From 27535e9ccae89db5856bfb5e3357f44645812143 Mon Sep 17 00:00:00 2001
From: Xin Wang <wangxinxin.wang@huawei.com>
Date: Tue, 19 Aug 2025 22:58:34 +0800
Subject: [PATCH 0001/2396] target/i386: Add support for save/load of exception
 error code

For now, qemu save/load CPU exception info(such as exception_nr and
has_error_code), while the exception error_code is ignored. This will
cause the dest hypervisor reinject a vCPU exception with error_code(0),
potentially causing a guest kernel panic.

For instance, if src VM stopped with an user-mode write #PF (error_code 6),
the dest hypervisor will reinject an #PF with error_code(0) when vCPU resume,
then guest kernel panic as:
  BUG: unable to handle page fault for address: 00007f80319cb010
  #PF: supervisor read access in user mode
  #PF: error_code(0x0000) - not-present page
  RIP: 0033:0x40115d

To fix it, support save/load exception error_code.

Signed-off-by: Xin Wang <wangxinxin.wang@huawei.com>
Link: https://lore.kernel.org/r/20250819145834.3998-1-wangxinxin.wang@huawei.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/machine.c | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/target/i386/machine.c b/target/i386/machine.c
index dd2dac1d44..45b7cea80a 100644
--- a/target/i386/machine.c
+++ b/target/i386/machine.c
@@ -462,6 +462,24 @@ static const VMStateDescription vmstate_exception_info = {
     }
 };
 
+static bool cpu_errcode_needed(void *opaque)
+{
+    X86CPU *cpu = opaque;
+
+    return cpu->env.has_error_code != 0;
+}
+
+static const VMStateDescription vmstate_error_code = {
+    .name = "cpu/error_code",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = cpu_errcode_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_INT32(env.error_code, X86CPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 /* Poll control MSR enabled by default */
 static bool poll_control_msr_needed(void *opaque)
 {
@@ -1746,6 +1764,7 @@ const VMStateDescription vmstate_x86_cpu = {
     },
     .subsections = (const VMStateDescription * const []) {
         &vmstate_exception_info,
+        &vmstate_error_code,
         &vmstate_async_pf_msr,
         &vmstate_async_pf_int_msr,
         &vmstate_pv_eoi_msr,

From a9292b24c35ca40da5bc4b2fd7fcf898b08dcce9 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Wed, 20 Aug 2025 23:41:56 +0300
Subject: [PATCH 0002/2396] scripts/minikconf.py: fix invalid attribute access

Fix parse method to use `defconfig` global variable instead of the
non-existent KconfigParser class attribute

Fixes: f349474920d80838ecea3d421531fdb0660b8740 ("minikconfig: implement allnoconfig and defconfig modes")
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250820-scripts-minikconf-fixes-v1-1-252041a9125e@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/minikconf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/minikconf.py b/scripts/minikconf.py
index 6f7f43b291..2a4694fb6a 100644
--- a/scripts/minikconf.py
+++ b/scripts/minikconf.py
@@ -340,7 +340,7 @@ class KconfigParser:
 
     @classmethod
     def parse(self, fp, mode=None):
-        data = KconfigData(mode or KconfigParser.defconfig)
+        data = KconfigData(mode or defconfig)
         parser = KconfigParser(data)
         parser.parse_file(fp)
         return data

From d84082cc1a7a7cac361094fc9b3165df7c697a01 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Wed, 20 Aug 2025 23:41:57 +0300
Subject: [PATCH 0003/2396] scripts/minikconf.py: s/Error/KconfigParserError

Error is not defined in this script, raise KconfigParserError instead.

Fixes: 82f5181777ebe04b550fd94a1d04c49dd3f012dc ("kconfig: introduce kconfig files")
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250820-scripts-minikconf-fixes-v1-2-252041a9125e@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/minikconf.py | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/scripts/minikconf.py b/scripts/minikconf.py
index 2a4694fb6a..4de5aeed11 100644
--- a/scripts/minikconf.py
+++ b/scripts/minikconf.py
@@ -363,7 +363,9 @@ class KconfigParser:
 
     def do_assignment(self, var, val):
         if not var.startswith("CONFIG_"):
-            raise Error('assigned variable should start with CONFIG_')
+            raise KconfigParserError(
+                self, "assigned variable should start with CONFIG_"
+            )
         var = self.data.do_var(var[7:])
         self.data.do_assignment(var, val)
 

From ab85146ac4c6527d6d975afbd3157488cb42147f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 22 Aug 2025 10:46:05 +0200
Subject: [PATCH 0004/2396] python: mkvenv: fix messages printed by mkvenv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The new Matcher class does not have a __str__ implementation, and therefore
it prints the debugging representation of the internal object:

  $ ../configure --enable-rust && make qemu-system-arm --enable-download
  python determined to be '/usr/bin/python3'
  python version: Python 3.13.6
  mkvenv: Creating non-isolated virtual environment at 'pyvenv'
  mkvenv: checking for LegacyMatcher('meson>=1.5.0')
  mkvenv: checking for LegacyMatcher('pycotap>=1.1.0')

Add the method to print the nicer

  mkvenv: checking for meson>=1.5.0
  mkvenv: checking for pycotap>=1.1.0

Cc: qemu-stable@nongnu.org
Cc: John Snow <jsnow@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 python/scripts/mkvenv.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index f102527c4d..9aed266df1 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -184,6 +184,10 @@ class Matcher:
             )
         )
 
+    def __str__(self) -> str:
+        """String representation delegated to the backend."""
+        return str(self._m)
+
     def __repr__(self) -> str:
         """Stable debug representation delegated to the backend."""
         return repr(self._m)

From 6f8924163ff1fb4bd19e0cd9dc7910bb540486f3 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 19 Aug 2025 17:42:16 +0200
Subject: [PATCH 0005/2396] MAINTAINERS: add a few more files to "Top Level
 Makefile and configure"

A few files in scripts, and the list of packages in pythondeps.toml, are
strictly related to the toplevel build scripts.  Add them to the
MAINTAINERS file stanza.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index a07086ed76..0f3e55b51e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4392,7 +4392,6 @@ R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: meson.build
 F: meson_options.txt
-F: scripts/meson-buildoptions.*
 F: scripts/check_sparse.py
 F: scripts/symlink-install-tree.py
 
@@ -4403,6 +4402,9 @@ R: Thomas Huth <thuth@redhat.com>
 S: Maintained
 F: Makefile
 F: configure
+F: pythondeps.toml
+F: scripts/git-submodule.sh
+F: scripts/meson-buildoptions.*
 F: scripts/mtest2make.py
 F: tests/Makefile.include
 

From e771ba98de25c9f43959f79fc7099cf7fbba44cc Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 26 Aug 2025 14:10:25 -0400
Subject: [PATCH 0006/2396] Open 10.2 development tree

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 4149c39eec..9856be5dd9 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.0
+10.1.50

From d96519c6bd1e197f24a157ec761ff69cf54779d3 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Tue, 5 Aug 2025 11:56:16 +0200
Subject: [PATCH 0007/2396] hw: add compat machines for 10.2

Add 10.2 machine types for arm/i440fx/m68k/q35/s390x/spapr.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250805095616.1168905-1-cohuck@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/arm/virt.c              | 11 +++++++++--
 hw/core/machine.c          |  3 +++
 hw/i386/pc.c               |  3 +++
 hw/i386/pc_piix.c          | 13 +++++++++++--
 hw/i386/pc_q35.c           | 13 +++++++++++--
 hw/m68k/virt.c             | 11 +++++++++--
 hw/ppc/spapr.c             | 17 ++++++++++++++---
 hw/s390x/s390-virtio-ccw.c | 14 +++++++++++++-
 include/hw/boards.h        |  3 +++
 include/hw/i386/pc.h       |  3 +++
 10 files changed, 79 insertions(+), 12 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index ef6be3660f..9326cfc895 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3455,10 +3455,17 @@ static void machvirt_machine_init(void)
 }
 type_init(machvirt_machine_init);
 
-static void virt_machine_10_1_options(MachineClass *mc)
+static void virt_machine_10_2_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(10, 1)
+DEFINE_VIRT_MACHINE_AS_LATEST(10, 2)
+
+static void virt_machine_10_1_options(MachineClass *mc)
+{
+    virt_machine_10_2_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
+}
+DEFINE_VIRT_MACHINE(10, 1)
 
 static void virt_machine_10_0_options(MachineClass *mc)
 {
diff --git a/hw/core/machine.c b/hw/core/machine.c
index bd47527479..38c949c4f2 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -37,6 +37,9 @@
 #include "hw/virtio/virtio-iommu.h"
 #include "audio/audio.h"
 
+GlobalProperty hw_compat_10_1[] = {};
+const size_t hw_compat_10_1_len = G_N_ELEMENTS(hw_compat_10_1);
+
 GlobalProperty hw_compat_10_0[] = {
     { "scsi-hd", "dpofua", "off" },
     { "vfio-pci", "x-migration-load-config-after-iter", "off" },
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 2f58e73d33..bc048a6d13 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -81,6 +81,9 @@
     { "qemu64-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },\
     { "athlon-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },
 
+GlobalProperty pc_compat_10_1[] = {};
+const size_t pc_compat_10_1_len = G_N_ELEMENTS(pc_compat_10_1);
+
 GlobalProperty pc_compat_10_0[] = {
     { TYPE_X86_CPU, "x-consistent-cache", "false" },
     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index c03324281b..d165ac72ed 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -504,12 +504,21 @@ static void pc_i440fx_machine_options(MachineClass *m)
                      pc_piix_compat_defaults, pc_piix_compat_defaults_len);
 }
 
-static void pc_i440fx_machine_10_1_options(MachineClass *m)
+static void pc_i440fx_machine_10_2_options(MachineClass *m)
 {
     pc_i440fx_machine_options(m);
 }
 
-DEFINE_I440FX_MACHINE_AS_LATEST(10, 1);
+DEFINE_I440FX_MACHINE_AS_LATEST(10, 2);
+
+static void pc_i440fx_machine_10_1_options(MachineClass *m)
+{
+    pc_i440fx_machine_10_2_options(m);
+    compat_props_add(m->compat_props, hw_compat_10_1, hw_compat_10_1_len);
+    compat_props_add(m->compat_props, pc_compat_10_1, pc_compat_10_1_len);
+}
+
+DEFINE_I440FX_MACHINE(10, 1);
 
 static void pc_i440fx_machine_10_0_options(MachineClass *m)
 {
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index b309b2b378..e89951285e 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -374,12 +374,21 @@ static void pc_q35_machine_options(MachineClass *m)
                      pc_q35_compat_defaults, pc_q35_compat_defaults_len);
 }
 
-static void pc_q35_machine_10_1_options(MachineClass *m)
+static void pc_q35_machine_10_2_options(MachineClass *m)
 {
     pc_q35_machine_options(m);
 }
 
-DEFINE_Q35_MACHINE_AS_LATEST(10, 1);
+DEFINE_Q35_MACHINE_AS_LATEST(10, 2);
+
+static void pc_q35_machine_10_1_options(MachineClass *m)
+{
+    pc_q35_machine_10_2_options(m);
+    compat_props_add(m->compat_props, hw_compat_10_1, hw_compat_10_1_len);
+    compat_props_add(m->compat_props, pc_compat_10_1, pc_compat_10_1_len);
+}
+
+DEFINE_Q35_MACHINE(10, 1);
 
 static void pc_q35_machine_10_0_options(MachineClass *m)
 {
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 875fd00ef8..98cfe43c73 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -367,10 +367,17 @@ type_init(virt_machine_register_types)
 #define DEFINE_VIRT_MACHINE(major, minor) \
     DEFINE_VIRT_MACHINE_IMPL(false, major, minor)
 
-static void virt_machine_10_1_options(MachineClass *mc)
+static void virt_machine_10_2_options(MachineClass *mc)
 {
 }
-DEFINE_VIRT_MACHINE_AS_LATEST(10, 1)
+DEFINE_VIRT_MACHINE_AS_LATEST(10, 2)
+
+static void virt_machine_10_1_options(MachineClass *mc)
+{
+    virt_machine_10_2_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
+}
+DEFINE_VIRT_MACHINE(10, 1)
 
 static void virt_machine_10_0_options(MachineClass *mc)
 {
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 1855a3cd8d..eb22333404 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4762,14 +4762,25 @@ static void spapr_machine_latest_class_options(MachineClass *mc)
     DEFINE_SPAPR_MACHINE_IMPL(false, major, minor)
 
 /*
- * pseries-10.1
+ * pseries-10.2
  */
-static void spapr_machine_10_1_class_options(MachineClass *mc)
+static void spapr_machine_10_2_class_options(MachineClass *mc)
 {
     /* Defaults for the latest behaviour inherited from the base class */
 }
 
-DEFINE_SPAPR_MACHINE_AS_LATEST(10, 1);
+DEFINE_SPAPR_MACHINE_AS_LATEST(10, 2);
+
+/*
+ * pseries-10.1
+ */
+static void spapr_machine_10_1_class_options(MachineClass *mc)
+{
+    spapr_machine_10_2_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
+}
+
+DEFINE_SPAPR_MACHINE(10, 1);
 
 /*
  * pseries-10.0
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index a79bd13275..d0c6e80cb0 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -911,14 +911,26 @@ static const TypeInfo ccw_machine_info = {
     DEFINE_CCW_MACHINE_IMPL(false, major, minor)
 
 
+static void ccw_machine_10_2_instance_options(MachineState *machine)
+{
+}
+
+static void ccw_machine_10_2_class_options(MachineClass *mc)
+{
+}
+DEFINE_CCW_MACHINE_AS_LATEST(10, 2);
+
 static void ccw_machine_10_1_instance_options(MachineState *machine)
 {
+    ccw_machine_10_2_instance_options(machine);
 }
 
 static void ccw_machine_10_1_class_options(MachineClass *mc)
 {
+    ccw_machine_10_2_class_options(mc);
+    compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
 }
-DEFINE_CCW_MACHINE_AS_LATEST(10, 1);
+DEFINE_CCW_MACHINE(10, 1);
 
 static void ccw_machine_10_0_instance_options(MachineState *machine)
 {
diff --git a/include/hw/boards.h b/include/hw/boards.h
index f94713e6e2..665b620121 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -779,6 +779,9 @@ struct MachineState {
     } \
     type_init(machine_initfn##_register_types)
 
+extern GlobalProperty hw_compat_10_1[];
+extern const size_t hw_compat_10_1_len;
+
 extern GlobalProperty hw_compat_10_0[];
 extern const size_t hw_compat_10_0_len;
 
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 79b72c54dd..e83157ab35 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -214,6 +214,9 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size);
 /* sgx.c */
 void pc_machine_init_sgx_epc(PCMachineState *pcms);
 
+extern GlobalProperty pc_compat_10_1[];
+extern const size_t pc_compat_10_1_len;
+
 extern GlobalProperty pc_compat_10_0[];
 extern const size_t pc_compat_10_0_len;
 

From fe26463d7b3e0f65de4b11377d762d5dcc03bd24 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Wed, 6 Aug 2025 22:09:09 +0200
Subject: [PATCH 0008/2396] CI: Use mingw-w64-x86_64-curl-winssl instead of
 mingw-w64-x86_64-curl for Windows build

mingw-w64-x86_64-curl-winssl is required for https connections.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250806200909.507803-1-sw@weilnetz.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 45ed0c96fe..beac39e5bd 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -77,7 +77,7 @@ msys2-64bit:
       git grep make sed
       mingw-w64-x86_64-binutils
       mingw-w64-x86_64-ccache
-      mingw-w64-x86_64-curl
+      mingw-w64-x86_64-curl-winssl
       mingw-w64-x86_64-gcc
       mingw-w64-x86_64-glib2
       mingw-w64-x86_64-libnfs

From 19ae064832dd915e14306c03b94a505abc13b873 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 26 Aug 2025 13:34:55 +0100
Subject: [PATCH 0009/2396] tests/functional/test_aarch64_virt_gpu: Skip test
 if EGL won't initialize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you are using the Nvidia drivers and have installed new versions
of those packages but have not yet rebooted the host kernel,
attempting to use the egl-headless display will cause QEMU to fail to
start with

$ qemu-system-aarch64 -M virt -display egl-headless
qemu-system-aarch64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
qemu-system-aarch64: egl: render node init failed

together with this complaint in the host kernel dmesg:

[7874777.555649] NVRM: API mismatch: the client has the version 535.247.01, but
                 NVRM: this kernel module has the version 535.230.02.  Please
                 NVRM: make sure that this kernel module and all NVIDIA driver
                 NVRM: components have the same version.

This isn't a problem with QEMU itself, so reporting this as a test
failure is misleading.  Instead skip the tests, as we already do for
various other kinds of "host system can't actually run the EGL
display" situation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20250826123455.2856988-1-peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_aarch64_virt_gpu.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/functional/test_aarch64_virt_gpu.py b/tests/functional/test_aarch64_virt_gpu.py
index 3844727857..4e50887c3e 100755
--- a/tests/functional/test_aarch64_virt_gpu.py
+++ b/tests/functional/test_aarch64_virt_gpu.py
@@ -76,6 +76,8 @@ class Aarch64VirtGPUMachine(LinuxKernelTest):
                 self.skipTest("egl-headless support is not available")
             elif "'type' does not accept value 'dbus'" in excp.output:
                 self.skipTest("dbus display support is not available")
+            elif "eglInitialize failed: EGL_NOT_INITIALIZED" in excp.output:
+                self.skipTest("EGL failed to initialize on this host")
             else:
                 self.log.info("unhandled launch failure: %s", excp.output)
                 raise excp

From 36fb9796662e8d1f8626b1cacb1a6d5e35a8bd00 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Wed, 27 Aug 2025 00:10:08 +0000
Subject: [PATCH 0010/2396] tests/functional: Fix reverse_debugging asset
 precaching

This commit fixes the asset precaching in the reverse_debugging test on
aarch64.

QemuBaseTest.main() precaches assets (kernel, rootfs, DT blobs, etc.)
that are defined in variables with the ASSET_ prefix. This works because
it ultimately calls Asset.precache_test(), which relies on introspection
to locate these variables.

If an asset variable is not named with the ASSET_ prefix, precache_test
cannot find the asset and precaching silently fails. Hence, fix the
asset precaching by fixing the asset variable name.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20250827001008.22112-1-gustavo.romero@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/test_aarch64_reverse_debug.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/test_aarch64_reverse_debug.py b/tests/functional/test_aarch64_reverse_debug.py
index 58d4532835..8bc91ccfde 100755
--- a/tests/functional/test_aarch64_reverse_debug.py
+++ b/tests/functional/test_aarch64_reverse_debug.py
@@ -21,7 +21,7 @@ class ReverseDebugging_AArch64(ReverseDebugging):
 
     REG_PC = 32
 
-    KERNEL_ASSET = Asset(
+    ASSET_KERNEL = Asset(
         ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
          'releases/29/Everything/aarch64/os/images/pxeboot/vmlinuz'),
         '7e1430b81c26bdd0da025eeb8fbd77b5dc961da4364af26e771bd39f379cbbf7')
@@ -30,7 +30,7 @@ class ReverseDebugging_AArch64(ReverseDebugging):
     def test_aarch64_virt(self):
         self.set_machine('virt')
         self.cpu = 'cortex-a53'
-        kernel_path = self.KERNEL_ASSET.fetch()
+        kernel_path = self.ASSET_KERNEL.fetch()
         self.reverse_debugging(args=('-kernel', kernel_path))
 
 

From 0cdabf8adbaca4b370301366faab2d01121289c7 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 21 Aug 2025 11:47:35 +0200
Subject: [PATCH 0011/2396] tests/functional: Use more fine-grained locking
 when looking for free ports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, we have one lock that is held while a test is looking for
free ports. However, we are also using different ranges for looking
for free ports nowadays (PORTS_START is based on the PID of the process),
so instead of using only one lock, we should rather use a lock per
range instead. This should help to allow running more tests in parallel.

While we're at it, also create the lock files without executable bit
(mode is 0o777 by default).

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250821094735.804210-1-thuth@redhat.com>
---
 tests/functional/qemu_test/ports.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/functional/qemu_test/ports.py b/tests/functional/qemu_test/ports.py
index 631b77abf6..81174a6153 100644
--- a/tests/functional/qemu_test/ports.py
+++ b/tests/functional/qemu_test/ports.py
@@ -23,8 +23,9 @@ class Ports():
     PORTS_END = PORTS_START + PORTS_RANGE_SIZE
 
     def __enter__(self):
-        lock_file = os.path.join(BUILD_DIR, "tests", "functional", "port_lock")
-        self.lock_fh = os.open(lock_file, os.O_CREAT)
+        lock_file = os.path.join(BUILD_DIR, "tests", "functional",
+                                 f".port_lock.{self.PORTS_START}")
+        self.lock_fh = os.open(lock_file, os.O_CREAT, mode=0o666)
         fcntl.flock(self.lock_fh, fcntl.LOCK_EX)
         return self
 

From 9845740a162f2d9a4c852068155e94f1a3c487f9 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:38 +0200
Subject: [PATCH 0012/2396] tests/functional: Rework the migration test to have
 target-specific files

We are going to move the tests for each target into separate subdirectories.
The migration test does not fit quite into this scheme, since it works
for multiple targets, but not all. Rework the test to have a common
test class, and target specific files with a target specific class, so
that this will fit better into the new scheme.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-2-thuth@redhat.com>
---
 MAINTAINERS                                   |  2 +-
 tests/functional/meson.build                  | 22 ++++++------
 .../{test_migration.py => migration.py}       | 35 +++++--------------
 tests/functional/test_aarch64_migration.py    | 26 ++++++++++++++
 tests/functional/test_alpha_migration.py      | 26 ++++++++++++++
 tests/functional/test_arm_migration.py        | 26 ++++++++++++++
 tests/functional/test_i386_migration.py       | 26 ++++++++++++++
 tests/functional/test_ppc64_migration.py      | 26 ++++++++++++++
 tests/functional/test_ppc_migration.py        | 26 ++++++++++++++
 tests/functional/test_riscv32_migration.py    | 26 ++++++++++++++
 tests/functional/test_riscv64_migration.py    | 26 ++++++++++++++
 tests/functional/test_sparc64_migration.py    | 26 ++++++++++++++
 tests/functional/test_sparc_migration.py      | 26 ++++++++++++++
 tests/functional/test_x86_64_migration.py     | 26 ++++++++++++++
 14 files changed, 306 insertions(+), 39 deletions(-)
 rename tests/functional/{test_migration.py => migration.py} (74%)
 mode change 100755 => 100644
 create mode 100755 tests/functional/test_aarch64_migration.py
 create mode 100755 tests/functional/test_alpha_migration.py
 create mode 100755 tests/functional/test_arm_migration.py
 create mode 100755 tests/functional/test_i386_migration.py
 create mode 100755 tests/functional/test_ppc64_migration.py
 create mode 100755 tests/functional/test_ppc_migration.py
 create mode 100755 tests/functional/test_riscv32_migration.py
 create mode 100755 tests/functional/test_riscv64_migration.py
 create mode 100755 tests/functional/test_sparc64_migration.py
 create mode 100755 tests/functional/test_sparc_migration.py
 create mode 100755 tests/functional/test_x86_64_migration.py

diff --git a/MAINTAINERS b/MAINTAINERS
index a07086ed76..56c1fe6769 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3597,7 +3597,7 @@ F: include/migration/
 F: include/qemu/userfaultfd.h
 F: migration/
 F: scripts/vmstate-static-checker.py
-F: tests/functional/test_migration.py
+F: tests/functional/*migration.py
 F: tests/vmstate-static-checker-data/
 F: tests/qtest/migration/
 F: tests/qtest/migration-*
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 311c6f1806..c32436d99a 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -80,7 +80,7 @@ tests_generic_bsduser = [
 ]
 
 tests_aarch64_system_quick = [
-  'migration',
+  'aarch64_migration',
 ]
 
 tests_aarch64_system_thorough = [
@@ -110,7 +110,7 @@ tests_aarch64_system_thorough = [
 ]
 
 tests_alpha_system_quick = [
-  'migration',
+  'alpha_migration',
 ]
 
 tests_alpha_system_thorough = [
@@ -119,7 +119,7 @@ tests_alpha_system_thorough = [
 ]
 
 tests_arm_system_quick = [
-  'migration',
+  'arm_migration',
 ]
 
 tests_arm_system_thorough = [
@@ -168,7 +168,7 @@ tests_hppa_system_quick = [
 ]
 
 tests_i386_system_quick = [
-  'migration',
+  'i386_migration',
 ]
 
 tests_i386_system_thorough = [
@@ -228,7 +228,7 @@ tests_or1k_system_thorough = [
 ]
 
 tests_ppc_system_quick = [
-  'migration',
+  'ppc_migration',
   'ppc_74xx',
 ]
 
@@ -245,7 +245,7 @@ tests_ppc_system_thorough = [
 ]
 
 tests_ppc64_system_quick = [
-  'migration',
+  'ppc64_migration',
 ]
 
 tests_ppc64_system_thorough = [
@@ -260,7 +260,7 @@ tests_ppc64_system_thorough = [
 ]
 
 tests_riscv32_system_quick = [
-  'migration',
+  'riscv32_migration',
   'riscv_opensbi',
 ]
 
@@ -269,7 +269,7 @@ tests_riscv32_system_thorough = [
 ]
 
 tests_riscv64_system_quick = [
-  'migration',
+  'riscv64_migration',
   'riscv_opensbi',
 ]
 
@@ -300,7 +300,7 @@ tests_sh4eb_system_thorough = [
 ]
 
 tests_sparc_system_quick = [
-  'migration',
+  'sparc_migration',
 ]
 
 tests_sparc_system_thorough = [
@@ -309,7 +309,7 @@ tests_sparc_system_thorough = [
 ]
 
 tests_sparc64_system_quick = [
-  'migration',
+  'sparc64_migration',
 ]
 
 tests_sparc64_system_thorough = [
@@ -320,7 +320,7 @@ tests_sparc64_system_thorough = [
 tests_x86_64_system_quick = [
   'cpu_queries',
   'mem_addr_space',
-  'migration',
+  'x86_64_migration',
   'pc_cpu_hotplug_props',
   'virtio_version',
   'x86_cpu_model_versions',
diff --git a/tests/functional/test_migration.py b/tests/functional/migration.py
old mode 100755
new mode 100644
similarity index 74%
rename from tests/functional/test_migration.py
rename to tests/functional/migration.py
index c4393c3543..0739554483
--- a/tests/functional/test_migration.py
+++ b/tests/functional/migration.py
@@ -1,6 +1,6 @@
-#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-or-later
 #
-# Migration test
+# Migration test base class
 #
 # Copyright (c) 2019 Red Hat, Inc.
 #
@@ -14,7 +14,7 @@
 import tempfile
 import time
 
-from qemu_test import QemuSystemTest, skipIfMissingCommands
+from qemu_test import QemuSystemTest, which
 from qemu_test.ports import Ports
 
 
@@ -41,24 +41,7 @@ class MigrationTest(QemuSystemTest):
         self.assertEqual(dst_vm.cmd('query-status')['status'], 'running')
         self.assertEqual(src_vm.cmd('query-status')['status'],'postmigrate')
 
-    def select_machine(self):
-        target_machine = {
-            'aarch64': 'quanta-gsj',
-            'alpha': 'clipper',
-            'arm': 'npcm750-evb',
-            'i386': 'isapc',
-            'ppc': 'sam460ex',
-            'ppc64': 'mac99',
-            'riscv32': 'spike',
-            'riscv64': 'virt',
-            'sparc': 'SS-4',
-            'sparc64': 'sun4u',
-            'x86_64': 'microvm',
-        }
-        self.set_machine(target_machine[self.arch])
-
     def do_migrate(self, dest_uri, src_uri=None):
-        self.select_machine()
         dest_vm = self.get_vm('-incoming', dest_uri, name="dest-qemu")
         dest_vm.add_args('-nodefaults')
         dest_vm.launch()
@@ -76,23 +59,21 @@ class MigrationTest(QemuSystemTest):
             self.skipTest('Failed to find a free port')
         return port
 
-    def test_migration_with_tcp_localhost(self):
+    def migration_with_tcp_localhost(self):
         with Ports() as ports:
             dest_uri = 'tcp:localhost:%u' % self._get_free_port(ports)
             self.do_migrate(dest_uri)
 
-    def test_migration_with_unix(self):
+    def migration_with_unix(self):
         with tempfile.TemporaryDirectory(prefix='socket_') as socket_path:
             dest_uri = 'unix:%s/qemu-test.sock' % socket_path
             self.do_migrate(dest_uri)
 
-    @skipIfMissingCommands('ncat')
-    def test_migration_with_exec(self):
+    def migration_with_exec(self):
+        if not which('ncat'):
+            self.skipTest('ncat is not available')
         with Ports() as ports:
             free_port = self._get_free_port(ports)
             dest_uri = 'exec:ncat -l localhost %u' % free_port
             src_uri = 'exec:ncat localhost %u' % free_port
             self.do_migrate(dest_uri, src_uri)
-
-if __name__ == '__main__':
-    QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_migration.py b/tests/functional/test_aarch64_migration.py
new file mode 100755
index 0000000000..70267e756d
--- /dev/null
+++ b/tests/functional/test_aarch64_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# aarch64 migration test
+
+from migration import MigrationTest
+
+
+class Aarch64MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('quanta-gsj')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('quanta-gsj')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('quanta-gsj')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_alpha_migration.py b/tests/functional/test_alpha_migration.py
new file mode 100755
index 0000000000..f11b523ec9
--- /dev/null
+++ b/tests/functional/test_alpha_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Alpha migration test
+
+from migration import MigrationTest
+
+
+class AlphaMigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('clipper')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('clipper')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('clipper')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_arm_migration.py b/tests/functional/test_arm_migration.py
new file mode 100755
index 0000000000..0aa89f4f61
--- /dev/null
+++ b/tests/functional/test_arm_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# arm migration test
+
+from migration import MigrationTest
+
+
+class ArmMigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('npcm750-evb')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('npcm750-evb')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('npcm750-evb')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_i386_migration.py b/tests/functional/test_i386_migration.py
new file mode 100755
index 0000000000..a57f316404
--- /dev/null
+++ b/tests/functional/test_i386_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# i386 migration test
+
+from migration import MigrationTest
+
+
+class I386MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('isapc')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('isapc')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('isapc')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_ppc64_migration.py b/tests/functional/test_ppc64_migration.py
new file mode 100755
index 0000000000..5dfdaaf709
--- /dev/null
+++ b/tests/functional/test_ppc64_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# ppc migration test
+
+from migration import MigrationTest
+
+
+class PpcMigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('mac99')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('mac99')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('mac99')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_ppc_migration.py b/tests/functional/test_ppc_migration.py
new file mode 100755
index 0000000000..a8692826d3
--- /dev/null
+++ b/tests/functional/test_ppc_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# ppc migration test
+
+from migration import MigrationTest
+
+
+class PpcMigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('sam460ex')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('sam460ex')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('sam460ex')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_riscv32_migration.py b/tests/functional/test_riscv32_migration.py
new file mode 100755
index 0000000000..30acbbe69f
--- /dev/null
+++ b/tests/functional/test_riscv32_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# riscv32 migration test
+
+from migration import MigrationTest
+
+
+class Rv32MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('spike')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('virt')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('spike')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_riscv64_migration.py b/tests/functional/test_riscv64_migration.py
new file mode 100755
index 0000000000..2d613a29ec
--- /dev/null
+++ b/tests/functional/test_riscv64_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# riscv64 migration test
+
+from migration import MigrationTest
+
+
+class Rv64MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('virt')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('spike')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('virt')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_sparc64_migration.py b/tests/functional/test_sparc64_migration.py
new file mode 100755
index 0000000000..a8a6c73c35
--- /dev/null
+++ b/tests/functional/test_sparc64_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Sparc64 migration test
+
+from migration import MigrationTest
+
+
+class Sparc64MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('sun4u')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('sun4u')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('sun4u')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_sparc_migration.py b/tests/functional/test_sparc_migration.py
new file mode 100755
index 0000000000..dd6d5783b1
--- /dev/null
+++ b/tests/functional/test_sparc_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Sparc migration test
+
+from migration import MigrationTest
+
+
+class SparcMigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('SS-4')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('SS-5')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('SS-4')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()
diff --git a/tests/functional/test_x86_64_migration.py b/tests/functional/test_x86_64_migration.py
new file mode 100755
index 0000000000..f3a517ae1f
--- /dev/null
+++ b/tests/functional/test_x86_64_migration.py
@@ -0,0 +1,26 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# x86_64 migration test
+
+from migration import MigrationTest
+
+
+class X8664MigrationTest(MigrationTest):
+
+    def test_migration_with_tcp_localhost(self):
+        self.set_machine('microvm')
+        self.migration_with_tcp_localhost()
+
+    def test_migration_with_unix(self):
+        self.set_machine('microvm')
+        self.migration_with_unix()
+
+    def test_migration_with_exec(self):
+        self.set_machine('microvm')
+        self.migration_with_exec()
+
+
+if __name__ == '__main__':
+    MigrationTest.main()

From b19c560e4ac730799f45730020fae63e4727a8e0 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:39 +0200
Subject: [PATCH 0013/2396] tests/functional: Rework the multiprocess test to
 have target-specific files

We are going to move the tests for each target into separate subdirectories.
The multiprocess test currently contains code for both, x86 and aarch64,
so it does not quite fit into this scheme. Rework the test to have a common
test class, and target specific files with a target specific class, so
that this will fit better into the new scheme.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-3-thuth@redhat.com>
---
 MAINTAINERS                                   |  2 +-
 tests/functional/meson.build                  |  4 +-
 .../{test_multiprocess.py => multiprocess.py} | 40 +------------------
 tests/functional/test_aarch64_multiprocess.py | 31 ++++++++++++++
 tests/functional/test_x86_64_multiprocess.py  | 31 ++++++++++++++
 5 files changed, 67 insertions(+), 41 deletions(-)
 rename tests/functional/{test_multiprocess.py => multiprocess.py} (58%)
 mode change 100755 => 100644
 create mode 100755 tests/functional/test_aarch64_multiprocess.py
 create mode 100755 tests/functional/test_x86_64_multiprocess.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 56c1fe6769..adbed9df2f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4286,7 +4286,7 @@ F: hw/remote/vfio-user-obj.c
 F: include/hw/remote/vfio-user-obj.h
 F: hw/remote/iommu.c
 F: include/hw/remote/iommu.h
-F: tests/functional/test_multiprocess.py
+F: tests/functional/*multiprocess.py
 
 VFIO-USER:
 M: John Levon <john.levon@nutanix.com>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index c32436d99a..38ae0d6cd3 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -90,6 +90,7 @@ tests_aarch64_system_thorough = [
   'aarch64_hotplug_pci',
   'aarch64_imx8mp_evk',
   'aarch64_kvm',
+  'aarch64_multiprocess',
   'aarch64_raspi3',
   'aarch64_raspi4',
   'aarch64_replay',
@@ -106,7 +107,6 @@ tests_aarch64_system_thorough = [
   'aarch64_virt_gpu',
   'aarch64_xen',
   'aarch64_xlnx_versal',
-  'multiprocess',
 ]
 
 tests_alpha_system_quick = [
@@ -332,7 +332,7 @@ tests_x86_64_system_thorough = [
   'acpi_bits',
   'intel_iommu',
   'linux_initrd',
-  'multiprocess',
+  'x86_64_multiprocess',
   'netdev_ethtool',
   'virtio_balloon',
   'virtio_gpu',
diff --git a/tests/functional/test_multiprocess.py b/tests/functional/multiprocess.py
old mode 100755
new mode 100644
similarity index 58%
rename from tests/functional/test_multiprocess.py
rename to tests/functional/multiprocess.py
index 92d5207b0e..6a06c1eda1
--- a/tests/functional/test_multiprocess.py
+++ b/tests/functional/multiprocess.py
@@ -1,4 +1,4 @@
-#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0-or-later
 #
 # Test for multiprocess qemu
 #
@@ -9,33 +9,13 @@
 import os
 import socket
 
-from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
+from qemu_test import QemuSystemTest, wait_for_console_pattern
 from qemu_test import exec_command, exec_command_and_wait_for_pattern
 
 class Multiprocess(QemuSystemTest):
 
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
 
-    ASSET_KERNEL_X86 = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
-         '/releases/31/Everything/x86_64/os/images/pxeboot/vmlinuz'),
-        'd4738d03dbbe083ca610d0821d0a8f1488bebbdccef54ce33e3adb35fda00129')
-
-    ASSET_INITRD_X86 = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
-         '/releases/31/Everything/x86_64/os/images/pxeboot/initrd.img'),
-        '3b6cb5c91a14c42e2f61520f1689264d865e772a1f0069e660a800d31dd61fb9')
-
-    ASSET_KERNEL_AARCH64 = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
-         '/releases/31/Everything/aarch64/os/images/pxeboot/vmlinuz'),
-        '3ae07fcafbfc8e4abeb693035a74fe10698faae15e9ccd48882a9167800c1527')
-
-    ASSET_INITRD_AARCH64 = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
-         '/releases/31/Everything/aarch64/os/images/pxeboot/initrd.img'),
-        '9fd230cab10b1dafea41cf00150e6669d37051fad133bd618d2130284e16d526')
-
     def do_test(self, kernel_asset, initrd_asset,
                 kernel_command_line, machine_type):
         """Main test method"""
@@ -85,19 +65,3 @@ class Multiprocess(QemuSystemTest):
 
         proxy_sock.close()
         remote_sock.close()
-
-    def test_multiprocess(self):
-        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE
-        if self.arch == 'x86_64':
-            kernel_command_line += 'console=ttyS0 rdinit=/bin/bash'
-            self.do_test(self.ASSET_KERNEL_X86, self.ASSET_INITRD_X86,
-                         kernel_command_line, 'pc')
-        elif self.arch == 'aarch64':
-            kernel_command_line += 'rdinit=/bin/bash console=ttyAMA0'
-            self.do_test(self.ASSET_KERNEL_AARCH64, self.ASSET_INITRD_AARCH64,
-                         kernel_command_line, 'virt,gic-version=3')
-        else:
-            assert False
-
-if __name__ == '__main__':
-    QemuSystemTest.main()
diff --git a/tests/functional/test_aarch64_multiprocess.py b/tests/functional/test_aarch64_multiprocess.py
new file mode 100755
index 0000000000..1c6e45ecb6
--- /dev/null
+++ b/tests/functional/test_aarch64_multiprocess.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Test for multiprocess qemu on aarch64
+
+from multiprocess import Multiprocess
+from qemu_test import Asset
+
+
+class Aarch64Multiprocess(Multiprocess):
+
+    ASSET_KERNEL_AARCH64 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
+         '/releases/31/Everything/aarch64/os/images/pxeboot/vmlinuz'),
+        '3ae07fcafbfc8e4abeb693035a74fe10698faae15e9ccd48882a9167800c1527')
+
+    ASSET_INITRD_AARCH64 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
+         '/releases/31/Everything/aarch64/os/images/pxeboot/initrd.img'),
+        '9fd230cab10b1dafea41cf00150e6669d37051fad133bd618d2130284e16d526')
+
+    def test_multiprocess(self):
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'rdinit=/bin/bash console=ttyAMA0')
+        self.do_test(self.ASSET_KERNEL_AARCH64, self.ASSET_INITRD_AARCH64,
+                     kernel_command_line, 'virt,gic-version=3')
+
+
+if __name__ == '__main__':
+    Multiprocess.main()
diff --git a/tests/functional/test_x86_64_multiprocess.py b/tests/functional/test_x86_64_multiprocess.py
new file mode 100755
index 0000000000..756629dd44
--- /dev/null
+++ b/tests/functional/test_x86_64_multiprocess.py
@@ -0,0 +1,31 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Test for multiprocess qemu on x86
+
+from multiprocess import Multiprocess
+from qemu_test import Asset
+
+
+class X86Multiprocess(Multiprocess):
+
+    ASSET_KERNEL_X86 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
+         '/releases/31/Everything/x86_64/os/images/pxeboot/vmlinuz'),
+        'd4738d03dbbe083ca610d0821d0a8f1488bebbdccef54ce33e3adb35fda00129')
+
+    ASSET_INITRD_X86 = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora/linux'
+         '/releases/31/Everything/x86_64/os/images/pxeboot/initrd.img'),
+        '3b6cb5c91a14c42e2f61520f1689264d865e772a1f0069e660a800d31dd61fb9')
+
+    def test_multiprocess(self):
+        kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
+                               'console=ttyS0 rdinit=/bin/bash')
+        self.do_test(self.ASSET_KERNEL_X86, self.ASSET_INITRD_X86,
+                     kernel_command_line, 'pc')
+
+
+if __name__ == '__main__':
+    Multiprocess.main()

From b8103f56d97c2e6554af2c365b366989005a666c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:40 +0200
Subject: [PATCH 0014/2396] tests/functional/meson.build: Split timeout
 settings by target

We are going to move these settings into target-specific subfolders.
As a first step, split the big test_timeouts array up into individual
ones.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-4-thuth@redhat.com>
---
 tests/functional/meson.build | 50 +++++++++++++++++++++++++++++++-----
 1 file changed, 44 insertions(+), 6 deletions(-)

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 38ae0d6cd3..356aad12de 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -10,7 +10,7 @@ if get_option('tcg_interpreter')
 endif
 
 # Timeouts for individual tests that can be slow e.g. with debugging enabled
-test_timeouts = {
+test_aarch64_timeouts = {
   'aarch64_aspeed_ast2700' : 600,
   'aarch64_aspeed_ast2700fc' : 600,
   'aarch64_device_passthrough' : 720,
@@ -25,7 +25,9 @@ test_timeouts = {
   'aarch64_tuxrun' : 240,
   'aarch64_virt' : 360,
   'aarch64_virt_gpu' : 480,
-  'acpi_bits' : 420,
+}
+
+test_arm_timeouts = {
   'arm_aspeed_palmetto' : 120,
   'arm_aspeed_romulus' : 120,
   'arm_aspeed_witherspoon' : 120,
@@ -44,24 +46,55 @@ test_timeouts = {
   'arm_replay' : 240,
   'arm_tuxrun' : 240,
   'arm_sx1' : 360,
-  'intel_iommu': 300,
+}
+
+test_mips_timeouts = {
   'mips_malta' : 480,
+}
+
+test_mipsel_timeouts = {
   'mipsel_malta' : 420,
   'mipsel_replay' : 480,
+}
+
+test_mips64_timeouts = {
   'mips64_malta' : 240,
+}
+
+test_mips64el_timeouts = {
   'mips64el_malta' : 420,
   'mips64el_replay' : 180,
-  'netdev_ethtool' : 180,
+}
+
+test_ppc_timeouts = {
   'ppc_40p' : 240,
+}
+
+test_ppc64_timeouts = {
   'ppc64_hv' : 1000,
   'ppc64_powernv' : 480,
   'ppc64_pseries' : 480,
   'ppc64_replay' : 210,
   'ppc64_tuxrun' : 420,
   'ppc64_mac99' : 120,
+}
+
+test_riscv64_timeouts = {
   'riscv64_tuxrun' : 120,
+}
+
+test_s390x_timeouts = {
   's390x_ccw_virtio' : 420,
+}
+
+test_sh4_timeouts = {
   'sh4_tuxrun' : 240,
+}
+
+test_x86_64_timeouts = {
+  'acpi_bits' : 420,
+  'intel_iommu': 300,
+  'netdev_ethtool' : 180,
   'virtio_balloon': 120,
   'x86_64_kvm_xen' : 180,
   'x86_64_replay' : 480,
@@ -404,6 +437,11 @@ foreach speed : ['quick', 'thorough']
                                build_by_default: false,
                                env: test_precache_env)
       precache_all += precache
+      if is_variable('test_' + target_base + '_timeouts')
+        time_out = get_variable('test_' + target_base + '_timeouts').get(test, 90)
+      else
+        time_out = 90
+      endif
 
       # Ideally we would add 'precache' to 'depends' here, such that
       # 'build_by_default: false' lets the pre-caching automatically
@@ -419,8 +457,8 @@ foreach speed : ['quick', 'thorough']
            env: test_env,
            args: [testpath],
            protocol: 'tap',
-           timeout: test_timeouts.get(test, 90),
-           priority: test_timeouts.get(test, 90),
+           timeout: time_out,
+           priority: time_out,
            suite: suites)
     endforeach
   endforeach

From 9c9efb1e36ddb2e636c7f6aafda49cddaee88a0c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:41 +0200
Subject: [PATCH 0015/2396] tests/functional/meson.build: Allow tests to reside
 in subfolders

We are going to move target-specific tests to subfolders that are
named after the target (and generic tests will be put into a "generic"
folder), so prepare the meson.build file to allow such locations, too.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-5-thuth@redhat.com>
---
 tests/functional/meson.build | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 356aad12de..8c24ac1cc2 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -423,7 +423,13 @@ foreach speed : ['quick', 'thorough']
 
     foreach test : target_tests
       testname = '@0@-@1@'.format(target_base, test)
-      testfile = 'test_' + test + '.py'
+      if fs.exists('test_' + test + '.py')
+        testfile = 'test_' + test + '.py'
+      elif fs.exists('generic' / 'test_' + test + '.py')
+        testfile = 'generic' / 'test_' + test + '.py'
+      else
+        testfile = target_base / 'test_' + test + '.py'
+      endif
       testpath = meson.current_source_dir() / testfile
       teststamp = testname + '.tstamp'
       test_precache_env = environment()

From 96ced85b0c5664426518ad43f0e423092fbee933 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:42 +0200
Subject: [PATCH 0016/2396] tests/functional: Move aarch64 tests into
 architecture specific folder

The tests/functional folder has become quite crowded already, some
restructuring would be helpful here. Thus move the aarch64 tests into
a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-6-thuth@redhat.com>
---
 MAINTAINERS                                   | 24 +++++-----
 tests/functional/aarch64/meson.build          | 48 +++++++++++++++++++
 .../test_aspeed_ast2700.py}                   |  0
 .../test_aspeed_ast2700fc.py}                 |  0
 .../test_device_passthrough.py}               |  0
 .../test_hotplug_pci.py}                      |  0
 .../test_imx8mp_evk.py}                       |  0
 .../test_kvm.py}                              |  0
 .../test_migration.py}                        |  0
 .../test_multiprocess.py}                     |  0
 .../test_raspi3.py}                           |  0
 .../test_raspi4.py}                           |  0
 .../test_replay.py}                           |  0
 .../test_reverse_debug.py}                    |  0
 .../test_rme_sbsaref.py}                      |  2 +-
 .../test_rme_virt.py}                         |  0
 .../test_sbsaref.py}                          |  0
 .../test_sbsaref_alpine.py}                   |  2 +-
 .../test_sbsaref_freebsd.py}                  |  2 +-
 .../test_smmu.py}                             |  0
 .../test_tcg_plugins.py}                      |  0
 .../test_tuxrun.py}                           |  0
 .../test_virt.py}                             |  0
 .../test_virt_gpu.py}                         |  0
 .../test_xen.py}                              |  0
 .../test_xlnx_versal.py}                      |  0
 tests/functional/meson.build                  | 48 +------------------
 27 files changed, 64 insertions(+), 62 deletions(-)
 create mode 100644 tests/functional/aarch64/meson.build
 rename tests/functional/{test_aarch64_aspeed_ast2700.py => aarch64/test_aspeed_ast2700.py} (100%)
 rename tests/functional/{test_aarch64_aspeed_ast2700fc.py => aarch64/test_aspeed_ast2700fc.py} (100%)
 rename tests/functional/{test_aarch64_device_passthrough.py => aarch64/test_device_passthrough.py} (100%)
 rename tests/functional/{test_aarch64_hotplug_pci.py => aarch64/test_hotplug_pci.py} (100%)
 rename tests/functional/{test_aarch64_imx8mp_evk.py => aarch64/test_imx8mp_evk.py} (100%)
 rename tests/functional/{test_aarch64_kvm.py => aarch64/test_kvm.py} (100%)
 rename tests/functional/{test_aarch64_migration.py => aarch64/test_migration.py} (100%)
 rename tests/functional/{test_aarch64_multiprocess.py => aarch64/test_multiprocess.py} (100%)
 rename tests/functional/{test_aarch64_raspi3.py => aarch64/test_raspi3.py} (100%)
 rename tests/functional/{test_aarch64_raspi4.py => aarch64/test_raspi4.py} (100%)
 rename tests/functional/{test_aarch64_replay.py => aarch64/test_replay.py} (100%)
 rename tests/functional/{test_aarch64_reverse_debug.py => aarch64/test_reverse_debug.py} (100%)
 rename tests/functional/{test_aarch64_rme_sbsaref.py => aarch64/test_rme_sbsaref.py} (98%)
 rename tests/functional/{test_aarch64_rme_virt.py => aarch64/test_rme_virt.py} (100%)
 rename tests/functional/{test_aarch64_sbsaref.py => aarch64/test_sbsaref.py} (100%)
 rename tests/functional/{test_aarch64_sbsaref_alpine.py => aarch64/test_sbsaref_alpine.py} (97%)
 rename tests/functional/{test_aarch64_sbsaref_freebsd.py => aarch64/test_sbsaref_freebsd.py} (97%)
 rename tests/functional/{test_aarch64_smmu.py => aarch64/test_smmu.py} (100%)
 rename tests/functional/{test_aarch64_tcg_plugins.py => aarch64/test_tcg_plugins.py} (100%)
 rename tests/functional/{test_aarch64_tuxrun.py => aarch64/test_tuxrun.py} (100%)
 rename tests/functional/{test_aarch64_virt.py => aarch64/test_virt.py} (100%)
 rename tests/functional/{test_aarch64_virt_gpu.py => aarch64/test_virt_gpu.py} (100%)
 rename tests/functional/{test_aarch64_xen.py => aarch64/test_xen.py} (100%)
 rename tests/functional/{test_aarch64_xlnx_versal.py => aarch64/test_xlnx_versal.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index adbed9df2f..a2a5ccea7b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -212,7 +212,7 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/smmu*
 F: include/hw/arm/smmu*
-F: tests/functional/test_aarch64_smmu.py
+F: tests/functional/aarch64/test_smmu.py
 
 AVR TCG CPUs
 M: Michael Rolnik <mrolnik@gmail.com>
@@ -874,7 +874,7 @@ F: include/hw/arm/fsl-imx8mp.h
 F: include/hw/misc/imx8mp_*.h
 F: include/hw/pci-host/fsl_imx8m_phy.h
 F: docs/system/arm/imx8mp-evk.rst
-F: tests/functional/test_aarch64_imx8mp_evk.py
+F: tests/functional/aarch64/test_imx8mp_evk.py
 F: tests/qtest/rs5c372-test.c
 
 MPS2 / MPS3
@@ -952,8 +952,7 @@ F: include/hw/arm/rasp*
 F: include/hw/*/bcm283*
 F: docs/system/arm/raspi.rst
 F: tests/functional/test_arm_raspi2.py
-F: tests/functional/test_aarch64_raspi3.py
-F: tests/functional/test_aarch64_raspi4.py
+F: tests/functional/aarch64/test_raspi*.py
 
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -993,7 +992,7 @@ F: hw/misc/sbsa_ec.c
 F: hw/watchdog/sbsa_gwdt.c
 F: include/hw/watchdog/sbsa_gwdt.h
 F: docs/system/arm/sbsa.rst
-F: tests/functional/test_aarch64_*sbsaref*.py
+F: tests/functional/aarch64/test_*sbsaref*.py
 
 Sharp SL-5500 (Collie) PDA
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -1063,8 +1062,8 @@ S: Maintained
 F: hw/arm/virt*
 F: include/hw/arm/virt.h
 F: docs/system/arm/virt.rst
-F: tests/functional/test_aarch64_*virt*.py
-F: tests/functional/test_aarch64_tuxrun.py
+F: tests/functional/aarch64/test_*virt*.py
+F: tests/functional/aarch64/test_tuxrun.py
 F: tests/functional/test_arm_tuxrun.py
 F: tests/functional/test_arm_virt.py
 
@@ -1096,7 +1095,7 @@ F: hw/display/dpcd.c
 F: include/hw/display/dpcd.h
 F: docs/system/arm/xlnx-versal-virt.rst
 F: docs/system/arm/xlnx-zcu102.rst
-F: tests/functional/test_aarch64_xlnx_versal.py
+F: tests/functional/aarch64/test_xlnx_versal.py
 
 Xilinx Versal OSPI
 M: Francisco Iglesias <francisco.iglesias@amd.com>
@@ -2109,7 +2108,7 @@ ARM PCI Hotplug
 M: Gustavo Romero <gustavo.romero@linaro.org>
 L: qemu-arm@nongnu.org
 S: Supported
-F: tests/functional/test_aarch64_hotplug_pci.py
+F: tests/functional/aarch64/test_hotplug_pci.py
 
 ACPI/SMBIOS
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -2263,6 +2262,7 @@ F: util/vfio-helpers.c
 F: include/hw/vfio/
 F: docs/devel/migration/vfio.rst
 F: qapi/vfio.json
+F: tests/functional/aarch64/test_device_passthrough.py
 
 vfio-igd
 M: Alex Williamson <alex.williamson@redhat.com>
@@ -2638,7 +2638,7 @@ M: Alex Bennée <alex.bennee@linaro.org>
 S: Maintained
 F: hw/core/guest-loader.c
 F: docs/system/guest-loader.rst
-F: tests/functional/test_aarch64_xen.py
+F: tests/functional/aarch64/test_xen.py
 
 Intel Hexadecimal Object File Loader
 M: Su Hang <suhang16@mails.ucas.ac.cn>
@@ -2707,7 +2707,7 @@ F: hw/display/virtio-gpu*
 F: hw/display/virtio-vga.*
 F: include/hw/virtio/virtio-gpu.h
 F: docs/system/devices/virtio-gpu.rst
-F: tests/functional/test_aarch64_virt_gpu.py
+F: tests/functional/aarch64/test_virt_gpu.py
 
 vhost-user-blk
 M: Raphael Norwitz <raphael@enfabrica.net>
@@ -3933,7 +3933,7 @@ S: Maintained
 F: docs/devel/tcg-plugins.rst
 F: plugins/
 F: tests/tcg/plugins/
-F: tests/functional/test_aarch64_tcg_plugins.py
+F: tests/functional/aarch64/test_tcg_plugins.py
 F: contrib/plugins/
 F: scripts/qemu-plugin-symbols.py
 
diff --git a/tests/functional/aarch64/meson.build b/tests/functional/aarch64/meson.build
new file mode 100644
index 0000000000..04846c6eb1
--- /dev/null
+++ b/tests/functional/aarch64/meson.build
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_aarch64_timeouts = {
+  'aspeed_ast2700' : 600,
+  'aspeed_ast2700fc' : 600,
+  'device_passthrough' : 720,
+  'imx8mp_evk' : 240,
+  'raspi4' : 480,
+  'reverse_debug' : 180,
+  'rme_virt' : 1200,
+  'rme_sbsaref' : 1200,
+  'sbsaref_alpine' : 1200,
+  'sbsaref_freebsd' : 720,
+  'smmu' : 720,
+  'tuxrun' : 240,
+  'virt' : 360,
+  'virt_gpu' : 480,
+}
+
+tests_aarch64_system_quick = [
+  'migration',
+]
+
+tests_aarch64_system_thorough = [
+  'aspeed_ast2700',
+  'aspeed_ast2700fc',
+  'device_passthrough',
+  'hotplug_pci',
+  'imx8mp_evk',
+  'kvm',
+  'multiprocess',
+  'raspi3',
+  'raspi4',
+  'replay',
+  'reverse_debug',
+  'rme_virt',
+  'rme_sbsaref',
+  'sbsaref',
+  'sbsaref_alpine',
+  'sbsaref_freebsd',
+  'smmu',
+  'tcg_plugins',
+  'tuxrun',
+  'virt',
+  'virt_gpu',
+  'xen',
+  'xlnx_versal',
+]
diff --git a/tests/functional/test_aarch64_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
similarity index 100%
rename from tests/functional/test_aarch64_aspeed_ast2700.py
rename to tests/functional/aarch64/test_aspeed_ast2700.py
diff --git a/tests/functional/test_aarch64_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
similarity index 100%
rename from tests/functional/test_aarch64_aspeed_ast2700fc.py
rename to tests/functional/aarch64/test_aspeed_ast2700fc.py
diff --git a/tests/functional/test_aarch64_device_passthrough.py b/tests/functional/aarch64/test_device_passthrough.py
similarity index 100%
rename from tests/functional/test_aarch64_device_passthrough.py
rename to tests/functional/aarch64/test_device_passthrough.py
diff --git a/tests/functional/test_aarch64_hotplug_pci.py b/tests/functional/aarch64/test_hotplug_pci.py
similarity index 100%
rename from tests/functional/test_aarch64_hotplug_pci.py
rename to tests/functional/aarch64/test_hotplug_pci.py
diff --git a/tests/functional/test_aarch64_imx8mp_evk.py b/tests/functional/aarch64/test_imx8mp_evk.py
similarity index 100%
rename from tests/functional/test_aarch64_imx8mp_evk.py
rename to tests/functional/aarch64/test_imx8mp_evk.py
diff --git a/tests/functional/test_aarch64_kvm.py b/tests/functional/aarch64/test_kvm.py
similarity index 100%
rename from tests/functional/test_aarch64_kvm.py
rename to tests/functional/aarch64/test_kvm.py
diff --git a/tests/functional/test_aarch64_migration.py b/tests/functional/aarch64/test_migration.py
similarity index 100%
rename from tests/functional/test_aarch64_migration.py
rename to tests/functional/aarch64/test_migration.py
diff --git a/tests/functional/test_aarch64_multiprocess.py b/tests/functional/aarch64/test_multiprocess.py
similarity index 100%
rename from tests/functional/test_aarch64_multiprocess.py
rename to tests/functional/aarch64/test_multiprocess.py
diff --git a/tests/functional/test_aarch64_raspi3.py b/tests/functional/aarch64/test_raspi3.py
similarity index 100%
rename from tests/functional/test_aarch64_raspi3.py
rename to tests/functional/aarch64/test_raspi3.py
diff --git a/tests/functional/test_aarch64_raspi4.py b/tests/functional/aarch64/test_raspi4.py
similarity index 100%
rename from tests/functional/test_aarch64_raspi4.py
rename to tests/functional/aarch64/test_raspi4.py
diff --git a/tests/functional/test_aarch64_replay.py b/tests/functional/aarch64/test_replay.py
similarity index 100%
rename from tests/functional/test_aarch64_replay.py
rename to tests/functional/aarch64/test_replay.py
diff --git a/tests/functional/test_aarch64_reverse_debug.py b/tests/functional/aarch64/test_reverse_debug.py
similarity index 100%
rename from tests/functional/test_aarch64_reverse_debug.py
rename to tests/functional/aarch64/test_reverse_debug.py
diff --git a/tests/functional/test_aarch64_rme_sbsaref.py b/tests/functional/aarch64/test_rme_sbsaref.py
similarity index 98%
rename from tests/functional/test_aarch64_rme_sbsaref.py
rename to tests/functional/aarch64/test_rme_sbsaref.py
index 746770e776..100f1c7738 100755
--- a/tests/functional/test_aarch64_rme_sbsaref.py
+++ b/tests/functional/aarch64/test_rme_sbsaref.py
@@ -13,7 +13,7 @@ import os
 
 from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
-from test_aarch64_rme_virt import test_realms_guest
+from test_rme_virt import test_realms_guest
 
 
 class Aarch64RMESbsaRefMachine(QemuSystemTest):
diff --git a/tests/functional/test_aarch64_rme_virt.py b/tests/functional/aarch64/test_rme_virt.py
similarity index 100%
rename from tests/functional/test_aarch64_rme_virt.py
rename to tests/functional/aarch64/test_rme_virt.py
diff --git a/tests/functional/test_aarch64_sbsaref.py b/tests/functional/aarch64/test_sbsaref.py
similarity index 100%
rename from tests/functional/test_aarch64_sbsaref.py
rename to tests/functional/aarch64/test_sbsaref.py
diff --git a/tests/functional/test_aarch64_sbsaref_alpine.py b/tests/functional/aarch64/test_sbsaref_alpine.py
similarity index 97%
rename from tests/functional/test_aarch64_sbsaref_alpine.py
rename to tests/functional/aarch64/test_sbsaref_alpine.py
index 8776999383..abb8f5114b 100755
--- a/tests/functional/test_aarch64_sbsaref_alpine.py
+++ b/tests/functional/aarch64/test_sbsaref_alpine.py
@@ -12,7 +12,7 @@
 
 from qemu_test import QemuSystemTest, Asset, skipSlowTest
 from qemu_test import wait_for_console_pattern
-from test_aarch64_sbsaref import fetch_firmware
+from test_sbsaref import fetch_firmware
 
 
 class Aarch64SbsarefAlpine(QemuSystemTest):
diff --git a/tests/functional/test_aarch64_sbsaref_freebsd.py b/tests/functional/aarch64/test_sbsaref_freebsd.py
similarity index 97%
rename from tests/functional/test_aarch64_sbsaref_freebsd.py
rename to tests/functional/aarch64/test_sbsaref_freebsd.py
index 7ef016fba6..3b942f7795 100755
--- a/tests/functional/test_aarch64_sbsaref_freebsd.py
+++ b/tests/functional/aarch64/test_sbsaref_freebsd.py
@@ -12,7 +12,7 @@
 
 from qemu_test import QemuSystemTest, Asset, skipSlowTest
 from qemu_test import wait_for_console_pattern
-from test_aarch64_sbsaref import fetch_firmware
+from test_sbsaref import fetch_firmware
 
 
 class Aarch64SbsarefFreeBSD(QemuSystemTest):
diff --git a/tests/functional/test_aarch64_smmu.py b/tests/functional/aarch64/test_smmu.py
similarity index 100%
rename from tests/functional/test_aarch64_smmu.py
rename to tests/functional/aarch64/test_smmu.py
diff --git a/tests/functional/test_aarch64_tcg_plugins.py b/tests/functional/aarch64/test_tcg_plugins.py
similarity index 100%
rename from tests/functional/test_aarch64_tcg_plugins.py
rename to tests/functional/aarch64/test_tcg_plugins.py
diff --git a/tests/functional/test_aarch64_tuxrun.py b/tests/functional/aarch64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_aarch64_tuxrun.py
rename to tests/functional/aarch64/test_tuxrun.py
diff --git a/tests/functional/test_aarch64_virt.py b/tests/functional/aarch64/test_virt.py
similarity index 100%
rename from tests/functional/test_aarch64_virt.py
rename to tests/functional/aarch64/test_virt.py
diff --git a/tests/functional/test_aarch64_virt_gpu.py b/tests/functional/aarch64/test_virt_gpu.py
similarity index 100%
rename from tests/functional/test_aarch64_virt_gpu.py
rename to tests/functional/aarch64/test_virt_gpu.py
diff --git a/tests/functional/test_aarch64_xen.py b/tests/functional/aarch64/test_xen.py
similarity index 100%
rename from tests/functional/test_aarch64_xen.py
rename to tests/functional/aarch64/test_xen.py
diff --git a/tests/functional/test_aarch64_xlnx_versal.py b/tests/functional/aarch64/test_xlnx_versal.py
similarity index 100%
rename from tests/functional/test_aarch64_xlnx_versal.py
rename to tests/functional/aarch64/test_xlnx_versal.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 8c24ac1cc2..9cb6325360 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -9,23 +9,7 @@ if get_option('tcg_interpreter')
   subdir_done()
 endif
 
-# Timeouts for individual tests that can be slow e.g. with debugging enabled
-test_aarch64_timeouts = {
-  'aarch64_aspeed_ast2700' : 600,
-  'aarch64_aspeed_ast2700fc' : 600,
-  'aarch64_device_passthrough' : 720,
-  'aarch64_imx8mp_evk' : 240,
-  'aarch64_raspi4' : 480,
-  'aarch64_reverse_debug' : 180,
-  'aarch64_rme_virt' : 1200,
-  'aarch64_rme_sbsaref' : 1200,
-  'aarch64_sbsaref_alpine' : 1200,
-  'aarch64_sbsaref_freebsd' : 720,
-  'aarch64_smmu' : 720,
-  'aarch64_tuxrun' : 240,
-  'aarch64_virt' : 360,
-  'aarch64_virt_gpu' : 480,
-}
+subdir('aarch64')
 
 test_arm_timeouts = {
   'arm_aspeed_palmetto' : 120,
@@ -112,36 +96,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_aarch64_system_quick = [
-  'aarch64_migration',
-]
-
-tests_aarch64_system_thorough = [
-  'aarch64_aspeed_ast2700',
-  'aarch64_aspeed_ast2700fc',
-  'aarch64_device_passthrough',
-  'aarch64_hotplug_pci',
-  'aarch64_imx8mp_evk',
-  'aarch64_kvm',
-  'aarch64_multiprocess',
-  'aarch64_raspi3',
-  'aarch64_raspi4',
-  'aarch64_replay',
-  'aarch64_reverse_debug',
-  'aarch64_rme_virt',
-  'aarch64_rme_sbsaref',
-  'aarch64_sbsaref',
-  'aarch64_sbsaref_alpine',
-  'aarch64_sbsaref_freebsd',
-  'aarch64_smmu',
-  'aarch64_tcg_plugins',
-  'aarch64_tuxrun',
-  'aarch64_virt',
-  'aarch64_virt_gpu',
-  'aarch64_xen',
-  'aarch64_xlnx_versal',
-]
-
 tests_alpha_system_quick = [
   'alpha_migration',
 ]

From e534eee5ba6aefd905c16bcb714d1ff8156a0c45 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:43 +0200
Subject: [PATCH 0017/2396] tests/functional: Move alpha tests into
 architecture specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded already, some
restructuring would be helpful here. Thus move the alpha tests into
a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-7-thuth@redhat.com>
---
 MAINTAINERS                                            |  3 ++-
 tests/functional/alpha/meson.build                     | 10 ++++++++++
 .../{test_alpha_clipper.py => alpha/test_clipper.py}   |  0
 .../test_migration.py}                                 |  0
 .../{test_alpha_replay.py => alpha/test_replay.py}     |  0
 tests/functional/meson.build                           | 10 +---------
 6 files changed, 13 insertions(+), 10 deletions(-)
 create mode 100644 tests/functional/alpha/meson.build
 rename tests/functional/{test_alpha_clipper.py => alpha/test_clipper.py} (100%)
 rename tests/functional/{test_alpha_migration.py => alpha/test_migration.py} (100%)
 rename tests/functional/{test_alpha_replay.py => alpha/test_replay.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index a2a5ccea7b..8115aae618 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -189,6 +189,7 @@ M: Richard Henderson <richard.henderson@linaro.org>
 S: Maintained
 F: target/alpha/
 F: tests/tcg/alpha/
+F: tests/functional/alpha/
 F: disas/alpha.c
 
 ARM TCG CPUs
@@ -656,7 +657,7 @@ S: Maintained
 F: hw/alpha/
 F: hw/isa/smc37c669-superio.c
 F: tests/tcg/alpha/system/
-F: tests/functional/test_alpha_clipper.py
+F: tests/functional/alpha/test_clipper.py
 
 ARM Machines
 ------------
diff --git a/tests/functional/alpha/meson.build b/tests/functional/alpha/meson.build
new file mode 100644
index 0000000000..26a5b3f2e4
--- /dev/null
+++ b/tests/functional/alpha/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_alpha_system_quick = [
+  'migration',
+]
+
+tests_alpha_system_thorough = [
+  'clipper',
+  'replay',
+]
diff --git a/tests/functional/test_alpha_clipper.py b/tests/functional/alpha/test_clipper.py
similarity index 100%
rename from tests/functional/test_alpha_clipper.py
rename to tests/functional/alpha/test_clipper.py
diff --git a/tests/functional/test_alpha_migration.py b/tests/functional/alpha/test_migration.py
similarity index 100%
rename from tests/functional/test_alpha_migration.py
rename to tests/functional/alpha/test_migration.py
diff --git a/tests/functional/test_alpha_replay.py b/tests/functional/alpha/test_replay.py
similarity index 100%
rename from tests/functional/test_alpha_replay.py
rename to tests/functional/alpha/test_replay.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 9cb6325360..a7f8c88a07 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -10,6 +10,7 @@ if get_option('tcg_interpreter')
 endif
 
 subdir('aarch64')
+subdir('alpha')
 
 test_arm_timeouts = {
   'arm_aspeed_palmetto' : 120,
@@ -96,15 +97,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_alpha_system_quick = [
-  'alpha_migration',
-]
-
-tests_alpha_system_thorough = [
-  'alpha_clipper',
-  'alpha_replay',
-]
-
 tests_arm_system_quick = [
   'arm_migration',
 ]

From 8de42cb748287d8dcc521d057b107f32d98e5edd Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:44 +0200
Subject: [PATCH 0018/2396] tests/functional: Move arm tests into architecture
 specific folder

The tests/functional folder has become quite crowded, thus move the
arm tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-8-thuth@redhat.com>
---
 MAINTAINERS                                   | 38 ++++++------
 tests/functional/arm/meson.build              | 62 +++++++++++++++++++
 .../test_aspeed_ast1030.py}                   |  0
 .../test_aspeed_ast2500.py}                   |  0
 .../test_aspeed_ast2600.py}                   |  0
 .../test_aspeed_bletchley.py}                 |  0
 .../test_aspeed_catalina.py}                  |  0
 .../test_aspeed_gb200nvl_bmc.py}              |  0
 .../test_aspeed_palmetto.py}                  |  0
 .../test_aspeed_rainier.py}                   |  0
 .../test_aspeed_romulus.py}                   |  0
 .../test_aspeed_witherspoon.py}               |  0
 .../{test_arm_bflt.py => arm/test_bflt.py}    |  0
 .../test_bpim2u.py}                           |  0
 .../test_canona1100.py}                       |  0
 .../test_collie.py}                           |  0
 .../test_cubieboard.py}                       |  0
 .../test_emcraft_sf2.py}                      |  0
 .../test_integratorcp.py}                     |  0
 .../test_max78000fthr.py}                     |  0
 .../test_microbit.py}                         |  0
 .../test_migration.py}                        |  0
 .../test_orangepi.py}                         |  0
 .../test_quanta_gsj.py}                       |  0
 .../test_raspi2.py}                           |  0
 .../test_realview.py}                         |  0
 .../test_replay.py}                           |  0
 .../test_smdkc210.py}                         |  0
 .../test_stellaris.py}                        |  0
 .../{test_arm_sx1.py => arm/test_sx1.py}      |  0
 .../test_tuxrun.py}                           |  0
 .../test_vexpress.py}                         |  0
 .../{test_arm_virt.py => arm/test_virt.py}    |  0
 tests/functional/meson.build                  | 62 +------------------
 34 files changed, 83 insertions(+), 79 deletions(-)
 create mode 100644 tests/functional/arm/meson.build
 rename tests/functional/{test_arm_aspeed_ast1030.py => arm/test_aspeed_ast1030.py} (100%)
 rename tests/functional/{test_arm_aspeed_ast2500.py => arm/test_aspeed_ast2500.py} (100%)
 rename tests/functional/{test_arm_aspeed_ast2600.py => arm/test_aspeed_ast2600.py} (100%)
 rename tests/functional/{test_arm_aspeed_bletchley.py => arm/test_aspeed_bletchley.py} (100%)
 mode change 100644 => 100755
 rename tests/functional/{test_arm_aspeed_catalina.py => arm/test_aspeed_catalina.py} (100%)
 rename tests/functional/{test_arm_aspeed_gb200nvl_bmc.py => arm/test_aspeed_gb200nvl_bmc.py} (100%)
 mode change 100644 => 100755
 rename tests/functional/{test_arm_aspeed_palmetto.py => arm/test_aspeed_palmetto.py} (100%)
 rename tests/functional/{test_arm_aspeed_rainier.py => arm/test_aspeed_rainier.py} (100%)
 rename tests/functional/{test_arm_aspeed_romulus.py => arm/test_aspeed_romulus.py} (100%)
 rename tests/functional/{test_arm_aspeed_witherspoon.py => arm/test_aspeed_witherspoon.py} (100%)
 mode change 100644 => 100755
 rename tests/functional/{test_arm_bflt.py => arm/test_bflt.py} (100%)
 rename tests/functional/{test_arm_bpim2u.py => arm/test_bpim2u.py} (100%)
 rename tests/functional/{test_arm_canona1100.py => arm/test_canona1100.py} (100%)
 rename tests/functional/{test_arm_collie.py => arm/test_collie.py} (100%)
 rename tests/functional/{test_arm_cubieboard.py => arm/test_cubieboard.py} (100%)
 rename tests/functional/{test_arm_emcraft_sf2.py => arm/test_emcraft_sf2.py} (100%)
 rename tests/functional/{test_arm_integratorcp.py => arm/test_integratorcp.py} (100%)
 rename tests/functional/{test_arm_max78000fthr.py => arm/test_max78000fthr.py} (100%)
 rename tests/functional/{test_arm_microbit.py => arm/test_microbit.py} (100%)
 rename tests/functional/{test_arm_migration.py => arm/test_migration.py} (100%)
 rename tests/functional/{test_arm_orangepi.py => arm/test_orangepi.py} (100%)
 rename tests/functional/{test_arm_quanta_gsj.py => arm/test_quanta_gsj.py} (100%)
 rename tests/functional/{test_arm_raspi2.py => arm/test_raspi2.py} (100%)
 rename tests/functional/{test_arm_realview.py => arm/test_realview.py} (100%)
 rename tests/functional/{test_arm_replay.py => arm/test_replay.py} (100%)
 rename tests/functional/{test_arm_smdkc210.py => arm/test_smdkc210.py} (100%)
 rename tests/functional/{test_arm_stellaris.py => arm/test_stellaris.py} (100%)
 rename tests/functional/{test_arm_sx1.py => arm/test_sx1.py} (100%)
 rename tests/functional/{test_arm_tuxrun.py => arm/test_tuxrun.py} (100%)
 rename tests/functional/{test_arm_vexpress.py => arm/test_vexpress.py} (100%)
 rename tests/functional/{test_arm_virt.py => arm/test_virt.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 8115aae618..1eb964feca 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -444,6 +444,7 @@ M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: target/arm/kvm.c
+F: tests/functional/aarch64/test_kvm.py
 
 MIPS KVM CPUs
 M: Huacai Chen <chenhuacai@kernel.org>
@@ -673,7 +674,7 @@ F: include/hw/*/allwinner*
 F: hw/arm/cubieboard.c
 F: docs/system/arm/cubieboard.rst
 F: hw/misc/axp209.c
-F: tests/functional/test_arm_cubieboard.py
+F: tests/functional/arm/test_cubieboard.py
 
 Allwinner-h3
 M: Niek Linnenbank <nieklinnenbank@gmail.com>
@@ -683,7 +684,7 @@ F: hw/*/allwinner-h3*
 F: include/hw/*/allwinner-h3*
 F: hw/arm/orangepi.c
 F: docs/system/arm/orangepi.rst
-F: tests/functional/test_arm_orangepi.py
+F: tests/functional/arm/test_orangepi.py
 
 ARM PrimeCell and CMSDK devices
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -753,7 +754,7 @@ F: docs/system/arm/bananapi_m2u.rst
 F: hw/*/allwinner-r40*.c
 F: hw/arm/bananapi_m2u.c
 F: include/hw/*/allwinner-r40*.h
-F: tests/functional/test_arm_bpim2u.py
+F: tests/functional/arm/test_bpim2u.py
 
 B-L475E-IOT01A IoT Node
 M: Samuel Tardieu <sam@rfc1149.net>
@@ -771,7 +772,7 @@ S: Odd Fixes
 F: hw/*/exynos*
 F: include/hw/*/exynos*
 F: docs/system/arm/exynos.rst
-F: tests/functional/test_arm_smdkc210.py
+F: tests/functional/arm/test_smdkc210.py
 
 Calxeda Highbank
 M: Rob Herring <robh@kernel.org>
@@ -790,7 +791,7 @@ S: Odd Fixes
 F: include/hw/arm/digic.h
 F: hw/*/digic*
 F: include/hw/*/digic*
-F: tests/functional/test_arm_canona1100.py
+F: tests/functional/arm/test_canona1100.py
 F: docs/system/arm/digic.rst
 
 Goldfish RTC
@@ -833,7 +834,7 @@ S: Odd Fixes
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 F: include/hw/misc/arm_integrator_debug.h
-F: tests/functional/test_arm_integratorcp.py
+F: tests/functional/arm/test_integratorcp.py
 F: docs/system/arm/integratorcp.rst
 
 MCIMX6UL EVK / i.MX6ul
@@ -939,7 +940,7 @@ F: pc-bios/npcm7xx_bootrom.bin
 F: pc-bios/npcm8xx_bootrom.bin
 F: roms/vbootrom
 F: docs/system/arm/nuvoton.rst
-F: tests/functional/test_arm_quanta_gsj.py
+F: tests/functional/arm/test_quanta_gsj.py
 
 Raspberry Pi
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -952,7 +953,7 @@ F: hw/*/bcm283*
 F: include/hw/arm/rasp*
 F: include/hw/*/bcm283*
 F: docs/system/arm/raspi.rst
-F: tests/functional/test_arm_raspi2.py
+F: tests/functional/arm/test_raspi2.py
 F: tests/functional/aarch64/test_raspi*.py
 
 Real View
@@ -964,7 +965,7 @@ F: hw/cpu/realview_mpcore.c
 F: hw/intc/realview_gic.c
 F: include/hw/intc/realview_gic.h
 F: docs/system/arm/realview.rst
-F: tests/functional/test_arm_realview.py
+F: tests/functional/arm/test_realview.py
 
 SABRELITE / i.MX6
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -1004,7 +1005,7 @@ F: hw/arm/strongarm*
 F: hw/gpio/zaurus.c
 F: include/hw/arm/sharpsl.h
 F: docs/system/arm/collie.rst
-F: tests/functional/test_arm_collie.py
+F: tests/functional/arm/test_collie.py
 
 Stellaris
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -1015,7 +1016,7 @@ F: hw/display/ssd03*
 F: include/hw/input/stellaris_gamepad.h
 F: include/hw/timer/stellaris-gptm.h
 F: docs/system/arm/stellaris.rst
-F: tests/functional/test_arm_stellaris.py
+F: tests/functional/arm/test_stellaris.py
 
 STM32L4x5 SoC Family
 M: Samuel Tardieu <sam@rfc1149.net>
@@ -1044,7 +1045,7 @@ S: Odd Fixes
 F: hw/arm/vexpress.c
 F: hw/display/sii9022.c
 F: docs/system/arm/vexpress.rst
-F: tests/functional/test_arm_vexpress.py
+F: tests/functional/arm/test_vexpress.py
 
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
@@ -1065,8 +1066,8 @@ F: include/hw/arm/virt.h
 F: docs/system/arm/virt.rst
 F: tests/functional/aarch64/test_*virt*.py
 F: tests/functional/aarch64/test_tuxrun.py
-F: tests/functional/test_arm_tuxrun.py
-F: tests/functional/test_arm_virt.py
+F: tests/functional/arm/test_tuxrun.py
+F: tests/functional/arm/test_virt.py
 
 Xilinx Zynq
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
@@ -1187,7 +1188,7 @@ L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/msf2-som.c
 F: docs/system/arm/emcraft-sf2.rst
-F: tests/functional/test_arm_emcraft_sf2.py
+F: tests/functional/arm/test_emcraft_sf2.py
 
 ASPEED BMCs
 M: Cédric Le Goater <clg@kaod.org>
@@ -1205,6 +1206,7 @@ F: hw/net/ftgmac100.c
 F: include/hw/net/ftgmac100.h
 F: docs/system/arm/aspeed.rst
 F: docs/system/arm/fby35.rst
+F: tests/functional/*/*aspeed*
 F: tests/*/*aspeed*
 F: tests/*/*ast2700*
 F: hw/arm/fby35.c
@@ -1220,7 +1222,7 @@ F: hw/*/microbit*.c
 F: include/hw/*/nrf51*.h
 F: include/hw/*/microbit*.h
 F: tests/qtest/microbit-test.c
-F: tests/functional/test_arm_microbit.py
+F: tests/functional/arm/test_microbit.py
 F: docs/system/arm/nrf.rst
 
 ARM PL011 Rust device
@@ -2077,7 +2079,7 @@ S: Odd Fixes
 F: hw/*/omap*
 F: include/hw/arm/omap.h
 F: docs/system/arm/sx1.rst
-F: tests/functional/test_arm_sx1.py
+F: tests/functional/arm/test_sx1.py
 
 IPack
 M: Alberto Garcia <berto@igalia.com>
@@ -3914,7 +3916,7 @@ F: configs/targets/*linux-user.mak
 F: scripts/qemu-binfmt-conf.sh
 F: scripts/update-syscalltbl.sh
 F: scripts/update-mips-syscall-args.sh
-F: tests/functional/test_arm_bflt.py
+F: tests/functional/arm/test_bflt.py
 
 Tiny Code Generator (TCG)
 -------------------------
diff --git a/tests/functional/arm/meson.build b/tests/functional/arm/meson.build
new file mode 100644
index 0000000000..e4e7dba8d0
--- /dev/null
+++ b/tests/functional/arm/meson.build
@@ -0,0 +1,62 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_arm_timeouts = {
+  'aspeed_palmetto' : 120,
+  'aspeed_romulus' : 120,
+  'aspeed_witherspoon' : 120,
+  'aspeed_ast2500' : 720,
+  'aspeed_ast2600' : 1200,
+  'aspeed_bletchley' : 480,
+  'aspeed_catalina' : 480,
+  'aspeed_gb200nvl_bmc' : 480,
+  'aspeed_rainier' : 480,
+  'bpim2u' : 500,
+  'collie' : 180,
+  'cubieboard' : 360,
+  'orangepi' : 540,
+  'quanta_gsj' : 240,
+  'raspi2' : 120,
+  'replay' : 240,
+  'tuxrun' : 240,
+  'sx1' : 360,
+}
+
+tests_arm_system_quick = [
+  'migration',
+]
+
+tests_arm_system_thorough = [
+  'aspeed_ast1030',
+  'aspeed_palmetto',
+  'aspeed_romulus',
+  'aspeed_witherspoon',
+  'aspeed_ast2500',
+  'aspeed_ast2600',
+  'aspeed_bletchley',
+  'aspeed_catalina',
+  'aspeed_gb200nvl_bmc',
+  'aspeed_rainier',
+  'bpim2u',
+  'canona1100',
+  'collie',
+  'cubieboard',
+  'emcraft_sf2',
+  'integratorcp',
+  'max78000fthr',
+  'microbit',
+  'orangepi',
+  'quanta_gsj',
+  'raspi2',
+  'realview',
+  'replay',
+  'smdkc210',
+  'stellaris',
+  'sx1',
+  'vexpress',
+  'virt',
+  'tuxrun',
+]
+
+tests_arm_linuxuser_thorough = [
+  'bflt',
+]
diff --git a/tests/functional/test_arm_aspeed_ast1030.py b/tests/functional/arm/test_aspeed_ast1030.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_ast1030.py
rename to tests/functional/arm/test_aspeed_ast1030.py
diff --git a/tests/functional/test_arm_aspeed_ast2500.py b/tests/functional/arm/test_aspeed_ast2500.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_ast2500.py
rename to tests/functional/arm/test_aspeed_ast2500.py
diff --git a/tests/functional/test_arm_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_ast2600.py
rename to tests/functional/arm/test_aspeed_ast2600.py
diff --git a/tests/functional/test_arm_aspeed_bletchley.py b/tests/functional/arm/test_aspeed_bletchley.py
old mode 100644
new mode 100755
similarity index 100%
rename from tests/functional/test_arm_aspeed_bletchley.py
rename to tests/functional/arm/test_aspeed_bletchley.py
diff --git a/tests/functional/test_arm_aspeed_catalina.py b/tests/functional/arm/test_aspeed_catalina.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_catalina.py
rename to tests/functional/arm/test_aspeed_catalina.py
diff --git a/tests/functional/test_arm_aspeed_gb200nvl_bmc.py b/tests/functional/arm/test_aspeed_gb200nvl_bmc.py
old mode 100644
new mode 100755
similarity index 100%
rename from tests/functional/test_arm_aspeed_gb200nvl_bmc.py
rename to tests/functional/arm/test_aspeed_gb200nvl_bmc.py
diff --git a/tests/functional/test_arm_aspeed_palmetto.py b/tests/functional/arm/test_aspeed_palmetto.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_palmetto.py
rename to tests/functional/arm/test_aspeed_palmetto.py
diff --git a/tests/functional/test_arm_aspeed_rainier.py b/tests/functional/arm/test_aspeed_rainier.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_rainier.py
rename to tests/functional/arm/test_aspeed_rainier.py
diff --git a/tests/functional/test_arm_aspeed_romulus.py b/tests/functional/arm/test_aspeed_romulus.py
similarity index 100%
rename from tests/functional/test_arm_aspeed_romulus.py
rename to tests/functional/arm/test_aspeed_romulus.py
diff --git a/tests/functional/test_arm_aspeed_witherspoon.py b/tests/functional/arm/test_aspeed_witherspoon.py
old mode 100644
new mode 100755
similarity index 100%
rename from tests/functional/test_arm_aspeed_witherspoon.py
rename to tests/functional/arm/test_aspeed_witherspoon.py
diff --git a/tests/functional/test_arm_bflt.py b/tests/functional/arm/test_bflt.py
similarity index 100%
rename from tests/functional/test_arm_bflt.py
rename to tests/functional/arm/test_bflt.py
diff --git a/tests/functional/test_arm_bpim2u.py b/tests/functional/arm/test_bpim2u.py
similarity index 100%
rename from tests/functional/test_arm_bpim2u.py
rename to tests/functional/arm/test_bpim2u.py
diff --git a/tests/functional/test_arm_canona1100.py b/tests/functional/arm/test_canona1100.py
similarity index 100%
rename from tests/functional/test_arm_canona1100.py
rename to tests/functional/arm/test_canona1100.py
diff --git a/tests/functional/test_arm_collie.py b/tests/functional/arm/test_collie.py
similarity index 100%
rename from tests/functional/test_arm_collie.py
rename to tests/functional/arm/test_collie.py
diff --git a/tests/functional/test_arm_cubieboard.py b/tests/functional/arm/test_cubieboard.py
similarity index 100%
rename from tests/functional/test_arm_cubieboard.py
rename to tests/functional/arm/test_cubieboard.py
diff --git a/tests/functional/test_arm_emcraft_sf2.py b/tests/functional/arm/test_emcraft_sf2.py
similarity index 100%
rename from tests/functional/test_arm_emcraft_sf2.py
rename to tests/functional/arm/test_emcraft_sf2.py
diff --git a/tests/functional/test_arm_integratorcp.py b/tests/functional/arm/test_integratorcp.py
similarity index 100%
rename from tests/functional/test_arm_integratorcp.py
rename to tests/functional/arm/test_integratorcp.py
diff --git a/tests/functional/test_arm_max78000fthr.py b/tests/functional/arm/test_max78000fthr.py
similarity index 100%
rename from tests/functional/test_arm_max78000fthr.py
rename to tests/functional/arm/test_max78000fthr.py
diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/arm/test_microbit.py
similarity index 100%
rename from tests/functional/test_arm_microbit.py
rename to tests/functional/arm/test_microbit.py
diff --git a/tests/functional/test_arm_migration.py b/tests/functional/arm/test_migration.py
similarity index 100%
rename from tests/functional/test_arm_migration.py
rename to tests/functional/arm/test_migration.py
diff --git a/tests/functional/test_arm_orangepi.py b/tests/functional/arm/test_orangepi.py
similarity index 100%
rename from tests/functional/test_arm_orangepi.py
rename to tests/functional/arm/test_orangepi.py
diff --git a/tests/functional/test_arm_quanta_gsj.py b/tests/functional/arm/test_quanta_gsj.py
similarity index 100%
rename from tests/functional/test_arm_quanta_gsj.py
rename to tests/functional/arm/test_quanta_gsj.py
diff --git a/tests/functional/test_arm_raspi2.py b/tests/functional/arm/test_raspi2.py
similarity index 100%
rename from tests/functional/test_arm_raspi2.py
rename to tests/functional/arm/test_raspi2.py
diff --git a/tests/functional/test_arm_realview.py b/tests/functional/arm/test_realview.py
similarity index 100%
rename from tests/functional/test_arm_realview.py
rename to tests/functional/arm/test_realview.py
diff --git a/tests/functional/test_arm_replay.py b/tests/functional/arm/test_replay.py
similarity index 100%
rename from tests/functional/test_arm_replay.py
rename to tests/functional/arm/test_replay.py
diff --git a/tests/functional/test_arm_smdkc210.py b/tests/functional/arm/test_smdkc210.py
similarity index 100%
rename from tests/functional/test_arm_smdkc210.py
rename to tests/functional/arm/test_smdkc210.py
diff --git a/tests/functional/test_arm_stellaris.py b/tests/functional/arm/test_stellaris.py
similarity index 100%
rename from tests/functional/test_arm_stellaris.py
rename to tests/functional/arm/test_stellaris.py
diff --git a/tests/functional/test_arm_sx1.py b/tests/functional/arm/test_sx1.py
similarity index 100%
rename from tests/functional/test_arm_sx1.py
rename to tests/functional/arm/test_sx1.py
diff --git a/tests/functional/test_arm_tuxrun.py b/tests/functional/arm/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_arm_tuxrun.py
rename to tests/functional/arm/test_tuxrun.py
diff --git a/tests/functional/test_arm_vexpress.py b/tests/functional/arm/test_vexpress.py
similarity index 100%
rename from tests/functional/test_arm_vexpress.py
rename to tests/functional/arm/test_vexpress.py
diff --git a/tests/functional/test_arm_virt.py b/tests/functional/arm/test_virt.py
similarity index 100%
rename from tests/functional/test_arm_virt.py
rename to tests/functional/arm/test_virt.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index a7f8c88a07..6989446d1c 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -11,27 +11,7 @@ endif
 
 subdir('aarch64')
 subdir('alpha')
-
-test_arm_timeouts = {
-  'arm_aspeed_palmetto' : 120,
-  'arm_aspeed_romulus' : 120,
-  'arm_aspeed_witherspoon' : 120,
-  'arm_aspeed_ast2500' : 720,
-  'arm_aspeed_ast2600' : 1200,
-  'arm_aspeed_bletchley' : 480,
-  'arm_aspeed_catalina' : 480,
-  'arm_aspeed_gb200nvl_bmc' : 480,
-  'arm_aspeed_rainier' : 480,
-  'arm_bpim2u' : 500,
-  'arm_collie' : 180,
-  'arm_cubieboard' : 360,
-  'arm_orangepi' : 540,
-  'arm_quanta_gsj' : 240,
-  'arm_raspi2' : 120,
-  'arm_replay' : 240,
-  'arm_tuxrun' : 240,
-  'arm_sx1' : 360,
-}
+subdir('arm')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -97,46 +77,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_arm_system_quick = [
-  'arm_migration',
-]
-
-tests_arm_system_thorough = [
-  'arm_aspeed_ast1030',
-  'arm_aspeed_palmetto',
-  'arm_aspeed_romulus',
-  'arm_aspeed_witherspoon',
-  'arm_aspeed_ast2500',
-  'arm_aspeed_ast2600',
-  'arm_aspeed_bletchley',
-  'arm_aspeed_catalina',
-  'arm_aspeed_gb200nvl_bmc',
-  'arm_aspeed_rainier',
-  'arm_bpim2u',
-  'arm_canona1100',
-  'arm_collie',
-  'arm_cubieboard',
-  'arm_emcraft_sf2',
-  'arm_integratorcp',
-  'arm_max78000fthr',
-  'arm_microbit',
-  'arm_orangepi',
-  'arm_quanta_gsj',
-  'arm_raspi2',
-  'arm_realview',
-  'arm_replay',
-  'arm_smdkc210',
-  'arm_stellaris',
-  'arm_sx1',
-  'arm_vexpress',
-  'arm_virt',
-  'arm_tuxrun',
-]
-
-tests_arm_linuxuser_thorough = [
-  'arm_bflt',
-]
-
 tests_avr_system_thorough = [
   'avr_mega2560',
   'avr_uno',

From dc8f7a1bf724cb90d37c5bdfcdb80a5c74befc11 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:45 +0200
Subject: [PATCH 0019/2396] tests/functional: Move avr tests into architecture
 specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
avr tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-9-thuth@redhat.com>
---
 MAINTAINERS                                                 | 4 ++--
 tests/functional/avr/meson.build                            | 6 ++++++
 .../{test_avr_mega2560.py => avr/test_mega2560.py}          | 0
 tests/functional/{test_avr_uno.py => avr/test_uno.py}       | 0
 tests/functional/meson.build                                | 6 +-----
 5 files changed, 9 insertions(+), 7 deletions(-)
 create mode 100644 tests/functional/avr/meson.build
 rename tests/functional/{test_avr_mega2560.py => avr/test_mega2560.py} (100%)
 rename tests/functional/{test_avr_uno.py => avr/test_uno.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1eb964feca..d01afcbea6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -221,7 +221,7 @@ S: Maintained
 F: docs/system/target-avr.rst
 F: gdb-xml/avr-cpu.xml
 F: target/avr/
-F: tests/functional/test_avr_*.py
+F: tests/functional/avr/
 
 Hexagon TCG CPUs
 M: Brian Cain <brian.cain@oss.qualcomm.com>
@@ -1249,7 +1249,7 @@ Arduino
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: hw/avr/arduino.c
-F: tests/functional/test_avr_uno.py
+F: tests/functional/avr/test_uno.py
 
 HP-PARISC Machines
 ------------------
diff --git a/tests/functional/avr/meson.build b/tests/functional/avr/meson.build
new file mode 100644
index 0000000000..7a2cb7099e
--- /dev/null
+++ b/tests/functional/avr/meson.build
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_avr_system_thorough = [
+  'mega2560',
+  'uno',
+]
diff --git a/tests/functional/test_avr_mega2560.py b/tests/functional/avr/test_mega2560.py
similarity index 100%
rename from tests/functional/test_avr_mega2560.py
rename to tests/functional/avr/test_mega2560.py
diff --git a/tests/functional/test_avr_uno.py b/tests/functional/avr/test_uno.py
similarity index 100%
rename from tests/functional/test_avr_uno.py
rename to tests/functional/avr/test_uno.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 6989446d1c..81eaa9c218 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -12,6 +12,7 @@ endif
 subdir('aarch64')
 subdir('alpha')
 subdir('arm')
+subdir('avr')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -77,11 +78,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_avr_system_thorough = [
-  'avr_mega2560',
-  'avr_uno',
-]
-
 tests_hppa_system_quick = [
   'hppa_seabios',
 ]

From e538303d31bb0b537285571b9b56674e7c90b120 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:46 +0200
Subject: [PATCH 0020/2396] tests/functional: Move hppa tests into architecture
 specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
avr tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-10-thuth@redhat.com>
---
 MAINTAINERS                                                  | 2 +-
 tests/functional/hppa/meson.build                            | 5 +++++
 .../{test_hppa_seabios.py => hppa/test_seabios.py}           | 0
 tests/functional/meson.build                                 | 5 +----
 4 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 tests/functional/hppa/meson.build
 rename tests/functional/{test_hppa_seabios.py => hppa/test_seabios.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index d01afcbea6..2e1754912f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1273,7 +1273,7 @@ F: include/hw/pci-host/astro.h
 F: include/hw/pci-host/dino.h
 F: pc-bios/hppa-firmware.img
 F: roms/seabios-hppa/
-F: tests/functional/test_hppa_seabios.py
+F: tests/functional/hppa/test_seabios.py
 
 LoongArch Machines
 ------------------
diff --git a/tests/functional/hppa/meson.build b/tests/functional/hppa/meson.build
new file mode 100644
index 0000000000..a334837088
--- /dev/null
+++ b/tests/functional/hppa/meson.build
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_hppa_system_quick = [
+  'seabios',
+]
diff --git a/tests/functional/test_hppa_seabios.py b/tests/functional/hppa/test_seabios.py
similarity index 100%
rename from tests/functional/test_hppa_seabios.py
rename to tests/functional/hppa/test_seabios.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 81eaa9c218..8f85c13d3d 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -13,6 +13,7 @@ subdir('aarch64')
 subdir('alpha')
 subdir('arm')
 subdir('avr')
+subdir('hppa')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -78,10 +79,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_hppa_system_quick = [
-  'hppa_seabios',
-]
-
 tests_i386_system_quick = [
   'i386_migration',
 ]

From 84b30c4587719297955e1fe2a22face5cc84587c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:47 +0200
Subject: [PATCH 0021/2396] tests/functional: Move i386 tests into architecture
 specific folder

The tests/functional folder has become quite crowded, thus move the
i386 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-11-thuth@redhat.com>
---
 MAINTAINERS                                            |  3 ++-
 tests/functional/i386/meson.build                      | 10 ++++++++++
 .../{test_i386_migration.py => i386/test_migration.py} |  0
 .../{test_i386_replay.py => i386/test_replay.py}       |  0
 .../{test_i386_tuxrun.py => i386/test_tuxrun.py}       |  0
 tests/functional/meson.build                           | 10 +---------
 6 files changed, 13 insertions(+), 10 deletions(-)
 create mode 100644 tests/functional/i386/meson.build
 rename tests/functional/{test_i386_migration.py => i386/test_migration.py} (100%)
 rename tests/functional/{test_i386_replay.py => i386/test_replay.py} (100%)
 rename tests/functional/{test_i386_tuxrun.py => i386/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 2e1754912f..2b109ecc18 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -146,6 +146,7 @@ F: target/i386/*.[ch]
 F: target/i386/Kconfig
 F: target/i386/meson.build
 F: tools/i386/
+F: tests/functional/i386/
 
 Guest CPU cores (TCG)
 ---------------------
@@ -1891,7 +1892,7 @@ F: hw/isa/apm.c
 F: include/hw/isa/apm.h
 F: tests/unit/test-x86-topo.c
 F: tests/qtest/test-x86-cpuid-compat.c
-F: tests/functional/test_i386_tuxrun.py
+F: tests/functional/i386/test_tuxrun.py
 F: tests/functional/test_linux_initrd.py
 F: tests/functional/test_mem_addr_space.py
 F: tests/functional/test_pc_cpu_hotplug_props.py
diff --git a/tests/functional/i386/meson.build b/tests/functional/i386/meson.build
new file mode 100644
index 0000000000..23d8c216be
--- /dev/null
+++ b/tests/functional/i386/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_i386_system_quick = [
+  'migration',
+]
+
+tests_i386_system_thorough = [
+  'replay',
+  'tuxrun',
+]
diff --git a/tests/functional/test_i386_migration.py b/tests/functional/i386/test_migration.py
similarity index 100%
rename from tests/functional/test_i386_migration.py
rename to tests/functional/i386/test_migration.py
diff --git a/tests/functional/test_i386_replay.py b/tests/functional/i386/test_replay.py
similarity index 100%
rename from tests/functional/test_i386_replay.py
rename to tests/functional/i386/test_replay.py
diff --git a/tests/functional/test_i386_tuxrun.py b/tests/functional/i386/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_i386_tuxrun.py
rename to tests/functional/i386/test_tuxrun.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 8f85c13d3d..f1fc01717c 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -14,6 +14,7 @@ subdir('alpha')
 subdir('arm')
 subdir('avr')
 subdir('hppa')
+subdir('i386')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -79,15 +80,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_i386_system_quick = [
-  'i386_migration',
-]
-
-tests_i386_system_thorough = [
-  'i386_replay',
-  'i386_tuxrun',
-]
-
 tests_loongarch64_system_thorough = [
   'loongarch64_virt',
 ]

From 6bd38ef0f9af38364509005385ff2ac897ad3913 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:48 +0200
Subject: [PATCH 0022/2396] tests/functional: Move loongarch64 tests into
 architecture specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
loongarch64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-12-thuth@redhat.com>
---
 MAINTAINERS                                                  | 2 +-
 tests/functional/loongarch64/meson.build                     | 5 +++++
 .../{test_loongarch64_virt.py => loongarch64/test_virt.py}   | 0
 tests/functional/meson.build                                 | 5 +----
 4 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 tests/functional/loongarch64/meson.build
 rename tests/functional/{test_loongarch64_virt.py => loongarch64/test_virt.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 2b109ecc18..716127e831 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -258,7 +258,7 @@ M: Song Gao <gaosong@loongson.cn>
 S: Maintained
 F: target/loongarch/
 F: tests/tcg/loongarch64/
-F: tests/functional/test_loongarch64_virt.py
+F: tests/functional/loongarch64/test_virt.py
 
 M68K TCG CPUs
 M: Laurent Vivier <laurent@vivier.eu>
diff --git a/tests/functional/loongarch64/meson.build b/tests/functional/loongarch64/meson.build
new file mode 100644
index 0000000000..d1687176a3
--- /dev/null
+++ b/tests/functional/loongarch64/meson.build
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_loongarch64_system_thorough = [
+  'virt',
+]
diff --git a/tests/functional/test_loongarch64_virt.py b/tests/functional/loongarch64/test_virt.py
similarity index 100%
rename from tests/functional/test_loongarch64_virt.py
rename to tests/functional/loongarch64/test_virt.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index f1fc01717c..e2e66dcf52 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -15,6 +15,7 @@ subdir('arm')
 subdir('avr')
 subdir('hppa')
 subdir('i386')
+subdir('loongarch64')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -80,10 +81,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_loongarch64_system_thorough = [
-  'loongarch64_virt',
-]
-
 tests_m68k_system_thorough = [
   'm68k_mcf5208evb',
   'm68k_nextcube',

From 0ae63d0e19b22d45cd354b428b4b530223f53d7b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:49 +0200
Subject: [PATCH 0023/2396] tests/functional: Move m68k tests into architecture
 specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
m68k tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-13-thuth@redhat.com>
---
 MAINTAINERS                                              | 8 ++++----
 tests/functional/m68k/meson.build                        | 9 +++++++++
 .../{test_m68k_mcf5208evb.py => m68k/test_mcf5208evb.py} | 0
 .../{test_m68k_nextcube.py => m68k/test_nextcube.py}     | 0
 .../functional/{test_m68k_q800.py => m68k/test_q800.py}  | 0
 .../{test_m68k_replay.py => m68k/test_replay.py}         | 0
 .../{test_m68k_tuxrun.py => m68k/test_tuxrun.py}         | 0
 tests/functional/meson.build                             | 9 +--------
 8 files changed, 14 insertions(+), 12 deletions(-)
 create mode 100644 tests/functional/m68k/meson.build
 rename tests/functional/{test_m68k_mcf5208evb.py => m68k/test_mcf5208evb.py} (100%)
 rename tests/functional/{test_m68k_nextcube.py => m68k/test_nextcube.py} (100%)
 rename tests/functional/{test_m68k_q800.py => m68k/test_q800.py} (100%)
 rename tests/functional/{test_m68k_replay.py => m68k/test_replay.py} (100%)
 rename tests/functional/{test_m68k_tuxrun.py => m68k/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 716127e831..e188de813f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1312,7 +1312,7 @@ F: hw/m68k/mcf_intc.c
 F: hw/char/mcf_uart.c
 F: hw/net/mcf_fec.c
 F: include/hw/m68k/mcf*.h
-F: tests/functional/test_m68k_mcf5208evb.py
+F: tests/functional/m68k/test_mcf5208evb.py
 
 NeXTcube
 M: Thomas Huth <huth@tuxfamily.org>
@@ -1320,7 +1320,7 @@ S: Odd Fixes
 F: hw/m68k/next-*.c
 F: hw/display/next-fb.c
 F: include/hw/m68k/next-cube.h
-F: tests/functional/test_m68k_nextcube.py
+F: tests/functional/m68k/test_nextcube.py
 
 q800
 M: Laurent Vivier <laurent@vivier.eu>
@@ -1346,7 +1346,7 @@ F: include/hw/m68k/q800-glue.h
 F: include/hw/misc/djmemc.h
 F: include/hw/misc/iosb.h
 F: include/hw/audio/asc.h
-F: tests/functional/test_m68k_q800.py
+F: tests/functional/m68k/test_q800.py
 
 virt
 M: Laurent Vivier <laurent@vivier.eu>
@@ -1361,7 +1361,7 @@ F: include/hw/intc/goldfish_pic.h
 F: include/hw/intc/m68k_irqc.h
 F: include/hw/misc/virt_ctrl.h
 F: docs/specs/virt-ctlr.rst
-F: tests/functional/test_m68k_tuxrun.py
+F: tests/functional/m68k/test_tuxrun.py
 
 MicroBlaze Machines
 -------------------
diff --git a/tests/functional/m68k/meson.build b/tests/functional/m68k/meson.build
new file mode 100644
index 0000000000..e29044a6d7
--- /dev/null
+++ b/tests/functional/m68k/meson.build
@@ -0,0 +1,9 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_m68k_system_thorough = [
+  'mcf5208evb',
+  'nextcube',
+  'replay',
+  'q800',
+  'tuxrun',
+]
diff --git a/tests/functional/test_m68k_mcf5208evb.py b/tests/functional/m68k/test_mcf5208evb.py
similarity index 100%
rename from tests/functional/test_m68k_mcf5208evb.py
rename to tests/functional/m68k/test_mcf5208evb.py
diff --git a/tests/functional/test_m68k_nextcube.py b/tests/functional/m68k/test_nextcube.py
similarity index 100%
rename from tests/functional/test_m68k_nextcube.py
rename to tests/functional/m68k/test_nextcube.py
diff --git a/tests/functional/test_m68k_q800.py b/tests/functional/m68k/test_q800.py
similarity index 100%
rename from tests/functional/test_m68k_q800.py
rename to tests/functional/m68k/test_q800.py
diff --git a/tests/functional/test_m68k_replay.py b/tests/functional/m68k/test_replay.py
similarity index 100%
rename from tests/functional/test_m68k_replay.py
rename to tests/functional/m68k/test_replay.py
diff --git a/tests/functional/test_m68k_tuxrun.py b/tests/functional/m68k/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_m68k_tuxrun.py
rename to tests/functional/m68k/test_tuxrun.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index e2e66dcf52..d32dd4a371 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -16,6 +16,7 @@ subdir('avr')
 subdir('hppa')
 subdir('i386')
 subdir('loongarch64')
+subdir('m68k')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -81,14 +82,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_m68k_system_thorough = [
-  'm68k_mcf5208evb',
-  'm68k_nextcube',
-  'm68k_replay',
-  'm68k_q800',
-  'm68k_tuxrun',
-]
-
 tests_microblaze_system_thorough = [
   'microblaze_replay',
   'microblaze_s3adsp1800'

From 67adbc8b6f40f6a2370d4a0ba479d3778d147cbc Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:50 +0200
Subject: [PATCH 0024/2396] tests/functional: Move microblaze tests into
 architecture specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
microblaze tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-14-thuth@redhat.com>
---
 MAINTAINERS                                           |  2 +-
 tests/functional/meson.build                          | 11 ++---------
 tests/functional/microblaze/meson.build               |  6 ++++++
 .../test_replay.py}                                   |  0
 .../test_s3adsp1800.py}                               |  0
 tests/functional/microblazeel/meson.build             |  5 +++++
 .../test_s3adsp1800.py}                               |  2 +-
 7 files changed, 15 insertions(+), 11 deletions(-)
 create mode 100644 tests/functional/microblaze/meson.build
 rename tests/functional/{test_microblaze_replay.py => microblaze/test_replay.py} (100%)
 rename tests/functional/{test_microblaze_s3adsp1800.py => microblaze/test_s3adsp1800.py} (100%)
 create mode 100644 tests/functional/microblazeel/meson.build
 rename tests/functional/{test_microblazeel_s3adsp1800.py => microblazeel/test_s3adsp1800.py} (92%)

diff --git a/MAINTAINERS b/MAINTAINERS
index e188de813f..b6a835777b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1370,7 +1370,7 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 S: Maintained
 F: hw/microblaze/petalogix_s3adsp1800_mmu.c
 F: include/hw/char/xilinx_uartlite.h
-F: tests/functional/test_microblaze*.py
+F: tests/functional/microblaze*/test_s3adsp1800.py
 
 petalogix_ml605
 M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index d32dd4a371..fee6805614 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -17,6 +17,8 @@ subdir('hppa')
 subdir('i386')
 subdir('loongarch64')
 subdir('m68k')
+subdir('microblaze')
+subdir('microblazeel')
 
 test_mips_timeouts = {
   'mips_malta' : 480,
@@ -82,15 +84,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_microblaze_system_thorough = [
-  'microblaze_replay',
-  'microblaze_s3adsp1800'
-]
-
-tests_microblazeel_system_thorough = [
-  'microblazeel_s3adsp1800'
-]
-
 tests_mips_system_thorough = [
   'mips_malta',
   'mips_replay',
diff --git a/tests/functional/microblaze/meson.build b/tests/functional/microblaze/meson.build
new file mode 100644
index 0000000000..8069ca9be6
--- /dev/null
+++ b/tests/functional/microblaze/meson.build
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_microblaze_system_thorough = [
+  'replay',
+  's3adsp1800'
+]
diff --git a/tests/functional/test_microblaze_replay.py b/tests/functional/microblaze/test_replay.py
similarity index 100%
rename from tests/functional/test_microblaze_replay.py
rename to tests/functional/microblaze/test_replay.py
diff --git a/tests/functional/test_microblaze_s3adsp1800.py b/tests/functional/microblaze/test_s3adsp1800.py
similarity index 100%
rename from tests/functional/test_microblaze_s3adsp1800.py
rename to tests/functional/microblaze/test_s3adsp1800.py
diff --git a/tests/functional/microblazeel/meson.build b/tests/functional/microblazeel/meson.build
new file mode 100644
index 0000000000..27619dc5a9
--- /dev/null
+++ b/tests/functional/microblazeel/meson.build
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_microblazeel_system_thorough = [
+  's3adsp1800'
+]
diff --git a/tests/functional/test_microblazeel_s3adsp1800.py b/tests/functional/microblazeel/test_s3adsp1800.py
similarity index 92%
rename from tests/functional/test_microblazeel_s3adsp1800.py
rename to tests/functional/microblazeel/test_s3adsp1800.py
index 915902d48b..75ce8856ed 100755
--- a/tests/functional/test_microblazeel_s3adsp1800.py
+++ b/tests/functional/microblazeel/test_s3adsp1800.py
@@ -7,7 +7,7 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later. See the COPYING file in the top-level directory.
 
-from test_microblaze_s3adsp1800 import MicroblazeMachine
+from microblaze.test_s3adsp1800 import MicroblazeMachine
 
 
 class MicroblazeLittleEndianMachine(MicroblazeMachine):

From f227c45e5b6e928a413fcf7176b59aac4e430c82 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:51 +0200
Subject: [PATCH 0025/2396] tests/functional: Move mips tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
mips tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-15-thuth@redhat.com>
---
 MAINTAINERS                                   |  8 ++--
 tests/functional/meson.build                  | 47 ++-----------------
 tests/functional/mips/meson.build             | 11 +++++
 .../test_malta.py}                            |  0
 .../test_replay.py}                           |  0
 .../test_tuxrun.py}                           |  0
 tests/functional/mips64/meson.build           | 10 ++++
 .../test_malta.py}                            |  2 +-
 .../test_tuxrun.py}                           |  0
 tests/functional/mips64el/meson.build         | 14 ++++++
 .../test_fuloong2e.py}                        |  0
 .../test_loongson3v.py}                       |  0
 .../test_malta.py}                            |  4 +-
 .../test_replay.py}                           |  0
 .../test_tuxrun.py}                           |  0
 tests/functional/mipsel/meson.build           | 12 +++++
 .../test_malta.py}                            |  2 +-
 .../test_replay.py}                           |  0
 .../test_tuxrun.py}                           |  0
 19 files changed, 59 insertions(+), 51 deletions(-)
 create mode 100644 tests/functional/mips/meson.build
 rename tests/functional/{test_mips_malta.py => mips/test_malta.py} (100%)
 rename tests/functional/{test_mips_replay.py => mips/test_replay.py} (100%)
 rename tests/functional/{test_mips_tuxrun.py => mips/test_tuxrun.py} (100%)
 create mode 100644 tests/functional/mips64/meson.build
 rename tests/functional/{test_mips64_malta.py => mips64/test_malta.py} (96%)
 rename tests/functional/{test_mips64_tuxrun.py => mips64/test_tuxrun.py} (100%)
 create mode 100644 tests/functional/mips64el/meson.build
 rename tests/functional/{test_mips64el_fuloong2e.py => mips64el/test_fuloong2e.py} (100%)
 rename tests/functional/{test_mips64el_loongson3v.py => mips64el/test_loongson3v.py} (100%)
 rename tests/functional/{test_mips64el_malta.py => mips64el/test_malta.py} (98%)
 rename tests/functional/{test_mips64el_replay.py => mips64el/test_replay.py} (100%)
 rename tests/functional/{test_mips64el_tuxrun.py => mips64el/test_tuxrun.py} (100%)
 create mode 100644 tests/functional/mipsel/meson.build
 rename tests/functional/{test_mipsel_malta.py => mipsel/test_malta.py} (98%)
 rename tests/functional/{test_mipsel_replay.py => mipsel/test_replay.py} (100%)
 mode change 100644 => 100755
 rename tests/functional/{test_mipsel_tuxrun.py => mipsel/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index b6a835777b..b8f0ce3360 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1406,8 +1406,8 @@ F: hw/acpi/piix4.c
 F: hw/mips/malta.c
 F: hw/pci-host/gt64120.c
 F: include/hw/southbridge/piix.h
-F: tests/functional/test_mips*_malta.py
-F: tests/functional/test_mips*_tuxrun.py
+F: tests/functional/mips*/test_malta.py
+F: tests/functional/mips*/test_tuxrun.py
 
 Mipssim
 R: Aleksandar Rikalo <arikalo@gmail.com>
@@ -1423,7 +1423,7 @@ S: Odd Fixes
 F: hw/mips/fuloong2e.c
 F: hw/pci-host/bonito.c
 F: include/hw/pci-host/bonito.h
-F: tests/functional/test_mips64el_fuloong2e.py
+F: tests/functional/mips64el/test_fuloong2e.py
 
 Loongson-3 virtual platforms
 M: Huacai Chen <chenhuacai@kernel.org>
@@ -1438,7 +1438,7 @@ F: hw/mips/loongson3_virt.c
 F: include/hw/intc/loongson_ipi_common.h
 F: include/hw/intc/loongson_ipi.h
 F: include/hw/intc/loongson_liointc.h
-F: tests/functional/test_mips64el_loongson3v.py
+F: tests/functional/mips64el/test_loongson3v.py
 
 Boston
 M: Paul Burton <paulburton@kernel.org>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index fee6805614..52969a3ff8 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -19,24 +19,10 @@ subdir('loongarch64')
 subdir('m68k')
 subdir('microblaze')
 subdir('microblazeel')
-
-test_mips_timeouts = {
-  'mips_malta' : 480,
-}
-
-test_mipsel_timeouts = {
-  'mipsel_malta' : 420,
-  'mipsel_replay' : 480,
-}
-
-test_mips64_timeouts = {
-  'mips64_malta' : 240,
-}
-
-test_mips64el_timeouts = {
-  'mips64el_malta' : 420,
-  'mips64el_replay' : 180,
-}
+subdir('mips')
+subdir('mipsel')
+subdir('mips64')
+subdir('mips64el')
 
 test_ppc_timeouts = {
   'ppc_40p' : 240,
@@ -84,31 +70,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_mips_system_thorough = [
-  'mips_malta',
-  'mips_replay',
-  'mips_tuxrun',
-]
-
-tests_mipsel_system_thorough = [
-  'mipsel_malta',
-  'mipsel_replay',
-  'mipsel_tuxrun',
-]
-
-tests_mips64_system_thorough = [
-  'mips64_malta',
-  'mips64_tuxrun',
-]
-
-tests_mips64el_system_thorough = [
-  'mips64el_fuloong2e',
-  'mips64el_loongson3v',
-  'mips64el_malta',
-  'mips64el_replay',
-  'mips64el_tuxrun',
-]
-
 tests_or1k_system_thorough = [
   'or1k_replay',
   'or1k_sim',
diff --git a/tests/functional/mips/meson.build b/tests/functional/mips/meson.build
new file mode 100644
index 0000000000..49aaf53b02
--- /dev/null
+++ b/tests/functional/mips/meson.build
@@ -0,0 +1,11 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_mips_timeouts = {
+  'malta' : 480,
+}
+
+tests_mips_system_thorough = [
+  'malta',
+  'replay',
+  'tuxrun',
+]
diff --git a/tests/functional/test_mips_malta.py b/tests/functional/mips/test_malta.py
similarity index 100%
rename from tests/functional/test_mips_malta.py
rename to tests/functional/mips/test_malta.py
diff --git a/tests/functional/test_mips_replay.py b/tests/functional/mips/test_replay.py
similarity index 100%
rename from tests/functional/test_mips_replay.py
rename to tests/functional/mips/test_replay.py
diff --git a/tests/functional/test_mips_tuxrun.py b/tests/functional/mips/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_mips_tuxrun.py
rename to tests/functional/mips/test_tuxrun.py
diff --git a/tests/functional/mips64/meson.build b/tests/functional/mips64/meson.build
new file mode 100644
index 0000000000..3ff2118987
--- /dev/null
+++ b/tests/functional/mips64/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_mips64_timeouts = {
+  'malta' : 240,
+}
+
+tests_mips64_system_thorough = [
+  'malta',
+  'tuxrun',
+]
diff --git a/tests/functional/test_mips64_malta.py b/tests/functional/mips64/test_malta.py
similarity index 96%
rename from tests/functional/test_mips64_malta.py
rename to tests/functional/mips64/test_malta.py
index 53c3e0c122..a553d3c5bc 100755
--- a/tests/functional/test_mips64_malta.py
+++ b/tests/functional/mips64/test_malta.py
@@ -5,7 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import LinuxKernelTest, Asset
-from test_mips_malta import mips_check_wheezy
+from mips.test_malta import mips_check_wheezy
 
 
 class MaltaMachineConsole(LinuxKernelTest):
diff --git a/tests/functional/test_mips64_tuxrun.py b/tests/functional/mips64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_mips64_tuxrun.py
rename to tests/functional/mips64/test_tuxrun.py
diff --git a/tests/functional/mips64el/meson.build b/tests/functional/mips64el/meson.build
new file mode 100644
index 0000000000..69ec50174c
--- /dev/null
+++ b/tests/functional/mips64el/meson.build
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_mips64el_timeouts = {
+  'malta' : 420,
+  'replay' : 180,
+}
+
+tests_mips64el_system_thorough = [
+  'fuloong2e',
+  'loongson3v',
+  'malta',
+  'replay',
+  'tuxrun',
+]
diff --git a/tests/functional/test_mips64el_fuloong2e.py b/tests/functional/mips64el/test_fuloong2e.py
similarity index 100%
rename from tests/functional/test_mips64el_fuloong2e.py
rename to tests/functional/mips64el/test_fuloong2e.py
diff --git a/tests/functional/test_mips64el_loongson3v.py b/tests/functional/mips64el/test_loongson3v.py
similarity index 100%
rename from tests/functional/test_mips64el_loongson3v.py
rename to tests/functional/mips64el/test_loongson3v.py
diff --git a/tests/functional/test_mips64el_malta.py b/tests/functional/mips64el/test_malta.py
similarity index 98%
rename from tests/functional/test_mips64el_malta.py
rename to tests/functional/mips64el/test_malta.py
index 3cc79b74c1..8fdc49b300 100755
--- a/tests/functional/test_mips64el_malta.py
+++ b/tests/functional/mips64el/test_malta.py
@@ -16,7 +16,7 @@ from qemu_test import LinuxKernelTest, Asset
 from qemu_test import exec_command_and_wait_for_pattern
 from qemu_test import skipIfMissingImports, skipFlakyTest, skipUntrustedTest
 
-from test_mips_malta import mips_check_wheezy
+from mips.test_malta import mips_check_wheezy
 
 
 class MaltaMachineConsole(LinuxKernelTest):
@@ -191,7 +191,7 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         self.do_test_i6400_framebuffer_logo(8)
 
 
-from test_mipsel_malta import MaltaMachineYAMON
+from mipsel.test_malta import MaltaMachineYAMON
 
 if __name__ == '__main__':
     LinuxKernelTest.main()
diff --git a/tests/functional/test_mips64el_replay.py b/tests/functional/mips64el/test_replay.py
similarity index 100%
rename from tests/functional/test_mips64el_replay.py
rename to tests/functional/mips64el/test_replay.py
diff --git a/tests/functional/test_mips64el_tuxrun.py b/tests/functional/mips64el/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_mips64el_tuxrun.py
rename to tests/functional/mips64el/test_tuxrun.py
diff --git a/tests/functional/mipsel/meson.build b/tests/functional/mipsel/meson.build
new file mode 100644
index 0000000000..8bfdf0649b
--- /dev/null
+++ b/tests/functional/mipsel/meson.build
@@ -0,0 +1,12 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_mipsel_timeouts = {
+  'malta' : 420,
+  'replay' : 480,
+}
+
+tests_mipsel_system_thorough = [
+  'malta',
+  'replay',
+  'tuxrun',
+]
diff --git a/tests/functional/test_mipsel_malta.py b/tests/functional/mipsel/test_malta.py
similarity index 98%
rename from tests/functional/test_mipsel_malta.py
rename to tests/functional/mipsel/test_malta.py
index 9ee2884da8..427e163d19 100755
--- a/tests/functional/test_mipsel_malta.py
+++ b/tests/functional/mipsel/test_malta.py
@@ -13,7 +13,7 @@ from qemu_test import QemuSystemTest, LinuxKernelTest, Asset
 from qemu_test import interrupt_interactive_console_until_pattern
 from qemu_test import wait_for_console_pattern
 
-from test_mips_malta import mips_check_wheezy
+from mips.test_malta import mips_check_wheezy
 
 
 class MaltaMachineConsole(LinuxKernelTest):
diff --git a/tests/functional/test_mipsel_replay.py b/tests/functional/mipsel/test_replay.py
old mode 100644
new mode 100755
similarity index 100%
rename from tests/functional/test_mipsel_replay.py
rename to tests/functional/mipsel/test_replay.py
diff --git a/tests/functional/test_mipsel_tuxrun.py b/tests/functional/mipsel/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_mipsel_tuxrun.py
rename to tests/functional/mipsel/test_tuxrun.py

From ff94df87caeecf3fe2b77e06d2ffe483725bcb51 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:52 +0200
Subject: [PATCH 0026/2396] tests/functional: Move or1k tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
openrisc tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-16-thuth@redhat.com>
---
 MAINTAINERS                                                 | 2 +-
 tests/functional/meson.build                                | 6 +-----
 tests/functional/or1k/meson.build                           | 6 ++++++
 .../functional/{test_or1k_replay.py => or1k/test_replay.py} | 0
 tests/functional/{test_or1k_sim.py => or1k/test_sim.py}     | 0
 5 files changed, 8 insertions(+), 6 deletions(-)
 create mode 100644 tests/functional/or1k/meson.build
 rename tests/functional/{test_or1k_replay.py => or1k/test_replay.py} (100%)
 rename tests/functional/{test_or1k_sim.py => or1k/test_sim.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index b8f0ce3360..56ba9b02c3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1457,7 +1457,7 @@ S: Maintained
 F: docs/system/openrisc/or1k-sim.rst
 F: hw/intc/ompic.c
 F: hw/openrisc/openrisc_sim.c
-F: tests/functional/test_or1k_sim.py
+F: tests/functional/or1k/test_sim.py
 
 PowerPC Machines
 ----------------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 52969a3ff8..397303ec6f 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -23,6 +23,7 @@ subdir('mips')
 subdir('mipsel')
 subdir('mips64')
 subdir('mips64el')
+subdir('or1k')
 
 test_ppc_timeouts = {
   'ppc_40p' : 240,
@@ -70,11 +71,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_or1k_system_thorough = [
-  'or1k_replay',
-  'or1k_sim',
-]
-
 tests_ppc_system_quick = [
   'ppc_migration',
   'ppc_74xx',
diff --git a/tests/functional/or1k/meson.build b/tests/functional/or1k/meson.build
new file mode 100644
index 0000000000..e246e2ab08
--- /dev/null
+++ b/tests/functional/or1k/meson.build
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_or1k_system_thorough = [
+  'replay',
+  'sim',
+]
diff --git a/tests/functional/test_or1k_replay.py b/tests/functional/or1k/test_replay.py
similarity index 100%
rename from tests/functional/test_or1k_replay.py
rename to tests/functional/or1k/test_replay.py
diff --git a/tests/functional/test_or1k_sim.py b/tests/functional/or1k/test_sim.py
similarity index 100%
rename from tests/functional/test_or1k_sim.py
rename to tests/functional/or1k/test_sim.py

From 1cdb63218c975b20699714449131c6745a512a1f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:53 +0200
Subject: [PATCH 0027/2396] tests/functional: Move ppc/ppc64 tests into
 target-specific folders

The tests/functional folder has become quite crowded, thus move the
ppc and ppc64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-17-thuth@redhat.com>
---
 MAINTAINERS                                   | 32 ++++++-------
 tests/functional/meson.build                  | 47 +------------------
 tests/functional/ppc/meson.build              | 22 +++++++++
 .../{test_ppc_40p.py => ppc/test_40p.py}      |  0
 .../{test_ppc_74xx.py => ppc/test_74xx.py}    |  0
 .../{test_ppc_amiga.py => ppc/test_amiga.py}  |  0
 .../test_bamboo.py}                           |  0
 .../{test_ppc_mac.py => ppc/test_mac.py}      |  0
 .../test_migration.py}                        |  0
 .../test_mpc8544ds.py}                        |  0
 .../test_replay.py}                           |  0
 .../test_sam460ex.py}                         |  0
 .../test_tuxrun.py}                           |  0
 .../test_virtex_ml507.py}                     |  0
 tests/functional/ppc64/meson.build            | 25 ++++++++++
 .../test_e500.py}                             |  0
 .../{test_ppc64_hv.py => ppc64/test_hv.py}    |  0
 .../test_mac99.py}                            |  0
 .../test_migration.py}                        |  0
 .../test_powernv.py}                          |  0
 .../test_pseries.py}                          |  0
 .../test_replay.py}                           |  0
 .../test_reverse_debug.py}                    |  0
 .../test_tuxrun.py}                           |  0
 24 files changed, 65 insertions(+), 61 deletions(-)
 create mode 100644 tests/functional/ppc/meson.build
 rename tests/functional/{test_ppc_40p.py => ppc/test_40p.py} (100%)
 rename tests/functional/{test_ppc_74xx.py => ppc/test_74xx.py} (100%)
 rename tests/functional/{test_ppc_amiga.py => ppc/test_amiga.py} (100%)
 rename tests/functional/{test_ppc_bamboo.py => ppc/test_bamboo.py} (100%)
 rename tests/functional/{test_ppc_mac.py => ppc/test_mac.py} (100%)
 rename tests/functional/{test_ppc_migration.py => ppc/test_migration.py} (100%)
 rename tests/functional/{test_ppc_mpc8544ds.py => ppc/test_mpc8544ds.py} (100%)
 rename tests/functional/{test_ppc_replay.py => ppc/test_replay.py} (100%)
 rename tests/functional/{test_ppc_sam460ex.py => ppc/test_sam460ex.py} (100%)
 mode change 100644 => 100755
 rename tests/functional/{test_ppc_tuxrun.py => ppc/test_tuxrun.py} (100%)
 rename tests/functional/{test_ppc_virtex_ml507.py => ppc/test_virtex_ml507.py} (100%)
 create mode 100644 tests/functional/ppc64/meson.build
 rename tests/functional/{test_ppc64_e500.py => ppc64/test_e500.py} (100%)
 rename tests/functional/{test_ppc64_hv.py => ppc64/test_hv.py} (100%)
 rename tests/functional/{test_ppc64_mac99.py => ppc64/test_mac99.py} (100%)
 rename tests/functional/{test_ppc64_migration.py => ppc64/test_migration.py} (100%)
 rename tests/functional/{test_ppc64_powernv.py => ppc64/test_powernv.py} (100%)
 rename tests/functional/{test_ppc64_pseries.py => ppc64/test_pseries.py} (100%)
 rename tests/functional/{test_ppc64_replay.py => ppc64/test_replay.py} (100%)
 rename tests/functional/{test_ppc64_reverse_debug.py => ppc64/test_reverse_debug.py} (100%)
 rename tests/functional/{test_ppc64_tuxrun.py => ppc64/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 56ba9b02c3..b0d440cf75 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -310,7 +310,7 @@ F: configs/devices/ppc*
 F: docs/system/ppc/embedded.rst
 F: docs/system/target-ppc.rst
 F: tests/tcg/ppc*/*
-F: tests/functional/test_ppc_74xx.py
+F: tests/functional/ppc/test_74xx.py
 
 RISC-V TCG CPUs
 M: Palmer Dabbelt <palmer@dabbelt.com>
@@ -1466,7 +1466,7 @@ L: qemu-ppc@nongnu.org
 S: Orphan
 F: hw/ppc/ppc440_bamboo.c
 F: hw/pci-host/ppc4xx_pci.c
-F: tests/functional/test_ppc_bamboo.py
+F: tests/functional/ppc/test_bamboo.py
 
 e500
 M: Bernhard Beschow <shentey@gmail.com>
@@ -1484,8 +1484,8 @@ F: pc-bios/u-boot.e500
 F: hw/intc/openpic_kvm.c
 F: include/hw/ppc/openpic_kvm.h
 F: docs/system/ppc/ppce500.rst
-F: tests/functional/test_ppc64_e500.py
-F: tests/functional/test_ppc_tuxrun.py
+F: tests/functional/ppc64/test_e500.py
+F: tests/functional/ppc/test_tuxrun.py
 
 mpc8544ds
 M: Bernhard Beschow <shentey@gmail.com>
@@ -1493,7 +1493,7 @@ L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/mpc8544ds.c
 F: hw/ppc/mpc8544_guts.c
-F: tests/functional/test_ppc_mpc8544ds.py
+F: tests/functional/ppc/test_mpc8544ds.py
 
 New World (mac99)
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
@@ -1515,8 +1515,8 @@ F: include/hw/ppc/mac_dbdma.h
 F: include/hw/pci-host/uninorth.h
 F: include/hw/input/adb*
 F: pc-bios/qemu_vga.ndrv
-F: tests/functional/test_ppc_mac.py
-F: tests/functional/test_ppc64_mac99.py
+F: tests/functional/ppc/test_mac.py
+F: tests/functional/ppc64/test_mac99.py
 
 Old World (g3beige)
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
@@ -1532,7 +1532,7 @@ F: include/hw/intc/heathrow_pic.h
 F: include/hw/input/adb*
 F: include/hw/pci-host/grackle.h
 F: pc-bios/qemu_vga.ndrv
-F: tests/functional/test_ppc_mac.py
+F: tests/functional/ppc/test_mac.py
 
 PReP
 M: Hervé Poussineau <hpoussin@reactos.org>
@@ -1549,7 +1549,7 @@ F: hw/dma/i82374.c
 F: hw/rtc/m48t59-isa.c
 F: include/hw/isa/pc87312.h
 F: include/hw/rtc/m48t59.h
-F: tests/functional/test_ppc_40p.py
+F: tests/functional/ppc/test_40p.py
 
 sPAPR (pseries)
 M: Nicholas Piggin <npiggin@gmail.com>
@@ -1572,9 +1572,9 @@ F: tests/qtest/spapr*
 F: tests/qtest/libqos/*spapr*
 F: tests/qtest/rtas*
 F: tests/qtest/libqos/rtas*
-F: tests/functional/test_ppc64_pseries.py
-F: tests/functional/test_ppc64_hv.py
-F: tests/functional/test_ppc64_tuxrun.py
+F: tests/functional/ppc64/test_pseries.py
+F: tests/functional/ppc64/test_hv.py
+F: tests/functional/ppc64/test_tuxrun.py
 
 PowerNV (Non-Virtualized)
 M: Nicholas Piggin <npiggin@gmail.com>
@@ -1593,7 +1593,7 @@ F: include/hw/ssi/pnv_spi*
 F: pc-bios/skiboot.lid
 F: pc-bios/pnv-pnor.bin
 F: tests/qtest/pnv*
-F: tests/functional/test_ppc64_powernv.py
+F: tests/functional/ppc64/test_powernv.py
 
 pca955x
 M: Glenn Miles <milesg@linux.ibm.com>
@@ -1608,7 +1608,7 @@ M: Edgar E. Iglesias <edgar.iglesias@gmail.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/virtex_ml507.c
-F: tests/functional/test_ppc_virtex_ml507.py
+F: tests/functional/ppc/test_virtex_ml507.py
 
 sam460ex
 M: BALATON Zoltan <balaton@eik.bme.hu>
@@ -1624,7 +1624,7 @@ F: pc-bios/dtb/canyonlands.dt[sb]
 F: pc-bios/u-boot-sam460ex-20100605.bin
 F: roms/u-boot-sam460ex
 F: docs/system/ppc/amigang.rst
-F: tests/functional/test_ppc_sam460ex.py
+F: tests/functional/ppc/test_sam460ex.py
 
 pegasos2
 M: BALATON Zoltan <balaton@eik.bme.hu>
@@ -1642,7 +1642,7 @@ S: Maintained
 F: hw/ppc/amigaone.c
 F: hw/pci-host/articia.c
 F: include/hw/pci-host/articia.h
-F: tests/functional/test_ppc_amiga.py
+F: tests/functional/ppc/test_amiga.py
 
 Virtual Open Firmware (VOF)
 M: Alexey Kardashevskiy <aik@ozlabs.ru>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 397303ec6f..3caeea5ebd 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -24,19 +24,8 @@ subdir('mipsel')
 subdir('mips64')
 subdir('mips64el')
 subdir('or1k')
-
-test_ppc_timeouts = {
-  'ppc_40p' : 240,
-}
-
-test_ppc64_timeouts = {
-  'ppc64_hv' : 1000,
-  'ppc64_powernv' : 480,
-  'ppc64_pseries' : 480,
-  'ppc64_replay' : 210,
-  'ppc64_tuxrun' : 420,
-  'ppc64_mac99' : 120,
-}
+subdir('ppc')
+subdir('ppc64')
 
 test_riscv64_timeouts = {
   'riscv64_tuxrun' : 120,
@@ -71,38 +60,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_ppc_system_quick = [
-  'ppc_migration',
-  'ppc_74xx',
-]
-
-tests_ppc_system_thorough = [
-  'ppc_40p',
-  'ppc_amiga',
-  'ppc_bamboo',
-  'ppc_mac',
-  'ppc_mpc8544ds',
-  'ppc_replay',
-  'ppc_sam460ex',
-  'ppc_tuxrun',
-  'ppc_virtex_ml507',
-]
-
-tests_ppc64_system_quick = [
-  'ppc64_migration',
-]
-
-tests_ppc64_system_thorough = [
-  'ppc64_e500',
-  'ppc64_hv',
-  'ppc64_powernv',
-  'ppc64_pseries',
-  'ppc64_replay',
-  'ppc64_reverse_debug',
-  'ppc64_tuxrun',
-  'ppc64_mac99',
-]
-
 tests_riscv32_system_quick = [
   'riscv32_migration',
   'riscv_opensbi',
diff --git a/tests/functional/ppc/meson.build b/tests/functional/ppc/meson.build
new file mode 100644
index 0000000000..3d562010d8
--- /dev/null
+++ b/tests/functional/ppc/meson.build
@@ -0,0 +1,22 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_ppc_timeouts = {
+  '40p' : 240,
+}
+
+tests_ppc_system_quick = [
+  'migration',
+  '74xx',
+]
+
+tests_ppc_system_thorough = [
+  '40p',
+  'amiga',
+  'bamboo',
+  'mac',
+  'mpc8544ds',
+  'replay',
+  'sam460ex',
+  'tuxrun',
+  'virtex_ml507',
+]
diff --git a/tests/functional/test_ppc_40p.py b/tests/functional/ppc/test_40p.py
similarity index 100%
rename from tests/functional/test_ppc_40p.py
rename to tests/functional/ppc/test_40p.py
diff --git a/tests/functional/test_ppc_74xx.py b/tests/functional/ppc/test_74xx.py
similarity index 100%
rename from tests/functional/test_ppc_74xx.py
rename to tests/functional/ppc/test_74xx.py
diff --git a/tests/functional/test_ppc_amiga.py b/tests/functional/ppc/test_amiga.py
similarity index 100%
rename from tests/functional/test_ppc_amiga.py
rename to tests/functional/ppc/test_amiga.py
diff --git a/tests/functional/test_ppc_bamboo.py b/tests/functional/ppc/test_bamboo.py
similarity index 100%
rename from tests/functional/test_ppc_bamboo.py
rename to tests/functional/ppc/test_bamboo.py
diff --git a/tests/functional/test_ppc_mac.py b/tests/functional/ppc/test_mac.py
similarity index 100%
rename from tests/functional/test_ppc_mac.py
rename to tests/functional/ppc/test_mac.py
diff --git a/tests/functional/test_ppc_migration.py b/tests/functional/ppc/test_migration.py
similarity index 100%
rename from tests/functional/test_ppc_migration.py
rename to tests/functional/ppc/test_migration.py
diff --git a/tests/functional/test_ppc_mpc8544ds.py b/tests/functional/ppc/test_mpc8544ds.py
similarity index 100%
rename from tests/functional/test_ppc_mpc8544ds.py
rename to tests/functional/ppc/test_mpc8544ds.py
diff --git a/tests/functional/test_ppc_replay.py b/tests/functional/ppc/test_replay.py
similarity index 100%
rename from tests/functional/test_ppc_replay.py
rename to tests/functional/ppc/test_replay.py
diff --git a/tests/functional/test_ppc_sam460ex.py b/tests/functional/ppc/test_sam460ex.py
old mode 100644
new mode 100755
similarity index 100%
rename from tests/functional/test_ppc_sam460ex.py
rename to tests/functional/ppc/test_sam460ex.py
diff --git a/tests/functional/test_ppc_tuxrun.py b/tests/functional/ppc/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_ppc_tuxrun.py
rename to tests/functional/ppc/test_tuxrun.py
diff --git a/tests/functional/test_ppc_virtex_ml507.py b/tests/functional/ppc/test_virtex_ml507.py
similarity index 100%
rename from tests/functional/test_ppc_virtex_ml507.py
rename to tests/functional/ppc/test_virtex_ml507.py
diff --git a/tests/functional/ppc64/meson.build b/tests/functional/ppc64/meson.build
new file mode 100644
index 0000000000..842fe0fc71
--- /dev/null
+++ b/tests/functional/ppc64/meson.build
@@ -0,0 +1,25 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_ppc64_timeouts = {
+  'hv' : 1000,
+  'mac99' : 120,
+  'powernv' : 480,
+  'pseries' : 480,
+  'replay' : 210,
+  'tuxrun' : 420,
+}
+
+tests_ppc64_system_quick = [
+  'migration',
+]
+
+tests_ppc64_system_thorough = [
+  'e500',
+  'hv',
+  'mac99',
+  'powernv',
+  'pseries',
+  'replay',
+  'reverse_debug',
+  'tuxrun',
+]
diff --git a/tests/functional/test_ppc64_e500.py b/tests/functional/ppc64/test_e500.py
similarity index 100%
rename from tests/functional/test_ppc64_e500.py
rename to tests/functional/ppc64/test_e500.py
diff --git a/tests/functional/test_ppc64_hv.py b/tests/functional/ppc64/test_hv.py
similarity index 100%
rename from tests/functional/test_ppc64_hv.py
rename to tests/functional/ppc64/test_hv.py
diff --git a/tests/functional/test_ppc64_mac99.py b/tests/functional/ppc64/test_mac99.py
similarity index 100%
rename from tests/functional/test_ppc64_mac99.py
rename to tests/functional/ppc64/test_mac99.py
diff --git a/tests/functional/test_ppc64_migration.py b/tests/functional/ppc64/test_migration.py
similarity index 100%
rename from tests/functional/test_ppc64_migration.py
rename to tests/functional/ppc64/test_migration.py
diff --git a/tests/functional/test_ppc64_powernv.py b/tests/functional/ppc64/test_powernv.py
similarity index 100%
rename from tests/functional/test_ppc64_powernv.py
rename to tests/functional/ppc64/test_powernv.py
diff --git a/tests/functional/test_ppc64_pseries.py b/tests/functional/ppc64/test_pseries.py
similarity index 100%
rename from tests/functional/test_ppc64_pseries.py
rename to tests/functional/ppc64/test_pseries.py
diff --git a/tests/functional/test_ppc64_replay.py b/tests/functional/ppc64/test_replay.py
similarity index 100%
rename from tests/functional/test_ppc64_replay.py
rename to tests/functional/ppc64/test_replay.py
diff --git a/tests/functional/test_ppc64_reverse_debug.py b/tests/functional/ppc64/test_reverse_debug.py
similarity index 100%
rename from tests/functional/test_ppc64_reverse_debug.py
rename to tests/functional/ppc64/test_reverse_debug.py
diff --git a/tests/functional/test_ppc64_tuxrun.py b/tests/functional/ppc64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_ppc64_tuxrun.py
rename to tests/functional/ppc64/test_tuxrun.py

From e1a8572a8d7a11627db22366d356d0daf0f6d559 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:54 +0200
Subject: [PATCH 0028/2396] tests/functional: Move riscv32/riscv64 tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The opensbi test is used for both, riscv32 and riscv64. Copy the main
test to the riscv64 folder and add a simple wrapper to the riscv32
folder to be able to run it for that target, too.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-18-thuth@redhat.com>
---
 MAINTAINERS                                   |  3 ++-
 tests/functional/meson.build                  | 25 ++-----------------
 tests/functional/riscv32/meson.build          | 10 ++++++++
 .../test_migration.py}                        |  0
 tests/functional/riscv32/test_opensbi.py      | 10 ++++++++
 .../test_tuxrun.py}                           |  0
 tests/functional/riscv64/meson.build          | 15 +++++++++++
 .../test_migration.py}                        |  0
 .../test_opensbi.py}                          |  0
 .../test_sifive_u.py}                         |  0
 .../test_tuxrun.py}                           |  0
 11 files changed, 39 insertions(+), 24 deletions(-)
 create mode 100644 tests/functional/riscv32/meson.build
 rename tests/functional/{test_riscv32_migration.py => riscv32/test_migration.py} (100%)
 create mode 100755 tests/functional/riscv32/test_opensbi.py
 rename tests/functional/{test_riscv32_tuxrun.py => riscv32/test_tuxrun.py} (100%)
 create mode 100644 tests/functional/riscv64/meson.build
 rename tests/functional/{test_riscv64_migration.py => riscv64/test_migration.py} (100%)
 rename tests/functional/{test_riscv_opensbi.py => riscv64/test_opensbi.py} (100%)
 rename tests/functional/{test_riscv64_sifive_u.py => riscv64/test_sifive_u.py} (100%)
 rename tests/functional/{test_riscv64_tuxrun.py => riscv64/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index b0d440cf75..81262546c4 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -332,7 +332,8 @@ F: include/hw/riscv/
 F: linux-user/host/riscv32/
 F: linux-user/host/riscv64/
 F: common-user/host/riscv*
-F: tests/functional/test_riscv*
+F: tests/functional/riscv32
+F: tests/functional/riscv64
 F: tests/tcg/riscv64/
 
 RISC-V XThead* extensions
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 3caeea5ebd..2d8f67fd94 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -26,10 +26,8 @@ subdir('mips64el')
 subdir('or1k')
 subdir('ppc')
 subdir('ppc64')
-
-test_riscv64_timeouts = {
-  'riscv64_tuxrun' : 120,
-}
+subdir('riscv32')
+subdir('riscv64')
 
 test_s390x_timeouts = {
   's390x_ccw_virtio' : 420,
@@ -60,25 +58,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_riscv32_system_quick = [
-  'riscv32_migration',
-  'riscv_opensbi',
-]
-
-tests_riscv32_system_thorough = [
-  'riscv32_tuxrun',
-]
-
-tests_riscv64_system_quick = [
-  'riscv64_migration',
-  'riscv_opensbi',
-]
-
-tests_riscv64_system_thorough = [
-  'riscv64_sifive_u',
-  'riscv64_tuxrun',
-]
-
 tests_rx_system_thorough = [
   'rx_gdbsim',
 ]
diff --git a/tests/functional/riscv32/meson.build b/tests/functional/riscv32/meson.build
new file mode 100644
index 0000000000..f3ebbb8db5
--- /dev/null
+++ b/tests/functional/riscv32/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_riscv32_system_quick = [
+  'migration',
+  'opensbi',
+]
+
+tests_riscv32_system_thorough = [
+  'tuxrun',
+]
diff --git a/tests/functional/test_riscv32_migration.py b/tests/functional/riscv32/test_migration.py
similarity index 100%
rename from tests/functional/test_riscv32_migration.py
rename to tests/functional/riscv32/test_migration.py
diff --git a/tests/functional/riscv32/test_opensbi.py b/tests/functional/riscv32/test_opensbi.py
new file mode 100755
index 0000000000..d1ac706f0b
--- /dev/null
+++ b/tests/functional/riscv32/test_opensbi.py
@@ -0,0 +1,10 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Reuse the 64-bit OpenSBI test for RISC-V 32-bit machines
+
+from riscv64.test_opensbi import RiscvOpenSBI
+
+if __name__ == '__main__':
+    RiscvOpenSBI.main()
diff --git a/tests/functional/test_riscv32_tuxrun.py b/tests/functional/riscv32/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_riscv32_tuxrun.py
rename to tests/functional/riscv32/test_tuxrun.py
diff --git a/tests/functional/riscv64/meson.build b/tests/functional/riscv64/meson.build
new file mode 100644
index 0000000000..c1704d9275
--- /dev/null
+++ b/tests/functional/riscv64/meson.build
@@ -0,0 +1,15 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_riscv64_timeouts = {
+  'tuxrun' : 120,
+}
+
+tests_riscv64_system_quick = [
+  'migration',
+  'opensbi',
+]
+
+tests_riscv64_system_thorough = [
+  'sifive_u',
+  'tuxrun',
+]
diff --git a/tests/functional/test_riscv64_migration.py b/tests/functional/riscv64/test_migration.py
similarity index 100%
rename from tests/functional/test_riscv64_migration.py
rename to tests/functional/riscv64/test_migration.py
diff --git a/tests/functional/test_riscv_opensbi.py b/tests/functional/riscv64/test_opensbi.py
similarity index 100%
rename from tests/functional/test_riscv_opensbi.py
rename to tests/functional/riscv64/test_opensbi.py
diff --git a/tests/functional/test_riscv64_sifive_u.py b/tests/functional/riscv64/test_sifive_u.py
similarity index 100%
rename from tests/functional/test_riscv64_sifive_u.py
rename to tests/functional/riscv64/test_sifive_u.py
diff --git a/tests/functional/test_riscv64_tuxrun.py b/tests/functional/riscv64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_riscv64_tuxrun.py
rename to tests/functional/riscv64/test_tuxrun.py

From bbb43ea3be12f09c284954b7b51ae8fea85ebe33 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:55 +0200
Subject: [PATCH 0029/2396] tests/functional: Move rx test into target-specific
 folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the architecture specific test into an architecture specific
subdirectory.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-19-thuth@redhat.com>
---
 MAINTAINERS                                               | 2 +-
 tests/functional/meson.build                              | 5 +----
 tests/functional/rx/meson.build                           | 5 +++++
 tests/functional/{test_rx_gdbsim.py => rx/test_gdbsim.py} | 0
 4 files changed, 7 insertions(+), 5 deletions(-)
 create mode 100644 tests/functional/rx/meson.build
 rename tests/functional/{test_rx_gdbsim.py => rx/test_gdbsim.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 81262546c4..c6410a5f5f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1721,7 +1721,7 @@ R: Yoshinori Sato <yoshinori.sato@nifty.com>
 S: Orphan
 F: docs/system/target-rx.rst
 F: hw/rx/rx-gdbsim.c
-F: tests/functional/test_rx_gdbsim.py
+F: tests/functional/rx/test_gdbsim.py
 
 SH4 Machines
 ------------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 2d8f67fd94..7e7a6aa0c9 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -28,6 +28,7 @@ subdir('ppc')
 subdir('ppc64')
 subdir('riscv32')
 subdir('riscv64')
+subdir('rx')
 
 test_s390x_timeouts = {
   's390x_ccw_virtio' : 420,
@@ -58,10 +59,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_rx_system_thorough = [
-  'rx_gdbsim',
-]
-
 tests_s390x_system_thorough = [
   's390x_ccw_virtio',
   's390x_pxelinux',
diff --git a/tests/functional/rx/meson.build b/tests/functional/rx/meson.build
new file mode 100644
index 0000000000..6af83a9f23
--- /dev/null
+++ b/tests/functional/rx/meson.build
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_rx_system_thorough = [
+  'gdbsim',
+]
diff --git a/tests/functional/test_rx_gdbsim.py b/tests/functional/rx/test_gdbsim.py
similarity index 100%
rename from tests/functional/test_rx_gdbsim.py
rename to tests/functional/rx/test_gdbsim.py

From 5e50a3c9c0f31daf53962914855accdc97a3109b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:56 +0200
Subject: [PATCH 0030/2396] tests/functional: Move s390x tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
s390x tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-20-thuth@redhat.com>
---
 MAINTAINERS                                         |  6 +++---
 tests/functional/meson.build                        | 13 +------------
 tests/functional/s390x/meson.build                  | 13 +++++++++++++
 .../test_ccw_virtio.py}                             |  0
 .../test_pxelinux.py}                               |  0
 .../{test_s390x_replay.py => s390x/test_replay.py}  |  0
 .../test_topology.py}                               |  0
 .../{test_s390x_tuxrun.py => s390x/test_tuxrun.py}  |  0
 8 files changed, 17 insertions(+), 15 deletions(-)
 create mode 100644 tests/functional/s390x/meson.build
 rename tests/functional/{test_s390x_ccw_virtio.py => s390x/test_ccw_virtio.py} (100%)
 rename tests/functional/{test_s390x_pxelinux.py => s390x/test_pxelinux.py} (100%)
 rename tests/functional/{test_s390x_replay.py => s390x/test_replay.py} (100%)
 rename tests/functional/{test_s390x_topology.py => s390x/test_topology.py} (100%)
 rename tests/functional/{test_s390x_tuxrun.py => s390x/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index c6410a5f5f..4a55a20f6a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1797,7 +1797,7 @@ S: Supported
 F: hw/s390x/
 F: include/hw/s390x/
 F: configs/devices/s390x-softmmu/default.mak
-F: tests/functional/test_s390x_*
+F: tests/functional/s390x
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
@@ -1811,7 +1811,7 @@ F: hw/s390x/ipl.*
 F: pc-bios/s390-ccw/
 F: pc-bios/s390-ccw.img
 F: docs/devel/s390-dasd-ipl.rst
-F: tests/functional/test_s390x_pxelinux.py
+F: tests/functional/s390x/test_pxelinux.py
 T: git https://github.com/borntraeger/qemu.git s390-next
 L: qemu-s390x@nongnu.org
 
@@ -1865,7 +1865,7 @@ F: hw/s390x/cpu-topology.c
 F: target/s390x/kvm/stsi-topology.c
 F: docs/devel/s390-cpu-topology.rst
 F: docs/system/s390x/cpu-topology.rst
-F: tests/functional/test_s390x_topology.py
+F: tests/functional/s390x/test_topology.py
 
 X86 Machines
 ------------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 7e7a6aa0c9..abaa4e00fc 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -29,10 +29,7 @@ subdir('ppc64')
 subdir('riscv32')
 subdir('riscv64')
 subdir('rx')
-
-test_s390x_timeouts = {
-  's390x_ccw_virtio' : 420,
-}
+subdir('s390x')
 
 test_sh4_timeouts = {
   'sh4_tuxrun' : 240,
@@ -59,14 +56,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_s390x_system_thorough = [
-  's390x_ccw_virtio',
-  's390x_pxelinux',
-  's390x_replay',
-  's390x_topology',
-  's390x_tuxrun',
-]
-
 tests_sh4_system_thorough = [
   'sh4_r2d',
   'sh4_tuxrun',
diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/meson.build
new file mode 100644
index 0000000000..030b116039
--- /dev/null
+++ b/tests/functional/s390x/meson.build
@@ -0,0 +1,13 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_s390x_timeouts = {
+  'ccw_virtio' : 420,
+}
+
+tests_s390x_system_thorough = [
+  'ccw_virtio',
+  'pxelinux',
+  'replay',
+  'topology',
+  'tuxrun',
+]
diff --git a/tests/functional/test_s390x_ccw_virtio.py b/tests/functional/s390x/test_ccw_virtio.py
similarity index 100%
rename from tests/functional/test_s390x_ccw_virtio.py
rename to tests/functional/s390x/test_ccw_virtio.py
diff --git a/tests/functional/test_s390x_pxelinux.py b/tests/functional/s390x/test_pxelinux.py
similarity index 100%
rename from tests/functional/test_s390x_pxelinux.py
rename to tests/functional/s390x/test_pxelinux.py
diff --git a/tests/functional/test_s390x_replay.py b/tests/functional/s390x/test_replay.py
similarity index 100%
rename from tests/functional/test_s390x_replay.py
rename to tests/functional/s390x/test_replay.py
diff --git a/tests/functional/test_s390x_topology.py b/tests/functional/s390x/test_topology.py
similarity index 100%
rename from tests/functional/test_s390x_topology.py
rename to tests/functional/s390x/test_topology.py
diff --git a/tests/functional/test_s390x_tuxrun.py b/tests/functional/s390x/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_s390x_tuxrun.py
rename to tests/functional/s390x/test_tuxrun.py

From 58e95a05dec8bb0c739a2b7192b6d0a96d1a99a5 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:57 +0200
Subject: [PATCH 0031/2396] tests/functional: Move sh4/sh4eb tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
sh4 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-21-thuth@redhat.com>
---
 MAINTAINERS                                       |  4 ++--
 tests/functional/meson.build                      | 15 ++-------------
 tests/functional/sh4/meson.build                  | 10 ++++++++++
 .../{test_sh4_r2d.py => sh4/test_r2d.py}          |  0
 .../{test_sh4_tuxrun.py => sh4/test_tuxrun.py}    |  0
 tests/functional/sh4eb/meson.build                |  5 +++++
 .../{test_sh4eb_r2d.py => sh4eb/test_r2d.py}      |  0
 7 files changed, 19 insertions(+), 15 deletions(-)
 create mode 100644 tests/functional/sh4/meson.build
 rename tests/functional/{test_sh4_r2d.py => sh4/test_r2d.py} (100%)
 rename tests/functional/{test_sh4_tuxrun.py => sh4/test_tuxrun.py} (100%)
 create mode 100644 tests/functional/sh4eb/meson.build
 rename tests/functional/{test_sh4eb_r2d.py => sh4eb/test_r2d.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 4a55a20f6a..eddec0058e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1736,8 +1736,8 @@ F: hw/pci-host/sh_pci.c
 F: hw/timer/sh_timer.c
 F: include/hw/sh4/sh_intc.h
 F: include/hw/timer/tmu012.h
-F: tests/functional/test_sh4*_r2d.py
-F: tests/functional/test_sh4_tuxrun.py
+F: tests/functional/sh4*/test_r2d.py
+F: tests/functional/sh4/test_tuxrun.py
 
 SPARC Machines
 --------------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index abaa4e00fc..ce713509e3 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -30,10 +30,8 @@ subdir('riscv32')
 subdir('riscv64')
 subdir('rx')
 subdir('s390x')
-
-test_sh4_timeouts = {
-  'sh4_tuxrun' : 240,
-}
+subdir('sh4')
+subdir('sh4eb')
 
 test_x86_64_timeouts = {
   'acpi_bits' : 420,
@@ -56,15 +54,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_sh4_system_thorough = [
-  'sh4_r2d',
-  'sh4_tuxrun',
-]
-
-tests_sh4eb_system_thorough = [
-  'sh4eb_r2d',
-]
-
 tests_sparc_system_quick = [
   'sparc_migration',
 ]
diff --git a/tests/functional/sh4/meson.build b/tests/functional/sh4/meson.build
new file mode 100644
index 0000000000..56f824e1e7
--- /dev/null
+++ b/tests/functional/sh4/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_sh4_timeouts = {
+  'tuxrun' : 240,
+}
+
+tests_sh4_system_thorough = [
+  'r2d',
+  'tuxrun',
+]
diff --git a/tests/functional/test_sh4_r2d.py b/tests/functional/sh4/test_r2d.py
similarity index 100%
rename from tests/functional/test_sh4_r2d.py
rename to tests/functional/sh4/test_r2d.py
diff --git a/tests/functional/test_sh4_tuxrun.py b/tests/functional/sh4/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_sh4_tuxrun.py
rename to tests/functional/sh4/test_tuxrun.py
diff --git a/tests/functional/sh4eb/meson.build b/tests/functional/sh4eb/meson.build
new file mode 100644
index 0000000000..25e9a6e404
--- /dev/null
+++ b/tests/functional/sh4eb/meson.build
@@ -0,0 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_sh4eb_system_thorough = [
+  'r2d',
+]
diff --git a/tests/functional/test_sh4eb_r2d.py b/tests/functional/sh4eb/test_r2d.py
similarity index 100%
rename from tests/functional/test_sh4eb_r2d.py
rename to tests/functional/sh4eb/test_r2d.py

From e76291a65457b1fe18b6bf7a90b1d022fa15bf9d Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:58 +0200
Subject: [PATCH 0032/2396] tests/functional: Move sparc/sparc64 tests into
 target-specific folders
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
sparc tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-22-thuth@redhat.com>
---
 MAINTAINERS                                   |  6 +++---
 tests/functional/meson.build                  | 20 ++-----------------
 tests/functional/sparc/meson.build            | 10 ++++++++++
 .../test_migration.py}                        |  0
 .../test_replay.py}                           |  0
 .../test_sun4m.py}                            |  0
 tests/functional/sparc64/meson.build          | 10 ++++++++++
 .../test_migration.py}                        |  0
 .../test_sun4u.py}                            |  0
 .../test_tuxrun.py}                           |  0
 10 files changed, 25 insertions(+), 21 deletions(-)
 create mode 100644 tests/functional/sparc/meson.build
 rename tests/functional/{test_sparc_migration.py => sparc/test_migration.py} (100%)
 rename tests/functional/{test_sparc_replay.py => sparc/test_replay.py} (100%)
 rename tests/functional/{test_sparc_sun4m.py => sparc/test_sun4m.py} (100%)
 create mode 100644 tests/functional/sparc64/meson.build
 rename tests/functional/{test_sparc64_migration.py => sparc64/test_migration.py} (100%)
 rename tests/functional/{test_sparc64_sun4u.py => sparc64/test_sun4u.py} (100%)
 rename tests/functional/{test_sparc64_tuxrun.py => sparc64/test_tuxrun.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index eddec0058e..b46445ff5c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1755,7 +1755,7 @@ F: include/hw/nvram/sun_nvram.h
 F: include/hw/sparc/sparc32_dma.h
 F: include/hw/sparc/sun4m_iommu.h
 F: pc-bios/openbios-sparc32
-F: tests/functional/test_sparc_sun4m.py
+F: tests/functional/sparc/test_sun4m.py
 
 Sun4u
 M: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
@@ -1768,8 +1768,8 @@ F: include/hw/pci-host/sabre.h
 F: hw/pci-bridge/simba.c
 F: include/hw/pci-bridge/simba.h
 F: pc-bios/openbios-sparc64
-F: tests/functional/test_sparc64_sun4u.py
-F: tests/functional/test_sparc64_tuxrun.py
+F: tests/functional/sparc64/test_sun4u.py
+F: tests/functional/sparc64/test_tuxrun.py
 
 Sun4v
 M: Artyom Tarasenko <atar4qemu@gmail.com>
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index ce713509e3..00d18dba3c 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -32,6 +32,8 @@ subdir('rx')
 subdir('s390x')
 subdir('sh4')
 subdir('sh4eb')
+subdir('sparc')
+subdir('sparc64')
 
 test_x86_64_timeouts = {
   'acpi_bits' : 420,
@@ -54,24 +56,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_sparc_system_quick = [
-  'sparc_migration',
-]
-
-tests_sparc_system_thorough = [
-  'sparc_replay',
-  'sparc_sun4m',
-]
-
-tests_sparc64_system_quick = [
-  'sparc64_migration',
-]
-
-tests_sparc64_system_thorough = [
-  'sparc64_sun4u',
-  'sparc64_tuxrun',
-]
-
 tests_x86_64_system_quick = [
   'cpu_queries',
   'mem_addr_space',
diff --git a/tests/functional/sparc/meson.build b/tests/functional/sparc/meson.build
new file mode 100644
index 0000000000..88732becd8
--- /dev/null
+++ b/tests/functional/sparc/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_sparc_system_quick = [
+  'migration',
+]
+
+tests_sparc_system_thorough = [
+  'replay',
+  'sun4m',
+]
diff --git a/tests/functional/test_sparc_migration.py b/tests/functional/sparc/test_migration.py
similarity index 100%
rename from tests/functional/test_sparc_migration.py
rename to tests/functional/sparc/test_migration.py
diff --git a/tests/functional/test_sparc_replay.py b/tests/functional/sparc/test_replay.py
similarity index 100%
rename from tests/functional/test_sparc_replay.py
rename to tests/functional/sparc/test_replay.py
diff --git a/tests/functional/test_sparc_sun4m.py b/tests/functional/sparc/test_sun4m.py
similarity index 100%
rename from tests/functional/test_sparc_sun4m.py
rename to tests/functional/sparc/test_sun4m.py
diff --git a/tests/functional/sparc64/meson.build b/tests/functional/sparc64/meson.build
new file mode 100644
index 0000000000..2e04e7d4f3
--- /dev/null
+++ b/tests/functional/sparc64/meson.build
@@ -0,0 +1,10 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_sparc64_system_quick = [
+  'migration',
+]
+
+tests_sparc64_system_thorough = [
+  'sun4u',
+  'tuxrun',
+]
diff --git a/tests/functional/test_sparc64_migration.py b/tests/functional/sparc64/test_migration.py
similarity index 100%
rename from tests/functional/test_sparc64_migration.py
rename to tests/functional/sparc64/test_migration.py
diff --git a/tests/functional/test_sparc64_sun4u.py b/tests/functional/sparc64/test_sun4u.py
similarity index 100%
rename from tests/functional/test_sparc64_sun4u.py
rename to tests/functional/sparc64/test_sun4u.py
diff --git a/tests/functional/test_sparc64_tuxrun.py b/tests/functional/sparc64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_sparc64_tuxrun.py
rename to tests/functional/sparc64/test_tuxrun.py

From 1917d47dd78adbd30abd462712458d0a0b583308 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:23:59 +0200
Subject: [PATCH 0033/2396] tests/functional: Move x86_64 tests into
 target-specific folder

The tests/functional folder has become quite crowded, thus move the
x86_64 tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-23-thuth@redhat.com>
---
 MAINTAINERS                                   | 32 ++++++++--------
 tests/functional/meson.build                  | 37 +------------------
 tests/functional/x86_64/meson.build           | 37 +++++++++++++++++++
 .../functional/{ => x86_64}/test_acpi_bits.py |  0
 .../test_cpu_model_versions.py}               |  0
 .../{ => x86_64}/test_cpu_queries.py          |  0
 .../test_hotplug_blk.py}                      |  0
 .../test_hotplug_cpu.py}                      |  0
 .../{ => x86_64}/test_intel_iommu.py          |  0
 .../test_kvm_xen.py}                          |  0
 .../{ => x86_64}/test_linux_initrd.py         |  0
 .../{ => x86_64}/test_mem_addr_space.py       |  0
 tests/functional/{ => x86_64}/test_memlock.py |  0
 .../test_migration.py}                        |  0
 .../test_multiprocess.py}                     |  0
 .../{ => x86_64}/test_netdev_ethtool.py       |  0
 .../{ => x86_64}/test_pc_cpu_hotplug_props.py |  0
 .../test_replay.py}                           |  0
 .../test_reverse_debug.py}                    |  0
 .../test_tuxrun.py}                           |  0
 .../{ => x86_64}/test_virtio_balloon.py       |  0
 .../{ => x86_64}/test_virtio_gpu.py           |  0
 .../{ => x86_64}/test_virtio_version.py       |  0
 23 files changed, 55 insertions(+), 51 deletions(-)
 create mode 100644 tests/functional/x86_64/meson.build
 rename tests/functional/{ => x86_64}/test_acpi_bits.py (100%)
 rename tests/functional/{test_x86_cpu_model_versions.py => x86_64/test_cpu_model_versions.py} (100%)
 rename tests/functional/{ => x86_64}/test_cpu_queries.py (100%)
 rename tests/functional/{test_x86_64_hotplug_blk.py => x86_64/test_hotplug_blk.py} (100%)
 rename tests/functional/{test_x86_64_hotplug_cpu.py => x86_64/test_hotplug_cpu.py} (100%)
 rename tests/functional/{ => x86_64}/test_intel_iommu.py (100%)
 rename tests/functional/{test_x86_64_kvm_xen.py => x86_64/test_kvm_xen.py} (100%)
 rename tests/functional/{ => x86_64}/test_linux_initrd.py (100%)
 rename tests/functional/{ => x86_64}/test_mem_addr_space.py (100%)
 rename tests/functional/{ => x86_64}/test_memlock.py (100%)
 rename tests/functional/{test_x86_64_migration.py => x86_64/test_migration.py} (100%)
 rename tests/functional/{test_x86_64_multiprocess.py => x86_64/test_multiprocess.py} (100%)
 rename tests/functional/{ => x86_64}/test_netdev_ethtool.py (100%)
 rename tests/functional/{ => x86_64}/test_pc_cpu_hotplug_props.py (100%)
 rename tests/functional/{test_x86_64_replay.py => x86_64/test_replay.py} (100%)
 rename tests/functional/{test_x86_64_reverse_debug.py => x86_64/test_reverse_debug.py} (100%)
 rename tests/functional/{test_x86_64_tuxrun.py => x86_64/test_tuxrun.py} (100%)
 rename tests/functional/{ => x86_64}/test_virtio_balloon.py (100%)
 rename tests/functional/{ => x86_64}/test_virtio_gpu.py (100%)
 rename tests/functional/{ => x86_64}/test_virtio_version.py (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index b46445ff5c..7b1a94f696 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -147,6 +147,7 @@ F: target/i386/Kconfig
 F: target/i386/meson.build
 F: tools/i386/
 F: tests/functional/i386/
+F: tests/functional/x86_64/
 
 Guest CPU cores (TCG)
 ---------------------
@@ -483,7 +484,7 @@ F: docs/system/i386/sgx.rst
 F: target/i386/kvm/
 F: target/i386/sev*
 F: scripts/kvm/vmxcap
-F: tests/functional/test_x86_64_hotplug_cpu.py
+F: tests/functional/x86_64/test_hotplug_cpu.py
 
 Xen emulation on X86 KVM CPUs
 M: David Woodhouse <dwmw2@infradead.org>
@@ -492,7 +493,7 @@ S: Supported
 F: include/system/kvm_xen.h
 F: target/i386/kvm/xen*
 F: hw/i386/kvm/xen*
-F: tests/functional/test_x86_64_kvm_xen.py
+F: tests/functional/x86_64/test_kvm_xen.py
 
 Guest CPU Cores (other accelerators)
 ------------------------------------
@@ -1894,11 +1895,11 @@ F: include/hw/isa/apm.h
 F: tests/unit/test-x86-topo.c
 F: tests/qtest/test-x86-cpuid-compat.c
 F: tests/functional/i386/test_tuxrun.py
-F: tests/functional/test_linux_initrd.py
-F: tests/functional/test_mem_addr_space.py
-F: tests/functional/test_pc_cpu_hotplug_props.py
-F: tests/functional/test_x86_64_tuxrun.py
-F: tests/functional/test_x86_cpu_model_versions.py
+F: tests/functional/x86_64/test_linux_initrd.py
+F: tests/functional/x86_64/test_mem_addr_space.py
+F: tests/functional/x86_64/test_pc_cpu_hotplug_props.py
+F: tests/functional/x86_64/test_tuxrun.py
+F: tests/functional/x86_64/test_cpu_model_versions.py
 
 PC Chipset
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -1974,7 +1975,7 @@ F: include/hw/boards.h
 F: include/hw/core/cpu.h
 F: include/hw/cpu/cluster.h
 F: include/system/numa.h
-F: tests/functional/test_cpu_queries.py
+F: tests/functional/x86_64/test_cpu_queries.py
 F: tests/functional/test_empty_cpu_model.py
 F: tests/unit/test-smp-parse.c
 T: git https://gitlab.com/ehabkost/qemu.git machine-next
@@ -2159,7 +2160,7 @@ M: Ani Sinha <anisinha@redhat.com>
 M: Michael S. Tsirkin <mst@redhat.com>
 S: Supported
 F: tests/functional/acpi-bits/*
-F: tests/functional/test_acpi_bits.py
+F: tests/functional/x86_64/test_acpi_bits.py
 F: docs/devel/testing/acpi-bits.rst
 
 ACPI/HEST/GHES
@@ -2345,7 +2346,7 @@ F: net/vhost-user.c
 F: include/hw/virtio/
 F: docs/devel/virtio*
 F: docs/devel/migration/virtio.rst
-F: tests/functional/test_virtio_version.py
+F: tests/functional/x86_64/test_virtio_version.py
 
 virtio-balloon
 M: Michael S. Tsirkin <mst@redhat.com>
@@ -2357,7 +2358,7 @@ F: include/hw/virtio/virtio-balloon.h
 F: system/balloon.c
 F: include/system/balloon.h
 F: tests/qtest/virtio-balloon-test.c
-F: tests/functional/test_virtio_balloon.py
+F: tests/functional/x86_64/test_virtio_balloon.py
 
 virtio-9p
 M: Christian Schoenebeck <qemu_oss@crudebyte.com>
@@ -2380,7 +2381,7 @@ F: hw/block/virtio-blk.c
 F: hw/block/dataplane/*
 F: include/hw/virtio/virtio-blk-common.h
 F: tests/qtest/virtio-blk-test.c
-F: tests/functional/test_x86_64_hotplug_blk.py
+F: tests/functional/x86_64/test_hotplug_blk.py
 T: git https://github.com/stefanha/qemu.git block
 
 virtio-ccw
@@ -2604,7 +2605,7 @@ R: Sriram Yagnaraman <sriram.yagnaraman@ericsson.com>
 S: Odd Fixes
 F: docs/system/devices/igb.rst
 F: hw/net/igb*
-F: tests/functional/test_netdev_ethtool.py
+F: tests/functional/x86_64/test_netdev_ethtool.py
 F: tests/qtest/igb-test.c
 F: tests/qtest/libqos/igb.c
 
@@ -2713,6 +2714,7 @@ F: hw/display/virtio-vga.*
 F: include/hw/virtio/virtio-gpu.h
 F: docs/system/devices/virtio-gpu.rst
 F: tests/functional/aarch64/test_virt_gpu.py
+F: tests/functional/x86_64/test_virtio_gpu.py
 
 vhost-user-blk
 M: Raphael Norwitz <raphael@enfabrica.net>
@@ -3856,7 +3858,7 @@ S: Supported
 F: hw/i386/intel_iommu.c
 F: hw/i386/intel_iommu_internal.h
 F: include/hw/i386/intel_iommu.h
-F: tests/functional/test_intel_iommu.py
+F: tests/functional/x86_64/test_intel_iommu.py
 F: tests/qtest/intel-iommu-test.c
 
 AMD-Vi Emulation
@@ -4330,7 +4332,7 @@ F: scripts/ci/
 F: tests/docker/
 F: tests/vm/
 F: tests/lcitool/
-F: tests/functional/test_*_tuxrun.py
+F: tests/functional/*/test_tuxrun.py
 F: scripts/archive-source.sh
 F: docs/devel/testing/ci*
 F: docs/devel/testing/main.rst
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 00d18dba3c..34e30239a6 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -34,15 +34,7 @@ subdir('sh4')
 subdir('sh4eb')
 subdir('sparc')
 subdir('sparc64')
-
-test_x86_64_timeouts = {
-  'acpi_bits' : 420,
-  'intel_iommu': 300,
-  'netdev_ethtool' : 180,
-  'virtio_balloon': 120,
-  'x86_64_kvm_xen' : 180,
-  'x86_64_replay' : 480,
-}
+subdir('x86_64')
 
 tests_generic_system = [
   'empty_cpu_model',
@@ -56,33 +48,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_x86_64_system_quick = [
-  'cpu_queries',
-  'mem_addr_space',
-  'x86_64_migration',
-  'pc_cpu_hotplug_props',
-  'virtio_version',
-  'x86_cpu_model_versions',
-  'vnc',
-  'memlock',
-]
-
-tests_x86_64_system_thorough = [
-  'acpi_bits',
-  'intel_iommu',
-  'linux_initrd',
-  'x86_64_multiprocess',
-  'netdev_ethtool',
-  'virtio_balloon',
-  'virtio_gpu',
-  'x86_64_hotplug_blk',
-  'x86_64_hotplug_cpu',
-  'x86_64_kvm_xen',
-  'x86_64_replay',
-  'x86_64_reverse_debug',
-  'x86_64_tuxrun',
-]
-
 tests_xtensa_system_thorough = [
   'xtensa_lx60',
   'xtensa_replay',
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
new file mode 100644
index 0000000000..696a9ecab4
--- /dev/null
+++ b/tests/functional/x86_64/meson.build
@@ -0,0 +1,37 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_x86_64_timeouts = {
+  'acpi_bits' : 420,
+  'intel_iommu': 300,
+  'kvm_xen' : 180,
+  'netdev_ethtool' : 180,
+  'replay' : 480,
+  'virtio_balloon': 120,
+}
+
+tests_x86_64_system_quick = [
+  'cpu_model_versions',
+  'cpu_queries',
+  'mem_addr_space',
+  'migration',
+  'pc_cpu_hotplug_props',
+  'virtio_version',
+  'vnc',
+  'memlock',
+]
+
+tests_x86_64_system_thorough = [
+  'acpi_bits',
+  'hotplug_blk',
+  'hotplug_cpu',
+  'intel_iommu',
+  'kvm_xen',
+  'linux_initrd',
+  'multiprocess',
+  'netdev_ethtool',
+  'replay',
+  'reverse_debug',
+  'tuxrun',
+  'virtio_balloon',
+  'virtio_gpu',
+]
diff --git a/tests/functional/test_acpi_bits.py b/tests/functional/x86_64/test_acpi_bits.py
similarity index 100%
rename from tests/functional/test_acpi_bits.py
rename to tests/functional/x86_64/test_acpi_bits.py
diff --git a/tests/functional/test_x86_cpu_model_versions.py b/tests/functional/x86_64/test_cpu_model_versions.py
similarity index 100%
rename from tests/functional/test_x86_cpu_model_versions.py
rename to tests/functional/x86_64/test_cpu_model_versions.py
diff --git a/tests/functional/test_cpu_queries.py b/tests/functional/x86_64/test_cpu_queries.py
similarity index 100%
rename from tests/functional/test_cpu_queries.py
rename to tests/functional/x86_64/test_cpu_queries.py
diff --git a/tests/functional/test_x86_64_hotplug_blk.py b/tests/functional/x86_64/test_hotplug_blk.py
similarity index 100%
rename from tests/functional/test_x86_64_hotplug_blk.py
rename to tests/functional/x86_64/test_hotplug_blk.py
diff --git a/tests/functional/test_x86_64_hotplug_cpu.py b/tests/functional/x86_64/test_hotplug_cpu.py
similarity index 100%
rename from tests/functional/test_x86_64_hotplug_cpu.py
rename to tests/functional/x86_64/test_hotplug_cpu.py
diff --git a/tests/functional/test_intel_iommu.py b/tests/functional/x86_64/test_intel_iommu.py
similarity index 100%
rename from tests/functional/test_intel_iommu.py
rename to tests/functional/x86_64/test_intel_iommu.py
diff --git a/tests/functional/test_x86_64_kvm_xen.py b/tests/functional/x86_64/test_kvm_xen.py
similarity index 100%
rename from tests/functional/test_x86_64_kvm_xen.py
rename to tests/functional/x86_64/test_kvm_xen.py
diff --git a/tests/functional/test_linux_initrd.py b/tests/functional/x86_64/test_linux_initrd.py
similarity index 100%
rename from tests/functional/test_linux_initrd.py
rename to tests/functional/x86_64/test_linux_initrd.py
diff --git a/tests/functional/test_mem_addr_space.py b/tests/functional/x86_64/test_mem_addr_space.py
similarity index 100%
rename from tests/functional/test_mem_addr_space.py
rename to tests/functional/x86_64/test_mem_addr_space.py
diff --git a/tests/functional/test_memlock.py b/tests/functional/x86_64/test_memlock.py
similarity index 100%
rename from tests/functional/test_memlock.py
rename to tests/functional/x86_64/test_memlock.py
diff --git a/tests/functional/test_x86_64_migration.py b/tests/functional/x86_64/test_migration.py
similarity index 100%
rename from tests/functional/test_x86_64_migration.py
rename to tests/functional/x86_64/test_migration.py
diff --git a/tests/functional/test_x86_64_multiprocess.py b/tests/functional/x86_64/test_multiprocess.py
similarity index 100%
rename from tests/functional/test_x86_64_multiprocess.py
rename to tests/functional/x86_64/test_multiprocess.py
diff --git a/tests/functional/test_netdev_ethtool.py b/tests/functional/x86_64/test_netdev_ethtool.py
similarity index 100%
rename from tests/functional/test_netdev_ethtool.py
rename to tests/functional/x86_64/test_netdev_ethtool.py
diff --git a/tests/functional/test_pc_cpu_hotplug_props.py b/tests/functional/x86_64/test_pc_cpu_hotplug_props.py
similarity index 100%
rename from tests/functional/test_pc_cpu_hotplug_props.py
rename to tests/functional/x86_64/test_pc_cpu_hotplug_props.py
diff --git a/tests/functional/test_x86_64_replay.py b/tests/functional/x86_64/test_replay.py
similarity index 100%
rename from tests/functional/test_x86_64_replay.py
rename to tests/functional/x86_64/test_replay.py
diff --git a/tests/functional/test_x86_64_reverse_debug.py b/tests/functional/x86_64/test_reverse_debug.py
similarity index 100%
rename from tests/functional/test_x86_64_reverse_debug.py
rename to tests/functional/x86_64/test_reverse_debug.py
diff --git a/tests/functional/test_x86_64_tuxrun.py b/tests/functional/x86_64/test_tuxrun.py
similarity index 100%
rename from tests/functional/test_x86_64_tuxrun.py
rename to tests/functional/x86_64/test_tuxrun.py
diff --git a/tests/functional/test_virtio_balloon.py b/tests/functional/x86_64/test_virtio_balloon.py
similarity index 100%
rename from tests/functional/test_virtio_balloon.py
rename to tests/functional/x86_64/test_virtio_balloon.py
diff --git a/tests/functional/test_virtio_gpu.py b/tests/functional/x86_64/test_virtio_gpu.py
similarity index 100%
rename from tests/functional/test_virtio_gpu.py
rename to tests/functional/x86_64/test_virtio_gpu.py
diff --git a/tests/functional/test_virtio_version.py b/tests/functional/x86_64/test_virtio_version.py
similarity index 100%
rename from tests/functional/test_virtio_version.py
rename to tests/functional/x86_64/test_virtio_version.py

From e365d26e42281aae3dcb47aa63c862892efadb0c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:24:00 +0200
Subject: [PATCH 0034/2396] tests/functional: Move xtensa tests into
 target-specific folder
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tests/functional folder has become quite crowded, thus move the
xtensa tests into a target-specific subfolder.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-24-thuth@redhat.com>
---
 MAINTAINERS                                                 | 2 +-
 tests/functional/meson.build                                | 6 +-----
 tests/functional/xtensa/meson.build                         | 6 ++++++
 .../functional/{test_xtensa_lx60.py => xtensa/test_lx60.py} | 0
 .../{test_xtensa_replay.py => xtensa/test_replay.py}        | 0
 5 files changed, 8 insertions(+), 6 deletions(-)
 create mode 100644 tests/functional/xtensa/meson.build
 rename tests/functional/{test_xtensa_lx60.py => xtensa/test_lx60.py} (100%)
 rename tests/functional/{test_xtensa_replay.py => xtensa/test_replay.py} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 7b1a94f696..792d2d6f2d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2005,7 +2005,7 @@ S: Maintained
 F: hw/xtensa/xtfpga.c
 F: hw/net/opencores_eth.c
 F: include/hw/xtensa/mx_pic.h
-F: tests/functional/test_xtensa_lx60.py
+F: tests/functional/xtensa/test_lx60.py
 
 Devices
 -------
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 34e30239a6..b1eec16add 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -35,6 +35,7 @@ subdir('sh4eb')
 subdir('sparc')
 subdir('sparc64')
 subdir('x86_64')
+subdir('xtensa')
 
 tests_generic_system = [
   'empty_cpu_model',
@@ -48,11 +49,6 @@ tests_generic_linuxuser = [
 tests_generic_bsduser = [
 ]
 
-tests_xtensa_system_thorough = [
-  'xtensa_lx60',
-  'xtensa_replay',
-]
-
 precache_all = []
 foreach speed : ['quick', 'thorough']
   foreach dir : target_dirs
diff --git a/tests/functional/xtensa/meson.build b/tests/functional/xtensa/meson.build
new file mode 100644
index 0000000000..d61d82a135
--- /dev/null
+++ b/tests/functional/xtensa/meson.build
@@ -0,0 +1,6 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_xtensa_system_thorough = [
+  'lx60',
+  'replay',
+]
diff --git a/tests/functional/test_xtensa_lx60.py b/tests/functional/xtensa/test_lx60.py
similarity index 100%
rename from tests/functional/test_xtensa_lx60.py
rename to tests/functional/xtensa/test_lx60.py
diff --git a/tests/functional/test_xtensa_replay.py b/tests/functional/xtensa/test_replay.py
similarity index 100%
rename from tests/functional/test_xtensa_replay.py
rename to tests/functional/xtensa/test_replay.py

From 0137f60b37c5678e9fa4971fd7e4f07afed33294 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:24:01 +0200
Subject: [PATCH 0035/2396] tests/functional: Move the generic tests to a
 subfolder

This also removes the line for using tests from the main folder
since we do not have any tests left here. And while we're at it,
also mark the vnc test as generic now since it is not specific to x86.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-25-thuth@redhat.com>
---
 MAINTAINERS                                     |  8 ++++----
 tests/functional/generic/meson.build            | 14 ++++++++++++++
 .../{ => generic}/test_empty_cpu_model.py       |  0
 .../{ => generic}/test_info_usernet.py          |  0
 tests/functional/{ => generic}/test_version.py  |  0
 tests/functional/{ => generic}/test_vnc.py      |  0
 tests/functional/meson.build                    | 17 ++---------------
 tests/functional/x86_64/meson.build             |  1 -
 8 files changed, 20 insertions(+), 20 deletions(-)
 create mode 100644 tests/functional/generic/meson.build
 rename tests/functional/{ => generic}/test_empty_cpu_model.py (100%)
 rename tests/functional/{ => generic}/test_info_usernet.py (100%)
 rename tests/functional/{ => generic}/test_version.py (100%)
 rename tests/functional/{ => generic}/test_vnc.py (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 792d2d6f2d..625fe67b41 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1976,7 +1976,7 @@ F: include/hw/core/cpu.h
 F: include/hw/cpu/cluster.h
 F: include/system/numa.h
 F: tests/functional/x86_64/test_cpu_queries.py
-F: tests/functional/test_empty_cpu_model.py
+F: tests/functional/generic/test_empty_cpu_model.py
 F: tests/unit/test-smp-parse.c
 T: git https://gitlab.com/ehabkost/qemu.git machine-next
 
@@ -2197,7 +2197,7 @@ S: Odd Fixes
 F: hw/net/
 F: include/hw/net/
 F: tests/qtest/virtio-net-test.c
-F: tests/functional/test_info_usernet.py
+F: tests/functional/generic/test_info_usernet.py
 F: docs/system/virtio-net-failover.rst
 T: git https://github.com/jasowang/qemu.git net
 
@@ -3134,7 +3134,7 @@ S: Supported
 F: include/qemu/option.h
 F: tests/unit/test-keyval.c
 F: tests/unit/test-qemu-opts.c
-F: tests/functional/test_version.py
+F: tests/functional/generic/test_version.py
 F: util/keyval.c
 F: util/qemu-option.c
 
@@ -3252,7 +3252,7 @@ F: include/ui/
 F: qapi/ui.json
 F: util/drm.c
 F: docs/devel/ui.rst
-F: tests/functional/test_vnc.py
+F: tests/functional/generic/test_vnc.py
 
 Cocoa graphics
 M: Peter Maydell <peter.maydell@linaro.org>
diff --git a/tests/functional/generic/meson.build b/tests/functional/generic/meson.build
new file mode 100644
index 0000000000..013cc96fbf
--- /dev/null
+++ b/tests/functional/generic/meson.build
@@ -0,0 +1,14 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+tests_generic_system = [
+  'empty_cpu_model',
+  'info_usernet',
+  'version',
+  'vnc',
+]
+
+tests_generic_linuxuser = [
+]
+
+tests_generic_bsduser = [
+]
diff --git a/tests/functional/test_empty_cpu_model.py b/tests/functional/generic/test_empty_cpu_model.py
similarity index 100%
rename from tests/functional/test_empty_cpu_model.py
rename to tests/functional/generic/test_empty_cpu_model.py
diff --git a/tests/functional/test_info_usernet.py b/tests/functional/generic/test_info_usernet.py
similarity index 100%
rename from tests/functional/test_info_usernet.py
rename to tests/functional/generic/test_info_usernet.py
diff --git a/tests/functional/test_version.py b/tests/functional/generic/test_version.py
similarity index 100%
rename from tests/functional/test_version.py
rename to tests/functional/generic/test_version.py
diff --git a/tests/functional/test_vnc.py b/tests/functional/generic/test_vnc.py
similarity index 100%
rename from tests/functional/test_vnc.py
rename to tests/functional/generic/test_vnc.py
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index b1eec16add..2a0c5aa141 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -36,18 +36,7 @@ subdir('sparc')
 subdir('sparc64')
 subdir('x86_64')
 subdir('xtensa')
-
-tests_generic_system = [
-  'empty_cpu_model',
-  'info_usernet',
-  'version',
-]
-
-tests_generic_linuxuser = [
-]
-
-tests_generic_bsduser = [
-]
+subdir('generic')
 
 precache_all = []
 foreach speed : ['quick', 'thorough']
@@ -90,9 +79,7 @@ foreach speed : ['quick', 'thorough']
 
     foreach test : target_tests
       testname = '@0@-@1@'.format(target_base, test)
-      if fs.exists('test_' + test + '.py')
-        testfile = 'test_' + test + '.py'
-      elif fs.exists('generic' / 'test_' + test + '.py')
+      if fs.exists('generic' / 'test_' + test + '.py')
         testfile = 'generic' / 'test_' + test + '.py'
       else
         testfile = target_base / 'test_' + test + '.py'
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
index 696a9ecab4..d0b4667bb8 100644
--- a/tests/functional/x86_64/meson.build
+++ b/tests/functional/x86_64/meson.build
@@ -16,7 +16,6 @@ tests_x86_64_system_quick = [
   'migration',
   'pc_cpu_hotplug_props',
   'virtio_version',
-  'vnc',
   'memlock',
 ]
 

From 45d34fa8a4f7fed96f7fbf2ae42b33382bf25d0d Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 19 Aug 2025 13:24:02 +0200
Subject: [PATCH 0036/2396] MAINTAINERS: Adjust wildcards for the migration,
 multiprocess and replay tests

Now that we moved the tests into subfolders, we have to adjust the
wildcards accordingly.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250819112403.432587-26-thuth@redhat.com>
---
 MAINTAINERS | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 625fe67b41..a64b5b849b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3604,7 +3604,8 @@ F: include/migration/
 F: include/qemu/userfaultfd.h
 F: migration/
 F: scripts/vmstate-static-checker.py
-F: tests/functional/*migration.py
+F: tests/functional/migration.py
+F: tests/functional/*/*migration.py
 F: tests/vmstate-static-checker-data/
 F: tests/qtest/migration/
 F: tests/qtest/migration-*
@@ -3773,8 +3774,10 @@ F: include/system/replay.h
 F: docs/devel/replay.rst
 F: docs/system/replay.rst
 F: stubs/replay.c
-F: tests/functional/*reverse_debug*.py
-F: tests/functional/*replay*.py
+F: tests/functional/replay_kernel.py
+F: tests/functional/reverse_debugging.py
+F: tests/functional/*/*replay*.py
+F: tests/functional/*/*reverse_debug*.py
 F: qapi/replay.json
 
 IOVA Tree
@@ -4293,7 +4296,8 @@ F: hw/remote/vfio-user-obj.c
 F: include/hw/remote/vfio-user-obj.h
 F: hw/remote/iommu.c
 F: include/hw/remote/iommu.h
-F: tests/functional/*multiprocess.py
+F: tests/functional/multiprocess.py
+F: tests/functional/*/*multiprocess.py
 
 VFIO-USER:
 M: John Levon <john.levon@nutanix.com>

From 0ac3c314130eff8e3ea9860fe3202908a7746225 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 19 Aug 2025 14:39:15 +0000
Subject: [PATCH 0037/2396] tests/functional: Mark main in QemuBaseTest class
 as a static method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The main() method in the QemuBaseTest class has no parameters but is
defined as a regular method. Currently, this does not cause any issues
because in the functional tests main() is always called directly from
QemuBaseTest (never from instances), but the way this method is defined
makes its signature wrong, implying a 'self'. Hence, it's best practice
to define such a method as a static method, so decorate it with
@staticmethod.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20250819143916.4138035-4-gustavo.romero@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 5caf7b13fe..fbeb171058 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -235,6 +235,7 @@ class QemuBaseTest(unittest.TestCase):
         self.log.removeHandler(self._log_fh)
         self._log_fh.close()
 
+    @staticmethod
     def main():
         warnings.simplefilter("default")
         os.environ["PYTHONWARNINGS"] = "default"

From a7542a38f399c50337e10aadd60513a400c45013 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Thu, 14 Aug 2025 17:21:11 +0800
Subject: [PATCH 0038/2396] x86/loader: Don't update kernel header for CoCo VMs

Update the header makes it different from the original kernel that user
provides via "-kernel", which leads to a different hash and breaks the
attestation, e.g., for TDX.

We already skip it for SEV VMs. Instead of adding another check of
is_tdx_vm() to cover the TDX case, check machine->cgs to cover all the
confidential computing case for x86.

Reported-by: Vikrant Garg <vikrant1garg@gmail.com>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250814092111.2353598-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/x86-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index b1b5f11e73..7512be64d6 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -952,7 +952,7 @@ void x86_load_linux(X86MachineState *x86ms,
      * kernel on the other side of the fw_cfg interface matches the hash of the
      * file the user passed in.
      */
-    if (!sev_enabled() && protocol > 0) {
+    if (!MACHINE(x86ms)->cgs && protocol > 0) {
         memcpy(setup, header, MIN(sizeof(header), setup_size));
     }
 

From c12cbaa007c9da97a11e74119ea3aed9fcc3ac4c Mon Sep 17 00:00:00 2001
From: Zero Tang <zero.tangptr@gmail.com>
Date: Mon, 18 Aug 2025 12:16:47 +0200
Subject: [PATCH 0039/2396] i386/tcg/svm: fix incorrect canonicalization

For all 32-bit systems and 64-bit Windows systems, "long" is 4 bytes long.
Due to using "long" for a linear address, svm_canonicalization would
set all high bits to 1 when (assuming 48-bit linear address) the segment
base is bigger than 0x7FFF.

This fixes booting guests under TCG when the guest IDT and GDT bases are
above 0x7FFF, thereby resulting in incorrect bases. When an interrupt
arrives, it would trigger a #PF exception; the #PF would trigger again,
resulting in a #DF exception; the #PF would trigger for the third time,
resulting in triple-fault, and eventually causes a shutdown VM-Exit to
the hypervisor right after guest boot.

Cc: qemu-stable@nongnu.org
Signed-off-by: Zero Tang <zero.tangptr@gmail.com>
---
 target/i386/tcg/system/svm_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index b27049b9ed..dea039b87a 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -49,7 +49,7 @@ static void svm_save_seg(CPUX86State *env, int mmu_idx, hwaddr addr,
 static inline void svm_canonicalization(CPUX86State *env, target_ulong *seg_base)
 {
     uint16_t shift_amt = 64 - cpu_x86_virtual_addr_width(env);
-    *seg_base = ((((long) *seg_base) << shift_amt) >> shift_amt);
+    *seg_base = (((int64_t) *seg_base) << shift_amt) >> shift_amt;
 }
 
 static void svm_load_seg(CPUX86State *env, int mmu_idx, hwaddr addr,

From 8e98961f6eb691b59ff0230ee22917061bfae5f8 Mon Sep 17 00:00:00 2001
From: Ani Sinha <anisinha@redhat.com>
Date: Fri, 15 Aug 2025 12:24:45 +0530
Subject: [PATCH 0040/2396] kvm/kvm-all: make kvm_park/unpark_vcpu local to
 kvm-all.c

kvm_park_vcpu() and kvm_unpark_vcpu() is only used in kvm-all.c. Declare it
static, remove it from common header file and make it local to kvm-all.c

Signed-off-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250815065445.8978-1-anisinha@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c  |  4 ++--
 include/system/kvm.h | 17 -----------------
 2 files changed, 2 insertions(+), 19 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 890d5ea9f8..f36dfe3349 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -414,7 +414,7 @@ err:
     return ret;
 }
 
-void kvm_park_vcpu(CPUState *cpu)
+static void kvm_park_vcpu(CPUState *cpu)
 {
     struct KVMParkedVcpu *vcpu;
 
@@ -426,7 +426,7 @@ void kvm_park_vcpu(CPUState *cpu)
     QLIST_INSERT_HEAD(&kvm_state->kvm_parked_vcpus, vcpu, node);
 }
 
-int kvm_unpark_vcpu(KVMState *s, unsigned long vcpu_id)
+static int kvm_unpark_vcpu(KVMState *s, unsigned long vcpu_id)
 {
     struct KVMParkedVcpu *cpu;
     int kvm_fd = -ENOENT;
diff --git a/include/system/kvm.h b/include/system/kvm.h
index 3c7d314736..4fc09e3891 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -317,23 +317,6 @@ int kvm_create_device(KVMState *s, uint64_t type, bool test);
  */
 bool kvm_device_supported(int vmfd, uint64_t type);
 
-/**
- * kvm_park_vcpu - Park QEMU KVM vCPU context
- * @cpu: QOM CPUState object for which QEMU KVM vCPU context has to be parked.
- *
- * @returns: none
- */
-void kvm_park_vcpu(CPUState *cpu);
-
-/**
- * kvm_unpark_vcpu - unpark QEMU KVM vCPU context
- * @s: KVM State
- * @vcpu_id: Architecture vCPU ID of the parked vCPU
- *
- * @returns: KVM fd
- */
-int kvm_unpark_vcpu(KVMState *s, unsigned long vcpu_id);
-
 /**
  * kvm_create_and_park_vcpu - Create and park a KVM vCPU
  * @cpu: QOM CPUState object for which KVM vCPU has to be created and parked.

From db62680edd04c78eada3cf67f27d8825e08feb9a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 31 Jul 2025 19:36:38 +0200
Subject: [PATCH 0041/2396] rust: disable borrow_as_ptr warning

This is pretty noisy, but it was not visible until now because it only shows up
if the rust-version has "&raw const".

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml | 1 -
 1 file changed, 1 deletion(-)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 0868e1b426..0a83db1535 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -53,7 +53,6 @@ as_ptr_cast_mut = "deny"
 as_underscore = "deny"
 assertions_on_result_states = "deny"
 bool_to_int_with_if = "deny"
-borrow_as_ptr = "deny"
 cast_lossless = "deny"
 dbg_macro = "deny"
 debug_assert_with_mut_call = "deny"

From 2102780c5523c240c66ba52ea1629353a7518072 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 16 Jul 2025 13:17:09 +0200
Subject: [PATCH 0042/2396] rust: qemu-api-macros: support matching more than
 one error

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/tests.rs | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index d6dcd62fcf..6028cdbc4c 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -7,9 +7,9 @@ use quote::quote;
 use super::*;
 
 macro_rules! derive_compile_fail {
-    ($derive_fn:ident, $input:expr, $error_msg:expr) => {{
+    ($derive_fn:ident, $input:expr, $($error_msg:expr),+ $(,)?) => {{
         let input: proc_macro2::TokenStream = $input;
-        let error_msg: &str = $error_msg;
+        let error_msg = &[$( quote! { ::core::compile_error! { $error_msg } } ),*];
         let derive_fn: fn(input: syn::DeriveInput) -> Result<proc_macro2::TokenStream, syn::Error> =
             $derive_fn;
 
@@ -18,7 +18,7 @@ macro_rules! derive_compile_fail {
         let err = result.unwrap_err().into_compile_error();
         assert_eq!(
             err.to_string(),
-            quote! { ::core::compile_error! { #error_msg } }.to_string()
+            quote! { #(#error_msg)* }.to_string()
         );
     }};
 }

From 9a6d6ae8afb18e18eacb94e105722c08e84fe9fd Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 17 Jul 2025 08:09:26 +0200
Subject: [PATCH 0043/2396] subprojects: update proc-macro2 and syn

syn 2.0.69 adds Punctuated::get().  The serde and attrs crate also need
a newer version.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                                       | 8 ++++----
 subprojects/packagefiles/proc-macro2-1-rs/meson.build | 2 +-
 subprojects/packagefiles/syn-2-rs/meson.build         | 2 +-
 subprojects/proc-macro2-1-rs.wrap                     | 8 ++++----
 subprojects/syn-2-rs.wrap                             | 8 ++++----
 5 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index b785c718f3..4baf6ba663 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -118,9 +118,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.84"
+version = "1.0.95"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ec96c6a92621310b51366f1e28d05ef11489516e93be030060e5fc12024a49d6"
+checksum = "02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778"
 dependencies = [
  "unicode-ident",
 ]
@@ -155,9 +155,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "2.0.66"
+version = "2.0.104"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5"
+checksum = "17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40"
 dependencies = [
  "proc-macro2",
  "quote",
diff --git a/subprojects/packagefiles/proc-macro2-1-rs/meson.build b/subprojects/packagefiles/proc-macro2-1-rs/meson.build
index 5759df3ecc..ba7de07029 100644
--- a/subprojects/packagefiles/proc-macro2-1-rs/meson.build
+++ b/subprojects/packagefiles/proc-macro2-1-rs/meson.build
@@ -1,6 +1,6 @@
 project('proc-macro2-1-rs', 'rust',
   meson_version: '>=1.5.0',
-  version: '1.0.84',
+  version: '1.0.95',
   license: 'MIT OR Apache-2.0',
   default_options: [])
 
diff --git a/subprojects/packagefiles/syn-2-rs/meson.build b/subprojects/packagefiles/syn-2-rs/meson.build
index a009417408..3e6dc318a9 100644
--- a/subprojects/packagefiles/syn-2-rs/meson.build
+++ b/subprojects/packagefiles/syn-2-rs/meson.build
@@ -1,6 +1,6 @@
 project('syn-2-rs', 'rust',
   meson_version: '>=1.5.0',
-  version: '2.0.66',
+  version: '2.0.104',
   license: 'MIT OR Apache-2.0',
   default_options: [])
 
diff --git a/subprojects/proc-macro2-1-rs.wrap b/subprojects/proc-macro2-1-rs.wrap
index 6c9369f0df..0f06cd8e11 100644
--- a/subprojects/proc-macro2-1-rs.wrap
+++ b/subprojects/proc-macro2-1-rs.wrap
@@ -1,8 +1,8 @@
 [wrap-file]
-directory = proc-macro2-1.0.84
-source_url = https://crates.io/api/v1/crates/proc-macro2/1.0.84/download
-source_filename = proc-macro2-1.0.84.0.tar.gz
-source_hash = ec96c6a92621310b51366f1e28d05ef11489516e93be030060e5fc12024a49d6
+directory = proc-macro2-1.0.95
+source_url = https://crates.io/api/v1/crates/proc-macro2/1.0.95/download
+source_filename = proc-macro2-1.0.95.0.tar.gz
+source_hash = 02b3e5e68a3a1a02aad3ec490a98007cbc13c37cbe84a3cd7b8e406d76e7f778
 #method = cargo
 patch_directory = proc-macro2-1-rs
 
diff --git a/subprojects/syn-2-rs.wrap b/subprojects/syn-2-rs.wrap
index d79cf750fb..1e5e9d9fb6 100644
--- a/subprojects/syn-2-rs.wrap
+++ b/subprojects/syn-2-rs.wrap
@@ -1,8 +1,8 @@
 [wrap-file]
-directory = syn-2.0.66
-source_url = https://crates.io/api/v1/crates/syn/2.0.66/download
-source_filename = syn-2.0.66.0.tar.gz
-source_hash = c42f3f41a2de00b01c0aaad383c5a45241efc8b2d1eda5661812fda5f3cdcff5
+directory = syn-2.0.104
+source_url = https://crates.io/api/v1/crates/syn/2.0.104/download
+source_filename = syn-2.0.104.0.tar.gz
+source_hash = 17b6f705963418cdb9927482fa304bc562ece2fdd4f616084c50b7023b435a40
 #method = cargo
 patch_directory = syn-2-rs
 

From 96f2c80fed20790fec0b35b774af676d5068077b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 26 Aug 2025 17:31:32 +0400
Subject: [PATCH 0044/2396] rust/qemu-api-macros: make derive(Object) friendly
 when missing parent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250826133132.4064478-5-marcandre.lureau@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index b525d89c09..a614741889 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -85,7 +85,15 @@ fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
     is_c_repr(&input, "#[derive(Object)]")?;
 
     let name = &input.ident;
-    let parent = &get_fields(&input, "#[derive(Object)]")?[0].ident;
+    let parent = &get_fields(&input, "#[derive(Object)]")?
+        .get(0)
+        .ok_or_else(|| {
+            Error::new(
+                input.ident.span(),
+                "#[derive(Object)] requires a parent field",
+            )
+        })?
+        .ident;
 
     Ok(quote! {
         ::qemu_api::assert_field_type!(#name, #parent,

From 4344b358a8dd62591db0b7b98328511fadffca85 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Mon, 28 Jul 2025 14:48:23 +0300
Subject: [PATCH 0045/2396] rust: declare self as qemu_api for proc-macros

Fix an outstanding TODO.

Declaring `extern crate self as qemu_api` allows use of `qemu_api`
within the qemu_api crate; this allows the Wrapper derive macro and
future proc macros to be used interchangeably in the qemu_api crate and
other crates. This is not required currently and is only for
future-proofing.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250728-self-as-qemu_api-v1-1-001c339cccc8@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api-macros/src/lib.rs | 14 ++++++--------
 rust/qemu-api/src/lib.rs        |  4 ++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index a614741889..959726efe6 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -123,23 +123,21 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
     let field = &get_unnamed_field(&input, "#[derive(Wrapper)]")?;
     let typ = &field.ty;
 
-    // TODO: how to add "::qemu_api"?  For now, this is only used in the
-    // qemu_api crate so it's not a problem.
     Ok(quote! {
-        unsafe impl crate::cell::Wrapper for #name {
-            type Wrapped = <#typ as crate::cell::Wrapper>::Wrapped;
+        unsafe impl ::qemu_api::cell::Wrapper for #name {
+            type Wrapped = <#typ as ::qemu_api::cell::Wrapper>::Wrapped;
         }
         impl #name {
-            pub unsafe fn from_raw<'a>(ptr: *mut <Self as crate::cell::Wrapper>::Wrapped) -> &'a Self {
+            pub unsafe fn from_raw<'a>(ptr: *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped) -> &'a Self {
                 let ptr = ::std::ptr::NonNull::new(ptr).unwrap().cast::<Self>();
                 unsafe { ptr.as_ref() }
             }
 
-            pub const fn as_mut_ptr(&self) -> *mut <Self as crate::cell::Wrapper>::Wrapped {
+            pub const fn as_mut_ptr(&self) -> *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped {
                 self.0.as_mut_ptr()
             }
 
-            pub const fn as_ptr(&self) -> *const <Self as crate::cell::Wrapper>::Wrapped {
+            pub const fn as_ptr(&self) -> *const <Self as ::qemu_api::cell::Wrapper>::Wrapped {
                 self.0.as_ptr()
             }
 
@@ -147,7 +145,7 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
                 self.0.as_void_ptr()
             }
 
-            pub const fn raw_get(slot: *mut Self) -> *mut <Self as crate::cell::Wrapper>::Wrapped {
+            pub const fn raw_get(slot: *mut Self) -> *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped {
                 slot.cast()
             }
         }
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 86dcd8ef17..bcb51c7986 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -32,6 +32,10 @@ pub mod uninit;
 pub mod vmstate;
 pub mod zeroable;
 
+// Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
+// crate).
+extern crate self as qemu_api;
+
 use std::{
     alloc::{GlobalAlloc, Layout},
     ffi::c_void,

From 92dedaf169ddcf8c81fa6d21c86c60f3b82458e5 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 22 Aug 2025 12:07:44 +0200
Subject: [PATCH 0046/2396] rust: move dependencies to rust/Cargo.toml

As more crates start using the same dependencies, it's better to not
repeat the versions and move the dependency declarations to the workspace.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml          | 5 +++++
 rust/qemu-api/Cargo.toml | 6 +++---
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 0a83db1535..6f8884eb30 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -15,6 +15,11 @@ license = "GPL-2.0-or-later"
 repository = "https://gitlab.com/qemu-project/qemu/"
 rust-version = "1.77.0"
 
+[workspace.dependencies]
+anyhow = "~1.0"
+foreign = "~0.3.1"
+libc = "0.2.162"
+
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = [
     'cfg(MESON)', 'cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)',
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index db7000dee4..c07a17a28b 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -15,9 +15,9 @@ rust-version.workspace = true
 
 [dependencies]
 qemu_api_macros = { path = "../qemu-api-macros" }
-anyhow = "~1.0"
-libc = "0.2.162"
-foreign = "~0.3.1"
+anyhow = { workspace = true }
+foreign = { workspace = true }
+libc = { workspace = true }
 
 [features]
 default = ["debug_cell"]

From 05c84cf8df23b8dc81317ee0cea748e6199637f4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 2 Aug 2025 10:12:01 +1000
Subject: [PATCH 0047/2396] semihosting: Retrieve stack top from image_info

Remove the write-once field TaskState.stack_base, and use the
same value from struct image_info.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 1 -
 linux-user/arm/cpu_loop.c     | 1 -
 linux-user/m68k/cpu_loop.c    | 1 -
 linux-user/qemu.h             | 1 -
 linux-user/riscv/cpu_loop.c   | 1 -
 semihosting/arm-compat-semi.c | 6 +++++-
 6 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index fea43cefa6..b65999a75b 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -168,7 +168,6 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
         qemu_guest_getrandom_nofail(&env->keys, sizeof(env->keys));
     }
 
-    ts->stack_base = info->start_stack;
     ts->heap_base = info->brk;
     /* This will be filled in on the first SYS_HEAPINFO call.  */
     ts->heap_limit = 0;
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index 33f63951a9..e40d6beafa 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -504,7 +504,6 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     arm_rebuild_hflags(env);
 #endif
 
-    ts->stack_base = info->start_stack;
     ts->heap_base = info->brk;
     /* This will be filled in on the first SYS_HEAPINFO call.  */
     ts->heap_limit = 0;
diff --git a/linux-user/m68k/cpu_loop.c b/linux-user/m68k/cpu_loop.c
index 5da91b997a..3aaaf02ca4 100644
--- a/linux-user/m68k/cpu_loop.c
+++ b/linux-user/m68k/cpu_loop.c
@@ -117,7 +117,6 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     env->aregs[7] = regs->usp;
     env->sr = regs->sr;
 
-    ts->stack_base = info->start_stack;
     ts->heap_base = info->brk;
     /* This will be filled in on the first SYS_HEAPINFO call.  */
     ts->heap_limit = 0;
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 0b19fa43e6..b6621536b3 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -127,7 +127,6 @@ struct TaskState {
     abi_ulong heap_base;
     abi_ulong heap_limit;
 #endif
-    abi_ulong stack_base;
     int used; /* non zero if used */
     struct image_info *info;
     struct linux_binprm *bprm;
diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c
index 3ac8bbfec1..541de765ff 100644
--- a/linux-user/riscv/cpu_loop.c
+++ b/linux-user/riscv/cpu_loop.c
@@ -109,7 +109,6 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
         exit(EXIT_FAILURE);
     }
 
-    ts->stack_base = info->start_stack;
     ts->heap_base = info->brk;
     /* This will be filled in on the first SYS_HEAPINFO call.  */
     ts->heap_limit = 0;
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 86e5260e50..bc04b02eba 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -696,7 +696,11 @@ void do_common_semihosting(CPUState *cs)
 
             retvals[0] = ts->heap_base;
             retvals[1] = ts->heap_limit;
-            retvals[2] = ts->stack_base;
+            /*
+             * Note that semihosting is *not* thread aware.
+             * Always return the stack base of the main thread.
+             */
+            retvals[2] = ts->info->start_stack;
             retvals[3] = 0; /* Stack limit.  */
 #else
             retvals[0] = info.heapbase;  /* Heap Base */

From 7adf9ebb0ac72637833f61e24e44def6228b4484 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 2 Aug 2025 10:25:12 +1000
Subject: [PATCH 0048/2396] semihosting: Initialize heap once per process

While semihosting isn't really thread aware, the current
implementation allocates space for the heap per-thread.

Remove the heap_base and heap_limit fields from TaskState.
Replace with static variables within do_common_semihosting.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/cpu_loop.c |  7 -------
 linux-user/arm/cpu_loop.c     | 25 +++++++++++--------------
 linux-user/m68k/cpu_loop.c    |  8 --------
 linux-user/qemu.h             |  5 -----
 linux-user/riscv/cpu_loop.c   |  4 ----
 semihosting/arm-compat-semi.c | 22 +++++++++-------------
 6 files changed, 20 insertions(+), 51 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index b65999a75b..030a630c93 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -140,9 +140,6 @@ void cpu_loop(CPUARMState *env)
 void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
 {
     ARMCPU *cpu = env_archcpu(env);
-    CPUState *cs = env_cpu(env);
-    TaskState *ts = get_task_state(cs);
-    struct image_info *info = ts->info;
     int i;
 
     if (!(arm_feature(env, ARM_FEATURE_AARCH64))) {
@@ -167,8 +164,4 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     if (cpu_isar_feature(aa64_pauth, cpu)) {
         qemu_guest_getrandom_nofail(&env->keys, sizeof(env->keys));
     }
-
-    ts->heap_base = info->brk;
-    /* This will be filled in on the first SYS_HEAPINFO call.  */
-    ts->heap_limit = 0;
 }
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index e40d6beafa..9d54422736 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -492,19 +492,16 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     for(i = 0; i < 16; i++) {
         env->regs[i] = regs->uregs[i];
     }
-#if TARGET_BIG_ENDIAN
-    /* Enable BE8.  */
-    if (EF_ARM_EABI_VERSION(info->elf_flags) >= EF_ARM_EABI_VER4
-        && (info->elf_flags & EF_ARM_BE8)) {
-        env->uncached_cpsr |= CPSR_E;
-        env->cp15.sctlr_el[1] |= SCTLR_E0E;
-    } else {
-        env->cp15.sctlr_el[1] |= SCTLR_B;
-    }
-    arm_rebuild_hflags(env);
-#endif
 
-    ts->heap_base = info->brk;
-    /* This will be filled in on the first SYS_HEAPINFO call.  */
-    ts->heap_limit = 0;
+    if (TARGET_BIG_ENDIAN) {
+        /* Enable BE8.  */
+        if (EF_ARM_EABI_VERSION(info->elf_flags) >= EF_ARM_EABI_VER4
+            && (info->elf_flags & EF_ARM_BE8)) {
+            env->uncached_cpsr |= CPSR_E;
+            env->cp15.sctlr_el[1] |= SCTLR_E0E;
+        } else {
+            env->cp15.sctlr_el[1] |= SCTLR_B;
+        }
+        arm_rebuild_hflags(env);
+    }
 }
diff --git a/linux-user/m68k/cpu_loop.c b/linux-user/m68k/cpu_loop.c
index 3aaaf02ca4..23693f3358 100644
--- a/linux-user/m68k/cpu_loop.c
+++ b/linux-user/m68k/cpu_loop.c
@@ -94,10 +94,6 @@ void cpu_loop(CPUM68KState *env)
 
 void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
 {
-    CPUState *cpu = env_cpu(env);
-    TaskState *ts = get_task_state(cpu);
-    struct image_info *info = ts->info;
-
     env->pc = regs->pc;
     env->dregs[0] = regs->d0;
     env->dregs[1] = regs->d1;
@@ -116,8 +112,4 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     env->aregs[6] = regs->a6;
     env->aregs[7] = regs->usp;
     env->sr = regs->sr;
-
-    ts->heap_base = info->brk;
-    /* This will be filled in on the first SYS_HEAPINFO call.  */
-    ts->heap_limit = 0;
 }
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index b6621536b3..4d6fad28c6 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -121,11 +121,6 @@ struct TaskState {
     abi_ulong child_tidptr;
 #ifdef TARGET_M68K
     abi_ulong tp_value;
-#endif
-#if defined(TARGET_ARM) || defined(TARGET_M68K) || defined(TARGET_RISCV)
-    /* Extra fields for semihosted binaries.  */
-    abi_ulong heap_base;
-    abi_ulong heap_limit;
 #endif
     int used; /* non zero if used */
     struct image_info *info;
diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c
index 541de765ff..2dd30c7b28 100644
--- a/linux-user/riscv/cpu_loop.c
+++ b/linux-user/riscv/cpu_loop.c
@@ -108,8 +108,4 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
         error_report("Incompatible ELF: RVE cpu requires RVE ABI binary");
         exit(EXIT_FAILURE);
     }
-
-    ts->heap_base = info->brk;
-    /* This will be filled in on the first SYS_HEAPINFO call.  */
-    ts->heap_limit = 0;
 }
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index bc04b02eba..bcd13cd6df 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -666,7 +666,7 @@ void do_common_semihosting(CPUState *cs)
             int i;
 #ifdef CONFIG_USER_ONLY
             TaskState *ts = get_task_state(cs);
-            target_ulong limit;
+            static abi_ulong heapbase, heaplimit;
 #else
             LayoutInfo info = common_semi_find_bases(cs);
 #endif
@@ -678,24 +678,20 @@ void do_common_semihosting(CPUState *cs)
              * Some C libraries assume the heap immediately follows .bss, so
              * allocate it using sbrk.
              */
-            if (!ts->heap_limit) {
-                abi_ulong ret;
-
-                ts->heap_base = do_brk(0);
-                limit = ts->heap_base + COMMON_SEMI_HEAP_SIZE;
+            if (!heaplimit) {
+                heapbase = do_brk(0);
                 /* Try a big heap, and reduce the size if that fails.  */
-                for (;;) {
-                    ret = do_brk(limit);
+                for (abi_ulong size = COMMON_SEMI_HEAP_SIZE; ; size >>= 1) {
+                    abi_ulong limit = heapbase + size;
+                    abi_ulong ret = do_brk(limit);
                     if (ret >= limit) {
+                        heaplimit = limit;
                         break;
                     }
-                    limit = (ts->heap_base >> 1) + (limit >> 1);
                 }
-                ts->heap_limit = limit;
             }
-
-            retvals[0] = ts->heap_base;
-            retvals[1] = ts->heap_limit;
+            retvals[0] = heapbase;
+            retvals[1] = heaplimit;
             /*
              * Note that semihosting is *not* thread aware.
              * Always return the stack base of the main thread.

From 58afe4cfe93be0e283e7a0fcd9a50fd52fc44169 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 08:03:41 -1000
Subject: [PATCH 0049/2396] linux-user: Create target/elfload.c files

Prepare to split the main linux-user/elfload.c.
Create empty files for each target, and add the common build rule.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c     | 1 +
 linux-user/alpha/elfload.c       | 1 +
 linux-user/arm/elfload.c         | 1 +
 linux-user/hexagon/elfload.c     | 1 +
 linux-user/hppa/elfload.c        | 1 +
 linux-user/i386/elfload.c        | 1 +
 linux-user/loongarch64/elfload.c | 1 +
 linux-user/m68k/elfload.c        | 1 +
 linux-user/microblaze/elfload.c  | 1 +
 linux-user/mips/elfload.c        | 1 +
 linux-user/mips64/elfload.c      | 1 +
 linux-user/openrisc/elfload.c    | 1 +
 linux-user/ppc/elfload.c         | 1 +
 linux-user/riscv/elfload.c       | 1 +
 linux-user/s390x/elfload.c       | 1 +
 linux-user/sh4/elfload.c         | 1 +
 linux-user/sparc/elfload.c       | 1 +
 linux-user/x86_64/elfload.c      | 1 +
 linux-user/xtensa/elfload.c      | 1 +
 meson.build                      | 6 +++++-
 20 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 linux-user/aarch64/elfload.c
 create mode 100644 linux-user/alpha/elfload.c
 create mode 100644 linux-user/arm/elfload.c
 create mode 100644 linux-user/hexagon/elfload.c
 create mode 100644 linux-user/hppa/elfload.c
 create mode 100644 linux-user/i386/elfload.c
 create mode 100644 linux-user/loongarch64/elfload.c
 create mode 100644 linux-user/m68k/elfload.c
 create mode 100644 linux-user/microblaze/elfload.c
 create mode 100644 linux-user/mips/elfload.c
 create mode 100644 linux-user/mips64/elfload.c
 create mode 100644 linux-user/openrisc/elfload.c
 create mode 100644 linux-user/ppc/elfload.c
 create mode 100644 linux-user/riscv/elfload.c
 create mode 100644 linux-user/s390x/elfload.c
 create mode 100644 linux-user/sh4/elfload.c
 create mode 100644 linux-user/sparc/elfload.c
 create mode 100644 linux-user/x86_64/elfload.c
 create mode 100644 linux-user/xtensa/elfload.c

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/aarch64/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/alpha/elfload.c b/linux-user/alpha/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/alpha/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/arm/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/hexagon/elfload.c b/linux-user/hexagon/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/hexagon/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/hppa/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/i386/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/loongarch64/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/m68k/elfload.c b/linux-user/m68k/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/m68k/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/microblaze/elfload.c b/linux-user/microblaze/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/microblaze/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/mips/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/mips64/elfload.c b/linux-user/mips64/elfload.c
new file mode 100644
index 0000000000..b719555e65
--- /dev/null
+++ b/linux-user/mips64/elfload.c
@@ -0,0 +1 @@
+#include "../mips/elfload.c"
diff --git a/linux-user/openrisc/elfload.c b/linux-user/openrisc/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/openrisc/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/ppc/elfload.c b/linux-user/ppc/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/ppc/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/riscv/elfload.c b/linux-user/riscv/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/riscv/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/s390x/elfload.c b/linux-user/s390x/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/s390x/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/sh4/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/sparc/elfload.c b/linux-user/sparc/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/sparc/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/x86_64/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/linux-user/xtensa/elfload.c b/linux-user/xtensa/elfload.c
new file mode 100644
index 0000000000..73fa78ef14
--- /dev/null
+++ b/linux-user/xtensa/elfload.c
@@ -0,0 +1 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
diff --git a/meson.build b/meson.build
index 50c774a195..0d42de61ae 100644
--- a/meson.build
+++ b/meson.build
@@ -4327,7 +4327,11 @@ foreach target : target_dirs
     )
     if 'CONFIG_LINUX_USER' in config_target
       dir = base_dir / abi
-      arch_srcs += files(dir / 'signal.c', dir / 'cpu_loop.c')
+      arch_srcs += files(
+        dir / 'cpu_loop.c',
+        dir / 'elfload.c',
+        dir / 'signal.c',
+      )
       if config_target.has_key('TARGET_SYSTBL_ABI')
         arch_srcs += \
           syscall_nr_generators[abi].process(base_dir / abi / config_target['TARGET_SYSTBL'],

From a859022ceaba12444f1a8f5a5efc5e76c7d5dc13 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 13:40:15 -1000
Subject: [PATCH 0050/2396] linux-user: Move ppc uabi/asm/elf.h workaround to
 osdep.h

Move the workaround out of linux-user/elfload.c, so that
we don't have to replicate it in many places.  Place it
immediately after the include of <signal.h>, which draws
in the relevant symbols.

Note that ARCH_DLINFO is not defined by the kernel header,
and so there's no need to undef it either.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/loader.c     |  4 ----
 include/qemu/osdep.h |  8 ++++++++
 linux-user/elfload.c | 10 ----------
 3 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index e7056ba4bd..524af6f14a 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -295,10 +295,6 @@ static void *load_at(int fd, off_t offset, size_t size)
     return ptr;
 }
 
-#ifdef ELF_CLASS
-#undef ELF_CLASS
-#endif
-
 #define ELF_CLASS   ELFCLASS32
 #include "elf.h"
 
diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 96fe51bc39..be3460b32f 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -133,6 +133,14 @@ QEMU_EXTERN_C int daemon(int, int);
 #include <setjmp.h>
 #include <signal.h>
 
+/*
+ * Avoid conflict with linux/arch/powerpc/include/uapi/asm/elf.h, included
+ * from <asm/sigcontext.h>, but we might as well do this unconditionally.
+ */
+#undef ELF_CLASS
+#undef ELF_DATA
+#undef ELF_ARCH
+
 #ifdef CONFIG_IOVEC
 #include <sys/uio.h>
 #endif
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ea214105ff..4ca8c39dc2 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -35,16 +35,6 @@
 #include "target/arm/cpu-features.h"
 #endif
 
-#ifdef _ARCH_PPC64
-#undef ARCH_DLINFO
-#undef ELF_PLATFORM
-#undef ELF_HWCAP
-#undef ELF_HWCAP2
-#undef ELF_CLASS
-#undef ELF_DATA
-#undef ELF_ARCH
-#endif
-
 #ifndef TARGET_ARCH_HAS_SIGTRAMP_PAGE
 #define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0
 #endif

From af880af8d4624b619c9d44ff5d27440ae064f99a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:09:57 -1000
Subject: [PATCH 0051/2396] linux-user: Move get_elf_cpu_model to
 target/elfload.c

Rename from cpu_get_model to emphasize that this is an elf-specific
function.  Declare the function once in loader.h.

This frees up target_elf.h for other uses.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c        | 10 +++++++
 linux-user/aarch64/target_elf.h     |  5 +---
 linux-user/alpha/elfload.c          | 10 +++++++
 linux-user/alpha/target_elf.h       |  5 +---
 linux-user/arm/elfload.c            | 10 +++++++
 linux-user/arm/target_elf.h         |  5 +---
 linux-user/hexagon/elfload.c        | 34 +++++++++++++++++++++++
 linux-user/hexagon/target_elf.h     | 29 -------------------
 linux-user/hppa/elfload.c           | 10 +++++++
 linux-user/hppa/target_elf.h        |  5 +---
 linux-user/i386/elfload.c           | 10 +++++++
 linux-user/i386/target_elf.h        |  5 +---
 linux-user/loader.h                 |  3 ++
 linux-user/loongarch64/elfload.c    | 10 +++++++
 linux-user/loongarch64/target_elf.h |  5 +---
 linux-user/m68k/elfload.c           | 17 ++++++++++++
 linux-user/m68k/target_elf.h        |  9 ------
 linux-user/main.c                   |  3 +-
 linux-user/microblaze/elfload.c     | 10 +++++++
 linux-user/microblaze/target_elf.h  |  5 +---
 linux-user/mips/elfload.c           | 43 +++++++++++++++++++++++++++++
 linux-user/mips/target_elf.h        | 11 +-------
 linux-user/mips64/target_elf.h      | 27 +-----------------
 linux-user/openrisc/elfload.c       | 10 +++++++
 linux-user/openrisc/target_elf.h    |  5 +---
 linux-user/ppc/elfload.c            | 14 ++++++++++
 linux-user/ppc/target_elf.h         |  9 +-----
 linux-user/riscv/elfload.c          | 10 +++++++
 linux-user/riscv/target_elf.h       |  5 +---
 linux-user/s390x/elfload.c          | 10 +++++++
 linux-user/s390x/target_elf.h       |  5 +---
 linux-user/sh4/elfload.c            | 10 +++++++
 linux-user/sh4/target_elf.h         |  5 +---
 linux-user/sparc/elfload.c          | 14 ++++++++++
 linux-user/sparc/target_elf.h       |  9 +-----
 linux-user/x86_64/elfload.c         | 10 +++++++
 linux-user/x86_64/target_elf.h      |  5 +---
 linux-user/xtensa/elfload.c         | 10 +++++++
 linux-user/xtensa/target_elf.h      |  5 ----
 39 files changed, 272 insertions(+), 145 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 73fa78ef14..b92442dfeb 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "any";
+}
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index a7eb962fba..d955b3d07f 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef AARCH64_TARGET_ELF_H
 #define AARCH64_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "any";
-}
+
 #endif
diff --git a/linux-user/alpha/elfload.c b/linux-user/alpha/elfload.c
index 73fa78ef14..1e44475c47 100644
--- a/linux-user/alpha/elfload.c
+++ b/linux-user/alpha/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "ev67";
+}
diff --git a/linux-user/alpha/target_elf.h b/linux-user/alpha/target_elf.h
index b77d638f6d..52b68680ad 100644
--- a/linux-user/alpha/target_elf.h
+++ b/linux-user/alpha/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef ALPHA_TARGET_ELF_H
 #define ALPHA_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "ev67";
-}
+
 #endif
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index 73fa78ef14..b92442dfeb 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "any";
+}
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 58ff6a0986..2abb27a733 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef ARM_TARGET_ELF_H
 #define ARM_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "any";
-}
+
 #endif
diff --git a/linux-user/hexagon/elfload.c b/linux-user/hexagon/elfload.c
index 73fa78ef14..d8b545032a 100644
--- a/linux-user/hexagon/elfload.c
+++ b/linux-user/hexagon/elfload.c
@@ -1 +1,35 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    static char buf[32];
+    int err;
+
+    /* For now, treat anything newer than v5 as a v73 */
+    /* FIXME - Disable instructions that are newer than the specified arch */
+    if (eflags == 0x04 ||    /* v5  */
+        eflags == 0x05 ||    /* v55 */
+        eflags == 0x60 ||    /* v60 */
+        eflags == 0x61 ||    /* v61 */
+        eflags == 0x62 ||    /* v62 */
+        eflags == 0x65 ||    /* v65 */
+        eflags == 0x66 ||    /* v66 */
+        eflags == 0x67 ||    /* v67 */
+        eflags == 0x8067 ||  /* v67t */
+        eflags == 0x68 ||    /* v68 */
+        eflags == 0x69 ||    /* v69 */
+        eflags == 0x71 ||    /* v71 */
+        eflags == 0x8071 ||  /* v71t */
+        eflags == 0x73       /* v73 */
+       ) {
+        return "v73";
+    }
+
+    err = snprintf(buf, sizeof(buf), "unknown (0x%x)", eflags);
+    return err >= 0 && err < sizeof(buf) ? buf : "unknown";
+}
diff --git a/linux-user/hexagon/target_elf.h b/linux-user/hexagon/target_elf.h
index 36056fc9f0..eccf207f6b 100644
--- a/linux-user/hexagon/target_elf.h
+++ b/linux-user/hexagon/target_elf.h
@@ -18,33 +18,4 @@
 #ifndef HEXAGON_TARGET_ELF_H
 #define HEXAGON_TARGET_ELF_H
 
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    static char buf[32];
-    int err;
-
-    /* For now, treat anything newer than v5 as a v73 */
-    /* FIXME - Disable instructions that are newer than the specified arch */
-    if (eflags == 0x04 ||    /* v5  */
-        eflags == 0x05 ||    /* v55 */
-        eflags == 0x60 ||    /* v60 */
-        eflags == 0x61 ||    /* v61 */
-        eflags == 0x62 ||    /* v62 */
-        eflags == 0x65 ||    /* v65 */
-        eflags == 0x66 ||    /* v66 */
-        eflags == 0x67 ||    /* v67 */
-        eflags == 0x8067 ||  /* v67t */
-        eflags == 0x68 ||    /* v68 */
-        eflags == 0x69 ||    /* v69 */
-        eflags == 0x71 ||    /* v71 */
-        eflags == 0x8071 ||  /* v71t */
-        eflags == 0x73       /* v73 */
-       ) {
-        return "v73";
-    }
-
-    err = snprintf(buf, sizeof(buf), "unknown (0x%x)", eflags);
-    return err >= 0 && err < sizeof(buf) ? buf : "unknown";
-}
-
 #endif
diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
index 73fa78ef14..2274fcbde4 100644
--- a/linux-user/hppa/elfload.c
+++ b/linux-user/hppa/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "hppa";
+}
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index 19cae8bd65..5826ca2cd2 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef HPPA_TARGET_ELF_H
 #define HPPA_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "hppa";
-}
+
 #endif
diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index 73fa78ef14..f92adb7308 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "max";
+}
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index 238a9aba73..e6f0d8fa4e 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef I386_TARGET_ELF_H
 #define I386_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "max";
-}
+
 #endif
diff --git a/linux-user/loader.h b/linux-user/loader.h
index e102e6f410..75ee9975a0 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -98,6 +98,9 @@ abi_long memcpy_to_target(abi_ulong dest, const void *src,
 
 extern unsigned long guest_stack_size;
 
+/* Note that Elf32 and Elf64 use uint32_t for e_flags. */
+const char *get_elf_cpu_model(uint32_t eflags);
+
 #if defined(TARGET_S390X) || defined(TARGET_AARCH64) || defined(TARGET_ARM)
 uint32_t get_elf_hwcap(void);
 const char *elf_hwcap_str(uint32_t bit);
diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
index 73fa78ef14..874dc4c230 100644
--- a/linux-user/loongarch64/elfload.c
+++ b/linux-user/loongarch64/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "la464";
+}
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 95c3f05a46..39a08d35d9 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -5,8 +5,5 @@
 
 #ifndef LOONGARCH_TARGET_ELF_H
 #define LOONGARCH_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "la464";
-}
+
 #endif
diff --git a/linux-user/m68k/elfload.c b/linux-user/m68k/elfload.c
index 73fa78ef14..561ac5b3b3 100644
--- a/linux-user/m68k/elfload.c
+++ b/linux-user/m68k/elfload.c
@@ -1 +1,18 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+#include "elf.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    if (eflags == 0 || (eflags & EF_M68K_M68000)) {
+        /* 680x0 */
+        return "m68040";
+    }
+
+    /* Coldfire */
+    return "any";
+}
diff --git a/linux-user/m68k/target_elf.h b/linux-user/m68k/target_elf.h
index 998fe0fe2f..62ff9d38d4 100644
--- a/linux-user/m68k/target_elf.h
+++ b/linux-user/m68k/target_elf.h
@@ -7,14 +7,5 @@
 
 #ifndef M68K_TARGET_ELF_H
 #define M68K_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    if (eflags == 0 || (eflags & EF_M68K_M68000)) {
-        /* 680x0 */
-        return "m68040";
-    }
 
-    /* Coldfire */
-    return "any";
-}
 #endif
diff --git a/linux-user/main.c b/linux-user/main.c
index 68972f00a1..ad1a29d198 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -49,7 +49,6 @@
 #include "qemu/guest-random.h"
 #include "elf.h"
 #include "trace/control.h"
-#include "target_elf.h"
 #include "user/cpu_loop.h"
 #include "crypto/init.h"
 #include "fd-trans.h"
@@ -809,7 +808,7 @@ int main(int argc, char **argv, char **envp)
     }
 
     if (cpu_model == NULL) {
-        cpu_model = cpu_get_model(get_elf_eflags(execfd));
+        cpu_model = get_elf_cpu_model(get_elf_eflags(execfd));
     }
     cpu_type = parse_cpu_option(cpu_model);
 
diff --git a/linux-user/microblaze/elfload.c b/linux-user/microblaze/elfload.c
index 73fa78ef14..b92442dfeb 100644
--- a/linux-user/microblaze/elfload.c
+++ b/linux-user/microblaze/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "any";
+}
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index 8a8f1debff..bfe2997fd2 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef MICROBLAZE_TARGET_ELF_H
 #define MICROBLAZE_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "any";
-}
+
 #endif
diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index 73fa78ef14..04e3b76740 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -1 +1,44 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+#include "elf.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+#ifdef TARGET_MIPS64
+    switch (eflags & EF_MIPS_MACH) {
+    case EF_MIPS_MACH_OCTEON:
+    case EF_MIPS_MACH_OCTEON2:
+    case EF_MIPS_MACH_OCTEON3:
+        return "Octeon68XX";
+    case EF_MIPS_MACH_LS2E:
+        return "Loongson-2E";
+    case EF_MIPS_MACH_LS2F:
+        return "Loongson-2F";
+    case EF_MIPS_MACH_LS3A:
+        return "Loongson-3A1000";
+    default:
+        break;
+    }
+    switch (eflags & EF_MIPS_ARCH) {
+    case EF_MIPS_ARCH_64R6:
+        return "I6400";
+    case EF_MIPS_ARCH_64R2:
+        return "MIPS64R2-generic";
+    default:
+        break;
+    }
+    return "5KEf";
+#else
+    if ((eflags & EF_MIPS_ARCH) == EF_MIPS_ARCH_32R6) {
+        return "mips32r6-generic";
+    }
+    if (eflags & EF_MIPS_NAN2008) {
+        return "P5600";
+    }
+    return "24Kf";
+#endif
+}
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index 71a32315a8..febf710c7a 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -7,14 +7,5 @@
 
 #ifndef MIPS_TARGET_ELF_H
 #define MIPS_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    if ((eflags & EF_MIPS_ARCH) == EF_MIPS_ARCH_32R6) {
-        return "mips32r6-generic";
-    }
-    if (eflags & EF_MIPS_NAN2008) {
-        return "P5600";
-    }
-    return "24Kf";
-}
+
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 502af9d278..02e6d14840 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -7,30 +7,5 @@
 
 #ifndef MIPS64_TARGET_ELF_H
 #define MIPS64_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    switch (eflags & EF_MIPS_MACH) {
-    case EF_MIPS_MACH_OCTEON:
-    case EF_MIPS_MACH_OCTEON2:
-    case EF_MIPS_MACH_OCTEON3:
-        return "Octeon68XX";
-    case EF_MIPS_MACH_LS2E:
-        return "Loongson-2E";
-    case EF_MIPS_MACH_LS2F:
-        return "Loongson-2F";
-    case EF_MIPS_MACH_LS3A:
-        return "Loongson-3A1000";
-    default:
-        break;
-    }
-    switch (eflags & EF_MIPS_ARCH) {
-    case EF_MIPS_ARCH_64R6:
-        return "I6400";
-    case EF_MIPS_ARCH_64R2:
-        return "MIPS64R2-generic";
-    default:
-        break;
-    }
-    return "5KEf";
-}
+
 #endif
diff --git a/linux-user/openrisc/elfload.c b/linux-user/openrisc/elfload.c
index 73fa78ef14..b92442dfeb 100644
--- a/linux-user/openrisc/elfload.c
+++ b/linux-user/openrisc/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "any";
+}
diff --git a/linux-user/openrisc/target_elf.h b/linux-user/openrisc/target_elf.h
index 265ecd3079..b34f2ff672 100644
--- a/linux-user/openrisc/target_elf.h
+++ b/linux-user/openrisc/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef OPENRISC_TARGET_ELF_H
 #define OPENRISC_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "any";
-}
+
 #endif
diff --git a/linux-user/ppc/elfload.c b/linux-user/ppc/elfload.c
index 73fa78ef14..7775dc06fa 100644
--- a/linux-user/ppc/elfload.c
+++ b/linux-user/ppc/elfload.c
@@ -1 +1,15 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+#ifdef TARGET_PPC64
+    return "POWER9";
+#else
+    return "750";
+#endif
+}
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 0616618854..8c0a8ea431 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -7,12 +7,5 @@
 
 #ifndef PPC_TARGET_ELF_H
 #define PPC_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-#ifdef TARGET_PPC64
-    return "POWER9";
-#else
-    return "750";
-#endif
-}
+
 #endif
diff --git a/linux-user/riscv/elfload.c b/linux-user/riscv/elfload.c
index 73fa78ef14..f92adb7308 100644
--- a/linux-user/riscv/elfload.c
+++ b/linux-user/riscv/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "max";
+}
diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h
index dedd5956f3..bfe86105d0 100644
--- a/linux-user/riscv/target_elf.h
+++ b/linux-user/riscv/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef RISCV_TARGET_ELF_H
 #define RISCV_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "max";
-}
+
 #endif
diff --git a/linux-user/s390x/elfload.c b/linux-user/s390x/elfload.c
index 73fa78ef14..989953a247 100644
--- a/linux-user/s390x/elfload.c
+++ b/linux-user/s390x/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "qemu";
+}
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index 8114b59c1d..e51b053339 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef S390X_TARGET_ELF_H
 #define S390X_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "qemu";
-}
+
 #endif
diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
index 73fa78ef14..546034ec07 100644
--- a/linux-user/sh4/elfload.c
+++ b/linux-user/sh4/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "sh7785";
+}
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index f485e0cef2..d17011bd75 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef SH4_TARGET_ELF_H
 #define SH4_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "sh7785";
-}
+
 #endif
diff --git a/linux-user/sparc/elfload.c b/linux-user/sparc/elfload.c
index 73fa78ef14..243e6f9b66 100644
--- a/linux-user/sparc/elfload.c
+++ b/linux-user/sparc/elfload.c
@@ -1 +1,15 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+#ifdef TARGET_SPARC64
+    return "TI UltraSparc II";
+#else
+    return "Fujitsu MB86904";
+#endif
+}
diff --git a/linux-user/sparc/target_elf.h b/linux-user/sparc/target_elf.h
index a510ceb612..7e46748d26 100644
--- a/linux-user/sparc/target_elf.h
+++ b/linux-user/sparc/target_elf.h
@@ -7,12 +7,5 @@
 
 #ifndef SPARC_TARGET_ELF_H
 #define SPARC_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-#ifdef TARGET_SPARC64
-    return "TI UltraSparc II";
-#else
-    return "Fujitsu MB86904";
-#endif
-}
+
 #endif
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 73fa78ef14..f92adb7308 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return "max";
+}
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 3f628f8d66..5849f96350 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -7,8 +7,5 @@
 
 #ifndef X86_64_TARGET_ELF_H
 #define X86_64_TARGET_ELF_H
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return "max";
-}
+
 #endif
diff --git a/linux-user/xtensa/elfload.c b/linux-user/xtensa/elfload.c
index 73fa78ef14..e35ba69a10 100644
--- a/linux-user/xtensa/elfload.c
+++ b/linux-user/xtensa/elfload.c
@@ -1 +1,11 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu.h"
+#include "loader.h"
+
+
+const char *get_elf_cpu_model(uint32_t eflags)
+{
+    return XTENSA_DEFAULT_CPU_MODEL;
+}
diff --git a/linux-user/xtensa/target_elf.h b/linux-user/xtensa/target_elf.h
index a9a3fabd89..2c55c22e14 100644
--- a/linux-user/xtensa/target_elf.h
+++ b/linux-user/xtensa/target_elf.h
@@ -8,9 +8,4 @@
 #ifndef XTENSA_TARGET_ELF_H
 #define XTENSA_TARGET_ELF_H
 
-static inline const char *cpu_get_model(uint32_t eflags)
-{
-    return XTENSA_DEFAULT_CPU_MODEL;
-}
-
 #endif

From 39476538942f0ae1eff5e03f08399ef1eeca0cc0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 20:34:19 -1000
Subject: [PATCH 0052/2396] linux-user: Move get_elf_hwcap to
 {i386,x86_64}/elfload.c

Change the return type to abi_ulong, and pass in the cpu.
Duplicate the one line function between i386 and x86_64,
as most other additions to elfload.c won't be common.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 9 +--------
 linux-user/i386/elfload.c      | 5 +++++
 linux-user/i386/target_elf.h   | 2 ++
 linux-user/loader.h            | 3 +++
 linux-user/x86_64/elfload.c    | 5 +++++
 linux-user/x86_64/target_elf.h | 2 ++
 6 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 4ca8c39dc2..0c62c249e9 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -148,14 +148,7 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
-#define ELF_HWCAP get_elf_hwcap()
-
-static uint32_t get_elf_hwcap(void)
-{
-    X86CPU *cpu = X86_CPU(thread_cpu);
-
-    return cpu->env.features[FEAT_1_EDX];
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index f92adb7308..f99336e73c 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -9,3 +9,8 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "max";
 }
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    return cpu_env(cs)->features[FEAT_1_EDX];
+}
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index e6f0d8fa4e..802395af3a 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef I386_TARGET_ELF_H
 #define I386_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 75ee9975a0..457bb36daa 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -101,6 +101,9 @@ extern unsigned long guest_stack_size;
 /* Note that Elf32 and Elf64 use uint32_t for e_flags. */
 const char *get_elf_cpu_model(uint32_t eflags);
 
+#if defined(TARGET_I386) || defined(TARGET_X86_64)
+abi_ulong get_elf_hwcap(CPUState *cs);
+#endif
 #if defined(TARGET_S390X) || defined(TARGET_AARCH64) || defined(TARGET_ARM)
 uint32_t get_elf_hwcap(void);
 const char *elf_hwcap_str(uint32_t bit);
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index f92adb7308..f99336e73c 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -9,3 +9,8 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "max";
 }
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    return cpu_env(cs)->features[FEAT_1_EDX];
+}
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 5849f96350..03483bad57 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef X86_64_TARGET_ELF_H
 #define X86_64_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From 2d0687a514c63956de6215978acdda4f55c190dd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 20:52:01 -1000
Subject: [PATCH 0053/2396] linux-user: Move hwcap functions to
 {arm,aarch64}/elfload.c

For get_elf_hwcap and get_elf_hwcap2, change the return type to
abi_ulong, and pass in the cpu.  We must do these targets at the
same time because of the ifdef dependency between TARGET_AARCH64
and TARGET_ARM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c    | 333 +++++++++++++++++++++
 linux-user/aarch64/target_elf.h |   3 +
 linux-user/arm/elfload.c        | 161 ++++++++++
 linux-user/arm/target_elf.h     |   3 +
 linux-user/arm/target_proc.h    |   4 +-
 linux-user/elfload.c            | 505 +-------------------------------
 linux-user/loader.h             |  10 +-
 7 files changed, 510 insertions(+), 509 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index b92442dfeb..92c8ea62c6 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -3,9 +3,342 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target/arm/cpu-features.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "any";
 }
+
+enum {
+    ARM_HWCAP_A64_FP            = 1 << 0,
+    ARM_HWCAP_A64_ASIMD         = 1 << 1,
+    ARM_HWCAP_A64_EVTSTRM       = 1 << 2,
+    ARM_HWCAP_A64_AES           = 1 << 3,
+    ARM_HWCAP_A64_PMULL         = 1 << 4,
+    ARM_HWCAP_A64_SHA1          = 1 << 5,
+    ARM_HWCAP_A64_SHA2          = 1 << 6,
+    ARM_HWCAP_A64_CRC32         = 1 << 7,
+    ARM_HWCAP_A64_ATOMICS       = 1 << 8,
+    ARM_HWCAP_A64_FPHP          = 1 << 9,
+    ARM_HWCAP_A64_ASIMDHP       = 1 << 10,
+    ARM_HWCAP_A64_CPUID         = 1 << 11,
+    ARM_HWCAP_A64_ASIMDRDM      = 1 << 12,
+    ARM_HWCAP_A64_JSCVT         = 1 << 13,
+    ARM_HWCAP_A64_FCMA          = 1 << 14,
+    ARM_HWCAP_A64_LRCPC         = 1 << 15,
+    ARM_HWCAP_A64_DCPOP         = 1 << 16,
+    ARM_HWCAP_A64_SHA3          = 1 << 17,
+    ARM_HWCAP_A64_SM3           = 1 << 18,
+    ARM_HWCAP_A64_SM4           = 1 << 19,
+    ARM_HWCAP_A64_ASIMDDP       = 1 << 20,
+    ARM_HWCAP_A64_SHA512        = 1 << 21,
+    ARM_HWCAP_A64_SVE           = 1 << 22,
+    ARM_HWCAP_A64_ASIMDFHM      = 1 << 23,
+    ARM_HWCAP_A64_DIT           = 1 << 24,
+    ARM_HWCAP_A64_USCAT         = 1 << 25,
+    ARM_HWCAP_A64_ILRCPC        = 1 << 26,
+    ARM_HWCAP_A64_FLAGM         = 1 << 27,
+    ARM_HWCAP_A64_SSBS          = 1 << 28,
+    ARM_HWCAP_A64_SB            = 1 << 29,
+    ARM_HWCAP_A64_PACA          = 1 << 30,
+    ARM_HWCAP_A64_PACG          = 1ULL << 31,
+    ARM_HWCAP_A64_GCS           = 1ULL << 32,
+    ARM_HWCAP_A64_CMPBR         = 1ULL << 33,
+    ARM_HWCAP_A64_FPRCVT        = 1ULL << 34,
+    ARM_HWCAP_A64_F8MM8         = 1ULL << 35,
+    ARM_HWCAP_A64_F8MM4         = 1ULL << 36,
+    ARM_HWCAP_A64_SVE_F16MM     = 1ULL << 37,
+    ARM_HWCAP_A64_SVE_ELTPERM   = 1ULL << 38,
+    ARM_HWCAP_A64_SVE_AES2      = 1ULL << 39,
+    ARM_HWCAP_A64_SVE_BFSCALE   = 1ULL << 40,
+    ARM_HWCAP_A64_SVE2P2        = 1ULL << 41,
+    ARM_HWCAP_A64_SME2P2        = 1ULL << 42,
+    ARM_HWCAP_A64_SME_SBITPERM  = 1ULL << 43,
+    ARM_HWCAP_A64_SME_AES       = 1ULL << 44,
+    ARM_HWCAP_A64_SME_SFEXPA    = 1ULL << 45,
+    ARM_HWCAP_A64_SME_STMOP     = 1ULL << 46,
+    ARM_HWCAP_A64_SME_SMOP4     = 1ULL << 47,
+
+    ARM_HWCAP2_A64_DCPODP       = 1 << 0,
+    ARM_HWCAP2_A64_SVE2         = 1 << 1,
+    ARM_HWCAP2_A64_SVEAES       = 1 << 2,
+    ARM_HWCAP2_A64_SVEPMULL     = 1 << 3,
+    ARM_HWCAP2_A64_SVEBITPERM   = 1 << 4,
+    ARM_HWCAP2_A64_SVESHA3      = 1 << 5,
+    ARM_HWCAP2_A64_SVESM4       = 1 << 6,
+    ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
+    ARM_HWCAP2_A64_FRINT        = 1 << 8,
+    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
+    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
+    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
+    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
+    ARM_HWCAP2_A64_I8MM         = 1 << 13,
+    ARM_HWCAP2_A64_BF16         = 1 << 14,
+    ARM_HWCAP2_A64_DGH          = 1 << 15,
+    ARM_HWCAP2_A64_RNG          = 1 << 16,
+    ARM_HWCAP2_A64_BTI          = 1 << 17,
+    ARM_HWCAP2_A64_MTE          = 1 << 18,
+    ARM_HWCAP2_A64_ECV          = 1 << 19,
+    ARM_HWCAP2_A64_AFP          = 1 << 20,
+    ARM_HWCAP2_A64_RPRES        = 1 << 21,
+    ARM_HWCAP2_A64_MTE3         = 1 << 22,
+    ARM_HWCAP2_A64_SME          = 1 << 23,
+    ARM_HWCAP2_A64_SME_I16I64   = 1 << 24,
+    ARM_HWCAP2_A64_SME_F64F64   = 1 << 25,
+    ARM_HWCAP2_A64_SME_I8I32    = 1 << 26,
+    ARM_HWCAP2_A64_SME_F16F32   = 1 << 27,
+    ARM_HWCAP2_A64_SME_B16F32   = 1 << 28,
+    ARM_HWCAP2_A64_SME_F32F32   = 1 << 29,
+    ARM_HWCAP2_A64_SME_FA64     = 1 << 30,
+    ARM_HWCAP2_A64_WFXT         = 1ULL << 31,
+    ARM_HWCAP2_A64_EBF16        = 1ULL << 32,
+    ARM_HWCAP2_A64_SVE_EBF16    = 1ULL << 33,
+    ARM_HWCAP2_A64_CSSC         = 1ULL << 34,
+    ARM_HWCAP2_A64_RPRFM        = 1ULL << 35,
+    ARM_HWCAP2_A64_SVE2P1       = 1ULL << 36,
+    ARM_HWCAP2_A64_SME2         = 1ULL << 37,
+    ARM_HWCAP2_A64_SME2P1       = 1ULL << 38,
+    ARM_HWCAP2_A64_SME_I16I32   = 1ULL << 39,
+    ARM_HWCAP2_A64_SME_BI32I32  = 1ULL << 40,
+    ARM_HWCAP2_A64_SME_B16B16   = 1ULL << 41,
+    ARM_HWCAP2_A64_SME_F16F16   = 1ULL << 42,
+    ARM_HWCAP2_A64_MOPS         = 1ULL << 43,
+    ARM_HWCAP2_A64_HBC          = 1ULL << 44,
+    ARM_HWCAP2_A64_SVE_B16B16   = 1ULL << 45,
+    ARM_HWCAP2_A64_LRCPC3       = 1ULL << 46,
+    ARM_HWCAP2_A64_LSE128       = 1ULL << 47,
+    ARM_HWCAP2_A64_FPMR         = 1ULL << 48,
+    ARM_HWCAP2_A64_LUT          = 1ULL << 49,
+    ARM_HWCAP2_A64_FAMINMAX     = 1ULL << 50,
+    ARM_HWCAP2_A64_F8CVT        = 1ULL << 51,
+    ARM_HWCAP2_A64_F8FMA        = 1ULL << 52,
+    ARM_HWCAP2_A64_F8DP4        = 1ULL << 53,
+    ARM_HWCAP2_A64_F8DP2        = 1ULL << 54,
+    ARM_HWCAP2_A64_F8E4M3       = 1ULL << 55,
+    ARM_HWCAP2_A64_F8E5M2       = 1ULL << 56,
+    ARM_HWCAP2_A64_SME_LUTV2    = 1ULL << 57,
+    ARM_HWCAP2_A64_SME_F8F16    = 1ULL << 58,
+    ARM_HWCAP2_A64_SME_F8F32    = 1ULL << 59,
+    ARM_HWCAP2_A64_SME_SF8FMA   = 1ULL << 60,
+    ARM_HWCAP2_A64_SME_SF8DP4   = 1ULL << 61,
+    ARM_HWCAP2_A64_SME_SF8DP2   = 1ULL << 62,
+    ARM_HWCAP2_A64_POE          = 1ULL << 63,
+};
+
+#define GET_FEATURE_ID(feat, hwcap) \
+    do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    hwcaps |= ARM_HWCAP_A64_FP;
+    hwcaps |= ARM_HWCAP_A64_ASIMD;
+    hwcaps |= ARM_HWCAP_A64_CPUID;
+
+    /* probe for the extra features */
+
+    GET_FEATURE_ID(aa64_aes, ARM_HWCAP_A64_AES);
+    GET_FEATURE_ID(aa64_pmull, ARM_HWCAP_A64_PMULL);
+    GET_FEATURE_ID(aa64_sha1, ARM_HWCAP_A64_SHA1);
+    GET_FEATURE_ID(aa64_sha256, ARM_HWCAP_A64_SHA2);
+    GET_FEATURE_ID(aa64_sha512, ARM_HWCAP_A64_SHA512);
+    GET_FEATURE_ID(aa64_crc32, ARM_HWCAP_A64_CRC32);
+    GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
+    GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
+    GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
+    GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
+    GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
+    GET_FEATURE_ID(aa64_lse2, ARM_HWCAP_A64_USCAT);
+    GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
+    GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
+    GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
+    GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
+    GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
+    GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
+    GET_FEATURE_ID(aa64_dit, ARM_HWCAP_A64_DIT);
+    GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
+    GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
+    GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
+    GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
+    GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
+    GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
+
+    return hwcaps;
+}
+
+abi_ulong get_elf_hwcap2(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
+    GET_FEATURE_ID(aa64_sve2, ARM_HWCAP2_A64_SVE2);
+    GET_FEATURE_ID(aa64_sve2_aes, ARM_HWCAP2_A64_SVEAES);
+    GET_FEATURE_ID(aa64_sve2_pmull128, ARM_HWCAP2_A64_SVEPMULL);
+    GET_FEATURE_ID(aa64_sve2_bitperm, ARM_HWCAP2_A64_SVEBITPERM);
+    GET_FEATURE_ID(aa64_sve2_sha3, ARM_HWCAP2_A64_SVESHA3);
+    GET_FEATURE_ID(aa64_sve2_sm4, ARM_HWCAP2_A64_SVESM4);
+    GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
+    GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
+    GET_FEATURE_ID(aa64_sve_i8mm, ARM_HWCAP2_A64_SVEI8MM);
+    GET_FEATURE_ID(aa64_sve_f32mm, ARM_HWCAP2_A64_SVEF32MM);
+    GET_FEATURE_ID(aa64_sve_f64mm, ARM_HWCAP2_A64_SVEF64MM);
+    GET_FEATURE_ID(aa64_sve_bf16, ARM_HWCAP2_A64_SVEBF16);
+    GET_FEATURE_ID(aa64_i8mm, ARM_HWCAP2_A64_I8MM);
+    GET_FEATURE_ID(aa64_bf16, ARM_HWCAP2_A64_BF16);
+    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
+    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
+    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
+    GET_FEATURE_ID(aa64_mte3, ARM_HWCAP2_A64_MTE3);
+    GET_FEATURE_ID(aa64_sme, (ARM_HWCAP2_A64_SME |
+                              ARM_HWCAP2_A64_SME_F32F32 |
+                              ARM_HWCAP2_A64_SME_B16F32 |
+                              ARM_HWCAP2_A64_SME_F16F32 |
+                              ARM_HWCAP2_A64_SME_I8I32));
+    GET_FEATURE_ID(aa64_sme_f64f64, ARM_HWCAP2_A64_SME_F64F64);
+    GET_FEATURE_ID(aa64_sme_i16i64, ARM_HWCAP2_A64_SME_I16I64);
+    GET_FEATURE_ID(aa64_sme_fa64, ARM_HWCAP2_A64_SME_FA64);
+    GET_FEATURE_ID(aa64_hbc, ARM_HWCAP2_A64_HBC);
+    GET_FEATURE_ID(aa64_mops, ARM_HWCAP2_A64_MOPS);
+    GET_FEATURE_ID(aa64_sve2p1, ARM_HWCAP2_A64_SVE2P1);
+    GET_FEATURE_ID(aa64_sme2, (ARM_HWCAP2_A64_SME2 |
+                               ARM_HWCAP2_A64_SME_I16I32 |
+                               ARM_HWCAP2_A64_SME_BI32I32));
+    GET_FEATURE_ID(aa64_sme2p1, ARM_HWCAP2_A64_SME2P1);
+    GET_FEATURE_ID(aa64_sme_b16b16, ARM_HWCAP2_A64_SME_B16B16);
+    GET_FEATURE_ID(aa64_sme_f16f16, ARM_HWCAP2_A64_SME_F16F16);
+    GET_FEATURE_ID(aa64_sve_b16b16, ARM_HWCAP2_A64_SVE_B16B16);
+
+    return hwcaps;
+}
+
+const char *elf_hwcap_str(uint32_t bit)
+{
+    static const char * const hwcap_str[] = {
+    [__builtin_ctz(ARM_HWCAP_A64_FP      )] = "fp",
+    [__builtin_ctz(ARM_HWCAP_A64_ASIMD   )] = "asimd",
+    [__builtin_ctz(ARM_HWCAP_A64_EVTSTRM )] = "evtstrm",
+    [__builtin_ctz(ARM_HWCAP_A64_AES     )] = "aes",
+    [__builtin_ctz(ARM_HWCAP_A64_PMULL   )] = "pmull",
+    [__builtin_ctz(ARM_HWCAP_A64_SHA1    )] = "sha1",
+    [__builtin_ctz(ARM_HWCAP_A64_SHA2    )] = "sha2",
+    [__builtin_ctz(ARM_HWCAP_A64_CRC32   )] = "crc32",
+    [__builtin_ctz(ARM_HWCAP_A64_ATOMICS )] = "atomics",
+    [__builtin_ctz(ARM_HWCAP_A64_FPHP    )] = "fphp",
+    [__builtin_ctz(ARM_HWCAP_A64_ASIMDHP )] = "asimdhp",
+    [__builtin_ctz(ARM_HWCAP_A64_CPUID   )] = "cpuid",
+    [__builtin_ctz(ARM_HWCAP_A64_ASIMDRDM)] = "asimdrdm",
+    [__builtin_ctz(ARM_HWCAP_A64_JSCVT   )] = "jscvt",
+    [__builtin_ctz(ARM_HWCAP_A64_FCMA    )] = "fcma",
+    [__builtin_ctz(ARM_HWCAP_A64_LRCPC   )] = "lrcpc",
+    [__builtin_ctz(ARM_HWCAP_A64_DCPOP   )] = "dcpop",
+    [__builtin_ctz(ARM_HWCAP_A64_SHA3    )] = "sha3",
+    [__builtin_ctz(ARM_HWCAP_A64_SM3     )] = "sm3",
+    [__builtin_ctz(ARM_HWCAP_A64_SM4     )] = "sm4",
+    [__builtin_ctz(ARM_HWCAP_A64_ASIMDDP )] = "asimddp",
+    [__builtin_ctz(ARM_HWCAP_A64_SHA512  )] = "sha512",
+    [__builtin_ctz(ARM_HWCAP_A64_SVE     )] = "sve",
+    [__builtin_ctz(ARM_HWCAP_A64_ASIMDFHM)] = "asimdfhm",
+    [__builtin_ctz(ARM_HWCAP_A64_DIT     )] = "dit",
+    [__builtin_ctz(ARM_HWCAP_A64_USCAT   )] = "uscat",
+    [__builtin_ctz(ARM_HWCAP_A64_ILRCPC  )] = "ilrcpc",
+    [__builtin_ctz(ARM_HWCAP_A64_FLAGM   )] = "flagm",
+    [__builtin_ctz(ARM_HWCAP_A64_SSBS    )] = "ssbs",
+    [__builtin_ctz(ARM_HWCAP_A64_SB      )] = "sb",
+    [__builtin_ctz(ARM_HWCAP_A64_PACA    )] = "paca",
+    [__builtin_ctz(ARM_HWCAP_A64_PACG    )] = "pacg",
+    [__builtin_ctzll(ARM_HWCAP_A64_GCS   )] = "gcs",
+    [__builtin_ctzll(ARM_HWCAP_A64_CMPBR )] = "cmpbr",
+    [__builtin_ctzll(ARM_HWCAP_A64_FPRCVT)] = "fprcvt",
+    [__builtin_ctzll(ARM_HWCAP_A64_F8MM8 )] = "f8mm8",
+    [__builtin_ctzll(ARM_HWCAP_A64_F8MM4 )] = "f8mm4",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_F16MM)] = "svef16mm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_ELTPERM)] = "sveeltperm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_AES2)] = "sveaes2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE_BFSCALE)] = "svebfscale",
+    [__builtin_ctzll(ARM_HWCAP_A64_SVE2P2)] = "sve2p2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME2P2)] = "sme2p2",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SBITPERM)] = "smesbitperm",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_AES)] = "smeaes",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SFEXPA)] = "smesfexpa",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_STMOP)] = "smestmop",
+    [__builtin_ctzll(ARM_HWCAP_A64_SME_SMOP4)] = "smesmop4",
+    };
+
+    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
+}
+
+const char *elf_hwcap2_str(uint32_t bit)
+{
+    static const char * const hwcap_str[] = {
+    [__builtin_ctz(ARM_HWCAP2_A64_DCPODP       )] = "dcpodp",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVE2         )] = "sve2",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEAES       )] = "sveaes",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEPMULL     )] = "svepmull",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEBITPERM   )] = "svebitperm",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVESHA3      )] = "svesha3",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVESM4       )] = "svesm4",
+    [__builtin_ctz(ARM_HWCAP2_A64_FLAGM2       )] = "flagm2",
+    [__builtin_ctz(ARM_HWCAP2_A64_FRINT        )] = "frint",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEI8MM      )] = "svei8mm",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEF32MM     )] = "svef32mm",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEF64MM     )] = "svef64mm",
+    [__builtin_ctz(ARM_HWCAP2_A64_SVEBF16      )] = "svebf16",
+    [__builtin_ctz(ARM_HWCAP2_A64_I8MM         )] = "i8mm",
+    [__builtin_ctz(ARM_HWCAP2_A64_BF16         )] = "bf16",
+    [__builtin_ctz(ARM_HWCAP2_A64_DGH          )] = "dgh",
+    [__builtin_ctz(ARM_HWCAP2_A64_RNG          )] = "rng",
+    [__builtin_ctz(ARM_HWCAP2_A64_BTI          )] = "bti",
+    [__builtin_ctz(ARM_HWCAP2_A64_MTE          )] = "mte",
+    [__builtin_ctz(ARM_HWCAP2_A64_ECV          )] = "ecv",
+    [__builtin_ctz(ARM_HWCAP2_A64_AFP          )] = "afp",
+    [__builtin_ctz(ARM_HWCAP2_A64_RPRES        )] = "rpres",
+    [__builtin_ctz(ARM_HWCAP2_A64_MTE3         )] = "mte3",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME          )] = "sme",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_I16I64   )] = "smei16i64",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_F64F64   )] = "smef64f64",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_I8I32    )] = "smei8i32",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_F16F32   )] = "smef16f32",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32   )] = "smeb16f32",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32   )] = "smef32f32",
+    [__builtin_ctz(ARM_HWCAP2_A64_SME_FA64     )] = "smefa64",
+    [__builtin_ctz(ARM_HWCAP2_A64_WFXT         )] = "wfxt",
+    [__builtin_ctzll(ARM_HWCAP2_A64_EBF16      )] = "ebf16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SVE_EBF16  )] = "sveebf16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_CSSC       )] = "cssc",
+    [__builtin_ctzll(ARM_HWCAP2_A64_RPRFM      )] = "rprfm",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SVE2P1     )] = "sve2p1",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME2       )] = "sme2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME2P1     )] = "sme2p1",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_I16I32 )] = "smei16i32",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_BI32I32)] = "smebi32i32",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_B16B16 )] = "smeb16b16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F16F16 )] = "smef16f16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_MOPS       )] = "mops",
+    [__builtin_ctzll(ARM_HWCAP2_A64_HBC        )] = "hbc",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SVE_B16B16 )] = "sveb16b16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LRCPC3     )] = "lrcpc3",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LSE128     )] = "lse128",
+    [__builtin_ctzll(ARM_HWCAP2_A64_FPMR       )] = "fpmr",
+    [__builtin_ctzll(ARM_HWCAP2_A64_LUT        )] = "lut",
+    [__builtin_ctzll(ARM_HWCAP2_A64_FAMINMAX   )] = "faminmax",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8CVT      )] = "f8cvt",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8FMA      )] = "f8fma",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP4      )] = "f8dp4",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP2      )] = "f8dp2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8E4M3     )] = "f8e4m3",
+    [__builtin_ctzll(ARM_HWCAP2_A64_F8E5M2     )] = "f8e5m2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_LUTV2  )] = "smelutv2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F16  )] = "smef8f16",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F32  )] = "smef8f32",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP4 )] = "smesf8dp4",
+    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP2 )] = "smesf8dp2",
+    [__builtin_ctzll(ARM_HWCAP2_A64_POE        )] = "poe",
+    };
+
+    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
+}
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index d955b3d07f..77108f3cb0 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -8,4 +8,7 @@
 #ifndef AARCH64_TARGET_ELF_H
 #define AARCH64_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_HWCAP2         1
+
 #endif
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index b92442dfeb..c7561b005b 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -3,9 +3,170 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target/arm/cpu-features.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "any";
 }
+
+enum
+{
+    ARM_HWCAP_ARM_SWP       = 1 << 0,
+    ARM_HWCAP_ARM_HALF      = 1 << 1,
+    ARM_HWCAP_ARM_THUMB     = 1 << 2,
+    ARM_HWCAP_ARM_26BIT     = 1 << 3,
+    ARM_HWCAP_ARM_FAST_MULT = 1 << 4,
+    ARM_HWCAP_ARM_FPA       = 1 << 5,
+    ARM_HWCAP_ARM_VFP       = 1 << 6,
+    ARM_HWCAP_ARM_EDSP      = 1 << 7,
+    ARM_HWCAP_ARM_JAVA      = 1 << 8,
+    ARM_HWCAP_ARM_IWMMXT    = 1 << 9,
+    ARM_HWCAP_ARM_CRUNCH    = 1 << 10,
+    ARM_HWCAP_ARM_THUMBEE   = 1 << 11,
+    ARM_HWCAP_ARM_NEON      = 1 << 12,
+    ARM_HWCAP_ARM_VFPv3     = 1 << 13,
+    ARM_HWCAP_ARM_VFPv3D16  = 1 << 14,
+    ARM_HWCAP_ARM_TLS       = 1 << 15,
+    ARM_HWCAP_ARM_VFPv4     = 1 << 16,
+    ARM_HWCAP_ARM_IDIVA     = 1 << 17,
+    ARM_HWCAP_ARM_IDIVT     = 1 << 18,
+    ARM_HWCAP_ARM_VFPD32    = 1 << 19,
+    ARM_HWCAP_ARM_LPAE      = 1 << 20,
+    ARM_HWCAP_ARM_EVTSTRM   = 1 << 21,
+    ARM_HWCAP_ARM_FPHP      = 1 << 22,
+    ARM_HWCAP_ARM_ASIMDHP   = 1 << 23,
+    ARM_HWCAP_ARM_ASIMDDP   = 1 << 24,
+    ARM_HWCAP_ARM_ASIMDFHM  = 1 << 25,
+    ARM_HWCAP_ARM_ASIMDBF16 = 1 << 26,
+    ARM_HWCAP_ARM_I8MM      = 1 << 27,
+};
+
+enum {
+    ARM_HWCAP2_ARM_AES      = 1 << 0,
+    ARM_HWCAP2_ARM_PMULL    = 1 << 1,
+    ARM_HWCAP2_ARM_SHA1     = 1 << 2,
+    ARM_HWCAP2_ARM_SHA2     = 1 << 3,
+    ARM_HWCAP2_ARM_CRC32    = 1 << 4,
+    ARM_HWCAP2_ARM_SB       = 1 << 5,
+    ARM_HWCAP2_ARM_SSBS     = 1 << 6,
+};
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    hwcaps |= ARM_HWCAP_ARM_SWP;
+    hwcaps |= ARM_HWCAP_ARM_HALF;
+    hwcaps |= ARM_HWCAP_ARM_THUMB;
+    hwcaps |= ARM_HWCAP_ARM_FAST_MULT;
+
+    /* probe for the extra features */
+#define GET_FEATURE(feat, hwcap) \
+    do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
+
+#define GET_FEATURE_ID(feat, hwcap) \
+    do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
+
+    /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
+    GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
+    GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
+    GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
+    GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
+    GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
+    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
+    GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
+    GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
+    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
+
+    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
+        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
+        hwcaps |= ARM_HWCAP_ARM_VFPv3;
+        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
+            hwcaps |= ARM_HWCAP_ARM_VFPD32;
+        } else {
+            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
+        }
+    }
+    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
+    /*
+     * MVFR1.FPHP and .SIMDHP must be in sync, and QEMU uses the same
+     * isar_feature function for both. The kernel reports them as two hwcaps.
+     */
+    GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_FPHP);
+    GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_ASIMDHP);
+    GET_FEATURE_ID(aa32_dp, ARM_HWCAP_ARM_ASIMDDP);
+    GET_FEATURE_ID(aa32_fhm, ARM_HWCAP_ARM_ASIMDFHM);
+    GET_FEATURE_ID(aa32_bf16, ARM_HWCAP_ARM_ASIMDBF16);
+    GET_FEATURE_ID(aa32_i8mm, ARM_HWCAP_ARM_I8MM);
+
+    return hwcaps;
+}
+
+abi_ulong get_elf_hwcap2(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    GET_FEATURE_ID(aa32_aes, ARM_HWCAP2_ARM_AES);
+    GET_FEATURE_ID(aa32_pmull, ARM_HWCAP2_ARM_PMULL);
+    GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);
+    GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);
+    GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);
+    GET_FEATURE_ID(aa32_sb, ARM_HWCAP2_ARM_SB);
+    GET_FEATURE_ID(aa32_ssbs, ARM_HWCAP2_ARM_SSBS);
+    return hwcaps;
+}
+
+const char *elf_hwcap_str(uint32_t bit)
+{
+    static const char *hwcap_str[] = {
+    [__builtin_ctz(ARM_HWCAP_ARM_SWP      )] = "swp",
+    [__builtin_ctz(ARM_HWCAP_ARM_HALF     )] = "half",
+    [__builtin_ctz(ARM_HWCAP_ARM_THUMB    )] = "thumb",
+    [__builtin_ctz(ARM_HWCAP_ARM_26BIT    )] = "26bit",
+    [__builtin_ctz(ARM_HWCAP_ARM_FAST_MULT)] = "fast_mult",
+    [__builtin_ctz(ARM_HWCAP_ARM_FPA      )] = "fpa",
+    [__builtin_ctz(ARM_HWCAP_ARM_VFP      )] = "vfp",
+    [__builtin_ctz(ARM_HWCAP_ARM_EDSP     )] = "edsp",
+    [__builtin_ctz(ARM_HWCAP_ARM_JAVA     )] = "java",
+    [__builtin_ctz(ARM_HWCAP_ARM_IWMMXT   )] = "iwmmxt",
+    [__builtin_ctz(ARM_HWCAP_ARM_CRUNCH   )] = "crunch",
+    [__builtin_ctz(ARM_HWCAP_ARM_THUMBEE  )] = "thumbee",
+    [__builtin_ctz(ARM_HWCAP_ARM_NEON     )] = "neon",
+    [__builtin_ctz(ARM_HWCAP_ARM_VFPv3    )] = "vfpv3",
+    [__builtin_ctz(ARM_HWCAP_ARM_VFPv3D16 )] = "vfpv3d16",
+    [__builtin_ctz(ARM_HWCAP_ARM_TLS      )] = "tls",
+    [__builtin_ctz(ARM_HWCAP_ARM_VFPv4    )] = "vfpv4",
+    [__builtin_ctz(ARM_HWCAP_ARM_IDIVA    )] = "idiva",
+    [__builtin_ctz(ARM_HWCAP_ARM_IDIVT    )] = "idivt",
+    [__builtin_ctz(ARM_HWCAP_ARM_VFPD32   )] = "vfpd32",
+    [__builtin_ctz(ARM_HWCAP_ARM_LPAE     )] = "lpae",
+    [__builtin_ctz(ARM_HWCAP_ARM_EVTSTRM  )] = "evtstrm",
+    [__builtin_ctz(ARM_HWCAP_ARM_FPHP     )] = "fphp",
+    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDHP  )] = "asimdhp",
+    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDDP  )] = "asimddp",
+    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDFHM )] = "asimdfhm",
+    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDBF16)] = "asimdbf16",
+    [__builtin_ctz(ARM_HWCAP_ARM_I8MM     )] = "i8mm",
+    };
+
+    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
+}
+
+const char *elf_hwcap2_str(uint32_t bit)
+{
+    static const char *hwcap_str[] = {
+    [__builtin_ctz(ARM_HWCAP2_ARM_AES  )] = "aes",
+    [__builtin_ctz(ARM_HWCAP2_ARM_PMULL)] = "pmull",
+    [__builtin_ctz(ARM_HWCAP2_ARM_SHA1 )] = "sha1",
+    [__builtin_ctz(ARM_HWCAP2_ARM_SHA2 )] = "sha2",
+    [__builtin_ctz(ARM_HWCAP2_ARM_CRC32)] = "crc32",
+    [__builtin_ctz(ARM_HWCAP2_ARM_SB   )] = "sb",
+    [__builtin_ctz(ARM_HWCAP2_ARM_SSBS )] = "ssbs",
+    };
+
+    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
+}
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 2abb27a733..90470bd87b 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -8,4 +8,7 @@
 #ifndef ARM_TARGET_ELF_H
 #define ARM_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_HWCAP2         1
+
 #endif
diff --git a/linux-user/arm/target_proc.h b/linux-user/arm/target_proc.h
index ac75af9ca6..a4cd6948c6 100644
--- a/linux-user/arm/target_proc.h
+++ b/linux-user/arm/target_proc.h
@@ -10,8 +10,8 @@ static int open_cpuinfo(CPUArchState *cpu_env, int fd)
 {
     ARMCPU *cpu = env_archcpu(cpu_env);
     int arch, midr_rev, midr_part, midr_var, midr_impl;
-    target_ulong elf_hwcap = get_elf_hwcap();
-    target_ulong elf_hwcap2 = get_elf_hwcap2();
+    target_ulong elf_hwcap = get_elf_hwcap(env_cpu(cpu_env));
+    target_ulong elf_hwcap2 = get_elf_hwcap2(env_cpu(cpu_env));
     const char *elf_name;
     int num_cpus, len_part, len_var;
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0c62c249e9..149d1313c0 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -401,48 +401,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *en
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
-enum
-{
-    ARM_HWCAP_ARM_SWP       = 1 << 0,
-    ARM_HWCAP_ARM_HALF      = 1 << 1,
-    ARM_HWCAP_ARM_THUMB     = 1 << 2,
-    ARM_HWCAP_ARM_26BIT     = 1 << 3,
-    ARM_HWCAP_ARM_FAST_MULT = 1 << 4,
-    ARM_HWCAP_ARM_FPA       = 1 << 5,
-    ARM_HWCAP_ARM_VFP       = 1 << 6,
-    ARM_HWCAP_ARM_EDSP      = 1 << 7,
-    ARM_HWCAP_ARM_JAVA      = 1 << 8,
-    ARM_HWCAP_ARM_IWMMXT    = 1 << 9,
-    ARM_HWCAP_ARM_CRUNCH    = 1 << 10,
-    ARM_HWCAP_ARM_THUMBEE   = 1 << 11,
-    ARM_HWCAP_ARM_NEON      = 1 << 12,
-    ARM_HWCAP_ARM_VFPv3     = 1 << 13,
-    ARM_HWCAP_ARM_VFPv3D16  = 1 << 14,
-    ARM_HWCAP_ARM_TLS       = 1 << 15,
-    ARM_HWCAP_ARM_VFPv4     = 1 << 16,
-    ARM_HWCAP_ARM_IDIVA     = 1 << 17,
-    ARM_HWCAP_ARM_IDIVT     = 1 << 18,
-    ARM_HWCAP_ARM_VFPD32    = 1 << 19,
-    ARM_HWCAP_ARM_LPAE      = 1 << 20,
-    ARM_HWCAP_ARM_EVTSTRM   = 1 << 21,
-    ARM_HWCAP_ARM_FPHP      = 1 << 22,
-    ARM_HWCAP_ARM_ASIMDHP   = 1 << 23,
-    ARM_HWCAP_ARM_ASIMDDP   = 1 << 24,
-    ARM_HWCAP_ARM_ASIMDFHM  = 1 << 25,
-    ARM_HWCAP_ARM_ASIMDBF16 = 1 << 26,
-    ARM_HWCAP_ARM_I8MM      = 1 << 27,
-};
-
-enum {
-    ARM_HWCAP2_ARM_AES      = 1 << 0,
-    ARM_HWCAP2_ARM_PMULL    = 1 << 1,
-    ARM_HWCAP2_ARM_SHA1     = 1 << 2,
-    ARM_HWCAP2_ARM_SHA2     = 1 << 3,
-    ARM_HWCAP2_ARM_CRC32    = 1 << 4,
-    ARM_HWCAP2_ARM_SB       = 1 << 5,
-    ARM_HWCAP2_ARM_SSBS     = 1 << 6,
-};
-
 /* The commpage only exists for 32 bit kernels */
 
 #define HI_COMMPAGE (intptr_t)0xffff0f00u
@@ -491,129 +449,8 @@ static bool init_guest_commpage(void)
     return true;
 }
 
-#define ELF_HWCAP get_elf_hwcap()
-#define ELF_HWCAP2 get_elf_hwcap2()
-
-uint32_t get_elf_hwcap(void)
-{
-    ARMCPU *cpu = ARM_CPU(thread_cpu);
-    uint32_t hwcaps = 0;
-
-    hwcaps |= ARM_HWCAP_ARM_SWP;
-    hwcaps |= ARM_HWCAP_ARM_HALF;
-    hwcaps |= ARM_HWCAP_ARM_THUMB;
-    hwcaps |= ARM_HWCAP_ARM_FAST_MULT;
-
-    /* probe for the extra features */
-#define GET_FEATURE(feat, hwcap) \
-    do { if (arm_feature(&cpu->env, feat)) { hwcaps |= hwcap; } } while (0)
-
-#define GET_FEATURE_ID(feat, hwcap) \
-    do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
-
-    /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
-    GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
-    GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
-    GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
-    GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
-    GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
-    GET_FEATURE(ARM_FEATURE_LPAE, ARM_HWCAP_ARM_LPAE);
-    GET_FEATURE_ID(aa32_arm_div, ARM_HWCAP_ARM_IDIVA);
-    GET_FEATURE_ID(aa32_thumb_div, ARM_HWCAP_ARM_IDIVT);
-    GET_FEATURE_ID(aa32_vfp, ARM_HWCAP_ARM_VFP);
-
-    if (cpu_isar_feature(aa32_fpsp_v3, cpu) ||
-        cpu_isar_feature(aa32_fpdp_v3, cpu)) {
-        hwcaps |= ARM_HWCAP_ARM_VFPv3;
-        if (cpu_isar_feature(aa32_simd_r32, cpu)) {
-            hwcaps |= ARM_HWCAP_ARM_VFPD32;
-        } else {
-            hwcaps |= ARM_HWCAP_ARM_VFPv3D16;
-        }
-    }
-    GET_FEATURE_ID(aa32_simdfmac, ARM_HWCAP_ARM_VFPv4);
-    /*
-     * MVFR1.FPHP and .SIMDHP must be in sync, and QEMU uses the same
-     * isar_feature function for both. The kernel reports them as two hwcaps.
-     */
-    GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_FPHP);
-    GET_FEATURE_ID(aa32_fp16_arith, ARM_HWCAP_ARM_ASIMDHP);
-    GET_FEATURE_ID(aa32_dp, ARM_HWCAP_ARM_ASIMDDP);
-    GET_FEATURE_ID(aa32_fhm, ARM_HWCAP_ARM_ASIMDFHM);
-    GET_FEATURE_ID(aa32_bf16, ARM_HWCAP_ARM_ASIMDBF16);
-    GET_FEATURE_ID(aa32_i8mm, ARM_HWCAP_ARM_I8MM);
-
-    return hwcaps;
-}
-
-uint64_t get_elf_hwcap2(void)
-{
-    ARMCPU *cpu = ARM_CPU(thread_cpu);
-    uint64_t hwcaps = 0;
-
-    GET_FEATURE_ID(aa32_aes, ARM_HWCAP2_ARM_AES);
-    GET_FEATURE_ID(aa32_pmull, ARM_HWCAP2_ARM_PMULL);
-    GET_FEATURE_ID(aa32_sha1, ARM_HWCAP2_ARM_SHA1);
-    GET_FEATURE_ID(aa32_sha2, ARM_HWCAP2_ARM_SHA2);
-    GET_FEATURE_ID(aa32_crc32, ARM_HWCAP2_ARM_CRC32);
-    GET_FEATURE_ID(aa32_sb, ARM_HWCAP2_ARM_SB);
-    GET_FEATURE_ID(aa32_ssbs, ARM_HWCAP2_ARM_SSBS);
-    return hwcaps;
-}
-
-const char *elf_hwcap_str(uint32_t bit)
-{
-    static const char *hwcap_str[] = {
-    [__builtin_ctz(ARM_HWCAP_ARM_SWP      )] = "swp",
-    [__builtin_ctz(ARM_HWCAP_ARM_HALF     )] = "half",
-    [__builtin_ctz(ARM_HWCAP_ARM_THUMB    )] = "thumb",
-    [__builtin_ctz(ARM_HWCAP_ARM_26BIT    )] = "26bit",
-    [__builtin_ctz(ARM_HWCAP_ARM_FAST_MULT)] = "fast_mult",
-    [__builtin_ctz(ARM_HWCAP_ARM_FPA      )] = "fpa",
-    [__builtin_ctz(ARM_HWCAP_ARM_VFP      )] = "vfp",
-    [__builtin_ctz(ARM_HWCAP_ARM_EDSP     )] = "edsp",
-    [__builtin_ctz(ARM_HWCAP_ARM_JAVA     )] = "java",
-    [__builtin_ctz(ARM_HWCAP_ARM_IWMMXT   )] = "iwmmxt",
-    [__builtin_ctz(ARM_HWCAP_ARM_CRUNCH   )] = "crunch",
-    [__builtin_ctz(ARM_HWCAP_ARM_THUMBEE  )] = "thumbee",
-    [__builtin_ctz(ARM_HWCAP_ARM_NEON     )] = "neon",
-    [__builtin_ctz(ARM_HWCAP_ARM_VFPv3    )] = "vfpv3",
-    [__builtin_ctz(ARM_HWCAP_ARM_VFPv3D16 )] = "vfpv3d16",
-    [__builtin_ctz(ARM_HWCAP_ARM_TLS      )] = "tls",
-    [__builtin_ctz(ARM_HWCAP_ARM_VFPv4    )] = "vfpv4",
-    [__builtin_ctz(ARM_HWCAP_ARM_IDIVA    )] = "idiva",
-    [__builtin_ctz(ARM_HWCAP_ARM_IDIVT    )] = "idivt",
-    [__builtin_ctz(ARM_HWCAP_ARM_VFPD32   )] = "vfpd32",
-    [__builtin_ctz(ARM_HWCAP_ARM_LPAE     )] = "lpae",
-    [__builtin_ctz(ARM_HWCAP_ARM_EVTSTRM  )] = "evtstrm",
-    [__builtin_ctz(ARM_HWCAP_ARM_FPHP     )] = "fphp",
-    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDHP  )] = "asimdhp",
-    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDDP  )] = "asimddp",
-    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDFHM )] = "asimdfhm",
-    [__builtin_ctz(ARM_HWCAP_ARM_ASIMDBF16)] = "asimdbf16",
-    [__builtin_ctz(ARM_HWCAP_ARM_I8MM     )] = "i8mm",
-    };
-
-    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
-}
-
-const char *elf_hwcap2_str(uint32_t bit)
-{
-    static const char *hwcap_str[] = {
-    [__builtin_ctz(ARM_HWCAP2_ARM_AES  )] = "aes",
-    [__builtin_ctz(ARM_HWCAP2_ARM_PMULL)] = "pmull",
-    [__builtin_ctz(ARM_HWCAP2_ARM_SHA1 )] = "sha1",
-    [__builtin_ctz(ARM_HWCAP2_ARM_SHA2 )] = "sha2",
-    [__builtin_ctz(ARM_HWCAP2_ARM_CRC32)] = "crc32",
-    [__builtin_ctz(ARM_HWCAP2_ARM_SB   )] = "sb",
-    [__builtin_ctz(ARM_HWCAP2_ARM_SSBS )] = "ssbs",
-    };
-
-    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
-}
-
-#undef GET_FEATURE
-#undef GET_FEATURE_ID
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
+#define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
 
 #define ELF_PLATFORM get_elf_platform()
 
@@ -702,342 +539,8 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
-enum {
-    ARM_HWCAP_A64_FP            = 1 << 0,
-    ARM_HWCAP_A64_ASIMD         = 1 << 1,
-    ARM_HWCAP_A64_EVTSTRM       = 1 << 2,
-    ARM_HWCAP_A64_AES           = 1 << 3,
-    ARM_HWCAP_A64_PMULL         = 1 << 4,
-    ARM_HWCAP_A64_SHA1          = 1 << 5,
-    ARM_HWCAP_A64_SHA2          = 1 << 6,
-    ARM_HWCAP_A64_CRC32         = 1 << 7,
-    ARM_HWCAP_A64_ATOMICS       = 1 << 8,
-    ARM_HWCAP_A64_FPHP          = 1 << 9,
-    ARM_HWCAP_A64_ASIMDHP       = 1 << 10,
-    ARM_HWCAP_A64_CPUID         = 1 << 11,
-    ARM_HWCAP_A64_ASIMDRDM      = 1 << 12,
-    ARM_HWCAP_A64_JSCVT         = 1 << 13,
-    ARM_HWCAP_A64_FCMA          = 1 << 14,
-    ARM_HWCAP_A64_LRCPC         = 1 << 15,
-    ARM_HWCAP_A64_DCPOP         = 1 << 16,
-    ARM_HWCAP_A64_SHA3          = 1 << 17,
-    ARM_HWCAP_A64_SM3           = 1 << 18,
-    ARM_HWCAP_A64_SM4           = 1 << 19,
-    ARM_HWCAP_A64_ASIMDDP       = 1 << 20,
-    ARM_HWCAP_A64_SHA512        = 1 << 21,
-    ARM_HWCAP_A64_SVE           = 1 << 22,
-    ARM_HWCAP_A64_ASIMDFHM      = 1 << 23,
-    ARM_HWCAP_A64_DIT           = 1 << 24,
-    ARM_HWCAP_A64_USCAT         = 1 << 25,
-    ARM_HWCAP_A64_ILRCPC        = 1 << 26,
-    ARM_HWCAP_A64_FLAGM         = 1 << 27,
-    ARM_HWCAP_A64_SSBS          = 1 << 28,
-    ARM_HWCAP_A64_SB            = 1 << 29,
-    ARM_HWCAP_A64_PACA          = 1 << 30,
-    ARM_HWCAP_A64_PACG          = 1ULL << 31,
-    ARM_HWCAP_A64_GCS           = 1ULL << 32,
-    ARM_HWCAP_A64_CMPBR         = 1ULL << 33,
-    ARM_HWCAP_A64_FPRCVT        = 1ULL << 34,
-    ARM_HWCAP_A64_F8MM8         = 1ULL << 35,
-    ARM_HWCAP_A64_F8MM4         = 1ULL << 36,
-    ARM_HWCAP_A64_SVE_F16MM     = 1ULL << 37,
-    ARM_HWCAP_A64_SVE_ELTPERM   = 1ULL << 38,
-    ARM_HWCAP_A64_SVE_AES2      = 1ULL << 39,
-    ARM_HWCAP_A64_SVE_BFSCALE   = 1ULL << 40,
-    ARM_HWCAP_A64_SVE2P2        = 1ULL << 41,
-    ARM_HWCAP_A64_SME2P2        = 1ULL << 42,
-    ARM_HWCAP_A64_SME_SBITPERM  = 1ULL << 43,
-    ARM_HWCAP_A64_SME_AES       = 1ULL << 44,
-    ARM_HWCAP_A64_SME_SFEXPA    = 1ULL << 45,
-    ARM_HWCAP_A64_SME_STMOP     = 1ULL << 46,
-    ARM_HWCAP_A64_SME_SMOP4     = 1ULL << 47,
-
-    ARM_HWCAP2_A64_DCPODP       = 1 << 0,
-    ARM_HWCAP2_A64_SVE2         = 1 << 1,
-    ARM_HWCAP2_A64_SVEAES       = 1 << 2,
-    ARM_HWCAP2_A64_SVEPMULL     = 1 << 3,
-    ARM_HWCAP2_A64_SVEBITPERM   = 1 << 4,
-    ARM_HWCAP2_A64_SVESHA3      = 1 << 5,
-    ARM_HWCAP2_A64_SVESM4       = 1 << 6,
-    ARM_HWCAP2_A64_FLAGM2       = 1 << 7,
-    ARM_HWCAP2_A64_FRINT        = 1 << 8,
-    ARM_HWCAP2_A64_SVEI8MM      = 1 << 9,
-    ARM_HWCAP2_A64_SVEF32MM     = 1 << 10,
-    ARM_HWCAP2_A64_SVEF64MM     = 1 << 11,
-    ARM_HWCAP2_A64_SVEBF16      = 1 << 12,
-    ARM_HWCAP2_A64_I8MM         = 1 << 13,
-    ARM_HWCAP2_A64_BF16         = 1 << 14,
-    ARM_HWCAP2_A64_DGH          = 1 << 15,
-    ARM_HWCAP2_A64_RNG          = 1 << 16,
-    ARM_HWCAP2_A64_BTI          = 1 << 17,
-    ARM_HWCAP2_A64_MTE          = 1 << 18,
-    ARM_HWCAP2_A64_ECV          = 1 << 19,
-    ARM_HWCAP2_A64_AFP          = 1 << 20,
-    ARM_HWCAP2_A64_RPRES        = 1 << 21,
-    ARM_HWCAP2_A64_MTE3         = 1 << 22,
-    ARM_HWCAP2_A64_SME          = 1 << 23,
-    ARM_HWCAP2_A64_SME_I16I64   = 1 << 24,
-    ARM_HWCAP2_A64_SME_F64F64   = 1 << 25,
-    ARM_HWCAP2_A64_SME_I8I32    = 1 << 26,
-    ARM_HWCAP2_A64_SME_F16F32   = 1 << 27,
-    ARM_HWCAP2_A64_SME_B16F32   = 1 << 28,
-    ARM_HWCAP2_A64_SME_F32F32   = 1 << 29,
-    ARM_HWCAP2_A64_SME_FA64     = 1 << 30,
-    ARM_HWCAP2_A64_WFXT         = 1ULL << 31,
-    ARM_HWCAP2_A64_EBF16        = 1ULL << 32,
-    ARM_HWCAP2_A64_SVE_EBF16    = 1ULL << 33,
-    ARM_HWCAP2_A64_CSSC         = 1ULL << 34,
-    ARM_HWCAP2_A64_RPRFM        = 1ULL << 35,
-    ARM_HWCAP2_A64_SVE2P1       = 1ULL << 36,
-    ARM_HWCAP2_A64_SME2         = 1ULL << 37,
-    ARM_HWCAP2_A64_SME2P1       = 1ULL << 38,
-    ARM_HWCAP2_A64_SME_I16I32   = 1ULL << 39,
-    ARM_HWCAP2_A64_SME_BI32I32  = 1ULL << 40,
-    ARM_HWCAP2_A64_SME_B16B16   = 1ULL << 41,
-    ARM_HWCAP2_A64_SME_F16F16   = 1ULL << 42,
-    ARM_HWCAP2_A64_MOPS         = 1ULL << 43,
-    ARM_HWCAP2_A64_HBC          = 1ULL << 44,
-    ARM_HWCAP2_A64_SVE_B16B16   = 1ULL << 45,
-    ARM_HWCAP2_A64_LRCPC3       = 1ULL << 46,
-    ARM_HWCAP2_A64_LSE128       = 1ULL << 47,
-    ARM_HWCAP2_A64_FPMR         = 1ULL << 48,
-    ARM_HWCAP2_A64_LUT          = 1ULL << 49,
-    ARM_HWCAP2_A64_FAMINMAX     = 1ULL << 50,
-    ARM_HWCAP2_A64_F8CVT        = 1ULL << 51,
-    ARM_HWCAP2_A64_F8FMA        = 1ULL << 52,
-    ARM_HWCAP2_A64_F8DP4        = 1ULL << 53,
-    ARM_HWCAP2_A64_F8DP2        = 1ULL << 54,
-    ARM_HWCAP2_A64_F8E4M3       = 1ULL << 55,
-    ARM_HWCAP2_A64_F8E5M2       = 1ULL << 56,
-    ARM_HWCAP2_A64_SME_LUTV2    = 1ULL << 57,
-    ARM_HWCAP2_A64_SME_F8F16    = 1ULL << 58,
-    ARM_HWCAP2_A64_SME_F8F32    = 1ULL << 59,
-    ARM_HWCAP2_A64_SME_SF8FMA   = 1ULL << 60,
-    ARM_HWCAP2_A64_SME_SF8DP4   = 1ULL << 61,
-    ARM_HWCAP2_A64_SME_SF8DP2   = 1ULL << 62,
-    ARM_HWCAP2_A64_POE          = 1ULL << 63,
-};
-
-#define ELF_HWCAP   get_elf_hwcap()
-#define ELF_HWCAP2  get_elf_hwcap2()
-
-#define GET_FEATURE_ID(feat, hwcap) \
-    do { if (cpu_isar_feature(feat, cpu)) { hwcaps |= hwcap; } } while (0)
-
-uint32_t get_elf_hwcap(void)
-{
-    ARMCPU *cpu = ARM_CPU(thread_cpu);
-    uint32_t hwcaps = 0;
-
-    hwcaps |= ARM_HWCAP_A64_FP;
-    hwcaps |= ARM_HWCAP_A64_ASIMD;
-    hwcaps |= ARM_HWCAP_A64_CPUID;
-
-    /* probe for the extra features */
-
-    GET_FEATURE_ID(aa64_aes, ARM_HWCAP_A64_AES);
-    GET_FEATURE_ID(aa64_pmull, ARM_HWCAP_A64_PMULL);
-    GET_FEATURE_ID(aa64_sha1, ARM_HWCAP_A64_SHA1);
-    GET_FEATURE_ID(aa64_sha256, ARM_HWCAP_A64_SHA2);
-    GET_FEATURE_ID(aa64_sha512, ARM_HWCAP_A64_SHA512);
-    GET_FEATURE_ID(aa64_crc32, ARM_HWCAP_A64_CRC32);
-    GET_FEATURE_ID(aa64_sha3, ARM_HWCAP_A64_SHA3);
-    GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
-    GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
-    GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
-    GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
-    GET_FEATURE_ID(aa64_lse2, ARM_HWCAP_A64_USCAT);
-    GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
-    GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
-    GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
-    GET_FEATURE_ID(aa64_sve, ARM_HWCAP_A64_SVE);
-    GET_FEATURE_ID(aa64_pauth, ARM_HWCAP_A64_PACA | ARM_HWCAP_A64_PACG);
-    GET_FEATURE_ID(aa64_fhm, ARM_HWCAP_A64_ASIMDFHM);
-    GET_FEATURE_ID(aa64_dit, ARM_HWCAP_A64_DIT);
-    GET_FEATURE_ID(aa64_jscvt, ARM_HWCAP_A64_JSCVT);
-    GET_FEATURE_ID(aa64_sb, ARM_HWCAP_A64_SB);
-    GET_FEATURE_ID(aa64_condm_4, ARM_HWCAP_A64_FLAGM);
-    GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
-    GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
-    GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
-
-    return hwcaps;
-}
-
-uint64_t get_elf_hwcap2(void)
-{
-    ARMCPU *cpu = ARM_CPU(thread_cpu);
-    uint64_t hwcaps = 0;
-
-    GET_FEATURE_ID(aa64_dcpodp, ARM_HWCAP2_A64_DCPODP);
-    GET_FEATURE_ID(aa64_sve2, ARM_HWCAP2_A64_SVE2);
-    GET_FEATURE_ID(aa64_sve2_aes, ARM_HWCAP2_A64_SVEAES);
-    GET_FEATURE_ID(aa64_sve2_pmull128, ARM_HWCAP2_A64_SVEPMULL);
-    GET_FEATURE_ID(aa64_sve2_bitperm, ARM_HWCAP2_A64_SVEBITPERM);
-    GET_FEATURE_ID(aa64_sve2_sha3, ARM_HWCAP2_A64_SVESHA3);
-    GET_FEATURE_ID(aa64_sve2_sm4, ARM_HWCAP2_A64_SVESM4);
-    GET_FEATURE_ID(aa64_condm_5, ARM_HWCAP2_A64_FLAGM2);
-    GET_FEATURE_ID(aa64_frint, ARM_HWCAP2_A64_FRINT);
-    GET_FEATURE_ID(aa64_sve_i8mm, ARM_HWCAP2_A64_SVEI8MM);
-    GET_FEATURE_ID(aa64_sve_f32mm, ARM_HWCAP2_A64_SVEF32MM);
-    GET_FEATURE_ID(aa64_sve_f64mm, ARM_HWCAP2_A64_SVEF64MM);
-    GET_FEATURE_ID(aa64_sve_bf16, ARM_HWCAP2_A64_SVEBF16);
-    GET_FEATURE_ID(aa64_i8mm, ARM_HWCAP2_A64_I8MM);
-    GET_FEATURE_ID(aa64_bf16, ARM_HWCAP2_A64_BF16);
-    GET_FEATURE_ID(aa64_rndr, ARM_HWCAP2_A64_RNG);
-    GET_FEATURE_ID(aa64_bti, ARM_HWCAP2_A64_BTI);
-    GET_FEATURE_ID(aa64_mte, ARM_HWCAP2_A64_MTE);
-    GET_FEATURE_ID(aa64_mte3, ARM_HWCAP2_A64_MTE3);
-    GET_FEATURE_ID(aa64_sme, (ARM_HWCAP2_A64_SME |
-                              ARM_HWCAP2_A64_SME_F32F32 |
-                              ARM_HWCAP2_A64_SME_B16F32 |
-                              ARM_HWCAP2_A64_SME_F16F32 |
-                              ARM_HWCAP2_A64_SME_I8I32));
-    GET_FEATURE_ID(aa64_sme_f64f64, ARM_HWCAP2_A64_SME_F64F64);
-    GET_FEATURE_ID(aa64_sme_i16i64, ARM_HWCAP2_A64_SME_I16I64);
-    GET_FEATURE_ID(aa64_sme_fa64, ARM_HWCAP2_A64_SME_FA64);
-    GET_FEATURE_ID(aa64_hbc, ARM_HWCAP2_A64_HBC);
-    GET_FEATURE_ID(aa64_mops, ARM_HWCAP2_A64_MOPS);
-    GET_FEATURE_ID(aa64_sve2p1, ARM_HWCAP2_A64_SVE2P1);
-    GET_FEATURE_ID(aa64_sme2, (ARM_HWCAP2_A64_SME2 |
-                               ARM_HWCAP2_A64_SME_I16I32 |
-                               ARM_HWCAP2_A64_SME_BI32I32));
-    GET_FEATURE_ID(aa64_sme2p1, ARM_HWCAP2_A64_SME2P1);
-    GET_FEATURE_ID(aa64_sme_b16b16, ARM_HWCAP2_A64_SME_B16B16);
-    GET_FEATURE_ID(aa64_sme_f16f16, ARM_HWCAP2_A64_SME_F16F16);
-    GET_FEATURE_ID(aa64_sve_b16b16, ARM_HWCAP2_A64_SVE_B16B16);
-
-    return hwcaps;
-}
-
-const char *elf_hwcap_str(uint32_t bit)
-{
-    static const char * const hwcap_str[] = {
-    [__builtin_ctz(ARM_HWCAP_A64_FP      )] = "fp",
-    [__builtin_ctz(ARM_HWCAP_A64_ASIMD   )] = "asimd",
-    [__builtin_ctz(ARM_HWCAP_A64_EVTSTRM )] = "evtstrm",
-    [__builtin_ctz(ARM_HWCAP_A64_AES     )] = "aes",
-    [__builtin_ctz(ARM_HWCAP_A64_PMULL   )] = "pmull",
-    [__builtin_ctz(ARM_HWCAP_A64_SHA1    )] = "sha1",
-    [__builtin_ctz(ARM_HWCAP_A64_SHA2    )] = "sha2",
-    [__builtin_ctz(ARM_HWCAP_A64_CRC32   )] = "crc32",
-    [__builtin_ctz(ARM_HWCAP_A64_ATOMICS )] = "atomics",
-    [__builtin_ctz(ARM_HWCAP_A64_FPHP    )] = "fphp",
-    [__builtin_ctz(ARM_HWCAP_A64_ASIMDHP )] = "asimdhp",
-    [__builtin_ctz(ARM_HWCAP_A64_CPUID   )] = "cpuid",
-    [__builtin_ctz(ARM_HWCAP_A64_ASIMDRDM)] = "asimdrdm",
-    [__builtin_ctz(ARM_HWCAP_A64_JSCVT   )] = "jscvt",
-    [__builtin_ctz(ARM_HWCAP_A64_FCMA    )] = "fcma",
-    [__builtin_ctz(ARM_HWCAP_A64_LRCPC   )] = "lrcpc",
-    [__builtin_ctz(ARM_HWCAP_A64_DCPOP   )] = "dcpop",
-    [__builtin_ctz(ARM_HWCAP_A64_SHA3    )] = "sha3",
-    [__builtin_ctz(ARM_HWCAP_A64_SM3     )] = "sm3",
-    [__builtin_ctz(ARM_HWCAP_A64_SM4     )] = "sm4",
-    [__builtin_ctz(ARM_HWCAP_A64_ASIMDDP )] = "asimddp",
-    [__builtin_ctz(ARM_HWCAP_A64_SHA512  )] = "sha512",
-    [__builtin_ctz(ARM_HWCAP_A64_SVE     )] = "sve",
-    [__builtin_ctz(ARM_HWCAP_A64_ASIMDFHM)] = "asimdfhm",
-    [__builtin_ctz(ARM_HWCAP_A64_DIT     )] = "dit",
-    [__builtin_ctz(ARM_HWCAP_A64_USCAT   )] = "uscat",
-    [__builtin_ctz(ARM_HWCAP_A64_ILRCPC  )] = "ilrcpc",
-    [__builtin_ctz(ARM_HWCAP_A64_FLAGM   )] = "flagm",
-    [__builtin_ctz(ARM_HWCAP_A64_SSBS    )] = "ssbs",
-    [__builtin_ctz(ARM_HWCAP_A64_SB      )] = "sb",
-    [__builtin_ctz(ARM_HWCAP_A64_PACA    )] = "paca",
-    [__builtin_ctz(ARM_HWCAP_A64_PACG    )] = "pacg",
-    [__builtin_ctzll(ARM_HWCAP_A64_GCS   )] = "gcs",
-    [__builtin_ctzll(ARM_HWCAP_A64_CMPBR )] = "cmpbr",
-    [__builtin_ctzll(ARM_HWCAP_A64_FPRCVT)] = "fprcvt",
-    [__builtin_ctzll(ARM_HWCAP_A64_F8MM8 )] = "f8mm8",
-    [__builtin_ctzll(ARM_HWCAP_A64_F8MM4 )] = "f8mm4",
-    [__builtin_ctzll(ARM_HWCAP_A64_SVE_F16MM)] = "svef16mm",
-    [__builtin_ctzll(ARM_HWCAP_A64_SVE_ELTPERM)] = "sveeltperm",
-    [__builtin_ctzll(ARM_HWCAP_A64_SVE_AES2)] = "sveaes2",
-    [__builtin_ctzll(ARM_HWCAP_A64_SVE_BFSCALE)] = "svebfscale",
-    [__builtin_ctzll(ARM_HWCAP_A64_SVE2P2)] = "sve2p2",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME2P2)] = "sme2p2",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME_SBITPERM)] = "smesbitperm",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME_AES)] = "smeaes",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME_SFEXPA)] = "smesfexpa",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME_STMOP)] = "smestmop",
-    [__builtin_ctzll(ARM_HWCAP_A64_SME_SMOP4)] = "smesmop4",
-    };
-
-    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
-}
-
-const char *elf_hwcap2_str(uint32_t bit)
-{
-    static const char * const hwcap_str[] = {
-    [__builtin_ctz(ARM_HWCAP2_A64_DCPODP       )] = "dcpodp",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVE2         )] = "sve2",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEAES       )] = "sveaes",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEPMULL     )] = "svepmull",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEBITPERM   )] = "svebitperm",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVESHA3      )] = "svesha3",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVESM4       )] = "svesm4",
-    [__builtin_ctz(ARM_HWCAP2_A64_FLAGM2       )] = "flagm2",
-    [__builtin_ctz(ARM_HWCAP2_A64_FRINT        )] = "frint",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEI8MM      )] = "svei8mm",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEF32MM     )] = "svef32mm",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEF64MM     )] = "svef64mm",
-    [__builtin_ctz(ARM_HWCAP2_A64_SVEBF16      )] = "svebf16",
-    [__builtin_ctz(ARM_HWCAP2_A64_I8MM         )] = "i8mm",
-    [__builtin_ctz(ARM_HWCAP2_A64_BF16         )] = "bf16",
-    [__builtin_ctz(ARM_HWCAP2_A64_DGH          )] = "dgh",
-    [__builtin_ctz(ARM_HWCAP2_A64_RNG          )] = "rng",
-    [__builtin_ctz(ARM_HWCAP2_A64_BTI          )] = "bti",
-    [__builtin_ctz(ARM_HWCAP2_A64_MTE          )] = "mte",
-    [__builtin_ctz(ARM_HWCAP2_A64_ECV          )] = "ecv",
-    [__builtin_ctz(ARM_HWCAP2_A64_AFP          )] = "afp",
-    [__builtin_ctz(ARM_HWCAP2_A64_RPRES        )] = "rpres",
-    [__builtin_ctz(ARM_HWCAP2_A64_MTE3         )] = "mte3",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME          )] = "sme",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_I16I64   )] = "smei16i64",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_F64F64   )] = "smef64f64",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_I8I32    )] = "smei8i32",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_F16F32   )] = "smef16f32",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_B16F32   )] = "smeb16f32",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_F32F32   )] = "smef32f32",
-    [__builtin_ctz(ARM_HWCAP2_A64_SME_FA64     )] = "smefa64",
-    [__builtin_ctz(ARM_HWCAP2_A64_WFXT         )] = "wfxt",
-    [__builtin_ctzll(ARM_HWCAP2_A64_EBF16      )] = "ebf16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SVE_EBF16  )] = "sveebf16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_CSSC       )] = "cssc",
-    [__builtin_ctzll(ARM_HWCAP2_A64_RPRFM      )] = "rprfm",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SVE2P1     )] = "sve2p1",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME2       )] = "sme2",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME2P1     )] = "sme2p1",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_I16I32 )] = "smei16i32",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_BI32I32)] = "smebi32i32",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_B16B16 )] = "smeb16b16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F16F16 )] = "smef16f16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_MOPS       )] = "mops",
-    [__builtin_ctzll(ARM_HWCAP2_A64_HBC        )] = "hbc",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SVE_B16B16 )] = "sveb16b16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_LRCPC3     )] = "lrcpc3",
-    [__builtin_ctzll(ARM_HWCAP2_A64_LSE128     )] = "lse128",
-    [__builtin_ctzll(ARM_HWCAP2_A64_FPMR       )] = "fpmr",
-    [__builtin_ctzll(ARM_HWCAP2_A64_LUT        )] = "lut",
-    [__builtin_ctzll(ARM_HWCAP2_A64_FAMINMAX   )] = "faminmax",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8CVT      )] = "f8cvt",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8FMA      )] = "f8fma",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP4      )] = "f8dp4",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8DP2      )] = "f8dp2",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8E4M3     )] = "f8e4m3",
-    [__builtin_ctzll(ARM_HWCAP2_A64_F8E5M2     )] = "f8e5m2",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_LUTV2  )] = "smelutv2",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F16  )] = "smef8f16",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_F8F32  )] = "smef8f32",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP4 )] = "smesf8dp4",
-    [__builtin_ctzll(ARM_HWCAP2_A64_SME_SF8DP2 )] = "smesf8dp2",
-    [__builtin_ctzll(ARM_HWCAP2_A64_POE        )] = "poe",
-    };
-
-    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
-}
-
-#undef GET_FEATURE_ID
+#define ELF_HWCAP   get_elf_hwcap(thread_cpu)
+#define ELF_HWCAP2  get_elf_hwcap2(thread_cpu)
 
 #if TARGET_BIG_ENDIAN
 # define VDSO_HEADER  "vdso-be.c.inc"
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 457bb36daa..151a06f5db 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -101,16 +101,14 @@ extern unsigned long guest_stack_size;
 /* Note that Elf32 and Elf64 use uint32_t for e_flags. */
 const char *get_elf_cpu_model(uint32_t eflags);
 
-#if defined(TARGET_I386) || defined(TARGET_X86_64)
+#if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM)
 abi_ulong get_elf_hwcap(CPUState *cs);
+abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
-#if defined(TARGET_S390X) || defined(TARGET_AARCH64) || defined(TARGET_ARM)
+#if defined(TARGET_S390X)
 uint32_t get_elf_hwcap(void);
+#endif
 const char *elf_hwcap_str(uint32_t bit);
-#endif
-#if defined(TARGET_AARCH64) || defined(TARGET_ARM)
-uint64_t get_elf_hwcap2(void);
 const char *elf_hwcap2_str(uint32_t bit);
-#endif
 
 #endif /* LINUX_USER_LOADER_H */

From e0f62c5a5b5c80d0a6b163a8113e5938b0b40d54 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:03:12 -1000
Subject: [PATCH 0054/2396] linux-user: Move get_elf_hwcap to sparc/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 30 +-----------------------------
 linux-user/loader.h           |  3 ++-
 linux-user/sparc/elfload.c    | 27 +++++++++++++++++++++++++++
 linux-user/sparc/target_elf.h |  2 ++
 4 files changed, 32 insertions(+), 30 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 149d1313c0..16709865f7 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -565,35 +565,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 # define ELF_ARCH   EM_SPARCV9
 #endif
 
-#include "elf.h"
-
-#define ELF_HWCAP get_elf_hwcap()
-
-static uint32_t get_elf_hwcap(void)
-{
-    /* There are not many sparc32 hwcap bits -- we have all of them. */
-    uint32_t r = HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
-                 HWCAP_SPARC_SWAP | HWCAP_SPARC_MULDIV;
-
-#ifdef TARGET_SPARC64
-    CPUSPARCState *env = cpu_env(thread_cpu);
-    uint32_t features = env->def.features;
-
-    r |= HWCAP_SPARC_V9 | HWCAP_SPARC_V8PLUS;
-    /* 32x32 multiply and divide are efficient. */
-    r |= HWCAP_SPARC_MUL32 | HWCAP_SPARC_DIV32;
-    /* We don't have an internal feature bit for this. */
-    r |= HWCAP_SPARC_POPC;
-    r |= features & CPU_FEATURE_FSMULD ? HWCAP_SPARC_FSMULD : 0;
-    r |= features & CPU_FEATURE_VIS1 ? HWCAP_SPARC_VIS : 0;
-    r |= features & CPU_FEATURE_VIS2 ? HWCAP_SPARC_VIS2 : 0;
-    r |= features & CPU_FEATURE_FMAF ? HWCAP_SPARC_FMAF : 0;
-    r |= features & CPU_FEATURE_VIS3 ? HWCAP_SPARC_VIS3 : 0;
-    r |= features & CPU_FEATURE_IMA ? HWCAP_SPARC_IMA : 0;
-#endif
-
-    return r;
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 151a06f5db..2c8414e0e5 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -101,7 +101,8 @@ extern unsigned long guest_stack_size;
 /* Note that Elf32 and Elf64 use uint32_t for e_flags. */
 const char *get_elf_cpu_model(uint32_t eflags);
 
-#if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM)
+#if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
+    || defined(TARGET_SPARC)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
diff --git a/linux-user/sparc/elfload.c b/linux-user/sparc/elfload.c
index 243e6f9b66..32ca1b05b1 100644
--- a/linux-user/sparc/elfload.c
+++ b/linux-user/sparc/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -13,3 +14,29 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "Fujitsu MB86904";
 #endif
 }
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    /* There are not many sparc32 hwcap bits -- we have all of them. */
+    uint32_t r = HWCAP_SPARC_FLUSH | HWCAP_SPARC_STBAR |
+                 HWCAP_SPARC_SWAP | HWCAP_SPARC_MULDIV;
+
+#ifdef TARGET_SPARC64
+    CPUSPARCState *env = cpu_env(cs);
+    uint32_t features = env->def.features;
+
+    r |= HWCAP_SPARC_V9 | HWCAP_SPARC_V8PLUS;
+    /* 32x32 multiply and divide are efficient. */
+    r |= HWCAP_SPARC_MUL32 | HWCAP_SPARC_DIV32;
+    /* We don't have an internal feature bit for this. */
+    r |= HWCAP_SPARC_POPC;
+    r |= features & CPU_FEATURE_FSMULD ? HWCAP_SPARC_FSMULD : 0;
+    r |= features & CPU_FEATURE_VIS1 ? HWCAP_SPARC_VIS : 0;
+    r |= features & CPU_FEATURE_VIS2 ? HWCAP_SPARC_VIS2 : 0;
+    r |= features & CPU_FEATURE_FMAF ? HWCAP_SPARC_FMAF : 0;
+    r |= features & CPU_FEATURE_VIS3 ? HWCAP_SPARC_VIS3 : 0;
+    r |= features & CPU_FEATURE_IMA ? HWCAP_SPARC_IMA : 0;
+#endif
+
+    return r;
+}
diff --git a/linux-user/sparc/target_elf.h b/linux-user/sparc/target_elf.h
index 7e46748d26..b7544db0a1 100644
--- a/linux-user/sparc/target_elf.h
+++ b/linux-user/sparc/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef SPARC_TARGET_ELF_H
 #define SPARC_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From ea9d69159e013a5757e20bea0266b7c17303d961 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:12:54 -1000
Subject: [PATCH 0055/2396] linux-user: Move hwcap functions to ppc/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 116 +-----------------------------------
 linux-user/loader.h         |   2 +-
 linux-user/ppc/elfload.c    | 116 ++++++++++++++++++++++++++++++++++++
 linux-user/ppc/target_elf.h |   3 +
 4 files changed, 122 insertions(+), 115 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 16709865f7..843b1f7b6c 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -598,120 +598,8 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #define ELF_ARCH        EM_PPC
 
-/* Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP).
-   See arch/powerpc/include/asm/cputable.h.  */
-enum {
-    QEMU_PPC_FEATURE_32 = 0x80000000,
-    QEMU_PPC_FEATURE_64 = 0x40000000,
-    QEMU_PPC_FEATURE_601_INSTR = 0x20000000,
-    QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000,
-    QEMU_PPC_FEATURE_HAS_FPU = 0x08000000,
-    QEMU_PPC_FEATURE_HAS_MMU = 0x04000000,
-    QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000,
-    QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000,
-    QEMU_PPC_FEATURE_HAS_SPE = 0x00800000,
-    QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000,
-    QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000,
-    QEMU_PPC_FEATURE_NO_TB = 0x00100000,
-    QEMU_PPC_FEATURE_POWER4 = 0x00080000,
-    QEMU_PPC_FEATURE_POWER5 = 0x00040000,
-    QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000,
-    QEMU_PPC_FEATURE_CELL = 0x00010000,
-    QEMU_PPC_FEATURE_BOOKE = 0x00008000,
-    QEMU_PPC_FEATURE_SMT = 0x00004000,
-    QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000,
-    QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000,
-    QEMU_PPC_FEATURE_PA6T = 0x00000800,
-    QEMU_PPC_FEATURE_HAS_DFP = 0x00000400,
-    QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200,
-    QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100,
-    QEMU_PPC_FEATURE_HAS_VSX = 0x00000080,
-    QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040,
-
-    QEMU_PPC_FEATURE_TRUE_LE = 0x00000002,
-    QEMU_PPC_FEATURE_PPC_LE = 0x00000001,
-
-    /* Feature definitions in AT_HWCAP2.  */
-    QEMU_PPC_FEATURE2_ARCH_2_07 = 0x80000000, /* ISA 2.07 */
-    QEMU_PPC_FEATURE2_HAS_HTM = 0x40000000, /* Hardware Transactional Memory */
-    QEMU_PPC_FEATURE2_HAS_DSCR = 0x20000000, /* Data Stream Control Register */
-    QEMU_PPC_FEATURE2_HAS_EBB = 0x10000000, /* Event Base Branching */
-    QEMU_PPC_FEATURE2_HAS_ISEL = 0x08000000, /* Integer Select */
-    QEMU_PPC_FEATURE2_HAS_TAR = 0x04000000, /* Target Address Register */
-    QEMU_PPC_FEATURE2_VEC_CRYPTO = 0x02000000,
-    QEMU_PPC_FEATURE2_HTM_NOSC = 0x01000000,
-    QEMU_PPC_FEATURE2_ARCH_3_00 = 0x00800000, /* ISA 3.00 */
-    QEMU_PPC_FEATURE2_HAS_IEEE128 = 0x00400000, /* VSX IEEE Bin Float 128-bit */
-    QEMU_PPC_FEATURE2_DARN = 0x00200000, /* darn random number insn */
-    QEMU_PPC_FEATURE2_SCV = 0x00100000, /* scv syscall */
-    QEMU_PPC_FEATURE2_HTM_NO_SUSPEND = 0x00080000, /* TM w/o suspended state */
-    QEMU_PPC_FEATURE2_ARCH_3_1 = 0x00040000, /* ISA 3.1 */
-    QEMU_PPC_FEATURE2_MMA = 0x00020000, /* Matrix-Multiply Assist */
-};
-
-#define ELF_HWCAP get_elf_hwcap()
-
-static uint32_t get_elf_hwcap(void)
-{
-    PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
-    uint32_t features = 0;
-
-    /* We don't have to be terribly complete here; the high points are
-       Altivec/FP/SPE support.  Anything else is just a bonus.  */
-#define GET_FEATURE(flag, feature)                                      \
-    do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
-#define GET_FEATURE2(flags, feature) \
-    do { \
-        if ((cpu->env.insns_flags2 & flags) == flags) { \
-            features |= feature; \
-        } \
-    } while (0)
-    GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
-    GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
-    GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
-    GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE);
-    GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE);
-    GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE);
-    GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE);
-    GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC);
-    GET_FEATURE2(PPC2_DFP, QEMU_PPC_FEATURE_HAS_DFP);
-    GET_FEATURE2(PPC2_VSX, QEMU_PPC_FEATURE_HAS_VSX);
-    GET_FEATURE2((PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 | PPC2_ATOMIC_ISA206 |
-                  PPC2_FP_CVT_ISA206 | PPC2_FP_TST_ISA206),
-                  QEMU_PPC_FEATURE_ARCH_2_06);
-#undef GET_FEATURE
-#undef GET_FEATURE2
-
-    return features;
-}
-
-#define ELF_HWCAP2 get_elf_hwcap2()
-
-static uint32_t get_elf_hwcap2(void)
-{
-    PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);
-    uint32_t features = 0;
-
-#define GET_FEATURE(flag, feature)                                      \
-    do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
-#define GET_FEATURE2(flag, feature)                                      \
-    do { if (cpu->env.insns_flags2 & flag) { features |= feature; } } while (0)
-
-    GET_FEATURE(PPC_ISEL, QEMU_PPC_FEATURE2_HAS_ISEL);
-    GET_FEATURE2(PPC2_BCTAR_ISA207, QEMU_PPC_FEATURE2_HAS_TAR);
-    GET_FEATURE2((PPC2_BCTAR_ISA207 | PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
-                  PPC2_ISA207S), QEMU_PPC_FEATURE2_ARCH_2_07 |
-                  QEMU_PPC_FEATURE2_VEC_CRYPTO);
-    GET_FEATURE2(PPC2_ISA300, QEMU_PPC_FEATURE2_ARCH_3_00 |
-                 QEMU_PPC_FEATURE2_DARN | QEMU_PPC_FEATURE2_HAS_IEEE128);
-    GET_FEATURE2(PPC2_ISA310, QEMU_PPC_FEATURE2_ARCH_3_1 |
-                 QEMU_PPC_FEATURE2_MMA);
-
-#undef GET_FEATURE
-#undef GET_FEATURE2
-
-    return features;
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
+#define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
 
 /*
  * The requirements here are:
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 2c8414e0e5..818c5e6d7d 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -102,7 +102,7 @@ extern unsigned long guest_stack_size;
 const char *get_elf_cpu_model(uint32_t eflags);
 
 #if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
-    || defined(TARGET_SPARC)
+    || defined(TARGET_SPARC) || defined(TARGET_PPC)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
diff --git a/linux-user/ppc/elfload.c b/linux-user/ppc/elfload.c
index 7775dc06fa..a214675650 100644
--- a/linux-user/ppc/elfload.c
+++ b/linux-user/ppc/elfload.c
@@ -13,3 +13,119 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "750";
 #endif
 }
+
+/*
+ * Feature masks for the Aux Vector Hardware Capabilities (AT_HWCAP).
+ * See arch/powerpc/include/asm/cputable.h.
+ */
+enum {
+    QEMU_PPC_FEATURE_32 = 0x80000000,
+    QEMU_PPC_FEATURE_64 = 0x40000000,
+    QEMU_PPC_FEATURE_601_INSTR = 0x20000000,
+    QEMU_PPC_FEATURE_HAS_ALTIVEC = 0x10000000,
+    QEMU_PPC_FEATURE_HAS_FPU = 0x08000000,
+    QEMU_PPC_FEATURE_HAS_MMU = 0x04000000,
+    QEMU_PPC_FEATURE_HAS_4xxMAC = 0x02000000,
+    QEMU_PPC_FEATURE_UNIFIED_CACHE = 0x01000000,
+    QEMU_PPC_FEATURE_HAS_SPE = 0x00800000,
+    QEMU_PPC_FEATURE_HAS_EFP_SINGLE = 0x00400000,
+    QEMU_PPC_FEATURE_HAS_EFP_DOUBLE = 0x00200000,
+    QEMU_PPC_FEATURE_NO_TB = 0x00100000,
+    QEMU_PPC_FEATURE_POWER4 = 0x00080000,
+    QEMU_PPC_FEATURE_POWER5 = 0x00040000,
+    QEMU_PPC_FEATURE_POWER5_PLUS = 0x00020000,
+    QEMU_PPC_FEATURE_CELL = 0x00010000,
+    QEMU_PPC_FEATURE_BOOKE = 0x00008000,
+    QEMU_PPC_FEATURE_SMT = 0x00004000,
+    QEMU_PPC_FEATURE_ICACHE_SNOOP = 0x00002000,
+    QEMU_PPC_FEATURE_ARCH_2_05 = 0x00001000,
+    QEMU_PPC_FEATURE_PA6T = 0x00000800,
+    QEMU_PPC_FEATURE_HAS_DFP = 0x00000400,
+    QEMU_PPC_FEATURE_POWER6_EXT = 0x00000200,
+    QEMU_PPC_FEATURE_ARCH_2_06 = 0x00000100,
+    QEMU_PPC_FEATURE_HAS_VSX = 0x00000080,
+    QEMU_PPC_FEATURE_PSERIES_PERFMON_COMPAT = 0x00000040,
+
+    QEMU_PPC_FEATURE_TRUE_LE = 0x00000002,
+    QEMU_PPC_FEATURE_PPC_LE = 0x00000001,
+
+    /* Feature definitions in AT_HWCAP2.  */
+    QEMU_PPC_FEATURE2_ARCH_2_07 = 0x80000000, /* ISA 2.07 */
+    QEMU_PPC_FEATURE2_HAS_HTM = 0x40000000, /* Hardware Transactional Memory */
+    QEMU_PPC_FEATURE2_HAS_DSCR = 0x20000000, /* Data Stream Control Register */
+    QEMU_PPC_FEATURE2_HAS_EBB = 0x10000000, /* Event Base Branching */
+    QEMU_PPC_FEATURE2_HAS_ISEL = 0x08000000, /* Integer Select */
+    QEMU_PPC_FEATURE2_HAS_TAR = 0x04000000, /* Target Address Register */
+    QEMU_PPC_FEATURE2_VEC_CRYPTO = 0x02000000,
+    QEMU_PPC_FEATURE2_HTM_NOSC = 0x01000000,
+    QEMU_PPC_FEATURE2_ARCH_3_00 = 0x00800000, /* ISA 3.00 */
+    QEMU_PPC_FEATURE2_HAS_IEEE128 = 0x00400000, /* VSX IEEE Bin Float 128-bit */
+    QEMU_PPC_FEATURE2_DARN = 0x00200000, /* darn random number insn */
+    QEMU_PPC_FEATURE2_SCV = 0x00100000, /* scv syscall */
+    QEMU_PPC_FEATURE2_HTM_NO_SUSPEND = 0x00080000, /* TM w/o suspended state */
+    QEMU_PPC_FEATURE2_ARCH_3_1 = 0x00040000, /* ISA 3.1 */
+    QEMU_PPC_FEATURE2_MMA = 0x00020000, /* Matrix-Multiply Assist */
+};
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    uint32_t features = 0;
+
+    /*
+     * We don't have to be terribly complete here; the high points are
+     * Altivec/FP/SPE support.  Anything else is just a bonus.
+     */
+#define GET_FEATURE(flag, feature)                                      \
+    do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
+#define GET_FEATURE2(flags, feature) \
+    do { \
+        if ((cpu->env.insns_flags2 & flags) == flags) { \
+            features |= feature; \
+        } \
+    } while (0)
+    GET_FEATURE(PPC_64B, QEMU_PPC_FEATURE_64);
+    GET_FEATURE(PPC_FLOAT, QEMU_PPC_FEATURE_HAS_FPU);
+    GET_FEATURE(PPC_ALTIVEC, QEMU_PPC_FEATURE_HAS_ALTIVEC);
+    GET_FEATURE(PPC_SPE, QEMU_PPC_FEATURE_HAS_SPE);
+    GET_FEATURE(PPC_SPE_SINGLE, QEMU_PPC_FEATURE_HAS_EFP_SINGLE);
+    GET_FEATURE(PPC_SPE_DOUBLE, QEMU_PPC_FEATURE_HAS_EFP_DOUBLE);
+    GET_FEATURE(PPC_BOOKE, QEMU_PPC_FEATURE_BOOKE);
+    GET_FEATURE(PPC_405_MAC, QEMU_PPC_FEATURE_HAS_4xxMAC);
+    GET_FEATURE2(PPC2_DFP, QEMU_PPC_FEATURE_HAS_DFP);
+    GET_FEATURE2(PPC2_VSX, QEMU_PPC_FEATURE_HAS_VSX);
+    GET_FEATURE2((PPC2_PERM_ISA206 | PPC2_DIVE_ISA206 | PPC2_ATOMIC_ISA206 |
+                  PPC2_FP_CVT_ISA206 | PPC2_FP_TST_ISA206),
+                  QEMU_PPC_FEATURE_ARCH_2_06);
+
+#undef GET_FEATURE
+#undef GET_FEATURE2
+
+    return features;
+}
+
+abi_ulong get_elf_hwcap2(CPUState *cs)
+{
+    PowerPCCPU *cpu = POWERPC_CPU(cs);
+    uint32_t features = 0;
+
+#define GET_FEATURE(flag, feature)                                      \
+    do { if (cpu->env.insns_flags & flag) { features |= feature; } } while (0)
+#define GET_FEATURE2(flag, feature)                                      \
+    do { if (cpu->env.insns_flags2 & flag) { features |= feature; } } while (0)
+
+    GET_FEATURE(PPC_ISEL, QEMU_PPC_FEATURE2_HAS_ISEL);
+    GET_FEATURE2(PPC2_BCTAR_ISA207, QEMU_PPC_FEATURE2_HAS_TAR);
+    GET_FEATURE2((PPC2_BCTAR_ISA207 | PPC2_LSQ_ISA207 | PPC2_ALTIVEC_207 |
+                  PPC2_ISA207S), QEMU_PPC_FEATURE2_ARCH_2_07 |
+                  QEMU_PPC_FEATURE2_VEC_CRYPTO);
+    GET_FEATURE2(PPC2_ISA300, QEMU_PPC_FEATURE2_ARCH_3_00 |
+                 QEMU_PPC_FEATURE2_DARN | QEMU_PPC_FEATURE2_HAS_IEEE128);
+    GET_FEATURE2(PPC2_ISA310, QEMU_PPC_FEATURE2_ARCH_3_1 |
+                 QEMU_PPC_FEATURE2_MMA);
+
+#undef GET_FEATURE
+#undef GET_FEATURE2
+
+    return features;
+}
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 8c0a8ea431..4203a89d66 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -8,4 +8,7 @@
 #ifndef PPC_TARGET_ELF_H
 #define PPC_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_HWCAP2         1
+
 #endif

From 184e74b236df9ad42ddbf92011713259cd17caf1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:17:08 -1000
Subject: [PATCH 0056/2396] linux-user: Move get_elf_hwcap to
 loongarch64/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c                | 49 +----------------------------
 linux-user/loader.h                 |  3 +-
 linux-user/loongarch64/elfload.c    | 47 +++++++++++++++++++++++++++
 linux-user/loongarch64/target_elf.h |  2 ++
 4 files changed, 52 insertions(+), 49 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 843b1f7b6c..574b37a22c 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -725,54 +725,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_HWCAP get_elf_hwcap()
-
-/* See arch/loongarch/include/uapi/asm/hwcap.h */
-enum {
-    HWCAP_LOONGARCH_CPUCFG   = (1 << 0),
-    HWCAP_LOONGARCH_LAM      = (1 << 1),
-    HWCAP_LOONGARCH_UAL      = (1 << 2),
-    HWCAP_LOONGARCH_FPU      = (1 << 3),
-    HWCAP_LOONGARCH_LSX      = (1 << 4),
-    HWCAP_LOONGARCH_LASX     = (1 << 5),
-    HWCAP_LOONGARCH_CRC32    = (1 << 6),
-    HWCAP_LOONGARCH_COMPLEX  = (1 << 7),
-    HWCAP_LOONGARCH_CRYPTO   = (1 << 8),
-    HWCAP_LOONGARCH_LVZ      = (1 << 9),
-    HWCAP_LOONGARCH_LBT_X86  = (1 << 10),
-    HWCAP_LOONGARCH_LBT_ARM  = (1 << 11),
-    HWCAP_LOONGARCH_LBT_MIPS = (1 << 12),
-};
-
-static uint32_t get_elf_hwcap(void)
-{
-    LoongArchCPU *cpu = LOONGARCH_CPU(thread_cpu);
-    uint32_t hwcaps = 0;
-
-    hwcaps |= HWCAP_LOONGARCH_CRC32;
-
-    if (FIELD_EX32(cpu->env.cpucfg[1], CPUCFG1, UAL)) {
-        hwcaps |= HWCAP_LOONGARCH_UAL;
-    }
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, FP)) {
-        hwcaps |= HWCAP_LOONGARCH_FPU;
-    }
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LAM)) {
-        hwcaps |= HWCAP_LOONGARCH_LAM;
-    }
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
-        hwcaps |= HWCAP_LOONGARCH_LSX;
-    }
-
-    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LASX)) {
-        hwcaps |= HWCAP_LOONGARCH_LASX;
-    }
-
-    return hwcaps;
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 #define ELF_PLATFORM "loongarch"
 
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 818c5e6d7d..92b6d41145 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -102,7 +102,8 @@ extern unsigned long guest_stack_size;
 const char *get_elf_cpu_model(uint32_t eflags);
 
 #if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
-    || defined(TARGET_SPARC) || defined(TARGET_PPC)
+    || defined(TARGET_SPARC) || defined(TARGET_PPC) \
+    || defined(TARGET_LOONGARCH64)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
index 874dc4c230..ee4a85b8d6 100644
--- a/linux-user/loongarch64/elfload.c
+++ b/linux-user/loongarch64/elfload.c
@@ -9,3 +9,50 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "la464";
 }
+
+/* See arch/loongarch/include/uapi/asm/hwcap.h */
+enum {
+    HWCAP_LOONGARCH_CPUCFG   = (1 << 0),
+    HWCAP_LOONGARCH_LAM      = (1 << 1),
+    HWCAP_LOONGARCH_UAL      = (1 << 2),
+    HWCAP_LOONGARCH_FPU      = (1 << 3),
+    HWCAP_LOONGARCH_LSX      = (1 << 4),
+    HWCAP_LOONGARCH_LASX     = (1 << 5),
+    HWCAP_LOONGARCH_CRC32    = (1 << 6),
+    HWCAP_LOONGARCH_COMPLEX  = (1 << 7),
+    HWCAP_LOONGARCH_CRYPTO   = (1 << 8),
+    HWCAP_LOONGARCH_LVZ      = (1 << 9),
+    HWCAP_LOONGARCH_LBT_X86  = (1 << 10),
+    HWCAP_LOONGARCH_LBT_ARM  = (1 << 11),
+    HWCAP_LOONGARCH_LBT_MIPS = (1 << 12),
+};
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    hwcaps |= HWCAP_LOONGARCH_CRC32;
+
+    if (FIELD_EX32(cpu->env.cpucfg[1], CPUCFG1, UAL)) {
+        hwcaps |= HWCAP_LOONGARCH_UAL;
+    }
+
+    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, FP)) {
+        hwcaps |= HWCAP_LOONGARCH_FPU;
+    }
+
+    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LAM)) {
+        hwcaps |= HWCAP_LOONGARCH_LAM;
+    }
+
+    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LSX)) {
+        hwcaps |= HWCAP_LOONGARCH_LSX;
+    }
+
+    if (FIELD_EX32(cpu->env.cpucfg[2], CPUCFG2, LASX)) {
+        hwcaps |= HWCAP_LOONGARCH_LASX;
+    }
+
+    return hwcaps;
+}
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 39a08d35d9..037740d36f 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -6,4 +6,6 @@
 #ifndef LOONGARCH_TARGET_ELF_H
 #define LOONGARCH_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From 48004ab0586ba01387efc37e7ada26607a1c183e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:23:05 -1000
Subject: [PATCH 0057/2396] linux-user: Move get_elf_hwcap to mips/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 52 +---------------------------------
 linux-user/loader.h            |  2 +-
 linux-user/mips/elfload.c      | 50 ++++++++++++++++++++++++++++++++
 linux-user/mips/target_elf.h   |  2 ++
 linux-user/mips64/target_elf.h |  2 ++
 5 files changed, 56 insertions(+), 52 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 574b37a22c..dc3f502277 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -834,57 +834,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *e
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-/* See arch/mips/include/uapi/asm/hwcap.h.  */
-enum {
-    HWCAP_MIPS_R6           = (1 << 0),
-    HWCAP_MIPS_MSA          = (1 << 1),
-    HWCAP_MIPS_CRC32        = (1 << 2),
-    HWCAP_MIPS_MIPS16       = (1 << 3),
-    HWCAP_MIPS_MDMX         = (1 << 4),
-    HWCAP_MIPS_MIPS3D       = (1 << 5),
-    HWCAP_MIPS_SMARTMIPS    = (1 << 6),
-    HWCAP_MIPS_DSP          = (1 << 7),
-    HWCAP_MIPS_DSP2         = (1 << 8),
-    HWCAP_MIPS_DSP3         = (1 << 9),
-    HWCAP_MIPS_MIPS16E2     = (1 << 10),
-    HWCAP_LOONGSON_MMI      = (1 << 11),
-    HWCAP_LOONGSON_EXT      = (1 << 12),
-    HWCAP_LOONGSON_EXT2     = (1 << 13),
-    HWCAP_LOONGSON_CPUCFG   = (1 << 14),
-};
-
-#define ELF_HWCAP get_elf_hwcap()
-
-#define GET_FEATURE_INSN(_flag, _hwcap) \
-    do { if (cpu->env.insn_flags & (_flag)) { hwcaps |= _hwcap; } } while (0)
-
-#define GET_FEATURE_REG_SET(_reg, _mask, _hwcap) \
-    do { if (cpu->env._reg & (_mask)) { hwcaps |= _hwcap; } } while (0)
-
-#define GET_FEATURE_REG_EQU(_reg, _start, _length, _val, _hwcap) \
-    do { \
-        if (extract32(cpu->env._reg, (_start), (_length)) == (_val)) { \
-            hwcaps |= _hwcap; \
-        } \
-    } while (0)
-
-static uint32_t get_elf_hwcap(void)
-{
-    MIPSCPU *cpu = MIPS_CPU(thread_cpu);
-    uint32_t hwcaps = 0;
-
-    GET_FEATURE_REG_EQU(CP0_Config0, CP0C0_AR, CP0C0_AR_LENGTH,
-                        2, HWCAP_MIPS_R6);
-    GET_FEATURE_REG_SET(CP0_Config3, 1 << CP0C3_MSAP, HWCAP_MIPS_MSA);
-    GET_FEATURE_INSN(ASE_LMMI, HWCAP_LOONGSON_MMI);
-    GET_FEATURE_INSN(ASE_LEXT, HWCAP_LOONGSON_EXT);
-
-    return hwcaps;
-}
-
-#undef GET_FEATURE_REG_EQU
-#undef GET_FEATURE_REG_SET
-#undef GET_FEATURE_INSN
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 #endif /* TARGET_MIPS */
 
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 92b6d41145..04457737dd 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -103,7 +103,7 @@ const char *get_elf_cpu_model(uint32_t eflags);
 
 #if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
     || defined(TARGET_SPARC) || defined(TARGET_PPC) \
-    || defined(TARGET_LOONGARCH64)
+    || defined(TARGET_LOONGARCH64) || defined(TARGET_MIPS)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index 04e3b76740..739f71c21b 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -42,3 +42,53 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "24Kf";
 #endif
 }
+
+/* See arch/mips/include/uapi/asm/hwcap.h.  */
+enum {
+    HWCAP_MIPS_R6           = (1 << 0),
+    HWCAP_MIPS_MSA          = (1 << 1),
+    HWCAP_MIPS_CRC32        = (1 << 2),
+    HWCAP_MIPS_MIPS16       = (1 << 3),
+    HWCAP_MIPS_MDMX         = (1 << 4),
+    HWCAP_MIPS_MIPS3D       = (1 << 5),
+    HWCAP_MIPS_SMARTMIPS    = (1 << 6),
+    HWCAP_MIPS_DSP          = (1 << 7),
+    HWCAP_MIPS_DSP2         = (1 << 8),
+    HWCAP_MIPS_DSP3         = (1 << 9),
+    HWCAP_MIPS_MIPS16E2     = (1 << 10),
+    HWCAP_LOONGSON_MMI      = (1 << 11),
+    HWCAP_LOONGSON_EXT      = (1 << 12),
+    HWCAP_LOONGSON_EXT2     = (1 << 13),
+    HWCAP_LOONGSON_CPUCFG   = (1 << 14),
+};
+
+#define GET_FEATURE_INSN(_flag, _hwcap) \
+    do { if (cpu->env.insn_flags & (_flag)) { hwcaps |= _hwcap; } } while (0)
+
+#define GET_FEATURE_REG_SET(_reg, _mask, _hwcap) \
+    do { if (cpu->env._reg & (_mask)) { hwcaps |= _hwcap; } } while (0)
+
+#define GET_FEATURE_REG_EQU(_reg, _start, _length, _val, _hwcap) \
+    do { \
+        if (extract32(cpu->env._reg, (_start), (_length)) == (_val)) { \
+            hwcaps |= _hwcap; \
+        } \
+    } while (0)
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+    abi_ulong hwcaps = 0;
+
+    GET_FEATURE_REG_EQU(CP0_Config0, CP0C0_AR, CP0C0_AR_LENGTH,
+                        2, HWCAP_MIPS_R6);
+    GET_FEATURE_REG_SET(CP0_Config3, 1 << CP0C3_MSAP, HWCAP_MIPS_MSA);
+    GET_FEATURE_INSN(ASE_LMMI, HWCAP_LOONGSON_MMI);
+    GET_FEATURE_INSN(ASE_LEXT, HWCAP_LOONGSON_EXT);
+
+    return hwcaps;
+}
+
+#undef GET_FEATURE_REG_EQU
+#undef GET_FEATURE_REG_SET
+#undef GET_FEATURE_INSN
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index febf710c7a..877f8347d7 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef MIPS_TARGET_ELF_H
 #define MIPS_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 02e6d14840..c0347e5cb6 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef MIPS64_TARGET_ELF_H
 #define MIPS64_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From 92c9983c06fa0a55f120c71dda03e38d5220fccc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:28:05 -1000
Subject: [PATCH 0058/2396] linux-user: Move get_elf_hwcap to sh4/elfload.c

Change the return type to abi_ulong, and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 29 +----------------------------
 linux-user/loader.h         |  3 ++-
 linux-user/sh4/elfload.c    | 27 +++++++++++++++++++++++++++
 linux-user/sh4/target_elf.h |  2 ++
 4 files changed, 32 insertions(+), 29 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index dc3f502277..7e1c11c39f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -963,34 +963,7 @@ static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-enum {
-    SH_CPU_HAS_FPU            = 0x0001, /* Hardware FPU support */
-    SH_CPU_HAS_P2_FLUSH_BUG   = 0x0002, /* Need to flush the cache in P2 area */
-    SH_CPU_HAS_MMU_PAGE_ASSOC = 0x0004, /* SH3: TLB way selection bit support */
-    SH_CPU_HAS_DSP            = 0x0008, /* SH-DSP: DSP support */
-    SH_CPU_HAS_PERF_COUNTER   = 0x0010, /* Hardware performance counters */
-    SH_CPU_HAS_PTEA           = 0x0020, /* PTEA register */
-    SH_CPU_HAS_LLSC           = 0x0040, /* movli.l/movco.l */
-    SH_CPU_HAS_L2_CACHE       = 0x0080, /* Secondary cache / URAM */
-    SH_CPU_HAS_OP32           = 0x0100, /* 32-bit instruction support */
-    SH_CPU_HAS_PTEAEX         = 0x0200, /* PTE ASID Extension support */
-};
-
-#define ELF_HWCAP get_elf_hwcap()
-
-static uint32_t get_elf_hwcap(void)
-{
-    SuperHCPU *cpu = SUPERH_CPU(thread_cpu);
-    uint32_t hwcap = 0;
-
-    hwcap |= SH_CPU_HAS_FPU;
-
-    if (cpu->env.features & SH_FEATURE_SH4A) {
-        hwcap |= SH_CPU_HAS_LLSC;
-    }
-
-    return hwcap;
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 #endif
 
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 04457737dd..d8a9399807 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -103,7 +103,8 @@ const char *get_elf_cpu_model(uint32_t eflags);
 
 #if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
     || defined(TARGET_SPARC) || defined(TARGET_PPC) \
-    || defined(TARGET_LOONGARCH64) || defined(TARGET_MIPS)
+    || defined(TARGET_LOONGARCH64) || defined(TARGET_MIPS) \
+    || defined(TARGET_SH4)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
index 546034ec07..99ad4f6334 100644
--- a/linux-user/sh4/elfload.c
+++ b/linux-user/sh4/elfload.c
@@ -9,3 +9,30 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "sh7785";
 }
+
+enum {
+    SH_CPU_HAS_FPU            = 0x0001, /* Hardware FPU support */
+    SH_CPU_HAS_P2_FLUSH_BUG   = 0x0002, /* Need to flush the cache in P2 area */
+    SH_CPU_HAS_MMU_PAGE_ASSOC = 0x0004, /* SH3: TLB way selection bit support */
+    SH_CPU_HAS_DSP            = 0x0008, /* SH-DSP: DSP support */
+    SH_CPU_HAS_PERF_COUNTER   = 0x0010, /* Hardware performance counters */
+    SH_CPU_HAS_PTEA           = 0x0020, /* PTEA register */
+    SH_CPU_HAS_LLSC           = 0x0040, /* movli.l/movco.l */
+    SH_CPU_HAS_L2_CACHE       = 0x0080, /* Secondary cache / URAM */
+    SH_CPU_HAS_OP32           = 0x0100, /* 32-bit instruction support */
+    SH_CPU_HAS_PTEAEX         = 0x0200, /* PTE ASID Extension support */
+};
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    SuperHCPU *cpu = SUPERH_CPU(cs);
+    abi_ulong hwcap = 0;
+
+    hwcap |= SH_CPU_HAS_FPU;
+
+    if (cpu->env.features & SH_FEATURE_SH4A) {
+        hwcap |= SH_CPU_HAS_LLSC;
+    }
+
+    return hwcap;
+}
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index d17011bd75..badd0f5371 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef SH4_TARGET_ELF_H
 #define SH4_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From 1d4774b60e3dfdc9295e36c5fa298b457d10db10 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:39:23 -1000
Subject: [PATCH 0059/2396] linux-user: Move hwcap functions to s390x/elfload.c

For get_elf_hwcap, change the return type to abi_ulong
and pass in the cpu.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 60 +---------------------------------
 linux-user/loader.h            |  5 +--
 linux-user/s390x/elfload.c     | 57 ++++++++++++++++++++++++++++++++
 linux-user/s390x/target_elf.h  |  2 ++
 linux-user/s390x/target_proc.h |  2 +-
 5 files changed, 62 insertions(+), 64 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 7e1c11c39f..ba8593368d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1039,65 +1039,7 @@ static inline void init_thread(struct target_pt_regs *regs,
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-#include "elf.h"
-
-#define ELF_HWCAP get_elf_hwcap()
-
-#define GET_FEATURE(_feat, _hwcap) \
-    do { if (s390_has_feat(_feat)) { hwcap |= _hwcap; } } while (0)
-
-uint32_t get_elf_hwcap(void)
-{
-    /*
-     * Let's assume we always have esan3 and zarch.
-     * 31-bit processes can use 64-bit registers (high gprs).
-     */
-    uint32_t hwcap = HWCAP_S390_ESAN3 | HWCAP_S390_ZARCH | HWCAP_S390_HIGH_GPRS;
-
-    GET_FEATURE(S390_FEAT_STFLE, HWCAP_S390_STFLE);
-    GET_FEATURE(S390_FEAT_MSA, HWCAP_S390_MSA);
-    GET_FEATURE(S390_FEAT_LONG_DISPLACEMENT, HWCAP_S390_LDISP);
-    GET_FEATURE(S390_FEAT_EXTENDED_IMMEDIATE, HWCAP_S390_EIMM);
-    if (s390_has_feat(S390_FEAT_EXTENDED_TRANSLATION_3) &&
-        s390_has_feat(S390_FEAT_ETF3_ENH)) {
-        hwcap |= HWCAP_S390_ETF3EH;
-    }
-    GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
-    GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
-    GET_FEATURE(S390_FEAT_VECTOR_ENH2, HWCAP_S390_VXRS_EXT2);
-
-    return hwcap;
-}
-
-const char *elf_hwcap_str(uint32_t bit)
-{
-    static const char *hwcap_str[] = {
-        [HWCAP_S390_NR_ESAN3]     = "esan3",
-        [HWCAP_S390_NR_ZARCH]     = "zarch",
-        [HWCAP_S390_NR_STFLE]     = "stfle",
-        [HWCAP_S390_NR_MSA]       = "msa",
-        [HWCAP_S390_NR_LDISP]     = "ldisp",
-        [HWCAP_S390_NR_EIMM]      = "eimm",
-        [HWCAP_S390_NR_DFP]       = "dfp",
-        [HWCAP_S390_NR_HPAGE]     = "edat",
-        [HWCAP_S390_NR_ETF3EH]    = "etf3eh",
-        [HWCAP_S390_NR_HIGH_GPRS] = "highgprs",
-        [HWCAP_S390_NR_TE]        = "te",
-        [HWCAP_S390_NR_VXRS]      = "vx",
-        [HWCAP_S390_NR_VXRS_BCD]  = "vxd",
-        [HWCAP_S390_NR_VXRS_EXT]  = "vxe",
-        [HWCAP_S390_NR_GS]        = "gs",
-        [HWCAP_S390_NR_VXRS_EXT2] = "vxe2",
-        [HWCAP_S390_NR_VXRS_PDE]  = "vxp",
-        [HWCAP_S390_NR_SORT]      = "sort",
-        [HWCAP_S390_NR_DFLT]      = "dflt",
-        [HWCAP_S390_NR_NNPA]      = "nnpa",
-        [HWCAP_S390_NR_PCI_MIO]   = "pcimio",
-        [HWCAP_S390_NR_SIE]       = "sie",
-    };
-
-    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
diff --git a/linux-user/loader.h b/linux-user/loader.h
index d8a9399807..c14e69f551 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -104,13 +104,10 @@ const char *get_elf_cpu_model(uint32_t eflags);
 #if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
     || defined(TARGET_SPARC) || defined(TARGET_PPC) \
     || defined(TARGET_LOONGARCH64) || defined(TARGET_MIPS) \
-    || defined(TARGET_SH4)
+    || defined(TARGET_SH4) || defined(TARGET_S390X)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 #endif
-#if defined(TARGET_S390X)
-uint32_t get_elf_hwcap(void);
-#endif
 const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 
diff --git a/linux-user/s390x/elfload.c b/linux-user/s390x/elfload.c
index 989953a247..79ceaba51d 100644
--- a/linux-user/s390x/elfload.c
+++ b/linux-user/s390x/elfload.c
@@ -3,9 +3,66 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "qemu";
 }
+
+#define GET_FEATURE(_feat, _hwcap) \
+    do { if (s390_has_feat(_feat)) { hwcap |= _hwcap; } } while (0)
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+    /*
+     * Let's assume we always have esan3 and zarch.
+     * 31-bit processes can use 64-bit registers (high gprs).
+     */
+    uint32_t hwcap = HWCAP_S390_ESAN3 | HWCAP_S390_ZARCH | HWCAP_S390_HIGH_GPRS;
+
+    GET_FEATURE(S390_FEAT_STFLE, HWCAP_S390_STFLE);
+    GET_FEATURE(S390_FEAT_MSA, HWCAP_S390_MSA);
+    GET_FEATURE(S390_FEAT_LONG_DISPLACEMENT, HWCAP_S390_LDISP);
+    GET_FEATURE(S390_FEAT_EXTENDED_IMMEDIATE, HWCAP_S390_EIMM);
+    if (s390_has_feat(S390_FEAT_EXTENDED_TRANSLATION_3) &&
+        s390_has_feat(S390_FEAT_ETF3_ENH)) {
+        hwcap |= HWCAP_S390_ETF3EH;
+    }
+    GET_FEATURE(S390_FEAT_VECTOR, HWCAP_S390_VXRS);
+    GET_FEATURE(S390_FEAT_VECTOR_ENH, HWCAP_S390_VXRS_EXT);
+    GET_FEATURE(S390_FEAT_VECTOR_ENH2, HWCAP_S390_VXRS_EXT2);
+
+    return hwcap;
+}
+
+const char *elf_hwcap_str(uint32_t bit)
+{
+    static const char *hwcap_str[] = {
+        [HWCAP_S390_NR_ESAN3]     = "esan3",
+        [HWCAP_S390_NR_ZARCH]     = "zarch",
+        [HWCAP_S390_NR_STFLE]     = "stfle",
+        [HWCAP_S390_NR_MSA]       = "msa",
+        [HWCAP_S390_NR_LDISP]     = "ldisp",
+        [HWCAP_S390_NR_EIMM]      = "eimm",
+        [HWCAP_S390_NR_DFP]       = "dfp",
+        [HWCAP_S390_NR_HPAGE]     = "edat",
+        [HWCAP_S390_NR_ETF3EH]    = "etf3eh",
+        [HWCAP_S390_NR_HIGH_GPRS] = "highgprs",
+        [HWCAP_S390_NR_TE]        = "te",
+        [HWCAP_S390_NR_VXRS]      = "vx",
+        [HWCAP_S390_NR_VXRS_BCD]  = "vxd",
+        [HWCAP_S390_NR_VXRS_EXT]  = "vxe",
+        [HWCAP_S390_NR_GS]        = "gs",
+        [HWCAP_S390_NR_VXRS_EXT2] = "vxe2",
+        [HWCAP_S390_NR_VXRS_PDE]  = "vxp",
+        [HWCAP_S390_NR_SORT]      = "sort",
+        [HWCAP_S390_NR_DFLT]      = "dflt",
+        [HWCAP_S390_NR_NNPA]      = "nnpa",
+        [HWCAP_S390_NR_PCI_MIO]   = "pcimio",
+        [HWCAP_S390_NR_SIE]       = "sie",
+    };
+
+    return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
+}
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index e51b053339..cebace949a 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef S390X_TARGET_ELF_H
 #define S390X_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif
diff --git a/linux-user/s390x/target_proc.h b/linux-user/s390x/target_proc.h
index a4a4821ea5..60cc22d3b4 100644
--- a/linux-user/s390x/target_proc.h
+++ b/linux-user/s390x/target_proc.h
@@ -48,7 +48,7 @@ static void show_cpu_summary(CPUArchState *cpu_env, int fd)
 {
     S390CPUModel *model = env_archcpu(cpu_env)->model;
     int num_cpus = sysconf(_SC_NPROCESSORS_ONLN);
-    uint32_t elf_hwcap = get_elf_hwcap();
+    uint32_t elf_hwcap = get_elf_hwcap(env_cpu(cpu_env));
     const char *hwcap_str;
     int i;
 

From 50e59ad0b7b1c71e858939504a749bf1a1313e2e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 27 Jul 2025 21:44:02 -1000
Subject: [PATCH 0060/2396] linux-user: Move get_elf_hwcap to riscv/elfload.c

Change the return type to abi_ulong, and pass in the cpu.
As this is the last instance of get_elf_hwcap to be converted,
remove the ifdef around the declaration in loader.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 14 +-------------
 linux-user/loader.h           |  5 -----
 linux-user/riscv/elfload.c    | 12 ++++++++++++
 linux-user/riscv/target_elf.h |  2 ++
 4 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ba8593368d..ce4055b0e9 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1099,19 +1099,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define VDSO_HEADER "vdso-64.c.inc"
 #endif
 
-#define ELF_HWCAP get_elf_hwcap()
-
-static uint32_t get_elf_hwcap(void)
-{
-#define MISA_BIT(EXT) (1 << (EXT - 'A'))
-    RISCVCPU *cpu = RISCV_CPU(thread_cpu);
-    uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
-                    | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C')
-                    | MISA_BIT('V');
-
-    return cpu->env.misa_ext & mask;
-#undef MISA_BIT
-}
+#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
diff --git a/linux-user/loader.h b/linux-user/loader.h
index c14e69f551..729723cc06 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -101,13 +101,8 @@ extern unsigned long guest_stack_size;
 /* Note that Elf32 and Elf64 use uint32_t for e_flags. */
 const char *get_elf_cpu_model(uint32_t eflags);
 
-#if defined(TARGET_I386) || defined(TARGET_X86_64) || defined(TARGET_ARM) \
-    || defined(TARGET_SPARC) || defined(TARGET_PPC) \
-    || defined(TARGET_LOONGARCH64) || defined(TARGET_MIPS) \
-    || defined(TARGET_SH4) || defined(TARGET_S390X)
 abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
-#endif
 const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 
diff --git a/linux-user/riscv/elfload.c b/linux-user/riscv/elfload.c
index f92adb7308..2e7d622232 100644
--- a/linux-user/riscv/elfload.c
+++ b/linux-user/riscv/elfload.c
@@ -9,3 +9,15 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "max";
 }
+
+abi_ulong get_elf_hwcap(CPUState *cs)
+{
+#define MISA_BIT(EXT) (1 << (EXT - 'A'))
+    RISCVCPU *cpu = RISCV_CPU(cs);
+    uint32_t mask = MISA_BIT('I') | MISA_BIT('M') | MISA_BIT('A')
+                    | MISA_BIT('F') | MISA_BIT('D') | MISA_BIT('C')
+                    | MISA_BIT('V');
+
+    return cpu->env.misa_ext & mask;
+#undef MISA_BIT
+}
diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h
index bfe86105d0..48d9af557b 100644
--- a/linux-user/riscv/target_elf.h
+++ b/linux-user/riscv/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef RISCV_TARGET_ELF_H
 #define RISCV_TARGET_ELF_H
 
+#define HAVE_ELF_HWCAP          1
+
 #endif

From 0dbb0ba870a11366b061905b1a06baa973b642d6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 2 Aug 2025 09:05:41 +1000
Subject: [PATCH 0061/2396] linux-user: Remove ELF_HWCAP

All real definitions of ELF_HWCAP are now identical, and the stub
definitions are 0.  Provide zero stub as a fallback definition.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 35 ++++++++++++-----------------------
 1 file changed, 12 insertions(+), 23 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ce4055b0e9..88d439f348 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -28,6 +28,7 @@
 #include "qemu/lockable.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
+#include "target_elf.h"
 #include "target_signal.h"
 #include "tcg/debuginfo.h"
 
@@ -148,8 +149,6 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
@@ -449,7 +448,6 @@ static bool init_guest_commpage(void)
     return true;
 }
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 #define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
 
 #define ELF_PLATFORM get_elf_platform()
@@ -539,7 +537,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
-#define ELF_HWCAP   get_elf_hwcap(thread_cpu)
 #define ELF_HWCAP2  get_elf_hwcap2(thread_cpu)
 
 #if TARGET_BIG_ENDIAN
@@ -565,8 +562,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 # define ELF_ARCH   EM_SPARCV9
 #endif
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
 {
@@ -598,7 +593,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #define ELF_ARCH        EM_PPC
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
 #define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
 
 /*
@@ -725,8 +719,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 #define ELF_PLATFORM "loongarch"
 
 #endif /* TARGET_LOONGARCH64 */
@@ -834,8 +826,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *e
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 #endif /* TARGET_MIPS */
 
 #ifdef TARGET_MICROBLAZE
@@ -909,7 +899,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
     (*regs)[32] = tswapreg(env->pc);
     (*regs)[33] = tswapreg(cpu_get_sr(env));
 }
-#define ELF_HWCAP 0
+
 #define ELF_PLATFORM NULL
 
 #endif /* TARGET_OPENRISC */
@@ -963,8 +953,6 @@ static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 #endif
 
 #ifdef TARGET_M68K
@@ -1039,8 +1027,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
     regs->psw.addr = infop->entry;
@@ -1099,8 +1085,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define VDSO_HEADER "vdso-64.c.inc"
 #endif
 
-#define ELF_HWCAP get_elf_hwcap(thread_cpu)
-
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
 {
@@ -1268,10 +1252,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 #define elf_check_abi(x) (1)
 #endif
 
-#ifndef ELF_HWCAP
-#define ELF_HWCAP 0
-#endif
-
 #ifndef STACK_GROWS_DOWN
 #define STACK_GROWS_DOWN 1
 #endif
@@ -1291,6 +1271,15 @@ static inline void init_thread(struct target_pt_regs *regs,
 #define EXSTACK_DEFAULT false
 #endif
 
+/*
+ * Provide fallback definitions that the target may omit.
+ * One way or another, we'll get a link error if the setting of
+ * HAVE_* doesn't match the implementation.
+ */
+#ifndef HAVE_ELF_HWCAP
+abi_ulong get_elf_hwcap(CPUState *cs) { return 0; }
+#endif
+
 #include "elf.h"
 
 /* We must delay the following stanzas until after "elf.h". */
@@ -1868,7 +1857,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     NEW_AUX_ENT(AT_EUID, (abi_ulong) geteuid());
     NEW_AUX_ENT(AT_GID, (abi_ulong) getgid());
     NEW_AUX_ENT(AT_EGID, (abi_ulong) getegid());
-    NEW_AUX_ENT(AT_HWCAP, (abi_ulong) ELF_HWCAP);
+    NEW_AUX_ENT(AT_HWCAP, get_elf_hwcap(thread_cpu));
     NEW_AUX_ENT(AT_CLKTCK, (abi_ulong) sysconf(_SC_CLK_TCK));
     NEW_AUX_ENT(AT_RANDOM, (abi_ulong) u_rand_bytes);
     NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));

From fcac98d0ba8b5f4c311c1059d897d74d1276af9d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 2 Aug 2025 09:13:23 +1000
Subject: [PATCH 0062/2396] linux-user: Remove ELF_HWCAP2

All definitions of ELF_HWCAP2 are now identical.  Provide a
not-reached stub as a fallback definition of get_elf_hwcap2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 23 ++++++++++-------------
 1 file changed, 10 insertions(+), 13 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 88d439f348..7a41917b49 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -448,8 +448,6 @@ static bool init_guest_commpage(void)
     return true;
 }
 
-#define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
-
 #define ELF_PLATFORM get_elf_platform()
 
 static const char *get_elf_platform(void)
@@ -537,8 +535,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
-#define ELF_HWCAP2  get_elf_hwcap2(thread_cpu)
-
 #if TARGET_BIG_ENDIAN
 # define VDSO_HEADER  "vdso-be.c.inc"
 #else
@@ -593,8 +589,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #define ELF_ARCH        EM_PPC
 
-#define ELF_HWCAP2 get_elf_hwcap2(thread_cpu)
-
 /*
  * The requirements here are:
  * - keep the final alignment of sp (sp & 0xf)
@@ -1279,6 +1273,10 @@ static inline void init_thread(struct target_pt_regs *regs,
 #ifndef HAVE_ELF_HWCAP
 abi_ulong get_elf_hwcap(CPUState *cs) { return 0; }
 #endif
+#ifndef HAVE_ELF_HWCAP2
+abi_ulong get_elf_hwcap2(CPUState *cs) { g_assert_not_reached(); }
+#define HAVE_ELF_HWCAP2 0
+#endif
 
 #include "elf.h"
 
@@ -1801,9 +1799,9 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #ifdef DLINFO_ARCH_ITEMS
     size += DLINFO_ARCH_ITEMS * 2;
 #endif
-#ifdef ELF_HWCAP2
-    size += 2;
-#endif
+    if (HAVE_ELF_HWCAP2) {
+        size += 2;
+    }
     info->auxv_len = size * n;
 
     size += envc + argc + 2;
@@ -1863,10 +1861,9 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     NEW_AUX_ENT(AT_SECURE, (abi_ulong) qemu_getauxval(AT_SECURE));
     NEW_AUX_ENT(AT_EXECFN, info->file_string);
 
-#ifdef ELF_HWCAP2
-    NEW_AUX_ENT(AT_HWCAP2, (abi_ulong) ELF_HWCAP2);
-#endif
-
+    if (HAVE_ELF_HWCAP2) {
+        NEW_AUX_ENT(AT_HWCAP2, get_elf_hwcap(thread_cpu));
+    }
     if (u_base_platform) {
         NEW_AUX_ENT(AT_BASE_PLATFORM, u_base_platform);
     }

From 3c907dec45b66fff084fbddf18ee5bb84ddc5314 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 08:41:43 -1000
Subject: [PATCH 0063/2396] linux-user: Move get_elf_platform to
 {i386,x86_64}/elfload.c

Move get_elf_platform to i386/elfload.c; pass in CPUState.
Create a simple get_elf_platform for x86_64.
Introduce HAVE_ELF_PLATFORM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 18 ++----------------
 linux-user/i386/elfload.c      | 13 +++++++++++++
 linux-user/i386/target_elf.h   |  1 +
 linux-user/loader.h            |  3 +++
 linux-user/x86_64/elfload.c    |  5 +++++
 linux-user/x86_64/target_elf.h |  1 +
 6 files changed, 25 insertions(+), 16 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 7a41917b49..e6e509c0a6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -149,12 +149,12 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
+#define ELF_PLATFORM get_elf_platform(thread_cpu)
+
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
 
-#define ELF_PLATFORM   "x86_64"
-
 static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
 {
     regs->rax = 0;
@@ -237,22 +237,8 @@ static bool init_guest_commpage(void)
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_386
 
-#define ELF_PLATFORM get_elf_platform()
 #define EXSTACK_DEFAULT true
 
-static const char *get_elf_platform(void)
-{
-    static char elf_platform[] = "i386";
-    int family = object_property_get_int(OBJECT(thread_cpu), "family", NULL);
-    if (family > 6) {
-        family = 6;
-    }
-    if (family >= 3) {
-        elf_platform[1] = '0' + family;
-    }
-    return elf_platform;
-}
-
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
 {
diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index f99336e73c..1b759098ca 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -14,3 +14,16 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 {
     return cpu_env(cs)->features[FEAT_1_EDX];
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    static char elf_platform[] = "i386";
+    int family = object_property_get_int(OBJECT(cs), "family", NULL);
+    if (family > 6) {
+        family = 6;
+    }
+    if (family >= 3) {
+        elf_platform[1] = '0' + family;
+    }
+    return elf_platform;
+}
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index 802395af3a..44dde1ac4a 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -9,5 +9,6 @@
 #define I386_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_PLATFORM       1
 
 #endif
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 729723cc06..44bb4cbfd3 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -105,5 +105,8 @@ abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
+#if defined(TARGET_I386)
+const char *get_elf_platform(CPUState *cs);
+#endif
 
 #endif /* LINUX_USER_LOADER_H */
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index f99336e73c..88541ea45e 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -14,3 +14,8 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 {
     return cpu_env(cs)->features[FEAT_1_EDX];
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    return "x86_64";
+}
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 03483bad57..498c3f7e4e 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -9,5 +9,6 @@
 #define X86_64_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_PLATFORM       1
 
 #endif

From e03b6ad483c087c8cf0357b7859d98bd2b109071 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 08:43:35 -1000
Subject: [PATCH 0064/2396] linux-user/i386: Return const data from
 get_elf_platform

Rather than modify a static buffer, index into an array of const data.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/i386/elfload.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index 1b759098ca..ef3a6c35d2 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -17,13 +17,9 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 
 const char *get_elf_platform(CPUState *cs)
 {
-    static char elf_platform[] = "i386";
+    static const char elf_platform[4][5] = { "i386", "i486", "i586", "i686" };
     int family = object_property_get_int(OBJECT(cs), "family", NULL);
-    if (family > 6) {
-        family = 6;
-    }
-    if (family >= 3) {
-        elf_platform[1] = '0' + family;
-    }
-    return elf_platform;
+
+    family = MAX(MIN(family, 6), 3);
+    return elf_platform[family - 3];
 }

From d6b8c5dbd9b0fd05c3f8ac9427729082eecb9fbb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 08:47:57 -1000
Subject: [PATCH 0065/2396] linux-user: Move get_elf_platform to arm/elfload.c

Move the aarch32 get_elf_platform to arm/elfload.c; pass in CPUState.
Create a simple version in aarch64/elfload.c, which we must do at the
same time because of the ifdef dependency between TARGET_AARCH64
and TARGET_ARM.

Since all versions of get_elf_platform now have the same
signature, remove the ifdef from the declaration in loader.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c    |  5 +++++
 linux-user/aarch64/target_elf.h |  1 +
 linux-user/arm/elfload.c        | 29 +++++++++++++++++++++++++
 linux-user/arm/target_elf.h     |  1 +
 linux-user/elfload.c            | 38 ++-------------------------------
 linux-user/loader.h             |  2 --
 6 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 92c8ea62c6..1030cb8094 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -342,3 +342,8 @@ const char *elf_hwcap2_str(uint32_t bit)
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    return TARGET_BIG_ENDIAN ? "aarch64_be" : "aarch64";
+}
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index 77108f3cb0..dee79ce0c6 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -10,5 +10,6 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
+#define HAVE_ELF_PLATFORM       1
 
 #endif
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index c7561b005b..7de1f13f4b 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -170,3 +170,32 @@ const char *elf_hwcap2_str(uint32_t bit)
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    CPUARMState *env = cpu_env(cs);
+
+#if TARGET_BIG_ENDIAN
+# define END  "b"
+#else
+# define END  "l"
+#endif
+
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return "v8" END;
+    } else if (arm_feature(env, ARM_FEATURE_V7)) {
+        if (arm_feature(env, ARM_FEATURE_M)) {
+            return "v7m" END;
+        } else {
+            return "v7" END;
+        }
+    } else if (arm_feature(env, ARM_FEATURE_V6)) {
+        return "v6" END;
+    } else if (arm_feature(env, ARM_FEATURE_V5)) {
+        return "v5" END;
+    } else {
+        return "v4" END;
+    }
+
+#undef END
+}
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 90470bd87b..856ca41b16 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -10,5 +10,6 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
+#define HAVE_ELF_PLATFORM       1
 
 #endif
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e6e509c0a6..0e41737cf1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -309,6 +309,8 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #ifdef TARGET_ARM
 
+#define ELF_PLATFORM get_elf_platform(thread_cpu)
+
 #ifndef TARGET_AARCH64
 /* 32 bit ARM definitions */
 
@@ -434,37 +436,6 @@ static bool init_guest_commpage(void)
     return true;
 }
 
-#define ELF_PLATFORM get_elf_platform()
-
-static const char *get_elf_platform(void)
-{
-    CPUARMState *env = cpu_env(thread_cpu);
-
-#if TARGET_BIG_ENDIAN
-# define END  "b"
-#else
-# define END  "l"
-#endif
-
-    if (arm_feature(env, ARM_FEATURE_V8)) {
-        return "v8" END;
-    } else if (arm_feature(env, ARM_FEATURE_V7)) {
-        if (arm_feature(env, ARM_FEATURE_M)) {
-            return "v7m" END;
-        } else {
-            return "v7" END;
-        }
-    } else if (arm_feature(env, ARM_FEATURE_V6)) {
-        return "v6" END;
-    } else if (arm_feature(env, ARM_FEATURE_V5)) {
-        return "v5" END;
-    } else {
-        return "v4" END;
-    }
-
-#undef END
-}
-
 #if TARGET_BIG_ENDIAN
 #include "elf.h"
 #include "vdso-be8.c.inc"
@@ -487,11 +458,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 
 #define ELF_ARCH        EM_AARCH64
 #define ELF_CLASS       ELFCLASS64
-#if TARGET_BIG_ENDIAN
-# define ELF_PLATFORM    "aarch64_be"
-#else
-# define ELF_PLATFORM    "aarch64"
-#endif
 
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 44bb4cbfd3..440871466c 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -105,8 +105,6 @@ abi_ulong get_elf_hwcap(CPUState *cs);
 abi_ulong get_elf_hwcap2(CPUState *cs);
 const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
-#if defined(TARGET_I386)
 const char *get_elf_platform(CPUState *cs);
-#endif
 
 #endif /* LINUX_USER_LOADER_H */

From 084b3247a08da16c541efba059c308b0d9299bdc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 09:00:52 -1000
Subject: [PATCH 0066/2396] linux-user/loongarch64: Create get_elf_platform

Move the string literal to a new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c                | 2 +-
 linux-user/loongarch64/elfload.c    | 5 +++++
 linux-user/loongarch64/target_elf.h | 1 +
 3 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0e41737cf1..9d61feae30 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -665,7 +665,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_PLATFORM "loongarch"
+#define ELF_PLATFORM get_elf_platform(thread_cpu)
 
 #endif /* TARGET_LOONGARCH64 */
 
diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
index ee4a85b8d6..911352840f 100644
--- a/linux-user/loongarch64/elfload.c
+++ b/linux-user/loongarch64/elfload.c
@@ -56,3 +56,8 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 
     return hwcaps;
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    return "loongarch";
+}
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 037740d36f..eb17927325 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -7,5 +7,6 @@
 #define LOONGARCH_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_PLATFORM       1
 
 #endif

From eaf983e04b342ab4c3401ad8add649ec626a0744 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 09:06:39 -1000
Subject: [PATCH 0067/2396] linux-user/hppa: Create get_elf_platform

Move the string literal to a new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 2 +-
 linux-user/hppa/elfload.c    | 5 +++++
 linux-user/hppa/target_elf.h | 2 ++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 9d61feae30..83cb6731ec 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1046,7 +1046,7 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_PARISC
-#define ELF_PLATFORM    "PARISC"
+#define ELF_PLATFORM    get_elf_platform(thread_cpu)
 #define STACK_GROWS_DOWN 0
 #define STACK_ALIGNMENT  64
 
diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
index 2274fcbde4..9dd3fe092a 100644
--- a/linux-user/hppa/elfload.c
+++ b/linux-user/hppa/elfload.c
@@ -9,3 +9,8 @@ const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "hppa";
 }
+
+const char *get_elf_platform(CPUState *cs)
+{
+    return "PARISC";
+}
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index 5826ca2cd2..85be00584d 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -8,4 +8,6 @@
 #ifndef HPPA_TARGET_ELF_H
 #define HPPA_TARGET_ELF_H
 
+#define HAVE_ELF_PLATFORM       1
+
 #endif

From f10c3d90849da63916905f7bd155d5737aa4378f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 09:18:03 -1000
Subject: [PATCH 0068/2396] linux-user: Remove ELF_PLATFORM

All real definitions of ELF_PLATFORM are now identical, and the stub
definitions are NULL.  Use HAVE_ELF_PLATFORM and provide a stub as a
fallback definition of get_elf_platform.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 83cb6731ec..d2d73b06fc 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -149,8 +149,6 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
-#define ELF_PLATFORM get_elf_platform(thread_cpu)
-
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
@@ -309,8 +307,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 
 #ifdef TARGET_ARM
 
-#define ELF_PLATFORM get_elf_platform(thread_cpu)
-
 #ifndef TARGET_AARCH64
 /* 32 bit ARM definitions */
 
@@ -665,8 +661,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
-#define ELF_PLATFORM get_elf_platform(thread_cpu)
-
 #endif /* TARGET_LOONGARCH64 */
 
 #ifdef TARGET_MIPS
@@ -846,8 +840,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
     (*regs)[33] = tswapreg(cpu_get_sr(env));
 }
 
-#define ELF_PLATFORM NULL
-
 #endif /* TARGET_OPENRISC */
 
 #ifdef TARGET_SH4
@@ -1046,7 +1038,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_PARISC
-#define ELF_PLATFORM    get_elf_platform(thread_cpu)
 #define STACK_GROWS_DOWN 0
 #define STACK_ALIGNMENT  64
 
@@ -1182,10 +1173,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 #define ELF_BASE_PLATFORM (NULL)
 #endif
 
-#ifndef ELF_PLATFORM
-#define ELF_PLATFORM (NULL)
-#endif
-
 #ifndef ELF_MACHINE
 #define ELF_MACHINE ELF_ARCH
 #endif
@@ -1229,6 +1216,9 @@ abi_ulong get_elf_hwcap(CPUState *cs) { return 0; }
 abi_ulong get_elf_hwcap2(CPUState *cs) { g_assert_not_reached(); }
 #define HAVE_ELF_HWCAP2 0
 #endif
+#ifndef HAVE_ELF_PLATFORM
+const char *get_elf_platform(CPUState *cs) { return NULL; }
+#endif
 
 #include "elf.h"
 
@@ -1699,7 +1689,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     }
 
     u_platform = 0;
-    k_platform = ELF_PLATFORM;
+    k_platform = get_elf_platform(thread_cpu);
     if (k_platform) {
         size_t len = strlen(k_platform) + 1;
         if (STACK_GROWS_DOWN) {

From f8498e084eaa7f78d455d5f2f7a308a4d0d5f39b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 09:24:31 -1000
Subject: [PATCH 0069/2396] linux-user: Move get_elf_base_platform to
 mips/elfload.c

Pass in CPUState; define HAVE_ELF_BASE_PLATFORM.
Since this was the only instance of ELF_BASE_PLATFORM, go ahead and
provide the stub definition for other platforms.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 40 ++++------------------------------
 linux-user/loader.h            |  1 +
 linux-user/mips/elfload.c      | 30 +++++++++++++++++++++++++
 linux-user/mips/target_elf.h   |  1 +
 linux-user/mips64/target_elf.h |  1 +
 5 files changed, 37 insertions(+), 36 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d2d73b06fc..4facaa7e27 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -679,37 +679,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
 #endif
 
-#define ELF_BASE_PLATFORM get_elf_base_platform()
-
-#define MATCH_PLATFORM_INSN(_flags, _base_platform)      \
-    do { if ((cpu->env.insn_flags & (_flags)) == _flags) \
-    { return _base_platform; } } while (0)
-
-static const char *get_elf_base_platform(void)
-{
-    MIPSCPU *cpu = MIPS_CPU(thread_cpu);
-
-    /* 64 bit ISAs goes first */
-    MATCH_PLATFORM_INSN(CPU_MIPS64R6, "mips64r6");
-    MATCH_PLATFORM_INSN(CPU_MIPS64R5, "mips64r5");
-    MATCH_PLATFORM_INSN(CPU_MIPS64R2, "mips64r2");
-    MATCH_PLATFORM_INSN(CPU_MIPS64R1, "mips64");
-    MATCH_PLATFORM_INSN(CPU_MIPS5, "mips5");
-    MATCH_PLATFORM_INSN(CPU_MIPS4, "mips4");
-    MATCH_PLATFORM_INSN(CPU_MIPS3, "mips3");
-
-    /* 32 bit ISAs */
-    MATCH_PLATFORM_INSN(CPU_MIPS32R6, "mips32r6");
-    MATCH_PLATFORM_INSN(CPU_MIPS32R5, "mips32r5");
-    MATCH_PLATFORM_INSN(CPU_MIPS32R2, "mips32r2");
-    MATCH_PLATFORM_INSN(CPU_MIPS32R1, "mips32");
-    MATCH_PLATFORM_INSN(CPU_MIPS2, "mips2");
-
-    /* Fallback */
-    return "mips";
-}
-#undef MATCH_PLATFORM_INSN
-
 static inline void init_thread(struct target_pt_regs *regs,
                                struct image_info *infop)
 {
@@ -1169,10 +1138,6 @@ static inline void init_thread(struct target_pt_regs *regs,
 
 #endif /* TARGET_HEXAGON */
 
-#ifndef ELF_BASE_PLATFORM
-#define ELF_BASE_PLATFORM (NULL)
-#endif
-
 #ifndef ELF_MACHINE
 #define ELF_MACHINE ELF_ARCH
 #endif
@@ -1219,6 +1184,9 @@ abi_ulong get_elf_hwcap2(CPUState *cs) { g_assert_not_reached(); }
 #ifndef HAVE_ELF_PLATFORM
 const char *get_elf_platform(CPUState *cs) { return NULL; }
 #endif
+#ifndef HAVE_ELF_BASE_PLATFORM
+const char *get_elf_base_platform(CPUState *cs) { return NULL; }
+#endif
 
 #include "elf.h"
 
@@ -1673,7 +1641,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     }
 
     u_base_platform = 0;
-    k_base_platform = ELF_BASE_PLATFORM;
+    k_base_platform = get_elf_base_platform(thread_cpu);
     if (k_base_platform) {
         size_t len = strlen(k_base_platform) + 1;
         if (STACK_GROWS_DOWN) {
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 440871466c..42cba90dea 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -106,5 +106,6 @@ abi_ulong get_elf_hwcap2(CPUState *cs);
 const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 const char *get_elf_platform(CPUState *cs);
+const char *get_elf_base_platform(CPUState *cs);
 
 #endif /* LINUX_USER_LOADER_H */
diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index 739f71c21b..c353ccc1ad 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -92,3 +92,33 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 #undef GET_FEATURE_REG_EQU
 #undef GET_FEATURE_REG_SET
 #undef GET_FEATURE_INSN
+
+#define MATCH_PLATFORM_INSN(_flags, _base_platform)      \
+    do { if ((cpu->env.insn_flags & (_flags)) == _flags) \
+    { return _base_platform; } } while (0)
+
+const char *get_elf_base_platform(CPUState *cs)
+{
+    MIPSCPU *cpu = MIPS_CPU(cs);
+
+    /* 64 bit ISAs goes first */
+    MATCH_PLATFORM_INSN(CPU_MIPS64R6, "mips64r6");
+    MATCH_PLATFORM_INSN(CPU_MIPS64R5, "mips64r5");
+    MATCH_PLATFORM_INSN(CPU_MIPS64R2, "mips64r2");
+    MATCH_PLATFORM_INSN(CPU_MIPS64R1, "mips64");
+    MATCH_PLATFORM_INSN(CPU_MIPS5, "mips5");
+    MATCH_PLATFORM_INSN(CPU_MIPS4, "mips4");
+    MATCH_PLATFORM_INSN(CPU_MIPS3, "mips3");
+
+    /* 32 bit ISAs */
+    MATCH_PLATFORM_INSN(CPU_MIPS32R6, "mips32r6");
+    MATCH_PLATFORM_INSN(CPU_MIPS32R5, "mips32r5");
+    MATCH_PLATFORM_INSN(CPU_MIPS32R2, "mips32r2");
+    MATCH_PLATFORM_INSN(CPU_MIPS32R1, "mips32");
+    MATCH_PLATFORM_INSN(CPU_MIPS2, "mips2");
+
+    /* Fallback */
+    return "mips";
+}
+
+#undef MATCH_PLATFORM_INSN
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index 877f8347d7..08e699c085 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -9,5 +9,6 @@
 #define MIPS_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_BASE_PLATFORM  1
 
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index c0347e5cb6..24bb7fcd3f 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -9,5 +9,6 @@
 #define MIPS64_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_BASE_PLATFORM  1
 
 #endif

From d8329660b2e103ac2bbbf9ae933c0c742d44864e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 09:49:39 -1000
Subject: [PATCH 0070/2396] linux-user: Move target_cpu_copy_regs decl to
 qemu.h

The function is not used by bsd-user, so placement
within include/user/cpu_loop.h is not ideal.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/user/cpu_loop.h | 4 ----
 linux-user/qemu.h       | 3 +++
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/include/user/cpu_loop.h b/include/user/cpu_loop.h
index ad8a1d711f..346e37ede8 100644
--- a/include/user/cpu_loop.h
+++ b/include/user/cpu_loop.h
@@ -81,8 +81,4 @@ void target_exception_dump(CPUArchState *env, const char *fmt, int code);
 #define EXCP_DUMP(env, fmt, code) \
     target_exception_dump(env, fmt, code)
 
-typedef struct target_pt_regs target_pt_regs;
-
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs);
-
 #endif
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 4d6fad28c6..0c3cfe93a1 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -359,4 +359,7 @@ void *lock_user_string(abi_ulong guest_addr);
 /* Clone cpu state */
 CPUArchState *cpu_copy(CPUArchState *env);
 
+typedef struct target_pt_regs target_pt_regs;
+void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs);
+
 #endif /* QEMU_H */

From 1f2f4c0fbcc527f47e2f9d5708ae7df824bd574f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 10:00:36 -1000
Subject: [PATCH 0071/2396] linux-user: Create do_init_main_thread

Provide a unified function to initialize the main thread.
Keep target_pt_regs isolated to this function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c   |  7 +++++--
 linux-user/linuxload.c |  6 ++----
 linux-user/loader.h    |  5 ++---
 linux-user/main.c      | 10 +++-------
 4 files changed, 12 insertions(+), 16 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 4facaa7e27..6fce74f45a 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -3619,7 +3619,10 @@ static int elf_core_dump(int signr, const CPUArchState *env)
 }
 #endif /* USE_ELF_CORE_DUMP */
 
-void do_init_thread(struct target_pt_regs *regs, struct image_info *infop)
+void do_init_main_thread(CPUState *cs, struct image_info *infop)
 {
-    init_thread(regs, infop);
+    target_pt_regs regs = { };
+
+    init_thread(&regs, infop);
+    target_cpu_copy_regs(cpu_env(cs), &regs);
 }
diff --git a/linux-user/linuxload.c b/linux-user/linuxload.c
index 37f132be4a..85d700953e 100644
--- a/linux-user/linuxload.c
+++ b/linux-user/linuxload.c
@@ -139,8 +139,7 @@ abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
 }
 
 int loader_exec(int fdexec, const char *filename, char **argv, char **envp,
-                struct target_pt_regs *regs, struct image_info *infop,
-                struct linux_binprm *bprm)
+                struct image_info *infop, struct linux_binprm *bprm)
 {
     int retval;
 
@@ -175,8 +174,7 @@ int loader_exec(int fdexec, const char *filename, char **argv, char **envp,
         return retval;
     }
 
-    /* Success.  Initialize important registers. */
-    do_init_thread(regs, infop);
+    /* Success. */
     return 0;
 }
 
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 42cba90dea..e0291cc3b0 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -82,12 +82,11 @@ struct linux_binprm {
     int (*core_dump)(int, const CPUArchState *); /* coredump routine */
 };
 
-void do_init_thread(struct target_pt_regs *regs, struct image_info *infop);
+void do_init_main_thread(CPUState *cs, struct image_info *infop);
 abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
                               abi_ulong stringp, int push_ptr);
 int loader_exec(int fdexec, const char *filename, char **argv, char **envp,
-             struct target_pt_regs *regs, struct image_info *infop,
-             struct linux_binprm *);
+                struct image_info *infop, struct linux_binprm *);
 
 uint32_t get_elf_eflags(int fd);
 int load_elf_binary(struct linux_binprm *bprm, struct image_info *info);
diff --git a/linux-user/main.c b/linux-user/main.c
index ad1a29d198..e21842bde9 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -696,7 +696,6 @@ static int parse_args(int argc, char **argv)
 
 int main(int argc, char **argv, char **envp)
 {
-    struct target_pt_regs regs1, *regs = &regs1;
     struct image_info info1, *info = &info1;
     struct linux_binprm bprm;
     TaskState *ts;
@@ -762,9 +761,6 @@ int main(int argc, char **argv, char **envp)
     trace_init_file();
     qemu_plugin_load_list(&plugins, &error_fatal);
 
-    /* Zero out regs */
-    memset(regs, 0, sizeof(struct target_pt_regs));
-
     /* Zero out image_info */
     memset(info, 0, sizeof(struct image_info));
 
@@ -988,8 +984,8 @@ int main(int argc, char **argv, char **envp)
 
     fd_trans_init();
 
-    ret = loader_exec(execfd, exec_path, target_argv, target_environ, regs,
-        info, &bprm);
+    ret = loader_exec(execfd, exec_path, target_argv, target_environ,
+                      info, &bprm);
     if (ret != 0) {
         printf("Error while loading %s: %s\n", exec_path, strerror(-ret));
         _exit(EXIT_FAILURE);
@@ -1041,7 +1037,7 @@ int main(int argc, char **argv, char **envp)
        the real value of GUEST_BASE into account.  */
     tcg_prologue_init();
 
-    target_cpu_copy_regs(env, regs);
+    do_init_main_thread(cpu, info);
 
     if (gdbstub) {
         gdbserver_start(gdbstub, &error_fatal);

From 8d4020dd025dc37d9003c6a514e758d8c6ef99b9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 10:17:44 -1000
Subject: [PATCH 0072/2396] linux-user/i386: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.
Temporarily introduce HAVE_INIT_MAIN_THREAD during conversion.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c       | 29 +++++------------------
 linux-user/i386/cpu_loop.c | 48 +++++++++++++++++---------------------
 linux-user/qemu.h          |  1 +
 3 files changed, 29 insertions(+), 49 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 6fce74f45a..89f3972253 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -149,17 +149,12 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
+#define HAVE_INIT_MAIN_THREAD
+
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
 
-static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
-{
-    regs->rax = 0;
-    regs->rsp = infop->start_stack;
-    regs->rip = infop->entry;
-}
-
 #define ELF_NREG    27
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
 
@@ -237,22 +232,6 @@ static bool init_guest_commpage(void)
 
 #define EXSTACK_DEFAULT true
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->esp = infop->start_stack;
-    regs->eip = infop->entry;
-
-    /* SVR4/i386 ABI (pages 3-31, 3-32) says that when the program
-       starts %edx contains a pointer to a function which might be
-       registered using `atexit'.  This provides a mean for the
-       dynamic linker to call DT_FINI functions for shared libraries
-       that have been loaded before the code runs.
-
-       A value of 0 tells we have no such handler.  */
-    regs->edx = 0;
-}
-
 #define ELF_NREG    17
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
 
@@ -3621,8 +3600,12 @@ static int elf_core_dump(int signr, const CPUArchState *env)
 
 void do_init_main_thread(CPUState *cs, struct image_info *infop)
 {
+#ifdef HAVE_INIT_MAIN_THREAD
+    init_main_thread(cs, infop);
+#else
     target_pt_regs regs = { };
 
     init_thread(&regs, infop);
     target_cpu_copy_regs(cpu_env(cs), &regs);
+#endif
 }
diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c
index d96d5553fa..7b2d8b03d8 100644
--- a/linux-user/i386/cpu_loop.c
+++ b/linux-user/i386/cpu_loop.c
@@ -331,11 +331,10 @@ static void target_cpu_free(void *obj)
     g_free(obj);
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cpu, struct image_info *info)
 {
-    CPUState *cpu = env_cpu(env);
+    CPUArchState *env = cpu_env(cpu);
     bool is64 = (env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_LM) != 0;
-    int i;
 
     OBJECT(cpu)->free = target_cpu_free;
     env->cr[0] = CR0_PG_MASK | CR0_WP_MASK | CR0_PE_MASK;
@@ -361,28 +360,25 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
     /* flags setup : we activate the IRQs by default as in user mode */
     env->eflags |= IF_MASK;
 
-    /* linux register setup */
-#ifndef TARGET_ABI32
-    env->regs[R_EAX] = regs->rax;
-    env->regs[R_EBX] = regs->rbx;
-    env->regs[R_ECX] = regs->rcx;
-    env->regs[R_EDX] = regs->rdx;
-    env->regs[R_ESI] = regs->rsi;
-    env->regs[R_EDI] = regs->rdi;
-    env->regs[R_EBP] = regs->rbp;
-    env->regs[R_ESP] = regs->rsp;
-    env->eip = regs->rip;
-#else
-    env->regs[R_EAX] = regs->eax;
-    env->regs[R_EBX] = regs->ebx;
-    env->regs[R_ECX] = regs->ecx;
-    env->regs[R_EDX] = regs->edx;
-    env->regs[R_ESI] = regs->esi;
-    env->regs[R_EDI] = regs->edi;
-    env->regs[R_EBP] = regs->ebp;
-    env->regs[R_ESP] = regs->esp;
-    env->eip = regs->eip;
-#endif
+    /*
+     * Linux register setup.
+     *
+     * SVR4/i386 ABI (pages 3-31, 3-32) says that when the program
+     * starts %edx contains a pointer to a function which might be
+     * registered using `atexit'.  This provides a mean for the
+     * dynamic linker to call DT_FINI functions for shared libraries
+     * that have been loaded before the code runs.
+     * A value of 0 tells we have no such handler.
+     *
+     * This applies to x86_64 as well as i386.
+     *
+     * That said, the kernel's ELF_PLAT_INIT simply zeros all of the general
+     * registers.  Note that x86_cpu_reset_hold will set %edx to cpuid_version;
+     * clear all general registers defensively.
+     */
+    memset(env->regs, 0, sizeof(env->regs));
+    env->regs[R_ESP] = info->start_stack;
+    env->eip = info->entry;
 
     /* linux interrupt setup */
 #ifndef TARGET_ABI32
@@ -394,7 +390,7 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
                                 PROT_READ|PROT_WRITE,
                                 MAP_ANONYMOUS|MAP_PRIVATE, -1, 0);
     idt_table = g2h_untagged(env->idt.base);
-    for (i = 0; i < 20; i++) {
+    for (int i = 0; i < 20; i++) {
         set_idt(i, 0, is64);
     }
     set_idt(3, 3, is64);
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 0c3cfe93a1..8a9500d4f4 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -361,5 +361,6 @@ CPUArchState *cpu_copy(CPUArchState *env);
 
 typedef struct target_pt_regs target_pt_regs;
 void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs);
+void init_main_thread(CPUState *cs, struct image_info *info);
 
 #endif /* QEMU_H */

From ea8683d2b3777fcb934a075df8b63d45642097d6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 10:43:26 -1000
Subject: [PATCH 0073/2396] linux-user/arm: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/cpu_loop.c | 51 ++++++++++++++++++++++++++++++++-------
 linux-user/elfload.c      | 41 +------------------------------
 2 files changed, 43 insertions(+), 49 deletions(-)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index 9d54422736..739e1607e3 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -480,17 +480,50 @@ void cpu_loop(CPUARMState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    CPUState *cpu = env_cpu(env);
-    TaskState *ts = get_task_state(cpu);
-    struct image_info *info = ts->info;
-    int i;
+    CPUARMState *env = cpu_env(cs);
+    abi_ptr stack = info->start_stack;
+    abi_ptr entry = info->entry;
 
-    cpsr_write(env, regs->uregs[16], CPSR_USER | CPSR_EXEC,
-               CPSRWriteByInstr);
-    for(i = 0; i < 16; i++) {
-        env->regs[i] = regs->uregs[i];
+    cpsr_write(env, ARM_CPU_MODE_USR | (entry & 1 ? CPSR_T : 0),
+               CPSR_USER | CPSR_EXEC, CPSRWriteByInstr);
+
+    env->regs[15] = entry & 0xfffffffe;
+    env->regs[13] = stack;
+
+    /* FIXME - what to for failure of get_user()? */
+    get_user_ual(env->regs[2], stack + 8); /* envp */
+    get_user_ual(env->regs[1], stack + 4); /* envp */
+
+    /*
+     * Per the SVR4 ABI, r0 contains a pointer to a function to be
+     * registered with atexit.  A value of 0 means we have no such handler.
+     */
+    env->regs[0] = 0;
+
+    /* For uClinux PIC binaries.  */
+    /* XXX: Linux does this only on ARM with no MMU (do we care?) */
+    env->regs[10] = info->start_data;
+
+    /* Support ARM FDPIC.  */
+    if (info_is_fdpic(info)) {
+        /*
+         * As described in the ABI document, r7 points to the loadmap info
+         * prepared by the kernel. If an interpreter is needed, r8 points
+         * to the interpreter loadmap and r9 points to the interpreter
+         * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and
+         * r9 points to the main program PT_DYNAMIC info.
+         */
+        env->regs[7] = info->loadmap_addr;
+        if (info->interpreter_loadmap_addr) {
+            /* Executable is dynamically loaded.  */
+            env->regs[8] = info->interpreter_loadmap_addr;
+            env->regs[9] = info->interpreter_pt_dynamic_addr;
+        } else {
+            env->regs[8] = 0;
+            env->regs[9] = info->pt_dynamic_addr;
+        }
     }
 
     if (TARGET_BIG_ENDIAN) {
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 89f3972253..9586873954 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -293,46 +293,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 #define ELF_CLASS       ELFCLASS32
 #define EXSTACK_DEFAULT true
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    abi_long stack = infop->start_stack;
-    memset(regs, 0, sizeof(*regs));
-
-    regs->uregs[16] = ARM_CPU_MODE_USR;
-    if (infop->entry & 1) {
-        regs->uregs[16] |= CPSR_T;
-    }
-    regs->uregs[15] = infop->entry & 0xfffffffe;
-    regs->uregs[13] = infop->start_stack;
-    /* FIXME - what to for failure of get_user()? */
-    get_user_ual(regs->uregs[2], stack + 8); /* envp */
-    get_user_ual(regs->uregs[1], stack + 4); /* envp */
-    /* XXX: it seems that r0 is zeroed after ! */
-    regs->uregs[0] = 0;
-    /* For uClinux PIC binaries.  */
-    /* XXX: Linux does this only on ARM with no MMU (do we care ?) */
-    regs->uregs[10] = infop->start_data;
-
-    /* Support ARM FDPIC.  */
-    if (info_is_fdpic(infop)) {
-        /* As described in the ABI document, r7 points to the loadmap info
-         * prepared by the kernel. If an interpreter is needed, r8 points
-         * to the interpreter loadmap and r9 points to the interpreter
-         * PT_DYNAMIC info. If no interpreter is needed, r8 is zero, and
-         * r9 points to the main program PT_DYNAMIC info.
-         */
-        regs->uregs[7] = infop->loadmap_addr;
-        if (infop->interpreter_loadmap_addr) {
-            /* Executable is dynamically loaded.  */
-            regs->uregs[8] = infop->interpreter_loadmap_addr;
-            regs->uregs[9] = infop->interpreter_pt_dynamic_addr;
-        } else {
-            regs->uregs[8] = 0;
-            regs->uregs[9] = infop->pt_dynamic_addr;
-        }
-    }
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define ELF_NREG    18
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];

From e872342837ed61af5f2ed15541375adf0c23e0eb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 3 Aug 2025 07:51:51 +1000
Subject: [PATCH 0074/2396] linux-user/arm: Remove a.out startup remenents

The setting of r1/r2 was removed in kernel commit acfdd4b1f7590d0
("ARM: 7791/1: a.out: remove partial a.out support"), and the
kernel commit message explains the history.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/cpu_loop.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index 739e1607e3..9aeb9b0087 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -492,10 +492,6 @@ void init_main_thread(CPUState *cs, struct image_info *info)
     env->regs[15] = entry & 0xfffffffe;
     env->regs[13] = stack;
 
-    /* FIXME - what to for failure of get_user()? */
-    get_user_ual(env->regs[2], stack + 8); /* envp */
-    get_user_ual(env->regs[1], stack + 4); /* envp */
-
     /*
      * Per the SVR4 ABI, r0 contains a pointer to a function to be
      * registered with atexit.  A value of 0 means we have no such handler.

From 2eaaf04ad7f9eb5bd578f3f225d118c9eb0bef1d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 11:04:34 -1000
Subject: [PATCH 0075/2396] linux-user/aarch64: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 14 ++++++--------
 linux-user/elfload.c          | 10 +---------
 2 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 030a630c93..4c4921152e 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -137,10 +137,10 @@ void cpu_loop(CPUARMState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
+    CPUARMState *env = cpu_env(cs);
     ARMCPU *cpu = env_archcpu(env);
-    int i;
 
     if (!(arm_feature(env, ARM_FEATURE_AARCH64))) {
         fprintf(stderr,
@@ -148,14 +148,12 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
         exit(EXIT_FAILURE);
     }
 
-    for (i = 0; i < 31; i++) {
-        env->xregs[i] = regs->regs[i];
-    }
-    env->pc = regs->pc;
-    env->xregs[31] = regs->sp;
+    env->pc = info->entry & ~0x3ULL;
+    env->xregs[31] = info->start_stack;
+
 #if TARGET_BIG_ENDIAN
     env->cp15.sctlr_el[1] |= SCTLR_E0E;
-    for (i = 1; i < 4; ++i) {
+    for (int i = 1; i < 4; ++i) {
         env->cp15.sctlr_el[i] |= SCTLR_EE;
     }
     arm_rebuild_hflags(env);
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 9586873954..f93afbdcea 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -395,15 +395,7 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_ARCH        EM_AARCH64
 #define ELF_CLASS       ELFCLASS64
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    abi_long stack = infop->start_stack;
-    memset(regs, 0, sizeof(*regs));
-
-    regs->pc = infop->entry & ~0x3ULL;
-    regs->sp = stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define ELF_NREG    34
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];

From 7b9efb7aaef9b43b22fce7051861f59fe15ff51a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 12:29:11 -1000
Subject: [PATCH 0076/2396] linux-user/sparc: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 12 ++----------
 linux-user/sparc/cpu_loop.c | 16 +++++++---------
 2 files changed, 9 insertions(+), 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index f93afbdcea..887a3a1cb2 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -438,16 +438,8 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 # define ELF_ARCH   EM_SPARCV9
 #endif
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    /* Note that target_cpu_copy_regs does not read psr/tstate. */
-    regs->pc = infop->entry;
-    regs->npc = regs->pc + 4;
-    regs->y = 0;
-    regs->u_regs[14] = (infop->start_stack - 16 * sizeof(abi_ulong)
-                        - TARGET_STACK_BIAS);
-}
+#define HAVE_INIT_MAIN_THREAD
+
 #endif /* TARGET_SPARC */
 
 #ifdef TARGET_PPC
diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index 68f1e8ecd4..7d30cd1ff2 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -357,14 +357,12 @@ void cpu_loop (CPUSPARCState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
-    env->pc = regs->pc;
-    env->npc = regs->npc;
-    env->y = regs->y;
-    for(i = 0; i < 8; i++)
-        env->gregs[i] = regs->u_regs[i];
-    for(i = 0; i < 8; i++)
-        env->regwptr[i] = regs->u_regs[i + 8];
+    CPUArchState *env = cpu_env(cs);
+
+    env->pc = info->entry;
+    env->npc = env->pc + 4;
+    env->regwptr[WREG_SP] = (info->start_stack - 16 * sizeof(abi_ulong)
+                             - TARGET_STACK_BIAS);
 }

From 88c9adef2b0fff84f0e9cbc728e860cfbad52008 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 13:09:29 -1000
Subject: [PATCH 0077/2396] linux-user/ppc: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c      | 17 +----------------
 linux-user/ppc/cpu_loop.c | 26 ++++++++++++++++++--------
 2 files changed, 19 insertions(+), 24 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 887a3a1cb2..a30431c7a2 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -485,22 +485,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
     } while (0)
 
-static inline void init_thread(struct target_pt_regs *_regs, struct image_info *infop)
-{
-    _regs->gpr[1] = infop->start_stack;
-#if defined(TARGET_PPC64)
-    if (get_ppc64_abi(infop) < 2) {
-        uint64_t val;
-        get_user_u64(val, infop->entry + 8);
-        _regs->gpr[2] = val + infop->load_bias;
-        get_user_u64(val, infop->entry);
-        infop->entry = val + infop->load_bias;
-    } else {
-        _regs->gpr[12] = infop->entry;  /* r12 set to global entry address */
-    }
-#endif
-    _regs->nip = infop->entry;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
 #define ELF_NREG 48
diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c
index 2a0efaffcd..22885ffd90 100644
--- a/linux-user/ppc/cpu_loop.c
+++ b/linux-user/ppc/cpu_loop.c
@@ -378,21 +378,31 @@ void cpu_loop(CPUPPCState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
+    CPUArchState *env = cpu_env(cs);
+    abi_ptr entry = info->entry;
+
+    env->gpr[1] = info->start_stack;
+
+#ifdef TARGET_PPC64
+    if (get_ppc64_abi(info) < 2) {
+        uint64_t val;
+        get_user_u64(val, entry + 8);
+        env->gpr[2] = val + info->load_bias;
+        get_user_u64(val, entry);
+        entry = val + info->load_bias;
+    } else {
+        env->gpr[12] = entry;  /* r12 set to global entry address */
+    }
 
-#if defined(TARGET_PPC64)
     int flag = (env->insns_flags2 & PPC2_BOOKE206) ? MSR_CM : MSR_SF;
 #if defined(TARGET_ABI32)
     ppc_store_msr(env, env->msr & ~((target_ulong)1 << flag));
 #else
     ppc_store_msr(env, env->msr | (target_ulong)1 << flag);
 #endif
-#endif
+#endif /* TARGET_PPC64 */
 
-    env->nip = regs->nip;
-    for(i = 0; i < 32; i++) {
-        env->gpr[i] = regs->gpr[i];
-    }
+    env->nip = entry;
 }

From a2c83f5156324b88cf5c92ed777648fc1aaccf7f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 13:22:48 -1000
Subject: [PATCH 0078/2396] linux-user/loongarch64: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Note that init_thread had set crmd in target_pt_regs, but
target_cpu_copy_regs did not copy to env.  This turns out to be
ok because loongarch_cpu_reset_hold initializes CRMD properly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c              |  9 +--------
 linux-user/loongarch64/cpu_loop.c | 11 ++++-------
 2 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a30431c7a2..0feccfbe91 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -533,14 +533,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define VDSO_HEADER "vdso.c.inc"
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    /*Set crmd PG,DA = 1,0 */
-    regs->csr.crmd = 2 << 3;
-    regs->csr.era = infop->entry;
-    regs->regs[3] = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/loongarch/include/asm/elf.h */
 #define ELF_NREG 45
diff --git a/linux-user/loongarch64/cpu_loop.c b/linux-user/loongarch64/cpu_loop.c
index ec8a06c88c..a0a4cbb7cc 100644
--- a/linux-user/loongarch64/cpu_loop.c
+++ b/linux-user/loongarch64/cpu_loop.c
@@ -120,13 +120,10 @@ void cpu_loop(CPULoongArchState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
-
-    for (i = 0; i < 32; i++) {
-        env->gpr[i] = regs->regs[i];
-    }
-    env->pc = regs->csr.era;
+    CPUArchState *env = cpu_env(cs);
 
+    env->pc = info->entry;
+    env->gpr[3] = info->start_stack;
 }

From e17cc00f7195f387720cd839dcb83fd17c2147c9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 13:33:18 -1000
Subject: [PATCH 0079/2396] linux-user/mips: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Note that init_thread had set cp0_status in target_pt_regs, but
target_cpu_copy_regs did not copy to env.  This turns out to be
ok because mips_cpu_reset_hold initializes CP0_Status properly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c       |  8 +-------
 linux-user/mips/cpu_loop.c | 16 ++++++----------
 2 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0feccfbe91..ac96755b06 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -581,13 +581,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
 #endif
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->cp0_status = 2 << CP0St_KSU;
-    regs->cp0_epc = infop->entry;
-    regs->regs[29] = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/mips/include/asm/elf.h.  */
 #define ELF_NREG 45
diff --git a/linux-user/mips/cpu_loop.c b/linux-user/mips/cpu_loop.c
index 6405806eb0..e67b8a2e46 100644
--- a/linux-user/mips/cpu_loop.c
+++ b/linux-user/mips/cpu_loop.c
@@ -211,12 +211,9 @@ done_syscall:
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    CPUState *cpu = env_cpu(env);
-    TaskState *ts = get_task_state(cpu);
-    struct image_info *info = ts->info;
-    int i;
+    CPUArchState *env = cpu_env(cs);
 
     struct mode_req {
         bool single;
@@ -245,12 +242,11 @@ void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
 
     struct mode_req prog_req;
     struct mode_req interp_req;
+    target_ulong entry = info->entry;
 
-    for(i = 0; i < 32; i++) {
-        env->active_tc.gpr[i] = regs->regs[i];
-    }
-    env->active_tc.PC = regs->cp0_epc & ~(target_ulong)1;
-    if (regs->cp0_epc & 1) {
+    env->active_tc.gpr[29] = info->start_stack;
+    env->active_tc.PC = entry & ~(target_ulong)1;
+    if (entry & 1) {
         env->hflags |= MIPS_HFLAG_M16;
     }
 

From 2ffaa3f70dfbf07a3bdb1035fb4ba4e0f7f94de1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 21:44:06 -1000
Subject: [PATCH 0080/2396] linux-user/microblaze: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c             |  8 +------
 linux-user/microblaze/cpu_loop.c | 39 ++++----------------------------
 2 files changed, 6 insertions(+), 41 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ac96755b06..3f9ec49359 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -640,13 +640,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *e
 #define ELF_CLASS   ELFCLASS32
 #define ELF_ARCH    EM_MICROBLAZE
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->pc = infop->entry;
-    regs->r1 = infop->start_stack;
-
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define ELF_EXEC_PAGESIZE        4096
 
diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index 87236c166f..d8277961c7 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -127,39 +127,10 @@ void cpu_loop(CPUMBState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    env->regs[0] = regs->r0;
-    env->regs[1] = regs->r1;
-    env->regs[2] = regs->r2;
-    env->regs[3] = regs->r3;
-    env->regs[4] = regs->r4;
-    env->regs[5] = regs->r5;
-    env->regs[6] = regs->r6;
-    env->regs[7] = regs->r7;
-    env->regs[8] = regs->r8;
-    env->regs[9] = regs->r9;
-    env->regs[10] = regs->r10;
-    env->regs[11] = regs->r11;
-    env->regs[12] = regs->r12;
-    env->regs[13] = regs->r13;
-    env->regs[14] = regs->r14;
-    env->regs[15] = regs->r15;
-    env->regs[16] = regs->r16;
-    env->regs[17] = regs->r17;
-    env->regs[18] = regs->r18;
-    env->regs[19] = regs->r19;
-    env->regs[20] = regs->r20;
-    env->regs[21] = regs->r21;
-    env->regs[22] = regs->r22;
-    env->regs[23] = regs->r23;
-    env->regs[24] = regs->r24;
-    env->regs[25] = regs->r25;
-    env->regs[26] = regs->r26;
-    env->regs[27] = regs->r27;
-    env->regs[28] = regs->r28;
-    env->regs[29] = regs->r29;
-    env->regs[30] = regs->r30;
-    env->regs[31] = regs->r31;
-    env->pc = regs->pc;
+    CPUArchState *env = cpu_env(cs);
+
+    env->pc = info->entry;
+    env->regs[1] = info->start_stack;
 }

From 83411d840cfd80d7288ea096d905413754a87c66 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 21:48:48 -1000
Subject: [PATCH 0081/2396] linux-user/openrisc: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           |  7 +------
 linux-user/openrisc/cpu_loop.c | 11 ++++-------
 2 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 3f9ec49359..03c9539774 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -673,12 +673,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env
 #define ELF_CLASS ELFCLASS32
 #define ELF_DATA  ELFDATA2MSB
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->pc = infop->entry;
-    regs->gpr[1] = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 8192
diff --git a/linux-user/openrisc/cpu_loop.c b/linux-user/openrisc/cpu_loop.c
index 306b4f8eb4..8c72347a99 100644
--- a/linux-user/openrisc/cpu_loop.c
+++ b/linux-user/openrisc/cpu_loop.c
@@ -83,13 +83,10 @@ void cpu_loop(CPUOpenRISCState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
+    CPUArchState *env = cpu_env(cs);
 
-    for (i = 0; i < 32; i++) {
-        cpu_set_gpr(env, i, regs->gpr[i]);
-    }
-    env->pc = regs->pc;
-    cpu_set_sr(env, regs->sr);
+    env->pc = info->entry;
+    cpu_set_gpr(env, 1, info->start_stack);
 }

From 011480ff599d76e62a0e49ddd21ba9023cdb0ec3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 21:51:02 -1000
Subject: [PATCH 0082/2396] linux-user/sh4: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c      |  8 +-------
 linux-user/sh4/cpu_loop.c | 10 ++++------
 2 files changed, 5 insertions(+), 13 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 03c9539774..8604308a31 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -701,13 +701,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS ELFCLASS32
 #define ELF_ARCH  EM_SH
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    /* Check other registers XXXXX */
-    regs->pc = infop->entry;
-    regs->regs[15] = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/sh/include/asm/elf.h.  */
 #define ELF_NREG 23
diff --git a/linux-user/sh4/cpu_loop.c b/linux-user/sh4/cpu_loop.c
index ee9eff3428..259ea1cc8b 100644
--- a/linux-user/sh4/cpu_loop.c
+++ b/linux-user/sh4/cpu_loop.c
@@ -81,12 +81,10 @@ void cpu_loop(CPUSH4State *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
+    CPUArchState *env = cpu_env(cs);
 
-    for(i = 0; i < 16; i++) {
-        env->gregs[i] = regs->regs[i];
-    }
-    env->pc = regs->pc;
+    env->pc = info->entry;
+    env->gregs[15] = info->start_stack;
 }

From ff053f9c5a4df1f0fb49ab7d7a0886a43f18a4f4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 21:53:30 -1000
Subject: [PATCH 0083/2396] linux-user/m68k: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c       | 11 +----------
 linux-user/m68k/cpu_loop.c | 25 ++++++-------------------
 2 files changed, 7 insertions(+), 29 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 8604308a31..46150586af 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -746,16 +746,7 @@ static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_68K
 
-/* ??? Does this need to do anything?
-   #define ELF_PLAT_INIT(_r) */
-
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->usp = infop->start_stack;
-    regs->sr = 0;
-    regs->pc = infop->entry;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
 #define ELF_NREG 20
diff --git a/linux-user/m68k/cpu_loop.c b/linux-user/m68k/cpu_loop.c
index 23693f3358..aca0bf23dc 100644
--- a/linux-user/m68k/cpu_loop.c
+++ b/linux-user/m68k/cpu_loop.c
@@ -92,24 +92,11 @@ void cpu_loop(CPUM68KState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    env->pc = regs->pc;
-    env->dregs[0] = regs->d0;
-    env->dregs[1] = regs->d1;
-    env->dregs[2] = regs->d2;
-    env->dregs[3] = regs->d3;
-    env->dregs[4] = regs->d4;
-    env->dregs[5] = regs->d5;
-    env->dregs[6] = regs->d6;
-    env->dregs[7] = regs->d7;
-    env->aregs[0] = regs->a0;
-    env->aregs[1] = regs->a1;
-    env->aregs[2] = regs->a2;
-    env->aregs[3] = regs->a3;
-    env->aregs[4] = regs->a4;
-    env->aregs[5] = regs->a5;
-    env->aregs[6] = regs->a6;
-    env->aregs[7] = regs->usp;
-    env->sr = regs->sr;
+    CPUArchState *env = cpu_env(cs);
+
+    env->pc = info->entry;
+    env->aregs[7] = info->start_stack;
+    env->sr = 0;
 }

From 6b523112baac10747446af9074d1281974767004 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 21:59:47 -1000
Subject: [PATCH 0084/2396] linux-user/alpha: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Note that init_thread had set ps in target_pt_regs, but
target_cpu_copy_regs did not copy to env.  This turns out to be
ok because alpha_cpu_initfn initializes flags properly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/alpha/cpu_loop.c | 11 ++++-------
 linux-user/elfload.c        |  8 +-------
 2 files changed, 5 insertions(+), 14 deletions(-)

diff --git a/linux-user/alpha/cpu_loop.c b/linux-user/alpha/cpu_loop.c
index 80ad536c5f..728b64906d 100644
--- a/linux-user/alpha/cpu_loop.c
+++ b/linux-user/alpha/cpu_loop.c
@@ -173,13 +173,10 @@ void cpu_loop(CPUAlphaState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
+    CPUArchState *env = cpu_env(cs);
 
-    for(i = 0; i < 28; i++) {
-        env->ir[i] = ((abi_ulong *)regs)[i];
-    }
-    env->ir[IR_SP] = regs->usp;
-    env->pc = regs->pc;
+    env->pc = info->entry;
+    env->ir[IR_SP] = info->start_stack;
 }
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 46150586af..a7de852d4d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -786,13 +786,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *e
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_ALPHA
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->pc = infop->entry;
-    regs->ps = 8;
-    regs->usp = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define ELF_EXEC_PAGESIZE        8192
 

From 592f36d13dd32d0a90f71266931a68f522617026 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:03:03 -1000
Subject: [PATCH 0085/2396] linux-user/s390x: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        |  9 +--------
 linux-user/s390x/cpu_loop.c | 15 ++++++++-------
 2 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a7de852d4d..16aa09214e 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -798,14 +798,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *e
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-static inline void init_thread(struct target_pt_regs *regs, struct image_info *infop)
-{
-    regs->psw.addr = infop->entry;
-    regs->psw.mask = PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT | \
-                     PSW_MASK_MCHECK | PSW_MASK_PSTATE | PSW_MASK_64 | \
-                     PSW_MASK_32;
-    regs->gprs[15] = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
 #define ELF_NREG 27
diff --git a/linux-user/s390x/cpu_loop.c b/linux-user/s390x/cpu_loop.c
index c9124444ed..49e44548f8 100644
--- a/linux-user/s390x/cpu_loop.c
+++ b/linux-user/s390x/cpu_loop.c
@@ -180,12 +180,13 @@ void cpu_loop(CPUS390XState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
-    for (i = 0; i < 16; i++) {
-        env->regs[i] = regs->gprs[i];
-    }
-    env->psw.mask = regs->psw.mask;
-    env->psw.addr = regs->psw.addr;
+    CPUArchState *env = cpu_env(cs);
+
+    env->psw.addr = info->entry;
+    env->psw.mask = PSW_MASK_DAT | PSW_MASK_IO | PSW_MASK_EXT |
+                    PSW_MASK_MCHECK | PSW_MASK_PSTATE | PSW_MASK_64 |
+                    PSW_MASK_32;
+    env->regs[15] = info->start_stack;
 }

From a56cf00bc06a11627ec7b695618532d0d58cf8de Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:06:12 -1000
Subject: [PATCH 0086/2396] linux-user/riscv: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        |  7 +------
 linux-user/riscv/cpu_loop.c | 10 ++++------
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 16aa09214e..556f11d720 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -849,12 +849,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define VDSO_HEADER "vdso-64.c.inc"
 #endif
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->sepc = infop->entry;
-    regs->sp = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define ELF_EXEC_PAGESIZE 4096
 
diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c
index 2dd30c7b28..b316281532 100644
--- a/linux-user/riscv/cpu_loop.c
+++ b/linux-user/riscv/cpu_loop.c
@@ -94,14 +94,12 @@ void cpu_loop(CPURISCVState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    CPUState *cpu = env_cpu(env);
-    TaskState *ts = get_task_state(cpu);
-    struct image_info *info = ts->info;
+    CPUArchState *env = cpu_env(cs);
 
-    env->pc = regs->sepc;
-    env->gpr[xSP] = regs->sp;
+    env->pc = info->entry;
+    env->gpr[xSP] = info->start_stack;
     env->elf_flags = info->elf_flags;
 
     if ((env->misa_ext & RVE) && !(env->elf_flags & EF_RISCV_RVE)) {

From 1aec088719c5646b3117fd3b9c4507830f99f432 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:09:19 -1000
Subject: [PATCH 0087/2396] linux-user/hppa: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c       | 13 +------------
 linux-user/hppa/cpu_loop.c | 18 +++++++++++-------
 2 files changed, 12 insertions(+), 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 556f11d720..4876e4b0a8 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -864,18 +864,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 
 #define VDSO_HEADER "vdso.c.inc"
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->iaoq[0] = infop->entry | PRIV_USER;
-    regs->iaoq[1] = regs->iaoq[0] + 4;
-    regs->gr[23] = 0;
-    regs->gr[24] = infop->argv;
-    regs->gr[25] = infop->argc;
-    /* The top-of-stack contains a linkage buffer.  */
-    regs->gr[30] = infop->start_stack + 64;
-    regs->gr[31] = infop->entry;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #define LO_COMMPAGE  0
 
diff --git a/linux-user/hppa/cpu_loop.c b/linux-user/hppa/cpu_loop.c
index 9abaad5ef8..3af50653bb 100644
--- a/linux-user/hppa/cpu_loop.c
+++ b/linux-user/hppa/cpu_loop.c
@@ -196,12 +196,16 @@ void cpu_loop(CPUHPPAState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
-    for (i = 1; i < 32; i++) {
-        env->gr[i] = regs->gr[i];
-    }
-    env->iaoq_f = regs->iaoq[0];
-    env->iaoq_b = regs->iaoq[1];
+    CPUArchState *env = cpu_env(cs);
+
+    env->iaoq_f = info->entry | PRIV_USER;
+    env->iaoq_b = env->iaoq_f + 4;
+    env->gr[23] = 0;
+    env->gr[24] = info->argv;
+    env->gr[25] = info->argc;
+    /* The top-of-stack contains a linkage buffer.  */
+    env->gr[30] = info->start_stack + 64;
+    env->gr[31] = info->entry;
 }

From ceff7f9ae996ec9bb78d463f054241c338dc979c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:16:22 -1000
Subject: [PATCH 0088/2396] linux-user/xtensa: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 18 +-----------------
 linux-user/xtensa/cpu_loop.c | 22 ++++++++++++++++------
 2 files changed, 17 insertions(+), 23 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 4876e4b0a8..447a9be11d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -905,23 +905,7 @@ static bool init_guest_commpage(void)
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_XTENSA
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->windowbase = 0;
-    regs->windowstart = 1;
-    regs->areg[1] = infop->start_stack;
-    regs->pc = infop->entry;
-    if (info_is_fdpic(infop)) {
-        regs->areg[4] = infop->loadmap_addr;
-        regs->areg[5] = infop->interpreter_loadmap_addr;
-        if (infop->interpreter_loadmap_addr) {
-            regs->areg[6] = infop->interpreter_pt_dynamic_addr;
-        } else {
-            regs->areg[6] = infop->pt_dynamic_addr;
-        }
-    }
-}
+#define HAVE_INIT_MAIN_THREAD
 
 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
 #define ELF_NREG 128
diff --git a/linux-user/xtensa/cpu_loop.c b/linux-user/xtensa/cpu_loop.c
index c0fcf743e7..43a194fc4a 100644
--- a/linux-user/xtensa/cpu_loop.c
+++ b/linux-user/xtensa/cpu_loop.c
@@ -238,12 +238,22 @@ void cpu_loop(CPUXtensaState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    int i;
-    for (i = 0; i < 16; ++i) {
-        env->regs[i] = regs->areg[i];
+    CPUArchState *env = cpu_env(cs);
+
+    env->sregs[WINDOW_BASE] = 0;
+    env->sregs[WINDOW_START] = 1;
+    env->regs[1] = info->start_stack;
+    env->pc = info->entry;
+
+    if (info_is_fdpic(info)) {
+        env->regs[4] = info->loadmap_addr;
+        env->regs[5] = info->interpreter_loadmap_addr;
+        if (info->interpreter_loadmap_addr) {
+            env->regs[6] = info->interpreter_pt_dynamic_addr;
+        } else {
+            env->regs[6] = info->pt_dynamic_addr;
+        }
     }
-    env->sregs[WINDOW_START] = regs->windowstart;
-    env->pc = regs->pc;
 }

From f61c88c571e5e68cdf1d935d7524493a8f404556 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:19:49 -1000
Subject: [PATCH 0089/2396] linux-user/hexagon: Create init_main_thread

Merge init_thread and target_cpu_copy_regs.
There's no point going through a target_pt_regs intermediate.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 7 +------
 linux-user/hexagon/cpu_loop.c | 8 +++++---
 2 files changed, 6 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 447a9be11d..4417c2d99a 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -954,12 +954,7 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_HEXAGON
 
-static inline void init_thread(struct target_pt_regs *regs,
-                               struct image_info *infop)
-{
-    regs->sepc = infop->entry;
-    regs->sp = infop->start_stack;
-}
+#define HAVE_INIT_MAIN_THREAD
 
 #endif /* TARGET_HEXAGON */
 
diff --git a/linux-user/hexagon/cpu_loop.c b/linux-user/hexagon/cpu_loop.c
index e18a0183b5..25c97edcae 100644
--- a/linux-user/hexagon/cpu_loop.c
+++ b/linux-user/hexagon/cpu_loop.c
@@ -79,9 +79,11 @@ void cpu_loop(CPUHexagonState *env)
     }
 }
 
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs)
+void init_main_thread(CPUState *cs, struct image_info *info)
 {
-    env->gpr[HEX_REG_PC] = regs->sepc;
-    env->gpr[HEX_REG_SP] = regs->sp;
+    CPUArchState *env = cpu_env(cs);
+
+    env->gpr[HEX_REG_PC] = info->entry;
+    env->gpr[HEX_REG_SP] = info->start_stack;
     env->gpr[HEX_REG_USR] = 0x56000;
 }

From e191623fb0694a08c372fb68c5634969addbcb7b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 28 Jul 2025 22:24:19 -1000
Subject: [PATCH 0090/2396] linux-user: Remove do_init_main_thread

All targets have been converted, so we can call init_main_thread
directly.  Remove do_init_main_thread and HAVE_INIT_MAIN_THREAD.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 46 --------------------------------------------
 linux-user/loader.h  |  1 -
 linux-user/main.c    |  2 +-
 linux-user/qemu.h    |  2 --
 4 files changed, 1 insertion(+), 50 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 4417c2d99a..fce4c05674 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -149,8 +149,6 @@ typedef abi_int         target_pid_t;
 
 #ifdef TARGET_I386
 
-#define HAVE_INIT_MAIN_THREAD
-
 #ifdef TARGET_X86_64
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
@@ -293,8 +291,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *en
 #define ELF_CLASS       ELFCLASS32
 #define EXSTACK_DEFAULT true
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define ELF_NREG    18
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
 
@@ -395,8 +391,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_ARCH        EM_AARCH64
 #define ELF_CLASS       ELFCLASS64
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define ELF_NREG    34
 typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
 
@@ -438,8 +432,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 # define ELF_ARCH   EM_SPARCV9
 #endif
 
-#define HAVE_INIT_MAIN_THREAD
-
 #endif /* TARGET_SPARC */
 
 #ifdef TARGET_PPC
@@ -485,8 +477,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
     } while (0)
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
 #define ELF_NREG 48
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -533,8 +523,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *en
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/loongarch/include/asm/elf.h */
 #define ELF_NREG 45
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -581,8 +569,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
 #endif
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/mips/include/asm/elf.h.  */
 #define ELF_NREG 45
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -640,8 +626,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *e
 #define ELF_CLASS   ELFCLASS32
 #define ELF_ARCH    EM_MICROBLAZE
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define ELF_EXEC_PAGESIZE        4096
 
 #define USE_ELF_CORE_DUMP
@@ -673,8 +657,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env
 #define ELF_CLASS ELFCLASS32
 #define ELF_DATA  ELFDATA2MSB
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define USE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 8192
 
@@ -701,8 +683,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS ELFCLASS32
 #define ELF_ARCH  EM_SH
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/sh/include/asm/elf.h.  */
 #define ELF_NREG 23
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -746,8 +726,6 @@ static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_68K
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
 #define ELF_NREG 20
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -786,8 +764,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *e
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_ALPHA
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define ELF_EXEC_PAGESIZE        8192
 
 #endif /* TARGET_ALPHA */
@@ -798,8 +774,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *e
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
 #define ELF_NREG 27
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -849,8 +823,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define VDSO_HEADER "vdso-64.c.inc"
 #endif
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define ELF_EXEC_PAGESIZE 4096
 
 #endif /* TARGET_RISCV */
@@ -864,8 +836,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define HAVE_INIT_MAIN_THREAD
-
 #define LO_COMMPAGE  0
 
 static bool init_guest_commpage(void)
@@ -905,8 +875,6 @@ static bool init_guest_commpage(void)
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_XTENSA
 
-#define HAVE_INIT_MAIN_THREAD
-
 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
 #define ELF_NREG 128
 typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
@@ -954,8 +922,6 @@ static void elf_core_copy_regs(target_elf_gregset_t *regs,
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_HEXAGON
 
-#define HAVE_INIT_MAIN_THREAD
-
 #endif /* TARGET_HEXAGON */
 
 #ifndef ELF_MACHINE
@@ -3438,15 +3404,3 @@ static int elf_core_dump(int signr, const CPUArchState *env)
     return ret;
 }
 #endif /* USE_ELF_CORE_DUMP */
-
-void do_init_main_thread(CPUState *cs, struct image_info *infop)
-{
-#ifdef HAVE_INIT_MAIN_THREAD
-    init_main_thread(cs, infop);
-#else
-    target_pt_regs regs = { };
-
-    init_thread(&regs, infop);
-    target_cpu_copy_regs(cpu_env(cs), &regs);
-#endif
-}
diff --git a/linux-user/loader.h b/linux-user/loader.h
index e0291cc3b0..6482c7c90c 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -82,7 +82,6 @@ struct linux_binprm {
     int (*core_dump)(int, const CPUArchState *); /* coredump routine */
 };
 
-void do_init_main_thread(CPUState *cs, struct image_info *infop);
 abi_ulong loader_build_argptr(int envc, int argc, abi_ulong sp,
                               abi_ulong stringp, int push_ptr);
 int loader_exec(int fdexec, const char *filename, char **argv, char **envp,
diff --git a/linux-user/main.c b/linux-user/main.c
index e21842bde9..6edeeecef3 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -1037,7 +1037,7 @@ int main(int argc, char **argv, char **envp)
        the real value of GUEST_BASE into account.  */
     tcg_prologue_init();
 
-    do_init_main_thread(cpu, info);
+    init_main_thread(cpu, info);
 
     if (gdbstub) {
         gdbserver_start(gdbstub, &error_fatal);
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index 8a9500d4f4..e4dca0c20f 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -359,8 +359,6 @@ void *lock_user_string(abi_ulong guest_addr);
 /* Clone cpu state */
 CPUArchState *cpu_copy(CPUArchState *env);
 
-typedef struct target_pt_regs target_pt_regs;
-void target_cpu_copy_regs(CPUArchState *env, target_pt_regs *regs);
 void init_main_thread(CPUState *cs, struct image_info *info);
 
 #endif /* QEMU_H */

From f91563d011a0439cd6709e169cdfac268779d562 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Tue, 26 Aug 2025 15:33:40 +0930
Subject: [PATCH 0091/2396] linux-user: Add strace for rseq

 build/qemu-riscv64 -cpu rv64,v=on -d strace  build/tests/tcg/riscv64-linux-user/test-vstart-overflow
 1118081 riscv_hwprobe(0xffffbc038200,1,0,0,0,0) = 0
 1118081 brk(NULL) = 0x0000000000085000
 1118081 brk(0x0000000000085b00) = 0x0000000000085b00
 1118081 set_tid_address(0x850f0) = 1118081
 1118081 set_robust_list(0x85100,24) = -1 errno=38 (Function not implemented)
 1118081 rseq(0x857c0,32,0,0xf1401073) = -1 errno=38 (Function not implemented)

Signed-off-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250826060341.1118670-1-joel@jms.id.au>
---
 linux-user/strace.list | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/strace.list b/linux-user/strace.list
index ab818352a9..51b5ead969 100644
--- a/linux-user/strace.list
+++ b/linux-user/strace.list
@@ -1719,3 +1719,6 @@
 #ifdef TARGET_NR_riscv_hwprobe
 { TARGET_NR_riscv_hwprobe, "riscv_hwprobe" , "%s(%p,%d,%d,%d,%d,%d)", NULL, NULL },
 #endif
+#ifdef TARGET_NR_rseq
+{ TARGET_NR_rseq, "rseq" , "%s(%p,%u,%d,%#x)", NULL, NULL },
+#endif

From a5fbf1c617c5b51082d317601e0d4cf5eea5c140 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C5=81ukasz=20Stelmach?= <l.stelmach@samsung.com>
Date: Wed, 27 Aug 2025 11:54:12 +0200
Subject: [PATCH 0092/2396] linux-user: do not print IP socket options by
 default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IP protocols should not be printed unless the socket is an IPv4 or
IPv6 one. Current arrangement erroneously prints IPPROTO_IP for Unix
domain sockets.

Signed-off-by: Łukasz Stelmach <l.stelmach@samsung.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250827095412.2348821-1-l.stelmach@samsung.com>
---
 linux-user/strace.c | 36 ++++++++++++++++++++----------------
 1 file changed, 20 insertions(+), 16 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 3b744ccd4a..786354627a 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -586,23 +586,27 @@ print_socket_protocol(int domain, int type, int protocol)
         return;
     }
 
-    switch (protocol) {
-    case IPPROTO_IP:
-        qemu_log("IPPROTO_IP");
-        break;
-    case IPPROTO_TCP:
-        qemu_log("IPPROTO_TCP");
-        break;
-    case IPPROTO_UDP:
-        qemu_log("IPPROTO_UDP");
-        break;
-    case IPPROTO_RAW:
-        qemu_log("IPPROTO_RAW");
-        break;
-    default:
-        qemu_log("%d", protocol);
-        break;
+    if (domain == AF_INET || domain == AF_INET6) {
+        switch (protocol) {
+        case IPPROTO_IP:
+            qemu_log("IPPROTO_IP");
+            break;
+        case IPPROTO_TCP:
+            qemu_log("IPPROTO_TCP");
+            break;
+        case IPPROTO_UDP:
+            qemu_log("IPPROTO_UDP");
+            break;
+        case IPPROTO_RAW:
+            qemu_log("IPPROTO_RAW");
+            break;
+        default:
+            qemu_log("%d", protocol);
+            break;
+        }
+        return;
     }
+    qemu_log("%d", protocol);
 }
 
 

From 96e7448c1f820c56caea8447c01f5227b0c95c79 Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Fri, 25 Jul 2025 11:12:32 +0800
Subject: [PATCH 0093/2396] target/loongarch: Guard 64-bit-only insn
 translation with TRANS64 macro

This patch replaces uses of the generic TRANS macro with TRANS64 for
instructions that are only valid when 64-bit support is available.

This improves correctness and avoids potential assertion failures or
undefined behavior during translation on 32-bit-only configurations.

Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 .../tcg/insn_trans/trans_atomic.c.inc         | 36 +++++++++----------
 .../tcg/insn_trans/trans_extra.c.inc          |  8 +++--
 .../tcg/insn_trans/trans_farith.c.inc         |  8 ++---
 .../loongarch/tcg/insn_trans/trans_fcnv.c.inc |  4 +--
 .../tcg/insn_trans/trans_fmemory.c.inc        | 16 ++++-----
 .../tcg/insn_trans/trans_privileged.c.inc     |  4 +--
 .../tcg/insn_trans/trans_shift.c.inc          |  4 +--
 target/loongarch/translate.h                  |  4 +++
 8 files changed, 46 insertions(+), 38 deletions(-)

diff --git a/target/loongarch/tcg/insn_trans/trans_atomic.c.inc b/target/loongarch/tcg/insn_trans/trans_atomic.c.inc
index 3d70d75941..77eeedbc42 100644
--- a/target/loongarch/tcg/insn_trans/trans_atomic.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_atomic.c.inc
@@ -74,38 +74,38 @@ TRANS(sc_w, ALL, gen_sc, MO_TESL)
 TRANS(ll_d, 64, gen_ll, MO_TEUQ)
 TRANS(sc_d, 64, gen_sc, MO_TEUQ)
 TRANS(amswap_w, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS64(amswap_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
 TRANS(amadd_w, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS64(amadd_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
 TRANS(amand_w, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS64(amand_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
 TRANS(amor_w, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS64(amor_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
 TRANS(amxor_w, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS64(amxor_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
 TRANS(ammax_w, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS64(ammax_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
 TRANS(ammin_w, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS64(ammin_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
 TRANS(ammax_wu, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS64(ammax_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
 TRANS(ammin_wu, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS64(ammin_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
 TRANS(amswap_db_w, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TESL)
-TRANS(amswap_db_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
+TRANS64(amswap_db_d, LAM, gen_am, tcg_gen_atomic_xchg_tl, MO_TEUQ)
 TRANS(amadd_db_w, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TESL)
-TRANS(amadd_db_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
+TRANS64(amadd_db_d, LAM, gen_am, tcg_gen_atomic_fetch_add_tl, MO_TEUQ)
 TRANS(amand_db_w, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TESL)
-TRANS(amand_db_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
+TRANS64(amand_db_d, LAM, gen_am, tcg_gen_atomic_fetch_and_tl, MO_TEUQ)
 TRANS(amor_db_w, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TESL)
-TRANS(amor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
+TRANS64(amor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_or_tl, MO_TEUQ)
 TRANS(amxor_db_w, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TESL)
-TRANS(amxor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
+TRANS64(amxor_db_d, LAM, gen_am, tcg_gen_atomic_fetch_xor_tl, MO_TEUQ)
 TRANS(ammax_db_w, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TESL)
-TRANS(ammax_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
+TRANS64(ammax_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smax_tl, MO_TEUQ)
 TRANS(ammin_db_w, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TESL)
-TRANS(ammin_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
+TRANS64(ammin_db_d, LAM, gen_am, tcg_gen_atomic_fetch_smin_tl, MO_TEUQ)
 TRANS(ammax_db_wu, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TESL)
-TRANS(ammax_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
+TRANS64(ammax_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umax_tl, MO_TEUQ)
 TRANS(ammin_db_wu, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TESL)
-TRANS(ammin_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
+TRANS64(ammin_db_du, LAM, gen_am, tcg_gen_atomic_fetch_umin_tl, MO_TEUQ)
diff --git a/target/loongarch/tcg/insn_trans/trans_extra.c.inc b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
index eda3d6e561..298a80cff5 100644
--- a/target/loongarch/tcg/insn_trans/trans_extra.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_extra.c.inc
@@ -69,6 +69,10 @@ static bool trans_rdtimeh_w(DisasContext *ctx, arg_rdtimeh_w *a)
 
 static bool trans_rdtime_d(DisasContext *ctx, arg_rdtime_d *a)
 {
+    if (!avail_64(ctx)) {
+        return false;
+    }
+
     return gen_rdtime(ctx, a, 0, 0);
 }
 
@@ -100,8 +104,8 @@ static bool gen_crc(DisasContext *ctx, arg_rrr *a,
 TRANS(crc_w_b_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(1))
 TRANS(crc_w_h_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(2))
 TRANS(crc_w_w_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(4))
-TRANS(crc_w_d_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
+TRANS64(crc_w_d_w, CRC, gen_crc, gen_helper_crc32, tcg_constant_tl(8))
 TRANS(crcc_w_b_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(1))
 TRANS(crcc_w_h_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(2))
 TRANS(crcc_w_w_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(4))
-TRANS(crcc_w_d_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
+TRANS64(crcc_w_d_w, CRC, gen_crc, gen_helper_crc32c, tcg_constant_tl(8))
diff --git a/target/loongarch/tcg/insn_trans/trans_farith.c.inc b/target/loongarch/tcg/insn_trans/trans_farith.c.inc
index f4a0dea727..ff6cf3448e 100644
--- a/target/loongarch/tcg/insn_trans/trans_farith.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_farith.c.inc
@@ -183,16 +183,16 @@ TRANS(fmaxa_s, FP_SP, gen_fff, gen_helper_fmaxa_s)
 TRANS(fmaxa_d, FP_DP, gen_fff, gen_helper_fmaxa_d)
 TRANS(fmina_s, FP_SP, gen_fff, gen_helper_fmina_s)
 TRANS(fmina_d, FP_DP, gen_fff, gen_helper_fmina_d)
-TRANS(fscaleb_s, FP_SP, gen_fff, gen_helper_fscaleb_s)
-TRANS(fscaleb_d, FP_DP, gen_fff, gen_helper_fscaleb_d)
+TRANS64(fscaleb_s, FP_SP, gen_fff, gen_helper_fscaleb_s)
+TRANS64(fscaleb_d, FP_DP, gen_fff, gen_helper_fscaleb_d)
 TRANS(fsqrt_s, FP_SP, gen_ff, gen_helper_fsqrt_s)
 TRANS(fsqrt_d, FP_DP, gen_ff, gen_helper_fsqrt_d)
 TRANS(frecip_s, FP_SP, gen_ff, gen_helper_frecip_s)
 TRANS(frecip_d, FP_DP, gen_ff, gen_helper_frecip_d)
 TRANS(frsqrt_s, FP_SP, gen_ff, gen_helper_frsqrt_s)
 TRANS(frsqrt_d, FP_DP, gen_ff, gen_helper_frsqrt_d)
-TRANS(flogb_s, FP_SP, gen_ff, gen_helper_flogb_s)
-TRANS(flogb_d, FP_DP, gen_ff, gen_helper_flogb_d)
+TRANS64(flogb_s, FP_SP, gen_ff, gen_helper_flogb_s)
+TRANS64(flogb_d, FP_DP, gen_ff, gen_helper_flogb_d)
 TRANS(fclass_s, FP_SP, gen_ff, gen_helper_fclass_s)
 TRANS(fclass_d, FP_DP, gen_ff, gen_helper_fclass_d)
 TRANS(fmadd_s, FP_SP, gen_muladd, gen_helper_fmuladd_s, 0)
diff --git a/target/loongarch/tcg/insn_trans/trans_fcnv.c.inc b/target/loongarch/tcg/insn_trans/trans_fcnv.c.inc
index 833c059d6d..ca1d76a366 100644
--- a/target/loongarch/tcg/insn_trans/trans_fcnv.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_fcnv.c.inc
@@ -29,5 +29,5 @@ TRANS(ffint_s_w, FP_SP, gen_ff, gen_helper_ffint_s_w)
 TRANS(ffint_s_l, FP_SP, gen_ff, gen_helper_ffint_s_l)
 TRANS(ffint_d_w, FP_DP, gen_ff, gen_helper_ffint_d_w)
 TRANS(ffint_d_l, FP_DP, gen_ff, gen_helper_ffint_d_l)
-TRANS(frint_s, FP_SP, gen_ff, gen_helper_frint_s)
-TRANS(frint_d, FP_DP, gen_ff, gen_helper_frint_d)
+TRANS64(frint_s, FP_SP, gen_ff, gen_helper_frint_s)
+TRANS64(frint_d, FP_DP, gen_ff, gen_helper_frint_d)
diff --git a/target/loongarch/tcg/insn_trans/trans_fmemory.c.inc b/target/loongarch/tcg/insn_trans/trans_fmemory.c.inc
index 13452bc7e5..79da4718a5 100644
--- a/target/loongarch/tcg/insn_trans/trans_fmemory.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_fmemory.c.inc
@@ -148,11 +148,11 @@ TRANS(fldx_s, FP_SP, gen_floadx, MO_TEUL)
 TRANS(fldx_d, FP_DP, gen_floadx, MO_TEUQ)
 TRANS(fstx_s, FP_SP, gen_fstorex, MO_TEUL)
 TRANS(fstx_d, FP_DP, gen_fstorex, MO_TEUQ)
-TRANS(fldgt_s, FP_SP, gen_fload_gt, MO_TEUL)
-TRANS(fldgt_d, FP_DP, gen_fload_gt, MO_TEUQ)
-TRANS(fldle_s, FP_SP, gen_fload_le, MO_TEUL)
-TRANS(fldle_d, FP_DP, gen_fload_le, MO_TEUQ)
-TRANS(fstgt_s, FP_SP, gen_fstore_gt, MO_TEUL)
-TRANS(fstgt_d, FP_DP, gen_fstore_gt, MO_TEUQ)
-TRANS(fstle_s, FP_SP, gen_fstore_le, MO_TEUL)
-TRANS(fstle_d, FP_DP, gen_fstore_le, MO_TEUQ)
+TRANS64(fldgt_s, FP_SP, gen_fload_gt, MO_TEUL)
+TRANS64(fldgt_d, FP_DP, gen_fload_gt, MO_TEUQ)
+TRANS64(fldle_s, FP_SP, gen_fload_le, MO_TEUL)
+TRANS64(fldle_d, FP_DP, gen_fload_le, MO_TEUQ)
+TRANS64(fstgt_s, FP_SP, gen_fstore_gt, MO_TEUL)
+TRANS64(fstgt_d, FP_DP, gen_fstore_gt, MO_TEUQ)
+TRANS64(fstle_s, FP_SP, gen_fstore_le, MO_TEUL)
+TRANS64(fstle_d, FP_DP, gen_fstore_le, MO_TEUQ)
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index ecbfe23b63..34cfab8879 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -233,11 +233,11 @@ static bool gen_iocsrwr(DisasContext *ctx, arg_rr *a,
 TRANS(iocsrrd_b, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_b)
 TRANS(iocsrrd_h, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_h)
 TRANS(iocsrrd_w, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_w)
-TRANS(iocsrrd_d, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_d)
+TRANS64(iocsrrd_d, IOCSR, gen_iocsrrd, gen_helper_iocsrrd_d)
 TRANS(iocsrwr_b, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_b)
 TRANS(iocsrwr_h, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_h)
 TRANS(iocsrwr_w, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_w)
-TRANS(iocsrwr_d, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_d)
+TRANS64(iocsrwr_d, IOCSR, gen_iocsrwr, gen_helper_iocsrwr_d)
 
 static void check_mmu_idx(DisasContext *ctx)
 {
diff --git a/target/loongarch/tcg/insn_trans/trans_shift.c.inc b/target/loongarch/tcg/insn_trans/trans_shift.c.inc
index 377307785a..136c4c8455 100644
--- a/target/loongarch/tcg/insn_trans/trans_shift.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_shift.c.inc
@@ -78,7 +78,7 @@ TRANS(sra_w, ALL, gen_rrr, EXT_SIGN, EXT_NONE, EXT_SIGN, gen_sra_w)
 TRANS(sll_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sll_d)
 TRANS(srl_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_srl_d)
 TRANS(sra_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_sra_d)
-TRANS(rotr_w, 64, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
+TRANS(rotr_w, ALL, gen_rrr, EXT_ZERO, EXT_NONE, EXT_SIGN, gen_rotr_w)
 TRANS(rotr_d, 64, gen_rrr, EXT_NONE, EXT_NONE, EXT_NONE, gen_rotr_d)
 TRANS(slli_w, ALL, gen_rri_c, EXT_NONE, EXT_SIGN, tcg_gen_shli_tl)
 TRANS(slli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shli_tl)
@@ -86,5 +86,5 @@ TRANS(srli_w, ALL, gen_rri_c, EXT_ZERO, EXT_SIGN, tcg_gen_shri_tl)
 TRANS(srli_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_shri_tl)
 TRANS(srai_w, ALL, gen_rri_c, EXT_NONE, EXT_NONE, gen_sari_w)
 TRANS(srai_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_sari_tl)
-TRANS(rotri_w, 64, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
+TRANS(rotri_w, ALL, gen_rri_v, EXT_NONE, EXT_NONE, gen_rotr_w)
 TRANS(rotri_d, 64, gen_rri_c, EXT_NONE, EXT_NONE, tcg_gen_rotri_tl)
diff --git a/target/loongarch/translate.h b/target/loongarch/translate.h
index 018dc5eb17..bbe015ba57 100644
--- a/target/loongarch/translate.h
+++ b/target/loongarch/translate.h
@@ -14,6 +14,10 @@
     static bool trans_##NAME(DisasContext *ctx, arg_##NAME * a) \
     { return avail_##AVAIL(ctx) && FUNC(ctx, a, __VA_ARGS__); }
 
+#define TRANS64(NAME, AVAIL, FUNC, ...) \
+    static bool trans_##NAME(DisasContext *ctx, arg_##NAME * a) \
+    { return avail_64(ctx) && avail_##AVAIL(ctx) && FUNC(ctx, a, __VA_ARGS__); }
+
 #define avail_ALL(C)   true
 #define avail_64(C)    (FIELD_EX32((C)->cpucfg1, CPUCFG1, ARCH) == \
                         CPUCFG1_ARCH_LA64)

From 86bca40402316891b8b9a920c2e3bf8cf37ba9a4 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 1 Aug 2025 08:01:52 +0200
Subject: [PATCH 0094/2396] hw/intc/loongarch_pch_pic: Fix ubsan warning and
 endianness issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When booting the Linux kernel from tests/functional/test_loongarch64_virt.py
with a QEMU that has been compiled with --enable-ubsan, there is
a warning like this:

 .../hw/intc/loongarch_pch_pic.c:171:46: runtime error: index 512 out of
  bounds for type 'uint8_t[64]' (aka 'unsigned char[64]')
 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
  .../hw/intc/loongarch_pch_pic.c:171:46
 .../hw/intc/loongarch_pch_pic.c:175:45: runtime error: index 256 out of
  bounds for type 'uint8_t[64]' (aka 'unsigned char[64]')
 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior
  .../hw/intc/loongarch_pch_pic.c:175:45

It happens because "addr" is added first before substracting the base
(PCH_PIC_HTMSI_VEC or PCH_PIC_ROUTE_ENTRY).
Additionally, this code looks like it is not endianness safe, since
it uses a 64-bit pointer to write values into an array of 8-bit values.

Thus rework the code to use the stq_le_p / ldq_le_p helpers here
and make sure that we do not create pointers with undefined behavior
by accident.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/intc/loongarch_pch_pic.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/hw/intc/loongarch_pch_pic.c b/hw/intc/loongarch_pch_pic.c
index c4b242dbf4..32f01aabf0 100644
--- a/hw/intc/loongarch_pch_pic.c
+++ b/hw/intc/loongarch_pch_pic.c
@@ -110,10 +110,10 @@ static uint64_t pch_pic_read(void *opaque, hwaddr addr, uint64_t field_mask)
         val = s->int_polarity;
         break;
     case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        val = *(uint64_t *)(s->htmsi_vector + addr - PCH_PIC_HTMSI_VEC);
+        val = ldq_le_p(&s->htmsi_vector[addr - PCH_PIC_HTMSI_VEC]);
         break;
     case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        val = *(uint64_t *)(s->route_entry + addr - PCH_PIC_ROUTE_ENTRY);
+        val = ldq_le_p(&s->route_entry[addr - PCH_PIC_ROUTE_ENTRY]);
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,
@@ -129,7 +129,8 @@ static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
 {
     LoongArchPICCommonState *s = LOONGARCH_PIC_COMMON(opaque);
     uint32_t offset;
-    uint64_t old, mask, data, *ptemp;
+    uint64_t old, mask, data;
+    void *ptemp;
 
     offset = addr & 7;
     addr -= offset;
@@ -168,12 +169,12 @@ static void pch_pic_write(void *opaque, hwaddr addr, uint64_t value,
         s->int_polarity = (s->int_polarity & ~mask) | data;
         break;
     case PCH_PIC_HTMSI_VEC ... PCH_PIC_HTMSI_VEC_END:
-        ptemp = (uint64_t *)(s->htmsi_vector + addr - PCH_PIC_HTMSI_VEC);
-        *ptemp = (*ptemp & ~mask) | data;
+        ptemp = &s->htmsi_vector[addr - PCH_PIC_HTMSI_VEC];
+        stq_le_p(ptemp, (ldq_le_p(ptemp) & ~mask) | data);
         break;
     case PCH_PIC_ROUTE_ENTRY ... PCH_PIC_ROUTE_ENTRY_END:
-        ptemp = (uint64_t *)(s->route_entry + addr - PCH_PIC_ROUTE_ENTRY);
-        *ptemp = (*ptemp & ~mask) | data;
+        ptemp = (uint64_t *)&s->route_entry[addr - PCH_PIC_ROUTE_ENTRY];
+        stq_le_p(ptemp, (ldq_le_p(ptemp) & ~mask) | data);
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR,

From de3c9f552d8d6af5e1a5f28eb93c836080715796 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 8 Jul 2025 15:22:37 +0800
Subject: [PATCH 0095/2396] target/loongarch: Move some function definition to
 kvm directory

Move function definition specified with kvm to the corresponding
directory. Also remove header file "cpu.h" including outside of
macro QEMU_KVM_LOONGARCH_H.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/loongarch/virt.c                  | 1 +
 target/loongarch/cpu.h               | 9 ---------
 target/loongarch/kvm/kvm_loongarch.h | 4 ++--
 3 files changed, 3 insertions(+), 11 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index b15ada2078..31215b7785 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -46,6 +46,7 @@
 #include "hw/block/flash.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "qemu/error-report.h"
+#include "kvm/kvm_loongarch.h"
 
 static void virt_get_veiointc(Object *obj, Visitor *v, const char *name,
                               void *opaque, Error **errp)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 9538e8d61d..bbe6db33f1 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -496,13 +496,4 @@ static inline void set_pc(CPULoongArchState *env, uint64_t value)
 
 void loongarch_cpu_post_init(Object *obj);
 
-#ifdef CONFIG_KVM
-void kvm_loongarch_cpu_post_init(LoongArchCPU *cpu);
-#else
-static inline void kvm_loongarch_cpu_post_init(LoongArchCPU *cpu)
-{
-}
-#endif
-void kvm_loongarch_init_irq_routing(void);
-
 #endif /* LOONGARCH_CPU_H */
diff --git a/target/loongarch/kvm/kvm_loongarch.h b/target/loongarch/kvm/kvm_loongarch.h
index 1051a341ec..51475675d6 100644
--- a/target/loongarch/kvm/kvm_loongarch.h
+++ b/target/loongarch/kvm/kvm_loongarch.h
@@ -5,11 +5,11 @@
  * Copyright (c) 2023 Loongson Technology Corporation Limited
  */
 
-#include "cpu.h"
-
 #ifndef QEMU_KVM_LOONGARCH_H
 #define QEMU_KVM_LOONGARCH_H
 
+void kvm_loongarch_cpu_post_init(LoongArchCPU *cpu);
+void kvm_loongarch_init_irq_routing(void);
 int  kvm_loongarch_set_interrupt(LoongArchCPU *cpu, int irq, int level);
 void kvm_arch_reset_vcpu(CPUState *cs);
 

From 982d7674ff4ed1affc4dadba2c6f6ab1b1df4e97 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 8 Jul 2025 15:35:12 +0800
Subject: [PATCH 0096/2396] target/loongarch: Define function
 loongarch_cpu_post_init as static

Function loongarch_cpu_post_init() is implemented and used in the
same file target/loongarch/cpu.c, it can be defined as static function.

This patch moves implementation about function loongarch_cpu_post_init()
before it is referenced. And it is only code movement, no function
change.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu.c | 180 ++++++++++++++++++++---------------------
 target/loongarch/cpu.h |   2 -
 2 files changed, 90 insertions(+), 92 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index abad84c054..b96429ffb1 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -422,6 +422,96 @@ static void loongarch_la464_init_csr(Object *obj)
 #endif
 }
 
+static bool loongarch_get_lsx(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->lsx != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+    uint32_t val;
+
+    cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    if (cpu->lsx == ON_OFF_AUTO_OFF) {
+        cpu->lasx = ON_OFF_AUTO_OFF;
+        if (cpu->lasx == ON_OFF_AUTO_ON) {
+            error_setg(errp, "Failed to disable LSX since LASX is enabled");
+            return;
+        }
+    }
+
+    if (kvm_enabled()) {
+        /* kvm feature detection in function kvm_arch_init_vcpu */
+        return;
+    }
+
+    /* LSX feature detection in TCG mode */
+    val = cpu->env.cpucfg[2];
+    if (cpu->lsx == ON_OFF_AUTO_ON) {
+        if (FIELD_EX32(val, CPUCFG2, LSX) == 0) {
+            error_setg(errp, "Failed to enable LSX in TCG mode");
+            return;
+        }
+    } else {
+        cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, 0);
+        val = cpu->env.cpucfg[2];
+    }
+
+    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
+}
+
+static bool loongarch_get_lasx(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->lasx != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+    uint32_t val;
+
+    cpu->lasx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+    if ((cpu->lsx == ON_OFF_AUTO_OFF) && (cpu->lasx == ON_OFF_AUTO_ON)) {
+        error_setg(errp, "Failed to enable LASX since lSX is disabled");
+        return;
+    }
+
+    if (kvm_enabled()) {
+        /* kvm feature detection in function kvm_arch_init_vcpu */
+        return;
+    }
+
+    /* LASX feature detection in TCG mode */
+    val = cpu->env.cpucfg[2];
+    if (cpu->lasx == ON_OFF_AUTO_ON) {
+        if (FIELD_EX32(val, CPUCFG2, LASX) == 0) {
+            error_setg(errp, "Failed to enable LASX in TCG mode");
+            return;
+        }
+    }
+
+    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, value);
+}
+
+static void loongarch_cpu_post_init(Object *obj)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
+    cpu->lbt = ON_OFF_AUTO_OFF;
+    cpu->pmu = ON_OFF_AUTO_OFF;
+    cpu->lsx = ON_OFF_AUTO_AUTO;
+    cpu->lasx = ON_OFF_AUTO_AUTO;
+    object_property_add_bool(obj, "lsx", loongarch_get_lsx,
+                             loongarch_set_lsx);
+    object_property_add_bool(obj, "lasx", loongarch_get_lasx,
+                             loongarch_set_lasx);
+    /* lbt is enabled only in kvm mode, not supported in tcg mode */
+    if (kvm_enabled()) {
+        kvm_loongarch_cpu_post_init(cpu);
+    }
+}
+
 static void loongarch_la464_initfn(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
@@ -683,96 +773,6 @@ static void loongarch_cpu_unrealizefn(DeviceState *dev)
     lacc->parent_unrealize(dev);
 }
 
-static bool loongarch_get_lsx(Object *obj, Error **errp)
-{
-    return LOONGARCH_CPU(obj)->lsx != ON_OFF_AUTO_OFF;
-}
-
-static void loongarch_set_lsx(Object *obj, bool value, Error **errp)
-{
-    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-    uint32_t val;
-
-    cpu->lsx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
-    if (cpu->lsx == ON_OFF_AUTO_OFF) {
-        cpu->lasx = ON_OFF_AUTO_OFF;
-        if (cpu->lasx == ON_OFF_AUTO_ON) {
-            error_setg(errp, "Failed to disable LSX since LASX is enabled");
-            return;
-        }
-    }
-
-    if (kvm_enabled()) {
-        /* kvm feature detection in function kvm_arch_init_vcpu */
-        return;
-    }
-
-    /* LSX feature detection in TCG mode */
-    val = cpu->env.cpucfg[2];
-    if (cpu->lsx == ON_OFF_AUTO_ON) {
-        if (FIELD_EX32(val, CPUCFG2, LSX) == 0) {
-            error_setg(errp, "Failed to enable LSX in TCG mode");
-            return;
-        }
-    } else {
-        cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, 0);
-        val = cpu->env.cpucfg[2];
-    }
-
-    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LSX, value);
-}
-
-static bool loongarch_get_lasx(Object *obj, Error **errp)
-{
-    return LOONGARCH_CPU(obj)->lasx != ON_OFF_AUTO_OFF;
-}
-
-static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
-{
-    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-    uint32_t val;
-
-    cpu->lasx = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
-    if ((cpu->lsx == ON_OFF_AUTO_OFF) && (cpu->lasx == ON_OFF_AUTO_ON)) {
-        error_setg(errp, "Failed to enable LASX since lSX is disabled");
-        return;
-    }
-
-    if (kvm_enabled()) {
-        /* kvm feature detection in function kvm_arch_init_vcpu */
-        return;
-    }
-
-    /* LASX feature detection in TCG mode */
-    val = cpu->env.cpucfg[2];
-    if (cpu->lasx == ON_OFF_AUTO_ON) {
-        if (FIELD_EX32(val, CPUCFG2, LASX) == 0) {
-            error_setg(errp, "Failed to enable LASX in TCG mode");
-            return;
-        }
-    }
-
-    cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, value);
-}
-
-void loongarch_cpu_post_init(Object *obj)
-{
-    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-
-    cpu->lbt = ON_OFF_AUTO_OFF;
-    cpu->pmu = ON_OFF_AUTO_OFF;
-    cpu->lsx = ON_OFF_AUTO_AUTO;
-    cpu->lasx = ON_OFF_AUTO_AUTO;
-    object_property_add_bool(obj, "lsx", loongarch_get_lsx,
-                             loongarch_set_lsx);
-    object_property_add_bool(obj, "lasx", loongarch_get_lasx,
-                             loongarch_set_lasx);
-    /* lbt is enabled only in kvm mode, not supported in tcg mode */
-    if (kvm_enabled()) {
-        kvm_loongarch_cpu_post_init(cpu);
-    }
-}
-
 static void loongarch_cpu_init(Object *obj)
 {
 #ifndef CONFIG_USER_ONLY
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index bbe6db33f1..7731f6acdc 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -494,6 +494,4 @@ static inline void set_pc(CPULoongArchState *env, uint64_t value)
 
 #define CPU_RESOLVING_TYPE TYPE_LOONGARCH_CPU
 
-void loongarch_cpu_post_init(Object *obj);
-
 #endif /* LOONGARCH_CPU_H */

From 198c827ca5d3bee6aa0c498f25f5ea6928f57de2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 16 Jul 2025 09:45:47 +0800
Subject: [PATCH 0097/2396] target/loongarch: Set page size in TLB entry with
 STLB

With VTLB different TLB entry may have different page size, and
page size is set in PS field of TLB entry. However with STLB, all
the TLB entries have the same page size, page size comes from register
CSR_STLBPS, PS field of TLB entry is not used.

Here PS field of TLB entry is used with all TLB entries, even with
STLB. It is convenient with TLB maintainance operation.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 41 ++++++++-----------------------
 1 file changed, 10 insertions(+), 31 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 8872593ff0..3ea0e153b1 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -110,11 +110,8 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     if (!tlb_e) {
         return;
     }
-    if (index >= LOONGARCH_STLB) {
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-    } else {
-        tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    }
+
+    tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
 
@@ -173,11 +170,8 @@ static void fill_tlb_entry(CPULoongArchState *env, int index)
         lo1 = env->CSR_TLBELO1;
     }
 
-    /* Only MTLB has the ps fields */
-    if (index >= LOONGARCH_STLB) {
-        tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, PS, csr_ps);
-    }
-
+    /* Store page size in field PS */
+    tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, PS, csr_ps);
     tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, VPPN, csr_vppn);
     tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 1);
     csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
@@ -283,12 +277,7 @@ void helper_tlbrd(CPULoongArchState *env)
 
     index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
     tlb = &env->tlb[index];
-
-    if (index >= LOONGARCH_STLB) {
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-    } else {
-        tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    }
+    tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
     if (!tlb_e) {
@@ -476,11 +465,8 @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
         if (!tlb_e) {
             continue;
         }
-        if (i >= LOONGARCH_STLB) {
-            tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-        } else {
-            tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-        }
+
+        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
@@ -509,11 +495,8 @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
         if (!tlb_e) {
             continue;
         }
-        if (i >= LOONGARCH_STLB) {
-            tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-        } else {
-            tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-        }
+
+        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
         tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
         vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
         compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
@@ -673,11 +656,7 @@ static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
     uint64_t tlb_entry, tlb_ppn;
     uint8_t tlb_ps, n, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
 
-    if (index >= LOONGARCH_STLB) {
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-    } else {
-        tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
-    }
+    tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     n = (address >> tlb_ps) & 0x1;/* Odd or even */
 
     tlb_entry = n ? tlb->tlb_entry1 : tlb->tlb_entry0;

From a3d4bc4845911d82162f5be782f73e9742a41306 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 8 Jul 2025 16:10:20 +0800
Subject: [PATCH 0098/2396] target/loongarch: Add header file cpu-mmu.h

New header file cpu-mmu.h is added and move mmu relative function
declaration to this file.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu-mmu.h        | 30 ++++++++++++++++++++++++++++++
 target/loongarch/cpu.c            |  1 +
 target/loongarch/cpu_helper.c     |  1 +
 target/loongarch/internals.h      | 20 --------------------
 target/loongarch/tcg/csr_helper.c |  1 +
 target/loongarch/tcg/tlb_helper.c |  1 +
 6 files changed, 34 insertions(+), 20 deletions(-)
 create mode 100644 target/loongarch/cpu-mmu.h

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
new file mode 100644
index 0000000000..4c5cbd7425
--- /dev/null
+++ b/target/loongarch/cpu-mmu.h
@@ -0,0 +1,30 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch CPU parameters for QEMU.
+ *
+ * Copyright (c) 2025 Loongson Technology Corporation Limited
+ */
+
+#ifndef LOONGARCH_CPU_MMU_H
+#define LOONGARCH_CPU_MMU_H
+
+enum {
+    TLBRET_MATCH = 0,
+    TLBRET_BADADDR = 1,
+    TLBRET_NOMATCH = 2,
+    TLBRET_INVALID = 3,
+    TLBRET_DIRTY = 4,
+    TLBRET_RI = 5,
+    TLBRET_XI = 6,
+    TLBRET_PE = 7,
+};
+
+bool check_ps(CPULoongArchState *ent, uint8_t ps);
+int get_physical_address(CPULoongArchState *env, hwaddr *physical,
+                         int *prot, target_ulong address,
+                         MMUAccessType access_type, int mmu_idx, int is_debug);
+void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
+                               uint64_t *dir_width, target_ulong level);
+hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
+
+#endif  /* LOONGARCH_CPU_MMU_H */
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index b96429ffb1..990985708e 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -17,6 +17,7 @@
 #include "hw/qdev-properties.h"
 #include "exec/translation-block.h"
 #include "cpu.h"
+#include "cpu-mmu.h"
 #include "internals.h"
 #include "fpu/softfloat-helpers.h"
 #include "csr.h"
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index b5f732f15b..418122f447 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -13,6 +13,7 @@
 #include "exec/target_page.h"
 #include "internals.h"
 #include "cpu-csr.h"
+#include "cpu-mmu.h"
 #include "tcg/tcg_loongarch.h"
 
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index a7384b0d31..e50d109767 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -32,19 +32,6 @@ void restore_fp_status(CPULoongArchState *env);
 #endif
 
 #ifndef CONFIG_USER_ONLY
-enum {
-    TLBRET_MATCH = 0,
-    TLBRET_BADADDR = 1,
-    TLBRET_NOMATCH = 2,
-    TLBRET_INVALID = 3,
-    TLBRET_DIRTY = 4,
-    TLBRET_RI = 5,
-    TLBRET_XI = 6,
-    TLBRET_PE = 7,
-};
-
-bool check_ps(CPULoongArchState *ent, uint8_t ps);
-
 extern const VMStateDescription vmstate_loongarch_cpu;
 
 void loongarch_cpu_set_irq(void *opaque, int irq, int level);
@@ -54,13 +41,6 @@ uint64_t cpu_loongarch_get_constant_timer_counter(LoongArchCPU *cpu);
 uint64_t cpu_loongarch_get_constant_timer_ticks(LoongArchCPU *cpu);
 void cpu_loongarch_store_constant_timer_config(LoongArchCPU *cpu,
                                                uint64_t value);
-int get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                         int *prot, target_ulong address,
-                         MMUAccessType access_type, int mmu_idx, int is_debug);
-void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
-                               uint64_t *dir_width, target_ulong level);
-hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
-
 #endif /* !CONFIG_USER_ONLY */
 
 uint64_t read_fcc(CPULoongArchState *env);
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 28b1bb86bd..0d99e2c92b 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -16,6 +16,7 @@
 #include "accel/tcg/cpu-ldst.h"
 #include "hw/irq.h"
 #include "cpu-csr.h"
+#include "cpu-mmu.h"
 
 target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
 {
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 3ea0e153b1..1f49619e7f 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -10,6 +10,7 @@
 #include "qemu/guest-random.h"
 
 #include "cpu.h"
+#include "cpu-mmu.h"
 #include "internals.h"
 #include "exec/helper-proto.h"
 #include "exec/cputlb.h"

From 912f75eaed5f686fe0f312e8ac797be7c1f43b0e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 10:44:51 +0800
Subject: [PATCH 0099/2396] target/loongarch: Add enum type TLBRet definition

There is mixed usage between enum variable TLBRET_xxx and int type,
here add enum type TLBRet definition and replace int type variable
with enum type TLBRet in some functions.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu-mmu.h           | 27 ++++++++++++++-------------
 target/loongarch/cpu_helper.c        | 26 ++++++++++++++------------
 target/loongarch/tcg/tcg_loongarch.h |  7 ++++---
 target/loongarch/tcg/tlb_helper.c    | 16 ++++++++--------
 4 files changed, 40 insertions(+), 36 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index 4c5cbd7425..cbe6f37773 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -8,21 +8,22 @@
 #ifndef LOONGARCH_CPU_MMU_H
 #define LOONGARCH_CPU_MMU_H
 
-enum {
-    TLBRET_MATCH = 0,
-    TLBRET_BADADDR = 1,
-    TLBRET_NOMATCH = 2,
-    TLBRET_INVALID = 3,
-    TLBRET_DIRTY = 4,
-    TLBRET_RI = 5,
-    TLBRET_XI = 6,
-    TLBRET_PE = 7,
-};
+typedef enum TLBRet {
+    TLBRET_MATCH,
+    TLBRET_BADADDR,
+    TLBRET_NOMATCH,
+    TLBRET_INVALID,
+    TLBRET_DIRTY,
+    TLBRET_RI,
+    TLBRET_XI,
+    TLBRET_PE,
+} TLBRet;
 
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
-int get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                         int *prot, target_ulong address,
-                         MMUAccessType access_type, int mmu_idx, int is_debug);
+TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
+                            int *prot, target_ulong address,
+                            MMUAccessType access_type, int mmu_idx,
+                            int is_debug);
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                                uint64_t *dir_width, target_ulong level);
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 418122f447..17a0735f5c 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -44,8 +44,9 @@ void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
     }
 }
 
-static int loongarch_page_table_walker(CPULoongArchState *env, hwaddr *physical,
-                                 int *prot, target_ulong address)
+static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
+                                          hwaddr *physical,
+                                          int *prot, target_ulong address)
 {
     CPUState *cs = env_cpu(env);
     target_ulong index, phys;
@@ -116,15 +117,15 @@ static int loongarch_page_table_walker(CPULoongArchState *env, hwaddr *physical,
     /* mask other attribute bits */
     *physical = base & TARGET_PAGE_MASK;
 
-    return 0;
+    return TLBRET_MATCH;
 }
 
-static int loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
-                                 int *prot, target_ulong address,
-                                 MMUAccessType access_type, int mmu_idx,
-                                 int is_debug)
+static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
+                                    int *prot, target_ulong address,
+                                    MMUAccessType access_type, int mmu_idx,
+                                    int is_debug)
 {
-    int ret;
+    TLBRet ret;
 
     if (tcg_enabled()) {
         ret = loongarch_get_addr_from_tlb(env, physical, prot, address,
@@ -158,9 +159,10 @@ static hwaddr dmw_va2pa(CPULoongArchState *env, target_ulong va,
     }
 }
 
-int get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                         int *prot, target_ulong address,
-                         MMUAccessType access_type, int mmu_idx, int is_debug)
+TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
+                            int *prot, target_ulong address,
+                            MMUAccessType access_type, int mmu_idx,
+                            int is_debug)
 {
     int user_mode = mmu_idx == MMU_USER_IDX;
     int kernel_mode = mmu_idx == MMU_KERNEL_IDX;
@@ -214,7 +216,7 @@ hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
     int prot;
 
     if (get_physical_address(env, &phys_addr, &prot, addr, MMU_DATA_LOAD,
-                             cpu_mmu_index(cs, false), 1) != 0) {
+                             cpu_mmu_index(cs, false), 1) != TLBRET_MATCH) {
         return -1;
     }
     return phys_addr;
diff --git a/target/loongarch/tcg/tcg_loongarch.h b/target/loongarch/tcg/tcg_loongarch.h
index fd4e116022..488700c3c3 100644
--- a/target/loongarch/tcg/tcg_loongarch.h
+++ b/target/loongarch/tcg/tcg_loongarch.h
@@ -7,6 +7,7 @@
 #ifndef TARGET_LOONGARCH_TCG_LOONGARCH_H
 #define TARGET_LOONGARCH_TCG_LOONGARCH_H
 #include "cpu.h"
+#include "cpu-mmu.h"
 
 void loongarch_csr_translate_init(void);
 
@@ -14,8 +15,8 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                             MMUAccessType access_type, int mmu_idx,
                             bool probe, uintptr_t retaddr);
 
-int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                int *prot, target_ulong address,
-                                MMUAccessType access_type, int mmu_idx);
+TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                   int *prot, target_ulong address,
+                                   MMUAccessType access_type, int mmu_idx);
 
 #endif  /* TARGET_LOONGARCH_TCG_LOONGARCH_H */
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 1f49619e7f..4a2a565985 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -30,7 +30,7 @@ bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
 }
 
 static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
-                                MMUAccessType access_type, int tlb_error)
+                                MMUAccessType access_type, TLBRet tlb_error)
 {
     CPUState *cs = env_cpu(env);
 
@@ -517,7 +517,7 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     CPULoongArchState *env = cpu_env(cs);
     hwaddr physical;
     int prot;
-    int ret;
+    TLBRet ret;
 
     /* Data access */
     ret = get_physical_address(env, &physical, &prot, address,
@@ -648,9 +648,9 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
     env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI, PS, ps);
 }
 
-static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
-                                   int *prot, target_ulong address,
-                                   int access_type, int index, int mmu_idx)
+static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
+                                      int *prot, target_ulong address,
+                                      int access_type, int index, int mmu_idx)
 {
     LoongArchTLB *tlb = &env->tlb[index];
     uint64_t plv = mmu_idx;
@@ -713,9 +713,9 @@ static int loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
     return TLBRET_MATCH;
 }
 
-int loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                int *prot, target_ulong address,
-                                MMUAccessType access_type, int mmu_idx)
+TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
+                                   int *prot, target_ulong address,
+                                   MMUAccessType access_type, int mmu_idx)
 {
     int index, match;
 

From 82cd0be29b603ef620f45053a406bdb4a3221563 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 11:29:32 +0800
Subject: [PATCH 0100/2396] target/loongarch: Use vaddr in
 get_physical_address()

Replace target_ulong type with vaddr in function get_physical_address()
and the same with its calling functions.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu-mmu.h        |  2 +-
 target/loongarch/cpu_helper.c     |  9 ++++-----
 target/loongarch/tcg/tlb_helper.c | 11 ++++++-----
 3 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index cbe6f37773..dffc12820f 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -21,7 +21,7 @@ typedef enum TLBRet {
 
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
 TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                            int *prot, target_ulong address,
+                            int *prot, vaddr address,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug);
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 17a0735f5c..0c037ef163 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -46,7 +46,7 @@ void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
 
 static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
                                           hwaddr *physical,
-                                          int *prot, target_ulong address)
+                                          int *prot, vaddr address)
 {
     CPUState *cs = env_cpu(env);
     target_ulong index, phys;
@@ -121,7 +121,7 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
 }
 
 static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
-                                    int *prot, target_ulong address,
+                                    int *prot, vaddr address,
                                     MMUAccessType access_type, int mmu_idx,
                                     int is_debug)
 {
@@ -147,8 +147,7 @@ static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
     return TLBRET_NOMATCH;
 }
 
-static hwaddr dmw_va2pa(CPULoongArchState *env, target_ulong va,
-                        target_ulong dmw)
+static hwaddr dmw_va2pa(CPULoongArchState *env, vaddr va, target_ulong dmw)
 {
     if (is_la64(env)) {
         return va & TARGET_VIRT_MASK;
@@ -160,7 +159,7 @@ static hwaddr dmw_va2pa(CPULoongArchState *env, target_ulong va,
 }
 
 TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                            int *prot, target_ulong address,
+                            int *prot, vaddr address,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug)
 {
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 4a2a565985..3d09f18020 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -29,7 +29,7 @@ bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
     return BIT_ULL(tlb_ps) & (env->CSR_PRCFG2);
 }
 
-static void raise_mmu_exception(CPULoongArchState *env, target_ulong address,
+static void raise_mmu_exception(CPULoongArchState *env, vaddr address,
                                 MMUAccessType access_type, TLBRet tlb_error)
 {
     CPUState *cs = env_cpu(env);
@@ -198,7 +198,7 @@ static uint32_t get_random_tlb(uint32_t low, uint32_t high)
  * field in tlb entry contains bit[47:13], so need adjust.
  * virt_vpn = vaddr[47:13]
  */
-static bool loongarch_tlb_search(CPULoongArchState *env, target_ulong vaddr,
+static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
                                  int *index)
 {
     LoongArchTLB *tlb;
@@ -649,8 +649,9 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
 }
 
 static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
-                                      int *prot, target_ulong address,
-                                      int access_type, int index, int mmu_idx)
+                                      int *prot, vaddr address,
+                                      int access_type, int index,
+                                      int mmu_idx)
 {
     LoongArchTLB *tlb = &env->tlb[index];
     uint64_t plv = mmu_idx;
@@ -714,7 +715,7 @@ static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
 }
 
 TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                   int *prot, target_ulong address,
+                                   int *prot, vaddr address,
                                    MMUAccessType access_type, int mmu_idx)
 {
     int index, match;

From e6c855f44ad63b5e94bc3d27adca12c24ce7953d Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 11:38:35 +0800
Subject: [PATCH 0101/2396] target/loongarch: Use MMUAccessType in
 loongarch_map_tlb_entry()

Enum type MMUAccessType is used in function loongarch_map_tlb_entry()
rather than int type, and keep consistent with its caller function.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 3d09f18020..915b1aadb5 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -650,7 +650,7 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
 
 static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
                                       int *prot, vaddr address,
-                                      int access_type, int index,
+                                      MMUAccessType access_type, int index,
                                       int mmu_idx)
 {
     LoongArchTLB *tlb = &env->tlb[index];

From 7392cb1c7b24e34987b6f2bbff00c39fe0829cc9 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 12:03:43 +0800
Subject: [PATCH 0102/2396] target/loongarch: Add common function
 loongarch_check_pte()

Common function loongarch_check_pte() is to check tlb entry, return
the physical address and access priviledge if found. Also it can be
used with page table entry, which is used in page table walker.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu-mmu.h        | 10 +++++
 target/loongarch/cpu_helper.c     | 61 ++++++++++++++++++++++++++++
 target/loongarch/tcg/tlb_helper.c | 66 ++++++-------------------------
 3 files changed, 83 insertions(+), 54 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index dffc12820f..be3d11d3c1 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -19,7 +19,17 @@ typedef enum TLBRet {
     TLBRET_PE,
 } TLBRet;
 
+typedef struct MMUContext {
+    vaddr         addr;
+    uint64_t      pte;
+    hwaddr        physical;
+    int           ps;  /* page size shift */
+    int           prot;
+} MMUContext;
+
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
+TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
+                           MMUAccessType access_type, int mmu_idx);
 TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
                             int *prot, vaddr address,
                             MMUAccessType access_type, int mmu_idx,
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 0c037ef163..739cdab5aa 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -44,6 +44,67 @@ void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
     }
 }
 
+TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
+                           MMUAccessType access_type, int mmu_idx)
+{
+    uint64_t plv = mmu_idx;
+    uint64_t tlb_entry, tlb_ppn;
+    uint8_t tlb_ps, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
+
+    tlb_entry = context->pte;
+    tlb_ps = context->ps;
+    tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
+    tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
+    tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
+    if (is_la64(env)) {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
+        tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY_64, NX);
+        tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY_64, NR);
+        tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY_64, RPLV);
+    } else {
+        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_32, PPN);
+        tlb_nx = 0;
+        tlb_nr = 0;
+        tlb_rplv = 0;
+    }
+
+    /* Remove sw bit between bit12 -- bit PS*/
+    tlb_ppn = tlb_ppn & ~(((0x1UL << (tlb_ps - 12)) - 1));
+
+    /* Check access rights */
+    if (!tlb_v) {
+        return TLBRET_INVALID;
+    }
+
+    if (access_type == MMU_INST_FETCH && tlb_nx) {
+        return TLBRET_XI;
+    }
+
+    if (access_type == MMU_DATA_LOAD && tlb_nr) {
+        return TLBRET_RI;
+    }
+
+    if (((tlb_rplv == 0) && (plv > tlb_plv)) ||
+        ((tlb_rplv == 1) && (plv != tlb_plv))) {
+        return TLBRET_PE;
+    }
+
+    if ((access_type == MMU_DATA_STORE) && !tlb_d) {
+        return TLBRET_DIRTY;
+    }
+
+    context->physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
+                        (context->addr & MAKE_64BIT_MASK(0, tlb_ps));
+    context->prot = PAGE_READ;
+    if (tlb_d) {
+        context->prot |= PAGE_WRITE;
+    }
+    if (!tlb_nx) {
+        context->prot |= PAGE_EXEC;
+    }
+    return TLBRET_MATCH;
+}
+
 static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
                                           hwaddr *physical,
                                           int *prot, vaddr address)
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 915b1aadb5..10322da62e 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -654,64 +654,22 @@ static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
                                       int mmu_idx)
 {
     LoongArchTLB *tlb = &env->tlb[index];
-    uint64_t plv = mmu_idx;
-    uint64_t tlb_entry, tlb_ppn;
-    uint8_t tlb_ps, n, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
+    uint8_t tlb_ps, n;
+    MMUContext context;
+    TLBRet ret;
 
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     n = (address >> tlb_ps) & 0x1;/* Odd or even */
+    context.pte = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
+    context.addr = address;
+    context.ps = tlb_ps;
+    ret = loongarch_check_pte(env, &context, access_type, mmu_idx);
+    if (ret == TLBRET_MATCH) {
+        *physical = context.physical;
+        *prot = context.prot;
+     }
 
-    tlb_entry = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
-    tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
-    tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
-    tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
-    if (is_la64(env)) {
-        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
-        tlb_nx = FIELD_EX64(tlb_entry, TLBENTRY_64, NX);
-        tlb_nr = FIELD_EX64(tlb_entry, TLBENTRY_64, NR);
-        tlb_rplv = FIELD_EX64(tlb_entry, TLBENTRY_64, RPLV);
-    } else {
-        tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_32, PPN);
-        tlb_nx = 0;
-        tlb_nr = 0;
-        tlb_rplv = 0;
-    }
-
-    /* Remove sw bit between bit12 -- bit PS*/
-    tlb_ppn = tlb_ppn & ~(((0x1UL << (tlb_ps - 12)) - 1));
-
-    /* Check access rights */
-    if (!tlb_v) {
-        return TLBRET_INVALID;
-    }
-
-    if (access_type == MMU_INST_FETCH && tlb_nx) {
-        return TLBRET_XI;
-    }
-
-    if (access_type == MMU_DATA_LOAD && tlb_nr) {
-        return TLBRET_RI;
-    }
-
-    if (((tlb_rplv == 0) && (plv > tlb_plv)) ||
-        ((tlb_rplv == 1) && (plv != tlb_plv))) {
-        return TLBRET_PE;
-    }
-
-    if ((access_type == MMU_DATA_STORE) && !tlb_d) {
-        return TLBRET_DIRTY;
-    }
-
-    *physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
-                (address & MAKE_64BIT_MASK(0, tlb_ps));
-    *prot = PAGE_READ;
-    if (tlb_d) {
-        *prot |= PAGE_WRITE;
-    }
-    if (!tlb_nx) {
-        *prot |= PAGE_EXEC;
-    }
-    return TLBRET_MATCH;
+    return ret;
 }
 
 TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,

From 3dd4a2d0fc339c3cb321d69a0372cb9433786105 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 16:10:02 +0800
Subject: [PATCH 0103/2396] target/loongarch: Use loongarch_check_pte in
 loongarch_page_table_walker

Function loongarch_check_pte() can get physical address and access
priviledge, it works on both TLB entry and pte entry. It can be used
in function loongarch_page_table_walker() also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu_helper.c | 42 +++++++++++++----------------------
 1 file changed, 16 insertions(+), 26 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 739cdab5aa..cd61b33ef9 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -106,15 +106,17 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
 }
 
 static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
-                                          hwaddr *physical,
-                                          int *prot, vaddr address)
+                                          MMUContext *context,
+                                          int access_type, int mmu_idx)
 {
     CPUState *cs = env_cpu(env);
     target_ulong index, phys;
     uint64_t dir_base, dir_width;
     uint64_t base;
     int level;
+    vaddr address;
 
+    address = context->addr;
     if ((address >> 63) & 0x1) {
         base = env->CSR_PGDH;
     } else {
@@ -156,29 +158,9 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
         base = ldq_phys(cs->as, phys);
     }
 
-    /* TODO: check plv and other bits? */
-
-    /* base is pte, in normal pte format */
-    if (!FIELD_EX64(base, TLBENTRY, V)) {
-        return TLBRET_NOMATCH;
-    }
-
-    if (!FIELD_EX64(base, TLBENTRY, D)) {
-        *prot = PAGE_READ;
-    } else {
-        *prot = PAGE_READ | PAGE_WRITE;
-    }
-
-    /* get TARGET_PAGE_SIZE aligned physical address */
-    base += (address & TARGET_PHYS_MASK) & ((1 << dir_base) - 1);
-    /* mask RPLV, NX, NR bits */
-    base = FIELD_DP64(base, TLBENTRY_64, RPLV, 0);
-    base = FIELD_DP64(base, TLBENTRY_64, NX, 0);
-    base = FIELD_DP64(base, TLBENTRY_64, NR, 0);
-    /* mask other attribute bits */
-    *physical = base & TARGET_PAGE_MASK;
-
-    return TLBRET_MATCH;
+    context->ps = dir_base;
+    context->pte = base;
+    return loongarch_check_pte(env, context, access_type, mmu_idx);
 }
 
 static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
@@ -187,7 +169,9 @@ static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
                                     int is_debug)
 {
     TLBRet ret;
+    MMUContext context;
 
+    context.addr = address;
     if (tcg_enabled()) {
         ret = loongarch_get_addr_from_tlb(env, physical, prot, address,
                                           access_type, mmu_idx);
@@ -202,7 +186,13 @@ static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
          * legal mapping, even if the mapping is not yet in TLB. return 0 if
          * there is a valid map, else none zero.
          */
-        return loongarch_page_table_walker(env, physical, prot, address);
+        ret = loongarch_page_table_walker(env, &context, access_type, mmu_idx);
+        if (ret == TLBRET_MATCH) {
+            *physical = context.physical;
+            *prot = context.prot;
+        }
+
+        return ret;
     }
 
     return TLBRET_NOMATCH;

From 36055cf414b591ce2467631dbd5d8c32d4350263 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 16:40:25 +0800
Subject: [PATCH 0104/2396] target/loongarch: Use MMUConext in
 loongarch_map_tlb_entry()

With function loongarch_map_tlb_entry(), parameter MMUConext is added
and remove parameter physical, prot and address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 33 +++++++++++++++----------------
 1 file changed, 16 insertions(+), 17 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 10322da62e..703ab9c8ca 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -648,28 +648,19 @@ void helper_ldpte(CPULoongArchState *env, target_ulong base, target_ulong odd,
     env->CSR_TLBREHI = FIELD_DP64(env->CSR_TLBREHI, CSR_TLBREHI, PS, ps);
 }
 
-static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env, hwaddr *physical,
-                                      int *prot, vaddr address,
+static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env,
+                                      MMUContext *context,
                                       MMUAccessType access_type, int index,
                                       int mmu_idx)
 {
     LoongArchTLB *tlb = &env->tlb[index];
     uint8_t tlb_ps, n;
-    MMUContext context;
-    TLBRet ret;
 
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-    n = (address >> tlb_ps) & 0x1;/* Odd or even */
-    context.pte = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
-    context.addr = address;
-    context.ps = tlb_ps;
-    ret = loongarch_check_pte(env, &context, access_type, mmu_idx);
-    if (ret == TLBRET_MATCH) {
-        *physical = context.physical;
-        *prot = context.prot;
-     }
-
-    return ret;
+    n = (context->addr >> tlb_ps) & 0x1;/* Odd or even */
+    context->pte = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
+    context->ps = tlb_ps;
+    return loongarch_check_pte(env, context, access_type, mmu_idx);
 }
 
 TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
@@ -677,11 +668,19 @@ TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
                                    MMUAccessType access_type, int mmu_idx)
 {
     int index, match;
+    MMUContext context;
+    TLBRet ret;
 
+    context.addr = address;
     match = loongarch_tlb_search(env, address, &index);
     if (match) {
-        return loongarch_map_tlb_entry(env, physical, prot,
-                                       address, access_type, index, mmu_idx);
+        ret = loongarch_map_tlb_entry(env, &context, access_type, index,
+                                      mmu_idx);
+        if (ret == TLBRET_MATCH) {
+            *physical = context.physical;
+            *prot = context.prot;
+        }
+        return ret;
     }
 
     return TLBRET_NOMATCH;

From 35fc0ec73c3264b67ba2c8d5e39d5897dca2c891 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 17:06:05 +0800
Subject: [PATCH 0105/2396] target/loongarch: Use MMUContext in
 loongarch_get_addr_from_tlb

With function loongarch_get_addr_from_tlb(), parameter MMUContext
is added and remove parameter physical, prot and address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu_helper.c        |  7 +++++--
 target/loongarch/tcg/tcg_loongarch.h |  4 ++--
 target/loongarch/tcg/tlb_helper.c    | 18 +++++-------------
 3 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index cd61b33ef9..0cc01a0ca4 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -173,9 +173,12 @@ static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
 
     context.addr = address;
     if (tcg_enabled()) {
-        ret = loongarch_get_addr_from_tlb(env, physical, prot, address,
-                                          access_type, mmu_idx);
+        ret = loongarch_get_addr_from_tlb(env, &context, access_type, mmu_idx);
         if (ret != TLBRET_NOMATCH) {
+            if (ret == TLBRET_MATCH) {
+                *physical = context.physical;
+                *prot = context.prot;
+            }
             return ret;
         }
     }
diff --git a/target/loongarch/tcg/tcg_loongarch.h b/target/loongarch/tcg/tcg_loongarch.h
index 488700c3c3..47702893e3 100644
--- a/target/loongarch/tcg/tcg_loongarch.h
+++ b/target/loongarch/tcg/tcg_loongarch.h
@@ -15,8 +15,8 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                             MMUAccessType access_type, int mmu_idx,
                             bool probe, uintptr_t retaddr);
 
-TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                   int *prot, target_ulong address,
+TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env,
+                                   MMUContext *context,
                                    MMUAccessType access_type, int mmu_idx);
 
 #endif  /* TARGET_LOONGARCH_TCG_LOONGARCH_H */
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 703ab9c8ca..64a4e82dec 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -663,24 +663,16 @@ static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env,
     return loongarch_check_pte(env, context, access_type, mmu_idx);
 }
 
-TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env, hwaddr *physical,
-                                   int *prot, vaddr address,
+TLBRet loongarch_get_addr_from_tlb(CPULoongArchState *env,
+                                   MMUContext *context,
                                    MMUAccessType access_type, int mmu_idx)
 {
     int index, match;
-    MMUContext context;
-    TLBRet ret;
 
-    context.addr = address;
-    match = loongarch_tlb_search(env, address, &index);
+    match = loongarch_tlb_search(env, context->addr, &index);
     if (match) {
-        ret = loongarch_map_tlb_entry(env, &context, access_type, index,
-                                      mmu_idx);
-        if (ret == TLBRET_MATCH) {
-            *physical = context.physical;
-            *prot = context.prot;
-        }
-        return ret;
+        return loongarch_map_tlb_entry(env, context, access_type, index,
+                                       mmu_idx);
     }
 
     return TLBRET_NOMATCH;

From 4817a22edd49fc671f6efdc922826a4ce7f91017 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 17:19:53 +0800
Subject: [PATCH 0106/2396] target/loongarch: Use MMUContext in
 loongarch_map_address()

With function loongarch_map_address(), parameter MMUContext is added
and remove parameter address, prot and address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu_helper.c | 32 ++++++++++++++------------------
 1 file changed, 14 insertions(+), 18 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 0cc01a0ca4..225382f70e 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -163,22 +163,16 @@ static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
     return loongarch_check_pte(env, context, access_type, mmu_idx);
 }
 
-static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
-                                    int *prot, vaddr address,
+static TLBRet loongarch_map_address(CPULoongArchState *env,
+                                    MMUContext *context,
                                     MMUAccessType access_type, int mmu_idx,
                                     int is_debug)
 {
     TLBRet ret;
-    MMUContext context;
 
-    context.addr = address;
     if (tcg_enabled()) {
-        ret = loongarch_get_addr_from_tlb(env, &context, access_type, mmu_idx);
+        ret = loongarch_get_addr_from_tlb(env, context, access_type, mmu_idx);
         if (ret != TLBRET_NOMATCH) {
-            if (ret == TLBRET_MATCH) {
-                *physical = context.physical;
-                *prot = context.prot;
-            }
             return ret;
         }
     }
@@ -189,13 +183,7 @@ static TLBRet loongarch_map_address(CPULoongArchState *env, hwaddr *physical,
          * legal mapping, even if the mapping is not yet in TLB. return 0 if
          * there is a valid map, else none zero.
          */
-        ret = loongarch_page_table_walker(env, &context, access_type, mmu_idx);
-        if (ret == TLBRET_MATCH) {
-            *physical = context.physical;
-            *prot = context.prot;
-        }
-
-        return ret;
+        return loongarch_page_table_walker(env, context, access_type, mmu_idx);
     }
 
     return TLBRET_NOMATCH;
@@ -223,6 +211,8 @@ TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
     int64_t addr_high;
     uint8_t da = FIELD_EX64(env->CSR_CRMD, CSR_CRMD, DA);
     uint8_t pg = FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PG);
+    MMUContext context;
+    TLBRet ret;
 
     /* Check PG and DA */
     if (da & !pg) {
@@ -258,8 +248,14 @@ TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
     }
 
     /* Mapped address */
-    return loongarch_map_address(env, physical, prot, address,
-                                 access_type, mmu_idx, is_debug);
+    context.addr = address;
+    ret = loongarch_map_address(env, &context,
+                                access_type, mmu_idx, is_debug);
+    if (ret == TLBRET_MATCH) {
+        *physical = context.physical;
+        *prot = context.prot;
+    }
+    return ret;
 }
 
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)

From f95b9702750507665f90e377b5c6c68274104024 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 29 Jul 2025 17:51:28 +0800
Subject: [PATCH 0107/2396] target/loongarch: Use MMUContext in
 get_physical_address()

With function get_physical_address(), parameter MMUContext is added
and remove parameter address, prot and address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/cpu-mmu.h        |  3 +--
 target/loongarch/cpu_helper.c     | 32 ++++++++++++-------------------
 target/loongarch/tcg/tlb_helper.c |  8 +++++---
 3 files changed, 18 insertions(+), 25 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index be3d11d3c1..0068d22efc 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -30,8 +30,7 @@ typedef struct MMUContext {
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
 TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
                            MMUAccessType access_type, int mmu_idx);
-TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                            int *prot, vaddr address,
+TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug);
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 225382f70e..4a9db3ea4c 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -200,8 +200,7 @@ static hwaddr dmw_va2pa(CPULoongArchState *env, vaddr va, target_ulong dmw)
     }
 }
 
-TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
-                            int *prot, vaddr address,
+TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug)
 {
@@ -211,13 +210,13 @@ TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
     int64_t addr_high;
     uint8_t da = FIELD_EX64(env->CSR_CRMD, CSR_CRMD, DA);
     uint8_t pg = FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PG);
-    MMUContext context;
-    TLBRet ret;
+    vaddr address;
 
     /* Check PG and DA */
+    address = context->addr;
     if (da & !pg) {
-        *physical = address & TARGET_PHYS_MASK;
-        *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        context->physical = address & TARGET_PHYS_MASK;
+        context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
         return TLBRET_MATCH;
     }
 
@@ -235,8 +234,8 @@ TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
             base_c = FIELD_EX64(env->CSR_DMW[i], CSR_DMW_32, VSEG);
         }
         if ((plv & env->CSR_DMW[i]) && (base_c == base_v)) {
-            *physical = dmw_va2pa(env, address, env->CSR_DMW[i]);
-            *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            context->physical = dmw_va2pa(env, address, env->CSR_DMW[i]);
+            context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
             return TLBRET_MATCH;
         }
     }
@@ -248,25 +247,18 @@ TLBRet get_physical_address(CPULoongArchState *env, hwaddr *physical,
     }
 
     /* Mapped address */
-    context.addr = address;
-    ret = loongarch_map_address(env, &context,
-                                access_type, mmu_idx, is_debug);
-    if (ret == TLBRET_MATCH) {
-        *physical = context.physical;
-        *prot = context.prot;
-    }
-    return ret;
+    return loongarch_map_address(env, context, access_type, mmu_idx, is_debug);
 }
 
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
     CPULoongArchState *env = cpu_env(cs);
-    hwaddr phys_addr;
-    int prot;
+    MMUContext context;
 
-    if (get_physical_address(env, &phys_addr, &prot, addr, MMU_DATA_LOAD,
+    context.addr = addr;
+    if (get_physical_address(env, &context, MMU_DATA_LOAD,
                              cpu_mmu_index(cs, false), 1) != TLBRET_MATCH) {
         return -1;
     }
-    return phys_addr;
+    return context.physical;
 }
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 64a4e82dec..7d3f98633d 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -517,13 +517,15 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     CPULoongArchState *env = cpu_env(cs);
     hwaddr physical;
     int prot;
+    MMUContext context;
     TLBRet ret;
 
     /* Data access */
-    ret = get_physical_address(env, &physical, &prot, address,
-                               access_type, mmu_idx, 0);
-
+    context.addr = address;
+    ret = get_physical_address(env, &context, access_type, mmu_idx, 0);
     if (ret == TLBRET_MATCH) {
+        physical = context.physical;
+        prot = context.prot;
         tlb_set_page(cs, address & TARGET_PAGE_MASK,
                      physical & TARGET_PAGE_MASK, prot,
                      mmu_idx, TARGET_PAGE_SIZE);

From cc78259deb21940521a227619eb00a4b8e3e36c2 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 30 Jul 2025 09:47:55 +0800
Subject: [PATCH 0108/2396] target/loongarch: Use correct address when flush
 tlb

With tlb_flush_range_by_mmuidx(), the virtual address is 64 bit.
However on LoongArch TLB emulation system, virtual address is
48 bit. It is necessary to signed-extend 48 bit address to 64 bit when
flush tlb, also fix address calculation issue with odd page.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 7d3f98633d..9365860c8c 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -115,16 +115,16 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
+    addr = (tlb_vppn << R_TLB_MISC_VPPN_SHIFT) & ~mask;
+    addr = sextract64(addr, 0, TARGET_VIRT_ADDR_SPACE_BITS);
 
     if (tlb_v0) {
-        addr = (tlb_vppn << R_TLB_MISC_VPPN_SHIFT) & ~mask;    /* even */
         tlb_flush_range_by_mmuidx(env_cpu(env), addr, pagesize,
                                   mmu_idx, TARGET_LONG_BITS);
     }
 
     if (tlb_v1) {
-        addr = (tlb_vppn << R_TLB_MISC_VPPN_SHIFT) & pagesize;    /* odd */
-        tlb_flush_range_by_mmuidx(env_cpu(env), addr, pagesize,
+        tlb_flush_range_by_mmuidx(env_cpu(env), addr + pagesize, pagesize,
                                   mmu_idx, TARGET_LONG_BITS);
     }
 }

From e1e2909f8e74051a34a044940f90d4650b6e784a Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:44 +0100
Subject: [PATCH 0109/2396] hw/i386/pc_piix.c: restrict isapc machine to 32-bit
 CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The isapc machine represents a legacy ISA PC with a 486 CPU. Whilst it is
possible to specify any CPU via -cpu on the command line, it makes no
sense to allow modern 64-bit CPUs to be used.

Restrict the isapc machine to the available 32-bit CPUs, taking care to
handle the case where if a user inadvertently uses either -cpu max or
-cpu host then the "best" 32-bit CPU is used (in this case the pentium3).

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250828111057.468712-2-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 39 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index d165ac72ed..8f5fb3cf90 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -436,6 +436,31 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
 #ifdef CONFIG_ISAPC
 static void pc_init_isa(MachineState *machine)
 {
+    /*
+     * There is a small chance that someone unintentionally passes "-cpu max"
+     * for the isapc machine, which will provide a much more modern 32-bit
+     * CPU than would be expected for an ISA-era PC. If the "max" cpu type has
+     * been specified, choose the "best" 32-bit cpu possible which we consider
+     * be the pentium3 (deliberately choosing an Intel CPU given that the
+     * default 486 CPU for the isapc machine is also an Intel CPU).
+     */
+    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("max"))) {
+        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
+        warn_report("-cpu max is invalid for isapc machine, using pentium3");
+    }
+
+    /*
+     * Similarly if someone unintentionally passes "-cpu host" for the isapc
+     * machine then display a warning and also switch to the "best" 32-bit
+     * cpu possible which we consider to be the pentium3. This is because any
+     * host CPU will already be modern than this, but it also ensures any
+     * newer CPU flags/features are filtered out for older guests.
+     */
+    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("host"))) {
+        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
+        warn_report("-cpu host is invalid for isapc machine, using pentium3");
+    }
+
     pc_init1(machine, NULL);
 }
 #endif
@@ -815,7 +840,20 @@ DEFINE_I440FX_MACHINE(2, 6);
 #ifdef CONFIG_ISAPC
 static void isapc_machine_options(MachineClass *m)
 {
+    static const char * const valid_cpu_types[] = {
+        X86_CPU_TYPE_NAME("486"),
+        X86_CPU_TYPE_NAME("athlon"),
+        X86_CPU_TYPE_NAME("kvm32"),
+        X86_CPU_TYPE_NAME("pentium"),
+        X86_CPU_TYPE_NAME("pentium2"),
+        X86_CPU_TYPE_NAME("pentium3"),
+        X86_CPU_TYPE_NAME("qemu32"),
+        X86_CPU_TYPE_NAME("max"),
+        X86_CPU_TYPE_NAME("host"),
+        NULL
+    };
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+
     m->desc = "ISA-only PC";
     m->max_cpus = 1;
     m->option_rom_has_mr = true;
@@ -828,6 +866,7 @@ static void isapc_machine_options(MachineClass *m)
     pcmc->has_reserved_memory = false;
     m->default_nic = "ne2k_isa";
     m->default_cpu_type = X86_CPU_TYPE_NAME("486");
+    m->valid_cpu_types = valid_cpu_types;
     m->no_floppy = !module_object_class_by_name(TYPE_ISA_FDC);
     m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
 }

From 483a232e0431f19a4d6596be59c1d51370407249 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:45 +0100
Subject: [PATCH 0110/2396] hw/i386/pc_piix.c: restrict isapc machine to 3.5G
 memory

Since the isapc machine is now limited to using 32-bit CPUs, add a hard restriction
so that the machine cannot be started with more than 3.5G memory. This matches the
default value for max_ram_below_4g if not specified and provides consistent
behaviour betweem TCG and KVM accelerators.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/r/20250828111057.468712-3-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 8f5fb3cf90..9a3b5d88f0 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -461,6 +461,12 @@ static void pc_init_isa(MachineState *machine)
         warn_report("-cpu host is invalid for isapc machine, using pentium3");
     }
 
+    if (machine->ram_size > 3.5 * GiB) {
+        error_report("Too much memory for this machine: %" PRId64 " MiB, "
+                     "maximum 3584 MiB", machine->ram_size / MiB);
+        exit(1);
+    }
+
     pc_init1(machine, NULL);
 }
 #endif

From b55eab382cfbeb11f0afe116a06243d3fe5e43d9 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:46 +0100
Subject: [PATCH 0111/2396] hw/i386/pc_piix.c: remove include for loader.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This header is not required since the loader functionality is handled separately
by pc_memory_init() in pc.c.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-4-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 9a3b5d88f0..351986232d 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -28,7 +28,6 @@
 #include "qemu/units.h"
 #include "hw/char/parallel-isa.h"
 #include "hw/dma/i8257.h"
-#include "hw/loader.h"
 #include "hw/i386/x86.h"
 #include "hw/i386/pc.h"
 #include "hw/i386/apic.h"

From 79233a7e600ff26c623aecee81aa9a04cbbc7668 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:47 +0100
Subject: [PATCH 0112/2396] hw/i386/pc_piix.c: inline pc_xen_hvm_init_pci()
 into pc_xen_hvm_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This helps to simplify the initialisation of the Xen hvm machine.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-5-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 351986232d..8e302dc013 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -471,14 +471,6 @@ static void pc_init_isa(MachineState *machine)
 #endif
 
 #ifdef CONFIG_XEN
-static void pc_xen_hvm_init_pci(MachineState *machine)
-{
-    const char *pci_type = xen_igd_gfx_pt_enabled() ?
-                TYPE_IGD_PASSTHROUGH_I440FX_PCI_DEVICE : TYPE_I440FX_PCI_DEVICE;
-
-    pc_init1(machine, pci_type);
-}
-
 static void pc_xen_hvm_init(MachineState *machine)
 {
     PCMachineState *pcms = PC_MACHINE(machine);
@@ -488,7 +480,10 @@ static void pc_xen_hvm_init(MachineState *machine)
         exit(1);
     }
 
-    pc_xen_hvm_init_pci(machine);
+    pc_init1(machine, xen_igd_gfx_pt_enabled()
+                      ? TYPE_IGD_PASSTHROUGH_I440FX_PCI_DEVICE
+                      : TYPE_I440FX_PCI_DEVICE);
+
     xen_igd_reserve_slot(pcms->pcibus);
     pci_create_simple(pcms->pcibus, -1, "xen-platform");
 }

From 469be2f11f7279fe9174199183cf51ba1f557e2d Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:48 +0100
Subject: [PATCH 0113/2396] hw/i386/pc_piix.c: duplicate pc_init1() into
 pc_isa_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is to prepare for splitting the isapc machine into its own separate file.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250828111057.468712-6-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 275 +++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 274 insertions(+), 1 deletion(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 8e302dc013..60bf18c680 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -435,6 +435,23 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
 #ifdef CONFIG_ISAPC
 static void pc_init_isa(MachineState *machine)
 {
+    const char *pci_type = NULL;
+    PCMachineState *pcms = PC_MACHINE(machine);
+    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
+    X86MachineState *x86ms = X86_MACHINE(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    MemoryRegion *system_io = get_system_io();
+    Object *phb = NULL;
+    ISABus *isa_bus;
+    Object *piix4_pm = NULL;
+    qemu_irq smi_irq;
+    GSIState *gsi_state;
+    MemoryRegion *ram_memory;
+    MemoryRegion *pci_memory = NULL;
+    MemoryRegion *rom_memory = system_memory;
+    ram_addr_t lowmem;
+    uint64_t hole64_size = 0;
+
     /*
      * There is a small chance that someone unintentionally passes "-cpu max"
      * for the isapc machine, which will provide a much more modern 32-bit
@@ -466,7 +483,263 @@ static void pc_init_isa(MachineState *machine)
         exit(1);
     }
 
-    pc_init1(machine, NULL);
+    /*
+     * Calculate ram split, for memory below and above 4G.  It's a bit
+     * complicated for backward compatibility reasons ...
+     *
+     *  - Traditional split is 3.5G (lowmem = 0xe0000000).  This is the
+     *    default value for max_ram_below_4g now.
+     *
+     *  - Then, to gigabyte align the memory, we move the split to 3G
+     *    (lowmem = 0xc0000000).  But only in case we have to split in
+     *    the first place, i.e. ram_size is larger than (traditional)
+     *    lowmem.  And for new machine types (gigabyte_align = true)
+     *    only, for live migration compatibility reasons.
+     *
+     *  - Next the max-ram-below-4g option was added, which allowed to
+     *    reduce lowmem to a smaller value, to allow a larger PCI I/O
+     *    window below 4G.  qemu doesn't enforce gigabyte alignment here,
+     *    but prints a warning.
+     *
+     *  - Finally max-ram-below-4g got updated to also allow raising lowmem,
+     *    so legacy non-PAE guests can get as much memory as possible in
+     *    the 32bit address space below 4G.
+     *
+     *  - Note that Xen has its own ram setup code in xen_ram_init(),
+     *    called via xen_hvm_init_pc().
+     *
+     * Examples:
+     *    qemu -M pc-1.7 -m 4G    (old default)    -> 3584M low,  512M high
+     *    qemu -M pc -m 4G        (new default)    -> 3072M low, 1024M high
+     *    qemu -M pc,max-ram-below-4g=2G -m 4G     -> 2048M low, 2048M high
+     *    qemu -M pc,max-ram-below-4g=4G -m 3968M  -> 3968M low (=4G-128M)
+     */
+    if (xen_enabled()) {
+        xen_hvm_init_pc(pcms, &ram_memory);
+    } else {
+        ram_memory = machine->ram;
+        if (!pcms->max_ram_below_4g) {
+            pcms->max_ram_below_4g = 0xe0000000; /* default: 3.5G */
+        }
+        lowmem = pcms->max_ram_below_4g;
+        if (machine->ram_size >= pcms->max_ram_below_4g) {
+            if (pcmc->gigabyte_align) {
+                if (lowmem > 0xc0000000) {
+                    lowmem = 0xc0000000;
+                }
+                if (lowmem & (1 * GiB - 1)) {
+                    warn_report("Large machine and max_ram_below_4g "
+                                "(%" PRIu64 ") not a multiple of 1G; "
+                                "possible bad performance.",
+                                pcms->max_ram_below_4g);
+                }
+            }
+        }
+
+        if (machine->ram_size >= lowmem) {
+            x86ms->above_4g_mem_size = machine->ram_size - lowmem;
+            x86ms->below_4g_mem_size = lowmem;
+        } else {
+            x86ms->above_4g_mem_size = 0;
+            x86ms->below_4g_mem_size = machine->ram_size;
+        }
+    }
+
+    pc_machine_init_sgx_epc(pcms);
+    x86_cpus_init(x86ms, pcmc->default_cpu_version);
+
+    if (kvm_enabled()) {
+        kvmclock_create(pcmc->kvmclock_create_always);
+    }
+
+    if (pcmc->pci_enabled) {
+        pci_memory = g_new(MemoryRegion, 1);
+        memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
+        rom_memory = pci_memory;
+
+        phb = OBJECT(qdev_new(TYPE_I440FX_PCI_HOST_BRIDGE));
+        object_property_add_child(OBJECT(machine), "i440fx", phb);
+        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
+                                 OBJECT(ram_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
+                                 OBJECT(pci_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
+                                 OBJECT(system_memory), &error_fatal);
+        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
+                                 OBJECT(system_io), &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
+                                 x86ms->below_4g_mem_size, &error_fatal);
+        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
+                                 x86ms->above_4g_mem_size, &error_fatal);
+        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE, pci_type,
+                                &error_fatal);
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+
+        pcms->pcibus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
+        pci_bus_map_irqs(pcms->pcibus,
+                         xen_enabled() ? xen_pci_slot_get_pirq
+                                       : pc_pci_slot_get_pirq);
+
+        hole64_size = object_property_get_uint(phb,
+                                               PCI_HOST_PROP_PCI_HOLE64_SIZE,
+                                               &error_abort);
+    }
+
+    /* allocate ram and load rom/bios */
+    if (!xen_enabled()) {
+        pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
+    } else {
+        assert(machine->ram_size == x86ms->below_4g_mem_size +
+                                    x86ms->above_4g_mem_size);
+
+        pc_system_flash_cleanup_unused(pcms);
+        if (machine->kernel_filename != NULL) {
+            /* For xen HVM direct kernel boot, load linux here */
+            xen_load_linux(pcms);
+        }
+    }
+
+    gsi_state = pc_gsi_create(&x86ms->gsi, pcmc->pci_enabled);
+
+    if (pcmc->pci_enabled) {
+        PCIDevice *pci_dev;
+        DeviceState *dev;
+        size_t i;
+
+        pci_dev = pci_new_multifunction(-1, pcms->south_bridge);
+        object_property_set_bool(OBJECT(pci_dev), "has-usb",
+                                 machine_usb(machine), &error_abort);
+        object_property_set_bool(OBJECT(pci_dev), "has-acpi",
+                                 x86_machine_is_acpi_enabled(x86ms),
+                                 &error_abort);
+        object_property_set_bool(OBJECT(pci_dev), "has-pic", false,
+                                 &error_abort);
+        object_property_set_bool(OBJECT(pci_dev), "has-pit", false,
+                                 &error_abort);
+        qdev_prop_set_uint32(DEVICE(pci_dev), "smb_io_base", 0xb100);
+        object_property_set_bool(OBJECT(pci_dev), "smm-enabled",
+                                 x86_machine_is_smm_enabled(x86ms),
+                                 &error_abort);
+        dev = DEVICE(pci_dev);
+        for (i = 0; i < ISA_NUM_IRQS; i++) {
+            qdev_connect_gpio_out_named(dev, "isa-irqs", i, x86ms->gsi[i]);
+        }
+        pci_realize_and_unref(pci_dev, pcms->pcibus, &error_fatal);
+
+        if (xen_enabled()) {
+            pci_device_set_intx_routing_notifier(
+                        pci_dev, piix_intx_routing_notifier_xen);
+
+            /*
+             * Xen supports additional interrupt routes from the PCI devices to
+             * the IOAPIC: the four pins of each PCI device on the bus are also
+             * connected to the IOAPIC directly.
+             * These additional routes can be discovered through ACPI.
+             */
+            pci_bus_irqs(pcms->pcibus, xen_intx_set_irq, pci_dev,
+                         XEN_IOAPIC_NUM_PIRQS);
+        }
+
+        isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(pci_dev), "isa.0"));
+        x86ms->rtc = ISA_DEVICE(object_resolve_path_component(OBJECT(pci_dev),
+                                                              "rtc"));
+        piix4_pm = object_resolve_path_component(OBJECT(pci_dev), "pm");
+        dev = DEVICE(object_resolve_path_component(OBJECT(pci_dev), "ide"));
+        pci_ide_create_devs(PCI_DEVICE(dev));
+        pcms->idebus[0] = qdev_get_child_bus(dev, "ide.0");
+        pcms->idebus[1] = qdev_get_child_bus(dev, "ide.1");
+    } else {
+        uint32_t irq;
+
+        isa_bus = isa_bus_new(NULL, system_memory, system_io,
+                              &error_abort);
+        isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
+
+        x86ms->rtc = isa_new(TYPE_MC146818_RTC);
+        qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
+        isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
+        irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
+                                       &error_fatal);
+        isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
+
+        i8257_dma_init(OBJECT(machine), isa_bus, 0);
+        pcms->hpet_enabled = false;
+    }
+
+    if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
+        pc_i8259_create(isa_bus, gsi_state->i8259_irq);
+    }
+
+    if (phb) {
+        ioapic_init_gsi(gsi_state, phb);
+    }
+
+    if (tcg_enabled()) {
+        x86_register_ferr_irq(x86ms->gsi[13]);
+    }
+
+    pc_vga_init(isa_bus, pcmc->pci_enabled ? pcms->pcibus : NULL);
+
+    /* init basic PC hardware */
+    pc_basic_device_init(pcms, isa_bus, x86ms->gsi, x86ms->rtc,
+                         !MACHINE_CLASS(pcmc)->no_floppy, 0x4);
+
+    pc_nic_init(pcmc, isa_bus, pcms->pcibus);
+
+#ifdef CONFIG_IDE_ISA
+    if (!pcmc->pci_enabled) {
+        DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+        int i;
+
+        ide_drive_get(hd, ARRAY_SIZE(hd));
+        for (i = 0; i < MAX_IDE_BUS; i++) {
+            ISADevice *dev;
+            char busname[] = "ide.0";
+            dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
+                               ide_irq[i],
+                               hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
+            /*
+             * The ide bus name is ide.0 for the first bus and ide.1 for the
+             * second one.
+             */
+            busname[4] = '0' + i;
+            pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
+        }
+    }
+#endif
+
+    if (piix4_pm) {
+        smi_irq = qemu_allocate_irq(pc_acpi_smi_interrupt, first_cpu, 0);
+
+        qdev_connect_gpio_out_named(DEVICE(piix4_pm), "smi-irq", 0, smi_irq);
+        pcms->smbus = I2C_BUS(qdev_get_child_bus(DEVICE(piix4_pm), "i2c"));
+        /* TODO: Populate SPD eeprom data.  */
+        smbus_eeprom_init(pcms->smbus, 8, NULL, 0);
+
+        object_property_add_link(OBJECT(machine), PC_MACHINE_ACPI_DEVICE_PROP,
+                                 TYPE_HOTPLUG_HANDLER,
+                                 (Object **)&x86ms->acpi_dev,
+                                 object_property_allow_set_link,
+                                 OBJ_PROP_LINK_STRONG);
+        object_property_set_link(OBJECT(machine), PC_MACHINE_ACPI_DEVICE_PROP,
+                                 piix4_pm, &error_abort);
+    }
+
+    if (machine->nvdimms_state->is_enabled) {
+        nvdimm_init_acpi_state(machine->nvdimms_state, system_io,
+                               x86_nvdimm_acpi_dsmio,
+                               x86ms->fw_cfg, OBJECT(pcms));
+    }
+
+#if defined(CONFIG_IGVM)
+    /* Apply guest state from IGVM if supplied */
+    if (x86ms->igvm) {
+        if (IGVM_CFG_GET_CLASS(x86ms->igvm)
+                ->process(x86ms->igvm, machine->cgs, false, &error_fatal) < 0) {
+            g_assert_not_reached();
+        }
+    }
+#endif
 }
 #endif
 

From ba5500e0385fad2dd1d4878872695023e5e32e92 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:49 +0100
Subject: [PATCH 0114/2396] hw/i386/pc_piix.c: remove pcmc->pci_enabled
 dependent initialisation from pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PCI code will never be used for an isapc machine.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-7-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 120 ++++++----------------------------------------
 1 file changed, 15 insertions(+), 105 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 60bf18c680..f1b4468d0a 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -435,19 +435,17 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
 #ifdef CONFIG_ISAPC
 static void pc_init_isa(MachineState *machine)
 {
-    const char *pci_type = NULL;
     PCMachineState *pcms = PC_MACHINE(machine);
     PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
     X86MachineState *x86ms = X86_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *system_io = get_system_io();
-    Object *phb = NULL;
     ISABus *isa_bus;
     Object *piix4_pm = NULL;
     qemu_irq smi_irq;
+    uint32_t irq;
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
-    MemoryRegion *pci_memory = NULL;
     MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
     uint64_t hole64_size = 0;
@@ -552,39 +550,6 @@ static void pc_init_isa(MachineState *machine)
         kvmclock_create(pcmc->kvmclock_create_always);
     }
 
-    if (pcmc->pci_enabled) {
-        pci_memory = g_new(MemoryRegion, 1);
-        memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
-        rom_memory = pci_memory;
-
-        phb = OBJECT(qdev_new(TYPE_I440FX_PCI_HOST_BRIDGE));
-        object_property_add_child(OBJECT(machine), "i440fx", phb);
-        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
-                                 OBJECT(ram_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
-                                 OBJECT(pci_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
-                                 OBJECT(system_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
-                                 OBJECT(system_io), &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
-                                 x86ms->below_4g_mem_size, &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
-                                 x86ms->above_4g_mem_size, &error_fatal);
-        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE, pci_type,
-                                &error_fatal);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
-
-        pcms->pcibus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
-        pci_bus_map_irqs(pcms->pcibus,
-                         xen_enabled() ? xen_pci_slot_get_pirq
-                                       : pc_pci_slot_get_pirq);
-
-        hole64_size = object_property_get_uint(phb,
-                                               PCI_HOST_PROP_PCI_HOLE64_SIZE,
-                                               &error_abort);
-    }
-
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
         pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
@@ -599,92 +564,37 @@ static void pc_init_isa(MachineState *machine)
         }
     }
 
-    gsi_state = pc_gsi_create(&x86ms->gsi, pcmc->pci_enabled);
+    gsi_state = pc_gsi_create(&x86ms->gsi, false);
 
-    if (pcmc->pci_enabled) {
-        PCIDevice *pci_dev;
-        DeviceState *dev;
-        size_t i;
+    isa_bus = isa_bus_new(NULL, system_memory, system_io,
+                          &error_abort);
+    isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
 
-        pci_dev = pci_new_multifunction(-1, pcms->south_bridge);
-        object_property_set_bool(OBJECT(pci_dev), "has-usb",
-                                 machine_usb(machine), &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-acpi",
-                                 x86_machine_is_acpi_enabled(x86ms),
-                                 &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-pic", false,
-                                 &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-pit", false,
-                                 &error_abort);
-        qdev_prop_set_uint32(DEVICE(pci_dev), "smb_io_base", 0xb100);
-        object_property_set_bool(OBJECT(pci_dev), "smm-enabled",
-                                 x86_machine_is_smm_enabled(x86ms),
-                                 &error_abort);
-        dev = DEVICE(pci_dev);
-        for (i = 0; i < ISA_NUM_IRQS; i++) {
-            qdev_connect_gpio_out_named(dev, "isa-irqs", i, x86ms->gsi[i]);
-        }
-        pci_realize_and_unref(pci_dev, pcms->pcibus, &error_fatal);
+    x86ms->rtc = isa_new(TYPE_MC146818_RTC);
+    qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
+    isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
+    irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
+                                   &error_fatal);
+    isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
 
-        if (xen_enabled()) {
-            pci_device_set_intx_routing_notifier(
-                        pci_dev, piix_intx_routing_notifier_xen);
-
-            /*
-             * Xen supports additional interrupt routes from the PCI devices to
-             * the IOAPIC: the four pins of each PCI device on the bus are also
-             * connected to the IOAPIC directly.
-             * These additional routes can be discovered through ACPI.
-             */
-            pci_bus_irqs(pcms->pcibus, xen_intx_set_irq, pci_dev,
-                         XEN_IOAPIC_NUM_PIRQS);
-        }
-
-        isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(pci_dev), "isa.0"));
-        x86ms->rtc = ISA_DEVICE(object_resolve_path_component(OBJECT(pci_dev),
-                                                              "rtc"));
-        piix4_pm = object_resolve_path_component(OBJECT(pci_dev), "pm");
-        dev = DEVICE(object_resolve_path_component(OBJECT(pci_dev), "ide"));
-        pci_ide_create_devs(PCI_DEVICE(dev));
-        pcms->idebus[0] = qdev_get_child_bus(dev, "ide.0");
-        pcms->idebus[1] = qdev_get_child_bus(dev, "ide.1");
-    } else {
-        uint32_t irq;
-
-        isa_bus = isa_bus_new(NULL, system_memory, system_io,
-                              &error_abort);
-        isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
-
-        x86ms->rtc = isa_new(TYPE_MC146818_RTC);
-        qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
-        isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
-        irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
-                                       &error_fatal);
-        isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
-
-        i8257_dma_init(OBJECT(machine), isa_bus, 0);
-        pcms->hpet_enabled = false;
-    }
+    i8257_dma_init(OBJECT(machine), isa_bus, 0);
+    pcms->hpet_enabled = false;
 
     if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
         pc_i8259_create(isa_bus, gsi_state->i8259_irq);
     }
 
-    if (phb) {
-        ioapic_init_gsi(gsi_state, phb);
-    }
-
     if (tcg_enabled()) {
         x86_register_ferr_irq(x86ms->gsi[13]);
     }
 
-    pc_vga_init(isa_bus, pcmc->pci_enabled ? pcms->pcibus : NULL);
+    pc_vga_init(isa_bus, NULL);
 
     /* init basic PC hardware */
     pc_basic_device_init(pcms, isa_bus, x86ms->gsi, x86ms->rtc,
                          !MACHINE_CLASS(pcmc)->no_floppy, 0x4);
 
-    pc_nic_init(pcmc, isa_bus, pcms->pcibus);
+    pc_nic_init(pcmc, isa_bus, NULL);
 
 #ifdef CONFIG_IDE_ISA
     if (!pcmc->pci_enabled) {

From dc58530f0a58fe09862026ab6c26c68c00f4d535 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:50 +0100
Subject: [PATCH 0115/2396] hw/i386/pc_piix.c: remove igvm initialisation from
 pc_init_isa()

According to the QEMU documentation igvm is only supported for the pc and q35
machines so remove igvm support from the isapc machine.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/r/20250828111057.468712-8-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index f1b4468d0a..5ae265bd53 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -640,16 +640,6 @@ static void pc_init_isa(MachineState *machine)
                                x86_nvdimm_acpi_dsmio,
                                x86ms->fw_cfg, OBJECT(pcms));
     }
-
-#if defined(CONFIG_IGVM)
-    /* Apply guest state from IGVM if supplied */
-    if (x86ms->igvm) {
-        if (IGVM_CFG_GET_CLASS(x86ms->igvm)
-                ->process(x86ms->igvm, machine->cgs, false, &error_fatal) < 0) {
-            g_assert_not_reached();
-        }
-    }
-#endif
 }
 #endif
 

From ae4199af92d38fffd0d1fb9f02eaeb0632eff6df Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:51 +0100
Subject: [PATCH 0116/2396] hw/i386/pc_piix.c: remove SMI and piix4_pm
 initialisation from pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These are based upon the PIIX4 PCI chipset and so can never be used on an isapc machine.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-9-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 5ae265bd53..57b02da5a8 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -441,8 +441,6 @@ static void pc_init_isa(MachineState *machine)
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *system_io = get_system_io();
     ISABus *isa_bus;
-    Object *piix4_pm = NULL;
-    qemu_irq smi_irq;
     uint32_t irq;
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
@@ -618,23 +616,6 @@ static void pc_init_isa(MachineState *machine)
     }
 #endif
 
-    if (piix4_pm) {
-        smi_irq = qemu_allocate_irq(pc_acpi_smi_interrupt, first_cpu, 0);
-
-        qdev_connect_gpio_out_named(DEVICE(piix4_pm), "smi-irq", 0, smi_irq);
-        pcms->smbus = I2C_BUS(qdev_get_child_bus(DEVICE(piix4_pm), "i2c"));
-        /* TODO: Populate SPD eeprom data.  */
-        smbus_eeprom_init(pcms->smbus, 8, NULL, 0);
-
-        object_property_add_link(OBJECT(machine), PC_MACHINE_ACPI_DEVICE_PROP,
-                                 TYPE_HOTPLUG_HANDLER,
-                                 (Object **)&x86ms->acpi_dev,
-                                 object_property_allow_set_link,
-                                 OBJ_PROP_LINK_STRONG);
-        object_property_set_link(OBJECT(machine), PC_MACHINE_ACPI_DEVICE_PROP,
-                                 piix4_pm, &error_abort);
-    }
-
     if (machine->nvdimms_state->is_enabled) {
         nvdimm_init_acpi_state(machine->nvdimms_state, system_io,
                                x86_nvdimm_acpi_dsmio,

From d7916f6d5ec346d05ef63f5419d97a4d9f7d0a75 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:52 +0100
Subject: [PATCH 0117/2396] hw/i386/pc_piix.c: remove SGX initialisation from
 pc_init_isa()

The Intel SGX instructions only exist on recent CPUs and so would never be available
on a CPU from the pre-PCI era.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-10-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 57b02da5a8..9a2eee8ab0 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -541,7 +541,6 @@ static void pc_init_isa(MachineState *machine)
         }
     }
 
-    pc_machine_init_sgx_epc(pcms);
     x86_cpus_init(x86ms, pcmc->default_cpu_version);
 
     if (kvm_enabled()) {

From 62f8d562bb86cd7e1a0ce06f191c402a1eeba309 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:53 +0100
Subject: [PATCH 0118/2396] hw/i386/pc_piix.c: remove nvdimm initialisation
 from pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

NVDIMMs cannot be used by PCs from a pre-PCI era.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-11-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 9a2eee8ab0..daf63a326b 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -614,12 +614,6 @@ static void pc_init_isa(MachineState *machine)
         }
     }
 #endif
-
-    if (machine->nvdimms_state->is_enabled) {
-        nvdimm_init_acpi_state(machine->nvdimms_state, system_io,
-                               x86_nvdimm_acpi_dsmio,
-                               x86ms->fw_cfg, OBJECT(pcms));
-    }
 }
 #endif
 

From f2096fa151cbdf6cd169a6f0be9c5ccb5cd10466 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:54 +0100
Subject: [PATCH 0119/2396] hw/i386/pc_piix.c: simplify RAM size logic in
 pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All isapc machines must have 32-bit CPUs and so the RAM split logic can be hardcoded
accordingly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250828111057.468712-12-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 58 ++++-------------------------------------------
 1 file changed, 4 insertions(+), 54 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index daf63a326b..0bc033943c 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -445,7 +445,6 @@ static void pc_init_isa(MachineState *machine)
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
     MemoryRegion *rom_memory = system_memory;
-    ram_addr_t lowmem;
     uint64_t hole64_size = 0;
 
     /*
@@ -480,65 +479,16 @@ static void pc_init_isa(MachineState *machine)
     }
 
     /*
-     * Calculate ram split, for memory below and above 4G.  It's a bit
-     * complicated for backward compatibility reasons ...
-     *
-     *  - Traditional split is 3.5G (lowmem = 0xe0000000).  This is the
-     *    default value for max_ram_below_4g now.
-     *
-     *  - Then, to gigabyte align the memory, we move the split to 3G
-     *    (lowmem = 0xc0000000).  But only in case we have to split in
-     *    the first place, i.e. ram_size is larger than (traditional)
-     *    lowmem.  And for new machine types (gigabyte_align = true)
-     *    only, for live migration compatibility reasons.
-     *
-     *  - Next the max-ram-below-4g option was added, which allowed to
-     *    reduce lowmem to a smaller value, to allow a larger PCI I/O
-     *    window below 4G.  qemu doesn't enforce gigabyte alignment here,
-     *    but prints a warning.
-     *
-     *  - Finally max-ram-below-4g got updated to also allow raising lowmem,
-     *    so legacy non-PAE guests can get as much memory as possible in
-     *    the 32bit address space below 4G.
-     *
-     *  - Note that Xen has its own ram setup code in xen_ram_init(),
-     *    called via xen_hvm_init_pc().
-     *
-     * Examples:
-     *    qemu -M pc-1.7 -m 4G    (old default)    -> 3584M low,  512M high
-     *    qemu -M pc -m 4G        (new default)    -> 3072M low, 1024M high
-     *    qemu -M pc,max-ram-below-4g=2G -m 4G     -> 2048M low, 2048M high
-     *    qemu -M pc,max-ram-below-4g=4G -m 3968M  -> 3968M low (=4G-128M)
+     * There is no RAM split for the isapc machine
      */
     if (xen_enabled()) {
         xen_hvm_init_pc(pcms, &ram_memory);
     } else {
         ram_memory = machine->ram;
-        if (!pcms->max_ram_below_4g) {
-            pcms->max_ram_below_4g = 0xe0000000; /* default: 3.5G */
-        }
-        lowmem = pcms->max_ram_below_4g;
-        if (machine->ram_size >= pcms->max_ram_below_4g) {
-            if (pcmc->gigabyte_align) {
-                if (lowmem > 0xc0000000) {
-                    lowmem = 0xc0000000;
-                }
-                if (lowmem & (1 * GiB - 1)) {
-                    warn_report("Large machine and max_ram_below_4g "
-                                "(%" PRIu64 ") not a multiple of 1G; "
-                                "possible bad performance.",
-                                pcms->max_ram_below_4g);
-                }
-            }
-        }
 
-        if (machine->ram_size >= lowmem) {
-            x86ms->above_4g_mem_size = machine->ram_size - lowmem;
-            x86ms->below_4g_mem_size = lowmem;
-        } else {
-            x86ms->above_4g_mem_size = 0;
-            x86ms->below_4g_mem_size = machine->ram_size;
-        }
+        pcms->max_ram_below_4g = 3.5 * GiB;
+        x86ms->above_4g_mem_size = 0;
+        x86ms->below_4g_mem_size = machine->ram_size;
     }
 
     x86_cpus_init(x86ms, pcmc->default_cpu_version);

From 20fd284ec3c6ec39fb8e062d52f1ee514e89c554 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:55 +0100
Subject: [PATCH 0120/2396] hw/i386/pc_piix.c: hardcode hole64_size to 0 in
 pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All isapc machines must have 32-bit CPUs and have no PCI 64-bit hole so it can be
hardcoded to 0.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-13-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 0bc033943c..66dc4a5186 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -445,7 +445,6 @@ static void pc_init_isa(MachineState *machine)
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
     MemoryRegion *rom_memory = system_memory;
-    uint64_t hole64_size = 0;
 
     /*
      * There is a small chance that someone unintentionally passes "-cpu max"
@@ -499,7 +498,7 @@ static void pc_init_isa(MachineState *machine)
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
-        pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
+        pc_memory_init(pcms, system_memory, rom_memory, 0);
     } else {
         assert(machine->ram_size == x86ms->below_4g_mem_size +
                                     x86ms->above_4g_mem_size);

From b11ad71e32441baff354cdab1993847b61923570 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:56 +0100
Subject: [PATCH 0121/2396] hw/i386/pc_piix.c: remove
 pc_system_flash_cleanup_unused() from pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function contains 'assert(PC_MACHINE_GET_CLASS(pcms)->pci_enabled)' and so we can
safely assume that it should never be used for the isapc machine.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250828111057.468712-14-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 66dc4a5186..fb936748bd 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -503,7 +503,6 @@ static void pc_init_isa(MachineState *machine)
         assert(machine->ram_size == x86ms->below_4g_mem_size +
                                     x86ms->above_4g_mem_size);
 
-        pc_system_flash_cleanup_unused(pcms);
         if (machine->kernel_filename != NULL) {
             /* For xen HVM direct kernel boot, load linux here */
             xen_load_linux(pcms);

From 32c73eb73c7c09290a642c0c3ea541ce00350994 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:57 +0100
Subject: [PATCH 0122/2396] hw/i386/pc_piix.c: always initialise ISA IDE drives
 in pc_init_isa()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By definition an isapc machine must always use ISA IDE drives so ensure that they
are always enabled. At the same time also remove the surrounding CONFIG_IDE_ISA
define since it will be enabled via the ISAPC Kconfig.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-15-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 35 +++++++++++++++--------------------
 1 file changed, 15 insertions(+), 20 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index fb936748bd..72ddd9b149 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -445,6 +445,8 @@ static void pc_init_isa(MachineState *machine)
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
     MemoryRegion *rom_memory = system_memory;
+    DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    int i;
 
     /*
      * There is a small chance that someone unintentionally passes "-cpu max"
@@ -541,27 +543,20 @@ static void pc_init_isa(MachineState *machine)
 
     pc_nic_init(pcmc, isa_bus, NULL);
 
-#ifdef CONFIG_IDE_ISA
-    if (!pcmc->pci_enabled) {
-        DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
-        int i;
-
-        ide_drive_get(hd, ARRAY_SIZE(hd));
-        for (i = 0; i < MAX_IDE_BUS; i++) {
-            ISADevice *dev;
-            char busname[] = "ide.0";
-            dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
-                               ide_irq[i],
-                               hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
-            /*
-             * The ide bus name is ide.0 for the first bus and ide.1 for the
-             * second one.
-             */
-            busname[4] = '0' + i;
-            pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
-        }
+    ide_drive_get(hd, ARRAY_SIZE(hd));
+    for (i = 0; i < MAX_IDE_BUS; i++) {
+        ISADevice *dev;
+        char busname[] = "ide.0";
+        dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
+                            ide_irq[i],
+                            hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
+        /*
+         * The ide bus name is ide.0 for the first bus and ide.1 for the
+         * second one.
+         */
+        busname[4] = '0' + i;
+        pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
     }
-#endif
 }
 #endif
 

From 99d0630a454581eeb2bfabdc0bc15cc07d145876 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:58 +0100
Subject: [PATCH 0123/2396] hw/i386/pc_piix.c: assume pcmc->pci_enabled is
 always true in pc_init1()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PCI is always enabled on the pc-i440fx machine so hardcode the relevant logic
in pc_init1(). Add an assert() to ensure that this is always the case at
runtime as already done in pc_q35_init().

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-16-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 192 ++++++++++++++++++----------------------------
 1 file changed, 76 insertions(+), 116 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 72ddd9b149..3ea77b2c44 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -125,6 +125,11 @@ static void pc_init1(MachineState *machine, const char *pci_type)
     MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
     uint64_t hole64_size = 0;
+    PCIDevice *pci_dev;
+    DeviceState *dev;
+    size_t i;
+
+    assert(pcmc->pci_enabled);
 
     /*
      * Calculate ram split, for memory below and above 4G.  It's a bit
@@ -195,38 +200,36 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         kvmclock_create(pcmc->kvmclock_create_always);
     }
 
-    if (pcmc->pci_enabled) {
-        pci_memory = g_new(MemoryRegion, 1);
-        memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
-        rom_memory = pci_memory;
+    pci_memory = g_new(MemoryRegion, 1);
+    memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
+    rom_memory = pci_memory;
 
-        phb = OBJECT(qdev_new(TYPE_I440FX_PCI_HOST_BRIDGE));
-        object_property_add_child(OBJECT(machine), "i440fx", phb);
-        object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
-                                 OBJECT(ram_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
-                                 OBJECT(pci_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
-                                 OBJECT(system_memory), &error_fatal);
-        object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
-                                 OBJECT(system_io), &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
-                                 x86ms->below_4g_mem_size, &error_fatal);
-        object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
-                                 x86ms->above_4g_mem_size, &error_fatal);
-        object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE, pci_type,
-                                &error_fatal);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
+    phb = OBJECT(qdev_new(TYPE_I440FX_PCI_HOST_BRIDGE));
+    object_property_add_child(OBJECT(machine), "i440fx", phb);
+    object_property_set_link(phb, PCI_HOST_PROP_RAM_MEM,
+                             OBJECT(ram_memory), &error_fatal);
+    object_property_set_link(phb, PCI_HOST_PROP_PCI_MEM,
+                             OBJECT(pci_memory), &error_fatal);
+    object_property_set_link(phb, PCI_HOST_PROP_SYSTEM_MEM,
+                             OBJECT(system_memory), &error_fatal);
+    object_property_set_link(phb, PCI_HOST_PROP_IO_MEM,
+                             OBJECT(system_io), &error_fatal);
+    object_property_set_uint(phb, PCI_HOST_BELOW_4G_MEM_SIZE,
+                             x86ms->below_4g_mem_size, &error_fatal);
+    object_property_set_uint(phb, PCI_HOST_ABOVE_4G_MEM_SIZE,
+                             x86ms->above_4g_mem_size, &error_fatal);
+    object_property_set_str(phb, I440FX_HOST_PROP_PCI_TYPE, pci_type,
+                            &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(phb), &error_fatal);
 
-        pcms->pcibus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
-        pci_bus_map_irqs(pcms->pcibus,
-                         xen_enabled() ? xen_pci_slot_get_pirq
-                                       : pc_pci_slot_get_pirq);
+    pcms->pcibus = PCI_BUS(qdev_get_child_bus(DEVICE(phb), "pci.0"));
+    pci_bus_map_irqs(pcms->pcibus,
+                     xen_enabled() ? xen_pci_slot_get_pirq
+                                   : pc_pci_slot_get_pirq);
 
-        hole64_size = object_property_get_uint(phb,
-                                               PCI_HOST_PROP_PCI_HOLE64_SIZE,
-                                               &error_abort);
-    }
+    hole64_size = object_property_get_uint(phb,
+                                           PCI_HOST_PROP_PCI_HOLE64_SIZE,
+                                           &error_abort);
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
@@ -242,72 +245,51 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         }
     }
 
-    gsi_state = pc_gsi_create(&x86ms->gsi, pcmc->pci_enabled);
+    gsi_state = pc_gsi_create(&x86ms->gsi, true);
 
-    if (pcmc->pci_enabled) {
-        PCIDevice *pci_dev;
-        DeviceState *dev;
-        size_t i;
-
-        pci_dev = pci_new_multifunction(-1, pcms->south_bridge);
-        object_property_set_bool(OBJECT(pci_dev), "has-usb",
-                                 machine_usb(machine), &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-acpi",
-                                 x86_machine_is_acpi_enabled(x86ms),
-                                 &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-pic", false,
-                                 &error_abort);
-        object_property_set_bool(OBJECT(pci_dev), "has-pit", false,
-                                 &error_abort);
-        qdev_prop_set_uint32(DEVICE(pci_dev), "smb_io_base", 0xb100);
-        object_property_set_bool(OBJECT(pci_dev), "smm-enabled",
-                                 x86_machine_is_smm_enabled(x86ms),
-                                 &error_abort);
-        dev = DEVICE(pci_dev);
-        for (i = 0; i < ISA_NUM_IRQS; i++) {
-            qdev_connect_gpio_out_named(dev, "isa-irqs", i, x86ms->gsi[i]);
-        }
-        pci_realize_and_unref(pci_dev, pcms->pcibus, &error_fatal);
-
-        if (xen_enabled()) {
-            pci_device_set_intx_routing_notifier(
-                        pci_dev, piix_intx_routing_notifier_xen);
-
-            /*
-             * Xen supports additional interrupt routes from the PCI devices to
-             * the IOAPIC: the four pins of each PCI device on the bus are also
-             * connected to the IOAPIC directly.
-             * These additional routes can be discovered through ACPI.
-             */
-            pci_bus_irqs(pcms->pcibus, xen_intx_set_irq, pci_dev,
-                         XEN_IOAPIC_NUM_PIRQS);
-        }
-
-        isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(pci_dev), "isa.0"));
-        x86ms->rtc = ISA_DEVICE(object_resolve_path_component(OBJECT(pci_dev),
-                                                              "rtc"));
-        piix4_pm = object_resolve_path_component(OBJECT(pci_dev), "pm");
-        dev = DEVICE(object_resolve_path_component(OBJECT(pci_dev), "ide"));
-        pci_ide_create_devs(PCI_DEVICE(dev));
-        pcms->idebus[0] = qdev_get_child_bus(dev, "ide.0");
-        pcms->idebus[1] = qdev_get_child_bus(dev, "ide.1");
-    } else {
-        uint32_t irq;
-
-        isa_bus = isa_bus_new(NULL, system_memory, system_io,
-                              &error_abort);
-        isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
-
-        x86ms->rtc = isa_new(TYPE_MC146818_RTC);
-        qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
-        isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
-        irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
-                                       &error_fatal);
-        isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
-
-        i8257_dma_init(OBJECT(machine), isa_bus, 0);
-        pcms->hpet_enabled = false;
+    pci_dev = pci_new_multifunction(-1, pcms->south_bridge);
+    object_property_set_bool(OBJECT(pci_dev), "has-usb",
+                             machine_usb(machine), &error_abort);
+    object_property_set_bool(OBJECT(pci_dev), "has-acpi",
+                             x86_machine_is_acpi_enabled(x86ms),
+                             &error_abort);
+    object_property_set_bool(OBJECT(pci_dev), "has-pic", false,
+                             &error_abort);
+    object_property_set_bool(OBJECT(pci_dev), "has-pit", false,
+                             &error_abort);
+    qdev_prop_set_uint32(DEVICE(pci_dev), "smb_io_base", 0xb100);
+    object_property_set_bool(OBJECT(pci_dev), "smm-enabled",
+                             x86_machine_is_smm_enabled(x86ms),
+                             &error_abort);
+    dev = DEVICE(pci_dev);
+    for (i = 0; i < ISA_NUM_IRQS; i++) {
+        qdev_connect_gpio_out_named(dev, "isa-irqs", i, x86ms->gsi[i]);
     }
+    pci_realize_and_unref(pci_dev, pcms->pcibus, &error_fatal);
+
+    if (xen_enabled()) {
+        pci_device_set_intx_routing_notifier(
+                    pci_dev, piix_intx_routing_notifier_xen);
+
+        /*
+         * Xen supports additional interrupt routes from the PCI devices to
+         * the IOAPIC: the four pins of each PCI device on the bus are also
+         * connected to the IOAPIC directly.
+         * These additional routes can be discovered through ACPI.
+         */
+        pci_bus_irqs(pcms->pcibus, xen_intx_set_irq, pci_dev,
+                     XEN_IOAPIC_NUM_PIRQS);
+    }
+
+    isa_bus = ISA_BUS(qdev_get_child_bus(DEVICE(pci_dev), "isa.0"));
+    x86ms->rtc = ISA_DEVICE(object_resolve_path_component(OBJECT(pci_dev),
+                                                          "rtc"));
+    piix4_pm = object_resolve_path_component(OBJECT(pci_dev), "pm");
+    dev = DEVICE(object_resolve_path_component(OBJECT(pci_dev), "ide"));
+    pci_ide_create_devs(PCI_DEVICE(dev));
+    pcms->idebus[0] = qdev_get_child_bus(dev, "ide.0");
+    pcms->idebus[1] = qdev_get_child_bus(dev, "ide.1");
+
 
     if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
         pc_i8259_create(isa_bus, gsi_state->i8259_irq);
@@ -321,7 +303,7 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         x86_register_ferr_irq(x86ms->gsi[13]);
     }
 
-    pc_vga_init(isa_bus, pcmc->pci_enabled ? pcms->pcibus : NULL);
+    pc_vga_init(isa_bus, pcms->pcibus);
 
     /* init basic PC hardware */
     pc_basic_device_init(pcms, isa_bus, x86ms->gsi, x86ms->rtc,
@@ -329,28 +311,6 @@ static void pc_init1(MachineState *machine, const char *pci_type)
 
     pc_nic_init(pcmc, isa_bus, pcms->pcibus);
 
-#ifdef CONFIG_IDE_ISA
-    if (!pcmc->pci_enabled) {
-        DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
-        int i;
-
-        ide_drive_get(hd, ARRAY_SIZE(hd));
-        for (i = 0; i < MAX_IDE_BUS; i++) {
-            ISADevice *dev;
-            char busname[] = "ide.0";
-            dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
-                               ide_irq[i],
-                               hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
-            /*
-             * The ide bus name is ide.0 for the first bus and ide.1 for the
-             * second one.
-             */
-            busname[4] = '0' + i;
-            pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
-        }
-    }
-#endif
-
     if (piix4_pm) {
         smi_irq = qemu_allocate_irq(pc_acpi_smi_interrupt, first_cpu, 0);
 

From 3113e7db1d5d683e91cdbb4796e1b154cdda73bf Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:09:59 +0100
Subject: [PATCH 0124/2396] hw/i386: move isapc machine to separate isapc.c
 file

Now that pc_init_isa() is independent of any PCI initialisation, move it into a
separate isapc.c file including the ISA IDE variables which are now no longer
needed for the pc-i440fx machine. This enables us to finally fix the dependency
of ISAPC on I440FX in hw/i386/Kconfig.

Note that as part of the move to a separate file we can see that the licence text
is a verbatim copy of the MIT licence. The text originates from commit 1df912cf9e
("VL license of the day is MIT/BSD") so we can be sure that this was the original
intent. As a consequence we can update the file header to use a SPDX tag as per
the current project contribution guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-17-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/Kconfig     |   3 -
 hw/i386/isapc.c     | 190 ++++++++++++++++++++++++++++++++++++++++++++
 hw/i386/meson.build |   1 +
 hw/i386/pc_piix.c   | 172 ---------------------------------------
 4 files changed, 191 insertions(+), 175 deletions(-)
 create mode 100644 hw/i386/isapc.c

diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index 3a0e2b8ebb..6a0ab54bea 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -96,9 +96,6 @@ config ISAPC
     select ISA_BUS
     select PC
     select IDE_ISA
-    # FIXME: it is in the same file as i440fx, and does not compile
-    # if separated
-    depends on I440FX
 
 config Q35
     bool
diff --git a/hw/i386/isapc.c b/hw/i386/isapc.c
new file mode 100644
index 0000000000..300d64b7ad
--- /dev/null
+++ b/hw/i386/isapc.c
@@ -0,0 +1,190 @@
+/*
+ * QEMU PC System Emulator
+ *
+ * Copyright (c) 2003-2004 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: MIT
+ */
+
+#include "qemu/osdep.h"
+
+#include "qemu/units.h"
+#include "qemu/error-report.h"
+#include "hw/char/parallel-isa.h"
+#include "hw/dma/i8257.h"
+#include "hw/i386/pc.h"
+#include "hw/ide/isa.h"
+#include "hw/ide/ide-bus.h"
+#include "system/kvm.h"
+#include "hw/i386/kvm/clock.h"
+#include "hw/xen/xen-x86.h"
+#include "system/xen.h"
+#include "hw/rtc/mc146818rtc.h"
+#include "target/i386/cpu.h"
+
+static const int ide_iobase[MAX_IDE_BUS] = { 0x1f0, 0x170 };
+static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
+static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
+
+
+static void pc_init_isa(MachineState *machine)
+{
+    PCMachineState *pcms = PC_MACHINE(machine);
+    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
+    X86MachineState *x86ms = X86_MACHINE(machine);
+    MemoryRegion *system_memory = get_system_memory();
+    MemoryRegion *system_io = get_system_io();
+    ISABus *isa_bus;
+    uint32_t irq;
+    GSIState *gsi_state;
+    MemoryRegion *ram_memory;
+    MemoryRegion *rom_memory = system_memory;
+    DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
+    int i;
+
+    /*
+     * There is a small chance that someone unintentionally passes "-cpu max"
+     * for the isapc machine, which will provide a much more modern 32-bit
+     * CPU than would be expected for an ISA-era PC. If the "max" cpu type has
+     * been specified, choose the "best" 32-bit cpu possible which we consider
+     * be the pentium3 (deliberately choosing an Intel CPU given that the
+     * default 486 CPU for the isapc machine is also an Intel CPU).
+     */
+    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("max"))) {
+        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
+        warn_report("-cpu max is invalid for isapc machine, using pentium3");
+    }
+
+    /*
+     * Similarly if someone unintentionally passes "-cpu host" for the isapc
+     * machine then display a warning and also switch to the "best" 32-bit
+     * cpu possible which we consider to be the pentium3. This is because any
+     * host CPU will already be modern than this, but it also ensures any
+     * newer CPU flags/features are filtered out for older guests.
+     */
+    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("host"))) {
+        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
+        warn_report("-cpu host is invalid for isapc machine, using pentium3");
+    }
+
+    if (machine->ram_size > 3.5 * GiB) {
+        error_report("Too much memory for this machine: %" PRId64 " MiB, "
+                     "maximum 3584 MiB", machine->ram_size / MiB);
+        exit(1);
+    }
+
+    /*
+     * There is no RAM split for the isapc machine
+     */
+    if (xen_enabled()) {
+        xen_hvm_init_pc(pcms, &ram_memory);
+    } else {
+        ram_memory = machine->ram;
+
+        pcms->max_ram_below_4g = 3.5 * GiB;
+        x86ms->above_4g_mem_size = 0;
+        x86ms->below_4g_mem_size = machine->ram_size;
+    }
+
+    x86_cpus_init(x86ms, pcmc->default_cpu_version);
+
+    if (kvm_enabled()) {
+        kvmclock_create(pcmc->kvmclock_create_always);
+    }
+
+    /* allocate ram and load rom/bios */
+    if (!xen_enabled()) {
+        pc_memory_init(pcms, system_memory, rom_memory, 0);
+    } else {
+        assert(machine->ram_size == x86ms->below_4g_mem_size +
+                                    x86ms->above_4g_mem_size);
+
+        if (machine->kernel_filename != NULL) {
+            /* For xen HVM direct kernel boot, load linux here */
+            xen_load_linux(pcms);
+        }
+    }
+
+    gsi_state = pc_gsi_create(&x86ms->gsi, false);
+
+    isa_bus = isa_bus_new(NULL, system_memory, system_io,
+                          &error_abort);
+    isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
+
+    x86ms->rtc = isa_new(TYPE_MC146818_RTC);
+    qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
+    isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
+    irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
+                                   &error_fatal);
+    isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
+
+    i8257_dma_init(OBJECT(machine), isa_bus, 0);
+    pcms->hpet_enabled = false;
+
+    if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
+        pc_i8259_create(isa_bus, gsi_state->i8259_irq);
+    }
+
+    if (tcg_enabled()) {
+        x86_register_ferr_irq(x86ms->gsi[13]);
+    }
+
+    pc_vga_init(isa_bus, NULL);
+
+    /* init basic PC hardware */
+    pc_basic_device_init(pcms, isa_bus, x86ms->gsi, x86ms->rtc,
+                         !MACHINE_CLASS(pcmc)->no_floppy, 0x4);
+
+    pc_nic_init(pcmc, isa_bus, NULL);
+
+    ide_drive_get(hd, ARRAY_SIZE(hd));
+    for (i = 0; i < MAX_IDE_BUS; i++) {
+        ISADevice *dev;
+        char busname[] = "ide.0";
+        dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
+                            ide_irq[i],
+                            hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
+        /*
+         * The ide bus name is ide.0 for the first bus and ide.1 for the
+         * second one.
+         */
+        busname[4] = '0' + i;
+        pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
+    }
+}
+
+static void isapc_machine_options(MachineClass *m)
+{
+    static const char * const valid_cpu_types[] = {
+        X86_CPU_TYPE_NAME("486"),
+        X86_CPU_TYPE_NAME("athlon"),
+        X86_CPU_TYPE_NAME("kvm32"),
+        X86_CPU_TYPE_NAME("pentium"),
+        X86_CPU_TYPE_NAME("pentium2"),
+        X86_CPU_TYPE_NAME("pentium3"),
+        X86_CPU_TYPE_NAME("qemu32"),
+        X86_CPU_TYPE_NAME("max"),
+        X86_CPU_TYPE_NAME("host"),
+        NULL
+    };
+    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
+
+    m->desc = "ISA-only PC";
+    m->max_cpus = 1;
+    m->option_rom_has_mr = true;
+    m->rom_file_has_mr = false;
+    pcmc->pci_enabled = false;
+    pcmc->has_acpi_build = false;
+    pcmc->smbios_defaults = false;
+    pcmc->gigabyte_align = false;
+    pcmc->smbios_legacy_mode = true;
+    pcmc->has_reserved_memory = false;
+    m->default_nic = "ne2k_isa";
+    m->default_cpu_type = X86_CPU_TYPE_NAME("486");
+    m->valid_cpu_types = valid_cpu_types;
+    m->no_floppy = !module_object_class_by_name(TYPE_ISA_FDC);
+    m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
+}
+
+DEFINE_PC_MACHINE(isapc, "isapc", pc_init_isa,
+                  isapc_machine_options);
diff --git a/hw/i386/meson.build b/hw/i386/meson.build
index 7896f348cf..436b3ce52d 100644
--- a/hw/i386/meson.build
+++ b/hw/i386/meson.build
@@ -14,6 +14,7 @@ i386_ss.add(when: 'CONFIG_X86_IOMMU', if_true: files('x86-iommu.c'),
 i386_ss.add(when: 'CONFIG_AMD_IOMMU', if_true: files('amd_iommu.c'),
                                       if_false: files('amd_iommu-stub.c'))
 i386_ss.add(when: 'CONFIG_I440FX', if_true: files('pc_piix.c'))
+i386_ss.add(when: 'CONFIG_ISAPC', if_true: files('isapc.c'))
 i386_ss.add(when: 'CONFIG_MICROVM', if_true: files('x86-common.c', 'microvm.c', 'acpi-microvm.c', 'microvm-dt.c'))
 i386_ss.add(when: 'CONFIG_NITRO_ENCLAVE', if_true: files('nitro_enclave.c'))
 i386_ss.add(when: 'CONFIG_Q35', if_true: files('pc_q35.c'))
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 3ea77b2c44..988c9edc32 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -71,12 +71,6 @@
 
 #define XEN_IOAPIC_NUM_PIRQS 128ULL
 
-#ifdef CONFIG_IDE_ISA
-static const int ide_iobase[MAX_IDE_BUS] = { 0x1f0, 0x170 };
-static const int ide_iobase2[MAX_IDE_BUS] = { 0x3f6, 0x376 };
-static const int ide_irq[MAX_IDE_BUS] = { 14, 15 };
-#endif
-
 static GlobalProperty pc_piix_compat_defaults[] = {
     { TYPE_RAMFB_DEVICE, "use-legacy-x86-rom", "true" },
     { TYPE_VFIO_PCI_NOHOTPLUG, "use-legacy-x86-rom", "true" },
@@ -392,134 +386,6 @@ static void pc_set_south_bridge(Object *obj, int value, Error **errp)
     pcms->south_bridge = PCSouthBridgeOption_lookup.array[value];
 }
 
-#ifdef CONFIG_ISAPC
-static void pc_init_isa(MachineState *machine)
-{
-    PCMachineState *pcms = PC_MACHINE(machine);
-    PCMachineClass *pcmc = PC_MACHINE_GET_CLASS(pcms);
-    X86MachineState *x86ms = X86_MACHINE(machine);
-    MemoryRegion *system_memory = get_system_memory();
-    MemoryRegion *system_io = get_system_io();
-    ISABus *isa_bus;
-    uint32_t irq;
-    GSIState *gsi_state;
-    MemoryRegion *ram_memory;
-    MemoryRegion *rom_memory = system_memory;
-    DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
-    int i;
-
-    /*
-     * There is a small chance that someone unintentionally passes "-cpu max"
-     * for the isapc machine, which will provide a much more modern 32-bit
-     * CPU than would be expected for an ISA-era PC. If the "max" cpu type has
-     * been specified, choose the "best" 32-bit cpu possible which we consider
-     * be the pentium3 (deliberately choosing an Intel CPU given that the
-     * default 486 CPU for the isapc machine is also an Intel CPU).
-     */
-    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("max"))) {
-        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
-        warn_report("-cpu max is invalid for isapc machine, using pentium3");
-    }
-
-    /*
-     * Similarly if someone unintentionally passes "-cpu host" for the isapc
-     * machine then display a warning and also switch to the "best" 32-bit
-     * cpu possible which we consider to be the pentium3. This is because any
-     * host CPU will already be modern than this, but it also ensures any
-     * newer CPU flags/features are filtered out for older guests.
-     */
-    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("host"))) {
-        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
-        warn_report("-cpu host is invalid for isapc machine, using pentium3");
-    }
-
-    if (machine->ram_size > 3.5 * GiB) {
-        error_report("Too much memory for this machine: %" PRId64 " MiB, "
-                     "maximum 3584 MiB", machine->ram_size / MiB);
-        exit(1);
-    }
-
-    /*
-     * There is no RAM split for the isapc machine
-     */
-    if (xen_enabled()) {
-        xen_hvm_init_pc(pcms, &ram_memory);
-    } else {
-        ram_memory = machine->ram;
-
-        pcms->max_ram_below_4g = 3.5 * GiB;
-        x86ms->above_4g_mem_size = 0;
-        x86ms->below_4g_mem_size = machine->ram_size;
-    }
-
-    x86_cpus_init(x86ms, pcmc->default_cpu_version);
-
-    if (kvm_enabled()) {
-        kvmclock_create(pcmc->kvmclock_create_always);
-    }
-
-    /* allocate ram and load rom/bios */
-    if (!xen_enabled()) {
-        pc_memory_init(pcms, system_memory, rom_memory, 0);
-    } else {
-        assert(machine->ram_size == x86ms->below_4g_mem_size +
-                                    x86ms->above_4g_mem_size);
-
-        if (machine->kernel_filename != NULL) {
-            /* For xen HVM direct kernel boot, load linux here */
-            xen_load_linux(pcms);
-        }
-    }
-
-    gsi_state = pc_gsi_create(&x86ms->gsi, false);
-
-    isa_bus = isa_bus_new(NULL, system_memory, system_io,
-                          &error_abort);
-    isa_bus_register_input_irqs(isa_bus, x86ms->gsi);
-
-    x86ms->rtc = isa_new(TYPE_MC146818_RTC);
-    qdev_prop_set_int32(DEVICE(x86ms->rtc), "base_year", 2000);
-    isa_realize_and_unref(x86ms->rtc, isa_bus, &error_fatal);
-    irq = object_property_get_uint(OBJECT(x86ms->rtc), "irq",
-                                   &error_fatal);
-    isa_connect_gpio_out(ISA_DEVICE(x86ms->rtc), 0, irq);
-
-    i8257_dma_init(OBJECT(machine), isa_bus, 0);
-    pcms->hpet_enabled = false;
-
-    if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
-        pc_i8259_create(isa_bus, gsi_state->i8259_irq);
-    }
-
-    if (tcg_enabled()) {
-        x86_register_ferr_irq(x86ms->gsi[13]);
-    }
-
-    pc_vga_init(isa_bus, NULL);
-
-    /* init basic PC hardware */
-    pc_basic_device_init(pcms, isa_bus, x86ms->gsi, x86ms->rtc,
-                         !MACHINE_CLASS(pcmc)->no_floppy, 0x4);
-
-    pc_nic_init(pcmc, isa_bus, NULL);
-
-    ide_drive_get(hd, ARRAY_SIZE(hd));
-    for (i = 0; i < MAX_IDE_BUS; i++) {
-        ISADevice *dev;
-        char busname[] = "ide.0";
-        dev = isa_ide_init(isa_bus, ide_iobase[i], ide_iobase2[i],
-                            ide_irq[i],
-                            hd[MAX_IDE_DEVS * i], hd[MAX_IDE_DEVS * i + 1]);
-        /*
-         * The ide bus name is ide.0 for the first bus and ide.1 for the
-         * second one.
-         */
-        busname[4] = '0' + i;
-        pcms->idebus[i] = qdev_get_child_bus(DEVICE(dev), busname);
-    }
-}
-#endif
-
 #ifdef CONFIG_XEN
 static void pc_xen_hvm_init(MachineState *machine)
 {
@@ -887,44 +753,6 @@ static void pc_i440fx_machine_2_6_options(MachineClass *m)
 
 DEFINE_I440FX_MACHINE(2, 6);
 
-#ifdef CONFIG_ISAPC
-static void isapc_machine_options(MachineClass *m)
-{
-    static const char * const valid_cpu_types[] = {
-        X86_CPU_TYPE_NAME("486"),
-        X86_CPU_TYPE_NAME("athlon"),
-        X86_CPU_TYPE_NAME("kvm32"),
-        X86_CPU_TYPE_NAME("pentium"),
-        X86_CPU_TYPE_NAME("pentium2"),
-        X86_CPU_TYPE_NAME("pentium3"),
-        X86_CPU_TYPE_NAME("qemu32"),
-        X86_CPU_TYPE_NAME("max"),
-        X86_CPU_TYPE_NAME("host"),
-        NULL
-    };
-    PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
-
-    m->desc = "ISA-only PC";
-    m->max_cpus = 1;
-    m->option_rom_has_mr = true;
-    m->rom_file_has_mr = false;
-    pcmc->pci_enabled = false;
-    pcmc->has_acpi_build = false;
-    pcmc->smbios_defaults = false;
-    pcmc->gigabyte_align = false;
-    pcmc->smbios_legacy_mode = true;
-    pcmc->has_reserved_memory = false;
-    m->default_nic = "ne2k_isa";
-    m->default_cpu_type = X86_CPU_TYPE_NAME("486");
-    m->valid_cpu_types = valid_cpu_types;
-    m->no_floppy = !module_object_class_by_name(TYPE_ISA_FDC);
-    m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
-}
-
-DEFINE_PC_MACHINE(isapc, "isapc", pc_init_isa,
-                  isapc_machine_options);
-#endif
-
 #ifdef CONFIG_XEN
 static void xenfv_machine_4_2_options(MachineClass *m)
 {

From d773f9689109eb00ba6627c2264af949c66897fb Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:10:00 +0100
Subject: [PATCH 0125/2396] hw/i386/pc_piix.c: remove unused headers after
 isapc machine split
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The headers for isapc-only devices can be removed from pc_piix.c since they are
no longer used by the i440fx-pc machine.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-18-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 988c9edc32..627de09c70 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -27,19 +27,16 @@
 
 #include "qemu/units.h"
 #include "hw/char/parallel-isa.h"
-#include "hw/dma/i8257.h"
 #include "hw/i386/x86.h"
 #include "hw/i386/pc.h"
 #include "hw/i386/apic.h"
 #include "hw/pci-host/i440fx.h"
-#include "hw/rtc/mc146818rtc.h"
 #include "hw/southbridge/piix.h"
 #include "hw/display/ramfb.h"
 #include "hw/pci/pci.h"
 #include "hw/pci/pci_ids.h"
 #include "hw/usb.h"
 #include "net/net.h"
-#include "hw/ide/isa.h"
 #include "hw/ide/pci.h"
 #include "hw/irq.h"
 #include "system/kvm.h"

From 523a64f388a689a1e9bc593ca8768fe1449613db Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:10:01 +0100
Subject: [PATCH 0126/2396] hw/i386/pc_piix.c: replace rom_memory with
 pci_memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we can guarantee the i440fx-pc machine will always have a PCI bus, any
instances of rom_memory can be replaced by pci_memory and rom_memory removed
completely.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-19-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc_piix.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 627de09c70..7e78b6daa6 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -113,7 +113,6 @@ static void pc_init1(MachineState *machine, const char *pci_type)
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
     MemoryRegion *pci_memory = NULL;
-    MemoryRegion *rom_memory = system_memory;
     ram_addr_t lowmem;
     uint64_t hole64_size = 0;
     PCIDevice *pci_dev;
@@ -193,7 +192,6 @@ static void pc_init1(MachineState *machine, const char *pci_type)
 
     pci_memory = g_new(MemoryRegion, 1);
     memory_region_init(pci_memory, NULL, "pci", UINT64_MAX);
-    rom_memory = pci_memory;
 
     phb = OBJECT(qdev_new(TYPE_I440FX_PCI_HOST_BRIDGE));
     object_property_add_child(OBJECT(machine), "i440fx", phb);
@@ -224,7 +222,7 @@ static void pc_init1(MachineState *machine, const char *pci_type)
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
-        pc_memory_init(pcms, system_memory, rom_memory, hole64_size);
+        pc_memory_init(pcms, system_memory, pci_memory, hole64_size);
     } else {
         assert(machine->ram_size == x86ms->below_4g_mem_size +
                                     x86ms->above_4g_mem_size);

From d8701867d12241f53f3b17973e7fd533c764c76a Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 28 Aug 2025 12:10:02 +0100
Subject: [PATCH 0127/2396] hw/i386/isapc.c: replace rom_memory with
 system_memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we can guarantee the isapc machine will never have a PCI bus, any
instances of rom_memory can be replaced by system_memory and rom_memory
removed completely.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250828111057.468712-20-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/isapc.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/i386/isapc.c b/hw/i386/isapc.c
index 300d64b7ad..44f4a44672 100644
--- a/hw/i386/isapc.c
+++ b/hw/i386/isapc.c
@@ -38,7 +38,6 @@ static void pc_init_isa(MachineState *machine)
     uint32_t irq;
     GSIState *gsi_state;
     MemoryRegion *ram_memory;
-    MemoryRegion *rom_memory = system_memory;
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
     int i;
 
@@ -94,7 +93,7 @@ static void pc_init_isa(MachineState *machine)
 
     /* allocate ram and load rom/bios */
     if (!xen_enabled()) {
-        pc_memory_init(pcms, system_memory, rom_memory, 0);
+        pc_memory_init(pcms, system_memory, system_memory, 0);
     } else {
         assert(machine->ram_size == x86ms->below_4g_mem_size +
                                     x86ms->above_4g_mem_size);

From b8217bbaf2bafef1a4f54082a3548613eeef8f2b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 10:46:48 +0200
Subject: [PATCH 0128/2396] user-exec: ensure interrupt_request is not used

cpu_interrupt() is not called anymore except by ARM but even there
it is dead code; disentangling the various cpregs accessors from user-mode
emulation is a work in progress.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c  | 6 ++++--
 accel/tcg/user-exec.c | 4 +---
 include/hw/core/cpu.h | 1 +
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 713bdb2056..b44dd1e820 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -778,6 +778,9 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
      */
     qatomic_set_mb(&cpu->neg.icount_decr.u16.high, 0);
 
+#ifdef CONFIG_USER_ONLY
+    g_assert(!qatomic_read(&cpu->interrupt_request));
+#else
     if (unlikely(qatomic_read(&cpu->interrupt_request))) {
         int interrupt_request;
         bql_lock();
@@ -792,7 +795,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             bql_unlock();
             return true;
         }
-#if !defined(CONFIG_USER_ONLY)
         if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) {
             /* Do nothing */
         } else if (interrupt_request & CPU_INTERRUPT_HALT) {
@@ -840,7 +842,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
              * reload the 'interrupt_request' value */
             interrupt_request = cpu->interrupt_request;
         }
-#endif /* !CONFIG_USER_ONLY */
         if (interrupt_request & CPU_INTERRUPT_EXITTB) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
             /* ensure that no TB jump will be modified as
@@ -851,6 +852,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
         /* If we exit via cpu_loop_exit/longjmp it is reset in cpu_exec */
         bql_unlock();
     }
+#endif /* !CONFIG_USER_ONLY */
 
     /* Finally, check if we need to exit to the main loop.  */
     if (unlikely(qatomic_read(&cpu->exit_request)) || icount_exit_request(cpu)) {
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index f25d80e2dc..748bfab04a 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -48,9 +48,7 @@ __thread uintptr_t helper_retaddr;
 
 void cpu_interrupt(CPUState *cpu, int mask)
 {
-    g_assert(bql_locked());
-    cpu->interrupt_request |= mask;
-    qatomic_set(&cpu->neg.icount_decr.u16.high, -1);
+    g_assert_not_reached();
 }
 
 /*
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 5eaf41a566..f73b4357c7 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -423,6 +423,7 @@ struct qemu_work_item;
  * @created: Indicates whether the CPU thread has been successfully created.
  * @halt_cond: condition variable sleeping threads can wait on.
  * @interrupt_request: Indicates a pending interrupt request.
+ *   Only used by system emulation.
  * @halted: Nonzero if the CPU is in suspended state.
  * @stop: Indicates a pending stop request.
  * @stopped: Indicates the CPU has been artificially stopped.

From 87511341c30d8c9c77178db16491a0ccacc5d64b Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 21 Aug 2025 17:56:03 +0200
Subject: [PATCH 0129/2396] add cpu_test_interrupt()/cpu_set_interrupt()
 helpers and use them tree wide

The helpers form load-acquire/store-release pair and ensure
that appropriate barriers are in place in case checks happen
outside of BQL.

Use them to replace open-coded checkers/setters across the code,
to make sure that barriers are not missed.  Helpers also make code a
bit more readable.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Link: https://lore.kernel.org/r/20250821155603.2422553-1-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c                | 12 +++++-----
 accel/tcg/tcg-accel-ops.c           |  2 +-
 hw/intc/s390_flic.c                 |  2 +-
 hw/openrisc/cputimer.c              |  2 +-
 include/hw/core/cpu.h               | 22 +++++++++++++++++++
 system/cpus.c                       |  9 +++++++-
 target/alpha/cpu.c                  |  8 +++----
 target/arm/cpu.c                    | 20 ++++++++---------
 target/arm/helper.c                 | 18 +++++++--------
 target/arm/hvf/hvf.c                |  6 ++---
 target/avr/cpu.c                    |  2 +-
 target/hppa/cpu.c                   |  2 +-
 target/i386/hvf/hvf.c               |  4 ++--
 target/i386/hvf/x86hvf.c            | 21 +++++++++---------
 target/i386/kvm/kvm.c               | 34 ++++++++++++++---------------
 target/i386/nvmm/nvmm-all.c         | 24 ++++++++++----------
 target/i386/tcg/system/seg_helper.c |  2 +-
 target/i386/tcg/system/svm_helper.c |  2 +-
 target/i386/whpx/whpx-all.c         | 34 ++++++++++++++---------------
 target/loongarch/cpu.c              |  2 +-
 target/m68k/cpu.c                   |  2 +-
 target/microblaze/cpu.c             |  2 +-
 target/mips/cpu.c                   |  6 ++---
 target/mips/kvm.c                   |  2 +-
 target/openrisc/cpu.c               |  3 +--
 target/ppc/cpu_init.c               |  2 +-
 target/ppc/kvm.c                    |  2 +-
 target/rx/cpu.c                     |  3 +--
 target/rx/helper.c                  |  2 +-
 target/s390x/cpu-system.c           |  2 +-
 target/sh4/cpu.c                    |  2 +-
 target/sh4/helper.c                 |  2 +-
 target/sparc/cpu.c                  |  2 +-
 target/sparc/int64_helper.c         |  4 ++--
 34 files changed, 145 insertions(+), 119 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index b44dd1e820..96c124aa72 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -779,9 +779,9 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
     qatomic_set_mb(&cpu->neg.icount_decr.u16.high, 0);
 
 #ifdef CONFIG_USER_ONLY
-    g_assert(!qatomic_read(&cpu->interrupt_request));
+    assert(!cpu_test_interrupt(cpu, ~0));
 #else
-    if (unlikely(qatomic_read(&cpu->interrupt_request))) {
+    if (unlikely(cpu_test_interrupt(cpu, ~0))) {
         int interrupt_request;
         bql_lock();
         interrupt_request = cpu->interrupt_request;
@@ -789,7 +789,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             /* Mask out external interrupts for this step. */
             interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
         }
-        if (interrupt_request & CPU_INTERRUPT_DEBUG) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_DEBUG)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
             cpu->exception_index = EXCP_DEBUG;
             bql_unlock();
@@ -797,7 +797,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
         }
         if (replay_mode == REPLAY_MODE_PLAY && !replay_has_interrupt()) {
             /* Do nothing */
-        } else if (interrupt_request & CPU_INTERRUPT_HALT) {
+        } else if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HALT)) {
             replay_interrupt();
             cpu->interrupt_request &= ~CPU_INTERRUPT_HALT;
             cpu->halted = 1;
@@ -807,7 +807,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
         } else {
             const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
 
-            if (interrupt_request & CPU_INTERRUPT_RESET) {
+            if (cpu_test_interrupt(cpu, CPU_INTERRUPT_RESET)) {
                 replay_interrupt();
                 tcg_ops->cpu_exec_reset(cpu);
                 bql_unlock();
@@ -842,7 +842,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
              * reload the 'interrupt_request' value */
             interrupt_request = cpu->interrupt_request;
         }
-        if (interrupt_request & CPU_INTERRUPT_EXITTB) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_EXITTB)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
             /* ensure that no TB jump will be modified as
                the program flow was changed */
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 3b0d7d298e..9c37266c1e 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -97,7 +97,7 @@ static void tcg_cpu_reset_hold(CPUState *cpu)
 /* mask must never be zero, except for A20 change call */
 void tcg_handle_interrupt(CPUState *cpu, int mask)
 {
-    cpu->interrupt_request |= mask;
+    cpu_set_interrupt(cpu, mask);
 
     /*
      * If called from iothread context, wake the target cpu in
diff --git a/hw/intc/s390_flic.c b/hw/intc/s390_flic.c
index 8f4c9fd52e..1eed5125d1 100644
--- a/hw/intc/s390_flic.c
+++ b/hw/intc/s390_flic.c
@@ -190,7 +190,7 @@ static void qemu_s390_flic_notify(uint32_t type)
     CPU_FOREACH(cs) {
         S390CPU *cpu = S390_CPU(cs);
 
-        cs->interrupt_request |= CPU_INTERRUPT_HARD;
+        cpu_set_interrupt(cs, CPU_INTERRUPT_HARD);
 
         /* ignore CPUs that are not sleeping */
         if (s390_cpu_get_state(cpu) != S390_CPU_STATE_OPERATING &&
diff --git a/hw/openrisc/cputimer.c b/hw/openrisc/cputimer.c
index 6331997d56..51da226fcd 100644
--- a/hw/openrisc/cputimer.c
+++ b/hw/openrisc/cputimer.c
@@ -105,7 +105,7 @@ static void openrisc_timer_cb(void *opaque)
         CPUState *cs = CPU(cpu);
 
         cpu->env.ttmr |= TTMR_IP;
-        cs->interrupt_request |= CPU_INTERRUPT_TIMER;
+        cpu_set_interrupt(cs, CPU_INTERRUPT_TIMER);
     }
 
     switch (cpu->env.ttmr & TTMR_M) {
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index f73b4357c7..b01a0cffd6 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -943,6 +943,28 @@ CPUState *cpu_by_arch_id(int64_t id);
 
 void cpu_interrupt(CPUState *cpu, int mask);
 
+/**
+ * cpu_test_interrupt:
+ * @cpu: The CPU to check interrupt(s) on.
+ * @mask: The interrupts to check.
+ *
+ * Checks if any of interrupts in @mask are pending on @cpu.
+ */
+static inline bool cpu_test_interrupt(CPUState *cpu, int mask)
+{
+    return qatomic_load_acquire(&cpu->interrupt_request) & mask;
+}
+
+/**
+ * cpu_set_interrupt:
+ * @cpu: The CPU to set pending interrupt(s) on.
+ * @mask: The interrupts to set.
+ *
+ * Sets interrupts in @mask as pending on @cpu.  Unlike @cpu_interrupt,
+ * this does not kick the vCPU.
+ */
+void cpu_set_interrupt(CPUState *cpu, int mask);
+
 /**
  * cpu_set_pc:
  * @cpu: The CPU to set the program counter for.
diff --git a/system/cpus.c b/system/cpus.c
index 256723558d..437848b5eb 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -254,9 +254,16 @@ int64_t cpus_get_elapsed_ticks(void)
     return cpu_get_ticks();
 }
 
+void cpu_set_interrupt(CPUState *cpu, int mask)
+{
+    /* Pairs with cpu_test_interrupt(). */
+    qatomic_store_release(&cpu->interrupt_request,
+        cpu->interrupt_request | mask);
+}
+
 void generic_handle_interrupt(CPUState *cpu, int mask)
 {
-    cpu->interrupt_request |= mask;
+    cpu_set_interrupt(cpu, mask);
 
     if (!qemu_cpu_is_self(cpu)) {
         qemu_cpu_kick(cpu);
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index bf1787a69d..932cddac05 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -86,10 +86,10 @@ static bool alpha_cpu_has_work(CPUState *cs)
        assume that if a CPU really wants to stay asleep, it will mask
        interrupts at the chipset level, which will prevent these bits
        from being set in the first place.  */
-    return cs->interrupt_request & (CPU_INTERRUPT_HARD
-                                    | CPU_INTERRUPT_TIMER
-                                    | CPU_INTERRUPT_SMP
-                                    | CPU_INTERRUPT_MCHK);
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD
+                                  | CPU_INTERRUPT_TIMER
+                                  | CPU_INTERRUPT_SMP
+                                  | CPU_INTERRUPT_MCHK);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e2b2337399..a29c3facbf 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -142,11 +142,11 @@ static bool arm_cpu_has_work(CPUState *cs)
     ARMCPU *cpu = ARM_CPU(cs);
 
     return (cpu->power_state != PSCI_OFF)
-        && cs->interrupt_request &
-        (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
-         | CPU_INTERRUPT_NMI | CPU_INTERRUPT_VINMI | CPU_INTERRUPT_VFNMI
-         | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
-         | CPU_INTERRUPT_EXITTB);
+        && cpu_test_interrupt(cs,
+               CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
+               | CPU_INTERRUPT_NMI | CPU_INTERRUPT_VINMI | CPU_INTERRUPT_VFNMI
+               | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
+               | CPU_INTERRUPT_EXITTB);
 }
 #endif /* !CONFIG_USER_ONLY */
 
@@ -958,7 +958,7 @@ void arm_cpu_update_virq(ARMCPU *cpu)
         !(arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
         (env->irq_line_state & CPU_INTERRUPT_VIRQ);
 
-    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VIRQ) != 0)) {
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VIRQ)) {
         if (new_state) {
             cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
         } else {
@@ -980,7 +980,7 @@ void arm_cpu_update_vfiq(ARMCPU *cpu)
         !(arm_hcrx_el2_eff(env) & HCRX_VFNMI)) ||
         (env->irq_line_state & CPU_INTERRUPT_VFIQ);
 
-    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFIQ) != 0)) {
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFIQ)) {
         if (new_state) {
             cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
         } else {
@@ -1002,7 +1002,7 @@ void arm_cpu_update_vinmi(ARMCPU *cpu)
                       (arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
         (env->irq_line_state & CPU_INTERRUPT_VINMI);
 
-    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VINMI) != 0)) {
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VINMI)) {
         if (new_state) {
             cpu_interrupt(cs, CPU_INTERRUPT_VINMI);
         } else {
@@ -1022,7 +1022,7 @@ void arm_cpu_update_vfnmi(ARMCPU *cpu)
     bool new_state = (arm_hcr_el2_eff(env) & HCR_VF) &&
                       (arm_hcrx_el2_eff(env) & HCRX_VFNMI);
 
-    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFNMI) != 0)) {
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFNMI)) {
         if (new_state) {
             cpu_interrupt(cs, CPU_INTERRUPT_VFNMI);
         } else {
@@ -1041,7 +1041,7 @@ void arm_cpu_update_vserr(ARMCPU *cpu)
 
     bool new_state = env->cp15.hcr_el2 & HCR_VSE;
 
-    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VSERR) != 0)) {
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VSERR)) {
         if (new_state) {
             cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
         } else {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0c1299ff84..4cd36e950a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -833,40 +833,40 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     uint64_t ret = 0;
 
     if (hcr_el2 & HCR_IMO) {
-        if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_VIRQ)) {
             ret |= CPSR_I;
         }
-        if (cs->interrupt_request & CPU_INTERRUPT_VINMI) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_VINMI)) {
             ret |= ISR_IS;
             ret |= CPSR_I;
         }
     } else {
-        if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
             ret |= CPSR_I;
         }
 
-        if (cs->interrupt_request & CPU_INTERRUPT_NMI) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
             ret |= ISR_IS;
             ret |= CPSR_I;
         }
     }
 
     if (hcr_el2 & HCR_FMO) {
-        if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_VFIQ)) {
             ret |= CPSR_F;
         }
-        if (cs->interrupt_request & CPU_INTERRUPT_VFNMI) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_VFNMI)) {
             ret |= ISR_FS;
             ret |= CPSR_F;
         }
     } else {
-        if (cs->interrupt_request & CPU_INTERRUPT_FIQ) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_FIQ)) {
             ret |= CPSR_F;
         }
     }
 
     if (hcr_el2 & HCR_AMO) {
-        if (cs->interrupt_request & CPU_INTERRUPT_VSERR) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_VSERR)) {
             ret |= CPSR_A;
         }
     }
@@ -9147,7 +9147,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
     arm_call_el_change_hook(cpu);
 
     if (!kvm_enabled()) {
-        cs->interrupt_request |= CPU_INTERRUPT_EXITTB;
+        cpu_set_interrupt(cs, CPU_INTERRUPT_EXITTB);
     }
 }
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 47b0cd3a35..b77db99079 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1782,13 +1782,13 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
 
 static int hvf_inject_interrupts(CPUState *cpu)
 {
-    if (cpu->interrupt_request & CPU_INTERRUPT_FIQ) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_FIQ)) {
         trace_hvf_inject_fiq();
         hv_vcpu_set_pending_interrupt(cpu->accel->fd, HV_INTERRUPT_TYPE_FIQ,
                                       true);
     }
 
-    if (cpu->interrupt_request & CPU_INTERRUPT_HARD) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
         trace_hvf_inject_irq();
         hv_vcpu_set_pending_interrupt(cpu->accel->fd, HV_INTERRUPT_TYPE_IRQ,
                                       true);
@@ -1840,7 +1840,7 @@ static void hvf_wfi(CPUState *cpu)
     uint64_t nanos;
     uint32_t cntfrq;
 
-    if (cpu->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ)) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ)) {
         /* Interrupt pending, no need to wait */
         return;
     }
diff --git a/target/avr/cpu.c b/target/avr/cpu.c
index 6995de6a12..a6df71d020 100644
--- a/target/avr/cpu.c
+++ b/target/avr/cpu.c
@@ -45,7 +45,7 @@ static vaddr avr_cpu_get_pc(CPUState *cs)
 
 static bool avr_cpu_has_work(CPUState *cs)
 {
-    return (cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_RESET))
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_RESET)
             && cpu_interrupts_enabled(cpu_env(cs));
 }
 
diff --git a/target/hppa/cpu.c b/target/hppa/cpu.c
index 24777727e6..0ca79ee5e2 100644
--- a/target/hppa/cpu.c
+++ b/target/hppa/cpu.c
@@ -135,7 +135,7 @@ static void hppa_restore_state_to_opc(CPUState *cs,
 #ifndef CONFIG_USER_ONLY
 static bool hppa_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 818b50419f..8445cadece 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -773,9 +773,9 @@ int hvf_vcpu_exec(CPUState *cpu)
         switch (exit_reason) {
         case EXIT_REASON_HLT: {
             macvm_set_rip(cpu, rip + ins_len);
-            if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+            if (!(cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
                 (env->eflags & IF_MASK))
-                && !(cpu->interrupt_request & CPU_INTERRUPT_NMI) &&
+                && !cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI) &&
                 !(idtvec_info & VMCS_IDT_VEC_VALID)) {
                 cpu->halted = 1;
                 ret = EXCP_HLT;
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 17fce1d3cd..9e05e0e576 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -395,7 +395,7 @@ bool hvf_inject_interrupts(CPUState *cs)
         };
     }
 
-    if (cs->interrupt_request & CPU_INTERRUPT_NMI) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
         if (!(env->hflags2 & HF2_NMI_MASK) && !(info & VMCS_INTR_VALID)) {
             cs->interrupt_request &= ~CPU_INTERRUPT_NMI;
             info = VMCS_INTR_VALID | VMCS_INTR_T_NMI | EXCP02_NMI;
@@ -406,7 +406,7 @@ bool hvf_inject_interrupts(CPUState *cs)
     }
 
     if (!(env->hflags & HF_INHIBIT_IRQ_MASK) &&
-        (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+        cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         (env->eflags & IF_MASK) && !(info & VMCS_INTR_VALID)) {
         int line = cpu_get_pic_interrupt(env);
         cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
@@ -415,11 +415,10 @@ bool hvf_inject_interrupts(CPUState *cs)
                   VMCS_INTR_VALID | VMCS_INTR_T_HWINTR);
         }
     }
-    if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
         vmx_set_int_window_exiting(cs);
     }
-    return (cs->interrupt_request
-            & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR));
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR);
 }
 
 int hvf_process_events(CPUState *cs)
@@ -432,25 +431,25 @@ int hvf_process_events(CPUState *cs)
         env->eflags = rreg(cs->accel->fd, HV_X86_RFLAGS);
     }
 
-    if (cs->interrupt_request & CPU_INTERRUPT_INIT) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_INIT)) {
         cpu_synchronize_state(cs);
         do_cpu_init(cpu);
     }
 
-    if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_POLL)) {
         cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
         apic_poll_irq(cpu->apic_state);
     }
-    if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if ((cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         (env->eflags & IF_MASK)) ||
-        (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
         cs->halted = 0;
     }
-    if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_SIPI)) {
         cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
-    if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_TPR)) {
         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
         cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 369626f8c8..a7b5c8f81b 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5453,8 +5453,8 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     int ret;
 
     /* Inject NMI */
-    if (cpu->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
-        if (cpu->interrupt_request & CPU_INTERRUPT_NMI) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
             bql_lock();
             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
             bql_unlock();
@@ -5465,7 +5465,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
                         strerror(-ret));
             }
         }
-        if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
             bql_lock();
             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
             bql_unlock();
@@ -5486,12 +5486,12 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
      * or (for userspace APIC, but it is cheap to combine the checks here)
      * pending TPR access reports.
      */
-    if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
-        if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
             !(env->hflags & HF_SMM_MASK)) {
             cpu->exit_request = 1;
         }
-        if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
             cpu->exit_request = 1;
         }
     }
@@ -5499,7 +5499,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     if (!kvm_pic_in_kernel()) {
         /* Try to inject an interrupt if the guest can accept it */
         if (run->ready_for_interrupt_injection &&
-            (cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+            cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
             (env->eflags & IF_MASK)) {
             int irq;
 
@@ -5523,7 +5523,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
          * interrupt, request an interrupt window exit.  This will
          * cause a return to userspace as soon as the guest is ready to
          * receive interrupts. */
-        if ((cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
             run->request_interrupt_window = 1;
         } else {
             run->request_interrupt_window = 0;
@@ -5595,7 +5595,7 @@ int kvm_arch_process_async_events(CPUState *cs)
     X86CPU *cpu = X86_CPU(cs);
     CPUX86State *env = &cpu->env;
 
-    if (cs->interrupt_request & CPU_INTERRUPT_MCE) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_MCE)) {
         /* We must not raise CPU_INTERRUPT_MCE if it's not supported. */
         assert(env->mcg_cap);
 
@@ -5618,7 +5618,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         }
     }
 
-    if ((cs->interrupt_request & CPU_INTERRUPT_INIT) &&
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_INIT) &&
         !(env->hflags & HF_SMM_MASK)) {
         kvm_cpu_synchronize_state(cs);
         do_cpu_init(cpu);
@@ -5628,20 +5628,20 @@ int kvm_arch_process_async_events(CPUState *cs)
         return 0;
     }
 
-    if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_POLL)) {
         cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
         apic_poll_irq(cpu->apic_state);
     }
-    if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if ((cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
          (env->eflags & IF_MASK)) ||
-        (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
         cs->halted = 0;
     }
-    if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_SIPI)) {
         kvm_cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
-    if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_TPR)) {
         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
         kvm_cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
@@ -5656,9 +5656,9 @@ static int kvm_handle_halt(X86CPU *cpu)
     CPUState *cs = CPU(cpu);
     CPUX86State *env = &cpu->env;
 
-    if (!((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (!(cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
           (env->eflags & IF_MASK)) &&
-        !(cs->interrupt_request & CPU_INTERRUPT_NMI)) {
+        !cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
         cs->halted = 1;
         return EXCP_HLT;
     }
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 92e3b8b2f4..c1ac74c4f0 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -413,11 +413,11 @@ nvmm_vcpu_pre_run(CPUState *cpu)
      * Force the VCPU out of its inner loop to process any INIT requests
      * or commit pending TPR access.
      */
-    if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
         cpu->exit_request = 1;
     }
 
-    if (!has_event && (cpu->interrupt_request & CPU_INTERRUPT_NMI)) {
+    if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         if (nvmm_can_take_nmi(cpu)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
             event->type = NVMM_VCPU_EVENT_INTR;
@@ -426,7 +426,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
         }
     }
 
-    if (!has_event && (cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
+    if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
         if (nvmm_can_take_int(cpu)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
             event->type = NVMM_VCPU_EVENT_INTR;
@@ -436,7 +436,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
     }
 
     /* Don't want SMIs. */
-    if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
     }
 
@@ -651,9 +651,9 @@ nvmm_handle_halted(struct nvmm_machine *mach, CPUState *cpu,
 
     bql_lock();
 
-    if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (!(cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
           (cpu_env(cpu)->eflags & IF_MASK)) &&
-        !(cpu->interrupt_request & CPU_INTERRUPT_NMI)) {
+        !cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         cpu->exception_index = EXCP_HLT;
         cpu->halted = true;
         ret = 1;
@@ -691,25 +691,25 @@ nvmm_vcpu_loop(CPUState *cpu)
      * Some asynchronous events must be handled outside of the inner
      * VCPU loop. They are handled here.
      */
-    if (cpu->interrupt_request & CPU_INTERRUPT_INIT) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT)) {
         nvmm_cpu_synchronize_state(cpu);
         do_cpu_init(x86_cpu);
         /* set int/nmi windows back to the reset state */
     }
-    if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_POLL)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_POLL;
         apic_poll_irq(x86_cpu->apic_state);
     }
-    if (((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if ((cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
          (env->eflags & IF_MASK)) ||
-        (cpu->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         cpu->halted = false;
     }
-    if (cpu->interrupt_request & CPU_INTERRUPT_SIPI) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SIPI)) {
         nvmm_cpu_synchronize_state(cpu);
         do_cpu_sipi(x86_cpu);
     }
-    if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_TPR;
         nvmm_cpu_synchronize_state(cpu);
         apic_handle_tpr_access_report(x86_cpu->apic_state, env->eip,
diff --git a/target/i386/tcg/system/seg_helper.c b/target/i386/tcg/system/seg_helper.c
index d4ea890c12..794a23ddfc 100644
--- a/target/i386/tcg/system/seg_helper.c
+++ b/target/i386/tcg/system/seg_helper.c
@@ -133,7 +133,7 @@ bool x86_cpu_exec_halt(CPUState *cpu)
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
 
-    if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_POLL)) {
         bql_lock();
         apic_poll_irq(x86_cpu->apic_state);
         cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index dea039b87a..3569196bdd 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -403,7 +403,7 @@ void helper_vmrun(CPUX86State *env, int aflag, int next_eip_addend)
     env->hflags2 |= HF2_GIF_MASK;
 
     if (ctl_has_irq(env)) {
-        cs->interrupt_request |= CPU_INTERRUPT_VIRQ;
+        cpu_set_interrupt(cs, CPU_INTERRUPT_VIRQ);
     }
 
     if (virtual_gif_set(env)) {
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index b72dcff3c8..878cdd1668 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1436,9 +1436,9 @@ static int whpx_handle_halt(CPUState *cpu)
     int ret = 0;
 
     bql_lock();
-    if (!((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (!(cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
           (cpu_env(cpu)->eflags & IF_MASK)) &&
-        !(cpu->interrupt_request & CPU_INTERRUPT_NMI)) {
+        !cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         cpu->exception_index = EXCP_HLT;
         cpu->halted = true;
         ret = 1;
@@ -1469,15 +1469,15 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 
     /* Inject NMI */
     if (!vcpu->interruption_pending &&
-        cpu->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
-        if (cpu->interrupt_request & CPU_INTERRUPT_NMI) {
+        cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
             vcpu->interruptable = false;
             new_int.InterruptionType = WHvX64PendingNmi;
             new_int.InterruptionPending = 1;
             new_int.InterruptionVector = 2;
         }
-        if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
         }
     }
@@ -1486,12 +1486,12 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
      * Force the VCPU out of its inner loop to process any INIT requests or
      * commit pending TPR access.
      */
-    if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
-        if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
             !(env->hflags & HF_SMM_MASK)) {
             cpu->exit_request = 1;
         }
-        if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
+        if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
             cpu->exit_request = 1;
         }
     }
@@ -1501,7 +1501,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
         if (!vcpu->interruption_pending &&
             vcpu->interruptable && (env->eflags & IF_MASK)) {
             assert(!new_int.InterruptionPending);
-            if (cpu->interrupt_request & CPU_INTERRUPT_HARD) {
+            if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
                 cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
                 irq = cpu_get_pic_interrupt(env);
                 if (irq >= 0) {
@@ -1519,7 +1519,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
             reg_count += 1;
         }
     } else if (vcpu->ready_for_pic_interrupt &&
-               (cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
+               cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
         irq = cpu_get_pic_interrupt(env);
         if (irq >= 0) {
@@ -1546,7 +1546,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
 
     /* Update the state of the interrupt delivery notification */
     if (!vcpu->window_registered &&
-        cpu->interrupt_request & CPU_INTERRUPT_HARD) {
+        cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
         reg_values[reg_count].DeliverabilityNotifications =
             (WHV_X64_DELIVERABILITY_NOTIFICATIONS_REGISTER) {
                 .InterruptNotification = 1
@@ -1599,30 +1599,30 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
     CPUX86State *env = &x86_cpu->env;
     AccelCPUState *vcpu = cpu->accel;
 
-    if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
         !(env->hflags & HF_SMM_MASK)) {
         whpx_cpu_synchronize_state(cpu);
         do_cpu_init(x86_cpu);
         vcpu->interruptable = true;
     }
 
-    if (cpu->interrupt_request & CPU_INTERRUPT_POLL) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_POLL)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_POLL;
         apic_poll_irq(x86_cpu->apic_state);
     }
 
-    if (((cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if ((cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
          (env->eflags & IF_MASK)) ||
-        (cpu->interrupt_request & CPU_INTERRUPT_NMI)) {
+        cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         cpu->halted = false;
     }
 
-    if (cpu->interrupt_request & CPU_INTERRUPT_SIPI) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SIPI)) {
         whpx_cpu_synchronize_state(cpu);
         do_cpu_sipi(x86_cpu);
     }
 
-    if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
+    if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
         cpu->interrupt_request &= ~CPU_INTERRUPT_TPR;
         whpx_cpu_synchronize_state(cpu);
         apic_handle_tpr_access_report(x86_cpu->apic_state, env->eip,
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index abad84c054..3a7621c0ea 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -376,7 +376,7 @@ static bool loongarch_cpu_has_work(CPUState *cs)
 {
     bool has_work = false;
 
-    if ((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         cpu_loongarch_hw_interrupts_pending(cpu_env(cs))) {
         has_work = true;
     }
diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index 6a09db3a6f..f1b673119d 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -74,7 +74,7 @@ static void m68k_restore_state_to_opc(CPUState *cs,
 #ifndef CONFIG_USER_ONLY
 static bool m68k_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & CPU_INTERRUPT_HARD;
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index ee0a869a94..22231f09e6 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -129,7 +129,7 @@ static void mb_restore_state_to_opc(CPUState *cs,
 #ifndef CONFIG_USER_ONLY
 static bool mb_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & (CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_NMI);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/mips/cpu.c b/target/mips/cpu.c
index 1f6c41fd34..5989c3ba17 100644
--- a/target/mips/cpu.c
+++ b/target/mips/cpu.c
@@ -145,7 +145,7 @@ static bool mips_cpu_has_work(CPUState *cs)
      * check for interrupts that can be taken. For pre-release 6 CPUs,
      * check for CP0 Config7 'Wait IE ignore' bit.
      */
-    if ((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         cpu_mips_hw_interrupts_pending(env)) {
         if (cpu_mips_hw_interrupts_enabled(env) ||
             (env->CP0_Config7 & (1 << CP0C7_WII)) ||
@@ -160,7 +160,7 @@ static bool mips_cpu_has_work(CPUState *cs)
          * The QEMU model will issue an _WAKE request whenever the CPUs
          * should be woken up.
          */
-        if (cs->interrupt_request & CPU_INTERRUPT_WAKE) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_WAKE)) {
             has_work = true;
         }
 
@@ -170,7 +170,7 @@ static bool mips_cpu_has_work(CPUState *cs)
     }
     /* MIPS Release 6 has the ability to halt the CPU.  */
     if (env->CP0_Config5 & (1 << CP0C5_VP)) {
-        if (cs->interrupt_request & CPU_INTERRUPT_WAKE) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_WAKE)) {
             has_work = true;
         }
         if (!mips_vp_active(env)) {
diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index ec53acb51a..450947c3fa 100644
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -144,7 +144,7 @@ void kvm_arch_pre_run(CPUState *cs, struct kvm_run *run)
 
     bql_lock();
 
-    if ((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
             cpu_mips_io_interrupts_pending(cpu)) {
         intr.cpu = -1;
         intr.irq = 2;
diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
index dfbb2df643..9bbfe22ed3 100644
--- a/target/openrisc/cpu.c
+++ b/target/openrisc/cpu.c
@@ -78,8 +78,7 @@ static void openrisc_restore_state_to_opc(CPUState *cs,
 #ifndef CONFIG_USER_ONLY
 static bool openrisc_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & (CPU_INTERRUPT_HARD |
-                                    CPU_INTERRUPT_TIMER);
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_TIMER);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index a0e77f2673..db841f1260 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7225,7 +7225,7 @@ static int ppc_cpu_mmu_index(CPUState *cs, bool ifetch)
 #ifndef CONFIG_USER_ONLY
 static bool ppc_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & CPU_INTERRUPT_HARD;
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 015658049e..d145774b09 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1354,7 +1354,7 @@ static int kvmppc_handle_halt(PowerPCCPU *cpu)
     CPUState *cs = CPU(cpu);
     CPUPPCState *env = &cpu->env;
 
-    if (!(cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    if (!cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         FIELD_EX64(env->msr, MSR, EE)) {
         cs->halted = 1;
         cs->exception_index = EXCP_HLT;
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index c6dd5d6f83..da02ae7bf8 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -75,8 +75,7 @@ static void rx_restore_state_to_opc(CPUState *cs,
 
 static bool rx_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request &
-        (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR);
 }
 
 static int rx_cpu_mmu_index(CPUState *cs, bool ifunc)
diff --git a/target/rx/helper.c b/target/rx/helper.c
index 0640ab322b..ce003af421 100644
--- a/target/rx/helper.c
+++ b/target/rx/helper.c
@@ -44,7 +44,7 @@ void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte)
 void rx_cpu_do_interrupt(CPUState *cs)
 {
     CPURXState *env = cpu_env(cs);
-    int do_irq = cs->interrupt_request & INT_FLAGS;
+    int do_irq = cpu_test_interrupt(cs, INT_FLAGS);
     uint32_t save_psw;
 
     env->in_sleep = 0;
diff --git a/target/s390x/cpu-system.c b/target/s390x/cpu-system.c
index 709ccd5299..f3a9ffb2a2 100644
--- a/target/s390x/cpu-system.c
+++ b/target/s390x/cpu-system.c
@@ -49,7 +49,7 @@ bool s390_cpu_has_work(CPUState *cs)
         return false;
     }
 
-    if (!(cs->interrupt_request & CPU_INTERRUPT_HARD)) {
+    if (!cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
         return false;
     }
 
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index 4f561e8c91..21ccb86df4 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -108,7 +108,7 @@ static bool superh_io_recompile_replay_branch(CPUState *cs,
 
 static bool superh_cpu_has_work(CPUState *cs)
 {
-    return cs->interrupt_request & CPU_INTERRUPT_HARD;
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index fb7642bda1..1744ef0e6d 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -58,7 +58,7 @@ int cpu_sh4_is_cached(CPUSH4State *env, target_ulong addr)
 void superh_cpu_do_interrupt(CPUState *cs)
 {
     CPUSH4State *env = cpu_env(cs);
-    int do_irq = cs->interrupt_request & CPU_INTERRUPT_HARD;
+    int do_irq = cpu_test_interrupt(cs, CPU_INTERRUPT_HARD);
     int do_exp, irq_vector = cs->exception_index;
 
     /* prioritize exceptions over interrupts */
diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index 245caf2de0..c9773f1540 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -783,7 +783,7 @@ static void sparc_restore_state_to_opc(CPUState *cs,
 #ifndef CONFIG_USER_ONLY
 static bool sparc_cpu_has_work(CPUState *cs)
 {
-    return (cs->interrupt_request & CPU_INTERRUPT_HARD) &&
+    return cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
            cpu_interrupts_enabled(cpu_env(cs));
 }
 #endif /* !CONFIG_USER_ONLY */
diff --git a/target/sparc/int64_helper.c b/target/sparc/int64_helper.c
index bd14c7a0db..49e4e51c6d 100644
--- a/target/sparc/int64_helper.c
+++ b/target/sparc/int64_helper.c
@@ -89,7 +89,7 @@ void cpu_check_irqs(CPUSPARCState *env)
      * the next bit is (2 << psrpil).
      */
     if (pil < (2 << env->psrpil)) {
-        if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
+        if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
             trace_sparc64_cpu_check_irqs_reset_irq(env->interrupt_index);
             env->interrupt_index = 0;
             cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
@@ -120,7 +120,7 @@ void cpu_check_irqs(CPUSPARCState *env)
                 break;
             }
         }
-    } else if (cs->interrupt_request & CPU_INTERRUPT_HARD) {
+    } else if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
         trace_sparc64_cpu_check_irqs_disabled(pil, env->pil_in, env->softint,
                                               env->interrupt_index);
         env->interrupt_index = 0;

From 73c520b088878682e2d3b7fa19a6366ec8d39829 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:53 +0200
Subject: [PATCH 0130/2396] memory: reintroduce BQL-free fine-grained PIO/MMIO

This patch brings back Jan's idea [1] of BQL-free IO access

This will let us make access to ACPI PM/HPET timers cheaper,
and prevent BQL contention in case of workload that heavily
uses the timers with a lot of vCPUs.

1) 196ea13104f (memory: Add global-locking property to memory regions)
   ... de7ea885c539 (kvm: Switch to unlocked MMIO)

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-2-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/memory.h | 12 ++++++++++++
 system/memory.c         | 15 +++++++++++++++
 system/physmem.c        |  2 +-
 3 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/include/system/memory.h b/include/system/memory.h
index e2cd6ed126..aa85fc27a1 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -833,6 +833,7 @@ struct MemoryRegion {
     bool nonvolatile;
     bool rom_device;
     bool flush_coalesced_mmio;
+    bool lockless_io;
     bool unmergeable;
     uint8_t dirty_log_mask;
     bool is_iommu;
@@ -2341,6 +2342,17 @@ void memory_region_set_flush_coalesced(MemoryRegion *mr);
  */
 void memory_region_clear_flush_coalesced(MemoryRegion *mr);
 
+/**
+ * memory_region_enable_lockless_io: Enable lockless (BQL free) acceess.
+ *
+ * Enable BQL-free access for devices that are well prepared to handle
+ * locking during I/O themselves: either by doing fine grained locking or
+ * by providing lock-free I/O schemes.
+ *
+ * @mr: the memory region to be updated.
+ */
+void memory_region_enable_lockless_io(MemoryRegion *mr);
+
 /**
  * memory_region_add_eventfd: Request an eventfd to be triggered when a word
  *                            is written to a location.
diff --git a/system/memory.c b/system/memory.c
index 5646547940..44701c465c 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2546,6 +2546,21 @@ void memory_region_clear_flush_coalesced(MemoryRegion *mr)
     }
 }
 
+void memory_region_enable_lockless_io(MemoryRegion *mr)
+{
+    mr->lockless_io = true;
+    /*
+     * reentrancy_guard has per device scope, that when enabled
+     * will effectively prevent concurrent access to device's IO
+     * MemoryRegion(s) by not calling accessor callback.
+     *
+     * Turn it off for lock-less IO enabled devices, to allow
+     * concurrent IO.
+     * TODO: remove this when reentrancy_guard becomes per transaction.
+     */
+    mr->disable_reentrancy_guard = true;
+}
+
 void memory_region_add_eventfd(MemoryRegion *mr,
                                hwaddr addr,
                                unsigned size,
diff --git a/system/physmem.c b/system/physmem.c
index e5dd760e0b..f498572fc8 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -2900,7 +2900,7 @@ bool prepare_mmio_access(MemoryRegion *mr)
 {
     bool release_lock = false;
 
-    if (!bql_locked()) {
+    if (!bql_locked() && !mr->lockless_io) {
         bql_lock();
         release_lock = true;
     }

From 4ae5e2b2bf65452538511a2895d7a4e2115058a5 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:54 +0200
Subject: [PATCH 0131/2396] acpi: mark PMTIMER as unlocked

Reading QEMU_CLOCK_VIRTUAL is thread-safe, write access is NOP.

This makes possible to boot Windows with large vCPUs count when
hv-time is not used.

Reproducer:
  -M q35,hpet=off -cpu host -enable-kvm -smp 240,sockets=4 -m 8G WS2025.img
fails to boot within 30min.

With this fix it boots within 2-1min.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-3-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/acpi/core.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/acpi/core.c b/hw/acpi/core.c
index 58f8964e13..ff16582803 100644
--- a/hw/acpi/core.c
+++ b/hw/acpi/core.c
@@ -547,6 +547,7 @@ void acpi_pm_tmr_init(ACPIREGS *ar, acpi_update_sci_fn update_sci,
     ar->tmr.timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, acpi_pm_tmr_timer, ar);
     memory_region_init_io(&ar->tmr.io, memory_region_owner(parent),
                           &acpi_pm_tmr_ops, ar, "acpi-tmr", 4);
+    memory_region_enable_lockless_io(&ar->tmr.io);
     memory_region_add_subregion(parent, 8, &ar->tmr.io);
 }
 

From 7defb58bafac8dcb23c06be5e4f2d1a33d8392fd Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:55 +0200
Subject: [PATCH 0132/2396] hpet: switch to fine-grained device locking

as a step towards lock-less HPET counter read,
use per device locking instead of BQL.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-4-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index cb48cc151f..ab5aa59ae4 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -38,6 +38,7 @@
 #include "hw/timer/i8254.h"
 #include "system/address-spaces.h"
 #include "qom/object.h"
+#include "qemu/lockable.h"
 #include "trace.h"
 
 struct hpet_fw_config hpet_fw_cfg = {.count = UINT8_MAX};
@@ -69,6 +70,7 @@ struct HPETState {
     SysBusDevice parent_obj;
     /*< public >*/
 
+    QemuMutex lock;
     MemoryRegion iomem;
     uint64_t hpet_offset;
     bool hpet_offset_saved;
@@ -428,6 +430,7 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
     trace_hpet_ram_read(addr);
     addr &= ~4;
 
+    QEMU_LOCK_GUARD(&s->lock);
     /*address range of all global regs*/
     if (addr <= 0xff) {
         switch (addr) {
@@ -482,6 +485,7 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
     int len = MIN(size * 8, 64 - shift);
     uint64_t old_val, new_val, cleared;
 
+    QEMU_LOCK_GUARD(&s->lock);
     trace_hpet_ram_write(addr, value);
     addr &= ~4;
 
@@ -679,8 +683,10 @@ static void hpet_init(Object *obj)
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     HPETState *s = HPET(obj);
 
+    qemu_mutex_init(&s->lock);
     /* HPET Area */
     memory_region_init_io(&s->iomem, obj, &hpet_ram_ops, s, "hpet", HPET_LEN);
+    memory_region_enable_lockless_io(&s->iomem);
     sysbus_init_mmio(sbd, &s->iomem);
 }
 

From a453bf0354412592362139bdf4df0d4900ec0686 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:56 +0200
Subject: [PATCH 0133/2396] hpet: move out main counter read into a separate
 block

Follow up patche will switch main counter read to
lock-less mode. As preparation for that move relevant
branch into a separate top level block to make followup
patch cleaner/simplier by reducing contextual noise
when lock-less read is introduced.

no functional changes.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-5-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index ab5aa59ae4..c776afc0f2 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -431,6 +431,16 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
     addr &= ~4;
 
     QEMU_LOCK_GUARD(&s->lock);
+    if (addr == HPET_COUNTER) {
+        if (hpet_enabled(s)) {
+            cur_tick = hpet_get_ticks(s);
+        } else {
+            cur_tick = s->hpet_counter;
+        }
+        trace_hpet_ram_read_reading_counter(addr & 4, cur_tick);
+        return cur_tick >> shift;
+    }
+
     /*address range of all global regs*/
     if (addr <= 0xff) {
         switch (addr) {
@@ -438,14 +448,6 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
             return s->capability >> shift;
         case HPET_CFG:
             return s->config >> shift;
-        case HPET_COUNTER:
-            if (hpet_enabled(s)) {
-                cur_tick = hpet_get_ticks(s);
-            } else {
-                cur_tick = s->hpet_counter;
-            }
-            trace_hpet_ram_read_reading_counter(addr & 4, cur_tick);
-            return cur_tick >> shift;
         case HPET_STATUS:
             return s->isr >> shift;
         default:

From 20c2345290f34aac434284cf9a242c7904d39a27 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:57 +0200
Subject: [PATCH 0134/2396] hpet: make main counter read lock-less

Make access to main HPET counter lock-less.

In unlikely event of an update in progress, readers will busy wait
untill update is finished.

As result micro benchmark of concurrent reading of HPET counter
with large number of vCPU shows over 80% better (less) latency.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-6-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 26 ++++++++++++++++++++------
 1 file changed, 20 insertions(+), 6 deletions(-)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index c776afc0f2..789a31d0a0 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -39,6 +39,7 @@
 #include "system/address-spaces.h"
 #include "qom/object.h"
 #include "qemu/lockable.h"
+#include "qemu/seqlock.h"
 #include "trace.h"
 
 struct hpet_fw_config hpet_fw_cfg = {.count = UINT8_MAX};
@@ -74,6 +75,7 @@ struct HPETState {
     MemoryRegion iomem;
     uint64_t hpet_offset;
     bool hpet_offset_saved;
+    QemuSeqLock state_version;
     qemu_irq irqs[HPET_NUM_IRQ_ROUTES];
     uint32_t flags;
     uint8_t rtc_irq_level;
@@ -430,17 +432,25 @@ static uint64_t hpet_ram_read(void *opaque, hwaddr addr,
     trace_hpet_ram_read(addr);
     addr &= ~4;
 
-    QEMU_LOCK_GUARD(&s->lock);
     if (addr == HPET_COUNTER) {
-        if (hpet_enabled(s)) {
-            cur_tick = hpet_get_ticks(s);
-        } else {
-            cur_tick = s->hpet_counter;
-        }
+        unsigned version;
+
+        /*
+         * Write update is rare, so busywait here is unlikely to happen
+         */
+        do {
+            version = seqlock_read_begin(&s->state_version);
+            if (unlikely(!hpet_enabled(s))) {
+                cur_tick = s->hpet_counter;
+            } else {
+                cur_tick = hpet_get_ticks(s);
+            }
+        } while (seqlock_read_retry(&s->state_version, version));
         trace_hpet_ram_read_reading_counter(addr & 4, cur_tick);
         return cur_tick >> shift;
     }
 
+    QEMU_LOCK_GUARD(&s->lock);
     /*address range of all global regs*/
     if (addr <= 0xff) {
         switch (addr) {
@@ -500,6 +510,7 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
             old_val = s->config;
             new_val = deposit64(old_val, shift, len, value);
             new_val = hpet_fixup_reg(new_val, old_val, HPET_CFG_WRITE_MASK);
+            seqlock_write_begin(&s->state_version);
             s->config = new_val;
             if (activating_bit(old_val, new_val, HPET_CFG_ENABLE)) {
                 /* Enable main counter and interrupt generation. */
@@ -518,6 +529,8 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
                     hpet_del_timer(&s->timer[i]);
                 }
             }
+            seqlock_write_end(&s->state_version);
+
             /* i8254 and RTC output pins are disabled
              * when HPET is in legacy mode */
             if (activating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
@@ -686,6 +699,7 @@ static void hpet_init(Object *obj)
     HPETState *s = HPET(obj);
 
     qemu_mutex_init(&s->lock);
+    seqlock_init(&s->state_version);
     /* HPET Area */
     memory_region_init_io(&s->iomem, obj, &hpet_ram_ops, s, "hpet", HPET_LEN);
     memory_region_enable_lockless_io(&s->iomem);

From 17e645c6f17999cd0306c4d18d6f6cb3db55756d Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:05:59 +0200
Subject: [PATCH 0135/2396] kvm: i386: irqchip: take BQL only if there is an
 interrupt

when kernel-irqchip=split is used, QEMU still hits BQL
contention issue when reading ACPI PM/HPET timers
(despite of timer[s] access being lock-less).

So Windows with more than 255 cpus is still not able to
boot (since it requires iommu -> split irqchip).

Problematic path is in kvm_arch_pre_run() where BQL is taken
unconditionally when split irqchip is in use.

There are a few parts that BQL protects there:
  1. interrupt check and injecting

    however we do not take BQL when checking for pending
    interrupt (even within the same function), so the patch
    takes the same approach for cpu->interrupt_request checks
    and takes BQL only if there is a job to do.

  2. request_interrupt_window access
      CPUState::kvm_run::request_interrupt_window doesn't need BQL
      as it's accessed by its own vCPU thread.

  3. cr8/cpu_get_apic_tpr access
      the same (as #2) applies to CPUState::kvm_run::cr8,
      and APIC registers are also cached/synced (get/put) within
      the vCPU thread it belongs to.

Taking BQL only when is necessary, eleminates BQL bottleneck on
IO/MMIO only exit path, improoving latency by 80% on HPET micro
benchmark.

This lets Windows to boot succesfully (in case hv-time isn't used)
when more than 255 vCPUs are in use.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-8-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index a7b5c8f81b..306430a052 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5478,9 +5478,6 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
         }
     }
 
-    if (!kvm_pic_in_kernel()) {
-        bql_lock();
-    }
 
     /* Force the VCPU out of its inner loop to process any INIT requests
      * or (for userspace APIC, but it is cheap to combine the checks here)
@@ -5489,10 +5486,10 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
             !(env->hflags & HF_SMM_MASK)) {
-            cpu->exit_request = 1;
+            qatomic_set(&cpu->exit_request, 1);
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
-            cpu->exit_request = 1;
+            qatomic_set(&cpu->exit_request, 1);
         }
     }
 
@@ -5503,6 +5500,8 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
             (env->eflags & IF_MASK)) {
             int irq;
 
+            bql_lock();
+
             cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
             irq = cpu_get_pic_interrupt(env);
             if (irq >= 0) {
@@ -5517,6 +5516,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
                             strerror(-ret));
                 }
             }
+            bql_unlock();
         }
 
         /* If we have an interrupt but the guest is not ready to receive an
@@ -5531,8 +5531,6 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
 
         DPRINTF("setting tpr\n");
         run->cr8 = cpu_get_apic_tpr(x86_cpu->apic_state);
-
-        bql_unlock();
     }
 }
 

From 83bd8e65bc70cef03a207df315004f8b1301dc53 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 14 Aug 2025 18:06:00 +0200
Subject: [PATCH 0136/2396] tcg: move interrupt caching and single step masking
 closer to user

in cpu_handle_interrupt() the only place where cached interrupt_request
might have effect is when CPU_INTERRUPT_SSTEP_MASK applied and
cached interrupt_request handed over to cpu_exec_interrupt() and
need_replay_interrupt().

Simplify code by moving interrupt_request caching and CPU_INTERRUPT_SSTEP_MASK
masking into the block where it actually matters and drop reloading cached value
from CPUState:interrupt_request as the rest of the code directly uses
CPUState:interrupt_request.

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Link: https://lore.kernel.org/r/20250814160600.2327672-9-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c | 15 ++++++---------
 1 file changed, 6 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 96c124aa72..8491e5badd 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -782,13 +782,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
     assert(!cpu_test_interrupt(cpu, ~0));
 #else
     if (unlikely(cpu_test_interrupt(cpu, ~0))) {
-        int interrupt_request;
         bql_lock();
-        interrupt_request = cpu->interrupt_request;
-        if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) {
-            /* Mask out external interrupts for this step. */
-            interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
-        }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_DEBUG)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
             cpu->exception_index = EXCP_DEBUG;
@@ -806,6 +800,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             return true;
         } else {
             const TCGCPUOps *tcg_ops = cpu->cc->tcg_ops;
+            int interrupt_request = cpu->interrupt_request;
 
             if (cpu_test_interrupt(cpu, CPU_INTERRUPT_RESET)) {
                 replay_interrupt();
@@ -814,6 +809,11 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
                 return true;
             }
 
+            if (unlikely(cpu->singlestep_enabled & SSTEP_NOIRQ)) {
+                /* Mask out external interrupts for this step. */
+                interrupt_request &= ~CPU_INTERRUPT_SSTEP_MASK;
+            }
+
             /*
              * The target hook has 3 exit conditions:
              * False when the interrupt isn't processed,
@@ -838,9 +838,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
                 cpu->exception_index = -1;
                 *last_tb = NULL;
             }
-            /* The target hook may have updated the 'cpu->interrupt_request';
-             * reload the 'interrupt_request' value */
-            interrupt_request = cpu->interrupt_request;
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_EXITTB)) {
             cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;

From f3d9393791e6c02bae99f920d350e65cd299fed1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 27 Aug 2025 15:27:50 +1000
Subject: [PATCH 0137/2396] hw/core: Dump cpu_reset in the reset.exit phase
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

During reset.hold, the cpu is in an inconsistent state,
where the leaf class has not had a chance to initialize
state at all.

This is visible as a SIGSEGV in "qemu-system-sparc64 -d cpu_reset".

Move the dump to the exit phase, where all initialization
is certain to be complete.

Reported-by: Henk van der Laak <henk@laaksoft.nl>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/cpu-common.c | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 39e674aca2..26321be785 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -119,11 +119,6 @@ static void cpu_common_reset_hold(Object *obj, ResetType type)
 {
     CPUState *cpu = CPU(obj);
 
-    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        qemu_log("CPU Reset (CPU %d)\n", cpu->cpu_index);
-        log_cpu_state(cpu, cpu->cc->reset_dump_flags);
-    }
-
     cpu->interrupt_request = 0;
     cpu->halted = cpu->start_powered_off;
     cpu->mem_io_pc = 0;
@@ -137,6 +132,16 @@ static void cpu_common_reset_hold(Object *obj, ResetType type)
     cpu_exec_reset_hold(cpu);
 }
 
+static void cpu_common_reset_exit(Object *obj, ResetType type)
+{
+    if (qemu_loglevel_mask(CPU_LOG_RESET)) {
+        CPUState *cpu = CPU(obj);
+
+        qemu_log("CPU Reset (CPU %d)\n", cpu->cpu_index);
+        log_cpu_state(cpu, cpu->cc->reset_dump_flags);
+    }
+}
+
 ObjectClass *cpu_class_by_name(const char *typename, const char *cpu_model)
 {
     ObjectClass *oc;
@@ -380,6 +385,7 @@ static void cpu_common_class_init(ObjectClass *klass, const void *data)
     dc->realize = cpu_common_realizefn;
     dc->unrealize = cpu_common_unrealizefn;
     rc->phases.hold = cpu_common_reset_hold;
+    rc->phases.exit = cpu_common_reset_exit;
     cpu_class_init_props(dc);
     /*
      * Reason: CPUs still need special care by board code: wiring up

From fd5c5032df6bea4bbf56752d8885c8a9770c4959 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 27 Aug 2025 15:34:35 +1000
Subject: [PATCH 0138/2396] hw/core: Use qemu_log_trylock/unlock in
 cpu_common_reset_exit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ensure that the "CPU Reset" message won't be separated
from the cpu_dump_state output.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/core/cpu-common.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 26321be785..259cf2a3c3 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -135,10 +135,15 @@ static void cpu_common_reset_hold(Object *obj, ResetType type)
 static void cpu_common_reset_exit(Object *obj, ResetType type)
 {
     if (qemu_loglevel_mask(CPU_LOG_RESET)) {
-        CPUState *cpu = CPU(obj);
+        FILE *f = qemu_log_trylock();
 
-        qemu_log("CPU Reset (CPU %d)\n", cpu->cpu_index);
-        log_cpu_state(cpu, cpu->cc->reset_dump_flags);
+        if (f) {
+            CPUState *cpu = CPU(obj);
+
+            fprintf(f, "CPU Reset (CPU %d)\n", cpu->cpu_index);
+            cpu_dump_state(cpu, f, cpu->cc->reset_dump_flags);
+            qemu_log_unlock(f);
+        }
     }
 }
 

From d7cde4df1c1b1f24dfd7760fe897429b75200b19 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 07:36:25 +1000
Subject: [PATCH 0139/2396] linux-user: Tidy print_socket_protocol
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sink all of the qemu_log calls to the end, collecting only
a string for the name, if identified.  Merge separate if
blocks into one switch.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/strace.c | 102 ++++++++++++++++++++++----------------------
 1 file changed, 52 insertions(+), 50 deletions(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 786354627a..1233ebceb0 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -499,116 +499,118 @@ print_socket_type(int type)
 static void
 print_socket_protocol(int domain, int type, int protocol)
 {
-    if (domain == AF_PACKET ||
-        (domain == AF_INET && type == TARGET_SOCK_PACKET)) {
-        switch (protocol) {
-        case 0x0003:
-            qemu_log("ETH_P_ALL");
-            break;
-        default:
-            qemu_log("%d", protocol);
-        }
-        return;
-    }
+    const char *name = NULL;
 
-    if (domain == PF_NETLINK) {
+    switch (domain) {
+    case AF_PACKET:
+        switch (protocol) {
+        case 3:
+            name = "ETH_P_ALL";
+            break;
+        }
+        break;
+
+    case PF_NETLINK:
         switch (protocol) {
         case NETLINK_ROUTE:
-            qemu_log("NETLINK_ROUTE");
+            name = "NETLINK_ROUTE";
             break;
         case NETLINK_UNUSED:
-            qemu_log("NETLINK_UNUSED");
+            name = "NETLINK_UNUSED";
             break;
         case NETLINK_USERSOCK:
-            qemu_log("NETLINK_USERSOCK");
+            name = "NETLINK_USERSOCK";
             break;
         case NETLINK_FIREWALL:
-            qemu_log("NETLINK_FIREWALL");
+            name = "NETLINK_FIREWALL";
             break;
         case NETLINK_SOCK_DIAG:
-            qemu_log("NETLINK_SOCK_DIAG");
+            name = "NETLINK_SOCK_DIAG";
             break;
         case NETLINK_NFLOG:
-            qemu_log("NETLINK_NFLOG");
+            name = "NETLINK_NFLOG";
             break;
         case NETLINK_XFRM:
-            qemu_log("NETLINK_XFRM");
+            name = "NETLINK_XFRM";
             break;
         case NETLINK_SELINUX:
-            qemu_log("NETLINK_SELINUX");
+            name = "NETLINK_SELINUX";
             break;
         case NETLINK_ISCSI:
-            qemu_log("NETLINK_ISCSI");
+            name = "NETLINK_ISCSI";
             break;
         case NETLINK_AUDIT:
-            qemu_log("NETLINK_AUDIT");
+            name = "NETLINK_AUDIT";
             break;
         case NETLINK_FIB_LOOKUP:
-            qemu_log("NETLINK_FIB_LOOKUP");
+            name = "NETLINK_FIB_LOOKUP";
             break;
         case NETLINK_CONNECTOR:
-            qemu_log("NETLINK_CONNECTOR");
+            name = "NETLINK_CONNECTOR";
             break;
         case NETLINK_NETFILTER:
-            qemu_log("NETLINK_NETFILTER");
+            name = "NETLINK_NETFILTER";
             break;
         case NETLINK_IP6_FW:
-            qemu_log("NETLINK_IP6_FW");
+            name = "NETLINK_IP6_FW";
             break;
         case NETLINK_DNRTMSG:
-            qemu_log("NETLINK_DNRTMSG");
+            name = "NETLINK_DNRTMSG";
             break;
         case NETLINK_KOBJECT_UEVENT:
-            qemu_log("NETLINK_KOBJECT_UEVENT");
+            name = "NETLINK_KOBJECT_UEVENT";
             break;
         case NETLINK_GENERIC:
-            qemu_log("NETLINK_GENERIC");
+            name = "NETLINK_GENERIC";
             break;
         case NETLINK_SCSITRANSPORT:
-            qemu_log("NETLINK_SCSITRANSPORT");
+            name = "NETLINK_SCSITRANSPORT";
             break;
         case NETLINK_ECRYPTFS:
-            qemu_log("NETLINK_ECRYPTFS");
+            name = "NETLINK_ECRYPTFS";
             break;
         case NETLINK_RDMA:
-            qemu_log("NETLINK_RDMA");
+            name = "NETLINK_RDMA";
             break;
         case NETLINK_CRYPTO:
-            qemu_log("NETLINK_CRYPTO");
+            name = "NETLINK_CRYPTO";
             break;
         case NETLINK_SMC:
-            qemu_log("NETLINK_SMC");
-            break;
-        default:
-            qemu_log("%d", protocol);
+            name = "NETLINK_SMC";
             break;
         }
-        return;
-    }
+        break;
 
-    if (domain == AF_INET || domain == AF_INET6) {
+    case AF_INET:
+    case AF_INET6:
         switch (protocol) {
+        case 3:
+            if (domain == AF_INET && type == TARGET_SOCK_PACKET) {
+                name = "ETH_P_ALL";
+            }
+            break;
         case IPPROTO_IP:
-            qemu_log("IPPROTO_IP");
+            name = "IPPROTO_IP";
             break;
         case IPPROTO_TCP:
-            qemu_log("IPPROTO_TCP");
+            name = "IPPROTO_TCP";
             break;
         case IPPROTO_UDP:
-            qemu_log("IPPROTO_UDP");
+            name = "IPPROTO_UDP";
             break;
         case IPPROTO_RAW:
-            qemu_log("IPPROTO_RAW");
-            break;
-        default:
-            qemu_log("%d", protocol);
+            name = "IPPROTO_RAW";
             break;
         }
-        return;
+        break;
     }
-    qemu_log("%d", protocol);
-}
 
+    if (name) {
+        qemu_log("%s", name);
+    } else {
+        qemu_log("%d", protocol);
+    }
+}
 
 #ifdef TARGET_NR__newselect
 static void

From e61df9176d7a0107069de1a77b6f502b24b34f58 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 17:20:12 +0100
Subject: [PATCH 0140/2396] linux-user: Drop deprecated -p option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user-mode '-p' option has been deprecated since 9.0 and
doesn't do anything except emit a warning. We are well past
our minimum deprecation period, so drop the option.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250828162012.3307647-1-peter.maydell@linaro.org>
---
 bsd-user/main.c                 |  8 --------
 docs/about/deprecated.rst       | 10 ----------
 docs/about/removed-features.rst |  8 ++++++++
 docs/user/main.rst              |  3 ---
 linux-user/main.c               | 12 ------------
 5 files changed, 8 insertions(+), 33 deletions(-)

diff --git a/bsd-user/main.c b/bsd-user/main.c
index 7e5d4bbce0..9ba69642f5 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -367,14 +367,6 @@ int main(int argc, char **argv)
             }
         } else if (!strcmp(r, "L")) {
             interp_prefix = argv[optind++];
-        } else if (!strcmp(r, "p")) {
-            unsigned size, want = qemu_real_host_page_size();
-
-            r = argv[optind++];
-            if (qemu_strtoui(r, NULL, 10, &size) || size != want) {
-                warn_report("Deprecated page size option cannot "
-                            "change host page size (%u)", want);
-            }
         } else if (!strcmp(r, "g")) {
             gdbstub = g_strdup(argv[optind++]);
         } else if (!strcmp(r, "r")) {
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index d50645a071..5d1579dcf8 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -81,16 +81,6 @@ kernel since 2001. None of the board types QEMU supports need
 ``param_struct`` support, so this option has been deprecated and will
 be removed in a future QEMU version.
 
-User-mode emulator command line arguments
------------------------------------------
-
-``-p`` (since 9.0)
-''''''''''''''''''
-
-The ``-p`` option pretends to control the host page size.  However,
-it is not possible to change the host page size, and using the
-option only causes failures.
-
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index d7c2113fc3..25a904032c 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -571,6 +571,14 @@ The ``-singlestep`` option has been given a name that better reflects
 what it actually does. For both linux-user and bsd-user, use the
 ``-one-insn-per-tb`` option instead.
 
+``-p`` (removed in 10.2)
+''''''''''''''''''''''''
+
+The ``-p`` option pretends to control the host page size.  However,
+it is not possible to change the host page size; we stopped trying
+to do anything with the option except print a warning from 9.0,
+and now the option is removed entirely.
+
 
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
diff --git a/docs/user/main.rst b/docs/user/main.rst
index 347bdfabf8..a8ddf91424 100644
--- a/docs/user/main.rst
+++ b/docs/user/main.rst
@@ -262,9 +262,6 @@ Debug options:
    Activate logging of the specified items (use '-d help' for a list of
    log items)
 
-``-p pagesize``
-   Act as if the host page size was 'pagesize' bytes
-
 ``-one-insn-per-tb``
    Run the emulation with one guest instruction per translation block.
    This slows down emulation a lot, but can be useful in some situations,
diff --git a/linux-user/main.c b/linux-user/main.c
index 6edeeecef3..7b0ccb6fd6 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -340,16 +340,6 @@ static void handle_arg_ld_prefix(const char *arg)
     interp_prefix = strdup(arg);
 }
 
-static void handle_arg_pagesize(const char *arg)
-{
-    unsigned size, want = qemu_real_host_page_size();
-
-    if (qemu_strtoui(arg, NULL, 10, &size) || size != want) {
-        warn_report("Deprecated page size option cannot "
-                    "change host page size (%u)", want);
-    }
-}
-
 static void handle_arg_seed(const char *arg)
 {
     seed_optarg = arg;
@@ -522,8 +512,6 @@ static const struct qemu_argument arg_table[] = {
      "range[,...]","filter logging based on address range"},
     {"D",          "QEMU_LOG_FILENAME", true, handle_arg_log_filename,
      "logfile",     "write logs to 'logfile' (default stderr)"},
-    {"p",          "QEMU_PAGESIZE",    true,  handle_arg_pagesize,
-     "pagesize",   "deprecated change to host page size"},
     {"one-insn-per-tb",
                    "QEMU_ONE_INSN_PER_TB",  false, handle_arg_one_insn_per_tb,
      "",           "run with one guest instruction per emulated TB"},

From 720dbc31cb424ba6364e99a340fca805d1837bfa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 07:55:10 +1000
Subject: [PATCH 0141/2396] linux-user/x86_64: Convert target_elf_gregset_t to
 a struct

A structure typedef may be abstract, while an array typedef cannot.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 60 +++++++++++++++++++++++---------------------
 1 file changed, 31 insertions(+), 29 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index fce4c05674..ba205c5a19 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -154,7 +154,9 @@ typedef abi_int         target_pid_t;
 #define ELF_ARCH       EM_X86_64
 
 #define ELF_NREG    27
-typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 /*
  * Note that ELF_NREG should be 29 as there should be place for
@@ -163,35 +165,35 @@ typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
  *
  * See linux kernel: arch/x86/include/asm/elf.h
  */
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
-    (*regs)[0] = tswapreg(env->regs[15]);
-    (*regs)[1] = tswapreg(env->regs[14]);
-    (*regs)[2] = tswapreg(env->regs[13]);
-    (*regs)[3] = tswapreg(env->regs[12]);
-    (*regs)[4] = tswapreg(env->regs[R_EBP]);
-    (*regs)[5] = tswapreg(env->regs[R_EBX]);
-    (*regs)[6] = tswapreg(env->regs[11]);
-    (*regs)[7] = tswapreg(env->regs[10]);
-    (*regs)[8] = tswapreg(env->regs[9]);
-    (*regs)[9] = tswapreg(env->regs[8]);
-    (*regs)[10] = tswapreg(env->regs[R_EAX]);
-    (*regs)[11] = tswapreg(env->regs[R_ECX]);
-    (*regs)[12] = tswapreg(env->regs[R_EDX]);
-    (*regs)[13] = tswapreg(env->regs[R_ESI]);
-    (*regs)[14] = tswapreg(env->regs[R_EDI]);
-    (*regs)[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    (*regs)[16] = tswapreg(env->eip);
-    (*regs)[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    (*regs)[18] = tswapreg(env->eflags);
-    (*regs)[19] = tswapreg(env->regs[R_ESP]);
-    (*regs)[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
-    (*regs)[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    (*regs)[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    (*regs)[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    (*regs)[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    (*regs)[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    (*regs)[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->regs[0] = tswapreg(env->regs[15]);
+    r->regs[1] = tswapreg(env->regs[14]);
+    r->regs[2] = tswapreg(env->regs[13]);
+    r->regs[3] = tswapreg(env->regs[12]);
+    r->regs[4] = tswapreg(env->regs[R_EBP]);
+    r->regs[5] = tswapreg(env->regs[R_EBX]);
+    r->regs[6] = tswapreg(env->regs[11]);
+    r->regs[7] = tswapreg(env->regs[10]);
+    r->regs[8] = tswapreg(env->regs[9]);
+    r->regs[9] = tswapreg(env->regs[8]);
+    r->regs[10] = tswapreg(env->regs[R_EAX]);
+    r->regs[11] = tswapreg(env->regs[R_ECX]);
+    r->regs[12] = tswapreg(env->regs[R_EDX]);
+    r->regs[13] = tswapreg(env->regs[R_ESI]);
+    r->regs[14] = tswapreg(env->regs[R_EDI]);
+    r->regs[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
+    r->regs[16] = tswapreg(env->eip);
+    r->regs[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
+    r->regs[18] = tswapreg(env->eflags);
+    r->regs[19] = tswapreg(env->regs[R_ESP]);
+    r->regs[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
+    r->regs[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->regs[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
+    r->regs[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
+    r->regs[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
 }
 
 #if ULONG_MAX > UINT32_MAX

From 4d8db2fa6f8e1e77fd88b1c3a4b0409adad630c0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 07:57:31 +1000
Subject: [PATCH 0142/2396] linux-user/i386: Convert target_elf_gregset_t to a
 struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 40 +++++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ba205c5a19..e8a7f040ed 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -233,7 +233,9 @@ static bool init_guest_commpage(void)
 #define EXSTACK_DEFAULT true
 
 #define ELF_NREG    17
-typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 /*
  * Note that ELF_NREG should be 19 as there should be place for
@@ -242,25 +244,25 @@ typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
  *
  * See linux kernel: arch/x86/include/asm/elf.h
  */
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUX86State *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
-    (*regs)[0] = tswapreg(env->regs[R_EBX]);
-    (*regs)[1] = tswapreg(env->regs[R_ECX]);
-    (*regs)[2] = tswapreg(env->regs[R_EDX]);
-    (*regs)[3] = tswapreg(env->regs[R_ESI]);
-    (*regs)[4] = tswapreg(env->regs[R_EDI]);
-    (*regs)[5] = tswapreg(env->regs[R_EBP]);
-    (*regs)[6] = tswapreg(env->regs[R_EAX]);
-    (*regs)[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    (*regs)[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    (*regs)[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    (*regs)[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    (*regs)[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    (*regs)[12] = tswapreg(env->eip);
-    (*regs)[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    (*regs)[14] = tswapreg(env->eflags);
-    (*regs)[15] = tswapreg(env->regs[R_ESP]);
-    (*regs)[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
+    r->regs[0] = tswapreg(env->regs[R_EBX]);
+    r->regs[1] = tswapreg(env->regs[R_ECX]);
+    r->regs[2] = tswapreg(env->regs[R_EDX]);
+    r->regs[3] = tswapreg(env->regs[R_ESI]);
+    r->regs[4] = tswapreg(env->regs[R_EDI]);
+    r->regs[5] = tswapreg(env->regs[R_EBP]);
+    r->regs[6] = tswapreg(env->regs[R_EAX]);
+    r->regs[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
+    r->regs[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
+    r->regs[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->regs[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
+    r->regs[12] = tswapreg(env->eip);
+    r->regs[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
+    r->regs[14] = tswapreg(env->eflags);
+    r->regs[15] = tswapreg(env->regs[R_ESP]);
+    r->regs[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
 }
 
 /*

From ea37ee2b2659a7fa4b1161112c0be3559180ccdd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:02:18 +1000
Subject: [PATCH 0143/2396] linux-user/arm: Convert target_elf_gregset_t to a
 struct

While we're at it, loop over the general registers
rather than open-code them.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 30 +++++++++---------------------
 1 file changed, 9 insertions(+), 21 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e8a7f040ed..0180f6063f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -296,29 +296,17 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 #define EXSTACK_DEFAULT true
 
 #define ELF_NREG    18
-typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUARMState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
-    (*regs)[0] = tswapreg(env->regs[0]);
-    (*regs)[1] = tswapreg(env->regs[1]);
-    (*regs)[2] = tswapreg(env->regs[2]);
-    (*regs)[3] = tswapreg(env->regs[3]);
-    (*regs)[4] = tswapreg(env->regs[4]);
-    (*regs)[5] = tswapreg(env->regs[5]);
-    (*regs)[6] = tswapreg(env->regs[6]);
-    (*regs)[7] = tswapreg(env->regs[7]);
-    (*regs)[8] = tswapreg(env->regs[8]);
-    (*regs)[9] = tswapreg(env->regs[9]);
-    (*regs)[10] = tswapreg(env->regs[10]);
-    (*regs)[11] = tswapreg(env->regs[11]);
-    (*regs)[12] = tswapreg(env->regs[12]);
-    (*regs)[13] = tswapreg(env->regs[13]);
-    (*regs)[14] = tswapreg(env->regs[14]);
-    (*regs)[15] = tswapreg(env->regs[15]);
-
-    (*regs)[16] = tswapreg(cpsr_read((CPUARMState *)env));
-    (*regs)[17] = tswapreg(env->regs[0]); /* XXX */
+    for (int i = 0; i < 16; ++i) {
+        r->regs[i] = tswapreg(env->regs[i]);
+    }
+    r->regs[16] = tswapreg(cpsr_read((CPUARMState *)env));
+    r->regs[17] = tswapreg(env->regs[0]); /* XXX */
 }
 
 #define USE_ELF_CORE_DUMP

From 0b3357425cef78233ec0c574990a4e70e53c30e6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:03:45 +1000
Subject: [PATCH 0144/2396] linux-user/aarch64: Convert target_elf_gregset_t to
 a struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0180f6063f..da57c6c2ce 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -384,18 +384,17 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_CLASS       ELFCLASS64
 
 #define ELF_NREG    34
-typedef target_elf_greg_t  target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs,
-                               const CPUARMState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
-    int i;
-
-    for (i = 0; i < 32; i++) {
-        (*regs)[i] = tswapreg(env->xregs[i]);
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(env->xregs[i]);
     }
-    (*regs)[32] = tswapreg(env->pc);
-    (*regs)[33] = tswapreg(pstate_read((CPUARMState *)env));
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(pstate_read((CPUARMState *)env));
 }
 
 #define USE_ELF_CORE_DUMP

From 544843f2e76b2d40535b8b3d14007371cbd868f8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:05:47 +1000
Subject: [PATCH 0145/2396] linux-user/ppc: Convert target_elf_gregset_t to a
 struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index da57c6c2ce..0dd76937f9 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -470,25 +470,27 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 
 /* See linux kernel: arch/powerpc/include/asm/elf.h.  */
 #define ELF_NREG 48
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUPPCState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
 {
     int i;
     target_ulong ccr = 0;
 
     for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
-        (*regs)[i] = tswapreg(env->gpr[i]);
+        r->regs[i] = tswapreg(env->gpr[i]);
     }
 
-    (*regs)[32] = tswapreg(env->nip);
-    (*regs)[33] = tswapreg(env->msr);
-    (*regs)[35] = tswapreg(env->ctr);
-    (*regs)[36] = tswapreg(env->lr);
-    (*regs)[37] = tswapreg(cpu_read_xer(env));
+    r->regs[32] = tswapreg(env->nip);
+    r->regs[33] = tswapreg(env->msr);
+    r->regs[35] = tswapreg(env->ctr);
+    r->regs[36] = tswapreg(env->lr);
+    r->regs[37] = tswapreg(cpu_read_xer(env));
 
     ccr = ppc_get_cr(env);
-    (*regs)[38] = tswapreg(ccr);
+    r->regs[38] = tswapreg(ccr);
 }
 
 #define USE_ELF_CORE_DUMP

From 68bb444d358c8cbe7bf4d8f942491ff01f132443 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:07:32 +1000
Subject: [PATCH 0146/2396] linux-user/loongarch64: Convert
 target_elf_gregset_t to a struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0dd76937f9..1e59399afa 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -518,7 +518,9 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
 
 /* See linux kernel: arch/loongarch/include/asm/elf.h */
 #define ELF_NREG 45
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 enum {
     TARGET_EF_R0 = 0,
@@ -526,19 +528,17 @@ enum {
     TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs,
+static void elf_core_copy_regs(target_elf_gregset_t *r,
                                const CPULoongArchState *env)
 {
-    int i;
+    r->regs[TARGET_EF_R0] = 0;
 
-    (*regs)[TARGET_EF_R0] = 0;
-
-    for (i = 1; i < ARRAY_SIZE(env->gpr); i++) {
-        (*regs)[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
+    for (int i = 1; i < ARRAY_SIZE(env->gpr); i++) {
+        r->regs[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
     }
 
-    (*regs)[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
-    (*regs)[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
+    r->regs[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
+    r->regs[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
 }
 
 #define USE_ELF_CORE_DUMP

From 5c86402eef21c09c65c23158ddebd791fdf603c9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:10:05 +1000
Subject: [PATCH 0147/2396] linux-user/mips: Convert target_elf_gregset_t to a
 struct

While we're at it, merge the store of TARGET_EF_R0 into the
loop over all R0 registers.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1e59399afa..8fcdb0569b 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -564,7 +564,9 @@ static void elf_core_copy_regs(target_elf_gregset_t *r,
 
 /* See linux kernel: arch/mips/include/asm/elf.h.  */
 #define ELF_NREG 45
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 /* See linux kernel: arch/mips/include/asm/reg.h.  */
 enum {
@@ -584,27 +586,25 @@ enum {
 };
 
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMIPSState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
 {
     int i;
 
-    for (i = 0; i < TARGET_EF_R0; i++) {
-        (*regs)[i] = 0;
+    for (i = 0; i <= TARGET_EF_R0; i++) {
+        r->regs[i] = 0;
     }
-    (*regs)[TARGET_EF_R0] = 0;
-
     for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
-        (*regs)[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
+        r->regs[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
     }
 
-    (*regs)[TARGET_EF_R26] = 0;
-    (*regs)[TARGET_EF_R27] = 0;
-    (*regs)[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
-    (*regs)[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
-    (*regs)[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
-    (*regs)[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
-    (*regs)[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
-    (*regs)[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
+    r->regs[TARGET_EF_R26] = 0;
+    r->regs[TARGET_EF_R27] = 0;
+    r->regs[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
+    r->regs[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
+    r->regs[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
+    r->regs[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
+    r->regs[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
+    r->regs[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
 }
 
 #define USE_ELF_CORE_DUMP

From b4ad80d6d3355f2ab7f02381f8eb697609b89e93 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:13:46 +1000
Subject: [PATCH 0148/2396] linux-user/microblaze: Convert target_elf_gregset_t
 to a struct

While we're at it, drop "pos++" and simply open-code indexes.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 8fcdb0569b..40a5bcccab 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -623,23 +623,23 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
 
 #define USE_ELF_CORE_DUMP
 #define ELF_NREG 38
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUMBState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
 {
-    int i, pos = 0;
-
-    for (i = 0; i < 32; i++) {
-        (*regs)[pos++] = tswapreg(env->regs[i]);
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(env->regs[i]);
     }
 
-    (*regs)[pos++] = tswapreg(env->pc);
-    (*regs)[pos++] = tswapreg(mb_cpu_read_msr(env));
-    (*regs)[pos++] = 0;
-    (*regs)[pos++] = tswapreg(env->ear);
-    (*regs)[pos++] = 0;
-    (*regs)[pos++] = tswapreg(env->esr);
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(mb_cpu_read_msr(env));
+    r->regs[34] = 0;
+    r->regs[35] = tswapreg(env->ear);
+    r->regs[36] = 0;
+    r->regs[37] = tswapreg(env->esr);
 }
 
 #endif /* TARGET_MICROBLAZE */

From aebdd808e6288d78d7393bf1d4b49aaea93f786c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:15:44 +1000
Subject: [PATCH 0149/2396] linux-user/openrisc: Convert target_elf_gregset_t
 to a struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 40a5bcccab..da034e5a76 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -655,18 +655,18 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
 
 /* See linux kernel arch/openrisc/include/asm/elf.h.  */
 #define ELF_NREG 34 /* gprs and pc, sr */
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs,
+static void elf_core_copy_regs(target_elf_gregset_t *r,
                                const CPUOpenRISCState *env)
 {
-    int i;
-
-    for (i = 0; i < 32; i++) {
-        (*regs)[i] = tswapreg(cpu_get_gpr(env, i));
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(cpu_get_gpr(env, i));
     }
-    (*regs)[32] = tswapreg(env->pc);
-    (*regs)[33] = tswapreg(cpu_get_sr(env));
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(cpu_get_sr(env));
 }
 
 #endif /* TARGET_OPENRISC */

From 7bd01645d66c23ef5494dcc8ea13d15bc90d82f5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:17:40 +1000
Subject: [PATCH 0150/2396] linux-user/sh4: Convert target_elf_gregset_t to a
 struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index da034e5a76..cc9140bf32 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -678,7 +678,9 @@ static void elf_core_copy_regs(target_elf_gregset_t *r,
 
 /* See linux kernel: arch/sh/include/asm/elf.h.  */
 #define ELF_NREG 23
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 /* See linux kernel: arch/sh/include/asm/ptrace.h.  */
 enum {
@@ -691,22 +693,19 @@ enum {
     TARGET_REG_SYSCALL = 22
 };
 
-static inline void elf_core_copy_regs(target_elf_gregset_t *regs,
-                                      const CPUSH4State *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
 {
-    int i;
-
-    for (i = 0; i < 16; i++) {
-        (*regs)[i] = tswapreg(env->gregs[i]);
+    for (int i = 0; i < 16; i++) {
+        r->regs[i] = tswapreg(env->gregs[i]);
     }
 
-    (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
-    (*regs)[TARGET_REG_PR] = tswapreg(env->pr);
-    (*regs)[TARGET_REG_SR] = tswapreg(env->sr);
-    (*regs)[TARGET_REG_GBR] = tswapreg(env->gbr);
-    (*regs)[TARGET_REG_MACH] = tswapreg(env->mach);
-    (*regs)[TARGET_REG_MACL] = tswapreg(env->macl);
-    (*regs)[TARGET_REG_SYSCALL] = 0; /* FIXME */
+    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
+    r->regs[TARGET_REG_PR] = tswapreg(env->pr);
+    r->regs[TARGET_REG_SR] = tswapreg(env->sr);
+    r->regs[TARGET_REG_GBR] = tswapreg(env->gbr);
+    r->regs[TARGET_REG_MACH] = tswapreg(env->mach);
+    r->regs[TARGET_REG_MACL] = tswapreg(env->macl);
+    r->regs[TARGET_REG_SYSCALL] = 0; /* FIXME */
 }
 
 #define USE_ELF_CORE_DUMP

From a9caaa69f081c6ae0a1adead578a757be5dec98b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:19:30 +1000
Subject: [PATCH 0151/2396] linux-user/m68k: Convert target_elf_gregset_t to a
 struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 46 +++++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index cc9140bf32..63376fa1d6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -720,30 +720,32 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
 
 /* See linux kernel: arch/m68k/include/asm/elf.h.  */
 #define ELF_NREG 20
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUM68KState *env)
+static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
 {
-    (*regs)[0] = tswapreg(env->dregs[1]);
-    (*regs)[1] = tswapreg(env->dregs[2]);
-    (*regs)[2] = tswapreg(env->dregs[3]);
-    (*regs)[3] = tswapreg(env->dregs[4]);
-    (*regs)[4] = tswapreg(env->dregs[5]);
-    (*regs)[5] = tswapreg(env->dregs[6]);
-    (*regs)[6] = tswapreg(env->dregs[7]);
-    (*regs)[7] = tswapreg(env->aregs[0]);
-    (*regs)[8] = tswapreg(env->aregs[1]);
-    (*regs)[9] = tswapreg(env->aregs[2]);
-    (*regs)[10] = tswapreg(env->aregs[3]);
-    (*regs)[11] = tswapreg(env->aregs[4]);
-    (*regs)[12] = tswapreg(env->aregs[5]);
-    (*regs)[13] = tswapreg(env->aregs[6]);
-    (*regs)[14] = tswapreg(env->dregs[0]);
-    (*regs)[15] = tswapreg(env->aregs[7]);
-    (*regs)[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
-    (*regs)[17] = tswapreg(env->sr);
-    (*regs)[18] = tswapreg(env->pc);
-    (*regs)[19] = 0;  /* FIXME: regs->format | regs->vector */
+    r->regs[0] = tswapreg(env->dregs[1]);
+    r->regs[1] = tswapreg(env->dregs[2]);
+    r->regs[2] = tswapreg(env->dregs[3]);
+    r->regs[3] = tswapreg(env->dregs[4]);
+    r->regs[4] = tswapreg(env->dregs[5]);
+    r->regs[5] = tswapreg(env->dregs[6]);
+    r->regs[6] = tswapreg(env->dregs[7]);
+    r->regs[7] = tswapreg(env->aregs[0]);
+    r->regs[8] = tswapreg(env->aregs[1]);
+    r->regs[9] = tswapreg(env->aregs[2]);
+    r->regs[10] = tswapreg(env->aregs[3]);
+    r->regs[11] = tswapreg(env->aregs[4]);
+    r->regs[12] = tswapreg(env->aregs[5]);
+    r->regs[13] = tswapreg(env->aregs[6]);
+    r->regs[14] = tswapreg(env->dregs[0]);
+    r->regs[15] = tswapreg(env->aregs[7]);
+    r->regs[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
+    r->regs[17] = tswapreg(env->sr);
+    r->regs[18] = tswapreg(env->pc);
+    r->regs[19] = 0;  /* FIXME: regs->format | regs->vector */
 }
 
 #define USE_ELF_CORE_DUMP

From f2accdfac4ca431dd58054a82c2312bc58e984a2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:30:25 +1000
Subject: [PATCH 0152/2396] linux-user/s390x: Convert target_elf_gregset_t to a
 struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 63376fa1d6..98c17d32e6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -770,7 +770,9 @@ static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
 
 /* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
 #define ELF_NREG 27
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 enum {
     TARGET_REG_PSWM = 0,
@@ -780,22 +782,22 @@ enum {
     TARGET_REG_ORIG_R2 = 26,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs,
+static void elf_core_copy_regs(target_elf_gregset_t *r,
                                const CPUS390XState *env)
 {
     int i;
     uint32_t *aregs;
 
-    (*regs)[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
-    (*regs)[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
+    r->regs[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
+    r->regs[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
     for (i = 0; i < 16; i++) {
-        (*regs)[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
+        r->regs[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
     }
-    aregs = (uint32_t *)&((*regs)[TARGET_REG_ARS]);
+    aregs = (uint32_t *)&(r->regs[TARGET_REG_ARS]);
     for (i = 0; i < 16; i++) {
         aregs[i] = tswap32(env->aregs[i]);
     }
-    (*regs)[TARGET_REG_ORIG_R2] = 0;
+    r->regs[TARGET_REG_ORIG_R2] = 0;
 }
 
 #define USE_ELF_CORE_DUMP

From 8caa6621109ea1fb71870aa52c688de1f7dc64e9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:32:11 +1000
Subject: [PATCH 0153/2396] linux-user/xtensa: Convert target_elf_gregset_t to
 a struct

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 98c17d32e6..930701f08f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -873,7 +873,9 @@ static bool init_guest_commpage(void)
 
 /* See linux kernel: arch/xtensa/include/asm/elf.h.  */
 #define ELF_NREG 128
-typedef target_elf_greg_t target_elf_gregset_t[ELF_NREG];
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 enum {
     TARGET_REG_PC,
@@ -888,23 +890,23 @@ enum {
     TARGET_REG_AR0 = 64,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *regs,
+static void elf_core_copy_regs(target_elf_gregset_t *r,
                                const CPUXtensaState *env)
 {
     unsigned i;
 
-    (*regs)[TARGET_REG_PC] = tswapreg(env->pc);
-    (*regs)[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
-    (*regs)[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
-    (*regs)[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
-    (*regs)[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
-    (*regs)[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
-    (*regs)[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
-    (*regs)[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
-    (*regs)[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
+    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
+    r->regs[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
+    r->regs[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
+    r->regs[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
+    r->regs[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
+    r->regs[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
+    r->regs[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
+    r->regs[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
+    r->regs[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
     xtensa_sync_phys_from_window((CPUXtensaState *)env);
     for (i = 0; i < env->config->nareg; ++i) {
-        (*regs)[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
+        r->regs[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
     }
 }
 

From 1b32b3d7d8d438ee46313312aa62ae8b89c90bcb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 08:37:17 +1000
Subject: [PATCH 0154/2396] linux-user: Update comment for target_elf_gregset_t

The only thing now used by generic core dump code is
target_elf_gregset_t; ELF_NREG and target_elf_greg_t
are now private to the implementation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 930701f08f..74f88dfa68 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2859,12 +2859,8 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
  *
  * #define USE_ELF_CORE_DUMP
  *
- * Next you define type of register set used for dumping.  ELF specification
- * says that it needs to be array of elf_greg_t that has size of ELF_NREG.
- *
- * typedef <target_regtype> target_elf_greg_t;
- * #define ELF_NREG <number of registers>
- * typedef taret_elf_greg_t target_elf_gregset_t[ELF_NREG];
+ * Next you define type of register set used for dumping:
+ * typedef struct target_elf_gregset_t { ... } target_elf_gregset_t;
  *
  * Last step is to implement target specific function that copies registers
  * from given cpu into just specified register set.  Prototype is:

From 553bf7dbd466794955f93c07b5c6fc0a7f65abb4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 2 Aug 2025 19:38:28 +1000
Subject: [PATCH 0155/2396] linux-user: Declare elf_core_copy_regs in loader.h

Drop the static from all implementations.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 33 ++++++++++++++-------------------
 linux-user/loader.h  |  3 +++
 2 files changed, 17 insertions(+), 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 74f88dfa68..5ed5b3c544 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -165,7 +165,7 @@ typedef struct target_elf_gregset_t {
  *
  * See linux kernel: arch/x86/include/asm/elf.h
  */
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
     r->regs[0] = tswapreg(env->regs[15]);
     r->regs[1] = tswapreg(env->regs[14]);
@@ -244,7 +244,7 @@ typedef struct target_elf_gregset_t {
  *
  * See linux kernel: arch/x86/include/asm/elf.h
  */
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
     r->regs[0] = tswapreg(env->regs[R_EBX]);
     r->regs[1] = tswapreg(env->regs[R_ECX]);
@@ -300,7 +300,7 @@ typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
 } target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
     for (int i = 0; i < 16; ++i) {
         r->regs[i] = tswapreg(env->regs[i]);
@@ -388,7 +388,7 @@ typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
 } target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
     for (int i = 0; i < 32; i++) {
         r->regs[i] = tswapreg(env->xregs[i]);
@@ -474,7 +474,7 @@ typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
 } target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
 {
     int i;
     target_ulong ccr = 0;
@@ -528,8 +528,7 @@ enum {
     TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *r,
-                               const CPULoongArchState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPULoongArchState *env)
 {
     r->regs[TARGET_EF_R0] = 0;
 
@@ -586,7 +585,7 @@ enum {
 };
 
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
 {
     int i;
 
@@ -628,7 +627,7 @@ typedef struct target_elf_gregset_t {
 } target_elf_gregset_t;
 
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
 {
     for (int i = 0; i < 32; i++) {
         r->regs[i] = tswapreg(env->regs[i]);
@@ -659,8 +658,7 @@ typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
 } target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *r,
-                               const CPUOpenRISCState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUOpenRISCState *env)
 {
     for (int i = 0; i < 32; i++) {
         r->regs[i] = tswapreg(cpu_get_gpr(env, i));
@@ -693,7 +691,7 @@ enum {
     TARGET_REG_SYSCALL = 22
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
 {
     for (int i = 0; i < 16; i++) {
         r->regs[i] = tswapreg(env->gregs[i]);
@@ -724,7 +722,7 @@ typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
 } target_elf_gregset_t;
 
-static void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
 {
     r->regs[0] = tswapreg(env->dregs[1]);
     r->regs[1] = tswapreg(env->dregs[2]);
@@ -782,8 +780,7 @@ enum {
     TARGET_REG_ORIG_R2 = 26,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *r,
-                               const CPUS390XState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUS390XState *env)
 {
     int i;
     uint32_t *aregs;
@@ -890,8 +887,7 @@ enum {
     TARGET_REG_AR0 = 64,
 };
 
-static void elf_core_copy_regs(target_elf_gregset_t *r,
-                               const CPUXtensaState *env)
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUXtensaState *env)
 {
     unsigned i;
 
@@ -2865,8 +2861,7 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
  * Last step is to implement target specific function that copies registers
  * from given cpu into just specified register set.  Prototype is:
  *
- * static void elf_core_copy_regs(taret_elf_gregset_t *regs,
- *                                const CPUArchState *env);
+ * void elf_core_copy_regs(target_elf_gregset_t *regs, const CPUArchState *env);
  *
  * Parameters:
  *     regs - copy register values into here (allocated and zeroed by caller)
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 6482c7c90c..8f4a7f69ac 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -106,4 +106,7 @@ const char *elf_hwcap2_str(uint32_t bit);
 const char *get_elf_platform(CPUState *cs);
 const char *get_elf_base_platform(CPUState *cs);
 
+struct target_elf_gregset_t;
+void elf_core_copy_regs(struct target_elf_gregset_t *, const CPUArchState *);
+
 #endif /* LINUX_USER_LOADER_H */

From bb130c1758863f9d5c825ed7bf21669c15d6deff Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 09:46:08 +1000
Subject: [PATCH 0156/2396] linux-user: Rename USE_ELF_CORE_DUMP to
 HAVE_ELF_CORE_DUMP

The other knobs in target_elf.h are all HAVE_*.
Rename this USE_ELF_CORE_DUMP to match.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 38 +++++++++++++++++++-------------------
 1 file changed, 19 insertions(+), 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5ed5b3c544..af31a34594 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -281,7 +281,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #endif /* TARGET_I386 */
@@ -309,7 +309,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
     r->regs[17] = tswapreg(env->regs[0]); /* XXX */
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 /* The commpage only exists for 32 bit kernels */
@@ -397,7 +397,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
     r->regs[33] = tswapreg(pstate_read((CPUARMState *)env));
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #if TARGET_BIG_ENDIAN
@@ -493,7 +493,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
     r->regs[38] = tswapreg(ccr);
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #ifndef TARGET_PPC64
@@ -540,7 +540,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPULoongArchState *env)
     r->regs[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif /* TARGET_LOONGARCH64 */
@@ -606,7 +606,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
     r->regs[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif /* TARGET_MIPS */
@@ -620,7 +620,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
 
 #define ELF_EXEC_PAGESIZE        4096
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_NREG 38
 typedef struct target_elf_gregset_t {
     target_elf_greg_t regs[ELF_NREG];
@@ -649,7 +649,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
 #define ELF_CLASS ELFCLASS32
 #define ELF_DATA  ELFDATA2MSB
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 8192
 
 /* See linux kernel arch/openrisc/include/asm/elf.h.  */
@@ -706,7 +706,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
     r->regs[TARGET_REG_SYSCALL] = 0; /* FIXME */
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif
@@ -746,7 +746,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
     r->regs[19] = 0;  /* FIXME: regs->format | regs->vector */
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       8192
 
 #endif
@@ -797,7 +797,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUS390XState *env)
     r->regs[TARGET_REG_ORIG_R2] = 0;
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 4096
 
 #define VDSO_HEADER "vdso.c.inc"
@@ -906,7 +906,7 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUXtensaState *env)
     }
 }
 
-#define USE_ELF_CORE_DUMP
+#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #endif /* TARGET_XTENSA */
@@ -1115,9 +1115,9 @@ static void bswap_mips_abiflags(Mips_elf_abiflags_v0 *abiflags)
 }
 #endif
 
-#ifdef USE_ELF_CORE_DUMP
+#ifdef HAVE_ELF_CORE_DUMP
 static int elf_core_dump(int, const CPUArchState *);
-#endif /* USE_ELF_CORE_DUMP */
+#endif /* HAVE_ELF_CORE_DUMP */
 static void load_symbols(struct elfhdr *hdr, const ImageSource *src,
                          abi_ulong load_bias);
 
@@ -2827,14 +2827,14 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
         g_free(elf_interpreter);
     }
 
-#ifdef USE_ELF_CORE_DUMP
+#ifdef HAVE_ELF_CORE_DUMP
     bprm->core_dump = &elf_core_dump;
 #endif
 
     return 0;
 }
 
-#ifdef USE_ELF_CORE_DUMP
+#ifdef HAVE_ELF_CORE_DUMP
 
 /*
  * Definitions to generate Intel SVR4-like core files.
@@ -2850,10 +2850,10 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
  * Core dump code is copied from linux kernel (fs/binfmt_elf.c).
  *
  * Porting ELF coredump for target is (quite) simple process.  First you
- * define USE_ELF_CORE_DUMP in target ELF code (where init_thread() for
+ * define HAVE_ELF_CORE_DUMP in target ELF code (where init_thread() for
  * the target resides):
  *
- * #define USE_ELF_CORE_DUMP
+ * #define HAVE_ELF_CORE_DUMP
  *
  * Next you define type of register set used for dumping:
  * typedef struct target_elf_gregset_t { ... } target_elf_gregset_t;
@@ -3392,4 +3392,4 @@ static int elf_core_dump(int signr, const CPUArchState *env)
     }
     return ret;
 }
-#endif /* USE_ELF_CORE_DUMP */
+#endif /* HAVE_ELF_CORE_DUMP */

From 93c62ca6fe31dadbdb38688f67c741ee00448a24 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 09:48:07 +1000
Subject: [PATCH 0157/2396] linux-user: Move elf_core_copy_regs to
 {i386,x86_64}/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 77 ----------------------------------
 linux-user/i386/elfload.c      | 24 +++++++++++
 linux-user/i386/target_elf.h   | 15 +++++++
 linux-user/x86_64/elfload.c    | 34 +++++++++++++++
 linux-user/x86_64/target_elf.h | 15 +++++++
 5 files changed, 88 insertions(+), 77 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index af31a34594..e4f821f8c8 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -153,49 +153,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
 
-#define ELF_NREG    27
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-/*
- * Note that ELF_NREG should be 29 as there should be place for
- * TRAPNO and ERR "registers" as well but linux doesn't dump
- * those.
- *
- * See linux kernel: arch/x86/include/asm/elf.h
- */
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
-{
-    r->regs[0] = tswapreg(env->regs[15]);
-    r->regs[1] = tswapreg(env->regs[14]);
-    r->regs[2] = tswapreg(env->regs[13]);
-    r->regs[3] = tswapreg(env->regs[12]);
-    r->regs[4] = tswapreg(env->regs[R_EBP]);
-    r->regs[5] = tswapreg(env->regs[R_EBX]);
-    r->regs[6] = tswapreg(env->regs[11]);
-    r->regs[7] = tswapreg(env->regs[10]);
-    r->regs[8] = tswapreg(env->regs[9]);
-    r->regs[9] = tswapreg(env->regs[8]);
-    r->regs[10] = tswapreg(env->regs[R_EAX]);
-    r->regs[11] = tswapreg(env->regs[R_ECX]);
-    r->regs[12] = tswapreg(env->regs[R_EDX]);
-    r->regs[13] = tswapreg(env->regs[R_ESI]);
-    r->regs[14] = tswapreg(env->regs[R_EDI]);
-    r->regs[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    r->regs[16] = tswapreg(env->eip);
-    r->regs[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    r->regs[18] = tswapreg(env->eflags);
-    r->regs[19] = tswapreg(env->regs[R_ESP]);
-    r->regs[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
-    r->regs[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    r->regs[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    r->regs[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    r->regs[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
-}
-
 #if ULONG_MAX > UINT32_MAX
 #define INIT_GUEST_COMMPAGE
 static bool init_guest_commpage(void)
@@ -232,39 +189,6 @@ static bool init_guest_commpage(void)
 
 #define EXSTACK_DEFAULT true
 
-#define ELF_NREG    17
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-/*
- * Note that ELF_NREG should be 19 as there should be place for
- * TRAPNO and ERR "registers" as well but linux doesn't dump
- * those.
- *
- * See linux kernel: arch/x86/include/asm/elf.h
- */
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
-{
-    r->regs[0] = tswapreg(env->regs[R_EBX]);
-    r->regs[1] = tswapreg(env->regs[R_ECX]);
-    r->regs[2] = tswapreg(env->regs[R_EDX]);
-    r->regs[3] = tswapreg(env->regs[R_ESI]);
-    r->regs[4] = tswapreg(env->regs[R_EDI]);
-    r->regs[5] = tswapreg(env->regs[R_EBP]);
-    r->regs[6] = tswapreg(env->regs[R_EAX]);
-    r->regs[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    r->regs[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    r->regs[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    r->regs[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    r->regs[12] = tswapreg(env->eip);
-    r->regs[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    r->regs[14] = tswapreg(env->eflags);
-    r->regs[15] = tswapreg(env->regs[R_ESP]);
-    r->regs[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
-}
-
 /*
  * i386 is the only target which supplies AT_SYSINFO for the vdso.
  * All others only supply AT_SYSINFO_EHDR.
@@ -281,7 +205,6 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #endif /* TARGET_I386 */
diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index ef3a6c35d2..279aeb8116 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -23,3 +24,26 @@ const char *get_elf_platform(CPUState *cs)
     family = MAX(MIN(family, 6), 3);
     return elf_platform[family - 3];
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
+{
+    r->regs[0] = tswapreg(env->regs[R_EBX]);
+    r->regs[1] = tswapreg(env->regs[R_ECX]);
+    r->regs[2] = tswapreg(env->regs[R_EDX]);
+    r->regs[3] = tswapreg(env->regs[R_ESI]);
+    r->regs[4] = tswapreg(env->regs[R_EDI]);
+    r->regs[5] = tswapreg(env->regs[R_EBP]);
+    r->regs[6] = tswapreg(env->regs[R_EAX]);
+    r->regs[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
+    r->regs[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
+    r->regs[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->regs[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
+    r->regs[12] = tswapreg(env->eip);
+    r->regs[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
+    r->regs[14] = tswapreg(env->eflags);
+    r->regs[15] = tswapreg(env->regs[R_ESP]);
+    r->regs[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
+}
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index 44dde1ac4a..eb286868e1 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -10,5 +10,20 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
+#define HAVE_ELF_CORE_DUMP      1
+
+/*
+ * Note that ELF_NREG should be 19 as there should be place for
+ * TRAPNO and ERR "registers" as well but linux doesn't dump those.
+ *
+ * See linux kernel: arch/x86/include/asm/elf.h
+ */
+#define ELF_NREG                17
+
+typedef abi_ulong target_elf_greg_t;
+
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 88541ea45e..76cf5c1509 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -19,3 +20,36 @@ const char *get_elf_platform(CPUState *cs)
 {
     return "x86_64";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
+{
+    r->regs[0] = tswapreg(env->regs[15]);
+    r->regs[1] = tswapreg(env->regs[14]);
+    r->regs[2] = tswapreg(env->regs[13]);
+    r->regs[3] = tswapreg(env->regs[12]);
+    r->regs[4] = tswapreg(env->regs[R_EBP]);
+    r->regs[5] = tswapreg(env->regs[R_EBX]);
+    r->regs[6] = tswapreg(env->regs[11]);
+    r->regs[7] = tswapreg(env->regs[10]);
+    r->regs[8] = tswapreg(env->regs[9]);
+    r->regs[9] = tswapreg(env->regs[8]);
+    r->regs[10] = tswapreg(env->regs[R_EAX]);
+    r->regs[11] = tswapreg(env->regs[R_ECX]);
+    r->regs[12] = tswapreg(env->regs[R_EDX]);
+    r->regs[13] = tswapreg(env->regs[R_ESI]);
+    r->regs[14] = tswapreg(env->regs[R_EDI]);
+    r->regs[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
+    r->regs[16] = tswapreg(env->eip);
+    r->regs[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
+    r->regs[18] = tswapreg(env->eflags);
+    r->regs[19] = tswapreg(env->regs[R_ESP]);
+    r->regs[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
+    r->regs[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->regs[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
+    r->regs[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
+    r->regs[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
+    r->regs[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
+}
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 498c3f7e4e..74a77d94cd 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -10,5 +10,20 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
+#define HAVE_ELF_CORE_DUMP      1
+
+/*
+ * Note that ELF_NREG should be 29 as there should be place for
+ * TRAPNO and ERR "registers" as well but linux doesn't dump those.
+ *
+ * See linux kernel: arch/x86/include/asm/elf.h
+ */
+#define ELF_NREG                27
+
+typedef abi_ulong target_elf_greg_t;
+
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From 53c6724cc96acc64bf6213e5820e3cd610e7eaa4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 05:51:30 -1000
Subject: [PATCH 0158/2396] linux-user: Move elf_core_copy_regs to
 arm/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/elfload.c    | 12 ++++++++++++
 linux-user/arm/target_elf.h |  8 ++++++++
 linux-user/elfload.c        | 15 ---------------
 3 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index 7de1f13f4b..47fe16a1a6 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -4,6 +4,7 @@
 #include "qemu.h"
 #include "loader.h"
 #include "target/arm/cpu-features.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -199,3 +200,14 @@ const char *get_elf_platform(CPUState *cs)
 
 #undef END
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
+{
+    for (int i = 0; i < 16; ++i) {
+        r->regs[i] = tswapreg(env->regs[i]);
+    }
+    r->regs[16] = tswapreg(cpsr_read((CPUARMState *)env));
+    r->regs[17] = tswapreg(env->regs[0]); /* XXX */
+}
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 856ca41b16..94db3738e8 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -11,5 +11,13 @@
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+#define ELF_NREG                18
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e4f821f8c8..72a291e51f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -218,21 +218,6 @@ static bool init_guest_commpage(void)
 #define ELF_CLASS       ELFCLASS32
 #define EXSTACK_DEFAULT true
 
-#define ELF_NREG    18
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
-{
-    for (int i = 0; i < 16; ++i) {
-        r->regs[i] = tswapreg(env->regs[i]);
-    }
-    r->regs[16] = tswapreg(cpsr_read((CPUARMState *)env));
-    r->regs[17] = tswapreg(env->regs[0]); /* XXX */
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 /* The commpage only exists for 32 bit kernels */

From b71b68b233dd828960e57702580a97b11f3fd26f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 05:53:29 -1000
Subject: [PATCH 0159/2396] linux-user: Move elf_core_copy_regs to
 aarch64/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c    | 12 ++++++++++++
 linux-user/aarch64/target_elf.h |  8 ++++++++
 linux-user/elfload.c            | 15 ---------------
 3 files changed, 20 insertions(+), 15 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 1030cb8094..00550f9fdf 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -4,6 +4,7 @@
 #include "qemu.h"
 #include "loader.h"
 #include "target/arm/cpu-features.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -347,3 +348,14 @@ const char *get_elf_platform(CPUState *cs)
 {
     return TARGET_BIG_ENDIAN ? "aarch64_be" : "aarch64";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(env->xregs[i]);
+    }
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(pstate_read((CPUARMState *)env));
+}
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index dee79ce0c6..b0728a1008 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -11,5 +11,13 @@
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+#define ELF_NREG                34
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 72a291e51f..017346b82d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -291,21 +291,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_ARCH        EM_AARCH64
 #define ELF_CLASS       ELFCLASS64
 
-#define ELF_NREG    34
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
-{
-    for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(env->xregs[i]);
-    }
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(pstate_read((CPUARMState *)env));
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #if TARGET_BIG_ENDIAN

From a67e20d629a849d9d9d5ef527963462cd0718e78 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 05:55:56 -1000
Subject: [PATCH 0160/2396] linux-user: Move elf_core_copy_regs to
 ppc/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 26 --------------------------
 linux-user/ppc/elfload.c    | 22 ++++++++++++++++++++++
 linux-user/ppc/target_elf.h |  9 +++++++++
 3 files changed, 31 insertions(+), 26 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 017346b82d..d1d0a112fb 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -361,32 +361,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
     } while (0)
 
-/* See linux kernel: arch/powerpc/include/asm/elf.h.  */
-#define ELF_NREG 48
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
-{
-    int i;
-    target_ulong ccr = 0;
-
-    for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
-        r->regs[i] = tswapreg(env->gpr[i]);
-    }
-
-    r->regs[32] = tswapreg(env->nip);
-    r->regs[33] = tswapreg(env->msr);
-    r->regs[35] = tswapreg(env->ctr);
-    r->regs[36] = tswapreg(env->lr);
-    r->regs[37] = tswapreg(cpu_read_xer(env));
-
-    ccr = ppc_get_cr(env);
-    r->regs[38] = tswapreg(ccr);
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #ifndef TARGET_PPC64
diff --git a/linux-user/ppc/elfload.c b/linux-user/ppc/elfload.c
index a214675650..114e40a358 100644
--- a/linux-user/ppc/elfload.c
+++ b/linux-user/ppc/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -129,3 +130,24 @@ abi_ulong get_elf_hwcap2(CPUState *cs)
 
     return features;
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
+{
+    int i;
+    target_ulong ccr = 0;
+
+    for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
+        r->regs[i] = tswapreg(env->gpr[i]);
+    }
+
+    r->regs[32] = tswapreg(env->nip);
+    r->regs[33] = tswapreg(env->msr);
+    r->regs[35] = tswapreg(env->ctr);
+    r->regs[36] = tswapreg(env->lr);
+    r->regs[37] = tswapreg(cpu_read_xer(env));
+
+    ccr = ppc_get_cr(env);
+    r->regs[38] = tswapreg(ccr);
+}
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 4203a89d66..72615553ea 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -10,5 +10,14 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/powerpc/include/asm/elf.h.  */
+#define ELF_NREG                48
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From cf334829cb2a68ba1582923c773557b6fd20e123 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 05:58:48 -1000
Subject: [PATCH 0161/2396] linux-user: Move elf_core_copy_regs to
 loongarch64/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c                | 25 -------------------------
 linux-user/loongarch64/elfload.c    | 21 +++++++++++++++++++++
 linux-user/loongarch64/target_elf.h |  9 +++++++++
 3 files changed, 30 insertions(+), 25 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d1d0a112fb..4acd7b9ffe 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -383,31 +383,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 
 #define VDSO_HEADER "vdso.c.inc"
 
-/* See linux kernel: arch/loongarch/include/asm/elf.h */
-#define ELF_NREG 45
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-enum {
-    TARGET_EF_R0 = 0,
-    TARGET_EF_CSR_ERA = TARGET_EF_R0 + 33,
-    TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
-};
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPULoongArchState *env)
-{
-    r->regs[TARGET_EF_R0] = 0;
-
-    for (int i = 1; i < ARRAY_SIZE(env->gpr); i++) {
-        r->regs[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
-    }
-
-    r->regs[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
-    r->regs[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif /* TARGET_LOONGARCH64 */
diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
index 911352840f..832890de10 100644
--- a/linux-user/loongarch64/elfload.c
+++ b/linux-user/loongarch64/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -61,3 +62,23 @@ const char *get_elf_platform(CPUState *cs)
 {
     return "loongarch";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+enum {
+    TARGET_EF_R0 = 0,
+    TARGET_EF_CSR_ERA = TARGET_EF_R0 + 33,
+    TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
+};
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPULoongArchState *env)
+{
+    r->regs[TARGET_EF_R0] = 0;
+
+    for (int i = 1; i < ARRAY_SIZE(env->gpr); i++) {
+        r->regs[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
+    }
+
+    r->regs[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
+    r->regs[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
+}
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index eb17927325..90bca4499d 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -8,5 +8,14 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/loongarch/include/asm/elf.h */
+#define ELF_NREG                45
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From a8081da18de8f3558b593e9c1ff12b9319c1d892 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:03:38 -1000
Subject: [PATCH 0162/2396] linux-user: Move elf_core_copy_regs to
 mips/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 46 ----------------------------------
 linux-user/mips/elfload.c      | 46 ++++++++++++++++++++++++++++++++++
 linux-user/mips/target_elf.h   |  9 +++++++
 linux-user/mips64/target_elf.h | 13 ++++++++++
 4 files changed, 68 insertions(+), 46 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 4acd7b9ffe..5a3a5cfc39 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -403,52 +403,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
 #endif
 
-/* See linux kernel: arch/mips/include/asm/elf.h.  */
-#define ELF_NREG 45
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-/* See linux kernel: arch/mips/include/asm/reg.h.  */
-enum {
-#ifdef TARGET_MIPS64
-    TARGET_EF_R0 = 0,
-#else
-    TARGET_EF_R0 = 6,
-#endif
-    TARGET_EF_R26 = TARGET_EF_R0 + 26,
-    TARGET_EF_R27 = TARGET_EF_R0 + 27,
-    TARGET_EF_LO = TARGET_EF_R0 + 32,
-    TARGET_EF_HI = TARGET_EF_R0 + 33,
-    TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
-    TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
-    TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
-    TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
-};
-
-/* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
-{
-    int i;
-
-    for (i = 0; i <= TARGET_EF_R0; i++) {
-        r->regs[i] = 0;
-    }
-    for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
-        r->regs[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
-    }
-
-    r->regs[TARGET_EF_R26] = 0;
-    r->regs[TARGET_EF_R27] = 0;
-    r->regs[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
-    r->regs[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
-    r->regs[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
-    r->regs[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
-    r->regs[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
-    r->regs[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif /* TARGET_MIPS */
diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index c353ccc1ad..6e884911af 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -4,6 +4,7 @@
 #include "qemu.h"
 #include "loader.h"
 #include "elf.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -122,3 +123,48 @@ const char *get_elf_base_platform(CPUState *cs)
 }
 
 #undef MATCH_PLATFORM_INSN
+
+#ifdef TARGET_ABI_MIPSN32
+#define tswapreg(ptr)   tswap64(ptr)
+#else
+#define tswapreg(ptr)   tswapal(ptr)
+#endif
+
+/* See linux kernel: arch/mips/include/asm/reg.h.  */
+enum {
+#ifdef TARGET_MIPS64
+    TARGET_EF_R0 = 0,
+#else
+    TARGET_EF_R0 = 6,
+#endif
+    TARGET_EF_R26 = TARGET_EF_R0 + 26,
+    TARGET_EF_R27 = TARGET_EF_R0 + 27,
+    TARGET_EF_LO = TARGET_EF_R0 + 32,
+    TARGET_EF_HI = TARGET_EF_R0 + 33,
+    TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
+    TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
+    TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
+    TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
+};
+
+/* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
+{
+    int i;
+
+    for (i = 0; i <= TARGET_EF_R0; i++) {
+        r->regs[i] = 0;
+    }
+    for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
+        r->regs[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
+    }
+
+    r->regs[TARGET_EF_R26] = 0;
+    r->regs[TARGET_EF_R27] = 0;
+    r->regs[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
+    r->regs[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
+    r->regs[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
+    r->regs[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
+    r->regs[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
+    r->regs[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
+}
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index 08e699c085..f767767eaa 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -10,5 +10,14 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/mips/include/asm/elf.h.  */
+#define ELF_NREG                45
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 24bb7fcd3f..046a165eef 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -10,5 +10,18 @@
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
+#define HAVE_ELF_CORE_DUMP      1
+
+#ifdef TARGET_ABI_MIPSN32
+typedef abi_ullong target_elf_greg_t;
+#else
+typedef abi_ulong target_elf_greg_t;
+#endif
+
+/* See linux kernel: arch/mips/include/asm/elf.h.  */
+#define ELF_NREG                45
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From e06b9c34eaa388e0503426c7831a2db977a472fd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:06:03 -1000
Subject: [PATCH 0163/2396] linux-user: Move elf_core_copy_regs to
 microblaze/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c               | 21 ---------------------
 linux-user/microblaze/elfload.c    | 17 +++++++++++++++++
 linux-user/microblaze/target_elf.h |  9 +++++++++
 3 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5a3a5cfc39..96ed6b6515 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -416,27 +416,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 
 #define ELF_EXEC_PAGESIZE        4096
 
-#define HAVE_ELF_CORE_DUMP
-#define ELF_NREG 38
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-/* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
-{
-    for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(env->regs[i]);
-    }
-
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(mb_cpu_read_msr(env));
-    r->regs[34] = 0;
-    r->regs[35] = tswapreg(env->ear);
-    r->regs[36] = 0;
-    r->regs[37] = tswapreg(env->esr);
-}
-
 #endif /* TARGET_MICROBLAZE */
 
 #ifdef TARGET_OPENRISC
diff --git a/linux-user/microblaze/elfload.c b/linux-user/microblaze/elfload.c
index b92442dfeb..89250dbd63 100644
--- a/linux-user/microblaze/elfload.c
+++ b/linux-user/microblaze/elfload.c
@@ -3,9 +3,26 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "any";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(env->regs[i]);
+    }
+
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(mb_cpu_read_msr(env));
+    r->regs[34] = 0;
+    r->regs[35] = tswapreg(env->ear);
+    r->regs[36] = 0;
+    r->regs[37] = tswapreg(env->esr);
+}
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index bfe2997fd2..cc5cc0477e 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -8,4 +8,13 @@
 #ifndef MICROBLAZE_TARGET_ELF_H
 #define MICROBLAZE_TARGET_ELF_H
 
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+#define ELF_NREG                38
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
+
 #endif

From 28c7d60b54d7e6e3afa064ceae7a4786375d8b4b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:12:01 -1000
Subject: [PATCH 0164/2396] linux-user: Move elf_core_copy_regs to
 openrisc/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c             | 16 ----------------
 linux-user/openrisc/elfload.c    | 12 ++++++++++++
 linux-user/openrisc/target_elf.h | 10 ++++++++++
 3 files changed, 22 insertions(+), 16 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 96ed6b6515..8c3ef41312 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -424,24 +424,8 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_CLASS ELFCLASS32
 #define ELF_DATA  ELFDATA2MSB
 
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 8192
 
-/* See linux kernel arch/openrisc/include/asm/elf.h.  */
-#define ELF_NREG 34 /* gprs and pc, sr */
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUOpenRISCState *env)
-{
-    for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(cpu_get_gpr(env, i));
-    }
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(cpu_get_sr(env));
-}
-
 #endif /* TARGET_OPENRISC */
 
 #ifdef TARGET_SH4
diff --git a/linux-user/openrisc/elfload.c b/linux-user/openrisc/elfload.c
index b92442dfeb..bb5ad96711 100644
--- a/linux-user/openrisc/elfload.c
+++ b/linux-user/openrisc/elfload.c
@@ -3,9 +3,21 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return "any";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUOpenRISCState *env)
+{
+    for (int i = 0; i < 32; i++) {
+        r->regs[i] = tswapreg(cpu_get_gpr(env, i));
+    }
+    r->regs[32] = tswapreg(env->pc);
+    r->regs[33] = tswapreg(cpu_get_sr(env));
+}
diff --git a/linux-user/openrisc/target_elf.h b/linux-user/openrisc/target_elf.h
index b34f2ff672..e97bdc11ed 100644
--- a/linux-user/openrisc/target_elf.h
+++ b/linux-user/openrisc/target_elf.h
@@ -8,4 +8,14 @@
 #ifndef OPENRISC_TARGET_ELF_H
 #define OPENRISC_TARGET_ELF_H
 
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel arch/openrisc/include/asm/elf.h.  */
+#define ELF_NREG                34 /* gprs and pc, sr */
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
+
 #endif

From a4ea8c30e7c8ae49e2e50e2c410581ad53c3e1fb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:12:27 -1000
Subject: [PATCH 0165/2396] linux-user: Move elf_core_copy_regs to
 sh4/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 33 ---------------------------------
 linux-user/sh4/elfload.c    | 29 +++++++++++++++++++++++++++++
 linux-user/sh4/target_elf.h |  9 +++++++++
 3 files changed, 38 insertions(+), 33 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 8c3ef41312..69532faddb 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -433,39 +433,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_CLASS ELFCLASS32
 #define ELF_ARCH  EM_SH
 
-/* See linux kernel: arch/sh/include/asm/elf.h.  */
-#define ELF_NREG 23
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-/* See linux kernel: arch/sh/include/asm/ptrace.h.  */
-enum {
-    TARGET_REG_PC = 16,
-    TARGET_REG_PR = 17,
-    TARGET_REG_SR = 18,
-    TARGET_REG_GBR = 19,
-    TARGET_REG_MACH = 20,
-    TARGET_REG_MACL = 21,
-    TARGET_REG_SYSCALL = 22
-};
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
-{
-    for (int i = 0; i < 16; i++) {
-        r->regs[i] = tswapreg(env->gregs[i]);
-    }
-
-    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
-    r->regs[TARGET_REG_PR] = tswapreg(env->pr);
-    r->regs[TARGET_REG_SR] = tswapreg(env->sr);
-    r->regs[TARGET_REG_GBR] = tswapreg(env->gbr);
-    r->regs[TARGET_REG_MACH] = tswapreg(env->mach);
-    r->regs[TARGET_REG_MACL] = tswapreg(env->macl);
-    r->regs[TARGET_REG_SYSCALL] = 0; /* FIXME */
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE        4096
 
 #endif
diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
index 99ad4f6334..71cae9703e 100644
--- a/linux-user/sh4/elfload.c
+++ b/linux-user/sh4/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -36,3 +37,31 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 
     return hwcap;
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+/* See linux kernel: arch/sh/include/asm/ptrace.h.  */
+enum {
+    TARGET_REG_PC = 16,
+    TARGET_REG_PR = 17,
+    TARGET_REG_SR = 18,
+    TARGET_REG_GBR = 19,
+    TARGET_REG_MACH = 20,
+    TARGET_REG_MACL = 21,
+    TARGET_REG_SYSCALL = 22
+};
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
+{
+    for (int i = 0; i < 16; i++) {
+        r->regs[i] = tswapreg(env->gregs[i]);
+    }
+
+    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
+    r->regs[TARGET_REG_PR] = tswapreg(env->pr);
+    r->regs[TARGET_REG_SR] = tswapreg(env->sr);
+    r->regs[TARGET_REG_GBR] = tswapreg(env->gbr);
+    r->regs[TARGET_REG_MACH] = tswapreg(env->mach);
+    r->regs[TARGET_REG_MACL] = tswapreg(env->macl);
+    r->regs[TARGET_REG_SYSCALL] = 0; /* FIXME */
+}
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index badd0f5371..f7443ddbac 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -9,5 +9,14 @@
 #define SH4_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/sh/include/asm/elf.h.  */
+#define ELF_NREG                23
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From bcaebf6e5bac13352a17eb4949464787c34829f9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:14:26 -1000
Subject: [PATCH 0166/2396] linux-user: Move elf_core_copy_regs to
 m68k/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 31 -------------------------------
 linux-user/m68k/elfload.c    | 27 +++++++++++++++++++++++++++
 linux-user/m68k/target_elf.h | 10 ++++++++++
 3 files changed, 37 insertions(+), 31 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 69532faddb..e92c424faf 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -442,37 +442,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_68K
 
-/* See linux kernel: arch/m68k/include/asm/elf.h.  */
-#define ELF_NREG 20
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
-{
-    r->regs[0] = tswapreg(env->dregs[1]);
-    r->regs[1] = tswapreg(env->dregs[2]);
-    r->regs[2] = tswapreg(env->dregs[3]);
-    r->regs[3] = tswapreg(env->dregs[4]);
-    r->regs[4] = tswapreg(env->dregs[5]);
-    r->regs[5] = tswapreg(env->dregs[6]);
-    r->regs[6] = tswapreg(env->dregs[7]);
-    r->regs[7] = tswapreg(env->aregs[0]);
-    r->regs[8] = tswapreg(env->aregs[1]);
-    r->regs[9] = tswapreg(env->aregs[2]);
-    r->regs[10] = tswapreg(env->aregs[3]);
-    r->regs[11] = tswapreg(env->aregs[4]);
-    r->regs[12] = tswapreg(env->aregs[5]);
-    r->regs[13] = tswapreg(env->aregs[6]);
-    r->regs[14] = tswapreg(env->dregs[0]);
-    r->regs[15] = tswapreg(env->aregs[7]);
-    r->regs[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
-    r->regs[17] = tswapreg(env->sr);
-    r->regs[18] = tswapreg(env->pc);
-    r->regs[19] = 0;  /* FIXME: regs->format | regs->vector */
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       8192
 
 #endif
diff --git a/linux-user/m68k/elfload.c b/linux-user/m68k/elfload.c
index 561ac5b3b3..2970ff7dec 100644
--- a/linux-user/m68k/elfload.c
+++ b/linux-user/m68k/elfload.c
@@ -4,6 +4,7 @@
 #include "qemu.h"
 #include "loader.h"
 #include "elf.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -16,3 +17,29 @@ const char *get_elf_cpu_model(uint32_t eflags)
     /* Coldfire */
     return "any";
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
+{
+    r->regs[0] = tswapreg(env->dregs[1]);
+    r->regs[1] = tswapreg(env->dregs[2]);
+    r->regs[2] = tswapreg(env->dregs[3]);
+    r->regs[3] = tswapreg(env->dregs[4]);
+    r->regs[4] = tswapreg(env->dregs[5]);
+    r->regs[5] = tswapreg(env->dregs[6]);
+    r->regs[6] = tswapreg(env->dregs[7]);
+    r->regs[7] = tswapreg(env->aregs[0]);
+    r->regs[8] = tswapreg(env->aregs[1]);
+    r->regs[9] = tswapreg(env->aregs[2]);
+    r->regs[10] = tswapreg(env->aregs[3]);
+    r->regs[11] = tswapreg(env->aregs[4]);
+    r->regs[12] = tswapreg(env->aregs[5]);
+    r->regs[13] = tswapreg(env->aregs[6]);
+    r->regs[14] = tswapreg(env->dregs[0]);
+    r->regs[15] = tswapreg(env->aregs[7]);
+    r->regs[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
+    r->regs[17] = tswapreg(env->sr);
+    r->regs[18] = tswapreg(env->pc);
+    r->regs[19] = 0;  /* FIXME: regs->format | regs->vector */
+}
diff --git a/linux-user/m68k/target_elf.h b/linux-user/m68k/target_elf.h
index 62ff9d38d4..cd6908ab57 100644
--- a/linux-user/m68k/target_elf.h
+++ b/linux-user/m68k/target_elf.h
@@ -8,4 +8,14 @@
 #ifndef M68K_TARGET_ELF_H
 #define M68K_TARGET_ELF_H
 
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/m68k/include/asm/elf.h.  */
+#define ELF_NREG                20
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
+
 #endif

From 59b51b4e7cacca78d0f60e3817150d2c29423d54 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:16:07 -1000
Subject: [PATCH 0167/2396] linux-user: Move elf_core_copy_regs to
 s390x/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 32 --------------------------------
 linux-user/s390x/elfload.c    | 28 ++++++++++++++++++++++++++++
 linux-user/s390x/target_elf.h |  9 +++++++++
 3 files changed, 37 insertions(+), 32 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index e92c424faf..7c783b74d4 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -461,38 +461,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-/* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
-#define ELF_NREG 27
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-enum {
-    TARGET_REG_PSWM = 0,
-    TARGET_REG_PSWA = 1,
-    TARGET_REG_GPRS = 2,
-    TARGET_REG_ARS = 18,
-    TARGET_REG_ORIG_R2 = 26,
-};
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUS390XState *env)
-{
-    int i;
-    uint32_t *aregs;
-
-    r->regs[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
-    r->regs[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
-    for (i = 0; i < 16; i++) {
-        r->regs[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
-    }
-    aregs = (uint32_t *)&(r->regs[TARGET_REG_ARS]);
-    for (i = 0; i < 16; i++) {
-        aregs[i] = tswap32(env->aregs[i]);
-    }
-    r->regs[TARGET_REG_ORIG_R2] = 0;
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE 4096
 
 #define VDSO_HEADER "vdso.c.inc"
diff --git a/linux-user/s390x/elfload.c b/linux-user/s390x/elfload.c
index 79ceaba51d..4113273b72 100644
--- a/linux-user/s390x/elfload.c
+++ b/linux-user/s390x/elfload.c
@@ -4,6 +4,7 @@
 #include "qemu.h"
 #include "loader.h"
 #include "elf.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -66,3 +67,30 @@ const char *elf_hwcap_str(uint32_t bit)
 
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+enum {
+    TARGET_REG_PSWM = 0,
+    TARGET_REG_PSWA = 1,
+    TARGET_REG_GPRS = 2,
+    TARGET_REG_ARS = 18,
+    TARGET_REG_ORIG_R2 = 26,
+};
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUS390XState *env)
+{
+    int i;
+    uint32_t *aregs;
+
+    r->regs[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
+    r->regs[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
+    for (i = 0; i < 16; i++) {
+        r->regs[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
+    }
+    aregs = (uint32_t *)&(r->regs[TARGET_REG_ARS]);
+    for (i = 0; i < 16; i++) {
+        aregs[i] = tswap32(env->aregs[i]);
+    }
+    r->regs[TARGET_REG_ORIG_R2] = 0;
+}
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index cebace949a..b7d863ee66 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -9,5 +9,14 @@
 #define S390X_TARGET_ELF_H
 
 #define HAVE_ELF_HWCAP          1
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
+#define ELF_NREG                27
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
 
 #endif

From 952916bb8fae405fd9f25be6c3ad0f6f8525ddbf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 06:17:52 -1000
Subject: [PATCH 0168/2396] linux-user: Move elf_core_copy_regs to
 xtensa/elfload.c

Move elf_core_copy_regs to elfload.c.
Move HAVE_ELF_CORE_DUMP, ELF_NREGS, target_elf_gregset_t to target_elf.h.
For now, duplicate the definitions of target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 39 ----------------------------------
 linux-user/xtensa/elfload.c    | 35 ++++++++++++++++++++++++++++++
 linux-user/xtensa/target_elf.h | 10 +++++++++
 3 files changed, 45 insertions(+), 39 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 7c783b74d4..5cdbdc20d9 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -531,45 +531,6 @@ static bool init_guest_commpage(void)
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_XTENSA
 
-/* See linux kernel: arch/xtensa/include/asm/elf.h.  */
-#define ELF_NREG 128
-typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
-} target_elf_gregset_t;
-
-enum {
-    TARGET_REG_PC,
-    TARGET_REG_PS,
-    TARGET_REG_LBEG,
-    TARGET_REG_LEND,
-    TARGET_REG_LCOUNT,
-    TARGET_REG_SAR,
-    TARGET_REG_WINDOWSTART,
-    TARGET_REG_WINDOWBASE,
-    TARGET_REG_THREADPTR,
-    TARGET_REG_AR0 = 64,
-};
-
-void elf_core_copy_regs(target_elf_gregset_t *r, const CPUXtensaState *env)
-{
-    unsigned i;
-
-    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
-    r->regs[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
-    r->regs[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
-    r->regs[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
-    r->regs[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
-    r->regs[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
-    r->regs[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
-    r->regs[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
-    r->regs[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
-    xtensa_sync_phys_from_window((CPUXtensaState *)env);
-    for (i = 0; i < env->config->nareg; ++i) {
-        r->regs[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
-    }
-}
-
-#define HAVE_ELF_CORE_DUMP
 #define ELF_EXEC_PAGESIZE       4096
 
 #endif /* TARGET_XTENSA */
diff --git a/linux-user/xtensa/elfload.c b/linux-user/xtensa/elfload.c
index e35ba69a10..49e709a094 100644
--- a/linux-user/xtensa/elfload.c
+++ b/linux-user/xtensa/elfload.c
@@ -3,9 +3,44 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
     return XTENSA_DEFAULT_CPU_MODEL;
 }
+
+#define tswapreg(ptr)   tswapal(ptr)
+
+enum {
+    TARGET_REG_PC,
+    TARGET_REG_PS,
+    TARGET_REG_LBEG,
+    TARGET_REG_LEND,
+    TARGET_REG_LCOUNT,
+    TARGET_REG_SAR,
+    TARGET_REG_WINDOWSTART,
+    TARGET_REG_WINDOWBASE,
+    TARGET_REG_THREADPTR,
+    TARGET_REG_AR0 = 64,
+};
+
+void elf_core_copy_regs(target_elf_gregset_t *r, const CPUXtensaState *env)
+{
+    unsigned i;
+
+    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
+    r->regs[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
+    r->regs[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
+    r->regs[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
+    r->regs[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
+    r->regs[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
+    r->regs[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
+    r->regs[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
+    r->regs[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
+    xtensa_sync_phys_from_window((CPUXtensaState *)env);
+    for (i = 0; i < env->config->nareg; ++i) {
+        r->regs[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
+    }
+}
diff --git a/linux-user/xtensa/target_elf.h b/linux-user/xtensa/target_elf.h
index 2c55c22e14..43e241aac1 100644
--- a/linux-user/xtensa/target_elf.h
+++ b/linux-user/xtensa/target_elf.h
@@ -8,4 +8,14 @@
 #ifndef XTENSA_TARGET_ELF_H
 #define XTENSA_TARGET_ELF_H
 
+#define HAVE_ELF_CORE_DUMP      1
+
+typedef abi_ulong target_elf_greg_t;
+
+/* See linux kernel: arch/xtensa/include/asm/elf.h.  */
+#define ELF_NREG                128
+typedef struct target_elf_gregset_t {
+    target_elf_greg_t regs[ELF_NREG];
+} target_elf_gregset_t;
+
 #endif

From 4540a4e6044870dc98bdaacb1593012aef6f5df9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 10:53:13 +1000
Subject: [PATCH 0169/2396] linux-user: Remove target_elf_greg_t, tswapreg from
 elfload.c

These are no longer used within the generic file.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 5cdbdc20d9..07d83c674d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,14 +130,6 @@ int info_is_fdpic(struct image_info *info)
 #define ELF_DATA        ELFDATA2LSB
 #endif
 
-#ifdef TARGET_ABI_MIPSN32
-typedef abi_ullong      target_elf_greg_t;
-#define tswapreg(ptr)   tswap64(ptr)
-#else
-typedef abi_ulong       target_elf_greg_t;
-#define tswapreg(ptr)   tswapal(ptr)
-#endif
-
 #ifdef USE_UID16
 typedef abi_ushort      target_uid_t;
 typedef abi_ushort      target_gid_t;

From c47407ef2f4e6b2965b726618cd600aa24149f13 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 14:19:04 +1000
Subject: [PATCH 0170/2396] linux-user/i386: Create target_ptrace.h

Remove the target_pt_regs structure from target_syscall.h.
Add target_user_regs_struct to target_ptrace.h, which is
what is actually used by ELF_CORE_COPY_REGS; the layout
of the two structure definitions is identical.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/i386/target_ptrace.h  | 32 ++++++++++++++++++++++++++++++++
 linux-user/i386/target_syscall.h | 18 ------------------
 2 files changed, 32 insertions(+), 18 deletions(-)
 create mode 100644 linux-user/i386/target_ptrace.h

diff --git a/linux-user/i386/target_ptrace.h b/linux-user/i386/target_ptrace.h
new file mode 100644
index 0000000000..bc57926f25
--- /dev/null
+++ b/linux-user/i386/target_ptrace.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef I386_TARGET_PTRACE_H
+#define I386_TARGET_PTRACE_H
+
+/*
+ * Note that arch/x86/include/uapi/asm/ptrace.h (struct pt_regs) and
+ * arch/x86/include/asm/user_32.h (struct user_regs_struct) have the
+ * same layout, though the exact types differ (int vs long vs unsigned).
+ * Define user_regs_struct because that's what's actually used.
+ */
+struct target_user_regs_struct {
+    abi_ulong bx;
+    abi_ulong cx;
+    abi_ulong dx;
+    abi_ulong si;
+    abi_ulong di;
+    abi_ulong bp;
+    abi_ulong ax;
+    abi_ulong ds;
+    abi_ulong es;
+    abi_ulong fs;
+    abi_ulong gs;
+    abi_ulong orig_ax;
+    abi_ulong ip;
+    abi_ulong cs;
+    abi_ulong flags;
+    abi_ulong sp;
+    abi_ulong ss;
+};
+
+#endif /* I386_TARGET_PTRACE_H */
diff --git a/linux-user/i386/target_syscall.h b/linux-user/i386/target_syscall.h
index aaade06b13..c214a909a6 100644
--- a/linux-user/i386/target_syscall.h
+++ b/linux-user/i386/target_syscall.h
@@ -5,24 +5,6 @@
 #define __USER_CS	(0x23)
 #define __USER_DS	(0x2B)
 
-struct target_pt_regs {
-	long ebx;
-	long ecx;
-	long edx;
-	long esi;
-	long edi;
-	long ebp;
-	long eax;
-	int  xds;
-	int  xes;
-	long orig_eax;
-	long eip;
-	int  xcs;
-	long eflags;
-	long esp;
-	int  xss;
-};
-
 /* ioctls */
 
 #define TARGET_LDT_ENTRIES      8192

From ff15e62d3f472890b6c93262f85447bfb9eec642 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:09:03 +1000
Subject: [PATCH 0171/2396] linux-user/i386: Expand target_elf_gregset_t

The comment re ELF_NREG is incorrect or out-of-date.
Make use of the fact that target_elf_gregset_t is a
proper structure by using target_user_regs_struct.

Drop target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/i386/elfload.c    | 36 +++++++++++++++++-------------------
 linux-user/i386/target_elf.h | 14 +++++---------
 2 files changed, 22 insertions(+), 28 deletions(-)

diff --git a/linux-user/i386/elfload.c b/linux-user/i386/elfload.c
index 279aeb8116..26b12001a3 100644
--- a/linux-user/i386/elfload.c
+++ b/linux-user/i386/elfload.c
@@ -25,25 +25,23 @@ const char *get_elf_platform(CPUState *cs)
     return elf_platform[family - 3];
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
-    r->regs[0] = tswapreg(env->regs[R_EBX]);
-    r->regs[1] = tswapreg(env->regs[R_ECX]);
-    r->regs[2] = tswapreg(env->regs[R_EDX]);
-    r->regs[3] = tswapreg(env->regs[R_ESI]);
-    r->regs[4] = tswapreg(env->regs[R_EDI]);
-    r->regs[5] = tswapreg(env->regs[R_EBP]);
-    r->regs[6] = tswapreg(env->regs[R_EAX]);
-    r->regs[7] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    r->regs[8] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    r->regs[9] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[10] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    r->regs[11] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    r->regs[12] = tswapreg(env->eip);
-    r->regs[13] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    r->regs[14] = tswapreg(env->eflags);
-    r->regs[15] = tswapreg(env->regs[R_ESP]);
-    r->regs[16] = tswapreg(env->segs[R_SS].selector & 0xffff);
+    r->pt.bx = tswapal(env->regs[R_EBX]);
+    r->pt.cx = tswapal(env->regs[R_ECX]);
+    r->pt.dx = tswapal(env->regs[R_EDX]);
+    r->pt.si = tswapal(env->regs[R_ESI]);
+    r->pt.di = tswapal(env->regs[R_EDI]);
+    r->pt.bp = tswapal(env->regs[R_EBP]);
+    r->pt.ax = tswapal(env->regs[R_EAX]);
+    r->pt.ds = tswapal(env->segs[R_DS].selector & 0xffff);
+    r->pt.es = tswapal(env->segs[R_ES].selector & 0xffff);
+    r->pt.fs = tswapal(env->segs[R_FS].selector & 0xffff);
+    r->pt.gs = tswapal(env->segs[R_GS].selector & 0xffff);
+    r->pt.orig_ax = tswapal(get_task_state(env_cpu_const(env))->orig_ax);
+    r->pt.ip = tswapal(env->eip);
+    r->pt.cs = tswapal(env->segs[R_CS].selector & 0xffff);
+    r->pt.flags = tswapal(env->eflags);
+    r->pt.sp = tswapal(env->regs[R_ESP]);
+    r->pt.ss = tswapal(env->segs[R_SS].selector & 0xffff);
 }
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index eb286868e1..f89ac0b611 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -8,22 +8,18 @@
 #ifndef I386_TARGET_ELF_H
 #define I386_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
 /*
- * Note that ELF_NREG should be 19 as there should be place for
- * TRAPNO and ERR "registers" as well but linux doesn't dump those.
- *
- * See linux kernel: arch/x86/include/asm/elf.h
+ * See linux kernel: arch/x86/include/asm/elf.h, where elf_gregset_t
+ * is mapped to struct user_regs_struct via sizeof.
  */
-#define ELF_NREG                17
-
-typedef abi_ulong target_elf_greg_t;
-
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_regs_struct pt;
 } target_elf_gregset_t;
 
 #endif

From 399313bb6d94e5f3ce4ce533f9a8c5fe504f6cda Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 14:41:40 +1000
Subject: [PATCH 0172/2396] linux-user/x86_64: Create target_ptrace.h

Remove the target_pt_regs structure from target_syscall.h.
Add target_user_regs_struct to target_ptrace.h, which matches
what is actually used on x86_64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/x86_64/target_ptrace.h  | 40 ++++++++++++++++++++++++++++++
 linux-user/x86_64/target_syscall.h | 28 ---------------------
 2 files changed, 40 insertions(+), 28 deletions(-)
 create mode 100644 linux-user/x86_64/target_ptrace.h

diff --git a/linux-user/x86_64/target_ptrace.h b/linux-user/x86_64/target_ptrace.h
new file mode 100644
index 0000000000..33527127cb
--- /dev/null
+++ b/linux-user/x86_64/target_ptrace.h
@@ -0,0 +1,40 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef X86_64_TARGET_PTRACE_H
+#define X86_64_TARGET_PTRACE_H
+
+/*
+ * The struct pt_regs in arch/x86/include/uapi/asm/ptrace.h has missing
+ * register values and is not used.  See arch/x86/include/asm/user_64.h.
+ */
+struct target_user_regs_struct {
+    abi_ulong r15;
+    abi_ulong r14;
+    abi_ulong r13;
+    abi_ulong r12;
+    abi_ulong bp;
+    abi_ulong bx;
+    abi_ulong r11;
+    abi_ulong r10;
+    abi_ulong r9;
+    abi_ulong r8;
+    abi_ulong ax;
+    abi_ulong cx;
+    abi_ulong dx;
+    abi_ulong si;
+    abi_ulong di;
+    abi_ulong orig_ax;
+    abi_ulong ip;
+    abi_ulong cs;
+    abi_ulong flags;
+    abi_ulong sp;
+    abi_ulong ss;
+    abi_ulong fs_base;
+    abi_ulong gs_base;
+    abi_ulong ds;
+    abi_ulong es;
+    abi_ulong fs;
+    abi_ulong gs;
+};
+
+#endif /* X86_64_TARGET_PTRACE_H */
diff --git a/linux-user/x86_64/target_syscall.h b/linux-user/x86_64/target_syscall.h
index fb558345d3..68f55f8e7b 100644
--- a/linux-user/x86_64/target_syscall.h
+++ b/linux-user/x86_64/target_syscall.h
@@ -4,34 +4,6 @@
 #define __USER_CS	(0x33)
 #define __USER_DS	(0x2B)
 
-struct target_pt_regs {
-	abi_ulong r15;
-	abi_ulong r14;
-	abi_ulong r13;
-	abi_ulong r12;
-	abi_ulong rbp;
-	abi_ulong rbx;
-/* arguments: non interrupts/non tracing syscalls only save up to here */
-	abi_ulong r11;
-	abi_ulong r10;
-	abi_ulong r9;
-	abi_ulong r8;
-	abi_ulong rax;
-	abi_ulong rcx;
-	abi_ulong rdx;
-	abi_ulong rsi;
-	abi_ulong rdi;
-	abi_ulong orig_rax;
-/* end of arguments */
-/* cpu exception frame or undefined */
-	abi_ulong rip;
-	abi_ulong cs;
-	abi_ulong eflags;
-	abi_ulong rsp;
-	abi_ulong ss;
-/* top of stack page */
-};
-
 /* Maximum number of LDT entries supported. */
 #define TARGET_LDT_ENTRIES	8192
 /* The size of each LDT entry. */

From 9c49798e18c00eb07bf6832aa50a1a889a145ec5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:17:02 +1000
Subject: [PATCH 0173/2396] linux-user/x86_64: Expand target_elf_gregset_t

The comment re ELF_NREG is incorrect or out-of-date.
Make use of the fact that target_elf_gregset_t is a
proper structure by using target_user_regs_struct.

Drop target_elf_greg_t and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/x86_64/elfload.c    | 56 ++++++++++++++++------------------
 linux-user/x86_64/target_elf.h | 14 +++------
 2 files changed, 32 insertions(+), 38 deletions(-)

diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 76cf5c1509..18d632ec34 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -21,35 +21,33 @@ const char *get_elf_platform(CPUState *cs)
     return "x86_64";
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
-    r->regs[0] = tswapreg(env->regs[15]);
-    r->regs[1] = tswapreg(env->regs[14]);
-    r->regs[2] = tswapreg(env->regs[13]);
-    r->regs[3] = tswapreg(env->regs[12]);
-    r->regs[4] = tswapreg(env->regs[R_EBP]);
-    r->regs[5] = tswapreg(env->regs[R_EBX]);
-    r->regs[6] = tswapreg(env->regs[11]);
-    r->regs[7] = tswapreg(env->regs[10]);
-    r->regs[8] = tswapreg(env->regs[9]);
-    r->regs[9] = tswapreg(env->regs[8]);
-    r->regs[10] = tswapreg(env->regs[R_EAX]);
-    r->regs[11] = tswapreg(env->regs[R_ECX]);
-    r->regs[12] = tswapreg(env->regs[R_EDX]);
-    r->regs[13] = tswapreg(env->regs[R_ESI]);
-    r->regs[14] = tswapreg(env->regs[R_EDI]);
-    r->regs[15] = tswapreg(get_task_state(env_cpu_const(env))->orig_ax);
-    r->regs[16] = tswapreg(env->eip);
-    r->regs[17] = tswapreg(env->segs[R_CS].selector & 0xffff);
-    r->regs[18] = tswapreg(env->eflags);
-    r->regs[19] = tswapreg(env->regs[R_ESP]);
-    r->regs[20] = tswapreg(env->segs[R_SS].selector & 0xffff);
-    r->regs[21] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[22] = tswapreg(env->segs[R_GS].selector & 0xffff);
-    r->regs[23] = tswapreg(env->segs[R_DS].selector & 0xffff);
-    r->regs[24] = tswapreg(env->segs[R_ES].selector & 0xffff);
-    r->regs[25] = tswapreg(env->segs[R_FS].selector & 0xffff);
-    r->regs[26] = tswapreg(env->segs[R_GS].selector & 0xffff);
+    r->pt.r15 = tswapal(env->regs[15]);
+    r->pt.r14 = tswapal(env->regs[14]);
+    r->pt.r13 = tswapal(env->regs[13]);
+    r->pt.r12 = tswapal(env->regs[12]);
+    r->pt.bp = tswapal(env->regs[R_EBP]);
+    r->pt.bx = tswapal(env->regs[R_EBX]);
+    r->pt.r11 = tswapal(env->regs[11]);
+    r->pt.r10 = tswapal(env->regs[10]);
+    r->pt.r9 = tswapal(env->regs[9]);
+    r->pt.r8 = tswapal(env->regs[8]);
+    r->pt.ax = tswapal(env->regs[R_EAX]);
+    r->pt.cx = tswapal(env->regs[R_ECX]);
+    r->pt.dx = tswapal(env->regs[R_EDX]);
+    r->pt.si = tswapal(env->regs[R_ESI]);
+    r->pt.di = tswapal(env->regs[R_EDI]);
+    r->pt.orig_ax = tswapal(get_task_state(env_cpu_const(env))->orig_ax);
+    r->pt.ip = tswapal(env->eip);
+    r->pt.cs = tswapal(env->segs[R_CS].selector & 0xffff);
+    r->pt.flags = tswapal(env->eflags);
+    r->pt.sp = tswapal(env->regs[R_ESP]);
+    r->pt.ss = tswapal(env->segs[R_SS].selector & 0xffff);
+    r->pt.fs_base = tswapal(env->segs[R_FS].selector & 0xffff);
+    r->pt.gs_base = tswapal(env->segs[R_GS].selector & 0xffff);
+    r->pt.ds = tswapal(env->segs[R_DS].selector & 0xffff);
+    r->pt.es = tswapal(env->segs[R_ES].selector & 0xffff);
+    r->pt.fs = tswapal(env->segs[R_FS].selector & 0xffff);
+    r->pt.gs = tswapal(env->segs[R_GS].selector & 0xffff);
 }
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 74a77d94cd..32a9eec431 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -8,22 +8,18 @@
 #ifndef X86_64_TARGET_ELF_H
 #define X86_64_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
 /*
- * Note that ELF_NREG should be 29 as there should be place for
- * TRAPNO and ERR "registers" as well but linux doesn't dump those.
- *
- * See linux kernel: arch/x86/include/asm/elf.h
+ * See linux kernel: arch/x86/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct user_regs_struct via sizeof.
  */
-#define ELF_NREG                27
-
-typedef abi_ulong target_elf_greg_t;
-
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_regs_struct pt;
 } target_elf_gregset_t;
 
 #endif

From 31d0ef2c85ca481266d0a8793afdce38ab0b687c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 14:50:12 +1000
Subject: [PATCH 0174/2396] linux-user/x86_64: Fix dump of fs_base, gs_base

We were storing the selector, not the base.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/x86_64/elfload.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 18d632ec34..12de1c54c7 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -44,8 +44,8 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
     r->pt.flags = tswapal(env->eflags);
     r->pt.sp = tswapal(env->regs[R_ESP]);
     r->pt.ss = tswapal(env->segs[R_SS].selector & 0xffff);
-    r->pt.fs_base = tswapal(env->segs[R_FS].selector & 0xffff);
-    r->pt.gs_base = tswapal(env->segs[R_GS].selector & 0xffff);
+    r->pt.fs_base = tswapal(env->segs[R_FS].base);
+    r->pt.gs_base = tswapal(env->segs[R_GS].base);
     r->pt.ds = tswapal(env->segs[R_DS].selector & 0xffff);
     r->pt.es = tswapal(env->segs[R_ES].selector & 0xffff);
     r->pt.fs = tswapal(env->segs[R_FS].selector & 0xffff);

From 7ee71b02fbc21f9de31140f5237c849e36ee30d5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 14:50:33 +1000
Subject: [PATCH 0175/2396] linux-user/aarch64: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h, and
rename to target_user_pt_regs, to match what's in ptrace.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/target_ptrace.h  | 14 ++++++++++++++
 linux-user/aarch64/target_syscall.h |  7 -------
 2 files changed, 14 insertions(+), 7 deletions(-)
 create mode 100644 linux-user/aarch64/target_ptrace.h

diff --git a/linux-user/aarch64/target_ptrace.h b/linux-user/aarch64/target_ptrace.h
new file mode 100644
index 0000000000..10681338ba
--- /dev/null
+++ b/linux-user/aarch64/target_ptrace.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef AARCH64_TARGET_PTRACE_H
+#define AARCH64_TARGET_PTRACE_H
+
+/* See arch/arm64/include/uapi/asm/ptrace.h. */
+struct target_user_pt_regs {
+    uint64_t regs[31];
+    uint64_t sp;
+    uint64_t pc;
+    uint64_t pstate;
+};
+
+#endif /* AARCH64_TARGET_PTRACE_H */
diff --git a/linux-user/aarch64/target_syscall.h b/linux-user/aarch64/target_syscall.h
index c055133725..bd05f6c7fe 100644
--- a/linux-user/aarch64/target_syscall.h
+++ b/linux-user/aarch64/target_syscall.h
@@ -1,13 +1,6 @@
 #ifndef AARCH64_TARGET_SYSCALL_H
 #define AARCH64_TARGET_SYSCALL_H
 
-struct target_pt_regs {
-    uint64_t        regs[31];
-    uint64_t        sp;
-    uint64_t        pc;
-    uint64_t        pstate;
-};
-
 #if TARGET_BIG_ENDIAN
 #define UNAME_MACHINE "aarch64_be"
 #else

From ff22166d3f68786e5f129d2fb34a38cfdc0631b3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:24:05 +1000
Subject: [PATCH 0176/2396] linux-user/aarch64: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a
proper structure by using target_user_pt_regs.

Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c    | 11 +++++------
 linux-user/aarch64/target_elf.h | 11 +++++++----
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 00550f9fdf..07a0c3f844 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -349,13 +349,12 @@ const char *get_elf_platform(CPUState *cs)
     return TARGET_BIG_ENDIAN ? "aarch64_be" : "aarch64";
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
-    for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(env->xregs[i]);
+    for (int i = 0; i < 31; i++) {
+        r->pt.regs[i] = tswap64(env->xregs[i]);
     }
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(pstate_read((CPUARMState *)env));
+    r->pt.sp = tswap64(env->xregs[31]);
+    r->pt.pc = tswap64(env->pc);
+    r->pt.pstate = tswap64(pstate_read((CPUARMState *)env));
 }
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index b0728a1008..9eb8bb547e 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -8,16 +8,19 @@
 #ifndef AARCH64_TARGET_ELF_H
 #define AARCH64_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-#define ELF_NREG                34
+/*
+ * See linux kernel: arch/arm64/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct user_pt_regs via sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From db58f1667e72b3fa4c0a9e45f0b6b683e836295b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 14:56:57 +1000
Subject: [PATCH 0177/2396] linux-user/arm: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h.
Replace the array with proper structure fields.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_ptrace.h  | 16 ++++++++++++++++
 linux-user/arm/target_syscall.h |  8 --------
 2 files changed, 16 insertions(+), 8 deletions(-)
 create mode 100644 linux-user/arm/target_ptrace.h

diff --git a/linux-user/arm/target_ptrace.h b/linux-user/arm/target_ptrace.h
new file mode 100644
index 0000000000..1610b8e03c
--- /dev/null
+++ b/linux-user/arm/target_ptrace.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef ARM_TARGET_PTRACE_H
+#define ARM_TARGET_PTRACE_H
+
+/*
+ * See arch/arm/include/uapi/asm/ptrace.h.
+ * Instead of an array and ARM_xx defines, use proper fields.
+ */
+struct target_pt_regs {
+    abi_ulong regs[16];
+    abi_ulong cpsr;
+    abi_ulong orig_r0;
+};
+
+#endif /* ARM_TARGET_PTRACE_H */
diff --git a/linux-user/arm/target_syscall.h b/linux-user/arm/target_syscall.h
index 412ad434cf..8c4ddba717 100644
--- a/linux-user/arm/target_syscall.h
+++ b/linux-user/arm/target_syscall.h
@@ -1,14 +1,6 @@
 #ifndef ARM_TARGET_SYSCALL_H
 #define ARM_TARGET_SYSCALL_H
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-
-/* uregs[0..15] are r0 to r15; uregs[16] is CPSR; uregs[17] is ORIG_r0 */
-struct target_pt_regs {
-    abi_long uregs[18];
-};
-
 #define ARM_SYSCALL_BASE	0x900000
 #define ARM_THUMB_SYSCALL	0
 

From af6da9e6b845f31675343c58786b2389b2f4a0ec Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:30:59 +1000
Subject: [PATCH 0178/2396] linux-user/arm: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/elfload.c    |  8 +++-----
 linux-user/arm/target_elf.h | 11 +++++++----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index 47fe16a1a6..f811c2f07a 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -201,13 +201,11 @@ const char *get_elf_platform(CPUState *cs)
 #undef END
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
     for (int i = 0; i < 16; ++i) {
-        r->regs[i] = tswapreg(env->regs[i]);
+        r->pt.regs[i] = tswapal(env->regs[i]);
     }
-    r->regs[16] = tswapreg(cpsr_read((CPUARMState *)env));
-    r->regs[17] = tswapreg(env->regs[0]); /* XXX */
+    r->pt.cpsr = tswapal(cpsr_read((CPUARMState *)env));
+    r->pt.orig_r0 = tswapal(env->regs[0]); /* FIXME */
 }
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 94db3738e8..fa8f8af2f3 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -8,16 +8,19 @@
 #ifndef ARM_TARGET_ELF_H
 #define ARM_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-#define ELF_NREG                18
+/*
+ * See linux kernel: arch/arm/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct pt_regs via sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From 9308223c714d1efb275cf21c439ee85f5e6cad0d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 15:03:40 +1000
Subject: [PATCH 0179/2396] linux-user/loongarch64: Create target_ptrace.h

Remove the target_pt_regs structure from target_syscall.h.
Add target_user_pt_regs to target_ptrace.h, which matches
what is actually used on loongarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/loongarch64/target_ptrace.h  | 15 +++++++++++++++
 linux-user/loongarch64/target_syscall.h | 23 -----------------------
 2 files changed, 15 insertions(+), 23 deletions(-)
 create mode 100644 linux-user/loongarch64/target_ptrace.h

diff --git a/linux-user/loongarch64/target_ptrace.h b/linux-user/loongarch64/target_ptrace.h
new file mode 100644
index 0000000000..2578e09207
--- /dev/null
+++ b/linux-user/loongarch64/target_ptrace.h
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef LOONGARCH64_TARGET_PTRACE_H
+#define LOONGARCH64_TARGET_PTRACE_H
+
+/* See arch/loongarch/include/uapi/asm/ptrace.h. */
+struct target_user_pt_regs {
+    abi_ulong regs[32];
+    abi_ulong orig_a0;
+    abi_ulong csr_era;
+    abi_ulong csr_badv;
+    abi_ulong reserved[10];
+};
+
+#endif /* LOONGARCH64_TARGET_PTRACE_H */
diff --git a/linux-user/loongarch64/target_syscall.h b/linux-user/loongarch64/target_syscall.h
index 39f229bb9c..f7ced7b2be 100644
--- a/linux-user/loongarch64/target_syscall.h
+++ b/linux-user/loongarch64/target_syscall.h
@@ -8,29 +8,6 @@
 
 #include "qemu/units.h"
 
-/*
- * this struct defines the way the registers are stored on the
- * stack during a system call.
- */
-
-struct target_pt_regs {
-    /* Saved main processor registers. */
-    target_ulong regs[32];
-
-    /* Saved special registers. */
-    struct {
-        target_ulong era;
-        target_ulong badv;
-        target_ulong crmd;
-        target_ulong prmd;
-        target_ulong euen;
-        target_ulong ecfg;
-        target_ulong estat;
-    } csr;
-    target_ulong orig_a0;
-    target_ulong __last[0];
-};
-
 #define UNAME_MACHINE "loongarch64"
 #define UNAME_MINIMUM_RELEASE "5.19.0"
 

From 190cc717f8cf50b7d38b8f9b8a2045540f71c571 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:37:08 +1000
Subject: [PATCH 0180/2396] linux-user/loongarch64: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Note that the kernel's uses an array, and then it has a bunch of defines
to create symbolic offsets.  Modulo some reserved fields, which we do
not implement here, this is the same layout as struct user_pt_regs.

Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/loongarch64/elfload.c    | 14 ++++----------
 linux-user/loongarch64/target_elf.h |  7 +++----
 2 files changed, 7 insertions(+), 14 deletions(-)

diff --git a/linux-user/loongarch64/elfload.c b/linux-user/loongarch64/elfload.c
index 832890de10..ce3bd0c607 100644
--- a/linux-user/loongarch64/elfload.c
+++ b/linux-user/loongarch64/elfload.c
@@ -65,20 +65,14 @@ const char *get_elf_platform(CPUState *cs)
 
 #define tswapreg(ptr)   tswapal(ptr)
 
-enum {
-    TARGET_EF_R0 = 0,
-    TARGET_EF_CSR_ERA = TARGET_EF_R0 + 33,
-    TARGET_EF_CSR_BADV = TARGET_EF_R0 + 34,
-};
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPULoongArchState *env)
 {
-    r->regs[TARGET_EF_R0] = 0;
+    r->pt.regs[0] = 0;
 
     for (int i = 1; i < ARRAY_SIZE(env->gpr); i++) {
-        r->regs[TARGET_EF_R0 + i] = tswapreg(env->gpr[i]);
+        r->pt.regs[i] = tswapreg(env->gpr[i]);
     }
 
-    r->regs[TARGET_EF_CSR_ERA] = tswapreg(env->pc);
-    r->regs[TARGET_EF_CSR_BADV] = tswapreg(env->CSR_BADV);
+    r->pt.csr_era = tswapreg(env->pc);
+    r->pt.csr_badv = tswapreg(env->CSR_BADV);
 }
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 90bca4499d..1f40419af2 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -6,16 +6,15 @@
 #ifndef LOONGARCH_TARGET_ELF_H
 #define LOONGARCH_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
 /* See linux kernel: arch/loongarch/include/asm/elf.h */
-#define ELF_NREG                45
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From 5c3a0884efe7d9a8651bc847571584804146f3f1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:44:40 +1000
Subject: [PATCH 0181/2396] linux-user/m68k: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/m68k/elfload.c    | 42 +++++++++++++++++-------------------
 linux-user/m68k/target_elf.h | 24 ++++++++++++++++-----
 2 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/linux-user/m68k/elfload.c b/linux-user/m68k/elfload.c
index 2970ff7dec..423d1f680a 100644
--- a/linux-user/m68k/elfload.c
+++ b/linux-user/m68k/elfload.c
@@ -18,28 +18,26 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "any";
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUM68KState *env)
 {
-    r->regs[0] = tswapreg(env->dregs[1]);
-    r->regs[1] = tswapreg(env->dregs[2]);
-    r->regs[2] = tswapreg(env->dregs[3]);
-    r->regs[3] = tswapreg(env->dregs[4]);
-    r->regs[4] = tswapreg(env->dregs[5]);
-    r->regs[5] = tswapreg(env->dregs[6]);
-    r->regs[6] = tswapreg(env->dregs[7]);
-    r->regs[7] = tswapreg(env->aregs[0]);
-    r->regs[8] = tswapreg(env->aregs[1]);
-    r->regs[9] = tswapreg(env->aregs[2]);
-    r->regs[10] = tswapreg(env->aregs[3]);
-    r->regs[11] = tswapreg(env->aregs[4]);
-    r->regs[12] = tswapreg(env->aregs[5]);
-    r->regs[13] = tswapreg(env->aregs[6]);
-    r->regs[14] = tswapreg(env->dregs[0]);
-    r->regs[15] = tswapreg(env->aregs[7]);
-    r->regs[16] = tswapreg(env->dregs[0]); /* FIXME: orig_d0 */
-    r->regs[17] = tswapreg(env->sr);
-    r->regs[18] = tswapreg(env->pc);
-    r->regs[19] = 0;  /* FIXME: regs->format | regs->vector */
+    r->d1 = tswapal(env->dregs[1]);
+    r->d2 = tswapal(env->dregs[2]);
+    r->d3 = tswapal(env->dregs[3]);
+    r->d4 = tswapal(env->dregs[4]);
+    r->d5 = tswapal(env->dregs[5]);
+    r->d6 = tswapal(env->dregs[6]);
+    r->d7 = tswapal(env->dregs[7]);
+    r->a0 = tswapal(env->aregs[0]);
+    r->a1 = tswapal(env->aregs[1]);
+    r->a2 = tswapal(env->aregs[2]);
+    r->a3 = tswapal(env->aregs[3]);
+    r->a4 = tswapal(env->aregs[4]);
+    r->a5 = tswapal(env->aregs[5]);
+    r->a6 = tswapal(env->aregs[6]);
+    r->d0 = tswapal(env->dregs[0]);
+    r->usp = tswapal(env->aregs[7]);
+    r->orig_d0 = tswapal(env->dregs[0]); /* FIXME */
+    r->sr = tswapal(env->sr);
+    r->pc = tswapal(env->pc);
+    /* FIXME: regs->format | regs->vector */
 }
diff --git a/linux-user/m68k/target_elf.h b/linux-user/m68k/target_elf.h
index cd6908ab57..0737412cee 100644
--- a/linux-user/m68k/target_elf.h
+++ b/linux-user/m68k/target_elf.h
@@ -10,12 +10,26 @@
 
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel: arch/m68k/include/asm/elf.h.  */
-#define ELF_NREG                20
+/*
+ * See linux kernel: arch/m68k/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct user_regs_struct via sizeof.
+ *
+ * Note that user_regs_struct has
+ *    short stkadj, sr;
+ *    ...
+ *    short fmtvec, __fill;
+ * but ELF_CORE_COPY_REGS writes to unsigned longs.
+ * Therefore adjust the sr and fmtvec fields to match.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    abi_ulong d1, d2, d3, d4, d5, d6, d7;
+    abi_ulong a0, a1, a2, a3, a4, a5, a6;
+    abi_ulong d0;
+    abi_ulong usp;
+    abi_ulong orig_d0;
+    abi_ulong sr;
+    abi_ulong pc;
+    abi_ulong fmtvec;
 } target_elf_gregset_t;
 
 #endif

From cf33264f19b566cda4b50ccfec9e87734b08971f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 15:22:14 +1000
Subject: [PATCH 0182/2396] linux-user/microblaze: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/signal.c         |  1 +
 linux-user/microblaze/target_ptrace.h  | 50 ++++++++++++++++++++++++++
 linux-user/microblaze/target_syscall.h | 44 -----------------------
 3 files changed, 51 insertions(+), 44 deletions(-)
 create mode 100644 linux-user/microblaze/target_ptrace.h

diff --git a/linux-user/microblaze/signal.c b/linux-user/microblaze/signal.c
index f6d47d76ff..7aef781314 100644
--- a/linux-user/microblaze/signal.c
+++ b/linux-user/microblaze/signal.c
@@ -21,6 +21,7 @@
 #include "user-internals.h"
 #include "signal-common.h"
 #include "linux-user/trace.h"
+#include "target_ptrace.h"
 
 struct target_sigcontext {
     struct target_pt_regs regs;  /* needs to be first */
diff --git a/linux-user/microblaze/target_ptrace.h b/linux-user/microblaze/target_ptrace.h
new file mode 100644
index 0000000000..a46c8cb7bc
--- /dev/null
+++ b/linux-user/microblaze/target_ptrace.h
@@ -0,0 +1,50 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef MICROBLAZE_TARGET_PTRACE_H
+#define MICROBLAZE_TARGET_PTRACE_H
+
+/* We use microblaze_reg_t to keep things similar to the kernel sources.  */
+typedef uint32_t microblaze_reg_t;
+
+struct target_pt_regs {
+    microblaze_reg_t r0;
+    microblaze_reg_t r1;
+    microblaze_reg_t r2;
+    microblaze_reg_t r3;
+    microblaze_reg_t r4;
+    microblaze_reg_t r5;
+    microblaze_reg_t r6;
+    microblaze_reg_t r7;
+    microblaze_reg_t r8;
+    microblaze_reg_t r9;
+    microblaze_reg_t r10;
+    microblaze_reg_t r11;
+    microblaze_reg_t r12;
+    microblaze_reg_t r13;
+    microblaze_reg_t r14;
+    microblaze_reg_t r15;
+    microblaze_reg_t r16;
+    microblaze_reg_t r17;
+    microblaze_reg_t r18;
+    microblaze_reg_t r19;
+    microblaze_reg_t r20;
+    microblaze_reg_t r21;
+    microblaze_reg_t r22;
+    microblaze_reg_t r23;
+    microblaze_reg_t r24;
+    microblaze_reg_t r25;
+    microblaze_reg_t r26;
+    microblaze_reg_t r27;
+    microblaze_reg_t r28;
+    microblaze_reg_t r29;
+    microblaze_reg_t r30;
+    microblaze_reg_t r31;
+    microblaze_reg_t pc;
+    microblaze_reg_t msr;
+    microblaze_reg_t ear;
+    microblaze_reg_t esr;
+    microblaze_reg_t fsr;
+    uint32_t kernel_mode;
+};
+
+#endif /* MICROBLAZE_TARGET_PTRACE_H */
diff --git a/linux-user/microblaze/target_syscall.h b/linux-user/microblaze/target_syscall.h
index 43362a1664..66f5a9ebe2 100644
--- a/linux-user/microblaze/target_syscall.h
+++ b/linux-user/microblaze/target_syscall.h
@@ -4,50 +4,6 @@
 #define UNAME_MACHINE "microblaze"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 
-/* We use microblaze_reg_t to keep things similar to the kernel sources.  */
-typedef uint32_t microblaze_reg_t;
-
-struct target_pt_regs {
-        microblaze_reg_t r0;
-        microblaze_reg_t r1;
-        microblaze_reg_t r2;
-        microblaze_reg_t r3;
-        microblaze_reg_t r4;
-        microblaze_reg_t r5;
-        microblaze_reg_t r6;
-        microblaze_reg_t r7;
-        microblaze_reg_t r8;
-        microblaze_reg_t r9;
-        microblaze_reg_t r10;
-        microblaze_reg_t r11;
-        microblaze_reg_t r12;
-        microblaze_reg_t r13;
-        microblaze_reg_t r14;
-        microblaze_reg_t r15;
-        microblaze_reg_t r16;
-        microblaze_reg_t r17;
-        microblaze_reg_t r18;
-        microblaze_reg_t r19;
-        microblaze_reg_t r20;
-        microblaze_reg_t r21;
-        microblaze_reg_t r22;
-        microblaze_reg_t r23;
-        microblaze_reg_t r24;
-        microblaze_reg_t r25;
-        microblaze_reg_t r26;
-        microblaze_reg_t r27;
-        microblaze_reg_t r28;
-        microblaze_reg_t r29;
-        microblaze_reg_t r30;
-        microblaze_reg_t r31;
-        microblaze_reg_t pc;
-        microblaze_reg_t msr;
-        microblaze_reg_t ear;
-        microblaze_reg_t esr;
-        microblaze_reg_t fsr;
-        uint32_t kernel_mode;
-};
-
 #define TARGET_CLONE_BACKWARDS
 #define TARGET_MCL_CURRENT 1
 #define TARGET_MCL_FUTURE  2

From e5c31ef558da16fb9cbb9e3a3c7247b60fdfd05b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 15:28:11 +1000
Subject: [PATCH 0183/2396] linux-user/microblaze: Fold target_pt_regs.r* to an
 array

Separately enumerating all 32 registers is not helpful.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/signal.c        | 70 +++------------------------
 linux-user/microblaze/target_ptrace.h | 34 +------------
 2 files changed, 8 insertions(+), 96 deletions(-)

diff --git a/linux-user/microblaze/signal.c b/linux-user/microblaze/signal.c
index 7aef781314..e874e4def1 100644
--- a/linux-user/microblaze/signal.c
+++ b/linux-user/microblaze/signal.c
@@ -51,75 +51,17 @@ struct target_rt_sigframe {
 
 static void setup_sigcontext(struct target_sigcontext *sc, CPUMBState *env)
 {
-    __put_user(env->regs[0], &sc->regs.r0);
-    __put_user(env->regs[1], &sc->regs.r1);
-    __put_user(env->regs[2], &sc->regs.r2);
-    __put_user(env->regs[3], &sc->regs.r3);
-    __put_user(env->regs[4], &sc->regs.r4);
-    __put_user(env->regs[5], &sc->regs.r5);
-    __put_user(env->regs[6], &sc->regs.r6);
-    __put_user(env->regs[7], &sc->regs.r7);
-    __put_user(env->regs[8], &sc->regs.r8);
-    __put_user(env->regs[9], &sc->regs.r9);
-    __put_user(env->regs[10], &sc->regs.r10);
-    __put_user(env->regs[11], &sc->regs.r11);
-    __put_user(env->regs[12], &sc->regs.r12);
-    __put_user(env->regs[13], &sc->regs.r13);
-    __put_user(env->regs[14], &sc->regs.r14);
-    __put_user(env->regs[15], &sc->regs.r15);
-    __put_user(env->regs[16], &sc->regs.r16);
-    __put_user(env->regs[17], &sc->regs.r17);
-    __put_user(env->regs[18], &sc->regs.r18);
-    __put_user(env->regs[19], &sc->regs.r19);
-    __put_user(env->regs[20], &sc->regs.r20);
-    __put_user(env->regs[21], &sc->regs.r21);
-    __put_user(env->regs[22], &sc->regs.r22);
-    __put_user(env->regs[23], &sc->regs.r23);
-    __put_user(env->regs[24], &sc->regs.r24);
-    __put_user(env->regs[25], &sc->regs.r25);
-    __put_user(env->regs[26], &sc->regs.r26);
-    __put_user(env->regs[27], &sc->regs.r27);
-    __put_user(env->regs[28], &sc->regs.r28);
-    __put_user(env->regs[29], &sc->regs.r29);
-    __put_user(env->regs[30], &sc->regs.r30);
-    __put_user(env->regs[31], &sc->regs.r31);
+    for (int i = 0; i < 32; ++i) {
+        __put_user(env->regs[i], &sc->regs.r[i]);
+    }
     __put_user(env->pc, &sc->regs.pc);
 }
 
 static void restore_sigcontext(struct target_sigcontext *sc, CPUMBState *env)
 {
-    __get_user(env->regs[0], &sc->regs.r0);
-    __get_user(env->regs[1], &sc->regs.r1);
-    __get_user(env->regs[2], &sc->regs.r2);
-    __get_user(env->regs[3], &sc->regs.r3);
-    __get_user(env->regs[4], &sc->regs.r4);
-    __get_user(env->regs[5], &sc->regs.r5);
-    __get_user(env->regs[6], &sc->regs.r6);
-    __get_user(env->regs[7], &sc->regs.r7);
-    __get_user(env->regs[8], &sc->regs.r8);
-    __get_user(env->regs[9], &sc->regs.r9);
-    __get_user(env->regs[10], &sc->regs.r10);
-    __get_user(env->regs[11], &sc->regs.r11);
-    __get_user(env->regs[12], &sc->regs.r12);
-    __get_user(env->regs[13], &sc->regs.r13);
-    __get_user(env->regs[14], &sc->regs.r14);
-    __get_user(env->regs[15], &sc->regs.r15);
-    __get_user(env->regs[16], &sc->regs.r16);
-    __get_user(env->regs[17], &sc->regs.r17);
-    __get_user(env->regs[18], &sc->regs.r18);
-    __get_user(env->regs[19], &sc->regs.r19);
-    __get_user(env->regs[20], &sc->regs.r20);
-    __get_user(env->regs[21], &sc->regs.r21);
-    __get_user(env->regs[22], &sc->regs.r22);
-    __get_user(env->regs[23], &sc->regs.r23);
-    __get_user(env->regs[24], &sc->regs.r24);
-    __get_user(env->regs[25], &sc->regs.r25);
-    __get_user(env->regs[26], &sc->regs.r26);
-    __get_user(env->regs[27], &sc->regs.r27);
-    __get_user(env->regs[28], &sc->regs.r28);
-    __get_user(env->regs[29], &sc->regs.r29);
-    __get_user(env->regs[30], &sc->regs.r30);
-    __get_user(env->regs[31], &sc->regs.r31);
+    for (int i = 0; i < 32; ++i) {
+        __get_user(env->regs[i], &sc->regs.r[i]);
+    }
     __get_user(env->pc, &sc->regs.pc);
 }
 
diff --git a/linux-user/microblaze/target_ptrace.h b/linux-user/microblaze/target_ptrace.h
index a46c8cb7bc..ead913e5a4 100644
--- a/linux-user/microblaze/target_ptrace.h
+++ b/linux-user/microblaze/target_ptrace.h
@@ -7,38 +7,8 @@
 typedef uint32_t microblaze_reg_t;
 
 struct target_pt_regs {
-    microblaze_reg_t r0;
-    microblaze_reg_t r1;
-    microblaze_reg_t r2;
-    microblaze_reg_t r3;
-    microblaze_reg_t r4;
-    microblaze_reg_t r5;
-    microblaze_reg_t r6;
-    microblaze_reg_t r7;
-    microblaze_reg_t r8;
-    microblaze_reg_t r9;
-    microblaze_reg_t r10;
-    microblaze_reg_t r11;
-    microblaze_reg_t r12;
-    microblaze_reg_t r13;
-    microblaze_reg_t r14;
-    microblaze_reg_t r15;
-    microblaze_reg_t r16;
-    microblaze_reg_t r17;
-    microblaze_reg_t r18;
-    microblaze_reg_t r19;
-    microblaze_reg_t r20;
-    microblaze_reg_t r21;
-    microblaze_reg_t r22;
-    microblaze_reg_t r23;
-    microblaze_reg_t r24;
-    microblaze_reg_t r25;
-    microblaze_reg_t r26;
-    microblaze_reg_t r27;
-    microblaze_reg_t r28;
-    microblaze_reg_t r29;
-    microblaze_reg_t r30;
-    microblaze_reg_t r31;
+    /* Note the kernel enumerates all 32 registers. */
+    microblaze_reg_t r[32];
     microblaze_reg_t pc;
     microblaze_reg_t msr;
     microblaze_reg_t ear;

From e803a48c1ac72ed47b6490e3d7cf6b0cc7372e85 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 11:55:27 +1000
Subject: [PATCH 0184/2396] linux-user/microblaze: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/microblaze/elfload.c    | 14 +++++---------
 linux-user/microblaze/target_elf.h | 11 +++++++----
 2 files changed, 12 insertions(+), 13 deletions(-)

diff --git a/linux-user/microblaze/elfload.c b/linux-user/microblaze/elfload.c
index 89250dbd63..7eb1b26d17 100644
--- a/linux-user/microblaze/elfload.c
+++ b/linux-user/microblaze/elfload.c
@@ -11,18 +11,14 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "any";
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)
 {
     for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(env->regs[i]);
+        r->pt.r[i] = tswapal(env->regs[i]);
     }
 
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(mb_cpu_read_msr(env));
-    r->regs[34] = 0;
-    r->regs[35] = tswapreg(env->ear);
-    r->regs[36] = 0;
-    r->regs[37] = tswapreg(env->esr);
+    r->pt.pc = tswapal(env->pc);
+    r->pt.msr = tswapal(mb_cpu_read_msr(env));
+    r->pt.ear = tswapal(env->ear);
+    r->pt.esr = tswapal(env->esr);
 }
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index cc5cc0477e..56de77d4f3 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -8,13 +8,16 @@
 #ifndef MICROBLAZE_TARGET_ELF_H
 #define MICROBLAZE_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-#define ELF_NREG                38
+/*
+ * See linux kernel: arch/microblaze/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct pt_regs via sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From 0dcef5773000f4d72277c6b41200f35031bdcbb5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 15:34:41 +1000
Subject: [PATCH 0185/2396] linux-user/mips: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h.
Fix the incorrect ordering of the fields.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mips/target_ptrace.h    | 17 +++++++++++++++++
 linux-user/mips/target_syscall.h   | 19 -------------------
 linux-user/mips64/target_ptrace.h  | 16 ++++++++++++++++
 linux-user/mips64/target_syscall.h | 16 ----------------
 4 files changed, 33 insertions(+), 35 deletions(-)
 create mode 100644 linux-user/mips/target_ptrace.h
 create mode 100644 linux-user/mips64/target_ptrace.h

diff --git a/linux-user/mips/target_ptrace.h b/linux-user/mips/target_ptrace.h
new file mode 100644
index 0000000000..2f63b27ac4
--- /dev/null
+++ b/linux-user/mips/target_ptrace.h
@@ -0,0 +1,17 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef MIPS_TARGET_PTRACE_H
+#define MIPS_TARGET_PTRACE_H
+
+struct target_pt_regs {
+    abi_ulong pad0[6];
+    abi_ulong regs[32];
+    abi_ulong lo;
+    abi_ulong hi;
+    abi_ulong cp0_epc;
+    abi_ulong cp0_badvaddr;
+    abi_ulong cp0_status;
+    abi_ulong cp0_cause;
+};
+
+#endif /* MIPS_TARGET_PTRACE_H */
diff --git a/linux-user/mips/target_syscall.h b/linux-user/mips/target_syscall.h
index 08ead67810..dfcdf320b7 100644
--- a/linux-user/mips/target_syscall.h
+++ b/linux-user/mips/target_syscall.h
@@ -1,25 +1,6 @@
 #ifndef MIPS_TARGET_SYSCALL_H
 #define MIPS_TARGET_SYSCALL_H
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-
-struct target_pt_regs {
-	/* Pad bytes for argument save space on the stack. */
-	abi_ulong pad0[6];
-
-	/* Saved main processor registers. */
-	abi_ulong regs[32];
-
-	/* Saved special registers. */
-	abi_ulong cp0_status;
-	abi_ulong lo;
-	abi_ulong hi;
-	abi_ulong cp0_badvaddr;
-	abi_ulong cp0_cause;
-	abi_ulong cp0_epc;
-};
-
 #define UNAME_MACHINE "mips"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 
diff --git a/linux-user/mips64/target_ptrace.h b/linux-user/mips64/target_ptrace.h
new file mode 100644
index 0000000000..41f0bf6c1c
--- /dev/null
+++ b/linux-user/mips64/target_ptrace.h
@@ -0,0 +1,16 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef MIPS64_TARGET_PTRACE_H
+#define MIPS64_TARGET_PTRACE_H
+
+struct target_pt_regs {
+    target_ulong regs[32];
+    target_ulong lo;
+    target_ulong hi;
+    target_ulong cp0_epc;
+    target_ulong cp0_badvaddr;
+    target_ulong cp0_status;
+    target_ulong cp0_cause;
+};
+
+#endif /* MIPS64_TARGET_PTRACE_H */
diff --git a/linux-user/mips64/target_syscall.h b/linux-user/mips64/target_syscall.h
index 358dc2d64c..9135bf5e8b 100644
--- a/linux-user/mips64/target_syscall.h
+++ b/linux-user/mips64/target_syscall.h
@@ -1,22 +1,6 @@
 #ifndef MIPS64_TARGET_SYSCALL_H
 #define MIPS64_TARGET_SYSCALL_H
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-
-struct target_pt_regs {
-        /* Saved main processor registers. */
-        target_ulong regs[32];
-
-        /* Saved special registers. */
-        target_ulong cp0_status;
-        target_ulong lo;
-        target_ulong hi;
-        target_ulong cp0_badvaddr;
-        target_ulong cp0_cause;
-        target_ulong cp0_epc;
-};
-
 #define UNAME_MACHINE "mips64"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 

From c61b88fbe49e428e39eff501cddbcd53f12486cb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 12:05:05 +1000
Subject: [PATCH 0186/2396] linux-user/mips: Use target_ulong for
 target_elf_greg_t

Make use of the fact that target_elf_gregset_t is a proper structure.
The target_ulong type matches the abi_ulong/abi_ullong
selection within mips64/target_elf.h.

Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mips/elfload.c      | 48 +++++++---------------------------
 linux-user/mips/target_elf.h   | 10 ++++---
 linux-user/mips64/target_elf.h | 14 +++++-----
 3 files changed, 22 insertions(+), 50 deletions(-)

diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index 6e884911af..e0c50f50ed 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -124,47 +124,19 @@ const char *get_elf_base_platform(CPUState *cs)
 
 #undef MATCH_PLATFORM_INSN
 
-#ifdef TARGET_ABI_MIPSN32
-#define tswapreg(ptr)   tswap64(ptr)
-#else
-#define tswapreg(ptr)   tswapal(ptr)
-#endif
-
-/* See linux kernel: arch/mips/include/asm/reg.h.  */
-enum {
-#ifdef TARGET_MIPS64
-    TARGET_EF_R0 = 0,
-#else
-    TARGET_EF_R0 = 6,
-#endif
-    TARGET_EF_R26 = TARGET_EF_R0 + 26,
-    TARGET_EF_R27 = TARGET_EF_R0 + 27,
-    TARGET_EF_LO = TARGET_EF_R0 + 32,
-    TARGET_EF_HI = TARGET_EF_R0 + 33,
-    TARGET_EF_CP0_EPC = TARGET_EF_R0 + 34,
-    TARGET_EF_CP0_BADVADDR = TARGET_EF_R0 + 35,
-    TARGET_EF_CP0_STATUS = TARGET_EF_R0 + 36,
-    TARGET_EF_CP0_CAUSE = TARGET_EF_R0 + 37
-};
-
 /* See linux kernel: arch/mips/kernel/process.c:elf_dump_regs.  */
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMIPSState *env)
 {
-    int i;
-
-    for (i = 0; i <= TARGET_EF_R0; i++) {
-        r->regs[i] = 0;
-    }
-    for (i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
-        r->regs[TARGET_EF_R0 + i] = tswapreg(env->active_tc.gpr[i]);
+    for (int i = 1; i < ARRAY_SIZE(env->active_tc.gpr); i++) {
+        r->pt.regs[i] = tswapl(env->active_tc.gpr[i]);
     }
 
-    r->regs[TARGET_EF_R26] = 0;
-    r->regs[TARGET_EF_R27] = 0;
-    r->regs[TARGET_EF_LO] = tswapreg(env->active_tc.LO[0]);
-    r->regs[TARGET_EF_HI] = tswapreg(env->active_tc.HI[0]);
-    r->regs[TARGET_EF_CP0_EPC] = tswapreg(env->active_tc.PC);
-    r->regs[TARGET_EF_CP0_BADVADDR] = tswapreg(env->CP0_BadVAddr);
-    r->regs[TARGET_EF_CP0_STATUS] = tswapreg(env->CP0_Status);
-    r->regs[TARGET_EF_CP0_CAUSE] = tswapreg(env->CP0_Cause);
+    r->pt.regs[26] = 0;
+    r->pt.regs[27] = 0;
+    r->pt.lo = tswapl(env->active_tc.LO[0]);
+    r->pt.hi = tswapl(env->active_tc.HI[0]);
+    r->pt.cp0_epc = tswapl(env->active_tc.PC);
+    r->pt.cp0_badvaddr = tswapl(env->CP0_BadVAddr);
+    r->pt.cp0_status = tswapl(env->CP0_Status);
+    r->pt.cp0_cause = tswapl(env->CP0_Cause);
 }
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index f767767eaa..a4b7fadbd6 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -8,16 +8,18 @@
 #ifndef MIPS_TARGET_ELF_H
 #define MIPS_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
 /* See linux kernel: arch/mips/include/asm/elf.h.  */
-#define ELF_NREG                45
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    union {
+        abi_ulong reserved[45];
+        struct target_pt_regs pt;
+    };
 } target_elf_gregset_t;
 
 #endif
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 046a165eef..67bc963134 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -8,20 +8,18 @@
 #ifndef MIPS64_TARGET_ELF_H
 #define MIPS64_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
 #define HAVE_ELF_CORE_DUMP      1
 
-#ifdef TARGET_ABI_MIPSN32
-typedef abi_ullong target_elf_greg_t;
-#else
-typedef abi_ulong target_elf_greg_t;
-#endif
-
 /* See linux kernel: arch/mips/include/asm/elf.h.  */
-#define ELF_NREG                45
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    union {
+        target_ulong reserved[45];
+        struct target_pt_regs pt;
+    };
 } target_elf_gregset_t;
 
 #endif

From 7a4512db0a52b5005999f839cec934a77f32437b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 15:47:43 +1000
Subject: [PATCH 0187/2396] linux-user/openrisc: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h and
rename to target_user_regs_struct, obviating the comment.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/openrisc/signal.c         |  3 ++-
 linux-user/openrisc/target_ptrace.h  | 13 +++++++++++++
 linux-user/openrisc/target_syscall.h | 11 -----------
 3 files changed, 15 insertions(+), 12 deletions(-)
 create mode 100644 linux-user/openrisc/target_ptrace.h

diff --git a/linux-user/openrisc/signal.c b/linux-user/openrisc/signal.c
index cb74a9fe5e..40249095f2 100644
--- a/linux-user/openrisc/signal.c
+++ b/linux-user/openrisc/signal.c
@@ -21,9 +21,10 @@
 #include "user-internals.h"
 #include "signal-common.h"
 #include "linux-user/trace.h"
+#include "target_ptrace.h"
 
 typedef struct target_sigcontext {
-    struct target_pt_regs regs;
+    struct target_user_regs_struct regs;
     abi_ulong oldmask;
 } target_sigcontext;
 
diff --git a/linux-user/openrisc/target_ptrace.h b/linux-user/openrisc/target_ptrace.h
new file mode 100644
index 0000000000..563c648525
--- /dev/null
+++ b/linux-user/openrisc/target_ptrace.h
@@ -0,0 +1,13 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef OPENRISC_TARGET_PTRACE_H
+#define OPENRISC_TARGET_PTRACE_H
+
+/* See arch/openrisc/include/uapi/asm/ptrace.h. */
+struct target_user_regs_struct {
+    abi_ulong gpr[32];
+    abi_ulong pc;
+    abi_ulong sr;
+};
+
+#endif /* OPENRISC_TARGET_PTRACE_H */
diff --git a/linux-user/openrisc/target_syscall.h b/linux-user/openrisc/target_syscall.h
index 7fe5b73d3b..c8394e9dcd 100644
--- a/linux-user/openrisc/target_syscall.h
+++ b/linux-user/openrisc/target_syscall.h
@@ -1,17 +1,6 @@
 #ifndef OPENRISC_TARGET_SYSCALL_H
 #define OPENRISC_TARGET_SYSCALL_H
 
-/* Note that in linux/arch/openrisc/include/uapi/asm/ptrace.h,
- * this is called user_regs_struct.  Given that this is what
- * is used within struct sigcontext we need this definition.
- * However, elfload.c wants this name.
- */
-struct target_pt_regs {
-    abi_ulong gpr[32];
-    abi_ulong pc;
-    abi_ulong sr;
-};
-
 #define UNAME_MACHINE "openrisc"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 

From 611dd00a45860027f51281fc31e6428aefc8a003 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 12:09:26 +1000
Subject: [PATCH 0188/2396] linux-user/openrisc: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/openrisc/elfload.c    |  8 +++-----
 linux-user/openrisc/target_elf.h | 12 +++++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/linux-user/openrisc/elfload.c b/linux-user/openrisc/elfload.c
index bb5ad96711..6bf02bf58d 100644
--- a/linux-user/openrisc/elfload.c
+++ b/linux-user/openrisc/elfload.c
@@ -11,13 +11,11 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return "any";
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUOpenRISCState *env)
 {
     for (int i = 0; i < 32; i++) {
-        r->regs[i] = tswapreg(cpu_get_gpr(env, i));
+        r->pt.gpr[i] = tswapal(cpu_get_gpr(env, i));
     }
-    r->regs[32] = tswapreg(env->pc);
-    r->regs[33] = tswapreg(cpu_get_sr(env));
+    r->pt.pc = tswapal(env->pc);
+    r->pt.sr = tswapal(cpu_get_sr(env));
 }
diff --git a/linux-user/openrisc/target_elf.h b/linux-user/openrisc/target_elf.h
index e97bdc11ed..ad80e4b41a 100644
--- a/linux-user/openrisc/target_elf.h
+++ b/linux-user/openrisc/target_elf.h
@@ -8,14 +8,16 @@
 #ifndef OPENRISC_TARGET_ELF_H
 #define OPENRISC_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel arch/openrisc/include/asm/elf.h.  */
-#define ELF_NREG                34 /* gprs and pc, sr */
+/*
+ * See linux kernel: arch/openrisc/include/uapi/asm/elf.h, where
+ * elf_gregset_t is mapped to struct user_regs_struct via sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_regs_struct pt;
 } target_elf_gregset_t;
 
 #endif

From 584c21f34eb0419858d74420df7d0fd5f3ea419a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:02:35 +1000
Subject: [PATCH 0189/2396] linux-user/ppc: Create target_ptrace.h

Move the target_pt_regs structure from target_syscall.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/ppc/target_ptrace.h  | 26 ++++++++++++++++++++++++++
 linux-user/ppc/target_syscall.h | 28 ----------------------------
 2 files changed, 26 insertions(+), 28 deletions(-)
 create mode 100644 linux-user/ppc/target_ptrace.h

diff --git a/linux-user/ppc/target_ptrace.h b/linux-user/ppc/target_ptrace.h
new file mode 100644
index 0000000000..df77bfde73
--- /dev/null
+++ b/linux-user/ppc/target_ptrace.h
@@ -0,0 +1,26 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef PPC_TARGET_PTRACE_H
+#define PPC_TARGET_PTRACE_H
+
+struct target_pt_regs {
+    abi_ulong gpr[32];
+    abi_ulong nip;
+    abi_ulong msr;
+    abi_ulong orig_gpr3;        /* Used for restarting system calls */
+    abi_ulong ctr;
+    abi_ulong link;
+    abi_ulong xer;
+    abi_ulong ccr;
+#if defined(TARGET_PPC64)
+    abi_ulong softe;
+#else
+    abi_ulong mq;               /* 601 only (not used at present) */
+#endif
+    abi_ulong trap;             /* Reason for being here */
+    abi_ulong dar;              /* Fault registers */
+    abi_ulong dsisr;
+    abi_ulong result;           /* Result of a system call */
+};
+
+#endif /* PPC_TARGET_PTRACE_H */
diff --git a/linux-user/ppc/target_syscall.h b/linux-user/ppc/target_syscall.h
index 77b36d0b46..976b4bb7e9 100644
--- a/linux-user/ppc/target_syscall.h
+++ b/linux-user/ppc/target_syscall.h
@@ -20,34 +20,6 @@
 #ifndef PPC_TARGET_SYSCALL_H
 #define PPC_TARGET_SYSCALL_H
 
-/* XXX: ABSOLUTELY BUGGY:
- * for now, this is quite just a cut-and-paste from i386 target...
- */
-
-/* default linux values for the selectors */
-#define __USER_DS	(1)
-
-struct target_pt_regs {
-	abi_ulong gpr[32];
-	abi_ulong nip;
-	abi_ulong msr;
-	abi_ulong orig_gpr3;	/* Used for restarting system calls */
-	abi_ulong ctr;
-	abi_ulong link;
-	abi_ulong xer;
-	abi_ulong ccr;
-#if defined(TARGET_PPC64)
-        abi_ulong softe;
-#else
-	abi_ulong mq;		/* 601 only (not used at present) */
-#endif
-					/* Used on APUS to hold IPL value. */
-	abi_ulong trap;		/* Reason for being here */
-	abi_ulong dar;		/* Fault registers */
-	abi_ulong dsisr;
-	abi_ulong result; 		/* Result of a system call */
-};
-
 /* ioctls */
 struct target_revectored_struct {
 	abi_ulong __map[8];			/* 256 bits */

From 8ad5f12426dd6218db4753722ab240a16a235259 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 12:22:55 +1000
Subject: [PATCH 0190/2396] linux-user/ppc: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/ppc/elfload.c    | 23 ++++++++---------------
 linux-user/ppc/target_elf.h | 16 +++++++++++-----
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/linux-user/ppc/elfload.c b/linux-user/ppc/elfload.c
index 114e40a358..0d54da9803 100644
--- a/linux-user/ppc/elfload.c
+++ b/linux-user/ppc/elfload.c
@@ -131,23 +131,16 @@ abi_ulong get_elf_hwcap2(CPUState *cs)
     return features;
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUPPCState *env)
 {
-    int i;
-    target_ulong ccr = 0;
-
-    for (i = 0; i < ARRAY_SIZE(env->gpr); i++) {
-        r->regs[i] = tswapreg(env->gpr[i]);
+    for (int i = 0; i < ARRAY_SIZE(env->gpr); i++) {
+        r->pt.gpr[i] = tswapal(env->gpr[i]);
     }
 
-    r->regs[32] = tswapreg(env->nip);
-    r->regs[33] = tswapreg(env->msr);
-    r->regs[35] = tswapreg(env->ctr);
-    r->regs[36] = tswapreg(env->lr);
-    r->regs[37] = tswapreg(cpu_read_xer(env));
-
-    ccr = ppc_get_cr(env);
-    r->regs[38] = tswapreg(ccr);
+    r->pt.nip = tswapal(env->nip);
+    r->pt.msr = tswapal(env->msr);
+    r->pt.ctr = tswapal(env->ctr);
+    r->pt.link = tswapal(env->lr);
+    r->pt.xer = tswapal(cpu_read_xer(env));
+    r->pt.ccr = tswapal(ppc_get_cr(env));
 }
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 72615553ea..2a61cd2896 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -8,16 +8,22 @@
 #ifndef PPC_TARGET_ELF_H
 #define PPC_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel: arch/powerpc/include/asm/elf.h.  */
-#define ELF_NREG                48
+/*
+ * The size of 48 words is set in arch/powerpc/include/uapi/asm/elf.h.
+ * However PPC_ELF_CORE_COPY_REGS in arch/powerpc/include/asm/elf.h
+ * open-codes a memcpy from struct pt_regs, then zeros the rest.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    union {
+        struct target_pt_regs pt;
+        abi_ulong reserved[48];
+    };
 } target_elf_gregset_t;
 
 #endif

From 71c2c79815fafe6d509ca1a76bc67d6041aaa37b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:13:03 +1000
Subject: [PATCH 0191/2396] linux-user/s390x: Create target_ptrace.h

Move target_psw_t to target_ptrace.h.  Note that abi_ulong already
has an attribute for 8-byte alignment, so there's no need to carry
another on target_psw_t.

Remove the target_pt_regs; add target_s390x_reg to target_ptrace.h,
which matches what is actually used.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/s390x/signal.c         |  1 +
 linux-user/s390x/target_ptrace.h  | 18 ++++++++++++++++++
 linux-user/s390x/target_syscall.h | 22 ----------------------
 3 files changed, 19 insertions(+), 22 deletions(-)
 create mode 100644 linux-user/s390x/target_ptrace.h

diff --git a/linux-user/s390x/signal.c b/linux-user/s390x/signal.c
index df49c24708..96d1c8d11c 100644
--- a/linux-user/s390x/signal.c
+++ b/linux-user/s390x/signal.c
@@ -22,6 +22,7 @@
 #include "signal-common.h"
 #include "linux-user/trace.h"
 #include "vdso-asmoffset.h"
+#include "target_ptrace.h"
 
 #define __NUM_GPRS 16
 #define __NUM_FPRS 16
diff --git a/linux-user/s390x/target_ptrace.h b/linux-user/s390x/target_ptrace.h
new file mode 100644
index 0000000000..a5ceb75a74
--- /dev/null
+++ b/linux-user/s390x/target_ptrace.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef S390X_TARGET_PTRACE_H
+#define S390X_TARGET_PTRACE_H
+
+typedef struct {
+    abi_ulong mask;
+    abi_ulong addr;
+} target_psw_t;
+
+struct target_s390_regs {
+    target_psw_t psw;
+    abi_ulong gprs[16];
+    abi_uint acrs[16];
+    abi_ulong orig_gpr2;
+};
+
+#endif /* S390X_TARGET_PTRACE_H */
diff --git a/linux-user/s390x/target_syscall.h b/linux-user/s390x/target_syscall.h
index 4018988a25..f01f9a0baa 100644
--- a/linux-user/s390x/target_syscall.h
+++ b/linux-user/s390x/target_syscall.h
@@ -1,28 +1,6 @@
 #ifndef S390X_TARGET_SYSCALL_H
 #define S390X_TARGET_SYSCALL_H
 
-/* this typedef defines how a Program Status Word looks like */
-typedef struct {
-    abi_ulong mask;
-    abi_ulong addr;
-} __attribute__ ((aligned(8))) target_psw_t;
-
-/*
- * The pt_regs struct defines the way the registers are stored on
- * the stack during a system call.
- */
-
-#define TARGET_NUM_GPRS        16
-
-struct target_pt_regs {
-    abi_ulong args[1];
-    target_psw_t psw;
-    abi_ulong gprs[TARGET_NUM_GPRS];
-    abi_ulong orig_gpr2;
-    unsigned short ilen;
-    unsigned short trap;
-};
-
 #define UNAME_MACHINE "s390x"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 

From dabda4f36a992dffde252919124a25fe7054fe42 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 12:31:49 +1000
Subject: [PATCH 0192/2396] linux-user/s390x: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
This lets us drop the ugly cast to uint32_t* in the middle.

Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/s390x/elfload.c    | 28 +++++++---------------------
 linux-user/s390x/target_elf.h | 12 +++++++-----
 2 files changed, 14 insertions(+), 26 deletions(-)

diff --git a/linux-user/s390x/elfload.c b/linux-user/s390x/elfload.c
index 4113273b72..27109279e2 100644
--- a/linux-user/s390x/elfload.c
+++ b/linux-user/s390x/elfload.c
@@ -68,29 +68,15 @@ const char *elf_hwcap_str(uint32_t bit)
     return bit < ARRAY_SIZE(hwcap_str) ? hwcap_str[bit] : NULL;
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
-enum {
-    TARGET_REG_PSWM = 0,
-    TARGET_REG_PSWA = 1,
-    TARGET_REG_GPRS = 2,
-    TARGET_REG_ARS = 18,
-    TARGET_REG_ORIG_R2 = 26,
-};
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUS390XState *env)
 {
-    int i;
-    uint32_t *aregs;
-
-    r->regs[TARGET_REG_PSWM] = tswapreg(env->psw.mask);
-    r->regs[TARGET_REG_PSWA] = tswapreg(env->psw.addr);
-    for (i = 0; i < 16; i++) {
-        r->regs[TARGET_REG_GPRS + i] = tswapreg(env->regs[i]);
+    r->pt.psw.mask = tswapal(env->psw.mask);
+    r->pt.psw.addr = tswapal(env->psw.addr);
+    for (int i = 0; i < 16; i++) {
+        r->pt.gprs[i] = tswapal(env->regs[i]);
     }
-    aregs = (uint32_t *)&(r->regs[TARGET_REG_ARS]);
-    for (i = 0; i < 16; i++) {
-        aregs[i] = tswap32(env->aregs[i]);
+    for (int i = 0; i < 16; i++) {
+        r->pt.acrs[i] = tswap32(env->aregs[i]);
     }
-    r->regs[TARGET_REG_ORIG_R2] = 0;
+    r->pt.orig_gpr2 = 0;
 }
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index b7d863ee66..670c7b3eed 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -8,15 +8,17 @@
 #ifndef S390X_TARGET_ELF_H
 #define S390X_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel: arch/s390/include/uapi/asm/ptrace.h (s390_regs).  */
-#define ELF_NREG                27
+/*
+ * See linux kernel: arch/s390/include/asm/elf.h, where
+ * elf_gregset_t is typedef'd to struct s390_regs.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_s390_regs pt;
 } target_elf_gregset_t;
 
 #endif

From ec12f80d1f2915bbd1c2734f7ce1dcbb3c0ff70b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:22:08 +1000
Subject: [PATCH 0193/2396] linux-user/sh4: Create target_ptrace.h

Move target_pt_regs to target_ptrace.h.
Convert to abi_foo types.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sh4/target_ptrace.h  | 18 ++++++++++++++++++
 linux-user/sh4/target_syscall.h | 11 -----------
 2 files changed, 18 insertions(+), 11 deletions(-)
 create mode 100644 linux-user/sh4/target_ptrace.h

diff --git a/linux-user/sh4/target_ptrace.h b/linux-user/sh4/target_ptrace.h
new file mode 100644
index 0000000000..b80218526b
--- /dev/null
+++ b/linux-user/sh4/target_ptrace.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef SH4_TARGET_PTRACE_H
+#define SH4_TARGET_PTRACE_H
+
+/* See arch/sh/include/uapi/asm/ptrace_32.h. */
+struct target_pt_regs {
+    abi_ulong regs[16];
+    abi_ulong pc;
+    abi_ulong pr;
+    abi_ulong sr;
+    abi_ulong gbr;
+    abi_ulong mach;
+    abi_ulong macl;
+    abi_long tra;
+};
+
+#endif /* SH4_TARGET_PTRACE_H */
diff --git a/linux-user/sh4/target_syscall.h b/linux-user/sh4/target_syscall.h
index 148398855d..2f3557742d 100644
--- a/linux-user/sh4/target_syscall.h
+++ b/linux-user/sh4/target_syscall.h
@@ -1,17 +1,6 @@
 #ifndef SH4_TARGET_SYSCALL_H
 #define SH4_TARGET_SYSCALL_H
 
-struct target_pt_regs {
-        unsigned long regs[16];
-        unsigned long pc;
-        unsigned long pr;
-        unsigned long sr;
-        unsigned long gbr;
-        unsigned long mach;
-        unsigned long macl;
-        long tra;
-};
-
 #define UNAME_MACHINE "sh4"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 

From 92e1a92823eaa812451a9499754431b2002503ec Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 13:34:12 +1000
Subject: [PATCH 0194/2396] linux-user/sh4: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sh4/elfload.c    | 28 +++++++---------------------
 linux-user/sh4/target_elf.h | 12 +++++++-----
 2 files changed, 14 insertions(+), 26 deletions(-)

diff --git a/linux-user/sh4/elfload.c b/linux-user/sh4/elfload.c
index 71cae9703e..ddf2aaaed7 100644
--- a/linux-user/sh4/elfload.c
+++ b/linux-user/sh4/elfload.c
@@ -38,30 +38,16 @@ abi_ulong get_elf_hwcap(CPUState *cs)
     return hwcap;
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
-/* See linux kernel: arch/sh/include/asm/ptrace.h.  */
-enum {
-    TARGET_REG_PC = 16,
-    TARGET_REG_PR = 17,
-    TARGET_REG_SR = 18,
-    TARGET_REG_GBR = 19,
-    TARGET_REG_MACH = 20,
-    TARGET_REG_MACL = 21,
-    TARGET_REG_SYSCALL = 22
-};
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUSH4State *env)
 {
     for (int i = 0; i < 16; i++) {
-        r->regs[i] = tswapreg(env->gregs[i]);
+        r->pt.regs[i] = tswapal(env->gregs[i]);
     }
 
-    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
-    r->regs[TARGET_REG_PR] = tswapreg(env->pr);
-    r->regs[TARGET_REG_SR] = tswapreg(env->sr);
-    r->regs[TARGET_REG_GBR] = tswapreg(env->gbr);
-    r->regs[TARGET_REG_MACH] = tswapreg(env->mach);
-    r->regs[TARGET_REG_MACL] = tswapreg(env->macl);
-    r->regs[TARGET_REG_SYSCALL] = 0; /* FIXME */
+    r->pt.pc = tswapal(env->pc);
+    r->pt.pr = tswapal(env->pr);
+    r->pt.sr = tswapal(env->sr);
+    r->pt.gbr = tswapal(env->gbr);
+    r->pt.mach = tswapal(env->mach);
+    r->pt.macl = tswapal(env->macl);
 }
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index f7443ddbac..fd3ae68a01 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -8,15 +8,17 @@
 #ifndef SH4_TARGET_ELF_H
 #define SH4_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel: arch/sh/include/asm/elf.h.  */
-#define ELF_NREG                23
+/*
+ * See linux kernel: arch/sh/include/asm/elf.h, where
+ * elf_gregset_t is mapped to struct pt_regs via sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From b90e36861636fc5f021fd2a0676087d076cd0cc9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:35:33 +1000
Subject: [PATCH 0195/2396] linux-user/xtensa: Create target_ptrace.h

Remove the target_pt_regs; add target_user_pt_regs to
target_ptrace.h, which matches what is actually used.
Remove xtensa_reg_t and xtregs_opt_t.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/xtensa/target_ptrace.h  | 22 +++++++++++++++++++
 linux-user/xtensa/target_syscall.h | 35 ------------------------------
 2 files changed, 22 insertions(+), 35 deletions(-)
 create mode 100644 linux-user/xtensa/target_ptrace.h

diff --git a/linux-user/xtensa/target_ptrace.h b/linux-user/xtensa/target_ptrace.h
new file mode 100644
index 0000000000..32443d0dee
--- /dev/null
+++ b/linux-user/xtensa/target_ptrace.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef XTENSA_TARGET_PTRACE_H
+#define XTENSA_TARGET_PTRACE_H
+
+/* See arch/xtensa/include/uapi/asm/ptrace.h. */
+struct target_user_pt_regs {
+    uint32_t pc;
+    uint32_t ps;
+    uint32_t lbeg;
+    uint32_t lend;
+    uint32_t lcount;
+    uint32_t sar;
+    uint32_t windowstart;
+    uint32_t windowbase;
+    uint32_t threadptr;
+    uint32_t syscall;
+    uint32_t reserved[6 + 48];
+    uint32_t a[64];
+};
+
+#endif /* XTENSA_TARGET_PTRACE_H */
diff --git a/linux-user/xtensa/target_syscall.h b/linux-user/xtensa/target_syscall.h
index afc86a153f..5d4352a4d1 100644
--- a/linux-user/xtensa/target_syscall.h
+++ b/linux-user/xtensa/target_syscall.h
@@ -8,41 +8,6 @@
 
 #define MMAP_SHIFT TARGET_PAGE_BITS
 
-typedef uint32_t xtensa_reg_t;
-typedef struct {
-} xtregs_opt_t; /* TODO */
-
-struct target_pt_regs {
-    xtensa_reg_t pc;            /*   4 */
-    xtensa_reg_t ps;            /*   8 */
-    xtensa_reg_t depc;          /*  12 */
-    xtensa_reg_t exccause;      /*  16 */
-    xtensa_reg_t excvaddr;      /*  20 */
-    xtensa_reg_t debugcause;    /*  24 */
-    xtensa_reg_t wmask;         /*  28 */
-    xtensa_reg_t lbeg;          /*  32 */
-    xtensa_reg_t lend;          /*  36 */
-    xtensa_reg_t lcount;        /*  40 */
-    xtensa_reg_t sar;           /*  44 */
-    xtensa_reg_t windowbase;    /*  48 */
-    xtensa_reg_t windowstart;   /*  52 */
-    xtensa_reg_t syscall;       /*  56 */
-    xtensa_reg_t icountlevel;   /*  60 */
-    xtensa_reg_t scompare1;     /*  64 */
-    xtensa_reg_t threadptr;     /*  68 */
-
-    /* Additional configurable registers that are used by the compiler. */
-    xtregs_opt_t xtregs_opt;
-
-    /* Make sure the areg field is 16 bytes aligned. */
-    int align[0] __attribute__ ((aligned(16)));
-
-    /* current register frame.
-     * Note: The ESF for kernel exceptions ends after 16 registers!
-     */
-    xtensa_reg_t areg[16];
-};
-
 #define TARGET_MCL_CURRENT 1
 #define TARGET_MCL_FUTURE  2
 #define TARGET_MCL_ONFAULT 4

From abfa6c7c2a0ddc4eaf373de320d758435e7acf9b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 13:44:40 +1000
Subject: [PATCH 0196/2396] linux-user/xtensa: Expand target_elf_gregset_t

Make use of the fact that target_elf_gregset_t is a proper structure.
Drop ELF_NREG, target_elf_greg_t, and tswapreg.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/xtensa/elfload.c    | 39 +++++++++++-----------------------
 linux-user/xtensa/target_elf.h | 12 ++++++-----
 2 files changed, 19 insertions(+), 32 deletions(-)

diff --git a/linux-user/xtensa/elfload.c b/linux-user/xtensa/elfload.c
index 49e709a094..68aeed855f 100644
--- a/linux-user/xtensa/elfload.c
+++ b/linux-user/xtensa/elfload.c
@@ -11,36 +11,21 @@ const char *get_elf_cpu_model(uint32_t eflags)
     return XTENSA_DEFAULT_CPU_MODEL;
 }
 
-#define tswapreg(ptr)   tswapal(ptr)
-
-enum {
-    TARGET_REG_PC,
-    TARGET_REG_PS,
-    TARGET_REG_LBEG,
-    TARGET_REG_LEND,
-    TARGET_REG_LCOUNT,
-    TARGET_REG_SAR,
-    TARGET_REG_WINDOWSTART,
-    TARGET_REG_WINDOWBASE,
-    TARGET_REG_THREADPTR,
-    TARGET_REG_AR0 = 64,
-};
-
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUXtensaState *env)
 {
-    unsigned i;
+    r->pt.pc = tswap32(env->pc);
+    r->pt.ps = tswap32(env->sregs[PS] & ~PS_EXCM);
+    r->pt.lbeg = tswap32(env->sregs[LBEG]);
+    r->pt.lend = tswap32(env->sregs[LEND]);
+    r->pt.lcount = tswap32(env->sregs[LCOUNT]);
+    r->pt.sar = tswap32(env->sregs[SAR]);
+    r->pt.windowstart = tswap32(env->sregs[WINDOW_START]);
+    r->pt.windowbase = tswap32(env->sregs[WINDOW_BASE]);
+    r->pt.threadptr = tswap32(env->uregs[THREADPTR]);
 
-    r->regs[TARGET_REG_PC] = tswapreg(env->pc);
-    r->regs[TARGET_REG_PS] = tswapreg(env->sregs[PS] & ~PS_EXCM);
-    r->regs[TARGET_REG_LBEG] = tswapreg(env->sregs[LBEG]);
-    r->regs[TARGET_REG_LEND] = tswapreg(env->sregs[LEND]);
-    r->regs[TARGET_REG_LCOUNT] = tswapreg(env->sregs[LCOUNT]);
-    r->regs[TARGET_REG_SAR] = tswapreg(env->sregs[SAR]);
-    r->regs[TARGET_REG_WINDOWSTART] = tswapreg(env->sregs[WINDOW_START]);
-    r->regs[TARGET_REG_WINDOWBASE] = tswapreg(env->sregs[WINDOW_BASE]);
-    r->regs[TARGET_REG_THREADPTR] = tswapreg(env->uregs[THREADPTR]);
     xtensa_sync_phys_from_window((CPUXtensaState *)env);
-    for (i = 0; i < env->config->nareg; ++i) {
-        r->regs[TARGET_REG_AR0 + i] = tswapreg(env->phys_regs[i]);
+
+    for (unsigned i = 0; i < env->config->nareg; ++i) {
+        r->pt.a[i] = tswap32(env->phys_regs[i]);
     }
 }
diff --git a/linux-user/xtensa/target_elf.h b/linux-user/xtensa/target_elf.h
index 43e241aac1..850a7206a5 100644
--- a/linux-user/xtensa/target_elf.h
+++ b/linux-user/xtensa/target_elf.h
@@ -8,14 +8,16 @@
 #ifndef XTENSA_TARGET_ELF_H
 #define XTENSA_TARGET_ELF_H
 
+#include "target_ptrace.h"
+
 #define HAVE_ELF_CORE_DUMP      1
 
-typedef abi_ulong target_elf_greg_t;
-
-/* See linux kernel: arch/xtensa/include/asm/elf.h.  */
-#define ELF_NREG                128
+/*
+ * See linux kernel: arch/xtensa/include/asm/elf.h, where elf_gregset_t
+ * is mapped to struct user_pt_regs via typedef and sizeof.
+ */
 typedef struct target_elf_gregset_t {
-    target_elf_greg_t regs[ELF_NREG];
+    struct target_user_pt_regs pt;
 } target_elf_gregset_t;
 
 #endif

From 8d4a6f8e4c95e11a3da2e38682da2819d4e2160c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:06:15 -1000
Subject: [PATCH 0197/2396] linux-user: Move init_guest_commpage to
 x86_64/elfload.c

Rename INIT_GUEST_COMMPAGE to HAVE_GUEST_COMMPAGE
to match the other HAVE_* defines.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 23 +----------------------
 linux-user/loader.h            |  3 +++
 linux-user/x86_64/elfload.c    | 20 ++++++++++++++++++++
 linux-user/x86_64/target_elf.h |  1 +
 4 files changed, 25 insertions(+), 22 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 07d83c674d..0ba75a83b3 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -145,27 +145,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_X86_64
 
-#if ULONG_MAX > UINT32_MAX
-#define INIT_GUEST_COMMPAGE
-static bool init_guest_commpage(void)
-{
-    /*
-     * The vsyscall page is at a high negative address aka kernel space,
-     * which means that we cannot actually allocate it with target_mmap.
-     * We still should be able to use page_set_flags, unless the user
-     * has specified -R reserved_va, which would trigger an assert().
-     */
-    if (reserved_va != 0 &&
-        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE - 1 > reserved_va) {
-        error_report("Cannot allocate vsyscall page");
-        exit(EXIT_FAILURE);
-    }
-    page_set_flags(TARGET_VSYSCALL_PAGE,
-                   TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
-                   PAGE_EXEC | PAGE_VALID);
-    return true;
-}
-#endif
 #else
 
 /*
@@ -1215,7 +1194,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #else
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
-#ifndef INIT_GUEST_COMMPAGE
+#ifndef HAVE_GUEST_COMMPAGE
 #define init_guest_commpage() true
 #endif
 #endif
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 8f4a7f69ac..98015fba7d 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -105,6 +105,9 @@ const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 const char *get_elf_platform(CPUState *cs);
 const char *get_elf_base_platform(CPUState *cs);
+#if defined(TARGET_X86_64)
+bool init_guest_commpage(void);
+#endif
 
 struct target_elf_gregset_t;
 void elf_core_copy_regs(struct target_elf_gregset_t *, const CPUArchState *);
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 12de1c54c7..1e7000c6bc 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "qemu.h"
 #include "loader.h"
 #include "target_elf.h"
@@ -21,6 +22,25 @@ const char *get_elf_platform(CPUState *cs)
     return "x86_64";
 }
 
+bool init_guest_commpage(void)
+{
+    /*
+     * The vsyscall page is at a high negative address aka kernel space,
+     * which means that we cannot actually allocate it with target_mmap.
+     * We still should be able to use page_set_flags, unless the user
+     * has specified -R reserved_va, which would trigger an assert().
+     */
+    if (reserved_va != 0 &&
+        TARGET_VSYSCALL_PAGE + TARGET_PAGE_SIZE - 1 > reserved_va) {
+        error_report("Cannot allocate vsyscall page");
+        exit(EXIT_FAILURE);
+    }
+    page_set_flags(TARGET_VSYSCALL_PAGE,
+                   TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUX86State *env)
 {
     r->pt.r15 = tswapal(env->regs[15]);
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index 32a9eec431..f05b1d4dba 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -13,6 +13,7 @@
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
+#define HAVE_GUEST_COMMPAGE     1
 
 /*
  * See linux kernel: arch/x86/include/asm/elf.h, where

From a56ef5e8454e42c0d263a97a1297ae67f4ce19cd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:11:12 -1000
Subject: [PATCH 0198/2396] linux-user: Move init_guest_commpage to
 arm/elfload.c

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/elfload.c    | 46 +++++++++++++++++++++++++++++++++++
 linux-user/arm/target_elf.h |  2 ++
 linux-user/elfload.c        | 48 -------------------------------------
 linux-user/loader.h         |  2 +-
 4 files changed, 49 insertions(+), 49 deletions(-)

diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index f811c2f07a..1205687976 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -3,6 +3,8 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "user-internals.h"
+#include "target_elf.h"
 #include "target/arm/cpu-features.h"
 #include "target_elf.h"
 
@@ -201,6 +203,50 @@ const char *get_elf_platform(CPUState *cs)
 #undef END
 }
 
+bool init_guest_commpage(void)
+{
+    ARMCPU *cpu = ARM_CPU(thread_cpu);
+    int host_page_size = qemu_real_host_page_size();
+    abi_ptr commpage;
+    void *want;
+    void *addr;
+
+    /*
+     * M-profile allocates maximum of 2GB address space, so can never
+     * allocate the commpage.  Skip it.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
+        return true;
+    }
+
+    commpage = HI_COMMPAGE & -host_page_size;
+    want = g2h_untagged(commpage);
+    addr = mmap(want, host_page_size, PROT_READ | PROT_WRITE,
+                MAP_ANONYMOUS | MAP_PRIVATE |
+                (commpage < reserved_va ? MAP_FIXED : MAP_FIXED_NOREPLACE),
+                -1, 0);
+
+    if (addr == MAP_FAILED) {
+        perror("Allocating guest commpage");
+        exit(EXIT_FAILURE);
+    }
+    if (addr != want) {
+        return false;
+    }
+
+    /* Set kernel helper versions; rest of page is 0.  */
+    __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
+
+    if (mprotect(addr, host_page_size, PROT_READ)) {
+        perror("Protecting guest commpage");
+        exit(EXIT_FAILURE);
+    }
+
+    page_set_flags(commpage, commpage | (host_page_size - 1),
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
+    return true;
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
     for (int i = 0; i < 16; ++i) {
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index fa8f8af2f3..5f81a43efb 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -15,6 +15,8 @@
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
 
+#define HI_COMMPAGE             ((intptr_t)0xffff0f00u)
+
 /*
  * See linux kernel: arch/arm/include/asm/elf.h, where
  * elf_gregset_t is mapped to struct pt_regs via sizeof.
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0ba75a83b3..2281853c57 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -191,54 +191,6 @@ typedef abi_int         target_pid_t;
 
 #define ELF_EXEC_PAGESIZE       4096
 
-/* The commpage only exists for 32 bit kernels */
-
-#define HI_COMMPAGE (intptr_t)0xffff0f00u
-
-static bool init_guest_commpage(void)
-{
-    ARMCPU *cpu = ARM_CPU(thread_cpu);
-    int host_page_size = qemu_real_host_page_size();
-    abi_ptr commpage;
-    void *want;
-    void *addr;
-
-    /*
-     * M-profile allocates maximum of 2GB address space, so can never
-     * allocate the commpage.  Skip it.
-     */
-    if (arm_feature(&cpu->env, ARM_FEATURE_M)) {
-        return true;
-    }
-
-    commpage = HI_COMMPAGE & -host_page_size;
-    want = g2h_untagged(commpage);
-    addr = mmap(want, host_page_size, PROT_READ | PROT_WRITE,
-                MAP_ANONYMOUS | MAP_PRIVATE |
-                (commpage < reserved_va ? MAP_FIXED : MAP_FIXED_NOREPLACE),
-                -1, 0);
-
-    if (addr == MAP_FAILED) {
-        perror("Allocating guest commpage");
-        exit(EXIT_FAILURE);
-    }
-    if (addr != want) {
-        return false;
-    }
-
-    /* Set kernel helper versions; rest of page is 0.  */
-    __put_user(5, (uint32_t *)g2h_untagged(0xffff0ffcu));
-
-    if (mprotect(addr, host_page_size, PROT_READ)) {
-        perror("Protecting guest commpage");
-        exit(EXIT_FAILURE);
-    }
-
-    page_set_flags(commpage, commpage | (host_page_size - 1),
-                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
-    return true;
-}
-
 #if TARGET_BIG_ENDIAN
 #include "elf.h"
 #include "vdso-be8.c.inc"
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 98015fba7d..0c2cc556c3 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -105,7 +105,7 @@ const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 const char *get_elf_platform(CPUState *cs);
 const char *get_elf_base_platform(CPUState *cs);
-#if defined(TARGET_X86_64)
+#if defined(TARGET_X86_64) || defined(TARGET_ARM)
 bool init_guest_commpage(void);
 #endif
 

From 6a91f64ee12fe54d1a9573e9ecbbae037b113097 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:13:54 -1000
Subject: [PATCH 0199/2396] linux-user: Move init_guest_commpage to
 hppa/elfload.c

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 32 --------------------------------
 linux-user/hppa/elfload.c    | 31 +++++++++++++++++++++++++++++++
 linux-user/hppa/target_elf.h |  2 ++
 linux-user/loader.h          |  2 --
 4 files changed, 33 insertions(+), 34 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 2281853c57..25f29e60de 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -415,38 +415,6 @@ static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define LO_COMMPAGE  0
-
-static bool init_guest_commpage(void)
-{
-    /* If reserved_va, then we have already mapped 0 page on the host. */
-    if (!reserved_va) {
-        void *want, *addr;
-
-        want = g2h_untagged(LO_COMMPAGE);
-        addr = mmap(want, TARGET_PAGE_SIZE, PROT_NONE,
-                    MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED_NOREPLACE, -1, 0);
-        if (addr == MAP_FAILED) {
-            perror("Allocating guest commpage");
-            exit(EXIT_FAILURE);
-        }
-        if (addr != want) {
-            return false;
-        }
-    }
-
-    /*
-     * On Linux, page zero is normally marked execute only + gateway.
-     * Normal read or write is supposed to fail (thus PROT_NONE above),
-     * but specific offsets have kernel code mapped to raise permissions
-     * and implement syscalls.  Here, simply mark the page executable.
-     * Special case the entry points during translation (see do_page_zero).
-     */
-    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
-                   PAGE_EXEC | PAGE_VALID);
-    return true;
-}
-
 #endif /* TARGET_HPPA */
 
 #ifdef TARGET_XTENSA
diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
index 9dd3fe092a..018034f244 100644
--- a/linux-user/hppa/elfload.c
+++ b/linux-user/hppa/elfload.c
@@ -3,6 +3,7 @@
 #include "qemu/osdep.h"
 #include "qemu.h"
 #include "loader.h"
+#include "target_elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -14,3 +15,33 @@ const char *get_elf_platform(CPUState *cs)
 {
     return "PARISC";
 }
+
+bool init_guest_commpage(void)
+{
+    /* If reserved_va, then we have already mapped 0 page on the host. */
+    if (!reserved_va) {
+        void *want, *addr;
+
+        want = g2h_untagged(LO_COMMPAGE);
+        addr = mmap(want, TARGET_PAGE_SIZE, PROT_NONE,
+                    MAP_ANONYMOUS | MAP_PRIVATE | MAP_FIXED_NOREPLACE, -1, 0);
+        if (addr == MAP_FAILED) {
+            perror("Allocating guest commpage");
+            exit(EXIT_FAILURE);
+        }
+        if (addr != want) {
+            return false;
+        }
+    }
+
+    /*
+     * On Linux, page zero is normally marked execute only + gateway.
+     * Normal read or write is supposed to fail (thus PROT_NONE above),
+     * but specific offsets have kernel code mapped to raise permissions
+     * and implement syscalls.  Here, simply mark the page executable.
+     * Special case the entry points during translation (see do_page_zero).
+     */
+    page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
+                   PAGE_EXEC | PAGE_VALID);
+    return true;
+}
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index 85be00584d..b654758afa 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -10,4 +10,6 @@
 
 #define HAVE_ELF_PLATFORM       1
 
+#define LO_COMMPAGE             0
+
 #endif
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 0c2cc556c3..c3b8f92e23 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -105,9 +105,7 @@ const char *elf_hwcap_str(uint32_t bit);
 const char *elf_hwcap2_str(uint32_t bit);
 const char *get_elf_platform(CPUState *cs);
 const char *get_elf_base_platform(CPUState *cs);
-#if defined(TARGET_X86_64) || defined(TARGET_ARM)
 bool init_guest_commpage(void);
-#endif
 
 struct target_elf_gregset_t;
 void elf_core_copy_regs(struct target_elf_gregset_t *, const CPUArchState *);

From 6e1c4ec4582814537c9a2b4700ff32da44fb27af Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:16:37 -1000
Subject: [PATCH 0200/2396] linux-user: Replace init_guest_commpage macro with
 function

Turn the fallback macro into a function.  This will produce
a link error if the other macros are set up incorrectly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 25f29e60de..81bf05f581 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1115,7 +1115,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
 #define HI_COMMPAGE 0
 #define LO_COMMPAGE -1
 #ifndef HAVE_GUEST_COMMPAGE
-#define init_guest_commpage() true
+bool init_guest_commpage(void) { return true; }
 #endif
 #endif
 

From 71cc79a4a172d28638ad27a4e6327a4ce1bcdf2b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:33:51 -1000
Subject: [PATCH 0201/2396] linux-user: Move get_vdso_image_info to
 arm/elfload.c

Rename from vdso_image_info to avoid a symbol clash.
Define HAVE_VDSO_IMAGE_INFO to signal the external definition exists.
Provide fallback versions for other targets.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/elfload.c    | 20 ++++++++++++++++++
 linux-user/arm/target_elf.h |  1 +
 linux-user/elfload.c        | 41 ++++++++-----------------------------
 linux-user/loader.h         | 12 +++++++++++
 4 files changed, 42 insertions(+), 32 deletions(-)

diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index 1205687976..308ed23fcb 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -7,6 +7,7 @@
 #include "target_elf.h"
 #include "target/arm/cpu-features.h"
 #include "target_elf.h"
+#include "elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -255,3 +256,22 @@ void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
     r->pt.cpsr = tswapal(cpsr_read((CPUARMState *)env));
     r->pt.orig_r0 = tswapal(env->regs[0]); /* FIXME */
 }
+
+#if TARGET_BIG_ENDIAN
+# include "vdso-be8.c.inc"
+# include "vdso-be32.c.inc"
+#else
+# include "vdso-le.c.inc"
+#endif
+
+const VdsoImageInfo *get_vdso_image_info(uint32_t elf_flags)
+{
+#if TARGET_BIG_ENDIAN
+    return (EF_ARM_EABI_VERSION(elf_flags) >= EF_ARM_EABI_VER4
+            && (elf_flags & EF_ARM_BE8)
+            ? &vdso_be8_image_info
+            : &vdso_be32_image_info);
+#else
+    return &vdso_image_info;
+#endif
+}
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 5f81a43efb..19fdfa2f2c 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -14,6 +14,7 @@
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
+#define HAVE_VDSO_IMAGE_INFO    1
 
 #define HI_COMMPAGE             ((intptr_t)0xffff0f00u)
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 81bf05f581..aed390ebb3 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -40,15 +40,6 @@
 #define TARGET_ARCH_HAS_SIGTRAMP_PAGE 0
 #endif
 
-typedef struct {
-    const uint8_t *image;
-    const uint32_t *relocs;
-    unsigned image_size;
-    unsigned reloc_count;
-    unsigned sigreturn_ofs;
-    unsigned rt_sigreturn_ofs;
-} VdsoImageInfo;
-
 #define ELF_OSABI   ELFOSABI_SYSV
 
 /* from personality.h */
@@ -191,23 +182,6 @@ typedef abi_int         target_pid_t;
 
 #define ELF_EXEC_PAGESIZE       4096
 
-#if TARGET_BIG_ENDIAN
-#include "elf.h"
-#include "vdso-be8.c.inc"
-#include "vdso-be32.c.inc"
-
-static const VdsoImageInfo *vdso_image_info(uint32_t elf_flags)
-{
-    return (EF_ARM_EABI_VERSION(elf_flags) >= EF_ARM_EABI_VER4
-            && (elf_flags & EF_ARM_BE8)
-            ? &vdso_be8_image_info
-            : &vdso_be32_image_info);
-}
-#define vdso_image_info vdso_image_info
-#else
-# define VDSO_HEADER  "vdso-le.c.inc"
-#endif
-
 #else
 /* 64 bit ARM definitions */
 
@@ -1973,14 +1947,17 @@ static void load_elf_interp(const char *filename, struct image_info *info,
     load_elf_image(filename, &src, info, &ehdr, NULL);
 }
 
-#ifndef vdso_image_info
+#ifndef HAVE_VDSO_IMAGE_INFO
+const VdsoImageInfo *get_vdso_image_info(uint32_t elf_flags)
+{
 #ifdef VDSO_HEADER
 #include VDSO_HEADER
-#define  vdso_image_info(flags)  &vdso_image_info
+    return &vdso_image_info;
 #else
-#define  vdso_image_info(flags)  NULL
-#endif /* VDSO_HEADER */
-#endif /* vdso_image_info */
+    return NULL;
+#endif
+}
+#endif /* HAVE_VDSO_IMAGE_INFO */
 
 static void load_elf_vdso(struct image_info *info, const VdsoImageInfo *vdso)
 {
@@ -2311,7 +2288,7 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
      * Load a vdso if available, which will amongst other things contain the
      * signal trampolines.  Otherwise, allocate a separate page for them.
      */
-    const VdsoImageInfo *vdso = vdso_image_info(info->elf_flags);
+    const VdsoImageInfo *vdso = get_vdso_image_info(info->elf_flags);
     if (vdso) {
         load_elf_vdso(&vdso_info, vdso);
         info->vdso = vdso_info.load_bias;
diff --git a/linux-user/loader.h b/linux-user/loader.h
index c3b8f92e23..2175dd4e0a 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -110,4 +110,16 @@ bool init_guest_commpage(void);
 struct target_elf_gregset_t;
 void elf_core_copy_regs(struct target_elf_gregset_t *, const CPUArchState *);
 
+typedef struct {
+    const uint8_t *image;
+    const uint32_t *relocs;
+    unsigned image_size;
+    unsigned reloc_count;
+    unsigned sigreturn_ofs;
+    unsigned rt_sigreturn_ofs;
+} VdsoImageInfo;
+
+/* Note that both Elf32_Word and Elf64_Word are uint32_t. */
+const VdsoImageInfo *get_vdso_image_info(uint32_t elf_flags);
+
 #endif /* LINUX_USER_LOADER_H */

From 9f24d077f1ea76ede5968d68312840c909751b73 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 09:40:47 -1000
Subject: [PATCH 0202/2396] linux-user: Remove ELF_EXEC_PAGESIZE

Use TARGET_PAGE_SIZE instead.  If the target page size may vary,
using a different fixed size is wrong.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 32 ++------------------------------
 1 file changed, 2 insertions(+), 30 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index aed390ebb3..59e6605e36 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -167,8 +167,6 @@ typedef abi_int         target_pid_t;
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define ELF_EXEC_PAGESIZE       4096
-
 #endif /* TARGET_I386 */
 
 #ifdef TARGET_ARM
@@ -180,16 +178,12 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS       ELFCLASS32
 #define EXSTACK_DEFAULT true
 
-#define ELF_EXEC_PAGESIZE       4096
-
 #else
 /* 64 bit ARM definitions */
 
 #define ELF_ARCH        EM_AARCH64
 #define ELF_CLASS       ELFCLASS64
 
-#define ELF_EXEC_PAGESIZE       4096
-
 #if TARGET_BIG_ENDIAN
 # define VDSO_HEADER  "vdso-be.c.inc"
 #else
@@ -258,8 +252,6 @@ typedef abi_int         target_pid_t;
         NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
     } while (0)
 
-#define ELF_EXEC_PAGESIZE       4096
-
 #ifndef TARGET_PPC64
 # define VDSO_HEADER  "vdso-32.c.inc"
 #elif TARGET_BIG_ENDIAN
@@ -280,8 +272,6 @@ typedef abi_int         target_pid_t;
 
 #define VDSO_HEADER "vdso.c.inc"
 
-#define ELF_EXEC_PAGESIZE        4096
-
 #endif /* TARGET_LOONGARCH64 */
 
 #ifdef TARGET_MIPS
@@ -300,8 +290,6 @@ typedef abi_int         target_pid_t;
 #define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
 #endif
 
-#define ELF_EXEC_PAGESIZE        4096
-
 #endif /* TARGET_MIPS */
 
 #ifdef TARGET_MICROBLAZE
@@ -311,8 +299,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS   ELFCLASS32
 #define ELF_ARCH    EM_MICROBLAZE
 
-#define ELF_EXEC_PAGESIZE        4096
-
 #endif /* TARGET_MICROBLAZE */
 
 #ifdef TARGET_OPENRISC
@@ -321,8 +307,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS ELFCLASS32
 #define ELF_DATA  ELFDATA2MSB
 
-#define ELF_EXEC_PAGESIZE 8192
-
 #endif /* TARGET_OPENRISC */
 
 #ifdef TARGET_SH4
@@ -330,8 +314,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS ELFCLASS32
 #define ELF_ARCH  EM_SH
 
-#define ELF_EXEC_PAGESIZE        4096
-
 #endif
 
 #ifdef TARGET_M68K
@@ -339,8 +321,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_68K
 
-#define ELF_EXEC_PAGESIZE       8192
-
 #endif
 
 #ifdef TARGET_ALPHA
@@ -348,8 +328,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS      ELFCLASS64
 #define ELF_ARCH       EM_ALPHA
 
-#define ELF_EXEC_PAGESIZE        8192
-
 #endif /* TARGET_ALPHA */
 
 #ifdef TARGET_S390X
@@ -358,8 +336,6 @@ typedef abi_int         target_pid_t;
 #define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
-#define ELF_EXEC_PAGESIZE 4096
-
 #define VDSO_HEADER "vdso.c.inc"
 
 #endif /* TARGET_S390X */
@@ -376,8 +352,6 @@ typedef abi_int         target_pid_t;
 #define VDSO_HEADER "vdso-64.c.inc"
 #endif
 
-#define ELF_EXEC_PAGESIZE 4096
-
 #endif /* TARGET_RISCV */
 
 #ifdef TARGET_HPPA
@@ -396,8 +370,6 @@ typedef abi_int         target_pid_t;
 #define ELF_CLASS       ELFCLASS32
 #define ELF_ARCH        EM_XTENSA
 
-#define ELF_EXEC_PAGESIZE       4096
-
 #endif /* TARGET_XTENSA */
 
 #ifdef TARGET_HEXAGON
@@ -2697,7 +2669,7 @@ static int wmr_fill_region_phdr(void *opaque, vaddr start,
     phdr->p_flags = (flags & PAGE_READ ? PF_R : 0)
                   | (flags & PAGE_WRITE_ORG ? PF_W : 0)
                   | (flags & PAGE_EXEC ? PF_X : 0);
-    phdr->p_align = ELF_EXEC_PAGESIZE;
+    phdr->p_align = TARGET_PAGE_SIZE;
 
     bswap_phdr(phdr, 1);
     d->phdr = phdr + 1;
@@ -2805,7 +2777,7 @@ static int elf_core_dump(int signr, const CPUArchState *env)
     offset += size_note("CORE", sizeof(struct target_elf_prpsinfo));
     offset += size_note("CORE", sizeof(struct target_elf_prstatus)) * cpus;
     note_size = offset - note_offset;
-    data_offset = ROUND_UP(offset, ELF_EXEC_PAGESIZE);
+    data_offset = TARGET_PAGE_ALIGN(offset);
 
     /* Do not dump if the corefile size exceeds the limit. */
     if (dumpsize.rlim_cur != RLIM_INFINITY

From 793ca839186df6cc9dda25121932a25c7d0ff366 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 3 Aug 2025 07:21:46 +1000
Subject: [PATCH 0203/2396] linux-user: Remove redundant ELF_DATA definitons

We already provide ELF_DATA based on TARGET_BIG_ENDIAN.
Remove the extra definitions from openrisc and s390x.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 59e6605e36..8ff9f83bb8 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -305,7 +305,6 @@ typedef abi_int         target_pid_t;
 
 #define ELF_ARCH EM_OPENRISC
 #define ELF_CLASS ELFCLASS32
-#define ELF_DATA  ELFDATA2MSB
 
 #endif /* TARGET_OPENRISC */
 
@@ -333,7 +332,6 @@ typedef abi_int         target_pid_t;
 #ifdef TARGET_S390X
 
 #define ELF_CLASS	ELFCLASS64
-#define ELF_DATA	ELFDATA2MSB
 #define ELF_ARCH	EM_S390
 
 #define VDSO_HEADER "vdso.c.inc"

From 73addb3ffc2c2252a9ffc55e56d9ed88d1dccd84 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:14:24 -1000
Subject: [PATCH 0204/2396] linux-user: Move elf parameters to
 {i386,x86_64}/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 39 ----------------------------------
 linux-user/i386/target_elf.h   | 22 +++++++++++++++++++
 linux-user/x86_64/target_elf.h |  4 ++++
 3 files changed, 26 insertions(+), 39 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 8ff9f83bb8..73ca6c681e 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,45 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_I386
-
-#ifdef TARGET_X86_64
-#define ELF_CLASS      ELFCLASS64
-#define ELF_ARCH       EM_X86_64
-
-#else
-
-/*
- * This is used to ensure we don't load something for the wrong architecture.
- */
-#define elf_check_arch(x) ( ((x) == EM_386) || ((x) == EM_486) )
-
-/*
- * These are used to set parameters in the core dumps.
- */
-#define ELF_CLASS       ELFCLASS32
-#define ELF_ARCH        EM_386
-
-#define EXSTACK_DEFAULT true
-
-/*
- * i386 is the only target which supplies AT_SYSINFO for the vdso.
- * All others only supply AT_SYSINFO_EHDR.
- */
-#define DLINFO_ARCH_ITEMS (vdso_info != NULL)
-#define ARCH_DLINFO                                     \
-    do {                                                \
-        if (vdso_info) {                                \
-            NEW_AUX_ENT(AT_SYSINFO, vdso_info->entry);  \
-        }                                               \
-    } while (0)
-
-#endif /* TARGET_X86_64 */
-
-#define VDSO_HEADER "vdso.c.inc"
-
-#endif /* TARGET_I386 */
-
 #ifdef TARGET_ARM
 
 #ifndef TARGET_AARCH64
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index f89ac0b611..dc58c0017a 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -10,6 +10,11 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_386
+#define EXSTACK_DEFAULT         true
+#define VDSO_HEADER             "vdso.c.inc"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
@@ -22,4 +27,21 @@ typedef struct target_elf_gregset_t {
     struct target_user_regs_struct pt;
 } target_elf_gregset_t;
 
+/*
+ * This is used to ensure we don't load something for the wrong architecture.
+ */
+#define elf_check_arch(x)       ((x) == EM_386 || (x) == EM_486)
+
+/*
+ * i386 is the only target which supplies AT_SYSINFO for the vdso.
+ * All others only supply AT_SYSINFO_EHDR.
+ */
+#define DLINFO_ARCH_ITEMS (vdso_info != NULL)
+#define ARCH_DLINFO                                     \
+    do {                                                \
+        if (vdso_info) {                                \
+            NEW_AUX_ENT(AT_SYSINFO, vdso_info->entry);  \
+        }                                               \
+    } while (0)
+
 #endif
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index f05b1d4dba..f3c09bb8da 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -10,6 +10,10 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS64
+#define ELF_ARCH                EM_X86_64
+#define VDSO_HEADER             "vdso.c.inc"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1

From f8eff2334a3b77d30ddae672edd3c541020cd1ca Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:17:19 -1000
Subject: [PATCH 0205/2396] linux-user: Move elf parameters to
 {arm,aarch64}/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/target_elf.h |  9 +++++++++
 linux-user/arm/target_elf.h     |  4 ++++
 linux-user/elfload.c            | 25 -------------------------
 3 files changed, 13 insertions(+), 25 deletions(-)

diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index 9eb8bb547e..3c9fef9378 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -10,6 +10,9 @@
 
 #include "target_ptrace.h"
 
+#define ELF_ARCH                EM_AARCH64
+#define ELF_CLASS               ELFCLASS64
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
@@ -23,4 +26,10 @@ typedef struct target_elf_gregset_t {
     struct target_user_pt_regs pt;
 } target_elf_gregset_t;
 
+#if TARGET_BIG_ENDIAN
+# define VDSO_HEADER            "vdso-be.c.inc"
+#else
+# define VDSO_HEADER            "vdso-le.c.inc"
+#endif
+
 #endif
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index 19fdfa2f2c..d871d6d665 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -10,6 +10,10 @@
 
 #include "target_ptrace.h"
 
+#define ELF_ARCH                EM_ARM
+#define ELF_CLASS               ELFCLASS32
+#define EXSTACK_DEFAULT         true
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 73ca6c681e..838d7199a6 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,31 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_ARM
-
-#ifndef TARGET_AARCH64
-/* 32 bit ARM definitions */
-
-#define ELF_ARCH        EM_ARM
-#define ELF_CLASS       ELFCLASS32
-#define EXSTACK_DEFAULT true
-
-#else
-/* 64 bit ARM definitions */
-
-#define ELF_ARCH        EM_AARCH64
-#define ELF_CLASS       ELFCLASS64
-
-#if TARGET_BIG_ENDIAN
-# define VDSO_HEADER  "vdso-be.c.inc"
-#else
-# define VDSO_HEADER  "vdso-le.c.inc"
-#endif
-
-#endif /* not TARGET_AARCH64 */
-
-#endif /* TARGET_ARM */
-
 #ifdef TARGET_SPARC
 
 #ifndef TARGET_SPARC64

From 7b75b5e611d157ec77e4be3ac7f5ff1301380440 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:19:10 -1000
Subject: [PATCH 0206/2396] linux-user: Move elf parameters to
 sparc/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 15 ---------------
 linux-user/sparc/target_elf.h | 11 +++++++++++
 2 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 838d7199a6..ccdd87aa12 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,21 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_SPARC
-
-#ifndef TARGET_SPARC64
-# define ELF_CLASS  ELFCLASS32
-# define ELF_ARCH   EM_SPARC
-#elif defined(TARGET_ABI32)
-# define ELF_CLASS  ELFCLASS32
-# define elf_check_arch(x) ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
-#else
-# define ELF_CLASS  ELFCLASS64
-# define ELF_ARCH   EM_SPARCV9
-#endif
-
-#endif /* TARGET_SPARC */
-
 #ifdef TARGET_PPC
 
 #define ELF_MACHINE    PPC_ELF_MACHINE
diff --git a/linux-user/sparc/target_elf.h b/linux-user/sparc/target_elf.h
index b7544db0a1..f89c708c46 100644
--- a/linux-user/sparc/target_elf.h
+++ b/linux-user/sparc/target_elf.h
@@ -8,6 +8,17 @@
 #ifndef SPARC_TARGET_ELF_H
 #define SPARC_TARGET_ELF_H
 
+#ifndef TARGET_SPARC64
+# define ELF_CLASS              ELFCLASS32
+# define ELF_ARCH               EM_SPARC
+#elif defined(TARGET_ABI32)
+# define ELF_CLASS              ELFCLASS32
+# define elf_check_arch(x)      ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
+#else
+# define ELF_CLASS              ELFCLASS64
+# define ELF_ARCH               EM_SPARCV9
+#endif
+
 #define HAVE_ELF_HWCAP          1
 
 #endif

From 5408b354552180e42d644dc42b8b565648fad1be Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:24:56 -1000
Subject: [PATCH 0207/2396] linux-user: Move elf parameters to ppc/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 53 -------------------------------------
 linux-user/ppc/target_elf.h | 43 ++++++++++++++++++++++++++++++
 2 files changed, 43 insertions(+), 53 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index ccdd87aa12..526c90e2c1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,59 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_PPC
-
-#define ELF_MACHINE    PPC_ELF_MACHINE
-
-#if defined(TARGET_PPC64)
-
-#define elf_check_arch(x) ( (x) == EM_PPC64 )
-
-#define ELF_CLASS       ELFCLASS64
-
-#else
-
-#define ELF_CLASS       ELFCLASS32
-#define EXSTACK_DEFAULT true
-
-#endif
-
-#define ELF_ARCH        EM_PPC
-
-/*
- * The requirements here are:
- * - keep the final alignment of sp (sp & 0xf)
- * - make sure the 32-bit value at the first 16 byte aligned position of
- *   AUXV is greater than 16 for glibc compatibility.
- *   AT_IGNOREPPC is used for that.
- * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC,
- *   even if DLINFO_ARCH_ITEMS goes to zero or is undefined.
- */
-#define DLINFO_ARCH_ITEMS       5
-#define ARCH_DLINFO                                     \
-    do {                                                \
-        PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);              \
-        /*                                              \
-         * Handle glibc compatibility: these magic entries must \
-         * be at the lowest addresses in the final auxv.        \
-         */                                             \
-        NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
-        NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
-        NEW_AUX_ENT(AT_DCACHEBSIZE, cpu->env.dcache_line_size); \
-        NEW_AUX_ENT(AT_ICACHEBSIZE, cpu->env.icache_line_size); \
-        NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
-    } while (0)
-
-#ifndef TARGET_PPC64
-# define VDSO_HEADER  "vdso-32.c.inc"
-#elif TARGET_BIG_ENDIAN
-# define VDSO_HEADER  "vdso-64.c.inc"
-#else
-# define VDSO_HEADER  "vdso-64le.c.inc"
-#endif
-
-#endif
-
 #ifdef TARGET_LOONGARCH64
 
 #define ELF_CLASS   ELFCLASS64
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 2a61cd2896..9a47f18fb8 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -10,6 +10,17 @@
 
 #include "target_ptrace.h"
 
+#define ELF_MACHINE             PPC_ELF_MACHINE
+
+#ifdef TARGET_PPC64
+# define elf_check_arch(x)      ((x) == EM_PPC64)
+# define ELF_CLASS              ELFCLASS64
+#else
+# define ELF_CLASS              ELFCLASS32
+# define EXSTACK_DEFAULT        true
+#endif
+#define ELF_ARCH                EM_PPC
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_CORE_DUMP      1
@@ -26,4 +37,36 @@ typedef struct target_elf_gregset_t {
     };
 } target_elf_gregset_t;
 
+#ifndef TARGET_PPC64
+# define VDSO_HEADER  "vdso-32.c.inc"
+#elif TARGET_BIG_ENDIAN
+# define VDSO_HEADER  "vdso-64.c.inc"
+#else
+# define VDSO_HEADER  "vdso-64le.c.inc"
+#endif
+
+/*
+ * The requirements here are:
+ * - keep the final alignment of sp (sp & 0xf)
+ * - make sure the 32-bit value at the first 16 byte aligned position of
+ *   AUXV is greater than 16 for glibc compatibility.
+ *   AT_IGNOREPPC is used for that.
+ * - for compatibility with glibc ARCH_DLINFO must always be defined on PPC,
+ *   even if DLINFO_ARCH_ITEMS goes to zero or is undefined.
+ */
+#define DLINFO_ARCH_ITEMS       5
+#define ARCH_DLINFO                                     \
+    do {                                                \
+        PowerPCCPU *cpu = POWERPC_CPU(thread_cpu);              \
+        /*                                              \
+         * Handle glibc compatibility: these magic entries must \
+         * be at the lowest addresses in the final auxv.        \
+         */                                             \
+        NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
+        NEW_AUX_ENT(AT_IGNOREPPC, AT_IGNOREPPC);        \
+        NEW_AUX_ENT(AT_DCACHEBSIZE, cpu->env.dcache_line_size); \
+        NEW_AUX_ENT(AT_ICACHEBSIZE, cpu->env.icache_line_size); \
+        NEW_AUX_ENT(AT_UCACHEBSIZE, 0);                 \
+    } while (0)
+
 #endif

From b38ec953747d8a56f1a6cf72cdecf9b243a55fae Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:26:37 -1000
Subject: [PATCH 0208/2396] linux-user: Move elf parameters to
 loongarch64/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c                | 12 ------------
 linux-user/loongarch64/target_elf.h |  6 ++++++
 2 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 526c90e2c1..a4005c44ef 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,18 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_LOONGARCH64
-
-#define ELF_CLASS   ELFCLASS64
-#define ELF_ARCH    EM_LOONGARCH
-#define EXSTACK_DEFAULT true
-
-#define elf_check_arch(x) ((x) == EM_LOONGARCH)
-
-#define VDSO_HEADER "vdso.c.inc"
-
-#endif /* TARGET_LOONGARCH64 */
-
 #ifdef TARGET_MIPS
 
 #ifdef TARGET_MIPS64
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 1f40419af2..47bf51a41c 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -8,6 +8,12 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS64
+#define ELF_ARCH                EM_LOONGARCH
+#define EXSTACK_DEFAULT         true
+#define elf_check_arch(x)       ((x) == EM_LOONGARCH)
+#define VDSO_HEADER             "vdso.c.inc"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1

From c33d6652970edcdc6d88e1e4316569f618086a9a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:30:44 -1000
Subject: [PATCH 0209/2396] linux-user: Move elf parameters to
 {mips,mips64}/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 18 ------------------
 linux-user/mips/target_elf.h   |  4 ++++
 linux-user/mips64/target_elf.h | 10 ++++++++++
 3 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a4005c44ef..a67147d43b 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,24 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_MIPS
-
-#ifdef TARGET_MIPS64
-#define ELF_CLASS   ELFCLASS64
-#else
-#define ELF_CLASS   ELFCLASS32
-#endif
-#define ELF_ARCH    EM_MIPS
-#define EXSTACK_DEFAULT true
-
-#ifdef TARGET_ABI_MIPSN32
-#define elf_check_abi(x) ((x) & EF_MIPS_ABI2)
-#else
-#define elf_check_abi(x) (!((x) & EF_MIPS_ABI2))
-#endif
-
-#endif /* TARGET_MIPS */
-
 #ifdef TARGET_MICROBLAZE
 
 #define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index a4b7fadbd6..f400bc2fdb 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -10,6 +10,10 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_MIPS
+#define EXSTACK_DEFAULT         true
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
 #define HAVE_ELF_CORE_DUMP      1
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index 67bc963134..c455985a76 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -10,6 +10,16 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS64
+#define ELF_ARCH                EM_MIPS
+#define EXSTACK_DEFAULT         true
+
+#ifdef TARGET_ABI_MIPSN32
+#define elf_check_abi(x)        ((x) & EF_MIPS_ABI2)
+#else
+#define elf_check_abi(x)        (!((x) & EF_MIPS_ABI2))
+#endif
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_BASE_PLATFORM  1
 #define HAVE_ELF_CORE_DUMP      1

From db325955c715c4e4237b370cb65c03ca3414e60d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:38:04 -1000
Subject: [PATCH 0210/2396] linux-user: Move elf parameters to
 microblaze/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c               | 9 ---------
 linux-user/microblaze/target_elf.h | 5 +++++
 2 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a67147d43b..6c8771d804 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,15 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_MICROBLAZE
-
-#define elf_check_arch(x) ( (x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
-
-#define ELF_CLASS   ELFCLASS32
-#define ELF_ARCH    EM_MICROBLAZE
-
-#endif /* TARGET_MICROBLAZE */
-
 #ifdef TARGET_OPENRISC
 
 #define ELF_ARCH EM_OPENRISC
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index 56de77d4f3..a622cd8e43 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -10,6 +10,11 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_MICROBLAZE
+
+#define elf_check_arch(x)   ((x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
+
 #define HAVE_ELF_CORE_DUMP      1
 
 /*

From b333696601c72d1bffc8a608c25791113875571b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:40:21 -1000
Subject: [PATCH 0211/2396] linux-user: Move elf parameters to
 openrisc/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c             | 7 -------
 linux-user/openrisc/target_elf.h | 3 +++
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 6c8771d804..d0993621c1 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_OPENRISC
-
-#define ELF_ARCH EM_OPENRISC
-#define ELF_CLASS ELFCLASS32
-
-#endif /* TARGET_OPENRISC */
-
 #ifdef TARGET_SH4
 
 #define ELF_CLASS ELFCLASS32
diff --git a/linux-user/openrisc/target_elf.h b/linux-user/openrisc/target_elf.h
index ad80e4b41a..ed9739380f 100644
--- a/linux-user/openrisc/target_elf.h
+++ b/linux-user/openrisc/target_elf.h
@@ -10,6 +10,9 @@
 
 #include "target_ptrace.h"
 
+#define ELF_ARCH                EM_OPENRISC
+#define ELF_CLASS               ELFCLASS32
+
 #define HAVE_ELF_CORE_DUMP      1
 
 /*

From ac2a6820bf1785c7ff28bb00a1b3e66765d82d3b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:42:01 -1000
Subject: [PATCH 0212/2396] linux-user: Move elf parameters to sh4/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c        | 7 -------
 linux-user/sh4/target_elf.h | 3 +++
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index d0993621c1..1a6e81394c 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_SH4
-
-#define ELF_CLASS ELFCLASS32
-#define ELF_ARCH  EM_SH
-
-#endif
-
 #ifdef TARGET_M68K
 
 #define ELF_CLASS       ELFCLASS32
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index fd3ae68a01..61aea237c4 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -10,6 +10,9 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_SH
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_CORE_DUMP      1
 

From 4cbf380111b7f013bcfe6bff9c4f73f00ffdefc6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:43:03 -1000
Subject: [PATCH 0213/2396] linux-user: Move elf parameters to
 m68k/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 7 -------
 linux-user/m68k/target_elf.h | 3 +++
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1a6e81394c..a3757c595e 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_M68K
-
-#define ELF_CLASS       ELFCLASS32
-#define ELF_ARCH        EM_68K
-
-#endif
-
 #ifdef TARGET_ALPHA
 
 #define ELF_CLASS      ELFCLASS64
diff --git a/linux-user/m68k/target_elf.h b/linux-user/m68k/target_elf.h
index 0737412cee..073c85becc 100644
--- a/linux-user/m68k/target_elf.h
+++ b/linux-user/m68k/target_elf.h
@@ -8,6 +8,9 @@
 #ifndef M68K_TARGET_ELF_H
 #define M68K_TARGET_ELF_H
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_68K
+
 #define HAVE_ELF_CORE_DUMP      1
 
 /*

From 39955adeb2928fb41757421fb2b1b91b18bfc8de Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:53:00 -1000
Subject: [PATCH 0214/2396] linux-user: Move elf parameters to
 alpha/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/alpha/target_elf.h | 3 +++
 linux-user/elfload.c          | 7 -------
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/alpha/target_elf.h b/linux-user/alpha/target_elf.h
index 52b68680ad..f9d6372c9f 100644
--- a/linux-user/alpha/target_elf.h
+++ b/linux-user/alpha/target_elf.h
@@ -8,4 +8,7 @@
 #ifndef ALPHA_TARGET_ELF_H
 #define ALPHA_TARGET_ELF_H
 
+#define ELF_CLASS               ELFCLASS64
+#define ELF_ARCH                EM_ALPHA
+
 #endif
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index a3757c595e..aff800baff 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_ALPHA
-
-#define ELF_CLASS      ELFCLASS64
-#define ELF_ARCH       EM_ALPHA
-
-#endif /* TARGET_ALPHA */
-
 #ifdef TARGET_S390X
 
 #define ELF_CLASS	ELFCLASS64

From 2fed144511457a2bc83f8731b8af4dc4b476bba4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 10:55:36 -1000
Subject: [PATCH 0215/2396] linux-user: Move elf parameters to
 s390x/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 9 ---------
 linux-user/s390x/target_elf.h | 4 ++++
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index aff800baff..705d726922 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,15 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_S390X
-
-#define ELF_CLASS	ELFCLASS64
-#define ELF_ARCH	EM_S390
-
-#define VDSO_HEADER "vdso.c.inc"
-
-#endif /* TARGET_S390X */
-
 #ifdef TARGET_RISCV
 
 #define ELF_ARCH  EM_RISCV
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index 670c7b3eed..b23e46ab46 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -10,6 +10,10 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS64
+#define ELF_ARCH                EM_S390
+#define VDSO_HEADER             "vdso.c.inc"
+
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_CORE_DUMP      1
 

From 4a56d73ae20aa893ce4f3f7d691310f9d503e7b9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:03:31 -1000
Subject: [PATCH 0216/2396] linux-user: Move elf parameters to
 riscv/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c          | 14 --------------
 linux-user/riscv/target_elf.h | 10 ++++++++++
 2 files changed, 10 insertions(+), 14 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 705d726922..6e476d5308 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,20 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_RISCV
-
-#define ELF_ARCH  EM_RISCV
-
-#ifdef TARGET_RISCV32
-#define ELF_CLASS ELFCLASS32
-#define VDSO_HEADER "vdso-32.c.inc"
-#else
-#define ELF_CLASS ELFCLASS64
-#define VDSO_HEADER "vdso-64.c.inc"
-#endif
-
-#endif /* TARGET_RISCV */
-
 #ifdef TARGET_HPPA
 
 #define ELF_CLASS       ELFCLASS32
diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h
index 48d9af557b..51b8def1d1 100644
--- a/linux-user/riscv/target_elf.h
+++ b/linux-user/riscv/target_elf.h
@@ -8,6 +8,16 @@
 #ifndef RISCV_TARGET_ELF_H
 #define RISCV_TARGET_ELF_H
 
+#define ELF_ARCH                EM_RISCV
+
+#ifdef TARGET_RISCV32
+#define ELF_CLASS               ELFCLASS32
+#define VDSO_HEADER             "vdso-32.c.inc"
+#else
+#define ELF_CLASS               ELFCLASS64
+#define VDSO_HEADER             "vdso-64.c.inc"
+#endif
+
 #define HAVE_ELF_HWCAP          1
 
 #endif

From 964bc6c1b251e46b6d635ccbd69990227f8891df Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:11:36 -1000
Subject: [PATCH 0217/2396] linux-user: Move elf parameters to
 hppa/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c         | 11 -----------
 linux-user/hppa/target_elf.h |  6 ++++++
 2 files changed, 6 insertions(+), 11 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 6e476d5308..6732011332 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,17 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_HPPA
-
-#define ELF_CLASS       ELFCLASS32
-#define ELF_ARCH        EM_PARISC
-#define STACK_GROWS_DOWN 0
-#define STACK_ALIGNMENT  64
-
-#define VDSO_HEADER "vdso.c.inc"
-
-#endif /* TARGET_HPPA */
-
 #ifdef TARGET_XTENSA
 
 #define ELF_CLASS       ELFCLASS32
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index b654758afa..9b6363a0a7 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -8,8 +8,14 @@
 #ifndef HPPA_TARGET_ELF_H
 #define HPPA_TARGET_ELF_H
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_PARISC
+
 #define HAVE_ELF_PLATFORM       1
 
 #define LO_COMMPAGE             0
+#define STACK_GROWS_DOWN        0
+#define STACK_ALIGNMENT         64
+#define VDSO_HEADER             "vdso.c.inc"
 
 #endif

From 60502ab782496c160223a7892197abaad1670187 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:13:03 -1000
Subject: [PATCH 0218/2396] linux-user: Move elf parameters to
 xtensa/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 7 -------
 linux-user/xtensa/target_elf.h | 3 +++
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 6732011332..804a819471 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_XTENSA
-
-#define ELF_CLASS       ELFCLASS32
-#define ELF_ARCH        EM_XTENSA
-
-#endif /* TARGET_XTENSA */
-
 #ifdef TARGET_HEXAGON
 
 #define ELF_CLASS       ELFCLASS32
diff --git a/linux-user/xtensa/target_elf.h b/linux-user/xtensa/target_elf.h
index 850a7206a5..0689e79be5 100644
--- a/linux-user/xtensa/target_elf.h
+++ b/linux-user/xtensa/target_elf.h
@@ -10,6 +10,9 @@
 
 #include "target_ptrace.h"
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_XTENSA
+
 #define HAVE_ELF_CORE_DUMP      1
 
 /*

From 14095cb5f84c0a18707e86ed7f064e2fed3bf87a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:14:14 -1000
Subject: [PATCH 0219/2396] linux-user: Move elf parameters to
 hexagon/target_elf.h

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c            | 7 -------
 linux-user/hexagon/target_elf.h | 3 +++
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 804a819471..33c4214c95 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,13 +130,6 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifdef TARGET_HEXAGON
-
-#define ELF_CLASS       ELFCLASS32
-#define ELF_ARCH        EM_HEXAGON
-
-#endif /* TARGET_HEXAGON */
-
 #ifndef ELF_MACHINE
 #define ELF_MACHINE ELF_ARCH
 #endif
diff --git a/linux-user/hexagon/target_elf.h b/linux-user/hexagon/target_elf.h
index eccf207f6b..a9f6d77fc6 100644
--- a/linux-user/hexagon/target_elf.h
+++ b/linux-user/hexagon/target_elf.h
@@ -18,4 +18,7 @@
 #ifndef HEXAGON_TARGET_ELF_H
 #define HEXAGON_TARGET_ELF_H
 
+#define ELF_CLASS               ELFCLASS32
+#define ELF_ARCH                EM_HEXAGON
+
 #endif

From e6b7635c9a33918c671e1f2ef4b17b5c2f279d66 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:23:31 -1000
Subject: [PATCH 0220/2396] linux-user: Standardize on ELF_MACHINE not ELF_ARCH

PowerPC was the one outlier that defined both ELF_ARCH and
ELF_MACHINE; ELF_ARCH was defined incorrectly, necessitating
the definition of elf_check_arch.

However, the elf file header field in question is called
e_machine, so ELF_MACHINE is in fact the better name.

Mechanically change most target/target_elf.h files,
then adjust ppc/target_elf.h manually.

Do not provide a default for ELF_MACHINE.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/target_elf.h     | 2 +-
 linux-user/alpha/target_elf.h       | 2 +-
 linux-user/arm/target_elf.h         | 2 +-
 linux-user/elfload.c                | 6 +-----
 linux-user/hexagon/target_elf.h     | 2 +-
 linux-user/hppa/target_elf.h        | 2 +-
 linux-user/i386/target_elf.h        | 2 +-
 linux-user/loongarch64/target_elf.h | 2 +-
 linux-user/m68k/target_elf.h        | 2 +-
 linux-user/microblaze/target_elf.h  | 2 +-
 linux-user/mips/target_elf.h        | 2 +-
 linux-user/mips64/target_elf.h      | 2 +-
 linux-user/openrisc/target_elf.h    | 2 +-
 linux-user/ppc/target_elf.h         | 2 --
 linux-user/riscv/target_elf.h       | 2 +-
 linux-user/s390x/target_elf.h       | 2 +-
 linux-user/sh4/target_elf.h         | 2 +-
 linux-user/sparc/target_elf.h       | 4 ++--
 linux-user/x86_64/target_elf.h      | 2 +-
 linux-user/xtensa/target_elf.h      | 2 +-
 20 files changed, 20 insertions(+), 26 deletions(-)

diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index 3c9fef9378..9ec51f6237 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -10,7 +10,7 @@
 
 #include "target_ptrace.h"
 
-#define ELF_ARCH                EM_AARCH64
+#define ELF_MACHINE             EM_AARCH64
 #define ELF_CLASS               ELFCLASS64
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/alpha/target_elf.h b/linux-user/alpha/target_elf.h
index f9d6372c9f..864dc6e2e6 100644
--- a/linux-user/alpha/target_elf.h
+++ b/linux-user/alpha/target_elf.h
@@ -9,6 +9,6 @@
 #define ALPHA_TARGET_ELF_H
 
 #define ELF_CLASS               ELFCLASS64
-#define ELF_ARCH                EM_ALPHA
+#define ELF_MACHINE             EM_ALPHA
 
 #endif
diff --git a/linux-user/arm/target_elf.h b/linux-user/arm/target_elf.h
index d871d6d665..12cdc8e5a7 100644
--- a/linux-user/arm/target_elf.h
+++ b/linux-user/arm/target_elf.h
@@ -10,7 +10,7 @@
 
 #include "target_ptrace.h"
 
-#define ELF_ARCH                EM_ARM
+#define ELF_MACHINE             EM_ARM
 #define ELF_CLASS               ELFCLASS32
 #define EXSTACK_DEFAULT         true
 
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 33c4214c95..c481759710 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,12 +130,8 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifndef ELF_MACHINE
-#define ELF_MACHINE ELF_ARCH
-#endif
-
 #ifndef elf_check_arch
-#define elf_check_arch(x) ((x) == ELF_ARCH)
+#define elf_check_arch(x) ((x) == ELF_MACHINE)
 #endif
 
 #ifndef elf_check_abi
diff --git a/linux-user/hexagon/target_elf.h b/linux-user/hexagon/target_elf.h
index a9f6d77fc6..f81ae3895a 100644
--- a/linux-user/hexagon/target_elf.h
+++ b/linux-user/hexagon/target_elf.h
@@ -19,6 +19,6 @@
 #define HEXAGON_TARGET_ELF_H
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_HEXAGON
+#define ELF_MACHINE             EM_HEXAGON
 
 #endif
diff --git a/linux-user/hppa/target_elf.h b/linux-user/hppa/target_elf.h
index 9b6363a0a7..76930c9369 100644
--- a/linux-user/hppa/target_elf.h
+++ b/linux-user/hppa/target_elf.h
@@ -9,7 +9,7 @@
 #define HPPA_TARGET_ELF_H
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_PARISC
+#define ELF_MACHINE             EM_PARISC
 
 #define HAVE_ELF_PLATFORM       1
 
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index dc58c0017a..c3caad68b9 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_386
+#define ELF_MACHINE             EM_386
 #define EXSTACK_DEFAULT         true
 #define VDSO_HEADER             "vdso.c.inc"
 
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index 47bf51a41c..b988592993 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -9,7 +9,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS64
-#define ELF_ARCH                EM_LOONGARCH
+#define ELF_MACHINE             EM_LOONGARCH
 #define EXSTACK_DEFAULT         true
 #define elf_check_arch(x)       ((x) == EM_LOONGARCH)
 #define VDSO_HEADER             "vdso.c.inc"
diff --git a/linux-user/m68k/target_elf.h b/linux-user/m68k/target_elf.h
index 073c85becc..b997fa0b6d 100644
--- a/linux-user/m68k/target_elf.h
+++ b/linux-user/m68k/target_elf.h
@@ -9,7 +9,7 @@
 #define M68K_TARGET_ELF_H
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_68K
+#define ELF_MACHINE             EM_68K
 
 #define HAVE_ELF_CORE_DUMP      1
 
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index a622cd8e43..1ec91ea5a9 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_MICROBLAZE
+#define ELF_MACHINE             EM_MICROBLAZE
 
 #define elf_check_arch(x)   ((x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
 
diff --git a/linux-user/mips/target_elf.h b/linux-user/mips/target_elf.h
index f400bc2fdb..157306f7a0 100644
--- a/linux-user/mips/target_elf.h
+++ b/linux-user/mips/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_MIPS
+#define ELF_MACHINE             EM_MIPS
 #define EXSTACK_DEFAULT         true
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/mips64/target_elf.h b/linux-user/mips64/target_elf.h
index c455985a76..061471a0f1 100644
--- a/linux-user/mips64/target_elf.h
+++ b/linux-user/mips64/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS64
-#define ELF_ARCH                EM_MIPS
+#define ELF_MACHINE             EM_MIPS
 #define EXSTACK_DEFAULT         true
 
 #ifdef TARGET_ABI_MIPSN32
diff --git a/linux-user/openrisc/target_elf.h b/linux-user/openrisc/target_elf.h
index ed9739380f..e8554f5339 100644
--- a/linux-user/openrisc/target_elf.h
+++ b/linux-user/openrisc/target_elf.h
@@ -10,7 +10,7 @@
 
 #include "target_ptrace.h"
 
-#define ELF_ARCH                EM_OPENRISC
+#define ELF_MACHINE             EM_OPENRISC
 #define ELF_CLASS               ELFCLASS32
 
 #define HAVE_ELF_CORE_DUMP      1
diff --git a/linux-user/ppc/target_elf.h b/linux-user/ppc/target_elf.h
index 9a47f18fb8..22854cf52f 100644
--- a/linux-user/ppc/target_elf.h
+++ b/linux-user/ppc/target_elf.h
@@ -13,13 +13,11 @@
 #define ELF_MACHINE             PPC_ELF_MACHINE
 
 #ifdef TARGET_PPC64
-# define elf_check_arch(x)      ((x) == EM_PPC64)
 # define ELF_CLASS              ELFCLASS64
 #else
 # define ELF_CLASS              ELFCLASS32
 # define EXSTACK_DEFAULT        true
 #endif
-#define ELF_ARCH                EM_PPC
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_HWCAP2         1
diff --git a/linux-user/riscv/target_elf.h b/linux-user/riscv/target_elf.h
index 51b8def1d1..dbbfdf54d3 100644
--- a/linux-user/riscv/target_elf.h
+++ b/linux-user/riscv/target_elf.h
@@ -8,7 +8,7 @@
 #ifndef RISCV_TARGET_ELF_H
 #define RISCV_TARGET_ELF_H
 
-#define ELF_ARCH                EM_RISCV
+#define ELF_MACHINE             EM_RISCV
 
 #ifdef TARGET_RISCV32
 #define ELF_CLASS               ELFCLASS32
diff --git a/linux-user/s390x/target_elf.h b/linux-user/s390x/target_elf.h
index b23e46ab46..ef5edbd860 100644
--- a/linux-user/s390x/target_elf.h
+++ b/linux-user/s390x/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS64
-#define ELF_ARCH                EM_S390
+#define ELF_MACHINE             EM_S390
 #define VDSO_HEADER             "vdso.c.inc"
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/sh4/target_elf.h b/linux-user/sh4/target_elf.h
index 61aea237c4..d9e253d425 100644
--- a/linux-user/sh4/target_elf.h
+++ b/linux-user/sh4/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_SH
+#define ELF_MACHINE             EM_SH
 
 #define HAVE_ELF_HWCAP          1
 #define HAVE_ELF_CORE_DUMP      1
diff --git a/linux-user/sparc/target_elf.h b/linux-user/sparc/target_elf.h
index f89c708c46..6b0cac3caf 100644
--- a/linux-user/sparc/target_elf.h
+++ b/linux-user/sparc/target_elf.h
@@ -10,13 +10,13 @@
 
 #ifndef TARGET_SPARC64
 # define ELF_CLASS              ELFCLASS32
-# define ELF_ARCH               EM_SPARC
+# define ELF_MACHINE            EM_SPARC
 #elif defined(TARGET_ABI32)
 # define ELF_CLASS              ELFCLASS32
 # define elf_check_arch(x)      ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
 #else
 # define ELF_CLASS              ELFCLASS64
-# define ELF_ARCH               EM_SPARCV9
+# define ELF_MACHINE            EM_SPARCV9
 #endif
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/x86_64/target_elf.h b/linux-user/x86_64/target_elf.h
index f3c09bb8da..840bddf5ec 100644
--- a/linux-user/x86_64/target_elf.h
+++ b/linux-user/x86_64/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS64
-#define ELF_ARCH                EM_X86_64
+#define ELF_MACHINE             EM_X86_64
 #define VDSO_HEADER             "vdso.c.inc"
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/xtensa/target_elf.h b/linux-user/xtensa/target_elf.h
index 0689e79be5..1bf8f2a14a 100644
--- a/linux-user/xtensa/target_elf.h
+++ b/linux-user/xtensa/target_elf.h
@@ -11,7 +11,7 @@
 #include "target_ptrace.h"
 
 #define ELF_CLASS               ELFCLASS32
-#define ELF_ARCH                EM_XTENSA
+#define ELF_MACHINE             EM_XTENSA
 
 #define HAVE_ELF_CORE_DUMP      1
 

From eb727cc45a352ff259c4c2d85456f0412e738d43 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:26:43 -1000
Subject: [PATCH 0221/2396] linux-user: Rename elf_check_arch

Rename to elf_check_machine to match ELF_MACHINE.
Remove the unnecessary definition for loongarch64.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c                | 6 +++---
 linux-user/i386/target_elf.h        | 2 +-
 linux-user/loongarch64/target_elf.h | 1 -
 linux-user/microblaze/target_elf.h  | 2 +-
 linux-user/sparc/target_elf.h       | 2 +-
 5 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index c481759710..aa0eed6dea 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -130,8 +130,8 @@ typedef abi_uint        target_gid_t;
 #endif
 typedef abi_int         target_pid_t;
 
-#ifndef elf_check_arch
-#define elf_check_arch(x) ((x) == ELF_MACHINE)
+#ifndef elf_check_machine
+#define elf_check_machine(x) ((x) == ELF_MACHINE)
 #endif
 
 #ifndef elf_check_abi
@@ -346,7 +346,7 @@ static bool elf_check_ident(struct elfhdr *ehdr)
    This has to wait until after bswapping the header.  */
 static bool elf_check_ehdr(struct elfhdr *ehdr)
 {
-    return (elf_check_arch(ehdr->e_machine)
+    return (elf_check_machine(ehdr->e_machine)
             && elf_check_abi(ehdr->e_flags)
             && ehdr->e_ehsize == sizeof(struct elfhdr)
             && ehdr->e_phentsize == sizeof(struct elf_phdr)
diff --git a/linux-user/i386/target_elf.h b/linux-user/i386/target_elf.h
index c3caad68b9..eafac8f382 100644
--- a/linux-user/i386/target_elf.h
+++ b/linux-user/i386/target_elf.h
@@ -30,7 +30,7 @@ typedef struct target_elf_gregset_t {
 /*
  * This is used to ensure we don't load something for the wrong architecture.
  */
-#define elf_check_arch(x)       ((x) == EM_386 || (x) == EM_486)
+#define elf_check_machine(x)    ((x) == EM_386 || (x) == EM_486)
 
 /*
  * i386 is the only target which supplies AT_SYSINFO for the vdso.
diff --git a/linux-user/loongarch64/target_elf.h b/linux-user/loongarch64/target_elf.h
index b988592993..3aa8c83958 100644
--- a/linux-user/loongarch64/target_elf.h
+++ b/linux-user/loongarch64/target_elf.h
@@ -11,7 +11,6 @@
 #define ELF_CLASS               ELFCLASS64
 #define ELF_MACHINE             EM_LOONGARCH
 #define EXSTACK_DEFAULT         true
-#define elf_check_arch(x)       ((x) == EM_LOONGARCH)
 #define VDSO_HEADER             "vdso.c.inc"
 
 #define HAVE_ELF_HWCAP          1
diff --git a/linux-user/microblaze/target_elf.h b/linux-user/microblaze/target_elf.h
index 1ec91ea5a9..7b3ef70d23 100644
--- a/linux-user/microblaze/target_elf.h
+++ b/linux-user/microblaze/target_elf.h
@@ -13,7 +13,7 @@
 #define ELF_CLASS               ELFCLASS32
 #define ELF_MACHINE             EM_MICROBLAZE
 
-#define elf_check_arch(x)   ((x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
+#define elf_check_machine(x) ((x) == EM_MICROBLAZE || (x) == EM_MICROBLAZE_OLD)
 
 #define HAVE_ELF_CORE_DUMP      1
 
diff --git a/linux-user/sparc/target_elf.h b/linux-user/sparc/target_elf.h
index 6b0cac3caf..7827767bcb 100644
--- a/linux-user/sparc/target_elf.h
+++ b/linux-user/sparc/target_elf.h
@@ -13,7 +13,7 @@
 # define ELF_MACHINE            EM_SPARC
 #elif defined(TARGET_ABI32)
 # define ELF_CLASS              ELFCLASS32
-# define elf_check_arch(x)      ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
+# define elf_check_machine(x)   ((x) == EM_SPARC32PLUS || (x) == EM_SPARC)
 #else
 # define ELF_CLASS              ELFCLASS64
 # define ELF_MACHINE            EM_SPARCV9

From 5dcc0b62059e2330f2746fa691ac6791e9a14cc3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:30:26 -1000
Subject: [PATCH 0222/2396] linux-user: Remove ELIBBAD from elfload.c

The last use of this fallback was removed in 8e62a71738bc.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index aa0eed6dea..c0326928d4 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -110,11 +110,6 @@ int info_is_fdpic(struct image_info *info)
 #define MAP_DENYWRITE 0
 #endif
 
-/* should probably go in elf.h */
-#ifndef ELIBBAD
-#define ELIBBAD 80
-#endif
-
 #if TARGET_BIG_ENDIAN
 #define ELF_DATA        ELFDATA2MSB
 #else

From dd1d0239a79c4e7947c901fcb1f232ecc0428a96 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:33:58 -1000
Subject: [PATCH 0223/2396] linux-user: Remove MAP_DENYWRITE from elfload.c

The last use of this fallback was removed in bf858897b769.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index c0326928d4..8b92fba0f0 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -105,11 +105,6 @@ int info_is_fdpic(struct image_info *info)
     return info->personality == PER_LINUX_FDPIC;
 }
 
-/* this flag is uneffective under linux too, should be deleted */
-#ifndef MAP_DENYWRITE
-#define MAP_DENYWRITE 0
-#endif
-
 #if TARGET_BIG_ENDIAN
 #define ELF_DATA        ELFDATA2MSB
 #else

From 8218eb6f52abd08c9e89baafdddec6f0d9234768 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:43:27 -1000
Subject: [PATCH 0224/2396] linux-user: Move arch_parse_elf_property to
 aarch64/elfload.c

Rename the controlling macro to HAVE_ELF_GNU_PROPERTY to
match the other HAVE_* macros.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/elfload.c    | 18 +++++++++++++++
 linux-user/aarch64/target_elf.h |  1 +
 linux-user/elfload.c            | 39 +++++++--------------------------
 linux-user/loader.h             |  5 +++++
 4 files changed, 32 insertions(+), 31 deletions(-)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 07a0c3f844..8076968251 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -1,10 +1,12 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu.h"
 #include "loader.h"
 #include "target/arm/cpu-features.h"
 #include "target_elf.h"
+#include "elf.h"
 
 
 const char *get_elf_cpu_model(uint32_t eflags)
@@ -349,6 +351,22 @@ const char *get_elf_platform(CPUState *cs)
     return TARGET_BIG_ENDIAN ? "aarch64_be" : "aarch64";
 }
 
+bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
+                             const uint32_t *data,
+                             struct image_info *info,
+                             Error **errp)
+{
+    if (pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
+        if (pr_datasz != sizeof(uint32_t)) {
+            error_setg(errp, "Ill-formed GNU_PROPERTY_AARCH64_FEATURE_1_AND");
+            return false;
+        }
+        /* We will extract GNU_PROPERTY_AARCH64_FEATURE_1_BTI later. */
+        info->note_flags = *data;
+    }
+    return true;
+}
+
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUARMState *env)
 {
     for (int i = 0; i < 31; i++) {
diff --git a/linux-user/aarch64/target_elf.h b/linux-user/aarch64/target_elf.h
index 9ec51f6237..4cdeb64b0d 100644
--- a/linux-user/aarch64/target_elf.h
+++ b/linux-user/aarch64/target_elf.h
@@ -17,6 +17,7 @@
 #define HAVE_ELF_HWCAP2         1
 #define HAVE_ELF_PLATFORM       1
 #define HAVE_ELF_CORE_DUMP      1
+#define HAVE_ELF_GNU_PROPERTY   1
 
 /*
  * See linux kernel: arch/arm64/include/asm/elf.h, where
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 8b92fba0f0..12d4873212 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -166,41 +166,18 @@ const char *get_elf_platform(CPUState *cs) { return NULL; }
 const char *get_elf_base_platform(CPUState *cs) { return NULL; }
 #endif
 
-#include "elf.h"
-
-/* We must delay the following stanzas until after "elf.h". */
-#if defined(TARGET_AARCH64)
-
-static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
-                                    const uint32_t *data,
-                                    struct image_info *info,
-                                    Error **errp)
-{
-    if (pr_type == GNU_PROPERTY_AARCH64_FEATURE_1_AND) {
-        if (pr_datasz != sizeof(uint32_t)) {
-            error_setg(errp, "Ill-formed GNU_PROPERTY_AARCH64_FEATURE_1_AND");
-            return false;
-        }
-        /* We will extract GNU_PROPERTY_AARCH64_FEATURE_1_BTI later. */
-        info->note_flags = *data;
-    }
-    return true;
-}
-#define ARCH_USE_GNU_PROPERTY 1
-
-#else
-
-static bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
-                                    const uint32_t *data,
-                                    struct image_info *info,
-                                    Error **errp)
+#ifndef HAVE_ELF_GNU_PROPERTY
+bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
+                             const uint32_t *data, struct image_info *info,
+                             Error **errp)
 {
     g_assert_not_reached();
 }
-#define ARCH_USE_GNU_PROPERTY 0
-
+#define HAVE_ELF_GNU_PROPERTY 0
 #endif
 
+#include "elf.h"
+
 struct exec
 {
     unsigned int a_info;   /* Use macros N_MAGIC, etc for access */
@@ -1233,7 +1210,7 @@ static bool parse_elf_properties(const ImageSource *src,
     uint32_t prev_type;
 
     /* Unless the arch requires properties, ignore them. */
-    if (!ARCH_USE_GNU_PROPERTY) {
+    if (!HAVE_ELF_GNU_PROPERTY) {
         return true;
     }
 
diff --git a/linux-user/loader.h b/linux-user/loader.h
index 2175dd4e0a..e42b8fa1e3 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -122,4 +122,9 @@ typedef struct {
 /* Note that both Elf32_Word and Elf64_Word are uint32_t. */
 const VdsoImageInfo *get_vdso_image_info(uint32_t elf_flags);
 
+bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
+                             const uint32_t *data,
+                             struct image_info *info,
+                             Error **errp);
+
 #endif /* LINUX_USER_LOADER_H */

From ab2d261ab3e73f622d75c5c6cc06cc0b7db2d79a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 29 Jul 2025 11:45:13 -1000
Subject: [PATCH 0225/2396] linux-user: Remove a.out declarations from
 elfload.c

These should have been removed with the rest of the stub a.out
support in b9329d4b5321, though they were not in use even then.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 12d4873212..26c090c95d 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -178,25 +178,6 @@ bool arch_parse_elf_property(uint32_t pr_type, uint32_t pr_datasz,
 
 #include "elf.h"
 
-struct exec
-{
-    unsigned int a_info;   /* Use macros N_MAGIC, etc for access */
-    unsigned int a_text;   /* length of text, in bytes */
-    unsigned int a_data;   /* length of data, in bytes */
-    unsigned int a_bss;    /* length of uninitialized data area, in bytes */
-    unsigned int a_syms;   /* length of symbol table data in file, in bytes */
-    unsigned int a_entry;  /* start address */
-    unsigned int a_trsize; /* length of relocation info for text, in bytes */
-    unsigned int a_drsize; /* length of relocation info for data, in bytes */
-};
-
-
-#define N_MAGIC(exec) ((exec).a_info & 0xffff)
-#define OMAGIC 0407
-#define NMAGIC 0410
-#define ZMAGIC 0413
-#define QMAGIC 0314
-
 #define DLINFO_ITEMS 16
 
 static inline void memcpy_fromfs(void * to, const void * from, unsigned long n)

From 8bb7873f28e82944ab6fb2c633c09877fd4eeda8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:51:46 +1000
Subject: [PATCH 0226/2396] linux-user/sparc: Create target_ptrace.h

Move target_pt_regs to target_ptrace.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/sparc/signal.c         |  2 ++
 linux-user/sparc/target_ptrace.h  | 24 ++++++++++++++++++++++++
 linux-user/sparc/target_syscall.h | 19 -------------------
 3 files changed, 26 insertions(+), 19 deletions(-)
 create mode 100644 linux-user/sparc/target_ptrace.h

diff --git a/linux-user/sparc/signal.c b/linux-user/sparc/signal.c
index 8181b8b92c..d339f89928 100644
--- a/linux-user/sparc/signal.c
+++ b/linux-user/sparc/signal.c
@@ -21,6 +21,8 @@
 #include "user-internals.h"
 #include "signal-common.h"
 #include "linux-user/trace.h"
+#include "target_ptrace.h"
+
 
 /* A Sparc register window */
 struct target_reg_window {
diff --git a/linux-user/sparc/target_ptrace.h b/linux-user/sparc/target_ptrace.h
new file mode 100644
index 0000000000..a4d5416c1f
--- /dev/null
+++ b/linux-user/sparc/target_ptrace.h
@@ -0,0 +1,24 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef SPARC_TARGET_PTRACE_H
+#define SPARC_TARGET_PTRACE_H
+
+/* See arch/sparc/include/uapi/asm/ptrace.h. */
+struct target_pt_regs {
+#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
+    abi_ulong u_regs[16];
+    abi_ulong tstate;
+    abi_ulong pc;
+    abi_ulong npc;
+    uint32_t y;
+    uint32_t magic;
+#else
+    abi_ulong psr;
+    abi_ulong pc;
+    abi_ulong npc;
+    abi_ulong y;
+    abi_ulong u_regs[16];
+#endif
+};
+
+#endif /* SPARC_TARGET_PTRACE_H */
diff --git a/linux-user/sparc/target_syscall.h b/linux-user/sparc/target_syscall.h
index e421165357..a90ed2983a 100644
--- a/linux-user/sparc/target_syscall.h
+++ b/linux-user/sparc/target_syscall.h
@@ -1,25 +1,6 @@
 #ifndef SPARC_TARGET_SYSCALL_H
 #define SPARC_TARGET_SYSCALL_H
 
-#if defined(TARGET_SPARC64) && !defined(TARGET_ABI32)
-struct target_pt_regs {
-    abi_ulong u_regs[16];
-    abi_ulong tstate;
-    abi_ulong pc;
-    abi_ulong npc;
-    uint32_t y;
-    uint32_t magic;
-};
-#else
-struct target_pt_regs {
-    abi_ulong psr;
-    abi_ulong pc;
-    abi_ulong npc;
-    abi_ulong y;
-    abi_ulong u_regs[16];
-};
-#endif
-
 #ifdef TARGET_SPARC64
 # define UNAME_MACHINE "sparc64"
 #else

From 3f1b9dbdf5452a2baab00d46bd149f6f8192fe44 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 28 Aug 2025 21:55:01 +1000
Subject: [PATCH 0227/2396] linux-user: Remove target_pt_regs from
 target_syscall.h

All target_pt_regs which have not been broken out to
target_ptrace.h by this point are unused.  Remove them.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/alpha/target_syscall.h   | 40 -----------------------------
 linux-user/hexagon/target_syscall.h |  5 ----
 linux-user/hppa/target_syscall.h    | 18 -------------
 linux-user/m68k/target_syscall.h    | 16 ------------
 linux-user/riscv/target_syscall.h   | 35 -------------------------
 5 files changed, 114 deletions(-)

diff --git a/linux-user/alpha/target_syscall.h b/linux-user/alpha/target_syscall.h
index fda3a49f29..53706b749f 100644
--- a/linux-user/alpha/target_syscall.h
+++ b/linux-user/alpha/target_syscall.h
@@ -1,46 +1,6 @@
 #ifndef ALPHA_TARGET_SYSCALL_H
 #define ALPHA_TARGET_SYSCALL_H
 
-/* default linux values for the selectors */
-#define __USER_DS	(1)
-
-struct target_pt_regs {
-	abi_ulong r0;
-	abi_ulong r1;
-	abi_ulong r2;
-	abi_ulong r3;
-	abi_ulong r4;
-	abi_ulong r5;
-	abi_ulong r6;
-	abi_ulong r7;
-	abi_ulong r8;
-	abi_ulong r19;
-	abi_ulong r20;
-	abi_ulong r21;
-	abi_ulong r22;
-	abi_ulong r23;
-	abi_ulong r24;
-	abi_ulong r25;
-	abi_ulong r26;
-	abi_ulong r27;
-	abi_ulong r28;
-	abi_ulong hae;
-/* JRP - These are the values provided to a0-a2 by PALcode */
-	abi_ulong trap_a0;
-	abi_ulong trap_a1;
-	abi_ulong trap_a2;
-/* These are saved by PAL-code: */
-	abi_ulong ps;
-	abi_ulong pc;
-	abi_ulong gp;
-	abi_ulong r16;
-	abi_ulong r17;
-	abi_ulong r18;
-/* Those is needed by qemu to temporary store the user stack pointer */
-        abi_ulong usp;
-        abi_ulong unique;
-};
-
 #define UNAME_MACHINE "alpha"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 
diff --git a/linux-user/hexagon/target_syscall.h b/linux-user/hexagon/target_syscall.h
index 7f91a4abc7..d9c94737a5 100644
--- a/linux-user/hexagon/target_syscall.h
+++ b/linux-user/hexagon/target_syscall.h
@@ -18,11 +18,6 @@
 #ifndef HEXAGON_TARGET_SYSCALL_H
 #define HEXAGON_TARGET_SYSCALL_H
 
-struct target_pt_regs {
-    abi_long sepc;
-    abi_long sp;
-};
-
 #define UNAME_MACHINE "hexagon"
 #define UNAME_MINIMUM_RELEASE "4.15.0"
 
diff --git a/linux-user/hppa/target_syscall.h b/linux-user/hppa/target_syscall.h
index 9a8f8ca628..4b21e85371 100644
--- a/linux-user/hppa/target_syscall.h
+++ b/linux-user/hppa/target_syscall.h
@@ -1,24 +1,6 @@
 #ifndef HPPA_TARGET_SYSCALL_H
 #define HPPA_TARGET_SYSCALL_H
 
-struct target_pt_regs {
-    target_ulong gr[32];
-    uint64_t     fr[32];
-    target_ulong sr[8];
-    target_ulong iasq[2];
-    target_ulong iaoq[2];
-    target_ulong cr27;
-    target_ulong __pad0;
-    target_ulong orig_r28;
-    target_ulong ksp;
-    target_ulong kpc;
-    target_ulong sar;
-    target_ulong iir;
-    target_ulong isr;
-    target_ulong ior;
-    target_ulong ipsw;
-};
-
 #define UNAME_MACHINE "parisc"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 #define TARGET_CLONE_BACKWARDS
diff --git a/linux-user/m68k/target_syscall.h b/linux-user/m68k/target_syscall.h
index 8d4ddbd76c..3ca0231c70 100644
--- a/linux-user/m68k/target_syscall.h
+++ b/linux-user/m68k/target_syscall.h
@@ -1,22 +1,6 @@
 #ifndef M68K_TARGET_SYSCALL_H
 #define M68K_TARGET_SYSCALL_H
 
-/* this struct defines the way the registers are stored on the
-   stack during a system call. */
-
-struct target_pt_regs {
-    abi_long d1, d2, d3, d4, d5, d6, d7;
-    abi_long a0, a1, a2, a3, a4, a5, a6;
-    abi_ulong d0;
-    abi_ulong usp;
-    abi_ulong orig_d0;
-    int16_t stkadj;
-    uint16_t sr;
-    abi_ulong pc;
-    uint16_t fntvex;
-    uint16_t __fill;
-};
-
 #define UNAME_MACHINE "m68k"
 #define UNAME_MINIMUM_RELEASE "2.6.32"
 
diff --git a/linux-user/riscv/target_syscall.h b/linux-user/riscv/target_syscall.h
index 7601f10c28..69a7b753eb 100644
--- a/linux-user/riscv/target_syscall.h
+++ b/linux-user/riscv/target_syscall.h
@@ -8,41 +8,6 @@
 #ifndef LINUX_USER_RISCV_TARGET_SYSCALL_H
 #define LINUX_USER_RISCV_TARGET_SYSCALL_H
 
-struct target_pt_regs {
-    abi_long sepc;
-    abi_long ra;
-    abi_long sp;
-    abi_long gp;
-    abi_long tp;
-    abi_long t0;
-    abi_long t1;
-    abi_long t2;
-    abi_long s0;
-    abi_long s1;
-    abi_long a0;
-    abi_long a1;
-    abi_long a2;
-    abi_long a3;
-    abi_long a4;
-    abi_long a5;
-    abi_long a6;
-    abi_long a7;
-    abi_long s2;
-    abi_long s3;
-    abi_long s4;
-    abi_long s5;
-    abi_long s6;
-    abi_long s7;
-    abi_long s8;
-    abi_long s9;
-    abi_long s10;
-    abi_long s11;
-    abi_long t3;
-    abi_long t4;
-    abi_long t5;
-    abi_long t6;
-};
-
 #ifdef TARGET_RISCV32
 #define UNAME_MACHINE "riscv32"
 #define UNAME_MINIMUM_RELEASE "5.4.0"

From a362960b29749750168601f3969ec9364082ee59 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 26 Aug 2025 11:21:27 +0100
Subject: [PATCH 0228/2396] target/arm: Clean up of register field definitions

Clean up the definitions of NSW and NSA fields in the VTCR register.
These two fields are already defined properly using FIELD() so they are
actually duplications. Also, define the NSW and NSA fields in the
VSTCR register using FIELD() and remove their definitions based on VTCR
fields.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20250725014755.2122579-1-gustavo.romero@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 8 +++-----
 target/arm/ptw.c       | 8 ++++----
 2 files changed, 7 insertions(+), 9 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 1b3d0244fd..3f86b07044 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -113,11 +113,6 @@ FIELD(DBGWCR, WT, 20, 1)
 FIELD(DBGWCR, MASK, 24, 5)
 FIELD(DBGWCR, SSCE, 29, 1)
 
-#define VTCR_NSW (1u << 29)
-#define VTCR_NSA (1u << 30)
-#define VSTCR_SW VTCR_NSW
-#define VSTCR_SA VTCR_NSA
-
 /* Bit definitions for CPACR (AArch32 only) */
 FIELD(CPACR, CP10, 20, 2)
 FIELD(CPACR, CP11, 22, 2)
@@ -220,6 +215,9 @@ FIELD(VTCR, NSA, 30, 1)
 FIELD(VTCR, DS, 32, 1)
 FIELD(VTCR, SL2, 33, 1)
 
+FIELD(VSTCR, SW, 29, 1)
+FIELD(VSTCR, SA, 30, 1)
+
 #define HCRX_ENAS0    (1ULL << 0)
 #define HCRX_ENALS    (1ULL << 1)
 #define HCRX_ENASR    (1ULL << 2)
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 561bf2678e..ed5c728eab 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -193,9 +193,9 @@ static ARMMMUIdx ptw_idx_for_stage_2(CPUARMState *env, ARMMMUIdx stage2idx)
         return ARMMMUIdx_Phys_Realm;
     case ARMSS_Secure:
         if (stage2idx == ARMMMUIdx_Stage2_S) {
-            s2walk_secure = !(env->cp15.vstcr_el2 & VSTCR_SW);
+            s2walk_secure = !(env->cp15.vstcr_el2 & R_VSTCR_SW_MASK);
         } else {
-            s2walk_secure = !(env->cp15.vtcr_el2 & VTCR_NSW);
+            s2walk_secure = !(env->cp15.vtcr_el2 & R_VTCR_NSW_MASK);
         }
         return s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
     default:
@@ -3372,9 +3372,9 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      */
     if (in_space == ARMSS_Secure) {
         result->f.attrs.secure =
-            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            !(env->cp15.vstcr_el2 & (R_VSTCR_SA_MASK | R_VSTCR_SW_MASK))
             && (ipa_secure
-                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+                || !(env->cp15.vtcr_el2 & (R_VTCR_NSA_MASK | R_VTCR_NSW_MASK)));
         result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
     }
 

From 2561626c25e05bc6f673b29f7dd46a20fa6719c3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Tue, 26 Aug 2025 11:21:27 +0100
Subject: [PATCH 0229/2396] tests/functional/test_aarch64_device_passthrough:
 update image

TF-A needs to be patched to enable support for FEAT_TCR2 and
FEAT_SCTLR2. This new image contains updated firmware.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250727074202.83141-2-richard.henderson@linaro.org
Message-ID: <20250719035838.2284029-2-pierrick.bouvier@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .../aarch64/test_device_passthrough.py        | 27 ++++++++++---------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/tests/functional/aarch64/test_device_passthrough.py b/tests/functional/aarch64/test_device_passthrough.py
index 1f3f158a9f..17437784bb 100755
--- a/tests/functional/aarch64/test_device_passthrough.py
+++ b/tests/functional/aarch64/test_device_passthrough.py
@@ -9,7 +9,7 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
+from os.path import join
 
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import exec_command, wait_for_console_pattern
@@ -77,15 +77,16 @@ echo device_passthrough_test_ok
 
 class Aarch64DevicePassthrough(QemuSystemTest):
 
-    # https://github.com/pbo-linaro/qemu-linux-stack
+    # https://github.com/pbo-linaro/qemu-linux-stack/tree/device_passthrough
+    # $ ./build.sh && ./archive_artifacts.sh out.tar.xz
     #
     # Linux kernel is compiled with defconfig +
     # IOMMUFD + VFIO_DEVICE_CDEV + ARM_SMMU_V3_IOMMUFD
     # https://docs.kernel.org/driver-api/vfio.html#vfio-device-cde
     ASSET_DEVICE_PASSTHROUGH_STACK = Asset(
-        ('https://fileserver.linaro.org/s/fx5DXxBYme8dw2G/'
-         'download/device_passthrough.tar.xz'),
-         '812750b664d61c2986f2b149939ae28cafbd60d53e9c7e4b16e97143845e196d')
+        ('https://github.com/pbo-linaro/qemu-linux-stack/'
+         'releases/download/build/device_passthrough-c3fb84a.tar.xz'),
+         '15ac2b02bed0c0ea8e3e007de0bcfdaf6fd51c1ba98213f841dc7d01d6f72f04')
 
     # This tests the device passthrough implementation, by booting a VM
     # supporting it with two nvme disks attached, and launching a nested VM
@@ -96,16 +97,16 @@ class Aarch64DevicePassthrough(QemuSystemTest):
 
         self.vm.set_console()
 
-        stack_path_tar_gz = self.ASSET_DEVICE_PASSTHROUGH_STACK.fetch()
-        self.archive_extract(stack_path_tar_gz, format="tar")
+        stack_path_tar = self.ASSET_DEVICE_PASSTHROUGH_STACK.fetch()
+        self.archive_extract(stack_path_tar, format="tar")
 
         stack = self.scratch_file('out')
-        kernel = os.path.join(stack, 'Image.gz')
-        rootfs_host = os.path.join(stack, 'host.ext4')
-        disk_vfio = os.path.join(stack, 'disk_vfio')
-        disk_iommufd = os.path.join(stack, 'disk_iommufd')
-        guest_cmd = os.path.join(stack, 'guest.sh')
-        nested_guest_cmd = os.path.join(stack, 'nested_guest.sh')
+        kernel = join(stack, 'Image.gz')
+        rootfs_host = join(stack, 'host.ext4')
+        disk_vfio = join(stack, 'disk_vfio')
+        disk_iommufd = join(stack, 'disk_iommufd')
+        guest_cmd = join(stack, 'guest.sh')
+        nested_guest_cmd = join(stack, 'nested_guest.sh')
         # we generate two random disks
         with open(disk_vfio, "wb") as d: d.write(randbytes(512))
         with open(disk_iommufd, "wb") as d: d.write(randbytes(1024))

From 84249d026bc3878c196ecd3e8558609ba9260eb6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Tue, 26 Aug 2025 11:21:27 +0100
Subject: [PATCH 0230/2396] tests/functional/test_aarch64_rme: update image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TF-A needs to be patched to enable support for FEAT_TCR2 and
FEAT_SCTLR2. This new image contains updated firmware.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250727074202.83141-3-richard.henderson@linaro.org
Message-ID: <20250719035838.2284029-3-pierrick.bouvier@linaro.org>
[PMM: switch to os.makedirs(..., exist_ok=True) to improve
 robustness when re-run after test was cancelled midway]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/aarch64/test_rme_sbsaref.py | 64 ++++++++-------
 tests/functional/aarch64/test_rme_virt.py    | 85 +++++++-------------
 2 files changed, 66 insertions(+), 83 deletions(-)

diff --git a/tests/functional/aarch64/test_rme_sbsaref.py b/tests/functional/aarch64/test_rme_sbsaref.py
index 100f1c7738..ca892e0a8c 100755
--- a/tests/functional/aarch64/test_rme_sbsaref.py
+++ b/tests/functional/aarch64/test_rme_sbsaref.py
@@ -10,21 +10,23 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import os
+from os.path import join
+import shutil
 
 from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
-from test_rme_virt import test_realms_guest
 
 
 class Aarch64RMESbsaRefMachine(QemuSystemTest):
 
-    # Stack is built with OP-TEE build environment from those instructions:
+    # Stack is inspired from:
     # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
-    # https://github.com/pbo-linaro/qemu-rme-stack
+    # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_sbsa_release
+    # ./build.sh && ./archive_artifacts.sh out.tar.xz
     ASSET_RME_STACK_SBSA = Asset(
-        ('https://fileserver.linaro.org/s/KJyeBxL82mz2r7F/'
-         'download/rme-stack-op-tee-4.2.0-cca-v4-sbsa.tar.gz'),
-         'dd9ab28ec869bdf3b5376116cb3689103b43433fd5c4bca0f4a8d8b3c104999e')
+        ('https://github.com/pbo-linaro/qemu-linux-stack/'
+         'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
+         '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
 
     # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
     # and launching a nested VM using it.
@@ -35,35 +37,41 @@ class Aarch64RMESbsaRefMachine(QemuSystemTest):
 
         self.vm.set_console()
 
-        stack_path_tar_gz = self.ASSET_RME_STACK_SBSA.fetch()
-        self.archive_extract(stack_path_tar_gz, format="tar")
+        stack_path_tar = self.ASSET_RME_STACK_SBSA.fetch()
+        self.archive_extract(stack_path_tar, format="tar")
 
-        rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-sbsa')
-        pflash0 = os.path.join(rme_stack, 'images', 'SBSA_FLASH0.fd')
-        pflash1 = os.path.join(rme_stack, 'images', 'SBSA_FLASH1.fd')
-        virtual = os.path.join(rme_stack, 'images', 'disks', 'virtual')
-        drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+        rme_stack = self.scratch_file('.')
+        pflash0 = join(rme_stack, 'out', 'SBSA_FLASH0.fd')
+        pflash1 = join(rme_stack, 'out', 'SBSA_FLASH1.fd')
+        rootfs = join(rme_stack, 'out', 'host.ext4')
 
-        self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+        efi = join(rme_stack, 'out', 'EFI')
+        os.makedirs(efi, exist_ok=True)
+        shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
+        with open(join(efi, 'startup.nsh'), 'w') as startup:
+            startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
+                          ' /host/out/lkvm run --realm'
+                          ' -m 256m'
+                          ' --restricted_mem'
+                          ' --kernel /host/out/Image'
+                          ' --disk /host/out/guest.ext4'
+                          ' --params "root=/dev/vda rw init=/init"')
+
+        self.vm.add_args('-cpu', 'max,x-rme=on')
+        self.vm.add_args('-smp', '2')
         self.vm.add_args('-m', '2G')
         self.vm.add_args('-M', 'sbsa-ref')
         self.vm.add_args('-drive', f'file={pflash0},format=raw,if=pflash')
         self.vm.add_args('-drive', f'file={pflash1},format=raw,if=pflash')
-        self.vm.add_args('-drive', f'file=fat:rw:{virtual},format=raw')
-        self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
-        self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
-        self.vm.add_args('-device', 'virtio-9p-pci,fsdev=shr0,mount_tag=shr0')
-        self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
-        self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
-        self.vm.add_args('-netdev', 'user,id=net0')
-
+        self.vm.add_args('-drive', f'file=fat:rw:{efi},format=raw')
+        self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+        self.vm.add_args('-virtfs',
+                         f'local,path={rme_stack}/,mount_tag=host,'
+                         'security_model=mapped,readonly=off')
         self.vm.launch()
-        # Wait for host VM boot to complete.
-        wait_for_console_pattern(self, 'Welcome to Buildroot',
-                                 failure_message='Synchronous Exception at')
-        exec_command_and_wait_for_pattern(self, 'root', '#')
-
-        test_realms_guest(self)
+        # Wait for host and guest VM boot to complete.
+        wait_for_console_pattern(self, 'root@guest',
+                                 failure_message='Kernel panic')
 
 if __name__ == '__main__':
     QemuSystemTest.main()
diff --git a/tests/functional/aarch64/test_rme_virt.py b/tests/functional/aarch64/test_rme_virt.py
index 8452d27928..bb603aaa26 100755
--- a/tests/functional/aarch64/test_rme_virt.py
+++ b/tests/functional/aarch64/test_rme_virt.py
@@ -9,50 +9,22 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-import os
+from os.path import join
 
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import exec_command, wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
 
-def test_realms_guest(test_rme_instance):
-
-    # Boot the (nested) guest VM
-    exec_command(test_rme_instance,
-                 'qemu-system-aarch64 -M virt,gic-version=3 '
-                 '-cpu host -enable-kvm -m 512M '
-                 '-M confidential-guest-support=rme0 '
-                 '-object rme-guest,id=rme0 '
-                 '-device virtio-net-pci,netdev=net0,romfile= '
-                 '-netdev user,id=net0 '
-                 '-kernel /mnt/out/bin/Image '
-                 '-initrd /mnt/out-br/images/rootfs.cpio '
-                 '-serial stdio')
-    # Detect Realm activation during (nested) guest boot.
-    wait_for_console_pattern(test_rme_instance,
-                             'SMC_RMI_REALM_ACTIVATE')
-    # Wait for (nested) guest boot to complete.
-    wait_for_console_pattern(test_rme_instance,
-                             'Welcome to Buildroot')
-    exec_command_and_wait_for_pattern(test_rme_instance, 'root', '#')
-    # query (nested) guest cca report
-    exec_command(test_rme_instance, 'cca-workload-attestation report')
-    wait_for_console_pattern(test_rme_instance,
-                             '"cca-platform-hash-algo-id": "sha-256"')
-    wait_for_console_pattern(test_rme_instance,
-                             '"cca-realm-hash-algo-id": "sha-512"')
-    wait_for_console_pattern(test_rme_instance,
-                             '"cca-realm-public-key-hash-algo-id": "sha-256"')
-
 class Aarch64RMEVirtMachine(QemuSystemTest):
 
-    # Stack is built with OP-TEE build environment from those instructions:
+    # Stack is inspired from:
     # https://linaro.atlassian.net/wiki/spaces/QEMU/pages/29051027459/
-    # https://github.com/pbo-linaro/qemu-rme-stack
+    # https://github.com/pbo-linaro/qemu-linux-stack/tree/rme_release
+    # ./build.sh && ./archive_artifacts.sh out.tar.xz
     ASSET_RME_STACK_VIRT = Asset(
-        ('https://fileserver.linaro.org/s/iaRsNDJp2CXHMSJ/'
-         'download/rme-stack-op-tee-4.2.0-cca-v4-qemu_v8.tar.gz'),
-         '1851adc232b094384d8b879b9a2cfff07ef3d6205032b85e9b3a4a9ae6b0b7ad')
+        ('https://github.com/pbo-linaro/qemu-linux-stack/'
+         'releases/download/build/rme_release-86101e5.tar.xz'),
+         'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
 
     # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
     # and launching a nested VM using it.
@@ -63,15 +35,16 @@ class Aarch64RMEVirtMachine(QemuSystemTest):
 
         self.vm.set_console()
 
-        stack_path_tar_gz = self.ASSET_RME_STACK_VIRT.fetch()
-        self.archive_extract(stack_path_tar_gz, format="tar")
+        stack_path_tar = self.ASSET_RME_STACK_VIRT.fetch()
+        self.archive_extract(stack_path_tar, format="tar")
 
-        rme_stack = self.scratch_file('rme-stack-op-tee-4.2.0-cca-v4-qemu_v8')
-        kernel = os.path.join(rme_stack, 'out', 'bin', 'Image')
-        bios = os.path.join(rme_stack, 'out', 'bin', 'flash.bin')
-        drive = os.path.join(rme_stack, 'out-br', 'images', 'rootfs.ext4')
+        rme_stack = self.scratch_file('.')
+        kernel = join(rme_stack, 'out', 'Image')
+        bios = join(rme_stack, 'out', 'flash.bin')
+        rootfs = join(rme_stack, 'out', 'host.ext4')
 
-        self.vm.add_args('-cpu', 'max,x-rme=on,pauth-impdef=on')
+        self.vm.add_args('-cpu', 'max,x-rme=on')
+        self.vm.add_args('-smp', '2')
         self.vm.add_args('-m', '2G')
         self.vm.add_args('-M', 'virt,acpi=off,'
                          'virtualization=on,'
@@ -79,23 +52,25 @@ class Aarch64RMEVirtMachine(QemuSystemTest):
                          'gic-version=3')
         self.vm.add_args('-bios', bios)
         self.vm.add_args('-kernel', kernel)
-        self.vm.add_args('-drive', f'format=raw,if=none,file={drive},id=hd0')
-        self.vm.add_args('-device', 'virtio-blk-pci,drive=hd0')
-        self.vm.add_args('-device', 'virtio-9p-device,fsdev=shr0,mount_tag=shr0')
-        self.vm.add_args('-fsdev', f'local,security_model=none,path={rme_stack},id=shr0')
-        self.vm.add_args('-device', 'virtio-net-pci,netdev=net0')
-        self.vm.add_args('-netdev', 'user,id=net0')
+        self.vm.add_args('-drive', f'format=raw,file={rootfs},if=virtio')
+        self.vm.add_args('-virtfs',
+                         f'local,path={rme_stack}/,mount_tag=host,'
+                         'security_model=mapped,readonly=off')
         # We need to add nokaslr to avoid triggering this sporadic bug:
         # https://gitlab.com/qemu-project/qemu/-/issues/2823
-        self.vm.add_args('-append', 'root=/dev/vda nokaslr')
+        self.vm.add_args('-append',
+                         'nokaslr root=/dev/vda rw init=/init --'
+                         ' /host/out/lkvm run --realm'
+                         ' -m 256m'
+                         ' --restricted_mem'
+                         ' --kernel /host/out/Image'
+                         ' --disk /host/out/guest.ext4'
+                         ' --params "root=/dev/vda rw init=/init"')
 
         self.vm.launch()
-        # Wait for host VM boot to complete.
-        wait_for_console_pattern(self, 'Welcome to Buildroot',
-                                 failure_message='Synchronous Exception at')
-        exec_command_and_wait_for_pattern(self, 'root', '#')
-
-        test_realms_guest(self)
+        # Wait for host and guest VM boot to complete.
+        wait_for_console_pattern(self, 'root@guest',
+                                 failure_message='Kernel panic')
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From 8a60ffe9a8f46ed514656eb4a40d1386c439daf8 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 26 Aug 2025 11:21:28 +0100
Subject: [PATCH 0231/2396] target/arm: Implement FEAT_SCTLR2 and enable with
 -cpu max

Add FEAT_SCTLR2, which introduces the SCTLR2_EL1, SCTLR2_EL2, and
SCTLR2_EL3 registers. These registers are extensions of the SCTLR_ELx
ones.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250727074202.83141-4-richard.henderson@linaro.org
Message-ID: <20250711140828.1714666-4-gustavo.romero@linaro.org>
[rth: Remove FEAT_MEC code; handle SCR and HCRX enable bits.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpu-features.h     |  5 ++
 target/arm/cpu.c              |  3 ++
 target/arm/cpu.h              | 15 ++++++
 target/arm/helper.c           | 97 ++++++++++++++++++++++++++++++++---
 target/arm/internals.h        |  1 +
 target/arm/tcg/cpu64.c        |  5 +-
 7 files changed, 119 insertions(+), 8 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 890dc6fee2..66043b0747 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -121,6 +121,7 @@ the following architecture extensions:
 - FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
 - FEAT_SB (Speculation Barrier)
+- FEAT_SCTLR2 (Extension to SCTLR_ELx)
 - FEAT_SEL2 (Secure EL2)
 - FEAT_SHA1 (SHA1 instructions)
 - FEAT_SHA256 (SHA256 instructions)
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 5876162428..e372543bf3 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -904,6 +904,11 @@ static inline bool isar_feature_aa64_nv2(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64MMFR2, NV) >= 2;
 }
 
+static inline bool isar_feature_aa64_sctlr2(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, SCTLRX) != 0;
+}
+
 static inline bool isar_feature_aa64_pmuv3p1(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 4 &&
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index e2b2337399..2ab04cb5f7 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -644,6 +644,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
             if (cpu_isar_feature(aa64_fgt, cpu)) {
                 env->cp15.scr_el3 |= SCR_FGTEN;
             }
+            if (cpu_isar_feature(aa64_sctlr2, cpu)) {
+                env->cp15.scr_el3 |= SCR_SCTLR2EN;
+            }
         }
 
         if (target_el == 2) {
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index dc9b6dce4c..08a29802e1 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -337,6 +337,7 @@ typedef struct CPUArchState {
             };
             uint64_t sctlr_el[4];
         };
+        uint64_t sctlr2_el[4]; /* Extension to System control register. */
         uint64_t vsctlr; /* Virtualization System control register. */
         uint64_t cpacr_el1; /* Architectural feature access control register */
         uint64_t cptr_el[4];  /* ARMv8 feature trap registers */
@@ -1420,6 +1421,19 @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_SPINTMASK (1ULL << 62) /* FEAT_NMI */
 #define SCTLR_TIDCP   (1ULL << 63) /* FEAT_TIDCP1 */
 
+#define SCTLR2_EMEC (1ULL << 1) /* FEAT_MEC */
+#define SCTLR2_NMEA (1ULL << 2) /* FEAT_DoubleFault2 */
+#define SCTLR2_ENADERR (1ULL << 3) /* FEAT_ADERR */
+#define SCTLR2_ENANERR (1ULL << 4) /* FEAT_ANERR */
+#define SCTLR2_EASE (1ULL << 5) /* FEAT_DoubleFault2 */
+#define SCTLR2_ENIDCP128 (1ULL << 6) /* FEAT_SYSREG128 */
+#define SCTLR2_ENPACM (1ULL << 7) /* FEAT_PAuth_LR */
+#define SCTLR2_ENPACM0 (1ULL << 8) /* FEAT_PAuth_LR */
+#define SCTLR2_CPTA (1ULL << 9) /* FEAT_CPA2 */
+#define SCTLR2_CPTA0 (1ULL << 10) /* FEAT_CPA2 */
+#define SCTLR2_CPTM (1ULL << 11) /* FEAT_CPA2 */
+#define SCTLR2_CPTM0 (1ULL << 12) /* FEAT_CAP2 */
+
 #define CPSR_M (0x1fU)
 #define CPSR_T (1U << 5)
 #define CPSR_F (1U << 6)
@@ -1712,6 +1726,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_HXEN              (1ULL << 38)
 #define SCR_TRNDR             (1ULL << 40)
 #define SCR_ENTP2             (1ULL << 41)
+#define SCR_SCTLR2EN          (1ULL << 44)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0c1299ff84..11ddeabb13 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -741,6 +741,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_ecv, cpu)) {
             valid_mask |= SCR_ECVEN;
         }
+        if (cpu_isar_feature(aa64_sctlr2, cpu)) {
+            valid_mask |= SCR_SCTLR2EN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -3907,23 +3910,21 @@ static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = env_archcpu(env);
     uint64_t valid_mask = 0;
 
-    /* FEAT_MOPS adds MSCEn and MCE2 */
     if (cpu_isar_feature(aa64_mops, cpu)) {
         valid_mask |= HCRX_MSCEN | HCRX_MCE2;
     }
-
-    /* FEAT_NMI adds TALLINT, VINMI and VFNMI */
     if (cpu_isar_feature(aa64_nmi, cpu)) {
         valid_mask |= HCRX_TALLINT | HCRX_VINMI | HCRX_VFNMI;
     }
-    /* FEAT_CMOW adds CMOW */
     if (cpu_isar_feature(aa64_cmow, cpu)) {
         valid_mask |= HCRX_CMOW;
     }
-    /* FEAT_XS adds FGTnXS, FnXS */
     if (cpu_isar_feature(aa64_xs, cpu)) {
         valid_mask |= HCRX_FGTNXS | HCRX_FNXS;
     }
+    if (cpu_isar_feature(aa64_sctlr2, cpu)) {
+        valid_mask |= HCRX_SCTLR2EN;
+    }
 
     /* Clear RES0 bits.  */
     env->cp15.hcrx_el2 = value & valid_mask;
@@ -3981,11 +3982,16 @@ uint64_t arm_hcrx_el2_eff(CPUARMState *env)
      * This may need to be revisited for future bits.
      */
     if (!arm_is_el2_enabled(env)) {
+        ARMCPU *cpu = env_archcpu(env);
         uint64_t hcrx = 0;
-        if (cpu_isar_feature(aa64_mops, env_archcpu(env))) {
-            /* MSCEn behaves as 1 if EL2 is not enabled */
+
+        /* Bits which whose effective value is 1 if el2 not enabled. */
+        if (cpu_isar_feature(aa64_mops, cpu)) {
             hcrx |= HCRX_MSCEN;
         }
+        if (cpu_isar_feature(aa64_sctlr2, cpu)) {
+            hcrx |= HCRX_SCTLR2EN;
+        }
         return hcrx;
     }
     if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {
@@ -4513,6 +4519,8 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
     static const struct E2HAlias aliases[] = {
         { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
           "SCTLR", "SCTLR_EL2", "SCTLR_EL12" },
+        { K(3, 0,  1, 0, 3), K(3, 4,  1, 0, 3), K(3, 5, 1, 0, 3),
+          "SCTLR2_EL1", "SCTLR2_EL2", "SCTLR2_EL12", isar_feature_aa64_sctlr2 },
         { K(3, 0,  1, 0, 2), K(3, 4,  1, 1, 2), K(3, 5, 1, 0, 2),
           "CPACR", "CPTR_EL2", "CPACR_EL12" },
         { K(3, 0,  2, 0, 0), K(3, 4,  2, 0, 0), K(3, 5, 2, 0, 0),
@@ -5994,6 +6002,77 @@ static const ARMCPRegInfo actlr2_hactlr2_reginfo[] = {
       .resetvalue = 0 },
 };
 
+static CPAccessResult sctlr2_el2_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    if (arm_current_el(env) < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_SCTLR2EN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult sctlr2_el1_access(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    CPAccessResult ret = access_tvm_trvm(env, ri, isread);
+    if (ret != CP_ACCESS_OK) {
+        return ret;
+    }
+    if (arm_current_el(env) < 2 && !(arm_hcrx_el2_eff(env) & HCRX_SCTLR2EN)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    return sctlr2_el2_access(env, ri, isread);
+}
+
+static void sctlr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    uint64_t valid_mask = 0;
+
+    value &= valid_mask;
+    raw_write(env, ri, value);
+}
+
+static void sctlr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    uint64_t valid_mask = 0;
+
+    value &= valid_mask;
+    raw_write(env, ri, value);
+}
+
+static void sctlr2_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                             uint64_t value)
+{
+    uint64_t valid_mask = 0;
+
+    value &= valid_mask;
+    raw_write(env, ri, value);
+}
+
+static const ARMCPRegInfo sctlr2_reginfo[] = {
+    { .name = "SCTLR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .opc2 = 3, .crn = 1, .crm = 0,
+      .access = PL1_RW, .accessfn = sctlr2_el1_access,
+      .writefn = sctlr2_el1_write, .fgt = FGT_SCTLR_EL1,
+      .nv2_redirect_offset = 0x278 | NV2_REDIR_NV1,
+      .fieldoffset = offsetof(CPUARMState, cp15.sctlr2_el[1]) },
+    { .name = "SCTLR2_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 3, .crn = 1, .crm = 0,
+      .access = PL2_RW, .accessfn = sctlr2_el2_access,
+      .writefn = sctlr2_el2_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.sctlr2_el[2]) },
+    { .name = "SCTLR2_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .opc2 = 3, .crn = 1, .crm = 0,
+      .access = PL3_RW, .writefn = sctlr2_el3_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.sctlr2_el[3]) },
+};
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -7223,6 +7302,10 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, nmi_reginfo);
     }
 
+    if (cpu_isar_feature(aa64_sctlr2, cpu)) {
+        define_arm_cp_regs(cpu, sctlr2_reginfo);
+    }
+
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);
     }
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 3f86b07044..fb72236255 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -230,6 +230,7 @@ FIELD(VSTCR, SA, 30, 1)
 #define HCRX_CMOW     (1ULL << 9)
 #define HCRX_MCE2     (1ULL << 10)
 #define HCRX_MSCEN    (1ULL << 11)
+#define HCRX_SCTLR2EN (1ULL << 15)
 
 #define HPFAR_NS      (1ULL << 63)
 
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 35cddbafa4..f4efff03a5 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1247,7 +1247,10 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1);     /* FEAT_E0PD */
     SET_IDREG(isar, ID_AA64MMFR2, t);
 
-    FIELD_DP64_IDREG(isar, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
+    t = GET_IDREG(isar, ID_AA64MMFR3);
+    t = FIELD_DP64(t, ID_AA64MMFR3, SCTLRX, 1);     /* FEAT_SCTLR2 */
+    t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
+    SET_IDREG(isar, ID_AA64MMFR3, t);
 
     t = GET_IDREG(isar, ID_AA64ZFR0);
     t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 2);    /* FEAT_SVE2p1 */

From 6e6d5fb4b928f09b46d0fa99830d75cddb22f73b Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Tue, 26 Aug 2025 11:21:28 +0100
Subject: [PATCH 0232/2396] target/arm: Implement FEAT_TCR2 and enable with
 -cpu max

Add FEAT_TCR2, which introduces the TCR2_EL1 and TCR2_EL2 registers.
These registers are extensions of the TCR_ELx registers and provide
top-level control of the EL10 and EL20 translation regimes.

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250727074202.83141-5-richard.henderson@linaro.org
Message-ID: <20250711140828.1714666-5-gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Remove FEAT_MEC code; handle SCR and HCRX enable bits.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpu-features.h     |  5 +++
 target/arm/cpu.c              |  3 ++
 target/arm/cpu.h              |  2 +
 target/arm/helper.c           | 71 +++++++++++++++++++++++++++++++++++
 target/arm/internals.h        | 19 ++++++++++
 target/arm/tcg/cpu64.c        |  1 +
 7 files changed, 102 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 66043b0747..1c597d8673 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -149,6 +149,7 @@ the following architecture extensions:
 - FEAT_SPECRES (Speculation restriction instructions)
 - FEAT_SSBS (Speculative Store Bypass Safe)
 - FEAT_SSBS2 (MRS and MSR instructions for SSBS version 2)
+- FEAT_TCR2 (Support for TCR2_ELx)
 - FEAT_TGran16K (Support for 16KB memory translation granule size at stage 1)
 - FEAT_TGran4K (Support for 4KB memory translation granule size at stage 1)
 - FEAT_TGran64K (Support for 64KB memory translation granule size at stage 1)
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index e372543bf3..8ec8c3feb3 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -904,6 +904,11 @@ static inline bool isar_feature_aa64_nv2(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64MMFR2, NV) >= 2;
 }
 
+static inline bool isar_feature_aa64_tcr2(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, TCRX) != 0;
+}
+
 static inline bool isar_feature_aa64_sctlr2(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64MMFR3, SCTLRX) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 2ab04cb5f7..27a4610da5 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -644,6 +644,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
             if (cpu_isar_feature(aa64_fgt, cpu)) {
                 env->cp15.scr_el3 |= SCR_FGTEN;
             }
+            if (cpu_isar_feature(aa64_tcr2, cpu)) {
+                env->cp15.scr_el3 |= SCR_TCR2EN;
+            }
             if (cpu_isar_feature(aa64_sctlr2, cpu)) {
                 env->cp15.scr_el3 |= SCR_SCTLR2EN;
             }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 08a29802e1..c15d79a106 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -366,6 +366,7 @@ typedef struct CPUArchState {
         uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
         /* MMU translation table base control. */
         uint64_t tcr_el[4];
+        uint64_t tcr2_el[3];
         uint64_t vtcr_el2; /* Virtualization Translation Control.  */
         uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
         uint32_t c2_data; /* MPU data cacheable bits.  */
@@ -1726,6 +1727,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_HXEN              (1ULL << 38)
 #define SCR_TRNDR             (1ULL << 40)
 #define SCR_ENTP2             (1ULL << 41)
+#define SCR_TCR2EN            (1ULL << 43)
 #define SCR_SCTLR2EN          (1ULL << 44)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 11ddeabb13..5a219703ae 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -741,6 +741,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_ecv, cpu)) {
             valid_mask |= SCR_ECVEN;
         }
+        if (cpu_isar_feature(aa64_tcr2, cpu)) {
+            valid_mask |= SCR_TCR2EN;
+        }
         if (cpu_isar_feature(aa64_sctlr2, cpu)) {
             valid_mask |= SCR_SCTLR2EN;
         }
@@ -3922,6 +3925,9 @@ static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_xs, cpu)) {
         valid_mask |= HCRX_FGTNXS | HCRX_FNXS;
     }
+    if (cpu_isar_feature(aa64_tcr2, cpu)) {
+        valid_mask |= HCRX_TCR2EN;
+    }
     if (cpu_isar_feature(aa64_sctlr2, cpu)) {
         valid_mask |= HCRX_SCTLR2EN;
     }
@@ -3989,6 +3995,9 @@ uint64_t arm_hcrx_el2_eff(CPUARMState *env)
         if (cpu_isar_feature(aa64_mops, cpu)) {
             hcrx |= HCRX_MSCEN;
         }
+        if (cpu_isar_feature(aa64_tcr2, cpu)) {
+            hcrx |= HCRX_TCR2EN;
+        }
         if (cpu_isar_feature(aa64_sctlr2, cpu)) {
             hcrx |= HCRX_SCTLR2EN;
         }
@@ -4529,6 +4538,8 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
           "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" },
         { K(3, 0,  2, 0, 2), K(3, 4,  2, 0, 2), K(3, 5, 2, 0, 2),
           "TCR_EL1", "TCR_EL2", "TCR_EL12" },
+        { K(3, 0,  2, 0, 3), K(3, 4,  2, 0, 3), K(3, 5, 2, 0, 3),
+          "TCR2_EL1", "TCR2_EL2", "TCR2_EL12", isar_feature_aa64_tcr2 },
         { K(3, 0,  4, 0, 0), K(3, 4,  4, 0, 0), K(3, 5, 4, 0, 0),
           "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" },
         { K(3, 0,  4, 0, 1), K(3, 4,  4, 0, 1), K(3, 5, 4, 0, 1),
@@ -6073,6 +6084,62 @@ static const ARMCPRegInfo sctlr2_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.sctlr2_el[3]) },
 };
 
+static CPAccessResult tcr2_el2_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    if (arm_current_el(env) < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_TCR2EN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult tcr2_el1_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    CPAccessResult ret = access_tvm_trvm(env, ri, isread);
+    if (ret != CP_ACCESS_OK) {
+        return ret;
+    }
+    if (arm_current_el(env) < 2 && !(arm_hcrx_el2_eff(env) & HCRX_TCR2EN)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    return tcr2_el2_access(env, ri, isread);
+}
+
+static void tcr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                           uint64_t value)
+{
+    uint64_t valid_mask = 0;
+
+    value &= valid_mask;
+    raw_write(env, ri, value);
+}
+
+static void tcr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                           uint64_t value)
+{
+    uint64_t valid_mask = 0;
+
+    value &= valid_mask;
+    raw_write(env, ri, value);
+}
+
+static const ARMCPRegInfo tcr2_reginfo[] = {
+    { .name = "TCR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .opc2 = 3, .crn = 2, .crm = 0,
+      .access = PL1_RW, .accessfn = tcr2_el1_access,
+      .writefn = tcr2_el1_write, .fgt = FGT_TCR_EL1,
+      .nv2_redirect_offset = 0x270 | NV2_REDIR_NV1,
+      .fieldoffset = offsetof(CPUARMState, cp15.tcr2_el[1]) },
+    { .name = "TCR2_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 3, .crn = 2, .crm = 0,
+      .access = PL2_RW, .accessfn = tcr2_el2_access,
+      .writefn = tcr2_el2_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.tcr2_el[2]) },
+};
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -7306,6 +7373,10 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, sctlr2_reginfo);
     }
 
+    if (cpu_isar_feature(aa64_tcr2, cpu)) {
+        define_arm_cp_regs(cpu, tcr2_reginfo);
+    }
+
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);
     }
diff --git a/target/arm/internals.h b/target/arm/internals.h
index fb72236255..f5a1e75db3 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -196,6 +196,24 @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define TTBCR_SH1    (1U << 28)
 #define TTBCR_EAE    (1U << 31)
 
+#define TCR2_PNCH    (1ULL << 0)
+#define TCR2_PIE     (1ULL << 1)
+#define TCR2_E0POE   (1ULL << 2)
+#define TCR2_POE     (1ULL << 3)
+#define TCR2_AIE     (1ULL << 4)
+#define TCR2_D128    (1ULL << 5)
+#define TCR2_PTTWI   (1ULL << 10)
+#define TCR2_HAFT    (1ULL << 11)
+#define TCR2_AMEC0   (1ULL << 12)
+#define TCR2_AMEC1   (1ULL << 13)
+#define TCR2_DISCH0  (1ULL << 14)
+#define TCR2_DISCH1  (1ULL << 15)
+#define TCR2_A2      (1ULL << 16)
+#define TCR2_FNG0    (1ULL << 17)
+#define TCR2_FNG1    (1ULL << 18)
+#define TCR2_FNGNA0  (1ULL << 20)
+#define TCR2_FNGNA1  (1ULL << 21)
+
 FIELD(VTCR, T0SZ, 0, 6)
 FIELD(VTCR, SL0, 6, 2)
 FIELD(VTCR, IRGN0, 8, 2)
@@ -230,6 +248,7 @@ FIELD(VSTCR, SA, 30, 1)
 #define HCRX_CMOW     (1ULL << 9)
 #define HCRX_MCE2     (1ULL << 10)
 #define HCRX_MSCEN    (1ULL << 11)
+#define HCRX_TCR2EN   (1ULL << 14)
 #define HCRX_SCTLR2EN (1ULL << 15)
 
 #define HPFAR_NS      (1ULL << 63)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index f4efff03a5..4eb51420ef 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1248,6 +1248,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     SET_IDREG(isar, ID_AA64MMFR2, t);
 
     t = GET_IDREG(isar, ID_AA64MMFR3);
+    t = FIELD_DP64(t, ID_AA64MMFR3, TCRX, 1);       /* FEAT_TCR2 */
     t = FIELD_DP64(t, ID_AA64MMFR3, SCTLRX, 1);     /* FEAT_SCTLR2 */
     t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
     SET_IDREG(isar, ID_AA64MMFR3, t);

From 376cdd7e9c94f1e03b2c58e068e8ebfe78b49514 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Tue, 26 Aug 2025 11:21:28 +0100
Subject: [PATCH 0233/2396] hw/intc/arm_gicv3_kvm: preserve pending interrupts
 during cpr

Close a race condition that causes cpr-transfer to lose VFIO
interrupts on ARM.

CPR stops VCPUs but does not disable VFIO interrupts, which may continue
to arrive throughout the transition to new QEMU.

CPR calls kvm_irqchip_remove_irqfd_notifier_gsi in old QEMU to force
future interrupts to the producer eventfd, where they are preserved.
Old QEMU then destroys the old KVM instance.  However, interrupts may
already be pending in KVM state.  To preserve them, call ioctl
KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES to flush them to guest RAM, where
they will be picked up when the new KVM+VCPU instance is created.

Cc: qemu-stable@nongnu.org
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-id: 1754936384-278328-1-git-send-email-steven.sistare@oracle.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c            | 15 +++++++++++++++
 include/hw/intc/arm_gicv3_common.h |  3 +++
 2 files changed, 18 insertions(+)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 6166283cd1..0cd14d78a7 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -31,6 +31,7 @@
 #include "gicv3_internal.h"
 #include "vgic_common.h"
 #include "migration/blocker.h"
+#include "migration/misc.h"
 #include "qom/object.h"
 #include "target/arm/cpregs.h"
 
@@ -776,6 +777,17 @@ static void vm_change_state_handler(void *opaque, bool running,
     }
 }
 
+static int kvm_arm_gicv3_notifier(NotifierWithReturn *notifier,
+                                  MigrationEvent *e, Error **errp)
+{
+    if (e->type == MIG_EVENT_PRECOPY_DONE) {
+        GICv3State *s = container_of(notifier, GICv3State, cpr_notifier);
+        return kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
+                                 KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES,
+                                 NULL, true, errp);
+    }
+    return 0;
+}
 
 static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
 {
@@ -917,6 +929,9 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     if (kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CTRL,
                               KVM_DEV_ARM_VGIC_SAVE_PENDING_TABLES)) {
         qemu_add_vm_change_state_handler(vm_change_state_handler, s);
+        migration_add_notifier_mode(&s->cpr_notifier,
+                                    kvm_arm_gicv3_notifier,
+                                    MIG_MODE_CPR_TRANSFER);
     }
 }
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index c18503869f..572d971d22 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -27,6 +27,7 @@
 #include "hw/sysbus.h"
 #include "hw/intc/arm_gic_common.h"
 #include "qom/object.h"
+#include "qemu/notify.h"
 
 /*
  * Maximum number of possible interrupts, determined by the GIC architecture.
@@ -271,6 +272,8 @@ struct GICv3State {
     GICv3CPUState *cpu;
     /* List of all ITSes connected to this GIC */
     GPtrArray *itslist;
+
+    NotifierWithReturn cpr_notifier;
 };
 
 #define GICV3_BITMAP_ACCESSORS(BMP)                                     \

From 186db6a73bc5c01026bb9f4f4a59e442c0156841 Mon Sep 17 00:00:00 2001
From: Smail AIDER <smail.aider@huawei.com>
Date: Tue, 26 Aug 2025 11:21:28 +0100
Subject: [PATCH 0234/2396] target/arm: Trap PMCR when MDCR_EL2.TPMCR is set

Trap PMCR_EL0 or PMCR accesses to EL2 when MDCR_EL2.TPMCR is set.
Similar to MDCR_EL2.TPM, MDCR_EL2.TPMCR allows trapping EL0 and EL1
accesses to the PMCR register to EL2.

Cc: qemu-stable@nongnu.org
Signed-off-by: Smail AIDER <smail.aider@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250811112143.1577055-2-smail.aider@huawei.com
Message-Id: <20250722131925.2119169-1-smail.aider@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-pmu.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpregs-pmu.c b/target/arm/cpregs-pmu.c
index 9c4431c18b..31c01eddc8 100644
--- a/target/arm/cpregs-pmu.c
+++ b/target/arm/cpregs-pmu.c
@@ -228,22 +228,27 @@ static bool event_supported(uint16_t number)
     return supported_event_map[number] != UNSUPPORTED_EVENT;
 }
 
-static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                   bool isread)
+static CPAccessResult do_pmreg_access(CPUARMState *env, bool is_pmcr)
 {
     /*
      * Performance monitor registers user accessibility is controlled
-     * by PMUSERENR. MDCR_EL2.TPM and MDCR_EL3.TPM allow configurable
+     * by PMUSERENR. MDCR_EL2.TPM/TPMCR and MDCR_EL3.TPM allow configurable
      * trapping to EL2 or EL3 for other accesses.
      */
     int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 
     if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
         return CP_ACCESS_TRAP_EL1;
     }
-    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
-        return CP_ACCESS_TRAP_EL2;
+    if (el < 2) {
+        uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+
+        if (mdcr_el2 & MDCR_TPM) {
+            return CP_ACCESS_TRAP_EL2;
+        }
+        if (is_pmcr && (mdcr_el2 & MDCR_TPMCR)) {
+            return CP_ACCESS_TRAP_EL2;
+        }
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
         return CP_ACCESS_TRAP_EL3;
@@ -252,6 +257,19 @@ static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                   bool isread)
+{
+    return do_pmreg_access(env, false);
+}
+
+static CPAccessResult pmreg_access_pmcr(CPUARMState *env,
+                                        const ARMCPRegInfo *ri,
+                                        bool isread)
+{
+    return do_pmreg_access(env, true);
+}
+
 static CPAccessResult pmreg_access_xevcntr(CPUARMState *env,
                                            const ARMCPRegInfo *ri,
                                            bool isread)
@@ -1187,14 +1205,14 @@ void define_pm_cpregs(ARMCPU *cpu)
             .fgt = FGT_PMCR_EL0,
             .type = ARM_CP_IO | ARM_CP_ALIAS,
             .fieldoffset = offsetoflow32(CPUARMState, cp15.c9_pmcr),
-            .accessfn = pmreg_access,
+            .accessfn = pmreg_access_pmcr,
             .readfn = pmcr_read, .raw_readfn = raw_read,
             .writefn = pmcr_write, .raw_writefn = raw_write,
         };
         const ARMCPRegInfo pmcr64 = {
             .name = "PMCR_EL0", .state = ARM_CP_STATE_AA64,
             .opc0 = 3, .opc1 = 3, .crn = 9, .crm = 12, .opc2 = 0,
-            .access = PL0_RW, .accessfn = pmreg_access,
+            .access = PL0_RW, .accessfn = pmreg_access_pmcr,
             .fgt = FGT_PMCR_EL0,
             .type = ARM_CP_IO,
             .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),

From 3b53af353b0b2e00fced6f00de87c03346542665 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 26 Aug 2025 11:21:29 +0100
Subject: [PATCH 0235/2396] target/arm: Add feature predicate for FEAT_CSSC

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 8ec8c3feb3..41511d0835 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -604,6 +604,11 @@ static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ISAR2, RPRES);
 }
 
+static inline bool isar_feature_aa64_cssc(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, CSSC) != 0;
+}
+
 static inline bool isar_feature_aa64_lut(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64ISAR2, LUT);

From d0e4b9d4d77ab3685fc22b71de0f4fd220afa17a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 26 Aug 2025 11:21:29 +0100
Subject: [PATCH 0236/2396] target/arm: Implement MIN/MAX (immediate)

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/a64.decode      | 10 ++++++++
 target/arm/tcg/translate-a64.c | 44 ++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 8c798cde2b..c1811b0274 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -156,6 +156,16 @@ MOVZ            . 10 100101 .. ................ .....   @movw_32
 MOVK            . 11 100101 .. ................ .....   @movw_64
 MOVK            . 11 100101 .. ................ .....   @movw_32
 
+# Min/Max (immediate)
+
+@minmaxi_s      sf:1 .. ........... imm:s8 rn:5 rd:5    &rri_sf
+@minmaxi_u      sf:1 .. ........... imm:8  rn:5 rd:5    &rri_sf
+
+SMAX_i          . 00 1000111 0000 ........ ..... .....  @minmaxi_s
+SMIN_i          . 00 1000111 0010 ........ ..... .....  @minmaxi_s
+UMAX_i          . 00 1000111 0001 ........ ..... .....  @minmaxi_u
+UMIN_i          . 00 1000111 0011 ........ ..... .....  @minmaxi_u
+
 # Bitfield
 
 &bitfield       rd rn sf immr imms
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index dbf47595db..b70ae5befd 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -4552,6 +4552,50 @@ TRANS(SUB_i, gen_rri, a, 1, 1, tcg_gen_sub_i64)
 TRANS(ADDS_i, gen_rri, a, 0, 1, a->sf ? gen_add64_CC : gen_add32_CC)
 TRANS(SUBS_i, gen_rri, a, 0, 1, a->sf ? gen_sub64_CC : gen_sub32_CC)
 
+/*
+ * Min/Max (immediate)
+ */
+
+static void gen_wrap3_i32(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, NeonGenTwoOpFn fn)
+{
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+
+    tcg_gen_extrl_i64_i32(t1, n);
+    tcg_gen_extrl_i64_i32(t2, m);
+    fn(t1, t1, t2);
+    tcg_gen_extu_i32_i64(d, t1);
+}
+
+static void gen_smax32_i64(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m)
+{
+    gen_wrap3_i32(d, n, m, tcg_gen_smax_i32);
+}
+
+static void gen_smin32_i64(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m)
+{
+    gen_wrap3_i32(d, n, m, tcg_gen_smin_i32);
+}
+
+static void gen_umax32_i64(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m)
+{
+    gen_wrap3_i32(d, n, m, tcg_gen_umax_i32);
+}
+
+static void gen_umin32_i64(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m)
+{
+    gen_wrap3_i32(d, n, m, tcg_gen_umin_i32);
+}
+
+TRANS_FEAT(SMAX_i, aa64_cssc, gen_rri, a, 0, 0,
+           a->sf ? tcg_gen_smax_i64 : gen_smax32_i64)
+TRANS_FEAT(SMIN_i, aa64_cssc, gen_rri, a, 0, 0,
+           a->sf ? tcg_gen_smin_i64 : gen_smin32_i64)
+TRANS_FEAT(UMAX_i, aa64_cssc, gen_rri, a, 0, 0,
+           a->sf ? tcg_gen_umax_i64 : gen_umax32_i64)
+TRANS_FEAT(UMIN_i, aa64_cssc, gen_rri, a, 0, 0,
+           a->sf ? tcg_gen_umin_i64 : gen_umin32_i64)
+
 /*
  * Add/subtract (immediate, with tags)
  */

From 506538208ddabc9b15b02a7e865aa1b64f9f18e5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 26 Aug 2025 11:21:29 +0100
Subject: [PATCH 0237/2396] target/arm: Implement MIN/MAX (register)

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/a64.decode      |  5 +++++
 target/arm/tcg/translate-a64.c | 22 ++++++++++++++++++++++
 2 files changed, 27 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index c1811b0274..a886b3ba4c 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -708,6 +708,11 @@ GMI             1 00 11010110 ..... 000101 ..... .....  @rrr
 
 PACGA           1 00 11010110 ..... 001100 ..... .....  @rrr
 
+SMAX            . 00 11010110 ..... 011000 ..... .....  @rrr_sf
+SMIN            . 00 11010110 ..... 011010 ..... .....  @rrr_sf
+UMAX            . 00 11010110 ..... 011001 ..... .....  @rrr_sf
+UMIN            . 00 11010110 ..... 011011 ..... .....  @rrr_sf
+
 # Data Processing (1-source)
 
 @rr             . .......... ..... ...... rn:5 rd:5     &rr
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index b70ae5befd..bb92bdc296 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -8201,6 +8201,28 @@ static bool trans_PACGA(DisasContext *s, arg_rrr *a)
     return false;
 }
 
+static bool gen_rrr(DisasContext *s, arg_rrr_sf *a, ArithTwoOp fn)
+{
+    TCGv_i64 tcg_rm = cpu_reg(s, a->rm);
+    TCGv_i64 tcg_rn = cpu_reg(s, a->rn);
+    TCGv_i64 tcg_rd = cpu_reg(s, a->rd);
+
+    fn(tcg_rd, tcg_rn, tcg_rm);
+    if (!a->sf) {
+        tcg_gen_ext32u_i64(tcg_rd, tcg_rd);
+    }
+    return true;
+}
+
+TRANS_FEAT(SMAX, aa64_cssc, gen_rrr, a,
+           a->sf ? tcg_gen_smax_i64 : gen_smax32_i64)
+TRANS_FEAT(SMIN, aa64_cssc, gen_rrr, a,
+           a->sf ? tcg_gen_smin_i64 : gen_smin32_i64)
+TRANS_FEAT(UMAX, aa64_cssc, gen_rrr, a,
+           a->sf ? tcg_gen_umax_i64 : gen_umax32_i64)
+TRANS_FEAT(UMIN, aa64_cssc, gen_rrr, a,
+           a->sf ? tcg_gen_umin_i64 : gen_umin32_i64)
+
 typedef void ArithOneOp(TCGv_i64, TCGv_i64);
 
 static bool gen_rr(DisasContext *s, int rd, int rn, ArithOneOp fn)

From 8a4bb8b975f80022cdea27757cd8d14f13bf65a9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 26 Aug 2025 11:21:29 +0100
Subject: [PATCH 0238/2396] target/arm: Split out gen_wrap2_i32 helper

Wrapper to extract the low 32 bits, perform an operation,
and zero-extend back to 64 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-5-richard.henderson@linaro.org
[PMM: fixed wrong output-reg argument in callsites; add comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index bb92bdc296..c0fa9a44e7 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -8231,13 +8231,22 @@ static bool gen_rr(DisasContext *s, int rd, int rn, ArithOneOp fn)
     return true;
 }
 
+/*
+ * Perform 32-bit operation fn on the low half of n;
+ * the high half of the output is zeroed.
+ */
+static void gen_wrap2_i32(TCGv_i64 d, TCGv_i64 n, NeonGenOneOpFn fn)
+{
+    TCGv_i32 t = tcg_temp_new_i32();
+
+    tcg_gen_extrl_i64_i32(t, n);
+    fn(t, t);
+    tcg_gen_extu_i32_i64(d, t);
+}
+
 static void gen_rbit32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
 {
-    TCGv_i32 t32 = tcg_temp_new_i32();
-
-    tcg_gen_extrl_i64_i32(t32, tcg_rn);
-    gen_helper_rbit(t32, t32);
-    tcg_gen_extu_i32_i64(tcg_rd, t32);
+    gen_wrap2_i32(tcg_rd, tcg_rn, gen_helper_rbit);
 }
 
 static void gen_rev16_xx(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn, TCGv_i64 mask)
@@ -8293,11 +8302,7 @@ static void gen_clz64(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
 
 static void gen_cls32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
 {
-    TCGv_i32 t32 = tcg_temp_new_i32();
-
-    tcg_gen_extrl_i64_i32(t32, tcg_rn);
-    tcg_gen_clrsb_i32(t32, t32);
-    tcg_gen_extu_i32_i64(tcg_rd, t32);
+    gen_wrap2_i32(tcg_rd, tcg_rn, tcg_gen_clrsb_i32);
 }
 
 TRANS(CLZ, gen_rr, a->rd, a->rn, a->sf ? gen_clz64 : gen_clz32)

From 994a260feac452ca478af5bd4ba4bff45b889b6e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 26 Aug 2025 17:11:12 +0100
Subject: [PATCH 0239/2396] target/arm: Implement CTZ, CNT, ABS

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-6-richard.henderson@linaro.org
[PMM: fix tcg_rd/tcg_rn mixup]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/a64.decode      |  4 ++++
 target/arm/tcg/translate-a64.c | 31 +++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index a886b3ba4c..766c610c01 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -726,6 +726,10 @@ REV64           1 10 11010110 00000 000011 ..... .....  @rr
 CLZ             . 10 11010110 00000 000100 ..... .....  @rr_sf
 CLS             . 10 11010110 00000 000101 ..... .....  @rr_sf
 
+CTZ             . 10 11010110 00000 000110 ..... .....  @rr_sf
+CNT             . 10 11010110 00000 000111 ..... .....  @rr_sf
+ABS             . 10 11010110 00000 001000 ..... .....  @rr_sf
+
 &pacaut         rd rn z
 @pacaut         . .. ........ ..... .. z:1 ... rn:5 rd:5  &pacaut
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index c0fa9a44e7..259aa70a36 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -8308,6 +8308,37 @@ static void gen_cls32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
 TRANS(CLZ, gen_rr, a->rd, a->rn, a->sf ? gen_clz64 : gen_clz32)
 TRANS(CLS, gen_rr, a->rd, a->rn, a->sf ? tcg_gen_clrsb_i64 : gen_cls32)
 
+static void gen_ctz32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
+{
+    TCGv_i32 t32 = tcg_temp_new_i32();
+
+    tcg_gen_extrl_i64_i32(t32, tcg_rn);
+    tcg_gen_ctzi_i32(t32, t32, 32);
+    tcg_gen_extu_i32_i64(tcg_rd, t32);
+}
+
+static void gen_ctz64(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
+{
+    tcg_gen_ctzi_i64(tcg_rd, tcg_rn, 64);
+}
+
+static void gen_cnt32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
+{
+    gen_wrap2_i32(tcg_rd, tcg_rn, tcg_gen_ctpop_i32);
+}
+
+static void gen_abs32(TCGv_i64 tcg_rd, TCGv_i64 tcg_rn)
+{
+    gen_wrap2_i32(tcg_rd, tcg_rn, tcg_gen_abs_i32);
+}
+
+TRANS_FEAT(CTZ, aa64_cssc, gen_rr, a->rd, a->rn,
+           a->sf ? gen_ctz64 : gen_ctz32)
+TRANS_FEAT(CNT, aa64_cssc, gen_rr, a->rd, a->rn,
+           a->sf ? tcg_gen_ctpop_i64 : gen_cnt32)
+TRANS_FEAT(ABS, aa64_cssc, gen_rr, a->rd, a->rn,
+           a->sf ? tcg_gen_abs_i64 : gen_abs32)
+
 static bool gen_pacaut(DisasContext *s, arg_pacaut *a, NeonGenTwo64OpEnvFn fn)
 {
     TCGv_i64 tcg_rd, tcg_rn;

From 7494f8bbfbb030c5c40a42e4d71430115e4f7a63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 26 Aug 2025 11:21:30 +0100
Subject: [PATCH 0240/2396] target/arm: Enable FEAT_CSSC for -cpu max

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250803014019.416797-7-richard.henderson@linaro.org
[PMM: rebased to handle linux-user elfload.c refactor]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 linux-user/aarch64/elfload.c  | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 3 files changed, 3 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 1c597d8673..b12f013b4f 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -30,6 +30,7 @@ the following architecture extensions:
 - FEAT_CMOW (Control for cache maintenance permission)
 - FEAT_CRC32 (CRC32 instructions)
 - FEAT_Crypto (Cryptographic Extension)
+- FEAT_CSSC (Common Short Sequence Compression instructions)
 - FEAT_CSV2 (Cache speculation variant 2)
 - FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
 - FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 8076968251..dd5f34398a 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -215,6 +215,7 @@ abi_ulong get_elf_hwcap2(CPUState *cs)
     GET_FEATURE_ID(aa64_sme_b16b16, ARM_HWCAP2_A64_SME_B16B16);
     GET_FEATURE_ID(aa64_sme_f16f16, ARM_HWCAP2_A64_SME_F16F16);
     GET_FEATURE_ID(aa64_sve_b16b16, ARM_HWCAP2_A64_SVE_B16B16);
+    GET_FEATURE_ID(aa64_cssc, ARM_HWCAP2_A64_CSSC);
 
     return hwcaps;
 }
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 4eb51420ef..eaf8846a6a 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1178,6 +1178,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR2, MOPS, 1);     /* FEAT_MOPS */
     t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1);       /* FEAT_HBC */
     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
+    t = FIELD_DP64(t, ID_AA64ISAR2, CSSC, 1);     /* FEAT_CSSC */
     SET_IDREG(isar, ID_AA64ISAR2, t);
 
     t = GET_IDREG(isar, ID_AA64PFR0);

From 36bc78aca83cfd3c8f73cbcb428bc7f0ce7a4a61 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Tue, 26 Aug 2025 11:21:30 +0100
Subject: [PATCH 0241/2396] hw/arm: add static NVDIMMs in device tree

NVDIMM is used for fast rootfs with EROFS, for example by kata
containers. To allow booting with static NVDIMM memory, add them to the
device tree in arm virt machine.

This allows users to boot directly with nvdimm memory devices without
having to rely on ACPI and hotplug.

Verified to work with command invocation:

./qemu-system-aarch64 \
  -M virt,nvdimm=on \
  -cpu cortex-a57 \
  -m 4G,slots=2,maxmem=8G \
  -object memory-backend-file,id=mem1,share=on,mem-path=/tmp/nvdimm,size=4G,readonly=off \
  -device nvdimm,id=nvdimm1,memdev=mem1,unarmed=off \
  -drive file=./debian-12-nocloud-arm64-commited.qcow2,format=qcow2 \
  -kernel ./vmlinuz-6.1.0-13-arm64 \
  -append "root=/dev/vda1 console=ttyAMA0,115200 acpi=off"
  -initrd ./initrd.img-6.1.0-13-arm64 \
  -nographic \
  -serial mon:stdio

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-id: 20250807-nvdimm_arm64_virt-v2-1-b8054578bea8@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 42 ++++++++++++++++++++++++++++++++++++++++++
 hw/arm/virt.c |  8 +++++---
 2 files changed, 47 insertions(+), 3 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index d391cd01bb..1e57c4ab9e 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -25,6 +25,7 @@
 #include "hw/boards.h"
 #include "system/reset.h"
 #include "hw/loader.h"
+#include "hw/mem/memory-device.h"
 #include "elf.h"
 #include "system/device_tree.h"
 #include "qemu/config-file.h"
@@ -515,6 +516,29 @@ static void fdt_add_psci_node(void *fdt, ARMCPU *armcpu)
     qemu_fdt_setprop_cell(fdt, "/psci", "migrate", migrate_fn);
 }
 
+static int fdt_add_pmem_node(void *fdt, uint32_t acells, uint32_t scells,
+                             int64_t mem_base, int64_t size, int64_t node)
+{
+    int ret;
+
+    g_autofree char *nodename = g_strdup_printf("/pmem@%" PRIx64, mem_base);
+
+    qemu_fdt_add_subnode(fdt, nodename);
+    qemu_fdt_setprop_string(fdt, nodename, "compatible", "pmem-region");
+    ret = qemu_fdt_setprop_sized_cells(fdt, nodename, "reg", acells,
+                                       mem_base, scells, size);
+    if (ret) {
+        return ret;
+    }
+
+    if (node >= 0) {
+        return qemu_fdt_setprop_cell(fdt, nodename, "numa-node-id",
+                                     node);
+    }
+
+    return 0;
+}
+
 int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
                  hwaddr addr_limit, AddressSpace *as, MachineState *ms,
                  ARMCPU *cpu)
@@ -525,6 +549,7 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
     unsigned int i;
     hwaddr mem_base, mem_len;
     char **node_path;
+    g_autofree MemoryDeviceInfoList *md_list = NULL;
     Error *err = NULL;
 
     if (binfo->dtb_filename) {
@@ -628,6 +653,23 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
         }
     }
 
+    md_list = qmp_memory_device_list();
+    for (MemoryDeviceInfoList *m = md_list; m != NULL; m = m->next) {
+        MemoryDeviceInfo *mi = m->value;
+
+        if (mi->type == MEMORY_DEVICE_INFO_KIND_NVDIMM) {
+            PCDIMMDeviceInfo *di = mi->u.nvdimm.data;
+
+            rc = fdt_add_pmem_node(fdt, acells, scells,
+                                   di->addr, di->size, di->node);
+            if (rc < 0) {
+                fprintf(stderr, "couldn't add NVDIMM /pmem@%"PRIx64" node\n",
+                        di->addr);
+                goto fail;
+            }
+        }
+    }
+
     rc = fdt_path_offset(fdt, "/chosen");
     if (rc < 0) {
         qemu_fdt_add_subnode(fdt, "/chosen");
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 9326cfc895..1e63f40fbe 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2917,7 +2917,7 @@ static void virt_memory_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
     const MachineState *ms = MACHINE(hotplug_dev);
     const bool is_nvdimm = object_dynamic_cast(OBJECT(dev), TYPE_NVDIMM);
 
-    if (!vms->acpi_dev) {
+    if (!vms->acpi_dev && !(is_nvdimm && !dev->hotplugged)) {
         error_setg(errp,
                    "memory hotplug is not enabled: missing acpi-ged device");
         return;
@@ -2949,8 +2949,10 @@ static void virt_memory_plug(HotplugHandler *hotplug_dev,
         nvdimm_plug(ms->nvdimms_state);
     }
 
-    hotplug_handler_plug(HOTPLUG_HANDLER(vms->acpi_dev),
-                         dev, &error_abort);
+    if (vms->acpi_dev) {
+        hotplug_handler_plug(HOTPLUG_HANDLER(vms->acpi_dev),
+                             dev, &error_abort);
+    }
 }
 
 static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,

From 5ffd387e9e0f787744fadaad35e1bf92224b0642 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 19 Aug 2025 12:56:48 +0100
Subject: [PATCH 0242/2396] scripts/kernel-doc: Avoid new Perl precedence
 warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Newer versions of Perl (5.41.x and up) emit a warning for code in
kernel-doc:
 Possible precedence problem between ! and pattern match (m//) at /scripts/kernel-doc line 1597.

This is because the code does:
            if (!$param =~ /\w\.\.\.$/) {

In Perl, the !  operator has higher precedence than the =~
pattern-match binding, so the effect of this condition is to first
logically-negate the string $param into a true-or-false value and
then try to pattern match it against the regex, which in this case
will always fail.  This is almost certainly not what the author
intended.

In the new Python version of kernel-doc in the Linux kernel,
the equivalent code is written:

            if KernRe(r'\w\.\.\.$').search(param):
                # For named variable parameters of the form `x...`,
                # remove the dots
                param = param[:-3]
            else:
                # Handles unnamed variable parameters
                param = "..."

which is a more sensible way of writing the behaviour you would
get if you put in brackets to make the regex match first and
then negate the result.

Take this as the intended behaviour, and update the Perl to match.

For QEMU, this produces no change in output, presumably because we
never used the "unnamed variable parameters" syntax.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250819115648.2125709-1-peter.maydell@linaro.org
---
 scripts/kernel-doc | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index fec83f53ed..117ec8fcd1 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1594,13 +1594,12 @@ sub push_parameter($$$$$) {
 
 	if ($type eq "" && $param =~ /\.\.\.$/)
 	{
-	    if (!$param =~ /\w\.\.\.$/) {
-	      # handles unnamed variable parameters
-	      $param = "...";
-	    }
-	    elsif ($param =~ /\w\.\.\.$/) {
+	    if ($param =~ /\w\.\.\.$/) {
 	      # for named variable parameters of the form `x...`, remove the dots
 	      $param =~ s/\.\.\.$//;
+	    } else {
+	      # handles unnamed variable parameters
+	      $param = "...";
 	    }
 	    if (!defined $parameterdescs{$param} || $parameterdescs{$param} eq "") {
 		$parameterdescs{$param} = "variable arguments";

From 3f34478007a2423399dbdfae5e3deeca3898da9c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:16 +0100
Subject: [PATCH 0243/2396] docs/sphinx/kerneldoc.py: Handle new LINENO syntax

The new upstream kernel-doc that we plan to update to uses a different
syntax for the LINENO directives that the Sphinx extension parses:
instead of
  #define LINENO 86
it has
  .. LINENO 86

Update the kerneldoc.py extension to handle both syntaxes, so
that it will work with both the old and the new kernel-doc.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-2-peter.maydell@linaro.org
---
 docs/sphinx/kerneldoc.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/sphinx/kerneldoc.py b/docs/sphinx/kerneldoc.py
index 3aa972f2e8..30bb343198 100644
--- a/docs/sphinx/kerneldoc.py
+++ b/docs/sphinx/kerneldoc.py
@@ -127,7 +127,7 @@ class KernelDocDirective(Directive):
             result = ViewList()
 
             lineoffset = 0;
-            line_regex = re.compile("^#define LINENO ([0-9]+)$")
+            line_regex = re.compile(r"^(?:\.\.|#define) LINENO ([0-9]+)$")
             for line in lines:
                 match = line_regex.search(line)
                 if match:

From 4a1bc66d3f61cb803b16bb1691e46b5ec59d25f5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:17 +0100
Subject: [PATCH 0244/2396] tests/qtest/libqtest.h: Remove stray space from doc
 comment

The doc comment for qtest_cb_for_every_machine has a stray
space at the start of its description, which makes kernel-doc
think that this line is part of the documentation of the
skip_old_versioned argument. The result is that the HTML
doesn't have a "Description" section and the text is instead
put in the wrong place.

Remove the stray space.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-3-peter.maydell@linaro.org
---
 tests/qtest/libqtest.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index b3f2e7fbef..fd27521a9c 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -977,7 +977,7 @@ void qtest_qmp_fds_assert_success(QTestState *qts, int *fds, size_t nfds,
  * @cb: Pointer to the callback function
  * @skip_old_versioned: true if versioned old machine types should be skipped
  *
- *  Call a callback function for every name of all available machines.
+ * Call a callback function for every name of all available machines.
  */
 void qtest_cb_for_every_machine(void (*cb)(const char *machine),
                                 bool skip_old_versioned);

From 2b2765ac4045642563cc92ad98c2244a0aa0c7fc Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:18 +0100
Subject: [PATCH 0245/2396] scripts: Import Python kerneldoc from Linux kernel

We last synced our copy of kerneldoc with Linux back in 2020.  In the
interim, upstream has entirely rewritten the script in Python, and
the new Python version is split into a main script plus some
libraries in the kernel's scripts/lib/kdoc.

Import all these files.  These are the versions as of kernel commit
0cc53520e68be, with no local changes.

We use the same lib/kdoc/ directory as the kernel does here, so we
can avoid having to edit the top-level script just to adjust a
pathname, even though it is probably not the naming we would have
picked if this was a purely QEMU script.

The Sphinx conf.py still points at the Perl version of the script,
so this Python code will not be invoked to build the docs yet.

NB: checkpatch complains about many things in this commit,
including the use of "GPL-2.0" rather than "GPL-2.0-only" in
the SPDX tags, but since this is a third party import we can
ignore this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-4-peter.maydell@linaro.org
---
 scripts/kernel-doc.py           |  325 ++++++
 scripts/lib/kdoc/kdoc_files.py  |  291 ++++++
 scripts/lib/kdoc/kdoc_item.py   |   42 +
 scripts/lib/kdoc/kdoc_output.py |  749 ++++++++++++++
 scripts/lib/kdoc/kdoc_parser.py | 1669 +++++++++++++++++++++++++++++++
 scripts/lib/kdoc/kdoc_re.py     |  270 +++++
 6 files changed, 3346 insertions(+)
 create mode 100755 scripts/kernel-doc.py
 create mode 100644 scripts/lib/kdoc/kdoc_files.py
 create mode 100644 scripts/lib/kdoc/kdoc_item.py
 create mode 100644 scripts/lib/kdoc/kdoc_output.py
 create mode 100644 scripts/lib/kdoc/kdoc_parser.py
 create mode 100644 scripts/lib/kdoc/kdoc_re.py

diff --git a/scripts/kernel-doc.py b/scripts/kernel-doc.py
new file mode 100755
index 0000000000..fc3d46ef51
--- /dev/null
+++ b/scripts/kernel-doc.py
@@ -0,0 +1,325 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+#
+# pylint: disable=C0103,R0915
+#
+# Converted from the kernel-doc script originally written in Perl
+# under GPLv2, copyrighted since 1998 by the following authors:
+#
+#    Aditya Srivastava <yashsri421@gmail.com>
+#    Akira Yokosawa <akiyks@gmail.com>
+#    Alexander A. Klimov <grandmaster@al2klimov.de>
+#    Alexander Lobakin <aleksander.lobakin@intel.com>
+#    André Almeida <andrealmeid@igalia.com>
+#    Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+#    Anna-Maria Behnsen <anna-maria@linutronix.de>
+#    Armin Kuster <akuster@mvista.com>
+#    Bart Van Assche <bart.vanassche@sandisk.com>
+#    Ben Hutchings <ben@decadent.org.uk>
+#    Borislav Petkov <bbpetkov@yahoo.de>
+#    Chen-Yu Tsai <wenst@chromium.org>
+#    Coco Li <lixiaoyan@google.com>
+#    Conchúr Navid <conchur@web.de>
+#    Daniel Santos <daniel.santos@pobox.com>
+#    Danilo Cesar Lemes de Paula <danilo.cesar@collabora.co.uk>
+#    Dan Luedtke <mail@danrl.de>
+#    Donald Hunter <donald.hunter@gmail.com>
+#    Gabriel Krisman Bertazi <krisman@collabora.co.uk>
+#    Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+#    Harvey Harrison <harvey.harrison@gmail.com>
+#    Horia Geanta <horia.geanta@freescale.com>
+#    Ilya Dryomov <idryomov@gmail.com>
+#    Jakub Kicinski <kuba@kernel.org>
+#    Jani Nikula <jani.nikula@intel.com>
+#    Jason Baron <jbaron@redhat.com>
+#    Jason Gunthorpe <jgg@nvidia.com>
+#    Jérémy Bobbio <lunar@debian.org>
+#    Johannes Berg <johannes.berg@intel.com>
+#    Johannes Weiner <hannes@cmpxchg.org>
+#    Jonathan Cameron <Jonathan.Cameron@huawei.com>
+#    Jonathan Corbet <corbet@lwn.net>
+#    Jonathan Neuschäfer <j.neuschaefer@gmx.net>
+#    Kamil Rytarowski <n54@gmx.com>
+#    Kees Cook <kees@kernel.org>
+#    Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+#    Levin, Alexander (Sasha Levin) <alexander.levin@verizon.com>
+#    Linus Torvalds <torvalds@linux-foundation.org>
+#    Lucas De Marchi <lucas.demarchi@profusion.mobi>
+#    Mark Rutland <mark.rutland@arm.com>
+#    Markus Heiser <markus.heiser@darmarit.de>
+#    Martin Waitz <tali@admingilde.org>
+#    Masahiro Yamada <masahiroy@kernel.org>
+#    Matthew Wilcox <willy@infradead.org>
+#    Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+#    Michal Wajdeczko <michal.wajdeczko@intel.com>
+#    Michael Zucchi
+#    Mike Rapoport <rppt@linux.ibm.com>
+#    Niklas Söderlund <niklas.soderlund@corigine.com>
+#    Nishanth Menon <nm@ti.com>
+#    Paolo Bonzini <pbonzini@redhat.com>
+#    Pavan Kumar Linga <pavan.kumar.linga@intel.com>
+#    Pavel Pisa <pisa@cmp.felk.cvut.cz>
+#    Peter Maydell <peter.maydell@linaro.org>
+#    Pierre-Louis Bossart <pierre-louis.bossart@linux.intel.com>
+#    Randy Dunlap <rdunlap@infradead.org>
+#    Richard Kennedy <richard@rsk.demon.co.uk>
+#    Rich Walker <rw@shadow.org.uk>
+#    Rolf Eike Beer <eike-kernel@sf-tec.de>
+#    Sakari Ailus <sakari.ailus@linux.intel.com>
+#    Silvio Fricke <silvio.fricke@gmail.com>
+#    Simon Huggins
+#    Tim Waugh <twaugh@redhat.com>
+#    Tomasz Warniełło <tomasz.warniello@gmail.com>
+#    Utkarsh Tripathi <utripathi2002@gmail.com>
+#    valdis.kletnieks@vt.edu <valdis.kletnieks@vt.edu>
+#    Vegard Nossum <vegard.nossum@oracle.com>
+#    Will Deacon <will.deacon@arm.com>
+#    Yacine Belkadi <yacine.belkadi.1@gmail.com>
+#    Yujie Liu <yujie.liu@intel.com>
+
+"""
+kernel_doc
+==========
+
+Print formatted kernel documentation to stdout
+
+Read C language source or header FILEs, extract embedded
+documentation comments, and print formatted documentation
+to standard output.
+
+The documentation comments are identified by the "/**"
+opening comment mark.
+
+See Documentation/doc-guide/kernel-doc.rst for the
+documentation comment syntax.
+"""
+
+import argparse
+import logging
+import os
+import sys
+
+# Import Python modules
+
+LIB_DIR = "lib/kdoc"
+SRC_DIR = os.path.dirname(os.path.realpath(__file__))
+
+sys.path.insert(0, os.path.join(SRC_DIR, LIB_DIR))
+
+from kdoc_files import KernelFiles                      # pylint: disable=C0413
+from kdoc_output import RestFormat, ManFormat           # pylint: disable=C0413
+
+DESC = """
+Read C language source or header FILEs, extract embedded documentation comments,
+and print formatted documentation to standard output.
+
+The documentation comments are identified by the "/**" opening comment mark.
+
+See Documentation/doc-guide/kernel-doc.rst for the documentation comment syntax.
+"""
+
+EXPORT_FILE_DESC = """
+Specify an additional FILE in which to look for EXPORT_SYMBOL information.
+
+May be used multiple times.
+"""
+
+EXPORT_DESC = """
+Only output documentation for the symbols that have been
+exported using EXPORT_SYMBOL() and related macros in any input
+FILE or -export-file FILE.
+"""
+
+INTERNAL_DESC = """
+Only output documentation for the symbols that have NOT been
+exported using EXPORT_SYMBOL() and related macros in any input
+FILE or -export-file FILE.
+"""
+
+FUNCTION_DESC = """
+Only output documentation for the given function or DOC: section
+title. All other functions and DOC: sections are ignored.
+
+May be used multiple times.
+"""
+
+NOSYMBOL_DESC = """
+Exclude the specified symbol from the output documentation.
+
+May be used multiple times.
+"""
+
+FILES_DESC = """
+Header and C source files to be parsed.
+"""
+
+WARN_CONTENTS_BEFORE_SECTIONS_DESC = """
+Warns if there are contents before sections (deprecated).
+
+This option is kept just for backward-compatibility, but it does nothing,
+neither here nor at the original Perl script.
+"""
+
+
+class MsgFormatter(logging.Formatter):
+    """Helper class to format warnings on a similar way to kernel-doc.pl"""
+
+    def format(self, record):
+        record.levelname = record.levelname.capitalize()
+        return logging.Formatter.format(self, record)
+
+def main():
+    """Main program"""
+
+    parser = argparse.ArgumentParser(formatter_class=argparse.RawTextHelpFormatter,
+                                     description=DESC)
+
+    # Normal arguments
+
+    parser.add_argument("-v", "-verbose", "--verbose", action="store_true",
+                        help="Verbose output, more warnings and other information.")
+
+    parser.add_argument("-d", "-debug", "--debug", action="store_true",
+                        help="Enable debug messages")
+
+    parser.add_argument("-M", "-modulename", "--modulename",
+                        default="Kernel API",
+                        help="Allow setting a module name at the output.")
+
+    parser.add_argument("-l", "-enable-lineno", "--enable_lineno",
+                        action="store_true",
+                        help="Enable line number output (only in ReST mode)")
+
+    # Arguments to control the warning behavior
+
+    parser.add_argument("-Wreturn", "--wreturn", action="store_true",
+                        help="Warns about the lack of a return markup on functions.")
+
+    parser.add_argument("-Wshort-desc", "-Wshort-description", "--wshort-desc",
+                        action="store_true",
+                        help="Warns if initial short description is missing")
+
+    parser.add_argument("-Wcontents-before-sections",
+                        "--wcontents-before-sections", action="store_true",
+                        help=WARN_CONTENTS_BEFORE_SECTIONS_DESC)
+
+    parser.add_argument("-Wall", "--wall", action="store_true",
+                        help="Enable all types of warnings")
+
+    parser.add_argument("-Werror", "--werror", action="store_true",
+                        help="Treat warnings as errors.")
+
+    parser.add_argument("-export-file", "--export-file", action='append',
+                        help=EXPORT_FILE_DESC)
+
+    # Output format mutually-exclusive group
+
+    out_group = parser.add_argument_group("Output format selection (mutually exclusive)")
+
+    out_fmt = out_group.add_mutually_exclusive_group()
+
+    out_fmt.add_argument("-m", "-man", "--man", action="store_true",
+                         help="Output troff manual page format.")
+    out_fmt.add_argument("-r", "-rst", "--rst", action="store_true",
+                         help="Output reStructuredText format (default).")
+    out_fmt.add_argument("-N", "-none", "--none", action="store_true",
+                         help="Do not output documentation, only warnings.")
+
+    # Output selection mutually-exclusive group
+
+    sel_group = parser.add_argument_group("Output selection (mutually exclusive)")
+    sel_mut = sel_group.add_mutually_exclusive_group()
+
+    sel_mut.add_argument("-e", "-export", "--export", action='store_true',
+                         help=EXPORT_DESC)
+
+    sel_mut.add_argument("-i", "-internal", "--internal", action='store_true',
+                         help=INTERNAL_DESC)
+
+    sel_mut.add_argument("-s", "-function", "--symbol", action='append',
+                         help=FUNCTION_DESC)
+
+    # Those are valid for all 3 types of filter
+    parser.add_argument("-n", "-nosymbol", "--nosymbol", action='append',
+                        help=NOSYMBOL_DESC)
+
+    parser.add_argument("-D", "-no-doc-sections", "--no-doc-sections",
+                        action='store_true', help="Don't outputt DOC sections")
+
+    parser.add_argument("files", metavar="FILE",
+                        nargs="+", help=FILES_DESC)
+
+    args = parser.parse_args()
+
+    if args.wall:
+        args.wreturn = True
+        args.wshort_desc = True
+        args.wcontents_before_sections = True
+
+    logger = logging.getLogger()
+
+    if not args.debug:
+        logger.setLevel(logging.INFO)
+    else:
+        logger.setLevel(logging.DEBUG)
+
+    formatter = MsgFormatter('%(levelname)s: %(message)s')
+
+    handler = logging.StreamHandler()
+    handler.setFormatter(formatter)
+
+    logger.addHandler(handler)
+
+    python_ver = sys.version_info[:2]
+    if python_ver < (3,6):
+        logger.warning("Python 3.6 or later is required by kernel-doc")
+
+        # Return 0 here to avoid breaking compilation
+        sys.exit(0)
+
+    if python_ver < (3,7):
+        logger.warning("Python 3.7 or later is required for correct results")
+
+    if args.man:
+        out_style = ManFormat(modulename=args.modulename)
+    elif args.none:
+        out_style = None
+    else:
+        out_style = RestFormat()
+
+    kfiles = KernelFiles(verbose=args.verbose,
+                         out_style=out_style, werror=args.werror,
+                         wreturn=args.wreturn, wshort_desc=args.wshort_desc,
+                         wcontents_before_sections=args.wcontents_before_sections)
+
+    kfiles.parse(args.files, export_file=args.export_file)
+
+    for t in kfiles.msg(enable_lineno=args.enable_lineno, export=args.export,
+                        internal=args.internal, symbol=args.symbol,
+                        nosymbol=args.nosymbol, export_file=args.export_file,
+                        no_doc_sections=args.no_doc_sections):
+        msg = t[1]
+        if msg:
+            print(msg)
+
+    error_count = kfiles.errors
+    if not error_count:
+        sys.exit(0)
+
+    if args.werror:
+        print(f"{error_count} warnings as errors")
+        sys.exit(error_count)
+
+    if args.verbose:
+        print(f"{error_count} errors")
+
+    if args.none:
+        sys.exit(0)
+
+    sys.exit(error_count)
+
+
+# Call main method
+if __name__ == "__main__":
+    main()
diff --git a/scripts/lib/kdoc/kdoc_files.py b/scripts/lib/kdoc/kdoc_files.py
new file mode 100644
index 0000000000..9e09b45b02
--- /dev/null
+++ b/scripts/lib/kdoc/kdoc_files.py
@@ -0,0 +1,291 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+#
+# pylint: disable=R0903,R0913,R0914,R0917
+
+"""
+Parse lernel-doc tags on multiple kernel source files.
+"""
+
+import argparse
+import logging
+import os
+import re
+
+from kdoc_parser import KernelDoc
+from kdoc_output import OutputFormat
+
+
+class GlobSourceFiles:
+    """
+    Parse C source code file names and directories via an Interactor.
+    """
+
+    def __init__(self, srctree=None, valid_extensions=None):
+        """
+        Initialize valid extensions with a tuple.
+
+        If not defined, assume default C extensions (.c and .h)
+
+        It would be possible to use python's glob function, but it is
+        very slow, and it is not interactive. So, it would wait to read all
+        directories before actually do something.
+
+        So, let's use our own implementation.
+        """
+
+        if not valid_extensions:
+            self.extensions = (".c", ".h")
+        else:
+            self.extensions = valid_extensions
+
+        self.srctree = srctree
+
+    def _parse_dir(self, dirname):
+        """Internal function to parse files recursively"""
+
+        with os.scandir(dirname) as obj:
+            for entry in obj:
+                name = os.path.join(dirname, entry.name)
+
+                if entry.is_dir():
+                    yield from self._parse_dir(name)
+
+                if not entry.is_file():
+                    continue
+
+                basename = os.path.basename(name)
+
+                if not basename.endswith(self.extensions):
+                    continue
+
+                yield name
+
+    def parse_files(self, file_list, file_not_found_cb):
+        """
+        Define an interator to parse all source files from file_list,
+        handling directories if any
+        """
+
+        if not file_list:
+            return
+
+        for fname in file_list:
+            if self.srctree:
+                f = os.path.join(self.srctree, fname)
+            else:
+                f = fname
+
+            if os.path.isdir(f):
+                yield from self._parse_dir(f)
+            elif os.path.isfile(f):
+                yield f
+            elif file_not_found_cb:
+                file_not_found_cb(fname)
+
+
+class KernelFiles():
+    """
+    Parse kernel-doc tags on multiple kernel source files.
+
+    There are two type of parsers defined here:
+        - self.parse_file(): parses both kernel-doc markups and
+          EXPORT_SYMBOL* macros;
+        - self.process_export_file(): parses only EXPORT_SYMBOL* macros.
+    """
+
+    def warning(self, msg):
+        """Ancillary routine to output a warning and increment error count"""
+
+        self.config.log.warning(msg)
+        self.errors += 1
+
+    def error(self, msg):
+        """Ancillary routine to output an error and increment error count"""
+
+        self.config.log.error(msg)
+        self.errors += 1
+
+    def parse_file(self, fname):
+        """
+        Parse a single Kernel source.
+        """
+
+        # Prevent parsing the same file twice if results are cached
+        if fname in self.files:
+            return
+
+        doc = KernelDoc(self.config, fname)
+        export_table, entries = doc.parse_kdoc()
+
+        self.export_table[fname] = export_table
+
+        self.files.add(fname)
+        self.export_files.add(fname)      # parse_kdoc() already check exports
+
+        self.results[fname] = entries
+
+    def process_export_file(self, fname):
+        """
+        Parses EXPORT_SYMBOL* macros from a single Kernel source file.
+        """
+
+        # Prevent parsing the same file twice if results are cached
+        if fname in self.export_files:
+            return
+
+        doc = KernelDoc(self.config, fname)
+        export_table = doc.parse_export()
+
+        if not export_table:
+            self.error(f"Error: Cannot check EXPORT_SYMBOL* on {fname}")
+            export_table = set()
+
+        self.export_table[fname] = export_table
+        self.export_files.add(fname)
+
+    def file_not_found_cb(self, fname):
+        """
+        Callback to warn if a file was not found.
+        """
+
+        self.error(f"Cannot find file {fname}")
+
+    def __init__(self, verbose=False, out_style=None,
+                 werror=False, wreturn=False, wshort_desc=False,
+                 wcontents_before_sections=False,
+                 logger=None):
+        """
+        Initialize startup variables and parse all files
+        """
+
+        if not verbose:
+            verbose = bool(os.environ.get("KBUILD_VERBOSE", 0))
+
+        if out_style is None:
+            out_style = OutputFormat()
+
+        if not werror:
+            kcflags = os.environ.get("KCFLAGS", None)
+            if kcflags:
+                match = re.search(r"(\s|^)-Werror(\s|$)/", kcflags)
+                if match:
+                    werror = True
+
+            # reading this variable is for backwards compat just in case
+            # someone was calling it with the variable from outside the
+            # kernel's build system
+            kdoc_werror = os.environ.get("KDOC_WERROR", None)
+            if kdoc_werror:
+                werror = kdoc_werror
+
+        # Some variables are global to the parser logic as a whole as they are
+        # used to send control configuration to KernelDoc class. As such,
+        # those variables are read-only inside the KernelDoc.
+        self.config = argparse.Namespace
+
+        self.config.verbose = verbose
+        self.config.werror = werror
+        self.config.wreturn = wreturn
+        self.config.wshort_desc = wshort_desc
+        self.config.wcontents_before_sections = wcontents_before_sections
+
+        if not logger:
+            self.config.log = logging.getLogger("kernel-doc")
+        else:
+            self.config.log = logger
+
+        self.config.warning = self.warning
+
+        self.config.src_tree = os.environ.get("SRCTREE", None)
+
+        # Initialize variables that are internal to KernelFiles
+
+        self.out_style = out_style
+
+        self.errors = 0
+        self.results = {}
+
+        self.files = set()
+        self.export_files = set()
+        self.export_table = {}
+
+    def parse(self, file_list, export_file=None):
+        """
+        Parse all files
+        """
+
+        glob = GlobSourceFiles(srctree=self.config.src_tree)
+
+        for fname in glob.parse_files(file_list, self.file_not_found_cb):
+            self.parse_file(fname)
+
+        for fname in glob.parse_files(export_file, self.file_not_found_cb):
+            self.process_export_file(fname)
+
+    def out_msg(self, fname, name, arg):
+        """
+        Return output messages from a file name using the output style
+        filtering.
+
+        If output type was not handled by the syler, return None.
+        """
+
+        # NOTE: we can add rules here to filter out unwanted parts,
+        # although OutputFormat.msg already does that.
+
+        return self.out_style.msg(fname, name, arg)
+
+    def msg(self, enable_lineno=False, export=False, internal=False,
+            symbol=None, nosymbol=None, no_doc_sections=False,
+            filenames=None, export_file=None):
+        """
+        Interacts over the kernel-doc results and output messages,
+        returning kernel-doc markups on each interaction
+        """
+
+        self.out_style.set_config(self.config)
+
+        if not filenames:
+            filenames = sorted(self.results.keys())
+
+        glob = GlobSourceFiles(srctree=self.config.src_tree)
+
+        for fname in filenames:
+            function_table = set()
+
+            if internal or export:
+                if not export_file:
+                    export_file = [fname]
+
+                for f in glob.parse_files(export_file, self.file_not_found_cb):
+                    function_table |= self.export_table[f]
+
+            if symbol:
+                for s in symbol:
+                    function_table.add(s)
+
+            self.out_style.set_filter(export, internal, symbol, nosymbol,
+                                      function_table, enable_lineno,
+                                      no_doc_sections)
+
+            msg = ""
+            if fname not in self.results:
+                self.config.log.warning("No kernel-doc for file %s", fname)
+                continue
+
+            for arg in self.results[fname]:
+                m = self.out_msg(fname, arg.name, arg)
+
+                if m is None:
+                    ln = arg.get("ln", 0)
+                    dtype = arg.get('type', "")
+
+                    self.config.log.warning("%s:%d Can't handle %s",
+                                            fname, ln, dtype)
+                else:
+                    msg += m
+
+            if msg:
+                yield fname, msg
diff --git a/scripts/lib/kdoc/kdoc_item.py b/scripts/lib/kdoc/kdoc_item.py
new file mode 100644
index 0000000000..b3b2257645
--- /dev/null
+++ b/scripts/lib/kdoc/kdoc_item.py
@@ -0,0 +1,42 @@
+# SPDX-License-Identifier: GPL-2.0
+#
+# A class that will, eventually, encapsulate all of the parsed data that we
+# then pass into the output modules.
+#
+
+class KdocItem:
+    def __init__(self, name, type, start_line, **other_stuff):
+        self.name = name
+        self.type = type
+        self.declaration_start_line = start_line
+        self.sections = {}
+        self.sections_start_lines = {}
+        self.parameterlist = []
+        self.parameterdesc_start_lines = []
+        self.parameterdescs = {}
+        self.parametertypes = {}
+        #
+        # Just save everything else into our own dict so that the output
+        # side can grab it directly as before.  As we move things into more
+        # structured data, this will, hopefully, fade away.
+        #
+        self.other_stuff = other_stuff
+
+    def get(self, key, default = None):
+        return self.other_stuff.get(key, default)
+
+    def __getitem__(self, key):
+        return self.get(key)
+
+    #
+    # Tracking of section and parameter information.
+    #
+    def set_sections(self, sections, start_lines):
+        self.sections = sections
+        self.section_start_lines = start_lines
+
+    def set_params(self, names, descs, types, starts):
+        self.parameterlist = names
+        self.parameterdescs = descs
+        self.parametertypes = types
+        self.parameterdesc_start_lines = starts
diff --git a/scripts/lib/kdoc/kdoc_output.py b/scripts/lib/kdoc/kdoc_output.py
new file mode 100644
index 0000000000..ea8914537b
--- /dev/null
+++ b/scripts/lib/kdoc/kdoc_output.py
@@ -0,0 +1,749 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+#
+# pylint: disable=C0301,R0902,R0911,R0912,R0913,R0914,R0915,R0917
+
+"""
+Implement output filters to print kernel-doc documentation.
+
+The implementation uses a virtual base class (OutputFormat) which
+contains a dispatches to virtual methods, and some code to filter
+out output messages.
+
+The actual implementation is done on one separate class per each type
+of output. Currently, there are output classes for ReST and man/troff.
+"""
+
+import os
+import re
+from datetime import datetime
+
+from kdoc_parser import KernelDoc, type_param
+from kdoc_re import KernRe
+
+
+function_pointer = KernRe(r"([^\(]*\(\*)\s*\)\s*\(([^\)]*)\)", cache=False)
+
+# match expressions used to find embedded type information
+type_constant = KernRe(r"\b``([^\`]+)``\b", cache=False)
+type_constant2 = KernRe(r"\%([-_*\w]+)", cache=False)
+type_func = KernRe(r"(\w+)\(\)", cache=False)
+type_param_ref = KernRe(r"([\!~\*]?)\@(\w*((\.\w+)|(->\w+))*(\.\.\.)?)", cache=False)
+
+# Special RST handling for func ptr params
+type_fp_param = KernRe(r"\@(\w+)\(\)", cache=False)
+
+# Special RST handling for structs with func ptr params
+type_fp_param2 = KernRe(r"\@(\w+->\S+)\(\)", cache=False)
+
+type_env = KernRe(r"(\$\w+)", cache=False)
+type_enum = KernRe(r"\&(enum\s*([_\w]+))", cache=False)
+type_struct = KernRe(r"\&(struct\s*([_\w]+))", cache=False)
+type_typedef = KernRe(r"\&(typedef\s*([_\w]+))", cache=False)
+type_union = KernRe(r"\&(union\s*([_\w]+))", cache=False)
+type_member = KernRe(r"\&([_\w]+)(\.|->)([_\w]+)", cache=False)
+type_fallback = KernRe(r"\&([_\w]+)", cache=False)
+type_member_func = type_member + KernRe(r"\(\)", cache=False)
+
+
+class OutputFormat:
+    """
+    Base class for OutputFormat. If used as-is, it means that only
+    warnings will be displayed.
+    """
+
+    # output mode.
+    OUTPUT_ALL          = 0 # output all symbols and doc sections
+    OUTPUT_INCLUDE      = 1 # output only specified symbols
+    OUTPUT_EXPORTED     = 2 # output exported symbols
+    OUTPUT_INTERNAL     = 3 # output non-exported symbols
+
+    # Virtual member to be overriden at the  inherited classes
+    highlights = []
+
+    def __init__(self):
+        """Declare internal vars and set mode to OUTPUT_ALL"""
+
+        self.out_mode = self.OUTPUT_ALL
+        self.enable_lineno = None
+        self.nosymbol = {}
+        self.symbol = None
+        self.function_table = None
+        self.config = None
+        self.no_doc_sections = False
+
+        self.data = ""
+
+    def set_config(self, config):
+        """
+        Setup global config variables used by both parser and output.
+        """
+
+        self.config = config
+
+    def set_filter(self, export, internal, symbol, nosymbol, function_table,
+                   enable_lineno, no_doc_sections):
+        """
+        Initialize filter variables according with the requested mode.
+
+        Only one choice is valid between export, internal and symbol.
+
+        The nosymbol filter can be used on all modes.
+        """
+
+        self.enable_lineno = enable_lineno
+        self.no_doc_sections = no_doc_sections
+        self.function_table = function_table
+
+        if symbol:
+            self.out_mode = self.OUTPUT_INCLUDE
+        elif export:
+            self.out_mode = self.OUTPUT_EXPORTED
+        elif internal:
+            self.out_mode = self.OUTPUT_INTERNAL
+        else:
+            self.out_mode = self.OUTPUT_ALL
+
+        if nosymbol:
+            self.nosymbol = set(nosymbol)
+
+
+    def highlight_block(self, block):
+        """
+        Apply the RST highlights to a sub-block of text.
+        """
+
+        for r, sub in self.highlights:
+            block = r.sub(sub, block)
+
+        return block
+
+    def out_warnings(self, args):
+        """
+        Output warnings for identifiers that will be displayed.
+        """
+
+        for log_msg in args.warnings:
+            self.config.warning(log_msg)
+
+    def check_doc(self, name, args):
+        """Check if DOC should be output"""
+
+        if self.no_doc_sections:
+            return False
+
+        if name in self.nosymbol:
+            return False
+
+        if self.out_mode == self.OUTPUT_ALL:
+            self.out_warnings(args)
+            return True
+
+        if self.out_mode == self.OUTPUT_INCLUDE:
+            if name in self.function_table:
+                self.out_warnings(args)
+                return True
+
+        return False
+
+    def check_declaration(self, dtype, name, args):
+        """
+        Checks if a declaration should be output or not based on the
+        filtering criteria.
+        """
+
+        if name in self.nosymbol:
+            return False
+
+        if self.out_mode == self.OUTPUT_ALL:
+            self.out_warnings(args)
+            return True
+
+        if self.out_mode in [self.OUTPUT_INCLUDE, self.OUTPUT_EXPORTED]:
+            if name in self.function_table:
+                return True
+
+        if self.out_mode == self.OUTPUT_INTERNAL:
+            if dtype != "function":
+                self.out_warnings(args)
+                return True
+
+            if name not in self.function_table:
+                self.out_warnings(args)
+                return True
+
+        return False
+
+    def msg(self, fname, name, args):
+        """
+        Handles a single entry from kernel-doc parser
+        """
+
+        self.data = ""
+
+        dtype = args.type
+
+        if dtype == "doc":
+            self.out_doc(fname, name, args)
+            return self.data
+
+        if not self.check_declaration(dtype, name, args):
+            return self.data
+
+        if dtype == "function":
+            self.out_function(fname, name, args)
+            return self.data
+
+        if dtype == "enum":
+            self.out_enum(fname, name, args)
+            return self.data
+
+        if dtype == "typedef":
+            self.out_typedef(fname, name, args)
+            return self.data
+
+        if dtype in ["struct", "union"]:
+            self.out_struct(fname, name, args)
+            return self.data
+
+        # Warn if some type requires an output logic
+        self.config.log.warning("doesn't now how to output '%s' block",
+                                dtype)
+
+        return None
+
+    # Virtual methods to be overridden by inherited classes
+    # At the base class, those do nothing.
+    def out_doc(self, fname, name, args):
+        """Outputs a DOC block"""
+
+    def out_function(self, fname, name, args):
+        """Outputs a function"""
+
+    def out_enum(self, fname, name, args):
+        """Outputs an enum"""
+
+    def out_typedef(self, fname, name, args):
+        """Outputs a typedef"""
+
+    def out_struct(self, fname, name, args):
+        """Outputs a struct"""
+
+
+class RestFormat(OutputFormat):
+    """Consts and functions used by ReST output"""
+
+    highlights = [
+        (type_constant, r"``\1``"),
+        (type_constant2, r"``\1``"),
+
+        # Note: need to escape () to avoid func matching later
+        (type_member_func, r":c:type:`\1\2\3\\(\\) <\1>`"),
+        (type_member, r":c:type:`\1\2\3 <\1>`"),
+        (type_fp_param, r"**\1\\(\\)**"),
+        (type_fp_param2, r"**\1\\(\\)**"),
+        (type_func, r"\1()"),
+        (type_enum, r":c:type:`\1 <\2>`"),
+        (type_struct, r":c:type:`\1 <\2>`"),
+        (type_typedef, r":c:type:`\1 <\2>`"),
+        (type_union, r":c:type:`\1 <\2>`"),
+
+        # in rst this can refer to any type
+        (type_fallback, r":c:type:`\1`"),
+        (type_param_ref, r"**\1\2**")
+    ]
+    blankline = "\n"
+
+    sphinx_literal = KernRe(r'^[^.].*::$', cache=False)
+    sphinx_cblock = KernRe(r'^\.\.\ +code-block::', cache=False)
+
+    def __init__(self):
+        """
+        Creates class variables.
+
+        Not really mandatory, but it is a good coding style and makes
+        pylint happy.
+        """
+
+        super().__init__()
+        self.lineprefix = ""
+
+    def print_lineno(self, ln):
+        """Outputs a line number"""
+
+        if self.enable_lineno and ln is not None:
+            ln += 1
+            self.data += f".. LINENO {ln}\n"
+
+    def output_highlight(self, args):
+        """
+        Outputs a C symbol that may require being converted to ReST using
+        the self.highlights variable
+        """
+
+        input_text = args
+        output = ""
+        in_literal = False
+        litprefix = ""
+        block = ""
+
+        for line in input_text.strip("\n").split("\n"):
+
+            # If we're in a literal block, see if we should drop out of it.
+            # Otherwise, pass the line straight through unmunged.
+            if in_literal:
+                if line.strip():  # If the line is not blank
+                    # If this is the first non-blank line in a literal block,
+                    # figure out the proper indent.
+                    if not litprefix:
+                        r = KernRe(r'^(\s*)')
+                        if r.match(line):
+                            litprefix = '^' + r.group(1)
+                        else:
+                            litprefix = ""
+
+                        output += line + "\n"
+                    elif not KernRe(litprefix).match(line):
+                        in_literal = False
+                    else:
+                        output += line + "\n"
+                else:
+                    output += line + "\n"
+
+            # Not in a literal block (or just dropped out)
+            if not in_literal:
+                block += line + "\n"
+                if self.sphinx_literal.match(line) or self.sphinx_cblock.match(line):
+                    in_literal = True
+                    litprefix = ""
+                    output += self.highlight_block(block)
+                    block = ""
+
+        # Handle any remaining block
+        if block:
+            output += self.highlight_block(block)
+
+        # Print the output with the line prefix
+        for line in output.strip("\n").split("\n"):
+            self.data += self.lineprefix + line + "\n"
+
+    def out_section(self, args, out_docblock=False):
+        """
+        Outputs a block section.
+
+        This could use some work; it's used to output the DOC: sections, and
+        starts by putting out the name of the doc section itself, but that
+        tends to duplicate a header already in the template file.
+        """
+        for section, text in args.sections.items():
+            # Skip sections that are in the nosymbol_table
+            if section in self.nosymbol:
+                continue
+
+            if out_docblock:
+                if not self.out_mode == self.OUTPUT_INCLUDE:
+                    self.data += f".. _{section}:\n\n"
+                    self.data += f'{self.lineprefix}**{section}**\n\n'
+            else:
+                self.data += f'{self.lineprefix}**{section}**\n\n'
+
+            self.print_lineno(args.section_start_lines.get(section, 0))
+            self.output_highlight(text)
+            self.data += "\n"
+        self.data += "\n"
+
+    def out_doc(self, fname, name, args):
+        if not self.check_doc(name, args):
+            return
+        self.out_section(args, out_docblock=True)
+
+    def out_function(self, fname, name, args):
+
+        oldprefix = self.lineprefix
+        signature = ""
+
+        func_macro = args.get('func_macro', False)
+        if func_macro:
+            signature = name
+        else:
+            if args.get('functiontype'):
+                signature = args['functiontype'] + " "
+            signature += name + " ("
+
+        ln = args.declaration_start_line
+        count = 0
+        for parameter in args.parameterlist:
+            if count != 0:
+                signature += ", "
+            count += 1
+            dtype = args.parametertypes.get(parameter, "")
+
+            if function_pointer.search(dtype):
+                signature += function_pointer.group(1) + parameter + function_pointer.group(3)
+            else:
+                signature += dtype
+
+        if not func_macro:
+            signature += ")"
+
+        self.print_lineno(ln)
+        if args.get('typedef') or not args.get('functiontype'):
+            self.data += f".. c:macro:: {name}\n\n"
+
+            if args.get('typedef'):
+                self.data += "   **Typedef**: "
+                self.lineprefix = ""
+                self.output_highlight(args.get('purpose', ""))
+                self.data += "\n\n**Syntax**\n\n"
+                self.data += f"  ``{signature}``\n\n"
+            else:
+                self.data += f"``{signature}``\n\n"
+        else:
+            self.data += f".. c:function:: {signature}\n\n"
+
+        if not args.get('typedef'):
+            self.print_lineno(ln)
+            self.lineprefix = "   "
+            self.output_highlight(args.get('purpose', ""))
+            self.data += "\n"
+
+        # Put descriptive text into a container (HTML <div>) to help set
+        # function prototypes apart
+        self.lineprefix = "  "
+
+        if args.parameterlist:
+            self.data += ".. container:: kernelindent\n\n"
+            self.data += f"{self.lineprefix}**Parameters**\n\n"
+
+        for parameter in args.parameterlist:
+            parameter_name = KernRe(r'\[.*').sub('', parameter)
+            dtype = args.parametertypes.get(parameter, "")
+
+            if dtype:
+                self.data += f"{self.lineprefix}``{dtype}``\n"
+            else:
+                self.data += f"{self.lineprefix}``{parameter}``\n"
+
+            self.print_lineno(args.parameterdesc_start_lines.get(parameter_name, 0))
+
+            self.lineprefix = "    "
+            if parameter_name in args.parameterdescs and \
+               args.parameterdescs[parameter_name] != KernelDoc.undescribed:
+
+                self.output_highlight(args.parameterdescs[parameter_name])
+                self.data += "\n"
+            else:
+                self.data += f"{self.lineprefix}*undescribed*\n\n"
+            self.lineprefix = "  "
+
+        self.out_section(args)
+        self.lineprefix = oldprefix
+
+    def out_enum(self, fname, name, args):
+
+        oldprefix = self.lineprefix
+        ln = args.declaration_start_line
+
+        self.data += f"\n\n.. c:enum:: {name}\n\n"
+
+        self.print_lineno(ln)
+        self.lineprefix = "  "
+        self.output_highlight(args.get('purpose', ''))
+        self.data += "\n"
+
+        self.data += ".. container:: kernelindent\n\n"
+        outer = self.lineprefix + "  "
+        self.lineprefix = outer + "  "
+        self.data += f"{outer}**Constants**\n\n"
+
+        for parameter in args.parameterlist:
+            self.data += f"{outer}``{parameter}``\n"
+
+            if args.parameterdescs.get(parameter, '') != KernelDoc.undescribed:
+                self.output_highlight(args.parameterdescs[parameter])
+            else:
+                self.data += f"{self.lineprefix}*undescribed*\n\n"
+            self.data += "\n"
+
+        self.lineprefix = oldprefix
+        self.out_section(args)
+
+    def out_typedef(self, fname, name, args):
+
+        oldprefix = self.lineprefix
+        ln = args.declaration_start_line
+
+        self.data += f"\n\n.. c:type:: {name}\n\n"
+
+        self.print_lineno(ln)
+        self.lineprefix = "   "
+
+        self.output_highlight(args.get('purpose', ''))
+
+        self.data += "\n"
+
+        self.lineprefix = oldprefix
+        self.out_section(args)
+
+    def out_struct(self, fname, name, args):
+
+        purpose = args.get('purpose', "")
+        declaration = args.get('definition', "")
+        dtype = args.type
+        ln = args.declaration_start_line
+
+        self.data += f"\n\n.. c:{dtype}:: {name}\n\n"
+
+        self.print_lineno(ln)
+
+        oldprefix = self.lineprefix
+        self.lineprefix += "  "
+
+        self.output_highlight(purpose)
+        self.data += "\n"
+
+        self.data += ".. container:: kernelindent\n\n"
+        self.data += f"{self.lineprefix}**Definition**::\n\n"
+
+        self.lineprefix = self.lineprefix + "  "
+
+        declaration = declaration.replace("\t", self.lineprefix)
+
+        self.data += f"{self.lineprefix}{dtype} {name}" + ' {' + "\n"
+        self.data += f"{declaration}{self.lineprefix}" + "};\n\n"
+
+        self.lineprefix = "  "
+        self.data += f"{self.lineprefix}**Members**\n\n"
+        for parameter in args.parameterlist:
+            if not parameter or parameter.startswith("#"):
+                continue
+
+            parameter_name = parameter.split("[", maxsplit=1)[0]
+
+            if args.parameterdescs.get(parameter_name) == KernelDoc.undescribed:
+                continue
+
+            self.print_lineno(args.parameterdesc_start_lines.get(parameter_name, 0))
+
+            self.data += f"{self.lineprefix}``{parameter}``\n"
+
+            self.lineprefix = "    "
+            self.output_highlight(args.parameterdescs[parameter_name])
+            self.lineprefix = "  "
+
+            self.data += "\n"
+
+        self.data += "\n"
+
+        self.lineprefix = oldprefix
+        self.out_section(args)
+
+
+class ManFormat(OutputFormat):
+    """Consts and functions used by man pages output"""
+
+    highlights = (
+        (type_constant, r"\1"),
+        (type_constant2, r"\1"),
+        (type_func, r"\\fB\1\\fP"),
+        (type_enum, r"\\fI\1\\fP"),
+        (type_struct, r"\\fI\1\\fP"),
+        (type_typedef, r"\\fI\1\\fP"),
+        (type_union, r"\\fI\1\\fP"),
+        (type_param, r"\\fI\1\\fP"),
+        (type_param_ref, r"\\fI\1\2\\fP"),
+        (type_member, r"\\fI\1\2\3\\fP"),
+        (type_fallback, r"\\fI\1\\fP")
+    )
+    blankline = ""
+
+    date_formats = [
+        "%a %b %d %H:%M:%S %Z %Y",
+        "%a %b %d %H:%M:%S %Y",
+        "%Y-%m-%d",
+        "%b %d %Y",
+        "%B %d %Y",
+        "%m %d %Y",
+    ]
+
+    def __init__(self, modulename):
+        """
+        Creates class variables.
+
+        Not really mandatory, but it is a good coding style and makes
+        pylint happy.
+        """
+
+        super().__init__()
+        self.modulename = modulename
+
+        dt = None
+        tstamp = os.environ.get("KBUILD_BUILD_TIMESTAMP")
+        if tstamp:
+            for fmt in self.date_formats:
+                try:
+                    dt = datetime.strptime(tstamp, fmt)
+                    break
+                except ValueError:
+                    pass
+
+        if not dt:
+            dt = datetime.now()
+
+        self.man_date = dt.strftime("%B %Y")
+
+    def output_highlight(self, block):
+        """
+        Outputs a C symbol that may require being highlighted with
+        self.highlights variable using troff syntax
+        """
+
+        contents = self.highlight_block(block)
+
+        if isinstance(contents, list):
+            contents = "\n".join(contents)
+
+        for line in contents.strip("\n").split("\n"):
+            line = KernRe(r"^\s*").sub("", line)
+            if not line:
+                continue
+
+            if line[0] == ".":
+                self.data += "\\&" + line + "\n"
+            else:
+                self.data += line + "\n"
+
+    def out_doc(self, fname, name, args):
+        if not self.check_doc(name, args):
+            return
+
+        self.data += f'.TH "{self.modulename}" 9 "{self.modulename}" "{self.man_date}" "API Manual" LINUX' + "\n"
+
+        for section, text in args.sections.items():
+            self.data += f'.SH "{section}"' + "\n"
+            self.output_highlight(text)
+
+    def out_function(self, fname, name, args):
+        """output function in man"""
+
+        self.data += f'.TH "{name}" 9 "{name}" "{self.man_date}" "Kernel Hacker\'s Manual" LINUX' + "\n"
+
+        self.data += ".SH NAME\n"
+        self.data += f"{name} \\- {args['purpose']}\n"
+
+        self.data += ".SH SYNOPSIS\n"
+        if args.get('functiontype', ''):
+            self.data += f'.B "{args["functiontype"]}" {name}' + "\n"
+        else:
+            self.data += f'.B "{name}' + "\n"
+
+        count = 0
+        parenth = "("
+        post = ","
+
+        for parameter in args.parameterlist:
+            if count == len(args.parameterlist) - 1:
+                post = ");"
+
+            dtype = args.parametertypes.get(parameter, "")
+            if function_pointer.match(dtype):
+                # Pointer-to-function
+                self.data += f'".BI "{parenth}{function_pointer.group(1)}" " ") ({function_pointer.group(2)}){post}"' + "\n"
+            else:
+                dtype = KernRe(r'([^\*])$').sub(r'\1 ', dtype)
+
+                self.data += f'.BI "{parenth}{dtype}"  "{post}"' + "\n"
+            count += 1
+            parenth = ""
+
+        if args.parameterlist:
+            self.data += ".SH ARGUMENTS\n"
+
+        for parameter in args.parameterlist:
+            parameter_name = re.sub(r'\[.*', '', parameter)
+
+            self.data += f'.IP "{parameter}" 12' + "\n"
+            self.output_highlight(args.parameterdescs.get(parameter_name, ""))
+
+        for section, text in args.sections.items():
+            self.data += f'.SH "{section.upper()}"' + "\n"
+            self.output_highlight(text)
+
+    def out_enum(self, fname, name, args):
+        self.data += f'.TH "{self.modulename}" 9 "enum {name}" "{self.man_date}" "API Manual" LINUX' + "\n"
+
+        self.data += ".SH NAME\n"
+        self.data += f"enum {name} \\- {args['purpose']}\n"
+
+        self.data += ".SH SYNOPSIS\n"
+        self.data += f"enum {name}" + " {\n"
+
+        count = 0
+        for parameter in args.parameterlist:
+            self.data += f'.br\n.BI "    {parameter}"' + "\n"
+            if count == len(args.parameterlist) - 1:
+                self.data += "\n};\n"
+            else:
+                self.data += ", \n.br\n"
+
+            count += 1
+
+        self.data += ".SH Constants\n"
+
+        for parameter in args.parameterlist:
+            parameter_name = KernRe(r'\[.*').sub('', parameter)
+            self.data += f'.IP "{parameter}" 12' + "\n"
+            self.output_highlight(args.parameterdescs.get(parameter_name, ""))
+
+        for section, text in args.sections.items():
+            self.data += f'.SH "{section}"' + "\n"
+            self.output_highlight(text)
+
+    def out_typedef(self, fname, name, args):
+        module = self.modulename
+        purpose = args.get('purpose')
+
+        self.data += f'.TH "{module}" 9 "{name}" "{self.man_date}" "API Manual" LINUX' + "\n"
+
+        self.data += ".SH NAME\n"
+        self.data += f"typedef {name} \\- {purpose}\n"
+
+        for section, text in args.sections.items():
+            self.data += f'.SH "{section}"' + "\n"
+            self.output_highlight(text)
+
+    def out_struct(self, fname, name, args):
+        module = self.modulename
+        purpose = args.get('purpose')
+        definition = args.get('definition')
+
+        self.data += f'.TH "{module}" 9 "{args.type} {name}" "{self.man_date}" "API Manual" LINUX' + "\n"
+
+        self.data += ".SH NAME\n"
+        self.data += f"{args.type} {name} \\- {purpose}\n"
+
+        # Replace tabs with two spaces and handle newlines
+        declaration = definition.replace("\t", "  ")
+        declaration = KernRe(r"\n").sub('"\n.br\n.BI "', declaration)
+
+        self.data += ".SH SYNOPSIS\n"
+        self.data += f"{args.type} {name} " + "{" + "\n.br\n"
+        self.data += f'.BI "{declaration}\n' + "};\n.br\n\n"
+
+        self.data += ".SH Members\n"
+        for parameter in args.parameterlist:
+            if parameter.startswith("#"):
+                continue
+
+            parameter_name = re.sub(r"\[.*", "", parameter)
+
+            if args.parameterdescs.get(parameter_name) == KernelDoc.undescribed:
+                continue
+
+            self.data += f'.IP "{parameter}" 12' + "\n"
+            self.output_highlight(args.parameterdescs.get(parameter_name))
+
+        for section, text in args.sections.items():
+            self.data += f'.SH "{section}"' + "\n"
+            self.output_highlight(text)
diff --git a/scripts/lib/kdoc/kdoc_parser.py b/scripts/lib/kdoc/kdoc_parser.py
new file mode 100644
index 0000000000..fe730099ec
--- /dev/null
+++ b/scripts/lib/kdoc/kdoc_parser.py
@@ -0,0 +1,1669 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+#
+# pylint: disable=C0301,C0302,R0904,R0912,R0913,R0914,R0915,R0917,R1702
+
+"""
+kdoc_parser
+===========
+
+Read a C language source or header FILE and extract embedded
+documentation comments
+"""
+
+import sys
+import re
+from pprint import pformat
+
+from kdoc_re import NestedMatch, KernRe
+from kdoc_item import KdocItem
+
+#
+# Regular expressions used to parse kernel-doc markups at KernelDoc class.
+#
+# Let's declare them in lowercase outside any class to make easier to
+# convert from the python script.
+#
+# As those are evaluated at the beginning, no need to cache them
+#
+
+# Allow whitespace at end of comment start.
+doc_start = KernRe(r'^/\*\*\s*$', cache=False)
+
+doc_end = KernRe(r'\*/', cache=False)
+doc_com = KernRe(r'\s*\*\s*', cache=False)
+doc_com_body = KernRe(r'\s*\* ?', cache=False)
+doc_decl = doc_com + KernRe(r'(\w+)', cache=False)
+
+# @params and a strictly limited set of supported section names
+# Specifically:
+#   Match @word:
+#         @...:
+#         @{section-name}:
+# while trying to not match literal block starts like "example::"
+#
+known_section_names = 'description|context|returns?|notes?|examples?'
+known_sections = KernRe(known_section_names, flags = re.I)
+doc_sect = doc_com + \
+    KernRe(r'\s*(\@[.\w]+|\@\.\.\.|' + known_section_names + r')\s*:([^:].*)?$',
+           flags=re.I, cache=False)
+
+doc_content = doc_com_body + KernRe(r'(.*)', cache=False)
+doc_inline_start = KernRe(r'^\s*/\*\*\s*$', cache=False)
+doc_inline_sect = KernRe(r'\s*\*\s*(@\s*[\w][\w\.]*\s*):(.*)', cache=False)
+doc_inline_end = KernRe(r'^\s*\*/\s*$', cache=False)
+doc_inline_oneline = KernRe(r'^\s*/\*\*\s*(@[\w\s]+):\s*(.*)\s*\*/\s*$', cache=False)
+attribute = KernRe(r"__attribute__\s*\(\([a-z0-9,_\*\s\(\)]*\)\)",
+               flags=re.I | re.S, cache=False)
+
+export_symbol = KernRe(r'^\s*EXPORT_SYMBOL(_GPL)?\s*\(\s*(\w+)\s*\)\s*', cache=False)
+export_symbol_ns = KernRe(r'^\s*EXPORT_SYMBOL_NS(_GPL)?\s*\(\s*(\w+)\s*,\s*"\S+"\)\s*', cache=False)
+
+type_param = KernRe(r"\@(\w*((\.\w+)|(->\w+))*(\.\.\.)?)", cache=False)
+
+#
+# Tests for the beginning of a kerneldoc block in its various forms.
+#
+doc_block = doc_com + KernRe(r'DOC:\s*(.*)?', cache=False)
+doc_begin_data = KernRe(r"^\s*\*?\s*(struct|union|enum|typedef)\b\s*(\w*)", cache = False)
+doc_begin_func = KernRe(str(doc_com) +			# initial " * '
+                        r"(?:\w+\s*\*\s*)?" + 		# type (not captured)
+                        r'(?:define\s+)?' + 		# possible "define" (not captured)
+                        r'(\w+)\s*(?:\(\w*\))?\s*' +	# name and optional "(...)"
+                        r'(?:[-:].*)?$',		# description (not captured)
+                        cache = False)
+
+#
+# A little helper to get rid of excess white space
+#
+multi_space = KernRe(r'\s\s+')
+def trim_whitespace(s):
+    return multi_space.sub(' ', s.strip())
+
+class state:
+    """
+    State machine enums
+    """
+
+    # Parser states
+    NORMAL        = 0        # normal code
+    NAME          = 1        # looking for function name
+    DECLARATION   = 2        # We have seen a declaration which might not be done
+    BODY          = 3        # the body of the comment
+    SPECIAL_SECTION = 4      # doc section ending with a blank line
+    PROTO         = 5        # scanning prototype
+    DOCBLOCK      = 6        # documentation block
+    INLINE_NAME   = 7        # gathering doc outside main block
+    INLINE_TEXT   = 8	     # reading the body of inline docs
+
+    name = [
+        "NORMAL",
+        "NAME",
+        "DECLARATION",
+        "BODY",
+        "SPECIAL_SECTION",
+        "PROTO",
+        "DOCBLOCK",
+        "INLINE_NAME",
+        "INLINE_TEXT",
+    ]
+
+
+SECTION_DEFAULT = "Description"  # default section
+
+class KernelEntry:
+
+    def __init__(self, config, ln):
+        self.config = config
+
+        self._contents = []
+        self.prototype = ""
+
+        self.warnings = []
+
+        self.parameterlist = []
+        self.parameterdescs = {}
+        self.parametertypes = {}
+        self.parameterdesc_start_lines = {}
+
+        self.section_start_lines = {}
+        self.sections = {}
+
+        self.anon_struct_union = False
+
+        self.leading_space = None
+
+        # State flags
+        self.brcount = 0
+        self.declaration_start_line = ln + 1
+
+    #
+    # Management of section contents
+    #
+    def add_text(self, text):
+        self._contents.append(text)
+
+    def contents(self):
+        return '\n'.join(self._contents) + '\n'
+
+    # TODO: rename to emit_message after removal of kernel-doc.pl
+    def emit_msg(self, log_msg, warning=True):
+        """Emit a message"""
+
+        if not warning:
+            self.config.log.info(log_msg)
+            return
+
+        # Delegate warning output to output logic, as this way it
+        # will report warnings/info only for symbols that are output
+
+        self.warnings.append(log_msg)
+        return
+
+    #
+    # Begin a new section.
+    #
+    def begin_section(self, line_no, title = SECTION_DEFAULT, dump = False):
+        if dump:
+            self.dump_section(start_new = True)
+        self.section = title
+        self.new_start_line = line_no
+
+    def dump_section(self, start_new=True):
+        """
+        Dumps section contents to arrays/hashes intended for that purpose.
+        """
+        #
+        # If we have accumulated no contents in the default ("description")
+        # section, don't bother.
+        #
+        if self.section == SECTION_DEFAULT and not self._contents:
+            return
+        name = self.section
+        contents = self.contents()
+
+        if type_param.match(name):
+            name = type_param.group(1)
+
+            self.parameterdescs[name] = contents
+            self.parameterdesc_start_lines[name] = self.new_start_line
+
+            self.new_start_line = 0
+
+        else:
+            if name in self.sections and self.sections[name] != "":
+                # Only warn on user-specified duplicate section names
+                if name != SECTION_DEFAULT:
+                    self.emit_msg(self.new_start_line,
+                                  f"duplicate section name '{name}'\n")
+                # Treat as a new paragraph - add a blank line
+                self.sections[name] += '\n' + contents
+            else:
+                self.sections[name] = contents
+                self.section_start_lines[name] = self.new_start_line
+                self.new_start_line = 0
+
+#        self.config.log.debug("Section: %s : %s", name, pformat(vars(self)))
+
+        if start_new:
+            self.section = SECTION_DEFAULT
+            self._contents = []
+
+
+class KernelDoc:
+    """
+    Read a C language source or header FILE and extract embedded
+    documentation comments.
+    """
+
+    # Section names
+
+    section_context = "Context"
+    section_return = "Return"
+
+    undescribed = "-- undescribed --"
+
+    def __init__(self, config, fname):
+        """Initialize internal variables"""
+
+        self.fname = fname
+        self.config = config
+
+        # Initial state for the state machines
+        self.state = state.NORMAL
+
+        # Store entry currently being processed
+        self.entry = None
+
+        # Place all potential outputs into an array
+        self.entries = []
+
+        #
+        # We need Python 3.7 for its "dicts remember the insertion
+        # order" guarantee
+        #
+        if sys.version_info.major == 3 and sys.version_info.minor < 7:
+            self.emit_msg(0,
+                          'Python 3.7 or later is required for correct results')
+
+    def emit_msg(self, ln, msg, warning=True):
+        """Emit a message"""
+
+        log_msg = f"{self.fname}:{ln} {msg}"
+
+        if self.entry:
+            self.entry.emit_msg(log_msg, warning)
+            return
+
+        if warning:
+            self.config.log.warning(log_msg)
+        else:
+            self.config.log.info(log_msg)
+
+    def dump_section(self, start_new=True):
+        """
+        Dumps section contents to arrays/hashes intended for that purpose.
+        """
+
+        if self.entry:
+            self.entry.dump_section(start_new)
+
+    # TODO: rename it to store_declaration after removal of kernel-doc.pl
+    def output_declaration(self, dtype, name, **args):
+        """
+        Stores the entry into an entry array.
+
+        The actual output and output filters will be handled elsewhere
+        """
+
+        item = KdocItem(name, dtype, self.entry.declaration_start_line, **args)
+        item.warnings = self.entry.warnings
+
+        # Drop empty sections
+        # TODO: improve empty sections logic to emit warnings
+        sections = self.entry.sections
+        for section in ["Description", "Return"]:
+            if section in sections and not sections[section].rstrip():
+                del sections[section]
+        item.set_sections(sections, self.entry.section_start_lines)
+        item.set_params(self.entry.parameterlist, self.entry.parameterdescs,
+                        self.entry.parametertypes,
+                        self.entry.parameterdesc_start_lines)
+        self.entries.append(item)
+
+        self.config.log.debug("Output: %s:%s = %s", dtype, name, pformat(args))
+
+    def reset_state(self, ln):
+        """
+        Ancillary routine to create a new entry. It initializes all
+        variables used by the state machine.
+        """
+
+        self.entry = KernelEntry(self.config, ln)
+
+        # State flags
+        self.state = state.NORMAL
+
+    def push_parameter(self, ln, decl_type, param, dtype,
+                       org_arg, declaration_name):
+        """
+        Store parameters and their descriptions at self.entry.
+        """
+
+        if self.entry.anon_struct_union and dtype == "" and param == "}":
+            return  # Ignore the ending }; from anonymous struct/union
+
+        self.entry.anon_struct_union = False
+
+        param = KernRe(r'[\[\)].*').sub('', param, count=1)
+
+        if dtype == "" and param.endswith("..."):
+            if KernRe(r'\w\.\.\.$').search(param):
+                # For named variable parameters of the form `x...`,
+                # remove the dots
+                param = param[:-3]
+            else:
+                # Handles unnamed variable parameters
+                param = "..."
+
+            if param not in self.entry.parameterdescs or \
+                not self.entry.parameterdescs[param]:
+
+                self.entry.parameterdescs[param] = "variable arguments"
+
+        elif dtype == "" and (not param or param == "void"):
+            param = "void"
+            self.entry.parameterdescs[param] = "no arguments"
+
+        elif dtype == "" and param in ["struct", "union"]:
+            # Handle unnamed (anonymous) union or struct
+            dtype = param
+            param = "{unnamed_" + param + "}"
+            self.entry.parameterdescs[param] = "anonymous\n"
+            self.entry.anon_struct_union = True
+
+        # Handle cache group enforcing variables: they do not need
+        # to be described in header files
+        elif "__cacheline_group" in param:
+            # Ignore __cacheline_group_begin and __cacheline_group_end
+            return
+
+        # Warn if parameter has no description
+        # (but ignore ones starting with # as these are not parameters
+        # but inline preprocessor statements)
+        if param not in self.entry.parameterdescs and not param.startswith("#"):
+            self.entry.parameterdescs[param] = self.undescribed
+
+            if "." not in param:
+                if decl_type == 'function':
+                    dname = f"{decl_type} parameter"
+                else:
+                    dname = f"{decl_type} member"
+
+                self.emit_msg(ln,
+                              f"{dname} '{param}' not described in '{declaration_name}'")
+
+        # Strip spaces from param so that it is one continuous string on
+        # parameterlist. This fixes a problem where check_sections()
+        # cannot find a parameter like "addr[6 + 2]" because it actually
+        # appears as "addr[6", "+", "2]" on the parameter list.
+        # However, it's better to maintain the param string unchanged for
+        # output, so just weaken the string compare in check_sections()
+        # to ignore "[blah" in a parameter string.
+
+        self.entry.parameterlist.append(param)
+        org_arg = KernRe(r'\s\s+').sub(' ', org_arg)
+        self.entry.parametertypes[param] = org_arg
+
+
+    def create_parameter_list(self, ln, decl_type, args,
+                              splitter, declaration_name):
+        """
+        Creates a list of parameters, storing them at self.entry.
+        """
+
+        # temporarily replace all commas inside function pointer definition
+        arg_expr = KernRe(r'(\([^\),]+),')
+        while arg_expr.search(args):
+            args = arg_expr.sub(r"\1#", args)
+
+        for arg in args.split(splitter):
+            # Strip comments
+            arg = KernRe(r'\/\*.*\*\/').sub('', arg)
+
+            # Ignore argument attributes
+            arg = KernRe(r'\sPOS0?\s').sub(' ', arg)
+
+            # Strip leading/trailing spaces
+            arg = arg.strip()
+            arg = KernRe(r'\s+').sub(' ', arg, count=1)
+
+            if arg.startswith('#'):
+                # Treat preprocessor directive as a typeless variable just to fill
+                # corresponding data structures "correctly". Catch it later in
+                # output_* subs.
+
+                # Treat preprocessor directive as a typeless variable
+                self.push_parameter(ln, decl_type, arg, "",
+                                    "", declaration_name)
+
+            elif KernRe(r'\(.+\)\s*\(').search(arg):
+                # Pointer-to-function
+
+                arg = arg.replace('#', ',')
+
+                r = KernRe(r'[^\(]+\(\*?\s*([\w\[\]\.]*)\s*\)')
+                if r.match(arg):
+                    param = r.group(1)
+                else:
+                    self.emit_msg(ln, f"Invalid param: {arg}")
+                    param = arg
+
+                dtype = KernRe(r'([^\(]+\(\*?)\s*' + re.escape(param)).sub(r'\1', arg)
+                self.push_parameter(ln, decl_type, param, dtype,
+                                    arg, declaration_name)
+
+            elif KernRe(r'\(.+\)\s*\[').search(arg):
+                # Array-of-pointers
+
+                arg = arg.replace('#', ',')
+                r = KernRe(r'[^\(]+\(\s*\*\s*([\w\[\]\.]*?)\s*(\s*\[\s*[\w]+\s*\]\s*)*\)')
+                if r.match(arg):
+                    param = r.group(1)
+                else:
+                    self.emit_msg(ln, f"Invalid param: {arg}")
+                    param = arg
+
+                dtype = KernRe(r'([^\(]+\(\*?)\s*' + re.escape(param)).sub(r'\1', arg)
+
+                self.push_parameter(ln, decl_type, param, dtype,
+                                    arg, declaration_name)
+
+            elif arg:
+                arg = KernRe(r'\s*:\s*').sub(":", arg)
+                arg = KernRe(r'\s*\[').sub('[', arg)
+
+                args = KernRe(r'\s*,\s*').split(arg)
+                if args[0] and '*' in args[0]:
+                    args[0] = re.sub(r'(\*+)\s*', r' \1', args[0])
+
+                first_arg = []
+                r = KernRe(r'^(.*\s+)(.*?\[.*\].*)$')
+                if args[0] and r.match(args[0]):
+                    args.pop(0)
+                    first_arg.extend(r.group(1))
+                    first_arg.append(r.group(2))
+                else:
+                    first_arg = KernRe(r'\s+').split(args.pop(0))
+
+                args.insert(0, first_arg.pop())
+                dtype = ' '.join(first_arg)
+
+                for param in args:
+                    if KernRe(r'^(\*+)\s*(.*)').match(param):
+                        r = KernRe(r'^(\*+)\s*(.*)')
+                        if not r.match(param):
+                            self.emit_msg(ln, f"Invalid param: {param}")
+                            continue
+
+                        param = r.group(1)
+
+                        self.push_parameter(ln, decl_type, r.group(2),
+                                            f"{dtype} {r.group(1)}",
+                                            arg, declaration_name)
+
+                    elif KernRe(r'(.*?):(\w+)').search(param):
+                        r = KernRe(r'(.*?):(\w+)')
+                        if not r.match(param):
+                            self.emit_msg(ln, f"Invalid param: {param}")
+                            continue
+
+                        if dtype != "":  # Skip unnamed bit-fields
+                            self.push_parameter(ln, decl_type, r.group(1),
+                                                f"{dtype}:{r.group(2)}",
+                                                arg, declaration_name)
+                    else:
+                        self.push_parameter(ln, decl_type, param, dtype,
+                                            arg, declaration_name)
+
+    def check_sections(self, ln, decl_name, decl_type):
+        """
+        Check for errors inside sections, emitting warnings if not found
+        parameters are described.
+        """
+        for section in self.entry.sections:
+            if section not in self.entry.parameterlist and \
+               not known_sections.search(section):
+                if decl_type == 'function':
+                    dname = f"{decl_type} parameter"
+                else:
+                    dname = f"{decl_type} member"
+                self.emit_msg(ln,
+                              f"Excess {dname} '{section}' description in '{decl_name}'")
+
+    def check_return_section(self, ln, declaration_name, return_type):
+        """
+        If the function doesn't return void, warns about the lack of a
+        return description.
+        """
+
+        if not self.config.wreturn:
+            return
+
+        # Ignore an empty return type (It's a macro)
+        # Ignore functions with a "void" return type (but not "void *")
+        if not return_type or KernRe(r'void\s*\w*\s*$').search(return_type):
+            return
+
+        if not self.entry.sections.get("Return", None):
+            self.emit_msg(ln,
+                          f"No description found for return value of '{declaration_name}'")
+
+    def dump_struct(self, ln, proto):
+        """
+        Store an entry for an struct or union
+        """
+
+        type_pattern = r'(struct|union)'
+
+        qualifiers = [
+            "__attribute__",
+            "__packed",
+            "__aligned",
+            "____cacheline_aligned_in_smp",
+            "____cacheline_aligned",
+        ]
+
+        definition_body = r'\{(.*)\}\s*' + "(?:" + '|'.join(qualifiers) + ")?"
+        struct_members = KernRe(type_pattern + r'([^\{\};]+)(\{)([^\{\}]*)(\})([^\{\}\;]*)(\;)')
+
+        # Extract struct/union definition
+        members = None
+        declaration_name = None
+        decl_type = None
+
+        r = KernRe(type_pattern + r'\s+(\w+)\s*' + definition_body)
+        if r.search(proto):
+            decl_type = r.group(1)
+            declaration_name = r.group(2)
+            members = r.group(3)
+        else:
+            r = KernRe(r'typedef\s+' + type_pattern + r'\s*' + definition_body + r'\s*(\w+)\s*;')
+
+            if r.search(proto):
+                decl_type = r.group(1)
+                declaration_name = r.group(3)
+                members = r.group(2)
+
+        if not members:
+            self.emit_msg(ln, f"{proto} error: Cannot parse struct or union!")
+            return
+
+        if self.entry.identifier != declaration_name:
+            self.emit_msg(ln,
+                          f"expecting prototype for {decl_type} {self.entry.identifier}. Prototype was for {decl_type} {declaration_name} instead\n")
+            return
+
+        args_pattern = r'([^,)]+)'
+
+        sub_prefixes = [
+            (KernRe(r'\/\*\s*private:.*?\/\*\s*public:.*?\*\/', re.S | re.I), ''),
+            (KernRe(r'\/\*\s*private:.*', re.S | re.I), ''),
+
+            # Strip comments
+            (KernRe(r'\/\*.*?\*\/', re.S), ''),
+
+            # Strip attributes
+            (attribute, ' '),
+            (KernRe(r'\s*__aligned\s*\([^;]*\)', re.S), ' '),
+            (KernRe(r'\s*__counted_by\s*\([^;]*\)', re.S), ' '),
+            (KernRe(r'\s*__counted_by_(le|be)\s*\([^;]*\)', re.S), ' '),
+            (KernRe(r'\s*__packed\s*', re.S), ' '),
+            (KernRe(r'\s*CRYPTO_MINALIGN_ATTR', re.S), ' '),
+            (KernRe(r'\s*____cacheline_aligned_in_smp', re.S), ' '),
+            (KernRe(r'\s*____cacheline_aligned', re.S), ' '),
+
+            # Unwrap struct_group macros based on this definition:
+            # __struct_group(TAG, NAME, ATTRS, MEMBERS...)
+            # which has variants like: struct_group(NAME, MEMBERS...)
+            # Only MEMBERS arguments require documentation.
+            #
+            # Parsing them happens on two steps:
+            #
+            # 1. drop struct group arguments that aren't at MEMBERS,
+            #    storing them as STRUCT_GROUP(MEMBERS)
+            #
+            # 2. remove STRUCT_GROUP() ancillary macro.
+            #
+            # The original logic used to remove STRUCT_GROUP() using an
+            # advanced regex:
+            #
+            #   \bSTRUCT_GROUP(\(((?:(?>[^)(]+)|(?1))*)\))[^;]*;
+            #
+            # with two patterns that are incompatible with
+            # Python re module, as it has:
+            #
+            #   - a recursive pattern: (?1)
+            #   - an atomic grouping: (?>...)
+            #
+            # I tried a simpler version: but it didn't work either:
+            #   \bSTRUCT_GROUP\(([^\)]+)\)[^;]*;
+            #
+            # As it doesn't properly match the end parenthesis on some cases.
+            #
+            # So, a better solution was crafted: there's now a NestedMatch
+            # class that ensures that delimiters after a search are properly
+            # matched. So, the implementation to drop STRUCT_GROUP() will be
+            # handled in separate.
+
+            (KernRe(r'\bstruct_group\s*\(([^,]*,)', re.S), r'STRUCT_GROUP('),
+            (KernRe(r'\bstruct_group_attr\s*\(([^,]*,){2}', re.S), r'STRUCT_GROUP('),
+            (KernRe(r'\bstruct_group_tagged\s*\(([^,]*),([^,]*),', re.S), r'struct \1 \2; STRUCT_GROUP('),
+            (KernRe(r'\b__struct_group\s*\(([^,]*,){3}', re.S), r'STRUCT_GROUP('),
+
+            # Replace macros
+            #
+            # TODO: use NestedMatch for FOO($1, $2, ...) matches
+            #
+            # it is better to also move those to the NestedMatch logic,
+            # to ensure that parenthesis will be properly matched.
+
+            (KernRe(r'__ETHTOOL_DECLARE_LINK_MODE_MASK\s*\(([^\)]+)\)', re.S), r'DECLARE_BITMAP(\1, __ETHTOOL_LINK_MODE_MASK_NBITS)'),
+            (KernRe(r'DECLARE_PHY_INTERFACE_MASK\s*\(([^\)]+)\)', re.S), r'DECLARE_BITMAP(\1, PHY_INTERFACE_MODE_MAX)'),
+            (KernRe(r'DECLARE_BITMAP\s*\(' + args_pattern + r',\s*' + args_pattern + r'\)', re.S), r'unsigned long \1[BITS_TO_LONGS(\2)]'),
+            (KernRe(r'DECLARE_HASHTABLE\s*\(' + args_pattern + r',\s*' + args_pattern + r'\)', re.S), r'unsigned long \1[1 << ((\2) - 1)]'),
+            (KernRe(r'DECLARE_KFIFO\s*\(' + args_pattern + r',\s*' + args_pattern + r',\s*' + args_pattern + r'\)', re.S), r'\2 *\1'),
+            (KernRe(r'DECLARE_KFIFO_PTR\s*\(' + args_pattern + r',\s*' + args_pattern + r'\)', re.S), r'\2 *\1'),
+            (KernRe(r'(?:__)?DECLARE_FLEX_ARRAY\s*\(' + args_pattern + r',\s*' + args_pattern + r'\)', re.S), r'\1 \2[]'),
+            (KernRe(r'DEFINE_DMA_UNMAP_ADDR\s*\(' + args_pattern + r'\)', re.S), r'dma_addr_t \1'),
+            (KernRe(r'DEFINE_DMA_UNMAP_LEN\s*\(' + args_pattern + r'\)', re.S), r'__u32 \1'),
+            (KernRe(r'VIRTIO_DECLARE_FEATURES\s*\(' + args_pattern + r'\)', re.S), r'u64 \1; u64 \1_array[VIRTIO_FEATURES_DWORDS]'),
+        ]
+
+        # Regexes here are guaranteed to have the end limiter matching
+        # the start delimiter. Yet, right now, only one replace group
+        # is allowed.
+
+        sub_nested_prefixes = [
+            (re.compile(r'\bSTRUCT_GROUP\('), r'\1'),
+        ]
+
+        for search, sub in sub_prefixes:
+            members = search.sub(sub, members)
+
+        nested = NestedMatch()
+
+        for search, sub in sub_nested_prefixes:
+            members = nested.sub(search, sub, members)
+
+        # Keeps the original declaration as-is
+        declaration = members
+
+        # Split nested struct/union elements
+        #
+        # This loop was simpler at the original kernel-doc perl version, as
+        #   while ($members =~ m/$struct_members/) { ... }
+        # reads 'members' string on each interaction.
+        #
+        # Python behavior is different: it parses 'members' only once,
+        # creating a list of tuples from the first interaction.
+        #
+        # On other words, this won't get nested structs.
+        #
+        # So, we need to have an extra loop on Python to override such
+        # re limitation.
+
+        while True:
+            tuples = struct_members.findall(members)
+            if not tuples:
+                break
+
+            for t in tuples:
+                newmember = ""
+                maintype = t[0]
+                s_ids = t[5]
+                content = t[3]
+
+                oldmember = "".join(t)
+
+                for s_id in s_ids.split(','):
+                    s_id = s_id.strip()
+
+                    newmember += f"{maintype} {s_id}; "
+                    s_id = KernRe(r'[:\[].*').sub('', s_id)
+                    s_id = KernRe(r'^\s*\**(\S+)\s*').sub(r'\1', s_id)
+
+                    for arg in content.split(';'):
+                        arg = arg.strip()
+
+                        if not arg:
+                            continue
+
+                        r = KernRe(r'^([^\(]+\(\*?\s*)([\w\.]*)(\s*\).*)')
+                        if r.match(arg):
+                            # Pointer-to-function
+                            dtype = r.group(1)
+                            name = r.group(2)
+                            extra = r.group(3)
+
+                            if not name:
+                                continue
+
+                            if not s_id:
+                                # Anonymous struct/union
+                                newmember += f"{dtype}{name}{extra}; "
+                            else:
+                                newmember += f"{dtype}{s_id}.{name}{extra}; "
+
+                        else:
+                            arg = arg.strip()
+                            # Handle bitmaps
+                            arg = KernRe(r':\s*\d+\s*').sub('', arg)
+
+                            # Handle arrays
+                            arg = KernRe(r'\[.*\]').sub('', arg)
+
+                            # Handle multiple IDs
+                            arg = KernRe(r'\s*,\s*').sub(',', arg)
+
+                            r = KernRe(r'(.*)\s+([\S+,]+)')
+
+                            if r.search(arg):
+                                dtype = r.group(1)
+                                names = r.group(2)
+                            else:
+                                newmember += f"{arg}; "
+                                continue
+
+                            for name in names.split(','):
+                                name = KernRe(r'^\s*\**(\S+)\s*').sub(r'\1', name).strip()
+
+                                if not name:
+                                    continue
+
+                                if not s_id:
+                                    # Anonymous struct/union
+                                    newmember += f"{dtype} {name}; "
+                                else:
+                                    newmember += f"{dtype} {s_id}.{name}; "
+
+                members = members.replace(oldmember, newmember)
+
+        # Ignore other nested elements, like enums
+        members = re.sub(r'(\{[^\{\}]*\})', '', members)
+
+        self.create_parameter_list(ln, decl_type, members, ';',
+                                   declaration_name)
+        self.check_sections(ln, declaration_name, decl_type)
+
+        # Adjust declaration for better display
+        declaration = KernRe(r'([\{;])').sub(r'\1\n', declaration)
+        declaration = KernRe(r'\}\s+;').sub('};', declaration)
+
+        # Better handle inlined enums
+        while True:
+            r = KernRe(r'(enum\s+\{[^\}]+),([^\n])')
+            if not r.search(declaration):
+                break
+
+            declaration = r.sub(r'\1,\n\2', declaration)
+
+        def_args = declaration.split('\n')
+        level = 1
+        declaration = ""
+        for clause in def_args:
+
+            clause = clause.strip()
+            clause = KernRe(r'\s+').sub(' ', clause, count=1)
+
+            if not clause:
+                continue
+
+            if '}' in clause and level > 1:
+                level -= 1
+
+            if not KernRe(r'^\s*#').match(clause):
+                declaration += "\t" * level
+
+            declaration += "\t" + clause + "\n"
+            if "{" in clause and "}" not in clause:
+                level += 1
+
+        self.output_declaration(decl_type, declaration_name,
+                                definition=declaration,
+                                purpose=self.entry.declaration_purpose)
+
+    def dump_enum(self, ln, proto):
+        """
+        Stores an enum inside self.entries array.
+        """
+
+        # Ignore members marked private
+        proto = KernRe(r'\/\*\s*private:.*?\/\*\s*public:.*?\*\/', flags=re.S).sub('', proto)
+        proto = KernRe(r'\/\*\s*private:.*}', flags=re.S).sub('}', proto)
+
+        # Strip comments
+        proto = KernRe(r'\/\*.*?\*\/', flags=re.S).sub('', proto)
+
+        # Strip #define macros inside enums
+        proto = KernRe(r'#\s*((define|ifdef|if)\s+|endif)[^;]*;', flags=re.S).sub('', proto)
+
+        #
+        # Parse out the name and members of the enum.  Typedef form first.
+        #
+        r = KernRe(r'typedef\s+enum\s*\{(.*)\}\s*(\w*)\s*;')
+        if r.search(proto):
+            declaration_name = r.group(2)
+            members = r.group(1).rstrip()
+        #
+        # Failing that, look for a straight enum
+        #
+        else:
+            r = KernRe(r'enum\s+(\w*)\s*\{(.*)\}')
+            if r.match(proto):
+                declaration_name = r.group(1)
+                members = r.group(2).rstrip()
+        #
+        # OK, this isn't going to work.
+        #
+            else:
+                self.emit_msg(ln, f"{proto}: error: Cannot parse enum!")
+                return
+        #
+        # Make sure we found what we were expecting.
+        #
+        if self.entry.identifier != declaration_name:
+            if self.entry.identifier == "":
+                self.emit_msg(ln,
+                              f"{proto}: wrong kernel-doc identifier on prototype")
+            else:
+                self.emit_msg(ln,
+                              f"expecting prototype for enum {self.entry.identifier}. "
+                              f"Prototype was for enum {declaration_name} instead")
+            return
+
+        if not declaration_name:
+            declaration_name = "(anonymous)"
+        #
+        # Parse out the name of each enum member, and verify that we
+        # have a description for it.
+        #
+        member_set = set()
+        members = KernRe(r'\([^;)]*\)').sub('', members)
+        for arg in members.split(','):
+            if not arg:
+                continue
+            arg = KernRe(r'^\s*(\w+).*').sub(r'\1', arg)
+            self.entry.parameterlist.append(arg)
+            if arg not in self.entry.parameterdescs:
+                self.entry.parameterdescs[arg] = self.undescribed
+                self.emit_msg(ln,
+                              f"Enum value '{arg}' not described in enum '{declaration_name}'")
+            member_set.add(arg)
+        #
+        # Ensure that every described member actually exists in the enum.
+        #
+        for k in self.entry.parameterdescs:
+            if k not in member_set:
+                self.emit_msg(ln,
+                              f"Excess enum value '%{k}' description in '{declaration_name}'")
+
+        self.output_declaration('enum', declaration_name,
+                                purpose=self.entry.declaration_purpose)
+
+    def dump_declaration(self, ln, prototype):
+        """
+        Stores a data declaration inside self.entries array.
+        """
+
+        if self.entry.decl_type == "enum":
+            self.dump_enum(ln, prototype)
+        elif self.entry.decl_type == "typedef":
+            self.dump_typedef(ln, prototype)
+        elif self.entry.decl_type in ["union", "struct"]:
+            self.dump_struct(ln, prototype)
+        else:
+            # This would be a bug
+            self.emit_message(ln, f'Unknown declaration type: {self.entry.decl_type}')
+
+    def dump_function(self, ln, prototype):
+        """
+        Stores a function of function macro inside self.entries array.
+        """
+
+        func_macro = False
+        return_type = ''
+        decl_type = 'function'
+
+        # Prefixes that would be removed
+        sub_prefixes = [
+            (r"^static +", "", 0),
+            (r"^extern +", "", 0),
+            (r"^asmlinkage +", "", 0),
+            (r"^inline +", "", 0),
+            (r"^__inline__ +", "", 0),
+            (r"^__inline +", "", 0),
+            (r"^__always_inline +", "", 0),
+            (r"^noinline +", "", 0),
+            (r"^__FORTIFY_INLINE +", "", 0),
+            (r"__init +", "", 0),
+            (r"__init_or_module +", "", 0),
+            (r"__deprecated +", "", 0),
+            (r"__flatten +", "", 0),
+            (r"__meminit +", "", 0),
+            (r"__must_check +", "", 0),
+            (r"__weak +", "", 0),
+            (r"__sched +", "", 0),
+            (r"_noprof", "", 0),
+            (r"__printf\s*\(\s*\d*\s*,\s*\d*\s*\) +", "", 0),
+            (r"__(?:re)?alloc_size\s*\(\s*\d+\s*(?:,\s*\d+\s*)?\) +", "", 0),
+            (r"__diagnose_as\s*\(\s*\S+\s*(?:,\s*\d+\s*)*\) +", "", 0),
+            (r"DECL_BUCKET_PARAMS\s*\(\s*(\S+)\s*,\s*(\S+)\s*\)", r"\1, \2", 0),
+            (r"__attribute_const__ +", "", 0),
+
+            # It seems that Python support for re.X is broken:
+            # At least for me (Python 3.13), this didn't work
+#            (r"""
+#              __attribute__\s*\(\(
+#                (?:
+#                    [\w\s]+          # attribute name
+#                    (?:\([^)]*\))?   # attribute arguments
+#                    \s*,?            # optional comma at the end
+#                )+
+#              \)\)\s+
+#             """, "", re.X),
+
+            # So, remove whitespaces and comments from it
+            (r"__attribute__\s*\(\((?:[\w\s]+(?:\([^)]*\))?\s*,?)+\)\)\s+", "", 0),
+        ]
+
+        for search, sub, flags in sub_prefixes:
+            prototype = KernRe(search, flags).sub(sub, prototype)
+
+        # Macros are a special case, as they change the prototype format
+        new_proto = KernRe(r"^#\s*define\s+").sub("", prototype)
+        if new_proto != prototype:
+            is_define_proto = True
+            prototype = new_proto
+        else:
+            is_define_proto = False
+
+        # Yes, this truly is vile.  We are looking for:
+        # 1. Return type (may be nothing if we're looking at a macro)
+        # 2. Function name
+        # 3. Function parameters.
+        #
+        # All the while we have to watch out for function pointer parameters
+        # (which IIRC is what the two sections are for), C types (these
+        # regexps don't even start to express all the possibilities), and
+        # so on.
+        #
+        # If you mess with these regexps, it's a good idea to check that
+        # the following functions' documentation still comes out right:
+        # - parport_register_device (function pointer parameters)
+        # - atomic_set (macro)
+        # - pci_match_device, __copy_to_user (long return type)
+
+        name = r'[a-zA-Z0-9_~:]+'
+        prototype_end1 = r'[^\(]*'
+        prototype_end2 = r'[^\{]*'
+        prototype_end = fr'\(({prototype_end1}|{prototype_end2})\)'
+
+        # Besides compiling, Perl qr{[\w\s]+} works as a non-capturing group.
+        # So, this needs to be mapped in Python with (?:...)? or (?:...)+
+
+        type1 = r'(?:[\w\s]+)?'
+        type2 = r'(?:[\w\s]+\*+)+'
+
+        found = False
+
+        if is_define_proto:
+            r = KernRe(r'^()(' + name + r')\s+')
+
+            if r.search(prototype):
+                return_type = ''
+                declaration_name = r.group(2)
+                func_macro = True
+
+                found = True
+
+        if not found:
+            patterns = [
+                rf'^()({name})\s*{prototype_end}',
+                rf'^({type1})\s+({name})\s*{prototype_end}',
+                rf'^({type2})\s*({name})\s*{prototype_end}',
+            ]
+
+            for p in patterns:
+                r = KernRe(p)
+
+                if r.match(prototype):
+
+                    return_type = r.group(1)
+                    declaration_name = r.group(2)
+                    args = r.group(3)
+
+                    self.create_parameter_list(ln, decl_type, args, ',',
+                                               declaration_name)
+
+                    found = True
+                    break
+        if not found:
+            self.emit_msg(ln,
+                          f"cannot understand function prototype: '{prototype}'")
+            return
+
+        if self.entry.identifier != declaration_name:
+            self.emit_msg(ln,
+                          f"expecting prototype for {self.entry.identifier}(). Prototype was for {declaration_name}() instead")
+            return
+
+        self.check_sections(ln, declaration_name, "function")
+
+        self.check_return_section(ln, declaration_name, return_type)
+
+        if 'typedef' in return_type:
+            self.output_declaration(decl_type, declaration_name,
+                                    typedef=True,
+                                    functiontype=return_type,
+                                    purpose=self.entry.declaration_purpose,
+                                    func_macro=func_macro)
+        else:
+            self.output_declaration(decl_type, declaration_name,
+                                    typedef=False,
+                                    functiontype=return_type,
+                                    purpose=self.entry.declaration_purpose,
+                                    func_macro=func_macro)
+
+    def dump_typedef(self, ln, proto):
+        """
+        Stores a typedef inside self.entries array.
+        """
+
+        typedef_type = r'((?:\s+[\w\*]+\b){0,7}\s+(?:\w+\b|\*+))\s*'
+        typedef_ident = r'\*?\s*(\w\S+)\s*'
+        typedef_args = r'\s*\((.*)\);'
+
+        typedef1 = KernRe(r'typedef' + typedef_type + r'\(' + typedef_ident + r'\)' + typedef_args)
+        typedef2 = KernRe(r'typedef' + typedef_type + typedef_ident + typedef_args)
+
+        # Strip comments
+        proto = KernRe(r'/\*.*?\*/', flags=re.S).sub('', proto)
+
+        # Parse function typedef prototypes
+        for r in [typedef1, typedef2]:
+            if not r.match(proto):
+                continue
+
+            return_type = r.group(1).strip()
+            declaration_name = r.group(2)
+            args = r.group(3)
+
+            if self.entry.identifier != declaration_name:
+                self.emit_msg(ln,
+                              f"expecting prototype for typedef {self.entry.identifier}. Prototype was for typedef {declaration_name} instead\n")
+                return
+
+            decl_type = 'function'
+            self.create_parameter_list(ln, decl_type, args, ',', declaration_name)
+
+            self.output_declaration(decl_type, declaration_name,
+                                    typedef=True,
+                                    functiontype=return_type,
+                                    purpose=self.entry.declaration_purpose)
+            return
+
+        # Handle nested parentheses or brackets
+        r = KernRe(r'(\(*.\)\s*|\[*.\]\s*);$')
+        while r.search(proto):
+            proto = r.sub('', proto)
+
+        # Parse simple typedefs
+        r = KernRe(r'typedef.*\s+(\w+)\s*;')
+        if r.match(proto):
+            declaration_name = r.group(1)
+
+            if self.entry.identifier != declaration_name:
+                self.emit_msg(ln,
+                              f"expecting prototype for typedef {self.entry.identifier}. Prototype was for typedef {declaration_name} instead\n")
+                return
+
+            self.output_declaration('typedef', declaration_name,
+                                    purpose=self.entry.declaration_purpose)
+            return
+
+        self.emit_msg(ln, "error: Cannot parse typedef!")
+
+    @staticmethod
+    def process_export(function_set, line):
+        """
+        process EXPORT_SYMBOL* tags
+
+        This method doesn't use any variable from the class, so declare it
+        with a staticmethod decorator.
+        """
+
+        # We support documenting some exported symbols with different
+        # names.  A horrible hack.
+        suffixes = [ '_noprof' ]
+
+        # Note: it accepts only one EXPORT_SYMBOL* per line, as having
+        # multiple export lines would violate Kernel coding style.
+
+        if export_symbol.search(line):
+            symbol = export_symbol.group(2)
+        elif export_symbol_ns.search(line):
+            symbol = export_symbol_ns.group(2)
+        else:
+            return False
+        #
+        # Found an export, trim out any special suffixes
+        #
+        for suffix in suffixes:
+            # Be backward compatible with Python < 3.9
+            if symbol.endswith(suffix):
+                symbol = symbol[:-len(suffix)]
+        function_set.add(symbol)
+        return True
+
+    def process_normal(self, ln, line):
+        """
+        STATE_NORMAL: looking for the /** to begin everything.
+        """
+
+        if not doc_start.match(line):
+            return
+
+        # start a new entry
+        self.reset_state(ln)
+
+        # next line is always the function name
+        self.state = state.NAME
+
+    def process_name(self, ln, line):
+        """
+        STATE_NAME: Looking for the "name - description" line
+        """
+        #
+        # Check for a DOC: block and handle them specially.
+        #
+        if doc_block.search(line):
+
+            if not doc_block.group(1):
+                self.entry.begin_section(ln, "Introduction")
+            else:
+                self.entry.begin_section(ln, doc_block.group(1))
+
+            self.entry.identifier = self.entry.section
+            self.state = state.DOCBLOCK
+        #
+        # Otherwise we're looking for a normal kerneldoc declaration line.
+        #
+        elif doc_decl.search(line):
+            self.entry.identifier = doc_decl.group(1)
+
+            # Test for data declaration
+            if doc_begin_data.search(line):
+                self.entry.decl_type = doc_begin_data.group(1)
+                self.entry.identifier = doc_begin_data.group(2)
+            #
+            # Look for a function description
+            #
+            elif doc_begin_func.search(line):
+                self.entry.identifier = doc_begin_func.group(1)
+                self.entry.decl_type = "function"
+            #
+            # We struck out.
+            #
+            else:
+                self.emit_msg(ln,
+                              f"This comment starts with '/**', but isn't a kernel-doc comment. Refer Documentation/doc-guide/kernel-doc.rst\n{line}")
+                self.state = state.NORMAL
+                return
+            #
+            # OK, set up for a new kerneldoc entry.
+            #
+            self.state = state.BODY
+            self.entry.identifier = self.entry.identifier.strip(" ")
+            # if there's no @param blocks need to set up default section here
+            self.entry.begin_section(ln + 1)
+            #
+            # Find the description portion, which *should* be there but
+            # isn't always.
+            # (We should be able to capture this from the previous parsing - someday)
+            #
+            r = KernRe("[-:](.*)")
+            if r.search(line):
+                self.entry.declaration_purpose = trim_whitespace(r.group(1))
+                self.state = state.DECLARATION
+            else:
+                self.entry.declaration_purpose = ""
+
+            if not self.entry.declaration_purpose and self.config.wshort_desc:
+                self.emit_msg(ln,
+                              f"missing initial short description on line:\n{line}")
+
+            if not self.entry.identifier and self.entry.decl_type != "enum":
+                self.emit_msg(ln,
+                              f"wrong kernel-doc identifier on line:\n{line}")
+                self.state = state.NORMAL
+
+            if self.config.verbose:
+                self.emit_msg(ln,
+                              f"Scanning doc for {self.entry.decl_type} {self.entry.identifier}",
+                                  warning=False)
+        #
+        # Failed to find an identifier. Emit a warning
+        #
+        else:
+            self.emit_msg(ln, f"Cannot find identifier on line:\n{line}")
+
+    #
+    # Helper function to determine if a new section is being started.
+    #
+    def is_new_section(self, ln, line):
+        if doc_sect.search(line):
+            self.state = state.BODY
+            #
+            # Pick out the name of our new section, tweaking it if need be.
+            #
+            newsection = doc_sect.group(1)
+            if newsection.lower() == 'description':
+                newsection = 'Description'
+            elif newsection.lower() == 'context':
+                newsection = 'Context'
+                self.state = state.SPECIAL_SECTION
+            elif newsection.lower() in ["@return", "@returns",
+                                        "return", "returns"]:
+                newsection = "Return"
+                self.state = state.SPECIAL_SECTION
+            elif newsection[0] == '@':
+                self.state = state.SPECIAL_SECTION
+            #
+            # Initialize the contents, and get the new section going.
+            #
+            newcontents = doc_sect.group(2)
+            if not newcontents:
+                newcontents = ""
+            self.dump_section()
+            self.entry.begin_section(ln, newsection)
+            self.entry.leading_space = None
+
+            self.entry.add_text(newcontents.lstrip())
+            return True
+        return False
+
+    #
+    # Helper function to detect (and effect) the end of a kerneldoc comment.
+    #
+    def is_comment_end(self, ln, line):
+        if doc_end.search(line):
+            self.dump_section()
+
+            # Look for doc_com + <text> + doc_end:
+            r = KernRe(r'\s*\*\s*[a-zA-Z_0-9:\.]+\*/')
+            if r.match(line):
+                self.emit_msg(ln, f"suspicious ending line: {line}")
+
+            self.entry.prototype = ""
+            self.entry.new_start_line = ln + 1
+
+            self.state = state.PROTO
+            return True
+        return False
+
+
+    def process_decl(self, ln, line):
+        """
+        STATE_DECLARATION: We've seen the beginning of a declaration
+        """
+        if self.is_new_section(ln, line) or self.is_comment_end(ln, line):
+            return
+        #
+        # Look for anything with the " * " line beginning.
+        #
+        if doc_content.search(line):
+            cont = doc_content.group(1)
+            #
+            # A blank line means that we have moved out of the declaration
+            # part of the comment (without any "special section" parameter
+            # descriptions).
+            #
+            if cont == "":
+                self.state = state.BODY
+            #
+            # Otherwise we have more of the declaration section to soak up.
+            #
+            else:
+                self.entry.declaration_purpose = \
+                    trim_whitespace(self.entry.declaration_purpose + ' ' + cont)
+        else:
+            # Unknown line, ignore
+            self.emit_msg(ln, f"bad line: {line}")
+
+
+    def process_special(self, ln, line):
+        """
+        STATE_SPECIAL_SECTION: a section ending with a blank line
+        """
+        #
+        # If we have hit a blank line (only the " * " marker), then this
+        # section is done.
+        #
+        if KernRe(r"\s*\*\s*$").match(line):
+            self.entry.begin_section(ln, dump = True)
+            self.state = state.BODY
+            return
+        #
+        # Not a blank line, look for the other ways to end the section.
+        #
+        if self.is_new_section(ln, line) or self.is_comment_end(ln, line):
+            return
+        #
+        # OK, we should have a continuation of the text for this section.
+        #
+        if doc_content.search(line):
+            cont = doc_content.group(1)
+            #
+            # If the lines of text after the first in a special section have
+            # leading white space, we need to trim it out or Sphinx will get
+            # confused.  For the second line (the None case), see what we
+            # find there and remember it.
+            #
+            if self.entry.leading_space is None:
+                r = KernRe(r'^(\s+)')
+                if r.match(cont):
+                    self.entry.leading_space = len(r.group(1))
+                else:
+                    self.entry.leading_space = 0
+            #
+            # Otherwise, before trimming any leading chars, be *sure*
+            # that they are white space.  We should maybe warn if this
+            # isn't the case.
+            #
+            for i in range(0, self.entry.leading_space):
+                if cont[i] != " ":
+                    self.entry.leading_space = i
+                    break
+            #
+            # Add the trimmed result to the section and we're done.
+            #
+            self.entry.add_text(cont[self.entry.leading_space:])
+        else:
+            # Unknown line, ignore
+            self.emit_msg(ln, f"bad line: {line}")
+
+    def process_body(self, ln, line):
+        """
+        STATE_BODY: the bulk of a kerneldoc comment.
+        """
+        if self.is_new_section(ln, line) or self.is_comment_end(ln, line):
+            return
+
+        if doc_content.search(line):
+            cont = doc_content.group(1)
+            self.entry.add_text(cont)
+        else:
+            # Unknown line, ignore
+            self.emit_msg(ln, f"bad line: {line}")
+
+    def process_inline_name(self, ln, line):
+        """STATE_INLINE_NAME: beginning of docbook comments within a prototype."""
+
+        if doc_inline_sect.search(line):
+            self.entry.begin_section(ln, doc_inline_sect.group(1))
+            self.entry.add_text(doc_inline_sect.group(2).lstrip())
+            self.state = state.INLINE_TEXT
+        elif doc_inline_end.search(line):
+            self.dump_section()
+            self.state = state.PROTO
+        elif doc_content.search(line):
+            self.emit_msg(ln, f"Incorrect use of kernel-doc format: {line}")
+            self.state = state.PROTO
+        # else ... ??
+
+    def process_inline_text(self, ln, line):
+        """STATE_INLINE_TEXT: docbook comments within a prototype."""
+
+        if doc_inline_end.search(line):
+            self.dump_section()
+            self.state = state.PROTO
+        elif doc_content.search(line):
+            self.entry.add_text(doc_content.group(1))
+        # else ... ??
+
+    def syscall_munge(self, ln, proto):         # pylint: disable=W0613
+        """
+        Handle syscall definitions
+        """
+
+        is_void = False
+
+        # Strip newlines/CR's
+        proto = re.sub(r'[\r\n]+', ' ', proto)
+
+        # Check if it's a SYSCALL_DEFINE0
+        if 'SYSCALL_DEFINE0' in proto:
+            is_void = True
+
+        # Replace SYSCALL_DEFINE with correct return type & function name
+        proto = KernRe(r'SYSCALL_DEFINE.*\(').sub('long sys_', proto)
+
+        r = KernRe(r'long\s+(sys_.*?),')
+        if r.search(proto):
+            proto = KernRe(',').sub('(', proto, count=1)
+        elif is_void:
+            proto = KernRe(r'\)').sub('(void)', proto, count=1)
+
+        # Now delete all of the odd-numbered commas in the proto
+        # so that argument types & names don't have a comma between them
+        count = 0
+        length = len(proto)
+
+        if is_void:
+            length = 0  # skip the loop if is_void
+
+        for ix in range(length):
+            if proto[ix] == ',':
+                count += 1
+                if count % 2 == 1:
+                    proto = proto[:ix] + ' ' + proto[ix + 1:]
+
+        return proto
+
+    def tracepoint_munge(self, ln, proto):
+        """
+        Handle tracepoint definitions
+        """
+
+        tracepointname = None
+        tracepointargs = None
+
+        # Match tracepoint name based on different patterns
+        r = KernRe(r'TRACE_EVENT\((.*?),')
+        if r.search(proto):
+            tracepointname = r.group(1)
+
+        r = KernRe(r'DEFINE_SINGLE_EVENT\((.*?),')
+        if r.search(proto):
+            tracepointname = r.group(1)
+
+        r = KernRe(r'DEFINE_EVENT\((.*?),(.*?),')
+        if r.search(proto):
+            tracepointname = r.group(2)
+
+        if tracepointname:
+            tracepointname = tracepointname.lstrip()
+
+        r = KernRe(r'TP_PROTO\((.*?)\)')
+        if r.search(proto):
+            tracepointargs = r.group(1)
+
+        if not tracepointname or not tracepointargs:
+            self.emit_msg(ln,
+                          f"Unrecognized tracepoint format:\n{proto}\n")
+        else:
+            proto = f"static inline void trace_{tracepointname}({tracepointargs})"
+            self.entry.identifier = f"trace_{self.entry.identifier}"
+
+        return proto
+
+    def process_proto_function(self, ln, line):
+        """Ancillary routine to process a function prototype"""
+
+        # strip C99-style comments to end of line
+        line = KernRe(r"\/\/.*$", re.S).sub('', line)
+        #
+        # Soak up the line's worth of prototype text, stopping at { or ; if present.
+        #
+        if KernRe(r'\s*#\s*define').match(line):
+            self.entry.prototype = line
+        elif not line.startswith('#'):   # skip other preprocessor stuff
+            r = KernRe(r'([^\{]*)')
+            if r.match(line):
+                self.entry.prototype += r.group(1) + " "
+        #
+        # If we now have the whole prototype, clean it up and declare victory.
+        #
+        if '{' in line or ';' in line or KernRe(r'\s*#\s*define').match(line):
+            # strip comments and surrounding spaces
+            self.entry.prototype = KernRe(r'/\*.*\*/').sub('', self.entry.prototype).strip()
+            #
+            # Handle self.entry.prototypes for function pointers like:
+            #       int (*pcs_config)(struct foo)
+            # by turning it into
+            #	    int pcs_config(struct foo)
+            #
+            r = KernRe(r'^(\S+\s+)\(\s*\*(\S+)\)')
+            self.entry.prototype = r.sub(r'\1\2', self.entry.prototype)
+            #
+            # Handle special declaration syntaxes
+            #
+            if 'SYSCALL_DEFINE' in self.entry.prototype:
+                self.entry.prototype = self.syscall_munge(ln,
+                                                          self.entry.prototype)
+            else:
+                r = KernRe(r'TRACE_EVENT|DEFINE_EVENT|DEFINE_SINGLE_EVENT')
+                if r.search(self.entry.prototype):
+                    self.entry.prototype = self.tracepoint_munge(ln,
+                                                                 self.entry.prototype)
+            #
+            # ... and we're done
+            #
+            self.dump_function(ln, self.entry.prototype)
+            self.reset_state(ln)
+
+    def process_proto_type(self, ln, line):
+        """Ancillary routine to process a type"""
+
+        # Strip C99-style comments and surrounding whitespace
+        line = KernRe(r"//.*$", re.S).sub('', line).strip()
+        if not line:
+            return # nothing to see here
+
+        # To distinguish preprocessor directive from regular declaration later.
+        if line.startswith('#'):
+            line += ";"
+        #
+        # Split the declaration on any of { } or ;, and accumulate pieces
+        # until we hit a semicolon while not inside {brackets}
+        #
+        r = KernRe(r'(.*?)([{};])')
+        for chunk in r.split(line):
+            if chunk:  # Ignore empty matches
+                self.entry.prototype += chunk
+                #
+                # This cries out for a match statement ... someday after we can
+                # drop Python 3.9 ...
+                #
+                if chunk == '{':
+                    self.entry.brcount += 1
+                elif chunk == '}':
+                    self.entry.brcount -= 1
+                elif chunk == ';' and self.entry.brcount <= 0:
+                    self.dump_declaration(ln, self.entry.prototype)
+                    self.reset_state(ln)
+                    return
+        #
+        # We hit the end of the line while still in the declaration; put
+        # in a space to represent the newline.
+        #
+        self.entry.prototype += ' '
+
+    def process_proto(self, ln, line):
+        """STATE_PROTO: reading a function/whatever prototype."""
+
+        if doc_inline_oneline.search(line):
+            self.entry.begin_section(ln, doc_inline_oneline.group(1))
+            self.entry.add_text(doc_inline_oneline.group(2))
+            self.dump_section()
+
+        elif doc_inline_start.search(line):
+            self.state = state.INLINE_NAME
+
+        elif self.entry.decl_type == 'function':
+            self.process_proto_function(ln, line)
+
+        else:
+            self.process_proto_type(ln, line)
+
+    def process_docblock(self, ln, line):
+        """STATE_DOCBLOCK: within a DOC: block."""
+
+        if doc_end.search(line):
+            self.dump_section()
+            self.output_declaration("doc", self.entry.identifier)
+            self.reset_state(ln)
+
+        elif doc_content.search(line):
+            self.entry.add_text(doc_content.group(1))
+
+    def parse_export(self):
+        """
+        Parses EXPORT_SYMBOL* macros from a single Kernel source file.
+        """
+
+        export_table = set()
+
+        try:
+            with open(self.fname, "r", encoding="utf8",
+                      errors="backslashreplace") as fp:
+
+                for line in fp:
+                    self.process_export(export_table, line)
+
+        except IOError:
+            return None
+
+        return export_table
+
+    #
+    # The state/action table telling us which function to invoke in
+    # each state.
+    #
+    state_actions = {
+        state.NORMAL:			process_normal,
+        state.NAME:			process_name,
+        state.BODY:			process_body,
+        state.DECLARATION:		process_decl,
+        state.SPECIAL_SECTION:		process_special,
+        state.INLINE_NAME:		process_inline_name,
+        state.INLINE_TEXT:		process_inline_text,
+        state.PROTO:			process_proto,
+        state.DOCBLOCK:			process_docblock,
+        }
+
+    def parse_kdoc(self):
+        """
+        Open and process each line of a C source file.
+        The parsing is controlled via a state machine, and the line is passed
+        to a different process function depending on the state. The process
+        function may update the state as needed.
+
+        Besides parsing kernel-doc tags, it also parses export symbols.
+        """
+
+        prev = ""
+        prev_ln = None
+        export_table = set()
+
+        try:
+            with open(self.fname, "r", encoding="utf8",
+                      errors="backslashreplace") as fp:
+                for ln, line in enumerate(fp):
+
+                    line = line.expandtabs().strip("\n")
+
+                    # Group continuation lines on prototypes
+                    if self.state == state.PROTO:
+                        if line.endswith("\\"):
+                            prev += line.rstrip("\\")
+                            if not prev_ln:
+                                prev_ln = ln
+                            continue
+
+                        if prev:
+                            ln = prev_ln
+                            line = prev + line
+                            prev = ""
+                            prev_ln = None
+
+                    self.config.log.debug("%d %s: %s",
+                                          ln, state.name[self.state],
+                                          line)
+
+                    # This is an optimization over the original script.
+                    # There, when export_file was used for the same file,
+                    # it was read twice. Here, we use the already-existing
+                    # loop to parse exported symbols as well.
+                    #
+                    if (self.state != state.NORMAL) or \
+                       not self.process_export(export_table, line):
+                        # Hand this line to the appropriate state handler
+                        self.state_actions[self.state](self, ln, line)
+
+        except OSError:
+            self.config.log.error(f"Error: Cannot open file {self.fname}")
+
+        return export_table, self.entries
diff --git a/scripts/lib/kdoc/kdoc_re.py b/scripts/lib/kdoc/kdoc_re.py
new file mode 100644
index 0000000000..612223e1e7
--- /dev/null
+++ b/scripts/lib/kdoc/kdoc_re.py
@@ -0,0 +1,270 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-2.0
+# Copyright(c) 2025: Mauro Carvalho Chehab <mchehab@kernel.org>.
+
+"""
+Regular expression ancillary classes.
+
+Those help caching regular expressions and do matching for kernel-doc.
+"""
+
+import re
+
+# Local cache for regular expressions
+re_cache = {}
+
+
+class KernRe:
+    """
+    Helper class to simplify regex declaration and usage,
+
+    It calls re.compile for a given pattern. It also allows adding
+    regular expressions and define sub at class init time.
+
+    Regular expressions can be cached via an argument, helping to speedup
+    searches.
+    """
+
+    def _add_regex(self, string, flags):
+        """
+        Adds a new regex or re-use it from the cache.
+        """
+        self.regex = re_cache.get(string, None)
+        if not self.regex:
+            self.regex = re.compile(string, flags=flags)
+            if self.cache:
+                re_cache[string] = self.regex
+
+    def __init__(self, string, cache=True, flags=0):
+        """
+        Compile a regular expression and initialize internal vars.
+        """
+
+        self.cache = cache
+        self.last_match = None
+
+        self._add_regex(string, flags)
+
+    def __str__(self):
+        """
+        Return the regular expression pattern.
+        """
+        return self.regex.pattern
+
+    def __add__(self, other):
+        """
+        Allows adding two regular expressions into one.
+        """
+
+        return KernRe(str(self) + str(other), cache=self.cache or other.cache,
+                  flags=self.regex.flags | other.regex.flags)
+
+    def match(self, string):
+        """
+        Handles a re.match storing its results
+        """
+
+        self.last_match = self.regex.match(string)
+        return self.last_match
+
+    def search(self, string):
+        """
+        Handles a re.search storing its results
+        """
+
+        self.last_match = self.regex.search(string)
+        return self.last_match
+
+    def findall(self, string):
+        """
+        Alias to re.findall
+        """
+
+        return self.regex.findall(string)
+
+    def split(self, string):
+        """
+        Alias to re.split
+        """
+
+        return self.regex.split(string)
+
+    def sub(self, sub, string, count=0):
+        """
+        Alias to re.sub
+        """
+
+        return self.regex.sub(sub, string, count=count)
+
+    def group(self, num):
+        """
+        Returns the group results of the last match
+        """
+
+        return self.last_match.group(num)
+
+
+class NestedMatch:
+    """
+    Finding nested delimiters is hard with regular expressions. It is
+    even harder on Python with its normal re module, as there are several
+    advanced regular expressions that are missing.
+
+    This is the case of this pattern:
+
+            '\\bSTRUCT_GROUP(\\(((?:(?>[^)(]+)|(?1))*)\\))[^;]*;'
+
+    which is used to properly match open/close parenthesis of the
+    string search STRUCT_GROUP(),
+
+    Add a class that counts pairs of delimiters, using it to match and
+    replace nested expressions.
+
+    The original approach was suggested by:
+        https://stackoverflow.com/questions/5454322/python-how-to-match-nested-parentheses-with-regex
+
+    Although I re-implemented it to make it more generic and match 3 types
+    of delimiters. The logic checks if delimiters are paired. If not, it
+    will ignore the search string.
+    """
+
+    # TODO: make NestedMatch handle multiple match groups
+    #
+    # Right now, regular expressions to match it are defined only up to
+    #       the start delimiter, e.g.:
+    #
+    #       \bSTRUCT_GROUP\(
+    #
+    # is similar to: STRUCT_GROUP\((.*)\)
+    # except that the content inside the match group is delimiter's aligned.
+    #
+    # The content inside parenthesis are converted into a single replace
+    # group (e.g. r`\1').
+    #
+    # It would be nice to change such definition to support multiple
+    # match groups, allowing a regex equivalent to.
+    #
+    #   FOO\((.*), (.*), (.*)\)
+    #
+    # it is probably easier to define it not as a regular expression, but
+    # with some lexical definition like:
+    #
+    #   FOO(arg1, arg2, arg3)
+
+    DELIMITER_PAIRS = {
+        '{': '}',
+        '(': ')',
+        '[': ']',
+    }
+
+    RE_DELIM = re.compile(r'[\{\}\[\]\(\)]')
+
+    def _search(self, regex, line):
+        """
+        Finds paired blocks for a regex that ends with a delimiter.
+
+        The suggestion of using finditer to match pairs came from:
+        https://stackoverflow.com/questions/5454322/python-how-to-match-nested-parentheses-with-regex
+        but I ended using a different implementation to align all three types
+        of delimiters and seek for an initial regular expression.
+
+        The algorithm seeks for open/close paired delimiters and place them
+        into a stack, yielding a start/stop position of each match  when the
+        stack is zeroed.
+
+        The algorithm shoud work fine for properly paired lines, but will
+        silently ignore end delimiters that preceeds an start delimiter.
+        This should be OK for kernel-doc parser, as unaligned delimiters
+        would cause compilation errors. So, we don't need to rise exceptions
+        to cover such issues.
+        """
+
+        stack = []
+
+        for match_re in regex.finditer(line):
+            start = match_re.start()
+            offset = match_re.end()
+
+            d = line[offset - 1]
+            if d not in self.DELIMITER_PAIRS:
+                continue
+
+            end = self.DELIMITER_PAIRS[d]
+            stack.append(end)
+
+            for match in self.RE_DELIM.finditer(line[offset:]):
+                pos = match.start() + offset
+
+                d = line[pos]
+
+                if d in self.DELIMITER_PAIRS:
+                    end = self.DELIMITER_PAIRS[d]
+
+                    stack.append(end)
+                    continue
+
+                # Does the end delimiter match what it is expected?
+                if stack and d == stack[-1]:
+                    stack.pop()
+
+                    if not stack:
+                        yield start, offset, pos + 1
+                        break
+
+    def search(self, regex, line):
+        """
+        This is similar to re.search:
+
+        It matches a regex that it is followed by a delimiter,
+        returning occurrences only if all delimiters are paired.
+        """
+
+        for t in self._search(regex, line):
+
+            yield line[t[0]:t[2]]
+
+    def sub(self, regex, sub, line, count=0):
+        """
+        This is similar to re.sub:
+
+        It matches a regex that it is followed by a delimiter,
+        replacing occurrences only if all delimiters are paired.
+
+        if r'\1' is used, it works just like re: it places there the
+        matched paired data with the delimiter stripped.
+
+        If count is different than zero, it will replace at most count
+        items.
+        """
+        out = ""
+
+        cur_pos = 0
+        n = 0
+
+        for start, end, pos in self._search(regex, line):
+            out += line[cur_pos:start]
+
+            # Value, ignoring start/end delimiters
+            value = line[end:pos - 1]
+
+            # replaces \1 at the sub string, if \1 is used there
+            new_sub = sub
+            new_sub = new_sub.replace(r'\1', value)
+
+            out += new_sub
+
+            # Drop end ';' if any
+            if line[pos] == ';':
+                pos += 1
+
+            cur_pos = pos
+            n += 1
+
+            if count and count >= n:
+                break
+
+        # Append the remaining string
+        l = len(line)
+        out += line[cur_pos:l]
+
+        return out

From 7f58572cff7e79c7733ba504cd200af2287706f5 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:19 +0100
Subject: [PATCH 0246/2396] scripts/kernel-doc: strip QEMU_ from function
 definitions

This commit is the Python version of our older commit
b30df2751e5 ("scripts/kernel-doc: strip QEMU_ from function definitions").

Some versions of Sphinx get confused if function attributes are
left on the C code from kernel-doc; strip out any QEMU_* prefixes
from function prototypes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-5-peter.maydell@linaro.org
---
 scripts/lib/kdoc/kdoc_parser.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/lib/kdoc/kdoc_parser.py b/scripts/lib/kdoc/kdoc_parser.py
index fe730099ec..32b4356292 100644
--- a/scripts/lib/kdoc/kdoc_parser.py
+++ b/scripts/lib/kdoc/kdoc_parser.py
@@ -907,6 +907,7 @@ class KernelDoc:
             (r"^__always_inline +", "", 0),
             (r"^noinline +", "", 0),
             (r"^__FORTIFY_INLINE +", "", 0),
+            (r"QEMU_[A-Z_]+ +", "", 0),
             (r"__init +", "", 0),
             (r"__init_or_module +", "", 0),
             (r"__deprecated +", "", 0),

From 9cbe72b868b7cb04f7553220738f1286b6f0dc32 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:20 +0100
Subject: [PATCH 0247/2396] scripts/kernel-doc: tweak for QEMU coding standards

This commit makes the equivalent changes to the Python script that we
had for the old Perl script in commit 4cf41794411f ("docs: tweak
kernel-doc for QEMU coding standards").  To repeat the rationale from
that commit:

    Surprisingly, QEMU does have a pretty consistent doc comment style and
    it is not very different from the Linux kernel's.  Of the documentation
    "sigils", only "#" separates the QEMU doc comment style from Linux's,
    and it has 200+ instances vs. 6 for the kernel's '&struct foo' (all in
    accel/tcg/translate-all.c), so it's clear that the two standards are
    different in this respect.  In addition, our structs are typedefed and
    recognized by CamelCase names.

Note that in 4cf41794411f we used '(?!)' as our type_fallback regex;
this is strictly not quite a replacement for the upstream
'\&([_\w]+)', because the latter includes a group that can later be
matched with \1, and the former does not.  The old perl script did
not care about this, but the python version does, so we must include
the extra set of brackets to ensure we have a group.

This commit does not include all the same changes that 4cf41794411f
did.  Of the missing pieces, some had already gone in an earlier
kernel-doc update; the parts we still had but do not include here are:

    @@ -2057,7 +2060,7 @@
         }
         elsif (/$doc_decl/o) {
            $identifier = $1;
    -       if (/\s*([\w\s]+?)(\(\))?\s*-/) {
    +       if (/\s*([\w\s]+?)(\s*-|:)/) {
                $identifier = $1;
            }

    @@ -2067,7 +2070,7 @@
            $contents = "";
            $section = $section_default;
            $new_start_line = $. + 1;
    -       if (/-(.*)/) {
    +       if (/[-:](.*)/) {
                # strip leading/trailing/multiple spaces
                $descr= $1;
                $descr =~ s/^\s*//;

The second of these is already in the upstream version: the line r =
KernRe("[-:](.*)") in process_name() matches the regex we have.  The
first change has been refactored into the doc_begin_data and
doc_begin_func changes.  Since the output HTML for QEMU's
documentation has no relevant changes with the new kerneldoc, we
assume that this too has been handled upstream.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-6-peter.maydell@linaro.org
---
 scripts/lib/kdoc/kdoc_output.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/scripts/lib/kdoc/kdoc_output.py b/scripts/lib/kdoc/kdoc_output.py
index ea8914537b..39fa872dfc 100644
--- a/scripts/lib/kdoc/kdoc_output.py
+++ b/scripts/lib/kdoc/kdoc_output.py
@@ -38,12 +38,12 @@ type_fp_param = KernRe(r"\@(\w+)\(\)", cache=False)
 type_fp_param2 = KernRe(r"\@(\w+->\S+)\(\)", cache=False)
 
 type_env = KernRe(r"(\$\w+)", cache=False)
-type_enum = KernRe(r"\&(enum\s*([_\w]+))", cache=False)
-type_struct = KernRe(r"\&(struct\s*([_\w]+))", cache=False)
-type_typedef = KernRe(r"\&(typedef\s*([_\w]+))", cache=False)
-type_union = KernRe(r"\&(union\s*([_\w]+))", cache=False)
-type_member = KernRe(r"\&([_\w]+)(\.|->)([_\w]+)", cache=False)
-type_fallback = KernRe(r"\&([_\w]+)", cache=False)
+type_enum = KernRe(r"#(enum\s*([_\w]+))", cache=False)
+type_struct = KernRe(r"#(struct\s*([_\w]+))", cache=False)
+type_typedef = KernRe(r"#(([A-Z][_\w]*))", cache=False)
+type_union = KernRe(r"#(union\s*([_\w]+))", cache=False)
+type_member = KernRe(r"#([_\w]+)(\.|->)([_\w]+)", cache=False)
+type_fallback = KernRe(r"((?!))", cache=False) # this never matches
 type_member_func = type_member + KernRe(r"\(\)", cache=False)
 
 

From 33be8171e2fe02173d24ffd61bd97bf9c2b37834 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:21 +0100
Subject: [PATCH 0248/2396] scripts/kerneldoc: Switch to the Python kernel-doc
 script

Change the Sphinx config to run the new Python kernel-doc script
instead of the Perl one.  The only difference between the two is that
the new script does not handle the -sphinx-version option, instead
assuming that Sphinx is always at least version 3: so we must
delete the code that passes that option to avoid the Python
script complaining about an unknown option.

QEMU's minimum Sphinx version is already 3.4.3, so this doesn't
change the set of versions we can handle.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-7-peter.maydell@linaro.org
---
 docs/conf.py             | 4 +++-
 docs/sphinx/kerneldoc.py | 5 -----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index f892a6e1da..e09769e5f8 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -341,7 +341,9 @@ man_make_section_directory = False
 # We use paths starting from qemu_docdir here so that you can run
 # sphinx-build from anywhere and the kerneldoc extension can still
 # find everything.
-kerneldoc_bin = ['perl', os.path.join(qemu_docdir, '../scripts/kernel-doc')]
+# Since kernel-doc is now a Python script, we should run it with whatever
+# Python this sphinx is using (rather than letting it find one via env)
+kerneldoc_bin = [sys.executable, os.path.join(qemu_docdir, '../scripts/kernel-doc.py')]
 kerneldoc_srctree = os.path.join(qemu_docdir, '..')
 hxtool_srctree = os.path.join(qemu_docdir, '..')
 qapidoc_srctree = os.path.join(qemu_docdir, '..')
diff --git a/docs/sphinx/kerneldoc.py b/docs/sphinx/kerneldoc.py
index 30bb343198..9721072e47 100644
--- a/docs/sphinx/kerneldoc.py
+++ b/docs/sphinx/kerneldoc.py
@@ -63,11 +63,6 @@ class KernelDocDirective(Directive):
         env = self.state.document.settings.env
         cmd = env.config.kerneldoc_bin + ['-rst', '-enable-lineno']
 
-        # Pass the version string to kernel-doc, as it needs to use a different
-        # dialect, depending what the C domain supports for each specific
-        # Sphinx versions
-        cmd += ['-sphinx-version', sphinx.__version__]
-
         # Pass through the warnings-as-errors flag
         if env.config.kerneldoc_werror:
             cmd += ['-Werror']

From 619d5f0211ac69d71291505a8528671ab83764e3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:22 +0100
Subject: [PATCH 0249/2396] scripts/kernel-doc: Delete the old Perl kernel-doc
 script

We can now delete the old Perl kernel-doc script. For posterity,
this is a complete diff of the local changes that we were carrying
between the kernel's Perl script as of kernel commit 72b97d0b911872ba
(the last time we synced it) and our local copy:

--- /tmp/kdoc   2025-08-14 10:42:47.620331939 +0100
+++ scripts/kernel-doc  2025-02-17 10:44:34.528421457 +0000
@@ -1,5 +1,5 @@
 #!/usr/bin/env perl
-# SPDX-License-Identifier: GPL-2.0
+# SPDX-License-Identifier: GPL-2.0-only

 use warnings;
 use strict;
@@ -224,12 +224,12 @@
 my $type_fp_param = '\@(\w+)\(\)';  # Special RST handling for func ptr params
 my $type_fp_param2 = '\@(\w+->\S+)\(\)';  # Special RST handling for structs with func ptr params
 my $type_env = '(\$\w+)';
-my $type_enum = '\&(enum\s*([_\w]+))';
-my $type_struct = '\&(struct\s*([_\w]+))';
-my $type_typedef = '\&(typedef\s*([_\w]+))';
-my $type_union = '\&(union\s*([_\w]+))';
-my $type_member = '\&([_\w]+)(\.|->)([_\w]+)';
-my $type_fallback = '\&([_\w]+)';
+my $type_enum = '#(enum\s*([_\w]+))';
+my $type_struct = '#(struct\s*([_\w]+))';
+my $type_typedef = '#(([A-Z][_\w]*))';
+my $type_union = '#(union\s*([_\w]+))';
+my $type_member = '#([_\w]+)(\.|->)([_\w]+)';
+my $type_fallback = '(?!)';    # this never matches
 my $type_member_func = $type_member . '\(\)';

 # Output conversion substitutions.
@@ -1745,6 +1745,9 @@
             )+
           \)\)\s+//x;

+    # Strip QEMU specific compiler annotations
+    $prototype =~ s/QEMU_[A-Z_]+ +//;
+
     # Yes, this truly is vile.  We are looking for:
     # 1. Return type (may be nothing if we're looking at a macro)
     # 2. Function name
@@ -2057,7 +2060,7 @@
     }
     elsif (/$doc_decl/o) {
        $identifier = $1;
-       if (/\s*([\w\s]+?)(\(\))?\s*-/) {
+       if (/\s*([\w\s]+?)(\s*-|:)/) {
            $identifier = $1;
        }

@@ -2067,7 +2070,7 @@
        $contents = "";
        $section = $section_default;
        $new_start_line = $. + 1;
-       if (/-(.*)/) {
+       if (/[-:](.*)/) {
            # strip leading/trailing/multiple spaces
            $descr= $1;
            $descr =~ s/^\s*//;

These changes correspond to:
06e2329636f license: Update deprecated SPDX tag GPL-2.0 to GPL-2.0-only
(a bulk change which we won't bother to re-apply to this third-party script)
b30df2751e5 scripts/kernel-doc: strip QEMU_ from function definitions
4cf41794411 docs: tweak kernel-doc for QEMU coding standards

We have already applied the equivalent of these changes to the
Python code in libs/kdoc/ in the preceding commits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .editorconfig      |    2 +-
 scripts/kernel-doc | 2441 --------------------------------------------
 2 files changed, 1 insertion(+), 2442 deletions(-)
 delete mode 100755 scripts/kernel-doc

diff --git a/.editorconfig b/.editorconfig
index a04cb9054c..258d41ab48 100644
--- a/.editorconfig
+++ b/.editorconfig
@@ -55,7 +55,7 @@ indent_size = 4
 emacs_mode = perl
 
 # but user kernel "style" for imported scripts
-[scripts/{kernel-doc,get_maintainer.pl,checkpatch.pl}]
+[scripts/{get_maintainer.pl,checkpatch.pl}]
 indent_style = tab
 indent_size = 8
 emacs_mode = perl
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
deleted file mode 100755
index 117ec8fcd1..0000000000
--- a/scripts/kernel-doc
+++ /dev/null
@@ -1,2441 +0,0 @@
-#!/usr/bin/env perl
-# SPDX-License-Identifier: GPL-2.0-only
-
-use warnings;
-use strict;
-
-## Copyright (c) 1998 Michael Zucchi, All Rights Reserved        ##
-## Copyright (C) 2000, 1  Tim Waugh <twaugh@redhat.com>          ##
-## Copyright (C) 2001  Simon Huggins                             ##
-## Copyright (C) 2005-2012  Randy Dunlap                         ##
-## Copyright (C) 2012  Dan Luedtke                               ##
-## 								 ##
-## #define enhancements by Armin Kuster <akuster@mvista.com>	 ##
-## Copyright (c) 2000 MontaVista Software, Inc.			 ##
-## 								 ##
-## This software falls under the GNU General Public License.     ##
-## Please read the COPYING file for more information             ##
-
-# 18/01/2001 - 	Cleanups
-# 		Functions prototyped as foo(void) same as foo()
-# 		Stop eval'ing where we don't need to.
-# -- huggie@earth.li
-
-# 27/06/2001 -  Allowed whitespace after initial "/**" and
-#               allowed comments before function declarations.
-# -- Christian Kreibich <ck@whoop.org>
-
-# Still to do:
-# 	- add perldoc documentation
-# 	- Look more closely at some of the scarier bits :)
-
-# 26/05/2001 - 	Support for separate source and object trees.
-#		Return error code.
-# 		Keith Owens <kaos@ocs.com.au>
-
-# 23/09/2001 - Added support for typedefs, structs, enums and unions
-#              Support for Context section; can be terminated using empty line
-#              Small fixes (like spaces vs. \s in regex)
-# -- Tim Jansen <tim@tjansen.de>
-
-# 25/07/2012 - Added support for HTML5
-# -- Dan Luedtke <mail@danrl.de>
-
-sub usage {
-    my $message = <<"EOF";
-Usage: $0 [OPTION ...] FILE ...
-
-Read C language source or header FILEs, extract embedded documentation comments,
-and print formatted documentation to standard output.
-
-The documentation comments are identified by "/**" opening comment mark. See
-Documentation/doc-guide/kernel-doc.rst for the documentation comment syntax.
-
-Output format selection (mutually exclusive):
-  -man			Output troff manual page format. This is the default.
-  -rst			Output reStructuredText format.
-  -none			Do not output documentation, only warnings.
-
-Output format selection modifier (affects only ReST output):
-
-  -sphinx-version	Use the ReST C domain dialect compatible with an
-			specific Sphinx Version.
-			If not specified, kernel-doc will auto-detect using
-			the sphinx-build version found on PATH.
-
-Output selection (mutually exclusive):
-  -export		Only output documentation for symbols that have been
-			exported using EXPORT_SYMBOL() or EXPORT_SYMBOL_GPL()
-                        in any input FILE or -export-file FILE.
-  -internal		Only output documentation for symbols that have NOT been
-			exported using EXPORT_SYMBOL() or EXPORT_SYMBOL_GPL()
-                        in any input FILE or -export-file FILE.
-  -function NAME	Only output documentation for the given function(s)
-			or DOC: section title(s). All other functions and DOC:
-			sections are ignored. May be specified multiple times.
-  -nosymbol NAME	Exclude the specified symbols from the output
-		        documentation. May be specified multiple times.
-
-Output selection modifiers:
-  -no-doc-sections	Do not output DOC: sections.
-  -enable-lineno        Enable output of #define LINENO lines. Only works with
-                        reStructuredText format.
-  -export-file FILE     Specify an additional FILE in which to look for
-                        EXPORT_SYMBOL() and EXPORT_SYMBOL_GPL(). To be used with
-                        -export or -internal. May be specified multiple times.
-
-Other parameters:
-  -v			Verbose output, more warnings and other information.
-  -h			Print this help.
-  -Werror		Treat warnings as errors.
-
-EOF
-    print $message;
-    exit 1;
-}
-
-#
-# format of comments.
-# In the following table, (...)? signifies optional structure.
-#                         (...)* signifies 0 or more structure elements
-# /**
-#  * function_name(:)? (- short description)?
-# (* @parameterx: (description of parameter x)?)*
-# (* a blank line)?
-#  * (Description:)? (Description of function)?
-#  * (section header: (section description)? )*
-#  (*)?*/
-#
-# So .. the trivial example would be:
-#
-# /**
-#  * my_function
-#  */
-#
-# If the Description: header tag is omitted, then there must be a blank line
-# after the last parameter specification.
-# e.g.
-# /**
-#  * my_function - does my stuff
-#  * @my_arg: its mine damnit
-#  *
-#  * Does my stuff explained.
-#  */
-#
-#  or, could also use:
-# /**
-#  * my_function - does my stuff
-#  * @my_arg: its mine damnit
-#  * Description: Does my stuff explained.
-#  */
-# etc.
-#
-# Besides functions you can also write documentation for structs, unions,
-# enums and typedefs. Instead of the function name you must write the name
-# of the declaration;  the struct/union/enum/typedef must always precede
-# the name. Nesting of declarations is not supported.
-# Use the argument mechanism to document members or constants.
-# e.g.
-# /**
-#  * struct my_struct - short description
-#  * @a: first member
-#  * @b: second member
-#  *
-#  * Longer description
-#  */
-# struct my_struct {
-#     int a;
-#     int b;
-# /* private: */
-#     int c;
-# };
-#
-# All descriptions can be multiline, except the short function description.
-#
-# For really longs structs, you can also describe arguments inside the
-# body of the struct.
-# eg.
-# /**
-#  * struct my_struct - short description
-#  * @a: first member
-#  * @b: second member
-#  *
-#  * Longer description
-#  */
-# struct my_struct {
-#     int a;
-#     int b;
-#     /**
-#      * @c: This is longer description of C
-#      *
-#      * You can use paragraphs to describe arguments
-#      * using this method.
-#      */
-#     int c;
-# };
-#
-# This should be use only for struct/enum members.
-#
-# You can also add additional sections. When documenting kernel functions you
-# should document the "Context:" of the function, e.g. whether the functions
-# can be called form interrupts. Unlike other sections you can end it with an
-# empty line.
-# A non-void function should have a "Return:" section describing the return
-# value(s).
-# Example-sections should contain the string EXAMPLE so that they are marked
-# appropriately in DocBook.
-#
-# Example:
-# /**
-#  * user_function - function that can only be called in user context
-#  * @a: some argument
-#  * Context: !in_interrupt()
-#  *
-#  * Some description
-#  * Example:
-#  *    user_function(22);
-#  */
-# ...
-#
-#
-# All descriptive text is further processed, scanning for the following special
-# patterns, which are highlighted appropriately.
-#
-# 'funcname()' - function
-# '$ENVVAR' - environmental variable
-# '&struct_name' - name of a structure (up to two words including 'struct')
-# '&struct_name.member' - name of a structure member
-# '@parameter' - name of a parameter
-# '%CONST' - name of a constant.
-# '``LITERAL``' - literal string without any spaces on it.
-
-## init lots of data
-
-my $errors = 0;
-my $warnings = 0;
-my $anon_struct_union = 0;
-
-# match expressions used to find embedded type information
-my $type_constant = '\b``([^\`]+)``\b';
-my $type_constant2 = '\%([-_\w]+)';
-my $type_func = '(\w+)\(\)';
-my $type_param = '\@(\w*((\.\w+)|(->\w+))*(\.\.\.)?)';
-my $type_param_ref = '([\!]?)\@(\w*((\.\w+)|(->\w+))*(\.\.\.)?)';
-my $type_fp_param = '\@(\w+)\(\)';  # Special RST handling for func ptr params
-my $type_fp_param2 = '\@(\w+->\S+)\(\)';  # Special RST handling for structs with func ptr params
-my $type_env = '(\$\w+)';
-my $type_enum = '#(enum\s*([_\w]+))';
-my $type_struct = '#(struct\s*([_\w]+))';
-my $type_typedef = '#(([A-Z][_\w]*))';
-my $type_union = '#(union\s*([_\w]+))';
-my $type_member = '#([_\w]+)(\.|->)([_\w]+)';
-my $type_fallback = '(?!)';    # this never matches
-my $type_member_func = $type_member . '\(\)';
-
-# Output conversion substitutions.
-#  One for each output format
-
-# these are pretty rough
-my @highlights_man = (
-                      [$type_constant, "\$1"],
-                      [$type_constant2, "\$1"],
-                      [$type_func, "\\\\fB\$1\\\\fP"],
-                      [$type_enum, "\\\\fI\$1\\\\fP"],
-                      [$type_struct, "\\\\fI\$1\\\\fP"],
-                      [$type_typedef, "\\\\fI\$1\\\\fP"],
-                      [$type_union, "\\\\fI\$1\\\\fP"],
-                      [$type_param, "\\\\fI\$1\\\\fP"],
-                      [$type_param_ref, "\\\\fI\$1\$2\\\\fP"],
-                      [$type_member, "\\\\fI\$1\$2\$3\\\\fP"],
-                      [$type_fallback, "\\\\fI\$1\\\\fP"]
-		     );
-my $blankline_man = "";
-
-# rst-mode
-my @highlights_rst = (
-                       [$type_constant, "``\$1``"],
-                       [$type_constant2, "``\$1``"],
-                       # Note: need to escape () to avoid func matching later
-                       [$type_member_func, "\\:c\\:type\\:`\$1\$2\$3\\\\(\\\\) <\$1>`"],
-                       [$type_member, "\\:c\\:type\\:`\$1\$2\$3 <\$1>`"],
-		       [$type_fp_param, "**\$1\\\\(\\\\)**"],
-		       [$type_fp_param2, "**\$1\\\\(\\\\)**"],
-                       [$type_func, "\$1()"],
-                       [$type_enum, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_struct, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_typedef, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       [$type_union, "\\:c\\:type\\:`\$1 <\$2>`"],
-                       # in rst this can refer to any type
-                       [$type_fallback, "\\:c\\:type\\:`\$1`"],
-                       [$type_param_ref, "**\$1\$2**"]
-		      );
-my $blankline_rst = "\n";
-
-# read arguments
-if ($#ARGV == -1) {
-    usage();
-}
-
-my $kernelversion;
-my ($sphinx_major, $sphinx_minor, $sphinx_patch);
-
-my $dohighlight = "";
-
-my $verbose = 0;
-my $Werror = 0;
-my $output_mode = "rst";
-my $output_preformatted = 0;
-my $no_doc_sections = 0;
-my $enable_lineno = 0;
-my @highlights = @highlights_rst;
-my $blankline = $blankline_rst;
-my $modulename = "Kernel API";
-
-use constant {
-    OUTPUT_ALL          => 0, # output all symbols and doc sections
-    OUTPUT_INCLUDE      => 1, # output only specified symbols
-    OUTPUT_EXPORTED     => 2, # output exported symbols
-    OUTPUT_INTERNAL     => 3, # output non-exported symbols
-};
-my $output_selection = OUTPUT_ALL;
-my $show_not_found = 0;	# No longer used
-
-my @export_file_list;
-
-my @build_time;
-if (defined($ENV{'KBUILD_BUILD_TIMESTAMP'}) &&
-    (my $seconds = `date -d"${ENV{'KBUILD_BUILD_TIMESTAMP'}}" +%s`) ne '') {
-    @build_time = gmtime($seconds);
-} else {
-    @build_time = localtime;
-}
-
-my $man_date = ('January', 'February', 'March', 'April', 'May', 'June',
-		'July', 'August', 'September', 'October',
-		'November', 'December')[$build_time[4]] .
-  " " . ($build_time[5]+1900);
-
-# Essentially these are globals.
-# They probably want to be tidied up, made more localised or something.
-# CAVEAT EMPTOR!  Some of the others I localised may not want to be, which
-# could cause "use of undefined value" or other bugs.
-my ($function, %function_table, %parametertypes, $declaration_purpose);
-my %nosymbol_table = ();
-my $declaration_start_line;
-my ($type, $declaration_name, $return_type);
-my ($newsection, $newcontents, $prototype, $brcount, %source_map);
-
-if (defined($ENV{'KBUILD_VERBOSE'})) {
-	$verbose = "$ENV{'KBUILD_VERBOSE'}";
-}
-
-if (defined($ENV{'KDOC_WERROR'})) {
-	$Werror = "$ENV{'KDOC_WERROR'}";
-}
-
-if (defined($ENV{'KCFLAGS'})) {
-	my $kcflags = "$ENV{'KCFLAGS'}";
-
-	if ($kcflags =~ /Werror/) {
-		$Werror = 1;
-	}
-}
-
-# Generated docbook code is inserted in a template at a point where
-# docbook v3.1 requires a non-zero sequence of RefEntry's; see:
-# https://www.oasis-open.org/docbook/documentation/reference/html/refentry.html
-# We keep track of number of generated entries and generate a dummy
-# if needs be to ensure the expanded template can be postprocessed
-# into html.
-my $section_counter = 0;
-
-my $lineprefix="";
-
-# Parser states
-use constant {
-    STATE_NORMAL        => 0,        # normal code
-    STATE_NAME          => 1,        # looking for function name
-    STATE_BODY_MAYBE    => 2,        # body - or maybe more description
-    STATE_BODY          => 3,        # the body of the comment
-    STATE_BODY_WITH_BLANK_LINE => 4, # the body, which has a blank line
-    STATE_PROTO         => 5,        # scanning prototype
-    STATE_DOCBLOCK      => 6,        # documentation block
-    STATE_INLINE        => 7,        # gathering doc outside main block
-};
-my $state;
-my $in_doc_sect;
-my $leading_space;
-
-# Inline documentation state
-use constant {
-    STATE_INLINE_NA     => 0, # not applicable ($state != STATE_INLINE)
-    STATE_INLINE_NAME   => 1, # looking for member name (@foo:)
-    STATE_INLINE_TEXT   => 2, # looking for member documentation
-    STATE_INLINE_END    => 3, # done
-    STATE_INLINE_ERROR  => 4, # error - Comment without header was found.
-                              # Spit a warning as it's not
-                              # proper kernel-doc and ignore the rest.
-};
-my $inline_doc_state;
-
-#declaration types: can be
-# 'function', 'struct', 'union', 'enum', 'typedef'
-my $decl_type;
-
-my $doc_start = '^/\*\*\s*$'; # Allow whitespace at end of comment start.
-my $doc_end = '\*/';
-my $doc_com = '\s*\*\s*';
-my $doc_com_body = '\s*\* ?';
-my $doc_decl = $doc_com . '(\w+)';
-# @params and a strictly limited set of supported section names
-my $doc_sect = $doc_com .
-    '\s*(\@[.\w]+|\@\.\.\.|description|context|returns?|notes?|examples?)\s*:(.*)';
-my $doc_content = $doc_com_body . '(.*)';
-my $doc_block = $doc_com . 'DOC:\s*(.*)?';
-my $doc_inline_start = '^\s*/\*\*\s*$';
-my $doc_inline_sect = '\s*\*\s*(@\s*[\w][\w\.]*\s*):(.*)';
-my $doc_inline_end = '^\s*\*/\s*$';
-my $doc_inline_oneline = '^\s*/\*\*\s*(@[\w\s]+):\s*(.*)\s*\*/\s*$';
-my $export_symbol = '^\s*EXPORT_SYMBOL(_GPL)?\s*\(\s*(\w+)\s*\)\s*;';
-
-my %parameterdescs;
-my %parameterdesc_start_lines;
-my @parameterlist;
-my %sections;
-my @sectionlist;
-my %section_start_lines;
-my $sectcheck;
-my $struct_actual;
-
-my $contents = "";
-my $new_start_line = 0;
-
-# the canonical section names. see also $doc_sect above.
-my $section_default = "Description";	# default section
-my $section_intro = "Introduction";
-my $section = $section_default;
-my $section_context = "Context";
-my $section_return = "Return";
-
-my $undescribed = "-- undescribed --";
-
-reset_state();
-
-while ($ARGV[0] =~ m/^--?(.*)/) {
-    my $cmd = $1;
-    shift @ARGV;
-    if ($cmd eq "man") {
-	$output_mode = "man";
-	@highlights = @highlights_man;
-	$blankline = $blankline_man;
-    } elsif ($cmd eq "rst") {
-	$output_mode = "rst";
-	@highlights = @highlights_rst;
-	$blankline = $blankline_rst;
-    } elsif ($cmd eq "none") {
-	$output_mode = "none";
-    } elsif ($cmd eq "module") { # not needed for XML, inherits from calling document
-	$modulename = shift @ARGV;
-    } elsif ($cmd eq "function") { # to only output specific functions
-	$output_selection = OUTPUT_INCLUDE;
-	$function = shift @ARGV;
-	$function_table{$function} = 1;
-    } elsif ($cmd eq "nosymbol") { # Exclude specific symbols
-	my $symbol = shift @ARGV;
-	$nosymbol_table{$symbol} = 1;
-    } elsif ($cmd eq "export") { # only exported symbols
-	$output_selection = OUTPUT_EXPORTED;
-	%function_table = ();
-    } elsif ($cmd eq "internal") { # only non-exported symbols
-	$output_selection = OUTPUT_INTERNAL;
-	%function_table = ();
-    } elsif ($cmd eq "export-file") {
-	my $file = shift @ARGV;
-	push(@export_file_list, $file);
-    } elsif ($cmd eq "v") {
-	$verbose = 1;
-    } elsif ($cmd eq "Werror") {
-	$Werror = 1;
-    } elsif (($cmd eq "h") || ($cmd eq "help")) {
-	usage();
-    } elsif ($cmd eq 'no-doc-sections') {
-	    $no_doc_sections = 1;
-    } elsif ($cmd eq 'enable-lineno') {
-	    $enable_lineno = 1;
-    } elsif ($cmd eq 'show-not-found') {
-	$show_not_found = 1;  # A no-op but don't fail
-    } elsif ($cmd eq "sphinx-version") {
-	my $ver_string = shift @ARGV;
-	if ($ver_string =~ m/^(\d+)(\.\d+)?(\.\d+)?/) {
-	    $sphinx_major = $1;
-	    if (defined($2)) {
-		$sphinx_minor = substr($2,1);
-	    } else {
-		$sphinx_minor = 0;
-	    }
-	    if (defined($3)) {
-		$sphinx_patch = substr($3,1)
-	    } else {
-		$sphinx_patch = 0;
-	    }
-	} else {
-	    die "Sphinx version should either major.minor or major.minor.patch format\n";
-	}
-    } else {
-	# Unknown argument
-        usage();
-    }
-}
-
-# continue execution near EOF;
-
-# The C domain dialect changed on Sphinx 3. So, we need to check the
-# version in order to produce the right tags.
-sub findprog($)
-{
-	foreach(split(/:/, $ENV{PATH})) {
-		return "$_/$_[0]" if(-x "$_/$_[0]");
-	}
-}
-
-sub get_sphinx_version()
-{
-	my $ver;
-
-	my $cmd = "sphinx-build";
-	if (!findprog($cmd)) {
-		my $cmd = "sphinx-build3";
-		if (!findprog($cmd)) {
-			$sphinx_major = 1;
-			$sphinx_minor = 2;
-			$sphinx_patch = 0;
-			printf STDERR "Warning: Sphinx version not found. Using default (Sphinx version %d.%d.%d)\n",
-			       $sphinx_major, $sphinx_minor, $sphinx_patch;
-			return;
-		}
-	}
-
-	open IN, "$cmd --version 2>&1 |";
-	while (<IN>) {
-		if (m/^\s*sphinx-build\s+([\d]+)\.([\d\.]+)(\+\/[\da-f]+)?$/) {
-			$sphinx_major = $1;
-			$sphinx_minor = $2;
-			$sphinx_patch = $3;
-			last;
-		}
-		# Sphinx 1.2.x uses a different format
-		if (m/^\s*Sphinx.*\s+([\d]+)\.([\d\.]+)$/) {
-			$sphinx_major = $1;
-			$sphinx_minor = $2;
-			$sphinx_patch = $3;
-			last;
-		}
-	}
-	close IN;
-}
-
-# get kernel version from env
-sub get_kernel_version() {
-    my $version = 'unknown kernel version';
-
-    if (defined($ENV{'KERNELVERSION'})) {
-	$version = $ENV{'KERNELVERSION'};
-    }
-    return $version;
-}
-
-#
-sub print_lineno {
-    my $lineno = shift;
-    if ($enable_lineno && defined($lineno)) {
-        print "#define LINENO " . $lineno . "\n";
-    }
-}
-##
-# dumps section contents to arrays/hashes intended for that purpose.
-#
-sub dump_section {
-    my $file = shift;
-    my $name = shift;
-    my $contents = join "\n", @_;
-
-    if ($name =~ m/$type_param/) {
-	$name = $1;
-	$parameterdescs{$name} = $contents;
-	$sectcheck = $sectcheck . $name . " ";
-        $parameterdesc_start_lines{$name} = $new_start_line;
-        $new_start_line = 0;
-    } elsif ($name eq "@\.\.\.") {
-	$name = "...";
-	$parameterdescs{$name} = $contents;
-	$sectcheck = $sectcheck . $name . " ";
-        $parameterdesc_start_lines{$name} = $new_start_line;
-        $new_start_line = 0;
-    } else {
-	if (defined($sections{$name}) && ($sections{$name} ne "")) {
-	    # Only warn on user specified duplicate section names.
-	    if ($name ne $section_default) {
-		print STDERR "${file}:$.: warning: duplicate section name '$name'\n";
-		++$warnings;
-	    }
-	    $sections{$name} .= $contents;
-	} else {
-	    $sections{$name} = $contents;
-	    push @sectionlist, $name;
-            $section_start_lines{$name} = $new_start_line;
-            $new_start_line = 0;
-	}
-    }
-}
-
-##
-# dump DOC: section after checking that it should go out
-#
-sub dump_doc_section {
-    my $file = shift;
-    my $name = shift;
-    my $contents = join "\n", @_;
-
-    if ($no_doc_sections) {
-        return;
-    }
-
-    return if (defined($nosymbol_table{$name}));
-
-    if (($output_selection == OUTPUT_ALL) ||
-	(($output_selection == OUTPUT_INCLUDE) &&
-	 defined($function_table{$name})))
-    {
-	dump_section($file, $name, $contents);
-	output_blockhead({'sectionlist' => \@sectionlist,
-			  'sections' => \%sections,
-			  'module' => $modulename,
-			  'content-only' => ($output_selection != OUTPUT_ALL), });
-    }
-}
-
-##
-# output function
-#
-# parameterdescs, a hash.
-#  function => "function name"
-#  parameterlist => @list of parameters
-#  parameterdescs => %parameter descriptions
-#  sectionlist => @list of sections
-#  sections => %section descriptions
-#
-
-sub output_highlight {
-    my $contents = join "\n",@_;
-    my $line;
-
-#   DEBUG
-#   if (!defined $contents) {
-#	use Carp;
-#	confess "output_highlight got called with no args?\n";
-#   }
-
-#   print STDERR "contents b4:$contents\n";
-    eval $dohighlight;
-    die $@ if $@;
-#   print STDERR "contents af:$contents\n";
-
-    foreach $line (split "\n", $contents) {
-	if (! $output_preformatted) {
-	    $line =~ s/^\s*//;
-	}
-	if ($line eq ""){
-	    if (! $output_preformatted) {
-		print $lineprefix, $blankline;
-	    }
-	} else {
-	    if ($output_mode eq "man" && substr($line, 0, 1) eq ".") {
-		print "\\&$line";
-	    } else {
-		print $lineprefix, $line;
-	    }
-	}
-	print "\n";
-    }
-}
-
-##
-# output function in man
-sub output_function_man(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-    my $count;
-
-    print ".TH \"$args{'function'}\" 9 \"$args{'function'}\" \"$man_date\" \"Kernel Hacker's Manual\" LINUX\n";
-
-    print ".SH NAME\n";
-    print $args{'function'} . " \\- " . $args{'purpose'} . "\n";
-
-    print ".SH SYNOPSIS\n";
-    if ($args{'functiontype'} ne "") {
-	print ".B \"" . $args{'functiontype'} . "\" " . $args{'function'} . "\n";
-    } else {
-	print ".B \"" . $args{'function'} . "\n";
-    }
-    $count = 0;
-    my $parenth = "(";
-    my $post = ",";
-    foreach my $parameter (@{$args{'parameterlist'}}) {
-	if ($count == $#{$args{'parameterlist'}}) {
-	    $post = ");";
-	}
-	$type = $args{'parametertypes'}{$parameter};
-	if ($type =~ m/([^\(]*\(\*)\s*\)\s*\(([^\)]*)\)/) {
-	    # pointer-to-function
-	    print ".BI \"" . $parenth . $1 . "\" " . " \") (" . $2 . ")" . $post . "\"\n";
-	} else {
-	    $type =~ s/([^\*])$/$1 /;
-	    print ".BI \"" . $parenth . $type . "\" " . " \"" . $post . "\"\n";
-	}
-	$count++;
-	$parenth = "";
-    }
-
-    print ".SH ARGUMENTS\n";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
-    }
-    foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"", uc $section, "\"\n";
-	output_highlight($args{'sections'}{$section});
-    }
-}
-
-##
-# output enum in man
-sub output_enum_man(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-    my $count;
-
-    print ".TH \"$args{'module'}\" 9 \"enum $args{'enum'}\" \"$man_date\" \"API Manual\" LINUX\n";
-
-    print ".SH NAME\n";
-    print "enum " . $args{'enum'} . " \\- " . $args{'purpose'} . "\n";
-
-    print ".SH SYNOPSIS\n";
-    print "enum " . $args{'enum'} . " {\n";
-    $count = 0;
-    foreach my $parameter (@{$args{'parameterlist'}}) {
-	print ".br\n.BI \"    $parameter\"\n";
-	if ($count == $#{$args{'parameterlist'}}) {
-	    print "\n};\n";
-	    last;
-	}
-	else {
-	    print ", \n.br\n";
-	}
-	$count++;
-    }
-
-    print ".SH Constants\n";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
-    }
-    foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
-    }
-}
-
-##
-# output struct in man
-sub output_struct_man(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-
-    print ".TH \"$args{'module'}\" 9 \"" . $args{'type'} . " " . $args{'struct'} . "\" \"$man_date\" \"API Manual\" LINUX\n";
-
-    print ".SH NAME\n";
-    print $args{'type'} . " " . $args{'struct'} . " \\- " . $args{'purpose'} . "\n";
-
-    my $declaration = $args{'definition'};
-    $declaration =~ s/\t/  /g;
-    $declaration =~ s/\n/"\n.br\n.BI \"/g;
-    print ".SH SYNOPSIS\n";
-    print $args{'type'} . " " . $args{'struct'} . " {\n.br\n";
-    print ".BI \"$declaration\n};\n.br\n\n";
-
-    print ".SH Members\n";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	($parameter =~ /^#/) && next;
-
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-
-	($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
-	print ".IP \"" . $parameter . "\" 12\n";
-	output_highlight($args{'parameterdescs'}{$parameter_name});
-    }
-    foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
-    }
-}
-
-##
-# output typedef in man
-sub output_typedef_man(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-
-    print ".TH \"$args{'module'}\" 9 \"$args{'typedef'}\" \"$man_date\" \"API Manual\" LINUX\n";
-
-    print ".SH NAME\n";
-    print "typedef " . $args{'typedef'} . " \\- " . $args{'purpose'} . "\n";
-
-    foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
-    }
-}
-
-sub output_blockhead_man(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-    my $count;
-
-    print ".TH \"$args{'module'}\" 9 \"$args{'module'}\" \"$man_date\" \"API Manual\" LINUX\n";
-
-    foreach $section (@{$args{'sectionlist'}}) {
-	print ".SH \"$section\"\n";
-	output_highlight($args{'sections'}{$section});
-    }
-}
-
-##
-# output in restructured text
-#
-
-#
-# This could use some work; it's used to output the DOC: sections, and
-# starts by putting out the name of the doc section itself, but that tends
-# to duplicate a header already in the template file.
-#
-sub output_blockhead_rst(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-
-    foreach $section (@{$args{'sectionlist'}}) {
-	next if (defined($nosymbol_table{$section}));
-
-	if ($output_selection != OUTPUT_INCLUDE) {
-	    print "**$section**\n\n";
-	}
-        print_lineno($section_start_lines{$section});
-	output_highlight_rst($args{'sections'}{$section});
-	print "\n";
-    }
-}
-
-#
-# Apply the RST highlights to a sub-block of text.
-#
-sub highlight_block($) {
-    # The dohighlight kludge requires the text be called $contents
-    my $contents = shift;
-    eval $dohighlight;
-    die $@ if $@;
-    return $contents;
-}
-
-#
-# Regexes used only here.
-#
-my $sphinx_literal = '^[^.].*::$';
-my $sphinx_cblock = '^\.\.\ +code-block::';
-
-sub output_highlight_rst {
-    my $input = join "\n",@_;
-    my $output = "";
-    my $line;
-    my $in_literal = 0;
-    my $litprefix;
-    my $block = "";
-
-    foreach $line (split "\n",$input) {
-	#
-	# If we're in a literal block, see if we should drop out
-	# of it.  Otherwise pass the line straight through unmunged.
-	#
-	if ($in_literal) {
-	    if (! ($line =~ /^\s*$/)) {
-		#
-		# If this is the first non-blank line in a literal
-		# block we need to figure out what the proper indent is.
-		#
-		if ($litprefix eq "") {
-		    $line =~ /^(\s*)/;
-		    $litprefix = '^' . $1;
-		    $output .= $line . "\n";
-		} elsif (! ($line =~ /$litprefix/)) {
-		    $in_literal = 0;
-		} else {
-		    $output .= $line . "\n";
-		}
-	    } else {
-		$output .= $line . "\n";
-	    }
-	}
-	#
-	# Not in a literal block (or just dropped out)
-	#
-	if (! $in_literal) {
-	    $block .= $line . "\n";
-	    if (($line =~ /$sphinx_literal/) || ($line =~ /$sphinx_cblock/)) {
-		$in_literal = 1;
-		$litprefix = "";
-		$output .= highlight_block($block);
-		$block = ""
-	    }
-	}
-    }
-
-    if ($block) {
-	$output .= highlight_block($block);
-    }
-    foreach $line (split "\n", $output) {
-	print $lineprefix . $line . "\n";
-    }
-}
-
-sub output_function_rst(%) {
-    my %args = %{$_[0]};
-    my ($parameter, $section);
-    my $oldprefix = $lineprefix;
-    my $start = "";
-    my $is_macro = 0;
-
-    if ($sphinx_major < 3) {
-	if ($args{'typedef'}) {
-	    print ".. c:type:: ". $args{'function'} . "\n\n";
-	    print_lineno($declaration_start_line);
-	    print "   **Typedef**: ";
-	    $lineprefix = "";
-	    output_highlight_rst($args{'purpose'});
-	    $start = "\n\n**Syntax**\n\n  ``";
-	    $is_macro = 1;
-	} else {
-	    print ".. c:function:: ";
-	}
-    } else {
-	if ($args{'typedef'} || $args{'functiontype'} eq "") {
-	    $is_macro = 1;
-	    print ".. c:macro:: ". $args{'function'} . "\n\n";
-	} else {
-	    print ".. c:function:: ";
-	}
-
-	if ($args{'typedef'}) {
-	    print_lineno($declaration_start_line);
-	    print "   **Typedef**: ";
-	    $lineprefix = "";
-	    output_highlight_rst($args{'purpose'});
-	    $start = "\n\n**Syntax**\n\n  ``";
-	} else {
-	    print "``" if ($is_macro);
-	}
-    }
-    if ($args{'functiontype'} ne "") {
-	$start .= $args{'functiontype'} . " " . $args{'function'} . " (";
-    } else {
-	$start .= $args{'function'} . " (";
-    }
-    print $start;
-
-    my $count = 0;
-    foreach my $parameter (@{$args{'parameterlist'}}) {
-	if ($count ne 0) {
-	    print ", ";
-	}
-	$count++;
-	$type = $args{'parametertypes'}{$parameter};
-
-	if ($type =~ m/([^\(]*\(\*)\s*\)\s*\(([^\)]*)\)/) {
-	    # pointer-to-function
-	    print $1 . $parameter . ") (" . $2 . ")";
-	} else {
-	    print $type;
-	}
-    }
-    if ($is_macro) {
-	print ")``\n\n";
-    } else {
-	print ")\n\n";
-    }
-    if (!$args{'typedef'}) {
-	print_lineno($declaration_start_line);
-	$lineprefix = "   ";
-	output_highlight_rst($args{'purpose'});
-	print "\n";
-    }
-
-    print "**Parameters**\n\n";
-    $lineprefix = "  ";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-	$type = $args{'parametertypes'}{$parameter};
-
-	if ($type ne "") {
-	    print "``$type``\n";
-	} else {
-	    print "``$parameter``\n";
-	}
-
-        print_lineno($parameterdesc_start_lines{$parameter_name});
-
-	if (defined($args{'parameterdescs'}{$parameter_name}) &&
-	    $args{'parameterdescs'}{$parameter_name} ne $undescribed) {
-	    output_highlight_rst($args{'parameterdescs'}{$parameter_name});
-	} else {
-	    print "  *undescribed*\n";
-	}
-	print "\n";
-    }
-
-    $lineprefix = $oldprefix;
-    output_section_rst(@_);
-}
-
-sub output_section_rst(%) {
-    my %args = %{$_[0]};
-    my $section;
-    my $oldprefix = $lineprefix;
-    $lineprefix = "";
-
-    foreach $section (@{$args{'sectionlist'}}) {
-	print "**$section**\n\n";
-        print_lineno($section_start_lines{$section});
-	output_highlight_rst($args{'sections'}{$section});
-	print "\n";
-    }
-    print "\n";
-    $lineprefix = $oldprefix;
-}
-
-sub output_enum_rst(%) {
-    my %args = %{$_[0]};
-    my ($parameter);
-    my $oldprefix = $lineprefix;
-    my $count;
-
-    if ($sphinx_major < 3) {
-	my $name = "enum " . $args{'enum'};
-	print "\n\n.. c:type:: " . $name . "\n\n";
-    } else {
-	my $name = $args{'enum'};
-	print "\n\n.. c:enum:: " . $name . "\n\n";
-    }
-    print_lineno($declaration_start_line);
-    $lineprefix = "   ";
-    output_highlight_rst($args{'purpose'});
-    print "\n";
-
-    print "**Constants**\n\n";
-    $lineprefix = "  ";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	print "``$parameter``\n";
-	if ($args{'parameterdescs'}{$parameter} ne $undescribed) {
-	    output_highlight_rst($args{'parameterdescs'}{$parameter});
-	} else {
-	    print "  *undescribed*\n";
-	}
-	print "\n";
-    }
-
-    $lineprefix = $oldprefix;
-    output_section_rst(@_);
-}
-
-sub output_typedef_rst(%) {
-    my %args = %{$_[0]};
-    my ($parameter);
-    my $oldprefix = $lineprefix;
-    my $name;
-
-    if ($sphinx_major < 3) {
-	$name = "typedef " . $args{'typedef'};
-    } else {
-	$name = $args{'typedef'};
-    }
-    print "\n\n.. c:type:: " . $name . "\n\n";
-    print_lineno($declaration_start_line);
-    $lineprefix = "   ";
-    output_highlight_rst($args{'purpose'});
-    print "\n";
-
-    $lineprefix = $oldprefix;
-    output_section_rst(@_);
-}
-
-sub output_struct_rst(%) {
-    my %args = %{$_[0]};
-    my ($parameter);
-    my $oldprefix = $lineprefix;
-
-    if ($sphinx_major < 3) {
-	my $name = $args{'type'} . " " . $args{'struct'};
-	print "\n\n.. c:type:: " . $name . "\n\n";
-    } else {
-	my $name = $args{'struct'};
-	if ($args{'type'} eq 'union') {
-	    print "\n\n.. c:union:: " . $name . "\n\n";
-	} else {
-	    print "\n\n.. c:struct:: " . $name . "\n\n";
-	}
-    }
-    print_lineno($declaration_start_line);
-    $lineprefix = "   ";
-    output_highlight_rst($args{'purpose'});
-    print "\n";
-
-    print "**Definition**\n\n";
-    print "::\n\n";
-    my $declaration = $args{'definition'};
-    $declaration =~ s/\t/  /g;
-    print "  " . $args{'type'} . " " . $args{'struct'} . " {\n$declaration  };\n\n";
-
-    print "**Members**\n\n";
-    $lineprefix = "  ";
-    foreach $parameter (@{$args{'parameterlist'}}) {
-	($parameter =~ /^#/) && next;
-
-	my $parameter_name = $parameter;
-	$parameter_name =~ s/\[.*//;
-
-	($args{'parameterdescs'}{$parameter_name} ne $undescribed) || next;
-	$type = $args{'parametertypes'}{$parameter};
-        print_lineno($parameterdesc_start_lines{$parameter_name});
-	print "``" . $parameter . "``\n";
-	output_highlight_rst($args{'parameterdescs'}{$parameter_name});
-	print "\n";
-    }
-    print "\n";
-
-    $lineprefix = $oldprefix;
-    output_section_rst(@_);
-}
-
-## none mode output functions
-
-sub output_function_none(%) {
-}
-
-sub output_enum_none(%) {
-}
-
-sub output_typedef_none(%) {
-}
-
-sub output_struct_none(%) {
-}
-
-sub output_blockhead_none(%) {
-}
-
-##
-# generic output function for all types (function, struct/union, typedef, enum);
-# calls the generated, variable output_ function name based on
-# functype and output_mode
-sub output_declaration {
-    no strict 'refs';
-    my $name = shift;
-    my $functype = shift;
-    my $func = "output_${functype}_$output_mode";
-
-    return if (defined($nosymbol_table{$name}));
-
-    if (($output_selection == OUTPUT_ALL) ||
-	(($output_selection == OUTPUT_INCLUDE ||
-	  $output_selection == OUTPUT_EXPORTED) &&
-	 defined($function_table{$name})) ||
-	($output_selection == OUTPUT_INTERNAL &&
-	 !($functype eq "function" && defined($function_table{$name}))))
-    {
-	&$func(@_);
-	$section_counter++;
-    }
-}
-
-##
-# generic output function - calls the right one based on current output mode.
-sub output_blockhead {
-    no strict 'refs';
-    my $func = "output_blockhead_" . $output_mode;
-    &$func(@_);
-    $section_counter++;
-}
-
-##
-# takes a declaration (struct, union, enum, typedef) and
-# invokes the right handler. NOT called for functions.
-sub dump_declaration($$) {
-    no strict 'refs';
-    my ($prototype, $file) = @_;
-    my $func = "dump_" . $decl_type;
-    &$func(@_);
-}
-
-sub dump_union($$) {
-    dump_struct(@_);
-}
-
-sub dump_struct($$) {
-    my $x = shift;
-    my $file = shift;
-
-    if ($x =~ /(struct|union)\s+(\w+)\s*\{(.*)\}(\s*(__packed|__aligned|____cacheline_aligned_in_smp|____cacheline_aligned|__attribute__\s*\(\([a-z0-9,_\s\(\)]*\)\)))*/) {
-	my $decl_type = $1;
-	$declaration_name = $2;
-	my $members = $3;
-
-	# ignore members marked private:
-	$members =~ s/\/\*\s*private:.*?\/\*\s*public:.*?\*\///gosi;
-	$members =~ s/\/\*\s*private:.*//gosi;
-	# strip comments:
-	$members =~ s/\/\*.*?\*\///gos;
-	# strip attributes
-	$members =~ s/\s*__attribute__\s*\(\([a-z0-9,_\*\s\(\)]*\)\)/ /gi;
-	$members =~ s/\s*__aligned\s*\([^;]*\)/ /gos;
-	$members =~ s/\s*__packed\s*/ /gos;
-	$members =~ s/\s*CRYPTO_MINALIGN_ATTR/ /gos;
-	$members =~ s/\s*____cacheline_aligned_in_smp/ /gos;
-	$members =~ s/\s*____cacheline_aligned/ /gos;
-
-	# replace DECLARE_BITMAP
-	$members =~ s/__ETHTOOL_DECLARE_LINK_MODE_MASK\s*\(([^\)]+)\)/DECLARE_BITMAP($1, __ETHTOOL_LINK_MODE_MASK_NBITS)/gos;
-	$members =~ s/DECLARE_BITMAP\s*\(([^,)]+),\s*([^,)]+)\)/unsigned long $1\[BITS_TO_LONGS($2)\]/gos;
-	# replace DECLARE_HASHTABLE
-	$members =~ s/DECLARE_HASHTABLE\s*\(([^,)]+),\s*([^,)]+)\)/unsigned long $1\[1 << (($2) - 1)\]/gos;
-	# replace DECLARE_KFIFO
-	$members =~ s/DECLARE_KFIFO\s*\(([^,)]+),\s*([^,)]+),\s*([^,)]+)\)/$2 \*$1/gos;
-	# replace DECLARE_KFIFO_PTR
-	$members =~ s/DECLARE_KFIFO_PTR\s*\(([^,)]+),\s*([^,)]+)\)/$2 \*$1/gos;
-
-	my $declaration = $members;
-
-	# Split nested struct/union elements as newer ones
-	while ($members =~ m/(struct|union)([^\{\};]+)\{([^\{\}]*)\}([^\{\}\;]*)\;/) {
-		my $newmember;
-		my $maintype = $1;
-		my $ids = $4;
-		my $content = $3;
-		foreach my $id(split /,/, $ids) {
-			$newmember .= "$maintype $id; ";
-
-			$id =~ s/[:\[].*//;
-			$id =~ s/^\s*\**(\S+)\s*/$1/;
-			foreach my $arg (split /;/, $content) {
-				next if ($arg =~ m/^\s*$/);
-				if ($arg =~ m/^([^\(]+\(\*?\s*)([\w\.]*)(\s*\).*)/) {
-					# pointer-to-function
-					my $type = $1;
-					my $name = $2;
-					my $extra = $3;
-					next if (!$name);
-					if ($id =~ m/^\s*$/) {
-						# anonymous struct/union
-						$newmember .= "$type$name$extra; ";
-					} else {
-						$newmember .= "$type$id.$name$extra; ";
-					}
-				} else {
-					my $type;
-					my $names;
-					$arg =~ s/^\s+//;
-					$arg =~ s/\s+$//;
-					# Handle bitmaps
-					$arg =~ s/:\s*\d+\s*//g;
-					# Handle arrays
-					$arg =~ s/\[.*\]//g;
-					# The type may have multiple words,
-					# and multiple IDs can be defined, like:
-					#	const struct foo, *bar, foobar
-					# So, we remove spaces when parsing the
-					# names, in order to match just names
-					# and commas for the names
-					$arg =~ s/\s*,\s*/,/g;
-					if ($arg =~ m/(.*)\s+([\S+,]+)/) {
-						$type = $1;
-						$names = $2;
-					} else {
-						$newmember .= "$arg; ";
-						next;
-					}
-					foreach my $name (split /,/, $names) {
-						$name =~ s/^\s*\**(\S+)\s*/$1/;
-						next if (($name =~ m/^\s*$/));
-						if ($id =~ m/^\s*$/) {
-							# anonymous struct/union
-							$newmember .= "$type $name; ";
-						} else {
-							$newmember .= "$type $id.$name; ";
-						}
-					}
-				}
-			}
-		}
-		$members =~ s/(struct|union)([^\{\};]+)\{([^\{\}]*)\}([^\{\}\;]*)\;/$newmember/;
-	}
-
-	# Ignore other nested elements, like enums
-	$members =~ s/(\{[^\{\}]*\})//g;
-
-	create_parameterlist($members, ';', $file, $declaration_name);
-	check_sections($file, $declaration_name, $decl_type, $sectcheck, $struct_actual);
-
-	# Adjust declaration for better display
-	$declaration =~ s/([\{;])/$1\n/g;
-	$declaration =~ s/\}\s+;/};/g;
-	# Better handle inlined enums
-	do {} while ($declaration =~ s/(enum\s+\{[^\}]+),([^\n])/$1,\n$2/);
-
-	my @def_args = split /\n/, $declaration;
-	my $level = 1;
-	$declaration = "";
-	foreach my $clause (@def_args) {
-		$clause =~ s/^\s+//;
-		$clause =~ s/\s+$//;
-		$clause =~ s/\s+/ /;
-		next if (!$clause);
-		$level-- if ($clause =~ m/(\})/ && $level > 1);
-		if (!($clause =~ m/^\s*#/)) {
-			$declaration .= "\t" x $level;
-		}
-		$declaration .= "\t" . $clause . "\n";
-		$level++ if ($clause =~ m/(\{)/ && !($clause =~m/\}/));
-	}
-	output_declaration($declaration_name,
-			   'struct',
-			   {'struct' => $declaration_name,
-			    'module' => $modulename,
-			    'definition' => $declaration,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose,
-			    'type' => $decl_type
-			   });
-    }
-    else {
-	print STDERR "${file}:$.: error: Cannot parse struct or union!\n";
-	++$errors;
-    }
-}
-
-
-sub show_warnings($$) {
-	my $functype = shift;
-	my $name = shift;
-
-	return 0 if (defined($nosymbol_table{$name}));
-
-	return 1 if ($output_selection == OUTPUT_ALL);
-
-	if ($output_selection == OUTPUT_EXPORTED) {
-		if (defined($function_table{$name})) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-        if ($output_selection == OUTPUT_INTERNAL) {
-		if (!($functype eq "function" && defined($function_table{$name}))) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-	if ($output_selection == OUTPUT_INCLUDE) {
-		if (defined($function_table{$name})) {
-			return 1;
-		} else {
-			return 0;
-		}
-	}
-	die("Please add the new output type at show_warnings()");
-}
-
-sub dump_enum($$) {
-    my $x = shift;
-    my $file = shift;
-    my $members;
-
-
-    $x =~ s@/\*.*?\*/@@gos;	# strip comments.
-    # strip #define macros inside enums
-    $x =~ s@#\s*((define|ifdef)\s+|endif)[^;]*;@@gos;
-
-    if ($x =~ /typedef\s+enum\s*\{(.*)\}\s*(\w*)\s*;/) {
-	$declaration_name = $2;
-	$members = $1;
-    } elsif ($x =~ /enum\s+(\w*)\s*\{(.*)\}/) {
-	$declaration_name = $1;
-	$members = $2;
-    }
-
-    if ($declaration_name) {
-	my %_members;
-
-	$members =~ s/\s+$//;
-
-	foreach my $arg (split ',', $members) {
-	    $arg =~ s/^\s*(\w+).*/$1/;
-	    push @parameterlist, $arg;
-	    if (!$parameterdescs{$arg}) {
-		$parameterdescs{$arg} = $undescribed;
-	        if (show_warnings("enum", $declaration_name)) {
-			print STDERR "${file}:$.: warning: Enum value '$arg' not described in enum '$declaration_name'\n";
-		}
-	    }
-	    $_members{$arg} = 1;
-	}
-
-	while (my ($k, $v) = each %parameterdescs) {
-	    if (!exists($_members{$k})) {
-	        if (show_warnings("enum", $declaration_name)) {
-		     print STDERR "${file}:$.: warning: Excess enum value '$k' description in '$declaration_name'\n";
-		}
-	    }
-        }
-
-	output_declaration($declaration_name,
-			   'enum',
-			   {'enum' => $declaration_name,
-			    'module' => $modulename,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-    } else {
-	print STDERR "${file}:$.: error: Cannot parse enum!\n";
-	++$errors;
-    }
-}
-
-my $typedef_type = qr { ((?:\s+[\w\*]+){1,8})\s* }x;
-my $typedef_ident = qr { \*?\s*(\w\S+)\s* }x;
-my $typedef_args = qr { \s*\((.*)\); }x;
-
-my $typedef1 = qr { typedef$typedef_type\($typedef_ident\)$typedef_args }x;
-my $typedef2 = qr { typedef$typedef_type$typedef_ident$typedef_args }x;
-
-sub dump_typedef($$) {
-    my $x = shift;
-    my $file = shift;
-
-    $x =~ s@/\*.*?\*/@@gos;	# strip comments.
-
-    # Parse function typedef prototypes
-    if ($x =~ $typedef1 || $x =~ $typedef2) {
-	$return_type = $1;
-	$declaration_name = $2;
-	my $args = $3;
-	$return_type =~ s/^\s+//;
-
-	create_parameterlist($args, ',', $file, $declaration_name);
-
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'typedef' => 1,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-	return;
-    }
-
-    while (($x =~ /\(*.\)\s*;$/) || ($x =~ /\[*.\]\s*;$/)) {
-	$x =~ s/\(*.\)\s*;$/;/;
-	$x =~ s/\[*.\]\s*;$/;/;
-    }
-
-    if ($x =~ /typedef.*\s+(\w+)\s*;/) {
-	$declaration_name = $1;
-
-	output_declaration($declaration_name,
-			   'typedef',
-			   {'typedef' => $declaration_name,
-			    'module' => $modulename,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-    }
-    else {
-	print STDERR "${file}:$.: error: Cannot parse typedef!\n";
-	++$errors;
-    }
-}
-
-sub save_struct_actual($) {
-    my $actual = shift;
-
-    # strip all spaces from the actual param so that it looks like one string item
-    $actual =~ s/\s*//g;
-    $struct_actual = $struct_actual . $actual . " ";
-}
-
-sub create_parameterlist($$$$) {
-    my $args = shift;
-    my $splitter = shift;
-    my $file = shift;
-    my $declaration_name = shift;
-    my $type;
-    my $param;
-
-    # temporarily replace commas inside function pointer definition
-    while ($args =~ /(\([^\),]+),/) {
-	$args =~ s/(\([^\),]+),/$1#/g;
-    }
-
-    foreach my $arg (split($splitter, $args)) {
-	# strip comments
-	$arg =~ s/\/\*.*\*\///;
-	# strip leading/trailing spaces
-	$arg =~ s/^\s*//;
-	$arg =~ s/\s*$//;
-	$arg =~ s/\s+/ /;
-
-	if ($arg =~ /^#/) {
-	    # Treat preprocessor directive as a typeless variable just to fill
-	    # corresponding data structures "correctly". Catch it later in
-	    # output_* subs.
-	    push_parameter($arg, "", "", $file);
-	} elsif ($arg =~ m/\(.+\)\s*\(/) {
-	    # pointer-to-function
-	    $arg =~ tr/#/,/;
-	    $arg =~ m/[^\(]+\(\*?\s*([\w\.]*)\s*\)/;
-	    $param = $1;
-	    $type = $arg;
-	    $type =~ s/([^\(]+\(\*?)\s*$param/$1/;
-	    save_struct_actual($param);
-	    push_parameter($param, $type, $arg, $file, $declaration_name);
-	} elsif ($arg) {
-	    $arg =~ s/\s*:\s*/:/g;
-	    $arg =~ s/\s*\[/\[/g;
-
-	    my @args = split('\s*,\s*', $arg);
-	    if ($args[0] =~ m/\*/) {
-		$args[0] =~ s/(\*+)\s*/ $1/;
-	    }
-
-	    my @first_arg;
-	    if ($args[0] =~ /^(.*\s+)(.*?\[.*\].*)$/) {
-		    shift @args;
-		    push(@first_arg, split('\s+', $1));
-		    push(@first_arg, $2);
-	    } else {
-		    @first_arg = split('\s+', shift @args);
-	    }
-
-	    unshift(@args, pop @first_arg);
-	    $type = join " ", @first_arg;
-
-	    foreach $param (@args) {
-		if ($param =~ m/^(\*+)\s*(.*)/) {
-		    save_struct_actual($2);
-
-		    push_parameter($2, "$type $1", $arg, $file, $declaration_name);
-		}
-		elsif ($param =~ m/(.*?):(\d+)/) {
-		    if ($type ne "") { # skip unnamed bit-fields
-			save_struct_actual($1);
-			push_parameter($1, "$type:$2", $arg, $file, $declaration_name)
-		    }
-		}
-		else {
-		    save_struct_actual($param);
-		    push_parameter($param, $type, $arg, $file, $declaration_name);
-		}
-	    }
-	}
-    }
-}
-
-sub push_parameter($$$$$) {
-	my $param = shift;
-	my $type = shift;
-	my $org_arg = shift;
-	my $file = shift;
-	my $declaration_name = shift;
-
-	if (($anon_struct_union == 1) && ($type eq "") &&
-	    ($param eq "}")) {
-		return;		# ignore the ending }; from anon. struct/union
-	}
-
-	$anon_struct_union = 0;
-	$param =~ s/[\[\)].*//;
-
-	if ($type eq "" && $param =~ /\.\.\.$/)
-	{
-	    if ($param =~ /\w\.\.\.$/) {
-	      # for named variable parameters of the form `x...`, remove the dots
-	      $param =~ s/\.\.\.$//;
-	    } else {
-	      # handles unnamed variable parameters
-	      $param = "...";
-	    }
-	    if (!defined $parameterdescs{$param} || $parameterdescs{$param} eq "") {
-		$parameterdescs{$param} = "variable arguments";
-	    }
-	}
-	elsif ($type eq "" && ($param eq "" or $param eq "void"))
-	{
-	    $param="void";
-	    $parameterdescs{void} = "no arguments";
-	}
-	elsif ($type eq "" && ($param eq "struct" or $param eq "union"))
-	# handle unnamed (anonymous) union or struct:
-	{
-		$type = $param;
-		$param = "{unnamed_" . $param . "}";
-		$parameterdescs{$param} = "anonymous\n";
-		$anon_struct_union = 1;
-	}
-
-	# warn if parameter has no description
-	# (but ignore ones starting with # as these are not parameters
-	# but inline preprocessor statements);
-	# Note: It will also ignore void params and unnamed structs/unions
-	if (!defined $parameterdescs{$param} && $param !~ /^#/) {
-		$parameterdescs{$param} = $undescribed;
-
-	        if (show_warnings($type, $declaration_name) && $param !~ /\./) {
-			print STDERR
-			      "${file}:$.: warning: Function parameter or member '$param' not described in '$declaration_name'\n";
-			++$warnings;
-		}
-	}
-
-	# strip spaces from $param so that it is one continuous string
-	# on @parameterlist;
-	# this fixes a problem where check_sections() cannot find
-	# a parameter like "addr[6 + 2]" because it actually appears
-	# as "addr[6", "+", "2]" on the parameter list;
-	# but it's better to maintain the param string unchanged for output,
-	# so just weaken the string compare in check_sections() to ignore
-	# "[blah" in a parameter string;
-	###$param =~ s/\s*//g;
-	push @parameterlist, $param;
-	$org_arg =~ s/\s\s+/ /g;
-	$parametertypes{$param} = $org_arg;
-}
-
-sub check_sections($$$$$) {
-	my ($file, $decl_name, $decl_type, $sectcheck, $prmscheck) = @_;
-	my @sects = split ' ', $sectcheck;
-	my @prms = split ' ', $prmscheck;
-	my $err;
-	my ($px, $sx);
-	my $prm_clean;		# strip trailing "[array size]" and/or beginning "*"
-
-	foreach $sx (0 .. $#sects) {
-		$err = 1;
-		foreach $px (0 .. $#prms) {
-			$prm_clean = $prms[$px];
-			$prm_clean =~ s/\[.*\]//;
-			$prm_clean =~ s/__attribute__\s*\(\([a-z,_\*\s\(\)]*\)\)//i;
-			# ignore array size in a parameter string;
-			# however, the original param string may contain
-			# spaces, e.g.:  addr[6 + 2]
-			# and this appears in @prms as "addr[6" since the
-			# parameter list is split at spaces;
-			# hence just ignore "[..." for the sections check;
-			$prm_clean =~ s/\[.*//;
-
-			##$prm_clean =~ s/^\**//;
-			if ($prm_clean eq $sects[$sx]) {
-				$err = 0;
-				last;
-			}
-		}
-		if ($err) {
-			if ($decl_type eq "function") {
-				print STDERR "${file}:$.: warning: " .
-					"Excess function parameter " .
-					"'$sects[$sx]' " .
-					"description in '$decl_name'\n";
-				++$warnings;
-			}
-		}
-	}
-}
-
-##
-# Checks the section describing the return value of a function.
-sub check_return_section {
-        my $file = shift;
-        my $declaration_name = shift;
-        my $return_type = shift;
-
-        # Ignore an empty return type (It's a macro)
-        # Ignore functions with a "void" return type. (But don't ignore "void *")
-        if (($return_type eq "") || ($return_type =~ /void\s*\w*\s*$/)) {
-                return;
-        }
-
-        if (!defined($sections{$section_return}) ||
-            $sections{$section_return} eq "") {
-                print STDERR "${file}:$.: warning: " .
-                        "No description found for return value of " .
-                        "'$declaration_name'\n";
-                ++$warnings;
-        }
-}
-
-##
-# takes a function prototype and the name of the current file being
-# processed and spits out all the details stored in the global
-# arrays/hashes.
-sub dump_function($$) {
-    my $prototype = shift;
-    my $file = shift;
-    my $noret = 0;
-
-    print_lineno($new_start_line);
-
-    $prototype =~ s/^static +//;
-    $prototype =~ s/^extern +//;
-    $prototype =~ s/^asmlinkage +//;
-    $prototype =~ s/^inline +//;
-    $prototype =~ s/^__inline__ +//;
-    $prototype =~ s/^__inline +//;
-    $prototype =~ s/^__always_inline +//;
-    $prototype =~ s/^noinline +//;
-    $prototype =~ s/__init +//;
-    $prototype =~ s/__init_or_module +//;
-    $prototype =~ s/__meminit +//;
-    $prototype =~ s/__must_check +//;
-    $prototype =~ s/__weak +//;
-    $prototype =~ s/__sched +//;
-    $prototype =~ s/__printf\s*\(\s*\d*\s*,\s*\d*\s*\) +//;
-    my $define = $prototype =~ s/^#\s*define\s+//; #ak added
-    $prototype =~ s/__attribute__\s*\(\(
-            (?:
-                 [\w\s]++          # attribute name
-                 (?:\([^)]*+\))?   # attribute arguments
-                 \s*+,?            # optional comma at the end
-            )+
-          \)\)\s+//x;
-
-    # Strip QEMU specific compiler annotations
-    $prototype =~ s/QEMU_[A-Z_]+ +//;
-
-    # Yes, this truly is vile.  We are looking for:
-    # 1. Return type (may be nothing if we're looking at a macro)
-    # 2. Function name
-    # 3. Function parameters.
-    #
-    # All the while we have to watch out for function pointer parameters
-    # (which IIRC is what the two sections are for), C types (these
-    # regexps don't even start to express all the possibilities), and
-    # so on.
-    #
-    # If you mess with these regexps, it's a good idea to check that
-    # the following functions' documentation still comes out right:
-    # - parport_register_device (function pointer parameters)
-    # - atomic_set (macro)
-    # - pci_match_device, __copy_to_user (long return type)
-
-    if ($define && $prototype =~ m/^()([a-zA-Z0-9_~:]+)\s+/) {
-        # This is an object-like macro, it has no return type and no parameter
-        # list.
-        # Function-like macros are not allowed to have spaces between
-        # declaration_name and opening parenthesis (notice the \s+).
-        $return_type = $1;
-        $declaration_name = $2;
-        $noret = 1;
-    } elsif ($prototype =~ m/^()([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\(]*)\)/ ||
-	$prototype =~ m/^()([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+\s+\w+)\s+([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s+\w+\s+\w+\s*\*+)\s*([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/ ||
-	$prototype =~ m/^(\w+\s+\w+\s*\*+\s*\w+\s*\*+\s*)\s*([a-zA-Z0-9_~:]+)\s*\(([^\{]*)\)/)  {
-	$return_type = $1;
-	$declaration_name = $2;
-	my $args = $3;
-
-	create_parameterlist($args, ',', $file, $declaration_name);
-    } else {
-	print STDERR "${file}:$.: warning: cannot understand function prototype: '$prototype'\n";
-	return;
-    }
-
-    my $prms = join " ", @parameterlist;
-    check_sections($file, $declaration_name, "function", $sectcheck, $prms);
-
-    # This check emits a lot of warnings at the moment, because many
-    # functions don't have a 'Return' doc section. So until the number
-    # of warnings goes sufficiently down, the check is only performed in
-    # verbose mode.
-    # TODO: always perform the check.
-    if ($verbose && !$noret) {
-	    check_return_section($file, $declaration_name, $return_type);
-    }
-
-    # The function parser can be called with a typedef parameter.
-    # Handle it.
-    if ($return_type =~ /typedef/) {
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'typedef' => 1,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-    } else {
-	output_declaration($declaration_name,
-			   'function',
-			   {'function' => $declaration_name,
-			    'module' => $modulename,
-			    'functiontype' => $return_type,
-			    'parameterlist' => \@parameterlist,
-			    'parameterdescs' => \%parameterdescs,
-			    'parametertypes' => \%parametertypes,
-			    'sectionlist' => \@sectionlist,
-			    'sections' => \%sections,
-			    'purpose' => $declaration_purpose
-			   });
-    }
-}
-
-sub reset_state {
-    $function = "";
-    %parameterdescs = ();
-    %parametertypes = ();
-    @parameterlist = ();
-    %sections = ();
-    @sectionlist = ();
-    $sectcheck = "";
-    $struct_actual = "";
-    $prototype = "";
-
-    $state = STATE_NORMAL;
-    $inline_doc_state = STATE_INLINE_NA;
-}
-
-sub tracepoint_munge($) {
-	my $file = shift;
-	my $tracepointname = 0;
-	my $tracepointargs = 0;
-
-	if ($prototype =~ m/TRACE_EVENT\((.*?),/) {
-		$tracepointname = $1;
-	}
-	if ($prototype =~ m/DEFINE_SINGLE_EVENT\((.*?),/) {
-		$tracepointname = $1;
-	}
-	if ($prototype =~ m/DEFINE_EVENT\((.*?),(.*?),/) {
-		$tracepointname = $2;
-	}
-	$tracepointname =~ s/^\s+//; #strip leading whitespace
-	if ($prototype =~ m/TP_PROTO\((.*?)\)/) {
-		$tracepointargs = $1;
-	}
-	if (($tracepointname eq 0) || ($tracepointargs eq 0)) {
-		print STDERR "${file}:$.: warning: Unrecognized tracepoint format: \n".
-			     "$prototype\n";
-	} else {
-		$prototype = "static inline void trace_$tracepointname($tracepointargs)";
-	}
-}
-
-sub syscall_munge() {
-	my $void = 0;
-
-	$prototype =~ s@[\r\n]+@ @gos; # strip newlines/CR's
-##	if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
-	if ($prototype =~ m/SYSCALL_DEFINE0/) {
-		$void = 1;
-##		$prototype = "long sys_$1(void)";
-	}
-
-	$prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
-	if ($prototype =~ m/long (sys_.*?),/) {
-		$prototype =~ s/,/\(/;
-	} elsif ($void) {
-		$prototype =~ s/\)/\(void\)/;
-	}
-
-	# now delete all of the odd-number commas in $prototype
-	# so that arg types & arg names don't have a comma between them
-	my $count = 0;
-	my $len = length($prototype);
-	if ($void) {
-		$len = 0;	# skip the for-loop
-	}
-	for (my $ix = 0; $ix < $len; $ix++) {
-		if (substr($prototype, $ix, 1) eq ',') {
-			$count++;
-			if ($count % 2 == 1) {
-				substr($prototype, $ix, 1) = ' ';
-			}
-		}
-	}
-}
-
-sub process_proto_function($$) {
-    my $x = shift;
-    my $file = shift;
-
-    $x =~ s@\/\/.*$@@gos; # strip C99-style comments to end of line
-
-    if ($x =~ m#\s*/\*\s+MACDOC\s*#io || ($x =~ /^#/ && $x !~ /^#\s*define/)) {
-	# do nothing
-    }
-    elsif ($x =~ /([^\{]*)/) {
-	$prototype .= $1;
-    }
-
-    if (($x =~ /\{/) || ($x =~ /\#\s*define/) || ($x =~ /;/)) {
-	$prototype =~ s@/\*.*?\*/@@gos;	# strip comments.
-	$prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
-	$prototype =~ s@^\s+@@gos; # strip leading spaces
-
-	 # Handle prototypes for function pointers like:
-	 # int (*pcs_config)(struct foo)
-	$prototype =~ s@^(\S+\s+)\(\s*\*(\S+)\)@$1$2@gos;
-
-	if ($prototype =~ /SYSCALL_DEFINE/) {
-		syscall_munge();
-	}
-	if ($prototype =~ /TRACE_EVENT/ || $prototype =~ /DEFINE_EVENT/ ||
-	    $prototype =~ /DEFINE_SINGLE_EVENT/)
-	{
-		tracepoint_munge($file);
-	}
-	dump_function($prototype, $file);
-	reset_state();
-    }
-}
-
-sub process_proto_type($$) {
-    my $x = shift;
-    my $file = shift;
-
-    $x =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
-    $x =~ s@^\s+@@gos; # strip leading spaces
-    $x =~ s@\s+$@@gos; # strip trailing spaces
-    $x =~ s@\/\/.*$@@gos; # strip C99-style comments to end of line
-
-    if ($x =~ /^#/) {
-	# To distinguish preprocessor directive from regular declaration later.
-	$x .= ";";
-    }
-
-    while (1) {
-	if ( $x =~ /([^\{\};]*)([\{\};])(.*)/ ) {
-            if( length $prototype ) {
-                $prototype .= " "
-            }
-	    $prototype .= $1 . $2;
-	    ($2 eq '{') && $brcount++;
-	    ($2 eq '}') && $brcount--;
-	    if (($2 eq ';') && ($brcount == 0)) {
-		dump_declaration($prototype, $file);
-		reset_state();
-		last;
-	    }
-	    $x = $3;
-	} else {
-	    $prototype .= $x;
-	    last;
-	}
-    }
-}
-
-
-sub map_filename($) {
-    my $file;
-    my ($orig_file) = @_;
-
-    if (defined($ENV{'SRCTREE'})) {
-	$file = "$ENV{'SRCTREE'}" . "/" . $orig_file;
-    } else {
-	$file = $orig_file;
-    }
-
-    if (defined($source_map{$file})) {
-	$file = $source_map{$file};
-    }
-
-    return $file;
-}
-
-sub process_export_file($) {
-    my ($orig_file) = @_;
-    my $file = map_filename($orig_file);
-
-    if (!open(IN,"<$file")) {
-	print STDERR "Error: Cannot open file $file\n";
-	++$errors;
-	return;
-    }
-
-    while (<IN>) {
-	if (/$export_symbol/) {
-	    next if (defined($nosymbol_table{$2}));
-	    $function_table{$2} = 1;
-	}
-    }
-
-    close(IN);
-}
-
-#
-# Parsers for the various processing states.
-#
-# STATE_NORMAL: looking for the /** to begin everything.
-#
-sub process_normal() {
-    if (/$doc_start/o) {
-	$state = STATE_NAME;	# next line is always the function name
-	$in_doc_sect = 0;
-	$declaration_start_line = $. + 1;
-    }
-}
-
-#
-# STATE_NAME: Looking for the "name - description" line
-#
-sub process_name($$) {
-    my $file = shift;
-    my $identifier;
-    my $descr;
-
-    if (/$doc_block/o) {
-	$state = STATE_DOCBLOCK;
-	$contents = "";
-	$new_start_line = $.;
-
-	if ( $1 eq "" ) {
-	    $section = $section_intro;
-	} else {
-	    $section = $1;
-	}
-    }
-    elsif (/$doc_decl/o) {
-	$identifier = $1;
-	if (/\s*([\w\s]+?)(\s*-|:)/) {
-	    $identifier = $1;
-	}
-
-	$state = STATE_BODY;
-	# if there's no @param blocks need to set up default section
-	# here
-	$contents = "";
-	$section = $section_default;
-	$new_start_line = $. + 1;
-	if (/[-:](.*)/) {
-	    # strip leading/trailing/multiple spaces
-	    $descr= $1;
-	    $descr =~ s/^\s*//;
-	    $descr =~ s/\s*$//;
-	    $descr =~ s/\s+/ /g;
-	    $declaration_purpose = $descr;
-	    $state = STATE_BODY_MAYBE;
-	} else {
-	    $declaration_purpose = "";
-	}
-
-	if (($declaration_purpose eq "") && $verbose) {
-	    print STDERR "${file}:$.: warning: missing initial short description on line:\n";
-	    print STDERR $_;
-	    ++$warnings;
-	}
-
-	if ($identifier =~ m/^struct\b/) {
-	    $decl_type = 'struct';
-	} elsif ($identifier =~ m/^union\b/) {
-	    $decl_type = 'union';
-	} elsif ($identifier =~ m/^enum\b/) {
-	    $decl_type = 'enum';
-	} elsif ($identifier =~ m/^typedef\b/) {
-	    $decl_type = 'typedef';
-	} else {
-	    $decl_type = 'function';
-	}
-
-	if ($verbose) {
-	    print STDERR "${file}:$.: info: Scanning doc for $identifier\n";
-	}
-    } else {
-	print STDERR "${file}:$.: warning: Cannot understand $_ on line $.",
-	    " - I thought it was a doc line\n";
-	++$warnings;
-	$state = STATE_NORMAL;
-    }
-}
-
-
-#
-# STATE_BODY and STATE_BODY_MAYBE: the bulk of a kerneldoc comment.
-#
-sub process_body($$) {
-    my $file = shift;
-
-    # Until all named variable macro parameters are
-    # documented using the bare name (`x`) rather than with
-    # dots (`x...`), strip the dots:
-    if ($section =~ /\w\.\.\.$/) {
-	$section =~ s/\.\.\.$//;
-
-	if ($verbose) {
-	    print STDERR "${file}:$.: warning: Variable macro arguments should be documented without dots\n";
-	    ++$warnings;
-	}
-    }
-
-    if ($state == STATE_BODY_WITH_BLANK_LINE && /^\s*\*\s?\S/) {
-	dump_section($file, $section, $contents);
-	$section = $section_default;
-	$new_start_line = $.;
-	$contents = "";
-    }
-
-    if (/$doc_sect/i) { # case insensitive for supported section names
-	$newsection = $1;
-	$newcontents = $2;
-
-	# map the supported section names to the canonical names
-	if ($newsection =~ m/^description$/i) {
-	    $newsection = $section_default;
-	} elsif ($newsection =~ m/^context$/i) {
-	    $newsection = $section_context;
-	} elsif ($newsection =~ m/^returns?$/i) {
-	    $newsection = $section_return;
-	} elsif ($newsection =~ m/^\@return$/) {
-	    # special: @return is a section, not a param description
-	    $newsection = $section_return;
-	}
-
-	if (($contents ne "") && ($contents ne "\n")) {
-	    if (!$in_doc_sect && $verbose) {
-		print STDERR "${file}:$.: warning: contents before sections\n";
-		++$warnings;
-	    }
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	}
-
-	$in_doc_sect = 1;
-	$state = STATE_BODY;
-	$contents = $newcontents;
-	$new_start_line = $.;
-	while (substr($contents, 0, 1) eq " ") {
-	    $contents = substr($contents, 1);
-	}
-	if ($contents ne "") {
-	    $contents .= "\n";
-	}
-	$section = $newsection;
-	$leading_space = undef;
-    } elsif (/$doc_end/) {
-	if (($contents ne "") && ($contents ne "\n")) {
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
-	# look for doc_com + <text> + doc_end:
-	if ($_ =~ m'\s*\*\s*[a-zA-Z_0-9:\.]+\*/') {
-	    print STDERR "${file}:$.: warning: suspicious ending line: $_";
-	    ++$warnings;
-	}
-
-	$prototype = "";
-	$state = STATE_PROTO;
-	$brcount = 0;
-        $new_start_line = $. + 1;
-    } elsif (/$doc_content/) {
-	if ($1 eq "") {
-	    if ($section eq $section_context) {
-		dump_section($file, $section, $contents);
-		$section = $section_default;
-		$contents = "";
-		$new_start_line = $.;
-		$state = STATE_BODY;
-	    } else {
-		if ($section ne $section_default) {
-		    $state = STATE_BODY_WITH_BLANK_LINE;
-		} else {
-		    $state = STATE_BODY;
-		}
-		$contents .= "\n";
-	    }
-	} elsif ($state == STATE_BODY_MAYBE) {
-	    # Continued declaration purpose
-	    chomp($declaration_purpose);
-	    $declaration_purpose .= " " . $1;
-	    $declaration_purpose =~ s/\s+/ /g;
-	} else {
-	    my $cont = $1;
-	    if ($section =~ m/^@/ || $section eq $section_context) {
-		if (!defined $leading_space) {
-		    if ($cont =~ m/^(\s+)/) {
-			$leading_space = $1;
-		    } else {
-			$leading_space = "";
-		    }
-		}
-		$cont =~ s/^$leading_space//;
-	    }
-	    $contents .= $cont . "\n";
-	}
-    } else {
-	# i dont know - bad line?  ignore.
-	print STDERR "${file}:$.: warning: bad line: $_";
-	++$warnings;
-    }
-}
-
-
-#
-# STATE_PROTO: reading a function/whatever prototype.
-#
-sub process_proto($$) {
-    my $file = shift;
-
-    if (/$doc_inline_oneline/) {
-	$section = $1;
-	$contents = $2;
-	if ($contents ne "") {
-	    $contents .= "\n";
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
-    } elsif (/$doc_inline_start/) {
-	$state = STATE_INLINE;
-	$inline_doc_state = STATE_INLINE_NAME;
-    } elsif ($decl_type eq 'function') {
-	process_proto_function($_, $file);
-    } else {
-	process_proto_type($_, $file);
-    }
-}
-
-#
-# STATE_DOCBLOCK: within a DOC: block.
-#
-sub process_docblock($$) {
-    my $file = shift;
-
-    if (/$doc_end/) {
-	dump_doc_section($file, $section, $contents);
-	$section = $section_default;
-	$contents = "";
-	$function = "";
-	%parameterdescs = ();
-	%parametertypes = ();
-	@parameterlist = ();
-	%sections = ();
-	@sectionlist = ();
-	$prototype = "";
-	$state = STATE_NORMAL;
-    } elsif (/$doc_content/) {
-	if ( $1 eq "" )	{
-	    $contents .= $blankline;
-	} else {
-	    $contents .= $1 . "\n";
-	}
-    }
-}
-
-#
-# STATE_INLINE: docbook comments within a prototype.
-#
-sub process_inline($$) {
-    my $file = shift;
-
-    # First line (state 1) needs to be a @parameter
-    if ($inline_doc_state == STATE_INLINE_NAME && /$doc_inline_sect/o) {
-	$section = $1;
-	$contents = $2;
-	$new_start_line = $.;
-	if ($contents ne "") {
-	    while (substr($contents, 0, 1) eq " ") {
-		$contents = substr($contents, 1);
-	    }
-	    $contents .= "\n";
-	}
-	$inline_doc_state = STATE_INLINE_TEXT;
-	# Documentation block end */
-    } elsif (/$doc_inline_end/) {
-	if (($contents ne "") && ($contents ne "\n")) {
-	    dump_section($file, $section, $contents);
-	    $section = $section_default;
-	    $contents = "";
-	}
-	$state = STATE_PROTO;
-	$inline_doc_state = STATE_INLINE_NA;
-	# Regular text
-    } elsif (/$doc_content/) {
-	if ($inline_doc_state == STATE_INLINE_TEXT) {
-	    $contents .= $1 . "\n";
-	    # nuke leading blank lines
-	    if ($contents =~ /^\s*$/) {
-		$contents = "";
-	    }
-	} elsif ($inline_doc_state == STATE_INLINE_NAME) {
-	    $inline_doc_state = STATE_INLINE_ERROR;
-	    print STDERR "${file}:$.: warning: ";
-	    print STDERR "Incorrect use of kernel-doc format: $_";
-	    ++$warnings;
-	}
-    }
-}
-
-
-sub process_file($) {
-    my $file;
-    my $initial_section_counter = $section_counter;
-    my ($orig_file) = @_;
-
-    $file = map_filename($orig_file);
-
-    if (!open(IN_FILE,"<$file")) {
-	print STDERR "Error: Cannot open file $file\n";
-	++$errors;
-	return;
-    }
-
-    $. = 1;
-
-    $section_counter = 0;
-    while (<IN_FILE>) {
-	while (s/\\\s*$//) {
-	    $_ .= <IN_FILE>;
-	}
-	# Replace tabs by spaces
-        while ($_ =~ s/\t+/' ' x (length($&) * 8 - length($`) % 8)/e) {};
-	# Hand this line to the appropriate state handler
-	if ($state == STATE_NORMAL) {
-	    process_normal();
-	} elsif ($state == STATE_NAME) {
-	    process_name($file, $_);
-	} elsif ($state == STATE_BODY || $state == STATE_BODY_MAYBE ||
-		 $state == STATE_BODY_WITH_BLANK_LINE) {
-	    process_body($file, $_);
-	} elsif ($state == STATE_INLINE) { # scanning for inline parameters
-	    process_inline($file, $_);
-	} elsif ($state == STATE_PROTO) {
-	    process_proto($file, $_);
-	} elsif ($state == STATE_DOCBLOCK) {
-	    process_docblock($file, $_);
-	}
-    }
-
-    # Make sure we got something interesting.
-    if ($initial_section_counter == $section_counter && $
-	output_mode ne "none") {
-	if ($output_selection == OUTPUT_INCLUDE) {
-	    print STDERR "${file}:1: warning: '$_' not found\n"
-		for keys %function_table;
-	}
-	else {
-	    print STDERR "${file}:1: warning: no structured comments found\n";
-	}
-    }
-    close IN_FILE;
-}
-
-
-if ($output_mode eq "rst") {
-	get_sphinx_version() if (!$sphinx_major);
-}
-
-$kernelversion = get_kernel_version();
-
-# generate a sequence of code that will splice in highlighting information
-# using the s// operator.
-for (my $k = 0; $k < @highlights; $k++) {
-    my $pattern = $highlights[$k][0];
-    my $result = $highlights[$k][1];
-#   print STDERR "scanning pattern:$pattern, highlight:($result)\n";
-    $dohighlight .=  "\$contents =~ s:$pattern:$result:gs;\n";
-}
-
-# Read the file that maps relative names to absolute names for
-# separate source and object directories and for shadow trees.
-if (open(SOURCE_MAP, "<.tmp_filelist.txt")) {
-	my ($relname, $absname);
-	while(<SOURCE_MAP>) {
-		chop();
-		($relname, $absname) = (split())[0..1];
-		$relname =~ s:^/+::;
-		$source_map{$relname} = $absname;
-	}
-	close(SOURCE_MAP);
-}
-
-if ($output_selection == OUTPUT_EXPORTED ||
-    $output_selection == OUTPUT_INTERNAL) {
-
-    push(@export_file_list, @ARGV);
-
-    foreach (@export_file_list) {
-	chomp;
-	process_export_file($_);
-    }
-}
-
-foreach (@ARGV) {
-    chomp;
-    process_file($_);
-}
-if ($verbose && $errors) {
-  print STDERR "$errors errors\n";
-}
-if ($verbose && $warnings) {
-  print STDERR "$warnings warnings\n";
-}
-
-if ($Werror && $warnings) {
-    print STDERR "$warnings warnings as Errors\n";
-    exit($warnings);
-} else {
-    exit($output_mode eq "none" ? 0 : $errors)
-}

From e0ca100425853aa362acefeb027800d952fb222d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 14 Aug 2025 18:13:23 +0100
Subject: [PATCH 0250/2396] MAINTAINERS: Put kernel-doc under the "docs build
 machinery" section

We never had a MAINTAINERS entry for the old kernel-doc script; add
the files for the new Python kernel-doc under "Sphinx documentation
configuration and build machinery", as the most appropriate
subsection.

Mauro has kindly volunteered to help with maintenance/review
of this area of the codebase, so add him as a maintainer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-id: 20250814171324.1614516-9-peter.maydell@linaro.org
---
 MAINTAINERS | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 8f074e4371..8147fff352 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4441,6 +4441,7 @@ F: po/*.po
 Sphinx documentation configuration and build machinery
 M: John Snow <jsnow@redhat.com>
 M: Peter Maydell <peter.maydell@linaro.org>
+M: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
 S: Maintained
 F: docs/conf.py
 F: docs/*/conf.py
@@ -4449,6 +4450,8 @@ F: docs/sphinx/
 F: docs/_templates/
 F: docs/devel/docs.rst
 F: docs/devel/qapi-domain.rst
+F: scripts/kernel-doc
+F: scripts/lib/kdoc/
 
 Rust build system integration
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>

From c2fae597099ef6ff81ca63d69ee28eddb982d894 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 19 Aug 2025 15:56:58 +0100
Subject: [PATCH 0251/2396] target/arm: Correct condition of aa64_atomics
 feature function

The ARMv8.1-Atomics feature (renamed FEAT_LSE in more modern versions
of the Arm ARM) has always ben indicated by ID_AA64ISAR0.ATOMIC being
0b0010 or greater; 0b0001 is a reserved unused value.

We were incorrectly checking for != 0; this had no harmful effects
because all the CPUs set their value for this field to either 0
(for not having the feature) or 2 (if they do have it), but it's
better to match what the architecture specifies here.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250819145659.2165160-1-peter.maydell@linaro.org
---
 target/arm/cpu-features.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 41511d0835..d48754bcf2 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -408,7 +408,7 @@ static inline bool isar_feature_aa64_crc32(const ARMISARegisters *id)
 
 static inline bool isar_feature_aa64_atomics(const ARMISARegisters *id)
 {
-    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) != 0;
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) >= 2;
 }
 
 static inline bool isar_feature_aa64_rdm(const ARMISARegisters *id)

From 1748c0d59228c7790940d8be381df1c3108022b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:47 +1000
Subject: [PATCH 0252/2396] qemu/atomic: Finish renaming atomic128-cas.h
 headers

The aarch64 header was not renamed with the others, meaning it
was skipped in favor of the generic version.

Cc: qemu-stable@nongnu.org
Fixes: 15606965400b ("qemu/atomic: Rename atomic128-cas.h headers using .h.inc suffix")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .../include/aarch64/host/{atomic128-cas.h => atomic128-cas.h.inc} | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename host/include/aarch64/host/{atomic128-cas.h => atomic128-cas.h.inc} (100%)

diff --git a/host/include/aarch64/host/atomic128-cas.h b/host/include/aarch64/host/atomic128-cas.h.inc
similarity index 100%
rename from host/include/aarch64/host/atomic128-cas.h
rename to host/include/aarch64/host/atomic128-cas.h.inc

From 1d5e88e7b5b83130deb312d05de11267baac4c05 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:48 +1000
Subject: [PATCH 0253/2396] qemu/atomic: Add atomic16 primitives for xchg,
 fetch_and, fetch_or

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 host/include/aarch64/host/atomic128-cas.h.inc | 57 +++++++++++
 host/include/generic/host/atomic128-cas.h.inc | 96 +++++++++++++++++++
 2 files changed, 153 insertions(+)

diff --git a/host/include/aarch64/host/atomic128-cas.h.inc b/host/include/aarch64/host/atomic128-cas.h.inc
index 991da4ef54..aec27df182 100644
--- a/host/include/aarch64/host/atomic128-cas.h.inc
+++ b/host/include/aarch64/host/atomic128-cas.h.inc
@@ -38,6 +38,63 @@ static inline Int128 atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
     return int128_make128(oldl, oldh);
 }
 
+static inline Int128 atomic16_xchg(Int128 *ptr, Int128 new)
+{
+    uint64_t newl = int128_getlo(new), newh = int128_gethi(new);
+    uint64_t oldl, oldh;
+    uint32_t tmp;
+
+    asm("0: ldaxp %[oldl], %[oldh], %[mem]\n\t"
+        "stlxp %w[tmp], %[newl], %[newh], %[mem]\n\t"
+        "cbnz %w[tmp], 0b"
+        : [mem] "+m"(*ptr), [tmp] "=&r"(tmp),
+          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh)
+        : [newl] "r"(newl), [newh] "r"(newh)
+        : "memory");
+
+    return int128_make128(oldl, oldh);
+}
+
+static inline Int128 atomic16_fetch_and(Int128 *ptr, Int128 new)
+{
+    uint64_t newl = int128_getlo(new), newh = int128_gethi(new);
+    uint64_t oldl, oldh, tmpl, tmph;
+    uint32_t tmp;
+
+    asm("0: ldaxp %[oldl], %[oldh], %[mem]\n\t"
+        "and %[tmpl], %[oldl], %[newl]\n\t"
+        "and %[tmph], %[oldh], %[newh]\n\t"
+        "stlxp %w[tmp], %[tmpl], %[tmph], %[mem]\n\t"
+        "cbnz %w[tmp], 0b"
+        : [mem] "+m"(*ptr), [tmp] "=&r"(tmp),
+          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh)
+        : [newl] "r"(newl), [newh] "r"(newh),
+          [tmpl] "r"(tmpl), [tmph] "r"(tmph)
+        : "memory");
+
+    return int128_make128(oldl, oldh);
+}
+
+static inline Int128 atomic16_fetch_or(Int128 *ptr, Int128 new)
+{
+    uint64_t newl = int128_getlo(new), newh = int128_gethi(new);
+    uint64_t oldl, oldh, tmpl, tmph;
+    uint32_t tmp;
+
+    asm("0: ldaxp %[oldl], %[oldh], %[mem]\n\t"
+        "orr %[tmpl], %[oldl], %[newl]\n\t"
+        "orr %[tmph], %[oldh], %[newh]\n\t"
+        "stlxp %w[tmp], %[tmpl], %[tmph], %[mem]\n\t"
+        "cbnz %w[tmp], 0b"
+        : [mem] "+m"(*ptr), [tmp] "=&r"(tmp),
+          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh)
+        : [newl] "r"(newl), [newh] "r"(newh),
+          [tmpl] "r"(tmpl), [tmph] "r"(tmph)
+        : "memory");
+
+    return int128_make128(oldl, oldh);
+}
+
 # define CONFIG_CMPXCHG128 1
 # define HAVE_CMPXCHG128 1
 #endif
diff --git a/host/include/generic/host/atomic128-cas.h.inc b/host/include/generic/host/atomic128-cas.h.inc
index 6b40cc2271..990162c56f 100644
--- a/host/include/generic/host/atomic128-cas.h.inc
+++ b/host/include/generic/host/atomic128-cas.h.inc
@@ -23,6 +23,51 @@ atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
     r.i = qatomic_cmpxchg__nocheck(ptr_align, c.i, n.i);
     return r.s;
 }
+
+/*
+ * Since we're looping anyway, use weak compare and swap.
+ * If the host supports weak, this will eliminate a second loop hidden
+ * within the atomic operation itself; otherwise the weak parameter is
+ * ignored.
+ */
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_xchg(Int128 *ptr, Int128 new)
+{
+    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128 old = *ptr_align;
+
+    while (!__atomic_compare_exchange_n(ptr_align, &old, new, true,
+                                        __ATOMIC_SEQ_CST, 0)) {
+        continue;
+    }
+    return old;
+}
+
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_fetch_and(Int128 *ptr, Int128 val)
+{
+    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128 old = *ptr_align;
+
+    while (!__atomic_compare_exchange_n(ptr_align, &old, old & val, true,
+                                        __ATOMIC_SEQ_CST, 0)) {
+        continue;
+    }
+    return old;
+}
+
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_fetch_or(Int128 *ptr, Int128 val)
+{
+    __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128 old = *ptr_align;
+
+    while (!__atomic_compare_exchange_n(ptr_align, &old, old | val, true,
+                                        __ATOMIC_SEQ_CST, 0)) {
+        continue;
+    }
+    return old;
+}
 # define HAVE_CMPXCHG128 1
 #elif defined(CONFIG_CMPXCHG128)
 static inline Int128 ATTRIBUTE_ATOMIC128_OPT
@@ -36,6 +81,57 @@ atomic16_cmpxchg(Int128 *ptr, Int128 cmp, Int128 new)
     r.i = __sync_val_compare_and_swap_16(ptr_align, c.i, n.i);
     return r.s;
 }
+
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_xchg(Int128 *ptr, Int128 new)
+{
+    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128Alias o, n;
+
+    n.s = new;
+    o.s = *ptr_align;
+    while (1) {
+        __int128 c = __sync_val_compare_and_swap_16(ptr_align, o.i, n.i);
+        if (c == o.i) {
+            return o.s;
+        }
+        o.i = c;
+    }
+}
+
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_fetch_and(Int128 *ptr, Int128 val)
+{
+    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128Alias o, v;
+
+    v.s = val;
+    o.s = *ptr_align;
+    while (1) {
+        __int128 c = __sync_val_compare_and_swap_16(ptr_align, o.i, o.i & v.i);
+        if (c == o.i) {
+            return o.s;
+        }
+        o.i = c;
+    }
+}
+
+static inline Int128 ATTRIBUTE_ATOMIC128_OPT
+atomic16_fetch_or(Int128 *ptr, Int128 val)
+{
+    Int128Aligned *ptr_align = __builtin_assume_aligned(ptr, 16);
+    Int128Alias o, v;
+
+    v.s = val;
+    o.s = *ptr_align;
+    while (1) {
+        __int128 c = __sync_val_compare_and_swap_16(ptr_align, o.i, o.i | v.i);
+        if (c == o.i) {
+            return o.s;
+        }
+        o.i = c;
+    }
+}
 # define HAVE_CMPXCHG128 1
 #else
 /* Fallback definition that must be optimized away, or error.  */

From 33aefd187eaff71dbc686c43f7acfdd0a81c7de4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:49 +1000
Subject: [PATCH 0254/2396] accel/tcg: Add cpu_atomic_*_mmu for 16-byte xchg,
 fetch_and, fetch_or

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_template.h         | 80 +++++++++++++++++++++++++++--
 include/accel/tcg/cpu-ldst-common.h | 13 +++--
 2 files changed, 86 insertions(+), 7 deletions(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index 08a475c10c..ae5203b439 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -100,7 +100,6 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, vaddr addr,
     return ret;
 }
 
-#if DATA_SIZE < 16
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
@@ -108,7 +107,11 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                                          DATA_SIZE, retaddr);
     DATA_TYPE ret;
 
+#if DATA_SIZE == 16
+    ret = atomic16_xchg(haddr, val);
+#else
     ret = qatomic_xchg__nocheck(haddr, val);
+#endif
     ATOMIC_MMU_CLEANUP;
     atomic_trace_rmw_post(env, addr,
                           VALUE_LOW(ret),
@@ -119,6 +122,39 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
     return ret;
 }
 
+#if DATA_SIZE == 16
+ABI_TYPE ATOMIC_NAME(fetch_and)(CPUArchState *env, vaddr addr, ABI_TYPE val,
+                                MemOpIdx oi, uintptr_t retaddr)
+{
+    DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
+                                         DATA_SIZE, retaddr);
+    DATA_TYPE ret = atomic16_fetch_and(haddr, val);
+    ATOMIC_MMU_CLEANUP;
+    atomic_trace_rmw_post(env, addr,
+                          VALUE_LOW(ret),
+                          VALUE_HIGH(ret),
+                          VALUE_LOW(val),
+                          VALUE_HIGH(val),
+                          oi);
+    return ret;
+}
+
+ABI_TYPE ATOMIC_NAME(fetch_or)(CPUArchState *env, vaddr addr, ABI_TYPE val,
+                               MemOpIdx oi, uintptr_t retaddr)
+{
+    DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
+                                         DATA_SIZE, retaddr);
+    DATA_TYPE ret = atomic16_fetch_or(haddr, val);
+    ATOMIC_MMU_CLEANUP;
+    atomic_trace_rmw_post(env, addr,
+                          VALUE_LOW(ret),
+                          VALUE_HIGH(ret),
+                          VALUE_LOW(val),
+                          VALUE_HIGH(val),
+                          oi);
+    return ret;
+}
+#else
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
@@ -188,7 +224,7 @@ GEN_ATOMIC_HELPER_FN(smax_fetch, MAX, SDATA_TYPE, new)
 GEN_ATOMIC_HELPER_FN(umax_fetch, MAX,  DATA_TYPE, new)
 
 #undef GEN_ATOMIC_HELPER_FN
-#endif /* DATA SIZE < 16 */
+#endif /* DATA SIZE == 16 */
 
 #undef END
 
@@ -225,7 +261,6 @@ ABI_TYPE ATOMIC_NAME(cmpxchg)(CPUArchState *env, vaddr addr,
     return BSWAP(ret);
 }
 
-#if DATA_SIZE < 16
 ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                            MemOpIdx oi, uintptr_t retaddr)
 {
@@ -233,7 +268,11 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
                                          DATA_SIZE, retaddr);
     ABI_TYPE ret;
 
+#if DATA_SIZE == 16
+    ret = atomic16_xchg(haddr, BSWAP(val));
+#else
     ret = qatomic_xchg__nocheck(haddr, BSWAP(val));
+#endif
     ATOMIC_MMU_CLEANUP;
     atomic_trace_rmw_post(env, addr,
                           VALUE_LOW(ret),
@@ -244,6 +283,39 @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, vaddr addr, ABI_TYPE val,
     return BSWAP(ret);
 }
 
+#if DATA_SIZE == 16
+ABI_TYPE ATOMIC_NAME(fetch_and)(CPUArchState *env, vaddr addr, ABI_TYPE val,
+                                MemOpIdx oi, uintptr_t retaddr)
+{
+    DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
+                                         DATA_SIZE, retaddr);
+    DATA_TYPE ret = atomic16_fetch_and(haddr, BSWAP(val));
+    ATOMIC_MMU_CLEANUP;
+    atomic_trace_rmw_post(env, addr,
+                          VALUE_LOW(ret),
+                          VALUE_HIGH(ret),
+                          VALUE_LOW(val),
+                          VALUE_HIGH(val),
+                          oi);
+    return BSWAP(ret);
+}
+
+ABI_TYPE ATOMIC_NAME(fetch_or)(CPUArchState *env, vaddr addr, ABI_TYPE val,
+                               MemOpIdx oi, uintptr_t retaddr)
+{
+    DATA_TYPE *haddr = atomic_mmu_lookup(env_cpu(env), addr, oi,
+                                         DATA_SIZE, retaddr);
+    DATA_TYPE ret = atomic16_fetch_or(haddr, BSWAP(val));
+    ATOMIC_MMU_CLEANUP;
+    atomic_trace_rmw_post(env, addr,
+                          VALUE_LOW(ret),
+                          VALUE_HIGH(ret),
+                          VALUE_LOW(val),
+                          VALUE_HIGH(val),
+                          oi);
+    return BSWAP(ret);
+}
+#else
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, vaddr addr,              \
                         ABI_TYPE val, MemOpIdx oi, uintptr_t retaddr) \
@@ -317,7 +389,7 @@ GEN_ATOMIC_HELPER_FN(add_fetch, ADD, DATA_TYPE, new)
 #undef ADD
 
 #undef GEN_ATOMIC_HELPER_FN
-#endif /* DATA_SIZE < 16 */
+#endif /* DATA_SIZE == 16 */
 
 #undef END
 #endif /* DATA_SIZE > 1 */
diff --git a/include/accel/tcg/cpu-ldst-common.h b/include/accel/tcg/cpu-ldst-common.h
index 8bf17c2fab..17a3250ded 100644
--- a/include/accel/tcg/cpu-ldst-common.h
+++ b/include/accel/tcg/cpu-ldst-common.h
@@ -100,9 +100,6 @@ GEN_ATOMIC_HELPER_ALL(umax_fetch)
 
 GEN_ATOMIC_HELPER_ALL(xchg)
 
-#undef GEN_ATOMIC_HELPER_ALL
-#undef GEN_ATOMIC_HELPER
-
 Int128 cpu_atomic_cmpxchgo_le_mmu(CPUArchState *env, vaddr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
@@ -110,6 +107,16 @@ Int128 cpu_atomic_cmpxchgo_be_mmu(CPUArchState *env, vaddr addr,
                                   Int128 cmpv, Int128 newv,
                                   MemOpIdx oi, uintptr_t retaddr);
 
+GEN_ATOMIC_HELPER(xchg, Int128, o_le)
+GEN_ATOMIC_HELPER(xchg, Int128, o_be)
+GEN_ATOMIC_HELPER(fetch_and, Int128, o_le)
+GEN_ATOMIC_HELPER(fetch_and, Int128, o_be)
+GEN_ATOMIC_HELPER(fetch_or, Int128, o_le)
+GEN_ATOMIC_HELPER(fetch_or, Int128, o_be)
+
+#undef GEN_ATOMIC_HELPER_ALL
+#undef GEN_ATOMIC_HELPER
+
 uint8_t cpu_ldb_code_mmu(CPUArchState *env, vaddr addr,
                          MemOpIdx oi, uintptr_t ra);
 uint16_t cpu_ldw_code_mmu(CPUArchState *env, vaddr addr,

From 092ac2481a4301d0282227bb4ee8641b3f39e437 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:50 +1000
Subject: [PATCH 0255/2396] tcg: Add
 tcg_gen_atomic_{xchg,fetch_and,fetch_or}_i128

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_common.c.inc |  9 ++++
 accel/tcg/tcg-runtime.h       | 12 +++++
 include/tcg/tcg-op-common.h   |  7 +++
 include/tcg/tcg-op.h          |  3 ++
 tcg/tcg-op-ldst.c             | 97 +++++++++++++++++++++++++++++++++--
 5 files changed, 125 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/atomic_common.c.inc b/accel/tcg/atomic_common.c.inc
index 6056598c23..bca93a0ac4 100644
--- a/accel/tcg/atomic_common.c.inc
+++ b/accel/tcg/atomic_common.c.inc
@@ -122,5 +122,14 @@ GEN_ATOMIC_HELPERS(umax_fetch)
 
 GEN_ATOMIC_HELPERS(xchg)
 
+#if HAVE_CMPXCHG128
+ATOMIC_HELPER(xchgo_be, Int128)
+ATOMIC_HELPER(xchgo_le, Int128)
+ATOMIC_HELPER(fetch_ando_be, Int128)
+ATOMIC_HELPER(fetch_ando_le, Int128)
+ATOMIC_HELPER(fetch_oro_be, Int128)
+ATOMIC_HELPER(fetch_oro_le, Int128)
+#endif
+
 #undef ATOMIC_HELPER
 #undef GEN_ATOMIC_HELPERS
diff --git a/accel/tcg/tcg-runtime.h b/accel/tcg/tcg-runtime.h
index c23b5e66c4..8436599b9f 100644
--- a/accel/tcg/tcg-runtime.h
+++ b/accel/tcg/tcg-runtime.h
@@ -63,6 +63,18 @@ DEF_HELPER_FLAGS_5(atomic_cmpxchgo_be, TCG_CALL_NO_WG,
                    i128, env, i64, i128, i128, i32)
 DEF_HELPER_FLAGS_5(atomic_cmpxchgo_le, TCG_CALL_NO_WG,
                    i128, env, i64, i128, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_xchgo_be, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_xchgo_le, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_fetch_ando_be, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_fetch_ando_le, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_fetch_oro_be, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
+DEF_HELPER_FLAGS_4(atomic_fetch_oro_le, TCG_CALL_NO_WG,
+                   i128, env, i64, i128, i32)
 #endif
 
 DEF_HELPER_FLAGS_5(nonatomic_cmpxchgo, TCG_CALL_NO_WG,
diff --git a/include/tcg/tcg-op-common.h b/include/tcg/tcg-op-common.h
index e1071adebf..f752ef440b 100644
--- a/include/tcg/tcg-op-common.h
+++ b/include/tcg/tcg-op-common.h
@@ -344,6 +344,8 @@ void tcg_gen_atomic_xchg_i32_chk(TCGv_i32, TCGTemp *, TCGv_i32,
                                  TCGArg, MemOp, TCGType);
 void tcg_gen_atomic_xchg_i64_chk(TCGv_i64, TCGTemp *, TCGv_i64,
                                  TCGArg, MemOp, TCGType);
+void tcg_gen_atomic_xchg_i128_chk(TCGv_i128, TCGTemp *, TCGv_i128,
+                                  TCGArg, MemOp, TCGType);
 
 void tcg_gen_atomic_fetch_add_i32_chk(TCGv_i32, TCGTemp *, TCGv_i32,
                                       TCGArg, MemOp, TCGType);
@@ -411,6 +413,11 @@ void tcg_gen_atomic_umax_fetch_i32_chk(TCGv_i32, TCGTemp *, TCGv_i32,
 void tcg_gen_atomic_umax_fetch_i64_chk(TCGv_i64, TCGTemp *, TCGv_i64,
                                        TCGArg, MemOp, TCGType);
 
+void tcg_gen_atomic_fetch_and_i128_chk(TCGv_i128, TCGTemp *, TCGv_i128,
+                                       TCGArg, MemOp, TCGType);
+void tcg_gen_atomic_fetch_or_i128_chk(TCGv_i128, TCGTemp *, TCGv_i128,
+                                      TCGArg, MemOp, TCGType);
+
 /* Vector ops */
 
 void tcg_gen_mov_vec(TCGv_vec, TCGv_vec);
diff --git a/include/tcg/tcg-op.h b/include/tcg/tcg-op.h
index c912578fdd..232733cb71 100644
--- a/include/tcg/tcg-op.h
+++ b/include/tcg/tcg-op.h
@@ -134,13 +134,16 @@ DEF_ATOMIC3(tcg_gen_nonatomic_cmpxchg, i128)
 
 DEF_ATOMIC2(tcg_gen_atomic_xchg, i32)
 DEF_ATOMIC2(tcg_gen_atomic_xchg, i64)
+DEF_ATOMIC2(tcg_gen_atomic_xchg, i128)
 
 DEF_ATOMIC2(tcg_gen_atomic_fetch_add, i32)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_add, i64)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_and, i32)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_and, i64)
+DEF_ATOMIC2(tcg_gen_atomic_fetch_and, i128)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_or, i32)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_or, i64)
+DEF_ATOMIC2(tcg_gen_atomic_fetch_or, i128)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_xor, i32)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_xor, i64)
 DEF_ATOMIC2(tcg_gen_atomic_fetch_smin, i32)
diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 548496002d..67c15fd4d0 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -801,6 +801,8 @@ typedef void (*gen_atomic_op_i32)(TCGv_i32, TCGv_env, TCGv_i64,
                                   TCGv_i32, TCGv_i32);
 typedef void (*gen_atomic_op_i64)(TCGv_i64, TCGv_env, TCGv_i64,
                                   TCGv_i64, TCGv_i32);
+typedef void (*gen_atomic_op_i128)(TCGv_i128, TCGv_env, TCGv_i64,
+                                   TCGv_i128, TCGv_i32);
 
 #ifdef CONFIG_ATOMIC64
 # define WITH_ATOMIC64(X) X,
@@ -1201,6 +1203,94 @@ static void do_atomic_op_i64(TCGv_i64 ret, TCGTemp *addr, TCGv_i64 val,
     }
 }
 
+static void do_nonatomic_op_i128(TCGv_i128 ret, TCGTemp *addr, TCGv_i128 val,
+                                 TCGArg idx, MemOp memop, bool new_val,
+                                 void (*gen)(TCGv_i64, TCGv_i64, TCGv_i64))
+{
+    TCGv_i128 t = tcg_temp_ebb_new_i128();
+    TCGv_i128 r = tcg_temp_ebb_new_i128();
+
+    tcg_gen_qemu_ld_i128_int(r, addr, idx, memop);
+    gen(TCGV128_LOW(t), TCGV128_LOW(r), TCGV128_LOW(val));
+    gen(TCGV128_HIGH(t), TCGV128_HIGH(r), TCGV128_HIGH(val));
+    tcg_gen_qemu_st_i128_int(t, addr, idx, memop);
+
+    tcg_gen_mov_i128(ret, r);
+    tcg_temp_free_i128(t);
+    tcg_temp_free_i128(r);
+}
+
+static void do_atomic_op_i128(TCGv_i128 ret, TCGTemp *addr, TCGv_i128 val,
+                              TCGArg idx, MemOp memop, void * const table[])
+{
+    gen_atomic_op_i128 gen = table[memop & (MO_SIZE | MO_BSWAP)];
+
+    if (gen) {
+        MemOpIdx oi = make_memop_idx(memop & ~MO_SIGN, idx);
+        TCGv_i64 a64 = maybe_extend_addr64(addr);
+        gen(ret, tcg_env, a64, val, tcg_constant_i32(oi));
+        maybe_free_addr64(a64);
+        return;
+    }
+
+    gen_helper_exit_atomic(tcg_env);
+    /* Produce a result */
+    tcg_gen_movi_i64(TCGV128_LOW(ret), 0);
+    tcg_gen_movi_i64(TCGV128_HIGH(ret), 0);
+}
+
+#define GEN_ATOMIC_HELPER128(NAME, OP, NEW)                             \
+static void * const table_##NAME[(MO_SIZE | MO_BSWAP) + 1] = {          \
+    [MO_8] = gen_helper_atomic_##NAME##b,                               \
+    [MO_16 | MO_LE] = gen_helper_atomic_##NAME##w_le,                   \
+    [MO_16 | MO_BE] = gen_helper_atomic_##NAME##w_be,                   \
+    [MO_32 | MO_LE] = gen_helper_atomic_##NAME##l_le,                   \
+    [MO_32 | MO_BE] = gen_helper_atomic_##NAME##l_be,                   \
+    WITH_ATOMIC64([MO_64 | MO_LE] = gen_helper_atomic_##NAME##q_le)     \
+    WITH_ATOMIC64([MO_64 | MO_BE] = gen_helper_atomic_##NAME##q_be)     \
+    WITH_ATOMIC128([MO_128 | MO_LE] = gen_helper_atomic_##NAME##o_le)   \
+    WITH_ATOMIC128([MO_128 | MO_BE] = gen_helper_atomic_##NAME##o_be)   \
+};                                                                      \
+void tcg_gen_atomic_##NAME##_i32_chk(TCGv_i32 ret, TCGTemp *addr,       \
+                                     TCGv_i32 val, TCGArg idx,          \
+                                     MemOp memop, TCGType addr_type)    \
+{                                                                       \
+    tcg_debug_assert(addr_type == tcg_ctx->addr_type);                  \
+    tcg_debug_assert((memop & MO_SIZE) <= MO_32);                       \
+    if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {                        \
+        do_atomic_op_i32(ret, addr, val, idx, memop, table_##NAME);     \
+    } else {                                                            \
+        do_nonatomic_op_i32(ret, addr, val, idx, memop, NEW,            \
+                            tcg_gen_##OP##_i32);                        \
+    }                                                                   \
+}                                                                       \
+void tcg_gen_atomic_##NAME##_i64_chk(TCGv_i64 ret, TCGTemp *addr,       \
+                                     TCGv_i64 val, TCGArg idx,          \
+                                     MemOp memop, TCGType addr_type)    \
+{                                                                       \
+    tcg_debug_assert(addr_type == tcg_ctx->addr_type);                  \
+    tcg_debug_assert((memop & MO_SIZE) <= MO_64);                       \
+    if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {                        \
+        do_atomic_op_i64(ret, addr, val, idx, memop, table_##NAME);     \
+    } else {                                                            \
+        do_nonatomic_op_i64(ret, addr, val, idx, memop, NEW,            \
+                            tcg_gen_##OP##_i64);                        \
+    }                                                                   \
+}                                                                       \
+void tcg_gen_atomic_##NAME##_i128_chk(TCGv_i128 ret, TCGTemp *addr,     \
+                                      TCGv_i128 val, TCGArg idx,        \
+                                      MemOp memop, TCGType addr_type)   \
+{                                                                       \
+    tcg_debug_assert(addr_type == tcg_ctx->addr_type);                  \
+    tcg_debug_assert((memop & MO_SIZE) == MO_128);                      \
+    if (tcg_ctx->gen_tb->cflags & CF_PARALLEL) {                        \
+        do_atomic_op_i128(ret, addr, val, idx, memop, table_##NAME);    \
+    } else {                                                            \
+        do_nonatomic_op_i128(ret, addr, val, idx, memop, NEW,           \
+                             tcg_gen_##OP##_i64);                       \
+    }                                                                   \
+}
+
 #define GEN_ATOMIC_HELPER(NAME, OP, NEW)                                \
 static void * const table_##NAME[(MO_SIZE | MO_BSWAP) + 1] = {          \
     [MO_8] = gen_helper_atomic_##NAME##b,                               \
@@ -1239,8 +1329,8 @@ void tcg_gen_atomic_##NAME##_i64_chk(TCGv_i64 ret, TCGTemp *addr,       \
 }
 
 GEN_ATOMIC_HELPER(fetch_add, add, 0)
-GEN_ATOMIC_HELPER(fetch_and, and, 0)
-GEN_ATOMIC_HELPER(fetch_or, or, 0)
+GEN_ATOMIC_HELPER128(fetch_and, and, 0)
+GEN_ATOMIC_HELPER128(fetch_or, or, 0)
 GEN_ATOMIC_HELPER(fetch_xor, xor, 0)
 GEN_ATOMIC_HELPER(fetch_smin, smin, 0)
 GEN_ATOMIC_HELPER(fetch_umin, umin, 0)
@@ -1266,6 +1356,7 @@ static void tcg_gen_mov2_i64(TCGv_i64 r, TCGv_i64 a, TCGv_i64 b)
     tcg_gen_mov_i64(r, b);
 }
 
-GEN_ATOMIC_HELPER(xchg, mov2, 0)
+GEN_ATOMIC_HELPER128(xchg, mov2, 0)
 
 #undef GEN_ATOMIC_HELPER
+#undef GEN_ATOMIC_HELPER128

From 905c2c34fe3432879f31ef0aa64ce478e573276b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 14:50:06 +1000
Subject: [PATCH 0256/2396] target/arm: Rename isar_feature_aa64_atomics

This is FEAT_LSE -- rename the predicate to match.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250830045006.380393-1-richard.henderson@linaro.org
Message-id: 20250815122653.701782-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 bsd-user/aarch64/target_arch_elf.h |  2 +-
 linux-user/aarch64/elfload.c       |  2 +-
 target/arm/cpu-features.h          |  2 +-
 target/arm/tcg/translate-a64.c     | 24 ++++++++++++------------
 4 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/bsd-user/aarch64/target_arch_elf.h b/bsd-user/aarch64/target_arch_elf.h
index cc87f475b3..cec254f88b 100644
--- a/bsd-user/aarch64/target_arch_elf.h
+++ b/bsd-user/aarch64/target_arch_elf.h
@@ -114,7 +114,7 @@ static uint32_t get_elf_hwcap(void)
     GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
     GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
     GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
-    GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
+    GET_FEATURE_ID(aa64_lse, ARM_HWCAP_A64_ATOMICS);
     GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
     GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
     GET_FEATURE_ID(aa64_fcma, ARM_HWCAP_A64_FCMA);
diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index dd5f34398a..8bf39c4730 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -154,7 +154,7 @@ abi_ulong get_elf_hwcap(CPUState *cs)
     GET_FEATURE_ID(aa64_sm3, ARM_HWCAP_A64_SM3);
     GET_FEATURE_ID(aa64_sm4, ARM_HWCAP_A64_SM4);
     GET_FEATURE_ID(aa64_fp16, ARM_HWCAP_A64_FPHP | ARM_HWCAP_A64_ASIMDHP);
-    GET_FEATURE_ID(aa64_atomics, ARM_HWCAP_A64_ATOMICS);
+    GET_FEATURE_ID(aa64_lse, ARM_HWCAP_A64_ATOMICS);
     GET_FEATURE_ID(aa64_lse2, ARM_HWCAP_A64_USCAT);
     GET_FEATURE_ID(aa64_rdm, ARM_HWCAP_A64_ASIMDRDM);
     GET_FEATURE_ID(aa64_dp, ARM_HWCAP_A64_ASIMDDP);
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index d48754bcf2..451b37b5b3 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -406,7 +406,7 @@ static inline bool isar_feature_aa64_crc32(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ISAR0, CRC32) != 0;
 }
 
-static inline bool isar_feature_aa64_atomics(const ARMISARegisters *id)
+static inline bool isar_feature_aa64_lse(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) >= 2;
 }
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 259aa70a36..0ba537268c 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3237,7 +3237,7 @@ static bool trans_LDXP(DisasContext *s, arg_stxr *a)
 
 static bool trans_CASP(DisasContext *s, arg_CASP *a)
 {
-    if (!dc_isar_feature(aa64_atomics, s)) {
+    if (!dc_isar_feature(aa64_lse, s)) {
         return false;
     }
     if (((a->rt | a->rs) & 1) != 0) {
@@ -3250,7 +3250,7 @@ static bool trans_CASP(DisasContext *s, arg_CASP *a)
 
 static bool trans_CAS(DisasContext *s, arg_CAS *a)
 {
-    if (!dc_isar_feature(aa64_atomics, s)) {
+    if (!dc_isar_feature(aa64_lse, s)) {
         return false;
     }
     gen_compare_and_swap(s, a->rs, a->rt, a->rn, a->sz);
@@ -3743,15 +3743,15 @@ static bool do_atomic_ld(DisasContext *s, arg_atomic *a, AtomicThreeOpFn *fn,
     return true;
 }
 
-TRANS_FEAT(LDADD, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_add_i64, 0, false)
-TRANS_FEAT(LDCLR, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_and_i64, 0, true)
-TRANS_FEAT(LDEOR, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_xor_i64, 0, false)
-TRANS_FEAT(LDSET, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_or_i64, 0, false)
-TRANS_FEAT(LDSMAX, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_smax_i64, MO_SIGN, false)
-TRANS_FEAT(LDSMIN, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_smin_i64, MO_SIGN, false)
-TRANS_FEAT(LDUMAX, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_umax_i64, 0, false)
-TRANS_FEAT(LDUMIN, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_fetch_umin_i64, 0, false)
-TRANS_FEAT(SWP, aa64_atomics, do_atomic_ld, a, tcg_gen_atomic_xchg_i64, 0, false)
+TRANS_FEAT(LDADD, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_add_i64, 0, false)
+TRANS_FEAT(LDCLR, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_and_i64, 0, true)
+TRANS_FEAT(LDEOR, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_xor_i64, 0, false)
+TRANS_FEAT(LDSET, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_or_i64, 0, false)
+TRANS_FEAT(LDSMAX, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_smax_i64, MO_SIGN, false)
+TRANS_FEAT(LDSMIN, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_smin_i64, MO_SIGN, false)
+TRANS_FEAT(LDUMAX, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_umax_i64, 0, false)
+TRANS_FEAT(LDUMIN, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_umin_i64, 0, false)
+TRANS_FEAT(SWP, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_xchg_i64, 0, false)
 
 static bool trans_LDAPR(DisasContext *s, arg_LDAPR *a)
 {
@@ -3759,7 +3759,7 @@ static bool trans_LDAPR(DisasContext *s, arg_LDAPR *a)
     TCGv_i64 clean_addr;
     MemOp mop;
 
-    if (!dc_isar_feature(aa64_atomics, s) ||
+    if (!dc_isar_feature(aa64_lse, s) ||
         !dc_isar_feature(aa64_rcpc_8_3, s)) {
         return false;
     }

From 99e441107efb34a8af990cedbfbda0567d0bb387 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:52 +1000
Subject: [PATCH 0257/2396] target/arm: Implement FEAT_LSE128

This feature contains the LDCLRP, LDSETP, and SWPP instructions.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h      |  5 ++++
 target/arm/tcg/a64.decode      |  7 +++++
 target/arm/tcg/translate-a64.c | 49 ++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 451b37b5b3..e49e0ae3af 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -411,6 +411,11 @@ static inline bool isar_feature_aa64_lse(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) >= 2;
 }
 
+static inline bool isar_feature_aa64_lse128(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR0, ATOMIC) >= 3;
+}
+
 static inline bool isar_feature_aa64_rdm(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64ISAR0, RDM) != 0;
diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 766c610c01..55ff6c504f 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -546,6 +546,13 @@ SWP             .. 111 0 00 . . 1 ..... 1000 00 ..... ..... @atomic
 
 LDAPR           sz:2 111 0 00 1 0 1 11111 1100 00 rn:5 rt:5
 
+# Atomic 128-bit memory operations
+&atomic128      rn rt rt2 a r
+@atomic128      ........ a:1 r:1 . rt2:5 ...... rn:5 rt:5   &atomic128
+LDCLRP          00011001 .   .   1 ..... 000100 ..... ..... @atomic128
+LDSETP          00011001 .   .   1 ..... 001100 ..... ..... @atomic128
+SWPP            00011001 .   .   1 ..... 100000 ..... ..... @atomic128
+
 # Load/store register (pointer authentication)
 
 # LDRA immediate is 10 bits signed and scaled, but the bits aren't all contiguous
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 0ba537268c..37bedc3780 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3753,6 +3753,55 @@ TRANS_FEAT(LDUMAX, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_umax_i64, 0,
 TRANS_FEAT(LDUMIN, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_fetch_umin_i64, 0, false)
 TRANS_FEAT(SWP, aa64_lse, do_atomic_ld, a, tcg_gen_atomic_xchg_i64, 0, false)
 
+typedef void Atomic128ThreeOpFn(TCGv_i128, TCGv_i64, TCGv_i128, TCGArg, MemOp);
+
+static bool do_atomic128_ld(DisasContext *s, arg_atomic128 *a,
+                            Atomic128ThreeOpFn *fn, bool invert)
+{
+    MemOp mop;
+    int rlo, rhi;
+    TCGv_i64 clean_addr, tlo, thi;
+    TCGv_i128 t16;
+
+    if (a->rt == 31 || a->rt2 == 31 || a->rt == a->rt2) {
+        return false;
+    }
+    if (a->rn == 31) {
+        gen_check_sp_alignment(s);
+    }
+    mop = check_atomic_align(s, a->rn, MO_128);
+    clean_addr = gen_mte_check1(s, cpu_reg_sp(s, a->rn), false,
+                                a->rn != 31, mop);
+
+    rlo = (s->be_data == MO_LE ? a->rt : a->rt2);
+    rhi = (s->be_data == MO_LE ? a->rt2 : a->rt);
+
+    tlo = read_cpu_reg(s, rlo, true);
+    thi = read_cpu_reg(s, rhi, true);
+    if (invert) {
+        tcg_gen_not_i64(tlo, tlo);
+        tcg_gen_not_i64(thi, thi);
+    }
+    /*
+     * The tcg atomic primitives are all full barriers.  Therefore we
+     * can ignore the Acquire and Release bits of this instruction.
+     */
+    t16 = tcg_temp_new_i128();
+    tcg_gen_concat_i64_i128(t16, tlo, thi);
+
+    fn(t16, clean_addr, t16, get_mem_index(s), mop);
+
+    tcg_gen_extr_i128_i64(cpu_reg(s, rlo), cpu_reg(s, rhi), t16);
+    return true;
+}
+
+TRANS_FEAT(LDCLRP, aa64_lse128, do_atomic128_ld,
+           a, tcg_gen_atomic_fetch_and_i128, true)
+TRANS_FEAT(LDSETP, aa64_lse128, do_atomic128_ld,
+           a, tcg_gen_atomic_fetch_or_i128, false)
+TRANS_FEAT(SWPP, aa64_lse128, do_atomic128_ld,
+           a, tcg_gen_atomic_xchg_i128, false)
+
 static bool trans_LDAPR(DisasContext *s, arg_LDAPR *a)
 {
     bool iss_sf = ldst_iss_sf(a->sz, false, false);

From 23f5b02447503d9e28f6fad690ccce850c7bb656 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 15 Aug 2025 22:26:53 +1000
Subject: [PATCH 0258/2396] target/arm: Enable FEAT_LSE128 for -cpu max

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250815122653.701782-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 linux-user/aarch64/elfload.c  | 1 +
 target/arm/tcg/cpu64.c        | 2 +-
 3 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index b12f013b4f..4e8aca8b5d 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -89,6 +89,7 @@ the following architecture extensions:
 - FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
 - FEAT_LSE (Large System Extensions)
 - FEAT_LSE2 (Large System Extensions v2)
+- FEAT_LSE128 (128-bit Atomics)
 - FEAT_LVA (Large Virtual Address space)
 - FEAT_MixedEnd (Mixed-endian support)
 - FEAT_MixedEndEL0 (Mixed-endian support at EL0)
diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 8bf39c4730..77d03b50e1 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -216,6 +216,7 @@ abi_ulong get_elf_hwcap2(CPUState *cs)
     GET_FEATURE_ID(aa64_sme_f16f16, ARM_HWCAP2_A64_SME_F16F16);
     GET_FEATURE_ID(aa64_sve_b16b16, ARM_HWCAP2_A64_SVE_B16B16);
     GET_FEATURE_ID(aa64_cssc, ARM_HWCAP2_A64_CSSC);
+    GET_FEATURE_ID(aa64_lse128, ARM_HWCAP2_A64_LSE128);
 
     return hwcaps;
 }
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index eaf8846a6a..b8b1981e70 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1145,7 +1145,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);     /* FEAT_SHA1 */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2);     /* FEAT_SHA512 */
     t = FIELD_DP64(t, ID_AA64ISAR0, CRC32, 1);    /* FEAT_CRC32 */
-    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);   /* FEAT_LSE */
+    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 3);   /* FEAT_LSE, FEAT_LSE128 */
     t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);      /* FEAT_RDM */
     t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);     /* FEAT_SHA3 */
     t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);      /* FEAT_SM3 */

From 2e27650bddd35477d994a795a3b1cb57c8ed5c76 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:42:29 +0100
Subject: [PATCH 0259/2396] hw/arm/stm32f205_soc: Don't leak TYPE_OR_IRQ
 objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In stm32f250_soc_initfn() we mostly use the standard pattern
for child objects of calling object_initialize_child(). However
for s->adc_irqs we call object_new() and then later qdev_realize(),
and we never unref the object on deinit. This causes a leak,
detected by ASAN on the device-introspect-test:

Indirect leak of 10 byte(s) in 1 object(s) allocated from:
    #0 0x5b9fc4789de3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-arm+0x21f1de3) (BuildId: 267a2619a026ed91c78a07b1eb2ef15381538efe)
    #1 0x740de3f28b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x740de3f3e4d8 in g_strdup (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x784d8) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #3 0x5b9fc70159e1 in g_strdup_inline /usr/include/glib-2.0/glib/gstrfuncs.h:321:10
    #4 0x5b9fc70159e1 in object_property_try_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1276:18
    #5 0x5b9fc7015f94 in object_property_add /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1294:12
    #6 0x5b9fc701b900 in object_add_link_prop /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:2021:10
    #7 0x5b9fc701b3fc in object_property_add_link /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:2037:12
    #8 0x5b9fc4c299fb in qdev_init_gpio_out_named /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/gpio.c:90:9
    #9 0x5b9fc4c29b26 in qdev_init_gpio_out /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/gpio.c:101:5
    #10 0x5b9fc4c0f77a in or_irq_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/or-irq.c:70:5
    #11 0x5b9fc70257e1 in object_init_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:428:9
    #12 0x5b9fc700cd4b in object_initialize_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:570:5
    #13 0x5b9fc700e66d in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:774:5
    #14 0x5b9fc700e750 in object_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:789:12
    #15 0x5b9fc68b2162 in stm32f205_soc_initfn /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/arm/stm32f205_soc.c:69:26

Switch to using object_initialize_child() like all our
other child objects for this SoC object.

Cc: qemu-stable@nongnu.org
Fixes: b63041c8f6b ("STM32F205: Connect the ADC devices")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250821154229.2417453-1-peter.maydell@linaro.org
---
 hw/arm/stm32f205_soc.c         | 10 +++++-----
 include/hw/arm/stm32f205_soc.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index 229af7fb10..e3c7203c6e 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -66,7 +66,7 @@ static void stm32f205_soc_initfn(Object *obj)
                                 TYPE_STM32F2XX_TIMER);
     }
 
-    s->adc_irqs = OR_IRQ(object_new(TYPE_OR_IRQ));
+    object_initialize_child(obj, "adc-irq-orgate", &s->adc_irqs, TYPE_OR_IRQ);
 
     for (i = 0; i < STM_NUM_ADCS; i++) {
         object_initialize_child(obj, "adc[*]", &s->adc[i], TYPE_STM32F2XX_ADC);
@@ -171,12 +171,12 @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
 
     /* ADC 1 to 3 */
-    object_property_set_int(OBJECT(s->adc_irqs), "num-lines", STM_NUM_ADCS,
+    object_property_set_int(OBJECT(&s->adc_irqs), "num-lines", STM_NUM_ADCS,
                             &error_abort);
-    if (!qdev_realize(DEVICE(s->adc_irqs), NULL, errp)) {
+    if (!qdev_realize(DEVICE(&s->adc_irqs), NULL, errp)) {
         return;
     }
-    qdev_connect_gpio_out(DEVICE(s->adc_irqs), 0,
+    qdev_connect_gpio_out(DEVICE(&s->adc_irqs), 0,
                           qdev_get_gpio_in(armv7m, ADC_IRQ));
 
     for (i = 0; i < STM_NUM_ADCS; i++) {
@@ -187,7 +187,7 @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
         busdev = SYS_BUS_DEVICE(dev);
         sysbus_mmio_map(busdev, 0, adc_addr[i]);
         sysbus_connect_irq(busdev, 0,
-                           qdev_get_gpio_in(DEVICE(s->adc_irqs), i));
+                           qdev_get_gpio_in(DEVICE(&s->adc_irqs), i));
     }
 
     /* SPI 1 and 2 */
diff --git a/include/hw/arm/stm32f205_soc.h b/include/hw/arm/stm32f205_soc.h
index 4f4c8bbebc..46eda3403a 100644
--- a/include/hw/arm/stm32f205_soc.h
+++ b/include/hw/arm/stm32f205_soc.h
@@ -59,7 +59,7 @@ struct STM32F205State {
     STM32F2XXADCState adc[STM_NUM_ADCS];
     STM32F2XXSPIState spi[STM_NUM_SPIS];
 
-    OrIRQState *adc_irqs;
+    OrIRQState adc_irqs;
 
     MemoryRegion sram;
     MemoryRegion flash;

From a12ff7f807e3ae2e254ac1de45c3892831479a0f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 23 Jul 2025 15:15:04 +0200
Subject: [PATCH 0260/2396] ui/keymaps: Avoid trace crash and improve error
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

parse_keyboard_layout() passes a possibly null @filename to
trace_keymap_parse().  Trace backend log then formats it with %s,
which crashes on some systems.

Fix by moving the null check before the trace_keymap_parse().

While there, improve the error messages a bit.

Fixes: d3b787fa7dde (keymaps: add tracing)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250723131504.1482657-1-armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ui/keymaps.c | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/ui/keymaps.c b/ui/keymaps.c
index 6ceaa97085..2359dbfe7e 100644
--- a/ui/keymaps.c
+++ b/ui/keymaps.c
@@ -86,19 +86,25 @@ static int parse_keyboard_layout(kbd_layout_t *k,
                                  const name2keysym_t *table,
                                  const char *language, Error **errp)
 {
+    g_autofree char *filename = NULL;
     int ret;
     FILE *f;
-    char * filename;
     char line[1024];
     char keyname[64];
     int len;
 
     filename = qemu_find_file(QEMU_FILE_TYPE_KEYMAP, language);
+    if (!filename) {
+        error_setg(errp, "could not find keymap file for language '%s'",
+                   language);
+        return -1;
+    }
+
     trace_keymap_parse(filename);
-    f = filename ? fopen(filename, "r") : NULL;
-    g_free(filename);
+
+    f = fopen(filename, "r");
     if (!f) {
-        error_setg(errp, "could not read keymap file: '%s'", language);
+        error_setg_file_open(errp, errno, filename);
         return -1;
     }
 

From 83f6dceb8f5c0a1efe806a9a4905cbc743a8a378 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 30 Jul 2025 09:27:09 +0200
Subject: [PATCH 0261/2396] qga: Fix ubsan warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When compiling QEMU with --enable-ubsan there is a undefined behavior
warning when running "make check":

 .../qga/commands-linux.c:452:15: runtime error: applying non-zero offset 5 to null pointer
 #0 0x55ea7b89450c in build_guest_fsinfo_for_pci_dev ..../qga/commands-linux.c:452:15

Fix it by avoiding the additional pointer variable here and use an
"offset" integer variable instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250730072709.27077-1-thuth@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/commands-linux.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/qga/commands-linux.c b/qga/commands-linux.c
index 9dc0c82503..4a09ddc760 100644
--- a/qga/commands-linux.c
+++ b/qga/commands-linux.c
@@ -400,10 +400,10 @@ static bool build_guest_fsinfo_for_pci_dev(char const *syspath,
                                            Error **errp)
 {
     unsigned int pci[4], host, hosts[8], tgt[3];
-    int i, nhosts = 0, pcilen;
+    int i, offset, nhosts = 0, pcilen;
     GuestPCIAddress *pciaddr = disk->pci_controller;
     bool has_ata = false, has_host = false, has_tgt = false;
-    char *p, *q, *driver = NULL;
+    char *p, *driver = NULL;
     bool ret = false;
 
     p = strstr(syspath, "/devices/pci");
@@ -445,13 +445,13 @@ static bool build_guest_fsinfo_for_pci_dev(char const *syspath,
 
     p = strstr(syspath, "/ata");
     if (p) {
-        q = p + 4;
+        offset = 4;
         has_ata = true;
     } else {
         p = strstr(syspath, "/host");
-        q = p + 5;
+        offset = 5;
     }
-    if (p && sscanf(q, "%u", &host) == 1) {
+    if (p && sscanf(p + offset, "%u", &host) == 1) {
         has_host = true;
         nhosts = build_hosts(syspath, p, has_ata, hosts,
                              ARRAY_SIZE(hosts), errp);

From 42bdb911c22f9449f7a310efc73b70548ca42b24 Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Thu, 7 Aug 2025 15:32:21 +0200
Subject: [PATCH 0262/2396] qga: fix potentially not initialized nr_volumes in
 qga_vss_fsfreeze()

In this function we could have this variable not initialized. If this
could be acceptable on error, the variable could be left not initialized
f.e. as follows:

void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
{
    ...
    if (mountpoints) {
        ...
        if (num_mount_points == 0) {
            /* If there is no valid mount points, just exit. */
            goto out;
        }
    }
    ...
    if (!mountpoints) {
        ...
        if (num_fixed_drives == 0) {
            goto out; /* If there is no fixed drive, just exit. */
        }
    }
    ...
}

Stay on safe side, initialize the variable at the beginning.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: Kostiantyn Kostiuk <kkostiuk@redhat.com>
CC: Michael Roth <michael.roth@amd.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250807133221.1135453-1-den@openvz.org
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/qga/vss-win32.c b/qga/vss-win32.c
index f444a25a70..b272bfc782 100644
--- a/qga/vss-win32.c
+++ b/qga/vss-win32.c
@@ -157,6 +157,8 @@ void qga_vss_fsfreeze(int *nr_volume, bool freeze,
         .errp = errp,
     };
 
+    *nr_volume = 0;
+
     g_assert(errp);             /* requester.cpp requires it */
     func = (QGAVSSRequesterFunc)GetProcAddress(provider_lib, func_name);
     if (!func) {

From 9646155bb01c076f982601b1ebdead73efcb58a1 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 17:52:40 +0300
Subject: [PATCH 0263/2396] qga-vss: Replace asserts with condition and report
 error

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825145241.170717-2-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/requester.cpp | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/qga/vss-win32/requester.cpp b/qga/vss-win32/requester.cpp
index 4401d55e3a..bc260abb96 100644
--- a/qga/vss-win32/requester.cpp
+++ b/qga/vss-win32/requester.cpp
@@ -347,7 +347,12 @@ void requester_freeze(int *num_vols, void *mountpoints, ErrorSet *errset)
         goto out;
     }
 
-    assert(pCreateVssBackupComponents != NULL);
+    if (!pCreateVssBackupComponents) {
+        err_set(errset, (HRESULT)ERROR_PROC_NOT_FOUND,
+                "CreateVssBackupComponents proc address absent. Did you call requester_init()?");
+        goto out;
+    }
+
     hr = pCreateVssBackupComponents(&vss_ctx.pVssbc);
     if (FAILED(hr)) {
         err_set(errset, hr, "failed to create VSS backup components");
@@ -579,8 +584,16 @@ void requester_thaw(int *num_vols, void *mountpints, ErrorSet *errset)
     /* Tell the provider that the snapshot is finished. */
     SetEvent(vss_ctx.hEventThaw);
 
-    assert(vss_ctx.pVssbc);
-    assert(vss_ctx.pAsyncSnapshot);
+    if (!vss_ctx.pVssbc) {
+        err_set(errset, (HRESULT)VSS_E_BAD_STATE,
+                "CreateVssBackupComponents is missing. Did you freeze the volumes?");
+        return;
+    }
+    if (!vss_ctx.pAsyncSnapshot) {
+        err_set(errset, (HRESULT)VSS_E_BAD_STATE,
+                "AsyncSnapshot set is missing. Did you freeze the volumes?");
+        return;
+    }
 
     HRESULT hr = WaitForAsync(vss_ctx.pAsyncSnapshot);
     switch (hr) {

From ed42682a66ef9f5e892abb7bcc3f211e1180f075 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 17:52:41 +0300
Subject: [PATCH 0264/2396] qga-vss: Remove unused dependencies

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825145241.170717-3-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/meson.build | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/qga/vss-win32/meson.build b/qga/vss-win32/meson.build
index 0ac918910b..a6b810f12a 100644
--- a/qga/vss-win32/meson.build
+++ b/qga/vss-win32/meson.build
@@ -13,13 +13,11 @@ qga_vss = shared_module(
   link_args: link_args,
   vs_module_defs: 'qga-vss.def',
   dependencies: [
-    glib,
     socket,
     cc.find_library('ole32'),
     cc.find_library('oleaut32'),
     cc.find_library('shlwapi'),
-    cc.find_library('uuid'),
-    cc.find_library('intl')
+    cc.find_library('uuid')
   ]
 )
 

From 3b0ba59762380fff9c91a031301f6f661abaac96 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 17:05:48 +0300
Subject: [PATCH 0265/2396] qga: Fix channel initialization check in
 run_agent_once

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825140549.146617-2-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/main.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qga/main.c b/qga/main.c
index 6c02f3ec38..a1bf8f53ac 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -1563,7 +1563,7 @@ static void cleanup_agent(GAState *s)
 static int run_agent_once(GAState *s)
 {
     if (!s->channel &&
-        channel_init(s, s->config->method, s->config->channel_path,
+        !channel_init(s, s->config->method, s->config->channel_path,
                      s->socket_activation ? FIRST_SOCKET_ACTIVATION_FD : -1)) {
         g_critical("failed to initialize guest agent channel");
         return EXIT_FAILURE;

From b44c8a6d837ed4e082dd03d79095a4e9141eff5b Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 17:05:49 +0300
Subject: [PATCH 0266/2396] qga: ignore channel_init() fail if 'retry_path' is
 set

On Windows, we run QGA with `-d --retry-path` options by default,
and expect that QGA will start even without the vioserial driver
and will wait for communication forever.

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Reviewed-by: Michal Privoznik <mprivozn@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825140549.146617-3-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/main.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/qga/main.c b/qga/main.c
index a1bf8f53ac..dd1c216f9a 100644
--- a/qga/main.c
+++ b/qga/main.c
@@ -1512,8 +1512,12 @@ static GAState *initialize_agent(GAConfig *config, int socket_activation)
 
     if (!channel_init(s, s->config->method, s->config->channel_path,
                       s->socket_activation ? FIRST_SOCKET_ACTIVATION_FD : -1)) {
-        g_critical("failed to initialize guest agent channel");
-        return NULL;
+        if (s->config->retry_path) {
+            g_info("failed to initialize guest agent channel, will retry");
+        } else {
+            g_critical("failed to initialize guest agent channel");
+            return NULL;
+        }
     }
 
     if (config->daemonize) {

From edf3780a7dad4658ab7b72ea37e310a2be9b16d3 Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 16:53:11 +0300
Subject: [PATCH 0267/2396] qga-vss: Write hex value of error in log

QGA-VSS writes error using error_setg_win32_internal,
which call g_win32_error_message.

g_win32_error_message - translate a Win32 error code
(as returned by GetLastError()) into the corresponding message.

In the same time, we call error_setg_win32_internal with
error codes from different Windows componets like VSS or
Performance monitor that provides different codes and
can't be converted with g_win32_error_message. In this
case, the empty suffix will be returned so error will be
masked.

This commit directly add hex value of error code.

Reproduce:
 - Run QGA command: {"execute": "guest-fsfreeze-freeze-list", "arguments": {"mountpoints": ["D:"]}}

QGA error example:
 - before changes:
  {"error": {"class": "GenericError", "desc": "failed to add D: to snapshot set: "}}
 - after changes:
  {"error": {"class": "GenericError", "desc": "failed to add D: to snapshot set: Windows error 0x8004230e: "}}

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825135311.138330-1-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/vss-win32/requester.cpp | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/qga/vss-win32/requester.cpp b/qga/vss-win32/requester.cpp
index bc260abb96..5615955b6f 100644
--- a/qga/vss-win32/requester.cpp
+++ b/qga/vss-win32/requester.cpp
@@ -28,8 +28,9 @@
 
 #define err_set(e, err, fmt, ...) {                                         \
     (e)->error_setg_win32_wrapper((e)->errp, __FILE__, __LINE__, __func__,  \
-                                   err, fmt, ## __VA_ARGS__);               \
-    qga_debug(fmt, ## __VA_ARGS__);                                         \
+                                   err, fmt ": Windows error 0x%lx",        \
+                                   ## __VA_ARGS__, err);                    \
+    qga_debug(fmt ": Windows error 0x%lx", ## __VA_ARGS__, err);            \
 }
 /* Bad idea, works only when (e)->errp != NULL: */
 #define err_is_set(e) ((e)->errp && *(e)->errp)

From 85ff0e956bf26a93c92e4dca8f6257613269a0cf Mon Sep 17 00:00:00 2001
From: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Date: Mon, 25 Aug 2025 17:31:55 +0300
Subject: [PATCH 0268/2396] qga/installer: Remove QGA VSS if QGA installation
 failed

When QGA Installer failed to install QGA service but install
QGA VSS provider, provider should be removed before installer
exits. Otherwise QGA VSS will has broken infomation and
prevent QGA installation in next run.

Reviewed-by: Yan Vugenfirer <yvugenfi@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250825143155.160913-1-kkostiuk@redhat.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/installer/qemu-ga.wxs | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/qga/installer/qemu-ga.wxs b/qga/installer/qemu-ga.wxs
index df572adb4a..32b8308728 100644
--- a/qga/installer/qemu-ga.wxs
+++ b/qga/installer/qemu-ga.wxs
@@ -151,6 +151,14 @@
               Return="check"
               >
     </CustomAction>
+    <CustomAction Id="UnRegisterCom_Rollback"
+              ExeCommand='"[qemu_ga_directory]qga-vss.dll",DLLCOMUnregister'
+              Execute="rollback"
+              Property="rundll"
+              Impersonate="no"
+              Return="check"
+              >
+    </CustomAction>
     <?endif?>
 
     <Feature Id="QEMUFeature" Title="QEMU Guest Agent" Level="1">
@@ -174,8 +182,19 @@
 
     <InstallExecuteSequence>
       <?ifdef var.InstallVss?>
-      <Custom Action="UnRegisterCom" After="StopServices">Installed</Custom>
-      <Custom Action="RegisterCom" After="InstallServices">NOT REMOVE</Custom>
+        <!-- Use explicit Sequence number to provide an absolute position in the sequence-->
+        <!-- This is needed to set "UnRegisterCom_Rollback" before "RegisterCom" and after "InstallFiles"-->
+        <!-- but, Wix detect this double condition incorrectly -->
+
+        <!-- UnRegisterCom_Rollback (for install rollback): at 5849, right before RegisterCom (5850)-->
+        <!-- Runs only if the installation fails and rolls back-->
+        <Custom Action="UnRegisterCom_Rollback" Sequence="5849">NOT REMOVE</Custom>
+
+        <!-- RegisterCom (for install): at 5850, right after InstallFiles (5849) (old: After="InstallServices")-->
+        <Custom Action="RegisterCom" Sequence="5850">NOT REMOVE</Custom>
+
+        <!-- UnRegisterCom (for uninstall): at 1901, right after StopServices (1900) (old: After="StopServices")-->
+        <Custom Action="UnRegisterCom" Sequence="1901">Installed</Custom>
       <?endif?>
     </InstallExecuteSequence>
   </Product>

From 28c5d27dd4dc4100a96ff4c9e5871dd23c6b02ec Mon Sep 17 00:00:00 2001
From: "minglei.liu" <minglei.liu@smartx.com>
Date: Fri, 11 Jul 2025 10:17:14 +0800
Subject: [PATCH 0269/2396] qga: Fix truncated output handling in guest-exec
 status reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: minglei.liu <minglei.liu@smartx.com>
Fixes: a1853dca743
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250711021714.91258-1-minglei.liu@smartx.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/commands.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/qga/commands.c b/qga/commands.c
index 5a5fad31f8..5f20af25d3 100644
--- a/qga/commands.c
+++ b/qga/commands.c
@@ -205,13 +205,15 @@ GuestExecStatus *qmp_guest_exec_status(int64_t pid, Error **errp)
 #endif
         if (gei->out.length > 0) {
             ges->out_data = g_base64_encode(gei->out.data, gei->out.length);
-            ges->has_out_truncated = gei->out.truncated;
+            ges->has_out_truncated = true;
+            ges->out_truncated = gei->out.truncated;
         }
         g_free(gei->out.data);
 
         if (gei->err.length > 0) {
             ges->err_data = g_base64_encode(gei->err.data, gei->err.length);
-            ges->has_err_truncated = gei->err.truncated;
+            ges->has_err_truncated = true;
+            ges->err_truncated = gei->err.truncated;
         }
         g_free(gei->err.data);
 

From b2e4534a2c9ce3d20ba44d855f1e2b71cc53c3a3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 23 Jul 2025 15:32:56 +0200
Subject: [PATCH 0270/2396] i386/kvm/vmsr_energy: Plug memory leak on failure
 to connect socket

vmsr_open_socket() leaks the Error set by
qio_channel_socket_connect_sync().  Plug the leak by not creating the
Error.

Fixes: 0418f90809ae (Add support for RAPL MSRs in KVM/Qemu)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250723133257.1497640-2-armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
---
 target/i386/kvm/vmsr_energy.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/target/i386/kvm/vmsr_energy.c b/target/i386/kvm/vmsr_energy.c
index 58ce3df53a..890322ae37 100644
--- a/target/i386/kvm/vmsr_energy.c
+++ b/target/i386/kvm/vmsr_energy.c
@@ -57,13 +57,9 @@ QIOChannelSocket *vmsr_open_socket(const char *path)
     };
 
     QIOChannelSocket *sioc = qio_channel_socket_new();
-    Error *local_err = NULL;
 
     qio_channel_set_name(QIO_CHANNEL(sioc), "vmsr-helper");
-    qio_channel_socket_connect_sync(sioc,
-                                    &saddr,
-                                    &local_err);
-    if (local_err) {
+    if (qio_channel_socket_connect_sync(sioc, &saddr, NULL) < 0) {
         /* Close socket. */
         qio_channel_close(QIO_CHANNEL(sioc), NULL);
         object_unref(OBJECT(sioc));

From ec14a3de622ae30a8afa78b6f564bc743b753ee1 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 23 Jul 2025 15:32:57 +0200
Subject: [PATCH 0271/2396] vfio scsi ui: Error-check
 qio_channel_socket_connect_sync() the same way

qio_channel_socket_connect_sync() returns 0 on success, and -1 on
failure, with errp set.  Some callers check the return value, and some
check whether errp was set.

For consistency, always check the return value, and always check it's
negative.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250723133257.1497640-3-armbru@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
---
 hw/vfio-user/proxy.c     | 2 +-
 scsi/pr-manager-helper.c | 9 ++-------
 ui/input-barrier.c       | 5 +----
 3 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 2275d3fe39..2c03d49f97 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -885,7 +885,7 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
 
     sioc = qio_channel_socket_new();
     ioc = QIO_CHANNEL(sioc);
-    if (qio_channel_socket_connect_sync(sioc, addr, errp)) {
+    if (qio_channel_socket_connect_sync(sioc, addr, errp) < 0) {
         object_unref(OBJECT(ioc));
         return NULL;
     }
diff --git a/scsi/pr-manager-helper.c b/scsi/pr-manager-helper.c
index 6b86f01b01..aea751fb04 100644
--- a/scsi/pr-manager-helper.c
+++ b/scsi/pr-manager-helper.c
@@ -105,20 +105,15 @@ static int pr_manager_helper_initialize(PRManagerHelper *pr_mgr,
         .u.q_unix.path = path
     };
     QIOChannelSocket *sioc = qio_channel_socket_new();
-    Error *local_err = NULL;
-
     uint32_t flags;
     int r;
 
     assert(!pr_mgr->ioc);
     qio_channel_set_name(QIO_CHANNEL(sioc), "pr-manager-helper");
-    qio_channel_socket_connect_sync(sioc,
-                                    &saddr,
-                                    &local_err);
+    r = qio_channel_socket_connect_sync(sioc, &saddr, errp);
     g_free(path);
-    if (local_err) {
+    if (r < 0) {
         object_unref(OBJECT(sioc));
-        error_propagate(errp, local_err);
         return -ENOTCONN;
     }
 
diff --git a/ui/input-barrier.c b/ui/input-barrier.c
index 9793258aac..0a2198ca50 100644
--- a/ui/input-barrier.c
+++ b/ui/input-barrier.c
@@ -490,7 +490,6 @@ static gboolean input_barrier_event(QIOChannel *ioc G_GNUC_UNUSED,
 static void input_barrier_complete(UserCreatable *uc, Error **errp)
 {
     InputBarrier *ib = INPUT_BARRIER(uc);
-    Error *local_err = NULL;
 
     if (!ib->name) {
         error_setg(errp, QERR_MISSING_PARAMETER, "name");
@@ -506,9 +505,7 @@ static void input_barrier_complete(UserCreatable *uc, Error **errp)
     ib->sioc = qio_channel_socket_new();
     qio_channel_set_name(QIO_CHANNEL(ib->sioc), "barrier-client");
 
-    qio_channel_socket_connect_sync(ib->sioc, &ib->saddr, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    if (qio_channel_socket_connect_sync(ib->sioc, &ib->saddr, errp) < 0) {
         return;
     }
 

From a60e1544b515e5205489141fc76cdf26de3a5f1b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 25 Jul 2025 15:50:31 +0200
Subject: [PATCH 0272/2396] qtest/qom-test: Shallow testing of qom-list /
 qom-get

This test traverses the QOM sub-tree rooted at /machine with a
combination of qom-list and qom-get.  In my x86_64 testing, it runs
almost 12000 QMP commands in 34 seconds.  With -m slow, we test more
machines, and it takes almost 84000 commands in almost four minutes.

Since commit 3dd93992ffb (tests/qtest/qom-test: unit test for
qom-list-get), the test traverses this tree a second time, with
qom-list-get.  In my x86_64 testing, this takes some 200 QMP commands
and around two seconds, and some 1100 in just under 12s with -m slow.

Traversing the entire tree is useful, because it exercise the QOM
property getters.  Traversing it twice not so much.

Make the qom-list / qom-get test shallow unless -m slow is given:
don't recurse.  Cuts the number of commands to around 600, and run
time to under 5s for me.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250725135034.2280477-3-armbru@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
---
 tests/qtest/qom-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/qom-test.c b/tests/qtest/qom-test.c
index 4ade1c728c..7dea0d802d 100644
--- a/tests/qtest/qom-test.c
+++ b/tests/qtest/qom-test.c
@@ -180,7 +180,7 @@ static void test_properties(QTestState *qts, const char *path, bool recurse)
         links = g_slist_delete_link(links, links);
     }
     while (children) {
-        test_properties(qts, children->data, true);
+        test_properties(qts, children->data, g_test_slow());
         g_free(children->data);
         children = g_slist_delete_link(children, children);
     }

From 67a392f7cf2b1662c21fb609b25bd745d25a2d05 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 25 Jul 2025 15:50:32 +0200
Subject: [PATCH 0273/2396] qtest/qom-test: Traverse entire QOM tree

This test traverses the QOM sub-tree rooted at /machine.  Traverse the
entire tree instead.

The x86_64 test runs some 40 additional QMP commands, and stays under
5s for me.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250725135034.2280477-4-armbru@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
---
 tests/qtest/qom-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/qom-test.c b/tests/qtest/qom-test.c
index 7dea0d802d..a2db56bf22 100644
--- a/tests/qtest/qom-test.c
+++ b/tests/qtest/qom-test.c
@@ -211,7 +211,7 @@ static void test_machine(gconstpointer data)
 
     test_properties(qts, "/machine", true);
 
-    qlist_append_str(paths, "/machine");
+    qlist_append_str(paths, "/");
     test_list_get(qts, paths);
     test_list_get_value(qts);
 

From c4c3ee8c1de5f04b4a34b53c2f3d6e85f5a2fe6f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 25 Jul 2025 15:50:33 +0200
Subject: [PATCH 0274/2396] qtest/qom-test: Don't bother to execute QMP command
 quit

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250725135034.2280477-5-armbru@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
---
 tests/qtest/qom-test.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tests/qtest/qom-test.c b/tests/qtest/qom-test.c
index a2db56bf22..2da9918e16 100644
--- a/tests/qtest/qom-test.c
+++ b/tests/qtest/qom-test.c
@@ -215,10 +215,6 @@ static void test_machine(gconstpointer data)
     test_list_get(qts, paths);
     test_list_get_value(qts);
 
-    response = qtest_qmp(qts, "{ 'execute': 'quit' }");
-    g_assert(qdict_haskey(response, "return"));
-    qobject_unref(response);
-
     qtest_quit(qts);
     g_free((void *)machine);
 }

From f0f682675c9b95ef762cec8dd1b868171a3dda67 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 25 Jul 2025 15:50:34 +0200
Subject: [PATCH 0275/2396] MAINTAINERS: Cover tests/qtest/qom-test.c

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250725135034.2280477-6-armbru@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 8147fff352..0207946537 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3454,6 +3454,7 @@ F: qom/
 F: tests/unit/check-qom-interface.c
 F: tests/unit/check-qom-proplist.c
 F: tests/unit/test-qdev-global-props.c
+F: tests/qtest/qom-test.c
 
 QOM boilerplate conversion script
 M: Eduardo Habkost <eduardo@habkost.net>

From c9a1ea9c52e6462ad5c7814f3abd65baa69dc4ce Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 28 Jul 2025 16:57:47 +0200
Subject: [PATCH 0276/2396] Revert "tests/qtest: use qos_printf instead of
 g_test_message"

This reverts commit 30ea13e9d97dcbd4ea541ddf9e8857fa1d5cb30f.

Also rewrites qos_printf() calls added later.

"make check" prints many lines like

    stdout: 138: UNKNOWN:     # # qos_test running single test in subprocess
    stdout: 139: UNKNOWN:     # # set_protocol_features: 0x42
    stdout: 140: UNKNOWN:     # # set_owner: start of session
    stdout: 141: UNKNOWN:     # # vhost-user: un-handled message: 14
    stdout: 142: UNKNOWN:     # # vhost-user: un-handled message: 14
    stdout: 143: UNKNOWN:     # # set_vring(0)=enabled
    stdout: 144: UNKNOWN:     # # set_vring(1)=enabled
    stdout: 145: UNKNOWN:     # # set_vring(0)=enabled
    stdout: 146: UNKNOWN:     # # set_vring(1)=enabled
    stdout: 147: UNKNOWN:     # # set_vring(0)=enabled
    stdout: 148: UNKNOWN:     # # set_vring(1)=enabled
    stdout: 149: UNKNOWN:     # # set_vring(0)=enabled
    stdout: 150: UNKNOWN:     # # set_vring(1)=enabled
    stdout: 151: UNKNOWN:     # # set_vring(0)=enabled
    stdout: 152: UNKNOWN:     # # set_vring(1)=enabled
    stdout: 153: UNKNOWN:     # # set_vring_num: 0/256
    stdout: 154: UNKNOWN:     # # set_vring_addr: 0x7f9060000000/0x7f905ffff000/0x7f9060001000

Turns out this is qos-test, and the culprit is a commit meant to ease
debugging.  Revert it until a better solution is found.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250728145747.3165315-1-armbru@redhat.com>
[Commit message clarified]
---
 tests/qtest/qos-test.c        |  5 -----
 tests/qtest/vhost-user-test.c | 27 +++++++++++++--------------
 2 files changed, 13 insertions(+), 19 deletions(-)

diff --git a/tests/qtest/qos-test.c b/tests/qtest/qos-test.c
index abfd4b9512..00f39f33f6 100644
--- a/tests/qtest/qos-test.c
+++ b/tests/qtest/qos-test.c
@@ -328,11 +328,6 @@ static void walk_path(QOSGraphNode *orig_path, int len)
 int main(int argc, char **argv, char** envp)
 {
     g_test_init(&argc, &argv, NULL);
-
-    if (g_test_subprocess()) {
-        qos_printf("qos_test running single test in subprocess\n");
-    }
-
     if (g_test_verbose()) {
         qos_printf("ENVIRONMENT VARIABLES: {\n");
         for (char **env = envp; *env != 0; env++) {
diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index 75cb3e44b2..56472ca709 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -26,7 +26,6 @@
 #include "libqos/virtio-pci.h"
 
 #include "libqos/malloc-pc.h"
-#include "libqos/qgraph_internal.h"
 #include "hw/virtio/virtio-net.h"
 
 #include "standard-headers/linux/vhost_types.h"
@@ -345,7 +344,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
     }
 
     if (size != VHOST_USER_HDR_SIZE) {
-        qos_printf("%s: Wrong message size received %d\n", __func__, size);
+        g_test_message("Wrong message size received %d", size);
         return;
     }
 
@@ -356,8 +355,8 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
         p += VHOST_USER_HDR_SIZE;
         size = qemu_chr_fe_read_all(chr, p, msg.size);
         if (size != msg.size) {
-            qos_printf("%s: Wrong message size received %d != %d\n",
-                       __func__, size, msg.size);
+            g_test_message("Wrong message size received %d != %d",
+                           size, msg.size);
             goto out;
         }
     }
@@ -393,7 +392,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * We don't need to do anything here, the remote is just
          * letting us know it is in charge. Just log it.
          */
-        qos_printf("set_owner: start of session\n");
+        g_test_message("set_owner: start of session\n");
         break;
 
     case VHOST_USER_GET_PROTOCOL_FEATURES:
@@ -419,7 +418,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * the remote end to send this. There is no handshake reply so
          * just log the details for debugging.
          */
-        qos_printf("set_protocol_features: 0x%"PRIx64 "\n", msg.payload.u64);
+        g_test_message("set_protocol_features: 0x%"PRIx64 "\n", msg.payload.u64);
         break;
 
         /*
@@ -427,11 +426,11 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * address of the vrings but we can simply report them.
          */
     case VHOST_USER_SET_VRING_NUM:
-        qos_printf("set_vring_num: %d/%d\n",
+        g_test_message("set_vring_num: %d/%d\n",
                    msg.payload.state.index, msg.payload.state.num);
         break;
     case VHOST_USER_SET_VRING_ADDR:
-        qos_printf("set_vring_addr: 0x%"PRIx64"/0x%"PRIx64"/0x%"PRIx64"\n",
+        g_test_message("set_vring_addr: 0x%"PRIx64"/0x%"PRIx64"/0x%"PRIx64"\n",
                    msg.payload.addr.avail_user_addr,
                    msg.payload.addr.desc_user_addr,
                    msg.payload.addr.used_user_addr);
@@ -464,7 +463,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
     case VHOST_USER_SET_VRING_CALL:
         /* consume the fd */
         if (!qemu_chr_fe_get_msgfds(chr, &fd, 1) && fd < 0) {
-            qos_printf("call fd: %d, do not set non-blocking\n", fd);
+            g_test_message("call fd: %d, do not set non-blocking\n", fd);
             break;
         }
         /*
@@ -510,12 +509,12 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * fully functioning vhost-user we would enable/disable the
          * vring monitoring.
          */
-        qos_printf("set_vring(%d)=%s\n", msg.payload.state.index,
+        g_test_message("set_vring(%d)=%s\n", msg.payload.state.index,
                    msg.payload.state.num ? "enabled" : "disabled");
         break;
 
     default:
-        qos_printf("vhost-user: un-handled message: %d\n", msg.request);
+        g_test_message("vhost-user: un-handled message: %d\n", msg.request);
         break;
     }
 
@@ -539,7 +538,7 @@ static const char *init_hugepagefs(void)
     }
 
     if (access(path, R_OK | W_OK | X_OK)) {
-        qos_printf("access on path (%s): %s", path, strerror(errno));
+        g_test_message("access on path (%s): %s", path, strerror(errno));
         g_test_fail();
         return NULL;
     }
@@ -549,13 +548,13 @@ static const char *init_hugepagefs(void)
     } while (ret != 0 && errno == EINTR);
 
     if (ret != 0) {
-        qos_printf("statfs on path (%s): %s", path, strerror(errno));
+        g_test_message("statfs on path (%s): %s", path, strerror(errno));
         g_test_fail();
         return NULL;
     }
 
     if (fs.f_type != HUGETLBFS_MAGIC) {
-        qos_printf("Warning: path not on HugeTLBFS: %s", path);
+        g_test_message("Warning: path not on HugeTLBFS: %s", path);
         g_test_fail();
         return NULL;
     }

From a80151c9da1a848e5d3ad7153080beaf0745e4cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 27 Jun 2024 09:10:39 +0200
Subject: [PATCH 0277/2396] hw/sd/sdcard: Remove support for spec v1.10
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support for spec v1.10 was deprecated in QEMU v9.1.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20240627071040.36190-4-philmd@linaro.org>
---
 docs/about/deprecated.rst       |  6 ------
 docs/about/removed-features.rst |  5 +++++
 hw/sd/sd.c                      | 12 ++----------
 include/hw/sd/sd.h              |  1 -
 4 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 5d1579dcf8..6ae6920681 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -434,12 +434,6 @@ recommending to switch to their stable counterparts:
 - "Zve64f" should be replaced with "zve64f"
 - "Zve64d" should be replaced with "zve64d"
 
-``-device sd-card,spec_version=1`` (since 9.1)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-SD physical layer specification v2.00 supersedes the v1.10 one.
-v2.00 is the default since QEMU 3.0.0.
-
 Block device options
 ''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 25a904032c..332d07e2b1 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1186,6 +1186,11 @@ by using ``-machine graphics=off``.
 
 The 'pvrdma' device and the whole RDMA subsystem have been removed.
 
+``-device sd-card,spec_version=1`` (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''''''
+
+SD physical layer specification v2.00 supersedes the v1.10 one.
+
 Related binaries
 ----------------
 
diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 8c290595f0..8b142e4796 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -195,7 +195,6 @@ static bool sd_is_emmc(SDState *sd)
 static const char *sd_version_str(enum SDPhySpecificationVersion version)
 {
     static const char *sdphy_version[] = {
-        [SD_PHY_SPECv1_10_VERS]     = "v1.10",
         [SD_PHY_SPECv2_00_VERS]     = "v2.00",
         [SD_PHY_SPECv3_01_VERS]     = "v3.01",
     };
@@ -407,11 +406,7 @@ static void sd_set_ocr(SDState *sd)
 static void sd_set_scr(SDState *sd)
 {
     sd->scr[0] = 0 << 4;        /* SCR structure version 1.0 */
-    if (sd->spec_version == SD_PHY_SPECv1_10_VERS) {
-        sd->scr[0] |= 1;        /* Spec Version 1.10 */
-    } else {
-        sd->scr[0] |= 2;        /* Spec Version 2.00 or Version 3.0X */
-    }
+    sd->scr[0] |= 2;            /* Spec Version 2.00 or Version 3.0X */
     sd->scr[1] = (2 << 4)       /* SDSC Card (Security Version 1.01) */
                  | 0b0101;      /* 1-bit or 4-bit width bus modes */
     sd->scr[2] = 0x00;          /* Extended Security is not supported. */
@@ -1555,9 +1550,6 @@ static sd_rsp_type_t sd_cmd_DE_SELECT_CARD(SDState *sd, SDRequest req)
 /* CMD8 */
 static sd_rsp_type_t sd_cmd_SEND_IF_COND(SDState *sd, SDRequest req)
 {
-    if (sd->spec_version < SD_PHY_SPECv2_00_VERS) {
-        return sd_cmd_illegal(sd, req);
-    }
     if (sd->state != sd_idle_state) {
         return sd_invalid_state_for_cmd(sd, req);
     }
@@ -2773,7 +2765,7 @@ static void sd_realize(DeviceState *dev, Error **errp)
     int ret;
 
     switch (sd->spec_version) {
-    case SD_PHY_SPECv1_10_VERS
+    case SD_PHY_SPECv2_00_VERS
      ... SD_PHY_SPECv3_01_VERS:
         break;
     default:
diff --git a/include/hw/sd/sd.h b/include/hw/sd/sd.h
index 55d363f58f..91b5c40a5f 100644
--- a/include/hw/sd/sd.h
+++ b/include/hw/sd/sd.h
@@ -56,7 +56,6 @@
 #define AKE_SEQ_ERROR           (1 << 3)
 
 enum SDPhySpecificationVersion {
-    SD_PHY_SPECv1_10_VERS     = 1,
     SD_PHY_SPECv2_00_VERS     = 2,
     SD_PHY_SPECv3_01_VERS     = 3,
 };

From b8d6e05f16b77231d11b96659072b302290b3396 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 10 Jun 2025 11:19:34 +0200
Subject: [PATCH 0278/2396] target/ppc/kvm: Avoid using alloca()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

kvmppc_load_htab_chunk() is used for migration, thus is not
a hot path. Use the heap instead of the stack, removing the
alloca() call.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250901132626.28639-2-philmd@linaro.org>
---
 target/ppc/kvm.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index d145774b09..2521ff65c6 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -2760,11 +2760,11 @@ int kvmppc_save_htab(QEMUFile *f, int fd, size_t bufsize, int64_t max_ns)
 int kvmppc_load_htab_chunk(QEMUFile *f, int fd, uint32_t index,
                            uint16_t n_valid, uint16_t n_invalid, Error **errp)
 {
-    struct kvm_get_htab_header *buf;
-    size_t chunksize = sizeof(*buf) + n_valid * HASH_PTE_SIZE_64;
+    size_t chunksize = sizeof(struct kvm_get_htab_header)
+                       + n_valid * HASH_PTE_SIZE_64;
+    g_autofree struct kvm_get_htab_header *buf = g_malloc(chunksize);
     ssize_t rc;
 
-    buf = alloca(chunksize);
     buf->index = index;
     buf->n_valid = n_valid;
     buf->n_invalid = n_invalid;

From 32ee080ccdde8a90d5ee3b56e28f95ada35dee4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 10 Jun 2025 11:25:39 +0200
Subject: [PATCH 0279/2396] docs/devel/style: Mention alloca() family API is
 forbidden
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20250901132626.28639-4-philmd@linaro.org>
---
 docs/devel/style.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/style.rst b/docs/devel/style.rst
index d025933808..941fe14bfd 100644
--- a/docs/devel/style.rst
+++ b/docs/devel/style.rst
@@ -446,8 +446,8 @@ Low level memory management
 ===========================
 
 Use of the ``malloc/free/realloc/calloc/valloc/memalign/posix_memalign``
-APIs is not allowed in the QEMU codebase. Instead of these routines,
-use the GLib memory allocation routines
+or ``alloca/g_alloca/g_newa/g_newa0`` APIs is not allowed in the QEMU codebase.
+Instead of these routines, use the GLib memory allocation routines
 ``g_malloc/g_malloc0/g_new/g_new0/g_realloc/g_free``
 or QEMU's ``qemu_memalign/qemu_blockalign/qemu_vfree`` APIs.
 

From e74416713fe166a6f21cc5ee2000cfd0c248e1a7 Mon Sep 17 00:00:00 2001
From: Djordje Todorovic <Djordje.Todorovic@htecgroup.com>
Date: Wed, 18 Jun 2025 12:27:49 +0000
Subject: [PATCH 0280/2396] hw/pci: Allow explicit function numbers in pci
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since there is no pch_gbe emulation, we could be using func other
than 0 when adding new devices to specific boards.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901102850.1172983-13-djordje.todorovic@htecgroup.com>
[PMD: Compare with null character ('\0'), not '0']
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci/pci.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c70b5ceeba..297196b242 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -984,14 +984,15 @@ static int pci_parse_devaddr(const char *addr, int *domp, int *busp,
 
     slot = val;
 
-    if (funcp != NULL) {
-        if (*e != '.')
+    if (funcp != NULL && *e != '\0') {
+        if (*e != '.') {
             return -1;
-
+        }
         p = e + 1;
         val = strtoul(p, &e, 16);
-        if (e == p)
+        if (e == p) {
             return -1;
+        }
 
         func = val;
     }
@@ -2054,13 +2055,15 @@ bool pci_init_nic_in_slot(PCIBus *rootbus, const char *model,
     int dom, busnr, devfn;
     PCIDevice *pci_dev;
     unsigned slot;
+    unsigned func;
+
     PCIBus *bus;
 
     if (!nd) {
         return false;
     }
 
-    if (!devaddr || pci_parse_devaddr(devaddr, &dom, &busnr, &slot, NULL) < 0) {
+    if (!devaddr || pci_parse_devaddr(devaddr, &dom, &busnr, &slot, &func) < 0) {
         error_report("Invalid PCI device address %s for device %s",
                      devaddr, model);
         exit(1);
@@ -2071,7 +2074,7 @@ bool pci_init_nic_in_slot(PCIBus *rootbus, const char *model,
         exit(1);
     }
 
-    devfn = PCI_DEVFN(slot, 0);
+    devfn = PCI_DEVFN(slot, func);
 
     bus = pci_find_bus_nr(rootbus, busnr);
     if (!bus) {

From 7ef54b7bf38104c59523a0d7559ae964676178b2 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 30 Jul 2025 15:04:34 -0700
Subject: [PATCH 0281/2396] migration: compile migration/ram.c once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250730220435.1139101-2-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 migration/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/meson.build b/migration/meson.build
index 276da3be5a..45e9445f97 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -31,6 +31,7 @@ system_ss.add(files(
   'multifd-zero-page.c',
   'options.c',
   'postcopy-ram.c',
+  'ram.c',
   'savevm.c',
   'socket.c',
   'tls.c',
@@ -50,5 +51,4 @@ system_ss.add(when: uadk, if_true: files('multifd-uadk.c'))
 system_ss.add(when: qatzip, if_true: files('multifd-qatzip.c'))
 
 specific_ss.add(when: 'CONFIG_SYSTEM_ONLY',
-                if_true: files('ram.c',
-                               'vfio.c'))
+                if_true: files('vfio.c'))

From 01b6fb37056bf5c6a734e77b386f4e9c830b2ce0 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 30 Jul 2025 15:04:35 -0700
Subject: [PATCH 0282/2396] migration/vfio: compile only once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250730220435.1139101-3-pierrick.bouvier@linaro.org>
[PMD: Cover vfio-stub.c in MAINTAINERS]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 MAINTAINERS           |  1 +
 migration/meson.build |  6 +++---
 migration/vfio-stub.c | 16 ++++++++++++++++
 migration/vfio.c      | 14 --------------
 4 files changed, 20 insertions(+), 17 deletions(-)
 create mode 100644 migration/vfio-stub.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 0207946537..040ef06494 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2268,6 +2268,7 @@ F: util/vfio-helpers.c
 F: include/hw/vfio/
 F: docs/devel/migration/vfio.rst
 F: qapi/vfio.json
+F: migration/vfio-stub.c
 F: tests/functional/aarch64/test_device_passthrough.py
 
 vfio-igd
diff --git a/migration/meson.build b/migration/meson.build
index 45e9445f97..0f71544a82 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -49,6 +49,6 @@ system_ss.add(when: zstd, if_true: files('multifd-zstd.c'))
 system_ss.add(when: qpl, if_true: files('multifd-qpl.c'))
 system_ss.add(when: uadk, if_true: files('multifd-uadk.c'))
 system_ss.add(when: qatzip, if_true: files('multifd-qatzip.c'))
-
-specific_ss.add(when: 'CONFIG_SYSTEM_ONLY',
-                if_true: files('vfio.c'))
+system_ss.add(when: 'CONFIG_VFIO',
+              if_true: files('vfio.c'),
+              if_false: files('vfio-stub.c'))
diff --git a/migration/vfio-stub.c b/migration/vfio-stub.c
new file mode 100644
index 0000000000..f59ebe075d
--- /dev/null
+++ b/migration/vfio-stub.c
@@ -0,0 +1,16 @@
+/*
+ * QEMU live migration - stubs for VFIO
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "migration.h"
+
+void migration_populate_vfio_info(MigrationInfo *info)
+{
+}
+
+void migration_reset_vfio_bytes_transferred(void)
+{
+}
diff --git a/migration/vfio.c b/migration/vfio.c
index 0b64e49ef0..af6ae2c1e1 100644
--- a/migration/vfio.c
+++ b/migration/vfio.c
@@ -8,13 +8,8 @@
 #include "qemu/osdep.h"
 #include "qapi/qapi-types-migration.h"
 #include "migration.h"
-#include CONFIG_DEVICES
-
-#ifdef CONFIG_VFIO
 #include "hw/vfio/vfio-migration.h"
-#endif
 
-#ifdef CONFIG_VFIO
 void migration_populate_vfio_info(MigrationInfo *info)
 {
     if (vfio_migration_active()) {
@@ -27,12 +22,3 @@ void migration_reset_vfio_bytes_transferred(void)
 {
     vfio_migration_reset_bytes_transferred();
 }
-#else
-void migration_populate_vfio_info(MigrationInfo *info)
-{
-}
-
-void migration_reset_vfio_bytes_transferred(void)
-{
-}
-#endif

From 38838f0837a3fcfadf000d885329216195a5f9ae Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 30 Jul 2025 15:05:17 -0700
Subject: [PATCH 0283/2396] cpu-target: build compilation unit once for
 user/system
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250730220519.1140447-2-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 cpu-target.c       | 5 -----
 meson.build        | 3 ++-
 target-info-stub.c | 4 ++++
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/cpu-target.c b/cpu-target.c
index 772e35495b..f030e2c642 100644
--- a/cpu-target.c
+++ b/cpu-target.c
@@ -18,7 +18,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "cpu.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "exec/cpu-common.h"
@@ -27,10 +26,6 @@
 #include "hw/core/cpu.h"
 #include "trace/trace-root.h"
 
-/* Validate correct placement of CPUArchState. */
-QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
-QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
-
 /* enable or disable single step mode. EXCP_DEBUG is returned by the
    CPU loop after each instruction */
 void cpu_single_step(CPUState *cpu, int enabled)
diff --git a/meson.build b/meson.build
index 0d42de61ae..7ff84787cf 100644
--- a/meson.build
+++ b/meson.build
@@ -3876,7 +3876,8 @@ if have_block
 endif
 
 common_ss.add(files('cpu-common.c'))
-specific_ss.add(files('cpu-target.c'))
+user_ss.add(files('cpu-target.c'))
+system_ss.add(files('cpu-target.c'))
 
 subdir('system')
 
diff --git a/target-info-stub.c b/target-info-stub.c
index ca0caa3686..d96d8249c1 100644
--- a/target-info-stub.c
+++ b/target-info-stub.c
@@ -12,6 +12,10 @@
 #include "hw/boards.h"
 #include "cpu.h"
 
+/* Validate correct placement of CPUArchState. */
+QEMU_BUILD_BUG_ON(offsetof(ArchCPU, parent_obj) != 0);
+QEMU_BUILD_BUG_ON(offsetof(ArchCPU, env) != sizeof(CPUState));
+
 static const TargetInfo target_info_stub = {
     .target_name = TARGET_NAME,
     .target_arch = SYS_EMU_TARGET__MAX,

From 9dbb61bb2cfea836bfdb10260a5ebe4d0678463a Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 30 Jul 2025 15:05:18 -0700
Subject: [PATCH 0284/2396] include/exec/target_page.h: move page-target.c to
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250730220519.1140447-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/exec/target_page.h | 11 ++++++++++-
 meson.build                |  2 +-
 page-target.c              | 21 ---------------------
 3 files changed, 11 insertions(+), 23 deletions(-)
 delete mode 100644 page-target.c

diff --git a/include/exec/target_page.h b/include/exec/target_page.h
index ca0ebbc8bb..813591c9b5 100644
--- a/include/exec/target_page.h
+++ b/include/exec/target_page.h
@@ -62,6 +62,15 @@ static inline int qemu_target_page_bits(void)
     return TARGET_PAGE_BITS;
 }
 
-size_t qemu_target_pages_to_MiB(size_t pages);
+/* Convert target pages to MiB (2**20). */
+static inline size_t qemu_target_pages_to_MiB(size_t pages)
+{
+    int page_bits = TARGET_PAGE_BITS;
+
+    /* So far, the largest (non-huge) page size is 64k, i.e. 16 bits. */
+    g_assert(page_bits < 20);
+
+    return pages >> (20 - page_bits);
+}
 
 #endif
diff --git a/meson.build b/meson.build
index 7ff84787cf..fa6186db33 100644
--- a/meson.build
+++ b/meson.build
@@ -3899,7 +3899,7 @@ if get_option('b_lto')
   pagevary = declare_dependency(link_with: pagevary)
 endif
 common_ss.add(pagevary)
-specific_ss.add(files('page-target.c', 'page-vary-target.c'))
+specific_ss.add(files('page-vary-target.c'))
 
 common_ss.add(files('target-info.c'))
 specific_ss.add(files('target-info-stub.c'))
diff --git a/page-target.c b/page-target.c
deleted file mode 100644
index 8fcd5443b5..0000000000
--- a/page-target.c
+++ /dev/null
@@ -1,21 +0,0 @@
-/*
- * QEMU page values getters (target independent)
- *
- *  Copyright (c) 2003 Fabrice Bellard
- *
- * SPDX-License-Identifier: LGPL-2.1-or-later
- */
-
-#include "qemu/osdep.h"
-#include "exec/target_page.h"
-
-/* Convert target pages to MiB (2**20). */
-size_t qemu_target_pages_to_MiB(size_t pages)
-{
-    int page_bits = TARGET_PAGE_BITS;
-
-    /* So far, the largest (non-huge) page size is 64k, i.e. 16 bits. */
-    g_assert(page_bits < 20);
-
-    return pages >> (20 - page_bits);
-}

From 0df57e00d22412320873c2a7548f49c72b247e42 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Fri, 1 Aug 2025 10:40:05 -0700
Subject: [PATCH 0285/2396] hw/meson: enter target hw first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can reuse target source sets for "generic" devices that are related
to a single architecture (like interrupt controllers).

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250801174006.2466508-2-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/meson.build | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/hw/meson.build b/hw/meson.build
index 791ce21ab4..1022bdb806 100644
--- a/hw/meson.build
+++ b/hw/meson.build
@@ -1,3 +1,26 @@
+# Enter target code first to reuse variables associated
+subdir('alpha')
+subdir('arm')
+subdir('avr')
+subdir('hppa')
+subdir('xenpv') # i386 uses it
+subdir('i386')
+subdir('loongarch')
+subdir('m68k')
+subdir('microblaze')
+subdir('mips')
+subdir('openrisc')
+subdir('ppc')
+subdir('remote')
+subdir('riscv')
+subdir('rx')
+subdir('s390x')
+subdir('sh4')
+subdir('sparc')
+subdir('sparc64')
+subdir('tricore')
+subdir('xtensa')
+
 subdir('9pfs')
 subdir('acpi')
 subdir('adc')
@@ -44,26 +67,4 @@ subdir('virtio')
 subdir('vmapple')
 subdir('watchdog')
 subdir('xen')
-subdir('xenpv')
 subdir('fsi')
-
-subdir('alpha')
-subdir('arm')
-subdir('avr')
-subdir('hppa')
-subdir('i386')
-subdir('loongarch')
-subdir('m68k')
-subdir('microblaze')
-subdir('mips')
-subdir('openrisc')
-subdir('ppc')
-subdir('remote')
-subdir('riscv')
-subdir('rx')
-subdir('s390x')
-subdir('sh4')
-subdir('sparc')
-subdir('sparc64')
-subdir('tricore')
-subdir('xtensa')

From c0a3bdf62c260aa647491b4906c55177a2c08d23 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Fri, 1 Aug 2025 10:40:06 -0700
Subject: [PATCH 0286/2396] hw/intc: compile some arm related source once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Let kvm related gic file out for now, as they are compiled only on
aarch64 hosts.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250801174006.2466508-3-pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/meson.build | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 3137521a4a..3efb276b6e 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -38,11 +38,11 @@ if config_all_devices.has_key('CONFIG_APIC') or \
 endif
 
 specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
-specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
-specific_ss.add(when: 'CONFIG_ARM_GICV3', if_true: files('arm_gicv3_cpuif.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_GICV3', if_true: files('arm_gicv3_cpuif.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
 specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
-specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
 specific_ss.add(when: 'CONFIG_GRLIB', if_true: files('grlib_irqmp.c'))
 specific_ss.add(when: 'CONFIG_IOAPIC', if_true: files('ioapic.c'))
 specific_ss.add(when: 'CONFIG_LOONGSON_LIOINTC', if_true: files('loongson_liointc.c'))

From 8e4649cac9bcddc050d2df07908075e9e69bccc7 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Thu, 7 Aug 2025 13:08:06 +0200
Subject: [PATCH 0287/2396] e1000e: Prevent crash from legacy interrupt firing
 after MSI-X enable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A race condition between guest driver actions and QEMU timers can lead
to an assertion failure when the guest switches the e1000e from legacy
interrupt mode to MSI-X. If a legacy interrupt delay timer (TIDV or
RDTR) is active, but the guest enables MSI-X before the timer fires,
the pending interrupt cause can trigger an assert in
e1000e_intmgr_collect_delayed_causes().

This patch removes the assertion and executes the code that clears the
pending legacy causes. This change is safe and introduces no unintended
behavioral side effects, as it only alters a state that previously led
to termination.

- when core->delayed_causes == 0 the function was already a no-op and
  remains so.

- when core->delayed_causes != 0 the function would previously
  crash due to the assertion failure. The patch now defines a safe
  outcome by clearing the cause and returning. Since behavior after
  the assertion never existed, this simply corrects the crash.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1863
Suggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20250807110806.409065-1-lvivier@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/e1000e_core.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 2413858790..06657bb3ac 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -341,11 +341,6 @@ e1000e_intmgr_collect_delayed_causes(E1000ECore *core)
 {
     uint32_t res;
 
-    if (msix_enabled(core->owner)) {
-        assert(core->delayed_causes == 0);
-        return 0;
-    }
-
     res = core->delayed_causes;
     core->delayed_causes = 0;
 

From c5ade4f9d289fed61df7a04950f8f607e26353e6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 11 Aug 2025 11:36:00 +0200
Subject: [PATCH 0288/2396] scripts/coverity-scan/COMPONENTS.md: Add a
 'plugins' category
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cover the TCG plugins files under their own Coverity category.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-Id: <20250811094341.91597-1-philmd@linaro.org>
---
 scripts/coverity-scan/COMPONENTS.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md
index 72995903ff..95805b536b 100644
--- a/scripts/coverity-scan/COMPONENTS.md
+++ b/scripts/coverity-scan/COMPONENTS.md
@@ -147,6 +147,9 @@ tcg
 system
   ~ .*/qemu(/system/.*|/accel/.*)
 
+plugins
+  ~ .*/qemu(/contrib|/tests/tcg)?/plugins/.*
+
 (headers)
   ~ .*/qemu(/include/.*)
 

From 7baa9c39fc3d525216f0cedcfda5374c26d50e80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 11 Aug 2025 11:31:08 +0200
Subject: [PATCH 0289/2396] hw/scsi/mptsas: Avoid silent integer truncation in
 MPI_FUNC_IOC_INIT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For the MaxDevices 8-bit field of the request / response structures
of the MPI_FUNCTION_IOC_INIT command, the 0x00 value means "max 256
devices". This is not a problem because when max_devices=256, its
value (0x100), being casted to a uint8_t, is truncated to 0x00.
However Coverity complains for an "Overflowed constant". Fix by
re-using the request fields in the response, since they are not
modified and use the same types.

Fix: Coverity 1547736 (Overflowed constant)
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20250811095550.93655-1-philmd@linaro.org>
---
 hw/scsi/mptsas.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/scsi/mptsas.c b/hw/scsi/mptsas.c
index 1ebe0b82a7..4ada35b7ec 100644
--- a/hw/scsi/mptsas.c
+++ b/hw/scsi/mptsas.c
@@ -579,11 +579,11 @@ static void mptsas_process_ioc_init(MPTSASState *s, MPIMsgIOCInit *req)
     }
 
     memset(&reply, 0, sizeof(reply));
-    reply.WhoInit    = s->who_init;
+    reply.WhoInit    = req->WhoInit;
     reply.MsgLength  = sizeof(reply) / 4;
     reply.Function   = req->Function;
-    reply.MaxDevices = s->max_devices;
-    reply.MaxBuses   = s->max_buses;
+    reply.MaxDevices = req->MaxDevices;
+    reply.MaxBuses   = req->MaxBuses;
     reply.MsgContext = req->MsgContext;
 
     mptsas_fix_ioc_init_reply_endianness(&reply);

From 831d75fd735dbd116703d3a1ca5e271dc930ebae Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 12 Aug 2025 15:36:05 +0200
Subject: [PATCH 0290/2396] hw/ssi: Document ssi_transfer() method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A SPI transaction consists of shifting bit in sync with the CLK
line, writing on the MOSI (output) line / and reading MISO (input)
line.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/hw/ssi/ssi.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/include/hw/ssi/ssi.h b/include/hw/ssi/ssi.h
index 3cdcbd5390..2ad8033d8f 100644
--- a/include/hw/ssi/ssi.h
+++ b/include/hw/ssi/ssi.h
@@ -38,6 +38,7 @@ struct SSIPeripheralClass {
 
     /* if you have standard or no CS behaviour, just override transfer.
      * This is called when the device cs is active (true by default).
+     * See ssi_transfer().
      */
     uint32_t (*transfer)(SSIPeripheral *dev, uint32_t val);
     /* called when the CS line changes. Optional, devices only need to implement
@@ -52,6 +53,7 @@ struct SSIPeripheralClass {
      * of the CS behaviour at the device level. transfer, set_cs, and
      * cs_polarity are unused if this is overwritten. Transfer_raw will
      * always be called for the device for every txrx access to the parent bus
+     * See ssi_transfer().
      */
     uint32_t (*transfer_raw)(SSIPeripheral *dev, uint32_t val);
 };
@@ -110,6 +112,18 @@ bool ssi_realize_and_unref(DeviceState *dev, SSIBus *bus, Error **errp);
 /* Master interface.  */
 SSIBus *ssi_create_bus(DeviceState *parent, const char *name);
 
+/**
+ * Transfer a word on a SSI bus
+ * @bus: SSI bus
+ * @val: word to transmit
+ *
+ * At the same time, read a word and write the @val one on the SSI bus.
+ *
+ * SSI words might vary between 8 and 32 bits. The same number of bits
+ * written is received.
+ *
+ * Return: word value received
+ */
 uint32_t ssi_transfer(SSIBus *bus, uint32_t val);
 
 DeviceState *ssi_get_cs(SSIBus *bus, uint8_t cs_index);

From 14ab44b96d5bf761af81cc723314ef5ecf73ed17 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 14 Aug 2025 08:40:38 +0200
Subject: [PATCH 0291/2396] elf: Add EF_MIPS_ARCH_ASE definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Include MIPS ASE ELF definitions from binutils:
https://sourceware.org/git/?p=binutils-gdb.git;a=blob;f=include/elf/mips.h;h=4fc190f404d828ded84e621bfcece5fa9f9c23c8;hb=HEAD#l210

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250814070650.78657-2-philmd@linaro.org>
---
 include/elf.h | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/include/elf.h b/include/elf.h
index e7259ec366..bbfac055de 100644
--- a/include/elf.h
+++ b/include/elf.h
@@ -56,6 +56,13 @@ typedef int64_t  Elf64_Sxword;
 #define EF_MIPS_ARCH_32R6     0x90000000      /* MIPS32r6 code.  */
 #define EF_MIPS_ARCH_64R6     0xa0000000      /* MIPS64r6 code.  */
 
+/* MIPS Architectural Extensions. */
+#define EF_MIPS_ARCH_ASE      0x0f000000
+
+#define EF_MIPS_ARCH_ASE_MICROMIPS 0x02000000
+#define EF_MIPS_ARCH_ASE_M16  0x04000000
+#define EF_MIPS_ARCH_ASE_MDMX 0x08000000
+
 /* The ABI of a file. */
 #define EF_MIPS_ABI_O32       0x00001000      /* O32 ABI.  */
 #define EF_MIPS_ABI_O64       0x00002000      /* O32 extended for 64 bit.  */

From 7a09b3cc70ab6d717b18dec5c5995f7a06af4593 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 14 Aug 2025 08:40:49 +0200
Subject: [PATCH 0292/2396] linux-user/mips: Select 74Kf CPU to run MIPS16e
 binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 74Kf is our latest CPU supporting MIPS16e ASE.

Note, currently QEMU doesn't have 64-bit CPU supporting MIPS16e ASE.

Cc: qemu-stable@nongnu.org
Fixes: 6ea219d0196..d19954f46df ("target-mips: MIPS16 support")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3054
Reported-by: Justin Applegate <justink.applegate@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250814070650.78657-3-philmd@linaro.org>
---
 linux-user/mips/elfload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index e0c50f50ed..6f1880befc 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -37,6 +37,9 @@ const char *get_elf_cpu_model(uint32_t eflags)
     if ((eflags & EF_MIPS_ARCH) == EF_MIPS_ARCH_32R6) {
         return "mips32r6-generic";
     }
+    if ((eflags & EF_MIPS_ARCH_ASE) == EF_MIPS_ARCH_ASE_M16) {
+        return "74Kf";
+    }
     if (eflags & EF_MIPS_NAN2008) {
         return "P5600";
     }

From 51c3aebfda6489b49cebef593a1ceb597cb97a7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 14 Aug 2025 08:41:26 +0200
Subject: [PATCH 0293/2396] linux-user/mips: Select M14Kc CPU to run microMIPS
 binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The M14Kc is our latest CPU supporting the microMIPS ASE.

Note, currently QEMU doesn't have 64-bit CPU supporting microMIPS ASE.

Cc: qemu-stable@nongnu.org
Fixes: 3c824109da0 ("target-mips: microMIPS ASE support")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3054
Reported-by: Justin Applegate <justink.applegate@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250814070650.78657-4-philmd@linaro.org>
---
 linux-user/mips/elfload.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/linux-user/mips/elfload.c b/linux-user/mips/elfload.c
index 6f1880befc..cc5bbf05ab 100644
--- a/linux-user/mips/elfload.c
+++ b/linux-user/mips/elfload.c
@@ -37,6 +37,9 @@ const char *get_elf_cpu_model(uint32_t eflags)
     if ((eflags & EF_MIPS_ARCH) == EF_MIPS_ARCH_32R6) {
         return "mips32r6-generic";
     }
+    if ((eflags & EF_MIPS_ARCH_ASE) == EF_MIPS_ARCH_ASE_MICROMIPS) {
+        return "M14Kc";
+    }
     if ((eflags & EF_MIPS_ARCH_ASE) == EF_MIPS_ARCH_ASE_M16) {
         return "74Kf";
     }

From 1f82ca723478f44823a18e7151e487d58da03659 Mon Sep 17 00:00:00 2001
From: Denis Rastyogin <gerben@altlinux.org>
Date: Thu, 14 Aug 2025 13:48:32 +0300
Subject: [PATCH 0294/2396] target/mips: fix TLB huge page check to use 64-bit
 shift
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use extract64(entry, psn, 1) instead of (entry & (1 << psn)) to avoid
undefined behavior for shifts by 32–63 and to make bit extraction intent explicit.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250814104914.13101-1-gerben@altlinux.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/mips/tcg/system/tlb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index eccaf3624c..1e8901556d 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -652,7 +652,7 @@ static int walk_directory(CPUMIPSState *env, uint64_t *vaddr,
         return 0;
     }
 
-    if ((entry & (1 << psn)) && hugepg) {
+    if (extract64(entry, psn, 1) && hugepg) {
         *huge_page = true;
         *hgpg_directory_hit = true;
         entry = get_tlb_entry_layout(env, entry, leaf_mop, pf_ptew);

From 46d03bb23dde86513465724760d85f42eb17539e Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Wed, 20 Aug 2025 17:55:17 +0530
Subject: [PATCH 0295/2396] hw/ppc: Fix build error with CONFIG_POWERNV
 disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently when CONFIG_POWERNV is not enabled, the build fails, such as
with --without-default-devices:

    $ ./configure --without-default-devices
    $ make

    [281/283] Linking target qemu-system-ppc64
    FAILED: qemu-system-ppc64
    cc -m64 @qemu-system-ppc64.rsp
    /usr/bin/ld: libqemu-ppc64-softmmu.a.p/target_ppc_misc_helper.c.o: in function `helper_load_sprd':
    .../target/ppc/misc_helper.c:335:(.text+0xcdc): undefined reference to `pnv_chip_find_core'
    /usr/bin/ld: libqemu-ppc64-softmmu.a.p/target_ppc_misc_helper.c.o: in function `helper_store_sprd':
    .../target/ppc/misc_helper.c:375:(.text+0xdf4): undefined reference to `pnv_chip_find_core'
    collect2: error: ld returned 1 exit status
    ...

This is since target/ppc/misc_helper.c references PowerNV specific
'pnv_chip_find_core' call.

Split the PowerNV specific SPRD code out of the generic PowerPC code, by
moving the SPRD code to pnv.c

Fixes: 9808ce6d5cb ("target/ppc: Big-core scratch register fix")
Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Reported-by: Thomas Huth <thuth@redhat.com>
Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Acked-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250820122516.949766-2-adityag@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/pnv.c             | 86 ++++++++++++++++++++++++++++++++++++++++
 target/ppc/cpu.h         |  4 ++
 target/ppc/misc_helper.c | 59 +++------------------------
 3 files changed, 96 insertions(+), 53 deletions(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index d84c9067ed..9c74f46091 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -21,6 +21,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/datadir.h"
+#include "qemu/log.h"
 #include "qemu/units.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
@@ -1794,12 +1795,83 @@ static void pnv_chip_power9_pec_realize(PnvChip *chip, Error **errp)
     }
 }
 
+static uint64_t pnv_handle_sprd_load(CPUPPCState *env)
+{
+    PowerPCCPU *cpu = env_archcpu(env);
+    PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
+    uint64_t sprc = env->spr[SPR_POWER_SPRC];
+
+    if (pc->big_core) {
+        pc = pnv_chip_find_core(pc->chip, CPU_CORE(pc)->core_id & ~0x1);
+    }
+
+    switch (sprc & 0x3e0) {
+    case 0: /* SCRATCH0-3 */
+    case 1: /* SCRATCH4-7 */
+        return pc->scratch[(sprc >> 3) & 0x7];
+
+    case 0x1e0: /* core thread state */
+        if (env->excp_model == POWERPC_EXCP_POWER9) {
+            /*
+             * Only implement for POWER9 because skiboot uses it to check
+             * big-core mode. Other bits are unimplemented so we would
+             * prefer to get unimplemented message on POWER10 if it were
+             * used anywhere.
+             */
+            if (pc->big_core) {
+                return PPC_BIT(63);
+            } else {
+                return 0;
+            }
+        }
+        /* fallthru */
+
+    default:
+        qemu_log_mask(LOG_UNIMP, "mfSPRD: Unimplemented SPRC:0x"
+                                  TARGET_FMT_lx"\n", sprc);
+        break;
+    }
+    return 0;
+}
+
+static void pnv_handle_sprd_store(CPUPPCState *env, uint64_t val)
+{
+    PowerPCCPU *cpu = env_archcpu(env);
+    uint64_t sprc = env->spr[SPR_POWER_SPRC];
+    PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
+    int nr;
+
+    if (pc->big_core) {
+        pc = pnv_chip_find_core(pc->chip, CPU_CORE(pc)->core_id & ~0x1);
+    }
+
+    switch (sprc & 0x3e0) {
+    case 0: /* SCRATCH0-3 */
+    case 1: /* SCRATCH4-7 */
+        /*
+         * Log stores to SCRATCH, because some firmware uses these for
+         * debugging and logging, but they would normally be read by the BMC,
+         * which is not implemented in QEMU yet. This gives a way to get at the
+         * information. Could also dump these upon checkstop.
+         */
+        nr = (sprc >> 3) & 0x7;
+        pc->scratch[nr] = val;
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "mtSPRD: Unimplemented SPRC:0x"
+                                  TARGET_FMT_lx"\n", sprc);
+        break;
+    }
+}
+
 static void pnv_chip_power9_realize(DeviceState *dev, Error **errp)
 {
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
     Pnv9Chip *chip9 = PNV9_CHIP(dev);
     PnvChip *chip = PNV_CHIP(dev);
     Pnv9Psi *psi9 = &chip9->psi;
+    PowerPCCPU *cpu;
+    PowerPCCPUClass *cpu_class;
     Error *local_err = NULL;
     int i;
 
@@ -1827,6 +1899,12 @@ static void pnv_chip_power9_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    /* Set handlers for Special registers, such as SPRD */
+    cpu = chip->cores[0]->threads[0];
+    cpu_class = POWERPC_CPU_GET_CLASS(cpu);
+    cpu_class->load_sprd = pnv_handle_sprd_load;
+    cpu_class->store_sprd = pnv_handle_sprd_store;
+
     /* XIVE interrupt controller (POWER9) */
     object_property_set_int(OBJECT(&chip9->xive), "ic-bar",
                             PNV9_XIVE_IC_BASE(chip), &error_fatal);
@@ -2078,6 +2156,8 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
     PnvChip *chip = PNV_CHIP(dev);
     Pnv10Chip *chip10 = PNV10_CHIP(dev);
+    PowerPCCPU *cpu;
+    PowerPCCPUClass *cpu_class;
     Error *local_err = NULL;
     int i;
 
@@ -2105,6 +2185,12 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    /* Set handlers for Special registers, such as SPRD */
+    cpu = chip->cores[0]->threads[0];
+    cpu_class = POWERPC_CPU_GET_CLASS(cpu);
+    cpu_class->load_sprd = pnv_handle_sprd_load;
+    cpu_class->store_sprd = pnv_handle_sprd_store;
+
     /* XIVE2 interrupt controller (POWER10) */
     object_property_set_int(OBJECT(&chip10->xive), "ic-bar",
                             PNV10_XIVE2_IC_BASE(chip), &error_fatal);
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 6b90543811..0e26e4343d 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1522,6 +1522,10 @@ struct PowerPCCPUClass {
     void (*init_proc)(CPUPPCState *env);
     int  (*check_pow)(CPUPPCState *env);
     int  (*check_attn)(CPUPPCState *env);
+
+    /* Handlers to be set by the machine initialising the chips */
+    uint64_t (*load_sprd)(CPUPPCState *env);
+    void (*store_sprd)(CPUPPCState *env, uint64_t val);
 };
 
 static inline bool ppc_cpu_core_single_threaded(CPUState *cs)
diff --git a/target/ppc/misc_helper.c b/target/ppc/misc_helper.c
index e7d9462518..0e625cbb70 100644
--- a/target/ppc/misc_helper.c
+++ b/target/ppc/misc_helper.c
@@ -328,69 +328,22 @@ target_ulong helper_load_sprd(CPUPPCState *env)
      * accessed by powernv machines.
      */
     PowerPCCPU *cpu = env_archcpu(env);
-    PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
-    target_ulong sprc = env->spr[SPR_POWER_SPRC];
+    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
 
-    if (pc->big_core) {
-        pc = pnv_chip_find_core(pc->chip, CPU_CORE(pc)->core_id & ~0x1);
+    if (pcc->load_sprd) {
+        return pcc->load_sprd(env);
     }
 
-    switch (sprc & 0x3e0) {
-    case 0: /* SCRATCH0-3 */
-    case 1: /* SCRATCH4-7 */
-        return pc->scratch[(sprc >> 3) & 0x7];
-
-    case 0x1e0: /* core thread state */
-        if (env->excp_model == POWERPC_EXCP_POWER9) {
-            /*
-             * Only implement for POWER9 because skiboot uses it to check
-             * big-core mode. Other bits are unimplemented so we would
-             * prefer to get unimplemented message on POWER10 if it were
-             * used anywhere.
-             */
-            if (pc->big_core) {
-                return PPC_BIT(63);
-            } else {
-                return 0;
-            }
-        }
-        /* fallthru */
-
-    default:
-        qemu_log_mask(LOG_UNIMP, "mfSPRD: Unimplemented SPRC:0x"
-                                  TARGET_FMT_lx"\n", sprc);
-        break;
-    }
     return 0;
 }
 
 void helper_store_sprd(CPUPPCState *env, target_ulong val)
 {
-    target_ulong sprc = env->spr[SPR_POWER_SPRC];
     PowerPCCPU *cpu = env_archcpu(env);
-    PnvCore *pc = pnv_cpu_state(cpu)->pnv_core;
-    int nr;
+    PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
 
-    if (pc->big_core) {
-        pc = pnv_chip_find_core(pc->chip, CPU_CORE(pc)->core_id & ~0x1);
-    }
-
-    switch (sprc & 0x3e0) {
-    case 0: /* SCRATCH0-3 */
-    case 1: /* SCRATCH4-7 */
-        /*
-         * Log stores to SCRATCH, because some firmware uses these for
-         * debugging and logging, but they would normally be read by the BMC,
-         * which is not implemented in QEMU yet. This gives a way to get at the
-         * information. Could also dump these upon checkstop.
-         */
-        nr = (sprc >> 3) & 0x7;
-        pc->scratch[nr] = val;
-        break;
-    default:
-        qemu_log_mask(LOG_UNIMP, "mtSPRD: Unimplemented SPRC:0x"
-                                  TARGET_FMT_lx"\n", sprc);
-        break;
+    if (pcc->store_sprd) {
+        return pcc->store_sprd(env, val);
     }
 }
 

From 01941107ebda4756e63a841ff5c457bc6a77c6ce Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:40:51 +0100
Subject: [PATCH 0296/2396] hw/irq: New qemu_init_irq_child() function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The qemu_init_irq() function initializes a TYPE_IRQ QOM object.  The
caller is therefore responsible for eventually calling
qemu_free_irq() to unref (and thus free) it.

In many places where we want to initialize an IRQ we are in
the init/realize of some other QOM object; if we have a variant
of this function that calls object_initialize_child() then the
IRQ will be automatically cleaned up when its parent object is
destroyed, and we don't need to remember to manually free it.

Implement qemu_init_irq_child(), which is to qemu_init_irq()
what object_initialize_child() is to object_initialize().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250821154053.2417090-2-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/irq.c    |  8 ++++++++
 include/hw/irq.h | 23 ++++++++++++++++++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/hw/core/irq.c b/hw/core/irq.c
index 6dd8d47bd6..0c768f7704 100644
--- a/hw/core/irq.c
+++ b/hw/core/irq.c
@@ -49,6 +49,14 @@ void qemu_init_irq(IRQState *irq, qemu_irq_handler handler, void *opaque,
     init_irq_fields(irq, handler, opaque, n);
 }
 
+void qemu_init_irq_child(Object *parent, const char *propname,
+                         IRQState *irq, qemu_irq_handler handler,
+                         void *opaque, int n)
+{
+    object_initialize_child(parent, propname, irq, TYPE_IRQ);
+    init_irq_fields(irq, handler, opaque, n);
+}
+
 void qemu_init_irqs(IRQState irq[], size_t count,
                     qemu_irq_handler handler, void *opaque)
 {
diff --git a/include/hw/irq.h b/include/hw/irq.h
index b3012237ac..291fdd67df 100644
--- a/include/hw/irq.h
+++ b/include/hw/irq.h
@@ -36,11 +36,32 @@ static inline void qemu_irq_pulse(qemu_irq irq)
 
 /*
  * Init a single IRQ. The irq is assigned with a handler, an opaque data
- * and the interrupt number.
+ * and the interrupt number. The caller must free this with qemu_free_irq().
+ * If you are using this inside a device's init or realize method, then
+ * qemu_init_irq_child() is probably a better choice to avoid the need
+ * to manually clean up the IRQ.
  */
 void qemu_init_irq(IRQState *irq, qemu_irq_handler handler, void *opaque,
                    int n);
 
+/**
+ * qemu_init_irq_child: Initialize IRQ and make it a QOM child
+ * @parent: QOM object which owns this IRQ
+ * @propname: child property name
+ * @irq: pointer to IRQState to initialize
+ * @handler: handler function for incoming interrupts
+ * @opaque: opaque data to pass to @handler
+ * @n: interrupt number to pass to @handler
+ *
+ * Init a single IRQ and make the IRQ object a child of @parent with
+ * the child-property name @propname. The IRQ object will thus be
+ * automatically freed when @parent is destroyed.
+ */
+void qemu_init_irq_child(Object *parent, const char *propname,
+                         IRQState *irq, qemu_irq_handler handler,
+                         void *opaque, int n);
+
+
 /**
  * qemu_init_irqs: Initialize an array of IRQs.
  *

From d1c9061b97d57d194e44023eb7e52fedde155e61 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:40:52 +0100
Subject: [PATCH 0297/2396] hw/char/serial-pci-multi: Use qemu_init_irq_child()
 to avoid leak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The serial-pci-multi device initializes an IRQ with qemu_init_irq()
in its instance_init function; however it never calls qemu_free_irq(),
so the init/deinit cycle has a memory leak, which ASAN catches
in the device-introspect-test:

Direct leak of 576 byte(s) in 6 object(s) allocated from:
    #0 0x626306ddade3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qem
u-system-arm+0x21f1de3) (BuildId: 52ece17287eba2d68e5be980e1856cd1f6be932f)
    #1 0x7756ade79b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1
eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x7756ade5b45a in g_hash_table_new_full (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4445a
) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #3 0x62630965da37 in object_initialize_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qem
u/build/arm-asan/../../qom/object.c:568:23
    #4 0x62630965d440 in object_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/ar
m-asan/../../qom/object.c:578:5
    #5 0x626309653eeb in qemu_init_irq /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-as
an/../../hw/core/irq.c:48:5
    #6 0x6263072370bb in multi_serial_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/char/serial-pci-multi.c:183:9

Use the new qemu_init_irq_child() function instead, so that the
IRQ object is automatically unreffed when the serial-pci
device is deinited.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250821154053.2417090-3-peter.maydell@linaro.org>
[PMD: Use "irq[*]" as child property name]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/char/serial-pci-multi.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/serial-pci-multi.c b/hw/char/serial-pci-multi.c
index 13df272691..34f30fb70b 100644
--- a/hw/char/serial-pci-multi.c
+++ b/hw/char/serial-pci-multi.c
@@ -180,7 +180,8 @@ static void multi_serial_init(Object *o)
     size_t i, nports = multi_serial_get_port_count(PCI_DEVICE_GET_CLASS(dev));
 
     for (i = 0; i < nports; i++) {
-        qemu_init_irq(&pms->irqs[i], multi_serial_irq_mux, pms, i);
+        qemu_init_irq_child(o, "irq[*]", &pms->irqs[i],
+                            multi_serial_irq_mux, pms, i);
         object_initialize_child(o, "serial[*]", &pms->state[i], TYPE_SERIAL);
     }
 }

From f905be62379aab0c5874756e1a73b33581d7011d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:40:53 +0100
Subject: [PATCH 0298/2396] hw/ide/ich.c: Use qemu_init_irq_child() to avoid
 memory leak
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ICH9 PCI device uses qemu_init_irq() in its instance_init method,
but fails to clean it up in its uninit. This results in a leak,
detected by ASAN when running the device-introspect-test:

Direct leak of 96 byte(s) in 1 object(s) allocated from:
    #0 0x58f3b53ecde3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qem
u-system-arm+0x21f1de3) (BuildId: 8dcd38b1d76bd7bd44f905c38200f4cceafd7ca4)
    #1 0x72e446dd5b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1
eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x72e446db745a in g_hash_table_new_full (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x4445a
) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #3 0x58f3b7c6fc67 in object_initialize_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qem
u/build/arm-asan/../../qom/object.c:568:23
    #4 0x58f3b7c6f670 in object_initialize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/ar
m-asan/../../qom/object.c:578:5
    #5 0x58f3b7c6611b in qemu_init_irq /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/irq.c:48:5
    #6 0x58f3b5c6e931 in pci_ich9_ahci_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/ide/ich.c:117:5

We could call qemu_free_irq() in pci_ich9_uninit(), but
since we have a method of initializing the IRQ that doesn't
need manual freeing, use that instead: qemu_init_irq_child().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250821154053.2417090-4-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/ich.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ide/ich.c b/hw/ide/ich.c
index 4cade0d121..b00987f08d 100644
--- a/hw/ide/ich.c
+++ b/hw/ide/ich.c
@@ -114,7 +114,8 @@ static void pci_ich9_ahci_init(Object *obj)
 {
     AHCIPCIState *d = ICH9_AHCI(obj);
 
-    qemu_init_irq(&d->irq, pci_ich9_ahci_update_irq, d, 0);
+    qemu_init_irq_child(obj, "update-irq", &d->irq,
+                        pci_ich9_ahci_update_irq, d, 0);
     ahci_init(&d->ahci, DEVICE(obj));
     d->ahci.irq = &d->irq;
 }

From 3284d1c07cfd8d42aa27d1cf83d3e65fcd62e35e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:44:59 +0100
Subject: [PATCH 0299/2396] hw/gpio/pca9554: Avoid leak in pca9554_set_pin()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In pca9554_set_pin() we have a string property which we parse in
order to set some non-string fields in the device state.  So we call
visit_type_str(), passing it the address of the local variable
state_str.

visit_type_str() will allocate a new copy of the string; we
never free this string, so the result is a memory leak, detected
by ASAN during a "make check" run:

Direct leak of 5 byte(s) in 1 object(s) allocated from:
    #0 0x5d605212ede3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-arm+0x21f1de3) (
BuildId: 3d5373c89317f58bfcd191a33988c7347714be14)
    #1 0x7f7edea57b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b68282
9a6913cf682d75)
    #2 0x7f7edea6d4d8 in g_strdup (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x784d8) (BuildId: 1eb6131419edb83b2178b68282
9a6913cf682d75)
    #3 0x5d6055289a91 in g_strdup_inline /usr/include/glib-2.0/glib/gstrfuncs.h:321:10
    #4 0x5d6055289a91 in qobject_input_type_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qapi/qo
bject-input-visitor.c:542:12
    #5 0x5d605528479c in visit_type_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qapi/qapi-visit
-core.c:349:10
    #6 0x5d60528bdd87 in pca9554_set_pin /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/gpio/pca9554.c:179:10
    #7 0x5d60549bcbbb in object_property_set /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1450:5
    #8 0x5d60549d2055 in object_property_set_qobject /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/qom-qobject.c:28:10
    #9 0x5d60549bcdf1 in object_property_set_str /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:1458:15
    #10 0x5d605439d077 in gb200nvl_bmc_i2c_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/arm/aspeed.c:1267:5
    #11 0x5d60543a3bbc in aspeed_machine_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/arm/aspeed.c:493:9

Make the state_str g_autofree, so that we will always free
it, on both error-exit and success codepaths.

Cc: qemu-stable@nongnu.org
Fixes: de0c7d543bca ("misc: Add a pca9554 GPIO device model")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250821154459.2417976-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/gpio/pca9554.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/gpio/pca9554.c b/hw/gpio/pca9554.c
index de3f883aee..eac0d23be3 100644
--- a/hw/gpio/pca9554.c
+++ b/hw/gpio/pca9554.c
@@ -174,7 +174,7 @@ static void pca9554_set_pin(Object *obj, Visitor *v, const char *name,
     PCA9554State *s = PCA9554(obj);
     int pin, rc, val;
     uint8_t state, mask;
-    char *state_str;
+    g_autofree char *state_str = NULL;
 
     if (!visit_type_str(v, name, &state_str, errp)) {
         return;

From ac6b124180f7698084ef2a59282e8fa65a45f23b Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 21 Aug 2025 16:43:58 +0100
Subject: [PATCH 0300/2396] hw/char/max78000_uart: Destroy FIFO on deinit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the max78000_uart we create a FIFO in the instance_init function,
but we don't destroy it on deinit, so ASAN reports a leak in the
device-introspect-test:

    #0 0x561cc92d5de3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-arm+0x21f1de3) (BuildId: 98fdf9fc85c3beaeca8eda0be8412f1e11b9c6ad)
    #1 0x70cbf2afab09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x561ccc4c884d in fifo8_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../util/fifo8.c:27:18
    #3 0x561cc9744ec9 in max78000_uart_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/char/max78000_uart.c:241:5

Add an instance_finalize method to destroy the FIFO.

Cc: qemu-stable@nongnu.org
Fixes: d447e4b70295 ("MAX78000: UART Implementation")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250821154358.2417744-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/char/max78000_uart.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/char/max78000_uart.c b/hw/char/max78000_uart.c
index 19506d52ef..c76c0e759b 100644
--- a/hw/char/max78000_uart.c
+++ b/hw/char/max78000_uart.c
@@ -247,6 +247,12 @@ static void max78000_uart_init(Object *obj)
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
 }
 
+static void max78000_uart_finalize(Object *obj)
+{
+    Max78000UartState *s = MAX78000_UART(obj);
+    fifo8_destroy(&s->rx_fifo);
+}
+
 static void max78000_uart_realize(DeviceState *dev, Error **errp)
 {
     Max78000UartState *s = MAX78000_UART(dev);
@@ -274,6 +280,7 @@ static const TypeInfo max78000_uart_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Max78000UartState),
     .instance_init = max78000_uart_init,
+    .instance_finalize = max78000_uart_finalize,
     .class_init    = max78000_uart_class_init,
 };
 

From 4dec497264c2e03b32fc82d6f24a694661b14d64 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 26 Aug 2025 18:49:55 +0100
Subject: [PATCH 0301/2396] hw/misc/xlnx-versal-cframe-reg: Free FIFO, g_tree
 on deinit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the xlnx-versal-cframe-reg device we create a FIFO in
instance_init but don't destroy it on deinit, causing ASAN
to report a leak in the device-introspect-test:

Direct leak of 400 byte(s) in 1 object(s) allocated from:
    #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c53fecd904ba5fc1f521d7da080a0e4103b)
    #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5aded850059d in fifo8_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../util/fifo8.c:27:18
    #3 0x5aded582b9e4 in fifo32_create /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/include/qemu/fifo32.h:35:5
    #4 0x5aded582b326 in cframe_reg_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/misc/xlnx-versal-cframe-reg.c:693:5

Similarly, we don't clean up the g_tree we create:
Direct leak of 48 byte(s) in 1 object(s) allocated from:
    #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c5
3fecd904ba5fc1f521d7da080a0e4103b)
    #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x71fbfaccc799 in g_tree_new_full (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x93799) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d7
5)
    #3 0x5aded582b21a in cframe_reg_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/misc/xlnx-versal-cframe-reg.c:691:18

Add an instance_finalize method to clean up what we
allocated in instance_init.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-ID: <20250826174956.3010274-2-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/misc/xlnx-versal-cframe-reg.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/misc/xlnx-versal-cframe-reg.c b/hw/misc/xlnx-versal-cframe-reg.c
index 1ce083e240..95e167b921 100644
--- a/hw/misc/xlnx-versal-cframe-reg.c
+++ b/hw/misc/xlnx-versal-cframe-reg.c
@@ -693,6 +693,14 @@ static void cframe_reg_init(Object *obj)
     fifo32_create(&s->new_f_data, FRAME_NUM_WORDS);
 }
 
+static void cframe_reg_finalize(Object *obj)
+{
+    XlnxVersalCFrameReg *s = XLNX_VERSAL_CFRAME_REG(obj);
+
+    fifo32_destroy(&s->new_f_data);
+    g_tree_destroy(s->cframes);
+}
+
 static const VMStateDescription vmstate_cframe = {
     .name = "cframe",
     .version_id = 1,
@@ -833,6 +841,7 @@ static const TypeInfo cframe_reg_info = {
     .instance_size = sizeof(XlnxVersalCFrameReg),
     .class_init    = cframe_reg_class_init,
     .instance_init = cframe_reg_init,
+    .instance_finalize = cframe_reg_finalize,
     .interfaces = (const InterfaceInfo[]) {
         { TYPE_XLNX_CFI_IF },
         { }

From 6592f710e4e1890a8a71e157266060bceacef6dd Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 26 Aug 2025 18:49:56 +0100
Subject: [PATCH 0302/2396] hw/display/xlnx_dp: Don't leak dpcd and edid
 objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the xnlx_dp_init() function we create the s->dpcd and
s->edid objects with qdev_new(); then in xlnx_dp_realize()
we realize the dpcd with qdev_realize() and the edid with
qdev_realize_and_unref().

This is inconsistent, and both ways result in a memory
leak for the instance_init -> deinit lifecycle tested
by device-introspect-test:

Indirect leak of 1968 byte(s) in 1 object(s) allocated from:
    #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c5
3fecd904ba5fc1f521d7da080a0e4103b)
    #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5aded7b9211c in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:767:15
    #3 0x5aded7b92240 in object_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:789:12
    #4 0x5aded7b773e4 in qdev_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/qdev.c:149:19
    #5 0x5aded54458be in xlnx_dp_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/display/xlnx_dp.c:1272:20

Direct leak of 344 byte(s) in 1 object(s) allocated from:
    #0 0x5aded4d54e23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x24ffe23) (BuildId: 9f1e6c53fecd904ba5fc1f521d7da080a0e4103b)
    #1 0x71fbfac9bb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5aded7b9211c in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:767:15
    #3 0x5aded7b92240 in object_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:789:12
    #4 0x5aded7b773e4 in qdev_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/core/qdev.c:149:19
    #5 0x5aded5445a56 in xlnx_dp_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/display/xlnx_dp.c:1275:22

Instead, explicitly object_unref() after we have added the objects as
child properties of the device.  This means they will automatically
be freed when this device is deinited.  When we do this,
qdev_realize() is the correct way to realize them in
xlnx_dp_realize().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-ID: <20250826174956.3010274-3-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/display/xlnx_dp.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 7c980ee642..ef73e1815f 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1267,14 +1267,18 @@ static void xlnx_dp_init(Object *obj)
     s->aux_bus = aux_bus_init(DEVICE(obj), "aux");
 
     /*
-     * Initialize DPCD and EDID..
+     * Initialize DPCD and EDID. Once we have added the objects as
+     * child properties of this device, we can drop the reference we
+     * hold to them, leaving the child-property as the only reference.
      */
     s->dpcd = DPCD(qdev_new("dpcd"));
     object_property_add_child(OBJECT(s), "dpcd", OBJECT(s->dpcd));
+    object_unref(s->dpcd);
 
     s->edid = I2CDDC(qdev_new("i2c-ddc"));
     i2c_slave_set_address(I2C_SLAVE(s->edid), 0x50);
     object_property_add_child(OBJECT(s), "edid", OBJECT(s->edid));
+    object_unref(s->edid);
 
     fifo8_create(&s->rx_fifo, 16);
     fifo8_create(&s->tx_fifo, 16);
@@ -1311,8 +1315,8 @@ static void xlnx_dp_realize(DeviceState *dev, Error **errp)
     qdev_realize(DEVICE(s->dpcd), BUS(s->aux_bus), &error_fatal);
     aux_map_slave(AUX_SLAVE(s->dpcd), 0x0000);
 
-    qdev_realize_and_unref(DEVICE(s->edid), BUS(aux_get_i2c_bus(s->aux_bus)),
-                           &error_fatal);
+    qdev_realize(DEVICE(s->edid), BUS(aux_get_i2c_bus(s->aux_bus)),
+                 &error_fatal);
 
     s->console = graphic_console_init(dev, 0, &xlnx_dp_gfx_ops, s);
     surface = qemu_console_surface(s->console);

From acba1ebcad9a0dd8c08495edaf5b8ce6a748bb01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 28 Aug 2025 16:24:16 +0200
Subject: [PATCH 0303/2396] hw/mips: Remove mipssim machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "mipssim" machine is deprecated since commit facfc943cb9
("hw/mips: Mark the "mipssim" machine as deprecated"), released
in v10.0; time to remove.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Message-Id: <20250828143800.49842-2-philmd@linaro.org>
---
 MAINTAINERS                             |   1 -
 configs/devices/mips-softmmu/common.mak |   1 -
 docs/about/deprecated.rst               |  12 --
 docs/about/removed-features.rst         |   5 +
 docs/system/target-mips.rst             |  11 --
 hw/mips/Kconfig                         |   7 -
 hw/mips/meson.build                     |   1 -
 hw/mips/mipssim.c                       | 249 ------------------------
 8 files changed, 5 insertions(+), 282 deletions(-)
 delete mode 100644 hw/mips/mipssim.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 040ef06494..3d3bbc0026 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1414,7 +1414,6 @@ F: tests/functional/mips*/test_tuxrun.py
 Mipssim
 R: Aleksandar Rikalo <arikalo@gmail.com>
 S: Orphan
-F: hw/mips/mipssim.c
 F: hw/net/mipsnet.c
 
 Fuloong 2E
diff --git a/configs/devices/mips-softmmu/common.mak b/configs/devices/mips-softmmu/common.mak
index b50107feaf..cdeae7ce45 100644
--- a/configs/devices/mips-softmmu/common.mak
+++ b/configs/devices/mips-softmmu/common.mak
@@ -6,4 +6,3 @@
 
 # Boards are selected by default, uncomment to keep out of the build.
 # CONFIG_MALTA=n
-# CONFIG_MIPSSIM=n
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 6ae6920681..b2420732e1 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -313,18 +313,6 @@ and serves as the initial engineering sample rather than a production version.
 A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should
 replace the older A0 version.
 
-Mips ``mipssim`` machine (since 10.0)
-'''''''''''''''''''''''''''''''''''''
-
-Linux dropped support for this virtual machine type in kernel v3.7, and
-there does not seem to be anybody around who is still using this board
-in QEMU: Most former MIPS-related people are working on other architectures
-in their everyday job nowadays, and we are also not aware of anybody still
-using old binaries with this board (i.e. there is also no binary available
-online to check that this board did not completely bitrot yet). It is
-recommended to use another MIPS machine for future MIPS code development
-instead.
-
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 332d07e2b1..dc3d4eaa2d 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1107,6 +1107,11 @@ were added for little endian CPUs. Big endian support was never tested
 and likely never worked. Starting with QEMU v10.1, the machines are now
 only available as little-endian machines.
 
+Mips ``mipssim`` machine (removed in 10.2)
+''''''''''''''''''''''''''''''''''''''''''
+
+Linux dropped support for this virtual machine type in kernel v3.7, and
+there was also no binary available online to use with that board.
 
 linux-user mode CPUs
 --------------------
diff --git a/docs/system/target-mips.rst b/docs/system/target-mips.rst
index 9028c3b304..2a152e1338 100644
--- a/docs/system/target-mips.rst
+++ b/docs/system/target-mips.rst
@@ -12,8 +12,6 @@ machine types are emulated:
 
 -  An ACER Pica \"pica61\". This machine needs the 64-bit emulator.
 
--  MIPS emulator pseudo board \"mipssim\"
-
 -  A MIPS Magnum R4000 machine \"magnum\". This machine needs the
    64-bit emulator.
 
@@ -80,15 +78,6 @@ The Loongson-3 virtual platform emulation supports:
 
 -  Both KVM and TCG supported
 
-The mipssim pseudo board emulation provides an environment similar to
-what the proprietary MIPS emulator uses for running Linux. It supports:
-
--  A range of MIPS CPUs, default is the 24Kf
-
--  PC style serial port
-
--  MIPSnet network emulation
-
 .. include:: cpu-models-mips.rst.inc
 
 .. _nanoMIPS-System-emulator:
diff --git a/hw/mips/Kconfig b/hw/mips/Kconfig
index f84fffcd32..b59cb2f111 100644
--- a/hw/mips/Kconfig
+++ b/hw/mips/Kconfig
@@ -13,13 +13,6 @@ config MALTA
     select SERIAL_MM
     select SMBUS_EEPROM
 
-config MIPSSIM
-    bool
-    default y
-    depends on MIPS
-    select SERIAL_MM
-    select MIPSNET
-
 config JAZZ
     bool
     default y
diff --git a/hw/mips/meson.build b/hw/mips/meson.build
index 31dbd2bf4d..390f0fd7f9 100644
--- a/hw/mips/meson.build
+++ b/hw/mips/meson.build
@@ -8,7 +8,6 @@ mips_ss.add(when: 'CONFIG_MIPS_CPS', if_true: files('cps.c'))
 
 if 'CONFIG_TCG' in config_all_accel
 mips_ss.add(when: 'CONFIG_JAZZ', if_true: files('jazz.c'))
-mips_ss.add(when: 'CONFIG_MIPSSIM', if_true: files('mipssim.c'))
 mips_ss.add(when: 'CONFIG_FULOONG', if_true: files('fuloong2e.c'))
 mips_ss.add(when: 'CONFIG_MIPS_BOSTON', if_true: files('boston.c'))
 endif
diff --git a/hw/mips/mipssim.c b/hw/mips/mipssim.c
deleted file mode 100644
index e843307b9b..0000000000
--- a/hw/mips/mipssim.c
+++ /dev/null
@@ -1,249 +0,0 @@
-/*
- * QEMU/mipssim emulation
- *
- * Emulates a very simple machine model similar to the one used by the
- * proprietary MIPS emulator.
- *
- * Copyright (c) 2007 Thiemo Seufer
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "qemu/datadir.h"
-#include "system/address-spaces.h"
-#include "hw/clock.h"
-#include "hw/mips/mips.h"
-#include "hw/char/serial-mm.h"
-#include "net/net.h"
-#include "system/system.h"
-#include "hw/boards.h"
-#include "hw/loader.h"
-#include "elf.h"
-#include "hw/sysbus.h"
-#include "hw/qdev-properties.h"
-#include "qemu/error-report.h"
-#include "system/qtest.h"
-#include "system/reset.h"
-#include "cpu.h"
-
-#define BIOS_SIZE (4 * MiB)
-
-static struct _loaderparams {
-    int ram_size;
-    const char *kernel_filename;
-    const char *kernel_cmdline;
-    const char *initrd_filename;
-} loaderparams;
-
-typedef struct ResetData {
-    MIPSCPU *cpu;
-    uint64_t vector;
-} ResetData;
-
-static uint64_t load_kernel(void)
-{
-    uint64_t entry, kernel_high, initrd_size;
-    long kernel_size;
-    ram_addr_t initrd_offset;
-
-    kernel_size = load_elf(loaderparams.kernel_filename, NULL,
-                           cpu_mips_kseg0_to_phys, NULL,
-                           &entry, NULL,
-                           &kernel_high, NULL,
-                           TARGET_BIG_ENDIAN ? ELFDATA2MSB : ELFDATA2LSB,
-                           EM_MIPS, 1, 0);
-    if (kernel_size < 0) {
-        error_report("could not load kernel '%s': %s",
-                     loaderparams.kernel_filename,
-                     load_elf_strerror(kernel_size));
-        exit(1);
-    }
-
-    /* load initrd */
-    initrd_size = 0;
-    initrd_offset = 0;
-    if (loaderparams.initrd_filename) {
-        initrd_size = get_image_size(loaderparams.initrd_filename);
-        if (initrd_size > 0) {
-            initrd_offset = ROUND_UP(kernel_high, INITRD_PAGE_SIZE);
-            if (initrd_offset + initrd_size > loaderparams.ram_size) {
-                error_report("memory too small for initial ram disk '%s'",
-                             loaderparams.initrd_filename);
-                exit(1);
-            }
-            initrd_size = load_image_targphys(loaderparams.initrd_filename,
-                initrd_offset, loaderparams.ram_size - initrd_offset);
-        }
-        if (initrd_size == (target_ulong) -1) {
-            error_report("could not load initial ram disk '%s'",
-                         loaderparams.initrd_filename);
-            exit(1);
-        }
-    }
-    return entry;
-}
-
-static void main_cpu_reset(void *opaque)
-{
-    ResetData *s = (ResetData *)opaque;
-    CPUMIPSState *env = &s->cpu->env;
-
-    cpu_reset(CPU(s->cpu));
-    env->active_tc.PC = s->vector & ~(target_ulong)1;
-    if (s->vector & 1) {
-        env->hflags |= MIPS_HFLAG_M16;
-    }
-}
-
-static void mipsnet_init(int base, qemu_irq irq)
-{
-    DeviceState *dev;
-    SysBusDevice *s;
-
-    dev = qemu_create_nic_device("mipsnet", true, NULL);
-    if (!dev) {
-        return;
-    }
-
-    s = SYS_BUS_DEVICE(dev);
-    sysbus_realize_and_unref(s, &error_fatal);
-    sysbus_connect_irq(s, 0, irq);
-    memory_region_add_subregion(get_system_io(),
-                                base,
-                                sysbus_mmio_get_region(s, 0));
-}
-
-static void
-mips_mipssim_init(MachineState *machine)
-{
-    const char *kernel_filename = machine->kernel_filename;
-    const char *kernel_cmdline = machine->kernel_cmdline;
-    const char *initrd_filename = machine->initrd_filename;
-    const char *bios_name = TARGET_BIG_ENDIAN ? "mips_bios.bin"
-                                              : "mipsel_bios.bin";
-    char *filename;
-    MemoryRegion *address_space_mem = get_system_memory();
-    MemoryRegion *isa = g_new(MemoryRegion, 1);
-    MemoryRegion *bios = g_new(MemoryRegion, 1);
-    Clock *cpuclk;
-    MIPSCPU *cpu;
-    CPUMIPSState *env;
-    ResetData *reset_info;
-    int bios_size;
-
-    cpuclk = clock_new(OBJECT(machine), "cpu-refclk");
-#ifdef TARGET_MIPS64
-    clock_set_hz(cpuclk, 6000000); /* 6 MHz */
-#else
-    clock_set_hz(cpuclk, 12000000); /* 12 MHz */
-#endif
-
-    /* Init CPUs. */
-    cpu = mips_cpu_create_with_clock(machine->cpu_type, cpuclk,
-                                     TARGET_BIG_ENDIAN);
-    env = &cpu->env;
-
-    reset_info = g_new0(ResetData, 1);
-    reset_info->cpu = cpu;
-    reset_info->vector = env->active_tc.PC;
-    qemu_register_reset(main_cpu_reset, reset_info);
-
-    /* Allocate RAM. */
-    memory_region_init_rom(bios, NULL, "mips_mipssim.bios", BIOS_SIZE,
-                           &error_fatal);
-
-    memory_region_add_subregion(address_space_mem, 0, machine->ram);
-
-    /* Map the BIOS / boot exception handler. */
-    memory_region_add_subregion(address_space_mem, 0x1fc00000LL, bios);
-    /* Load a BIOS / boot exception handler image. */
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS,
-                              machine->firmware ?: bios_name);
-    if (filename) {
-        bios_size = load_image_targphys(filename, 0x1fc00000LL, BIOS_SIZE);
-        g_free(filename);
-    } else {
-        bios_size = -1;
-    }
-    if ((bios_size < 0 || bios_size > BIOS_SIZE) &&
-        machine->firmware && !qtest_enabled()) {
-        /* Bail out if we have neither a kernel image nor boot vector code. */
-        error_report("Could not load MIPS bios '%s'", machine->firmware);
-        exit(1);
-    } else {
-        /* We have a boot vector start address. */
-        env->active_tc.PC = (target_long)(int32_t)0xbfc00000;
-    }
-
-    if (kernel_filename) {
-        loaderparams.ram_size = machine->ram_size;
-        loaderparams.kernel_filename = kernel_filename;
-        loaderparams.kernel_cmdline = kernel_cmdline;
-        loaderparams.initrd_filename = initrd_filename;
-        reset_info->vector = load_kernel();
-    }
-
-    /* Init CPU internal devices. */
-    cpu_mips_irq_init_cpu(cpu);
-    cpu_mips_clock_init(cpu);
-
-    /*
-     * Register 64 KB of ISA IO space at 0x1fd00000.  But without interrupts
-     * (except for the hardcoded serial port interrupt) -device cannot work,
-     * so do not expose the ISA bus to the user.
-     */
-    memory_region_init_alias(isa, NULL, "isa_mmio",
-                             get_system_io(), 0, 0x00010000);
-    memory_region_add_subregion(get_system_memory(), 0x1fd00000, isa);
-
-    /*
-     * A single 16450 sits at offset 0x3f8. It is attached to
-     * MIPS CPU INT2, which is interrupt 4.
-     */
-    if (serial_hd(0)) {
-        DeviceState *dev = qdev_new(TYPE_SERIAL_MM);
-
-        qdev_prop_set_chr(dev, "chardev", serial_hd(0));
-        qdev_prop_set_uint8(dev, "regshift", 0);
-        qdev_prop_set_uint8(dev, "endianness", DEVICE_LITTLE_ENDIAN);
-        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, env->irq[4]);
-        memory_region_add_subregion(get_system_io(), 0x3f8,
-                      sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
-    }
-
-    /* MIPSnet uses the MIPS CPU INT0, which is interrupt 2. */
-    mipsnet_init(0x4200, env->irq[2]);
-}
-
-static void mips_mipssim_machine_init(MachineClass *mc)
-{
-    mc->desc = "MIPS MIPSsim platform";
-    mc->init = mips_mipssim_init;
-#ifdef TARGET_MIPS64
-    mc->default_cpu_type = MIPS_CPU_TYPE_NAME("5Kf");
-#else
-    mc->default_cpu_type = MIPS_CPU_TYPE_NAME("24Kf");
-#endif
-    mc->default_ram_id = "mips_mipssim.ram";
-}
-
-DEFINE_MACHINE("mipssim", mips_mipssim_machine_init)

From 60c8ee1a6d6ad89dd55f3066062dc788f4a419dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 28 Aug 2025 16:25:56 +0200
Subject: [PATCH 0304/2396] hw/net: Remove mipsnet device model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The mipsnet device model was only used by the mipssim machine,
which just got removed. Remove as now dead code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Jiaxun Yang <jiaxun.yang@flygoat.com>
Message-Id: <20250828143800.49842-3-philmd@linaro.org>
---
 MAINTAINERS         |   5 -
 hw/net/Kconfig      |   3 -
 hw/net/meson.build  |   1 -
 hw/net/mipsnet.c    | 297 --------------------------------------------
 hw/net/trace-events |   7 --
 5 files changed, 313 deletions(-)
 delete mode 100644 hw/net/mipsnet.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 3d3bbc0026..1ae28e8804 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1411,11 +1411,6 @@ F: include/hw/southbridge/piix.h
 F: tests/functional/mips*/test_malta.py
 F: tests/functional/mips*/test_tuxrun.py
 
-Mipssim
-R: Aleksandar Rikalo <arikalo@gmail.com>
-S: Orphan
-F: hw/net/mipsnet.c
-
 Fuloong 2E
 M: Huacai Chen <chenhuacai@kernel.org>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index 7f80218d10..2b513d6895 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -82,9 +82,6 @@ config OPENCORES_ETH
 config XGMAC
     bool
 
-config MIPSNET
-    bool
-
 config ALLWINNER_EMAC
     bool
 
diff --git a/hw/net/meson.build b/hw/net/meson.build
index e6759e26ca..913eaedbc5 100644
--- a/hw/net/meson.build
+++ b/hw/net/meson.build
@@ -23,7 +23,6 @@ system_ss.add(when: 'CONFIG_LAN9118_PHY', if_true: files('lan9118_phy.c'))
 system_ss.add(when: 'CONFIG_NE2000_ISA', if_true: files('ne2000-isa.c'))
 system_ss.add(when: 'CONFIG_OPENCORES_ETH', if_true: files('opencores_eth.c'))
 system_ss.add(when: 'CONFIG_XGMAC', if_true: files('xgmac.c'))
-system_ss.add(when: 'CONFIG_MIPSNET', if_true: files('mipsnet.c'))
 system_ss.add(when: 'CONFIG_XILINX_AXI', if_true: files('xilinx_axienet.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_EMAC', if_true: files('allwinner_emac.c'))
 system_ss.add(when: 'CONFIG_ALLWINNER_SUN8I_EMAC', if_true: files('allwinner-sun8i-emac.c'))
diff --git a/hw/net/mipsnet.c b/hw/net/mipsnet.c
deleted file mode 100644
index 583aa1c7de..0000000000
--- a/hw/net/mipsnet.c
+++ /dev/null
@@ -1,297 +0,0 @@
-#include "qemu/osdep.h"
-#include "hw/irq.h"
-#include "hw/qdev-properties.h"
-#include "net/net.h"
-#include "qemu/module.h"
-#include "trace.h"
-#include "hw/sysbus.h"
-#include "migration/vmstate.h"
-#include "qom/object.h"
-
-/* MIPSnet register offsets */
-
-#define MIPSNET_DEV_ID          0x00
-#define MIPSNET_BUSY            0x08
-#define MIPSNET_RX_DATA_COUNT   0x0c
-#define MIPSNET_TX_DATA_COUNT   0x10
-#define MIPSNET_INT_CTL         0x14
-# define MIPSNET_INTCTL_TXDONE          0x00000001
-# define MIPSNET_INTCTL_RXDONE          0x00000002
-# define MIPSNET_INTCTL_TESTBIT         0x80000000
-#define MIPSNET_INTERRUPT_INFO  0x18
-#define MIPSNET_RX_DATA_BUFFER  0x1c
-#define MIPSNET_TX_DATA_BUFFER  0x20
-
-#define MAX_ETH_FRAME_SIZE      1514
-
-#define TYPE_MIPS_NET "mipsnet"
-OBJECT_DECLARE_SIMPLE_TYPE(MIPSnetState, MIPS_NET)
-
-struct MIPSnetState {
-    SysBusDevice parent_obj;
-
-    uint32_t busy;
-    uint32_t rx_count;
-    uint32_t rx_read;
-    uint32_t tx_count;
-    uint32_t tx_written;
-    uint32_t intctl;
-    uint8_t rx_buffer[MAX_ETH_FRAME_SIZE];
-    uint8_t tx_buffer[MAX_ETH_FRAME_SIZE];
-    MemoryRegion io;
-    qemu_irq irq;
-    NICState *nic;
-    NICConf conf;
-};
-
-static void mipsnet_reset(MIPSnetState *s)
-{
-    s->busy = 1;
-    s->rx_count = 0;
-    s->rx_read = 0;
-    s->tx_count = 0;
-    s->tx_written = 0;
-    s->intctl = 0;
-    memset(s->rx_buffer, 0, MAX_ETH_FRAME_SIZE);
-    memset(s->tx_buffer, 0, MAX_ETH_FRAME_SIZE);
-}
-
-static void mipsnet_update_irq(MIPSnetState *s)
-{
-    int isr = !!s->intctl;
-    trace_mipsnet_irq(isr, s->intctl);
-    qemu_set_irq(s->irq, isr);
-}
-
-static int mipsnet_buffer_full(MIPSnetState *s)
-{
-    if (s->rx_count >= MAX_ETH_FRAME_SIZE) {
-        return 1;
-    }
-    return 0;
-}
-
-static int mipsnet_can_receive(NetClientState *nc)
-{
-    MIPSnetState *s = qemu_get_nic_opaque(nc);
-
-    if (s->busy) {
-        return 0;
-    }
-    return !mipsnet_buffer_full(s);
-}
-
-static ssize_t mipsnet_receive(NetClientState *nc,
-                               const uint8_t *buf, size_t size)
-{
-    MIPSnetState *s = qemu_get_nic_opaque(nc);
-
-    trace_mipsnet_receive(size);
-    if (!mipsnet_can_receive(nc)) {
-        return 0;
-    }
-
-    if (size >= sizeof(s->rx_buffer)) {
-        return 0;
-    }
-    s->busy = 1;
-
-    /* Just accept everything. */
-
-    /* Write packet data. */
-    memcpy(s->rx_buffer, buf, size);
-
-    s->rx_count = size;
-    s->rx_read = 0;
-
-    /* Now we can signal we have received something. */
-    s->intctl |= MIPSNET_INTCTL_RXDONE;
-    mipsnet_update_irq(s);
-
-    return size;
-}
-
-static uint64_t mipsnet_ioport_read(void *opaque, hwaddr addr,
-                                    unsigned int size)
-{
-    MIPSnetState *s = opaque;
-    int ret = 0;
-
-    addr &= 0x3f;
-    switch (addr) {
-    case MIPSNET_DEV_ID:
-        ret = be32_to_cpu(0x4d495053);          /* MIPS */
-        break;
-    case MIPSNET_DEV_ID + 4:
-        ret = be32_to_cpu(0x4e455430);          /* NET0 */
-        break;
-    case MIPSNET_BUSY:
-        ret = s->busy;
-        break;
-    case MIPSNET_RX_DATA_COUNT:
-        ret = s->rx_count;
-        break;
-    case MIPSNET_TX_DATA_COUNT:
-        ret = s->tx_count;
-        break;
-    case MIPSNET_INT_CTL:
-        ret = s->intctl;
-        s->intctl &= ~MIPSNET_INTCTL_TESTBIT;
-        break;
-    case MIPSNET_INTERRUPT_INFO:
-        /* XXX: This seems to be a per-VPE interrupt number. */
-        ret = 0;
-        break;
-    case MIPSNET_RX_DATA_BUFFER:
-        if (s->rx_count) {
-            s->rx_count--;
-            ret = s->rx_buffer[s->rx_read++];
-            if (mipsnet_can_receive(s->nic->ncs)) {
-                qemu_flush_queued_packets(qemu_get_queue(s->nic));
-            }
-        }
-        break;
-    /* Reads as zero. */
-    case MIPSNET_TX_DATA_BUFFER:
-    default:
-        break;
-    }
-    trace_mipsnet_read(addr, ret);
-    return ret;
-}
-
-static void mipsnet_ioport_write(void *opaque, hwaddr addr,
-                                 uint64_t val, unsigned int size)
-{
-    MIPSnetState *s = opaque;
-
-    addr &= 0x3f;
-    trace_mipsnet_write(addr, val);
-    switch (addr) {
-    case MIPSNET_TX_DATA_COUNT:
-        s->tx_count = (val <= MAX_ETH_FRAME_SIZE) ? val : 0;
-        s->tx_written = 0;
-        break;
-    case MIPSNET_INT_CTL:
-        if (val & MIPSNET_INTCTL_TXDONE) {
-            s->intctl &= ~MIPSNET_INTCTL_TXDONE;
-        } else if (val & MIPSNET_INTCTL_RXDONE) {
-            s->intctl &= ~MIPSNET_INTCTL_RXDONE;
-        } else if (val & MIPSNET_INTCTL_TESTBIT) {
-            mipsnet_reset(s);
-            s->intctl |= MIPSNET_INTCTL_TESTBIT;
-        } else if (!val) {
-            /* ACK testbit interrupt, flag was cleared on read. */
-        }
-        s->busy = !!s->intctl;
-        mipsnet_update_irq(s);
-        if (mipsnet_can_receive(s->nic->ncs)) {
-            qemu_flush_queued_packets(qemu_get_queue(s->nic));
-        }
-        break;
-    case MIPSNET_TX_DATA_BUFFER:
-        s->tx_buffer[s->tx_written++] = val;
-        if ((s->tx_written >= MAX_ETH_FRAME_SIZE)
-            || (s->tx_written == s->tx_count)) {
-            /* Send buffer. */
-            trace_mipsnet_send(s->tx_written);
-            qemu_send_packet(qemu_get_queue(s->nic),
-                                s->tx_buffer, s->tx_written);
-            s->tx_count = s->tx_written = 0;
-            s->intctl |= MIPSNET_INTCTL_TXDONE;
-            s->busy = 1;
-            mipsnet_update_irq(s);
-        }
-        break;
-    /* Read-only registers */
-    case MIPSNET_DEV_ID:
-    case MIPSNET_BUSY:
-    case MIPSNET_RX_DATA_COUNT:
-    case MIPSNET_INTERRUPT_INFO:
-    case MIPSNET_RX_DATA_BUFFER:
-    default:
-        break;
-    }
-}
-
-static const VMStateDescription vmstate_mipsnet = {
-    .name = "mipsnet",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .fields = (const VMStateField[]) {
-        VMSTATE_UINT32(busy, MIPSnetState),
-        VMSTATE_UINT32(rx_count, MIPSnetState),
-        VMSTATE_UINT32(rx_read, MIPSnetState),
-        VMSTATE_UINT32(tx_count, MIPSnetState),
-        VMSTATE_UINT32(tx_written, MIPSnetState),
-        VMSTATE_UINT32(intctl, MIPSnetState),
-        VMSTATE_BUFFER(rx_buffer, MIPSnetState),
-        VMSTATE_BUFFER(tx_buffer, MIPSnetState),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
-static NetClientInfo net_mipsnet_info = {
-    .type = NET_CLIENT_DRIVER_NIC,
-    .size = sizeof(NICState),
-    .receive = mipsnet_receive,
-};
-
-static const MemoryRegionOps mipsnet_ioport_ops = {
-    .read = mipsnet_ioport_read,
-    .write = mipsnet_ioport_write,
-    .impl.min_access_size = 1,
-    .impl.max_access_size = 4,
-};
-
-static void mipsnet_realize(DeviceState *dev, Error **errp)
-{
-    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-    MIPSnetState *s = MIPS_NET(dev);
-
-    memory_region_init_io(&s->io, OBJECT(dev), &mipsnet_ioport_ops, s,
-                          "mipsnet-io", 36);
-    sysbus_init_mmio(sbd, &s->io);
-    sysbus_init_irq(sbd, &s->irq);
-
-    s->nic = qemu_new_nic(&net_mipsnet_info, &s->conf,
-                          object_get_typename(OBJECT(dev)), dev->id,
-                          &dev->mem_reentrancy_guard, s);
-    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
-}
-
-static void mipsnet_sysbus_reset(DeviceState *dev)
-{
-    MIPSnetState *s = MIPS_NET(dev);
-    mipsnet_reset(s);
-}
-
-static const Property mipsnet_properties[] = {
-    DEFINE_NIC_PROPERTIES(MIPSnetState, conf),
-};
-
-static void mipsnet_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = mipsnet_realize;
-    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
-    dc->desc = "MIPS Simulator network device";
-    device_class_set_legacy_reset(dc, mipsnet_sysbus_reset);
-    dc->vmsd = &vmstate_mipsnet;
-    device_class_set_props(dc, mipsnet_properties);
-}
-
-static const TypeInfo mipsnet_info = {
-    .name          = TYPE_MIPS_NET,
-    .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(MIPSnetState),
-    .class_init    = mipsnet_class_init,
-};
-
-static void mipsnet_register_types(void)
-{
-    type_register_static(&mipsnet_info);
-}
-
-type_init(mipsnet_register_types)
diff --git a/hw/net/trace-events b/hw/net/trace-events
index 72b69c4a8b..e82d7490c3 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -20,13 +20,6 @@ lan9118_phy_reset(void) ""
 lance_mem_readw(uint64_t addr, uint32_t ret) "addr=0x%"PRIx64"val=0x%04x"
 lance_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64"val=0x%04x"
 
-# mipsnet.c
-mipsnet_send(uint32_t size) "sending len=%u"
-mipsnet_receive(uint32_t size) "receiving len=%u"
-mipsnet_read(uint64_t addr, uint32_t val) "read addr=0x%" PRIx64 " val=0x%x"
-mipsnet_write(uint64_t addr, uint64_t val) "write addr=0x%" PRIx64 " val=0x%" PRIx64
-mipsnet_irq(uint32_t isr, uint32_t intctl) "set irq to %d (0x%02x)"
-
 # ne2000.c
 ne2000_read(uint64_t addr, uint64_t val) "read addr=0x%" PRIx64 " val=0x%" PRIx64
 ne2000_write(uint64_t addr, uint64_t val) "write addr=0x%" PRIx64 " val=0x%" PRIx64

From 79d472a51015f9c9ab341a5f56b8c450870c006b Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Mon, 1 Sep 2025 07:56:22 +0200
Subject: [PATCH 0305/2396] hw/sd/sdcard: Add validation for
 boot-partition-size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Make sure we are not silently rounding down or even wrapping around,
causing inconsistencies with the provided image.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
[PMD: Use g_autofree, suggested by Alex]
Message-ID: <1fff448da042bdf8cff7733ce67cadff4c540f1d.1756706188.git.jan.kiszka@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 8b142e4796..5603b391bf 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2810,6 +2810,15 @@ static void sd_realize(DeviceState *dev, Error **errp)
         }
         blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
     }
+    if (sd->boot_part_size % (128 * KiB) ||
+        sd->boot_part_size > 255 * 128 * KiB) {
+        g_autofree char *size_str = size_to_str(sd->boot_part_size);
+
+        error_setg(errp, "Invalid boot partition size: %s", size_str);
+        error_append_hint(errp,
+                          "The boot partition size must be multiples of 128K"
+                          "and not larger than 32640K.\n");
+    }
 }
 
 static void emmc_realize(DeviceState *dev, Error **errp)

From e2d7c1a3cdc46d6b2e8afa8db8a7ef4c2740a2fe Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Mon, 1 Sep 2025 07:56:24 +0200
Subject: [PATCH 0306/2396] hw/sd/sdcard: Refactor sd_bootpart_offset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function provides the offset for any partition in the block image,
not only the boot partitions, therefore rename it. Align the constant
names with the numbering scheme in the standard and use constants for
both boot partitions for consistency reasons. There is also no reason to
return early if boot_part_size is zero because the existing code will
provide the right value in that case as well.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <66e9b07476aad61820c4f42f4f984cc90752ba5e.1756706188.git.jan.kiszka@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c             | 16 ++++++++--------
 hw/sd/sdmmc-internal.h |  3 ++-
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 5603b391bf..d7a496d77c 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -833,14 +833,14 @@ static uint32_t sd_blk_len(SDState *sd)
 
 /*
  * This requires a disk image that has two boot partitions inserted at the
- * beginning of it. The size of the boot partitions is the "boot-size"
- * property.
+ * beginning of it, followed by an RPMB partition. The size of the boot
+ * partitions is the "boot-partition-size" property.
  */
-static uint32_t sd_bootpart_offset(SDState *sd)
+static uint32_t sd_part_offset(SDState *sd)
 {
     unsigned partition_access;
 
-    if (!sd->boot_part_size || !sd_is_emmc(sd)) {
+    if (!sd_is_emmc(sd)) {
         return 0;
     }
 
@@ -849,9 +849,9 @@ static uint32_t sd_bootpart_offset(SDState *sd)
     switch (partition_access) {
     case EXT_CSD_PART_CONFIG_ACC_DEFAULT:
         return sd->boot_part_size * 2;
-    case EXT_CSD_PART_CONFIG_ACC_BOOT0:
+    case EXT_CSD_PART_CONFIG_ACC_BOOT1:
         return 0;
-    case EXT_CSD_PART_CONFIG_ACC_BOOT0 + 1:
+    case EXT_CSD_PART_CONFIG_ACC_BOOT2:
         return sd->boot_part_size * 1;
     default:
          g_assert_not_reached();
@@ -1052,7 +1052,7 @@ static const VMStateDescription sd_vmstate = {
 static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
 {
     trace_sdcard_read_block(addr, len);
-    addr += sd_bootpart_offset(sd);
+    addr += sd_part_offset(sd);
     if (!sd->blk || blk_pread(sd->blk, addr, len, sd->data, 0) < 0) {
         fprintf(stderr, "sd_blk_read: read error on host side\n");
     }
@@ -1061,7 +1061,7 @@ static void sd_blk_read(SDState *sd, uint64_t addr, uint32_t len)
 static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
 {
     trace_sdcard_write_block(addr, len);
-    addr += sd_bootpart_offset(sd);
+    addr += sd_part_offset(sd);
     if (!sd->blk || blk_pwrite(sd->blk, addr, len, sd->data, 0) < 0) {
         fprintf(stderr, "sd_blk_write: write error on host side\n");
     }
diff --git a/hw/sd/sdmmc-internal.h b/hw/sd/sdmmc-internal.h
index 91eb5b6b2f..ce6bc4e6ec 100644
--- a/hw/sd/sdmmc-internal.h
+++ b/hw/sd/sdmmc-internal.h
@@ -116,7 +116,8 @@ DECLARE_OBJ_CHECKERS(SDState, SDCardClass, SDMMC_COMMON, TYPE_SDMMC_COMMON)
 
 #define EXT_CSD_PART_CONFIG_ACC_MASK            (0x7)
 #define EXT_CSD_PART_CONFIG_ACC_DEFAULT         (0x0)
-#define EXT_CSD_PART_CONFIG_ACC_BOOT0           (0x1)
+#define EXT_CSD_PART_CONFIG_ACC_BOOT1           (0x1)
+#define EXT_CSD_PART_CONFIG_ACC_BOOT2           (0x2)
 
 #define EXT_CSD_PART_CONFIG_EN_MASK             (0x7 << 3)
 #define EXT_CSD_PART_CONFIG_EN_BOOT0            (0x1 << 3)

From 22ece1a6ebf5d9e0b0a3e376dcfbfe9d96d209b9 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Mon, 1 Sep 2025 07:56:26 +0200
Subject: [PATCH 0307/2396] crypto/hmac: Allow to build hmac over multiple
 qcrypto_gnutls_hmac_bytes[v] calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the buffers that should be considered for building the hmac are not
available at the same time, the current API is unsuitable. Extend it so
that passing a NULL pointer as result_len is used as indicator that
further buffers will be passed in succeeding calls to
qcrypto_gnutls_hmac_bytes[v].

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <2d3539c247a6c323491a3821f0e5b6fc382a4686.1756706188.git.jan.kiszka@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 crypto/hmac-gcrypt.c  |  4 +++-
 crypto/hmac-glib.c    |  4 +++-
 crypto/hmac-gnutls.c  |  4 +++-
 crypto/hmac-nettle.c  |  4 +++-
 include/crypto/hmac.h | 12 ++++++++++++
 5 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/crypto/hmac-gcrypt.c b/crypto/hmac-gcrypt.c
index 5273086eb9..e428d17479 100644
--- a/crypto/hmac-gcrypt.c
+++ b/crypto/hmac-gcrypt.c
@@ -121,7 +121,9 @@ qcrypto_gcrypt_hmac_bytesv(QCryptoHmac *hmac,
         return -1;
     }
 
-    if (*resultlen == 0) {
+    if (resultlen == NULL) {
+        return 0;
+    } else if (*resultlen == 0) {
         *resultlen = ret;
         *result = g_new0(uint8_t, *resultlen);
     } else if (*resultlen != ret) {
diff --git a/crypto/hmac-glib.c b/crypto/hmac-glib.c
index ea80c8d1b2..b845133a05 100644
--- a/crypto/hmac-glib.c
+++ b/crypto/hmac-glib.c
@@ -104,7 +104,9 @@ qcrypto_glib_hmac_bytesv(QCryptoHmac *hmac,
         return -1;
     }
 
-    if (*resultlen == 0) {
+    if (resultlen == NULL) {
+        return 0;
+    } else if (*resultlen == 0) {
         *resultlen = ret;
         *result = g_new0(uint8_t, *resultlen);
     } else if (*resultlen != ret) {
diff --git a/crypto/hmac-gnutls.c b/crypto/hmac-gnutls.c
index 822995505c..3c5bcbe80b 100644
--- a/crypto/hmac-gnutls.c
+++ b/crypto/hmac-gnutls.c
@@ -119,7 +119,9 @@ qcrypto_gnutls_hmac_bytesv(QCryptoHmac *hmac,
         return -1;
     }
 
-    if (*resultlen == 0) {
+    if (resultlen == NULL) {
+        return 0;
+    } else if (*resultlen == 0) {
         *resultlen = ret;
         *result = g_new0(uint8_t, *resultlen);
     } else if (*resultlen != ret) {
diff --git a/crypto/hmac-nettle.c b/crypto/hmac-nettle.c
index dd5b2ab7a1..2cff7931e1 100644
--- a/crypto/hmac-nettle.c
+++ b/crypto/hmac-nettle.c
@@ -164,7 +164,9 @@ qcrypto_nettle_hmac_bytesv(QCryptoHmac *hmac,
         }
     }
 
-    if (*resultlen == 0) {
+    if (resultlen == NULL) {
+        return 0;
+    } else if (*resultlen == 0) {
         *resultlen = qcrypto_hmac_alg_map[hmac->alg].len;
         *result = g_new0(uint8_t, *resultlen);
     } else if (*resultlen != qcrypto_hmac_alg_map[hmac->alg].len) {
diff --git a/include/crypto/hmac.h b/include/crypto/hmac.h
index da8a1e3ceb..af3d5f8feb 100644
--- a/include/crypto/hmac.h
+++ b/include/crypto/hmac.h
@@ -90,6 +90,12 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoHmac, qcrypto_hmac_free)
  * The memory referenced in @result must be released with a call
  * to g_free() when no longer required by the caller.
  *
+ * If @result_len is set to a NULL pointer, no result will be returned, and
+ * the hmac object can be used for further invocations of qcrypto_hmac_bytes()
+ * or qcrypto_hmac_bytesv() until a non-NULL pointer is provided. This allows
+ * to build the hmac across memory regions that are not available at the same
+ * time.
+ *
  * Returns:
  *  0 on success, -1 on error
  */
@@ -123,6 +129,12 @@ int qcrypto_hmac_bytesv(QCryptoHmac *hmac,
  * The memory referenced in @result must be released with a call
  * to g_free() when no longer required by the caller.
  *
+ * If @result_len is set to a NULL pointer, no result will be returned, and
+ * the hmac object can be used for further invocations of qcrypto_hmac_bytes()
+ * or qcrypto_hmac_bytesv() until a non-NULL pointer is provided. This allows
+ * to build the hmac across memory regions that are not available at the same
+ * time.
+ *
  * Returns:
  *  0 on success, -1 on error
  */

From 319ca84949fc3134774342d50790592680c3b9b0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:24 +0200
Subject: [PATCH 0308/2396] hw/arm/virt: Include 'system/system.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hw/arm/virt.c should include 'system/system.h' for :

  serial_hd()
  qemu_add_machine_init_done_notifier()

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250731144019.1403591-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250901064631.530723-2-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/arm/virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 1e63f40fbe..e5c4142e82 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -50,6 +50,7 @@
 #include "system/kvm.h"
 #include "system/hvf.h"
 #include "system/qtest.h"
+#include "system/system.h"
 #include "hw/loader.h"
 #include "qapi/error.h"
 #include "qemu/bitops.h"

From 02423bc9d329b7ff274aa2cf7da544dc339d9724 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:25 +0200
Subject: [PATCH 0309/2396] hw/isa/superio: Include 'system/system.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Files using serial_hd() should include 'system/system.h'. Fix that.

Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901064631.530723-3-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/isa/isa-superio.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/isa/isa-superio.c b/hw/isa/isa-superio.c
index 2853485977..941b0f91d7 100644
--- a/hw/isa/isa-superio.c
+++ b/hw/isa/isa-superio.c
@@ -15,6 +15,7 @@
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "system/blockdev.h"
+#include "system/system.h"
 #include "chardev/char.h"
 #include "hw/char/parallel.h"
 #include "hw/block/fdc.h"

From f4e39e06d1c8cfc0cfd4d2f839d85f568072435d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:26 +0200
Subject: [PATCH 0310/2396] hw/mips/loongson3_virt: Include 'system/system.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Files using serial_hd() should include 'system/system.h'. Fix that.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901064631.530723-4-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/mips/loongson3_virt.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index de6fbcc0cb..672083dec9 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -49,6 +49,7 @@
 #include "system/qtest.h"
 #include "system/reset.h"
 #include "system/runstate.h"
+#include "system/system.h"
 #include "qemu/error-report.h"
 
 #define PM_CNTL_MODE          0x10

From 42ab9014a9de94fc8c0aa97b1822230a5ee96bfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:27 +0200
Subject: [PATCH 0311/2396] hw/mips/malta: Include 'system/system.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Files using serial_hd() should include 'system/system.h'. Fix that.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Aurelien Jarno <aurelien@aurel32.net>
Cc: Jiaxun Yang <jiaxun.yang@flygoat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901064631.530723-5-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/mips/malta.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index cbdbb21056..344dc8ca76 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -52,6 +52,7 @@
 #include "system/qtest.h"
 #include "system/reset.h"
 #include "system/runstate.h"
+#include "system/system.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "system/kvm.h"

From 21dca6e6c79e28dc05f7a0722895618b489223a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 1 Sep 2025 09:27:35 +0200
Subject: [PATCH 0312/2396] docs/about/removed-features: Clarify 'device_add'
 is removed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All other titles in removed-features.rst mention when
the feature was removed using "removed in". Use that
instead of "since" which we use for when a feature is
deprecated.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20250901113957.17113-1-philmd@linaro.org>
---
 docs/about/removed-features.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index dc3d4eaa2d..fff781d6b7 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -730,8 +730,8 @@ Use ``multifd-channels`` instead.
 
 Use ``multifd-compression`` instead.
 
-Incorrectly typed ``device_add`` arguments (since 9.2)
-''''''''''''''''''''''''''''''''''''''''''''''''''''''
+Incorrectly typed ``device_add`` arguments (removed in 9.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 
 Due to shortcomings in the internal implementation of ``device_add``,
 QEMU used to incorrectly accept certain invalid arguments. Any object

From 7e52554c293184083f571265daacfc9aa57c3d55 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 1 Sep 2025 11:22:14 +0100
Subject: [PATCH 0313/2396] hw/arm/boot: Correctly free the
 MemoryDeviceInfoList
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When running the bios-tables-test under ASAN we see leaks like this:

Direct leak of 16 byte(s) in 1 object(s) allocated from:
    #0 0x5bc58579b00d in calloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x250400d) (BuildId: 2e27b63dc9ac45f522ced40a17c2a60cc32f1d38)
    #1 0x7b4ad90337b1 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x637b1) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5bc5861826db in qmp_memory_device_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/mem/memory-device.c:307:34
    #3 0x5bc587a9edb6 in arm_load_dtb /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/arm/boot.c:656:15

Indirect leak of 28 byte(s) in 2 object(s) allocated from:
    #0 0x5bc58579ae23 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/qemu-system-aarch64+0x2503e23) (BuildId: 2e27b63dc9ac45f522ced40a17c2a60cc32f1d38)
    #1 0x7b4ad6c8f947 in __vasprintf_internal libio/vasprintf.c:116:16
    #2 0x7b4ad9080a52 in g_vasprintf (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0xb0a52) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #3 0x7b4ad90515e4 in g_strdup_vprintf (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x815e4) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #4 0x7b4ad9051940 in g_strdup_printf (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x81940) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #5 0x5bc5885eb739 in object_get_canonical_path /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../qom/object.c:2123:19
    #6 0x5bc58618dca8 in pc_dimm_md_fill_device_info /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/mem/pc-dimm.c:268:18
    #7 0x5bc586182792 in qmp_memory_device_list /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/arm-asan/../../hw/mem/memory-device.c:310:9

This happens because we declared the MemoryDeviceInfoList *md_list
with g_autofree, which will free the direct memory with g_free() but
doesn't free all the other data structures referenced by it.  Instead
what we want is to declare the pointer with g_autoptr(), which will
automatically call the qapi_free_MemoryDeviceInfoList() cleanup
function when the variable goes out of scope.

Fixes: 36bc78aca83cfd ("hw/arm: add static NVDIMMs in device tree")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901102214.3748011-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/arm/boot.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index 1e57c4ab9e..d0840308f5 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -549,7 +549,7 @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
     unsigned int i;
     hwaddr mem_base, mem_len;
     char **node_path;
-    g_autofree MemoryDeviceInfoList *md_list = NULL;
+    g_autoptr(MemoryDeviceInfoList) md_list = NULL;
     Error *err = NULL;
 
     if (binfo->dtb_filename) {

From e502e614f4c3e5ee7b12cf1c926d9581262fd626 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Mon, 1 Sep 2025 21:31:58 +0100
Subject: [PATCH 0314/2396] hw/i386/pc_piix.c: remove unnecessary if() from
 pc_init1()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the isapc logic has been split out of pc_piix.c, the PCI Host Bridge
(phb) object is now always set in pc_init1().

Since phb is now guaranteed not to be NULL, Coverity reports that the if()
statement surrounding ioapic_init_gsi() is now unnecessary and can be removed
along with the phb NULL initialiser.

Coverity: CID 1620557
Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Fixes: 99d0630a45 ("hw/i386/pc_piix.c: assume pcmc->pci_enabled is always true in pc_init1()")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250901203409.1196620-1-mark.caveayland@nutanix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/pc_piix.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 7e78b6daa6..caf8bab68e 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -106,7 +106,7 @@ static void pc_init1(MachineState *machine, const char *pci_type)
     X86MachineState *x86ms = X86_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *system_io = get_system_io();
-    Object *phb = NULL;
+    Object *phb;
     ISABus *isa_bus;
     Object *piix4_pm = NULL;
     qemu_irq smi_irq;
@@ -284,9 +284,7 @@ static void pc_init1(MachineState *machine, const char *pci_type)
         pc_i8259_create(isa_bus, gsi_state->i8259_irq);
     }
 
-    if (phb) {
-        ioapic_init_gsi(gsi_state, phb);
-    }
+    ioapic_init_gsi(gsi_state, phb);
 
     if (tcg_enabled()) {
         x86_register_ferr_irq(x86ms->gsi[13]);

From 1566b8c8df9e8603f5d03cc1a7708c4ecfda0897 Mon Sep 17 00:00:00 2001
From: Stefan Weil via <qemu-trivial@nongnu.org>
Date: Sat, 9 Aug 2025 08:13:02 +0200
Subject: [PATCH 0315/2396] chardev/baum: Fix compiler warning for Windows
 builds

Compiler warning:

../chardev/baum.c:657:25: warning: comparison between pointer and integer

Use brlapi_fileDescriptor instead of int for brlapi_fd and
BRLAPI_INVALID_FILE_DESCRIPTOR instead of -1.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 chardev/baum.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/chardev/baum.c b/chardev/baum.c
index f3e8cd27f0..ad68321504 100644
--- a/chardev/baum.c
+++ b/chardev/baum.c
@@ -94,7 +94,7 @@ struct BaumChardev {
     Chardev parent;
 
     brlapi_handle_t *brlapi;
-    int brlapi_fd;
+    brlapi_fileDescriptor brlapi_fd;
     unsigned int x, y;
     bool deferred_init;
 
@@ -654,7 +654,7 @@ static void baum_chr_open(Chardev *chr,
     baum->brlapi = handle;
 
     baum->brlapi_fd = brlapi__openConnection(handle, NULL, NULL);
-    if (baum->brlapi_fd == -1) {
+    if (baum->brlapi_fd == BRLAPI_INVALID_FILE_DESCRIPTOR) {
         error_setg(errp, "brlapi__openConnection: %s",
                    brlapi_strerror(brlapi_error_location()));
         g_free(handle);
@@ -665,6 +665,10 @@ static void baum_chr_open(Chardev *chr,
 
     baum->cellCount_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, baum_cellCount_timer_cb, baum);
 
+    /*
+     * On Windows, brlapi_fd is a pointer, which is being used here
+     * as an integer, but in practice it seems to work
+     */
     qemu_set_fd_handler(baum->brlapi_fd, baum_chr_read, NULL, baum);
 }
 

From 606978500c3d18fb89a49844f253097b17f757de Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sun, 24 Aug 2025 03:05:32 +0300
Subject: [PATCH 0316/2396] block/curl: fix curl internal handles handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

block/curl.c uses CURLMOPT_SOCKETFUNCTION to register a socket callback.
According to the documentation, this callback is called not just with
application-created sockets but also with internal curl sockets, - and
for such sockets, user data pointer is not set by the application, so
the result qemu crashing.

Pass BDRVCURLState directly to the callback function as user pointer,
instead of relying on CURLINFO_PRIVATE.

This problem started happening with update of libcurl from 8.9 to 8.10 --
apparently with this change curl started using private handles more.

(CURLINFO_PRIVATE is used in one more place, in curl_multi_check_completion() -
it might need a similar fix too)

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3081
Cc: qemu-stable@qemu.org
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 block/curl.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index 5467678024..00b949ea45 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -162,13 +162,9 @@ static int curl_timer_cb(CURLM *multi, long timeout_ms, void *opaque)
 static int curl_sock_cb(CURL *curl, curl_socket_t fd, int action,
                         void *userp, void *sp)
 {
-    BDRVCURLState *s;
-    CURLState *state = NULL;
+    BDRVCURLState *s = userp;
     CURLSocket *socket;
 
-    curl_easy_getinfo(curl, CURLINFO_PRIVATE, (char **)&state);
-    s = state->s;
-
     socket = g_hash_table_lookup(s->sockets, GINT_TO_POINTER(fd));
     if (!socket) {
         socket = g_new0(CURLSocket, 1);
@@ -605,6 +601,7 @@ static void curl_attach_aio_context(BlockDriverState *bs,
     assert(!s->multi);
     s->multi = curl_multi_init();
     s->aio_context = new_context;
+    curl_multi_setopt(s->multi, CURLMOPT_SOCKETDATA, s);
     curl_multi_setopt(s->multi, CURLMOPT_SOCKETFUNCTION, curl_sock_cb);
     curl_multi_setopt(s->multi, CURLMOPT_TIMERDATA, s);
     curl_multi_setopt(s->multi, CURLMOPT_TIMERFUNCTION, curl_timer_cb);

From 29e68f41c064299d4b45f3517c2e4400b1c17231 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Mon, 25 Aug 2025 12:52:46 +0300
Subject: [PATCH 0317/2396] block/curl: drop old/unuspported curl version
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We currently require libcurl >=7.29.0 (since f9cd86fe72be3cd8).
Drop older LIBCURL_VERSION_NUM checks from the driver.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 block/curl.c | 13 +------------
 1 file changed, 1 insertion(+), 12 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index 00b949ea45..e0f98e035a 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -516,7 +516,7 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
                              CURLOPT_REDIR_PROTOCOLS_STR, PROTOCOLS)) {
             goto err;
         }
-#elif LIBCURL_VERSION_NUM >= 0x071304
+#else
         if (curl_easy_setopt(state->curl, CURLOPT_PROTOCOLS, PROTOCOLS) ||
             curl_easy_setopt(state->curl, CURLOPT_REDIR_PROTOCOLS, PROTOCOLS)) {
             goto err;
@@ -821,22 +821,11 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
         goto out;
     }
 #endif
-    /* Prior CURL 7.19.4 return value of 0 could mean that the file size is not
-     * know or the size is zero. From 7.19.4 CURL returns -1 if size is not
-     * known and zero if it is really zero-length file. */
-#if LIBCURL_VERSION_NUM >= 0x071304
     if (cl < 0) {
         pstrcpy(state->errmsg, CURL_ERROR_SIZE,
                 "Server didn't report file size.");
         goto out;
     }
-#else
-    if (cl <= 0) {
-        pstrcpy(state->errmsg, CURL_ERROR_SIZE,
-                "Unknown file size or zero-length file.");
-        goto out;
-    }
-#endif
 
     s->len = cl;
 

From 0ac122d933323610b3dc7ce846cb47ba48d78266 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 11 Aug 2025 11:43:41 +0200
Subject: [PATCH 0318/2396] scripts/coverity-scan/COMPONENTS.md: Add a
 'plugins' category
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cover the TCG plugins files under their own Coverity category.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 scripts/coverity-scan/COMPONENTS.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/coverity-scan/COMPONENTS.md b/scripts/coverity-scan/COMPONENTS.md
index 72995903ff..95805b536b 100644
--- a/scripts/coverity-scan/COMPONENTS.md
+++ b/scripts/coverity-scan/COMPONENTS.md
@@ -147,6 +147,9 @@ tcg
 system
   ~ .*/qemu(/system/.*|/accel/.*)
 
+plugins
+  ~ .*/qemu(/contrib|/tests/tcg)?/plugins/.*
+
 (headers)
   ~ .*/qemu(/include/.*)
 

From 25fef09ce17ac1ae22638a0b57d97c2bd5cd7d83 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Wed, 27 Aug 2025 11:02:28 +0530
Subject: [PATCH 0319/2396] docs: fix typo in xive doc

"Interrupt Pending Buffer" IPB, which got written as IBP due to typo.

The "IPB" register is also mentioned in same doc multiple times.

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/specs/ppc-xive.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/specs/ppc-xive.rst b/docs/specs/ppc-xive.rst
index 83d43f658b..968cc760d4 100644
--- a/docs/specs/ppc-xive.rst
+++ b/docs/specs/ppc-xive.rst
@@ -157,7 +157,7 @@ Interrupt flow from an O/S perspective
 
 After an event data has been enqueued in the O/S Event Queue, the IVPE
 raises the bit corresponding to the priority of the pending interrupt
-in the register IBP (Interrupt Pending Buffer) to indicate that an
+in the register IPB (Interrupt Pending Buffer) to indicate that an
 event is pending in one of the 8 priority queues. The Pending
 Interrupt Priority Register (PIPR) is also updated using the IPB. This
 register represent the priority of the most favored pending

From 27ea28a0b369b4b14a485a5d6f045e0dc1db4e38 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 29 Aug 2025 13:49:06 +0000
Subject: [PATCH 0320/2396] tcg/arm: Fix tgen_deposit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When converting from tcg_out_deposit, the arguments were not
shuffled properly.

Cc: qemu-stable@nongnu.org
Fixes: cf4905c03135f1181e8 ("tcg: Convert deposit to TCGOutOpDeposit")
Reported-by: Michael Tokarev <mjt@tls.msk.ru>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/arm/tcg-target.c.inc | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 836894b16a..338c57b061 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -975,7 +975,8 @@ static void tgen_deposit(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1,
                          TCGReg a2, unsigned ofs, unsigned len)
 {
     /* bfi/bfc */
-    tcg_out32(s, 0x07c00010 | (COND_AL << 28) | (a0 << 12) | a1
+    tcg_debug_assert(a0 == a1);
+    tcg_out32(s, 0x07c00010 | (COND_AL << 28) | (a0 << 12) | a2
               | (ofs << 7) | ((ofs + len - 1) << 16));
 }
 

From b8eb3dd49583729edceb18628e626eac15a15de4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 5 Aug 2025 11:40:31 +1000
Subject: [PATCH 0321/2396] cpuinfo/i386: Detect GFNI as an AVX extension

We won't use the SSE GFNI instructions, so delay
detection until we know AVX is present.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/i386/host/cpuinfo.h | 1 +
 include/qemu/cpuid.h             | 3 +++
 util/cpuinfo-i386.c              | 1 +
 3 files changed, 5 insertions(+)

diff --git a/host/include/i386/host/cpuinfo.h b/host/include/i386/host/cpuinfo.h
index 9541a64da6..93d029d499 100644
--- a/host/include/i386/host/cpuinfo.h
+++ b/host/include/i386/host/cpuinfo.h
@@ -27,6 +27,7 @@
 #define CPUINFO_ATOMIC_VMOVDQU  (1u << 17)
 #define CPUINFO_AES             (1u << 18)
 #define CPUINFO_PCLMUL          (1u << 19)
+#define CPUINFO_GFNI            (1u << 20)
 
 /* Initialized with a constructor. */
 extern unsigned cpuinfo;
diff --git a/include/qemu/cpuid.h b/include/qemu/cpuid.h
index b11161555b..de7a900509 100644
--- a/include/qemu/cpuid.h
+++ b/include/qemu/cpuid.h
@@ -68,6 +68,9 @@
 #ifndef bit_AVX512VBMI2
 #define bit_AVX512VBMI2 (1 << 6)
 #endif
+#ifndef bit_GFNI
+#define bit_GFNI        (1 << 8)
+#endif
 
 /* Leaf 0x80000001, %ecx */
 #ifndef bit_LZCNT
diff --git a/util/cpuinfo-i386.c b/util/cpuinfo-i386.c
index c8c8a1b370..f4c5b6ff40 100644
--- a/util/cpuinfo-i386.c
+++ b/util/cpuinfo-i386.c
@@ -50,6 +50,7 @@ unsigned __attribute__((constructor)) cpuinfo_init(void)
             if ((bv & 6) == 6) {
                 info |= CPUINFO_AVX1;
                 info |= (b7 & bit_AVX2 ? CPUINFO_AVX2 : 0);
+                info |= (c7 & bit_GFNI ? CPUINFO_GFNI : 0);
 
                 if ((bv & 0xe0) == 0xe0) {
                     info |= (b7 & bit_AVX512F ? CPUINFO_AVX512F : 0);

From 26c41cc4a3d998caa700407a27e18755a6e1895c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 27 Aug 2025 20:33:27 +1000
Subject: [PATCH 0322/2396] tcg/i386: Expand sari of bits-1 as pcmpgt

Expand arithmetic right shift of bits-1 as a comparison vs 0.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 088c6c9264..4cd5d4276c 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -4357,6 +4357,12 @@ static void expand_vec_sari(TCGType type, unsigned vece,
 {
     TCGv_vec t1, t2;
 
+    if (imm >= (8 << vece) - 1) {
+        tcg_gen_cmp_vec(TCG_COND_LT, vece, v0, v1,
+                        tcg_constant_vec(type, MO_64, 0));
+        return;
+    }
+
     switch (vece) {
     case MO_8:
         /* Unpack to 16-bit, shift, and repack.  */

From ba8a86d67aca43a854c78380c917845059c83d4c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 27 Aug 2025 20:38:40 +1000
Subject: [PATCH 0323/2396] tcg/i386: Use canonical operand ordering in
 expand_vec_sari
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The optimizer prefers to have constants as the second operand,
so expand LT x,0 instead of GT 0,x.  This will not affect the
generated code at all.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 4cd5d4276c..8260c35edd 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -4399,8 +4399,8 @@ static void expand_vec_sari(TCGType type, unsigned vece,
             /* Otherwise we will need to use a compare vs 0 to produce
              * the sign-extend, shift and merge.
              */
-            tcg_gen_cmp_vec(TCG_COND_GT, MO_64, t1,
-                            tcg_constant_vec(type, MO_64, 0), v1);
+            tcg_gen_cmp_vec(TCG_COND_LT, MO_64, t1, v1,
+                            tcg_constant_vec(type, MO_64, 0));
             tcg_gen_shri_vec(MO_64, v0, v1, imm);
             tcg_gen_shli_vec(MO_64, t1, t1, 64 - imm);
             tcg_gen_or_vec(MO_64, v0, v0, t1);

From 6c76a1f687cd509d26dae44ea39bf396b251fe0e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 5 Aug 2025 11:56:33 +1000
Subject: [PATCH 0324/2396] tcg/i386: Add INDEX_op_x86_vgf2p8affineqb_vec

Add a backend-specific opcode for expanding the
GFNI vgf2p8affineqb instruction, which we can use
for expanding 8-bit immediate shifts and rotates.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target-opc.h.inc | 1 +
 tcg/i386/tcg-target.c.inc     | 6 ++++++
 2 files changed, 7 insertions(+)

diff --git a/tcg/i386/tcg-target-opc.h.inc b/tcg/i386/tcg-target-opc.h.inc
index 8cc0dbaeaf..8a5cb34dbe 100644
--- a/tcg/i386/tcg-target-opc.h.inc
+++ b/tcg/i386/tcg-target-opc.h.inc
@@ -35,3 +35,4 @@ DEF(x86_punpckh_vec, 1, 2, 0, TCG_OPF_VECTOR)
 DEF(x86_vpshldi_vec, 1, 2, 1, TCG_OPF_VECTOR)
 DEF(x86_vpshldv_vec, 1, 3, 0, TCG_OPF_VECTOR)
 DEF(x86_vpshrdv_vec, 1, 3, 0, TCG_OPF_VECTOR)
+DEF(x86_vgf2p8affineqb_vec, 1, 2, 1, TCG_OPF_VECTOR)
diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index 8260c35edd..efaca0ca67 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -451,6 +451,7 @@ static bool tcg_target_const_match(int64_t val, int ct,
 #define OPC_VPBROADCASTW (0x79 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTD (0x58 | P_EXT38 | P_DATA16)
 #define OPC_VPBROADCASTQ (0x59 | P_EXT38 | P_DATA16)
+#define OPC_VGF2P8AFFINEQB (0xce | P_EXT3A | P_DATA16 | P_VEXW)
 #define OPC_VPMOVM2B    (0x28 | P_EXT38 | P_SIMDF3 | P_EVEX)
 #define OPC_VPMOVM2W    (0x28 | P_EXT38 | P_SIMDF3 | P_VEXW | P_EVEX)
 #define OPC_VPMOVM2D    (0x38 | P_EXT38 | P_SIMDF3 | P_EVEX)
@@ -4084,6 +4085,10 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         insn = vpshldi_insn[vece];
         sub = args[3];
         goto gen_simd_imm8;
+    case INDEX_op_x86_vgf2p8affineqb_vec:
+        insn = OPC_VGF2P8AFFINEQB;
+        sub = args[3];
+        goto gen_simd_imm8;
 
     case INDEX_op_not_vec:
         insn = OPC_VPTERNLOGQ;
@@ -4188,6 +4193,7 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_x86_punpckl_vec:
     case INDEX_op_x86_punpckh_vec:
     case INDEX_op_x86_vpshldi_vec:
+    case INDEX_op_x86_vgf2p8affineqb_vec:
 #if TCG_TARGET_REG_BITS == 32
     case INDEX_op_dup2_vec:
 #endif

From cb2540979264c8d3984e26c5dd90a840e47ec5dd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 5 Aug 2025 15:21:44 +1000
Subject: [PATCH 0325/2396] tcg/i386: Use vgf2p8affineqb for MO_8 vector shifts

A constant matrix can describe the movement of the 8 bits,
so these shifts can be performed with one instruction.

Logic courtesy of Andi Kleen <ak@linux.intel.com>:
https://gcc.gnu.org/pipermail/gcc-patches/2025-August/691624.html

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/i386/tcg-target.c.inc | 75 ++++++++++++++++++++++++++++++++++++---
 1 file changed, 71 insertions(+), 4 deletions(-)

diff --git a/tcg/i386/tcg-target.c.inc b/tcg/i386/tcg-target.c.inc
index efaca0ca67..ee27266861 100644
--- a/tcg/i386/tcg-target.c.inc
+++ b/tcg/i386/tcg-target.c.inc
@@ -4342,12 +4342,46 @@ int tcg_can_emit_vec_op(TCGOpcode opc, TCGType type, unsigned vece)
     }
 }
 
+static void gen_vgf2p8affineqb0(TCGType type, TCGv_vec v0,
+                                TCGv_vec v1, uint64_t matrix)
+{
+    vec_gen_4(INDEX_op_x86_vgf2p8affineqb_vec, type, MO_8,
+              tcgv_vec_arg(v0), tcgv_vec_arg(v1),
+              tcgv_vec_arg(tcg_constant_vec(type, MO_64, matrix)), 0);
+}
+
 static void expand_vec_shi(TCGType type, unsigned vece, bool right,
                            TCGv_vec v0, TCGv_vec v1, TCGArg imm)
 {
+    static const uint64_t gf2_shi[2][8] = {
+        /* left shift */
+        { 0,
+          0x0001020408102040ull,
+          0x0000010204081020ull,
+          0x0000000102040810ull,
+          0x0000000001020408ull,
+          0x0000000000010204ull,
+          0x0000000000000102ull,
+          0x0000000000000001ull },
+        /* right shift */
+        { 0,
+          0x0204081020408000ull,
+          0x0408102040800000ull,
+          0x0810204080000000ull,
+          0x1020408000000000ull,
+          0x2040800000000000ull,
+          0x4080000000000000ull,
+          0x8000000000000000ull }
+    };
     uint8_t mask;
 
     tcg_debug_assert(vece == MO_8);
+
+    if (cpuinfo & CPUINFO_GFNI) {
+        gen_vgf2p8affineqb0(type, v0, v1, gf2_shi[right][imm]);
+        return;
+    }
+
     if (right) {
         mask = 0xff >> imm;
         tcg_gen_shri_vec(MO_16, v0, v1, imm);
@@ -4361,6 +4395,16 @@ static void expand_vec_shi(TCGType type, unsigned vece, bool right,
 static void expand_vec_sari(TCGType type, unsigned vece,
                             TCGv_vec v0, TCGv_vec v1, TCGArg imm)
 {
+    static const uint64_t gf2_sar[8] = {
+        0,
+        0x0204081020408080ull,
+        0x0408102040808080ull,
+        0x0810204080808080ull,
+        0x1020408080808080ull,
+        0x2040808080808080ull,
+        0x4080808080808080ull,
+        0x8080808080808080ull,
+    };
     TCGv_vec t1, t2;
 
     if (imm >= (8 << vece) - 1) {
@@ -4371,6 +4415,11 @@ static void expand_vec_sari(TCGType type, unsigned vece,
 
     switch (vece) {
     case MO_8:
+        if (cpuinfo & CPUINFO_GFNI) {
+            gen_vgf2p8affineqb0(type, v0, v1, gf2_sar[imm]);
+            break;
+        }
+
         /* Unpack to 16-bit, shift, and repack.  */
         t1 = tcg_temp_new_vec(type);
         t2 = tcg_temp_new_vec(type);
@@ -4422,12 +4471,30 @@ static void expand_vec_sari(TCGType type, unsigned vece,
 static void expand_vec_rotli(TCGType type, unsigned vece,
                              TCGv_vec v0, TCGv_vec v1, TCGArg imm)
 {
+    static const uint64_t gf2_rol[8] = {
+        0,
+        0x8001020408102040ull,
+        0x4080010204081020ull,
+        0x2040800102040810ull,
+        0x1020408001020408ull,
+        0x0810204080010204ull,
+        0x0408102040800102ull,
+        0x0204081020408001ull,
+    };
     TCGv_vec t;
 
-    if (vece != MO_8 && have_avx512vbmi2) {
-        vec_gen_4(INDEX_op_x86_vpshldi_vec, type, vece,
-                  tcgv_vec_arg(v0), tcgv_vec_arg(v1), tcgv_vec_arg(v1), imm);
-        return;
+    if (vece == MO_8) {
+        if (cpuinfo & CPUINFO_GFNI) {
+            gen_vgf2p8affineqb0(type, v0, v1, gf2_rol[imm]);
+            return;
+        }
+    } else {
+        if (have_avx512vbmi2) {
+            vec_gen_4(INDEX_op_x86_vpshldi_vec, type, vece,
+                      tcgv_vec_arg(v0), tcgv_vec_arg(v1),
+                      tcgv_vec_arg(v1), imm);
+            return;
+        }
     }
 
     t = tcg_temp_new_vec(type);

From 889bf9a067804211c2fc4d09a8dc1a66f1472f89 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Tue, 5 Aug 2025 16:36:31 -0500
Subject: [PATCH 0326/2396] MAINTAINERS: Add myself as reviewer for PowerNV and
 XIVE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adding myself as reviewer for PowerNV and XIVE areas.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250805213646.3285026-1-milesg@linux.ibm.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 1ae28e8804..fb045388b9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1575,6 +1575,7 @@ F: tests/functional/ppc64/test_tuxrun.py
 PowerNV (Non-Virtualized)
 M: Nicholas Piggin <npiggin@gmail.com>
 R: Aditya Gupta <adityag@linux.ibm.com>
+R: Glenn Miles <milesg@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: docs/system/ppc/powernv.rst
@@ -2781,6 +2782,7 @@ T: git https://github.com/philmd/qemu.git fw_cfg-next
 
 XIVE
 R: Gautam Menghani <gautam@linux.ibm.com>
+R: Glenn Miles <milesg@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/*/*xive*

From 432ca3dfa3d57a7bf1e427576fcfca4ab0079a50 Mon Sep 17 00:00:00 2001
From: Tomita Moeko <tomitamoeko@gmail.com>
Date: Thu, 14 Aug 2025 00:05:10 +0800
Subject: [PATCH 0327/2396] vfio/igd: Enable quirks when IGD is not the primary
 display
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since linux 6.15, commit 41112160ca87 ("vfio/pci: match IGD devices in
display controller class"), IGD related regions are also exposed when
IGD is not primary display (device class is Display controller).

Allow IGD quirks to be enabled in this configuration so that guests can
have display output on IGD when it is not the primary display.

Signed-off-by: Tomita Moeko <tomitamoeko@gmail.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250813160510.23553-1-tomitamoeko@gmail.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 7 ++++---
 hw/vfio/pci.h | 5 +++++
 2 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index ee0767b0b8..f116c40ccd 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -460,7 +460,7 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
     int gen;
 
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-        !vfio_is_vga(vdev) || nr != 0) {
+        !vfio_is_base_display(vdev) || nr != 0) {
         return;
     }
 
@@ -518,7 +518,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     Error *err = NULL;
 
     if (!vfio_pci_is(vdev, PCI_VENDOR_ID_INTEL, PCI_ANY_ID) ||
-        !vfio_is_vga(vdev)) {
+        !vfio_is_base_display(vdev)) {
         return true;
     }
 
@@ -534,12 +534,13 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     /*
      * For backward compatibility, enable legacy mode when
      * - Device geneation is 6 to 9 (including both)
-     * - IGD claims VGA cycles on host
+     * - IGD exposes itself as VGA controller and claims VGA cycles on host
      * - Machine type is i440fx (pc_piix)
      * - IGD device is at guest BDF 00:02.0
      * - Not manually disabled by x-igd-legacy-mode=off
      */
     if ((vdev->igd_legacy_mode != ON_OFF_AUTO_OFF) &&
+        vfio_is_vga(vdev) &&
         (gen >= 6 && gen <= 9) &&
         !(gmch & IGD_GMCH_VGA_DISABLE) &&
         !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 810a842f4a..923cf9c2f7 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -203,6 +203,11 @@ static inline bool vfio_is_vga(VFIOPCIDevice *vdev)
     return (vdev->class_code >> 8) == PCI_CLASS_DISPLAY_VGA;
 }
 
+static inline bool vfio_is_base_display(VFIOPCIDevice *vdev)
+{
+    return (vdev->class_code >> 16) == PCI_BASE_CLASS_DISPLAY;
+}
+
 /* MSI/MSI-X/INTx */
 void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr);
 void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,

From aeb1a50d4a7f464a8ff0a66e0beec2a5e1ef6342 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:28 +0200
Subject: [PATCH 0328/2396] vfio: Remove 'vfio-amd-xgbe' device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VFIO_AMD_XGBE device type has been deprecated in the QEMU 10.0
timeframe. The AMD "Seattle" device is not supported anymore. Remove it.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250901064631.530723-6-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst       |   6 -
 docs/about/removed-features.rst |   9 +
 docs/devel/kconfig.rst          |   1 -
 hw/arm/Kconfig                  |   1 -
 hw/arm/virt.c                   |   2 -
 hw/core/sysbus-fdt.c            | 316 --------------------------------
 hw/vfio/Kconfig                 |   5 -
 hw/vfio/amd-xgbe.c              |  61 ------
 hw/vfio/meson.build             |   1 -
 include/hw/vfio/vfio-amd-xgbe.h |  46 -----
 10 files changed, 9 insertions(+), 439 deletions(-)
 delete mode 100644 hw/vfio/amd-xgbe.c
 delete mode 100644 include/hw/vfio/vfio-amd-xgbe.h

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index b2420732e1..eb424f96d2 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -498,12 +498,6 @@ The vfio-calxeda-xgmac device allows to assign a host Calxeda Highbank
 string) to a guest. Calxeda HW has been ewasted now and there is no point
 keeping that device.
 
-``-device vfio-amd-xgbe`` (since 10.0)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-The vfio-amd-xgbe device allows to assign a host AMD 10GbE controller
-to a guest ("amd,xgbe-seattle-v1a" compatibility string). AMD "Seattle"
-is not supported anymore and there is no point keeping that device.
-
 ``-device vfio-platform`` (since 10.0)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 The vfio-platform device allows to assign a host platform device
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index fff781d6b7..eb0e5128ba 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1280,6 +1280,15 @@ The corresponding upstream server project is no longer maintained.
 Users are recommended to switch to an alternative distributed block
 device driver such as RBD.
 
+VFIO devices
+------------
+
+``-device vfio-amd-xgbe`` (since 10.2)
+''''''''''''''''''''''''''''''''''''''
+The vfio-amd-xgbe device allows to assign a host AMD 10GbE controller
+to a guest ("amd,xgbe-seattle-v1a" compatibility string). AMD "Seattle"
+is not supported anymore and there is no point keeping that device.
+
 Tools
 -----
 
diff --git a/docs/devel/kconfig.rst b/docs/devel/kconfig.rst
index 493b76c4fb..9fdf501529 100644
--- a/docs/devel/kconfig.rst
+++ b/docs/devel/kconfig.rst
@@ -59,7 +59,6 @@ stanza like the following::
       config ARM_VIRT
          bool
          imply PCI_DEVICES
-         imply VFIO_AMD_XGBE
          imply VFIO_XGMAC
          select A15MPCORE
          select ACPI
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 2aa4b5d778..64b2ec87b5 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -5,7 +5,6 @@ config ARM_VIRT
     depends on TCG || KVM || HVF
     imply PCI_DEVICES
     imply TEST_DEVICES
-    imply VFIO_AMD_XGBE
     imply VFIO_PLATFORM
     imply VFIO_XGMAC
     imply TPM_TIS_SYSBUS
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index e5c4142e82..75fb157f6c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -39,7 +39,6 @@
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
 #include "hw/vfio/vfio-calxeda-xgmac.h"
-#include "hw/vfio/vfio-amd-xgbe.h"
 #include "hw/display/ramfb.h"
 #include "net/net.h"
 #include "system/device_tree.h"
@@ -3219,7 +3218,6 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
      */
     mc->max_cpus = 512;
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_CALXEDA_XGMAC);
-    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_AMD_XGBE);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
index c339a27875..d3649d5367 100644
--- a/hw/core/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -34,7 +34,6 @@
 #include "hw/platform-bus.h"
 #include "hw/vfio/vfio-platform.h"
 #include "hw/vfio/vfio-calxeda-xgmac.h"
-#include "hw/vfio/vfio-amd-xgbe.h"
 #include "hw/vfio/vfio-region.h"
 #include "hw/display/ramfb.h"
 #include "hw/uefi/var-service-api.h"
@@ -68,142 +67,6 @@ typedef struct HostProperty {
 
 #ifdef CONFIG_LINUX
 
-/**
- * copy_properties_from_host
- *
- * copies properties listed in an array from host device tree to
- * guest device tree. If a non optional property is not found, the
- * function asserts. An optional property is ignored if not found
- * in the host device tree.
- * @props: array of HostProperty to copy
- * @nb_props: number of properties in the array
- * @host_dt: host device tree blob
- * @guest_dt: guest device tree blob
- * @node_path: host dt node path where the property is supposed to be
-              found
- * @nodename: guest node name the properties should be added to
- */
-static void copy_properties_from_host(HostProperty *props, int nb_props,
-                                      void *host_fdt, void *guest_fdt,
-                                      char *node_path, char *nodename)
-{
-    int i, prop_len;
-    const void *r;
-    Error *err = NULL;
-
-    for (i = 0; i < nb_props; i++) {
-        r = qemu_fdt_getprop(host_fdt, node_path,
-                             props[i].name,
-                             &prop_len,
-                             &err);
-        if (r) {
-            qemu_fdt_setprop(guest_fdt, nodename,
-                             props[i].name, r, prop_len);
-        } else {
-            if (props[i].optional && prop_len == -FDT_ERR_NOTFOUND) {
-                /* optional property does not exist */
-                error_free(err);
-            } else {
-                error_report_err(err);
-            }
-            if (!props[i].optional) {
-                /* mandatory property not found: bail out */
-                exit(1);
-            }
-            err = NULL;
-        }
-    }
-}
-
-/* clock properties whose values are copied/pasted from host */
-static HostProperty clock_copied_properties[] = {
-    {"compatible", false},
-    {"#clock-cells", false},
-    {"clock-frequency", true},
-    {"clock-output-names", true},
-};
-
-/**
- * fdt_build_clock_node
- *
- * Build a guest clock node, used as a dependency from a passthrough'ed
- * device. Most information are retrieved from the host clock node.
- * Also check the host clock is a fixed one.
- *
- * @host_fdt: host device tree blob from which info are retrieved
- * @guest_fdt: guest device tree blob where the clock node is added
- * @host_phandle: phandle of the clock in host device tree
- * @guest_phandle: phandle to assign to the guest node
- */
-static void fdt_build_clock_node(void *host_fdt, void *guest_fdt,
-                                uint32_t host_phandle,
-                                uint32_t guest_phandle)
-{
-    char *node_path = NULL;
-    char *nodename;
-    const void *r;
-    int ret, node_offset, prop_len, path_len = 16;
-
-    node_offset = fdt_node_offset_by_phandle(host_fdt, host_phandle);
-    if (node_offset <= 0) {
-        error_report("not able to locate clock handle %d in host device tree",
-                     host_phandle);
-        exit(1);
-    }
-    node_path = g_malloc(path_len);
-    while ((ret = fdt_get_path(host_fdt, node_offset, node_path, path_len))
-            == -FDT_ERR_NOSPACE) {
-        path_len += 16;
-        node_path = g_realloc(node_path, path_len);
-    }
-    if (ret < 0) {
-        error_report("not able to retrieve node path for clock handle %d",
-                     host_phandle);
-        exit(1);
-    }
-
-    r = qemu_fdt_getprop(host_fdt, node_path, "compatible", &prop_len,
-                         &error_fatal);
-    if (strcmp(r, "fixed-clock")) {
-        error_report("clock handle %d is not a fixed clock", host_phandle);
-        exit(1);
-    }
-
-    nodename = strrchr(node_path, '/');
-    qemu_fdt_add_subnode(guest_fdt, nodename);
-
-    copy_properties_from_host(clock_copied_properties,
-                              ARRAY_SIZE(clock_copied_properties),
-                              host_fdt, guest_fdt,
-                              node_path, nodename);
-
-    qemu_fdt_setprop_cell(guest_fdt, nodename, "phandle", guest_phandle);
-
-    g_free(node_path);
-}
-
-/**
- * sysfs_to_dt_name: convert the name found in sysfs into the node name
- * for instance e0900000.xgmac is converted into xgmac@e0900000
- * @sysfs_name: directory name in sysfs
- *
- * returns the device tree name upon success or NULL in case the sysfs name
- * does not match the expected format
- */
-static char *sysfs_to_dt_name(const char *sysfs_name)
-{
-    gchar **substrings =  g_strsplit(sysfs_name, ".", 2);
-    char *dt_name = NULL;
-
-    if (!substrings || !substrings[0] || !substrings[1]) {
-        goto out;
-    }
-    dt_name = g_strdup_printf("%s@%s", substrings[1], substrings[0]);
-out:
-    g_strfreev(substrings);
-    return dt_name;
-}
-
 /* Device Specific Code */
 
 /**
@@ -261,183 +124,6 @@ static int add_calxeda_midway_xgmac_fdt_node(SysBusDevice *sbdev, void *opaque)
     g_free(nodename);
     return 0;
 }
-
-/* AMD xgbe properties whose values are copied/pasted from host */
-static HostProperty amd_xgbe_copied_properties[] = {
-    {"compatible", false},
-    {"dma-coherent", true},
-    {"amd,per-channel-interrupt", true},
-    {"phy-mode", false},
-    {"mac-address", true},
-    {"amd,speed-set", false},
-    {"amd,serdes-blwc", true},
-    {"amd,serdes-cdr-rate", true},
-    {"amd,serdes-pq-skew", true},
-    {"amd,serdes-tx-amp", true},
-    {"amd,serdes-dfe-tap-config", true},
-    {"amd,serdes-dfe-tap-enable", true},
-    {"clock-names", false},
-};
-
-/**
- * add_amd_xgbe_fdt_node
- *
- * Generates the combined xgbe/phy node following kernel >=4.2
- * binding documentation:
- * Documentation/devicetree/bindings/net/amd-xgbe.txt:
- * Also 2 clock nodes are created (dma and ptp)
- *
- * Asserts in case of error
- */
-static int add_amd_xgbe_fdt_node(SysBusDevice *sbdev, void *opaque)
-{
-    PlatformBusFDTData *data = opaque;
-    PlatformBusDevice *pbus = data->pbus;
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(sbdev);
-    VFIODevice *vbasedev = &vdev->vbasedev;
-    VFIOINTp *intp;
-    const char *parent_node = data->pbus_node_name;
-    char **node_path, *nodename, *dt_name;
-    void *guest_fdt = data->fdt, *host_fdt;
-    const void *r;
-    int i, prop_len;
-    uint32_t *irq_attr, *reg_attr;
-    const uint32_t *host_clock_phandles;
-    uint64_t mmio_base, irq_number;
-    uint32_t guest_clock_phandles[2];
-
-    host_fdt = load_device_tree_from_sysfs();
-
-    dt_name = sysfs_to_dt_name(vbasedev->name);
-    if (!dt_name) {
-        error_report("%s incorrect sysfs device name %s",
-                     __func__, vbasedev->name);
-        exit(1);
-    }
-    node_path = qemu_fdt_node_path(host_fdt, dt_name, vdev->compat,
-                                   &error_fatal);
-    if (!node_path || !node_path[0]) {
-        error_report("%s unable to retrieve node path for %s/%s",
-                     __func__, dt_name, vdev->compat);
-        exit(1);
-    }
-
-    if (node_path[1]) {
-        error_report("%s more than one node matching %s/%s!",
-                     __func__, dt_name, vdev->compat);
-        exit(1);
-    }
-
-    g_free(dt_name);
-
-    if (vbasedev->num_regions != 5) {
-        error_report("%s Does the host dt node combine XGBE/PHY?", __func__);
-        exit(1);
-    }
-
-    /* generate nodes for DMA_CLK and PTP_CLK */
-    r = qemu_fdt_getprop(host_fdt, node_path[0], "clocks",
-                         &prop_len, &error_fatal);
-    if (prop_len != 8) {
-        error_report("%s clocks property should contain 2 handles", __func__);
-        exit(1);
-    }
-    host_clock_phandles = r;
-    guest_clock_phandles[0] = qemu_fdt_alloc_phandle(guest_fdt);
-    guest_clock_phandles[1] = qemu_fdt_alloc_phandle(guest_fdt);
-
-    /**
-     * clock handles fetched from host dt are in be32 layout whereas
-     * rest of the code uses cpu layout. Also guest clock handles are
-     * in cpu layout.
-     */
-    fdt_build_clock_node(host_fdt, guest_fdt,
-                         be32_to_cpu(host_clock_phandles[0]),
-                         guest_clock_phandles[0]);
-
-    fdt_build_clock_node(host_fdt, guest_fdt,
-                         be32_to_cpu(host_clock_phandles[1]),
-                         guest_clock_phandles[1]);
-
-    /* combined XGBE/PHY node */
-    mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
-    nodename = g_strdup_printf("%s/%s@%" PRIx64, parent_node,
-                               vbasedev->name, mmio_base);
-    qemu_fdt_add_subnode(guest_fdt, nodename);
-
-    copy_properties_from_host(amd_xgbe_copied_properties,
-                       ARRAY_SIZE(amd_xgbe_copied_properties),
-                       host_fdt, guest_fdt,
-                       node_path[0], nodename);
-
-    qemu_fdt_setprop_cells(guest_fdt, nodename, "clocks",
-                           guest_clock_phandles[0],
-                           guest_clock_phandles[1]);
-
-    reg_attr = g_new(uint32_t, vbasedev->num_regions * 2);
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, i);
-        reg_attr[2 * i] = cpu_to_be32(mmio_base);
-        reg_attr[2 * i + 1] = cpu_to_be32(
-                                memory_region_size(vdev->regions[i]->mem));
-    }
-    qemu_fdt_setprop(guest_fdt, nodename, "reg", reg_attr,
-                     vbasedev->num_regions * 2 * sizeof(uint32_t));
-
-    irq_attr = g_new(uint32_t, vbasedev->num_irqs * 3);
-    for (i = 0; i < vbasedev->num_irqs; i++) {
-        irq_number = platform_bus_get_irqn(pbus, sbdev , i)
-                         + data->irq_start;
-        irq_attr[3 * i] = cpu_to_be32(GIC_FDT_IRQ_TYPE_SPI);
-        irq_attr[3 * i + 1] = cpu_to_be32(irq_number);
-        /*
-          * General device interrupt and PCS auto-negotiation interrupts are
-          * level-sensitive while the 4 per-channel interrupts are edge
-          * sensitive
-          */
-        QLIST_FOREACH(intp, &vdev->intp_list, next) {
-            if (intp->pin == i) {
-                break;
-            }
-        }
-        if (intp->flags & VFIO_IRQ_INFO_AUTOMASKED) {
-            irq_attr[3 * i + 2] = cpu_to_be32(GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        } else {
-            irq_attr[3 * i + 2] = cpu_to_be32(GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
-        }
-    }
-    qemu_fdt_setprop(guest_fdt, nodename, "interrupts",
-                     irq_attr, vbasedev->num_irqs * 3 * sizeof(uint32_t));
-
-    g_free(host_fdt);
-    g_strfreev(node_path);
-    g_free(irq_attr);
-    g_free(reg_attr);
-    g_free(nodename);
-    return 0;
-}
-
-/* DT compatible matching */
-static bool vfio_platform_match(SysBusDevice *sbdev,
-                                const BindingEntry *entry)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(sbdev);
-    const char *compat;
-    unsigned int n;
-
-    for (n = vdev->num_compat, compat = vdev->compat; n > 0;
-         n--, compat += strlen(compat) + 1) {
-        if (!strcmp(entry->compat, compat)) {
-            return true;
-        }
-    }
-
-    return false;
-}
-
-#define VFIO_PLATFORM_BINDING(compat, add_fn) \
-    {TYPE_VFIO_PLATFORM, (compat), (add_fn), vfio_platform_match}
-
 #endif /* CONFIG_LINUX */
 
 #ifdef CONFIG_TPM
@@ -512,8 +198,6 @@ static bool type_match(SysBusDevice *sbdev, const BindingEntry *entry)
 static const BindingEntry bindings[] = {
 #ifdef CONFIG_LINUX
     TYPE_BINDING(TYPE_VFIO_CALXEDA_XGMAC, add_calxeda_midway_xgmac_fdt_node),
-    TYPE_BINDING(TYPE_VFIO_AMD_XGBE, add_amd_xgbe_fdt_node),
-    VFIO_PLATFORM_BINDING("amd,xgbe-seattle-v1a", add_amd_xgbe_fdt_node),
 #endif
 #ifdef CONFIG_TPM
     TYPE_BINDING(TYPE_TPM_TIS_SYSBUS, add_tpm_tis_fdt_node),
diff --git a/hw/vfio/Kconfig b/hw/vfio/Kconfig
index 91d9023b79..bc984f1986 100644
--- a/hw/vfio/Kconfig
+++ b/hw/vfio/Kconfig
@@ -28,11 +28,6 @@ config VFIO_XGMAC
     default y
     depends on VFIO_PLATFORM
 
-config VFIO_AMD_XGBE
-    bool
-    default y
-    depends on VFIO_PLATFORM
-
 config VFIO_AP
     bool
     default y
diff --git a/hw/vfio/amd-xgbe.c b/hw/vfio/amd-xgbe.c
deleted file mode 100644
index 58f590e385..0000000000
--- a/hw/vfio/amd-xgbe.c
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * AMD XGBE VFIO device
- *
- * Copyright Linaro Limited, 2015
- *
- * Authors:
- *  Eric Auger <eric.auger@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "hw/vfio/vfio-amd-xgbe.h"
-#include "migration/vmstate.h"
-#include "qemu/module.h"
-#include "qemu/error-report.h"
-
-static void amd_xgbe_realize(DeviceState *dev, Error **errp)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(dev);
-    VFIOAmdXgbeDeviceClass *k = VFIO_AMD_XGBE_DEVICE_GET_CLASS(dev);
-
-    warn_report("-device vfio-amd-xgbe is deprecated");
-    vdev->compat = g_strdup("amd,xgbe-seattle-v1a");
-    vdev->num_compat = 1;
-
-    k->parent_realize(dev, errp);
-}
-
-static const VMStateDescription vfio_platform_amd_xgbe_vmstate = {
-    .name = "vfio-amd-xgbe",
-    .unmigratable = 1,
-};
-
-static void vfio_amd_xgbe_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    VFIOAmdXgbeDeviceClass *vcxc =
-        VFIO_AMD_XGBE_DEVICE_CLASS(klass);
-    device_class_set_parent_realize(dc, amd_xgbe_realize,
-                                    &vcxc->parent_realize);
-    dc->desc = "VFIO AMD XGBE";
-    dc->vmsd = &vfio_platform_amd_xgbe_vmstate;
-}
-
-static const TypeInfo vfio_amd_xgbe_dev_info = {
-    .name = TYPE_VFIO_AMD_XGBE,
-    .parent = TYPE_VFIO_PLATFORM,
-    .instance_size = sizeof(VFIOAmdXgbeDevice),
-    .class_init = vfio_amd_xgbe_class_init,
-    .class_size = sizeof(VFIOAmdXgbeDeviceClass),
-};
-
-static void register_amd_xgbe_dev_type(void)
-{
-    type_register_static(&vfio_amd_xgbe_dev_info);
-}
-
-type_init(register_amd_xgbe_dev_type)
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index bfaf6be805..0edcaf5155 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -20,7 +20,6 @@ vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
 specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 
 system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
-system_ss.add(when: 'CONFIG_VFIO_AMD_XGBE', if_true: files('amd-xgbe.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'cpr.c',
   'cpr-legacy.c',
diff --git a/include/hw/vfio/vfio-amd-xgbe.h b/include/hw/vfio/vfio-amd-xgbe.h
deleted file mode 100644
index a894546c02..0000000000
--- a/include/hw/vfio/vfio-amd-xgbe.h
+++ /dev/null
@@ -1,46 +0,0 @@
-/*
- * VFIO AMD XGBE device
- *
- * Copyright Linaro Limited, 2015
- *
- * Authors:
- *  Eric Auger <eric.auger@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- */
-
-#ifndef HW_VFIO_VFIO_AMD_XGBE_H
-#define HW_VFIO_VFIO_AMD_XGBE_H
-
-#include "hw/vfio/vfio-platform.h"
-#include "qom/object.h"
-
-#define TYPE_VFIO_AMD_XGBE "vfio-amd-xgbe"
-
-/**
- * This device exposes:
- * - 5 MMIO regions: MAC, PCS, SerDes Rx/Tx regs,
-     SerDes Integration Registers 1/2 & 2/2
- * - 2 level sensitive IRQs and optional DMA channel IRQs
- */
-struct VFIOAmdXgbeDevice {
-    VFIOPlatformDevice vdev;
-};
-
-typedef struct VFIOAmdXgbeDevice VFIOAmdXgbeDevice;
-
-struct VFIOAmdXgbeDeviceClass {
-    /*< private >*/
-    VFIOPlatformDeviceClass parent_class;
-    /*< public >*/
-    DeviceRealize parent_realize;
-};
-
-typedef struct VFIOAmdXgbeDeviceClass VFIOAmdXgbeDeviceClass;
-
-DECLARE_OBJ_CHECKERS(VFIOAmdXgbeDevice, VFIOAmdXgbeDeviceClass,
-                     VFIO_AMD_XGBE_DEVICE, TYPE_VFIO_AMD_XGBE)
-
-#endif

From 8ebc416ac17a71aec267df1ca5cb5301cc6c4906 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:29 +0200
Subject: [PATCH 0329/2396] vfio: Remove 'vfio-calxeda-xgmac' device
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VFIO_XGMAC device type has been deprecated in the QEMU 10.0
timeframe. Remove it.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250901064631.530723-7-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst            |  7 ---
 docs/about/removed-features.rst      |  7 +++
 docs/devel/kconfig.rst               |  1 -
 hw/arm/Kconfig                       |  1 -
 hw/arm/virt.c                        |  3 +-
 hw/core/sysbus-fdt.c                 | 67 ----------------------------
 hw/vfio/Kconfig                      |  5 ---
 hw/vfio/calxeda-xgmac.c              | 61 -------------------------
 hw/vfio/meson.build                  |  1 -
 include/hw/vfio/vfio-calxeda-xgmac.h | 43 ------------------
 10 files changed, 8 insertions(+), 188 deletions(-)
 delete mode 100644 hw/vfio/calxeda-xgmac.c
 delete mode 100644 include/hw/vfio/vfio-calxeda-xgmac.h

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index eb424f96d2..d0fa8e5536 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -491,13 +491,6 @@ which is not enough for all types of use cases, use ``reconnect-ms`` instead.
 VFIO device options
 '''''''''''''''''''
 
-``-device vfio-calxeda-xgmac`` (since 10.0)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-The vfio-calxeda-xgmac device allows to assign a host Calxeda Highbank
-10Gb XGMAC Ethernet controller device ("calxeda,hb-xgmac" compatibility
-string) to a guest. Calxeda HW has been ewasted now and there is no point
-keeping that device.
-
 ``-device vfio-platform`` (since 10.0)
 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
 The vfio-platform device allows to assign a host platform device
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index eb0e5128ba..db3f22941c 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1283,6 +1283,13 @@ device driver such as RBD.
 VFIO devices
 ------------
 
+``-device vfio-calxeda-xgmac`` (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''
+The vfio-calxeda-xgmac device allows to assign a host Calxeda Highbank
+10Gb XGMAC Ethernet controller device ("calxeda,hb-xgmac" compatibility
+string) to a guest. Calxeda HW has been ewasted now and there is no point
+keeping that device.
+
 ``-device vfio-amd-xgbe`` (since 10.2)
 ''''''''''''''''''''''''''''''''''''''
 The vfio-amd-xgbe device allows to assign a host AMD 10GbE controller
diff --git a/docs/devel/kconfig.rst b/docs/devel/kconfig.rst
index 9fdf501529..1d4a114a02 100644
--- a/docs/devel/kconfig.rst
+++ b/docs/devel/kconfig.rst
@@ -59,7 +59,6 @@ stanza like the following::
       config ARM_VIRT
          bool
          imply PCI_DEVICES
-         imply VFIO_XGMAC
          select A15MPCORE
          select ACPI
          select ARM_SMMUV3
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 64b2ec87b5..3fca48349a 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -6,7 +6,6 @@ config ARM_VIRT
     imply PCI_DEVICES
     imply TEST_DEVICES
     imply VFIO_PLATFORM
-    imply VFIO_XGMAC
     imply TPM_TIS_SYSBUS
     imply TPM_TIS_I2C
     imply NVDIMM
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 75fb157f6c..6a887228bb 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -38,7 +38,7 @@
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
-#include "hw/vfio/vfio-calxeda-xgmac.h"
+#include "hw/vfio/vfio-platform.h"
 #include "hw/display/ramfb.h"
 #include "net/net.h"
 #include "system/device_tree.h"
@@ -3217,7 +3217,6 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
      * configuration of the particular instance.
      */
     mc->max_cpus = 512;
-    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_CALXEDA_XGMAC);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
index d3649d5367..07117363a6 100644
--- a/hw/core/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -32,9 +32,6 @@
 #include "system/device_tree.h"
 #include "system/tpm.h"
 #include "hw/platform-bus.h"
-#include "hw/vfio/vfio-platform.h"
-#include "hw/vfio/vfio-calxeda-xgmac.h"
-#include "hw/vfio/vfio-region.h"
 #include "hw/display/ramfb.h"
 #include "hw/uefi/var-service-api.h"
 #include "hw/arm/fdt.h"
@@ -65,67 +62,6 @@ typedef struct HostProperty {
     bool optional;
 } HostProperty;
 
-#ifdef CONFIG_LINUX
-
-/* Device Specific Code */
-
-/**
- * add_calxeda_midway_xgmac_fdt_node
- *
- * Generates a simple node with following properties:
- * compatible string, regs, interrupts, dma-coherent
- */
-static int add_calxeda_midway_xgmac_fdt_node(SysBusDevice *sbdev, void *opaque)
-{
-    PlatformBusFDTData *data = opaque;
-    PlatformBusDevice *pbus = data->pbus;
-    void *fdt = data->fdt;
-    const char *parent_node = data->pbus_node_name;
-    int compat_str_len, i;
-    char *nodename;
-    uint32_t *irq_attr, *reg_attr;
-    uint64_t mmio_base, irq_number;
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(sbdev);
-    VFIODevice *vbasedev = &vdev->vbasedev;
-
-    mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
-    nodename = g_strdup_printf("%s/%s@%" PRIx64, parent_node,
-                               vbasedev->name, mmio_base);
-    qemu_fdt_add_subnode(fdt, nodename);
-
-    compat_str_len = strlen(vdev->compat) + 1;
-    qemu_fdt_setprop(fdt, nodename, "compatible",
-                          vdev->compat, compat_str_len);
-
-    qemu_fdt_setprop(fdt, nodename, "dma-coherent", "", 0);
-
-    reg_attr = g_new(uint32_t, vbasedev->num_regions * 2);
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        mmio_base = platform_bus_get_mmio_addr(pbus, sbdev, i);
-        reg_attr[2 * i] = cpu_to_be32(mmio_base);
-        reg_attr[2 * i + 1] = cpu_to_be32(
-                                memory_region_size(vdev->regions[i]->mem));
-    }
-    qemu_fdt_setprop(fdt, nodename, "reg", reg_attr,
-                     vbasedev->num_regions * 2 * sizeof(uint32_t));
-
-    irq_attr = g_new(uint32_t, vbasedev->num_irqs * 3);
-    for (i = 0; i < vbasedev->num_irqs; i++) {
-        irq_number = platform_bus_get_irqn(pbus, sbdev , i)
-                         + data->irq_start;
-        irq_attr[3 * i] = cpu_to_be32(GIC_FDT_IRQ_TYPE_SPI);
-        irq_attr[3 * i + 1] = cpu_to_be32(irq_number);
-        irq_attr[3 * i + 2] = cpu_to_be32(GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    }
-    qemu_fdt_setprop(fdt, nodename, "interrupts",
-                     irq_attr, vbasedev->num_irqs * 3 * sizeof(uint32_t));
-    g_free(irq_attr);
-    g_free(reg_attr);
-    g_free(nodename);
-    return 0;
-}
-#endif /* CONFIG_LINUX */
-
 #ifdef CONFIG_TPM
 /*
  * add_tpm_tis_fdt_node: Create a DT node for TPM TIS
@@ -196,9 +132,6 @@ static bool type_match(SysBusDevice *sbdev, const BindingEntry *entry)
 
 /* list of supported dynamic sysbus bindings */
 static const BindingEntry bindings[] = {
-#ifdef CONFIG_LINUX
-    TYPE_BINDING(TYPE_VFIO_CALXEDA_XGMAC, add_calxeda_midway_xgmac_fdt_node),
-#endif
 #ifdef CONFIG_TPM
     TYPE_BINDING(TYPE_TPM_TIS_SYSBUS, add_tpm_tis_fdt_node),
 #endif
diff --git a/hw/vfio/Kconfig b/hw/vfio/Kconfig
index bc984f1986..9a1dbe2926 100644
--- a/hw/vfio/Kconfig
+++ b/hw/vfio/Kconfig
@@ -23,11 +23,6 @@ config VFIO_PLATFORM
     select VFIO
     depends on LINUX && PLATFORM_BUS
 
-config VFIO_XGMAC
-    bool
-    default y
-    depends on VFIO_PLATFORM
-
 config VFIO_AP
     bool
     default y
diff --git a/hw/vfio/calxeda-xgmac.c b/hw/vfio/calxeda-xgmac.c
deleted file mode 100644
index 03f2ff5763..0000000000
--- a/hw/vfio/calxeda-xgmac.c
+++ /dev/null
@@ -1,61 +0,0 @@
-/*
- * calxeda xgmac VFIO device
- *
- * Copyright Linaro Limited, 2014
- *
- * Authors:
- *  Eric Auger <eric.auger@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- */
-
-#include "qemu/osdep.h"
-#include "hw/vfio/vfio-calxeda-xgmac.h"
-#include "migration/vmstate.h"
-#include "qemu/module.h"
-#include "qemu/error-report.h"
-
-static void calxeda_xgmac_realize(DeviceState *dev, Error **errp)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(dev);
-    VFIOCalxedaXgmacDeviceClass *k = VFIO_CALXEDA_XGMAC_DEVICE_GET_CLASS(dev);
-
-    warn_report("-device vfio-calxeda-xgmac is deprecated");
-    vdev->compat = g_strdup("calxeda,hb-xgmac");
-    vdev->num_compat = 1;
-
-    k->parent_realize(dev, errp);
-}
-
-static const VMStateDescription vfio_platform_calxeda_xgmac_vmstate = {
-    .name = "vfio-calxeda-xgmac",
-    .unmigratable = 1,
-};
-
-static void vfio_calxeda_xgmac_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    VFIOCalxedaXgmacDeviceClass *vcxc =
-        VFIO_CALXEDA_XGMAC_DEVICE_CLASS(klass);
-    device_class_set_parent_realize(dc, calxeda_xgmac_realize,
-                                    &vcxc->parent_realize);
-    dc->desc = "VFIO Calxeda XGMAC";
-    dc->vmsd = &vfio_platform_calxeda_xgmac_vmstate;
-}
-
-static const TypeInfo vfio_calxeda_xgmac_dev_info = {
-    .name = TYPE_VFIO_CALXEDA_XGMAC,
-    .parent = TYPE_VFIO_PLATFORM,
-    .instance_size = sizeof(VFIOCalxedaXgmacDevice),
-    .class_init = vfio_calxeda_xgmac_class_init,
-    .class_size = sizeof(VFIOCalxedaXgmacDeviceClass),
-};
-
-static void register_calxeda_xgmac_dev_type(void)
-{
-    type_register_static(&vfio_calxeda_xgmac_dev_info);
-}
-
-type_init(register_calxeda_xgmac_dev_type)
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 0edcaf5155..06473a0789 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -19,7 +19,6 @@ vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
 
 specific_ss.add_all(when: 'CONFIG_VFIO', if_true: vfio_ss)
 
-system_ss.add(when: 'CONFIG_VFIO_XGMAC', if_true: files('calxeda-xgmac.c'))
 system_ss.add(when: 'CONFIG_VFIO', if_true: files(
   'cpr.c',
   'cpr-legacy.c',
diff --git a/include/hw/vfio/vfio-calxeda-xgmac.h b/include/hw/vfio/vfio-calxeda-xgmac.h
deleted file mode 100644
index 8482f151dd..0000000000
--- a/include/hw/vfio/vfio-calxeda-xgmac.h
+++ /dev/null
@@ -1,43 +0,0 @@
-/*
- * VFIO calxeda xgmac device
- *
- * Copyright Linaro Limited, 2014
- *
- * Authors:
- *  Eric Auger <eric.auger@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- */
-
-#ifndef HW_VFIO_VFIO_CALXEDA_XGMAC_H
-#define HW_VFIO_VFIO_CALXEDA_XGMAC_H
-
-#include "hw/vfio/vfio-platform.h"
-#include "qom/object.h"
-
-#define TYPE_VFIO_CALXEDA_XGMAC "vfio-calxeda-xgmac"
-
-/**
- * This device exposes:
- * - a single MMIO region corresponding to its register space
- * - 3 IRQS (main and 2 power related IRQs)
- */
-struct VFIOCalxedaXgmacDevice {
-    VFIOPlatformDevice vdev;
-};
-typedef struct VFIOCalxedaXgmacDevice VFIOCalxedaXgmacDevice;
-
-struct VFIOCalxedaXgmacDeviceClass {
-    /*< private >*/
-    VFIOPlatformDeviceClass parent_class;
-    /*< public >*/
-    DeviceRealize parent_realize;
-};
-typedef struct VFIOCalxedaXgmacDeviceClass VFIOCalxedaXgmacDeviceClass;
-
-DECLARE_OBJ_CHECKERS(VFIOCalxedaXgmacDevice, VFIOCalxedaXgmacDeviceClass,
-                     VFIO_CALXEDA_XGMAC_DEVICE, TYPE_VFIO_CALXEDA_XGMAC)
-
-#endif

From 762c85543948bf1f7838d663995648635d3f4b92 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:30 +0200
Subject: [PATCH 0330/2396] vfio: Remove 'vfio-platform'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VFIO_PLATFORM device type has been deprecated in the QEMU 10.0
timeframe. All dependent devices have been removed. Now remove the
core vfio platform framework.

Rename VFIO_DEVICE_TYPE_PLATFORM enum to VFIO_DEVICE_TYPE_UNUSED to
maintain the same index for the CCW and AP VFIO device types.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250901064631.530723-8-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst       |  12 -
 docs/about/removed-features.rst |   9 +
 hw/arm/Kconfig                  |   1 -
 hw/arm/virt.c                   |   2 -
 hw/vfio/Kconfig                 |   6 -
 hw/vfio/meson.build             |   1 -
 hw/vfio/platform.c              | 716 --------------------------------
 hw/vfio/trace-events            |  11 -
 include/hw/vfio/vfio-device.h   |   2 +-
 include/hw/vfio/vfio-platform.h |  78 ----
 10 files changed, 10 insertions(+), 828 deletions(-)
 delete mode 100644 hw/vfio/platform.c
 delete mode 100644 include/hw/vfio/vfio-platform.h

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index d0fa8e5536..2fa2c47b68 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -488,18 +488,6 @@ Stream ``reconnect`` (since 9.2)
 The ``reconnect`` option only allows specifying second granularity timeouts,
 which is not enough for all types of use cases, use ``reconnect-ms`` instead.
 
-VFIO device options
-'''''''''''''''''''
-
-``-device vfio-platform`` (since 10.0)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-The vfio-platform device allows to assign a host platform device
-to a guest in a generic manner. Integrating a new device into
-the vfio-platform infrastructure requires some adaptation at
-both kernel and qemu level. No such attempt has been done for years
-and the conclusion is that vfio-platform has not got any traction.
-PCIe passthrough shall be the mainline solution.
-
 CPU device properties
 '''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index db3f22941c..2d3a684e53 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1296,6 +1296,15 @@ The vfio-amd-xgbe device allows to assign a host AMD 10GbE controller
 to a guest ("amd,xgbe-seattle-v1a" compatibility string). AMD "Seattle"
 is not supported anymore and there is no point keeping that device.
 
+``-device vfio-platform`` (since 10.2)
+''''''''''''''''''''''''''''''''''''''
+The vfio-platform device allows to assign a host platform device
+to a guest in a generic manner. Integrating a new device into
+the vfio-platform infrastructure requires some adaptation at
+both kernel and qemu level. No such attempt has been done for years
+and the conclusion is that vfio-platform has not got any traction.
+PCIe passthrough shall be the mainline solution.
+
 Tools
 -----
 
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 3fca48349a..3baa6c6c74 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -5,7 +5,6 @@ config ARM_VIRT
     depends on TCG || KVM || HVF
     imply PCI_DEVICES
     imply TEST_DEVICES
-    imply VFIO_PLATFORM
     imply TPM_TIS_SYSBUS
     imply TPM_TIS_I2C
     imply NVDIMM
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6a887228bb..6f01746e74 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -38,7 +38,6 @@
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
 #include "hw/block/flash.h"
-#include "hw/vfio/vfio-platform.h"
 #include "hw/display/ramfb.h"
 #include "net/net.h"
 #include "system/device_tree.h"
@@ -3218,7 +3217,6 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
      */
     mc->max_cpus = 512;
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
-    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
 #ifdef CONFIG_TPM
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
diff --git a/hw/vfio/Kconfig b/hw/vfio/Kconfig
index 9a1dbe2926..27de24e4db 100644
--- a/hw/vfio/Kconfig
+++ b/hw/vfio/Kconfig
@@ -17,12 +17,6 @@ config VFIO_CCW
     select VFIO
     depends on LINUX && S390_CCW_VIRTIO
 
-config VFIO_PLATFORM
-    bool
-    default y
-    select VFIO
-    depends on LINUX && PLATFORM_BUS
-
 config VFIO_AP
     bool
     default y
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 06473a0789..d3ed3cb7ac 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -13,7 +13,6 @@ vfio_ss.add(when: 'CONFIG_VFIO_PCI', if_true: files(
   'pci.c',
 ))
 vfio_ss.add(when: 'CONFIG_VFIO_CCW', if_true: files('ccw.c'))
-vfio_ss.add(when: 'CONFIG_VFIO_PLATFORM', if_true: files('platform.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_AP', if_true: files('ap.c'))
 vfio_ss.add(when: 'CONFIG_VFIO_IGD', if_true: files('igd.c'))
 
diff --git a/hw/vfio/platform.c b/hw/vfio/platform.c
deleted file mode 100644
index 5c1795a26f..0000000000
--- a/hw/vfio/platform.c
+++ /dev/null
@@ -1,716 +0,0 @@
-/*
- * vfio based device assignment support - platform devices
- *
- * Copyright Linaro Limited, 2014
- *
- * Authors:
- *  Kim Phillips <kim.phillips@linaro.org>
- *  Eric Auger <eric.auger@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Based on vfio based PCI device assignment support:
- *  Copyright Red Hat, Inc. 2012
- */
-
-#include "qemu/osdep.h"
-#include CONFIG_DEVICES /* CONFIG_IOMMUFD */
-#include "qapi/error.h"
-#include <sys/ioctl.h>
-#include <linux/vfio.h>
-
-#include "hw/vfio/vfio-platform.h"
-#include "system/iommufd.h"
-#include "migration/vmstate.h"
-#include "qemu/error-report.h"
-#include "qemu/lockable.h"
-#include "qemu/main-loop.h"
-#include "qemu/module.h"
-#include "qemu/range.h"
-#include "system/memory.h"
-#include "system/address-spaces.h"
-#include "qemu/queue.h"
-#include "hw/sysbus.h"
-#include "trace.h"
-#include "hw/irq.h"
-#include "hw/platform-bus.h"
-#include "hw/qdev-properties.h"
-#include "system/kvm.h"
-#include "hw/vfio/vfio-region.h"
-
-/*
- * Functions used whatever the injection method
- */
-
-static inline bool vfio_irq_is_automasked(VFIOINTp *intp)
-{
-    return intp->flags & VFIO_IRQ_INFO_AUTOMASKED;
-}
-
-/**
- * vfio_init_intp - allocate, initialize the IRQ struct pointer
- * and add it into the list of IRQs
- * @vbasedev: the VFIO device handle
- * @info: irq info struct retrieved from VFIO driver
- * @errp: error object
- */
-static VFIOINTp *vfio_init_intp(VFIODevice *vbasedev,
-                                struct vfio_irq_info info, Error **errp)
-{
-    int ret;
-    VFIOPlatformDevice *vdev =
-        container_of(vbasedev, VFIOPlatformDevice, vbasedev);
-    SysBusDevice *sbdev = SYS_BUS_DEVICE(vdev);
-    VFIOINTp *intp;
-
-    intp = g_malloc0(sizeof(*intp));
-    intp->vdev = vdev;
-    intp->pin = info.index;
-    intp->flags = info.flags;
-    intp->state = VFIO_IRQ_INACTIVE;
-    intp->kvm_accel = false;
-
-    sysbus_init_irq(sbdev, &intp->qemuirq);
-
-    /* Get an eventfd for trigger */
-    intp->interrupt = g_new0(EventNotifier, 1);
-    ret = event_notifier_init(intp->interrupt, 0);
-    if (ret) {
-        g_free(intp->interrupt);
-        g_free(intp);
-        error_setg_errno(errp, -ret,
-                         "failed to initialize trigger eventfd notifier");
-        return NULL;
-    }
-    if (vfio_irq_is_automasked(intp)) {
-        /* Get an eventfd for resample/unmask */
-        intp->unmask = g_new0(EventNotifier, 1);
-        ret = event_notifier_init(intp->unmask, 0);
-        if (ret) {
-            g_free(intp->interrupt);
-            g_free(intp->unmask);
-            g_free(intp);
-            error_setg_errno(errp, -ret,
-                             "failed to initialize resample eventfd notifier");
-            return NULL;
-        }
-    }
-
-    QLIST_INSERT_HEAD(&vdev->intp_list, intp, next);
-    return intp;
-}
-
-/**
- * vfio_set_trigger_eventfd - set VFIO eventfd handling
- *
- * @intp: IRQ struct handle
- * @handler: handler to be called on eventfd signaling
- *
- * Setup VFIO signaling and attach an optional user-side handler
- * to the eventfd
- */
-static int vfio_set_trigger_eventfd(VFIOINTp *intp,
-                                    eventfd_user_side_handler_t handler)
-{
-    VFIODevice *vbasedev = &intp->vdev->vbasedev;
-    int32_t fd = event_notifier_get_fd(intp->interrupt);
-    Error *err = NULL;
-
-    qemu_set_fd_handler(fd, (IOHandler *)handler, NULL, intp);
-
-    if (!vfio_device_irq_set_signaling(vbasedev, intp->pin, 0,
-                                       VFIO_IRQ_SET_ACTION_TRIGGER, fd, &err)) {
-        error_reportf_err(err, VFIO_MSG_PREFIX, vbasedev->name);
-        qemu_set_fd_handler(fd, NULL, NULL, NULL);
-        return -EINVAL;
-    }
-
-    return 0;
-}
-
-/*
- * Functions only used when eventfds are handled on user-side
- * ie. without irqfd
- */
-
-/**
- * vfio_mmap_set_enabled - enable/disable the fast path mode
- * @vdev: the VFIO platform device
- * @enabled: the target mmap state
- *
- * enabled = true ~ fast path = MMIO region is mmaped (no KVM TRAP);
- * enabled = false ~ slow path = MMIO region is trapped and region callbacks
- * are called; slow path enables to trap the device IRQ status register reset
-*/
-
-static void vfio_mmap_set_enabled(VFIOPlatformDevice *vdev, bool enabled)
-{
-    int i;
-
-    for (i = 0; i < vdev->vbasedev.num_regions; i++) {
-        vfio_region_mmaps_set_enabled(vdev->regions[i], enabled);
-    }
-}
-
-/**
- * vfio_intp_mmap_enable - timer function, restores the fast path
- * if there is no more active IRQ
- * @opaque: actually points to the VFIO platform device
- *
- * Called on mmap timer timeout, this function checks whether the
- * IRQ is still active and if not, restores the fast path.
- * by construction a single eventfd is handled at a time.
- * if the IRQ is still active, the timer is re-programmed.
- */
-static void vfio_intp_mmap_enable(void *opaque)
-{
-    VFIOINTp *tmp;
-    VFIOPlatformDevice *vdev = (VFIOPlatformDevice *)opaque;
-
-    QEMU_LOCK_GUARD(&vdev->intp_mutex);
-    QLIST_FOREACH(tmp, &vdev->intp_list, next) {
-        if (tmp->state == VFIO_IRQ_ACTIVE) {
-            trace_vfio_platform_intp_mmap_enable(tmp->pin);
-            /* re-program the timer to check active status later */
-            timer_mod(vdev->mmap_timer,
-                      qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-                          vdev->mmap_timeout);
-            return;
-        }
-    }
-    vfio_mmap_set_enabled(vdev, true);
-}
-
-/**
- * vfio_intp_inject_pending_lockheld - Injects a pending IRQ
- * @opaque: opaque pointer, in practice the VFIOINTp handle
- *
- * The function is called on a previous IRQ completion, from
- * vfio_platform_eoi, while the intp_mutex is locked.
- * Also in such situation, the slow path already is set and
- * the mmap timer was already programmed.
- */
-static void vfio_intp_inject_pending_lockheld(VFIOINTp *intp)
-{
-    trace_vfio_platform_intp_inject_pending_lockheld(intp->pin,
-                              event_notifier_get_fd(intp->interrupt));
-
-    intp->state = VFIO_IRQ_ACTIVE;
-
-    /* trigger the virtual IRQ */
-    qemu_set_irq(intp->qemuirq, 1);
-}
-
-/**
- * vfio_intp_interrupt - The user-side eventfd handler
- * @opaque: opaque pointer which in practice is the VFIOINTp handle
- *
- * the function is entered in event handler context:
- * the vIRQ is injected into the guest if there is no other active
- * or pending IRQ.
- */
-static void vfio_intp_interrupt(VFIOINTp *intp)
-{
-    int ret;
-    VFIOINTp *tmp;
-    VFIOPlatformDevice *vdev = intp->vdev;
-    bool delay_handling = false;
-
-    QEMU_LOCK_GUARD(&vdev->intp_mutex);
-    if (intp->state == VFIO_IRQ_INACTIVE) {
-        QLIST_FOREACH(tmp, &vdev->intp_list, next) {
-            if (tmp->state == VFIO_IRQ_ACTIVE ||
-                tmp->state == VFIO_IRQ_PENDING) {
-                delay_handling = true;
-                break;
-            }
-        }
-    }
-    if (delay_handling) {
-        /*
-         * the new IRQ gets a pending status and is pushed in
-         * the pending queue
-         */
-        intp->state = VFIO_IRQ_PENDING;
-        trace_vfio_intp_interrupt_set_pending(intp->pin);
-        QSIMPLEQ_INSERT_TAIL(&vdev->pending_intp_queue,
-                             intp, pqnext);
-        event_notifier_test_and_clear(intp->interrupt);
-        return;
-    }
-
-    trace_vfio_platform_intp_interrupt(intp->pin,
-                              event_notifier_get_fd(intp->interrupt));
-
-    ret = event_notifier_test_and_clear(intp->interrupt);
-    if (!ret) {
-        error_report("Error when clearing fd=%d (ret = %d)",
-                     event_notifier_get_fd(intp->interrupt), ret);
-    }
-
-    intp->state = VFIO_IRQ_ACTIVE;
-
-    /* sets slow path */
-    vfio_mmap_set_enabled(vdev, false);
-
-    /* trigger the virtual IRQ */
-    qemu_set_irq(intp->qemuirq, 1);
-
-    /*
-     * Schedule the mmap timer which will restore fastpath when no IRQ
-     * is active anymore
-     */
-    if (vdev->mmap_timeout) {
-        timer_mod(vdev->mmap_timer,
-                  qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-                      vdev->mmap_timeout);
-    }
-}
-
-/**
- * vfio_platform_eoi - IRQ completion routine
- * @vbasedev: the VFIO device handle
- *
- * De-asserts the active virtual IRQ and unmasks the physical IRQ
- * (effective for level sensitive IRQ auto-masked by the  VFIO driver).
- * Then it handles next pending IRQ if any.
- * eoi function is called on the first access to any MMIO region
- * after an IRQ was triggered, trapped since slow path was set.
- * It is assumed this access corresponds to the IRQ status
- * register reset. With such a mechanism, a single IRQ can be
- * handled at a time since there is no way to know which IRQ
- * was completed by the guest (we would need additional details
- * about the IRQ status register mask).
- */
-static void vfio_platform_eoi(VFIODevice *vbasedev)
-{
-    VFIOINTp *intp;
-    VFIOPlatformDevice *vdev =
-        container_of(vbasedev, VFIOPlatformDevice, vbasedev);
-
-    QEMU_LOCK_GUARD(&vdev->intp_mutex);
-    QLIST_FOREACH(intp, &vdev->intp_list, next) {
-        if (intp->state == VFIO_IRQ_ACTIVE) {
-            trace_vfio_platform_eoi(intp->pin,
-                                event_notifier_get_fd(intp->interrupt));
-            intp->state = VFIO_IRQ_INACTIVE;
-
-            /* deassert the virtual IRQ */
-            qemu_set_irq(intp->qemuirq, 0);
-
-            if (vfio_irq_is_automasked(intp)) {
-                /* unmasks the physical level-sensitive IRQ */
-                vfio_device_irq_unmask(vbasedev, intp->pin);
-            }
-
-            /* a single IRQ can be active at a time */
-            break;
-        }
-    }
-    /* in case there are pending IRQs, handle the first one */
-    if (!QSIMPLEQ_EMPTY(&vdev->pending_intp_queue)) {
-        intp = QSIMPLEQ_FIRST(&vdev->pending_intp_queue);
-        vfio_intp_inject_pending_lockheld(intp);
-        QSIMPLEQ_REMOVE_HEAD(&vdev->pending_intp_queue, pqnext);
-    }
-}
-
-/**
- * vfio_start_eventfd_injection - starts the virtual IRQ injection using
- * user-side handled eventfds
- * @sbdev: the sysbus device handle
- * @irq: the qemu irq handle
- */
-
-static void vfio_start_eventfd_injection(SysBusDevice *sbdev, qemu_irq irq)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(sbdev);
-    VFIOINTp *intp;
-
-    QLIST_FOREACH(intp, &vdev->intp_list, next) {
-        if (intp->qemuirq == irq) {
-            break;
-        }
-    }
-    assert(intp);
-
-    if (vfio_set_trigger_eventfd(intp, vfio_intp_interrupt)) {
-        abort();
-    }
-}
-
-/*
- * Functions used for irqfd
- */
-
-/**
- * vfio_set_resample_eventfd - sets the resamplefd for an IRQ
- * @intp: the IRQ struct handle
- * programs the VFIO driver to unmask this IRQ when the
- * intp->unmask eventfd is triggered
- */
-static int vfio_set_resample_eventfd(VFIOINTp *intp)
-{
-    int32_t fd = event_notifier_get_fd(intp->unmask);
-    VFIODevice *vbasedev = &intp->vdev->vbasedev;
-    Error *err = NULL;
-
-    qemu_set_fd_handler(fd, NULL, NULL, NULL);
-    if (!vfio_device_irq_set_signaling(vbasedev, intp->pin, 0,
-                                       VFIO_IRQ_SET_ACTION_UNMASK, fd, &err)) {
-        error_reportf_err(err, VFIO_MSG_PREFIX, vbasedev->name);
-        return -EINVAL;
-    }
-    return 0;
-}
-
-/**
- * vfio_start_irqfd_injection - starts the virtual IRQ injection using
- * irqfd
- *
- * @sbdev: the sysbus device handle
- * @irq: the qemu irq handle
- *
- * In case the irqfd setup fails, we fallback to userspace handled eventfd
- */
-static void vfio_start_irqfd_injection(SysBusDevice *sbdev, qemu_irq irq)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(sbdev);
-    VFIOINTp *intp;
-
-    if (!kvm_irqfds_enabled() || !kvm_resamplefds_enabled() ||
-        !vdev->irqfd_allowed) {
-        goto fail_irqfd;
-    }
-
-    QLIST_FOREACH(intp, &vdev->intp_list, next) {
-        if (intp->qemuirq == irq) {
-            break;
-        }
-    }
-    assert(intp);
-
-    if (kvm_irqchip_add_irqfd_notifier(kvm_state, intp->interrupt,
-                                   intp->unmask, irq) < 0) {
-        goto fail_irqfd;
-    }
-
-    if (vfio_set_trigger_eventfd(intp, NULL) < 0) {
-        goto fail_vfio;
-    }
-    if (vfio_irq_is_automasked(intp)) {
-        if (vfio_set_resample_eventfd(intp) < 0) {
-            goto fail_vfio;
-        }
-        trace_vfio_platform_start_level_irqfd_injection(intp->pin,
-                                    event_notifier_get_fd(intp->interrupt),
-                                    event_notifier_get_fd(intp->unmask));
-    } else {
-        trace_vfio_platform_start_edge_irqfd_injection(intp->pin,
-                                    event_notifier_get_fd(intp->interrupt));
-    }
-
-    intp->kvm_accel = true;
-
-    return;
-fail_vfio:
-    kvm_irqchip_remove_irqfd_notifier(kvm_state, intp->interrupt, irq);
-    abort();
-fail_irqfd:
-    vfio_start_eventfd_injection(sbdev, irq);
-}
-
-/* VFIO skeleton */
-
-static void vfio_platform_compute_needs_reset(VFIODevice *vbasedev)
-{
-    vbasedev->needs_reset = true;
-}
-
-/* not implemented yet */
-static int vfio_platform_hot_reset_multi(VFIODevice *vbasedev)
-{
-    return -1;
-}
-
-/**
- * vfio_populate_device - Allocate and populate MMIO region
- * and IRQ structs according to driver returned information
- * @vbasedev: the VFIO device handle
- * @errp: error object
- *
- */
-static bool vfio_populate_device(VFIODevice *vbasedev, Error **errp)
-{
-    VFIOINTp *intp, *tmp;
-    int i, ret = -1;
-    VFIOPlatformDevice *vdev =
-        container_of(vbasedev, VFIOPlatformDevice, vbasedev);
-
-    if (!(vbasedev->flags & VFIO_DEVICE_FLAGS_PLATFORM)) {
-        error_setg(errp, "this isn't a platform device");
-        return false;
-    }
-
-    vdev->regions = g_new0(VFIORegion *, vbasedev->num_regions);
-
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        char *name = g_strdup_printf("VFIO %s region %d\n", vbasedev->name, i);
-
-        vdev->regions[i] = g_new0(VFIORegion, 1);
-        ret = vfio_region_setup(OBJECT(vdev), vbasedev,
-                                vdev->regions[i], i, name);
-        g_free(name);
-        if (ret) {
-            error_setg_errno(errp, -ret, "failed to get region %d info", i);
-            goto reg_error;
-        }
-    }
-
-    vdev->mmap_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
-                                    vfio_intp_mmap_enable, vdev);
-
-    QSIMPLEQ_INIT(&vdev->pending_intp_queue);
-
-    for (i = 0; i < vbasedev->num_irqs; i++) {
-        struct vfio_irq_info irq;
-
-        ret = vfio_device_get_irq_info(vbasedev, i, &irq);
-
-        if (ret) {
-            error_setg_errno(errp, -ret, "failed to get device irq info");
-            goto irq_err;
-        } else {
-            trace_vfio_platform_populate_interrupts(irq.index,
-                                                    irq.count,
-                                                    irq.flags);
-            intp = vfio_init_intp(vbasedev, irq, errp);
-            if (!intp) {
-                goto irq_err;
-            }
-        }
-    }
-    return true;
-irq_err:
-    timer_del(vdev->mmap_timer);
-    QLIST_FOREACH_SAFE(intp, &vdev->intp_list, next, tmp) {
-        QLIST_REMOVE(intp, next);
-        g_free(intp);
-    }
-reg_error:
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        if (vdev->regions[i]) {
-            vfio_region_finalize(vdev->regions[i]);
-        }
-        g_free(vdev->regions[i]);
-    }
-    g_free(vdev->regions);
-    return false;
-}
-
-/* specialized functions for VFIO Platform devices */
-static VFIODeviceOps vfio_platform_ops = {
-    .vfio_compute_needs_reset = vfio_platform_compute_needs_reset,
-    .vfio_hot_reset_multi = vfio_platform_hot_reset_multi,
-    .vfio_eoi = vfio_platform_eoi,
-};
-
-/**
- * vfio_base_device_init - perform preliminary VFIO setup
- * @vbasedev: the VFIO device handle
- * @errp: error object
- *
- * Implement the VFIO command sequence that allows to discover
- * assigned device resources: group extraction, device
- * fd retrieval, resource query.
- * Precondition: the device name must be initialized
- */
-static bool vfio_base_device_init(VFIODevice *vbasedev, Error **errp)
-{
-    /* @fd takes precedence over @sysfsdev which takes precedence over @host */
-    if (vbasedev->fd < 0 && vbasedev->sysfsdev) {
-        vfio_device_free_name(vbasedev);
-        vbasedev->name = g_path_get_basename(vbasedev->sysfsdev);
-    } else if (vbasedev->fd < 0) {
-        if (!vbasedev->name || strchr(vbasedev->name, '/')) {
-            error_setg(errp, "wrong host device name");
-            return false;
-        }
-
-        vbasedev->sysfsdev = g_strdup_printf("/sys/bus/platform/devices/%s",
-                                             vbasedev->name);
-    }
-
-    if (!vfio_device_get_name(vbasedev, errp)) {
-        return false;
-    }
-
-    if (!vfio_device_attach(vbasedev->name, vbasedev,
-                            &address_space_memory, errp)) {
-        return false;
-    }
-
-    if (vfio_populate_device(vbasedev, errp)) {
-        return true;
-    }
-
-    vfio_device_detach(vbasedev);
-    return false;
-}
-
-/**
- * vfio_platform_realize  - the device realize function
- * @dev: device state pointer
- * @errp: error
- *
- * initialize the device, its memory regions and IRQ structures
- * IRQ are started separately
- */
-static void vfio_platform_realize(DeviceState *dev, Error **errp)
-{
-    ERRP_GUARD();
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(dev);
-    SysBusDevice *sbdev = SYS_BUS_DEVICE(dev);
-    VFIODevice *vbasedev = &vdev->vbasedev;
-    int i;
-
-    warn_report("-device vfio-platform is deprecated");
-    qemu_mutex_init(&vdev->intp_mutex);
-
-    trace_vfio_platform_realize(vbasedev->sysfsdev ?
-                                vbasedev->sysfsdev : vbasedev->name,
-                                vdev->compat);
-
-    if (!vfio_base_device_init(vbasedev, errp)) {
-        goto init_err;
-    }
-
-    if (!vdev->compat) {
-        GError *gerr = NULL;
-        gchar *contents;
-        gsize length;
-        char *path;
-
-        path = g_strdup_printf("%s/of_node/compatible", vbasedev->sysfsdev);
-        if (!g_file_get_contents(path, &contents, &length, &gerr)) {
-            error_setg(errp, "%s", gerr->message);
-            g_error_free(gerr);
-            g_free(path);
-            return;
-        }
-        g_free(path);
-        vdev->compat = contents;
-        for (vdev->num_compat = 0; length; vdev->num_compat++) {
-            size_t skip = strlen(contents) + 1;
-            contents += skip;
-            length -= skip;
-        }
-    }
-
-    for (i = 0; i < vbasedev->num_regions; i++) {
-        if (vfio_region_mmap(vdev->regions[i])) {
-            warn_report("%s mmap unsupported, performance may be slow",
-                        memory_region_name(vdev->regions[i]->mem));
-        }
-        sysbus_init_mmio(sbdev, vdev->regions[i]->mem);
-    }
-    return;
-
-init_err:
-    if (vdev->vbasedev.name) {
-        error_prepend(errp, VFIO_MSG_PREFIX, vdev->vbasedev.name);
-    } else {
-        error_prepend(errp, "vfio error: ");
-    }
-}
-
-static const VMStateDescription vfio_platform_vmstate = {
-    .name = "vfio-platform",
-    .unmigratable = 1,
-};
-
-static const Property vfio_platform_dev_properties[] = {
-    DEFINE_PROP_STRING("host", VFIOPlatformDevice, vbasedev.name),
-    DEFINE_PROP_STRING("sysfsdev", VFIOPlatformDevice, vbasedev.sysfsdev),
-    DEFINE_PROP_BOOL("x-no-mmap", VFIOPlatformDevice, vbasedev.no_mmap, false),
-    DEFINE_PROP_UINT32("mmap-timeout-ms", VFIOPlatformDevice,
-                       mmap_timeout, 1100),
-    DEFINE_PROP_BOOL("x-irqfd", VFIOPlatformDevice, irqfd_allowed, true),
-#ifdef CONFIG_IOMMUFD
-    DEFINE_PROP_LINK("iommufd", VFIOPlatformDevice, vbasedev.iommufd,
-                     TYPE_IOMMUFD_BACKEND, IOMMUFDBackend *),
-#endif
-};
-
-static void vfio_platform_instance_init(Object *obj)
-{
-    VFIOPlatformDevice *vdev = VFIO_PLATFORM_DEVICE(obj);
-    VFIODevice *vbasedev = &vdev->vbasedev;
-
-    vfio_device_init(vbasedev, VFIO_DEVICE_TYPE_PLATFORM, &vfio_platform_ops,
-                     DEVICE(vdev), false);
-}
-
-#ifdef CONFIG_IOMMUFD
-static void vfio_platform_set_fd(Object *obj, const char *str, Error **errp)
-{
-    vfio_device_set_fd(&VFIO_PLATFORM_DEVICE(obj)->vbasedev, str, errp);
-}
-#endif
-
-static void vfio_platform_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    SysBusDeviceClass *sbc = SYS_BUS_DEVICE_CLASS(klass);
-
-    dc->realize = vfio_platform_realize;
-    device_class_set_props(dc, vfio_platform_dev_properties);
-#ifdef CONFIG_IOMMUFD
-    object_class_property_add_str(klass, "fd", NULL, vfio_platform_set_fd);
-#endif
-    dc->vmsd = &vfio_platform_vmstate;
-    dc->desc = "VFIO-based platform device assignment";
-    sbc->connect_irq_notifier = vfio_start_irqfd_injection;
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-
-    object_class_property_set_description(klass, /* 2.4 */
-                                          "host",
-                                          "Host device name of assigned device");
-    object_class_property_set_description(klass, /* 2.4 and 2.5 */
-                                          "x-no-mmap",
-                                          "Disable MMAP for device. Allows to trace MMIO "
-                                          "accesses (DEBUG)");
-    object_class_property_set_description(klass, /* 2.4 */
-                                          "mmap-timeout-ms",
-                                          "When EOI is not provided by KVM/QEMU, wait time "
-                                          "(milliseconds) to re-enable device direct access "
-                                          "after level interrupt (DEBUG)");
-    object_class_property_set_description(klass, /* 2.4 */
-                                          "x-irqfd",
-                                          "Allow disabling irqfd support (DEBUG)");
-    object_class_property_set_description(klass, /* 2.6 */
-                                          "sysfsdev",
-                                          "Host sysfs path of assigned device");
-#ifdef CONFIG_IOMMUFD
-    object_class_property_set_description(klass, /* 9.0 */
-                                          "iommufd",
-                                          "Set host IOMMUFD backend device");
-#endif
-}
-
-static const TypeInfo vfio_platform_dev_info = {
-    .name = TYPE_VFIO_PLATFORM,
-    .parent = TYPE_DYNAMIC_SYS_BUS_DEVICE,
-    .instance_size = sizeof(VFIOPlatformDevice),
-    .instance_init = vfio_platform_instance_init,
-    .class_init = vfio_platform_class_init,
-    .class_size = sizeof(VFIOPlatformDeviceClass),
-};
-
-static void register_vfio_platform_dev_type(void)
-{
-    type_register_static(&vfio_platform_dev_info);
-}
-
-type_init(register_vfio_platform_dev_type)
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index fc6ed230d0..e3d571f8c8 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -127,17 +127,6 @@ vfio_region_unmap(const char *name, unsigned long offset, unsigned long end) "Re
 vfio_region_sparse_mmap_header(const char *name, int index, int nr_areas) "Device %s region %d: %d sparse mmap entries"
 vfio_region_sparse_mmap_entry(int i, unsigned long start, unsigned long end) "sparse entry %d [0x%lx - 0x%lx]"
 
-# platform.c
-vfio_platform_realize(char *name, char *compat) "vfio device %s, compat = %s"
-vfio_platform_eoi(int pin, int fd) "EOI IRQ pin %d (fd=%d)"
-vfio_platform_intp_mmap_enable(int pin) "IRQ #%d still active, stay in slow path"
-vfio_platform_intp_interrupt(int pin, int fd) "Inject IRQ #%d (fd = %d)"
-vfio_platform_intp_inject_pending_lockheld(int pin, int fd) "Inject pending IRQ #%d (fd = %d)"
-vfio_platform_populate_interrupts(int pin, int count, int flags) "- IRQ index %d: count %d, flags=0x%x"
-vfio_intp_interrupt_set_pending(int index) "irq %d is set PENDING"
-vfio_platform_start_level_irqfd_injection(int index, int fd, int resamplefd) "IRQ index=%d, fd = %d, resamplefd = %d"
-vfio_platform_start_edge_irqfd_injection(int index, int fd) "IRQ index=%d, fd = %d"
-
 # spapr.c
 vfio_prereg_listener_region_add_skip(uint64_t start, uint64_t end) "0x%"PRIx64" - 0x%"PRIx64
 vfio_prereg_listener_region_del_skip(uint64_t start, uint64_t end) "0x%"PRIx64" - 0x%"PRIx64
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 6e4d5ccdac..e7e6243e2d 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -36,7 +36,7 @@
 
 enum {
     VFIO_DEVICE_TYPE_PCI = 0,
-    VFIO_DEVICE_TYPE_PLATFORM = 1,
+    VFIO_DEVICE_TYPE_UNUSED = 1,
     VFIO_DEVICE_TYPE_CCW = 2,
     VFIO_DEVICE_TYPE_AP = 3,
 };
diff --git a/include/hw/vfio/vfio-platform.h b/include/hw/vfio/vfio-platform.h
deleted file mode 100644
index 256d8500b7..0000000000
--- a/include/hw/vfio/vfio-platform.h
+++ /dev/null
@@ -1,78 +0,0 @@
-/*
- * vfio based device assignment support - platform devices
- *
- * Copyright Linaro Limited, 2014
- *
- * Authors:
- *  Kim Phillips <kim.phillips@linaro.org>
- *
- * This work is licensed under the terms of the GNU GPL, version 2.  See
- * the COPYING file in the top-level directory.
- *
- * Based on vfio based PCI device assignment support:
- *  Copyright Red Hat, Inc. 2012
- */
-
-#ifndef HW_VFIO_VFIO_PLATFORM_H
-#define HW_VFIO_VFIO_PLATFORM_H
-
-#include "hw/sysbus.h"
-#include "hw/vfio/vfio-device.h"
-#include "qemu/event_notifier.h"
-#include "qemu/queue.h"
-#include "qom/object.h"
-
-#define TYPE_VFIO_PLATFORM "vfio-platform"
-
-enum {
-    VFIO_IRQ_INACTIVE = 0,
-    VFIO_IRQ_PENDING = 1,
-    VFIO_IRQ_ACTIVE = 2,
-    /* VFIO_IRQ_ACTIVE_AND_PENDING cannot happen with VFIO */
-};
-
-typedef struct VFIOINTp {
-    QLIST_ENTRY(VFIOINTp) next; /* entry for IRQ list */
-    QSIMPLEQ_ENTRY(VFIOINTp) pqnext; /* entry for pending IRQ queue */
-    EventNotifier *interrupt; /* eventfd triggered on interrupt */
-    EventNotifier *unmask; /* eventfd for unmask on QEMU bypass */
-    qemu_irq qemuirq;
-    struct VFIOPlatformDevice *vdev; /* back pointer to device */
-    int state; /* inactive, pending, active */
-    uint8_t pin; /* index */
-    uint32_t flags; /* IRQ info flags */
-    bool kvm_accel; /* set when QEMU bypass through KVM enabled */
-} VFIOINTp;
-
-/* function type for user side eventfd handler */
-typedef void (*eventfd_user_side_handler_t)(VFIOINTp *intp);
-
-typedef struct VFIORegion VFIORegion;
-
-struct VFIOPlatformDevice {
-    SysBusDevice sbdev;
-    VFIODevice vbasedev; /* not a QOM object */
-    VFIORegion **regions;
-    QLIST_HEAD(, VFIOINTp) intp_list; /* list of IRQs */
-    /* queue of pending IRQs */
-    QSIMPLEQ_HEAD(, VFIOINTp) pending_intp_queue;
-    char *compat; /* DT compatible values, separated by NUL */
-    unsigned int num_compat; /* number of compatible values */
-    uint32_t mmap_timeout; /* delay to re-enable mmaps after interrupt */
-    QEMUTimer *mmap_timer; /* allows fast-path resume after IRQ hit */
-    QemuMutex intp_mutex; /* protect the intp_list IRQ state */
-    bool irqfd_allowed; /* debug option to force irqfd on/off */
-};
-typedef struct VFIOPlatformDevice VFIOPlatformDevice;
-
-struct VFIOPlatformDeviceClass {
-    /*< private >*/
-    SysBusDeviceClass parent_class;
-    /*< public >*/
-};
-typedef struct VFIOPlatformDeviceClass VFIOPlatformDeviceClass;
-
-DECLARE_OBJ_CHECKERS(VFIOPlatformDevice, VFIOPlatformDeviceClass,
-                     VFIO_PLATFORM_DEVICE, TYPE_VFIO_PLATFORM)
-
-#endif /* HW_VFIO_VFIO_PLATFORM_H */

From e7a47f717718441b546090fe3fa91e2705ca125b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 1 Sep 2025 08:46:31 +0200
Subject: [PATCH 0331/2396] vfio: Move vfio-region.h under hw/vfio/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since the removal of vfio-platform, header file vfio-region.h no
longer needs to be a public VFIO interface. Move it under hw/vfio.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250901064631.530723-9-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 {include/hw => hw}/vfio/vfio-region.h | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 rename {include/hw => hw}/vfio/vfio-region.h (100%)

diff --git a/include/hw/vfio/vfio-region.h b/hw/vfio/vfio-region.h
similarity index 100%
rename from include/hw/vfio/vfio-region.h
rename to hw/vfio/vfio-region.h

From 36cd81dc139f899127d868ba9baaf3079c336efc Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 13 Aug 2025 07:17:47 -0700
Subject: [PATCH 0332/2396] vfio/container: set error on cpr failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Set an error message if vfio_cpr_ram_discard_register_listener fails so
the fail label gets a valid error object.

Reported-by: Cédric Le Goater <clg@redhat.com>
Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/1755094667-281419-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index f498e23a93..5ebafaa07e 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -574,6 +574,9 @@ void vfio_container_region_add(VFIOContainerBase *bcontainer,
             vfio_ram_discard_register_listener(bcontainer, section);
         } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
                                                            section)) {
+            error_setg(&err,
+                       "vfio_cpr_ram_discard_register_listener for %s failed",
+                       memory_region_name(section->mr));
             goto fail;
         }
         return;

From ceb59c1cc61dee57c8806571e7c723e555914547 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Thu, 14 Aug 2025 17:34:19 +0200
Subject: [PATCH 0333/2396] vfio: Report an error when the 'dma_max_mappings'
 limit is reached
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VFIO IOMMU Type1 kernel driver enforces a default IOMMU mapping
limit of 65535, which is configurable via the 'dma_max_mappings'
module parameter. When this limit is reached, QEMU issues a warning
and fails the mapping operation, but allows the VM to continue
running, potentially causing issues later. This scenario occurs with
SEV-SNP guests, which must update all IOMMU mappings during
initialization.

To address this, update vfio_ram_discard_register_listener() to accept
an 'Error **' parameter and propagate the error to the caller. This
change will halt the VM immediately, at init time, with the same error
message.

Additionally, the same behavior will be enforced at runtime. While
this might be considered too brutal, the rarity of this case and the
planned removal of the dma_max_mappings module parameter make it a
reasonable approach.

Cc: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250814153419.1643897-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 5ebafaa07e..c244be5e21 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -250,8 +250,9 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
     return 0;
 }
 
-static void vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
-                                               MemoryRegionSection *section)
+static bool vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
+                                               MemoryRegionSection *section,
+                                               Error **errp)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
     int target_page_size = qemu_target_page_size();
@@ -316,13 +317,15 @@ static void vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
 
         if (vrdl_mappings + max_memslots - vrdl_count >
             bcontainer->dma_max_mappings) {
-            warn_report("%s: possibly running out of DMA mappings. E.g., try"
+            error_setg(errp, "%s: possibly running out of DMA mappings. E.g., try"
                         " increasing the 'block-size' of virtio-mem devies."
                         " Maximum possible DMA mappings: %d, Maximum possible"
                         " memslots: %d", __func__, bcontainer->dma_max_mappings,
                         max_memslots);
+            return false;
         }
     }
+    return true;
 }
 
 static void vfio_ram_discard_unregister_listener(VFIOContainerBase *bcontainer,
@@ -571,7 +574,9 @@ void vfio_container_region_add(VFIOContainerBase *bcontainer,
      */
     if (memory_region_has_ram_discard_manager(section->mr)) {
         if (!cpr_remap) {
-            vfio_ram_discard_register_listener(bcontainer, section);
+            if (!vfio_ram_discard_register_listener(bcontainer, section, &err)) {
+                goto fail;
+            }
         } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
                                                            section)) {
             error_setg(&err,

From 1b50621881241ac5bc75ae7f8aa4c278ada8a668 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 27 Aug 2025 20:08:10 +0100
Subject: [PATCH 0334/2396] hw/vfio-user: add x-pci-class-code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This new option was not added to vfio_user_pci_dev_properties, which
caused an incorrect class code for vfio-user devices.

Fixes: a59d06305fff ("vfio/pci: Introduce x-pci-class-code option")
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250827190810.1645340-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index be71c77729..dfaa89498d 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -406,6 +406,8 @@ static const Property vfio_user_pci_dev_properties[] = {
                        sub_vendor_id, PCI_ANY_ID),
     DEFINE_PROP_UINT32("x-pci-sub-device-id", VFIOPCIDevice,
                        sub_device_id, PCI_ANY_ID),
+    DEFINE_PROP_UINT32("x-pci-class-code", VFIOPCIDevice,
+                       class_code, PCI_ANY_ID),
     DEFINE_PROP_BOOL("x-send-queued", VFIOUserPCIDevice, send_queued, false),
     DEFINE_PROP_UINT32("x-msg-timeout", VFIOUserPCIDevice, wait_time, 5000),
     DEFINE_PROP_BOOL("x-no-posted-writes", VFIOUserPCIDevice, no_post, false),

From bb1a6f1f43374a1850c314c4d0e945667d013d07 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 22 Aug 2025 02:40:42 -0400
Subject: [PATCH 0335/2396] vfio: Introduce helper vfio_pci_from_vfio_device()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce helper vfio_pci_from_vfio_device() to transform from VFIODevice
to VFIOPCIDevice, also to hide low level VFIO_DEVICE_TYPE_PCI type check.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250822064101.123526-5-zhenzhong.duan@intel.com
[ clg: Added documentation ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c |  4 ++--
 hw/vfio/device.c    |  2 +-
 hw/vfio/iommufd.c   |  4 ++--
 hw/vfio/listener.c  |  4 ++--
 hw/vfio/pci.c       |  9 +++++++++
 hw/vfio/pci.h       | 12 ++++++++++++
 6 files changed, 28 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 3e13feaa74..134ddccc52 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -1087,7 +1087,7 @@ static int vfio_legacy_pci_hot_reset(VFIODevice *vbasedev, bool single)
         /* Prep dependent devices for reset and clear our marker. */
         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
             if (!vbasedev_iter->dev->realized ||
-                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
+                !vfio_pci_from_vfio_device(vbasedev_iter)) {
                 continue;
             }
             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
@@ -1172,7 +1172,7 @@ out:
 
         QLIST_FOREACH(vbasedev_iter, &group->device_list, next) {
             if (!vbasedev_iter->dev->realized ||
-                vbasedev_iter->type != VFIO_DEVICE_TYPE_PCI) {
+                !vfio_pci_from_vfio_device(vbasedev_iter)) {
                 continue;
             }
             tmp = container_of(vbasedev_iter, VFIOPCIDevice, vbasedev);
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 52a1996dc4..08f12ac31f 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -129,7 +129,7 @@ static inline const char *action_to_str(int action)
 
 static const char *index_to_str(VFIODevice *vbasedev, int index)
 {
-    if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
+    if (!vfio_pci_from_vfio_device(vbasedev)) {
         return NULL;
     }
 
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 48c590b6a9..8c27222f75 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -737,8 +737,8 @@ iommufd_cdev_dep_get_realized_vpdev(struct vfio_pci_dependent_device *dep_dev,
     }
 
     vbasedev_tmp = iommufd_cdev_pci_find_by_devid(dep_dev->devid);
-    if (!vbasedev_tmp || !vbasedev_tmp->dev->realized ||
-        vbasedev_tmp->type != VFIO_DEVICE_TYPE_PCI) {
+    if (!vfio_pci_from_vfio_device(vbasedev_tmp) ||
+        !vbasedev_tmp->dev->realized) {
         return NULL;
     }
 
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index c244be5e21..e093833165 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -453,7 +453,7 @@ static void vfio_device_error_append(VFIODevice *vbasedev, Error **errp)
      * MMIO region mapping failures are not fatal but in this case PCI
      * peer-to-peer transactions are broken.
      */
-    if (vbasedev && vbasedev->type == VFIO_DEVICE_TYPE_PCI) {
+    if (vfio_pci_from_vfio_device(vbasedev)) {
         error_append_hint(errp, "%s: PCI peer-to-peer transactions "
                           "on BARs are not supported.\n", vbasedev->name);
     }
@@ -759,7 +759,7 @@ static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
     owner = memory_region_owner(section->mr);
 
     QLIST_FOREACH(vbasedev, &bcontainer->device_list, container_next) {
-        if (vbasedev->type != VFIO_DEVICE_TYPE_PCI) {
+        if (!vfio_pci_from_vfio_device(vbasedev)) {
             continue;
         }
         pcidev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 07257d0fa0..3fe5b03eb1 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2833,6 +2833,15 @@ static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
     return ret;
 }
 
+/* Transform from VFIODevice to VFIOPCIDevice. Return NULL if fails. */
+VFIOPCIDevice *vfio_pci_from_vfio_device(VFIODevice *vbasedev)
+{
+    if (vbasedev && vbasedev->type == VFIO_DEVICE_TYPE_PCI) {
+        return container_of(vbasedev, VFIOPCIDevice, vbasedev);
+    }
+    return NULL;
+}
+
 void vfio_sub_page_bar_update_mappings(VFIOPCIDevice *vdev)
 {
     PCIDevice *pdev = &vdev->pdev;
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 923cf9c2f7..96144b6fde 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -226,6 +226,18 @@ void vfio_pci_write_config(PCIDevice *pdev,
 uint64_t vfio_vga_read(void *opaque, hwaddr addr, unsigned size);
 void vfio_vga_write(void *opaque, hwaddr addr, uint64_t data, unsigned size);
 
+/**
+ * vfio_pci_from_vfio_device: Transform from VFIODevice to
+ * VFIOPCIDevice
+ *
+ * This function checks if the given @vbasedev is a VFIO PCI device.
+ * If it is, it returns the containing VFIOPCIDevice.
+ *
+ * @vbasedev: The VFIODevice to transform
+ *
+ * Return: The VFIOPCIDevice on success, NULL on failure.
+ */
+VFIOPCIDevice *vfio_pci_from_vfio_device(VFIODevice *vbasedev);
 void vfio_sub_page_bar_update_mappings(VFIOPCIDevice *vdev);
 bool vfio_opt_rom_in_denylist(VFIOPCIDevice *vdev);
 bool vfio_config_quirk_setup(VFIOPCIDevice *vdev, Error **errp);

From 42875d256d204e69b608f2bd265f85fae32dd4bd Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:41 +0100
Subject: [PATCH 0336/2396] vfio/vfio-container-base.h: update
 VFIOContainerBase declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the VFIOContainerBase declaration to match our current coding
guidelines: remove the explicit typedef (this is already handled by the
OBJECT_DECLARE_TYPE() macro), add a blank line after the parent object,
rename parent to parent_obj, and move the macro declaration next to the
VFIOContainerBase struct declaration.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-2-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container-base.h | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index bded6e993f..acbd48a18a 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -33,8 +33,9 @@ typedef struct VFIOAddressSpace {
 /*
  * This is the base object for vfio container backends
  */
-typedef struct VFIOContainerBase {
-    Object parent;
+struct VFIOContainerBase {
+    Object parent_obj;
+
     VFIOAddressSpace *space;
     MemoryListener listener;
     Error *error;
@@ -51,7 +52,10 @@ typedef struct VFIOContainerBase {
     QLIST_HEAD(, VFIODevice) device_list;
     GList *iova_ranges;
     NotifierWithReturn cpr_reboot_notifier;
-} VFIOContainerBase;
+};
+
+#define TYPE_VFIO_IOMMU "vfio-iommu"
+OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
 
 typedef struct VFIOGuestIOMMU {
     VFIOContainerBase *bcontainer;
@@ -105,14 +109,11 @@ vfio_container_get_page_size_mask(const VFIOContainerBase *bcontainer)
     return bcontainer->pgsizes;
 }
 
-#define TYPE_VFIO_IOMMU "vfio-iommu"
 #define TYPE_VFIO_IOMMU_LEGACY TYPE_VFIO_IOMMU "-legacy"
 #define TYPE_VFIO_IOMMU_SPAPR TYPE_VFIO_IOMMU "-spapr"
 #define TYPE_VFIO_IOMMU_IOMMUFD TYPE_VFIO_IOMMU "-iommufd"
 #define TYPE_VFIO_IOMMU_USER TYPE_VFIO_IOMMU "-user"
 
-OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
-
 struct VFIOIOMMUClass {
     ObjectClass parent_class;
 

From 98c12de5aeb1cb464a9cde13cd7a53dd6520d3aa Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:42 +0100
Subject: [PATCH 0337/2396] vfio/vfio-container.h: update VFIOContainer
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the VFIOContainer declaration so that it is closer to our coding
guidelines: emove the explicit typedef (this is already handled by the
OBJECT_DECLARE_TYPE() macro) and add a blank line after the parent object.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-3-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index 21e5807e48..50c91788d5 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -25,13 +25,14 @@ typedef struct VFIOGroup {
     bool ram_block_discard_allowed;
 } VFIOGroup;
 
-typedef struct VFIOContainer {
+struct VFIOContainer {
     VFIOContainerBase bcontainer;
+
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;
     QLIST_HEAD(, VFIOGroup) group_list;
     VFIOContainerCPR cpr;
-} VFIOContainer;
+};
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
 

From 5255ba39b16539bd4b28a961d196812af1684c02 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:43 +0100
Subject: [PATCH 0338/2396] hw/vfio/cpr-legacy.c: use QOM casts where
 appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOContainer and VFIOContainerBase instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-4-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 553b203e9b..8f437194fa 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -41,8 +41,8 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
                                    hwaddr iova, ram_addr_t size, void *vaddr,
                                    bool readonly, MemoryRegion *mr)
 {
-    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                                  bcontainer);
+    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+
     struct vfio_iommu_type1_dma_map map = {
         .argsz = sizeof(map),
         .flags = VFIO_DMA_MAP_FLAG_VADDR,
@@ -65,7 +65,7 @@ static void vfio_region_remap(MemoryListener *listener,
 {
     VFIOContainer *container = container_of(listener, VFIOContainer,
                                             cpr.remap_listener);
-    vfio_container_region_add(&container->bcontainer, section, true);
+    vfio_container_region_add(VFIO_IOMMU(container), section, true);
 }
 
 static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
@@ -98,7 +98,7 @@ static int vfio_container_pre_save(void *opaque)
 static int vfio_container_post_load(void *opaque, int version_id)
 {
     VFIOContainer *container = opaque;
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     dma_map_fn saved_dma_map = vioc->dma_map;
     Error *local_err = NULL;
@@ -135,7 +135,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
 {
     VFIOContainer *container =
         container_of(notifier, VFIOContainer, cpr.transfer_notifier);
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
 
     if (e->type != MIG_EVENT_PRECOPY_FAILED) {
         return 0;
@@ -167,7 +167,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
 
 bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     Error **cpr_blocker = &container->cpr.blocker;
 
     migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
@@ -191,7 +191,7 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
 
 void vfio_legacy_cpr_unregister_container(VFIOContainer *container)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
 
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
     migrate_del_blocker(&container->cpr.blocker);

From 5947f69b63639b54f02db1727c559f8aae32d849 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:44 +0100
Subject: [PATCH 0339/2396] hw/vfio/container.c: use QOM casts where
 appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOContainer and VFIOContainerBase instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-5-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 134ddccc52..030c6d3f89 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -71,7 +71,7 @@ static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
                                  hwaddr iova, ram_addr_t size,
                                  IOMMUTLBEntry *iotlb)
 {
-    const VFIOContainerBase *bcontainer = &container->bcontainer;
+    const VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     struct vfio_iommu_type1_dma_unmap *unmap;
     struct vfio_bitmap *bitmap;
     VFIOBitmap vbmap;
@@ -124,8 +124,7 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
                                      hwaddr iova, ram_addr_t size,
                                      IOMMUTLBEntry *iotlb)
 {
-    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                                  bcontainer);
+    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dma_unmap unmap = {
         .argsz = sizeof(unmap),
         .flags = 0,
@@ -213,8 +212,7 @@ static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                ram_addr_t size, void *vaddr, bool readonly,
                                MemoryRegion *mr)
 {
-    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                                  bcontainer);
+    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dma_map map = {
         .argsz = sizeof(map),
         .flags = VFIO_DMA_MAP_FLAG_READ,
@@ -246,8 +244,7 @@ static int
 vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
                                     bool start, Error **errp)
 {
-    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                                  bcontainer);
+    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     int ret;
     struct vfio_iommu_type1_dirty_bitmap dirty = {
         .argsz = sizeof(dirty),
@@ -272,8 +269,7 @@ vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
 static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                       VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
 {
-    const VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                                  bcontainer);
+    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
     struct vfio_iommu_type1_dirty_bitmap_get *range;
     int ret;
@@ -495,7 +491,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_iommu_type1_info_cap_migration *cap_mig;
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
 
     hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
     if (!hdr) {
@@ -518,8 +514,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
 
 static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
 {
-    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                            bcontainer);
+    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     g_autofree struct vfio_iommu_type1_info *info = NULL;
     int ret;
 
@@ -634,7 +629,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
 
     if (!cpr_is_incoming()) {
         QLIST_FOREACH(bcontainer, &space->containers, next) {
-            container = container_of(bcontainer, VFIOContainer, bcontainer);
+            container = VFIO_IOMMU_LEGACY(bcontainer);
             if (!ioctl(group->fd, VFIO_GROUP_SET_CONTAINER, &container->fd)) {
                 return vfio_container_group_add(container, group, errp);
             }
@@ -652,7 +647,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
          * create the container struct and group list.
          */
         QLIST_FOREACH(bcontainer, &space->containers, next) {
-            container = container_of(bcontainer, VFIOContainer, bcontainer);
+            container = VFIO_IOMMU_LEGACY(bcontainer);
 
             if (vfio_cpr_container_match(container, group, fd)) {
                 return vfio_container_group_add(container, group, errp);
@@ -672,7 +667,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
         goto fail;
     }
     new_container = true;
-    bcontainer = &container->bcontainer;
+    bcontainer = VFIO_IOMMU(container);
 
     if (!vfio_legacy_cpr_register_container(container, errp)) {
         goto fail;
@@ -735,7 +730,7 @@ fail:
 static void vfio_container_disconnect(VFIOGroup *group)
 {
     VFIOContainer *container = group->container;
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
     QLIST_REMOVE(group, container_next);
@@ -781,7 +776,7 @@ static VFIOGroup *vfio_group_get(int groupid, AddressSpace *as, Error **errp)
     QLIST_FOREACH(group, &vfio_group_list, next) {
         if (group->groupid == groupid) {
             /* Found it.  Now is it already in the right context? */
-            if (group->container->bcontainer.space->as == as) {
+            if (VFIO_IOMMU(group->container)->space->as == as) {
                 return group;
             } else {
                 error_setg(errp, "group %d used in multiple address spaces",
@@ -895,7 +890,7 @@ static bool vfio_device_get(VFIOGroup *group, const char *name,
         }
     }
 
-    vfio_device_prepare(vbasedev, &group->container->bcontainer, info);
+    vfio_device_prepare(vbasedev, VFIO_IOMMU(group->container), info);
 
     vbasedev->fd = fd;
     vbasedev->group = group;

From 1f778031ec64cab0e79ab22f1313de59b81de3e5 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:45 +0100
Subject: [PATCH 0340/2396] ppc/spapr_pci_vfio.c: use QOM casts where
 appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use a QOM cast to convert to VFIOContainer instead of accessing bcontainer
directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-6-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index e318d0d912..7e1c71ef59 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -106,7 +106,7 @@ static VFIOContainer *vfio_eeh_as_container(AddressSpace *as)
 
 out:
     vfio_address_space_put(space);
-    return container_of(bcontainer, VFIOContainer, bcontainer);
+    return VFIO_IOMMU_LEGACY(bcontainer);
 }
 
 static bool vfio_eeh_as_ok(AddressSpace *as)

From 1ea79b4b9a1477dca3ff53358fc9ebdd73d55938 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:46 +0100
Subject: [PATCH 0341/2396] vfio/spapr.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOContainer and VFIOContainerBase instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-7-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 16 ++++++----------
 1 file changed, 6 insertions(+), 10 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 564b70ef97..c41e4588d6 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -62,7 +62,7 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
     VFIOContainer *container = &scontainer->container;
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
     int ret;
@@ -244,7 +244,7 @@ static bool vfio_spapr_create_window(VFIOContainer *container,
                                     hwaddr *pgsize, Error **errp)
 {
     int ret = 0;
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     IOMMUMemoryRegion *iommu_mr = IOMMU_MEMORY_REGION(section->mr);
@@ -352,8 +352,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
                                         MemoryRegionSection *section,
                                         Error **errp)
 {
-    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                            bcontainer);
+    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     VFIOHostDMAWindow *hostwin;
@@ -443,8 +442,7 @@ static void
 vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
                                         MemoryRegionSection *section)
 {
-    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                            bcontainer);
+    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
 
@@ -465,8 +463,7 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
 
 static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
 {
-    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                            bcontainer);
+    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     VFIOHostDMAWindow *hostwin, *next;
@@ -484,8 +481,7 @@ static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
 static bool vfio_spapr_container_setup(VFIOContainerBase *bcontainer,
                                        Error **errp)
 {
-    VFIOContainer *container = container_of(bcontainer, VFIOContainer,
-                                            bcontainer);
+    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     struct vfio_iommu_spapr_tce_info info;

From 507a118e9f8cc328c55adc531336e075fa8ee2d7 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:47 +0100
Subject: [PATCH 0342/2396] vfio/vfio-container.h: rename VFIOContainer
 bcontainer field to parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the bcontainer field directly, rename bcontainer to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-8-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-container.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index 50c91788d5..240f566993 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -26,7 +26,7 @@ typedef struct VFIOGroup {
 } VFIOGroup;
 
 struct VFIOContainer {
-    VFIOContainerBase bcontainer;
+    VFIOContainerBase parent_obj;
 
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;

From 52a1cc3dc00f09779aeb9aa9c6fcdc0284a40d4c Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:48 +0100
Subject: [PATCH 0343/2396] vfio-user/container.h: update VFIOUserContainer
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the VFIOUserContainer declaration so that it is closer to our coding
guidelines: remove the explicit typedef (this is already handled by the
OBJECT_DECLARE_TYPE() macro) and add a blank line after the parent object.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-9-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index 2bb1fa1343..d5d2275af7 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -13,10 +13,11 @@
 #include "hw/vfio-user/proxy.h"
 
 /* MMU container sub-class for vfio-user. */
-typedef struct VFIOUserContainer {
+struct VFIOUserContainer {
     VFIOContainerBase bcontainer;
+
     VFIOUserProxy *proxy;
-} VFIOUserContainer;
+};
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserContainer, VFIO_IOMMU_USER);
 

From 06229592fa7e6173b979158e9759f0d40a183861 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:49 +0100
Subject: [PATCH 0344/2396] vfio/container.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOUserContainer and VFIOContainerBase instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-10-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index d589dd90f5..3cdbd44c1a 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -24,16 +24,14 @@
  */
 static void vfio_user_listener_begin(VFIOContainerBase *bcontainer)
 {
-    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
-                                                 bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
     container->proxy->async_ops = true;
 }
 
 static void vfio_user_listener_commit(VFIOContainerBase *bcontainer)
 {
-    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
-                                            bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
     /* wait here for any async requests sent during the transaction */
     container->proxy->async_ops = false;
@@ -44,8 +42,8 @@ static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
                                hwaddr iova, ram_addr_t size,
                                IOMMUTLBEntry *iotlb, bool unmap_all)
 {
-    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
-                                            bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
+
     Error *local_err = NULL;
     int ret = 0;
 
@@ -86,8 +84,8 @@ static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                              ram_addr_t size, void *vaddr, bool readonly,
                              MemoryRegion *mrp)
 {
-    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
-                                                bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
+
     int fd = memory_region_get_fd(mrp);
     Error *local_err = NULL;
     int ret = 0;
@@ -173,8 +171,7 @@ static int vfio_user_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
 
 static bool vfio_user_setup(VFIOContainerBase *bcontainer, Error **errp)
 {
-    VFIOUserContainer *container = container_of(bcontainer, VFIOUserContainer,
-                                                bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
     assert(container->proxy->dma_pgsizes != 0);
     bcontainer->pgsizes = container->proxy->dma_pgsizes;
@@ -218,7 +215,7 @@ vfio_user_container_connect(AddressSpace *as, VFIODevice *vbasedev,
         goto put_space_exit;
     }
 
-    bcontainer = &container->bcontainer;
+    bcontainer = VFIO_IOMMU(container);
 
     ret = ram_block_uncoordinated_discard_disable(true);
     if (ret) {
@@ -263,7 +260,7 @@ put_space_exit:
 
 static void vfio_user_container_disconnect(VFIOUserContainer *container)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     VFIOAddressSpace *space = bcontainer->space;
 
@@ -291,7 +288,7 @@ static bool vfio_user_device_get(VFIOUserContainer *container,
 
     vbasedev->fd = -1;
 
-    vfio_device_prepare(vbasedev, &container->bcontainer, &info);
+    vfio_device_prepare(vbasedev, VFIO_IOMMU(container), &info);
 
     return true;
 }
@@ -315,8 +312,7 @@ static bool vfio_user_device_attach(const char *name, VFIODevice *vbasedev,
 
 static void vfio_user_device_detach(VFIODevice *vbasedev)
 {
-    VFIOUserContainer *container = container_of(vbasedev->bcontainer,
-                                                VFIOUserContainer, bcontainer);
+    VFIOUserContainer *container = VFIO_IOMMU_USER(vbasedev->bcontainer);
 
     vfio_device_unprepare(vbasedev);
 

From 81b53891ca52288540e6e4f34bb924284feebc58 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:50 +0100
Subject: [PATCH 0345/2396] vfio-user/container.h: rename VFIOUserContainer
 bcontainer field to parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the bcontainer field directly, rename bcontainer to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-11-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index d5d2275af7..96aa6785d9 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -14,7 +14,7 @@
 
 /* MMU container sub-class for vfio-user. */
 struct VFIOUserContainer {
-    VFIOContainerBase bcontainer;
+    VFIOContainerBase parent_obj;
 
     VFIOUserProxy *proxy;
 };

From b458e9e9e4c171622f19df18f5363c7ef4e8697f Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:51 +0100
Subject: [PATCH 0346/2396] vfio-user/pci.c: update VFIOUserPCIDevice
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the VFIOUserPCIDevice declaration so that it is closer to our coding
guidelines: add a blank line after the parent object.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-12-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index dfaa89498d..29cb592e9c 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -21,6 +21,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
 
 struct VFIOUserPCIDevice {
     VFIOPCIDevice device;
+
     SocketAddress *socket;
     bool send_queued;   /* all sends are queued */
     uint32_t wait_time; /* timeout for message replies */

From 5d1219e358a559680fdc34b112e2b04806f5ff62 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:52 +0100
Subject: [PATCH 0347/2396] vfio-user/pci.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOUserPCIDevice and VFIOPCIDevice instead
of accessing device directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-13-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 29cb592e9c..7b6a6514f6 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -214,8 +214,9 @@ static void vfio_user_compute_needs_reset(VFIODevice *vbasedev)
 
 static Object *vfio_user_pci_get_object(VFIODevice *vbasedev)
 {
-    VFIOUserPCIDevice *vdev = container_of(vbasedev, VFIOUserPCIDevice,
-                                           device.vbasedev);
+    VFIOUserPCIDevice *vdev = VFIO_USER_PCI(container_of(vbasedev,
+                                                         VFIOPCIDevice,
+                                                         vbasedev));
 
     return OBJECT(vdev);
 }
@@ -420,7 +421,7 @@ static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
     VFIOUserPCIDevice *udev = VFIO_USER_PCI(obj);
     bool success;
 
-    if (udev->device.vbasedev.proxy) {
+    if (VFIO_PCI_BASE(udev)->vbasedev.proxy) {
         error_setg(errp, "Proxy is connected");
         return;
     }

From 5fc421b8cd4813fa8ca9131905f12c4eedf55051 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:53 +0100
Subject: [PATCH 0348/2396] vfio-user/pci.c: rename VFIOUserPCIDevice device
 field to parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the device field directly, rename device to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-14-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 7b6a6514f6..c3947a8f2e 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -20,7 +20,7 @@
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOUserPCIDevice, VFIO_USER_PCI)
 
 struct VFIOUserPCIDevice {
-    VFIOPCIDevice device;
+    VFIOPCIDevice parent_obj;
 
     SocketAddress *socket;
     bool send_queued;   /* all sends are queued */

From 750e424fd04311aaeeb85536744c4cd3e460404d Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:54 +0100
Subject: [PATCH 0349/2396] vfio/pci.h: update VFIOPCIDevice declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the VFIOPCIDevice declaration so that it is closer to our coding
guidelines: add a blank line after the parent object.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-15-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 96144b6fde..2db76b6f4f 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -124,6 +124,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_BASE)
 
 struct VFIOPCIDevice {
     PCIDevice pdev;
+
     VFIODevice vbasedev;
     VFIOINTx intx;
     unsigned int config_size;

From 77f143cc418121fb30ad9e26dd90334dcf5851fc Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:56 +0100
Subject: [PATCH 0350/2396] vfio/pci.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOPCIDevice and PCIDevice instead of
accessing pdev directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-17-mark.caveayland@nutanix.com
[ clg: Updated vfio_sub_page_bar_update_mappings() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 204 ++++++++++++++++++++++++++++++--------------------
 1 file changed, 121 insertions(+), 83 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 3fe5b03eb1..052591d2c9 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -117,6 +117,7 @@ static void vfio_intx_mmap_enable(void *opaque)
 static void vfio_intx_interrupt(void *opaque)
 {
     VFIOPCIDevice *vdev = opaque;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     if (!event_notifier_test_and_clear(&vdev->intx.interrupt)) {
         return;
@@ -125,7 +126,7 @@ static void vfio_intx_interrupt(void *opaque)
     trace_vfio_intx_interrupt(vdev->vbasedev.name, 'A' + vdev->intx.pin);
 
     vdev->intx.pending = true;
-    pci_irq_assert(&vdev->pdev);
+    pci_irq_assert(pdev);
     vfio_mmap_set_enabled(vdev, false);
     if (vdev->intx.mmap_timeout) {
         timer_mod(vdev->intx.mmap_timer,
@@ -136,6 +137,7 @@ static void vfio_intx_interrupt(void *opaque)
 void vfio_pci_intx_eoi(VFIODevice *vbasedev)
 {
     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     if (!vdev->intx.pending) {
         return;
@@ -144,13 +146,14 @@ void vfio_pci_intx_eoi(VFIODevice *vbasedev)
     trace_vfio_pci_intx_eoi(vbasedev->name);
 
     vdev->intx.pending = false;
-    pci_irq_deassert(&vdev->pdev);
+    pci_irq_deassert(pdev);
     vfio_device_irq_unmask(vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
 }
 
 static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
 {
 #ifdef CONFIG_KVM
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int irq_fd = event_notifier_get_fd(&vdev->intx.interrupt);
 
     if (vdev->no_kvm_intx || !kvm_irqfds_enabled() ||
@@ -163,7 +166,7 @@ static bool vfio_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
     qemu_set_fd_handler(irq_fd, NULL, NULL, vdev);
     vfio_device_irq_mask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
-    pci_irq_deassert(&vdev->pdev);
+    pci_irq_deassert(pdev);
 
     /* Get an eventfd for resample/unmask */
     if (!vfio_notifier_init(vdev, &vdev->intx.unmask, "intx-unmask", 0, errp)) {
@@ -241,6 +244,8 @@ static bool vfio_cpr_intx_enable_kvm(VFIOPCIDevice *vdev, Error **errp)
 static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
 {
 #ifdef CONFIG_KVM
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
     if (!vdev->intx.kvm_accel) {
         return;
     }
@@ -251,7 +256,7 @@ static void vfio_intx_disable_kvm(VFIOPCIDevice *vdev)
      */
     vfio_device_irq_mask(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
-    pci_irq_deassert(&vdev->pdev);
+    pci_irq_deassert(pdev);
 
     /* Tell KVM to stop listening for an INTx irqfd */
     if (kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, &vdev->intx.interrupt,
@@ -307,7 +312,7 @@ static void vfio_intx_routing_notifier(PCIDevice *pdev)
         return;
     }
 
-    route = pci_device_route_intx_to_irq(&vdev->pdev, vdev->intx.pin);
+    route = pci_device_route_intx_to_irq(pdev, vdev->intx.pin);
 
     if (pci_intx_route_changed(&vdev->intx.route, &route)) {
         vfio_intx_update(vdev, &route);
@@ -324,7 +329,8 @@ static void vfio_irqchip_change(Notifier *notify, void *data)
 
 static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
 {
-    uint8_t pin = vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    uint8_t pin = vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1);
     Error *err = NULL;
     int32_t fd;
 
@@ -342,7 +348,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
     }
 
     vdev->intx.pin = pin - 1; /* Pin A (1) -> irq[0] */
-    pci_config_set_interrupt_pin(vdev->pdev.config, pin);
+    pci_config_set_interrupt_pin(pdev->config, pin);
 
 #ifdef CONFIG_KVM
     /*
@@ -350,7 +356,7 @@ static bool vfio_intx_enable(VFIOPCIDevice *vdev, Error **errp)
      * where we won't actually use the result anyway.
      */
     if (kvm_irqfds_enabled() && kvm_resamplefds_enabled()) {
-        vdev->intx.route = pci_device_route_intx_to_irq(&vdev->pdev,
+        vdev->intx.route = pci_device_route_intx_to_irq(pdev,
                                                         vdev->intx.pin);
     }
 #endif
@@ -390,13 +396,14 @@ skip_signaling:
 
 static void vfio_intx_disable(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int fd;
 
     timer_del(vdev->intx.mmap_timer);
     vfio_intx_disable_kvm(vdev);
     vfio_device_irq_disable(&vdev->vbasedev, VFIO_PCI_INTX_IRQ_INDEX);
     vdev->intx.pending = false;
-    pci_irq_deassert(&vdev->pdev);
+    pci_irq_deassert(pdev);
     vfio_mmap_set_enabled(vdev, true);
 
     fd = event_notifier_get_fd(&vdev->intx.interrupt);
@@ -428,6 +435,7 @@ static void vfio_msi_interrupt(void *opaque)
 {
     VFIOMSIVector *vector = opaque;
     VFIOPCIDevice *vdev = vector->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     MSIMessage (*get_msg)(PCIDevice *dev, unsigned vector);
     void (*notify)(PCIDevice *dev, unsigned vector);
     MSIMessage msg;
@@ -442,9 +450,9 @@ static void vfio_msi_interrupt(void *opaque)
         notify = msix_notify;
 
         /* A masked vector firing needs to use the PBA, enable it */
-        if (msix_is_masked(&vdev->pdev, nr)) {
+        if (msix_is_masked(pdev, nr)) {
             set_bit(nr, vdev->msix->pending);
-            memory_region_set_enabled(&vdev->pdev.msix_pba_mmio, true);
+            memory_region_set_enabled(&pdev->msix_pba_mmio, true);
             trace_vfio_msix_pba_enable(vdev->vbasedev.name);
         }
     } else if (vdev->interrupt == VFIO_INT_MSI) {
@@ -454,9 +462,9 @@ static void vfio_msi_interrupt(void *opaque)
         abort();
     }
 
-    msg = get_msg(&vdev->pdev, nr);
+    msg = get_msg(pdev, nr);
     trace_vfio_msi_interrupt(vdev->vbasedev.name, nr, msg.address, msg.data);
-    notify(&vdev->pdev, nr);
+    notify(pdev, nr);
 }
 
 void vfio_pci_msi_set_handler(VFIOPCIDevice *vdev, int nr, bool enable)
@@ -495,6 +503,7 @@ static int vfio_enable_msix_no_vec(VFIOPCIDevice *vdev)
 
 static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     struct vfio_irq_set *irq_set;
     int ret = 0, i, argsz;
     int32_t *fds;
@@ -537,7 +546,7 @@ static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
          */
         if (vdev->msi_vectors[i].use) {
             if (vdev->msi_vectors[i].virq < 0 ||
-                (msix && msix_is_masked(&vdev->pdev, i))) {
+                (msix && msix_is_masked(pdev, i))) {
                 fd = event_notifier_get_fd(&vdev->msi_vectors[i].interrupt);
             } else {
                 fd = event_notifier_get_fd(&vdev->msi_vectors[i].kvm_interrupt);
@@ -557,12 +566,14 @@ static int vfio_enable_vectors(VFIOPCIDevice *vdev, bool msix)
 void vfio_pci_add_kvm_msi_virq(VFIOPCIDevice *vdev, VFIOMSIVector *vector,
                                int vector_n, bool msix)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
     if ((msix && vdev->no_kvm_msix) || (!msix && vdev->no_kvm_msi)) {
         return;
     }
 
     vector->virq = kvm_irqchip_add_msi_route(&vfio_route_change,
-                                             vector_n, &vdev->pdev);
+                                             vector_n, pdev);
 }
 
 static void vfio_connect_kvm_msi_virq(VFIOMSIVector *vector, int nr)
@@ -631,7 +642,7 @@ static void set_irq_signalling(VFIODevice *vbasedev, VFIOMSIVector *vector,
 void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
 {
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     Error *local_err = NULL;
 
     vector->vdev = vdev;
@@ -720,7 +731,7 @@ static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
     clear_bit(nr, vdev->msix->pending);
     if (find_first_bit(vdev->msix->pending,
                        vdev->nr_vectors) == vdev->nr_vectors) {
-        memory_region_set_enabled(&vdev->pdev.msix_pba_mmio, false);
+        memory_region_set_enabled(&pdev->msix_pba_mmio, false);
         trace_vfio_msix_pba_disable(vdev->vbasedev.name);
     }
 
@@ -771,7 +782,9 @@ static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
 
 void vfio_pci_msix_set_notifiers(VFIOPCIDevice *vdev)
 {
-    msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
+    msix_set_vector_notifiers(pdev, vfio_msix_vector_use,
                               vfio_msix_vector_release, NULL);
 }
 
@@ -798,6 +811,7 @@ void vfio_pci_commit_kvm_msi_virq_batch(VFIOPCIDevice *vdev)
 
 static void vfio_msix_enable(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int ret;
 
     vfio_disable_interrupts(vdev);
@@ -814,7 +828,7 @@ static void vfio_msix_enable(VFIOPCIDevice *vdev)
      */
     vfio_pci_prepare_kvm_msi_virq_batch(vdev);
 
-    if (msix_set_vector_notifiers(&vdev->pdev, vfio_msix_vector_use,
+    if (msix_set_vector_notifiers(pdev, vfio_msix_vector_use,
                                   vfio_msix_vector_release, NULL)) {
         error_report("vfio: msix_set_vector_notifiers failed");
     }
@@ -852,11 +866,12 @@ static void vfio_msix_enable(VFIOPCIDevice *vdev)
 
 static void vfio_msi_enable(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int ret, i;
 
     vfio_disable_interrupts(vdev);
 
-    vdev->nr_vectors = msi_nr_vectors_allocated(&vdev->pdev);
+    vdev->nr_vectors = msi_nr_vectors_allocated(pdev);
 retry:
     /*
      * Setting vector notifiers needs to enable route for each vector.
@@ -949,10 +964,11 @@ static void vfio_msi_disable_common(VFIOPCIDevice *vdev)
 
 static void vfio_msix_disable(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     Error *err = NULL;
     int i;
 
-    msix_unset_vector_notifiers(&vdev->pdev);
+    msix_unset_vector_notifiers(pdev);
 
     /*
      * MSI-X will only release vectors if MSI-X is still enabled on the
@@ -960,8 +976,8 @@ static void vfio_msix_disable(VFIOPCIDevice *vdev)
      */
     for (i = 0; i < vdev->nr_vectors; i++) {
         if (vdev->msi_vectors[i].use) {
-            vfio_msix_vector_release(&vdev->pdev, i);
-            msix_vector_unuse(&vdev->pdev, i);
+            vfio_msix_vector_release(pdev, i);
+            msix_vector_unuse(pdev, i);
         }
     }
 
@@ -998,6 +1014,7 @@ static void vfio_msi_disable(VFIOPCIDevice *vdev)
 
 static void vfio_update_msi(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int i;
 
     for (i = 0; i < vdev->nr_vectors; i++) {
@@ -1008,8 +1025,8 @@ static void vfio_update_msi(VFIOPCIDevice *vdev)
             continue;
         }
 
-        msg = msi_get_message(&vdev->pdev, i);
-        vfio_update_kvm_msi_virq(vector, msg, &vdev->pdev);
+        msg = msi_get_message(pdev, i);
+        vfio_update_kvm_msi_virq(vector, msg, pdev);
     }
 }
 
@@ -1171,13 +1188,14 @@ static const MemoryRegionOps vfio_rom_ops = {
 
 static void vfio_pci_size_rom(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t orig, size = cpu_to_le32((uint32_t)PCI_ROM_ADDRESS_MASK);
     char *name;
 
-    if (vdev->pdev.romfile || !vdev->pdev.rom_bar) {
+    if (pdev->romfile || !pdev->rom_bar) {
         /* Since pci handles romfile, just print a message and return */
-        if (vfio_opt_rom_in_denylist(vdev) && vdev->pdev.romfile) {
+        if (vfio_opt_rom_in_denylist(vdev) && pdev->romfile) {
             warn_report("Device at %s is known to cause system instability"
                         " issues during option rom execution",
                         vdev->vbasedev.name);
@@ -1206,7 +1224,7 @@ static void vfio_pci_size_rom(VFIOPCIDevice *vdev)
     }
 
     if (vfio_opt_rom_in_denylist(vdev)) {
-        if (vdev->pdev.rom_bar > 0) {
+        if (pdev->rom_bar > 0) {
             warn_report("Device at %s is known to cause system instability"
                         " issues during option rom execution",
                         vdev->vbasedev.name);
@@ -1225,12 +1243,12 @@ static void vfio_pci_size_rom(VFIOPCIDevice *vdev)
 
     name = g_strdup_printf("vfio[%s].rom", vdev->vbasedev.name);
 
-    memory_region_init_io(&vdev->pdev.rom, OBJECT(vdev),
+    memory_region_init_io(&pdev->rom, OBJECT(vdev),
                           &vfio_rom_ops, vdev, name, size);
     g_free(name);
 
-    pci_register_bar(&vdev->pdev, PCI_ROM_SLOT,
-                     PCI_BASE_ADDRESS_SPACE_MEMORY, &vdev->pdev.rom);
+    pci_register_bar(pdev, PCI_ROM_SLOT,
+                     PCI_BASE_ADDRESS_SPACE_MEMORY, &pdev->rom);
 
     vdev->rom_read_failed = false;
 }
@@ -1503,6 +1521,7 @@ static void vfio_disable_interrupts(VFIOPCIDevice *vdev)
 
 static bool vfio_msi_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint16_t ctrl;
     bool msi_64bit, msi_maskbit;
     int ret, entries;
@@ -1523,7 +1542,7 @@ static bool vfio_msi_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
 
     trace_vfio_msi_setup(vdev->vbasedev.name, pos);
 
-    ret = msi_init(&vdev->pdev, pos, entries, msi_64bit, msi_maskbit, &err);
+    ret = msi_init(pdev, pos, entries, msi_64bit, msi_maskbit, &err);
     if (ret < 0) {
         if (ret == -ENOTSUP) {
             return true;
@@ -1716,6 +1735,7 @@ static bool vfio_pci_relocate_msix(VFIOPCIDevice *vdev, Error **errp)
  */
 static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint8_t pos;
     uint16_t ctrl;
     uint32_t table, pba;
@@ -1723,7 +1743,7 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
     VFIOMSIXInfo *msix;
     int ret;
 
-    pos = pci_find_capability(&vdev->pdev, PCI_CAP_ID_MSIX);
+    pos = pci_find_capability(pdev, PCI_CAP_ID_MSIX);
     if (!pos) {
         return true;
     }
@@ -1815,12 +1835,13 @@ static bool vfio_msix_early_setup(VFIOPCIDevice *vdev, Error **errp)
 
 static bool vfio_msix_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int ret;
     Error *err = NULL;
 
     vdev->msix->pending = g_new0(unsigned long,
                                  BITS_TO_LONGS(vdev->msix->entries));
-    ret = msix_init(&vdev->pdev, vdev->msix->entries,
+    ret = msix_init(pdev, vdev->msix->entries,
                     vdev->bars[vdev->msix->table_bar].mr,
                     vdev->msix->table_bar, vdev->msix->table_offset,
                     vdev->bars[vdev->msix->pba_bar].mr,
@@ -1852,7 +1873,7 @@ static bool vfio_msix_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
      * vector-use notifier is called, which occurs on unmask, we test whether
      * PBA emulation is needed and again disable if not.
      */
-    memory_region_set_enabled(&vdev->pdev.msix_pba_mmio, false);
+    memory_region_set_enabled(&pdev->msix_pba_mmio, false);
 
     /*
      * The emulated machine may provide a paravirt interface for MSIX setup
@@ -1864,7 +1885,7 @@ static bool vfio_msix_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
      */
     if (object_property_get_bool(OBJECT(qdev_get_machine()),
                                  "vfio-no-msix-emulation", NULL)) {
-        memory_region_set_enabled(&vdev->pdev.msix_table_mmio, false);
+        memory_region_set_enabled(&pdev->msix_table_mmio, false);
     }
 
     return true;
@@ -1872,10 +1893,12 @@ static bool vfio_msix_setup(VFIOPCIDevice *vdev, int pos, Error **errp)
 
 void vfio_pci_teardown_msi(VFIOPCIDevice *vdev)
 {
-    msi_uninit(&vdev->pdev);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
+    msi_uninit(pdev);
 
     if (vdev->msix) {
-        msix_uninit(&vdev->pdev,
+        msix_uninit(pdev,
                     vdev->bars[vdev->msix->table_bar].mr,
                     vdev->bars[vdev->msix->pba_bar].mr);
         g_free(vdev->msix->pending);
@@ -1936,6 +1959,7 @@ static void vfio_bars_prepare(VFIOPCIDevice *vdev)
 
 static void vfio_bar_register(VFIOPCIDevice *vdev, int nr)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIOBAR *bar = &vdev->bars[nr];
     char *name;
 
@@ -1957,7 +1981,7 @@ static void vfio_bar_register(VFIOPCIDevice *vdev, int nr)
         }
     }
 
-    pci_register_bar(&vdev->pdev, nr, bar->type, bar->mr);
+    pci_register_bar(pdev, nr, bar->type, bar->mr);
 }
 
 static void vfio_bars_register(VFIOPCIDevice *vdev)
@@ -1971,6 +1995,7 @@ static void vfio_bars_register(VFIOPCIDevice *vdev)
 
 void vfio_pci_bars_exit(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int i;
 
     for (i = 0; i < PCI_ROM_SLOT; i++) {
@@ -1984,7 +2009,7 @@ void vfio_pci_bars_exit(VFIOPCIDevice *vdev)
     }
 
     if (vdev->vga) {
-        pci_unregister_vga(&vdev->pdev);
+        pci_unregister_vga(pdev);
         vfio_vga_quirk_exit(vdev);
     }
 }
@@ -2056,8 +2081,10 @@ static void vfio_set_word_bits(uint8_t *buf, uint16_t val, uint16_t mask)
 static void vfio_add_emulated_word(VFIOPCIDevice *vdev, int pos,
                                    uint16_t val, uint16_t mask)
 {
-    vfio_set_word_bits(vdev->pdev.config + pos, val, mask);
-    vfio_set_word_bits(vdev->pdev.wmask + pos, ~mask, mask);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
+    vfio_set_word_bits(pdev->config + pos, val, mask);
+    vfio_set_word_bits(pdev->wmask + pos, ~mask, mask);
     vfio_set_word_bits(vdev->emulated_config_bits + pos, mask, mask);
 }
 
@@ -2069,8 +2096,10 @@ static void vfio_set_long_bits(uint8_t *buf, uint32_t val, uint32_t mask)
 static void vfio_add_emulated_long(VFIOPCIDevice *vdev, int pos,
                                    uint32_t val, uint32_t mask)
 {
-    vfio_set_long_bits(vdev->pdev.config + pos, val, mask);
-    vfio_set_long_bits(vdev->pdev.wmask + pos, ~mask, mask);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
+    vfio_set_long_bits(pdev->config + pos, val, mask);
+    vfio_set_long_bits(pdev->wmask + pos, ~mask, mask);
     vfio_set_long_bits(vdev->emulated_config_bits + pos, mask, mask);
 }
 
@@ -2078,7 +2107,8 @@ static void vfio_pci_enable_rp_atomics(VFIOPCIDevice *vdev)
 {
     struct vfio_device_info_cap_pci_atomic_comp *cap;
     g_autofree struct vfio_device_info *info = NULL;
-    PCIBus *bus = pci_get_bus(&vdev->pdev);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    PCIBus *bus = pci_get_bus(pdev);
     PCIDevice *parent = bus->parent_dev;
     struct vfio_info_cap_header *hdr;
     uint32_t mask = 0;
@@ -2094,8 +2124,8 @@ static void vfio_pci_enable_rp_atomics(VFIOPCIDevice *vdev)
     if (pci_bus_is_root(bus) || !parent || !parent->exp.exp_cap ||
         pcie_cap_get_type(parent) != PCI_EXP_TYPE_ROOT_PORT ||
         pcie_cap_get_version(parent) != PCI_EXP_FLAGS_VER2 ||
-        vdev->pdev.devfn ||
-        vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        pdev->devfn ||
+        pdev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
         return;
     }
 
@@ -2139,8 +2169,10 @@ static void vfio_pci_enable_rp_atomics(VFIOPCIDevice *vdev)
 
 static void vfio_pci_disable_rp_atomics(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+
     if (vdev->clear_parent_atomics_on_exit) {
-        PCIDevice *parent = pci_get_bus(&vdev->pdev)->parent_dev;
+        PCIDevice *parent = pci_get_bus(pdev)->parent_dev;
         uint8_t *pos = parent->config + parent->exp.exp_cap + PCI_EXP_DEVCAP2;
 
         pci_long_test_and_clear_mask(pos, PCI_EXP_DEVCAP2_ATOMIC_COMP32 |
@@ -2152,10 +2184,11 @@ static void vfio_pci_disable_rp_atomics(VFIOPCIDevice *vdev)
 static bool vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
                                 Error **errp)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint16_t flags;
     uint8_t type;
 
-    flags = pci_get_word(vdev->pdev.config + pos + PCI_CAP_FLAGS);
+    flags = pci_get_word(pdev->config + pos + PCI_CAP_FLAGS);
     type = (flags & PCI_EXP_FLAGS_TYPE) >> 4;
 
     if (type != PCI_EXP_TYPE_ENDPOINT &&
@@ -2167,8 +2200,8 @@ static bool vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
         return false;
     }
 
-    if (!pci_bus_is_express(pci_get_bus(&vdev->pdev))) {
-        PCIBus *bus = pci_get_bus(&vdev->pdev);
+    if (!pci_bus_is_express(pci_get_bus(pdev))) {
+        PCIBus *bus = pci_get_bus(pdev);
         PCIDevice *bridge;
 
         /*
@@ -2200,7 +2233,7 @@ static bool vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
             return true;
         }
 
-    } else if (pci_bus_is_root(pci_get_bus(&vdev->pdev))) {
+    } else if (pci_bus_is_root(pci_get_bus(pdev))) {
         /*
          * On a Root Complex bus Endpoints become Root Complex Integrated
          * Endpoints, which changes the type and clears the LNK & LNK2 fields.
@@ -2268,20 +2301,20 @@ static bool vfio_setup_pcie_cap(VFIOPCIDevice *vdev, int pos, uint8_t size,
                                1, PCI_EXP_FLAGS_VERS);
     }
 
-    pos = pci_add_capability(&vdev->pdev, PCI_CAP_ID_EXP, pos, size,
-                             errp);
+    pos = pci_add_capability(pdev, PCI_CAP_ID_EXP, pos, size, errp);
     if (pos < 0) {
         return false;
     }
 
-    vdev->pdev.exp.exp_cap = pos;
+    pdev->exp.exp_cap = pos;
 
     return true;
 }
 
 static void vfio_check_pcie_flr(VFIOPCIDevice *vdev, uint8_t pos)
 {
-    uint32_t cap = pci_get_long(vdev->pdev.config + pos + PCI_EXP_DEVCAP);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    uint32_t cap = pci_get_long(pdev->config + pos + PCI_EXP_DEVCAP);
 
     if (cap & PCI_EXP_DEVCAP_FLR) {
         trace_vfio_check_pcie_flr(vdev->vbasedev.name);
@@ -2291,7 +2324,8 @@ static void vfio_check_pcie_flr(VFIOPCIDevice *vdev, uint8_t pos)
 
 static void vfio_check_pm_reset(VFIOPCIDevice *vdev, uint8_t pos)
 {
-    uint16_t csr = pci_get_word(vdev->pdev.config + pos + PCI_PM_CTRL);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    uint16_t csr = pci_get_word(pdev->config + pos + PCI_PM_CTRL);
 
     if (!(csr & PCI_PM_CTRL_NO_SOFT_RESET)) {
         trace_vfio_check_pm_reset(vdev->vbasedev.name);
@@ -2301,7 +2335,8 @@ static void vfio_check_pm_reset(VFIOPCIDevice *vdev, uint8_t pos)
 
 static void vfio_check_af_flr(VFIOPCIDevice *vdev, uint8_t pos)
 {
-    uint8_t cap = pci_get_byte(vdev->pdev.config + pos + PCI_AF_CAP);
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    uint8_t cap = pci_get_byte(pdev->config + pos + PCI_AF_CAP);
 
     if ((cap & PCI_AF_CAP_TP) && (cap & PCI_AF_CAP_FLR)) {
         trace_vfio_check_af_flr(vdev->vbasedev.name);
@@ -2312,7 +2347,7 @@ static void vfio_check_af_flr(VFIOPCIDevice *vdev, uint8_t pos)
 static bool vfio_add_vendor_specific_cap(VFIOPCIDevice *vdev, int pos,
                                          uint8_t size, Error **errp)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     pos = pci_add_capability(pdev, PCI_CAP_ID_VNDR, pos, size, errp);
     if (pos < 0) {
@@ -2334,7 +2369,7 @@ static bool vfio_add_vendor_specific_cap(VFIOPCIDevice *vdev, int pos,
 static bool vfio_add_std_cap(VFIOPCIDevice *vdev, uint8_t pos, Error **errp)
 {
     ERRP_GUARD();
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint8_t cap_id, next, size;
     bool ret;
 
@@ -2420,17 +2455,18 @@ static bool vfio_add_std_cap(VFIOPCIDevice *vdev, uint8_t pos, Error **errp)
 
 static int vfio_setup_rebar_ecap(VFIOPCIDevice *vdev, uint16_t pos)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint32_t ctrl;
     int i, nbar;
 
-    ctrl = pci_get_long(vdev->pdev.config + pos + PCI_REBAR_CTRL);
+    ctrl = pci_get_long(pdev->config + pos + PCI_REBAR_CTRL);
     nbar = (ctrl & PCI_REBAR_CTRL_NBAR_MASK) >> PCI_REBAR_CTRL_NBAR_SHIFT;
 
     for (i = 0; i < nbar; i++) {
         uint32_t cap;
         int size;
 
-        ctrl = pci_get_long(vdev->pdev.config + pos + PCI_REBAR_CTRL + (i * 8));
+        ctrl = pci_get_long(pdev->config + pos + PCI_REBAR_CTRL + (i * 8));
         size = (ctrl & PCI_REBAR_CTRL_BAR_SIZE) >> PCI_REBAR_CTRL_BAR_SHIFT;
 
         /* The cap register reports sizes 1MB to 128TB, with 4 reserved bits */
@@ -2468,7 +2504,7 @@ static int vfio_setup_rebar_ecap(VFIOPCIDevice *vdev, uint16_t pos)
 
 static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint32_t header;
     uint16_t cap_id, next, size;
     uint8_t cap_ver;
@@ -2562,7 +2598,7 @@ static void vfio_add_ext_cap(VFIOPCIDevice *vdev)
 
 bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     if (!(pdev->config[PCI_STATUS] & PCI_STATUS_CAP_LIST) ||
         !pdev->config[PCI_CAPABILITY_LIST]) {
@@ -2579,7 +2615,7 @@ bool vfio_pci_add_capabilities(VFIOPCIDevice *vdev, Error **errp)
 
 void vfio_pci_pre_reset(VFIOPCIDevice *vdev)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint16_t cmd;
 
     vfio_disable_interrupts(vdev);
@@ -2796,7 +2832,7 @@ static int vfio_pci_save_config(VFIODevice *vbasedev, QEMUFile *f, Error **errp)
 static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
 {
     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     pcibus_t old_addr[PCI_NUM_REGIONS - 1];
     int bar, ret;
 
@@ -2844,7 +2880,7 @@ VFIOPCIDevice *vfio_pci_from_vfio_device(VFIODevice *vbasedev)
 
 void vfio_sub_page_bar_update_mappings(VFIOPCIDevice *vdev)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int page_size = qemu_real_host_page_size();
     int bar;
 
@@ -2928,6 +2964,7 @@ bool vfio_populate_vga(VFIOPCIDevice *vdev, Error **errp)
 
 bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     struct vfio_region_info *reg_info = NULL;
     struct vfio_irq_info irq_info;
@@ -2979,7 +3016,7 @@ bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
 
     vdev->config_size = reg_info->size;
     if (vdev->config_size == PCI_CONFIG_SPACE_SIZE) {
-        vdev->pdev.cap_present &= ~QEMU_PCI_CAP_EXPRESS;
+        pdev->cap_present &= ~QEMU_PCI_CAP_EXPRESS;
     }
     vdev->config_offset = reg_info->offset;
 
@@ -3183,25 +3220,26 @@ static void vfio_unregister_req_notifier(VFIOPCIDevice *vdev)
 
 void vfio_pci_config_register_vga(VFIOPCIDevice *vdev)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     assert(vdev->vga != NULL);
 
-    pci_register_vga(&vdev->pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
+    pci_register_vga(pdev, &vdev->vga->region[QEMU_PCI_VGA_MEM].mem,
                      &vdev->vga->region[QEMU_PCI_VGA_IO_LO].mem,
                      &vdev->vga->region[QEMU_PCI_VGA_IO_HI].mem);
 }
 
 bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t config_space_size;
     int ret;
 
-    config_space_size = MIN(pci_config_size(&vdev->pdev), vdev->config_size);
+    config_space_size = MIN(pci_config_size(pdev), vdev->config_size);
 
     /* Get a copy of config space */
     ret = vfio_pci_config_space_read(vdev, 0, config_space_size,
-                                     vdev->pdev.config);
+                                     pdev->config);
     if (ret < (int)config_space_size) {
         ret = ret < 0 ? -ret : EFAULT;
         error_setg_errno(errp, ret, "failed to read device config space");
@@ -3286,10 +3324,10 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
                                               PCI_HEADER_TYPE_MULTI_FUNCTION;
 
     /* Restore or clear multifunction, this is always controlled by QEMU */
-    if (vdev->pdev.cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
-        vdev->pdev.config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
+    if (pdev->cap_present & QEMU_PCI_CAP_MULTIFUNCTION) {
+        pdev->config[PCI_HEADER_TYPE] |= PCI_HEADER_TYPE_MULTI_FUNCTION;
     } else {
-        vdev->pdev.config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
+        pdev->config[PCI_HEADER_TYPE] &= ~PCI_HEADER_TYPE_MULTI_FUNCTION;
     }
 
     /*
@@ -3297,8 +3335,8 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
      * BAR, such as might be the case with the option ROM, we can get
      * confusing, unwritable, residual addresses from the host here.
      */
-    memset(&vdev->pdev.config[PCI_BASE_ADDRESS_0], 0, 24);
-    memset(&vdev->pdev.config[PCI_ROM_ADDRESS], 0, 4);
+    memset(&pdev->config[PCI_BASE_ADDRESS_0], 0, 24);
+    memset(&pdev->config[PCI_ROM_ADDRESS], 0, 4);
 
     vfio_pci_size_rom(vdev);
 
@@ -3319,7 +3357,7 @@ bool vfio_pci_config_setup(VFIOPCIDevice *vdev, Error **errp)
 
 bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     /* QEMU emulates all of MSI & MSIX */
     if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
@@ -3332,10 +3370,10 @@ bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
                vdev->msi_cap_size);
     }
 
-    if (vfio_pci_read_config(&vdev->pdev, PCI_INTERRUPT_PIN, 1)) {
+    if (vfio_pci_read_config(pdev, PCI_INTERRUPT_PIN, 1)) {
         vdev->intx.mmap_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL,
                                              vfio_intx_mmap_enable, vdev);
-        pci_device_set_intx_routing_notifier(&vdev->pdev,
+        pci_device_set_intx_routing_notifier(pdev,
                                              vfio_intx_routing_notifier);
         vdev->irqchip_change_notifier.notify = vfio_irqchip_change;
         kvm_irqchip_add_change_notifier(&vdev->irqchip_change_notifier);
@@ -3347,7 +3385,7 @@ bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
          */
         if (!cpr_is_incoming() && !vfio_intx_enable(vdev, errp)) {
             timer_free(vdev->intx.mmap_timer);
-            pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+            pci_device_set_intx_routing_notifier(pdev, NULL);
             kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
             return false;
         }
@@ -3498,7 +3536,7 @@ out_deregister:
     if (vdev->interrupt == VFIO_INT_INTx) {
         vfio_intx_disable(vdev);
     }
-    pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+    pci_device_set_intx_routing_notifier(pdev, NULL);
     if (vdev->irqchip_change_notifier.notify) {
         kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
     }
@@ -3530,7 +3568,7 @@ static void vfio_exitfn(PCIDevice *pdev)
 
     vfio_unregister_req_notifier(vdev);
     vfio_unregister_err_notifier(vdev);
-    pci_device_set_intx_routing_notifier(&vdev->pdev, NULL);
+    pci_device_set_intx_routing_notifier(pdev, NULL);
     if (vdev->irqchip_change_notifier.notify) {
         kvm_irqchip_remove_change_notifier(&vdev->irqchip_change_notifier);
     }

From 31bfd70ef02045692d04bf53461399d3b81c0ea3 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:57 +0100
Subject: [PATCH 0351/2396] vfio/pci-quirks.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOPCIDevice and PCIDevice instead of
accessing pdev directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-18-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci-quirks.c | 48 ++++++++++++++++++++++++++------------------
 1 file changed, 29 insertions(+), 19 deletions(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index 3f002252ac..c97606dbf1 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -113,6 +113,7 @@ static uint64_t vfio_generic_window_quirk_data_read(void *opaque,
 {
     VFIOConfigWindowQuirk *window = opaque;
     VFIOPCIDevice *vdev = window->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint64_t data;
 
     /* Always read data reg, discard if window enabled */
@@ -120,7 +121,7 @@ static uint64_t vfio_generic_window_quirk_data_read(void *opaque,
                             addr + window->data_offset, size);
 
     if (window->window_enabled) {
-        data = vfio_pci_read_config(&vdev->pdev, window->address_val, size);
+        data = vfio_pci_read_config(pdev, window->address_val, size);
         trace_vfio_quirk_generic_window_data_read(vdev->vbasedev.name,
                                     memory_region_name(window->data_mem), data);
     }
@@ -133,9 +134,10 @@ static void vfio_generic_window_quirk_data_write(void *opaque, hwaddr addr,
 {
     VFIOConfigWindowQuirk *window = opaque;
     VFIOPCIDevice *vdev = window->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     if (window->window_enabled) {
-        vfio_pci_write_config(&vdev->pdev, window->address_val, data, size);
+        vfio_pci_write_config(pdev, window->address_val, data, size);
         trace_vfio_quirk_generic_window_data_write(vdev->vbasedev.name,
                                     memory_region_name(window->data_mem), data);
         return;
@@ -156,6 +158,7 @@ static uint64_t vfio_generic_quirk_mirror_read(void *opaque,
 {
     VFIOConfigMirrorQuirk *mirror = opaque;
     VFIOPCIDevice *vdev = mirror->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint64_t data;
 
     /* Read and discard in case the hardware cares */
@@ -163,7 +166,7 @@ static uint64_t vfio_generic_quirk_mirror_read(void *opaque,
                            addr + mirror->offset, size);
 
     addr += mirror->config_offset;
-    data = vfio_pci_read_config(&vdev->pdev, addr, size);
+    data = vfio_pci_read_config(pdev, addr, size);
     trace_vfio_quirk_generic_mirror_read(vdev->vbasedev.name,
                                          memory_region_name(mirror->mem),
                                          addr, data);
@@ -175,9 +178,10 @@ static void vfio_generic_quirk_mirror_write(void *opaque, hwaddr addr,
 {
     VFIOConfigMirrorQuirk *mirror = opaque;
     VFIOPCIDevice *vdev = mirror->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     addr += mirror->config_offset;
-    vfio_pci_write_config(&vdev->pdev, addr, data, size);
+    vfio_pci_write_config(pdev, addr, data, size);
     trace_vfio_quirk_generic_mirror_write(vdev->vbasedev.name,
                                           memory_region_name(mirror->mem),
                                           addr, data);
@@ -211,7 +215,8 @@ static uint64_t vfio_ati_3c3_quirk_read(void *opaque,
                                         hwaddr addr, unsigned size)
 {
     VFIOPCIDevice *vdev = opaque;
-    uint64_t data = vfio_pci_read_config(&vdev->pdev,
+    PCIDevice *pdev = PCI_DEVICE(vdev);
+    uint64_t data = vfio_pci_read_config(pdev,
                                          PCI_BASE_ADDRESS_4 + 1, size);
 
     trace_vfio_quirk_ati_3c3_read(vdev->vbasedev.name, data);
@@ -563,6 +568,7 @@ static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque,
 {
     VFIONvidia3d0Quirk *quirk = opaque;
     VFIOPCIDevice *vdev = quirk->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIONvidia3d0State old_state = quirk->state;
     uint64_t data = vfio_vga_read(&vdev->vga->region[QEMU_PCI_VGA_IO_HI],
                                   addr + 0x10, size);
@@ -573,7 +579,7 @@ static uint64_t vfio_nvidia_3d0_quirk_read(void *opaque,
         (quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
         uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
 
-        data = vfio_pci_read_config(&vdev->pdev, offset, size);
+        data = vfio_pci_read_config(pdev, offset, size);
         trace_vfio_quirk_nvidia_3d0_read(vdev->vbasedev.name,
                                          offset, size, data);
     }
@@ -586,6 +592,7 @@ static void vfio_nvidia_3d0_quirk_write(void *opaque, hwaddr addr,
 {
     VFIONvidia3d0Quirk *quirk = opaque;
     VFIOPCIDevice *vdev = quirk->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIONvidia3d0State old_state = quirk->state;
 
     quirk->state = NONE;
@@ -599,7 +606,7 @@ static void vfio_nvidia_3d0_quirk_write(void *opaque, hwaddr addr,
         if ((quirk->offset & ~(PCI_CONFIG_SPACE_SIZE - 1)) == 0x1800) {
             uint8_t offset = quirk->offset & (PCI_CONFIG_SPACE_SIZE - 1);
 
-            vfio_pci_write_config(&vdev->pdev, offset, data, size);
+            vfio_pci_write_config(pdev, offset, data, size);
             trace_vfio_quirk_nvidia_3d0_write(vdev->vbasedev.name,
                                               offset, data, size);
             return;
@@ -815,7 +822,7 @@ static void vfio_nvidia_quirk_mirror_write(void *opaque, hwaddr addr,
 {
     VFIOConfigMirrorQuirk *mirror = opaque;
     VFIOPCIDevice *vdev = mirror->vdev;
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     LastDataSet *last = (LastDataSet *)&mirror->data;
 
     vfio_generic_quirk_mirror_write(opaque, addr, data, size);
@@ -1005,6 +1012,7 @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
 {
     VFIOrtl8168Quirk *rtl = opaque;
     VFIOPCIDevice *vdev = rtl->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     rtl->enabled = false;
 
@@ -1013,7 +1021,7 @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
         rtl->addr = (uint32_t)data;
 
         if (data & 0x80000000U) { /* Do write */
-            if (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX) {
+            if (pdev->cap_present & QEMU_PCI_CAP_MSIX) {
                 hwaddr offset = data & 0xfff;
                 uint64_t val = rtl->data;
 
@@ -1021,7 +1029,7 @@ static void vfio_rtl8168_quirk_address_write(void *opaque, hwaddr addr,
                                                     (uint16_t)offset, val);
 
                 /* Write to the proper guest MSI-X table instead */
-                memory_region_dispatch_write(&vdev->pdev.msix_table_mmio,
+                memory_region_dispatch_write(&pdev->msix_table_mmio,
                                              offset, val,
                                              size_memop(size) | MO_LE,
                                              MEMTXATTRS_UNSPECIFIED);
@@ -1049,11 +1057,12 @@ static uint64_t vfio_rtl8168_quirk_data_read(void *opaque,
 {
     VFIOrtl8168Quirk *rtl = opaque;
     VFIOPCIDevice *vdev = rtl->vdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint64_t data = vfio_region_read(&vdev->bars[2].region, addr + 0x70, size);
 
-    if (rtl->enabled && (vdev->pdev.cap_present & QEMU_PCI_CAP_MSIX)) {
+    if (rtl->enabled && (pdev->cap_present & QEMU_PCI_CAP_MSIX)) {
         hwaddr offset = rtl->addr & 0xfff;
-        memory_region_dispatch_read(&vdev->pdev.msix_table_mmio, offset,
+        memory_region_dispatch_read(&pdev->msix_table_mmio, offset,
                                     &data, size_memop(size) | MO_LE,
                                     MEMTXATTRS_UNSPECIFIED);
         trace_vfio_quirk_rtl8168_msix_read(vdev->vbasedev.name, offset, data);
@@ -1297,7 +1306,7 @@ static void vfio_radeon_set_gfx_only_reset(VFIOPCIDevice *vdev)
 
 static int vfio_radeon_reset(VFIOPCIDevice *vdev)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int i, ret = 0;
     uint32_t data;
 
@@ -1454,7 +1463,7 @@ static bool is_valid_std_cap_offset(uint8_t pos)
 static bool vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
 {
     ERRP_GUARD();
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int ret, pos;
     bool c8_conflict = false, d4_conflict = false;
     uint8_t tmp;
@@ -1547,6 +1556,7 @@ static bool vfio_add_nv_gpudirect_cap(VFIOPCIDevice *vdev, Error **errp)
 static bool vfio_add_vmd_shadow_cap(VFIOPCIDevice *vdev, Error **errp)
 {
     ERRP_GUARD();
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     uint8_t membar_phys[16];
     int ret, pos = 0xE8;
 
@@ -1565,7 +1575,7 @@ static bool vfio_add_vmd_shadow_cap(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    ret = pci_add_capability(&vdev->pdev, PCI_CAP_ID_VNDR, pos,
+    ret = pci_add_capability(pdev, PCI_CAP_ID_VNDR, pos,
                              VMD_SHADOW_CAP_LEN, errp);
     if (ret < 0) {
         error_prepend(errp, "Failed to add VMD MEMBAR Shadow cap: ");
@@ -1574,10 +1584,10 @@ static bool vfio_add_vmd_shadow_cap(VFIOPCIDevice *vdev, Error **errp)
 
     memset(vdev->emulated_config_bits + pos, 0xFF, VMD_SHADOW_CAP_LEN);
     pos += PCI_CAP_FLAGS;
-    pci_set_byte(vdev->pdev.config + pos++, VMD_SHADOW_CAP_LEN);
-    pci_set_byte(vdev->pdev.config + pos++, VMD_SHADOW_CAP_VER);
-    pci_set_long(vdev->pdev.config + pos, 0x53484457); /* SHDW */
-    memcpy(vdev->pdev.config + pos + 4, membar_phys, 16);
+    pci_set_byte(pdev->config + pos++, VMD_SHADOW_CAP_LEN);
+    pci_set_byte(pdev->config + pos++, VMD_SHADOW_CAP_VER);
+    pci_set_long(pdev->config + pos, 0x53484457); /* SHDW */
+    memcpy(pdev->config + pos + 4, membar_phys, 16);
 
     return true;
 }

From 54a3eb315023f59db0426d85604f4527bf7b1aaa Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:58 +0100
Subject: [PATCH 0352/2396] vfio/cpr.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOPCIDevice and PCIDevice instead of
accessing pdev directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-19-mark.caveayland@nutanix.com
[ clg: Updated vfio_cpr_set_msi_virq() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index a831243e02..f911988add 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -56,7 +56,7 @@ static void vfio_cpr_claim_vectors(VFIOPCIDevice *vdev, int nr_vectors,
 {
     int i, fd;
     bool pending = false;
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
 
     vdev->nr_vectors = nr_vectors;
     vdev->msi_vectors = g_new0(VFIOMSIVector, nr_vectors);
@@ -99,7 +99,7 @@ static void vfio_cpr_claim_vectors(VFIOPCIDevice *vdev, int nr_vectors,
 static int vfio_cpr_pci_pre_load(void *opaque)
 {
     VFIOPCIDevice *vdev = opaque;
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int size = MIN(pci_config_size(pdev), vdev->config_size);
     int i;
 
@@ -113,7 +113,7 @@ static int vfio_cpr_pci_pre_load(void *opaque)
 static int vfio_cpr_pci_post_load(void *opaque, int version_id)
 {
     VFIOPCIDevice *vdev = opaque;
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int nr_vectors;
 
     vfio_sub_page_bar_update_mappings(vdev);
@@ -214,7 +214,7 @@ static int set_irqfd_notifier_gsi(KVMState *s, EventNotifier *n,
 static int vfio_cpr_set_msi_virq(VFIOPCIDevice *vdev, Error **errp, bool enable)
 {
     const char *op = (enable ? "enable" : "disable");
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int i, nr_vectors, ret = 0;
 
     if (msix_enabled(pdev)) {

From 8d3776dd6d8740fb7c91c7c1c25b60fc7edfd19c Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:25:59 +0100
Subject: [PATCH 0353/2396] vfio/igd.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOPCIDevice and PCIDevice instead of
accessing pdev directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Tomita Moeko <tomitamoeko@gmail.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-20-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/igd.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/hw/vfio/igd.c b/hw/vfio/igd.c
index f116c40ccd..4bfa2e0fcd 100644
--- a/hw/vfio/igd.c
+++ b/hw/vfio/igd.c
@@ -200,7 +200,7 @@ static bool vfio_pci_igd_opregion_detect(VFIOPCIDevice *vdev,
     }
 
     /* Hotplugging is not supported for opregion access */
-    if (vdev->pdev.qdev.hotplugged) {
+    if (DEVICE(vdev)->hotplugged) {
         warn_report("IGD device detected, but OpRegion is not supported "
                     "on hotplugged device.");
         return false;
@@ -260,11 +260,12 @@ static int vfio_pci_igd_copy(VFIOPCIDevice *vdev, PCIDevice *pdev,
 static int vfio_pci_igd_host_init(VFIOPCIDevice *vdev,
                                   struct vfio_region_info *info)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     PCIBus *bus;
     PCIDevice *host_bridge;
     int ret;
 
-    bus = pci_device_root_bus(&vdev->pdev);
+    bus = pci_device_root_bus(pdev);
     host_bridge = pci_find_device(bus, 0, PCI_DEVFN(0, 0));
 
     if (!host_bridge) {
@@ -327,13 +328,14 @@ type_init(vfio_pci_igd_register_types)
 static int vfio_pci_igd_lpc_init(VFIOPCIDevice *vdev,
                                  struct vfio_region_info *info)
 {
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     PCIDevice *lpc_bridge;
     int ret;
 
-    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
+    lpc_bridge = pci_find_device(pci_device_root_bus(pdev),
                                  0, PCI_DEVFN(0x1f, 0));
     if (!lpc_bridge) {
-        lpc_bridge = pci_create_simple(pci_device_root_bus(&vdev->pdev),
+        lpc_bridge = pci_create_simple(pci_device_root_bus(pdev),
                                  PCI_DEVFN(0x1f, 0), "vfio-pci-igd-lpc-bridge");
     }
 
@@ -350,13 +352,14 @@ static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
 {
     struct vfio_region_info *host = NULL;
     struct vfio_region_info *lpc = NULL;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     PCIDevice *lpc_bridge;
     int ret;
 
     /*
      * Copying IDs or creating new devices are not supported on hotplug
      */
-    if (vdev->pdev.qdev.hotplugged) {
+    if (DEVICE(vdev)->hotplugged) {
         error_setg(errp, "IGD LPC is not supported on hotplugged device");
         return false;
     }
@@ -366,7 +369,7 @@ static bool vfio_pci_igd_setup_lpc_bridge(VFIOPCIDevice *vdev, Error **errp)
      * can stuff host values into, so if there's already one there and it's not
      * one we can hack on, this quirk is no-go.  Sorry Q35.
      */
-    lpc_bridge = pci_find_device(pci_device_root_bus(&vdev->pdev),
+    lpc_bridge = pci_find_device(pci_device_root_bus(pdev),
                                  0, PCI_DEVFN(0x1f, 0));
     if (lpc_bridge && !object_dynamic_cast(OBJECT(lpc_bridge),
                                            "vfio-pci-igd-lpc-bridge")) {
@@ -510,6 +513,7 @@ void vfio_probe_igd_bar0_quirk(VFIOPCIDevice *vdev, int nr)
 static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 {
     struct vfio_region_info *opregion = NULL;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     int ret, gen;
     uint64_t gms_size = 0;
     uint64_t *bdsm_size;
@@ -529,7 +533,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
     info_report("OpRegion detected on Intel display %x.", vdev->device_id);
 
     gen = igd_gen(vdev);
-    gmch = vfio_pci_read_config(&vdev->pdev, IGD_GMCH, 4);
+    gmch = vfio_pci_read_config(pdev, IGD_GMCH, 4);
 
     /*
      * For backward compatibility, enable legacy mode when
@@ -544,7 +548,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         (gen >= 6 && gen <= 9) &&
         !(gmch & IGD_GMCH_VGA_DISABLE) &&
         !strcmp(MACHINE_GET_CLASS(qdev_get_machine())->family, "pc_piix") &&
-        (&vdev->pdev == pci_find_device(pci_device_root_bus(&vdev->pdev),
+        (pdev == pci_find_device(pci_device_root_bus(pdev),
         0, PCI_DEVFN(0x2, 0)))) {
         /*
          * IGD legacy mode requires:
@@ -566,7 +570,7 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
          */
         ret = vfio_device_get_region_info(&vdev->vbasedev,
                                           VFIO_PCI_ROM_REGION_INDEX, &rom);
-        if ((ret || !rom->size) && !vdev->pdev.romfile) {
+        if ((ret || !rom->size) && !pdev->romfile) {
             error_setg(&err, "Device has no ROM");
             goto error;
         }
@@ -611,8 +615,8 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
      * ASLS (OpRegion address) is read-only, emulated
      * It contains HPA, guest firmware need to reprogram it with GPA.
      */
-    pci_set_long(vdev->pdev.config + IGD_ASLS, 0);
-    pci_set_long(vdev->pdev.wmask + IGD_ASLS, ~0);
+    pci_set_long(pdev->config + IGD_ASLS, 0);
+    pci_set_long(pdev->wmask + IGD_ASLS, ~0);
     pci_set_long(vdev->emulated_config_bits + IGD_ASLS, ~0);
 
     /*
@@ -626,8 +630,8 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
         }
 
         /* GMCH is read-only, emulated */
-        pci_set_long(vdev->pdev.config + IGD_GMCH, gmch);
-        pci_set_long(vdev->pdev.wmask + IGD_GMCH, 0);
+        pci_set_long(pdev->config + IGD_GMCH, gmch);
+        pci_set_long(pdev->wmask + IGD_GMCH, 0);
         pci_set_long(vdev->emulated_config_bits + IGD_GMCH, ~0);
     }
 
@@ -636,12 +640,12 @@ static bool vfio_pci_igd_config_quirk(VFIOPCIDevice *vdev, Error **errp)
 
         /* BDSM is read-write, emulated. BIOS needs to be able to write it */
         if (gen < 11) {
-            pci_set_long(vdev->pdev.config + IGD_BDSM, 0);
-            pci_set_long(vdev->pdev.wmask + IGD_BDSM, ~0);
+            pci_set_long(pdev->config + IGD_BDSM, 0);
+            pci_set_long(pdev->wmask + IGD_BDSM, ~0);
             pci_set_long(vdev->emulated_config_bits + IGD_BDSM, ~0);
         } else {
-            pci_set_quad(vdev->pdev.config + IGD_BDSM_GEN11, 0);
-            pci_set_quad(vdev->pdev.wmask + IGD_BDSM_GEN11, ~0);
+            pci_set_quad(pdev->config + IGD_BDSM_GEN11, 0);
+            pci_set_quad(pdev->wmask + IGD_BDSM_GEN11, ~0);
             pci_set_quad(vdev->emulated_config_bits + IGD_BDSM_GEN11, ~0);
         }
     }

From a49ef7a467c3ced0be048b02189092031e325d01 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:26:00 +0100
Subject: [PATCH 0354/2396] vfio-user/pci.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOPCIDevice and PCIDevice instead of
accessing pdev directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-21-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index c3947a8f2e..e2c309784f 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -65,7 +65,7 @@ static void vfio_user_msix_setup(VFIOPCIDevice *vdev)
     vdev->msix->pba_region = pba_reg;
 
     vfio_reg = vdev->bars[vdev->msix->pba_bar].mr;
-    msix_reg = &vdev->pdev.msix_pba_mmio;
+    msix_reg = &PCI_DEVICE(vdev)->msix_pba_mmio;
     memory_region_init_io(pba_reg, OBJECT(vdev), &vfio_user_pba_ops, vdev,
                           "VFIO MSIX PBA", int128_get64(msix_reg->size));
     memory_region_add_subregion_overlap(vfio_reg, vdev->msix->pba_offset,
@@ -86,7 +86,7 @@ static void vfio_user_msix_teardown(VFIOPCIDevice *vdev)
 
 static void vfio_user_dma_read(VFIOPCIDevice *vdev, VFIOUserDMARW *msg)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIOUserProxy *proxy = vdev->vbasedev.proxy;
     VFIOUserDMARW *res;
     MemTxResult r;
@@ -134,7 +134,7 @@ static void vfio_user_dma_read(VFIOPCIDevice *vdev, VFIOUserDMARW *msg)
 
 static void vfio_user_dma_write(VFIOPCIDevice *vdev, VFIOUserDMARW *msg)
 {
-    PCIDevice *pdev = &vdev->pdev;
+    PCIDevice *pdev = PCI_DEVICE(vdev);
     VFIOUserProxy *proxy = vdev->vbasedev.proxy;
     MemTxResult r;
 

From e2827210d6a9c56c1b14b00b414dfa9eb7843711 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:26:01 +0100
Subject: [PATCH 0355/2396] s390x/s390-pci-vfio.c: use QOM casts where
 appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to cast to VFIOPCIDevice instead of using container_of().

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-22-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/s390x/s390-pci-vfio.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index aaf91319b4..938a551171 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -62,7 +62,7 @@ S390PCIDMACount *s390_pci_start_dma_count(S390pciState *s,
 {
     S390PCIDMACount *cnt;
     uint32_t avail;
-    VFIOPCIDevice *vpdev = container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpdev = VFIO_PCI_BASE(pbdev->pdev);
     int id;
 
     assert(vpdev);
@@ -108,7 +108,7 @@ static void s390_pci_read_base(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_base *cap;
-    VFIOPCIDevice *vpci =  container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
     uint64_t vfio_size;
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_BASE);
@@ -162,7 +162,7 @@ static bool get_host_fh(S390PCIBusDevice *pbdev, struct vfio_device_info *info,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_base *cap;
-    VFIOPCIDevice *vpci = container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_BASE);
 
@@ -185,7 +185,7 @@ static void s390_pci_read_group(S390PCIBusDevice *pbdev,
     struct vfio_device_info_cap_zpci_group *cap;
     S390pciState *s = s390_get_phb();
     ClpRspQueryPciGrp *resgrp;
-    VFIOPCIDevice *vpci =  container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
     uint8_t start_gid = pbdev->zpci_fn.pfgid;
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_GROUP);
@@ -264,7 +264,7 @@ static void s390_pci_read_util(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_util *cap;
-    VFIOPCIDevice *vpci =  container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_UTIL);
 
@@ -291,7 +291,7 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_pfip *cap;
-    VFIOPCIDevice *vpci =  container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_PFIP);
 
@@ -314,7 +314,7 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
 
 static struct vfio_device_info *get_device_info(S390PCIBusDevice *pbdev)
 {
-    VFIOPCIDevice *vfio_pci = container_of(pbdev->pdev, VFIOPCIDevice, pdev);
+    VFIOPCIDevice *vfio_pci = VFIO_PCI_BASE(pbdev->pdev);
 
     return vfio_get_device_info(vfio_pci->vbasedev.fd);
 }

From bb986792a968ee51cda72cd4cc05822198495375 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Tue, 15 Jul 2025 10:26:02 +0100
Subject: [PATCH 0356/2396] vfio/pci.h: rename VFIOPCIDevice pdev field to
 parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the pdev field directly, rename pdev to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250715093110.107317-23-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr.c | 4 ++--
 hw/vfio/pci.c | 4 ++--
 hw/vfio/pci.h | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index f911988add..2c71fc1e8e 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -173,8 +173,8 @@ const VMStateDescription vfio_cpr_pci_vmstate = {
     .post_load = vfio_cpr_pci_post_load,
     .needed = cpr_incoming_needed,
     .fields = (VMStateField[]) {
-        VMSTATE_PCI_DEVICE(pdev, VFIOPCIDevice),
-        VMSTATE_MSIX_TEST(pdev, VFIOPCIDevice, pci_msix_present),
+        VMSTATE_PCI_DEVICE(parent_obj, VFIOPCIDevice),
+        VMSTATE_MSIX_TEST(parent_obj, VFIOPCIDevice, pci_msix_present),
         VMSTATE_VFIO_INTX(intx, VFIOPCIDevice),
         VMSTATE_END_OF_LIST()
     }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 052591d2c9..d14e96b2f8 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2811,8 +2811,8 @@ static const VMStateDescription vmstate_vfio_pci_config = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (const VMStateField[]) {
-        VMSTATE_PCI_DEVICE(pdev, VFIOPCIDevice),
-        VMSTATE_MSIX_TEST(pdev, VFIOPCIDevice, vfio_msix_present),
+        VMSTATE_PCI_DEVICE(parent_obj, VFIOPCIDevice),
+        VMSTATE_MSIX_TEST(parent_obj, VFIOPCIDevice, vfio_msix_present),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription * const []) {
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index 2db76b6f4f..e0aef82a89 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -123,7 +123,7 @@ typedef struct VFIOMSIXInfo {
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_BASE)
 
 struct VFIOPCIDevice {
-    PCIDevice pdev;
+    PCIDevice parent_obj;
 
     VFIODevice vbasedev;
     VFIOINTx intx;

From 180c65c3467f49565ffe26f663a0482717f7d4ea Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 8 May 2025 16:41:17 +0200
Subject: [PATCH 0357/2396] hw/display/bcm2835_fb: Move inclusion of console.h
 to the .c file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The definitions from console.h are not needed in the bcm2835_fb.h
header file yet, so let's move it to the place that really needs
its definitions, i.e. into the bcm2835_fb.c file.
This way the header can also be used by code that is not compiled
with the CFLAGS that are required for pixman or OpenGL (in case
their headers do not reside under /usr/include).

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250508144120.163009-3-thuth@redhat.com>
---
 hw/display/bcm2835_fb.c         | 1 +
 include/hw/display/bcm2835_fb.h | 1 -
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index 820e67ac8b..1bb2ee45a0 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -27,6 +27,7 @@
 #include "hw/display/bcm2835_fb.h"
 #include "hw/hw.h"
 #include "hw/irq.h"
+#include "ui/console.h"
 #include "framebuffer.h"
 #include "ui/pixel_ops.h"
 #include "hw/misc/bcm2835_mbox_defs.h"
diff --git a/include/hw/display/bcm2835_fb.h b/include/hw/display/bcm2835_fb.h
index 49541bf08f..acc9230b6a 100644
--- a/include/hw/display/bcm2835_fb.h
+++ b/include/hw/display/bcm2835_fb.h
@@ -13,7 +13,6 @@
 #define BCM2835_FB_H
 
 #include "hw/sysbus.h"
-#include "ui/console.h"
 #include "qom/object.h"
 
 #define UPPER_RAM_BASE 0x40000000

From b3a51bb30bc72f88231e3b6a63c04eef5c36433c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 8 May 2025 16:41:20 +0200
Subject: [PATCH 0358/2396] Revert "meson.build: Disable -fzero-call-used-regs
 on OpenBSD"

This reverts commit 2d6d995709482cc8b6a76dbb5334a28001a14a9a.

OpenBSD 7.7 fixed the problem with the -fzero-call-used-regs on OpenBSD,
see https://github.com/openbsd/src/commit/03eca72d1e030b7a542cd6aec1 for
the fix there.

Suggested-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250508144120.163009-6-thuth@redhat.com>
---
 meson.build | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/meson.build b/meson.build
index fa6186db33..3d73873356 100644
--- a/meson.build
+++ b/meson.build
@@ -709,11 +709,7 @@ hardening_flags = [
 #
 # NB: Clang 17 is broken and SEGVs
 # https://github.com/llvm/llvm-project/issues/75168
-#
-# NB2: This clashes with the "retguard" extension of OpenBSD's Clang
-# https://gitlab.com/qemu-project/qemu/-/issues/2278
-if host_os != 'openbsd' and \
-   cc.compiles('extern struct { void (*cb)(void); } s; void f(void) { s.cb(); }',
+if cc.compiles('extern struct { void (*cb)(void); } s; void f(void) { s.cb(); }',
                name: '-fzero-call-used-regs=used-gpr',
                args: ['-O2', '-fzero-call-used-regs=used-gpr'])
     hardening_flags += '-fzero-call-used-regs=used-gpr'

From 7af325c23ef5e94b77864d2d2ca64da4a5a35f30 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 28 Jul 2025 13:51:51 +0200
Subject: [PATCH 0359/2396] hw/mips/malta: Silence warning from ubsan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When compiling QEMU with --enable-ubsan there is a undefined behavior
warning when using the malta machine:

 hw/mips/malta.c:1200:32: runtime error: addition of unsigned offset
  to 0x7fb620600000 overflowed to 0x7fb6205fffff
 SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior hw/mips/malta.c:1200:32

To fix the issue, check the bios_size whether we really loaded the
firmware before trying to byte-swap the instructions here.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250728115152.187728-1-thuth@redhat.com>
---
 hw/mips/malta.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 344dc8ca76..02da629b5a 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -1191,7 +1191,7 @@ void mips_malta_init(MachineState *machine)
          * In little endian mode the 32bit words in the bios are swapped,
          * a neat trick which allows bi-endian firmware.
          */
-        if (!TARGET_BIG_ENDIAN) {
+        if (!TARGET_BIG_ENDIAN && bios_size > 0) {
             uint32_t *end, *addr;
             const size_t swapsize = MIN(bios_size, 0x3e0000);
             addr = rom_ptr(FLASH_ADDRESS, swapsize);

From 2dbaf58bbe78f415ec867dc238f90321ed8a3f62 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 28 Jul 2025 19:25:45 +0200
Subject: [PATCH 0360/2396] system/physmem: Silence warning from ubsan

When compiling QEMU with --enable-ubsan there is a undefined behavior
warning when running the bios-tables-test for example:

 .../system/physmem.c:3243:13: runtime error: applying non-zero offset 262144 to null pointer
    #0 0x55ac1df5fbc4 in address_space_write_rom_internal .../system/physmem.c:3243:13

The problem is that buf is indeed NULL if the function is e.g. called
with type == FLUSH_CACHE. Add a check to fix the issue.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250728172545.314178-1-thuth@redhat.com>
---
 system/physmem.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/system/physmem.c b/system/physmem.c
index f498572fc8..311011156c 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3231,8 +3231,10 @@ static inline MemTxResult address_space_write_rom_internal(AddressSpace *as,
             }
         }
         len -= l;
-        buf += l;
         addr += l;
+        if (buf) {
+            buf += l;
+        }
     }
     return MEMTX_OK;
 }

From 38dd513263d814dc3cf554b899c118a46ca77577 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 21 Aug 2025 16:51:30 +0200
Subject: [PATCH 0361/2396] ui/vnc: Fix crash when specifying [vnc] without id
 in the config file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU currently crashes when there is a [vnc] section in the config
file that does not have an "id = ..." line:

 $ echo "[vnc]" > /tmp/qemu.conf
 $ ./qemu-system-x86_64 -readconfig /tmp/qemu.conf
 qemu-system-x86_64: ../../devel/qemu/ui/vnc.c:4347: vnc_init_func:
  Assertion `id' failed.
 Aborted (core dumped)

The required "id" is only set up automatically while parsing the command
line, but not when reading the options from the config file.
Thus let's move code that automatically adds the id (if it does not
exist yet) to the init function that needs the id for the first time,
replacing the assert() statement there.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2836
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250821145130.845104-1-thuth@redhat.com>
---
 ui/vnc.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 68ca4a68e7..9054fc8125 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -4309,8 +4309,9 @@ void vnc_display_add_client(const char *id, int csock, bool skipauth)
     }
 }
 
-static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
+static char *vnc_auto_assign_id(QemuOpts *opts)
 {
+    QemuOptsList *olist = qemu_find_opts("vnc");
     int i = 2;
     char *id;
 
@@ -4320,23 +4321,18 @@ static void vnc_auto_assign_id(QemuOptsList *olist, QemuOpts *opts)
         id = g_strdup_printf("vnc%d", i++);
     }
     qemu_opts_set_id(opts, id);
+
+    return id;
 }
 
 void vnc_parse(const char *str)
 {
     QemuOptsList *olist = qemu_find_opts("vnc");
     QemuOpts *opts = qemu_opts_parse_noisily(olist, str, !is_help_option(str));
-    const char *id;
 
     if (!opts) {
         exit(1);
     }
-
-    id = qemu_opts_id(opts);
-    if (!id) {
-        /* auto-assign id if not present */
-        vnc_auto_assign_id(olist, opts);
-    }
 }
 
 int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
@@ -4344,7 +4340,11 @@ int vnc_init_func(void *opaque, QemuOpts *opts, Error **errp)
     Error *local_err = NULL;
     char *id = (char *)qemu_opts_id(opts);
 
-    assert(id);
+    if (!id) {
+        /* auto-assign id if not present */
+        id = vnc_auto_assign_id(opts);
+    }
+
     vnc_display_init(id, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);

From 5f81033e5b3e55eda2a1d06f959c05b61e719d68 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 29 Aug 2025 16:20:00 +0200
Subject: [PATCH 0362/2396] tests/functional/m68k: Avoid ResourceWarning in the
 nextcube test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit c3fd296cf7b1 ("functional: always enable all python
warnings") we enabled more warnings for the functional tests. This
triggers now a warning in the nextcube test:

 tests/functional/m68k/test_nextcube.py:47: ResourceWarning:
  unclosed file <_io.BufferedReader name='tests/functional/m68k/test_nextcube.NextCubeMachine.test_bootrom_framebuffer_size/scratch/dump.ppm'>
   width, height = Image.open(screenshot_path).size

Use a proper "with" context to avoid it.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250829142000.62320-1-thuth@redhat.com>
---
 tests/functional/m68k/test_nextcube.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/functional/m68k/test_nextcube.py b/tests/functional/m68k/test_nextcube.py
index 13c72bd136..c1610e5845 100755
--- a/tests/functional/m68k/test_nextcube.py
+++ b/tests/functional/m68k/test_nextcube.py
@@ -44,7 +44,8 @@ class NextCubeMachine(QemuSystemTest):
         self.check_bootrom_framebuffer(screenshot_path)
 
         from PIL import Image
-        width, height = Image.open(screenshot_path).size
+        with Image.open(screenshot_path) as image:
+                width, height = image.size
         self.assertEqual(width, 1120)
         self.assertEqual(height, 832)
 

From 9f80f3695d305015f5271d946304e5cffee607c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 29 Aug 2025 15:26:14 +0100
Subject: [PATCH 0363/2396] tests/functional: enable force refresh of cached
 assets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the 'QEMU_TEST_REFRESH_CACHE' environment variable is set, then
ignore any existing cached asset and download a fresh copy.

This can be used to selectively refresh assets if set before running
a single test script.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250829142616.2633254-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 docs/devel/testing/functional.rst   | 3 +++
 tests/functional/qemu_test/asset.py | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/docs/devel/testing/functional.rst b/docs/devel/testing/functional.rst
index 3728bab6c0..fdeaebaadc 100644
--- a/docs/devel/testing/functional.rst
+++ b/docs/devel/testing/functional.rst
@@ -312,6 +312,9 @@ The cache is populated in the ``~/.cache/qemu/download`` directory by
 default, but the location can be changed by setting the
 ``QEMU_TEST_CACHE_DIR`` environment variable.
 
+To force the test suite to re-download the cache, even if still valid,
+set the ``QEMU_TEST_REFRESH_CACHE`` environment variable.
+
 Skipping tests
 --------------
 
diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index 704b84d0ea..b5a6136d36 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -72,6 +72,10 @@ class Asset:
         return self.hash == hl.hexdigest()
 
     def valid(self):
+        if os.getenv("QEMU_TEST_REFRESH_CACHE", None) is not None:
+            self.log.info("Force refresh of asset %s", self.url)
+            return False
+
         return self.cache_file.exists() and self._check(self.cache_file)
 
     def fetchable(self):

From 124ab930ba38c41a86533dbfabb7a3b3b270ef98 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 29 Aug 2025 15:26:15 +0100
Subject: [PATCH 0364/2396] tests/functional: fix formatting of exception args
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The catch-all exception handler forgot the placeholder for
the exception details.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250829142616.2633254-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index b5a6136d36..5c74adf224 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -173,7 +173,7 @@ class Asset:
                 continue
             except Exception as e:
                 tmp_cache_file.unlink()
-                raise AssetError(self, "Unable to download: " % e)
+                raise AssetError(self, "Unable to download: %s" % e)
 
         if not os.path.exists(tmp_cache_file):
             raise AssetError(self, "Download retries exceeded", transient=True)

From 335da23abec85cd2f6d10f1fe36b28a02088e723 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 29 Aug 2025 15:26:16 +0100
Subject: [PATCH 0365/2396] tests/functional: handle URLError when fetching
 assets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We treat most HTTP errors as non-fatal when fetching assets,
but forgot to handle network level errors. This adds catching
of URLError so that we retry on failure, and will ultimately
trigger graceful skipping in the pre-cache task.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250829142616.2633254-4-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index 5c74adf224..2dd32bf28d 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -15,7 +15,7 @@ import urllib.request
 from time import sleep
 from pathlib import Path
 from shutil import copyfileobj
-from urllib.error import HTTPError
+from urllib.error import HTTPError, URLError
 
 class AssetError(Exception):
     def __init__(self, asset, msg, transient=False):
@@ -171,6 +171,14 @@ class Asset:
                     raise AssetError(self, "Unable to download: "
                                      "HTTP error %d" % e.code)
                 continue
+            except URLError as e:
+                # This is typically a network/service level error
+                # eg urlopen error [Errno 110] Connection timed out>
+                tmp_cache_file.unlink()
+                self.log.error("Unable to download %s: URL error %s",
+                               self.url, e.reason)
+                raise AssetError(self, "Unable to download: URL error %s" %
+                                 e.reason, transient=True)
             except Exception as e:
                 tmp_cache_file.unlink()
                 raise AssetError(self, "Unable to download: %s" % e)

From 4effdc3c39f93e65396b46cc8432bbb37a8219e8 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Thu, 4 Sep 2025 18:05:52 +0800
Subject: [PATCH 0366/2396] tests/functional/arm: Update test ASPEED SDK v03.02
 for AST1030
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250904100556.1729604-2-kane_chen@aspeedtech.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/arm/test_aspeed_ast1030.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1030.py b/tests/functional/arm/test_aspeed_ast1030.py
index 77037f0179..42126b514f 100755
--- a/tests/functional/arm/test_aspeed_ast1030.py
+++ b/tests/functional/arm/test_aspeed_ast1030.py
@@ -12,17 +12,17 @@ from qemu_test import exec_command_and_wait_for_pattern
 
 class AST1030Machine(LinuxKernelTest):
 
-    ASSET_ZEPHYR_3_00 = Asset(
+    ASSET_ZEPHYR_3_02 = Asset(
         ('https://github.com/AspeedTech-BMC'
-         '/zephyr/releases/download/v00.03.00/ast1030-evb-demo.zip'),
-        '37fe3ecd4a1b9d620971a15b96492a81093435396eeac69b6f3e384262ff555f')
+         '/zephyr/releases/download/v00.03.02/ast1030-evb-demo.zip'),
+        '1ec83caab3ddd5d09481772801be7210e222cb015ce22ec6fffb8a76956dcd4f')
 
-    def test_ast1030_zephyros_3_00(self):
+    def test_ast1030_zephyros_3_02(self):
         self.set_machine('ast1030-evb')
 
-        kernel_name = "ast1030-evb-demo/zephyr.elf"
+        kernel_name = "ast1030-evb-demo-3/zephyr.elf"
         kernel_file = self.archive_extract(
-            self.ASSET_ZEPHYR_3_00, member=kernel_name)
+            self.ASSET_ZEPHYR_3_02, member=kernel_name)
 
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_file, '-nographic')

From bab31635d76fcbd9da8fff2c6c99906e86b449ec Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Thu, 4 Sep 2025 18:05:53 +0800
Subject: [PATCH 0367/2396] tests/functional/arm: Update test ASPEED SDK v09.07
 for AST2500
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250904100556.1729604-3-kane_chen@aspeedtech.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2500.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast2500.py b/tests/functional/arm/test_aspeed_ast2500.py
index 6923fe8701..4fdd81e2f9 100755
--- a/tests/functional/arm/test_aspeed_ast2500.py
+++ b/tests/functional/arm/test_aspeed_ast2500.py
@@ -37,14 +37,14 @@ class AST2500Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V906_AST2500 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2500-default-obmc.tar.gz',
-        '542db84645b4efd8aed50385d7f4dd1caff379a987032311cfa7b563a3addb2a')
+    ASSET_SDK_V907_AST2500 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2500-default-obmc.tar.gz',
+        'd52bcc279a37c8d7679b3e4ef22cc77c36f0f6624c687b37334f798828afb077')
 
     def test_arm_ast2500_evb_sdk(self):
         self.set_machine('ast2500-evb')
 
-        self.archive_extract(self.ASSET_SDK_V906_AST2500)
+        self.archive_extract(self.ASSET_SDK_V907_AST2500)
 
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2500-default", "image-bmc"))

From f57d0872694bc0de03bc6654db72f2ec7281f1ae Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Thu, 4 Sep 2025 18:05:54 +0800
Subject: [PATCH 0368/2396] tests/functional/arm: Update test ASPEED SDK v09.07
 for AST2600
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250904100556.1729604-4-kane_chen@aspeedtech.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2600.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600.py
index fdae4c939d..129695ca4e 100755
--- a/tests/functional/arm/test_aspeed_ast2600.py
+++ b/tests/functional/arm/test_aspeed_ast2600.py
@@ -97,14 +97,14 @@ class AST2600Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V906_AST2600 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2600-default-obmc.tar.gz',
-        '768d76e247896ad78c154b9cff4f766da2ce65f217d620b286a4a03a8a4f68f5')
+    ASSET_SDK_V907_AST2600 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2600-default-obmc.tar.gz',
+        'cb6c08595bcbba1672ce716b068ba4e48eda1ed9abe78a07b30392ba2278feba')
 
     def test_arm_ast2600_evb_sdk(self):
         self.set_machine('ast2600-evb')
 
-        self.archive_extract(self.ASSET_SDK_V906_AST2600)
+        self.archive_extract(self.ASSET_SDK_V907_AST2600)
 
         self.vm.add_args('-device',
             'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')

From 8cdcabe129cdd3270fd5c21708833464396fbf9b Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Thu, 4 Sep 2025 18:05:55 +0800
Subject: [PATCH 0369/2396] tests/functional/arm: Update test ASPEED SDK v09.07
 for AST2700 vbootrom
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20250904100556.1729604-5-kane_chen@aspeedtech.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700.py | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index d02dc7991c..8a08bc4688 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -54,6 +54,10 @@ class AST2x00MachineSDK(QemuSystemTest):
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-default-obmc.tar.gz',
             'f1d53e0be8a404ecce3e105f72bc50fa4e090ad13160ffa91b10a6e0233a9dc6')
 
+    ASSET_SDK_V907_AST2700A1_VBOOROM = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2700-default-obmc.tar.gz',
+            '6e9e0c4b13e0f26040eca3f4a7f17cf09fc0f5c37c820500ff79370cc3c44add')
+
     def do_ast2700_i2c_test(self):
         exec_command_and_wait_for_pattern(self,
             'echo lm75 0x4d > /sys/class/i2c-dev/i2c-1/device/new_device ',
@@ -127,10 +131,10 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
 
-    def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_06(self):
+    def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_07(self):
         self.set_machine('ast2700a1-evb')
 
-        self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
+        self.archive_extract(self.ASSET_SDK_V907_AST2700A1_VBOOROM)
         self.start_ast2700_test_vbootrom('ast2700-default')
         self.verify_vbootrom_firmware_flow()
         self.verify_openbmc_boot_and_login('ast2700-default')

From 8e22db01a1f45b108f55860514f8896952af550e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 20:08:58 +0100
Subject: [PATCH 0370/2396] gitlab: replace avocado results files with meson
 results files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'results.xml' file and 'test-results' directory were both outputs
of the avovcado test runner. Since we're now using meson with the new
functional test framework, we must reference meson results files as the
CI artifacts.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908190901.3571859-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 038c3c9540..4672298214 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -104,11 +104,10 @@
     when: always
     expire_in: 7 days
     paths:
-      - build/tests/results/latest/results.xml
-      - build/tests/results/latest/test-results
+      - build/meson-logs/testlog.txt
       - build/tests/functional/*/*/*.log
     reports:
-      junit: build/tests/results/latest/results.xml
+      junit: build/meson-logs/testlog.junit.xml
   before_script:
     - export QEMU_TEST_ALLOW_UNTRUSTED_CODE=1
     - export QEMU_TEST_CACHE_DIR=${CI_PROJECT_DIR}/functional-cache

From ce1a7cd4cf090e21e0929566400fb759752e28c1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 20:08:59 +0100
Subject: [PATCH 0371/2396] gitlab: always include entire of meson-logs
 directory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are files besides testlog.txt that may be useful as published
CI artifacts.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908190901.3571859-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml  | 4 ++--
 .gitlab-ci.d/buildtest.yml           | 2 +-
 .gitlab-ci.d/crossbuild-template.yml | 2 +-
 .gitlab-ci.d/windows.yml             | 2 +-
 4 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 4672298214..4cc5b20790 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -88,7 +88,7 @@
     when: always
     expire_in: 7 days
     paths:
-      - build/meson-logs/testlog.txt
+      - build/meson-logs
     reports:
       junit: build/meson-logs/testlog.junit.xml
 
@@ -104,7 +104,7 @@
     when: always
     expire_in: 7 days
     paths:
-      - build/meson-logs/testlog.txt
+      - build/meson-logs
       - build/tests/functional/*/*/*.log
     reports:
       junit: build/meson-logs/testlog.junit.xml
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index d888a60063..778289267f 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -613,7 +613,7 @@ gcov:
     when: always
     expire_in: 2 days
     paths:
-      - build/meson-logs/testlog.txt
+      - build/meson-logs
     reports:
       junit: build/meson-logs/testlog.junit.xml
       coverage_report:
diff --git a/.gitlab-ci.d/crossbuild-template.yml b/.gitlab-ci.d/crossbuild-template.yml
index 303943f818..7e70376cfc 100644
--- a/.gitlab-ci.d/crossbuild-template.yml
+++ b/.gitlab-ci.d/crossbuild-template.yml
@@ -128,6 +128,6 @@
     when: always
     expire_in: 7 days
     paths:
-      - build/meson-logs/testlog.txt
+      - build/meson-logs
     reports:
       junit: build/meson-logs/testlog.junit.xml
diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index beac39e5bd..f14e9ca134 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -24,7 +24,7 @@ msys2-64bit:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
     expire_in: 7 days
     paths:
-      - build/meson-logs/testlog.txt
+      - build/meson-logs
     reports:
       junit: "build/meson-logs/testlog.junit.xml"
   before_script:

From c65b3d49b96f2d2da30dba5fb96e07f79e73bd88 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 20:09:00 +0100
Subject: [PATCH 0372/2396] gitlab: include all junit XML files from meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The junit XML file produced by meson does not always have the
name 'testlog.junit.xml' - in the case of 'make check-functional'
there is a 'testlog-thorough.junit.xml' file too.

Improve CI debugging robustness by capturing all junit files that
meson produces.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908190901.3571859-4-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml  | 4 ++--
 .gitlab-ci.d/buildtest.yml           | 2 +-
 .gitlab-ci.d/crossbuild-template.yml | 2 +-
 .gitlab-ci.d/custom-runners.yml      | 2 +-
 .gitlab-ci.d/windows.yml             | 2 +-
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 4cc5b20790..308490a35a 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -90,7 +90,7 @@
     paths:
       - build/meson-logs
     reports:
-      junit: build/meson-logs/testlog.junit.xml
+      junit: build/meson-logs/*.junit.xml
 
 .functional_test_job_template:
   extends: .common_test_job_template
@@ -107,7 +107,7 @@
       - build/meson-logs
       - build/tests/functional/*/*/*.log
     reports:
-      junit: build/meson-logs/testlog.junit.xml
+      junit: build/meson-logs/*.junit.xml
   before_script:
     - export QEMU_TEST_ALLOW_UNTRUSTED_CODE=1
     - export QEMU_TEST_CACHE_DIR=${CI_PROJECT_DIR}/functional-cache
diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 778289267f..83c2867295 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -615,7 +615,7 @@ gcov:
     paths:
       - build/meson-logs
     reports:
-      junit: build/meson-logs/testlog.junit.xml
+      junit: build/meson-logs/*.junit.xml
       coverage_report:
         coverage_format: cobertura
         path: build/coverage.xml
diff --git a/.gitlab-ci.d/crossbuild-template.yml b/.gitlab-ci.d/crossbuild-template.yml
index 7e70376cfc..58136d06e4 100644
--- a/.gitlab-ci.d/crossbuild-template.yml
+++ b/.gitlab-ci.d/crossbuild-template.yml
@@ -130,4 +130,4 @@
     paths:
       - build/meson-logs
     reports:
-      junit: build/meson-logs/testlog.junit.xml
+      junit: build/meson-logs/*.junit.xml
diff --git a/.gitlab-ci.d/custom-runners.yml b/.gitlab-ci.d/custom-runners.yml
index 1aa3c60efe..2d493f70f7 100644
--- a/.gitlab-ci.d/custom-runners.yml
+++ b/.gitlab-ci.d/custom-runners.yml
@@ -26,7 +26,7 @@
       - build/build.ninja
       - build/meson-logs
     reports:
-      junit: build/meson-logs/testlog.junit.xml
+      junit: build/meson-logs/*.junit.xml
 
 include:
   - local: '/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml'
diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index f14e9ca134..1e6a01bd9a 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -26,7 +26,7 @@ msys2-64bit:
     paths:
       - build/meson-logs
     reports:
-      junit: "build/meson-logs/testlog.junit.xml"
+      junit: build/meson-logs/*.junit.xml
   before_script:
   - Write-Output "Acquiring msys2.exe installer at $(Get-Date -Format u)"
   - If ( !(Test-Path -Path msys64\var\cache ) ) {

From f547894f68f9b18e6f3e4404b0a2e8ad013191f8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 20:09:01 +0100
Subject: [PATCH 0373/2396] gitlab: prevent duplicated meson log artifacts in
 test jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The build jobs will populate build/meson-logs/ with various files
that are added as artifacts.

The test jobs preserve the state of the build jobs, so we must
delete any pre-existing logs to prevent confusion from duplicate
artifacts.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908190901.3571859-5-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest-template.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index 308490a35a..d866cb12bb 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -83,6 +83,10 @@
 
 .native_test_job_template:
   extends: .common_test_job_template
+  before_script:
+    # Prevent logs from the build job that run earlier
+    # from being duplicated in the test job artifacts
+    - rm -f build/meson-logs/*
   artifacts:
     name: "$CI_JOB_NAME-$CI_COMMIT_REF_SLUG"
     when: always
@@ -111,6 +115,9 @@
   before_script:
     - export QEMU_TEST_ALLOW_UNTRUSTED_CODE=1
     - export QEMU_TEST_CACHE_DIR=${CI_PROJECT_DIR}/functional-cache
+    # Prevent logs from the build job that run earlier
+    # from being duplicated in the test job artifacts
+    - rm -f build/meson-logs/*
   after_script:
     - cd build
     - du -chs ${CI_PROJECT_DIR}/*-cache

From 595ba81145e76dbbcae700fce39253509172f9ff Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Sep 2025 22:19:29 +0200
Subject: [PATCH 0374/2396] tests/functional: return output from cmd.py helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tests might want to look at the whole output from a command execution,
as well as just logging it. Add support for this.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250903201931.168317-2-john.levon@nutanix.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/cmd.py | 53 +++++++++++++++++++++++++------
 1 file changed, 44 insertions(+), 9 deletions(-)

diff --git a/tests/functional/qemu_test/cmd.py b/tests/functional/qemu_test/cmd.py
index dc5f422b77..c19dfc577f 100644
--- a/tests/functional/qemu_test/cmd.py
+++ b/tests/functional/qemu_test/cmd.py
@@ -45,6 +45,9 @@ def is_readable_executable_file(path):
 # If end of line is seen, with neither @success or @failure
 # return False
 #
+# In both cases, also return the contents of the line (in bytes)
+# up to that point.
+#
 # If @failure is seen, then mark @test as failed
 def _console_read_line_until_match(test, vm, success, failure):
     msg = bytes([])
@@ -76,10 +79,23 @@ def _console_read_line_until_match(test, vm, success, failure):
     except:
         console_logger.debug(msg)
 
-    return done
+    return done, msg
 
 def _console_interaction(test, success_message, failure_message,
                          send_string, keep_sending=False, vm=None):
+    """
+    Interact with the console until either message is seen.
+
+    :param success_message: if this message appears, finish interaction
+    :param failure_message: if this message appears, test fails
+    :param send_string: a string to send to the console before trying
+                        to read a new line
+    :param keep_sending: keep sending the send string each time
+    :param vm: the VM to interact with
+
+    :return: The collected output (in bytes form).
+    """
+
     assert not keep_sending or send_string
     assert success_message or send_string
 
@@ -101,6 +117,8 @@ def _console_interaction(test, success_message, failure_message,
     if failure_message is not None:
         failure_message_b = failure_message.encode()
 
+    out = bytes([])
+
     while True:
         if send_string:
             vm.console_socket.sendall(send_string.encode())
@@ -113,11 +131,17 @@ def _console_interaction(test, success_message, failure_message,
                 break
             continue
 
-        if _console_read_line_until_match(test, vm,
-                                          success_message_b,
-                                          failure_message_b):
+        done, line = _console_read_line_until_match(test, vm,
+                                                    success_message_b,
+                                                    failure_message_b)
+
+        out += line
+
+        if done:
             break
 
+    return out
+
 def interrupt_interactive_console_until_pattern(test, success_message,
                                                 failure_message=None,
                                                 interrupt_string='\r'):
@@ -140,10 +164,12 @@ def interrupt_interactive_console_until_pattern(test, success_message,
     :param failure_message: if this message appears, test fails
     :param interrupt_string: a string to send to the console before trying
                              to read a new line
+
+    :return: The collected output (in bytes form).
     """
     assert success_message
-    _console_interaction(test, success_message, failure_message,
-                         interrupt_string, True)
+    return _console_interaction(test, success_message, failure_message,
+                                interrupt_string, True)
 
 def wait_for_console_pattern(test, success_message, failure_message=None,
                              vm=None):
@@ -155,9 +181,12 @@ def wait_for_console_pattern(test, success_message, failure_message=None,
     :type test: :class:`qemu_test.QemuSystemTest`
     :param success_message: if this message appears, test succeeds
     :param failure_message: if this message appears, test fails
+
+    :return: The collected output (in bytes form).
     """
     assert success_message
-    _console_interaction(test, success_message, failure_message, None, vm=vm)
+    return _console_interaction(test, success_message, failure_message,
+                                None, vm=vm)
 
 def exec_command(test, command):
     """
@@ -168,8 +197,10 @@ def exec_command(test, command):
     :type test: :class:`qemu_test.QemuSystemTest`
     :param command: the command to send
     :type command: str
+
+    :return: The collected output (in bytes form).
     """
-    _console_interaction(test, None, None, command + '\r')
+    return _console_interaction(test, None, None, command + '\r')
 
 def exec_command_and_wait_for_pattern(test, command,
                                       success_message, failure_message=None):
@@ -184,9 +215,13 @@ def exec_command_and_wait_for_pattern(test, command,
     :param command: the command to send
     :param success_message: if this message appears, test succeeds
     :param failure_message: if this message appears, test fails
+
+    :return: The collected output (in bytes form).
     """
     assert success_message
-    _console_interaction(test, success_message, failure_message, command + '\r')
+
+    return _console_interaction(test, success_message, failure_message,
+                                command + '\r')
 
 def get_qemu_img(test):
     test.log.debug('Looking for and selecting a qemu-img binary')

From ba87a01e1af04599e1952cacfb7eb25f06e15da5 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Sep 2025 22:19:30 +0200
Subject: [PATCH 0375/2396] tests/functional: add vm param to cmd.py helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend the "vm" parameter of wait_for_console_pattern() to all the other
utility functions; this allows them to be used on a VM other than
test.vm.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250903201931.168317-3-john.levon@nutanix.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/cmd.py | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tests/functional/qemu_test/cmd.py b/tests/functional/qemu_test/cmd.py
index c19dfc577f..8069c89730 100644
--- a/tests/functional/qemu_test/cmd.py
+++ b/tests/functional/qemu_test/cmd.py
@@ -144,7 +144,8 @@ def _console_interaction(test, success_message, failure_message,
 
 def interrupt_interactive_console_until_pattern(test, success_message,
                                                 failure_message=None,
-                                                interrupt_string='\r'):
+                                                interrupt_string='\r',
+                                                vm=None):
     """
     Keep sending a string to interrupt a console prompt, while logging the
     console output. Typical use case is to break a boot loader prompt, such:
@@ -164,12 +165,13 @@ def interrupt_interactive_console_until_pattern(test, success_message,
     :param failure_message: if this message appears, test fails
     :param interrupt_string: a string to send to the console before trying
                              to read a new line
+    :param vm: VM to use
 
     :return: The collected output (in bytes form).
     """
     assert success_message
     return _console_interaction(test, success_message, failure_message,
-                                interrupt_string, True)
+                                interrupt_string, True, vm=vm)
 
 def wait_for_console_pattern(test, success_message, failure_message=None,
                              vm=None):
@@ -181,6 +183,7 @@ def wait_for_console_pattern(test, success_message, failure_message=None,
     :type test: :class:`qemu_test.QemuSystemTest`
     :param success_message: if this message appears, test succeeds
     :param failure_message: if this message appears, test fails
+    :param vm: VM to use
 
     :return: The collected output (in bytes form).
     """
@@ -188,7 +191,7 @@ def wait_for_console_pattern(test, success_message, failure_message=None,
     return _console_interaction(test, success_message, failure_message,
                                 None, vm=vm)
 
-def exec_command(test, command):
+def exec_command(test, command, vm=None):
     """
     Send a command to a console (appending CRLF characters), while logging
     the content.
@@ -196,14 +199,16 @@ def exec_command(test, command):
     :param test: a test containing a VM.
     :type test: :class:`qemu_test.QemuSystemTest`
     :param command: the command to send
+    :param vm: VM to use
     :type command: str
 
     :return: The collected output (in bytes form).
     """
-    return _console_interaction(test, None, None, command + '\r')
+    return _console_interaction(test, None, None, command + '\r', vm=vm)
 
 def exec_command_and_wait_for_pattern(test, command,
-                                      success_message, failure_message=None):
+                                      success_message, failure_message=None,
+                                      vm=None):
     """
     Send a command to a console (appending CRLF characters), then wait
     for success_message to appear on the console, while logging the.
@@ -215,13 +220,14 @@ def exec_command_and_wait_for_pattern(test, command,
     :param command: the command to send
     :param success_message: if this message appears, test succeeds
     :param failure_message: if this message appears, test fails
+    :param vm: VM to use
 
     :return: The collected output (in bytes form).
     """
     assert success_message
 
     return _console_interaction(test, success_message, failure_message,
-                                command + '\r')
+                                command + '\r', vm=vm)
 
 def get_qemu_img(test):
     test.log.debug('Looking for and selecting a qemu-img binary')

From fb352b3c85a990ba81e41e4e8c7eb53ccc3059a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 14:57:19 +0100
Subject: [PATCH 0376/2396] tests/functional: fix infinite loop on console EOF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'recv' method will return an empty byte array, not None, when
the socket has EOF.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908135722.3375580-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/cmd.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/cmd.py b/tests/functional/qemu_test/cmd.py
index 8069c89730..f544566245 100644
--- a/tests/functional/qemu_test/cmd.py
+++ b/tests/functional/qemu_test/cmd.py
@@ -54,7 +54,7 @@ def _console_read_line_until_match(test, vm, success, failure):
     done = False
     while True:
         c = vm.console_socket.recv(1)
-        if c is None:
+        if not c:
             done = True
             test.fail(
                 f"EOF in console, expected '{success}'")

From e5381b041037f3918163f2b7f82415aee80cd64e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 14:57:20 +0100
Subject: [PATCH 0377/2396] tests/functional: avoid duplicate messages on
 failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In some scenarios the same tests is mentioned in both the
'res.results.errors' and 'res.results.failures' array returned
by unittest.main(). This was seen when the 'tearDown' method
raised an exception.

In such a case, we printed out the same information about where
to find a log file twice for each test. Track which tests we
have already reported on, to avoid the duplication.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250908135722.3375580-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index fbeb171058..82a7724404 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -251,13 +251,14 @@ class QemuBaseTest(unittest.TestCase):
                                    test_output_log = pycotap.LogMode.LogToError)
         res = unittest.main(module = None, testRunner = tr, exit = False,
                             argv=[sys.argv[0], path] + sys.argv[1:])
+        failed = {}
         for (test, message) in res.result.errors + res.result.failures:
-
-            if hasattr(test, "log_filename"):
+            if hasattr(test, "log_filename") and not test.id() in failed:
                 print('More information on ' + test.id() + ' could be found here:'
                       '\n %s' % test.log_filename, file=sys.stderr)
                 if hasattr(test, 'console_log_name'):
                     print(' %s' % test.console_log_name, file=sys.stderr)
+                failed[test.id()] = True
         sys.exit(not res.result.wasSuccessful())
 
 

From 2ee187dcb55aee7f70b514db772090649235de70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 14:57:21 +0100
Subject: [PATCH 0378/2396] tests/functional: avoid tearDown failure when QEMU
 dies
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In a QEMU process under test dies unexpectedly, the 'shutdown'
method may well raise an exception. This causes the tearDown
method to fail, which means any later cleanup code fails to
get run. Most notably the log handlers don't get removed so
the base.log file from an earlier test will get polluted with
messages from any subsequent tests. The tearDown failure also
results in pages of exceptions printed on the console, which
obscures the real failure message / trace printed by the test.

Ignore any shutdown failures in the tearDown method, since any
test which cares about clean shutdown should have already
cleaned up any running VMs. The tearDown method is just there
as a safety net to cleanup resources. The base.log file will
still containing log messages from the failed 'vm.shutdown'
call too.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250908135722.3375580-4-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 82a7724404..faa0a4f0db 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -404,7 +404,10 @@ class QemuSystemTest(QemuBaseTest):
 
     def tearDown(self):
         for vm in self._vms.values():
-            vm.shutdown()
+            try:
+                vm.shutdown()
+            except Exception as ex:
+                self.log.error("Failed to teardown VM: %s" % ex)
         logging.getLogger('console').removeHandler(self._console_log_fh)
         self._console_log_fh.close()
         super().tearDown()

From 2fc170bcdc4d2f05534c68572b4f72a7d18c2119 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 8 Sep 2025 14:57:22 +0100
Subject: [PATCH 0379/2396] tests/functional: purge scratch dir on test startup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test suite purges the scratch dir in the tearDown method, but
if python crashes (or is non-gracefully killed) this won't get run.
Also the user can set QEMU_TEST_KEEP_SCRATCH to disable cleanup.

Purging the scratch dir on startup ensures that tests always run
from a clean state.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250908135722.3375580-5-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index faa0a4f0db..2c0abde395 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -205,6 +205,10 @@ class QemuBaseTest(unittest.TestCase):
         self.outputdir = self.build_file('tests', 'functional',
                                          self.arch, self.id())
         self.workdir = os.path.join(self.outputdir, 'scratch')
+        if os.path.exists(self.workdir):
+            # Purge as safety net in case of unclean termination of
+            # previous test, or use of QEMU_TEST_KEEP_SCRATCH
+            shutil.rmtree(self.workdir)
         os.makedirs(self.workdir, exist_ok=True)
 
         self.log_filename = self.log_file('base.log')

From 769acb2a1e47b97ada8e0db6ff73e303b23764d8 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 9 Sep 2025 14:37:47 +0200
Subject: [PATCH 0380/2396] tests/functional/aarch64: Fix assets of
 test_hotplug_pci

The old bookworm URLs don't work anymore, resulting in a 404 error
now. Let's update the test to Debian Trixie to get it going again.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/aarch64/test_hotplug_pci.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/functional/aarch64/test_hotplug_pci.py b/tests/functional/aarch64/test_hotplug_pci.py
index 0c67991b89..bf67720431 100755
--- a/tests/functional/aarch64/test_hotplug_pci.py
+++ b/tests/functional/aarch64/test_hotplug_pci.py
@@ -15,14 +15,14 @@ from qemu_test import BUILD_DIR
 class HotplugPCI(LinuxKernelTest):
 
     ASSET_KERNEL = Asset(
-        ('https://ftp.debian.org/debian/dists/bookworm/main/installer-arm64/'
-         '20230607+deb12u11/images/netboot/debian-installer/arm64/linux'),
-         'd92a60392ce1e379ca198a1a820899f8f0d39a62d047c41ab79492f81541a9d9')
+        ('https://ftp.debian.org/debian/dists/trixie/main/installer-arm64/'
+         '20250803/images/netboot/debian-installer/arm64/linux'),
+         '93a6e4f9627d759375d28f863437a86a0659e125792a435f8e526dda006b7d5e')
 
     ASSET_INITRD = Asset(
-        ('https://ftp.debian.org/debian/dists/bookworm/main/installer-arm64/'
-         '20230607+deb12u11/images/netboot/debian-installer/arm64/initrd.gz'),
-         '9f817f76951f3237bca8216bee35267bfb826815687f4b2fcdd5e6c2a917790c')
+        ('https://ftp.debian.org/debian/dists/trixie/main/installer-arm64/'
+         '20250803/images/netboot/debian-installer/arm64/initrd.gz'),
+         'f6c78af7078ca67638ef3a50c926cd3c1485673243f8b37952e6bd854d6ba007')
 
     def test_hotplug_pci(self):
 

From c75847f9eb8fb09dde0c0f4fa4710c6bde11f5a9 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Wed, 3 Sep 2025 10:29:32 -0400
Subject: [PATCH 0381/2396] memory: Fix addr/len for flatview_access_allowed()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

flatview_access_allowed() should pass in the address offset of the memory
region, rather than the global address space. Shouldn't be a major issue
yet, since the addr is only used in an error log.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Fixes: 3ab6fdc91b ("softmmu/physmem: Introduce MemTxAttrs::memory field and MEMTX_ACCESS_ERROR")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20250903142932.1038765-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 system/physmem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/system/physmem.c b/system/physmem.c
index 311011156c..ddd58e9eb8 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3027,7 +3027,7 @@ static MemTxResult flatview_write(FlatView *fv, hwaddr addr, MemTxAttrs attrs,
 
     l = len;
     mr = flatview_translate(fv, addr, &mr_addr, &l, true, attrs);
-    if (!flatview_access_allowed(mr, attrs, addr, len)) {
+    if (!flatview_access_allowed(mr, attrs, mr_addr, l)) {
         return MEMTX_ACCESS_ERROR;
     }
     return flatview_write_continue(fv, addr, attrs, buf, len,
@@ -3118,7 +3118,7 @@ static MemTxResult flatview_read(FlatView *fv, hwaddr addr,
 
     l = len;
     mr = flatview_translate(fv, addr, &mr_addr, &l, false, attrs);
-    if (!flatview_access_allowed(mr, attrs, addr, len)) {
+    if (!flatview_access_allowed(mr, attrs, mr_addr, l)) {
         return MEMTX_ACCESS_ERROR;
     }
     return flatview_read_continue(fv, addr, attrs, buf, len,

From ac7a892fd37ce4427d390ca8556203c9a2eb9d38 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 21 Aug 2025 12:59:02 -0400
Subject: [PATCH 0382/2396] memory: Fix leaks due to owner-shared MRs circular
 references
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, QEMU refcounts the MR by always taking it from the owner.

It's common that one object will have multiple MR objects embeded in the
object itself.  All the MRs in this case share the same lifespan of the
owner object.

It's also common that in the instance_init() of an object, MR A can be a
container of MR B, C, D, by using memory_region_add_subregion*() set of
memory region APIs.

Now we have a circular reference issue, as when adding subregions for MR A,
we essentially incremented the owner's refcount within the instance_init(),
meaning the object will be self-boosted and its refcount can never go down
to zero if the MRs won't get detached properly before object's finalize().

Delete subregions within object's finalize() won't work either, because
finalize() will be invoked only if the refcount goes to zero first.  What
is worse, object_finalize() will do object_property_del_all() first before
object_deinit().  Since embeded MRs will be properties of the owner object,
it means they'll be freed _before_ the owner's finalize().

To fix that, teach memory API to stop refcount on MRs that share the same
owner.  Because if they share the lifecycle of the owner, then they share
the same lifecycle between themselves, hence the refcount doesn't help but
only introduce troubles.

Meanwhile, allow auto-detachments of MRs during finalize() of MRs even
against its container, as long as they belong to the same owner.

The latter is needed because now it's possible to have MRs' finalize()
happen in any order when they share the same lifespan with a same owner.
In this case, we should allow finalize() to happen in any order of either
the parent or child MR.  Loose the mr->container check in MR's finalize()
to allow auto-detach.  Double check it shares the same owner.

Proper document this behavior in code.

This patch is heavily based on the work done by Akihiko Odaki:

https://lore.kernel.org/r/CAFEAcA8DV40fGsci76r4yeP1P-SP_QjNRDD2OzPxjx5wRs0GEg@mail.gmail.com

Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/r/20250826221750.285242-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 docs/devel/memory.rst |  7 +++++--
 system/memory.c       | 46 ++++++++++++++++++++++++++++++++++---------
 2 files changed, 42 insertions(+), 11 deletions(-)

diff --git a/docs/devel/memory.rst b/docs/devel/memory.rst
index 57fb2aec76..42d3ca29c4 100644
--- a/docs/devel/memory.rst
+++ b/docs/devel/memory.rst
@@ -158,8 +158,11 @@ ioeventfd) can be changed during the region lifecycle.  They take effect
 as soon as the region is made visible.  This can be immediately, later,
 or never.
 
-Destruction of a memory region happens automatically when the owner
-object dies.
+Destruction of a memory region happens automatically when the owner object
+dies.  When there are multiple memory regions under the same owner object,
+the memory API will guarantee all memory regions will be properly detached
+and finalized one by one.  The order in which memory regions will be
+finalized is not guaranteed.
 
 If however the memory region is part of a dynamically allocated data
 structure, you should call object_unparent() to destroy the memory region
diff --git a/system/memory.c b/system/memory.c
index 44701c465c..cf8cad6961 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -1796,16 +1796,37 @@ static void memory_region_finalize(Object *obj)
 {
     MemoryRegion *mr = MEMORY_REGION(obj);
 
-    assert(!mr->container);
-
-    /* We know the region is not visible in any address space (it
-     * does not have a container and cannot be a root either because
-     * it has no references, so we can blindly clear mr->enabled.
-     * memory_region_set_enabled instead could trigger a transaction
-     * and cause an infinite loop.
+    /*
+     * Each memory region (that can be freed) must have an owner, and it
+     * always has the same lifecycle of its owner.  It means when reaching
+     * here, the memory region's owner's refcount is zero.
+     *
+     * Here it is possible that the MR has:
+     *
+     * (1) mr->container set, which means this MR is a subregion of a
+     *     container MR. In this case they must share the same owner as the
+     *     container (otherwise the container should have kept a refcount
+     *     of this MR's owner).
+     *
+     * (2) mr->subregions non-empty, which means this MR is a container of
+     *     one or more other MRs (which might have the the owner as this
+     *     MR, or a different owner).
+     *
+     * We know the MR, or any MR that is attached to this one as either
+     * container or children, is not visible in any address space, because
+     * otherwise the address space should have taken at least one refcount
+     * of this MR's owner.  So we can blindly clear mr->enabled.
+     *
+     * memory_region_set_enabled instead could trigger a transaction and
+     * cause an infinite loop.
      */
     mr->enabled = false;
     memory_region_transaction_begin();
+    if (mr->container) {
+        /* Must share the owner; see above comments */
+        assert(mr->container->owner == mr->owner);
+        memory_region_del_subregion(mr->container, mr);
+    }
     while (!QTAILQ_EMPTY(&mr->subregions)) {
         MemoryRegion *subregion = QTAILQ_FIRST(&mr->subregions);
         memory_region_del_subregion(mr, subregion);
@@ -2640,7 +2661,10 @@ static void memory_region_update_container_subregions(MemoryRegion *subregion)
 
     memory_region_transaction_begin();
 
-    memory_region_ref(subregion);
+    if (mr->owner != subregion->owner) {
+        memory_region_ref(subregion);
+    }
+
     QTAILQ_FOREACH(other, &mr->subregions, subregions_link) {
         if (subregion->priority >= other->priority) {
             QTAILQ_INSERT_BEFORE(other, subregion, subregions_link);
@@ -2698,7 +2722,11 @@ void memory_region_del_subregion(MemoryRegion *mr,
         assert(alias->mapped_via_alias >= 0);
     }
     QTAILQ_REMOVE(&mr->subregions, subregion, subregions_link);
-    memory_region_unref(subregion);
+
+    if (mr->owner != subregion->owner) {
+        memory_region_unref(subregion);
+    }
+
     memory_region_update_pending |= mr->enabled && subregion->enabled;
     memory_region_transaction_commit();
 }

From 2d26741fc5170e51621eb365a34460fadb5f969e Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 14:23:37 -0400
Subject: [PATCH 0383/2396] python: backport 'Change error classes to have
 better repr methods'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By passing all of the arguments to the base class and overriding the
__str__ method when we want a different "human readable" message that
isn't just printing the list of arguments, we can ensure that all custom
error classes have a reasonable __repr__ implementation.

In the case of ExecuteError, the pseudo-field that isn't actually
correlated to an input argument can be re-imagined as a read-only
property; this forces consistency in the class and makes the repr output
more obviously correct.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@afdb7893f3b34212da4259b7202973f9a8cb85b3
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/error.py      |  7 +++++--
 python/qemu/qmp/message.py    | 12 ++++++------
 python/qemu/qmp/protocol.py   |  7 +++++--
 python/qemu/qmp/qmp_client.py | 20 +++++++++++++-------
 4 files changed, 29 insertions(+), 17 deletions(-)

diff --git a/python/qemu/qmp/error.py b/python/qemu/qmp/error.py
index 24ba4d5054..c87b078f62 100644
--- a/python/qemu/qmp/error.py
+++ b/python/qemu/qmp/error.py
@@ -44,7 +44,10 @@ class ProtocolError(QMPError):
 
     :param error_message: Human-readable string describing the error.
     """
-    def __init__(self, error_message: str):
-        super().__init__(error_message)
+    def __init__(self, error_message: str, *args: object):
+        super().__init__(error_message, *args)
         #: Human-readable error message, without any prefix.
         self.error_message: str = error_message
+
+    def __str__(self) -> str:
+        return self.error_message
diff --git a/python/qemu/qmp/message.py b/python/qemu/qmp/message.py
index f76ccc9074..c2e9dd0dd5 100644
--- a/python/qemu/qmp/message.py
+++ b/python/qemu/qmp/message.py
@@ -178,15 +178,15 @@ class DeserializationError(ProtocolError):
     :param raw: The raw `bytes` that prompted the failure.
     """
     def __init__(self, error_message: str, raw: bytes):
-        super().__init__(error_message)
+        super().__init__(error_message, raw)
         #: The raw `bytes` that were not understood as JSON.
         self.raw: bytes = raw
 
     def __str__(self) -> str:
-        return "\n".join([
+        return "\n".join((
             super().__str__(),
             f"  raw bytes were: {str(self.raw)}",
-        ])
+        ))
 
 
 class UnexpectedTypeError(ProtocolError):
@@ -197,13 +197,13 @@ class UnexpectedTypeError(ProtocolError):
     :param value: The deserialized JSON value that wasn't an object.
     """
     def __init__(self, error_message: str, value: object):
-        super().__init__(error_message)
+        super().__init__(error_message, value)
         #: The JSON value that was expected to be an object.
         self.value: object = value
 
     def __str__(self) -> str:
         strval = json.dumps(self.value, indent=2)
-        return "\n".join([
+        return "\n".join((
             super().__str__(),
             f"  json value was: {strval}",
-        ])
+        ))
diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index a4ffdfad51..86e588881b 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -80,7 +80,7 @@ class ConnectError(QMPError):
     :param exc: The root-cause exception.
     """
     def __init__(self, error_message: str, exc: Exception):
-        super().__init__(error_message)
+        super().__init__(error_message, exc)
         #: Human-readable error string
         self.error_message: str = error_message
         #: Wrapped root cause exception
@@ -108,11 +108,14 @@ class StateError(QMPError):
     """
     def __init__(self, error_message: str,
                  state: Runstate, required: Runstate):
-        super().__init__(error_message)
+        super().__init__(error_message, state, required)
         self.error_message = error_message
         self.state = state
         self.required = required
 
+    def __str__(self) -> str:
+        return self.error_message
+
 
 F = TypeVar('F', bound=Callable[..., Any])  # pylint: disable=invalid-name
 
diff --git a/python/qemu/qmp/qmp_client.py b/python/qemu/qmp/qmp_client.py
index 2a817f9db3..a87fb565ab 100644
--- a/python/qemu/qmp/qmp_client.py
+++ b/python/qemu/qmp/qmp_client.py
@@ -41,7 +41,7 @@ class _WrappedProtocolError(ProtocolError):
     :param exc: The root-cause exception.
     """
     def __init__(self, error_message: str, exc: Exception):
-        super().__init__(error_message)
+        super().__init__(error_message, exc)
         self.exc = exc
 
     def __str__(self) -> str:
@@ -76,15 +76,21 @@ class ExecuteError(QMPError):
     """
     def __init__(self, error_response: ErrorResponse,
                  sent: Message, received: Message):
-        super().__init__(error_response.error.desc)
+        super().__init__(error_response, sent, received)
         #: The sent `Message` that caused the failure
         self.sent: Message = sent
         #: The received `Message` that indicated failure
         self.received: Message = received
         #: The parsed error response
         self.error: ErrorResponse = error_response
-        #: The QMP error class
-        self.error_class: str = error_response.error.class_
+
+    @property
+    def error_class(self) -> str:
+        """The QMP error class"""
+        return self.error.error.class_
+
+    def __str__(self) -> str:
+        return self.error.error.desc
 
 
 class ExecInterruptedError(QMPError):
@@ -110,8 +116,8 @@ class _MsgProtocolError(ProtocolError):
     :param error_message: Human-readable string describing the error.
     :param msg: The QMP `Message` that caused the error.
     """
-    def __init__(self, error_message: str, msg: Message):
-        super().__init__(error_message)
+    def __init__(self, error_message: str, msg: Message, *args: object):
+        super().__init__(error_message, msg, *args)
         #: The received `Message` that caused the error.
         self.msg: Message = msg
 
@@ -150,7 +156,7 @@ class BadReplyError(_MsgProtocolError):
     :param sent: The message that was sent that prompted the error.
     """
     def __init__(self, error_message: str, msg: Message, sent: Message):
-        super().__init__(error_message, msg)
+        super().__init__(error_message, msg, sent)
         #: The sent `Message` that caused the failure
         self.sent = sent
 

From cb0e43804038e47bbaf0179ce67df678ec13a392 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 15:42:23 -0400
Subject: [PATCH 0384/2396] python: backport 'EventListener: add __repr__
 method'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the object is not stateful, this repr method prints what you'd
expect. In cases where there are pending events, the output is augmented
to illustrate that.

The object itself has no idea if it's "active" or not, so it cannot
convey that information.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@8a6f2e136dae395fec8aa5fd77487cfe12d9e05e
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/events.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/python/qemu/qmp/events.py b/python/qemu/qmp/events.py
index 6199776cc6..6658349619 100644
--- a/python/qemu/qmp/events.py
+++ b/python/qemu/qmp/events.py
@@ -497,6 +497,21 @@ class EventListener:
         #: Optional, secondary event filter.
         self.event_filter: Optional[EventFilter] = event_filter
 
+    def __repr__(self) -> str:
+        args: List[str] = []
+        if self.names:
+            args.append(f"names={self.names!r}")
+        if self.event_filter:
+            args.append(f"event_filter={self.event_filter!r}")
+
+        if self._queue.qsize():
+            state = f"<pending={self._queue.qsize()}>"
+        else:
+            state = ''
+
+        argstr = ", ".join(args)
+        return f"{type(self).__name__}{state}({argstr})"
+
     @property
     def history(self) -> Tuple[Message, ...]:
         """

From 1e343714bfc06cc982e68a290f3809117d6dfcd0 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 3 May 2022 14:07:10 -0400
Subject: [PATCH 0385/2396] python: backport 'kick event queue on legacy
 event_pull()'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This corrects an oversight in qmp-shell operation where new events will
not accumulate in the event queue when pressing "enter" with an empty
command buffer, so no new events show up.

Reported-by: Jag Raman <jag.raman@oracle.com>
Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@0443582d16cf9efd52b2c41a7b5be7af42c856cd
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/legacy.py | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py
index 22a2b5616e..c8d0a29b56 100644
--- a/python/qemu/qmp/legacy.py
+++ b/python/qemu/qmp/legacy.py
@@ -231,6 +231,9 @@ class QEMUMonitorProtocol:
 
         :return: The first available QMP event, or None.
         """
+        # Kick the event loop to allow events to accumulate
+        self._sync(asyncio.sleep(0))
+
         if not wait:
             # wait is False/0: "do not wait, do not except."
             if self._qmp.events.empty():

From 094ded5227dc4e8dde2c78a9788bf6c90771ad85 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 16:30:05 -0400
Subject: [PATCH 0386/2396] python: backport 'protocol: adjust logging name
 when changing client name'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The client name is mutable, so the logging name should also change to
reflect it when it changes.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@e10b73c633ce138ba30bc8beccd2ab31989eaf3d
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/protocol.py | 24 ++++++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index 86e588881b..ec4762c567 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -217,10 +217,8 @@ class AsyncProtocol(Generic[T]):
     # -------------------------
 
     def __init__(self, name: Optional[str] = None) -> None:
-        #: The nickname for this connection, if any.
-        self.name: Optional[str] = name
-        if self.name is not None:
-            self.logger = self.logger.getChild(self.name)
+        self._name: Optional[str]
+        self.name = name
 
         # stream I/O
         self._reader: Optional[StreamReader] = None
@@ -257,6 +255,24 @@ class AsyncProtocol(Generic[T]):
         tokens.append(f"runstate={self.runstate.name}")
         return f"<{cls_name} {' '.join(tokens)}>"
 
+    @property
+    def name(self) -> Optional[str]:
+        """
+        The nickname for this connection, if any.
+
+        This name is used for differentiating instances in debug output.
+        """
+        return self._name
+
+    @name.setter
+    def name(self, name: Optional[str]) -> None:
+        logger = logging.getLogger(__name__)
+        if name:
+            self.logger = logger.getChild(name)
+        else:
+            self.logger = logger
+        self._name = name
+
     @property  # @upper_half
     def runstate(self) -> Runstate:
         """The current `Runstate` of the connection."""

From f9d2e0a3bd7ba2a693a892881f91cf53fa90cc71 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 6 Jun 2023 13:19:11 -0400
Subject: [PATCH 0387/2396] python: backport 'drop Python3.6 workarounds'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the minimum version is 3.7, drop some of the 3.6-specific hacks
we've been carrying. A single remaining compatibility hack concerning
3.6's lack of @asynccontextmanager is addressed in the following commit.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@3e8e34e594cfc6b707e6f67959166acde4b421b8
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/protocol.py |  13 ++---
 python/qemu/qmp/qmp_tui.py  |   8 +--
 python/qemu/qmp/util.py     | 107 ++----------------------------------
 python/tests/protocol.py    |   8 +--
 4 files changed, 17 insertions(+), 119 deletions(-)

diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index ec4762c567..208bdec5c8 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -36,13 +36,10 @@ from typing import (
 from .error import QMPError
 from .util import (
     bottom_half,
-    create_task,
     exception_summary,
     flush,
-    is_closing,
     pretty_traceback,
     upper_half,
-    wait_closed,
 )
 
 
@@ -682,8 +679,8 @@ class AsyncProtocol(Generic[T]):
         reader_coro = self._bh_loop_forever(self._bh_recv_message, 'Reader')
         writer_coro = self._bh_loop_forever(self._bh_send_message, 'Writer')
 
-        self._reader_task = create_task(reader_coro)
-        self._writer_task = create_task(writer_coro)
+        self._reader_task = asyncio.create_task(reader_coro)
+        self._writer_task = asyncio.create_task(writer_coro)
 
         self._bh_tasks = asyncio.gather(
             self._reader_task,
@@ -708,7 +705,7 @@ class AsyncProtocol(Generic[T]):
         if not self._dc_task:
             self._set_state(Runstate.DISCONNECTING)
             self.logger.debug("Scheduling disconnect.")
-            self._dc_task = create_task(self._bh_disconnect())
+            self._dc_task = asyncio.create_task(self._bh_disconnect())
 
     @upper_half
     async def _wait_disconnect(self) -> None:
@@ -844,13 +841,13 @@ class AsyncProtocol(Generic[T]):
         if not self._writer:
             return
 
-        if not is_closing(self._writer):
+        if not self._writer.is_closing():
             self.logger.debug("Closing StreamWriter.")
             self._writer.close()
 
         self.logger.debug("Waiting for StreamWriter to close ...")
         try:
-            await wait_closed(self._writer)
+            await self._writer.wait_closed()
         except Exception:  # pylint: disable=broad-except
             # It's hard to tell if the Stream is already closed or
             # not. Even if one of the tasks has failed, it may have
diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
index 2d9ebbd20b..562be008d5 100644
--- a/python/qemu/qmp/qmp_tui.py
+++ b/python/qemu/qmp/qmp_tui.py
@@ -40,7 +40,7 @@ from .legacy import QEMUMonitorProtocol, QMPBadPortError
 from .message import DeserializationError, Message, UnexpectedTypeError
 from .protocol import ConnectError, Runstate
 from .qmp_client import ExecInterruptedError, QMPClient
-from .util import create_task, pretty_traceback
+from .util import pretty_traceback
 
 
 # The name of the signal that is used to update the history list
@@ -225,7 +225,7 @@ class App(QMPClient):
         """
         try:
             msg = Message(bytes(raw_msg, encoding='utf-8'))
-            create_task(self._send_to_server(msg))
+            asyncio.create_task(self._send_to_server(msg))
         except (DeserializationError, UnexpectedTypeError) as err:
             raw_msg = format_json(raw_msg)
             logging.info('Invalid message: %s', err.error_message)
@@ -246,7 +246,7 @@ class App(QMPClient):
         Initiates killing of app. A bridge between asynchronous and synchronous
         code.
         """
-        create_task(self._kill_app())
+        asyncio.create_task(self._kill_app())
 
     async def _kill_app(self) -> None:
         """
@@ -393,7 +393,7 @@ class App(QMPClient):
                                    handle_mouse=True,
                                    event_loop=event_loop)
 
-        create_task(self.manage_connection(), self.aloop)
+        self.aloop.create_task(self.manage_connection())
         try:
             main_loop.run()
         except Exception as err:
diff --git a/python/qemu/qmp/util.py b/python/qemu/qmp/util.py
index ca6225e9cd..0b3e781373 100644
--- a/python/qemu/qmp/util.py
+++ b/python/qemu/qmp/util.py
@@ -1,25 +1,15 @@
 """
 Miscellaneous Utilities
 
-This module provides asyncio utilities and compatibility wrappers for
-Python 3.6 to provide some features that otherwise become available in
-Python 3.7+.
-
-Various logging and debugging utilities are also provided, such as
-`exception_summary()` and `pretty_traceback()`, used primarily for
-adding information into the logging stream.
+This module provides asyncio and various logging and debugging
+utilities, such as `exception_summary()` and `pretty_traceback()`, used
+primarily for adding information into the logging stream.
 """
 
 import asyncio
 import sys
 import traceback
-from typing import (
-    Any,
-    Coroutine,
-    Optional,
-    TypeVar,
-    cast,
-)
+from typing import TypeVar, cast
 
 
 T = TypeVar('T')
@@ -79,95 +69,6 @@ def bottom_half(func: T) -> T:
     return func
 
 
-# -------------------------------
-# Section: Compatibility Wrappers
-# -------------------------------
-
-
-def create_task(coro: Coroutine[Any, Any, T],
-                loop: Optional[asyncio.AbstractEventLoop] = None
-                ) -> 'asyncio.Future[T]':
-    """
-    Python 3.6-compatible `asyncio.create_task` wrapper.
-
-    :param coro: The coroutine to execute in a task.
-    :param loop: Optionally, the loop to create the task in.
-
-    :return: An `asyncio.Future` object.
-    """
-    if sys.version_info >= (3, 7):
-        if loop is not None:
-            return loop.create_task(coro)
-        return asyncio.create_task(coro)  # pylint: disable=no-member
-
-    # Python 3.6:
-    return asyncio.ensure_future(coro, loop=loop)
-
-
-def is_closing(writer: asyncio.StreamWriter) -> bool:
-    """
-    Python 3.6-compatible `asyncio.StreamWriter.is_closing` wrapper.
-
-    :param writer: The `asyncio.StreamWriter` object.
-    :return: `True` if the writer is closing, or closed.
-    """
-    if sys.version_info >= (3, 7):
-        return writer.is_closing()
-
-    # Python 3.6:
-    transport = writer.transport
-    assert isinstance(transport, asyncio.WriteTransport)
-    return transport.is_closing()
-
-
-async def wait_closed(writer: asyncio.StreamWriter) -> None:
-    """
-    Python 3.6-compatible `asyncio.StreamWriter.wait_closed` wrapper.
-
-    :param writer: The `asyncio.StreamWriter` to wait on.
-    """
-    if sys.version_info >= (3, 7):
-        await writer.wait_closed()
-        return
-
-    # Python 3.6
-    transport = writer.transport
-    assert isinstance(transport, asyncio.WriteTransport)
-
-    while not transport.is_closing():
-        await asyncio.sleep(0)
-
-    # This is an ugly workaround, but it's the best I can come up with.
-    sock = transport.get_extra_info('socket')
-
-    if sock is None:
-        # Our transport doesn't have a socket? ...
-        # Nothing we can reasonably do.
-        return
-
-    while sock.fileno() != -1:
-        await asyncio.sleep(0)
-
-
-def asyncio_run(coro: Coroutine[Any, Any, T], *, debug: bool = False) -> T:
-    """
-    Python 3.6-compatible `asyncio.run` wrapper.
-
-    :param coro: A coroutine to execute now.
-    :return: The return value from the coroutine.
-    """
-    if sys.version_info >= (3, 7):
-        return asyncio.run(coro, debug=debug)
-
-    # Python 3.6
-    loop = asyncio.get_event_loop()
-    loop.set_debug(debug)
-    ret = loop.run_until_complete(coro)
-    loop.close()
-
-    return ret
-
-
 # ----------------------------
 # Section: Logging & Debugging
 # ----------------------------
diff --git a/python/tests/protocol.py b/python/tests/protocol.py
index 56c4d441f9..c254c77b17 100644
--- a/python/tests/protocol.py
+++ b/python/tests/protocol.py
@@ -8,7 +8,6 @@ import avocado
 
 from qemu.qmp import ConnectError, Runstate
 from qemu.qmp.protocol import AsyncProtocol, StateError
-from qemu.qmp.util import asyncio_run, create_task
 
 
 class NullProtocol(AsyncProtocol[None]):
@@ -124,7 +123,7 @@ def run_as_task(coro, allow_cancellation=False):
             if allow_cancellation:
                 return
             raise
-    return create_task(_runner())
+    return asyncio.create_task(_runner())
 
 
 @contextmanager
@@ -271,7 +270,7 @@ class TestBase(avocado.Test):
                     msg=f"Expected state '{state.name}'",
                 )
 
-        self.runstate_watcher = create_task(_watcher())
+        self.runstate_watcher = asyncio.create_task(_watcher())
         # Kick the loop and force the task to block on the event.
         await asyncio.sleep(0)
 
@@ -589,7 +588,8 @@ class SimpleSession(TestBase):
     async def testSmoke(self):
         with TemporaryDirectory(suffix='.qmp') as tmpdir:
             sock = os.path.join(tmpdir, type(self.proto).__name__ + ".sock")
-            server_task = create_task(self.server.start_server_and_accept(sock))
+            server_task = asyncio.create_task(
+                self.server.start_server_and_accept(sock))
 
             # give the server a chance to start listening [...]
             await asyncio.sleep(0)

From 0408b8d7a086486f5c1887798be744b2d73bcda9 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 6 Jun 2023 13:45:44 -0400
Subject: [PATCH 0388/2396] python: backport 'Use @asynciocontextmanager'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes a non-idiomatic use of a "coroutine callback" in favor of
something a bit more standardized.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@commit 97f7ffa3be17a50544b52767d14b6fd478c07b9e
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/protocol.py | 35 ++++++++++++++++-------------------
 1 file changed, 16 insertions(+), 19 deletions(-)

diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index 208bdec5c8..958aeca08a 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -15,6 +15,7 @@ class.
 
 import asyncio
 from asyncio import StreamReader, StreamWriter
+from contextlib import asynccontextmanager
 from enum import Enum
 from functools import wraps
 import logging
@@ -22,6 +23,7 @@ import socket
 from ssl import SSLContext
 from typing import (
     Any,
+    AsyncGenerator,
     Awaitable,
     Callable,
     Generic,
@@ -337,9 +339,8 @@ class AsyncProtocol(Generic[T]):
             This exception will wrap a more concrete one. In most cases,
             the wrapped exception will be `OSError`.
         """
-        await self._session_guard(
-            self._do_start_server(address, ssl),
-            'Failed to establish connection')
+        async with self._session_guard('Failed to establish connection'):
+            await self._do_start_server(address, ssl)
         assert self.runstate == Runstate.CONNECTING
 
     @upper_half
@@ -362,12 +363,10 @@ class AsyncProtocol(Generic[T]):
         """
         if self._accepted is None:
             raise QMPError("Cannot call accept() before start_server().")
-        await self._session_guard(
-            self._do_accept(),
-            'Failed to establish connection')
-        await self._session_guard(
-            self._establish_session(),
-            'Failed to establish session')
+        async with self._session_guard('Failed to establish connection'):
+            await self._do_accept()
+        async with self._session_guard('Failed to establish session'):
+            await self._establish_session()
         assert self.runstate == Runstate.RUNNING
 
     @upper_half
@@ -392,12 +391,10 @@ class AsyncProtocol(Generic[T]):
             protocol-level failure occurs while establishing a new
             session, the wrapped error may also be an `QMPError`.
         """
-        await self._session_guard(
-            self._do_connect(address, ssl),
-            'Failed to establish connection')
-        await self._session_guard(
-            self._establish_session(),
-            'Failed to establish session')
+        async with self._session_guard('Failed to establish connection'):
+            await self._do_connect(address, ssl)
+        async with self._session_guard('Failed to establish session'):
+            await self._establish_session()
         assert self.runstate == Runstate.RUNNING
 
     @upper_half
@@ -418,7 +415,8 @@ class AsyncProtocol(Generic[T]):
     # Section: Session machinery
     # --------------------------
 
-    async def _session_guard(self, coro: Awaitable[None], emsg: str) -> None:
+    @asynccontextmanager
+    async def _session_guard(self, emsg: str) -> AsyncGenerator[None, None]:
         """
         Async guard function used to roll back to `IDLE` on any error.
 
@@ -435,10 +433,9 @@ class AsyncProtocol(Generic[T]):
         :raise ConnectError:
             When any other error is encountered in the guarded block.
         """
-        # Note: After Python 3.6 support is removed, this should be an
-        # @asynccontextmanager instead of accepting a callback.
         try:
-            await coro
+            # Caller's code runs here.
+            yield
         except BaseException as err:
             self.logger.error("%s: %s", emsg, exception_summary(err))
             self.logger.debug("%s:\n%s\n", emsg, pretty_traceback())

From 8fd9ccebd905dfe3afdee03732ba09e46a3a1d49 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 13:59:19 -0400
Subject: [PATCH 0389/2396] python: backport 'qmp-shell: add common_parser()'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@20a88c2471f37d10520b2409046d59e1d0f1e905
Signed-off-by: John Snow <jsnow@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/qmp_shell.py | 29 +++++++++++++----------------
 1 file changed, 13 insertions(+), 16 deletions(-)

diff --git a/python/qemu/qmp/qmp_shell.py b/python/qemu/qmp/qmp_shell.py
index 98e684e9e8..02028e94b5 100644
--- a/python/qemu/qmp/qmp_shell.py
+++ b/python/qemu/qmp/qmp_shell.py
@@ -514,21 +514,27 @@ def die(msg: str) -> NoReturn:
     sys.exit(1)
 
 
-def main() -> None:
-    """
-    qmp-shell entry point: parse command line arguments and start the REPL.
-    """
+def common_parser() -> argparse.ArgumentParser:
+    """Build common parsing options used by qmp-shell and qmp-shell-wrap."""
     parser = argparse.ArgumentParser()
     parser.add_argument('-H', '--hmp', action='store_true',
                         help='Use HMP interface')
-    parser.add_argument('-N', '--skip-negotiation', action='store_true',
-                        help='Skip negotiate (for qemu-ga)')
     parser.add_argument('-v', '--verbose', action='store_true',
                         help='Verbose (echo commands sent and received)')
     parser.add_argument('-p', '--pretty', action='store_true',
                         help='Pretty-print JSON')
     parser.add_argument('-l', '--logfile',
                         help='Save log of all QMP messages to PATH')
+    return parser
+
+
+def main() -> None:
+    """
+    qmp-shell entry point: parse command line arguments and start the REPL.
+    """
+    parser = common_parser()
+    parser.add_argument('-N', '--skip-negotiation', action='store_true',
+                        help='Skip negotiate (for qemu-ga)')
 
     default_server = os.environ.get('QMP_SOCKET')
     parser.add_argument('qmp_server', action='store',
@@ -564,16 +570,7 @@ def main_wrap() -> None:
     qmp-shell-wrap entry point: parse command line arguments and
     start the REPL.
     """
-    parser = argparse.ArgumentParser()
-    parser.add_argument('-H', '--hmp', action='store_true',
-                        help='Use HMP interface')
-    parser.add_argument('-v', '--verbose', action='store_true',
-                        help='Verbose (echo commands sent and received)')
-    parser.add_argument('-p', '--pretty', action='store_true',
-                        help='Pretty-print JSON')
-    parser.add_argument('-l', '--logfile',
-                        help='Save log of all QMP messages to PATH')
-
+    parser = common_parser()
     parser.add_argument('command', nargs=argparse.REMAINDER,
                         help='QEMU command line to invoke')
 

From 653f501434889b23a5062b3fe00488d140eb79fd Mon Sep 17 00:00:00 2001
From: Adam Dorsey <adam.dorsey@twosixtech.com>
Date: Mon, 14 Apr 2025 14:30:14 -0400
Subject: [PATCH 0390/2396] python: backport 'feat: allow setting read buffer
 limit'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Expose the limit parameter of the underlying StreamReader and StreamWriter
instances.

This is helpful for the use case of transferring files in and out of a VM
via the QEMU guest agent's guest-file-open, guest-file-read, guest-file-write,
and guest-file-close methods, as it allows pushing the buffer size up to the
guest agent's limit of 48MB per transfer.

Signed-off-by: Adam Dorsey <adam@dorseys.email>
cherry picked from commit python-qemu-qmp@9ba6a698344eb3b570fa4864e906c54042824cd6
cherry picked from commit python-qemu-qmp@e4d0d3f835d82283ee0e48438d1b154e18303491
[Squashed in linter fixups. --js]
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/protocol.py   | 25 ++++++++++++++++---------
 python/qemu/qmp/qmp_client.py | 18 ++++++++++++++----
 2 files changed, 30 insertions(+), 13 deletions(-)

diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index 958aeca08a..3d5eb553aa 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -53,6 +53,9 @@ InternetAddrT = Tuple[str, int]
 UnixAddrT = str
 SocketAddrT = Union[UnixAddrT, InternetAddrT]
 
+# Maximum allowable size of read buffer, default
+_DEFAULT_READBUFLEN = 64 * 1024
+
 
 class Runstate(Enum):
     """Protocol session runstate."""
@@ -202,22 +205,26 @@ class AsyncProtocol(Generic[T]):
         will log to 'qemu.qmp.protocol', but each individual connection
         can be given its own logger by giving it a name; messages will
         then log to 'qemu.qmp.protocol.${name}'.
+    :param readbuflen:
+        The maximum read buffer length of the underlying StreamReader
+        instance.
     """
     # pylint: disable=too-many-instance-attributes
 
     #: Logger object for debugging messages from this connection.
     logger = logging.getLogger(__name__)
 
-    # Maximum allowable size of read buffer
-    _limit = 64 * 1024
-
     # -------------------------
     # Section: Public interface
     # -------------------------
 
-    def __init__(self, name: Optional[str] = None) -> None:
+    def __init__(
+        self, name: Optional[str] = None,
+        readbuflen: int = _DEFAULT_READBUFLEN
+    ) -> None:
         self._name: Optional[str]
         self.name = name
+        self.readbuflen = readbuflen
 
         # stream I/O
         self._reader: Optional[StreamReader] = None
@@ -574,7 +581,7 @@ class AsyncProtocol(Generic[T]):
                 port=address[1],
                 ssl=ssl,
                 backlog=1,
-                limit=self._limit,
+                limit=self.readbuflen,
             )
         else:
             coro = asyncio.start_unix_server(
@@ -582,7 +589,7 @@ class AsyncProtocol(Generic[T]):
                 path=address,
                 ssl=ssl,
                 backlog=1,
-                limit=self._limit,
+                limit=self.readbuflen,
             )
 
         # Allow runstate watchers to witness 'CONNECTING' state; some
@@ -637,7 +644,7 @@ class AsyncProtocol(Generic[T]):
                               "fd=%d, family=%r, type=%r",
                               address.fileno(), address.family, address.type)
             connect = asyncio.open_connection(
-                limit=self._limit,
+                limit=self.readbuflen,
                 ssl=ssl,
                 sock=address,
             )
@@ -647,14 +654,14 @@ class AsyncProtocol(Generic[T]):
                 address[0],
                 address[1],
                 ssl=ssl,
-                limit=self._limit,
+                limit=self.readbuflen,
             )
         else:
             self.logger.debug("Connecting to file://%s ...", address)
             connect = asyncio.open_unix_connection(
                 path=address,
                 ssl=ssl,
-                limit=self._limit,
+                limit=self.readbuflen,
             )
 
         self._reader, self._writer = await connect
diff --git a/python/qemu/qmp/qmp_client.py b/python/qemu/qmp/qmp_client.py
index a87fb565ab..d826331b6d 100644
--- a/python/qemu/qmp/qmp_client.py
+++ b/python/qemu/qmp/qmp_client.py
@@ -170,6 +170,12 @@ class QMPClient(AsyncProtocol[Message], Events):
 
     :param name: Optional nickname for the connection, used for logging.
 
+    :param readbuflen:
+        The maximum buffer length for reads and writes to and from the QMP
+        server, in bytes. Default is 10MB. If `QMPClient` is used to
+        connect to a guest agent to transfer files via ``guest-file-read``/
+        ``guest-file-write``, increasing this value may be required.
+
     Basic script-style usage looks like this::
 
       qmp = QMPClient('my_virtual_machine_name')
@@ -203,14 +209,18 @@ class QMPClient(AsyncProtocol[Message], Events):
     #: Logger object used for debugging messages.
     logger = logging.getLogger(__name__)
 
-    # Read buffer limit; 10MB like libvirt default
-    _limit = 10 * 1024 * 1024
+    # Read buffer default limit; 10MB like libvirt default
+    _readbuflen = 10 * 1024 * 1024
 
     # Type alias for pending execute() result items
     _PendingT = Union[Message, ExecInterruptedError]
 
-    def __init__(self, name: Optional[str] = None) -> None:
-        super().__init__(name)
+    def __init__(
+        self,
+        name: Optional[str] = None,
+        readbuflen: int = _readbuflen
+    ) -> None:
+        super().__init__(name, readbuflen)
         Events.__init__(self)
 
         #: Whether or not to await a greeting after establishing a connection.

From a50b8572f0e3873db64dd6660cea047f067ca5f7 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Mon, 2 May 2022 18:54:20 -0400
Subject: [PATCH 0391/2396] python: backport 'make require() preserve
 async-ness'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is not strictly needed functionality-wise, but doing this allows
sphinx to see which decorated methods are async. Without this, sphinx
misses the "async" classifier on generated docs, which ... for an async
library, isn't great.

It does make an already gnarly function even gnarlier, though.

So, what's going on here?

A synchronous function (like require() before this patch) can return a
coroutine that can be awaited on, for example:

  def some_func():
      return asyncio.task(asyncio.sleep(5))

  async def some_async_func():
      await some_func()

However, this function is not considered to be an "async" function in
the eyes of the abstract syntax tree. Specifically,
some_func.__code__.co_flags will not be set with CO_COROUTINE.

The interpreter uses this flag to know if it's legal to use "await" from
within the body of the function. Since this function is just wrapping
another function, it doesn't matter much for the decorator, but sphinx
uses the stdlib inspect.iscoroutinefunction() to determine when to add
the "async" prefix in generated output. This function uses the presence
of CO_COROUTINE.

So, in order to preserve the "async" flag for docs, the require()
decorator needs to differentiate based on whether it is decorating a
sync or async function and use a different wrapping mechanism
accordingly.

Phew.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@40aa9699d619849f528032aa456dd061a4afa957
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/protocol.py | 53 ++++++++++++++++++++++---------------
 1 file changed, 32 insertions(+), 21 deletions(-)

diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index 3d5eb553aa..4d8a39f014 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -18,6 +18,7 @@ from asyncio import StreamReader, StreamWriter
 from contextlib import asynccontextmanager
 from enum import Enum
 from functools import wraps
+from inspect import iscoroutinefunction
 import logging
 import socket
 from ssl import SSLContext
@@ -130,6 +131,25 @@ def require(required_state: Runstate) -> Callable[[F], F]:
     :param required_state: The `Runstate` required to invoke this method.
     :raise StateError: When the required `Runstate` is not met.
     """
+    def _check(proto: 'AsyncProtocol[Any]') -> None:
+        name = type(proto).__name__
+        if proto.runstate == required_state:
+            return
+
+        if proto.runstate == Runstate.CONNECTING:
+            emsg = f"{name} is currently connecting."
+        elif proto.runstate == Runstate.DISCONNECTING:
+            emsg = (f"{name} is disconnecting."
+                    " Call disconnect() to return to IDLE state.")
+        elif proto.runstate == Runstate.RUNNING:
+            emsg = f"{name} is already connected and running."
+        elif proto.runstate == Runstate.IDLE:
+            emsg = f"{name} is disconnected and idle."
+        else:
+            assert False
+
+        raise StateError(emsg, proto.runstate, required_state)
+
     def _decorator(func: F) -> F:
         # _decorator is the decorator that is built by calling the
         # require() decorator factory; e.g.:
@@ -140,29 +160,20 @@ def require(required_state: Runstate) -> Callable[[F], F]:
         @wraps(func)
         def _wrapper(proto: 'AsyncProtocol[Any]',
                      *args: Any, **kwargs: Any) -> Any:
-            # _wrapper is the function that gets executed prior to the
-            # decorated method.
-
-            name = type(proto).__name__
-
-            if proto.runstate != required_state:
-                if proto.runstate == Runstate.CONNECTING:
-                    emsg = f"{name} is currently connecting."
-                elif proto.runstate == Runstate.DISCONNECTING:
-                    emsg = (f"{name} is disconnecting."
-                            " Call disconnect() to return to IDLE state.")
-                elif proto.runstate == Runstate.RUNNING:
-                    emsg = f"{name} is already connected and running."
-                elif proto.runstate == Runstate.IDLE:
-                    emsg = f"{name} is disconnected and idle."
-                else:
-                    assert False
-                raise StateError(emsg, proto.runstate, required_state)
-            # No StateError, so call the wrapped method.
+            _check(proto)
             return func(proto, *args, **kwargs)
 
-        # Return the decorated method;
-        # Transforming Func to Decorated[Func].
+        @wraps(func)
+        async def _async_wrapper(proto: 'AsyncProtocol[Any]',
+                                 *args: Any, **kwargs: Any) -> Any:
+            _check(proto)
+            return await func(proto, *args, **kwargs)
+
+        # Return the decorated method; F => Decorated[F]
+        # Use an async version when applicable, which
+        # preserves async signature generation in sphinx.
+        if iscoroutinefunction(func):
+            return cast(F, _async_wrapper)
         return cast(F, _wrapper)
 
     # Return the decorator instance from the decorator factory. Phew!

From fcaeeb7653d2c6f38183170e1cae5729adb7875c Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 14:13:45 -0400
Subject: [PATCH 0392/2396] python: backport 'qmp-shell-wrap: handle missing
 binary gracefully'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@9c889dcbd58817b0c917a9d2dd16161f48ac8203
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/qmp_shell.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python/qemu/qmp/qmp_shell.py b/python/qemu/qmp/qmp_shell.py
index 02028e94b5..c923ff09e1 100644
--- a/python/qemu/qmp/qmp_shell.py
+++ b/python/qemu/qmp/qmp_shell.py
@@ -607,6 +607,8 @@ def main_wrap() -> None:
 
                 for _ in qemu.repl():
                     pass
+    except FileNotFoundError:
+        sys.stderr.write(f"ERROR: QEMU executable '{cmd[0]}' not found.\n")
     finally:
         os.unlink(sockpath)
 

From fd0ed46d4effbf2700804657bad9c6db086527c4 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 22 Jul 2022 15:55:45 -0400
Subject: [PATCH 0393/2396] python: backport 'qmp-tui: Do not crash if optional
 dependencies are not met'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based on the discussion at https://github.com/pypa/pip/issues/9726 -
even though the setuptools documentation implies that it is possible to
guard script execution with optional dependency groups, this is not true
in practice with the scripts generated by pip.

Just do the simple thing and guard the import statements.

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@df520dcacf9a75dd4c82ab1129768de4128b554c
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/qmp_tui.py | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
index 562be008d5..53ea6c59a7 100644
--- a/python/qemu/qmp/qmp_tui.py
+++ b/python/qemu/qmp/qmp_tui.py
@@ -21,6 +21,7 @@ import json
 import logging
 from logging import Handler, LogRecord
 import signal
+import sys
 from typing import (
     List,
     Optional,
@@ -30,10 +31,20 @@ from typing import (
     cast,
 )
 
-from pygments import lexers
-from pygments import token as Token
-import urwid
-import urwid_readline
+
+try:
+    from pygments import lexers
+    from pygments import token as Token
+    import urwid
+    import urwid_readline
+except ModuleNotFoundError as exc:
+    print(
+        f"Module '{exc.name}' not found.",
+        "You need the optional 'tui' group: pip install qemu.qmp[tui]",
+        sep='\n',
+        file=sys.stderr,
+    )
+    sys.exit(1)
 
 from .error import ProtocolError
 from .legacy import QEMUMonitorProtocol, QMPBadPortError

From 5d99044d09db0fa8c2b3294e301927118f9effc9 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 13 Aug 2024 09:35:30 -0400
Subject: [PATCH 0394/2396] python: backport 'Remove deprecated get_event_loop
 calls'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This method was deprecated in 3.12 because it ordinarily should not be
used from coroutines; if there is not a currently running event loop,
this automatically creates a new event loop - which is usually not what
you want from code that would ever run in the bottom half.

In our case, we do want this behavior in two places:

(1) The synchronous shim, for convenience: this allows fully sync
programs to use QEMUMonitorProtocol() without needing to set up an event
loop beforehand. This is intentional to fully box in the async
complexities into the legacy sync shim.

(2) The qmp_tui shell; instead of relying on asyncio.run to create and
run an asyncio program, we need to be able to pass the current asyncio
loop to urwid setup functions. For convenience, again, we create one if
one is not present to simplify the creation of the TUI appliance.

The remaining user of get_event_loop() was in fact one of the erroneous
users that should not have been using this function: if there's no
running event loop inside of a coroutine, you're in big trouble :)

Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@aa1ff9907603a3033296027e1bd021133df86ef1
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/legacy.py  | 9 ++++++++-
 python/qemu/qmp/qmp_tui.py | 7 ++++++-
 python/tests/protocol.py   | 2 +-
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py
index c8d0a29b56..735d42971e 100644
--- a/python/qemu/qmp/legacy.py
+++ b/python/qemu/qmp/legacy.py
@@ -86,7 +86,14 @@ class QEMUMonitorProtocol:
                 "server argument should be False when passing a socket")
 
         self._qmp = QMPClient(nickname)
-        self._aloop = asyncio.get_event_loop()
+
+        try:
+            self._aloop = asyncio.get_running_loop()
+        except RuntimeError:
+            # No running loop; since this is a sync shim likely to be
+            # used in fully sync programs, create one if neccessary.
+            self._aloop = asyncio.get_event_loop_policy().get_event_loop()
+
         self._address = address
         self._timeout: Optional[float] = None
 
diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
index 53ea6c59a7..12bdc17c99 100644
--- a/python/qemu/qmp/qmp_tui.py
+++ b/python/qemu/qmp/qmp_tui.py
@@ -388,7 +388,12 @@ class App(QMPClient):
         screen = urwid.raw_display.Screen()
         screen.set_terminal_properties(256)
 
-        self.aloop = asyncio.get_event_loop()
+        try:
+            self.aloop = asyncio.get_running_loop()
+        except RuntimeError:
+            # No running asyncio event loop. Create one if necessary.
+            self.aloop = asyncio.get_event_loop_policy().get_event_loop()
+
         self.aloop.set_debug(debug)
 
         # Gracefully handle SIGTERM and SIGINT signals
diff --git a/python/tests/protocol.py b/python/tests/protocol.py
index c254c77b17..e565802516 100644
--- a/python/tests/protocol.py
+++ b/python/tests/protocol.py
@@ -227,7 +227,7 @@ class TestBase(avocado.Test):
         Decorator; adds SetUp and TearDown to async tests.
         """
         async def _wrapper(self, *args, **kwargs):
-            loop = asyncio.get_event_loop()
+            loop = asyncio.get_running_loop()
             loop.set_debug(True)
 
             await self._asyncSetUp()

From 85f223e5b031eb8ab63fbca314a4fb296a3a2632 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 3 Sep 2025 01:06:30 -0400
Subject: [PATCH 0395/2396] python: backport 'avoid creating additional event
 loops per thread'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit is two backports squashed into one to avoid regressions.

python: *really* remove get_event_loop

A prior commit, aa1ff990, switched away from using get_event_loop *by
default*, but this is not good enough to avoid deprecation warnings as
`asyncio.get_event_loop_policy().get_event_loop()` is *also*
deprecated. Replace this mechanism with explicit calls to
asyncio.get_new_loop() and revise the cleanup mechanisms in __del__ to
match.

python: avoid creating additional event loops per thread

"Too hasty by far!", commit 21ce2ee4 attempted to avoid deprecated
behavior altogether by calling new_event_loop() directly if there was no
loop currently running, but this has the unfortunate side effect of
potentially creating multiple event loops per thread if tests
instantiate multiple QMP connections in a single thread. This behavior
is apparently not well-defined and causes problems in some, but not all,
combinations of Python interpreter version and platform environment.

Partially revert to Daniel Berrange's original patch, which calls
get_event_loop and simply suppresses the deprecation warning in
Python<=3.13. This time, however, additionally register new loops
created with new_event_loop() so that future calls to get_event_loop()
will return the loop already created.

Reported-by: Richard W.M. Jones <rjones@redhat.com>
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
cherry picked from commit python-qemu-qmp@21ce2ee4f2df87efe84a27b9c5112487f4670622
cherry picked from commit python-qemu-qmp@c08fb82b38212956ccffc03fc6d015c3979f42fe
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/legacy.py  | 46 +++++++++++++++++++++++---------------
 python/qemu/qmp/qmp_tui.py | 10 ++-------
 python/qemu/qmp/util.py    | 27 ++++++++++++++++++++++
 3 files changed, 57 insertions(+), 26 deletions(-)

diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py
index 735d42971e..e46695ae2c 100644
--- a/python/qemu/qmp/legacy.py
+++ b/python/qemu/qmp/legacy.py
@@ -38,6 +38,7 @@ from typing import (
 from .error import QMPError
 from .protocol import Runstate, SocketAddrT
 from .qmp_client import QMPClient
+from .util import get_or_create_event_loop
 
 
 #: QMPMessage is an entire QMP message of any kind.
@@ -86,17 +87,13 @@ class QEMUMonitorProtocol:
                 "server argument should be False when passing a socket")
 
         self._qmp = QMPClient(nickname)
-
-        try:
-            self._aloop = asyncio.get_running_loop()
-        except RuntimeError:
-            # No running loop; since this is a sync shim likely to be
-            # used in fully sync programs, create one if neccessary.
-            self._aloop = asyncio.get_event_loop_policy().get_event_loop()
-
         self._address = address
         self._timeout: Optional[float] = None
 
+        # This is a sync shim intended for use in fully synchronous
+        # programs. Create and set an event loop if necessary.
+        self._aloop = get_or_create_event_loop()
+
         if server:
             assert not isinstance(self._address, socket.socket)
             self._sync(self._qmp.start_server(self._address))
@@ -313,17 +310,30 @@ class QEMUMonitorProtocol:
         self._qmp.send_fd_scm(fd)
 
     def __del__(self) -> None:
-        if self._qmp.runstate == Runstate.IDLE:
-            return
+        if self._qmp.runstate != Runstate.IDLE:
+            self._qmp.logger.warning(
+                "QEMUMonitorProtocol object garbage collected without a prior "
+                "call to close()"
+            )
 
         if not self._aloop.is_running():
-            self.close()
-        else:
-            # Garbage collection ran while the event loop was running.
-            # Nothing we can do about it now, but if we don't raise our
-            # own error, the user will be treated to a lot of traceback
-            # they might not understand.
+            if self._qmp.runstate != Runstate.IDLE:
+                # If the user neglected to close the QMP session and we
+                # are not currently running in an asyncio context, we
+                # have the opportunity to close the QMP session. If we
+                # do not do this, the error messages presented over
+                # dangling async resources may not make any sense to the
+                # user.
+                self.close()
+
+        if self._qmp.runstate != Runstate.IDLE:
+            # If QMP is still not quiesced, it means that the garbage
+            # collector ran from a context within the event loop and we
+            # are simply too late to take any corrective action. Raise
+            # our own error to give meaningful feedback to the user in
+            # order to prevent pages of asyncio stacktrace jargon.
             raise QMPError(
-                "QEMUMonitorProtocol.close()"
-                " was not called before object was garbage collected"
+                "QEMUMonitorProtocol.close() was not called before object was "
+                "garbage collected, and could not be closed due to GC running "
+                "in the event loop"
             )
diff --git a/python/qemu/qmp/qmp_tui.py b/python/qemu/qmp/qmp_tui.py
index 12bdc17c99..d946c20513 100644
--- a/python/qemu/qmp/qmp_tui.py
+++ b/python/qemu/qmp/qmp_tui.py
@@ -51,7 +51,7 @@ from .legacy import QEMUMonitorProtocol, QMPBadPortError
 from .message import DeserializationError, Message, UnexpectedTypeError
 from .protocol import ConnectError, Runstate
 from .qmp_client import ExecInterruptedError, QMPClient
-from .util import pretty_traceback
+from .util import get_or_create_event_loop, pretty_traceback
 
 
 # The name of the signal that is used to update the history list
@@ -387,13 +387,7 @@ class App(QMPClient):
         """
         screen = urwid.raw_display.Screen()
         screen.set_terminal_properties(256)
-
-        try:
-            self.aloop = asyncio.get_running_loop()
-        except RuntimeError:
-            # No running asyncio event loop. Create one if necessary.
-            self.aloop = asyncio.get_event_loop_policy().get_event_loop()
-
+        self.aloop = get_or_create_event_loop()
         self.aloop.set_debug(debug)
 
         # Gracefully handle SIGTERM and SIGINT signals
diff --git a/python/qemu/qmp/util.py b/python/qemu/qmp/util.py
index 0b3e781373..47ec39a8b5 100644
--- a/python/qemu/qmp/util.py
+++ b/python/qemu/qmp/util.py
@@ -10,6 +10,7 @@ import asyncio
 import sys
 import traceback
 from typing import TypeVar, cast
+import warnings
 
 
 T = TypeVar('T')
@@ -20,6 +21,32 @@ T = TypeVar('T')
 # --------------------------
 
 
+def get_or_create_event_loop() -> asyncio.AbstractEventLoop:
+    """
+    Return this thread's current event loop, or create a new one.
+
+    This function behaves similarly to asyncio.get_event_loop() in
+    Python<=3.13, where if there is no event loop currently associated
+    with the current context, it will create and register one. It should
+    generally not be used in any asyncio-native applications.
+    """
+    try:
+        with warnings.catch_warnings():
+            # Python <= 3.13 will trigger deprecation warnings if no
+            # event loop is set, but will create and set a new loop.
+            warnings.simplefilter("ignore")
+            loop = asyncio.get_event_loop()
+    except RuntimeError:
+        # Python 3.14+: No event loop set for this thread,
+        # create and set one.
+        loop = asyncio.new_event_loop()
+        # Set this loop as the current thread's loop, to be returned
+        # by calls to get_event_loop() in the future.
+        asyncio.set_event_loop(loop)
+
+    return loop
+
+
 async def flush(writer: asyncio.StreamWriter) -> None:
     """
     Utility function to ensure a StreamWriter is *fully* drained.

From f414048e32262830e06d50240b2f15b6e5857efe Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 26 Aug 2025 13:04:50 -0400
Subject: [PATCH 0396/2396] python: synchronize qemu.qmp documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch collects comments and documentation changes from many commits
in the python-qemu-qmp repository; bringing the qemu.git copy in
bit-identical alignment with the standalone library *except* for several
copyright messages that reference the "LICENSE" file which is, for QEMU,
named "COPYING" instead and are therefore left unchanged.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/qmp/__init__.py   |   3 +-
 python/qemu/qmp/events.py     |  35 +++++++---
 python/qemu/qmp/legacy.py     |   4 +-
 python/qemu/qmp/message.py    |  10 ++-
 python/qemu/qmp/models.py     |   8 +--
 python/qemu/qmp/protocol.py   |  37 ++++++----
 python/qemu/qmp/qmp_client.py | 117 +++++++++++++++++++++++--------
 python/qemu/qmp/qmp_shell.py  | 128 ++++++++++++++++++++++++++--------
 python/qemu/qmp/util.py       |   9 ++-
 9 files changed, 264 insertions(+), 87 deletions(-)

diff --git a/python/qemu/qmp/__init__.py b/python/qemu/qmp/__init__.py
index 69190d057a..058139dc3c 100644
--- a/python/qemu/qmp/__init__.py
+++ b/python/qemu/qmp/__init__.py
@@ -39,7 +39,8 @@ from .qmp_client import ExecInterruptedError, ExecuteError, QMPClient
 logging.getLogger('qemu.qmp').addHandler(logging.NullHandler())
 
 
-# The order of these fields impact the Sphinx documentation order.
+# IMPORTANT: When modifying this list, update the Sphinx overview docs.
+# Anything visible in the qemu.qmp namespace should be on the overview page.
 __all__ = (
     # Classes, most to least important
     'QMPClient',
diff --git a/python/qemu/qmp/events.py b/python/qemu/qmp/events.py
index 6658349619..cfb5f0ac62 100644
--- a/python/qemu/qmp/events.py
+++ b/python/qemu/qmp/events.py
@@ -12,7 +12,14 @@ EventListener Tutorial
 ----------------------
 
 In all of the following examples, we assume that we have a `QMPClient`
-instantiated named ``qmp`` that is already connected.
+instantiated named ``qmp`` that is already connected. For example:
+
+.. code:: python
+
+   from qemu.qmp import QMPClient
+
+   qmp = QMPClient('example-vm')
+   await qmp.connect('127.0.0.1', 1234)
 
 
 `listener()` context blocks with one name
@@ -87,7 +94,9 @@ This is analogous to the following code:
            event = listener.get()
            print(f"Event arrived: {event['event']}")
 
-This event stream will never end, so these blocks will never terminate.
+This event stream will never end, so these blocks will never
+terminate. Even if the QMP connection errors out prematurely, this
+listener will go silent without raising an error.
 
 
 Using asyncio.Task to concurrently retrieve events
@@ -227,16 +236,20 @@ Clearing listeners
 .. code:: python
 
    await qmp.execute('stop')
-   qmp.events.clear()
+   discarded = qmp.events.clear()
    await qmp.execute('cont')
    event = await qmp.events.get()
    assert event['event'] == 'RESUME'
+   assert discarded[0]['event'] == 'STOP'
 
 `EventListener` objects are FIFO queues. If events are not consumed,
 they will remain in the queue until they are witnessed or discarded via
 `clear()`. FIFO queues will be drained automatically upon leaving a
 context block, or when calling `remove_listener()`.
 
+Any events removed from the queue in this fashion will be returned by
+the clear call.
+
 
 Accessing listener history
 ~~~~~~~~~~~~~~~~~~~~~~~~~~
@@ -350,6 +363,12 @@ While `listener()` is only capable of creating a single listener,
                break
 
 
+Note that in the above example, we explicitly wait on jobA to conclude
+first, and then wait for jobB to do the same. All we have guaranteed is
+that the code that waits for jobA will not accidentally consume the
+event intended for the jobB waiter.
+
+
 Extending the `EventListener` class
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
@@ -407,13 +426,13 @@ Experimental Interfaces & Design Issues
 These interfaces are not ones I am sure I will keep or otherwise modify
 heavily.
 
-qmp.listener()’s type signature
+qmp.listen()’s type signature
 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
-`listener()` does not return anything, because it was assumed the caller
+`listen()` does not return anything, because it was assumed the caller
 already had a handle to the listener. However, for
-``qmp.listener(EventListener())`` forms, the caller will not have saved
-a handle to the listener.
+``qmp.listen(EventListener())`` forms, the caller will not have saved a
+handle to the listener.
 
 Because this function can accept *many* listeners, I found it hard to
 accurately type in a way where it could be used in both “one” or “many”
@@ -633,7 +652,7 @@ class Events:
     def __init__(self) -> None:
         self._listeners: List[EventListener] = []
 
-        #: Default, all-events `EventListener`.
+        #: Default, all-events `EventListener`. See `qmp.events` for more info.
         self.events: EventListener = EventListener()
         self.register_listener(self.events)
 
diff --git a/python/qemu/qmp/legacy.py b/python/qemu/qmp/legacy.py
index e46695ae2c..060ed0eb9d 100644
--- a/python/qemu/qmp/legacy.py
+++ b/python/qemu/qmp/legacy.py
@@ -293,8 +293,8 @@ class QEMUMonitorProtocol:
         """
         Set the timeout for QMP RPC execution.
 
-        This timeout affects the `cmd`, `cmd_obj`, and `command` methods.
-        The `accept`, `pull_event` and `get_event` methods have their
+        This timeout affects the `cmd`, `cmd_obj`, and `cmd_raw` methods.
+        The `accept`, `pull_event` and `get_events` methods have their
         own configurable timeouts.
 
         :param timeout:
diff --git a/python/qemu/qmp/message.py b/python/qemu/qmp/message.py
index c2e9dd0dd5..dabb8ec360 100644
--- a/python/qemu/qmp/message.py
+++ b/python/qemu/qmp/message.py
@@ -28,7 +28,8 @@ class Message(MutableMapping[str, object]):
     be instantiated from either another mapping (like a `dict`), or from
     raw `bytes` that still need to be deserialized.
 
-    Once instantiated, it may be treated like any other MutableMapping::
+    Once instantiated, it may be treated like any other
+    :py:obj:`~collections.abc.MutableMapping`::
 
         >>> msg = Message(b'{"hello": "world"}')
         >>> assert msg['hello'] == 'world'
@@ -50,12 +51,19 @@ class Message(MutableMapping[str, object]):
        >>> dict(msg)
        {'hello': 'world'}
 
+    Or pretty-printed::
+
+       >>> print(str(msg))
+       {
+         "hello": "world"
+       }
 
     :param value: Initial value, if any.
     :param eager:
         When `True`, attempt to serialize or deserialize the initial value
         immediately, so that conversion exceptions are raised during
         the call to ``__init__()``.
+
     """
     # pylint: disable=too-many-ancestors
 
diff --git a/python/qemu/qmp/models.py b/python/qemu/qmp/models.py
index da52848d5a..7e0d0baf03 100644
--- a/python/qemu/qmp/models.py
+++ b/python/qemu/qmp/models.py
@@ -54,7 +54,7 @@ class Model:
 
 class Greeting(Model):
     """
-    Defined in qmp-spec.rst, section "Server Greeting".
+    Defined in `interop/qmp-spec`, "Server Greeting" section.
 
     :param raw: The raw Greeting object.
     :raise KeyError: If any required fields are absent.
@@ -82,7 +82,7 @@ class Greeting(Model):
 
 class QMPGreeting(Model):
     """
-    Defined in qmp-spec.rst, section "Server Greeting".
+    Defined in `interop/qmp-spec`, "Server Greeting" section.
 
     :param raw: The raw QMPGreeting object.
     :raise KeyError: If any required fields are absent.
@@ -104,7 +104,7 @@ class QMPGreeting(Model):
 
 class ErrorResponse(Model):
     """
-    Defined in qmp-spec.rst, section "Error".
+    Defined in `interop/qmp-spec`, "Error" section.
 
     :param raw: The raw ErrorResponse object.
     :raise KeyError: If any required fields are absent.
@@ -126,7 +126,7 @@ class ErrorResponse(Model):
 
 class ErrorInfo(Model):
     """
-    Defined in qmp-spec.rst, section "Error".
+    Defined in `interop/qmp-spec`, "Error" section.
 
     :param raw: The raw ErrorInfo object.
     :raise KeyError: If any required fields are absent.
diff --git a/python/qemu/qmp/protocol.py b/python/qemu/qmp/protocol.py
index 4d8a39f014..219d092a79 100644
--- a/python/qemu/qmp/protocol.py
+++ b/python/qemu/qmp/protocol.py
@@ -79,6 +79,12 @@ class ConnectError(QMPError):
     This Exception always wraps a "root cause" exception that can be
     interrogated for additional information.
 
+    For example, when connecting to a non-existent socket::
+
+        await qmp.connect('not_found.sock')
+        # ConnectError: Failed to establish connection:
+        #               [Errno 2] No such file or directory
+
     :param error_message: Human-readable string describing the error.
     :param exc: The root-cause exception.
     """
@@ -102,8 +108,8 @@ class StateError(QMPError):
     An API command (connect, execute, etc) was issued at an inappropriate time.
 
     This error is raised when a command like
-    :py:meth:`~AsyncProtocol.connect()` is issued at an inappropriate
-    time.
+    :py:meth:`~AsyncProtocol.connect()` is called when the client is
+    already connected.
 
     :param error_message: Human-readable string describing the state violation.
     :param state: The actual `Runstate` seen at the time of the violation.
@@ -298,7 +304,7 @@ class AsyncProtocol(Generic[T]):
     @upper_half
     async def runstate_changed(self) -> Runstate:
         """
-        Wait for the `runstate` to change, then return that runstate.
+        Wait for the `runstate` to change, then return that `Runstate`.
         """
         await self._runstate_event.wait()
         return self.runstate
@@ -312,9 +318,9 @@ class AsyncProtocol(Generic[T]):
         """
         Accept a connection and begin processing message queues.
 
-        If this call fails, `runstate` is guaranteed to be set back to `IDLE`.
-        This method is precisely equivalent to calling `start_server()`
-        followed by `accept()`.
+        If this call fails, `runstate` is guaranteed to be set back to
+        `IDLE`.  This method is precisely equivalent to calling
+        `start_server()` followed by :py:meth:`~AsyncProtocol.accept()`.
 
         :param address:
             Address to listen on; UNIX socket path or TCP address/port.
@@ -327,7 +333,8 @@ class AsyncProtocol(Generic[T]):
             This exception will wrap a more concrete one. In most cases,
             the wrapped exception will be `OSError` or `EOFError`. If a
             protocol-level failure occurs while establishing a new
-            session, the wrapped error may also be an `QMPError`.
+            session, the wrapped error may also be a `QMPError`.
+
         """
         await self.start_server(address, ssl)
         await self.accept()
@@ -343,8 +350,8 @@ class AsyncProtocol(Generic[T]):
         This method starts listening for an incoming connection, but
         does not block waiting for a peer. This call will return
         immediately after binding and listening on a socket. A later
-        call to `accept()` must be made in order to finalize the
-        incoming connection.
+        call to :py:meth:`~AsyncProtocol.accept()` must be made in order
+        to finalize the incoming connection.
 
         :param address:
             Address to listen on; UNIX socket path or TCP address/port.
@@ -367,10 +374,12 @@ class AsyncProtocol(Generic[T]):
         """
         Accept an incoming connection and begin processing message queues.
 
-        If this call fails, `runstate` is guaranteed to be set back to `IDLE`.
+        Used after a previous call to `start_server()` to accept an
+        incoming connection. If this call fails, `runstate` is
+        guaranteed to be set back to `IDLE`.
 
         :raise StateError: When the `Runstate` is not `CONNECTING`.
-        :raise QMPError: When `start_server()` was not called yet.
+        :raise QMPError: When `start_server()` was not called first.
         :raise ConnectError:
             When a connection or session cannot be established.
 
@@ -423,7 +432,11 @@ class AsyncProtocol(Generic[T]):
         If there was an exception that caused the reader/writers to
         terminate prematurely, it will be raised here.
 
-        :raise Exception: When the reader or writer terminate unexpectedly.
+        :raise Exception:
+            When the reader or writer terminate unexpectedly. You can
+            expect to see `EOFError` if the server hangs up, or
+            `OSError` for connection-related issues. If there was a QMP
+            protocol-level problem, `ProtocolError` will be seen.
         """
         self.logger.debug("disconnect() called.")
         self._schedule_disconnect()
diff --git a/python/qemu/qmp/qmp_client.py b/python/qemu/qmp/qmp_client.py
index d826331b6d..8beccfe29d 100644
--- a/python/qemu/qmp/qmp_client.py
+++ b/python/qemu/qmp/qmp_client.py
@@ -70,6 +70,17 @@ class ExecuteError(QMPError):
     """
     Exception raised by `QMPClient.execute()` on RPC failure.
 
+    This exception is raised when the server received, interpreted, and
+    replied to a command successfully; but the command itself returned a
+    failure status.
+
+    For example::
+
+        await qmp.execute('block-dirty-bitmap-add',
+                          {'node': 'foo', 'name': 'my_bitmap'})
+        # qemu.qmp.qmp_client.ExecuteError:
+        #     Cannot find device='foo' nor node-name='foo'
+
     :param error_response: The RPC error response object.
     :param sent: The sent RPC message that caused the failure.
     :param received: The raw RPC error reply received.
@@ -99,9 +110,22 @@ class ExecInterruptedError(QMPError):
 
     This error is raised when an `execute()` statement could not be
     completed.  This can occur because the connection itself was
-    terminated before a reply was received.
+    terminated before a reply was received. The true cause of the
+    interruption will be available via `disconnect()`.
 
-    The true cause of the interruption will be available via `disconnect()`.
+    The QMP protocol does not make it possible to know if a command
+    succeeded or failed after such an event; the client will need to
+    query the server to determine the state of the server on a
+    case-by-case basis.
+
+    For example, ECONNRESET might look like this::
+
+        try:
+            await qmp.execute('query-block')
+            # ExecInterruptedError: Disconnected
+        except ExecInterruptedError:
+            await qmp.disconnect()
+            # ConnectionResetError: [Errno 104] Connection reset by peer
     """
 
 
@@ -162,13 +186,14 @@ class BadReplyError(_MsgProtocolError):
 
 
 class QMPClient(AsyncProtocol[Message], Events):
-    """
-    Implements a QMP client connection.
+    """Implements a QMP client connection.
 
-    QMP can be used to establish a connection as either the transport
-    client or server, though this class always acts as the QMP client.
+    `QMPClient` can be used to either connect or listen to a QMP server,
+    but always acts as the QMP client.
 
-    :param name: Optional nickname for the connection, used for logging.
+    :param name:
+        Optional nickname for the connection, used to differentiate
+        instances when logging.
 
     :param readbuflen:
         The maximum buffer length for reads and writes to and from the QMP
@@ -178,14 +203,21 @@ class QMPClient(AsyncProtocol[Message], Events):
 
     Basic script-style usage looks like this::
 
-      qmp = QMPClient('my_virtual_machine_name')
-      await qmp.connect(('127.0.0.1', 1234))
-      ...
-      res = await qmp.execute('block-query')
-      ...
-      await qmp.disconnect()
+      import asyncio
+      from qemu.qmp import QMPClient
 
-    Basic async client-style usage looks like this::
+      async def main():
+          qmp = QMPClient('my_virtual_machine_name')
+          await qmp.connect(('127.0.0.1', 1234))
+          ...
+          res = await qmp.execute('query-block')
+          ...
+          await qmp.disconnect()
+
+      asyncio.run(main())
+
+    A more advanced example that starts to take advantage of asyncio
+    might look like this::
 
       class Client:
           def __init__(self, name: str):
@@ -205,6 +237,7 @@ class QMPClient(AsyncProtocol[Message], Events):
               await self.disconnect()
 
     See `qmp.events` for more detail on event handling patterns.
+
     """
     #: Logger object used for debugging messages.
     logger = logging.getLogger(__name__)
@@ -224,10 +257,12 @@ class QMPClient(AsyncProtocol[Message], Events):
         Events.__init__(self)
 
         #: Whether or not to await a greeting after establishing a connection.
+        #: Defaults to True; QGA servers expect this to be False.
         self.await_greeting: bool = True
 
-        #: Whether or not to perform capabilities negotiation upon connection.
-        #: Implies `await_greeting`.
+        #: Whether or not to perform capabilities negotiation upon
+        #: connection. Implies `await_greeting`. Defaults to True; QGA
+        #: servers expect this to be False.
         self.negotiate: bool = True
 
         # Cached Greeting, if one was awaited.
@@ -244,7 +279,13 @@ class QMPClient(AsyncProtocol[Message], Events):
 
     @property
     def greeting(self) -> Optional[Greeting]:
-        """The `Greeting` from the QMP server, if any."""
+        """
+        The `Greeting` from the QMP server, if any.
+
+        Defaults to ``None``, and will be set after a greeting is
+        received during the connection process. It is reset at the start
+        of each connection attempt.
+        """
         return self._greeting
 
     @upper_half
@@ -385,7 +426,7 @@ class QMPClient(AsyncProtocol[Message], Events):
             # This is very likely a server parsing error.
             # It doesn't inherently belong to any pending execution.
             # Instead of performing clever recovery, just terminate.
-            # See "NOTE" in qmp-spec.rst, section "Error".
+            # See "NOTE" in interop/qmp-spec, "Error" section.
             raise ServerParseError(
                 ("Server sent an error response without an ID, "
                  "but there are no ID-less executions pending. "
@@ -393,7 +434,7 @@ class QMPClient(AsyncProtocol[Message], Events):
                 msg
             )
 
-        # qmp-spec.rst, section "Commands Responses":
+        # qmp-spec.rst, "Commands Responses" section:
         # 'Clients should drop all the responses
         # that have an unknown "id" field.'
         self.logger.log(
@@ -566,7 +607,7 @@ class QMPClient(AsyncProtocol[Message], Events):
     @require(Runstate.RUNNING)
     async def execute_msg(self, msg: Message) -> object:
         """
-        Execute a QMP command and return its value.
+        Execute a QMP command on the server and return its value.
 
         :param msg: The QMP `Message` to execute.
 
@@ -578,7 +619,9 @@ class QMPClient(AsyncProtocol[Message], Events):
             If the QMP `Message` does not have either the 'execute' or
             'exec-oob' fields set.
         :raise ExecuteError: When the server returns an error response.
-        :raise ExecInterruptedError: if the connection was terminated early.
+        :raise ExecInterruptedError:
+            If the connection was disrupted before
+            receiving a reply from the server.
         """
         if not ('execute' in msg or 'exec-oob' in msg):
             raise ValueError("Requires 'execute' or 'exec-oob' message")
@@ -617,9 +660,11 @@ class QMPClient(AsyncProtocol[Message], Events):
 
         :param cmd: QMP command name.
         :param arguments: Arguments (if any). Must be JSON-serializable.
-        :param oob: If `True`, execute "out of band".
+        :param oob:
+            If `True`, execute "out of band". See `interop/qmp-spec`
+            section "Out-of-band execution".
 
-        :return: An executable QMP `Message`.
+        :return: A QMP `Message` that can be executed with `execute_msg()`.
         """
         msg = Message({'exec-oob' if oob else 'execute': cmd})
         if arguments is not None:
@@ -631,18 +676,22 @@ class QMPClient(AsyncProtocol[Message], Events):
                       arguments: Optional[Mapping[str, object]] = None,
                       oob: bool = False) -> object:
         """
-        Execute a QMP command and return its value.
+        Execute a QMP command on the server and return its value.
 
         :param cmd: QMP command name.
         :param arguments: Arguments (if any). Must be JSON-serializable.
-        :param oob: If `True`, execute "out of band".
+        :param oob:
+            If `True`, execute "out of band". See `interop/qmp-spec`
+            section "Out-of-band execution".
 
         :return:
             The command execution return value from the server. The type of
             object returned depends on the command that was issued,
             though most in QEMU return a `dict`.
         :raise ExecuteError: When the server returns an error response.
-        :raise ExecInterruptedError: if the connection was terminated early.
+        :raise ExecInterruptedError:
+            If the connection was disrupted before
+            receiving a reply from the server.
         """
         msg = self.make_execute_msg(cmd, arguments, oob=oob)
         return await self.execute_msg(msg)
@@ -650,8 +699,20 @@ class QMPClient(AsyncProtocol[Message], Events):
     @upper_half
     @require(Runstate.RUNNING)
     def send_fd_scm(self, fd: int) -> None:
-        """
-        Send a file descriptor to the remote via SCM_RIGHTS.
+        """Send a file descriptor to the remote via SCM_RIGHTS.
+
+        This method does not close the file descriptor.
+
+        :param fd: The file descriptor to send to QEMU.
+
+        This is an advanced feature of QEMU where file descriptors can
+        be passed from client to server. This is usually used as a
+        security measure to isolate the QEMU process from being able to
+        open its own files. See the QMP commands ``getfd`` and
+        ``add-fd`` for more information.
+
+        See `socket.socket.sendmsg` for more information on the Python
+        implementation for sending file descriptors over a UNIX socket.
         """
         assert self._writer is not None
         sock = self._writer.transport.get_extra_info('socket')
diff --git a/python/qemu/qmp/qmp_shell.py b/python/qemu/qmp/qmp_shell.py
index c923ff09e1..f818800568 100644
--- a/python/qemu/qmp/qmp_shell.py
+++ b/python/qemu/qmp/qmp_shell.py
@@ -10,9 +10,15 @@
 #
 
 """
-Low-level QEMU shell on top of QMP.
+qmp-shell - An interactive QEMU shell powered by QMP
 
-usage: qmp-shell [-h] [-H] [-N] [-v] [-p] qmp_server
+qmp-shell offers a simple shell with a convenient shorthand syntax as an
+alternative to typing JSON by hand. This syntax is not standardized and
+is not meant to be used as a scriptable interface. This shorthand *may*
+change incompatibly in the future, and it is strongly encouraged to use
+the QMP library to provide API-stable scripting when needed.
+
+usage: qmp-shell [-h] [-H] [-v] [-p] [-l LOGFILE] [-N] qmp_server
 
 positional arguments:
   qmp_server            < UNIX socket path | TCP address:port >
@@ -20,41 +26,52 @@ positional arguments:
 optional arguments:
   -h, --help            show this help message and exit
   -H, --hmp             Use HMP interface
-  -N, --skip-negotiation
-                        Skip negotiate (for qemu-ga)
   -v, --verbose         Verbose (echo commands sent and received)
   -p, --pretty          Pretty-print JSON
+  -l LOGFILE, --logfile LOGFILE
+                        Save log of all QMP messages to PATH
+  -N, --skip-negotiation
+                        Skip negotiate (for qemu-ga)
 
+Usage
+-----
 
-Start QEMU with:
+First, start QEMU with::
 
-# qemu [...] -qmp unix:./qmp-sock,server
+    > qemu [...] -qmp unix:./qmp-sock,server=on[,wait=off]
 
-Run the shell:
+Then run the shell, passing the address of the socket::
 
-$ qmp-shell ./qmp-sock
+    > qmp-shell ./qmp-sock
 
-Commands have the following format:
+Syntax
+------
 
-   < command-name > [ arg-name1=arg1 ] ... [ arg-nameN=argN ]
+Commands have the following format::
 
-For example:
+    < command-name > [ arg-name1=arg1 ] ... [ arg-nameN=argN ]
 
-(QEMU) device_add driver=e1000 id=net1
-{'return': {}}
-(QEMU)
+For example, to add a network device::
 
-key=value pairs also support Python or JSON object literal subset notations,
-without spaces. Dictionaries/objects {} are supported as are arrays [].
+    (QEMU) device_add driver=e1000 id=net1
+    {'return': {}}
+    (QEMU)
 
-   example-command arg-name1={'key':'value','obj'={'prop':"value"}}
+key=value pairs support either Python or JSON object literal notations,
+**without spaces**. Dictionaries/objects ``{}`` are supported, as are
+arrays ``[]``::
 
-Both JSON and Python formatting should work, including both styles of
-string literal quotes. Both paradigms of literal values should work,
-including null/true/false for JSON and None/True/False for Python.
+    example-command arg-name1={'key':'value','obj'={'prop':"value"}}
 
+Either JSON or Python formatting for compound values works, including
+both styles of string literal quotes (either single or double
+quotes). Both paradigms of literal values are accepted, including
+``null/true/false`` for JSON and ``None/True/False`` for Python.
 
-Transactions have the following multi-line format:
+Transactions
+------------
+
+Transactions have the following multi-line format::
 
    transaction(
    action-name1 [ arg-name1=arg1 ] ... [arg-nameN=argN ]
@@ -62,11 +79,11 @@ Transactions have the following multi-line format:
    action-nameN [ arg-name1=arg1 ] ... [arg-nameN=argN ]
    )
 
-One line transactions are also supported:
+One line transactions are also supported::
 
    transaction( action-name1 ... )
 
-For example:
+For example::
 
     (QEMU) transaction(
     TRANS> block-dirty-bitmap-add node=drive0 name=bitmap1
@@ -75,9 +92,35 @@ For example:
     {"return": {}}
     (QEMU)
 
-Use the -v and -p options to activate the verbose and pretty-print options,
-which will echo back the properly formatted JSON-compliant QMP that is being
-sent to QEMU, which is useful for debugging and documentation generation.
+Commands
+--------
+
+Autocomplete of command names using <tab> is supported. Pressing <tab>
+at a blank CLI prompt will show you a list of all available commands
+that the connected QEMU instance supports.
+
+For documentation on QMP commands and their arguments, please see
+`qmp ref`.
+
+Events
+------
+
+qmp-shell will display events received from the server, but this version
+does not do so asynchronously. To check for new events from the server,
+press <enter> on a blank line::
+
+    (QEMU) ⏎
+    {'timestamp': {'seconds': 1660071944, 'microseconds': 184667},
+     'event': 'STOP'}
+
+Display options
+---------------
+
+Use the -v and -p options to activate the verbose and pretty-print
+options, which will echo back the properly formatted JSON-compliant QMP
+that is being sent to QEMU. This is useful for debugging to see the
+wire-level QMP data being exchanged, and generating output for use in
+writing documentation for QEMU.
 """
 
 import argparse
@@ -525,6 +568,8 @@ def common_parser() -> argparse.ArgumentParser:
                         help='Pretty-print JSON')
     parser.add_argument('-l', '--logfile',
                         help='Save log of all QMP messages to PATH')
+    # NOTE: When changing arguments, update both this module docstring
+    # and the manpage synopsis in docs/man/qmp_shell.rst.
     return parser
 
 
@@ -567,8 +612,35 @@ def main() -> None:
 
 def main_wrap() -> None:
     """
-    qmp-shell-wrap entry point: parse command line arguments and
-    start the REPL.
+    qmp-shell-wrap - QEMU + qmp-shell launcher utility
+
+    Launch QEMU and connect to it with `qmp-shell` in a single command.
+    CLI arguments will be forwarded to qemu, with additional arguments
+    added to allow `qmp-shell` to then connect to the recently launched
+    QEMU instance.
+
+    usage: qmp-shell-wrap [-h] [-H] [-v] [-p] [-l LOGFILE] ...
+
+    positional arguments:
+      command               QEMU command line to invoke
+
+    optional arguments:
+      -h, --help            show this help message and exit
+      -H, --hmp             Use HMP interface
+      -v, --verbose         Verbose (echo commands sent and received)
+      -p, --pretty          Pretty-print JSON
+      -l LOGFILE, --logfile LOGFILE
+                            Save log of all QMP messages to PATH
+
+    Usage
+    -----
+
+    Prepend "qmp-shell-wrap" to your usual QEMU command line::
+
+        > qmp-shell-wrap qemu-system-x86_64 -M q35 -m 4096 -display none
+        Welcome to the QMP low-level shell!
+        Connected
+        (QEMU)
     """
     parser = common_parser()
     parser.add_argument('command', nargs=argparse.REMAINDER,
diff --git a/python/qemu/qmp/util.py b/python/qemu/qmp/util.py
index 47ec39a8b5..a8229e5524 100644
--- a/python/qemu/qmp/util.py
+++ b/python/qemu/qmp/util.py
@@ -49,7 +49,7 @@ def get_or_create_event_loop() -> asyncio.AbstractEventLoop:
 
 async def flush(writer: asyncio.StreamWriter) -> None:
     """
-    Utility function to ensure a StreamWriter is *fully* drained.
+    Utility function to ensure an `asyncio.StreamWriter` is *fully* drained.
 
     `asyncio.StreamWriter.drain` only promises we will return to below
     the "high-water mark". This function ensures we flush the entire
@@ -89,7 +89,7 @@ def bottom_half(func: T) -> T:
 
     These methods do not, in general, have the ability to directly
     report information to a caller’s context and will usually be
-    collected as a Task result instead.
+    collected as an `asyncio.Task` result instead.
 
     They must not call upper-half functions directly.
     """
@@ -105,8 +105,11 @@ def exception_summary(exc: BaseException) -> str:
     """
     Return a summary string of an arbitrary exception.
 
-    It will be of the form "ExceptionType: Error Message", if the error
+    It will be of the form "ExceptionType: Error Message" if the error
     string is non-empty, and just "ExceptionType" otherwise.
+
+    This code is based on CPython's implementation of
+    `traceback.TracebackException.format_exception_only`.
     """
     name = type(exc).__qualname__
     smod = type(exc).__module__

From 82c7cb93c750196f513a1b11cb85e0328bad444f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:16 +0100
Subject: [PATCH 0397/2396] iotests: drop compat for old version context
 manager
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Our minimum python is now 3.9, so back compat with prior
python versions is no longer required.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/qemu-iotests/testenv.py    | 7 ++-----
 tests/qemu-iotests/testrunner.py | 9 ++-------
 2 files changed, 4 insertions(+), 12 deletions(-)

diff --git a/tests/qemu-iotests/testenv.py b/tests/qemu-iotests/testenv.py
index 6326e46b7b..29caaa8a34 100644
--- a/tests/qemu-iotests/testenv.py
+++ b/tests/qemu-iotests/testenv.py
@@ -22,15 +22,12 @@ import tempfile
 from pathlib import Path
 import shutil
 import collections
+import contextlib
 import random
 import subprocess
 import glob
 from typing import List, Dict, Any, Optional
 
-if sys.version_info >= (3, 9):
-    from contextlib import AbstractContextManager as ContextManager
-else:
-    from typing import ContextManager
 
 DEF_GDB_OPTIONS = 'localhost:12345'
 
@@ -58,7 +55,7 @@ def get_default_machine(qemu_prog: str) -> str:
     return default_machine
 
 
-class TestEnv(ContextManager['TestEnv']):
+class TestEnv(contextlib.AbstractContextManager['TestEnv']):
     """
     Manage system environment for running tests
 
diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
index 2e236c8fa3..14cc8492f9 100644
--- a/tests/qemu-iotests/testrunner.py
+++ b/tests/qemu-iotests/testrunner.py
@@ -30,11 +30,6 @@ from multiprocessing import Pool
 from typing import List, Optional, Any, Sequence, Dict
 from testenv import TestEnv
 
-if sys.version_info >= (3, 9):
-    from contextlib import AbstractContextManager as ContextManager
-else:
-    from typing import ContextManager
-
 
 def silent_unlink(path: Path) -> None:
     try:
@@ -57,7 +52,7 @@ def file_diff(file1: str, file2: str) -> List[str]:
         return res
 
 
-class LastElapsedTime(ContextManager['LastElapsedTime']):
+class LastElapsedTime(contextlib.AbstractContextManager['LastElapsedTime']):
     """ Cache for elapsed time for tests, to show it during new test run
 
     It is safe to use get() at any time.  To use update(), you must either
@@ -112,7 +107,7 @@ class TestResult:
         self.interrupted = interrupted
 
 
-class TestRunner(ContextManager['TestRunner']):
+class TestRunner(contextlib.AbstractContextManager['TestRunner']):
     shared_self = None
 
     @staticmethod

From 6ccb48ffc19fe25511313a246d4a8bad51114ea9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:20 +0100
Subject: [PATCH 0398/2396] python: ensure QEMUQtestProtocol closes its socket
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While QEMUQtestMachine closes the socket that was passed to
QEMUQtestProtocol, the python resource leak manager still
believes that the copy QEMUQtestProtocol holds is open. We
must explicitly call close to avoid this leak warnnig.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 python/qemu/machine/qtest.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/python/qemu/machine/qtest.py b/python/qemu/machine/qtest.py
index 4f5ede85b2..781f674ffa 100644
--- a/python/qemu/machine/qtest.py
+++ b/python/qemu/machine/qtest.py
@@ -177,6 +177,8 @@ class QEMUQtestMachine(QEMUMachine):
             self._qtest_sock_pair[0].close()
             self._qtest_sock_pair[1].close()
             self._qtest_sock_pair = None
+        if self._qtest is not None:
+            self._qtest.close()
         super()._post_shutdown()
 
     def qtest(self, cmd: str) -> str:

From d4d0ebfcc926c11d16320d0d5accf22e3441c115 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:21 +0100
Subject: [PATCH 0399/2396] iotests/147: ensure temporary sockets are closed
 before exiting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This avoids the python resource leak detector from issuing warnings
in the iotests.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/qemu-iotests/147 | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/147 b/tests/qemu-iotests/147
index 6d6f077a14..3e14bd389a 100755
--- a/tests/qemu-iotests/147
+++ b/tests/qemu-iotests/147
@@ -277,6 +277,7 @@ class BuiltinNBD(NBDBlockdevAddBase):
                      } }
         self.client_test(filename, flatten_sock_addr(address), 'nbd-export')
 
+        sockfd.close()
         self._server_down()
 
 

From 2b2fb25c2aaf5b2e8172d845db39cc50a951a12e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:22 +0100
Subject: [PATCH 0400/2396] iotests/151: ensure subprocesses are cleaned up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The iotest 151 creates a bunch of subprocesses, with their stdout
connected to a pipe but never reads any data from them and does
not gurantee the processes are killed on cleanup.

This triggers resource leak warnings from python when the
subprocess.Popen object is garbage collected.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/qemu-iotests/151 | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tests/qemu-iotests/151 b/tests/qemu-iotests/151
index f2ff9c5dac..06ee3585db 100755
--- a/tests/qemu-iotests/151
+++ b/tests/qemu-iotests/151
@@ -263,6 +263,11 @@ class TestThrottledWithNbdExportBase(iotests.QMPTestCase):
                         break
                     except subprocess.TimeoutExpired:
                         self.vm.qtest(f'clock_step {1 * 1000 * 1000 * 1000}')
+                try:
+                    p.kill()
+                    p.stdout.close()
+                except:
+                    pass
         except IndexError:
             pass
 

From 9a494d83538680651197651031375c2b6fa2490b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 15 Jul 2025 15:30:23 +0100
Subject: [PATCH 0401/2396] iotests/check: always enable all python warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Of most importance is that this gives us a heads-up if anything
we rely on has been deprecated. The default python behaviour
only emits a warning if triggered from __main__ which is very
limited.

Setting the env variable further ensures that any python child
processes will also display warnings.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/qemu-iotests/check | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index 545f9ec7bd..d9b7c1d598 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -21,6 +21,7 @@ import sys
 import argparse
 import shutil
 from pathlib import Path
+import warnings
 
 from findtests import TestFinder
 from testenv import TestEnv
@@ -137,6 +138,9 @@ def make_argparser() -> argparse.ArgumentParser:
 
 
 if __name__ == '__main__':
+    warnings.simplefilter("default")
+    os.environ["PYTHONWARNINGS"] = "default"
+
     args = make_argparser().parse_args()
 
     env = TestEnv(source_dir=args.source_dir,

From 424dc390ec68263b5fc82b88f0f81bc3f374ad44 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 11 Sep 2025 13:14:15 +0100
Subject: [PATCH 0402/2396] tests, scripts: Don't import print_function from
 __future__
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some of our Python scripts still include the line
  from __future__ import print_function

which is intended to allow a Python 2 to handle the Python 3 print()
syntax. This particular part of the future arrived many years ago,
and our minimum Python version is 3.9, so we don't need to keep
this line around.

NB: the scripts in tests/tcg/*/gdbstub/ are run with whatever Python
gdb was built against, but we can safely assume that that was a
Python 3 because our supported distros are all on Python 3.  In any
case these are only run as part of "make check-tcg", not by
end-users.

Commit created with:

 sed -i -e '/import print_function/d' $(git grep -l 'from __future__')

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250819102409.2117969-1-peter.maydell@linaro.org
---
 scripts/userfaultfd-wrlat.py                           | 1 -
 tests/guest-debug/test_gdbstub.py                      | 1 -
 tests/tcg/aarch64/gdbstub/test-mte.py                  | 1 -
 tests/tcg/aarch64/gdbstub/test-sve-ioctl.py            | 1 -
 tests/tcg/aarch64/gdbstub/test-sve.py                  | 1 -
 tests/tcg/multiarch/gdbstub/interrupt.py               | 1 -
 tests/tcg/multiarch/gdbstub/memory.py                  | 1 -
 tests/tcg/multiarch/gdbstub/sha1.py                    | 1 -
 tests/tcg/multiarch/gdbstub/test-proc-mappings.py      | 1 -
 tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py    | 1 -
 tests/tcg/multiarch/gdbstub/test-qxfer-siginfo-read.py | 1 -
 tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py  | 1 -
 tests/tcg/s390x/gdbstub/test-signals-s390x.py          | 1 -
 tests/tcg/s390x/gdbstub/test-svc.py                    | 1 -
 14 files changed, 14 deletions(-)

diff --git a/scripts/userfaultfd-wrlat.py b/scripts/userfaultfd-wrlat.py
index 0684be4e04..a61a9abbfc 100755
--- a/scripts/userfaultfd-wrlat.py
+++ b/scripts/userfaultfd-wrlat.py
@@ -17,7 +17,6 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-from __future__ import print_function
 from bcc import BPF
 from ctypes import c_ushort, c_int, c_ulonglong
 from time import sleep
diff --git a/tests/guest-debug/test_gdbstub.py b/tests/guest-debug/test_gdbstub.py
index 4f08089e6a..e017ccb55d 100644
--- a/tests/guest-debug/test_gdbstub.py
+++ b/tests/guest-debug/test_gdbstub.py
@@ -1,7 +1,6 @@
 """Helper functions for gdbstub testing
 
 """
-from __future__ import print_function
 import argparse
 import gdb
 import os
diff --git a/tests/tcg/aarch64/gdbstub/test-mte.py b/tests/tcg/aarch64/gdbstub/test-mte.py
index 9ad98e7a54..f4a7d7b446 100644
--- a/tests/tcg/aarch64/gdbstub/test-mte.py
+++ b/tests/tcg/aarch64/gdbstub/test-mte.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test GDB memory-tag commands that exercise the stubs for the qIsAddressTagged,
 # qMemTag, and QMemTag packets, which are used for manipulating allocation tags.
diff --git a/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py b/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
index a78a3a2514..2c5c218031 100644
--- a/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
+++ b/tests/tcg/aarch64/gdbstub/test-sve-ioctl.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test the SVE ZReg reports the right amount of data. It uses the
 # sve-ioctl test and examines the register data each time the
diff --git a/tests/tcg/aarch64/gdbstub/test-sve.py b/tests/tcg/aarch64/gdbstub/test-sve.py
index 84cdcd4a32..7b0489a622 100644
--- a/tests/tcg/aarch64/gdbstub/test-sve.py
+++ b/tests/tcg/aarch64/gdbstub/test-sve.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test the SVE registers are visible and changeable via gdbstub
 #
diff --git a/tests/tcg/multiarch/gdbstub/interrupt.py b/tests/tcg/multiarch/gdbstub/interrupt.py
index 2d5654d154..4eccdb41b9 100644
--- a/tests/tcg/multiarch/gdbstub/interrupt.py
+++ b/tests/tcg/multiarch/gdbstub/interrupt.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test some of the system debug features with the multiarch memory
 # test. It is a port of the original vmlinux focused test case but
diff --git a/tests/tcg/multiarch/gdbstub/memory.py b/tests/tcg/multiarch/gdbstub/memory.py
index 532b92e7fb..76d75e5251 100644
--- a/tests/tcg/multiarch/gdbstub/memory.py
+++ b/tests/tcg/multiarch/gdbstub/memory.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test some of the system debug features with the multiarch memory
 # test. It is a port of the original vmlinux focused test case but
diff --git a/tests/tcg/multiarch/gdbstub/sha1.py b/tests/tcg/multiarch/gdbstub/sha1.py
index 1ce711a402..3403b82fd4 100644
--- a/tests/tcg/multiarch/gdbstub/sha1.py
+++ b/tests/tcg/multiarch/gdbstub/sha1.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # A very simple smoke test for debugging the SHA1 userspace test on
 # each target.
diff --git a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
index 6eb6ebf7b1..796dca75f0 100644
--- a/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
+++ b/tests/tcg/multiarch/gdbstub/test-proc-mappings.py
@@ -1,7 +1,6 @@
 """Test that gdbstub has access to proc mappings.
 
 This runs as a sourced script (via -x, via run-test.py)."""
-from __future__ import print_function
 import gdb
 from test_gdbstub import gdb_exit, main, report
 
diff --git a/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py b/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
index 00c26ab4a9..fa36c943d6 100644
--- a/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
+++ b/tests/tcg/multiarch/gdbstub/test-qxfer-auxv-read.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test auxiliary vector is loaded via gdbstub
 #
diff --git a/tests/tcg/multiarch/gdbstub/test-qxfer-siginfo-read.py b/tests/tcg/multiarch/gdbstub/test-qxfer-siginfo-read.py
index 862596b07a..b18fa1234f 100644
--- a/tests/tcg/multiarch/gdbstub/test-qxfer-siginfo-read.py
+++ b/tests/tcg/multiarch/gdbstub/test-qxfer-siginfo-read.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test gdbstub Xfer:siginfo:read stub.
 #
diff --git a/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py b/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
index 4d6b6b9fbe..49cbc3548f 100644
--- a/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
+++ b/tests/tcg/multiarch/gdbstub/test-thread-breakpoint.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 #
 # Test auxiliary vector is loaded via gdbstub
 #
diff --git a/tests/tcg/s390x/gdbstub/test-signals-s390x.py b/tests/tcg/s390x/gdbstub/test-signals-s390x.py
index b6b7b39fc4..398ad534eb 100644
--- a/tests/tcg/s390x/gdbstub/test-signals-s390x.py
+++ b/tests/tcg/s390x/gdbstub/test-signals-s390x.py
@@ -1,4 +1,3 @@
-from __future__ import print_function
 
 #
 # Test that signals and debugging mix well together on s390x.
diff --git a/tests/tcg/s390x/gdbstub/test-svc.py b/tests/tcg/s390x/gdbstub/test-svc.py
index 17210b4e02..29a0aa0ede 100644
--- a/tests/tcg/s390x/gdbstub/test-svc.py
+++ b/tests/tcg/s390x/gdbstub/test-svc.py
@@ -1,7 +1,6 @@
 """Test single-stepping SVC.
 
 This runs as a sourced script (via -x, via run-test.py)."""
-from __future__ import print_function
 import gdb
 from test_gdbstub import main, report
 

From 71eba045758289e12133c4977f81c9132325c648 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:05 +1000
Subject: [PATCH 0403/2396] linux-user/aarch64: Split out signal_for_exception
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 84 ++++++++++++++++++++---------------
 1 file changed, 47 insertions(+), 37 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 4c4921152e..3b2782581b 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -27,11 +27,56 @@
 #include "target/arm/syndrome.h"
 #include "target/arm/cpu-features.h"
 
+/* Use the exception syndrome to map a cpu exception to a signal. */
+static void signal_for_exception(CPUARMState *env, vaddr addr)
+{
+    uint32_t syn = env->exception.syndrome;
+    int si_code, si_signo;
+
+    switch (syn_get_ec(syn)) {
+    case EC_DATAABORT:
+    case EC_INSNABORT:
+        /* Both EC have the same format for FSC, or close enough. */
+        switch (extract32(syn, 0, 6)) {
+        case 0x04 ... 0x07: /* Translation fault, level {0-3} */
+            si_signo = TARGET_SIGSEGV;
+            si_code = TARGET_SEGV_MAPERR;
+            break;
+        case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
+        case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
+            si_signo = TARGET_SIGSEGV;
+            si_code = TARGET_SEGV_ACCERR;
+            break;
+        case 0x11: /* Synchronous Tag Check Fault */
+            si_signo = TARGET_SIGSEGV;
+            si_code = TARGET_SEGV_MTESERR;
+            break;
+        case 0x21: /* Alignment fault */
+            si_signo = TARGET_SIGBUS;
+            si_code = TARGET_BUS_ADRALN;
+            break;
+        default:
+            g_assert_not_reached();
+        }
+        break;
+
+    case EC_PCALIGNMENT:
+        si_signo = TARGET_SIGBUS;
+        si_code = TARGET_BUS_ADRALN;
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
+
+    force_sig_fault(si_signo, si_code, addr);
+}
+
 /* AArch64 main loop */
 void cpu_loop(CPUARMState *env)
 {
     CPUState *cs = env_cpu(env);
-    int trapnr, ec, fsc, si_code, si_signo;
+    int trapnr;
     abi_long ret;
 
     for (;;) {
@@ -67,42 +112,7 @@ void cpu_loop(CPUARMState *env)
             break;
         case EXCP_PREFETCH_ABORT:
         case EXCP_DATA_ABORT:
-            ec = syn_get_ec(env->exception.syndrome);
-            switch (ec) {
-            case EC_DATAABORT:
-            case EC_INSNABORT:
-                /* Both EC have the same format for FSC, or close enough. */
-                fsc = extract32(env->exception.syndrome, 0, 6);
-                switch (fsc) {
-                case 0x04 ... 0x07: /* Translation fault, level {0-3} */
-                    si_signo = TARGET_SIGSEGV;
-                    si_code = TARGET_SEGV_MAPERR;
-                    break;
-                case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
-                case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
-                    si_signo = TARGET_SIGSEGV;
-                    si_code = TARGET_SEGV_ACCERR;
-                    break;
-                case 0x11: /* Synchronous Tag Check Fault */
-                    si_signo = TARGET_SIGSEGV;
-                    si_code = TARGET_SEGV_MTESERR;
-                    break;
-                case 0x21: /* Alignment fault */
-                    si_signo = TARGET_SIGBUS;
-                    si_code = TARGET_BUS_ADRALN;
-                    break;
-                default:
-                    g_assert_not_reached();
-                }
-                break;
-            case EC_PCALIGNMENT:
-                si_signo = TARGET_SIGBUS;
-                si_code = TARGET_BUS_ADRALN;
-                break;
-            default:
-                g_assert_not_reached();
-            }
-            force_sig_fault(si_signo, si_code, env->exception.vaddress);
+            signal_for_exception(env, env->exception.vaddress);
             break;
         case EXCP_DEBUG:
         case EXCP_BKPT:

From 5fe3151c5e18eb15347c2ea572b551c7aed67a9f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:06 +1000
Subject: [PATCH 0404/2396] linux-user/aarch64: Check syndrome for EXCP_UDEF

Note that we have been passing the incorrect code for most
exception codes: uncategorized (do_el0_undef),
systemregistertrap (do_el0_sys), smetrap (do_sme_acc),
btitrap (do_el0_bti) and illegalstate (bad_el0_sync).
Only pacfail uses ILL_ILLOPN (do_el0_fpac).

Note that EC_MOP (do_el0_mops) ought not signal at all.
For now, preserve existing behavior signalling ILL_ILLOPN.

List all other exception codes and document why they do
not apply to user-only.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 75 ++++++++++++++++++++++++++++++++++-
 1 file changed, 74 insertions(+), 1 deletion(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 3b2782581b..7ad26316de 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -65,6 +65,79 @@ static void signal_for_exception(CPUARMState *env, vaddr addr)
         si_code = TARGET_BUS_ADRALN;
         break;
 
+    case EC_UNCATEGORIZED:         /* E.g. undefined instruction */
+    case EC_SYSTEMREGISTERTRAP:    /* E.g. inaccessible register */
+    case EC_SMETRAP:               /* E.g. invalid insn in streaming state */
+    case EC_BTITRAP:               /* E.g. invalid guarded branch target */
+    case EC_ILLEGALSTATE:
+        /*
+         * Illegal state happens via an ERET from a privileged mode,
+         * so is not normally possible from user-only.  However, gdbstub
+         * is not prevented from writing CPSR_IL, aka PSTATE.IL, which
+         * would generate a trap from the next translated block.
+         * In the kernel, default case -> el0_inv -> bad_el0_sync.
+         */
+        si_signo = TARGET_SIGILL;
+        si_code = TARGET_ILL_ILLOPC;
+        break;
+
+    case EC_PACFAIL:
+        si_signo = TARGET_SIGILL;
+        si_code = TARGET_ILL_ILLOPN;
+        break;
+
+    case EC_MOP:
+        /*
+         * FIXME: The kernel fixes up wrong-option exceptions.
+         * For QEMU linux-user mode, you can only get these if
+         * the process is doing something silly (not executing
+         * the MOPS instructions in the required P/M/E sequence),
+         * so it is not a problem in practice that we do not.
+         *
+         * We ought ideally to implement the same "rewind to the
+         * start of the sequence" logic that the kernel does in
+         * arm64_mops_reset_regs(). In the meantime, deliver
+         * the guest a SIGILL, with the same ILLOPN si_code
+         * we've always used for this.
+         */
+        si_signo = TARGET_SIGILL;
+        si_code = TARGET_ILL_ILLOPN;
+        break;
+
+    case EC_WFX_TRAP:              /* user-only WFI implemented as NOP */
+    case EC_CP15RTTRAP:            /* AArch32 */
+    case EC_CP15RRTTRAP:           /* AArch32 */
+    case EC_CP14RTTRAP:            /* AArch32 */
+    case EC_CP14DTTRAP:            /* AArch32 */
+    case EC_ADVSIMDFPACCESSTRAP:   /* user-only does not disable fpu */
+    case EC_FPIDTRAP:              /* AArch32 */
+    case EC_PACTRAP:               /* user-only does not disable pac regs */
+    case EC_BXJTRAP:               /* AArch32 */
+    case EC_CP14RRTTRAP:           /* AArch32 */
+    case EC_AA32_SVC:              /* AArch32 */
+    case EC_AA32_HVC:              /* AArch32 */
+    case EC_AA32_SMC:              /* AArch32 */
+    case EC_AA64_SVC:              /* generates EXCP_SWI */
+    case EC_AA64_HVC:              /* user-only generates EC_UNCATEGORIZED */
+    case EC_AA64_SMC:              /* user-only generates EC_UNCATEGORIZED */
+    case EC_SVEACCESSTRAP:         /* user-only does not disable sve */
+    case EC_ERETTRAP:              /* user-only generates EC_UNCATEGORIZED */
+    case EC_GPC:                   /* user-only has no EL3 gpc tables */
+    case EC_INSNABORT_SAME_EL:     /* el0 cannot trap to el0 */
+    case EC_DATAABORT_SAME_EL:     /* el0 cannot trap to el0 */
+    case EC_SPALIGNMENT:           /* sp alignment checks not implemented */
+    case EC_AA32_FPTRAP:           /* fp exceptions not implemented */
+    case EC_AA64_FPTRAP:           /* fp exceptions not implemented */
+    case EC_SERROR:                /* user-only does not have hw faults */
+    case EC_BREAKPOINT:            /* user-only does not have hw debug */
+    case EC_BREAKPOINT_SAME_EL:    /* user-only does not have hw debug */
+    case EC_SOFTWARESTEP:          /* user-only does not have hw debug */
+    case EC_SOFTWARESTEP_SAME_EL:  /* user-only does not have hw debug */
+    case EC_WATCHPOINT:            /* user-only does not have hw debug */
+    case EC_WATCHPOINT_SAME_EL:    /* user-only does not have hw debug */
+    case EC_AA32_BKPT:             /* AArch32 */
+    case EC_VECTORCATCH:           /* AArch32 */
+    case EC_AA64_BKPT:             /* generates EXCP_BKPT */
     default:
         g_assert_not_reached();
     }
@@ -108,7 +181,7 @@ void cpu_loop(CPUARMState *env)
             /* just indicate that signals should be handled asap */
             break;
         case EXCP_UDEF:
-            force_sig_fault(TARGET_SIGILL, TARGET_ILL_ILLOPN, env->pc);
+            signal_for_exception(env, env->pc);
             break;
         case EXCP_PREFETCH_ABORT:
         case EXCP_DATA_ABORT:

From e1b31ba94d143c5026b199c5df7523fa4d9fa4cf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:07 +1000
Subject: [PATCH 0405/2396] linux-user/aarch64: Generate ESR signal records

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/cpu_loop.c |  3 +++
 linux-user/aarch64/signal.c   | 34 +++++++++++++++++++++++++++++++++-
 2 files changed, 36 insertions(+), 1 deletion(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 7ad26316de..6060572eed 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -33,6 +33,9 @@ static void signal_for_exception(CPUARMState *env, vaddr addr)
     uint32_t syn = env->exception.syndrome;
     int si_code, si_signo;
 
+    /* Let signal delivery see that ESR is live. */
+    env->cp15.esr_el[1] = syn;
+
     switch (syn_get_ec(syn)) {
     case EC_DATAABORT:
     case EC_INSNABORT:
diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index 668353bbda..ef97be3ac7 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -65,6 +65,13 @@ struct target_fpsimd_context {
     uint64_t vregs[32 * 2]; /* really uint128_t vregs[32] */
 };
 
+#define TARGET_ESR_MAGIC    0x45535201
+
+struct target_esr_context {
+    struct target_aarch64_ctx head;
+    uint64_t esr;
+};
+
 #define TARGET_EXTRA_MAGIC  0x45585401
 
 struct target_extra_context {
@@ -201,6 +208,14 @@ static void target_setup_fpsimd_record(struct target_fpsimd_context *fpsimd,
     }
 }
 
+static void target_setup_esr_record(struct target_esr_context *ctx,
+                                    CPUARMState *env)
+{
+    __put_user(TARGET_ESR_MAGIC, &ctx->head.magic);
+    __put_user(sizeof(*ctx), &ctx->head.size);
+    __put_user(env->cp15.esr_el[1], &ctx->esr);
+}
+
 static void target_setup_extra_record(struct target_extra_context *extra,
                                       uint64_t datap, uint32_t extra_size)
 {
@@ -531,6 +546,9 @@ static int target_restore_sigframe(CPUARMState *env,
             fpsimd = (struct target_fpsimd_context *)ctx;
             break;
 
+        case TARGET_ESR_MAGIC:
+            break; /* ignore */
+
         case TARGET_SVE_MAGIC:
             if (sve || size < sizeof(struct target_sve_context)) {
                 goto err;
@@ -683,7 +701,7 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
                                uc.tuc_mcontext.__reserved),
     };
     int fpsimd_ofs, fr_ofs, sve_ofs = 0, za_ofs = 0, tpidr2_ofs = 0;
-    int zt_ofs = 0;
+    int zt_ofs = 0, esr_ofs = 0;
     int sve_size = 0, za_size = 0, tpidr2_size = 0, zt_size = 0;
     struct target_rt_sigframe *frame;
     struct target_rt_frame_record *fr;
@@ -693,6 +711,15 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
     fpsimd_ofs = alloc_sigframe_space(sizeof(struct target_fpsimd_context),
                                       &layout);
 
+    /*
+     * In user mode, ESR_EL1 is only set by cpu_loop while queueing the
+     * signal, and it's only valid for the one sync insn.
+     */
+    if (env->cp15.esr_el[1]) {
+        esr_ofs = alloc_sigframe_space(sizeof(struct target_esr_context),
+                                       &layout);
+    }
+
     /* SVE state needs saving only if it exists.  */
     if (cpu_isar_feature(aa64_sve, env_archcpu(env)) ||
         cpu_isar_feature(aa64_sme, env_archcpu(env))) {
@@ -754,6 +781,11 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
 
     target_setup_general_frame(frame, env, set);
     target_setup_fpsimd_record((void *)frame + fpsimd_ofs, env);
+    if (esr_ofs) {
+        target_setup_esr_record((void *)frame + esr_ofs, env);
+        /* Leave ESR_EL1 clear while it's not relevant. */
+        env->cp15.esr_el[1] = 0;
+    }
     target_setup_end_record((void *)frame + layout.std_end_ofs);
     if (layout.extra_ofs) {
         target_setup_extra_record((void *)frame + layout.extra_ofs,

From 76fea609082d9673449a1f6aca9a28af6f20f8cf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:08 +1000
Subject: [PATCH 0406/2396] target/arm: Add prot_check parameter to
 pmsav8_mpu_lookup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Separate the access_type from the protection check.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    |  5 +++--
 target/arm/ptw.c          | 11 ++++++-----
 target/arm/tcg/m_helper.c |  4 ++--
 3 files changed, 11 insertions(+), 9 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index f5a1e75db3..899242e572 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1624,8 +1624,9 @@ bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
     __attribute__((nonnull));
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
-                       MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                       bool is_secure, GetPhysAddrResult *result,
+                       MMUAccessType access_type, unsigned prot_check,
+                       ARMMMUIdx mmu_idx, bool is_secure,
+                       GetPhysAddrResult *result,
                        ARMMMUFaultInfo *fi, uint32_t *mregion);
 
 void arm_log_exception(CPUState *cs);
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index ed5c728eab..9652f40ff8 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2561,8 +2561,9 @@ static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx,
 }
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
-                       MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                       bool secure, GetPhysAddrResult *result,
+                       MMUAccessType access_type, unsigned prot_check,
+                       ARMMMUIdx mmu_idx, bool secure,
+                       GetPhysAddrResult *result,
                        ARMMMUFaultInfo *fi, uint32_t *mregion)
 {
     /*
@@ -2750,7 +2751,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
     if (arm_feature(env, ARM_FEATURE_M)) {
         fi->level = 1;
     }
-    return !(result->f.prot & (1 << access_type));
+    return (prot_check & ~result->f.prot) != 0;
 }
 
 static bool v8m_is_sau_exempt(CPUARMState *env,
@@ -2952,8 +2953,8 @@ static bool get_phys_addr_pmsav8(CPUARMState *env,
         }
     }
 
-    ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, secure,
-                            result, fi, NULL);
+    ret = pmsav8_mpu_lookup(env, address, access_type, 1 << access_type,
+                            mmu_idx, secure, result, fi, NULL);
     if (sattrs.subpage) {
         result->f.lg_page_size = 0;
     }
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index 28307b5615..d856e3bc8e 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -2829,8 +2829,8 @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
         ARMMMUFaultInfo fi = {};
 
         /* We can ignore the return value as prot is always set */
-        pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, mmu_idx, targetsec,
-                          &res, &fi, &mregion);
+        pmsav8_mpu_lookup(env, addr, MMU_DATA_LOAD, PAGE_READ, mmu_idx,
+                          targetsec, &res, &fi, &mregion);
         if (mregion == -1) {
             mrvalid = false;
             mregion = 0;

From 015cefc0ed65ef054616171128f5962f1cccb2d1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:09 +1000
Subject: [PATCH 0407/2396] target/arm: Add in_prot_check to S1Translate

Separate the access_type from the protection check.
Save the trouble of modifying all helper functions
by passing the new data in the control structure.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 19 ++++++++++++++-----
 1 file changed, 14 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 9652f40ff8..d37c0ce0f1 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -64,6 +64,12 @@ typedef struct S1Translate {
      * Stage 2 is indicated by in_mmu_idx set to ARMMMUIdx_Stage2{,_S}.
      */
     bool in_s1_is_el0;
+    /*
+     * The set of PAGE_* bits to be use in the permission check.
+     * This is normally directly related to the access_type, but
+     * may be suppressed for debug or AT insns.
+     */
+    uint8_t in_prot_check;
     bool out_rw;
     bool out_be;
     ARMSecuritySpace out_space;
@@ -581,6 +587,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
             .in_space = s2_space,
             .in_debug = true,
+            .in_prot_check = PAGE_READ,
         };
         GetPhysAddrResult s2 = { };
 
@@ -1089,7 +1096,7 @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
     }
     result->f.prot = ap_to_rw_prot(env, ptw->in_mmu_idx, ap, domain_prot);
     result->f.prot |= result->f.prot ? PAGE_EXEC : 0;
-    if (!(result->f.prot & (1 << access_type))) {
+    if (ptw->in_prot_check & ~result->f.prot) {
         /* Access permission fault.  */
         fi->type = ARMFault_Permission;
         goto do_fault;
@@ -1243,7 +1250,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
 
         result->f.prot = get_S1prot(env, mmu_idx, false, user_rw, prot_rw,
                                     xn, pxn, result->f.attrs.space, out_space);
-        if (!(result->f.prot & (1 << access_type))) {
+        if (ptw->in_prot_check & ~result->f.prot) {
             /* Access permission fault.  */
             fi->type = ARMFault_Permission;
             goto do_fault;
@@ -2123,7 +2130,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.tlb_fill_flags = 0;
     }
 
-    if (!(result->f.prot & (1 << access_type))) {
+    if (ptw->in_prot_check & ~result->f.prot) {
         fi->type = ARMFault_Permission;
         goto do_fault;
     }
@@ -2537,7 +2544,7 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
 
     fi->type = ARMFault_Permission;
     fi->level = 1;
-    return !(result->f.prot & (1 << access_type));
+    return (ptw->in_prot_check & ~result->f.prot) != 0;
 }
 
 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
@@ -2953,7 +2960,7 @@ static bool get_phys_addr_pmsav8(CPUARMState *env,
         }
     }
 
-    ret = pmsav8_mpu_lookup(env, address, access_type, 1 << access_type,
+    ret = pmsav8_mpu_lookup(env, address, access_type, ptw->in_prot_check,
                             mmu_idx, secure, result, fi, NULL);
     if (sattrs.subpage) {
         result->f.lg_page_size = 0;
@@ -3625,6 +3632,7 @@ bool get_phys_addr(CPUARMState *env, vaddr address,
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
+        .in_prot_check = 1 << access_type,
     };
 
     return get_phys_addr_gpc(env, &ptw, address, access_type,
@@ -3638,6 +3646,7 @@ static hwaddr arm_cpu_get_phys_page(CPUARMState *env, vaddr addr,
         .in_mmu_idx = mmu_idx,
         .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
         .in_debug = true,
+        .in_prot_check = PAGE_READ,
     };
     GetPhysAddrResult res = {};
     ARMMMUFaultInfo fi = {};

From 7e130764415e0a15faf09c5c26043b016ba798fc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:10 +1000
Subject: [PATCH 0408/2396] target/arm: Skip permission check from
 arm_cpu_get_phys_page_attrs_debug

Do not require read permission when translating addresses
for debugging purposes.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index d37c0ce0f1..5d85610de2 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3646,7 +3646,7 @@ static hwaddr arm_cpu_get_phys_page(CPUARMState *env, vaddr addr,
         .in_mmu_idx = mmu_idx,
         .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
         .in_debug = true,
-        .in_prot_check = PAGE_READ,
+        .in_prot_check = 0,
     };
     GetPhysAddrResult res = {};
     ARMMMUFaultInfo fi = {};

From 8818b2d91363dc6b478edc4e6325e958e7348648 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:11 +1000
Subject: [PATCH 0409/2396] target/arm: Introduce get_phys_addr_for_at

Rename get_phys_addr_with_space_nogpc for its only
caller, do_ats_write.  Drop the MemOp memop argument
as it doesn't make sense in the new context.  Replace
the access_type parameter with prot_check.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h     | 18 +++++++-----------
 target/arm/ptw.c           | 21 ++++++++++++++-------
 target/arm/tcg/cpregs-at.c | 11 ++---------
 3 files changed, 23 insertions(+), 27 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 899242e572..8782594b77 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1602,25 +1602,21 @@ bool get_phys_addr(CPUARMState *env, vaddr address,
     __attribute__((nonnull));
 
 /**
- * get_phys_addr_with_space_nogpc: get the physical address for a virtual
- *                                 address
+ * get_phys_addr_for_at:
  * @env: CPUARMState
  * @address: virtual address to get physical address for
- * @access_type: 0 for read, 1 for write, 2 for execute
- * @memop: memory operation feeding this access, or 0 for none
+ * @prot_check: PAGE_{READ,WRITE,EXEC}, or 0
  * @mmu_idx: MMU index indicating required translation regime
  * @space: security space for the access
  * @result: set on translation success.
  * @fi: set to fault info if the translation fails
  *
- * Similar to get_phys_addr, but use the given security space and don't perform
- * a Granule Protection Check on the resulting address.
+ * Similar to get_phys_addr, but for use by AccessType_AT, i.e.
+ * system instructions for address translation.
  */
-bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
-                                    MMUAccessType access_type, MemOp memop,
-                                    ARMMMUIdx mmu_idx, ARMSecuritySpace space,
-                                    GetPhysAddrResult *result,
-                                    ARMMMUFaultInfo *fi)
+bool get_phys_addr_for_at(CPUARMState *env, vaddr address, unsigned prot_check,
+                          ARMMMUIdx mmu_idx, ARMSecuritySpace space,
+                          GetPhysAddrResult *result, ARMMMUFaultInfo *fi)
     __attribute__((nonnull));
 
 bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 5d85610de2..8925c9a610 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -3545,18 +3545,25 @@ static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
     return false;
 }
 
-bool get_phys_addr_with_space_nogpc(CPUARMState *env, vaddr address,
-                                    MMUAccessType access_type, MemOp memop,
-                                    ARMMMUIdx mmu_idx, ARMSecuritySpace space,
-                                    GetPhysAddrResult *result,
-                                    ARMMMUFaultInfo *fi)
+bool get_phys_addr_for_at(CPUARMState *env, vaddr address,
+                          unsigned prot_check, ARMMMUIdx mmu_idx,
+                          ARMSecuritySpace space, GetPhysAddrResult *result,
+                          ARMMMUFaultInfo *fi)
 {
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = space,
+        .in_prot_check = prot_check,
     };
-    return get_phys_addr_nogpc(env, &ptw, address, access_type,
-                               memop, result, fi);
+    /*
+     * I_MXTJT: Granule protection checks are not performed on the final
+     * address of a successful translation.  This is a translation not a
+     * memory reference, so MMU_DATA_LOAD is arbitrary (the exact protection
+     * check is handled or bypassed by .in_prot_check) and "memop = MO_8"
+     * bypasses any alignment check.
+     */
+    return get_phys_addr_nogpc(env, &ptw, address,
+                               MMU_DATA_LOAD, MO_8, result, fi);
 }
 
 static ARMSecuritySpace
diff --git a/target/arm/tcg/cpregs-at.c b/target/arm/tcg/cpregs-at.c
index 398a61d398..2ff0b3e76f 100644
--- a/target/arm/tcg/cpregs-at.c
+++ b/target/arm/tcg/cpregs-at.c
@@ -27,19 +27,12 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                              MMUAccessType access_type, ARMMMUIdx mmu_idx,
                              ARMSecuritySpace ss)
 {
-    bool ret;
     uint64_t par64;
     bool format64 = false;
     ARMMMUFaultInfo fi = {};
     GetPhysAddrResult res = {};
-
-    /*
-     * I_MXTJT: Granule protection checks are not performed on the final
-     * address of a successful translation.  This is a translation not a
-     * memory reference, so "memop = none = 0".
-     */
-    ret = get_phys_addr_with_space_nogpc(env, value, access_type, 0,
-                                         mmu_idx, ss, &res, &fi);
+    bool ret = get_phys_addr_for_at(env, value, 1 << access_type,
+                                    mmu_idx, ss, &res, &fi);
 
     /*
      * ATS operations only do S1 or S1+S2 translations, so we never

From efebeec13d076100191a4a5a98f047c46c0d592c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:12 +1000
Subject: [PATCH 0410/2396] target/arm: Skip AF and DB updates for
 AccessType_AT

We are required to skip DB update for AT instructions, and
we are allowed to skip AF updates.  Choose to skip both.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 8925c9a610..089eeff845 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -58,6 +58,12 @@ typedef struct S1Translate {
      * and will not change the state of the softmmu TLBs.
      */
     bool in_debug;
+    /*
+     * in_at: is this AccessType_AT?
+     * This is also set for debug, because at heart that is also
+     * an address translation, and simplifies a test.
+     */
+    bool in_at;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must
      * be true if stage 1 is an EL0 access; otherwise this is ignored.
@@ -1929,7 +1935,12 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
 
-    if (likely(!ptw->in_debug)) {
+    /*
+     * For AccessType_AT, DB is not updated (AArch64.SetDirtyFlag),
+     * and it is IMPLEMENTATION DEFINED whether AF is updated
+     * (AArch64.SetAccessFlag; qemu chooses to not update).
+     */
+    if (likely(!ptw->in_at)) {
         /*
          * Access flag.
          * If HA is enabled, prepare to update the descriptor below.
@@ -3553,6 +3564,7 @@ bool get_phys_addr_for_at(CPUARMState *env, vaddr address,
     S1Translate ptw = {
         .in_mmu_idx = mmu_idx,
         .in_space = space,
+        .in_at = true,
         .in_prot_check = prot_check,
     };
     /*
@@ -3653,6 +3665,7 @@ static hwaddr arm_cpu_get_phys_page(CPUARMState *env, vaddr addr,
         .in_mmu_idx = mmu_idx,
         .in_space = arm_mmu_idx_to_security_space(env, mmu_idx),
         .in_debug = true,
+        .in_at = true,
         .in_prot_check = 0,
     };
     GetPhysAddrResult res = {};

From 95901c43a8845a86a6895a8bd5d141f3ce36b3d1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:13 +1000
Subject: [PATCH 0411/2396] target/arm: Add prot_check parameter to
 do_ats_write

Separate protection check from access type, in preparation
for skipping the protection check altogether.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpregs-at.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/cpregs-at.c b/target/arm/tcg/cpregs-at.c
index 2ff0b3e76f..bebf168997 100644
--- a/target/arm/tcg/cpregs-at.c
+++ b/target/arm/tcg/cpregs-at.c
@@ -24,14 +24,14 @@ static int par_el1_shareability(GetPhysAddrResult *res)
 }
 
 static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-                             MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                             unsigned prot_check, ARMMMUIdx mmu_idx,
                              ARMSecuritySpace ss)
 {
     uint64_t par64;
     bool format64 = false;
     ARMMMUFaultInfo fi = {};
     GetPhysAddrResult res = {};
-    bool ret = get_phys_addr_for_at(env, value, 1 << access_type,
+    bool ret = get_phys_addr_for_at(env, value, prot_check,
                                     mmu_idx, ss, &res, &fi);
 
     /*
@@ -191,7 +191,7 @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
 
 static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    unsigned access_perm = ri->opc2 & 1 ? PAGE_WRITE : PAGE_READ;
     uint64_t par64;
     ARMMMUIdx mmu_idx;
     int el = arm_current_el(env);
@@ -253,7 +253,7 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         g_assert_not_reached();
     }
 
-    par64 = do_ats_write(env, value, access_type, mmu_idx, ss);
+    par64 = do_ats_write(env, value, access_perm, mmu_idx, ss);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
 }
@@ -261,11 +261,11 @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    unsigned access_perm = ri->opc2 & 1 ? PAGE_WRITE : PAGE_READ;
     uint64_t par64;
 
     /* There is no SecureEL2 for AArch32. */
-    par64 = do_ats_write(env, value, access_type, ARMMMUIdx_E2,
+    par64 = do_ats_write(env, value, access_perm, ARMMMUIdx_E2,
                          ARMSS_NonSecure);
 
     A32_BANKED_CURRENT_REG_SET(env, par, par64);
@@ -309,7 +309,7 @@ static CPAccessResult at_s1e01_access(CPUARMState *env, const ARMCPRegInfo *ri,
 static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
-    MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
+    unsigned access_perm = ri->opc2 & 1 ? PAGE_WRITE : PAGE_READ;
     ARMMMUIdx mmu_idx;
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
@@ -352,7 +352,7 @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 
     ss = for_el3 ? arm_security_space(env) : arm_security_space_below_el3(env);
-    env->cp15.par_el[1] = do_ats_write(env, value, access_type, mmu_idx, ss);
+    env->cp15.par_el[1] = do_ats_write(env, value, access_perm, mmu_idx, ss);
 }
 
 static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,

From b41cfb6d17ee29f3c5474d8a8f79260535a11335 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:14 +1000
Subject: [PATCH 0412/2396] target/arm: Fill in HFG[RWI]TR_EL2 bits for Arm
 v9.5

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index c9506aa6d5..1d103b577f 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -408,10 +408,19 @@ FIELD(HFGRTR_EL2, ERXPFGCTL_EL1, 47, 1)
 FIELD(HFGRTR_EL2, ERXPFGCDN_EL1, 48, 1)
 FIELD(HFGRTR_EL2, ERXADDR_EL1, 49, 1)
 FIELD(HFGRTR_EL2, NACCDATA_EL1, 50, 1)
-/* 51-53: RES0 */
+/* 51: RES0 */
+FIELD(HFGRTR_EL2, NGCS_EL0, 52, 1)
+FIELD(HFGRTR_EL2, NGCS_EL1, 53, 1)
 FIELD(HFGRTR_EL2, NSMPRI_EL1, 54, 1)
 FIELD(HFGRTR_EL2, NTPIDR2_EL0, 55, 1)
-/* 56-63: RES0 */
+FIELD(HFGRTR_EL2, NRCWMASK_EL1, 56, 1)
+FIELD(HFGRTR_EL2, NPIRE0_EL1, 57, 1)
+FIELD(HFGRTR_EL2, NPIR_EL1, 58, 1)
+FIELD(HFGRTR_EL2, NPOR_EL0, 59, 1)
+FIELD(HFGRTR_EL2, NPOR_EL1, 60, 1)
+FIELD(HFGRTR_EL2, NS2POR_EL1, 61, 1)
+FIELD(HFGRTR_EL2, NMAIR2_EL1, 62, 1)
+FIELD(HFGRTR_EL2, NAMAIR2_EL1, 63, 1)
 
 /* These match HFGRTR but bits for RO registers are RES0 */
 FIELD(HFGWTR_EL2, AFSR0_EL1, 0, 1)
@@ -452,8 +461,18 @@ FIELD(HFGWTR_EL2, ERXPFGCTL_EL1, 47, 1)
 FIELD(HFGWTR_EL2, ERXPFGCDN_EL1, 48, 1)
 FIELD(HFGWTR_EL2, ERXADDR_EL1, 49, 1)
 FIELD(HFGWTR_EL2, NACCDATA_EL1, 50, 1)
+FIELD(HFGWTR_EL2, NGCS_EL0, 52, 1)
+FIELD(HFGWTR_EL2, NGCS_EL1, 53, 1)
 FIELD(HFGWTR_EL2, NSMPRI_EL1, 54, 1)
 FIELD(HFGWTR_EL2, NTPIDR2_EL0, 55, 1)
+FIELD(HFGWTR_EL2, NRCWMASK_EL1, 56, 1)
+FIELD(HFGWTR_EL2, NPIRE0_EL1, 57, 1)
+FIELD(HFGWTR_EL2, NPIR_EL1, 58, 1)
+FIELD(HFGWTR_EL2, NPOR_EL0, 59, 1)
+FIELD(HFGWTR_EL2, NPOR_EL1, 60, 1)
+FIELD(HFGWTR_EL2, NS2POR_EL1, 61, 1)
+FIELD(HFGWTR_EL2, NMAIR2_EL1, 62, 1)
+FIELD(HFGWTR_EL2, NAMAIR2_EL1, 63, 1)
 
 FIELD(HFGITR_EL2, ICIALLUIS, 0, 1)
 FIELD(HFGITR_EL2, ICIALLU, 1, 1)
@@ -512,6 +531,11 @@ FIELD(HFGITR_EL2, SVC_EL1, 53, 1)
 FIELD(HFGITR_EL2, DCCVAC, 54, 1)
 FIELD(HFGITR_EL2, NBRBINJ, 55, 1)
 FIELD(HFGITR_EL2, NBRBIALL, 56, 1)
+FIELD(HFGITR_EL2, NGCSPUSHM_EL1, 57, 1)
+FIELD(HFGITR_EL2, NGCSSTR_EL1, 58, 1)
+FIELD(HFGITR_EL2, NGCSEPP, 59, 1)
+FIELD(HFGITR_EL2, COSPRCTX, 60, 1)
+FIELD(HFGITR_EL2, ATS1E1A, 62, 1)
 
 FIELD(HDFGRTR_EL2, DBGBCRN_EL1, 0, 1)
 FIELD(HDFGRTR_EL2, DBGBVRN_EL1, 1, 1)

From 171a302a041ed5532d997d40bb50f39b2b9435a3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:15 +1000
Subject: [PATCH 0413/2396] target/arm: Remove outdated comment for ZCR_EL12

The comment about not being included in the summary table
has been out of date for quite a while.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 19637e7301..b641229ba0 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4563,11 +4563,6 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
         { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0),
           "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" },
 
-        /*
-         * Note that redirection of ZCR is mentioned in the description
-         * of ZCR_EL2, and aliasing in the description of ZCR_EL1, but
-         * not in the summary table.
-         */
         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
         { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),

From 2b5daf79c32656264a23104c0693aa89c528cff8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 30 Aug 2025 15:40:16 +1000
Subject: [PATCH 0414/2396] target/arm: Implement FEAT_ATS1A

Implement FEAT_ATS1A and enable for -cpu max.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250830054128.448363-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpregs.h           |  1 +
 target/arm/cpu-features.h     |  5 ++++
 target/arm/tcg/cpregs-at.c    | 44 +++++++++++++++++++++++++++++++++++
 target/arm/tcg/cpu64.c        |  1 +
 5 files changed, 52 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 4e8aca8b5d..6b04c96c8c 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -23,6 +23,7 @@ the following architecture extensions:
 - FEAT_AFP (Alternate floating-point behavior)
 - FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)
 - FEAT_ASID16 (16 bit ASID)
+- FEAT_ATS1A (Address Translation operations that ignore stage 1 permissions)
 - FEAT_BBM at level 2 (Translation table break-before-make levels)
 - FEAT_BF16 (AArch64 BFloat16 instructions)
 - FEAT_BTI (Branch Target Identification)
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 1d103b577f..2a4826f5c4 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -854,6 +854,7 @@ typedef enum FGTBit {
     DO_BIT(HFGITR, DVPRCTX),
     DO_BIT(HFGITR, CPPRCTX),
     DO_BIT(HFGITR, DCCVAC),
+    DO_BIT(HFGITR, ATS1E1A),
 } FGTBit;
 
 #undef DO_BIT
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index e49e0ae3af..512eeaf551 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -619,6 +619,11 @@ static inline bool isar_feature_aa64_lut(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64ISAR2, LUT);
 }
 
+static inline bool isar_feature_aa64_ats1a(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64ISAR2, ATS1A);
+}
+
 static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
 {
     /* We always set the AdvSIMD and FP fields identically.  */
diff --git a/target/arm/tcg/cpregs-at.c b/target/arm/tcg/cpregs-at.c
index bebf168997..0e8f229aa7 100644
--- a/target/arm/tcg/cpregs-at.c
+++ b/target/arm/tcg/cpregs-at.c
@@ -488,6 +488,47 @@ static const ARMCPRegInfo ats1cp_reginfo[] = {
       .writefn = ats_write },
 };
 
+static void ats_s1e1a(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+{
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
+    ARMMMUIdx mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
+    ARMSecuritySpace ss = arm_security_space_below_el3(env);
+
+    env->cp15.par_el[1] = do_ats_write(env, value, 0, mmu_idx, ss);
+}
+
+static void ats_s1e2a(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+{
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    ARMMMUIdx mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
+    ARMSecuritySpace ss = arm_security_space_below_el3(env);
+
+    env->cp15.par_el[1] = do_ats_write(env, value, 0, mmu_idx, ss);
+}
+
+static void ats_s1e3a(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+{
+    env->cp15.par_el[1] = do_ats_write(env, value, 0, ARMMMUIdx_E3,
+                                       arm_security_space(env));
+}
+
+static const ARMCPRegInfo ats1a_reginfo[] = {
+    { .name = "AT_S1E1A", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 9, .opc2 = 2,
+      .access = PL1_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .fgt = FGT_ATS1E1A,
+      .accessfn = at_s1e01_access, .writefn = ats_s1e1a },
+    { .name = "AT_S1E2A", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 9, .opc2 = 2,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .accessfn = at_s1e2_access, .writefn = ats_s1e2a },
+    { .name = "AT_S1E3A", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 6, .crn = 7, .crm = 9, .opc2 = 2,
+      .access = PL3_W, .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC,
+      .writefn = ats_s1e3a },
+};
+
 void define_at_insn_regs(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
@@ -509,4 +550,7 @@ void define_at_insn_regs(ARMCPU *cpu)
     if (cpu_isar_feature(aa32_ats1e1, cpu)) {
         define_arm_cp_regs(cpu, ats1cp_reginfo);
     }
+    if (cpu_isar_feature(aa64_ats1a, cpu)) {
+        define_arm_cp_regs(cpu, ats1a_reginfo);
+    }
 }
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index b8b1981e70..abef6a246e 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1179,6 +1179,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1);       /* FEAT_HBC */
     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
     t = FIELD_DP64(t, ID_AA64ISAR2, CSSC, 1);     /* FEAT_CSSC */
+    t = FIELD_DP64(t, ID_AA64ISAR2, ATS1A, 1);    /* FEAT_ATS1A */
     SET_IDREG(isar, ID_AA64ISAR2, t);
 
     t = GET_IDREG(isar, ID_AA64PFR0);

From cc2c5027dc755b0b7e2a6531b089e5a239d3e0ce Mon Sep 17 00:00:00 2001
From: Osama Abdelkader <osama.abdelkader@gmail.com>
Date: Tue, 2 Sep 2025 22:08:18 +0200
Subject: [PATCH 0415/2396] hw/arm/raspi4b: remove redundant check in
 raspi_add_memory_node
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The if (acells == 0 || scells == 0) check is redundant in
raspi_add_memory_node, since it is already checked in the call
chain, arm_load_dtb. Also the return value of the function is
not checked/used so it's removed.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250902200818.43305-1-osama.abdelkader@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/raspi4b.c | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/hw/arm/raspi4b.c b/hw/arm/raspi4b.c
index 20082d5266..4df951a0d8 100644
--- a/hw/arm/raspi4b.c
+++ b/hw/arm/raspi4b.c
@@ -36,9 +36,8 @@ struct Raspi4bMachineState {
  * (see https://datasheets.raspberrypi.com/bcm2711/bcm2711-peripherals.pdf
  * 1.2 Address Map)
  */
-static int raspi_add_memory_node(void *fdt, hwaddr mem_base, hwaddr mem_len)
+static void raspi_add_memory_node(void *fdt, hwaddr mem_base, hwaddr mem_len)
 {
-    int ret;
     uint32_t acells, scells;
     char *nodename = g_strdup_printf("/memory@%" PRIx64, mem_base);
 
@@ -46,19 +45,16 @@ static int raspi_add_memory_node(void *fdt, hwaddr mem_base, hwaddr mem_len)
                                    NULL, &error_fatal);
     scells = qemu_fdt_getprop_cell(fdt, "/", "#size-cells",
                                    NULL, &error_fatal);
-    if (acells == 0 || scells == 0) {
-        fprintf(stderr, "dtb file invalid (#address-cells or #size-cells 0)\n");
-        ret = -1;
-    } else {
-        qemu_fdt_add_subnode(fdt, nodename);
-        qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
-        ret = qemu_fdt_setprop_sized_cells(fdt, nodename, "reg",
-                                           acells, mem_base,
-                                           scells, mem_len);
-    }
+    /* validated by arm_load_dtb */
+    g_assert(acells && scells);
+
+    qemu_fdt_add_subnode(fdt, nodename);
+    qemu_fdt_setprop_string(fdt, nodename, "device_type", "memory");
+    qemu_fdt_setprop_sized_cells(fdt, nodename, "reg",
+                                        acells, mem_base,
+                                        scells, mem_len);
 
     g_free(nodename);
-    return ret;
 }
 
 static void raspi4_modify_dtb(const struct arm_boot_info *info, void *fdt)

From 5b3764d9e30627853c5b9171925c51232e56a293 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 15:04:18 +0100
Subject: [PATCH 0416/2396] target/arm: Remove deprecated pxa CPU family
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In 10.0 we deprecated the pxa CPU family (pxa250, pxa255, pxa260
pxa261, pxa262, pxa270-a0, pxa270-a1, pxa270, pxa270-b0, pxa270-b1,
pxa270-c0, pxa270-c5).  Now we have released 10.1 we can remove them.

This commit removes only the top level CPU definitions and updates
the documentation. Removing the CPUs means that there is now a lot
of dead iwMMXt code, which we will delete in subsequent commits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250828140422.3271703-2-peter.maydell@linaro.org
---
 docs/about/deprecated.rst       |  21 ----
 docs/about/removed-features.rst |  14 +++
 target/arm/tcg/cpu32.c          | 163 --------------------------------
 3 files changed, 14 insertions(+), 184 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index b2420732e1..f031414769 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -236,27 +236,6 @@ Keeping 32-bit host support alive is a substantial burden for the
 QEMU project.  Thus QEMU will in future drop the support for all
 32-bit host systems.
 
-linux-user mode CPUs
---------------------
-
-iwMMXt emulation and the ``pxa`` CPUs (since 10.0)
-''''''''''''''''''''''''''''''''''''''''''''''''''
-
-The ``pxa`` CPU family (``pxa250``, ``pxa255``, ``pxa260``,
-``pxa261``, ``pxa262``, ``pxa270-a0``, ``pxa270-a1``, ``pxa270``,
-``pxa270-b0``, ``pxa270-b1``, ``pxa270-c0``, ``pxa270-c5``) are no
-longer used in system emulation, because all the machine types which
-used these CPUs were removed in the QEMU 9.2 release. These CPUs can
-now only be used in linux-user mode, and to do that you would have to
-explicitly select one of these CPUs with the ``-cpu`` command line
-option or the ``QEMU_CPU`` environment variable.
-
-We don't believe that anybody is using the iwMMXt emulation, and we do
-not have any tests to validate it or any real hardware or similar
-known-good implementation to test against. GCC is in the process of
-dropping their support for iwMMXt codegen. These CPU types are
-therefore deprecated in QEMU, and will be removed in a future release.
-
 System emulator CPUs
 --------------------
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index fff781d6b7..65fd564d22 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1138,6 +1138,20 @@ reason the maintainers strongly suspected no one actually used it.
 QEMU Nios II architecture was orphan; Intel has EOL'ed the Nios II
 processor IP (see `Intel discontinuance notification`_).
 
+iwMMXt emulation and the ``pxa`` CPUs (removed in 10.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``pxa`` CPU family (``pxa250``, ``pxa255``, ``pxa260``,
+``pxa261``, ``pxa262``, ``pxa270-a0``, ``pxa270-a1``, ``pxa270``,
+``pxa270-b0``, ``pxa270-b1``, ``pxa270-c0``, ``pxa270-c5``) were
+not available in system emulation, because all the machine types which
+used these CPUs were removed in the QEMU 9.2 release. We don't
+believe that anybody was using the iwMMXt emulation (which you
+would have to explicitly enable on the command line), and we did
+not have any tests to validate it or any real hardware or similar
+known-good implementation to test against. These CPUs have
+therefore been removed in linux-user mode as well.
+
 TCG introspection features
 --------------------------
 
diff --git a/target/arm/tcg/cpu32.c b/target/arm/tcg/cpu32.c
index a2a23eae0d..f0761410ad 100644
--- a/target/arm/tcg/cpu32.c
+++ b/target/arm/tcg/cpu32.c
@@ -807,144 +807,6 @@ static void sa1110_initfn(Object *obj)
     cpu->reset_sctlr = 0x00000070;
 }
 
-static void pxa250_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    cpu->midr = 0x69052100;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa255_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    cpu->midr = 0x69052d00;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa260_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    cpu->midr = 0x69052903;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa261_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    cpu->midr = 0x69052d05;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa262_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    cpu->midr = 0x69052d06;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270a0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054110;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270a1_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054111;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270b0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054112;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270b1_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054113;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270c0_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054114;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
-static void pxa270c5_initfn(Object *obj)
-{
-    ARMCPU *cpu = ARM_CPU(obj);
-
-    cpu->dtb_compatible = "marvell,xscale";
-    set_feature(&cpu->env, ARM_FEATURE_V5);
-    set_feature(&cpu->env, ARM_FEATURE_XSCALE);
-    set_feature(&cpu->env, ARM_FEATURE_IWMMXT);
-    cpu->midr = 0x69054117;
-    cpu->ctr = 0xd172172;
-    cpu->reset_sctlr = 0x00000078;
-}
-
 #ifndef TARGET_AARCH64
 /*
  * -cpu max: a CPU with as many features enabled as our emulation supports.
@@ -1032,31 +894,6 @@ static const ARMCPUInfo arm_tcg_cpus[] = {
     { .name = "ti925t",      .initfn = ti925t_initfn },
     { .name = "sa1100",      .initfn = sa1100_initfn },
     { .name = "sa1110",      .initfn = sa1110_initfn },
-    { .name = "pxa250",      .initfn = pxa250_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa255",      .initfn = pxa255_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa260",      .initfn = pxa260_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa261",      .initfn = pxa261_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa262",      .initfn = pxa262_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    /* "pxa270" is an alias for "pxa270-a0" */
-    { .name = "pxa270",      .initfn = pxa270a0_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-a0",   .initfn = pxa270a0_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-a1",   .initfn = pxa270a1_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-b0",   .initfn = pxa270b0_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-b1",   .initfn = pxa270b1_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-c0",   .initfn = pxa270c0_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
-    { .name = "pxa270-c5",   .initfn = pxa270c5_initfn,
-      .deprecation_note = "iwMMXt CPUs are no longer supported", },
 #ifndef TARGET_AARCH64
     { .name = "max",         .initfn = arm_max_initfn },
 #endif

From cdafe5bd90eef82bec798029ad5669bf2ee15023 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 15:04:19 +0100
Subject: [PATCH 0417/2396] target/arm: Remove XScale and iWMMXt translate.c
 code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove all the translator code that is accessible only via
ARM_FEATURE_XSCALE or ARM_FEATURE_IWMMXT.  This includes the
xscale-only cp15_cpar TB flags and cpu_{V0,V1,M0} TCG temps.

The no-longer-used helper functions will be removed in a separate
commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250828140422.3271703-3-peter.maydell@linaro.org
---
 target/arm/cpu.h           |    7 -
 target/arm/tcg/hflags.c    |   13 +-
 target/arm/tcg/translate.c | 1324 +-----------------------------------
 target/arm/tcg/translate.h |    2 -
 4 files changed, 7 insertions(+), 1339 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c15d79a106..f56fa6df8d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3025,13 +3025,6 @@ FIELD(TBFLAG_AM32, THUMB, 23, 1)         /* Not cached. */
  */
 FIELD(TBFLAG_A32, VECLEN, 0, 3)         /* Not cached. */
 FIELD(TBFLAG_A32, VECSTRIDE, 3, 2)     /* Not cached. */
-/*
- * We store the bottom two bits of the CPAR as TB flags and handle
- * checks on the other bits at runtime. This shares the same bits as
- * VECSTRIDE, which is OK as no XScale CPU has VFP.
- * Not cached, because VECLEN+VECSTRIDE are not cached.
- */
-FIELD(TBFLAG_A32, XSCALE_CPAR, 5, 2)
 FIELD(TBFLAG_A32, VFPEN, 7, 1)         /* Partially cached, minus FPEXC. */
 FIELD(TBFLAG_A32, SCTLR__B, 8, 1)      /* Cannot overlap with SCTLR_B */
 FIELD(TBFLAG_A32, HSTR_ACTIVE, 9, 1)
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 59ab526375..01894226cc 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -624,16 +624,9 @@ TCGTBCPUState arm_get_tb_cpu_state(CPUState *cs)
                 DP_TBFLAG_M32(flags, MVE_NO_PRED, 1);
             }
         } else {
-            /*
-             * Note that XSCALE_CPAR shares bits with VECSTRIDE.
-             * Note that VECLEN+VECSTRIDE are RES0 for M-profile.
-             */
-            if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-                DP_TBFLAG_A32(flags, XSCALE_CPAR, env->cp15.c15_cpar);
-            } else {
-                DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len);
-                DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride);
-            }
+            /* Note that VECLEN+VECSTRIDE are RES0 for M-profile. */
+            DP_TBFLAG_A32(flags, VECLEN, env->vfp.vec_len);
+            DP_TBFLAG_A32(flags, VECSTRIDE, env->vfp.vec_stride);
             if (env->vfp.xregs[ARM_VFP_FPEXC] & (1 << 30)) {
                 DP_TBFLAG_A32(flags, VFPEN, 1);
             }
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index f7d6d8ce19..e62dcc5d85 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -44,8 +44,6 @@
 #define ENABLE_ARCH_7     arm_dc_feature(s, ARM_FEATURE_V7)
 #define ENABLE_ARCH_8     arm_dc_feature(s, ARM_FEATURE_V8)
 
-/* These are TCG temporaries used only by the legacy iwMMXt decoder */
-static TCGv_i64 cpu_V0, cpu_V1, cpu_M0;
 /* These are TCG globals which alias CPUARMState fields */
 static TCGv_i32 cpu_R[16];
 TCGv_i32 cpu_CF, cpu_NF, cpu_VF, cpu_ZF;
@@ -1252,1263 +1250,6 @@ void write_neon_element64(TCGv_i64 src, int reg, int ele, MemOp memop)
     }
 }
 
-#define ARM_CP_RW_BIT   (1 << 20)
-
-static inline void iwmmxt_load_reg(TCGv_i64 var, int reg)
-{
-    tcg_gen_ld_i64(var, tcg_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
-}
-
-static inline void iwmmxt_store_reg(TCGv_i64 var, int reg)
-{
-    tcg_gen_st_i64(var, tcg_env, offsetof(CPUARMState, iwmmxt.regs[reg]));
-}
-
-static inline TCGv_i32 iwmmxt_load_creg(int reg)
-{
-    TCGv_i32 var = tcg_temp_new_i32();
-    tcg_gen_ld_i32(var, tcg_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
-    return var;
-}
-
-static inline void iwmmxt_store_creg(int reg, TCGv_i32 var)
-{
-    tcg_gen_st_i32(var, tcg_env, offsetof(CPUARMState, iwmmxt.cregs[reg]));
-}
-
-static inline void gen_op_iwmmxt_movq_wRn_M0(int rn)
-{
-    iwmmxt_store_reg(cpu_M0, rn);
-}
-
-static inline void gen_op_iwmmxt_movq_M0_wRn(int rn)
-{
-    iwmmxt_load_reg(cpu_M0, rn);
-}
-
-static inline void gen_op_iwmmxt_orq_M0_wRn(int rn)
-{
-    iwmmxt_load_reg(cpu_V1, rn);
-    tcg_gen_or_i64(cpu_M0, cpu_M0, cpu_V1);
-}
-
-static inline void gen_op_iwmmxt_andq_M0_wRn(int rn)
-{
-    iwmmxt_load_reg(cpu_V1, rn);
-    tcg_gen_and_i64(cpu_M0, cpu_M0, cpu_V1);
-}
-
-static inline void gen_op_iwmmxt_xorq_M0_wRn(int rn)
-{
-    iwmmxt_load_reg(cpu_V1, rn);
-    tcg_gen_xor_i64(cpu_M0, cpu_M0, cpu_V1);
-}
-
-#define IWMMXT_OP(name) \
-static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
-{ \
-    iwmmxt_load_reg(cpu_V1, rn); \
-    gen_helper_iwmmxt_##name(cpu_M0, cpu_M0, cpu_V1); \
-}
-
-#define IWMMXT_OP_ENV(name) \
-static inline void gen_op_iwmmxt_##name##_M0_wRn(int rn) \
-{ \
-    iwmmxt_load_reg(cpu_V1, rn); \
-    gen_helper_iwmmxt_##name(cpu_M0, tcg_env, cpu_M0, cpu_V1); \
-}
-
-#define IWMMXT_OP_ENV_SIZE(name) \
-IWMMXT_OP_ENV(name##b) \
-IWMMXT_OP_ENV(name##w) \
-IWMMXT_OP_ENV(name##l)
-
-#define IWMMXT_OP_ENV1(name) \
-static inline void gen_op_iwmmxt_##name##_M0(void) \
-{ \
-    gen_helper_iwmmxt_##name(cpu_M0, tcg_env, cpu_M0); \
-}
-
-IWMMXT_OP(maddsq)
-IWMMXT_OP(madduq)
-IWMMXT_OP(sadb)
-IWMMXT_OP(sadw)
-IWMMXT_OP(mulslw)
-IWMMXT_OP(mulshw)
-IWMMXT_OP(mululw)
-IWMMXT_OP(muluhw)
-IWMMXT_OP(macsw)
-IWMMXT_OP(macuw)
-
-IWMMXT_OP_ENV_SIZE(unpackl)
-IWMMXT_OP_ENV_SIZE(unpackh)
-
-IWMMXT_OP_ENV1(unpacklub)
-IWMMXT_OP_ENV1(unpackluw)
-IWMMXT_OP_ENV1(unpacklul)
-IWMMXT_OP_ENV1(unpackhub)
-IWMMXT_OP_ENV1(unpackhuw)
-IWMMXT_OP_ENV1(unpackhul)
-IWMMXT_OP_ENV1(unpacklsb)
-IWMMXT_OP_ENV1(unpacklsw)
-IWMMXT_OP_ENV1(unpacklsl)
-IWMMXT_OP_ENV1(unpackhsb)
-IWMMXT_OP_ENV1(unpackhsw)
-IWMMXT_OP_ENV1(unpackhsl)
-
-IWMMXT_OP_ENV_SIZE(cmpeq)
-IWMMXT_OP_ENV_SIZE(cmpgtu)
-IWMMXT_OP_ENV_SIZE(cmpgts)
-
-IWMMXT_OP_ENV_SIZE(mins)
-IWMMXT_OP_ENV_SIZE(minu)
-IWMMXT_OP_ENV_SIZE(maxs)
-IWMMXT_OP_ENV_SIZE(maxu)
-
-IWMMXT_OP_ENV_SIZE(subn)
-IWMMXT_OP_ENV_SIZE(addn)
-IWMMXT_OP_ENV_SIZE(subu)
-IWMMXT_OP_ENV_SIZE(addu)
-IWMMXT_OP_ENV_SIZE(subs)
-IWMMXT_OP_ENV_SIZE(adds)
-
-IWMMXT_OP_ENV(avgb0)
-IWMMXT_OP_ENV(avgb1)
-IWMMXT_OP_ENV(avgw0)
-IWMMXT_OP_ENV(avgw1)
-
-IWMMXT_OP_ENV(packuw)
-IWMMXT_OP_ENV(packul)
-IWMMXT_OP_ENV(packuq)
-IWMMXT_OP_ENV(packsw)
-IWMMXT_OP_ENV(packsl)
-IWMMXT_OP_ENV(packsq)
-
-static void gen_op_iwmmxt_set_mup(void)
-{
-    TCGv_i32 tmp;
-    tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
-    tcg_gen_ori_i32(tmp, tmp, 2);
-    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
-}
-
-static void gen_op_iwmmxt_set_cup(void)
-{
-    TCGv_i32 tmp;
-    tmp = load_cpu_field(iwmmxt.cregs[ARM_IWMMXT_wCon]);
-    tcg_gen_ori_i32(tmp, tmp, 1);
-    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCon]);
-}
-
-static void gen_op_iwmmxt_setpsr_nz(void)
-{
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    gen_helper_iwmmxt_setpsr_nz(tmp, cpu_M0);
-    store_cpu_field(tmp, iwmmxt.cregs[ARM_IWMMXT_wCASF]);
-}
-
-static inline void gen_op_iwmmxt_addl_M0_wRn(int rn)
-{
-    iwmmxt_load_reg(cpu_V1, rn);
-    tcg_gen_ext32u_i64(cpu_V1, cpu_V1);
-    tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
-}
-
-static inline int gen_iwmmxt_address(DisasContext *s, uint32_t insn,
-                                     TCGv_i32 dest)
-{
-    int rd;
-    uint32_t offset;
-    TCGv_i32 tmp;
-
-    rd = (insn >> 16) & 0xf;
-    tmp = load_reg(s, rd);
-
-    offset = (insn & 0xff) << ((insn >> 7) & 2);
-    if (insn & (1 << 24)) {
-        /* Pre indexed */
-        if (insn & (1 << 23))
-            tcg_gen_addi_i32(tmp, tmp, offset);
-        else
-            tcg_gen_addi_i32(tmp, tmp, -offset);
-        tcg_gen_mov_i32(dest, tmp);
-        if (insn & (1 << 21)) {
-            store_reg(s, rd, tmp);
-        }
-    } else if (insn & (1 << 21)) {
-        /* Post indexed */
-        tcg_gen_mov_i32(dest, tmp);
-        if (insn & (1 << 23))
-            tcg_gen_addi_i32(tmp, tmp, offset);
-        else
-            tcg_gen_addi_i32(tmp, tmp, -offset);
-        store_reg(s, rd, tmp);
-    } else if (!(insn & (1 << 23)))
-        return 1;
-    return 0;
-}
-
-static inline int gen_iwmmxt_shift(uint32_t insn, uint32_t mask, TCGv_i32 dest)
-{
-    int rd = (insn >> 0) & 0xf;
-    TCGv_i32 tmp;
-
-    if (insn & (1 << 8)) {
-        if (rd < ARM_IWMMXT_wCGR0 || rd > ARM_IWMMXT_wCGR3) {
-            return 1;
-        } else {
-            tmp = iwmmxt_load_creg(rd);
-        }
-    } else {
-        tmp = tcg_temp_new_i32();
-        iwmmxt_load_reg(cpu_V0, rd);
-        tcg_gen_extrl_i64_i32(tmp, cpu_V0);
-    }
-    tcg_gen_andi_i32(tmp, tmp, mask);
-    tcg_gen_mov_i32(dest, tmp);
-    return 0;
-}
-
-/* Disassemble an iwMMXt instruction.  Returns nonzero if an error occurred
-   (ie. an undefined instruction).  */
-static int disas_iwmmxt_insn(DisasContext *s, uint32_t insn)
-{
-    int rd, wrd;
-    int rdhi, rdlo, rd0, rd1, i;
-    TCGv_i32 addr;
-    TCGv_i32 tmp, tmp2, tmp3;
-
-    if ((insn & 0x0e000e00) == 0x0c000000) {
-        if ((insn & 0x0fe00ff0) == 0x0c400000) {
-            wrd = insn & 0xf;
-            rdlo = (insn >> 12) & 0xf;
-            rdhi = (insn >> 16) & 0xf;
-            if (insn & ARM_CP_RW_BIT) {                         /* TMRRC */
-                iwmmxt_load_reg(cpu_V0, wrd);
-                tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
-                tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
-            } else {                                    /* TMCRR */
-                tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
-                iwmmxt_store_reg(cpu_V0, wrd);
-                gen_op_iwmmxt_set_mup();
-            }
-            return 0;
-        }
-
-        wrd = (insn >> 12) & 0xf;
-        addr = tcg_temp_new_i32();
-        if (gen_iwmmxt_address(s, insn, addr)) {
-            return 1;
-        }
-        if (insn & ARM_CP_RW_BIT) {
-            if ((insn >> 28) == 0xf) {                  /* WLDRW wCx */
-                tmp = tcg_temp_new_i32();
-                gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
-                iwmmxt_store_creg(wrd, tmp);
-            } else {
-                i = 1;
-                if (insn & (1 << 8)) {
-                    if (insn & (1 << 22)) {             /* WLDRD */
-                        gen_aa32_ld64(s, cpu_M0, addr, get_mem_index(s));
-                        i = 0;
-                    } else {                            /* WLDRW wRd */
-                        tmp = tcg_temp_new_i32();
-                        gen_aa32_ld32u(s, tmp, addr, get_mem_index(s));
-                    }
-                } else {
-                    tmp = tcg_temp_new_i32();
-                    if (insn & (1 << 22)) {             /* WLDRH */
-                        gen_aa32_ld16u(s, tmp, addr, get_mem_index(s));
-                    } else {                            /* WLDRB */
-                        gen_aa32_ld8u(s, tmp, addr, get_mem_index(s));
-                    }
-                }
-                if (i) {
-                    tcg_gen_extu_i32_i64(cpu_M0, tmp);
-                }
-                gen_op_iwmmxt_movq_wRn_M0(wrd);
-            }
-        } else {
-            if ((insn >> 28) == 0xf) {                  /* WSTRW wCx */
-                tmp = iwmmxt_load_creg(wrd);
-                gen_aa32_st32(s, tmp, addr, get_mem_index(s));
-            } else {
-                gen_op_iwmmxt_movq_M0_wRn(wrd);
-                tmp = tcg_temp_new_i32();
-                if (insn & (1 << 8)) {
-                    if (insn & (1 << 22)) {             /* WSTRD */
-                        gen_aa32_st64(s, cpu_M0, addr, get_mem_index(s));
-                    } else {                            /* WSTRW wRd */
-                        tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-                        gen_aa32_st32(s, tmp, addr, get_mem_index(s));
-                    }
-                } else {
-                    if (insn & (1 << 22)) {             /* WSTRH */
-                        tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-                        gen_aa32_st16(s, tmp, addr, get_mem_index(s));
-                    } else {                            /* WSTRB */
-                        tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-                        gen_aa32_st8(s, tmp, addr, get_mem_index(s));
-                    }
-                }
-            }
-        }
-        return 0;
-    }
-
-    if ((insn & 0x0f000000) != 0x0e000000)
-        return 1;
-
-    switch (((insn >> 12) & 0xf00) | ((insn >> 4) & 0xff)) {
-    case 0x000:                                                 /* WOR */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 0) & 0xf;
-        rd1 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        gen_op_iwmmxt_orq_M0_wRn(rd1);
-        gen_op_iwmmxt_setpsr_nz();
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x011:                                                 /* TMCR */
-        if (insn & 0xf)
-            return 1;
-        rd = (insn >> 12) & 0xf;
-        wrd = (insn >> 16) & 0xf;
-        switch (wrd) {
-        case ARM_IWMMXT_wCID:
-        case ARM_IWMMXT_wCASF:
-            break;
-        case ARM_IWMMXT_wCon:
-            gen_op_iwmmxt_set_cup();
-            /* Fall through.  */
-        case ARM_IWMMXT_wCSSF:
-            tmp = iwmmxt_load_creg(wrd);
-            tmp2 = load_reg(s, rd);
-            tcg_gen_andc_i32(tmp, tmp, tmp2);
-            iwmmxt_store_creg(wrd, tmp);
-            break;
-        case ARM_IWMMXT_wCGR0:
-        case ARM_IWMMXT_wCGR1:
-        case ARM_IWMMXT_wCGR2:
-        case ARM_IWMMXT_wCGR3:
-            gen_op_iwmmxt_set_cup();
-            tmp = load_reg(s, rd);
-            iwmmxt_store_creg(wrd, tmp);
-            break;
-        default:
-            return 1;
-        }
-        break;
-    case 0x100:                                                 /* WXOR */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 0) & 0xf;
-        rd1 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        gen_op_iwmmxt_xorq_M0_wRn(rd1);
-        gen_op_iwmmxt_setpsr_nz();
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x111:                                                 /* TMRC */
-        if (insn & 0xf)
-            return 1;
-        rd = (insn >> 12) & 0xf;
-        wrd = (insn >> 16) & 0xf;
-        tmp = iwmmxt_load_creg(wrd);
-        store_reg(s, rd, tmp);
-        break;
-    case 0x300:                                                 /* WANDN */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 0) & 0xf;
-        rd1 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tcg_gen_neg_i64(cpu_M0, cpu_M0);
-        gen_op_iwmmxt_andq_M0_wRn(rd1);
-        gen_op_iwmmxt_setpsr_nz();
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x200:                                                 /* WAND */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 0) & 0xf;
-        rd1 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        gen_op_iwmmxt_andq_M0_wRn(rd1);
-        gen_op_iwmmxt_setpsr_nz();
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x810: case 0xa10:                             /* WMADD */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 0) & 0xf;
-        rd1 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        if (insn & (1 << 21))
-            gen_op_iwmmxt_maddsq_M0_wRn(rd1);
-        else
-            gen_op_iwmmxt_madduq_M0_wRn(rd1);
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x10e: case 0x50e: case 0x90e: case 0xd0e:     /* WUNPCKIL */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            gen_op_iwmmxt_unpacklb_M0_wRn(rd1);
-            break;
-        case 1:
-            gen_op_iwmmxt_unpacklw_M0_wRn(rd1);
-            break;
-        case 2:
-            gen_op_iwmmxt_unpackll_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x10c: case 0x50c: case 0x90c: case 0xd0c:     /* WUNPCKIH */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            gen_op_iwmmxt_unpackhb_M0_wRn(rd1);
-            break;
-        case 1:
-            gen_op_iwmmxt_unpackhw_M0_wRn(rd1);
-            break;
-        case 2:
-            gen_op_iwmmxt_unpackhl_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x012: case 0x112: case 0x412: case 0x512:     /* WSAD */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        if (insn & (1 << 22))
-            gen_op_iwmmxt_sadw_M0_wRn(rd1);
-        else
-            gen_op_iwmmxt_sadb_M0_wRn(rd1);
-        if (!(insn & (1 << 20)))
-            gen_op_iwmmxt_addl_M0_wRn(wrd);
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x010: case 0x110: case 0x210: case 0x310:     /* WMUL */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        if (insn & (1 << 21)) {
-            if (insn & (1 << 20))
-                gen_op_iwmmxt_mulshw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_mulslw_M0_wRn(rd1);
-        } else {
-            if (insn & (1 << 20))
-                gen_op_iwmmxt_muluhw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_mululw_M0_wRn(rd1);
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x410: case 0x510: case 0x610: case 0x710:     /* WMAC */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        if (insn & (1 << 21))
-            gen_op_iwmmxt_macsw_M0_wRn(rd1);
-        else
-            gen_op_iwmmxt_macuw_M0_wRn(rd1);
-        if (!(insn & (1 << 20))) {
-            iwmmxt_load_reg(cpu_V1, wrd);
-            tcg_gen_add_i64(cpu_M0, cpu_M0, cpu_V1);
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x006: case 0x406: case 0x806: case 0xc06:     /* WCMPEQ */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            gen_op_iwmmxt_cmpeqb_M0_wRn(rd1);
-            break;
-        case 1:
-            gen_op_iwmmxt_cmpeqw_M0_wRn(rd1);
-            break;
-        case 2:
-            gen_op_iwmmxt_cmpeql_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x800: case 0x900: case 0xc00: case 0xd00:     /* WAVG2 */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        if (insn & (1 << 22)) {
-            if (insn & (1 << 20))
-                gen_op_iwmmxt_avgw1_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_avgw0_M0_wRn(rd1);
-        } else {
-            if (insn & (1 << 20))
-                gen_op_iwmmxt_avgb1_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_avgb0_M0_wRn(rd1);
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x802: case 0x902: case 0xa02: case 0xb02:     /* WALIGNR */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = iwmmxt_load_creg(ARM_IWMMXT_wCGR0 + ((insn >> 20) & 3));
-        tcg_gen_andi_i32(tmp, tmp, 7);
-        iwmmxt_load_reg(cpu_V1, rd1);
-        gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1, tmp);
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x601: case 0x605: case 0x609: case 0x60d:     /* TINSR */
-        if (((insn >> 6) & 3) == 3)
-            return 1;
-        rd = (insn >> 12) & 0xf;
-        wrd = (insn >> 16) & 0xf;
-        tmp = load_reg(s, rd);
-        gen_op_iwmmxt_movq_M0_wRn(wrd);
-        switch ((insn >> 6) & 3) {
-        case 0:
-            tmp2 = tcg_constant_i32(0xff);
-            tmp3 = tcg_constant_i32((insn & 7) << 3);
-            break;
-        case 1:
-            tmp2 = tcg_constant_i32(0xffff);
-            tmp3 = tcg_constant_i32((insn & 3) << 4);
-            break;
-        case 2:
-            tmp2 = tcg_constant_i32(0xffffffff);
-            tmp3 = tcg_constant_i32((insn & 1) << 5);
-            break;
-        default:
-            g_assert_not_reached();
-        }
-        gen_helper_iwmmxt_insr(cpu_M0, cpu_M0, tmp, tmp2, tmp3);
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x107: case 0x507: case 0x907: case 0xd07:     /* TEXTRM */
-        rd = (insn >> 12) & 0xf;
-        wrd = (insn >> 16) & 0xf;
-        if (rd == 15 || ((insn >> 22) & 3) == 3)
-            return 1;
-        gen_op_iwmmxt_movq_M0_wRn(wrd);
-        tmp = tcg_temp_new_i32();
-        switch ((insn >> 22) & 3) {
-        case 0:
-            tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 7) << 3);
-            tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-            if (insn & 8) {
-                tcg_gen_ext8s_i32(tmp, tmp);
-            } else {
-                tcg_gen_andi_i32(tmp, tmp, 0xff);
-            }
-            break;
-        case 1:
-            tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 3) << 4);
-            tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-            if (insn & 8) {
-                tcg_gen_ext16s_i32(tmp, tmp);
-            } else {
-                tcg_gen_andi_i32(tmp, tmp, 0xffff);
-            }
-            break;
-        case 2:
-            tcg_gen_shri_i64(cpu_M0, cpu_M0, (insn & 1) << 5);
-            tcg_gen_extrl_i64_i32(tmp, cpu_M0);
-            break;
-        }
-        store_reg(s, rd, tmp);
-        break;
-    case 0x117: case 0x517: case 0x917: case 0xd17:     /* TEXTRC */
-        if ((insn & 0x000ff008) != 0x0003f000 || ((insn >> 22) & 3) == 3)
-            return 1;
-        tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            tcg_gen_shri_i32(tmp, tmp, ((insn & 7) << 2) + 0);
-            break;
-        case 1:
-            tcg_gen_shri_i32(tmp, tmp, ((insn & 3) << 3) + 4);
-            break;
-        case 2:
-            tcg_gen_shri_i32(tmp, tmp, ((insn & 1) << 4) + 12);
-            break;
-        }
-        tcg_gen_shli_i32(tmp, tmp, 28);
-        gen_set_nzcv(tmp);
-        break;
-    case 0x401: case 0x405: case 0x409: case 0x40d:     /* TBCST */
-        if (((insn >> 6) & 3) == 3)
-            return 1;
-        rd = (insn >> 12) & 0xf;
-        wrd = (insn >> 16) & 0xf;
-        tmp = load_reg(s, rd);
-        switch ((insn >> 6) & 3) {
-        case 0:
-            gen_helper_iwmmxt_bcstb(cpu_M0, tmp);
-            break;
-        case 1:
-            gen_helper_iwmmxt_bcstw(cpu_M0, tmp);
-            break;
-        case 2:
-            gen_helper_iwmmxt_bcstl(cpu_M0, tmp);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x113: case 0x513: case 0x913: case 0xd13:     /* TANDC */
-        if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
-            return 1;
-        tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
-        tmp2 = tcg_temp_new_i32();
-        tcg_gen_mov_i32(tmp2, tmp);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            for (i = 0; i < 7; i ++) {
-                tcg_gen_shli_i32(tmp2, tmp2, 4);
-                tcg_gen_and_i32(tmp, tmp, tmp2);
-            }
-            break;
-        case 1:
-            for (i = 0; i < 3; i ++) {
-                tcg_gen_shli_i32(tmp2, tmp2, 8);
-                tcg_gen_and_i32(tmp, tmp, tmp2);
-            }
-            break;
-        case 2:
-            tcg_gen_shli_i32(tmp2, tmp2, 16);
-            tcg_gen_and_i32(tmp, tmp, tmp2);
-            break;
-        }
-        gen_set_nzcv(tmp);
-        break;
-    case 0x01c: case 0x41c: case 0x81c: case 0xc1c:     /* WACC */
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            gen_helper_iwmmxt_addcb(cpu_M0, cpu_M0);
-            break;
-        case 1:
-            gen_helper_iwmmxt_addcw(cpu_M0, cpu_M0);
-            break;
-        case 2:
-            gen_helper_iwmmxt_addcl(cpu_M0, cpu_M0);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x115: case 0x515: case 0x915: case 0xd15:     /* TORC */
-        if ((insn & 0x000ff00f) != 0x0003f000 || ((insn >> 22) & 3) == 3)
-            return 1;
-        tmp = iwmmxt_load_creg(ARM_IWMMXT_wCASF);
-        tmp2 = tcg_temp_new_i32();
-        tcg_gen_mov_i32(tmp2, tmp);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            for (i = 0; i < 7; i ++) {
-                tcg_gen_shli_i32(tmp2, tmp2, 4);
-                tcg_gen_or_i32(tmp, tmp, tmp2);
-            }
-            break;
-        case 1:
-            for (i = 0; i < 3; i ++) {
-                tcg_gen_shli_i32(tmp2, tmp2, 8);
-                tcg_gen_or_i32(tmp, tmp, tmp2);
-            }
-            break;
-        case 2:
-            tcg_gen_shli_i32(tmp2, tmp2, 16);
-            tcg_gen_or_i32(tmp, tmp, tmp2);
-            break;
-        }
-        gen_set_nzcv(tmp);
-        break;
-    case 0x103: case 0x503: case 0x903: case 0xd03:     /* TMOVMSK */
-        rd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        if ((insn & 0xf) != 0 || ((insn >> 22) & 3) == 3)
-            return 1;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_temp_new_i32();
-        switch ((insn >> 22) & 3) {
-        case 0:
-            gen_helper_iwmmxt_msbb(tmp, cpu_M0);
-            break;
-        case 1:
-            gen_helper_iwmmxt_msbw(tmp, cpu_M0);
-            break;
-        case 2:
-            gen_helper_iwmmxt_msbl(tmp, cpu_M0);
-            break;
-        }
-        store_reg(s, rd, tmp);
-        break;
-    case 0x106: case 0x306: case 0x506: case 0x706:     /* WCMPGT */
-    case 0x906: case 0xb06: case 0xd06: case 0xf06:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_cmpgtsb_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_cmpgtub_M0_wRn(rd1);
-            break;
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_cmpgtsw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_cmpgtuw_M0_wRn(rd1);
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_cmpgtsl_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_cmpgtul_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x00e: case 0x20e: case 0x40e: case 0x60e:     /* WUNPCKEL */
-    case 0x80e: case 0xa0e: case 0xc0e: case 0xe0e:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpacklsb_M0();
-            else
-                gen_op_iwmmxt_unpacklub_M0();
-            break;
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpacklsw_M0();
-            else
-                gen_op_iwmmxt_unpackluw_M0();
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpacklsl_M0();
-            else
-                gen_op_iwmmxt_unpacklul_M0();
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x00c: case 0x20c: case 0x40c: case 0x60c:     /* WUNPCKEH */
-    case 0x80c: case 0xa0c: case 0xc0c: case 0xe0c:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpackhsb_M0();
-            else
-                gen_op_iwmmxt_unpackhub_M0();
-            break;
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpackhsw_M0();
-            else
-                gen_op_iwmmxt_unpackhuw_M0();
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_unpackhsl_M0();
-            else
-                gen_op_iwmmxt_unpackhul_M0();
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x204: case 0x604: case 0xa04: case 0xe04:     /* WSRL */
-    case 0x214: case 0x614: case 0xa14: case 0xe14:
-        if (((insn >> 22) & 3) == 0)
-            return 1;
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_temp_new_i32();
-        if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
-            return 1;
-        }
-        switch ((insn >> 22) & 3) {
-        case 1:
-            gen_helper_iwmmxt_srlw(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 2:
-            gen_helper_iwmmxt_srll(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 3:
-            gen_helper_iwmmxt_srlq(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x004: case 0x404: case 0x804: case 0xc04:     /* WSRA */
-    case 0x014: case 0x414: case 0x814: case 0xc14:
-        if (((insn >> 22) & 3) == 0)
-            return 1;
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_temp_new_i32();
-        if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
-            return 1;
-        }
-        switch ((insn >> 22) & 3) {
-        case 1:
-            gen_helper_iwmmxt_sraw(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 2:
-            gen_helper_iwmmxt_sral(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 3:
-            gen_helper_iwmmxt_sraq(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x104: case 0x504: case 0x904: case 0xd04:     /* WSLL */
-    case 0x114: case 0x514: case 0x914: case 0xd14:
-        if (((insn >> 22) & 3) == 0)
-            return 1;
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_temp_new_i32();
-        if (gen_iwmmxt_shift(insn, 0xff, tmp)) {
-            return 1;
-        }
-        switch ((insn >> 22) & 3) {
-        case 1:
-            gen_helper_iwmmxt_sllw(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 2:
-            gen_helper_iwmmxt_slll(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 3:
-            gen_helper_iwmmxt_sllq(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x304: case 0x704: case 0xb04: case 0xf04:     /* WROR */
-    case 0x314: case 0x714: case 0xb14: case 0xf14:
-        if (((insn >> 22) & 3) == 0)
-            return 1;
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_temp_new_i32();
-        switch ((insn >> 22) & 3) {
-        case 1:
-            if (gen_iwmmxt_shift(insn, 0xf, tmp)) {
-                return 1;
-            }
-            gen_helper_iwmmxt_rorw(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 2:
-            if (gen_iwmmxt_shift(insn, 0x1f, tmp)) {
-                return 1;
-            }
-            gen_helper_iwmmxt_rorl(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        case 3:
-            if (gen_iwmmxt_shift(insn, 0x3f, tmp)) {
-                return 1;
-            }
-            gen_helper_iwmmxt_rorq(cpu_M0, tcg_env, cpu_M0, tmp);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x116: case 0x316: case 0x516: case 0x716:     /* WMIN */
-    case 0x916: case 0xb16: case 0xd16: case 0xf16:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_minsb_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_minub_M0_wRn(rd1);
-            break;
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_minsw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_minuw_M0_wRn(rd1);
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_minsl_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_minul_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x016: case 0x216: case 0x416: case 0x616:     /* WMAX */
-    case 0x816: case 0xa16: case 0xc16: case 0xe16:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 0:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_maxsb_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_maxub_M0_wRn(rd1);
-            break;
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_maxsw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_maxuw_M0_wRn(rd1);
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_maxsl_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_maxul_M0_wRn(rd1);
-            break;
-        case 3:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x002: case 0x102: case 0x202: case 0x302:     /* WALIGNI */
-    case 0x402: case 0x502: case 0x602: case 0x702:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        iwmmxt_load_reg(cpu_V1, rd1);
-        gen_helper_iwmmxt_align(cpu_M0, cpu_M0, cpu_V1,
-                                tcg_constant_i32((insn >> 20) & 3));
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    case 0x01a: case 0x11a: case 0x21a: case 0x31a:     /* WSUB */
-    case 0x41a: case 0x51a: case 0x61a: case 0x71a:
-    case 0x81a: case 0x91a: case 0xa1a: case 0xb1a:
-    case 0xc1a: case 0xd1a: case 0xe1a: case 0xf1a:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 20) & 0xf) {
-        case 0x0:
-            gen_op_iwmmxt_subnb_M0_wRn(rd1);
-            break;
-        case 0x1:
-            gen_op_iwmmxt_subub_M0_wRn(rd1);
-            break;
-        case 0x3:
-            gen_op_iwmmxt_subsb_M0_wRn(rd1);
-            break;
-        case 0x4:
-            gen_op_iwmmxt_subnw_M0_wRn(rd1);
-            break;
-        case 0x5:
-            gen_op_iwmmxt_subuw_M0_wRn(rd1);
-            break;
-        case 0x7:
-            gen_op_iwmmxt_subsw_M0_wRn(rd1);
-            break;
-        case 0x8:
-            gen_op_iwmmxt_subnl_M0_wRn(rd1);
-            break;
-        case 0x9:
-            gen_op_iwmmxt_subul_M0_wRn(rd1);
-            break;
-        case 0xb:
-            gen_op_iwmmxt_subsl_M0_wRn(rd1);
-            break;
-        default:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x01e: case 0x11e: case 0x21e: case 0x31e:     /* WSHUFH */
-    case 0x41e: case 0x51e: case 0x61e: case 0x71e:
-    case 0x81e: case 0x91e: case 0xa1e: case 0xb1e:
-    case 0xc1e: case 0xd1e: case 0xe1e: case 0xf1e:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        tmp = tcg_constant_i32(((insn >> 16) & 0xf0) | (insn & 0x0f));
-        gen_helper_iwmmxt_shufh(cpu_M0, tcg_env, cpu_M0, tmp);
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x018: case 0x118: case 0x218: case 0x318:     /* WADD */
-    case 0x418: case 0x518: case 0x618: case 0x718:
-    case 0x818: case 0x918: case 0xa18: case 0xb18:
-    case 0xc18: case 0xd18: case 0xe18: case 0xf18:
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 20) & 0xf) {
-        case 0x0:
-            gen_op_iwmmxt_addnb_M0_wRn(rd1);
-            break;
-        case 0x1:
-            gen_op_iwmmxt_addub_M0_wRn(rd1);
-            break;
-        case 0x3:
-            gen_op_iwmmxt_addsb_M0_wRn(rd1);
-            break;
-        case 0x4:
-            gen_op_iwmmxt_addnw_M0_wRn(rd1);
-            break;
-        case 0x5:
-            gen_op_iwmmxt_adduw_M0_wRn(rd1);
-            break;
-        case 0x7:
-            gen_op_iwmmxt_addsw_M0_wRn(rd1);
-            break;
-        case 0x8:
-            gen_op_iwmmxt_addnl_M0_wRn(rd1);
-            break;
-        case 0x9:
-            gen_op_iwmmxt_addul_M0_wRn(rd1);
-            break;
-        case 0xb:
-            gen_op_iwmmxt_addsl_M0_wRn(rd1);
-            break;
-        default:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x008: case 0x108: case 0x208: case 0x308:     /* WPACK */
-    case 0x408: case 0x508: case 0x608: case 0x708:
-    case 0x808: case 0x908: case 0xa08: case 0xb08:
-    case 0xc08: case 0xd08: case 0xe08: case 0xf08:
-        if (!(insn & (1 << 20)) || ((insn >> 22) & 3) == 0)
-            return 1;
-        wrd = (insn >> 12) & 0xf;
-        rd0 = (insn >> 16) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        gen_op_iwmmxt_movq_M0_wRn(rd0);
-        switch ((insn >> 22) & 3) {
-        case 1:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_packsw_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_packuw_M0_wRn(rd1);
-            break;
-        case 2:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_packsl_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_packul_M0_wRn(rd1);
-            break;
-        case 3:
-            if (insn & (1 << 21))
-                gen_op_iwmmxt_packsq_M0_wRn(rd1);
-            else
-                gen_op_iwmmxt_packuq_M0_wRn(rd1);
-            break;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        gen_op_iwmmxt_set_cup();
-        break;
-    case 0x201: case 0x203: case 0x205: case 0x207:
-    case 0x209: case 0x20b: case 0x20d: case 0x20f:
-    case 0x211: case 0x213: case 0x215: case 0x217:
-    case 0x219: case 0x21b: case 0x21d: case 0x21f:
-        wrd = (insn >> 5) & 0xf;
-        rd0 = (insn >> 12) & 0xf;
-        rd1 = (insn >> 0) & 0xf;
-        if (rd0 == 0xf || rd1 == 0xf)
-            return 1;
-        gen_op_iwmmxt_movq_M0_wRn(wrd);
-        tmp = load_reg(s, rd0);
-        tmp2 = load_reg(s, rd1);
-        switch ((insn >> 16) & 0xf) {
-        case 0x0:                                       /* TMIA */
-            gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        case 0x8:                                       /* TMIAPH */
-            gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        case 0xc: case 0xd: case 0xe: case 0xf:                 /* TMIAxy */
-            if (insn & (1 << 16))
-                tcg_gen_shri_i32(tmp, tmp, 16);
-            if (insn & (1 << 17))
-                tcg_gen_shri_i32(tmp2, tmp2, 16);
-            gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        default:
-            return 1;
-        }
-        gen_op_iwmmxt_movq_wRn_M0(wrd);
-        gen_op_iwmmxt_set_mup();
-        break;
-    default:
-        return 1;
-    }
-
-    return 0;
-}
-
-/* Disassemble an XScale DSP instruction.  Returns nonzero if an error occurred
-   (ie. an undefined instruction).  */
-static int disas_dsp_insn(DisasContext *s, uint32_t insn)
-{
-    int acc, rd0, rd1, rdhi, rdlo;
-    TCGv_i32 tmp, tmp2;
-
-    if ((insn & 0x0ff00f10) == 0x0e200010) {
-        /* Multiply with Internal Accumulate Format */
-        rd0 = (insn >> 12) & 0xf;
-        rd1 = insn & 0xf;
-        acc = (insn >> 5) & 7;
-
-        if (acc != 0)
-            return 1;
-
-        tmp = load_reg(s, rd0);
-        tmp2 = load_reg(s, rd1);
-        switch ((insn >> 16) & 0xf) {
-        case 0x0:                                       /* MIA */
-            gen_helper_iwmmxt_muladdsl(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        case 0x8:                                       /* MIAPH */
-            gen_helper_iwmmxt_muladdsw(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        case 0xc:                                       /* MIABB */
-        case 0xd:                                       /* MIABT */
-        case 0xe:                                       /* MIATB */
-        case 0xf:                                       /* MIATT */
-            if (insn & (1 << 16))
-                tcg_gen_shri_i32(tmp, tmp, 16);
-            if (insn & (1 << 17))
-                tcg_gen_shri_i32(tmp2, tmp2, 16);
-            gen_helper_iwmmxt_muladdswl(cpu_M0, cpu_M0, tmp, tmp2);
-            break;
-        default:
-            return 1;
-        }
-
-        gen_op_iwmmxt_movq_wRn_M0(acc);
-        return 0;
-    }
-
-    if ((insn & 0x0fe00ff8) == 0x0c400000) {
-        /* Internal Accumulator Access Format */
-        rdhi = (insn >> 16) & 0xf;
-        rdlo = (insn >> 12) & 0xf;
-        acc = insn & 7;
-
-        if (acc != 0)
-            return 1;
-
-        if (insn & ARM_CP_RW_BIT) {                     /* MRA */
-            iwmmxt_load_reg(cpu_V0, acc);
-            tcg_gen_extrl_i64_i32(cpu_R[rdlo], cpu_V0);
-            tcg_gen_extrh_i64_i32(cpu_R[rdhi], cpu_V0);
-            tcg_gen_andi_i32(cpu_R[rdhi], cpu_R[rdhi], (1 << (40 - 32)) - 1);
-        } else {                                        /* MAR */
-            tcg_gen_concat_i32_i64(cpu_V0, cpu_R[rdlo], cpu_R[rdhi]);
-            iwmmxt_store_reg(cpu_V0, acc);
-        }
-        return 0;
-    }
-
-    return 1;
-}
-
 static void gen_goto_ptr(void)
 {
     tcg_gen_lookup_and_goto_ptr();
@@ -3048,13 +1789,10 @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
     }
 
     if ((s->hstr_active && s->current_el == 0) || ri->accessfn ||
-        (ri->fgt && s->fgt_active) ||
-        (arm_dc_feature(s, ARM_FEATURE_XSCALE) && cpnum < 14)) {
+        (ri->fgt && s->fgt_active)) {
         /*
          * Emit code to perform further access permissions checks at
          * runtime; this may result in an exception.
-         * Note that on XScale all cp0..c13 registers do an access check
-         * call in order to handle c15_cpar.
          */
         gen_set_condexec(s);
         gen_update_pc(s, 0);
@@ -3192,24 +1930,6 @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
     }
 }
 
-/* Decode XScale DSP or iWMMXt insn (in the copro space, cp=0 or 1) */
-static void disas_xscale_insn(DisasContext *s, uint32_t insn)
-{
-    int cpnum = (insn >> 8) & 0xf;
-
-    if (extract32(s->c15_cpar, cpnum, 1) == 0) {
-        unallocated_encoding(s);
-    } else if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
-        if (disas_iwmmxt_insn(s, insn)) {
-            unallocated_encoding(s);
-        }
-    } else if (arm_dc_feature(s, ARM_FEATURE_XSCALE)) {
-        if (disas_dsp_insn(s, insn)) {
-            unallocated_encoding(s);
-        }
-    }
-}
-
 /* Store a 64-bit value to a register pair.  Clobbers val.  */
 static void gen_storeq_reg(DisasContext *s, int rlow, int rhigh, TCGv_i64 val)
 {
@@ -3569,14 +2289,7 @@ static bool valid_cp(DisasContext *s, int cp)
      * only cp14 and cp15 are valid, and other values aren't considered
      * to be in the coprocessor-instruction space at all. v8M still
      * permits coprocessors 0..7.
-     * For XScale, we must not decode the XScale cp0, cp1 space as
-     * a standard coprocessor insn, because we want to fall through to
-     * the legacy disas_xscale_insn() decoder after decodetree is done.
      */
-    if (arm_dc_feature(s, ARM_FEATURE_XSCALE) && (cp == 0 || cp == 1)) {
-        return false;
-    }
-
     if (arm_dc_feature(s, ARM_FEATURE_V8) &&
         !arm_dc_feature(s, ARM_FEATURE_M)) {
         return cp >= 14;
@@ -7343,18 +6056,6 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
             disas_neon_shared(s, insn)) {
             return;
         }
-        /* fall back to legacy decoder */
-
-        if ((insn & 0x0e000f00) == 0x0c000100) {
-            if (arm_dc_feature(s, ARM_FEATURE_IWMMXT)) {
-                /* iWMMXt register transfer.  */
-                if (extract32(s->c15_cpar, 1, 1)) {
-                    if (!disas_iwmmxt_insn(s, insn)) {
-                        return;
-                    }
-                }
-            }
-        }
         goto illegal_op;
     }
     if (cond != 0xe) {
@@ -7368,16 +6069,7 @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         disas_vfp(s, insn)) {
         return;
     }
-    /* fall back to legacy decoder */
-    /* TODO: convert xscale/iwmmxt decoder to decodetree ?? */
-    if (arm_dc_feature(s, ARM_FEATURE_XSCALE)) {
-        if (((insn & 0x0c000e00) == 0x0c000000)
-            && ((insn & 0x03000000) != 0x03000000)) {
-            /* Coprocessor insn, coprocessor 0 or 1 */
-            disas_xscale_insn(s, insn);
-            return;
-        }
-    }
+    /* We didn't match anything in the decoder: UNDEF */
 
 illegal_op:
     unallocated_encoding(s);
@@ -7606,12 +6298,8 @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         dc->hstr_active = EX_TBFLAG_A32(tb_flags, HSTR_ACTIVE);
         dc->ns = EX_TBFLAG_A32(tb_flags, NS);
         dc->vfp_enabled = EX_TBFLAG_A32(tb_flags, VFPEN);
-        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-            dc->c15_cpar = EX_TBFLAG_A32(tb_flags, XSCALE_CPAR);
-        } else {
-            dc->vec_len = EX_TBFLAG_A32(tb_flags, VECLEN);
-            dc->vec_stride = EX_TBFLAG_A32(tb_flags, VECSTRIDE);
-        }
+        dc->vec_len = EX_TBFLAG_A32(tb_flags, VECLEN);
+        dc->vec_stride = EX_TBFLAG_A32(tb_flags, VECSTRIDE);
         dc->sme_trap_nonstreaming =
             EX_TBFLAG_A32(tb_flags, SME_TRAP_NONSTREAMING);
     }
@@ -7651,10 +6339,6 @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
         int bound = -(dc->base.pc_first | TARGET_PAGE_MASK) / 4;
         dc->base.max_insns = MIN(dc->base.max_insns, bound);
     }
-
-    cpu_V0 = tcg_temp_new_i64();
-    cpu_V1 = tcg_temp_new_i64();
-    cpu_M0 = tcg_temp_new_i64();
 }
 
 static void arm_tr_tb_start(DisasContextBase *dcbase, CPUState *cpu)
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index f974996f3f..ec4755ae3f 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -175,8 +175,6 @@ typedef struct DisasContext {
     uint8_t gm_blocksize;
     /* True if the current insn_start has been updated. */
     bool insn_start_updated;
-    /* Bottom two bits of XScale c15_cpar coprocessor access control reg */
-    int c15_cpar;
     /* Offset from VNCR_EL2 when FEAT_NV2 redirects this reg to memory */
     uint32_t nv2_redirect_offset;
 } DisasContext;

From 144aac11d6e0600f6dc644ad0d7e47110d8484f1 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 15:04:20 +0100
Subject: [PATCH 0418/2396] target/arm: Remove iwmmxt helper functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the iwmmxt helper functions which are no longer called now
that we have removed the associated translate.c handling.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250828140422.3271703-4-peter.maydell@linaro.org
---
 target/arm/tcg/helper.h        |  95 -----
 target/arm/tcg/iwmmxt_helper.c | 672 ---------------------------------
 target/arm/tcg/meson.build     |   2 -
 3 files changed, 769 deletions(-)
 delete mode 100644 target/arm/tcg/iwmmxt_helper.c

diff --git a/target/arm/tcg/helper.h b/target/arm/tcg/helper.h
index 4da32db902..4636d1bc03 100644
--- a/target/arm/tcg/helper.h
+++ b/target/arm/tcg/helper.h
@@ -444,101 +444,6 @@ DEF_HELPER_3(neon_acgt_f32, i32, i32, i32, fpst)
 DEF_HELPER_3(neon_acge_f64, i64, i64, i64, fpst)
 DEF_HELPER_3(neon_acgt_f64, i64, i64, i64, fpst)
 
-/* iwmmxt_helper.c */
-DEF_HELPER_2(iwmmxt_maddsq, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_madduq, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_sadb, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_sadw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mulslw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mulshw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_mululw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_muluhw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_macsw, i64, i64, i64)
-DEF_HELPER_2(iwmmxt_macuw, i64, i64, i64)
-DEF_HELPER_1(iwmmxt_setpsr_nz, i32, i64)
-
-#define DEF_IWMMXT_HELPER_SIZE_ENV(name) \
-DEF_HELPER_3(iwmmxt_##name##b, i64, env, i64, i64) \
-DEF_HELPER_3(iwmmxt_##name##w, i64, env, i64, i64) \
-DEF_HELPER_3(iwmmxt_##name##l, i64, env, i64, i64) \
-
-DEF_IWMMXT_HELPER_SIZE_ENV(unpackl)
-DEF_IWMMXT_HELPER_SIZE_ENV(unpackh)
-
-DEF_HELPER_2(iwmmxt_unpacklub, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackluw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklul, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhub, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhuw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhul, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsb, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpacklsl, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsb, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsw, i64, env, i64)
-DEF_HELPER_2(iwmmxt_unpackhsl, i64, env, i64)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpeq)
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpgtu)
-DEF_IWMMXT_HELPER_SIZE_ENV(cmpgts)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(mins)
-DEF_IWMMXT_HELPER_SIZE_ENV(minu)
-DEF_IWMMXT_HELPER_SIZE_ENV(maxs)
-DEF_IWMMXT_HELPER_SIZE_ENV(maxu)
-
-DEF_IWMMXT_HELPER_SIZE_ENV(subn)
-DEF_IWMMXT_HELPER_SIZE_ENV(addn)
-DEF_IWMMXT_HELPER_SIZE_ENV(subu)
-DEF_IWMMXT_HELPER_SIZE_ENV(addu)
-DEF_IWMMXT_HELPER_SIZE_ENV(subs)
-DEF_IWMMXT_HELPER_SIZE_ENV(adds)
-
-DEF_HELPER_3(iwmmxt_avgb0, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgb1, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgw0, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_avgw1, i64, env, i64, i64)
-
-DEF_HELPER_3(iwmmxt_align, i64, i64, i64, i32)
-DEF_HELPER_4(iwmmxt_insr, i64, i64, i32, i32, i32)
-
-DEF_HELPER_1(iwmmxt_bcstb, i64, i32)
-DEF_HELPER_1(iwmmxt_bcstw, i64, i32)
-DEF_HELPER_1(iwmmxt_bcstl, i64, i32)
-
-DEF_HELPER_1(iwmmxt_addcb, i64, i64)
-DEF_HELPER_1(iwmmxt_addcw, i64, i64)
-DEF_HELPER_1(iwmmxt_addcl, i64, i64)
-
-DEF_HELPER_1(iwmmxt_msbb, i32, i64)
-DEF_HELPER_1(iwmmxt_msbw, i32, i64)
-DEF_HELPER_1(iwmmxt_msbl, i32, i64)
-
-DEF_HELPER_3(iwmmxt_srlw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_srll, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_srlq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sllw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_slll, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sllq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sraw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sral, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_sraq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorw, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorl, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_rorq, i64, env, i64, i32)
-DEF_HELPER_3(iwmmxt_shufh, i64, env, i64, i32)
-
-DEF_HELPER_3(iwmmxt_packuw, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packul, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packuq, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsw, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsl, i64, env, i64, i64)
-DEF_HELPER_3(iwmmxt_packsq, i64, env, i64, i64)
-
-DEF_HELPER_3(iwmmxt_muladdsl, i64, i64, i32, i32)
-DEF_HELPER_3(iwmmxt_muladdsw, i64, i64, i32, i32)
-DEF_HELPER_3(iwmmxt_muladdswl, i64, i64, i32, i32)
-
 DEF_HELPER_FLAGS_2(neon_unzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
 DEF_HELPER_FLAGS_2(neon_unzip16, TCG_CALL_NO_RWG, void, ptr, ptr)
 DEF_HELPER_FLAGS_2(neon_qunzip8, TCG_CALL_NO_RWG, void, ptr, ptr)
diff --git a/target/arm/tcg/iwmmxt_helper.c b/target/arm/tcg/iwmmxt_helper.c
deleted file mode 100644
index ba054b6b4d..0000000000
--- a/target/arm/tcg/iwmmxt_helper.c
+++ /dev/null
@@ -1,672 +0,0 @@
-/*
- * iwMMXt micro operations for XScale.
- *
- * Copyright (c) 2007 OpenedHand, Ltd.
- * Written by Andrzej Zaborowski <andrew@openedhand.com>
- * Copyright (c) 2008 CodeSourcery
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- */
-
-#include "qemu/osdep.h"
-
-#include "cpu.h"
-
-#define HELPER_H "tcg/helper.h"
-#include "exec/helper-proto.h.inc"
-
-/* iwMMXt macros extracted from GNU gdb.  */
-
-/* Set the SIMD wCASF flags for 8, 16, 32 or 64-bit operations.  */
-#define SIMD8_SET(v, n, b)      ((v != 0) << ((((b) + 1) * 4) + (n)))
-#define SIMD16_SET(v, n, h)     ((v != 0) << ((((h) + 1) * 8) + (n)))
-#define SIMD32_SET(v, n, w)     ((v != 0) << ((((w) + 1) * 16) + (n)))
-#define SIMD64_SET(v, n)        ((v != 0) << (32 + (n)))
-/* Flags to pass as "n" above.  */
-#define SIMD_NBIT       -1
-#define SIMD_ZBIT       -2
-#define SIMD_CBIT       -3
-#define SIMD_VBIT       -4
-/* Various status bit macros.  */
-#define NBIT8(x)        ((x) & 0x80)
-#define NBIT16(x)       ((x) & 0x8000)
-#define NBIT32(x)       ((x) & 0x80000000)
-#define NBIT64(x)       ((x) & 0x8000000000000000ULL)
-#define ZBIT8(x)        (((x) & 0xff) == 0)
-#define ZBIT16(x)       (((x) & 0xffff) == 0)
-#define ZBIT32(x)       (((x) & 0xffffffff) == 0)
-#define ZBIT64(x)       (x == 0)
-/* Sign extension macros.  */
-#define EXTEND8H(a)     ((uint16_t) (int8_t) (a))
-#define EXTEND8(a)      ((uint32_t) (int8_t) (a))
-#define EXTEND16(a)     ((uint32_t) (int16_t) (a))
-#define EXTEND16S(a)    ((int32_t) (int16_t) (a))
-#define EXTEND32(a)     ((uint64_t) (int32_t) (a))
-
-uint64_t HELPER(iwmmxt_maddsq)(uint64_t a, uint64_t b)
-{
-    a = ((
-            EXTEND16S((a >> 0) & 0xffff) * EXTEND16S((b >> 0) & 0xffff) +
-            EXTEND16S((a >> 16) & 0xffff) * EXTEND16S((b >> 16) & 0xffff)
-        ) & 0xffffffff) | ((uint64_t) (
-            EXTEND16S((a >> 32) & 0xffff) * EXTEND16S((b >> 32) & 0xffff) +
-            EXTEND16S((a >> 48) & 0xffff) * EXTEND16S((b >> 48) & 0xffff)
-        ) << 32);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_madduq)(uint64_t a, uint64_t b)
-{
-    a = ((
-            ((a >> 0) & 0xffff) * ((b >> 0) & 0xffff) +
-            ((a >> 16) & 0xffff) * ((b >> 16) & 0xffff)
-        ) & 0xffffffff) | ((
-            ((a >> 32) & 0xffff) * ((b >> 32) & 0xffff) +
-            ((a >> 48) & 0xffff) * ((b >> 48) & 0xffff)
-        ) << 32);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_sadb)(uint64_t a, uint64_t b)
-{
-#define abs(x) (((x) >= 0) ? x : -x)
-#define SADB(SHR) abs((int) ((a >> SHR) & 0xff) - (int) ((b >> SHR) & 0xff))
-    return
-        SADB(0) + SADB(8) + SADB(16) + SADB(24) +
-        SADB(32) + SADB(40) + SADB(48) + SADB(56);
-#undef SADB
-}
-
-uint64_t HELPER(iwmmxt_sadw)(uint64_t a, uint64_t b)
-{
-#define SADW(SHR) \
-    abs((int) ((a >> SHR) & 0xffff) - (int) ((b >> SHR) & 0xffff))
-    return SADW(0) + SADW(16) + SADW(32) + SADW(48);
-#undef SADW
-}
-
-uint64_t HELPER(iwmmxt_mulslw)(uint64_t a, uint64_t b)
-{
-#define MULS(SHR) ((uint64_t) ((( \
-        EXTEND16S((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff) \
-    ) >> 0) & 0xffff) << SHR)
-    return MULS(0) | MULS(16) | MULS(32) | MULS(48);
-#undef MULS
-}
-
-uint64_t HELPER(iwmmxt_mulshw)(uint64_t a, uint64_t b)
-{
-#define MULS(SHR) ((uint64_t) ((( \
-        EXTEND16S((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff) \
-    ) >> 16) & 0xffff) << SHR)
-    return MULS(0) | MULS(16) | MULS(32) | MULS(48);
-#undef MULS
-}
-
-uint64_t HELPER(iwmmxt_mululw)(uint64_t a, uint64_t b)
-{
-#define MULU(SHR) ((uint64_t) ((( \
-        ((a >> SHR) & 0xffff) * ((b >> SHR) & 0xffff) \
-    ) >> 0) & 0xffff) << SHR)
-    return MULU(0) | MULU(16) | MULU(32) | MULU(48);
-#undef MULU
-}
-
-uint64_t HELPER(iwmmxt_muluhw)(uint64_t a, uint64_t b)
-{
-#define MULU(SHR) ((uint64_t) ((( \
-        ((a >> SHR) & 0xffff) * ((b >> SHR) & 0xffff) \
-    ) >> 16) & 0xffff) << SHR)
-    return MULU(0) | MULU(16) | MULU(32) | MULU(48);
-#undef MULU
-}
-
-uint64_t HELPER(iwmmxt_macsw)(uint64_t a, uint64_t b)
-{
-#define MACS(SHR) ( \
-        EXTEND16((a >> SHR) & 0xffff) * EXTEND16S((b >> SHR) & 0xffff))
-    return (int64_t) (MACS(0) + MACS(16) + MACS(32) + MACS(48));
-#undef MACS
-}
-
-uint64_t HELPER(iwmmxt_macuw)(uint64_t a, uint64_t b)
-{
-#define MACU(SHR) ( \
-        (uint32_t) ((a >> SHR) & 0xffff) * \
-        (uint32_t) ((b >> SHR) & 0xffff))
-    return MACU(0) + MACU(16) + MACU(32) + MACU(48);
-#undef MACU
-}
-
-#define NZBIT8(x, i) \
-    SIMD8_SET(NBIT8((x) & 0xff), SIMD_NBIT, i) | \
-    SIMD8_SET(ZBIT8((x) & 0xff), SIMD_ZBIT, i)
-#define NZBIT16(x, i) \
-    SIMD16_SET(NBIT16((x) & 0xffff), SIMD_NBIT, i) | \
-    SIMD16_SET(ZBIT16((x) & 0xffff), SIMD_ZBIT, i)
-#define NZBIT32(x, i) \
-    SIMD32_SET(NBIT32((x) & 0xffffffff), SIMD_NBIT, i) | \
-    SIMD32_SET(ZBIT32((x) & 0xffffffff), SIMD_ZBIT, i)
-#define NZBIT64(x) \
-    SIMD64_SET(NBIT64(x), SIMD_NBIT) | \
-    SIMD64_SET(ZBIT64(x), SIMD_ZBIT)
-#define IWMMXT_OP_UNPACK(S, SH0, SH1, SH2, SH3)                         \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, b)))(CPUARMState *env, \
-                                                 uint64_t a, uint64_t b) \
-{                                                               \
-    a =                                                                 \
-        (((a >> SH0) & 0xff) << 0) | (((b >> SH0) & 0xff) << 8) |       \
-        (((a >> SH1) & 0xff) << 16) | (((b >> SH1) & 0xff) << 24) |     \
-        (((a >> SH2) & 0xff) << 32) | (((b >> SH2) & 0xff) << 40) |     \
-        (((a >> SH3) & 0xff) << 48) | (((b >> SH3) & 0xff) << 56);      \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |                         \
-        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |               \
-        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |               \
-        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);                \
-    return a;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, w)))(CPUARMState *env, \
-                                        uint64_t a, uint64_t b) \
-{                                                               \
-    a =                                                                 \
-        (((a >> SH0) & 0xffff) << 0) |                          \
-        (((b >> SH0) & 0xffff) << 16) |                                 \
-        (((a >> SH2) & 0xffff) << 32) |                                 \
-        (((b >> SH2) & 0xffff) << 48);                          \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT8(a >> 0, 0) | NZBIT8(a >> 16, 1) |                \
-        NZBIT8(a >> 32, 2) | NZBIT8(a >> 48, 3);                \
-    return a;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, l)))(CPUARMState *env, \
-                                        uint64_t a, uint64_t b) \
-{                                                               \
-    a =                                                                 \
-        (((a >> SH0) & 0xffffffff) << 0) |                      \
-        (((b >> SH0) & 0xffffffff) << 32);                      \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);               \
-    return a;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, ub)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x =                                                                 \
-        (((x >> SH0) & 0xff) << 0) |                            \
-        (((x >> SH1) & 0xff) << 16) |                           \
-        (((x >> SH2) & 0xff) << 32) |                           \
-        (((x >> SH3) & 0xff) << 48);                            \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |              \
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);              \
-    return x;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, uw)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x =                                                                 \
-        (((x >> SH0) & 0xffff) << 0) |                          \
-        (((x >> SH2) & 0xffff) << 32);                          \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);               \
-    return x;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, ul)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x = (((x >> SH0) & 0xffffffff) << 0);                       \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x >> 0);      \
-    return x;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sb)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x =                                                                 \
-        ((uint64_t) EXTEND8H((x >> SH0) & 0xff) << 0) |                 \
-        ((uint64_t) EXTEND8H((x >> SH1) & 0xff) << 16) |        \
-        ((uint64_t) EXTEND8H((x >> SH2) & 0xff) << 32) |        \
-        ((uint64_t) EXTEND8H((x >> SH3) & 0xff) << 48);                 \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |              \
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);              \
-    return x;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sw)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x =                                                                 \
-        ((uint64_t) EXTEND16((x >> SH0) & 0xffff) << 0) |       \
-        ((uint64_t) EXTEND16((x >> SH2) & 0xffff) << 32);       \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);               \
-    return x;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_unpack, glue(S, sl)))(CPUARMState *env, \
-                                                  uint64_t x)   \
-{                                                               \
-    x = EXTEND32((x >> SH0) & 0xffffffff);                      \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x >> 0);      \
-    return x;                                                   \
-}
-IWMMXT_OP_UNPACK(l, 0, 8, 16, 24)
-IWMMXT_OP_UNPACK(h, 32, 40, 48, 56)
-
-#define IWMMXT_OP_CMP(SUFF, Tb, Tw, Tl, O)                      \
-uint64_t HELPER(glue(iwmmxt_, glue(SUFF, b)))(CPUARMState *env,    \
-                                        uint64_t a, uint64_t b) \
-{                                                               \
-    a =                                                                 \
-        CMP(0, Tb, O, 0xff) | CMP(8, Tb, O, 0xff) |             \
-        CMP(16, Tb, O, 0xff) | CMP(24, Tb, O, 0xff) |           \
-        CMP(32, Tb, O, 0xff) | CMP(40, Tb, O, 0xff) |           \
-        CMP(48, Tb, O, 0xff) | CMP(56, Tb, O, 0xff);            \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |                         \
-        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |               \
-        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |               \
-        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);                \
-    return a;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_, glue(SUFF, w)))(CPUARMState *env,    \
-                                        uint64_t a, uint64_t b) \
-{                                                               \
-    a = CMP(0, Tw, O, 0xffff) | CMP(16, Tw, O, 0xffff) |        \
-        CMP(32, Tw, O, 0xffff) | CMP(48, Tw, O, 0xffff);        \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |              \
-        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);              \
-    return a;                                                   \
-}                                                               \
-uint64_t HELPER(glue(iwmmxt_, glue(SUFF, l)))(CPUARMState *env,    \
-                                        uint64_t a, uint64_t b) \
-{                                                               \
-    a = CMP(0, Tl, O, 0xffffffff) |                             \
-        CMP(32, Tl, O, 0xffffffff);                             \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                       \
-        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);               \
-    return a;                                                   \
-}
-#define CMP(SHR, TYPE, OPER, MASK) ((((TYPE) ((a >> SHR) & MASK) OPER \
-            (TYPE) ((b >> SHR) & MASK)) ? (uint64_t) MASK : 0) << SHR)
-IWMMXT_OP_CMP(cmpeq, uint8_t, uint16_t, uint32_t, ==)
-IWMMXT_OP_CMP(cmpgts, int8_t, int16_t, int32_t, >)
-IWMMXT_OP_CMP(cmpgtu, uint8_t, uint16_t, uint32_t, >)
-#undef CMP
-#define CMP(SHR, TYPE, OPER, MASK) ((((TYPE) ((a >> SHR) & MASK) OPER \
-            (TYPE) ((b >> SHR) & MASK)) ? a : b) & ((uint64_t) MASK << SHR))
-IWMMXT_OP_CMP(mins, int8_t, int16_t, int32_t, <)
-IWMMXT_OP_CMP(minu, uint8_t, uint16_t, uint32_t, <)
-IWMMXT_OP_CMP(maxs, int8_t, int16_t, int32_t, >)
-IWMMXT_OP_CMP(maxu, uint8_t, uint16_t, uint32_t, >)
-#undef CMP
-#define CMP(SHR, TYPE, OPER, MASK) ((uint64_t) (((TYPE) ((a >> SHR) & MASK) \
-            OPER (TYPE) ((b >> SHR) & MASK)) & MASK) << SHR)
-IWMMXT_OP_CMP(subn, uint8_t, uint16_t, uint32_t, -)
-IWMMXT_OP_CMP(addn, uint8_t, uint16_t, uint32_t, +)
-#undef CMP
-/* TODO Signed- and Unsigned-Saturation */
-#define CMP(SHR, TYPE, OPER, MASK) ((uint64_t) (((TYPE) ((a >> SHR) & MASK) \
-            OPER (TYPE) ((b >> SHR) & MASK)) & MASK) << SHR)
-IWMMXT_OP_CMP(subu, uint8_t, uint16_t, uint32_t, -)
-IWMMXT_OP_CMP(addu, uint8_t, uint16_t, uint32_t, +)
-IWMMXT_OP_CMP(subs, int8_t, int16_t, int32_t, -)
-IWMMXT_OP_CMP(adds, int8_t, int16_t, int32_t, +)
-#undef CMP
-#undef IWMMXT_OP_CMP
-
-#define AVGB(SHR) ((( \
-        ((a >> SHR) & 0xff) + ((b >> SHR) & 0xff) + round) >> 1) << SHR)
-#define IWMMXT_OP_AVGB(r)                                                 \
-uint64_t HELPER(iwmmxt_avgb##r)(CPUARMState *env, uint64_t a, uint64_t b)    \
-{                                                                         \
-    const int round = r;                                                  \
-    a = AVGB(0) | AVGB(8) | AVGB(16) | AVGB(24) |                         \
-        AVGB(32) | AVGB(40) | AVGB(48) | AVGB(56);                        \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                                 \
-        SIMD8_SET(ZBIT8((a >> 0) & 0xff), SIMD_ZBIT, 0) |                 \
-        SIMD8_SET(ZBIT8((a >> 8) & 0xff), SIMD_ZBIT, 1) |                 \
-        SIMD8_SET(ZBIT8((a >> 16) & 0xff), SIMD_ZBIT, 2) |                \
-        SIMD8_SET(ZBIT8((a >> 24) & 0xff), SIMD_ZBIT, 3) |                \
-        SIMD8_SET(ZBIT8((a >> 32) & 0xff), SIMD_ZBIT, 4) |                \
-        SIMD8_SET(ZBIT8((a >> 40) & 0xff), SIMD_ZBIT, 5) |                \
-        SIMD8_SET(ZBIT8((a >> 48) & 0xff), SIMD_ZBIT, 6) |                \
-        SIMD8_SET(ZBIT8((a >> 56) & 0xff), SIMD_ZBIT, 7);                 \
-    return a;                                                             \
-}
-IWMMXT_OP_AVGB(0)
-IWMMXT_OP_AVGB(1)
-#undef IWMMXT_OP_AVGB
-#undef AVGB
-
-#define AVGW(SHR) ((( \
-        ((a >> SHR) & 0xffff) + ((b >> SHR) & 0xffff) + round) >> 1) << SHR)
-#define IWMMXT_OP_AVGW(r)                                               \
-uint64_t HELPER(iwmmxt_avgw##r)(CPUARMState *env, uint64_t a, uint64_t b)  \
-{                                                                       \
-    const int round = r;                                                \
-    a = AVGW(0) | AVGW(16) | AVGW(32) | AVGW(48);                       \
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =                               \
-        SIMD16_SET(ZBIT16((a >> 0) & 0xffff), SIMD_ZBIT, 0) |           \
-        SIMD16_SET(ZBIT16((a >> 16) & 0xffff), SIMD_ZBIT, 1) |          \
-        SIMD16_SET(ZBIT16((a >> 32) & 0xffff), SIMD_ZBIT, 2) |          \
-        SIMD16_SET(ZBIT16((a >> 48) & 0xffff), SIMD_ZBIT, 3);           \
-    return a;                                                           \
-}
-IWMMXT_OP_AVGW(0)
-IWMMXT_OP_AVGW(1)
-#undef IWMMXT_OP_AVGW
-#undef AVGW
-
-uint64_t HELPER(iwmmxt_align)(uint64_t a, uint64_t b, uint32_t n)
-{
-    a >>= n << 3;
-    a |= b << (64 - (n << 3));
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_insr)(uint64_t x, uint32_t a, uint32_t b, uint32_t n)
-{
-    x &= ~((uint64_t) b << n);
-    x |= (uint64_t) (a & b) << n;
-    return x;
-}
-
-uint32_t HELPER(iwmmxt_setpsr_nz)(uint64_t x)
-{
-    return SIMD64_SET((x == 0), SIMD_ZBIT) |
-           SIMD64_SET((x & (1ULL << 63)), SIMD_NBIT);
-}
-
-uint64_t HELPER(iwmmxt_bcstb)(uint32_t arg)
-{
-    arg &= 0xff;
-    return
-        ((uint64_t) arg << 0 ) | ((uint64_t) arg << 8 ) |
-        ((uint64_t) arg << 16) | ((uint64_t) arg << 24) |
-        ((uint64_t) arg << 32) | ((uint64_t) arg << 40) |
-        ((uint64_t) arg << 48) | ((uint64_t) arg << 56);
-}
-
-uint64_t HELPER(iwmmxt_bcstw)(uint32_t arg)
-{
-    arg &= 0xffff;
-    return
-        ((uint64_t) arg << 0 ) | ((uint64_t) arg << 16) |
-        ((uint64_t) arg << 32) | ((uint64_t) arg << 48);
-}
-
-uint64_t HELPER(iwmmxt_bcstl)(uint32_t arg)
-{
-    return arg | ((uint64_t) arg << 32);
-}
-
-uint64_t HELPER(iwmmxt_addcb)(uint64_t x)
-{
-    return
-        ((x >> 0) & 0xff) + ((x >> 8) & 0xff) +
-        ((x >> 16) & 0xff) + ((x >> 24) & 0xff) +
-        ((x >> 32) & 0xff) + ((x >> 40) & 0xff) +
-        ((x >> 48) & 0xff) + ((x >> 56) & 0xff);
-}
-
-uint64_t HELPER(iwmmxt_addcw)(uint64_t x)
-{
-    return
-        ((x >> 0) & 0xffff) + ((x >> 16) & 0xffff) +
-        ((x >> 32) & 0xffff) + ((x >> 48) & 0xffff);
-}
-
-uint64_t HELPER(iwmmxt_addcl)(uint64_t x)
-{
-    return (x & 0xffffffff) + (x >> 32);
-}
-
-uint32_t HELPER(iwmmxt_msbb)(uint64_t x)
-{
-    return
-        ((x >> 7) & 0x01) | ((x >> 14) & 0x02) |
-        ((x >> 21) & 0x04) | ((x >> 28) & 0x08) |
-        ((x >> 35) & 0x10) | ((x >> 42) & 0x20) |
-        ((x >> 49) & 0x40) | ((x >> 56) & 0x80);
-}
-
-uint32_t HELPER(iwmmxt_msbw)(uint64_t x)
-{
-    return
-        ((x >> 15) & 0x01) | ((x >> 30) & 0x02) |
-        ((x >> 45) & 0x04) | ((x >> 52) & 0x08);
-}
-
-uint32_t HELPER(iwmmxt_msbl)(uint64_t x)
-{
-    return ((x >> 31) & 0x01) | ((x >> 62) & 0x02);
-}
-
-/* FIXME: Split wCASF setting into a separate op to avoid env use.  */
-uint64_t HELPER(iwmmxt_srlw)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = (((x & (0xffffll << 0)) >> n) & (0xffffll << 0)) |
-        (((x & (0xffffll << 16)) >> n) & (0xffffll << 16)) |
-        (((x & (0xffffll << 32)) >> n) & (0xffffll << 32)) |
-        (((x & (0xffffll << 48)) >> n) & (0xffffll << 48));
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_srll)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ((x & (0xffffffffll << 0)) >> n) |
-        ((x >> n) & (0xffffffffll << 32));
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_srlq)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x >>= n;
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_sllw)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = (((x & (0xffffll << 0)) << n) & (0xffffll << 0)) |
-        (((x & (0xffffll << 16)) << n) & (0xffffll << 16)) |
-        (((x & (0xffffll << 32)) << n) & (0xffffll << 32)) |
-        (((x & (0xffffll << 48)) << n) & (0xffffll << 48));
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_slll)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ((x << n) & (0xffffffffll << 0)) |
-        ((x & (0xffffffffll << 32)) << n);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_sllq)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x <<= n;
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_sraw)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ((uint64_t) ((EXTEND16(x >> 0) >> n) & 0xffff) << 0) |
-        ((uint64_t) ((EXTEND16(x >> 16) >> n) & 0xffff) << 16) |
-        ((uint64_t) ((EXTEND16(x >> 32) >> n) & 0xffff) << 32) |
-        ((uint64_t) ((EXTEND16(x >> 48) >> n) & 0xffff) << 48);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_sral)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = (((EXTEND32(x >> 0) >> n) & 0xffffffff) << 0) |
-        (((EXTEND32(x >> 32) >> n) & 0xffffffff) << 32);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_sraq)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = (int64_t) x >> n;
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_rorw)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ((((x & (0xffffll << 0)) >> n) |
-          ((x & (0xffffll << 0)) << (16 - n))) & (0xffffll << 0)) |
-        ((((x & (0xffffll << 16)) >> n) |
-          ((x & (0xffffll << 16)) << (16 - n))) & (0xffffll << 16)) |
-        ((((x & (0xffffll << 32)) >> n) |
-          ((x & (0xffffll << 32)) << (16 - n))) & (0xffffll << 32)) |
-        ((((x & (0xffffll << 48)) >> n) |
-          ((x & (0xffffll << 48)) << (16 - n))) & (0xffffll << 48));
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_rorl)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ((x & (0xffffffffll << 0)) >> n) |
-        ((x >> n) & (0xffffffffll << 32)) |
-        ((x << (32 - n)) & (0xffffffffll << 0)) |
-        ((x & (0xffffffffll << 32)) << (32 - n));
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(x >> 0, 0) | NZBIT32(x >> 32, 1);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_rorq)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = ror64(x, n);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] = NZBIT64(x);
-    return x;
-}
-
-uint64_t HELPER(iwmmxt_shufh)(CPUARMState *env, uint64_t x, uint32_t n)
-{
-    x = (((x >> ((n << 4) & 0x30)) & 0xffff) << 0) |
-        (((x >> ((n << 2) & 0x30)) & 0xffff) << 16) |
-        (((x >> ((n << 0) & 0x30)) & 0xffff) << 32) |
-        (((x >> ((n >> 2) & 0x30)) & 0xffff) << 48);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(x >> 0, 0) | NZBIT16(x >> 16, 1) |
-        NZBIT16(x >> 32, 2) | NZBIT16(x >> 48, 3);
-    return x;
-}
-
-/* TODO: Unsigned-Saturation */
-uint64_t HELPER(iwmmxt_packuw)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (((a >> 0) & 0xff) << 0) | (((a >> 16) & 0xff) << 8) |
-        (((a >> 32) & 0xff) << 16) | (((a >> 48) & 0xff) << 24) |
-        (((b >> 0) & 0xff) << 32) | (((b >> 16) & 0xff) << 40) |
-        (((b >> 32) & 0xff) << 48) | (((b >> 48) & 0xff) << 56);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |
-        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |
-        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |
-        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_packul)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (((a >> 0) & 0xffff) << 0) | (((a >> 32) & 0xffff) << 16) |
-        (((b >> 0) & 0xffff) << 32) | (((b >> 32) & 0xffff) << 48);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |
-        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_packuq)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (a & 0xffffffff) | ((b & 0xffffffff) << 32);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);
-    return a;
-}
-
-/* TODO: Signed-Saturation */
-uint64_t HELPER(iwmmxt_packsw)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (((a >> 0) & 0xff) << 0) | (((a >> 16) & 0xff) << 8) |
-        (((a >> 32) & 0xff) << 16) | (((a >> 48) & 0xff) << 24) |
-        (((b >> 0) & 0xff) << 32) | (((b >> 16) & 0xff) << 40) |
-        (((b >> 32) & 0xff) << 48) | (((b >> 48) & 0xff) << 56);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT8(a >> 0, 0) | NZBIT8(a >> 8, 1) |
-        NZBIT8(a >> 16, 2) | NZBIT8(a >> 24, 3) |
-        NZBIT8(a >> 32, 4) | NZBIT8(a >> 40, 5) |
-        NZBIT8(a >> 48, 6) | NZBIT8(a >> 56, 7);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_packsl)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (((a >> 0) & 0xffff) << 0) | (((a >> 32) & 0xffff) << 16) |
-        (((b >> 0) & 0xffff) << 32) | (((b >> 32) & 0xffff) << 48);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT16(a >> 0, 0) | NZBIT16(a >> 16, 1) |
-        NZBIT16(a >> 32, 2) | NZBIT16(a >> 48, 3);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_packsq)(CPUARMState *env, uint64_t a, uint64_t b)
-{
-    a = (a & 0xffffffff) | ((b & 0xffffffff) << 32);
-    env->iwmmxt.cregs[ARM_IWMMXT_wCASF] =
-        NZBIT32(a >> 0, 0) | NZBIT32(a >> 32, 1);
-    return a;
-}
-
-uint64_t HELPER(iwmmxt_muladdsl)(uint64_t c, uint32_t a, uint32_t b)
-{
-    return c + ((int32_t) EXTEND32(a) * (int32_t) EXTEND32(b));
-}
-
-uint64_t HELPER(iwmmxt_muladdsw)(uint64_t c, uint32_t a, uint32_t b)
-{
-    c += EXTEND32(EXTEND16S((a >> 0) & 0xffff) *
-                  EXTEND16S((b >> 0) & 0xffff));
-    c += EXTEND32(EXTEND16S((a >> 16) & 0xffff) *
-                  EXTEND16S((b >> 16) & 0xffff));
-    return c;
-}
-
-uint64_t HELPER(iwmmxt_muladdswl)(uint64_t c, uint32_t a, uint32_t b)
-{
-    return c + (EXTEND32(EXTEND16S(a & 0xffff) *
-                         EXTEND16S(b & 0xffff)));
-}
diff --git a/target/arm/tcg/meson.build b/target/arm/tcg/meson.build
index 895facdc30..1b115656c4 100644
--- a/target/arm/tcg/meson.build
+++ b/target/arm/tcg/meson.build
@@ -66,7 +66,6 @@ arm_common_ss.add(files(
 arm_common_system_ss.add(files(
   'cpregs-at.c',
   'hflags.c',
-  'iwmmxt_helper.c',
   'neon_helper.c',
   'tlb_helper.c',
   'tlb-insns.c',
@@ -74,7 +73,6 @@ arm_common_system_ss.add(files(
 ))
 arm_user_ss.add(files(
   'hflags.c',
-  'iwmmxt_helper.c',
   'neon_helper.c',
   'tlb_helper.c',
   'vfp_helper.c',

From 4f0fa4bfd98f3ccdcdeed6f43a2340084a6e0a92 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 15:04:21 +0100
Subject: [PATCH 0419/2396] target/arm: Drop ARM_FEATURE_XSCALE handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have now removed all the CPU types which had the Intel XScale
extensions indicated via ARM_FEATURE_XSCALE, so this feature bit
is never set. Remove all the code that can only be reached when
using this flag.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250828140422.3271703-5-peter.maydell@linaro.org
---
 target/arm/cpu.c           | 13 ---------
 target/arm/cpu.h           |  3 ---
 target/arm/helper.c        | 54 --------------------------------------
 target/arm/ptw.c           |  7 +++--
 target/arm/tcg/op_helper.c |  6 -----
 5 files changed, 3 insertions(+), 80 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index d0f6fcdfce..9781055bdc 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -349,11 +349,6 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     env->uncached_cpsr = ARM_CPU_MODE_USR;
     /* For user mode we must enable access to coprocessors */
     env->vfp.xregs[ARM_VFP_FPEXC] = 1 << 30;
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        env->cp15.c15_cpar = 3;
-    } else if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-        env->cp15.c15_cpar = 1;
-    }
 #else
 
     /*
@@ -2259,14 +2254,6 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
 
-    /*
-     * We rely on no XScale CPU having VFP so we can use the same bits in the
-     * TB flags field for VECSTRIDE and XSCALE_CPAR.
-     */
-    assert(arm_feature(env, ARM_FEATURE_AARCH64) ||
-           !cpu_isar_feature(aa32_vfp_simd, cpu) ||
-           !arm_feature(env, ARM_FEATURE_XSCALE));
-
 #ifndef CONFIG_USER_ONLY
     {
         int pagebits;
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index f56fa6df8d..92fcb96671 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -341,7 +341,6 @@ typedef struct CPUArchState {
         uint64_t vsctlr; /* Virtualization System control register. */
         uint64_t cpacr_el1; /* Architectural feature access control register */
         uint64_t cptr_el[4];  /* ARMv8 feature trap registers */
-        uint32_t c1_xscaleauxcr; /* XScale auxiliary control register.  */
         uint64_t sder; /* Secure debug enable register. */
         uint32_t nsacr; /* Non-secure access control register. */
         union { /* MMU translation table base 0. */
@@ -513,7 +512,6 @@ typedef struct CPUArchState {
         uint64_t cntvoff_el2; /* Counter Virtual Offset register */
         uint64_t cntpoff_el2; /* Counter Physical Offset register */
         ARMGenericTimer c14_timer[NUM_GTIMERS];
-        uint32_t c15_cpar; /* XScale Coprocessor Access Register */
         uint32_t c15_ticonfig; /* TI925T configuration byte.  */
         uint32_t c15_i_max; /* Maximum D-cache dirty line index.  */
         uint32_t c15_i_min; /* Minimum D-cache dirty line index.  */
@@ -2444,7 +2442,6 @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
  */
 enum arm_features {
     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
-    ARM_FEATURE_XSCALE, /* Intel XScale extensions.  */
     ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
     ARM_FEATURE_V6,
     ARM_FEATURE_V6K,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b641229ba0..fa8dfac299 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2923,39 +2923,6 @@ static const ARMCPRegInfo omap_cp_reginfo[] = {
       .type = ARM_CP_CONST | ARM_CP_OVERRIDE, .resetvalue = 0 },
 };
 
-static void xscale_cpar_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint64_t value)
-{
-    env->cp15.c15_cpar = value & 0x3fff;
-}
-
-static const ARMCPRegInfo xscale_cp_reginfo[] = {
-    { .name = "XSCALE_CPAR",
-      .cp = 15, .crn = 15, .crm = 1, .opc1 = 0, .opc2 = 0, .access = PL1_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c15_cpar), .resetvalue = 0,
-      .writefn = xscale_cpar_write, },
-    { .name = "XSCALE_AUXCR",
-      .cp = 15, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 1, .access = PL1_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.c1_xscaleauxcr),
-      .resetvalue = 0, },
-    /*
-     * XScale specific cache-lockdown: since we have no cache we NOP these
-     * and hope the guest does not really rely on cache behaviour.
-     */
-    { .name = "XSCALE_LOCK_ICACHE_LINE",
-      .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 0,
-      .access = PL1_W, .type = ARM_CP_NOP },
-    { .name = "XSCALE_UNLOCK_ICACHE",
-      .cp = 15, .opc1 = 0, .crn = 9, .crm = 1, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NOP },
-    { .name = "XSCALE_DCACHE_LOCK",
-      .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_NOP },
-    { .name = "XSCALE_UNLOCK_DCACHE",
-      .cp = 15, .opc1 = 0, .crn = 9, .crm = 2, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NOP },
-};
-
 static const ARMCPRegInfo dummy_c15_cp_reginfo[] = {
     /*
      * RAZ/WI the whole crn=15 space, when we don't have a more specific
@@ -3346,16 +3313,6 @@ static void sctlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
     /* This may enable/disable the MMU, so do a TLB flush.  */
     tlb_flush(CPU(cpu));
-
-    if (tcg_enabled() && ri->type & ARM_CP_SUPPRESS_TB_END) {
-        /*
-         * Normally we would always end the TB on an SCTLR write; see the
-         * comment in ARMCPRegInfo sctlr initialization below for why Xscale
-         * is special.  Setting ARM_CP_SUPPRESS_TB_END also stops the rebuild
-         * of hflags from the translator, so do it here.
-         */
-        arm_rebuild_hflags(env);
-    }
 }
 
 static void mdcr_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -6894,9 +6851,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (arm_feature(env, ARM_FEATURE_STRONGARM)) {
         define_arm_cp_regs(cpu, strongarm_cp_reginfo);
     }
-    if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-        define_arm_cp_regs(cpu, xscale_cp_reginfo);
-    }
     if (arm_feature(env, ARM_FEATURE_DUMMY_C15_REGS)) {
         define_arm_cp_regs(cpu, dummy_c15_cp_reginfo);
     }
@@ -7245,14 +7199,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             .writefn = sctlr_write, .resetvalue = cpu->reset_sctlr,
             .raw_writefn = raw_write,
         };
-        if (arm_feature(env, ARM_FEATURE_XSCALE)) {
-            /*
-             * Normally we would always end the TB on an SCTLR write, but Linux
-             * arch/arm/mach-pxa/sleep.S expects two instructions following
-             * an MMU enable to execute from cache.  Imitate this behaviour.
-             */
-            sctlr.type |= ARM_CP_SUPPRESS_TB_END;
-        }
         define_one_arm_cp_reg(cpu, &sctlr);
 
         if (arm_feature(env, ARM_FEATURE_PMSA) &&
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 089eeff845..6344971fa6 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1074,11 +1074,10 @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
             ap = (desc >> (4 + ((address >> 9) & 6))) & 3;
             result->f.lg_page_size = 12;
             break;
-        case 3: /* 1k page, or ARMv6/XScale "extended small (4k) page" */
+        case 3: /* 1k page, or ARMv6 "extended small (4k) page" */
             if (type == 1) {
-                /* ARMv6/XScale extended small page format */
-                if (arm_feature(env, ARM_FEATURE_XSCALE)
-                    || arm_feature(env, ARM_FEATURE_V6)) {
+                /* ARMv6 extended small page format */
+                if (arm_feature(env, ARM_FEATURE_V6)) {
                     phys_addr = (desc & 0xfffff000) | (address & 0xfff);
                     result->f.lg_page_size = 12;
                 } else {
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index 575e566280..5373e0e998 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -768,12 +768,6 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key,
 
     assert(ri != NULL);
 
-    if (arm_feature(env, ARM_FEATURE_XSCALE) && ri->cp < 14
-        && extract32(env->cp15.c15_cpar, ri->cp, 1) == 0) {
-        res = CP_ACCESS_UNDEFINED;
-        goto fail;
-    }
-
     if (ri->accessfn) {
         res = ri->accessfn(env, ri, isread);
     }

From effe47ff4840860811e2e1cccfd60cb1cea8e459 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 15:04:22 +0100
Subject: [PATCH 0420/2396] target/arm: Drop ARM_FEATURE_IWMMXT handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have now removed all the CPU types which had the Intel XScale
extensions indicated via ARM_FEATURE_IWMMXT, so this feature bit
is never set. Remove all the code that can only be reached when
using this flag.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250828140422.3271703-6-peter.maydell@linaro.org
---
 bsd-user/arm/target_arch_elf.h |  1 -
 linux-user/arm/elfload.c       |  1 -
 linux-user/arm/signal.c        | 67 ----------------------------------
 target/arm/cpu.c               |  8 ----
 target/arm/cpu.h               | 19 ----------
 target/arm/machine.c           | 21 -----------
 6 files changed, 117 deletions(-)

diff --git a/bsd-user/arm/target_arch_elf.h b/bsd-user/arm/target_arch_elf.h
index b1c0fd2b32..b54bf5fbc6 100644
--- a/bsd-user/arm/target_arch_elf.h
+++ b/bsd-user/arm/target_arch_elf.h
@@ -86,7 +86,6 @@ static uint32_t get_elf_hwcap(void)
     /* probe for the extra features */
     /* EDSP is in v5TE and above */
     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
-    GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index 308ed23fcb..b1a4db4466 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -76,7 +76,6 @@ abi_ulong get_elf_hwcap(CPUState *cs)
 
     /* EDSP is in v5TE and above, but all our v5 CPUs are v5TE */
     GET_FEATURE(ARM_FEATURE_V5, ARM_HWCAP_ARM_EDSP);
-    GET_FEATURE(ARM_FEATURE_IWMMXT, ARM_HWCAP_ARM_IWMMXT);
     GET_FEATURE(ARM_FEATURE_THUMB2EE, ARM_HWCAP_ARM_THUMBEE);
     GET_FEATURE(ARM_FEATURE_NEON, ARM_HWCAP_ARM_NEON);
     GET_FEATURE(ARM_FEATURE_V6K, ARM_HWCAP_ARM_TLS);
diff --git a/linux-user/arm/signal.c b/linux-user/arm/signal.c
index 8db1c4b233..3b387cd6d7 100644
--- a/linux-user/arm/signal.c
+++ b/linux-user/arm/signal.c
@@ -76,21 +76,7 @@ struct target_vfp_sigframe {
     struct target_user_vfp_exc ufp_exc;
 } __attribute__((__aligned__(8)));
 
-struct target_iwmmxt_sigframe {
-    abi_ulong magic;
-    abi_ulong size;
-    uint64_t regs[16];
-    /* Note that not all the coprocessor control registers are stored here */
-    uint32_t wcssf;
-    uint32_t wcasf;
-    uint32_t wcgr0;
-    uint32_t wcgr1;
-    uint32_t wcgr2;
-    uint32_t wcgr3;
-} __attribute__((__aligned__(8)));
-
 #define TARGET_VFP_MAGIC 0x56465001
-#define TARGET_IWMMXT_MAGIC 0x12ef842a
 
 struct sigframe
 {
@@ -267,25 +253,6 @@ static abi_ulong *setup_sigframe_vfp(abi_ulong *regspace, CPUARMState *env)
     return (abi_ulong*)(vfpframe+1);
 }
 
-static abi_ulong *setup_sigframe_iwmmxt(abi_ulong *regspace, CPUARMState *env)
-{
-    int i;
-    struct target_iwmmxt_sigframe *iwmmxtframe;
-    iwmmxtframe = (struct target_iwmmxt_sigframe *)regspace;
-    __put_user(TARGET_IWMMXT_MAGIC, &iwmmxtframe->magic);
-    __put_user(sizeof(*iwmmxtframe), &iwmmxtframe->size);
-    for (i = 0; i < 16; i++) {
-        __put_user(env->iwmmxt.regs[i], &iwmmxtframe->regs[i]);
-    }
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCSSF], &iwmmxtframe->wcssf);
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCASF], &iwmmxtframe->wcssf);
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCGR0], &iwmmxtframe->wcgr0);
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCGR1], &iwmmxtframe->wcgr1);
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCGR2], &iwmmxtframe->wcgr2);
-    __put_user(env->vfp.xregs[ARM_IWMMXT_wCGR3], &iwmmxtframe->wcgr3);
-    return (abi_ulong*)(iwmmxtframe+1);
-}
-
 static void setup_sigframe(struct target_ucontext *uc,
                            target_sigset_t *set, CPUARMState *env)
 {
@@ -306,9 +273,6 @@ static void setup_sigframe(struct target_ucontext *uc,
     if (cpu_isar_feature(aa32_vfp_simd, env_archcpu(env))) {
         regspace = setup_sigframe_vfp(regspace, env);
     }
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        regspace = setup_sigframe_iwmmxt(regspace, env);
-    }
 
     /* Write terminating magic word */
     __put_user(0, regspace);
@@ -435,31 +399,6 @@ static abi_ulong *restore_sigframe_vfp(CPUARMState *env, abi_ulong *regspace)
     return (abi_ulong*)(vfpframe + 1);
 }
 
-static abi_ulong *restore_sigframe_iwmmxt(CPUARMState *env,
-                                          abi_ulong *regspace)
-{
-    int i;
-    abi_ulong magic, sz;
-    struct target_iwmmxt_sigframe *iwmmxtframe;
-    iwmmxtframe = (struct target_iwmmxt_sigframe *)regspace;
-
-    __get_user(magic, &iwmmxtframe->magic);
-    __get_user(sz, &iwmmxtframe->size);
-    if (magic != TARGET_IWMMXT_MAGIC || sz != sizeof(*iwmmxtframe)) {
-        return 0;
-    }
-    for (i = 0; i < 16; i++) {
-        __get_user(env->iwmmxt.regs[i], &iwmmxtframe->regs[i]);
-    }
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCSSF], &iwmmxtframe->wcssf);
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCASF], &iwmmxtframe->wcssf);
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCGR0], &iwmmxtframe->wcgr0);
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCGR1], &iwmmxtframe->wcgr1);
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCGR2], &iwmmxtframe->wcgr2);
-    __get_user(env->vfp.xregs[ARM_IWMMXT_wCGR3], &iwmmxtframe->wcgr3);
-    return (abi_ulong*)(iwmmxtframe + 1);
-}
-
 static int do_sigframe_return(CPUARMState *env,
                               target_ulong context_addr,
                               struct target_ucontext *uc)
@@ -482,12 +421,6 @@ static int do_sigframe_return(CPUARMState *env,
             return 1;
         }
     }
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        regspace = restore_sigframe_iwmmxt(env, regspace);
-        if (!regspace) {
-            return 1;
-        }
-    }
 
     target_restore_altstack(&uc->tuc_stack, env);
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 9781055bdc..02e2a31a86 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -247,10 +247,6 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
 
     cpu->power_state = cs->start_powered_off ? PSCI_OFF : PSCI_ON;
 
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        env->iwmmxt.cregs[ARM_IWMMXT_wCID] = 0x69051000 | 'Q';
-    }
-
     if (arm_feature(env, ARM_FEATURE_AARCH64)) {
         /* 64 bit CPUs always start in 64 bit mode */
         env->aarch64 = true;
@@ -2610,14 +2606,10 @@ static const Property arm_cpu_properties[] = {
 static const gchar *arm_gdb_arch_name(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
 
     if (arm_gdbstub_is_aarch64(cpu)) {
         return "aarch64";
     }
-    if (arm_feature(env, ARM_FEATURE_IWMMXT)) {
-        return "iwmmxt";
-    }
     return "arm";
 }
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 92fcb96671..6644043f4c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -697,14 +697,6 @@ typedef struct CPUArchState {
      */
     uint64_t exclusive_high;
 
-    /* iwMMXt coprocessor state.  */
-    struct {
-        uint64_t regs[16];
-        uint64_t val;
-
-        uint32_t cregs[16];
-    } iwmmxt;
-
     struct {
         ARMPACKey apia;
         ARMPACKey apib;
@@ -1863,16 +1855,6 @@ enum arm_cpu_mode {
 /* QEMU-internal value meaning "FPSCR, but we care only about NZCV" */
 #define QEMU_VFP_FPSCR_NZCV 0xffff
 
-/* iwMMXt coprocessor control registers.  */
-#define ARM_IWMMXT_wCID  0
-#define ARM_IWMMXT_wCon  1
-#define ARM_IWMMXT_wCSSF 2
-#define ARM_IWMMXT_wCASF 3
-#define ARM_IWMMXT_wCGR0 8
-#define ARM_IWMMXT_wCGR1 9
-#define ARM_IWMMXT_wCGR2 10
-#define ARM_IWMMXT_wCGR3 11
-
 /* V7M CCR bits */
 FIELD(V7M_CCR, NONBASETHRDENA, 0, 1)
 FIELD(V7M_CCR, USERSETMPEND, 1, 1)
@@ -2442,7 +2424,6 @@ QEMU_BUILD_BUG_ON(ARRAY_SIZE(((ARMCPU *)0)->ccsidr) <= R_V7M_CSSELR_INDEX_MASK);
  */
 enum arm_features {
     ARM_FEATURE_AUXCR,  /* ARM1026 Auxiliary control register.  */
-    ARM_FEATURE_IWMMXT, /* Intel iwMMXt extension.  */
     ARM_FEATURE_V6,
     ARM_FEATURE_V6K,
     ARM_FEATURE_V7,
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 6986915bee..6666a0c50c 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -221,26 +221,6 @@ static const VMStateDescription vmstate_vfp = {
     }
 };
 
-static bool iwmmxt_needed(void *opaque)
-{
-    ARMCPU *cpu = opaque;
-    CPUARMState *env = &cpu->env;
-
-    return arm_feature(env, ARM_FEATURE_IWMMXT);
-}
-
-static const VMStateDescription vmstate_iwmmxt = {
-    .name = "cpu/iwmmxt",
-    .version_id = 1,
-    .minimum_version_id = 1,
-    .needed = iwmmxt_needed,
-    .fields = (const VMStateField[]) {
-        VMSTATE_UINT64_ARRAY(env.iwmmxt.regs, ARMCPU, 16),
-        VMSTATE_UINT32_ARRAY(env.iwmmxt.cregs, ARMCPU, 16),
-        VMSTATE_END_OF_LIST()
-    }
-};
-
 /* The expression ARM_MAX_VQ - 2 is 0 for pure AArch32 build,
  * and ARMPredicateReg is actively empty.  This triggers errors
  * in the expansion of the VMSTATE macros.
@@ -1102,7 +1082,6 @@ const VMStateDescription vmstate_arm_cpu = {
     },
     .subsections = (const VMStateDescription * const []) {
         &vmstate_vfp,
-        &vmstate_iwmmxt,
         &vmstate_m,
         &vmstate_thumb2ee,
         /* pmsav7_rnr must come before pmsav7 so that we have the

From 116c2c21d521eb31fffb44eb74d918975c9a5658 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 28 Aug 2025 17:27:00 +0100
Subject: [PATCH 0421/2396] system: drop the -old-param option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We deprecated the command line option -old-param for the 10.0
release, which allows us to drop it in 10.2.  This option was used to
boot Arm targets with a very old boot protocol using the
'param_struct' ABI.  We only ever needed this on a handful of board
types which have all now been removed from QEMU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250828162700.3308812-1-peter.maydell@linaro.org
---
 docs/about/deprecated.rst       | 13 ------
 docs/about/removed-features.rst | 12 +++++
 hw/arm/boot.c                   | 81 +--------------------------------
 include/system/system.h         |  1 -
 qemu-options.hx                 |  7 ---
 system/globals.c                |  1 -
 system/vl.c                     |  4 --
 7 files changed, 13 insertions(+), 106 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index f031414769..03f7cabf73 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -68,19 +68,6 @@ configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
 marked deprecated since 9.0, users have to ensure that all the topology members
 described with -smp are supported by the target machine.
 
-``-old-param`` option for booting Arm kernels via param_struct (since 10.0)
-'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-The ``-old-param`` command line option is specific to Arm targets:
-it is used when directly booting a guest kernel to pass it the
-command line and other information via the old ``param_struct`` ABI,
-rather than the newer ATAGS or DTB mechanisms. This option was only
-ever needed to support ancient kernels on some old board types
-like the ``akita`` or ``terrier``; it has been deprecated in the
-kernel since 2001. None of the board types QEMU supports need
-``param_struct`` support, so this option has been deprecated and will
-be removed in a future QEMU version.
-
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 65fd564d22..07ca4079d4 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -560,6 +560,18 @@ the options along with the machine models they were intended for.
 
 Use ``-run-with user=..`` instead.
 
+``-old-param`` option for booting Arm kernels via param_struct (removed in 10.2)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``-old-param`` command line option was specific to Arm targets:
+it was used when directly booting a guest kernel to pass it the
+command line and other information via the old ``param_struct`` ABI,
+rather than the newer ATAGS or DTB mechanisms. This option was only
+ever needed to support ancient kernels on some old board types
+like the ``akita`` or ``terrier``; it has been deprecated in the
+kernel since 2001. None of the board types QEMU supports need
+``param_struct`` support, so this option has been removed.
+
 
 User-mode emulator command line arguments
 -----------------------------------------
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index d0840308f5..e77d8679d8 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -337,81 +337,6 @@ static void set_kernel_args(const struct arm_boot_info *info, AddressSpace *as)
     WRITE_WORD(p, 0);
 }
 
-static void set_kernel_args_old(const struct arm_boot_info *info,
-                                AddressSpace *as)
-{
-    hwaddr p;
-    const char *s;
-    int initrd_size = info->initrd_size;
-    hwaddr base = info->loader_start;
-
-    /* see linux/include/asm-arm/setup.h */
-    p = base + KERNEL_ARGS_ADDR;
-    /* page_size */
-    WRITE_WORD(p, 4096);
-    /* nr_pages */
-    WRITE_WORD(p, info->ram_size / 4096);
-    /* ramdisk_size */
-    WRITE_WORD(p, 0);
-#define FLAG_READONLY 1
-#define FLAG_RDLOAD   4
-#define FLAG_RDPROMPT 8
-    /* flags */
-    WRITE_WORD(p, FLAG_READONLY | FLAG_RDLOAD | FLAG_RDPROMPT);
-    /* rootdev */
-    WRITE_WORD(p, (31 << 8) | 0); /* /dev/mtdblock0 */
-    /* video_num_cols */
-    WRITE_WORD(p, 0);
-    /* video_num_rows */
-    WRITE_WORD(p, 0);
-    /* video_x */
-    WRITE_WORD(p, 0);
-    /* video_y */
-    WRITE_WORD(p, 0);
-    /* memc_control_reg */
-    WRITE_WORD(p, 0);
-    /* unsigned char sounddefault */
-    /* unsigned char adfsdrives */
-    /* unsigned char bytes_per_char_h */
-    /* unsigned char bytes_per_char_v */
-    WRITE_WORD(p, 0);
-    /* pages_in_bank[4] */
-    WRITE_WORD(p, 0);
-    WRITE_WORD(p, 0);
-    WRITE_WORD(p, 0);
-    WRITE_WORD(p, 0);
-    /* pages_in_vram */
-    WRITE_WORD(p, 0);
-    /* initrd_start */
-    if (initrd_size) {
-        WRITE_WORD(p, info->initrd_start);
-    } else {
-        WRITE_WORD(p, 0);
-    }
-    /* initrd_size */
-    WRITE_WORD(p, initrd_size);
-    /* rd_start */
-    WRITE_WORD(p, 0);
-    /* system_rev */
-    WRITE_WORD(p, 0);
-    /* system_serial_low */
-    WRITE_WORD(p, 0);
-    /* system_serial_high */
-    WRITE_WORD(p, 0);
-    /* mem_fclk_21285 */
-    WRITE_WORD(p, 0);
-    /* zero unused fields */
-    while (p < base + KERNEL_ARGS_ADDR + 256 + 1024) {
-        WRITE_WORD(p, 0);
-    }
-    s = info->kernel_cmdline;
-    if (s) {
-        address_space_write(as, p, MEMTXATTRS_UNSPECIFIED, s, strlen(s) + 1);
-    } else {
-        WRITE_WORD(p, 0);
-    }
-}
-
 static int fdt_add_memory_node(void *fdt, uint32_t acells, hwaddr mem_base,
                                uint32_t scells, hwaddr mem_len,
                                int numa_node_id)
@@ -802,11 +727,7 @@ static void do_cpu_reset(void *opaque)
                 cpu_set_pc(cs, info->loader_start);
 
                 if (!have_dtb(info)) {
-                    if (old_param) {
-                        set_kernel_args_old(info, as);
-                    } else {
-                        set_kernel_args(info, as);
-                    }
+                    set_kernel_args(info, as);
                 }
             } else if (info->secondary_cpu_reset_hook) {
                 info->secondary_cpu_reset_hook(cpu, info);
diff --git a/include/system/system.h b/include/system/system.h
index a7effe7dfd..03a2d0e900 100644
--- a/include/system/system.h
+++ b/include/system/system.h
@@ -42,7 +42,6 @@ extern int graphic_height;
 extern int graphic_depth;
 extern int display_opengl;
 extern const char *keyboard_layout;
-extern int old_param;
 extern uint8_t *boot_splash_filedata;
 extern bool enable_cpu_pm;
 extern QEMUClockType rtc_clock;
diff --git a/qemu-options.hx b/qemu-options.hx
index ab23f14d21..aa44b0e34a 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -5347,13 +5347,6 @@ SRST
         specified, the former is passed to semihosting as it always
         takes precedence.
 ERST
-DEF("old-param", 0, QEMU_OPTION_old_param,
-    "-old-param      old param mode\n", QEMU_ARCH_ARM)
-SRST
-``-old-param``
-    Old param mode (ARM only).
-ERST
-
 DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
     "-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]\n" \
     "          [,spawn=allow|deny][,resourcecontrol=allow|deny]\n" \
diff --git a/system/globals.c b/system/globals.c
index 9640c9511e..98f9876d5d 100644
--- a/system/globals.c
+++ b/system/globals.c
@@ -52,7 +52,6 @@ bool vga_interface_created;
 Chardev *parallel_hds[MAX_PARALLEL_PORTS];
 QEMUOptionRom option_rom[MAX_OPTION_ROMS];
 int nb_option_roms;
-int old_param;
 const char *qemu_name;
 unsigned int nb_prom_envs;
 const char *prom_envs[MAX_PROM_ENVS];
diff --git a/system/vl.c b/system/vl.c
index 3b7057e6c6..00f3694725 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -3524,10 +3524,6 @@ void qemu_init(int argc, char **argv)
                 prom_envs[nb_prom_envs] = optarg;
                 nb_prom_envs++;
                 break;
-            case QEMU_OPTION_old_param:
-                warn_report("-old-param is deprecated");
-                old_param = 1;
-                break;
             case QEMU_OPTION_rtc:
                 opts = qemu_opts_parse_noisily(qemu_find_opts("rtc"), optarg,
                                                false);

From 19f6dcfe6b8b2a3523362812fc696ab83050d316 Mon Sep 17 00:00:00 2001
From: Cornelia Huck <cohuck@redhat.com>
Date: Thu, 11 Sep 2025 17:41:59 +0200
Subject: [PATCH 0422/2396] arm/kvm: report registers we failed to set

If we fail migration because of a mismatch of some registers between
source and destination, the error message is not very informative:

qemu-system-aarch64: error while loading state for instance 0x0 ofdevice 'cpu'
qemu-system-aarch64: Failed to put registers after init: Invalid argument

At least try to give the user a hint which registers had a problem,
even if they cannot really do anything about it right now.

Sample output:

Could not set register op0:3 op1:0 crn:0 crm:0 op2:0 to c00fac31 (is 413fd0c1)

We could be even more helpful once we support writable ID registers,
at which point the user might actually be able to configure something
that is migratable.

Suggested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Sebastian Ott <sebott@redhat.com>
Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Message-id: 20250911154159.158046-1-cohuck@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 86 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 6672344855..c1ec6654ca 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -900,6 +900,58 @@ bool write_kvmstate_to_list(ARMCPU *cpu)
     return ok;
 }
 
+/* pretty-print a KVM register */
+#define CP_REG_ARM64_SYSREG_OP(_reg, _op)                       \
+    ((uint8_t)((_reg & CP_REG_ARM64_SYSREG_ ## _op ## _MASK) >> \
+               CP_REG_ARM64_SYSREG_ ## _op ## _SHIFT))
+
+static gchar *kvm_print_sve_register_name(uint64_t regidx)
+{
+    uint16_t sve_reg = regidx & 0x000000000000ffff;
+
+    if (regidx == KVM_REG_ARM64_SVE_VLS) {
+        return g_strdup_printf("SVE VLS");
+    }
+    /* zreg, preg, ffr */
+    switch (sve_reg & 0xfc00) {
+    case 0:
+        return g_strdup_printf("SVE zreg n:%d slice:%d",
+                               (sve_reg & 0x03e0) >> 5, sve_reg & 0x001f);
+    case 0x04:
+        return g_strdup_printf("SVE preg n:%d slice:%d",
+                               (sve_reg & 0x01e0) >> 5, sve_reg & 0x001f);
+    case 0x06:
+        return g_strdup_printf("SVE ffr slice:%d", sve_reg & 0x001f);
+    default:
+        return g_strdup_printf("SVE ???");
+    }
+}
+
+static gchar *kvm_print_register_name(uint64_t regidx)
+{
+        switch ((regidx & KVM_REG_ARM_COPROC_MASK)) {
+        case KVM_REG_ARM_CORE:
+            return g_strdup_printf("core reg %"PRIx64, regidx);
+        case KVM_REG_ARM_DEMUX:
+            return g_strdup_printf("demuxed reg %"PRIx64, regidx);
+        case KVM_REG_ARM64_SYSREG:
+            return g_strdup_printf("op0:%d op1:%d crn:%d crm:%d op2:%d",
+                                   CP_REG_ARM64_SYSREG_OP(regidx, OP0),
+                                   CP_REG_ARM64_SYSREG_OP(regidx, OP1),
+                                   CP_REG_ARM64_SYSREG_OP(regidx, CRN),
+                                   CP_REG_ARM64_SYSREG_OP(regidx, CRM),
+                                   CP_REG_ARM64_SYSREG_OP(regidx, OP2));
+        case KVM_REG_ARM_FW:
+            return g_strdup_printf("fw reg %d", (int)(regidx & 0xffff));
+        case KVM_REG_ARM64_SVE:
+            return kvm_print_sve_register_name(regidx);
+        case KVM_REG_ARM_FW_FEAT_BMAP:
+            return g_strdup_printf("fw feat reg %d", (int)(regidx & 0xffff));
+        default:
+            return g_strdup_printf("%"PRIx64, regidx);
+        }
+}
+
 bool write_list_to_kvmstate(ARMCPU *cpu, int level)
 {
     CPUState *cs = CPU(cpu);
@@ -927,11 +979,45 @@ bool write_list_to_kvmstate(ARMCPU *cpu, int level)
             g_assert_not_reached();
         }
         if (ret) {
+            gchar *reg_str = kvm_print_register_name(regidx);
+
             /* We might fail for "unknown register" and also for
              * "you tried to set a register which is constant with
              * a different value from what it actually contains".
              */
             ok = false;
+            switch (ret) {
+            case -ENOENT:
+                error_report("Could not set register %s: unknown to KVM",
+                             reg_str);
+                break;
+            case -EINVAL:
+                if ((regidx & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U32) {
+                    if (!kvm_get_one_reg(cs, regidx, &v32)) {
+                        error_report("Could not set register %s to %x (is %x)",
+                                     reg_str, (uint32_t)cpu->cpreg_values[i],
+                                     v32);
+                    } else {
+                        error_report("Could not set register %s to %x",
+                                     reg_str, (uint32_t)cpu->cpreg_values[i]);
+                    }
+                } else /* U64 */ {
+                    uint64_t v64;
+
+                    if (!kvm_get_one_reg(cs, regidx, &v64)) {
+                        error_report("Could not set register %s to %"PRIx64" (is %"PRIx64")",
+                                     reg_str, cpu->cpreg_values[i], v64);
+                    } else {
+                        error_report("Could not set register %s to %"PRIx64,
+                                     reg_str, cpu->cpreg_values[i]);
+                    }
+                }
+                break;
+            default:
+                error_report("Could not set register %s: %s",
+                             reg_str, strerror(-ret));
+            }
+            g_free(reg_str);
         }
     }
     return ok;

From 71cda981208ebcfa403d8e3451d1d5bdef0b0931 Mon Sep 17 00:00:00 2001
From: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Date: Tue, 9 Sep 2025 16:10:10 +0000
Subject: [PATCH 0423/2396] target/arm: Increase MAX_PACKET_LENGTH for SME ZA
 remote gdb debugging

This patch increases the value of the MAX_PACKET_LEGNTH to
131104 from 4096 to allow the GDBState.line_buf to be large enough
to accommodate the full contents of the SME ZA storage when the
vector length is maximal. This is in preparation for a related
patch that allows SME register visibility through remote GDB
debugging.

Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250909161012.2561593-2-vacha.bhavsar@oss.qualcomm.com
[PMM: fixed up comment formatting]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 gdbstub/internals.h | 22 +++++++++++++++++++++-
 1 file changed, 21 insertions(+), 1 deletion(-)

diff --git a/gdbstub/internals.h b/gdbstub/internals.h
index bf5a5c6302..92466b28c1 100644
--- a/gdbstub/internals.h
+++ b/gdbstub/internals.h
@@ -11,7 +11,27 @@
 
 #include "exec/cpu-common.h"
 
-#define MAX_PACKET_LENGTH 4096
+/*
+ * Most "large" transfers (e.g. memory reads, feature XML
+ * transfer) have mechanisms in the gdb protocol for splitting
+ * them. However, register values in particular cannot currently
+ * be split. This packet size must therefore be at least big enough
+ * for the worst-case register size. Currently that is Arm SME
+ * ZA storage with a 256x256 byte value. We also must account
+ * for the conversion from raw data to hex in gdb_memtohex(),
+ * which writes 2 * size bytes, and for other protocol overhead
+ * including command, register number and checksum which add
+ * another 4 bytes of overhead. However, to be consistent with
+ * the changes made in gdbserver to address this same requirement,
+ * we add a total of 32 bytes to account for protocol overhead
+ * (unclear why specifically 32 bytes), bringing the value of
+ * MAX_PACKET_LENGTH to 2 * 256 * 256 + 32 = 131104.
+ *
+ * The commit making this change for gdbserver can be found here:
+ * https://sourceware.org/git/?p=binutils-gdb.git;a=commit;h=
+ * b816042e88583f280ad186ff124ab84d31fb592b
+ */
+#define MAX_PACKET_LENGTH 131104
 
 /*
  * Shared structures and definitions

From 030f0ba11767c7bd4148d9cd4f63e299d38139b3 Mon Sep 17 00:00:00 2001
From: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Date: Tue, 9 Sep 2025 16:10:11 +0000
Subject: [PATCH 0424/2396] target/arm: Added support for SME register exposure
 to GDB

The QEMU GDB stub does not expose the ZA storage SME register to GDB
via the remote serial protocol, which can be a useful functionality
to debug SME code.  To provide this functionality for AArch64
targets, this patch registers the SME register set with the GDB stub.
To do so, this patch implements the aarch64_gdb_get_sme_reg() and
aarch64_gdb_set_sme_reg() functions to specify how to get and set the
SME registers, and the arm_gen_dynamic_smereg_feature() function to
generate the target description in XML format to indicate the target
architecture supports SME.  Finally, this patch includes a
dyn_smereg_feature structure to hold this GDB XML description of the
SME registers for each CPU.

Note that according to the GDB documentation the ZA register is
defined as a vector of bytes; however the target description xml
retrieved when using gdb natively on a host with SME capabilities
represents the ZA register as a vector of vectors of bytes, so this
is a GDB documentation error.  We follow GDB's own gdbstub
implementation and represent the ZA register as a vector of vectors
of bytes as is done by GDB here:

https://github.com/bminor/binutils-gdb/blob/5cce2b7006daa7073b98e3d1a3b176199d1381d7/gdb/features/aarch64-sme.c#L50

Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Message-id: 20250909161012.2561593-3-vacha.bhavsar@oss.qualcomm.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: fixed minor checkpatch nits]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |   1 +
 target/arm/gdbstub.c   |  10 +++-
 target/arm/gdbstub64.c | 119 +++++++++++++++++++++++++++++++++++++++++
 target/arm/internals.h |   3 ++
 4 files changed, 132 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 6644043f4c..1c0deb723d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -925,6 +925,7 @@ struct ArchCPU {
 
     DynamicGDBFeatureInfo dyn_sysreg_feature;
     DynamicGDBFeatureInfo dyn_svereg_feature;
+    DynamicGDBFeatureInfo dyn_smereg_feature;
     DynamicGDBFeatureInfo dyn_m_systemreg_feature;
     DynamicGDBFeatureInfo dyn_m_secextreg_feature;
 
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index ce4497ad7c..2d331fff44 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -527,7 +527,8 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
          * registers so we don't need to include both.
          */
 #ifdef TARGET_AARCH64
-        if (isar_feature_aa64_sve(&cpu->isar)) {
+        if (isar_feature_aa64_sve(&cpu->isar) ||
+            isar_feature_aa64_sme(&cpu->isar)) {
             GDBFeature *feature = arm_gen_dynamic_svereg_feature(cs, cs->gdb_num_regs);
             gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
                                      aarch64_gdb_set_sve_reg, feature, 0);
@@ -537,6 +538,13 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      gdb_find_static_feature("aarch64-fpu.xml"),
                                      0);
         }
+
+        if (isar_feature_aa64_sme(&cpu->isar)) {
+            GDBFeature *sme_feature =
+                arm_gen_dynamic_smereg_feature(cs, cs->gdb_num_regs);
+            gdb_register_coprocessor(cs, aarch64_gdb_get_sme_reg,
+                                     aarch64_gdb_set_sme_reg, sme_feature, 0);
+        }
         /*
          * Note that we report pauth information via the feature name
          * org.gnu.gdb.aarch64.pauth_v2, not org.gnu.gdb.aarch64.pauth.
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 08e2858539..3bccde2bf2 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -249,6 +249,90 @@ int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg)
     return 0;
 }
 
+int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    switch (reg) {
+    case 0: /* svg register */
+    {
+        int vq = 0;
+        if (FIELD_EX64(env->svcr, SVCR, SM)) {
+            vq = sve_vqm1_for_el_sm(env, arm_current_el(env),
+                                    FIELD_EX64(env->svcr, SVCR, SM)) + 1;
+        }
+        /* svg = vector granules (2 * vector quardwords) in streaming mode */
+        return gdb_get_reg64(buf, vq * 2);
+    }
+    case 1: /* svcr register */
+        return gdb_get_reg64(buf, env->svcr);
+    case 2: /* za register */
+    {
+        int len = 0;
+        int vq = cpu->sme_max_vq;
+        int svl = vq * 16;
+        for (int i = 0; i < svl; i++) {
+            for (int q = 0; q < vq; q++) {
+                len += gdb_get_reg128(buf,
+                                      env->za_state.za[i].d[q * 2 + 1],
+                                      env->za_state.za[i].d[q * 2]);
+            }
+        }
+        return len;
+    }
+    default:
+        /* gdbstub asked for something out of range */
+        qemu_log_mask(LOG_UNIMP, "%s: out of range register %d", __func__, reg);
+        break;
+    }
+
+    return 0;
+}
+
+int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    switch (reg) {
+    case 0: /* svg register */
+        /* cannot set svg via gdbstub */
+        return 8;
+    case 1: /* svcr register */
+        aarch64_set_svcr(env, ldq_le_p(buf),
+                         R_SVCR_SM_MASK | R_SVCR_ZA_MASK);
+        return 8;
+    case 2: /* za register */
+    {
+        int len = 0;
+        int vq = cpu->sme_max_vq;
+        int svl = vq * 16;
+        for (int i = 0; i < svl; i++) {
+            for (int q = 0; q < vq; q++) {
+                if (target_big_endian()) {
+                    env->za_state.za[i].d[q * 2 + 1] = ldq_p(buf);
+                    buf += 8;
+                    env->za_state.za[i].d[q * 2] = ldq_p(buf);
+                } else{
+                    env->za_state.za[i].d[q * 2] = ldq_p(buf);
+                    buf += 8;
+                    env->za_state.za[i].d[q * 2 + 1] = ldq_p(buf);
+                }
+                buf += 8;
+                len += 16;
+            }
+        }
+        return len;
+    }
+    default:
+        /* gdbstub asked for something out of range */
+        break;
+    }
+
+    return 0;
+}
+
 int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -413,6 +497,41 @@ GDBFeature *arm_gen_dynamic_svereg_feature(CPUState *cs, int base_reg)
     return &cpu->dyn_svereg_feature.desc;
 }
 
+GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    int vq = cpu->sme_max_vq;
+    int svl = vq * 16;
+    GDBFeatureBuilder builder;
+    int reg = 0;
+
+    gdb_feature_builder_init(&builder, &cpu->dyn_smereg_feature.desc,
+                             "org.gnu.gdb.aarch64.sme", "sme-registers.xml",
+                             base_reg);
+
+
+    /* Create the sme_bv vector type. */
+    gdb_feature_builder_append_tag(
+        &builder, "<vector id=\"sme_bv\" type=\"uint8\" count=\"%d\"/>",
+        svl);
+
+    /* Create the sme_bvv vector type. */
+    gdb_feature_builder_append_tag(
+        &builder, "<vector id=\"sme_bvv\" type=\"sme_bv\" count=\"%d\"/>",
+        svl);
+
+    /* Define the svg, svcr, and za registers. */
+
+    gdb_feature_builder_append_reg(&builder, "svg", 64, reg++, "int", NULL);
+    gdb_feature_builder_append_reg(&builder, "svcr", 64, reg++, "int", NULL);
+    gdb_feature_builder_append_reg(&builder, "za", svl * svl * 8, reg++,
+                                   "sme_bvv", NULL);
+
+    gdb_feature_builder_end(&builder);
+
+    return &cpu->dyn_smereg_feature.desc;
+}
+
 #ifdef CONFIG_USER_ONLY
 int aarch64_gdb_get_tag_ctl_reg(CPUState *cs, GByteArray *buf, int reg)
 {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 8782594b77..532fabcafc 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1817,8 +1817,11 @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 }
 
 GDBFeature *arm_gen_dynamic_svereg_feature(CPUState *cpu, int base_reg);
+GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cpu, int base_reg);
 int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg);
+int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg);
+int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_fpu_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg);

From 904b8aae52a7b23fa00285decba535bd1e8f8d50 Mon Sep 17 00:00:00 2001
From: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Date: Tue, 9 Sep 2025 16:10:12 +0000
Subject: [PATCH 0425/2396] target/arm: Added test case for SME register
 exposure to GDB

This patch adds a test case to test SME register exposure to
a remote gdb debugging session. This test simply sets and
reads SME registers.

Signed-off-by: Vacha Bhavsar <vacha.bhavsar@oss.qualcomm.com>
Message-id: 20250909161012.2561593-4-vacha.bhavsar@oss.qualcomm.com
[PMM: fixed various python formatting nits]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure                             |   6 ++
 tests/tcg/aarch64/Makefile.target     |  29 +++++++
 tests/tcg/aarch64/gdbstub/test-sme.py | 117 ++++++++++++++++++++++++++
 3 files changed, 152 insertions(+)
 create mode 100644 tests/tcg/aarch64/gdbstub/test-sme.py

diff --git a/configure b/configure
index 274a778764..9aea02cf6a 100755
--- a/configure
+++ b/configure
@@ -1839,6 +1839,12 @@ for target in $target_list; do
           echo "GDB=$gdb_bin" >> $config_target_mak
       fi
 
+      if test "${gdb_arches#*$arch}" != "$gdb_arches" && version_ge $gdb_version 14.1; then
+          echo "GDB_HAS_SME_TILES=y" >> $config_target_mak
+      else
+          echo "GDB_HAS_SME_TILES=n" >> $config_target_mak
+      fi
+
       if test "${gdb_arches#*aarch64}" != "$gdb_arches" && version_ge $gdb_version 15.1; then
           echo "GDB_HAS_MTE=y" >> $config_target_mak
       fi
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 16ddcf4f88..1755874bee 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -134,6 +134,35 @@ run-gdbstub-sve-ioctls: sve-ioctls
 
 EXTRA_RUNS += run-gdbstub-sysregs run-gdbstub-sve-ioctls
 
+ifneq ($(CROSS_AS_HAS_ARMV9_SME),)
+# SME gdbstub tests
+
+run-gdbstub-sysregs-sme: sysregs
+	$(call run-test, $@, $(GDB_SCRIPT) \
+		--gdb $(GDB) \
+		--qemu $(QEMU) --qargs "$(QEMU_OPTS)" \
+		--bin $< --test $(AARCH64_SRC)/gdbstub/test-sme.py \
+		-- test_sme --gdb_basic_za_test, \
+	basic gdbstub SME support)
+
+ifeq ($(GDB_HAS_SME_TILES),y)
+run-gdbstub-sysregs-sme-tile-slice: sysregs
+	$(call run-test, $@, $(GDB_SCRIPT) \
+		--gdb $(GDB) \
+		--qemu $(QEMU) --qargs "$(QEMU_OPTS)" \
+		--bin $< --test $(AARCH64_SRC)/gdbstub/test-sme.py \
+		-- test_sme --gdb_tile_slice_test, \
+	gdbstub SME ZA tile slice support)
+else
+run-gdbstub-sysregs-sme-tile-slice: sysregs
+	$(call skip-test,"gdbstub SME ZA tile slice support", \
+	"selected gdb ($(GDB)) does not support SME ZA tile slices")
+endif
+
+EXTRA_RUNS += run-gdbstub-sysregs-sme run-gdbstub-sysregs-sme-tile-slice
+
+endif
+
 ifeq ($(GDB_HAS_MTE),y)
 run-gdbstub-mte: mte-8
 	$(call run-test, $@, $(GDB_SCRIPT) \
diff --git a/tests/tcg/aarch64/gdbstub/test-sme.py b/tests/tcg/aarch64/gdbstub/test-sme.py
new file mode 100644
index 0000000000..ec03189642
--- /dev/null
+++ b/tests/tcg/aarch64/gdbstub/test-sme.py
@@ -0,0 +1,117 @@
+#
+# Copyright (c) Qualcomm Technologies, Inc. and/or its subsidiaries.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#
+# Test the SME registers are visible and changeable via gdbstub
+#
+# This is launched via tests/guest-debug/run-test.py
+#
+
+import argparse
+import gdb
+from test_gdbstub import main, report
+
+MAGIC = 0x01020304
+BASIC_ZA_TEST = 0
+TILE_SLICE_TEST = 0
+
+
+def run_test():
+    """Run the requested test(s) for SME ZA gdbstub support"""
+
+    if BASIC_ZA_TEST:
+        run_basic_sme_za_gdbstub_support_test()
+    if TILE_SLICE_TEST:
+        run_basic_sme_za_tile_slice_gdbstub_support_test()
+
+
+def run_basic_sme_za_gdbstub_support_test():
+    """Test reads and writes to the SME ZA register at the byte level"""
+
+    frame = gdb.selected_frame()
+    rname = "za"
+    za = frame.read_register(rname)
+    report(True, "Reading %s" % rname)
+
+    # Writing to the ZA register, byte by byte.
+    for i in range(0, 16):
+        for j in range(0, 16):
+            cmd = "set $za[%d][%d] = 0x01" % (i, j)
+            gdb.execute(cmd)
+            report(True, "%s" % cmd)
+
+    # Reading from the ZA register, byte by byte.
+    for i in range(0, 16):
+        for j in range(0, 16):
+            reg = "$za[%d][%d]" % (i, j)
+            v = gdb.parse_and_eval(reg)
+            report(str(v.type) == "uint8_t", "size of %s" % (reg))
+            report(v == 0x1, "%s is 0x%x" % (reg, 0x1))
+
+
+def run_basic_sme_za_tile_slice_gdbstub_support_test():
+    """Test reads and writes of SME ZA horizontal and vertical tile slices
+
+    Test if SME ZA tile slices, both horizontal and vertical,
+    can be correctly read and written to. The sizes to test
+    are quadwords and doublewords.
+    """
+
+    sizes = {}
+    sizes["q"] = "uint128_t"
+    sizes["d"] = "uint64_t"
+
+    # Accessing requested sizes of elements of ZA
+    for size in sizes:
+
+        # Accessing various ZA tiles
+        for i in range(0, 4):
+
+            # Accessing various horizontal slices for each ZA tile
+            for j in range(0, 4):
+                # Writing to various elements in each tile slice
+                for k in range(0, 4):
+                    cmd = "set $za%dh%c%d[%d] = 0x%x" % (i, size, j, k, MAGIC)
+                    gdb.execute(cmd)
+                    report(True, "%s" % cmd)
+
+                # Reading from the written elements in each tile slice
+                for k in range(0, 4):
+                    reg = "$za%dh%c%d[%d]" % (i, size, j, k)
+                    v = gdb.parse_and_eval(reg)
+                    report(str(v.type) == sizes[size], "size of %s" % (reg))
+                    report(v == MAGIC, "%s is 0x%x" % (reg, MAGIC))
+
+            # Accessing various vertical slices for each ZA tile
+            for j in range(0, 4):
+                # Writing to various elements in each tile slice
+                for k in range(0, 4):
+                    cmd = "set $za%dv%c%d[%d] = 0x%x" % (i, size, j, k, MAGIC)
+                    gdb.execute(cmd)
+                    report(True, "%s" % cmd)
+
+                # Reading from the written elements in each tile slice
+                for k in range(0, 4):
+                    reg = "$za%dv%c%d[%d]" % (i, size, j, k)
+                    v = gdb.parse_and_eval(reg)
+                    report(str(v.type) == sizes[size], "size of %s" % (reg))
+                    report(v == MAGIC, "%s is 0x%x" % (reg, MAGIC))
+
+
+parser = argparse.ArgumentParser(description="A gdbstub test for SME support")
+parser.add_argument("--gdb_basic_za_test",
+                    help="Enable test for basic SME ZA support",
+                    action="store_true")
+parser.add_argument("--gdb_tile_slice_test",
+                    help="Enable test for ZA tile slice support",
+                    action="store_true")
+args = parser.parse_args()
+
+if args.gdb_basic_za_test:
+    BASIC_ZA_TEST = 1
+if args.gdb_tile_slice_test:
+    TILE_SLICE_TEST = 1
+
+main(run_test, expected_arch="aarch64")

From d9e6b8424fd2523a0361972d5dd841471879479c Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:23 +0100
Subject: [PATCH 0426/2396] hw/arm/smmu-common: Check SMMU has PCIe Root
 Complex association

We only allow default PCIe Root Complex(pcie.0) or pxb-pcie based extra
root complexes to be associated with SMMU.

Although this change does not affect functionality at present, it is
required when we add support for user-creatable SMMUv3 devices in
future patches.

Note: Added a specific check to identify pxb-pcie to avoid matching
pxb-cxl host bridges, which are also of type PCI_HOST_BRIDGE. This
restriction can be relaxed once support for CXL devices on arm/virt
is added and validated with SMMUv3.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nathan Chen <nathanc@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Message-id: 20250829082543.7680-2-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c                | 31 ++++++++++++++++++++++++++---
 hw/pci-bridge/pci_expander_bridge.c |  1 -
 include/hw/pci/pci_bridge.h         |  1 +
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 0dcaf2f589..7f64ea48d0 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -20,6 +20,7 @@
 #include "trace.h"
 #include "exec/target_page.h"
 #include "hw/core/cpu.h"
+#include "hw/pci/pci_bridge.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
 #include "qemu/jhash.h"
@@ -925,6 +926,7 @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
 {
     SMMUState *s = ARM_SMMU(dev);
     SMMUBaseClass *sbc = ARM_SMMU_GET_CLASS(dev);
+    PCIBus *pci_bus = s->primary_bus;
     Error *local_err = NULL;
 
     sbc->parent_realize(dev, &local_err);
@@ -937,11 +939,34 @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
                                      g_free, g_free);
     s->smmu_pcibus_by_busptr = g_hash_table_new(NULL, NULL);
 
-    if (s->primary_bus) {
-        pci_setup_iommu(s->primary_bus, &smmu_ops, s);
-    } else {
+    if (!pci_bus) {
         error_setg(errp, "SMMU is not attached to any PCI bus!");
+        return;
     }
+
+    /*
+     * We only allow default PCIe Root Complex(pcie.0) or pxb-pcie based extra
+     * root complexes to be associated with SMMU.
+     */
+    if (pci_bus_is_express(pci_bus) && pci_bus_is_root(pci_bus) &&
+        object_dynamic_cast(OBJECT(pci_bus)->parent, TYPE_PCI_HOST_BRIDGE)) {
+        /*
+         * This condition matches either the default pcie.0, pxb-pcie, or
+         * pxb-cxl. For both pxb-pcie and pxb-cxl, parent_dev will be set.
+         * Currently, we don't allow pxb-cxl as it requires further
+         * verification. Therefore, make sure this is indeed pxb-pcie.
+         */
+        if (pci_bus->parent_dev) {
+            if (!object_dynamic_cast(OBJECT(pci_bus), TYPE_PXB_PCIE_BUS)) {
+                goto out_err;
+            }
+        }
+        pci_setup_iommu(pci_bus, &smmu_ops, s);
+        return;
+    }
+out_err:
+    error_setg(errp, "SMMU should be attached to a default PCIe root complex"
+               "(pcie.0) or a pxb-pcie based root complex");
 }
 
 /*
diff --git a/hw/pci-bridge/pci_expander_bridge.c b/hw/pci-bridge/pci_expander_bridge.c
index 3a29dfefc2..1bcceddbc4 100644
--- a/hw/pci-bridge/pci_expander_bridge.c
+++ b/hw/pci-bridge/pci_expander_bridge.c
@@ -34,7 +34,6 @@ typedef struct PXBBus PXBBus;
 DECLARE_INSTANCE_CHECKER(PXBBus, PXB_BUS,
                          TYPE_PXB_BUS)
 
-#define TYPE_PXB_PCIE_BUS "pxb-pcie-bus"
 DECLARE_INSTANCE_CHECKER(PXBBus, PXB_PCIE_BUS,
                          TYPE_PXB_PCIE_BUS)
 
diff --git a/include/hw/pci/pci_bridge.h b/include/hw/pci/pci_bridge.h
index 8cdacbc4e1..a055fd8d32 100644
--- a/include/hw/pci/pci_bridge.h
+++ b/include/hw/pci/pci_bridge.h
@@ -104,6 +104,7 @@ typedef struct PXBPCIEDev {
     PXBDev parent_obj;
 } PXBPCIEDev;
 
+#define TYPE_PXB_PCIE_BUS "pxb-pcie-bus"
 #define TYPE_PXB_CXL_BUS "pxb-cxl-bus"
 #define TYPE_PXB_DEV "pxb"
 OBJECT_DECLARE_SIMPLE_TYPE(PXBDev, PXB_DEV)

From 0e6a5bfb0eb17f57fb923b7905bd1435204bdd62 Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:24 +0100
Subject: [PATCH 0427/2396] hw/arm/virt-acpi-build: Re-arrange SMMUv3 IORT
 build

Introduce a new struct AcpiIortSMMUv3Dev to hold all the information
required for SMMUv3 IORT node and use that for populating the node.

The current machine wide SMMUv3 is named as legacy SMMUv3 as we will
soon add support for user-creatable SMMUv3 devices. These changes will
be useful to have common code paths when we add that support.

Tested-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Message-id: 20250829082543.7680-3-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 137 ++++++++++++++++++++++++++-------------
 hw/arm/virt.c            |   1 +
 include/hw/arm/virt.h    |   1 +
 3 files changed, 94 insertions(+), 45 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index b01fc4f8ef..bef4fabe56 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -305,29 +305,65 @@ static int iort_idmap_compare(gconstpointer a, gconstpointer b)
     return idmap_a->input_base - idmap_b->input_base;
 }
 
+typedef struct AcpiIortSMMUv3Dev {
+    int irq;
+    hwaddr base;
+    GArray *rc_smmu_idmaps;
+    /* Offset of the SMMUv3 IORT Node relative to the start of the IORT */
+    size_t offset;
+} AcpiIortSMMUv3Dev;
+
+/*
+ * Populate the struct AcpiIortSMMUv3Dev for the legacy SMMUv3 and
+ * return the total number of associated idmaps.
+ */
+static int populate_smmuv3_legacy_dev(GArray *sdev_blob)
+{
+    VirtMachineState *vms = VIRT_MACHINE(qdev_get_machine());
+    AcpiIortSMMUv3Dev sdev;
+
+    sdev.rc_smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
+    object_child_foreach_recursive(object_get_root(), iort_host_bridges,
+                                   sdev.rc_smmu_idmaps);
+    /*
+     * There can be only one legacy SMMUv3("iommu=smmuv3") as it is a machine
+     * wide one. Since it may cover multiple PCIe RCs(based on "bypass_iommu"
+     * property), may have multiple SMMUv3 idmaps. Sort it by input_base.
+     */
+    g_array_sort(sdev.rc_smmu_idmaps, iort_idmap_compare);
+
+    sdev.base = vms->memmap[VIRT_SMMU].base;
+    sdev.irq = vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
+    g_array_append_val(sdev_blob, sdev);
+    return sdev.rc_smmu_idmaps->len;
+}
+
 /* Compute ID ranges (RIDs) from RC that are directed to the ITS Group node */
-static void create_rc_its_idmaps(GArray *its_idmaps, GArray *smmu_idmaps)
+static void create_rc_its_idmaps(GArray *its_idmaps, GArray *smmuv3_devs)
 {
     AcpiIortIdMapping *idmap;
     AcpiIortIdMapping next_range = {0};
+    AcpiIortSMMUv3Dev *sdev;
 
-    /*
-     * Based on the RID ranges that are directed to the SMMU, determine the
-     * bypassed RID ranges, i.e., the ones that are directed to the ITS Group
-     * node and do not pass through the SMMU, by subtracting the SMMU-bound
-     * ranges from the full RID range (0x0000–0xFFFF).
-     */
-     for (int i = 0; i < smmu_idmaps->len; i++) {
-        idmap = &g_array_index(smmu_idmaps, AcpiIortIdMapping, i);
+    for (int i = 0; i < smmuv3_devs->len; i++) {
+        sdev = &g_array_index(smmuv3_devs, AcpiIortSMMUv3Dev, i);
+        /*
+         * Based on the RID ranges that are directed to the SMMU, determine the
+         * bypassed RID ranges, i.e., the ones that are directed to the ITS
+         * Group node and do not pass through the SMMU, by subtracting the
+         * SMMU-bound ranges from the full RID range (0x0000–0xFFFF).
+         */
+         for (int j = 0; j < sdev->rc_smmu_idmaps->len; j++) {
+            idmap = &g_array_index(sdev->rc_smmu_idmaps, AcpiIortIdMapping, j);
 
-        if (next_range.input_base < idmap->input_base) {
-            next_range.id_count = idmap->input_base - next_range.input_base;
-            g_array_append_val(its_idmaps, next_range);
+            if (next_range.input_base < idmap->input_base) {
+                next_range.id_count = idmap->input_base - next_range.input_base;
+                g_array_append_val(its_idmaps, next_range);
+            }
+
+            next_range.input_base = idmap->input_base + idmap->id_count;
         }
-
-        next_range.input_base = idmap->input_base + idmap->id_count;
     }
-
     /*
      * Append the last RC -> ITS ID mapping.
      *
@@ -341,7 +377,6 @@ static void create_rc_its_idmaps(GArray *its_idmaps, GArray *smmu_idmaps)
     }
 }
 
-
 /*
  * Input Output Remapping Table (IORT)
  * Conforms to "IO Remapping Table System Software on ARM Platforms",
@@ -351,9 +386,12 @@ static void
 build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 {
     int i, nb_nodes, rc_mapping_count;
-    size_t node_size, smmu_offset = 0;
+    AcpiIortSMMUv3Dev *sdev;
+    size_t node_size;
+    int num_smmus = 0;
     uint32_t id = 0;
-    GArray *rc_smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
+    int rc_smmu_idmaps_len = 0;
+    GArray *smmuv3_devs = g_array_new(false, true, sizeof(AcpiIortSMMUv3Dev));
     GArray *rc_its_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
 
     AcpiTable table = { .sig = "IORT", .rev = 3, .oem_id = vms->oem_id,
@@ -361,22 +399,21 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     /* Table 2 The IORT */
     acpi_table_begin(&table, table_data);
 
-    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
-        object_child_foreach_recursive(object_get_root(),
-                                       iort_host_bridges, rc_smmu_idmaps);
+    if (vms->legacy_smmuv3_present) {
+        rc_smmu_idmaps_len = populate_smmuv3_legacy_dev(smmuv3_devs);
+    }
 
-        /* Sort the smmu idmap by input_base */
-        g_array_sort(rc_smmu_idmaps, iort_idmap_compare);
-
-        nb_nodes = 2; /* RC and SMMUv3 */
-        rc_mapping_count = rc_smmu_idmaps->len;
+    num_smmus = smmuv3_devs->len;
+    if (num_smmus) {
+        nb_nodes = num_smmus + 1; /* RC and SMMUv3 */
+        rc_mapping_count = rc_smmu_idmaps_len;
 
         if (vms->its) {
             /*
              * Knowing the ID ranges from the RC to the SMMU, it's possible to
              * determine the ID ranges from RC that go directly to ITS.
              */
-            create_rc_its_idmaps(rc_its_idmaps, rc_smmu_idmaps);
+            create_rc_its_idmaps(rc_its_idmaps, smmuv3_devs);
 
             nb_nodes++; /* ITS */
             rc_mapping_count += rc_its_idmaps->len;
@@ -411,9 +448,10 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         build_append_int_noprefix(table_data, 0 /* MADT translation_id */, 4);
     }
 
-    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
-        int irq =  vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
+    for (i = 0; i < num_smmus; i++) {
+        sdev = &g_array_index(smmuv3_devs, AcpiIortSMMUv3Dev, i);
         int smmu_mapping_count, offset_to_id_array;
+        int irq = sdev->irq;
 
         if (vms->its) {
             smmu_mapping_count = 1; /* ITS Group node */
@@ -422,7 +460,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
             smmu_mapping_count = 0; /* No ID mappings */
             offset_to_id_array = 0; /* No ID mappings array */
         }
-        smmu_offset = table_data->len - table.table_offset;
+        sdev->offset = table_data->len - table.table_offset;
         /* Table 9 SMMUv3 Format */
         build_append_int_noprefix(table_data, 4 /* SMMUv3 */, 1); /* Type */
         node_size =  SMMU_V3_ENTRY_SIZE +
@@ -435,7 +473,7 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
         /* Reference to ID Array */
         build_append_int_noprefix(table_data, offset_to_id_array, 4);
         /* Base address */
-        build_append_int_noprefix(table_data, vms->memmap[VIRT_SMMU].base, 8);
+        build_append_int_noprefix(table_data, sdev->base, 8);
         /* Flags */
         build_append_int_noprefix(table_data, 1 /* COHACC Override */, 4);
         build_append_int_noprefix(table_data, 0, 4); /* Reserved */
@@ -486,21 +524,26 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     build_append_int_noprefix(table_data, 0, 3); /* Reserved */
 
     /* Output Reference */
-    if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+    if (num_smmus) {
         AcpiIortIdMapping *range;
 
-        /*
-         * Map RIDs (input) from RC to SMMUv3 nodes: RC -> SMMUv3.
-         *
-         * N.B.: The mapping from SMMUv3 to ITS Group node (SMMUv3 -> ITS) is
-         * defined in the SMMUv3 table, where all SMMUv3 IDs are mapped to the
-         * ITS Group node, if ITS is available.
-         */
-        for (i = 0; i < rc_smmu_idmaps->len; i++) {
-            range = &g_array_index(rc_smmu_idmaps, AcpiIortIdMapping, i);
-            /* Output IORT node is the SMMUv3 node. */
-            build_iort_id_mapping(table_data, range->input_base,
-                                  range->id_count, smmu_offset);
+        for (i = 0; i < num_smmus; i++) {
+            sdev = &g_array_index(smmuv3_devs, AcpiIortSMMUv3Dev, i);
+
+            /*
+             * Map RIDs (input) from RC to SMMUv3 nodes: RC -> SMMUv3.
+             *
+             * N.B.: The mapping from SMMUv3 to ITS Group node (SMMUv3 -> ITS)
+             * is defined in the SMMUv3 table, where all SMMUv3 IDs are mapped
+             * to the ITS Group node, if ITS is available.
+             */
+             for (int j = 0; j < sdev->rc_smmu_idmaps->len; j++) {
+                range = &g_array_index(sdev->rc_smmu_idmaps,
+                                       AcpiIortIdMapping, j);
+                /* Output IORT node is the SMMUv3 node. */
+                build_iort_id_mapping(table_data, range->input_base,
+                                      range->id_count, sdev->offset);
+            }
         }
 
         if (vms->its) {
@@ -525,8 +568,12 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     }
 
     acpi_table_end(linker, &table);
-    g_array_free(rc_smmu_idmaps, true);
     g_array_free(rc_its_idmaps, true);
+    for (i = 0; i < num_smmus; i++) {
+        sdev = &g_array_index(smmuv3_devs, AcpiIortSMMUv3Dev, i);
+        g_array_free(sdev->rc_smmu_idmaps, true);
+    }
+    g_array_free(smmuv3_devs, true);
 }
 
 /*
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index e5c4142e82..16a1ac3c2d 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1651,6 +1651,7 @@ static void create_pcie(VirtMachineState *vms)
                 qemu_fdt_setprop_cells(ms->fdt, nodename, "iommu-map",
                                        0x0, vms->iommu_phandle, 0x0, 0x10000);
             }
+            vms->legacy_smmuv3_present = true;
             break;
         default:
             g_assert_not_reached();
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 365a28b082..ea2cff05b0 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -179,6 +179,7 @@ struct VirtMachineState {
     char *oem_table_id;
     bool ns_el2_virt_timer_irq;
     CXLState cxl_devices_state;
+    bool legacy_smmuv3_present;
 };
 
 #define VIRT_ECAM_ID(high) (high ? VIRT_HIGH_PCIE_ECAM : VIRT_PCIE_ECAM)

From 01e9a18730e6f56f713ed074603a8b0f2982ed26 Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:25 +0100
Subject: [PATCH 0428/2396] hw/arm/virt-acpi-build: Update IORT for multiple
 smmuv3 devices

With the soon to be introduced user-creatable SMMUv3 devices for
virt, it is possible to have multiple SMMUv3 devices associated
with different PCIe root complexes.

Update IORT nodes accordingly.

An example IORT Id mappings for a Qemu virt machine with two
PCIe Root Complexes each assocaited with a SMMUv3 will
be something like below,

  -device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0
  -device arm-smmuv3,primary-bus=pcie.1,id=smmuv3.1
  ...

  +--------------------+           +--------------------+
  |   Root Complex 0   |           |   Root Complex 1   |
  |                    |           |                    |
  |  Requestor IDs     |           |  Requestor IDs     |
  |  0x0000 - 0x00FF   |           |  0x0100 - 0x01FF   |
  +---------+----------+           +---------+----------+
            |                               |
            |                               |
            |       Stream ID Mapping       |
            v                               v
  +--------------------+          +--------------------+
  |    SMMUv3 Node 0   |          |    SMMUv3 Node 1   |
  |                    |          |                    |
  | Stream IDs 0x0000- |          | Stream IDs 0x0100- |
  | 0x00FF mapped from |          | 0x01FF mapped from |
  | RC0 Requestor IDs  |          | RC1 Requestor IDs  |
  +--------------------+          +--------------------+
            |                                |
            |                                |
            +----------------+---------------+
                             |
                             |Device ID Mapping
                             v
              +----------------------------+
              |       ITS Node 0           |
              |                            |
              | Device IDs:                |
              | 0x0000 - 0x00FF (from RC0) |
              | 0x0100 - 0x01FF (from RC1) |
              | 0x0200 - 0xFFFF (No SMMU)  |
              +----------------------------+

Tested-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Message-id: 20250829082543.7680-4-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 64 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 64 insertions(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index bef4fabe56..96830f7c4e 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -45,6 +45,7 @@
 #include "hw/acpi/generic_event_device.h"
 #include "hw/acpi/tpm.h"
 #include "hw/acpi/hmat.h"
+#include "hw/arm/smmuv3.h"
 #include "hw/cxl/cxl.h"
 #include "hw/pci/pcie_host.h"
 #include "hw/pci/pci.h"
@@ -338,6 +339,67 @@ static int populate_smmuv3_legacy_dev(GArray *sdev_blob)
     return sdev.rc_smmu_idmaps->len;
 }
 
+static int smmuv3_dev_idmap_compare(gconstpointer a, gconstpointer b)
+{
+    AcpiIortSMMUv3Dev *sdev_a = (AcpiIortSMMUv3Dev *)a;
+    AcpiIortSMMUv3Dev *sdev_b = (AcpiIortSMMUv3Dev *)b;
+    AcpiIortIdMapping *map_a = &g_array_index(sdev_a->rc_smmu_idmaps,
+                                              AcpiIortIdMapping, 0);
+    AcpiIortIdMapping *map_b = &g_array_index(sdev_b->rc_smmu_idmaps,
+                                              AcpiIortIdMapping, 0);
+    return map_a->input_base - map_b->input_base;
+}
+
+static int iort_smmuv3_devices(Object *obj, void *opaque)
+{
+    VirtMachineState *vms = VIRT_MACHINE(qdev_get_machine());
+    GArray *sdev_blob = opaque;
+    AcpiIortIdMapping idmap;
+    PlatformBusDevice *pbus;
+    AcpiIortSMMUv3Dev sdev;
+    int min_bus, max_bus;
+    SysBusDevice *sbdev;
+    PCIBus *bus;
+
+    if (!object_dynamic_cast(obj, TYPE_ARM_SMMUV3)) {
+        return 0;
+    }
+
+    bus = PCI_BUS(object_property_get_link(obj, "primary-bus", &error_abort));
+    pbus = PLATFORM_BUS_DEVICE(vms->platform_bus_dev);
+    sbdev = SYS_BUS_DEVICE(obj);
+    sdev.base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
+    sdev.base += vms->memmap[VIRT_PLATFORM_BUS].base;
+    sdev.irq = platform_bus_get_irqn(pbus, sbdev, 0);
+    sdev.irq += vms->irqmap[VIRT_PLATFORM_BUS];
+    sdev.irq += ARM_SPI_BASE;
+
+    pci_bus_range(bus, &min_bus, &max_bus);
+    sdev.rc_smmu_idmaps = g_array_new(false, true, sizeof(AcpiIortIdMapping));
+    idmap.input_base = min_bus << 8,
+    idmap.id_count = (max_bus - min_bus + 1) << 8,
+    g_array_append_val(sdev.rc_smmu_idmaps, idmap);
+    g_array_append_val(sdev_blob, sdev);
+    return 0;
+}
+
+/*
+ * Populate the struct AcpiIortSMMUv3Dev for all SMMUv3 devices and
+ * return the total number of idmaps.
+ */
+static int populate_smmuv3_dev(GArray *sdev_blob)
+{
+    object_child_foreach_recursive(object_get_root(),
+                                   iort_smmuv3_devices, sdev_blob);
+    /* Sort the smmuv3 devices(if any) by smmu idmap input_base */
+    g_array_sort(sdev_blob, smmuv3_dev_idmap_compare);
+    /*
+     * Since each SMMUv3 dev is assocaited with specific host bridge,
+     * total number of idmaps equals to total number of smmuv3 devices.
+     */
+    return sdev_blob->len;
+}
+
 /* Compute ID ranges (RIDs) from RC that are directed to the ITS Group node */
 static void create_rc_its_idmaps(GArray *its_idmaps, GArray *smmuv3_devs)
 {
@@ -401,6 +463,8 @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
 
     if (vms->legacy_smmuv3_present) {
         rc_smmu_idmaps_len = populate_smmuv3_legacy_dev(smmuv3_devs);
+    } else {
+        rc_smmu_idmaps_len = populate_smmuv3_dev(smmuv3_devs);
     }
 
     num_smmus = smmuv3_devs->len;

From 7a276b7570266ec39611f9d91089741ec7e9295b Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:26 +0100
Subject: [PATCH 0429/2396] hw/arm/virt: Factor out common SMMUV3 dt bindings
 code

No functional changes intended. This will be useful when we
add support for user-creatable smmuv3 device.

Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Message-id: 20250829082543.7680-5-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 54 +++++++++++++++++++++++++++------------------------
 1 file changed, 29 insertions(+), 25 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 16a1ac3c2d..bebe2d8cea 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1444,19 +1444,43 @@ static void create_pcie_irq_map(const MachineState *ms,
                            0x7           /* PCI irq */);
 }
 
+static void create_smmuv3_dt_bindings(const VirtMachineState *vms, hwaddr base,
+                                      hwaddr size, int irq)
+{
+    char *node;
+    const char compat[] = "arm,smmu-v3";
+    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
+    MachineState *ms = MACHINE(vms);
+
+    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
+    qemu_fdt_add_subnode(ms->fdt, node);
+    qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg", 2, base, 2, size);
+
+    qemu_fdt_setprop_cells(ms->fdt, node, "interrupts",
+            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
+            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
+
+    qemu_fdt_setprop(ms->fdt, node, "interrupt-names", irq_names,
+                     sizeof(irq_names));
+
+    qemu_fdt_setprop(ms->fdt, node, "dma-coherent", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, node, "#iommu-cells", 1);
+    qemu_fdt_setprop_cell(ms->fdt, node, "phandle", vms->iommu_phandle);
+    g_free(node);
+}
+
 static void create_smmu(const VirtMachineState *vms,
                         PCIBus *bus)
 {
     VirtMachineClass *vmc = VIRT_MACHINE_GET_CLASS(vms);
-    char *node;
-    const char compat[] = "arm,smmu-v3";
     int irq =  vms->irqmap[VIRT_SMMU];
     int i;
     hwaddr base = vms->memmap[VIRT_SMMU].base;
     hwaddr size = vms->memmap[VIRT_SMMU].size;
-    const char irq_names[] = "eventq\0priq\0cmdq-sync\0gerror";
     DeviceState *dev;
-    MachineState *ms = MACHINE(vms);
 
     if (vms->iommu != VIRT_IOMMU_SMMUV3 || !vms->iommu_phandle) {
         return;
@@ -1475,27 +1499,7 @@ static void create_smmu(const VirtMachineState *vms,
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
                            qdev_get_gpio_in(vms->gic, irq + i));
     }
-
-    node = g_strdup_printf("/smmuv3@%" PRIx64, base);
-    qemu_fdt_add_subnode(ms->fdt, node);
-    qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
-    qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg", 2, base, 2, size);
-
-    qemu_fdt_setprop_cells(ms->fdt, node, "interrupts",
-            GIC_FDT_IRQ_TYPE_SPI, irq    , GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
-            GIC_FDT_IRQ_TYPE_SPI, irq + 1, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
-            GIC_FDT_IRQ_TYPE_SPI, irq + 2, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI,
-            GIC_FDT_IRQ_TYPE_SPI, irq + 3, GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
-
-    qemu_fdt_setprop(ms->fdt, node, "interrupt-names", irq_names,
-                     sizeof(irq_names));
-
-    qemu_fdt_setprop(ms->fdt, node, "dma-coherent", NULL, 0);
-
-    qemu_fdt_setprop_cell(ms->fdt, node, "#iommu-cells", 1);
-
-    qemu_fdt_setprop_cell(ms->fdt, node, "phandle", vms->iommu_phandle);
-    g_free(node);
+    create_smmuv3_dt_bindings(vms, base, size, irq);
 }
 
 static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)

From 466197fc7a25658f9187d538c26887f5738d1ac9 Mon Sep 17 00:00:00 2001
From: Nicolin Chen <nicolinc@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:27 +0100
Subject: [PATCH 0430/2396] hw/arm/virt: Add an SMMU_IO_LEN macro

This is useful as the subsequent support for new SMMUv3 dev will also
use the same.

Signed-off-by: Nicolin Chen <nicolinc@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nathan Chen <nathanc@nvidia.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-6-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index bebe2d8cea..64b4dcf607 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -151,6 +151,9 @@ static void arm_virt_compat_set(MachineClass *mc)
 #define LEGACY_RAMLIMIT_GB 255
 #define LEGACY_RAMLIMIT_BYTES (LEGACY_RAMLIMIT_GB * GiB)
 
+/* MMIO region size for SMMUv3 */
+#define SMMU_IO_LEN 0x20000
+
 /* Addresses and sizes of our components.
  * 0..128MB is space for a flash device so we can run bootrom code such as UEFI.
  * 128MB..256MB is used for miscellaneous device I/O.
@@ -182,7 +185,7 @@ static const MemMapEntry base_memmap[] = {
     [VIRT_FW_CFG] =             { 0x09020000, 0x00000018 },
     [VIRT_GPIO] =               { 0x09030000, 0x00001000 },
     [VIRT_UART1] =              { 0x09040000, 0x00001000 },
-    [VIRT_SMMU] =               { 0x09050000, 0x00020000 },
+    [VIRT_SMMU] =               { 0x09050000, SMMU_IO_LEN },
     [VIRT_PCDIMM_ACPI] =        { 0x09070000, MEMORY_HOTPLUG_IO_LEN },
     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},

From 951bc76fb669eab96cc60e38a50097ad4435163e Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:28 +0100
Subject: [PATCH 0431/2396] hw/pci: Introduce pci_setup_iommu_per_bus() for
 per-bus IOMMU ops retrieval

Currently, pci_setup_iommu() registers IOMMU ops for a given PCIBus.
However, when retrieving IOMMU ops for a device using
pci_device_get_iommu_bus_devfn(), the function checks the parent_dev
and fetches IOMMU ops from the parent device, even if the current
bus does not have any associated IOMMU ops.

This behavior works for now because QEMU's IOMMU implementations are
globally scoped, and host bridges rely on the bypass_iommu property
to skip IOMMU translation when needed.

However, this model will break with the soon to be introduced
arm-smmuv3 device, which allows users to associate the IOMMU
with a specific PCIe root complex (e.g., the default pcie.0
or a pxb-pcie root complex).

For example, consider the following setup with multiple root
complexes:

-device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0 \
...
-device pxb-pcie,id=pcie.1,bus_nr=8,bus=pcie.0 \
-device pcie-root-port,id=pcie.port1,bus=pcie.1 \
-device virtio-net-pci,bus=pcie.port1

In Qemu, pxb-pcie acts as a special root complex whose parent is
effectively the default root complex(pcie.0). Hence, though pcie.1
has no associated SMMUv3 as per above, pci_device_get_iommu_bus_devfn()
will incorrectly return the IOMMU ops from pcie.0 due to the fallback
via parent_dev.

To fix this, introduce a new helper pci_setup_iommu_per_bus() that
explicitly sets the new iommu_per_bus field in the PCIBus structure.
This helper will be used in a subsequent patch that adds support for
the new arm-smmuv3 device.

Update pci_device_get_iommu_bus_devfn() to use iommu_per_bus when
determining the correct IOMMU ops, ensuring accurate behavior for
per-bus IOMMUs.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nathan Chen <nathanc@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Message-id: 20250829082543.7680-7-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/pci/pci.c             | 31 +++++++++++++++++++++++++++++++
 include/hw/pci/pci.h     |  2 ++
 include/hw/pci/pci_bus.h |  1 +
 3 files changed, 34 insertions(+)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 297196b242..c3df9d6656 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2912,6 +2912,19 @@ static void pci_device_get_iommu_bus_devfn(PCIDevice *dev,
             }
         }
 
+        /*
+         * When multiple PCI Express Root Buses are defined using pxb-pcie,
+         * the IOMMU configuration may be specific to each root bus. However,
+         * pxb-pcie acts as a special root complex whose parent is effectively
+         * the default root complex(pcie.0). Ensure that we retrieve the
+         * correct IOMMU ops(if any) in such cases.
+         */
+        if (pci_bus_is_express(iommu_bus) && pci_bus_is_root(iommu_bus)) {
+            if (parent_bus->iommu_per_bus) {
+                break;
+            }
+        }
+
         iommu_bus = parent_bus;
     }
 
@@ -3172,6 +3185,24 @@ void pci_setup_iommu(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque)
     bus->iommu_opaque = opaque;
 }
 
+/*
+ * Similar to pci_setup_iommu(), but sets iommu_per_bus to true,
+ * indicating that the IOMMU is specific to this bus. This is used by
+ * IOMMU implementations that are tied to a specific PCIe root complex.
+ *
+ * In QEMU, pxb-pcie behaves as a special root complex whose parent is
+ * effectively the default root complex (pcie.0). The iommu_per_bus
+ * is checked in pci_device_get_iommu_bus_devfn() to ensure the correct
+ * IOMMU ops are returned, avoiding the use of the parent’s IOMMU when
+ * it's not appropriate.
+ */
+void pci_setup_iommu_per_bus(PCIBus *bus, const PCIIOMMUOps *ops,
+                             void *opaque)
+{
+    pci_setup_iommu(bus, ops, opaque);
+    bus->iommu_per_bus = true;
+}
+
 static void pci_dev_get_w64(PCIBus *b, PCIDevice *dev, void *opaque)
 {
     Range *range = opaque;
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 6b7d3ac8a3..6bccb25ac2 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -773,6 +773,8 @@ int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
  */
 void pci_setup_iommu(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque);
 
+void pci_setup_iommu_per_bus(PCIBus *bus, const PCIIOMMUOps *ops, void *opaque);
+
 pcibus_t pci_bar_address(PCIDevice *d,
                          int reg, uint8_t type, pcibus_t size);
 
diff --git a/include/hw/pci/pci_bus.h b/include/hw/pci/pci_bus.h
index 2261312546..c738446788 100644
--- a/include/hw/pci/pci_bus.h
+++ b/include/hw/pci/pci_bus.h
@@ -35,6 +35,7 @@ struct PCIBus {
     enum PCIBusFlags flags;
     const PCIIOMMUOps *iommu_ops;
     void *iommu_opaque;
+    bool iommu_per_bus;
     uint8_t devfn_min;
     uint32_t slot_reserved_mask;
     pci_set_irq_fn set_irq;

From 66d2f665e163cf1afccd171e3c16f8d3acb3d94a Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:29 +0100
Subject: [PATCH 0432/2396] hw/arm/virt: Allow user-creatable SMMUv3 dev
 instantiation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow cold-plugging of an SMMUv3 device on the virt machine when no
global (legacy) SMMUv3 is present or when a virtio-iommu is specified.

This user-created SMMUv3 device is tied to a specific PCI bus provided
by the user, so ensure the IOMMU ops are configured accordingly.

Due to current limitations in QEMU’s device tree support, specifically
its inability to properly present pxb-pcie based root complexes and
their devices, the device tree support for the new SMMUv3 device is
limited to cases where it is attached to the default pcie.0 root complex.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nathan Chen <nathanc@nvidia.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-8-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c         |  8 +++++-
 hw/arm/smmuv3.c              |  2 ++
 hw/arm/virt.c                | 51 ++++++++++++++++++++++++++++++++++++
 hw/core/sysbus-fdt.c         |  3 +++
 include/hw/arm/smmu-common.h |  1 +
 5 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index 7f64ea48d0..62a7612184 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -961,7 +961,12 @@ static void smmu_base_realize(DeviceState *dev, Error **errp)
                 goto out_err;
             }
         }
-        pci_setup_iommu(pci_bus, &smmu_ops, s);
+
+        if (s->smmu_per_bus) {
+            pci_setup_iommu_per_bus(pci_bus, &smmu_ops, s);
+        } else {
+            pci_setup_iommu(pci_bus, &smmu_ops, s);
+        }
         return;
     }
 out_err:
@@ -986,6 +991,7 @@ static void smmu_base_reset_exit(Object *obj, ResetType type)
 
 static const Property smmu_dev_properties[] = {
     DEFINE_PROP_UINT8("bus_num", SMMUState, bus_num, 0),
+    DEFINE_PROP_BOOL("smmu_per_bus", SMMUState, smmu_per_bus, false),
     DEFINE_PROP_LINK("primary-bus", SMMUState, primary_bus,
                      TYPE_PCI_BUS, PCIBus *),
 };
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index ab67972353..bcf8af8dc7 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -1996,6 +1996,8 @@ static void smmuv3_class_init(ObjectClass *klass, const void *data)
     device_class_set_parent_realize(dc, smmu_realize,
                                     &c->parent_realize);
     device_class_set_props(dc, smmuv3_properties);
+    dc->hotpluggable = false;
+    dc->user_creatable = true;
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 64b4dcf607..7b3f9b1cdf 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -57,6 +57,7 @@
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
+#include "hw/pci/pci_bus.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/pci-bridge/pci_expander_bridge.h"
 #include "hw/virtio/virtio-pci.h"
@@ -1475,6 +1476,29 @@ static void create_smmuv3_dt_bindings(const VirtMachineState *vms, hwaddr base,
     g_free(node);
 }
 
+static void create_smmuv3_dev_dtb(VirtMachineState *vms,
+                                  DeviceState *dev, PCIBus *bus)
+{
+    PlatformBusDevice *pbus = PLATFORM_BUS_DEVICE(vms->platform_bus_dev);
+    SysBusDevice *sbdev = SYS_BUS_DEVICE(dev);
+    int irq = platform_bus_get_irqn(pbus, sbdev, 0);
+    hwaddr base = platform_bus_get_mmio_addr(pbus, sbdev, 0);
+    MachineState *ms = MACHINE(vms);
+
+    if (!(vms->bootinfo.firmware_loaded && virt_is_acpi_enabled(vms)) &&
+        strcmp("pcie.0", bus->qbus.name)) {
+        warn_report("SMMUv3 device only supported with pcie.0 for DT");
+        return;
+    }
+    base += vms->memmap[VIRT_PLATFORM_BUS].base;
+    irq += vms->irqmap[VIRT_PLATFORM_BUS];
+
+    vms->iommu_phandle = qemu_fdt_alloc_phandle(ms->fdt);
+    create_smmuv3_dt_bindings(vms, base, SMMU_IO_LEN, irq);
+    qemu_fdt_setprop_cells(ms->fdt, vms->pciehb_nodename, "iommu-map",
+                           0x0, vms->iommu_phandle, 0x0, 0x10000);
+}
+
 static void create_smmu(const VirtMachineState *vms,
                         PCIBus *bus)
 {
@@ -3006,6 +3030,16 @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
         qlist_append_str(reserved_regions, resv_prop_str);
         qdev_prop_set_array(dev, "reserved-regions", reserved_regions);
         g_free(resv_prop_str);
+    } else if (object_dynamic_cast(OBJECT(dev), TYPE_ARM_SMMUV3)) {
+        if (vms->legacy_smmuv3_present || vms->iommu == VIRT_IOMMU_VIRTIO) {
+            error_setg(errp, "virt machine already has %s set. "
+                       "Doesn't support incompatible iommus",
+                       (vms->legacy_smmuv3_present) ?
+                       "iommu=smmuv3" : "virtio-iommu");
+        } else if (vms->iommu == VIRT_IOMMU_NONE) {
+            /* The new SMMUv3 device is specific to the PCI bus */
+            object_property_set_bool(OBJECT(dev), "smmu_per_bus", true, NULL);
+        }
     }
 }
 
@@ -3029,6 +3063,22 @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
         virtio_md_pci_plug(VIRTIO_MD_PCI(dev), MACHINE(hotplug_dev), errp);
     }
 
+    if (object_dynamic_cast(OBJECT(dev), TYPE_ARM_SMMUV3)) {
+        if (!vms->legacy_smmuv3_present && vms->platform_bus_dev) {
+            PCIBus *bus;
+
+            bus = PCI_BUS(object_property_get_link(OBJECT(dev), "primary-bus",
+                                                   &error_abort));
+            if (pci_bus_bypass_iommu(bus)) {
+                error_setg(errp, "Bypass option cannot be set for SMMUv3 "
+                           "associated PCIe RC");
+                return;
+            }
+
+            create_smmuv3_dev_dtb(vms, dev, bus);
+        }
+    }
+
     if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         PCIDevice *pdev = PCI_DEVICE(dev);
 
@@ -3231,6 +3281,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_VFIO_PLATFORM);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
+    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_ARM_SMMUV3);
 #ifdef CONFIG_TPM
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_TPM_TIS_SYSBUS);
 #endif
diff --git a/hw/core/sysbus-fdt.c b/hw/core/sysbus-fdt.c
index c339a27875..e80776080b 100644
--- a/hw/core/sysbus-fdt.c
+++ b/hw/core/sysbus-fdt.c
@@ -31,6 +31,7 @@
 #include "qemu/error-report.h"
 #include "system/device_tree.h"
 #include "system/tpm.h"
+#include "hw/arm/smmuv3.h"
 #include "hw/platform-bus.h"
 #include "hw/vfio/vfio-platform.h"
 #include "hw/vfio/vfio-calxeda-xgmac.h"
@@ -518,6 +519,8 @@ static const BindingEntry bindings[] = {
 #ifdef CONFIG_TPM
     TYPE_BINDING(TYPE_TPM_TIS_SYSBUS, add_tpm_tis_fdt_node),
 #endif
+    /* No generic DT support for smmuv3 dev. Support added for arm virt only */
+    TYPE_BINDING(TYPE_ARM_SMMUV3, no_fdt_node),
     TYPE_BINDING(TYPE_RAMFB_DEVICE, no_fdt_node),
     TYPE_BINDING(TYPE_UEFI_VARS_SYSBUS, add_uefi_vars_node),
     TYPE_BINDING("", NULL), /* last element */
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index e5e2d09294..80d0fecfde 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -161,6 +161,7 @@ struct SMMUState {
     QLIST_HEAD(, SMMUDevice) devices_with_notifiers;
     uint8_t bus_num;
     PCIBus *primary_bus;
+    bool smmu_per_bus; /* SMMU is specific to the primary_bus */
 };
 
 struct SMMUBaseClass {

From 73d3d0187bc6b482d8b15116edce1475c7975b89 Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:30 +0100
Subject: [PATCH 0433/2396] qemu-options.hx: Document the arm-smmuv3 device

Now that arm,virt can have user-creatable smmuv3 devices, document it.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-9-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qemu-options.hx | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index aa44b0e34a..075f4be2e3 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1231,6 +1231,13 @@ SRST
     ``aw-bits=val`` (val between 32 and 64, default depends on machine)
         This decides the address width of the IOVA address space.
 
+``-device arm-smmuv3,primary-bus=id``
+    This is only supported by ``-machine virt`` (ARM).
+
+    ``primary-bus=id``
+        Accepts either the default root complex (pcie.0) or a
+        pxb-pcie based root complex.
+
 ERST
 
 DEF("name", HAS_ARG, QEMU_OPTION_name,

From c69520c13d6ea45a69a7a49361806fa05b19046d Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:31 +0100
Subject: [PATCH 0434/2396] bios-tables-test: Allow for smmuv3 test data.

The tests to be added exercise both legacy(iommu=smmuv3) and new
-device arm-smmuv3,.. cases.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-10-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev    | 0
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy | 0
 tests/data/acpi/aarch64/virt/IORT.smmuv3-dev    | 0
 tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy | 0
 tests/qtest/bios-tables-test-allowed-diff.h     | 4 ++++
 5 files changed, 4 insertions(+)
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
 create mode 100644 tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
 create mode 100644 tests/data/acpi/aarch64/virt/IORT.smmuv3-dev
 create mode 100644 tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/aarch64/virt/IORT.smmuv3-dev b/tests/data/acpi/aarch64/virt/IORT.smmuv3-dev
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..2e3e3ccdce 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,5 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
+"tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy",
+"tests/data/acpi/aarch64/virt/IORT.smmuv3-dev",

From 3f8cd046c151c471d9a34181320f4a7d3f72b32a Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:32 +0100
Subject: [PATCH 0435/2396] qtest/bios-tables-test: Add tests for legacy smmuv3
 and smmuv3 device

For the legacy SMMUv3 test, the setup includes three PCIe Root Complexes,
one of which has bypass_iommu enabled. The generated IORT table contains
a single SMMUv3 node, a Root Complex(RC) node and 1 ITS node.
RC node features 4 ID mappings, of which 2 points to SMMU node and the
remaining ones points to ITS.

       pcie.0 -> {SMMU0} -> {ITS}
{RC}   pcie.1 -> {SMMU0} -> {ITS}
       pcie.2            -> {ITS}
       [all other ids]   -> {ITS}

For the -device arm-smmuv3,... test, the configuration also includes three
Root Complexes, with two connected to separate SMMUv3 devices.
The resulting IORT table contains 1 RC node, 2 SMMU nodes and 1 ITS node.
RC node features 4 ID mappings. 2 of them target the 2 SMMU nodes while
the others targets the ITS.

        pcie.0 -> {SMMU0} -> {ITS}
{RC}    pcie.1 -> {SMMU1} -> {ITS}
        pcie.2            -> {ITS}
        [all other ids]   -> {ITS}

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-11-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test.c | 86 ++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index e7e6926c81..4fa8ac5096 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2337,6 +2337,86 @@ static void test_acpi_aarch64_virt_viot(void)
     free_test_data(&data);
 }
 
+static void test_acpi_aarch64_virt_smmuv3_legacy(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 128ULL * MiB,
+    };
+
+    /*
+     * cdrom is plugged into scsi controller to avoid conflict
+     * with pxb-pcie. See comments in test_acpi_aarch64_virt_tcg_pxb() for
+     * details.
+     *
+     * The setup includes three PCIe root complexes, one of which has
+     * bypass_iommu enabled. The generated IORT table contains a single
+     * SMMUv3 node and a Root Complex node with three ID mappings. Two
+     * of the ID mappings have output references pointing to the SMMUv3
+     * node and the remaining one points to ITS.
+     */
+    data.variant = ".smmuv3-legacy";
+    test_acpi_one(" -device pcie-root-port,chassis=1,id=pci.1"
+                  " -device virtio-scsi-pci,id=scsi0,bus=pci.1"
+                  " -drive file="
+                  "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2,"
+                  "if=none,media=cdrom,id=drive-scsi0-0-0-1,readonly=on"
+                  " -device scsi-cd,bus=scsi0.0,scsi-id=0,"
+                  "drive=drive-scsi0-0-0-1,id=scsi0-0-0-1,bootindex=1"
+                  " -cpu cortex-a57"
+                  " -M iommu=smmuv3"
+                  " -device pxb-pcie,id=pcie.1,bus=pcie.0,bus_nr=0x10"
+                  " -device pxb-pcie,id=pcie.2,bus=pcie.0,bus_nr=0x20,bypass_iommu=on",
+                  &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_aarch64_virt_smmuv3_dev(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .arch = "aarch64",
+        .tcg_only = true,
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 128ULL * MiB,
+    };
+
+    /*
+     * cdrom is plugged into scsi controller to avoid conflict
+     * with pxb-pcie. See comments in test_acpi_aarch64_virt_tcg_pxb()
+     * for details.
+     *
+     * The setup includes three PCie root complexes, two of which are
+     * connected to separate SMMUv3 devices. The resulting IORT table
+     * contains two SMMUv3 nodes and a Root Complex node with ID mappings
+     * of which two of the ID mappings have output references pointing
+     * to two different SMMUv3 nodes and the remaining ones pointing to
+     * ITS.
+     */
+    data.variant = ".smmuv3-dev";
+    test_acpi_one(" -device pcie-root-port,chassis=1,id=pci.1"
+                  " -device virtio-scsi-pci,id=scsi0,bus=pci.1"
+                  " -drive file="
+                  "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2,"
+                  "if=none,media=cdrom,id=drive-scsi0-0-0-1,readonly=on"
+                  " -device scsi-cd,bus=scsi0.0,scsi-id=0,"
+                  "drive=drive-scsi0-0-0-1,id=scsi0-0-0-1,bootindex=1"
+                  " -cpu cortex-a57"
+                  " -device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0"
+                  " -device pxb-pcie,id=pcie.1,bus=pcie.0,bus_nr=0x10"
+                  " -device arm-smmuv3,primary-bus=pcie.1,id=smmuv3.1"
+                  " -device pxb-pcie,id=pcie.2,bus=pcie.0,bus_nr=0x20",
+                  &data);
+    free_test_data(&data);
+}
+
 #ifndef _WIN32
 # define DEV_NULL "/dev/null"
 #else
@@ -2768,6 +2848,12 @@ int main(int argc, char *argv[])
             if (qtest_has_device("virtio-iommu-pci")) {
                 qtest_add_func("acpi/virt/viot", test_acpi_aarch64_virt_viot);
             }
+            qtest_add_func("acpi/virt/smmuv3-legacy",
+                           test_acpi_aarch64_virt_smmuv3_legacy);
+            if (qtest_has_device("arm-smmuv3")) {
+                qtest_add_func("acpi/virt/smmuv3-dev",
+                               test_acpi_aarch64_virt_smmuv3_dev);
+            }
         }
     } else if (strcmp(arch, "riscv64") == 0) {
         if (has_tcg && qtest_has_device("virtio-blk-pci")) {

From d35146a6606cf6ebb4e24bb97dfc0330f074f6e3 Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Fri, 29 Aug 2025 09:25:33 +0100
Subject: [PATCH 0436/2396] qtest/bios-tables-test: Update tables for smmuv3
 tests

For the legacy smmuv3 test case, generated IORT has a single SMMUv3 node,
a Root Complex(RC) node and 1 ITS node.
RC node features 4 ID mappings, of which 2 points to SMMU node and the
remaining ones points to ITS.

       pcie.0 -> {SMMU0} -> {ITS}
{RC}   pcie.1 -> {SMMU0} -> {ITS}
       pcie.2            -> {ITS}
       [all other ids]   -> {ITS}

...
[030h 0048   1]                         Type : 00
[031h 0049   2]                       Length : 0018
[033h 0051   1]                     Revision : 01
[034h 0052   4]                   Identifier : 00000000
[038h 0056   4]                Mapping Count : 00000000
[03Ch 0060   4]               Mapping Offset : 00000000

[040h 0064   4]                     ItsCount : 00000001
[044h 0068   4]                  Identifiers : 00000000

[048h 0072   1]                         Type : 04
[049h 0073   2]                       Length : 0058
[04Bh 0075   1]                     Revision : 04
[04Ch 0076   4]                   Identifier : 00000001
[050h 0080   4]                Mapping Count : 00000001
[054h 0084   4]               Mapping Offset : 00000044

[058h 0088   8]                 Base Address : 0000000009050000
[060h 0096   4]        Flags (decoded below) : 00000001
                             COHACC Override : 1
                               HTTU Override : 0
                      Proximity Domain Valid : 0
[064h 0100   4]                     Reserved : 00000000
[068h 0104   8]                VATOS Address : 0000000000000000
[070h 0112   4]                        Model : 00000000
[074h 0116   4]                   Event GSIV : 0000006A
[078h 0120   4]                     PRI GSIV : 0000006B
[07Ch 0124   4]                    GERR GSIV : 0000006D
[080h 0128   4]                    Sync GSIV : 0000006C
[084h 0132   4]             Proximity Domain : 00000000
[088h 0136   4]      Device ID Mapping Index : 00000000

[08Ch 0140   4]                   Input base : 00000000
[090h 0144   4]                     ID Count : 0000FFFF
[094h 0148   4]                  Output Base : 00000000
[098h 0152   4]             Output Reference : 00000030
[09Ch 0156   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[0A0h 0160   1]                         Type : 02
[0A1h 0161   2]                       Length : 0074
[0A3h 0163   1]                     Revision : 03
[0A4h 0164   4]                   Identifier : 00000002
[0A8h 0168   4]                Mapping Count : 00000004
[0ACh 0172   4]               Mapping Offset : 00000024

[0B0h 0176   8]            Memory Properties : [IORT Memory Access Properties]
[0B0h 0176   4]              Cache Coherency : 00000001
[0B4h 0180   1]        Hints (decoded below) : 00
                                   Transient : 0
                              Write Allocate : 0
                               Read Allocate : 0
                                    Override : 0
[0B5h 0181   2]                     Reserved : 0000
[0B7h 0183   1] Memory Flags (decoded below) : 03
                                   Coherency : 1
                            Device Attribute : 1
[0B8h 0184   4]                ATS Attribute : 00000000
[0BCh 0188   4]           PCI Segment Number : 00000000
[0C0h 0192   1]            Memory Size Limit : 40
[0C1h 0193   2]           PASID Capabilities : 0000
[0C3h 0195   1]                     Reserved : 00

[0C4h 0196   4]                   Input base : 00000000
[0C8h 0200   4]                     ID Count : 000001FF
[0CCh 0204   4]                  Output Base : 00000000
[0D0h 0208   4]             Output Reference : 00000048
[0D4h 0212   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[0D8h 0216   4]                   Input base : 00001000
[0DCh 0220   4]                     ID Count : 000000FF
[0E0h 0224   4]                  Output Base : 00001000
[0E4h 0228   4]             Output Reference : 00000048
[0E8h 0232   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[0ECh 0236   4]                   Input base : 00000200
[0F0h 0240   4]                     ID Count : 00000DFF
[0F4h 0244   4]                  Output Base : 00000200
[0F8h 0248   4]             Output Reference : 00000030
[0FCh 0252   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[100h 0256   4]                   Input base : 00001100
[104h 0260   4]                     ID Count : 0000EEFF
[108h 0264   4]                  Output Base : 00001100
[10Ch 0268   4]             Output Reference : 00000030
[110h 0272   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

For the smmuv3-dev test case, IORT has 2 SMMUV3 nodes,
1 RC node and 1 ITS node.
RC node features 4 ID mappings. 2 of them target the 2
SMMU nodes while the others targets the ITS.

        pcie.0 -> {SMMU0} -> {ITS}
{RC}    pcie.1 -> {SMMU1} -> {ITS}
        pcie.2            -> {ITS}
        [all other ids]   -> {ITS}
...
[030h 0048   1]                         Type : 00
[031h 0049   2]                       Length : 0018
[033h 0051   1]                     Revision : 01
[034h 0052   4]                   Identifier : 00000000
[038h 0056   4]                Mapping Count : 00000000
[03Ch 0060   4]               Mapping Offset : 00000000

[040h 0064   4]                     ItsCount : 00000001
[044h 0068   4]                  Identifiers : 00000000

[048h 0072   1]                         Type : 04
[049h 0073   2]                       Length : 0058
[04Bh 0075   1]                     Revision : 04
[04Ch 0076   4]                   Identifier : 00000001
[050h 0080   4]                Mapping Count : 00000001
[054h 0084   4]               Mapping Offset : 00000044

[058h 0088   8]                 Base Address : 000000000C000000
[060h 0096   4]        Flags (decoded below) : 00000001
                             COHACC Override : 1
                               HTTU Override : 0
                      Proximity Domain Valid : 0
[064h 0100   4]                     Reserved : 00000000
[068h 0104   8]                VATOS Address : 0000000000000000
[070h 0112   4]                        Model : 00000000
[074h 0116   4]                   Event GSIV : 00000090
[078h 0120   4]                     PRI GSIV : 00000091
[07Ch 0124   4]                    GERR GSIV : 00000093
[080h 0128   4]                    Sync GSIV : 00000092
[084h 0132   4]             Proximity Domain : 00000000
[088h 0136   4]      Device ID Mapping Index : 00000000

[08Ch 0140   4]                   Input base : 00000000
[090h 0144   4]                     ID Count : 0000FFFF
[094h 0148   4]                  Output Base : 00000000
[098h 0152   4]             Output Reference : 00000030
[09Ch 0156   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[0A0h 0160   1]                         Type : 04
[0A1h 0161   2]                       Length : 0058
[0A3h 0163   1]                     Revision : 04
[0A4h 0164   4]                   Identifier : 00000002
[0A8h 0168   4]                Mapping Count : 00000001
[0ACh 0172   4]               Mapping Offset : 00000044

[0B0h 0176   8]                 Base Address : 000000000C020000
[0B8h 0184   4]        Flags (decoded below) : 00000001
                             COHACC Override : 1
                               HTTU Override : 0
                      Proximity Domain Valid : 0
[0BCh 0188   4]                     Reserved : 00000000
[0C0h 0192   8]                VATOS Address : 0000000000000000
[0C8h 0200   4]                        Model : 00000000
[0CCh 0204   4]                   Event GSIV : 00000094
[0D0h 0208   4]                     PRI GSIV : 00000095
[0D4h 0212   4]                    GERR GSIV : 00000097
[0D8h 0216   4]                    Sync GSIV : 00000096
[0DCh 0220   4]             Proximity Domain : 00000000
[0E0h 0224   4]      Device ID Mapping Index : 00000000

[0E4h 0228   4]                   Input base : 00000000
[0E8h 0232   4]                     ID Count : 0000FFFF
[0ECh 0236   4]                  Output Base : 00000000
[0F0h 0240   4]             Output Reference : 00000030
[0F4h 0244   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[0F8h 0248   1]                         Type : 02
[0F9h 0249   2]                       Length : 0074
[0FBh 0251   1]                     Revision : 03
[0FCh 0252   4]                   Identifier : 00000003
[100h 0256   4]                Mapping Count : 00000004
[104h 0260   4]               Mapping Offset : 00000024

[108h 0264   8]            Memory Properties : [IORT Memory Access Properties]
[108h 0264   4]              Cache Coherency : 00000001
[10Ch 0268   1]        Hints (decoded below) : 00
                                   Transient : 0
                              Write Allocate : 0
                               Read Allocate : 0
                                    Override : 0
[10Dh 0269   2]                     Reserved : 0000
[10Fh 0271   1] Memory Flags (decoded below) : 03
                                   Coherency : 1
                            Device Attribute : 1
[110h 0272   4]                ATS Attribute : 00000000
[114h 0276   4]           PCI Segment Number : 00000000
[118h 0280   1]            Memory Size Limit : 40
[119h 0281   2]           PASID Capabilities : 0000
[11Bh 0283   1]                     Reserved : 00

[11Ch 0284   4]                   Input base : 00000000
[120h 0288   4]                     ID Count : 000001FF
[124h 0292   4]                  Output Base : 00000000
[128h 0296   4]             Output Reference : 00000048
[12Ch 0300   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[130h 0304   4]                   Input base : 00001000
[134h 0308   4]                     ID Count : 000000FF
[138h 0312   4]                  Output Base : 00001000
[13Ch 0316   4]             Output Reference : 000000A0
[140h 0320   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[144h 0324   4]                   Input base : 00000200
[148h 0328   4]                     ID Count : 00000DFF
[14Ch 0332   4]                  Output Base : 00000200
[150h 0336   4]             Output Reference : 00000030
[154h 0340   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

[158h 0344   4]                   Input base : 00001100
[15Ch 0348   4]                     ID Count : 0000EEFF
[160h 0352   4]                  Output Base : 00001100
[164h 0356   4]             Output Reference : 00000030
[168h 0360   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

Note: DSDT changes are not described here as it is not impacted by the
way the SMMUv3 is instantiated.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Nicolin Chen <nicolinc@nvidia.com>
Signed-off-by: Shameer Kolothum <shameerali.kolothum.thodi@huawei.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Donald Dutile <ddutile@redhat.com>
Reviewed-by: Nicolin Chen <nicolinc@nvidia.com>
Message-id: 20250829082543.7680-12-skolothumtho@nvidia.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev    | Bin 0 -> 10230 bytes
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy | Bin 0 -> 10230 bytes
 tests/data/acpi/aarch64/virt/IORT.smmuv3-dev    | Bin 0 -> 364 bytes
 tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy | Bin 0 -> 276 bytes
 tests/qtest/bios-tables-test-allowed-diff.h     |   4 ----
 5 files changed, 4 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..53d4c07f423886d8c4b57f1da6498eef5a08b556 100644
GIT binary patch
literal 10230
zcmZ<>b_w~W&cML*z{%g)BUr&HBEVTeK|z6$fq?<U2GIiDg-kK=!A|kfO;XMV1_m7Q
z9-c0|j?Mv|1_lP^3>@*Ho-Pd0O;*nSzA(8UUk?KVLqn(>N4#@Tu%Hx|cpE1J$Usg8
z0S1OnHU>sUMFs|jN`~kr3%77*H;B1`uD+oL1_nk99Pz;+j$GUv@y^bUj1VIPx%ePP
zFmXyibvm+y1;L!;;}_&_U|?X1uokWpVL2BA6V!48WFrhAwxb#WvKGS#CI*BNhEOA%
zK&~*tW&{@#vIk(!U_mm&2-yr{tY$D{GlLDu3}a+7Ot6~4g3SyLBr{Bq%`nAk1}io*
zxRA^+MK;3>s~K$A%-}&X!wlIBbF5~tV>5#f$qaL3Gc2&0!GX;T0VFdlkj=2fY6d4Z
zGlY=LutYM$5SlqqlNc8lHZw$!%&<Z>18Xux%_OiiCWd5&HL@Al(<u)&cSs<aVS{W2
z_H@dN%?v3dGi;H~z@AR|u$du)WQHBG8Q9Y)KQ=Sukj$`0HUoP)6~JbO0+JaH$Yx+q
zr-InbP(m`p5!npv=~M`t87fF-I3b&XJ)H_;GeZr@3}+-WjIgIu5o~5?AerHUYzFpp
zDvHevEhIBsk<GxKPQ|d9p@U?G8?qVL)2TQ%GxU(ma7Q)+dpecCW`+Th86L=HU{9x#
z*vv3OGQ$(u4D9Jt3Y!@wNM?8;n}I!@N@Fv_49N^{WHYd*QyFY#SRk3<gKP%&bSjI@
z3@aove38sB#-2{)u$f_lWQHHI8Q9aQJT^1zkj(Ihn&HXfV+3n`1o#CQI2*XZ8y^8d
z!Ge5T+~9VOGFUyN5rZlw!WJJK6wDai1U3rl92BD%IpUFxQo&*rL=0|}7syr6+=F5i
zs4;?UmMRvrAY!OyL30tRS<I;JQo~{vL=0}0Z)<=vtaJgH<!E5Rz!C54>B0-)88dLi
zJ30ArDS(@lASyT{NKleXtbn0{A&EhO!G$4}p^PDuA(<hSfdQly+&Bve3K8}x=4ue)
zX5s$-p8*sj3=lS>kCA~PgAfl$oQuiF$iN83VfHaHFlG?qW#Re%pOFEi#}Li~=`vyv
z;)BS6^%*0$Ae{zKwM<~0MsOZTCrl|516Zd4R3{Sy7f2_}7G|(cm<yO0KssScnISq2
zp*oo%I$^f3fOW!Lzyj6@Q_2F-33EIPL?_G^R<KT(3s}KAVM<vcI$@4yh3JIY!Uom}
za{(JzCrl|DL?_JgY!IC=TiC%mVJ=_?>x3y~hv<Yko*kkSW(x;cC(H#LV4X0f91xu_
z$8$h*!ffFL>x8+06RZ=aloO&8=6FtsPM9rRV4W}*aDjEglyX6I!W_>9(FwDK8>|!N
z0&cKQm{M+tPMG7lAv$5U@PKu~T)+d?2~)}g(Ft=r4@4)-7GAJUm<xEpI$=tAAv$4>
z=Y{Bm*}@0b33CA-SSL&=A4Dh2@q7@SFkAS+I$<v02kV3><%j5mIi4S)6K0D5SSQQ{
z0$`mmr2-J0Fvkl(bi!;A1nY#kKoG1Grc@B36Xtk9h)$R-LSUUR7YKoM!juX@biy1j
z1knkzMHs9T<^o}`PMA_*h)$T}g&{g&wupdr!dxH%)(KN80?`R`ya+@m%ob6wPM8Zs
z!8&0|MIkz2ju(aKgxMkn)(LZg7+5DvsTf2j%<*CnoiJO(!8&0s5C`joDHVt4ggIUu
zq7!C|1Xw4`1rlJLFr^X@oiN8sKy<=vkp%06xj+)E6Q)!Wq7&wLNr+CEEmB~eFc(OH
zb;6WNL3F|#F9p#Fvqc)L6XpVGuuhm#X^2jk<E0@wVYbMCb;4XA1J(&sDg)68bG!^h
zC(IUEuuhl@WWhRNN@XEBVUCxD=!DrK2i6I5fgD&TOsO11C(QA35S=hv<iR>&E|3T7
zgejGW=!7|59-<R8&;lBs5#<u<;ALRqVPIfTU{GLSU|?jZWDxOTkM|FDX6ediaCQkd
zT;Rt#IYUsGOCZ|!w()m)8HZ`%C5{JducviobFnzPgd25bb8$Gkgc}!th=l3{F8PE7
z0+S|ZGS-5$gXIht2v3>}mWGH4fMg01Kq3oyAVMIc43}h!=*GJQ`?4%hgxGn({N&SM
z(<<MI;;(!q4?FuV;GCSrutboVkr6~NfLl<8)N70x8c?k<W@tdY#+ac26&qu)AqhzH
z3wvWs0MZx}01d~H(HJu{Fn~A443QgShRBUELzKoCSRJ%!#^?i9h-i#~mBP5pK49~~
zYC(-Luv#b&q!X5Dz>P7mQm{^NV+>&ns4)gM7OWH07(*xpH^#t9!8*Z>F@!Ck#u!*F
zSSP44hENJ_jDeMcb%GmX2wOmnF|b;&PEcbEp%mO011kmV1UJSIwtyOAV6|YKpvD+N
zDY!8PRtnY$Zj2#p0X4?JYQZ`|jWL8$aAORt6s!~67(>_sYK(!^f^~u#V+f_-#u!*B
zSSPqKhOh<H7z3*X>jX8%5K6&~F|bmwPH<xkVGF1+238B!32KZXl!6;$V5MN4;Kmrj
z7EoghtQM>j)EGl31vkdPO2In8jWL8RpvD+jEm$Y0F@{hIZj6DIf^~u$V+dP7jWMuV
zuuf28451X<7y~N>>jXE(5Vn9CV_>ylouI}TLMga02388z32uxbYymaKz-qxdL5(ql
zQgCAotQ4#h+!#aH0&0wb)q-_`8e<5h;KmqODOe}CF@~@O)EEP+1?vPg#t=%ujWMuN
zuugDe3}FkXF$Pu()(L8iA(Vm}V_>CVo#4h8!WK|t46GKc6Vw<(C<Qmhz)Hb7!HqG5
zEuh92SS?s5s4<363T}*nm4bDG8)FDtK#ei5TCh$~V+^4b+!zBZ1?vPi#t^oE8e?F!
zV4a}G7(ywyF$Pu&)(LKmA#4FP#=vU9Izf#wgi>&046GEa6Wka>*aB*dfz^U_f*NB8
zrQpUGSSeU1xG{#X1=JV=s|D)>HO3H1!HqGnQm{^NV+>&ns4)gs3)Ts0j3JbQ8)IOl
zV4dK`7{V4%V+^botP|82Lns9|#=uI!I>C)Gge{=P7+5V>C#W%oPzr90ft7-Ff*WH9
zTR@F5uv)NAP-6_C6x<jCD+TKWH^vaQfEr_9wP2l~#u!2=xG@G+3f2j3j3I0RHO9bd
z!8$>WF@#cZV+^bmtP|WA1K9!@BSLD734kWchGb(5K2->6UQjkNW<b5hm;n_VV+Pb}
zjCoB8aQ1|bXM#ct+sIh3t2<<T3_ijL8Xc48k_ljNX7FT4Wl&%+AbO0<0I6AKfZQwt
z&AdVf%$R))P?}|6b>O7T$iV0WRtQeJjG%r6SSgGP(h2L!fSP4swP2l0V4Wz<GO$y?
zI>F5{ge{<E8Q55`PEfN9p%mOK11kmV1UJhNwt$*tV6|YKpk^6DDY#h%RtnY$Zk8cz
z0X56OYQZ`|%`${iaI*}o6s!~6EJN4=YL<c3f^~wLWeBC<W*Jy1SSPqyhOh<HECZ_r
z>jX8+5K6(#GO$vxPH?jfVGF2P238B!32K%hl!BXOV5MN4;AR=Z7ErSctQM>j)GR|N
z1vksUO2In8%`${7pk^6ZEm$Y0S%y#wZkB<Sf^~wMWe8h9%`&iBuuf33451X<ECVYA
z>jXE;5VnAtWni^nouFnJLMgae2388z32v4lYymaPz-qxdLCrFRQgE{jtQ4#h+$=-b
z0&13l)q-_`nq>&3;AR<EDOe}CS%$C$)GPz51?vPg%MePz%`&i3uugEZ3}FkXSq4@M
z)(L8sA(VofWniUXo#18}!WK}o46GKc6Vxn2C<Qmmz)Hb7!Ob#+Eudx@SS?s5s9A<k
z3T~Exm4bDGn`H=FK+Q6+TCh$~vkajW+$;kt1?vPi%MiAJnq^?MV4a|58A2(zSq4@L
z)(LKwA#4FP%fM>EIzi1cgi>&`46GEa6WlCA*aB*nfz^U_f|_LrrQl{6SSeU1xLJm<
z1=K79s|D)>HOml6!Ob$TQm{^NvkYMis96S93)Ts0mLZgan`L07V4dJ*8NwD&vka^j
ztP|8MLns9|%fL#(I>F5{ge{<E8CWe?C#YG5Pzr9Aft7-Ff}3RsTR_b+uv)NAP_qo7
z6x=KWD+TKWH_H&VfSP4swP2l~W*I^$xLF2P3f2j3mLY5bHOs(i!8$?BGK5lavka^h
ztP|WUL)ZdpmVwoRb%L5@2&Ld=8CWS;C%9RLum#jC1FHq=1U1VLO2N%Cuu`y2aI*|#
zi-<tHvy&sk5<Uh71_98_Kct=J!Om3z8#QBK;0H-Ew2Lz^@PL*%F@U)L|NjFmSYTja
z_^;P4&cMjS3=#(6|Np_H9cZMjOB+cKNSL7kq~rg8h$65EgaC;Tv2i(HmLS()q{fXi
zcySkK%+Z+30K@0t(Eb1azdR_EA$|sv0w5B!R?LY#Mh~<a&E3@{9<nM2vJ}k_G<_KA
z>B8&o>H?Y@gipURGirk8CZii%gIwJico-NsIJsD&8@WMTXV+j?9|aNFc-OEH&H@l8
zVS&Kp>I5#(kWpJec#soULv)iQhyk$-)I4)GaE3O*1YEfxt^u{*M7&vDU4ngi7nn`X
zVki(~W@JcMAT<g5=;e}x1?*EZxtNwD6mT_mBrq^6Nmw8=Ig5+EK!}xzftMknpt&Q5
zfg!OV5h5Ag#2sv45YG|s=n}*b-6RuiU;*LqfYJ||EPt>eR4ESw0~14Z6MwKFLOC-7
E0Qi|ec>n+a

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..53d4c07f423886d8c4b57f1da6498eef5a08b556 100644
GIT binary patch
literal 10230
zcmZ<>b_w~W&cML*z{%g)BUr&HBEVTeK|z6$fq?<U2GIiDg-kK=!A|kfO;XMV1_m7Q
z9-c0|j?Mv|1_lP^3>@*Ho-Pd0O;*nSzA(8UUk?KVLqn(>N4#@Tu%Hx|cpE1J$Usg8
z0S1OnHU>sUMFs|jN`~kr3%77*H;B1`uD+oL1_nk99Pz;+j$GUv@y^bUj1VIPx%ePP
zFmXyibvm+y1;L!;;}_&_U|?X1uokWpVL2BA6V!48WFrhAwxb#WvKGS#CI*BNhEOA%
zK&~*tW&{@#vIk(!U_mm&2-yr{tY$D{GlLDu3}a+7Ot6~4g3SyLBr{Bq%`nAk1}io*
zxRA^+MK;3>s~K$A%-}&X!wlIBbF5~tV>5#f$qaL3Gc2&0!GX;T0VFdlkj=2fY6d4Z
zGlY=LutYM$5SlqqlNc8lHZw$!%&<Z>18Xux%_OiiCWd5&HL@Al(<u)&cSs<aVS{W2
z_H@dN%?v3dGi;H~z@AR|u$du)WQHBG8Q9Y)KQ=Sukj$`0HUoP)6~JbO0+JaH$Yx+q
zr-InbP(m`p5!npv=~M`t87fF-I3b&XJ)H_;GeZr@3}+-WjIgIu5o~5?AerHUYzFpp
zDvHevEhIBsk<GxKPQ|d9p@U?G8?qVL)2TQ%GxU(ma7Q)+dpecCW`+Th86L=HU{9x#
z*vv3OGQ$(u4D9Jt3Y!@wNM?8;n}I!@N@Fv_49N^{WHYd*QyFY#SRk3<gKP%&bSjI@
z3@aove38sB#-2{)u$f_lWQHHI8Q9aQJT^1zkj(Ihn&HXfV+3n`1o#CQI2*XZ8y^8d
z!Ge5T+~9VOGFUyN5rZlw!WJJK6wDai1U3rl92BD%IpUFxQo&*rL=0|}7syr6+=F5i
zs4;?UmMRvrAY!OyL30tRS<I;JQo~{vL=0}0Z)<=vtaJgH<!E5Rz!C54>B0-)88dLi
zJ30ArDS(@lASyT{NKleXtbn0{A&EhO!G$4}p^PDuA(<hSfdQly+&Bve3K8}x=4ue)
zX5s$-p8*sj3=lS>kCA~PgAfl$oQuiF$iN83VfHaHFlG?qW#Re%pOFEi#}Li~=`vyv
z;)BS6^%*0$Ae{zKwM<~0MsOZTCrl|516Zd4R3{Sy7f2_}7G|(cm<yO0KssScnISq2
zp*oo%I$^f3fOW!Lzyj6@Q_2F-33EIPL?_G^R<KT(3s}KAVM<vcI$@4yh3JIY!Uom}
za{(JzCrl|DL?_JgY!IC=TiC%mVJ=_?>x3y~hv<Yko*kkSW(x;cC(H#LV4X0f91xu_
z$8$h*!ffFL>x8+06RZ=aloO&8=6FtsPM9rRV4W}*aDjEglyX6I!W_>9(FwDK8>|!N
z0&cKQm{M+tPMG7lAv$5U@PKu~T)+d?2~)}g(Ft=r4@4)-7GAJUm<xEpI$=tAAv$4>
z=Y{Bm*}@0b33CA-SSL&=A4Dh2@q7@SFkAS+I$<v02kV3><%j5mIi4S)6K0D5SSQQ{
z0$`mmr2-J0Fvkl(bi!;A1nY#kKoG1Grc@B36Xtk9h)$R-LSUUR7YKoM!juX@biy1j
z1knkzMHs9T<^o}`PMA_*h)$T}g&{g&wupdr!dxH%)(KN80?`R`ya+@m%ob6wPM8Zs
z!8&0|MIkz2ju(aKgxMkn)(LZg7+5DvsTf2j%<*CnoiJO(!8&0s5C`joDHVt4ggIUu
zq7!C|1Xw4`1rlJLFr^X@oiN8sKy<=vkp%06xj+)E6Q)!Wq7&wLNr+CEEmB~eFc(OH
zb;6WNL3F|#F9p#Fvqc)L6XpVGuuhm#X^2jk<E0@wVYbMCb;4XA1J(&sDg)68bG!^h
zC(IUEuuhl@WWhRNN@XEBVUCxD=!DrK2i6I5fgD&TOsO11C(QA35S=hv<iR>&E|3T7
zgejGW=!7|59-<R8&;lBs5#<u<;ALRqVPIfTU{GLSU|?jZWDxOTkM|FDX6ediaCQkd
zT;Rt#IYUsGOCZ|!w()m)8HZ`%C5{JducviobFnzPgd25bb8$Gkgc}!th=l3{F8PE7
z0+S|ZGS-5$gXIht2v3>}mWGH4fMg01Kq3oyAVMIc43}h!=*GJQ`?4%hgxGn({N&SM
z(<<MI;;(!q4?FuV;GCSrutboVkr6~NfLl<8)N70x8c?k<W@tdY#+ac26&qu)AqhzH
z3wvWs0MZx}01d~H(HJu{Fn~A443QgShRBUELzKoCSRJ%!#^?i9h-i#~mBP5pK49~~
zYC(-Luv#b&q!X5Dz>P7mQm{^NV+>&ns4)gM7OWH07(*xpH^#t9!8*Z>F@!Ck#u!*F
zSSP44hENJ_jDeMcb%GmX2wOmnF|b;&PEcbEp%mO011kmV1UJSIwtyOAV6|YKpvD+N
zDY!8PRtnY$Zj2#p0X4?JYQZ`|jWL8$aAORt6s!~67(>_sYK(!^f^~u#V+f_-#u!*B
zSSPqKhOh<H7z3*X>jX8%5K6&~F|bmwPH<xkVGF1+238B!32KZXl!6;$V5MN4;Kmrj
z7EoghtQM>j)EGl31vkdPO2In8jWL8RpvD+jEm$Y0F@{hIZj6DIf^~u$V+dP7jWMuV
zuuf28451X<7y~N>>jXE(5Vn9CV_>ylouI}TLMga02388z32uxbYymaKz-qxdL5(ql
zQgCAotQ4#h+!#aH0&0wb)q-_`8e<5h;KmqODOe}CF@~@O)EEP+1?vPg#t=%ujWMuN
zuugDe3}FkXF$Pu()(L8iA(Vm}V_>CVo#4h8!WK|t46GKc6Vw<(C<Qmhz)Hb7!HqG5
zEuh92SS?s5s4<363T}*nm4bDG8)FDtK#ei5TCh$~V+^4b+!zBZ1?vPi#t^oE8e?F!
zV4a}G7(ywyF$Pu&)(LKmA#4FP#=vU9Izf#wgi>&046GEa6Wka>*aB*dfz^U_f*NB8
zrQpUGSSeU1xG{#X1=JV=s|D)>HO3H1!HqGnQm{^NV+>&ns4)gs3)Ts0j3JbQ8)IOl
zV4dK`7{V4%V+^botP|82Lns9|#=uI!I>C)Gge{=P7+5V>C#W%oPzr90ft7-Ff*WH9
zTR@F5uv)NAP-6_C6x<jCD+TKWH^vaQfEr_9wP2l~#u!2=xG@G+3f2j3j3I0RHO9bd
z!8$>WF@#cZV+^bmtP|WA1K9!@BSLD734kWchGb(5K2->6UQjkNW<b5hm;n_VV+Pb}
zjCoB8aQ1|bXM#ct+sIh3t2<<T3_ijL8Xc48k_ljNX7FT4Wl&%+AbO0<0I6AKfZQwt
z&AdVf%$R))P?}|6b>O7T$iV0WRtQeJjG%r6SSgGP(h2L!fSP4swP2l0V4Wz<GO$y?
zI>F5{ge{<E8Q55`PEfN9p%mOK11kmV1UJhNwt$*tV6|YKpk^6DDY#h%RtnY$Zk8cz
z0X56OYQZ`|%`${iaI*}o6s!~6EJN4=YL<c3f^~wLWeBC<W*Jy1SSPqyhOh<HECZ_r
z>jX8+5K6(#GO$vxPH?jfVGF2P238B!32K%hl!BXOV5MN4;AR=Z7ErSctQM>j)GR|N
z1vksUO2In8%`${7pk^6ZEm$Y0S%y#wZkB<Sf^~wMWe8h9%`&iBuuf33451X<ECVYA
z>jXE;5VnAtWni^nouFnJLMgae2388z32v4lYymaPz-qxdLCrFRQgE{jtQ4#h+$=-b
z0&13l)q-_`nq>&3;AR<EDOe}CS%$C$)GPz51?vPg%MePz%`&i3uugEZ3}FkXSq4@M
z)(L8sA(VofWniUXo#18}!WK}o46GKc6Vxn2C<Qmmz)Hb7!Ob#+Eudx@SS?s5s9A<k
z3T~Exm4bDGn`H=FK+Q6+TCh$~vkajW+$;kt1?vPi%MiAJnq^?MV4a|58A2(zSq4@L
z)(LKwA#4FP%fM>EIzi1cgi>&`46GEa6WlCA*aB*nfz^U_f|_LrrQl{6SSeU1xLJm<
z1=K79s|D)>HOml6!Ob$TQm{^NvkYMis96S93)Ts0mLZgan`L07V4dJ*8NwD&vka^j
ztP|8MLns9|%fL#(I>F5{ge{<E8CWe?C#YG5Pzr9Aft7-Ff}3RsTR_b+uv)NAP_qo7
z6x=KWD+TKWH_H&VfSP4swP2l~W*I^$xLF2P3f2j3mLY5bHOs(i!8$?BGK5lavka^h
ztP|WUL)ZdpmVwoRb%L5@2&Ld=8CWS;C%9RLum#jC1FHq=1U1VLO2N%Cuu`y2aI*|#
zi-<tHvy&sk5<Uh71_98_Kct=J!Om3z8#QBK;0H-Ew2Lz^@PL*%F@U)L|NjFmSYTja
z_^;P4&cMjS3=#(6|Np_H9cZMjOB+cKNSL7kq~rg8h$65EgaC;Tv2i(HmLS()q{fXi
zcySkK%+Z+30K@0t(Eb1azdR_EA$|sv0w5B!R?LY#Mh~<a&E3@{9<nM2vJ}k_G<_KA
z>B8&o>H?Y@gipURGirk8CZii%gIwJico-NsIJsD&8@WMTXV+j?9|aNFc-OEH&H@l8
zVS&Kp>I5#(kWpJec#soULv)iQhyk$-)I4)GaE3O*1YEfxt^u{*M7&vDU4ngi7nn`X
zVki(~W@JcMAT<g5=;e}x1?*EZxtNwD6mT_mBrq^6Nmw8=Ig5+EK!}xzftMknpt&Q5
zfg!OV5h5Ag#2sv45YG|s=n}*b-6RuiU;*LqfYJ||EPt>eR4ESw0~14Z6MwKFLOC-7
E0Qi|ec>n+a

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/aarch64/virt/IORT.smmuv3-dev b/tests/data/acpi/aarch64/virt/IORT.smmuv3-dev
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..67be268f62afbf2d9459540984da5e9340afdaaa 100644
GIT binary patch
literal 364
zcmebD4+_a)WME)E<>c?|5v<@85#X$#prF9Wz`y`vgJ>281_lELD3D+P2|+mwa1KiZ
z0}Dt3gk2!AJRl0h2hqrQ0s{lXL<R<i$qWn(laM7C7#RNlhX}yz1DVUj0I>&RE)!03
zr!X)uOl4qTn9jh!Fb!f1oJ2R5sf2-<nSp@;<Tn+l`3wvUAR(|G2QbON@E_^{4=A5O
mfPn$*L;(hd1u!ut28RE<3=9lRNZ};N!0`Va0|SE~LJR;A#Tfwr

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..41981a449fc306b80cccd87ddec3c593a8d72c07 100644
GIT binary patch
literal 276
zcmebD4+;@sWME+Saq@Te2v%^42yj+VP*7lGU|;~TK{PW11A_qr6i6_DgrFP-IEN*I
zfdwQ1!Y*K0R!$HF;)7^poW;Pvkj=orkjucpkb^A2z`*eTKSTg#A5#efGZO;?0}BHK
zg9-!OK9G~Z3LU^C1H*r)MIKN-g8%~q*eC%82Dlg#1H*q_1_lNuB>xC9F#LbVz`!7g
G5CZ^ox)K2Z

literal 0
HcmV?d00001

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 2e3e3ccdce..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,5 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
-"tests/data/acpi/aarch64/virt/IORT.smmuv3-legacy",
-"tests/data/acpi/aarch64/virt/IORT.smmuv3-dev",

From aaf042299acf83919862c7d7dd5fc36acf4e0671 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber@stgraber.org>
Date: Thu, 11 Sep 2025 13:14:15 +0100
Subject: [PATCH 0437/2396] hw/usb/network: Remove hardcoded 0x40 prefix in
 STRING_ETHADDR response
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

USB NICs have a "40:" prefix hardcoded for all MAC addresses when we
return the guest the MAC address if it queries the STRING_ETHADDR USB
string property.  This doesn't match what we use for the
OID_802_3_PERMANENT_ADDRESS or OID_802_3_CURRENT_ADDRESS OIDs for
NDIS, or the MAC address we actually use in the QEMU networking code
to send/receive packets for this device, or the NIC info string we
print for users.  In all those other places we directly use
s->conf.macaddr.a, which is the full thing the user asks for.

This overrides user-provided configuration and leads to an inconsistent
experience.

I couldn't find any documented reason (comment or git commits) for
this behavior.  It seems like everyone is just expecting the MAC
address to be fully passed through to the guest, but it isn't.

This may have been a debugging hack that accidentally made it through
to the accepted patch: it has been in the code since it was originally
added back in 2008.

This is also particularly problematic as the "40:" prefix isn't a
reserved prefix for MAC addresses (IEEE OUI).  There are a number of
valid allocations out there which use this prefix, meaning that QEMU
may be causing MAC address conflicts.

Cc: qemu-stable@nongnu.org
Fixes: 6c9f886ceae5b ("Add CDC-Ethernet usb NIC (original patch from Thomas Sailer)"
Signed-off-by: Stéphane Graber <stgraber@stgraber.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2951
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
[PMM: beef up commit message based on mailing list discussion]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/dev-network.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/usb/dev-network.c b/hw/usb/dev-network.c
index 81cc09dcac..1df2454181 100644
--- a/hw/usb/dev-network.c
+++ b/hw/usb/dev-network.c
@@ -1383,7 +1383,7 @@ static void usb_net_realize(USBDevice *dev, Error **errp)
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
     snprintf(s->usbstring_mac, sizeof(s->usbstring_mac),
              "%02x%02x%02x%02x%02x%02x",
-             0x40,
+             s->conf.macaddr.a[0],
              s->conf.macaddr.a[1],
              s->conf.macaddr.a[2],
              s->conf.macaddr.a[3],

From aa3c761c7095476acde9b7140cc1dfff2ee0e170 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 15 Sep 2025 11:48:03 -0700
Subject: [PATCH 0438/2396] tests/functional/x86_64: Accept a few locked pages
 in test_memlock.py

Startup of libgcrypt locks a small pool of pages -- by default 16k.
Testing for zero locked pages is isn't correct, while testing for
32k is a decent compromise.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/functional/x86_64/test_memlock.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/functional/x86_64/test_memlock.py b/tests/functional/x86_64/test_memlock.py
index 2b515ff979..81bce80b0c 100755
--- a/tests/functional/x86_64/test_memlock.py
+++ b/tests/functional/x86_64/test_memlock.py
@@ -37,7 +37,8 @@ class MemlockTest(QemuSystemTest):
 
         status = self.get_process_status_values(self.vm.get_pid())
 
-        self.assertTrue(status['VmLck'] == 0)
+        # libgcrypt may mlock a few pages
+        self.assertTrue(status['VmLck'] < 32)
 
     def test_memlock_on(self):
         self.common_vm_setup_with_memlock('on')

From a11d1847d5ef8a7db58e6d4e44f36fec708f0981 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 8 Sep 2025 15:19:11 +0100
Subject: [PATCH 0439/2396] .gitmodules: move u-boot mirrors to
 qemu-project-mirrors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To continue our GitLab Open Source Program license we need to pass an
automated license check for all repos under qemu-project. While U-Boot
is clearly GPLv2 rather than fight with the automated validation
script just move the mirror across to a separate project.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250908141911.2546063-1-alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 .gitmodules | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitmodules b/.gitmodules
index 73cae4cd4d..e27dfe8c2c 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -15,7 +15,7 @@
 	url = https://gitlab.com/qemu-project/qemu-palcode.git
 [submodule "roms/u-boot"]
 	path = roms/u-boot
-	url = https://gitlab.com/qemu-project/u-boot.git
+	url = https://gitlab.com/qemu-project-mirrors/u-boot.git
 [submodule "roms/skiboot"]
 	path = roms/skiboot
 	url = https://gitlab.com/qemu-project/skiboot.git
@@ -27,7 +27,7 @@
 	url = https://gitlab.com/qemu-project/seabios-hppa.git
 [submodule "roms/u-boot-sam460ex"]
 	path = roms/u-boot-sam460ex
-	url = https://gitlab.com/qemu-project/u-boot-sam460ex.git
+	url = https://gitlab.com/qemu-project-mirrors/u-boot-sam460ex.git
 [submodule "roms/edk2"]
 	path = roms/edk2
 	url = https://gitlab.com/qemu-project/edk2.git

From 4b948222c0801ddd428ca2e4260181ba35b219a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:31 +0100
Subject: [PATCH 0440/2396] checkpatch: cull trailing '*/' in SPDX check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Sometimes SPDX expressions appear inside C comments, and this
confuses checkpatch.pl. Drop the closing C comment characters
to avoid this.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-2-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/checkpatch.pl | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 833f20f555..91616c974f 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1368,6 +1368,9 @@ sub checkspdx {
     $expr =~ s/^\s*//g;
     $expr =~ s/\s*$//g;
 
+    # Cull C comment end
+    $expr =~ s/\*\/.*//;
+
     my @bits = split / +/, $expr;
 
     my $prefer = "GPL-2.0-or-later";

From acf7882d194562983fd7a85df5d4b99d15c81766 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:32 +0100
Subject: [PATCH 0441/2396] tracetool: eliminate trailing whitespace in C
 format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-3-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/format/c.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/tracetool/format/c.py b/scripts/tracetool/format/c.py
index 69edf0d588..7aa51cd41a 100644
--- a/scripts/tracetool/format/c.py
+++ b/scripts/tracetool/format/c.py
@@ -36,7 +36,7 @@ def generate(events, backend, group):
             '    .id = 0,',
             '    .name = \"%(name)s\",',
             '    .sstate = %(sstate)s,',
-            '    .dstate = &%(dstate)s ',
+            '    .dstate = &%(dstate)s',
             '};',
             event = e.api(e.QEMU_EVENT),
             name = e.name,

From 69e22a5e20518fbb68b892b2189d525cf9d90a3d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:33 +0100
Subject: [PATCH 0442/2396] tracetool: avoid space after "*" in arg types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU code style is to have no whitespace between "*" and the
arg name. Since generated trace code will soon be added to
git, make it comply with code style.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-4-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 2ae2e562d6..0f33758870 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -170,10 +170,16 @@ class Arguments:
 
     def __str__(self):
         """String suitable for declaring function arguments."""
+        def onearg(t, n):
+            if t[-1] == '*':
+                return "".join([t, n])
+            else:
+                return " ".join([t, n])
+
         if len(self._args) == 0:
             return "void"
         else:
-            return ", ".join([ " ".join([t, n]) for t,n in self._args ])
+            return ", ".join([ onearg(t, n) for t,n in self._args ])
 
     def __repr__(self):
         """Evaluable string representation for this object."""

From 52d1ec2929e5f43fe650bdbc85653e05f0aa9ffc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:34 +0100
Subject: [PATCH 0443/2396] tracetool: include SPDX-License-Identifier in
 generated files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While these files are auto-generated, a later commit will add
reference output to git, so having SPDX-License-Identifier is
desirable.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-5-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/format/c.py                | 1 +
 scripts/tracetool/format/d.py                | 3 ++-
 scripts/tracetool/format/h.py                | 1 +
 scripts/tracetool/format/log_stap.py         | 1 +
 scripts/tracetool/format/simpletrace_stap.py | 1 +
 scripts/tracetool/format/stap.py             | 1 +
 scripts/tracetool/format/ust_events_c.py     | 1 +
 scripts/tracetool/format/ust_events_h.py     | 1 +
 8 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/scripts/tracetool/format/c.py b/scripts/tracetool/format/c.py
index 7aa51cd41a..e473fb6c6e 100644
--- a/scripts/tracetool/format/c.py
+++ b/scripts/tracetool/format/c.py
@@ -22,6 +22,7 @@ def generate(events, backend, group):
     header = "trace-" + group + ".h"
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '',
         '#include "qemu/osdep.h"',
         '#include "qemu/module.h"',
diff --git a/scripts/tracetool/format/d.py b/scripts/tracetool/format/d.py
index ebfb714200..a5e096e214 100644
--- a/scripts/tracetool/format/d.py
+++ b/scripts/tracetool/format/d.py
@@ -39,7 +39,8 @@ def generate(events, backend, group):
     if not events and platform != "darwin":
         return
 
-    out('/* This file is autogenerated by tracetool, do not edit. */'
+    out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '',
         'provider qemu {')
 
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index ea126b07ea..a00ae475f7 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -19,6 +19,7 @@ def generate(events, backend, group):
     header = "trace/control.h"
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '',
         '#ifndef TRACE_%s_GENERATED_TRACERS_H' % group.upper(),
         '#define TRACE_%s_GENERATED_TRACERS_H' % group.upper(),
diff --git a/scripts/tracetool/format/log_stap.py b/scripts/tracetool/format/log_stap.py
index b49afababd..710d62bffe 100644
--- a/scripts/tracetool/format/log_stap.py
+++ b/scripts/tracetool/format/log_stap.py
@@ -88,6 +88,7 @@ def c_fmt_to_stap(fmt):
 
 def generate(events, backend, group):
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '')
 
     for event_id, e in enumerate(events):
diff --git a/scripts/tracetool/format/simpletrace_stap.py b/scripts/tracetool/format/simpletrace_stap.py
index 4f4633b4e6..72971133bf 100644
--- a/scripts/tracetool/format/simpletrace_stap.py
+++ b/scripts/tracetool/format/simpletrace_stap.py
@@ -22,6 +22,7 @@ def global_var_name(name):
 
 def generate(events, backend, group):
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '')
 
     for event_id, e in enumerate(events):
diff --git a/scripts/tracetool/format/stap.py b/scripts/tracetool/format/stap.py
index a218b0445c..4d77fbc11a 100644
--- a/scripts/tracetool/format/stap.py
+++ b/scripts/tracetool/format/stap.py
@@ -38,6 +38,7 @@ def generate(events, backend, group):
               if "disable" not in e.properties]
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '')
 
     for e in events:
diff --git a/scripts/tracetool/format/ust_events_c.py b/scripts/tracetool/format/ust_events_c.py
index deced9533d..569754a304 100644
--- a/scripts/tracetool/format/ust_events_c.py
+++ b/scripts/tracetool/format/ust_events_c.py
@@ -20,6 +20,7 @@ def generate(events, backend, group):
               if "disabled" not in e.properties]
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '',
         '#include "qemu/osdep.h"',
         '',
diff --git a/scripts/tracetool/format/ust_events_h.py b/scripts/tracetool/format/ust_events_h.py
index b99fe6896b..2a31fefeca 100644
--- a/scripts/tracetool/format/ust_events_h.py
+++ b/scripts/tracetool/format/ust_events_h.py
@@ -25,6 +25,7 @@ def generate(events, backend, group):
         include = "trace-ust.h"
 
     out('/* This file is autogenerated by tracetool, do not edit. */',
+        '/* SPDX-License-Identifier: GPL-2.0-or-later */',
         '',
         '#undef TRACEPOINT_PROVIDER',
         '#define TRACEPOINT_PROVIDER qemu',

From da949d495ddd4d36f2c9750eb4d70f4135018199 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:35 +0100
Subject: [PATCH 0444/2396] tracetool: add test suite for tracetool with
 reference output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When reviewing tracetool patches it is often very unclear what the
expected output will be for the generated backends. Compounding
this is that a default build will only enable the 'log' trace
backend, so developers won't see generated code for other backends
without making a special effort. Some backends are also platform
specific, so can't be enabled in QEMU builds, even though tracetool
could generate the code.

To address this, introduce a test suite for tracetool which is
conceptually similar to the qapi-schema test. It is a simple
python program that runs tracetool and compares the actual output
to historical reference output kept in git. The test directly
emits TAP format logs for ease of integration with meson.

This can be run with

  make check-tracetool

to make it easier for developers changing generated output, the
sample expected content can be auto-recreated

  QEMU_TEST_REGENERATE=1 make check-tracetool

and the changes reviewed and added to the commit. This will also
assist reviewers interpreting the change.

Developers are reminded of this in the test output on failure:

  $ make check-tracetool
  1/6 qemu:tracetool / dtrace        OK              0.14s
  2/6 qemu:tracetool / ftrace        FAIL            0.06s   exit status 1
  ――――――――――――――――――――――――――――――――――――――――――――――――――――――――――
  1..2
  ok 1 - ftrace.c
  #
  not ok 1 - ftrace.h (set QEMU_TEST_REGENERATE=1 to recreate reference output if tracetool generator was intentionally changed)
  ――――――――――――――――――――――――――――――――――――――――――――――――――――――――――

  3/6 qemu:tracetool / log           OK              0.06s
  4/6 qemu:tracetool / simple        OK              0.06s
  5/6 qemu:tracetool / syslog        OK              0.06s
  6/6 qemu:tracetool / ust           OK              0.11s

  Summary of Failures:

  2/6 qemu:tracetool / ftrace FAIL            0.06s   exit status 1

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-6-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 MAINTAINERS                             |   1 +
 docs/devel/testing/main.rst             |  28 +++++++
 tests/Makefile.include                  |   1 +
 tests/meson.build                       |   1 +
 tests/tracetool/dtrace.c                |  32 ++++++++
 tests/tracetool/dtrace.d                |  10 +++
 tests/tracetool/dtrace.h                |  59 +++++++++++++
 tests/tracetool/dtrace.log-stap         |  15 ++++
 tests/tracetool/dtrace.simpletrace-stap |  16 ++++
 tests/tracetool/dtrace.stap             |  14 ++++
 tests/tracetool/ftrace.c                |  32 ++++++++
 tests/tracetool/ftrace.h                |  73 ++++++++++++++++
 tests/tracetool/log.c                   |  32 ++++++++
 tests/tracetool/log.h                   |  57 +++++++++++++
 tests/tracetool/meson.build             |  28 +++++++
 tests/tracetool/simple.c                |  61 ++++++++++++++
 tests/tracetool/simple.h                |  54 ++++++++++++
 tests/tracetool/syslog.c                |  32 ++++++++
 tests/tracetool/syslog.h                |  57 +++++++++++++
 tests/tracetool/trace-events            |   5 ++
 tests/tracetool/tracetool-test.py       | 105 ++++++++++++++++++++++++
 tests/tracetool/ust.c                   |  32 ++++++++
 tests/tracetool/ust.h                   |  55 +++++++++++++
 tests/tracetool/ust.ust-events-c        |  14 ++++
 tests/tracetool/ust.ust-events-h        |  56 +++++++++++++
 25 files changed, 870 insertions(+)
 create mode 100644 tests/tracetool/dtrace.c
 create mode 100644 tests/tracetool/dtrace.d
 create mode 100644 tests/tracetool/dtrace.h
 create mode 100644 tests/tracetool/dtrace.log-stap
 create mode 100644 tests/tracetool/dtrace.simpletrace-stap
 create mode 100644 tests/tracetool/dtrace.stap
 create mode 100644 tests/tracetool/ftrace.c
 create mode 100644 tests/tracetool/ftrace.h
 create mode 100644 tests/tracetool/log.c
 create mode 100644 tests/tracetool/log.h
 create mode 100644 tests/tracetool/meson.build
 create mode 100644 tests/tracetool/simple.c
 create mode 100644 tests/tracetool/simple.h
 create mode 100644 tests/tracetool/syslog.c
 create mode 100644 tests/tracetool/syslog.h
 create mode 100644 tests/tracetool/trace-events
 create mode 100755 tests/tracetool/tracetool-test.py
 create mode 100644 tests/tracetool/ust.c
 create mode 100644 tests/tracetool/ust.h
 create mode 100644 tests/tracetool/ust.ust-events-c
 create mode 100644 tests/tracetool/ust.ust-events-h

diff --git a/MAINTAINERS b/MAINTAINERS
index fb045388b9..f8cd513d8b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3562,6 +3562,7 @@ F: scripts/tracetool/
 F: scripts/qemu-trace-stap*
 F: docs/tools/qemu-trace-stap.rst
 F: docs/devel/tracing.rst
+F: tests/tracetool/
 T: git https://github.com/stefanha/qemu.git tracing
 
 Simpletrace
diff --git a/docs/devel/testing/main.rst b/docs/devel/testing/main.rst
index 2b5cb0c148..11f05c0006 100644
--- a/docs/devel/testing/main.rst
+++ b/docs/devel/testing/main.rst
@@ -178,6 +178,34 @@ parser (either fixing a bug or extending/modifying the syntax). To do this:
 
   ``qapi-schema += foo.json``
 
+.. _tracetool-tests:
+
+Tracetool tests
+~~~~~~~~~~~~~~~
+
+The tracetool tests validate the generated source files used for defining
+probes for various tracing backends and source formats. The test operates
+by running the tracetool program against a sample trace-events file, and
+comparing the generated output against known good reference output. The
+tests can be run with:
+
+.. code::
+
+  make check-tracetool
+
+The reference output is stored in files under tests/tracetool, and when
+the tracetool backend/format output is intentionally changed, the reference
+files need to be updated. This can be automated by setting the
+QEMU_TEST_REGENERATE=1 environment variable:
+
+.. code::
+
+   QEMU_TEST_REGENERATE=1 make check-tracetool
+
+The resulting changes must be reviewed by the author to ensure they match
+the intended results, before adding the updated reference output to the
+same commit that alters the generator code.
+
 check-block
 ~~~~~~~~~~~
 
diff --git a/tests/Makefile.include b/tests/Makefile.include
index 23fb722d42..3538c0c740 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -13,6 +13,7 @@ check-help:
 	@echo " $(MAKE) check-functional-TARGET  Run functional tests for a given target"
 	@echo " $(MAKE) check-unit               Run qobject tests"
 	@echo " $(MAKE) check-qapi-schema        Run QAPI schema tests"
+	@echo " $(MAKE) check-tracetool          Run tracetool generator tests"
 	@echo " $(MAKE) check-block              Run block tests"
 ifneq ($(filter $(all-check-targets), check-softfloat),)
 	@echo " $(MAKE) check-tcg                Run TCG tests"
diff --git a/tests/meson.build b/tests/meson.build
index c59619220f..cbe7916241 100644
--- a/tests/meson.build
+++ b/tests/meson.build
@@ -88,3 +88,4 @@ subdir('qapi-schema')
 subdir('qtest')
 subdir('migration-stress')
 subdir('functional')
+subdir('tracetool')
diff --git a/tests/tracetool/dtrace.c b/tests/tracetool/dtrace.c
new file mode 100644
index 0000000000..9f862fa14d
--- /dev/null
+++ b/tests/tracetool/dtrace.c
@@ -0,0 +1,32 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
diff --git a/tests/tracetool/dtrace.d b/tests/tracetool/dtrace.d
new file mode 100644
index 0000000000..5cc06f9f4f
--- /dev/null
+++ b/tests/tracetool/dtrace.d
@@ -0,0 +1,10 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+provider qemu {
+
+probe test_blah(void * context,const char * filename);
+
+probe test_wibble(void * context,int value);
+
+};
diff --git a/tests/tracetool/dtrace.h b/tests/tracetool/dtrace.h
new file mode 100644
index 0000000000..c2e5110672
--- /dev/null
+++ b/tests/tracetool/dtrace.h
@@ -0,0 +1,59 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+#ifndef SDT_USE_VARIADIC
+#define SDT_USE_VARIADIC 1
+#endif
+#include "trace-dtrace-testsuite.h"
+
+#undef SDT_USE_VARIADIC
+#ifndef QEMU_TEST_BLAH_ENABLED
+#define QEMU_TEST_BLAH_ENABLED() true
+#endif
+#ifndef QEMU_TEST_WIBBLE_ENABLED
+#define QEMU_TEST_WIBBLE_ENABLED() true
+#endif
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    QEMU_TEST_BLAH_ENABLED() || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    QEMU_TEST_BLAH(context, filename);
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    QEMU_TEST_WIBBLE_ENABLED() || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    QEMU_TEST_WIBBLE(context, value);
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/dtrace.log-stap b/tests/tracetool/dtrace.log-stap
new file mode 100644
index 0000000000..092986e0b6
--- /dev/null
+++ b/tests/tracetool/dtrace.log-stap
@@ -0,0 +1,15 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+probe qemu.log.test_blah = qemu.test_blah ?
+{
+    try {
+        argfilename_str = filename ? user_string_n(filename, 512) : "<null>"
+    } catch {}
+    printf("%d@%d test_blah Blah context=%p filename=%s\n", pid(), gettimeofday_ns(), context, argfilename_str)
+}
+probe qemu.log.test_wibble = qemu.test_wibble ?
+{
+    printf("%d@%d test_wibble Wibble context=%p value=%d\n", pid(), gettimeofday_ns(), context, value)
+}
+
diff --git a/tests/tracetool/dtrace.simpletrace-stap b/tests/tracetool/dtrace.simpletrace-stap
new file mode 100644
index 0000000000..d064e3e286
--- /dev/null
+++ b/tests/tracetool/dtrace.simpletrace-stap
@@ -0,0 +1,16 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+probe qemu.simpletrace.test_blah = qemu.test_blah ?
+{
+    try {
+        argfilename_str = filename ? user_string_n(filename, 512) : "<null>"
+    } catch {}
+    argfilename_len = strlen(argfilename_str)
+    printf("%8b%8b%8b%4b%4b%8b%4b%.*s", 1, 0, gettimeofday_ns(), 24 + 8 + 4 + argfilename_len, pid(), context, argfilename_len, argfilename_len, argfilename_str)
+}
+probe qemu.simpletrace.test_wibble = qemu.test_wibble ?
+{
+    printf("%8b%8b%8b%4b%4b%8b%8b", 1, 1, gettimeofday_ns(), 24 + 8 + 8, pid(), context, value)
+}
+
diff --git a/tests/tracetool/dtrace.stap b/tests/tracetool/dtrace.stap
new file mode 100644
index 0000000000..9c5d8a527c
--- /dev/null
+++ b/tests/tracetool/dtrace.stap
@@ -0,0 +1,14 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+probe qemu.test_blah = process("qemu").mark("test_blah")
+{
+  context = $arg1;
+  filename = $arg2;
+}
+probe qemu.test_wibble = process("qemu").mark("test_wibble")
+{
+  context = $arg1;
+  value = $arg2;
+}
+
diff --git a/tests/tracetool/ftrace.c b/tests/tracetool/ftrace.c
new file mode 100644
index 0000000000..9f862fa14d
--- /dev/null
+++ b/tests/tracetool/ftrace.c
@@ -0,0 +1,32 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
diff --git a/tests/tracetool/ftrace.h b/tests/tracetool/ftrace.h
new file mode 100644
index 0000000000..f1ff3b0a62
--- /dev/null
+++ b/tests/tracetool/ftrace.h
@@ -0,0 +1,73 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+#include "trace/ftrace.h"
+
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    {
+        char ftrace_buf[MAX_TRACE_STRLEN];
+        int unused __attribute__ ((unused));
+        int trlen;
+        if (trace_event_get_state(TRACE_TEST_BLAH)) {
+#line 4 "trace-events"
+            trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,
+                             "test_blah " "Blah context=%p filename=%s" "\n" , context, filename);
+#line 33 "ftrace.h"
+            trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
+            unused = write(trace_marker_fd, ftrace_buf, trlen);
+        }
+    }
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    {
+        char ftrace_buf[MAX_TRACE_STRLEN];
+        int unused __attribute__ ((unused));
+        int trlen;
+        if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
+#line 5 "trace-events"
+            trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,
+                             "test_wibble " "Wibble context=%p value=%d" "\n" , context, value);
+#line 61 "ftrace.h"
+            trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
+            unused = write(trace_marker_fd, ftrace_buf, trlen);
+        }
+    }
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/log.c b/tests/tracetool/log.c
new file mode 100644
index 0000000000..9f862fa14d
--- /dev/null
+++ b/tests/tracetool/log.c
@@ -0,0 +1,32 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
diff --git a/tests/tracetool/log.h b/tests/tracetool/log.h
new file mode 100644
index 0000000000..4293f1010e
--- /dev/null
+++ b/tests/tracetool/log.h
@@ -0,0 +1,57 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+#include "qemu/log-for-trace.h"
+
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    if (trace_event_get_state(TRACE_TEST_BLAH) && qemu_loglevel_mask(LOG_TRACE)) {
+#line 4 "trace-events"
+        qemu_log("test_blah " "Blah context=%p filename=%s" "\n", context, filename);
+#line 28 "log.h"
+    }
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    if (trace_event_get_state(TRACE_TEST_WIBBLE) && qemu_loglevel_mask(LOG_TRACE)) {
+#line 5 "trace-events"
+        qemu_log("test_wibble " "Wibble context=%p value=%d" "\n", context, value);
+#line 48 "log.h"
+    }
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/meson.build b/tests/tracetool/meson.build
new file mode 100644
index 0000000000..09bbaaa86b
--- /dev/null
+++ b/tests/tracetool/meson.build
@@ -0,0 +1,28 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_env = environment()
+test_env.set('PYTHONPATH', meson.project_source_root() / 'scripts')
+test_env.set('PYTHONIOENCODING', 'utf-8')
+
+backends = [
+    'dtrace',
+    'ftrace',
+    'log',
+    'simple',
+    'syslog',
+    'ust'
+]
+
+# The tracetool-test.py program has portability problems on Windows.
+if host_machine.system() != 'windows'
+    foreach backend: backends
+        test(backend,
+             python,
+             args: [meson.current_source_dir() / 'tracetool-test.py',
+                    meson.project_source_root() / 'scripts' / 'tracetool.py',
+                    backend,
+                    meson.current_source_dir(),
+                    meson.current_build_dir()],
+             suite: ['tracetool'])
+    endforeach
+endif
diff --git a/tests/tracetool/simple.c b/tests/tracetool/simple.c
new file mode 100644
index 0000000000..0484177481
--- /dev/null
+++ b/tests/tracetool/simple.c
@@ -0,0 +1,61 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
+#include "qemu/osdep.h"
+#include "trace/control.h"
+#include "trace/simple.h"
+
+void _simple_trace_test_blah(void *context, const char *filename)
+{
+    TraceBufferRecord rec;
+    size_t argfilename_len = filename ? MIN(strlen(filename), MAX_TRACE_STRLEN) : 0;
+
+    if (trace_record_start(&rec, _TRACE_TEST_BLAH_EVENT.id, 8 + 4 + argfilename_len)) {
+        return; /* Trace Buffer Full, Event Dropped ! */
+    }
+    trace_record_write_u64(&rec, (uintptr_t)(uint64_t *)context);
+    trace_record_write_str(&rec, filename, argfilename_len);
+    trace_record_finish(&rec);
+}
+
+void _simple_trace_test_wibble(void *context, int value)
+{
+    TraceBufferRecord rec;
+
+    if (trace_record_start(&rec, _TRACE_TEST_WIBBLE_EVENT.id, 8 + 8)) {
+        return; /* Trace Buffer Full, Event Dropped ! */
+    }
+    trace_record_write_u64(&rec, (uintptr_t)(uint64_t *)context);
+    trace_record_write_u64(&rec, (uint64_t)value);
+    trace_record_finish(&rec);
+}
+
diff --git a/tests/tracetool/simple.h b/tests/tracetool/simple.h
new file mode 100644
index 0000000000..3c9de68c43
--- /dev/null
+++ b/tests/tracetool/simple.h
@@ -0,0 +1,54 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+void _simple_trace_test_blah(void *context, const char *filename);
+void _simple_trace_test_wibble(void *context, int value);
+
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    if (trace_event_get_state(TRACE_TEST_BLAH)) {
+        _simple_trace_test_blah(context, filename);
+    }
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
+        _simple_trace_test_wibble(context, value);
+    }
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/syslog.c b/tests/tracetool/syslog.c
new file mode 100644
index 0000000000..9f862fa14d
--- /dev/null
+++ b/tests/tracetool/syslog.c
@@ -0,0 +1,32 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
diff --git a/tests/tracetool/syslog.h b/tests/tracetool/syslog.h
new file mode 100644
index 0000000000..498bbfb99e
--- /dev/null
+++ b/tests/tracetool/syslog.h
@@ -0,0 +1,57 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+#include <syslog.h>
+
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    if (trace_event_get_state(TRACE_TEST_BLAH)) {
+#line 4 "trace-events"
+        syslog(LOG_INFO, "test_blah " "Blah context=%p filename=%s" , context, filename);
+#line 28 "syslog.h"
+    }
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
+#line 5 "trace-events"
+        syslog(LOG_INFO, "test_wibble " "Wibble context=%p value=%d" , context, value);
+#line 48 "syslog.h"
+    }
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/trace-events b/tests/tracetool/trace-events
new file mode 100644
index 0000000000..72cf4d6f70
--- /dev/null
+++ b/tests/tracetool/trace-events
@@ -0,0 +1,5 @@
+# See docs/devel/tracing.rst for syntax documentation.
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+test_blah(void *context, const char *filename) "Blah context=%p filename=%s"
+test_wibble(void *context, int value) "Wibble context=%p value=%d"
diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
new file mode 100755
index 0000000000..a420597fc4
--- /dev/null
+++ b/tests/tracetool/tracetool-test.py
@@ -0,0 +1,105 @@
+#!/usr/bin/python3
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+from pathlib import Path
+from shutil import copyfile
+from subprocess import check_call
+import sys
+
+
+def get_formats(backend):
+    formats = [
+        "c",
+        "h",
+    ]
+    if backend == "dtrace":
+        formats += [
+            "d",
+            "log-stap",
+            "simpletrace-stap",
+            "stap",
+        ]
+    if backend == "ust":
+        formats += [
+            "ust-events-c",
+            "ust-events-h",
+        ]
+    return formats
+
+
+def test_tracetool_one(tracetool, backend, fmt, src_dir, build_dir):
+    rel_filename = backend + "." + fmt
+    actual_file = Path(build_dir, rel_filename)
+    expect_file = Path(src_dir, rel_filename)
+
+    args = [tracetool, f"--format={fmt}", f"--backends={backend}", "--group=testsuite"]
+
+    if fmt.find("stap") != -1:
+        args += ["--binary=qemu", "--probe-prefix=qemu"]
+
+    # Use relative files for both, as these filenames end
+    # up in '#line' statements in the output
+    args += ["trace-events", rel_filename]
+
+    try:
+        check_call(args, cwd=build_dir)
+        actual = actual_file.read_text()
+    finally:
+        actual_file.unlink()
+
+    if os.getenv("QEMU_TEST_REGENERATE", False):
+        print(f"# regenerate {expect_file}")
+        expect_file.write_text(actual)
+
+    expect = expect_file.read_text()
+
+    assert expect == actual
+
+
+def test_tracetool(tracetool, backend, source_dir, build_dir):
+    fail = False
+    scenarios = len(get_formats(backend))
+
+    print(f"1..{scenarios}")
+
+    src_events = Path(source_dir, "trace-events")
+    build_events = Path(build_dir, "trace-events")
+
+    try:
+        # We need a stable relative filename under build dir
+        # for the '#line' statements, so copy over the input
+        copyfile(src_events, build_events)
+
+        num = 1
+        for fmt in get_formats(backend):
+            status = "not ok"
+            hint = ""
+            try:
+                test_tracetool_one(tracetool, backend, fmt, source_dir, build_dir)
+                status = "ok"
+            except Exception as e:
+                print(f"# {e}")
+                fail = True
+                hint = (
+                    " (set QEMU_TEST_REGENERATE=1 to recreate reference "
+                    + "output if tracetool generator was intentionally changed)"
+                )
+            finally:
+                print(f"{status} {num} - {backend}.{fmt}{hint}")
+    finally:
+        build_events.unlink()
+
+    return fail
+
+
+if __name__ == "__main__":
+    if len(sys.argv) != 5:
+        argv0 = sys.argv[0]
+        print("syntax: {argv0} TRACE-TOOL BACKEND SRC-DIR BUILD-DIR", file=sys.stderr)
+        sys.exit(1)
+
+    fail = test_tracetool(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
+    if fail:
+        sys.exit(1)
+    sys.exit(0)
diff --git a/tests/tracetool/ust.c b/tests/tracetool/ust.c
new file mode 100644
index 0000000000..9f862fa14d
--- /dev/null
+++ b/tests/tracetool/ust.c
@@ -0,0 +1,32 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "qemu/module.h"
+#include "trace-testsuite.h"
+
+uint16_t _TRACE_TEST_BLAH_DSTATE;
+uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+TraceEvent _TRACE_TEST_BLAH_EVENT = {
+    .id = 0,
+    .name = "test_blah",
+    .sstate = TRACE_TEST_BLAH_ENABLED,
+    .dstate = &_TRACE_TEST_BLAH_DSTATE
+};
+TraceEvent _TRACE_TEST_WIBBLE_EVENT = {
+    .id = 0,
+    .name = "test_wibble",
+    .sstate = TRACE_TEST_WIBBLE_ENABLED,
+    .dstate = &_TRACE_TEST_WIBBLE_DSTATE
+};
+TraceEvent *testsuite_trace_events[] = {
+    &_TRACE_TEST_BLAH_EVENT,
+    &_TRACE_TEST_WIBBLE_EVENT,
+  NULL,
+};
+
+static void trace_testsuite_register_events(void)
+{
+    trace_event_register_group(testsuite_trace_events);
+}
+trace_init(trace_testsuite_register_events)
diff --git a/tests/tracetool/ust.h b/tests/tracetool/ust.h
new file mode 100644
index 0000000000..1184ddd870
--- /dev/null
+++ b/tests/tracetool/ust.h
@@ -0,0 +1,55 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#ifndef TRACE_TESTSUITE_GENERATED_TRACERS_H
+#define TRACE_TESTSUITE_GENERATED_TRACERS_H
+
+#include "trace/control.h"
+
+extern TraceEvent _TRACE_TEST_BLAH_EVENT;
+extern TraceEvent _TRACE_TEST_WIBBLE_EVENT;
+extern uint16_t _TRACE_TEST_BLAH_DSTATE;
+extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
+#define TRACE_TEST_BLAH_ENABLED 1
+#define TRACE_TEST_WIBBLE_ENABLED 1
+#include <lttng/tracepoint.h>
+#include "trace-ust-testsuite.h"
+
+/* tracepoint_enabled() was introduced in LTTng UST 2.7 */
+#ifndef tracepoint_enabled
+#define tracepoint_enabled(a, b) true
+#endif
+
+
+#define TRACE_TEST_BLAH_BACKEND_DSTATE() ( \
+    tracepoint_enabled(qemu, test_blah) || \
+    false)
+
+static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+{
+    tracepoint(qemu, test_blah, context, filename);
+}
+
+static inline void trace_test_blah(void *context, const char *filename)
+{
+    if (true) {
+        _nocheck__trace_test_blah(context, filename);
+    }
+}
+
+#define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
+    tracepoint_enabled(qemu, test_wibble) || \
+    false)
+
+static inline void _nocheck__trace_test_wibble(void *context, int value)
+{
+    tracepoint(qemu, test_wibble, context, value);
+}
+
+static inline void trace_test_wibble(void *context, int value)
+{
+    if (true) {
+        _nocheck__trace_test_wibble(context, value);
+    }
+}
+#endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/ust.ust-events-c b/tests/tracetool/ust.ust-events-c
new file mode 100644
index 0000000000..db23224056
--- /dev/null
+++ b/tests/tracetool/ust.ust-events-c
@@ -0,0 +1,14 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+
+#define TRACEPOINT_DEFINE
+#define TRACEPOINT_CREATE_PROBES
+
+/* If gcc version 4.7 or older is used, LTTng ust gives a warning when compiling with
+   -Wredundant-decls.
+ */
+#pragma GCC diagnostic ignored "-Wredundant-decls"
+
+#include "trace-ust-all.h"
diff --git a/tests/tracetool/ust.ust-events-h b/tests/tracetool/ust.ust-events-h
new file mode 100644
index 0000000000..4621a995fc
--- /dev/null
+++ b/tests/tracetool/ust.ust-events-h
@@ -0,0 +1,56 @@
+/* This file is autogenerated by tracetool, do not edit. */
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#undef TRACEPOINT_PROVIDER
+#define TRACEPOINT_PROVIDER qemu
+
+#undef TRACEPOINT_INCLUDE
+#define TRACEPOINT_INCLUDE "./trace-ust.h"
+
+#if !defined (TRACE_TESTSUITE_GENERATED_UST_H) || \
+     defined(TRACEPOINT_HEADER_MULTI_READ)
+#define TRACE_TESTSUITE_GENERATED_UST_H
+
+#include <lttng/tracepoint.h>
+
+/*
+ * LTTng ust 2.0 does not allow you to use TP_ARGS(void) for tracepoints
+ * requiring no arguments. We define these macros introduced in more recent * versions of LTTng ust as a workaround
+ */
+#ifndef _TP_EXPROTO1
+#define _TP_EXPROTO1(a)               void
+#endif
+#ifndef _TP_EXDATA_PROTO1
+#define _TP_EXDATA_PROTO1(a)          void *__tp_data
+#endif
+#ifndef _TP_EXDATA_VAR1
+#define _TP_EXDATA_VAR1(a)            __tp_data
+#endif
+#ifndef _TP_EXVAR1
+#define _TP_EXVAR1(a)
+#endif
+
+TRACEPOINT_EVENT(
+   qemu,
+   test_blah,
+   TP_ARGS(void *, context, const char *, filename),
+   TP_FIELDS(
+       ctf_integer_hex(void *, context, context)
+       ctf_string(filename, filename)
+   )
+)
+
+TRACEPOINT_EVENT(
+   qemu,
+   test_wibble,
+   TP_ARGS(void *, context, int, value),
+   TP_FIELDS(
+       ctf_integer_hex(void *, context, context)
+       ctf_integer(int, value, value)
+   )
+)
+
+#endif /* TRACE_TESTSUITE_GENERATED_UST_H */
+
+/* This part must be outside ifdef protection */
+#include <lttng/tracepoint-event.h>

From c47db9b1db906bd05cf83e0d70df2beba2ef9eaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:36 +0100
Subject: [PATCH 0445/2396] tracetool: drop the probe "__nocheck__" wrapping
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every generated inline probe function is wrapped with a
trivial caller that has a hard-coded condition test:

  static inline void _nocheck__trace_test_wibble(void * context, int value)
  {
      tracepoint(qemu, test_wibble, context, value);
  }

  static inline void trace_test_wibble(void * context, int value)
  {
    if (true) {
        _nocheck__trace_test_wibble(context, value);
    }
  }

This was introduced for TCG probes back in

  864a2178: trace: [tcg] Do not generate TCG code to trace dynamically-disabled events

but is obsolete since

  126d4123 tracing: excise the tcg related from tracetool

This commit removes the wrapping such that we have

  static inline void trace_test_wibble(void * context, int value)
  {
      tracepoint(qemu, test_wibble, context, value);
  }

The default build of qemu-system-x86_64 on Fedora with the
'log' backend, has its size reduced by 1 MB

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-id: 20250916081638.764020-7-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py |  1 -
 scripts/tracetool/format/h.py | 16 +---------------
 tests/tracetool/dtrace.h      | 18 ++----------------
 tests/tracetool/ftrace.h      | 20 +++-----------------
 tests/tracetool/log.h         | 20 +++-----------------
 tests/tracetool/simple.h      | 18 ++----------------
 tests/tracetool/syslog.h      | 20 +++-----------------
 tests/tracetool/ust.h         | 18 ++----------------
 8 files changed, 16 insertions(+), 115 deletions(-)

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 0f33758870..1d5238a084 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -338,7 +338,6 @@ class Event(object):
         return self._FMT.findall(self.fmt)
 
     QEMU_TRACE               = "trace_%(name)s"
-    QEMU_TRACE_NOCHECK       = "_nocheck__" + QEMU_TRACE
     QEMU_TRACE_TCG           = QEMU_TRACE + "_tcg"
     QEMU_DSTATE              = "_TRACE_%(NAME)s_DSTATE"
     QEMU_BACKEND_DSTATE      = "TRACE_%(NAME)s_BACKEND_DSTATE"
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index a00ae475f7..b42a8268a8 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -64,7 +64,7 @@ def generate(events, backend, group):
         out('',
             'static inline void %(api)s(%(args)s)',
             '{',
-            api=e.api(e.QEMU_TRACE_NOCHECK),
+            api=e.api(),
             args=e.args)
 
         if "disable" not in e.properties:
@@ -72,20 +72,6 @@ def generate(events, backend, group):
 
         out('}')
 
-        cond = "true"
-
-        out('',
-            'static inline void %(api)s(%(args)s)',
-            '{',
-            '    if (%(cond)s) {',
-            '        %(api_nocheck)s(%(names)s);',
-            '    }',
-            '}',
-            api=e.api(),
-            api_nocheck=e.api(e.QEMU_TRACE_NOCHECK),
-            args=e.args,
-            names=", ".join(e.args.names()),
-            cond=cond)
 
     backend.generate_end(events, group)
 
diff --git a/tests/tracetool/dtrace.h b/tests/tracetool/dtrace.h
index c2e5110672..c8931a8d7b 100644
--- a/tests/tracetool/dtrace.h
+++ b/tests/tracetool/dtrace.h
@@ -29,31 +29,17 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
     QEMU_TEST_BLAH_ENABLED() || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
-{
-    QEMU_TEST_BLAH(context, filename);
-}
-
 static inline void trace_test_blah(void *context, const char *filename)
 {
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
+    QEMU_TEST_BLAH(context, filename);
 }
 
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     QEMU_TEST_WIBBLE_ENABLED() || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     QEMU_TEST_WIBBLE(context, value);
 }
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
-    }
-}
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/ftrace.h b/tests/tracetool/ftrace.h
index f1ff3b0a62..fe22ea0f09 100644
--- a/tests/tracetool/ftrace.h
+++ b/tests/tracetool/ftrace.h
@@ -19,7 +19,7 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
     trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+static inline void trace_test_blah(void *context, const char *filename)
 {
     {
         char ftrace_buf[MAX_TRACE_STRLEN];
@@ -36,18 +36,11 @@ static inline void _nocheck__trace_test_blah(void *context, const char *filename
     }
 }
 
-static inline void trace_test_blah(void *context, const char *filename)
-{
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
-}
-
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     {
         char ftrace_buf[MAX_TRACE_STRLEN];
@@ -57,17 +50,10 @@ static inline void _nocheck__trace_test_wibble(void *context, int value)
 #line 5 "trace-events"
             trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,
                              "test_wibble " "Wibble context=%p value=%d" "\n" , context, value);
-#line 61 "ftrace.h"
+#line 54 "ftrace.h"
             trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
             unused = write(trace_marker_fd, ftrace_buf, trlen);
         }
     }
 }
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
-    }
-}
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/log.h b/tests/tracetool/log.h
index 4293f1010e..edcc7f9d47 100644
--- a/tests/tracetool/log.h
+++ b/tests/tracetool/log.h
@@ -19,7 +19,7 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
     trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+static inline void trace_test_blah(void *context, const char *filename)
 {
     if (trace_event_get_state(TRACE_TEST_BLAH) && qemu_loglevel_mask(LOG_TRACE)) {
 #line 4 "trace-events"
@@ -28,30 +28,16 @@ static inline void _nocheck__trace_test_blah(void *context, const char *filename
     }
 }
 
-static inline void trace_test_blah(void *context, const char *filename)
-{
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
-}
-
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     if (trace_event_get_state(TRACE_TEST_WIBBLE) && qemu_loglevel_mask(LOG_TRACE)) {
 #line 5 "trace-events"
         qemu_log("test_wibble " "Wibble context=%p value=%d" "\n", context, value);
-#line 48 "log.h"
-    }
-}
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
+#line 41 "log.h"
     }
 }
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/simple.h b/tests/tracetool/simple.h
index 3c9de68c43..ec6fcb22c3 100644
--- a/tests/tracetool/simple.h
+++ b/tests/tracetool/simple.h
@@ -20,35 +20,21 @@ void _simple_trace_test_wibble(void *context, int value);
     trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+static inline void trace_test_blah(void *context, const char *filename)
 {
     if (trace_event_get_state(TRACE_TEST_BLAH)) {
         _simple_trace_test_blah(context, filename);
     }
 }
 
-static inline void trace_test_blah(void *context, const char *filename)
-{
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
-}
-
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
         _simple_trace_test_wibble(context, value);
     }
 }
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
-    }
-}
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/syslog.h b/tests/tracetool/syslog.h
index 498bbfb99e..ed4305554c 100644
--- a/tests/tracetool/syslog.h
+++ b/tests/tracetool/syslog.h
@@ -19,7 +19,7 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
     trace_event_get_state_dynamic_by_id(TRACE_TEST_BLAH) || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
+static inline void trace_test_blah(void *context, const char *filename)
 {
     if (trace_event_get_state(TRACE_TEST_BLAH)) {
 #line 4 "trace-events"
@@ -28,30 +28,16 @@ static inline void _nocheck__trace_test_blah(void *context, const char *filename
     }
 }
 
-static inline void trace_test_blah(void *context, const char *filename)
-{
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
-}
-
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     trace_event_get_state_dynamic_by_id(TRACE_TEST_WIBBLE) || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
 #line 5 "trace-events"
         syslog(LOG_INFO, "test_wibble " "Wibble context=%p value=%d" , context, value);
-#line 48 "syslog.h"
-    }
-}
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
+#line 41 "syslog.h"
     }
 }
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/tests/tracetool/ust.h b/tests/tracetool/ust.h
index 1184ddd870..b7acd0c39b 100644
--- a/tests/tracetool/ust.h
+++ b/tests/tracetool/ust.h
@@ -25,31 +25,17 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
     tracepoint_enabled(qemu, test_blah) || \
     false)
 
-static inline void _nocheck__trace_test_blah(void *context, const char *filename)
-{
-    tracepoint(qemu, test_blah, context, filename);
-}
-
 static inline void trace_test_blah(void *context, const char *filename)
 {
-    if (true) {
-        _nocheck__trace_test_blah(context, filename);
-    }
+    tracepoint(qemu, test_blah, context, filename);
 }
 
 #define TRACE_TEST_WIBBLE_BACKEND_DSTATE() ( \
     tracepoint_enabled(qemu, test_wibble) || \
     false)
 
-static inline void _nocheck__trace_test_wibble(void *context, int value)
+static inline void trace_test_wibble(void *context, int value)
 {
     tracepoint(qemu, test_wibble, context, value);
 }
-
-static inline void trace_test_wibble(void *context, int value)
-{
-    if (true) {
-        _nocheck__trace_test_wibble(context, value);
-    }
-}
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */

From 4b1e71591254a7e924b6b295868edc6550ed0420 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 16 Sep 2025 09:16:37 +0100
Subject: [PATCH 0446/2396] qapi: switch to use QEMU_TEST_REGENERATE env var
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QAPI_TEST_UPDATE env var can be set when running the QAPI
schema tests to regenerate the reference output. For consistent
naming with the tracetool test, change the env var name to
QEMU_TEST_REGENERATE.

The test is modified to provide a hint about use of the new
env var and it is also added to the developer documentation.document its usage.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20250916081638.764020-8-berrange@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/testing/main.rst    | 12 ++++++++++++
 tests/qapi-schema/test-qapi.py |  7 +++++--
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/docs/devel/testing/main.rst b/docs/devel/testing/main.rst
index 11f05c0006..0662766b5c 100644
--- a/docs/devel/testing/main.rst
+++ b/docs/devel/testing/main.rst
@@ -178,6 +178,18 @@ parser (either fixing a bug or extending/modifying the syntax). To do this:
 
   ``qapi-schema += foo.json``
 
+The reference output can be automatically updated to match the latest QAPI
+code generator by running the tests with the QEMU_TEST_REGENERATE environment
+variable set.
+
+.. code::
+
+   QEMU_TEST_REGENERATE=1 make check-qapi-schema
+
+The resulting changes must be reviewed by the author to ensure they match
+the intended results before adding the updated reference output to the
+same commit that alters the generator code.
+
 .. _tracetool-tests:
 
 Tracetool tests
diff --git a/tests/qapi-schema/test-qapi.py b/tests/qapi-schema/test-qapi.py
index 4be930228c..cf7fb8a6df 100755
--- a/tests/qapi-schema/test-qapi.py
+++ b/tests/qapi-schema/test-qapi.py
@@ -165,7 +165,7 @@ def test_and_diff(test_name, dir_name, update):
     if actual_out == expected_out and actual_err == expected_err:
         return 0
 
-    print("%s %s" % (test_name, 'UPDATE' if update else 'FAIL'),
+    print("%s: %s" % (test_name, 'UPDATE' if update else 'FAIL'),
           file=sys.stderr)
     out_diff = difflib.unified_diff(expected_out, actual_out, outfp.name)
     err_diff = difflib.unified_diff(expected_err, actual_err, errfp.name)
@@ -173,6 +173,9 @@ def test_and_diff(test_name, dir_name, update):
     sys.stdout.writelines(err_diff)
 
     if not update:
+        print(("\n%s: set QEMU_TEST_REGENERATE=1 to recreate reference output" +
+               "if the QAPI schema generator was intentionally changed") % test_name,
+              file=sys.stderr)
         return 1
 
     try:
@@ -197,7 +200,7 @@ def main(argv):
     parser.add_argument('-d', '--dir', action='store', default='',
                         help="directory containing tests")
     parser.add_argument('-u', '--update', action='store_true',
-                        default='QAPI_TEST_UPDATE' in os.environ,
+                        default='QEMU_TEST_REGENERATE' in os.environ,
                         help="update expected test results")
     parser.add_argument('tests', nargs='*', metavar='TEST', action='store')
     args = parser.parse_args()

From 2c27d8523927b0965b7b3d265eee3baf9a15c9c8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 16 Sep 2025 09:16:38 +0100
Subject: [PATCH 0447/2396] tracetool-test: allow to run in parallel
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Create a temporary build subdirectory, to avoid conflicting with other
running tests. This fixes "meson test" with tracetool-test which is
parallel default.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20250916081638.764020-9-berrange@redhat.com
Message-ID: <20250908114652.1880366-1-marcandre.lureau@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/tracetool/tracetool-test.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
index a420597fc4..65430fdedc 100755
--- a/tests/tracetool/tracetool-test.py
+++ b/tests/tracetool/tracetool-test.py
@@ -6,6 +6,7 @@ from pathlib import Path
 from shutil import copyfile
 from subprocess import check_call
 import sys
+import tempfile
 
 
 def get_formats(backend):
@@ -99,7 +100,8 @@ if __name__ == "__main__":
         print("syntax: {argv0} TRACE-TOOL BACKEND SRC-DIR BUILD-DIR", file=sys.stderr)
         sys.exit(1)
 
-    fail = test_tracetool(sys.argv[1], sys.argv[2], sys.argv[3], sys.argv[4])
-    if fail:
-        sys.exit(1)
+    with tempfile.TemporaryDirectory(prefix=sys.argv[4]) as tmpdir:
+        fail = test_tracetool(sys.argv[1], sys.argv[2], sys.argv[3], tmpdir)
+        if fail:
+            sys.exit(1)
     sys.exit(0)

From 588ffa75eba30baf75d1ba246c5f917e8716fcaa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 10:53:55 +0200
Subject: [PATCH 0448/2396] target/ppc: limit cpu_interrupt_exittb to system
 emulation

It is not used by user-mode emulation and is the only caller of
cpu_interrupt() in qemu-ppc* binaries.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/ppc/helper_regs.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 7e5726871e..5f21739749 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -274,6 +274,7 @@ TCGTBCPUState ppc_get_tb_cpu_state(CPUState *cs)
     return (TCGTBCPUState){ .pc = env->nip, .flags = hflags_current };
 }
 
+#ifndef CONFIG_USER_ONLY
 void cpu_interrupt_exittb(CPUState *cs)
 {
     /*
@@ -285,6 +286,7 @@ void cpu_interrupt_exittb(CPUState *cs)
         cpu_interrupt(cs, CPU_INTERRUPT_EXITTB);
     }
 }
+#endif
 
 int hreg_store_msr(CPUPPCState *env, target_ulong value, int alter_hv)
 {

From a445d3b85c4119aac7ecb7771b5da0709ee1f1a4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 10:53:55 +0200
Subject: [PATCH 0449/2396] target/sparc: limit cpu_check_irqs to system
 emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is not used by user-mode emulation and is the only caller of
cpu_interrupt() in qemu-sparc* binaries.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/sparc/int32_helper.c | 2 ++
 target/sparc/int64_helper.c | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/target/sparc/int32_helper.c b/target/sparc/int32_helper.c
index 39db4ffa70..fdcaa0a578 100644
--- a/target/sparc/int32_helper.c
+++ b/target/sparc/int32_helper.c
@@ -65,6 +65,7 @@ static const char *excp_name_str(int32_t exception_index)
     return excp_names[exception_index];
 }
 
+#if !defined(CONFIG_USER_ONLY)
 void cpu_check_irqs(CPUSPARCState *env)
 {
     CPUState *cs;
@@ -96,6 +97,7 @@ void cpu_check_irqs(CPUSPARCState *env)
         cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
     }
 }
+#endif
 
 void sparc_cpu_do_interrupt(CPUState *cs)
 {
diff --git a/target/sparc/int64_helper.c b/target/sparc/int64_helper.c
index 49e4e51c6d..23adda4cad 100644
--- a/target/sparc/int64_helper.c
+++ b/target/sparc/int64_helper.c
@@ -62,6 +62,7 @@ static const char * const excp_names[0x80] = {
 };
 #endif
 
+#if !defined(CONFIG_USER_ONLY)
 void cpu_check_irqs(CPUSPARCState *env)
 {
     CPUState *cs;
@@ -127,6 +128,7 @@ void cpu_check_irqs(CPUSPARCState *env)
         cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
     }
 }
+#endif
 
 void sparc_cpu_do_interrupt(CPUState *cs)
 {

From 3efe1a0f604cb7c4afd0381294acbdec75c65325 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 10:43:44 +0200
Subject: [PATCH 0450/2396] target/i386: limit a20 to system emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is not used by user-mode emulation and is the only caller of
cpu_interrupt() in qemu-i386 and qemu-x86_64.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/i386/helper.c b/target/i386/helper.c
index e0aaed3c4c..651041ccfa 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -110,6 +110,7 @@ int cpu_x86_support_mca_broadcast(CPUX86State *env)
 /* x86 mmu */
 /* XXX: add PGE support */
 
+#ifndef CONFIG_USER_ONLY
 void x86_cpu_set_a20(X86CPU *cpu, int a20_state)
 {
     CPUX86State *env = &cpu->env;
@@ -129,6 +130,7 @@ void x86_cpu_set_a20(X86CPU *cpu, int a20_state)
         env->a20_mask = ~(1 << 20) | (a20_state << 20);
     }
 }
+#endif
 
 void cpu_x86_update_cr0(CPUX86State *env, uint32_t new_cr0)
 {

From bd1cefdd9f18bfbdcb597d7d552fbf31dee47a28 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 12:43:55 +0200
Subject: [PATCH 0451/2396] target-arm: remove uses of cpu_interrupt() for
 user-mode emulation

Arm leaves around some functions that use cpu_interrupt(), even for
user-mode emulation when the code is unreachable.  Pull out the
system-mode implementation to a separate file, and add stubs for
CONFIG_USER_ONLY.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/arm/cpu-irq.c   | 381 +++++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.c       | 370 ---------------------------------------
 target/arm/el2-stubs.c |  37 ++++
 target/arm/helper.c    |   4 +
 target/arm/internals.h |   5 +
 target/arm/meson.build |   2 +
 6 files changed, 429 insertions(+), 370 deletions(-)
 create mode 100644 target/arm/cpu-irq.c
 create mode 100644 target/arm/el2-stubs.c

diff --git a/target/arm/cpu-irq.c b/target/arm/cpu-irq.c
new file mode 100644
index 0000000000..fe514cc93a
--- /dev/null
+++ b/target/arm/cpu-irq.c
@@ -0,0 +1,381 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * QEMU ARM CPU - interrupt_request handling
+ *
+ * Copyright (c) 2003-2025 QEMU contributors
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "accel/tcg/cpu-ops.h"
+#include "internals.h"
+
+#ifdef CONFIG_TCG
+static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
+                                     unsigned int target_el,
+                                     unsigned int cur_el, bool secure,
+                                     uint64_t hcr_el2)
+{
+    CPUARMState *env = cpu_env(cs);
+    bool pstate_unmasked;
+    bool unmasked = false;
+    bool allIntMask = false;
+
+    /*
+     * Don't take exceptions if they target a lower EL.
+     * This check should catch any exceptions that would not be taken
+     * but left pending.
+     */
+    if (cur_el > target_el) {
+        return false;
+    }
+
+    if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
+        env->cp15.sctlr_el[target_el] & SCTLR_NMI && cur_el == target_el) {
+        allIntMask = env->pstate & PSTATE_ALLINT ||
+                     ((env->cp15.sctlr_el[target_el] & SCTLR_SPINTMASK) &&
+                      (env->pstate & PSTATE_SP));
+    }
+
+    switch (excp_idx) {
+    case EXCP_NMI:
+        pstate_unmasked = !allIntMask;
+        break;
+
+    case EXCP_VINMI:
+        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
+            /* VINMIs are only taken when hypervized.  */
+            return false;
+        }
+        return !allIntMask;
+    case EXCP_VFNMI:
+        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
+            /* VFNMIs are only taken when hypervized.  */
+            return false;
+        }
+        return !allIntMask;
+    case EXCP_FIQ:
+        pstate_unmasked = (!(env->daif & PSTATE_F)) && (!allIntMask);
+        break;
+
+    case EXCP_IRQ:
+        pstate_unmasked = (!(env->daif & PSTATE_I)) && (!allIntMask);
+        break;
+
+    case EXCP_VFIQ:
+        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
+            /* VFIQs are only taken when hypervized.  */
+            return false;
+        }
+        return !(env->daif & PSTATE_F) && (!allIntMask);
+    case EXCP_VIRQ:
+        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
+            /* VIRQs are only taken when hypervized.  */
+            return false;
+        }
+        return !(env->daif & PSTATE_I) && (!allIntMask);
+    case EXCP_VSERR:
+        if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
+            /* VIRQs are only taken when hypervized.  */
+            return false;
+        }
+        return !(env->daif & PSTATE_A);
+    default:
+        g_assert_not_reached();
+    }
+
+    /*
+     * Use the target EL, current execution state and SCR/HCR settings to
+     * determine whether the corresponding CPSR bit is used to mask the
+     * interrupt.
+     */
+    if ((target_el > cur_el) && (target_el != 1)) {
+        /* Exceptions targeting a higher EL may not be maskable */
+        if (arm_feature(env, ARM_FEATURE_AARCH64)) {
+            switch (target_el) {
+            case 2:
+                /*
+                 * According to ARM DDI 0487H.a, an interrupt can be masked
+                 * when HCR_E2H and HCR_TGE are both set regardless of the
+                 * current Security state. Note that we need to revisit this
+                 * part again once we need to support NMI.
+                 */
+                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+                        unmasked = true;
+                }
+                break;
+            case 3:
+                /* Interrupt cannot be masked when the target EL is 3 */
+                unmasked = true;
+                break;
+            default:
+                g_assert_not_reached();
+            }
+        } else {
+            /*
+             * The old 32-bit-only environment has a more complicated
+             * masking setup. HCR and SCR bits not only affect interrupt
+             * routing but also change the behaviour of masking.
+             */
+            bool hcr, scr;
+
+            switch (excp_idx) {
+            case EXCP_FIQ:
+                /*
+                 * If FIQs are routed to EL3 or EL2 then there are cases where
+                 * we override the CPSR.F in determining if the exception is
+                 * masked or not. If neither of these are set then we fall back
+                 * to the CPSR.F setting otherwise we further assess the state
+                 * below.
+                 */
+                hcr = hcr_el2 & HCR_FMO;
+                scr = (env->cp15.scr_el3 & SCR_FIQ);
+
+                /*
+                 * When EL3 is 32-bit, the SCR.FW bit controls whether the
+                 * CPSR.F bit masks FIQ interrupts when taken in non-secure
+                 * state. If SCR.FW is set then FIQs can be masked by CPSR.F
+                 * when non-secure but only when FIQs are only routed to EL3.
+                 */
+                scr = scr && !((env->cp15.scr_el3 & SCR_FW) && !hcr);
+                break;
+            case EXCP_IRQ:
+                /*
+                 * When EL3 execution state is 32-bit, if HCR.IMO is set then
+                 * we may override the CPSR.I masking when in non-secure state.
+                 * The SCR.IRQ setting has already been taken into consideration
+                 * when setting the target EL, so it does not have a further
+                 * affect here.
+                 */
+                hcr = hcr_el2 & HCR_IMO;
+                scr = false;
+                break;
+            default:
+                g_assert_not_reached();
+            }
+
+            if ((scr || hcr) && !secure) {
+                unmasked = true;
+            }
+        }
+    }
+
+    /*
+     * The PSTATE bits only mask the interrupt if we have not overridden the
+     * ability above.
+     */
+    return unmasked || pstate_unmasked;
+}
+
+bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    CPUARMState *env = cpu_env(cs);
+    uint32_t cur_el = arm_current_el(env);
+    bool secure = arm_is_secure(env);
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    uint32_t target_el;
+    uint32_t excp_idx;
+
+    /* The prioritization of interrupts is IMPLEMENTATION DEFINED. */
+
+    if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
+        (arm_sctlr(env, cur_el) & SCTLR_NMI)) {
+        if (interrupt_request & CPU_INTERRUPT_NMI) {
+            excp_idx = EXCP_NMI;
+            target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
+            if (arm_excp_unmasked(cs, excp_idx, target_el,
+                                  cur_el, secure, hcr_el2)) {
+                goto found;
+            }
+        }
+        if (interrupt_request & CPU_INTERRUPT_VINMI) {
+            excp_idx = EXCP_VINMI;
+            target_el = 1;
+            if (arm_excp_unmasked(cs, excp_idx, target_el,
+                                  cur_el, secure, hcr_el2)) {
+                goto found;
+            }
+        }
+        if (interrupt_request & CPU_INTERRUPT_VFNMI) {
+            excp_idx = EXCP_VFNMI;
+            target_el = 1;
+            if (arm_excp_unmasked(cs, excp_idx, target_el,
+                                  cur_el, secure, hcr_el2)) {
+                goto found;
+            }
+        }
+    } else {
+        /*
+         * NMI disabled: interrupts with superpriority are handled
+         * as if they didn't have it
+         */
+        if (interrupt_request & CPU_INTERRUPT_NMI) {
+            interrupt_request |= CPU_INTERRUPT_HARD;
+        }
+        if (interrupt_request & CPU_INTERRUPT_VINMI) {
+            interrupt_request |= CPU_INTERRUPT_VIRQ;
+        }
+        if (interrupt_request & CPU_INTERRUPT_VFNMI) {
+            interrupt_request |= CPU_INTERRUPT_VFIQ;
+        }
+    }
+
+    if (interrupt_request & CPU_INTERRUPT_FIQ) {
+        excp_idx = EXCP_FIQ;
+        target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            goto found;
+        }
+    }
+    if (interrupt_request & CPU_INTERRUPT_HARD) {
+        excp_idx = EXCP_IRQ;
+        target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            goto found;
+        }
+    }
+    if (interrupt_request & CPU_INTERRUPT_VIRQ) {
+        excp_idx = EXCP_VIRQ;
+        target_el = 1;
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            goto found;
+        }
+    }
+    if (interrupt_request & CPU_INTERRUPT_VFIQ) {
+        excp_idx = EXCP_VFIQ;
+        target_el = 1;
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            goto found;
+        }
+    }
+    if (interrupt_request & CPU_INTERRUPT_VSERR) {
+        excp_idx = EXCP_VSERR;
+        target_el = 1;
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            /* Taking a virtual abort clears HCR_EL2.VSE */
+            env->cp15.hcr_el2 &= ~HCR_VSE;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
+            goto found;
+        }
+    }
+    return false;
+
+ found:
+    cs->exception_index = excp_idx;
+    env->exception.target_el = target_el;
+    cs->cc->tcg_ops->do_interrupt(cs);
+    return true;
+}
+#endif /* CONFIG_TCG */
+
+void arm_cpu_update_virq(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VIRQ, which is the logical OR of
+     * the HCR_EL2.VI bit and the input line level from the GIC.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
+        !(arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
+        (env->irq_line_state & CPU_INTERRUPT_VIRQ);
+
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VIRQ)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
+        }
+    }
+}
+
+void arm_cpu_update_vfiq(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VFIQ, which is the logical OR of
+     * the HCR_EL2.VF bit and the input line level from the GIC.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VF) &&
+        !(arm_hcrx_el2_eff(env) & HCRX_VFNMI)) ||
+        (env->irq_line_state & CPU_INTERRUPT_VFIQ);
+
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFIQ)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
+        }
+    }
+}
+
+void arm_cpu_update_vinmi(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VINMI, which is the logical OR of
+     * the HCRX_EL2.VINMI bit and the input line level from the GIC.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
+                      (arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
+        (env->irq_line_state & CPU_INTERRUPT_VINMI);
+
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VINMI)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VINMI);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VINMI);
+        }
+    }
+}
+
+void arm_cpu_update_vfnmi(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VFNMI, which is the HCRX_EL2.VFNMI bit.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = (arm_hcr_el2_eff(env) & HCR_VF) &&
+                      (arm_hcrx_el2_eff(env) & HCRX_VFNMI);
+
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFNMI)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VFNMI);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFNMI);
+        }
+    }
+}
+
+void arm_cpu_update_vserr(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = env->cp15.hcr_el2 & HCR_VSE;
+
+    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VSERR)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
+        }
+    }
+}
+
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index d0f6fcdfce..633ec55a57 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -686,376 +686,6 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
 }
 
 
-#if defined(CONFIG_TCG) && !defined(CONFIG_USER_ONLY)
-
-static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-                                     unsigned int target_el,
-                                     unsigned int cur_el, bool secure,
-                                     uint64_t hcr_el2)
-{
-    CPUARMState *env = cpu_env(cs);
-    bool pstate_unmasked;
-    bool unmasked = false;
-    bool allIntMask = false;
-
-    /*
-     * Don't take exceptions if they target a lower EL.
-     * This check should catch any exceptions that would not be taken
-     * but left pending.
-     */
-    if (cur_el > target_el) {
-        return false;
-    }
-
-    if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
-        env->cp15.sctlr_el[target_el] & SCTLR_NMI && cur_el == target_el) {
-        allIntMask = env->pstate & PSTATE_ALLINT ||
-                     ((env->cp15.sctlr_el[target_el] & SCTLR_SPINTMASK) &&
-                      (env->pstate & PSTATE_SP));
-    }
-
-    switch (excp_idx) {
-    case EXCP_NMI:
-        pstate_unmasked = !allIntMask;
-        break;
-
-    case EXCP_VINMI:
-        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
-            /* VINMIs are only taken when hypervized.  */
-            return false;
-        }
-        return !allIntMask;
-    case EXCP_VFNMI:
-        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
-            /* VFNMIs are only taken when hypervized.  */
-            return false;
-        }
-        return !allIntMask;
-    case EXCP_FIQ:
-        pstate_unmasked = (!(env->daif & PSTATE_F)) && (!allIntMask);
-        break;
-
-    case EXCP_IRQ:
-        pstate_unmasked = (!(env->daif & PSTATE_I)) && (!allIntMask);
-        break;
-
-    case EXCP_VFIQ:
-        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
-            /* VFIQs are only taken when hypervized.  */
-            return false;
-        }
-        return !(env->daif & PSTATE_F) && (!allIntMask);
-    case EXCP_VIRQ:
-        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
-            /* VIRQs are only taken when hypervized.  */
-            return false;
-        }
-        return !(env->daif & PSTATE_I) && (!allIntMask);
-    case EXCP_VSERR:
-        if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
-            /* VIRQs are only taken when hypervized.  */
-            return false;
-        }
-        return !(env->daif & PSTATE_A);
-    default:
-        g_assert_not_reached();
-    }
-
-    /*
-     * Use the target EL, current execution state and SCR/HCR settings to
-     * determine whether the corresponding CPSR bit is used to mask the
-     * interrupt.
-     */
-    if ((target_el > cur_el) && (target_el != 1)) {
-        /* Exceptions targeting a higher EL may not be maskable */
-        if (arm_feature(env, ARM_FEATURE_AARCH64)) {
-            switch (target_el) {
-            case 2:
-                /*
-                 * According to ARM DDI 0487H.a, an interrupt can be masked
-                 * when HCR_E2H and HCR_TGE are both set regardless of the
-                 * current Security state. Note that we need to revisit this
-                 * part again once we need to support NMI.
-                 */
-                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
-                        unmasked = true;
-                }
-                break;
-            case 3:
-                /* Interrupt cannot be masked when the target EL is 3 */
-                unmasked = true;
-                break;
-            default:
-                g_assert_not_reached();
-            }
-        } else {
-            /*
-             * The old 32-bit-only environment has a more complicated
-             * masking setup. HCR and SCR bits not only affect interrupt
-             * routing but also change the behaviour of masking.
-             */
-            bool hcr, scr;
-
-            switch (excp_idx) {
-            case EXCP_FIQ:
-                /*
-                 * If FIQs are routed to EL3 or EL2 then there are cases where
-                 * we override the CPSR.F in determining if the exception is
-                 * masked or not. If neither of these are set then we fall back
-                 * to the CPSR.F setting otherwise we further assess the state
-                 * below.
-                 */
-                hcr = hcr_el2 & HCR_FMO;
-                scr = (env->cp15.scr_el3 & SCR_FIQ);
-
-                /*
-                 * When EL3 is 32-bit, the SCR.FW bit controls whether the
-                 * CPSR.F bit masks FIQ interrupts when taken in non-secure
-                 * state. If SCR.FW is set then FIQs can be masked by CPSR.F
-                 * when non-secure but only when FIQs are only routed to EL3.
-                 */
-                scr = scr && !((env->cp15.scr_el3 & SCR_FW) && !hcr);
-                break;
-            case EXCP_IRQ:
-                /*
-                 * When EL3 execution state is 32-bit, if HCR.IMO is set then
-                 * we may override the CPSR.I masking when in non-secure state.
-                 * The SCR.IRQ setting has already been taken into consideration
-                 * when setting the target EL, so it does not have a further
-                 * affect here.
-                 */
-                hcr = hcr_el2 & HCR_IMO;
-                scr = false;
-                break;
-            default:
-                g_assert_not_reached();
-            }
-
-            if ((scr || hcr) && !secure) {
-                unmasked = true;
-            }
-        }
-    }
-
-    /*
-     * The PSTATE bits only mask the interrupt if we have not overridden the
-     * ability above.
-     */
-    return unmasked || pstate_unmasked;
-}
-
-static bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    CPUARMState *env = cpu_env(cs);
-    uint32_t cur_el = arm_current_el(env);
-    bool secure = arm_is_secure(env);
-    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
-    uint32_t target_el;
-    uint32_t excp_idx;
-
-    /* The prioritization of interrupts is IMPLEMENTATION DEFINED. */
-
-    if (cpu_isar_feature(aa64_nmi, env_archcpu(env)) &&
-        (arm_sctlr(env, cur_el) & SCTLR_NMI)) {
-        if (interrupt_request & CPU_INTERRUPT_NMI) {
-            excp_idx = EXCP_NMI;
-            target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
-            if (arm_excp_unmasked(cs, excp_idx, target_el,
-                                  cur_el, secure, hcr_el2)) {
-                goto found;
-            }
-        }
-        if (interrupt_request & CPU_INTERRUPT_VINMI) {
-            excp_idx = EXCP_VINMI;
-            target_el = 1;
-            if (arm_excp_unmasked(cs, excp_idx, target_el,
-                                  cur_el, secure, hcr_el2)) {
-                goto found;
-            }
-        }
-        if (interrupt_request & CPU_INTERRUPT_VFNMI) {
-            excp_idx = EXCP_VFNMI;
-            target_el = 1;
-            if (arm_excp_unmasked(cs, excp_idx, target_el,
-                                  cur_el, secure, hcr_el2)) {
-                goto found;
-            }
-        }
-    } else {
-        /*
-         * NMI disabled: interrupts with superpriority are handled
-         * as if they didn't have it
-         */
-        if (interrupt_request & CPU_INTERRUPT_NMI) {
-            interrupt_request |= CPU_INTERRUPT_HARD;
-        }
-        if (interrupt_request & CPU_INTERRUPT_VINMI) {
-            interrupt_request |= CPU_INTERRUPT_VIRQ;
-        }
-        if (interrupt_request & CPU_INTERRUPT_VFNMI) {
-            interrupt_request |= CPU_INTERRUPT_VFIQ;
-        }
-    }
-
-    if (interrupt_request & CPU_INTERRUPT_FIQ) {
-        excp_idx = EXCP_FIQ;
-        target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
-        if (arm_excp_unmasked(cs, excp_idx, target_el,
-                              cur_el, secure, hcr_el2)) {
-            goto found;
-        }
-    }
-    if (interrupt_request & CPU_INTERRUPT_HARD) {
-        excp_idx = EXCP_IRQ;
-        target_el = arm_phys_excp_target_el(cs, excp_idx, cur_el, secure);
-        if (arm_excp_unmasked(cs, excp_idx, target_el,
-                              cur_el, secure, hcr_el2)) {
-            goto found;
-        }
-    }
-    if (interrupt_request & CPU_INTERRUPT_VIRQ) {
-        excp_idx = EXCP_VIRQ;
-        target_el = 1;
-        if (arm_excp_unmasked(cs, excp_idx, target_el,
-                              cur_el, secure, hcr_el2)) {
-            goto found;
-        }
-    }
-    if (interrupt_request & CPU_INTERRUPT_VFIQ) {
-        excp_idx = EXCP_VFIQ;
-        target_el = 1;
-        if (arm_excp_unmasked(cs, excp_idx, target_el,
-                              cur_el, secure, hcr_el2)) {
-            goto found;
-        }
-    }
-    if (interrupt_request & CPU_INTERRUPT_VSERR) {
-        excp_idx = EXCP_VSERR;
-        target_el = 1;
-        if (arm_excp_unmasked(cs, excp_idx, target_el,
-                              cur_el, secure, hcr_el2)) {
-            /* Taking a virtual abort clears HCR_EL2.VSE */
-            env->cp15.hcr_el2 &= ~HCR_VSE;
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
-            goto found;
-        }
-    }
-    return false;
-
- found:
-    cs->exception_index = excp_idx;
-    env->exception.target_el = target_el;
-    cs->cc->tcg_ops->do_interrupt(cs);
-    return true;
-}
-
-#endif /* CONFIG_TCG && !CONFIG_USER_ONLY */
-
-void arm_cpu_update_virq(ARMCPU *cpu)
-{
-    /*
-     * Update the interrupt level for VIRQ, which is the logical OR of
-     * the HCR_EL2.VI bit and the input line level from the GIC.
-     */
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-
-    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
-        !(arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
-        (env->irq_line_state & CPU_INTERRUPT_VIRQ);
-
-    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VIRQ)) {
-        if (new_state) {
-            cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
-        } else {
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
-        }
-    }
-}
-
-void arm_cpu_update_vfiq(ARMCPU *cpu)
-{
-    /*
-     * Update the interrupt level for VFIQ, which is the logical OR of
-     * the HCR_EL2.VF bit and the input line level from the GIC.
-     */
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-
-    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VF) &&
-        !(arm_hcrx_el2_eff(env) & HCRX_VFNMI)) ||
-        (env->irq_line_state & CPU_INTERRUPT_VFIQ);
-
-    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFIQ)) {
-        if (new_state) {
-            cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
-        } else {
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
-        }
-    }
-}
-
-void arm_cpu_update_vinmi(ARMCPU *cpu)
-{
-    /*
-     * Update the interrupt level for VINMI, which is the logical OR of
-     * the HCRX_EL2.VINMI bit and the input line level from the GIC.
-     */
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-
-    bool new_state = ((arm_hcr_el2_eff(env) & HCR_VI) &&
-                      (arm_hcrx_el2_eff(env) & HCRX_VINMI)) ||
-        (env->irq_line_state & CPU_INTERRUPT_VINMI);
-
-    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VINMI)) {
-        if (new_state) {
-            cpu_interrupt(cs, CPU_INTERRUPT_VINMI);
-        } else {
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VINMI);
-        }
-    }
-}
-
-void arm_cpu_update_vfnmi(ARMCPU *cpu)
-{
-    /*
-     * Update the interrupt level for VFNMI, which is the HCRX_EL2.VFNMI bit.
-     */
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-
-    bool new_state = (arm_hcr_el2_eff(env) & HCR_VF) &&
-                      (arm_hcrx_el2_eff(env) & HCRX_VFNMI);
-
-    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VFNMI)) {
-        if (new_state) {
-            cpu_interrupt(cs, CPU_INTERRUPT_VFNMI);
-        } else {
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFNMI);
-        }
-    }
-}
-
-void arm_cpu_update_vserr(ARMCPU *cpu)
-{
-    /*
-     * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
-     */
-    CPUARMState *env = &cpu->env;
-    CPUState *cs = CPU(cpu);
-
-    bool new_state = env->cp15.hcr_el2 & HCR_VSE;
-
-    if (new_state != cpu_test_interrupt(cs, CPU_INTERRUPT_VSERR)) {
-        if (new_state) {
-            cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
-        } else {
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
-        }
-    }
-}
-
 #ifndef CONFIG_USER_ONLY
 static void arm_cpu_set_irq(void *opaque, int irq, int level)
 {
diff --git a/target/arm/el2-stubs.c b/target/arm/el2-stubs.c
new file mode 100644
index 0000000000..972023c337
--- /dev/null
+++ b/target/arm/el2-stubs.c
@@ -0,0 +1,37 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/* QEMU ARM CPU - user-mode emulation stubs for EL2 interrupts
+ *
+ * These should not really be needed, but CP registers for EL2
+ * are not elided by user-mode emulation and they call these
+ * functions.  Leave them as stubs until it's cleaned up.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "internals.h"
+
+void arm_cpu_update_virq(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_update_vfiq(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_update_vinmi(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_update_vfnmi(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+void arm_cpu_update_vserr(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 19637e7301..fb62742d98 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2868,8 +2868,12 @@ static void omap_threadid_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void omap_wfi_write(CPUARMState *env, const ARMCPRegInfo *ri,
                            uint64_t value)
 {
+#ifdef CONFIG_USER_ONLY
+    g_assert_not_reached();
+#else
     /* Wait-for-interrupt (deprecated) */
     cpu_interrupt(env_cpu(env), CPU_INTERRUPT_HALT);
+#endif
 }
 
 static void omap_cachemaint_write(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/target/arm/internals.h b/target/arm/internals.h
index f5a1e75db3..f0aa26c511 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1292,6 +1292,11 @@ static inline const char *aarch32_mode_name(uint32_t psr)
     return cpu_mode_names[psr & 0xf];
 }
 
+/**
+ * arm_cpu_exec_interrupt(): Implementation of the cpu_exec_inrerrupt hook.
+ */
+bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request);
+
 /**
  * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
  *
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 07d9271aa4..914f1498fc 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -26,6 +26,7 @@ arm_user_ss.add(files(
   'debug_helper.c',
   'helper.c',
   'vfp_fpscr.c',
+  'el2-stubs.c',
 ))
 
 arm_common_system_ss.add(files('cpu.c'))
@@ -38,6 +39,7 @@ arm_common_system_ss.add(files(
   'arm-powerctl.c',
   'cortex-regs.c',
   'cpregs-pmu.c',
+  'cpu-irq.c',
   'debug_helper.c',
   'helper.c',
   'machine.c',

From 11a73c6ea37483f7be85f6afebb4334d97d3050c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 12:49:00 +0200
Subject: [PATCH 0452/2396] user-exec: remove cpu_interrupt() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/user-exec.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 748bfab04a..66c25fba7d 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -46,11 +46,6 @@ __thread uintptr_t helper_retaddr;
 
 //#define DEBUG_SIGNAL
 
-void cpu_interrupt(CPUState *cpu, int mask)
-{
-    g_assert_not_reached();
-}
-
 /*
  * Adjust the pc to pass to cpu_restore_state; return the memop type.
  */

From 602d5ebba26b245730a0b6a4855b1812d587725c Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 12:09:09 +0200
Subject: [PATCH 0453/2396] treewide: clear bits of cs->interrupt_request with
 cpu_reset_interrupt()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Open coding cpu_reset_interrupt() can cause bugs if the BQL is not
taken, for example i386 has the call chain kvm_cpu_exec() ->
kvm_put_vcpu_events() -> kvm_arch_put_registers().

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c                |  6 +++---
 hw/core/cpu-system.c                |  2 +-
 target/avr/helper.c                 |  4 ++--
 target/i386/hvf/x86hvf.c            |  8 ++++----
 target/i386/kvm/kvm.c               | 14 +++++++-------
 target/i386/nvmm/nvmm-all.c         | 10 +++++-----
 target/i386/tcg/system/seg_helper.c | 13 ++++++-------
 target/i386/tcg/system/svm_helper.c |  2 +-
 target/i386/whpx/whpx-all.c         | 12 ++++++------
 target/openrisc/sys_helper.c        |  2 +-
 target/rx/helper.c                  |  4 ++--
 target/s390x/tcg/excp_helper.c      |  2 +-
 12 files changed, 39 insertions(+), 40 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 8491e5badd..508d2d2d9e 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -784,7 +784,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
     if (unlikely(cpu_test_interrupt(cpu, ~0))) {
         bql_lock();
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_DEBUG)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_DEBUG;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_DEBUG);
             cpu->exception_index = EXCP_DEBUG;
             bql_unlock();
             return true;
@@ -793,7 +793,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             /* Do nothing */
         } else if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HALT)) {
             replay_interrupt();
-            cpu->interrupt_request &= ~CPU_INTERRUPT_HALT;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_HALT);
             cpu->halted = 1;
             cpu->exception_index = EXCP_HLT;
             bql_unlock();
@@ -840,7 +840,7 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
             }
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_EXITTB)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_EXITTB;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_EXITTB);
             /* ensure that no TB jump will be modified as
                the program flow was changed */
             *last_tb = NULL;
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index a975405d3a..09c928c1f9 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -204,7 +204,7 @@ static int cpu_common_post_load(void *opaque, int version_id)
          * 0x01 was CPU_INTERRUPT_EXIT. This line can be removed when the
          * version_id is increased.
          */
-        cpu->interrupt_request &= ~0x01;
+        cpu_reset_interrupt(cpu, 0x01);
 
         tlb_flush(cpu);
 
diff --git a/target/avr/helper.c b/target/avr/helper.c
index b9cd6d5ef2..4b29ab3526 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -47,7 +47,7 @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
             cs->exception_index = EXCP_RESET;
             avr_cpu_do_interrupt(cs);
 
-            cs->interrupt_request &= ~CPU_INTERRUPT_RESET;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_RESET);
             return true;
         }
     }
@@ -59,7 +59,7 @@ bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 
             env->intsrc &= env->intsrc - 1; /* clear the interrupt */
             if (!env->intsrc) {
-                cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+                cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
             }
             return true;
         }
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 9e05e0e576..a502437c30 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -397,7 +397,7 @@ bool hvf_inject_interrupts(CPUState *cs)
 
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_NMI)) {
         if (!(env->hflags2 & HF2_NMI_MASK) && !(info & VMCS_INTR_VALID)) {
-            cs->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_NMI);
             info = VMCS_INTR_VALID | VMCS_INTR_T_NMI | EXCP02_NMI;
             wvmcs(cs->accel->fd, VMCS_ENTRY_INTR_INFO, info);
         } else {
@@ -409,7 +409,7 @@ bool hvf_inject_interrupts(CPUState *cs)
         cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
         (env->eflags & IF_MASK) && !(info & VMCS_INTR_VALID)) {
         int line = cpu_get_pic_interrupt(env);
-        cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
         if (line >= 0) {
             wvmcs(cs->accel->fd, VMCS_ENTRY_INTR_INFO, line |
                   VMCS_INTR_VALID | VMCS_INTR_T_HWINTR);
@@ -437,7 +437,7 @@ int hvf_process_events(CPUState *cs)
     }
 
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_POLL)) {
-        cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_POLL);
         apic_poll_irq(cpu->apic_state);
     }
     if ((cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
@@ -450,7 +450,7 @@ int hvf_process_events(CPUState *cs)
         do_cpu_sipi(cpu);
     }
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_TPR)) {
-        cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_TPR);
         cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
                                       env->tpr_access_type);
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 306430a052..8420c4090e 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5066,7 +5066,7 @@ static int kvm_put_vcpu_events(X86CPU *cpu, int level)
              */
             events.smi.pending = cs->interrupt_request & CPU_INTERRUPT_SMI;
             events.smi.latched_init = cs->interrupt_request & CPU_INTERRUPT_INIT;
-            cs->interrupt_request &= ~(CPU_INTERRUPT_INIT | CPU_INTERRUPT_SMI);
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_INIT | CPU_INTERRUPT_SMI);
         } else {
             /* Keep these in cs->interrupt_request.  */
             events.smi.pending = 0;
@@ -5456,7 +5456,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
             bql_lock();
-            cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_NMI);
             bql_unlock();
             DPRINTF("injected NMI\n");
             ret = kvm_vcpu_ioctl(cpu, KVM_NMI);
@@ -5467,7 +5467,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
             bql_lock();
-            cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_SMI);
             bql_unlock();
             DPRINTF("injected SMI\n");
             ret = kvm_vcpu_ioctl(cpu, KVM_SMI);
@@ -5502,7 +5502,7 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
 
             bql_lock();
 
-            cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
             irq = cpu_get_pic_interrupt(env);
             if (irq >= 0) {
                 struct kvm_interrupt intr;
@@ -5597,7 +5597,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         /* We must not raise CPU_INTERRUPT_MCE if it's not supported. */
         assert(env->mcg_cap);
 
-        cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_MCE);
 
         kvm_cpu_synchronize_state(cs);
 
@@ -5627,7 +5627,7 @@ int kvm_arch_process_async_events(CPUState *cs)
     }
 
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_POLL)) {
-        cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_POLL);
         apic_poll_irq(cpu->apic_state);
     }
     if ((cpu_test_interrupt(cs, CPU_INTERRUPT_HARD) &&
@@ -5640,7 +5640,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         do_cpu_sipi(cpu);
     }
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_TPR)) {
-        cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_TPR);
         kvm_cpu_synchronize_state(cs);
         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
                                       env->tpr_access_type);
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index c1ac74c4f0..e1151b04c6 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -419,7 +419,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 
     if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
         if (nvmm_can_take_nmi(cpu)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_NMI);
             event->type = NVMM_VCPU_EVENT_INTR;
             event->vector = 2;
             has_event = true;
@@ -428,7 +428,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 
     if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
         if (nvmm_can_take_int(cpu)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
             event->type = NVMM_VCPU_EVENT_INTR;
             event->vector = cpu_get_pic_interrupt(env);
             has_event = true;
@@ -437,7 +437,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
 
     /* Don't want SMIs. */
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_SMI);
     }
 
     if (sync_tpr) {
@@ -697,7 +697,7 @@ nvmm_vcpu_loop(CPUState *cpu)
         /* set int/nmi windows back to the reset state */
     }
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_POLL)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
         apic_poll_irq(x86_cpu->apic_state);
     }
     if ((cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
@@ -710,7 +710,7 @@ nvmm_vcpu_loop(CPUState *cpu)
         do_cpu_sipi(x86_cpu);
     }
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_TPR);
         nvmm_cpu_synchronize_state(cpu);
         apic_handle_tpr_access_report(x86_cpu->apic_state, env->eip,
             env->tpr_access_type);
diff --git a/target/i386/tcg/system/seg_helper.c b/target/i386/tcg/system/seg_helper.c
index 794a23ddfc..38072e51d7 100644
--- a/target/i386/tcg/system/seg_helper.c
+++ b/target/i386/tcg/system/seg_helper.c
@@ -178,7 +178,7 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
      */
     switch (interrupt_request) {
     case CPU_INTERRUPT_POLL:
-        cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_POLL);
         apic_poll_irq(cpu->apic_state);
         break;
     case CPU_INTERRUPT_SIPI:
@@ -186,23 +186,22 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         break;
     case CPU_INTERRUPT_SMI:
         cpu_svm_check_intercept_param(env, SVM_EXIT_SMI, 0, 0);
-        cs->interrupt_request &= ~CPU_INTERRUPT_SMI;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_SMI);
         do_smm_enter(cpu);
         break;
     case CPU_INTERRUPT_NMI:
         cpu_svm_check_intercept_param(env, SVM_EXIT_NMI, 0, 0);
-        cs->interrupt_request &= ~CPU_INTERRUPT_NMI;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_NMI);
         env->hflags2 |= HF2_NMI_MASK;
         do_interrupt_x86_hardirq(env, EXCP02_NMI, 1);
         break;
     case CPU_INTERRUPT_MCE:
-        cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_MCE);
         do_interrupt_x86_hardirq(env, EXCP12_MCHK, 0);
         break;
     case CPU_INTERRUPT_HARD:
         cpu_svm_check_intercept_param(env, SVM_EXIT_INTR, 0, 0);
-        cs->interrupt_request &= ~(CPU_INTERRUPT_HARD |
-                                   CPU_INTERRUPT_VIRQ);
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD | CPU_INTERRUPT_VIRQ);
         intno = cpu_get_pic_interrupt(env);
         qemu_log_mask(CPU_LOG_INT,
                       "Servicing hardware INT=0x%02x\n", intno);
@@ -215,7 +214,7 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         qemu_log_mask(CPU_LOG_INT,
                       "Servicing virtual hardware INT=0x%02x\n", intno);
         do_interrupt_x86_hardirq(env, intno, 1);
-        cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
         env->int_ctl &= ~V_IRQ_MASK;
         break;
     }
diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index 3569196bdd..505788b0e2 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -824,7 +824,7 @@ void do_vmexit(CPUX86State *env)
     env->intercept_exceptions = 0;
 
     /* Clears the V_IRQ and V_INTR_MASKING bits inside the processor. */
-    cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
+    cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
     env->int_ctl = 0;
 
     /* Clears the TSC_OFFSET inside the processor. */
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 878cdd1668..c09a0a64f2 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1471,14 +1471,14 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
     if (!vcpu->interruption_pending &&
         cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_NMI);
             vcpu->interruptable = false;
             new_int.InterruptionType = WHvX64PendingNmi;
             new_int.InterruptionPending = 1;
             new_int.InterruptionVector = 2;
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SMI)) {
-            cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
+            cpu_reset_interrupt(cpu, CPU_INTERRUPT_SMI);
         }
     }
 
@@ -1502,7 +1502,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
             vcpu->interruptable && (env->eflags & IF_MASK)) {
             assert(!new_int.InterruptionPending);
             if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
-                cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
+                cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
                 irq = cpu_get_pic_interrupt(env);
                 if (irq >= 0) {
                     new_int.InterruptionType = WHvX64PendingInterrupt;
@@ -1520,7 +1520,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
         }
     } else if (vcpu->ready_for_pic_interrupt &&
                cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
         irq = cpu_get_pic_interrupt(env);
         if (irq >= 0) {
             reg_names[reg_count] = WHvRegisterPendingEvent;
@@ -1607,7 +1607,7 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
     }
 
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_POLL)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_POLL;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_POLL);
         apic_poll_irq(x86_cpu->apic_state);
     }
 
@@ -1623,7 +1623,7 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
     }
 
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
-        cpu->interrupt_request &= ~CPU_INTERRUPT_TPR;
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_TPR);
         whpx_cpu_synchronize_state(cpu);
         apic_handle_tpr_access_report(x86_cpu->apic_state, env->eip,
                                       env->tpr_access_type);
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index d96b41a01c..b091a9c668 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -196,7 +196,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
                 env->ttmr = (rb & ~TTMR_IP) | ip;
             } else {    /* Clear IP bit.  */
                 env->ttmr = rb & ~TTMR_IP;
-                cs->interrupt_request &= ~CPU_INTERRUPT_TIMER;
+                cpu_reset_interrupt(cs, CPU_INTERRUPT_TIMER);
             }
             cpu_openrisc_timer_update(cpu);
             bql_unlock();
diff --git a/target/rx/helper.c b/target/rx/helper.c
index ce003af421..41c9606fd1 100644
--- a/target/rx/helper.c
+++ b/target/rx/helper.c
@@ -63,7 +63,7 @@ void rx_cpu_do_interrupt(CPUState *cs)
             env->bpsw = save_psw;
             env->pc = env->fintv;
             env->psw_ipl = 15;
-            cs->interrupt_request &= ~CPU_INTERRUPT_FIR;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_FIR);
             qemu_set_irq(env->ack, env->ack_irq);
             qemu_log_mask(CPU_LOG_INT, "fast interrupt raised\n");
         } else if (do_irq & CPU_INTERRUPT_HARD) {
@@ -73,7 +73,7 @@ void rx_cpu_do_interrupt(CPUState *cs)
             cpu_stl_data(env, env->isp, env->pc);
             env->pc = cpu_ldl_data(env, env->intb + env->ack_irq * 4);
             env->psw_ipl = env->ack_ipl;
-            cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
             qemu_set_irq(env->ack, env->ack_irq);
             qemu_log_mask(CPU_LOG_INT,
                           "interrupt 0x%02x raised\n", env->ack_irq);
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index e4c75d0ce0..4c7faeee82 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -559,7 +559,7 @@ try_deliver:
 
     /* we might still have pending interrupts, but not deliverable */
     if (!env->pending_int && !qemu_s390_flic_has_any(flic)) {
-        cs->interrupt_request &= ~CPU_INTERRUPT_HARD;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
     }
 
     /* WAIT PSW during interrupt injection or STOP interrupt */

From 27e76d010104646c997d20ca0996fb5a046587b0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 11:26:05 +0200
Subject: [PATCH 0454/2396] cpu-common: use atomic access for interrupt_request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Writes to interrupt_request used non-atomic accesses, but there are a
few cases where the access was not protected by the BQL.  Now that
there is a full set of helpers, it's easier to guarantee that
interrupt_request accesses are fully atomic, so just drop the
requirement instead of fixing them.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/cpu-common.c  | 12 +-----------
 include/hw/core/cpu.h |  1 -
 system/cpus.c         |  3 +--
 3 files changed, 2 insertions(+), 14 deletions(-)

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 259cf2a3c3..152abc9024 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -67,19 +67,9 @@ CPUState *cpu_create(const char *typename)
     return cpu;
 }
 
-/* Resetting the IRQ comes from across the code base so we take the
- * BQL here if we need to.  cpu_interrupt assumes it is held.*/
 void cpu_reset_interrupt(CPUState *cpu, int mask)
 {
-    bool need_lock = !bql_locked();
-
-    if (need_lock) {
-        bql_lock();
-    }
-    cpu->interrupt_request &= ~mask;
-    if (need_lock) {
-        bql_unlock();
-    }
+    qatomic_and(&cpu->interrupt_request, ~mask);
 }
 
 void cpu_exit(CPUState *cpu)
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index b01a0cffd6..23bd02277f 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -495,7 +495,6 @@ struct CPUState {
     bool exit_request;
     int exclusive_context_count;
     uint32_t cflags_next_tb;
-    /* updates protected by BQL */
     uint32_t interrupt_request;
     int singlestep_enabled;
     int64_t icount_budget;
diff --git a/system/cpus.c b/system/cpus.c
index 437848b5eb..9bfbe2b060 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -257,8 +257,7 @@ int64_t cpus_get_elapsed_ticks(void)
 void cpu_set_interrupt(CPUState *cpu, int mask)
 {
     /* Pairs with cpu_test_interrupt(). */
-    qatomic_store_release(&cpu->interrupt_request,
-        cpu->interrupt_request | mask);
+    qatomic_or(&cpu->interrupt_request, mask);
 }
 
 void generic_handle_interrupt(CPUState *cpu, int mask)

From 9e1ecd4aaaf9aa2f5b7caf364a10241a2cba02a8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 10:31:34 +0200
Subject: [PATCH 0455/2396] cpus: document that qemu_cpu_kick() can be used for
 BQL-less operation

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/hw/core/cpu.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 23bd02277f..8b57bcd92c 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -829,7 +829,8 @@ bool qemu_cpu_is_self(CPUState *cpu);
  * qemu_cpu_kick:
  * @cpu: The vCPU to kick.
  *
- * Kicks @cpu's thread.
+ * Kicks @cpu's thread to exit the accelerator.  For accelerators that
+ * can do that, the target vCPU thread will try not to take the BQL.
  */
 void qemu_cpu_kick(CPUState *cpu);
 

From ac6c8a390b451913995ee784ef7261b8928e5ace Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 1 Aug 2025 14:57:51 +0200
Subject: [PATCH 0456/2396] accel: use store_release/load_acquire for
 cross-thread exit_request

Reads and writes cpu->exit_request do not use a load-acquire/store-release
pair right now, but this means that cpu_exit() may not write cpu->exit_request
after any flags that are read by the vCPU thread.

Probably everything is protected one way or the other by the BQL, because
cpu->exit_request leads to the slow path, where the CPU thread often takes
the BQL (for example, to go to sleep by waiting on the BQL-protected
cpu->halt_cond); but it's not clear, so use load-acquire/store-release
consistently.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c          | 19 +++++++++----------
 accel/tcg/cpu-exec.c         |  7 +++++--
 accel/tcg/tcg-accel-ops-rr.c | 11 +++++++++--
 hw/core/cpu-common.c         |  3 ++-
 target/i386/nvmm/nvmm-all.c  |  5 ++---
 target/i386/whpx/whpx-all.c  |  3 ++-
 6 files changed, 29 insertions(+), 19 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f36dfe3349..bd9e5e3886 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3029,10 +3029,6 @@ static void kvm_eat_signals(CPUState *cpu)
 
     if (kvm_immediate_exit) {
         qatomic_set(&cpu->kvm_run->immediate_exit, 0);
-        /* Write kvm_run->immediate_exit before the cpu->exit_request
-         * write in kvm_cpu_exec.
-         */
-        smp_wmb();
         return;
     }
 
@@ -3187,7 +3183,8 @@ int kvm_cpu_exec(CPUState *cpu)
         }
 
         kvm_arch_pre_run(cpu, run);
-        if (qatomic_read(&cpu->exit_request)) {
+        /* Corresponding store-release is in cpu_exit. */
+        if (qatomic_load_acquire(&cpu->exit_request)) {
             trace_kvm_interrupt_exit_request();
             /*
              * KVM requires us to reenter the kernel after IO exits to complete
@@ -3197,13 +3194,15 @@ int kvm_cpu_exec(CPUState *cpu)
             kvm_cpu_kick_self();
         }
 
-        /* Read cpu->exit_request before KVM_RUN reads run->immediate_exit.
-         * Matching barrier in kvm_eat_signals.
-         */
-        smp_rmb();
-
         run_ret = kvm_vcpu_ioctl(cpu, KVM_RUN, 0);
 
+        /*
+         * After writing cpu->exit_request, cpu_exit() sends a signal that writes
+         * kvm->run->immediate_exit.  The signal is already happening after the
+         * write to cpu->exit_request so, if KVM read kvm->run->immediate_exit
+         * as true, cpu->exit_request will always read as true.
+         */
+
         attrs = kvm_arch_post_run(cpu, run);
 
 #ifdef KVM_HAVE_MCE_INJECTION
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 508d2d2d9e..f838535d11 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -851,8 +851,11 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
     }
 #endif /* !CONFIG_USER_ONLY */
 
-    /* Finally, check if we need to exit to the main loop.  */
-    if (unlikely(qatomic_read(&cpu->exit_request)) || icount_exit_request(cpu)) {
+    /*
+     * Finally, check if we need to exit to the main loop.
+     * The corresponding store-release is in cpu_exit.
+     */
+    if (unlikely(qatomic_load_acquire(&cpu->exit_request)) || icount_exit_request(cpu)) {
         qatomic_set(&cpu->exit_request, 0);
         if (cpu->exception_index == -1) {
             cpu->exception_index = EXCP_INTERRUPT;
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 6eec5c9eee..e8b0e370a8 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -242,10 +242,17 @@ static void *rr_cpu_thread_fn(void *arg)
             cpu = first_cpu;
         }
 
-        while (cpu && cpu_work_list_empty(cpu) && !cpu->exit_request) {
-            /* Store rr_current_cpu before evaluating cpu_can_run().  */
+        while (cpu && cpu_work_list_empty(cpu)) {
+            /*
+             * Store rr_current_cpu before evaluating cpu->exit_request.
+             * Pairs with rr_kick_next_cpu().
+             */
             qatomic_set_mb(&rr_current_cpu, cpu);
 
+            /* Pairs with store-release in cpu_exit.  */
+            if (qatomic_load_acquire(&cpu->exit_request)) {
+                break;
+            }
             current_cpu = cpu;
 
             qemu_clock_enable(QEMU_CLOCK_VIRTUAL,
diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 152abc9024..42463e6258 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -74,7 +74,8 @@ void cpu_reset_interrupt(CPUState *cpu, int mask)
 
 void cpu_exit(CPUState *cpu)
 {
-    qatomic_set(&cpu->exit_request, 1);
+    /* Ensure cpu_exec will see the reason why the exit request was set.  */
+    qatomic_store_release(&cpu->exit_request, true);
     /* Ensure cpu_exec will see the exit request after TCG has exited.  */
     smp_wmb();
     qatomic_set(&cpu->neg.icount_decr.u16.high, -1);
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index e1151b04c6..10bd51d9b5 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -743,7 +743,8 @@ nvmm_vcpu_loop(CPUState *cpu)
 
         nvmm_vcpu_pre_run(cpu);
 
-        if (qatomic_read(&cpu->exit_request)) {
+        /* Corresponding store-release is in cpu_exit. */
+        if (qatomic_load_acquire(&cpu->exit_request)) {
 #if NVMM_USER_VERSION >= 2
             nvmm_vcpu_stop(vcpu);
 #else
@@ -751,8 +752,6 @@ nvmm_vcpu_loop(CPUState *cpu)
 #endif
         }
 
-        /* Read exit_request before the kernel reads the immediate exit flag */
-        smp_rmb();
         ret = nvmm_vcpu_run(mach, vcpu);
         if (ret == -1) {
             error_report("NVMM: Failed to exec a virtual processor,"
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index c09a0a64f2..2106c29c3a 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1714,7 +1714,8 @@ static int whpx_vcpu_run(CPUState *cpu)
         if (exclusive_step_mode == WHPX_STEP_NONE) {
             whpx_vcpu_pre_run(cpu);
 
-            if (qatomic_read(&cpu->exit_request)) {
+            /* Corresponding store-release is in cpu_exit. */
+            if (qatomic_load_acquire(&cpu->exit_request)) {
                 whpx_vcpu_kick(cpu);
             }
         }

From f084ff128b6136e1aebfd73e1cf7066a077a79bf Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 8 Aug 2025 18:55:48 +0200
Subject: [PATCH 0457/2396] accel: use atomic accesses for exit_request
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPU threads write exit_request as a "note to self" that they need to
go out to a slow path.  This write happens out of the BQL and can be
a data race with another threads' cpu_exit(); use atomic accesses
consistently.

While at it, change the source argument from int ("1") to bool ("true").

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c               | 2 +-
 accel/tcg/tcg-accel-ops-mttcg.c   | 2 +-
 accel/tcg/tcg-accel-ops-rr.c      | 4 ++--
 hw/ppc/spapr_hcall.c              | 6 +++---
 include/hw/core/cpu.h             | 9 +++++++++
 target/i386/kvm/kvm.c             | 6 +++---
 target/i386/nvmm/nvmm-accel-ops.c | 2 +-
 target/i386/nvmm/nvmm-all.c       | 2 +-
 target/i386/whpx/whpx-all.c       | 6 +++---
 9 files changed, 24 insertions(+), 15 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index bd9e5e3886..e4167d94b4 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3730,7 +3730,7 @@ int kvm_on_sigbus_vcpu(CPUState *cpu, int code, void *addr)
     have_sigbus_pending = true;
     pending_sigbus_addr = addr;
     pending_sigbus_code = code;
-    qatomic_set(&cpu->exit_request, 1);
+    qatomic_set(&cpu->exit_request, true);
     return 0;
 #else
     return 1;
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index 337b993d3d..b12b7a36b5 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -85,7 +85,7 @@ static void *mttcg_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     /* process any pending work */
-    cpu->exit_request = 1;
+    qatomic_set(&cpu->exit_request, true);
 
     do {
         if (cpu_can_run(cpu)) {
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index e8b0e370a8..d13e0d8b44 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -212,7 +212,7 @@ static void *rr_cpu_thread_fn(void *arg)
     cpu = first_cpu;
 
     /* process any pending work */
-    cpu->exit_request = 1;
+    qatomic_set(&cpu->exit_request, true);
 
     while (1) {
         /* Only used for icount_enabled() */
@@ -293,7 +293,7 @@ static void *rr_cpu_thread_fn(void *arg)
         /* Does not need a memory barrier because a spurious wakeup is okay.  */
         qatomic_set(&rr_current_cpu, NULL);
 
-        if (cpu && cpu->exit_request) {
+        if (cpu && qatomic_read(&cpu->exit_request)) {
             qatomic_set_mb(&cpu->exit_request, 0);
         }
 
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 1e936f35e4..51875e32a0 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -509,7 +509,7 @@ static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
     if (!cpu_has_work(cs)) {
         cs->halted = 1;
         cs->exception_index = EXCP_HLT;
-        cs->exit_request = 1;
+        qatomic_set(&cs->exit_request, true);
         ppc_maybe_interrupt(env);
     }
 
@@ -531,7 +531,7 @@ static target_ulong h_confer_self(PowerPCCPU *cpu)
     }
     cs->halted = 1;
     cs->exception_index = EXCP_HALTED;
-    cs->exit_request = 1;
+    qatomic_set(&cs->exit_request, true);
     ppc_maybe_interrupt(&cpu->env);
 
     return H_SUCCESS;
@@ -624,7 +624,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
     }
 
     cs->exception_index = EXCP_YIELD;
-    cs->exit_request = 1;
+    qatomic_set(&cs->exit_request, true);
     cpu_loop_exit(cs);
 
     return H_SUCCESS;
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 8b57bcd92c..338757e525 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -422,6 +422,15 @@ struct qemu_work_item;
  * valid under cpu_list_lock.
  * @created: Indicates whether the CPU thread has been successfully created.
  * @halt_cond: condition variable sleeping threads can wait on.
+ * @exit_request: Another thread requests the CPU to call qemu_wait_io_event().
+ *   Should be read only by CPU thread with load-acquire, to synchronize with
+ *   other threads' store-release operation.
+ *
+ *   In some cases, accelerator-specific code will write exit_request from
+ *   within the same thread, to "bump" the effect of qemu_cpu_kick() to
+ *   the one provided by cpu_exit(), especially when processing interrupt
+ *   flags.  In this case, the write and read happen in the same thread
+ *   and the write therefore can use qemu_atomic_set().
  * @interrupt_request: Indicates a pending interrupt request.
  *   Only used by system emulation.
  * @halted: Nonzero if the CPU is in suspended state.
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 8420c4090e..34e74f2447 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5486,10 +5486,10 @@ void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
             !(env->hflags & HF_SMM_MASK)) {
-            qatomic_set(&cpu->exit_request, 1);
+            qatomic_set(&cpu->exit_request, true);
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
-            qatomic_set(&cpu->exit_request, 1);
+            qatomic_set(&cpu->exit_request, true);
         }
     }
 
@@ -5604,7 +5604,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         if (env->exception_nr == EXCP08_DBLE) {
             /* this means triple fault */
             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-            cs->exit_request = 1;
+            qatomic_set(&cs->exit_request, true);
             return 0;
         }
         kvm_queue_exception(env, EXCP12_MCHK, 0, 0);
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 3799260bbd..86869f133e 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -77,7 +77,7 @@ static void nvmm_start_vcpu_thread(CPUState *cpu)
  */
 static void nvmm_kick_vcpu_thread(CPUState *cpu)
 {
-    cpu->exit_request = 1;
+    qatomic_set(&cpu->exit_request, true);
     cpus_kick_thread(cpu);
 }
 
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 10bd51d9b5..7e36c42fbb 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -414,7 +414,7 @@ nvmm_vcpu_pre_run(CPUState *cpu)
      * or commit pending TPR access.
      */
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
-        cpu->exit_request = 1;
+        qatomic_set(&cpu->exit_request, true);
     }
 
     if (!has_event && cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)) {
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 2106c29c3a..00fb7e2310 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1489,10 +1489,10 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_INIT) &&
             !(env->hflags & HF_SMM_MASK)) {
-            cpu->exit_request = 1;
+            qatomic_set(&cpu->exit_request, true);
         }
         if (cpu_test_interrupt(cpu, CPU_INTERRUPT_TPR)) {
-            cpu->exit_request = 1;
+            qatomic_set(&cpu->exit_request, true);
         }
     }
 
@@ -1539,7 +1539,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
     if (tpr != vcpu->tpr) {
         vcpu->tpr = tpr;
         reg_values[reg_count].Reg64 = tpr;
-        cpu->exit_request = 1;
+        qatomic_set(&cpu->exit_request, true);
         reg_names[reg_count] = WHvX64RegisterCr8;
         reg_count += 1;
     }

From 9cf342b491f6872d316b7b0c3cbc0f6157f28797 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 11 Aug 2025 08:28:31 +0200
Subject: [PATCH 0458/2396] accel/tcg: create a thread-kick function for TCG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round-robin TCG is calling into cpu_exit() directly.  In preparation
for making cpu_exit() usable from all accelerators, define a generic
thread-kick function for TCG which is used directly in the multi-threaded
case, and through CPU_FOREACH in the round-robin case.

Use it also for user-mode emulation, and take the occasion to move
the implementation to accel/tcg/user-exec.c.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c            | 6 ++++++
 accel/tcg/tcg-accel-ops-mttcg.c | 5 -----
 accel/tcg/tcg-accel-ops-mttcg.h | 3 ---
 accel/tcg/tcg-accel-ops-rr.c    | 2 +-
 accel/tcg/tcg-accel-ops.c       | 2 +-
 accel/tcg/tcg-accel-ops.h       | 1 +
 accel/tcg/user-exec.c           | 6 ++++++
 bsd-user/main.c                 | 5 -----
 docs/devel/tcg-icount.rst       | 2 +-
 linux-user/main.c               | 5 -----
 10 files changed, 16 insertions(+), 21 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index f838535d11..9241bcadb5 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -40,6 +40,7 @@
 #include "exec/replay-core.h"
 #include "system/tcg.h"
 #include "exec/helper-proto-common.h"
+#include "tcg-accel-ops.h"
 #include "tb-jmp-cache.h"
 #include "tb-hash.h"
 #include "tb-context.h"
@@ -748,6 +749,11 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
     return false;
 }
 
+void tcg_kick_vcpu_thread(CPUState *cpu)
+{
+    cpu_exit(cpu);
+}
+
 static inline bool icount_exit_request(CPUState *cpu)
 {
     if (!icount_enabled()) {
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index b12b7a36b5..1148ebcaae 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -123,11 +123,6 @@ static void *mttcg_cpu_thread_fn(void *arg)
     return NULL;
 }
 
-void mttcg_kick_vcpu_thread(CPUState *cpu)
-{
-    cpu_exit(cpu);
-}
-
 void mttcg_start_vcpu_thread(CPUState *cpu)
 {
     char thread_name[VCPU_THREAD_NAME_SIZE];
diff --git a/accel/tcg/tcg-accel-ops-mttcg.h b/accel/tcg/tcg-accel-ops-mttcg.h
index 8ffa7a9a9f..5c145cc859 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.h
+++ b/accel/tcg/tcg-accel-ops-mttcg.h
@@ -10,9 +10,6 @@
 #ifndef TCG_ACCEL_OPS_MTTCG_H
 #define TCG_ACCEL_OPS_MTTCG_H
 
-/* kick MTTCG vCPU thread */
-void mttcg_kick_vcpu_thread(CPUState *cpu);
-
 /* start an mttcg vCPU thread */
 void mttcg_start_vcpu_thread(CPUState *cpu);
 
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index d13e0d8b44..a1d75fd341 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -43,7 +43,7 @@ void rr_kick_vcpu_thread(CPUState *unused)
     CPUState *cpu;
 
     CPU_FOREACH(cpu) {
-        cpu_exit(cpu);
+        tcg_kick_vcpu_thread(cpu);
     };
 }
 
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 9c37266c1e..1f662a9c74 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -206,7 +206,7 @@ static void tcg_accel_ops_init(AccelClass *ac)
 
     if (qemu_tcg_mttcg_enabled()) {
         ops->create_vcpu_thread = mttcg_start_vcpu_thread;
-        ops->kick_vcpu_thread = mttcg_kick_vcpu_thread;
+        ops->kick_vcpu_thread = tcg_kick_vcpu_thread;
         ops->handle_interrupt = tcg_handle_interrupt;
     } else {
         ops->create_vcpu_thread = rr_start_vcpu_thread;
diff --git a/accel/tcg/tcg-accel-ops.h b/accel/tcg/tcg-accel-ops.h
index 6feeb3f3e9..aecce605d7 100644
--- a/accel/tcg/tcg-accel-ops.h
+++ b/accel/tcg/tcg-accel-ops.h
@@ -18,5 +18,6 @@ void tcg_cpu_destroy(CPUState *cpu);
 int tcg_cpu_exec(CPUState *cpu);
 void tcg_handle_interrupt(CPUState *cpu, int mask);
 void tcg_cpu_init_cflags(CPUState *cpu, bool parallel);
+void tcg_kick_vcpu_thread(CPUState *cpu);
 
 #endif /* TCG_ACCEL_OPS_H */
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 66c25fba7d..3c072fd868 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -38,6 +38,7 @@
 #include "qemu/int128.h"
 #include "trace.h"
 #include "tcg/tcg-ldst.h"
+#include "tcg-accel-ops.h"
 #include "backend-ldst.h"
 #include "internal-common.h"
 #include "tb-internal.h"
@@ -46,6 +47,11 @@ __thread uintptr_t helper_retaddr;
 
 //#define DEBUG_SIGNAL
 
+void qemu_cpu_kick(CPUState *cpu)
+{
+    tcg_kick_vcpu_thread(cpu);
+}
+
 /*
  * Adjust the pc to pass to cpu_restore_state; return the memop type.
  */
diff --git a/bsd-user/main.c b/bsd-user/main.c
index 9ba69642f5..73aae8c327 100644
--- a/bsd-user/main.c
+++ b/bsd-user/main.c
@@ -214,11 +214,6 @@ bool qemu_cpu_is_self(CPUState *cpu)
     return thread_cpu == cpu;
 }
 
-void qemu_cpu_kick(CPUState *cpu)
-{
-    cpu_exit(cpu);
-}
-
 /* Assumes contents are already zeroed.  */
 static void init_task_state(TaskState *ts)
 {
diff --git a/docs/devel/tcg-icount.rst b/docs/devel/tcg-icount.rst
index 7df883446a..a1dcd79e0f 100644
--- a/docs/devel/tcg-icount.rst
+++ b/docs/devel/tcg-icount.rst
@@ -37,7 +37,7 @@ translator starts by allocating a budget of instructions to be
 executed. The budget of instructions is limited by how long it will be
 until the next timer will expire. We store this budget as part of a
 vCPU icount_decr field which shared with the machinery for handling
-cpu_exit(). The whole field is checked at the start of every
+qemu_cpu_kick(). The whole field is checked at the start of every
 translated block and will cause a return to the outer loop to deal
 with whatever caused the exit.
 
diff --git a/linux-user/main.c b/linux-user/main.c
index 7b0ccb6fd6..4ddfc9a619 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -189,11 +189,6 @@ bool qemu_cpu_is_self(CPUState *cpu)
     return thread_cpu == cpu;
 }
 
-void qemu_cpu_kick(CPUState *cpu)
-{
-    cpu_exit(cpu);
-}
-
 void task_settid(TaskState *ts)
 {
     if (ts->ts_tid == 0) {

From 61d996da508fe4082f1cbfd9b51c8c47f535a993 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 11 Aug 2025 08:33:40 +0200
Subject: [PATCH 0459/2396] accel/tcg: inline cpu_exit()

Right now, cpu_exit() is not usable from all accelerators because it
includes a TCG-specific thread kick.  In fact, cpu_exit() doubles as
the TCG thread-kick via tcg_kick_vcpu_thread().

In preparation for changing that, inline cpu_exit() into
tcg_kick_vcpu_thread().  The direction of the calls can then be
reversed, with an accelerator-independent cpu_exit() calling into
qemu_vcpu_kick() rather than the opposite.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 9241bcadb5..3ae545e888 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -751,7 +751,16 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 
 void tcg_kick_vcpu_thread(CPUState *cpu)
 {
-    cpu_exit(cpu);
+    /*
+     * Ensure cpu_exec will see the reason why the exit request was set.
+     * FIXME: this is not always needed.  Other accelerators instead
+     * read interrupt_request and set exit_request on demand from the
+     * CPU thread; see kvm_arch_pre_run() for example.
+     */
+    qatomic_store_release(&cpu->exit_request, true);
+
+    /* Ensure cpu_exec will see the exit request after TCG has exited.  */
+    qatomic_store_release(&cpu->neg.icount_decr.u16.high, -1);
 }
 
 static inline bool icount_exit_request(CPUState *cpu)
@@ -780,7 +789,8 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
     /* Clear the interrupt flag now since we're processing
      * cpu->interrupt_request and cpu->exit_request.
      * Ensure zeroing happens before reading cpu->exit_request or
-     * cpu->interrupt_request (see also smp_wmb in cpu_exit())
+     * cpu->interrupt_request (see also store-release in
+     * tcg_kick_vcpu_thread())
      */
     qatomic_set_mb(&cpu->neg.icount_decr.u16.high, 0);
 

From dcb46ecb2e90d532fcdc04702c92e732a0ef77e8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 1 Aug 2025 13:24:48 +0200
Subject: [PATCH 0460/2396] cpus: remove TCG-ism from cpu_exit()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that TCG has its own kick function, make cpu_exit() do the right kick
for all accelerators.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/cpu-common.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 42463e6258..41a339903c 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -76,9 +76,7 @@ void cpu_exit(CPUState *cpu)
 {
     /* Ensure cpu_exec will see the reason why the exit request was set.  */
     qatomic_store_release(&cpu->exit_request, true);
-    /* Ensure cpu_exec will see the exit request after TCG has exited.  */
-    smp_wmb();
-    qatomic_set(&cpu->neg.icount_decr.u16.high, -1);
+    qemu_cpu_kick(cpu);
 }
 
 static int cpu_common_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg)

From f8217ae54e4c44a7f0d20d56a5368ec1818f1cc2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 1 Aug 2025 13:50:04 +0200
Subject: [PATCH 0461/2396] cpus: properly kick CPUs out of inner execution
 loop

Now that cpu_exit() actually kicks all accelerators, use it whenever
the message to another thread is processed in qemu_wait_io_event().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 cpu-common.c                | 3 ++-
 hw/ppc/ppc.c                | 2 ++
 hw/ppc/spapr_hcall.c        | 7 +++----
 hw/ppc/spapr_rtas.c         | 2 +-
 replay/replay-events.c      | 3 ++-
 system/cpu-timers.c         | 6 +++---
 system/cpus.c               | 5 +++--
 target/arm/tcg/mte_helper.c | 2 +-
 target/i386/kvm/hyperv.c    | 1 -
 9 files changed, 17 insertions(+), 14 deletions(-)

diff --git a/cpu-common.c b/cpu-common.c
index ef5757d23b..152661df8e 100644
--- a/cpu-common.c
+++ b/cpu-common.c
@@ -137,7 +137,8 @@ static void queue_work_on_cpu(CPUState *cpu, struct qemu_work_item *wi)
     wi->done = false;
     qemu_mutex_unlock(&cpu->work_mutex);
 
-    qemu_cpu_kick(cpu);
+    /* exit the inner loop and reach qemu_wait_io_event_common().  */
+    cpu_exit(cpu);
 }
 
 void do_run_on_cpu(CPUState *cpu, run_on_cpu_func func, run_on_cpu_data data,
diff --git a/hw/ppc/ppc.c b/hw/ppc/ppc.c
index 43d0d0e755..3e436c7041 100644
--- a/hw/ppc/ppc.c
+++ b/hw/ppc/ppc.c
@@ -190,6 +190,7 @@ static void ppc970_set_irq(void *opaque, int pin, int level)
             if (level) {
                 trace_ppc_irq_cpu("stop");
                 cs->halted = 1;
+                cpu_exit(cs);
             } else {
                 trace_ppc_irq_cpu("restart");
                 cs->halted = 0;
@@ -386,6 +387,7 @@ static void ppc40x_set_irq(void *opaque, int pin, int level)
             if (level) {
                 trace_ppc_irq_cpu("stop");
                 cs->halted = 1;
+                cpu_exit(cs);
             } else {
                 trace_ppc_irq_cpu("restart");
                 cs->halted = 0;
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 51875e32a0..c594d4b916 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -509,8 +509,8 @@ static target_ulong h_cede(PowerPCCPU *cpu, SpaprMachineState *spapr,
     if (!cpu_has_work(cs)) {
         cs->halted = 1;
         cs->exception_index = EXCP_HLT;
-        qatomic_set(&cs->exit_request, true);
         ppc_maybe_interrupt(env);
+        cpu_exit(cs);
     }
 
     return H_SUCCESS;
@@ -531,8 +531,8 @@ static target_ulong h_confer_self(PowerPCCPU *cpu)
     }
     cs->halted = 1;
     cs->exception_index = EXCP_HALTED;
-    qatomic_set(&cs->exit_request, true);
     ppc_maybe_interrupt(&cpu->env);
+    cpu_exit(cs);
 
     return H_SUCCESS;
 }
@@ -624,8 +624,7 @@ static target_ulong h_confer(PowerPCCPU *cpu, SpaprMachineState *spapr,
     }
 
     cs->exception_index = EXCP_YIELD;
-    qatomic_set(&cs->exit_request, true);
-    cpu_loop_exit(cs);
+    cpu_exit(cs);
 
     return H_SUCCESS;
 }
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 78309dbb09..143bc8c379 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -221,7 +221,7 @@ static void rtas_stop_self(PowerPCCPU *cpu, SpaprMachineState *spapr,
     cs->halted = 1;
     ppc_store_lpcr(cpu, env->spr[SPR_LPCR] & ~pcc->lpcr_pm);
     kvmppc_set_reg_ppc_online(cpu, 0);
-    qemu_cpu_kick(cs);
+    cpu_exit(cs);
 }
 
 static void rtas_ibm_suspend_me(PowerPCCPU *cpu, SpaprMachineState *spapr,
diff --git a/replay/replay-events.c b/replay/replay-events.c
index 8959da9f1f..a96e47e774 100644
--- a/replay/replay-events.c
+++ b/replay/replay-events.c
@@ -118,7 +118,8 @@ void replay_add_event(ReplayAsyncEventKind event_kind,
 
     g_assert(replay_mutex_locked());
     QTAILQ_INSERT_TAIL(&events_list, event, events);
-    qemu_cpu_kick(first_cpu);
+    /* Kick the TCG thread out of tcg_cpu_exec().  */
+    cpu_exit(first_cpu);
 }
 
 void replay_bh_schedule_event(QEMUBH *bh)
diff --git a/system/cpu-timers.c b/system/cpu-timers.c
index cb35fa62b8..9919b46230 100644
--- a/system/cpu-timers.c
+++ b/system/cpu-timers.c
@@ -246,14 +246,14 @@ void qemu_timer_notify_cb(void *opaque, QEMUClockType type)
 
     if (qemu_in_vcpu_thread()) {
         /*
-         * A CPU is currently running; kick it back out to the
+         * A CPU is currently running; send it out of the
          * tcg_cpu_exec() loop so it will recalculate its
          * icount deadline immediately.
          */
-        qemu_cpu_kick(current_cpu);
+        cpu_exit(current_cpu);
     } else if (first_cpu) {
         /*
-         * qemu_cpu_kick is not enough to kick a halted CPU out of
+         * cpu_exit() is not enough to kick a halted CPU out of
          * qemu_tcg_wait_io_event.  async_run_on_cpu, instead,
          * causes cpu_thread_is_idle to return false.  This way,
          * handle_icount_deadline can run.
diff --git a/system/cpus.c b/system/cpus.c
index 9bfbe2b060..bb13942cbb 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -604,7 +604,7 @@ void cpu_pause(CPUState *cpu)
         qemu_cpu_stop(cpu, true);
     } else {
         cpu->stop = true;
-        qemu_cpu_kick(cpu);
+        cpu_exit(cpu);
     }
 }
 
@@ -644,6 +644,7 @@ void pause_all_vcpus(void)
 
     while (!all_vcpus_paused()) {
         qemu_cond_wait(&qemu_pause_cond, &bql);
+        /* FIXME: is this needed? */
         CPU_FOREACH(cpu) {
             qemu_cpu_kick(cpu);
         }
@@ -672,7 +673,7 @@ void cpu_remove_sync(CPUState *cpu)
 {
     cpu->stop = true;
     cpu->unplug = true;
-    qemu_cpu_kick(cpu);
+    cpu_exit(cpu);
     bql_unlock();
     qemu_thread_join(cpu->thread);
     bql_lock();
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 0efc18a181..302e899287 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -591,7 +591,7 @@ static void mte_async_check_fail(CPUARMState *env, uint64_t dirty_ptr,
      * which is rather sooner than "normal".  But the alternative
      * is waiting until the next syscall.
      */
-    qemu_cpu_kick(env_cpu(env));
+    cpu_exit(env_cpu(env));
 #endif
 }
 
diff --git a/target/i386/kvm/hyperv.c b/target/i386/kvm/hyperv.c
index 9865120cc4..f7a81bd270 100644
--- a/target/i386/kvm/hyperv.c
+++ b/target/i386/kvm/hyperv.c
@@ -81,7 +81,6 @@ int kvm_hv_handle_exit(X86CPU *cpu, struct kvm_hyperv_exit *exit)
          * necessary because memory hierarchy is being changed
          */
         async_safe_run_on_cpu(CPU(cpu), async_synic_update, RUN_ON_CPU_NULL);
-        cpu_exit(CPU(cpu));
 
         return EXCP_INTERRUPT;
     case KVM_EXIT_HYPERV_HCALL: {

From 871de7078fcaf597605576b97b32fab14722ea43 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 2 Sep 2025 07:17:09 +0200
Subject: [PATCH 0462/2396] treewide: rename
 qemu_wait_io_event/qemu_wait_io_event_common

Do so before extending it to the user-mode emulators, where there is no
such thing as an "I/O thread".

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/dummy-cpus.c                | 2 +-
 accel/hvf/hvf-accel-ops.c         | 2 +-
 accel/kvm/kvm-accel-ops.c         | 2 +-
 accel/tcg/tcg-accel-ops-mttcg.c   | 2 +-
 accel/tcg/tcg-accel-ops-rr.c      | 4 ++--
 cpu-common.c                      | 2 +-
 include/hw/core/cpu.h             | 2 +-
 include/system/cpus.h             | 4 ++--
 system/cpus.c                     | 6 +++---
 target/i386/nvmm/nvmm-accel-ops.c | 2 +-
 target/i386/whpx/whpx-accel-ops.c | 2 +-
 11 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/accel/dummy-cpus.c b/accel/dummy-cpus.c
index 03cfc0fa01..225a47c31f 100644
--- a/accel/dummy-cpus.c
+++ b/accel/dummy-cpus.c
@@ -57,7 +57,7 @@ static void *dummy_cpu_thread_fn(void *arg)
         qemu_sem_wait(&cpu->sem);
 #endif
         bql_lock();
-        qemu_wait_io_event(cpu);
+        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug);
 
     bql_unlock();
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index d488d6afba..7a27bdadb4 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -198,7 +198,7 @@ static void *hvf_cpu_thread_fn(void *arg)
                 cpu_handle_guest_debug(cpu);
             }
         }
-        qemu_wait_io_event(cpu);
+        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     hvf_vcpu_destroy(cpu);
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index b709187c7d..65a7f76a69 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -53,7 +53,7 @@ static void *kvm_vcpu_thread_fn(void *arg)
                 cpu_handle_guest_debug(cpu);
             }
         }
-        qemu_wait_io_event(cpu);
+        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     kvm_destroy_vcpu(cpu);
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index 1148ebcaae..342917c5f6 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -113,7 +113,7 @@ static void *mttcg_cpu_thread_fn(void *arg)
             }
         }
 
-        qemu_wait_io_event(cpu);
+        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     tcg_cpu_destroy(cpu);
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index a1d75fd341..813b313859 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -117,7 +117,7 @@ static void rr_wait_io_event(void)
     rr_start_kick_timer();
 
     CPU_FOREACH(cpu) {
-        qemu_wait_io_event_common(cpu);
+        qemu_process_cpu_events_common(cpu);
     }
 }
 
@@ -203,7 +203,7 @@ static void *rr_cpu_thread_fn(void *arg)
         /* process any pending work */
         CPU_FOREACH(cpu) {
             current_cpu = cpu;
-            qemu_wait_io_event_common(cpu);
+            qemu_process_cpu_events_common(cpu);
         }
     }
 
diff --git a/cpu-common.c b/cpu-common.c
index 152661df8e..0eb5c7b8f2 100644
--- a/cpu-common.c
+++ b/cpu-common.c
@@ -137,7 +137,7 @@ static void queue_work_on_cpu(CPUState *cpu, struct qemu_work_item *wi)
     wi->done = false;
     qemu_mutex_unlock(&cpu->work_mutex);
 
-    /* exit the inner loop and reach qemu_wait_io_event_common().  */
+    /* exit the inner loop and reach qemu_process_cpu_events_common().  */
     cpu_exit(cpu);
 }
 
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 338757e525..6075be0b59 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -422,7 +422,7 @@ struct qemu_work_item;
  * valid under cpu_list_lock.
  * @created: Indicates whether the CPU thread has been successfully created.
  * @halt_cond: condition variable sleeping threads can wait on.
- * @exit_request: Another thread requests the CPU to call qemu_wait_io_event().
+ * @exit_request: Another thread requests the CPU to call qemu_process_cpu_events().
  *   Should be read only by CPU thread with load-acquire, to synchronize with
  *   other threads' store-release operation.
  *
diff --git a/include/system/cpus.h b/include/system/cpus.h
index 69be6a77a7..4aebec4870 100644
--- a/include/system/cpus.h
+++ b/include/system/cpus.h
@@ -17,8 +17,8 @@ bool cpu_work_list_empty(CPUState *cpu);
 bool cpu_thread_is_idle(CPUState *cpu);
 bool all_cpu_threads_idle(void);
 bool cpu_can_run(CPUState *cpu);
-void qemu_wait_io_event_common(CPUState *cpu);
-void qemu_wait_io_event(CPUState *cpu);
+void qemu_process_cpu_events_common(CPUState *cpu);
+void qemu_process_cpu_events(CPUState *cpu);
 void cpu_thread_signal_created(CPUState *cpu);
 void cpu_thread_signal_destroyed(CPUState *cpu);
 void cpu_handle_guest_debug(CPUState *cpu);
diff --git a/system/cpus.c b/system/cpus.c
index bb13942cbb..fd804e0732 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -450,7 +450,7 @@ static void qemu_cpu_stop(CPUState *cpu, bool exit)
     qemu_cond_broadcast(&qemu_pause_cond);
 }
 
-void qemu_wait_io_event_common(CPUState *cpu)
+void qemu_process_cpu_events_common(CPUState *cpu)
 {
     qatomic_set_mb(&cpu->thread_kicked, false);
     if (cpu->stop) {
@@ -459,7 +459,7 @@ void qemu_wait_io_event_common(CPUState *cpu)
     process_queued_cpu_work(cpu);
 }
 
-void qemu_wait_io_event(CPUState *cpu)
+void qemu_process_cpu_events(CPUState *cpu)
 {
     bool slept = false;
 
@@ -474,7 +474,7 @@ void qemu_wait_io_event(CPUState *cpu)
         qemu_plugin_vcpu_resume_cb(cpu);
     }
 
-    qemu_wait_io_event_common(cpu);
+    qemu_process_cpu_events_common(cpu);
 }
 
 void cpus_kick_thread(CPUState *cpu)
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index 86869f133e..d066364b98 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -51,7 +51,7 @@ static void *qemu_nvmm_cpu_thread_fn(void *arg)
         while (cpu_thread_is_idle(cpu)) {
             qemu_cond_wait_bql(cpu->halt_cond);
         }
-        qemu_wait_io_event_common(cpu);
+        qemu_process_cpu_events_common(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     nvmm_destroy_vcpu(cpu);
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index da58805b1a..2ca4ee0263 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -51,7 +51,7 @@ static void *whpx_cpu_thread_fn(void *arg)
         while (cpu_thread_is_idle(cpu)) {
             qemu_cond_wait_bql(cpu->halt_cond);
         }
-        qemu_wait_io_event_common(cpu);
+        qemu_process_cpu_events_common(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     whpx_destroy_vcpu(cpu);

From 758e5de501f78d4ef53a43e0c5a4783cd807b5be Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 29 Aug 2025 16:53:05 +0200
Subject: [PATCH 0463/2396] bsd-user, linux-user: introduce
 qemu_process_cpu_events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a user-mode emulation version of the function.  More will be
added later, for now it is just process_queued_cpu_work.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/user-exec.c              | 5 +++++
 bsd-user/aarch64/target_arch_cpu.h | 2 +-
 bsd-user/arm/target_arch_cpu.h     | 2 +-
 bsd-user/i386/target_arch_cpu.h    | 2 +-
 bsd-user/riscv/target_arch_cpu.h   | 2 +-
 bsd-user/x86_64/target_arch_cpu.h  | 2 +-
 include/hw/core/cpu.h              | 9 +++++++++
 include/system/cpus.h              | 1 -
 linux-user/aarch64/cpu_loop.c      | 2 +-
 linux-user/alpha/cpu_loop.c        | 2 +-
 linux-user/arm/cpu_loop.c          | 2 +-
 linux-user/hexagon/cpu_loop.c      | 2 +-
 linux-user/hppa/cpu_loop.c         | 2 +-
 linux-user/i386/cpu_loop.c         | 2 +-
 linux-user/loongarch64/cpu_loop.c  | 2 +-
 linux-user/m68k/cpu_loop.c         | 2 +-
 linux-user/microblaze/cpu_loop.c   | 2 +-
 linux-user/mips/cpu_loop.c         | 2 +-
 linux-user/openrisc/cpu_loop.c     | 2 +-
 linux-user/ppc/cpu_loop.c          | 2 +-
 linux-user/riscv/cpu_loop.c        | 2 +-
 linux-user/s390x/cpu_loop.c        | 2 +-
 linux-user/sh4/cpu_loop.c          | 2 +-
 linux-user/sparc/cpu_loop.c        | 2 +-
 linux-user/xtensa/cpu_loop.c       | 2 +-
 25 files changed, 36 insertions(+), 23 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 3c072fd868..65f5da6c50 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -52,6 +52,11 @@ void qemu_cpu_kick(CPUState *cpu)
     tcg_kick_vcpu_thread(cpu);
 }
 
+void qemu_process_cpu_events(CPUState *cpu)
+{
+    process_queued_cpu_work(cpu);
+}
+
 /*
  * Adjust the pc to pass to cpu_restore_state; return the memop type.
  */
diff --git a/bsd-user/aarch64/target_arch_cpu.h b/bsd-user/aarch64/target_arch_cpu.h
index 87fbf6d677..15df84fda2 100644
--- a/bsd-user/aarch64/target_arch_cpu.h
+++ b/bsd-user/aarch64/target_arch_cpu.h
@@ -54,7 +54,7 @@ static inline G_NORETURN void target_cpu_loop(CPUARMState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_SWI:
diff --git a/bsd-user/arm/target_arch_cpu.h b/bsd-user/arm/target_arch_cpu.h
index bc2eaa0bf4..9a952ef0ff 100644
--- a/bsd-user/arm/target_arch_cpu.h
+++ b/bsd-user/arm/target_arch_cpu.h
@@ -46,7 +46,7 @@ static inline G_NORETURN void target_cpu_loop(CPUARMState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
         switch (trapnr) {
         case EXCP_UDEF:
         case EXCP_NOCP:
diff --git a/bsd-user/i386/target_arch_cpu.h b/bsd-user/i386/target_arch_cpu.h
index 5d4c931dec..f147d5b6f8 100644
--- a/bsd-user/i386/target_arch_cpu.h
+++ b/bsd-user/i386/target_arch_cpu.h
@@ -113,7 +113,7 @@ static inline G_NORETURN void target_cpu_loop(CPUX86State *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case 0x80: {
diff --git a/bsd-user/riscv/target_arch_cpu.h b/bsd-user/riscv/target_arch_cpu.h
index ef92f00480..ad428d0263 100644
--- a/bsd-user/riscv/target_arch_cpu.h
+++ b/bsd-user/riscv/target_arch_cpu.h
@@ -49,7 +49,7 @@ static inline G_NORETURN void target_cpu_loop(CPURISCVState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         signo = 0;
 
diff --git a/bsd-user/x86_64/target_arch_cpu.h b/bsd-user/x86_64/target_arch_cpu.h
index f82042e30a..1fa71d87f1 100644
--- a/bsd-user/x86_64/target_arch_cpu.h
+++ b/bsd-user/x86_64/target_arch_cpu.h
@@ -121,7 +121,7 @@ static inline G_NORETURN void target_cpu_loop(CPUX86State *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_SYSCALL:
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 6075be0b59..fb788ca110 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -1145,6 +1145,15 @@ AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx);
 G_NORETURN void cpu_abort(CPUState *cpu, const char *fmt, ...)
     G_GNUC_PRINTF(2, 3);
 
+/**
+ * qemu_process_cpu_events:
+ * @cpu: CPU that left the execution loop
+ *
+ * Perform accelerator-independent work after the CPU has left
+ * the inner execution loop.
+ */
+void qemu_process_cpu_events(CPUState *cpu);
+
 /* $(top_srcdir)/cpu.c */
 void cpu_class_init_props(DeviceClass *dc);
 void cpu_exec_class_post_init(CPUClass *cc);
diff --git a/include/system/cpus.h b/include/system/cpus.h
index 4aebec4870..508444ccf1 100644
--- a/include/system/cpus.h
+++ b/include/system/cpus.h
@@ -18,7 +18,6 @@ bool cpu_thread_is_idle(CPUState *cpu);
 bool all_cpu_threads_idle(void);
 bool cpu_can_run(CPUState *cpu);
 void qemu_process_cpu_events_common(CPUState *cpu);
-void qemu_process_cpu_events(CPUState *cpu);
 void cpu_thread_signal_created(CPUState *cpu);
 void cpu_thread_signal_destroyed(CPUState *cpu);
 void cpu_handle_guest_debug(CPUState *cpu);
diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 4c4921152e..f6b498c6c4 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -38,7 +38,7 @@ void cpu_loop(CPUARMState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_SWI:
diff --git a/linux-user/alpha/cpu_loop.c b/linux-user/alpha/cpu_loop.c
index 728b64906d..bb8346b509 100644
--- a/linux-user/alpha/cpu_loop.c
+++ b/linux-user/alpha/cpu_loop.c
@@ -35,7 +35,7 @@ void cpu_loop(CPUAlphaState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_RESET:
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index 9aeb9b0087..cd89b7d6f5 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -295,7 +295,7 @@ void cpu_loop(CPUARMState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch(trapnr) {
         case EXCP_UDEF:
diff --git a/linux-user/hexagon/cpu_loop.c b/linux-user/hexagon/cpu_loop.c
index 25c97edcae..1941f4c9c1 100644
--- a/linux-user/hexagon/cpu_loop.c
+++ b/linux-user/hexagon/cpu_loop.c
@@ -36,7 +36,7 @@ void cpu_loop(CPUHexagonState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_INTERRUPT:
diff --git a/linux-user/hppa/cpu_loop.c b/linux-user/hppa/cpu_loop.c
index 3af50653bb..356cb48acc 100644
--- a/linux-user/hppa/cpu_loop.c
+++ b/linux-user/hppa/cpu_loop.c
@@ -119,7 +119,7 @@ void cpu_loop(CPUHPPAState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_SYSCALL:
diff --git a/linux-user/i386/cpu_loop.c b/linux-user/i386/cpu_loop.c
index 7b2d8b03d8..f3f58576af 100644
--- a/linux-user/i386/cpu_loop.c
+++ b/linux-user/i386/cpu_loop.c
@@ -214,7 +214,7 @@ void cpu_loop(CPUX86State *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch(trapnr) {
         case 0x80:
diff --git a/linux-user/loongarch64/cpu_loop.c b/linux-user/loongarch64/cpu_loop.c
index a0a4cbb7cc..26a5ce3a93 100644
--- a/linux-user/loongarch64/cpu_loop.c
+++ b/linux-user/loongarch64/cpu_loop.c
@@ -27,7 +27,7 @@ void cpu_loop(CPULoongArchState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_INTERRUPT:
diff --git a/linux-user/m68k/cpu_loop.c b/linux-user/m68k/cpu_loop.c
index aca0bf23dc..2c9f628241 100644
--- a/linux-user/m68k/cpu_loop.c
+++ b/linux-user/m68k/cpu_loop.c
@@ -33,7 +33,7 @@ void cpu_loop(CPUM68KState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch(trapnr) {
         case EXCP_ILLEGAL:
diff --git a/linux-user/microblaze/cpu_loop.c b/linux-user/microblaze/cpu_loop.c
index d8277961c7..78506ab23d 100644
--- a/linux-user/microblaze/cpu_loop.c
+++ b/linux-user/microblaze/cpu_loop.c
@@ -32,7 +32,7 @@ void cpu_loop(CPUMBState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_INTERRUPT:
diff --git a/linux-user/mips/cpu_loop.c b/linux-user/mips/cpu_loop.c
index e67b8a2e46..2365de1de1 100644
--- a/linux-user/mips/cpu_loop.c
+++ b/linux-user/mips/cpu_loop.c
@@ -74,7 +74,7 @@ void cpu_loop(CPUMIPSState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch(trapnr) {
         case EXCP_SYSCALL:
diff --git a/linux-user/openrisc/cpu_loop.c b/linux-user/openrisc/cpu_loop.c
index 8c72347a99..2167d880d5 100644
--- a/linux-user/openrisc/cpu_loop.c
+++ b/linux-user/openrisc/cpu_loop.c
@@ -33,7 +33,7 @@ void cpu_loop(CPUOpenRISCState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_SYSCALL:
diff --git a/linux-user/ppc/cpu_loop.c b/linux-user/ppc/cpu_loop.c
index 22885ffd90..b0b0cb14b4 100644
--- a/linux-user/ppc/cpu_loop.c
+++ b/linux-user/ppc/cpu_loop.c
@@ -77,7 +77,7 @@ void cpu_loop(CPUPPCState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         arch_interrupt = true;
         switch (trapnr) {
diff --git a/linux-user/riscv/cpu_loop.c b/linux-user/riscv/cpu_loop.c
index b316281532..ce542540c2 100644
--- a/linux-user/riscv/cpu_loop.c
+++ b/linux-user/riscv/cpu_loop.c
@@ -36,7 +36,7 @@ void cpu_loop(CPURISCVState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_INTERRUPT:
diff --git a/linux-user/s390x/cpu_loop.c b/linux-user/s390x/cpu_loop.c
index 49e44548f8..4929b32e1f 100644
--- a/linux-user/s390x/cpu_loop.c
+++ b/linux-user/s390x/cpu_loop.c
@@ -64,7 +64,7 @@ void cpu_loop(CPUS390XState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case EXCP_INTERRUPT:
diff --git a/linux-user/sh4/cpu_loop.c b/linux-user/sh4/cpu_loop.c
index 259ea1cc8b..0c9d7e9c46 100644
--- a/linux-user/sh4/cpu_loop.c
+++ b/linux-user/sh4/cpu_loop.c
@@ -34,7 +34,7 @@ void cpu_loop(CPUSH4State *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case 0x160:
diff --git a/linux-user/sparc/cpu_loop.c b/linux-user/sparc/cpu_loop.c
index 7d30cd1ff2..7391e2add8 100644
--- a/linux-user/sparc/cpu_loop.c
+++ b/linux-user/sparc/cpu_loop.c
@@ -220,7 +220,7 @@ void cpu_loop (CPUSPARCState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         switch (trapnr) {
         case TARGET_TT_SYSCALL:
diff --git a/linux-user/xtensa/cpu_loop.c b/linux-user/xtensa/cpu_loop.c
index 43a194fc4a..a0ff10eff8 100644
--- a/linux-user/xtensa/cpu_loop.c
+++ b/linux-user/xtensa/cpu_loop.c
@@ -133,7 +133,7 @@ void cpu_loop(CPUXtensaState *env)
         cpu_exec_start(cs);
         trapnr = cpu_exec(cs);
         cpu_exec_end(cs);
-        process_queued_cpu_work(cs);
+        qemu_process_cpu_events(cs);
 
         env->sregs[PS] &= ~PS_EXCM;
         switch (trapnr) {

From 9a191d3782d707062c42b9fc9f22d9f55d4ed375 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 21 Aug 2025 18:56:55 +0200
Subject: [PATCH 0464/2396] cpus: clear exit_request in qemu_process_cpu_events

Make the code common to all accelerators: after seeing cpu->exit_request
set to true, accelerator code needs to reach qemu_process_cpu_events_common().

So for the common cases where they use qemu_process_cpu_events(), go ahead and
clear it in there.  Note that the cheap qatomic_set() is enough because
at this point the thread has taken the BQL; qatomic_set_mb() is not needed.
In particular, this is the ordering of the communication between
I/O and vCPU threads is always the same.

In the I/O thread:

(a) store other memory locations that will be checked if cpu->exit_request
    or cpu->interrupt_request is 1 (for example cpu->stop or cpu->work_list
    for cpu->exit_request)

(b) cpu_exit(): store-release cpu->exit_request, or
(b) cpu_interrupt(): store-release cpu->interrupt_request

>>> at this point, cpu->halt_cond is broadcast and the BQL released

(c) do the accelerator-specific kick (e.g. write icount_decr for TCG,
    pthread_kill for KVM, etc.)

In the vCPU thread instead the opposite order is respected:

(c) the accelerator's execution loop exits thanks to the kick

(b) then the inner execution loop checks cpu->interrupt_request
    and cpu->exit_request.  If needed cpu->interrupt_request is
    converted into cpu->exit_request when work is needed outside
    the execution loop.

(a) then the other memory locations are checked.  Some may need to
    be read under the BQL, but the vCPU thread may also take other
    locks (e.g. for queued work items) or none at all.

qatomic_set_mb() would only be needed if the halt sleep was done
outside the BQL (though in that case, cpu->exit_request probably
would be replaced by a QemuEvent or something like that).

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c          | 2 --
 accel/tcg/cpu-exec.c         | 1 -
 accel/tcg/tcg-accel-ops-rr.c | 9 +++++++--
 accel/tcg/tcg-accel-ops.c    | 2 --
 accel/tcg/user-exec.c        | 1 +
 system/cpus.c                | 1 +
 target/i386/nvmm/nvmm-all.c  | 2 --
 target/i386/whpx/whpx-all.c  | 2 --
 8 files changed, 9 insertions(+), 11 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index e4167d94b4..d13156bee8 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3155,7 +3155,6 @@ int kvm_cpu_exec(CPUState *cpu)
     trace_kvm_cpu_exec();
 
     if (kvm_arch_process_async_events(cpu)) {
-        qatomic_set(&cpu->exit_request, 0);
         return EXCP_HLT;
     }
 
@@ -3345,7 +3344,6 @@ int kvm_cpu_exec(CPUState *cpu)
         vm_stop(RUN_STATE_INTERNAL_ERROR);
     }
 
-    qatomic_set(&cpu->exit_request, 0);
     return ret;
 }
 
diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 3ae545e888..ad94f96b25 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -872,7 +872,6 @@ static inline bool cpu_handle_interrupt(CPUState *cpu,
      * The corresponding store-release is in cpu_exit.
      */
     if (unlikely(qatomic_load_acquire(&cpu->exit_request)) || icount_exit_request(cpu)) {
-        qatomic_set(&cpu->exit_request, 0);
         if (cpu->exception_index == -1) {
             cpu->exception_index = EXCP_INTERRUPT;
         }
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 813b313859..7dbdba7b51 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -293,8 +293,13 @@ static void *rr_cpu_thread_fn(void *arg)
         /* Does not need a memory barrier because a spurious wakeup is okay.  */
         qatomic_set(&rr_current_cpu, NULL);
 
-        if (cpu && qatomic_read(&cpu->exit_request)) {
-            qatomic_set_mb(&cpu->exit_request, 0);
+        if (cpu) {
+            /*
+             * This could even reset exit_request for all CPUs, but in practice
+             * races between CPU exits and changes to "cpu" are so rare that
+             * there's no advantage in doing so.
+             */
+            qatomic_set(&cpu->exit_request, false);
         }
 
         if (icount_enabled() && all_cpu_threads_idle()) {
diff --git a/accel/tcg/tcg-accel-ops.c b/accel/tcg/tcg-accel-ops.c
index 1f662a9c74..3bd9800504 100644
--- a/accel/tcg/tcg-accel-ops.c
+++ b/accel/tcg/tcg-accel-ops.c
@@ -82,8 +82,6 @@ int tcg_cpu_exec(CPUState *cpu)
     ret = cpu_exec(cpu);
     cpu_exec_end(cpu);
 
-    qatomic_set_mb(&cpu->exit_request, 0);
-
     return ret;
 }
 
diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 65f5da6c50..916f18754f 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -54,6 +54,7 @@ void qemu_cpu_kick(CPUState *cpu)
 
 void qemu_process_cpu_events(CPUState *cpu)
 {
+    qatomic_set(&cpu->exit_request, false);
     process_queued_cpu_work(cpu);
 }
 
diff --git a/system/cpus.c b/system/cpus.c
index fd804e0732..aa7bfcf56e 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -463,6 +463,7 @@ void qemu_process_cpu_events(CPUState *cpu)
 {
     bool slept = false;
 
+    qatomic_set(&cpu->exit_request, false);
     while (cpu_thread_is_idle(cpu)) {
         if (!slept) {
             slept = true;
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 7e36c42fbb..ed42425167 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -817,8 +817,6 @@ nvmm_vcpu_loop(CPUState *cpu)
     cpu_exec_end(cpu);
     bql_lock();
 
-    qatomic_set(&cpu->exit_request, false);
-
     return ret < 0;
 }
 
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 00fb7e2310..2a85168ed5 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2050,8 +2050,6 @@ static int whpx_vcpu_run(CPUState *cpu)
         whpx_last_vcpu_stopping(cpu);
     }
 
-    qatomic_set(&cpu->exit_request, false);
-
     return ret < 0;
 }
 

From d5e33b5f8f5a787bc4bb38bd0b9a8c3e3a0aa9f0 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 11 Aug 2025 09:52:46 +0200
Subject: [PATCH 0465/2396] accel: make all calls to qemu_process_cpu_events
 look the same
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no reason for some accelerators to use qemu_process_cpu_events_common
(which is separated from qemu_process_cpu_events() specifically for round
robin TCG).  They can also check for events directly on the first pass through
the loop, instead of setting cpu->exit_request to true.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/dummy-cpus.c                |  2 +-
 accel/hvf/hvf-accel-ops.c         |  2 +-
 accel/kvm/kvm-accel-ops.c         |  3 ++-
 accel/tcg/tcg-accel-ops-mttcg.c   |  7 ++---
 accel/tcg/tcg-accel-ops-rr.c      | 43 ++++++++++++++-----------------
 target/i386/nvmm/nvmm-accel-ops.c |  6 ++---
 target/i386/whpx/whpx-accel-ops.c |  6 ++---
 7 files changed, 30 insertions(+), 39 deletions(-)

diff --git a/accel/dummy-cpus.c b/accel/dummy-cpus.c
index 225a47c31f..5752f6302c 100644
--- a/accel/dummy-cpus.c
+++ b/accel/dummy-cpus.c
@@ -43,6 +43,7 @@ static void *dummy_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     do {
+        qemu_process_cpu_events(cpu);
         bql_unlock();
 #ifndef _WIN32
         do {
@@ -57,7 +58,6 @@ static void *dummy_cpu_thread_fn(void *arg)
         qemu_sem_wait(&cpu->sem);
 #endif
         bql_lock();
-        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug);
 
     bql_unlock();
diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 7a27bdadb4..8b794c2d41 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -192,13 +192,13 @@ static void *hvf_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     do {
+        qemu_process_cpu_events(cpu);
         if (cpu_can_run(cpu)) {
             r = hvf_vcpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(cpu);
             }
         }
-        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     hvf_vcpu_destroy(cpu);
diff --git a/accel/kvm/kvm-accel-ops.c b/accel/kvm/kvm-accel-ops.c
index 65a7f76a69..8ed6945c2f 100644
--- a/accel/kvm/kvm-accel-ops.c
+++ b/accel/kvm/kvm-accel-ops.c
@@ -47,13 +47,14 @@ static void *kvm_vcpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     do {
+        qemu_process_cpu_events(cpu);
+
         if (cpu_can_run(cpu)) {
             r = kvm_cpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(cpu);
             }
         }
-        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     kvm_destroy_vcpu(cpu);
diff --git a/accel/tcg/tcg-accel-ops-mttcg.c b/accel/tcg/tcg-accel-ops-mttcg.c
index 342917c5f6..cf1ee7ac25 100644
--- a/accel/tcg/tcg-accel-ops-mttcg.c
+++ b/accel/tcg/tcg-accel-ops-mttcg.c
@@ -84,10 +84,9 @@ static void *mttcg_cpu_thread_fn(void *arg)
     cpu_thread_signal_created(cpu);
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
-    /* process any pending work */
-    qatomic_set(&cpu->exit_request, true);
-
     do {
+        qemu_process_cpu_events(cpu);
+
         if (cpu_can_run(cpu)) {
             int r;
             bql_unlock();
@@ -112,8 +111,6 @@ static void *mttcg_cpu_thread_fn(void *arg)
                 break;
             }
         }
-
-        qemu_process_cpu_events(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     tcg_cpu_destroy(cpu);
diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 7dbdba7b51..2fb4643997 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -211,13 +211,30 @@ static void *rr_cpu_thread_fn(void *arg)
 
     cpu = first_cpu;
 
-    /* process any pending work */
-    qatomic_set(&cpu->exit_request, true);
-
     while (1) {
         /* Only used for icount_enabled() */
         int64_t cpu_budget = 0;
 
+        if (cpu) {
+            /*
+             * This could even reset exit_request for all CPUs, but in practice
+             * races between CPU exits and changes to "cpu" are so rare that
+             * there's no advantage in doing so.
+             */
+            qatomic_set(&cpu->exit_request, false);
+        }
+
+        if (icount_enabled() && all_cpu_threads_idle()) {
+            /*
+             * When all cpus are sleeping (e.g in WFI), to avoid a deadlock
+             * in the main_loop, wake it up in order to start the warp timer.
+             */
+            qemu_notify_event();
+        }
+
+        rr_wait_io_event();
+        rr_deal_with_unplugged_cpus();
+
         bql_unlock();
         replay_mutex_lock();
         bql_lock();
@@ -292,26 +309,6 @@ static void *rr_cpu_thread_fn(void *arg)
 
         /* Does not need a memory barrier because a spurious wakeup is okay.  */
         qatomic_set(&rr_current_cpu, NULL);
-
-        if (cpu) {
-            /*
-             * This could even reset exit_request for all CPUs, but in practice
-             * races between CPU exits and changes to "cpu" are so rare that
-             * there's no advantage in doing so.
-             */
-            qatomic_set(&cpu->exit_request, false);
-        }
-
-        if (icount_enabled() && all_cpu_threads_idle()) {
-            /*
-             * When all cpus are sleeping (e.g in WFI), to avoid a deadlock
-             * in the main_loop, wake it up in order to start the warp timer.
-             */
-            qemu_notify_event();
-        }
-
-        rr_wait_io_event();
-        rr_deal_with_unplugged_cpus();
     }
 
     g_assert_not_reached();
diff --git a/target/i386/nvmm/nvmm-accel-ops.c b/target/i386/nvmm/nvmm-accel-ops.c
index d066364b98..dd5d5428b1 100644
--- a/target/i386/nvmm/nvmm-accel-ops.c
+++ b/target/i386/nvmm/nvmm-accel-ops.c
@@ -42,16 +42,14 @@ static void *qemu_nvmm_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     do {
+        qemu_process_cpu_events(cpu);
+
         if (cpu_can_run(cpu)) {
             r = nvmm_vcpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(cpu);
             }
         }
-        while (cpu_thread_is_idle(cpu)) {
-            qemu_cond_wait_bql(cpu->halt_cond);
-        }
-        qemu_process_cpu_events_common(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     nvmm_destroy_vcpu(cpu);
diff --git a/target/i386/whpx/whpx-accel-ops.c b/target/i386/whpx/whpx-accel-ops.c
index 2ca4ee0263..f75886128d 100644
--- a/target/i386/whpx/whpx-accel-ops.c
+++ b/target/i386/whpx/whpx-accel-ops.c
@@ -42,16 +42,14 @@ static void *whpx_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     do {
+        qemu_process_cpu_events(cpu);
+
         if (cpu_can_run(cpu)) {
             r = whpx_vcpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(cpu);
             }
         }
-        while (cpu_thread_is_idle(cpu)) {
-            qemu_cond_wait_bql(cpu->halt_cond);
-        }
-        qemu_process_cpu_events_common(cpu);
     } while (!cpu->unplug || cpu_can_run(cpu));
 
     whpx_destroy_vcpu(cpu);

From b422a7bff64eaf55b8250225533ca1df42c3777e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 1 Aug 2025 14:46:27 +0200
Subject: [PATCH 0466/2396] tcg/user: do not set exit_request gratuitously

Whenever user-mode emulation needs to go all the way out of the cpu
exec loop, it uses cpu_exit(), which already sets cpu->exit_request.

Therefore, there is no need for tcg_kick_vcpu_thread() to set
cpu->exit_request again outside system emulation.

Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/tcg/cpu-exec.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index ad94f96b25..7c20d9db12 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -751,6 +751,7 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 
 void tcg_kick_vcpu_thread(CPUState *cpu)
 {
+#ifndef CONFIG_USER_ONLY
     /*
      * Ensure cpu_exec will see the reason why the exit request was set.
      * FIXME: this is not always needed.  Other accelerators instead
@@ -758,6 +759,7 @@ void tcg_kick_vcpu_thread(CPUState *cpu)
      * CPU thread; see kvm_arch_pre_run() for example.
      */
     qatomic_store_release(&cpu->exit_request, true);
+#endif
 
     /* Ensure cpu_exec will see the exit request after TCG has exited.  */
     qatomic_store_release(&cpu->neg.icount_decr.u16.high, -1);

From 614fff7c0a2e28ed8675bbc3385ad88a76d4ee3a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:33 +0200
Subject: [PATCH 0467/2396] ci: temporarily remove rust from Ubuntu
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is for the purpose of getting an easy-to-use base for future
development.  The plan is:
- that Debian will require trixie to enable Rust usage
- that Ubuntu will backport 1.83 to its 22.04 and 24.04 versions
  (https://bugs.launchpad.net/ubuntu/+source/rustc-1.83/+bug/2120318)

Marc-André is working on adding Rust to other CI jobs.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-2-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 83c2867295..f01978fb40 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -39,9 +39,9 @@ build-system-ubuntu:
     job: amd64-ubuntu2204-container
   variables:
     IMAGE: ubuntu2204
-    CONFIGURE_ARGS: --enable-docs --enable-rust
+    CONFIGURE_ARGS: --enable-docs
     TARGETS: alpha-softmmu microblazeel-softmmu mips64el-softmmu
-    MAKE_CHECK_ARGS: check-build check-doc
+    MAKE_CHECK_ARGS: check-build
 
 check-system-ubuntu:
   extends: .native_test_job_template

From 091f115ea5d40880e74123f2a7cd12f3dd32d624 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:34 +0200
Subject: [PATCH 0468/2396] configure: bump Meson to 1.9.0 for use with Rust

Meson 1.9.0 provides mixed linking of Rust and C objects.  As a side effect,
this also allows adding dependencies with "sources: ..." files to Rust crates
that use structured_sources().

It can also clean up up the meson.build files for Rust noticeably, but due
to an issue with doctests (see https://github.com/mesonbuild/meson/pull/14973)
that will have to wait for 1.9.1.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-3-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure                                  |   4 ++--
 python/scripts/vendor.py                   |   4 ++--
 python/wheels/meson-1.8.1-py3-none-any.whl | Bin 1013001 -> 0 bytes
 python/wheels/meson-1.9.0-py3-none-any.whl | Bin 0 -> 1029634 bytes
 pythondeps.toml                            |   4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)
 delete mode 100644 python/wheels/meson-1.8.1-py3-none-any.whl
 create mode 100644 python/wheels/meson-1.9.0-py3-none-any.whl

diff --git a/configure b/configure
index 274a778764..3053c23fbe 100755
--- a/configure
+++ b/configure
@@ -1184,12 +1184,12 @@ fi
 # detect rust triple
 
 meson_version=$($meson --version)
-if test "$rust" != disabled && ! version_ge "$meson_version" 1.8.1; then
+if test "$rust" != disabled && ! version_ge "$meson_version" 1.9.0; then
   if test "$rust" = enabled; then
     $mkvenv ensuregroup --dir "${source_path}/python/wheels" \
          ${source_path}/pythondeps.toml meson-rust || exit 1
   else
-    echo "Rust needs Meson 1.8.1, disabling" 2>&1
+    echo "Rust needs Meson 1.9.0, disabling" 2>&1
     rust=disabled
   fi
 fi
diff --git a/python/scripts/vendor.py b/python/scripts/vendor.py
index b47db00743..33ac7a45de 100755
--- a/python/scripts/vendor.py
+++ b/python/scripts/vendor.py
@@ -41,8 +41,8 @@ def main() -> int:
     parser.parse_args()
 
     packages = {
-        "meson==1.8.1":
-        "374bbf71247e629475fc10b0bd2ef66fc418c2d8f4890572f74de0f97d0d42da",
+        "meson==1.9.0":
+        "45e51ddc41e37d961582d06e78c48e0f9039011587f3495c4d6b0781dad92357",
     }
 
     vendor_dir = Path(__file__, "..", "..", "wheels").resolve()
diff --git a/python/wheels/meson-1.8.1-py3-none-any.whl b/python/wheels/meson-1.8.1-py3-none-any.whl
deleted file mode 100644
index a885f0e18cea1d1c32987540dc12d91cb74bcb9d..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 1013001
zcmWIWW@Zs#U|`^2NLsf&>Zb_viy}b=hDKus1|0?lhTPQR{5)MlJqtZUy_Cd~M13$(
zoRL_Rs-K&f2f~K>U`2X{XRU4*JvQ6){twrcJu<t!9`(ddy*uUn&9#$q&-P6ExKyWd
z(v^x++!H6X7`hs;WJG$t-9P``u~r3D|2;R~JUuGLSYm$Rd!EAFz3JkQUtU$MF8$KA
zch`gHvOmv$NdMR=7B%&a#$U6eozc2kWy`K*$36QMI?3<;=F=CCT5Me1*0XtP%({rs
z)q76%)J#b`{j67~Xxa8#9j1<R`j@AhPkw##$txpIJ&vF(hF<YaF&R5`T+j6+tuiXo
ztrzSlkNo^K>WZh2QmXLb9WmK4bF|aK8uIrYecEp{{pqC4o$I&^6IK~IZ<UxeRpQ*$
z;6<}n1#L~_4&A)<lxwWfTCudl*^JT^BCV^gEi!2c6Wwswh<%DoN17A=jJ!>vkF7Gj
zIJH~M45qDg5B$6|VXMOtgHIF1Pe)Dr*)TWNCYtjQ)0ap^d6!u##y@sG+mtd*@R4Uq
z@59edJMMDxUVbXJ;;ixUavRn23H%$DF7gn#xkxiHdesxwP0EU9%4xbj!G`QJRJKda
z6pYB*>0}+XVo`v!ul3=l8xG`L*$`EzJK?&EuWp0)trC`{!QaBJ8SDt<T`gVDw|J7z
zRPLQQ4O0z5qZbI@xTU%IR?_!xnx5(^387hYe&@LBbjDm$GG2Ah%~)ze>LT;0D$`GK
z+^{t-X_2#tHs6uk5~btPs}y@B%hy|XpUN8FyPQR=YxJik#(8q6fAXIu^+br#eYRs<
z5pzwW@WG(<{TtRg6{uTHD2iPzb;Kk}VuO0$surF&6V}f$k534)$*k+xEa`C5*)`?)
zZ5E3-A;l|e&Y0{eI6db~;^yBHlO~ltNjf<DkV^49TaF0sPrSPdHBal;95B=7jPkp}
z`k*R=KVi~}T`4IAExV6qc6#4jzWXTe?r0yL_0tdC=)ZjagS}^66Z48qH#P-DG`raz
zjE&5yTfOSc5zYV+RoP0%EYU3*nOix|Pc%Ah^GH|kf0NR;4r`kaLU%njh~1MgC}GY?
zxY;$`TVRvU+BU0ov!WtquQ(bsCE?tHh=lYF^POI>^e6CN>|%cNm|MZ8*<5?`BF<^u
zug?f{Sm<t#F4M`~;+kgGWUsJk$!Z1#p?l)@{#P~4+VH`tIq2yY(Ma_yVU49dXGLyF
zRzGoN{_SYrE?xGSS;e2Z{P5=os$7wW8egY6uhTzKb-jd<LqPU#>je3o=aYX|_AHBP
z4n87WvAoI0^-ZRiUe>9&oxO7$G-k#w*1OC5zU_gNY0sipArGt)zn3*kJzK@M&OU0F
zkn7cT-I)e+vSbrq_cR&vEYA$p*%5QjOn}KzPgkZq>Pf|Ys|n{$PU7@fdQpO@soD0X
z`|Is@Vgkg378DmvKH8Vgtd*sE@UcV7!n-D>KewObx@1%k%~liOmEm<%i*KQb&ce3G
z*F?0~epfVw9oDHAwD+8TWz&asYPVKBbzd3kxKTH3-`-Ql<^^sm(LcR!U4i4ZombNO
zXB1j|6zf%5$ND3s_sQm|H6oe$Z}T#$;xfaT#a1tlTiJWoseq+$lG}sEqmxZMxhsy<
zS-5wE#jGgN(D`D(#1m%l{PE<7kCtt(6&+^kHuZm)?076F>VN0U_GvBrH_{dMGpK4z
zR9~WX@9R?8ISx5z9c%B$-Hqu<3qIn#QjSBg^yq}=+r{2S96Pg3Nae>Gu?-9|=dQSU
zpPg6N=rKWNheWYOg13x>fN<T!(CJ$~&nS2HDBe@-{7cySU2HMiI_Z<{tJj#v7T!1$
zbKs=s)xGnT|Go**x_WoQBvY6AbsC4FO_v?vv7L5Z@WeL-gQDZ=%VRQJSNz)j>uH+M
z_xSHl&h>Y>ue`Qj5x-RGTGJ1qk0*O8EXoBK-fog`{(JYrDv8GU#5c#!R0Ml-EEDlq
zd*{N(6-wI+_msR_JW0dJQ%}X|cd@eO`VYG|+Hsc1@wKkjJ;r;zE_so9Rlys!9}QoR
zzo{u|Ua^eHgkuV;dHCe#<&%A;^lu7N-KBcrRkLQsiiG@2`TyqZvwV}Z_Th#DPE!Ih
zx2u=@v_G~qxu9tKT*enO@0Tu|CNOt@Q>gukRmr?>E`Rxb^6TF(-@g2M_G<UXn>oKM
zAGKcBJRQa5>)m-z;gG=P-`o7pe^{Ef`Qq-CTdlf#i_B)9&onXgF$vYI@z^dRVC3|7
zxw*Bw;Z~Kkb076L^v{{f61^;N^%oV}Q#%!Np7{1gN#3dVd2&OD(=0P<srIRtdm?}N
z=$r}Ye0kU}CU%`Ai>$`O7*iHy4z+1he&jBRRORxEzO7_1r8cL??wVO|+oDZbF^iZ(
zoSym4d|Dn5Qoh#y%?nq_1M<>8=lk!P6LBkrOZ31Bu2*6!nwzii-C`202s}}FHoMcl
z^(0^UN5=ri-kgnYSG%uXou{W5(9_13t9@2BX6>QLPbbSL>gIl~zwTwBaBjJY*@h$!
zXEvYt-|Z63{L{Xx*hOs#xjpHBx$0t}gWp*N3htUsShQ|h(&NMK`4@{_H>c`U`kmOY
zc!JYOhOO*Q>z*FH-`eRq`PZ)xE$4W=mQGvx=jhM0pm(xUf3H6|!RwWG<Sf-CJHKSM
zCSNX>>GAW(b`bwQ_rzn7oIj6$yeTuY`uo7Z{qC$Xu9YsrwoZnBIm-DOpI2pVe75M)
z7tiBjqEntNI&<QbM`oL%e7Ateo9j6fLa!=ZZeDZpr-D2~w$Itq2gU!LV9)xey4Zfh
zlD42qhDhW8)&f2gQW!Vxa%B7?r(zgwyC|a4=_v0i<L56XY-s5*(X~2uXH!FtX<?=0
z)t`Er&iy+c%Nwkif6vcu&h8cWR&l8{iG_1-*`Si3CA?!+oy$wk48|1;mi_C!TGA!K
zxBN}|*%?fm<D(n-*96}wyV2CGG|lBzqU5DpKm8=n*!ATvo4oq8#N63k2Kzkwqy9TZ
zzFAj)@L|g#g<EsFGmb2};OgXX*CScB_=N4OZTU0Q0-txRN{Ns-oXumMFl$?+%e@=x
z-<72Lef!$Su<x?vt9Q0q=d))f`W&-iROa}a{!zunG)MJqvO{c(lzZBg89QsPrM+5u
zKul)+?VjW2t6l_zgaw)$ozkGN!u43pXC2=>?Wffx+<M$6BG_zSg?L>*WK!xGdqACw
zdD{|8tAA{f+<S_-GY)ZRs0f@Ens#of+rz{2gx+x3oLD9NJ-4*oL+b4{CFM151nzB}
zQ{?kdVRci3HY4AU3);JPZ&}1_P;ji|K=p>U^{T=FbxtDAoZEPwtdmW95_Lgb&9R7a
zXC2SZGtXl;EIaawq3v;KMB5`HEq6nU#^On=H!u5z+`F=eDfReMKUK}mick6{x!-J$
z=Ct(N<+Cx{vG=!zxW(d0GhRta*G1j9_O!%#l5)ud=?hzfmTcUc^3LFG%9)JDShE0W
zaceJ&tLxJb|GINEQ=i3n=Q^%TC68ZiQ)DXQCf{zJKjEH`TnNLOXsdVPOqa9HzGmNl
z+h9TMHP3H1#kn3h9&Zo$A%8u9(>+l_qI<29N&1%)2Mxb=PCr}qVx3w}REH(&ONlo3
z75_KnKV4>f>Bh3^b7kvF+B*+<9p8MQkXhpLA;H%c(apt^4_FqhOnkp3{YqI&8Sjl|
zx7)J<R&QlEdEnxSAAR@sD9-5L?ZsYnC{H`+6YrJ;%X5j3Z5Tor7fcYixJ+Ix{qgnb
z+r__s>E6_-dGh*eww!Hq(^!_qa<zT*yrFo#Z0nC(Q4;G}9xL&zUCwJ|e?Yu-y2U*c
zw?}`c=<f3JG5_<|bIKEyYl(rgcP)7$Y52U@BJD57?ao@Oi+}8WYHbr|{Cd6b99Nv9
z!?~Lc7jIfO?FiW1+rI6_&7D^nzb=t(S~0tM-}(5KZRg%=_nl-9-XFr9vnWu{XaB7X
z>-)FfT+l7qy0<i8o56F%UY>&|b}f`xx3VbjZqwhZ!E-0f((t(D(SK|2u0M<J9&~D5
zQkx#S;$c}q`(mj)DOrP-Z#*w=)z#>&Xj~d_ruUY_#iwakWN)4=OA?6ZaPJcT>iUh@
zHax|3);D*v7D4}Qi~ZN~<geuk{Pj_7<yGgj3ul)oTAz|T@bN}RYW-thp(URdWU)&;
z+PM32Sys_jP41&B<IVL<x7|**y0IeKA$8B8yypD7H_i!fGD}^|#C5&qw2d6c>)MK#
zePNa>Im-N&yu05Nx>Z6*bk~h{2PQAmn90s`%e3Rx??yBI;~Zz!7WU57e!Ow#<CKy;
zFXBuVtdR0x5<J)&;hgKx<8H^Fdq|G)^Q{xC+h@H@$h~c`MO$ypxj=i1S&L>ZesDW%
zadx8jgxK6N<IczN%XjwtG~LF!LFoqT&)BLz>{s5-^36ZDKw<NTYfF<Brnw7VH+8?i
zwCql9OnmK@2Z0rG)9*z-=*ZsZDzL6&8*j+240TB#!`N-}3)2og54eBpn&WvUTeoQ5
z4a}QO+Esj}91#0*(scEoUG2OzuQQG|-^dG@yIpqrwQD)HCSSzUD?EiBzdJcCOI`m!
z!UMnA{F_SaZiJTPSTbF`buI0m$H&+gyAGvf-}luxs}dNw<vG*g!}g0KHeWou`{SFZ
zvKkgWtOtY7+`4r-?w*15p|Csej@yMSyftUtYQIVT*B9UX{rl$Cy+=R&+Wfb^Uv~bL
zzw_?xtF`|5@p9+yIe$xR|LwWW_m_Fgzq}cuO_yyCNdCL=`^TgC@A7IB@5j!ya{a&P
z*(|%x+SL=*HNJ5CEB8QrZ9(UI#<DwaMdzO24>pT**}kj5uE5)B;qDoWGhV;DE4p_<
zg11MCwe5ta+8t7J@AupF<-5I)N$0WsGGX`efR9`5FMWOXk=3*7iLRl$zXV)bn_9nL
z@al2d^9D=*$Xi}3<=e~cu;$kLwv07zii&>TeIZxUG{gK;m*>Kc>|g)QqyC$hF>Fm#
zTv^^aJu-Dh!PozZ(@!lfQ?c`_XZ{~0-2XkW;>!7j^@rXyEdKEL=GC7+%sVdpN`HAF
zXZn==UdIFe?|5%CS8c-+?w!-Wb#AG)WS=D-zvwN)f9A%QlJ75mZhd%Y7f*jr%FcT8
zHwq=^KCEk(`|3F1dcwV<5BEQlGs_G3b>jN|KQF)N9;h&k`&Ur<c`x^3>Hm)A_50r%
zE(-o-_p;&VtK8@F^zyHX{w}GjF8pg5bL-aXo~S=}7`E;?eehhW%#N4rT5@w8cJ7_!
zsb!P7LZbiM#gg}YH`Z5~3ixNdY<BOJ@|3-@y=>FlJ-lz-ep}2vbcnD2diURpx@T0c
z{9V=i?#uZ{haVc-PP^)L`E9{TPwPKZzwqs=KObrr$8%<7kd6HOzPxkys>5f6^LzhR
zVxIkG#?Hgv{wlYvyC0D@Gf#~B=aGAJ=iXf4;m2&P=9cDrFq<v=P`CDWiQ?M(a=n6D
zWu?~D);|UI?ApzBckdqcxJRqXA9~Jxy#B1(o9yke7N>v7Etq`#x?*g@%zq|xd-YEw
z7<ltFvhUWlmVS|#@l5XI+n0Lt41P0(2()<zZg_v(eEMU4K_T;hOgxcSH*9`=n?uY!
zj?E(G!&a7TwjaN@FYZ3sKL1z7n?Kwe9BU>dJlTKlX;FYjGFSFezUgyyKd$|-dB>cE
zR*Ua%4YHp2<G9D2@Mmvp19xry^;&$<uhg9xFTz+9Y;N+E{#}#1IFtW>;$gXeJpm!>
zZ%;Qasnv+he$J75KCD~%Rh;A2H`y6EBBd2#0bVYer&m3A*u}l`$@|=PlZ$%m3oTtH
zv-RAQn*CQnwS57jXcsr*uFauedK>$a>tEk*pSe4G`<0hd=5Am6agFM!&-Z?(XXPJx
z9rcDu(8-lk@xnt_8NK=%zR)bjH$L6ne{Otz%M)lNp2jYa`sA{LY;5v7k+{Ph>L+A0
zx(`V+Mm%%6$X^j1vg(JfNA=yte#>3!p9Wsp=6Koev%JA2#y8(GdA+<8vNbe$@+_;`
zxvPC{R&PBxJ%IW8yZcVx{<MS?2R7<h+6o=)71;a3SAAc}TFuB0Qe0f>z4g|UHmxW=
z)y;eV(vNpy4Wb8T`Y@TZ6*k6pCuQH~JsRG4POztb&Y2q}X0z`4tu;8{bzkN32PwO+
z&F&|4-}Z9-V0<;V-nD;Xx74u@m$$9G8~LZZzu~dP%!F0#Y47jduYPj;{ujMhMpk)$
zo}3LRKep8IUDE}n1<gLklg)k^?Dd*7)$r=c*VkLlTw<@>x9zc%T8^>x+w=eJ15n0p
zqSngI-^<9r(7?>V;6-5UrXW8jJF`UBP(LxbBr`v+SU)*GR}VanlT@0SlcJZIS6q^q
zlcQIVpOcwfIXB3=f3|_ZzR%h*_Ydb>@eUOXyPKlD_KN$GG=5vf<2(k^8&>8f{QPce
z=;_hFw^HtY^0CP_`^-&WUyQhvb@=*6=JXXy&UsFi{#W&5*RLb;mo<KF_`TEi&prFi
zVb@ha-9y#e`|WD0ZyN1m(%?zz`}U-SdxQ0xWygdqx7mN+{8sXU<ikCDpN$yK+gBXX
zetzpb!(oFX+-(uFh1TfZQQ&b(Xj=LyOZK_m^LsapX1fU{d-iKxSF;T{v2XF$EPvUn
zmcLD-+I^Xde_oqey39{q{+hJr$<Vuo({?qcG0CgvRKzWK{%`Z73C}Y%?icWP<TuQi
zQo3ke@?}js&!1`bvrMk|b$n5sGV`;X_oppuOn>n%O}6cPVAZIq5KzIW?d7w-L~e!5
z$ql}n&ODgk$Mft=rdxPX{ESNB9SO|BKU-71OlE9j<2Lzs`r^7bdlp51P1-9E`!<JT
z`N7vw{4)cRSCuerf3eRmD=MJBds+4?`DGJC>el%@;a&Nr<wo30@d=r_-o~8)Ue*sM
z%q_T6P;XvdF0$@$ynoMojmKd-x|UyvWOfg_(6{c=tHsx6dj4w<p0O!j-{X07WY8~<
zw)`HU9ric&BN9o<y6sV0wmfRf<!4}s(_vsxLr)}`#U;9#d1?9jIho0+dBv&4`p*6V
zk)D3;ccY?<Zyyt_`@a50(X!x7wq<ioGNqq)ZhX?V);ZH<XP(;RcGV3E+u1gp&{OF8
z`_*>(-o_;<<-fvwmzjFLxw-lIr@8Ov9OeGFbHA(p>A6DhOIKPgkF)vw#C}TYt&&Ht
zf4+A5<6E|P3;V~fudm;?*_mO^^LKXm`ftDg##}NhPTsy=>fWinRgK*5*T1ie>OT6)
zYtP=uSl##2%~x-&C@)sGTeF_Ku)Maqy!h)w-MZKd!QrRB{=NIDo&N_f=Z`GCbs=l5
zZ5xX6{vFCT{;WQWbNggp<tSBa!vmh|snO~w;hmRCMAr*#-I!FeN+9g(wUFe_c=0$9
zyXZ{wh`o{@s}<+2DDV#LJnOh7^rX{1rk~e(ZqNPUH$%!UqvG6@<kh<#M(8K|i)j1S
zZ>ZWW-Ey=16juPJ*sF&MPb}W_T>Zc7@18lu+HG@XSaNo46%s3pt~zmBG1wtDRe7D~
zmrkMNc6ODwQzxi;az-^sK8Vymc7Qp~aji@~FPrR|OfJQ>T=G&uyAE7_usu2a;HFDk
z*1p`M@_)gN*NMlADh}_gNY{CJv45MnfZ@qi7atyUH`Y&eb1!`46#pq`bNDuf?~xyb
zv=&<bD_3Mw_TuzA{(O(fzfPS5S8eN^p)YLiT<?8)PCKmQuiwRw2Y+u_uX1x|>Nlyy
zoJ(RdF0|ZvT(-;IbL+Z;v-WOM?b`R_+t>H{nbyqD5)ZRGK7PQq!Ri;oos_BELXJ<|
zN)uXwnzhw08QV@iU2pc-C+0xZpXqaBpT)KRzo5pyODb@hXk|?W<14`}SNTL4_eQ^!
zVYN9bsm{3bsmhgW8=^TiIbL3sbC1doUAw0B>6dI@vHva6Tb5laF!78Om07cUljKQ}
z2`!6^n=?vQ7nXlmZ2Wb@@ef5?6fKrAy>7pw>=?&mAJFn={nxTBU#xd54V0|8lk<;t
zVZo|hZ}|Sm?nutju+Pel`myoONxm(7oJ@fiEo*|>8W!bC{og1Sw4u@?#?W@b^uiJ!
zkJ)j_PLe_A<cql{GNd=GS7$$Wk=yUrffsKB_@3vj*3vy%@ZxiFy~(%BoEmQ)dS9AR
zz@e<WwBg+$!z88+FaK<eie#K%<8k+duka`P!%LYiiZE}OVmBq_NNYo00$YW}A?au?
zxoat5mOK&BC!8Fk^&c_uEs#sSefZo4fd#UM=7>L<+`TV+!)Ilc;N)-9PjZEydd0rs
zQL|8nfVp)a!=1-_c>lcItFp~8phj8NYW?DnH3j@VbsciYwC;4>Y2CTu{>!52jf@uA
z4N?p<Gp{zQg(rzLXV%Q)U==ent6>tncec{3GBM)mlx7db*WNeIm`oAb;FDj<zI)EE
zKO+6iepe@d(Lb{B=bo<yv-ZCC*t1?LY-`Z*KOuX!h-hYrTe+=Xlf^fI{jR#v9kxZR
zkC#kdyNk!~I)lr$X{w@~N~<ScT%qo@uyo4G$=B~IP5CWVf9>&cOMzgs+xk)$)MHjG
z4dfRw`^b5;;OR_{2`M+sws6(ed;L`M?qUqQf8d&LL#}xqgSAZs%RR@7uCpdr*@<Q-
zANnX9CAi1u>ARa*6NN=xQg6vUu3da!hUtt)nV&wTUX45RXl7cR*!ABWr#E<*PH4Es
zAR+#uwKqqj@0-~5QWv{p=c3~i#Gbf?pA5)YesF1u;_uy$ZU%{L)V|OB&)bSo=@px}
zxr3%-RM;jZ(IR&971y2$@R^o}L^ye^n)r{i%s$L6O?zVYQ#XAhiJ2~rX}MdZ3+@z^
zggnhWKJCM$%P0C<Dps1TJf6_<GSb=RP+-jZ(-(XACT*YkP1tF^?;DK(y{BKcDZgnC
zaFL&wc-~E^>1qz^w`oe}ul{^v(%S!{)TZpjf%8H0?lg4tzrDCDiTzZL$PwWHH&+in
zujjv)sFb|gF8FBq!CY_VZ_kQ)Tg<)f*%qyT{%F0&>Vn(bKmKTp?EHG-=+)z|Zl<Yu
zZ<d)V8sa%o(nF!8;oOl&9pVg@Ex}BOUteXI#`%!_!u62q-k8P4cfCLDX%>EbeENZ^
zH)7K2#S_jJR76Iz&NmU*%^s{YVSY&Q{r?Z!7T#_WosevM>?7wTRg3q>dDpONJ1zLu
z+v3oFzu{a=mTc|gPS<<epPJYw8BTmUS@!&t;zMF(7vzoE?|QM^{m=Y9=77;v{uv1u
zig+588k_p07kOX&9BKTXF_t~i`sad<r>w0j`prsvZTPzyvKZ=q)-wk7$lfp%WVZ?Y
zwq`<t+8iF=19n`yPwmU!aMwiEV(yxr8&5;ErB@!j_a~>!VuKRr$+gmjo15R1`bGKP
zjEr`ef8nBrY*zfdAL8$XZY5mSj2C45*D%o~%>Q(scnfo3`|H)ZE6%IrubOi|sec{E
z);zswroZgJIq^;4O182}y$~Jdn5X*BN8!2j_wJAlO53*`+c`bOz{V}p?TP;%NgI7v
z<?ne{nB}$xM(Z&pY+O+Dh{b)y519jjz6nR?=5L)m$H?-zK%eNJi$cMyhCWA^O_b0G
z&Ty+;*5ao8bcTLqV`yRN0TI{ttq~LT1h#SQ<2fk4miy8M|1}a^`(}1qPxWtmwxv{?
zpYvv4AV)y}d!F&Z#pw}pJ6ST7bIh1d1j;BbZv1b)QOW;yn%+Zyg~*9fibft>Yr{0Z
z73E63=-jc7{Y{ndt2eECo=ol&$c(-se)Vx3^PN=>J2;{&zxLi${5Mx7B&gQnoyxxD
zMpEDIq*Q-;pca_<X7Psl=L`Fe3N(FlESFHfW4kM-x@CvNB@N-|@4AxC8|S<{m%43p
zD6>k0U`6q@L&4<?QnK=Tw=ME!FfBU3<9&7Ghl{ZaI$>Ou!4oHPa$QthI@?~lU*X(~
zVxE;hrq7UGoIb(vRA?KAZiu9f+N{aO=lE6@eDw75{(2?js%lf%m;L#FE?nJw_3YnI
zZ@=<PdS9qeoqX%3?S!KA-%oB%bv!WB$8w|2Pi<k*D1T17DWYFzXuh}-xmiiWbI#|q
zB%2k2Mjsqsa2%a}!&JEV-l6ojUI*EXq*P_M1^=9KPv7$<*AWi0THz~G9FM2GPFd&~
zvNOH(haLN8&k0W}ZDk!eW7X#zoV3$d^h3zLjYn5bO?^;xbIR%OZ0T!4<Wso>IbJZ_
zj8wP~rvGt5`-|Cp&x<b@C~pi9nswo~Y<Xfw{PMJOe|(=bM!&Rp(k!QBy8cAKvR6Ou
zC>^o#N&CDp=ftW*_0ez2KXsg0!g6(Q>pm4>u5J66-Jhf{s^dB?9lCT^Rt|ISTo)e(
zv3LKQtosdnd1Tro652MObh)hcV&)9?8y_wH-7xUK8$HJ~@Re4_wo4o4aUQt%K)aZg
z>*Mnip~oi9al2-fxHDa%M(XX{okmH9H)AKRJf9J~WXsBxkv29LyPjO$Im1hZfBU&*
zm7a~0Z?Ezc?OP+Ae$r*BVV_#^%o{6ZN|}V)YrN0)?dN<DXS&hBTwLC2#iG7B%j6Ol
z2POaZ7TU}`$>P3+%;pn0Gp6=#oF@~jx~$(?j=yNetK3g7Ki6NLRXNKwD~<86(u`eU
z55G;kzWz)@_oKJGSEu(rT*h;`%=@kEG{K;=y#ai4R*A&3Bub^|eUvub{eV$3!f=~Q
z^oy4oANcK@S11SfuR5bJufbgE$f~tlYSx$Bss6FM!Jbisjp>nqn6X@}q|>=Z&GItk
zmbUNWSw8WHOxtn_^TZ^1{q|0&Juq|Me-5jk63^P5FR=AGFIi%Cb=7^hxB2}W7Fd7a
zoK{k#DN=X&(N~i!<}kK<frl9PYA0Q8oP2BY&zuv>9+=1To}0q3?aKV;kG!n2=6<-e
zO-#PAzA2W^kaN+h+05n}u2d#>Pfcjp<8jt|R+H$-M7!^?L0_3lk1jk|*gea>_wnh@
zV*SE(tP|{`*BmXf6}H#8cDmHy-SMY?`_1Lw9X)>Z?%kx){d?lNXYc+K_3zo-h&6R$
z_3`W0HN4B%$5?md<qB{0i!IurW@^5YF2zBT1+N%<^=5WSDOGcAOgQuV>EGY4nbz#9
z+8MKVcl5e{RevvkeYH=(KKB0Jzk*w0{%ok(zvur<rx$lW)s^mjcAZ@;?%3N$d@|o2
z{(a<kr*6mYy^-<7Tc6%O#Fj7S@L$gCYRPK{bK^Ureur6Y(tYzyFBMxA@Lp`~5BQ^c
z<m|JhHn}By7J_o-2ey{Ayg4_;YTHSkSO4ZsUAFP3>+4M8(;L4}x2)k)JL>v=>zx;E
zdgrG{RI*-}pQm6O!B%ti!Uo}z7C&q0tu3>4I2I_%OO|Ba&Pa$~x=ZI#Zn>f4(_<&k
zr$7GN)X8-2i}YSaC-+mig>r)Lbq`Hr-q-lxMcJR4I)f^|Q|x@HO{b-NrGIxa><rsh
zWIgxc<5wTN9I7l2eC2w7ZS(DP4-JKFHB%c{+R}GbC_ZmxYdJPk`bF>KtkdPsB911n
zJr@1=vD@@DmTo<gKc(+hrl;+g<<FxxZ?7<a)WeO^hZ%R9F1z(wZN6+>)1sVTagU}5
zSRU-?x*lY{_-U5P?5a0HI~OWdJo6RU!+PMs*|!I!wb>h+3p-f;RtP*#J(9R<jhspB
zq-+1a@}6MGZ~0KvEPh_{!`&DiuQi+*tqps2d{z>DrK4&0Zo)4A%U^$N`f&60wgXP5
z=Nj6uF7<r=WYgTVbq8)|xmGX*xJ#W{7gEzP@Av|_zkDL)tKNRNI>|&Jd9#^gd7@eG
zd?&&D%GM3dXQr=@dSEj{f8YK~jE>389~a+DRzI>f#YEz!vGAO8?)h6ve9NSTEVu6$
zTd271zf_~iL5-K*KI(TDskr!0UZlhG$48=CE!NmB`B3q`$+@pGW_w+|u<ip_!m+C}
zFYer;s~D(o{bHBqT=(qDxija>FsnI-_np<^5A43Y^W(DzC*7<rFzQaokvjRuuKQSz
znOm$y!}{>>i171!+1&T*=jA_~_|*RX0`ANxhK{Na>-C?kfA=td$tk;gst51?71z`F
zlPz*N(`ms~woS*Jr0rT(x=pnD8MS&@5fc}SigoipwtP)dmuGLL$EOSa$S``i`mQ32
z@WNH^e{J%s($ib#^S%AYK8I<G9e=#nV=aAsWtr6iaRE+;kBjB@S)VvnR%YJ4^ATUe
z^Zt)YQ)X3#F%&R~nepkb_>pO^&a2^fzUYp_6vgDH+qyH-<hu%YMBQES<rLT532eSH
zdUG0!Om?{O%u8H5<6h0L>G1)+95%A=AMbs7Xm7U6`6Y_&Tb}aeud$T4l=?`Y{m1Xn
zKTcK6^W3+u*?;M=oyV#*>9gAWC+-)}()-Z(<J{Ay-!+uJD08sH?ECY>=0e5YpJr1Q
z7`lZlu}~`go92Ak$WroVtHU&Bj_>F97X6aj@jI*buTaP`)%Zgf=0B4AH`iEXa_<$t
z`vr%*oBuQ}m-zADV?Xmpwasg%&RQYRG$(`i2#?I#+kFBB4x9^gN{;7$`<dza==HlV
zF`vc%Ga@?dpcOd`3=9lRAcBE`K@8Sm2M^Nd$H!;pWtPOp>lIWoGob34y?EaWH)aNg
zDt1g=1&JjYIhjd%1(kC{a=WiM@cg?MFZjhd|NP!{>$-L=P}p~1VG%nQSJ9Vcxw~X@
z)l=j0)_45Bd&Z~y?z_2M-@I?neB$}Z#`E2w<Daj```tS&H1*)*%Un~ZZgtt)G<~mz
zv`u8%_sP3Ibp3KXU7DO&S^ty4&Xhy`!h|NS^&6J%OSa#ju}j7CvI%3Io#`b9_o>-}
zJX@I`Y&E&opn7A%KR&0)!J-^5T63c!Q)V&V)^0hpwlU;@Mqsp}Xw9@$i+UN2CA#NE
zsy^Jdahv(-qe;5CkGs|^$-DS-377h9tvbCWhJ0rqo&0q3aVI~!VWj<ywh*@}*|&0b
z6~8hhH~Q<&Xp4zH_;KSSsjnXmML5nSuui=aajWdagOEbIMYEc>9JtDrzEU`B+M?Wc
z2H`j6yjnY^#QNXLTfO(ow|{2cE|u>$O_W*Ll*Hh7&tq#F?{u*Sy`5ilHf8QxrtDF5
z(16QnsqE(|NAJXkP2DnS%K0R|ZJd9UzxaJm5m@nT^Zi>VW=~?7;?WnL>@!iM`^5gO
zdyYLYPGj5}ytMzg>W1>0T*)^aGI%WJu;%Vq#b%oJA?)3yq!UrUo^{w5@0POu#4<ta
z;_t@Sy;t|GUdG8<@S!q9F(u{yo4Nj{lzvaVJTFG}(w@&}B~J%r>uTL`-Zi;3ZmntQ
zgy&l~`z6miykc@d*BXvg)srE+-|El2>#CjOJ8QT7dCPpaO1^mK6<_8Ap1-L-_x<0=
z6R)?oC-?jJJ^t=GDJM{(+*<GU;*_R}j19K_d`>bq-riNQd6yoSwNGFAT2lDjk8{r)
z`Q69m95v0)nEmTHrEcablhb>i{mOWD`?LG5&KEDwhpy<p-WhP<%R9Bsvl25?d6M1;
zeXbOX;F@N{a<;g2wvD{w3U^(d%=;I9>&b*Fcfb5CSjWQlEV<U6Sw-}|MV6R(&-*Zr
zys{S`Gq_A<AMN=YoXGpQ%gX4+wc-c&rYwzhbi86TKi@UGfK6TB?P1++HpAmvcl@uJ
z_vYZsf4`5vyIub;o&Vmm|I_DIM4Wtb;8kKNvxyhOv9J61H^~+^ZhrpJbautV($2lD
zoBQ*(sQq<6vVf;>(Vuf7=5zmZbe&1#+{AM6^M;d0cX;H_opN^yOK9HQNhez>HoskR
z|8`&1gJ%U>4nI75ai2#WT7DHj_Wbz?CI$u<b_NDfwES99S&*5R4$gSDvu-;G)ZSk&
zF^T=QLidDk3nikYZnaAVNp)m!D|T!xOVM3ZHudgQ*{}V-r2lR@w@&5wIo6)P39)JC
zW*Qs2SMzN*kFP(!KDF`I!y3(i>PW9G+&i)=0w4Y{+MDqF!%>sDQ(vDt{PgHk))di0
z<t1*-2Y9tEUuj|P-(z>;?|1WM=U=|J)!FLq>Udk?^j?!$8#iy>JnyJ!M8Hj^n(H2W
z+qgoTuPyDVHTK$Z_<DfGJDFW9G0`ChG<}MumENt|7gUklYu*}|9JS(5#Ju9ApJeO~
z$uj@)J+{U3lKuM+*Dw8yop9G!Ej#E9J8zHFpVoi^Ue}{vrB?1xVNJWTV{O1;v4fAC
zwRN2?|Ln4=nO>K$)b#6wX^$5#@4PG`!}BNE_gI9R(eFJbuciK+d|NWfH%+9|_Tbv>
zBGQbPKc;Q#Sj(ZKcz*8oO1sh(rzFqVGurAY_+FN6{nPx2cixl8#uO1@N9U<+5pJ8p
z)3-0)efk}zu;Z34?TllrTlrW$q*RuhwjR8=!$RW`gVajb`%%40jiIj(hAs<b+VXM3
zp%bEBRU(<^=d|hye0Jk{v?#V&bFqHblAn`XUrao#tIJy2=vi=9OtX6(>(5dv@AmAJ
z*V(%reVuNl6wC@rd;ROsmYoe#>x4EjiR=&ynb>ZA`IJe-Hm_3K`Hxlkoa!?^v22eM
zTl>iD+r4OyKEDT6-{NNpEcFjK(6-v_SL~#37XvT3+R2$4#+Md%tNI$GXc(oPz8+E}
zVRhTM?Muajp2Y3mRcH5Z+_Ltd2IHs7j#<1>sXJ~wj$Ew1s%n8(#zZE0@sf`d&0a_P
zDHnF}EvYR%7}0*JswQ#E^Pt`8Oi9rWVjH!SuW+|4Wj;OWW1pNOfAEU$f>)k)i|8Hk
zYg2rEk-dDyzZq>G9`g2S-?hzt#ku4o%LFUVC;kj;{h4I-^V_w2R{zy@tJt~r#pcCE
zk5_)Uqse~zH$Q5nldvF3u26u1VX+BD(oZZ(&&ez<(JQFj8}+wHdb{BN`TmVwa}^~g
zFYn(nx5c>VwMWsZl{!1O#i%Q1XMEt8w4$&5^g}<9$<G>pN!4z8r`KS8hh6iu-)YIq
zS7bLtywNMG-`!pN?c3Lz{D-+EyCS+DR;WGlIk(iq{f+CP!%HRP*xTpUmaUrPt0jKA
zM^;`=mcO6Bpa169pbg<pt7n`&vbQ5-Q`1Qu;hNByALiE^%k&lROM7e~EV#!<c<Lvg
zRXZ-vT%L7QZF1$jrz>ap%!oO-yXT`tm?ZDTvNJaQhkaIh>{bk%<?ocTDOtWntIH+h
z*$sE4bK&o{Yt37BbV|<T6BP${q+OreH)r$f2fvPAe?Iy0{(1BN<<|WCyW;Qz=hN&H
zd)~XOy8FMcd;5vh3P=9E7Z*mU8htu8_ZGYCguV)ag+0%^JkMGbJ4dQ4=Q;B8?(NOz
zcAx&pZ|~=~K5nmE{G9zWd-T_zzaO)2$BdYs{ne-aZupj8mEDln5%0OphjsqL^N}t0
zGu!Ux^}fqpewkBwovF3(W}BA_J(`Mtyy~|)^5NdSd%soB-<aEz?sL|0u7S=ZMbG)I
zHfg~J)3n5Nf>k%$#J)Hnu;bV9pR>&$Z{Gab+bre%bfxG=za`qAq=-y&3%}cKGSzs)
zCcW8t39kju^Jq$m3z+`d6Qaq{xqgxd&y5dno?aC#FrB{f0#AK$Ldg%l`llPe+c5l2
zx+&BmRiw+tx^=4ppUM304CYhujPeG48&pKU2R)s&(%{VHkRuBfZq=~;kI=ccfKPD2
zQt>S&@th&i)1Eb*ZS<9F542;BvWd=`#hc|*xoe~UHKXWF4{v;^N!-S9>+kQ~#RAv3
zcNZ^cmkK!1;O9_Sz?Oc(M22aKOpdUHq`};FZ<A~Nhd(F>XCAzIJW)ybqhZ4I1DktF
zk2OwmOFd+^wSddvsjHH+<_qhYDoJTScJ7%qXYTyH)wx&1jc0BYJ#Vz-p6QFA13@_}
zuYEAMx4~!Kgc2VimaY#4W-ZQvr#cQ_3$_rcJmURy(FKQlQeSz5R8^0bNeV5ww`Q4^
zR>y$=(Wfa*LM86Yd468-p2wx0qG`h68p*qOLs}BYwb!TBM78D~lsfQEtAOqP%6Gq8
zWPf#8Cc2j%wo5#I)UwE3a?A4S>jzicJihF)N7VjlhNHQacmD5V#U;CAfBkoQ#gkIP
zo+HG1$&8~<pQWmSBX04gKZjG_C?(`i*XmD8VTn4^ajS~6Il<tC<=KPx8=14unbf_I
zOKD+S7do%WmF3M8oyHR@TpEPgA}4h=O-SiU>pml~@>1X|%>+SJX>JKFxdYExWa@V*
z3U6HZz*VGDXHAjsGj1`>pcqd6#&aTC0#kndefcsVUHXQ1zQoz7O^fa3oh&)vBKECQ
zrqA8Daqm58u9-@^yAR5I5Xcv5Y!Vh=^O9`HK56Qux|!Yl#FZmwUVOdD^=Gn@lY;w<
zZGk%zO&rgD*kNJ+?Z=dowSl4YCfdDy_VL5i+3f0%ez+#9@BQAQ^4vp+-(t>zifga=
zBNXI}ehd5jx!HNwc8-lRYs=A_v+{c$I;?4n$Xv_uB6mjVntATpx+{W<S6q8-U;j@g
zBS}LtuHlVg3eRFqf5o^d>*vq>esWXA|IOd+JX7a<-H~`rK3w(1SrfCMjtt$4F-pE}
zseXESWqD>#mHMmm{%oJT^;C=Cfshs%9-*yA8)dwzADoVn`t0gIHT_u5g*9_xg-wfm
zR`zloi&fa!6qw*SiQQQ)V7Y<e3a+c1tWONeZp%-$xoP}4;LjVmS@Q24(@&k;UFtG5
zAlYx@9kWw;Pr0n07L`7-j#yK%xi&=cRF0nf97!=Tj&}Zg3lbl59@)(Dpk>L-8|{9N
zemp-CD5>~`>4xJwVLlguJ57b(e$Cw`+AH0dFQ=&EsF4)As??(OtdHS6=1n~lXC^Ol
z{qXF^$JV_Yt>)K%ib#3(f1{-E!f(1qPp^LcS@5Q%#rBY=-KhuSL<&_K4>KK@=U%{d
zNn)?q1Le1TH)0s~F!)9Wo!0UG^5Q`Pqn*}#r3tnXif86OGnzGXKD(!!D|`Kq$J^uI
zKVC1QEdNF%raywee_x}_L;v>p`e3i8FE}sRX)Wp1-^H+fc}CYk9i;;4jMRU3c8Kq}
zy?xI9N0Nt>*^=kHXG_?qq);|tCG!kMGyeSM!w)npwrpOP)ZpB)UHU@P!(%C0CuXy}
z;fmd!=G`aPqS$ThRu|3e!TCpaNs^*mLoG+QS-_V|dGDVcKG@E`{r|5Ii}<x!;%gb)
zs^ptyAAY!f`}tq>dH;X@&T}=f?meBuuJFO>h{#R#8LJ$QL<dVK#$A@^VVGvVBjhQc
z0q+fwy2B18R^BhQ<s463jJNbjU9hBh`-?@pSGKOc)BnrN#XZ$)%lUQd&#iNt)@0V9
z=6O}5;BuR!#kwh-m0O;*eDl8Dx;J&lZ8?^SdKM-=lLYi0{TC1`SM~a~$FYrpb6HQS
z*~~9nI-WHv)hyPze{{jV+3T1~GlJ{<uJ6?q?tG-|IH}`j!N1TZg{ki5*AL#XQ{(7}
z+SwwUyHKI7;G>dp%k{*G!eT9o7c$r#s`6$!vKCdb)W$VcPI;|5Z;R)mk~H2!wck!k
z3LL%XyuW`VPpsMLYp0Z|WLKIVO!>fN@@-+i#s)W4!w*w~geJO4m$*Jjb9imC`aHuS
zM=`lvHqrO;(r(85Gk@P{HtFj1VR)A+W7M@pYv(7+Q?iDpoKnlgst^CH6<((sEB!A}
z*vBQI&V2h^t;h)ym#m%jpK(+zZAoa;w<(<Esqn~3+<g00!;TqWkGLN5+#&MtZinyG
zu7nTX2W$_qwoG4PCA6CDeN+1329cPf9pV$FS%xhYc;TwbHDim{Qn!C`O8PzL9#l+<
ze_ZUdOYOn`vyR3mw=QYw=~WjnbZe8l8mqzEoZ^tNvx9d{?CLM)J}b=#zcqzvso4RO
zsq-Giv!o_6rPPZ}H<su;H?zSk#X*a^>u{8D%9Pakyz?jXx&I4vJeoJX<m$O+OE*bB
z-<cL`-oDuR%JSJ4?Cc!h%W=-T<`=b5DC$JAx8;NQGcWQZdE&ONOJi`%ytpyqy@B_X
zl@r&ArR>XhHRPFBv8B+__={)y;yK$&Ta(_{g$Z2zA8^c5&FN^HY5%(eM>Oh}O3Yhj
zQ5=|h>acZ*j@VLZjl7~@tv3f&F8UClnI!7{NZRjfOIWl)`@<ueCuRAkKdO*=wnax^
zmDiSqHUaJ4pDTj5UJ|?gAtSI*PeYr}H;R{)P2g(nrlaqI&YV_s|9<AxY4fP7InBF2
z?Y&!|^6X~*mY1h4<y~JY8@fmJ>690o*EEkX1TSPbuJ2PSRcN|KJND};x%6+Miw*{;
zsxAL^!D5!W&*wY(N^06NMHxG+3Og-rKBfF)n6~}KeDU*kfp3;s{dC>d?!Wf3X6E;7
z#f!I}a-PdzIn$<p>)q0ARxh#ywrKD&O?J(E@=13Y(-jB5C3l|KT@YPX_F%)^17g~m
z-?xX#{ZQRvc9LHs>{!H#IiZ!eyJq*~t7=?a-FcMjjsA7UcbY*AMRGsiG+(QGr2OsE
z?8VCYhq*Z>%#08{5yG^lN+NN`^1p|dx$72xZ1#9_GUgB4n#>QY4rwi4`{k#_e(RIg
z4tzoqGq&cvO?qajYWr3@Klaz;D>3YhN6x>U?pe{D@-=KJzl6&MnFZo+mLIYCU(8*h
zwS39+rt49UKC|pA*SnO&d2f<v_6oJQexnVy<!<pZ?h#$vtFrM8&#R~-TB50C*3<dd
zSobAPnKRS&!T~+Y+=|AVat8!`ygpdEDo$XTaPY>J)R64e9Bdyx2lsi1%D=y-GT~n4
z$F@d~Bm2zTSlz!SGdoM26TDpVUE<ohf4&OaBMxt2v->DhGmnXRH(TKL7F#}p8`GoT
z{F+(zJve;JCWoz3L3_Pc*=KBU>HZcgve0R3XT&qdi?`mb{n0$lzFT;e%9L4}iqR5@
z>!#{?1q!avvb=x$cD3`HK;!;f{2bx0&PLvrEj@Z{feXuHiPP>=WTQmZJ$$pCac!|n
zrR)C9YZz|M5)gYWJMsICk3ar>lI>1234fmOcIS27r*Yv7*2~^6K3K5AcwQQNLuebf
z#9Wap4ZJ4`KZl&I&Pro?#4$Zie4|5!tM2)4GO0IDe@bY`Y?zo4GyT5!e0J0BXRd4i
z_^zF0aGEpq0oM(s!y+?oH!hnctt|6(MPTW6k4x!OA4y#_xtpu?cU__E291a!C(b`d
zvNNTMuAh#PZc;lv?H0SwVdJcMhwJa}t$1u3A8eVY%vv-1Ur2FKY1=3FEtlqKO?h!=
z+YO#Fwc`<+v{xQ%>S7Y+%PLK3x$t#++}VAqtlM_BWWRhDbxh=CVJE+xVui$ngPB{}
z<4*7Td(ARoUa#c3w!8NaX3hNeX4=WgGi<AjHm4rkYsuWO&ocU7!K%E;=WlMczU;NW
z`oyeBcGv&T6#8_;Y+_W6g4j)|g{xfCzM4%D7e6&`<7!Fu*;!xDJ-W2$+9UaG!KVrw
z=0A8H^IWF;1MhsdIPEDbcj_7{moZ#yI=$*gXO6B*A@8Bxe;RHuX`0+s+{JKSx#~*K
zcjx&*%fqcUtAu{P)E9KQzDuAenj>{r)wkEOlRuTb@0)(9<?gDV4{B!%hbtfd5V7az
zuD9DZt~I#FdQYMMDYNVX&y{{>8l-2+WZh9YEgZamTh#i9P|=nhWg2yH7eay$>b`p~
zqIfOT^W(3cy?sr$78;3e4LjnjF)3<hg4g%>J4cnY){94pM_O#yCwh2$=Byuk4+ZgW
z%e;5&%VMjb0*8dJ4p|SDUAOt*a$u^&gSULGR~aYRuMTKf=^Y~aV0+ZIC6a4rTdPMs
zbrlF_)>`1Wa`~e02QN<=uU`8r>+)o6$0^r2yc%!KP7+%?BUa0*Ol;bc1CMR{H=n;C
zwyDYb$X!vT+sky+6X#qI*}s>E(R!ZC=MMcZ=^0ALF4dVVe0f!<<jSX>cNcS?%iOkH
z_bj#SVusKn={KJDcPH<jz!dfNrR(<l`PWYIgrCz&-I{fC%d=l%(P~1Aw_SL~pDX)N
zMChhs92cA8;uHU4es9<Od)_;GTXjs$=Qk~4Ypf%5*nf%c)=%E>$VJgE$^L+Rmj3S4
zKj&i94;o0dO|TRR_j{32HNBLpC_^}{Ec4=Ry&na8)}*})Yw9skd%0F8ZFS10D|HKV
zLn>=yMJ_KeYWF|vlu;UTR5gX=`h=)?$&Cxl-!D47z4VpDXSR;)rcjr2RXZNt)8BDn
zeRXY*oaoQ%RcvfUlRjyAzu)|Ek7;B{V%mW;u6(zf*}1{hyRYr94!@MOJ9qVqq^Wz0
zz0Eh?-5R}%vwiml{aIf!5*)Qw?74gE!H30DLjBfCCpKh%-c!9(zW>9quWT~QUdCL#
zsh=mn6zK7s!R#g5PN7%Vwcjmui(y>)amCiH9r8<*9>-kybNzCa-fpdL*E4%}WS3tv
ztQ6LLaD3i;ukID=CY6;(n@QYaaKAX+;NKLE+gndLUUd`fNLqMe(~DmZy_RsdY${Q%
z)p{0j>#@j$11}b@c*n|FRh4J(_x|sfZ?CGxtbe%s_JP8)<=ykSrmg&CxG7+NP{Hw@
z=ih=Yw_acAkdSru0Ke0z`Hl0P9yb<mdQf4MvvldBr)T$8`o1`GFYf!_<<G4%Kb_+?
z%<W{bwlq9F&Hu%{*u6KOx^0bdTo`;Mg=OcxgAUvucLnK%njN!V@*;|1=k-eykAD`B
zaWF4UJd-PX);4S6+btR&em~Ql<Q32NJIH@^?>X&d_kS;4H1Gb>{d_m{O&bp$uG{`O
z9(9Z&Bjet~>6Hu&^AwmEgi(j*lE5n;3o762{ar47e4@sm-T%7`f6g^_U~%ftnG~Bh
zBRg`E@H?+*c9%W(On=tccA!Cq`#^$WgGSrw|9`Ko-o0Ahm_fy|zxwdxh$lY&Usvzi
zb+2^B+`X0m4qrT-6{9!n(~FWIy=zyuXoVlYc{$Z^pI-kw9{JkB8MdpZZ(sfDRn=VE
z$}c}o3jTR+e)IeF)NiYDUb&iS-k-j?%CfzGb7|z6{Xdd+t$Kbl!{qK7^VLNrr&j&k
z6t{MB(#93nkM3F}&TB4teRHJcGWKO>m&_5HeX}a4_d4^B$NSBnDpc>CHDz_tCz*L4
z%O@wr_N2RBp7PH6bH;>&ENQ}d7I$@yz1}tNX4>YfX(q>J)+Qb+u{7J?mpJX&_t%Sd
z&I_IX?0i=2I*xM+(PG(um*t(wKb`d_FYV#FH~FtW9sZRTs`K{#_S0E~Q$>Bh?Ok)l
zV6$>V<{_7+<CBXb^%C-rh2CUY|7`Owt%@x%SHo8)<wcz<>`yrGtn__1Pu;(O^J+(*
zuBoa08QiH|8`k&w=o8g<D*Lp;nX|t6nl^u3o?G`ZF-EU&^@IF~16hG~yVo%mvfZ3r
zr0V}BZ0=Ns;xN+&-|ak{Vu_(W*B396eE6AB&-vyIwaCqJ2N&J2&s2Z7{bE|++I)B4
zy^+1A+Z1D`zP>1OY^z2>*5Xpj_;X#Re~xKf&e3B$R<&8r{eAaMHoHT6Wgf2UomF&F
zL91p1Q_a%nRcz-a{}yEK&^-J1_1USj{&gSyofWDtaQ}bE8m*k}3dh^_v#uUxSr+%_
zX&H<3MwTs&tS?T-UGe6>9)EfM|Hyk%HWJrAtDecZ`eQch;k|m?cSQbdou=CyUm07l
zbJfw^7uQ6@9CVQSQQ+dw7HK&9;$z>!)M@;7)!SF(i!Dwwo*O3rVZvI*dn*o3wv>BV
z{`6Gejwps_`r#K+N+V5{N?tclZFK*A`%_v%U45L>X2Ul}o^<Q4%KY~C!|(r9pOe14
z;n$z{_xa21`|X$Q<5YY6pF@DDqc5&+dc~=(n+m_>0-F7I|30;-{AF1DUfGi?C%G;E
z{IkvMqiVvH*`a&aHC|cqZ2Hk3vND>V*UKKd{%3oZWbR4h$_2MpxL(>nTmM|f^tk+M
zr_V}#dwyl>4Zddc+hzZ1JKdjG+OoC8FW-OdcFDG#Ehm*(u1+i8Vfg>nwk`klD}Tqn
zo=~&rM?ha?=6SCJwH6y$=X0ruu7Blua{u1AxfeUHO?Y)O?HR{6?O(#xx~0k%(|e<L
ztxq(%&lKR+a(_CvgTMg;mkDatj4Hn$Gg;Z6pPxIc)b{_r2*$z_>@&ZA*PL*U|Hp;8
zK97m<0w<<lO=WrWMk<5ZWLJ#n>gYcgbb4zy?6q$D_jTDU-yelnx~sPHd#K$|G*OuU
zfmhF_?srpWuI0mHz2=p_L>dH57Hz&+Y<bA{{JcH?49yS7FFDwefBa^u?sATLwWm*?
zy^?5aI9>U!m*v98M~BRw>}C12CoAXk<)anbW==W(aAx)oxeJ1vPU08zr#*gsakq4Y
z_?-W-c5(-q=RBy`xg`Gm{vS-5_c)?flwJPAH~-$_$7<)7ebqX=pK*o1^83a8|JnB~
z6MQy#;w(=)1OBt0cBuEfR5q6V-ZYKpUyI?Pry(yYFWmQeT4?s=dFa!+`gk4f8MnDE
zIMut=_ZKElWV-b3vhr!8JAKcN3fak+-%DQ_vvNxj?|QDDS3(nud_9)W`uySL-4~zA
zRCH#|6tj<i=$n<kN<!>&j|9W69d8$}_BGX-=KWbcHpzS{^I`sV*+;Uzwy>?1FDU;e
z`R39Zsqoi<M?KnpvmRd%xAJ1izNXa$X59b2sAtIe6}10x-|#c_M^0?aO!pI88PWp|
zU43o)==KfUsPOl?Gj7Qw{}dL;4n6pwb*{nrx6@9&(lcB9tgJ5byxaTL%XY0vJK$CM
zI&H%}n>{NhXz$3$lYX#D!gprq16{t4O*1F6ochDRw}Vf}HuU&(`4`Ox{7w2k3wQ6S
zHD2_|`6b&WyA%HzW7JD_xVY%sfB3k!RdoHaA1RR+Csy8{Va&b5H+@lrPgtqx!nzj;
zcfF6Rh`qVBHGqNT#+6t7JNA2SJan~O#ra%eVdTnn4;Rnf-M6db;o9#rP6dhOgetvK
zdH6SEjZ;R}Y=IMd8Z0l(ZDy#`x+kve-pOz~VTI(TvmerpgW8ubuRDIaQSy0GS>Aij
z-z@98y1Tm@_XaPTe>BZ*)l6~gW7bRO%l_5NZaf_GTH}T7%_)_yGuedlmfgPHn4z)3
z?)m*|-Jg_xx61Kzdl@${UFw}zY;SFOQf~X9OZ7_`%%1Aa|8!HkQ81!n?Y<w6y4SC{
zac8!;{H#~{PdWMa`%AZVDE%<fKW562w7nyojVWmRy&R|0JlaQ<54P{%_!;gJCeLJb
zM$K8R`-`^OhHS3-+mD$)aj!M}_CBrkY<t1f1Ev>Fw^x2U@O#;R*E?-&Grxab^10?m
zaI9|C4FQg`;%8*$>NPlpPF}uxHSZ}I-}BSke%o}YnzWW~it32_d0+j$$c9g~jGyns
zomk&m^SwqghT&jr*&EJ3&fiu2ncq!+tYbc>Q16myeC3%%ipe`}O_}@nC-X)r-ztG3
z72QqB$(p+rcXM55xl?;D@<{T5E3+c5Pu!(ko@M^LQ_`|Yo$aqqWRs=an?%or^Ul7K
z-gA3`h^bt`oPVrm<S#Z`-Z=c`_x1Df^6BQPZ;Zbb&-QKLSijjd(r;5z;q0rIb82Io
zE|}<Fzy6g)Wy|TaQu241W=~=CYqI$ycWYgC<M(ws({EljU(U-g=kB5_oEe;NpWpP|
zTg6__zkkBoIcdH-<$h*g%RY5;$`_F>1_qi|Qg(L9vlsrC_35fFJh1-Kf!0Np-0vK?
zH>p>BVC3e@=-?B-^x%oGyk8G*HJ=gNg`13vCcZwn@Uq{5=PKD{b7zMiO}cOVxp;ni
zq^(|BD$i&6TIsTbZqq8aKTN*fwr__1_3aAn%gROb)wf@&&i9qR-*h@>Wytjxev%Ha
ze^hiSyZV;wzp>}--4$;Y@7}OJxATuflE}HYzt0whF-4bzt;?)xKJ)k7k6x>LOQ-J0
zn`))#`82#iz{pl=)xMi$vA6%O>wfoI+ON*k)s&-K_e|7^;1g~l)&JgZoF=aGOY7f6
z@tzQA7j3;s-iiK=jLeU0vaA+Qe!v)VXSEF1lWlXBv3`}G8n}pmhV1GmSAIPHD)DmV
zhul)*Bh3fjT+*+S=eWn-qHt~E!`Ww7)iCe>?sM67@2toAM`C$71NQT;4_k3(&Y|P+
z^HP2m%=rF0uHT^O@aC^q8ul^@xE%ZBs5arZqGLn-ov3xMFZv%i^3v30srdT2%S(c0
zR|*Etw9a1>cE|cz>lFLiNR{bNO?#i5FHsJhE|dOz^XKE@YqoZMJE`Cj?`f;xU0cYZ
z;mlQ<Q0XOc`t7e-CQo>a?8PoKhMHYonPB-+rE(fOJG;ND?T&qV*KV2y$p6`T=0d=R
z%n7+o&W9h>AA2RT_<gIMt(e%2HJkxj8TKX{?#A^ryb6DP(c_2G(tGyT>UpMKT`F(j
z<z`~Bk<H}uiF|eTY?TO~F7Y|X_hbab>aYL&#r@lX@(EJECrVlD;rA6&%n90b_xJjU
zMNCx_o$Js2d%1W;m=OP#Z9g9=vCnw5JI<bUo=?VcrxnReO*-kE^O??b^A;@iTK!jj
z)<J7-55_kuKTL?z58wQ2(~OCS-bF~>JooqUGCzqgFJ^sx_l|vo-d`1;)trBF8qTKW
zG~c>(I4<^$(J%iO>{l<oTXphc)|B`k<_ueRw|uU&)en1LmU-q>=Jg<z6Csx?H*Prl
z;Fgc6=ES!`VKZ(?+UZ=C=--n2L*}1{=_PR+Q=7-^Yu|1?c=<MaE*JMS>Hc2|$xqw)
z&)&Pe^75N|eGyYmGixQQZZ!PhQT0CRP3}qAsB34dV)U2IXG>*@uaROo>XX&o|1f3p
z+-crBPRuwc#8x71wc6hL+qs^k8+t*~o8~dhzVxPInwtZg`RQZt8Tn61+W8+WkC!a&
z+*$g_(`WV3l$0sI64j5zytrmBA0giVu$#Z2@F3UThwQI<FB+Yk-Tg#q%F(QvSU<OC
z+Qp(Ls-z$Fud{nGtI?d{-rHq63)qfUCorE9x+&Dw-gD~0O@98(mo-<#cZJUM&H7Y(
z^4MxA3+^<z2cnwE*UU@ZypE+c=sfhDxtm|a;NOcUED@8~V$&|j`0wzzb24@BJ~55R
z;@JEJFNGY|G(Jy$$6B6fseSCJfs<;oVQ{rzaQaR)cFx{7huKs0PX<g_@O)$Cti3B|
z39jYTeo$R|<Oqw|qV-oF?Ny$|89qhDG3|DBR(-DXgH!)*Oqi$b{Q2YVH_vuS#it+3
z>EF$M$NY<d;Odo=LZ!Cey?-dqh|fUg&i>i2g~aMvrSlI+hD+S}$@Y7XPGEQBY{3Iz
zxwDE)uN?jy%5*D8v5WDzc$I#1q@s*6w@CKsu+!$w59U7iUH_ijp<!C6^OIady=uGj
zq9(m=g??7K65Yv6u00=SsczNM-TdYLzn;rideV~S{j<2G{%U)%vFmwj^&U-4minwi
zbA;>eaNo?XpZ1>ZX0`QE!JRF=ZoAKX{HySKWBjZg6BV7;hHaid!<6^Tx1xW1%m37Q
z6n|`uxX*O?XXTEhD<^cX>}i=Q?AaM7`+1W}$cZY;KkF{NeyBTBviGfoif_r&FBNK%
z?H?ytZCe-Ec`@WN%jMEMJJ~}C7b{vqJ~Qds{4hKzwvF{-=Ys!Nc*<TrP<i=TY~i%o
zQTOeqIDI*Ec|~Y{o8G+Vl?yt)Mjq6YsPmTZau@J8{A*%T(yrGkx=JgRt{vEP-~to7
zJ?DvSQ!T$SKi&8FVP}L8v+&O)yz^?FGc(5-v9Z*oNDE}VXLj&ZZEH~SkmmUG{i~r1
z%S?&BNf}Y4_dadpzvK~Z=%HM;^`LQlS>#+H<<dKK(h0gMKMqX2rl4fFbD`k@*44(m
z`Zmj-#PA>6p6S!^@#9qC=d)~D7SH8L46ya~END4a$aZtf=WdhI8+LVTpZ|Swv*K3w
zmzpES&CiwJ{+{KuICkz7p@m#x(;wPIN#yK$eyiow?EQ!S-P%_-&G%len*Djd?Pt!^
zCEm}!Te7?_>*mjbop0E!b)uJ-o~~*<_DpxNmRf!0gu;dSM#uCmT3T8zx=t&2!u&Dc
zOggGEaZe=cvUMAm&)Co=RkA|;x_RnMt1ItrNqA0}XwG4EY15bPq6?v{PLa#p6y}RP
z{@Ql+z5D`YvD6#9lPv#bNNflc*>lO*syWkf*(Tu>-``Q`ec6gu#rHS2nQ@Bx?BBba
z{o}`ncmKZsRPen+c9!^=0}SWgXEWA3>?jdgeDQ!pYIsVJV3F_YYy3wiPc2{l<M0Qb
zJ*$tX8u`V^#s1@Z{9_kKcnN>S!{zf@JDh_wqK^K^nP7TJ;c~-Mv-91`H<c3}ZLa#b
z@5m08_79TPrHeL1N4(|wzH;fy$Eh2&p6$xMa!h2pukGzM-j#WU@6G<4<GuL1r&QzH
z>c)=8%-@xEuVmQVXi*`;*zzT*=~8X0pYeeehyR;#3rvgIzh_^=b^pVWskSBW)|zK~
ztA6CV`6Eb1F8Z@|O}oM&WuaS!g<GcfD>fz^DCkkVXe@WDm3M;NLbh!u^bFGG?p`Qy
zC)wd{9%mze{jERqyXAiJr_2qmI5Llai`|-Ij;&psYBQT{4*U{(dARxL9{XK0R&uab
zU0!qSUfqP7RorI}y<c~#^?R&H&jw~5iQVkU$4|6($0i)sys<_~;nBv)2a9TQ<uCnv
z<J}_9C|dXD>8pPhyQ@EaTr%T($_X!-XP+zeTjc7GPSUB~@bgeh;he&Ep6L>yJ0+&S
zu}M}c{nX8vC-VNZ#!Z_$+fE1`KUnm-V8&jjrLC@>Q(ooTKU-=2>C!8e<Xxxhe|gFM
zkV@-!x0736p0Ke{`RxPlB>yAEW>;iCc>IrHdf(u<>d8KzbhdtrRr=wo!ZwOKTx1_|
z+!Q<_cf9?Hd&i%~zyjeZU29)t+&rJdBXf^w#pH;yjje~jb7o9C-F5He6W&Cl=_d7T
zznj)@Pl^?+%;e@;^sZZZCcmXr%ZbW+J5)`iowJN1^Imvrn&+HR<7_(>pFQDAuknsg
z7c<<e_|B#-Hw;|3$U#1mQ_)Vo^PtNUYuP!sF0)^C<K?sD5S^KLd3VynW7nVlnA>pB
z{{atkYdOo&>kA*o#pN=z7U;iZ3RAhWLAZpOq0h2F^4_ij^FM;S0}s47C6!jckL}*o
z&07<^6=n+O89IE~>(u*a)xDUHu8)pBHZlpiw$>}cg5g4f&iYh8j;oq`*0V^qDwW)v
z?a-){7S-6C+;QCdT4B<&3p%F_dvf3KF@G|(sJm>b#aF2*Vsibb+p=YCW@pZ29V*UB
zh@33Fh&3{DBHOiti$s?{4qhv5U2|oF^YwQ*eb2oWEPEZdUOSv<aO~0ix{Sh$4;S41
zaPge&iBLlWkNpAS?EfCzDZJI(^Wb1&zg1@F!o{4N(qAstbN`>f@A0{6qQa)ti?U8B
zEZQ@DzTqJbK4C+nDG{GFBjpZy|9fJ<?o{sfFm1-)@VyJ)t`S%16STQ?Bv#StpJ$tR
zGLJ{Islb}Vd;Y&mn5OqiMa@6YY_wG}`NPvEKHt`a3e<7MHh$nXKhpJblj6zlGspBd
z1?<XfSv1*Vc5HZq>*|kR*Pam7&wU;Fb={eL&Se7U-*1jikQaM$RZs6N!w<2QyfR_)
zO1Ey<F3zmppdhwbeZJ-8GFO8ytL8{|%AVJ{w;=7<j(=ZyIRtt?uH7zV*BE(_mqF;1
zi+}5J;T;oKMmy)MoA|ybQQUH2<9dO9r(E`#;#xHeXLu~{<J@^Nsm@Zfuk;_6k;Yfs
zjj}E3uV1Qto6W)4@yXqParBuv)x|&A%a-5xlPtAtt^J=*f9@WgFk_PE``VKCM^|L!
zdziYWOfwDcsdv9*ZujQpLv4ZJ3HL1yH&1(FpZMFx^UwFEQ3euKhSwVszOGt#-Rsk{
zjhmj_xfRps_xf>a;^#k){!Dx{O@-g>Q1AC(0n@0ASBKN|CHvMl*6^I%I;+N+cYET*
z!yB}va&LZlc01#5Z0kw;^>gLj*IF=E-$=d4bhi0Yi9q266-DiP*RQI~7JuTz@HhNS
z{U+g62XZ5JrfCEhcx_NlDb!kY`2|mrua8mTmaA2VPiD02*H_wk#A$N&;gTy?ikB31
zYko?ebV03^qk=>CuFtw+oee%4a}Rx&s;`;-b&Bk9;puC(%v}`DsrSR`uFJzt(TcDB
zxAN|On`$Ghxzl_5L5Vxu#TOdBoRXg-GX3$x%j@UwZDN1+?{l-zp&4v%P3P}kBVMz!
zz45iz-q$N1+4|aOXO|baiOn^V+{_f(_<GNbyCU0D_RX8x>852?r~j1e^uHZZM^l|`
zdQVzD7MZDF9LSLt<$bWQTX2TM#0Ccyr&?{9eXJKm1Fg%{kIs~@`|&Vh$*b273LZ(W
zZ*tLWx@t9-Us%8B=XXKT)TR74x2#C>u)e@E_wTFe73ak7JWS>E;mTCrRJ3&!^Fpc3
zTD<vPSDF64^8L5$;gTbNBKBs^dv5Qxys6O2ddFtvUG@sqjt8|^Byt#+EK&<q_2LuR
zD$p#rRI6y;*|g4&uT(n{uFl$Vy|8i4-L$|u21|~UB7PG(6gK5AntY(swSZgVbk?Eb
ztv)hKpGzGo;n`{*Qpl*{aH(VV|D|SS+xR3Uo^=UtZ|ZC-6Y1V3k>Y8uq$q#?+UwxM
zrd>%vd$%T4o4)+I`94>AvRnqsoT>Hhk8NH`ytsP*V$;8M*>mdMxqt2c#;U5$qc~0X
zVBeVp*N1$}(np@n*<;(+r4n90L;r)#Tj31J*XvYYU$wl;CN6(5(c525F2B0p%i~kA
z6i-IHehse(d(90FXQQK9W#>$M-yBr<dSQp_ZC=0JdBUy^KR&NnHdpv^g7ED{XC54^
zF!|#$i~V4sB=^O*pRy4(AuTG;1hxrD^~;1*6z^4-D!kTcW9JPq)3g*#m$_>jo^M|f
zTA+K#TOeHNb*FlMq{8~>G;>zZ8$TvqT)r{NMmVxQPA8AqW0CoB$Br;JwQ#>*|4hZ!
zZ!uf3MbA>|Tf*Y5uT@u9vqi?~Yuac|&)_!uI??2G_ls>xX~C173*JndJ@uAr1n;NP
zOG!OztTz1?u~A?0p6$G<$>lQtNYyFAb1F{WR)2S9Q}(~4os23nF0$KH0#E&3aP)YH
z8hiF^hJuZ??zjAO()13hs9tKkq$YJdw9c^OAfM1};T;@ezT)Rst!K#*`x*Z3*`x_x
zRU2BPzr{!|&797dcjWtJj?JClRNTEx3*Rxx6&TqU=5cw3IA&PH-POA;k-xFUnJ2d2
zTstIZ(GjbV`}58|oV?hxv~`W%x8pngCt6K@SF_n6R-WPLoYhlLE-4DVen3PoVB`CS
z*u%%X|6NWjj<xxDb-n1yJ#u-|Ui^Es%veV}ndjT``Uex{JemFV%ZvDj4}`YgobzP$
zBqqI*ocD^wyOy8lecgYm?#4G|2QHJ&#9!Kc(oe6?h-BvfKYvwP@R?1UzorFUz4b4E
zZ++VdHSg+2^RKU%yyWKjQ%vpCp1S`uxO4XP!_uFP;_I&4+y6W3dcCjd!ueI~cfu|$
z4hYyh$(`LVL^k8#%GB#OEn5=1Udo2I>WHZ=o4L-TYYR((WHYy@`t_$domGjOUw+7l
z^Es8XbLSk!duJTwn$Ip@!1Lv#Y?f*3ZJtj&3|5{GC0Ku3ZT#DooND>*@z==3f$y)Z
zv#LEAHJgpiBzdBo3jdXR>m$<R;`gn8<-2$vdrp1=XItdI(7bm?d5<-UNTlvzo5)*t
z(tW3~b6Q7%Oyeuw6i15|^BG4!wQXB7>%grXsY}WW&#t|BX0QH!%fAn=cKdt?>GAb#
zma|qdGBdUbxL|wPRYLj1&FfcFms*CNd();-e(2ELhSyJL+~at5t=zxvPoUh*^-Hbi
z>{frE#Z%P#e0xLPCEoI%4vS}{1+f^{rs~@oC#No}d2vxI@8RzKGPhzZF4P}ow444^
zs`vDi>mOD<5GmGt7We%JgW5mQWf_YiTb56h|HS!a(~Dcm5x!9?Ha}D8G+Lc%Fo%`f
z!0M@-+slJ#8=6kVt26yz_$>6G;OV6gVmFEly(hEPKfQa@_{0?R_OK0Km@}7^?wgl>
z=SXde(2BxGrn`Jo@BLBfF{s(KW3NYh&Jj!bj{+Q1Dv}bjeVE;I&nG)Dz8CcD@odnU
zuq8@#aY$_7_G@2PDtH_aFz$CV+nr$WQd3d#ndijUt51u~Jfg5br^2htu+C_sTcwq{
z$P<Z!;=j^`s?Ivu&0(4x!2RS1vqE{9#1f^r=e?X)rQdDwo}+svd#hGnjLec!+hb4m
zyemAfmU`t!Rvh=ao3{(Thd9UG-*ToV#Ny4a$7O!~>qYN>O|Cals4)?%u3Y?h&Fpj9
zbGAPVDd{d@Z>(@=+{hX?v*56AUS)~!A%!}Irh}orjOja+wBOEQO#e~a+Ba?bc9)yJ
z_uPAzMD5>n<jkeXS$7u2{H)_>Zt^_Qll!P}Ub)}D`F6thCoHmwQMB*4ahQMZfxX8c
z_*n1y=2^12aqGjE=lzR3=gzpgTmJp^GKOa{ix=*SJG;5L{OMax+5YA``;VQ_sG4;3
zFq@x*&PmQQ{|aZ6u%+J@ns{7a_Eh+r4*!+YX4KzK`pt8PV{7m&zj>#hpXxeMGkxNc
zveywys|1~UmQQ<pWbW<FO`jB+mZaS-H8Rt@zx9RAk>!m(^^b}Y_6T?ND1Y|&-n&0-
zj(B*-qr|j7oj29ft+XF(5ISng&V1th?~fL*d(9^=dVj#C`h!A4fNsF_&OZ+?=KOhZ
z@bKcu&GQcESJ+R#B-S$jYt>B|`<e>Y_*}h<r(Y{RbzlDUVZ3~p?`F-}?fvq9Uzzv6
zIDB#S^7Q|fRX@MnzCZt=Q0?Yb|AX|RgxC4JG_ATcN4w~PaktR~)k2QjhtFJ}a!m5s
zjPH?ZyFP?$PipU6$8<maVy7-=n&IC=x9-e2c{cxYUOaaKD__&j>Bjc_pLRw)UjN)6
zLx0){f5jg$cNXNPYb~w1P$d3){{Pm}Kc6#~7YFlHz1XpE%JJiAofp?R@1A_fl1u)j
zS(1bKPVvMisUe$g&6unwrsiSUaQt?tqeWrxm)R?4x;L&!`zC(ZvvZf3+ROv0F3kJd
zo7(@mFHJdfV9CRE%cr%he)&Yr?19I_)m(2pmbrZVl*>M+b$<8m`9ChGHBWlybG7N(
zJdMn%FEbU-#Mw5l^-~kq{TY?e8|8EDq@w4fZ%4AbG#38tC<=;*^b1<Hc!Su=qF811
zi%X?vvJ_4Evs$e*WkP%Up{1rZO-f(Q7Kxb5k!)>^_gcFxA-(R({t1^_Za4<MnoxSp
zVn$0hr+`~lL1$daKhZMH#AS)PHj7?o&iK1gbGfvaNc$R%n9Z|4Ze<ELxjDZpQn67n
z&BNF1h!pdYd3@^|r)PC+4Ek3i{L;u{PLdAuhK=`>+D~>GOj@M7I#kJ$_qR*Ls~eB5
zr|<iAZnBK3rpSb%lb>IDXce#SUq0o~v1R>+c?rBtY*N;Y--@@bo3`VzXy%SUht=0|
z_!Q<}Sa5t(%#VHV)?GisxFOGTuAoU^+giTmlU`W#FAHLNawC-aq~9Ty_L%*TZbaus
zUu8PFP@#9>y6J*-Pp@9`sL2j~*e>sO)l^9S_AHr)$Ja%)$CO#6FX~@^)xy_hTIkHW
z#+B_3Vmo+@uBd0O3r~Kg<Ql2L+P`Wo<M$u47Ddm#^<&xkQ<fefbE<Z2$b8Pp&YU>!
zO6QI%i%V@Eo#(k1dvD!OB~OKU7gY>bEmJPyTdLx#Z1?-tf{zt5_C`*9V(y-~Y3V}s
zJ6?<A!*)H2&*zo?FzvhF!D=IuHAjvxC5JmVwJtgRvuiTf-iU%<5^B9KZyKu1n#+(I
z$>yfI`s;^VXByuxF9_7$JLiXd^uHC)HF+0#&s!_^a`qigZ{tHUF6?ubH9dcNm!)w6
zliACnw_ksY=oX&t;@tLV8uwzo7SY|h9|bKXH9OoUH|EWq^jCY%gc;T+IZsCVFI_0T
zn#pT+GWWg<)AM%moZFmt(56gq-?Z5`-#mPL{QtMr_hlx@u=P%OZ(H@}wfg^WPvYx-
zKDoHxYQ?=p^EGB!ZhIN(v(@V6r^a=Gm%lUq{JllqVpYNAgWq|NZ{8Hq+HU-A+um6J
z=IqwX-HykyE+!S;w!Z%TnZk}GY;wl-8PaPylY4%AEqTkQ`1o|y&C~8rRBf2}&V?E#
zWy!hCspzW-?#nRcxhZS;a$^6zMcWKZVi^@JHFfhoF#D`H%~v&P!<(Q(k{UT#bA4BJ
zT6!JXdhqaSNA;YK-!@Nd^;v3peb$awi79THY<gV_I42%EGC5P$Z&u7q9k#I2DJ?4D
zx_NS`5@BX+kMG}nc6a9U$}+C^v8z0m<>b^&zQOnDtV%xTnfD11G3q&=c3sLbc`$9|
zj0NiYdtGNQ@i3flJHXOqdC7-KELvw*^LzdJ@+j84`-khk&ju?m^@aAc9s0)i*qfJY
zF~>y9t#->eW-&EBsZeWU-*Km>Kxg4?t62pbIT*{zTPh!=tDmqv7<us8<2@(0e0AwM
zb}dzSskp_F6xoRB#cI<<I5b&bo>XsekvRS1*_X&eOAhXt^*p)7Dpf~!>hbJnc{f_#
znN1Bo<6*(y)3LZ~E3eUamZ!_Re-y_SvO7KrF_^x}?xOxg%`=XBxO}%ioRM>8{l6vi
z|GD%YzIO1T;Fe`#7p+n%xMr}tu2BelD|A`z=-wI2cDHVm7C+ahzo^=oDPg5xV1DrV
zr?+ZF19v<q-h9q0yiMY@re=Hm|Bqju7Psm@dN%*ghIKjfcF#817av-)P$F-i!FSQ0
zc{ezute>>b_bru}VSTAC@!sByNu`3O&-U%;Pw5vr>V92h*L-#NgmT47<;>)g_|x3S
z<{f^;WA;w5#v)zxUhA@Fn@?L?uMeLUUK@Vz-j&s!!Y6L83}lG2aO;VBxjlNBgZ%4E
z9-G~rv!>LDzu2o`wf^ihK8~+^pKr5u^|;*foxrxr^+iNy{OQ<*$3^P%+R{1>TK7L$
zTs}Xuao)pzD~r{C`tMv=v;XYtOU?d<w;U|=mPmX*d`FpQ&1tu+6Ej0{=HKF1Qe4%k
zy^A9!ui%l#;@-t=!ljb-66-W0c;-AwN_lcJW4=bk=@UyH24(lRGM<QDHtV>8*Mmu?
z6jn*5PTi}RGwnm4#{qStqi<7;_AXO3)3N<JO)$W5SHisCM^%?Clhdhu+jFFM{_?|T
z@10roE`G`M6HYmtQQnj9tPEbZ@!B^(N2~gh!u&_6btbJA^=E$GkxK79^uXPt=B-?G
z-=@;u;E-LV2ja!e?mM5o7<p6npZI}WufLwYy4SAi+nR%)7oNYfbmKvJzmO-@CoJXM
z4u~9TI2W?4eYeS;+VD+_TatfFwwL=?^h3j3XsKztDo4k)l&LGPs4RSHsCY|8MrO{!
z_YGVJ-2M5wU5@BY*md4(s$ZAb<dh{k+##t}y4{hcmD}3VJTf;hZ}0aHx^JEpGJU&Q
z($v?dehBX5xcYd_QuZxk3A#4wMr*v-w;Y;s<ixq~>=?hKpQl}}b;a|&JyPj)Z%2))
z>@j1JwuS@m_p<CUI1#pd#Z9Nh(N1X-yFa_=_`A<P;;L&|7Lb2E#L;E(_4xJ++b+px
z-F);kMyIFBf6LLZ9e(ONdi*BNZ&rUf`OvH0fXQ<2p8fpjx@Do+&u*#oPwR}k&(2+H
zcAQsP^t4WXvQbj%$%{O-52H&I8kXj}?7X!=YFpCmhM)qG;F9^G>C)jI3ti5u-dcCy
zwDd|g2BCKGr5cWH6>+h#>my55I*lLXaJoOcp<LX{b3&)%`0bU6ucyXWiNx;iyr_Qs
z-Pf+zYi0(D-0$6zUaLN4-=lt8T)cgk-ijMjMA~N*o>{fyFmE*fX3aD6uB}#oQoNh*
z`HfR;wUvF`f4s8q1-iOVV}CrA?NRH-Bj!rKBNo5<|7q*qJI7Wq+c5uY73HX%Z6Eh>
zSNj4xwy#HLeY(Bok?+ByyPQh@-<src+39(d!2dGV^W}>dt<fnB)>`b?SeUSR=56Nu
zGj83z?i-ITJ#d>PO1m%nn~?7pr3q_qJuq?o)-8~u+@|@e-QLY-6X(66lkdZHmZ(J)
zMi!sEt|mC??JD&hd&~-oSINYm?9s}STDE7NlkB6bA3yR%?d7X6pDK1{@)qG@?mNy3
z;dYA|jbp{MPwh|s=KU_k$>>a-W9t12tKL4pkyOEyn&sln5D^>No%l^&B;07`iW?SI
zTzL=d6c(kQYb~1;d;RpJ`Cb|}wP#DKTc`H~T)H5*{f(!}=M%l|##Zb8+IskL9aEif
zpnMinjrU8ot4nrYd6e`o_d*QA>A;@j4i9}l+D0C@wK#1@i|~y%O_P!~^4VRPs3ETZ
zcJb8-RXd(<H`LhAKAF${#pKhKlZ?)^_CBkZO3CLv<Y-@Vx<IXsMgDzH|6RMyx1v5Q
zi_814i|?8B1Zy85W3@E`JM=x~>#DrH<h*m6O0!h@Y>uMCJ4^o+YYGNU_T>1-CVU~_
z!sVyAQ?B&$DDtXZUbXC;XH60Ja(Ri8j}uK_DqCKimitw9`Qy-?iBH{li`zJZ9^P1?
z&Skg3r>XV(n}?g(`DIj>%nZJ@A+hM}<JY@wXTDdLlt{kqnX+dh!{P#$S65V2G}<TM
z)me8oVinsvfm@x{>Wa>KmAlIf*p5zLx4Kk#`@Kn7CmJUBta=}<udh2{&9SKCSIh3N
zy1MDnv8*{_J-32+Do;N<7%2TM<mZ*6CsU#)9j!~66tP@))!fJ2g*&eW^06v$KAjpc
z*YewBhBSVm@Ffd%Dwj(LzgzN<Rr2tb6FCO<jPIA3%&Od?w3u74@X5IgUg7TrpZ>kP
zQg0($tk68gUUMhq39ox9mw32eUsjnTKD|(0O>BOx`Q0yVzHMtCRko*X<IT37{6gxf
ztHbKpWyW_lbmUYQuYP;yR>{f4b5mOS%H5?I-mQ7Uw)S$TWA=1Wk;O9(eRXAcVz1Q@
z^!$P4L-Tv$PkggX{0tg5Zpdosd@(6G#P`OA*8&NJ)>A?a&aXL`Qnpo~-HYwqRu<s~
zwNyuQ1J2FYvcF2Ua;r}iyUjB<`djCXp50G7-Zp$oc*UG|sX5uA`hA|qLYsEUqO#a3
zdxJw(dHi0F{2Y$=E{qBK!xDBie&%6@Pnv8ZUTWIk)~88Kf4au)+N4dB47R^-3Q1_!
zP~wif$q@I@n4jfz%?;a0*VVosYjBo%U0#zVqW{!CCn2^V;9UNp#x*M*DQK%6X=ab*
zNx9l}HFc|6q_xjvT~1r30=EB}oA=jUT|3`Iw}7*T(^yPn8`msr?PFKWRsOxvY<=Y4
zEipyp#TWi=yN8#{>>7moHmhD<vf%X$!JVh(?XdbXWiBK0{@;HUk6pda+ZM6C&hEIt
z8kr}Lc3-e;=)Qf$;g9=^Q2(%LasTg0J+fW1@9@9<F?Y9H*QmypKKtvS-Ll;xPWM(m
zd*=&>Vh)vH4_RM@P3P|f=$Tt_o5?(uUUc(|;M9*Adau7PUC#QdWY)>!);kqhS1`tJ
z<v8)<*y}m2oi5)uK4V(e82-ND&fC16xaAr5BDb@yzW&%Cv&hm`!I|r+kR6AERFvZ^
zi;e3Rp1NA45<6{9d&r!f9S@JVt_|w*dExDSQcmsJr^8pOA~&xKe`@gi@2VX~{4EQ`
z)SewUc$3ll;1mXxBDPe)f_NMAsV`2o#h*@ErqrFXGq+4LJ~y|{A;vwnp;NSvk&oxo
z{FZiAyM%idTUVcv5M!C1)?s*fi<Jd;mK{@vtwbw7Z{9XB?RICKUwc?z{+OFzxlnk<
zK^4vYQHSEyM5K6UdmMQ5#(m?2OjC)8yOZ8bZ&@e)ujK;c<BeY<znFx*Yss1`E~ERU
z>ukN&J@HBnPU*K>i+6EsvEK0Ph2FdF^SQ@fq@Vj6c;!skMu)bGhr*`pT-^8mbBmpO
zd&kddk)~zo{(`=}T-w~W{!XVkSznu6z1pPzJ3Hd^Oxp|{$piMSDcg--URbs$wQR$Y
z%Tk;I1>D<9I$lpYBg6FhRD@o2ts}eYCPVhuYYZoMcBFk?W59TR=FH2ys#jNv&3N6Z
zF+nll!YqktEp>^t%?Gzm<K7;8v2>bY<ZA8BJufrE*C>DKl`-nsvhbMxl_tagC!=)d
z=glZ(V>X^Q_il*6%Oi3Olgmx}x`fj{>%=4#^>>~04re^Y_WYahVV1mEn=c+<4Efde
zXY#WB?d+aK%YJ&-&RaA0!m==q^Io&IpFCN0ez}_QGAR|G6k7+reQTD_>t4V)X@YW+
zUwuIKsUv|uv&<!2B{<6s9qJ}#ttwcS8pPK==}Te92_chPQ=&sF61|_!OOQSs<7U7d
zA1UGXGEw<Q#q|YtOV=8AUoKs+?e!}m`6d25x|h2SJrwx4bVh6cGfmcb>tOwNF88OI
z-|FuOJDDUGe&fSLX7fK6KZN&Rx@XtP`Dg?0@mFTMPTT7woLqiR`T7)I!(+M=Io~hn
z|2^gTbOp!Nd?t$`wxrH~_wnMU9sBveE_uuS=k@X3x*IqY)OVZ-+N{<Zx^d~WwGTfO
zou2ozy)Q5Qo$A+rpWm(0J-GN&;J4`Sl5CeYo`1W<QcC=?y0KP|%6+%aiMyn_Yu|HS
zbB$q4l(;7OVc&Z8xI-NupY>(&M9se?_;$9>nPRamTdvMma+29LWpfu-XTa+pOb%vu
z_p@AT{kct`<mHmoqH2k0R#)ZkOy<dNC}r}`$Wbf3n`JE3tP}F>+0pi8zq~6Com_op
zj^NsYeb3Uu%g$W>S<}2Hwez|3kGrL|>(ZZV#q%$(`*7pYoA0XAjk7e?MO0R0)XU9R
zj*~o{@XB~%B;#8x9iBAfqz&^G7*<R@FP5cxXZeZDMOle+*P3znxR$xKc$&@?(m(x4
z@8qMWQTqxWTuZvU-oidk({t}#m#W&;);`6{)#|58Y%)A&8Rd}v-0rjT{Od=5$Uc|(
z@!oglpS-60L;g?xoIkaa<><}p2KAFn1=i`G3OXe8N9?hb^3ORQb9_?GkJdji7M^^M
zrCYMEPIrrqTIuf6SFGEYC&g!YJz?6}r}nlvX!U)oBE1L|Wq<ZvdA}7pDodG5T}vu1
z$QSSPo^1JAn183`<F*^SH6)5Q2=^OyE_Rm{ySBJ{$pc<>c13OeRQ89D%ug*`6Ctws
z_Wmi4Vw)3Y-{5E1|NKM1+;1wc`Y%5+IVK-fxxi9A^Lv1QW4u;ph?M6a!O22=_2>I;
z)_?tx>k@X~NHuxCqR5r4FV?atY}(KMbuD|?<@wtm87DQ)%s7@4c70L9mDw#ULieLe
z<^8YhOju`Im9;-nRaf_Tbo=uB(#nkRyvm88Y%ABSZ+BWz(z<9r=faTZ`kw^utjs-K
z__x0IT$%9kGOgJ$chCD+sq%C$Vrq$e&e+(nu&6}%=OMSi)F(4uNbSnv|DM6u-T5*7
z%&o#Mjk(!hMECor{@{7t#jsf;^SJN_$xn7$_6y%}=PjS!GH08cQ^}g92e$7x?AEot
z6g4%z7B9Q$uI=pU+Fs>b_XVExUOh?n<pYL&+NYNmT4;7(UE?JGn)TT>_wQR;^EDrK
z_Fns}+T&KmpDp?8tq)UGvvi?$!;@L<*6Ti(zuPi3t#HYvhUbMpLSCgR-u20!p|oaG
zyl2#|*XNGrDT#iFw%Q(GuKM8bG%3!7ZS!ZJ{Pb%^qPl$eW`5yCaer$>E3VAEdMaE_
z!=LlSY1#jE^Z)0xR+c<^yG=>Vv3!P@<M(u7mx-5Ni|#qQ{Y!(utw}Z8TSGQ0=PJop
z7-@1;XNwz8{TsTpYU^2pg#ssb@2%-EmFxK+w``ka@@yL~waooXmn?l7uRr}+_1anw
z6;5}3%?XD)-@ja}=c4{c%f4WeVcFDN&r7n)N;oc^Txss6eysE1=9&uG70oglr<P7<
zXgRNJ@MQz<rO>G|f;Q*&PPy?-+iLTs#<koz(og5QXh_bL3tq70-VWX42feKigx$Sn
zAaO0HJ@Kh~{XE`2jq8$?0%uOVGgxAzz-x4IZ_GWlW49td=|_I#ufJDdH;+@?^-)fP
z<nrvvT~8m)%~jJ{$@tVG__RvG8L9O}`#l9&uANcY!*HhG`|N>IhQ+(;&87;ZCr)f}
zGBnWR%J}!`L`V9n-cK`5ai2T&{A%^W*KbaQ%@Mk2u=tmYnXWyjP5k~J&%T!H{}FSX
zWxR^F^P=Dsvn|K(hl+4K<>*bZb)LDcY^Lg|okbOq6BL)eUa+EOeaPcApMt*M*jEyD
zV_w76%k^B3md&5tyEW;_9_N^XMaue-2e&n5y;v!DDT_nK)~LjI(S@~^r%#Fg-mq|;
zgO2T~9-DRH1^4w|v)*2t&3c^8KSbky!4=7qcNu2bS~l-W{3q}?DR#x7yq;9ciEAWg
zFEz3+`@6xk$EWFU$^D9>Y+J(iZ~9{P({R~$&d(2)D>z!qSQ?sVDOlghTPQr`+^M`r
zCL7P?Y%`gtx8{)MtT(!4-@{sWDJ<pUTp{=N>M|)t^LgKWGwN=+ujoB8JKng_dEU$?
zr|LBKU3RGTvfiq;Wi`v<ohvW=d_PHcyIrM^+?HCmWkIXT=DJ+fDc$|*$eMc(9$!(N
z8j-JT+fX*epZW0oB~pw6TO5MD?(%%h3*>W9^nW`?YQp+;Yc_6|^0RaeHqg2w#Jn}@
zL|~KE?YX7_WtLaYFMPh1_rye%|5K6{b@3EFOp?fsxmpzUGEVj3?xzQgmox01nQy(=
z?u>}>m9~k?e>u-)cFs6qpz>&z;)mmF?!7Tf`g+jr@!zQ41<6|qoFm>ZxaOQB&FY?_
zx@wWw{Dlc-t7|LIzh~K0Z2V%ziRCil=WUa|hTCbU{oQ13f18`vE5HA5Y;upA?$nyS
z-S1YVt$H>2pT()7<z<0eC+qln=8Im<S<ho%C9~oE>POd%=EQuOd`Nq}SV8h_t-01q
z1G_(7ob9>W{Hz{x>C#n~Ix@ds*4zEd>aNkbCGyXFdbZ7reYZVtuS*+Cw7z`)-KxCp
zrLUJxc=S(OYw>UGoV_zoy65fXDVe_ZyLfBT^r%PE%3cPpe4@WHLv(##$^EH2%>JEp
zT(o1Yc}&`j%gmlp0-<c;yBJq4KV;DMx53|c$z>snm{ng}-mSTL`*Zj9$bNU<-*@t@
z^~6H2{;}@s4i8qc(G%Q$Z)un9nSb12t&c@Q?1G<|$Inl-4=BnLWh~jc!jSX-#gagI
z*Gzx@m#0@5%Gig^X=wdvd?M~EFV~UHlHw<iL`^Mqo|)bkV2~_n*b|meo;W!sC9HUB
zh{@(jkM8ZrJ;N0Kr}EUocqfKgpA9q=l$eXpOt#bvJJA2#qtu;0uYzx-fx23G;im9E
zp7Oz8S^ruY{o$}_{y)7>K5|l>!G4*IffE1Ul;@Q$D0`E8kahOF^E{e|_}DLKy4;(y
z@4(*LT{G5Xh3W(!+j9KY<5OZhOOsPi?+xE}CpFbOF7l6R%5l}J2Q(J`<&gZ`x6Cr!
z?$)`L<p(^(rsq7pv-_B==**so4Xcl)UAc2k|MkrmwmlQMo!CD6ZoApL*S~HT|Kk6@
z^Z(B<Z1Cw_|2oR(#*BG4r+<9A<w%ZbwqIw1=ER*k8k%<^wzlt&4;Nk#_TzR@=z7hN
z$+OQ0oPL^XRbN!4kkqwp?t49pCDU1o#qZrUHs62X$eS4tulN_-+9av>;~3wv^=oBk
zSlzaqduLIqnZpDZZicGz`>k@F`IkzSZ>R88PLa8HF!s^QzXvxu$%MZ#a**rE<~sIk
zp5e9BT^<hGZ|eSg_1HYlYs!&%?t<P?CvAOfLQk%9Hd>`yz0#_X`G}*Y`MIT@bG;kq
z7ri&AZsXgv<Cfa#3l~LhbTIy5-pl)9y|~EQMt+Udt24T^q6Ai~S)d-*+AX;GkHoW|
z3Lh(W@+`9HUl!pnd5=$X-Zpp3CfSS^@uoL*rUy<wF#DkPr-Bdei6)<|fBd<pCXu?C
zbJfy`@lTRI1ZNuQi%B#1U22%F`Bh=dgksas^)c_P^*ttSKj55On)YxypXV!EO(~zX
zVR!c2dGp8ekNeZi1s592{Wx!k`p<lo{9nW8<mEqllKcY29Cv!PO0}{D<vu2DJHOSs
z)GFrI&W!zUJg0VF5B9ovkJ076U%t?}_W>!lO?Yc%OTKPf(tE$0_u{|u6Q3qa?wD7k
zXj!t%<mh9ra9)>C%OKI4A^XfHKj+-oRdXvRExhmNG#gciwC1`=hc9jZ_WV0%Yxd3K
z4f{VFv?x-1a;{}U*83H@4WcJE{xtsf;nT-Er{9+Bx}#*8$QxUHlzpDg^%$E}35z31
z+3WvJY+9zJc+;jv<hS?9!)eC%CveOVwz{MhVdj=tcA6>8a5s})X|3(~6Ys^9@1&dh
zNC^Kv$91wbanoNPgY4cWx1&-m_QH;tDb=hym8?yV?Y*%xeA&7MGyizTtn5DhKdg@H
zl1223<rQn{{<%zjV*Bc+`McL0lGW$)KR!DoA7=5oRqCUg^!6Q%rs|7t$}K$*nya51
zdLq?5f1QiHnp67kyd4`Qu4L}1nD-<im;2j|&dINfUYaar(yW=Xdn>0bNB=~&TZd9+
zKj6unGso?q!IX)oOVZX}m)yMCXtAAYQc6tdg&ywagI_jS%}wFDa*v1aYwkjO+vnw1
zjUFC;psTm5)a`u9S?SLvrAFI+%hyfWZn8eKXQIfZ<29cok~g?bIU_f9=8ab!QEvl(
zD$O%j%WvIx{ofvYO|{h9jCUUw+$vN%@9_Lv$&<%_dze4GXpq=(q}t>}^uqT^c@uwG
zq=~Lj$>f$W^!=&R&h<R|>)j_6*+0yCn9kh(W8r(sY`wl{+%2PD8fm-F9*&8!{IRC+
z`)c8(mzKEqE#Nz1s%9b;pZ`-#{u3*EZnLaue7(qVR{6;Rk1y5Djc55_yM9H++dYeJ
z<`$PR$Yi`ecO?0Eyr`O&YUbl+=ls2sS^Rgb3YZZ!p*wNMljv;*rR=P)7Kna$dcc20
zo!0TQQziVD%~<lm%jf7C=8iLgy>q|Xe76aG$h52PvqXh_W;-X}+ZVo>oy#^k>|#B4
zj;*+5{`L}qoyQc<EcqlFpD|^j!m~Q=h~SNG$9nF&EsfsGzo%%{EA8r&<+abnZ-&Hw
z?&g!|2{6$Q_HSG=XWx=r<#ylxSe$*kRiWkN#F=HRt=n(RYuaFCxM6y}SkUpR`HQqq
z&i~x)-#Q^~-Fenf-LL60vcCM^UH$(3d4m@>&Y$`-gZag!B~sJXZ~pwT`S2UdNp3-=
zI<v*B7R9;>{yVXJ{tscbbsaBb)N6&cqy;8zD_MX0Irsi@oj~r`D>|OiQ-9uAdP8XX
z_N#N*Tc;hm@-*@NIqPPg?{n0>T%RmnoGU0&xl8`vjvF`E%v&5OHSOgjp{P!E2CLs;
z*|Y8DZxK26wML!2(^<NZCwS$x7}oDn$sC6KyDH91?rsQqy7uoP9?phsKFs%9Pm3<I
zDNhpesE7%fm$LC_OYGaX_m2F~bDkm@{BTO7YueAEM$3%Jn#sQJ)NZ}}vx`NpZ~eTG
z5XSGH&c5VdAIFfKYP$T~a~_ssGerXaJKN5_@p4Aj?a8xjH|ghV?v2>QY~$ndv^~q@
zcDr7(Vvz+?;TQd<O3SNH=9if=ADQuU?YGayA3sFtHa&^p`A{i;=BT`Uwcx@pib2m)
zg8I@`ZcP4nT<P<^ySB2yOjZpIqFa~bsA-=LZ?UP^>3wir!8%R*d2d&}>+&euc*3kZ
zsb^-Ah40$czuH&=uGcnO?iI5A@y=zzniU6pHg2eCjoUNtYzq74V<`_0eZ6C(y}8<)
zPt7gu%9X@5|2VAfu-oK*I`R70GHGLbi3=8zzLx$$%I(K(KS&E(pUD>}t@`=9=xTy(
z_9mC}mIruTXM71=ZufQf+a1qh78n0~>a=n0;v=sUni_vNW%2G(bKbgpx3BWYHBX)L
z!}nW9tdm|_`cf=->RJx_CA$=K?n%nFOGYe7@X26bdno0&MwE{Jmhi-d9@<ZIuX9KC
z=IQ1cv0gd1G5yEqkhx*eQmZm7`VQ{iefZCeM7HjXx)};9G{fJol|207<3xSMRlbj0
zb(gMgxxi~|{59+Z-z39po_1d0%MJuLw<+h#8wG!9JoQAol-n`l_|sJB_l`dI7tC%h
z%loS?qZaD(;Loy{RR@<wUHm!G!1!XC;kWD!FXZhvocpsSj;TC*)#J<?te#$C?587S
zpHHiL7CTpV&yqFXXS|cnpRLW?WtPy+9((Fy*nac1`-SGd7pr}f`0e@YBE~fV`?Qj;
z+BNOa6s-!rHH$^y@=<4p#_vxTX-%E4yewhG^RKfcbk$#MKjFI0@qJBg;{LgFe)Oe3
zOK<0q+Y}YINo7{#^j$Z139h@?ZXkI4R)WZ_FApR?9-iXPt;~EO+9cxe?yXyA1<#8+
z|E5qnq~|Q(BwJgHlXLd7?(*s4=GqyW{aImWSck3DcW&9J<O#YnIBiv%YAtTdr0q(7
z>c^YGE#tFdU;kBmC9_vsl(LG;_Y})8<!lYf-P>)q_srdSA`6n&F5mei&(vtCn!_}%
zC4VnkD*GfKdOPvfyPMW(lb<Enq%zCDX4L#UT{B>}RDAgR#{y15XCG(RWpC<{_1suL
zYtr2JMc4jUPARuP_1o&s<MVRgIh1Z2-dBmqG4^nL=5UMKCEa)NtF~6nxiidnRYdn5
z+kW%+Cf}E4yY3`}sor1uNbKU(fSFUw-cOPFd1k9uPK3e!*_T4w4-~R|d%@z9J^h}}
zD!%x>t-e9?l1h5`*Ex7hW_YNzbH+2X<CDUkt;zoR;Qj^uJ9U!+-mrf^<d^6CHu>J=
z_7{_dHcp*%WL2q2<KJ@i_5E)Tl$A5S+$CE6!Q#VA*E9wDv#-;*k8NFdy{_#?#hcuF
zOuPG!ybI*M#Qnc0=dw;M*Xty{O`jyV7KiO?UY@L%zJKB@F1w8q37u-r4L;jalMmef
zoG@$J!>_x9Z@Y9(+P&;kt%;ptyB)XF(vu#kIa{`T3T5ES4@&f7yE)(gen9M5q4$ob
zrk>1hJL+tH;<J9!`t{derxySD@KE&5#@XIF=RQtIdimnn(|Gws%9jt<SAY5ufB1oc
z4ttyQWZTp8>T11y6|PimT)ZlLdr;)`(wP;GGk=LpUy~T`n!0<!!$Uzi3g*Q=@mEcx
zgN4rL==&}ICD0c7#!Ry9`-hK<@7q*<%AEiI(`CE=;_r)l3X4PiM541c9$K^Y>5SSm
zog^!!GM$BYmK<SNa%#biV_AkP?}bn1)!F;v%uTucul(%GmOOA=qI*zz&zjlGyf(bO
zdL^)FhPq3ifSTUSrghw9bA>x+3Y%nayqOhS)1Gram2YBp;A>T>Ei20wChHyBl)2(Z
z%$YqOZicKr`(t}%kdT+O^{uCe-&IOUNSXMgYQNXsbm!RVs9iFb9<$s`HRRepUE}JC
z9Y<o4-k!8~U7F-6UAN!|b1ZkvMEhS_7q9lM`*DA>io*<tAN^C*6eoHp>4?PcNnUhO
zMbKkelX&lit>5Gxy{LZX)3(}miCu~IpG)Q1JTLZlM4yXk747Ak)A{P_y>lDN6^i%R
zznE?5=KA>E*&O~Ux!)A{{S!s{7;Tt;-8WTM3ar-n=rQSZQFiswuZG9xf36pdnRdU-
z_(|16Q@NUzCeeXK+Zfi_@~b_LKXkU|(zEK&xC=LR&bD1}S+cc%{*i;f<}iv~m~^bR
zM6LGDqJPu3)GgBuQ@ro2_~F@2d6}7eiw&ksYIs<!*%I`)dQt%ATN5*L;cuxM*2*uB
zDnHYv<{alBqIGUn<&{LSt4&JMs-{Y<ifcAk-YqzwTz-4eUk>)IsaywJ{%;FDATP<u
zwqloK<dW8xF>eZL?D%S5t<?2sTB5xv;n1p?Zwx1Axi-3IO`UjY>s~*-?CX<^)<67Y
zd`&z2@`i&KmTFq+xj0WTGC6-*wZkCfNObsO#}m6&WQC{Bx0PA>>G}#A9iw-rax9Mq
zTblE4=_{Ro@_ws(QTQBfo^;;*bt|6DwtV+QcwW+s%adw!CY$Jn#rW<1EW>K%!oS_B
zID6H-rW}{MKl`Fy&-D#{^>SL2dC0q$c~$Q(Jr8DDtkENO?M2LWmuaS--_JO4bp}(i
zXLEg9<cma6=Kf?EOOJaF%QOV<6iRGlx1D%My-?nFPU?Yn$?0#jUfjB?*qdc|LS%(4
z-^-P!CwsozvVGYsL-nImc4sX7oawcDOSsq5t}~*H@yn)Z$C_Wsclsk1J@IpyL;S0>
zgIbyaj2S;XE-|(>AGZzAzWMtA-_qGrQ=a`w_|s##@auuEN%uC!8>@RxUUPlRbomqI
z8JA*y{8$;tzf>*b;p$5Xhc{etQ%XB{zTs@<hGhQk&)o{lcGoVtSXoKN-dncUyk`4f
zoAT8qVduSd)?VJBV%yfMp854=GyAlYst@N))-Ye;T~RFci}%dwq=%;pnbywTytU@z
zxjTX!>m&U=B(;B)WgX^=`f%;gCohfFJ3M!$Yh2-0R+v7cx_Qom4T=gMe<=QYez4gw
zY~As9+cwN=oH8ly5BD*ZX@#62!I~92R~e`Y@v*!z2(9ehEM#%D_6qy{e^>P<cl-UV
z%+U+xy6wRFJh><Dtl*x;V)j+{@>fKi<`Q<(i8&Ouuutyk#f3bweA^x^&g;Iu{Tg$g
zab|UVci6P&(v1s_pUS^pcm4h*fora3bXk03j%W)pY8HfMuj4C^R$p5E@6N`BU3;`S
z<kKJf>g`|o^R)H$3&k(Bp6Hd{FTb%d<NBSx){w4QtRG!p1a_w=20p!^yGWF4@4dnw
zFS*WroNlMA_xK?HpI$Y~t8@Qn?2eiCv2UyQwfV>7t#5u=kuH8QJo>fY<(!~1!P@RN
zXXoGa$?Le#DmCqovFXX9lUL1Hmy&<^k9ERQtuHfmn6h#=ynK*XR-bU?MC;d*y!M&m
z$I8zzdG0#-Y2K}q7EioCPs<a%5Swl4-a9dxQ)ZL>Ynu<fDJFvcY<iEk9%6}7-gjyb
z_jLWj7n8(UCI?zt-7n()zjKS^#}}6zotAT_r{{|<+NT;`V9o!ZZJK81Y2%~{#fH@C
zz}hUMx>L(KU)JrLxpwu^Q;ZM28q)m@9UEl@q>m)Ji$7v{zLYE7nuGOy^AV|@GdI=t
zsm5y`>9QBy>=e|c9N#$e)rJS=_S=(Pr$28i4r7_^=kUSSP^v8GyvjC)zp7mufBep5
zwyiYho>Z}<(P~)>hg+}i&(rNE?<(K6)-&7^6UgfvJ>ib4^Q8L=9<1emwchnF+n4z2
zlU(omE*xyzdU=Yk`lNTiX6afkzS1zyUG4Uy75f-oKA5}Y9?y-JMLB1axh5S}lb)#G
z`Cj<4OxiKYR%QVoPh-~pVi~XMTQ=Jd$*nopVt(*Y)laU_bp5vvPHzA9$!x9z!`;m@
zx7!q^{bbqwPWR(%t{<|l0UMo8A7K%UIF&Wyit-}y`869;pIKW!v0Z0Xeg1E4Org^<
z`_HV)7yNy5efAum#TzdKHMuG~DO}y4{>Aj!!n5ZS+r-pVQr~xrUax6<&B>noZdFLY
z73l>EucP&3HXT!Ol;7gM)oaO?hhG-G+1tDA;qBQcihOQoYwb$>&TJcA%eC(*OVtbQ
zrG2JCKRwT$uzjHYe3nIE@V;FRi+82i1YJmZesa2i{(<G`>(3lDdcxdZJhSOYpZLj1
zOHLMU(YVbY{;6Y&@cSd2KV`l|9ll-lsNk^3XTS9Knp5Q(lHKorvHRH3dM2c0XA;k+
zb^G5PVV>W<AUmVa$9s|6@5K5Yj^}5_sWV=0)rvl!w}5-j86T<LCNtZ<$Itt5`cT@r
zlR6P=_letCSAG5R#@=0je%<fio0qUJ`5dHDcPiTJ>=%`NzW(ug6^?fgU3C98-Sa@9
zjg$CW<3PWE3um6u`(`gZu|L|SOu%}s<sNIR&Pln?KI+bDa5?r}_EKfbw2CT;S!)&^
z-d$6~&Fs#6((7NS+ne7BEDdQ9)kU{UmP9`9`SB#Id-cUVmG*hfD{dyO-nnpr#QY?N
zhjpdjmZu-NF8Ke+C0X{kJ${Ytryu?F>5j{e39Nf1{pF4561N-cc8EyUY^WA>_xW0D
zI6XG4=%%UH<@V4C54!ZYckoL+$?^S`!&k0U$oX4fy~rM`k_(|vBOGFnNbHx8P*sUa
zFc6v`!Tzeb-Ff8?m5cLRlZ=l|@Nm8^Q8{hNv}=>2Pw0qW^E0z%aL;HJ+;lD4`%3nb
zcva`cQGy{mr^fg<X}RvUtv?eLDKtyx`m63@ru$uK8y?OG;oHgL%P?=}`<t$_1^QAP
zQ{MNk=3mRlqdJu*uz9g;*ZPm@&dTdg=BlPWY!km`wSQ&|W1m%A?t^^2@U_1qnV2tT
z@E!7L`d$`yF3oq_s&(t4pSnLc>zv)j&hxC?+BmCZy`1}Y?qzSSPZk(FEV>?$v&1Zy
z{ia9p>}XMisMO!9el=tmsR!Qeto(L?WA>e#X&GJ(Yj^8@<nWkOt$6mVfl6>$R>g}q
z+h)1Q8OZshoih=VSIC@mR?Yp{cmAnA*T$`TdHweV|8DOY{YP#HWNF&A`Z6-F$|<w>
zw?T2gN9`lYgMFLl_4>X}Z}<QA_4<A<Cf^nFx9@h|t~qsP(7r{DJ0A$G6>NKFP#@lV
zM1Q47-;P!9T0W_j|9?L5)gv9TMc4J$eOR;Z@6z+{zMQdm+4}xlif~VGW2?MSkhtW(
z?{hZ$E|PD1^-@6oX3Mq~fl24&FT}K*WmwtK6|jxvl(gQuKA|Z>CTpXA?buRL8R_?W
zs>|V1wk9*LDmZ=pb#8Jq*YAaojUx{Pgt8}z&wIISE%Od-b>7)L&qdQiru}&ll53P{
zKKW?%jv0H5)i$g5%WYpJ5mYgIRltGjnV<F@lrKt{-674D-EJ>=HAHo9mSVQ~9YbHo
ze~%CSuik!s+0J$EJXiSyU!5$wX+Dqq#iKi)ELzfHZ^Aoub)(4ri#aiA)8|*REpMyi
zde|y>v*7Erg_8T0CAofEwIoO-+3D|@v~@=6ORvuV@%fB`zn+%hzwOJ8yy$rR%t6fN
zzu|tFvl%_=!95#(81ApQJ<av_pPa+h)s2#APivF&3@f@q=WSos<6j+7CE8{?Bj&HB
z8CUn~rM1UYzwUAAdGYA+ZFAvk=eR@7wO-uxmRaAC8~xPksd&3+nN-$|u=hvab01Df
z*y6lotHNQ^uQ|*?5<i^;1>#R$iW6SSysE-i@XX!VRe$asz91gQxk^aVEjHlE;*(|Z
z789FT7P!3dH7QzeQ@HDKt?tc(E0(O$QEi`eAo*WK`^BB5s*-1Or-nbCcfDWkrp(*F
zdfWetnXk^+%p6i$dQ@d%-;Ue7LR(a)TTRoc;5oE2n6vFcq}yuA%418jjEwh1SS2!v
zwanczRbuxFmiY++yEL5=7u3EubGW;^o6&9dhEv(SjgHTErdAaPC(V&j`NX~U#%6&#
zyW-EOe0=|JDrd|~)?k;k63#i3x)+@OtF(LDYT+AgXRXfY{V_B=miNWd`(CAk_O|0q
z<;+W$?TmjWtN!9kZ<+5|p)Ag(71jpz7OC5vTYlxP(^;o~Wu~NlM*M8egS$JUj$e?x
z{(oAPg3UEQ%V$BV4}MC0d%x6o)yxQKW3|_lgJOgBZ%X?cn^DT-w#3LJ*JkdF(75=Z
zbh&@0zwy7BXZUFL-NMBd78XCGW^UP7khSE@hi7+#`W|-cA2aUZbbeI6>w#$X=2iEY
zW9#EOH_6-mU8mCT_2r*vRC4pt6;;{)1pZg<SSP<pTsr@E#>ojEgsMDD>x!#=kLXU&
z?BH=Sea$PpR`)QEdIbl!%a=$iIlZOIbGF95xybQ%mAi6eq11)Kf|r|n)OapkSs!31
z<rw|5#yge&-v!;bs~>&alwI5Dz_c~~{*;2*g}X9^I6i+l_9Rw#wOE0n^|8*%WhQgF
z3toNEO|6NaQKS%ma4o~3_rI=vGrzm>04Jj)+v*)!4@0iL;m!V3$M5s@W7U;4$Ar!Z
zzu&p}Wku|<CljjkW|u_Bw7I{rTyeaXf05=<F~;i(bC%4T$CqZ5qxelnn^E^nNNQx=
zzL~<=pYEnL{@b0i^7Q{55s8*Qh6#SBc0B2wm1a;UwNtv}|K$F@6zBHBL^E$0;pf|?
zRH_v0{}W(!=KNe=1@+uFS69v0os*US!%=JFI^MDmIt86=XA1JNOJ~GhH}{|Lc0uJ)
z-nxlDIDY6a*^*nx(y4#!sE~8YAA>(8DNo+moN&BVEy~BWy+7^n=Lh*|Dvh<-^3zqf
zoT$BFd)E0DbG5tZKJWh<*Dx;+{o=*5acQSI@A{|PUt}9!_n))Cx7K%`-t)%Gb|#|R
zjy>wTf8d6(A4~e5?M07U#LscPyW5w{tX~<*UswJ81!zZg&HvpmW|^Peqt&!nF!51F
zif}F88#R|q*}YmJ)v{~1J?V42tNtb6&?Em8*W&Fn_Rfz!`{Q)v!M7o<r7UjZBKr%!
zoZb_VJNxOHLp+_f+$-w;y*Tu{>5;u1gKN8*L(1p%`|7H`J-WSoeOwKzu(`tTSAS<u
z_xIm#$}1Bi{&C^Ohe|ODuZ&hrPZmp`ztwP8MseLGtLeF(Wr1N!zTA?Twf$6>bg<8v
zw#bRM=X!1Py4$Jd`+8~Jv%8;G_gq|JUwgahgtXn$dUuU1rz$)9wo@_sNur9a@=|(I
z_3p2#x{SCdG=FY6l*j(d>O{<2;TTti9l3?GG(=xU|GSd<-pwFK$5C<jndrnB42F+l
z3<OKF_ryuFge&Nk_D@><&5Wb_`@QA*b7npApY&(v$3<+-qD2;JS?edC$$s#9M#k<x
z>N{NAbYJZ43_o7~{#o6lI@hMf|BF&JBTWUu3>sd}Kk)yh@gMb^`B8oI^fJBqsyo*8
zG|T>K`1IH*r6Q7-+i~Z7p}2`lY;63q_)j~OTD;xu5nGq8CHL*{jrSQ$_pU8tzAx-C
z*JZERqWXf=2;;>ZHf0m1@GbLw6m@39y;m($p3DeMcJ%xg=saP!m%E44Cxf%EkL%>=
zoc&^#YI*tL`G;{;Qe{?pYqiR1XKXT(a_~w&vN!X1K~>f=6JPhJx4TX&%;{aW;wZ<_
zEwaxR-oLfu>Xycnsxc8_+8O8Ps%UWVuTcITC#^rp!8_<zF+<uWb)6RX7cbJK7xbv^
zaaT*3`L|--s_zT}a?8(T1RL^g(I{l#y*)vi`6OrgvP~N%8t861ARb?ny7X||&-?0g
z9L`Q}YF*(zX~RXuh1^p&*SmC^ZP8Nx{ptqijW12%Z9gP`RkwRjy7e=B;okp0?&?jS
zBUU-Bbn`W%+C#fmsHznj7)|!|?05TjIHakrb}RSC>%3<at}>aQJ*{$i<NwCwbr0Vu
z3vA?HpJ}B(?OM{MixcJ9*%rKe=gcVe{UFE68=|Y^>V7<IfBeSs!z&5J%Tu1-N!zBS
z{$G1*g!1XjJG-hJD>i;D{`l^9$e(@JS7;|i?mSm=(5b}hp@4(8F;5)-!fj`q=agBR
zZR5Jl5+T>3sCxgl^8QKjXIL8K3V+#2uh3OK^yf#oU*RL;>=h0EvMjp<JEhz?t;&qD
z<kQS*jaYYAhBk@CW%3*Qgq^y-#Ag3WDgLJhQ*L*#uXEZE6?pMRh}GMdiG3Quc@3T6
z!Eq0}q7U|(X3uT+Jy)=R>5liW7g{wZBK@K>owpwFoTN67<>vXic5#tKf(cC#jn13a
zuU|WJlJ7%(DL($P3Auk`-n)vai!xQz`OTgsp}1SP@!mY+O-6YYud46z<~%8>j!mi#
zHg3{6HCxsoB|pR?Ci&euL*t42?oK%S<*~Ee>vK;YUvNt7cx`si@Xe~nDxUuD=D6ti
zRR|~P317A-WuM1=qT6Td=PUY0E-%gAw=MQu?leu~73TvQ_6dtviduwnYWG;N?I~Wr
zBY`bx!ug|09kbhmb}v`FmA`0~T~Yb_jcV@}FGyRz>dWm+79-aBR>rbj&*EaZ`!~(%
zy%EhIyZ?p%j=xU?`x$g!A2N8h^m2^4&x+_0wXlccD}rR6%j}(CvGnnqoZ_EqQyYDD
zvdE{e|1mxNdZ{U&iMvq#iy+sz7n`s5WGr0A-L^?`vF(vC>2E(i82_HN(B$BAHP$sR
zdyev+{2}wI@QiKon*S17b!Yw`N<IAHPfN_P<^}BcJdZA%@ZED+OsSsx=~Z7g*FF1j
zq-85-)dE-9{jRl+)BP_LF8W=})UhQ~zFg^rui%lhn_|9h*fvW+I_a{4u^02yg?^8Z
z9LV{juyHxFbnYdsu-6~??%a}&U)vCO|3EAs^Ty0gTcnqN@9X~k^l{b21>RvN!e6{U
z;yc?<b)L&}hAxF|TaOg*oV?ibyVrcR)geC?qnULUebZmBDBR(xq587?pvd3p7p8kW
z;@a3`lg&AU+30{;@7s+m1rO?Hd+f~FBF@^V+wJ;dTYKk$)u$8G{utc1D#<fHQN<B+
zsVz{_A;`Kt>*9F}?mN}rGDDhe&cw|w(tVNWlE-m1B*Zp$x7O6GH}2{y&xYNt2|suG
z=Tgp%iyR8J*x#Svze8K}$Fwftu8PaA_qR^dUh}l`Qvb&be0%|op5G*yj&09kIHvY~
z_dV8iE97RH9Wu{r`yaS_|2E6(=kk(6wAONoD*CKjcw2C?yyZjhn{qc7iT&#DmQ-t<
zew69u#5pEUewgK0$6PUJ(M)4wn8Q#fTzB|XzDUJ7qt!BL^=(Jj<j<Henf=!0!|m%|
zxxQ^&vW79paB{<;drBuy9A2EDHQA_oTJiBjx%9*4$_fwUwlO}`b5>~YYFA`RRb$$J
zO2kPpcAAjj?>6b;T%WHsHPx;kgM2z>yL`#*_TRbYwC4t$AI__aF0%*!Qk>9zb=SeK
zZPp7iTE6`5Jt4hij``!ztufQPYqHPVn|Ah9|FkgV7C*m+N$~hjR`s|!43Az3imm=B
z(ae@Pr8C-4UVplEIg{`9vdd!p51vKU%=qUsS++l1zV2CPk+`+br%%ssUF3g!eE+>v
zmJipTOEVhFz2^Ga`*E^+zuZOr{m0_p*?+Gp|GKsImI6=RyUg?X$C4ciWZ3>i=}mt;
zKl|Frb=&-_0_)E0b$hf`Z&vw{o*JHcTif2>SkJRlWcn(>{T#mhZi~#X>sq$V6!Yq4
zp0BoU<%jH@+vI-aD_7V|(W~H3xOVss!=rB#x!9Lp`0Q?$a-eMayZkMIo`I#)g|9um
zyClIS*}AVHCgsT$9@}Xhj=@YV+9{%joJ>`_7e<@zRDOGd*Ri82@a~*tGXuT;omuJn
z_ob@%o&RPAdII)#LGv8W-TBH;rnqZku-}10mzVe6(Y5{X*gwJfmh*w;EAqN#52n@5
zdscq1<9)lvO&5b(&SlYx%yT3v7CI$cm>)T@kagPokH0*0CtPnZdbi}Ju~6fOPQQCe
z^IE%~IoqCTJAE=W&E~fcANQtf0ZPJtY)MM{4A(RG@ZUJ^X|khZ{e4@vR}EE`0m+}A
zoXz;^wC;xg;=saOxm5*QW+d!05IL#Q&L8G+zUt}*nWRlKXZbnS3phjvGl}<jHcnk=
zn^#brZ}?*SF`lbmH20jzW#VVwlf{%VBZzeco9x%BUiUc<W^Z{uXMOMQ&F3c0c5N-p
zO%-NpZq0b*I{B+b6zj1@Pty#YTKkesQ-7VFb;wEe32#`}laN)7b=~|;s!tZ1IrZ6R
zYGthC=d&o|Na?)H&G<%riTD1k>dS7eJKW>CFG#sU+iJz>tcmU>W}$1@rQa<(KS4c`
z;pvT4hI|ay8ehy>^FnfIt*K&5(B`ZsEBE)_)$qApXSl&L;biTEcMDvkzQ4FL$&zDr
z^~BAQb;tMLU(Gvviq3+WB`I}9lk9VzvBpeay(-2hZTqf`-U@l5`CdZT9)GmGQFxYT
zx$qZtdD$9P1AZpse*cwUyDHDA$Nic8_iuHvg73Qb6YgtVGkeWgtgH94KeXR!&7Zzw
zny<Xhxo({#6r`AOa=+n3mk%?}6ojprDCo&|#n|I#FyBTG`Q!c(d`vDs7q+Mec|S~d
zyp^lyb2rXw-zf%-z3c9uzjpHX=i*}jkokVffnLlKPvX}-Z@4X-DqubLyyWDIdp@Rx
zu76#4_VtWvZqD`h!i7(k^6)%OH9dUg-;!FcJ1!;5>b;7)MFo#}1xwUTkleP`@Pmxz
z&0SfC3fUzu`6@)_B-}36>&$yBrFX4lp=6ya^G*3<eaHR3etXIMh(|0*^~<4E<)$KL
z*-!r7@@cJGdbEBP_kYK;t!`q=-rQ4XNQq%sK3Cc78FT;s32xWkeJ;=6{oBT>&Sd(#
z1@?K#)6N~Lx>r}UO;dAcd*`Aa*`vkhPZ>@9$SEzq@YdA2&80zd_P?gb+jChyHL<T$
zs?^_EaQo3V^KF;6<=EI-o$sHp_S^^i!!_%J>Oy8rvie%&bdlj*(BUA{)hAZlWlv*G
zJki(L(ooxccWqXm?;Me{rs;p5n|$&Up6F|)`uxVM(9d36?99mxhb7BXH}O^f?rZMc
z&}=z5`;7ONtbmdnHmm7HF|un)<7eD?^lZr-LC8@8$q{+a{JH#A?O)M9%QTd6Qd7>B
zw#l7WL<>?E3kw*&HLJ<+2{31!x=YFZ=*P6yb8j|BmoDGUe{reVM+;jsuNx;T|K6Lr
zIl9bg{}FbDcroLwxlC!VuJZMCCA!F5wca6edZw1Wd)IQS)8YkpK8G;n$%%zpWHc!0
zCQQ8l+UkB#DWmR!&rg4uu{qvIOu6(eX2P@dB;{1g*?&KTta@v+{omrfcb45cWw`aY
zLKokyukD8B^DZBEoIJ7O|Nh<I|NYb0VY&QMZ~M$sclGo_)*YC%wqVKIC-KU&eJ`cP
z2uUp!ws;%S_gyGdj&)hEdw5)SIghc4d{L6G{Sx8L8}+0P@NT((cs)b2=&G+>o7TH+
zy(wyO<h|k4%x6#5vHZJPem^)W(OB<GR7Rfo>qpHipPu<OO)}l^;)hkHvK{yBtB+Z&
zi;Ug>c+T603QKOEDOpgwR_>OlWLo`-e1qCGCzp3`c2m#!Jkz@&dd=r!OSkHNS&{Tp
zNLc8x%$rlmU(c3{-P*LqaKFv!35C92CY^0yDrBnZFNn51bGB4fGFFrM`XjMhyDwL*
zaCrE(v-AD_%3uF4OPw`Le#~;hw^e(y){ND`cN$k`y~~<-v6Wk(?fUDVZ$3Qx^^N1=
z<Bod=8Ty`WcR%!5<{@uEOV%mnX<mI5!F_L*$$VTU^Kp~NEa4v!-g}la-#ad`f9mfG
zy-`2gx24Q^79hkgFz0m3zO%FE7#psQGPxsPU8}ZBqikcMVET`fYFp<XGuAKK{c6(Z
z3oqwhJet34UGemeYss%VlUj_k=7)aIdXwO_`PT*iO`SJ?bx+D$%eXOdr%7is`y<Z9
zk59*ctX{6w6QWrDy*`_F$?m&uVZxmC2i|}3(pD)C6gU*lZa@9p&9Dmp7c(DjJXg1Q
zeo|EMvVcyRAmz)q-z7Si-KdZ{G*K{n=ftAWr|lnk@@9VzoH?T+X3_;+SG%Z?&zwfC
zDq4|c2STI^QeM?P?`u-G7FZW{^NnO@s!kVc!v2`VS5aYqmRoe!m*1+NbB6I$6nmK!
zdmQJB0-s#%7h%rHOu0uRie8=6dcR)mtMHyf>C4_comRv*Z4cMQ0)q`1ddn9X-(0ol
z$=2hJQirC^5T6_%Sp4nE>D!9`mOpoXwS51D`Bta@xTju{K9J*h>hR)+>ONVX8;=V*
zJDvFY((La?*)tb{Cwe{O+Yl_^yxv{&%>*HaKPo-yH!UyTp7*le;rCg^k1wyh54<KI
z%&N*2vbWq?J7B%F=!!YtZ-p<AyERMJ-@pDrP)l-1-~E{BF=89ogxG}MS5KC{`N`kF
z_<(O(W%sMYD^|KMOPz7<$9$<<^%lIj&1phgj&5I?^l|q2YrD<ZABw5?JlM1D+Vz{0
z8%1tvq^nvk3vc|IsFHAT6{C~>R2%Wq36)RzTTYA3C{MJS(XiR;ysDSmoPxYx>|bUV
z?M?XVx=}~(e(b?beyg=T+vOD+%XtH0)n1$COaF^s*Zn{G<*|#dNoTGu{I^o}|LV-+
z_RV@ntaE;^aH>(XSmr(5m3h$|%WI3j3hi9-=iS7TTK@eT&&&Kdl<@BJ1OtzmiQGq@
zrTjSaXg%kO^6&k3ShalHN*+uNK6)tC*R|_rg^CTEXt%BN+ihN+JV%!1xs_zB>3O@y
z<jb-vNplV`NgMIh8!wBx|3H1l_xw+1rC!K9xTvvW<C4^x|C3!S7aw|S={7IT%;3T~
z`B)FHl>gp|w&tff=N!8y>+?ur;oa|xO-*xubZb1iXYzaYYV|j)!mHI^Ont8}nw+nY
zow>b5?9iK#RexR|ewt=h{X@UMUis_u0NvHy$7`Mcob+9pRZ^U5urv1hQyJOrQ)`}U
zPW@2v?Wp%hH~Ew@pJ{g-#Jc_$#((YCX?)9^%b99<uqk9ootnA)CHwPQUi~j$MV%6U
zI{oBNhXBQg2L<Gq7BXCaUi@>#!Q-iwk-BE`R~GEkll~;)*p_l2E~1jTx#4~Eopqbz
zx|qA%!aZ+p>kaWVQ=8NlQ<1fCuB5+S^h{|MQKM9mtcBBA?`EY5By}9n=lk<f_CV<7
zBx6SH&r7?y{o0+x*yI1bw5|WSY5q4JFV_{8Z<ke1E6U*8v07mHng>#`Y<+uvX6wYW
z+C134et&&okLz8tDTZvve_v?%E6J{TJUdy@_Rh4@n-S_w?dRoe0vP7Y3eA4xdj9Q;
zQxl@}>QAa|j{KmtQEzu#Yp(YDsq>mRd5vZ~RIuK?a@m38BuAI8)0C2V%Z%Px&f)%W
zKcwlhs5bxR{0#ye*BnzUXK!WV=gl&IXts#y&9;x*KPG3*iQNC=aqRUfb>XuMGjz7x
z46d<zxn$8_UIq92Ti@Cqw)rZ)>C>A|hCB&2&kGfkf6PC`*Er$T&Egl&h2}n*ytCc8
zUV2$=n0mdu;5PU2KfGnHE|<Oh-z95x#ORJf>B5VDPOPwa<g{(iOikHe+j51a%fFx7
zs+0QqndO4RJ3f4_d#<yA-R<(h1mRt&y^lJRR(dF_oYVAN^yEuO=I5i|F3LWXO<b_$
zzJzRIt9&JYEzeiK_VQAJ_qiF&48a-2Grl@FSy?qbclYhAx~n|z5@$_9*Wr#m0x1VJ
zpJ3BHyzxzcMpKH|s%cyQ3Y@XXEbMugIpyo`3J2*MT|55wE5+@S$ze|ow5XKc>++A&
z_GR3B-kQv;oJlfXqUlxE`gKfknjzoc?U1~7`bE1U?~}=4pOVW@^F6xU{=w4h^0l3R
zJMQMZD$w>ldb`sz`_#E(jh2_*#8=#|y>;jC(SIv6XRwyI^?c*aVVHQX{eP+5pZntC
zk@-L3Rle~2H#d~nDj^khhvWM!m48{sg&*FqtLRt$=fhm|W54vJ`smfM@;ex7uQ3bU
zXVQI{rJMIbUyxz?f@Q1?M;A<~4}7tBN&4c|dn>X|9I2i1!rV++b)WZlM>W+FN6oyO
zy<dc~XH8^Zw6ZbSM@{b%Pq+WVP29RZKOQ<<@32d`w5N!xG<k3In(*!aib{4wul$+c
z>FF1}c~O$gzIQyk|Lk0xTzcuDzuIoW?rFPT)-Ww)N@pt07I0R6``JP2W9RX67v6{~
z?&*-bIj88F>BZjIkD0nD-s_u$7}#2-?VI3m^>U!*jD|1ICl!bmU!D3!`ESYQb=OU~
zT2hWITI{&)?@{a4^PB<Qyie7I&)qDk%e=cU+5T@v=iktTH*cRFzO!24@LtaJkiB+~
zFYaxR?<n?=KE5(=cIcfx)eSw%&27ylvTF!9WIDHO*vuho<MYyq{mjRW8PlHbm=)H+
zbUN$Lx#NvrE*-!8_NOd=Q{#%qwKM*%%nC59+IG)pRaDMn_m(zM%fr7mZYkRPW(qT3
z{lAwlet7ovaW*cxdwHTX{~E)&Yj%A7!Ex@!s(-(~SMjVdJoS3wvSNc1d=*J=7+x;>
zRwy^&*y9CP{{~*WcW?E7AHfgjMHs8zC6)CEg|v%z-_d(%YVmbl<Wb3sheCRVa^-mC
z?W;^`Og4yJa7yR-*P6#E-mvtm#U>7qSDV*tkGxU%XSdnY7K1m}(~p_ApYuvGsG0hn
z<wxKG!waibjP34iIx;i-6vL6y?E%-WS=~Kz!;~%EM@YB-;-$HYHEiowtz=3$vu}pM
zmHn5hxpjYh)m)YB<k3DY-MHYmF{{uFi!_D(olj<Y`o+umS+m9;40`F%`}KTUksjOB
zQ17cuXA2A-SF*YoZ+^qHj_>B?NcN=;l6#hKaqV0E_mfNEQuC$Oajy(}y^mLBzIk)x
zg!7tBE{Urhxfgfq9;^5|tNGHlP3mj@dK5nGbdR4`qGxv2?e-Ge!Yg4GTRxn4c-vDz
zPUp4<ch$D$EjiuxuOFRS<|Djbw4y~x;h9oYq3Kf_xoxYHFLm$c3(83N`g(Pp{oY*u
zzs<W+tsiw;Sbp5Hr{`t0tY=Sw=fyQ*ho0Q}5OMpY&-YD!r@k*WGH&6%^=STs+(!zA
z9}DI-AI@1nbMB!j>q=)_a%amlF>5%*5^*C#i*v(;NWX8~8$KxfJ<JwSVE;dXQLKQq
zZJ*5?`*kOurEZK^Jt?L}(=W|5!OZPdTyfv0*3#z|E$bHU^zvuVw)&D}vE!4^dH!QB
zc^)x*EQ}Ul_nwh!DDz~_?7mwH`&ynG>mN6mx+*cxoa<r0$&3Fb4}a_zJKQ)g{MoWn
zQ}ZCnl(>b$D$C1{yOjK#>1MF<nn#ZK%7i@Izv7O(MJHEi|NC72CSv7^*Z#fE9Y?<N
z*%UHzSzrIGkgHO--$QSW)MVCKtf|a~CqG4cJig>F65!jjN`79Uhf9|f*G}hUtbWJ!
z<kk!Ie8~U*Dc_$-+O0SBbV`UI>yO#HIHae}`Y7~lf317svR(0qdp}<)__^1ZOS-C4
zhFk2ljxS$a|B{n${TiA!cox58pKfb?WV*Kgy-RoZ*Sx;<<JPyX<i#94H<s^7|7Y%W
z(Ld$DL2tgvwi6TC_1`KQTsLkG&^I~AE>^dcyMCFMi|^<ARorztvh(jeyl!i{?BC!0
zr#tqRe_2xhfA=5Z9n$>2n`%FmeLl2!!tM`7tN5nvUtrBPd)52DcR#(Z-8uQ_6jh$n
z9QWMZ^S*m-Uv$^~%t6UTw;A5;T=6RHM^*7tz4pv|7f&CIJ$?E&bJ>jb9r@M|4$7x+
zi)+>isCKSZyZhtbu6VPXZ3~^xTbzD+owcjxl6$mk_}5vNO*EJC<!|U>aI<p=^*OKq
zqxh^x;>85(wJ+C1tUuj4y-fJss-G>dKP2@%Da^E1TGZQ|wf=zBi7Od19zIn5v3UFW
zgFGS+&Yj$$+OEhn_fSnl!T;|M^h5hM9jfs$YVUt_EWG<>fE9~mlun4-_rmOrMaBxs
zZ2iJ=yX+KXQle{{Lylf8d=vgjaPPZ_u<&JlJU4diouv1#Cd)K7;tR9m*=83uy_GAh
z^RyReGv8g=q4%%moYO9z{O?J-eq7$QH=65JTfv)a$x?-Jvc(6sKXN#4E%_^9i&)vm
zq7$`YEm!W&cM_Kua{jSQX9DB@ZF?ja<y#vxHH7T7`8DOdp?>q)vbH&g7C&6SvCsPe
z>sE^_)#p|zcGaid45VcRVzzHS(YpESisR90p%#rxW!VGUH2Lf6A5JhR3tV*Vqf7Os
z>0dAXnRmDMX4K0*{kZK(d(SA_&Xb+KSK;crkGh>}Kii!Du)aq+aK*$dkE&N0_kV8s
zE$3S?{atj4nrWBJ0%z}Y`91D+#`Et7z2rS*m5|&W*y}uDS`3reWT&{~B}T^-_q)rx
zC&Z{edbjpg&(`wmU+&N1V2R-PSf*loX+~Qv%eI9x_4w@)d(Jw`U0C?EqcnY)%O=hp
zwR@R3m(Q6q_4Vf$U2-$BIL$u$B!@Px@$PmJIa4Pt_IGMX$2_LZm)Q2NGjw?~C0nLw
z&sy8sBUj32Np)=&@wPCOaxq_CQupcYW$XPvv|r`$^YQ(7AkwSw_vu=F-t7`4!R(u+
z?~>iOY|hfIjc?_TOL-mp6jJvtBGSWtjUi9Z<Ib|RS}vc%Ht+8g`@Q<%3-^xbNs)fq
zy&bH)6O$)+UQM5JdRB=0kIUzZCeN7=Bes0^o%9;PZk@$7jb9fXH#l{DuBFAFlUw?%
zEt5X-Ze3G-y6(Ty$DS(@%6{iMrzDEW^j`DV%kMq%Y@t+L_ND_%zU_-py1#KNzviCZ
zTVpjCwf0-@F5h9eK0H07=j)>6oR}N46}K^cUZUhLU3ZaHdch>~Ja41<UmkvnT5bGQ
zeSvL=+rr16GdpK(*Iljdbv*WVZ%0(cYa#Ehwtqrvy3e^9COrRoBwlir0zZHGkFwa9
zrR`62i?3^}DQGBi+${UM`{V9OE2qCz`aetl*<6W)*JlN6T~Gb1p04@e-Mq+IhYU=e
zR6nz599=Azc7K1}zgefY9+X{rN=Uig)LlL1{4V1^hhJ}gZ|oPaB{EP^kU5jT)L!40
zY18_>`Q{8Kp79D@QQvTfOIK{ItN%Y9Daqs2J<2<Bu3eQXpRD95eSe1<@5#3}pYD;E
znIpif@T1~x_c7lh*6%itW}Q>^oR+voyh-G5#kuF=e=kVLPVko~`@-Qe`A4KgZ~7<k
zstc_L7B!sT&$@o*x=AnR)P0W6F3P%gr<&~$^BIk=f!(uwi>>dymG~WaQ|eam0tLBL
zbxGH9VZW}Ym(5=G{O@(wU3l`-?Eg{%l5r2~6HjU0lD@X>OCJB`vVVuKJW`z7cI`+1
zf2WHv%)a(s2QPgQNshWQ|7F{osYXV9*IpI+|Ft{tq{z1RlGBuHrB?!uxBeIEVw<S_
zkZ%W9jQT9Qto<MDcW>!j@$Hj|lg^o>Q|ylCT0h=7@|W$R@{Dc%FE7fUs{Rmea%SiB
z+-Hh^PYM-tD~rke`S$K&ZQ1u9ph?}L|GPcD8Tf8Z7Z4~Ba&uGu(Hqn5#ymA7vuTx3
zZ5PwZKq1GMho={~iq7s#YgeidIb$O_vHgm=UF-rO#*h;eMBmEoe7W8HbKks6#nOAX
z?2Fr`v7$V1#Y-=?%&TIWb500<PQH3PPJW^l$9=Zy=SB4&b03*qzU?CNvD~P8hvG}7
z%KMTFtID`ba%}g7&AWK)ZpWX-6Uuik-%OciqF3@r$@0_n)m6o%bN8AuJ-+Su?b?Rt
zAFSUziQe3pfAVbfk?Q^TR5O<~Za-*z&~idhmhvCP((tPi|6{qtHLf3-x3}`wU-^<>
zDmCUunOZ)atJ-T{|1-$(H(NkK!-<yCOG_Rd`BYZR8!+S2$3<seB{l8Lo7d^yWV2T6
zeSr6~G)M0yTZK>el72EjJl=NFcc;nm+~;SPz7Bq#<-!rCwUb5j1OGLa<8HF$GAlaQ
z-|oKnXVS--M^jlgs-I|ovhvn#2hUgAJZA{#+lg%4{3NwzO;Xehv#ctf?$!fKbI)wu
zq#C|;-`eI$^(G&;-Ok({aqXsP)9W{UkzFYgZh0=-YrOf7OsR<Fm@VL|9LeEeEM_;u
z!fVOZS8F7M`CA00zGL-`a9PW>-1qb4g;zcM1Kb|*pMSE#b#u++2m}AgOBfE9e>qsV
zE3x};S%3AV=IIu_X$)`6XJlS9d$?_G=Io*u$pU(@PeeAkm~45`ELEqi_Ul~3Jf4X?
z1^2U#P5s@ku;a_-nhQ^=mh3*DADyyqg2254kpaEtCmtJUuW}W5pWD^+{YrR&M9rer
zTr1rRABkm%6iHujWO>gdvG3Qfmp8lf=kKff7;3lS17ZR{MtxiRjRS3UlepHn#%zvy
zk-Gk18*f?vO&en^wj^V*GW)VydzkDEE42;>oI5gWsqMR&d7N#Z<n{X3)b}q?oG-;Q
zG24kZc>Q#K?o-)4D|<i0b3T$OD!34^sJZF$>c2nF8tW^!{fK)tFZ}6*VA-!>Kl?AN
z`2P6A@srK}^#AR@!&BYv_ayRx)lIR62{DZxHAfxh96!14Z_30@raceYR(QJz3Mbun
zn;h-q*2XzA&wAC7D9-SwO6lMHYv<o=lKnAVc*6YKS1$Snue;{Bx6=55<2T_~VK+4I
zXH7ct{mdb&XD{V0|1vK9-gaQy9>&d!%qy(^T)lK`Lz;1}ug=1-H-BCfii9@I_d0NE
zu4Cwt6AQkaKOY%(;(%B_)BAmuT*u|}OP{QseBhSuhGPn=ST^`EKj$;`t+DKR9DMfM
zTGu(6DVCidn^qs!zdcn<-tO?q&LwG&MP(iw2=EVH8*%cE@Y-1w?d8QOl_&C_=H^UI
zGY{?GeZ-Nm)Bb{$Gz04j+wFGeMbCYaXpYz+P`-t$lBHyMtJ02HM|#|RSG{(0>&mw+
z*>z&y+Uv`Y*)E>5Ct~fZscoj3>4s}+8y9p4zFz+!Y0aD3Y@exeQg_3i>O5>oI`-(S
z)P<nk0f(L3xup`<eNs4Dz+`yhc+d(<#`~+eV<s)X*nZ5!XPFd3p0G@?)}PW^*C})S
zue`ifJY7?2iO-_Uwc$(lDg;h>B+YbP^!%^$vF~&L<(t0xuj}*g_ff%%{O@INr`>W(
zKIGhY_S`b5$mY2cFK<2U(b$yMEqM3Gp94mRtgdS3ezAC3e*WPpkJ?!#Q!4fqu4~Kr
z{XIHnW^J=~$uhkXL+<boA5?Z5*9(*$agv_>Xw{pq{khuV83)*I+^uXr<2*aGZjRC7
zXKWU0&9@ZB&Ne@OZ`vL9`|8^i?EP|mKFp2F`r+{ZWz??7cZq^qg)dAD_{bJ@;#l5^
zGKMvKcW2)amhO#7*?hcM+Sabt$IR|z;zQF5>fAF;zNW8Ae5}p3#f~9TUpnA8*TfxK
zt(RI^&5oW>a*Mi}x0HFdN!Q6E1`mV(7f<*wdunh@MC1K-r&X~zN6yx^DJXJJ+brm0
zYk0)vwewuRgBlOnn8d;sA5{$VS13tqJ-1>)k$=_O@<NT=U%Ck)74J<qFS2@?=+}QU
z-R|Mp>r3?*SiU^{__vg0YoJc{o8LWBOuhTv?uIO{<re5Xzr15h>FirCcj;_6;CrNQ
z68FsI3C6yEGp0mrWn*_(t<bTidc~rIg|`h4zEn)NKak(v#&K0<Lu|L&A@?U9TY?;T
zy}#T|6a1xKR;|3wtUD}j$>gsuihjQ?S#bNbsNSCB#p|r{j_sGPdnr73f6v=l2QvCo
z&KJJemE$8OIpb)G@wU*AuB*FdHK{E9qhoi``o(MedHZVK-7S*!Q+YG_;-fc$J65!q
zUv~f5<kH93IZN@HqKZskY?jovzuEme&hKAUdp|tnZO-lc{m1VdSJ<|^t=|0jhcFAq
zlYTXOr#I>eUfkQxsCDk!*4ct*w(p4uSQ%ht?0Eac-02tQta_lLl(?wS+F+s4ys51B
z3)d-J68ch9eO^X;x}vC0RKR=@uc(waDdt<)ek$$06Z2I5IQzlc(gZ#0Q&&{4&y@{$
zHEFSk<?fhb+3&p7J9BpiFVap~F0DK<!Cc{tMo`5k-$^0WPj<A%l?tyq@49$R*E9RB
ztLu(d)@y~Wjf{P8*YEcAz2du<c|M%WQ6jUixMG#g^7qa%OWi$Jy9!kr-LmZ7`+434
z|7@}6`!`QovTW|uXI8maQ$7`>ZK(MX{Ba+Lx0{gCcGg#nd8ejq+WqX_jKD4)Mpv=D
z-)y{2PW*W=|H5TE=4ww*--yi0?cdzexDr{*lHyiMC<~X^m^JQtzs6}w*MqCuLL5Ek
zIs9*YowR4or!v{L-2w(@Eo5WYue{`3F`sRXeBNOXjg}(DBkIpBbIU#)lsV$2=Hn=p
z@SSO`|HBh2=ZEf$?pn;S>3{AysRa%4#e2&u#dn7NmNZDH<p1;U&92hYbZOOnTR(g5
zVmX?9>0&eM(_M;h4r}=JD_@>;=JHLSL@VXRCT^Z5BX|6fINI-%<o+&T$2$!jmFu~C
zwlp2t89uc{tVQGeA%WC$QM*)sOEsjkom?3$CGdA8`{k|WH{P;mUNf+l(!Z#5pG_-B
zxn<9{c>8w2xW8t_f`1tIC+}Ode!~KZ`Ex$)_qW($EZBAO*is8V;m?waW*dH9_|VGE
z&hBrS9%gv@RVw43xp!iXT>7|GyCp;UzWx$Yn`W<2abZ>D<x<zoNCS?v-j}-4TLeWl
zy6ShBex2=lm!tgNo&@K~3oJgDvH0(~w|B<7thvdvL%+&RHeCP8@_W)G69p9><%y?z
ziWN7n*G#{-NZG>V^7otCDi!AoeE)~6@!^>*zj&9Jo4qXaBguyn+o$k%r`^h7EY!7D
zFS65|cX&eG&M#M_+5U*?=zlPJ9ew+3Szzw0`<XLBES~=HyX*5^{HNX>W5(0<(uqnO
zzvI_2Jo<a|eNlgQ-07~B>;Cyyhi{(k#?$h?vdgzx!D9-0N65;li#+x|x%5rMm1C2d
zQ)I-JI0ubWyUYK**~(tc>2hb5^v$m~=0)B%etdp@`}3CWK%Nt>C0ot}U;5Y)S|Z?=
zJijG=-a#=Dlct}IPMq?Lkr|qWGf&4nn7hWJUbTD^XZpjyqSC6w!;ig_>>VOozAG>J
zw|KFiqx;<M9xK^cy<@?wkMkdW(pa)&h5w3|4z49F8<MThfBV+7Liu9JDmK%5`pob6
zpEbC!GJ3fAu`m8#$If^4Y-9YBTdO{4l}taqWzyp9uOiCY>=n;=S=1Z6y3N#FpCl^r
z^6=-Cva=)Ng3bl=gqHo*sQt+&%2+1*$LI0Fdo%98efxFWja5(Hm4$54C_llj_0imP
zno{d^!F~IKy5yB7aqnAM&eqc2AJK7dj(bB;&AY!LmrnK7O?utAsk7+wlCSqU_fB@!
z>2|3)&hDgRD$><@C``5WfxYqBs*g_$?W8phzjiTRc3kTEcaKP}J-<ck`d@TpUuX&6
z-2ZG^yhX?DT`wb#9X$|IbmGWu<A_byO7Di$%yd6F&+hE54AEr6^uy6lSlir-!nUpL
zw2^h0BHg8$sweTCHSp(62X%XEp<^A^OtLj!&v#z0|I%Wqxa+Y?Om|XB%GVtWj#TgK
zyK6gTd8N{q>KmC41s;iPuQyu1deuGOH+7zM?$h2rIdbBt>cbs>ZKtc4>G^(}!J4$B
z(b#`4<H!7W{`Z#XbrpB{-PSb9K4m9wc%X8Y^41vj51Rj0-aGW_?0hR@j^CQCmGKoO
zq3<jM7YMd4zO&5xNXxY~%T0>j?y%UyYxB|kz~NODUGk^4KH97pG-X-Q`tU_TZ#O=W
zPrms2{+fK%^$BXb**5C=nn=BP=xzB}a-Q$*2&sYvYNvg#>K#~nNXX#$Mu{UlOFpm#
zaW=ns!zMOULc6kb>9@H4g481uZddOzJSFlk$?6{en&(IP`FE*a^I*KXDd+SG!P5m%
z=Xy8zH`v)3F)#3OG~MxDS)r@=erbcs3p3#oub8*fmX$?E?s?FgQ<3m;LBTvDqm7H#
zoxiqpm1>z2Ywr7%@w?YrPUQO-CKWMnTKCkM4b0trt8FhGWRcEZBiE~RI#=cYk_WtL
zy!X83@&8+w!F*xq`ig6Ho3EeUz2sHu$tACTY(5fv&78--)L87SP72F9lR`zUr;fFn
zAHH_J`#XDrWKw}6|8WDirO&qAERQ{q?e?L}wWEFIzjtxd7_WMFpL0;~@46Ys7R71I
z+p=&+o-pg8xp{>fpFNVX?O9PQvGbHo$|}7%vs_mO>%ZPDZrx{ET=DNFZ}sN9lS}wZ
ztNZtCPT{F_aENs@khi(ALF2%Rxj+9EZ7a;`Heb%SLE5)8MdQVSosE5Wi{#z!>C8R5
z>*@pTnxjjW`FR_EwsBoFVXolS<6VuG3k@$%68)mHtKrq8tVefJo+Z9eatTwHQs2X`
zvgJG9``b-^=dZ5x$$GToj?VQPnJ?Z3>^mx|Cc0~Sb(G`Y9lzL7?{V%aQM>+Lk%8fR
z1p|W^0|P^DYH@yE66gkJ{p9?j)Re@MM7@H_x3+JKZd*+H|5rrjIr~cK&W&@=#4OUv
zUz=<#dA(<H$eWqBb=P-$drmlF=vu^iY1_5uwezcct2e#Qs}W#OygBpk+P%B1{(7Vc
zWtd3)?PdF-wBtw3r}m5fH>Zfs={=XWCSz0Ou~&r!Axkf-O3NOpw$^WYyeaDX&7_+w
z?A5>5yRlcZ-)EifEjGtEPV8XM-A#Megk7-Ah}gBs>d*Ij$N9`RpRdV?;M0G-YRzRe
z?e4jAD`VF+sm$E&8@*YDbCc+v?4~Umr`l$Hm@E4;hsz<gJz{J0)2B%iQ>JEU%7@+j
zqL%()27mLmvuUp^<BKoW-V?jLOs9C=fhVQ2eF_gfs=c=1R+WA1vPi{yzNc-{gQfiU
z{tY=FaW+l;=9WNb(>MEeuD<N`aJQ4!)0-}(on=fv1pfNHU*7XUp6z*qQ`m;bshrwI
zJa(I->?DIezk4ri=6`#Sr~1wsQ(^u|tI|HdiL-g^J6E*Z=JAGQ*&jUu)J~o**=8KD
z!}Hb4n-}KW8~MJTDp5S|sn1r+xU+Rl?(ZL7e7@z`nrq!tihP;FwrKnQN<H_^wD6j!
z0-JBM_X~4=y~n5R>+F2{>Md;leSGt{-EiTm2Uokf+!v&`^uL(P(Ab#id&K^FYVe^?
zZ%T4a=bwo<%9Zdw^Vp7$RZ;7-W;mbSonO`U>0m(Z??V;=6%sX>++RcYS;lR8dA8Eh
zctX!v#)tiE5pItA{-|0eUcK3QahB-z$XGEIr%hKgzn{o>@kwyqf#tuN!fwsEuC+I@
zFnIZas4aF?Vb4E2lCb={CF9lBi>k~w*EH5XxbJ!Dt5^IM;RUbPH|)E3?ct2ea};M~
z?iJhf*?ZP@o|N}{RQXuLl8isHxjre1o!K&LOQc=!gnJL=r*C++MsT&o+2C`{-Kkuk
zN^9zr7JTr~{hFXN>tT9%`FHMS&H@+K*{n}xmXvPw>W-Yiyj{ywkxgt@_vU45+b*n`
zk<NX=!I_t@`m96Qqr4Ww3r4Z5Qx~+in5p?jEH7vDx^>J@{HCsUjK}4xItRl#+n&Dl
z_U16rnk97M6-&vQhn|J}VVR+teiKYyUU=VMCi%E2CbPkrrD(177d5H>EWvv=-ST-o
z=`%}d^Z!~#@50kIyenGIiXL2eh$AXvt(?5*r1cwm8`iW;R_VVXxncRc>A6!kYk##r
z*!lR!tTeMNM^Ys!qIL@DwpBB}Hezn&>CxQ6{-VLxS$Kn7isgOr6?-M(H%b2G?5J6F
zf35T}`{idRHT;P=;NrTUbDx8@*yG#tH%T{@=h`oH<B;poOJdRakR7SMeZk2I6(@CO
zpO2K~WxB9A;b<3YR@_gq{Y5hlbRD(UXE^YD4OiB;>1ND|T(eSdvBdXT`pi10wNAq5
zDR1+0$qi0B#NQvUF0{SNzwq&Hu_;y_2e+(Qm>nu+%<@;UdHG8v4T;%|dyHln-0a`w
zsgiK*Vcj3KHgyKh)RhcZ`A)a4a!!=GqbvF6FvrZEm_CVHX$zVvE-WfoknyCla`_A~
zc9x1FE5?_;yl>0fe;ZbqF=d?=yjgqT_1oJP73YJ#xY%vl{a~HWA+;Ue*@iX_!oHUi
z^rRNLTzk4^?xX@X+Zj$rJx*9Bxp|uB{^ZqN@R#q*!Jhl6XN|ZPrdvpO7w2vBytK=2
z;`=%4_MF<x_N%qIckVj3-`739?k(`1+??GM>uzv7BY3johujVCr8y2BPyCZTQ}o`s
z2i0#HP75{6^A}6_)8N09+4&hmtBPYOSB>>AS<SGdzZ*ps#Ygw4)m~~6xLm(NE9_?c
z%^Z)a-D#H2(q{Uv7ihdsS<hLhX}}XdP4|Y(gDIQ~wz=&KVQZMNF7jIH?g+L$F&i0X
zZ1h{I$Mm8yQm4W!`Cx`i2lH0PssaXsxw;#=E=5%-wfy}jae{TS*tZ^u$Ks9?KKHD@
zl(y?iUP4NBYth%k1}cv^%vQS1jalDV!OCndHG{v>wP<z}gGevaT&WBDE!4A&avkjs
z9-Yw3u&hY#AnW<AHJ+0?HrMcJsm)(0D$RXW^S70Mr`5?W{TKN$-zH3ZlN`C>oXy8=
zPO>7e9iQzzsdG?zj)B13wVSI9K2*uDElg!td){VGblT;m^ZAyn&WU2-KgS~fSogyI
zw`z7T(m1Dd^RhHb9g8nBPB+MSWpi;)(IT0XrjpWI8U?GaeboH3_|JU*>GpH#7!|6O
z{C<3NF8cHG@$b$2A2Q-4&U{`h@BeT;^TmJPS*nlDO0~SK(~uX~BqQxx+}9M^IB)x(
z8+_s$Pc3BMxgq+S_(4JbFjWn&O;rb(nlxtAMIGKX#o)Zu6AoV9==Ms#G^eP}60_#_
z-W;n;bOI(dc=^m?TpL)xu_x@VPRoO~ZQ3fXg3AQUx7^_CvUzqkp`*@vp14cp`J~4C
zJ}MKrp9mUC)xU|pfAB_{nB(5V54v{6+}0Ns+>w=j?(vnJ7?&#_`TNz{7EEwlxYlHn
z`GeGNdnGsin7yDc)@o)&9OIGfVwZnw1ltelvWfZ|E?Hc5r|{wnC5hsigavFrCfTQ-
zn!M>u_2%Ypj%ogzn*9$KHu(tXJvQdpaN$%;Zrs$hEIq0x4yy4gTJpvGPp<OqlVMlo
zwwc1l!n{}{yX0c4j25HtzBLhDoO6X9{m6`RJizTW)8x6$Tr;Luvcf^TnNH7T+&Mw)
zNrm9o+b^dS+T|A;Y^;pDw?%ZvmW<N;%`-nNwrHunz&+z#D(kVCP5}*iysP-)Yz{SF
z+j`PKBk)^T3x~MHc}1yzF3WU}m4zLhs_R^nvZG2bX@$1vGJe~j-Z?2LwTl|LLmslf
zy%N5iQ$s&xUuBW=$7Wmp4$VaYTTh5_&RCy%L%Ma!wP*hxZS~;P<WPIQ{O6P~(}!<a
z8f?~1XJNOVbWyNmn%T;0&h!2`8#AcfO<o!8&+lB@|F$OViGY<`_#_wQ#-sf<CUQJ&
z{(SCP|IB-rOn+o~c)~>q_VDYmmyhdxJYXs8X*4Zh4RZ*qY#rk{jSTaYx2~Q=H^YoY
zJU3P}M)^*B$Z*`8_2wRBgN3X8rD6_pFnUi;`pBAQzjVP&D{ht7S|LswJv|pPb?{^;
zTw50P_Lu$X{Tr@UGRr((oc4S>!v;UM180<DyEYYG-8|X+V?^h^BksM5wM~!OW5eAi
z%-Xjk>qYn?-ae)mWmA~eeG2wk*Er#|N&U3D3|D_PnjT;}vfL=Y%TGUYf}U!L+418N
zCyNxOnDFr!H~-kPfR$mo<R0S>r;b={j?7s){mZK>es)}KW}ZuO_g9_QIK=4?Joj2@
zWOb~*%>Kh-J7<XrJ8&;Q5qWZbgt-2xV<!w+qBK{Z3|sRtxbe@fMHhXOyZs$LeeK!m
zs^t?q?OI%8?**%5fz-}g?!$!vGbU`QTRUfQRmYl*trw&VE-w7c9Cqz+2+JjnoO!>u
z8vmC5z*fy7kZkpN|JzN|q!%ofiM#22XXDKNlXcvSAF^+@StRZB?y$&<V-IQ=(k`w|
z+SizFTljC!;%_GH6ILz$mL_i@rfYqEVi~iZl*6ALm%HPRPmD3XV7JJ7L7BI~+shXJ
zlwS%c>$2MgS&Pn7-m>oCw}21ZQ(p4?4PY$Tw5(67d~VaRn<h_kqtah2|G0e55%m>@
z+a{g;_WhjqM8!$04mYa!CtSE0_mL$cx@Yxd$9oOui&=tB9SZk+VxJuHaG}TMY0Hl;
z@)h?<>-%D~>-B}+EDmFj{#XB}ip7?G)=gROt7CZW#L1I?<Q7fi+Ouivyjic31iv=T
ztn_M*h>`lf@6?e!wOy6ZJj2eoRBd8V6uma<NI*(v!#xI84jY~dtJBv%`hDuYQOY3t
zmD{6q#-FBlf4Pmjf;Z}(6y8<sv@Cpv-CBe5Ez)5M-Bu0F?;;DM{gz5|KJxsz-NGU}
zV2P&gto5xr$<LNVcJ;=*aCchxhkIq5L+P9ZpACjRhjlgg?tSv^(?Or*rpw$WM}~Q?
zTWC|KRDN;|ud4Zm!>nFnxn_^|Iw(&$`Ap!>8uRyk_vPmAt2VCs{O;?;jQam6`Cp!;
z)Yos>UcROLPnrC^eRdqV{dRNyJ?jho8oj$|nrcnFtnB-}f90xV-pb4O_<iT^bN{{m
z-l6&VaeIHgJA3cn@5zhH^Wx{Gx-zi;zW;XazN)WTU!MIv`SHcqgBMp{ynX%uzp5?u
zUtYZ}zdwJ^zkg4@_`c}&cG2Rxps?!HT}GYt9UtdkKX6vTcFOauyRYON>{|bZ+2%IG
z`MOm7Zp#I;ziv0?zm@#%$Kjc2^^=cP-Oa7~bdK}DA}-N&msg*7kk>u^V1NLN`GV`F
z9LbBXJU(@$FYEr~GeOtYHWdjvTbn*qTd}$=r%FH7VWsfGrAG5QG%u;Og}wYyDHy}i
z&rs^n^769cvv<>(L&Sdg<ZnukXmb8txk58U;GhwY1y8~5q^Tl$XKOc0H!!Qot@diZ
zd*emo+ux0kH#jZg_Gi9+;DC~VsdmOcC%tX<XFs@JY&P@CJh?^p)hW5Qv^S}e-k0qS
zULIb-#qei)p0?1|cSd_t7j$HQsJ@o8nmIIa+Or+`qElGI{+J|Xv6<{_Txs-pONsH;
zldPLVf2$Pzp4yq?c*@Y+{4lQ%^R>A?FBYEKzxrTIc{i)b^S33LNwT|@R!;Qo2}?fw
zW}=SC#G|_J89!}eu`bpyO5B{c+Lwp7qgZmrtGPQlFRL9p$h4;-+G<WqgRZ#S%n+T@
zx+~vBV)E|K+TW?8Smd?sQMvv6za^i(GyHgX`RG#3ylHVB%XS=oZ!vG-b}=QF^ebzk
zx#oLBUdw&R{(hR3LP{*t)5feddrR(UD(Cs1C|S^ZwB(VX`$^0Ez>8nyA|KalT?p4~
zUey+%<dLZ@|5r4KBS`kay5!>aOB!WTyx-N!!WRa=-5>b6J4qt^?dc<nUQKy&lVz6r
zsS|g$hu*hI>pkbLHS51z^2VH3Ij?LRAAa7m&hps7FR@m;>~C6sYPuu;lua(JKfv*!
z(qx%rFP6B64>Gt9$j<#>l<)Z8=Rh)xsa}_wRI_g!OVhcC_ll?I8|+)>xb|V3;>$}f
zg$#Pw+ML>3RYQ*U$<2(gHhK|YVN&aVctQEgm2);fFE#U;Q|1$5;CHch&&#!|vyFFN
z6*K<Om+yG|*1WZI7e=JYbbD{x!oWQ_zp{6iU9;&?2`=+VncHnIby!JGvHZnpbL?*O
zjJx3*)@_I@O|fq(=yd<wICnJzSIJri(VUC^)e>us`aCM4S7xsK((#I^r{(|mV`1_<
z4VxCF?wzi)oz2bdmdU!U2Jy`f^P8`*FV;zXy*y$WlTGdE7H<XDRxSTL10@#!MW+g0
zx2&4~_dv^AeW@^$m>r3k%CYh~l1HvD`o}5qP&ZG~CFsasm+HhRsULzIoNH%_DRJ94
ziMxfRr0xj)CKTnpI8RJI%EjdiZ<x?j$7Mxx+WD7t|Cg|zpkcpg6ZhYaNspNeD+L`j
zIN7!x$vt{_L+-Q1<_{U>E~t7J&#>HFiT%}2y*mug^0+0KO#4sH@5<sSzZAKpQPx*%
znIms;>iPqL=Pu4)`zd7ExiyCZIO3w#>`-;@H^~Y6S{dVTDb#P#oL(2fJ!cn08`t}<
z6<B8!qVT!*&-1B<XUf(ku64|8-WSPwzrktW>8^10h5E_&bXM*;$Sr5#7Uur=ShUE$
zhfkb~ib^V{{Q2<mkBQ8$DZxLsPcP&Pv#CFMaYyUBX)<-|n)A(@?JR#6HP)RwJ?*+a
zuSar~LgT8S-5cAj1CJ|(X*@Tvwg3NM^%70tEi?LZ9+)3!cw#n1Oyb|?&!O?1QWMNq
znEsjZC*#|V8;MM|dHb9$dL}Qeyw~>T{q^_BQlY8;V)8bhO_$Gz(`!%{3;ZD`&9+HV
zYineirhQkVl~a4j2A=x=vsrH(+s|C(lh|$WgS9RF^?}CsjORJ`&6&Wv)6e+aoX3h6
zZETh$8z%9@ZPc81btY?2Alss2zY_mt7%V9<DOk8$<&Lq;Io_Y2#SiY@YL(rzF-~FE
zqU+na<I7t^6&#Eb{Y{TavTSGL5!l8yfAO<htfm(?Ol8{D-B>&8{?hCVyA)<{hlEa<
zdt{X%bK4~ynNWoY^@fvQ>(oWHnC<l6->;cp^S_EEV$1i%t{0=$Et-95<4(8Aa*0c^
z^J;zUYWLav{_^qBsTJ!5CiAmj*V=L9mwSbTRAu?;;QJm|lOq&L+FhMxr%mn*+HmyS
z+`WQrs=qH-y!f@_$FJ{4GhV&SnRa8%gJa9M{vD9Is<G~1W2SOKaPQghgjqFqe<#h6
zm;GPx?c<gHuh$dhHs3bdpE}Xy>jj5uh4ihed7pR|F34YDxhVJdJB_1e?To+r{~nj#
zR_N|!x8U4nUzf73AX~*2&+bVnt5^yTHb`7cJubnYEcQb7vHirYOBVSly(_Y^y~}kr
z`Bvo{&A3K+)h8*(c=zcReXuCvVhoH9T_aa|p!#lW+by9o(KmimZc9jdmumTlnQx4I
z<oo`_PH(qu=TGdklk%Ii`qVrR{;Y`kp_bXL{wy;TP8u}p$Ysr#w(`>3>RGKnI&MUK
zo33-M^do2dd^0hPg`T1-*6m*0bLl1TjnJikLT%^Pc-?sAa6ipu#-y7)O>dO6>wKO2
zi*7bWu2`_<Qnk&5lEa7JZ8(4a!GVW{7g<-ghI|RXa((~(7dCs(hrQKm;3z+oHAO0i
z>wbgaM!ks_Cr;U=YjAsydOuf%)+xt@>o*-UJ{0%=BG(kw!m|(W9f&b&FEV`Fd|Fs;
zyUiEP=g%+r=Pg$c+9IRX73}9Pw2^(u{g7pWS1(Gf;@q1a?DL?(>c8q^-HzX`m(Ojw
zbluiudrM#%%d`mF=^eEap_Lx>J<S&^*d$&x#XL@#a&6Nho$K}gE+pOQxjaqihoY0g
zgu}V3PH(a<cz%`5*rY^s;)-7{Vi=lKFPMqEFzdYP;PYaJ&Z6gR0z5OTCgeuwH+@g9
zx3HIuULLifW*>)ynEKHzf0-_FPxE~d9I@s>MH%PeDt0NQwy0<x?MXRRtFIsE(VEb3
zR$<bSEoE;Sen#9oDQva$01umM#g@o3t#iBnx=ak2Fm1Q=rvmO?<&%D=6u7poHQEx@
zw`-N}MT5qfQmJ#2p75=*nlJDoRN>rI|J2VCOK)EKxl3B~ifJF)(f(2&k4Hkm8ydbk
zANr-CVQYVHWt@Ap>(zd%DdD^4zLGe<OlSS_IeT??Oz`bFnz$+R@|B5xDeZT&1x{)&
z*5mx1>CbaJXTH>4soOK%b!r5j%3I1w7~OIFUa{&v`;v<#ITCgp75(k}ObgV%ZM>Pl
zeUjtLg$0KXEZg!h^V=TVjYb0ZQ%&<H<q0SHxUjw2!~SJP`zrwllkBf?_HRSgPVGG{
z7cO0KH^=et1&`>}dVdq2r_Sv>W9L?rTNpg0yj6HL3;z!Hexa0g4Kwc4%V~XC>k)U7
z|EJ)uEpr}wXK*C#Ze7+beIiC@(L1r7=Vry!ym~+7RA=w<wW>)w&PqJqwp4HC>;20%
z{(WC7UG{I<xoy$m3zr+Xtqq>y`oBVDo~v1QzsBwLYnJTx*EL%`xA^3Vjz{s!_i>kh
zJ63P+QGMHS=ZD!_jI<J)d3Dxm{eINB-sWuAhUYBozowqGtuWi79`mHXRAJ>r`6u(_
z@1)+%YhTvC_}4+X8rz7<MOXRXU(KIkx?`1$!58Ky=bbK;<}P8s+H1(Fz98o2hFx>@
z@8;fW_&=j#;r60-741xuW=9o<)~8_tNgH*a86ErIwq{25`aqc}M++xNNbPmq@|0QE
z;P<ltfg<aQ#s?Q(Y4Ka~+hp3l$qBihd#(Ra)=B3Qt$nxCy8gxg`=@_;{^n!bW`3;{
zce{02%vs(2W9Wn>CR+dMPE{?|dA!v=LiFCv{khBkx?KG@c`Enn($=rfr^NU({`j^2
z(Fvn8UXxwB_DZufiFYlw5%N;lwXbEd_2$zRvp%VD@wO~@&UV$cZtAJ9SF2Yo3a#qb
zDe3rk`hdTRPvswO&DO*DOQs!rJKxdh(zl|D)qMBXeH98h=*#_)L4R7)Jic6pdjF|m
z@r_Ll-yIezRAn96W4Lgw!IQ&tPCnVTG1!o!PW+8zTyEsrqYJ9M+qcx870c!Or}v>f
ziD6&PY?jTo*$RG(7Ykp}na6pO<#2!+|Cw6Z!ox!O+IzO2ycf2yy`pN-KLL*{;}nzp
zsq<t*?TX_MUfkxd&N-nsZ;rwK!<DmV?PfeGak`-AM7E+$<Mqk!1SYdR=&dxYtq^{#
zEB?>K`C)oxb9;aOqbceVCtaH3xZnRYe^vEcC3Vr$-ul@Q!D&U=PcBd2zOm=Rop1hf
zD-QRsGpsn|RPyC{EL+RtZD#4c@As|tzEgMb_QG8vv-h2NA}@CKbd-U<^!Lv{g`(GJ
z?~`QTey!8|@!lj+uBE=u4lK0c`IO;dI!&WnmfO%Zw%xt-lExdOd;S|=h=<txobqdy
zE9;6`_aj!>iWua6my*6Y<96`0iZ3djd~3_Xdj5qoT(T5bH}<yEEhze?`t!%j&(nhg
zQoU3wPG9Ibd`Nm?sC?nJ(#v9o^KN%nTL({>FX%si!W{Kro3`aDmkpoI%}bHnEmFDv
zS3bA-SCR9)QU(eY^ZD-WlK)hcZ^Ic=6jb$V9sgCernUb0+f}#qT%2l9^VoE6Rq~~a
zdu%RdN}Dc8|9^AgcCI^lI`hiKkE*^})?!z8L^i{1TkX_!sapHixLMxYy6QFa5l-K^
z-;Xm3%2k9+o@nZ2zJ%?Ag+;VTi6j3Ej@tMznLq6-db7_=)|Yj7@KEG5^UGIqg`1c^
z|NiE-eoc5s_1}$Rs`2Vt{Wq-Zy5(J#=uV8?HYupK!RXN09B-5I(#T(D=Bn(=$(g5g
z=S*MSlB=t>r`C(GCpw&Z_xjVJ$-*U4Dwk|{nM?OeStRhp++5aoz;MZA8M#B1T0)6y
zH*C<i(e^2;ezDKKulYh+c$Zc4hW*~V6pMQf$kk8NUK@JlU30o$|L%ti!tMU@OwQEq
zN#A+MpKaET=dU!FpZfb)`|kc(6|6ktmQ-<Wiutb%kIHi5m~Vd$vbmYP@}6hOvfJfB
z1x=mmR>JSzDH}*MZTs+EwBoUe=2Zs2hbAg#t1hd4UA|#m9v7SaqmT(7l#K&&jys2b
zGCkhBYKL*}J@(S~ulxUf+p&84;Y^Dwmzk3)dRkg5Lca#CU&VXEKD~lrhbUwG&BvDu
z1k>5q9Nk#*=qkrIUb!QF$(0d1tPMrt@*f?@tz=3%ec^%k{aD@IyLY>9o~gxp$$fk1
z!%Zf!C0kc~FjLRzEAu$}bE(cX0dw`kZ<0T+6MX(Dt=4;cRl<&4(@XaFXeP@TEZzO=
zT~o+Cw#Y^y)|)|k8+5jbmGfG-fBcXY?022x605cGu47t<7yb6z`%rP;w9D&uNAmnv
z`muTMp-)SGJ~&_Rc9>^dF`w|+>ko?0_d4fW@GUbw+I87{!|DTDR37~LmSuI?Ys<A)
zs~(Gaw`Bfhi(bVv|6o&G%Ng%_m)5gtqPHHOez)rF{Y9TjTodvwY6SFqCKM>Ji9bH3
z7kcI(oAov?(T%L7hi`AJpPYWY^kMsP`){FU57L`Ay|_L>gJs_P+cu%;M>0ECW)&QZ
zSgOT-a*<5E)&H7rmtRhQa`)oVm7+hs_~~yF4V_!+;{C+Z=C#%=-L+;pSNuNsrCqOU
zot!es^vAJ2r_$u<I!k_-KaCC5clQgE+5GWUSG@w?zdWZF^DWDwuCuVIX*^it5TDp~
z@>uWnN$WP`#c0{NzIdzG^lQ${4O2EPX5OpG|Bq$Gl9(4a?OT<mEjaA9xkotYcAk}~
z{rsbAcg@+DaMMIoet(VUbKxg`6+5eb`iZdih<rPpHg*4x2(upbmrHVHKUuM=Xxbj(
z7SEJl6I^=Uak7@qPqXZAoHj40`lO)Xg?bP6W&DO4*<R`9UiuU8BxP51YpE@#Y=?l|
zLaR$2Z&?0!mxiiZKKsdiH%|7D#L2_KFDkSzR7BZMaelOO{@P@_(B8|1+pVgUUlo`!
zin2`V+f?1==VTxee(mO^`-{G@9{65&+_BAfQKQA_C5bDw&-i<VcCE=-)}qerBlzB7
zc4V92vt_^JIM?px2xIBFo0@8|;X(bH>dFgFdU`d&<zEte-aR?NVidkmMr}{nF~5`p
zX{SEr9r6xHxE#G_o3DUV9OvZD&kKq!yi2UeUF-jTLFRU&zvT=DPknpJy{{)+k_=FL
zrO<uYD>nPdiPf(Q3_kE?+}oeO(^c|%xzUnOhnx$wCeE2H>XI3*m>Ml$bNq19=75+V
zJFJiRG&7z#5-j>V)wlddz+ZzViK7=X<y7VymoBa}FBfvMYW=Q1;m}&9rv;~P*cjZu
ztMbrxo_^PR^CCa?FQ=ZgXDge(oRee5P-S_zC1cV}mYde^?@YE3317u7EpT@6?Z(;V
zccMOi&u}z#<zgtW57K@tlD<sqxw-rklXHb$qUz^z&#C_BxcXs#Z=+duivHKBO}}?f
zOZecwK=0MmD+(<|r?(4-%+7q_zC514d38a_rw<iBK1dv6N>f?JHTn0h%s6}ZQ&)D}
zKXl-8fyp8><(%S<_P0l7YGj-6E@8i~UGk1$(Zy|oJO<a7aSN|n@<8<OgP=dt#cI~S
zh!c1^Z_Q$f*HL<%|F1jceZQ)j%f2sZ;qAXIzj$9phdt0Uuj$SH`&iid>t=!N?7Ln%
zUjK67`WM%NKHaaaf0(8#%AMCZdT!cJ=j2tQ|5h;HvbGXx-5qkR-%!J+P}^Z)6T{*U
zZ*L2n{J0?Pg5nPk#m0Fv-*nzrJ^R6_cV5tgw@HoV$&$xc{oeihZfizg-4Cwo!S_B2
zAGW{bKCRfa?)K>^*OG54%Dj5G_r|LEPaX)!xd@!^?|pWA&hz>!I;&>gRbw;w`!)JO
zW{qZ($b{Qj&a3ygdfoaH!#g=hyqZ_^{|vrO`mM72j^A)9zU}odg8lC$UvJ+l`fDrJ
z?S5hX@YnSVx71GWHkkQu$(^lF_wwg1+M#t*g>}_aPk(OiX&vcrR~@<;{rvdzk2d)~
zFWpdQ{PMge)<?ObHNm^og)i>JYK}RExo1@5SG8Mf=|w%ToESBK*%iwJ9)C=3M*Ke(
zU854udHVUR;5&1e;{L2Uyl&OPAM)nbR}(I#bUa|;JM6$Z=e$JfZ^x_8`z2gTywcX?
zoe1(QQ~pxRB#~FP(tGuuf}_3Bd<hpP2-#)nDjBR;^g^V~lIQ3*vAY+~&OUs>?xNtU
z$y3_HuU9B1PrkS8>%(;wdv{j`C!hTE%3x1|Q)IW1YX?`5>x+fEl3Mi29xr&4-J`x~
zs>P~yQ^8;DY$AyvUu>5uZ?Y<HnV9}OOhPpIpBI1R$299FTILH@J@j3FcZI^u7rT}J
zdN=o4iM_mfS0df~!-Jre>!w+}S)*K+vXVzOzxv<HUjI)GZa;ZvnC<!%e8)vSyy3Av
z%cb{keXcS7_MZLB=D|&;*IWBIzWHZJ2(3RgLG!!!@uF%yxjb*1mj=no@dw^U$7E$2
zFY^nSv$^V`y-)ui=TpThmxE&)ygIq|W@z2)-v2XGe$JgGWk+(?Ij8&bzWlRF$+Xn+
z%?HcmYOAigHm^zBg63Yhc>d}{p3)oKnN~b4S?{~NJ}&m2ZZ4NSnbpL=`Mp-vDfbrT
zSsM2puLiG}eD_C;)}9sd_1h=j-+L=vu1-UG?@tk%3vBAQPI-3zDOe=eaQ}P4qpuR|
z^AENx`Y&nC>G@t~{gs(&(LPtwj}^6_dr`9Y|CgtCZ=O8)^7xZaFHW~#KK<nJ#h))(
zf0>p34F3~*Pfh6h^|lI&6%*8Rj><32Y(6Ra`({$qly{ROSItj2q#JAS{k`C`&DH$x
z!z<rQs+C?noE0gS{q^{BdAr&_i+?GfEmhvNJFITL!;>8`OTYG3DXgywt>4!A*+FIc
zQOn|=9nEtkE*5`1@*(-^;+c-(fBcrOdBEth?LRZ>5)tvl%d4L=F);XXGBAiTpezwd
zNi9gr%t_TNs9YKroqgLtr0)9q3ojJRe0{EOXEl=0PHnx^Ys%lOB5~F(k9A#+PUYe$
z|Gv*vJ}s{5Wjy0viQfJ4JgaY#`~TN{EiTkH4v-Qvx71MP<~%#8ex2(#j_%V>n&y7g
z5B+=RM7#T8eSN!{C-w@@<6CEbmY%BGBkKG0$mJ~=zPBA_75xke?|taB@)U=%_EO1W
zqt7wkUk|iC%RUyt$GYBiv7**eroB&IKRM>0TsL*Y#bq~-)_mkl-5xaitX1T8(^Ge+
zUMaTQ`KHYK*hiDxn~HxIi^qRFd#+0AqD_Njt*3of@rwSHOT0Y0o3aD5Hf&mDS~36Z
zo24tH{3I8tzBk&M^g6m=&7`Sn3yS`_&pMv5Ep&6mmW9c8&kG8MHZzr|WjV~-?R8K=
zb=#Wdp8_YW{rvIhysq^Vp8n;zJze>Xb+x6*`(m5zzl1Yx=kjlVWyJ9~Rn%{O)<cJv
z9h;b4cQE8XN=(^ip)YcEPE);YPuc<7B|J?|mWPU*j><4^$Z%O1;M+fiLHCYH>(>&G
z*&Vx%6?O{f@kuf9Ju2idf0e(eLU@n(<4(6*<~N$%`*QM_`wu^~n*GtYb&}mW-n|E2
zR<6#Ra?)tRiT_tKI5O_Cuvtm;n?L1!U=$jwDtX##VPWd6jzy(K>hlz~ck^y<**^E(
z!f3xW-*-0sikg-ul5v08%8*M-GM6mWdG_bTBiYl5$_H%Js;ky8UlMES`xkDs`AV_4
z+S}vP!}B%Y`ZC#0&x@{3RXBZa0?)6dH8<prlz-`DYhKy8&7^M;zmn1-(N&8r3@VPa
zu(=ffIXZJmb$+E^f-=Wc{X)i`g&P*0J29_o(-Ol29~q~5URd{x>-P31+rsuQoyJzA
z^<eufyQz!r^u*rTdDiSN-=rGL+=lDrB^z$OtB<de(|1+p`IXQSGJV1P*=J8im!xg;
zdLp&i@oCh~Ph8Ui@~sZ<b+G;%T(eCzcP=;cy2snRH=5_I+bX=5-<oyfLDuND=?i@)
zOBNYs{#nUrE$Q)395rVwmD9LxCd9xn&z6Bf95rX8=9MMq=cQ$)>lIX9wZ2_;+hWrD
ze_TDE9W<4-UzV8Ner)_s_IQ|3?(c2WCi@+GeYnlT!)dmXC5xu(>&Nx?S21xkiKKcL
zSIN08zpYrf(wZyO;UlYb?A$tAi^+{0Q!OOgl+HbM>3TCkcDc=r&Svw!*Q@n!curbp
zWI6Zgo3pRw@5vmPU;ZXd?Z(ak&ofRN1p+6XOEfyoI{*D!-%Tm!YU+cYxT@96KUp~|
z#qx3CoF_KZJ=dI>G2yvQ$BrPUsm(c;=Vb;QwKzM;Aw>75*3^$v3XkTQNC=95F8aqX
zkM~R6O*3~ZWlOWOPqR%^6*sH6v9aA}o~YDn`%Sac$*%9n(;wx6PkcK9jjsA?o=@jn
zqg`?L_GIC*%lm(pnSSuM<MpePjH|J^ll<YbgV3P_OF0*&z|T3Qp0e>3AsiC~IOJN^
zuxP7_s2F%1a*=b@VgI>!O+=K-L=Mvo3B!q(m6R1XclIQNskd!!WyrAMi=3e970A!s
zrNg}E;;P$=_2gEvw5(ckN;LXZjhlthLFXykR<y7z5VM)AA#?S9HRJl@3#QBr(V1S{
zxY_97k}lg2%fpce98Wk|&UEmX;V={X8PpNs?{tULFG)+&D8PilN6n{kC5PC_>VtLM
zlYA65@Be!9w^F(%Pl@W$l4HwSc?890iy!RKO}9BNE@>USfRRB-TYs{WfA=3%r{mvu
zZRwdP8+6^}m<`iuz9mYbA3gcLJY{mZtiIRdDzj0>nq{?ZIcE;2#h;Rxuwr^`l#*0?
zAS?UMB{soIZ#EV-7A@K7&FMAobi_HwjoQ=FZNet2%<kTBzHV;gjAsY99cC?`_~V?K
zLB^Tp>I*rs>I+XC3~0QgCw$+r({@RotA{fqPvgW6k51K<>>P7N3K#Giy6<FMs&&4L
z!Lf1TQyGz^Ju9@7-!#YGJATsWTl1C=>NR@GoQL}&+Ij9gw&6~Df3M2+v(!@Ky!cHE
zs^;82?iyytmLIpjE;s((PW@MPp?2+BQ^h7!6vx~7eUiUF<@}^@6Bkb*|JNyJ@Bd9%
zepYo&XW^0m{vo<6i{{U*)T;fxSd}Y8bLvu-j;dt#Wtk6b!Waq;EmE2sH}~EP`}$4i
z@1Iux`Zzvr_xaG{XU>JJRF0`yxnR}O_`NziXNCXxxc1fWf0wPFUz|B5U1<8`?bltG
zo1D36q^VS3>Ev?D?BLM@Moi16Y;dqvk7)h<{@$<m?dJbZUQPdh_~XwHITjLcr?<^t
z_epY%eCBqUg8VJ^4|cIH_xQ&i^HZYgTMWm(HZHO9-+PYQrn8woU8j9&VxsT6^Cz~e
z1>P-hZ?b;Avh1>8|8my(T~faltkZ3G%as*;Jo>+==I#8LdGWmG*{=Wl`SGe^jsXL|
z`Jw2DZMFi@W$aFs3P*ONo)7+DsbI6WZjbY`xpQtjowDr8hp*XN53EQG;Z<Y}e7t?O
z|8()PuZfpe%CgmQ{S`H<+t7RRN4ZnQ&wu-~bEUMmg>`IpdU~VkZ)Hg`yMD!yjUP{c
zyty&A$8pPzib5N!cC*7TX7;?-Hv6k_WzMhk<$Rk{KVM((SDg{%fA?UU{N=9)-#YR6
zSZ})UVxxyiwV!@b#;*>~yI&(VcPO#j&sv|L=vc6+Rr5|v+`Qamw)d$$3qoI(PV9J`
zy*td~<#FZRE*&SjK1H1VednpL)4@rnPp{7R^N%>={dHcQ-TqB?ig~tn{CwQK`C;{K
zzQWcHwJU}ecCvG7H@x<2(r$Zp@xy!O+iZFo^MrOTo}JyX+%3;PYFqRgZ^`zV3qJ1W
z)Aw7?zW7v<UgrLDlb48i8$AEs^6|-^AL8Ag<Wpb&-?8@P-!BgDU*0JFdfGi=s<?cc
z{913r$#*Qd=bc*FvDGo2*Pic9QrDuRcNojdzCGR3#4Z-J>i4T(pOjZgoBsZkI@|um
z##MVw_>49NPfSy42++#eu4%^pS@W?wPkPeEEqgOMMIJS5Z(p#Qk8jbM>wo`Oa7!L~
z`QTMmK~asd#n*{#lWr~V-5gavd;0xnp<k}N+P!O&ch4fRvLe1H$-AeweCaY5I8ka4
z{NmM)KR@1Ff1IzZz`LzqHD0qnN}nyB?fMM~=eEf&%@VHe-(&H+?d(F2S`U@5xX$NV
z-a!+e3J7Fw5GZq$Vrh(h_uI-&tDehee|Wa%>YWN^b2&e}__nNGt2w57y=~wQ=ZSF*
zWhOR<13Q<*A8buL=RIj-`*B-uHJ5e!PB}-cl3jH6U10l)t$Nl!X7(l?4LM-U7+n{W
zn_8bXkMY66RFi_~+4)l(nive9hCE3t>7Tb*<>c4NQJPhYca(BUr?frH>`Aoc|HP!6
z!pz+i>iCd_m0RHUW=WR=kxbscDy>a5$}67E@p(2cNg`>9WWyvzRvos8Gn;iH7i~Ph
z)<;Xp{M3_W|1H^WMA@7FHRjm;@#nj97nvLx9-6xp-B#OWZOt3xal+O|=ALG1YXyIH
zS@M?!>^J0ku5RAL>%^i`_SPaI-)GXk6}$PWWIL{inDib{SkK8<>XBqzv`MV@QQ;Ym
z(7kH2?HpcI+<5-=#J1hO=Q8AOu#_#*wRXvh&RQ&7{VHVIwQa0RuNjyJM1RX)bmLt9
z@?CH4DI{KwUM^>*9RFU<?u7l6NNwr2X*2U4CG)<Ja!#0)dD3;Y;WECTFUn3aPq&kr
zKWB|qW;biv((89_{@HYC|CFMIym#Bp<6L&GY6<$DaG)(*{^i8-i0^T0eeN~<&irsQ
z=ArM0a{o2{4HuM|wx{wl&qz3y`sVRNr`69s8oXN9`|#JDxi{RFhKqc9nzl{aV_wQU
zed$%X%#150D9gkeyDiz5TNAG}zduw+bmt3`yK2Xsr*E6Q|J;(Pb=N8x_VmY^)VM@2
zeY^JMs@ZPeMlL2HdjrAF{&erDLea|8%zW1|-}Iclw&GXngw1p3MSI-vy<WNP*1R3N
zzOiQZ2CA4e$lBbFI=!{<$LDYIa^KgMDYEpXbkuV@+GPo^uQk&OvN<lAw#DvQb;Xx!
z246k~^goYc+P)~BQGCVvu(J2N?wZ}!obusl`9po<o_m|0$HpWd+JEA*>Bc{feDBNm
zJ^07tbUb&@oN2EFdpIm+bYH)5A<;bh?l&F2^}F2!DrK8)yH3pFshGBEZ({E?!<2af
zjlUS%%I(fCJEeN--I3Q{*5yuGo3gG^|H2y4g3{{iv7fsHbjxKX>VG+;JUM#7H&g%U
z^)r2M+?1JQY$moLr({vzM&2WD1cE<LwL5+N<?mT3+NzN!8MJ4u@mjY}{~x2|6uv_*
zPyCsnTB3V7?=#<NlU?oMZpSLjTF##hdFk=EFnGqXDcvgak2-C<99mMFii<0&Jl$VT
z*_o0wPbWZ5t8kKYiP3~g?Grm&9p*nU;PRTbb4GOD`=h7Mn$1~o&eJA<!S+IW+<C`$
z*EVf^wu$vcdA-Qfr*EgI%Ko%Sxh=5Ea<7Yo|B}gXO}?KvAUgl@+o_9wOaI89qtmiG
zL|W*bq409qcRJ~l8~%HjxSW>D*z)Ayt{=1as=O81_(=Gn^DjGVC;Pjm?t;&4W}J-R
zdF**<<^7adtPGN@FWFZtD6gKodDYfXeI-8C{?*^BCmvO@%2D%?sxZ`hXueyv+f#Vz
z^ySLe+^<dM5@Ks9e1ESgnf2@fk<)LNFPc$y{;M^Uc(~f7Gp@{A)_B%E`g>LIwqmt{
z$*hU)pTiVuTRJx6RK5B4CNrmA`Qv$4J8!3Mx%1Z)W}b3Aw%AYL;68RmhOTEfH_I-%
zTD;<u)~fgo@vPj!d(!59WX<s~jO|>snz`{s1hc-`XO`H_T1Hlt3#~6LO$a>XENFGW
zjnnKn(<6x)2bsCnyhxjnSNyExzkkQA%&X?sqI+cW^;~@_IC*6EPf53UI*q}4(h=!I
z8OFQbz5W&jdGWuB&;FNvF*i?V=B$gXB0-n)+a%7vtyHLztz7B1{q|yIceD7VtF_{c
zXRSIaFm>4(xlnHBm!Gz6usUY!$A5;Yt#azY2eac`ek?hAs=DO+TD2L>2^Q~XY=67`
z<<<kmK~VxXS*;4Izn_=m`EmSzukE+zUsp(+zwYtZ>tWf44>!J_viO!+bo#*7cQFno
zX$RJ7&$_j9y74WSm9Ndul_n-wy49cDEaB1e=WVf%@C9`P<`)Meci6JsHVfZj{h~@}
zl@r6`bDu+G_f?rr{kcZsyW*L8SI3(>CIqgKk8hMXP!xAG>80hL%&oijNV;DCVYHaX
zUzVTk`2>k(!=9&CUgsU1)cA41|Jsty3t~@&5_8rlIsJZ<)zPO}`udh(f9a#MAGaO$
zi}Y?(zIxHQs?V(2^lEjv?P1^Z7p|@jusSGTQNQP`=QL^lqHo{7zujzFqLa8V^8Zz<
zb9ZyR_4>c;6+H7X>qYZbkz3_Q)~Ua3iSb|gxGyE9=Dwim*_)ikXICimRc^DsyxgR-
z^gv>KU!3O;`}hO%Swk-#I6Ue3!8b)$?#{Ac`1T+(s9^317Gqic_!sr2F@Jp)Jp8!v
z7;FDworw?oa%5gdT6bPZSjAm<>}l;r<xl<=>FQTnmiAeQ{fu~f>RaoH`~809PHR72
zDRh1!^}g?qP}<wBy9rqmdB>J}+H{8bUw#mkYsvgEzwuhq3gu&SGP38$Cw!Rpg6EEv
zQE0>6{B|$5Ktul*$MUDRL~P!|8|HLj!!xDZp{wQf?e_m-xm*_X+9WT+c>3;L4l_31
zel?Z%yZUDJLaP;R*AK5h&#}ed)R$|$rnQ`t-uAcRZ@6DD>uX>3@p)3daJ6En;YIxt
z%SEeQlr7IC=p4J5b<DWq(rPhgZf&*H2YoIHk9Ko(-MP{)u|&!Fc;`o%Q(8QwXV!E7
zE#d6Cvb8rNgJZUd+6DF*QXL!Ot=}FxZ0Gy7?F!eSc}DHp<sbE;l5S>vyY?+ulK((>
zqNUu9t^A)~xflG($SB`+tC4w2Zia`9(wDt6<v)f7Ikb6em`P5~);-U;a*c6?ezM2D
zynyBHd6Ra>E<GrbzW%!86)n?$D}$KD3#RJtTrN99;;NCH^-?#*S+=th`McwuXB<iB
zdwRic9_QN3(+3vc*yZ)_%on-WE+GQlGZRj`Tw;D2{7qn**X{WpD|J@hGq@JcI;GrR
zqNo0p+}DG3bJ8c&C>Y;h$q8Y-aV|4swM2g5wb<JyH#i2(?@#~x^6!-p;hWBz%Q&rt
zPyJeatM|aO$RCUEsF+N3C^6WRZ}?t%-ocG6p=$*yP3Lau*L>eq!EpAm=<W3$H`*=o
z4i(GE);`#9?%L7KdP>t9cYjJ)aV@%R9iwpIOXjHKo9(wcZr<@vQu))lrL&S}aLtMK
zQJKZH$@KFj=GmM1H_fQ)KDnlP$*1p4d;LE}uKjmA?Ca%+8grYzl>E|uxw<Lkr3~lQ
z#D%7h^B6QUJ+{7B@Y7IK_nY~d9|nJ_>@1ErYb~xcxTn!H*YB8R@tXFTI^w*SY=5nE
z_TJ30*NS;Qi(TBzeE&MTB>OM*Z}yv&IylJ(9OXO^^Ke?5=V!Kt61CQ?AKrdh{)5wN
zvti4VpPa&%)f=j$^JExbJ*u(i_^^4_xo5W*Y~6j~)#vGUXL#P#>TG!Dz~(!_;IpMg
z#EZW&##vL_H$0cI+`O(WoH<K8@>)*(ZjZMyeJ`Z8K7VBU@JH*(sdbCreOvqK+q#{r
zBaOCC?EUq)W${1XC5y`h`uCRB`FZKz@Mu2jx>vq?>4|S2rQ9z$%FQS>JYK<n)?U<8
ziZl3Jzv7A$1rj?_i*E+3<>mc&qSyA9@6nys)}~vznyO}P%3#c1n00fD?3&BRP3&?l
ze#Oj{<2RrFRC48AkptVJCAO}t&_BB4?%k%Z8%uWz3h!E{{Ik*Sz1gSb=L<?a{L6!z
zN(>I}PgMHAtQnrv^7`A?xpv%_+5*KBGMOSydN$Wvta+d9xKdT%*er>)hVH&8ulf&f
z%j1469U@#{ec|@4o0?aD%&4>u`7~vz$g!GGEv7$rl(wiY7E`O%aQ*aRr_|nS-&W?o
z{P<h1cJ85-6NL0bbj;%nyj3h1*Js{-+A%NjoTtd7C;L2l8DGEl;Q3{C=f^fl4V8K6
zEH3PP+R{n;F3tb@(*N%Trql0_NyUqQS$#PA?5a(U=C0fk2OF+0Kcc6RG)Y7vV0v=>
z;gSdDix<v3r=ja0b-O%s?VZkp7dbY)XpnT>5cgoIx=s9Kw`Xt9F!Wwp<!i1|@wLfp
zwc(to)$;#?!p>~JQkH%7=B!`6qIb;yKCTGeufOhod06UC_j8-qUDZ22;Xu}od0yLO
zQd4@~P28#({MG$utY@~@){O>7r=;&l&J|Vvnmc*c$!$q#tJ~DCeX)DG=uGv5ez|q_
zL4IG4HhpLCaq^e^#N@k2%;mD$3Aq(YE@i*>^*?*|yMK#E$y;%OZSl|7>lLq>t-#Bu
z`gJqA^|7_TGOzppmTX|%@clpPP}4PyYl_YW3=C>p85krnhMF>q^7C?2^GfszD(}{2
z7T@-m_MrT4S5B3(L)pX)y1QfY&Ss^BOnMVET}M;r>cxeD2NY(i1Trz2@p<N~ufOoG
z_iyU&zB4Xre6KXZ-+wVWBsTLzP37L2ayuL0=jrVG`}!7l`V?7O%{sNDBW>cDvLpAj
z=IA`hxLv>TtIwO|t4qbsinrdV`&d-H<!{pO)*TTZA03}%DlPlucI;&qXRoW`;iZ=!
z{Qr}mvH368?HcXANlwQ;7(_3PjBv@^wAJ+VrKKEAk&#no@-PYNK8#d6q~giFYEpjg
z%1tXKL{3~*xQ_c$jYe2u#F<MumLfA{x@ve`e=gEl6cMg<ZMDYCZUb@gT^W;(ZJeX=
zz=R=whWpGpZLSg8agSUcXT<2YnRW?Tb|>xJx^@2?xx@YCA0F$RDVo_CySwRr#k$|u
z4wzo~H?4tx?c0ZUUDg#WaQ@in_*OsY#@dAz-r+`^p9<RUr!Jevw=(nVZ-;Y-jPwo_
zp1G<gHgihu`A?xTqK-4pCjR{wx2*NZdmi2CiDr>3=0>M06)ZNqKfP1(_B97zm8J7{
z&O5I8_fO!u*Q>>r7l&>+b*WNJ&v)`+>l=?%dd}~NSwF!iPc74^``J68T6xvPZTlWb
zu85RX-7K<f*1=CHt}2OE*FCFdvrG<^JaZ^jB>3jP_7742WYPq;oo!EJ6P3~l-{2p)
z?$p`*a)v;;mP)<pk1K4iuyRZKrKZ&#+LvZ<;#GOgW}Zc_Dy{zU23-7e=CV=q+g8TH
z^P7!k3Y>f0_jnDDT7}6^%ZKN7^gLR*F5w#2xwAeoKg8>;t$DuHTip5o@x_zBd|xjc
zF0T!}5OzG?tvqnjZ}Y&ow!*k6mo=`wty{LKSj)O^T`Kn+sWh2mLMvI<a6dkAJ~8Ih
zomKU-TeW}rZ~wvZxhG#{M%sFY;LEyI3#!lYFY;tO{{GN${ppnxdCzWMy>{)|$(JWT
zsCfURwxHruaY0pCVM$dH-&K81kNeiYKh|!juln@vMQy>h@{i5tBKKZZ$$i+wwt7QE
zMf1W{yZ<M?KYsYZo5v4#FOK(pds66vc0_8yhxb`u`}yz5zTazqJnCbKSo`NYO{HaN
za(-djpGDeyqGc3hJr6By*;uvZv)$BcgQY9ya5@}gcy?<)=VRG}9i{?{>%{|(N%x=V
zYB6bFt8*wtY2zz_`TPsK6&5G$j9Y8FYPRQs6P*oQQomxv7!$$^gwtwQNNYUW7Od{u
zaBQ;9+0U|uY-ePdI&=;Mz7KG>Sin91yKPTl{<?~Sy>b2j>X!5s2QoBIEPvP%Al1ka
zJR|5O@1pMaCbJG~=HS?VCNWp**YV>b_UAhiKTbQb@`3W=j9D59yNfC$mPUrGY5yQ1
zmZ_Gvl*3q4=z+8OrKTgxnRaqrnbBIPbL`=hC<TQVi+z0byG`^<)a`f_PU&h~(A#@f
zv_ww8$4ZoQ!)2a-?cYAUHaoj%E5~t79?pf;_y3oa)Cl~!xmjUp=b75iyX#kq$J8kA
zd2sjT@rGL!;TGz9EuD_-6j}Cas*@Aj4)ObKuVem%Jv+KgGj#LH2LTr!Tsp+B=k(-|
zZI4j)`Z6AdTR}H=nYbs(r*4RA$ZME)^T3tHi^W?x!gO_yaGu%S)G)tL?Qpi%!JDDy
z0~|QIncDc-*$wXg*X^D3@9CM}JhFc@e?QvF|9;gg>B?#LQy&-In_qcjqeuFq&5gfX
z1z7z!&y;sLa8y<*dAw{hd2mw6=UIo@XA9Z(jSHCHRfp=oI-~e!t=oG0r#C`+XJjt8
z+PtH;i*@~ZzObhK78@Pk>P!!s`)s97gAL1P&#K8^U;cNv_fhbu>ms3uRjE@l&gIYB
z`zijQu!NL+fkqX(jw9cZ`k9><B>!tRhD|@vcq&v!zc9#o)~%}nFPs*g@n90+)!0<J
zHG8#Uj`z$5%R(>t{lCN`W>#bp)ckoJ+jRZ1ZIahjJk=KUFS_O#wZ~bZJ#t!_3bXEF
zndpFn3C9opY7TkU$^PV-9+OPFuS=00gP~HWj=E~6ckXY~HD$j1w?yas3OVzeamJoc
zJ3p$-WxDsiOWft|7L6CH-54iHIq2r`2><&Y%kQ^!tM)Y>2CclVVkM5|2l4k8hYD<|
zSbV-=ed~`uM?Xt8n^q|Q{2JNzEnoa%O5nod40c~nM&EV}*mg_&nA<LiSzkWdvp?PN
z;J<3zOUA$T9bqBQ3p<)te~hrXsC}bN?dmH#3GaX)H=mQIB|prYyXy*rcVq4@)~@tN
z8Eq{VljHQ9t}(MPAAZ`d>Dv%-{K&5KR|f;891!bvjd&p%${SVb_f=xrt<QHvbtT$u
z=N#uKylqoDb8={TnpVG^@dN#NmuK$1btCP<S?;TklGcj#{qULd=+qrIgWHxT?(IyA
zx@@rf-lq0eCQ+}tEwT{~HFodAKd<^GwNt}a^-*7OxyM@Lg4J7k?>y^jQScD)c5sjq
zS|1#*{m$C0_51gSrx|N*wkZDQ=Df{c6sD)z*S|#e%H71+#tenyt?idZ7948iem?1$
zhH{L}ft9r`OaA8XW4vkTS~xp3aB;-jux7*7>3v(?OwKs=h1KPsLpXPUU$<k715XpX
zoTnO_f!r%DrO+Lp7Hck4G)>+zv*f^T_9*Q&=_}@>YxJF8<a4ssqWG>rxc(l_#S)$~
z``z`mUfg*byuIR3kbviUWfg@icFqpF1cyBidc7u!E%(=Q2R-bzt2#UNf|7Zp=`XpC
zi0S(4UWs(h&R==5vFreQ!u<y6t^&D7PKtdBYA#uRX-XE_^XA1l9msQ$G}bkq>hAv}
z^Rh+YipaNJH=7h6Wlg&Ed!C_HwoaaXuGnQZQG-a4(>o?tu718w<78@FbAR-jU1e4?
z%Re)P_B8LyoSM5mbcR9Ag{kqY0tFA2bT0iGvT=%Twc@Sc<;zaJX4&-L<U&f5M(RI?
zRY$rn%=j-Ku;AL|N!Nd5C%Z<fOMKAE&|5QY`MKHV6O&X~Y=oaz#BEt<CVsl0_sb_W
zCPCLyzM2^;g|qG{Fs^3|oE-R7;2`&%i!u2djMp8Tch5NM{N>HN>x*N3jMWn!D0p69
z#3z60@CC_r#V;ml{M3DOU3A0rf6?{3V?)X;@3z+S7%kuXJJM9PsW&B)^N99=`luyq
z*yf*;Wi?{{)!aRQ<JSd_%I{czPSJcJoV4tb$G40Li}Ge4V}AeS#gp~ba^2IIlUqF|
z{EVGdX0nirYqqP+uf}Cezl@TMrT?5cocc00a+k|ACGWL2*Z$s6W_jyX*WK<lQ~EfW
zmzw50oh)-_{Ym@DCX9SRVY?a@?+oZ)dyCsKgqxr1QEEGvv-UR;(>DH3k3(l(vwZpS
za=g5man#q<rd4f+BU)C=tj+$Zr2BX!$MO&UcbFb32nyeLt<p1bZ(~7Qk*(-ihaVb^
zOLZN;Z(Q)T@aRr&F@IMn|GBz9V|P^q^IsQPwJzzQdt^Ri@I{?B{fFo9?E0H>VMW&t
zrhbN{%PpnKf8FEwom{(~^JY_DeZqNn{i7ZXLRz99SFL8B^d-mUK1YmfZ|{K@Q*zpx
zLN^&?9a^cqX#Reas{t&F`VMZ`D*mhD*oE+ytIL@WEwFZp`+X+nrj~Y{$kAfHX|FCR
zc8c=m1W)>~I`^BIiO*~K<u^sX1Sb?!EV$&w5|%Xg%*GEtemv*D_E1UN@B(Z69Pz|s
z)9hLKK4x~bD<0%hnz&u)!KBh%3VV*v{~P{qyNY<);}s6iuOyrZYvRz5*btYo?!d(K
z?M4anj|x3dW=$5IDe89m_iXio9C6KwZOoQ^hgd??pWdi+o02bh&%@$m@Ql1E4SJ3e
zd?l@NdX5!LoU@m)PdHvAr|Nm+6tma^CC!Lbp~;uHCQsgAEwuE`oG^B?wziXOg`0bB
z?RM^9oHFM+S7-C8;N1P@x9T45cgZ?mKbJkA=c(Vz)B6ib|Gl<Z@ao5Lz1r2Q_OA`E
zKYjK7uBG=2UzX>+l-8?#Jgx5Z()+uXuHX4(YxJ)!@A#cdZ^!I<J8j>SOSdX2P2+a0
zb}SaV7k}r{_LyJSbpQ5w?=SYg|AXU3HLAu_#{(<Y{|nNt^<J8vz4U(I%kr(4%tL-H
z3;U%zweEJ4=n)0cOWWsguC}vPlc|~R`Sb5j$8u)1TP{9jIlmfz#8`%H;hHN^v%W)r
z>(|4g9bCbS+z&YC^n{o6tg<{5W5;=O^PPP4xV>@yGRt3@_A_W1e-}vpbZW7APkr{m
z`K-^%Gi)R#ZFHFP{{7quf1Rs;oRH-=QECs?6<({taCfe|k7U@)IVV>7sQD~h!2e~R
z<kdsrwF{Jm|Ass}ctK8Kf}I$<Qkl^tfo3Nzjo%*b6-;RlmoEx8efRTG`xi0W5@$1J
z1=Z6^0nq_hP95d)(2eSBh&?c$XNk_e#JJa*S2Sy+;x~Fs3^|^;tLc4Y)H(4BTho}Q
zS#RFtyYRYarGU0G_xTyM%d9<E8sm-?soXrA$1thJWpduT5VgZErG86>Ctc=>J^G|U
zMKQQD{nl-+JsgbX2`W5SjibGnE%P#1{~_q0L-V#y+n3>@`nm$)UN?(;XGr%>zN#ai
zH%}#*v2S_e;x*l6F`F-cdFA(hQkMBr{j#uEqL;m2`S3@rF1r1pdBuV!$2E>mU`XY1
zljGw*bdn`Pc`EP6@9Ph~>~9Xc{XzBG&P^*B-YoEC@=y;qy3X9e5Gr5zxBA2Z#?3!u
zmL5!6$h75E3;RX>wOV=!OZU5+x)GHosbJNitC6W;u6?s4mVb?+e!sn8?&YdKGjDdR
zD-(}fx~fb;JMV9rjq6f2?YqxqcN~fOp5!3td!7G&{hHeI@9e8S=FX@;aVeSo|6eh=
z9c6zyrY?WA*ym7^e}?Vn^?Ui}+UA6QHs1aDclpwrck5T%?qa<)<=!*KU&+6Zt=adu
zZQ)MAh^kNQERMgqZ1|Wyu{d>o;Jjs+@VEY<+?N373$GT<*648+e0F``k5>N!EsIhg
zN*;f$ar8{1>(cb>306WZZ6^XQXlY4$^gDEhuBh>KDrsGJS?FQ+8lNMp-wI~*FqNsg
z_f&nJRrktpn#lZ5r(f#l$0=(od1%jE7ci66b7e<>_u>P_0yjl8Oc${kxGt%0j671=
z#r%OQ<jpm!6RY+GM3hzW`6y2R$kUszpfqW-8?W+g$5<n6=FVP0)vI-a*GtsJ-G%#X
zj-C7Rroq<L_}J~%nC|FIro(g8_E{vY4_DmWBT`w(zSmu2Q_}jGf2t)f)_u4(alN4H
z9-%<lTY&}FG`!MI{7TB~-;&(2r)W=H*4HCPm3-Evt7d#o;Z2xqHS4@i!I84!KIumS
zeg_Tb1l(?O`>}~Fjw{%RWA~YSwUSS2+!JQmnqTWYs(eJsb&;cd{{&~@OQ%=fx~nX!
zW-6<dsNndSWx**W)rU4Nj&m11`SD@Tm#O==^{#*3^Z3Q(Q>l&0X3^}{XEIhk?c8GW
zO5$gY@~kI!Z<{Y#&ts6iMCVF|!znI>g?u~*5|^evlau^$L*wMJ_S|?^g^+g^n^Ov!
zj2G1CDScLG`?@ZKe{D!pb=A}Ge>Hby1cb8=teaK3VOFl?6^&G>HpbVtUaZWVz3ol#
zb)T0#lh2ym7M1I{z3GQ$)k-am*=GgaLaHj_ULUW0F+t2tW^Y>Xp@6-~=dUn6Y%k%c
zDV$fdMeWeMWj%`(A1EHxS2B8#^x|+AGv8KEuX1h+##O0`h96XSP2&=qz-naA_`i9r
za?XdNi9OzHl0|w}<{Xat9CmNf%ABaA6P^}+`B#n!em2_|bz1X%@P@d&-|RlNJUR1P
zDldND<+Oh9!j*47*v78-`@5pYcGkX!@%x;7B+jJYx~dqJ`{DHTGTkPv+*d7?KUL}+
z+%L|)fAM_HqGw5RI)`i&!o*b>+0(!6Rp^M@TPw_RuXgX1f*BI^GuCLk+c|{??4I#I
z;Al&jS;Cjnw;|E>_ve}4vA1}?t@7jicNtP&oFjLcuMBv$VRyOjtGM}#Eem`zkMauG
z`QJ?I?%`hiVYc%pSpyC3Tc^Fw*@Zv4YHo6^f67v=jchyY3|uF~PBc7ls>vcjC9Z^f
z>PD%nfeVi@dZnApKG|c*xo+P_gNb=u&7XRGIVD*Fx>aLyHhpwW*0Y*%LTk$O$*t=}
zW3?C;O;bCt?ePnFpRIE=53HMYwxdWlVpm5)(*1X77mF91Q86vp>~pHHugu1zCz4+%
za?7;ETkidO@cv}%W`mx0x7=2V%jy4I;Hq@?7qk3~oo9Yk&FQmTe$S`1|GJdo{$sQ1
z`u6cZmFTwFR`+4@sYJHuOGX=BbzJsZnWQ0q`s$Htm%j$l`zr5VQ#g{_=)TqM+>BCL
z^)Qk392x(<dtT)@_UW?l?i17G-iCdixFkK-x&0Hb!S8!q=E<g&pJ%N*dSSYwv_jn%
zfdDRn2E*jkWegG<g8DbA-CNc@N$ITkz3Jchq<6a{9C|v%z500lqV4$$vZOg~yjWnF
z(Kc!N$=8#d7#^JV&Hh}&I=krnJe|d%?{+%gmNQX|>IzacTXD24>%)~Tiyod;2-=-=
z-DJ^K?V=e6?&n9VFO=5a`OHM{cwo@IPP?B+4x1*VbuCJ>dvGJFcijQ0Mx%R~t#7V=
zD;C%hxI<}u)f9~ikI40@(@s>Z;4r^?OXtZYj>gHZ)0VZWsy>=KdEtbkN0xirtT>~Q
zu|R0kd54!~BHRKKFYejIB(<~i=cHX)kLRRp{djKMozt%qMR&J!{`PFQ+UNg5(C<YX
z-`StFYTuS^NIbDK@adj&tZ&7Bg`KiI{x4N1()>m8BX`a4Cw5Wl!q+&om)*IZ7?aG|
zawC5>?}OSY{&QYBd>5A&X`ArXNu$J}*ZkRnFFteL_S(tKegAmhGy}C=Whsph7?sYq
zChotr?Aw#vu4yZn-H+bNU&w4S<63CE<rmquiZ82QUFl%%QsWi<cj3oIZ|~D}SMv5&
z{{4ILXxraSC!QF8eE8yx%rwr>`-ZRoWz0MfG{a`D^0lOZwdXHql{)W=GTF#<ef~s_
zBtDg_Q!<|JyV%)3JXu@4^4$LB8F?!VA{WV-RI;wle&=)H&gB&^5<XwbV{KM)$vezb
zYP?5$YC+2Xe>eS`p1OaWnebQhchmR7nrV)SLMwkM>@hp+_u{c`SJKq?HuZMx$^m_b
z?;cl{9-g+}uK$zFkt5GL_dK2K^lbuP#e!|?yf!VV)6)EuDpI$|^p8nnppE;<7nVLk
zXKm-(m@k>IEI@pMyoTie)g6=no1DCObmM(R(VS;e=Z{!w^14_Zijg%7`qESM`D!Fj
zwp>M~@ih~%s?(t>d=)=1Xq@TSoX5UF&{T5i&a0gcyC>YzbKS&X^JB62gGQP4osu>x
zZ}v@EYTaPtFsH8PjL#3n?dxTq99Y79W};yq<NA9FXCEnd2;Q)`aJXX5)T!5QJ;~>{
zkoli;@bl{84&J@n`xjhX;QHt9dtHVa)|tMI8MA`fwjI5gs&6k>XJcu@XZL3AT-mvM
z?2mW!@jv7;UKUcWkvL_(t?QS)vWffhIQFiowK>YTVe7wN9oNo;Z`k<jTgSGp&4G^}
z8S*mrZ#G#JmmJa{cX^t$&C;hSw(WxUbz3eQ1iyVZ>60PvVv~BO)sLQep3PI@QK=2O
ze0#$Toq1P^X0?7cnRzrjC;D#%ON*;S?DQM6_S-CaYO}EHvwQE4Zso5VH{D5>{W(uW
z>cxshRWhxymx6AevFr`B6uSRQKb}L(W4YFn_}hhnvt*Yt%{-QJu<&4@%=FVH;zxX+
zTxmLP$$sUpBEv7Ct&?gP3)Hk?Svy``Y>}PMa_@8{ha9`M)_noz*$oTkbw?{zPI>0c
zc#WA&DQD$^tbKC>f3^8vvT1Z*wIe~{)c<1fhozPbUpQW;S)MsDarKF|=c)5-<=syf
z$GN=KX|I(lJlV2Nw`XZt#o}jEExg+oHawFOv0S0DskrBwLn(uDqterkqvx|a;!ZE*
z$l89*wp>HwWM9zxRln;F&o4XLed~y`h--|z!~JUUNuPaRF4%jk$362r*P6pmRCfQ^
zFXkdO-ReR#$J8ksKHdzraQ$Yo^<Mm)z^hyKd{+r#xU|S#cJ2u+agI%Cc1j|=TIWtb
z`66@9k1gxdl~a6avsQ9XvNdgzTNLWwyYTqR_-7Zw-y8RQ_dfsr!kZ75gFk-QA$`GE
z-C6nVh9I6qo!48o%<c3Ol71|-ymHOOwPz-OtX_Lv(8q{jwa;$1tLLTMm(LEkb>Nuz
z!Z`}}i_Y-RcS<n1yt1EzcYEf$ii<m@-ZuSy`$EjZJLZ1UpX9aX-FV?<yWzLt@;K-9
zAr7lwtJ>TRJNM??PO1O%t5?1`{PX@feLj1Z-_`Qp>p$GO7P4|aqg--y;`XY-l5+LQ
zjZ=@Esn}@|(Xqkp;5y3{h7;wk+0MF}_kGprG_9^*VXp!dH%)Ge*y&<F^+Ao9%f`zw
zs<S(mc)5$*YY<U6bW-Ken}!m{6fMIUbF9T2a=1lO1yuxkcB&}rGAiz`^qKy`)?fGB
zd|Q9_iVS=E$?h+>&S^w`UBE4R$RVMGUo5g@Z@QG~>lvx}i?^-|4bmvpJM*4*-igN5
zPa`%aUyVIs=HTDjusmUpUdpVQIYnX#?ivy%a@YO8G6;z5xbgDf$^&Ooa(DuIf<(5j
z{E?!2Uj0I&SI^c(0p(LubzR!ETDuq*_@6EP^(Xbi$vdwad4KVjY+QB2s4F^t-4l~X
zA`>-dYSvmAeT(E|P-Jp=xi5A{^81*x&3wQApLP<mOuwQQ=E~SPvG9r8PD>N5GM`qS
z*GZziTjU?5GVL;3V0uVP>&$^QbA)aQt={amU~&_KV&n4!@3<Pf&RdIn9II>i8)6<k
zG23YK`em549AAX+l_s_{wa1S4+V(7YCidi|W&a^Ahlg*1w_6!p_~HD<V3pG`!($&z
z|6aP5rm?Ea$mQ({(+=a`-#0Ee;U!t{Z&#Mn)x^??9mmgQzM3;{?Xqhp54u$P*iHDV
zX0ch~fR(T8zksC*FUlL)r(L#6+0+>M_P4C?YM$mdQ|?_6{MpXd->~Mb>UZa~YJQnN
zo;?+15pPZ3U*%F+vSGqOlT$uc2PbMhQDtU4Q_IELwfb^l>Aa6#+HdA|G8_{Tb-WP%
zamJKuLeUc%44*I`+Am$nt#&$dfsk8NrSLiNf}Ul+<@t7$`E5DSd-v$RKdZERn9S^T
zE=J!qJHkEbh58wlGZAwmR&ZF%ycD?qX!Mk{IX$IiA>BdTMxs}?s+g<GDf;N|NOSF4
zzhK6j>7Emp{_LvSp!zsUJy-Fh$<|f(@~$q6)SaKQLT7c?uT>m(TTIusnK}Is)8m=-
zLCdCsLnm}MYhSAgKjV_syC*DA-DIF~{`c3Ld^gvNF1fxn`}<nns}AzlJ@~VdSG!%9
z7TLu6)8S2uW1*DaPJ5m{^VgT<4|r-lFXohGo)=^lr0{<C9E*i}-My|cw|`W7Iw5gx
z`a#nbMK%%2$`03cUYua*+{622!tZMfWw#tOD^@mrnI3k{-sPu|`S}%dH70MHQFb-(
z@a1VqZL%k;q&}_DN*1n-e7Mwd<AT?H(^fjwuR8ry{;5n>f>_oBzpp``xB|0WTf?m7
zZaVxfx)2j@th(p3zyqcu9z8GJrd7wu&bqcS&_6OHJpFx)4cDI5OofON+dD3qo}c7X
zyE{Bh9>uk}O_((0WZShxtVtTjBCB*KKi?p`<I&|TL#eH^uV3|vJ@U@?wb_dk#Sd<<
z$?ckIm-CdTs(1G}Z&^pDh?qO|TFrvrMU}Q}|C4p&gGrCVnvAdA50+m&V*J_ebI-mG
z?p@)jy2|m-UI^wN7kE{~dghH;)X8~s*Kav{`&&5At}q|d7TyUz53S)<pSf6IyA*5I
z2lMm0`!{aAx}*H0*1NwvPiAwj+?>2e$iZ<|Dig<N{+T->QcQ)OS9ECgGTn5{i{1F6
zxRLYP|C~&jzBA|aBDv>qHEuh|`IN(?WbOGjRX=VU&W+WR`F03T$zQtesnCR_yMzzK
zM|oWnO%Hgt;-<XCX~D)ll4&(-m&|+F*J*Mye#-Ni+vaZ-kQGZ|jP^Ppz+xDpx!{A=
zjbas<u(IT}oo~0K@7%wo=uo`n$_3WX8GJGhDduKq1!g|JDs)<)Ib+Mb6}LmK?s5x!
zI=}vbf`;PWQtKmkvJ6W#mRpFFe|!0COMS%t4b3InB7a@Yuy}fFr|p4wC7)tl)>the
zjXUlVr+qk0xFf98B&Mo)FRf$d{Mi$JYksnJaahX>k4`y8fj`TYx5WCNJ>l^;b1&<Y
z!*xj&-)`7RpE#Abd4)#6qT|tFuZ%eMPG8s<mDVGs7rE?B)_32dS-bCAYJ@H|Vvj#<
zI%{*0mr(DqtxKxBnf9$b6sE6Zp|19rYi2Wx>fCch&QX_Ue#p?_I3!)P$cc+*w&<m>
zS{s!XZ_%c6(^YLw>A!t=;lU9n<Crx*ma1!hFfUr~rn~!teSwkGTV1ou5@jjh_bV}8
z-&1iod}jUyhF5yG5??>n+uU+$@1z47-R(NcQOd=xRiBG|%#Zq>_#fd^x#Zo01$CWM
zeB_yr^vz*<yUc9nqG<jTY#EIw`crj#^&fb63NoDM5!sgYPI!SyljN7|?yi%^7o3_L
z{`K>8UGW8WIVK+8RaLs=7A)~!v*!H@)qPb*8|Ur(&7&V@*{}8X)>2Ict3aWW*HgY4
z##pQ^IIU_S`$lXo<J`lquT8zW+UZW`<(0-y+7#~CmsdBH@k?v69!^YeT*s0A>GSki
z4|dG#yAiNzR&D`LvOz+O--Culr*Z=__AzSBJExR+=dJbB)uD1`%PxK?-mbDI_vS6G
z-8W?3ZTt1`%b!KECx7I!<yyF{*Qzk-3Vr;;Dq`!$D<uz@d;fI4NGJ$qtmMiH(^%SI
z!@Ahu0MG2#PXj&MH>L)A8h&bgbzzcwt<r46eSbB3La$HPd$Kz1ybhoJx_nh9`vu>n
zzC`^$Z(-KmazpffbYz5=S@zOvb3>d|cinQh5!8J2`hly`UM0Vj4;6XU9htQHnVnzs
zx8C*bzqU$pJ}rG={YJ})-*vz5#XK3_CxIu74T{8<rCyll_;ulOzS6tzJ_xP)`D)#R
zE%pxoj;>#tVRFNvCn|&gzTnROj4uXdZ{;_sznIsddc^8U<Keg}%MKpfxjlVrUevKK
zUc18SUG_5nPLs(yRV_C4t+w^tebsaC^3J7G-`on`w|u7M5siwO%y)BAy1iDktdO$W
z=d?H7Wx3wjpU3nRUlnuL7at6oVyJnwWlk?sVC@UP)V)6Zt7F&p$KDT1Ii#~Py(;}F
ztL(z586Njc&qV2QZ|V>@)EBU0izs*LqDZsrJ?&fEtfo)RYfL%nQC#aCwO-9wc6Vun
z!S+QtVeg9Fr<FV99&?S=Nv#+B5}@xtvFwUByR=i`p8gpHg`MF~D{qE4oPBZN3}<5>
z-<yY>`3oAJJubgH^+12s@v|0B-{`!E@?7@f!IK)fDV2*;r<xyTDXejS(Jgy5mv7gd
zkGA(C<TA55G-u8awO)JLob|n>nk%=d!x6W=5^FiuZFv2lhwoCuVKLu{kv&&tv*hr$
zU0QJD$^G6l-BKO88LR^Ns>1CXl3jj8B$;ev<<4s6(*HG4Mryvv;h={SPxd>VJ2)qz
za#q%-U{?JnRrOhG!>w0TJzKCT=6#3sGyel~rL3kTdCl$S)2Lh9sjuWU`ORhDH|~Y&
z8<)DCw3d8u`+3-u9LLJ;ORtNL9?9ShS$g8y-?Z({4<mE$I%hK9ee=9{_xh*P(i&Ng
z2}-2hJNDhm{nD13+rC7m9yAv<X;cks%6vQJN%_^d+)`U}q0g%O?DCJ;zy7-Myh3pP
z_u@GR=hZ!*znpo=tFj0OyRT|%_c#<A@9SlZXIsHE#lf#jhgoVdvt9YFg+lW8eP#u6
z34BhPd1~g~C6hx^ZY%6w!CHPqh^Nfw*{RKQH#aUmx_<4vgpxk1C%RK_#jkQdm*@Oz
z^;_raNk@ex%quMZPE!nvSm2}+AaVJ5M)`Ku-W--=r>@<Il}XyJVl8piC9>(s`jVeb
z(pgL|HqLWjvq2(pnn&n6hIb!gH015Pl&?<U$vn#Petzin_;p_tEDX;rHElhAb;Clb
zwpUF-FLxi`mU?{-<0r8Pw@ygAT(1i)+<x;K<K3N~mMCv`Q;+_;;@a+4`Hy?O1Fm)*
ze<8L^a^cjXkp2Gyf8R`O*;N%#ushjod)$Rxj89{kZodBN@%p*KvLy@t6l<nU`kS!P
z=G?R3OIs6<YMaIxFdulJ);(p0N|i)cYNCMpcDJeBGIO4^uL$5gs#qp;!%o8QmDkVh
z4_jP6xAd-9aeM92wMGlCueqq@;`cqX@%7byxAS&U8oY@D8a8T;n%AdYJr(5Zd{4CR
zBg5$!p5=?gI{p3U9Xc3jy|ks`XQ*k%ou~y`Z?B}*-U#b{CU}_t?n^x*UG5F1-8mV3
zr+$k1oHAW6xY~68!Y;n-IlO-hLxV0k<<7B~SpH(?rJJIq2V!`wt3=(tYn=&rc_c@Y
zv-rkM?WIWvE^2mIIG(>PczA(B@JoZ(AdiK0@fm8G-B!-wZEYtG-4=*nEpS|PQpjVj
zH_TNJ=X+1SA%0?wYVX5I7fwgbx#Oy^kS!vr?engeYqoOR&++@s!gfEX>t=nn$H#`S
z1?h3uXJ0E^nUz&LcggC~`U`zY9-kN5n&rjMUdFhxF6zeSy1%Z<r=Fhr#QtjYf=yz#
zF8zA!AM#h_ZoOU3<A=h0o_o)Q9DAGHv!l3n>(h7L$DF2Sos@WLRetF9!`V(=E3zb$
z<{swLo_SbjQdQ$Mzub+t9;?n$n0=7V^yD(dLnaHaU6>@kVD_<#c9T*rZk?Q_dwbe~
zV(*X1sgHtxMBco>n|rBK)o$Y^8}G~hV&@-o<Q4j?i)UbU@e!Q2BEyYgrReQ78xr?#
zvse|PqAOFvCE*)ZniriTm9_n`(Fxxs4x6mL_=wM1t`|%{Kg*o-ys<fX+e=oKOrwdq
z6B|VRc8Xni7P+YVl=RZnbNe?Za^7~@e=ciM;f$3YqOwUz)}9)_x|1&(uGzyXV>qMW
z)h6-deSb{__SfFfdayV5!T&3dFYlW^b;;g~7dm^RRifYiTPkz@?DQK>{Og$CZK^jG
zIgq+;zs9%cH-fa5#nj$jZhrc8c4F1v^+(M4?qFH0lBX5%O!s!`+9dA_6Z3zsep}vu
zHRgX->9QBU+?9_Vcq&x8C4|55|Ap)J2e!YHDCSN7%FNg7Ie+49A8&>x=arI<Su3_4
zy4s#tviC^b&u3q5U))-qq_N~PSJ9sZM|>`rJ^Nq3>>S6wH-3AgoqW8{-RVwgFMgtD
zcw*@yE$1Xp-3?BwbwA7uoRRu4DpI|5(;2Qk2Q@xlWANEJt!6IYSu@7{7i=90cRu#@
zz4d>wt@JtTyVjRZnYiyeFMh6rIXOexs6=~hQR;y;C3<^yX(mP9Sg8Hge}Vawe_Cwo
z5BU`D%(CBk_v1vHYwjukf9CzxU;kcSMq{?krZcyH#{Xx_X_DK*pC`KFyX%C=^D)_B
ziAD!5|Ki!E`e#Z-``)9gUso<TBx#oO;je9(PTp&QUDK|8N!t5tak8Y(RqwB}Vuc>;
z6yRMEeoA)L+gB?#oPN5h;r~s&MAtPh`-`$xil2FM=8wUVNpVThN00Jv_2<Y=GF!WI
z7t<xCja_?}Z$Bh9<B;5i>6e!H&3^uVW<~jz*X@U8LoQ$W{pP`*(@$r_&#Lw=tiOJ3
zX~N@T=Cbbg-K<LP6)y`P)p(s#$W^=I#}W0OrDR^c^zuh9b@-m=E?WC<%j?#w<|#V%
zZ}-~U@Yh+f%ZbRy3;4fc>zF^Qb#mO_ZQOJCt$!tHHne5Fk4jl}ySYLB?2(Sn-wQrI
zmYyVWch?K|xl`7K#a9P@JAZE82CX#5f1TMIJE!Gs^3L8Dw>{Y|V~q#f0~z~(Q<=|#
z^M0?mp0xOr<NC$Hw~`oM|F~57xahl&?&dYSMeiEl-0^7I*5@m{0_4@!8m@O1j*7cc
z*d_B%eBs0z(KH3i2U}k)=}7u6v?6)sq8!lx_n9j{c_}XVy>$DlZELfanJn;dza$<s
z^)1uYRXK5=b~_nJOU{Y7og}5ZbnfQa+`qiOJ4th@7V>k)F1%K@VA+zZk+wB+S>kFg
zg}=3r)V*xDGh%hL>z}YTP4!TopILeh8)nr=$@*k?m)p;*KJtxK%Inp4dx`&V)|nlj
z`zus>ZQ`x6!!M`wR{i;O_({|*MX_0_FL^i2_T#FmcUp0KVhC%{)|u_E1X?zC1y1-P
zYvc7L@3Mqh_oMi!W(iGE5s}BfhMljH_^h3oW%n$R*JoAy{Du`KrA-TB+pA*554?2g
zv^;mKZ(;CUi^R*{BW^@YFX3=rz4z?ehgKF}jpwgF^!4j|$M&{cJ?mZu1Xk~r>u6E4
zTCpp2eJ_Jp=B7tW4DxsF;r<wB*0KK>@0!KD7aGfjTOYk~PpDn4{=V<t<?L5ewF1K5
zTL!!n&+O=_+u1BP)k^!@YnIw-w!TBW*|86eV|O388pL+8`S9lc_TSaw?d&Z#)8+l|
zD@R}K`n;EKJ(rN#|H}8t%r3F7pH9CuY2VNFD?dev|Fzh^X3}SK7S=4CqEc^R3HIBo
z%fi;4Q+3=^)${M;lDZzFD*;iv&ILx_iTv)l>dyRYr;D~ob4=XzHRLA8AD@sPMk#k+
zF<w)7uKQ|+M{|zx^mB*4+EzIHI;f(zyyCkg%R=w>zb{|@-2LE1%KsnBn-4cH?w50T
zuwr>)c5#Gl&Grqq|NMCIyT4lg|F?!`GnnpV{rLFh3)5uRi~7G9-=4e|mH#igLYS?4
zN>E~KRsG%HmHIy(emR^NT^~MI-5}iiSE--U%S~QcPqkxoSG^CnUh|{!Mq{XH=CZp=
zMY?QPZJnmQUS8O-YYn^q1@*f761S?i+}q!|eCOL&8tra2n&L-|Kc2pKTsXj~><A<0
zg(nFf*PiJrR~&d-z0oR}ZJ%Qg50}^qpT0K<sk^vC`zr(a9<Sg^5eha6h$y(B>~xQJ
z&rSyZw+7BiRgGc>*(-Hklo>2_nfhbfeVwS8;<c%&CH}p<2I5n`Mrn4<+AhD#@{yEt
zhEksFmsC|{)4~;{GQYNeV%q&_@=YOa*=E0s7tFUmnLSfo=7i}CT}z1<r8aEevyRWY
z$k*#1!|+>#;n;Pi6qo2dVY<#jbtP<O>QbAoB`?<RKI?n>=_y;Gyi;bY`I+UMpWp2^
z$U2+#Q)f-y3)2a6CM6fEmwn>fURgY$SNF~y9iDgghO-Q26-+Z)&OCLJdt%<q9`B$R
z%dEFNvD)hP`?u9c<4C(_1_^JkDJL8~QX7A6?VMiqmDl+HAKqkBu>M26?8AlqS$s8;
zC9dnAT+q)|i_DXGHYq5BspYhIxaqyN1jn~*zi!ue?o{_)o!l#WdS&w~?hD6LmTjnM
zTTmV%rWhl#XI90mxs&Z)lrAo2ZCBu#Bln~0>ihSO2QyzXK31RpxZ>~c-v$$+suo^f
z<QAW}(qzFjyBlJke(w$_cq8}E_}r-kCKE2vpSxu$uIr_HZ&`jKY0>Ta?C-PHR~)#a
zenV{A+Fh$$I;0Y1x#V2E)qHNRyy@q4%aqrY=iPoYmnBSM+La6+H)mZxFk^Kqe`C<o
zV_Awt{LO)>3yT~I&N<wf!dp<~{wj9EjC0P_Uw1AIxUKo?SNG1T4bOC3+TvbUbac8T
zKhoX0RB@v2gXsrs(?ae9?6p0&NjK3!H|Q+WQ+X3tyFwTL2o+P6t!AP7y@lT=++ViE
zHRx$+Y|9t7dHw0t;`SVM^ZAy2T(J8c`|;yDKYFW6utzR=^x^v9JHET$STwxcE2k11
z;C5}-!M*$BW)!HN`o-&3c)sbcSlaBcRo5d{?|)aDGJEb?i`Dzm_MTs6o$~j}{prtF
z*nZ3U?Q-eB<Zqo(X5U{XUQXrz`^=f+4zus_t=7k%t>SJ{tYvoHwXd|aC$YM@jp3N`
zPv>7LH`dmkvbOxG{5$l+>{@M~KhD2WZ=AK$-hE2`^7_>6nO}MrJ(Rzye>m^kO8@Kf
zmsT>}dvkTqjAr90uO837fBNt4rRB0*d1ro|o#L){J-^(3mCk{4w+o|XPBhql;^X*r
z`k1g;%nj8iGqyE8T3xW)G4DR}Cf&8-J5Pli2wZYV<BB!&4G)IcP0IYwAFrNM{Kk68
z_n7Ms_TInmzHX!cx$wu1AvYXu)@p2EzPm6_p?OtNrsR98qQ{q;CfL693+g!SP@}A8
z>r*sKWN}PV*B!w}M}jXsE#G6k{r%hE26m~tYKb<QhWwNK0?x*Ay}D#17?2^d{CxPj
z=l{L-98`TP*3mb|>wdDH)5f2>?=8?>61l!7?9PYS??0CAfAqn@EheXY>(4bBT%XpL
z#?7nI`lnjBKP)LAcDM2z-7Ox<al)KycF+5s_uhG}kIc?3yKe@0n@@OQEA>snN2oUY
zc<8Y%z1LfJ?UQ)=<|Di8T&WHI$p#{FkM0%ijjGOl{akI1K__q2o7ZcL*37mK6^+{X
zD$nTiJBd?L$5*}giv7OkF7r0NS+>o`*tVZv_|{eEYxRMvA3i({TYLERHj}bDWolp6
zg?~t&QMgU-{~~dg>D_<WxcsMToK5|vs(R*lbV}l9M&8Q;+1lG@oJ<SuogZr;tsU*f
zz4nXl-TP~%-9KCWT+1`<RbSP!D}~!a4zHiQ*m**lrSFV=Q+BMlXLh)p(R1VBe|45t
zmPh34c#nDf5x7?{f#<owVzD{S2{J*a{JfUR1+GxJ^{Bh*NK1gZ(7M&%1HPnXc1hp9
zoNLi(=9k3s=tEBAhv-{ZwF}?LPLbOy711BI`(8Wu(SriQEP)T(HXqTmy1LWvIGctK
zqmujfGr#A_Ej54Q5yh^xEa%ye)h4&U{##qfyizXp?h($(rxpY*jlHe5<7&%SsU3@}
zUTFLf)n6NX!@J<a_Q%X`@9^%r{z&oqdYK*lEnbmgT1FeLa$aXkQ+9Wr(G(W_AMKC}
zmteh}(QFJ18$>X69^@t_XJqE3LXUvi8u2>swwcJk_sbtllHX+Deqz&K38spSSxcfX
z+__+}`v5PGn^o7%Q&Sv+JohT_Z@GSB^4mF!yIrI6E-fk!v{d5XU;N*rDmo@s?(fdx
zRY@1b%KU^b_$}o+v(IA2=?X6E>Wg{#(K63Iw+5C6tA8u2|52EpU;bWQ=JL4}w+}r%
z#x<SWoYnBq|MY}n-Dhh588&{t_V0K9gQ@Db9NQkJ&69o^vaWjXl_$oAGnce#^Z2Ma
zoh>-Wxw7<K#F1~S6t~aNu2o+my0}W?T<NNJ&n`t6e2vJ{zOdrhtWc(_A9~K5xsq#p
zHch_1D={u=NswWeTYapYKVQAIT}^e-zt?sC50=NsK4%kpnX>oSshQlLs~#SR^D@un
ze8!WWz4I|onnZG@n7GZy-DkKQf*<=tY4fF@TzTn(TWZ0{W8ZGCb8Y_<bgpHoDd!Ri
zv!zpK`}`8yWFlg{zvFX^v!(z1+>h)XD%Tr@`Gc$l->{49>)&wT>C9Q0>}d)`XXaN1
zh_yKF+;c*xFx#O{gg^L#u1@#QWh^%yZ9BDbMeUg@?gG)LJO36XRrvemnM!P%u{b^P
z%8k1biS3UQB<}FE9O63o>V(Bt=OXntrvDa&a{jgw&~)?i_IYZj_Bv|u2a6BEf;<J!
zSS~)vWy_vyzJj}Cj`|Bh$0?o@Z{DyfR&G<$h}reI_<*CV>+(}p^CFL3V-Q=D7n5{Z
zYVouiy01^qsPQT`UOi{Uq30W3emJ=6#ZuAF%6@S=n|sn0>C`LaGTr8xoDtre`Jt*b
zc5b5f@6xR+Yr>pvRoDoa>HF|>W<|c7E~(pp%IoNfwbP4Ucppnqnx_2PGRW|?WKM>_
zsiVmTMyxCveeukKdnV3Y8vd{D(?Q)Z`J)Gp*EPz8eYui-!N6B(X+eVLHmA#HE+3!S
zYVR<g{pqq9oEK{2_UW`H1_$40e)-GkS3-`ARQt9ish+L#Bn-Sc*Oa%kC@*-v(J({H
z>5$cuiC3=K9sGLvflpdU>x7QTNclGlDpH#F8~ZCw{V`8qdvO%!UX9Xs-R>1!hvqHM
z$}IgVe#`EB3eVpMSJy8WU(fHS9xi_UJzu~2dp$k3^-W>Et@><MR+Z&-1!X>~i@Tpb
zTPC<pz5BF7`@_#WGefo7%bP?SXTA)-#g=-^I{DqlkLKM!qb#<wn)gbW#}+j=9kb$*
z%-zDR!mOL;C?d9SgUQUjuCd>E`SOx-)0bcJ)0$a#!GV2Y{=WP30u7J%^39N4#K~Nm
z)KYgjV$-U%ySJ^~zo^$o#Cgdr)oWEIn#Nw@8}ib5t<(Bm7+u<SqP(<A^1PnpTUMTp
zP8DXy)YhBoH@7Y3?*AC^uzTgZlijLZGmkoaFxw>+cE>DTtTu)_tKomZwCh|focFBj
z6SQx9V%;|Fb9~_W@0T=gC9`gRs(e_WQz2#dmBk0%Yun7xnEQl3EI|LZM%SK~m!2p7
z+`FXl`}>XmKX%^Ne^H*<>AmW6d`PZ)Plv+P!jx!%X@Ri|Z)+{65K>*D;hcH<?CrUZ
zTwd}?cBg~RAIf<rc5oLT^ES=I1+F*BJbZsFF?wmf>-cW-xp$tt{u>pSwd%}mky&rd
zI$h5l(t79oW6P{dr{-+m@Pn&q&$S!NSC|Qw8ZSKMG0VDW_u_e0I?-E~XYDgQA6%Wd
zz`CPFYG?E^yC+jEbj@C#2=dgN_5H-IM{(ZV&n*s#T)zADckZdMu#K-HUb2`7{FQpy
zWv+EB>gA79Zj<^gTF>gpt+Q5;zWvFDd8Op1+Y0l<H%A-X7Z8vZV>V-5{jV*>_}#H%
ziLGAQ8M4N9>pvcl*!kju%0`1@v!$=xX+3lO2m4gb*Go?=b$3+ycC3B#3La0@)4z0s
zKioQSJ8*ONDS^zcduiQ2m0lFpiX1(`_jf^Qf_vQ*{nGDGcCMJVccagpv)zw7mOqfR
z5G~g@Vdq}9M!WgS&$T)8Vh`^(`O!UNcOh4;Mt$Cc$8A27`kLF``-UxbdbPwh=hQ>q
zY6r>fJ~jGhK7WvWwwinX@%;ge&lerO>~i=2{CU@of8gJFspaykP4E7Gh<aQ)vyRts
zl6vt=b=d`%^$W8q9ac-!Iq~HGjxSLCd+BxD%gEyF*!>#Y^*(EFpL*)=)W^Bk=l(wR
zl+7$|hiTfYeMMJ)^DcU-Z6!VX&aL#NUefBmK4E^Vm+F;l(LR&wyd!f@`Du2AU7wN{
zUc7qb^0um->dEFSGA*5=_FR8H<qz7Ob$SkZyC(=RFjSjk+*y~KoS$0&Ig#vabanCL
zZG!*r&u99&)LColirv}EPp$|RI=<68uV}rcb*|O6_C+26k7PX!STv)*{@7h!&NxBA
z_2ws)%xdFKPaCoByGQfoTjp)p{Qdr4o65N@Hq&c9X+5f(dW2Iy{ml}NL#Fd>zR#1h
zO<ca{#<Y`Ju^XTJ&$mx~o_+3Kfo74|M_zx|i3e@MJ}OvSb$L%Tyx;$NmEO+xn^m-3
zA~!0WcNGokJn{76#g899cJI;J-s+JskLUD~6%jgK+jtK7+w@0lIMupl(u7te?MYLr
z4IaPnm@IV3rj|wQO!3LHlkb=@KiRcz(v>}-x0OzY>r8kPvr)3k<f)=z>W`iZnJby1
zs)<XFi8yZco4oX8J^%Wu$@4N#2W@<1zOW==R-Tw^`o!`tzm)I4$}_(8WpYmZot8Pr
zdT+AJE!pwGbHzRTraONY#GEwr7M>8ir**s0jbF1B*8ZH~8F#gH|3sVnD?~FIQ|B(3
z$e!z|S#&94^K-5x51xDeGkno+p8SF}L|}9A`#<sT<9{r--(&Ij<JH^m)7^RgN$O5t
zt)!u9Z^dM3bX0iD&Lh`*POg&Kcrx7Kk?Dq7#`WP@Rh&H2e_lwta%G|t$9YeYkUQ#m
zi<Xp}J=`PWeB^%Doa|*uY;MPAIp&;_xpi}i#$?_Lg&R~wRM{6bvi~o3i&Oe5p>s}F
zQ|d_U1dn^cUDDReOCuMFG#YjIPl=x95oHkYDcC4`cY01?cErx;is?HquQB*>zH<I2
z2C-?Z{Ek`<)4tuGlv<E<sC2@5i`5TY;<`Tx-zq=tuNn~~yWzrWu1NkM%?QOMKGQUV
zc(jym-)7z2_IdLoOMS-%!QFnVOl9)aF1>hIIwitv&lCm6{+EBJ-kHFh7dh$hssp|p
zvGW#-`nx@4j+nx<H1Ow&4T?|aSKmK)()F~IwD#e}HA~;}B(nUU*Cn%KMZ$TW;|7e=
zgi>mPIyw2=53=^mtFoQ6)99qLU$4R5CrdtB`PVsWZ@upD;Dh$U9cjhevRggnxQ!g8
zj8;Ba^1-XBBdag>fUK9?e#XA1jNf+dc<bjf?Y-EFmpY89&sW=Tc>imebeD}^Si>E`
z+n-)#yXSUJxudGaHE*{Kzbi}2Gr!oQllA8cCS~6-Qajk3!uUpZ`;(<g9d{&5RxM$c
z>h<W~{5Pt3rI^C*4*o9X5;3p141=t>WwG5qTBS-KK6od);Ky>y%emoZUm}A0`VN^)
z5bEKYeJ=A&^o+GHj+f5*<-t=?JZ09jgjIW&y_2?(d(F#wbKgm;zRA*G{dhCp+j&^7
zthqncruTT&axQz_mrnE3H!p76`q!1~`AL&%)xEpVosry}zBo<fMg-TYCFcZxciGM^
z<ulY>^mDnP`1y5K%v*XdS;!xlY;fwhWS()k$!*5A+8I($rt`fjQMM~w{P5`7svXg1
z9xSOnb+j~Z*95CaS(~riJ#<klt=pmS-<MT_hrWDtx{zhOq>Md7_l-yA@=5#`Uh}Y5
z?e>`+$b0?X<DJ`bi|t?c3d)`OqYx?et@nt5{+WucVu9HgVowKT89zJ_)UhS@F{kxO
z1GXL)jgJNMyL7lec~nVO%r-qQ**}Tvugp%)mX@@v3CkYMT5YOQP<A`<&O>vXHLDr+
z%r<`aO=Dgy$H7wz?!5c5j`8_o_9|n+tGincM};Z9-rl6ZbTeP)^`84*3^mp++b#A%
zH0|O>7S7UbYh~2t@W#su$}?NB-a3^nW$^Ow?HQ$iU(WdYCs%&C|EITC8!jJxruOgB
z4d-c128?&Ut#JAvFf(y&C~tqQh01PzyQnoT3K!?@2+(<DW3*wR%F<fH8v*^T+}ZB0
zrr5lEZ!8q^?11Z>1hvWe2mL;aHds{L>`&m+T5;$AyZi0BeVa>mUuU+=YAIi8tCF)y
zG40N)b*nBMk9)B>y2<7;Z^R{`$5YHwK9;m+r!4t#m3y+}BC)k*OsC^!GtDfEm*qRV
z?~HZtt0w+mHPt@J3cHnps}#A@7lkRQ-wh~h&KGchtY^_*aph~em}_%E+3Zf0T{BiF
z?zT4QoOA7Q&E=zcy2pNhxUF`_!oWGV;ZCE<_uQfjyWeL$G%)fnZ(_Orc6RsQf9?C;
zY!F>~yxW9h=WBx->mOS$7F4md-m~M|$JY~;_Pv{X^+wio<}*xFS4~_pnS0Tb2Pa|^
z6%uZJakFTb`Yy;S*qczTX)%wteaEf0GW!Gr4n8R|5wLRX;rqA#+1$Q&iH8)f$NgAU
zoVWYJhu=x7j1+RG&26oIruq76m$%mBGjEt0o0gZ&ZeXnV@cm6=*-e?-zt6w=|CRBt
z>GDta7DpH)&*<Oob|O^tBcH48nOgO2+JC}M#|1d>aY`;UPQ3SJ+m6|H!^*D}WUt_F
zYmmH@`mQ44chTB?7xOdrJ8o-v5`JaUoYwCSmda%}JVkEK<VZR!q9Y=hP&V`aw`~RK
zNj$RqOLJy0Wr*%tnbgr6A0+y`&i73l=a+(yYaa(c=Wp+On`C`@%g2KPvmWo<YkF`!
zSH*jsAAwFcc{l8ume<DkU+<>jkMdPFO5c{7moQ#$e397peKGrQlbEfJTh?(WYz%$v
zaJ?v9;MnV|<?UJ%SR?jc4sV(EqcV2MpF@*u+~QYp$t;<>fXCW*D;EpPG6&NM+Z<l^
z^>mb)t2pMKEPii!AlYF@kE5pGrykR`2@z*aO>g^}C{5X5yQ<TPDeI^5jOQO`bDjUt
zYHYdn+dI}v`Yk?rcP>tid%{^Q8vMZZYfMU1(W=dV=h`0rCUYo_XV%88y))Ne_uRpD
zV2#Yml>)DWAFN<o+2VO5(Z``h>7nGitz8V-(}WDZy|kNWZ>3UjU9Ml|`-y~yr})hZ
zw8H<`6=n9%v0X3N;woM>?a;PdmF0mKXXfPmZE!Z<?7@^W!EMu`22};;G|6S+-sif4
zT4I{+Zc<oxz~#%8mA|YTcbZ=NpE`e`?Mn8gnV;FaHt6yN=koPmkK1H>@osxX?ULfv
z7y15ayto+{J>!#tyqI3;*9#KAj+adOc6h`7iTgQOnkW8=yCB_g>vWbxU1`wW_JkkR
z+r&y&P1-t%z2M2UJx6v)ebJx6snuJ$_TV)J`{t!L3Xb1+5FME2@a=v|jeO%uv)#3a
z&bh?4IpoKNw$AZg9&zjACKZ-{t}&GhPb{;Uf2C-bXNv5SO{*5W_!xW6p1ba->9qSV
zQy1B_sVrPM&3{r26GQyuQ|hO60~nvoc(GHsZgItnXBw*QDJ3tb9T%Tozvs`JPqR<&
zkFA>i?&*o0R?B9j+DtgnyJhW?eR?c*db{L5xLd8rdT?ig*-U5g-0DcN13t!yS>=5>
zv$x%9kCl@6Qh$E_Nt5F?^4?`@ZNgSY>^k>cuEgpWPqy?j3&~|YH)_t!YfQS=F=?MS
z<EAHbB-aMBo{6}7y)Tlpm1XkmT}wU{iT7>ed7j1IS1<h~y7_%`@@2WK4{3SqKi^qC
zZC`x1)-Y7xP{u8JwHKe!i=w;wOKw;kIK=SR<bgvkA6u-|G4?lBHy&M=XXH&~mRvCR
zsGHuI^4j(8-)qip|H8}bV|?;rtS5tKr|7K{86mSY7DR@-eln?OOxye-@M=wx+kUq9
z-5VQCy=zbSbVf3Vdg^J*z1i^H>(ni$wV^?4U#l(*ZI0#jP_+p2`~T^v`1yXTl#)Z&
zr~fN>WiGR8@9D-^lghoDd0h6I+;0_Lclwd6>dH$SLac;-O<r};NnhRi4(Hn$>G|Ou
zRn>2{&TekHQyZF8BjKt$Wy|x&6R)H!JNI_(cFz0{cRwb5ahbZC|KM4B+0a0_Mq%BA
zeeYkl+w$h*7fh2&cWwI>ard6-o44Hha)R&Q*xm|X_U2Nz?sua)hbLP$PY>o=xaNah
z`Y)XgM^(7<{JMXMe7c>raG%`srl+ObSaMDz%u6}0wLCE~(7Rw4hw?9P{aLx~hu++L
zwBf)$U5y)?^WS=wpOd?}rEt6H^_#sn-_F>l+F;(W=k<b?8KqCH^0&x*aAr6f!s5($
zc&G4WcMk#Yj=)D+;;KHM=j0XsJ)qK9H95=r^dy@`jvW6>8z#=}dB}WTp(2^}h<Zl<
zDxGtmdG-1vXNbJ|=YH*W=e#(Thw5dYpT<WswK(*;=go4Q`rqf1y?wY5`>z8NO~NNI
zcy_P#OJ8_W+vTCv`}p~D_SbxW*t<CCW21nqzA5i9BlCqFKmIG(mS?1jhTYH#*?!)p
zD1M#P-wSJd{bt>pB-?zu>qgj>C##xFQtjtE-M@ZrMeqKZp06)F)O?+l|Mr50K<$oW
z(ZL;zzE3W#WQx%+Q=BxT;Z1^KpW)sn<w}n;B?X_{6H+d)hy>emIDgl@t+;B_Zs&kI
zGY^QF8uHBlWjudFxy1RH#mk~{H>~n`V3TmRaXCZsTT{(1nG)qk94DQUeNn1r@A+?9
ze0{g``E3HlDW9jSuRkBh!}0ClCDt$RSH{W2?R#-(+SY^aiq{#u-Zfkkj;<-W&hzO^
z#_771!V~7p*{R+1UBIhwqQ+I%YmYLQ;}%zL`|H<*@^5-3tPm|>oOxK`&&5YvjK2#O
z8P(Z1h#skGNp=*uXd4);Cds_uqOa*LMR6CAuW2jlLu}##S+yHV8@hI#_WCYnSN-|X
zo4dC+^DhrBxgNapS*BGc`{|XtlqChLR<_0*T7Bu*I^nzSg^n-3<XOnc%O`V2-JfJC
zn0RB;yRF+V7VJyczn-S*SIiQ1`9bIg&Qm*!>pngFE&e>rzb|Qy_55hxTgB%mZrmnn
z7IUCxE?0txpLoE`tb<dUpNMns+1J1nzVKpC>>hi|{|D{spReA!Jp9%A|KFaR<@UFq
z|M$zMr>p1dr~MLLza(zvfp7oz`l-E|vb~3`WNq0y4+k%f6Q^$NJGQXQ@#47)r5=AL
zCj39N%1Ej(^6cE#9CBZ?_FC_)wl`hz)w<lu`BzA1q;HR;q0_cf9{C%#*K8cwxa`|p
z4Hn#7o-4detT>|H{o;?_*wzZAWv5qsa4}$8!_<G~=z~Ri9~K$(yWR71v}k?2=F;!<
zX-gE%;-@mYNN`r{6@3!%$#G)zZr`hUxqp6%?(S<m_h6rDqvb&rV}s5Q3%*QcRnYsf
zUcb@(P4ePz3mZQbZmZrVc3sEW`{Lz~(jI}~{gL%fS0mQQ+zxYg%FL^Lf9n0CRp+}K
zjg7ckvj6N>c*On8DPp$Tlnp_LZkN0`@-<LscFvRcN7warwM%U4lI?#y&F0GcqXn<4
z+bfpcW88Mq{@}sA_Dj_IS-!26xpe8&tKQFh`=)TP<-Iqby7}&nzNALmi4O{1><QSH
z;Aku^^-Mg%eAgDPFr$+WC64D@buX`FJiBz~+a-CL-y``;1q(9&*Bmn5FS9_gVyegA
zCrroYRwpVj{{EPzJSS#WpFPvU;8%%{oK`$%uG@XK-!Z0rnf2mt!EIli`L@R<T<L!B
zz<#=1nCf$dj_~~WeX}i<9eNh5b7>2gRy=c8C@km2wSTiW*Uy=?Vqwa)d27BDp4a7(
zu-R>H-Lz0^nbOWz@?XyIPivfaaW$*@B%%2>Pu9sftX^rz&fyp;ZEzx^E~(|==8cug
z@7rScd}zM$xa86Mjpq{I|242lTN`=#taxx4^S{$v&CgA<c70bZm4CU-VSm4#p?CTZ
zgEZ^RqUkGYUT7Dodv(suH)ZdRKHL4Pl2MH>dX17q`0;7c+b%rY_CX@W@tVGekD%D;
zx=p(0XU$r(@dW!69x=IVKXx7sDqNAr_xcC(`@QD&bBY`tZXN0}{C$Vra;AJ@<@=A@
zdH3-oy_+PFD%yB>PILeFD~q?Uc|2qCUiUpZzWg?3whF&2=Uwspx#+_cW~~P=>`~A2
zx$<&x>oj2ohEjJ124U3md~%cX^U^@aM%%nCda`Ze|F0rDu7*xb4!&~y*t*>-rQ_Ew
z?Oj}9A2MyuZtY0dV3o8svGy4POO~9RC-)*w*?-zQHisq!OQ~G5saBTSXB%F)E#AMI
zF>QWq+?>DP5AN1^*!qP1xu*WAoOvIMPTgDcIOQb2-=W2OYs<8*%{GeG(Jm`0`Lmn(
z$5-9mQAOY8c?WKoa{qJ8nsA0QT5{{H80!DpH&|Bk8mQmj@OjZAOB<c*i+Wc3h*Vd9
z4q6i-a`yEqy-JadIjrZk#Kc=yWOUuReK|Su=xMKxm|2afI@2r5viF@zjZNM8Q*BnJ
zX#E<wQx$h>?yuRLbTH}Ux-$VvpXR7nSt@CoOu2I{a-LOkr$(hz_(o%$Yh2FdQ^dbV
zYI3FYe@<zAbC}oSaAe@rL$YU%I`JRfWVARxrL^uFv%bZK;3<qoJ4A}sZfm-ucU`sp
zzSJe1j05+Zdp0-C*JI6Sn77zGaaqlh_4c27zwS7Cdv2=!j_GG_hE{yF7tddO*?y1h
z-;aL|^Ix`Qvu|<hRA4&T@aX30*eQ#I6nJN4l`M=|^El{}t(4EF2(PkV|9sYJ)++aW
zD3Uz9{F~>6gxNl#I{zlvT;>Uh2}?De^~6R`IOM11ZqcgRKat0|P1?^z@E!|tJ-}(%
zYP;`rN-6J-yem?_brhebZl4qTSF=i8tow)AbH*C~M^Qy#9gh^+Vwc+ps+gS&I@q8z
zLF!V=u9+Q5o!W=KzkAI8{+#`uRO5(O&zZipX0tBge<<xxoOa>BuitN)S0u3Wd&g~%
zDC^9M)62SIn{ZspjFaWaPLUr|LcRGG3H%Tbi#eFQ>13_iWTWQ08`mWK|Ml<f)8qWp
z?dQrV_47ZS^!%rzb)?+8r8Rvw7Nsf9U&8A1x#!6t^ItbvZ9l5Ld0?%u^?{eF6z8-W
z#xqY+Tb!6|Uq77lMswza=NICxeD8_b+aPM7m42`Okh_B3y3bk9TJMS7Xl@Ss#~?EK
z=NTK$n5TiE*X|tpQk@{rFBMx*-(dfGW_i~OiHF{f%L<RqJb&2r#Ir?uK?k-zW3{-g
z^0;Wz+zn1L6S%&en58W1GQH*POUv^UO4TH?)C!_AXRlaY8oQ9|h}XsKmp*NFb>4GK
z*5vedvBbhxzn)oE)jiTK<mWn>QoCF4XugZEq<&YoiMOPS+5I2i3;UjZTXti@uLI0W
zZ69P9%@jTGROz9GwnFw?pV>zbDql@)6!=jg^z2dN^nJIq&a*!#zTm_i*Yxq=zC9nz
zCyLg22bwWfHu1YyJ05x0RQ&$e<eFU{Z?z_f>7=dPXL{TCbISjjinaOq{=e-5&)m0D
zn=|97^nSS@hrDB7#jY`2U<^5Y;;zQ2t~Fgs@t<nsH111CKF=s-kZV61oX|euq1C!+
zi8b0E*XQq>ZgVbk!AzUXn@l_(Izn1cIq!>=J`r8u>$>MrUHMwi2Re1eZ#AxJq<+Zd
zxO-q40|)D++D%>Zi(4Ko>M81&7<jJRb!*Gc`*Nk}kF*3?W~zy0^w%;Mug~9A?AZ48
z+~l*Lto_)%eNM%yAFq_#>gHbfX3}Z{w#^4;9JI;VDY-69XvPhX=$p>%2OGsc9^7^2
z-NE;jlTXe#kf8XB`<uk_#YI^OOIDn2$=2My*;#u(m-vI$Tb2J9#Duet6`Guk<qxyo
z*0DrG*<dH{f`ttmuFu@tuXA|CsyULg(=CtZh!!z$ocSts;j;<D<70E3<6bkw>mGD}
zp_3#jo|z}$`N`Z+`$zLzqt&TCCk-sW^Oj${xM)J)na!+EZe-r5?BQSxbr4>p_EUS;
z9izy^7VC+MDUY;YS~p#tb?NBh45!acQ|xlDbl5l5CB3?KZm-=gNrw*mB;P-?4by);
zc+$?(6XH<tNmSxRawRt>dqKKgPn>S!Ru-Lw-dzEDkCW^B-syZ*pImTK{&EiE!gGO|
z>F=e^?zdPXcfV)7&+7CIMf$DZs)ZIDkYBLl*vfz(P650HvO&g)zrQ>zby~V?Vwllp
zN%;xfljH5ZPl~DTVoUg9+B-+&^RFMf7&mVAUo25uf5nRN@q{z4?in0au)PxE?r8dZ
zo8~!g4+9&X)yK2u^oURXz`FH0>#WcGmu8*c9KYx<_l*zJFNFV*ynb`~=69DTA2vFr
za=W4DN>2ZYvXbD#9L<&8(sRDw{QaZvaFJ?wAnPh0hW4K6!2tpSSG;ui7g&fCUp>(9
zYU>9rx7bEYb_XFvxBd1`Pgi93oYOLC<htSH@*$n^=a&GJm+gPkFZ-!?zwl<S)^5mH
z6KIsMYsOFU$dA!H^6wS~E$EUpT9x<y==?i8`eMgi=j8u8G~d%L<CS-CzqW?2?$(0R
zbv?!!-*+!PbjNz}E&nOf-&Q7G5q8a*H?bo5?)6~Ls9Qez8s7~(+aCq~o}pzHBl?<4
zYq|2O`p(6E2k)CRNgp_*{P=eu%Wt2lo4wx@1sq>I?T6uJ*X-vTl6y*KxQT|}mM{`A
zTVmp}d+Ny}N^ke?Fzap?nxwjk?WiA@_%cxuap`FeZR~NJ-38i$chU_bgjP&@vhvoP
zNt_*>_Meut{h2sH?2q85{W+}vG`K50f^}8o1M&q|tm)p6s{Q1dtLV|nZ5kC;$L@!(
zkDI&lo`A?-Q;~HntTKGJQ>Gh*N=-K@UU-JF<MLY850Zv|{MU*Ym~6^w_I$3@@^+I&
z^hvgvr*gFe4@U7vb`>U^>)UVZBsSH7SzmS9iUXH*&P#rJ&ln@JpMC1lt&AH(&61xB
z#EAV-_EfIUZ?q5h4%EM3ojPUCx>qTk*@9dOA|Df!6?#u^ar~BV#_A#bCpI<Vsso?e
zRtLw6P0o3IH~Rehm|m@%D&XCizE&=5)nm1Wn$RF7(Fet%|4ptZY!z9a_+rzJzhY;Y
zqpyBl6<`x_Y*jVWsd;BNyA=8gx}MKZ<XsUfS+@Ur*)#r4xpu;bm5+XynYSodF?E~d
zNuE2`WxS5vw%9rQr^2KLSzom>uD()r2j{DAZvWupziG~BZJFh(+@C7?()Ns1w!FcA
z)8AbNjb@v!Pm8;f%Khl^@rIlGbLS*H|91WT4MR(}*0S}BvyVsxT-cwIy+8OQyWd8+
zFRwlx(A+uq!P3c|2Kn;hk{r1re;>?$&#TfDVAC-7>fS}4ys~r8Oj{ta=ZKrA%j<ak
z+d&0-N4{J?(8!$rC0h4j-lL{1{XAhu%R@vbm<qRco$}M|y3@kjuq1QY-j%N(zYI8d
zEyw5Z+g;Wr-Yb>~&b#*GM|M`!{l-hLHLJ=#1#fA)8ht#?ef}h)ItN~6AH{z~zgjFz
zuDH(EC_Q+b`JoK|i4Bq*{~4_!6j@3hWK1aESN=9L<L;@=^;<aIW~uy<dZaHuf#q0%
z;@Qc6&YS88t=yXS%71>R$`uy>rV~?VHf&n6YU><1IlYE?zr>WTzAD(um>w*%&g}Ks
zL^V~Gy@wyy|Nl0dvBx>5RpVGFFTYe7f8Qk68=T!rS1lHVy|`t!xo}Imcpty|sac67
z?;54Q+Ad$s`tnAp{OtLxUe7u`c3z!t`bR$C#K)9caVefhijsRhgFU8QwLBvfoNQpX
z#jHzWX~h8srJL(xTW9?7I#<mgn_64MIk8uqk<-;xz~PvoNka6pe7051J!@@qBI<ol
z{TBV)dzn?l;NJ5qy{~HvVp^wiWw%IVG2fUL#3))U)DbRf>v&dhS!MsP#}Aw?_?>Cx
zI4mZ)fz^2n*Yc@OlMje=BtKXZDD;4dh2zH2<u+1=jeB;@h<+&YRx41Hb7AO0$DlUX
z2Ak3gFO3aLo7UzEA32(5{$u%Vhr<gPxi0<Ed;5dQI`6BDq8!VYhCbN^$?P7i3+(Q6
zGM7I(kT~O&^WL%ran=DMN`Z>AioXlA2uyr&K&0S4<Ko9cuHti9RT<NEShk*%JhH7(
zOz|7v#=2AMH%oIF{0QIad&y_ETE(RoshyRZ{_pnO|Ni=sIqNxg#@es>yk_N+#isge
zmu<KEY;b(XtDLJP8TYP>?m8g<vu*jR?M2g6uU<{_ZQVa>@iG04W%BP_ztw3}#kO{M
z&3$CI|4whMn99PUnfpW-Km58Jtp0H)v&E`siLVdujS)B<dt+195|eU1!4G>bY(Kc`
z*OC+bs_RR5ug#QZm^k^h^^&j%Yqk4J6{1(VRTy+yt#R#Gm66K5q~==r-0hLdQ?{Gl
zXV03S_atc5znmwBGPSPG$P87}TbYzCI-NV==k>R1bX#|S)4V;AXTDSGtCVROWqiA5
z)m%HXkTHGI)F-ntt4_?k@nm0`6mP_~cBi0MHwA@Pt`%dbz4mC)<XG>Bx1RaoCadPm
zF6D1~o14KiSMzXm#@CLN-5QohoRa2D`_}e+XT=5X7aOC0+<9=>y09!ZH8ihevfb*(
zSN_E<2wU<z!cy^Fim<p{@0KZ-nC5cclMEL(Y1kU}H9_L?Opmr>|62O@<k||nZSa4+
z>4-=;BhSYxhw2m;Y++r#IPG?CY5VRgPTBu@{fzHi(7O1->F^W7FYFm=GmcB}C`>QA
z;IUpdbLsWIm8vq1URPZ%ExL05Sj)}rmnE%#Sw}9Kz2qs^s+6@ov$%YoEW4M&E!I9o
zc>CYvU#Hj2t6Mq2;!W7g39KLUvv)mwsd@2oe#^FRPj8&8i*denE$vm?lKHCo_578Y
zu|=+P#d}O2Y<#(Jj*5%tedm^oF^x@S+r4iZh9sHI`&Fh<dWfk|+EQGSTXdoEvoCGm
zy%h~Q?zC>~`LOx7%<umX)gJHM^^kStc3H2?hJYT~$Gd$0J8JFye}YRR%IM9ri%a*0
z^8ENBb-&WKYfXb@RPT$8^^5qL4*R&BNHG5_p~$w}?(kMO+mZ`AxkK-WX@zLkOYYdw
z+-I^S{X?$%f;FuCC0kcUgfq35#`wMvaBuV3+te}d)^+V$t}@5}2ux>{?fnv-Suo2|
z?%wgz>Q6kXhaO+K;+*IHpK+D{U7IJFFG?2edSRb5!9ix0+tbBYTUliCO4jSHnkCG5
zcG}%v?{8aPTz<ji;<sOmmp63?PWT=!`9$Oz+ilODShE=8bqj6(&)l&ud%N$A7yHe9
z(&PRgSrFQ^=1Q0J!dqUo+{b5J{BA#g|8A@Q0(0m77pdK|!|MN!hnrN_HdUQr{dXni
z&R5&GX^U904s`b3Ke1Sz+apXf)c@X-%nmOOf%EKbc`p+u{*=7%;;@~3mFgv{?GNJP
zoFl`J^!^F1c=LFDT*eOhlD%4|W;}J{)^91jx-h;ma#29)<=S*ESs~$7^UA&y-kc=q
zE~cj_lj*k3+wQzvJ74bin?Dyh91b>~J=?qCA!Dyk>BNnZo@XU&wby$8p0dO>?Vaw$
z-3*EOObxG-UiKZ@?tCx6`_it4wuvVaG}ctC)N9p@VSaOH{<3achlxuwuS@+ss}b$K
zh2_xVoh-SJZZd4nU2LFjGI?6lImcU)&(7Vxw(i98-I^=buRU(YwRr0)=M6#c`5(-5
zc^=yIfnQ#K{k*7m+U?)ZE3(=?pXu8D>{Qm=r+fZbpOl;&>wRNKiL8*r9;=Dfn!*3&
z-yNCSS^V_r{0;4TtQ%Ont#*p=Pkgk^`9XkU?{THW;@%TORj-`knm(7&Y~^ZAi@o2&
z*5$^$C}>PSWij>bjFpb}f2}uc-t$t$gxT8p<kz#M3j~V8zBe%%l%G^Q@c!|WzGT-6
z0sm4}t5<*E_b!_tck+MZ5s!Vws>^S!`{nd@mJOSo(1GR4PZ~d}ohVZt$tuaLsCOX#
z+uMhEA~NSn*{02}p3m^<<Vo2*e81lM7;m4gaQ}FC;4PI*>l>me4iVnlwQpHoEW5#d
z+=u!4{NByyv~JywI~0(=cfMNG0%MJ9dlx=QP;h;@Tk7?<hU5FvlHdM*H_0LQ{K1|%
zLVK?GZe4xH#`&N_RO7qXmRs*TezotO<M{Z_RL$Kpf2A87_vGIv&}=tb=eS8(^p8kx
zX|)4Rsqc10I+o9meNk;N=jA`9)p8#iLb*a`KM>Xk@k)u9yS!rV`)S5&1V6S^O!dsX
zKmF#;!-iGgpU=E@{K7u2z!^VPW^t{$+LnKK&I<8Yy{F>3v$fYv^lm!P5*njg!e0E0
z#cs`Uw!%lRXV$IXoV4)PEt$L<-(O8<njKf%So`r><?o^-y<<yn%H*qvPu<Cq@lJZh
zC;m>uziZ;V!VlkFc+P*(dG{HNpXUU4Y|PJ5=8fVhzV2>*dGcfR9|bkWwswd3)xR8k
z&ACkQW{1GBU_NHcWexj9ejQ=gpH`5Zu!gZ%q@>;CL_^<x<&@%weGvugx96sP;djaH
zTK__g_nRd5L!mo+%(~Wc-Tge{`A4T&Znv&f70<EgjJ@;BHb{8=<f&HmFRL|cmF~vu
z+19XT`yuz`uiyWgYN#?Li@&JsfqL2EqMZD{=5bf8-aWe&e)stE+bzO#Q)69jX3gcF
zC{Yr>O1&%5``6pcY2_8CYcsZcedzovl@=OhCp`awYT5lYmkMQ1CWxlxX>VK28`~>i
znSbrO9mf}m$Xl;xT>gE#vC@)%)1{n!nHI0#I!HuZknr`)kTsQ<Qxf$cZi&K8nMg*)
zyLZnB-G4XhQp5lEJRBMMyPLHhFZ92%$GpR_o;ByK*V=`58D33~km6pnJ-Fw=thns<
zz}q6hAD8|vbLcO5?%LtA*ZhIfLhe837@78JCuF=!aj8qX``N#3)z2ioU-_%DdP-i~
z2kF;dbV+J<6W)+LcS*se9q**2DwHqqZRmX-tk1CJZ@>kWIF$wcqCcG9q#C{Y>@TbP
zW^eP#l^c#PpTC)X_lEFiN8b9@#&fOMt-r~%-aF-HrT8n8-^Fti?M#nXJz#vlqPy$y
z*%L+1>r1xmjjO7k8<r^&U%e!-{$|B|H~p9YFDVqsR)^2*o%Qb1qKSdGj;Z_R2*u{#
ztU7V>-hBqtVZ22gGjCb(F)-}XU_iecF*hZ(EH$qTbT^{Z-~8LhzLx(L4Oe{;*zI!r
zW&n@W6~(Djk7XxSPn^CbfOVRZzgTwHlZqvxj+g&^+xz`ppH0xDxeJ+iy7!d7e|_(J
z=FH{U&ni!E(kOmdsS}l+8E0VcdFhb;B9n=8`|75jvYY%=>GWj>kIZ|&e%3yF9yH^*
z)0)kxBH`zYLd61e<}Gr1;yUZt)o)3&T~FG6R^9!&WZDUzXX2|Zq9pwC9tP^}cy@JB
z&!Y|JuLUY`+xLBa6?MX7qnXv@Cx)jkr|3?4G<m-JKP54RgX}D`YdBrnE`7cEK66Ti
z0*j98rQ0r^Gx7og0;kOUuHpLW#`_JA=T`?lV0(B{RKR5)<6ikS53W{Bb!&XFIp)ZZ
zeakC-I#-zJ+`I7DKk2qmf$Z|{vKM|&y1TP{{~f<QA9tVpv3&Jw`Sv4SOmROBHhVaI
z-tSbkbW71o@w(;3)t@Ur75>Wm^lz{E&q||I<!z5|x~+@(==#C#apW$+oiUvj%glfK
zJ!jqR$8DH0d#c9_`L+_PpS7J?EPGQneps4NrxP5Ldem!8<itnyVoS0k+$J(~^L*0K
zZdl#2_m9EMdolj@ednDLUiF;d%}S`e#(7j|W2LBKdybZT*t4hmE_!d@av{0-ed9$J
zjb4q6>uwJ}9F$PuY1MI?qodYSRKdum?zX)o%;BnjazxqBlg4QWa?Bp>U_7eg!eh|6
zz~i&-dt1l44W6IbU8nGy9rs+!asJ{ylPeP%6<B(el#^yYYkHbG=>eyu)WZpqfxmO4
zR2vh--|eivS3T?EhM4pN@lAOKkLugkGs<`y?mB%sedlh^N4lqr61aN)-dFt~WfWK~
zS1cm^{9XC_M*d?rS5M}6dHDSwc11-7!>2lRXAI^9L>QdVyVJdXQYM2{)Nj`9eNi=z
z>Xnc7Fn@}%oK?8<&}3t2iTWvyQe1ZRe#-fs8rrHENy3cRyJoIWw-f0<XtjoKNl|0}
zWd8hh>-5#-6~A>Js{is?klj4$x95*FjQyfAvjlGNRH+6C7S8J2QyDW=@nC1y9saHt
zfd)m9PiESL9=GM0BDdD!NniQ9Ub~Gmbw2I<<kNNPRJNPQX;}}mf_d|<7dvVxcqV8?
zF?6ujAKSsFB(uNSYmdoyqnBx)npQi^c-Cb)Wx439wy92CHP$&9?yq@PoXs%*l|IQS
z&iUAhXhktL)l-v}7K-G2yqh%pXV9fpY|M(XM-%ez9hlF}DaG=obX!UDR1Ud4TXZ&U
zDllQ*dri;dVCTIzZA`sqU+#2JJvB!vB;Zw2Uu!kb!?>31uQDe+*R=S5cFMjlvnDO(
zknNUelP_KNU|Xt!#@vO=Efa*DEiRtc(D-2Dd8<<Ul~lq6kpr;?-0k)IcFnu9Z)f%L
zx6(lpB0{1mXM2+tI5D?(|5_Av@a~#L2~P`Z{@;zS=)b7BJ)Dn|p>Oez#_f@3ugkoU
zQOiqTW_aee=;n229&xz*l76olHDg-rk75f^!3U14ENP!Uu>>haT;X~pu|j6X!ef6F
zJc`dO{CMq~T*Ar77ZGp&EjT6FBY3YUmgjcglDV(fwbWQ<%X`X)Eo+K9v-NbRzUw<>
z&Iw;4c$f69WGYsblX;r)zUWhC(O=G<>SOvp{%{_+-EaPXM$h{_ug&GvIQA7Bl&WVh
zt?1k@wjp@u*RW@qUF$X!tkr1VAW+feaUybYLec%ZKJTApc*^B`Em$8sce9(>mY9VH
zZ`iBL|9iT3Kg%_>{PlHi%f9d(?hQJb*MFjC+suxIb3B(Op69)kvpVxtfJcJzvG{lA
zzVF#6zUbV#nQGs-<bR4TYLMvtH6i29p%YDs+K0}Dn({n6*e{g+Fe#v|Yw}yIo8P8!
zYcnccpCQl~6>}|c(W2k-%>Mm-*NzD0uMg8O5J+owx%u|cbnW%)ZfSI#X4bxDy0d-i
zy$OY@C7#~uyYIefgHVfBn)5_QUhPQ?K8McAy<7M%!tHw~|AzwmW#ZG>a&Bj`+`1Vf
zAJG>1OyJhT6MI984^1@H`Bd^NWWKEVQC|5?+XMbO<(^l~P|$q9det*P!9lZkhvU2V
z?(6S%7w=o&BOXyaJ#%JDU+KI^y=fPxGrw<`pcqhpL(fCw4~y)B#q!e+G2bp+we8?T
zu4c}FAB`OP8!k>N5eg`<;A%VM%D=<qb#(q_-SyiPbXQ3H=a82=dbuZK!E?)xe^{${
zDpZdq=3La$H1Y5~o~1HHU`5u^6<ig5ss15)kp~i3ug+pO<9laNl$H3)%zp2`$(u|C
z?G=-RFI@gPS!?mLAYa~zI+}42=blb#H$5YE=8Z(znqGmwmrQ@JRK5Cix{Tb6eR__6
zc<!=qTgi8=i;rtT@YdY#4-b7lt@QQL6@J-2ZSfsvCai2@cibR!bY9=2>q5@mQMpq^
z^>0Wd8KnMwYt=W2Jxi~C&!0w3mQ{>ir)6&Ux$hS!wP)KpPryp#gwsstW?2oD&JD5E
zSpns}XJ;+mx~NLt!%$%Do-d7ZQ~9Kxs;t;EPs(C#mbbX>l)$W?p${{DSg&3qqcp|g
zn$CrJsYNrwXT3;V9CkteaGutw?E>f2G}f<FH2oiZ!!3Jl)1)rXO^v>MGkexJTs_=p
zCy{V)&VS)bMlHRo8uDA&Vjq}tJ188jcJJQXYV~Cn<L@Qf!4A1w7&jhg*u%^sr67|3
zZlmqi-WBKnZMm?8%W}8Gt5caz?X|XQv?lv3z7rVA_|Q16x6^s9ykEtJnJw4E1a=7o
zuF$jF=k>~RuTHaR{>)e0W!t+_4xdzs{=HDatX9of(B-s7L-B`=hx-@1zIz@$XY$WV
z2E(+QPTK`lY^PXgC|RwR^x47d;n0$nDY9DP-OeYAcj_HrPf!xyd$V%$X{Tdd%zs5M
z=yoSNp0(R|XsN;lYX+v;$%jO|l@H%lG~3j(Tsb~Id;j@YKW_e$F%;l2Iric9X;b+R
zMqY~!b#MGEu~C&hE$g)Gi+z;=?8jnnr+nY9_J?6^*d?dk&8zQUZ#b>dUJ>C^lC)L#
z@$&^|m)&gdm3+l9(ZZ&l^*Lu~WLNFQj_F5>K7<>DXUv_}-o>VCl5#YHA$?y-@x%5X
z&lFyTt=T0qO{V(y$KVW((3kS|RwhYbcKda2kJuk5k`t73VntFS<JaouPlBD+@yD4n
z7R1^3O5Bc`&41!z<{ynYYLc><XZikCFj<HfD!+P}xGnkeOY?wlvpD?B&XmrXc*VT=
z>!Il2FUh5T(c+mhRx{4?sPCQ3@-C?DTJJ|T-P*U}feem`r?+LEyms;Ls)SAfi~mxe
zf-P<|?BzVn_L2Gcr|C%!RyR$ztetdb-giF}p*^Z1|KCSGjnSQ{)4e@lbG{p|ul%hV
z=f01p{NJ&1pPFO#dalA>&#PHhdxM20hzJyUYeq>)@l3ecICIroo@2INZeJPA&h%yF
z^0#}H&bQo>CYdJZwE0T&M34C^J)@Ezp4-d3e)q0}oc!1L*E%tMW<6TUAusB>TC{nU
zP|MASzyGe-9sK58#;lF+n@-$#-zRc&-rG51^Jf^HQCVPGarwnnrQncT9#<9C`N-7z
zrrfQIQQkgNUSlD{^nKq~tQLQ}xN3Fwrd<BV7QCVCQW31hQOgfj?Pd#lYoijJcRgNo
z5BFESf7=h|y>k!Rl6TGF#;-?7*VA6lt~q}w#3S@JXKDKufq={v9v63|7j8YTXJ9E<
zKP8{PCG@jP?i=N_YiFf5G<*{?{d(ZS0=?e`zjih1FMJcRB=gQZ;Xn4ah7TXBr9_H%
z`T4GEzuVW({N_;1%NGy%v{?2T9Tk;WbA)H7VBwlsV#dv@mTut{^gCO3cb3;o&B>;7
zS1p_LRbkVt*c&sXwq|a15Et|9w$Bp&73Y?}Mwh{4Lf)#=YeatSz2oyT_MWwu&_##d
zu9cfSZ*ZAyZOL8vq4-8%;87>nF5hM6cg=p++2z{4uzA8y9$~e*t7l%E`?V)|$~_b7
zO%fknD`v~w{&eTtK2tvR`zk)MQ4fwZXKGwX<jiBK3-w*U=F&2!GJ_wA$s0Ovswe1f
zSr?koc79>blEz+EcaE=>R&Pbl#U=i=O0mANfBnzZmu^P+tGzXn*YEmb?8<aLZpoHw
zJ(+A`i)StS?{fauo3Pbf?w=dWi?&^#`1bZfA;vdHCap8}c$#))`;*PF#S#1FUk|!m
zJ7wP8Xy?p5Q7<pu4cmV09(NhH$HO0Sm$;spa?HORzifSGSa)$RPfEx_*1xYdO9kI(
zkGy>NN^Tpg$=3;fTW_q|u$3+C>aRPWR;H^dRYaOwl{Md3*BEk{-&<X4F0X|s$I}nn
z?NXF?-8k~eC_Z`m0@c)CRr#Fho%WL#aDOTFurIYx`0>Z}QQ*&yP9Lml=igf%Q#-e&
zaaLa42G5&}k_R^VFm=^`FWmLv@xr)UZzW#8llrzPeS7e=)b%$`-#$P6!}{O0uixpa
zXBM#3nLKXZxKrSo$m}^X$84e(Y&+VUZ|9S*p3G5KS#I;^>*uRqpPqgGa($6D_r`yp
zU&n9N+r8JhFuU)Z+=g=x-A+ua(a(?ncjCGKkte}>H1l7Cn{oeL@XBvjdVtORlcC$w
zH?lsz?YjKMr0EQ&ZvNb3%UH>ObDCOjGRO4SUji=#Ggh|MoljvteA<R#-I@NmE9|)6
zv&4n}_$l_=HGOVd(h+lA=f!h(89y~P6X3C8e8ThL?9J`>jkeb@%Ki%6p0U~~{%)-A
z{XZY-9^LiR-!t2Pa=-j~J@vcFdpDkS44rUj*~P}Udt0{OWma32`K6P4VcM6PX^i4I
zbvx}<7B84qs2RTYLBsL%w##=9D)3Jz_-@j3D1^Uemf1HZFOFZSz3&>|nnZc=%+~5H
zKKa3I`#z=!kIORVX_Ig5xN;?Z$+uOj3wPDMTYc@wF0X(O7Awpo3Lh=ISH`D)PBTvI
z(Slv4ysmM5`ZuF<7U$Q)W(khPmuCF1GrVRIcyV_8#08?4a>bV9`evV(-tqN4{{}aq
z_}*{ZW4~tG2rb<HpEqec=lfR)EE7aL-qfRZHmAJNS+`J(fq@;%nvs;uV$khRM{Qmf
z-L{zZ|F6i4l+_+fRiE9MHBUD@Gwsqg>$fvYCT*HK_ui*n79yOU9h#GTCrnEXm&=Gx
zo}aUyS>d4bw(aWCvtMme5&H4ru6RS8-Z^{O|5nxOlV)aGTKlGitz0_k>B5R=myc2B
z?y;=ro7cT~&yA^BTh|?#9lrj*hTgTHKT4(ZI$iFaFwr+N@DDM%RdVd#_xgh$%>P?8
z+t&*$k5mn=h!m@o4AnZ%$2To?pJ3vSHLG_`Nz}N)b}v-v)TTX)6n{N<aKJ9+$l2>f
zp)O0Oef$2(PxM>$y0_+gv-htHuDtzkh4xgl{jXdDpKZKy_JNkxbgkTm@S@-y`>zW+
z1b09Cx-Q_RmrGQPMAf7fU5`vIMP+#heC}{xbEzgV{$Y7tl#3|SHhsH;{&gE2-So4j
zsx_X;3z?aIB-i-el3Eki%n+k>hkR1w7adIb^=i$7{nmSDY?AQLOO8}Hy!?@mo94Q|
zX3y?xN4A<6_k2F9c52efA8W%t6f9l!va#aL{jgNeeODC?EaTgrF4I~%hf8<$E{=SY
z3&x2y&2z5hM|_)D_s{oTTgrteZsC(uSZY^Htm{pBa6NIc^52)Yjk44pfB(nuJ8$x{
z)hidc2Ma!5>Y^wWQyQ~s(WNsN1MYcQuUzv|UE^&~42$^xk1thhe*Jv%B7eF3Jz1gk
z6?GX~j-9c(oAXL5YRRX)m#!{1TK~zyf9}KDgLChknxQ`Dbdc-HOULFdGKyO*EqUy<
z3{O<|&K+OG$`@R?7gC}9`{}hh#?2qs-HQCQjY*xMA>rQMndKUL80?yl-j&Yp-@=<<
zT~xZg{6TK|gSY=0J0$oHpI^`ZAjs~?R2z}oTh9bMNGS+=796<5=u(i&%5xvruDDjD
zyh_I2u|T@Q_fDl=&yAK-NA~|ID*E^F@XwnUy+vMo@12%umCgQoI(uhK+0@hOwM@q|
zLbWTh<7yX)3mg6xR+!~E&7_|%Mqr=0^`{FSrKaDvan|&nIPuJO_U-J@hE&7vLZM9)
zpFid6>~Tyq{t<IR^@WC(g2ew*vuzp<>v&zRv1T^7y6)(~%M3wnp^>L+i!u!=x*1q1
z{`I5=ol?5q70~s0O_#`x!nq6g2ZX8$3$9<BqgwjGAj;u@+A5R649TmS1}9g%Qhp(`
zFqvsSQ-N{}9}g1~V@JQJbghX5v(f4)1_}btOB>skupSiO7n#rWt&jh}%a808){Is^
zIPPh6U$&ZP%%>XfVD{_##;;QtIp<za?b*eBzmbPs??p+AB1cD*M?%fo#+V1vFRgxW
zZ!bLiDU$WocWXhLbF40DaUC<7Hz+uzOp@f6JY1T>QtKdgM26om<JW1OTMeSGSLJK{
z5WC-af1%-{>J7Df`|kaD$R3+-Bel74y4sgn;da8iIA1a4MEt5$G>&7AiQf4^jd9J~
zAHs6mLa#<$5ZEo%bBjq@<%MR|l%3(>r*H1B6y{MneYj2d{L$!zjRu}9?hhJDSmVOu
zn^_)lupBT7oRxCGs)uWhQNoEN^?S8Hd>%4S=6ma)nqk-$E4O{c*Sv}MjiMPZsYfoG
zu-fGSW58V--dQ`nI}*7#zP;PuCH_7Bzwu|LxNG-WvMXn6OmKMGZ1mjfz!Ig1hH96t
znbwmzxzZPhFHByv&@k}9rt)i1#ya+CCwxAIE!BL@e8fI1w#2Qawn>e{YzssD<BeJe
zuBc2^+&NcZ(O!Oy31$sii|ikow<j?k`6j}$Xr=X%hb+flBuGzv@kv0YJ8D_fw__(Z
zo$;1wT*b<Bxc|Juu0DMi{)J(Zy8=}X9#Cxz=+X%MvpaW-v0B@Ig_Ar_)~@<<U3ghg
zrcX~z>@md@o6yzoJj9ZpR<60^o-G-lt<uL-b0DpC=Q4(ON?aTVtD3L9Uc72*LgpIt
z4N|L*WwKU<F|!D`Ke6B~VSU0Us8n<O&c%IAC;LA0S-oJ4^Ih~jzG~$>#jF>W2l@q^
z(@WW+#MghE=-gD!$~kXgebLWXtERegu8f@7$^F5Uy^MGDk^`<Ey!ZY6sTv-6*tJ2P
zLF``2qZ6VnoTsYJ-8r}=Xh|jCAD^qHFO*dZF7`zxcCu)k&54jO6*qctxbM8ODC36i
zSu>gU94i#KpmjlHX3g``Hf9O_ggy1YlPgMIE&Rm%PtDU_#v+(o=9GE^_kY2>%q<L$
z<5_i|tYhk5c(li*RphkC(g0i5Mct8%&-(eUiYi_RxVlSu9;2z}-hj%ruKQS*ue&~>
zK`^w)<81LqVHP<DhrFYHPCFR=a+kNr?dr`~`1uQ)t<%!fU0b*!ykZ^dmWpYG9(!W&
z^3V^HO-?hLqgg(_&ge`mjBE^KTDe?-@55V;$=Y&Tf?L)dtTSz`3n}!N;AkJp(<%RB
zf6&vzKfcK<e`~SG=^9Vnq)#kI3?{0+2-qgPl4X{N!y^HPK-Li1&G|h0mHIYZU~ZbP
z`a;?};ojzrr3G2et5W3WU!BdmhN+IPE@{b;qoyj~RX?T8o}Rgh)kfi|kLryNLLHG;
z9sZxc$Qxj@$)jn3NrqKmXky;B)`H`wS5B(gux$}Tm%^lt^^*ncjU04ZBR!;iB_bJm
z7`a<&GCvpe6mJfd4BTOSh{65B3X7=o;u91<aqVGW@;WC}zrjj3zK2WY)SDLxKk8DB
zX)1(FSK(X~God`mekGSerm}L$Qx3rp73TVltdY|qj1&4c2v5?|TGDQF<Al_M7up)y
zKD=vo8Yxdb+_JRrT%$#!3-b=H#3Zg&PI1#*&h{)maI!BoWuk6~VuW0S7_+(N+QV0v
zKG`kfn6suYEW~or=N*lg_+uOxSIHgCj{YQZ^!bw16ArJvqU2f5vFFa&pcI|!rKPd-
zsQm{^i6cR46=IThD|wxiYc^A|t^W8%KK8qDN#eU(d3&7Ad%Z5HZOz@qD01*seV$`K
zdyQ~dT@zP;oJnHE-YNsG*`8+iG<cu9>9@<)SZR>^%lr1Jh5H{#ESk1|;<JY~QAZBm
zmhZ1?WLFDIR1-0qsc-vgfvdk*=A~+<%RUFIH1wEqcw^pa{#h@P6|MH5C0R6l`jps%
z@^Xn$I)1Fb89yl5J}l^&!|m+BzA7Mf6_>O8)rHf0E=GN@NDz6=>M~RB{)eSYPb_0I
zmU*k@C&sj)R-~cTu2gLCm#Kk&xr?Ndc+#9iKh)1v=jB}X;((^z>&+`!qWzToJM^BH
zd&f0?$~}-6d|dRn-Liz!{Z<pg7Bkr1U%GkeyoeyLQ;!>~mbZ&1?C;e%{O$H1&Xm>D
z=SjYe-J0oC<~&y_E4AhL^5^0YZyxU#zn9p)vpFK=*!=oGHDx82W?t0zGf&gL&aSrp
z&diG*l{Lq1p1gnFPv39DbY`<7n~sL%e2AXw%vfx_@YYwcz5S;ro@BUlecO*l&X80K
zucS3g=ATw+oXnCu<+aU&E$0N@%{X@;Gtu2SwbWed5Kq{he>GF)zt>}7dr*2=XTt5J
z4__?b++S~NxvQY1eCu_IfN5!W-5>5eB-?(&YP)(<NsB$-#;rdLJC^Os|DwS8h<B@6
zNqJ1*sx_ac-;*@o<ifL)+3f1Zc`1(F)h%CRe{MZ~ZPgv#*6?E+R=hm*i!<!E`Q(EN
z7epn#-;LQL#iWpUTj{)Y*@XoYdJ=c7`^B^@Z`Y5Cx+do~1KnPG$5-b9`3!2fI%QKf
zJTh^7F?W>)-$QxnvIB*VZ&W%Z)H#eeZ+mq7b=!Wr&}FyYluPH*s(4)sr#ed&C<inC
z?8(_BJ4LPFP-)4jB^iS6!=fuXq#k~=(5TfcdoV|Fm2u69{~L8Uj@<wJ$*L)5<}KL?
z?K%dZ_qa`*EhTCl@8)@1XPL&+pu68*%?i4AMq^%KuGfjr4r@v$ywOzo9*}c><EJ?>
z`}T2}q_x$Zjt%Djv}WBApG6ISJ_%l1((ZG@XO{Ea2|rD`=KC|L9SQuvsA2tN6LXeY
zT>RFD?83^IO#>s9@^62*tY-X!|5e#5jRfy$K^MB7v}L}F;BGgzi+;0tPr>C>W~(Jh
z8fE27|GD0+JDZXDuA^zuv?9@|A-5uDDTp6EbtKm*A<Opk<`VPLX$}lOdV)d?<}On6
zRL|P^#MCG9(UN~}#bO&I8V?8-ikOyNuD*As_~TN?{Tss=njODiyBF#%^WxzD@CVT@
zk~%LH>;C?H^0tuQ;#2Fj8Qs^{+C1KKqp-hYjZi{z*eA>8D?Oi03)Zese1CPT%2(Cv
z`Bte5UU6;Dc%l9)II3((ezu9E!e_szDM5YA!3LQd?W*qop7@6Cj_F%<$!9Zqx@I1D
z>;C7QwYS)5?d$t`Ue21ef%}e*zzUvVjsIsubQpEc&$$2j`Ss~>$K!lC>ICF+GgTEX
z-8{3|#M)@lvJH11@an1Lt#^I;PW{Kz@4pY!`nm*jdnP6*e$c<2!nf#1jy2=fdHTEO
zNtbw>%Kjg!pTg*VwygNT+w33H^!FXeF_`Loxo3;)tJUvfRQM*xyD-YW-*eJPI@I{Y
zqHV2evYA`g>00daGE=I4Vs`7`0a4#we<ZU%_La`;jhtDfQc$&9mh*d5^R#{MW+h9X
z`KR#k*gtu}oZxL{W_(eJGx%;iWSsV0V`^DUdF6pZ;aKkoAO3LFxd*RC&Ca(unebsl
zO5P+NE(u;HN6p|Bza2zE-<i+&W|AG;l3SX(zn1?PS3aBV8M(!CPfkw!W^}5c{8Ze(
zH?mir20CB5qI!7Ndzp|c=8|dRT!on_Y(_oX?A@-{Sy{F$HPvL;dvdbX)GD84%-kjI
z+w=ZwZaaS2>6X}w<#%7?uQ1L_sBUgqrXI<DBSq)*&F62Wzr1AMKJnz|;}vci8wJhQ
zdG|U#Jau$lS@Lt|`zH_Xe{TDl=h<{Cufslh!BaiYT1GGE4hj8o;N-0h5;*~jwI)q}
zJyY=EX^jsTP9MG=o4)G$#cZBvv0&pjUmuF<zj3~6B)VR`IfG%(Q6^?Jw$$_|Pqil>
zvSixW;c#PKrSe_F?K`)AIVXMS-C3^yfg1(xI!_)o2Wd@?eO%{0slYdJ`$M;^j*FAR
zmg#mKI92_=TI6;5`_}@O8|U9|f4lvreT_zp%>(zgZAk{RP28?8(<%;QoLqFH(eK)~
z^WUae-CHa_;cijQmc*7>ey7YXZQ{`Qe(i4pkFpc@w~1m5mv7Dg6H(sx!+efak2>Fm
zi4{hxdRE=_EIlDHbMO4M=k~1h_Fo?+pBwU7(lJQ2i`}2Wt%E13^=)-o`ISRUnj^zy
zZ@OvRa9g~qGG`y-+AC6*)Gxcd{NlG?y!mtV^uYVO1x+Q|osD;>AI<QpKC5{2dfs<Y
ze*Q1>ilwi`9#qxq=wh1uPVQdbHCv&=<5%yQy_Egnd-?J6s}biP|6dmsxBgDj%-QST
z=IOueQqFs|V6Q#b{eAWRe~sRs(A|=p*Ht0aA0DP)anES!T8Wb9rtdWO)&G8Y_xbks
zeivpw7ZCNH>TyuvZkN<s_SIsqKkK^0p19$vuJP&6cb$NORUt2S{`%=KW#5;Enx0ST
z%BCCFnM*q`%+}p-ZqMapW1*OeGnbto9$(qBsWV-A!-fOqUpD>spL$C9><hn??{nPd
ztF=1&W!OzRCip=-@{wG@l&)tEGlgH?nX)T=&69$|cT9H8k`(aheO>X(j$8K7p`v}P
z#ntHxA}TDNd|Ma#=IGto69p^Ewn%Q0YTj6saA)PC?+?4$UDf+yAIuE&GfCV3NYXR1
z$$C+nXt@8KwJgD#+u0kQUa7eA?CI9sd;jgZdvETfH9usWi#<-Uw9ffGL;B8}V>UXE
zl?6(VYVX{8tu$2h*N3O4kH&7;xM<$X3gIVDU#V`>ceW7_T7PAJsL}t2XZh=Mo?8Vp
zeSKv#>u&7c14}0OF|GO*!?LHQQSM>XDW-af<MK-#OSy04UDt|xd~Y>#z9YNTw9>B6
z3Rm~3Ir$2u?e$(g%dB|O57o@;w;8u}ZjxeSbYqq0Jn%MW>P0nMxy6qz_x44Eq%u9s
zX%l5QU%-&HH83-zZ#(Plw4TzCy!xy&>1WTq486TY>g^xv|9ft(uQgavrZ25|AbRoT
zaR1I<6*t=Yx4+~6`)p5n)%MORQ|*+dA5(U_<xH=bS9tKac>ck{OVZ5~ECo8(uX@^i
zvoF)(r>Mh@SUb5Vl`s4BP1KLeFXg&(Xo5z?2@}ciM*>@asJZCQbC?pj+xzM(!Brf!
zdpZyOSpUmt=Wn$a_iY*fhWe{LaDUD7_NLxl)i>wne3VjueLGTeo$=Ope_s_EojGxQ
z(!qCpwW{22%h#<g5n|6V5Gg5{bm`}|^?ugx-uf5cTVLy7o|Un?XhuhaaCYCyZ|1^Q
zD=ygm%h~3@vMI&SV6UQ=t{KDr-P$Lu+s{7Jh(CC$^8JR8?pZQxEn9unnNuI}O8lsj
z-=sV7&cuxwZw@}<5UQDa>&4HtfeL94e-`;@&u{2`>N$61*SV$H6VvyLZ$A5O;h%Z;
z;;N3TKNml~JblW&?OdN-PMvA7E1ctanW_4P&C|~REVs}0hd*nvi!@EWlU7w6k*RfP
zo@Vd85Tj|Xw*}J<9SB%<SK04IMxgoJb?M2jW#xaEQaVEVf-2rW$SOa1v(L>+EKT>;
z-pf~ej?eU*_ObuW!{)O#OQ(KSp1h`~Qfh0#g^Ry<7p+~oTQB{RW_s1$DUUR7%ex-`
znO~s!`%K{B%ICWlT+9_NmpHmC`awbUtxq>ot#{~K$?*kz>`B=E^O?Y#y&rsT-;<es
zDE6~n2WS3_vIObt92a&cZ#?UzcJt%r&+{IY^=yAVapOr}bGE&P4j*n!S@Kcs;5*~O
zbK7_AVNbd*#JA?=%*`6Vovu1BJP;~iF5|mqzvG8`sbAfy^CK0t&Be=a70-_LuzUBG
z>srq)*^PmJUu7P+SJ->Hu42aGUyE<p=lp&0Mmqm`-tKZeh2F09rFPA6O!4!XD&OvW
zlRkB2_020Wf+oMtnw2rWldoBwzJ3DR^XwHrCohigt9&eL9&{#E_g8|5{`#J&CYOJx
z%FR-8@^L?uU%EiD^SR!w#x0dM=bg<u{&@QW{{C4mXYWSeH{RK0p4q=qlJB#l-M!Bl
z)1EamRBtdbPr2}NinJJ8`kch6?caoE{y(62wJ>mM(Dlr#V&N~+MN6mgcs`3;c=zPY
zs#x~bIqIv*tG7*OznvWJ{r>*OyL$8Pu3mq>qF;A$c2z~&yxDDc`o+K7HpDmkxwx&#
zUAJ1w*sXlU31+KhcjO#?Pxzi^npD{<{%v-5eJ`WJA2r*$DQkUysLnRs-MeLR*3BKh
zYLAxMp6#B<x8&(V;eF*CpYq@FnoehVnbLe|O$*=c(;k^OcUSox%d@>)yIbp>vg*z!
zwfee0^YmliJp8i#`4t`c4-rPm)1C!B3OZOA&@_E1_lv&Xq;82bg%9s-=9hZPCQuSS
zsqe+49_Ikv>rou@%ng^ljw$+n`{|k8Wy#BSOWps*m8+D=TW-+T&v83Zqpv_kQF6|q
zZAF`{qkY+VAI?roz8p0Bq3zCZ8#7PKNW4F|EqhbPao$^NUc{x%?XI@Fahrd}TEk?f
z6qWRC9EUF+-u3pdq1hJEmr5`CWZtMQR*raMFL3ABIm^HInLWg3wbzMTycOa7-oyLA
z`-h!{=k4S9x7NLQqx<DX>fR1>YqvRveCM60oaVgXY{2)m8y-(7`o#S~db&iIG~f4k
zI#y*|!3@sDd#<Fgud3g@=(XSXP3NxYFaEx?cS0_=+1;;IkFLaIM)mKNed||vIqB?g
zXJyS^$Cl5F(j2X(bgYd(yPEOhjZG!L=en*to~4!CShJ?4Z}soq*sbboZ*g&Ky>M51
z#x9%LUB}{1_|81Guu^u1w92(xYG-4;<kptF=kVPA>#*>}^)ddrygH|ySIxFw-lUnY
za*yG}wx3=Bb1qE`YfGtl@?X5keBy7Z*G7kbtuve4Tm6vVcXEx;4K>{>w-rj?&EVgz
zmb<x$?V;z?vJT#<9}oUVTR!!sj%&RK69dC576t}!v|W&?#rb(Di6x181(l`22lH+l
z@a+Aq&G95b+T+eT>l}^?jIOhDkKR%`P;|q9rzz>OVPLe8$}aDJbyI}ZOQ*j~;1>Dm
zvhTY|<NMRQ<u|jRx>zyiu6V`_FDLW%*<sH`&#l{ZI)iEZw!4<MLU_Wbhrdq<RkT^O
zosFyJ;H_=FR~Q%PEm~2sjdAIzKI?WbM$@&WJhvoH&pIh3?|M;j$N#Ha&dpg+s^`9c
zeZFb9kX+Yvrmb7%ZS(H*SFB;@xVJUMY=P|>mTfJe+kWkgS#f)P_wD@e{_)QQPrNcT
zHqn2w=4G{Qh`!%KjZ@igZSQ1Wo4@i{ZEE9E9_O}*l}D0e{eItj_Tc7HgWoLv*JOeY
zb4f;eG`udn?8&k0qTuI#Ww%t{KIJPDs@TGw34QxDhiChfo9ZuLZaF?>-P3c%EvNj%
zy9!Tp`aBTN?J4ERD2nDN+}~*NO~GqZMwSY9meGslA6^($C_H36w?-we>CfxFS4wT&
zm+yQkbV{3*x&D?x%_J}8+_k9}ekjdznsfB!7oBIEhhMOrf6kK|e_VF@=KeyfQ?I(e
zpZWHgEofPK*1Z)6!nXFsneaz-1U?hk|H<u6w$KsFjpy>rrzIr(u{WCXNYnn2ZmsVf
z4zDk2{>L`+u}K<yJ65m!=U-Z7_OlxYKFVyj+{R;mrtg~U<3pCOk3ALED2?s@ajtAO
z*A1uLkG<Y}u=~xhGk1w;)OC&9O!o`k)|T|#=nIuFxM8;=R^m*}JCo;AwNA8pK3;I_
zhPLDLdIdhdQ?t@FeX6!=|E}3vB)jZ!`L|cRyhoS!FsmPS{DO9{Wkp}Kr3xbhgDMl|
zF=C*^my?;KS5TSTZ<}}6fTy*5Zj(nFgKMtEIWYz23w$pF7C2a!h~`+SX-#fgapUa7
zs@{2PilUyZzj(m$eszC;a7Arp&3T#76J3&5PfV0Lw4r6|_R#Lgnc`_&{ExmjZp&@i
zG-G;X<douyY{7YftqYII&HbS_Q*qH-J)ZmV2B+N5GtIMD<ZV#FX*OwtXVm`kBZZv5
z9PP4CEHs>aGNt)kazonjs~RC2Vw|6@(aM^)!|=+|DIANAnK)XVD4#gz*;JMm`?7M!
zD%W@ZFPh%YsN%`GD>?rVTky4l9_OyyS5w$30)NT;m+dQ;@4NV$S*jyj@{7DrrO<&x
zVv@|E2PSpy50cEf<Y;-DFL7(r&BU`gnF@P9?>hc<f9S>7pBDEFmL_$7y0fH0`R2_V
z9xwcM$)iqFO^m)Ha6*WI!QT>lrp`^w%+o8V+-jYjf7@fy{lD5$9~qZy5_)Sf^UVQ^
zw+9R7NZvone}ium_xghiPfWX#yl<Ls)HSxB@1sNiCQP0pdN%3&jLswP(n?GBuHLof
zeBOHdf2E%ykJwDFDVq0Tk67`+)yZW+ZXYN4_ca~fTU!=2<+Yd2G*fG<nqm`6E1Rmr
z@21U(Er@)g^U&W$_Y_ZDnrZ*0y?ZM|Q*?Nq``!();hA~j)S^|9Q=YrZUR`wJshq>#
zsE~f0Rb6WSGjxp3omvsMEa_O<StmBf1rJ%CeGNGO{$={kY1JR<Cy07ZE~<S0vhsbS
z@9m=-F5V6DFca5I{~-C4M_}!>H99N`Hu_p(OEtT@b-F*f^vyi+c#EgYz67InE|I4j
z=3W*^|2m1;A~IZQU8GvkL{mxa>tBUdEZC^fpt}A6^Mj*vLT#9oP98{zJ;4xY+@C6S
zb;mWE)%?$=1a8$>>{awRX1(_j-AQlG39MM@s@1$>#STSL!)I?SpQ#2_ubF3W!fky;
zId_^^_ujoN=Ox##S`@{k8Wi{Q&kRcklg_@049aFdxdT?&-An$E9<X}RjPr|r1oED1
zyrVSTbkf1+kL7}tziRz^_>R$B*iQbY<P3#<zE`Do=Db=G@w9F?Q<-6R!%l_xH=9mW
za^F7G{{L@y{dxZzdl<_O3wJw;q{&FMF-crqe=O_a8V}+4!!o^A4Ud%8J60??s4n(U
zCaitOl|4pj#qYn|`6Rk!@w39S!VBWH9=UIOBC4+VbD65*4A)7|1Je|H_TBDfTHnnu
z=bBGxe@A^PE6>NXHSI1NM9<H634L;~>H5C%!m{d8$+}&;EN!{%=gj$c|L)n7FK3#+
zI<!Vf(eiQGnnw%HSynqU+f3z~>NwM~V@Zxfx1-xNjin2?kM5buDUgzE@L-OTny&oe
z{R*|MYh(iy-fiueZL;c;=?d)?;#@W!@^usLG|4Uc@NpH(oQk89mL1x8UnL>ppP0pl
zyo>7u7&zz5Xg+mKW?`7k_bl=MoV%Zesx4vRv~iYIh@QA^k!cM>W_RQ%;~P`H<*DSX
z;_OOW&%8XVC|77wllKia_bVrD6;5ikFIG`dOE49Tx~MbFr{R$|J6Ce&1O=IdCSkMa
z&5KqFbp4;7zUryJ!z1A)sY812%%a}jEIDOUZML30wDZ_R*(Wa@{;tpKT(_8a*UeY^
zO!@z<*57I5+_`asl*58ImVeq~I@1pLh5Yv57Vo$^W3QA(`{(amseC2!Gwv2_6Z$%7
z?Zg9{-IjEozV;y0|NmFRN`^2a{W*u5^cb#3y}o6+Fs5Pe2e#uI+rRzN;`?`kz0a*Q
zR`KB?!<$<sW<Qv6->GuX_X}wi$<LN5J+ExM|46A-pMUYfUWZ_-0yet^9G@gKJ|AUf
z<=8K{Kv0JF>(3dTu6%yWn73rJ*X=l)A^lnQa6T*7pSP)jhwrUcUEw`tLNeR@8w$+_
z>ZWM^2;X44Ql~)ds_+|U$1JW%+?S6`sC|59V#<HlSw+>wRTErFOBANt_^Q86s@x#H
zJmHMO8^x3Vd7kWW6OUQhyl6I$vx#cr3-5X7PD+;DJ!hv~B;fN{V!BL$j)6=>p#k?P
zcFFU7MKZ-3Y<?cvcfa_2!j<O_<{i+ulFVgug<T_j)}`&cnCenf{y*6KY{$AstGUj^
zwhEu+G5aYiBRD}P`-AI-bj3Cvk0!%+6Q&;d$8&h+AI^ON9KqiMHl>8jICyHY&q?2-
ziQIQ~em}OV%WJdD{_Cz2w|#SMFY@k5jN05B!prbgC#I9-OYy4k1q-<gW1a*`d42SM
z*B{_9TW9*+>7t)r$Sl+8-4yBMR#TX>Qtr>G%bzAkK7Fh*$FhpgQR>tNoh1&DGZuNj
zO)fsr=a%etfBD{>f$w?L*4U(#A9U}Kdaqa}wcTP)hGW>H*234@-^Vg|Pjm>8+f`uK
zETSM2Q}_QutY5;%Gx|A>&*xN0RxUQ&9Kz-KXnE|V-d!64J2*Iw*`Lc}d=Y!Y@7LB9
z!FFG_eDk=W#<+4u)i0iV6|)QLe)2a=c%vA;=d<Mur`NL%7@V4Pe8w)77v7G}i`7^)
zS)CoM62o?V6q(Bqc)fU^ySMFPca!H4Qnp-r1*aK3Dh`}``0?}32#0^p%RI90UwfPU
zxy?LG%KktDTe%y<pR<SFo#9#}Q;;mpm62eRo58mG@`H7|{~s!jb2WWtf6FQSW01|q
zx4*L|KihgOx1m+?zUai_t##>o6LeiOSJ@^<nm=e*ygNBT;ax|=h3IZY{)~cj&W1a}
z76KdRtS`GIwRZdRzsD1@rS6ozmgcDZ$hx!CzJz_l{Eu9Jb>IG2x4X_Yyg5JT{<V*7
zan~*RO7G3QE!y3!(eLo_PVBbC#dl2-lKxETGF|ikozm0QFAL9~?TxD6Z@tJ>=~;HT
zu}@!1;LEaL*NaWp+4!V$rb^uxoyjj!`+n6@Esu{mJB&=ivVQcRSp9LMgwm^7VdiIV
zcTMbVVbJ`&w?EAKBm12b!tETId8@d%bNH-Y+*J~5&TZVXDXB7~xpt}5b^a&5$1~>%
zZ~iKnt6t{%g-<N`Q<6&OCe4)$s=hi3{<piPO-ea`Y%X)(tHdMhhiVz^T>TV(p3Him
zsLm3)=D5a}L?NMl6%K1^%a}A-qP(@aFRrOr#MP8CLrn2(@P}rt^9+uTKhnNVyZq27
z|BjzP)VY@#OnuALzGPd=zLvUN*6PN%QhAoFaE9f<7k0m=GI>^S$Yn~JT*IDdy+iPI
z**E?LdCpgE>tDZap1yti?IVYu=m<~VTrpc{X5$5(@HZOgr6+7YIlo&X$to>k-{M^_
zW|SImJolALK2yh~$nmJK{(sP$^^^XHyGUm4VZEZ7qkmeX?fOPNw*Rw=C6-Lt_hmDC
zXqbe``YO{j!C%rd#MLj~NS}Z1e^p`G8NZc_&QB9u(cu*`<1F)?n2N~jOKt2d7983q
zG-bgGG4_x~ORHZ$@1D;)c=AD?=yFEsU0d6Vw)?bKzVSb@_^z>>cI#diosLtJnC}Zl
z?XHSo)%5MVqUNSD=hg1@6An)HJ6jmNdYOH>dznUY-OY2;7*q5Xp6skq_748MG`7=K
z)zMY;$a}_)G?sJ^apwuujgvykwk9`ky)Y}OX}0)|ZH`iNRW37p-s{QpOa7>q<P=kl
z@`!NW?K{=#yMki;m`gsqT+T7W<QL-&PK#(AM(Yc=1^?z|W&Mtt;%xh_zm6gH>H5U;
zFLR=~m?aiH`*CyDlG&TPCx1TOpKjjgdn=>W^la&?=K^=7dfwUc8J6=lMd{9acV9+1
z`Rne+=78mFYnSux-Q9F(e&w6*3Kw{fiygfvs%YgM{_5JVeJn-}9UXrTZ`|q4Efjc>
z_0+PpRiZI0-g?~ecfK5&;nDeES)4@L#1n@vNQ<cP@BVbJ^!fkD!0oBRx@`CUAGlr-
z*&*S>dQ7R#UB20U-!z3T+nWWCyXxI_Wa4I5AJ8>hxc!S`yq<#4KeK1MLznih=Q-Jb
zUFnsL$K1a5+XY=~d|Y*2O~|rrlT)-XT%hJ*eUsyO;oS3zE^Aco9-8&3`iNX{Y4>6!
z+2Z%E)16jpgr}<S`Ft>?&8$dameUkjrG#sH6SjVGoz`T#@4K4!nh*YJB7t^0{wO|a
zV0*Fl<L7@L8jl^AS8gt;aVKonoyOR=dmO5L7)3+%mCYN|9zIP7cI9y33%tlWV_i^^
zX1hD*v9-Km`#Tf5x6E+WWZqkFKJ6TH`ppQjx3QOBNo#+Ox^6sMC^I~zcSW9+RwHBe
zj<fg67pz(?KEY{je&^NIUy^q;ZU1k}bEe|JeD5cI+1Uk-tL39UUQo`~J;ZNxyXxt(
z)wUDfJX~AZUEn`E)~!Bc)1({AY8ULf$EGJ5%JgK#)ulYw?)_}B@0Jo-a!PcyqIh)S
zE>XSdf*bc|+?gG6bBc=)k5|`~nAxl=CU4!x&~u6FiF>F)0%zKSU%K-odX8Dlwk~*?
zy65+K#pCNYFf%B#x49qXjt-IBqn~Fg^4L~_V{5*z!s4ffTQ_d;`t-eb3A0tr=FrsT
z8A)8Z+wT3GyUm?{`9?lhJN+B=#{b{W_<J)kDt4{;y**N5GiRKuFgt$Zl4*3cd#9{Q
zjq;j2?vA&=3l6#Lsr9Vxcu@P^%-d*>%97jmy8L!w2}Q}wR;JZ1U(7|1N$>ykVRp9l
z9>yo<<}Z&AbBGmCaJcECGi%YruD`Q3+i-r!W7%|ci@fQp$^QaW;w;wA`m%SwD6i)}
zqw4FgoPOkfn74MCQk+s+diZ?ivgl-OmNg5!UoAiU;BO#9;`wjP)vx4gR4<8G{OWf*
zU{}^|AH1|<eZ|(dEq~Ky+X}nBusC^4@YThWb#o00yS4A7iwCZ}9u(Ks=42YM()~*1
zfrz41bsuHdHd#Ry$M=(6XQbDDR=Dt`Z>HBbr<xm6+@f<gYric$yzDBc#LqN4@$)<6
z<R-9JB|QG+`gewip<dYi3y#V&&DX|?ZH-&KFE={+BkTD@*FPPvUurIKuW*bN(>f(6
zeStCZQb2UaVdc|uQ}<ljE!(^((ja&D1*WgMA;$X_Nl*QD#<!qh=ho)NNh-OydKrH<
zt*}p=JoVM;m$&B1Z)4bVvtjwXpxtaDjN6K?yDqp~ysa?b<<$J@T`$>nwmC0(?^Ea|
z{O*P)OPS*wsaHjvz7vFQ++k=k+^29@P5cJylkbxl40K<xTzSNBBW^_<yMdp?$=n&-
z2ktk{lsjl~gR9f&RdxJ3JKsCU<e%Ga2!1x};_}7LPK+F3N15KpO)m^_%Da{QW5;p7
zDV(vq1soGzL_`Dyc%}3(F7uk<u=Q`_+nwKT>MozPQg6T1<#me~wuBgSEf5yAnr+5h
z)XjQX*EBjwRa#+h&x~!!6IOPy@JWkJjR=r;l$I^MB`F(u-S6<+qqD_!Wn~2mawI#o
z^A<LqmHfby^}>KTclIj>QI8H2*&l(kN+qotE(&k;>sWXER!G|XOI^RyZ~c@kU%EiZ
ztm>V|*(Zz5gB0J@MLp@3jh{7Rx`v;!mE*1^{Rl4Bk3ta-_+Lua{3!bO^W7h#KNWSt
zak2O3#>d|4Grw?mo%P;bmd4z&MGCuSEc7+so4qMI=*0%T33vCon!FJE^hBs)wZqv)
zh5Nf+@AHqouFdwxjj5McPg&@0ul5-^+qy-Qk~-e-@38q^7r0Wk_0O7qk*KYbENc^X
znxu&O)m>gu!+*oHY+jRD(*NeK&+6P6t=>slC;qy1r|kE>D^(T0Uthic;qlF{XK%jb
z+<0QE<L{i%kp5kFrBhS01An~T{oVcjoh@^BwTG<HuwKQ|)}=K~{<g%M)lueY+h6bL
zoA>sy`YZSC{nxcRr1$-}klJ%o?Du1bC1)4EpZNDk5>Lcr*TA*Q8%{@5FJ1XqOLqN7
zC7skv+evkjx<9^zez;Zj(DUfk)~P&k`!DrH@9y&3_hGuGDo;M&)GxWuE}flz`t;}1
z@lFBDU(a6s-`09B_xp2s@BiJOxz$?o{FeO9b8dNEs=XZW)2!k%+hyOJ8*i7)Y<gBF
zW&EYvUfCpXZr?h--L{99?JbdO{NllJ!!Y4k8OuA>1^4{5G<a{MKM2|VB0_aqT5^tO
zlkT<T>C5KqJ;rn~`>udTpiF2t!^8}`<#vSu*S1WYvel^Mn&gWbranWbMK7)IO@95E
zZ?%+1f9=9s%9`gGC$LSNB(8d-<ci(PIr|?;&N&jdBf0!@$1V-o18UU)kzQB+A8q#h
zsmQ8)NtsQn-f=<Nf6)l_1KsL+#|?OVG+gH=PSAhG9uasj`liv3@)B3sH%$D?UT8#q
zkV=s=spflhR9IMVZ&l=(EpcyO+a*;*CvE;a=aA49Gp+?2iWp{c)M!6^*v<9$m_@%m
zUm(LJrM?&6Id)vq`?+^w$eE6vjICD%yVwtgzFPNemrzWWfx+3$YDdN7<^|8T2>A8u
z&8)v)-c7LR*+1WL*V+v)7QOh^oN-y^;)>5qdxDG)A3Eo_I{MY>pxnw2-~RgN$2KR|
z-)Q*z;A7QBp`F`r-n#Se?YDPtm`=+G1io^5V#|B^#^GZQca)7ZIIFn>)z0@crEK`!
zC}#VE|Dnvr^-AqBq5u05)^5(a!cwOADSqF+3ws~FD_?u-a*0;Q-DZEKO)OfAe+a7h
zu<iIQIMe3O&SQ-K#1c&-_tu+V41YR1YWhdd>+h}Bef#(0pur=t+hU8S1nz9jN+|w%
znl0k?G=IlA8w%$fihpzU`4?wZfgPqxjwz%_MVt#|*n8mH^DdQR)4uU?2hUp_AU^k~
zpy9bIVG|cl?!0;T^_732tRZU`icFdHdr#fhe@`#mj=j$Pc(-cNAL)>tGP}0r&iH4$
z;Pn&ZZ9=v6C4Vm5Eo^@@eY5L+hGpIrxApYC%$CklnN^g`zIktK$5vh6o5kB?OjbJU
zbsV{PHLmBYz=r$l56oF{e_KMz#8r>>oIUj+i)ZsX?}`8A0#}L{*=Mae8qjdVKJ0F7
z^0C)9PEGrHmT3i-0Pl`J{(aY%tvc{zi@3+0{hOzkJGmLZT>WDDao(-j7W)~xrF7~7
zQul67$v?r7zLt@1!OKPG?`6r^m8@{z%KZFTaZV${Tb6G>gRcopdT{%-!`7v|H$-dQ
ztN$~h4t~vQ@12z<$H0(12XjMkT7FS(B50NNUEA#9+a5*tziMwN3S!9Z+GaNWitE-r
zvFqh6!}r8pzg0e6WNE77lYm2#EISx9A`AcAzkK&|UE>1XpVtz1>IfNMzI*xd<;!<3
zH}9Ojr}FQY{e5v_++kbayf`{3G<Ks_MDZk>dr!K(%f7sQa`E8aC!TwEW_ER-*8BPG
z;`VxvdvTkds9(Dlx+x`m%^LIUjOish@$xcjW>w8S^L%yg_S_pa^F&_z-YxNr3oV^q
z?i#z5o&8bd;V0YQr3HtGd)`yaw`_2YUE9^|dvD8{i3;;BY`*>_XU?CHExKDO4~ubp
zIj<AH=~?9ED*-K`3p(mN3ua4mrk%XOR{wcY>b<AkM)}d#R&jm0Xu%jZ#rq?B-Ltow
zB1-l=RC}*?`caHo6|a42{;k<z9}<<iukX=*^irxa-9#<Uu6loh^qcM#Q?}nt3EqBp
z*-G&>p;v74tP_rGIxtIr;_tMt%T`#O-4Orj_4PlUfzMZEbgv65otJ-F$l>2qd(p2E
zrJ*LJu8Xx^&CTyFvWyp1UH!?lSusX6Up@c-@2{JGPPVtN{xn}d?(gxFj!g2FcX;J(
zs@xoY3Y@?Bo6m*!s6$w7Btv6mWkG?1kN><)q5E{Li?<kmKK|lK!vejVTu;`l=*qJ@
z9~HLl*oPH5*ErVMI=<RAd(zokd@4ysGv}yYR`Fi`(!$gK(#4M8?)hcA8F?0WHZ5J~
z^Ywb6Q_r0%s+=FcgvM^1sJ4Xh=WKn;r%e(kR|`+-4J`VyoJBhG$N{Gr!mIAJ?A5=u
z?kvxx50{^~o|fS}8K(LC#5Tn&4!2K^PQOk(ymmWlW}nE0bvrjIp6*kAJ2S`HFJkM8
z=>{Q}OKz|2`<LO6&|+`*S?0q5)+XC_#fD!FU*0g=iqy>7E_3Mk=F3{Xav5#`i}_Sk
zKW7+5)E%^9(3zp@FjvLo&ifm^KenAZ{mCYNk8|aZnHAHgYY1uZnzUHx_)UCwEHo}J
za)o9oGsg**IH#2xeV<OBXn8|s)=}jumJcu9v;5q0^3vfFm3?x{+NGQhJ1h>{qva!(
za?t9%*!1EnE;FZ@y)w69&V2f3f!)08r6&uQXWrUyR4n9)sJGs!UvrunD>H?*x#%94
zy8cNfH}8)t>!!W275Lpz7kc~ao|CJ&-HP9;cD(cPvz(!65_@h!=w@Tvl!mQy%yWXD
zaZg+8zrcI)d;#-7jwxBsLKeusc8x1q!mcKL`SNAXKi&&9BG31o&*>{tlJ}XM{JJnQ
zzJIcJ#K8uo9Ft7*)QhP?*G{Zjv)k;XxpbKBW}d3aj6H&1wVfRnPrU2Fb6)H0zWTqi
z4nG{G)cm=8@%v_X_y2X@5~jSW4B6Hv({U_cojc&7WUoS?X64kr!2G}KC)FG7IpF=G
z|HndY{|%eoO$(KbxR-Z+Guw$j?`B`VeDUS?2+8OdS&LP6POs@tHoD1}P*zn{^*^Vi
z%KrDi*_VGSvrIi(S6ks0FWc~4aDj%b!}Y(Hf3xHXwH$5qWpkWW%PhKo{@<!9t|{{v
zH?Vcu*xGS3%&Tpl{DNoU`MRa+nFVSte6VNo2tH-YB5x<hVL9#awX({~Td%YFJo=KD
zl~K=~`Ad71$KMmG+$wf|mrwCN9wl({Q(EE7mtIxAQl3iJJTF?Eo;2a;b4w4+_V!r|
z54?1ntfYL<?8O%`v4B7aM!zXvbEaO3sVMkkXuDaxC*t3il-Z)`o88k-mM`J^*dP1k
zTuFbJ>E0hkU&BMDG?t!xKYvawujV!RDSy>@CZ#VC`PrnM!=K{F${kT2eCu_yL0VcS
z_cLQ>#&@4SPZ3d+oH#S$_ldd&&vUzEF8bOp*)YrD@)wnq{||yb7p5fY{X6c~^Xl8@
zi3}o*>?h{Mi=Te?$!}vr-rVb}D<eY$&8BHTdAR7||HJE}Q=UE&nqMM#Bq1X7c*nG8
zxlgArR_>i<-}nFRoR{xacl$m{_#1!T+TfqpmRald8})=VyQ5;R<TI)^B~~s~;gKs(
zc*WdSd34?0gFA)Sy#8a`c~C~=N~>~dzIy%22eakoRIxTK@a;MOydvS6{rcIanSR-i
z?hD6h+^W{yG4;Xq(xa9V_gCzn{8env_Sn4}pG~;rBlh*x%eu)~Z(h1@_{Nfu@#DDr
zLauFbmiswp?%wXJEoJd{%d#)K+v8^OeBP7!X|~+MJ+_ltx4cuBEjCqd)&1D!<U8jQ
z9a$e;zp(6v;qF7S4wftdpG$xCzvj~6%h|WWyJXissej>LWn!-jX~wVr{4*<>bN|QH
zFPZ`z`={IdVGg_Gl)X5STPxn{>84Zv!xkJ~x8~~WZoksTx`v`8gTfyd4xay3zIbKT
z*N}~D{>7!rO$r7^CIWBYdpx@E?rrM7xNisE_xxfkdow+z`M-e5)OnnhD?6{N{_awF
zvS{UY>4<LqXLSeOd|&PJ@%*;bV!6+=ihX}gz2N6xuiz~DA?}*DXwqcE7p^yhLe3f|
z&yCx1VL$(BPJY>SYMaE3T~A2v{I6Z||EC#8<G&Ye+z%4V{_kVSYRTL#-EiDxMwrpf
zg{$UYI(+zWJcsA$?}e{KkH)h;Q8nND`rRZ`COeZ0jV@)nZDLkh+v_@{WP1<r1^t=U
zp1g2*&0_V(yzasmZf5Hn=qvA%a6IVHChIy;zQAB%u<x>$64E>NyjZtxnPtb{*|R4`
z9`yNqu~T&E4%WI^2Yl;}Rb;wloZTjD95Tsgd1pt@kHBcbs|*(oev4pv{Dpn>+}P)T
z+79{c`d1q<_w0t(ezy!FiZ^jPSKZ=e>=K+6yI_&+(<$yVU;UWwVr_NQu_Z25@F4%>
z_q)~|R!G{gp5LdxVTM{Z$IQTYMQ1c#P2At`Q%FvH{~~*ry15!@xm7I}RtAZ;Ygv3K
zS+h{0?uN-%wv3&DSxyrUKTm$YE$pEBp0hVseqe7pc<IX)%e9y0GCVrVZo+n6rOmq3
zvT;{fuEc+pzb}rTJt}6~ynIbEcS1&5e%|*Snd8?~lc!5~hMn^7X$g(ka%*wBmRpUa
zpwS)MdEsA!^jd#>b$Q0>Q+Fo%8`r!e+d8M`EJ|+3ofLjrWv_d5Lf%c44QC}5^}Fv*
z<-NpwVA-m-pRx`bwOEB+*{gWJ^>X_P&gGo>@+BvDy_{y8{#YgYxGQpDyYYOlPR-sz
ziI^vU#FBQkIa|&0-BT04>B+sChCq(eB`yDRgV+3D=KlYj>%ECTv+Clmb(fz~4{v%O
zcG^`uD*LD4(k<^K6)s&76`g6+z&N{BeZmE^tbc`Ur-JhTJ>kA%XLNSf`FZ;<b}n`A
zlVWE*Kk3`K#n<zS^((`+-fmNU(`9NNV!88-W1`9~PTQ?fmA_J@78*?Mzklt0#MGs`
zd{0>#U942;f3lzFf6p<4Rp+MdJpQZICx>bE!>)&FN}+{v(#@abTpkA>OKC2wV@->V
zH%#tcI+fGLckjG*$G*wy`b1babne<W&Fy}W66X}Vj_q$+d1tXkTob)IEuH=728*v-
z>_t}T3Z+#EwlDYF7jw>aM;+_r7n85q$G>xa9W&+hsTtG0ggj+PI>wp#RoH9Z#943G
zX_)w`MD=oRk8n>qaIr&ZCG&+k6OQZ5jb}I{7yJ{QBOoX<(=0{xsYic!vZ=V!)9V%~
z5te?NCo5mzpIDZ@Zl-$CT$P0)(!ty(mq+k?pS0cH{_jtfm7n+;XC4&bla2YzW8lJa
z`BB@0j)k`uCSFMEdZz2p>^V99{9Dc3kR1~)GEX`-<<-(9o?o4O4zJl^bTBXFLhs5q
z=TF3X&tGeP*Z0b^przI8mjre<_{?4r66KYwu5*0NGutAul>yu5OuhDAdRF4vm_ipj
zxn~_0ixV^syKE@ysx9ncH*MvWS9hq~;k}B}wX)}xapL{Sl^udwzm(**q;Ie|(;;4U
zDPY#Qh^xt>9xlxr&9feQC`zy{U}5AJv&uTMO5;rMs$-jl_L|5AF1tL#&p$TyiNR~e
zl__)j7xes$%R5wFKIw9Sb-nNAC0zDPOl_mywR#9j-InIvzs$eFqx`0Hu$+MX!}aW2
zlKFmX#fENQ#J?yyDW>q|g2Ll7W~xSQesu7oq@62U#kHUB5{<8G9@?3G$Xh@6L6hkm
z$+q9=UB}kRv0Rr6U%Y2$<oxTYA+ujRnlNokjXCqAwR*by9<<n=Nt5T>`dDIvkj3xz
zD3N)>OQ$a>Sk9wgzu;BB<<X0==Wj6V>NA#;*m?5aY6kZAB3TwyX3lm!lMjFSprf|&
zV1ZA63dh;=w_Nun&b(;aeo6Gb5dXnH6S!=X9J($m&yHF>BW+z#8qd8~2Y-7{H8;1<
z4_JKNw}fYJl=aig?a~ofZTUURrw2cn_<L1fd#TIK^vP+r?rvRSc7mZlTx{Q=^s;})
zlP)Cuyjr$Ng~8GwX5DdDmgzZHc~`2>H1=S55fIVB-EU~QT78?kSNXTd!;(5P&sI*>
zzh^kxs90(GqC*OW2N~iFVxBuK?XtR*`ZLc?Kxf;OWfLzwYv(?kthLKfDnh=K<GlRr
zFAV<-7JGMJWZI|9?%(YiBYxu0+@J*uc*L1}j`VvoOsl*1!TN6v)6{yGV2xXmtB>9L
zH+4zP<%qewt<%bHrmV{6TeHFV8u#^+d%x@46_}+j5YO|iPxySVo&J+`ewGCv9p;}j
z46lm0`ruJ+=WPD<`B8~)Z(jU3Q{=wvAKtaej(jH$B<;AG_mkttuK5b3+Z7At+V?*A
zXj1v)<&C?$4|-Lu5>Vvd7hvJH<A2+HeHTrSgMT~LCkE&-Xe_o@P^*2caamSJaT+6o
z^CZ8%JC}{0sDF1XnR1)k=8JG>&Z?5-Qr8RY@(r&~`Rl?N5O}HNqu(takHekJCLc}N
zxbjOoEA>82UA)&+`^%ddkIZh(Id?1T{G>^IclXE~Uwipv=e)_zU*~YF%@&qOFyxXk
zuyOM^Rd}F?D|hiD_IamXraRBFwfd~}y(N3Ar4-*4j%ZHhZHl)8*+P<@8ZA1(oRKK<
zW2d|Oms>e)>en(Ee&+wM>@o}5%kHPZ_``JD)Ev(X??X<>Z_h0Z{F=@d5n8re!0gCE
zz00BZ&U`IA`EOVCPT$&dk3a89{Q2mU=gj=u6*jk5Z=K9;cV}Tv#K&o$8+DxfCVosx
zkGRyyy;bkx`U#FtoR)Su8(fYQDUWaIY5!pL-P5~_C1ZW!O=b2qQC!d5S{@$FYL}TI
zTBg5m^}mb#LXm6s-1L9;sVgVWbj8tA-5*@PZ?iv~wrR7bT88jthK$^QYjT_=Ma#ZM
zFE}N=c3z>Bg;Vuep9k;v{m!>#)}0~Yu<!QA&ux_vdh9!tju%Q?%uLNmn`S%Nx$~gj
zHf;^&-~ay4T$~@-Y<Nr~xcAfC8q-AHshL;jD^9Jyy-Do#y3fz<PWUBTGNWR{@h+o;
zIpI66IXc?bX|L>?yMJ@y>+PkM@m+VqCGJ$jtyy@6Niy<~vUx+L^**;qeoL;T`c;dk
zD`xE7o0_hcB6CjgP^YW4v*E1?lMQVW9;$UstGw+x=}3s|opqth|Lklvxw=o#e9{SZ
zqra*zwQMi=TRsh2bAkP>3xi5!)I<d{lRG^HlTAK3uUVMT+@#dY5I0$W#l3}+e*!+u
zJ@$ZYi_NYr-t9}?&gffJdLx$8M{%l8?z<<oMN-qZzx-vD-|)@5?YPyWK(6)I)N>Br
znym9;R%Peo#QSHrZTmHO_1q_S|M8X`wLT<0$FrtpRhMaF$)UL>l53q0J1^<1*}iYp
zL60S~m*y~Whj!+iiYRpTYk0lYB=8;2*Nd)YJ3^*wo&0@Tu5&_}m&L=`I|Mu>@~>X3
z(JsDo^53s6V{c1-zYh<t?3?m2BG|-PMRJZp(%e&qeoHOOW^B@~oO|)Z4zqoJDIB_5
zuVg-~v`ZGRypT6bd<vI_<w1t;ON$=n-uKA3GXGcA`zhshs|qb&1-Ob-7pYdK_ptU(
zmTuZ&@87p<-S&%bmX*3MJFWg+y#C_HKGr44&1cOQm-m^x^{VGRyr=nsZ1SJT*=Bnm
z`&`-jRjfbx>hpSbdDTNK^Gr2#Rd=^$8+{G$lw0y(8J8HZ@TTYq7iavKSa?CXcJHO9
z>IL^_7Vsv_46X0jQ2TD(&AHms*4JKW<2hun;~uZlx_e@#BvZGfHQWAjDVwgtw|GNz
zwkqYlcw3aEHoI!F?WR~3{nPd{cI3_Do^X-d{B>+ZmUGd$xhzcuO9Phe%s-{=`*KND
zx=pnCiNhDq^?WX{JCx3TMQQW0bT8HKliGA&rOgyc*gSVLYu?fW-&5w^e{fo5HTSfb
z_)T5G9i98SPcMpTO18I|u{7(G?B-4DdSs1%nC2WmbC09g>|?L^_R34&`|es4&XHq2
zeq`l&$%pPAc|PQ1PJ1i4kE`uykAi4tl!ni<gl{4-{!bb<E_HgkRM)Y3eXvoWqJ}Qx
zN;AO~hsBculJu8-zI?${#PVl3>#q;WAAhk++?is%%2MTa-W$2+p%rcO9`l<2`}BN5
zX2}+Xlhf<0t<V2hSdrmi5h@bd>*unXlV`=B{=T_uBx)L`{p~AFzT=x%cz^rTg@;!5
zbQ%_Ez2;aopF_=_YsGs%izPf3A3b;uhKS7kw&;AatZXY^il*Ae?^7I}9IrDims2@j
zm*qdhj&t4nP_emAyUe%B-M87BIAN*wx269V2u@~*S}}c<@O(}kW?hcW`}t<i-`A_t
z^+sE4-p^0{@{{t;K7Vh+E3Iymbg-)9xaWyJQ~P5U(YMWibS|Bk!IJp%+segdg-JZs
z5jy{jo^6|d+kTtRvm<jp{yXNrKWn1|*Iu6AD;^dJUirr|*F>lAc#?xcWxBrm!*%99
zBD>%I71|P*pBkOAF?Yh2ox)GQok_hvp*ZRX-<^NE)tWW<6#2g%>SXwuA5^heXPe5r
zE3eOPOV)4fn*Jqg!}<F3vla_Ek2Syi{nlTA@fDNs$EXW8BUjAY-><m!uuK?F-BBJ#
z&Ps*E4R_2o^(ty9SuaWyU$aQ~&c@>R<=?|(_6V$2ynLzt{{f8?bJ_2l$hV%#(V>-|
z5fZRZq)9&h`uq7BXDk9{Epw{c@%^-6a!X2J-p5%AHMg}*)|$UMC-o<%z%tzZ#?ig{
zb1(A#4lVQGGM#B#WF%p}LcZeS$Ii`X9z@?3>CoA1k*p-4`akDp(W~5i<(Q-<RWZ5A
zVF^1Mr|k}wem`}R8~0;1xst>!b{zZvD9hAHN|oOfJUb!%>u<gmYold4#j|&R5}#Wx
z|1otNdsljFyZ>|RO}WZDyB|!GsIHFbS^32^{_)1--ny-^^EdxE7#8~{^G5E}L*ddt
zXHEIbvG=d?`?f!)I+`r5%l1q?)wiS5WA8?e<!|@@Xss<W;+UlW#jvsb2EXvT+kbg>
zsn=wy*qNT;+OBA@@<z|cX{%&g{@vJMQ&$l@^&VH}bB<ht+9kQqXZZ5AF-F%Vu`QH2
zJ8|w;F}o=`FaA#6s`hoC%(UHa8Bb>{J3H6d(|y4$52eR#f=5qHbP)G^ADDC0`+m!=
z?(hJ%U5etG?rh(@l1q+T2OM?Gs?0B+Z+r0W#CvP&UOKpMo3kV8=3E_tBv$+2wueGm
zt}~;in6d>3GYZ6?x_h;B)2Z2eLk`@1B3F=iwEPVF#;oIQzhggp?#R#I_Wbms%5%Gp
zK8?GXa%gVLwnug$*FRho<#{h$XSrA9%dKSRfOoo+%j-iX1wWiW)#TVkFM~4wH5KZj
z?EB369{0{G=aG3-CYc_2LG8Re*8{^|Q48~m2lu9IJzXfi{puyopx297rH&T9Fk`Fv
z{Kz75;f}LcZ#;GmuUn(_<Cyp7?Xg##nXm3mpQynUKmS#Y<@Q}ue#*+UKE2&0QnPZM
zt>^^vnbz0Y&oC)ndNpZ}*7W5YKR5=23*VkD<CXJ$l6jBn^w{m0{&IF(;)3JM#rZ>R
zuWAeXJj+R+^gAbEevU@l^B=8hLaW#U%oXOnJfh?Icjfh;zRKZR++8PKwj7?@&6~h|
z=T_o9PT%Ps*47@~XOHY+ytViU=jv0dOAF5&DNmaChp&fe!lp2@MaJU4HpNfwthB!0
z;8j1r_loWb<?8AqyZ0aVePVh;Bi>@?jRR|Df8aH#^Dla@E3W1qn6+co8Sj)+yc4c|
zv_A0hUd*)%6Q42jv+Xx!UB0f6yK{%v(fjWUcc?~+s-4}v@XDVPb9no@s@CO|PSXhx
zxBi^H-#KAVwEIW1-yEwy2=Bc9+m-c;i1!}7xhr*lIu|;hKJHxQe}~<F&w_?$pEJKU
z*7~^5xqWf&3dZZxPW12D=MopIB$?Ev^5l8kC-2yDp}fO&x5ap)y^b+FysOHboP3yh
zUZ?4N^>;OFAFrD~J+NTM^tS%VTNraz8k+t2x~DGw#MM`OeH>qUN3Z0M-~CHJCh*q9
zl@lW`wlK^~+;wu=@dayk|5};9^H9Hpu?xdBkNFnvM}Fvs_H9opD|IUCy=z$)`}ZOH
z{I34?bsW|yrM`B{SDP>YvM;Wv)!Ny{A-qrRbkf$O4O<#^9(`)Mj7e6vPrO2dr@G{8
zY-qf9<D%6+{1z0qKYmj1>HDq~M!dyG)ITJoEor>F!*N!PeXLYyKjT%2S)I&VpV&zm
zop`-sTGUdRdu^w+3pR&Zofi7kZ=hw$Xk7BjBC*8VMC)39)T3S92|F&`aZg<3`F{42
zi4`R$O1An3yKTAMWzv5s!&~lYzhv{Z>UGR!EAx-MH7Juks_uFstl^;?ThkQ5=v!4*
zocCv$a?U)u%luv4RRy18yy>q3)-p}rK6m0#6_amG%h_1g?zq_UiY+3!+R-ff#lxDT
zcZ(b{cE5ZlaEpmgWz~)*R&@cdYkbpUL&YLwrw7Py-;wa~%KGU$zNNFx&z#-C!&G|k
z&weYZvkXt;%7rBQ1Gkj_%iK{=Tzylwu-|M$wrqyB*`mcP3~L<bdA3{Jsd(yVoOW46
z^!msBPp+^3$?u%Ovu4q<?S>ljno}<vieV{_lS{m;U+^fYx+yUH*Q!GcV<ybq;2D_f
zb>{B^AN7*kJ1!`n_`2=(p;raQ?XC;%Y&$x2g{sE3C_f*mEtmZJ>kjv<Sgbr@`_bKt
zcWLGKbcYv5buY`j{c!e<k2CfMR-8O_*5v2}vHf@6Nl5zZhk31gox9WLT;!&82XizI
z#M$omytd;V$J~>)XKPRBSj=4Xsm`QmPSdtUR*w{Tgm~t)6`0GEA9gT^{vCFg@kXWb
zv=fo@IF<ML`mB5Gw)NG#2tRkGYYIx@Nit`@T5iq1wCB|9Os~TRf`=EJzGyn@QPk7P
z^YvpNbFKB@K38BQsXkd>tm)RmKU2zEtfp5KSslFRblSo#PvL@L$GusXqw}o;LY;pc
z%`Rd#S!`Z**dzW~c!tx)?-%T4vTq$|&szL&%7@mqrXDK{!YqB?^Dpf3x8rN}XX%_N
zB64F<@hYR~X1vGK*bm>~{_sNadXR`^hM3K^B}zfZnsz;!rZVsPfuumut0}Q@2M@{g
zMVDT1y;iuk-B(_1rGEJ*=2z|4m%mMJkmCyEG(D>=C*l9&ZTX3wwCL0trfqGL>RR<5
z9Qu0EZz1E7MekgC_MBNXy`NRv?WFnTClSITCdZ~OS$X8g68Dy#ha%6mI`&=)v$`25
zrm1^*#jPbB&sKD}?e;Wr@Yb5@m&|%sGJD0QV;75A+^iByw1aNzc6+ICR>lOYGtCj=
zIXhXptD4<Cb4{1PoRy-VdpCJb{_Ghe(07LEjZ}c`i`AD;o%ro8d{18e<nr2!tIMht
z)i)eG$@{1LhWWzT8JewKt5TldUKDfgsba&#j&AN^Z_i09t4qzBj^5$s%aYTSzqHEa
z?_3>@oHYdz^G@85&tm-jOK9rU<twL1P1c)PzJ{lkedPg%s|QxS%aRgq`}50S<Im-5
z{q#c`+Cm&em@Z_-Tr$s}zprBIrFkkls=R}?J*j)Fb@!RL(oD%IVZqy_<q|&}jx^mX
zyKFBbqr)DNJ4KHY9<I^58KhlWz;69*-{}a})CJp?z1$Wp`}ZOTQ^$^@-Sd+jyXP7j
zM7_++{jXry?i3T$G)-d1L?M-H{4b5Wo?YXp4tm_PL4fy#YTn<>6Nk=h?(edkd^hrm
z(?lh^a#i=&ys{@4qmMj&5fK+?eO1L`-If&wPHNj%d$gpQ?#w&D93mUZmOTCALn)J#
z7N-3zZaxdOc-vl<o^(@xFLQWy-@1t6IOe2{Mcbx-HC;DFV#Akr+Y|%;x_KWm%2JeR
z=X~VR#<$?^t8Z-^`*@Q7wzgk<7hhly+v>=-X&Hay#yP8YUuXF&FDr9GFi&FNO!dSW
zRhl!ed{SPRz30}d-DeI~cyG#onY(Y(Rjd6PVx1M40<LGI%Ua`ElM?o>I(^yVlvGL^
zb9?K{IqO(FpZrdb4z<+p=Ds7DeL-z?_>9ZCaZRtU1zy+IoV7vzRj7M|%i<&N>_Qp8
zg;hjEKh>Y_@H6n!<KB|SjOhKoyIxxfwuc^Zjc58ZW4>s#-b|CO3}1%0QkIwMEVZ#y
zQa9<{Q}?f{{5ePJfPBTj?TezWUDquaZdiTg(b=-iD`)rV>mF0R+<kh_M=cA<+~m!y
zY14kM@0M5p^(xOGTqnQxK=E>B_n^4uDIMMQPfR`hOl?AI0v~RDf5UiR;-OmhsJ4^b
zf)7n|ek^G_={D`_q4RCeA8pHZHLH2u+jh=JQ|n_<=8WaM!oM{Y1ZSWAGpF<@(_>S<
zr8b)`SKII&lzQ1Bbo=0cM%0OEUNz2F)?5q>B?_1q&SmChmgp5!?v=cqcl*TGx$%an
zToX=3#k}7qqV2#c6Mb&i>l1BDbuR5{G*D_667EtyGofh9%Kv+xpJ|l|63^~kRJY;8
z&N;v5=AU@-?^W=Bv+hX6$p31It}~ZP3NsgNT=sF&*ZRJ5d(EFrTEAT>TF3j-=b!%d
z%9mA@<!3x$^}Nycv}SKp^^%m5r<MEO$A4;>Smfy~#O>y-)_ErE^&G*-pun)~O=5qz
zyS*h3CZ6|Zjh}c^XYDDk4L5rZMCy4tbvI4la;8G@>`YVL>6K>N+21`3&EK#n>gH8J
zo9btgVZ{!j#+t9EriP|f{@u3LyyCCQ47Ob-Dto!+zpdLDn|`z@z;jvKI?=AAxYWv|
z^Q)&D?`0G@9DGjv?%}{Qtlk-(Z`Z!w-Ck}U9=`ZvPSwW`btZFr_3e7ptglCGJjtRz
z<;>Z$EmIZFM@|%te{t^Tq{a_{yc46=#J^2lyJY6AIV-i@9Xz^b`DDfvZQLsG<x$Q-
zE;WsuH+P<AFLkf}=ePIYv2F9FFHMp1{a<N6EB2q&u0L<n{?t7X{IS_hK`dKK<@1$A
zOsk*TC*Swl5Gnp@?*rBT$~w2a%|aX}zb>^{9yE!2<BEVJqb<j)nD_SA2OY_rW^Boj
zlxG}iw<x!E-S+vD7;mgwai4ov(p%AQy+=bmpI4^aCT8D^JDIt0#S5l$l3Mc378c5m
zd*W8hulyIzdGtQZ|D^}!EMT>(TPVF%Pb>0~{`~sRx9j)qUuelIb!zGl_LOs#_u{;b
zE-vHVaAZxfkjvXkHw`*x99YLH8qI#QjWeX9?R90sxy$X{A9Fr^{PpYE<qW5`C)EN=
zE6ka4UVV?+|F>w}{RiJ~?%pf0|9wo5kK4wd7w5P|g#^Z|lviDqvGo6I`Gx!u3thd;
z&OfnV;yu%~vYuahv3Bd{`gK#%&+nFsjj!1=_uM=AcmE7`&0&%YU-tFe`^D`i&)${T
zetz+MCjaOScU{wGwn#jyx)tg+-!0Z-M@{u-zUgac*}PAysWoqIFxpwMUXSIV%g?pE
z$JGQ>1ZNf{9g=K0ys9CB&v4>%%lbnn#6Mr{66<97AE@W2a(F@B*;6`)R+{b*c^PkJ
z-5~TvDRE`5rBy+TnhlSX{@aQF?w_0??z6c={Ns1osXB@be>pdEZ(aV7a|eUs!DqtC
z6ShBEpK+mOlBn)u)stPf-iyd2tSIP<WL&V<`JN|F<&p${wey)yOKl~$uE;th-?3Gi
zTesL&_F7QVJ>}LMi=5YA4H<IT=3flaK3pyBoT73)!}`jE$bUvT2A#nP(vw#*dOzQ?
zU}nmbg-uq8N8OwlnhzdldUw=Yh3(3`4G!@!-D@<QufM8_`ng4G=gEk+2ex7bX&jdo
zIa#WG8z(TAebi=VW;km;VXej%$&OZ)0N)5{#^MQcRQ7OqZCWC&5w^pyd(9887jwcV
zL|S{Xy;Ne+PMpe=wQ|R52d%XJ4dR>zb8DEnx>Qsy{Myi{60xMmm`5)2e}DJC{b}>h
z9<Ka9{d~S+-j0CkQ+mA~SpmInYSBjwe@&a3DAhBOhc7OSvoVzEhume(+yCD&)qe9_
z#v1Io)K(*Fg=3I4t6a~&SQgzS*7XNd&OXw)d#LuiQst>rsxQBb3M7m7<}Nwt-YJ;c
zzG{QT5l8;aoQYyzzP&u|dBQp>>zhNk-ZSx&*?CG6^(4FWytg(lFj;s-v6x>nVZ!h3
z{p%jz>@o^U%>1I8#w9VqDr<qJ(YFhK#6R}@V%waO#GKc#ZsB3+g3~UJ#T%H#CW?pL
zeetJp>C{OA1v5n@uf6%e{ZZBXmB-BwcTMk^uj*&W@|q&ql5)J(SjB6$TI~AII@=DJ
z6pBvV_BO<=cZGs{XVU!8E2a0ir^??rnjCz6!JMEgfiuj`A3MI$jOj5?b%$23k)?A%
z;`-}lL0dIfo1ESE@M&15@eRT4s#;9<A}6+Fu9vnclg!LH!pVAYMzcxMK8;QGQ&?2j
zFF2$8O7BCE=t<6Xycgr7=Y<(v;IC@yTX4r}B5O(VrZn@W9d-9ZS=4+!-zc>E?<L7J
zW2N`!h96JZg%U!KZ&qq?GH!`toT?NWV!olOI@u|<>V4L?4UHvR*&{_?UyNN^x-p?s
z^nF(upVP0ZGiLj?bKQL|EO_vueW#bPlK)eeeSCGLS~WWB;+qvM1sy+eg_itoxomLr
z+5^)&9l>80&g#9M5HYvIq114_(}#3}J(qGqPnSxGm3}d`2)SG)#aH@;RYw1q(x2O$
z5B{khRl2$|`|VL<CPlGZib}o@Stmw{M^`>6=U%He!|X9T&yv`z1rGJhPfIy(``=Is
z%(z`}?W)LAHq9%KWXcV5*Bg9G{&j4cemaNXf)f!buY+8l?srlwHlJq`^RMIbI{BxQ
zo>uO+)TzG`>p1C5mdnCfzd9H>->_(GntO2XEzY=CEDdI%-;z7RH+w7*I3?|vbRuqB
zq>Ebkm(@u^w{2OSue(%7+xmt*xg_<=Ec1uON9}|6j$F9z$vr)BtAkhDzvzl1=W;r>
z9+qS@T=Uj(?p-COrUjvKd=3XH=kDAX5`0o9WoNK}bnJU&ofq*=a-ItgNU`}_Y+bNw
zgVZ(GC(Mg2FBL7kcAjq<W7nkxb6;=lKJ;i>V}qn0Czn7{!3>H0@eIHB<+0YBu3bGT
ze}{d<Klz8(-W&HW(5%QdSraQ`JtKyxkICPpK<35OgomuBjKhvdGG7lUp13ciK>oOf
z`@*MEv%XqabWgYGo+;yXLQaSCw(!ch@VIY_vJFdn7^-L9cI?cKbJv`e-4(L=(e-6Q
z9uur)PhE6q=KN)j{cRasQ}bi{K0ng<uuqopXZo}Ui3_e}t>`UXcs$FfuhGYJZ&uFD
z3$M+;T#E{F=eTe1QDs5QbzZ3{zg~Q~wSL3aZ9g2RUJRW7YB4uEul(GFaf?rWIB?*K
zmhsoSJ0~wb`CfLydAGUGeiXhsBT&ZQn6_p|^W8f)+#7a&dNcbZ?~b1f6J=eR|4zIy
zgCm%6hjrj>`BdL^A-dCi1N}YqgR&+syc~T}*KEg)mv^M|dJb}*yStOU>GE5?bL$E&
zD8H2n_HVwj^qEcE_FC@gfqRa~omV_s{PM_p=fn?Y1uv{@9&IXK`%omOWchmQIJp-o
zaxs~<GmqVV*`c{}jq>4r@4O3(_xRqlo^jWl!{$t4x8~Br4ykiItZUY1PMZ37XU^+>
z0sSvq_zXNIJLGS=%E$Zjv+^8MN5<4(>%H2oci+ddr*HZ7`6QqH+T0C1M<>l=QgC<Q
zVJKCzyd(e2+OurC^rpEjxR~Q!|BE|KC2VOz&UB%Cd9?-+S6#t1LKmuI*>xf^k0jPG
zN&IZIVawX^o<~V{TAGPcM5k`e-?^rTI2bQPn=!O2*-k$A@<ZWQv-?k;F+}vAEApGH
zJV&fYb#rgZQMNpv#WTDfNVgwz_<84VR8)Pz(f1Rz0yWNEwW(n{#r69Aq{IaeSog*?
zyRAKAa6V^-wvDPvuYHb3Cg*{@x6<VIb2Ha>2iWR3EOnK5aH6ImQ^`R+x-tKF0AF5c
z-|d7<M?0Uo{afNASPCO}s^Z*FzFVHSI4o4`pM7c8f<uW#@BWITwl&j}mV}gQFfgdj
z#oSq)nO9trn3JPdP<hrivHZ40(fz;L8w%q!Q&Vr9{8qL-ue3b#&6hi;k7d5OlQ;i*
zzjyb9vs+zWd7RpG-nYIwosC(5!7=jOvFoqi9uwl^VQW5^kY>P~(>?h+yZzfeXVo{Y
zczP~Sty^vWvrV_e*NeS;;`MG%&-ZQHj=nA`41YR3ytiWK_eZm3e>|Um<mFTm`xCo#
zT-5TPtcf|Za8pK#)%{zu!k)&coGiJiqdikaX}<ocRf3s;Q+#hdNewKXc{;Lk;r&P7
zbz?W}idhn>`!zo@)OBV3l&$~5PS2cUl6uu{$E=gLza8InGX2^0Pf3AOg(J7OzCUyQ
zS>8nP=}K#luB;33JZ5-}BTnaYq?ypB9Vb_BI`FQjvAd*5x7+9c+S1m=i}Ehre4~&X
zq-W{gbhha7bH>0AAIg-(J*G{ph}TP*c;#hC-x2ni=k6^(dv$eZ)%5Epwe&X?h4ycA
z`N8aZ=}#F;OXjrhC(GDk+><8yuS++YIW^PG;nc6P6F;V0S>yO)M%};2dmmp{1wHLP
zw&&cFq*?b*WwG3UrFMGtlj}zMcQ&o+?%XqVSJ>7i^P_!BxBFKZm!G-3C!>;ihw6OA
z^#>#_NdMWX+G+Ht<CIKTXr!jV?MMDEnKVMXuTIt3(Ajjne^&p-pI1Zeb~gR%Vv2a@
z)+I0cHi@mEigo=1dx?JQjcZcXmZhqST@NTtx~eO^AWc(B&-N_$N(Bj(qY-<wxgSic
z(eitI`F~aYj6MG@KYVR3zxQ|f>iv6tj0%ojN}5^kot?l`S6~ruQqEp!$~Dz)=j`*J
z9!Y8U9??7_d-KMccGY$<H9O&bjedUu(k|RsnDqAXD~0(E`}rG1POI&maZ)()=}VpU
znV<3mb&Th*8Tc!;{o1EByC~?~3ZDMQtCy|()SarlcHx&*%&Scd)|rK8d01oxc)aWW
zvq__{F6r(`oweB?SM7><)ML~7ojEq~#<mY{Zf*{CTi;MPFW5cfi1dWyr$^T-xF?)y
z-lNqZtoN>mrEB4`#-J&ls-8S=y1OU+Zj(=0lu|TRZ2F~oRwwqIN2-5aPt}utf0Jv~
zHQ&^_&nlng!pb=}><-_$@0@t&q=FlhZ>_z&WcoefAM^Ajj$I2|`$Ii)si^PbjU9_#
zJYOq+^?a>NR?VF$Nle_09<1REx0d!sH1IG;GUf+2+V)<(GD~MQ7aNP3c*v>Ly{#?F
zellG-`@|&nT*J`@$s=0x&mL(N@v)asY;nnM-!W12Q<KK>JvR)5Sb7UiG+s`fb<}Cj
z2{yM9GwpCrWseBct3i+MyQ*eKHYy~XS#Wao7d3syIa9A*Gnsq!Qc0k5f1`kdJm>xC
z+fNovT-wVLH1Amc=UtY}TJxAUo;$Zap|>X7%;1Dd-z6R8%p*3D%^dSQXPjlarSVbs
z(0t*%3+I;1Ih;K!;`SkrJ5GNN^S7%XfA43v=U!{r<-5PU&ZSxBKCCL|UeR$u=<<bz
z2r-Le1?%UDzkhi&;LV?TEmLPntSZTAmT<9NudI6i_(iSe^_pw#lJgB;MK`b{?38dn
zux*RMeL>ekkB9GDTYjo--O$&TU2x-J<Ywk2^S61pm>!tI*|)-RlD8ZGf)tISPapsO
z=5JS5&z`M+N_O6hD}08pfADVdkeJSXqA=i*laj;|HJ5cMCKr_A{CTG6S=(6e<FGrv
z<JnY$?O~z!RzyawJ~@Xe?y1gX4e`rOKZTd&FI)C4%H}`U4#sUNxAv*r6cgRh&!8%N
zqmzXrahF%Nuj5Qx2Zw1(#DXk1<+9|SaIRn%6<l?SvCYE5#?sc}SHkLsjS_R79Chj1
z`=k8+(dxrnJ4Cvi6b_dsh<*9+wb^B2>Br(L33pXX{`mzvat6DuiL8vY=h`eA<5;#v
zlx2eUgIe3Ze+=>J3i%1^Y`1Gj<XYAA$Q92F`t2yM-EwtS@9XdUkGfvpR6aiGtK!nP
zrc0ErG99%)k-4JpHTS1oPCO5zC2DtnH~3m$`*+Vrn}e&^R6E}`D|s@s2A%J`I&sp1
ztKB(~isuXzF8>h<^N>D2o$I{rQlZ9eKb)&{BhMb%s^s}eDSuK*Lr|$oT5!xsKgWkw
zR&tGY)w+p&7hZjn@@UPvA1QNOIm+OiZY)>!@y(iRYBsO@9dP}7nEP^`2EP)^8Hu|j
zzT_H|cxUwpU0_ZRaQT1FNcNKd4rlI&`5xyPmEVd5c$~^!`q&|LlGD9k?g^h(c|2cn
zWO`{2LsEe5^B<`V|9K9dP-f=Y@#;cb=x$p!Yo;et^B%9>CRmq}@WwiZiD$v<2Biy=
zwjK7moxsE)rk=!SWm8zV`&XKRPDg2noY!rp(<@>QX|deVXJ$~J%A(3XEhps6EbYe4
zYV7A&&bf;^Pr2Z<^;EW5^PBUmA$z}BH?4ggCoER#zuc5HdD9!FC%pXA{ZE?OxG3NH
zbS$D?GH<5Wg2sneN>6Z{(&l3pY%95_<t#m8Me|dU)TmX_2P&2>PyNC*y^cFg=bnaa
zIg`q|KqkXY%?pD%8;is=O!XGBF^b(@v0%$GgEK{HCnYC~uQ_pO^PX)9Gbd^M@-V)9
zxbIYT*V5LY>)Oi$RG)8<Nc(VvX<Ea{wxFXk*$P`<m+Jnt^bLOUdSk(J!v+nh$c-tB
zBBe4vif)Zr^v0O!$(6lZTV`F^H^pUUm%@Vw?`IZnoYQ~A*DCtb?C_&^InFefC|%Te
zuFfc#Xu$u4%lAaiS)I@`b4*g1vOhJrs;`MXP`qUS;&8Qxsz#2k^#-nHYKCqrBBt$W
zIuo*CkJT!!6=GpGGg7Y0tUC5d%GNOFGQUpY%bC86D?9l^ekTa+-8X4+_NToI3<NR@
zmy2IW-+ulGYZrHjO5xrlxizO#O%s3fKNXP-3(FVy!?4UG;m!w>uLV-o``ZJ|6eoV~
zPg-B|@lort72bvA6Pss=W!?^K3selPXkfkaVAG33?1sOx3wH4@n%{jwD0-Qc?ez)E
zHmBB_CQM@HopdsEr&dmp{z(t(UVE_v6VtzNY%z<=ygC2LYu@RhJ7a9N3H^GpO!8XL
zy1gZ3Y^6Rg?-km!o;|93(d>6{@~hrS0m4Bmvp%obsTIh|`nLH^e8tH}TsMTDm7i_6
zq;$C5*DmthB`y&oe%={V!cR+uukzAMGq5c*%u=ap4iZ~`dyhq<#O(N#%-tb7d9^mq
zDErIQ@o(C+i)*!dS2Wi!Z!J+|G<>Vgayw4sr;C>8Zzr=}vk5+Dy_D1ww#ypna+f$}
zujEcDEo66Ls*8`)Du1MF)w6C^THyQl?+yh=TwUQ36E=N!Wvu?w?)UL;YWF{_)ZKb~
zGS6!f!8S?T<C31Ief#{bSSLNGyydg*i^$r~r<IPny7RNz{9d}x=*K^!r0dTY9Ag#!
z&a_GKT<TfoL(fvTnEZ=wI8);<99Fos%Hz#Roo<^WGUj(AdLH?=B_zE1W&dbZ=Wfmm
z;TlDiswq*6mwSc@mx(JXKM-ojt9u|Ta^;N2(iNAjFE5nM3iw&Y9jMdTKEZxvYSk{2
zIZ4ysPJ4Vy`f%x~>ciHKjH_iPKAG>bI`u%^YDHh`D-IJR(-X3<pE&$=Q_^XPECY*K
z^R*=pN?*{u(f+;r?1KFX*=?PPsb`Fjez6c-b?lY%;$wo-tXFgM_6MtUZ>wE;e!=7R
zWen?BSS)T`Y7%WzNjo3c^e^J$?~M{Q#zOl0HnzMrJ0m({%~?B-jZ)%kK5m+@ojag1
zWm~cC`>+M=ZyRo=y!Pl)Pe@8LzL}Yt^6aLnNB2`#8_nmtSM|>Ix%VO5^yRC&_5Z#-
zJsrlp!Q<Fz;h;9jk|RZBYyR2nDfv0?jj_s2zF(3Bmf_EuTc%zQtGyH%bS+CW@RojU
zu4#Bo&YQ@k;#^V68CGrqoXc<A{u4FnCacw<qp{7m7Ju%VH`o2S;_1?v>A$mX?lieS
zum9Q_W1mS3EB0+&?!2bYu5Et$`FXON<J~l0pOQ?NvrB_%m&>8^?j=Wr9FLYnPB^Hy
zYKn-Y>ZPx<m}Gj?cFnl2>rkOLJ7SO1f8A>(3|SgpFK0Hz>8`%ve(mSmo@LLL+bA!x
zn>F*+J<DjLABNtaBQ~~uF0%EHmdcA;Q1GJlO-b76YgG=`o43k^T$_<9cfs2xud-#@
zqX`WYu6V5YChs51a^!Y6^9AO<3;+ABO+Aw#oUPL5|Kl{LuF03fLdo+u=UnFq|0%|#
z65GA@TEXir455$njTlu^`5tjqo)6T2o>_Z0RP?;H)ZLdK4}RQtX>Nr6Pqlw?t~KTQ
zd98g3CDIvFd#3QLIklngW0b4DfDenrO^^3`8axzjdZsOu5fsl5S|A$}mT}>gYtw_y
zj}cqG)&^gQTls0$niWY(>>-n9Ni}5z7rfHW>JAIa_%O3A()RGbLtEM}eG)q3+Z1_1
zR8ah`W%bkY`?c*HrE8b#{oZh}<&d;i-S4;C<#yD|bpKau*>&gDxtW2{E7yz8HoY(H
zr||Fa+yd`}Nx>Bcz3&7+g<oA>`*Gs|zX^IQZnKWMKf1TYoAtfwjmW7k3+B6J?L5TW
zEn)laZH#-`TffrmGWV*<l9dgqrJEGzGrc@{j=Ao#76-?YgLiBkq-*-7J(HX{t)(VN
zTPI1tYm#A?=cc*VR>$gfULW((XcsuPfAREbWp^@m{8C$ZeScy{`o$#=u2yl_tV|Ym
zTcUK1Q}t%Xag(nJ(+jriUN)0qNl4i1cso8mHM=^0|3;3BkybIgxAsrVjx0|8cBjQP
zbo;w#lLb9X1MY9PusyL&E-(M|r>dPFl!OjxC|<mf-f?cLf|Hx|w~vwCjO!H`R~-mA
zJ)>!UfWW2cKR&#;8y~m#?JvLUi=%a(Z#tzO&ywqOH_)HAdwJ#B-hO!#>D!ZERa&*W
zKD4w`Prmu+?X}H0kp>bcrljxwz#gLfG*apO;iWF$zc|hGP%-_w$I8z3j`;C3ug={?
zon?%POsl-Mt^Q`?>G6mAY<>jim1E0;ju}V4$Vg1`pUs}$ySw8!Klev{t6-VLyzhyN
zJ0JGFe&*!2mes@S&d*DN!jpx<uHI%-ouYhc>-YD~TI=_mRd3JVIO&0x%C)P@6g$4z
zS2;>}y|$gzRexdjCIhDnwGKYH)=383eM&#?W&Srjn=bQr>Fo0B@xlrclYh=lSbH$?
z2(PzNk=WebT8itk7l`fCoZcG7@$mU-=Dm^+v^($p=zEhEe>v`3_1DwamA7x)yr4BT
zRnT-xrLu(aoPBzea#b#O3x1W(DdraVB_XnUwS~&t7mFm<h-p?YOmuDx+2(k}nWtG~
z?eTTG83h$3r{f;<-kx*wc7y4ppDb$JY^NmEGAx)_kMBRKen+kE5Xaj+f?QDne{Mzi
zJYZUVdq?~KwtsWqU6^khlErrMe05+C<HY8bNwN1tH&h#l#B=MIo7ko0n1*He1f2ZI
zCE^!f*nN-TXG4nbO6!X=wV!U`Z3{SZK=ZA1&_zy-6OmD=H_jg2bhAICy}EnioC850
zSQmSVCqI3;>?EI&#l^-2TN1O_*BqRopKg3%)AFCX_6ENcIhlWCU)g=l!b?BvzFE+U
zMcN0stghy2u28&~x+?QQRt8T{neV-pfY693nvx96GZ`YEb1zxB-!yp_!>1=p<~*Jk
zRk+hfzfm|*u=gl?3}dFAfsu(pNOEcDA*=QWQ?4`2{JKk_Jo0khyKc4lpY61BcWP8F
zi)ry%w@`oah0k-tjm!Km#C7-eT^8bJ2vA?6+q*+=vEr!-=el#ux?{Y<-d_j^yw$ie
zFjvmnr+fZER@e2{PHRr6%IJ04JLBnzjXZ}+mt0Vh3s$jUJaBW<XPYK_o)h7HX+mux
z*}O;JAMLiA`$F=Aao*wkj*}NKo&Cgp$35e^nCMj2J0jiJHBaf!^ZK|skzL73wD54@
zha_1ehY1X3HeMmma{PDybaI~bt%qa5zyGN&i*_jG)LovS@aq44Hy3;7telq#Qun-%
zW=Ls?a4dfq@vBzw=D`yarPCj`Uredo{X4puqw%IM<BlaVyIea9j4pGfIBl|w32Fb@
zZyNOOb;6szvW^rjfqEt`Ua#}E{PCi7cbu;IuUYz2r|aC&m}LzNZc`unwLiUd`1|?0
zOcHyZ?O~t$f>nTTn!)lpT=$$#O74#M`S83%%jDxC&aAW4^^RE<O?A7ezi!z91u0i&
z{RmFwgK`XR2b07YW=*+f{ggXMl4(|Phz#rJv&B4{jURHHpC7+|4Ljre^3~EaAHJ{<
z+R4at_mIps2?JqUMXp_~buxQitX=MK$mC)_>#=HkQMOx0`+V0NfAI7^W9xMO2M${2
zE-!XGyXJUH*p}tTTV}mH&T{SK5~ZWxIs-2L3@N;QX_jQROp(8<#N`9d9t-LpdrmyS
zc1=OB$je65ZsE3Tm)mO|`g_PV-S2l=&+WD_<#xvGL<crDyDOoxJ-=-2biJl2?$wNS
zh>y}syL4;sG2Yki0a=V(k~7w>lf1uh)@@<Y@bt*XTy4*F1*#K1FTN`u=@M?)r^Y7O
zb7bBV%bMFEnM&Q#>CI0}j?LL^d^vQlxYv~f8XUV{Gw*+&qU*3ZG0Nbcl;@B8hYsDJ
z&(OO*HT{;!Wv*4v6terzpEs>hh%damT>tY$zq~sV5&R#|?+tKMOBdUIYQZhf!g((q
zoa>v$X~G`5?fYK?3$As$`VJbnT|BbP_|K_I;kT=K6+SxO5zc21I6kNE$ew+7QqE<c
z4SlN4_U9Z!`i(?^Tx*prcN?saPt$9Zl<)LvRC$+o>RWh)jnxf{ms9yCCq?g>wf55P
zTW><s1139tzVZE?<b`j?_8ctBcoG-wWZCG`$s4fn(2JviY}<{l@-lEG9^JmoM&P*i
z*(Y36uC}epd=!6tSDm#}<jjg)cXxf{IB#HWdPFF~%W1Q~_S7&5FZHg&Ol>+3JZz?`
zpHkJc*?0cX1h?pSV!yxiMJ9yoE&T2#TE3-a_A>h!Zp%a0$!xOPz0&law5Y@SqAe{-
zZ}&3(5B+-b)65*{qtUtkFL=49@-2y}c*(PU?Yod$O<iBYpUve;+mf)<BVqD&cf}nu
zzE(}1?mbysJo~(*`N7{&To)%s+}xZoRZK*$Gcr&sMQd@d+9#VM3q6l;%2g#;&7Rq~
zkaK#h^DpL3CAXzXcZzdw@sz!AdHkki-Ro6BLDg$Hj31{x^JKU<PvU>(7TtT=8@61v
z44zln{6$^ZB(MJ0T*LVOquqA=)3i%@WR9e-y38cdIZe?1;fZ^zXMR0-xcSv4e#i3L
zA}`+k`8RFZr)&HIUirTwbS|CTnh|iNB+glNO>}P*V`9;fT?^t?vq+tCa15Jb^my+*
zfiu@i7bHYyI*XKTyC}42+W*RRU#5n6$R9Xmx_R2Vh?)jd-T4Xr28`R@r6pd>m~i@F
zQrz86cC&>ah40;T*WW7ceEy;N-Az9}a<9(VYxcrt?XwdSEll$tH|i`;Ss_v*<tVW0
zlIxyg?y6^#ifT*LKecVFPn@)-_01ETo44z&wyq6c=iXFuigl_@#G}~qc|vdZ?0H=L
z@7CS<-bM*8zX|FpaNgWm@s3&VP~%mLy(@&{Y>(Xu`~Rt1x@uL=@%wyJ&dJSn^C>?j
z*ZsjJ>*3byJ-6rodv@5mTkOcbf3<P9rC*Eun$a6%AQR_s>swCYt=RUB-<-P*KKd?r
zAmuVwRARN=mOn-A*VY)dI9y=k$g9rT^e^Mp#h)s3eixh%S^WOTwPo=Nv)I2f&x=~M
zY?l8l?a6!md~QA8u~bv7Fv{j4=ch<%4;i@)zL|~kdygJtG3Z>aCS4I4c3q-uh0&z6
z%x3pTM;=86T;uxqhDGOgtKZ8<#|*PHwn%T!Tix|!+TjGnw@ck6cIjMF=L}R+{&_RJ
zF>>;u!hkDRk4&oQ`@>x-@0PReOH*X@Wq0)r{cBRbeNK4PGVe+!S8wj)M8@`?`#i7l
zFL|=oc=DaE;rX8)KR1=#b(p<Eq}S{2yr`8A>r<Roh-|VqQha1K`vGs-wz8sGA2(a;
zo{nALFP{0--ss5dtVjk1t&0AaNA&+5mh!S{Q8?sw@%1+D8Shpdwt1(V6KXD0D^(=6
zdG+5w*7cez?jJR~(JB`s8U6W7=u_*=7(3?7fOFF%%4Z~n6lSU)ZR>oq_RPXxGgaFU
zJMetx`%uGLvg5+df-k)LCPnq;7(QrPl6OTpw*Q=!#J3%HQ>=Cxt$a48AY8lKC^RFi
zXjxy};S(;deHJIyIIeBXW_kN@e*%}er}u=PvnFchNo}^A8Kzvw>G1yN*6l%Mx09Rf
z@5qV2$?lJ@erxD@xNym}fL1q#G@Ji#)-$HQvsRC|v+D1w=r5{POYK=13!`TrJa|ZV
z#=5pQ$<Iw6&HLVXVfChvnT`_LtC<}criNPWewWDR_qX7<;KPbQ9V>VF#`$mOv+Gnu
ztXaqzFPu7M*J_zZ?UHB0SQE+?i8ed+ONdBhA8GbwTK&UUYHzst#kDuLTI@XAz_xs1
zuK(2+hYs_v6HHjy!pHJ+!5m+Mz1b&^`#ktqA#}JX?~_%2h=5tY$g%YcXKQ9SWUZ>q
z5pkQ%AEWT~!^Q|}l}ooICTweWntfnn$lp2#E3?}xK9$Uh+5O^P@mK#TyI21S@+xDx
z`659$y!YGUcVCz5KkIy9mR~C_b-V8LjG8lT>DQ<8=d~4yF3mm~b^2pa{D<VEq)vHx
zOZMgdM(ouUo7f%yd?`95KI<I+=d2k=qjq0-v~Jq_eFohtnKOj0tFPyO^z!M#bE~@N
z<~n};ay>15b%8{B`)cQog;QiYOAEFgoxON|oyC#GGJ#WKA9RXEN&a`Ph`Uj(^Dm^T
zW%|j+%(7p+GPfHz&YRul`}8emp~<4>$Mmb!6B7dxo|{PRes<xU+4`H0U*%l+m>m7_
zqH6QKLt;EUV)IvtH=nfWuvmRKbWzF2cXE811+U%~_zGV;(xZ7S#MdwOa>yMqwViYL
zH!wbNxITM{cN9ya*vrXQp<z09=cN0N{(CK?CRellfaS01JI?brB;5#lb|&EIp3*4R
zHkbOte_w{3%yYh9Z5tQ4hAV>E_x5AH`H5Xl8mi*<cVlAKZ#s4A>u>k<e-?=e^>a*p
zYf-4t8$A2^TJwXJvN;|5N(>Gk4!&rzYmb6vi{`K5!zN{m4hJmX8~fpAr1D|o12Q`v
zJ3LQHNih8w7`H={rC_!f+qvN4sOQ2=*SGGIJ0QwYyHoD(SB7VqAAe5O)Msb?m+l<!
z=tXgMcH!>|j=h3@vMV2kMT_a~p0sAcGV{!9oOxV@wG~TE@-DoHJsExR*mRkwr`3<`
zJbJ#qcm8+JU-yO5hq&v)-{&9MbV1#Eb8fVE=lQQMZ+mcgJ?Ux+IIAAUUd~@-C|!EK
z;K@(9%b%{69;v!nA$xxH<mBEk74I;SMnSs=p&XC9XYFQu<rBbgo@=4$W*MILy-O2n
zGre2C{ZpIrlVQ`NHokw_C!Ma%c&vEy)rBT5epy!L+{lKM?S9Kd&nHUEU)^iUbzeKw
zr6ICFB)w(szjgd9x8|M+w3jIH`u*BWHfnB-g`J&m-2VcB2Ub2|B|==UQ^WFt^t3Nm
zO)fI{_-#+oJAJ#y^>3~Q_wT-adDr(}TNthO`ZR9X{N`ifmw)Hm?Pd4**~!VeShcNI
z4M?azDiFqaC+c!pgyn*ND^wi66@5PWO)J?T*nR%tfaF`}Rou62=-ECYB;cInzHnu`
zfXIF7e-Z>V_?bQlO+KT2_C}@QCIy*)Pe0tv{Pgg{RmTJDPL^6zq#y2gddRSubvo~o
zq*kVs54+iO7KO(!?&`^YXFIunTeV*BmJe4_4hi4;B)#Cm(l!4T&b=$^E^hSfb8R~=
z#cg%q{OxDo+1RYSY-MUTUvCz!+xBwH)hRJ51{!U4k1XA`*uG!8{6$jN@r?Bk9b1|c
zV^+FM(U7oin*ZV3UhkC!zJE&k3$|MIW-xyGeo@xyQTL1Bdh0}szdJHty#5hW-?V$u
z#np@AJjJ%Yy2B%N{lhMI7B<N`@z&V~J-I&@Zj&(J?rr(Gh$mS#-YQF<NwV|#556y3
zW^We%{V-PH^<uwU?b96c{K9S~c%(N+tDmoacv59ruCRY$lhKD4)kPD<&wV_td@*fJ
z5YGv#-{)_+E;U}6dANW3iT9l6!mlpBVS3_9t`T!SR}QnU+HrNKx!1yGAMq|d>vp#N
zq|m8~Cg#i+*4qPKn$6dLzLEX)mXPmiE0i~0-N!CF-@|>^+c{h6e&|e|8UNem)VG?W
zSF=PP8+oelZ?xLI*+c)S-j{^$NA()Zzt_KUD2TcCGJa)lob{^M;P@KdbBpE*pW@oz
z%X9Ml_0~x>aoVvbcEo&nI`MJ)^v>%k>nA;OXIWbO*ZPu+_Z8twY2WJg-U)8aJ2ESj
z?~A0Kct_6Wy`F9DwTDj~nQkq;?cKK*w`4vugwL+oduIFNU)yi)-SFK;;bC*#fvss-
z>F;mz6(1D2Jujzf_v8fI*>O9TPoDj3ccQ?R=)(Dv)7B`-zghOT!RGe;XKs(aupHQG
zo4-Bh<D!)_{7)1mJTbJ6e7kOgd-lG#q+fMgZ20E4q!)|b?D0PnHq&zEPw!7cix&LN
zJ0RONYu){nn-Q#a*1t=d)@;3hB}+rbDf_p5?jCouzPG&0j~S&NtlF7)-Ts#Bb-Dd#
zjv1dVU14QWI%C82<+ln|Y(%54cCGbcII(Pv=%Qf#Y}=?0SF$bI8G;s^Up!-DAM^9y
z^?hG9{<y&6bj&L5wClOg2ev$TeS`DHZ=HFsKX6r@nb+m}tjl*nXRl?-KMlUXi<+IP
z$<N~5IL`jpb2@RnUO4f~lu2p-GCY%GmiZrb3fed!FFo0gt98}?cug0hdm(~aPfp$I
zj9<=d8NEr@y;Zs8!{xhEOi!{M{8o4PTmAigZ=S!-ZHwQV)t?rz_wa|1KesgMo~D_l
zUBBS>OU)|$vS@km`%jWKLhVN;$8L3BlzZ&_*{X*b3!mqt&-&A+e(93jht!g-pP#*7
zdDK*Tb5=t5vi4~Clk<1j+lYOC^WV<$-;al16?Yz7TpRN2O4Jlqp+!57?XR_|s=g4G
zVZQwE)BbyN>n!Xl>widfyEpOAvtInW|M7mk({5Id)iZZ}5p4+xz4l^?<$JzN=`+hM
z(|nB#O1}3P+E<kq{d)EG_7i)1IoWxa&Xs&odUb$HZ5jIlnVKK#pBz43&UP-!IWG5L
zz2xK7o4+oeeekE1zxeCg$pHzDX|tkFzRkVx`=sf6<)iT?zh14DUSg@O{?eyV^3Q6a
zJ#7btHl8w*x>LQRci+CYaPCOnw%>IIEn@cOU7711N?($i*!|h<-0OoME<cWX9KgE$
z>e-YBRVp$%5n{6>Cmf$_8GAOoyd`0s(3j6Ek2yTO-Oji5K>u65t1tN{r{10N+04HE
z$N8L(yV)mpRhP|VyY}IH@HCCiz{CT(lb>&%RN`H9Pl4f8MzWFZhO#@kuBES;?<)$w
z3+4Yc_XpRXfGhKEem!Qa_Gx0Gfd1|amY;USPp<m>>c!iK2lw?~Jumq1>&xdI%=rag
zaTk_uQcTT^-eYfP`OEXd)16!Wq$)ptvfj5sT>t)DWoe58%PMBPmOA?SY585>L!Jj7
z|Jw2I!!+5-!y9EC>+bx{`joj=D#Dj()(k$e$|T>O*&p}*cW<pI{UWS3xqHj3n5QKS
zYI&EJReV@&^`>9%fUx}|jWuUNca-=Fs{L6uJ!Lk7NKJR6aoMunS+3U)$}-;Nxe{p3
z9bnXScV6JiqndkmO_-tS&$4W#)6vU2zm)UWO;HOJ^*Ug5ZsN<D;umW?&#+#-u>aDZ
zL*6qbREv4i)wO2vZFHS+Pq&v>i1k?f+?wgZZmjML4KGB<%-+1I_}q?;uc6_0&iDOT
zJ=x@a&ead69sHCv3YK`U>dm!LnKB{3|M2d#Ka<|E9Apk*yBJwhH*FsOgY)ui>DAW%
zYyN#L_%Ww`nRWf*`8y(o9@mz}*ggxkzH)NOtEU@`AJ%Q&w140Ag%v&KCCB`_Dyx-i
z&G#mz?TYm_lzFk>wB-EPQAMx9I$rp$xo;=nXS_7Wu<-ne#BHjJ{F1U<+?Dliac?z$
zWmEUdJh}RkowY|v>#}y{_GcIVUX)qEUUDV;<|dB3+>|{(y13YL*Ij7bQ?;XR_R*tm
zef%kN=Uz2s2yK~oy;dSRYo~PWtL^&~J)V_qEp1oRiWiCDTyRuH_eU@110(miN6Gm@
zAEN>do7M`3mcEJm%Vy}bSM2B7vR4-QO{FjS`ZuPp&NWc|t@b2J@9rFT&G~n}fBRzc
z@>B8kRc6n=Sji`Qh*%t6)z_F+UM<hl#W7dmPj-}Rwo>q%2*-O}$3=Np&3w%K&feAP
z$+~{?-^`v>NBc7Gx)?;%rn0v!OteT{eEIsW^{a0`Dp+TtyR!fLx})n&*FW;e&}~XD
zSLh1Mv<;VjWP2gu;IRindnWu265DhrLP>b0KjVXn;2@2^oc0{^?q2%)Tz~%CxtCv_
zim;FoxasS)iDA8DvDQ^fvAZVgJ^vXn{isaPije4i({}xw?U&N;etRdFlr{Z`tbFie
zMQnWff%DS^Uj5iuyOv*uf3ba|Y*Bp7iq#^2eLwp0r3Wthz#M00WuCc8p1X8`jpl+9
zVYRGxZboIX_pVL&7ZxvD*EDSr<5juJtY7z!d}#<`GW;F?^k46t)~uAZtEA_$OT;X2
zV>0>Ly=mG)=7NrMr+l7j-_5&v=AHQdutUu~p&I<pEGM)C@-wM#x-Gw_!t6&;twp?f
zn7IAzx3;HqFCA<>b?#X9e)p!lhk;4;;q#re8|Kfx&}c1tTswcR{ez;=_KB-FyJr2=
zN){H@zs>ei)`~&E<7B?34ZlC%cBL=dwt6@JYHoOZWB=*JPhGji+OowfKW1k!J}y|1
zY!f`^-porc_DAXk?7d!|x8m`OmsyE+!jtsN&aa&jecS8(9KVH861P9zEL4+bn0i6G
z?CC}}m;RcN`70-XX#8s&ns7w$5u5#mytm4ha}JyKbStbr<$9@YKi{0kVQV+5@rf=w
zE;`TKi#;addHe%kQ;EM7Wo75Y1Ll|Wr@xH}Se7LF)aX3h;R7`Zle0D!eXW1`dCQ|S
zH@`~W*jTJ|(cex^MqS>Y&)((mSFMo9r_(uOOIF9M?k;+G<=x5&>32W5vnOnL_w~vS
zo-04T?~~el=`+`pbw>FO0XHrm<>Ks;S@cng@9|Nsjm3v~bf-rA-n{2^;r@r|(SMo@
ze<l<po_VdGq;^@lvz#Yh@%7b`!o$20drQO=`m{I3_X<ri68U2LK=ZD;)HVar>{X)c
zh5xU;%4Dwi;m6gJ&-s^!Ru=~`H(plTs>wSkKjFdmbyED3#DgXOy+3hVs8b^7tB@sI
z-TKFOwmnE)u;B3Ym~-g|<=!rB&P~X&mfX8!>sp7_t}9v#QhrZ3=W*1paZmX(=M%FR
zPqLCeb0y@_<ot)5^262Rb<VMVO4Z8j{&d+(z9J_-<8-%#VEGOn{nFEaUjArz);io$
zdT@bCd}zfo=V$lVrqyrx{*z&X+V6F)F>_C@xa}T1^Sa61N~NstkL+z#X6egq@hklB
z;@7?~x7bBJuUdEAk;w}Gv@_+=L58M2lbvUN@AG(b?n2;OS5?Co_A?*dRiA5G(!F}I
z=9PQT*`~;>Xq|uPkl~&BsdJO(ojiMk*(z^8-&*DqTZ0-FIGZ>7t}V!0%XVk|CjZ#b
zBbS(Do~Cq{A7xj4x1_54`i}Pg+bbXJc<vT`%G!g?pt*c&x3rh$>WT4R<_JA_HZ}QY
zWaZ1LOEdEt9pel3te(|+$x2%1jaiYd&5M{Gro)-n_Vu{uFMrXYsC9E!<VPcYJAL1L
z$(z?jHZlu8Eq;^Osw<vxCg9<=quei6Op2RPvfeP~IIrmUC(FWaozJvk+*>QKa9Pjx
zZO6CCSswiTCE$?~k5A~)ty((|DtBLqwF;<`*70iYc;LG2KAZYQr>({rvvclCm)?26
z5cNCXv60cr!(eSr_Q4*B>EBa!NUoRVYhHAF^TiEi9G*-v#u_nY31Q52N$Xt8x@O;2
zJESs4bZOJUFU*=2ebdgCJpbKcbR<34`?&58CyfO?J7v10j&skywQgto&4+n0TXgU3
z+Ada9YUS4cXXZubul!%y1gmZa)h_Ac&PaMMay{-IpCIQEk-2`dL5I}eU-f=tHl5q*
z>2;sbb=#6PTK^sM`^7QU(bF<Bk3BH@n$@90GdCNURY*#D82ijvWSjPD8F$ZK-o|xP
z>UZ!)d%es3s~_Oa%p$_Tz`((fv~GLU!i<aOFUv777*;VbfJAdsi}Ul6N;7j(^m8-w
zN{aHq%M`QoAD@^Ax~F6&vxkz=_08fe?2qRh-c$BCr95rJ<Gt)6j^5t7vy;0*JWg#h
z`cS{W>dS0j&w0K@>O9ASHt*gA0&#b16zytje&1hiKZQH8{L_~r&DZ;4rf#woUvGBw
zQP{k?+4JY_5y+o)cAaj1UiHVfH&5T6d#HZDc=-09KN`E2iFsG*uTI<Cc5Kn~qraY{
zTs6x!oWFkC-)&Pr@6@<Hd)Zsp!0W#8Us8k1)z$a^Je$8R@3h~6{Z4mIWhqBr)V)=7
zxjXc7*Xix=O%iUF?cCAwEcB{PNz(Nk*ZXr$9N(uawpSy2#Xhwai*D=XxnAsC^``3L
z8khJj=9}KDC546w{nMHCm2KbFq)<`wyHA!(kLAC6-TR{HqLsxTSFLi{{MP)o+()hK
zkIVh#?+M$<_AH!~6uc!i^8OQb_55wQ+{)|9E(rXq&bYO^FYBAbjPI#`cM4oT`pECv
z>6n^^P1}TT`*lf2p5FH2>8F&-X7g2f8VZzEruokOvS?Znr^AZ>p_7^Cia3h<-aWix
z^`|J|EmKc#VwL#3E}rR@`l^bHA)-@+=7wI}^rG7}v}CS{>-@xbU%oGUtY_w0|N6jx
z4tw=S%05bUm#6NY+j#N4nFFuN&#6vE*K^lzPu)7F!*mlz!<>#ZXNiY84EGxN&7vQO
zU)|K;8QiP?dSC7?UVf&!6J?jZe$*?){jd3X`1a4MtLN{lFE{=F?)mrpb$a%D{+kG{
z-}TQoSl>J61M??d(b#=|=e@kU<<D+6G4-^M@(*n4bG+YpCN5Sx&(mJ7W%bm1=R}U|
zz(aRdYUP*S)Kh3(^ZxX<m4%Hf)R)R$DrJmWs8zSat?x&2ur9AuSJpDNzkfDgiCr^M
zv2o$m$M3h9PJC0ld5XchZMtQ@UY`~F{XBktmBcIFI(tja@JCwvf6ecI|1AICk9TM1
z>))@huTy%k_<ByYbL^aehYZ!}he{>}8y<LP$}`nE_LS(FmO8&XhVFLr9~*hRl>YE#
z=Zjxv!prLq?C;?}aBrJwK~|s7topoDw?gK3v?$EI)a7{0Z&RW=pZD4KiMEICo7{5$
zWMqH({G`7EQ9rNi>g-#}|4QpWW6F6Eg>yC&E<fQHXE0^-`7fK2Wn^u+@ac&;|CU9r
zcVsBwepA9Xck17od1afTd{^A~t&_T4LCSUB+6MM>jDl%X7tM-$n(t5|c75s`zjWb>
zPsP0a%T5<v^!Erkmu6h3c+Y%mPs8fjKfe}<+`Hjqdx8HV*Zw)P`3jd<_HnPeF#mp+
zivOSE7A6%v^?%q~RBRUR|NWfTW!jq{-R3=w6Aez?Kd^ZFhg5!FHhG~k=8BM6`;Yyf
z&)VbK%kR}W|Bq??M~;~>PwmB|ryMy^A>6+_tuyMJHt+OpQr#OIUr4E3f4eK=y@y%+
zjJw$vy>6_3wj=ypqTzH_A63r_R~SxCys@lydfLp!uCx1u6yBcGTeIn1)q_127GDec
z{DZgmP7U4WE7_qPSz0tl=$u52NC8`f!9Ica0sN63h3byV8Piv!G#DiuQ4b5+bl~Q^
z&-@X=diM`Wc`j#bG-=#x@KN2!_g>z0=}UTXwY!wwvh5RUpUlO0wez?Bw18Z`x0`bw
zF>Kjv+|Vt=JyrYR)q}2OfugTps~VWDiz{!k<w|w*x9H5eee1ILHKA=$ORU-ZBG=E9
zd%ED1%=S5z*K-nulsFnMT{><0)<`*GqujOoVtXUR%Y$-e-ssUVmp^`)HUDPCqfPM+
zYHPdu5}0>A3ffWHCOdoiG^;xCb(4hNvtIGM*;FIwcr`IS;NUmoi`*yY^Q|$q<Gs6R
z#q;XGUo55>S1WFb1~P>d9)4%(-+BCt`<M08*2VN0FJ1Xa>*<n2^S2U-KC`b(<c-|&
z`sXsOSL@%!+D!SY8??}c>8oqxTh|V&+s&7y-t6AgcjnO2<N(p@31J<#mo>}AXnyGs
zy&Zap(a^=&e#>e_2Zx*XD>lhCHm{O>&n>Scvs}O5@XP1IX93faYKnfPDQj)fY*}mO
z;$-_deE-6KCng2<ep6_h{lMaUj-#*0E<YCaTTWm9rK%;c-TKIVV{cWZo?M>lg^Haj
z)_#$k2}>F`cDH#3Hm36UPkevPfg`F_qe825GIPL<H1*`4@pU!qX;+rdzgN?|xAt;l
zX#Ct;r|z0BnZdYa=Sz)L?uU1BrtI7nVt1+8Ay6f>FVx~j-S^cMYnT^UH0o9=z2lBa
z)N9$pGLiS|n`8ZXj19Br%u`!X=d^jx)D1miM!wHh?3%9@wlU#Iak+`+wsujch!_>w
zHPHdZw{*KS12TVeJF#R0<gEVp$a;b9jieX9b}&5g_<lBGcE>@sB_iyMTaM-i>!p-m
zY>Z@`<euAjEA8mY^C8nabC+2AWqt8edAv$v;gki<?yGwYKEBv<;T^BT(VLa6?tf!0
zYS^_kov7eiGy9El$RW|1AlU=c&y+`r9JS?e-{K$h{6gIxuVbrK{vW8j;xjir@%uWp
zmH^Qg<saBZn^kvC|E9bx>4?X6o7@xj1*haz{f!7}w!9U0{^*y`uK{mvM79>ko@Rf{
z%Iqb?zlJfQ^PRzgiQATmEK$zCo4&<y&zDLjRW`15dbiEP#O9=S&$gOUCVsMhN6c(>
z;pxVn>=$l7_PhN%>Zk9<|DOZxCvCbK_%?0wORf6Q_ft-uo80`Y>Aggd5Ub+i^;-I3
z+&f<ehuRj0)`YS>TFiV$a%*Ak!#fqzKY8o9{w{7<{5r(p<M*eY(PisGgUUAS|I%3K
z%RT+*{FO6T?|pvfF*}1TZ;j42R>8TldbRsjb#Fa$LE!J{hQ)4*3_ru4Dx0yZsX6S@
z`gKqsX_aES+_%(@z4?2xu6Q%GdC0mfJkz_3<tyKpGHq^yD@t2_z2Z|=PLF73<Kuog
z-#jmN>+QJ1Ie%@Bzc0VjDqFt0H1t}zWB;rWzw)-KSic<O0|DU{T*vihDBryieV3th
z#}f8m-zKiE`m?+6--AQ#{geDIoc$T@<ghUDMRLi#;^hVJAC*qG-x{iI%HnXLP+BYd
zR@FlGP<gSxGP8NUD;#)s>{_!t(+;I~hTaX5Q!NvsZ)~#V{Ti~>!tVAp?Q3WEUh}`F
zKWSMG(^1z|EB_wxu=%-4BW!MP57#Vf;ijhzp&C!$I2_1W-OLs6$R<2VYsF%(xm5=@
z@x5aAujFvf{n`4XaQn^9RAuX)=!1TD?p%3#f5{J*w=&C)d-y9d$o$?jduoAPQpkbH
ztb2N|PV;$wK{V@4!&6`0S?9LA`29^pOyS1#(=*LYuduydBpxX|fqTZUxZLu!=cmSe
z)JTx~aW?G9)7?7?IQcBJ)LYfcS!!+u@-E)S6JgR8m}7g3YhrDSs#Lye9RG@SZ*3G4
zD$hr+I~;dRY)#Vd#nZL9zcY7#eVNj8kNKEviMqV_)iTZJT2EHjC*|7iUd8j<&rr!|
zZmP3^$EwUnX8r+nO7_e0ULIWbrbuSX(nkq(0o(j}k0%N1IHp%*d8se>p87k=_v{yC
z2B&97F8eOr#XE7skwX(L3<d24j0An&dIa#Lxotn>p?XvC$!_-MGVbJ@TUT6kE-%q4
z+rX$2=@!g+tmyrj`F(o}75HDf+I(Im^!V|cgM#L#3dI;)U;pu)yg2N-Z}7xZwi~zp
z@JyNiRc;1@LIyuW$}xF4=kt%=%)g<(;lLEvl-njI=L4E9)-3Wrw`JC2<D=akmv=E1
z8oZZ|`XAe6|6J~w)g<fUlN|x+?_x@y-&5}9stdUE_?f0oN&o7LOfuh|9}duoC{q#3
zn(?LT(a{5&7uGoJsM5V=`R`P(dDf0;j8(pg?vt7<H<~KR`a4T}TULF>{H&Vo=ZB}W
z8g_Ty=vS6|R3ovZ_m6yo6l2HcFOuv&mj#vkFW*i#->h&+{Ok3`hxe=3&RBKi%VEv~
z{IhoNZ|zjy7J7B_&471d%q0RTGW_z(n0s?yuZ+~a-%&Jc!vRLcf4vndvuu=n7ra_<
zSNYZ--%|a{Ia?N)Dw%Y8znvu`^>mL@X5XLC&Ww+nkKEj^p_{d@D=hqch5aVq8$#j#
zLelLOYI05-S8U##JJChi>z9{n(`#1KPR;t+Kdozm^nNP-;gx@=cZ~mK^pA*_wF%{g
zs?W<KMB7(=_%K)M*3S<we1sa3j!OxsvmBXr{%hX4J%M*VFDNk(Qd>4}+2;u!A)MPD
z&(1Au_E5Y1Yh9k)tB(Az<JmjX|0avATyePRM(mrP%Q6~OY_r#1l;YdBp&@9x$E(0K
zQ%~j;AAi06((;EfNelGbI*zXqbh+|)!_?*3lae^AeyRs^q<Ltcw7-^XE?qQ_JtwoN
z<;>h?%VkeoJ`=n=gOMk6;uTNM!cPu+W(3@EHrU9ika(?q{g#OS)D>Y5gm(u^ZI%^Q
z@M&wEJmuI+>0Q%`ip$<UN|0V^TcDiv)v2aEvnKTNoy0$LYVN5#sHl;-xY#pvUr5;V
zop#~oeP>rVXDP^k-`V2zbb-NC<-e8x6qAhSzPEUE<kF_YJKC;1D_kPYePiP3N#~9P
zZWlS5eK7A%XZFgs9!~nlU2e~PkvFk$<Ceo4h0aHI)Gq!R`GRkyPd$5f@$Iswd)Jf+
zPgddHCBI4d&&l&&rceL5{pWr;*IO5EvxT+ozbL0v`lfP;xLV+b+wWWFic5=Vy*#*5
z=IhtgcV%66b&StW@7|UhRo@{UkoHDy-ZbxR$3;(B^g23C7UI2mVR}<l+T)e3F_Eoz
zKWn#1{)q41H2Kl;+`H4WJ%20}kq*o`dQr*c@pM6(x{DW?&Zs%bpVZIG-~Z&1vU_9U
z!7iqNofkbhF8C$2&zN}e;Imf8HO*YEF%u$q5AXW4VB6s+=Kj_&y%1)h_*to&RxH{m
zV`aEy-b03ilQabUpI?ZHGJh+zf62V8g-_B9W_8YHStGMD%KGG?du~_7jx$PMPM9-M
z!&mKW--VQr%^yxG#=1Sfl(<s9e!0k=1k*S7@Aj*_T)gnvVm={WxAzYBR?En|H2*ev
z1;bTUPP?*@r0onWcPFOpRkK>&b!no|C%w0U)vG?u(%cck#=P{t`vJC@!5mjtsg%9F
zTmHFp^PMoE<$<c6KN|i>F?4<Mi1idX(BUTX@v^^jg2s)%N(Su(*Y{5^j*DPB;2gPF
zykGcvQbm<$QpPWVZ;3CPomBQt5*A-2?Y(uUUuF62oYhPDzAd@AfZsio<wy8ivoDg@
zSH!!N=@q>{SZ3mSCB1#xXOHb}GXmZRn*}8{Se<IP8?8F;bovUb1>)<buPLaAYJFeP
z%{S>1XN`A2{=U892Hd4jHtsna|8nzU`8N*C4)graR6MXcE_UGOg=d)wZL6(RPA%(u
z;Bfnb>`jAU(+#ucF1yLW`pr77^tA%({k}72S^iHw!q~!RrSbjn#;|t(jPK$CRjYC|
zCOj=(#?;BaigUH&bK`~6-@f|v_s`p>{-62fPaZv1<GS;)<6-^2<ugkruiE)?QclLo
zS^bw6yq<n{nbvQWYA!?OQ`t3jcP@3ciWQygooE*>lNS`$-F(Y9T1mPl*1Jo`?}+WD
z_ZQ^lgU#M+91sh*AODVzby>N}4cVIu9C_4~1SI(k7da^1DBEIDC2--6!Cvl`wcg7G
zR!GUcWBLAb-4xMhrhK*y$HI!mBc=rYIagHazt8sen?<K3m>=65U$V@4=j#dGnO8sU
zvb351tYc2p^Z66xj0Ko<IC6ia&baNIn3{1`Pin4khLH?2(;;Oa9_N1-XPHQOGpIQK
zWw^VV({RDJGiqF{YfjvE3!nOU`Jq3aU%SmVuBx2ywuZ55*Cp0R50w)dc&`NO@(ME)
zZBg%BvZDNCu*KuPr!2ZUn)UBePWxr5WgU_AIk~|0mbL=hhO|eaoOe$#e^~D*acYqr
z+dtFr+BEk3Szk+yx#G?~GYRxuxW)AGlRzP<Pq$)hJ=@=vvTtYoR>YFFvRmriIrB}a
zPiofG$BEyad#K7j)Qjzt&#Dh=f{r|qxFjB7D0wBqra9uox<XCCxy`Ny^8)4{@;}q^
zf9Bi+SsS!IGm1P2%X6@8i}&EZ?)fnBfL*c8)+5RN*AJy6pSgX^b?wiin%vSmSIuo&
z_@-9*ZH%L(V_w!$uWu%y`|iv=ELVCZ%~VTj%GJ#8ZR#(4o?HBP{`ETLMx?pK%!SuC
zc&qlgSI=88CnWOsBA4}_Z~AnfE!?tY@_pB{3W?4PF=7g@bKYcx@6y~7!T;T0?Y~uX
zWoIQSbgropx*JfCcUAq?lr#FLpJ-ic|J{(BX5BVx`NSVv4V)EDybI7W50l9|ystE4
zHCxQDrw>kS`s^^*B51GF{WE*yM1^x3jTD7<o)QW<IKMO9ZDs3;v?HrpLJcgc-5N{Y
z8f=t0{2*e}SBHhKc+_s(|G?H^_ji(o`x>Fzby4%3%vq(*?x}wxJhktWQ%u*?DWY0^
zfBj@{JNhT;#T_=^rMhtS2eHnq>6>qH-L3w{_9$JKL&dr+Q9Ws0Ucmv*j9q^gu6XxF
z;_hW>E}2~o9s!#2LE5Vq`gby}PxzVXu(*ur(MF?tF=|rt6+%x1oZ4w~FD5g^X|{e{
zK!Jd=k=gs55{3<LW9+Ph9t(Ldce04x^-y7F(2BI?wBW}v+yCv<(QkM-dtFV*;rqKT
zzF}x=W0!L7{_)~Xq?!Bqsj*8B$W1pp?OXfU>twQw&#VW97BQTA++^5HWPL+x*}K}7
zEZ%!ARi$tHc@6>QtVO^3Sa=`R`jv{;?OOkDgL90z@xJ384&io}SX#G+7H;8eo1G9W
zmHE=Xm&sw>jPl!8SJkMLug-jL+hG#ommRA5=4QRr+sN3*54MH48k%emHSOP0aQgU3
z<2j6<6<pq)j5SJIH`i2nUgh8Fofpo$dZ?^(d}oUd`-Jxa#dohyYc9NhSZv}8zXwLw
zujjTrtrBW_6g|Ot^`cb)#ys<Nzt|eOKDGH|RGDyO&Sj&3=U(Oe)x|mb9-b7=Z4S1-
z_wePy>F-Ze{C{|6|A{5NCwB)j=xpjyvv7aNCnaRX@j-i?^Xn@Yw*P)|-|-`R>ZF%5
zp3c^N;qY2pzmL;&8}}a3te>6Co*Pe9c%NTf_hGM}wxde=M_B>;eOp%q_AYIBsU2A|
z_ok!7Jp+D+)7`Jvt=zVE$%>*?i&M&&%|7Rz4^C+h^f;bbCG*lrI%fH$tSx&D4m*~(
zr4_fBX&-->c4A4%)ibZc<<{@itV~gv?YSWOcwBz|y}+D#U)Dd_v`>H4B>!{88o#+C
zPwm?MMzj3w?47$zTCRI?d7qEF*W%t9E#f%uc<jn$eamg@DlSNt*`%HQc(_8NYUbnV
z9*6dBwk|wyHO9(hLhcsV2P;pV3n}Af*DZMcarNv;i8_1DD&IfzYbiF=jl34zWxH!?
zsK<?GCsuntyUV~`G%r;^><o+hx=9A}vOk}Z;fuE7%HQ6;_nZ3?c80mnk2CW&AHT%b
zuiDJEVT<jbE&)Rc9)s@dxfgF;C}8OAHGA+{C^m*A)bM8y)4o4*|E|tcyEoZ4KeFnY
z{-QaHmCoorGT5`>O!!$bpAC&R2c9l-da+~9q0$*Q|B3hs7kXb`IPtIPp1tbk$z5%h
zGB=MVsNIvzW~{1c770I{ulhko{lc4%Cd^OQ-Z}B(P~VReys<wdCR`JIbnnROnnw2-
z!s+vszt8vH^D@CNedf0dnwMPtmbuhUa6j8Kv1{h^zaFcnzn1VTSQn=}o$czy@&F0f
zOE0X#KRlUS&3omI##VJ6yJI~&(pPP8Z~P*9CyxE#pT{R^g<r*;e{;-SrgmNMalPbK
zXT6rb_6?QY-Ojf>?s{mb?49K&lg<j(t@|9kf?0Kode0-3*VXQURq22E|F5((IWx1N
zZh_$MRU0k4Z~n3?<+pIXBygxq?wK0<qVw#F4_RAT_R7nzj*sL0a_I3z<#h||DouCk
zo{;=HXJ57d#k=8KW+(=(wDRi=FTOl&L;W}FP~ZPNuS{w;XGn<T8ASAV8?9e-Pe)?f
zucucZ-0k*b$~bg$(t%HgmNLE-uWoM7`g1z<U%r@GqS$nkxLvLVr8oa;xA3~@9XtGb
zvW@&hM)w;t4A(D|%an|oeeY}Q(LD*ma}{3vI=toj8MX4GvQwnAC&)+M*fD!u`l~z3
zcI_9_VeheDdP`p{+fn=D_x-cur|+3oDsgMdG3k@;Z<9YoX|A9CQSPYp=4}So?p4pK
z;`VkfOslV0cy-}Td223-#Cys%tmoUG#p@=V6}5hB#b;E|e=}jpDWM*-&%H_k6)(?a
zt=HnPi!d+UIcdkL#R6$Nvn*JizW8@}y74^`=KKFQS4%!wXtgpW<5I<o-~D%HGdC?U
zU0s*4K7_}^MLBK`zsu!}ysvjxuvXa{g!1{vyGQnw&&-Z`k*{|u>vd!bUoqRy@;bAd
z_hhxo-rxS5&nBhUcJb<w*a8DJoA~TU>LP`=#rIxzFj{}o!1I@3$HtP)H#!g5uI%}z
zDdlFpBbVX$gU?HCFFoJUxol#z*<7EHZlzbf{gxTMx%VGNHidkBv!nV<LvpTRiOr>X
z3@&Xl$IsZdY-#r@UTfgy@$l0<29C{&OQ&imuev<b_*`!Jd&Bg+V4Wq~-e+Y0Q~AG(
zb*Tf>;@DjCsb4H7>W6&et3Js7RbbDIGoPazpRYN5K)g6f-gAYO^5m&}4J#_v?KL~|
ziLF=B_n!GLDgDORZ1;sX_^>H{pC00H(t7HeshKw}cK)C4{`H&FpN{S8zxD2zJZXKx
z)PB`Czrw}qpOxn+X|u!~kN0FXIv|<PbpE5)20vvZ+u4l;*SG9?V6V09<!mX5y>c$^
zy|Q<)|7;4V?OG{)MC-y)3$*~_d;1qXm}xpcu<T~DvBZV@k0)-KZd9P{Q?+UPBK4|o
zrfVt=?a8&asW{X<UpvL_eelfw?Rzi8rYrdziIt4WwzX>8c>CVjV-ml4^ct_<>HE8>
zID2Zqs^c%kb*etC>smi6>F3uOm#tFnyzB^J{v9E;l$H7P2bT+r4t}}PopO7<-+$ec
zA42YB8Gld~ey>pWGHY=`?)I;CiI4Ovr?|=4GkD(<PdLhU=TXs|oq<8VHOp?Q*9fF5
z-(Fh(#wx?+qUhJNRXd~>Tzr3LUWlged{3#OmZd_??%ZDLu6J*)oov&|_ueVkcj*xW
zxx}q6f4=nI`fPr=>q@oN_t`mSK8!qZaEcFG#u>JxEw?XiyvWr5<lc<eQii>3@t#fJ
z4ZfAg3*T2hr>~&+{gs!KbM0e;c!ragu77dhZ#JK>WW(7*&-P5oeKGTrd1u@W1$Ft`
zk4x-=F8oPcC9s0sHFe6&@?w{ulV4;U{FANbUEOdX$2Vt5<KC?Aso~#v?~0jxjaO_s
zS*5Hm7})<Oe8Q5*f{g<4vYd~SznjmrVpp4A>bdsOj4O9NUS12{x-%>KcFH8d6sy&f
zQ!9QnO?uqj6+g?Mg#B@L+9@lGeM`Qw@^mei3T<=nN_uv8LE`%ZJfZT7pS{ox2s~(Q
zcSnqW#x#+s$M2o}=b&QZy}-yskz4uWv`DAvsvnsrYb10VL^Iopr+?YSzm(-eV?587
zefhuMUzjdG=TB&LSKR#6_D?~l4SnPPuRLaJVRxo#YSqLEdqsRUmo5xTEx4NbZ+g{?
zV?49xTdh95>n2}RvCEY$Zdb&%yVf3le&XWaPOGVJ#X{C?IzPE~UwG@L?Heqf{d(G|
z*Q9*JGhW*H^CTmOmvJwBFPEyy{ZwbX%Aa2<%D+K*R<&xxBN2t&tDbTcsLhy_Ra~=k
zsuUZ~1pn*ITonR}{zYMGkE6HFPRacet#we(;LY|OQ@eND7S;WjCUM{C^8=oWGdnJa
zW_LXi)4jdn%<m0-k8+-#pUBj3dC88`F%1*DH8eje>^yeQL_hKP-%lc|*S~y`G;M;9
zSH=79Zc=IMe;=t;yf<@t_0Hyk_^+<|5{Gh6UJ6cs@kV&wvmAlFs>cr}Dt!OqWbbxt
zTGS!A2Fo342Zh%#sOo(!m?q0v9pTYybm&CV-Tizke%Bg*i<!9puFlJ467?G=c*=RQ
zsZIU9Q1_*-zQxWbQd{Hedr!*j%RlvM;}%WkW5UIXOD`|ZRuj7Ce7>{JH1y6B1D=id
zWHRO_h?>YAUUu!=1&0q;N{U(%8|9NHE~^PB-D(*2a{IrK^=3a;-74FjsrF(i<C>6Z
z+FvK_>bn>5JZ8z|l4rMSx@Rn#%(}OoeT(!29@X5iO)UK(^1h4j%@0pczqMyVUOd~@
zbx-av)vcMees-M2d;g1nV=UHp2V}%mtXhBmS$z7Nh&sEllUIs_rtC>pS$fbgKwx9;
ztjzm&=Be69F5DBx*2O&|J*4Q@!^f9@Put$Sd3J+UMg7Geg}JJN{gN>TJXTq2LYby=
zOkFkq-NN3F4U5YxF0Wf9^l9rY=L?rrzVr86T$H?2eg3F{z-B!=bKThgx0bVg`qER>
za$$D*DWi|<g~yhCh<wJR@tUJydLe_pGJ^wyULHHczFy`ZVax#wh0^D9#Oqk7DZN-w
zaXjC9<_>n7XI?gQg9Sq3%M2bU&bt<PaG~~%TVB`RSO0wYnbk)_bB@ft`ku6us#((}
zatQ66`SMO)&C*+6n|4fGWN^+bX?wbTL6aNb-N+>CnzcrYd=_Z!Iuqfx!fE=~KTD1!
zc)T(EpcMVP@5T|myEkv&*jbx9p?GIjhNDL9flG&WpTE7eiv5PX!pVcvQ;rn`by=(r
z)qSz(glpK;Wv%h6oaf!rTqd^s`J6CDsVb8_nW}3X7df#n`qQ)2{oMQ{!Aq^%xr5Gc
z_J~mEVvcWFlr#Om6XTKVHOlQxp?h_#?YRF;J$3K8c2(F(<BG-0p6{tX_@XRCB=l}i
z%PGHq;sGd=;OXLry;h1cF!%>DFbFX)Fytalg6HI?>lIYKwaG4iY&PlsPi=vp%u9RD
z%yobD$}9X<*W-^qG0!*d-DZ4p>f&Tam6XDEB@w$n5$pf|E;Dx!V$i&4T=weQ;gxAR
zTp1>EcVCE0-AR1D{C)jxTQ8-FqDkKk#3E<v2u<|Aac`Ep_r~956>r~esNK2m^yJm4
zC-3d6`<y5K@6Q3fX-&04t!E;1*12k3*UmWObufIMxde~iG|z(%?iZ+b8|{@gJl8cT
z-OxW(?S|K}P_2m2ju}%Y-F@Pz8KJd)-K00Cyf?L;3E$(xU_Sr!sw;n=god%aiCM?e
ze8_Z4yk}s-Z>3YMCyvE6mVSs%PAZ&a{9<xoC9lo&r$!BeRri#pYm2pYuUb<i*rpS?
zHZ{(v+h^L9+J}|9d{VBis+;Eecgl%hD|cjbola4G^}O_y_Z%PQZ9YeHKQErOzF4wz
zQO4@kMxN3x<=Jys^l!9EWvOfqx-%`)Xnp%C?=YLk;Y#5FhWeFLJ}qi^nYCeA#+im)
znQIuX?}?Gx;rCGeO!+~*rtbfiwjAH<?QZ;kfB12~aR0&fs1<^(7nDD6uk*kAjpN1i
z&sVY?n*;dco##xq{9|=CRa1Fp-_6QT{DQYz-5y_^^}O}O>tpsGon%f&X#5eMe^^<;
zU_LXuZ{n8yDF#zcFFJGl%>CxVz2XzkRB9I2zbUaUzAdln>S^)e;iVNbD&us-4jg#s
zJL%}BWfFZi-o-bTr>wfhtU3FmXx{?0A_kv;uB!ziOFp?hIV{NdjA@6q@q^`Ou3OYz
z^}OqPBJo3>y){qv<tZn1_9j0PI~IAs_;T*C1GjTZx9@9aV%R058vSuc>`9Il7d|yQ
znWlZ-E%S@@PK0&h$xyZ8hh|(1x3d2JyFPjI_b!%rmwBBc&(;~Rz52d;dr0II!@OH7
z+qmqyKJDqLZ|j}W_3+(n^Q>40mIsdngZ73TsNV3oC++uvBqP!J3?(ZzyxPdW@oUDC
zX(u9{^4sXP#BFbWymx*d-=XvE>Eip}$hL~Jr_bl>fB5jro0R_#{>WHJXMX(kjh(lC
zM}q2!Eggrgnq~+{8s2!$z06$G=yQ|0<_VLl(Ff!DkG*ko$eeYq@(b&%%ow31sgpiV
zIeT<cyt<KjBx9%bmB}{m=d1YX?|7D}dc(f3L-_zlk-EUm(n+Uv7_9jJ?tT3E@ZZVF
z^(LS87@Rz$(fIYtcmCRGDQp|qMHLM`g$C)Zwrr}g+4JM)^!bPO{_Q?I`EjxMozEU2
z8$QT9vEq2PTaj!31BQPGnl8Ka`Rnn0=VuVT`eD_SSxx)j&6T};s4R=`+&RB<Rj2OD
z&zUFt=KVvDIZ^MAyX9O}K6ID!lqWA!OAQB89n<dbDZQ6wE!SX4Yj`G6;=`?c?P*ca
z`$AsFqymoJ{o$FCdKD~>9_7tqI<g`&;*`J(#iAEXo@{HQz8(7II*Ds_xxgF+DSm$|
zXNRc_xAM2Lwb<ydb?XlKwCQpZW3c~W>3Qh~%3PPfw$PkleK>9P&8r4!GsP7<d6vKP
zIuamv@j&Cxf-_gGM7?U*91U*ov1&CCTP_zRagwVffNyP_`PA$yZr61FhTUXcUZiWZ
zf2Pq^u6{qeHu=8qcCrbZYgN9d&%1u*Q+Ni$8>Uwa_UP7Led6x^Gf}eZvQJyoe}3+X
zdLHxQSlU-CNRXO-<M|p<84jT@dM{n$I@#8od4J37$4+J2sQ*z9()?v7oLwR6y6qg3
zh?mN~G$qRd36H`9`xf3;_u2V$%Jli0<>p^MBXC3W&tfl!Nv4|*Ykr+@EG>OecPs0W
zD=}h^v_DF?tPr&PJw>2z=Dp2Z0=F+Lk5X3saQg+*8S8*sGd=yhOSXDUcI_5_$}{WI
z3hB4&J~oHV@hoZKyKrg4f+M*qE0#}qz9I3kz?z45a<BP&zPcyiA05aR*fm8Wa>7>5
z7Pe)rau!KzTUswVId9+8IE^nns5wtz^ENpS!y8o#n*J*~SWPUF?NhT=&g$aGmsp!L
z<N4DwM_$Z-S8HQY9J0i_VVmL2?~WV&CKuf}6rZKDxoi?s#d){MO&KaYFPK=&Ppd@n
z)#`kCd-Td>m4Yw1KEhXzb;t+&l3fz;?7@|ag^Ri!eJ57%*tRG#^fDQoKX_YP@BWz^
z@iXE@clO`^tn#_~cK*EEGYb40f42WHcy&f};jZRQ9Bm55(|M&j*0#Lw*dfd2HSwo=
zg2FGK$^A07v*)R6TsX$F<h{^0znxDW%zG9t8rIx9$FgD;W6#A|ERoE4SzE*UWM|H7
zO)zipxNx3p?_AX#RkK26QWWM0bVqG&cx!q$iS@#vxkn!498mME-y$8;abG}b+Lnkw
ztqQ-#0rO1wbefm4Ul#3&(}_1fb<*Kuqt(wzYoY~W>Mmt$Na=35#(L~-(l%9(GTtx7
zXKs0{d*3E2cHzo_#zST-H}vcs9xi24E`IoCJO4W_rAYSO7a2sgz1M4IZ78f<arwOe
z%TJqM6_{`Oo!zoLYKms@+4&0($}LcuoRj4wGf%Fk+WgWp{#ydUA-%~Gkt&RjuU=Vy
z>gc=rUlB#Nt^eD8DBe8FmnGQe*v2O;J1P3alxs4ZwHD{{FtL^hhRbj-vOMXsCPTjD
z+K0l2o$_x#E$&QjQPy~NnP<agjpv?<G7BCa`p>{Ot4mW;c8%`EY7v8^FAPQJ12lU-
z-CPrx<8&+eJqQ1v8@x=5ayNLaPO^M+>Q3APJKj|<ON;6nj=Y%M{y-)7V9jAi#ole3
zSFA0VtfMJBuZiz!m_Wm%?XG=IZ|B|kchO9kles9kcUAOiUEW*r2MksSH0?jFBE5<&
znf2x_t_QWh&FiK=bhlj*TYpL~<N4a}2|FJBoSwDzIbYJg0KUueq9tl;JTA_t6--)t
zE#b_8cd^U=tTSbsee~ejmA(6p3Fl7lc)s)X;#<>BxEWvGz;jaJMc;u%)+H@F{+|Br
z`62J4!DnXCTv?@>4U-zY(>z-WSM=8Q-I}=2qV?%PTffy$PBE;~u6h&pXTdU$O<p^C
zCn=pYh?414+~UqT^ZN}mgUJo+8zYliip+d&H6P>Rv+ELQ)=})bs(7jV$)obO=Io4I
zGBTmZ*Rjr+c6-Y7?dKf5v%-GIeUy5;iRW6(5z}<h6DfZ;_SK~_9=>tqfnZ{~b$+z&
z3KyoR1G7#z9F5}l=W$$|=2pCj)90c6yXz8H0(%a=2=U=;o_6{Q<9@}OfG(8<8Z#O%
zNvXG%<z(B4@Ax-Ox+h@z?u6C*lK$Dx^jA~T)txx;=eBo#j*CUVeLKv5llR0k1H0UZ
zzxSut@k>8U^LL!_{Nyh8XTrZ`dB3{2&*@6Sn`_KPf7GJ{-}rVryCkl;!N>hEWJyd?
zfn53RsVcjDgKTDGC_GwF&RTtCmR<DBZ&~Vx8#kr|32WVMc(sm0<bW9eiB_{@G1=JF
z7TjTO8z;Zd&I|Iens!cK;ZlkYpV6<|p^GvY7b_a8ewySY=saIMa1ukB{D~=_Jbo-z
z5KFtdBHc&oYFnXcw7uBpSEufMX$$+g>g~SN#rB?xH=7(ZIo$bI$@=`-%bxoGU5!d!
zV0T;0`UzLpY3rIr=!?8t@pg4up<%(c)ZByVYOAlA#mq@HUAjJQ?fQkM{tF*9ta=@2
zBR2b{QK)P4TjSg$hrA>FPs*Lk!#A0GMfk=}tXsA3SK3`8sodlg^Dj?LPA6V*%=~bx
zAm_}kvxVBFO`AinE18A(aMu^q|2FvGsebp`vg<se2k&b|Hc8G{=Ck(3{nbq|5j^HM
z!ZuE_|5yH`-0}SVzfb=)-nBP*rm%CF-DNHIjlFKijx3yYZt5nDwU2JO2dFEpIA{KY
z;at&AUA766r{Aba`||OR?;1a=HNWoFzTNOq`1_A-x_OLsU(42i_lnR-oq9~=+!oQ+
z;8~C4({F23FmH&PpZWKLM*R1jwVCJBj9*@!mcQhR^0sBwX4kX>ugp19o33*vO)T@|
z`#GzwXPn48*}nZQqjTZ$>4twgZ~OXnZu^wKeS7U0;guU%Uetf-U~yag?u6~EeEA)<
z(^zZ5A1%Be;6J~AigdWQ5VwA3|17?<FB9X{zrCDzTjfEajgIxZ3AM9?&75}IRbNcM
zF!`H>l*ioi%)8GSzrL;e^m}_w-CxgC7fFX}|JGd&*tRS7yovOc=O-sET{c;p+x*1T
z<t?|4In0`JE{lhqdGp>9Cx5+vD<;LP_+iYt!Sc`flx^D2uXnELYLE?_#wDgM$$D;c
zQI5jlA3GxwassoD?Ui)Zdu1Xs_u^*rH2bq@Qq?ClWSKv2XK|jYk`z5h<C(+dWe=w~
zJk_*#u2Z9T$<trx!qb>#3nrCF-|r~Qh+n>*eeQ<~msykc2xn^Lx7G1}by+e+dn042
zUP2GogU%a0Jl(k#z6Qdd`4-<@*0fK>>{yo!&t}z_+b$1lTuTq%5x6zWuebD@=q%r8
zN3~g1)p^@evOBC+tf;Jtn9d&2cYH~5k8ksQnY%}v)lXc05TMA{!+ueZ`z)8uyzN%f
z=5Luwt{7)3-%UJnH>+BwXkIPj?J4(lR+ae7e&Du2b-$Y5evSh<+E?W+pR-w3W%**k
zvQr1PF8ktTGcAbS$Agh)!@+=rd0&%6YZQMypK)zv!Hwq^%D=JCN`JN{{o9hPSJ5Zp
z0ym~-vrK-_KTBCwIPFR47jJXnr&p)!{h0Icf;{W7uR*^KaBlx1qswEbppboQ)fWQ^
z<@wDVt&18H=gyE?b6l@b<;V7wEAuY}oDcPj7Y|yKJ9XB(sLj?*e)<zP{{Q-A`Iqf?
z{VxA{cyaT_<;G$!PfjbCwZ~uW?)KXf_cIb~?(eEd6w12#?Y+y9h&9Cvt$uPj*|pC&
zukhluz*m2THHrLxtOdol)CzSjzx-9&^H=Vb8Z*WC8EvPg{k2z}ZzW_FlDs%jl(W&I
z?Kz`#`NTU>-U&NT-9EoQ<n_PDZn5oc3lbg5*KjJwWgdMeHUEeV?@@-dyNjddEps-w
zR?+Fno}k$Cb;jArw~jsB_vK>75ofkk-ABPH!4)$s%Rcb^Zt48DQN;Dx^ajSc+&)r=
z`lfuGF{Q3CSoa{Oz@8n>k3U#xYWZAgIoGwd!;5{nnZ(sx*%=ZY=O*Qe-r=zKEoBHy
zZBkh}_tC=3hc4)`eU`F#9@UbP61-@Jf^fA-SZ4CFiMFryRwb;fuC?3t;l1F)!%yNe
zl4r?f*2*>1Nei0Zd2npn`ZJr&S8RWoJMUiC#KhctDh8oRLe_@c^*OGKHybaxacocO
zEuX6B1?f%`Lu`J0F1>ZYeWK*f{mIw<z4gsFmVCa-sbl@zSD%flIp0UEJIgHogmLbJ
zi)oi53{8R~GEdBV*0I}lLP{z-V@0lWwT^$(^<%H<z4W&FtYuEQez>BEKPdgMef8FA
zgTpW0OucNtmGb*l?!4e;L6(#zCx_xi#oS5ROeMTsjK_Z6v@j~*ubVaTR^!ci!O7RE
zZ>;e<UG3NHynVHs>h+|^uM1t)vcAkt%=MbYx9e;o``$Bi#b(b`+?YSJH2L7&dz$G+
zjvMQjt1nt4DU_nUlJU9Q%-W2Lvv+>tox9`u#1BoPTI+X2opnsAHNV=Q+jGj(YK!|t
zb0+IWYuqm~U(bF0qSagF*Sd3Ib9T;N<h`~nox35TT=JUQAHKK~zqjt2aJ)Cgf7_zy
z%_Ymv?0jW<$ZZPen}QR3(^57tzP54O<>0tcR%T6%j>Nq`NsBsuL`iJF%(TtF{CdFj
z&#juv%RaozahvXW_TWX`?TeVs)+vj8VmU7$vHy{$*q#S<cTPRtn>oesmT>g<%>1S&
za$7u~h2EV0s8RmZ<S!o8lQpiIpGxSy@qA{)(gvp8hh9J4Cw1wmlGPg%h8Nq@cPtN!
z4SqH8WWtq;`Rg~%IXg?u{+h)Rvsb-A=Pzw!>j`})*|mqCZAzK@V~c{Yx!0dfluF25
z$gb+fT2py#;ey!f)2gi+SFa6YowxX{HAC*H^lJYzELmK(Pcx%RBOctG$?3K?_Tkm4
zD-A2U_dI(yIq>F`O55;>G8W6P8Rt1#PS|y2Gs{fg%hRgA@~R3uh*usHmD#*Y_v@{m
zEbaw*U%p(Dp1NzvzM`zk@UynrK0N``TiN&TulxS))7PwoITCFrd=ev~wG$X#-Qmtz
zEdT$&nvNTu!DT!WIh|$Ql@C^Z4qcJ|XOp%_*oq+jZN6@ui?e)QSYP1bI^41;C;4u<
zF<)@OwzXGR^Sn~Dbh>iDfw?aA%&Vz;H#qKIHdkY3+)BGUGfJEK`I+yBE-*=JR!LCH
z=(5Q>mK^;#LEc~d%rWV?9cfc{bGj-|UiiW9U5fDj7aWuBf3{+}|5Tv%#6`I*o61eD
zTcsYg<h$pd@@xK-t^WS?6q%_^7y2jM({^}1^H|%9yR0|7&u_b28)@2-y~h0E?5hio
zS%k(b|2@?r#8Ulb`Pbih!TXO~$=!bc(m{vChXgKe7Fa3zYkm0!52>f3adlOaOY)_c
z{Hplrx?x}ThI5AZf4LU?yYQgr-4E`w|LmpaNIqM+^x<iN(+X3M{SFc_ezDYWzr;<R
zMVVLhU96jnq&{*BUQoFI?DCgZuDYH1J%Jzhb8<yQo4tw?|7W|kX2zZC3!V1AJ;fK$
zbdjl5n9H|mX~5HpxuJhm?)+FVfuF6pf6*0jnS*)9ZueY?*stYkdh|M{;upT(8j=#N
z&Aa9_^3GZEWs<;$x&wc^o@BM^g^69P{UIj5^?9Jn^kSxX%as~;u9uutPo6HNuA%!k
zB>u3eQutk)O3}rkwJc|~rWAElRKL#*-t(<mqHEWj+b5U)?=d&3lF@lBBz5kIs4wgD
zMdI!ErcS!Bai`b+1sYs>YR@cY9J!MH=<NpnDSfLh`(DxI$=$ksb&c*vUH3f;wtGK)
z!YrTE#CfK7`l5zsF9e&NR|F{;%vRDo>eX62QDjd*<L70wvT8IwG5g=Y(D+VsVd9LG
z2i=#F&6jU~=(g)G<D|u`d2xA@H|^iFJ+{`5`GVJ9A!UtM8(j-5Z`K-1_s$GtVzpvz
zHmVP*nR-@v#a+g&y!T6_q-^)j%Y3n@`qPu&x2`xu8y$&Fe^vYE?u|#8@2|Di7JKPw
zt7mNewZXGtz4x}Z!0Eq~y1Aw>2p#njR{7u+{kxiH&O#;|9+oRVSLLh|IuoMSQ&-%W
zxAa))!t5C#hp(?py`t$FcSf!1k9d~IRjuU6t+Tjq?Yq)cxV2F|E43h?t5{%qlJ6Ui
z_Qg*W%hpEt`)`lqcV9B`=-+BLCEoq)IS2NIKd$@{AMsCKpNZ2hPOEZ_#>5ux4Zk&n
zS58}UO?y*{-~%>$uYC`$9<@Agbn(usBN+#m)XluEIxq6fnHVP(>3z!2{NGMJb9iQ|
z`mX$w0m&5$>#V~v-&<R*QK?mu{uiQgC-!38lBG8`e*CmltVFZIC-2jt`9AB4BG;-<
z)~va)SL!kI;rO+Sw@wIR{m&SavN7-BcIlgvUd{0fUmr}~^3`5;&U~46dB1bt_z!)a
z?_YORd)vF}g;mG>oY^>KS8jj1a;>_i@g9Z9+W7mA=YDRw^j2i5+wAAhzjw@*{rb)L
zFWc&tdmht**j7zsy%kw2q*gMsVxiFAKYQM9GFa8$I#KMLcV97c?8)TcvUwY1uihzC
zR+6b(J@N45_kX!j2X^auqim<jGceRIU|<kM8`v#KEGkYd0*&q3{w=@l*0=xn`WaU1
z{ezTVzcI-T-fvai`TEVzZ5xYwFW<I~e7bn)#IxNlS}LNqU;nDNPuOR#d8+KvyS<ma
zbtcX^n83ipcHm4y|B2n(?f=%kexBp=xhqfBFC#Afa?iBgPo65t#$Q;wy!mafd&>TZ
znCUlvy86z`dv9~Q$^QQ2$=qJ|F049nvZZd(<|M=RQ%jb;tVvFe5-XmhayfOcPUfTu
zIr}tD&010!cO`SKXywsvpG#J<=P#{VG*xGD-d9cqquDtfzg4I1KX$aGPrEX7Mf}&V
zN~h0zMokoMJebh;<LoA5&N&aO3rv@ByEutV;(xyRQBAV)>`9Xko~++%>+$XX+l2r5
z?e6t=?<#yqOsy2=+`FnV?gnq<_vdStrCQy-;L4sEdV0D3>R;E_oO-qB32WR^QQM}t
zITLJi-c&i(`<~8ozx(dX$;gdo)T>{GE#J<VW3ltZf}>qm9DYrjcUjv=*Q+d4SNw+1
zT!E<G%dB@6$WJ$sXO8XG^xXKRXxg+TtGr(@G|Vb&`TgNBv+CS0IW<*V_ujo}QL+8M
z(64{*9@yWLmw9`bU*W)c_LKVT4OyP-kCXPDNZS%!W+i)Vs-C57t$oeTuU2<w<>mi1
z*i~7_T`oWIdGzErHmgsvDx3^l74h@_!atXE{`X9;zZUTCl+OPt)9Y^q)a}^&_3w+c
z<^OrbQs=ursfbx_y#C3>muEk0zkP9X@Zu-GZJarkA9ru@IqtBuYfkKBo4LVv54_Y2
z$eA_$>+*?fzVW@VS{%J<+SM@r6Ib1T?X|bMWB>0Z!-4}x*R${6V^vqqux9QB%^sy3
zvzg1k{#bPS-@B%QJqP8T6K=0?-xjCve}~01k+v|sV}}~9Ki$gqJauDC$@XgI2ln^g
ze)UX0X+5=INx-Zd63Y3PH!aF?D0%zw;_au8xF+?ikl8%@WzG)%32|q;KC(|aBgk<q
zaAI(ri1j3u$az;iFRgu%bBn#Vfb}Y4;gqd&r0hQ@O;4%3+a7o3Nd7fXmgChYJ%8`g
zSeS0HAv3b+z~L3^E){ceEt+w*%Uhr-L7<O`#Y=DVucp|IhsqXC=?PvSvywX~R%H4v
ziA5XcJZHYD#iJ2bR?U1>@(Lfbn{&?6?!Axp3cUDUwM*|y^#N;+BM<H0w69^aNxnZx
zyk`lY^PAK6*7>Kf-pE<-{_fS74|197SmZtRD)~*X|49#>JFWB*L!@{Fqw+PcfS?&o
zGRrM37q5_V%nDFVvs|gqT{JT;Jf+(~l*vmjvc65^`P&0`Sau2jYp!t+To;mfhFk3M
z<taX!UQU^2ah6es@k!LR3;Y|sOm75KI67+bR+k-LD`%_Je%UmD=_&i%t9yO4#qTs)
zM$JiIAI?9wO=@9bO2WMW;WX0=D;_TrnN=A3!=b-1^kP^fv-{7Sdw1qN`}6-<!{t*_
zyXMZmeg8qcyWQ&ve3dy~aw47|!lv`z)cq_O^Y%;Cu>;FDcda`f?4I$jCWbfrctC8U
zV8;v7S&7rdFX)FGyja57c4)_kw)Eo5GP#-DuB+DyOkKbFa?HPWP4)*x9$#5~?3ikq
z?Dx<6vVY!*MYEq|CwX7Fel=fq&q>$L^Srg$H@@dGUhbC=+MoOCmfOyIwQ4ga$4{R8
zi23ZrD{FEVU#?<t<C;C;rbum=h_QjlztG4hvA+u6mvR~16E+rGeZyAr&(vpI&Kz^*
zzUFZztkf*An8CdFV1-Mt*L}w~!q@zlJ-KST@XO7u^O$cuy;<tJ+I80Az@kktXI@ND
z<gIsm^K*I0wiYp+9G}lEbs;|b4haWtYM%So-na8(<KBCwq2?0rEFZ9ME15nu?aIrW
zi-RJPd%j$Vzw&v_nuU^06C~<%6CWOJ3x2U;1^;sghLXK6Qj(J&e^}nUSonO@d!ET9
zujTc(|Eo6fInW`tUq0LTLwc3#>4w6Coh@PK*Imwj!FNy2;9Tg6q+N%^YD@p9Rn~v{
zwbR7Q`gGN<uX`>R?>hPPZ{eX95k}nusxQm@iYFYbtU9Xqy{yVC^U|6{>(1V)+<GR>
zV5PxLrO&E6Vhw&5-=2Q<Z^M~u#g|gE1lU*~Tz`Gy;wjbK{Ah{7>f3vH%M}{64+L(J
zuUT+?x~t{EizSy=o>pa@F;}yX@6SZvkNTqFC;s;3KUm?<p2iZ#yo~*ime(Kdb4JWu
zlU08_;t8+|4Cj4dq>_{#(_lQm_{g~hm)g&*z03M=UbOAQrl-@+d`jsQVtl-=EorVf
z`}@BBN%8mOWgDw!$jGVY*IWMk-u!p+lP3@Ep4`nBw0FgU|39WoeUK(?^w@E8>!C$&
z5_U3Nb>8g|r(xm8s{6Tf*Phalq~61tE5%CY_-;1jHeuN2oc_*Yk%G9v@y013chcvH
z{<Qqo<6onCXnT5J-t$jN$zJI`JC&EqK2)?^>+bKc@3-I7pG9HmK6`z4-hO-K&YY(3
z8?t}uW__3Y&svwa>3DvP!^Ky3ALh@!eEH)0yO%FJuK&Jc^ULdJ1LiFW`!Mg>>7SCi
zcja>V&&Tz)-L_t=zCWM8`?28X<sZLaz5mhtMZc!SlZxlxAM*WpvV8LK#&?&KrY+#u
zb>U#GTbJ!SJ1LuYe_4-JZ&($s9pV>k;j?hsmsYM74tLcU_dCqq%qk(hvpvo{U<;4<
z+tvm1roQ~a{I%1R=U}g>T&qI=^ril1XA9g&IC<OQ<jI?F9&cK)ci{#}4e5tI+!tN9
zEy)x9>mb~Hb5m2Kj`jD<zbX1Hbq^=!2{gWT=3(?%&At6W*aWea<~RJDowhA_YN0SO
zp1sR&b>xDt^_){$B-ee=*di@eCqI3qI!Cpl*Rz9*;#<4gBt^6=KR<bOJi)Nv#-7b<
zZuNn<mIe^X;#C`S=nTW;Q#QKx6*YglLlc+qo-2;pJVDTWnN0QdzE=;AZ~1@Wjf9lx
zm9qy;POBe^x^%wUZMAWgYSfmTyle9|+_=0;qx}ra+sz(a|E({r$T(rpn-{%(X8Fd&
z`J&0IIWp`5{++(FPUB111I|_RF1$@ji#@EvV<u<zO}WJ2y;haQF;(uCLr3<x&)A=2
zD}0af0+a5{zOOv7C-iRIJaPN8+$=-G-G}n}w?-N){#|oGc?Z{4yGOS_cQqTD=+|gW
zl6b*Zy)Jgagrxp`9OCIy=7`@(c;6(kX4S&X3Z`qh8#t^Ir5clDbdI<(N3oq=`}(ru
z!GkM2WV*imT;LIIemgw$aD(Lf%GWkpa(ZnOZQf;`d}(_|;!noOx+Fe^&xhyOa&E}s
zFIX+=kg9dW@z&!ts`Fkq<#y^CYdtdPZM-jZ{u{&X#1%a=EzWGX|1)@_4Rh`ht#F+M
z?0mE1I;AIk4_KLW+G)`RhApO-xr@9ELbiW#ovAJ*7Tjv~VySd)gy#PTX7`v^oH)ib
z-`vdq^I5r{S^YV0kF0)>9yj-K!)=>I(|wd*Ue$F_6kXkEaQBKxUemQ0r~ZSN*kr2$
zgO-1`-E{NDv>!Q(_`=%uW-L;Yuw3{ug<;0_rbA&&dYf<Z+_9OlL^FYVhrf%><izuL
z<2Sa&UXo;;UbI0{ZLbo?I;PlVseB$gy`3D^sC`q4z8Q1iS-<VhO}9;Ntb6_{PKI~o
z<s08WtX#QgiNXd4lbbj1-jduZu%tm;^h2z4%jsh;W_C{GZ-4yl?7M5`iFZC6PI@S`
zKv1$vn00!@0l5Ux>L;v`iq{V{G4>{3xz&}yy?N5Cw@+%?KCfUgWT{#&vC~8Nsl@TZ
zD?g3~Zc6`uVoRs|H9bRRiM0iPf?hbTuHve3+{W4CU%gDwocAnW`7Ftr>2~Rp+w{Cy
zSLHZKF3oCYUoENoe7)4#oI9O&Os^m7U%GwS?5f55FYg#!*e>fHJ#EXPr|KL2yC_dP
zH|5r(J*oE#dcC?+z9wu|)RX*m$6r3~F`wc_o`Yw~BKPIrKK?4GVd}M%`Ik+3<{b4|
ztA2oe&ZE}UH^H_U>OKb-9(`dI`Ak*dyUqE32Osq}81FRPvnR>s*Q!0asfr6cb8o%B
zrqz4LSK-CUjWHV+CGG4`*pTx)^t;kpy(dll)0kS**WECmcA3|u`{lvN$lKokg6~fM
z?fvK1#-&{+wh0~Q<U6tAra7~COt6r2%&)Zlhg_Meg|5Y}+AQa}M3VD||L%rkQe6__
z3M-z49z7x^_;_<Z2k%u&#?Jp@4M$qJ)f+Y)49QLwsFRyG-Bf}x-FwUQr&({+_ZhA$
z(rAn3(!D<auHR~_hqLxR7BZZla$<tZ^$?>;eT6z)oPuxPPU^ci^*X0Po)*XbMA1pJ
zqqn***cbO9f$tsPp&-viq8tJ|PfS|t%3Qr``A&5P_)NFlb=2UDb875bW54vxB6E86
z!e0OEV$Uz0(i5jIcEYMzvB+6$)x6k^-(Hl*th+R04$HaQtxA8kwdYOWdS#34Ay&f&
z9;dsmJ^F04{*tEe46y?pEio-+x29D2=fz!qIPV9aX|qDj>bZt>cWV>Yd~nE0s#6vF
z^s{x=rX0?xZkx1smi4c7&-u-`rF-&L@l%hqGeecaem+SO*MGv{xMjXz?a@Nk&wbxJ
zX6xrx6dstq=<=soAC<NlFYs52*);vlN5{ia|D%MPuYP}E*Lwa??&Jou{8F3l=@ZSb
z<Q-VVa9b<AWXnmbBf4BduUXIiSaj;4O2{pNjJO@F^8Gh<C2&Xy#Tl*j(HGX9Rpnl0
z;p}&+ZMWm|b$bFb%sx7cHT)~>bxP1;GTWiMK=*r8z<1ftEz%WNr|t5I4eu=4RDScF
zXk~Q8okwZeeqWBBOO5kysSocHEWh8<DQ3vbm{ZK4K5OSf*DxUuVdGhX>jje6TF&g`
z{kY>}-_hqWZ<vfHv7F>p4%?r7V$+Vp&u-uN<Xa;DcR|#=(zAQ-)h^f03O={*#(qJ8
zDF+_Zx8C#Gz3BbA=jlh^EG#*C`cqA(LDS}ZEjc6Z|IgQ~YTx7%QJXBg?cHkajGWo4
z&UDr6)sjCTZI>Qecj}mwuC3|cmCwap!|&WT+BCoL7puI&R3?54-Gcx9o8Pnlsf$vx
zNz1w^_9OD}oboM=$xC#+vLZAeT)gI^QNDGm!1kcePi-E)D6g)I(73>vZRl<B<=8Qs
zt5x%5&WLZdY<a{JFxBlz=VyzguD_d0KXqR9zPqyPnvC&9{dY;l&P(*y?s_J->}Tor
zY=!cx;$N#{(wSXWPWXO8^#9G|Pi0G+3wtcyDQyt_{OXVIk&P+KPdw{wtKHpsm+|GC
z4_ny{Og!hF{W+<(E3lAX`<C1Bm=cC3Uz3>QlPj!l$dyzrTxjm%<E9n#VzT+k?vxtG
z<MKLI*-N+1x}+QBY?$n{EX`~~+n$-eYj<nEd~s8uWyv;XC5z>XDL;2;cw4O#R=XtC
zv)AzY9o57W`&Q0h$h&af;*1p+RgYa0uHUnD4)f_RRu+t>uHK4GzBbiZ`HbDOCnwkL
z3;3C_MLS@Je8V07rrcT6RZ>h%S4t<99dcu{y0vPtZ}rmXP}T`wl*@jm9KU-}PcC_Z
z&z~=8wpX_QczUC8*Rnr1yYel*w%=^~_~@F=XD)ZiXVZELPU~Jfp{29t=aF?`#wS;$
z6nKPxzuA0#g87fT(+n5!{hs!1`K)4}P03TQnLS^v!#??I#li0et(G3kk3Bh+C%S0Q
z@$j-OH#KBZ=d*5>XSq?n(DV}@L)Nv2tq){=%WnMpL2?u0KACLa1<d?U{oAGAaD10L
z9#Hf+;=+05%mc+0GyQLg<Q+WtH))^8X`W?AEgbT0CGRMm{ziU(<?m0^50@Wzf4}I>
z$L>0{X_*F#RvlJs<7oTxaraY}Nms>-qtYLXKB;i=>#MiAmujsWRQYC3q_fOYpEujX
z!_O}C-+e>gMX$9*DCUi;^rpS>E7=w$-`hCj-J=^vPdt`No`3LvwB?nxwvt6Z<V0(>
zeLf*3@#_8kl%Jcj0{2`^Fz4&3)?xatzw>;Q!sTx}{x3@HdFcP>koDbZt5dhF5|>VF
zQ@-B6=l3o?^{MaQtkl(McHq9})z|Xuo6^3ZC*QyOt#;*;C_lQQ)kN-@aFytkBR%t(
zOU|^d;Oy5n4)=Sw^-cNuy)!)DZ`rcXRzE5zNo#%Uf>WnER&*VgkbA!W+LqgrzjSu+
z-RDo<xqsnTS3}OCjat*5&QNoV^W&P|n|7wjSVm{^wQc*O&5ph12&)xWHE(;QB>Yig
zPLS`W1B>K>1a7oWVEShLMvvjggzXL651(tg8q2eE_Vuzr1qP9Z{oiso{(F~S<<PZY
z#li4s{g&$o)`uPXS~au3kcq2HeBD;{c(=4Y%k0`MR=9~Yf0b2~_~jO3^<}HN;;T!O
zg;*ujvwr^eF8-}*JyRt1(2pt8>~_D;4ciqUe_+}a1yT8{ya(M%Wn;JKsTw~y-@d`>
z{<&#Wos)kT#TI`uwP)IE?>#-V;&Qu%%G?=SdT#Yy2!FH6Oy1I6uC8&Fs9D0zGur9b
zlB6BWa*b!%UU+^m{7~Pk84N3b1<v{+ZFT>9_096#m-)Xfm4E56_?A#b_FC0^kEN>X
zl`rYdSKfNWKi|SY>chhWbyj)%Vlp1v-)T2~c41TgaT%vs3oKjie^Z`Un9?77vTljz
zk@6Rv-DR_v@GVblE}vB)<&(QKTe;<;hh*}pBT<VRj{VRLwqsh`n!3dBghJHig(j8G
zZI_>vo;fggkpu@ztQ{ANr2f(OYRk6XRu>J7dGY0kPGt8NxsI<dPoC0F`lRjXStqEd
zoGrCfc>jCv#fLMSo6aw5%bI2OI_`*Dz=M<zcI@AHLs@pMk1(9XWjcEs_tR>je=}80
zwiK-2#df|V<gZ@u)`urJ*S@NKk;5FHlGXP+Q}ke`!iJ15Y5^6zUoZ8W-Z&D<8XFjO
zUvSAabETfCxsUkNK7O9Zbz-h*k66#@X)^l7J7-=_E$vzSOtI3R#~`pzVSnh!%`!VA
zr@vab`_dx5O;&9__AQ<l8aN+**qOSB_4L_3N6pWdChFhx7cuy`d+W+Y)%~wRW49Pv
z-FtNM`LCw1ibtv%&g;yjw|9M(>A!Ge;Wo3Wi(lRTym+qKwc<tTX$>jM4k<Cca%K%(
zw9g>BmGwr^t93tT-YYQKy>Vk2TkFwHmjou)ec^oexnaNkCi^$fx&KX9-F3=!nbr?O
zrhb3j*Q%dO4hrAUGf4k5L04b$?1P%x!?(nKx|MNe_uW5rb?^Esdn0?V+pqFIrFZpl
z@wXqXyHfh&R~&D+ujd}Vr6GFJ4coq&`p06yI{%%HpWbxJE>K_=SMi1i507wd?ryw&
zdfUemt$m>#{1+l;&DXzNY}K%9|D{h--?`J1C+U57pnP7k)-mx(Pxd_b50fT!i!3;Q
z`Hxh%-LaCU%vpxY#&R($Jwg+DC#_<BsvvjzGxwq3lB=wTSD!f-k$2S6Gu=4nm%?%9
zn>KTW-~GH>!D3$SvFcCGjvB86vGp$d4(5h__}i0_cJS%;3kzbJTTZ|C@H_w0>5lRz
zTkdlX!L>%|h2doita3K$+?K}<T2{H#DRf6_ZGRnQ*%qBLz1Vo_j`kHFL}a<t>o%tp
z=bhNd)}Eoa{q3elKekH;Z#umxMf$^yCeFNB$;UaYw<OHG@!<cqKi7}0m-Fv`wEj`e
zsjgJj*`fi>zN*u2Wu*4@_AHeR{W0g-)vtSA->R<+`h4=neS6Ecy6aPZ>J?Q>{PFpb
zW#RvI#k3=S2Yl;w%J=O%v;N_$jrX{?&2OBVsI|6oLNV`Zg>p%e*x1M2%1<|W{or)p
z>3m+HQA^`so7fzc27}8CJ-NKye`9v0DsXtMl1*sjEnIygeERi9Q;k5blaA|u95hm_
zJ!V$%=R=KY+T2E~vh$PYNS-`?=JKh=%isL|vmdJqs<fVwdMtbI&zkM^uS)mk1($u8
zx@UFw(L`Nyag&J`q|3w(J(G-k&v<%X*1adsMdsfye|od$;W>`a-`V7I`|kwic}?`X
ze`U_v&ebxTYZgd9<Fx%8leF}*aiyk*vks5$!>Uz>4_vq<r1NfP`%wuy&b$+%cA;h~
zzZ}$Fwurs?;ECl-_Rroe$}Ds2ux;KU_o#8p^0|G55|6VSkFV|2@RU2ZGwZTO&5Yj-
zTie}3@>WF`@d<zFz5PB~|GfA5tskTw9qj+l`b*s=Vy3H){tx?r`Ocj$?5mIeUTB!|
z<+6;E7~>m@sXLxunj~3R#Sy)3zgl-mNlUoN!*hL#(;mKb*wC?Z!@SiTxmKH|OWaV<
zs1ELUy+=E5$0q$h`Zo=?YQ~qJv-_DJ^7O>J2=|#~vtD)1ZQFA%xS6jnW2U5ptfuj_
z9*a=k=%Ziut+{#Q8uPczHL~vBKbA}Xm}Xqqwjgy<+qvkg%>SgM4Kg#<ZsJ^?aKgvw
zknGI^nTtE#Z`ZUHdCKS<60xxH<;2tR?vH(E-F`i%M67Cl-;*o$=F{WWJqft5?4w=1
ziuC)lPTJf{ovoCQZYmJJHR&5iLsFd3!xWF2lBCU3((lw)NJT%eJ16`w^G>KhZTZR5
z@fpXC9Qu^?vUHxsRlNi6?uv(M@4D9Dap31>38{%D%2nD&eI{JzsQ=cxZpOuP^Q@~k
z{C!sSsNz=DqaVj!OnNBbS$OP=H2=EZH#xueyx+JuZ%zL}!@?Pd6Ic$5PWInu+JAm^
zg3qd%wa=`-)cP(wvAZk${+4G~H>brVR{gTK-u&Uh1NoD>g>Fj6)}^n$`E`xy?tO1>
zC5pQ=9G{uGStqP{-gMcSPpbuXO}y#6A=-(1!vn@0d0*}`C(h?9tP)=QX1iMIT~Fcr
zOCNlBe5v<WLP%<i&N^99o={hV?DOyZh2I)nl35^~^=ayY50Bk<&#`v4ajN9>yUW4f
zI;AA8W>K1#u0hu;Z?9sz^5-vVt9u)Gbe_m8o8GV5SG9S=o`u&;Cfzt!_A}AYLB!hp
z-g8q~o`05ZjYnCHf4W`Yf7;2C%USu`W960FuUpKybc_3UR;)SLCj4uwtjManyZJeG
zW?W3uXqkFu`&!v!`Ik?!Ob(low|LKWhQ$#J76q=h`E+>mtM`-m916Y|pI^-1&#>v^
z3$sPPpPjy`^81NzM8?~l!Bf_xxa`R4$t<;;G~<lml*IG1r*$1o53arV@~{=>HSrV~
zvF^YrHzx^{DL>pYsjR|WNs8$~><sO=7zUp?;&SyjfAg0`8cBSgSkcR9(=sjG`2X(z
z>A%bQkAHYSE8=dFS}nt^BO>!HHl?}q)F##3H~DV7_0!XUYwFLh9lCXC=l$qg-+o_X
zdsv(tBk}RVjZf3OH7EYPR~ssR-|2#f`eH-%tV7#heom`!WBqKnJKuHJ*X-g&2B*b1
zOn*!B3-(M}?s6k(2cL_s*yf)730>=3)7MG$)a`Q#(OOo2Mp-}TvBLeIKZW*5x;b0v
zPx>Nb{hTFyht@RzTqmj0KLTy$DYdGXujH*LuUYQYbS6>dW6FVPH9vnfS8qGjx1&{x
zH~ZdmU*+HD4I4rmy!B20d~}WoxO_kHSn9N0Ot0MolX=YfjOz?rm*0Obx;)%_%R7Vk
zl}}86eOW2>_0g`06W+AS=!v@C>)$<5;EmBdZhyg``<ae@ALTY%=-yT+XLmZ4W2D6G
zeg8%KiI<m3cHNxyzkb8B|MIi8xMbfw5Eu0F!^$xCZ8m4cUN4<EV~hW*9aoRuZ<Wkl
zUn{XYw|S=c>>kG{?(d`;I?a{0v8?#K)QlnZpS$^odt$F^rG4K&D7e2+%Gq6AV(W#8
zD>Xxx92c2=)%)|Od4(AcUMmc3rY@PK9@HBf?z`Dj>RZp5$!pcr+@^F$%jM15T_JHZ
zb$i64kI(;wr1);x9=-LF<i5|-`J6cK{*rTS`n@CMQ&6w*K6%52%?Dqb+)%VxTlSu>
z_3qgXD{JPQUl-_6_VY#jl9>?^PZWRi#JAY3D_n2w@oSRgqH?}_;Zc*EzZETJ&|0N=
za$E4tzmrdvxY)`0uvi#y9u@7kPwQdb6l+#d*7Ne=_Ucq0p2D-DEaAJ$PpzJuACRfL
z;zwj~gk@=u%IyEkOI&?Q7Fn#dEc4|TSnWEwV8h0>#$6dcm04Z8Z*=a-Eu0m1yM(Ww
zNAs$v(xa^PlcH>2N^{<>ymo~nVR1zCRonEH-s-Gt&s@Jf@#Pwi?7{~Nc5Pl|X1&n8
zsnpy+>rhA0zl}ADSzFc#H-4Ouoh~Ce>t6Sfj7#i~4P$g#t}EG=%U<8TyZz3CrfuJL
z@6~-Owry$mS_^TZhBe2h9*&y!Yni{#&mQ+VQ7j!k**9c<{n@@;<43OX$2DDd)`W>^
zwNDXj-#fqk-0bkKwVs!6&Iu^wxqI+;qR`h_Df4aZUTtW+%x&DXfJ0YE{KMX@r?z~W
zRF!c`YNph?OY+?@FI3EWBDh@&E=WZxwgn!)bj(FQ*f4mryQ{TDxcvnendL`gUnX8s
z>57}7_s&{5>G#_wKd)HxYER5owwe+4?&r2od3PN1kF`x!|6rBcd2YYb=d~TNRZ8=_
zI&x=b2A|=%6`Y<ibEe3d(!IZP;!XNB+%r#aPi&1c2sGkzac9$=7Z%l=ob)~1ELY&f
z%8Z$!p*uZ!LRfmM^}G^JdNF-I6}S7!?JJu3KP)!Y2!EfX&3A%BOp4=EWzX~*TaPFd
z$mwmk%U^2|F8FZo?yMxYqhY5x6VDmHGcT<3eHUJPPxjmEHP<(<e9@yc)jCD(Xqe@r
z#Xqtvd08A&XHBu5T)^5I*30i)6`~~7HhIcVeF4KMnHn)l)tYWS4%^Qqf4pgOt@cXa
z+^oYDC(l)VZt`cEd*{e?|FC;P&HKJhJX*b0ch%xq2a6Z;>nUxV_++)x!e>`5y*5#K
z@n+&)ha*$+9y1BPpUfZ;|L{TZ`fjm1+dgc1bJy&I=Z@8eQ+!QtO!^}mlq+s@rrhtS
zn%s8YZHHInGQTnnUA^FQb3^1j9m7ZlFAMIR2wm@;<<i?v<Y&(^`x2fIZhT<bzMGlB
zyH^CRyxJx;Yi*xWl+310Vy&GWQBLb#X8wIC$M(qBZrayo$86b0+b86e&$|Dpp?cMQ
zZPk1C))ZN95a^9R)4yuvbvyI9>K9gQmbq~$N1&AXEyt%@!nU(@zNCC`SZ;q+*T>h$
z-?--Dgso?1@6F?=u4P-}GyO*s`-^`wq9R>R>`AyUtlauAN+zy(^I4g#$Ikv|LY>FI
zcsAHjRDyxwbpQhc`YENwsU@WadIgn7WBwN1cANBnzQ191tf)hKOU~1GS^nX>w2zkw
zy+78c6*OsgPzVPHpGSnkfkW*Y^St>>)))Gh{e3-?ku6^2?WuR0guI#3s;a7f?XIp+
zTBmpa&-Fj;7E>}6pTD1Gr2AN7+RvR8TX_#{oio2uUrqf{>9)JiKW4>tZ5G%6U+VY&
zPh`ycr4{<!I-=f{`jc~ZFFd(u%E4u(5C8w0{%lUIZ}GW*u6w+_XI?m6GyAEdWcte#
zp{F<9e$<6b4b`iSKO$Wf-lgEXc~ZN`<j%@z>$f?^otPQHwp8aa@84}+n~wU_sF<WF
zX{RO4W=Wm$boNY*YoU_rUyA+vy?5SpD|8YzILpAJ|Cz_%HK1eduh55^c~6xJ>GK#(
z|FV2$@Vo7WyAJha_wGq=(_Li|dCq0V(@6q6X-><&7tUL%aK`7zmhUyQy?>RfnJLJu
zb=ZILv(4i9p4%>cIOEMcedV8Tic_N1W=c)@DBmjiS^59Z@SW;eu8(f*{`da$_J6P6
z-{1G|^=|(AbNyLrE9N=fpU$s3cL#5SM_^jwG!tjr&4R{HvScqbUw?mp#nBfD24+4@
ziv-RFZ@10~J3MdRYRw-RRr9-Dmx(`Z&D?q9K5L~{gxK8aJ9##nbcG+$m}|bf;&!cw
zn$Zd84+YOz=U*~X6VpGnr!FcbRPNNh$GIDt47M<YsAw(q|Dyh9-Cp@ei}ozk+&=lF
zmfqirsX|w4o~`13XmO5{(<_Ff&cVKU)tNA(sYm`5X^K^s?wD60-dP*gSs=SaTXWN#
z7A?gvK|_n>BD-};I}WO3Oz=MQRqebwOPx{V`hWAf#eQ$$kvkXpPVM~s`B^F+PwZ1v
zCsu8rwvwY`--L-Zp^e`oby5Q+%u#i1+rB8q`_WMzd(SwtFS8<lyND#p38#8S9kJhA
zU;XuQ`|9~|^P4#RySMsGsx;nVF;^#*C8KWdgwwwo`Od81dOx+U^rZf>q<``)8Cp|a
zB-p+e?Oc>RWhehLjmKNq3#|h0G~BnX_PjpxeDI~<??rrB)|+Sf?vi&hTQTX=qi1C`
zJ_1SU;(i<Mo+_zikhqvs{jjF{v+7KZW{FQqo2q9%{}^=X<mE)IEi?8M9$IxJ%wt}0
zfq&vW(WCZR-dmWHnpw9Usi?Ur_ipaY1#<;_7rc1E-|Y1_MMT{8(V{egzYi2nZgHC}
zZq&KvYM0Qa$Y-K~Le|>)GPa*IldkyGeEt0Nsek_Zb$oi~R~4VzmYgT@BGKg5sc$D2
zSIXaUY!c4>de&y?X8z*IOLw{lR3*LDj^s-I*i@1^o9UXO%f)^p9ovt^ii@=Zvoxk!
zKkQiV=J@%zVZwDr&eKj>UtP0;vekKKh9A8@>-o{z2_c_2J}jv_Iax7w)_uXP^Cno`
z*r>03VZBN4OfyHf9)WY8YWssi87C^qKe0QfHEk7dn@XV;Z|Pp;Z7G*`?0(Yq%`0ef
zc(jqY@eL8VY2I=jPs<B;iX9X@ec|KDI~|KoC_Oc?UAjGMv;Dc>UYWJt$2{y@uU%(Q
zm$)}chIv!tp{e&yDYHfkKAk4y<-06Vr+cOPx<@8c9xeU8_4^}*S;trvbAqa(Vl4h=
zDzg19Nho@|Qf8KIV4S4)tJQDAW?IkizONn}_-h}xuBq|zy1bwHveKRW$FA``Z=D&k
zKP_V3q0{O|(z2M|3)TB)^4TlS?0mTEapFV2Y=$QrrM@NmuPfD1chZzgTK!fo=YZW|
zx6Qh{EmT%X_h=q?VqGOYK|p<XLVStB(@Bwy4lGN*^_^(;`2JLC&Q6YLOIQ<@d+_X2
zy*8DfaSyN5mBwTjugE1D9g~?}FAI9fTQsw&^$_=O!Gm2qTdp@H8tfD>-@aB{M@}u~
z<2u!t_X_v-8wx%16Rg%bU){q!x!*E#!^DF5d0CIQDwR*=c-EZoMrGIB&pSoqH#$Fm
zC~vN9bHx7MaUDNv<!Hs;@7I3S&OZMASIWs(cHcWr&w06}U)3&kpL|`S;IZI;O|MrO
zoICt*cUtw4x0fUL-h5diFyl#s=YfR^*S|!cczxUE{HKpg{axA}J3CLjkA1hWML<kn
z^zoG^3VE7*4%`X{Qe{-4ye~0MG+iL9`~BXFExIS)F8O}#Q%LjEgNN6oR^4hh^7<kC
zv8}fD?SJP(Wv_W;=6Emqc6^n_%}?1c4{yq8cW-cw+@!LVSMNvx!^b22U$Xagb9baq
z((rcJ)R-{WU2>@fQ?dBvUx@*tYq&lwh~VdI5mAYlvBN@f{yc`Vowaiqg*3K1-<i*|
zS<3E0VpUd5!qt>h-^7pYuXOyquXr-E#)ITX^+9bfjc$wD{Zxp2@?2Wrl5In?O82+c
z1?>mi3cb`#4;lGLMJ)ThVFUApMc(f&CPz)+c)VoGk$z>rC(TvqGfkE(u~+z==hEe1
zcfs-Z&AUfUBYzaW%JAK^P~+s$TTu=PqMm)Vt%bUQ#tWxEXkn0cO<|PMQ4ZT8+jg<|
zR@J7)Gp|maN}m!s?;1mebgT4AN7KBmeocG<T`P~hS2YqimB-GRuK43)<a@)%^>1Ut
zQ_g)zX!E^mHoG%8?$~`1?Icdgqx@SopZKYe?6LM-Uqs$Lb)A39|4h7L{r+b|MWvg*
z?Ck@|OjqJ>Z_bFD$GiUuvx4iH@VS$VPMl9Nl&<s4Z@<|kzDGdfVzs@VYbC?itA59K
zo~zC{o}_))LTUPL5s%UdXO^4oEm(F;bxT3T${+1KB|D<G$u26KlyRs1*-~Dgw3P{g
z57Ko_Q*4Fm8VWCe+p}5u`CQ-Vid(;Yiw%-5Uaz}$d-J)CJVItgc3*FP3iRCVdwO2z
z=C7=ejaDh?$UoFgJ}$>3qf;r<)bLNEq(|I@-7n^(Wk{vXwDkI5o%4N%FKtR<-Kf(&
zQSIS{opU+57EN*$xL3GCNB&gT9@&)ara86QMY}jWyygjO9<q6MCgkczX@#w4cX0oB
z{N!7uOQ*%zBS%{+7OKejPx~})zR%634eg9-t|`lI@})LB%TKzN8Gf^Y<E`mLo#08u
z3%A`A|DSkqe^8a+i>*@?%62uz9Z2GS8rZmCUd7p&AwSwIWmTPK^!?frIeUX_P)^oz
zTU{%&E!A1<5l?6LEaI;gw%YCSL(9Z6<CjU^UAf&+e$tk+JNs_N`8%5=oD-QbeX{yD
zqZPLMGVHhN%6%<Q^9{K0gFE-?*~VBmM_=m$oA!7gk3PDT>8*ggwKaR4%M8WbqK6@=
zCjU1dzBqr?oGn{9+q-w$=q<gy(%HwJyY=fU{sRkQCrcEiW!XQ|Jby&@Q^3PAh4~lC
zdVN+MGFCjgX6nHYuXwz?F9bX(UTfOn`D0>S{VT`iOH&J{ocg=$wb0cD`H6EcL^U$I
zg!pQ%d$l{F>Y;o3iF>ndr0J}YEI;pVQ>>d%n-wj(`^UV+_xjFfZ|?W9f1T3MYM~Ot
zxmaj-_qy;4O&MWI4W$pf|65!(bC8Yw?y%~|X@<<e_08`7t=H<7JruRB&61gQt)cFa
z*JZAqyUcyH!qSDZGQ8h!|FV6{``T6gpT#Bm_jm;^FqYeP^7<;C6shI%%uiEaw%8~=
ziJ9djf5c?!LY=OLo>PrW>lTI1`*`r;xl>u%Q9pmBZ+MfE;~e~Ux&3TczWhhADO+*`
z)LB*wM5h#Y7afa!t;6MI7yRI>&JQ)#qrXyj*lp-Kl_kx6dkQDlxup{-pYv?FIYIKY
zcS-NmXHC}_ub&i~tS!rz5j~eddQF)^%Z^*(OYclD4&P;SMY-sQiFxKr{phD(KfZCS
zO04YZeENLL(ItG-j!9OyEH^!~#@6#(is6A&wX2Jd?YS1prkb&T=`^mAD#H&Aw;n30
zKl1XroAiNq=S&Snu|tM$o^O!m*x8V_Y)1E#*V|Ge&xS7xYGGBGVi?Y>z_ZoTs9+24
z^~s@o=Zkb{33mKe>P$>I)gBhZ+pyiF%lO@?uC4b?Lsb7avGqOio9{J$``YmH5&|Lm
zN|)Kof7)?ds@}Ep_i(gZcRebZaqYF8FNztGe}9dLf2~k1p=z>G;VXAt_kZ_Y4Q+3X
zZIAig$viH!U3)_9{_8!)XO(nADh(HOOq2Wc!#sNazq8)r_0_X`IwmhIeBpQeVU(}Z
z<B$iAcKt=x`$FdWC0F}1eR3ANCwtCZs_nSM{%7`48`A7&Kh(M2IgS6lM#f5yrIN8J
zKf)GQ<=s4e{mW_TU#&Jf=CLXJ)lPkv?(y=M>(&dZes%xsZY*;2s7$)abUvSbPUMqk
z3qAE`oiUM0vM64E|L0w!iD!x{bk{DMS@!p_-r2I1y@HDln)ThAd*}92<rDV0Ecw3c
zZ}$e=pIZ84HWT|S2eY;xZf`so!f(YHEYM2jY1tabe#2>%h)Lvxy*CP)Z!?vKUea%A
z%u3qqwa#%i(=68CD%?&hBIQr*a<!RWcji}$WXJOb6_2-MaT{lZ9*SRF&$vpQ>osG`
zughV6^7A#%xSZSUpY`kU=56g+=PEDFTpQpR-1h0ymmMz+w>?j<H8N$d4`Ps)U47=_
z^3_7IzQNap)b=m_>G|*6@h`>4^<=iO`%5$lf1De#ROFH5m*|%)Erve|rPM^drxhme
zcy#59+6zgs14}<;>U7_}!I)w;rFu!s+Ngf>uj&sTX0Lem;pL2Vdkr*BH0QoLv|{<}
zwkiBiGDL4HOnLYD`FBV4H=Ba><_B+=I&{P;Htf515pVc9zV#8eg}-VTWkfmc{Ux3x
zQSNonp-m__;8xjzwy$#kPARn|7rZOjt#MSvXpPsDg7)Pro|?uQth~1@>ePF$$<{lz
zCq9_|yNGxF3|VUibKSM`s;=B-|NH)vez#8KF2BpuSIgL$o|c^T^v|MM+ELLNTdlUX
z$6qznN;AnWlbLaF>8p;4gjW-0bGtf)S?JZ|F$UjTZ7o~CsPp0JyqcS0HSVSpKIY73
z`>XO_a6^fEEdPxr7Pq6qHlo+=B*mEgxWusf|MlwYfBJ&12$aY0bUQ154;N((ULtvD
z_bsiNx*Hzf{xBs-{<KAxO1gAcg{!rrjoIc0FWHvQv35JGb^Jn#e_QaICR?9nc_*i>
zsucFMOX(IWQeHKsK)Jj>e!=tOO<M0&+k57S3+<1uUhnzSaZ_I2Jma?O`+wM{tQM8K
zd+x^R9e?-E^JfloY3*n_>ZW?rV3)#|LS6>j3y!V*(U<dDKF&ziSrm2renMtNy7M`u
zpxqC*ExJ)Itp3|fJ(1DYEq$ep)T`ACk2~41Jz1bpH(&JW^MyN>NgkHybGBu=bHZ=^
z$#W;pAKCE4(m!}3|8I>2Vq4-ApRY(@oqw>a@H*Ek5h+EM?(8Vn=i9z5C}*zZwiQ~*
z^2sNLJ&V15N3eVB<OK<0j1f-z8h@RAvO|ASS*+Cjhe{dDo1^Efn!B}e)0AD076cu(
z%kOu(su3K=uyVh2rS$`rsJgpGuSB<$-nrWosCVm9_}W84yv0W|cG%U;IPFy$SK5El
zWs{X`>Y~W2r<PBeJU8HBxMo@8)CK-;{misB><e)$@hX{>=Ut`db~xf7Z;N%GhK2Xh
zn}MC}k=xnVuCe~ZX~y3Ez-89$l3&*=^-R~Ta9YB=Sj+R<vdD`IE;FwC6A-E3rzJT1
zyw!n{N^esKrH?|Z#UfqU9rbpUUlzWfZf(SH<mzd^lp>}jCyP_+zxq8}=@T+tRd<Qh
z4}lG9S1Is!d@Ma2H{spSUwq4-O`YCSx2l~XtwXLXOygVTirX(Qw6t{cwDoOdnCH1>
z*H?yV+n;p4E?p|XARQr+cW%|@HcLyDbpl*&FJ5k5VUoOPg_^T$O`4+Q^`vWewq|^9
z65PBxWFosvO|f0x^10nt+00)|c=(mGS7_hf{pU9AW-?-(IQv^VkDB0{oa2ewH)|q<
zd3I{-t$CU5xTX1ye(<I>_XH*ji1x0MzIr5ZZM^-*Pux?JzU=s9ZeH(r|DWKg8i%uw
zE{EPx*>CqVEyHNPfbN!83raPDO%^<LY&)DKH{bDU<_dNJb1|=Tx%vD2^!b`E%Id88
zZs@0(qP+GoU*Fuqu5S{?CT$--9?9aK9Q4R_fz;t1&KHIcF3$|B@hf0&%okX+S=amB
z)v2qa-fs``P>k-d+9S`<b|5lTT;tI5w4@-7-8RjyJQnV4S-0(@<@euSw}1M5%h+0*
zt#0|+{BPeiF%D5?-op>x9O9TzHKmA|Z#h%j=F{vFhZxpxTP62L@`AP0-`%@vrgfF)
z-!t-0eeo_R(kW;6HqDs)AoE8FN*_*K`FW#2`QxWopYGZpiN4~IetcK=El=a1$J@Wf
z?#|lQ^0%?>skqL+N;x&x##PH#72lekV)6XJ?O%@+cbo3`>|vNLFmd<UI_Y><W1*he
zj2vv%YZ{{&a(`yORG#u9%X)42>!{K@IvzqX=Bx6<S-X2|y0vsy>3Ve+MT$4S75TjX
zdWHVNT+v4bUnXom9C`Soa>d<}Z*ezPa+ugYc&A<?SyuOAKkuPkzaxGwcU-yWk{|o@
zYrTK}XxpUi(|9^L`H9smk#i!wVdtD@=q@!rz{7Fu%fDDtuNO1lUU8Y4*EHjG?~bf3
zt?_z={K|@(73MmA{j1XDxk0@un@73m*F2Yke{N@Y9>`G0m@hiTG_YP!hvUBMyo+i!
zAu44{^qA5lw;Z$0NtOHjwX(?|?D;kMbm0d|Gk=7d7G&o+beeMo7%G~1|NL|^k2f}S
zX--M!%4u&}4?o;nQ~KBT$MTNpL7&gRIhlG;_`oiuI?XSpkFLL;a(@21!s~6{)SGuR
ziFLC~C~TN}TItzUmZ#xY?pZE-cFtB?IaK$;-p96`N0;t$&zW%j<lFn^U%v}1`M#g~
z&5S7<j&FTj8kyJq`SN8^&9_;OJR2;ZUi2~l`ugQGmZx9tpZoXowfgn`ACpQ>E_zqe
z^8Njyo0iXGbDz)7iBwEEXfDr_QC<~WFg@g@(!yM~)sJo-C|I-fdCj8vF}#QUtyJrL
zs*7JvUw<M0tsx)lngy>-wk$F4uf4u7Mk*viA?9E9J)IlJTSIjgKD=;8CC=jcm(|Da
zTbeWMH13F)IB&w*!mpQKE?yX2J}quf+*afLl^<{1cfM>YzVhC`kK1-+?672MKk{(S
z>V4u$Qafe`t6z$WHT<<}cZ}WaPr7q=+)!)mYTEhe?t!1tPZ9%GFDVF_?%zK9vvE>{
z=;lZF*S9=g$ai(R^6Jeuw$!YgsVw_TvPvXlvxx4CM&mUXo=^W+R?8H)wC3?L^No`e
zFS-6axMPu~RA1}uU5sDutYg&3e_EsS+CCsCzQU`1CR4WhjEDEqt8%;7t1h*<)nR#i
z^P+H_lhfk3i_0BrI(iS9D&F@#?tZ57-DPuU{}XHzQ_ej98say1!s5pKi3iUr8cF={
zn$e>@seDq+lqEfd3oku1m2oWI!l<<Rg{S`+)0Bm!lf;<Me}45lan<DO&sF|B?>#on
ztfcPr;^j{#z3r8gSBb2xmyAzYSe)GSjO|2)qPy7g<qKGB)V3TFPu<#+nKCWJOJl12
zf?3k9EEX-}UR>!_G4It>>pVI24JKx@mdTXlaH_R7azx7nzf9#jwroz>Z-tp3a+m2n
zTe>1lO*Up~;uYJ9<tr8}|D|MlefiBThgO7dwXa;%u=3Fj{qW_p53RG&ntnrI+s@c4
zxtE?MnraJjM<?&HRDJYVSKaGMLeM_-RdMPet5@$hD0|p)AHVX+rl)J&K1bEw_9%W?
z>%42rzMakb-3D^2;wstnwPK3vrQf-)iaz#ZoyxnJCoc7O%uCAKr*pkZ^!OwWc7Y|k
zrmo3Txo)&D&!|XTefRbct4#mj|9R}bs``}$CKsc&R7x&?%n~&1-mV9ty?uLED&Fg|
zzu43xBza8F^W?)R{M&0yZ|xTS_$|@<UL22jtZ=xghQyxI<Gh>y=bzR5_e{b&c>7wr
zr~MBf?>JLyDqA{Z!OC8j=Tn$xiD_x>41242d`-%q8;5E-9i^+6UYSyr7rivuBR=?_
zz{ALh58FOmv`+pWf6&FiY~MdEhW&D9l1rtwcs3n8Sru|k*J%3>i7l@<Ug=!D-y;}v
zZgJf!jvtHvpJe;d5xdv*c9HG5YirpvL+ZCq{r8Bap=8<iWzW`yuXs4YXi509+5C6n
z#8xUE=(UyqkddXIn{oH3)z1lUXM|MsWU7`$Tw<TPXC;${=^@!$R^P*4STQn%wSQ5&
zztJr`YU^CZ7yGa8+@rj*Hr`@#^2&^tzHe?_+c|l;hK0wXxcP5fwXd#<?K!q|$G1AS
z(+7J0$|i;dFUVS?)c@?x3mfgynC)JL?`K?{c;f!lMrWCSuhds_8GM-<cv(-r@2kVh
z_fH<kzmdQ8B~T%&GDNv*uEX0sk2@>Y&*4u_JaH-Pjg_XEqHCItAp3(!)whni`L3!y
zV#M1s`()|al_@jkt#aPxus(U}v4=9I(~o3qbeeJIywGCP11i&Ww>^6AY&`d(aIuY;
zd+oG9s|V$LnHQI<>^?es)`44_>kWU_2cVqumUwf{O-BU=2K^=m1}U`dfW@Ur1x5K;
zsmUe9dIgnNL3;wtChh;d-eJ<~#Zx>=Ht)Ut_LpDv*{8{~w`a~0U%tEi`7a5t78Ns*
zm7fmxy?*}x?=xlwMxiMw>UZD1+S=zL)O_$vf<ZjP^wf=lfm?E3Et?Xka_Q_gjcmc^
zm4U}gqn=#7cu{D+=Oe4Ql)})HUiK+^zDG{mto<)F-Tjpx<MdT&`*gco*J#z6>V@Cl
zv1ZB7*x0AtTQ1nYF4cUjayI<ep+z_1UcSG&Yvtvhz(|pwi!{AwURQh^+j=KV`CDJz
zUd^sIKizj`yjt|6?e>ni^p`RA-`MJAom;={g7E^Cdo#TYclsDNztw*^t<Gpg0Q1e1
zqh7IHtE1v;XI@VY%zet_$zh+eQ&;s*sDEBc=o2wDd-IiR7KcXpADMso*U#gvcajcw
zRs`py%7uOm@;g#~<HWA=na?~6BV8SyCP_}6y=zL)!Tmaqb^l(J?YZal_>I#v;g9A!
zavUo^y$b#EuKu2l{al&OMt(zGrboKh0)x|pFXl9UH9EwnwB)4A8iv0?X+~@xCFEt7
zdVkb&S#j}l{(Sqtr%zw6w^Mx4B0Je?l6>~eaE-(^`P4x1ZYAri`EUE5`0n{3u>Ohh
zP9Mi-3oPwxZ=JcXFe_Cx&F#XW6?^}*L=>jw*=mNLWpnAspKmNODQ#hXsB-VcA4de1
zYt1TBoV>+GFf?}7>B`NWQ+Aww<+7ym?zRP;AB0aZ-Kh}Y=e7D5&#ZZ~*&7sY9Aiu0
z+PHJ3{)UH_ElxkGR6Bp}oO%-9p}S5E)<;vPJQMY(*7Sd|&UTS}N8;NZXUww`md;`R
z9&-CzlIm;43JuTm|FX@mq%vN4#hB`N(9zag+@+VZrhZbqWlhDdY2Ey;!SCNC-fOhe
ze=Ngd+HXE7Gt03iupud8O*wOn$ZX#^>Uz!&c~*BeAJ~_9>Z;tUrgKrto-S+7o~6G@
zZQ@0y37<Cjp0x7Ym}UN>V)xl~RtHx9ICQ{dvyD~lcd=#4K9drZnm#O7I_v&S?aUn)
zJyxyr8hYZdzc^j`v(9aWrN2jF(~F~Pc(1f>obiv7qgd;;@t?|b9*t}V+z+ja)VtiD
z#P+v!fn&4S)6-kxvX@Hz%imSY_&><LAzZR2Q1ozY@A1yXb7h_+=v-%0FVwjtps)Nt
z@Rti$$Tr2+%zZjW36C>soE=ibPVz;0eQjS+%c<_fzD}y-2y@}Ibwv}@6+gQ+p1$@o
zH=yL=W(8xv4G|`(@0cvDl2%rPt_j<e(laqOuw|A(m)q1c(}V*LADZi08dIBK>++{E
z_Q^Ggj|UC3#pD_EH@|9I|KL!@8@m+7!|Au<-z6KQZj)S--&y&^`+MW2lf@ywxOBzD
z=eT{)$e5A0{pzlaO)8UAFX?y}cYczRnW?D1d0Euu3fslZ7e6x>re;Jl6}tUXS3hti
zMeGkp(TgpX9F|Ny-3Ph0q?@)Z&Dz0pZw0&mk*)pH%oX&m$Hv`ZVLPYxPoi;)vg}D0
zu0l;V@8rqPK9o%Tr{td8Fw;~zB4as|oNVItw>w0#WqL0>zj;GVpDD2X_@jwGy#9DD
zemH3d>)L&D=Vp{FfAszN1rv_L1}`qP{HtVHBDgsF>W8#Dc3Wo`{@Fh1cBH_M8y05{
z$=ln_oB#J{QVQ$kO<|k6a%49ztN7trb=YUk<b5|Rp71<Yk(8Vvr}&!V;*O(Qjd^=L
z4&LYv{Zgzfof)RJ;gHmXWyV{A4wu*W29z)0Z8ZNnsk(0Z#Sc6sg6^elub;To>^M>%
zxOuC_*E8OSIRDApK5^rhFEZvgjkz_oC^+WC+$XQKmbe>#{2`zuUz<E<*2F)R-;~<6
zCa(GNF51EA_1&J*4VR9t+2p@PykuE#Zk(XNdEx%MUcFDYb;u-dQrIoC#WCSprMJrB
zjOdW9t3NE<`0m2tlkAU<p8o&u-OtX7u#OoqT87iRcdT5J$;z@+fAK~S?J2*a^k)0y
zr0mrbicolTt7)6Ub%BHf+jS;$-hMe-ZFTU19Z`O(F3in8qIK1qvzYfH$H((4WZqX8
zv7EZ#WXarbq*C2<C73hqsLVUp2S2Y&-lk~BuT~rw_qN6B-H|nWFGsIZlG}Cv#Wh{g
z#fR3dlyehYmGI1uz2Dj|;KipmdqkP$7@zsoo-?gXdVBH97Dt}j3|#XCcswplT`VZ+
zX2ShdM=p97d&cE;=^njyHZ%AVS6j@~eW$Ya^y+g)irND5zSpPyn^raP$%e9+ge@nR
zxSK21cBm}%aXa{Vlg_Eh49A#*b5xEe*WWj}x_7Z5*LK-6OPuYpO;Zo|9yEHm@1W#V
zy$YXcQx%j?_xn9tT=uN`?&<@FU38moEp95jF>eQ(<gR}Uj|PZ0+pdw-WiC2d;CX&Q
zWGMHszyoWX{O5%=WKRz<-*Kpaw*>Q|_lI10HkldR=rlela_mRtfjq@oieII!h#qIl
zSeqy@t$3?WKygV%3)`gyIZPo}@@|wkY+!0+IkfJ@$<&KaILpqd@a($edg;TuoF%qR
z>63U(E-aKeeu+h9o-&W!rIu}5#Cz2X-j`oUm@W~<RXK6hvv;2px1J4ZFk;<h|L*Lr
z{l_AeE2S(GL^ql=-n{x=_p{#91<hqyb>it4GMKwP(ko7fq@8qmpkz8%DCUFhlnq@L
z`*-!MZ#w6)?ZjKZr_&fR+P8@un0ZBZrLc5y`zMBjX~hvo1x0%lADXPV9u$z^^XJ1i
z(R&_k5z=J~_9{PQ4ZHeb`yYp3_w~wKo^_f2cyEw)A<F39hF8L&n~!SD;9jGy^TY7r
zu6=7}L_5xJkqdm;^55;*?AulLocz-z|Gb$ndwIrQ;W>^)_v0!)7;8A_X4*KVoPYDk
z=zN#O#a|P*UcRJpLM2x3VfO2f7m}}SaXVWqw&H$hLEX1h>97+|Q<wZ~zOQQ&W0ClB
z{&|lYX6HMzUn(}fu>A0DYjR0tGL!Z;AJNoZO6kG(ziM*Uu0Nm6y)603R@ob3Vi6U>
zA9$*}dFtMF6q|e5Ub4L@ru_HYsivPi6Knl9FWh>)ZrSEld!|iayF|lt(#g(ge=S!$
zoOn9ZyYH^SH1=PUd3-->Gp=&=T+Xy<dGos5%j?pnu{yHIZIExf_UGZ%dqVTdejf8E
zaqqO7{NhRDE5_BLS2u3_pEyswVZB<CM%=Xwm4?qDON)zw8@LpvXZx7%G!TDn5r1%!
zNq)jFuWN@Y6&<n{Nd253K7HYjZ8sKmPl-)@lE){r?!d>X2?@(0ud%i-yn7_{#=bMX
zT{|`E3--hxtd@~}dz?4YoV{c2pNQ!nnPk$>-%9v=f8V>yf8=iOxxabsm8pew4;I}M
zFN+CWI@O%<Sm=^U5qtF&PYZUoX|9=Mp`mho$D2n@*BH}&oLZ>#rJOfYBdL4t!fRQs
zd?{M)oBt{4&RWHME}Ny~MnRSIo&KAzPAv7&n&QpA|Ii_QZLulGd21K?T(zvZm(Y@I
zwKQ_sGnv`OCI{J`PrZLHHBM4=qu1*d8Lx5|H)nSHK6(=5k$zzM<aMhID=!L~1bR97
z3o<nK9pE`ySo7`2owxiPcKTX7S3B>wKQsBbljN;idIt9x+w&~`^fYmtVx4z+ri$&X
zRSb0oA%#1q9Z|U;B~h$-!CIwxlK_kDmIr@*lP>V{9+lvc`Rl^o5|s8fSN5r5XnCho
zPUDgj(^qWs?L4IQZoi&KfRSpUO3)1ZUGlef?MOWy+2EJkJj;59-}a1@)WTVh&rhyC
zKIi_tZIcVTPG#&mR(MtZ^@BZ!y;9;iYCN|uF7!Wo`NZ~@Vpp@7t_YhX*;-w=;3GPr
z{70<NBO!O)%a?lCrdF`Oi(&d&(BXOAs6O_}Czn0*{SyD}cfZ6GBVd=Ja?W$d!b@eB
z)s9PkcT{_?{zT-!o#|nZrXM`I;nkG_OV(FjC5t9ZdjEaGi@i4<{9(KDn9pLtzEjqX
zYz&XLKaXhGk|Pyy=dp_7DwQYaADs_5pB1LMdWJTGiDtJB<FCxi!6GWJ_xwA$L28}N
zsnhc^RfMiexhCBHu;1knb1G9Y|G~=gMQgiHFRW~v%q_>bA#{(C*h<qvM#YSC6%(Fl
zCAQv-h(CMbW6$f!`q$#0#H)O$|LR)z&2`RvWxie9A8N8pqR(mR&V8~haKpj3an={?
zn_k!6yRLaIt6cS>l8j)1!TaOalulfidu;me*Y4umCXch@=azpJT>h@qA|m>oTHwQ|
zWZUFL{@Y(Nc^(Zoykli|@RK)d*nDr_JCLtGZ-4c#+%IoGtDn!=q*;AnU5X^v)w^q>
zC#<%tI9N8nwy67>w~6k|DGD!Sv$+$*Dq}7DGpzd9-_#s%5|FZuUMb%)MUlT~&wI!9
zqEEIq>^Ww^?X3EG_o+k7jwa>e&7DHuxSIbfojV}1?!toyH^f_Af_N(R5=B;U?B@Eg
z$V0ef&&mWIhvuSL@twRn$3C)KE(opY{5s+EL<uQv?;}=vlM^SJoQ-Xsc}mS<%f`zY
zayec9_GnGqG5OE$rBm6rI!Cm-eBG|n&K<h<v9Rj|jSsHbq4O3kelN$!`k4D`{(?rs
z^_7fs#4`T)7*@6Mg@|tH5)X^G+GxzsuuNF?;FZ3sN#^|v<R9Nk))(7T|E{u0?9Fo_
zzivUhP)#NyrgoR_+coA3N|bF6n#F&M;epfdwvBvCCvKHp?ZJIiRjW&-L6WmJ@e1?b
z8BA}(%%eUu=<04bcZ0oq`qq@?{>oWTLuRvzN!>E*pPAbx{w*bd*UILdbE44~#|-wi
z=r>Cq>*`F5pFg4FjD6Q6myX*LgQn^=`O3W9v0o`QI4wd^>$R+v(63oRYvN{m6z^er
z)m9%KE<I!7%cQQx)tc)HEB?;TzI(ZM>3fEgp0lfFy!~>x`sC(K(#t=e^Y$03V6GD?
zS@!#?*;hlYDL<6|&a#!eEm*kpOx&~1KQBB3Dy{QQw*FP*4cjy?$t-12!HWxx`l~`t
zB~CGjOt^dL2mb~J1^w!e!7V?sTl_U|E;{terrYhWMzwShXFx@B;c@Q!vTaAtKU{bt
z?(%Im=e>s(+s_veF+CgI=Q8Ej{h3;?Se-u>cQ>qf`L)b3kh{5V(<*tHx8Iur`2x1R
zc&I#cwMgVu-sd~d+WB`B2o$f?THJl(Y-C)*ubG#>HP&fJe7_ahX~{HEZ|?mA*VgJJ
zvfZ2A*>Hz>(d1uw3rdBTl|9cpCekdk_s^=o7Ip@uw<UO21{^yg{im&c*R!XmZ^a1<
zM+QqZ{s=Yw>^sp!@;d+Ne#2?I-uCG1*PEkf7}{GMd?{6{-DyW(%=cx|%m2K&Sbk^I
zzAWAyycVfZ;&rn;e<}HG{B>q_(erf~bM~7Smu%OP_4~qeVf(9#({oxs|C@8TsYZ39
z^_C0&@|Fe5-ZhrZ+A%kdKl!!aHLciU^|E_iOSdPyR>)3eGdZToD79>^0<+VeCkr3V
zC^<BdOLP70Y2QytFF9yhe|Ku;Me*7^t!E7luigh1Yh0GfIapd~8M^tY?aZqY2GZB3
zNH4t=&&QU$I4@JE&PTJwKcg&Sp_b0&%M5%zUs*eDifLI$S^xNI(*ExE_T{EF(|n^Q
zPHg&Cv*ggll}~#vJN-%aFMF%v*B;4W5*x=F_Vv87;Gg@ZhxdJ4lDp65yK18EYj00Z
zuP-;Bv2uj2VNz*{tYNG<kaaa+&LrvSB0D6?9t2h=Tn$RvC7c?Os%@}0&1>S#6mKWS
zbq=A;r!5+HPSCR}X;^5n+%mNz%P8n}!onY%#cC4Q*|+B|GSgbOl<$MUEoMat<zFqz
z>PAsQw+cVbi+y(WJO2@Gsho+)wT<obgxA$9sR%qe<={bvP@^wSk!`7>RSMhr%I5^1
zvp6a->*FrQqCHN+jvqCTp5o+5O?8>>wfuIC#r7pnN=&lyre=GkuwF|{D*kWx)P3q|
z-G9!Hzb^kRcY$N+g%x27<{8)oNQ6I@*!)PU{=nQ`)hyBVeYI<nH^c~SIv66AEAAn#
z;XLP<|Hh=1M|7kjdJ8QV&PkdS*1b&WQ{b(u$9I*+=C7XoI9cM}u9=VRT9UnL&dxUR
z{_*;wnA)3<^8Y^UUN5&rVDYE;{r`TwKEA*H&sX{1JJxMnBKPcXk#p<ogUUamWG`QR
z+^+tm`TDC@Gp6@HZg=G85LnF5te++DXYc)j_63X08yFt$?p<7c{MC(ZQZ~XY_T}58
zZb_)V=6bAE)8?`C^4;~B-Z!M;^*eU#Ub8ywzuL+N9=g#B)E$Z?)fx9R$MN2i`(NuW
zbEd2R+v3P0hWmH#6o2H<&~s)**_(e(F3ya*McSoXA9Ze$zS+3wg@Tq!$lTnIe6Kd=
zG0ZF1o@}dqZHmT&Bq`BZn`EB)tG`cQ_<~RA+v~+qT}LgK`t@82S#|YFK*2keKv$6m
zC$j4p9$PsW{y8NYq;;z+U7|rKPh2YXuGXetM;)~@M_z35u3xh@*!AzKElabfC&r3o
zq{}L%2)jp1?rrIcj4OFLMQB3(k2@Eh-3d7JeU@M3g}ke0D-I;?e$8{c_YT7g$Bbsj
zk9Rk2S!hwQ{iws&_T@L6+g%G1lQj0Y?A&=+=ybvAFHW~!J~W%##;X4Jui@*f0R>_&
zCW`+Rs`j7L^*FGS@$?~8)<ppuub-P%@yABt{}N5jW=1tbDehJKxJ5%^UK=g)Ts~9t
z@xh%nGY@TFy~xp8|A5g??wO*|MQ<B~Z1=WXhL|W8Uz$~U?)kKmH?hU@ygRJ_H#~YR
zD*ih~au-|o=@c`8ZEv}yID6&i9o1VjUEJhXOZ=~8S=_=0UA7<nV&K5O@W#}V{F^1E
zhC3F%D>&JuHbZE32gkfT{+@%Hg^r??JC-{<ZMg8>KYQoHDyd`z%Nfz1omSrWc${>a
z@7ayJw~de8oZVdbsPo>+2DT^m?_&a%gjGG?b~(}GPRxoEhdxbCeb*3MHznRl>dn2=
z*VhT{&1jul=B4ehHaYG+&xM36rfj|43p3wt68!yn+l)_>cxSsM_r6=THGRoxt6r0)
zji1xL*$H2l%3ayu{&m8ZMV!JVGhgV;`gW}2V_e0IGHVu@W4Yg)nN3SM3?i<5JM1KB
z!y>V2)7=XVrSFv9J^UNo_j1MEs4z==SJguKHZz5K;X@nKPxl(nO1PxR!FG-J%7OI2
ziM7?ID_tI#HYXb>X0o3Oa4S8*Q@m<BpO@Enzig>{hi{AbR%da&=(+JQ`P*9kYk~pS
z*b;uPO8t6!y5_!`37YPW?yr}u+^19L^y{3tnzwDXS9dmdv-Fn@Wv{buzcu)?)#1ge
zJu?-1{rBk@SIVFJ_g2BmxaNRU%C_KlvNz_6OYhZQcQ?O$ddmyh*L+qx7939gT9+Vs
zQ1>)D-}*_>pE5JsS2w)-m~~j{z#~KXiyf;X^QRj&t+A}QJimH=O3ao$V&R+Y8t$)3
z^El7lsv(z<QdT)_by@6<U%W-@BvuJW%ubtjwEWk*o8RsC+|E3g_{l8gh?uLA?LGbj
zTedmfsbA$G8FQZ{%SEVp@y{>fkwGu^i0x^1kGbFS-T5A`;V%7m#gPKjdi>_tm2<7r
zEfG_5mNZb}lRdko{Qr%AWpNkpKI*J#=U!LcaDUxl^`6IGZk?OVGt{};+%-&<i?_yh
zpVt)1yek@4{!u#a{2%T#&7IfW)cz_fX>2lET>Mk#=;hlBZS(s7NOHBkWah43xAC1?
z&L^F-_9Y54oaZ`JCMOD13hv@O_gL9K{+(e5-yU80*)HW(%-K_Q-*0NwG&V4(Pi#$8
z`7WdR%Cc6j{7vKUJ^wFF__S~Pl|$T8!rR{P{aBpW9#F6Tu5Q{4wQIYwA|AJ1)-|(u
zlhK~LhWCW?%5&<TGA>`gU2N{SXZKHA@b0SzlRNGm`WfSLJz8yH@Ye6b-c|=*2fpH%
zyZG$3eOcPyoC>*&12$b^nR|_Kd#|_6OKtD^hq)74y~Hkbp3Zq1bktOwNo|I8Xz6Ws
znczhxNps?Ra~L@;M@`$YsoXp8>+yI~u5W$3sc)8Q$eD139pJt*^`WNJyWp>l6@UL)
z+d1k!ztFOw&*!kuhyBGut70W?Wu5S?IqK(7y4BHg<05r8jwxP^Zhc*^Z!_|LnVB22
z?!fZ%2^@Kg^hC1K*Pp9O$mNhdvTJ+v`>zugMlZINtC(=^?}iU4k}+aCt_JekK5@=}
zu%DGfNsQ&p`jEV5$-cr8{qt^LD0uOu_3KpDz^PR#uEyurF?0u6RZsq#aqvm_-16uD
z6+hqOzifT~``ORi{yM0Jn>%=w9l9_hBTXj3{L8XCj@*APT=}%fIOXx(F21a^x_YnA
z7au>K5b0<r%j5sdaPGrEjj3fuSD5d-SQ)y%^XB4v2Nvd5{7||*?QLeR?Bk2|N^5Ih
zOq~AdSi!4XN8a{c&+4{MbIkm`>(UNko9X^XR!j6N9yYjHvTB!u)J3<W1{)?tMZb=C
z8GYl#zQZfZk5%;Kw@4Idc(Y%A^se)q&Hnnlpq^ii^L)iawyo&T7WejJ*|AMgmPL9(
z#GC^QZr3fl+_i1(^c~{+@{(*;vZm-{YkVx<Z4_%4Rqb)&zSldkpHA79^S}4}(q%ro
z|G$Gxv>o5KOj#AaFWI}3?lqTgU%Qd{RrZX_1;KM2(!@?W$nLtXz2trWtsoZ0Ya0S5
z${60BmSwl-?Ayl&wBmY`j-UDeM<b{+QRm!=$|K&-w>t*T=ka6jdjGv!&34cED&;pK
zNvRcFdlcihc&_d`U*zU$_^Rn~#LE4=8l3m;zb?CQ%VT%1+#ic6uYYbYsZ5v>YiJ?A
z`&m)7&hImaI{0>e>znU%WbMl{Y?G#&N=2S8{AKoi4f9v_7s(2Vb3Jc=)zW^p_`$=&
zkJ}IKFxK#PoO?`spO0MVwA&$HSE!aQ*s+P>P5a&FFMN864u%|Y+QRoJc)CinUqjo*
z^Qp~8dEaoI-?us_ZPrvav6$vonP2O=r<MKfoEEY*@70N08yT%`xJaLz&A(#XPj}bj
zLcTlPOtr3Py4K2`6FD|{!cPX%)~`nx<U5KlR!conS-9)H68pzX`RzC6ZCP($c)#$H
zq0hDoww;+4hh8!K%@Urmfx$j+Q&rp6Gj?igQn$@zwcvkwMApuK_3E78u@_eR<$SPS
zpwHZu<fq*!r%^Sn!oqN#cd}&^i-1goow)Go10R^y{Ym&!dcUer*=^Nh;WNyA?HB%Z
zu2%h&W^DStWa9)kDZdqqB_$NBPkh$>VJCg(!ur^Z!~+*6PFdjT_NJ;{^51Rw!}`Y`
zDm;84a&V=c>jkGa6YU*OLzWtFYbn^Du#%l=)N@0)=(LGRfVk?s(|5zHLsIm!BsZUr
zH?g=Ic}^$8pht%J`Q`@?^>X6B-iZ4unYm#pYrs=`PTR7WAG!_+>$b0FNeZq_5aFtP
zDp|}d)!B4YEY)Dr9`)_M{;OHzWGCd@`15;x!`bGTWxp=_r><-5wDL65Oj*iwzQ}pe
z_5+Jg=&*>o)%9Mw_u0Eij#tNj;-NiKH~SxLd|_;7XTQbosn4@}(<+R%-Ca~3WVSu%
zS3z~jlKwY~Rt4HT=eqny>Tl<bOFPdis6Pl_;k?nTD!r-7pW$78mBK35nR(e(cVEWu
ztFHU?_x0uN{{0_y`W|y>%=W$AzB*YsPi$^P9^V|XwIMH+%T5POp0U3F)s}NlbOLtD
zTyqe8;WM=^$Y%4A%~KvYB*vtsRc_iY_Rz1DrQ1{cdh?-dzsO6MPJ2Ii+wxsETrmD%
zQ<C5Eqq)bTLl`=a^gE_@bvp}oxHn(C^<XB;#mEnyf-AkQ#jN7hY*DPZ_*$YrTgTb(
z&>fpuuMTexmOt~^bMs}D_q&@FkBj;n23>uvvaoRNce$^Ee|Gy``xxiAiA%|PvB~qw
zH_PAune6F(mHR?!^lRG-(?h>pSm*eEC-=8(9e&MeDz?8`CM{ZPpkH!v&sGD;V@l>%
zIX{}T{_Eqp!tpMBVV|sonB95pO}sk34If2r#WWjpowv$4f7(4c?R$yLtfhaMdgA8a
zIJ(TEV*jtXRtpbozV*3nY3r*U$29XrUuD_co7b`2Fms94L=)BP8c$A_v>trEUtZW$
z==aPOT4qslLAk9V()yvftacC2hVn$tui88Ffp+4f?j0uH6C9QoUhfI%znEw1mMYG~
z{P*z}lgn4utjnKY|NY6+*Xif)^L@{sXZ!cz+1cCA`}=?2oHIjp^XAXdg}xt?>@RD~
z%Zd0Fmip2`<@P3~*-?d&%TG(JeSTiC;jXEle6CmH;sfg&cSqfFoKqb1#PRdZ>k`NI
zvV6`ghz#BMD!TMr$nou&)jB0I>9WT+crRn#>2~JB?4=UF%jHZ@HZWJ@92MbNy}!G7
z$s|`p^@=~MKTJQgYrE1{;jUHXi&y9EE1s}j;@h6k{N?{FUOJSwZ@j`8Bm45Z#Lu`b
zu4Yz0zMOK|{&}&LMLg3iiQ1g{<FA_fDqd@Jag~2-`YrOZkU!B#*4M?My2bgH{u`Mi
zDeY6|OZL8elaM>Ph~aqQuPgK3MC^B4BD{X1a{a0GkFGBbwCb!n(amwcoh5sL>@?;m
z#lp6@@;7}vi?wz}Kk9hv9CQ0cXq;g0-e{xzr{89XUh$Y)CbzTPJ=x^w9Es-noIl<u
z@W;%sRSUTE)K6!D73c0>d;H7m3f1_6_s`2^&w3@=VBp&Dta6d9-t%7JWwWmD<ym0x
zAwGJdr*&@f-pw}>P6)P2F4xg`bvpF$pGlKrKFq$VwdU@Pkcw+Jg9<j5zH2_cd`)TG
zzExEVwok|`kU1&8^5v0_whoKR&ZVq-8)u=hqOX58%j4qe44#HVKhk@eGtcWMZMz(?
z)hypvW8>t~{=(vkzoU#!1w4+swnut}$n~##Kcy|Y|7f#*)XJ8_dyGT(8oWE1I_KIK
zKdUPFxmDJ4>L$&R`W|}pEpuex1Er;Ld*mM7_IYvQ6G#3E&E@%v^0wwZlCN`ERlX{D
z%EIr9N*A-u6;G1>`6^(CeqhwJAAYCo_TREwByq&~VxUsp)5w_X%d+phT%LF6&XJDp
zmvQm=h8M!!)SAzh95Ua}m{GU?F-LrbmxQL`o5Wj8Iq{JvJXhHkU$06{lnDP(cKplY
zz24KN8HBKXNj=ix+mdB_@vd)6^L{b5IbH|MtCq*ja-UVK{5N%x)dBW9)27;Kh}ZAf
z9&zZ)U%#js@ipN$Wz8$+USc%;;&yK0wDqAqr74Ts|5QcJes}J)Ywyjc>09>Qe!OL0
z;>M`>qRO>e+#Wn<qi0^tZn~l;Q`h)qh3p@f{^C2+UR_xHd{;g1)hMeES9;B5x>dHz
zxJN$}d?cQtoIO43<Z<DpuWALi#aHe0J6OEQ>)i@2mC4?AJK1s`>BJT!nrn!>mOWUp
zqcGv#yVZr+H@&!Tq{ck*4s(}Q-`BP1zS$47g$GlYf7f@9W?-0A#K<6ww(y`NwYWsD
zpz`Y8+WOmOn>7CHw`a}1|2HrzMa^&f?Q7d#$z3muny<EP{o9;s`Qz<NRZgTSPt?*p
z`t9S#^8KHg8Y&j6Sih`%cQr4$lZCCB(LjRdS*o^`b>-LF-)7fnbVcRJ_qiCJKfZHC
z+2XyCW_!eL>rWP!j=orDxqJ1e)vqhRd^&p0e%r(O`HMbh3+@#yjdW4|80d5Arihk%
z@kC$q1;^q{^iOmC5f1HUns@E9)v4}`S)%0^HRStUTbJf<+HG}HBK)a|*X55%`&PKj
za{E~l7WP>~yQ^s4+0UC+nD02FGdte@Q=?V^ll{-58|L^Nnb5Ury7I^8PAj$_jk$BK
zch=V=v(+xKtG{pFy=>Nuhxv8JddqIsRIH6VHD8+R;H#`@p<6HPf4w_t#`IUuHD-5L
z+Ff1mx^c#;_w@{SuYBJWc0cXshr=$@=lgE@xnoVqTrF+4)X(12SASluH2Xz-_rWz<
z?KdpHKB-d5``T~)_s)^rI`h-r+AkbS*2(F1)kO5Md{GMS&s#p(<&3uCq~^{85AE9D
zM|hrj%Awj7((Gy{X?fn|qv85fOxjlY%O-#FvXh!7x^-pTMUmgrS7b@t*<R_(Tu@*w
zVl4Ak&S!=FDXqUJ-oKu*Jd9f-l1ngbeTZ*la#ye9=OxZ-rO(QSE6>=u*x2yB>vE;p
z4@B-P?!11x<IsF<L;w6wPD{R;HXPBs)BR85vr_BJ;O~p7%uYUkwR?ts+RNio99OyW
zRGuxGrL<@Ere6xHN+R^SD#Obb%!%xNFr)6D(vuRugtVB@n<4w{cd#ZHRQmncsbhMg
zP2R;YsJ`@Nam3MpqPRmvuP?4Q4t#o3Wqsz<yqqVGU)Wgwzpu{z^51#(-}`0c{%-NU
zyTJW<wfgc!aX!xi<-PW5FF5AP!|z|f8Oqtz9bJ7^e(?{-(5Y9IPo0+h(jlcj`HkVx
z`=at)pO#fHD}U~YvQPWDB<9TH)4VCO>}B_MZ#ufi<yz+(AvX3KA_eDordb;tS2`pr
zIrZ_2+4)LR+9x9tbMJONWU6C4&gu|6k@520a|wye(~mhFU_Es-MTFNSr2a&@v7wjQ
zf}LO9Og}vN%a;d#?!LVE@8fD_iP`!4DrL0p*M5%(Id&n_uq)xZ27`P;;U5{v3%p`1
z5|zF-yVfj}d87Da)<;_lTU)!Wg8$xGyZm?{wz_xm`bB>$O>f@oXAEVC>0Efio@vVL
znmS(TfJg>LmNy)Wd$(8bU;6v`^89a%$HF-tO_ezOg7L91Yl)t;4@=RWjEcFTHw8EX
zjx)UTy5rVhRKxtw#%0dJ_+X~~`=7WN&T1)0Tx}29aGv4tW6@9VUNCID_xs~n$6vQ^
zo4?$>`0(HP{^!dQ9rv7k{gZXgyrVfvdJC%fJL@Vrcf?-Ed9`Op?Z-vp2lwAEtN!xZ
z{nu9gdf5l-=U)HwdiM1nuW#=!uU_?T`~L&#_fLLbAHP>AVtu^q3ib8z!Yn_2@2cjk
zwa|JVIPsv??umP3GPq~E8=cL2dQRZ)h2v`R2im7sdcPOCQQg>EqW5Lh3x#Ey4$5Xt
zET~vHZ|{@zw4dv*>|Q_XQ+@dPfA6OMkJ|ftm*#)|uW#h*e&%1<oj>c-{Z;Are?8qF
z{C;2dsrM_>tLuKsU)?P~`_u1NH}}Q=n_BgKm1g~dd9pvA#?NNfIQ@Rl1(&*mk8gcV
zQ{V}x+ExDL@<GXSTM9+*^RHihZpogPb~%@?XAAt^#cz1FvgTg*3r?<L-N&_(Sx<Pb
z>1+w$yfJmTam4?*JBkI}&o8p@D=>evMfuv%py_va?A}=T>)jh0Tl<Fkn2gXr@<*br
z{{LCDD0bOx&wX#)-V6VUZ@K@UongVR^?l!OJ2>pDFI$|e^Z)#d{kz^<3#V|*{k}N;
z?)R1h$2@u(Eg!boY30A-6Zxko#nAsmv_UC)qAx2$*rjNu?liq+bMu&v2!}5BW>w|S
zJ@tKY#G#&2<-@zRE1qprT>U62BsZW`k9TXLM4fF->A&J%V%sEdG&9cp{iAe`^xikF
zAJ2a%XaDz4t6o0!)4_><cDL8dbFfA{H~*PYcXws^;;J}7xdT%~q>A+G9qkLNcnX8A
z?5>KscOcri%f}_Gc}ei|$caXG62qrYeK7B<viRTb+1{J)$4tm<QJ!~A*kW&qLqpbt
zFE=zEe=(e`lMwxC@q>92?p*Dhf4qmeV0)*ARm>9U+Kc^hX0j_c?GcN*<Ns~dYF5wv
z<;IRh9_f=`xh@tuaCjlBzl@3AhSG=eH!eTgY~KEx{e1tuy}mDRNABUg%-MK;_3mX$
z7cF|HFsWg?%k!k?lO~F&bh!OLwEW5k<$#{q%L>a~brO@0_5Sq=;T1Gtx_|gYozf4E
zZ|`gPcCWwKb3fH$L%`&+>G3svdct<6t5)Bx%gN6@v9NEK?w<vozkifX;9z=Eko?WV
zODjzw`sGVEvkGqU-3mdCGp6>smF%0WdmxhentNNX|0|*Un?#xyiFst65L9ncnYMO?
zT-eVZ|M&kNzdd;K<HegV{}soaKmR)0aAuBq>+9!Rv>2mSNxurXzAASAbREXaRklnk
zeT)Lcx_t%aR#Z#3@QFx0mXoPJCb{OnU59=_nrLmzqqUdJ9+<yA?%w^<Aw*-963?U?
z9wAc~rJFTu?w#^@(GJltpWEJBH4@Axdc1M#aFy(Rz|eANUK>lgPfk`~=ejwZx__BI
z2BZ`(j<)`>b>8>nzt2AIJyKk|)>J>}#k$E)XNagOI5*8}Jexg3)?m4j)q`)3tN6Zn
zJ-?cCle2weW$2|-6BI;OGA?wwT+iwhzPPcU^Kx6fE#vCom0eA-oP8e!4@CAJF`IXT
z*C(lU#u1gL-?gLMY#XCu12m<cC`8|vH0G2mo31?Bd3A%3?9mPH<z1y~*C?&+Xnpbg
z!pdjKy^Q?(&WnA1UXapiuiasO@^z(j*QdL}#{|xM27VKqCcbuO>9R|{Qx7(7H!5&!
zTO5#i?^2NQ7ej4>iK4l(>Vj*OC#`1rzDC=Eqi@>hhFaU1d2YO}*RJS#`nXxj6gRe%
zcbqP0VGgs(&a-TN<!WcX{PNLM<LPaak9sT#S!CA6^E*!ASg>LH!xg_i-rRlobMw^4
z<uN|*c&d1hEYVrlp?Tu!#Kln!v!c&#y7jS5_w(mRYb|a)KU8D4Xl9y1J>TW{h3oI#
z<WA}F&WQElWa&6^;H8#8o!bx5Yr5|qA7NI1dUaK+b5&1n<06h}|75HWKU;sDsl#=3
z+kxA&i_T=^>bYhsbUplPvf8djtYyN@%nprb2MTqiFS>c{Nww5#c&D)Xtffa2lTF;s
z5B(bT7hm%8`v)jX9X2eftgio{7NE22cF<}4Gl`tq?GG3DHc8K&bH3ir_C|Fn8~dxT
zsonEWOYhssxMb5w7ayg&7JZKw#Th=dH@YV8YO3-2z_zcNOl+U+Om{xDY1iB>vd~^~
zp}qJ{j+{V$hv!SQ+_@)wQg@irQSN?Jtiol}$s(b%lFC!=F8K9L<ig2BM)Tj7DuU9A
z)7hh4m9M3z1v2+8lhUof8Pq?o<2Fz0kJLx{^Obct`64;Lq|M_OpS<Rf^Lvfwui0OG
zk2P7!eYo<QqYksR>Q{Y*<}Z_0B@1l)=#X~mn$TU*PbRSow!HcL=`Po-zg2Vj*DpOL
zqrJv-|Mrc4%uex~i~Hiy=_K2m5qfshuCU@2^Ewspo$lk<?02^};X;C{*Rq`=<`&ku
zi=|E<$z=~c=_6J#ch&XRpPIMd%(aX4S?o05l7lHJI-Ys`g5M1~hyDh>H}x!G+tkug
zHfjB2aqSbH?h*MCoV(qgCck^IE-y8d{ai+V$YhBNW?RIA{x{BX@pG>ex%hjT^!;@&
z+UD@F{(E~oew|p)i*<UlT{NUuzit1<UOK~jk#9{~zuD9)E7co!HJ;evmwz+r-V^Uf
z_8T6oV-51#qS%nCc{XFB+toF@cGf8~*0>*;`yi(xo!NEKB)P^T&0EeLI~3wzwu?#N
z@uE7B<4e+Z-nh3@#q`B*r9PGog}<I<&*sQj{x0#Y-JkT#nfEqs`m|s{eQvJsswb~n
z^4eH<@@&t1ba2}w$fF-O_1fe$`<`Vh3YJfvXwY3YJ;7n`QtiYjx4Au4x4YSV*FSu}
zF6`pMQzrwIHgaVo?31flZyX#uWucoa=U1Lpfv=SvWTV!lp8gSBCp%5Jf=h$_<BGj)
z8?wHrhTaY+=~m8Jbu8>@kK$kb)$L2WW^$UGTP-#9l<XS$+~S>iU;b2n338sSTM)>Q
zt$FA{W6gSp0!!Ae-KUop)?BKbdF^w~z7^IV1m?3?tq#fD-<2^#^rK99%Zu-u{OW9L
zYRi6HzIbnTbGU4nk2>#*ckhq5OsEe}nsoN42a~iuSLSM_rVR`ai)Sc0Bz<Y=I?^xh
zo_wM4*Rhw2b_gw2v6|zZ5F_$FmAi22Maj8SFB&*;1YX^H^3@AxyO{<Te4=_?LXTbg
zQ5xpa(2`#!?DX{eY@PY#yY{PJythQJ`r<<g#)V=62QE&`s8e?EQdrH&EW;7Pox#mk
zt=Gz*5*#D=%jBee2j~3Q(@ZTcS5|nf<UA?TE9S(gEq$glKb>_=tkpAtO$SWN<Lac(
zs&&sgdD69VzSor_Q<-IJ^Iz3$)X2&Fn-RV5TE5P|g<YRi`49V_d%>?G-*nOU!`gKl
zU7B;5yA!pZvhu{)b=?g$?VG)E^4wj|ugU%3Zm8%m-y`>JqTD?x+2d*#-=$`T#s@n&
z-gHx7Jo@)mN`zCB>fP%n%9?I0;<)0~mDj`d;q&A0<0|+6oeIyE{#yF$dDFB{m7DmZ
z1-qt+i*GpR7<RaxvDec~wrA6eGV@(`C-|J(^FH~EsLUJdsBqOU-Id)McFT(Q)FoXD
zDt*AXt-Qm_B**`*pJ4UTF#X&-<=<=d-1N=f%m4b$e=+S)xaVAc+q-qolec@zwxr7k
z%Cv9O`#7t}!tteGZq}BMlafzg3FZ2}tL@YOwqu!`IsqoL9-sPsV8N-*3ie69?f2v!
zEO?hE@mlK0F6{)l1H#Hj546Q}bM3YK_i}l2@Gd12t&>7KK8Ty1&$!a@XeZ0PLyNn(
z<mKkd&w2NDzWhJ#^_k_<92x8if}d(Ezo_`ZQl4Sup_@NfKQ4dH@E~=^WDmt{UY~wf
z6cv2wTJN9ybL#V_FLy6i{uxvE^!f4q4;DX;|8f22!`sYxR@34iFN<IP-tR^4zk}~D
zNVJDB{duas{yX3O2f}|&`}5UVTi&p@uUL9-#{Qj0b}N5<lk%Qt{nzB*oh{96CM*p5
zJ?_+5S=rfExX$<(ep2WkuXwy2OXKfdPhxq}tz=|BoV&75+$`<Gx%-7jHgxnh?AbkO
z`<<ule!6PO&!^pHXwEOpyKmk+Rp$RC<70Y;ogWe$<x>``H@I7bF&A;HO|SZJOSO9O
z7GEamY8gi9T!G%=8}io=&5fASyMNC5FzupsQg0hPCVbkqNv+fBb<h!s#0iH^Y5n(i
z^ksOSl@ew0%ja8{RXyt@qZ5kHwlyf(PVs-jQTEohc!|~lA61R1Q`UY^R@=0x+i;zh
zbnLvxYmGBQSC=d7pJHBjxYM#>bwf<3f}x~A*2YDL5;h6EV|eML;hueI@l#DHJMT-Y
zC*D}<xb3@4TdT+cU2aK+H=Doe{bPRp{h?ymY<`;;!SbFb-nhmz$ZOVJ;5|Fv#lL0Q
z+`L7BA^Eaj+MkwiIhAznioDVO#iUf=dDyd<1(}-v9=6Lb+L4{paq7b)?a$68U*617
zcULg)$w)VA<Js0crEhhK)`kASS?NY*O+3+|R{lqIW!NKoTqPame)N2D!=PY7*@D~*
zAIGNi>sZ#xZkF=9qq>6s!=t-LW}kb+azyS+Y%-?}Q@Lr7CSTgDZ9M&kE{}iAbL%K{
zuI#Ow_+ggA(wb{8XZ=mq?r;}6y5UId>Q!<fD*~qY7%<P-B9q6g%6p<W>*ejehm|Kq
zzPNrbJE3bymAYZeyua`FZqL8*YD(Qaxh3{Y`x6TfZt^%>+4$>;{=Mt*iv(w1QBLR$
zZ(q*tWwYs3$-kZ4OYi3=PVL_O>(is@{L{tTe?C2W^3A8eH>dwEEwtOe$3jnEKd$#h
z{`bEQPVfI+Zm9p1_WlIx-sWp1bGyZF-;cF>{b=SrCzYA0#aq<#6Hdh4e!*C`BenE@
zWZjFT!~gGu3Oo$|K7Vfa{~Nph6v@8$Z)IU?ZS!qHi|abyzozSab(hpumF+8kmHcgA
z-L<>-?)mL2={{WcN~~>DP7H^KcJ`dYoeXiUXBua)g)Ee2tuj|w{9Hs|^UU!bN7h_z
zy~A-{amDjn8OxTMZMiJtX+Lv8<lLP8`3qW?70BO9z3jQ_*^Y|}w~o(z8)#|qZb3cY
zs_Q=vFn^MtSC)~NFY#IK`OnjB>66t=QdLcJt)8+!>#%j1Bj&mOq0`=u{QOV-haMa3
zUHYee$C>KxqjS{lJDo1*Ra|@(|6sR(gY%lWWA*yH-%c(M`m@+FxWU*-@bPr5&QINu
z9U_xv9s1G8wCnw;zBPflS<hB=f0_OMB-2?wo|2e~2G_8&*&!U|KXe{)C~jiv@eL^2
zd-`a~k=bUs1_nj8D?`2=(Of+Ju7bg{Ki9N{ru3|PD9GveYGeP|su>pSa<3#O?{VD_
z-B>1&8m?D-;qlxo8E@XUi+j&j|NWa7T-f#1ntl1Hf_5fZ#S2eb({$W^>4q!6oL*@7
z_M!77j|W8;wNKS1TECN6-7LMZI(ttNi|1^|Xq82?kM^H%FVbW-a*LRvvzqzxq)w-;
zX4jgUyN@*{AKG9!S;aXntF`Cy->bIfzj+FncrV*}ZrClIEwbd_4xXv^Oq?as+FvKk
z?^pelE7N{qV)Qv<)x#_JL*HJWzhu)9)2}zXJhn*soO;M!c0lvuJ$30t*F1X`<?v`s
zs@gtp_n+=r)1-ap*GnD>p3wZ!)8(CuJ;Sc}R!gZYW61@o3@T52U-a}|K4QWXc-iZ1
z506};zJ7kr;Z<V)qZZG)H+6YIj*j@|bAA%Je^_QjaG%?<^f!-{iOh|?-x>{$s!raL
z$h9r;Q^&azH*?;V>urpZ%4d{FcyYF7ndstostJ1KD<Xdc8GWC;Tr#;qe%D5OhwNSk
z8JiDsDkf}l6PHYz6)@q<$w>^`oNn(|Y5004N_EGxsO#<(u`4PYtc9W<t%&D5b>vHj
z9`DDE%G&FvxGZt}v#3FqzbrVDOHq=m@pv24mun{9mlki?!QJn#oLcP@Fx~KJ-t&W-
zGuks$roTL`XB3mNZBO@O)`HLLQoAgi{+R53TXDYH@37s94>L?={7c{oTKp!W*x-g!
zW3R)M{zD<R+Dz26Pd(U>T63scQC3mP%-t!eldazDpSDfz+kU3+q1%`5|9|(#ztY<Q
zH&$=GIazN1st*BwIag=hZA@Ie>UGcG*vvPX-`G#cPs{n3JkR8;<ZfXF;fY<Q2^ASx
zS*tFmF9<)&m2p35ZPKd;o3H&m)_7^bm*&dXx4(V#T*XqoYjNh1Y7zG726FSw9Oo^z
zd)vHGYU9?ztRIbYW-MX2%JS-UzU`ycfBOy#Ha6TnzQ+3I_kDk|=SKcIJBvp-`-`}?
zZQW7NqqmgB=U!YBbXITnzmN-;KCrY`s%{Ee{M936yM|cz%5P0~k4@ZtQ?4mDQ6Nuy
z_QXXm#W%cNdpb8{b&>iEy#>9DUjO`N>wYerx#U*H%&<a*?<OB=UneG{vd;?OlvL=8
zTg~t~aLwfmr<MJw(zU`T!>%?LFN@mXX5Hlc-DWqhj3wuamEYZpzMo+<of0m0Ejq=k
z{a@ivmmQyT|0W-ZSF~Z@m??Ivswg*tElc8-_}{NB3aral{`{-%;s5x@9-YM-cTD^?
zAw%}&#Y1mv89q4c?_$!rciV%7UozX*SD4@E{eNzONHe)<EvwlQd4ENJ-4`FZcIox?
zVw*kfj#TD$Y}|Uic>86y#MomlFCGTFKhBN2e(K1-%}J><_UutSJU4c2s+7Oj*V5wJ
z^wq65Ts%aVmTH#<UXKjz*mbWriRG8^|E}xIiE%<L55KGk|Mc+Xq6prKptz-9lRi|O
zIHlM4Zu8mG7fNTvT%58iF?PLl@3(2X9Cp2z4tr`&owwGtH}a#@4XyJ%e#V}=&gysu
zJ7ns;udLn@EfH>+!{uxL;hu-I({J9-nK9SeHoaOM&k#4wIItw7Gfw3Gf~%&tt{;+m
zdA$2)#qZn4_-6kvxvtXiNS(uW0jp}h4%-FZ{h`;>q_>@nk>>q=?i)Y<<;{~1FIG0{
z-rX^oW&M(}m-kc5pE-!THJ<(cK5kFNM&o~3>FJxrP4~w|?ccYl?r-g7;d8U6$49&V
zPyGAq*srf|m+g7NzU2J5KL3joaz6ik^weBG&SmzON6*dM-Pu3A<Zkfc_doB?|8(>E
z`akSba%S7!dcS1jcD^%0v0bJLf9~oj#ZH<s(@l8cTc`CFd+z7VlU{tXTAIzi`RS1=
zjo__$j2qUypVJlj_uwiGWk$92noAOQn3cNsJYTt~wLWqG`sYv2?9w{Me|yV2t>^dF
zPns*PkkY)veo02B#%4ZkN1-sgxm|&L@#^KasmXZ<PCmcrYd7=6qZGS3<@`vsRLjkU
zk!RdeJ}&xInsE2L!7de(<%>=|sdX)`TyuKDXTF^(ZM(cbEhyf8ch9`1u8LZhUfqjY
zU;8=dpqWEKo$tiPE0<1n-2HG#O1HU;N!zNuanAjn>E@ZcYih(c-3`-qT$&%R(|Dpe
z<9o+mmf%<0zhpV^^VBSzHfPF%%!OZju5ANX7-gLk7d)!?`)fn?s$z|G4;0>pGM=0t
z#?x@q_NiI3VfPI;^FSRL(`)m(&q%$q&^{qi|J&9w<k;G~ah|)jY8l^s^uI`Ep;OA{
z9rcIBrgz2t`twvzZ??dtr5X{F{`NewXsM|<nRVp`qj#a@>wg!&AB*a3x0-zJSE0_v
zs`#VtTzDRS`B#=+@Ugowvh`qW<8*`gti|&V?wT~~$38ZNWjn8L-kPdYJI}<NZ|OsR
zP9c*c-xzj0SCXthb^oHr*S9N@M7Tqrm59Bssi=EzaJxON=$E=6tM<P78~fUK^{z~B
z(9Pej^i$_nWVrf^!*6%qZZ7<ATvzDg?j7|zdfv$^^~#C9iS&MZ=)RWT-Jeh2D9=3*
z{KDJ(SM=r3pVu6^k`<LNzLMnF`PI3^J}PAQkN#Y}Y=1Vb+wS>0^nJbgQq8l41riqO
z=ds()7yiS}`<7X_-?Njoh9P5?_VQ9Dd(Wq{Ha$qxnBVl-a-!VzK3VnBKayYm{M@Ux
zVbS#;6J3A5J^N#FdhQqLIj_<d^&hc0otezHrSnsR&V`L96y&#kwd^`EF>spEGmX!h
zt*ds{t!a~%&f)vEG3nq9p+(y^n$26=)S&wNhkt+d#pU(3Kd&c!UQ_yS%jde{uGZv)
zNXZM#t(+GpwZy8%KVr~iYhEw&EV3i|=<h%gAErgqH#^_>n!oPjhh^&*1z!4g)mYNX
zI;xtZ+P+Qn>ZTI~N=DaB`0b-#SX-TacVWfcy>_o_tY+VdJU73~!)E?E<B}C3`;uz3
zwd}jNZ09{&#K0Eerp(ti(br&JRf~A?;nyl%8dv!CGz%%*2rp;!km1_i9yH^d_|XFY
zPi3-&0rPkiOJ(|cANksUIa?T+^f@tq_PL8E{@gg6v+b)+fqK8ZR`a>nnrrMASLvH*
z%Dmn5CMe<NqH{Y+7qZ^qt_fxf+xP#hQT7alR40#DE3@avHcvSF=v(B@t^N`Q_WDup
zG`BCBT=T>6R>8xkb*<*7KfGr+to>NC`Y+!v4^`ucw-tNOAB>oGC*juBO&2u`iW(J{
zIc@u)elyDBq_XPv2_Bgnw5|AdXR*HCuzFkDvxTt{a!Ok#vdhPZ>bi%1(E0Vs^}3Mk
z*~`l|Z3>*q&6qT;WM;|x+HY+=3il-P<5F&ZOZZS@v8Si6f3feT+Xg#@HW$tJn5Xnu
zTOi+~B8bnjEulU8d$fGpQZGXd?JlWer-H1GzU?!2{J!!$Q0uu&werM|T{pVr<$0DX
z|Nn4R>(S@T6M|e3JPPi5s@y9M7P20A@ceRWlZTf{?a|dz>TATd?7ACpe9f!A`C@&W
zJPqHA&5ql2)ajHI<9un!<({7>+<&ZW>=|GdV-&6PB$wmtZ!6bqr3XT}7kmRwe+ir>
z8o~X0Bku;L)@2*=7YAFgIX|xyNGeJExOC?88LmzuFN5{vbgt`o>PzlAH0Qk<`$SLG
zB@0#@KFDgjXUabYdx=YH);B!Xahx;X?CZ^?)~<`&_OWF2u2(&J`!46A&Yx~NANQ(p
zI=8hxGtd$9d6NER$Lc&8Y1Xo6=2sKzUzpj5-CVwTPLEY`SMJG=$%Zm)RyP*EJ-GMo
zo#rFgc{a5e+&j!ro|+)uC*$x`Z<}n6{_b^c&p+QuWPLtqadtx91s|@T2cGhYI9VUb
z{&<)>+&wz;sr@FFqUl>>Y_7Ggj+|wDe(Eo;^?sf{uC~=yQ^VJ4*-XC4DxvT0!o;As
z>`jKr?)ks-u6z`YP5yjj3!}CKr=g5z#nTUW|GqZ6d46;IIW5C;`M<rm_nf;nx8F_p
zV!RNmU;UHBy$|P{-kx6V9rM^A=UmtM4PTh6V^s^bzh+rhxB1YA2`MrYLXPmv;gwDI
z);iqYwRFDd=68k0IX-+Jx4d7l-N;?XC3ycixyS{pw+GGrs^EWZYw8h|$l2WztqYH|
zCVlWvagdQoj<u1#q-B<^v)a8o%F1L`{F%s{JBQSDx3AMa-g+kW-=<@?uO-i(ktuxp
zLGiZ>tdGJXl5f1(yH>jO?j>H4W>zta?Y}pzxi0STzK!qo>IBmddAC&GUhTD;>#&;T
zvw`vNklm7>Pu<=1KX#q(m(b@KTnS%KUQmu&s<UmuvaLQT9MAb?Iy9Ic|1LK*?A=O-
zyzLz_op~OgZq&rj(RH}C^4$f2FI#hJzSnNd?AP{N5_2}B&tmJ0Mb{U;*z$d$_}eXf
zUmlB<T%W;P_IK9C_cJcqC0wovj$63&T>p$Vhg(lf()`+TFHgR5=S=rSpN>cV3t9LV
zDO~9PoHS`t_oK$izN$7m!z~qs|1Q<Yw~CG6TdLyl{bB9LdnR|!cV{zRXjHCuNiR0v
z718OaskuIhiPtyV_)k~=eMRQOZ?b)jj@^B6FT-W)|Cy;RmNKhZ?nkcbEitUEsC%D%
zOzzP&z7wx2o33_0vfJ|a?Dkg|F5i1U!!_z_=j_XjkqauXUTvM#)9U<~CI0x5+IxR)
zpWj_yz5Dm}&1dEI@0@k1xb|Ma_CoIuiP@|=TeUxKyd85>u~d57YHN}Ix|Npe9>2)1
zIz8Prj5+x5^FVf0|DL_el~R69`PR~BW^HwIijDu<Dqqc+OZPHPiOqSTRiNN)y78pD
z=;_A_KV<l)sm^X#*k*rl$=Ziyr~hzW<&iVjeG`7cZRWfaAD;T>-3wJ^oz-!7>t&rE
z{&(G{ze_#Md0`jp->I`Fbi14`J7TqKs<-AA$(5U4$$YFboH^l?!@UQIKMqy%b|fpB
zR^Qlv*lp80xo?#cU*&(zn7`*#dof>d<-9kd<r&8-@&gUrN*>2fo_*`mmZ;ggpJ|nK
zeVDzBqpMve_6)0P<PuI_yP__wd)KFg`0v>kx+QLN?bkD!JhPL7Po2KFx*|H5r6MZ$
zNuusDh0gkgI}W5S);_GhR+#^@r?dR>&AXHxO(uu>tM=^A_EWNL<aqP!*|HkX*RSu-
z&e+Sd!EcAm{u7qk1+mXX=I(dlop@rI;8Kwj&r=poo&3XUe)!LZPX{l((=*N$Tv2Ix
z{bFV5q29PFYa&V{TkJ);=lblvx-=wo+KFqLoTi`GHp%q5E?fLPSZ-Pdzwk-E_0<=7
zkBapgolENq^j6n8P&bv=KET(FE1Tcgi-pml{U*z0=>?rSYod89{WX^^Wz-9juV%4z
zTkW>&LiWsL$73neZ;H1pO1^Ti;kZ|QcV2Z#v4cjK#EJYX0v&nt4R;uKPt-cC6L;!w
zBYPE>zsn-w+U|1~#VihQXpxW({odCgn5%Mr4ePQ`4!0j1ah*Qp{0lRk?y?DWQ=Ukx
zH0H`mM&7D5wGjR>iD_}cj5O)wTWfT;oXifCRGpr@KEBNUmD*0rX%i&O|0+}&rDfHf
zSkyV|-r8+1rl}vEEGxFccfy6|TGqRA*<GDh__@2-|N6+S+-6f39xPv9skSTPYT9Yv
z=p(b`<&?Lq-^b26>0u?Ca-Mj&(RH!4JuID>8;pZ~{9E|L$zlV~Cy{wVMsf_{44cH1
zC0_W=v8i9DDN^*}Uei{d->V)xcxXN&SJ-*uV^e{1{5Sru4|rPIo;h#*iDPP>LiPLA
zw;k|#*|dGV_qIBp7ymb|boP6~^XjCu>m)8`0j4sx=!^c(ee};*dj^M9W|`|4u2}BK
z6}&__>%>z2eS3eH$IYIe+xK4C@L^+6#wpuxpHA`y1s$w3o4fY@vUQ(0&pz^s-tVgO
zm$UaFW6IxSCl=q#_u1UkV%%H0;^@<3`=c)=F1%yGa8}yn-!F|RoxNv7CGL0&F&|qW
zV63h2e!@LBgZ`?M+Q(A<SL$|4q{T+F8GjYqo^wv{!N&A1)nnhEbu}(sGW|?*?USH|
zxh1KR`)?!^DLxfdKhjgTK;@|N+ubMMBpp8PegA~u5$?Npo(hTe&TsQ&H`=Dqu#fHO
z{`7TyS(1D7%`~s`u9&I%SlxK$(Jh+~S3WhZ4|&9Ns=L$f^_pGmhKC)@1y}toxUAUn
z<=yAXz^-Y>uf+*TM#pioPQ03^YNx+WZB?$|;^rR;yOmRJY;&DwKBwuN+rin793n4m
z)i?c<<7z+c08@mC(@7E5h<~k>a*+?@R4-aj^=_HQDE^^bO44h7OTx~Lnr@9Jwd+qk
z&)?+e@=@%S$48GT54HDrGVL_9_}N*1k;yum=ZciFOVyrDZF6+`#f5tBIC$;fWqp>3
z+r9FEl;`17a|F3R=S!=$awVuf54@0D9a>yux8=?!hJ=2xY|}Ma>J@LhFL8Pb8LgF3
zD{`FXSvbk9bADr{>8&G-a-M2QVg5=&dOzIF)FdxXp0)X==Z?gd{W%%8ZijDuyD)Rn
zB;R)@*8l2cUM%_T@`XI<#RiuwCTeWW-?~7;u-W?5zK<$LR2Tny?@&EubE(v8^{b9G
z5n_-3WHnyoe<E75K;BLN%!5PyPsGc=#`tUxTzxfk2J3=63*O7s@$J3xeG($iW~OB?
z?BZg6nK%ECkIPk2wOO9|%O{s`6ouTq*!z0J+{A95ctzJGD^`X6Fy%C#+tq*ApXI~n
zwTvR$yhI;xPhhmocTh8FTqDH&F}bU4PxH@q7mJ<mZ>0aambv!aPg~tn7y894lVpWE
zr_PNjlv&1ip;F@Z`Kt!I-=F+{Xkv=o-k;{`udY5)u9NzBK=GH=6Qe%EY)&5k8=G^z
zRu;Y8az$0e^zFr5_Z^{6Dt7JoSQ7Yn|LV)SOs5x@i%3hyE%Ck($|~2H8}XpBX+vW2
z;)-KJEwh#ST`H$u_)^mNa^;~*_3`(obHw^jjj?mR@$3D}#cP>vKY#s6og-_0KU@Fw
zJy9-u|IcpGmp{7S;oqa|t^OwLH}2fIb6q^6=I-(B92KG`w&l**#qZ7}D%3D}*9Q}Q
z$u+l`o%cNKeq@!QvfGJsx9HrH3)U>*UD|W}jjOe0e#(s`hm2s(+ONw>A7&)AeHJ*a
z&FQHt{Oj6>rDCs{k4;`~^l#&{$_)(Xit|N3NIUDy4tI(OdTVKup<s69LH7QcT;&OD
zx1|m&Sj4}f*UBkOEp=f=jKxMbCKWTWV^buT&nzxf?2najv$U=H9@hTF($dz>{+@l^
z<azSTf9Dq%2bsr3ykDaA{Heg@lXKLcmm4RxWEABexU@yUJoA?1B6ZdHvc#K^l~FgP
z6n+U^E`GnMmif=GPltOyIy^n1(ZgVVsx<xJ!j4dFq243T@!Stuw!f@-9OJZYQHOre
zOqVS?e=U}=-1j1fB_;Ty<ee0ITOWgtS^rMD_=J?nJzam;zIMl!@>HWx{-^!LXaApU
zJ#`~7h0kfXi0;3AbN@BQEtw*h;TfeAd&%R>;{(tBc{SVqc&6x46`H~Fca7egD-JiV
z9bFpjEZMZCedac|ja~ifsn>!QZhREI-X>3}aYNLJ9nAfkFKVRE$Pts#Fq+f1W}9lJ
zhGwn+vzb$<@g>J*=kFejP1~nDn;07=d-wM>PrI+|Q}sG^WpeAp+%C^}@ZsK%RPo?t
zFKbQz%4(dQ)Bo!k*M{!Q=wBxk<o(t6Ui1B&<XIBC<?6y?v4KWS4yTs{x2=*<Iw+l9
z!TbMI$vTJpg!s?az4B}JsdY`7dOB47`++$Z4obLpea#Gex6~(t;mh7ja>=2ow*#hb
zd+>6KQkUkO-khU$@6<kT5}2GTHC0&o{f322K@+C^xX6-F`0b(UtThg@ezWdet6crp
zbknvfyS?{5ZHSAo+ghgPchWAp$VTfIi~jm;N-w3|G<S<T`-nU|BK$B}Av0+C+-OcW
zONWU)rK?r#OBZJaPda>4daH9~VYL32Yne*&*(Sel%+o(-8mYJQL30q#^-araFL7#r
zv{5+!e&I&d1v2NeO%s+qEUUPXax`sr@_eS)!#5b_Zds#Map}~_2Xm~J`doNs`HuO5
zbioR?sULH$G@m{&=ioAqwx2TUi)>rw+?-n1A=!RTR`0&uzoX6Rx?9xLcAmUFp+vVQ
zbFSOdGuKp?-gM>TWm?*`(28@x%+%ns-*b%0OMBIO*UXK*dGdtpiTN_eF8klRZdBe^
zA35vtd3Tvs)$ZLFC1w1Yjfy#>j<XposgiiheXqTNi+@D~_lge<QAP{))~@!*uPV>K
z%X>3_(aimRX%^@0<4@Nv6ixLEQhB=2bVZ5nA%QM0jw}1zT3*zw6ra@cwo)(h!$*(o
z>YYa?@+1euFR$10idek;ogc&94Mx46qx=F-?=ew(5@i&8xMsl>fA{x6cWf?QZvI@p
z-2M0Q^?Y|Oo!fKl(m6qQ<Jk<Cyg%|@3t==}5|F9-JxnpZI_&|^@2TgveSO)KRvp|w
zeQuoeL(@j<>K7Lt`fa{t*Q#OR_*Q0Go!aJk{O>m{Qr^p1_Bh~CLFW5=Y)75$X6!m7
zAZfjO`iusK*X{Yussig96}m2b{2Dk#pkP^XLtmd-mcGxW)bPbV3FR}i7AEWHyv$zF
zALX(l+Mn;4-!>;D(?bf@kzV09wAP=Bmg=(e=(LJ9nq0N;{X>@`2B#x-^E992KNa72
zPRq1>t$tWH=am}cj(t0tH@P)DU9)+9R86{M&aU8Um4a29Q+~B(Km69Ca>()_=d^pv
z@;tn~PNr?zU*<Y{r98{U2OngrOK-|pUS-(L>|b_EcKL*dVOz64_#SWA(Yg2Zw)H39
zmOSbf{PJ(v8oL9P=L{$3HyoU2b^6)$BH@zNrg7ZUPF?3bdUr(`@7lbl%K{9HG$bme
zYxb^}OWO8T{jQPz{f**#q;0SCo%)&0!za;kckj`4S{btSzE)MD^^;6mlDqD9wViok
z9{W=9L3KlsmQ2Ld6ImfsCnfX#tXFuNvhLnN(Sv8QOT-iYvCfwA(DhuhyoI-q>2W;s
z@i_)2D-XT*oZhT`&bW{5mVzgb{etdZk7;WPmT{PPaJesHv%IoHCGbTJ8%u_}kkQgJ
zyOk!#MVUlh-22VsPVc*;;$NF3mpl;`yX(K=ieZ?{TAlKpbKlRE&=HINv&FY{k*Q5%
zaCRLB&+k^<%Zu3``Gzf*PmpL4Uy>wyZN+KNyK7W6jxJ32_^H95?d^1x<i6cAd{4gh
z>ZwruENQN^<^9|`o07*%lRM7;KNUM&Gik1Z&Do5_#paWyTCV!8_Vo6-(`jL5)m44f
zyVzLfnp~b!++lV;=8VPHXM2}z@;WD0@Y6u({K}l%zISPy5i^YpW|Wmb-Ey$MsP02^
z+0&CEaVg<Vb1Ip?|IM{XoSpmc{Hd8PanqhT?tXpe!YSR(T;V%^<*z#4`j@ca_(r4N
z{pW?tglapgrTX2!+?|obxaO)(?#q8cCyt!Hed1N@fdwVK|K@qUKdi38)x6+%>0Qm_
zqAdj`@>5MW+&?0@N4R3=-Ol^6e~U`~ybgR5p|pZwomPc*+v2mKZXSETg=FVN1jr_@
zu-!4CG=9+w+py!iUi@=2+g9zr!sfw0mE9j5)~imuqmu2wJeSpO#&^RT1v<}Je?IV<
zY~Hul<6XE!jrFPZU6b}``56c<QHbQ)c6Z|m1EsZIE{xIHFJ4IgIU@06_Pg~3+4F<m
z<npPx@1J=wea6CemPOW|-Ytl@)S#N);FDC|#kSVbx%OHxqt(^UOs$g}ChiW@wmfl+
z(Oi^gKX>)SiCHF*`|qoKIQTy?S-Qcd$bH|9@KfiQ#DD#dx%514f=AgBfs&Wek0hM_
z&ZzeKw;*Ab_~DaDDi*m~)lUm=lr2^>Q(U(B=Ui*?zsU*RjLAQ~h*|Bj59Ib`|8Ba}
ze8E=5-3Rr<i>zZ!o-aACv+M8Frp~r5bB4K1pL)OgICpxn?Fl${|J$;coWezQCwrc(
z6}K>(;&*X!URd8bnL^$i3peFSthGVjH6OR`(!H~WKdv??_|5(2=3DJpqI6!*XnlNg
z*+Z{Msev)AT*U&LU3+=VQ|A_X?BaRZUDOpX5F{DsmA0bn*Sj}!ChcFooZb7g$z$#L
zeRm>V3-yjh_P%zw)e&epMa=lho7InNcRvkNw~RE@S+sJ8=kB0`ec{V4y;&c)!J9+M
zyroL|#O^&R^)<;W7C&TvxsZF~tA)bv-vv1xX>e7ZbSUDqZTCFgm6kFu%>vfMN~M1I
zyx@fAi_IIIUkH4uzk6&;+bRR?ceg$)aos7lNPBDBX=$b0hm&tDoP6xR|7`Vj{>k5u
ztSw4T*1ol0>@fet#1iR+2XooHyOVD&*tz;i^qK|BMK7GNkbbgkcDRgf7lVVO1J4on
zGULgfWz!_SPYbO(I+Oo-=;o6zSI=MjA}PJR`uQZM@(HPI)<MY(@it5T$o<b#@_kbp
zu*qmq(w5dU{hO8^+VLPu--2P+5#FbFOD6fUFXrKw_``ZtJ6!Tn<lCVAR>y>AzTSH~
z^^1zZE$4f(vI|aCy+3Zw{xU!R{*vGJ^XDlBw`{%r@wPMP?u86*m{L5HEtC~qb)5nq
z#WG&mb71Q2Znp9ROnSLS7j;EjEk5-u$YEylX1~o+)jq2;C*;;iBlC^LvipP@W7-oH
zDr58Nf4{wcKli=Ft>|f@1*?sN4N@0}Ts!oBQI=5UJi#-;RkyZ1KE#=xINRjds$c&P
zg^Qn?`Z-m`$Y*JP=KT%XQRX+c9Q(Y$@3&T{vsmP87QZ_SRc0?=B(vM9bL|V3b3BW>
zG<XzPv!w2vv}uVvd+(jXfj%+k3{EzN#Q_(Swk)XdD*dA{VahYk1t%2aRJDGvKaTOW
zVz$qjFO%!K|FBc$ivo^YB8TIunM&h6+sxK!{;M|s+2_aoFA9U!@ZNmgx#R4G+xwMI
zn57zuD*Io`WN2w*j<EbaYtr4c&Gqqnk1Kq(Tl;3_f^GTnHzsB1Y@VCwyl2CVLxn%j
zgv>nsSk5_kk5bcx84V!{jh#;xthQ|3bLHaR%@vJO2WzjGFJ!Yi!+&c*&%~>~J(kkP
zZXBJWT6WK0%(ZJb|AkE&*2&f;Va1bzr)8<^F;z3@+_Chv^2)&XPfQuK-JbG#O<du!
z>hi<8qBctU!a=tl>v=XlHry7qT;@;Wik{f!AKsbIE`16s&Nlj=eWi>;#J_Kv*p^d8
z0t+;v)`zg}KbtMImOn$|fus7rxU2<r9T(3q`6V?ZYh9I}^yq?iL%+1u!@Qt-?u(yG
z|J*(4>~qJ{2Oe0hzG&YvyFXR)deF<yX4Yr_X=s04=I8!X!opB#!Izhfzxt1-TiO)Q
zdURrf2iqda4g-tdh0YC6`D={+uecJk=i8aTlc#yiYW{NhXR&$I*6*701^tZ=);^xg
zZP{(;{VZu!<@@;==1DSB{`nY0R9H1#%{(r<Jj${84Wq$3{$D3!_0*KLa?8B#^Au*S
zbyIpU<!PT(YH{)BaF@J0caAPv7wT0V?qHk19J2AaRPd5F6K;z87Q8)^n!D^y^12@q
zY$u*c*QE#9q#If!DY(=NwB4<FvvybOgws7jyq?)d&PkqnnUJfM_`+j)P^t7vk)rnG
z)_%#*_3G1I!!nHK7HjT28EnOM_eR@AW3T5LvU!UOax*%7_O0j@<lL(oGDSi=VTs&w
z728Q4luy3pmfYzRCZ09ZDc*3a&C2rJ`!X3H>|I0E!YbVE@uw_)&6DBqdb{Xcp}A5r
z9pbl^JvZ8Ea9ed{yG2d%lc%c^!yhOvzt$3-;_xJKMwk%etlPq|r7ND5uGnYwZr9J{
z$JXs<^lv_(k$2+ojgxo(NIjE3)^PgbZo%UjAze}LI7AZPC9~ZQFkJ4b<#=&X3Tw5Z
zVk)!1Qn43@W(J#RN-XVp<5#(9-SoYoS0{EKpTX1ByHR(-+!vSU=%2B9x}jj6ggDbH
z-Y1LY7m2e~x^F29i9MQo)~@`^u8@~q(Z$00KR@J6z8BNIXnp$2hc9ndR(-hr@8HRw
z4?hMPZ}{dSA88fr<vxeCX_a|h-mFEp)h<^2XwE)ScF1ON#wzD48(uGcZlQW^R`0@V
zOD7BelU~rh>*VJczNL{%z8_*Y)P8Nr=WeC8e@E?uxm%v->qV|!Gjn~miuOil-i3eL
zCQd4wxGq{j`I!F0?)b^URWmwXo3iVBBwu)>(=ISS?)C!avXwtm#Sf=!XKPnkdE;Rp
z<8`<HKKo<V?A)?t)|-oMTTFby!a3~9F0*Z4z*f7R*ZEb}s+(<>FS|NADpamx6W5Gq
zG}(EksdZYm>bc3qTcY-FaA~rY;hr_kWuAK>$MelR>m03vZ!Ns=?Fq}Z$kolqo@;U~
zFy(y8y+~_~LuRH}PHf2e8KSnUTi0d(eOwavXaB{@jaxqJT-sVvtv!d`{84;V<J97i
zuZdw2rWcEX;@0wSdf2Xg>XOb;1Ie!D!=}P{Z9XZ#&KFq4ZQY&~x+`VH+Kuye_G`)<
zFL<)|=dI0>+gP3l9b|c-aAlhOjSTaE`wynvk~-8RT~PPv?7<f+Tv=+qyV`GYZWHla
z8zPt+!uaELfa@RE5Wz`W^OSBaiaLMr@ZJmR+NVtaOy06*m21d?BgbW~_48ECIcsRL
z-N@O|@a~H4-U-^VOO7zeXxNlL{Vdh8u*PUr!n5nDZsEs*8v@1O_9U7tDhhOc>RZgv
zop!1yn76C$@ynKzZfh<Uv#u$eb&}D0bFrZET7m2<wRZKs|L0xauim~ssq6iPnW~#>
zuI!CDej{DmO87=%g7sCC=K?JX-{M6j3YUg#{Mu<yvi{JX#bTeW<XP9HZeOHWpkZ?(
z_pxQrGK&)*lvYS=Qr);B!(!7TJt;qzFrBnIj~ko(Hgs>+e&^+%G-ZzLzmmFwUuF_!
ze{;VvCSMP8n#Edq_hj2=R@ZFD3tMk)WiWY_qp!6vq_mk`ZN_1(8D(OOa{FcWRX$ce
zcWs-&Wvw&Da#kr@XW0Kb-X(H^<?eD}x9yhEdp!2>y_%N3EVD?vJyia3{(HkK$K$N8
z)CWz!{%)Q8w9LPK+scZxZylZ@e^o_X^ekJ?k!JDxOI|uOywFk9H_1;pbogDkXL{q2
z#uC2GOv_9i59Y|Vp4sQ49%mVQ<F{OJlh2)3?aA4_iNC+<?ABaRc(kS}=a$>Hzf)(V
zZLm(?qHVp7*(BrKtUvY11x)8HMP?|S7O3syyy4)I6Pxeyf6^`c%3U?V)8xfAFL-?-
z(sJpO%F-(f6Rx_<jsLi;)%o6Lch9*lGm@4F89uCEo3}*T!n{c)z%6yXp_hrf;p_!7
z%Ge+C9p;EWF3;WdWZHRIi<GqtUjuf`+HA&RnPT_nK+d()UK@if8K;!ZCtk+BIN?~-
zx8mQl<h|3Q)a|p^6o=)qD$5w0v-6*uxVBMwIy*~BeR{6#RjrjOI(Iabq^5b^yLaZv
zwkb#Ql-tg+A1(WNxHyYTcTd9=d80pOml`&?T;bi(6p(v<o$Ikz+0M&+z5C|tdTnyv
z)3)rXNV>twe_31d?#&OM{Pyn?{r8Q08+Y8BV;1W0@MXr77c>6l-`VwWN3Nlf!}r#p
zhPi=$(w45=JyMsKG0)!4`i$%N6C)k(zq-+Bn;VofN?prxP6|$Go166F<>qI(3pc6o
zd=Yq(|1G=k>*2#Lns1gXPj=}#7U45LwIlCQSzM~7)j3P8{1?w%Yc`etGj2_olGnL)
z#?E=2Yz;3WO9YD@+!k-!yi~NQaPNlr3tu~5K9(=I`CwO<DNpmHDWB%cq?lUnb~OC<
zXZrUm97}X>b1VLR{qSPrJF`hb*-O5f&ao3Hu<+Q@7`NN&q0+zqWfxy3yUm^Z^4zYJ
zJt@B~PEBa$lM#BPw|v{1Bma%_d=qkgRGykj=}7kNIk&yzm?5XjobA>5_hjBLS7%@T
z{Jmej&(su#;~YiF3!*)D<qJ${WBV3n<lHl-q%Jy8-QVR>wv63Xwp%Jor>^Uh2(*=d
zR{ZS-%ZFH-{ByhkQ>u8wE<I6xBRYd6J!F%}1`Pw|-6_d46nfU&S|>Ky=b5!}1J4nI
z!(R$|?D`sJBn25(n8jV-<eIr`X6|#J4UQ9?C;fZY?JM^2N}aLe&xL91J}%z7`c$5E
zy*a`+Bf?ex&;@BDW1F*{+wY_%XDl>&%Hv|VXI|RX_5)hqR(Zc)z|}D2GRyx3rf2;0
ztA2jH9_uYyI*l>-%zxorhQ>oT6h55dd23#{gnfgC#-ZSY+cJzqWA!%wdpI>Eli@MP
z0ZC({J=%<3$zR`wH*cB78+bfm!n}eu{T`X!3i9$RuQM6VK3-9=tA56V11l!moZl^_
zzy00!bKm-^-q*F%%U?>~)n++)=A>sofAqC26Xz9sc4pD+fS1#H4px0#$z(NeaY}#M
ztaBDg#$0u;6{1@8b~hGo@?Nm<TdCQ>49z{V-^<H7A3bCCW6(41|5lzPt^ew$*O50t
zj%Vg5`8)dly|(VO+_wDdj^EyT#oYgAx<V@WN&L+xTwV*7ah_vevD0Z;Xs6+;Z#{FS
zu4r*`k1M+?duQd=<g@dB#8>CnS=riDwOVZdep~OU%T!(|?Rz0R0>f6CY%`ye`C?tz
zzIQV&xqg4tI$xKe@Q+5d%;e?s87oe@y-Mg|-niHI$W6CJ3chDF9lk~!v(<5XWTtTa
zQTtj4o;yB&);{Rfvgp;kJ=^@)ztiu3U+mr%9sWA!n#+v<-qTGhuS6}%Qp#9*nc>T<
zdYLco4_;;QO@AOzyK_}y^S7`azD<wXB(@}ocCWPh&RG6W@z%z>@0p!f%+7KuE4q;N
zHM)1vD((5@hbR1xd2)!Cf49bk7XRoE-g9l1{S1v$xFmJp%{sn0x3gXM{+48loYhtC
zc7;ncT_)DzMZnpldXJZRZ56pv2ecGQLd&m(D4h12EVyIyMvco}0Zy^cbr{z!f1%E|
z{#kE>66>cu$9@RQ-c7skhQEEG;b-aN&%HuI3I*Sl{?%XA{_GNi1lJb%g9~SzIV|3K
zMnwDl9*)SF%@wn5yjv`_AoI*G_pr*cNj6gAALVZz?-AOXtT^SW?4_HpBhEW*b!ZEX
zoNcn{Y+m%q#ZkwDR!4t5=5mKCeFM`9iNKr_^M$om<|@^sOjj3=)jIR}!{*jx;hD|N
zPRfc7M#XlDrwt8bF1S`K*e7)D`I8?m=>n0CD`Zbzf3f|gW^|{>p_r`7)Mfdle-by9
z7Mau?S@7**kN&1tiBr!%YkVwe`BlW1FM89}%q<<;lcLL%w=mznd_tkp$St)fI;JhN
zw$*3ywTYH~Uel%;nf5cUJO4uN`cyB*%~wuZFPpZt-=_SyipZbuGP%O;8690o=JS%B
z|J9lVHGbv4vHHlKhx;b0FX2C*GAB;<QlCLvO4hd>r754cT}!=Ir@i8a3D4<+x;f$p
z=K9aru9{h^%NAMKx==_|d3$7$K`V=6^s2Sjm(KfHQ<whT=txG$)CXxP0jKXZ%kBTW
zWZfgL{N#D2yQ_p#daiMW`yGGnu_q&E#jjhNQl+i`TOFMKG%WX+d_LnJ!}Y~qZYkSN
zZIkJ`md%v+;+^x9OI`&67e3`_CaAVsY1Qr75%+B7`L`U(dz)oU))w--<N7s^iJ#5A
zC^^8V?u7KtNAJ(sIqsZT9B6HsqSGE1@^k5}<>6(937iXAwT*jTY)a@p*0NOfsR5&p
z%0js;O(}JWeHpp)l#d3dT=suCapfBKolMs!wm1sDIGi|1a#H%iMh2<htd^`H^LX~o
ztG+lr<@rqU*E1@k=ATb6%c_ks`FvQ~`fekigy5#OqvylExSd(N`l17C^6&n?9I=%y
zW==~lE&8Tb`G6t8e^#Wb-Lt2Q{Ib7z&RxzkgD2o;**~saqYu%`cdoOyu_~W@eZowZ
zcN>Gh^c%9MNp4bmlyxahYIj3s-VLqW)A~}37rOaQZv66Lxw5mON1&-z<J(KBJ~ue>
zayJz$_e+%V%KWMLG5ky5CBeJPUQ6HFDSx@td)D!VOAbC{&3y7{r@rvI+n>YN-(Qp7
z{CV}H7aD@QH?4EL$;Ixl(d3U`l4+TSip-|7+^qUXW!{Ruo`03)iqi4YO5wBZ7f!ud
z#dS37MiAGEH_0<sXO|mInskw2slZxk9;pu*(u&nD&T{WKZ}e@)C9#Ir6GZH9oL{Xo
zVSV+>8C!Mqn7_|V|8>62kFDPMV(yKFM;!b&yjEqqvAlkMn6&=FrLIpVzdAhQ`_i`$
z9=~RO{ATf~#~)1_w|{%MU;RqX4v+mmZ|(4tI=A?VT$1}VLzX>ljpb>!?UVYIdklB}
zUMBgEYmU?HWs{n3H%qRa$mixA;P1uX5PUI|^^`cH>cX1Cc7obh+PO*&FnqguaDU&u
zy_Ldw22X;DDvAV-ExfwxTBo=^=hK(JUd+4F`CjvAx;AGse{b71-s^2TC9$vj7S*oJ
zohu)zXCV6h2;cmy;2BQWy|(UMIQirpjvcEXbL~D5#wxx|y0}^5gq*qHpKaSYD^5KW
z{<Zz`$#;A6`kEEkXBH?gkou&`eR<c^t&yjKBi>(@cz5}Rj!}5=Kijs8O4VQ6G!w1~
z&bhVrr)z=hnxifj&nB6~noB<_$o-XK=&iF~!Cm=qz%;4V=DfPrm5~iOy8|xk-8JZ)
zue$E=gg1`om-}4al)55)?pB{e<~Lg2oSU`%T0-mDZ%<YQ=+BjU+iP*{yGzG`ncI@B
z8BY1Gxcd9O;5Dz+J(F(Sb}UemJRRx#irXnJE5c0mccaJB_ABp0_#URF&hj~25q=}A
z%P2^<@~`6jt$Qag{CO*Gwe{w0*O%mS?RVZc({J<b5~VJO-KL*>&KJ+T=X+|kcHqq~
zwa(|ARKh;b%XVZu$+yGJJ$F%yr*P7d+%unKHac2~PB2`$$wi{xV!^+OJF8c2K9+iU
z#WKH(drn(l-My*1TCDL@ME=vgi}zkD2w<D@<lgj|F>{(`ugPL!d8)B&@^7;%j)n#;
z^O6_7FH@>eeEi_0<Uzrf)b0No876MCVHNtGlR3MtQ1)$lartKP+-0-t&WHRJYxeKn
zB;j5u{q}jtQngtDE#C`Qik_eM#&w|s+isrN|2t>asim5EEl-*k_(gKFmTK_ELxndQ
zU%tq?cx;A|$c0?4<r;inmb-nv)wg?!#X>_i_tSwJ!>w1=y$QX#qBJ@CpwvX`)I;kJ
zOyXJfZ;sNg+}TCDZhl}qx?h}c<qLBrZn?!#rpM|}a+qnKVeeXB^LPJ2b(y<TQtNZy
zrLSm`TpY<K`f8zE$C;uZt7f^Z@C{#BX7TLOrVk90eRVX{<d?6%bj{jYfB(ya4E+I9
z6!v@Xb1FIzxP+a_!T3>>kD6`BG2ZnTzf?uJZ}_!J$l#a_U&TaC-Dd$?R>wyC4Det+
zc7HuXuVdWeO2Hh){fjG&s`owZRgBxx8@|Z+ft5w5Y=XgshHp))dVcavl~LL8y)Wy-
zI=>B%WnXMIlz+>5*+|{Po7YLpSaHT7g+pc2B3?Q#d}unQTyp7Qt!<0sf2zq(T+oqc
zvh4g%HA%r&uEB>}bsq0|6mn`g%hE;Z?~QUD8=^%f6*Zho(z<%ggRlR}?WuekGY`8+
zNuKDO*2m)J_crtB{1V$K;fqBrg&$`1pW4XWpDR{S{^&zL1LwDJMyAaxZi*FgJ=b|J
z@FF)gmwTcc!|eyr;>Rs7Moh~%zSsBTO%5*m-oWYe&ITletJ`%=oo2x(#&d>k<DKh?
ziyn#`_v<<3BE2&+WyAUA9p{#H$3ES9ICbx$ht+vk7w?X$e!r{QK4?zyth-lpH6F8v
z{qwqI5n|Xkd5-(ulJgF1z6|?jx2xPycT&p`-Mn6Q)s>X6PRCiSUtCj<+Nmiea$344
z9(B;)DZgWx)v>Ivc{6L@dPPWmIIXdBLFUw_@l`Xuicf3_-MsP8j>zpNxtHhXy!o=^
z@S(6(tBZGYKG;~N^H+4k>~|Ik&HMCtcTcXl^mIMXZ2lybUpEqegs~h@4sb}>^yG!R
z`iu1ntbR9&?U>xVcONh@O(^dUE&aH{@mf^2WaeHa_LG}-ar+)>JN$@E!!qaC$Ga-x
z@+*HW%jKy2o>`+YGc<;`iF1{~G3j5|ZhvICD9E36>51I$PEAXLIg4s%af$qYDmlYd
zCpb}hkNNgh_odV`3ax#fmm6Cxcq3Z=r(w;dufj&!#{_skc}5GJc(`PZr;W2wL}bof
zbKTz?&$Xw|71I6WyF*aFdPlX}7UhE((Y&*MZ@WAt@yA2o5VLs-`wr{t`ZaAkwtM5T
za?bsnasgM;E}koPdg(c3hw;6TodzDO5;{Kay?@5}4cDY)KC*e=53ygCIaT}3IL=4y
zR8jQH{{IROCFa|9Kk#@OB`M%D-HmsSzslL4T9amM(s%2g#^IdF|6l#0|Mw@GX0`+e
z#&YhQ=}{7<y)mlxw@Ulgx9n1jc*GTUi{8q)70K}9s`Vxfq1awFzSCK83eS^H{5ajR
zVbiwEw{jh}&m&xSyY`4(+Zq=iwC|<sfi#)dd6v10nwzhln0A{>T_G&t<MpsFzdmf=
z&c3(fbFlfp+a`h`u67Zvzjj{nxvHCDa(4#5l(*Po{@<)~b{lPN_;A2(-hnf>o*KMj
zYj?aEKGP>CW_y)d+l#qVCN{R4<@N5hJ)^*z?xJru%W`J>(>Lobzh$c^b3M0ywM}es
z*K^i*%}TDdeD~|a7N*37Ct4dHD6E@4sqS#3Oz*V{l_NbHwp<BZ%hh(kY{8@u=amA+
z8leha(#-Sk8_D!noINOd@>uJQMOPFo)i&KTU{LM8sWEx4-`eRfo?S_+k=?etFGjZ6
zNv)8pl7DJq!3Eb>58nLHu>J8?;qTXy_fMWYm~y9BL)uWvp=6r$*{Hdp2Q*wyD#ocS
zd_1+x@Jca9*=pH*rrnoMmhZn%d?>(o<6buZ6uwy}g(FkHO#E<2N_*zHbLUO;|Gs5*
z>)Ph@f96b=V<(mfGjy&rb8_oHd-srXgY3VOlA5XyS`6p+^;fW*cpUF^BT`)X^g_{#
zdl~zR86^2Fmiim09B^Kc`Z(yh;9QFzZ=WRm|MNg}n;e7G4#O&z59RJ$e@@=J8Oc!d
zVbjUX1I7z31cl~s&M`9NO8czvJksz|WsiXAYnyz<yOZW@e9Gq+dwa*t+-p`^COe;p
zmTC!{;Mg`J$jPx(r&0EZwadz$=5u=^wu@@S_x4^?uV-<;z4So5R=n9UmLKO&AMiWj
zmpLQJ@9DotpV@EqQo3aCCr_+y`}N_&oFmbPek*oO-OaTBt@K-a-3XN{Zx7e|uU;eg
zdN)fRN8*m~3LcTg7Yg})#~PJ?->{**`9$0HX>pcn2APHzZrtX-=~37ho%i`q*yoEG
zm#Tg~7hV5p_3N+)|1?goIGrdM=vKMyX?-%+NmWjN9ra(fJd^gWm3f}Kit&tPyYXc9
z++F87maPa}_q_XK#LDTut1s&AwB9sR|7OsJ^4V9agXb?#?d3XjGKp)`G%j1y#<NZm
z8<)$Z7?|J8Jzl4gulcs!O#6`{=VhOLueIw^t#3})$uDAf+gz|pY=;E9r_!xHG1qf3
z4bm@W^$Rq7Z8*OCVX2Vjo}iZhwVr$Lz1;c2;*VIT)H~(<ObI8}$uIhSanY@#^%I;`
z^pEpzP2;)e)W%iYJo)pQU31H?T;jHv#F!A8s`B2jsnvu%Xekd@UF!V(?n!<puYc80
zl>4+$-r8#)M+>X6l|ZPnSAn+oE}IawuQkWGU(J-`V@qg}PV4^@c3<LL^|k(YygrW}
z^Y7M+`<Umj%`j6;{zR-z74MICQB!L;53RZx@?lo?%8!1hc`kakZCmKuJHaCHsx9-)
z!nP*I1;tTowq(g{Dv?-~$k`XRw0Nq}!SyMghkci_8&9|Cot0aDs4$}7K$VOPiz@Hb
zCH$X5D&`eUxy#P|Phf9HNv`$`exA}hxs~pZg}S~dU)+3D;Y@4w{@;J^%YX6O>LU1O
z#ozz6h5tY7yYSSYb>fz<2?w5aR>z&&+&O8_jFi($#ry^0)Y914mSk3iJj=~pS!^mT
z(i-w-`Ha(9r!-Gm$(;3%`n~YcoWqJ@GFqt)i9v23k~Mr}TXQ$1WX@ZoExNV;T9`>e
z7*i7SO0Bc?v2z)IMqk`JFSl~F4V$c<>d8NcbZ-^aukvkObNcQxvkMy^I5Nx2moJ~N
zulLiZX@9ju>a6wm_uV+Z^Fc}fFEi^yCl%e|6uj?z)jXp5E<lB2#y0Nw$p;<YN(z}M
zHD6J+O!#<a{`sl9c-wZR{d0B{6E|f&vC?vmQtYFG4@+K@m-!#M_y1k|?9<;0XD&*$
zcxCgXc6~{?W6g(K8PXd2&+b)Ix{@(vQec7VlvJ4wUXq9SZmd<~jo%&S)OS&~izzBE
zV$r!rYgU#N1Yf^=?g>Bpz6P<F-3F@<D5uog*cTqoyVK`&#wBgeTf6y@ZINA9J9;lJ
zTz#(4hyUZ^&nLqp3stQYmoO)>Zf`ccv}NzY)u&U=2JR~fxx%hIEivrEwC?X4&Kxmz
zmW{mlq$B#;!r%pW-|u_9E#{B@?+e#FHgp)=xoI$C?Te{>T51*=Y@bpV$Vf31s+g6i
zUOBjF)9!D2R$((|%ndEeoO<-f?8o!#tSo9n+@q}|FKnCnZKKCK1;-T{RRSNbJ)9c(
z{aftbO?PfH&)yc~c|~Ghj)mxfU2eTIy3VPckq+`}x|OKy@c7=m%bqOjruJz2-!GbQ
zH{#bHFV_EuZBF`qh|B!uzFC;Nw6JPF&)b?WzaFtht-Y{)ZtC_4tN6Cv>kiqp%s?>X
z&Znl60p(HoqCfV&|C3^UW%5s%X;)eb&5A58{hb&TWuc-`|Jo{X-K}FwUvE@lxK_|(
zChV6ZBptn2vPqn$#LsWtd%pAh8P{86rv?`v<Y42vETXVuUMG*Z#@__RnA3am?#6O0
z;_U0UHqc?XGuw01<w7a;q#&{IqJA^QcIz3Fr=-1k`go61C`;Z$BNmn51^3OX#FvO|
zG~CjE=3U60G~*rpjbiCiC8`o_OpEPac<sqf?c@BUlN|o|>{THlP0m0+qi?HcDu1ft
zYWptubZN(;{0g-N3FXd)e3nV6vWh`Q@|$(}8&9w-eNyYu5o8v7`&hkc?^B)wW@{q@
zc7N-NxxLAI0^{lF6N4`Iyx`b>fhmtwap}h_fqB+C@n60!c4snfKV5l@kK1hZ;k-wF
zd;W--9=OGjIk}qU$FkxCf$dZN#7^U2Z!<CoY1uee+DG8s&d2V1CbF4Xh|I~DcPO{a
z>x|Nz$r<x{-P+bNw}(%Tuv}np?Vs%Je6GtU5377wY?YrZ_n|hr$TDZ9g5K8a5%n<_
zF66&#*uvj+oc~J9s^Bd%9<IKgX0~=B?|1cW!Ft;JJG_isb{>=BNmefUelI2Ho<=rv
z(&7_u3Ljp(sPbQ7(b;Db?3WkcIanW;x9FB+|FR!DgdZ1AaG#`Ncr1<oanh<Ox@pWO
zPMp{@t%O6OGqkwaNa|3UsmSKa$n0|CR{>GJ*H}eN)4C?U_Yf3W)vS?cmM)t&<ySJZ
zhr_Yfmu&uBmPh%PeVC`_!j?KOLolRS;G?}&kg)X`i#*<a`Bkyn?G1N2l$(5?IiI`r
zD5%!hqQcmxDo}K5U&W)&8McqCE7*3|Z+N0LBYj@0?9tM~Yo9cCUq6v?E~AF8c;$iK
z>7OEd+9FLqX&p6`^sn3bJN3;z$5|`3f4Qr>VfQAMUiIk<*83^<>hS*M%>0)jP<1MT
zm20Mv>74g3rq7mic6#PjQ7?KgLgm5_Z~H8%Pg;4=OcQ?Vb-Gx{NEGlEaLm6N;>%ys
zeRb1i?-j0v)oYrve#Mlmd34wN?Ywl~na@n#_I=N;(B7mNZSwWT|78<@X2>sVIelkd
zu;h2aD=mSu6fddu3eDU#qv_6yTUR!%z4(y1>1ObmvIf79RoRUDde|niI=;Oj*15N>
zQ^C(yvCeY|Xa6rFrz)|^SIWC3YM#3!9IvxlP;C(#6tv4}z9`dLuaZ+8%GxbX8(s*;
zh_D1RvGlzYJ+|^z|FMsIU0x)9pZC^s@1)aezL!n5C{7h~$@h7$^<1#k>kMb%m(xl|
zra1eC1tcvOn;}%oS$L)6$0v>E=_~8b?|8TJ%Hj(-XBK=s#Xlz{;9K!|)jvM!PeYZY
z-!Uw0e8PYBn9svGM=}C?46X<?g)fwv=%l+)^kZ^5d-!|<=ESHKcibk;(K@wNXxsaW
z1yNezVv40D71lvQP5<YX9y#^TP~c`K<E68*ca0Qw?D@gb<Yydu`1pFYiF;nIeGnA#
zTm6P@H*?u!FRR7(7TnxB+33%Q8=JHv4o4pDee-gSNLg-Azn5nGi4Ai-&zw`N?e(}Y
z>(`@8=O#Aodfr`mV&+vY)k|}7p56VXaA4no1+x<T!+38`$c>cUePmzpB>vdNcU-4l
zN{+Dj5`JGga;nWd_0#_nUYuY~s;X!c0iAax@ygff<sI(|{#dTSzH<$}itoyw@5_9-
z@bwy(*IciizH8p<D=RBkeRG<(JWOY<K-L7i$}|Z^d*1dLhI5$K+xM4qHX7N6UznM$
zno*n@;rGAs-w#8kGap#~@6-77v%jKy$)9_<+dpae{X3u}vp%hIMRR@o%1>?C>l-*&
z!x^o`w}0N+a5n$>#wS*#_UptyJk^@b9mv0VX2)*t(#y*(|KD^%j_vTLFPGQ$ad1e?
z><VlMx{*-wCYNjbyCwe(8$RapA8Y(Bu6D5Yn!A2TVRzn&t4(_XpXxWfVY=6KF6EZD
zmxgnr)WYfAnz9iOLQ;Q)S@`BC7kByE?s#t`@Me2(TBlO1;HyiqWj_wx%UCn}*wtOC
z_bYtk^t_(7@NK!j?B+VVbz$k|rG_CbvsIWZZ$I1YYt|I8wElhEn;5BwLM93Jj<F5#
z^+yD6-?_{4(WFK)@x|4%FDkca9{y!@EiG4E#y8Mb<m}x^TY6(kuS-5iytj4LogF^k
zo?GskFTdaF-qffPGoFyP=90jJj>q<U?fd$oG+f;(R&SnB{-;N)r#Eh1)tB4$j(f&#
zgQF^iFW0o>zVK7O^LuLY-MJyDZTn`jM||L&V*M~FmOVez*V=pezo&P)ZtoQR*C)bU
zZm6(!@@}0I5nG>q$rfyvykvIA|L(R!Zyk-VG<DCAopb%*+m#wD3)__W>RyGcJ!&#L
zcJbUy;l;0gY@?IbCiG}N4^gR|@}pQ$Ph`gRFOMeOseQ0B^V#9X%;2?eRa~dV_LoL(
z6YBnRZ`DyA-4}N<oDNr-N-mqCzQr-sMsssz^Ffo{uD4HYhn<}$-J=nk<jnZwIG1Nl
z>bfv(2Qz*l{$1Yhra7#PnV;_?vanf-d-L`sJRfq^OeU9~IUaRxW>D5A`Ri6L@`Wy2
zXZ%f8-75U)$V!(3MT{?cEp|@YT_f{q^D4m?!C##3SM`Q%erqRC6&0|{=M2-T-m@i^
zwM&`PgD*<Hcl*YZ!(ZYpx8BI~l?%&lIrT{f=jLucQxw&i`BU&#NgwyZ5<g|bjpApH
z-niG6`e{l0k-JeVC!c7avy!RyF=tN|`?jz7FHIizS}ELYjI?x?zBldNN{@*??$c|o
zL{(&29`8Re#ptSv;krj}|8_iP?+jcYX}rRAPkxV;ER#`skxv;@%d?_JJ*&z>*<Dhb
zb$!k)(ouUlA<6EwX<qQjM<w&@CcgcjYxZj5DcO`q)A<gS*0nxd5c=YY>cP3ZJ-6QN
z{S#aJvf!3;rB<8Le~!CTZ$7F{InJ?uj`G)4thvXV@?Hzvj7gh3`^~zrnX@knF5ba3
z;r66;S(h&F?ek)@IN-9Y>Z!E>|M432CHdzxzw3oQoGJBKX6c?wU-!(hE%LId<LR*t
z)b+e`_C%4cz&qA{0XNZ2s+X!&cWayH>u+<McYoWwJv(~#@y~r_cls3H`L=12iTl#r
z_aE04?aF`RkjX3Z`TAF#1FZ8DJWj2>b7|kq^fvvdb3AiGzH>33d%pM__bk3oj&gTC
zXXGtB$#6XLdiDkWt@*Cm@xIT#GR{78rfrWDTk+g5g?rCrw&d`56&d{%jf#-EnRtlF
zTcLL6ozTBO7nVOQD2dgbUv!(1`>N@;>_05!u3sb{+0A^J6E#cW)Z!UanYw2u{F&W1
zZO@_U>-^Osv-M-vel8NUx-+HN^Z9l;xeeF;Jb%5$`Ok$nsS68VDt)Nl8|FLb*S^9h
zT;DF0)J<|=|NJYeP|8a7FlWf8<Pt&CE6#nHQ?5;nm)28^>b;xqwA-*LSG;G9;&g|c
z)wPx%m!5Oaz9H#<`rzSyx7*zY-8?VF!)`uHcw#TQZq3A{v-?izOps@t^ENQD>*c-%
z`{Zr;e{M?fMz6B1Np&e(d!%L4#Le5Tnw&{5i|v;5UGn^#%A^Dp9=`dfj#fw9Fzz_k
z<n?fYZ%?PqipZLS>m{leot$~$V)bl+RYrj`4ZSwGX)#ZYR4ne**jZ_)H~(-&*wbxm
z6h&W43Cx|ZX*Gj$le^!Sj9u6I#Xo=iw%sUiMzZ{}RSCut|Ct<4S0oyH&vIFI<DT^^
z#YZ!wN-~-_X6`&+6D_mO>GKVTV~GN4AGrTj3qD^wgCXumkWWPsYv0F?gF7<+C@p)@
zno&`lS^aKn?9<2A=agn>7`6V;70uLDDCCPyJr$+3?9_?(EwdyywfL@`*prjPEg~_?
zNG2$N@o>c6BB584ZXfW|`ncTiH`C72zrQ@TEn5{OaHQ@@%|(G17Kh3oFD>~#i^+ZN
zp+bhALQA#6cb<HGbiuJD&y!i({3Tmw7RYLE)MP!rPA2^YOWSQdGl9eFEegYHl;hZx
z6QvlPz9&DinbN&wje}XJ_lDc1OfjqeDH&K_Q!UOip0%`S*Y5q2wm;UKF!0_K5Ni1<
z>~3DBxX0r%_kP{1Yt!7A@{6C{x>=C8svvr%+4X5F+wZPBuBH0Qp&&p*%k`^C&(6gC
zOzo>31T;Ds-0fv<c*fs)_wE{p!nRjjK4lMe<&s`53S(Qls4r!r<V=p{Il8Yqu1bDA
z@W!7<AgTYHcl*iC%4gTU?n*IxE^_F#Ug&;JF`pfs4|na^Gfy^_(_i#JeCnN;$ybbS
zCR)r~y+7c@sdY}VWxeT6Gi55xcU|`_{Bd2O_2tV0o&R1{{Fs=1<M=G*xVh?wd3<XF
zTN+jEJ<iOy>-<IGctkBj)1@5~AGjXW3%((1l_U4Ld&lb|Ec#(`MKUY8=atTSmczDF
zXMtgn;hq<7?PV1?mA3f?nIz1pVC7k_?3g=~v1?{a-_n=^y*DCbmUIWaT`=R=!j@+3
zHxhFVX1rb{W$=ATq3Q0<8H(ph&t)&&TNE5uEWboL@jQ=YpL_J?_zdo&wyldhlk>0N
zbJuc9nyL7DHK$wBjXNLCeDJ$`OzG%i=heA;OV@FnE195vlKtL|b&<|}6`9rYE+@RN
zomjKh@UWSaQD*kGyWd-#L#OQtWv~?4nUb^R`tjwz*<bco|K2}m{=2vGEloljG$+ko
zVzq=N@y($!Tk9(GCsQ7!ls;YhW=pyAEiLVBZO?Lx{crisxiFirXnNfpiKVCG9(%?`
zM-;HhSDIu$`u#E3PyC8Pvh3lWxx06NtY<*I@S8_R=}09j1H)<o1_lMRbGJ+Lic1oc
za#G`y^NUhb5=#>G3M#jT=l0)n6Zm&-y@cx2oREUJeWIM9qAy(otI7lQ<+WTVZcgXl
zaP(W$?re^(Pxq}i-!nB!FY2A8B(SFZ+05_a^A6qJ9bSL-{{+b}w&(dpYu3bgU*Z0-
zR_vzObN$KBCokU+^fmDG*=vVRKi98o{2twsZL+FK=6l47T`G1PG)|pNSsTikxhpSc
zv7xWyw5^xKTtYRq*Mv-+S+PjvPO4Y3-WrBPg~#&$_N556?%^-FzGUK>f~}!T)-Mm-
zdYDIL`@0`v{gXTE7x@Hn@8&(e>)NJG4^uvFw#^9iKXFVtwUDu0H%#GEOqjGl)#VMT
zX>6s9hZH&vY3yU&eN<@8qx_)#OR}eVYp7k`v~7t$t9|VMy7KDc@6TUJ-u`kXXQRe5
z^`y@^lOE5yc*!pyhC4UFUtD-Wc(unbkwTOC-HSTX6pYv+-HuKA9<*9|NxP-g?w%+n
zCUM`y>ETOE&dEHu(Y<BW^ow`HWDgu|IK<L>Q086#1k<SEl=rUN4r}=@dii8i()V7S
z6Zx}T!oOV6SsY&-<-#c&6*<SYPohK0_|pFq2hK@X24B<s?IE_p_s-u>a*^7+tt-ro
zIn3X@=+l}g<}F;Ev|Q8Ox{pEW$IZe^;ae06`8j@kRg1Sc#4zK;AEu{XQ<tu=sbmTK
zw0%<O^1P<`8z&s|^S@J6>lAD5I`N%nJlBIHff<cG+Dgq1W>;4C8|XbQ{1KjU@~6m)
zLP6OoeS_I<&(zLUA6((mX?&x5kz=3BKM$4}cU%w5m5CNuFk9=}(KkCSWi_1>I48bl
zDQ>#O-F@+h^y`z8CsZo*df%50edyUJ+>_6myXM@?^u_|I2a;MFJe<u77gQwNJtgin
z{eq)t;i)ey_qO^TxiaIV=|q7&Z7<dsEza@I>{_>3X3D)nWvhchrze`de7fH4)n?H>
z8Qhb#?7tq(x{;8tZ2PVC_Nw1?-mfl3@7T~3Wt~~lx=V=FWa`F8`xcx#rrfZ8?tfv9
z8kwIm?`NNF+qzh;mPf0SalOc$JNxo~AL%*J`CLJB_TJoerN3E{Cm-@ZnSahfN<`<s
zLSGt(j8%ZS(X_WmJh)Upu^Z+_?scAVrTF8Of?DI73w&dxmZb#W@#TM&rW^dkdxq}4
zz(t$8+SJ&e6|zrTw)0HRthPJvm$Ii`?2FvTvggWbkFyixBxUA!W^3QRzmVtm_bXHV
zpRYfBs_vAnwB1gNi8HT8<z@V-D>^r|;=vConQu&qKHnR5g)U$D<VCPt;l|Ao-o{I<
zGwvi@op;Vep~3On#KVVfDA?qlb-a};^Hy^~H~Zlgz3<jtms<9Gm+nel0Y3IKTNl2l
z7rMWC?T1%i_Z9A~*zhNOZB;qn=i+5WJ#~B5>A6-M`Sj=4N57tRwOm$z$|f(^lC}H6
ztRSfvu7zd0AKd(N$KO44UAeU1OOe%o<6dNxEc>h2!`i%M&)(|aRi)L%U!R!@?7gz8
z=(MJx*Y(RWTkEw?))-5PUyd@LG2^ku%&=oiaz1$Yz0t4AKblkEn)CmhY3|DU{d1&?
z{>$z6o^XHTxg`b3OZ=m@?Y2B#wP9KOwkhe}eDV9765hJ#ENW5kPJDcE?N;@3U*9{)
zt}sly<6F6Z0b9*N9lz?Q|D5@sJYI3o^4jxlpJqMU;{VcUng6cC%IkN0eOi?9UC#ga
z!=K0b_3bYGJjpcACZuS?yvo#{{vDalOEzB9xhnZ~edT|%#bW#ixFX-`DSo`0D)Gr(
z!DQ7%Nxo^jyP0g?cI@DLYB-nO)vV!zIp3p=DNAOqdF<%cx8glp`6+2@UCz2a{J~3R
zzfI<|+E{<u`1OQODQu-7Ym7SIYJGirvFBY^%96+IhkyUf*z@v!$m-)S%F2^=``ozs
z(cpXa)#QRT*?oMgziItp^jE1qa_sH>&r802-9P`*IY(8Oy8rB`#dc@@l5Pzi1_mQN
z1_l|_VmrT}Br~rhwWy#dwIsC&RAfiJF221(@c+C0Ow-Tso@{$`qkQM=FymKOHqN~=
z`N+wbDSqpvrZRU=INPNZI$_J&&oAoV>&dY=1o1E5Xn#UQuKTY1w^r8pN&558|F`@x
z;ao)Arh}=6K55Ne-ot<LW!Jg9n-7-1`0+y3Qadbr-n~0vPnJKPJfHo;=UF}Zl0Q$J
zQc~yKogBF_>QG9M;Vv7iS)Y?UA63MKo2D1~Tzb0df#|}@xR5Pg-Fs}Tf^z4)T%NVp
z>$9|zw^5jglI_Nblb(66g~HEY%D%dW?d3iHM_+BDx2Lbw(3i~Lo_4f1%j<L3N73{T
z)xO@#-1nr4EZv#(ePNwlx<QVc_OzB0w%(6I1CLF)Kjl|#q5l1IU3(T~p8Fv&OaF7F
z;H2+2TKn&&D$kK&{<E1?X_3SZt)jNe&Xb-Mo?P{#FD=t)brbW9Vxzue`|J00oc~u>
z`0d}PS9d>j9Jue-dE|%nDd(Rmm3Qsmde{D)DgHlk^QoSx)#97mxkOIhV@<KJ^iL1<
zuv_BLk#>z~uk|-pmL&J2kea%WKeu;pzWniMWzDbKyY*98g6hsDUU;%gW7C8wqDJzH
ze>*GM=4)=N@$kNAG}p^3|8<Sp$@xt^9`2u?R_DzZpX6@H`rqabN4~~2!(LA9bQ@7)
ztJ>F7QaQJ9{qy<!W*dXF_QGVDlUp;)Hs0KF?9jGrJ2DD;C8A|do0M}NV7n<i{Yzqc
z{iPM!JlV<F$8woEZ|W>g_1qUCQzka?qx6}kMB@kpZHEo&dl_F!p8bB-X~LV#^rN44
zS)^#*U6LSs%Q{bZ4-4<U#2R_e11mF`CRj_%^80n+?Hk7K%U}1I%Gyq_TD#?@#?dbc
zj#Hg)ZC_z@u=99P)!at8mIb1jH*GHO(%MtITJEH(>Thv=V>P*&x4p`OBD2bl9^qPc
zAY{XjIeL+25~Jk~@K|=I9W9!gcILa<|7Fege(e9P<o>A2`RrY=_0rOhZj(|DJrhX2
zWV80s4gE+n{?a)P{6;GCp87lN*t9Rsb31G7vGz(v$v>e#!kWc|E}zR>(dj1tnyay?
z<B*W2l%v}g#|g)Kt#7YkoBM2Oey7CT9)_DgHWrq+ZRVLi+a>S{huGX_**i`2tmi&D
z#Os;(c<BX)67MGNk7B1g#CIvLU)uX>;j69nZ+Liv`$hEsJ`T#vuUb;|R^I!fS5!~e
zwto+cS3az2s(RaV_e-AADu#sAy|SiSEY{3caaK|y=N*+>SHHa2*R{T#FaLXHDYtOs
zyXei%hdxD4YzR?azwTMHee)v6EaUR!T-w?~DS2{*Zo>8%zh)XJGVNn@pJV)I?}I%L
zJlc1bSokVB<QqEHzpGtxbI$|sX&Q{2n>^%n>*^m!8!i7ZVZtf}rm&dh(^m7JRK8tt
zu#6|8vuj<^>KB`TJb&!Nen~-yd6!e(LmA76Z7#8!JPhnNaei;QXyR1H(y8uwTEuMr
zGvjB>yAuz;mE7=CO*^eyyMp7+)q=U(mIwE_Ce2`Km%4Mp$-}45=)})YOc@87ULDQv
zxAc&@%;r5Y@~mQpsf+jY=jWb1m~V1-R`H2Tk7HKJ?D^K8ETOLu*ul82D>3Q);TvL)
ztIPXJcWw}1Y<jgc{mPmXvm77oOg|%c=hueKKkglWnb-Y_NBlzQopeW!B_Ybn2_7vx
zi``}gyf}Aa8_(kj7T&KU9r)KVA6iu6Jz*w)=VbMar?t#8EnmG2snGI&{^j0<Yjx3|
zfA)Gzj;`V>-1^LN-RA6hsrMHMZ(rl{Kf$yAsz#R6^q9g1o)%UMjz~R)*O4c$d!L;0
z%By0MTbktRJI7X6Ri53EkhVH!;)&+6^=n>s>g4UtnJo7(p}x^&fv?EC)~SbfRctym
zUn+Oy9JynR%b0C>RPuH;*6(<rq*8va=#!1O<EiaBe;2HN7`uLlLALab>NGBimfDgS
z<xf44y77})qnq>BC>q2#YbY8WX)f##+45AgHD+?_9eJPZstbF$e|=N5<T<@w{_-BZ
z>g}7~#IFk!FTbgm<-qtwv`BWtt2GNkqyLsIFx3;|Da+xTFhRUoT*7C9h3d|LXJQ`9
zm;^oL9!n*yoW5B)YH7KTuT~&u%l)p>YZ0~~Gw#Z}@88qsXCPW;d?hZ1UEx~dg*egL
zs9$pnj&AuP{gI_eY|)e#E#Em8IF)>0o%`T-L)RLap4Xb~dx}o3D!Im-zfJZ|&)M6n
z^W}9`RqeG_+@-kssZjexj-YQUA34qn&rXeO<-B!vlh|jL;2%@cv)?MGx%Q=Y#jMl0
zl+9uG<mhT~7bBK;d}d;P9!G6uV)$=eh`VHM_I3J;9|wHTp3pwDR#&&W_;cTZ<yKM-
z|8}UccJbE*ZR%9r=cQ%;<otvW$vR3$WfC;J+A`Cuqcf7aJtZD^WQKTt<8nP@lPJ^s
zT2w~Qcb~wjJC1I=`LCYv8%;P+$#&^@q^P(}<C}fCAEJ+(G3sIYZqOc}yorzdP)NAz
z%u`Vvl1a}m1-S*rviiR3-s5}2)Ns4`y)3WpYV(dRhEvzhhKO1lwrqX+hI4jK?wW6#
z^yP0gp8qXo#`0SESgvPnhP;l(JPn@t!VeN|1^Mc#e|yWb`pU6LjV-L@8G%Mt*Nbf?
zL{0BroMdhK*3!A$@yy&5zU)mM{_zPnAK9-lj!X_Pjx4+09```@v}?vou?58u+F~pE
zTNnZ_U+@xd%rySS{-M2f6{Gx-`48A*!aAR4TV7`0esbow<Rb=MK^9^U4#%CC&9d{c
zW43<pPj1d50^5a@EW%H3>pVI4@9f&tL_dotui)g&JiR-~6LhBSPL*D6p%?mQe<_zw
z|FJ!3dEv!#4YTg&|LEVfPIT6;(2P^Q3)cm-?ph-<tLfq~2Ei{UA58gtbt;nv*V@fl
zPb&8Y$821?X_xkd{Meupy@o$7F<l80-n>40Dd;PkUf|hV(OiwoSj{Rj%$gp2eQn6L
zJ}+M9%T5_vrn`!6JLBuy8fO>qJACqUZdX3rz&G=`c)tJsI*H@^<Kt>9_V1|@m$HjX
z7TB7><=X$cW}^7_ol6-T*Vg~yI-4)zf8c_JeDuV(5zC!t?O~b}#pARsue_>8@WQ2M
z`g2}>yt1ugd6MkZo=-Q|u3ye_D{!|+>!SB1!4^AN$|vlu(@GXS;%wkE_mp#lS4QP)
zD`uV$<>LL44^yLbc#jl_ZQQN2J9(dHoLlr{NrBC=y1kc#T-d^E*rS_R3{Tmf6z2A*
z*AZ0o)%bLxpZCtG*DqvOq{zmyn!NNr<91@hg1Pfz&F8;3nYJPIf|%>=Gs`*Fq#gP2
zanhX6NvcJ@lULm_e$Q8H5|)0{Z|a3azqvb$X3X%{X)9pae*V!r!9Cw)cyH*Z=$tvZ
zxM<;$r;}yG7r&P<mu7c}h;O>G!Xbm1Q9XpWWzM}DCyp$$V@+S8TJ*(P)&1Prj_7G;
zyJmX?PjXFP%F#b-p>MNNHN*F3FShtbEHU1+X}h)2$~krJ4MEda-oCTzqt-d!&U0xE
z&lk?SsjxCCX1Q`~@^8PZpPZjbg;prMwb_3tOGvGG*{MTs6pOaWy!ifR?LALTU7g>{
znIG-qTC)2=G4tF*MczHPg_f5c{n?|pUf4^n?NI$Tu0H-(ANrU5TCk?Md+(QL62JHK
zT4Zm18j#){&E>YbI_1XaTRd57%MUMlKi5V5(TC?(E7%vUZ1Hn@$9i`|=9ZIteX7|?
zH|gE@{%Z1u^1>A+N~<Hbdq2M-<R4(Q_ri+&qZ2FdES|13)%wJWTE@Bm^weIQkNdJ*
z+<NnxfTwCXJ6ByZ+Ro)<9{DzBQ!W25p6EL@JR8fKr?!Nxxok9hhK9msw-vsdWB14~
zJ=`_>%$9WXFK<&;y0^FR+&1-?5PDAQN>b02|F%(!ivIt<T-|AOI(W|Yg>lT;-c1K(
z^PJzrPP}iZ$8URepNot=!=<IqY@_<`Gv!KWh1}S?pq@>2o85t*({?OhR{v^eiM0h+
z+YitFJ8LG&H99!iH(YtgaAR4uiGQl>Dz);C*|$pf1iyP;ZL#q{ipAuY+jx%uJMu{K
zv&>i4E5*O`CQjQn`%Ixv8hh8Qx6jweI9o1wSGuCCU6AKVXs2q%{n-_^se8{YU$9Tz
zFd*l=@6T<X&;6Bb%Gm|QmX(Li*nKo5QNw!uvc2^krIVXHbzClbSEw9hlj%IEeQ8(2
z%~?fVy*3yAsLWVbUL3pY_RS^SudeJpd-2r2$+c-KU)kO-kP?XB+q(O;f0obt_Tt&=
zl1uIVtJthJ+x_@0c6`+``@b$9?NNIe&yU48eXwF+i2cLBAd1<;$j>X*E2w;1`?l!G
ziHSGr?Ob(_3%<B!R-K+!I;~&qd!O~;t9}{#Y@WP%btX08BCiRjAnz6i6HDD$f_1$1
zP4^G(e`Ee}vW5LCY1WcryCv4gOFgVv0;Yn&%&Akqdd%5Z`)_&k^q)4`v)?>$oi#Og
z--*q?0%X=t`WagGq2yP^`-v4{Yt2gQDzA1e@1I{&{o%{U%l8lM-n91f&0T9>xow%6
zvEHbV?SK7L(@@Q@(yz~R?pc-o|Nj5TtN$HW|2yu{xV@&K|Ldw%lg-wj+Pl{^R@YTV
z|JvJK=N?5o@&0kGYl+V4X<a5UDRH8#2abuaIy2kq>?@txdCrqV)bcm)TD!_=`iywh
z%ALy{u1#OPB+uxp4ZF<M`<a*2J}YI;S`)b5#Ng|qOZ96feOq-Rz53P8yK6pu3R3B{
zm@GR>Z=yngTcXh|;SawzYF$bROUY03SkAfEd$a2%y;~Kb>D_;tfAd}R`h2T)=Jd}=
zbJH5Xcdz;^6u`0fv|Y;QcfYgdiNx+Wz2wcF?6k@UPnXRMf9kYfeVN5igY#h)IoEc-
zzdrrmYo+`KcJsoZ>nGLrd3Kemoo04^miq0@DyFizZ+cZLMI)!XmU156Adr4}bA4sC
zkp1tEPj1S`@A-FFF?87`8;ink3t7vy-+ZpxR}kcLguk-$|D4>gn}rkAdH<iRNqyi`
zoN!Odjq{(i_bi`A%h>bxy!I_WblzCQ*#DM}t42H98Ve?!`_mf^{p9(Pr8H|>+p=Xh
z&RPED{lD{oxqhS6k7tjX6y&DQHg{QF*AT*2fAP24>iz5=B7=&SW*pL=A9_0S>Aqiz
z-UZiIPS+EdvwC{u+iMoN!T()(uh<?-<Zgb*l(+Qz=_Na-t>4kD?z)Y|aLN^-Q~oCy
zeRr&P(UR!tOfV{Y@ipu2BbDFD+fJ%%^LQlivEz&2^u|XG^POLF%Uz5Rw}@Wf#V1fz
zS!eb%$g}X=;TJ`Ey}HfHmdbrgO@2K-f7WC3ZI+a**&^=tDz1}z`M;ZJ3QwwO=WyNc
zy?NQ!`xjhF;?Hq1E>XRhng9OhN&e&S<L4dy|LM__r^Pe0FK}k%^FJ*Ma$9@gB<~{I
ze3zN3rks^-RWrAShjJ|nG>P2S(s@ZGbK}f+N7H>cUmW-MwC#GdIb+XubMI%@BWFIk
z({}!O;LPdueiPX9r2gsa@brI;_x~Dy|JD9~j{m<}|GjR%YX7{TUjENoXFv3B(lUOq
z?DU#FnOrk&?TU>2mXyEkT(`)P#-CfX5^4{e$~23Pe`T*FaWeJab)BQ;rEJA37phIO
z^q8>!()`b*m&3dnxLmBAy$=3Qa6Gv=<iu01FtrKyf@9=f^Vm<Hy2ICON0wPQ=N=~}
zX8z_i5$1nbHY|{_VeIr)+WpLiA>z=Ab<a0^@=GZ7sSHWcR<W0kcxc41@U_WhO`fyg
z-^cH<ss3nHSNrGH6OpP~_c?+ei<Hx|k35R8J(=omJB#)Bo`p-@Y(FU_&-2(=u>Ulx
z`~E=h-p`9N19N6g-}7n3@?)-(I%fO|JtMW`p2~tXN4Tez^uE*IysR!{&O*%te-_An
z*%jH`@+toOs&8I(r+v92W5Z3?`2A{4^Ko`@*r)Nx)XUkoJtcT;^j8&0!;LK3yfI<N
zZ+xs-xBKq0vs?|cpIgPRY%iU;UHZ9Vn%Oh+?VhoZxFS=`BNxUC{rk1jFYMzaHL3j(
zAzy8}#T)E`jN)c2TK)R8guBB2o<QHA_0LZ~v6^hv_xa&6#$5*v|CQVD>f`4h%O6jF
z@896N_&<}zmPh;7ea`w?|1W%tc=(ZP*KexLTRf?1#gXmmbJg4a>rc4N_)d;n|8Lx>
ztAGFgE#DEw%w$pSbx@Zh!^wBQw8W*XyDRiF{gP%Jt32h9@viw^_2gy?vCasQo9#7i
z8Edp&97u{?;kn-@jLUCkLzTwX$*XnJBYU~Lcu%)8B<UUHc;Z-j^T3gP=Ug_=^St_N
zf<@`6f@3P)S|X=b)NKp*^q$}m$mns@t>FpNQMuDsKd76`J=3t)qmJQ7iS7AiU1CLR
zyJs)Tk`6f1e?-H{CGeIciwDoAQ*HIf!aa*yH_5$D%G~@d!h<`%P~_3X3f@OjOYf!z
zo(=eYYTD|u=BXRCy)VRF*cZW><dqwt5Oed_!rcdqK6RW`{8sO;x$MG1qusraFYd|c
zNn2DWm7KC;#qZh`{O(s;^X3}V1>C8e_wUEEFF87V`!?SUYHYaZu$XIlYnEe=M)g9m
z1c}?Prtxf0X;r^?%|Smvy<sxzSw3E`TN!DxD^Gk8D1N{mwEt)>pF*R0+J|RSo%0Xp
zSk(Pa%38emKU=6YkFnaE%cU2(ua|O)M5lhuu-SUT?$|@NWn!<3rk-EVosq0`sq2Bj
zrVrQG29`$6Ir?$o`cg&vSr2Du82NKd-MBI~zp3KqqsMb*@4S#|Y~;aWQr<M_Jgd{9
zT}uLaN(~~)xY#1^^$G0l<VbjT?bTuas1OF{yO-|s><?b;8>XYywpZPGj?K%&$VYxp
z3Z1*%A3f)3<12N!7CFIqqvP3GZVMSzKW>W>*WA;P$o5!PqLi`8^W!GgFW<D<8TYZe
zomepCQE5Uf%UtyZcM75>m8VM<1hX-fZPjb&^!$=~#_O`}{NT@S7c-Vb9(%j&xIX8$
zXS3EVcKzaXD#Y=%(ibC7(VG_zvD~_Q^7!uzn}+6;_HFO-uWjpFm^x=mM0cpigu6i=
zPTfCl<?;O$-;n0kE@*yQyH}C(GJnMOlMdAx*$MG!BC0R$?z|FzCzAinVZG3^k1oz+
z|2wr}=1h)1=_UqCk0nQc_??hYbn>PHAKM&`gm<hr=CD8Bks2QE#*~<H#>Muvl<F}D
zjSbdGXYE#JK2a!|xpm2MFP{~zx8JGT=&kuyS#;l0=1?+=ECWZdQseKNQo@lZ7EOo_
z>21_m{;XB6<bB{pH@TVO^Z1x$Ik<Y{5B{2YW3xD~YD`VSvh~t)_IOQ_a#L6nG2!ns
z^DA?HUK5-WBT-T_X~ts1E}xq8?~Ff>so7<4$YvSK=wx2Kl296YU-Ch-<j*DLnK^Ce
zA5M6qKWk5d?*i><D_wmT&3=4gn&vc{g_owCd)+O%JHO5C(Tk4T8{>c3R>p4CpQc@Q
zCS~R7z`wa0|Gt{MfmQfzcLI0o-i>be%6{H=o>cuX%;9I_)Hzm>j2E1jvLD<moi5(>
z@84vOU#)HX=PyXvz$3VRx=Q+2D~Fp7##}-9!SlO6%|CK_dVJq>`8&@UmEO60JnwSh
zy<O+L|7{UFy(j4(K0R0SviDE_q^EA#X)ZYxCK3y6t5T+URr9>LDzf`g)YTVnYTkY8
zNz}b@+<b5I@!u<$3#Km&Xn40r>U+Cffa;s;ebS50h5ePC7Aod;Qs(Z<clDw7{afy@
z`Wh6(e6L42@8kTFkB^GYbYuMMYj~UQ2`{7R_i0}eosQpPEtC<=FPz-;#au)0*;S#r
zn-)2|TD(}x(U|$KK){l72Q<73>_sXM8XZ01c}?y50)yh;m)3uMU39rHSJ!;agTG#9
ze)pKTemR$!Fio48t>v%s=?$BmZaH7u(rUNi>(%!L8$!)B{)rru`8RV?bt%iTsVlW&
z*|vm>7D%x$OgzpZ&y(BGu`%iSg#H!sfjbj>9_&k1nXjd@{NfF9_ZTTr`+1y!<^T8>
zItiZ^w)6F9lSnCBIyv^JM?>i8_xofw<Sm@=Uo_75`PE%1N)7Xp4^ElPQ&G=yG=}@q
ztKCayq??Bp9zIon{NnL*Q)Txy9qw~^{Nr87m35M<rx_cqI(g9Z%w-NW&4?(G?*~4!
zrK#Qs6lQeO+sWt}v_&FNaoWwIX;*tqTkBV3NgPjkIm70D?RVJ&Hb%ikBD$-%{vNt`
zB>m~Cjdz$M3dPn~c)z;)O0F|yRhzr;_l{SyH=PSg^JXhbiB&b1teTnTAvwc5xAFI!
zo4#Sjrd=#+E^BX!pBmg9$9OYul9In}hNtp#vtO2{SJ^N)?mWfaaOBdOk25cPnNw@c
zef+p{x4GX2yX^h#J2PyJ{o`-0Nj<n(@_xl5;di3e?k>R#+4K8;A5{4LG;aDIwqSp&
zMVEQPr1+lB{HDBO`s>yWVecH=cN-gIKH9Y^YI9E8-KXbQeNxl@%u~BX$W(^&!8?J;
zE{|89<=Ivztn+q(^QF(1KTeFb<?6V(_6G0O(t^EBGe0j4SjyYee|X9&DVOyOms6*%
z<KF6+5l|LdaFfBKEX8rLT$ac5$lL5EC-3Tu^PjLQf~P`#L*(Wgen%#M{P~z$-hWez
zNnU01?Im`<S*&+7_uZENa^&ul4YQ{&NL@HxPvZNcN0}zkD;QMxLVu=ftL3fwKdpMD
z#L>fF-O?}Hr=*5G|NQv}kJfI*Jgv5)ccpwbr^P+jHeb@};$4%`{>V3eO6Bk1AmtRT
z%_lc2sopog#JlU!@l75dw3uFB=stF7p`Onhm9?jm7B}A1)!(pmqDZxo-0^GA!VNY*
zIoG~LUi9C`$OHUd%BK!}_OO4VxhwSL+m7u1wW_U)E+u>^+`RPcv+z{A<+`!Aem~}z
zc*NBuf@^<X$Z-}yn<YzH85c0?e*EWJ7a3Msw(rdBpRF%f@|@ZHyW)oMTGiz<`HsCZ
zo@=?QU!gr+LR4a1kFwah8o8|-Ubu@#^jCYFK3%!xfMJhb+ruW^%gka`M_P}~t*rBV
zue)e%!n;6@Su!!Ux2q4`VdD`q4iYx}q<p`lMRxM-5Y9xE!v~w1F7_>X&7rD%R<1KW
z{N|roOnfJd&YZrw>+LFmi~}c6t-Uj;PUYKkiCHt2{$>)J`Bx~UeRfWK!@1UtGlQeg
zt6VUe5*Rk^qj2%9aF^yur%o(rtd;puyE`=G|FT(Z_j-ygZoOeSn*Pu3g7pTqPfKsH
zR`D%*$F^*~Q|pmLu3ER!WleQgDrZ&ZTHbc#T@z@=wqR2Ego1F^2`l!!*zoLl*u_Os
z5(y%oHk=OI=J9WG(cUvzA}g**CH!+?G&W;2JHA2X@}q>c5@*ae-0AW;{HQQvnHAsB
z?x-n6tHYg+ce5xzHgh*owbQ<T`ON%&Pt94`d!3thU%2R6w`R4kFw2^bP1fpGe2d=s
zZ4%*Xjz0O#?vvzE<A({&Z`F5}-?y0g?t3BA`}=_tfB)soJ9U2jAK&!b8y|SQe*3CP
zc!~|zM!{CsY^R?x4)W!X8&fR3Cp#DReXc*G{jYU%m9oxl@$2hbD~n3DPn0f_$&Wo?
zwfeq#-|yKM0*sYU9CXv>mp<sgYr>W_XTp=qvp>$*DafmHDS&fjrTWD1I|=DB%r+6z
zr$0?dz5ej;$GeklbgY%#I`r1rUHLMjW%HBEH@Is4+huN&JGkx4=?MN^)07l4BTOUI
z<bT<{_q1X$EkBx)%bF^hFUhZ)7sbu<@-K^N2)q7G(b~J0=T~0xE`9gHFK4la)0gVA
zsv9ylMWv>4F@L)|u_$`=sd&@4Gd)}C?QA5zy*JGXz1ey;T4Lk71wDUeH+cR`SNP>o
z_u~$C$K_W?otJj5oyd~v87`tx`XI;3f7Y}|A5)(&einPp>|E&e_g6uM)W4LoJJ!Fd
zj?(=tCK(mr#TDFIX~x@I+p*qb^W*LNzjxV698F~D=1F19&{RG5rDkWGR^y{>Rq`&j
zN4AN*x?g$J&iK{oE<Z7aS0~%`Uah+N`+(CsgYGL5<q_BC7CR}&H%+>6ThDx{aCP^O
zkfmQ(id0lHCm5NWn>O>WwT4wk&^eBEdq1<Ce~_TL_{q5@9_KB&aVJ<MoKIwOmM!b-
zOPRmjlhH+P=F6WRdyZW;z5jV<o2J#FYX(9_QCfblysaXfqzja}WTxwyzIe9u=)Ie_
zA6E%&DNpm}nrO(pM9|^z7yFwDq9MKeSxTc`TKNC)5j^)|8{5Xos+w8LGR?$mlF}Mg
zQycE)26;U%R<`}-EfV(1A<k;+wId6AQ@5I0tKTYIICsaLS9Q~mPgT#2m(#TAe-YtW
zJK0ryf#>RnyKdwvec8QG&R;_*Z0F)_e$yB|uD-APZY_SR?0swggfBZZt7<j&#J`!+
zEBAlfE3ZZU*Y{lYU|~BX#lBp;XswOVvK)cx&pS6yU%YH_(0ZqRw$>(JyE}B}H2j^!
zUB03$Iy-L4o5Kem+x>m?s*kC^e1^rfjh8oE{9f6UEa$pYKPURd+#Pe~<{17ts$1Qo
zoXTpcs_|_ZcecyBovwkZZ!0*|0+Oa(wL5X4Z`Zm*hu?%v+}&NYabxJs&#qhQ**7Ot
z?w7x4@aVqm_oEfo?kB$H{O5D4ZMl7{gU_xv_MJhtgqF>xJ6)G9EcV-OwclgU+F5O4
zc9GoYjk^LDHMt#Yf5i7?+DZ}S+lr6;`M3oya_yVDV@mL3;rdwlHA~a{U%Z$dkry_*
zPvXW^!6eyf+unLVesSq?VurVi=dK?)Nk30K;mkPQ^f^~VCnY<2OQ-9v#(V6BW#(^9
zkG!mUT7PBp)V{0BAMVVOy}pfiNki<e{rl^k8lJ4QPO;$g(D>LAd@gpvJ?84uf{!KH
z%tCBVpD*3(b^ZBujwi;EHK#ZNcw~6CZvOl7-tM*gj;%d&)w19IQ^Y#ueEZXU{`aLs
zPrP2RT)4O6*}ikPo^~y~dtKjZf%4*JtJh*30xyMb6z-LL^iV-{%J$feOO@6et<VWu
zI9WO3n2)iMNcS2Rlc>i#mUC3ptiHcvN`#rp@A>N+XBD5G>sQ_4QR&M4z<sl&73;*`
z-VR-EBJ0X$i?g=v4e{>j+v)WxB;!<2k?_ZoUpFSdp3$4UO6tHxh9hToTvBprpLC_K
zeZNVyU5Cw+TM`nL&uVWz?y;0;i#KI|yzlNmF3VkeBi}x1W<S_><R^R6pM&q@uKgAW
z^3?lN$J`@peX{%GUEB5B|NY{ApIV$XIYOW1M{UK+9wisnojey5@4pegXVp9Fz{!YJ
z3#am~5!BnPTBmtx_Pw;kulH|l@V)kNNAQm1$Q2uJx=yjW8R#}o@Ah_Y#oDE@r@fOu
zdCZx@d%*Rz*qIWeJ>k-E?+U&?zRP`EQRd#Aj!i=0nx_IMKI{D_{aJRwR^csgKdDW-
zT6XV`!ex)GPaT5R+VM;|cD1oJ!k&lktMD<yy7y1zD&-e??bo}kyf}8@$|l{D51T~Q
znZJm4^Yr`lH_Z81y`trR#oNbnX>)Jx(&0Gz&Fr+-#d~31-A{5e9(<~Q<R`msl2s&E
zL$ywh==($etPZc|^@tGo+30lVweu~fgPKW;9VT{vUcF?`nV`y|hhj@xFW#9l>4}u)
zNtGS-*_{zwJ!kCJ7}R{Y-qO6Ge(qnbxq3mXkI&<}w!*MvN)wCWoVG*37KP$-|1a&m
zcRMB7iFx;_uWQ(sD*9Sq<PuxcZT!_?Y0YMysyCVr_0P}!x>2*Q?pL1X>cx&eR!`dl
z4f}GPj@c|KKKSXz=kTv5J|Db!p}73a<+z_-lkAdw*1TwBYtxQ@Qe0$q%y;&s4QIo(
ze?|M9(7bx!;GqicgPcVPE}S=B-YgF4wV2GsY8N)ctB)ZtPx*|=@yS&auk%K4`P8GY
zvubnijP==5WcIL}2#DWl*e<BEz@c%&u?F3l<;=mV3)PmMGGi)PEPdh2RVUtvOP=3c
z{yh9ztyq1OO=^mMbiy{*HmS&_M)Ro^ZK=zwz6M0zwVE~ejK?*DaIY(zGHI(9nr+y;
z-mktY?ctS}zy#hPo!N1IGxxYpfBNg><dc6+3R^$z44M9eWj&8c@Y&|Nj!l~R({>zF
zWo5gS8<D11fAgfxls_RKuLjJE*?Ylx)8Pg=BU@gtO^>JRPfhDy$9VY>%f!G>@4lQ}
zJ-J}x%EQ5Lbj!^A4fjOL2_8RVGb8kP<jvnozcqCJbgWu^Hg|hN)3M488o{Cx^Iol0
zoe-z0{bIALcM9v77KY@=^wml;Cr4R7Wn8q-aZX0b95G&wyS(NXWz>%cmL@19bvd+8
z4LzqCc4kHTk58}HD~FvCyC}PF?{cGMfqS>=Xs%N5D`92Y=BHO!%(8>um+Kz$g_pb4
zvRbW!LOwAsxA0pNm^Q1Xge|ivrSPxl7p-lNo!+i*44ld&%$Cu@yg;PFw&%q0PtAu8
zN*Ai`+;4YDHK&;=u;fapi-6<t8R{HuX@Uo5TUQkSd-CCtT>q=>nJaEqvvWCbtG;!y
z)A^2J?D`8VayLD8+$y<Y{_^{kb@qGDnVo&HS>jgT=IxKOW+YGBFr}|k_N%qbzia<k
zSyN-<nhW$!ny>B=D_7C|bMaD6@bR<|o#!(a3%&6Bv2QvD%i6e|mO2mb`uFl*6IxKt
zr*!VxMlRN;sX_+cr+UBromHnO@@7h+^>OVBiZ0&`)|zrQr&$O(+~QnYYxJCb=Hj03
z7PbdZaoDqn8z^i%5?CSCXxqN{wq=caHt)PoZ!P?rmc3W1%H4VWslr{!ocEpA`qnkE
zzW-uWn*U{L{3(x`yO&S(Z|J)FfHU3h@8XqhLNDiasDvtn_%s~pz2@_7$L8<M4`lg;
ze^oHgTiSR_f5+!nQzpO3F<x@Z$HGMN`_t>6wP(Cxe(>FPYkK_3IWt3+Z{R%jtL>Gt
z+;r#N4gB7XTN$#XCc6l>O!B$J#rry%_0}`NStYUQt%ZR%WbPQR78S2yVQ<*5eCe%6
zEEnB*x|M5AUU=<ktmJ$y<eugdWly7*nwo4CSu$}wUv3J7Ut6tQxT0o<Cf9EECO*Cm
zEcJJb?Ok3xIDXkGs9MU^aFsNB?3^E0_<d4e7CG`hyWq>QIw&jBJ#EJ{Po?dq=kA|Y
zZeS0reVl%Ycg@TnfgIo7EfPN<oM*epR=-rP<>vWFZ&i`0`d@x_mw$Y1o_~MtpAV1x
zKhEBsu77Wjo$c{=@pFpj-}JvY+x+d~36B&fI%=PhH?dgkHBao8l}yAgyDN*WY}e^u
zzhN*pnZ2@Xs_25d>%_Az*gSpzYuffhYrgC;>P{(mlabQ&`&O*?eW?wW2cF!T7nrXd
zSzJ9k@0j(0P~OXIi*uV-Xjq-n%?-P5+M#`UMJa>#dDET=roG7zU%ZQ3(II%JT6Xr?
z>#H+;HQioL`I=I}Cupeg_@c!HZ?zwlM<n}{O}x{%mRouj@f(La3iV~3`Tj<KQ|_-t
zKOcPg8~xzv<>2)xhmRKAKkIeMBz~C$>r$OX3vOHr-4TAK;<AeGN9~PwPOu%GQ(nUQ
z=tR=N&L3y<B_yBxb$?|0^5LWFTV|Qx*O~mwigoLo+3&AcUVQenu_#aHa(t?u?I*@n
zJQc@gut|$F$cppM2<HiWx_JJspAE|&nM}TSHp}z3sxE8%!h-#KZ+(#bDC2v6|C-NI
zx-Z-x={|L4yM4mpc<YiAH*B4IT>nk|&%oPoq2l`+>5}&P%MSaynS;0dOglf#H0a0z
zT?RLUXF1#b)pk|xER{+w?%DNdNmToyM^iZk4KgoUFE=jvmmHvO!LP3w>$Jb@@~8e|
z*Z#SQ&p73yvuHB^%{iC*xhp15JU{Q;*5|1v98S+;#4Z+}d9mk&t-!sx4ABOgip{!T
z9M^IDAExgUT%{c`^M~ZgZ47tW*8Vhb(b~Z}$4f?c(eyddmK@#QxvZ(1{FE)KvhFxa
z$T3=bZ*|n*=Fj-9*P8odX3uqoIdU1(HF!cr@3F4%Y}94E+^zTF1zWK)Ph;@UZLVLm
zG_QMJwBHj`#9h`qQ*8Ncw!{6~1cJkEuwC>1qr2#FRo&F>40*BX><mhWA2Vp2*=54;
z(b$LCy3yicum4}=)UNC``UcatPRcodZ;$m)p+&wcLobCtI>hiN=Hm0b)L)txkN%T>
zeMd=NfVoj)`;8W@9qY}+ZGYVqtW(>#t0P5c)7!_B#Thiz=a)JjaFIWr_IkyB&f|VB
zQ$nxH`#JuN=~V3r>`V77ZTrp~S8>olDThymFUEo2@J3a`dTznei7s=39W}}Y?<bt9
z56JvH$@aVbQ(nJWm&@ip6O}t=b|JGoT>0?Ni`VCvJ4;P1Hd>@PT}aL3)9%H3HU+lv
zllsohW#4t=fx*m{?*;)^O1oYgCoj!&xsaS1Kkq?fS^u}0r$zj{=Dqr%GmCdiyos9n
z%mb!OTTjl(W4mee=C0144FRXtsC=3lAe+SbuwwGp)gG$nj_)}4O>5T+|22y?@t%nN
zB3tlzJrl=bkIg%xLl)lXK3|YualgJIWsNuIk$>mIC3&0gWiNce{Nu#Tm*Spr6Vf=X
zjL!W%@Z*N#$A6`4%U*wJx|6>;bfe&kl+>?A`9F;0CYWwgi<`^H#r0^J@+$f817H6Y
zJ(v&|J7d9(2=2_peLBVa&Ky{@piWfR;q&VYXET|;W)*WYt49W%ce*!AVbO8En%d1A
zu?0?>A9DU{f2XsM+izBG^V8Tb3QE}r4it$0VeHQixK%b&batfk-rgr4uRol2=B=QD
z`A7be4=byg9{49n?-FFRaP)Y`S>VjB5$mX^p_8q8;L~xF6Bd7p_EZ-Xd+4uUCvdU)
zPjjn@U08RkbDo?;U3RL|yGu80*FL$^wosaJ?W?F0<@@K(I4tGv-yZOF-9>?m##5QR
z-X?sCWpg`XSGeng#R26PO?NN6<&)Q4z9%s7dsW8^p5i9WJ5sm)AMo#$ns$=;$^24#
zjt!bN9A6jY6z*RBEH)(URPZVPjCW$8PRTyyJv-(nMobT#UFx<~`m5BQg)T1k527E>
zb#=TG7us8UluhVC&FL#srcY~lW|{w4`pUMuTjlpXD-B)bn0w--w#7BIqqkpsU*lv+
zSCA6nUiD_nxq$!brBa0pO>8>4^$va#X}_ks>e%ID3^#a|r7ft;KelGYgOY8T#xL!@
zxlFFn-oa9MFu7Vt)@J66VDH1hUfY(2iFtmWuW86wzghFFI9ovA4`FYsa+%h;HucP}
zTUK50b<%y6xS%@maN@Mj2COUZOU?eaGp;Kmne)qLX3;%H2V)z>uFC)IV$a@n*Do};
z(QjXJ^o$Ab6yN@oInG-&rHIj6{$081>O0aEzw+Xvlqz4TUO!;%dZ+bqQckqjC67aE
z8lJ@+7rgtxg6l`;vWj_2C41GCQnFUAuh?)nTcNJ{lU`lvpEt+F*Zc3=viamhkGZoa
zUO4Fx==n{O{m+rv+5!I@&L!`8uI_!{6z|Dp4#ADLryc6uxO>{|#a<7Womf(<;y1Ch
zWGnOOb7`ID3W{#ePm>JEdETJd*_IZ^w5O%2yE5iw?9y*vHG(xKd}){Wx7@KhN{{i{
zE>FG9FYjGoYvn86=ysXEhLd+i?zh7m9=+H5m3H^a#f2UFPTs04vH!Sw$2svesi8X;
z+D!Ygxcq)V;#XI@Qpc)wyfz=7H2h&xv*AmX_xN>>_4ZW1l4+~9&zY#RNv7xD>dWcx
z&lya9va&PL>8jP!|DWvF<Zjoz*Zuv?+11<i;||6A{`cccd?WXf$(frgTy^@s2Pz#u
z8LBNB{zU7p@6owOS=UQ(u$bmGb}nj3*KgUPo*$^{V3-!*cgc<M$~&f?^Q!&{MOz*Y
zySHPljhxAM&V83o`f2V9JZ|{fBIDzyH@up8d$e)_?*{1JO*?cZNvAdUa;)sCbp7~$
zU$_o)c;^)Oo#fSDS<WpHP{ea4`<|{&#MAt$6E7+s-o5td+@+39yxT9#*>?4)itqnZ
zuTNZyyrWW~D>$3y{D&!Pssg2-*3D+)RNlmPb7z2x<&T{+WMrmXW!!t#`@xahtJiFK
zvm^F~VdjSv+iEtRD@!aNT(@p`^L@*~o}FvX^sLM<epobjxsl|oT*dM;#%5>qmbP`(
zE6?0^DWi|`s>6%ub1GlC-rLNMzw9~pZP}9hlPg0*wwCZEl)sSty)iHRkC|rPWZ%an
zPAfZp1&1uEHG5(GL0WHX{u@jA<_QzqSo(q$Z~9&eTmMz{lsNk<yGv`2B>z9qRm=WH
z=As_+%QC0S38AJ-_&81%?o-~qw&-+yM$K>MgmQzx^p86ESJ$q)wZhSsVRO)Or#ew(
zlVt`AKg_<IU-YBC`t!4rKZ0ipE}zMk`aIvyb*~=3N1OFOt9e&dL^M11)yJ;*wX$*Z
zwNvX2KQ9S)uY8;I{&4GJ@!QkG<}JGNNVj0>$1gum-kyB@yno#Mi*wgqx?iH<cI)$#
z$qRo^?u%OUWry{n+NV!r*cF>a=f4XH{HSy7N16GZE3vyHR5wVK*PmM&>K9Ue@5tv}
zSx+RN?UTscS-sBG<9XDJ6BqTA^ebk)^8W6abI|gvj_Z`q>$cUU?C`PNQ?0wN=MKx;
z)wkasbO`%+wfA<*XU{{$_j=i@g^pQA#y{fPYr0_$*J{B7w|Sn<@B7Sngn1RiD#sp$
z;QGlI7koN;#;8{HLHxy&oK1{UXNyc6bt}&O>oQ2|YVw@!|3mVYx)b}BiK|i%dh5uZ
zwCJ)~R4AV`zgI`sT!yJM@u>JkLDLypr8);^Di<>LeVz5?K}yLf1HT_7cJ6WU>96LP
z-)+4<nQ@nX<PPbg65a0h;=K}AWlvdV_QwBtdG%z-pPpG9sy0gd6cjynXSgbUdzl%}
z-zHUCayxLwN>;wO_sP?WgRNpGAK14l&r)NV!*9W9-M3fm3v+i^v5wVMHnZ~YvmUKQ
z?0>xC;w%H01%rQfJjt}#S0MWN(KYE?why(VKK5Lx>B~GC^4!4cUX%OD;<drocHEgL
zddDO?)#~u1yI&T3c3Qr`SDWwF&6L~+dVXdfKmJ}_&a`Fvr6$Lfho^0L@x<JyHR9f@
z%hr{~qWXoq6a&}B{QqWHW_wz&@{Ig?ePPafYL7ng-rH5<vNh!1uX7J$f4o>$6)t?h
zF2LZ(jjG%CJbNzM>weuUb^DW<@h6v-eVNaFm>102lX@$%%1QX7UIE`!y**#{ml^si
z1Xx)41`Ee$PR<YC^wxz*nxEGu?Q)mZd-ak-)lW|4PB$vjVsUN^;7?J0@o2lX@YgSG
z$|ZBZ{&~z^6uQ+x<V&ZlrE;o=zfB7No>^M&w7e5y*(Rh<DDZkya9S$v<Kl@QgZW?S
z2hVlfzu5ER*NYpC`Cq>3&0A9SoTHDudH0ivPwto$TwG~W@q5!RTcPEAvLEIsod|y=
zB!BLzdE56Z;ZrYbC39U|=u-T3cj=Su>`bkby34Ir@2tJc#msrXS?Omazsqug6CYZa
z%-^Lc8k{11w7Fm5bWO#T=Xu^mv6HgJADA*%=OoK-dU5Tf<<iS1BzGHLnjWv+!(3_c
zrtjufYgYE^_r-bVpO%#HIT><1+swv1?Xt+{LtSzw`7O27*A}?D++jR__jh^H*GE@u
zUu~0aJI7M=W&X<g<d1^!VoUPeH(opSF6FeiS<3H>h=Q9xRH`)pO-?a>Tec!Suwc38
zy@h4_W&A_zG~*X#&pP$Sx`grl&T^#%>8A2l-2O$k7_O`4Ke4glTA$T2Z?n__&yB~<
z8ct>OaQZMUC+=_gu3~|$E>;mu7oYh>vk8b@Sk5{%^qS-v#XEnJXG)#1Y~KH3MUrx4
z^`nEl>&~Z1{M_O8{*+CH?_cLHhS!5$?k>JNf8{?NS^f@|ldgBOO__Bq!XvT{U5#uG
zSDDGkX*|<fT1IR_@<XOg@9MoS&oJLOwQpm08;`?+)b|T~4>0}Zm>PcX_7avyeK$1@
zK0C11D{3!aruOVuH7~D+S~C+oBI7Qe^tI9Se{S|J#JTT7(!Xz>!p}F!im~~$d}Pq|
zZJp3?Yi`fMoaTVyq@{aqOj<7O<^MZk5C5Lfhsr&ZY^TrKR@&6m8fBpMsrO=EEpuw<
z+Nv!n;SRez9(a5Ezm2>3%;|RO6;Ti4FJ-wgP5Ero|IO}WEm-FeccZPJU03Hz={l!m
zDW4Tx$0wX>e(IP1^y=hFoqu_oWq&VAdmu7neV%krliW)cf%tBXzOvJL@4XpISStTn
z&-&aOu}-=t?nrdTSJ}QRQtqNYM^ALH7GCbK4t-!Jmp@gA`Ov}5&;HGuR93#baJl6E
z+Z|h?cKaB5*)3`CR-aa)G4b8a7qcgtTx@UkJYnDa_(|kbdDSAj^Gizp{G7!9W3Juv
zKjm|#EacS8KXxxu%gtV9zU+RHo#wx0+|CF)xFRm>>Y<pv(y0#~_W2ndwL6(`qGeN}
zdrOU5$y8>4L4&sas!A!ml4T|78-7&mJ-G78yAKk1S92C0Vt-?;J-7MkT@{U2X6b>9
z?&@!^n*83tl$3nxzhM3AfS9RAYM;A_-pX8e`dG?3fx1K1b{^L@<uf{j9hFM<H@tCX
zZkSF*qLf$JZ#5}yFXpFv|34M4KO*00zVwHs{^eKOHm>Iln0ezQ<K=6g7B~f~oSk}R
z%JasFKQ|Uz<vB#}y14mpywY3w_T?vb%{=n5_qE}~om#3tFKqs+TYclj(VvsKPlXpq
z?1-&yy{Q_zCGJJ`&Xa%pcW%-6T^gibeCy^V*`vIjGQv}zYMit+D6y<=-B&OA^3fxo
zosVqR%zx96VDY>^&GzQg!_De*r3HTmHymbkHZ9J1zxn8EE#vL$eScT}d#K+$+v{bk
z{Y+UGE(VnxNj}ez$U^n7OE2&2%)0lGxpJd|o0gf1MbXvsou#K2me-2kR*Tquj%(NJ
z3FaL=cAwl-^REOHTxTs`yyo_H%XqG|tw)&|UtB#JqnxSg@X7h}^t8wz_pIYB@1&Y9
zb@Pf{*zjUXfBmg%j{aY{zPB6L)YVqDdK8{>R=$1Xq=r7<;SR?cb6!t<%doY5>0{%t
zH2olU{$=}HS>NdXxjT6s=k)^@WOZz(FY}Do(KU2CB5|rftI)?r>v+YH_j6lLWC<qD
zznySrWpl^{`+pvD3OQz}nEJ4%we<CDTzR-+)y2-+tCa8QO8vc39LQ_le<ak&kCCNV
zG5i1f`v3A3f;HPVMVw!MPmnL={AS1V7V8RR?;G|OUP#_~qkNr)%Pp638<y`AP3J3D
z@&~!-{r{`5rnY|4Y?%<P$4d7@o0prfRK6U4%3#G&JC7;8Tc2H3m)Vq~+m-d{%Y&_t
zo^bAXQ6e@gPqg~6%=cu26|a~JwD`oHFJEHLE^@(vvC_BgWa`4lyqD*^dolCZr<v|&
z7)mC;Db1De7MXr??XCi~H?6Y^j0`UH<Y}Et5k0Z(`cB2bl^L&;#B5qNo}IcdP;$p?
z#`;}zE={X#^%mb?TX!w&ZqMiZFZowrnqK_;aN%jcuW5Uhns*i2ZPK1QHT2-_GPkov
z+pU7QR=t1sTJFxq+nS=XsjBQVrc9Sjf5tS~%vwy5yU2R0#+mvamd~H=|6Y0d%hm}|
zUyrYRnX<os&&IOJFMZzLS=2atRbfe9ijc$HNB0GGYO{Upk_xTUuzt+EOZn@^+5Ru1
zW}W}LZlOrP&P{n$XZXLqE-Ku>xM%K~SsmdA&Mn#TAYuEAv(uCUH5Twr&P-k>GvV^)
zSIc()&Wc_Az|7J5t@*)R<H;TM8t?BN4~_}y3|ccYn(fu^17VW?{)l|By`NvBtGTj}
z`9)0s$qMQ3v0u7)<~B__`0ku~?D<dciq9!d=HB70<D=2p7&7Nf{}1KF4V`;r+1A%M
z@>aA?&$wvyE=ya1Bl@j)p{&`d(4G^rJ7@IBO5SY!et*XMGrUH&OP?wPsVW~|btvbv
zg2Z&jkQX-`g!j3Gq<j9Xn6hU5q}0-D_hVBw-;;|A)7&6DH%#<O%cqAcbv@*^<aTfG
zNhmhlc=7JGUD>m8BZcha^cDCVxp$jZo_=yEW&1s29<!^mOfwqt<OFU1?>l62>h-d<
z)8_kbT^aW5!BH2rTNBpY=M}NP9uUhpvFuw=M$?H8A2!}k@XwT<s<GksBAMNqZ#yOQ
zmWQ#OD()`h-L0DK^W@6p$3j7wk5f0zOqIEM<W}z0<+oR*u3x;OZLzF&O^f2AjDLX^
zYS(sIc{8mp<7eEW5-B<*)GPkzhrUqh#YOLT>~o*mK2>*0)nRt+`+@6@AJ?vpTev&!
zvFNMz%z(TloTs)&&pzq4Zlzw&I^|VPi8qB8ZWF#L^KL=0gjR-4_fyvulU(PWK7DZx
z&*S&I^_kx+nx^z!shG_}JnQj-lkToUr*58jU($OqHSp{tr-@ZfyYFTRFZq1(u8idB
zgG(Q)%#i%O^PK;Uo_W>b`FqO)tK}Wu?(LT9QhoYsTBC-Z+q|NcV!`<(Z)RpTO7m}h
zEWhK&8s3TOm$Fv(KbY&VaV~Swmzu9hxdk&Hv>o1+wPVsM;WdkX2<R@Cwb{d;qsSq9
zaz>hKTlwNCS-XC0F=E|zfs3muqVQ^-LZ-mXbwS76{0g2<=XRcWtS?+DwSB+pV<{0M
z#ZOyLa`j|>2;cJ2;Eip_O)e|GAcK8>H!$s#`L^nZ(Z0pnEjJY=)dtx4il5hen0q2l
zj&-lW=?9-=CAh<Fe6PpOIxe5bBq}YZdpmf)L%u58{|)R`m$mnsXlUkJCW`f)xEdY2
z>SuAY^xH=_rtmC&7JQ;P{e&z>1)tChWkxTb-@5FTZ_*C2O|`ql<PzJoajsuuarUiG
zD%=V4IX%ml9lNTuY;9H4tCQke{7;u{J)>bLD8KB`+S+u_t#jS2U7Zz9#r*l4U(?RS
z?Nj}C;fme!dVlz|bN=$H*}?IO`(eOsnNL^WiD<5TBr$clai-Djvp3)C+%er-Zoqrw
zr^B6Vt+N-+Q9IqY@7Vk6)3<s4*89yJ*Vj9b{mV}4jT+mhxOlWP3v~Ox&33HJ`XYSo
zsmERi%g5Ke_asPk=M<LfYrj32(egMVFWuzVgVl$3Z0UMw*K*}*|C8$u920v(=dR8A
zJ)?i|jTZvfLhqKJWB<zkn=8&?-%ri+d25X~Jq-5fT6g_!b;h-KYxkX5!*b=Uk`Ye?
z)28*|OG@uF{b7n1cyRFXk;892-X0Kq+OBgdkRyC$-;sp18dIzHS6Iz>vfJi>-Z#U#
zr-$45Cq4ZpeM{oJP~{|+Y6X3!q<?`sPj2^4VUOoLd@5(%g2Sg42p#t3D}D1`>q<a>
z0k7aGrh48BcM`rVI4W<&f5X%5aJwmw;TwaNc~OTeybedDzvd5ERqe1QTxjRyiu(Hh
zk)iieQvJkld$Juo>$ht~`=R6?8&=CNeIBz$cE;^_dx{FrzKWQaQ24Qx{e55ChG^Gm
zuOmgy1WJCFdD)-ucmCM6GTBofMPs%xJ!|~-sv>c#kZE~AN`jx)&cEfd(zipoJa(`A
zvHfvp^t-|(A>Zd2RNcP1B<|H)PvO$`NV|_(Q$GGo-t3nsb%4qEpqZqHOkc>tHEt3+
zJSVzqIrGn}T((A@bMB$ZT~ivJcTVbVddy?+(I+&%+kWvBrv)?Izl5pv1&ixV)>^;L
zY}Z<y2%WU$k6O8s=3aRDB>UEs;}sGD^`Et$du-Zh;3lYgCMa{|@%9R?309RFPkgty
zzyJ66@^SyNh5Hz9pIyDdcy?r*!%6RZ-#&@Yc(JMVVduTW)0ezGz49U3_FaKJ^S=F1
ztxDXoW1-%TjcW^^JocFL!S&*kIrkZT%1<p=@VKS&5MPDk)2}M49@{zYIx?a5yN8gS
z`-jNPN35@f1J`Kkt-Tx)o8TY0&{pxZ^x@#bDph02oV1xf&!?VniR&{{e)%_5_1Sb`
zu7wt#);bGCY`yy;+4`)<0eKzUd$IesS><TnU+sQgLheN1p4;b{^MlOl(hk_&o3`)S
zuJV(jd4;X>C652Q@m#5_JFx27nx&iBmcCFsxIy;3`=%vH`;;S2&FlFq^-c1aW^U?-
zE~})Byvit_XceXq?&<>{zfZ7XWjy6GSu~Ho*C+d5?xKUn8y+(7PM>w#v0WxR>WBur
zQ7iK-Z643QB@%y5Y{`D%mgsza8MEN2(u~aBSaX&o)9pk0WjgK(Z=b(`JtfU{&%ug`
z%RlJ5J(EzCz2CNM@9bMA1;UsLifse0MM+L~Vu%f6y|uu<xM8;HmCxC?@;-Pf?4Nbd
z<GaSe&wsvuUZv6V{_xG+j~$<$>C^xGnrHV5FUv~qx9duEH@zr5Y@eR0`@18`U`0>f
z(E@YP*qaM8e4?bj8azoVzg~0f#R>bUi;fn>?N9%lbgsG9voq;QfkzLY$CE?O?W=dX
z%#mYz`S#PCMVy7xRlF<gT_+t6JMbp?zs!k^svKLLx6Njl8nCTasUy+p_)2@{58}&;
z=R{qe|G4l)#I)*L83mQ0k6bF}UA^|4dD)2q=Fh28;>Suav>dOMX!~TBAhM-5QQ>xh
ze^<vw=|AsR+0MUn@jTNbQS}>l_WDoDs8X31s%_OU;ZDd-pLy)dioFX>c1gr-nxOkg
zz_KuU>fOJ5Z5Q1iv_|?d&er^wE|Qg<!}_hI^;L$d{*qqN!`@e_Z-lx#v4r>T^NLlO
zvajDVQHJG?1?T(4SEau*>vb}lEdRV});zTtclb|F{B0roAZ$smZ1y|R%YkVUiDfHx
zdHi0X)h<0(Z^zWzYfoi<_P@ydqS)AD!R)<nm0zFke5m+#%D+F!GjFs1U^~Z~oV0(&
zV_px(>5H!0pIWT)!$A4_q-3Kb9@n%kH2eOzvGTU^_XW-MeTUwkzpt-!Xya*lp(hXC
z?r1N&eRy?o&F2FGoY~i+jE(o*6#Dp5S*HBa(Q0Q#nQ0+cxKD^#Ukl=0S?K%X&+0Qa
zxmzD;_nYi~<XdK)A=((vfB1Oi&z~i|2hPuTzjE)e>4XFNCW5K?a*L*yIQRb9k){7&
zWxnO?l3!Mwk5;f|dnCS*U+Vw$(wiULJ=gEAcslQ6NmIdG<yhOr7fOG96LI~${`uvj
z&eFUQbN;T?l6+XfU1hr3y=29|fG5*ce<h#4xV6G_x>4o2O9jP_*ZuADrhOH+a=U)H
z)~fS~j&GyE`GTh(vRY1xahC78WcB=W=4M{kdAgG-wLi~Y@mJU8hs#T~k1H-4dB3=2
z%D;$xe{#XWSpl+VCs|3YY12JxWUpJc;>kyekB@g(?i5_Ybo|(v!tF;-7f7Be{N_<(
z|L%>d|F%P&N`{-9B@E1&kNrIR)OUi&;pLYq``D`+kGEaq?+V{=*;ncHB)!Sk)6YiK
z6?!Z<v)uChm%r*$Tn^nTOj+=P_ri6l#)~C)PBK4y_e4WJ^1#av0rI&K2QM7g`y+A3
z{gLJJJ;&b8jlS@9hH_%!jHj$|85Ofvc6wHCWA|DbUd^OuuuIwH`D4A8Gb%Q|{Ibvf
z_2&zo9DfpL1jUst4qne5RQFInGM?{=(~<eoN@t!{Gfkh$UR7;$HsO(c+YQ@SduHqZ
zGRcnKXLRHAWS5^AH4lXu3S#2d8E#xHel9azVEzrk4U7W6=Im{6YHXAKU74wRnZw~=
zYr&##*DcnvIv>uIIid6*E${VtgFE~GFL3zs!}#yTBB9-^e?R>_x9x%9^z6CQPo=GV
zXC)FOS{B{Xl-KZp>x+Qml5&R)C0sd8fs+mHDNJ}`DC2YG%le42z)%0{r^nAaS8x9F
z>jcj=r{7K4Tygu!-L`!Db5g&K`#oQGcgyLJZ`rlKO#XfU`Q!iBnkCVF|E8WlsMq(m
zBCF%@XTR#{Rs8GQCSMG&ns{T^?wg!XO!bua1a;cFh5fN`ue*`C^lpMwgyG~p2TY6J
zKGRJ+{BGLhf`{UL`<EHBFs-k1T-$R=ctY3|{kPuHZ>)Kq++B9g)J0^*f*`BUYQ8^C
zO~0Hq^QK~9uf)r04(W+oKW~h9Ha%STm|b$(DF%~|W~--LzFxFok8Y;lb1latUM4=?
zO{<QDc=-ify>R8w`F|U3+!lzt(cX3TRZmL$^r|MK--pU}TRn34b9Kdg2A;k^kD9ui
z1w|h$da5lN{iA<)w|8aV$Xspmz-Wri9r-C=@=LyQdDIGTd>1=msZa{f{K@>%;&OjO
z)*Mz^B;)q|cbpf``U>+i-J3RY%<Ma={r0H;n;AZwA2Z%5r!P*g+uJ$4_)q!7GsawX
zy|=a8*3aww>*)JTIVrWoQ2oGNU!~>+&5><S_E^WelwbeuUT*$<qVQ40)mnY8Rc5?t
zVfuMnC@rq;OkGPYFXN`q??l6IL=`YUzHBD)?^?97yl#3x^zBX7f@+hBtnw3Y*)iST
zy}Q}(ZQ_r=CEvE0{#?blLC7IJV_A)F?f(7t9i`u`xXgcS{?$`BpTA@Ko^PLbM`Xvm
zDB}6k%4F5wcVxn^-hJz`?q2e#bx^DS^VP#8di4PfJ&~`U9zEXk<!;vhnf^!a-psi3
zezibRNsr{gyzPHIRA;F68*5cQk$Y!#;O^sBpM0tw$-332eA*wxdWQ4lH@D*syWZJ%
zeRWV)HgGMEENiw*s=BmtwS0+M-HM5#?Q3<;@U%VW(l~Ktufdh;$z?%FWw*9W+VWlR
z?v65jo~jM=Hs@y5nc5ULvAuV8f4+If>iLH}t4@ffx4dz*^Lq8OL0Wdzqq{q_4_|0_
z6nW~%ao4W*t(&Ho7#zIkr77n3c%jwKb4;CSRaYOpj(z|9(ZBNiUW2n`%TMOT_2sU)
zTptnlynb?$M;`lyLRRK~=W^f8dwOf`*Js+%g2&=RmzY1ZYI|^XLf!lqk1W@jhkeu7
z`}*{{o5z>D&XH13*A4r$?w!P$w-NE1)TKk41wJkEeyP9ubKg228>5A)u1__lyu5AT
zUU-S=_!_6(1`hdNd)DNw3e{1Yee=bdqbcIEHeGOFn00Uc5x4xwRt4e<mrb$f*xPfx
z`lj;b>t3hbwr~s1={Pr&=Z>p2&x{~%rC%C);umK-Eqg6znjACTvXNQXO+++cU)m=h
z3r`>I_jjjW5m;>9E&T5I<qUS+iiul13y=Kln%kUZDVL-B@z<nneh#nW%yZ5@v`O6G
z|Md359=<10hPPJkV$`2@GCV1hm#s*wqq*<RL;igmlr%+I?g$1kAFtYSytG`^Z&`pz
zr}jVj0B>d%5e5bZ4u+(4+oRTB?wY(;gn?nI2Lpo`0|P^DYH@yEQfX#Rihe;+etJ=2
zE@+SJU7PIUJ3A)c|Ej$q?CA;3^B4Nhw!4(yiaLJn)~e5|bu4#BcXb_{FhkN!rpbN6
zq%_h0-%HFHgdQX>DK!h<IeXL6nTi)OO3Z)p%5K`+zrHSN&sm{Bjg1z*u7T;ReL~#d
zxSpKc8)4HwPfljj^i6j{Z&n3we(pcNc6Y_UFF%9J_6fe38?Y&1<qol(I@=9qUTw<f
z=L?&9XOl&oX=!k$McU16Q$o*H1fH06eWuQpg9jJ8_uF-D65?9+^8JI#Q$;(^32mDs
zYQ1x<Yv_kL`|NbjwD(Vq39nhLG^4&CfnohDrIkz1O#SP$?fsQyD>v`?%i_KDefir3
zUN_3Wt~=9Z`nYTE>)0uK?mfAADes|jjmhusH|5bwn0j8;^F|xS-xU0I(Rx8{SjTi}
z&MEUZ^M`6_O`O*$RkkJR`Nf~-<^3N`&-aV__x<JX>+bA4aZ(dB)@}9@bID?Uz2x^P
z$r*}!8+LuT%xCj<pOuA$N71?v?_}qz7nG#-POLmNedmu2e`b5Ux_OcDAlt0{2}|Wp
zzv5+A5&5u+k*!hYih`iSm8cwLsoIbtneY#5EtCommiw&BSkU;0&*w=Q_a3_>d9Nw#
z^PcavG?@P}>+XfV&puZTRt1!XF^4z$bDZ?)zLBmPRJK`=mGNzy^-Y6$;Z4h}%R)~`
zmy2<RYe{mb?S80nV3Ov+)hUnPI;L7G6db9$!!aY~;fhU6Qp)c|<GEd5Z(4KWRnPOA
z`VF(q=PDe_4AZoTtde(N|G{%)YAD<1+og;g(FYGy@l82fT**8;>fMdw;?MJACOk4b
zIXmQt#{Az6vkIl`_c96bi8*$ZbO^li4O{Zb?dYRzVQ*%%HtrBTIEOWQ>I3}+V*jE(
z&9ckAoUp9bH|%2=xAB=zN34EbetvoTdXq09YaC=1N*`H-D8--c4Oy{kR(Xwmzs__0
zbBnicn9p5NSIIfy{%NN()j6%xQ%?(>v+McQ_?)Y6vin;_pXbs{``PRIPyGHkTXri$
zLARjiZ^PUx^$izn5;%@Bd~{b^(R}$wR0x-wT~42*%;A-d&krUg?&G+XxFBiGm%|@j
zPr7Tk-~0CUQ`(in)sK{>Y|7cneRlCob54fs%*LY9Gr7{;nNKybFou**>|Q>-IdB8(
zRrzmkGA#IbuDGd$Ydro{vPenGwP~5o(ya;e=Y&|wah?kaN>!EFux7oMz_qh#&A~GY
zSlii3rZET@XfiW*eq(g7-esD!TzkobIajapwe>b+Gx)J>^Vc;J<(<bYviopE?vY92
zuXju{d?0h^|IGxO2@=bAIIRvDv;3WrVIiUWU{23rh95x_TbS5?1__ESQ3>>Wqg=?H
zv|xU3^Tp`;<K^CtDvLKa_%P(|3o**idbnXR!|!_C8~ssn-xyeyPBAgPwbU}&Y{ACO
zRm#$5MK8oWIMT4dJs~?m^GA4hN^lCNlu#M7S&?ngk?0#7{2JSnmrh94yP&~vdz#Y2
zwr2B9yMk6&6mBh#{P@egK+k0!|IDoT7e^VQEZQp`Yu(J;^>FpN13eEc9z53C!R%Du
z`R>8v=?U*m+N;}Kbr;z7Y|^jQxGnj;FTTlhZ&im%9K(~-`*iqH1vZq2m>U(WnEs*k
zL><E+rivRHoea$BtQK1zUZ0t>>R^SqhC;K0{&!95VyVoqj!Ca)PT83+n#R5^Zt2P=
z0$;b@Q)K?WZfa$*&H;AjmkjMIOP5synX9aqnZq#QkU)z2qUsyrdhI^3sj8Egmdy=3
z@<i;4ywrD_-9m4aG|CICxJ+(zv(+mdSaFAS`jV}AF8pzax*1|#_RLu%dr@2?^vZ_h
z4fpq)JZYJAF>n5MIoYnc?7~mw&k87nbDB6S@y15=pHR6lA+4mWbBh1+$pylSJToUe
zzjlC0KJm(n84K_9y>=F#mfkFOUe9)&@~UH^FE5%zi*LHLXWzrn#xonGSSz@^_|FJi
zJ$kTO)I+iD6j$5fe{1(&Y3{I@_HxdOpnNITK64Lly@Vs@dM?B;THLzWZq5>)9WarP
zf1dJ=9e(@PZGW@qj;*7PSjV)e6=|Lq+QcN1=W_gOZ|qcYxc6eWs*JCdv$2RnOMQy`
zT5ZKHgC9Si=*;ldP7`a{AH2EYZy&2p$3L~rhr}1&WS018dc)C1jP1QW%jU@EhgPv&
zTT}MY^t`lV#+e(BtUsKx6EEP<KQVLZN&N!?dxbjJSXexo?#>)J^NLWy=Gm)WBo<t#
zzIAHp>zHr>Z|Uc=CNQN~T@bBm`d|9J^=@r&?ZM?ge(zquzk_MXD&6&_t&eBSkUjo^
zFH_|B=W`q9R;wRc7^t<Sn3ZLwgBnMZIq#V!4^v@Ru1l}aY&>;@p>1QW%JHKMoD+1j
zUK`8~IQ;Rtjkr~T(xU}mAF=<~<@4I|iQW4jzHfeP?Px#9$M-b3?Be%x`oGgJ94$T)
z=<@jKu6d!sH&~N6K7PKCQ@-QEzQ?A2cX12FB{8WptO`9FQS+rCe8Ph4f9D$oj+!!L
zICHB%{+P~pk84M>KuXO|tp^=fFPxs1@Z@B3*u+)A9}J#<+q+^FyT+WNJjX2_^;4E=
zBpnS`GHEh;b!YlSvCl3}Xa1cvthUN~mQcmx^h&QGooVOVWe*>(ek3U|zf3IkgI}KT
zLjN~f6`6MySZ`+0>JepsJS{7n+c+bk^j(b0ewW7m5&>&+E|gDoFt)h)P{D6WMw1(_
z`Hgd8Z*%f_GFGHGzv=9m9LD<a=;fpG`tt4donL0(d@Pw!#G6@C$YhkHrIz@(f4|H0
zc+T&2o6L9iZQR0q?99(p*Uhm>eCs!)FtS#rTk!08DOl&?xv)pUFCjlQxb6J0vz_+t
zmw#7Z`hRO~##QZQ;*V83q|%rUskqng*kPB{Sgh5&bGC%ltL4_WukgRTwP1QPkJTgD
zq-z^4H7aw)P1~^FYQldnxn+-^M%?Gp<#@oc?N;N_&(iyXd9Ezmbn{f|WX7wf=UmVD
zp(Hl%T34=0#rAL3G15s~wwD;MotwGQo-z2s_hlSYims?_=UiaXvUSeY0v%U&;hg0v
zYh)`V(*z9XG=7|VHtx-Zco(jcyi)O{3|9{>pBU~d`Fia!ho4#ER$neInYVM=8P7jF
z&DzQW?*mN?&j+vh{qtethXw{06``uaw^Bdcepa8gbnn}j|M_cRoT=f-xE)WoYyEbW
znJoBDMq1ifyKm>!_>wE4uS8~vDxQy#-!$3D^hrr})gp%)JL{icK3;B@_q#uDfqcx3
zlC`HC&hE4R{WHhUe*XEJr|(KlV_CRv@(I<L2MruA7Cf35Vy0~G<?-pFP2x7oKJnC*
zw|w6EasMz{eE4i&&4DG27W0C(?S9s<oVhLKt$5%`)=S!{0<XBa#HM=2PP}5v)IP!a
z$WgBi+*_+m)T=BKwuPJ*luSKS#3yqzp^EL=s)IM#ckI#mth4YEPsW~8J`Tpu<g{))
ziMp|-<EE_jYRy*@dF(`YKGC!-Whh%>Tf(WrSpI?IE8{guiy#J(xFD0)RSpO4ED$<Z
zV{uC)>EH$yVZRVA$p@zHWlb>}jtz5v>J@9eGrn!qS^0-cmeJyP=Q)m4x%$TW8vhsG
zTDjtM$k|<cnHWWq8Y)>V4n}x$Sqtv^;PR&E*t`u40hLFy<sSUrF0{y?>bst|*2*WV
zmihBto4eU(C+C^6k~p>0#XIy20u0tR$d+a}WviaLsUYht@o0|ZFD1QS%69xroe4ZY
zzEt_04?N`j<dK&pcYnxthOM3roL2lL!P|{x4R-vTwJ<2FH+uQWwy&J(7mBqRzDpXF
zyc3<fMoG}D+-~`#vlCuex*QE_-t;*6TaHTYy{N{CZ!Aw3%E_(Snj|D#Z0UFRIQRN3
zj~q=(oF1}Wp6B{t73b{#+m5c(yKX$~e6QS=)GKOxbv|b}WiYX=`de$V(;#2}cuCRy
zMU`T&cSJW|vOHc_(a<?-)x0Ao7v7q=Y+9MWRgw8AG2PvtSa$6=`fK*S58pn@9M9?3
z`F@(y>d3pEXD)`Tm36MMy{(RoH$1ca$dk6o!ON~IJY@V*@+#=|+@4FVt8;p{Nz_~y
z3tQjPwD^Ead1UpE4OvCIXSm%~W7+-qUK6v>WIO(XnTtZdF5K3-Qlu&^*x^lEjJNKk
zQy0&?i+lLx_ob!5XBIR$MVkvrd}FxY*SsuF_n*L-4T%Y+Q#@BaZd&eh^<rp?YQ`Ud
zbIT4b%46zz5W2SDt%1cKHHnEooXet0Y-R*E<u5lr;JtBEr8^VnCpR<ig*@ibR+p4N
z_(a|6(k@{0(K5W=cs6|N%8fr4xIYkNPW02;rDQkl+{N(aF-GfmfBHMq<?rTP4wZ;y
zf)$UZshfJtXxVJ8vs=O=<C~RLoQ?f1lWBSuJZTFwbl;xc{-XTR?8oVg8GkZ!&yup&
zu339!qV~6+e_#3^Q)qr1-??^=npOUBW3gQ#u2nbqwiR%mc(LT%*6^zCxgTsKC(pGz
zn-G-lYr^4cJj3_ryG~cx<fUnEtiMfJa<sWBN66y)qX$X`VbA6+*mx^t=|{f(uJs3|
zu(@7;ow!<0+34%)ZHZ!)H^QP0Ufi6ss?YY`e$P*nV;0{2@MhIav7P2WcBmKlONC}?
zH55)43C%d0+P`0(`v*heC*cl_`3#qH&aCO~6s%_DvR-+1r|Wka^A@c`Ul-RFxYbYQ
zdz)Ri)^k(Uo~BpbCWZ%&zTGaYp{yxVFD=$=HCuZ2BNoyB=1<aBZK*$DH}k^LyiKWH
z>#VljzwW2j6f<r8qkjLU^#4*qHuDp-Wfy0be%pVHZ?@XTh7EiU>WiecG<Z+k%2D_w
zWGfbAt08(iO}6PH*WHNYm0P&%#Cx5dpP0AH`tR-Y!ex<i4@D*z<#=y6H+7}Tk4Ukc
zO+`_2W?j|VeN<$9;gik-kG3r{=<bk7{2V2E&gReqrRa6*Hux~*WtWJ}|M%tR8{yy8
z-#>m`-v916|FVx~PuyYVF}h}KTE+i*kAaBe^j(LIub&m^XuBu0r+52|Y5)7ngcnE3
zZx2)p7FhG@W$mxv&9e?StUH=;L-D$;^p}ROwUs;@{&Xdq|J=7GetUHmQ{jwkt~{{|
z9!Z63-lw$ahD3Zx&COZSe4W+yyZ<%CgzDz0c3DimtS-T#>lNEB$ht@71|9n)60j#p
zN~bE}N6(F^ISm^%D~{$hPh3;gJl%M;$ioRzotIX|Y&5<rykW<=SB;aiyx(4w*y?V*
z&qP&5Q0C=?$_4hnUPt#=>AHU@%)fl`x~X(!%+Zb0ziX%|m*&bzFsIMxeAiwTp|2@7
z`6qL=<=H~1T#>I{H{Sl<E_6q$Q!pcJ>DuyN_P$}UmQ(7)0{5@=U93>OZ}~Edy_u=P
zJ2EET_A^^*Jj3GSljX(wQ4Y`htnAtDs4~8Nvg7T<$8qnr2%maB@u17|^65!?JlEg2
zUh_QZ+WW(sbBnF6uDktgN$#f2XD7Z`R;E!a9k^}}_ut()ottNuDX#hOeV5rq-m-~J
zvRhtut~)Emd3)`z>Hzsm*WxPnF+{A0&EY$~%<7Eat~)L!T4Hm5UwqH`>w=o*vt43|
zMzZT_GFBc?v57XV%nLeiz9`h#c1G+$W#{vI9LyHQ-_ug|S$egxPw-aT>AuB*{BmYD
zZmLYb?J#j$BTMP*)ab03OOj5Tm+UyIQ_t4@En!m5@1Pf{Qxr@lI#d)j`s`9a`fvTF
zNek|Mp4+cnx+Ejl^n*i=*~dpW7aTw2=RE(&FLnNqN$qd89yzzV?+|mSedb{|<4Nrg
z3g49U*TsHJxe#;bs(#O#%FVL(OZL=OEONemZnnvevI8@2zB2XycUgDe{#5Vx`Iin^
zzo=JpKfe6x`ps)&<D}MTIn6d%<=kv_SN-Lu6or_5eUjFDr=(uKn(02#sPpK7**@VH
z?%vv|sjlNYT`|sMVOPz>B7>^FXPYu@bZj=TgiZYRt()0b{Hwvu>z7YnF?h9<XUF35
z>R-3=U%!19F!SBkkB17w^A5AEHE@`4Lt6Swj-A1e^9j!?x9xlUpzx5RqSxlDTm}rS
zlIE#g_cCt07A`w_{Od_>@iP}~)Aw)-{pvlr|DfY{{>uBTx5cMTa5jBq^7pmO`pwt+
zezS@SbzIBZ9&fED=&`<ByIm`BSFL;Z_V-FX>;Anzebo8QyLG#d&0KeOLGI0Yx3%+c
zI2henwzxfK<<u<?9!Q;7(l%$4*!m@_&D2)pSglj{)2iV$dg*>8I8jj1$CHQOdi&C9
z|N4{8QyX-*T1#c@*<)8+a%4);2Tp^qeeXO)^IF#JaC^ci-FRr@aen1X8qaMkW%>8+
zIrQ>DkjwF61J?+K$O}tZZZol_ojhFS#`~%@=bCh^sm`4=?Khq8`_^Z@uarD_P-sD^
zp6&JI1vjF+Z@x0S+j`eb>$j!eddGFTTXs(u{<AIl_Pf_5ZQHr>?5`~LmKWk&$b9T_
z`{M<F+6q_}%~m-keQ0jy60Wzc4{Z0w?>)aao9VVs;tm&cR<W%y54JMae)%2VmT#1h
zo|vb6AgKS{e&w#WuURMDPDnezx<%i9;nx4pmR?qVuv+c=DtG<=AM!6p{uc-|^>jUa
zhTq{aSJPEbKCA7!dM~Sf6<PH;YMbj@-G_g_SKQ8C^?!c;SH4-<xu<iiS7{oq=!vp=
z``+N<{%>E_S^u`1x38`2&i*NGLd;nv+hSL4e3<s*>f2qvrQTfTIU{@jXrILl@8mC`
z&*g)R^7s|{!tW(pi+?;6XMWY|aP4)DI@#i_Wwp9oj^U+xY_>7Qx-MTXYs6Xb+Q0BF
zYVM0qFg822rG6%Z;q{ZfM)@LJlWwjqdG;tS#oFI1^0EAV20OvMHT8#-pXTJ$90@L-
z+&NEf)AlP;J!(P8jl6T7Ewa1Iyd?3(kzWlfEHAL%m2G&}xbOL=1!5`kv!3_=_@MTF
zQMKwi>+nnaX6WVLIx%<i8}Z{Gm+N>P@7j6R^#%WA@vLyhwx35$cRv%I_T-&S&hOsu
zyM3Ny?$12^w&&YPgYVzp9bPnPi`fKi3qJ3ATjNZ<Lb~&^qdH8U-k7y1IIF;S%e1A2
z{2|B8ip(E<m9?30<JgtmEv!M6A*CMez2OTwT(a~#Wfr+z-_3N#T!2&OgOF!df7>Fq
z*n9ItHftR-dUifhVSA$xo7B!aDc-vo>z^&tTw~^`JoigUyNm?qoC{`K<YzqbGGhAl
z|G?4N{OQkkS#q6Y+;PRkblGgCcSmL>J00VnvtDy~>i<2rG7sl?UViMat@|b2Y8l_X
zB|G?1u4J0-IetgMXMfC71-U(&uD5@+<v1<aK6}=y1Hls}qF)wq{zVDbD`f@-?o}8A
zo<*tUMVTew^TyxWW*0wpE4u$xTOfB8LzU*cb@oeyLSIzu-MugPT)*!6n&~2kn-qnn
zY+z!PV))wO_22gIjPE=SUe|uT>5lx?#gbOFtGWt=)8@I#-`oFp{o?#C*SM`eFP=17
zzbh&9$=Sj$Rg-n~J}o}4uFpTuHUHJw+~7I!B^RIT$N%*%sha41|5<LV>*+sQ`mfJQ
zy>gA6x0ZjwhnKDw-C|>>3;wyg?Wa(k%j-2-X19%Af6`dJ=+Cl@-HWWm1I}%8-N_QM
zdXd(yMeEeq&oi70oT58DP;70Nk-I?TmDID9_b#qhi@zRjxi@=pXz=>C*S}1v-@d3O
zP_guXp+oEClC5vI`OaGwxbfZ<U-pR5(&>q>-!e|0nUbr1e_lvz@b=j?jjRvc@8!&r
z`6ufh|F`1P+1p>feC4mNDxX#N_i=f?pZ~u9?+#m3-7U+1mF4-Rra5MjyL$frDdClq
zOG^*$=hV!)R`+qA<_6JYDZMdDYQ8VBBj<P?>1cePC-##qv1hT_`)#wotU9||+p$$=
zr{3$&g)Ha0m#y1y_{ZO@Xx$B)qaxq!I%&3c#qN74zO&6gUCpeW=`6i|w%YE$>*AjM
z_*&Dw;mG=Jy63e2{&r>$ne+Mk`USl<tA8BdZFD>+Qu)9fouBWocko<LTy=ll`By^w
z<vCdFws|Dq?OSNyc<pxBz887s8h(+|bLC`2R=+4I`gQ;P{iXT;{=7RI@3-&w<&Tam
z@?w*p&FPqA;>mSSc<JL8=PP&q+?97Nvi(i?)tIoFsaq`*%Qk3i-qu@pV*PBUtQG4#
z-prFU<dW9tPJXg`*XjPnue<j+DXL##m2<ewCc(;)mKuFo;Dz2NQ$B_t(z>rq_qcU1
zER8iex~zHL>P7YczTIV?uv`A#o`|&AZ;SSxIQ_{(JTG46zz3&{m022zU46D<YgB$7
zKXBYUGBPba)o%9ISmW{^#`3Q2@eGEcdMBMZgg4JrvCDc~C?YSr_3O6CC#M%R&c6`<
zQ-q<f@JjmaO|y>)SL`{r`;AuiGDCq+-=45nFqPyi`}lj!ZU;Vt4vvHa9&2Xb_Oy}8
z_`d$myU=@cuIBRD8wst;yyJA&=Itz9yD1zsynoK6How<eVks25xaxN9wz~<*@+=dl
zAAP2gKWkSeXBqdDhnv~A{$tc~;bHl;jrHiRo~##pjVIVl5N&kdZJQi&D<ey3>3sD&
zc1F^baV4pCy-SxY(r65e<FfIb!eJliu+M$pbMv1`x1U}x*vexyFI4y6i*vg}dU{tj
z3NJi#fAS1d!%quz9JbtksneGAF-GW5?p~d+?Ov_N+jy3l>|6Hg`-#jg{x`Oz>tuTE
zD=9w_-gNWJ<foiFdls)bwVqWgkm=Pov5O1E+iytiw-k}J>MCDYqGILng>8y3znHk`
znLTf}2*yr|d$#?pPf@ns{=$zx-+bQb$XCwkm1(o=+iyFcr<x5Du5g~Rx~8{(j>FZ=
zJ6FnYO3lhzG<kbj^X>yzr04u!;Mi=uS>jYezghO5aOLCYd*pv;?SDB-M|HNtp7MDj
zS68vEyxknXzOy9y8~euet1W9oK5UqKY<?!^<M5`3`Zr20Cco6LXMX&U`R|TB_bjLA
ztrx6$(<37==k>10SCJ{-1%h(lUgYg-;F580C`}YPuXv2_^H%=ZQ#Ww%q<C$R6>b$2
z^N?J~nKZq}t$KkXFYm056LzY0?;MszXzj~>7^fK^<TXX-z%g5A@9*1oA2=!Ne*NLH
zmG(`uEM?wixPINB?(u#z(-hk+t9MCX`5YRS$D3JonoDVwdCuua!2wd%PrWpzDF>dv
zboIlz%U3;iE%4A<>T&(9Vzt!5cJBEZI#YXXeYnay9x^0NGFcz~Z_@p~o#F{%VzOIS
ztPU;Qm%4@}zC`}7`i!h6yY>ha>)6JxnQmR}Ic0kl`>U7tDvv)o5aQLFlCjFzDQnaH
zi{?_i?W`F!+KV`=yuaDLs(QItvaM-Lcm2IXZ+5Y$Z9P8e=!3e2%cn2%oIQQDVOOy>
zPs*PM&Qhlju>UDexDwr9x$4#09<TUG_b07!d&L=cpnZ1D%o??Q3YH0p^~>r$Cm26?
zz%Fq9;4%HrT86KC7wIp%_&m%rK};c2Y}Vdc(W(V6;<-2-onr;f8E3{d@3Q)KM6^VR
zq4m?|>BU>N7O<Hv%NH_TKS`!J=Ht{g8uFWK<YXsq?CYykwmQbF(l(djizU-9ZI0VP
zdkq>C3Lo4yTl35&fHiX!hfMYonTn^EwYoe_7}cg-lXHE++>pjl&Zp5;b#Reo#Ff7e
zv(_*izE^&`z{0(~{Cj)H>0J!{Vk$Bl)}Qyds(7^g`^N=coV98;r-X!Bud4WJZ<utc
z#DvSRSK`{Dr}IO*Z6<!1bX#P?bjKpURobs?H61-}x$t_ce0pbRb-QfEne|<&HoMN<
zVxOEbk=<95>E_j7m7cNyz0{oLG98LpMV+hrl(+ELJlMpjX&t1o^P2J#7o%zJ(;mDj
z{IZX2qT+qQ`P&yXepYDT_(fkt*>&Tib-rbj%Wp613bWpN|6pUV>mK_B3mk6+$*3_l
z^#wkie13hh@foYYKzl!ph$#zhxBlNh<-h8WbeC5JOVT>?FWMfQ;PqZ4Fwy(s%O};3
z>@?IQ8ys~Tl9GD3r5wG30`@UX{I~Ra@JHMIejm#h&3vBCw^{6;<%hTllhq0W^8=$r
zyk2j=&3mk`;eEux;J*#q6wh&eu+U;kzL&lIf#07=61&dr?yg!{vC<=E%36caWqjx7
zx!!M<OFzE<z>d7&n8qbSCc3hJlNsxr*B4xP6k*zN*y*cor|r4>KZ9mDIp)NgF<#<#
zo3gaf?D{h18Ba84KR*)1yh!6s!IcXRQXE!~kDQQIDB(3(*zwS*@8xgjlLs%nWogS|
zEe;ggzc64cN1ygvWhbr>k+ug$ihI2)vgUd(oT#tF<B@AIVTnNM`Y*x{wHAH#@6Ve&
z|GD{mzF4OIsq)?H7T&Wf@m+N6&<jry*&dMsE&*mnCT)J+wYDOR8H(?gEco^$JUHOx
zx;L*Q_Fwt)Ms~+9`NY0LDbF4I-TK2>i>AC@_WWB*(BU;-trK=GI2@t)a<<LP%5>B7
z$NUf5E{>dCtDaxaf2MlPo==l58!Vn5;<eLp_R;$Z8n5NsP8z@c`E2R?V*!SV^KLV+
zbT9bp*>&T|9-9*ph3qRnWo&SYes<__f%>tJC)U{pItCrFypv&gX`8g7LHX}s-6pk5
zc75rFK8!g@tJ6PM1eE-lR;pfO^!iM8$jnTQen#V7gR`r}#Ls9h5;1A|BWIoyaa3>l
z>)l`7Bp)q{^_{e*eP!O%*+1@be`po_k=p(G4fl3tG4Y>|jC5~_*gRU}BN6?~{+H#7
zZ29z>OI`Qmd?)u#Yzk(#kG^PUd->e8$qI%k`@ijytG&x6YG8Hk_|HI-xo+!g)*szE
zd2ZI`>GuqZeO}4_x-Rl+d4Wt_<F4>Iv)#{oZvL8RdFy^;MTcLg*UiBABNq-NTys7Z
zR%2VY!TQQPXKx;>1>U^oI-+gXZW9w{8NHBkH(|<jJief{#@sMqh1$V2H4|O7*neA~
zJ7c-DM_1vOjrvoL*;d@L2n?(D_*+$bXp4R@OV;@<WgUtaOz$0VEvfBmYvKu8edBOz
zb8*DWSy$zrBpAu(a0=de625JdTp2sBtkoSR(Jj#%N;W+|mbv<^^xfn8w_V+~{ON~~
zdpCuB=6zEMwv<dtoIHWWhiCT6&7VH5e17xzgWFGpvmCjm9;;7rox+w;@rP&oX?eTK
z-_}#^xc|zW?-3_C+dk#%$&}E_qt~?TJ#Na1ehvHGf0Vmw<@LY)i(58vM#`lXp7wO~
zc361&@y>}tLfIZCH${{@e(`SJ>yJ6r=Ur39+OE#?a@#n2@hLa%qebqGwI82tQS(ZD
zG)M7kud2&(lbIJppEZB!Jfqod_w~)h6Xx9^54z(mQ@xjLh_rW6RJPRq(y{u-my<r)
z8FIQj8I|vnH7EU1=~`iOM=7mnu2%Z8tBjuMrR9ueXCfz?vM!$x$@-{YQcdVs%%f=<
z`%g%1s=cHBx@zZBFPl%Hf}VH&9^7ll)3Zmd*d(Xuj70pMTe9J4SAUvWyIU=pm?UtD
z+2qeUrjT_Zwmqz~^k3`6UcJpV;r#7w;`@A5Uo;+i@@)^x^fjrGMr*Z&E0dyMi`>vW
zHAQ#+yt~Vs8o!vFKRV0zT5L;Zu#CP5pH071>$&Z&vvSRBbEmkL&Wsb^#k#((u35@B
z_FmY{UDJb)Rxt}*{w@?+AIZ1hx6*}W#S~UHiH({%nj5Vgo;2RHeUSZbpWHE*pI5|L
zx?8t6E|q6n=4~kS*X5V)i^O#GkKb>(YPHUN_OP%-?|aUL{2t?Q*RO`nj(yz@n#&91
zFURoeXFe;LE66I;9P?>+?2-$=eHR4W51Zn0HLbLK-S^2cjky=DPEohpY`#!s@x5G)
zM^pE9s!E=9=leG+V2Q*3P2CqSWh*ADZR7T4-F2(Pz1l0GVafZgbLMQ_B_rUvicyI9
zv&U?!^>6<;+RlwC{joAQL{n+ChW%C7_jm8bUVT~QT^LZk)sp%2?{D>=r?7QMZ(6+6
z<A;4`e6XQU@S>(E-Q_vDVb|WWuz!1!9NRHtuA=s_z6G4Comm>ZXDz<CB3wY7$x_*E
zp<$PS`y1PScWGh%9;vO7(-ZTS-)L`0VvsnJ=GD#of4$8d(LYCX!`?ROhaRYT;&OL`
z@DYjQf84il9uYV`|7g%32aV%`vqH;4&b>VG?}+f`&F|m&3T%p;IU_|}p2>7_=yS6R
z`+|(sIxjtMkUQJK`_A(6nhJ}~oGaNZdAB`p>%Pu4SKK=*f$b&B>g}Dpc`_g0?Roh;
z?f8K;4y%^%O9vlslabLC+o9LrZT#hlnf~ctR-L`2zy4}9bxuBVOiiZsg=?7Z=|9sI
zvv)^rnUefo!TZQD8JQO|*u0wOy60>;#g)D@jg?1qmir0Q{{_rRR(rfMzgoQ5(qCzH
zFf+{hzuqHV^*QJM^jtqAkZ3D$wCzknj#%_Dukxch&ld7K89K*j)!i3gzVzGN9ZL=d
z=`C>Hx~THNjRiC0`_BC1TBI3fb7Z$Hx6Gm`JLfgdFL2X3DR$bgrfQ<O<x`$@j9-(2
zSH-Ro{P{{|lkuehiE8`1fu&CR=kG4_T={9A-YcHfvR5@{JZajNQ}XGWZbPi-fg?GO
zZQtj-nRQ#k`aFX*Q|qNYYrE!e-?=|ML#Ea(X-SFW0#>brUdR1CmZz?qPQNHE!jh#Q
zTphmk>7}{ld2aKC`WG}vJLI&@UOmHBG>xbHo!4CP>xSkh*_ys7{hs(nah8j#57+T)
z>L21Bc0N}5&J&)N#?M|5=}>&&>hXZ97jte2irw<HzY%@-=V|xEwW+%r{;uNw(kP|U
z{MyTP{WtS~dpEqig3~p%bgs|V)Kzev`ImKGV%M^HafeLb_^Um=z#BG2<%aN`M7wpX
zg}xsQnW8p##n!bGS0Ah1-Px1oUlqz<lbP4%S(cj}Bt2=7oW1Mq)z`GXUw3VGG@N+2
z!<P3~WXj^zNpJQo*;9M;<Fp=)<)7Zjy0<IMY1ikQdps@U0%yp#A0g#($;{_&<%r(D
zd&ggW{!tUJ{3B_TW^z3}cl4b7?%7*Z-`qH|jemMZT+f+_MOtRhSMwg^<35_kRQx&e
zi@!px#39~UM;V{p-nv}o9q+Wu(R#LyiQGO{qZS0pPkQIdyQrOQzmBFth0uqa>E$~X
z6<J#Kt*iKdNn)SE<&D2sR$UY;+u8WC?$7^y-}a{M-+sUQnv;-w94m+Y>SH(bRlWG7
zd+fueht|eQM(c0&W!vE9pK7oBip!>dt)b^bb{<Q4Ta_9u!9}&2!nZUhmll1M|6X^a
z&Ct@a?{M?-$~Okn>z^b`eMsThBpQ2b>g~3_v-<4}&A-X6f3dN_i&^CT^6~@Szi&wF
ztIk|;aHfmdTYm+nn2dWD4o>|ZGh>_X?A=RrzX|nbExHiL_;$jzcb^k$I&S($NbF_)
z!RPO$?BAZ{5%k0PwZb-?7PrRk4a_y+-)CE<+X^Y{V%llNt7KVxYtHQAQ`cR$ZZYqj
zd~-=z-|9t&W^Ib$Z<yCMk9|f**aWUq(JFS`*WTtz&rN;HS}|q2!6&mFoi=rXp9Q@|
z)O-A_KAbrv<ezKR{!w)QgX;mO7~5{&3J5hlz2~6Nbjuqq(J@+GKR9N+*|RG8gZQyW
z7ScR>UF`Q(d=&1<W1n_ZynyBQTc+B>JW&EKVy>T6HEZW<cWl4ou-5Tl^?`PS4E1$g
zdzp=nxm^CcBxAa3cj868oxw>}@*B)$)nz|Uc2A3NTK?_G`t7;x=?o21Tcnrp#~+BF
z^7ilzNx_c~<NV&qZOY{E%a^(0y~%WmSLB{m3`+~!TfE(Ny}jx1{L`$5>aK52yzM;4
zn<FK1z`9`hgX%ZZ_xlg;yslgD(QMA?c**jKbKPH>GoSMFt6IIl%J9+5e|k3?icJHe
zl(OZ&m>QYf%A6dko9Cr!bE7KqQ>6NAA!VC6>DQ{Fau!|Rrhl`%c&*;@B}Th_TD^`h
z;an<{Xi<5=#$9tk4b$;AiwsPn&$|7QvA4Yz!=I&SA9`q-^)=nAxeD3p6Lz^T`MP9P
z)rEzxRBG%Pc)7Pv-1jB#r{jgjIl<GNjiM_IK3{Qb>v)~)K128DJfDx!npG8#CU-8I
zxk6m+`r{p|vTrvn@x5|tlHFz1eY@++%H>bj-kI09Nc3F9cF`?CF9a;DV%ZL#vUo6U
ztEEX#anz2|+?br}FPWZA_$;&c|McpedY4w*IbD3w?a~Jqt!>d=!NuDSbu7NMf0Od%
z<+?6P)BKNZe!(uA;CSiflmiT#56cvZoNy?K)30b+EC0YNW=le-Y2~&(y%M)m-vs9d
z?pr)}JIB%341r$D5Vj~LnV44@D{lOYyLr68zDj8)@8y$8^<~y3wI_DlP1<F(O`Ofu
z?4^c6g5seM6Qoq%zj?Q+)@$El=@`aMY}&^SV}H$anpd@fe^tW7^%s9!**RH$zKtN?
zg)**lM{d;LU%dUU-sIDp8||!5i{BJG|6z%6@~&NC&y(&|xL59+|KY=Pzlyy#r`%!p
z(sDl7J0-Yw$&3~a{w}j)-@YySV>*}PmB-SI8`C0=PBz%s^|LBDP~h>uhZ>*!zB|np
zd8F`2;|jm)-CJg#G~T#!{Bkr|uvp8#pin$+{uI4?8;h2jZJsed{o?(M?YAP;rsW)I
z+7`VoJ!bW?E9>l+^Iqm-IQ)F-R=<$&@E1HBwYRxcvL-Uh^GkjC{p3x2-yVbP^#}E5
z-&(xk?&;~1g*IQiVDKz|+Va#1|6RXK;=8PT{>+&J8$VxT%CzuHl9rkvn!Y7jaBITK
z=?A~C`RqLJ^ejB!Tx)IHrp@2^{~q1u-M!Q)>>uCStELqu;j^W4*~2-$uP`^B^=Vti
ztF5OGZdhV-^$NdtRHjySi)v_AgK&R{ZjbV71xMNblC3R<9!FQz#s4{UEUu*E49kNU
zjaQQ&Oqww9+dk{Io$RIkeMz(4IhM^l{dtPvi+1%xQ>XB(>zj4YjQ5xS9Iy4OK9yNt
zs0}gCoZadt(X{`Zz`|WSWE6q~Hg6XD&$nE~Xr=MYBk$9uGCWWHx`?%*!@1zQ(nm)z
z);TLvHEhHxc5a)wAu@&6YH1yNNrh*iK+m^8Ic~Z89?z>D>sQ8=&fOk*=i|ojek&&Z
zPQ3j@=GBs9(~nzTA9^paT$wGSWM{8R#-hVYGUt>OE>5=A%UF5w#qZe@H!G~>iVA!$
zzk89+uISfGLUK$N+io&?=ze8t`_Je`FR#lit^H4fbri}NcRx4#^v78GjNXlzQ3?w_
zbnV-{(Kh3GTT$+z?@V8$o?S@%s#YmE!9)7{!j4{tJ4Y+cJ(RbY^O!OOcr19kq@=X#
zAhU6Jb$Wu|J2|dpQ!DJcgkqgv{Cd1G@8n;h&vR}yHmvKI5#;#(fWgm7vCcWa?u4yg
zBkdKgsvv(z(Oi9b{)D2f(sl+pPSJZ={drIRu-MRS(4jxePF_7J`?mnQ!OSMd;te<W
zj$Pj|Rc-w==gy@vGqRpOS@T1n=fFA_)yC&_=hPjiO#V<gxmhu~;-c6Fp#x=8UOPBV
zwQ_H0mAY*%bhvN9geeS0GiT3u%q)EFl-9n-C7Kg&)z_cd@4aBbs`rl@wqIKKm2d8Y
zcjDV0RHW4kGO1LHs2;h|>8IOc6Ipq-_2`oCzYb@rJagUG*!IX_-7S8-o=56aqNd%r
z-jgv^>RR33)22T@imcinvq?D1WBCfDg==@H@%$FxJDM|n_5Czn>xnET*-NW;l-yh@
zC6+f~?dhBEZ){!iBsj;}(Q(4tipgJ_YYhIpdDy;k-mAG)v$k#z`j>7ce<&*Bbp9q+
z_49kv{0_}#s@Q)rV0E;>l+VZI;xF{nbofnwD!=MFYrOoz+pcH(t#%5X{d@4ykBKwa
zJ${iq|L&UaV)8Aed)D4?HoScK*|k^FulS}0=q(F>rzPLL>)o+OOJzEDt!DD#+0jsX
z=y%+c<90riLUwG9xV`#R_o@AwhyU^%)$6^=acg7t$rW5`-k}epWq(LsTHM6m#$(7W
zzsP&8nLxvO|BsJfh2&+m`|&z_*Sr(F{n2uLqZ_wdWmxZ2+nKeTpEK?3apujN*Z*~O
zF*IagN$&dX%krc0Ov-`St;t3Q&hHa$a%f?@@2tl9=Zh~7N6z}rgSHC~oRqeFAN2CF
zT(k*)HE;F{M!RR6XSKi2Sef9r^l{gW>$iTK<53TOH1FQ*@{&jK4qSFQpIkTYa&7!~
zvf-PscEH1#!7ffJM}xiG_uXrduaAofeE#`7!v}>~g7ViU=!z|vZ<T18e)q^~`4k4>
zW!22r_Z_HcazCkhyw%gDS1wWi#xBWY7ZawxvJs#3#5<Y0v9mHl^0eH`%))01uerCr
zSjHc_*Yah{jn<dbuIIXnOTN;c%)iINyie@Gq=xdV(|r^tytUr^sq}||Z}+yiZu@x;
zC8xieI9*Yvsxo!GxQ2i7`EP6YNu6~z+xjO$xu1U%r|97aO&7m4f90$DRnpISL%i$5
ziNI}ZnxE7i7nWo)*kRqiO!#@quHz3yO9a}K!o$j*%3Z82X3?1KmKL+=)32qTQ-8M<
zaPStguS^e|$(3-vqVMS4{pmi(5C1inyIuJ4uJ*CdeqZn9tDKw6ulU7%O}m}-W5fFC
z8%{iaEPH;@<f$DxGqiZqHA?(Gz5W#D^X_!vmNkW<oa%;WY8X>W9~`_HsF1q7pie_^
z<;Uw4dmP%oo5WwgT_jm(c6QUfMe9$=M5NRRZ$8YH%vSrM%CfGmaLqAG#W&`Hn{O`M
zo;uh5k=e!frg_FIX4NNeoc(WySG-5^gkAQBr2ZEq_TH<RVk^WHGX1s8JC8W`E&fS;
z6L)E<Yo6O&5!AdlVp)2{C60F&XK%T^c}Zuw`$d`Hi$Oc}FZjP)$d__YBxA9c#`%R|
zb(4>0y}h+-dZdr{s|4P2$NN9J@Ko=XS#2i2<;t{ePNK=jPt08yBYADTl4071FM8Ln
z{Os!EI@B`t!K}>-9i2WhqzZqte)O&(ZAEXJRG;09UjA0W4R^G%?HDH|SbMH`CgA^O
z2g}=BUWRGrw~iXIBnnLQU{ZZ_Y<J*<_}tYTTZ|axJ9;LWa?f4q<Q^dN%HVw6Hr=0l
zBWsPNJosO|j@TU;++=gV@#)O=MdH(It1`tJXR8Z{#JB!1O1@;EVjS|WGsSJCU3{9)
zBW4bk)MLT-`URDugW1=8d)F!Zjmd<qjrFvkezA_<Cf2sB$@iL#e(!$L82YzZZ~o~(
z1%^J|5BxLV+NOKX-I1xfcUR}BZ&q#ldBYfAZryOUj4jNyX?a7?kr2D$u)wOG$lDx=
z&et|O{aUQqXSrI+yf^ai1%uS@FFFt0yPW=Lg6*vWg<u8U_Cvy_@7EX2h<qe(?vpj`
z&8Ka_(LJ^mH90pn%E{LJTNv*rU#ll6t&y_n`HjODwd&vZJM2vl<yGknbNqfrJ7`VG
zC;kUt3RGfjul&6xuNB>qt9E(CnQQ5%c^2F+IW9Qwc*FgSqkQ`>IPyMso!)aKFT94$
z*`$1XMcPxgKTU6=bOg9oe0XdztMk|-*4wJwcIhdX^1K*i)HhFe|8G`r*Y(n_>bZ{Q
zmi?U^w*=FjeA9N^PIu~_<@rZR&h>xawZCU?IH^uNCa_nrTcbT(#C-WLrcUu4O;01<
z6~*hExYld7f-8B`*Xc2NI-F%9YcCize~{zxKKAw}<HrK6A0@>(pY(SMPWQ1W?o74u
zm^J^j*qPw0Ol6OP-5d&XlU=V?Kd*VOTABaqtCVd0#$#QNiaQqY^)~bs{lD?v_-|S1
zuP^h?p1do^eNiX=^gqXYa~0=b{`>HFb^P(XT<vt7pGvEaxCO0guV%Md&1B4c$mSwD
zf1r|G-eeK$<x$^vM9)kNp2k^V^m-TDQ}t(+M$cNyJ|A7A*L?nIj<mF$i^98yvT+|@
zN|pIcPB{H-h3AyxuUq=$9E0ssZa=wyF-Tv~sX5svN%CrFOU+|m-_o72;cK)qqi;;|
z{~c)hF+gtai~8fs?iRM}IdjFbDarrcUxkOC1<pMG>u_*UDWlaFRz<DYrSo^b(%Lyu
zZPkVk4(Y4aRV){8d~#gGxWbL!Mb<f=@y^t{`ETb7zH74iAvrxl`W~PE#{~5dKKu4{
zotJ-DO6z{g&RlS0+oppz6VwXRox@7h<#L|v<9c7TZ1K^|cP#!dZ2xn}oD0xU<KFLi
z<+FE}_+($+YaMfh{v@%5Zeq({G*{uenO|=mb8ph)<7{=O_VY+&%Emb;M)QdX2rX=2
z?b7fxykVWP^Q4{o#KU2_KYuPeH*KPY#+_{!GPYi{`r@|!F!zMG1_=YDyfYg`96#)~
z-tl4YqT1Zx<jqlG@9uH0m{t6yH8dh(zH7dPsMoUPf?X};?!P}|T>EDJsCD~4!BdRv
z4PmPf>|VWtWnP_lvQAmxW2b*6_sUi;uJ5h3Y45Fkm?1EWo#VQ3SmWnqD#BsXPo5Pi
z<hFjP+#9vEVv0q?y!6Us<&AzDIlPz|Q=6yAscvgJ%+I`uum2#wn18CWqkZ2Wql;7g
z`$FYiXYT*4t-h#MqbYq;eaQ*6g>y6y&TMbrvg1`-<h%WOo3d+e8@I4d3OID+rsTq7
z0#lAp4`|}nEzrwKuYY_Yb<V8idb!4}UBxVQWwJWGDK}MJpKRb@OZCWcS;cz3<znEM
zQ-u$`BAe3O+znHo+~rhB=V;bDvetXG%yX8&O#k~8x67-}YQ-;-SeG+*LW}!KHP(rN
z{gU<R9JTRNx8Jd>&<a}pe!Frb-`qvMyzSdrBezLO&wt1A>gdZuH8VQ81LY6#3h_9f
zdDm0ftD2&-T;FP|qfba$ao<nTxHtFWe|#veZIqI_cXk1P#o<3&o^Ros81Y5x#`zyi
z#ts>g6LeG?Hm^3d618_q`oDZp{qB9AUx(gq-sL9H$=!e9h@q#+DTyf##~y`W{I=21
z{k`dHEltHat(<1h>Nwu|n_u;GF#Epg_OBDwcBYz6_h#Pe>(^aa!?wxb!yAF_u+LKr
zwS?^UIk#6_y{djrQRkndc9jw9594c}KJVk)RUUV@Lpqy-Z6Z%`566<#EAn=oGt0_L
zWP6o+=24c3%-LU7E}=%D;jWS8N~f&;W$)f5`{=WNP)GqAS5}A2G_m^Q6|z$2+(j%|
z=d<Kndv$dk4T|GrwzU@zKeDIwyYVhrPI)8!t5*#UZPIxmVz=cdtHL{D?aT4KjfW=w
zOTWluli<~Hu;l-u;OmpqE=nb&PG2y6-DipZfD?LKr<Yt_smx%=@aDh~BUkl&kJIa3
zC9PcjY|5k^jQZWS+*TQ@7BLsy{_|Y-grHO~p9_y<;l8VC+EUN&L_RyQX2$7Q?$!qf
zKbSG}$v-SDeQ$Bs=>vc8^#i{hrmxzzyX*1-{Y~0tjq5*g<t{1Skm;&$dZ!Hg?x+~i
z>8FMLj|5(QChNcvRjL<%H!Du&RC&g#2^&AUacyd_EX;S_tjEjIyJ6;<mGh+dCJPEq
zKbpdFNkjQPQ>g0;$M>NNxULr0sjPcG$NG%W@=W_#k)M1#{vO*=>G()Ne&_Ymr@kNE
z)IL@2x|8{lsN|Sy54JCsTlJ7#F7+Sxi!y$fdKSiCc^wL@LR;m8#9lw;d($hN)}pTA
z_*gXUn9kC4>CFe`8TURAyxSGl)X(>B{sqo!g(7)|>@%C0ed=y!tUMaL!qv(2%!lY1
zsXyZ^FNm{uZ&H}JZMmMQhpel@`*7R$^~+sON{T(&`r@_n-NbncFDEhQyIS1QVce?`
zzwWPil2G=xRp~D4PiixEsj+unT(_2ofkQ9u>DkEKZ%kL2^_BisMmKbc=q)#GK6v}B
z+TN_suTF93oJ`)(aJNWSVPmQ2QOlm+50||%wfW5G`=(m)?dKXDO%A=2vrksvznaCk
zXen=FYkAd*33i9ygnA2KJ|VJv=FKlLg?A5~i(EQsLPhVPy-V-R{q=;ach;ZG+2=J9
zT)lV96MefSzGv|-o_<&Ux$n2E{^@n)>kri`Pc~KV*KP_oTdzrZE$HvvEwT4CXZ)--
z=li9SJ@)MqVXPiLmC^!fiq9?_`_G8F9dZ@VuW7D~3=D^v7#O4&7?8I^CKi|I$H!;p
zWtPOp>lIX%1|G~h<RGy3eK=3WhomD_*$dfMuU!%`RmywelnuVe(iCS#mW3bO|6c8w
zn&wM6v2SN*e^0x|m#{r{54-kMg-D)5A}3ciI~B7V>rUorep#W!W{_TM_R6~0VD6ne
zPE!>3EJ$q<@t?6-uSVWtO6!Lw8o^?dVxsDeEmxjs`YaoNX%!2fyVsngNjr<u6^@7m
z7w|muP<YAHB_ox4;eK3qFZ=C?2cfIj&K-9;vhmDki?-??0uRm?q}`pP8M^fFsyVq9
zzjRxAy`*DxCSLG3E<5FvMvCU;@Va}s*P?@auR7hI5*m9?zHk144Ob&rFBqRYY!{>Z
zDC66%nx03?|5nMh&i;BX+`iR9LNDQt7gNZ>n-(wfu6>YNuKn5mx8N7)>ru;3N9pdb
zy0~lIO{-iB$Nvv`m;dHfe&JSI`Mss)>K>NsmsT%cBNhFz8*MMDLj#-OR9*&#m5vMy
zvY3INnOBlpR8W)(S)p}TIyV2d#izUbo7(Me98+^Dmw%_|z<*-d&D%-0mu1|!BU{tx
z;JxLn+p;|>Q?I=Ey8k|pr{@wE>&`o|GUptEyPxr-w;3P)xgc)BYyS2BD}PN(_t7Z(
zrIzmWSvCDr&z$_sZE4HxRrTHVPq^;9>$xu~`_tvq^8dZkvfb_(hH_2XTpc#$Htzw!
zvoF$ECZ}hw^9T!It@mE2Dc+UQ5D{?Hc+(n}WtEy42fy}l94ne894i#b>2$QOVByR=
zUTpP@;hKpT<gHnC*cRwax)?M~deXAfUg49LYCfEut7+=c5fmKb((9JDCgiL6*6e++
z?oR6#UD$QTO)PTK6%Vs$Ez!y9Da}1%H5ca|IAS|}slzqtg#Lgfo99_c3jUDj+?$ym
zqieU>Xa0=)dmheb+#t7yUGwSlqR@w0r~3ZsNbdc8qHg_+q66Xzsd`#sJo}z?>2W0-
zuz8x}x!P&DP=?04$g1OI>Wedb-c5Lxt?THtf0}Dt@-Io1^D92IPxv7^`QL?|Q%aum
z?|C+J-Td37b0-`&&91vY-E#HD!oBwl&KlSAgnf{k`bb-_X`#yP<)@n-o)4)Cm_B>$
zH@W*y-hMClS?~S+XYI?xe*qy{+aC3JUesa8`J_5ib#r~~4j=uxy?cJVJ^OqA{F#;0
z{#LKsp(p+B{M3CLmG8~DajoLiru1d&Yp!2?)U4CHO3=A$NA-fDrFSmd@=kCmKf)1F
zacDzSd$Hw<5{rM{oLsZk>T^Z?d}RJ9*3I4Z+`bm)aHE=ejZyIo{)Qj?-#dH{wPs7&
ze(t&HjH9em&)mAHl2;eJTQQnp#lw43Z{B?>J}p#=_eEvF^%v!vw$~^+^3LPj#TND1
zae?^MOHb3-cAuJe^7(Nu8`(F1zP|qQ>(%As-QJ(N_Q=%ksVOflzS;N3LTah;4|$Wi
z?WyJ=e#c(s*vKw5pL<YRVofK*((ht(Oa3f~mfIt~qf&2&-{sDvqn}z<Y?>tLof`Sd
zc#+AE%uwATz1!_;Lw{{Pz;Ns1mbpCh{+ua)elqp<-xdq)(DVa`uU?aj{T%senzn7e
z@3(JaGiu_yW~KaDk;Sd!J9*ldX)k8Q&0nHd*|sUOn@?hWZClgTS?eF9-g@74;9<Ik
z;u;2hgZ;dM7mnph_Fd3F-z$=p-`P|1SB#k{KCq-A?c~lIM-^09*dBOXD%-hyeVbyF
z*Q#7U)7dq$)}1})Z^d8U<I{N7bdK*@<&K(TQZmOC4zLQ}ta5&OS0RI=(nPnb<gCV=
zidPyk(pr5@?3$Mr3q-iu@*T|!E-0L%BRTJ?GiRei$;t4kCV>wNCSJ*i*!6@}x+UqP
z>%1nf^(uFHrnrZNSUR&ah6Q?^YkMhv_H#+-6z-@cTlx(8U0Y`Vk==0B?!)iIQ#YqM
z&QRQxyd+flH(!iX(83p4GuYP7NLX;<seyMw5MN6RkM7x1ygwG#%-|4ZnRa+jVYMC~
zQ+`>!dB6iJ-Log{IsO!%bltVI%GM`z&w-Q~`wb@kQMmBiXX&hUY|=iCM^`bK${(vZ
zr{Ka8Uj5|V!sT)rKh-!TmTgfJXUI=f`jx2R<5wWkm7E|hs$X=0!AGEN?sPRnOEzY!
zxylEWH+FaL=5KC1>YQ|j{r%rp5iC<JX0fePaNFRzVBrV%we?pX&3|dIgI$Z&$LiQE
zv(z}=l%E~JNsN={ER+{soN#Dz)2oo%%5PYgbtf_{U|s&oqPdkJdBN^U1$TH#uWmZE
zp<~W+Gk5u_B;8extG?%2WpT?+jhOAE**4?URO=6~B|X#CkBGg0@cZnPIsbTHYhB%z
zQ2a-8@6OzAexVWvt|aYRu@ljU*BzK{-5zh$d~bnIx~<NKV(vSMXA%V_oSDB>HQasU
z>d9B89=kp5--51y|2fy<r=(t7oS>$CZBoD#6Z6z5S3;iqnx(xk;Mnlv;`&1_iML*z
z65`(2(!JqKk=UDAt6N{Rq)Fa>#W}xhNz&QpyS-IXIMOGF`<>)kWhxvN`oaIS0K1`K
zBKyhsxQX%`XEtqBOyCX9nrQg>@gLO-4BdX#d)|dCGSTStkyE*zvq`32=*9Vsk%!-9
z1_qvu5zPK1Dp)&v(T_t-a+a*0*1!KDCawEl>~ZFXw!60{ZV%n2!lvGzz;D{`d->4h
zJfSI<WTYA2PYXWsnIr!3%sYwV95<Z~oxGm^B=PKK)5u`g3`NPa<tYbeYzQ@*RzB0q
zq1-Iw`lUH?X_qdhMXqMuIe+^ypBJlB)7SgVY5S$~qOI|U*VKf46BC{pt`z*i>L-2U
zs=(#t`8HwtZ;DtJp1hv$GXL+}yf?|ozce%5x|Ooz{Z0S6C3&Y-1v465-|LZcdzB-%
zvF&HW%oX{phi0U+Z1d*y^C|c%VJjjXB=LE+*<@wy)hXVgmp5&icY9_<e|)(8+0{K;
zL)$nLyn1w-+g!ufN2de|9pal6IiLHjrDx3M&|_?@>!LO+ooAQ1EK~6Nl5a*%d0P)I
z^PO^K+x*WqMrZfgWESS`E@^yLF?aWj({~pe+g(}gBK7v9*TiBTq4^f_Ov2kVPQ7{8
z`FZ-508@wgpJn)Fth?ZR`k=B#NZ@t7oYqE(y>_2eTm)_uCsdsKX?yg8(}EqWZgsND
zU;g~6^Y_cY?cc-ySIl3Q{QpdeZAtl^Ywh0W&z<4Y%Szh)>&?XVHhs%u_d3+yOL$S@
zcgG;i@XM?}4Y`}DnA&7+bf~u}+Suska#q~!o#n&ddG3Jergx{a=TBmJa$Ljat7b{j
z-(R|myl*cG+O}I*BWS<rKc4C?26F@b6GvwS`ifakn*Qt-+l1@erhhBj`OGgprOSOv
zsN5T?t*csgtbb{1EHT~3NP&ajde4?5^#^x8Fsx5Bl<}#Q>lFSiyP=YQ&9dbD?YZ(F
z*=rj<xBS(8d?WMyyqUhg_rA~jZMQ|Jd{IrqgPV6B89ui>E$bxAth{j9MyZ?Sx82uG
z{F<Y`>geAiC)-ZHU3qJ--lO^&>0<)FnO+=CNV9uyr6bL{xM1=0)Lk9L9=j{rf{v>C
zgxbCku#P!V&mprU_ixUD?>pnH#H03q^|yO2D_&r*oFjVOkB_#3zZ4(0@>wn}>)olJ
z_&83${=rKt{cfL>rAPLKMxBzmys2aP@|cbH?k+$1V~@s!W9$q$b9HZqaK$jqcqioi
zJ$L1fsrA;XoocexmzE!sUX?l7^m@Y$Kl^GcEeC<Gvm=Z1)eH`Qu<})rvdj47-+l4S
zm5K@9xR3E}+!6HTW5cC5_A0iy_m!vIaaUd9VyN`ibkTo7DMgPCp_h8oY$u<p*s?qS
z?b5xIMKxmH&kH*epS`ntPR=~7=VsTo%(~hcd{bO!Qc1pg+mADi7Z^Y2TezjU_iatB
zSfI=Q>551d&)FKu)gN6fp2U8eCFLw|SY=J$e*asyTkl>vrKo83!PC6!do@>IVg*nC
zZTG(SW@4NwW)^X`#aHuo9Q-HmY>@D3)4C~J=hPfi=Ki9;c;DJ<2icn5Ybsnbw|}K@
zM(*Pa;|7`JUk2*_-J9+>8LU71bo;-#raV5gPG^~keO&gSbe+M~-+Le3jIBN7-{ODa
zb2!tNy=#sgZn}Qm>FjFze@nvuEj4RD5`I>=e4@EfjEl(4cT;s6zdc*LNY%IMnQ-IL
zD@($B?~3&OeO-F7YrpX+KK6V13-|n<_Qd4F5@n(PFWE2oa7QM&`iDH+`ht08xysvj
z?k;u?0iSrj8tpqj*YcoQvyFmE`Kc?~%f886o_FTPM6pL1lYZ>^#%XJx++H}@`rB51
z>xh5RGu+;oJWJ%M{KGioOW2Owl~s;uMdDX(Me_&goprvh`fZ7TX|vlT*~4ahceu-v
zIrz1_n|DO3-R)oBSNlz&$nQ>ZkM64-)^Ds1ykxXboNj5zXR_)$uk|fkn`3^_4{TLt
z8l3moRJ41xjn+@*opJoXjRo1KKAcx>=5bngbGZ7(i7mCyKE`b>zg4f=B^&AdEx;g&
z`zwoFhvuZm*^Uz|S2MV7tlw{_B){oyk-eAjF8TFNt+r-7+56ItN@X1k6Me8)^_WeV
zNtl99gyi=*ZFl$XSpU^m^@L-$`X=@%UmBkVr+)4z+nRr|BspQGYiz*XKU!~JvooGa
z%YSa16z*(R{`t(N&exec*UeU3)GOFLbFa&)_1+2-YqNykZ29jsjdhl)fY+;&H(u}V
z%RO9R<@;yfZ1?w_Q=fUBEw=yiGH*p>R{we)4xW1gzb|XH@Vqc&YW{xpUkMX8N3Z<i
z3)Qvn{Fn1ryYyeYzVGaJ_leK57{8vL-dSn;@)A!|w@t;bABI<!224G2p)*U^$dXUt
zPfQr=oPcv*pRmMm+?;ZWE%c#om&b_>=6mi)@3=DIe6iPE-c=i2N<22SU%B(><+Lfk
zUj_v;ZhRqE?DHpK@yU<5OC=u9;s1C<PL;Rl{ncd_lJg`CHuTNO;=3Bq^(eg{{ifyq
zUhUS|msh1%?_AZXd)8NJ{*!ON!nIy9zk8?7$aWz||JFUzYo`*H-?H8Rm${pDVcFcu
zW8eDjJ?vF5Sj5hza(Mrv#&;qHuG~FEatfDBR;~UvBm8Vy$icf0<Ih_LOe;5j{xw8@
zb<w8ON~!(5sl7)Zzg!$D`Pk+|ZrSA$ja>7^@j*P&PixuuXJ3*}b~|shu+Hx8tuu|y
ztDXPu`FBsh=!-dH?y`CH8zLBmX3Xf|nR-L!i+aPVB~?~OvwT7xR=@s!{oC8Cktr6M
zRn0D$I`>Q0O(=;EG7}5l-{Jr7^2FWIYyQ<<+V|wssW|5BdCM37XF}~v&%L?z28R#>
z!yj)326?RgxuX2yg4E=a%=|pPg37x#Z~Jb0^!@*>`O3^*C0SO{_y#lIv9EeYp6ScW
z)lVi|+I*umQ6p>TooickD!)AJGk?Lp>-r9L>rHl%@<ruFlW)&9p3t`@X`_c&cgn=j
zx<mJB|9^V#zkjvYy)S=WKAmOmyme*8_Js4_U3Wh9-+yl2T-!wbTYopM&fCWP``69z
z{|DD?o3r;>?d=Vw_8)fLeZN3nx?*E-!vEj<8UDPsw`sNie@<_9<Mj(S-rim(v1*$o
z^NrQHS2u6ctNL-<%sJ51R+`~w>BVr>+daOW6I^3?-LDnwdzNjsWsS6Sn2CEB<Egy+
zg+I7=+~SM7RPN8%{o=y4^z_;5?ryZX-*foJN1ODkd@m#xxL@XLn)A<RuU2E--#fFm
zA1;hHHDB}M=2WL?sb{|2c)NO5`QJGop9PfWHh-G2S+;A%x^>Uj+&!(>)F&G+?%bH+
zU2}oqdUEJ`(<?{W<NBNnV?SH|_P%)b=I&g^zx!6N+r7y8)%x|fzjg?`pD;JbG^?h~
zskfMyNvl0(|9SJ=<%yjvfepKkrxrI<M%cg4b9=&9QEMJoe}Ahzqukw4<2Aqcu!*jc
z`j>ROsVP%Im7Di-Sj}H;^DXbbxnBS5x4oX(WKZVx12;dfliFs@cjx8%*up9O;->D4
z8j^qhEz<p8ztqH|uG+lBp#8_1V@hjYJ)HObuxjAy%~^-nZCYJlQ$KP4k8h8T#_Qkz
zQ(1WIf$;1V`5#V)UcCFE@sJNkh=Q$%ETe5mt?8C2)ApY<Pfyyor}k&r!BvfSw<_~g
zosDEpI?Bpub!OX9N1OG>Yh$M#Wr$BGoLl?(@zZks&#Rx?|M~eytN!cb+2Y~T^Y8CT
zex9Rw%y&oNx|DO1=6CV^U%m9(gJk_F+Whz5wCqzY?p!7w<$iG8?Znml!uR-}3rkNg
zTG(8%d)xhDL&N)@s`#(DDO4URyUI7sc1_ZRg%_Bvi7W_C=-kl|@tJqc!&NKWZ2YU^
z@}I3?iK*Sks2X>`#WPjwRjPf->X|Ox@-1g|G&be$Un}8bl*ux=g{k(k*_@A39TDqd
zTzEfJJxIIoepQ_Svr-iQmOBgINX^q;>;7YUsHINtt@ATq{rY(C?XKzB-6dbxl$0LY
zOE)&$xLC9O`i;tC^ZreYZD!oEh{0B7H`@+rz4GdvIX|qd%u{5SyxTP6C8zTHmUo=1
zm2`H*JuTmmc3Y4~cd~bCZ0QM+8ETymOK&&NyxU=?y2fWpo&6Tm{3o*%y44qR8?WPQ
z^Zxwu_D1c>dt2XbaPU0ta4dU4)~c_&H1aDq&&vw)-d4WF-*;;4e(gC%AuBlAgr#im
za%P16+Ne+_@!;)r6VEjD>SwdEUrf7ky;kTYYu(v}eLr@-Ib@gJb@I~Xt^&E}A1hPq
z%G{2fVwCykJm1bR$V;tEZ|RcuO*4K89-omK=9!^x`My|b;!bthhvz@<ocW~quYt97
zV$>UPagR(PhZXAECAaL9c&)gd>32qt%d8c8CvzSubl>igN#;z>3MhQ|v$D8n=1j*Q
z+S&1k{0w(*dsZzm*If0+H~%-QGIJ8P>i1NKcRfBSs(ips`uhQXe|xK}nIhQ+Yh8<t
z#mpbXi*0j$w`IqvITDBZ{ltIYYF7U@@zCw-ayC@~TpagpIo>L3PN{nCsO4!nAu2f5
z<GlA}zHOTK+<$)b5Wo58dy(wk%V$k0Yxe{+e7oqo?fBm_R%WL*7Ui$IcE&JBfop}+
zs;hJE-g_ywX!5Se9j+nf*~=7IIJRC+T&%6t!TQI*!uMX`ja_RZBd?hLa`1hpGt>9A
zZHDzfcX#&w=}IS!zs-NM`gkvooeWQi^}U=xo=<C?osQi*uxw@eQHB@YaaCzowVYP#
zC{FX)5iB5b#@&8N(1j#P?!wl0ytY?PEfx8}z<skp%|umP!()bBG)vvm;<wHJ4&=4S
z9{9?wn5r@LjDdtwAan8=H#YkV74}A36djK{^Y$MqiQMRZdxD(Ng#R9YrnE1t4iHj*
z85l9GDb;Y2wz${w%mX{m6e>CPX)JrXdFt)51Ge{fM)68Y{4zNhZqP5WxIf{OnZVq2
zo$GeBNUQvlJN>wUFKwQxw8&<2cNS}n%bZhMf~MP>eCANl^@`<T&M$frx@PIq@b0Nk
zd7929X>3mt<Ty3O$MVh6zBhlXH&&aT-ZIT{V#&9Ew!3eCYFm&Q)e!df!m7~VmURO6
z5|~nZZ*?>8t<MirZdf$&gbkmH+=GMbY^`Ef*-mskm(yl=QRqqG?JecLo4S;Q54!&s
z@Zx-`H1ESzB~QkU%sbBSd$VfqjsFYoH5!^*ad0gy%|3YIij<fb-^6W>f}1)%6uf6;
zsk|$eEvm%Xam6&@hRAhxEe8E7OoBS$#;Y}UCR%fxENN4IeKgALV%Y5DRqkqP@mrh)
zG#3?3ywj*L(OG8k#?EaeS!;Ht96YvI_}-J0D>t0CR0v!X`M}xib>h^j#`nKUo*iwL
zbCRu@D|N+Cj%fnh+u5sLvvVBa&(##lU6H=>xXf?!h{v37{#>`aeJRC6>rB|sO+1Hx
za_xC&ujr#_Jw5V4Z%xi~3%`t-*f$oF1)dfg`Si`cC}Z}xvRBgIID5x}%Pa2hIOX+W
zN9H1?39H{6XPfc;``=IbM$3hTZ*M*L{PACz-u^R8Cwu%iuUq=@Pze9sp7cPTgI8ES
zx6Auf)@*Az@h>yV<lYjSrr3k=SIs+*n;!qua5u#2W|NLyi@t&W=J>f6+%v1$e#_J=
z3TCgkvzB2+)g{BZovqV$RNrL@pV>7_w(6JdmQ@nY+w}jg)2_cMD4)N}Uf{n-?fKn`
zw}Oue8o70JpIXZPcK_|~hE5-Me7k%9lIO%VhYn0N(N?-;cU%0h+3%HWrA!0;{wXf0
zdBz>Ictur)?_NcvAeZR)hdxg3C4T*{MP<({y?4|w{puSRA6;2b@1x$If-YS3pC90R
zJ~Yd@dis=S)@vF%4)4Ai_b#k@C#UoB*tjeHu07H3FHX95?oY#!FRylfY|ot0A+)i3
z@^p{fKU~(A`M%!PoSt%jUv2r<(*_-P>~H$*Hdgw6Icw$xouriVH(8l+G2a8fE_>AC
zpdJ3I@0Llm!~LVb88QvlDBk!cv+MDp_>QUb^Oo$)X%t;_KIPq#OBuQk@0@;h@yLUn
z8`JeFp9}tTVfuJyI<Kcjm)h*mFE>wc-N={!-x-*9;fa*GV9(;vpewbr41e23Y-U(#
zn*Yc7<acIo-!Ix-`^6vWa+IH|lbF5m*2nI3+0D5!5@q^}A7_1>e)hFTMZLSi{Z+P&
zQ*)2k%V|fPzt<PJ-|vah<_`<cUs_N+E$QabCrdWVGky|n`Ja3|b%kNG=)?sVZ^?c?
z-eR>vV^^k4+`1E+7RX=h`^Z*2_4O6btHO~dW_|gy>85boE93O_TpS|l3+Gi{?zVk?
z#z@F8@R0WDjV^oNPLbtV96Uww&*}0_;zpZ$c!Z4CukN(?&M0;w<H#<ztGl${Eotq0
zx#`%BgrIPad#&ENE*oRlB>ogU8YG?mBBzx%@L^r&i#S>DQ!^%(hOPN#&d)e$a^U=K
z@AMlnY78zPE|xK8Z1_~Z{ZB=npJ~dCY12!u-l<CNIQRU~{xx~;H%L9%tmCj~w@-7u
zXPVj~<3{#N@-7W(mNq$pKThvlaQGtQ+binAjBYP3+4x61x5)HYkV+`u@PKbmV(P`h
zu$bhz({h3xbdszWm;Uk(E?j)^@k<r$v<-{be!RO(RN=?eG@jjU(Z4N(gjDajGrHX9
z2=3pk+$1J@WNt@3|BOqS-;eYBUm_fxd_?t&<@Bu;9CC+OUY;MlWs{`+mamPIHyrQR
zTqdZoYWnsJHonWZ^PJVAv=>i|dmt5hEFk%Dwg2O1xxR0?fB%@#Zf=>Ny~&@8^@^Ke
zNtaQ2PMojG{q3wQeXg;|Ih{YV|N7LtO?Q{oI%zfYTKqaDvy51mLkC5guh`0NpE3Pa
zp{t=Q^W@2?jS(iF0s;>#a$9fF8*oIv?%k!ZrLI1&r}l&%i*k9N*Dd(%(637IL(8^p
zWw~2s^_anBf7OHty)`MCyqyQD`YTm0cfaX>GxIv<L6I$)JJiz~j=Y=|Blg)od*@RD
zQ6HV1mXj-vN-DPOw0ie*(wwsBR?$NbR1T=?hi_ssOnsBt8C9@RLN)B-?1*Kx;s0zt
z1<G(Z7hcpoe?fF-X3WhQPdJ-vi%wQo28HGoR)0HtboF-o7=xqzU*^Vimg#kGl5r}x
zS=_#S@vc|Pm>fGTUumB1bn@V7ogry{?pn(Kc_At#x`)c5q*Aoa^=EjzOS$><ibDt&
zf3IudrH^unWrB^{inh#Ro*3G=y0?2#<@~T-g`*l9ujQ_-f9D;q{cA(~jHA16cPTey
zEjZ9WExA3C>*~C>w`+gtl$<&+S?{y^>r)T+34T0xHj3A9*R^n`%ZJwrALLSG`JK{t
z-*9rw@eT8}ZvS_>@~Pw<%RTi4?Cyo9q^GP6d;Rp&Qjf^fwM`YuZEPAfV#R{$Mp`c>
z|4jMQaPe|zDYw1oU#Wz>^$m`zXFofV$ohw8_g=C2_cK=-wy`Up*wCWhn|&^*NX@E@
z?N`X9um`zkqT;jGD2fJiIrpdgr_Mad;Izf`zJrRU+|i|t1tt=wUr4=iyK|wxPR*Qq
zSGB&a!#e+|Czw@@I`~By-_-0D|D~!m<ACY((7MWq(0D(GSzjK8y;SqPynKDq!lzCW
zN=@5Xc|z9x2z+;W_2&6Tfp=PR-AqpNCz*d?JibY(IP)KamD(Pwn^(^(6}v6_IWgky
z;$MQc-@a&@y;4ii)|>0s+OF~Pg{CxvLS@~|qt}u?)lB+!RK>NmufUkqKju{ro9O!P
z=nl1Ge7@2-yA>NWxNl4?bKNic+<%6J?E+@*mHA2vpJj6S7QT+?;;_`|S;5P!+1#;L
zpYy#@;X0R{=?nXq9wjTOtzLKZVx3@iocvcyhTrQ}yzfe$f9Jlv!<4XBz2!-#Z~L4m
zN$6qiHLyAIAw%<r#-sETJ>J`tFQh#F8DjU@<y48*$xQEPrFe()S66M`trGTd_uqmL
z)@hd~Bpko6Q{$+l^waR`Y9&V#_@?B(c{nqft=?<tG)|v_yZ0K^o~vzYIcQL@`Kd%E
z^ZAuQOIO7$`o#L_%GPp@1HNV!Z)SeJ8>IKqXwOfdCz^66UY)g#OP6zwkUY5H{u7^H
zdyW+wrtq5o(KEkuynG&)__DSSS_1og_a?J;E;`{PY~<=c@%Wk3i>AA8U}Cv?OLk=x
zy8?60gBXPx;iJpW-F+&WS6f=TE_1i6-I9Kt!q-7FR`PijH_m1aJoA}-YU~%!#MT3>
zoIMi~kLQ0ps>~~?9`tH^#bT{+-A0aEg*W=0-*frw<!ShOD8iyn*&;OWyBGKI#EOO>
zO-8r3D(aJ&o-k|;Ul_*zr}gk=t*p1rMU~r5`fIJ&d~bi1(EE))nQCwOTwJL9ELbx9
z%!bLQh2`2(o~1}K{dxYYphn17=fonzv)fJFgo-ymE!WGu^y})Cjz?eq=u1t!_owDa
zN5!{)+yxRcA!eM3)tQgtmwC@WvS4q;>*d?thPK~lQ=gYrab||J(tg3Tn7zd_FN%Bp
zli%<t=I~G5kIL&8{eJUj^<9q>9m_PH99jN%`J&(UF5f#je|TSH)qXTRjIEAW&ETbu
zr@+LtMcnT;CaZ7!WBW4ub=-_w1snYCCMg>5i>$d*cw+m8oTm-*cAK->-(MLtf3YA3
z|2zKY@jrhXP4qHYRsQ$=X&3E(EB>(_`Y#(NfBK20aZwRNVfdHNm4ex}+cM7lD)+Zg
zzV=d{rQ_a-4J*Dlx-=iLR_NM$^sdaEA5RwrEP4Oj!l3qI$cD}O+xP4_`%z(E{d(5=
zZwK%E{35k`qi1KO@b6_sC+-?gpXT!3Z0}Mt&q?7GvO?R}MYsfX>|vf8bm82?KiZXh
z=I1Uj|M%qJwv0t7$&xGYY+Cd#I?ez6?D>s~60VWV2S4m`IbUOw+pJ!qkg$D8>J;An
zQLC~zo!jiKK632NdUv$KHgn>aPOpaRk4j?Cr%dW^Ef(4TKz)+6dRD06CYNpR^7^iS
zx!|2~uJvkp@eI9n8}2nngzVL<x)*e@wt9Kcr035M9_=t_|Kp;N_<Gvu`CJEYcgphZ
zNZWtdzU<F^+W_VUNBKhk&`yp9TXT{7**jIkUVif5^~sWB=bGcD=dbQP6vMQ5;RSWw
zD_vb*wwbJ+cu;rdqW8zE%Y!~P_0GB)EG#*3(#a#o-kn=DWm!=2*VvShl;;xl7qwP9
zy4JC(*=gEs_I{A7%D2md$4`BKidx5{sUnr%HXm|%%BJ%|AwS7YU1dRX7n{TT*B$&-
z-|SHbkpk8C9}r?@V3^8>bx}Y;esM`bQGRl2G3cD?vthZ}w+#gTy^AlL!0(%pe5)>c
zL9<?MWJEL@Z}MW1g}0u&&DNFl)Z<S6U#ot*a%1xDSdZ<`nmhf=`{z~r?JDNav!7op
z8`sIO^x#7kmrPfcfc^(2PY?36AOE-Tdh<rF=TSE2bY$e^_BOxdc_`I8N#K$2F)d#W
zKAlfTl%K!!k>E(md$DrKQzxknA|DU*awwciNobv9BUZ*IWOzhi4bxoD2St2NQCC*F
zRS8YIloGR@ms6ELV54~EREFfhG~?c$MvtJSx~v|lJ8vJZXzl;6(zBr@v}%sj@1+}L
z4!DXPUtPZb%ZAS(C)^*fEt{vVG~?Ih{Q2i^{&@WJ$K@x_ik>k3<;tmVoV6rII_a(G
zPT?0WR*uD5(=`H%Z!O$^D<|MUi$tK96W8g8`w23<2|wiWrW{GS`*+UG{<${_nA-0d
z>G}6uw4Zl$nq_Wr3-bi6BNv+{{cm*Ht?12M#Glv6^-Pq@Xl<-&cW=v?UcStiZ{w!f
zge`g1;<xo#@%BXJ*-x{g7x6|~wm43f`K?|Mvh?`Z#UCpL60*20XCG?QTXXD}56iZx
zUy?rd7VdMi4o=j5ef86|J;ilysa6il<n|>e%varY_>bPHvWv4G?m8^J`Yh{R?W{$Q
zXQUtfn(epX-B+tfj&4tHsh_``*EGpTFSYEPce3Da;_D|$*Z0NxYi;U0!*$@Vi*aez
z-JSNw*go^D4$SS+4UIfzdU(IbT)x=2^><7vogcnC+UK=zR%ZHciPXkZcYNe8CY1Jm
zJr^N$)a2Rw%r$?0?LGZdt+I*5i&>WYZ_Tkey&F#{7RG(K`G7B?^+DRo(^IX*i{|@3
z?pkptLd|K@^9jE<T)(|o{pt1lJ#r>pK}zq#OXc;ss-CX8w7zcJpS^!nC9;1kb8v4u
zxh?qi($c3-Hl8YXI{W9;-Xh)hwoEZmgEc?j?DqS7q%>~7>weAq*}luSY&*=N<@rNM
zrGB;JlWl$0QY&_R<}2Uw^_W+FS=aMj4zh_m8XJssMBg?XoFDRZYtx%mzGdN2F1oID
zo|FHGGwpMk{dvb@FCDS%mye&_F4p=l`WyP;M>8T6n9DdB7$(^;Fi2vK$QBfV*VyP4
zRGy9gpMQIo;QzbztkcaMzCDu2ZTxG%T<v^oJCkhO<)pK1jD3n4MpHk8E;E^wCC&2l
ze!0rm)=3_<8>j5q*^t~>e*Cvg|8eF1znrx{|D3MZt5a26CKF#{k)Y+_VsLxWX%mk3
zACJyHyZWgAi`Yqa21Vui7iNdA|KGIkz2UEpN~epA^@j^5$u;tG%E*X2)YST0a6N7~
zT<+xRpyAGBk;m-kB$8?(qO#D@=Lqv63Hc9<oh%!B7B$!@II*T_9{#|)Nr+AVY`M6C
ztD(wArKFRBKkKG+_9WhSe=<YOhk@DGMd9}YZr{x}MRJduB*>_|zJ8xWooUwzY5ko)
zw%2WTd%xLY-8}K`IV}$#O|S6a-0RHfe!css(_z-O^FErp*HnbxW^Fpp=)OREq05hd
zlO9_{G3#W$U)$3Duj}5Lzyt4Uy7nJ$NwPoVBIN4&c>Z+_Z~n#ubq8A4b7UOa{zB{x
z!`b)EGam0z{yFiJInQUEX=mnz=U@2i)ch|nKj$?=%iHOt%O>2|^^ld{ByKa$_1Vd-
zF2DFq_Gg_qE%CYd-1QC@vkx51X(dww_Gs|VQFEBEN#)2KZRPbBj-Ky2mMYz5ZnHbq
z=zZJ#`vLjAHeYiE)@prpoRw5{!ku4)Yg-3*f!HjW58FPhJsbVuf_BB@SG(C_HsxJ$
z_GBrL{<fOMgmF&u&4>5rU)UtX;(yFw{h9-f{;%#ECY)M2>%w0Xivu-t6B?Of*10?I
zKl}Xd(O0<?&JR9Ym=mfjzLoyj6uqQyessW-<|Ql6O%zhvYTRbXZh6FUNv&h^!oJuA
ztN(~QEj$wZ{@|nM7cRc`au%KOXS>19LWiZQ#ogv-Vz%y1cyjCmOU6sjuTy5%a6jUC
z{qwPF(Hw7S(KEMZI~dMlIM%jKz_9n*vTO2ueyydGUBfx%NhE1~2-ahgdX&2Kc~sSn
zQ(UK2X8HbK{idROrm*wXJITctZUq#WcDK!FcZ_<$T6FbIaMgkPUc3>S#%`*NKMJMT
z6a3#lb33c{qhj@^w=>JPxuu)mySXZ}Ri8<0ll5}ZRnIQFU7lmOO7L08k*NWvO*Hpd
zWc^%uu&(8&m&`>Y@q%ZS_as?ZlZECef8C@Rey&%~GN`L+a({>61+NtE2Q2M1?4BYE
zCCm8QJTHiI9GX*hPV)b>hYwa;dx@^CU3J&%kmc81DLNGeuR^y)eUZAnQuOq>KITsv
z`#28?EO%OOSN5*9`s}5SI>m(rOj=U&na@8~vGLclnSZD7+hpxy&pQ27s;u=kiRvd#
zzO(As;%$y!*UipzzpI^a&x~KkV_uxl_1!Lu6gIql-Ql8kQb$A7onyCd3|sZzFYF#?
z6}Bo}Ic+RC*L>d#4`Zcw{Sgy3D4&|4@;Oq)(~vu%+|u^1Wam$<LiYuGa{n=e?6T?E
zSlcjFvg*$FhWp1nU&O7<5;1P<c=EC7&bcYQd*+1;{N6F0O~XuE*G4{}`upLzS>kK;
zWK?$k<!$F%U%l?Df1YQ(Pb7nVQsMj^hqJHRT>h}K+~#CN$6vkXt6T0@xb}HACr{0&
zI_=s0;#BJ7?>{?dUDi@NXsp7%Dpv0GPkpBElZuPnpLQ;`esRrX9`~p14W<I8gFA&6
zUw&@!n0dn1lW_uff4=;1Pkq9j_V4c>DLj7H>(l*8GJKN9_p3}Pi(7j?Kil4NK~>`D
zhR&Y1KW7^qdVYS-*8AH}-nCk^<iPQDnnAjprrV--mhjGq{BV`!eoWM&d5uP#X;O=)
zJnZ<hLSFg0xW7>0^J#kwGWA&ZOx?oI{p#+68>_ckh$T%e*~V|2a%v^dKE2*g-;=ez
zv~7CK!F=2Aww2p9lk}SpHwc<NFlYN7FQ54T{9NZ~Q~SqHc3YVC)pS_Z6um38_c_p4
z^l(n9p4o($WDb!twKj=c_M0p_mhktiUBoAk${Ehzj#`(p+|A$UT{gW`|2Nw~AG6@}
zpnX1(4XKjJyL5^qt_n|IUi<X+`unO6vs&xQre2bnxK>1csi2-uVO7wFr>g`*Zxwc~
zxwxsv)o>b9F?&?>Hdfw3-3@1Vxn0fZ%zGR8fWac~eejXZrPl9XTwLY8dHoN^x$~!U
zJ=+$h{eDxTl!Dxn^!C}O`)zvv%RczV8@pR*mz(*Q{%>9x2VYvqZ9f?_DM~anR{wwc
zhrKJNUw{49fa&Rz^`d91U+<h?YjTL~57&aT)2&5*GnV@A74v4TJ-K-ezgOJz9sCsv
zpOW|!LO)+Eo)){hb=}3&{1>jiSkk!2M{kY5sw>GlZHl$$1KQubyRWhBo2Zt%rrpjd
z<{`ODb-4Hae#~CxwQz0pamS^mhrdirPkyVlI`quMHH&P+lE0~RXE7gcO{-sX`@_iu
z`J`i!T`A3bx2##zJKO#8tCZ%gms_{UU0tQ^{r|_OmsvlyE`7(b$MyOuzOBLAoz|I8
z|B}cb`19jRKb_BdwX7!}m^$s-=(q0aFY9m9JcZ=Xh@9W^WQqRTo-3QmPP?R=oSU=#
z5tHs3Uu%ag`b*3le`_&rQG6csR{zI-$+n#Q>st=h?U79J4|=x#L;3Y>9U+C=x2KnE
z^I61{ClOR<b!m?i@5}Ah!KdoF0++fR-e9!iip{Ba?%B)pdyL=a><d<U5OE^AUp-a7
zwbJI~Gf(c5uV(f!Nyp26{JF2$HNQ<{a&daRP`hW&rB&|iD}AQT-n6=0)~DC*RQTrS
zHLXXb3;*y1@87p|)AD4~N%tmRluYhCHOblH%1m9`%?~z}m7co0E>PCz+>N#}6U(<!
zw=TY%9uQ*g`ry-(Z@TxzRtcTTYH6QSm78M6>$meo;QQEVC%W%FeLuC?FLVR9(^mtx
z^OxV{{gIn>u2A~%%rEPvvFyAe;oVdtV=Q4Dv%Vs)!!zpP>iZ`p7{6?>7M0a{J-cJ^
zp3GNIIfA9<9$xijVUNVC#2&BZ_w!dsyG?(~ZTcyje_dm^xQJKOPXo87n%jkUO<5P~
zP_Xiz@VwPF0!I5zrLQh}#xW;2U*^ohipPfz&e&jdn6=4@Y3_m2Gq%cCFNc;I-%ehB
zaK`6j2mUk8`I*OIlD5U>l79M@ngU;i&_*qdtIq5>p-;j$lpoe-eRI5Jf2V1Mw~bn0
zYR8F8w#81dqH~YC9MoieW_f)}aMsbU|4t`mE_D9+C`JC&m5M0eidFAky{Nsb@orbg
z+5cuKA_eYGZwbHNDaP+F?DwT!&s1#6o}lPYFQew)FZ^}YigU9}Yp<^2FCX~_rSq*%
z@pH)ft?5meQ=qx`(?1<kx5*+_QQ~{Adh!adoV?SWU#04{)4Fv<2aC`BNwHshyE3Ye
zYjWEOJ^7z#%b`D;=-bR-Wnj3Xg|)F(mRX!xl3xUBtVKoV-!>De`@UY`mN>gd&$@i=
z3yhw#@(y0x;&3^39*dh**Uo??Zb7+s;`ckp>YNnQycsg#)xiy=@7kZZe`=1ObbkK5
zzqQ}kyB#wucKbO<Ofw3|KT+xT*mTa`xV=$(RHhr<*C^X>_T=m8`E_dBvlZkWyd8yp
zaK${6yd}tN620Kl+gX`H#j8FBb2-nvaAd(z*{eEgnTkn=mn@hwlUI;|Q{{-qA}+@j
zHw4spR>UyYEz)24A@%!R$tq1=mG~uIX)0Zp4vBCr>e!$&{nUcS32nC|sy42;KhyWz
z5!;2c?u4cB)JCfB+W70-rw;Ez{#y$|z4F4h|F7BArB}au*Pp+?o?SQRZt~CE6=iA`
z={NP5jd<wR=ePcxG%*eey~Vj?hMe#jmy1En{{AO!>OXPgTJhxD$%_RWul~zAtNh1}
zJ5TBMs!Q*taLha~TkYN}rs{&`e6?S@4_GyFWgEU(H<iC)i`eSMBWwC6-wn9lY3!xS
z#aj@ZQodl0V^m?rg7a<<dkWdIjxKD}E9^B0Y%mT9S2VfN%Jl2OJdR$I9hI}+_!X6Z
z-uCE%L;c!9#q1WX^54I-7BZfnx=1>G&Dt*y40@;i-MZ*i-1-a|=RB=DH_kqi?d~=1
zbo+6{GA4CrVR@1^Z|)EG?@9kF?l`@ldQ#E!uTk}*qRXGRJ&f6*xPF>#aohAu&kh&t
z{^sBl{&c7Hsu_{#2@!81(_^QmpZo5%>w1zd_vsJXPg#3-3Yo-Xj^$;%&y<<#*Y(`6
z?fAxB#Xb#ru{YW)FYgiKwAsba(QC3M+UMS1?v42#GkKr*eqo-mwPgM4FqvtqrnPn{
zO8G`y;IVlWxS}q8{?56qrJ{$tHoaebq2~P7wC{)FwC-?R2<D89&(eANQT0csc$L$=
z-&yt!@7}A*{dx3Nb$M%<{E}~5ni5!qw^!yLT=H*kv-;QQ`$=XKGW-9WYnmrN_0q&c
zySa=V)xG~7xT(#!qwS;7zM2ExO=V&iyXIFJ@A9*q%j2&wO({`qO%vPSu4=YDf^Di+
z^N#2~coX){xy1e77hB_160=fm=T7mP)%E<<z7LDb-4mCIx@J$md~NF1+J>{5Og#5@
zRs0Bh=cBqv$NyJdK;@0ewHG?;^A~U#M>nV4KUll!#$_%WcFsn>-<hE{SAREsp0+w_
zTm0);@p~!)_bE*Id}+GfQMsdgJapQ_V()Q^a%Qf-CY5_@)xl4t6AMJGX6|cpU-MbQ
zTxV_7hqb;N?C0zbdjFyIL*dhg(q9+lS9tAOTl9hH&rzoX$7Mv03Kkvyz3$q<ol|rt
zZf!r@C)_@z_@LU=&Fjlz9F@24=KRVR!@$4Ne1d`0%6EPje=ydFzLVef`)Z}FkETIK
zx0I&7o(TVnv$=LlH#j`YOjyM4KOulAGi$-j$^|FCp7nn2!z+E})SJia7O&nMpntCQ
zLQd+=rW5<;zRlRdZ`W>M(XKPYq3U=)>*FowSPWzm>V9<y_Ou;5GjTt6u;gMFwhx{%
zlX)Ftmw%n|@2pek&uWX-MOEj-&K#@zdE21Tvg+662f`cEto7Q{Z|zxf{luKrcU<xU
z*3DcOEOc6DvDiZE{~i%$%3(n%%g-*A6a9M5_Nw=co9y2wTQ#|vr!AlIOf%Hxu$=ch
zRpGvbr&UD)o_9Ajyv^W?J8!w>^XJOlya_KqZawe9=4Zn!d-g|f&d-&}d#?n4(2)Bu
zL62=>%fDN1WIlw7&-lr6W|94W&Ab2CJG^k3+M{(pWWJM4-^1SS88%DOH*c7BZe3`G
z?9KmkCvJaw|NOLAk@znStmnm(kErb{Yu*zm&Au!-hp|8HrswmNh|6zf<<>UTm>KOi
z6O%6J`F?n7NZibI$M~cUIqKYIysG}>?d@-|NB4hIEW5d3i+WkQ%j~N3H&G@%Z#7@;
zvTNA?^^D%{Hy3x?m#tQxyZc${688+5|A|!%E8d;txAFbYk2;XWz`(%31R@w1801j<
z-bsnc*{OLc$lHsU8BldMq^W#Wj$>dDoy>?!H`EmHIN095Ww+fnDg4_%pDFph<$@%x
zE@Nx!a+C1l$2a`k(q(SjN1sbsw@99O(t?&5DiRD+)_nXmr*>BDhT2JM*Z<3FSn%df
z<h&zFjqhH)dj$f&Dkkiy{QBki;pb1+M3^6a_;OFg_NR+<UOj&DQEh&#XnTBW{JrW4
zHY?4xmsVC@Rg16v`C_&6kLUF&>EW)QYA=SoPKk>VKb^I?>6B;mlhxJV#Y(q&sZBn*
z?e4XsDU+tG_6^<cxi2m}_ujOtyCxcK&f2My_QgfCD)M~yt{L{a>AKTrKF_s_e&!qe
z!sypU3(MH)Z}}_Fx{BZax@PUFrFuKoY@aO2*K&V)ZlLx1^zh1^&&p@-*&8)2`0F##
zKYNyY9sF?hd(z(6mGAc-cyaans=)hZPv6|#6tF+*@7kSFV(-uP=SJ&YUH`2tc%A;_
zJ)Y;TEMC3m;5&|an|!`z@6w%K{Qu#e8zR{=_C!XS{M+pt8++}iR>i(UI}eNfd4Bp;
zknQZy)xJA*vU=A)?~kwf{_SJ=`FlS1_F2|`y!+(m<^1{f|K6RIsJd{-rf+iUzI}5{
zZXaD#lfP@xte^n5??OLnxF;Mx`Q5<!>8^^RP)5PNnTzJ_oi8e_!u9j-*>9JsR9HSO
z%Q(*R{O0eZZMmOcZmI~rlDbc4_8e}z==kZSTite<TwTd^(QoIDxjBthdFsAf*QT=y
zTu!~{cV&ip_o`{;F)MS_X76E35LTJ`aWAv!o~*}027muV7goQ&x3_5GoYeIH6<>2c
zJz0N#-XGq8GM^1gp1G*SWzAa`W;5Y=>g9c_R&Q(inmGOZYj26T)u-$yuCrUGFTFd$
zAa~V**cAph0*~sn+*Cbnsx#Y{*Er_&yjkv#pRCE4^XYWaUp}eu`p~)NJHDi!f4MOB
z&T_sb-S1ah3NY7INAAzeJ}@!%u=9`2sg1GcUPrtA<^Ng4eIz~0V4C{T-(olB#D0EL
zc6d(OoINXUT|c`1wva}5wx67Ry<O$!Pj6qVJG`}MJ;`}S_1u}Ck>ARA6VA<S%5+Wh
z-{u>=_FO_+gP!tvzr@;o;rjcuuer|MepKdQY|I^FmzgUr<;I#yr}g?b-tH|4=kMET
zQCF}v_w(sT7MZuA>|;Mpvf6gMgpXCPgws{wc$Uk#=mno@T7z#NxqrH-bN`+Y=h-gZ
zcbo4%+4*Ic=dIN;JF@rrg+2ZKWLeJoN$Q@V>i%+eEG~@EtFLKpIQ6zot^1mm@&?bm
zZZQSl?#O+)Tn)i0XLTnqIA{vhFm+#F8(_xyNVsf!<fX8alNY!1_s99wAKWkLP{nim
zbk?ptzG4m2*?zM`iylx{*r9qZ@%t?G*GyKNrx||#`SX+izWVa@JCE5u>B(2~m)mbK
zdrxg))i?eH(*mvhk9%^(X1=cJjbHycb)MXv-QTy~JK%P7z54xUr<YmmIR5$nE(V@?
z>%>Kkx!fM5#9d44%XE3Ce1l<ywA`lFC0vJn-FDQco_`?k>VCe?#<u#?C(TLUr+<0y
z=A-tHe;xbk%fG!jEBWVFSKZz^Z~MCQqWjfeIB0}ljj`Ie;Hz2VG55`?A1=2|(<}X~
zVEM;;(yds}e$$H#v!5(FdD3%|*!$CEY&-|F8ss0C-LB$2z2s!b{I9>0UN&WX_ASqq
zNJu|=TCD0u?9>kzBX{2WcGdOG%kt7Vv)1jmd&ORs{mqNLyGHm8>!lA|*N(I2JyaIz
zbNb9uXfv~CR?<#|Gl%>y8*E{_%o4Ny0TbW6hm3k`(!Ce;W@mmlmd&V8awOYWY4>U+
zvqz?!-QWK#w^;nWD*W8!)QRiQzhVkwyy_R+_DST2yhp3)2{+HJx#qXUb_5&k^-Vi6
zZ}K#Ybq0%9|Jmj6k3qYB>iX?Jg(42|FpB#;?t0vCgWLM%x7tsicg6glR6KM3L&GWa
z#l0WQ^9@>KcA);*vY%&OhNnnwzfxV!`@QE!$=xj%obSkgdnC4@u(>9!?(nnMd)%9D
z`z(8EmGY5)(&p*@@p9@<t!~~qbShqb|M`Esm1c$cH#6qX?A^Ba(9d<-ybn|q>L}EO
zNozQ@*Q&+OTYh2rvK8yQza;S-xZOSf_{p=Omb<<3mK1GT^-Aev`exlc{hm{k1PyMk
z`}9n<Y}!Gmd`S*brJswgNM~6r%f9h)fmHwfsHEAeGSyW-)K@RuyW(2w!swbgoQ#<V
zvbe8LE@oW)@z0^PC81A>tJ}AB)lW8eUBe~t#O`S4pNzP>R_8xh>U2fOF4<apD<dyl
z<0<Rmio@r3v#o!&b|&M($QiE%o>n{NOf2K=F#lrhQg`2qOU<X{i)n{rS}4Q&f-uhi
z^9mF#+n8K8^Khy3eko17cDc}Kt;?+N+T*JxhweM*>a6@@-hN}o>|bj>?rGHCF>}k+
zC3<03OB<IyWGS)R%j#GB&|&GLWwX<cetIpsp~Rx@(yCvq773H|^FQ5Y3y)Zr`hLl*
ze@xj&8@oj}M%o?-nd+B1<F=-ZS^YxOWfN6eE58_swp65*{anh-cbuEGpmC$kob~Er
z&r0sj6SXQ+Kgui@xqpLZq-jBZ(f#VrJhdxk@qC>9H)!hXz+a7#FWm*+b!hE;)9AhG
zgF)17CYx*d%Qjs4z}c&=EM)Uyy2RepvvbQc56pEk&Yyevnz=c1xk`#;ZSBiCtHSGd
z)8E=$<om+se^0UX#!|7XMUi)Xa`={?R<eE9%-=05=Pf?*@eIA=?r#>o&~rYU$+LP>
zrUzg7^^44<XB->d`V|{L`!0Ms=l9XyH;b(G-#xy?(B!KXVYs4UA|u<IvL_P{9Nf4y
zZtl`m?&f^#Ht!TVHf}bWZ1+h*{ZgsRg_~uYb<WL9Rq8v|`Lj-t@zuksJMAw%<~4O~
zF_^N4PbV>Xx8|#hj>|rJRB5mW3-0Na<>_6!@ZyR!_xk_(Ro3`?;FO)5|M!!{ysvX|
z|5!M^x+I!^(mYy#+u1R9;f-CtcjTxU3%r}f*|lr!*7IWTyHEP^R%>Njnbb}7GI4g?
z+NQq#2V--z_|ZKxElSUx^R;qtNZYt&-np>PoH{Q$+?GVd%V+y$r@g%H5T+4$E^)7H
z{_)AKakmm~7lj^}RJ?25(p$4v)u|tv>s)B`VcWS*7Ny!-Cw~6E5y*35wGf}yTU{^i
zwQ^CCNnvu#lh(AaY3<wcg5$=ggecQh@9LDc&rvqcZkk}OD9`;pZ;$DU=nDVr1l!5E
zS65m4?OMTDcDMS5b_kdM=bP3Nw_C1AZ?QcsoXB5tqUgGT=C6GR>v<P%Fj=`yCG}-+
z@ZL{_Z^{<t?>PCT={QHn1iuNN8qY19_N}pWsn=!C{G~hUw{5$hs{f&Vi^(EKi@Ryl
z9F|w^{`h*?=BKZpt=5;Xy?JrVXQR{GbB~I1PJW%H6tdZ0UEs#^7bp0?yylBI@OtAv
zzM8Ao8`sa_t0~>i_h;XJ=Kb$qA9z2P@6W$H*&ojJ?EfxYZ?w0N{c-rN)raH%`2K8M
z&s<+(_2KyL(g*&3Wq$<6v;TWi^1#3R)q(K8E<Zx$1?!#)JPiLW{IJ@;{Pi~feCt`;
z@2A?^HOg0;?_)c5^DN85RB?Wj^+qZCc1umms$sZr`-tkB?`MTl#J48)yyz5+{~s#d
z`tDf0VdsOXud13P4&L5e745R&yMm>%sv>9a=B&HVR5ke?3QRJ8+N1w9Go@m#b5zuw
z_l{o4rg|R9T`W?2PW{}bG0k96)0Z79v>DIji*tuWJ`(MdNjfFA{&xOqT@PW`O&Yg-
zj)Y0}-06$hzT}-t#HKkb?4NYZ|M&a0czyN9Pw(~rO}aIyxA@D;<xLAO=gacSsoa15
zo=Zl=BfyulNtI7-0;kLNxd#I#|18_O%lD6`=$*s$1vh42UK^PiZ#yYU+;Cd){H<oc
zuT4AtBQ&J)(4%RkS94_jVow#Fm*V;4az=Je__xw8oxQ87ZF`OCxZgKLi?c}<gf*<O
zm>+Q}rqrS3mG8wqJ|$b1wK99lq|bPyg|Pma<>q}q^y-w3?YF`vFPrC>Tf1dNw`$k#
z#d9AhxnJCOe%-{M&a2aJSejNJ-j&|?TW0TOckS>r{z;cvC)`{gZSjF&X8iQZN#{QC
zMyYegdmVRbtN8A%|LoN?n}dsEH)&3>nyRTHDS9(?8TaL%@8`tF%FO6~n|V+>d#14Y
z5!SFh=fh_&eZeC4!0K+uY+bPfw<noy*{V~h%bckH@I}wG$OH4ab{&bE{kv4cb@SQj
zC+<8;RXy;;;;zc#Ibo(n7bE!?^44{keqqVix_sDqum4i^nu(trUM=5Ld-m3M&CHq)
zcH9kd(@*3Gc8KiJOprOD@}tc?_uvM<ZL^hMDu3cnIe22`i*q@R=Kj}Hx8{Bb^EFUs
zkWG1iv-)10r2e5q)?KSVNvWq*@WtDnzOZRgw*A!YZ5uy6ef#>Yl>dwKuXe3+?+z(-
zkahE(lcM6~Aamw6d$H_n--yrlh3iTtmdvbEtC+gJ^uXgKrsmOSj+I5sJizwpsKw5c
zufL{jjotRNCEwOmFGHSBulICotxunmeL<!56%MI|x?)xKkG7uRmyYN-`QC4m`|*RH
z+_E?GEIe?BN$96n*arrS(*nHvSKBYLl!<3JbSjEDQmkm|@7*eI(<QsV=w9T#bZOC=
z*<#x1CxvfFH7?6uxN82=mHp4-<NnN9%FgFwDqFGqT_2a%>q#nI?+z)P?QcJ}@WJf4
zyLj)aoD?)lcd-9^HZ#k3vDnWuJJ%}2WeaM43U67r>igtRD)Y^{=D2>}EAQLRa{K1V
zeScLywl8!)zn}ln;fCas-;5%r8%+>+F30Ssc<76@QU19bdrvOb|EBd+J#tC3T;k6B
z!hO55-B>m;US4nY(#iUTVwC%*`<*X1uKp2MmbUzv&~m%^_nwefTcwwWD*rf;*(~x!
zW$GKJ2RDq^eWotW@T%rmus<p<@$i#w$!dMkE!nQ?Q){=Zjoh;J!?EpOl#dIYWPPVl
z6#1lBReE;d*9lW&4~k7JU0AmDVA>k(8>OM^J=98<u`%|ha<DTxhjc75w6qZWk?h!K
zZCI7{f9dB-{YAFfic4R;>rW28wfz?R#HKI4Q(J{gq)u^41<hjJmUwsbp{<W5Kgtit
zc-Ol<PNSpdliSsk{c<Y$*FA$7t?xA)=@+Y0c)M=a>zQ-*&h%8&R;o;m%xG=5S`fY9
z+4c*ci>7&OpZdh}+J+M!i^UfDZp@r}eY@w)OIt2oyx-)ucA*m6`t29)gjxp{>@_@D
zrtstblNT=n12=otb-tQ4ZP(15hh2{PxIWudwI+Fu|JMa}-+aGze&srS`;6Lkzjc3~
zX|2ClG3!;8kHkX%3v=!)w36#Oy7OY%*{b^+g%2GpoNHtEx6tR1-aNmw@Ta8{8NwfF
z&T{fT5)qc+wb)JV=mQ%U*{h3Ha_&5M=-9?z!0~?OeyJ}fcjl;7{*?RGePTM_VdjKy
z!kMZuI$~U}l$u%1z0Pm${`@D2rT$-X$-k!$=j+MI$<!#?e?DA)$$v}0xuPH8SKE`V
z&&VX$x7MAy-MnJO2QT?|yIojVKP#M;-t+9RVd?2}?{c~yJLGI*-!4D*^<FFETZb?F
zSFq8FoWycQa}o3V`lajlsW>`!&*qqaHKXU9zWwoOraS*TMlCWvTbt^o`NwhV+xf-+
zxC>8a7(c61+$FN=PO0?4OR`q72F)4wcmDr3Ep6+|Q<Wys{hoJPI)kDb^Y7KMOLrKj
zeh6R2&cE&A%)qL~^;`en%9y%8|5Ux0`jQ15Ugr#MoUcCcYWA+{w@X9RKQw%GoV{yS
zemZNP7vHPoYpR;ACDFNj(_ff-WEFqE5p>OKs@z8T@+Z$CS?`$U7k}Ys`pB@^*(YZ4
zfBtvRmEU%mdQJbSTf%Zf+*4w;(DUPyjeQQ+KJxMq3TyAol}~csH$kcOQM=p(p4Uv@
zJRUq#*devG-@16}Z-qG<Onmoi2ZZbAFsQ1rPT#iFH2?S?tK1$l`>g@FR-#kczFTjf
zFzJ9o|E>Q$8&(Ing$GPMb#sbb^x5OBj^3p*!sm8>_;<iS=TN2Qw*Lx-vEfhWoGrZO
zx|Ow(=f@GD)UC?<N{R~#1m-u(Z4-ONdg4<3jm&#?8og^@F?t<N4&|wwy=%|8+Y;Ym
z+@8o3e!CI;J&>_fyF#fe&@kFtuBl=3%Yc(n&9_&c`n6u-L7eu{d6MC!8_u&O+x!;r
zD>(iA=EjHjSRG$GRM>s+|FEm%pm5I9WzT#L{{8*^>-WunWZz^~KI+j7FXt~<l)yHr
z=Z)P1&%>Fwc0F}kXt(`c$&!7GB8zn@bf*WG=-fGUu!~RjYLgtx*W6|P%SCqeuU@^X
zm+!UXqc7q7?mxYECQQ)uJY2SwZ)4;0x0jbZU--)-k6WDKPj>IQgLU6Oq|E$be%C01
zd)|gBtC`8J;`^*tPk+7lM@Y)VQx0>EW>l{c&i|boadBODMA=92#nZl)nY!wR?tFGO
zP(JRW#O-@(=TB_gb3}E^$|xSQiTW445;y9k>q^e+KlyQciq5)^N+l=F<i)1c)OL$I
z1m8F-9HExs`uf+eN2?BTFP>8>wdg`b$W=wr(`mDNBO^ucFVPQre&&d({f85FY4R0&
z<e4{~lgx5^wlGCIds*6Znecxq#)c<-CP%-|3tc#&_3Tj>&KF-UT<h_l?fJs^O;yxY
z*Uhm~{g&cWqD7__T(Gg4cWklti3Z<-rk*EX*vxhAR&UOFD)`1jkh5cN*O$I|vkqOG
zXcqE!c2Y`G@qu$UPrfQEo-MV!Y7Wb$Yk~K^8cjDlI(z5LA4lq^&28LM{_9d|VpYqx
zj6+-3xE<+ry;a!1{J{PXvOcN}SAA3ZW_{m0yX8Upj>wMNXFYe{TJR+QSFe+}O-X*C
zX>MA^;=S|weOm2K+}r8Y7o)sAU_r&P=IyJ3_OM&!yD8r2sAGGzAd~sm)1z7y))IOu
zrn5M97AxLUUC_fW!10w$HtO2uEWY;k$s+gU{>>H&{rFkor<kv|!=%fOipOS6<tX3M
z!u@RGC56|C(ub1@10NVI{oB6A@5-xlr?y3y?%UR-;CJe4%C@!H+qQ3-_TITub%7nD
z@9PuHX$EgLy|Ca{=Zy*}&|oVvI~RDkrt=?Hxc0qn^U}f_A*Ht~E_f)Oi{Y5A`TpA#
z^BcF)!*74x?e=nO?5jm@m6JBMaU9ypGsAIB%NE8IQH7`aW?_f4f_iWD?7td&D(&>D
zkD*uVmMiP<qzA4u6t}#vnB|qB%#O(ySNL0$^ZW04dDVie^U>)7-irl!34Glbm1-5H
zoB#jExZ&4FefzbSH;6OdSipSOqh#Xq3BRk2_^(DU3ck82NxAgLl9&Tr@j6^N^(-;J
z_C8BGcyXrqKACM&K`GUO##`ns3c7bRIf!>fyfuF-SHtU>URh?}{8&8>*l_&Ii`&oK
z_2taIs<;D@%qcrLck}p9nEYm1_=SL8zRRbg3YwM+OKn*Fqr3Ksowi?XRE4CrqiTl0
z;^!vf)4njzT{>^k+e6C&XMa*L6WgjD?d4eKyU4pnfl*dqiKWL*73F=}d5PyI=*h?w
zsPnj8WM39H^)-{TSYoml!<4fAt^f9{{VX}hI_}fwce~?_?|8nCSlZ~*`!hz4A?xyl
z9o6iqlJ@sooqoLxQD$0OQh)c*v4}a=7v)dzo5+?cXubNJSzmSHv$0To|C3&p!adB3
zqM3I}Fu2(*+wgd^tG7s-l1QS0+Vvl+Zdw?zdGyYWa&zD8mm+Ia)vBV)^vm3MBBLey
zloJ;UvS<98l-Yjl2ivck$Mg?7@U4BV^>#(`^ya>`d*oSr+HSC3eJ<~I<7uL8U(Y@(
z34_V9JnM?RUNb#uRI8HK`<vBp`rV`2S??c~|Ck^7OixVSm4S7(GK<N_NjnaOuB?nm
ziM=E6{CaF(4%fxfV7*;C!ee}#w>A1Wo8C~a{x#XUVV6+-wvU&cx5)hpS?(m!V%L4@
z5BJ1(WsAPQdKulhr}cWLh}CI>pj*#375pwv?XZ*Nm+&hN)|>J#=}P{Yj%P8)`Qn!w
z&)DE68g@SYorBNo%4YS&fnL2!4QDgGvy5u^z4&9(YKfx9^9~DWvYd4&KGVVTNOSTb
zTYmRlTim?Vl>hAgD0=8y;V$>nZsn$@KTNtHc6w^s)(h7-CLiOA7TEo2#@c6rHy59t
zZj+QJb^Ume$4QTfF1`By87-XO{?FG^JoG80<Fv4Np~0=rB#+tMi)Qe@k!5q;!1e8z
zdq?vN?&A+dN|bmr>;=l-7F6&onHIXQ^GEB90-wHik6VIkwQRRtHM0Nr<MBp5fr%bJ
zJWArGXcV7*#kTn7BmKV5?7u^vPMHxay1D$(obBtbwF?ypJjfLc4w&a;{J%X<grjm!
zP2h8L;k)lR%N9OvYwId!bF}!zvD#sQ2vbY1ZratXsfU$pI8H5eT-u^E_0u)s%QsV(
zm@9_Ae08kyda3@}8jbRTk3X%iJr;H@mw6SpGD>A<`pj0lL?;%5t*2fYuH2rz>%@nI
zi#?AoPR@1sxNf5JvWMGE<3IYIHk~PU?S@#JW8k+9#r!iwRN}QHe3DqtpIHC7sPpaS
zPW5RIv?VfZxsQdL9oyNtch8ZUl@;|<4`-|lujy`%={8@lU7zD&5g__^_pCSOvt!lw
zlzcmT`|@-D-|0Kvb0n7XtW?vwcH66PamxQAb-$8&Zcp5O!0fx(#v7&&_xbGdo4xdl
ztX_KaPtLjzP6=+4eX`aBT;bL)GOH=$^;&gK^JK#1`b!4aFIj&}{qJOTElhvqFZDeh
z{$+Dx|9(rWzIb2Yphd>POB1ECxS}S8pWW$R+17Aj-pu(AFaBN@bAI*gHs1|vpKrc>
zTH2)PlV@zZQBbe+#SjPIHBNiFbQw9KE%(3Je7|_M#eRduWy;<My`L1#<!I2?&AHY)
zr~b*u6VBbqo1dCan9RMFUCx!!T4rj$;?6@{uVSD2#+%N%`b=o++WzZhD|EDXF|GS!
zQn}*C*`L$JSG-hvRyW!Be0<35uQuLsy4)pKSR<uYvaEl8`N{IW$thjpUR#1MhO+X_
zN|E{YJ++c)zTCrkX7eB0F-^L#`gnT%S*N`PUrg8^b3GL_-NQG(nmyF^3eyX-7aPvS
z+|;j>wJwU>WA&HSENaVQ`y-pg*)}TXcbGH!2Y+L6xYD1a&R8BAsefhDr}_6yP6zg^
zzxlV7ch{?T%bSBAUu>7RTzjDSE3f}X=fx@~6xTZMlUpfgcSVMKz1w>B_+;yg`<K*L
zhg>`3R6Vo*<p<@5U!EK>{B}-snw`uwRo^2nY@1y44nFtdTJcO{)7;#|4~CnJ58dr6
zymiSTX5+t^zc;UTu9mH~R(n19{6WQ8-z+8A=RZ_`x*@Aode;i|e>bbw@J{^r^7y+4
z!nSec_b2S&QoQ}*Pp_0v+-qrHp0^Ga7KeoO@BfOvHm&B_#`EEUHx{ia3@ZPlw&hKv
z%i3pNlMYSp`W$m*cGk|w-@Vg{szQSTE^g49eTI2nOHZKh<<37_Epz!aUI_my)K{|I
z%BS%%^ASgbR7O`8kHxb`X}PnPYiOt~d#0x$VQ@t2J!5cAqDTCaHSCJ<_xmo*zor?v
zeTFjMmmq&H`w~&ba84boqN}@hIQHH9@i;#I@;To6&9CR^Om2H9q_tz3ot&_TS%t%_
z&7#^T^0eZ_CY0~X>zVqBKfh##m;kSC#pfiqhp`4K(<1r;Ys6%wC9JlEJkBwaHF{;|
z&bQxwTY~1ADKFxhz8V@j&ApSLo_Ff$q%>v8PI<0lpDuiB(79nUmG$ki2{H!3D+3&_
zUoRGs5<ZX^xg}+8_G+OissW~F4d<S|!^oZ+ZMW*$?BF+gAJ%EDOz6Gxv?gv%r$$kP
zo4LjI&zq*Uu*uw1U;4)2j<of>Fwa8Q3HqF|3c3-;-`3bN{_&Y0<<}whM%`=E=d>Gk
zoz}+nLN<+h%Gz?Ax;s@?Y+D-}vfN2|qm*{3pU#%bw@eMK48k!t-!@uDtn9Xnd~UWk
z-at2C(w3f>CvKW+ncqLzwr^QY1mAHX7uEL-?=MbbQxP_fjqkUsvFVt-A@af%2eFs!
z<?{Y^G4(yWJ?AaIbFqDwIDhUt#vnVZGnej0lo%;}ma)CQ^5lgrf<6sbHMcX*3ryWV
zZF#?2NU6y-D}R3er2(tTXEXThnQq3TGx3vN>f9Y`H}*8WvSsI3+twE8@Ipk4?_1g&
z78}!tHifUh%zA#-DeOX6%C|Sy-^Kj$IuiKYHekI)se0@bFNuWM@2_Q;RxJIZyy?x#
z&v#hsHfldQ&Bt)=+_#n=TB%DX{GGqce;#AKTCGu@;v-RpH{vSJ>RMOMe7oe3F8jq?
zSKn~vq>42Uc3zw#(aW)Psai~$$7II}mZGQG8p)|AcjkKdHdY_&y3-_J^EK?{@`Sll
zjc*0$7?dV1T5S60ul9oCij(`)FW+u?WMIvC?#YsjgH4uua!YowZ{D2v&ckYox6sKo
zJ5R~)JQyAz)%>~PwC_vFSH0`pcpe>Ko|$W2+_TXw(%o&wv(wY2E3utwW;mg8XYD?p
zJ9o7nyL`Vc^2#z$VO`hvKPULkSga2GXfAm8wriH(cX^SO^>b<-RLL72?|XWkr}e~>
zgbwR9SspuoM!ubO?}BD$&I!?+Epqc0-Q!4cE<a`&nrU`_otg5P`kfpl2DSIvc30?W
z?c&>>o!9cou%KQk{ojP!QNM)t+WQ$Sk4R=ZyxMr#zWJt$4^Jw0TjQf}a6w0#NxGrP
z>ogsi$LBBnn{i9kIlaxB?dGZ#jJB*%d!n9x-R=K&591YkrtJr7+Y+<NdR%vkOUUf(
zJ=)`Ik^X|^MAoG(2i`Ahc2cdBVz+yA+i-G__0No~9MhLU_Uk5E9Bt6g)P2`b@_62c
z!hX(<%UbnjUAYZW`LRsWMlwH_a{X~)EU3FH_Eq;|?oLs+!mGVk9*1rJ{k3yqP>*8#
zv0Bk7-fx0_Ysp+lIoa+VlT_t)M}gDW=<39K?Zr1*cEyTE&3}8PW%K34U7gRiG2X0A
zS-RTTaMPhbk!k<*kFEJr)MV!FvsR)&$4z3t;bMi_gFcnVcD&1J6wy!EXmG!n>+c3z
z(JyZ%^K6aqKQgC0DX5h<#z^bf#;4*tej7>b^(wHCy}97-#VucRpR5qw-Foq&%^XF+
zOhI7|%_*OK-E$RkCAXix6v-RD`sFvn&?Q}qj%)w9t+uDb>q~9OlXKSjQuT3Lubn^j
z-HmT48}l0NH<3EKS6c_)_GBscTzOrRNt(Iu@Up`@U#bMJTzal*g3P~KOS>i8)h{l0
zV|(y#QOuut%wZ=dNnKs3SyyMYPh#%>|Bt)d*)wl+FN=C+n)V|%fBKS%%~}-}FW%mH
z{h;xx`nubfS6_dg+%xy;&BeE`ihMp(Zd%vTKF3*8G~q;Lc9klBRn^mwp2s~~qD<G`
zztGqGyy@LW!F>lA@8>GBvi_SKHh02>ji!lpVLRV!TDNWX#l_8QZt9#an<95S&+lV%
z%Z#U=e`=JhoT7PY?$+gN*6%Lc`;YIoYJ2%i-vc6y0;@i*(ePgSq*$Xq|3%F!_bcD6
zd={=P_)(GV?G(4Yv&?*#$XksP%Pm)$^_Iu!@0v5|_k!1<u`!F)?{7P)e^T|bYO+!9
zk}G$&_Z&XoxT5bt*7EEdN4<jtFI?C&b;be3b^l(RjXq)|vpg}OK~yTxnN2BM;CAGZ
znHl_fd<q&u&Xy`d4Nua9JrXax|5CE`k+td_wvb=?k3NOj=$w@OCKUWvv^ZPZ!2gYK
zf$ePmGieV#EUetP@y*_^)BL}0wNpHFnCI;$%c*Lv5%KEsK@*n-9J{|~_mK#pr>g&E
zEDTcnE3vU?)wSH6_uBaOYE4pZIJ)i2Hp!-h^w)Dj0wtRHpC;}SKN0A!9eiA4$%bgF
ze~+8qNnTv`)b!qjz_T+xB<)@@o%iO3;^$TxR#s|%ScKMo>J0yow05^hO3$QSDur*a
zE=_${=)f_z`#<Y4dyVTRvl}FA(mi*#?9bW%(avMurCLGtlT(kX-dX&_;g8aiwgy?x
zyStirU0<7}{j^??U!N{LHziJ#_uHnMc^U_@bf2lDgdg20bZ7RSZCwu9VRKBJ*ev(D
z3a)i!QOb4IN-16t;kP>A^I0pIo%;EcPT$lC+qLqNTIACu8L5`xmG`{U%nk^5n}3k~
z!ME%%1Ixbsf7L_I%B9Aq?tj1NZNS!kdDq2Tk{!Bdd7PJz{g8BAaKb8%dl%w4y{+~i
zWtV>(V8}Kvr=WC}?H^99-nvu&p4VG@C`XouPJVdkhUwjp&K%3SSw2nokU64u+$l|#
z;pnQ#&aDL}i+xrcm>PKf+lwDcQNeFgoS!8+B<=Zk<&TY@-3<9X>p8!7Stop+<nl8q
z+{AMA$y&b9WsLui^v;i6U46<+^qh0#n)G!ZM>kA;Y?tG)h)=HIUD3B@=J08HFB9sg
zPS=v_eZ1YIY|hNQby~8Yu5Q;aIKSp;o;ruITD8LOQ^HI24O`9yJ(2ZHD7BI`VsyB7
z;gM>0%(=zEMJ`LPublkDXW=TVRGVKdU5|85E5&8bTavu`cHQF*i#M=8Dz%K_$;o@U
z>h$H?iR`f_PY3PY_-yTs4(rm(@)K;?bmUgDO<N#(_KI<o+yo!RR~x=-wya_nzg560
zc<mJHvcqp2P0RW+_Zw_{;Boieh8LddHm|O^uGr+3CHe8TU+rnXi*?fuA2=l$AN#^!
z3in)I1F6Dr!)rA+%`{}oQ@6#Qn5*^oYU8fEx6<mH<<ll?P~F<Q?$q<m8IHR?&)WUb
zBEYNZZbyQQO1<a52bsUQxIRpgJ6Xy%)!P2g;g7B7PhD(VarDgb($zZEv$Xk)BVwlI
zd<>s?_*4ClGeXq|r=P#TeaeEx_wlzM_mwl-zIe=$4s>g9mu3GZD?e+u|DnABit@8d
zN)MIPNF4m&sPprs`X6(PAIH-3%1n<fV+xuw&;H3Hx3}8!UaQqIzKf{2bW43>%cY6^
zst%J<0_r38E9xH(X?(fyAn!?wNu@Izeotd-p3(JXL-X1XMWr^2FW&k!XTP-By0d3?
z^Q|nj{<4(orrQHHmZE~UU$pj!oKSr<?Nou8yLqw6q^9e}e6Q<Wucdu3UVSV{;z;P`
zQ^zKLIbOli6Qt#8^dWWfuVsq-lgwGWoZlFq5Zc|T-(jl0D!7K3HM=M>cG_kI*~Xsz
z)&*@xclMm=<ajAoB)R!huS<+Adu-6UmCxAiCz&%R-@j$B+iA~l-IvNuQZw6M9rwA@
z&e`s*^@d|nL--A!u3x)m{I}e>%8a$GU~lV8yCc?zBV!%-OLurB@t2&-+Lj^1<bG(=
zJno3{G=rV1TuLt=JnlOq?#rFP7q)hPn18-YF}7b;b^pve!`0<8F8&WM{8pKv{mRlr
zWH$e#?MYuBubA9(*kILEjcq$5_jN6n%9=7q(R(rTwT9re=C@|dd$y5je}2G8#x%aN
zBd0Qyl$w7l-s_t9J1;igES#^OJz&c8MV)__IzNy6^DlbmQTysY&+?b+@4LMF%?!T|
z%k%>^b>D<Sg&byTW%GwkbWpyeaBN-b{r@?kdT(V9_?EUTGp|^a@tIAr@;TR*&9U3A
zHhfqatTUZ$RXr=iE^DcbqJ;F76BUmof17Z8QO>F&=LrYRzInW?`Vbdhz*9W++@<ax
zZbo;coTM-8x_i6SHDM-C#Kk0w#q7`f{`~v0^W1?WYLC~=?D!PzxH6;F?4?NSg#HW0
zM$swB$1FdY?v(qa5a7o9N^gsoxgKxj@jpj`zX!isUUbkue~N7To`*5JN|dCvXLZg`
z;E8`Q<L43M+zDn!vp#P8ts&gqw{~@4+&zy!)5;$F_0q|k^l5AMLvfBhA0vWa$|~J_
zA(VFI;j7K%yziR%;!+GJzvr%4vUr-(+h2kAbeWs}xVc8E%~hNe!(vd7)OGB+Opt|-
z)y!kXniUQYUo>e?jAC&UvFa>bab`)OZ%E39yh{w}J080nZR@Z26zv>zO|q^fSM*7p
z3Rm=O;ltGyAxV!utyY>ZzSZbjY!Qp7w!pfbhbQgu$_l$%9B_ndS)ihzm9o*#YW}!6
zCpdMR9P@Yd>MtvEcrsPI^+l`asggd)lT}YH+@38zZ$`txoqe@i1C}?3`~S;YpFQ&w
zuUGV|CXZ(_-+I%S^le`8o#dYR$KvLPg*P>O3U<qyUeWWo82u*d7t<>l$M)y!_3WXB
zC2D8i?mBz_bXnKSA4-}WADMGczKj*Nns)4>-;=u@{aSM0&(58qw@m%O9m_`ty<Ad0
znhRfceipguI4jSgn+444H!CQKZU0t&XWN?{zmm`P-O%JdceBqyYwm`-2lKez&ENG>
zYsSe*rm8w_%D+4&NL<kh|9pt;V#pf-g}+OdG_{#Xt0yY>a;@QfRjU8<EnoP3$H=fN
zRhlnvMrPQ(`FV|pGvoco;}tR0f9{xWv#tBq`%ZVq(gzo{=55*ZuiCis(~qM!pS<n9
zyt)2Jc+a8ZhlR7&{pUMdzwmu{R>pRT-Y0Tv9Csc*^jz^o@5zf3zpik8yTO`azcusk
zxru8&mK?jO_t@v)<G=H?I+ILRRXpBknq%nFdD7M1bEls5xxAuvOiSC2zx@@`C--#L
zV*k|E+Pi{c@gHrBKg`RhJyEE9v*fX6@q2-_1?`eLCifLTx=dkeb1iH?+OW$yf33sy
z&g|0F>u#F9+sG%d)#k0YLJ#|^pzcqHidQMweLV1d+kVUcMtfv8x*v=yeRqY$TFIZc
z%&%wL!_<uSSNB^km@>avv_rjG>o5CBX(OgdD%(Z;*}gh1%QSb8%z1M;De`WL+}Dc*
zQ}*+PSpR95`=?`yTuK$^8sP;tGGY8G8hqCc%kBUEy}5E>`9#x1&25jbacs-_;_|G-
z-^g;#m4lD2S<N?4%FQvl7!?rkEUDF`_IA#VyMCYE94IVrK5?vEDE(H&l-surdP)|p
zvv9idY5tWs58>#wa;23o<KvPqFU#)u&Bqt;!iqbi@v-qI3G-gjHw_JX$3(3bE{sUh
zR?tn*uq!NBT=}fBc#XlYMLs(mH!t|Zrt;O>N+$K(grnhW%x`Y%m(uQCG`H%=<~KnX
zF0SX@Jkw`Yxq8Z<bjyW@>rP8b`kZTh@~_?Da<0bv2ao@nyx6Z&eDN@6&`t?`<=tN4
zMw2`0XYG*cU2=F@(|U8&=B(T|C8iIO?ds0H`pR$QT%#EiKIy<~N6V6w%`$z@HK+MG
z_ZF>~+59ZG-lb4i;_uoWOGP$6ep1M-e&yvh-52G5n$8qScK+rSIjeJDM96*Z^>Bqv
zp>_%jWh@;xAGv+1%~zvvqe+U8<@#-xpT1QzH`;z|QPk~+`Ij=+^%dH@@-9hP6<w-a
z_CsX-;l6on+Y^5{dZ>rEFW>eo`qumhk5ArMR_*1W_&Z~Mmycn&cucshTu!Egb7oB0
z%VWE0r)`zo`}l$Dy>P?O@+m$tjSau~?==3FUn95lT~X0A#@8C@ZvSK+?Y?fD_xH2m
z0ngl~>O*(Ll35cMh04xRd0260$wY@m0cuNMEw~@RB+M<~CU|hq8Z}!1d9RB$Z1o$O
z&1`l(<#{h8x8y;H_m=Kk>7hB3zZ{rx`>WRa=j|EM2L4YJ8vZGG_x$kQmbHif<D`6*
zADlANjl2C%uh5A+dvxvcud8NHyL^e+d&jXmRabXy@R@A*-c+VEu=vg^4|P`?rBjc8
z+E~Vf`!Koxx_!8PiO+%$4fSS)0X|ozZ1~KtD|s_o<X_>#1Fs#bTNx*wd}wc3_3_is
z)9+t=dQuRa*JZDMJ8ibUWzg9LaXVJYcf~%w{Ehh(A9t^xg{5iaui^u#X6KK7-eR&s
z^mJa`p>txI?{&5=H)CY5N#HN2nsV!UjFES}{)ErL5h}mRE*&cCk3F8D<#a)B?ZfU<
zyr+IUl>RC36qLz!-7FmHsdPJGL4AmY+zC;(*X3Q?J|1{_swDD$u7dXTgA7}a3LceQ
zwzTy~<eF34j&_7@;LxZF_<F8MZDXQ=%f+UU-KCEneNhNu`TB5*z|-hwCH}Ia{GF^9
z*XwA!uyENm^`!U>+X?d@p3ZOles{^SP*M4^>$BE7Un^gEwoEHmh9{3v?6d3wX-lyM
zYfjY{3B0`feM;HKdoKNDj%EK!t|T_QEr0d-#~bx)49||1R9h~19<pxx>5wF!peOU@
zE}eDCPja7CwUfib4T`U3d;hST=y`Ef!R!OfV&`U?%O5V;>h@YeY4TcmSLFwMFYZ6x
zH0#;vjPEBduG2g-Z;$3H=gjMGemJ`&OLg)rTm0PrP~7Ep{dcDAIXi#C{F4_a%hxZ_
zFL;!hE^>Q*)6RrH(cDt^Isea{ERfWB?B?RF+hRC{_DEkW-FDbVfK}_to~s8f&P%*#
z%+)Qp{<CWNJI=Ea1xlW+1z+aZAGs+1_qpatEBF7AYC<#l7GGD{u#aocvvtp+cYQSR
z^1W%SW63ILx<2E_3!hX+wvAo^QxaL&`;zQ+Hwe#}5-B%hgVl%aYTezB{-#Bq^V)Of
z!J0!6xAH`)dnWZ8olCHOY?;4NM6^%6m$x|0`^MoVuVrTQcZn3Zus)Kp{d;+O{9i@O
zu+QDDK@9UhO_ba>Z<pG2<+{_ms%F`5OPA<fvF10^Thj+0<?kMst&Tmm_yOCTsh&(i
zxsmPN;miGhoSVF6lW^|T-0vH2^EGQ7T^v+WwAEKq#^%DDi!Xa}RT$@PRFf}u7w<J*
zo@9J+Dr@qFP;blKzd8QAh+cIua7pN7X78g6wjZp5c;0y!I+RSDa6e;4RMHHu$iK&C
zvl+}$J-_vEa-8)gIYS2vUENZvs?^&qc9SkyR$K0^sQmUuBHT!JjakwgaqGI9wI8Lg
z-LqG*xc6X{%l9o#>04W;?m8fln7Z1kwfkJ;t!dh;uFSiwC)O9AC14!=F6^RfN7BOM
z`fHN?k}e9{#5qj%&Ho~FuC(dsreiO+D*L#)T)NS7H!{@m)x50ZD}U%tEpgah%jy08
z!|FGur@Rn~?@WKNM6WJ)7jNAg{+TmH_G_(=mUbvteaRzIRBB&u=@@(Nq-V(Y$MtW%
zHa%Qjag1O8=5~RE`SqnW8xQa1u)DnL#C=!qpS%Y`mL~Te6xeiLc9*)=Iq&4RN!im+
z`F6};2)@3cM&Pc{@<qbmI}G*rv`F($`oDgv?&S@+!dGsbzwEPfQiGyNc*;Wuzq$kc
zKA}^ZcCGrpvADba8-MUZZs)0%mloLTZTaf+IX8Okr_)8#y!M^TU$yF?4&VK`qP!gn
z{f0IR9ItESu5XBW=3Dh(`Blb87EfB|Ea()?E?i-tcH<~>ardLBqS$9A&-=f)`0@Pr
zIec49-DYak-JN#8J5qn;`sN=|i}!rvQG4_!{on?hJ|{8jx9OkCj_}7l^(ni3LRWdE
zn6>BSy>3(4nyNz<zgN+4o2a=@<__o9v?mWPmLHVyysjnq^nK0YHFK{lx+suw+A&!C
zjS4HrbHC$d@@6Tudt(=O_-<!e+#0dr(5ppnBYi?HTKL_Zb4v5kKXyB%m);AT`@h#_
z2VYxNu6E#{akIpUUo-VmRRR(d7O>rKIz7j#qv-j>*a_9{9}9!_t^ZaL&oKG%^vus$
zJnwhc9iJ@|CmX?O`6(hq*lOMimOP1<o}Q~JdD+z?np*Nq{A~VAylr)G((BhZb+%Yk
zCcM+gKlwQ9X6@CZn`S+gQLT@QnQr`rVa8)cp{rRpbRJkUoioy(_HV_pnOr6FUlbKr
zc{6{wTyCgg@&3`?J26L0`poN^E#JEQTXo`9ckT%Rao1i(<|VrY8=O>21l0B}I`k;!
zsF``vey3$IkK7hqobe}uyGbi`gRiq$;`b*ig0nBL-qu=LQDU+_&6h3xS>?>dM*lLl
z&3*pm{6eKghb=$I{%C$HKlR1pIk8(;KW+YSWr>}ig@M|s8*OK%$Se-MvSRaQ?w>lp
zOypvcR*Iimp||DXffE9LaZ9bA|GlF>g~#3h(HDnchq%ml;RXwH&MZw14tI#ml`Mai
zaJ_EDE4Bl?#*fNa%paI+)BK`p`(gLZu&a~IocFIjn``{D<=v`RdDE|6cDx(bnjHIo
zT}G%_cZ>5C<J0cdOkqhAcbyDWzIyoFue*8=)KZd`^WN(F!6sxISe2*5Wl@;s6sgE|
zxbwgb=Ed4fhh+C0oXuo;EoEPfpUM&yZ}GCA%Hw;lnYK;3bT8K2)!DK}ZccefVG;X-
z^%b)WpZlBKsYoq9ywK#%WOI#JjrYd&c`W*QmzE!R*0{#mNWg9N)6z!9>8B&Lw`r{E
zxM93t?ceTIf5rGOs4V2k;N#3{{Icbw#R;#rtUH0fSY10gV-ios_^ZEcQ1V^F*~7K=
z!A`?_oboBkRRYqg;Ty$n#&_rX3LfYe-e~HvFXEZ+Z`Yu+X}4!NO<3R@QPslk7b_^X
zT0-p7mnH5ys*X;#J3ag4vaAUwv)8Xwwp*uk_F?m6clNlNNuGz^bVfMyx9PBWyu5Jj
zpwEHpDW-e*|8~FJ9>-9yEy}E%Gob4KzrXo`&Z&>G88=t``m=NLRy}{cME<Zn$EFMB
zxoA&~S2EmEVi=b^?|tUsW6V|`In-Fw?axH+KHIA=cXncn`hji6&8yv)R6bMiuGr`q
zJ2^YzQi-&%F;{f|dBX*Q(Mt+HiSWMB=9Y+en|}G_CDRaR#p-i8^PWmxO}feUfuZu+
z60?-a4~~DkBRTWz^b_ANd)Xck^v(Y$(&>G`>W9*%pHHlHH9O*_wI=SWSnhi!@^4g8
zSZ~Q<bxrX_&64rUE{PRSa=Y_n!T*?Dr-SECaFN!T-u?R6BQ3ko=(72&KUI4*Hj3@?
ze;{;XPjBL!ii>T09o2Ua2}h_cI%+rb*=OgXX07Xb?tiAYDSv9~Ud%ncw(>&i!`zb#
z{#x42ZL9BI;B+@~U(=ezDL2oE-n+Y|*imk;e^2?9#X${M{}!!1d?s^Uqnu;3QSzeb
zP~qMykD|Qz^VdXa>{FC8JjumaA-hr3Q$2K1(@BF674>IFr(9`YTofa!edXlklcKV*
z%UkapTzfM3@CjattM=WSG-j}de3<;m>!>o{h4Qw><%a~0YRMiv;^X3OkUV|wQLnm1
zZ?gHFb@^U5F&eCWY+>3LFSqW+$`47i*X&v-JfBNsW8U`VOCse&;&m>4T$!}z?p-#q
z{oB^%%z3EO$uOt0be8MHJv(Hk{5;TgQ)pJ;#8(CH=CaGo3TP}^xYK{$L-v!Kzi$*|
zfAaLm0j`;g`IH5NC%>ItX_0h5z^}0U{iCXe4ej3)PdXZ`Qkr7E>Fbq(pBYM=&z@WT
zWzjjFuTlK>rFT-zyV6PX!w&mSelfH1Mcaw{Cso#b_?7&r_)l5vLm#z|aUJhH*e4i%
z_I|v)$DDWNX3Yn}>Z$7%m#*vIeY#ca#k9HSUWvVT+4!*V)4CnDk<V7YwDG^iw(ZVg
z_mkp3bZ=itWqthp{nCWR4*OM0HyXW4_MOt7)&Jz<oRt#7uCbdQOQ$c9T;MZV=J@;*
zsU-m{KB=VwOB}g{nq9yBJ9p8o?evn&YnyxSRv9HcIk4IwOj|WdbY3ZM$Oes@>o#d>
zZqQ-XOq3N|c5~G=wXa!*+w&eeanAizp_-GhdQ*vJZ}~hAr}G=4QgZHp-mV@VYN@>`
z|K2>i`l|EEyUkTr98mN%x#tz1T0T)lSTQazv^XL<(0Gx|+xy2OwQ2<3US!%Vwt0<A
z>75xTg}%OdCHr#HdM?lGmBPCdI{34gH*m__$!$5mvf|Vw%Poth{}U5@dU#vz${Dv?
z8fyzb{=7at|J<(iC(HfV!``nsyZzC-q6snI4d<??I^Lc8Wcyp|v^$0~t?Sxa*gj1Q
z*{~|qVu8ZjU6t!Lt#kh#{k!Brit4{BlO11_>e+t#8KAN@VUEz6d$TSmoyqywwL?>L
zUQ2QAswD?4G_Kv^`1aes@=EY(X2lbZ+8Qng<yL!a-E?uC>EGIOhUu619t(%4tz!5#
zw{z-lb!U-(HM2KMZo0a2hW+<TxwkCuR~I#J5^XN$n(UotslIil$gQ1+Z*Nt;A!MMk
zz<THAkDoPjHkYq^8}>QEW+~r-gHAF`_B}r@-~77o%bZunI-zrvPd#Bi6j}CS7t7mU
zUWEdib`=}k<-K=e-lcatZ(Lorq~K9S_=efrzm_dKYJFrv+>N#8LM&I*S9@&S$oF)e
z%WnUg^%+Hzzs#;#r?h;^oT>iNsmtUfw@sQar5tp4mY&%U)@kO?w7O+|7E3Sc+Aele
zH2M9r%DWqr^`6)4?=_qk==y$>!tq@eSKhAZ&-HVz$vI$Wc)xyrM3AuI*AwS#4`x+Z
z9x1W<_A&72!Y|4`Y-yJYnro9DxkYtloRJB8vc=SITHY16X0!dD3-4u^%N%7F%va<4
zzxd0~%O^iy&X2RN``gd??5M|aoud&6d=_4tx3d(i=HWY`?8YPQr05<{XCM>GXdD0F
zkNvTuHrJTmFEB8gc0{TwFttLYu=SRsgXe~OPfRByZIn@0Gqre_p}?{2*c_ctMV-nn
z%0?C^Bi|G}__2jYsbcXS=Rb3=vNb;_nX{t&9aA}zTtq)#Q_;VBEzeyZ)#Y!T>+$aP
ziRHHq-QO%`_miD6FRWMH{%Pr2vs>FZePkcxhRB;m2%1L3r>V<7ySqL3y(@32#_3(#
zb6zf~SKsnlWa;K6cE<C&_2YWZStfCKF7(RzJv-@aqUQ@O*6)eYp^E0JOH2Z%)y$Av
z)VX6z<*rv82S4SS^|PBYEHvDAx%4%=ltp^x^0=Ds*E9|)eN;IZ6a4y=j%}pIkrqDg
zV~%MT3~vZe^)Zh!Z(I7bEvrhZ^Z4=I*Q&F1y(`r{J6a#_xZK=xx|d-s%PGAhZ#6G{
zFWbbth3mzixXZQj0-`*f^WBvk80JUos+p9ZUK+GOUVZtW2bww$IJ6&ll{x6ni$0Uh
z#FVwuVVc8Fex07^sf${4^-jrtI%{Vcb4qeeM9;R#Ra->A+dOlt{?nJruq@{bOOC;#
zfX2H{UPm{@OC6V&vX2dXTlh^!<y6<5{~sjsci!S&U=$%6y?ASar^8}f$Da=;=v-j`
z)-?Y}!g6_u3&*!C_K!ZQVZE9+tA6VNjwtn$?ILH>E+soH|Iwk+_2A+b|83PeA2og(
z_2&Fu>9K%!%Fhq)EOwrI@S^Xs(xKzK3ya>iwr&ic%JuWdMHPSJz}Y6XcN9~E%NoCZ
zOLJLV$`dd@VVQEDPIS2Tjm6rAyALfhWXRYQySVbg(x>Yz&u8rHdXn^Ua{i}f8+J!U
z#&7pBN}oL2r0w8~<!2M86nE`7m~@;a{Z-3JyRSZP!fHACq_<C6+4oXIP?;ez^-zvM
zC+9Mw{<+fD;WML*c=T;HmrmR}p)`E!`G%j35#jTviaRD8kBQhF;LVwPT_yX1CI9lJ
z(RtpNMdmLm<({>>V9~VM+F#;NOn+k#wf5*nN1b?;X<b{(bx)OgK8<-^P#ZaIY1luN
zi%X)ny}z+kP_nx1*Y+nGGxZ;NS^S(3m%Na3!n^y8(pw+NEBNe=5O8bYSzFL2%eeGy
zw?zLhC+4;reWw^!>}{^D4paTTHzQVCd1ghs?8~eV{ad*|CO%p<WAE%U(?tK=-lLu8
z_KvqHck=^D)r`P4P0q<NQd(S3rX3UeVS8)y>}GKePOtsP-Y@6Ms-M>_`#SBp-QLCf
zx+m{7d!H7z`0U9IWeE#2c`htVI6LiT-kZB=Qg>tCC@*HS@Dux1d0~FJn4>0#0_#q8
zw}LM1>Qg@%^p!4qiLIIx*%tO!sMf47@j7epi!cl3W4$LdOIkxEe>~1woSc`}c)>ue
z`1D1S+q?Gc(aG9XJN<My^Od$uYgY9NhYIUXnLF)*$<G$Ki9yFUKTw^Q(DwG!+RJGh
z_n&!gxQNv(%dzp3_A7QL`wu^kZ8|E=wXUecw)~#GhtB4sl{fb+4m4CUG`qcO!V85N
znm1N^E;JRHcX6G?@h#hKr)@iWf^BtHw_}Hf1WQzO_0;`m_Wk)JsG~fip>ne7@@-eY
zpS_wpfxVmkllZ#pPctP`MC+Tb%uq0$RH>>q^Tdg#ia#56{K}X(QQ$m#)(eZ@@4NeZ
zy*;DC<#((;H0>bQKCAtrtLA@`K2ml!;ERTpjq@SKEQS~7pKsYba~u2LSIk*?x5{oX
zAKen8)wV+P@1%?3ce;X3aXnKKI{49g>&fJq^D=rBls#1D#%|QxtsFZk_3!obbvD(1
zD?a`BTAshJPvZLQvJ0kBRjU_8thmT)sU_twG1^kpGIBcS#FbZc=FZp>vq$xUVfe+E
zDu*W*OA9wMFWuq2XZf1&Q}=U1mdEd}ss8rr?add<e;#gLA3QzxS?or)a2D1Dod@^5
z_UM%FtK0OdzuNKN0tPOLn;BDMuU#!Ot`gaK_p!%U?yJ}NL*75Wo~U=qh9lEU@cP`Z
zX%BBXeztVn+hMZ5dP~!9yX`@mk4`<`b7uK=D~o+U<Rv7vZBM({)J2_(^1HQrdh3~^
zty_&kHqATFc$MQF$Kj7ruJgUPn!OqSe=x9KylYX=)W^&-Z}|V@xES@ZOGYR~GUJu3
z7O(M<g!YR*yf02o`uXGSr%M*g6;w`W|IO@fz3pyl+V-#{joWIaPFBBWk*vdG5AH|j
zesuoeQ~!85vCMDbtmO(8b8=06G{W|G7PAE(Y1@0QW!tf-r;@c!nOys}bi&LxJ6?3H
zJn;7H_RHGOV{Ya?+<S#px{pnZ^I@H}PWFkilbcFc=-V%?{_*k*gHo;gx3urJ-(~LP
zPT#ubbK8Dpu}d4)@$b#wP_<S@HDvw6^7~P@Upjdz@tWp8S`u>o>7E5&^MZ0MGaLRM
zKW_NgK56&z)uQ*M9>)Fh(#y#7-+E)E(Sa9&iDG55BCqDe|J%Ul+G3H}FJ?Gfz$mZd
zNkCWZzMr)VH~YAV8|2#6D)}7x<p05Y_m4foNgw6;%3nTIHdDMO)nB$*|5Btu<hHq2
z=e5XuJu$zksFmBFS4V8C(t<yFR~P*IcjVrw(lrG;SFRPa>e?|Qd|}n5pPP^L<{c}!
zVyq>U{*JpOXqmyI&bzv&W#5_d?zq@_;pu_hULj`YrA%ojn-}?I+<%~BCF8SjOLK}>
zf66Y-qhE!3rGKuR@_b_Og0=6qJU%{YMO2lX=)S3U9kz$ut$Dt($iew{tmFIE<_R^f
zZtl-QnYQ1Okx+he>FE+?!6$QqzrT-F(V2c@eO=$VpDWF)e?6a>@OsL;rS;2rXWcq1
z6MT|WYr$iSo&F2Y-4ya_I=edH*Z1A4SMSa&m3p&>r!1}E_0JXE^Dg>My}N8rqj>Wg
zQ_)9@Pjl>TH!92E)-_F$_%Na9ysgc{aJ%y5K85doI{y|spr%wVSu6d9FY#T{oQlVN
zbK{kEH$C3AadzpgzjqH>mPb}DX3IDpvXW2h;EEFU@0Z_8A3CpRb>np2&9}ezU3*!$
zquk-PZ1Kd|zOUCM->WX?IimE*_MKq&n%brLU*8x_?0%|nxFW*d?%?j~lbmjn8U|MR
z`_4={?o|;La`mFgdQH9Aq0*60Qd<|DssHUzSLg2^UvCrCYIx0ZooG+n&9E@j-5YA`
ze;;3+zH6Cm{tr&py9Wa<n6tKSbz69{t6x)m`;x5nuR;TFM|zZgD)3r;?a^1Qo(k`W
z?{4@{a8^n<<LkEbhF+Axi*HSbC*78+J*C*T^VFJs3>qQos!y)lChXy|PJVZM%Z$*9
z_)W3vxhLG3b!QrjXn${{<}EwTW<SU510s?+#i0weN-y;+TmAXdOHB@C%h_KiuIIac
zRsB-=(HDP`)XR${j$V*G_;z8JeV6Us;3M}cwVYLzMOS78J~}jM;T+c@rU|NQK~fh@
zcJH26x8!b3=fu=}QAMp&$>N5)j6C9!{<!+LpY&u~&!v4y_VDVwD*--bdmnr{V;xk-
zHq%N@>B{Cqy%S&PO|*XXG{{Z&>k`W?Q@_62@#IQqq5sBJJZD@3CpiQ>3cTUmulUdE
z^sC$(nSMvlzFo5|`QxsKm9do{KCgLYt(*Ab>Vl)U94(Jbjaol_UPI-hKcD<BzP{P#
zaV#~QBY92Mgt(aJ-s_8Bah3R|ync5oQm^UMe3=R9H*c10KBC}$O*Z~Izk20@sb5@f
ztA7q#V|8$2!bz!l!iN(AC)ZqQauqzX|9t*(EiHy=d-Aq;Fclao%nF;kLZawuy~I<F
z(`98}{Gz!oKmD;#WOKNE&%wtIb9>z0Zod}9C-B}c=EhFDn^#u8E~(J3*SB3{TPb?I
z_)PlZwzn~SthZhqlL%CwlFfLfF?nnAFOIqiHqO;PQ&)zHvA?ZIbB;gz{l-q#Bk3IT
z+890Mc8Q1^zUfdA=zrHV_tZ35t{4F$zj*btI_wuWrcG8ADG#45CeClYN<=AjQa(S|
zb3u(6E7xXj)1F#CLHK>b6ZNjb>mgbW9LF-3TvFh3PR?5u^Yx+6=6Pi=|D5(%(|qpF
z!M$8&>b5!Tzslq;tZd)yzjmW?R)~1Bp2goc3+k`@EpnM~@xhnl@8?fEaqd@kS8V4(
zwdV(_E%$m?a&8iNs@3(){Hww$9q)pD4|_UO!b0^dlwx9axU7mh7s~Q{6W=2n{!^^n
z*FEMk&(TZk@9(Mk{p;lBldq@ipWnAk#Us`Hme*v?YirH7&CD&ibZPxdhHdrMWm`8M
zoo*df`RUu&*XjD_)Gpat{CRsdYR#^6`J~<}myKLXB(E%Aem<_Y`q!VxdUvsDQazKC
zj{hlnbAHuMmDS?k4?S&ea14F;KFe(SW!niZ8J$_mUs)!9n7mIrFMn0lI@wp70;E^l
z1$NuLNWG(0eJ^vSzV)2${yrV+dw()R`g#BKMOJ?O^`-rI`fksZ&Bm|U-0Jws{C_7e
zSGa%S#-5zV7Z-kX%v$iQvLe5_`qkshj+bUE;QutYEA?W9j>wc64SS{1@a~k|Zf4un
z)VQW_|3Ad{`C{?;roS=sH_Ty4znyt`+S{-vlXoTDXR*3-SZ<HYLDzMnrMhJXjgGH)
zPwl&vrM4=GdB&{77P~v{QzU1k{yWQf(PV;Kd8(40&XX(W?%#Fz@hht(t-MRh@S@el
zM@x8$cjO+>^DkVOb5y?2zUJrM*<$zB8nDgW#(K_U^^VrZ^?UcIawr7daJ!_M$}>l=
zTU7n3N8R19DUVN|bIW@WX*xBj<*?CXQ=K+;{ns}q<&~`OdO9h(y=qRw)-9`N8?3NV
ziVr?yr{cCR#`>1urNt4kDoY>aZapgSYEI+Zy+Kb@-)QA%+nziU>m9nnBXv)*J40{!
z$Ch*HC9X9yFU-61VczK^wxeyV)2yujWd=^<6Pvki{@TBcuV*e0nAWxZW7*yXHS!L*
zYtoiB8U-GBs5|}4<rQ;$wn?9~+FbT*b5u}`C7*v2r|8LsMvpZ?k$(k(8^V3UQx@DT
z_SR#qxbK$kWo7ehyU9%%_H%cpzm`$BZ<?FsAISXtwJ+Q4sgueYXFKgK{q#3mB-Ct9
zU=S;}y5-MFLL$)y2~ypaGQnE2PpEF$J2yy4Fsky3=D(^fjFmrL^zZ+_c)QbiZ~Mx>
zfmyP176d$4_j+w*7t6y{SqXWnN~^C)WK^G-@y*OvMWeQOtIoaj9dEiOzOB2X+?cic
z&6C8Ud9$Wn=Dt5Qdw19wIR#hI{RjGWo%zo0nK!eoe!_<b*Vqmp%uNwLB<~h<Fh1ql
zb?#GVPcJkt-Ijjz$@+J7oA#YE(D3^8ceA;EypN8iu-f~Y=ZgOxE#RLuQPsLJvZ&sE
zjd}k5Mqj~)7DfsAOD~J3uaDnX`Snd_=Kkh+Z;rKgF-%Fd<lDS=<t(wei5K>+xO2np
z;JP~=o?e@Lyi!dfCFEUyo>b7ey>DXrALkUdzVhtArs`&aud)HZVm2~;kyYP&gPWnI
z<gknRyuBOxy{4<VdYGP$h_0!6C^Y?QD%=0&HO$_<MK`q$a5DSZbws@Dv`E>n_t_xp
zLZwBIENg0A`J@`l8xx;Rz5c~t)AZlR<t7I|n6y?1G^^YSGFtP*+4lE~iZdQPf}Q>b
zj_)0vlc!~`7QH5ZWbIiNVIh|-X{T3JZC|>5hA-Q^E87<vc&Tm3XnOSQi)q8+<BR_8
zHU3)TdF^4~ua-x-m%`Q`W$~L)b^2^KU%F1&iaq_E0`9D4NAH~fc1<+o+ncACr<b%>
zhlbxit-YzOz4-qgm-*+}4(sjJzHvp@ry*7O=bYLlBKEoGSS!V!$Hzr1<leq|Pv!T{
ziLxS+0y?)>TW=9rrt~<)#q7DN8fVd($`ao@3w5o2iOlZaU0wd|xW|q4Qg0e}M+Hy5
z9^109eEP&PZtm)a&xh43_Z^Zw=>07A=$E6{`-;L{?T))N?LKvop<LWa^o{QQg>N-H
z^*&j9n{L<c^4q?7frj7JsKjfxnWv|;NkpVBzI3`*_x8FI`{bwWX<lEnXxiTAW_d^V
zeu&;^GfDH9<M!}PvL{a6OyN_pY0`ak$Z^-jrMLbB{nUCqFRkWL(!>=BH&VJU&Nk~2
zueqMupTz#m$y@c>!U&c>Rzh8U)6_(_HU}9^mk5b86tNCIo|BQfQ}io?&$Ri9r~FM%
zPp_LWzd(M$vZ|!t83z9fRxFaeydX2QMt=F6Akj<CO0CR6HIv>?ymRCt=h2m03$`{{
ztrTpZH+h+g=S+33Rl>1nSLqsy1noL~<Q<#yy^E_{HpeQwbX?0nLq*hJYHr%g<Lf$H
zI$OSTl>U=dnBA3-B(+&?!AC*Pt-S6%*UjC!=RJE^aLWDvwr>YC!a~mQpDfhjJy6Q{
z_>tU}XWKHnLuco=9X1U8l08ZB`Oy+?p(opQ!WR2+?3|i(Kw>hhzpRM5XB4Nz-jia_
zTdsa6JKv~y$VabBZ~BRf1+q(v!V+~tH#@KGtT<|#y!q>aXKr0r3m?7h5pvSs>?Xd`
zr+&holZJ}#76v_*T+JS$7AYEQSh+XWw<P@uds~YBmA6c69!KKuEv?KrmBOGodm(?n
z$%zw1PVo=E_^eC1^7nLmf2SGm!S>{!uanmC#@*fCRw&=Ak{$9S_xk5I%S*4bp8Xp>
zBhw;wL8GVF=e27c1FpWzn(=j);*zDgd!Jg_uYF(M;NSbQV~&o90N>MvwP`m5gO2X#
zzQcR;eTzZz0j=W-FNB&pKU#h}%-8ppv*Y;W$B|oDm`^$DUcK{jijj!1_r-bc(|+hJ
za4a?No*nKam2DFqT&1^bM?-L8?A-~c<}QA+<H(MNecOeT#Sbn1sQ=_`kk*Hg4Luts
zUEdjeG^NK^d2#*~>Bu?<11{G19T$sqmdD7fn7>5&>QU2<vh6NODRTmJ9d2YdI!*W0
zd3*A{;ruw}-%YGrqg*!EtMA+=Bk;AFL;q5f%(jAXH`N-u6+*E=A@94sO0eE|AGgO>
zn$h`q?XG#6lk^j&ug>4^@gT-vt%h8&o^5}_l#L6fYVe5Ve=OkKI%#Qj?AnJ5wk^FQ
z;E);qv$S*8XX&T|mm^l?t?*pq?AAW}wcuNaOLNtV-;1T(Q&J3kYbQ4C5cB4{{`r%`
z_3zL5=OOHM^CN?bxYJt2)Xjo_{?t_bEM`$-kN0s)Wm9D>^t0y|xP5f}ZJ{#dJ>o5m
zw)b+Tu{PFxE^f)PGSNJKQrOBhq5j^3h<*;fdfi)*(_*GN95moRvmq>0)>)@s?CCCx
zJuLgSvgv%en08~o<Q!kg>*{mu7UpwwbOp(2l~+6u4d8KERQEn?x?#@-=D9O}wK(m(
zduWD^=x*kGqd1Z7n^&H8z1O^$6}e`W`=iR5lt-WB{!V%<S}tvPzjA`j+5%A#iHzBL
z`$US@x|}SZqJMgi<}78eT@nlode1%tf0R)6KHVqq{HJPRb#^y{S=aX<<%watBNkhS
z)=aoiRP^UxjFR9ij$KwO_VNW;oc|$nsg`j)&raK;GfY3;5*M!J%B^|xc#6myi{Bw-
zD?NCn%?oCk3!S{s(S7}|-Gs9~S9AWQy+12s7T0clhdrmRlIef{*-2Ix?_2SNsJ!(^
zj+A%dp2X7<a{8d<#0MJNn9fZJD314H)_U|hZI0(trMnAxr5C%`9-gJONUBTZ)Ze0m
zTkB4oFpOsK4^w^0`g)^R;*kzJpJcUZbqw|g4@tQOneO;0y>I=q+o?KpYWUeSRie1(
z^c4LxbI&-`D74Ju@QFAFH`C758$;)8m20rDN%^gObkz^3ULJ)N^QHK_HFO%kG91ws
zi&$f>7COsLZc?R7sH(EXqV%7F&$iofn2U2SFUnc;F=FDO^0c!Y=M#2sPO+IV=hlpi
z)7A!EO>FX!nZiEZQs_<G6#g{}#s6)|V3+m!e|G1C*;yPuX73$tpFHhVy6)z+4cQkH
z+Z^7uFz-DWBL2?sYMkv}fnBlU<=X_WKlmt;{PIJA%%TTdgxA(D)2Z7LJn5-qe3Oyv
z`iz6EP75zT-dm=6%1xb{qkM(!juP{(WAnGgujJ?CO13ELxBSj~)Us^*3~Pr{$t+c^
zXOmY1Bo^+pUU;nQ!)<^5=I{D{R;<~%?T6<idtZajx6PKlns+l3@_q-(^;k!}l#iRE
z#@n--+wIlo+k$su!;Yj+Y`Wq;S>xT8$Nq~o_xC(>meCg3xhtdONbsZ(^%G5XC#F{h
zO`jf~F||hcUFAHsclw?xeHwK=OlR(J-uS#MWmEk$>G-GR|6cq^S~Jz?i*m^B3(4O(
z82hVKCv7iy*A)DI{q04H(zbV=<Z}foX_@tgZMZUVUumYFmF;qwuP=G{mIa!Y_!b@C
zby9KPKQUQh0lntkN38zWbUXAh*E;3dFZ~@S=G<&I(Z=<cv<=5?qXsU<hF8-!TCf=2
zb?BT?=W4QV$&8{adsO~R$vyV$*oSzZYqbt;Tg@wN^Z72$6gs!-a#7^AHHU(af7+y4
zU;RSL?bi0(Y~DG4c4<AAII|_ga+`HR>M|Wi>5KP5U-U=FESmYs;izA$k>K*Z@%LW2
z9$uwyl6;kI){L*}KWCOaw0ED{{Ahb_z}d1*8O1TzT{knTxoXK>%kas!{P1Ey+$3Su
z-Y>_x%A1w!&K+i&Zd3hg1M~DJ^TPkAt-HH;2j|gWLhEmcXU+Kky#DX|*f$@as8k*~
zDE{Qw;>q#v*1I0;KbyK+a@BE-@)KN(<~G&`DyfEv-1)NF?5*DS{NVY$Cj~d{l9*e)
z;$QC)*1py+(wr-5Za;T-+`BsD)@lEb#x7Ma?3`*3soB5VJ4?oE{r~rQuYRvt6#M#l
zyt2X@&!YWDt$zAmKQZ@7?*%!9ym&K{;)rM0K0o?ir7xS^G%0v%mFuHMgG7btvd6X^
z=288UpZ84SZ1|M7rI|VFlYe|%!@;h^c4Vquc>V1@uj>z|DJf2P+B(;G{mOJ(uXz~)
zOizXP`u|{bxhv{7rR3mTmiJ6icMao@t~=<QI{EOXM|CT6&a80EikkRjtKm!6RbO`P
zdR2E?=c`CivX}h~&EFFDGD`CeKR)2S^dVx`?T3$FemUS>nO1(hq453x&_DZE?~_>c
z<K*(*8;5lN%qVq9PxiGDoU>c(`jjbN4@z@Z1^!Af=B&9nvpOsAVsFzfO^cnU_NZ^X
z6X~>Lug(QC2Du&k7JA+P<#w8>-RYs@j&%<gZoj56Rno?;&;Lo*b(f|Yev@zHJh)-%
zwfW0~KOX`mmN~9peRac9ug^9)xsDq{k3FlrE7Xy9UpdQ7T4+lXV~v#DvXjm-Q8hEa
zWS=NEzk0iYYyZv@cRXfpd>HgjG1o!yy7iLHJz=E>9>>28-{G;DpG)hj!6K*TR?gKr
z+mg!NeeOt_8pXK#O8fe%E)=+WSW~AiXv-$s91*_nQ4CVyUe)g^b9s|Zd)hZT$Y~#V
zY>}z0Cw#J?JwzZ`;lrNkl`MUX%$6OimN(x$@m0mHF3L-*yghb>l-&6RXIiCZ88eAJ
z;{I)LN%@@k%xw2p3uC_eoa)uxvBpNbX34Gv&t|?#(YKTR-nlR-!|&%>o0^Re|L=E7
znRR*28CiF;KSzudG*snz&uXrXynZL))_y&aa{kCUc?UfYl)dO%H}7QXv6xN2Rtf7}
znYNboY*%9DB_+8@#}6JTS^VY5wf`-W4paJ9$hm5lopci8`law8Y6gES&!x);eL9Zq
z_pXrAX6bp$$ZP%M?BAzm{MV$T7taux8{qU`;#!A(5@QRa(X_eqO?EA-O<&%4dY06e
zAB$6ag%T&Ontrb;W|O3@)9sCN(|-kB-SW85<#}K2&7DRsZ&^9LKF9jSh`VztXQ|}`
zzffbj*B!Ip>lllw2Zk1J3BNI4R%g#?pW}1$uCwRzi#MmqeKaiSuf6z1^)pYaZg;0U
z)5_$=T62a!B`o##8P{pgkl)nR;jroeZ`3k_n3rn}&NWV*a`11-$}G7Q)6O-@JV_7z
zN`=pEt#!YCEyG^zU}eyI4_nE7zh4<^-q8M1u6|FrN#1Yy)uJUeKANqQ9p-Jn<)g`G
z+T>CxGjVpS)uTzpBBrl?CM2ARTjTid!bhvk?-#ILzK|cj`u3IbBE}#29eZRh%e^~m
zadEME?Dhwr?y>QAeP8lm!TWu=4;idJmm8%B)>_Y8+L>Y|eE-6m2Lh>E%>;QuQl@xX
zir)`35AvGvUM+N14!2yA*4q<Ji;XTmc_QF+?d%a2p&o73JYE@F+4j!u{cnVnD|HPo
zEasY>DP>VU;e(>Xo4=|1_T70l{pjDvPyX$<umAIC_x?Nl7wh9&&$R|U|86<s;NQZc
z{ZSA0{|G8d@Jf32Tk!qI-x(r14_#5>bv!spk0&c3N4%#|P|%EtSxx-^iog|%e)R5{
zw|Fntp(b~R*G7R0_|EkIn*Ow`c-i``)1R(7lCAKi@Zjz*Pdb=Q#VUUHisi5x#eSOc
z=tG3orgb~gL$ABWCU4Q%Wz3`!8~V9INa_3)ha*k9mrk5~mSdvP%FoimciaQ6h2G$O
z+a<4ZHQs}zz|l?FH|p>I)bg5u{cqbZ{LnYN+bPI$tjr|h$&!U?XSd({u~geAZOzYu
z^sTr5rA8FbpY}7qeEOFc3*B`zI={)5$?#dUF5CENo$}WS=Fbz~H8N|r^=ZDYTsD*A
z$=rvH&ZjbDd){nVk{Ld`GwW!;#)__1r3Ff1yQ7wemDFc#J^p9r2~qp%i8(jg4?4Iv
z7rp%|`S3Px^_Nn1-vX1SCz4gs_nuo!+%J<NEaag!x&QlAM(@pc7hE--=}`LS|IDKY
zmft>oWp|rk`J2xL#lBac&5~1J$+E5|qG%Zxe}K>N?fl*|a|KV$b^o?0<c49}E~9Rp
zAiW!(ITq~hkIW9{{cuQh%7<HShmO4!mF*KsEzUS1ysvA!2vbVcy^r5kWqt5#J!F5h
zFZI(ZOMYh;S0S@^?_b<o#J}lX!v+5vVqCYYe;@gs+xzBVQo<@}zKxbv4j=xVzWG*l
zkG!nRhW_d^^~ZJ`bvb)#aaz0n^-dFQ$7O{PrH*YKo@+O$Ub|hIWb;#MpV&e*C55kv
zT8EFY%=xh7(2wgDs_W(E|DEc4bCqOuZ}^Oog)8z;PHpjh;uP%Ap0(*M8*@_c9-lI!
zzE0QLjya#Zo0}QFPZVH&9v^!|;LDapGoPuc-cc8ns1CjTZ0d`xt8E`&{lRwW@ZC$y
zM|um`Dl4MxLN+Gax4m3+B5f&`egC-w(?wYsR@59064qk9_fW)L!A#U$*L}^zmD^9=
zU27ctu(4y((#a21brQJNI#y~c31~VTFWtDtY{UK=6<n!$&O(v`k5=&J-?G*%mtDWb
zFXrWvt;`daG9Pkzn>OEmu8sZQXI~#*|35=PEj3-qe-E3ulB<Bokpn-=B8}#n&bgt?
zG{H)RJLCGPE`{TMWlx2b|EO)3i_76#v9Y(rx@N(fx)*F!D<>Hic1?>Y35xzAv1nG;
z@*RmYo1H(;S9y6||NgwaRox38w>L})c&v6<dL>)H$4bWoJ|!O&FK}r0GCotO2y|eN
zJ{TMkWxVdPxQWiK)mJ~rTU(xZ`}wit^M-?epB$e#wQODB&l_BQHydW&OGtg?!I<-G
z!esR&o%0ps>L)pucQ-Pe(}{j>>LH{$xACXP>B9DhnZ2CcA?c<jMxpsWvy=C+Fv!Iu
zn=bg7bT<9Piwh-2ZN@!;4yOg5{Et2<+;e4GNBHWO_VR*jrf4kUn*Yq#@^U+~TBv>a
zL}7C;!Jhh0i682wDfty}&RDqREKgiyDqG+?>xCX>e5=d$OuA=yX6E6uldsrr(va9I
zdzZD#nCYjXV{jc?QoDz{9CyyYfNimwKE|9&CW^j4e)7EWs%Z@iX3N?A{r2?qmq+PB
zjw->4$?dlBhs~Tt{AP)N^wE$~6SXoh$?0Bk)lg;0mMz8)6;)p!<39dZ%<_m+yT*kt
z!RbF<$vjl~bLA0xvxsq$QRdVXgAH<K2NqUZn_8}^tl#jUr=s=nrGp-CN*BA`4tSP3
z?Ujc0S+<*w>n2@zXnA^JZd!bq*S$QW=bHj;<_bUNT9mU|DQ&mI$BPfz$~pe5Wd0+#
z{&0opJKZVD$JWOR+D-T+dLZLUt}KJUZ+LMYWB-XBBe5?FKOc8zJ7xXtkpEq_#nun{
ztcu)h{M7pA+fRRRE?;eicyYMzL+dGujZ>dlYZ>g$o>S4YiG7!3NV$gWuHe;iJa-*u
zmK=I=@8jK1yj9{aWsBk#2KQ%(UAebhb4l{+%Nu@ebMSky_;bjy@8&#LYA?;4aQmr_
zgzYW96A{4*Li;<;7yW&^!9DMF+P7T_4ut}|DSWwoJB|5ElO-AAgX4BCoH^xuF4LY1
z*3UeDeO>*$-#>m&#h<^M*Khvma6f9{S>d13EsrlBKFRQT#(d}2s8BWY7R|#`UI)C}
zYBcHV`U*w%*XLGF4|;j6dv_zB*iD`MTY*wK&r9CC{A#H2q2W^0T#*M$W?PuVO31D`
z^*Y09cl-virsVTG=JIze_fg)HqZZvGw4-~zo7sf8ubYkaFLq2g^YrTB*EN!!dlxsE
zaK4$c>y?}N@-Bs|%*#8?9_JX8{XD7^cku1>(8G7mnthz5HnVZcVeiUr*;1C-_OZs%
zUR)tp<qm)2(w$Z;%G`74$-}hT`EK?9Eq*e*w_kQIcWw8^*xkv8CN&m^T{g_JeEZFK
zXVdEZpGWzZ@V=Q<xAPv~mDlgPqGyB){|h^nDKeME!+7&+ZRs8B+C+0t8YXdEeR55t
zX7gT?%?2q#Z+?7<JzlHJHgo5K#rv1AgthS0+V1#X&xm@wyo2JdXKLFS80K*@Gbmv{
zoIWozFDnsx#=KrZ<(0j^>mDDQXz=U54Xe`6?FzbGk0sS_y6oPxIOEv1Nju+q2&ebE
zoo-OjP;_Q8Vd!hS_^NvTXQ}5W{bGOJ;}y7a<7e5=&F(4}Vry5gTeoW6>AI4C&u+%^
z$3MvoyK?j4O&#r7HS^N129|8{x-|REhnGKAyZ^qJx${=Y&#%71wtrupyzKnrdHmw;
z**aA-uciu~-PC_`QH<`wqAMvUFRl9U|L^{Q=P$1ZJb#(LX!D|zVjng|O%1*DB=zHq
zi+i-DUraHIH-D`)+h<V?=lfY2nq8X~Ds9!6JgwVx+9l!0jA>^le_b^5X{K>kT=?cS
zr_#<pU=N?6>N`nq(yntQtUo)vQ;t??#@n{PUz`#9#D1-Dopro;X7Dub(CWao>YC@c
z_Q$K9J*zbT)b{)Z|MMSQ)HqbX(_?aNR^IBArPe*he?0!2n!RQb+mq(~hjUK7Us|>6
z)Mfr|pMR^aY_GD74NaYObydpd$frk3r(C(%I%CVmoXS~C<ToX$vDt;4pZ+vw?}<If
zBR?9hKgBe?L`1i6YT}Z-g)gn*&)76{f4WsWZQAM3eJ8Z8`UJ)5f7&(iz5mhQlV3%N
z2A1A&+H^ok-%et^|0?mH?Qd9ZWnA;m->+eBJ#X$hxn`2-6N{9o2N!eLMdXR>J+WMT
zwrEWyC-)rjn=gGiXD1zz_;>v4*U$c$+nk;V_xIdq`gqQG#wznjRfZmpAG25OS(niI
zZ-&G2x~S>CW{n%|rM8v6w8~a1dNR2(()U$SY@&VMq^c$k^Oc*gYMlD$&f4vKUS&g3
z>f65SUp}9|>9%LO#samHiK<6kr@p+poOSB@{pY)Q%recY8MRHD*8Vn(d}182$TW%d
z&8Zr>*dG0VpU-|i`I7&<|NokAuYM~_87JE<e8loWUZeZwYVnS*Cm&7Jvy$^?dDNwp
ze){Py&t=^_(QT4BUN?THRj!_Y-rh8Hl9PSB|9`$O3&XM_XNMLou(`VG)Pwk|J#{J5
zL@J&>y1v<WqR!_Kr5lz)>K{+9S$m;u&a2LKqVL$e4_O@+;EMcX{qJV%@~GEuKa1^a
z_u74;b;iG4R{2^pvKP<k78h?=7|Fajc<R?K&3DENX75S5aL!0mfR`hvgvX-cbV;RQ
zUAV)^(?3Gv{@7kT`Y15O{OVQFt98HM{Ym=t=jP3$H(!T84+vK{oXVqqDu02>zrV8o
zYk#TitNQZdV)^>}aeHhlO)aZSe?7Xp`T1mXb@71pw|=kx{&o8A`_Ei=MVvSKQ75_o
z{%)x~`)w=i+v?lC6#HMT`}ynUZt=3G--Fd^-!Fgvnt6>yOM7#Ee_g4;zoH*c#dp2?
zx!c~Ubh+MzxY)m^zcaHGe9?7OwD{rMTv494eeb%>7q{Pu2^14P;2SZ?%D?^5!;6CT
z$r}9+W^`YAn&b2(nPGKtOR!ZB-~NO9_q_bJ*y?oOqS?zLue$fkpFg!lj(OK1p=qDl
zK0Yf9lUeur`1VRe?florH?R43Van>`C$;Kh?x%FK)@eR#|MWZYls3n1g>0{k&yU~M
zP1T+J%K5K{Nk>KS;lwK8)Y4gNj4U>r2Y%z6!1(>snwZ0UX|uw+rNS6PW&6@^v}T$u
z-rSw-;&7LxLo&2Y?!lMT<QYF5MfvaT|6jC&ea0q_X_q5~bo&?m`1{-9mywjtrlbur
z@!?OaOe>6J4lQ1O(eX<P$NwV{%nH1{{}`C`J}X5={Ea*iSTy^3WJt=*p5Kb!eO4&P
ze|dZ2LS|i>?_|b$x%YPuZvVY^M!NKhE4#ElJXL<Mu1+I=G1GR*GilS-B{nH<j1gQH
zE_?RVPnpc?CfRwL*K{Og*DZQh_v9(N1oHv$Ry~$C6HdI^v1Xk-^NP|<68B9`v#$A7
z6U4a8-$mG2<<F!oJr7lcG)yIo)IMpppAqhHUZ}fQXzyGF?=7b$RKy$$U^4&n*ks=!
z%SiDJmK7&gKb7IQ#!`^XxA*v_%{h*#&%fmR{{PqV|K8ol`~QE^cQD%II+xXI(fNDR
z`eL?jiPRPR^6*Y(o7vOSS$?akRL#=v?$eciFtu|o3)jgU;dd(z8l2*e*qCX@>Q-=A
z)Me{4wd<!nN_OqDJW}>zj?RNxCZA0k+4uX1Z9lo}Ur^35soNqOo*l59zCFTlujh+3
zEzCR>Wfp}Eug+{*(N><dzEARTmV~X0@y)D>OKvh0R<+FFt#23edKD>m#o6T?OMzfZ
z=PPBI3G&7-{3h!+_I8}I^ld({$l2uz$F>ut#mvDQ&dheVn0%JEz}sAP&b#AM$0ulR
zisM_Mc#lzjvX*<?!oIwGuNxZ=EM1f6V*XUBLE&iA$tdwFr*F<^5z{+(_n>ZH0>d0O
z6Af+Q95F_(q{IoLToFbV8luk`q%GKQUDYwWShCoGchkqOGu*PbvEKR5wbA>aTL5RL
z;DM-=Jxgp>+^*T!a8BKrp{<+$^wlNF3*<^UgPgY<IV}G~`Nn-g!8aZ~?*pga@e`0(
zcQ5wOo1e4apL=kp`ui*Udwcg){NtJa;pXSh!GCr$9c2E0$Z<lL<;Jcbn-?CIukw0t
z##*<#{>zK2H&@%w_2D@6r2qZ7xD}rbCfl4`aBKG;C9A6Vn76!ZAJtn{-VT~^`jX$G
z#O~S_C*fSxN5z@jeFUQW7HNKwd{8s}fZX=)k`tEvs1>|??!c=r6UwSWb+ebPFx;%>
zP?T6z@a@&tE{S<cyHhuDZk>4PYL9xuG2X5%+dXT)ytpWPsC8xqbByr<<{X|$I|^ny
zNjDg7w@fHvI(zuml87amnO7s-=B-<={3N(BR>s*s<o_y`e#z)15(UeT+CAoFJN~dx
zB#u>Lx2eD2qyrioShAKWnFb1$*!(;6%W^~G!<B;aD}|hGw~8?aus;%izyAN<)%gt7
zE4H|5ec;?sQhy=H;;**Ex%8V{J1(s8Fn_M;@jtRO?96Fpwhi02x9?x2n#q!Ix*@=R
zvM`TERB^Ay%xT#w-91N}CdoFgn9{H#?y1A1O`JJ5l%wK5Dlq-=pY_G<&67>H7!I!C
z*u;|TkXZR9({t0Yz!D+dhb)elxT@#ecinQlQn*X5=;f@k9kc9iJ>Jk5eB-%?M??;j
zmT(4t-!v7a&PdbX)zdnSI;V+w7Vh<1XM8NVhHHzrDW`qmvYxPnq{>NaZZ_r~O>eNh
z(QT*|u9umv<exufW&akLf{k&yMtVzs{4Q~2arLnJcvbY%w|aqFV#k{PKRBG*&?V8B
zdRb`OmBKHge;Z`0{kFWbs8W*u&}P>+uZx}a-K6#MoE?2ChYTj(@@aT_ZuUu*iUmhy
zjw!9^wTSCa31^u0!|d2RfuohIxi54Zz8)_Ly47D7#BgN0yW8yx(=u)?OFZV6xFhBz
zziH>J(`$BWrgQNq9Zp!7COe&(ZNV<T2}iBdrPl4ac1NgL#(_6e{K=7pF|1~5S23$h
zQe5_kePREr7r9fF^Ie2_XA7INfBVIhaq#Br15=V#bLUKb=5Rpf`fAsEJQI#cvvAlm
zJ()4P^ZVk88z1W~ex0<y{#8{v-(TIF4PiZp?y67l`e5z8?upMNhqw0ItRxI;N}af8
z9N<y>pCI3%tkhz$ea(-?-1dmZ<8GQ)1NrVujp<F`eK09;^E(ECU9NYG=W~>9c6=~R
zjqg>|{^R%O&*Nk5ogU1Y8#9H?XxR<sYq}N{r$RakHMU%R+Ro>ZP&#`FLztQD&ZV+b
zjLO`8ov7N(FU#UN(XT2d+@kBllJ$#cuQ}CWx!ZN+){faP)P8!%IDF$YFhASqSfaqm
zYHm2~!X5u?i`ukFF$(2zxp{(Xtc3*9`aIb_TJP1L;rL|#?5tjOzRw45D7J^@NN@D!
zO4z2tJB6j<MQJ8aaI~rExzh|gIuFz^o!*_qSJ0WR`+@WQ{)+nVZy)@9JN@wY@AnVg
zoWQr&tKt-MziVl6+D!?=k20OpW?xm~Gj*BGB6YaR>(4hXr~L~V7+tsde>z)ty)rE}
z@$jsOx|71zN`0JSrt4??&S&h{^Peg5kMH+gUt(t~eLlV-HF1CK;y@?IDTSvhmj|>a
zx!?Zs<B*4mN0vxfgPEYXQLxaY`xo~$KVh!Vcz<eJmz$xLx5o)9wOcv+15|cBJ>X*7
z;6C+7jgMfZOYNn2j@}gCE3#?&?8i18xGNJoUBi6ZffJlondMFX&9YS!3iyTIForFA
z)*IHj|BIBY;v;R*?yS2O$qRHJPmj(Cy<Gjn`AUInh+WtE%O+}(Ns;wF$?JtS9y$K$
z$j11~n#}qy*Z=jJQ@kVNk@UF_G5u;zd1bR$*+No3Z;5ICqIT0=IODnZcaF!`?k;!a
znPu>h@n_bb??(D;)4xnw9op=_Ct<$MGq%p7jmH{RFXWXlQ|bsSp7Z6jYG}OB&Qr%e
z@0p=k?rU{I|J}X&a(DilU$}C+`Qi5I|Gyr+I(<cX`7W`0<zF19$^{oLn0j%2-{QmS
z;Z?s6L|3aO_QZ2MZ7SxAe9E_APMBTE#?4uMeRpbk*1VAUel&AagaTI#S6ui8rKrD8
zj4xk!>px4>ep|=Wz>bz0scbvD=q=&tMj|X9FV`>xwEaDBp-_q?`IWOyMdSAiDm>B`
zvMp*XZtDil;W)9;&0~GTybs$#KVDGVvXY_meNNbir$6KU=62uyc=V*@J?(qe#ZO9)
zUN+gzb9!>gBmGZFN?+`2%oV0*d9<+AUGI5UDY!X_RrHHXg?7-9S-LTjr{B%nbI>oE
zD`hsX+EnY@0>#sF7i!q1p8Rzxxj=W(^Z7q#+eDvPWWg7HS!CnZXDniB*KCh)He>}Q
zt6AMropm-@N8;|v#XtV>G2DqZn*KtB>6qnmv%hksi$Z0OEie#&a-!mu&{K<DyZib0
zf7<;O=$5HxOx@`E;{6QKz-HN#e?;H;Z)bli6P14d-v{o}<GCSnn~zVtnD9PJc%|b}
zyYDYvYHaZAxfgAH_HAv2(r&ejFD8@+RB5c-F+Vr=%wrD&&+=7%0w>QlZ;}t#C{&*2
zD_^o;*~wccZ@r4Fejf4X`>r(Yj1>X9tCr;|GI=}^kN%=5l0TDi;m(8NOUxHbFYnwl
zRY*N0E`fI?y9mRP^I^+0qf<_c?Oncb>h2^~*St$%Pv-o*7a7lX^;q<-P>qXgI9xZm
zNbH?@G)Y)>b!ceaqJ7uTupUw9S*DuV<oS|&`3%nNuw^M5m_LPIlKHytqw9oU8mVQ>
zyS(ny&og6|+B2`bxO>K?UA??gJolcido_bqI`ZOk8I^0_TRU2F7yNjlWzct8g0DnN
z^O{`@M?j;u=Ny9_k7`5SDVScov`LK3R9)e{eZS!MnxJIamEK#|t31x<4`;NtVXL#%
zPCKzyUTV$mP^-O>;_@GqOxLhFp5>jkqo&C9_}kbAYo;pfcyL)+gnJDi>&bPouTNeK
z-4I<h?_*oJL%;h))i>fM%nfI`ZYMv}RJmZF61{GgZ$%Pc#jLA>&H?R*-4E_v-lNu`
zvBPFtOXkYj{~gxPEEVim?p?{HT|G7EM#$G_uf&9@>J4tIOPxa=+f2@?Zj4@1pLEx-
zZfc09&AI7oJX{368opy`z9MvLhH8lGjP%uNTra0zb2AQET;?ud&3tGs^WRH<?jB`m
z*P3k~nz-<r@vo)JkK8gm!`fBuw7EGx+AZBT{q%z#qgiHOq-Vum{UI8%@JhqSa~>TJ
zw(nQ#TCE#;rI>l`gS8(|H~R6bmxTASK8{e%GMeqXAhB`z2jA6q_CD58u)cNK#+f;E
z&pfWP`h59&;?90}(fa;y?qsj03#(&pyxK5F@9yjKuV>Br7yE0ucB?g~%!!~9fkH<E
ziLPRf^B+$bb?}}2QCH%0&2Gi3{~fbi_4@bQ+uEiWY6ynyx}gy(`1$RIAF5L~UUKSC
zT=tqvw`=OgZxXjwc<(vuHv48(uz3oD^DAGYsFj76(z8|c3}SN@T{8M;l29FSPRQfU
zvi*;j%@IklGm$8B{<3}JEwwLCwKlXL%lORd{=C7HtJuid`}R?mrxsn-Q)29NwiuY?
z=IWfN4|wL&{X~8?XF;KM>KE5`*83Vh359A-moAncsW_j$u5QmR&2HZ_Y%VI{%Ieo;
z7EN^1JTsx^p+(E5h->_-=DjewIFEPB)QJj9g0_XncB^D<JbxwbX~VCpR>tdQ$7WSM
zjXh<@v8dEf@^o(8&dUt3f(LEPZ<(%mcihVRclhNMrak)<&u%uWzPzNh#589rr%w{w
zZ?m&my?S!ITLd43>vAY?vjtpy{!ynTfa@!B<{U-)M7E17a<0~F_!U%k*XpT^2ybN6
z&#633!GCHZe($`o>Q~CgqTS#0jwr<46uH*&KB4{km-@s1*}oNs9zGzu(vNS!)SD&R
z+azV?^&V#r(#@Ra_Fp+cdfDsO2W{+3*DT63@_2C6_`|u`Ppg+K>)y0O&N2Lki0rq!
zT)B}amuSCBV!QQg1y>;d1+Iy;;qMAIy?eiA=WhG1cPV>+zu>#@-p)+jqqF}+K0|58
zzD>U!d}Us=ay~w$E^Hp59TDbhX6$fVW8tjOJ$?&vCztPia+|~b?Fz4$t);&l_g<T8
zRJFEYpZ*t~ckbdV!cJzJopes++7NJ2QYbh=aF74t!^JaePDC&kM~BHTklA#FZNgQh
z%z)eo?l=xZ*NCgym6O&TJbuwqGVQXY?ditWQx}%3*VJZ~Y7n35exbtCOoek+froRh
zSjF`Q;md!jV%KGx=u5bs7Mizdzh96^_t_H-mfA0mh?%KgTEbE*?O3;tw|ff5-RcW>
zg&980HGCCm^hLwx2G^xao{f8Amd~;+36%c7<J+VDWbUa}d)P{xpP$m&zED&lOt@BR
z>RM|V&I_}<WK15MZd-O@%Skhl1fJkehfU*eeHM^g+&(?Vc#r9Mu8p5RYMnYB)O@Ro
z{Z_)l_J2P%8cmg7c%So~;%O%~E}oxynhPF=yb7J=zc8Zo>(bn`tcc^!QleL`Iw|_+
zjd{tBpPBcnw8hi7Ry5TrUyEzxdY#SmJ5B5ItISDT*31&S-7nOB_SR>~qh*H2bvSmI
zIVoP5ar~mJaGry3wCl{fY%b+DL#^gA?-lWOS+o77>MAAO0}Pw%9VUND6TW*O{+IfR
ztW$O#g-4Ub%63hA)%4}EOe62#mzD<G`dBUmomq0@2j|1`A9EMK@Xz1$r8%T^%f@3n
zm|Q13|76y!m-g!8p*d?;XU{yYf4y5RUiZR_J#*Fu7rkoScC&8g*)xmx?tWC4FQduM
zd}y!l&UG%0RXP5>w<UudMGiNt)wAlbJ00c}zfwf-(nNl~u9Ss2S6|*b_$m6QwB?LN
z`XBDEV7qminPtI_s$Gsr?(a)&FD~0?AwA)D+wt;i72i1C-J7^$*%A3|54N=1PJf>%
zzWVxi-Nnn|<WDyK>rjz%Z;9=Fa+Yb4|71~RvjyUA-$FKqx&1nmyWx_`^mjeC_VlZr
zoikB}qkPlM7b}+qPER#X+#dLM!m&=i3&)J(@|TyHoxaI(qiB&R_l8U2fk_)@URm-v
z`?T8}xkcYALYGZWofM`jEqGdTl1>os4-Sq-8}WFbl+&6@x`{4*e6v;cG^MR4T{&+i
z*c5t8{2=Fvw~pI7msjp>QZ71l!R7Riu<~@H+YHSPd2e&49iQJ=;=WL*LObj6%$+qt
z_s^vBMM=HZ@|NzOb0|qN)$!wHO_tNkz8(B?t1?q}zD}BLiIzf@!_Lz;Bm5*jUo>{T
z)S<t<Z1Nwin=I1lIzOD^{f{<rXG*_+C)k(y`=+#&=eL;BOHbnjuHBm|vaxBs?N+`&
zl_~KLHf;axP_?)JD060;+>RZJ6VD!U+h@LX_kz_E4_1YRX(}H$FtsvrbKJs>XCk&b
zUC=S;dlm07&G7zrtM@M$rac#%_UK&eDX#CcJC}%8Y0tPnarf>;v4#2J`8yAA#fK+6
z46S->rmP)1(Q*aXeJ10(EDReYfA2b#CVcq(iro+I@WdD#bXGJFd01i^sbi<7Ug^5Z
zL}S_Ea-J4{*56XMrW$@b)be7RardhuoM-1v`s&G*#M<pSi#gnSh1N>-H?5K0_Wa9F
zY~{IZxbvitMXQBVul3t2U6TI~#y<GF;>V1plJelX6Bn*9oV2+mdN`%VWaq-#ANzlJ
zOu8(ytc=nAVmqs9#+^q`yY_T3y8fu>O-w#_x@b;Mc%eCu1drS02eA$RejKrtEX@lz
z>B%Qn>AUT~n~B!_k4kL4J;eE<8JO8zu6Gx4z1YksXmk1m!`+7B6*&s)9HpZDH7%Id
za^}kX`&F?uPDk$lzw7&dRz06p8M}V7)T@85-+zC(`$MADpTGJ0{(XI4_xbAj{hvPU
z*)#V+iT{(5=ouBA%b#3j=ucY6^08yH;M(JAXFZ-8cAc5zsJM6gquVU0e3tWD*=5*x
zq6Me<uq*8}IS}9K%I2)>zF=>vRHtfcx*PM`75~e>E0+YcZ*}LX)e%rv{V!=@(<QmE
zDYAQgpO|#&{nRgp3U5l*wwT&%W!^f$F(t+6)ECa;+)q|Tdt>s{yh_jJMLX?OuPf4B
zYjo`)Gt)G-O^cVk|In{w$68&<H1GM79+!KobqqK7|D42B$Z1@8Wr>D=IIGvr)k>46
zg*=tIvCE}H{mHJLf@KD`_)EW-o1L`CStO#&@z*!IN#(o8+XVART8BLtZt8^DuDbq`
z_nV@dduGU#3sdhU31)v&o_8p0|G@}l!@F8W(>?1{IKI5ywL^eu;;K!DkJWs-9sl3T
zVs68)YpWuyq?rmeIxnX@lG^q0?IF&MP6h95+#i|FIIff>bcVy~=`_cl#QIIvtKY_l
ze&4w8#KPYfR9{QpnRi2!cdB96%@anuPnZ<&7qdsZe=5sRxn1i2>}HSck(XlE_Itg)
zyr>~(*6tm@4+=cHn4+GmCZC-W>r%qE@#3tUok6B+YClac-sk3|zeFlk<zbv3pYg>-
zK9gOS$(ajY=IRYPzrt6D>ow0yN0miQAIdiG`Qcbl_4m!zqQ9%t+A}RrFPeR+V1|)N
zf2jW>D>sH@A!FvQOY$w<4}Hq7NT~21{~B*|_(9Oc#~CxPc-uT}6%#Yp&HAqKf!Amc
zud8Q3Ur&Ey?Eb0ieAlJ9WVTHGY`KbW>U#49!rR2yLs~NA=ZI(DKOX4RGS_+g)$5f$
zCJWk`W**nH{Sp2;EA-mTNzthS(*nOd`)zD`Oyy`t`O{y&+SCqQ|1Wi-SLWOS7b}VQ
zrjk_+s_nvWEZSmAepugM7RJlvTD@|@yemuGSQ~kcd!7saSJ3gU?1j^J&rOF67j5!j
zKj*yF;&o2`<{6JPMQ`3%7R4_sEH-D+tXC486{j>Tj{TPI-P6H0xyrWPmYIEJyK4CK
z_}It~EUntF4ZVui=zcNd^qa?VqhTW#+u^t6uQ#pV_1&c)^TM%)d}rokle6A^2ywc9
zVxtVZ1KYjd92(zF?Z2*Ycgo}0`89Uj8hn9w>o><Sn%s^MWDYgBxa4wj;$=fwA?Ejb
zM~_HtefjRPV#(tdOK!M$HoxXwao<B)iA$#?N`CRb*}lv!l0StixOE#^9AggIoD^4>
z+B=bT=7Q)KEctUS(gYVay|mn+KjrzwlFKO)1(TY)F6eN*e=c>zVe^#2P3tfCyS49<
z*}t%Kvsv&r&BX;AhhHRc8^s)RIeCsnRk(4v8<*?4ZHd8E*4F=O=CG`3Fts&vFa7q+
zGRnA-A$;d~(|de77U^_s7hgSPP3Lu1$wXeAJB>$o`gXPDn;IVS{Ie?M=-NFyQl3p|
z-aX;dW`m8(m;QM3;_vCRoA*?$U-aH^(qWrJcNVQ*&DiW5@$l!ViippRi{$k`Zu>YZ
zWUYw3`(8uW%cifmGnuD!Z(4C&;pl^kYucjB%ML{ZyErDjh_^9Y-l+f0D5yNqWlxmA
z$`*enEA;^1rFt1J&s}R^xcx?q?`wy0uH(enJpI#`Y)~p-tkyar*dz8SKhW;nnY<Ng
z3_p@*9XOuEB;U=s#md)^Eg@QMp`W|Rj-GESK3tb8IPaVMbKiKNBm20zwVz4b$%Ufr
zvc4C8UHS7+bc?5BfZC<n;~YjOM7ystIVGLHb3(RMBD93l$%iX1#jSnTyT8{H{yhC%
zWwFDD?|)&@kN+{UvHR-(|9G|kVf+tcnR-oz+KuT6dk$)Hi3zq@eo=kYD$uH3xj)MH
z@%O9S-%kwxn7txyk*e+YFc!lN`HP>hzu)<>G(zH<dw=ykzn@!X8ZpbP>y;05nBx?j
zB;~Pq`QmF2Eq!VO+Wvn?cvXGs#QF4%W|Llq&#H|3@mc7b(wuOmBXPP-i{}2{axQWG
zoN1YsQ`l!0FPT}rOk~NqTO~fMyepgg`jgY&?z|$9@3U9j!^U@KzaxvU)X%Akk6X^1
zxNym1)d8OCa+9piJnR&G^tnXmSiQ*I!s+i`a@*`N*Ed?)<bT3CbCXl+3hCcZlX*Ml
z_+EN8d1+Ic?t(p*g5@gjqEGjnV|ZdP)Be;Awb?!$tek=pTxD(>y(XNWv#^o#r1GI@
zX=`u3pUAw?&0BQJ^b_w@U3*jyuTD~XwEE%tT`uv3o1*n3OxSj94)fCQlw4UU5Zs>`
zm@+>vWdq;Bf5+qeHovesp3(6lt?AIO-x2<Ye&2BT?$k2dh`+uudQIE(KHDGmbDAZ7
zRBX^#-@kp;+bti$*UggR$aITg?W~hvuUgP#$-kgDK=6i3b*+bjyYb@WE_=CWb1c_M
zf7JM<mbc2+qlYO|uy9-EC!YOJSfhm;!>?<eoR^`z{eeUOkuC1&pBW@fLRP(&nYzt|
z^?}T(OD%lrH?w1k6V`d88CJOSIv4X?y47`Vja0Kz-HC7(ha;IRn)w?a{QI$K$~?87
zr8?~fnWq@f-IcI<<QL!;A^Mk9yk&~@zmmidtJjL!zqX!VIVmo1i=z3pM$yNYwBDCB
zY+3Q)|AME5f2Qv_mi^~5TgBE(E`i%#F=e)H*c-*o%DYB%@2Zxjs%55~GMfSd-Ywp-
z^k`*G`qv+Er|K>~%q&q)|9;Pm@v$z;*<br=98bLx2)l83&6GbsQvU4z7_9OxBOvIg
z+T=CskGh<9dlowL#&qYGjbgj}4rjdnb<0(E(h4uZTa1D1b|Dsq`z`B?>ONilp>01c
zBA@a4jb)23=+1A;nRjiQz38l<fAVV=W<9lzIvTff_qJ;%zUpo3)w;QDs$ShQ7t0e2
z3b&GzqxVfe^08CA`QhJtX7BITHZDE6OY>^z^n$p+g{B)r%K{|x+rRtF;V>2`TP~e+
zbK$jZReKnW{HDj`^|*FaXuOJMaLAasMx*w~$9GTc#GYSHnOSqlVvc-P{K6&DAI=my
zdy5922v4cA57_FSV(!E!_FiPgZ}<KH){iHSNhc}`TsRnY>w4Ilg};ivzF4<a&SLXY
z!<0!IFIglQq#stS-RR7h`}d1W%wFCz39ZdDLM|&gEh~&n%8dK4S>DqxbK}IC>5B?Q
z0$GyXi{A=*i*f$)Qsk6fAS1%)EA}N~K@CsKd(|S>75n3L8XhdH-1%iyldQjA=!>6G
zpVzkM_&q6;=!?~v@MppLn5W{#GyR+R=5T(Ah_jCPzW>wW=gu!zeBCE1Y$~zs#gg7U
z$#qdhO+1S^_wCPId3X8e=}IQr-?Z8{2Sv7Oym|1Wrta@9uamdDN=`=>N!j(?@wj7n
z!-`v(Yg2(t_Y}#Je$B#FM_mHG2H%k~d+1zt=}EyalaocJH-x9hc`3|zYs>Im-@wLj
zVVw<6$o0ETMWx*96HB>H*Tzjh_k(GJ|N0}biT!n+3+CDe7o;z-yTkQGQi^?><DUt+
z44k}nwOo%|i<NestGU(NYW=?9$<79s1K0Ie3%)5^CL#Oj;wP!Nuod32o$I@nMjr65
zbG(10cm`*WxMJKw)n1Jk9Ud>D7S5U%a7=mr`-ywMn~F?xKW}YxVSn)4z5Q(EVdd`=
z&F`I*yD!YU*Z6mtzTTrWk5kR3m8W@_Iy!Dtbz#cj+0)wg)#*?0#X5=4hi9x>HqrlL
zpR4gP88(?i1-rf1?&zDp?!lz{bN_yQ`dK+~TjA`PcIpjtmUPOVl=xecZE&<Rb@KfD
z=!8eU9Lr2Q|Mgvb|2jqa(Rc5|Oy={x$*ox^V*S0wG2rZh+#peja;v)5Z6YS!J09(L
z(0|lvag56HrYZAQ&Qc2s-f<>!{Z;$rvp42dZO{AUDzEj2@ATItr3XSE6*&J9-`K^p
znMGN=;mFdA3^&8ob2hwj4qftx>&T29Px#cLMXvfXF}LMKS={`!jbpO2M3b9QzR|wd
ztd0hUsxL@iS(G-jlChPmvG)j1FZWWvf<$lEHkqZ>&cgkCx|w!@GP5NOlQl%umZu8_
zuFjrm)b{&>+3dyg`lr_)V4pNM&X#ZHI*EgoKdfgjw*C3`eO)qxO{(w;)9m{O0?~~f
zXLNQ?i0l8=IDMJn{{Lr#gCpd5%0z1&WvV`jq~1TV;qK)5a~FC#&gxkA$!Yr<C1w|4
zZg0uin|K+gm37_my3^+7s-LhjF@0B}(wDt4T`?W&GZ+^BHnLOMyo~F6ns9vYq4Ks>
zXCEG(t?+qu<g_zonMWT_3g5gk+bO#vYwM(ItxtEPO38`XrM!8gtFveQLq3!1kG5~#
zzWw{&MaKohtbH7OZvRnE{>}d2VBk#;eU?2NKmC+QzQmj?;8ww$dtF*0&|&(f#aim$
ztVGz~cU9k3x-whJme<OZXPfCo)vt>C9(iZ4dnaRXWBtb*-sfG{x9)aGPc&tb`QrK@
z{~>olBwwn5Mz;UF6&_-T`#1Lg5a+t|{rHE)UaQVN{!rt2U-46shpc{kh~ceczqBsu
z7Cf$hZ@);OFvF(s&+COHQymX+m6*D2?lvrn7IEjboN~P0s{Ze*ko(t?zS(TiTks;w
z?pn9)jiy&;IwDsIY%{a&x;IPwVr$Z-8||IWmx^=06|mjo$kqBOcc<^K)3f(Z_YNGM
z+&6Ja#*w*}r2(S%&#w5vn3g~7Vs87YM)q=sV&nVD=YRgTK67#N@r$0<-yA+Q@j-~6
z?*U$}*^TPkHYrKQu}<{jX9#|*utwsf-cgwypH|y!uwMP;nfU8VbtOi#T{R!n?(B)1
zw^!lq{Byj`QF6QVPfB{P$XpsLx^8dP*Jme<*v+`Klr+|<NGNs&Pe~Lnv{ea=bhBQu
zRdMllwUzb^`&i%Hd$J_!Zr?<iQ2&`N295Vle*fsPJuRw!`?iHLQ6Js=lRnRwJ|it|
z`t!9$6K6&kHr{!-{Ku)Hy7y=Q{E6Gu8Ncfw=T1pW{k4A>r#4;Vzf&jsAweYMaahi6
z&1LK5?r1wN*?C8^xzlh@0ejm0nTZqM-V(l7wC~iRq?Db0o)M=vi};<({IK9izsa4)
zby62?eq{OIwY+JXD;ap-ZKFY=<WrA3@{3(1t+vT<zgH|ws+m7gV#(7j9kFFuW+#m=
zyKg*c7yW(l?CuRGZ@MQ&-TKqq(3vt{wv1Pq*{oBDbKZ|7nKtGNqh|RF>z9cHoRgAl
z(K)VYYs)+9xm%ywwI^#fG^qT{?ekK+wsG|#Rfem#9rtXMNmzStm-_Sg|G%y;esO$u
zuR&_V%Ojafy6t9c4_-9IhOwydh05P+R(}_y&)K)jz<vF1?V781j8BJkb1N+F5UkGG
zraSfNv(3g4_x#s+G|gWiYFZ||L;cO7jE-L#e;+a@IE8Um>OQMu*bo&GdrZjV(TWvY
z3sSBbH><eZV_(7Pa6|0gk%DKN*(c42JG?B?qiOAT?(>>k)vY8f|GLgdGRZJ&Zenmd
zt9<L4PskqA&G&b0citI%j7?&87V9&`2r*N}m%CO)PW4Dkw`od9l)fc!Fl0r}M~4t$
zh4w}ECG*uw5>`$A^5NUEm=nKQ&F{o1=q++^o_S-|k6g=@&&>-0&K@}|z$ex0&gbE~
z#J_CKimq63SEY!A535eh$@Vg|lV&krlvDD8V@K>3)(M9h*8eO}^L?h>eV}TEUZ;b-
z)$d7#-&ALpO7-oSc476t{Y&o^q$qCMcC5j+Bu`2Bo8oN`y?a~kOj$Fp$td8M^&{Qa
zSEp3p2zX{B^ijd&#QPV1lm0yKm5f@rJN)7aC(~JqH_|MgNhI7BzL+O#6}SAs!)a$P
z_?)$fV&N70k}EFclM*Q4x?*3i+Mz!SHe?wsxa}b&!rt|)c!I?(Z^rjp4h>I&cw8j)
zpRzM?EV^^PFJu08gRPs@bhS6iOV$Qk>R$ZQEi9Q`H?yF3DQ{oUREx-q-xlkrdq$j4
zXquQ*%e1&lVZBmuwBh;n*F((`S&Iyd7jPQvkre3iwwlYl;#nr=L;jg2oazUJC0n>!
z+JzICpU${i;#&T7{i^D7@2pc7pFFFzS^dz?%mW%8D~`l1P|=i3d3;DpKKjIxfI`3U
zXVyxR6HX>=()*N_oOs)#=jaT^*_%GUeqhph)JiP=Sh0Ciafha0-ft$on?ItaFIi|M
zu`J0lHis=PzW1ZG+_w_f<QX{=cUs6;2pxMmS(_){E^f;9$fs|ZuW&!SwaP(Q-!HDV
z-p<mtvedBh`>QvP?Dq=K%<4!8)_Z*Uex+ZD6~kj8=^awROY~n(7hP1@I8%WCV&B!z
zb=wS&aP1dZ;yLN)(K=ble@RAGA2b$S*`DDR>wRXG`$YHK<sGY}TwAuJ32+|fu#%B+
zl=Qj%%i{9e&nafBeY*||ww~eKP_xA%cJ`-9N3QTqT*-a>{7jzugl5OPGS?Cl@*aFo
zIKrJ>_NZQ5<=LB?<{twc`hUMySY<lnz@yn0qL~z}>yE@f{_w~9=ANcBy_f8(ls5UV
znAAD(et-0wHA#D4g@}GTQNO3!Z{?|{-D?$&{7U+}O-W8_tH?Ir#b4I{R!}SHKD1?H
zKj+n#OXqk7&n{ZK<;TCGTSo8gCR|K9CKW$}$4i_m)XammHB4#Z^o6q~oV&0>wD&LD
zjb9z&)eD~ANtw91#3*)(rdno0U0@koVEvKXhZdb*RdQifxxJOB;i=MS*+m^Yzgiz^
zee5poYH#uNFo)c{X{&patKWw%aXnanEhA{fJ)a4oGgL0`iuus}Y}q!e^f?>nF?IKf
z7I0=H-Z>oZyKeu*D{9PZmXv<-<_JwYv*hxXJfpmafhLagd9L-b>G_<|T~!cd8OU}j
z+WPVgmi;N;=e^qdGpRd<o$Kaq;R#=Y6f_D=i@I{J8|*!C_H09}r0=5l&-st=bLa?4
z=18f?-3VzEpJvl6FFn(8mXmb;33si#9#Iv?-psb}^SpnvHTzPzcYy}0i~!4#{j*Hg
z?L3)s_)Nc6`kSD&52lK&S(~}}(66GC40m_%=zJ-wh?DI;bA!F2!aLTgV)I_#)qghh
zZgni>%31Yq4R81bNjZ~j<*V91{+)VK(w9^8+*t0e`x(CH#~1xjIM4K6U<23A^oBJO
z7Az$nA1FHLPB>L!z4YA;f19<x5;)#y=>-+rJmP<}&U4LtrNXea8)Tye`q&btnm^Za
zxx~pJRMK{{`@p2M67G|eUpJcge^pEfOJr5c+G4aoJJc(Fajt^#i>K|=UeEhg68cpB
z=B{mrCWovJ>dc=xMZRYLj<VbZ3px2y^Dl0H84@rvlw0||o$rbrPIEu3F1^SW6SrVi
zl3R3zxz@)irWs`$%mQz0I4ge6R#sd$#OdCaj@{-j+AsVqliJ*}x<DuL^q*Y$l*xNe
zPImprZ+7j7O3b<$huT$?-kS+N6<S#B_+m<E|F?4oq>Vq9bz4ik*?;Nw=|`1ezsvr8
ztGZ?`VI6ejT#&@YLg9qg2#eX?cX_3j&b%b+dPXSl)QfAf>!-Jzx}w1NJLlZ0HQts5
zydj|tH>Aa`uhHGz*L$qqt7+!iD-HkWh2(O`IP}Nx75IdeXE;61`oyG`Y<;l*vQ@?P
z%R5iMmc6|q|8wQ$V&jn2?%v0WqOOZgQn}J{RHDsG(<(94@Q*;X*&^k)Htrkc1CRF1
zSGe=q?a(vj$aNEz`drWsSE$Wwd2~KIHFx=(nyR=BGm<NUQ@yr`6!^){my=m>Z}W8%
z&2|5K^ArMRF5Hv%R>CMqIy=TR<Ls(k2^y>a%u+kBBl5!IO{RC}?t1CYm}TUw<>MPE
zzGv>@iFHTVEJPU>U+-8Ko4(+<Smc)-ckeB(QgjMg{Z4tOLVeAasy>4kVQ1THrikiv
z&YQcRVWm8C^k3CT73U>4!#eoeGoEhkNN!R~R`BZ!IkPV~#E?PmMQLCz>v@~gVO#zN
zT|dpB$Tn@7>)yCcjzVF6FRL1aCmjqv<I&Sprn{+ffs@HeZuS|iJCt1;dc7GJ{6BOv
zFSbVGRJ7{N1NZi9m1WPd;d!Z|d_VH|e3kQ&y?R}#UxcTh3*h=`u{6NP_SyUCuawIZ
z7J0G#dTDg2ESzb3#-}_Dm#DpU<@XMiI&$%y>)jgt_-Y%^gfkO&Up>2k+vLRZh$F`y
z`d?A$(oZ#YOj3x^wc%6ch+nGrXhNj7Ln&W>;tSOm&$#Apj9jhr@Sw$+CoacWyq>e>
zcWm%ib4oD2+<L9%_hJ{{kGEIn-C~XqXgT0pzUp3b=$$2Z&E`&?p6s&r;psggc01>6
zekuFaKWAb>{jRsddyXo^b+^BCb@5!K<h4w~M^m3?cX8?FcB#5~26hT1JxS3GJ_eJ7
z-8Yw+f0xkzd^bTLgi-%-LG6p<GnksLIhkLqdj7;xDa(UVa>hMXk-45_f}tPQ1Ya_3
zfBZEo^=|!70S#7;n$A=&&Baw;e805t${KbRzj2Jbc3tG>7r(~c>5FU6i5xk${QVb`
z>k<pwf;0<zs~e=hE$m@fRmsb3{n}55;T_kWUeQ1OpY$fXZCa7xeEfq$d1?dCFDCV?
z3TpKhTl`xVTKwK~@N@W_7mkk|j#b~>$MK}FdUE%Ye&gGxPu%#o@tGO>^?P}TKIf%=
zs0?C%W;kDqm96Y*$KqM(Ti+O;n|=G4g;l1EcJU^5$MstU*+0)sJ@EeG)IIlYrM7G-
zF?kkSetzj+m(w}g4(>11taB1C3SKhrTKmjRb*Jc)Rr`;!)kWp4+o>6<n$fm=h0aqU
zZn>GqT=%5By6yPLT{t53#TjPq+g9qAqk5{`#iu`rxiQyaxAaB!i)ZxCEq$2!UPi<)
zVByh(v<=CIPc&B?Xm`8L6=$(_Mbrsf<MhDC*#}d0EUjV@TO?*1ssG^8-w8XpeE-<F
zZDR|QnHz5@CVnyAPkwq(P0x{iEbg%!!W%Yn2`V?)u`XD@NocZirY=YHZ-vYqXN!9F
zXq*vU#3)npQbX!|ew&Z724hUIb0+%<QALJ%p4Q7A7|&3>uWFHSaOJZT3dt`X|MWTO
zBU3Takn`n2?^92D16`*bJ9cot|HGgY6|;|sKk`k9(eWx!U!^y>cfqbX(-ot&B#bZf
z`F@NNV|D+?A#Lswv^`&MZR$O)m8z{TZngA_bN$nLH(PKAkJx&f;!qj!Yne}TJaZW)
zH%~QtTW>7(Ab*kmo1Lqz_53mub~)UOo$@p*XX1CUOM2(p>{y~^inVewZ4jN8qB6PT
z29wNf)9*K89A`*8Ymk+RnJ|YX>BtJ_;?kTmv+pigJu!^!R-faHmA(7ce7vEvmPt=m
z=kI2}Wm+=F51&4)9)2lbhrgw%FTGG9w59vBTXdAq3ga)+Cv8^kbGhVm=<$SY@z)gA
z@;ugM`+n%sxlfDar(NKySiP{Z-$zSuUPb-X+zZe6TDR(_Z`%2jX|a*`A`Rb))iG-M
zX1!A<99r$h6a3)weZEsO4Yz)>4G8>n<?W6=1to_Tr5(6(jVXgI=&<0E&u1T8np&n8
zdZXf7fT+pb=BJe!mkS@79H>@%vRy-GM!}Jb4{H-H6^fi=Sht5E;DwBn+7+J2nQpVs
z=x2!+1+mQ9v(aPat3#_rxb>Z`JU=3Apt|k3{?&53g+B|`t&9E!8r)}!wLDjHVo^i*
zl+8Xu8=qzNv%c8OVe>WdZQDy*)n6x4Vmuhjj+n1Jwz6k)^?e3yrQHiPMc9m7(k3sK
zDUqpDwrSOz(80K3&S4Rc+9Z?c#qqjj+wbWtm&oruG<|VIOW}o$x{^z?L#HZm=$k$K
zS9|{7u5DA&i#c0GelN*7d_^hx&=kwkB`Q*#!jp@YH&#bPg>|g&yYQ^)|F3@;Z@J>^
zJZpD)-Foz!>tXCt&G%PKN*#qfHGDK?FSy+!yw2ohhsTD}2OXAI#b$3^Xr*Lt?X@kY
zd4}ZN6+4tZ@A;%~l6C*t6P;o#FGY0s&h<F9rosLHT!!PCN3sQ3+k<4Ev#Qr0TkXNK
zwCm%Kr>Yk_X2$H%EjgewQFPJ0;9@J$@?fr(C7Pd<j=z2L_Ucjj*-sDU_;G7(b$WGZ
zm4N+s2eVh7PFY==t1!Xt{$;;oM%^u*dp#VEFOp1h_s{0L88l(L#lhJJwQq?}Dq_nQ
z7n482zum7Uf8LJdRd<zw-qbb}E!q2>|7yvW7sAc*S1NM8U;Od3M9n&%S1@GH*^XW3
zk6+sHyXlo<Lu_qDvYzng1d+r3{tG?pnhst5cAGhQy|v-~jDwvAR=NgyTnJaW>-W7!
zdU~^N_ty=joNLx^_j`6?o7R1%(_0S*m7dyh`)cOzi<WMZ;*mji31U63eT0jGS`&qG
zOKxaA*GoL!pFBk=SMqh58=J?~tx>L19UY|fk}N70$9(8pby@RP(W}y@CMLUQNPMsT
zv|8~(RwsX-@tZ4R0)1c3l!nYtIjA>rr~i75y>pA-M7;g5_4x@#v!LSq6Hl)>$w=S7
z?UbAumhTjPeA>hdCk~&P*xRu9z_)^^qRnqKeQdNBP2Rk}Pos=+`AQZwp}(7z!&IL)
zRl3AX{c(URa`lZgmBsQZ6MJNvlA0MjeKv*0eRs&P*0kFg#;|FH>Xy2{IahP`7u7DA
z&Az@MZ^hDe2e|lJ>S}*3XNXtfI_w?6IP=_P^?BA$JWSp+uv(OD5Qu0y=$;U%rhhK(
z@6VsNCHVY5KGJgNc6#l-^g`ZrRi-OhCl$(9EaZs%D0edDd|Pdv&$7KUWS*Q*<#*d4
zp?sj0-`-=3{lu#Fw`>~A)-T{xj9vSv?p^QNxfXM}e@{MqY?I^}JIDJOyW@h4!*5q_
zk)OLx`;2-cqgvp9y%}HoE6b!$et73_^6eHbk5^CEZgwloFj}#C;kp^j4eVAwF0MZ$
z`M;^Tz02y!p3`58Lgcq@?GZQ<z{}q!7QXkN{Korze|3NCoM0IyFiDs*#(raSlSHt>
zgbab?J*DTAX3NREkeC0u-Y#!nQnkk0lv5pz3*Q}0I(^#ef7uS!xa<w;M;K(EzPvyG
zPu-s{<sa_n&;OIXejVH2g6(rXqnVh$#2@lw{{Amvo5cR_>?$Hp-(IXgl*iX4Ru+6q
z?Fo;-rg`O;w?vn)E%x=jA;=Ryd1_?dag)O}T(4MLUzKhBx7y|}!+MuvzK5MyH`nx}
zdkXJ%b(P-db9>oJ-<JHgi&p|%kN4i+zdWXM<8{>uZsi%r%9vl?p2GF@*vFPkp|1^@
z&$h(M-<|d0)uElUv_!c)Zw8b+P}=yEot@RAkiFYuZ_To@E0(uDrC*iYv-RtPy=hky
z|DCa$ebP+h#K(>0B~}-6zFx6Dv66ZDOC^cYkRvY9tS!e`@7Wc;{J6*`t$FI%btm)^
z9W6FIVToMCKK13*$+y4F>#z&B6L^zrL5HEW^@pru%YsiB8*OjPJY9Kc+UsTS#5OAx
zE)%~pZL!w+Wl!g4Iwx&;t8I2Ds3x;PS@cuZv5#&gTefLA3w+v@=)C<`%9gqJRF0Y+
zubg~Mk<CQQTZ}Q|Uw`_<;)lLmEX;G?%sgr-z4=fXThhm;;o;8NcE`P<ZJycj^UQiB
z;@T!ER%O{yX!UraXZyAjdQ#C`sY^@et=#RprFx6#{@wReJ-<E`n<ckthgOSHRho+)
z_k|}5O{*uz=I5mvC(V1m&2;PAO`rZHMjy6madYvTY!a(~{e=F)D~q=Awe_y)yeQkT
zj=w&wMIlk$XUWXepEh;QEH+lz4VJU?Hl6PN$hvE{(c+IxhgYg{KfCB2wP)upqZIZ{
zGEt$Px1K0CDgQh$W%CRFhDoo=V_fgNU2vp#C0FZ9KLyFn3Yw;uh4%1Ebo^nN{lfp`
z@s{G9-jh$r_|MjeRVh8I%agk*;Kc5isxz-zgf!}lZsm15T^eKI)h}A0G3CH9&YPQ)
ze<=3E>^5D}ciUG(aq*jyS<@z*5bgZ2Ln7{*i9kfz<aBP&Q|>x5tU`+0#YCUw<hoD0
za^wEf?K_Ufn!Bj3{lz%9W14L%%hluYQ^M{9)oMm%{Wv{4ZhPBw=eP;XuKgQlBp&|t
zU{#1>WS)5RX5G#ilczbkmiq9g$0mGoUUa5we#p@h>3!AAeJb}8LtR#hOyyy{{#5G3
z)R4uAb>He!LOnZYyYj^(Fi-fy5c+*xNiXLq_aj{G=d4S(T9}W$Ji(dC#H;5~VAp%f
zA^x<@I>oPMeKAiyA5EBgTj_PASX}HSW}zuH7D5|(l|4ER<*6K7AYI|Xw9V#J?VKkT
zckgDrmHSxX*=3h@X*Juv<)?23xQ70lq4TD1Wy*X#mCIG9U5_Q)WRBN8;+=U{<>tjo
zN!OVH#TWK+s+}#0s4QOk$lQKU-Pier96TbEr|oaNGB11TA|t!n^16?|o<8~V_4IW0
z_46_hy}r-5<@zj}>VL=9+?@T}aJpO5^6ZTQo4K8(ZqyjGCV&0XXLE6$^yBlp7N*@c
zn{xH_TI;N|cN%L`W6oV@vR}D%mf=d*s9SG@b5=d&DV`^7=hd;t!HeVk#~b%zWlscK
zs1|!QXJoCmDtx_e;;wrizs+qwcGIKJlu4m`?ZxnA<tpYXE)VX`p3%Id+-IYx?uj2i
ziVvh6b+<J9Q2PCs{N}8vYhLBuep{a&>f3eDJMXcGn$@D)K4129vCZL`@#X`E{37dh
zCH8M_9b^+wj)<C&@!;fhVZO)*H!K6x9~HG8=`=j8zGc<A>VHW_uNQM|o?^NvP+DYG
z>>3M~f6hWb+HM!E>FtTo+O+dpf~L*GX(DVcA9rsSmoW10wRTy_%EltXDkY-U{8WS~
z<l2HCE3_w`vhXrlclFzq*kCr7SBy%0aTm6F_I;9gFnQBjk!9D{6z#fxA!*sif-{AJ
z?5m2M&r~W*SpR%)mb-!o^Y<dJGi!hF#%0I~x2<QfExXR8y)4`*zVt%s1m%@4wkzG%
zvv#a1egFSM`#M_*rsNzq$u^yRpSkYM-Z$ZUVZ&*oriU#NI<kT40_VKWPq)cFG+FXN
z%!yOit(xy_4&Nn{m?p#Xb`jInXS`3_wY@5z`}S+Fbz2;}`{na*r$y5_9_G%Tx2D}t
zttYedWOv~GB+VyLGA|nU%=pfFjOXC&1*d<fwEREFSHbYUQ~vdt|I0tKd~=s?n9MHQ
z@XcMW-OluF{iB!0!8>$!zhcgvsl;^hV$p4JZy{lsx*KksoO&LHYh7QgNxpo(@=w?j
zE|=)~E;DUjhc&YG>giAH-nHDTi}>>>$%lRYzt6(e_MEHlIQjh9(5XCM%)_tx`|F^o
zcdv3q_-tMKXWhNmVO7!5Tehjr-MXsTtK=r%tT)l&7dy%iWu5)Td#STH`leOr_XZ;s
z*`%ozOR}RrtT}UNuVd0$XSQsn9h+?C^@KckygS_@`@s>9S#Iq=!x=-Gf9{R`ym3b6
zg_z`teJ1H^XKvQ`8nY&7(F&)E(za=Vo0sf5YrB8Vw4+<!$(%heqH&}B?VD(Jd7W}j
zgH&CQe(q`AC$9T=x}-f@eN8K<DUVh1&4j*Hw-jCSp1-ed+-P@hnQ?_K(<Q#A2ism8
z?3!UdW7SswHTOJpS=n|(HP}{l$9npExB4sPMw)+p^1|H5dbh{isW*S6E3`&lf4HVl
zzr?JX%Rt?2QndjGyRfovxrKiDwW^5Y_p|vo^liEPE_3_V_U<=Up61re1m8#aaNqlX
z#nko)&m8;PhYp!3RM_8V`d{$zQ|s<ibGv11%I7w3ynm+Vm9^nt_2<FocfPc@uYWsd
zo^J4#!zmA1pPaXqX8HVlE+5O!%Fh>5SG@>m`Z4=)eE<A5iFxxTM<q{NHUHY>c~eTa
z-@JO@w_oA^OuOkDsvpE3pA%g&`Q1yGruWxwtIzWboU-T{m*EMq2CL=qSKgUFpJpMN
zyftj<oz2gmFXwpF^YF1v;Qd?KZ%%0++9fsD-bUxtVXehM8?%pIaTj~L&H3W=+mX6@
zYi>_ldQPjaN#~Rl;{x7V@8>T(emW>mQ9J$ZLrm&)_8?VXy>Q;Axy#%<+7!5z4zuma
zOG`->++F#5!*-{Lrfs2yt3RI4v{=1r6I0vfcUhI8jQ8tTbjN)?o?}_Mk4aU`!g<MC
zfzyuGkyHOJDcmR9{3~;b>Mw6!uGlw<R$CtbcMcG?|9z3OeTwd)%&;ZqGmhL2aDLZU
zaxF?iV#R{b{t^5pXG`a>Cxvp|<31Cs&%ab}sa@Tr#&glvue>_6tu?f@{^Qk9UDvNt
zUVrvvzsb0w`u~nw9TVrntHoS#K8jcWmYoz3D`dQSdC3whQTv1$Mkh3+7ie*BEqs%9
z?uy*99DZFZ8Hx1u-$H)0_Dx$7{p|VHmTQZn-CX=8rKCyadH;^g=}Ng7S>nAt?s6~F
zRg>SF^_wyTE!QY_X<PN1J)Nc7+G_UI%J-zq3XP|}sz-P2d3r#c&0y7)JJZ|*A}4ai
zJw40!eO7gMu{lTXA^j))+SBqL>sRd032nI$`@b+I)#9qbB=vhqIqw-~*42dRpSYsX
z7TI$(^u1x2*!1Q5uV}>W|9QT1$Go>^|L=&}cy*cX*O@;Xcb@EQ|I1{+v0UA*b(Y8R
zeGX@nB`+4A{;>EyXVctG%qwrjZmDK7Rw?iKofW=x)*T5Y(~PZpS$t)S{`hU2)njr(
zu{*18vC!Q`l{%s^%+K8}2Bn2D$Xsli{CnD!RhH@RRHFZ-Mw%b^e4a7N@uRP$u836c
zlLHG)CHOu1Z}93%^gmwx*5lK+pWn~N+tybXeXRL(ygXfh-q!=iw#3h9`?2<o)ZBC}
zulT$252yZ|eWbFqs`858%>2jtg{n#&@y|D^y*=aNyPUJPhd-y8@x+dnyS*1L6-fUG
zHEB34Ql@p-DOsDp+h)RD4i5>97pg`E=k1qD?#?^+xLYgTUU18+W3w*KZK~jRvGL!$
z@w9J5aGO2T`;E-gxrD5uAM_vC)3x!^_XDb72^ZF!^~>M%rP<8qweiC*SFXhx>ZE>X
zza~)Q{4VazYTgr%4dQ<#><V}4Z+!Oq#!M6GX}P-6d|RD9&dZ<7Wx4!dO~1LMoKViG
z?&t4iom*c9iFto#3v4vrt57Ykb3P)W{BhlRhu}}UH<_$s($n(MPq;pBZ=T_{d8<}#
z3}12jQI!=}f@^}Cqf3mq%&odb?q(aDdEKUNwOIH6`;0a-fx{o$&IIn0H+p6sTFJ{^
z{`dHiqTmUS-P;!U^*@$hDCw$xGxc6*jqhE%sECH|Iub9Xp5^V7dLvm-vSsUDf&cyy
z_fP)+J>|kP-TMkGjt`%<F10Y9xKQW0;JoyY7cMJ)HB1uxG&S*n(0jed5|SNGVa_uS
zXl!Vy6VsWx=Kx3l$+SiZ-#qon`*%Lx9J18tUB|_Fr&89PV${++9=!O${mK0&UG^G_
zx_n}@5Yc7Gmh@rzlv21#*Snze(bB}1skaLg)jm|@iTHm?I`qyt?EaTx>(&{8b_v~X
zy{Q|QPHAZN`k|jH`0Z|ovc@B>=^_tTSie2nys65evvZ@{fAQo!-OrP^$T;s`>u9sA
zlqbM#^X0c6moD8hn}wN4Fm0ymod#pKvVf>F1uk;JXB>Q=G+uR`dndL@E^=<M^rSZ1
z9df&O&wcLv)_SpZUFw43iRT;V1aX~bx7>DIe}4QNnR$DE@pX!E^rhdowcjtX|IfJv
z@v8*4DCg#`xP0UKtL2W<c`nCs3f2jH{S=jZe!_~otM+=mh~-soKD_P76oKQ0bG+O4
zCzoeO-mtzm*{SV>^kh9}iGwT?!kYw^$JKOYmvpcla1VUIr4n0s>dD#@4VSkyFzU;6
zoqMstz$f(#UtI3n`DcQZtRKyY+I{rC_%VeKH9|Uyf~k_1kKb9m#O~n5r5kdmeXws!
znh{^=`ot~&Aomwzo{Q1@cP%-0_?p_Cm8HeMXH=<uGB<TTv5d27*R;*0UMFQIXU#H~
zn4+n5?X+gwiuv5#(##zX=V%q(F1}%DyiE7hlWYqvqX~V9aUXqt>|VPxseF5Xq^c2j
z2gmz4eECzC$WO{XygSs__P+d_WBY1rE57&FnwIFdE1nJL5lPySw)@!9nZDez`rQlS
zm6!3v<i22X+$=m}QLnIVqL<~wKE7Gs*Y>YWeR=de^9-LYe!)LNulsKGyLd45gIns1
zck_%+JymoL`BBKc<<##dZ@)kP=%MR#UnA|JraRwe;f_TwrJ_DPUn-n@)bE5&h-;bC
zvv-fPL|!(ZwRzU$rn~jgy#+^qIUi^YwVFIzZ0@qk<qvt^NPD*Zb@SbQKrBWvuQ_gu
z)z%qx*Od=nY?x!LHNW1_Qv7OGN3G`s8M#wR?uHkvcU$vi?K&{qUt%`T@s}n)HLpnh
z%<QZ%pSOBPO~d=nL!r)HGa3#Se33Y0&?>Rf`u~C|5d-Cl2IfZ^w>FF3u2xRBJN%aA
z{U*IYY2FvoyA68Sm<wMV+8+1$M+ocDX`4Hby;qC5t|VhW_jhca&i?qDru!opZic*+
zn<WvpY3{~v-<Ir(n_OZ)<M?}*Hg{9KTkhpo|K5-k$cqv!yk2aT)^zDvRZO|(_B5@x
z|5bzXmS34QtNfdj)TSGDK2x?Wa$fGwlcKz$_eHGuO%n;j=mU+lvz7-PTDi^3i!C^@
z@|&7W;D&9zN>PU+?fy?$I_Kb3(~5$Ktv>=3T)&;%=krcpXLCBUQrYsW9naHcgFIKS
zE!w5O_Q^%jBX`u9OFcf-1=ybyJRB|jKcw_%Rk5tj4KuD8`I-D}ucFmH`_xJD_MA<&
zF5Av2{VhfJmyE*NAm4(Ed)@`TzH+nGU(T27)t+SnGp}#t2zS~rSK{ZPjDHcX>Z!-B
zsc2Mm=%ojD$CeqY@wi|AadV5!q886^yWs1|FLGQ;#3##oHm~WwFKAxUs#Fx@e`Q~q
zZ0MSaiMKecCv<$dCgk@)SES+dcAp<g!nKQJrbyZ8<W2c?=*^BLYaF(Rwrp)&v_`pB
zNQNbC{q+CW(mN%;-L89CzE+EWs`-lIsvnCVybwKqVd)Lyne2}*Bt3LKDH)s8w$iEQ
z!AT9<RWVP^k|%|)nfl_Jpv7(})s0f+-M5Q&t-GOl|4D+!EyMRpnLndMtG1muB5?7F
z<CHa<Lpd%rvMt?KlpbqtHo<3Yi<hIlxkKOKpot|5bYAjBFD~2}n<X7<_sp(uMdP%2
zQgtO#RW?Smj3Vuh3bL=S@^LjzG|A_#|2)C(X8+nR-C6wg^NL>;pI<0f&K`D7wo+6u
zW%t(yVcbhiuAGXP9j?E;KL7mF76Im0?7P%oPQR!UvNKs?p<nklkD{G6R)0)6e}1ug
zw`TdQ!uTI^n>;HbmfW$Mu=e4h{NFXFH5$w3KMrrY{q@h+Tdys0pGLnvuyuXapQQVH
z>#ToXK6$%AZd>es8H-IP8QjmyUKGjqz0JXsTAQ)c`2FG&$8{N4wKmOMTsYflc@g(Q
zi;xrI3({DQohd8%w?byM-ZhEU1;QDtGZ<vqZZd`_)cb^027H#V`1AeSw=3VxBfmLn
zPf$(Nem-$w)r!Tpb=DbWih7HCE1OkLF3c6R=`yUGeML!M=dL4YGEL(2v`I|C|8DGg
zxa8h1A&bsq7A#>KZ+x&2weSp*;lKVyy3~0A1M5?FBZkE%FaGIUpZst+>$#10rP-ge
zrX2gq^!;|WpG^5X*SVrP=51`br-}mmFH0XdaDn&c39InDe6Oiy$M)I?%gLN*5B7TT
zi1`)!lC})-?}d+K1^fa`b#6^s_sa6v>?Ir4=)Suz!aCt)7Kh(HZ@cUL4ZI6~O#k61
zBA{gaO}1Mojh*{(YFhkHsRfL4CqJkaRjR8vskx?^MOH7vdMEdj#Rj50hk7EqKN~G9
z^k{Q<bJ0w6ey-8#e7?9%>t3kN5!k?Psi(Vi?eW<y-=-gAwBdLa%FSwdT=CPsC!GD+
zuI?QhE*SMKGR&&Ym~8y^frI6w*MSe}8p<o&En2^a+1adloOY<CYSp9YDE2ckmmfS>
z#Atq+Hz@h5!Kq1K*j7p}jecrlp0U6E-l3~)E2g??O%U&1HuJ=f6&>91mPyiVy_^@t
zoP844&*_*mpJ#%SHD92st<@vJ#1E!Rk4!t;swv9%c?CDSiQwTYoNS_pS5`*&&O3L0
zC3kXd#MfH49RaIcX6vig-3traUB2>}rBdLuqV=0u=ZM~lST<Ari07&^j8mVsoO@&!
zbw~U`t<JN1W?|F#To&B={HH3m^9*-`G@l7$+eXfXEq<KV2XeiCJiT_hSGXs5{kD}?
zZrwB8zv`W(`l~6$lM{QCvz6Sg{D|dcotrJNMeFtA?d9yj*$dhF1gzvg@Yy}!?vQU#
zVA4<Yd~Le&NOrJ`lL)_TmYTrx3eI?;ms~yj`<e9hpNq`D=N#If71_a+pDJ~}Frwv4
zajJ1y@!8yscF*S~X>n>QGjiQ1`hVnhW#cv-q4S0JTZ<Z5D;SNR<_C(kpU87-zI=Q+
zJG*nKpNsu8S09gF$?8Hr=7KkWP9E95s${K-l+R|@N^3rz<+?MMb(>vqT5vaAD|5@0
zsmh|Wo|ZDPY>c_S&~zsE%Gn2k^-OwOl->#IXYEKn{Yy$!Wc$+>@3d7Ip6C^SXW4(x
zwzdAhZkOz_BmWj~KbB!wxT1mOT+65Ircb7my7MG9a-FeI+GPCTAOCS-p$K*1&Sg*L
zUND~2H%nyQk%q6qyn9;Jc_#bMu-$KyQ~sr}FRAB^|8vu~Q<Qt>X>_|X-`E#s@zN~n
z@ROGIH$}76@{JR&NM(v}&s-_MpQU|$*ZW!ZX>MDN-ea|pyp^`|%(}T}XJp&Rx+@eX
za<Q6}X&IGBxXJlic`Z2BUnDtW&xHod+$AX%=6`yZwerb%ax%y46xa4+%jSD(AkMxa
zN2kP5%AzoH&ZDlYU31%|U5?CLV$`6}V6-z;D*SQms-vHm9+WPdwr<NgCjT~0?Y-46
zR`x7@9b#bf>%*+P9kHv$Cr?Q`5EEOy?px;H?T0*{3aUBo4DhLI-I1y?aW#wbC&kZa
zjSt;?we%N@vu_q#&Bg$4&rP#j1d1=@OUSJ``cN_I{edePy}nbs-2eKnJj2ZvU43B2
zsW9`VbBd1BHB8-VXO_=dZRlaUkSR%6a87ZG{>gUd-6pf1N3ym^rA;w5>$H4)_c(X{
z;o=3|H49n%+ft5|d=cyqou#0as3Db*G^^CrZyMj4%xP*fHgWt=36a(`sXW7_;vlB7
zJm+oa^EUw*^Rg}}SRObdw?edsZ4>WR&0TscbMx*pUTvr`3`&}v(9im1Pub3z7oxTc
zzw@cgxw%Qf({JZOsZix2wx=zVwkVd0XLc^jJD>LHjGI^F^UXRDl`<3W|H$pzxl=P`
z?dxM)#ri&vQk;)S_m;<19Wc7e>&_sjxpOA_dq1N+S6(ksbMo2zCbZxHpGy9ZbrTXj
zyeHk1{jpQ_P^VMd#7CC{_1$N@+#K2@V|8rW+p><T&sx<-u55Q^@#^uLEW$DCEBo5&
zbIT(?DPKBJesR4Y`|G@_v~7#nw(d4};Wi9@ZGO-pm{s~H{~N*HH`}70a8$;9Y>{=(
zZ*bW+@j%H_!|le?cF8Kd@+(e^Gu-pf=EpLrh_$C5E^B0LU&^`beA{E!fJNtRntD1z
zndJ|ETOlQO;?1>P&x@rG9k#hNNm6|t^FHqXw^LWouitMt-O<ua<?TY7$zlsbb*?Uc
zJ2!E?P~^hov!>dqvTt);MYoIStgW0En`_0fEkD|^|K^rOF;hZsrmcARM67T5sy(th
zo-oPU{Bx3#-jL_?Y0F-#3DFZwV&kv6JU`j9N&oq>X{j?+U4402^rT{SCcfJuH1lNX
z47SG_$8yekc*jmXW49sw^`WT3hjQFJjwT;UEDvuqkCk}tw6!zMLx^!*lPharr#oAB
z=1HkbEGe&hFVv~<*eSnXb}T1gR%O&r@jE>J>oY?O7MMpGozBVG|FZi1qIdgUy<3*^
zTrgia?eF977xqf;Pc}Lu;d5-)3F(&;#TEqozS!?@asu<SC6*l=k-I#!iX;TBWjt3N
zjSJXWDAjQ65cATF>S;z38x1GbH17GPyYwdW45ib{m#d^1{5~}4`GhFul$L8UZ};id
zTsB$#>&3^%*%BwE=02U??<wxB`}z8D(00dPA1B}c|Lyy~&YUw^Y!5|^tGCWwaOcPM
zcs0KjyQA1A?b=r@k*2`lKSgt5@IQ@}t<xe_@Rw+_EVo?W7hzxMrWJQ3F;n-5gyx}x
z6F$4;{WVx<zI@7*Y0A}WK32%Evt3O-b$I*a14YF#&KvnNkC>F4VzBi8FsmwX8PjUZ
zZAGp>l?@Ng@zws=?0Ctz)PL<G*G0A0%`Xa1tJqUM-QQz%2j8-Pe%#{uoI)xW?r+<9
z`_}s9xqqv6Mem;%_w|vtVaCD-Udb!prSWdvY!>9#vCqExbXb(h+nZ-(XQi(=zoT$&
zvE1hgvWC@v>?-tQ+kb=zSFeA0=4R6#j-%xZcpt5QQQ%>y6)2Ie*|6=}nT03%HDn%z
z-WGiF+KlDrE@sE52~S?%oyc;m?nla>(3~R6^PAY#m#yErSS>Ya&RK_m%lz`Q?E~~Y
zmz<jL#ib%~Z9<acCWfzPKYY=h6jXjlEyq(tK&;)>?&Zht`L5-9xB9|f9bf)5DJ4tv
zZH-~jdaaV^yB#Zz)%Wa+7TVQcW)=O`MPd)v!WerViCs60%P$=F3Hef$vPJ9$>+g%7
zo1Cg9+FgoxrX~E$|8h>BIg`9|&$2e9&-^P*9&Iptbb`6Bv@J{WNtgcqe7l&G)1qqe
z`?@y$l<_@npLT%%b&AWyinGs)R>*GMV1L0=NpIiLRKa7bT&@Y-P~4Q(!0UG`PU%Ig
z1pB3lyB2O(uUKn%?&9+I+j#EWxZqg1aajj@+tg`MS>cshhIw+<(eHlvUE8@m=VywZ
zo7uY0kFzs&@6O%M&VF2O$F@y}R1eSZcSxJ<r(N-OirE9>Hw&*V5!-lQvC;L$n<=hm
z>Jqk``*&dW{_~sMTqlR6-}@~+=iRGMj>>YJ<^iTE);bM4u3g?D9h@|CN=?cN4yU{&
z3YODZ)errdUw(M`4i(wxkZ&TMXEaOWjx$=hmcD*@kn!G|myypKR=X8_znj}`bGfU%
zQE;;CDdY3(n}dzsaCxtPq#Yf7xp3mLJ83JFatkN6Z$G==O?*!3<*%job9qI3nU@@8
zXfK`i)4rqpHT%^y7nyf>=sY;8TlCYwIIYoR;$`--yJzayc0@ftRc75?G)qT9&wS;A
z1g4Lw21NxKIjqXYe_I~Bxc7zmZjltn730|7cBYNoN$G;U8E=!=7o@(QwfTOBoecY~
z)GeED)fml5*IPe9`)BdAwG(8P$OjZF-QRT7G9c0DnC8r;n|A$|vQAwnZs%PVke*U~
z&cVK^P$fe6r@((cpU%jo-yd7gI2Ev`d7ZL(h1jp>A5`nJH@<xP>C1wvS(e56p3iO8
zo<1t2%(bdP|L%9k+j+%px{NASb1r{l*&=`V6Z4<XuhZA}zqw&>zv^htqP2grE!S?X
zzr9E>RE)Q5!O@5dR;%@X|Fn<Y_<ho`!fW4sLKK+mH)o`pOc!;3?Hie%yR7Y8-^=uz
z6}4BlNlI5udU|48UDoCg$?hBPZjY4}(X)Q@k%{+Y;>qYuW-C10eq9v&Q=_K)Qbo<?
zm@Fq3Z@v4XMXzicHavJPbX-t@^%%piNz8ZuzExqguPxv3=ZlK+kDI+ywkR*&{<C6N
zf~RhCw(${_Pbc;YPHX=fyE9_S_KF_8Q?KWked@md_ucEm_v^n--N3u+>=t85yGK07
zWMXgaeV>)7;^@z%=EU5kU&itGKF>){uN`hZuP<>aJ#S5!Hh-ImS*7l?Oozj&xlz*{
zGp}&9&DFD$?%Cmfo3k%ulVj<>EN4z-uDYJf4o5$14vW=3UeL+=rQE3Iva_|o9LC#4
zB5E_Q*qw2+yVf^{cj3`s*(kovf;SrbPGkvO{9RglFQj3fQPvT`)GmID^d<|9LkCo~
zPVg)eId<6CSM}y8uKa6L>Le%bR4BY<B)-*OJE)26j>ZND)tK(>241r~xi)xo*}mdh
zpKOwrsaN$XD<E&ml#U`xiB1(g&N2<N`A#fa7uBQK*5-vjaS-I$uXD8Ok}msx<0bim
zt3CEwikH8Vb^N^MPG8%s#ChSSm)-T5RnEm`&S*OIu*~!Jj@cGLt9C_xVON-|efZie
zjwao$EqTe(yN_%$)a|pmQkbN1BIARh^<vv)CzsB8GtW|neXhycMD1S(cL*792X)Ke
zJE#;9^J0te;!CR=f2G<pZZ`Gb^`=ne_m;zkUY~W;E2W!PsVN&w{rv6HZeQ6tt7ZJ!
zuTzED5^wz5kR0@J^W!6zo|O2l3$Z@+u(#*aF}HO4uTk3S4L?GpHy#(f-=`EbJMclI
z)`{N}<TgdU4l$UZzJm4csz1J#yYHo`Hgc3jZr>`(V(1%{$h2jdj<_;U^z21xi?q}?
z^UCaXIq`SOrs#vwPaf;?{EXbjwRG0e8Fz2$<U4g{`?~c%s|{Ev7&7-P+Y#peMXsCX
zoSXFGa^RPfTh4X!^RxPB8|}||_ICH@?vtO>)5X)*$Io3n{ru(i^Zuw!tC@OH`P`ly
zn+bJyj=wpct6}u~`rTEY2@kb(3a=HMQHkWb`<UI#-Tz{}_NGshL}N>N_Z?gEw7va8
z!JA|Yo2k|t9ir_S(_e5s=Q%agibb+$>2-sJ=TzfNS04&bJ5zcoMc#eKi{(G=if!L8
z&m)xacLUe;zLqDu^>0cauUr1T>F=EzLf^PIPW$G3>#o_IpIiSjL|nSP=~uvdp@hU~
zl5RzIZY_mnlfpgoS3Z95ZjyP=4#PL64n9g$*tJM{{plIcy=QJ~tBb11ID9$#j?zSy
z-A`wwq{LXuE-bvus>8fleQW17iD^3<*52lLvmi$I4VSt1E9rgLBE(lLIyh&B=`9Nl
z<&HnjX$)Qq9~#Y?TG1bK`c`I=mHwg6qDm&K8j4;-Pd;CKS#|24_WQFMH>Wo6g#FoJ
zywOMF&20yJp>sv&njh{sbwW<ej4kSj&!d8%L%Rx_WlQ3mStV_)lRU+br}0Q1Un3hc
z>j`t4k>-g6lf|~j{zNprk<m)`Ii79u!Fm47D2uZyy&VAxZ~i&>>21ns+m>G`^witu
zd3H$H%<3Dbl4mxoSbO%|o4;>AExvWc_<-{6B^$Rsk=PwByjU=)MoqPC)@Q3r#%vYV
z?Kjq*aoVPKt@i3M*Si0|HNq~2DLq!*>ua`SWdN6os+(VR&nAgW)u$B-_$Bx5W!MoK
z`MgF+d-v>#-#)4r`>kcXm{{bb^KIWY<8Sw3Uuz#Ya42(L_5+q3LfLt%LabR?@+;Su
zmmYt<^ZTtgi;sMjx*z+wGI#U)FqO)?yUiRI>}I~+cTVR@Si$uhd;0!ptXy0hD}2uT
zl3JU^q4?*APVMvHOTDLVQ`CKHYwoWQ=|fDa3G<VyXPgOL@k6Y3?f1Zi+|Rx}u|B=#
zi&Ud$?0N&`s|?mz;g^hNy|5SGc;noj@2v})z1MD<)?WNm&$>@9Rjx?YnR(~Ek7mp6
zo6Y;a(JI&T^ycm>a#_djE@teoUgKL(d&qH(4P(5E{rd@1a!;r!t5o>jKANVzyt6b&
zSEHDVD_r2-wzDl;<7RWMu~oaXFKfnH_BA!94>dPgWpUMdNR`gf-^JwjN+)NR<KfR+
z7abFkX7W8CagbLa<E!&Tohdg8PVp6<N-F2`<?>&*CMQ+F$b|Xe%@Y#k%DetNm>rTj
zK|0~amJg1+57zDJUOp#addu`5_qIDt*}GITka4<Tpii~j_5Rlh;_iA(xl+o?*>l{Q
z>enxJ7V}ek+;L>Dl<vB;r5rX*hoYLMyWR9r>lPDrt*~E{<zXCW|J5iU!1DC@6VnyH
zOg>R<B<8PEuhIGB-jSdU<)$m!TAD3mdVbE-_;{>r{pZ9PiJiT>>O?2TX~d=ZHnlxW
zIhhmiwZ=^1*R~j4Hme(TZ!%vBsb{V8PMe_P>+qvOV(-hTE7G21?YY(SZ(GLorE-QV
zTtA<^x6QkDWzWsld65z<9cOMVlK-3(b}xu8!)JqK-#IS9Jl)0IN;6b`%$ymd;PGtA
z9fhRV%V*`KY&ufV&A%)4VUFA)Tantyev$G2|E*TvZyI>L^S0{t)qB_v&fZpVu5H<^
zEh<YyKelfBm2_&;LYACR{?F?xtbRr~pLD3LzwcnF+-37e>g74BCOOrK9c=aI%+4E5
z{;Oe?IZJE)y4gK->^nqyekH21ghhp1ndkM`aY0Jcp|0fyE%|+m)gRygr)`yWBVpkQ
z5w-c3(&SFayZ!R%?={qxn5pM^+l6`h^<5vXUzqSYbybL)|8<Gi6Y3ckycg=pf4Iil
z=LU=P!&ys?K3%_NkLdEAwZ1y(YXm>3iZ?dhF=+37B=@stEz6?KEd{#ie=j!2oN?t>
z*tCM(c`DD2!iypdRY#}XQkUz@sa@6e-gDKC9X|>R-M_x?e}Ba5&g`~+8P%P0JipA>
zpTu@9Em85nquHkm6tY7mE$0p4oAYkh+u$QD&J`6k;k(Lg!ltovTg-C%Jax^Mzd_cQ
z>#a4;KDlvY-Ut4mY9)yS*G};X&g{(j^4M_oq?mta)+Ner**TT7qv=W3!?w=7YqiDi
zE}gO3xKj9<m2Z|*&*a#Rt(zCN2eU1l`*q>Qdq+Ina?|{Ku3yOEIqrA%c%jkRXqSzW
z!T;x5rfm4LV6v?Cf(YKKPsfd&>#d#C`o1KsQ0*~D&|dwFdoPFMhJy@;@5o7cKK<<b
z#eCkJ7hm3<Jo@?M>dDj3_s8$wUGe!{6A%BtWp{4mOx@C!{B4uo&6!%d;v2rV%s2Zo
zd1dA~DceP_3QrtfdGAWeQtQPD^@secEzhpMUimotY1*_k7wbF~{0~HKmzMTtHfk()
z$bA=Tv3q8Md9<pOLu~y1luaH*%p80t+cNIepSdx$-sg+r0*0W~nR^dzU_9Ec(doyT
zedOfRX$Nma1RlJY_qE92l&;yOQ{AePaa;BtzU&cnz?OX$&q<YQLZ|flt{kl1qyD}p
z;Iv;{W<>}i*K$wC@)<Xi9y920-!%J@GOv4wZ)jcZ<rNFEw;y^x`|ryuf_mbIN`?RP
z34RaWbR^@@h5eP0?_9UHM6%TL%k^Yes7*N|ai=S<PHnZ;?C0|nDy7(!N^<l2l@8sT
z_WG!g(c0BEe-Ct}p1QU4cef&|hQKE|8=<q73WZ5eZm0Bby(T}org8H#z85y9Mc!L!
zU*4D$#h5sw&{w|uMrON&&D(&^eUE3S?Ytp==;K1GO8%!ZW$eAb7+p^Gueh{8P36DR
zwCn)K_q<^&b-YWpQ_gxnZD`(lBRI(N>XO$+oe~{fFH|~j`wM7h_;UPQbai7fpRctE
zU&SlGBNy2DcrQGWbe^_b(?w_3-9oF<PR0(MW;@R(7DD@uHhym5YYHr><n61LnG_d$
z&_nW+wP<p?*!cv`nVxf7dnYyZY<e<LwY+9cx>3RI_3^))O{O`#SXEKR!sfBJTZ5_F
zW=D%1OP-9##O;y0p4f@a>^Z8LWm5LE#B>R3Zo1e)X|d^E>KfaUHY)B5n^84sr{<of
zGaifhE*V}fY1G*vqic8N_r=ftBD)*ePH#Rm@4OSkdIz6-6CU}*=d&wLWO#0ulFfTN
z?6K?Y(!G}Do*r*~Hk?^;bo0@sCb8?Pe-k%y?l06y{$ncBb)kuW!uhA{=MJCr5D?K;
z30*P!$HvNp6?e0O-4)%VU3Gc$t%Ux?#Cho4nY&gr)7*FM&*h#kx9LBgcxeChc=?|`
zJar;VH(ozH=Uakpzm><S4X1UTf6ICAku@{knJ9gyXNC2Y&g0uwygg7~XukQtJNJ5#
znm&%s&h6Ls#BNYb`5d@;pGX;ZLCJY(u8*4-&n<U6-ItQcFu8{D<A)cE`+rY}&~2C-
zZeVYGXWzvKUmi3B{Is4X?(X9_V=8C%IctyEiZ2)bJlPVxF=Xno3Hg(%4(0Sr5lJ+8
z#>nP>*wgE;OIzQT)&)0r9ck{r=`@8$jKf~QiT8>0f?2B%x$oZG5VZ8^<!jIPm9uv7
zExdYJG1B(v_m0ek2X|fEH{puX`kA5allBHmR&w0+5V~^am+s^|@l&Nu-G>d2vq}^x
zKVBiydC<!6SL2tCQ>oJ#r$2Q27?!%RgJHEnmGQ#oLVis$H($sY3fwdkT(?4H5wnEp
zw{25bhHhuiwDSFazEN9!YpLDbXt9^)BVPJ6oqOB0dV#pumU(??DV)WNw|yz!a%)<@
z%l5ldX7A!!d8)9)kj-+5<dKwl8YRDfu^lULSUxwqz}i}6|CSSJ|E)`tE_6O+F!VdB
zbiVv#lp}}k9Q$`YZlcUqd(;)h4W$gk^O-idUba2r<MrqC{r%tNKienYiF$vttp9Cm
z_m(q1V?tjrug|Hz_waMho~OH|ckxIZQJ-ijs+9FB+V)D-nnN$|9GYk$?XE7tFVy@s
zwtumCH&5#qE$6*XZ`@CbXs5=m<nw*|@72L&zQ;s0TIJ>*{pOexIIrPvLvg>HU2u=J
z?`y4f{GpFtJ8LIpeCJI*9lKekrzw5MfA+J@(Q6f*)i)RV+&XcIZFlG@|7DC#$7UT6
zt7lK<{C#wNU<Om}#KRHg0ftW%p5>iNJYQj{bj(LOZ%b6q_PP&AUVOJXS}$(?Cg%Ju
zw^TH5*0JwGqP~-a%lyhN6m6g3K5cHp)fL;#)E;G7r@H^UzV6(q>wZ(WD*X7pg<WI+
zBv#`iR<p{@yyi`4^j*z!)1~X~zRp%hj@AjwSL^2-2|e}K>8DerBtwMEhHE#T@!p$n
zT4Iy3_VfCEE6q=z_xr88!tDKdZ|UZB79t@H4ChX5IjAs?Z+_JE7nu*HNOmh<EZDYz
zKRAQ$l-o1iy%o;_7dd3yOXhTtSe=r0MKN^Kb<1aE)hY+K2kP%$c+%s~_XEzWxBmQ4
z@g*>AU#a8L(=*?2d0unqjo4~-;LOc;i?Tl}@G~qvBp-3Rai{*NnTomw#(F|od_4}<
z?iaoP6;%a4%Y0V7lEd(+Z&+tjb48P6<^Lb=-W)X++5G6?QbvD|$od6yb~Wa$kThd*
z(#a}`(q7lP)4BS+#vPSt*9E1AU%sB6e=g3ZUV8htD!KcL4}PDN4coK7dD$`9$%cFS
zt#{oQI>%J4A8$D=aG~Bwy%x1YXL9uqt1NU~U6uIdYDHJF^tU%ZwD$g#zxeaV*_Zsw
z)B|c~pO==r%TRc?e5+K|-J3HPzDrT&XjpREt=uQGWk*5P$@gazw}ifxYd$F7cFDxp
zgvUao$ze;g@XmJG`Y+o=zSeEg7F3)YEuz)x>Tym?GoSZ&*R-qA5>ZixG3#=oRf=+7
z$wV&yqomC9#Y(00+Y2LgrpJE2i|W0fpEO+P^}3<p;o%Pw?CUamW^dm1v)ECK?dCN3
z{nvS%U6?aGi&tK`+^1U`k$!G2XUN2Z4h#!?OvD2cBRQU{DsNY<X-ra6-k*B>mFE$r
zhkw#-MB9G82x+M?N)x{k{a#Y7Vxr@gHR4KUT-JZK>IUn775`qf`yF@H_SN#8mQl{u
zfm5z-YQM9xbnc<IOuGekOnq26`GjL@lkJ7n58)54nThzgv+!rloH+aZjES@7r@Q4v
z8Od?3F>I@OEMBsKqcY_fTh7U<lR2ySRrkb4i?%)IsB`aCEM4gv$|bzb$1dSco&Bxl
zg?6*EMEA72JT3hBP~!1=X~qy<_K9;pUH-6SE5j!B&<WzJ@+Qn$xW6*=0_)|N`I|)o
zWHQg!IW50<%Js?TQ~v1-@<fU`CnT26X5&lRC6>Fp^sL=lrk}e*gw`}PM*Y6JqUq{1
z6Q0Wx!e&l3c(YJi<AL1?S&lcWq8_!z`R<h4GG|w^a-#9u#t#CAC*8ZVT{lnSQAFs~
zDZZ_D%`dw@QQUlKp`m=6RDQqY>R!7Y)z<8NZ?jyEY|qVA=GYJ=zFS@X=oW3pcMDpL
zzv_u|ZT3;f*?qpfS}!$Nbgpki@b;z!zHhIIm$F`Bo6+Wf<o3<AH+ElPExfQ#)~<55
z!^iv2j_h7jnQ<ZQXv6P(b-jA2R|_>QzHP8&-YNF2PVksy&I!fBDHbi=i<R9blqV#t
zd)n6eYI;VN$uG+tEQ>O#uAETKT$v!^J4fb7?jrY$!V-n1^U*S^z0<nx%3B_BRcXG{
zxo7UBknn=LB56%dMvFNQAOFPs{H)iVC(C~;Rcgf_TWIRUrd}Opp29NO=c0gl{+GS>
zyJI>6w*S5uJ+W3WI_VgTwD8A2XUYmJWJ_l@h_3j|-x01OD|6%X>-palgWcWdX~|CZ
zNG)j<4LNl1lAF`T{HN@Xo}V{#TkiF?=KF~P-)2_D$kO`@Jn~LQTq-`sn3^A*elzF+
z)6C4n*K=l?XBldWaZNOmoxm*nex3K;57sT_CTYn_*bIeEOK{|zFywvv`N4sE47yu+
z&e;VV+I7U>#ikUU3zwZVPAs&YefL8OV|uatjxGDQ{@wmQ&epnGy8npgZS_3m^^YEw
zZdvlcBFTHX(VAyFo^V*EY+0;x!G%G#r^@NuTL}kt@jwa5&WE0f&iyQ>B;r&Jw4Szi
zOPfY-2$gzSvqqC?5ubm3>&N};e52>f3LH&TtaD7sbY?By(ZYJ|$N$J~z4&k2&A+dg
zw&mpQ_p>f_V&}g7dEfPWx7c2<JTvKH#_vndO`8`wN2ML)&AFWAEkCElu3~$s8IQ}J
zl3jU<iwtFDmx|248g$Ibulcc|py=ep2etDO4f$AA80|OwJan!sDsc1hLpy@Bw9QTk
z|F*2;c$~ZHLe`bnqLclKGEQIFB<ZJeDlD*IMzXf??U|MC+)vtNw?5dtcV^j+`%^bv
zFbjJB=F`LrD|=&%7Kf~!yef{<KWFI#z0<5!NA_z!c$k_a@$+br_T#vN_s`!*2(sBB
zWcP2zxwg-DJQUva{rUEXw@tz7zKHLqlb#PhJ8z3f4Lx!_(CCBM7vEhc`+1)&dN##t
z@+<~MtEWjT*IoCVD$={bY=+dc1t*+eeOSFhX{w@OP)yC7)`I~W3oU2gzwu^nno{fK
ze}yID&ay|kesrYe++q51Z^^_(zm~45PEB6=b6(qz%e!2*mTx||X~l$N)An$F(AzEH
z<I%Wo<=hQBkC^gjobUcxw8=?6$aAjmH~Gay2?AY)CL!h@n$4`9GO5^4ub8z&-eC3(
zqn|FhS2vc19I5xWQ!_kjlgGOD@xD7#N-w86HXitKX2aBcHo@b|*1S$+pI6D|a{TS_
z=F;k1r+~Q6LLS){7A!cdt;c$5!gFzT@$}`B#nadS`}1e*!$+Aj<XZ9<=SI!YOV0>h
zeJJWgu1EExzL~+_4q2~Uw|-8A#E*$OA%9%sEKb&ZU;O^uzh9qz27VEGTN*IISL~;~
zOG1gVj;fcyi+7C||EA1x@@aToeY=z2wQk{(ohOv*k`CsDPIVBy@zn3gEs4d`7iQ;f
z@s@jh-{$A_^DF;;+5Ya(Y{h%NG7_%pSG)f>AG<QKwqC<!|Cc$(8&=q?m~gAi{#SI+
zU*A~^ybd-0JY%0G`dr9QE8=f|#^kDN9`XKSkC+T6e0RO$X!5|Z*W~zuJ+AWwZ<Jp&
zwlEY-Ip|e->bb%>i!S+$Oa8n<E{0lsu{To1_WwJZ|EKq$2Y1DB^*pnkYYPlSrM53A
zQa=(Ou&umL-t|_S>O`lq&b?f@%$IU!ax44xSX9JCiyo-E(=PldFN)E6cczcQ-)lay
z>m&|o{Nh)5XK?=UBAq=;&WKO(o1?r#P4todh4t5;Uu3w()7xWs%qMi+`g|q9T9v9#
zA`V^$Z#K5|$sDScnQR?yDQCC!%gS};r!#kU%s75=U8%BmohEZo-R37V*iSP*58^!|
z^2k_jhr|=Eb5Tl+oYu$H6xwx#%CC2?Fh8W|S+T!t(v?CxWmOr|Ss{$EbIz5_atRI*
zS|I(1SH|^3qwp&AhI;Rb{#z%$@Rz&3qLhoF<*h<r(pDDb!@{iT`hh=7E*@l!<?sB<
z!SFa!N>K1XkKn(l9S%A#O;Ts;pXy(7?zYgedqEcQuauuz+lj0@b-{XL+?&&n^^Kcn
z9S(YA*%zz&*yoFq`=$+XuBN{xacX3lF->o8efTqH-ly(Oe>TMVE~{kx;u>Lp+sr=3
zT!5Rybkm~Wv4uZFZci7QVjp`hC;r&~Px^+dF1p-h4!OPT#Is9nrAss)th=nGzN$z4
zJNK~!O*xKO*3goTQJcf=yTr3D;xF7VFXE4C81Meu1&6-pE#i|*Z<FvA?LPGA*V))>
zN+F8(4Hcrki|v1Se&QVa%(ARACp3P2@@A|%!kN*(G5c_UP5Q%<uk};a@Ak&JTnmv2
zwf%9uY}rJeNs}Jk+Qu~fm6p@lgh%|1?who%e+hc$E}5+UUHixEYhU!2r|jX+pLR__
zXOjNj-QO#N?tYft8En{EktFp|_N+zg!_AWRvy7i6OPXbVVBvGTTgP^J+W)4-+S}y*
z^&B{O_WrKdN4s)w{`~QB`|ppJ>ptJ}V*PO0mGj9O)^%rgb26U)=ht#zrc}N%=beq)
z`8S>M>{GH=>c6Af7;V|OT|K@2Z%!hY{kf|70{45h`FJfHL;tj1>RH=5HR;j^FP9G=
zCri05<6HAx@ZtscJMVX8><-B1diU!0=F%9Ru7?vho%f4w+t~A|iP`r^-y9)heXri6
z6~*8GUYqT~E|Z(~{pQWn=KAOUy|7;%9Jl&~nYZe+{{{c%>nDHa^_gdIIDJ;(uWw&}
z?hM^|fb-}nB{d^M_A?p6)|tYb8vVx&rm?@9wcpk-Zu^=gFCKf8aF*^<zPT;NiqWd#
z+oV@6uS7V_Rx<=&-gWycb6n2OYoAwoaBmGynfE+k#YEYq&6~gag`Rm}?|47dD&EFx
zze9Yp{oFlw?Q;399`ZDv#d$6ys{HI_!ICv$U6<-Ft=T!d@Vll>?*;!%QM>JOKA*P7
zo#1%-yf8rU(&}BSrESBEpS*NyUVU=syWX#B{);RAi(l~hQkT%`8ns>CR*6FMK8QWg
z>508uCUVsNyIzKS+$+BVrETwIn15+)eB86Wt?b!n#_2C_em0-->B5^OC3ltuC4bQn
znKzMT-lCA3e`aKaO?%<MlIgN#?!~)~r>}5_e<<s-<*H8Ax!uUp!D%g4zdig#=i+7A
z_x|td&25p~@bRXL{@YDi`_!~L-mky><ufM}lg+e%^0+e(4sB4pWuKUuH+Axotwu8{
zd7f1)Dtd7uR!MJa?*9nRBL!upcXTg=t;zn%$`X2V`n6}Tk20<PlD=4f@6;C$mVDIZ
zG26>%X#4p`MvZoR-u_)&eZi&Q60|+9MmKBQr>M`FJ&);si*a7;WVx<C1%W~$eD9+K
zTg7iw{d{Cmr*5*^wd{0@<*anhv`G(TOeEYz*pqf1Jb&%Q^>f!0sxBo~2iWCAXoRdi
z$H+db@QYdWw2XufuG~4kXGB8v(xi%_&IPFRe*S!FlWoj1*L^YiSGO`;nZItj_CBF{
z(AkL+RqLh2^TI7wryRC8DBzZ)m2-W!Lr%uM17Q<t^`~5zI#ZZs{r|N~6ztQKrs=hF
z9JnY{(^sh~oKavCdU3VjtoDObBm+Jep5tb1Ywc`WdE~=m7QX4pv8R_ruU<80ZD4}O
zqReY1cP3c8;%&Gdx@ngoCzEf0^fZfCmWIpIgcyHv9JhCP%_Ok#?TgyCZMFvvUQ#$w
z-#qQ;-IFgaoWFQ7q<<ZgN`#)mtf`OJb}ZR1y6gQS{`>|e`-~TQf9D-nm>CPY503F%
z=BL9aU(SEO;^OZcIm?f4)$qPM-SCfV(x)F+7O2`aPF*TJBR|;0T$AHsxXIR_Got?*
zWIrj-5%&yTm-zbPllv+E>#OhIyKC0><ad2NSJ|HD0q;(nN={3!-t&6z<85~{?-xG0
zbK~Ys%RKqkMH;hnJ+DldBtLud`?^4W23CP38pmyIcYl91XJ(noA_k^br-gF+S24J9
z+?l@nzC`%)s)Rt^bzP6LW-UA(Y`c5b-W$KlB6U7}VSTqkwy5FXrq90)KWTq_`QwM`
z+jhR};h#kpJ?;w&|G%`tyfQFWyxiGA*lYc#|5N+F*ZtSu|Nr0os~y{{wexQY2*|JU
zWzm)`zxHwY<=Zz6^v$<$X6P+!ShjH?(^`Ee&%4uOZyd|%bl|Ey6MN+0l8@{6yOeL%
zDL2ym9k$<rWxagn#R`LYbN(E^{o)66`}vC(Gonh3-`4$Qy+4b+cHWzF3|SKt*qL>9
z_-I|ZlJ>LYZ0zR+v!C5K;?&r8ZPVnv`s>pB`lg>)CVlIA!MeSnc7puP>LuG6nU<II
zGPirSt|+Lwey>>i47=UG$kN$We0Arf7R~<??-c6)n!QQw;hl*wTxGF!r*l>F68`#a
z*FJe_p8VJFTLu?SuUD)2U9d55@0$dDe~qqQ=l#9i_vPllXb?GkC`0mZE^F=q1@$G$
zzjkEq-I_eju*gbxe~J2GHkbTQw-$K2dvjRx?_GTNz53ccakpX`U-hT15;5E-_4)c<
z1%9>-T5~@B{`SYcSFZML?q-n<#`dd}OP*~n71>a2yGq&1^Iz^Xl@z5anc%<;&bMn=
zb8pVIIy}33%9Kmpcl7woi}(J{KN`O7+Vxej9}BkB<vbL%PrLkP#S7i3hR1J7&td00
zutLD?yDWoyV4LisZ&O7soZjBK=h3C73#$}PZqX`pKDh8xQA_>)h&9VDi?5IW-z_bj
zmGtN%S99P8NBNh@J*}qaB76Vx?sZ+b>=pZ(!X++Wxs0z(nc*j<rpc@M<-v>_Y@d(V
z%huT3k(Zk*`)0qrmCU@=&Tn7bd9w3de(<RRmfh^nXSvKTyZ3Lt|5t~T>#v(LE5BS;
z&-QisfAy*N*Y7*v+miO@=G<j_qI@Q^H#U7cdexF;`9JfEv%mKHFJvz-w9Q$hF72^<
z`Q>R65l@SIx>9#V{BSJOJ;tlK%x25p2Kg_mZKlSb_t+A8$6$%o`WegT9f{U-mp%XP
zl8M;KJpzJqul_uG`jp{kX?kGVucY@;Y`d%9$21<wPye>tO7?-9BdeKPfkM;Ox;sYp
z@%O)8pFR2B>rBQ<7tNOcvHCB69bf;g#BSpB$$JFeCZ1uEQA|7EYW($C`CNJS_@2)t
zFSXUuuZg?(9JP>`;lUrp9e(+6#K}!7wBkaqyk%2V6t$?IuW;o2zGdQ98lIai5%t;3
z8F_!ri>%~?&yTDMGS}UoAy}RjweYl{+JjvWIkGlwIsCshQ11cnWRuvlVOeFH15{20
zpI!Vy)ns<;GJhA9SC_QENlbis>d7yG;y<s?XD@DCTxgvuvHQO^`@8kMx5`<xLvojQ
zvrph&Vls1Q*7pl7`Rmr&ZZcdSJpZiP&u4vme{aiQwaWj#l~CWiYfCLpH=hZVl(1UN
zw_xYT9jsF}9o};Al-Zof`6dZd^IX}znl;j%7_DFQn&pU@_@3sN^QmUfrD8nJd)_RP
zmS3G)!+((NMVS93)!1;^Cn9T_y)~D(`0bsk@ZHUx-LBeHqV#Tg+3ZElyE6{&GRs?~
zBmC0cmP>NN`vro=S?@(xnMnG?6^2jz?R4I>`S`4NbA@C#Oh{dpmy+3bROL?VWg%Xn
zg3~oTVe$@37CoqVUiQHD;mjP47YCdATo+d9>rGqezTxdOIi>gR;vb9^3-%bz7F(UV
zz*l<FJiGdL>^9YV)9bCQ|NeORAfuw<&qM$7Oh0;VKMG{&xbA<6;n3}w1#jp4n!a!y
zzg^vrf-moCUhp2AKjW=$hS6I7<;$PT-gmc`;%Cb2nOogg|4%Ym_R+D6MFpNh>wbwo
zsC|_A&oTUek=ft0r3cUKnDL}xODDsMEqDKY{~NGBJNHQA_MO|SBeokVMffh2n=BC6
zdL(Emud3Xagl8H~=eJzhZtCc$>GP^1VXsr!^z$nVrY~T9FyGH7f}vHQUadw$ciA1E
zqa~q1fvb1ExZUr6h0&$p@{;G*4@+PF*vd5f-qTcv`Ii}|zf)PM|IsVE{So7>wbP^=
zg8ihNWgjM<X6E1CywKHg$)T+UrNXzokFq>`G-Dpe^`x@U#qVyGKWbd~?Tgld<pHy<
zN7z46(2pxydF}PK`A6pee7gV0*20^HFRcrcwYKb8BvWH!ZC`6`V^RCN?El?FTmRnh
zi)%949nB}V2du9Ww~5Pp^oje2&XwQ7-x8V6b4VR@F1~xJ``_%%Z(82`6_%Fzr}Bz9
zvM@bOt7o2)fB)n1_x6tx74G?z6#x1tQ^($7ewyv8;GyLY1q5U#pKaJG5o<faWP0B1
z=1TK`)yI_mw1RdQJ<-<rV7Ri~>)_fCeqP@XW_36=aEP~^KeKt>uie^5qW?bb33JfD
z9I&;Z*5<ECq{Er_^S0l;>wAj-rpkol-<RvHsg8<RwSTXuROn%Wn(w#foKz6V3%KPy
zq3mufZ|mL3(z6q^W_eDrDDypZz;V^?44ws3FKp?1!XkQ<ximv)-9r_IbODyY<-C&{
zi;{fg`KIoY+aP<6qdd;=!mHPPIxGx_HoJMu%}<Tc>s3_wxm{`L>7|mE&4NFVTzO#1
z&GodQTieJpNW=coqy^$7J@L~eKP7%Xp_Xdc9o62>aaO_A>BbqIShd0{$_9!$vi(kK
zzkKZLZ+?rv9(}=hg@DaOx6S7b_UP}bjfrPn_`K-{m&V2HX}c!Q6y5o@E!N@j)#bZS
zzJJ#+DMODpVX>(p3y<mw{t2dHJe-rhC!gcw?m5%Fp>wt1|Lkc!SHrh^+PUsgY$<zY
z^=QhKhFw_`K3sQQENwmadGn2~bN>APoX3yZq->SXee+uQUP$<nT^j@^*tY93%HH$1
ze5+siXt{Zj*P6eEOIROOxW;%aHS}9QCrMTy?4cva4?D)Kb*d|3Q<ueWUH<sj{dsbA
zHkMNR?%TH;*B1PFcK2ob;^x1bm7mYM>h$2vWBx8TZASi*c%Ew?!d|%h9Df<++`jRx
zPFEO9WU_~&@rrZi+fVFT%--+T<)&S0t-6G(@Z*v<Qx_>Mj9mAOrSYkt;+^Eu53y^#
zjE;W)V*gT?^XsQC=eK@lZOdIVcavDa)vIM{CSS4^Y`hhCoqM&=p&3_Vr$#NG^25-(
ziZO2!`&Ny|r*_1AKhM|KADb?=s9*Hej5jaC1FcTQoD@^t^Zn5hug@|@N(&woZxw$Y
zUc9wAIcA1uZCAnX&GCvKjB7+bCrZqjWsp+H)y4eb&H-I!y9sX>-QJQVzKA_e@NQni
zPW8Rvx0^Eyr~f>f_-bxu`=UD<Xa62tzVOTWTdebryk}r5S{RadG(NbLP4nB`tLX>R
z<xY!R6kK6Z+*bd0QH1)gJ=zkF{%)>m=U!I+lhypz^H<&{ZY{GvIPJjmgJNentUoBO
zTr3{fy?tvozr4k97trZo^Ve#~9qY&s?<?9Wd#dJ_z(k`^mt?2hn5S1wgZl%jgX(#r
zR_aYrn3Y_}Y`8+IzHnaDp4&!y%c5pP&ol{F4@j<;d+~Vd(}!WF(ysLs-<kURZ87`&
z<C{!sq;A}LWjg=u1GAJoC4GrI)f>6JcS_Gbyu6joXpgO}d4Rya-+q@`JapI3)_*uB
zaH4J&^O}eyuPs*FiL~76WiYsQ(b%$dOVqUK{ekA1Mxs~hR;LMlT^?*WH^#rT#_;=o
zbN96H?pHx#S6^;WD-%3DCGX!h|7x9lYpXedliK=r^)Jxe;+MhU)>Qk~tX3-O#NAWD
z2^za)4D=Zo<hnL@AM)$-?=57P{eQDGNcD8;&C3qEHum-Rc+O993HZDA;%U<~<C2Kh
z1Am%Vs~1E$A6~on)zPKD`)+yKgl)g6J;(jytd)uRe-9mfA-;vj<GcQWy-qi0ZBPGS
z$RM=0>z@3-1>Un7jLl;Wdn(K3FY#9W_WY=9+}_nr6BxG^E@}xbWd9y=H6Z!VBIn8}
zsl~x=sdJY8WXiMIUa6!}u+eI%e(cJhhn(Jg`*K5wUv8!3)rG4v)EtkS@-UdVZdt4U
zHabIno5F&1CoC<VPjBuhh!!<(a+>~h4nM#7!Ac`nsfP2*W*Akz;O3gVNa8@NMUd94
ztkcbrJ?=j&{;k<}Th8UU@VuEtZQO-#c~qLs1t$guZapJ*af?U(k6IDO8g_+K64&PV
z>&3GdpXz=ZlsPA|syRn%+44n)B~HyMaNs>+AiCfXmr}*F$GsJE{M967=KZ?Yq_c>P
z!}4{2sQYw}BIAcsQ&xNuTy!-pkpEbN%!k5x_aCoKlb%>`GNW19@1sKB6%kG?{-at^
zPKC`(f+@KYPc1H)`b-QoyeaoJ!{8SOlhu{jv&Xk?`+FckY(kU0+{)j<jp0VZYo<-U
zQx^I2pvKQ%2Mx59zMt8Yq8GyO^Ecl&@6`)5XNh|;9AxA^s&TBoz+#vA`E^3<8)Yt>
z+IVToE;Gg(`4i6zrbXoH^SCqf6xZo9opn3?d7H7=*4*bk84KF3UT>UhVPLA;bMlPO
zA~o$FUg;S%hhHw$vaFdeGxeyinR_LNz+SH<UwAnTKFxc?=E(MLJIlm|*#|bwnsq_+
zNTY6eacP9Fd`8vDy5&2ZCp2uZ+f&&0U=oY4uEqSqKP$M{7@SsbH=9~>s5|qiTuL9q
zwXZW29{vo<Dp{W;@b-0PlBdE6hMZlG-YwFZdM@nD!&mM8D>+-s^wO078HMe!X|ZdU
zlid7Y^3JUZmf9KYDsh1V{w|8oj1T%RxtwIu^tM_1cuUCo&mRS*a~x}!IAQ7(|L-#t
z7aiAfW7Ifm%Xwq&I<E<mS$p4c^xnT4V64EzD|}@BKHZ{VhqY0uUIG6?b87?+hezCb
zGpjqxlhO42|818X{$J$^lm4-sVLI<V?hbKP$%40ACc3O`nZmoevMa`$%{(f5*1XiB
z$%Qk7zcv_M&SUp%ow{JfbpB0_UwnEW-ZT@>2#l7#uxsMdjgt+Q%kF7?w<@WsyW&|$
zUINQMt{In@%)iLKar-(wX`6hZGxM?^C0eTMVyav!H9wdwkH5E}e-`Ucrmj;8Rs5`n
z(_eYiIm~?Ruy94;f!8ZehA6L2>r86Q;p=!`<a?D(vrGCw??KtPXW<noO}3L*di_$~
zGXDDB#kXT$v%vZlDWW2+3ze4zZIVk9Tw~WGzqs6X6Ps8RW2uwS2G4-xD6Rx<9aV-K
zQ_|MEIxp?|*wgup;nzVYnbmEq->m#znqD(okl5F4eMSC`a73R;T#>}xm}wsZn-?z+
zIO$bU@GhZX_D8>!UHjI~o{*5E?Q_cF_+c6TYX;?-bD7zUPHtLxY<9a;8N;i|!3t(q
zq8sK$iDlLD96NvH<|dx>^^1QTW8LFo&%{!*V#bVvGrc5dFsny4sp>TR)R_3@e$=!}
zN5Z-71HIN1TAV04t?0dYVaWcP?WLQh*<{~37{l&=*6i<>hhIKwIkI!vmo7ikWp(kX
z(2BlC=TldgC~IYTM7mZi-4HtEjcWL`fL$@->7{lSM-RMAd3CqmT0dcL&07_&^^t##
zM5^}g(w=rZvgB~vO~LX->a*uIq(0a_L$YS;v6(wL8VxHG@7$X!p{vLsRvI-=_aUE}
z*@gl>&U>!htg|1LE-ZXK!Aar|SM1-V(f4GOzRq1@<a~bj@4T5U7F?_c9Zb5vGfp~X
zy@dDc^Jz7yIudD@RW~v0-mCkYuW4CSbH>^qhU-PIGCTXtWSSvj;Lo5O^Vdq`%%e7+
z71Km^G#Q)CXj#PH6d0oycsYzig@gauzE50F<aIiqZ|3GdD^a)S*QBi+4{j-(Iq$VZ
z^7q7(PCn0$+W2qmn|xPxQirfCPb#y#XpQRcb-^`#s#6X++-Wft*z`Q$ghHHI313~q
z-uc%XegE8zHoyGgz`Qx{8}vk2`3l{QlXtGY=2o;$zcylXlYi2`Q!LpwI-Bmk*u03%
zQ9MZK4{I>H!$QRu&Tk_9%Y6fQYYTJgDp=-)yFGN4b?&O*{rxWDSCv_I%4=6$Q~s^j
z97~S~d;gvH@^(pE|DVjLb!{uF)~+%4ey6?lxkmkhI+qpN{{r;$B$9T@_gdykeiK!Z
zy0Bm5b11*p^7(I-3RLB$<t5$x`JiU$loQ=QD$JD6O7va&p1M(I%B5a+Etk35|GYY2
z@$PZxrYPM_MMklrtF^k~SDZZ)rJu3#)jgN1`#y#>t?b&AWR;-$I^<QHOz?$0r?<V5
zdc(H8b@htRJ}Xw<%)8CfCS|X$`|`BW>0KqF9rM*T35n@)s^k_|`h|7+v?o1$l4tFn
zeOIS)LD!2LB5yufOc$s*`un`Y?V__gRHbT`u57z-Q$vO6jPst0p@$iNxE<KWb6sdk
z;;V84i9`*SIqwoL&yw=nvYb8jK<QP}9pbBRU+xYJTJ`_$bP>5lANg0SPG7Wm^S150
zjZ!%bi>>+le2Y45tri|^E9|Q(jR})j8>^Hh9y8A>J+nxBD^G8nYvJ-AEo%;DeQv*K
zCl<oR>{Xx~)%dSn=-t%C7FoIdAJV0E$<EsGY*y5@qHShD$x{<}ZL4*iH@#MO?<s1|
z{Pf^uvSskbDH-fBn`-1zHy{0UaG(BlpM_oro(g%rZe*G>L#rTRvrx-|TXGyOvX)1l
zB|7a4{hx4p`o^-?KQa^dRV~?9*Y@~uf`pz;(dsYLCkEY^&fomN>6WZPJnzc07q(6G
zmZ)?3w$EPf_G+)+y^d=)UlKR&3-3rwe0+kJ=dRHM&zOYuGhW~NU{J--b=V^@mrM56
zFVoW{54bLO-A%k8$HafYXZ^JmG1j`-dithw*PdQ}x>bFL`L$PqbIqP4tNLtC+Hm_6
zb4SntcZrwGJD!QoVe-25S?y=|-kzx?-!E#aa|<WN?P=clcI|fkPiLmAa6NN*;qLNT
zt-|{`*}h56Yh|`r`Q`SC{o${|H^en8?bGrLx_f)p!jSMJpQoAY`2C)5d3=^Fb<Jm!
z?aL=s*m3ATimgm>QQA`KzrFPR+Z8g$l>Td)O!L2ZcJ88O<>_a$_)qtXNJS;PO^dzO
zH8*-KpYo%S@+ntKH!{Ut+;l}%OTILfd1f@Hos8_pBz+#S)P)tBr5<TpEee}en?3pI
zw^;d^-}gNJF;O@1-G`PLs$D6UiuxLqFNpk}qW@#^EfvXwGZ+=$zIJz<k^Gi3dsW(@
z2O@z&oA*qe;xOrXM9p-Kp0g__SlX;oTe&PdbWPOrGqY4*rJZx;;65+BR4@63YvD7`
zFFudgY&m{&@#f;5gB(wmN*9Oz(DwK>dqt$y<aWm`_REX5PWW=h#a4;oRG1*|(gtm#
zBU0};?g&`VP<XyDZryV=3*EBK8@<j&u6*J$?X;8Ag!*eSOVUyz7ccjfD&c(k)A{UX
zHQukjm*w1&i<gG@vNP@tuV;F$QgY+h90~7=YenZawbqC)KEN(0edt#A`u+XVaZSr&
zVx!7SeAp&F2r(;_x&M8!zvk2J@0g@cKkQ$={NvN*j71sSRL<{SU>=^I`fiV!bKBg{
z9bb=MoE3Jqc?0to!$+}7YZ@oyHFPu^_4>ZC`ncAZUo66J+WXsGe9FZfjcne2Y)Pe+
z43bf5SGbJCj}?Ai`S{B@Q^PqI`@U`u)#&~wonQDyRFrkW&X-N^w=is;Z|n20{Cz`d
z{wk-}1)*=<_zI*rlQeEfiwJ1GKYIPw3*iu#?GHa2R2=%l%3P%8W$`*f#*XXEod?|~
zw`l+1o4N75Vr@ot+WnBuzO<iLw|<@TYR93y9=D|y*Digov$134`bE#B7Q09boYs+c
z$)Eg_x#C*l#*(`Q8`4F#^N9QtyS&k6x)Gbl1$~3!ZNXPhDrqXRC2_sF&h*YA%3EV{
z<<#8|!u*%H+$=b??$+hWrMWH%<$K?{b1=`ayReYmFehb#yWfK<v8aiu)!iwjpN?@C
z-8*|lG&0Os^5p`-gnFCGk6U8OZ?1_vva3S)hWu(x_V*sq7uo;pI@Dm*<Lu?NboTj4
zN12$L3Z!p;u;1V^Ra0u;;yAM%QZ8awC+3OWmauTX6=YbbXP!{i>LK_}()nk`D&Y${
z4l0ULv)?5i;Fp^*L-wM}+QX|_4m0sCKgy(RzTjJY+}cSmZx)%J<DOz7pfK^Q_KYt%
zR_i|8T6oJ*KtX8Enq?eC4I9luXPrGLb1-Us|5j7sjuRUMoK+V%Xz(ZQc)hNxLbt_p
zpM&t1km|IftpSr4P1+tlXGLmV+l1Gws=*A*A08#gN_Qj{G*mrkPV?~<a+sMrY5Lxc
z_fz=48W~+{eq~>;$QjqR{n_;y=WVVA-50wj|7S^~gyKA|t#-E(3J%9q?dE<w;n{*k
zhx6CWsG6d=n)C6!^_NU;t$1{1^>qFE|LxcJg?sDszxh^CCZ1iq_vUdssr1D*%qsfn
zhku_l&!0E%)U_AB7jNf8I^8?zn>ugh6}P{)xty#MUAK6+#D)I0W1Vf8_WIy8ZQ(rv
zec=f^Jf<9}USVK-JUGkQ`1|*{TWvote^`7zD`Reqsr{xq>)$<_P;!;I#Wa$C+V{?u
z0AuqlRn5y&*KYJ(`CH9%@|}dN0~HxxDpx0NI~-^3z!v=_C!FnR$EGx^pvRvkeeSlt
zw&jQ?r=aV@n=`Lv@rgxkn{WG2!tz4fo>q;UvxN(9I7PU!>+{XCfA7A0aXeq#f&T~X
zExxyjJao=|$$d%i^x|Wh|5;ZmewuGq*k>a6uy~_3Tiu?ZNfZ8a1x(<Y^Zvtet;~!+
z`j;6QJQ`ju5a(Z4o3Cnl^Sk!apu<)&juUF~h5mo|cy?VO>xRx|qq37r7Kc{7E?vL#
z@_e&*&pG=x#Xpy*zNEZnah9T3-Q&yeR;PZOJin;EUpVjb<+m@>UIs3o_3`z=+oDS*
zCFeCY?kP3jZ|md`^x&nSL%72JUF~aMd=co#zr6Uhd%>DGA+xQ@N28th%v*Hd`||ed
z>tCL_V{@CaCssIbyTwX(c9TN!Jf69I8#!l&o<AXV@TdJr=61J;@V2d!3jVm*DLPvn
zzpSr$P+<P8gFniJ-^SZJY!`?&ea!KNg`Yu^!LNX;#QNB+b^Ibn9m{%C`5b?x+9p=#
zMo8A|FrU}MXtm;Hi_vQlKdEiq2kT=QCQQf`vF(q0>vf|(zr4i$w}s=$cdJjW<Fky@
z2wu*^GS9YFBU(dd(qc~E4yz5F)d#E+S4}dVZ)YXs@KNIJIS)&>X@{EUv)wk{*fsB~
z$mTBwmja(>2z3M|x|qzYDPJsZ-*@%@xmo^;k015x`naIz0Jl!6>+Q}r>$d%B3^Z$f
zC_Qgo<jUI>$AScJDJ?htkiV5}fzGd~`b$b<3Z-rwy{I5up7pk0OVj(ipv=|97AFnY
zIDVH%Jh{H?<EKl9!vbyj4K}9TIlW!FZQZ<yukNW>-M9b!`QvW$FwMCt#te%a_8jEe
ztR?!n)2ixK_0gM)R~i)j3>2QRaM{mE6(Ww$INvfBmmXNPK19$bMW^JEO3CBpD-XV8
z?rffr`s~SrRr}aie*e)s=}WcX-Rb}4*nW9*v0#@@(sPI6-l=aTUcLGl=Rc>RD)@qL
zSh_{Rw2RvcqIkrzuCI7`s3h&+1Cb9Gf*0S}7T!PUq6J%_ebv_5kFSEVVnyFE_qCr}
z)oszM-|W`*?%~e<l~bkCz8qV3c6xSJ8Ef{c8dl5RRpD1voSK!_vhMMIIlbZybHVQ7
zO`2t_TUd(<Kbe}u9~1K6^0NA25a5;Vu<mA~Q%>`XH)`=WxIWAhi(OgYxLb6$iX`V@
z<z?TvcU}B3<I3zK`nSY1uC_H)hOFfMU*p)iA%4%VyYKgZkCcD!*}ICdhQVUe6ke9q
z0#V1f*VbLR)e$<0eNwZ2QorK6g?v1^$98a@V)s3>aP36KtzX$Lvak8J_())syM4=F
zkAoirn&Wa0A8_f|S(l<%IA3YH%>spTQ)Vf(UE1?Jil1`*&^XoadM`FRT}XcOTZss^
ztp;1WeY3dsKP+R86Igl5Bxp~p2{ZFnvEnt$XPYR$YgoVC_|i+Y$%%G0Kl`&~vghnQ
zy!iX!`QP~e@pPK~_|(5R{B-X}`?yIg{^z&pZ##U>q1%Sj?)*AE$LD*tExVdlqMK~b
z;J)utU5@m@i2XtPI%mo!o-^rU`u_69%2<|)o=F>xE_&w*?9^dUv*Oz#`Yk8kg6nLm
z%$}Wx*|ns4&G&9yd@d(N|B2e+Ux(I)_Zr?guB@={^@kNzMjw{$mHepQT^iRu)67=S
zry}O<oTPJQVYgSPB>F^H?zkg4ZJ)H+`Z|Wm6)&2E)?Y08$M|}o-=h6%xwgJw5MAJC
z_R{`+iKzRR$QA$F{9<^lpKo-EVDk%0n!qPy;I|-=L+Dc0TgG*XT!$3aE#7r-%a@|9
z^KS33eC~CUiPeK=-NT4h(*;741X-m2?D?YYu`9peh;Xg%0UOC>@;y_Wf_x{xvf_4@
ze8u>$$+0tQ;^sKHw=U~{UF7?>J~1Py<D02o-A<QhKYl)MdldNTu<^G!^YUx=$mRvs
z$NY%?|JaAW>FeGIwZ+GdTle(o{rYj}|CLYsnl9O|Ro!y6H{kMwH_D~1Gxx6hazg5$
zfF5tm{kUIS?rX$us=Lw|v~-u>qD72hAr`tbQVtwR>pT2`^VWp6liLCcXU#l(Q?paH
z?wrN%mR$Wg*CaKrC<pD{wZHti4^O^R)78wgovwPv7S<P77HyU_y?vD<CYsH<=DhU;
zN7>bjm|A`XxJ$SFT9_XEMn5h#&coYyWzn5a(JPD|<;r?q{}X%o$WzUiH<#Z&qxvha
zUNX@yWxASxV%beQ=7JwWkCN<4-{_v>kNDnp-PPCabl>8yPlE4m;eQ{v`sa@GQg*!k
zi@i^Td*?8Ozqq+%g2a0x_qU6y1a`H(crbm{4Ckc}wxu6?eB*XY(D|~BW*_owd0ySg
z>(maJbM*ZG!=~x!aaq4M&x}boFxf1;YWdp-(-~Gf2=w{zJ8vod^*@%SG%8devG3v@
zo*EHd#b+f)R;*iXIm1KnIH!&QuThp$`ML$?1$T1GC)DtZXl*=S-!XehT7JaJ?WrI7
z^D8d&D0)})3+$Ni^r^)w)o@R{`*JSzjLK#T_Kmvchw@jew)HGJy4}BR*Oe!ZYM1;@
z)NbhBcWIl=wz%0hGPl(vYuP%#GCUOFnfRdLVK{@3q+d#>;$5%E{fjGvkBDpU&^PgB
z`XmyneYkSjr3n)RC*KWzVkD`{8=x>PBfxu_PGGiP*NPye={+}J$s04YomNwDH?>>2
z_2lE<!8Mg8k-n~T{xqMHe!Md&z(BQ5F`9w>q_MHsW~TRNX1=vr@=eCOd&ZHKM#|R@
zSwyF4&WOtY%u=`N=aC-w8+ST0SXLB=1uF6}bT8S#dhqSz&@RO*4dyfScniCZyUy7o
z6V$FQ*}(rRe{T4@UCB)xdrjBweDq$0X^z)16SjMYO;kAC<^}(i-NLbW<xM`GI~Pop
zN*yO}4Xde1tJJT}@yZbB<(%s(RX@#CAgX8gnbzH>6=hx2&$#HExOyrfVZwstGiDWB
zl9<u|n!EqNOO_W|elO~6YoA6Z?rwklw=m)SKl5|RYbS}Tyc1dSc1q9sV=G=(KHcz!
z!A-`IO=g)L&!uctpDmF>iYs2c_tF=ytt^k7p`e&(&b2VWac)_O;HG=;WP8J&hMey>
z`9Na5?T@Ii?ZN-AsIoWPd1R^Yx&5N;?w=)(>JBA3CRH-|z3Kf_ud40nz;ecE!L&<a
z%a%tRIsTp9ey5-4v=7yOH~MB)U*`#wZcCs3^7E4Gv0I}|3nzF>?61}>=={K5pfK^+
zlM7lG%iLeD6+Zd2Z}qgT7en@%oe;gt&SU)LRnQvwIhMDqBb+aP+9_1<pJ$%J&F0v?
zdHi4bZJi^gPk+lC+@5GuvN-Kq4hz#whW6ye7QA)A>i1Z_1aH-!Z!9x?^ERt5M;vlz
zwrNzJxZXE=f@Zu`(2V@WKXlHpxv$T;?wr53L~hTM2Uot$o%dx;`>T7)`X}bZDktB*
zyieq8W8sDT_&0l$ns1i&NCo{3a0*_%%kfvz(~hm{Up8}IZ}jk%RhbiV@!;p@9Qkz(
zp-UYy=iL`GpR!<0-C?DtwH)hB1s0WaK5>33yk0v*MDvP6wa==aM!yZu%4aD_9{8#{
zCCtk@spCV9WyTaf@sH<h(*kYl_c=TF>+k=@kzp)+&CH_ft%5ysb4Fa<AGH?;wunzR
zIGKOrg0JFzwnVq2zW#7k<!0`qB?4Bv-q&ff{XZVNX;va<ilO-Y%2TB+JH^8p-D>`w
zVr_LWE9d=dGIbW)x2c*!VJy{Ell3augPt5(=1}G6A`<Yv^^xP|ggvdlHYWcy%zJR>
zVB~YgUfUnDg*Gx;pIEc&(5wFU*{nPd{(Z2NVE&l<v-OjRg;&Hh%??`;+uxnJ9}0pb
zLmLujJzO_WUy@ONsz_ByfcblKmMyEqS7yfFlhv7WhNHXi<@vRn*-H#AY^VzO_1t#%
zUk6j(9U4^&Wfw}UNb=sYKIM9zc;ds5^6IAK+jlSaUuCMb-C2A?twv#^>tCgUH{5d*
zwZ0XZFFV$kEFkmx@_!ABS1aT9ma;N;KcBCE@F@2;rEBLkw|IWOz%cvw?fo0q8`_=a
z_EuayMe)TgQ>`^Id$J_AbL8Gm63=wnEglh8yW07K)7gVdbvDR&tv6VIW$mwxEB)Ub
z@q2J-U3W<)M{(ha^^GaKHm_N1O?o`89aw9>AdT-@^qVWE4`vy%P2V@?#H?EiVt2l-
ze_=EC^{Yg+f@!I-vFtXvRnu)kL_8VQFEl*(rlmKn*)xjgtwD1WD^I`MvP9YFMlI`0
zj>-#DZC?eXe5+|~K6asK+ls9@3x6G5+`rwK^MHZsYb~D74{F}e{IQGk>RwAR>2CX$
zq>YpR#GRBVwOMxkXKvW%FF9?2bHfj_h@AQL@8Z|9JDx>2E#OEJ3U-=RAFzJfa_1_U
z(?<(>H#^+*m$W*!b#@^8y~zyU{v<gYrfwDUUGi1P#3cH1*4ol55kFn5AAYN!VY=XV
z_3u;9n|Yt8d|$Zb-sbt|{{1q`li>O(S+ZB4V7<bb8T&F8|4)B8g@2~=iHU2TF8<QF
z|H<dV!f;nxo#hKT<mS!Uu~;nV?T@#=CqI^dR9EcCn_%O&i-XPWnnk!_dX!k`(MuQD
zW52EHuD7sd7L<AaCSkGcijuwCEwgs>9}yKf+4o^dXSTrXtrhDhOnG%6n|b~8w+k5D
zO`6YL<vBd<rP<1olvP)+yb6w9BjMwGBt)8}g7ui??$heqz8U{&JC?jP<fcyiyBk6l
z@0L1CWwq1<JYw~-VqL9pDWFe1W`>vd@_mfbUSi#w0@^w5v~@0PJ^ocy(|?cmDp|q9
zJjHe;vn#uW*n&+Ly9X>2jNEY`U2JuAbe$>tjSVcTcAed+cEu#psmwrp)}`B1xpow;
zJ!H<#USO<RFt6i6WtLRvjH6cjwYDdpeCX=>d-vjPpYIy#d|LNcD^(%?8I$+NZJX?l
za9U2xHnn-Ed*}ItW&Lw57_m2A+xvjQ>PWbU<n37ZjP9QtTdTX1U;S#^@_vQN)H+$~
z?+a6=9s9G&^vG<jIfvLo&aaGC)K9nn{rhpV-lgP;%X!~8-E@py=96-8<y-dhy-IuH
zH7=Jv*T4La&sJ%}j;m^Rf#Dy2*KKL8T@@@hKj8lSd9MF&RzBj=3S(U_V#4tA(J>i~
zhAY$W&#o`hjQz!aQ}%FK;9rh}b)gZPdiP7JKaE{i##9^oQ+v5$&c_OdgglP&0~UgF
zlIEISi|qQ#f9GBO_0C_pOa4lAK1*3pWfseoD(RHdx=$q|*1B=mp>z6<Px*E-PK|t)
zSoG`Tzt1jC-Al6U&ip=@xb8UTj}5b&<y0RE9+7`;{`pbg_1g`KOa}2WyWhP^EW5zo
z&b?IV_KbLq){oz>2q@lhJL|bsYGPmSQRV0>v+|;5&sY9+aV78WC$G*LN}W0WAnU~Q
zv&L7<uW{-)8J%9eI@C_gRbnN7^`|c-3omXyJo)-<iwARW%D(q$T7SlSSH9w`M(bOV
z9J`miE&J5Fe|ma>=c9jB6$TH@Uml+Nt4LOB<Abd9M47^8e=be@?XsqSNBfIQRqacJ
z=5H`rcXPVJlTOCBl48C^a{RO2K4vUu__b`~h4-tjywhtCUy<V!(AO9*vCg91XR54w
zoZI^NeZQW+P`-6}(RI1EaqG;^Nhl==c**bhEXn&a(nU4@i>h>E0q3rauB`{Mv)O;1
z3P_mZ@AD;pmE%WCQ-kN(fAZJ=v#9u4^x;=|ea+X}7ZZxocvksXJ#_pQzFjq%Nz#=?
zRo|nuCF5|#PGzl$b9((>o;+>E!=hfrU30o>PWXXsEOu{l3?E3HaW*Lokhj(6Nxz%m
zTfpfOFwJ<YCqur}iqO58<wjN)CvBRzaoW!q@qFfIjW0@!Y<3=+t^b)fB>IS5x4hYE
z&!r7@7nC~p<^-p2-okddv+!rC;>uRu$Im&G77Je}nA0)+tLee8fQkbd%sfghdI9P8
z57)crTsi+B#^u2my9K<A8l|n%gih=dpZHebvz5S%!j)!0vKiMGJr<V>PFk!O=U*Em
zFir4l#PidsoDy=?(`=3?tT1NU_w4G^V|!VdE`HX&`qSt7g4SsdTUIU5UY9B`<tKx)
zLmkhGuNU5Vx-T;9V%3OKsN}XglYir+xm<RJPEqX4Ez4?m?9oj;U=p|UagBvsx<<UF
zl=M_aE;)0@KBKyuhn5HKDeCI)69~Mc>A)zu{{!cWfNxRPZ%^BLbkTbk!D0=q8E0H`
zT%DJ{h}`cj*I}lnm$3HLR1uEoSM^f)jd$A1U&&;&3)cMo_51$+bCNQSlbjb^@yWgH
zm7yu-$CEc>N$91mjQf{x`RMd;M^1|Q`@Y`!z(JGfBoXso`7g?b_mkQE=7}epURV5Q
zv)~A;z4&brfjos;W$F2;-V0k6SLFXVdqT3#gYAVamt<b|j6DtAEPGyV(GXj~(iFuf
z(fT=ywcg=osmr1To~dz1_k68v6J7A;BKJlQ0j0J4C5INOhQ{3e8}|9nJtf9nGe20q
zIxdhHYySGhe3Kdb_gy)_FBGABk25}_a(nxWU1$BB-df(1n0K%5pKX=wG|djh_I&%@
z6?>!0_n4?((L3G#j3-3Rx}9NFO{934$1l6HV%|$ni*`R&Wp^?Op5xoSnvq4WDg4n*
zY3@qrNv`YlIa=oma|bLwy(yxtaiMLt+gy(4Y?}+p7?~fQZ(EXHSHFGLl4of)-pq#D
zNvj)`7l+q(={?>0b-rEQ->cjHh)$co;-A@S{>vA){kxUV_Upj0ng%V6HNC%-H<;+v
zU$~-tC+tA-vBv`bH?J*lzQFJJLRmYI_tmXS6}ulavsamw@fCje+aNl3zTCV;-zRSI
z3*vrwX!)~_$sGl3Zv$6N>p3-LV)UdhkyiQ-mo#d*2`=Azz<2h#D*>5Z(@&PfJ(dkS
zy7kcWUo-D+WEEL8xu%5AZ2IQUe?LEFKBI8<@>97x>-Q|+F^Z|rHMf6TZ()`5`k1BB
z^a;0a3Ey|rVXl>YA=@o-)yBVZk6ciO@|-(?4zBl@?sEDaUbE-uW1dK!CJFBoHO#S!
z`x#GjOTXMHwKR(Df^6gA4_>R!>Zo1i;)x4*BKqkd)7(jmr7nJLxyA06t7Q=^UUfq~
zn>}S-&dwD-!lxX2d;9I<m;xI$o)hVFR@Qec+|?tq$LB^TZ}-&+Jr^Dw*(R%C%%JgK
z!EyHzX=B~r#+yHP{PVeO`uF3?i^gh_SC;mFh<<YY@6uaSmA7(aEOdP^qw0lk%>DOl
zbE4nAiaT+$?b-dPBF}&ecIBxh8h*1Aq-<B~9oT+oZs3<V_h}iM56@2Xx$htTYM!im
zjjurE*2669t;|brTS`51;(M`4{wTZr`E&mF`S|_r@4H)HF40~7|5!bz<TRhhPuCw^
zsxa4a*RG$eYbrQGv`nP#I@%`%_ti!PJnb<yjIuPjdH3^Psjf<9*ObETx3YK4=t)kw
z#o&Mci*(O>wN?F0E$^Kw&i_p3?%P#)OxdmYrNG3c4tq?GO;6Y%GG(*U^P*>oMJE?1
zAI`}250o<S68frg>`(TGo98E~tNba>R#{<ct;D|bSotpgDKnY_x|z7re6tV#`T5{+
zOz+1>2V6w6EgAO5n=KD|E^PkRG3WCv@eV6j)18NWDz1q7Y~?(2ENzE|U%`yTqfz~5
zP8EJ`keXP$v+K3a-i=q+2K;A;KeuB?@Fu@f3uDpyHj@@KzIb(dvttPt=lv>`2igH9
z?mr_ulNoL}R`_no@A<=GEc=Ds_o8Ke_!M)`$TiQB^_j(3m(S<ZR)4?R@B6eBo6Opu
z{Cc=uz-&s@G{)W=%hx+xb$Ajz$GM}loLM~L8tcs)7w1@?J!{1rV6K(@ETws2gn8@S
z-m?olDvgf*$+_akK0D#`+gUyvh2<{jXPt5ln6u*XP1}dBgpOU?)$S3dnDXfKK86!Z
zxIBzlZu*-EC(Nqm+mt4JE=~9Hncn<q|D969|7>pUSh*--&7YR7$J?w6986_SGrV%2
zeql%I{aw6IWG^tOJAFO+dnUKb#}yxp%xznnp419{$Y6=C6K;vPUwqH|WzXTskIU=r
zekBAXwZ43KAjL8bGzIx<SES?O)hjMlFI=NDD~EyYxJyc<YC!%%nTM;4R3}EQimEo%
zU~FSsEya~}W25Gq6=`LACW|F+nHy|bX{H(&sJMKd&HTiPCi73PT3r#q_@QHm)azvx
z^LjVs^euatbI1JP0~6s7Yjvs=lBE|!=U!cOX-nS4f**H9W<8DMy0$$%t|Zhvv+BQK
zjd!iylv($UChT(%W!f$;)^{eQ@zIA8hZA#og;w5J<M>KU?uLy2;%R{^n_|A$vVH5y
zPEG!5a_LDXk3!v6Syxe`8_%nFCHeO+s+x02t*vz0);z(3M%rzG=1Ufxna(d;p4`1A
zgX5LM)O-Aww*1@n%;AYbUoCIY;;ffX3ahyL-xT)Fj&DC~@SL@?c+0NznYU{GXE`^|
zSU#mJ{CPrWyrI6u{-uRUf9oW<InE?q>@HufzC7RWziCvch{~m{_2(z^&*msz{;HaD
zmrLKlpp8k&Z>;9+$e49EEx12ex@yYXKR3)5vK5(f*h+8A5zGIbTvJ%_<?wNHnMd<n
zyFY4N3Tzg6<H6^pA*}rU_%1)e@FU-&S;8mXy~xMY`MRqtf6B9qD`s+NeaLkYkdC~Z
zc{aWzl<UAM173aROMNMGH7)j~JYOAf#-L$?{L2PY=?O6>oz&kSy!3V{)6JGgVs#(I
zk9oUh-c**^kh!!rN~egYQg>P8R3G0()~xb8i?+wC&Yz-rlkfT8W|5l`?5}qSF^H=i
zFV-{a>{9r$vDt&Y=aX!{>%BWqO9OXS1y$EnxW9a3)W<RL^UP<SRo`wlPq>+p+?d;_
zf2eLlV6n`a-r%I@DYy5DEe~1i_NV9Ps*Py}cO8uL?Vi}Dlqt2^E~{6Mt@KSL%e-CJ
zzsl~-%U*xulb!m#-7^e$O1<8?skhtDd$ZqC+NC~_iT_djbc>RO_bZ-k=}I?oWB71+
zW#xxOYi`WY%sIAq<=w7ejr5s1!ZoSpN$zaTUDMyTub1$PU0Z&1uCJX;|Ml0?=AF~c
zoV(IoThptmJ!(c$*@xPc%_p=T&utBsySk4_pqXXkWarY}9}f@zYv0dz|NZ>`ElIxK
zl9sv`6_fWLu8m*fvQDtk^meQMUn$ldQktFXni};Z_lgM~SFyYz{ccfp_yi+=>pbS5
z(g$IRTjJd}S(>|7U;mPNvU77i!?G6H>O3VrrB!RDRasRw*+ea{5)N3zymIBcpcU_o
z<<xKP;Pfft)m;_R@zAFzVA-4N2dq!embp=S^?G&K4xTv?W)n}Xnx5Fa!_QNzXTh?S
zR^t0LLwe@C|DdhBXO-nwfjvPTmo5K$mwk0vey0Cbm#F&cR73A|pG^8zNPOjI-O;@8
zzWMW4`;0rjF)loP?Bv%+PfbG>uX>bg-%(#!yma01&z^Onil4Oa@qA3=THOCh)kk;H
z(mJaJR*my#X>aECe5&hgQOfId;%(R}pTY;3L6Lu$G;`nbH7L#d(p3{ZXXpDc{uyN|
zdQJf>-Zrv{4VwgWQ`_1&Cggb(rtgV5U>2#Ns;Pa|_4DO(o?DFnvNWxaD^J`U6!rhp
zs<?BW{`%~G{5#_{j+h<&Iw6pQDea!0jZ4UNW`Se(&g`hxk?4Dp6utiW^#egYyVo}T
zn=!qBH@A2FO%D&<)dw!AJ`agq#k9S4&hzhC^X&t!I<AT4*d9^p5vE`rUA5p=!U>Jy
zz`Gw>#cY=*y)(HLm^Der(1vZAhPA|$1rfVi_vn?bc$ZmL6KUGP*Yz{k%}jss&5rF2
zPv)mAy28QrGV>*)cT$mP(Ydbd87rS<E|_KVq@qnZFG9#ljV-0C<L`|VC*4F=<<AaW
z@ua=^dS}Se|Et%BO(}5tsiywZx9pLdQLEjgmxs<aGcH>eX)IoL`*hvUmA&uh9eE;j
z;Ea^5gDt0=&)xMi8sBU?mnD9USE`PEkx8u175P5KGKB-Y8cQneriS}1y%o0VXRO`v
zzfBIay1M?AC%;m2t~l(dtKG8dr*x)>tUG53&$=+15LWinXDv^-zG^wwDz3kEg<=1f
zQ1L6v8a*vjV+GxH%%6sRnOiCQ=C$Ab$d-Lkvv@f_y?n>NpFh_pJT6;u$z8|N{EZ<m
zE=*av+A#6J4cVTf2~(eO{9Kp5%U_(Oe?f=Y;bU8lFdsRWo^RAN=~Z4(OGf)|=P=>m
z=w+{E5C6H9<nwdKytv0(!^G`B)g-&W*dAuw|Bc(vf3~VQ&yn{UTh;2$DWA~#e)8u^
zsqKC14nI~_yinPEpz-uQ*Z4)>IVFl-JqvT@TUDB&dnIt)QGUNeS8usY<kM7Yyt~%C
z!#5-#sO|HU3W>0D53YyVUddH0+4%XyBAq-%(<^q-<qe&hTkoBCaGv*W`_TmjUU`lk
z$7<$G`DT@ypApWQwZ`n0(A?0^Z_Kn?`(~Yyzu;n<5xtB%Qpio)((H8gY$m-E;z`$i
zADGxSrTzZ6>i1;HLKpY4-JC3Q%c8lzFaDBf&34oFd3@su`PhqY@0*|ddcSc{=<MCT
zZ<2A#!}vRoeeQfdv;IAw)II)$X&NW$4ZI({_3n65|1$kJ_vfm;Or^mZ$xqz;zNvkz
zoOzjd9$#1Xa)J96zbvmMESF&VTI{pJkyGsawakCNt}##Q?JlkNZWl8udm3`AVc)0K
zl?T5uEHmto<xJe*St$LITaNk2W7Q{rEUYU2{@pvBJAhS3y=?D>khovJo}Ql0;q#mQ
zU-Hb~rJwgiY<CD-Yp|8^=Jqeo50*|`uDFJ6o%H>j8=Ehz_H(Mth(EZ}E&8C3=7T0D
z@wcHBiEcY|{acSc|NH1rcfMU>@8s_%esNBUQ=YcCLwC*lf+~qcf^EGo`Zuj;+F-LH
zab@vp9f$0KJK?|PtPXzkLFUEYFsapQ)|M{mw>vLP-ZocHQSQ!TE1lh98U6cw3;9EA
zn${$HL^!Svb(mG)rOB}3!qzqc>Ah3Ap9;=g_BH28l!nCOt$706Vr%)eR_jI^tE5O2
z3!VR-xvs=Qeo?a)Kf8fO;^U;rc1pi>Cu^UdwCH8!>4x}r27#5!?Q9?TS&JCv=WI87
zq?ff&#^=A5LXCVAYqj5TIqd+B{g#!lQsz84v+bNnbMg}DGmn4C-4{Kb9IK`(om}U@
z@J?Fj?1jeL)yHn@Ce^S9d^kSgCab^$wz`(K1l?CLHD=QM^H|*rtG>C|UY>if?a?I%
zjnkIyJ9_?v`5v9R>&j1M&d2J^))Kj#tW2+btlXV_@@mz0c==eJowV~Ff9kZzC0rct
z>zs9erRIuVKl;Z}d`8d2TYkG*l6Co>@*R0!Z&mv}TyQdP<0JM9uVk#=A9!KmadDqy
z#ul|{L0|t(na<pjvB4v6fnV`VUBMo=e92jD6WU5Pc2}gk$1g})F3zBS>|$Ko?jq+~
z$#X;#)Ss7$W?ED(E#KC%?Q}xJ{u!V0Uc3zH;!fl$W)S<`xFY{DkLWR{!r=a6YuHN6
zy9_;-uLxfl_vGbS6X~At&8#=NxyzF`A1K?Y9C3K*4pAOSffL~`=Xk9sd*D>DO`2b7
z)xlEp=eldm-)`OZRW3bvhBep87Jar4^%gTuf79Fh)jq_2@lx@5OFtEz<<5I?^30`@
zIVJPg6kaObG~?BJ%g8K)>2G7r{I6L=+DH1FXRZldwCl<-N#R~r$r|mix07~M1O!PR
z+T5LVYKFtwm(p>&Cn#xjPd{7ZVQ|4N@7Kk(n!56Pnpb?(`WTS*FxrKK$>PEmqeS%@
z%e|ZnWmX8j5>~rs=_2tUb){UZK#~jVySsdOlV56m4oUtuO-m<uj=9N`_1jB-#;MPF
zd#8nUvit5y7X81nG9Q|6dMeBEWZG&=tBW5Gy_r?N^FY!}!5K2g_D-6cq+qpMd1Hs4
zTeioPvX>`W9>uxMv^x2jNx$&qpGM^+?}Q$jUdqzSlCYhz=R&5<wFAbCncK_W_gTwt
zHr?@OGjmRd6vvT*K-q1slkTa6pSzcN=hfWv&N5F^m5;XG@~a3CD=yu9;@Z<}R*_km
z`yy;ie3hO|xFo#srpF<-rQT;Ad|xp4=8oACe<JH{D2G>0yS+_T$n{)nwBNFInh!LX
zjk84-oPM__aYgPq*}Fy`W?kpCweOHxqAp|G{3FzLww=m~58oO8+3#9-VnX1m%Pjp}
z?EjqK-Y-d?wj@<>Q@X`5r$r}bt>e~uYLk9(euMFpoT#N)Q#TvlPf?xV<36uNTuwYw
zI{1_F{}(YU+kd*`WS;z6zwZz45200WE(xEV!`Y)geda5T?qzRV-#2c5cvH5<;>5kR
zZ|6@aKRdzsPWIZ6+%<Q<Cx_?$(2Z5m&tCkZ#vts~QSpyU^_B~SIA-Tff3{Xt?eF#*
zv2*>iRZlKBV3>V9#3t_JHjf|{X_lStlQdsljmccuf39T3<>V~|P1|yG<PWdlGW@oS
z*-EP>Io@xX)h^DqGJ|!s-WO{5jy@~1o2|Zo$5t_&!nLNWm(M-EG`cuyN`Y&BvAIO8
ztXsn)t{C@SD|gNL|E62-_;D4vHzkV|d~KI4nPFj&e(WX3SH}j6Td!9NFMMCw5EC*}
zBVgf<%;ICr<zKgPHm!`C{r+{8<gdMJCKpW-H4`nGqsO`?C#J<qCL)pFG&O${yDG!B
z#r3zD+xdFV*+<re=8F7!e6nK8k2T)M8!p$)O%WFU8_i+1F^u<W(W`XRDMF7m_uTn2
z<yc!w`Ocq~y3*S}Z+QK9bCcz=Yx{EYD}|o%CgnCg-S^^S&7CsW>}v6xUnk5Pw{5gF
zvtij_DyzNH_V2BE$woPq%q#pa8Esslw90mVN7Lu>lT|_UZMf=Kl7sEO-tXBbn-EpX
z|Ki^&r?;F-`F-4df-h=S@49bOm#lbc&u7gm@o8J4T>Cb#UEEeO*H>JkopEA&dBfuR
zQr~||9OuqXxVn1T+h-4XBDU`9UAfgEGqvW<ieCQ(Q<uF=uT9MRCHvidj$!<f=fCsM
zNj(*|o&75PWxpwZc;?0vA2NTPW?xga<a@eldd`H3X6sG4U;2-(<m(RnQ!U)@yJL?3
z{7JS8HkA0rzCQY;E3WJMi^LVh|1Cdxy>$3$&=lA6u2r_QG@j{M<jlWkHK#1!*LL<w
z=P`}h%dc-<vgf4}hw6`SsV|}qFgiD$P?kM*JteK7-!J$2jt6sC1AI9CHvO%Cv+nTD
z%l8Yn6g4~wT3+vX!Pu?!ihNUCX@JDj0RKBh0S)_P-^%}2-^Y1+>B}wiBra$wv~9W^
zt)0hJwKX?gyRt-g*GhY~MF(~F{k*YjcG^>Ot-UvQzEWdr`?$5RHrDw=_jS+eR#CH#
z+e_9;FOD$!Y7m=X`@^K0>*9T>>yN`vSuE)jcooGrStL&Ces%Zjg$EzMb2F7oP88<3
zQ}B3>rio0~>lY<CCyqbud9<fzi*9)&N7j@%k%oG8ag}jD{FO8kKYr-k`{~KTPc~no
zr!ePmZRk13>Lq=b^W%oc7a|yxS{wo{b1w3_x8VPlX$Kc9j#Nl!J<S=qW{$?COLvd$
zl&F1V>ZQNvVd$pfhTnmY)UG!2{XB9)+mWZRolRQx`rf*~m*nm<uFO%{lz!Vd-F35}
zg~|iIf?b;0>KfNgJA~HmnU%2HW8!X)t;Y<mFj=0xd!IK|-E6vaYqY^MjV*VIZP)4v
z__(NSi`~O|UZ`~StoYQqx`C$E=hfVdbk05ca;t5(YEyueQdFW?$_<z4$Dg^X^K#p*
zFz{?y&!ctZ;4~NE!;2q%NKOiwGFjoJoy=a#s`4+1|NmtCIDGu^Wam}0<+^s(@7cy7
zKV{yNz3wxeRC6>XwRbQ7Ve0Va;9tXcuT!|H*mhWGmbR(Blnqbaw8QPg$=8qklGZGc
z+0~p-Ip>q1hmmd(NA)M2(@st-&s*}MzigkTv_Ag-$Novpvzy+%s$Tkf(S%PcJ>M~G
zjF_{_SJv(k&pQ(t2ATFRA3|rEemJo!`RB%*O$Rj^eUHi<m5zy-me=q@;7F@5r_Gt;
zeRo}z4L7BTZ?yYzcB4x9iWQySjBPhR>a8oc77**Ki81y#sQmE2$E!?AscgLZ$r@}1
z`943jH1@DMUvQsO^-Ow(!WI^uof-^N-44xpyUM40W5<+7CyYXmxBU}uUj3?Gk8|OJ
znt~b2C3vs)D>(hVl*aKU$!)=+yddG`hr#FP*&hCXsN%}ZlesUl4*h&8Hr1wzedau!
zAcadR^Ot*{J99+SA&BK~;GM+kqtCT_u7<YrPnmi|WSjq-WuG`NGZ||&&zNdbf86_o
z6pKz@#=cp-8XBH2b63w~TfX>O!>@MUecg7Np5Ir>*Dl($^h5YosgL$bo7M>iiKcYF
zWHRbeTBc{>@~m0t@An_q`D%D_uSTyt!O+0<^k&_yM-Sc4tGOD^`1A4UX8($ex>fc1
zY%hdnriFX{YB>94&i=ZepUS^zB}JJqRw*u+D9m{G)&1`a9)ABc_3WWX@)mVlt*>aF
z-E;Bx$1jI}w*M_Z{J5N5U7o+6!HG?wk^Ol7y}5N3RyXXe7sWO$<}?3WaqW&zzv-P%
zZyxjK`|~&VZrqw>wdC{Z6%(_xSJdx0F4JMO)XyL->~D5M;pQ$!?gt%vEmmH#2|uLO
zobf43f0>IG*Rr`g%qD9tSM$B|c7N*T6$LWu!mRw$1#a*hO-x8)|Dk{4{hI6UCg-<3
zUUD{=_tdg`Y_HVMO~1%}xuPIcY_;qA(7*3?iSD(wwZAp>Y>0crp(c?vne$g2oqF0P
z)>qi)WEbB(wS=!GeWkNJcD`qpb^If{<l{Nr{^KVeZ+vidLvPc)K5nDeFAjHy@18zm
z($dc>1DGxuM>@}CIV^rl_?C+EPH$bu-Zv>LH7Bj8xgc`O{$0~*+Xdn>+nsMW%}$RN
zkFh;Eujucd$Yfjlg)>dgep@8br(9}!>T<>OcRN=dp3PGd*)%hFlFllJ*_jO~8Ea;!
z|9ZHKzvL3j%76zNzO(95=Z5km$t9UuUK6Zjc)x>pO33GrTtZi8@9J8Va(lr8#+~A)
z+g(2@MK9~+b-OK9>&qY1=a&{E6>`um>Q(V7mb16NpEX{%gy)Ro6xFNDp=Y!gr7qK(
z&$4B9_#b!vT;}7vEe4zS&&X+>`%#=@uj$MMmWswPiWAnYRH_hnle_uIsEnnHN%YSK
zH<2Sf;S8n+)C3YTTN0xu{an}>*2GyGFh_ssCij)Me7~4oIV-Y`VS-Y$!iF$r$pFa(
zF7jcIv_ENaKb~t+wEWhEun?vxzqymnb3eOz`rwgHi;MDa7c733u<wXd&{@v~zdY}7
z+@F-9_SJiD>)B)CXYOWfTBDl#l0Qva@lfl;qrEOt=`6uwUo#Y~q~m$`JeAg(Jd$0b
z&*FW}?&j8b#|N7h7!}RpKCImGXVZqvhCK|W2UC}B(_9$*Eka@S)62CvzrR;mn=3Bl
zk^kj+I&E#SNmu%h12LUpYlEchN>+un)kH+_Yn5ile0y})B4@|5DANgV&#`Fc{s^_N
z`n&YKDF1}{H}=%Bm>HNB^Q%eC|7f+qAym{nXvUE{n>5NJT^r8&wVH9-KQ-=u>Afd5
zol(Y4SYp}r1QCWe3uml}`IS4XY~uBzzl}`u6NLU5TMN(M?-Ed`vYO*pV^znS{+4%>
zE?jz~%{Py?q{2N{G=6sIo9e??S6j8X%zh&Gf9v-y-@gkRg+ICpJ`KvB6k=06#X$4L
z+R2f3&gFh)xx{VPE5u_r+r#jOiI<U5SarMm$t_!DbCqu0Y2{x3H!Y}dE%UOA=KsY5
zyqQ@<7#J8h7?Rd)kD4~SXy<cA28Qd*3=E143=Fxc#rb(jrI|S?`bmk&*{OLc`g!?z
zsZh3FLFL+D-|RaE0(*al+nhKU*Wr8Pu@jf?<!Mf{#dckA3hL46&lQX`x>T|Ic6|KF
z?EILjmkXJav-jPrHh!#K^S9`~?f(@jlKwy2XYs6dn|S--SA`V!pWAkLuKRF|Pks5V
zzKwft=52h>G5<t#^DMq4Z!fgl7<AfsN~Kp%Nj3iTVujAaUk9z)432F|NbU7c6Q0kO
z8pYB7cTQM{lilQ%e<zie?>m1l$?*HFZQX18ZMLiuyMN?$Ue0|vRbD}TPob5q-zzq>
zJ!`u8=iZx1EDt3v3g=CnB`|58uc>Lq$qB+fGu7|LICm*_-CDRQto=i|Q}wQ62eXfc
zc-g(%pl|2Dz{&nyceUzI_m1uZ(ofbe>%SXfJMY4^z9+^~uP2<mxbuQb?X3ip5*ZJp
ztK3R0*@jhI<^FO%m$qc-Ez#RnF(+W&zdYAzb;?)75=AVM8xCtM&N{P}{dRZGpO8Bb
zHDe?0B)xa5^16I>)&Z}7^-lr>qe>N+8=Ehz;xmbBP~*zxE3|Vp)ru9@Ej+m}{)pY}
zKgx^SO?S)*`?{3#c~Ze*wff$ylpp8%cDbqZwYX`>vbi35`Qf(6>T5?-bq`Hm`u_aV
zN1J|cSUPJ#Px``AIkWFu7}f`=Th5!qb*et_<delS?C)L*Ob9<W^;FabjoAlO+5WMi
zrV{f_-vid>F)%!T$jG3KJ(ZLd8yOfHAkxX(y|vZ1k6kqXwcnmKZ)K%}nMkU&XZ)1t
zT+zs~lDpfco}M&$j{BvfPAVFTOq^m2s;k$X|85!oxMq`a{_ieUkCSD$FRSmm6`|C4
z^X|>NH)r0Qc|XVPxV_Eq%Gar8e$PX9m0EZ{FEu-RsYv}+w94bvC9hw8__+9N#{P&q
zQ*S;Em9?$?^W?SekMr*rO<rwMH8t$0&8#KnnQ=O4ABsYjpFC6f@c-ZX2XmLlAGG%0
z-^cg7bk^bNPZw!Sw$gsqFXwwYNvzlHa_U~4%NI3HrG1E%RsCEUcv<<X^3Mz&ldJC|
z=T0jPeDdqG)BkUI)A-eo=2)D5Ciy43e$KVjS$zDTM0Qs(?RWPSm7TM~ecI`qMRn`n
zi{1PqwBP=rp5CNiTIcmb{?|3wvtQ)DkpB6$|IM19J7GT>m4cW3`L^T4=Mta8fg<0!
zRSOo2@bO$dE`IWd)m(qApEqjuo%z)H|Dle)-rw`bj^<2!nt5}9!QqoliYv}vz5nX>
zy~P}L^A7K3o_FK@wCU{ckG*8ttt%f{KmDbW|FM@Ev-{L;mdu)V;Id;0Gw<Q+%5PkQ
zlvE?!Zra@4uaz*-_SNcR-K~dvlz)A$zhwQj)@uLBQ%Qc=Uh^ys<auYvF4in5n|J1t
z8vm)1NmouTcE4$2B{}a;yuD1%xBd1v{?9*rUB4`2#wVwsxMz`}vn><vy`4IJ>feYq
z<E<LOKh{@$xlr?^L+<ZFow`QNzOs!6pDOwLuihnd!f9c=Y}g$8DihD;ft%KJa|%da
zUpzZY<<9GiFUlGOKC7Pee>wSK`H%ab9aFv@uRQhYN~Qg+Uz6i}55NB*F1II>vno2|
zuy;jb-R183GpkZ3$zMP18TRJ{|B>bwrH1~$U+v9_yXrab@RaHIb{}tF-|zn|ZeLB=
zk7JdbX$;#oeb@WWTz^Vsbx?lc*Q6UVKU?l4KXbXWwd41;<n^sD)HF9gQSw*b%^eta
z@pWj_|LZqxuAODAf3(-A_gz<Nh~D$!JKwgLR(#49DE51N(O9f}gGj>8Gn0O@EU(+P
z;=j!22J^)X@*C|hOkZ*8S@Qe`lhqF&-?8Z7?WAefB)90b<Q+5E!Bt_l$D={iHR^1#
zlrV=wM2PE@Cm-ggKJAO$cz52jyBf#R9<9(=d?VkkjrFRP;}O;*j`fa_L5F8^^))X4
zH2s#S{iXIzH_pf`SGe>1-Sj=j<}SUH|N6(}X?^y!7035;mHt`1uCM-ULtp*fOCQ(E
z-}{*FB>R8a>c{tO7CgScrR2}|#=ghJ>8nz|w{AAhu>W#yR`cK5j1BwWOTBq7Z*b%O
zR-SMD{1Q1Y=9;qqK7JwL{|(a{_I3#y_Ve?9%goSUE0ObI?pL<oCMp*5$~gO$zvkep
zXOn-NV7)8D`141tU;LIU9n2nA3Rwu0E&BdHw9bL=_M+MLZ|ycdlK*7VI4`8TWRCCq
z7cE}*Rg>3RyP3}AJX~R+dnz*M`xz;TiZw63%Wsqm(*3kXPIPhRyqGZMfbLat|Jb*7
zPhX(0Q17r*>sRy7g~`dy|7_j3L^a-(U;Gx>qVHZ|X4I|y=4p<EZL@OEj8OIKnI>$!
zhFZ%6O{GLH95<THu)jlY!#_3cX&-*ttZlpav2@#k@aNI)Uu?E*IP!VF)TV!>Qu*?G
zna?u++gTwr|8?8m^Jh2jztFzEj>G<Ux6P_H^)-x3pHJD(a4$)|pi*%8mzK^$%<_DV
z=Tl?vrhN_N_c-=fHa+Y(Yee+t)U2|eEe%?loBn@!d9E_Pez)Y?P*EPq2+mUuwNnMN
z8#-4A#~jfAS+vbVUC_+Edr`yxDN|R-NPgb4>4a+WS(hKXygskAZTr!*jqmHpx7#-)
z&Cn6s5#P}EGG$hH=7*OrPRAzY%hXExc2)-a&Xd%d9XRiKYURvx!5c&_UsS!3raVPM
z+2lwS_oY=I_bYF>5)?IagGzah(}!|?-(8CTo=gAx`t{!G=Ew5izVW-|-`~?xsrGS8
zX>e}hb`#4Vw)YPDPhhFL_5ORiw?yvE*Twr?Qs<{W-n61C({|UKnC}PVRuvw9`=EMF
zU32HFFDrf8Hz*zt-)mGiv7xo9((H|`_v+WXBK|yn-u>vV!2e<s|DXNIHxw$PuK(Tq
zaQFRM-q%4}8?Igd@Zsp|#pdk4tB<o^(%jJI5V3S}U}&FvrBQpY&L8blaiKb=3t#2F
zklj1!q39gGuTy58FVDDmV7v1qfxQ(H-~G4Gn{!*+HF}Qo=jgEB8P`@s`7OV>TTbB9
zwEwZwnx63Nt@-oq=jX%o-PPR}Pp@7dKj+Zu1l?S>{2q;oeQp+~Qj2D~?ai6Nw^(JD
z-}@gAIzMV>+N^zKcS^FRFsxyxx$fotx`j7?r!=tsxR6>l`P@R+O}r0X6Hg1+{o*vc
z6&e_l*)U6Oa!BAFjm?ok_l|BbJ<hr6h2*RUonPk1iEL7FN+_R};GL^~q^Bj9cWr2a
z&9icY+X?ZDBaVkZ?UX3{CdzSvb8d)biD<3G2BYN($&+5R*3Q>g*IdJ$P{Nw6=GfTq
zC|NF6)m&4k#dNa!QK6@vv!-51DzxrbOW2o|e534Q31|G`y@5WhMO$@KR_AVbsJ*=~
zFH^#`+M`tJZd~f))i1QpI+nyQf7$e_-ng#a`M|PZsYmx0Ucc}rpsdDL=-NurmYlbS
z)o%Zc+{#%cjyz5cZO-A)E3(_Vr8mb<FG?}F<nV$EqV+!SOL|2;e>YCMwsUXw9lLdV
zO?kHN>!{wH9zSbcX<or})>^fe(>%3?o0I(Xdoo<#-{R$2n_lHVg|nKY+jQsQ<kY~B
z(6(o$vew%*^<}rl{oFFMS=DM?;9Ez(2S>sz{w{G^dLcnyHtx~8D|@GI|IM7qXEIAV
zWXgjb>P;J*f(=%_&tT_Ek#)R%Rdi+ah9>n3i*=*7u(enH`XTeL-B|D$i(L4V)f=9A
z3;7y-x_VHmr%JqB@SJ%S%jM#4hd;cpea12Gk*C}Gt1rGCY|LleDyLx(z2QQlk(R`U
zH}e|rO|4jWVE)OJNgq#L=~fkb9wEQtL!VHuUw(vO@PXT`RigQqE|_g$nf_&p39Fc<
z!>kssu3e0;Go!r)vy{SmST-L?-XNMCKHHaP)vS9bjuiZUD!89#mZpr>%Z!-)w-uN1
z?~*nB*PpW^$I1PjZTz($H?zr>+x*+kFVKIpzqo$8O!X`K=g*b=5*~<Vs$b<$eavx%
zRnB5Vxy$RelJ2`N{<7D;nbn`@HTAksZPt#Bj-l+cP8zL0`+7@G^)*i`Kd~2<)5ScB
z+tqmD{lBh$zI;~fbHR1rxHL{b6qY~DwS1`>_rx!^W;}B>Pd~pZbK<d8KRUFE`0E4X
zqG}fTAO32;G|-&gpk?3rRdMp)bp!vbzk4j_p+MiW0<&|Mr|8Vfu{)W!iIYR|M?s*@
zG)uXJg`(a<(PnOjs<WL|7<0F|DW>1FdsKJX<7TW)e7oSfUChZBWt@I1%wE4UsZ8p0
z)!y%ZysN*=s@7o57G*R%9w*o5V6W}?r~jF;fx(q?*Ur4U?Nqh5Ox{-Nxo7ClvYpRQ
zxA{6O`N+gzB|2I7Y2hD_++!ImO6)zi0{MNVBg^DphR8n<G&{6+tMe(_Ex&CVjgQ=#
zaCOp~mW6qH&(3$?cRt^?=)%R^wx=`tFV-6VdG#^e|DQ#T(C+miKll9nG5O)+<BiYP
zXiFM>eGr&7<u<3Gu3O34X^)ai^sM+T#n~0Lw%4$l33)E=oV9(H%j%~`RkXFsCtfnI
zIpZ&~)pHkz?b0-seV6t(6<F+R)~zzvp5mpri#<!S<itZmj&$91kx!n4h2C#GF}u;{
z%(e$U^V6n#U7q&Xc=mmf>nm^cc)1<hv*v@se$5k=jISs9JqbU)Wy1@{OUqvB1?&6C
zOn4MD^X`IP?wAQnwQdC-4h#)(zGHJZzANY6<b&BpKXwJJZaFmJXf6L;n`McqLCcHp
z%vYYFps2X^wD=Crd*>Ej-{c>6qI>f6C6hn4|6Wo$@51Ya=lPyb{&IKctMh&-xt3pr
z?g^g@jGu8}nUzK0_sz_Ub^8uDMCw#F?>M#h+MlZzkDU_zwCMN2u&yNx50pw}tRh|g
zj02`s9g;PTXxE<C+I{@EwaAxG=LEtGyf!Rz3FqEfns!f9%<7Mn%kt;1{=2O(nJzl(
z!wo0SX%f5q|13>j@36PU>e}>7ZeDZO*m<kDEd@?5T5(l+^^BXlj~BgSzcJ@#j+t=G
z*I&MA`InZiF<LHqUHz2gg7troo!+#B+s!ay;zaXEr~4aa8<cY<oS$&C#xl!H`;+FG
zpqC~FHm}Vyw(3VctzCTWj`(KNv^%+#YgdMCZolH%`0_@Lc3YDD>h>nSmwf(<Hp-RH
zU1?^v;r7ihbLVjW(Y58CU+JG({ABr!qh>dA&T*gknx^-9+VQVV#q-3y<Kw5ZhqL61
z-!Na0pZQVy`6BzR(^EIbFz5<QIewaZ;#6CAwIl5d?Dijcp0wV0f#y@qci}(s&-3i*
z4|o1C(R5c`arZ(V-H+9CewFN-b8+9smnP}5TjTP!{*?X9K1CvJ?)e4Fa-?p&u|Iom
z_V1-TGY;_{J^Nc!u1#Zd<IG7LANO5S@|%0(9*<e|z5KG!Ei;c@TddsleTQJb`ctFa
zNjp3aOcLupANx$``X%G$tbMwB*0>og`Ve)Dd4>Apyn6Y!d#?(cr*co&<K%bwIq#u|
z#qzR=ul63(KGbr#+?mt+RqmgsAHMSE`~TZyxFK!Z`u%<Xi@tng+27Cp?NUZx(BBuE
zV~qFSEPUC@5y#gbl*G87du>nS;hwbL3n$9T@2%ZjZ%|eCgRR~DY~;rv=f}+|j&c#z
zuZ}PJdH43=>E}gG9$<<)JHv0D#ozn&zn`5w_<Hh0bH2Mz|2cPXZ8UdxSD!yid#*|4
z>-7qi?>`<%PcPw@T>s=~+Lr0})yhRJIVQi@cI5JwE8F=_@puYvNcJ*VVIcKU%duHj
zpFMy5rOF1CIFSYa*?E-qT-f?9>Ti0s#7~W#D{2<*><a%LVD%y0hFQ33iCK71?+LEM
zk84=spWd{2%Q};vzvXVzIW<-Oww+(Er5D)$d6yd)=bT@D^~PcU&gAUyxA}!G(vG_P
z66z&0_|Dkh6J3%z?a9simt$?X5BW3gE}tsVeqZ|h7CEN_hc2&Gw|;(c`WMgQ+PIL#
zt`6-#k4)y-a#6;8?uO;FWDbZd(hZ4u-^PE?aII~)tdJ?EnSeC^7S;rN*-h7W-Y(VI
zHKoBS=%K^@9rkN}I+^q(bu-sTi<!>l+~Zkw;M{>1PA&aEN;YuRYqwlo71@7o-ac20
zIokz}bn@<GbkR3&e>a0Y+HxPq@i$w(?3uPX%H8t<&(^GevFEp5c5c)-edo@uo6{KX
zP1sm}-TZ&pt(#GgxuR}AyjW(bxa$vJTGr9Mo8^9%&dxh$dOjn#q(h-7c2?u_H@Bru
zJDv(xdH(3m=l9W1qmB7zU;GzpwQpJGo6g?3_rETFYE#>OJu;zF`((#Q(~6E>$LFh_
z?BcKgkQVyu&6i7D7dJIuum0#?anvVFd%I(zm-$p#!=*Eh+&i>6;%nmcDepJm*tB%r
z2fe~$7w^3C*tB#(O(^fjgAXe<%J@!>oOb`_-|~zDT6OZlE$)Bb@$Z*Dm@j{)G1u*6
z&Zph$4P$!b3-*P6KUXd)QMcOq$oZdTwFXO$E|f8NFLT{+%Nv{bQjZ-^pQ*P$W+8r>
z^?@;$vqU4~#`Cg2*6ci=yURZH^ZI#Zfy*>KCKc5j{XAjH=4U1+J|wtZpH(*h=(pFq
zFS%ItT~Fw)`l6`wbm9)@<NTU?PCq+npr7~gm6C!{ZdG-D+|4V0>{<@1+&{PaDU-5o
zV)<^tNorYK%In_zJCWIHzb1Ii=BGE(CGHjLP3^x^GVSjDy$yT!-A`vVKiPh*Fd<@o
zhGKSF-5swyzQ_As?`(Cty{gRO(#AEjQ|w<qD%+L1Ht(`{r$EM;4nE!k(ZK-%K|$qt
zlWJy8n(X%6|7()3`nHk)rH(|^&2Qe92!EZ}dt-^zTc1naPoKJ*Ihf>}Dy<ZsaX@Qk
z^S$5S`=8zP5ZpA|C$mkt;?V+~?oGQZz3oG%Z&r+dG)qi4-=@^ir)3|@WM+-%ERH(e
zzKrnoq2H&4RrH#>Rs=>Z5AF5;#&qAaqvH1URIdNIKPT-D5dAsHto>|H<GZ5U*)9@M
z^Totc&F?JGoAy|{azfG4S1H>fPKMvitzT)dvc$&w_3EUgm&dmXs3hIEJFo6~3+vA9
zO$)UnpY!`BCM;jgo4Z`9BR#9!<L$Azb9wr!Q_VeR>x#YH^L*3B;xjikMqAii`nltP
z_1n7=Yc8&}|H1gCd&#G~EtZMCGbfm6U$YM9TqbrvBSUymsQCYiJ^x?b%y@sc`{K!N
z;UDGytA!pM@R;et<+oYx_rDhwKjutaHv8gjt*=4P9~A8HJ@_ahDIzC#Ps9}CP5G&M
zyIk%*{FOQR(}hff{7-jM&bjzyH>U3uoV~#1_fw;@ni~>Su6KXD_bGN-x@Tp1ncKhK
z&6{s{|ClJ_q2ijeW#6yK=RPgEw&(YRteCX!suVq=vjMqj3-_ORE5@PO{!uUT#oSwp
zPp+)23UhvVS~>q@%lk4H>4VSzyfd2~e!1DpTlniaKc=*YrkY#gt+$r)evjAx=Xizr
zqT}NY%s1c7cGZ92y3GB|V*_dBE7ouPG<LWD`=Q^ipx?Sq%;lNy<KFMr&eY!MxcB(6
zd{VWr+(Q1JVpo^$dZMyazTePsy=ncm+f$GG@2lKX|K-)!lNT?Zemo)IMU0fJ_6^mZ
zY>R&zoBZCMSCikL((3&2nD|w<Ev<KN|6SCz&E)jM^%lRB6r?{KUuGMzv+wr24Pse`
z4~raMw?|K}ZsX$BN1nFNull}I)wO%q#qg5(?!wCF&6(uZdh|QB7RwZDNwBiqrJ$;M
z!X@X;7Ky4rpBG6%^1qZHmxnybFgSNgN|Dt(FyZ~lg8Vx34^DH#jvCKRW;$2Fx#)}9
z-LK3Hnp^p1-6~9K&pq_q*Urntc9(Jco_V#+M^n@9-aVXf<+T0>k(^^GafxP}YAuB<
zJ%7ts*z0apgjX$J(rVB8{bk&Obc=tT&rg=-9d_hBIg7`Txw`Jh=he-!ex0W+T=(fU
ze*P(YEab3{qrcF(-4iEzXw`D>75~w4wJ0QD&wH``F^zqEt0aPI<o5LBZAyN0uKu*c
z2Y20hmpeDVQa{I?@@8An@3Td9`eEx2KlZ<%tNm>K(qzjm314;3KfAt(FX~+FcFUT-
zcG8Os%~T%n^xJW)DK&nuExF$G?pDi!>eh#x|993z%obdGaPogS9geRIPo3S1D@x;+
zoqW=_i_1DSPJ?mj<YFza0uS}IE+;s+%U=ec=bHEVX3H1mnew%JUuz2)6}rBbeE+49
z^YTZ(CD#kM*=!3h|9JbSs!ws{A-7M<BcH#n{`cMaPPw~Ac-OmC(XZVE>!l3W>YmOQ
zmHy$IZuDbu!@-StvtzyQ<y$Psv%G)j@Vk#mrdK!Iaxz_e-R*U2?zT^I^G$cDWn`K*
zF|XbH@@Z=QpC6GQQfp^qnQVIaL+j)-+sow>Bbkpf|J=RUT(|3R?UEVB8t)Iho0RzD
zvHqH`rqkDjS*t8~k+;3Vv3u6+C1pZojwN%?S{|P8D8ywt^IE>elOwoaFW~t#Q+N*l
z=7N~%rwvnQ%YM$2o1mKMbRaN+zc)ibqg`r!!w2!TU#hn=<ut9hczc<r#i7lwR;KGZ
zA2PhwcKRqw{+p}Cyxx5OI9ZA{wrjI8Xk_!%R?kt;yvUO>OD6czFALkF2|ogE9bUvT
zao#yG2|)qwU6J{Z|B7F2@3pIG5qszGce>ryK<@(YfO+CJk;`6`dZ`O7&FM{@oM5|1
zvt-+{mWaP+ZEC~6n+SepduM6%D)sio>%7jL^Cn1?S|4Arv&wK*@SiU!PlRX9`5&;X
zP_Q>4t8q!k&ZQ0N>B48$9u4a|$A3nJAx%v6me>@(vwFL_Hh%~`!)bGMLDIe;+h_i_
z<VtqsZGLnmV3Ekn4em`9E2ICckL|7Sa1hX)=k@2~tR_*mx8Hs8+0OErMYd@hJm-$z
zEU~}i(8Rj8-|eR)bZictd#vko`Nv9&Hb32t#;?)E1_w4e{E#}@et+5qz3Nr3@A@BQ
z|J?az&E`s(u5(7;HMUHDds}4d(x+ao>4uyKFH8%2dF1SD<<iKa!sW$%N1tps7yG|d
zbxBW)_iC&2>w-V8E4`RpS{riSp#9)Zjo(IH|KH!3#IwHJO7w?{$(@%>O26K{2yMxb
zHt5bdAAjIUocoEFjPoU*6qe{Gin81<oOSt*`(>5WYXh#GeX)GaJ|O{~oFsw26@MNZ
z+PiJPE5bWFv1@<k`91mTBK{b*tq<I`>Wz?@e^6&e*|d($Hs_wL53%SoUzQvx-gN!v
zoQ8Q{Joc|husrC;`K;^P?c2A%L}gz1SmYTSBww2FfS>dGC-Et_szTeRyzSrl>g;6e
z883JETk3z*IXwHW!yTrzHy-q=$*(<PcBf|l96L*SGd{Dgi)GWVtzGw~H@N2e$I8z}
zjzuq$Z{{}oi0%^ee6{O}-n59r-46~OYA_3X`t|rj!Bul=dNjB2$Tx=;&AqqvSIe4x
zT2gDz$2QEY{_8*C{ggFwVsFmmnWp}Ef0^C8Q1+Zp$NKlSr!(F6{l8GrKes#TId^;X
z>-C|hiUV5T?8;Zt;XUmx%QyF(Ro9>NlQ$fNFITL(o2PZXdUbu9x<di~oZ=<5wLksm
zIe9<7#sBu!hl(F8(=X4O)tIw=+SAKFI`8kPwY9Reu(LdN+xqYEfK9HCO;2tq?>p8!
zH(UHh)d^Xny~%M?HB4u)&AvFhS)6_S$2F7hba<8=++J>ZsB-z!Yq?%K?&b4+>yNXy
zule}xEaRNBl6&gR7q}Yf=d}yY*_ye8fj!|^vU=7M%}W+SjQgcEE!bB#o_oH$QT&U_
zn#Ueoro1*0+XE|1?#S5xJ0Csap9fnn-+J#Ad+U8RRtL^1v@ZzdvUzGhv3S#L)h&*1
z(|>;6XT583V^+akoh^|c4AiX7?>*7ot@6I^*_vm|`y`j`TP|{@w&_rWQOy3X@D%~`
zv)eU##Zy<^%irR~A+79o<3mBOfpBIm&yuzuNyT5T^e!v;x|;1-kbC~DMTe4aME-UC
z+OPkiW?8*w=(`vt+q(x2@UE7d;kPy-<y`jPb3a?IKJ<C{_gTEywZqHyuXuIsXSjP0
zlhqr;CtmeA+e2#4MLOS3_6Rn+qx@yd-<MBq)e2=_?)cZ@7Wg~p#hlzfg8x$<3;gdi
z`10b)Q-KQ=r`vWum?_E8CR3yQVdjDhCsmfzmacGTF`j*2u<l~bp@`_GMSe3E=gbVx
z?94Q+G&^^}@^phmjr92m1q&U^&vM0z^2@KcSD&9ACue6q`=XtM&DH}iHG}U)K4d&R
zy}8!-%e&^vM@>2}4%}SexX0q}D;f1uD-8^nJbAhyPdEB_R}KG>!}lNWTHYF`z4UBG
zzER*ub*|LV!@7cd6vcc5&aw7RZ0BbA^Ye%kV|^9(2KC$1Pe{E!TXi)#!#nF|T1iLa
z+Ct3+6RA61x|T)0mUeS@2)&UychTv&i0JtX@5LttG|k^;vPzBX%b)k%(O=&2TO7Lf
zl4I-Hgh<<#vo~*DdbGlS6Z=Ddj@eeNso4p+(Na&3v`I9&6{d)sX(`XVSS0AnWm|OR
zbZp1E3=5fK&zfGE&D^|L|5{AaDc!eCvMte-Oq1SjN?`Lnd32N8;w?IY!c&;GaXy@L
zs_f3PQ=4)#MatT&7bbkTW)P4#$;svH4bD^F)py)*v{_voYT)!$fpf>xN9&e4zT|tW
zlfIW{<ptrB6&bl*u9F26KXF}oJEc6+h;{P^GtG~)J|{(HAFQA3n{dX{ySd|p$A(Rp
zihfLK2)&v;r(mMK?!~F!XZ($On9cJea?207UH2DRs}xI1eR{NzKY#88?XRCt^4tCS
zS#h)3KKr!%g@;r2H~&bF^#0#jHTT;Qn*jg))BV1mm!6i}UH5KcZP0C(n_>xzbuMi>
z7i8qItLGeB@P77(OXk(Z`dqm9q2~S5j|W$ohnK}jE?sMWZmx3m+(kU%x3gPkw%X5~
zX7+DF+RfU9N_*pGboU%{eP4Acr#bBP@9*+<H4gJF{uY_t4+!;$aM@YDa+&Y0Al~ou
z=YM<uDf-Zox0MUn7k2tzs$JL?&N1u5tGCtrTi4Amlj9D(_4(7QKi$VKgl;;=^<;I5
zeAVsN{DQnmx&_hKoJH1FFN^(_bTC??vV_UAxA%39{_!A=6k&_Mi;w>*W}13}ZGovk
zyvUWFY#-D9!qUo%Jv+a<_Z*LH=H6X)VnLTQ$6BB5w`cAanr7NwdSP4kzFk_yCV$#$
zvr{&d&q<f&X#en_ppC=bmc81&ou75x<SEWE%U7|*K3b+cQ8n?}F%GTEF|#&u<QCt)
z=UeiTJGOH5ANjQ0+l!Ug@Lt|IZK>@yeP!P3Ycu9(tBIDY$XqDj65@00T||9C)b{Vm
zj~y;Pna%Chp2X3X=3n`*cyfU@?+GE-4boGa?rj&|RyTox<NP&&*G^|RzbbC~dE(Wg
ztsBav{w(Ed+Qyh(`hH_)grr`V>-nmS@A_PJu5|CUc<dCaB@w<T>D0#O(t#h|^_|(_
zHQDo3GoNS6rr!&-Dg+qhlomv0ZqU^E!#X8YIdAK9)+LQ49*^f&eOOw_?fR~0!lIsM
z`$T5OI(Du4;yYte(zK}WCEU)2g-l!BD~~o#7umF*<z;4Ddw<s7t*_YXHaxrW>CGaa
zQ@bBLklOe;k^g#H3B$DCvJ%@;`jYJo)32!&Kde~d&9!0f+{7(f5<7%-t_!IeUG|mU
zUdy^dDNM^Rbe_x#O*x5WGtMd|opMdsmbgbpZpQ7&6CNymA)&8#?6l$%x3vy#%_Rox
zy(>jaBRtDAHCW$=yj*0M_iu*qOaI3Y4ea{syal#~b(^i)$$#)zv)`#roQvwbPR^9L
zHf5$Pum3#htdl8=_`Xj(cSK;;iD2>NF%H|;RM>=0P+4?Dw2|Sf78^^!F@0%=vKtZH
z3-mMoT~_;W_o+jB+}=Rh@`m>>;+>B+3$o2>YhYDsH`6HUVNYMLc!%wrhOPU-%}(}8
z0(Xmo_%?nqS-e~D(YDD2?Wq&fIhq=-+O)}?oFBArV!+p|Ip&)FOIy}DJ>BgX8LVp^
zabM20l;gqYu>EN#Yi_=An2@T!aO!lO%z2S_H%3?-jqJZ`dd<ftcip;U$M)vGnCSA(
z;-%Hu5ZOi7^UvFE6%IC8>Co5~Y~QJ(;^%+Cb;a_xdb@lZzE9#(HHn_lZ{NGCbI;D=
zz;8@W=}Q8+UM)&@HQedmaj5dULUhZg1F4N`AMZ+e_4~ynzkU7AZH<1-O&v>{w%8qD
z)Ah7iHd}p*)25A8*DaY<ES_xF{$nFi?D#_UZvVv3D}D=pdA_hc!@TZvdDm(s%_Z|U
z6qemi4E(!%>f_A0;Q_YoU#I$BUX_;Iwl+@head^g&%3uynD}3(YO2TurDB1-{qr|=
z&$K-lx<@#7LVS7h-5(QwuoQQSSe)<^NtS%MHNMXL^z$1THKEtL=e~WLRWtS6q^uQ<
ze+~8&S1)pq*p@E(lIym=y!}6|e+ereJZW>?T=8{f%i_A3F-t7BNq5Ptn6OD{&8Dn7
zmE25Iw#I3^YX6`5Q02o9wuK?N8meWv?@Nz2dkKdyMD&T&&sbj*_^-*|G%fJ_dj*^H
zY`vY|H)@D~?7QkH(EoqK0{1I>YG0JgExi(W==Rp%3(p4xD`d$kNyWJCe_wjctnTL9
zw4O%qU)C`>j??y6%zuAHYys~E?So-cO-nVDF3*`@8S50LoW>V-;Bw=1=~WVS3+M0J
z7wh<^{?hK~fNq^b*SB{q>HhFT_4|>aPlspEe^qvP!_wQkQ~%7q*Z*7T%Z2rq?Ju9?
zKK%D+l17qX;90TIH#_9MHBS`WGH<EK<-gAkMBD2sZ+!7P`(4Y2&mzrN7_V)Z`)5(4
zwJi7LTwmRD!gUw7h%U+g+*Pt%@?KrDjQ`@j&(+!Uf7t!rFPq1qZ#Jhe_YWuI{1wjk
z-GZuRMW1$y%u3GPb<wn9;kH}HUoM@r!E!}*h+cr7z^UnxNlAV)wRS~c>kiyfxJdi?
zg##Wd?%MqPm3bw&*G+xbpNO9OM{0GVJDI*Yec0Vru~klY2ivZgL_@*uPX&jcOZ?#v
zyqEYQ!}82VwYMcRCm*vvttG?#ZTe%u74x1>UVq=R_HK3Yf?3|`hyC|jGR<z<)f*{y
z^XMkOl>w3la*CZ(h51Bxb_M)WmyEc4QudeBDv!e&!H(&#f64FL<>~t*EG)`ypN(iy
z&C!H2J|B0iQ`{MMc=EQ!uKcP+)9<X`r*wfM{x>7f-(P&nfhlV*DHv8H&r7llU2~<w
zTRrUP?WC3WmbE$CNp%Tm2A4^Ea9Ya2+vopT=fM2>f0n;A72imBeVfGV=z8z@qn`&K
zu$|s0UAV(}>Y}ceqp|<rT$p42Rc(59e!^OX)2m#K{A{I@;!2JBZtTtq`ttGlzH4O?
zxA--GZd)`b{_>XBuP*re^q4okntQ1z_UHCRclk75oBiD86~Ay+i_=q;mFski_pq(C
zuiLV1&%JO}<G$QPS>dnm-@P*VcJ1=#H?nCN_u8gUskObZRB&f)!$le2c;Dl?eyo>&
z@LRETyw|Ip_HY`<OXY*kS9d?(xzH!+yX`{u^?ge+&v;!4zOC?JUTNd2=?|+nZgcCO
z_I0z{sjV@|nr^)3&)Fnw|H-wg{WC*oop-*X;l#jnr(f$>g+=DH*}Z4>PkSXEo>$L&
zh=+gOt&Y0Y?C)Q-h4Ivv<gz<IN+_G?7uWgqPE2>4df<WE&%XVN4Sm4-*7xVU*vJFd
z))l@#=>D{5T}s!jx^3wx$N3*SePGePDi!+9Y|d4O+gYvbwnmTCcKb*9eRkJ95PSaR
zw}LK<BX><}tYTGio_CcUyE&ijlt)zP`9nYZmTAl?y4(7f)A``MuYWIiary`>S9V^(
zdM<fM%FWfOOBEh!Y?EE>%rQ5y<i+tNd2TQFM8pNLo-CPmRmgok<7|~RGZlSG0*n_5
z#5P`8%iVvARr}~yGn2i%r*v5_XZargTCXO0Z_&2JYu-M*;m35&w{qgT0G+%`uKk?z
zGw#)&td3JiabK)x?q{`sWBS!wZ6ACM)Dle&{O?Vl960k%R{1O6N&R=4)VVS(T%5fU
zd#|mKeY#GT>(j(-{`245QSLqSn{!&;A|v0lAN*>3=}%n)TZ^i<zK*DH-MqxF{BX^g
z;@4}EQw%rkpXPIryCF8cawnUwmYVwA`9f<Xqg9rqMep9U>7Y!>&d}~DUQWwoxi85+
zyHNAD)5qv#SE*I@z9Og2od*`UF`d78U8l&d;`J0c*~G{K3rnv6{VNAes?1MUA3IzV
zwCv6I_p6OhTHm^pd$DxaPSdjMb`Q23N_3yFW@^c%v}vBf-`4o3|NMI4>fBFyj_)LY
z%D%e7+*i13_R-$n^n|3Ts(TddU8D?ErmXUf(D7ci>fF(bFH4q{>s0NM*!-rV>GJZ+
z_cRaX@OjP@x%$YXF<{{olh@0%j!#uco_M|aNNxSw;$!+Js_MTUUH*Y{wZ*#Ny&sLk
zbDvaoi8sY1z7=+oKlef{%<EZ{(4{^9FRFiU_RpQu9y8Zz2{&8V180u);l@Qr`;T6a
zef^#N;-#mWU)3fsP3>CzI&^u=M`PB+4c)uXs`km(>pb0hI%(Yx!&f&xEPOR1=;)WE
zImx~c>mIy$5_&#~Z}EcKAL@E>6BX{59KDxhVrQA&>k!(Q`fZWUw69@?cb!c1uE!Z{
z?*2OYr_tp_XFpc1c6Bgi^RB76DwetDlX@GUSnw;kpV_~|HaIWe_R8a-|LP5w^fuiK
z5Dh5YTBI1FyJe+^v7341?o`pr2;rMw`tIM~`sVU8u8iIDe_fgNT1wUa>ccCG&i}K1
zwRcYb&S{TM_y1e<vrPZaxB2m=_ruP9-~2Y_Y}Vw&13`D9f0QORYI}b_SF3e!!;k+q
zH$O}-oEI`R++JH|mfbn+Q}P>_<eug&lJRaaQaf<)<^z|14~%E}ebZb0up&fv`Q<lr
z<qxh)TDCT*{or-+?obvnZs$d;e`@weH1#^jeNT-FwQ`zM8ewhs*Ouq~;R|juOFa&M
zoXX+%BX^1O`H4KPmi@<eN;~)|{+SVzA;%wbl9{>9W4my!i~ha!>fEcUpSU_*b}pGc
zm21BG{a~KGwXU}NE|qij+z>Pu*ZJ1qyS<cc0o!l?cYmXQziKUJ-EwowI|-d#t0t6G
zAD_4Qm+iz0`m36S*fm$kdClL~^C*A+3)A>_$9tD*$i~f|Sari|{?(Zk*KYF&zI^a~
z)wXwr+~++zxBiur2>$r($A_=oFWUdUU)aCCul`Pdp0R;ip}ij$>$c5jCI_YRM7+<A
zd8DD=_4=t(68EN?PE2=&S7kEa&TZ?mn8kd#XPsV-)&-L~=JU!q&Oz>*Mc(9QRRy2b
z*xqtuvWSby6B(l}MVoSmTp{0SS1imn{C}44{>g_IrjfRubI-Qf$^YO?aBb4Ru}8pe
zM{Q$Zv`EFDZw!K;m>D%U6wXXGK9PFV!tKLSR~Na(g3BahkHjp|;y$1?Y2D=Tu9c~N
zku6-mT@U><FjiG<-4Jczza{O&WYZiS-Ewh@c;zpzesRC=cq5SilT-5Q36U*4`}V&3
zzbt*-%-_-P3*XjD9D3}xbldeu8xC*KmJx`JIb9mMWkyWE$0db%JD=z${tSt5<O)|^
zmKky7#W$&IjE^S25HPgZt6$VJIdG$U&vKi`3ygghGxb&_9{ic_wzs6h^2rm{sb6w}
z=Ka#^UN||{Mn~^-$~T>rlixciD7^pUp{lmg?7y1$+1=?gBXy5#^18iL+2xR==M<S&
z2FgD+>=8ccwm&*3$GB?pxvtq)cD%Ki(^>FHm}O$Wgv-C@;rc&QEpEm>zc2gqU%<Ny
z_txfLwAm=Pa2B^l+Qwe4^y&J^bGT|;r2b|&dtF>pAh5S0i|Z-dSCQjqwdS{K?)|it
z|3`h>ZuOJyteGZW-!|_M-}9r=(35@15rz7<UQ#C0-1e!}blnc$f8bL+$E#0sjGUNO
z>Xl@zGpzqmtFYW)#$2Y5jmk4ZzPsl8^G_*U`S3&bq=WlbB^2bGs8pD<EMxznxH(yK
z8ftGO=m_SVW!(I8&&3z7+d2;gtdp3<KJWC|7ZNQT9r@yyPF}RF{`k+^@aW1G2Gi3S
zffs&mVwftw@Up}IcKZ)Pdo<X;bsjXe7C9%>uQ91>lf~m8wHAigpKP2LC`SIR%epV~
znB7oufm1H4T8*6}U*_Dy&sa3hJknb5{AE<5oZQ0S9X;GNvF$62R~$O9ilOfuYxQjV
z<@?Tw73?~jIE8ucmYV9&2V2$KE?$1A6Y%}ObV)ZmC;uPbY;R|a798{SUiB<7V1AHO
zi14<@mqkxA{hW7xXD+LH>Q^mE=Km7qUFTm#$Q(2>yX9h7lEWBwT|#C13k|D(j=!?h
z`roH#iiVzZ2|GBm<}a5TYna!p;Fsdzn<PtC&kEb|b#1T9G=a%RR@Y8W-?encaSu~T
zHvh$IU7WV+8Laqz&MLj2Yx~Cb+e)1hTeu&dm0;$nP+tFN);ZDW<)>x*WInP**G_)9
zK}^#oc4eTJiN468lBhU?rPe)9d^w6IzH73OkW8<;eN<@6jR)R8=W19TyY*#>qt>&9
z9bQHfqPOPG`C_5g_mNdB*Yz-usXgzqfc+1<Rn~XNo|y44R7LJG*W$~G7fj5m8>dDw
zE9YdsYL5DKLp;b>>%HXHBYckM7Rpu5c8hq$ZOV1&{e=G)cIo_l)%EQAAw5M$UB>s7
z8@7FV+yCZ#;Fqp|b%93@USyPgpvXM!;>spp$=EMU(mn=Pe=Duc4-P1lIahSO@r7dE
zNyie6fRfNzZs8U!BIT2=Dh9vwU@kh<wXt=U&isYy!3~<sYh0Jyx*N8GeTiGbgnesc
z(mU=(DoaS0oGg+&(bd;}c%iCV?~UY|-6;pFY>!5%3;#HDZ)vX1v~>@>4$NH`a<<a&
z^n(SC0m`@5Y!oX^>(HKS+~k(9Gwe(L@%;IR=Sj?!>5Y50x6V;?M&q4^#C)f`-mfaP
z8$6ms3!a^j*WFWiVb9ydSC4o3_N-!_^2|Z)PxShw(S}byJz?sZnH0$=>#ns?=c&T%
zJ1K#o??MBW55JK+S?rs-r2UNaht~fLsn!c4*B%etcrn^w&PVobtgls<tef9>=-rZ?
zU;clTo*Q_{zPr5q{G;!)Znf9%x&AUEy-+xQwX>{Kwa@(Q^Jg}S@f);uR&QDTdzq=K
z%-6lM45Oz1@R%nVT<RKq<PN);n%2E8v4Tf;R&$?uu*lWN>8a9MF;<<hxJ~ztZNH}U
z&?W1p^NtylHVNKi`txdWY5P^PP`CQOzWpV=)7XE1yyaW!7rxlG@|nfass|;UA0|w@
z5_9tjb6abFW@4MwqYXPl-KN>3zAgB<Bs1%y_^n%$o>v&Ne_(l$xUC~<`2x-GmQ|aI
zf1EE}qx|0WwgcA&SHZaRURf{qr)t+~Z<~~~+**H{d)C#O1<}m%o7Gj61C*a<Kl^3t
zyXV;}-d+aj>D6Lo|0=|FwP$9%i+mV=Tgl4rp|wx+`m$}?)32tyQ(e3K^V-y{x(#->
z#l_?QK3r{Y^YgL6O0oBAX0PM^^n~f9B9}s!#jCyj`wv|CqCc;$*^p)b!~6S>-T&{j
zzkaV<(_gnej_d!*#s8ib_xqLgpTFn-{4W0Uce_tjzNw{pSYM@>qD|aX^{Z3){+xOx
z(Vr8L{5<;4g(bX4t}i_+8FDIL+xXyhZ5E#1x*a^-def%fn11X2mRY~bE4KHTU2a%v
zAtRLVrJ>^g>zna~7WKB)zq2JST>o`&%1qfm`hT*Ywsv3cn0{))GJW?8c6yI@9Xpi0
z%lgOs|Hji~ccs4ge%vhh=(c-P<7ee;-QlRYA?Hol=}kxGM5j7(N*W26pSX06rA4~s
zpJeve4E~5GDXEWdOD{`ni0VIfyz>}??y=4#DI5Z_Cb@yP4Z^ibqZaK9Sbq4$j5Us#
zoK-HWzlE+yPB>$6aCXxRgLx0D#WudqX;PkS%Jbhjx@UzzO=VzQIM>YhQn75s6?>mn
zc(<-U!CjVrXwkPVNs0HS@1CRcZ0+~VJs;=I|FJ=^d~Ffi0p$~_ZvxJLZpzD<apie(
zjR=nb>jwV-kG7`?-ix}~759GReEsU%_K9oCHk=Re{<y{K^VUwi*Pe-Ct2yrFtFj);
zHM?;+ruF45g_@hK{a4+e+=|(AqN8mVqr6qz^S9I6@BiIU{^_qD$CWTej)UII>+fVn
z$<DsGxg>j249m{ux-KEx?=6D!7pF7aJren<^|@41g5<L8C7&Blyqa@+-5R&aFV^@q
zJ(bbUHsWVGGG|>vYD%f?QklG-#3NtDc6^TvzNBrnftypRw_Ll#xK;Fu_C@tgt$fG#
z-IY^zF?(tob!k;tzMRID*Bkaq34OjK_gB<G@=3eMzxdCJOblO^Nk5ZTeH8YFdG{m!
z!cA9??(?jS4=g-8l~+JzfzY|sQ|@hTwrVcElZujbW_Dewt-Y{Gc+WJ&hozA#<}PPA
zS(M++bC}uq5Ub&-M|DTC@Bg#m)Xm<S<1E}#?Vf0Gs4jb^!jEV3$_3w^5v`owoz9Ty
zy{-RZr@Khe{M8TkZQ?x~aCN<m%j1NfrxHA!P9OYiC-?Z*fg7{<7oIA(5_~)O$F2?Q
zjW#^ya9OS>`SIL8F@8O(B|%MfA$uivTrXLbW|3d>cgo{7ujg8M{!uU7>$~K3%YKcx
zz-PT|XVER5G@E?=dppdwH_33bX+;)#Ju&cDR2y^ZcYNK-n+8v2G#cLJSv||?;y*LH
z#jE>oh<B`gn6#<L>&nMF7Yx;zOa#82yzjL#>EB`Ppq>!cUAJxSXng0kIc$B{)9RdX
znZM_$d0VB{<Z14i%z1Ct;~CpB0+y@@VXd2URZ8akjfSHVRh(~m)Q|Ffxn9}!f09$`
z*R!WKTrll^JFk6}=xVQ{bu*JBElh0IaKF?1v^)R(7lu4bbMuZjekZR!l#a4}@hE&o
zOT`lYGqLX->J`(z94HK&v3{zkO@VLP-YAjWuUb3huO|0xkc{{pemtQlWm581?n_0n
zJ*$dr9_?`ZExc>HiFn32*9Y?^{r>lM#-}YB=XK-HpIB(ac2{P7`ko1*-NoycJt@-r
zG51l!@266-E;6xZDT(&!<~LammxkoO-7TN_GJ4O2U0z~pqCPwU+nBGY9tqp(as1{L
zKK+dyFG~-0CT}pmus}1?v2VvB!!I6R1=n&_AG<Se;Y5e<Fp&<W!wai#_&f?dvvBb(
z*N$K5H+R@A%}(5TNv|<dwCU>p^W}>+PTRF+_4mk_^%m>wcKFVebe^>QxsS5Tf$EF1
z&V9ZA#3a@!;3)gguBP|%uDC9kr@mo};ELe(iIFZoH*+SaRIc*-Bp3ej;{BotyN;`T
zuXrw7vH$Vi&L0_ap<xCmEN>;ZJzDzU`|B-CuL3`;+5GhIg2H!fT9GVLOTXQCwcEYB
zE?Vl=-l(_}4=esZTV3^O<*aS0$5S5ZN=F&hsAsn)&5)UQ?8|4d`L|WCOyxSj%=OZ^
zV(0Z2w-l=WFZ_QpjQ3yF{Dnp)fdxypyfje!rlxzEr+4d?JC{V&rKS~IC;Lc$5BO|X
z_vZK6!q;0okJKITn7(O+)}qbAZ|&=Met%R^{r~y=m*N4IuRaRgUAW3@wy+JOQOsvn
zf5*0(Wz`;mJ45XZihPA0y_qSot4BCDj9;^&{`JxBhco`32`|)Jwf11R-v7z>zAiIl
z=PFupMnUM^do%SV@Ab+|7cR?Av`8!7S>ru%ir+yqGoziin%462*zhJinAl<&(5T_I
z?Q^GBap$+(&g-A2T)lnxMr*f;e%^062hKjmVBW)xdCliu&uf&HyS}IY#qsBH+cR$m
zp6i;rz}v95=tgzIqdiFy-KUk0zRzBI_+n{W$i<o~b!$?K=Sx}nZThM2sp6V%VWGS8
zpv*h7dAYJm8Cp_LrzNlUe$TV<@Vo6d+v|B-Y~TMe-L>y%7?-uq8RbrPv%t)S0X~{q
zN7wMGPrLQG`N!)S%g?;r*z)d$?R%kewWX=y8XScWWS5>T)^?68R+cJy%DDcgt#yvU
z#kcO8r{DYh?_1F}{)2v-?oA2Q5!-!TI!fI2Q`MA|+GUdyzu3l2<}YFJ=wvKda(t8a
zy+xg(l8$SpnU_t;FK~OIpp?I7+Om1c%*^eaCppX{?T$=Ub)C5X>+aLxF+4Rb;*k>f
z&ld|9NMABFs#A9kY~Xe_^gpAUd1CSQmGOre^^dCT^t;@;p>dj)ck463<z9|2mZ`70
zdX4QP`x^tcNyVF1{EYp_mnh7n8t`Gc-uqkKlRxH#G3Lgw^mc!|A*^#X=4bX+8AFTx
zQ`gC=>j)ixS$%oZ)50&mxBNL(sLtlpU^RCR)8hNdQQID!SYn>4lDj4Nlf0|_qt1$e
zX|6YqT5PReS+Q02Mr4}#!&Td~B^G<n(g@qKUVdIxV|u^^$+e}g?6Q8^Ou6ou_PHqg
z;zBmT7k}TgU5r1TQ`BrJnQvcRS0Xb1|I`q3Pq{*q?Ul2pEMoTK*|M%<de`9~^}f34
zv#hLNgnu(JU;IgH4_lH^;X~uhZ5cfAsnf$N{%_PUw)nh3W!H%biffFOBYlzt?)To%
zlY6KUu;bv3vh1KUE-(C3j^8dWmVbNU>tl=82g4JW+M9KpzLj}7*1_QUKb;dbi9O0;
zo${?Foo<J(Ie1t~9pjxp>-GgM+fx^;x95iJQ_Xc-v)fL2`4vH{=`N=y?hd_ulGR;B
z*XOlU`?bK%ZjZbFTDCmC_B3yq&5kpBy)Rsz>u_=Eg{L>J8DH74eg4tf(&;7tD|E8%
z-*SE>wZ70lMdC|O)BLpu8X|+@*!4_(x65DC{S%m&=Al}%X3MoL-{b9TrFIBS6Ks8d
zJ%z!^W!=p?H+J;hT5_*BRxsaY!UGZcOCs`S%XZv8_3Qe%&(6QxTq>&VE4I!3E^l+U
ztIPJjnoj=JmT3Q1s|x-EO3#*7lfS3?*^`OuSFYDghBf+mdo(`WPCq*1$)z@yohe$i
zhBCjd%1kbgzhI~G{@}3=siYep7jU{PITg0SS0gs@^r8<zdKYt_o20MkU|oA?#*1yS
z1-dd5Z)a7lSjM_y&BOki^Pinm6|?(s+eq6o{ix}Wv?+d0md^R{^8a$?@O)YHzI&y{
z+7*7RhSS~|Ejz^bKVz=I3hrq+eIM=ew{ftZwYrz8ZJV@XPWt;FT4z#Rx;|z8UL5@;
z*0Ln#)7q~ycAuNyFLLnAw!YexGnP6}iA|5F{`}*y-D;Ki*$R1;*{wg0&7Z3DC)ri}
z-<reA+Vje@Z>){Bv-zO6F~`zyZimocrY{!v>I$Wk<Il=wZ&)xT+3=zD*;$*<J>5Jt
z^Uj{yGUX@C*U!hDC<~9czmzR%32%Dd+>2*zPXF_3WL7@)=UU|o@zdUVT9zFlQQJ7v
zCVaa2VR`A38Dcq#3-;XHCHcx}^TWE1bJOJ%Ux@`Th!5YlWLMlSCHLApa}=E2UHSG*
zy>iWUW5hF^=fdY!OfnJKZs!rR_4&nIH+`cP6|=y}^CV*u4#hYv+5Uw0hh=ZVe7^Sd
z^osVHGPcXLWoqq4t_u#9-~M3#r)+l9Tm$vCZ(moZ3;+7QeEApuQ2(-H@pV624%Ke&
z|FQf3T)~Oy$KBWSxt-^m_ulT|{_k<}b8G59wAndbN)R|Ce)!>sn5ttkhgG&ndEb6m
zaNxqtBAvNfuOeSsm~7f-yXD4~U%3ko<|kKPF`K5cqgz2HCn%AxRywKAxxA~h@uw`~
z=H?&14qw|X!@M;vajxuTo48l-gPBoJZ^P;n7yHhhxF<bV@!adh;vOyc7KS>_KBKAV
zAszDf_^tYBcUL>`UGOMZ5#_A;KKbo2_2|gb@J3yZ%X?QQrs^F}_TgP7t=DO`jDbVo
zapsZptCxhD1|IwompA#v8w=ix?$M8JUY%VvyHKRRIJB}|TGZs|zN=Qpf+Fs2-S;s3
zgmQS5Z@S05+>3kKJp-m~W^MGY$Y?Y?Dwnu)%3B$sQmIyFncCYMtF+#wO@8XSAh$(y
z@>g}O1v3TiyCoeD*miyU{+FICKR<5%U%20J{ccYlxm@qBTx&h!o%hVY=j!}3=(S+W
zjVGHnsy-?X?3eJ#5I4D6Udqoepm%(?g09k*Z?pF{=l`m;SHCXRlc%;u-{AJr-x3Zh
z=f7t^e&{i$QD?=KRV6=#kN75W2P$v7f424Oy_l7v8+aD25NWd)JKfrJO@M2rxcc&|
z-<pz6Omc8aG7D5Sdf9BVd%@w`nFn?$PSz5zeX_#4k;}tI@wwCO?f$k61?&99SZ^&3
z(crzVB4>8!U<vn0+nbHT=EoTGuOBrNlw?v*vd-YOdb01!mCDRQ_MT_k6Xq@anmhf@
zqjL+7{os%A{WU8<-XZ_Mk{TC-aMu%iq*6F?>U39zvdA30dVImbkCQgH8YDMWIhJdQ
ztn2?iJt+C`xythAH+JbX>~&#C*SjuTvU%H6;X|IU6_h`o`1hsh=FcPMZD&P3_ug0W
zEjqR0;EZ6dE!~0FSFY=dzOY&Ez_hH8AIH>PJ(Qx{br|cUnj4LKFKjseN6gD;LdP$y
zqdlp-+RWJ}qCb9F<#u4fqwKm$@wR!Fx|KGGyVgs%9zS}3E9Qs+&mOU(-hEG<{FeRk
zJDR!b>Bh4M)Vh9KMhom%vFDopB`Mu{$7(;vtRM-clL1UN>lSdkONjP%6kM4SE!Hp2
zSvb30-O=b`D3kTcTBca;Xg~I->)dL3uIbV*BEDZcDLiS-hpE**KTd!1KBcr(?`l-o
z`^m-jZ9Y#_-SPu`4@;((3jP-`>3BDjM}=GV(QoVYO-<(_?0>v^x&7JZh{LxZoRoGC
z^NGH)`=k)R;CqMnQ8h7Z^(>Z)@V`7Z?{aq1y%(o)6c+HD`?D;er8e!k_ZOxYR~s7N
zwVb&)S!vd(m#N(gswRmZ*1pt!aN9|T$FGAuEIu{AKa-&OFL&nB9V#Crq%XIhS!cAE
zL1Jg#E)T)=tV_lHzPKE%59nctyS(wm(ih>s#k@bCJ|<Jyt17ec^pvu8@%NSzeV%iL
zYB;A(Ino<f?7nzL@;^f^5l64bFSKSibY<;2!Y!;VBP=hd-u!>r6b7who{XGf;(V+h
zrbt~7ot}0wc1hkGjwt3}(`R?w@6NKFB>Y6&Wc`BVW0kYcTx3(9vuo3ih_H_O*@vnY
zZ$0qCwd14rCmZ2N;jbEdm`lB1<;J@n@>i+jy|v#>&EmS-iD|iVZ8K$W9qEzroaY)f
zzv!!ft?H2$ZlN7nbFA!G_D=Yr*P)p{qq;cvpqNqWj(-A2*cN85IQy*fH;<a3{-n-x
zQ}(tzpC&#<(Yp0utjN)?-|i<)JoPvA@f%tHFY^u`-=_BRtmN8b#*d=j#Jag(47Xmi
z?!i+dk85kw#c#?ey9u6Kf9oh$-zUkg&qli^^l#%>-QrboKg3_&e(I?WE6P6|_tTDd
z)^_JU>1}FodgFJ#KgDf#<-#mWMAaic%vk5Oignq=sUZS$SvVqvl?#n)p4?15VD>a#
z{JoNyllmq`RhO#SdLgF`yXu>Iq^w-_H*Vyd^?<9AqbSn7YvQ(|^>tG;+vl6Pxd=uc
z;$+EodYNWl8j;-EA(L`U=Gw)Ow@Y><EV<Crzb-oF!><UH+dT|Eo4ppOR34t#9b2+u
zmyX(L!=-vzA5Q+8zcy9YZf=9(EN{NqUv?(GSB{+PclG80w>4W9CrRhaaTsxFb4^y5
zACqtGC+zjlg(aOmo#(GymP8o8i%rT@Gp#n?^0eEHb{QWII4=!Qt#tQlz1SJLN=JYB
zsghmI%=Qw&DeB30XE!vjEPucKsAqSovHX{PCz=cY`WgI_yVm%-Kgvn|#-(&MyCwgb
zTwN7Ko;+eKo~SG^=}yI_J25->Dyr9i`PJyvY}@v?%RMCf=T|+g<1Ne5oVQFnniLYd
zG&8nW?{wPR$9hSt=DjuCd+(O~dQR#6|MzMY%D#8$c=%t;FGS~lkHAK`rv0oorc0Wq
zYggMZk#bxUIAg<2-c>h)zRF#xsekM!tH7o-=g4WMlH+@iGC7u%Ccb13__HC&aL3a2
zuRM<$;#DpDe(!r`H;Gs5O#cFIo60}3?8*G{4<a}APBPCtmoA`w;PXY!qKXw=&E2b#
z|4d0LT4kNl*y2*N_o8O(l$^`;Pp_%Y%}JJxd2y>!=T(2`-aFlOVUrTuW^H%l5t*;>
zXszHKe}yv}G=tb~C~xQ68`qj(tCLcvv}%Lz!~J?9saGyrWG86KOO)GO?ppM}Y}pMa
zsoO7D3cJh8lM_$a-~0RSb;V=<V~blCPgBy6GmwofTFaaC{71N~%AP*8J-c*Ex?TGx
zS}2;W4Nt$#7W>=7!}@yRE$NkKg0G|{@;<B0mNn>6V*UKEae-K~cT;)0Vw0v$o8xY|
zpO@#ZUH(GQz(2=LKS(=jrrqQs@omd=e>*&@v|fAs`J!pJZdJUAIka<~a=BysE-v;M
z{T=LKdGj32rS}MMzR%%Y%e}f}XQN#G{v;0hKTgkHn=V;3v;JFKQy<^*yJjnYJMQ+`
z_HA+R)VsGU3f@aN-+y;Gzsg4N@At5|OZeaSF8gsXSEt}LQ%O%!hGY1=s6dwp?UVjD
zI1g(J=V@q7*C;z}eMT`_Kud6WlH!hShhC>z1b(Sv&0n)Lq)9<<(c=RLgP;2CSv!sE
zEccm}5qG#|aOrl+i$xi|75*Ztp%Gl-p7kMB_Ni}*glw{&`5UPhp*Mx&^m|TvUS?5W
zEIf7f+a(9?+FAyQ@~u6kK0SuBbqCks4+gXMe#`ZFrg&@J%NmDi(;MB+9jX2Dcw_e0
zg%dim-}-%wK4+0zxbEY<kORA~H?QGyQ@b$NVU`carQ1h4LtnKxc&8WN?lh=*!B_eD
z{LO<GuZiuvvFQKT{fp}NM%*~Q?$72nnQG(r*B^Am_7|_wH@PC0q(14M#wxGrF*`N%
zx#FEZE(?y!T$S~oL9NpE(w&c@PoL!qSS4LtzA#oY&3PjKl8!vhkO;4s8xbeDxR@C4
zJd-lmxoFAuA8k#m)*lI6q|je#&@Ix-ldt*xlJab`vya*;lkFXU&6oDQI_2?lyR&H_
z^Eh@0-WNz-GQ-KoO>&j;A{Dj+riq6FwPg3^#I3lWT)pPV<*n_X40%mI6#5F!vgcoN
zpK<=}C*PI-Pnh%k#hm@T7PsF&S!8v-JNi`YEZqZcQ4!&;K}$X2`I6g;rpBJ*RO-6(
zO5yf%PuBG-@01<Pp1yhUr}JE&{&wD29{p1HJ>!p^{%<<{@1-;;GpwxjUNRy5#j;s?
zc58QUX6aj2sK)S|V}jf2q)jsE;*otPgKtS^zpB{$IC!zUQC7Y1iz)gGmPkygKKaeN
zu+jZnT;KM>>0BFJKF%xhd;031)?Vin?@K-#x>s#7o0Zh*GI3@5hI*mqa}}PagBEf9
zZO9Gzv+ZyrLx{DKx~0m8Yft)@AIRf+keK_F&-Px$++OAT$Bt_2a9lCmd4JLNG|Re<
z-XevI0rK9@dk=lBGiaU86Z2!^`~P1On2wih{wg?Ui{*<Sw-T3^?6^61+bp~9dF{JG
zmA5@!*x<kG@Yy(B{U2pV{@#!=Rebd}o<&jfPeRsnZ`o;YYotEJyp{-L{E*?m{p+fG
z?)ScgHD$-Vq*cNe<<~#oaq+>QIce{wShjtWx_c|q@{UFCGci9)p|{b2yF8{h&e*m7
zSoL!D<gMDN34K3>&e<-%^0shlk?o~`rwJ1-YqGhde@iV5TQvEZnqcddqe{Pv7gRPe
zun7M6^rXYM{`9St<;_m-CgsP;ZqO}Hj`Wt?cG*9i^~ItZ*_xD%cMlzzueLK*qS&~K
zQ<?QKucG6&DeL||OPTMzYVB36#Q6P@=N9fQ`L87#e_P_u`5$k#MYC)?`TZNyXU{^Z
zAChbv4(vMg;?kS<X-B4<Dfm(K|Lnol&DYhd^~>YrXC7fIk9}8iLSg&m8B(dGOHL}T
zK3pT0R($8z5&wGq(6!t36$E;+PUQJ+-gwNiZ28A^N?h;XKi{P{<1C+xw+r8ws>vk>
zZ~E<4yS-9>D|=4IhO3&<aq=s&U-UE2T3=`Jj5Vu}lbQRC=iT~Zr=qXX=MEiE5d9eS
zsy%O2VPyZ5>l>x5HTFqde0*)k&(aI;YaS}gf9Ltz*vjBK&trC_n5@L{9HY+b@uvB!
zzew`EU)r=c_o)ZFck1dBH?spPTKkqvUM<9YN&U*X&C~UHJ-beQt%^Thw??s3+<?vT
z|DHc8k3Xp#bLY=F+VJP)4<6-TGRCR>r})|amp|OId6wDY<f&;PI~Rq8Z@I&2yJktp
zmOhhB>ki7ExoEkme9!k?&P5kKC{J6P=l<{eL))lpdlahL-6HIl$FJd&X*jvteEu8n
zNUwa`puCIEGp?=L)paa+^UeG9)6)7soivP!f31JvYv$slO#h`ihckSl8mwn72)3y_
z!C<|WJ1*h;<W<ww*DP~decJ!ttJ{{cFFgCUUlQT?u+2;F=gt8Bcbglpy*^ktw`cwQ
z!&zQ$)!(eV@ZeI<-&U(@p^HkqFXjbatu|K{U)VJ*X#1B&qvciyqQh;s&60l3^t4Zq
zVY{d2_Fw1!{rK_H-1^kk{`p64vxgtx?W>O0aa(DTGiPa2!7as-;OV(9r(RNOdT>u{
zg1Xh5nPCjG44&n!;r7y~J#s8jYLY`*<>``FKYzq6J3Q;`-dA~c-;BF_w68ADd@3Pz
zvwiV`9l7~gebT=sZxOTDy~9ZA-iOe~5~4>c9!ayyTkg4WvcW9l<D1vHPDk5=7BnmL
z#_r?2x_he@^X<QxhU>m$T-RCjZLRmMqu;i<y<B>?eBtpmZ*IK`DvDcQGIhOZ%Y6Ok
zB}ab?tvx?IN2crrpMB?&!rst{_H!2TuAj?uyuj(pqgBUP9*0hA|6G>yws!uSp!`oU
zyBdq?UfHvqm*iPL!;CRvzKit1ldm>?XZgpPz5n^18&T=Lo4uq`gJ!w%309l0ktypE
zD5~4qGi{sy1$`yi8>{(#oV^ygDOQl@{lfh^Zau=Av_os2<d?~}zRP^!V_W6U-eR+7
znXGh4yG{JF%Eu?{s(!6JvES>Stp268v&_CWKT~{DJ|~~a%rZ0l8RBbmS}W$oHH{sO
zZ|?ERB!wN45s}_{{`Og;yho4z)mY6*R-2jifPvdB{9T1X=o^Q;H9uaeeb#%opDoOM
zkNJM<xU`bwHxfw;-19i4G+Vb=M7R77zIk`y;m?ZMFDi?Ir`)&`c=GinEBlARyMxzv
zOKmi^NVEJDFCyyqbdhppLb|SJ*@kaQQ;(>c`X8LM!^Nq?W@hih3)64Oe!jtVYD3sM
zhP5@T4(^;C(93r>D&v7%@~qEAA7hQ?8=JiO_ImMjcl|zzg9|4u?F{!{v@yd=DU_9Y
zCfD~>zuc8eB))Blu2Xnt$G*2&xcSQ5*mmU)y*9T>*sJQ?r>9&G%&oSFFA{50S@>F?
zLu}RJ@E^0Tin7h;i4)o)YVsle<Hq1?`y&jRD-|y*&SRa^cFgfafMIX6it$vQTS-4_
zs&DMN`cc%)#Ew@csP?1p%Q9cd#I*%)!?oT<%3qulSmG1;@zKl7Mb+E(yK}Ov?>cGZ
z&n)?8wHniE#RAvw7ke@yHb0D)_-LY_;hM*ABI=ZkhE^{ZgYMi-3;%MizpR@4n1ywf
zEKAPr>aS6&I7`ZQZ7y;2e!BlF+v}}z64}QO#8owKIxYCdMSs5MLq^VJMn^eIB$@i<
z*hNaFDrKy8Y54oSL)9;^NiT1U)bC$qhc_(Wcw%;p)Q;6Ltl>XD<jtNFr}y-2!vBlQ
zg05HhoKDxDz4MRgk*C>`^Gf{cpOrp1;Cg;?^(mW$^{SumeYmc5rhQ}D9e&R6nXCfG
z!ehl+7aY~xn7K%J-{~n0^(${E2QAq(p>$#5wZ;4M_V#T1w11JG;Hu3MCl)Q8AQtui
z&+D?V(9>IP)qVP{UY`-5V6gjHZiK{|CyVoTe^J@iw59U0^^%|tVaD%Ey{)5itCm)s
z_Epx85>C=zI&D+Qv^VqD6vtSc{m3<AjrmXhM?ck{?tNCG9w2A?@x#s!{mi>=%Kx3V
zYP*iuhtsVtUK4Mb^nCky&3^ym0&kv`n=%^jtbOqHc8*_bjHe@;)~kFiRv(s=Yz<~1
zk+FVK%N{Uv&pEQy&ywB3{HlbIwB(f&jI5Qr<}98x<Ngx9DTnU9VKOdw8sbpHd$Qqq
zR!_)*%d3u_QcMWib7RrxXj>Upk3*t4T+fu)DyM`Tmq>lV!&dcs_j+IX+?MHAs}?R6
zv|Aw(a^6X<$<O3r#{|2k6+8F7)IPsCzVb$V7MtUi`x;EH99(H-OGH>+J)F$2MYHw8
zJ!hqgSqmny{SFatTU{@6X!rZ3CRx53qcbH-xkQszY>|lJW$v50@$~aW5*ZVi=ROsG
zFnzUMOZi%xtW4XYee<@Zb}Q_U_)&3{sq1#-<;%;nj4$^#xXk;q;o`F9`_D|zKG$u#
z#<7s$Ub>m-Yvb7;Ld}%6T}*TN5)*oXXWIU-+ijm%Irjgr`*i%_<Ku^y$N&9!Qr<~4
zyE5s-a)X5{yw}yAN?ld@(R<~Y*#Q>n52bdsPMBv`_sRE5nW5w37nvJ)zhrxfGOlr)
z_FP$W%dP6ZG_U`G-skTv$_&<j&Qj#0V4`4`bj~I*x%WgwFhf(?k!`D%+pm_7`7~W3
z&9uL0%jsD=TmM~_kUM|1F~Th%Ecp3P)!^$FbT)f^<;_@EAz#15XWRY<K68~;u{y9C
zv)?#d))Vu!Ie=MWgI@cC3vQfB8=D)7LO%cea`NZP$$S;jUmtU;?__t7T5cU(5t+30
zraFW2oUJ=j&*`>3pP_Nn)>i)Xle9{<qwltAS+0pcvhb;T#BId}#@zo7=iR2cyuQWg
z7aIEDn1aEBcgLdA!hc;bYEQh{5ovjLvedsxf6sFsTqw9*J7M<4Z~ph?_uAa3-u(aX
z!+v(_%Zn0ryN1?e#LQTG`DB|`LT7r!WZO~|lWMNE%Er@WZ?3l=-W<LldxegOe38gw
z&5NHKZ#m8`nQs^VbiHJyx9SsBD_Px8^H*9`TPHp{e#9g85l^&rID5&uk{Z+JUb!I!
zU5mpcEstL}<lUJgrO|o&g`w07NwF|L?Neq^NsW7yEJ9e$ES%YK_JYl1+4`)TeT<16
zJL8u&u=KoIv^;e4GoPznk@q&PTXA@Hl%j&A>iOf0K^0QvJNTw7iA$SYX3AXO(eifZ
zrJM-~{#RczZnIRl>LTkHbZ^(m>*1c2x^}`BpS~0LW^mFl;kDoN+-B7!n~pNMl>A#c
zQ=<28`>wzhZ|2BNG+C(5$+OR`X`PVTv&E%c_wwD`TcR^d?mXL9f9;w4LHRw0!hg+;
zVgIq}r<Y1lmDkt(no=uP`IIfpZVR%|e0k!Tgl3-6g(L1&5~uFI+;;ccvSK&J-eqA~
z(>Y(6Gf7A-b64(I==$lt{e;HYYuT-aKlXmAmff(L$(G;7^oh~jy~pDodKV^Gr22>T
ztG-hb;0WU=-CdkvaB=mq)U~YXF5fQge;)BBJiM2wIwSA)@`c%I3(qSsoWFZpwQ4c5
z*a5TERkhqA4WAQl-D>jhll-^q{oaMQF8wqy`_DXG+V*#uvsz^2ZZ-Su=R>#U9(40?
z3%mb!#p87S_^?M$ms<NCiW1=n^1R(UqhnkBQU&>4uCvY+otl4GIlbHH?Swt+lulmT
zc8V$S`{}v*o0@x49G1D=$-nMkFX&ubx6z+Dzir1dj(FoqyNn;?B#ABI^`5=EDtKkJ
z>X~V|r%D%xv+(>?;GMF|N|K{>%|~sIy;~a0q*ILIXU#kvd{4RS`lZdK>m<Y{cW;wT
zbY-uf9-?XXQEJ&~VIGGBQMcm)^9*lK*gx@f-?nWx<-c^v7a9A`GFN-?f3o}c^<6o0
z`1V&<|M(QCvB7WY=|rt9f2_`Q-`=uCzd?GJ^W)e@Y1)i;JwLOZICMMb-_^?&E)i{s
ztuHRzxBvgJJWjx)LF<vu$ER++QV)C>dwccNuiJjF+|QDje%qle^|q(w?(-Gj?(K={
zRx_!!UzPpsYkB<g$JN1hH{N#z=}+c)qV)9aONR?_f6DZVgukSmUz5DpUFuHfh1N&D
zlb%k#J5Ri_Ftca=v|?=mgG+)xx4nJtaPa1tgC9>v9&pK0aa_r=Y(~M+$DOk?C;8@9
zWxFWLEEiJWKgZPSZ%4I`&YBsmr;J2;rm|dCxw+v&h3L^M3VT;scXs*-s6XLje(ZYT
zyl3x)EvKW3j=fZC*3>^)5ZREho;POBx{%w9obKgaH$<7kv#UIAL~sbGyf`$+G+y-Q
zBqc*F@%6l$pY==nNZHPua_D$xb<d7<kxI+Awt8wfym;mGrOMB8>7}$qAEK(~7~J39
z7|qVaSFk#v`c%jchwX2!t+-LrU)AHb-~i($ONlK#oAl0JeBH#{bp2Y(RF4A9Ba@%b
z$=afKTEi}s{fVVhr)15(eY2P@#GOtGOnYH^uG_G^kgKsWYlqi^n^F-zhd;fPTF9i7
zzxDX*o$Fum%*}Z6gJsGpk@efob~(Rs<1!C8air>}>CWbJTI=dl&YLU@X}BA|sx*8-
zwc5jZd8-w4zD$(pI#a(;`|p-&?q6)ox1_GHWth78Yklok`oi(5s-dkmQR|P9gsym+
zlTRFLsH%v%Pw(s_b1EWUp7?#GNGmu;(zcC@cg-V10bkxLe9af#b{Sijaq28Jeb}D=
z{D9oN=?^=FO|R@Q;7VLrr!w!};SFEjF(z01`f-QpPO`=-hBtCnQ>$+p@U9DVyjyJE
zt@`r6?n8ZFxj#{spZ>j`FJNnYXLG%%%))!#y}5^1_k3x)o3`?E-$Aok(NA9l)-Kd~
zIk`MYvOkQ!qX%@nkly>3cVA~t`Sm%t;&)AI{&mSsSJ|I-9%?<ydU?Ytxi2}BdUwu|
ziP-t%-r=pQ#VxtcbGMwi?&Njy+xC*Uf~T!(Wc1T>%2p+*o!+_fM&r~C9OaGj;YYN4
zB;*P%G=}dJQG78qV85^FGMS7lZeEXeIhU@0$rE&~(oak<zhqZf_-Mzy3o#4(J1jzz
zCbOy}GHc9?^ts3~IjiMG(6sp4hMXC?TF+Y+iTunGRc4Z%qI>*a2y6c%4bkS<;Pnq}
z4=##daM5(Z&Ff`f58Yn=yiYi&^{CK?O63y^j6<$I@-;a3V8#ML$A_B1&F}0OHOo6E
z`)hb>$+#_1e<dAq>A<vFsmDLA^+j{s-6&GE?(C{Z7q}utwgk;!ySG8WNc#Fb@!Z8v
zR<yfDP1<;PU(!4G1&*zb$8U6s-aoT?n}C$yK_%tiJx9gv={#32`pNujN$-@9*mUmf
zx9saD23b1`3$9E^Jn$r8mzHMJwIwUonXG4H(VYM8&s_b$e_adu;yJDQ)A_gQv7fHq
za@ngSzp+wMM)_^!48G+m0tLJavSMAsS4c^<ICL%(@JI`|xA(jFsgN1|J6taPI3>Gt
zZ+l8|1C#wF`ED&?{-hAiYci$b4D)OYp6@J;d{yz%s>6Oab7Nutt8a(CbY!o5aBrH1
zXQVaL#MFhaPfikT6Hm_m=9b^RZQYd9KkXOGPiorOq{}q>d*`ps)3j5h_RoEMETGYw
zXKUA^v)``0zLfTtpRZ)kK9OmMo-=bAHpQ1jY?1$|_I|~#2cOdS7uKX)&9FTGYWIh$
zGdJDZV($`U@Iv%jp-)Bpf=>2d8nyh&uM1yY=6kk%ry8$u_S4+&XBBvEao(GA!&ve9
zNj6XCVp|UPrP9nZzkDzd7s%(n5>Rg2`{1ESVeb1!^>Throf~4mo_6o)H&^mGurBe&
z<o?7Nclb{~dA};&t|?Jd>E7ARnNe4F->TSPfAv{&r0zO%hRtVW8qY9tyt01(aAIh~
zmYsiFCj5z=!u8<#>D2+&!r^O0BegfCys6zWYswufH{pd2inT&5Ub7uOT4i0F8Yh_f
zbMDI1@|PO^T)paMz4(_|`9{qy%S*i0_mdu9yZ&SO%sK6jZ&yCqnO4d7dF#|)mrt}x
zM|}7HRK1{NhloM$enyj5Q31C(UYQ?E+5AtT>!Zl5ySndkrk`AX;QwzAfA?~Am#^zj
zi!8i-{XNgFolCT}?<$}5KFMCnR}%8&_?o+W`JVT_s@=|f*lPWg+bydPuC586QOf_v
zabHM)z_V)JjFbEsEZo1_SUgvSuaxSo($eWY^X<i?%I0HJcx&`{*Vx{Sziu#XZ|a%4
z(8D}y>%ymh_^=`IgwVH>@|RUEo6nnMx`AcVYR6X&TTNF@Jvrg(MNv!l#aI6~rsZVt
z{%(G;>+aRPuaA}IzHkWRFUjY9wyJmYtAy3RDpv9Ggk~R{bu-mosrGW@`eS!^w?0k&
zJ%x>FmT3pe<<#w^{88QhXS-&*KDt*{w8xe)J$p`SQF;OAWvf{_H#Z&Y7JN}|+A}Y`
zg8Ary)2+dFUmof0@(W(IzHuhQ^^()-j-55T)9?B{;NNxX!(zcIc}|IJmh)dNB8<=1
zJYQOu^~h3B@XyZcA5yy9FD-M}r|#==h<V{chcM4&%p1-~pFPn(;h|{Up=+1lC>RQr
z)tDMxJM){Lw@`64|B_16ruM_%1XxwoSh}R<9!p+xtan1h^Rsa}E4J-fx>4D;oZafr
zs*k+|XP!h{_~4|^W*mJeMa6?})<dHgZv+3%zIg9a*@?d!{?}gSUs@Ny9{t@wRGHJd
z^N+;ET<wK>tfs#{v5fH(b9dGD<JXi~w{`3_4xXCz?%w{nUv?LZTOWHfp}wfD|DHLY
z!f(&WUCTpeFxnoxQ+?9o0?%d*v%^bvUt;7ty0y!XtG2#DG|r^N=-A<n`zO!6`sU;n
zZi6`r8&2N%A(B7gz(Ud34X0}U7b=xsarjt%T9_|Lgj*o{@4_Vioxh^4?fv0rpb@Kj
zWr6F0f79lky0|$f>x6mOb|%K9`?eiCx~R3{#O8I0|8MT(o4tG0>8CT+34NFq7k?w7
zkfGw^3l;{RH(z`wpHEolox#$0O>ldvXX=L+vsT)QFwCCvJ9O6#P3bF3C)lv*d#qZ$
zODLl=z5ayhPQ$>dwGWEqOIVFQzgx)qfd5qCt}~NEH<kq?du)ld)tF<*J@1rN_o9s}
zqBm{0lc-&%VE5HKFj=S7ZN>Hvi)yd7{r<JH>gKim&&2-P*WIf48l=!YG00hOi;&m4
zH;;PlcD88A^=0$@H}0Fues9WGx9QnkRk~|?R~$cCGr@+xvw$c3;199g6M|Rd2tQ5q
zviH27?tI{sy>V#SwmiY*t?BD7svPs_o^d3}UU|(;$A++s+}nauD>4>+U3SK<>cqQQ
zT6;w1NSt25Q@4NG|DAUqZHdqczO=0OkM?<wcL(>sm~&))zm@h{ma7K>PgcF&>+dCG
zuxWz5*AqLP5B0GVSDTe~|73nF|Gf7hceKYZ4VLYqldiwI&K3C3XXV@lCtNRNL_4$J
z$ZoUVeSEKsOI6A1+}g)gl^vGK_jIqX^zDu4ys+h8RpX|dvyM$mvpFM|ZvA}WTE%^@
zNkTuS&GS9@k$dgI!sd<3V|*2hct!4nb#0q&<g&8!)9e2x;R^d?<S#B==cykU_&|F9
z%R<*X|JY;_)8|f)Sbh1Xbli<qsfV|pdhwxdjoo{{oW$qP?=)Xszx%y?;rE5-I%em1
zyjg1E^laVIdmrZVPMiGe|7WwbZ(AfdpJebYntE1jhvih!4@+Kp91@VJ;fR%G^lZ3a
z8<*Ii+w%NqnXz4hdW~P<p`4%T9#iT+@4fS(#!RMudHmMoXAfRJ7KmU}RQc2(kS|_-
z*mIWNhw1lbT{^VvVTEdLxc0&$x6f~x6y4jIUV7u@Blpf@S0CT$sr&cy`P>(giSC)J
zKlnOsStL^0HCM@cxgOW*s(E{_Sy-LjdNxo&RO+lEN8;tG{!YWW2eV_eT^30sIBd5*
zkT(BHY4FATvNK%4nXJ4SlQ!o6-4P~#h{ITe=jjh`fsG+~saFIyh!{?sQ!(@0%8aU(
zPjbmU2i-Qka?hLec&-}b-?vle&F1FKG~Sr?XV&Z3pB)nwLTdQ^IL(}s+v;7<E?)mc
zimOgOY5Ilq`>zepi7e}y!jW--f9Kui%ew0%e)|24n>8ooe#>v^q6-ItrY*ENGhu4m
z|6bn6qq9oyrprXAb{)5>JA8^cC(!su>gi3D9lRe_vL(j<YgeBWAo8GB{)fsv-DDlr
zvyKNuuXfv2FTHfI{dae3lirqKlPNs9!7`g0|GeC}v3QfaRSC<Qg`Im97F<X@S!p5j
zIlI}(=oa77g_`kVuh?gX%v9IV`Eiw7WkEnB_k<Jti>IFno|^4=PT%WP;*2*liau^Q
zKZAd__)BZ;Z+WUS=0;w(<eDb!qPSG)rd9ZlV}AC1wLB?miiW=&G6O?G%O+O4E-;<H
z)<s-2;L*|g!Vo!~<x(Pxgl;TV4!n2v(>zVynxJJopRa^(ynR;TxxyZiRq>{O9J%Z*
z<2aX`S!F*}y<B0v<ExKXtK7DRL@hcM`h1zlj=;)?Ps-|Mccw1j-|M61d*EEgrIfNY
z#g54@^*2@3u*NPA5U9K>;%FY(`^GtT+O;_z8gm||=}(Jg`TerCCP<|6tMc=_Bi4a`
zzJ4g&lP8eNbJ=A52VIx`dpGZ`I~M*@XJwnztj2;R>JdEblbyDui>Cj!tNrt1^^fLK
zyUQI3c|}Ia?-aj1_1#qR?(@A>KKe%=yB(XpOd;|hSAcIxQpiP*_c;n%R<PW-<Qe+(
zHEWNe$>bG>IZAhxAFL=6IcE}*P&q^UXw?qp$mb^7-WU646(nq|Yj~=pnXTcu^1Ji4
zzR0`spAN-HTX!3DUrkZUo-s4ehp%b2-_nZp($UKcmEL3@NOOG9QuOmf0rRxLhLCd;
zIry5jPikJX*;;wR!*a^e6+hG28y;D9rOah1kxP_JEjh3%kR|xD$nA{{{1Tnc_06xB
z9=Uud!)zhzR8~>m%C)?qHWr-AKMBpU*chDl)6}h1<!9-Z7>zw_2c14icy)+#saVg|
zePzwIf8J7ICQXIY$NF@Ib}&>Nd8$y(ck{-j$numn?>`Gxe_ElM#?Mv%V9%M$Wnn98
zWW1HHXj**=V%Tdu`xV>9qthe<VuM(u{Yzb6?>Xv}dfRYjMt!u})u|h11)UZ2n(Vmn
zAd}-><<3XO0?#Fu%hZ4TGCTiR;g3fvFRI_j+56*-&bDj8$6Gx9Zh0#aTJ>+mNf~4R
zeK$CbON4cTCV$dAobsso#Uh`{ue-_=*_FTkyAyt>^2K}0mrv?jpD)RE|DgUnr|0^;
zT}D2^7dQ3>AG6)FK}e|9VfpG^Z|(^y$<LCm+<8WAb;jxI%vyE7wx?EctV-;)5KUz$
zzO1$)Fzw#zqVgYa1^$07U4LI*@8B_A$)lf}w-)Z&bn(zjnJ9r-{}e24M7?A<H?eD0
za@KU?XCbztvt&4~sW`6L$3M&P`^2MH`c0n{&dv|q+pYEQ74Ow|>aSd4PRpgtUL`-Z
z=jz^P9!n=F6wG6;w)Fna^g7bt_xrj+>%_9NyI4#GZg&-*`xy6fs_6UY$DZCfk@aPs
ziJ-RD0fRqFwq;L^&B<NC9&N?4L7T~c<@{6g6uiTdl`W<*C+X^cEb&k~*(7@2oL!$U
z&V74^%Y>xl+g(yi(;a^BR~&MWxUpl^<eN+j<#!0kPD`J$xGi=5+pyJkvnDRumFu8#
zAa9SaVDbv16p;xoMru9(e#+J@kbN30rNmaUHC{;nZvExn8w$4mw@;j!cx-|3W2N&K
zk839Q7Q_gN*}J`w-fmv`ey3H3m%Q+PtDNN3p{uqfyR&c1%U`UR*`lpp;IVNNe{f^O
zrPN>BQ^UA!u{p6^NiAzGVEhoa(`ECStk4*)0yblo!`G&*vv$h;e1>;t-1%t-rXLUV
zI+-$MZokn|_w81hl~Z-J+O8^1YMXI&k)%*~utH2;=G?}DZQB}Vb4jSNZS%dfFQKq<
zL)42Ct+Gc_SDCH~IrJm#+CgsalZu?N?V(la1?Mh&Q}k#n;{1H+-s}@m{mZKy=ejRf
zQ22P*qG(6<m3vp>vgP)iU-tFb=fm^kW#1_5W0@9xaB4%Rv|4)~!?G_?hxVHUMWh@k
zIq^R_W<oG;;W1CyM@L`g8t^W2ZPop<>=A4K(q$4Gz3tNyZmgKLXfNN@Rc^j}9hQT(
zIUiEn-@C^xb6Um5u&u{(8^4!4<j!Z?64U9IzpDI0ah`9>(LYg~nww9oNfUk)HP7q7
zRs+BOvpyc*d*|)j^H|unu6RTJmtQ|0c5lz;i|OE=xcy$^?E<}-J^?%JwrOs2SXlnJ
z>_Y*6;-Y85-a)Icu2Xm)P*mUD@bR+B>CAf<+RNvf1w7hjbLvEkwZYS8Nq_X-MLlVo
zwb<Cbrs9gpz0)dd#bz447uu@(bymY#&uyh!W#T`^oU7n{)VBYSa)X(EZgR+)wm9qj
zAAfV1offmKdB*d{I<k-TUoV$N`!PEiKH2*p%FA+R-@CrQ+UCcy{mSe2Tm5^--#_2(
zp5p<D(5VX+obvhb)Gltv+x<ON_8J^aMe_tBLUrPsQce7xtteRa$Tww;p=Q~|q;yfu
z)t!w_9t&UVCGdZ_Eqx~Yi}&J)-FtT_&s^w|z9i`9wpG9M{9_$Y9*W=5^1D|_>g*O_
zttGSMazh_wt^ToOMNr8))l<bfmv+7X?&n@2cg#FuYQ{9fmiRV3W(mFN+Ad$7YVV4g
zeB#`VN#YBvS0=BtteUj-qF;%Qsl<i*kL7qo)nCQEv@6ndICHaAUC-g@qeJ12X@76t
zS#4^lE@i}G_CkHKoI^J6&X3cMXGLaqyt@z?+n8_l!SL_7+K0MtCe|}mbkEqerL}(j
z+tj>&HGDbU?7>mix;u|QRDMw@S(vm+Z0QD9_t05W9<QFb;A{H__FMOs?+}{b5`K;I
zZSlPKT+hoc&W-%doM>^i{8aY4w@1P|Sa-BO-M014f*;w7%QL?igg2VMn&Lch1MAXi
zxf+$DC2M$1Uw-=ixWMq^bGv|^jx8sy-qtwS_ax52SfC};ZPRk@y0Cqbj++t^+7Hf?
z_|njJ^u6W3((;vkH!92$pRf2UAeW`Km7(gAp`fq-(ZdbSXN8}6sWh-jWf!<OJ{I|L
z_U#tA=4U4g7W|S-kd&5wxtoQx{_@YC?;C4wnp(#zt@!hMo9#cvjC(nI;tkjFOJ6hI
zRA!emr}9DGIv$R0E}yyXSEp`SUi<EfH`5w(k3YSRwmYVp|6fw}Eiv$H^V%QZIcBfl
z+pzM6!j=bHBiF=C=*j5N`svD8C1A>Ys>e+^MC0xUxqn)>ZaTX?D0L{mYtLmRGP@=3
z!Y(~O-@B~=N6zZZHet4&sS%dfkZ+y6`oU|zv(klIBTJLkd@?WlJMCHX-*u+CyoD1*
zzh0W_8qNN0-7=wi|F{EbU-U~p>}=|ih+FIUf~9PQ!}pSaRiC>}Gh`RpvZu``HDBP-
z^0IH!!wTMA3%K^|el7Pp<6&^p(cqVCjG|Xp9Q-73*Ktmio(7MHv6<JKw&+9C<QMYI
zyzJI%D5U>uQP)3_y>-7oT|6c(>S6oCU#9%~seqqK0;_Yqr0(_PPugT;+d9vYd85;}
ztsUQHixya3tBFy%r~3MjZiS)HERUE#=?NXjnYTY@UgemlaO#J*Nk#-`l)Glw)Qf(z
zqtqrVAJ<n`S!0m+D|_LNv#U<ut%$!Xqy2^P?eayhPAN(1s;?3*_;^$4uocJVGtw^l
zle<ms_pW?qwJXK{(8E;zp46f_zY<nnSDasWn637ARY_4nO;L{6Pv_i#3)VTW<e9F$
z@QN1R{dU$Y?KKPQI~BX^k4cF7pFTco@sH1(K0$vjre$`|{;<z}p6i$OTO9r;_wMQ6
z@@7Zb^tbza3-yn>C5CXR-nQNtbnC^ULm@u0FA7x88eBj1@9M4J;*r%VQa2giZ~5?H
zXGV6t?&`ek?6?Na6WWV(pFK=wN?u*%v|IgK_E}T6uc~3omi&8B?j-wb#<>Z_cKUj&
zw^lp5f0$Oe{^O;HtGtUMEt%IQ-e2c@<^S>gEwlI6i@kq0@92Bp|NlSUYn1y}AZ9MT
zWBv48ftgOeyNXwPJ-K__E?g&T!k+z^zXcYTxjwgVH2nR3L6E{^`;~SNE#vD=Z`7OK
z*!|M(M8frnJnIYPo6p*MpL+f3{5fMC`*-=5Cz}}`sJ453qUi0<^R;o7vF*Z-Ov=u$
zcFVWBpD6mOt3G1q-Ndh^tam3&+AyJEeRR3C;Iy2OMb|_o$E*BOdKIb1v)kKG;s1Uc
z@z;|juO_`*n;kB{&(7{<_0LcD4{w^b?|)Vd1l8{;)P4Oa{P!>WWBbCGig<;ikA~F>
zY5)FjBYf%6m-;oLne!)Q?a{DVDl#d(|L^j7TlUYIyMNZ)`S;&k`Sj#p*ix%wyLnGf
zZJX$-mLgRt`-gu^pVXPefTl`A&vKm$4UQptl~PMrtSWH%cSt%@C-rPv!KC?7OV=50
zp0wcZZPm#!?(3H{Tt9Kn`N!ISpV)Gqyqv4G%~!OzoU>Iiz{HwceznCLu_FvJ_6wEQ
zCbL+H|7$Csa;CLDqGazM7p948t5%twZ+7sIjcAUwXV|;9^(ouw#RoKg-mQrA-~LbF
zyWznsDUT-Ed(#s1zL}ZrtXt@EC3x2VwwEI7Iry&UJlMAK@HHmeO@f&r=idrG+Ow0L
zDNK5wkMxnXZ66aJEdO)3#XeMtE#vo@k}#+CH$~CEC*HG~^El|vZ2unuEBFeWbQ;Z$
zE>iY;_UGZ1Q~4hG29a$WH<#S8*06q@8W|)j!TY&E!8X%Zfxqm~RbQsIQ?Ba*WG&tw
zb849-$}-(1_-Ts9Qojb%McvljlWtU~F*2COXJ3*~@=)iV@uuaJU)cR8IlYNr)OPPV
z<aBQPoJ)b~qH1a08{V_LKGd|ur6rqpb3@o_*XP@g?D${gaZ<E&W`WZco4rdtlK$vv
zPUU-XW%05lYTW`7+#dpGS+h30^gR<LvCSi+e3R>bQ(^1773<HmZ2oy{@v(m*f=_2o
zpRsIy!Y#SC(U<a!uf-h=b4_@iqcn9FtLh1_ZAH1-tg_pr=T3^)_`;~}X|3vcca3Jl
zl4Uc3<WGh+9Y}a>5Voy%Yx2ISheO<+bFf)iT)Ve$Tio?a970nbzttBNJwAKs*HFWY
z>~YP@xwSsKu}jK|d{|%V$ME*}Fa3%C|Fr#^qNrxWC?|05Q`sNauSZ)%c$XP>=v44C
z<{WgF<yRALRe3C1BDO_h=RCgo*E*i0&cD{k%+KmQ&zGfcUd{&T635!+qZeIPFt%^p
zWB%_qPjuD15L1bU>xHL}Byaw(#z}KgIiK(IH8&MEt-EwFAg@AW#qu>Wr;6u>cRf$k
z=-(;jAr{+Kc`PBd-|+8)zQodi2}?l-gbJPIx^$h>b&AE*(6Gs$nN&<UiqC|rzR;U{
zc7c0?=X%ZME(;VG9!gn9-rA@iY-O|KjO^1tzqUlW^2P-B&e4xrbGbrciQ$BVEBtH1
z4%xWAIOZATmvQx!OtweRm8bJklP`U`P<fE^di961mKifFrLJgSJEXLdMLNT{%DK8d
zfKOO8D>U7p-uG%@Z^l=SAffL!w7+CA7e~&HShjYnnd#hB2Txt$^)UFev%EHl>CNO%
zOLl3^_|?ii+3d?H_E0x--r7v{Sp^e~BTaruu9jHER1_7Lu{?9LO-cRRWqO|<DV^LM
zwTu1c1Ey(<j))ZIY`wf^Yqm*x!OYH%RTtm3f4BN8p!LgG+KBs!m#67-uPX|xOD<jR
zubkX`{_UfB(W>tHN>BcV3wP_be*g91=fRIB&%IvEAlDb{k}uk6@kov@QFp4Ta(fi-
zk;d76P47PPo84mkFOPcLo%Xagi+Cmm21Ql|24y_A-5DWnyQ>X}&Ax3QQu}@VjtT6y
zw+MPlG_(EMuq>7P^{qpP>@<#Qd@I#e^LCqb_v`)lUS+c^crQ15J}EwL`Ta$d@Q;55
zf3vH!i$cVfzh;^$ywqWHi$Cvq?KyfkbY>m!GGFgz6V4~L`DeSPt=*wzPCwehv^6$3
zube%r>!9NL#Vbs9wdrU_Uza*#Bv87zmwDZkvOAn>b3}Nn-)$9qCAp*ZY`}3VZ>G(<
z=l?IzD%)y*=vnA~ONPj|Uzgr^=Wy`++50lm`c6`+IX9ktKkU2hSJCEQyY~Iw)6;M*
zU|())jqr|7^?diao?b9vd%5%Qn(xtpQ@rzX-)9^C@N(0;oGS7|WWAuCB44fUqq@xp
zCJ707?a=YoIrT}VX|Af}KK^ezYk20(JNNLwsTY46=P%!qe^&ptS;nL(dq1*26ZGB1
zKH1E5UTKET#;V18&k7#!nmX0#kz$VDVMFUiX@$sjuMLFXOT3I=k_c7r31d{zxlnLm
zZrG0eBkMVH-mQN>{X>(9%C@B%+PR%yHl5FIQ9XKW(mg}#(_0TVS)a3Mx@9n}a$2C_
z&R4H3ePyQ`ot&w$$L~$?<jXO~0<xGbpWaZ8Jf7NZ=6QMJ(}dO>kHpxbmYO-Xdk<Ho
znk_lD=JBzc;tyA;%!@ywzT*C&JeBe%E6&Zib}7l@R)0&&)ti#FTWVJu>`!1nz9rg2
zbooy855fyCXq5$g<oj#U`tti(em&icNP(@ZcYG>8#QNoW^CkT^D$5@pdUWyo%p)c3
z5?|csZ$Eay@??0D#LKne+c&uWYQ1vI(&Wy?wJDhrDo?v~{QCPplo+UdtlRW&cCz{W
z;EewasOj^k!o*Xc^r=7~eH!CQpVn-=UlM&!i(NBqZLJOH3VicA%4b@S%I??u?@xWR
zrBG@a`{Wbu&*xOX+p6~A@4sKyzl1$mq2m|Ms-^DLn8r9?YF@a7ZSv*}Chxm@BtC{%
zTFgFc@ALAbpqc0)^DR-1jj~>Muarp0e6s5DTAY1i)27n32X&YO&2L#e@X9<s_rfVY
ziEEKcvvVu|v4?Iv{Fh^P_}^y?DO;~kO4`lL`gZnyOS5?fQe}6&m9GdFaL?8d0;kWv
zzT5s3ZT_=s*Y7<Y4c89r$Zf5;y602<H$?ipw{4Ne^gFliz51D8Dk<qN9{3=5kK2wG
ziz!ud-)FN<6PXZjC^a%EaN2T#H##RiT7?{W>ipqL1y^;L+xzc-Y?jq#*4^CZIC;sN
zsrCl_8JElrGK0l8@%5^P<!{+;$rQ12Q;^4<_OqF0Y3>EgDyK_j-5$v*Z&hswEIpJV
z>TrnZEZd#T*8J8Vrj2KRRqbs^U$X4hv_)&Ss9rj4w_b3Xh_rWA`x~9>Y~1fGK67Xt
zj(8U7)_yXye%@t;BF)KjIuE@*VrOo7HkD_o*@WOe+exJ{+cGAb$VT&pooExerpkVz
z{pMrqHQ{N_S!b;B=G2O<^Lq5twWj5l=^M8q_r6zWGIe#^mi+bbh?qC$g8A*~T%WnO
zU0-(B$*OQpHIuy{*V-g@(f1engJ;ym|9Nn!X&P(b?k??m)fk6*YmL8W`ii9VbmVF_
zdHRHRINtxY$F%L2N_<D+lI>CV4vD=K50YGdp}>9mq@{@yrf6@nu+4e+F~Q@}-;}@R
z$Mfpk7XD>MO`q*<9(R+N7#QRUq)$^^>2r;sXC^x|eQw2)K20F$^ZC5ucNanF^C9;1
znF>jtQXgY1E#{s*zwFBoj@MidrK8p^IKa0wFH4K9eNW$_OE080t;vbaHaP8YrPqva
zN6@W8^(~tMP2TLh?zSTRf!H-?+1EOpXUuH=H?O*J?H@d;PEXp*%4%<3U!1dtBXi1z
zwAc6f&2N4>efHDqSMNS6F-1B5TqgR-_ra<EH|w>hIA4}n@?325tz6eYy`5Y4uK#>6
z+^A@#-l7A`D|!n!3tzmpd1ub8qp7&C<@BZ_i*)=IZbVLa{5xU(>EjPxzGV5frsv-K
zpOs#}ul?DS+pOk!Q@TDu?&1<_gUsM3k?qHXR-50tEyK7bBvMo5-Qi~@GMklmFiv{9
zi_iGs!gOmHS+9mguUal@Ikd1!@$R_HRi699wDIfTuYZ~1Cb%8hCX%vLH!$v7X77e2
z*CT?gQ_^>uMHC#L=^h|_%;>z4mRfkN?edwAgVZdATd#N4W);mkE#Z}`uw0~C<@Ju7
zi)xux+ho>E;MH8?%{QTc^YZeD^=I17%qYEM@mnco>XFagKRCWdU+I0)Cv$b?<)|ng
z%ioO?HvIX}Xm@j8=#2Ocd!29TE$MoENBBo)K!&LGii-BS8He8de#SmsY>Q6Et<adC
z(hr$_opyXFUN+@&LE^^;uYHnsIr98kd_Fq)#hfSFhCN@xPDkHR`0JGQm__Q{3%^Y!
zJd=uC#g@0bSJ+5Qs<4mze|F>S`GFWksDAu4*`v%14Es3oSMlbEB)T>9V%}{tk=pCw
z0w<eQjy!v_C|Z!YHbQp2@vJh|q!Q^M=LJi(XLGo6sia!h@AvlFwnRg&jrVi&;(+PT
z=M`5})cVTpyZ6^{-*Zh5=EtdQmp;vDo;Pv6_q2Bjf7<+-vW>!@Zhm%qu4=y8<?YFT
zes!)XbFga;oRqSGec>r4b7Af^98EE+n^ZjGZhARS5{R4P6@6$)$h63HOE{a-d}m&s
zT&uV9j!@c(S6fPSSXfsxzHn+d9RG0h>WDS7)JpOvoJ~1=Nqxf2l^4zT|5zB8!<G5)
z1lK-G(aKNV$y`g5TUv@XEn02AUvJXS_1!<0Kb_vcx#7X`oBLMourUAe;NQ!APcJp;
znLhZwGVP`wtK$T&G#}qLvCcZLF7~81vQJsV@M&I4+>PBE;?5|z+wXj0=BdQ2BrkYA
zy=_YU=RY$mzAU+>eCgq(>iddY`m%H1C9e`H5xH!<&;8xOBe{m(+|Ez7&1hcHm*KlP
zJfX#>NN+*3*-;JOxRu#nlR`x89M^q0zU|$tKkxkRguLjwYv^5eD&gYqsQ){8_|Gdh
z-6>wX#QjlQ!o3sXstZG3+uc}Ya^uBQzFAtllAC*WaXnejTl%(Y_QuKg@3+6%cW_R6
z3#Z`HDd~M#9qsztABVK4gwI-%ksIsz-6terk%io%xxQMgn|G}BSQB)pq1>aRR*-L7
z!w#Q=bC>-P7YWKy-?8yx_p9S4e_gFQ-e8vQ)th>27W4Mq8guToiAVie8zdg(_{`kg
zqUDvb;^k;7$*%Rh1_e9Y`-7IHbSNfO7aaU9epT|4ftgDuPjteiC9_MnFOjPbl6~PC
zb9P6g_+u5WLc6R2NgwUChB1#M1FLMOf3DudSi>~ML`ikCMIo<cgTwm9wvP&TnVSXb
zB;I$&y<48YeDCa|smu7DJ$!e0`?Gno=B_F@m3u+v&Zf#TNzIsPUNXf?b8QW720t&-
zF5cx<!fnRIe&FGW&u_G|6yqM&uTT{75pYsVx6HkKu5MND)jd6j-rv8t_4AQCO)O`1
zR3vj&>GqkoKd7&tC8@Qe=2gq5SqXbS?z^J6zWCwt4WBK~NdD?@a$2qZ|NFUx{|@!+
zb)QkTP-u~9<;F$)SC{?#+7)BJ=J$;cpT3@+7Ag_U?Oq=uyJDe?xv$WkXrpAS&zq!d
z>z*x2Omhk1nRv$f(S?r&x~DJP{Zkx!zarFX``wfpo2swJ<329FzrW1m_`R$D4&KO_
zcJEHh$6rrZ<S4XH-<0ojR&4D~_e{~-hnyF$+q%T@&`xL51eu_Yb$-3;-JWpCPrMg;
zNBqzICvjrG?LB;-{dalesm1k|8?~bP{!#r$J~IQuArAbdfF)8X5OOf@wuQjn*V-LV
z95^@bEECWXV7A@Tcbm<3H)~Q!^pZ9QZ)I>P@YJGyzq8l2B|Bns0@v_u^Etn#GXGiO
zxs!jN&tCu7dSc@ygMDWmEdx0Wj6dyqbW`lu^c<nNlXtG0*Lx#JcIO<Q^~Zh``c8{h
zkUyB^T6ClFN@(ZFBaHfsR~YP4$&9+P&TPUmmnl=t`U;kAdF+>wx_E`{<!>LJ&C_0J
z))KwRM&_;e$pexM+a^5tIQ_>vWwF!SIBrL#7)O47BN$Sr@kLc;Unbwi5XWgbKi_^<
zn!7*#jQyRuD)Vj*J6@*f>rQgP_kYO$t#2(#&|>~k*|GC&-y)4uD%-bdR^FY~!_G1(
zQiMTNzj2R}Nx;5kXA}8Y%e*umUNYIH&@ISWljiYr{i*L=r`sK}OqFc)n*Ud~gn2GL
zYrk#Xfg_yOkJz6u`dng7&P`kD#jU7#w{c^~+n0V9nT4yQuD30jsdxB=;TP}Orhhkg
zAAi;^5@4OUg=^s<p%SK_OGHa@{x(NUbzL%DQs**T(L0OJf*uzlwq3o(J85Ik<ntFf
zV@_ElE2*!aAl~PZdu-;CB^TOKZZxP(db?xI!DF6AOA4<<dcHGQ>NEG+B_{#P?+Kr+
ztxhof{QPR)-B04H(<3~&UOy6_$Uph2=bH6rZe<$0-ck6?b4RYv#T5I7f8mAqJSUye
z*ZXkJyjSgVw%I~;jptAD6?TSQnW%fe@q5$`>A0lRM}>5YSqh@pdEAgZ%NO{obFa*t
z?T7h2{~k&xyS)0e;zfa7n`_O@!`Cl&S`lM^^Y?6i_RqK0t}B#Z6Da&>-Tc2ByzH-V
zi90>DdSzDsMlrkEK<9Qt_e)L#S=Phq&9g5$p7EP$Zz`bKC!%<H@w0Uq`tv1U_pC_z
z_1D^W*WFEwtZmjF#Szz~V_4)A-#jS0?Xgg<TF+Abg{ev2;~i;p661e*dvo`lbyK`D
z)2ilv#g*-Mc3HQ)<jd0Bt)@Ti&Azzp(l+0|8oY}=t$pNv*_w<)GH(vsR0k|C`lIS|
z@r~AVHU3Rewu!Zghu?Ih7+qfVqVsUy<u$8T>~A{0Bk^(R)7@{&FC4a8ai70Q-s#^d
z<+tqRZ~0$;iYzO1oP5<gfBS^xesX5Z61&&#bj~!rf1q~tx@^zx7Vid02kR7p`LbN|
zdrwI2Q`);ZMdQc!C;wvJ{8uoY`(Jz``$~;3XdQFaCxr^_%nS@~@#j|~q>lO45Z`=o
zehn8m*(j7$oSWb1%KPMkRi1gqEnR`d@*d2M)7;DiXNh=t75@9nr+IVIqir{m0%db%
z&a3=<@66*llW+Hj#~(9SVopu0ncG~nNFd?alhBi!b$il5`L$JVe$R~@*_pn}^p9;m
znd21}t?(X{VOKc5Dr!G@gz>&>VB(j)C7FRcPdUsI+Niy?utj^RY`K%RwCmfM+uF^)
zhj49Gyff+Q!;JltdFC)Ccyr3tx4ySa+L_h8;g-_Ule5zK7kqMF=>PCTX>rF=u1!g+
z*UL|T`RM)AM|Z!rZ~xr!;IhJoQq?DhU$_3h_&;2OeVIwa{Pr2I-)VF$@+r!8K6!JE
zt|UK)%4ZD*t$oZzo*A-EnZ+}l8|Mmn?J()pJ(1+XG~Y7l-|{beAAQoBuuFcT-1LM0
zZJi{xGEVh+nBaFU%6rX^Hg9gv#W(G@X&pSmX?=}Xl>LM3sizNBUw)dXwmE2N>x2o{
z5_B$oIJGQeI;U-Kw(}*Q_f6ggUxH_w{$1UD+_F_9V5>n?Yd|9BthSm9Tvm+#9M@b@
zy7ZZ6S|+n)`JA5|Dj7PrvtF~Ej97W{d4`l;>Kwy~lf9p`UJjXEsHUm8MN#tGlFk&<
z>7q9*JljnAth`UkE_)Ny?z>&UMbGBOqc%PxhkrYE&2RW~^p#}Tq(i%YL_WFu<e$p5
z@U*uk;AW`C9kXSZr+=}&U@!XISN-IpM@-k9FJ~Clo>cq7@^nrO+oWt)*_)rF_WV6$
z`bj8SZ(7Do<%Ziuu7BPtoZS`pYoe|Eob89pLD~4#%WnI27w3%J-+6g?nf|Q-JL|S=
z4}Z`1Y-@Dv!&ecD)sDp4|4e-QC&2rT?9$gOZvR=>zUJ-04LQtu%hV5)i15tk$#Y{j
zv`_ta!(oX<P>WChtlf+D)}*a5Uexn)d%nrbYXWg426r519o}{8LEZ<B#MtfKo?Krq
z6rZ$oT)(hT`nc(1p4DgLqoRH+ZFX8=9QtG5rxp1-O3gVg%Z3D%`Nplgk-If-dhMIn
ziFa;K3-8$fF5+T~<&E~rZwvgM{_vi$=w|3SU%8a6Rfm2ZYP%_TGG$rlMd5bY<&lv=
z^{oAchmXC!RDS#Yg59+N`{h~gxBjW_-y(l!tNohO&u<=O^?f(LdUvZ$>8A~bywN#l
zdA(NuV9SdxjrERFiD5d!a7(fI$D4p3IWFfuh`yYw>U{9O|GWO9|JYW(e6+vA*28t-
ze<sv=*Xx+@oN8wVhUMjq3`*Ds*ea6qQ&JJt?%Ue8Wp~UrJ*c;5bw9WFO<(kuKNIit
zq}xbGW?9=#RF(Dgdo#84*M{9Ug_6x~I&ad=EGao>cY5EEfA`&Qs^472<iNyopnuvN
z&!TqqiK;>xB3!Lbp$h{lUdYJ5+jsvC_j1QMtg{zK3Os*k!*fae+_y{f<5*_<?_JBz
zKX-0Q<=nRC;yXW=ygvE)?DA;;`4;Npji1d<Ou8|Xb$+u(q~3x}liB}0I@nw}OJ~l<
zihZZTGY#adA12LQvh(rr!b!g?XB@fN%>L(Yji~=;mCj9#o1<DcH%>l~f6~a~uZ<_W
zpHxTF&#y*3=Vk4S{VJH}HCTUKKEJ7A+Q;ipe}_t(U8OJHQ7q!O<$GX}-o2kMD@D?F
z{@5~EXIi4jlG`sUFSao#pAyiFTYIiO{BlBPtjvb+qxTmjIn}2wy2tqUXL13r$V_YX
zdneluKdgA({_tG?;=ktlauy#xbX}1Sd@K5|kg0-gXH42D!?UYaoNhg2!G9@L>VSV>
zPRPEh4+&fLTi>xSjI(-o{7&tMy5|Yy9T9u)+O?FMzq?ZVa7W}OujL0#X0qP9GJ6+u
zlfM1B{-b|Nss!u!8Wt>53g*31)cIffbX;ty2G9E2;&oqE)IMyz_A}*E_s0L+Yc(8>
z9!fhPF7<#r*)aM18P{GBWAUp|$0r?Il(?pU|Hgze$#b8*0>7OLs3_wN=HxDBn^(y#
zU_ZO_xSd3n%Cbui_bmV9x-4(%ny=dvGdr|hciWU0mYwpUr#6+h9eN%Zrt7`_%cAZ4
z-`Wq~ef;s<?#Gjxw?AH7UVS)uR#{>86_y2i-~KiKeLMeZ=kCSf0+&;t7reh~_%C0>
zDTXhVFYfPMmd4Mf`T@+#A9OvQ@4nvuSl-qHZ=0JBPhPH4{6O5PTJmQiPw2PF76uc_
zxEJP1cIN&4#IoPUu(q-*e%`EoHiz}kzgd$ib2^-zy?TxL59zY!DzU5qe+~<*c)aJ^
zVxIrE><bcixc#=z+kZ>Cul>D$+wbFxn`_NJ#4)MHo?kxSA>)^Mvi{94J5rr~Eq@po
z`TC@Jw8zYOzvUv2R(|SbpHi^z?knjZM{7UD=>D0*RsVVI&JV_0KNyGokS>0>JnP}|
zH6MzL6Aw7+{W((I*E&CvD?gM=_{s8ThoZ9{>W2O3-1uSs{FABw-`E~rly<0gdBfkn
z1$O_>MSO{7eYKtC>(6@0Zo6tN@!Ds$M;ARiSn<t8_ZLfd-R0}v_v|VRxS#dyKeaGH
z&gb(-(J;w+wp2!u332yt{*hiKzdBW9PMYP4xCLr+3|UqD*T;(pOuyVX`RV4Ash9UV
z&SKinnR~*T<*Ke+`ahc&b9Y@~TB&<t&Fnpz-+LB{Pe^;Rhpln%{3q)thuTOl%bYaL
zcWK=WR#DSc&)=zNUubriToU0f^J@2V8Mj9MqlYb+6=f_HSL7Ezw~Dl!o>=zqN$2LK
z^_CfHd%|Kezr?ihPKouiz0eSr>2v@8mrFOZ98%xq9rtUnus&I`%j<H&vzR!CdW*Cb
z>w}W@=SaJ)ioPeM&KkhC;!bhw`{^n@)tYN2Fs}01d*!di?_Z1E?f13KU$>z0zP114
ztDCl8{k|zx#3}ZL!+gft7d_9eI5OJC>8dSwe0Gw8a#ie)`Hf7|ITx7oiq}2SS$I|E
zOYWsVk0dYga91}et?|8}6>gY)^5^Q$TU5F-p1+=Muy{rr=aL^hQPw4=15+l6KRc-O
z`s?Xa406B!Nha(QnGmN@bDHgN;;z**#qACxoj5+Z-+HFF-;9F|>V8Z;kCOLC{NH?4
zXzSeuw!a5WK5g!~@m__uDbXj!FZZE~WdC7{GshptiMbTdlG*WZ3df^t{b=8`#94bA
zIyX!E6`SRYbfjza<X?@lT=_O6n}1DD@GQl7OD-lay=>h0@ZpmzYu{Qs*67D>Ec&+u
z9Na#HHHbg>b2F!BDW}Yt>K~%7_jWf<@^Vc%^d;v(!>!h1_qhKEpJln;z|5ELmMrAo
z9Otn$HKMk3jrSDWdQPPjw@@!ju?J2!1Dx5;M?aZyh()uidgdYZdskVuy1sesSunMq
zFW}iiPMf|9i)tJHWWJCL{Ujl={kvhAx6ad7=agrN9u=P>p?HofGiS;>g}pY85xzC2
zb5HfwoXy?pe(ug*&b{aBws7Umoy~OVt;50dJ}1xd^1PXQZ;JI@o-1$vw<d%}$hu!R
z^p3f`K;fQoVN$ACK;jRl|EJDms+jI6m#=^O$Re`6>A<J;3^V>;YdSKut2pE2PQk}d
zYX08HO)A@aaZ--8(Jr<{PY*nBQSEdHFlD$MKWkY;ms;iisE!j&Mj{@~OSOb}?}@}7
zvX7|WcV^D)-SUrTFS>b~>;D3ob*c0H51OXSo%0CwG#5x<^IOQi^?^wP_xp#-U0H&%
zn@<U3)OgkZNuK&-!OVx+VQT~VR^|LV{<zq1no;ViOAR;J{^=?Py_9^oq42QF^|sXk
z?3S|}4Kn4{><d!lb`UI*tNnj9{{OcdZ>tl{xQ(yeEwT&X({lK6`=yx9<^$@|>jX<u
z7ijTn-MLeDxBkVPn1)q{vkvR;GiL04XT)*&=7E_k!SbdLynmc`_s>1FY-#b2S9^_{
z%NBU)G&ZpvmRK=;$$}kL$pMRxRmB#m>NQ2aI4obYWx-ty?+M#itXl3Xe95biIcWO1
zj_04_;&qp5>0jazy<Dxpxpy;L>$7`ld;ALZWDDOFKa42Z^hD|a%Pa2_-yc}JFAE7Q
zF{-@4uamW?ca^HB?fwtO!RI+YdrorEUnSE%Lpws-<;jl13|2?4OSe6hJniEA<u>io
z6J`17q;>mj?W&wfU8}$Ni+3yL&o2nPxK1lW?Lbqx&xEUw<kHv7d+>DM!oC&h;g-Hz
zR$t_4tjxQ3%}{e;{lzI4HmzSK`lQcy_Uy|iv|b$P{JmPxQ;DZ*s=mL3x9}W>+?$&^
z+f+RN`yMfK*^;=`CvYOiS>2EQ^EN5W;0iHu`<duBWpU`7_U?u`xwhqkX_8i}E_7Zx
z6|yDiCd=QIx9bz8?T%f0EIP8`d}xHe=>AyI1*=c6?QQmoJZe_EpE<VT=$tm&jgQ}a
z6t8_}+4Yxo)x$HNUq<cmWZq`j+bwbX?^orU>?LLeOJt*#PTAsHt#(^}b?Ss~zv3=(
zIR+mH5xbK*>ra#2gHQ`$H+O-0zRN1dG+BeSdDH6NRZo<k-+z8#NZBhV`#+&mcBjWl
z=_t!D+rPWBE_QqUuSYLG8*gPiq_96u$<%Mp%K44AcwP(sGF;oMdfMjnL;m+RCua89
zx0&t;e>36x9j2^@pRZJz_&&0Hd-rqRT=tI^b3(tKZsqss?7LFv$x!TR-xW1g@ydpe
z$1b_58-+w)4HwmV<~Ys#&|)VIo<P_9&>gnxG7sF_u6b3AHEfqQ-)4rXhZW|<nSVEo
zG>SBE+q^7f@9L)u%(#su)mPW-JZ0RxUTp8jMW$x%sn?F?rW;H$darb{Vd8Y{t06kC
znq5A8+@3#wH(T}e?GJywWa3)!cCy05dxdu8lTPYC{nl7(?{4(e&G7rg#Rbftb$Cxi
zeO!K-VanH;pDn)>-dFHh$-udhr!|C6N%r1yzNCV;4PLyT1ikfC9=teJ_UA_A(TDb7
z34-Trp6mJ~-3gv?s7fF<xiwqIjiD=v?}SeK&O?!$F5Em<X0llK*xtE(z*ojDqQOzd
zFvNnxNpkL=n(Fq-+Ubh-Id||ZKC#p1lK&O?A9{`T=1KE8Q_3dBTzbdJ=<-_h)`K63
zp-Uv{{3a;PWMB48E4gDb?^Mr%##uXh*(#1$a!AGe-=N0cwj)W}BkjC`)CcK;(pKq<
z+rAfXoGf_c<f}hP3<)3O&r32X7yanxtXDXw(j&=vLMHui$fWp%MK|A@%wX3%vxz}q
zR#NWyN>v$l@suZ3XHIV5_#^R~-{L1<x2FP!(49HTJ<VRdF={f$eHKhs-zl#ce6~=z
zUD^EBQ|s`^RvQj^0iDjpQ5}z;KH=)-n7&+zZO79N7jub@pGhaDzgr~oN>Xl*zWS5Y
z8Sx1jQFk66P5ijKMO60yud~FH>F>1W=hr>|X6Vs-b7k4xM<0`)`^VS*efQ*Rd3^m>
z^|J|qh2dLIuica}Ni@5#G3e&mNj5QlVtL9(y^q;4epuHoSRwbX;@<1;d#_GfDf;Z`
zyjS({E$=G>cS-phrft~%Vg05L^ACEf6viJ?l;3=@-EL`8&kNU=6BCuDy=^KqJ$XB_
zF>FJ^d$$cNF>_zmGIS*UG0Nw3>dswZ^kIqrhPAum>OU;KBIx;miI4k#a6@#nEvx)m
zLl)nFV=|Wa1b^u6VA4&SQ&ZI`sQmX;#>XOlkxzb|K~1M}0)H<$Vs;_?+1dEH92-m?
zd1<5_kYJWO?qd;}vEc1az8wP9fyay<xV>|%n$x_uSTD<Ia+lk=*cnG&NiCH7l=}V9
z`57&~i!^o~dCIWiaJ|tCJ?^88r>{mtNpl=OF5y`CPvYMEdij{n>Fif7<{0~3YL&O$
z_v_v5kK517KTi2FiAkz`=_-9Ef3-uMlQwNzr?q5h%a!(+i+e(jGc11Uur#&wezUHW
z{!jgTF^-zaalr>IMcxR+JZ07P{nK-7hWXX^^Yi9<mfTT`U$og#_GW?FL77q^8J7B4
z>kG~*a#?Y3-@VCg-!A&)!PWcye0+Xha`XNeEfd<&dO)N8FlWVS_eaYVuD*RNt#oN^
zWltVgEI(J$`@FqJ))sBa*pQML@-8T0T7u8Q;uY-unSQ1pjQgJ}{<kz*sq^00;Bnju
z`I-M?L>!K%yKtLHzt-rn?{&S<WYp4hu$x2p!p}*cC0h13zy4{&Yrpsu+YctyNhU5^
zg-Rx#ZfIY$Va6PR5Js^(I-*M|`VP#m^lIiQf2jFRBW%Z|^*YWIb#}NO;51#dX5Nx2
zF7qAxk8JoR{v?3?RG`5913%{|w)ZXnIaNs^BBet~dDUz)Yw?3$gah}wJGvCg#eR2`
z<XSh)f%n4PitYu9^Mwy4{AFUwJyq<lurz3O&&-L+m#g2Mw@C4sxWp_YDduEipoLlM
zDc`R1?%@j<#cVwu_pf`^GVxdad=DR{=Qe+28pOJ#)fRlNFF8F;L?*(;Z$ewZoB0PN
zbnp5YHkSohFATfEVI8BR&lIpY{llakt$ROToPF}GTuFMMMI>8FpTV6Q3$}K1F7moP
ziT&sERlKWoZnm9zRo=}ieW7dnhv}<q)<t#Km+rf1G-E!iz_q`Bc5$5w$lB9lsw-hW
z-I?3oCVpv3XNhiq-JDxin=UV3G1b((nQt~<>5lfLrIlND+p#;H*`i_TpLo|nd8^#I
zRrj|ZZ<uHn+xRg)dUZ+1mW-ygyLBZTJ#JrW47Oe}Sv%%Y*2x2BvPyE*!oOaqxSbN@
zZ26ldNoCVCXSc&&7iA@Ei76?$+P%hGsO-lz)759aE{CP=&~X*p!+BV!?exSC4d<>-
zo4HSEPTJL(VrLGoo_BD68ry@Dw~s&FmvO#UbWU?x;g45;zx}L~n!}v4Y&}PPb9CvO
zQ*#WzxvJW2vfX*MZw60dV`jVi_P&WiZNKt%>rI_g&Odi$Zgp>-%-UV0%&BK;OAlZB
zCUw{1nCn@V?B38#Z*+90PP@16YO?mMySw))r>Gp`ky$h+$GoRCXQ{y?L(d!45*Nx|
zl)P5j^fT~kY~+3GN$*>`Kg<2P+Tna$Pqd2R<6*^hYjvx`vILII*`jmbojp3~%G&w)
z1+Uk}9=}o8zPtR$trYV!-#s_J+LWTX>V|E}63*tlzm`wz7KOz=+;!NtWYMylc|YXi
zSprLJd=IDID?ODG5o(tHZeje|i!X0@U)pNT&AMz+`uDrX%}$iOmVf;0?jfg)>$Yb%
z>}Wr?_23fc`}f`p%q&Z}y>Vx8c<^M?n(Ozr9$gyzT_od$f6mq2nOm>j{k@G%>1Niw
zjLR3?Ys)XL&eL1vHe;=;oS)$N$#L;_cPR!7>^*Vkq{q1e?}+MxsqBXL|1U4P6nNnB
zS@osL;#;CuzVWvCvo>p+k%|>-T#fFBM*Si-4wHgvS5tj2y~6H*z!eu4hlhmUp1klB
z`_1r=%Pn^Hn3h)r#+4rv)6@6Xso9vwlbW&lM&*k?9@1Yw<(Zm@T&(I^cT8ulRpz88
zqTlB|aTeGh5^j0BOt*QzX#M=UcYz_NPaJ+%D0x@p>g=oUmx^#?KeM-A%pr5iEaFUK
zqtRBs&Boa^y$*JXCqDnY*;12a^-XD>%k3??0e(>mvrUwx4N@AjgXgzx6nxk=SNmhe
zxoHa=Y%_e{F4)I>rOz}e<o-uJ!yVPP*}mByjeEKE%gdEklV7W?3=&#CeHZgjr`%W9
zu1$N=xn)b+o(by>qvfYrD?aSm_@C?Fei7-E*{6=F+U*RNN}P4ZK*Zwg*_6<Y9H$iI
z(_bCW;pa6!FEI5|K=m2XEyw3Q=S{hCw`bx5rIT3~ZA-lq@@#{m&Mt1?-m*@#f9=(r
z$7}O-O^PJL3{Mqs+pnlGIQS}(oA2tg33q;I=CT<@h{;^>ov+{5;`d-y?NlqN*{j#u
zFV($m(tCK#^=NMP+uQtOf45nc3uHdKyCE#6Z|U{)Qe~ZECeJMI&TEWrzSg<u{pza|
zoiyj(Z57a3Qd+R~-2qcRMeXcRvztm65_u0h{F_=I$Etat>wM4^_laKTR_KU|{@Cbl
zn>jTy(eZzg#CoQ;$&C+I{#e_Zr!;X@fDe~Lo8v|EfY)qImK{BR78md2*skqVaXajR
z<65?VYgTE!T4U6|xvxU{Zc}t_ks3p=!vaTMv%YkGos~XaF0J>McSr8G$ozD(U(5O6
zdA=`2-75o|HqA9(FWarAz3?i>%!U^_X?L8r7u<Ay-m9S-Bdes+R$@ItQQ`Muql{=i
zqw^6Tro0a*lY2X-w6k5zG*>fRxMttFXE996jisY+J#b>2mLbe*;&^yw;G+<UDc41E
zez{$7z21K`X7j0eNj@J}L@m)Va5Y}^n|W!lm9%DT*g0YQlDPhR`(+;;%xagn`1sE5
z;qHk$&fWg7TXlmCC$FwSdsMLXuQz{Kp1k>ZDQ(J;m-SEI>{qJE7MpU}zig(<qr5l%
zMz#i%{g!+_w?X5MgyqR6iC)KqrwRCKo{#KLy6Jq_A?u$+Uy`8N$;DQh2UOqlR~Y|t
z5S<%g9Ao^_JRr(?f9m9%KgNqI8p8s2Y5hp)(%y90L_~9iv?IUR@;JsFRrlf=^*a{w
z)TCb3md@3PRX-S+KQ&x8j3dmuDlt4)+c8@=<m0BcM8!)BZ<#8emU3w~=?P90(>W?N
zx&LDA++z!x4@9puu~Te|)wdP<*vI~P+G!09!Qz)3;?rg%Uvd&=xu`eKH%+zs);H#t
zX-0F-%`Tl@)?(sl6tVYM!QQCZ*FzrHiEyk6m#{8f_@d@cis-g~3EinzQdXYVReX8E
zx$xD3d^wf_4}ve+E62V$oF8lZ_FX*lrrZrCUct)So=v?Iu_ezoI(qj(zGt(lOMU<B
zewg>6YwE(4TjMsIygFmLafc<>rX*W)u~*M#PPnzp{e4egvi1CSMT6~q0aYJ&PjG6#
z#+Rw<vV$)*du`#42sc~Vi`yDc2Gy2U+*%M5CYGd-z47nI-!~Ut>7BeL&;6p7M{42B
zmuDr8c11P@v0YtIc2)oSv9^@Cr*HHuTWb2NSnto7^PffLTIzk*-;rBuk^T15rln;a
z(rYUUI_EcR=DF;=TqELZoy!ho{@na2FK0PU?o5-8+s=4hAm{MHS&UPrNMACQ`StYM
z?$m8tMIxI^KSuV~uI0V9vEX71yV<eh>;BBR#Je}SQH4+PD4*-B9p{v-ZqEx@yXJmW
zO2f4YbK7_2|2}P#qWS6gL&e&oYvkT<T=VgS@KWae9)H7^1y0&4a=~t+PwC4m!U|#v
z+B-{ipJ@Nf+Q_UFylB}xKf$*@!ruCIg#6I6n#HqxZdsbmm%}EqmKGmeCmub&EZb=5
zDy~ycIuhm{uze!4_5Q3J=g?>+9<4Z~QtN|p=Q8A{t})vw_xVZmQ^$bKx573y+|GLx
zaWUkNzuM*n9xMgRjM7bm6B@f}Tw;$e;pN(zE6%JVe`2b}+IsO1k<2=Gr@!@+eOkEv
z`?q83@AZBwTU-7?!=G{gjX!y}FTIT1ophy1G4`6IPNSM!O^ETQzgDwWnLLg>bxZK=
zi@X1Rq*T--?T|U~WeRV}@~Ft|KE7q{UVJ)AkJd2nbn)9d?Tget$#?wy+x**PIhHMt
zczx&XIhDzt3FY4<`M1tay}8BgYwX4F*(v(p_i|2nH!=NmfUDhu;Hj6dWiGvvb*CfQ
za)XUz)#PoK*_sDdN0@iMo#~tNI9T-V=CVb*1>27uyZ*^?%l)}i*kc|2?oKn#`zd*1
z2~YO1_N~Wu*XKWO?ysF5X>&F3j8)Y0n9#@C&X$5tC!R^UZjqQ>+?9P{$EkRG$t=(C
z#v9xHKFr#frsT9XN_n5>1QF{KO9O(LZgM<vIGFGtB<$LvgYD-G<MwObk)NFHQ+Ir_
z=);wh4ea!%2JhOHk#nWs#`bytdW#P17x}(&(t_6O2`9g7TlHzyj~mzAjvlc*|8}S8
zN5PYe{N~Sj`8X);?-~F3Qv0SiS=!fzY0vt6`FXnAkv)&N7|hSScxLl=$^K~B^0lvA
zto2(T9hKF%D`8PQU1jlNmuxGMlExO(ClWVyEOZH!78OxDz0v>r%FdEod&@K~Y3||q
zsKl@<WbTD`%Y9;MH*MUd`r@R}3bncEYaVnNEzsWd>BUZFMkjak`KG7Y;&!&oJAXqX
z-2a0qzi}Vyg2mOTJgL(&jiP-&*G7xJJtB4ZZ3(wa6NCDznQLP;<z39Jzw1@6+28&5
z<ImK+7XnXj`dzW6`qi~r7c9eO>Ia_cxb#+a>#Gej895#~d|_}scJ|M<HzwPZ=k8qb
zdRpur(Vg~ISLbi$VN()Li~Yc`Kvy@GWnJ$vvFVAnO3}Ce=BO@=d)WG>qWJ7qCQ%lH
z%D%|QnH!B$o&LmaTeivVT;7d6T<P=wdYqJ3+nK!eQffx;!TDJ-vYj2%Uhe5qny0-n
zyK9MF+<(8b1*#YC`E9$Fv+A1Ga{=`y3mh&Bh^31NnA9+{-84A4?~9+z@3@ovdUGeA
zH3*N}HY={;+<8XV4O)>0LK7Aojk~aR_6nAx^9|g~pUh96XS_(JYD%BfL;b%d{L5FL
z@L!zGy&_ZO$4cj!JB90%Mg2ujZs4j+E4I1SruW<O*{w76t9Q4A&VD2Joilq`{m#-A
z=ijugJ(`!)lwYHAtFF&<f`{c1@7N205%v3KTOC<wdsM;w-)=kS*;jjRdCuu@y{E@~
zE&AxzEYqgvnXX+X$2->xx762Pe0bR;px=MO(sj>uG|#->y6DKq$`=OtQ4_o6p2}`L
z=E`ku-<nex!E{f>>)iVHiV6SAYp=QeSb1%>yj8D{dMR6xHgjElij%qfD_&1mYk&3P
zyIoFq3Y1ptzozoKi0AQlv!fRltj+c`&pP{7lIM<*%YL&Dci$Y;Juv0tAJfDSyaqpl
z+7tipag*0g{1d%kVb%2)x@*3#F)2D|e>gQTY|nbF49~YNn`g}0v-HS>2^&6}th}b7
z&h9)z-{{Yyz%y$<X~yV%+|_R>KCk|mbl_jlCdSyAJC@ka;0;(9@>wqK&}@?khm$iW
zA9?dlVBVCAtBa>@FzLBltD4g=^U;zW-Y$Avr#Zd<>^ioCgEv0Jyt2Qm|C^&yRH&OK
zchMJ-^shxXS?2tzKC^oAiOC9AO_UmMSX%rsu=|tvyTZcG&QeNNY141^P#)e~?Y!+t
z4WC=o(@vjwed4(2lKgLnZa#FMwEdy}?cDvz5r4lt=+f*nU<|yVwOV9)|FrFMa~O&)
zcW?Rre0lAeYr7TICnfdn=sP{-qL5#_knxm58T&pKK7Ke~&i~Ml!m^JalWUk;^B&&s
zmzLhj=WuGtF1_IC%lC%bE6kl@w%IiLL7c@UwfRYYBGqbJ_Ak`US>&4OB<e9kTE*xS
zqi*}P%9V5N_4!*~+hrf&u?}6`BeL|(X0GD1QYI|HzKz#E8qHAR_;FjAJ)?7@yW)$u
zv`@1iA71x#*`}k{W`0(Gusqv7dWV_xU*?)6v&E9k^)K&Yxp~FC@pMSIR6=rXaQLaa
zIYNIg%v@i!`|#q6{)g{=e0}j=!5(X?SN8u_ncuRnDL-^?PgCW+?`gW3t*4K2-s?9u
zP~p%xe$_#-=YERXzS8D{R$C&(ty`GZvRs*_-?rJ{yLyjIw3>2H$N{k(o~%pRqJk_k
zJrl2WyjXi>N!;Isn`c}6W>^2S$Rwh7y4|iy!!>~{k&kmTDs=A{9p~o%@JnVF@58$u
z{fw0wdLhmR3wSr4629=qj&XVrkKT&Kk{YW^7PfAVI<!cRJ$xslP~0lk?C$4FjO}Yb
z{`mMh+<%^3<-eNOv-5pgS5DSA^ZMog3lCGTOcocm=Qd<koL!%+6D%VtobP+!RGK!M
zZ|TuPN^Q;I{IiewcO1C>LPwiz@`9Nx>bDARSXTzVxoI76g~2yg(C%PpL-bTOCaI%W
zPU~wgOELMmQO+*F;aQNRdEYFBo8IM*S3i~waP>RJ{@$;vbL&>cCygNs=2S@MxC^QG
zmlV(Zb7StM?1b3eomZY|R@J6^^oHy%=H42z-?+pui($X|JGISUSX0+p$YyFkuHal#
z@V!xDuJ(zzdAs6e=ln6SnY7EcZtwQL&u*BmsZmorD9ZV6;)+w!2W!}724{DQ=)SC)
z5NT-otSvsdf0yqL3+p4>+h(TPb6ZSk*rfM5@}>6byvTzqtk#9^cX(&uc~GKk>649&
zyC+F5{LFH5&E(tzm%P{I?DW5N#Ua_6|DMaqBmHi>-^|;6%C2DMr&XqV0&V;myz(9|
z^5Xkff81h)=&mCc92G&!T8{bFXm2T4cWwo@{bRnRS;o`$bsc}zBGP{}KQz~kZ+e8j
zlGDz)3xh*ko}~ZmubA|vH1pt&>6%uYmx^Sp8=t)E^Lpa0F0f<0vqInck4y)TS3gww
zdinM7pm*oLHX6_W;wcpn-(OyTWVV2|z`xr^t0e+<OfTS1-F@vz`8l51TffWvn&3Cv
zwRg^j-4;_+o@!ms4q5k5cm2yN-JkZoXmi-hJoRzx_WfF?)~Jf|Ol@ABD&luIW)d5#
zU=-s4MY&Jeiv)Y0r>zetp3=*>&9o-a=8kp$^{$7ya}6dGihao5v$;Ekl`ZmF{N{%b
zw&y*XdMD~uuaMmKKgoIjoNc#Fw3^-6IX%AZ@&TEq!~^qAZ<&>Hvr0BJ<f7o3jgC<d
zlegczws47Ty|MhZL;rs~xO?$jKuN;dzenm1F0(zqa_Rd;ohi}0))|j7w@Rlor1IJu
zzCBquhv%chj+e1_r#@bqJG+RLHA*wftTMy$M7~%pkKn%L>Ap-C6xQf&y`&&jtkUf&
zaZhoZ$bu_dc0~LtRA0I#YWM6vrj8lP4ZdHcT%EQuO=oXf^;T=E7{`w*E!!S^&TiqB
zQ{MkWa<_y;&#t8Zf3J7!nS52@{QMNpEl!t(es1kmyCTq+CAneiqQ5!b{@+CuzDu)S
zUr{^DiS_l97KeP@!i!3G)-?<KEt**A+vL4EYeJOU#ydtA)_c}uPR&Z49=0p6Ak#F;
zd+q(0Ra1ZO3RqgG#QHt^*vwr;>B{FAu9)5Dajo>{;Yzye!Xu@gwBeu2l~rZI@>^bQ
z{p_I~n=O#B^!2j|D^x6PuV$!z&6>AsM_;MU%bFD`3^oD&YjZe-Px2NjJqlT&z9G$1
zYpRn$v&HIF*ZNfFp7@|OV_nAndsBQ_7*Z{*8eOg&I}`oma`#!5ClgjYzZFrnPV&ID
zC2GgT>$=iJc0SG$G(2NpzAZ{;-QJs~99GQc*AtS3lD7Ir9#PCcboWPp&f(I3i|ZOx
z>R#AbpDpFRJo)<~-`v+V#^UV%9_1GJWe0nfTg>U<@8>JK|8|Z{GDrKK2Y(fr57!&7
zRN&3zee*7SZDWz)`;up8vi5J`ZC^ik%CZlAZ7aSl6TJ|#|E<kt=Lgz}**!n+<izfq
zGbcKC^_ED7qrsb#b3Pu_P8Zzwpt3WH%`n1pe<53DuVK1CEWg|O%y|ZfWA<__kbAJd
zuUU$(E5yPxQt#cIq759GnonhS3vFw-W1jYC!QLNH&(@@#5vt;Saqds%+I!P%*D_d?
zb7gH^bF^|xcKX^m8EY?26O8WKXe9e&!KG!UCX0C_7I1B2w$66@5%Dg4#+uZ*SMEhx
z3OF?OUE9Mo*-CZWiZ81?He8CBD{yO>_wxI{ZmKhU{c`g2|Ehm?H|Nj)AD;U5z{CYC
zhSxa4WdF=z|0y>0>(>|G1s^GWSpQ+2rnmccA4#jTmqKd<+^?^nTw)&KcGC1$DBonA
z_+^|gHcEb8mV5Kr;mTQSrpf-C|0-kUo1d#1R^R%S`HuC)E}#EZ$={3h5B%MJ_VL{!
zf%4MIe?f%{b7B?eO<lgNN99hIm+l{fZQYBdPIilSdTa>{Z!mN)<C<e0adqvKd2tCX
zX#%sCws0<3@sKZsL+n7RZ>h-=2A7)T!`}B6=(uxgP2bM2Ju`wwHhb#7taZzImiwNW
z?XhItruwCZzh~zh*le>lAa0T8)0#D2x+~W$a1Iv>db!+T<Ah+%%Uw&mq`u~)GV5%d
z#<p^&S@>S7(xrt<RODWGyyyBJ!f^A(%Ahr(SC?9SE!oaIT_e9C%&EddlbLzt1?KK0
z`HQFht^2|`SIu`;tLe(AwE`^6<taUBa&gyVckD~vA9K2L-6=Qm`sUNyPkj!WTQzSx
z^Yn^+Oe?oZp0rz`p|of9pLvzj>{c`xebBe$*jchYU41+2w^Lj5=l=h`|KE1z^%|Fx
zm#TKZ-p6OdeC2Lr?4~&}leuFS9g4a(edaEy8&yr&N280Uhiqo;zPeS}a2Dr_{jm>U
zC7(A)QizL|&%Rc-qeUWa@@lE0ADz>!k3C7+aL)C5YiyvY$*xt>U6ZsA8?4?_)EO4+
z6tZGIm)M3&JSz@ujO_Z#zFkD%>fueNrkTz?bxPV$r1{>wkgbn<%Iq?|&KwZeyRC38
z_;RJ$kqvK>&k2c(vnPcf-hVb%@ovQOEt*$Dqt2bUTw0sA)olHKJ#)Ru+t2;~Yrkho
zU+D3xYwmhoQ`uq7{dOJG?yVd0^jDm9x}~vTZPX-3z00cNqATx+1n;V|(NtAkkTQA3
zlZk%cK6D18RV;C4n`G_8Z)94wtGFQZx`O{_hAsT>-dJgI_IWMp^9qiLeLi8=x`!p9
z$F|*zzGk=S9k)?gg9=a968GxRWLZ<^D^GVew&dtfU%Kk{$t_Z$bNqL4Tlr2ZH4!=b
zKm34%g|zzzYdMZd&mXwO=fC@RO-}fPnRfrmc}r{rzC|2cyZ+J&)vnFAJUDd^cKiu^
zB`lhh)qZ!e$NVjPOhUWfB|YVrI&3kMb;iCf#sfY-|C#1FF8?5YBiH1k&hGLzk7vAo
z{)hhzU-Kll1J8=DKbrkuYZk9}+_KiM$GFVyu%;BA?cT*KslIiYmx^<&ven%)p~<p0
zzl3yNT(+&_sHXdB-?d@q8l(KCS~wlvEp&3>rrBNDN4I?Fw!X*BxB0!Z=bnVCkF|@N
zTF-5jD!<s0lA<!>u*MhVU3{yyb?dENf5xHc_cjrwTn82JJ09oWv80@7toSK<!p2nf
zUdx;{sn@ltniW^c=FYpv@}zg39D6Cl;Yqm*3o`B$Og*Y*=KH8K$@aln0rt>Mhcf1N
zJztTd={ieqZvI5=MK}IG{4+(JXZa%EqbX0lD?bLtp4L{Fv18e$9q;x86t?T@^MvQV
z42t40^L#p8b<d>4M*U-v1%0>gmiY6DU$@aZG1d5`*s_U1CnaWOaTRRNxHr>-N$;_i
z7;o^LIdQK{tXE6MGRx{X^rQ%1a(z;}<=7F8&VXy@!xpi<TYWS1Ope6%!VlZ|_pR^!
z*dKboY2S<^zItu7uO@y>QuU5~{nYF0_bk)+Z7Pc&<=lDlZ1uFR2Mc>V)p!33Y_G5U
z93(oA>#-bPQTU~4!PkoRq$zTxoqK+vTqC7ma(zgik8wkl@`uEm=V#u1dstpa(CV~K
z=r>RHg;KS1`=(?sSrw6+yY8{GoyM;RcTULX%YRnfKIg;Q{Z{>VryZR&N9X69wMS;%
z{5<noNpHi%-`$P-OV_Pm{c_O~m9=GMA)D7u3q986bBsr9zBO;g=O-If4~d>=*`2Y&
z>&`CACd;E;nunqSwLh=kb8SZRGw!3SCa<rEO*A<?bzYXM&m6&&#;VsbLhjf7`nI!v
zxXozbZ@OzmLG+!-12Uy*HEy8|AFKard{tW`Jfl&0M_C%Dn%9|xOY5eU#B)uUUX*tH
zdO*;w|NV@ehy2(0u9?SBR8q~j`fP3L`|`NVO;;~ho>(NpndcaCMz5}oBTeY8?TyOs
zWjpGP?i{UHoUP7h@Za5OrQ4iHi{%XW=Tt3CudM7)HRcg};Pm>?f1T?|`KKQi7Cf1y
z5_sj?86VkXiM%I0OT6{i9jp)M>DYzl&ybueSn}dkT*0b)`#o2DoF3c1PpduhX|~<s
zW!!eW7R3`UK62WpKY#s!f~lE7OJmHtLKN#5H<@Jdc+S3}ueR#$`y(DH&%C4jxRv$3
zn`m!YsJds0<wDbo6M_zJ`qgow=h~}HRh22vtDZJ;PUPIOX{Oep%8~=+_O_>s=M;yS
zeOx?U-E)cD{H^mRoK2LRwarp7J6k8IbZ?Ks*4%Ah58hdpmVVtKbZ_ir1K+;_*Pd>F
z(I6R@sFxd2U;S?P4`DSCk#1SpqGOeR<RxWyzCFeBC+FlHR_^xFrW~2gf~RY>WzU8`
zoEWJt6Lm68i+R=QT&?NGQ8V`}3pslJvy}a2R)sJw_0@Bx9Aj!?ToKY9q9qdO6ZhOF
zEp_pa3;rM7gwH&FRVN{5UcUU^2hpi5Z*L!aB+7DkhvwCtOcT=nU0bLc%Ni80c}-`X
zYz_lkU;LRzf3E&aJ6&M!_4n$5tr7{PySiKsT)f(9nx7ZA;c~6QDV8k@Ix<-r{!KRE
z`uuvn1n-d(7k66tO?PuhP?q!mYr&VcesV}k*~u%1lcuebxN^=+vf}Wki_OPw{rQ?V
zL+;bzoo|i5U1>g&>oh$#w3F*j&4%J;R;BgfIbTz?<URDYli1Ugtob(V-EO|@NJCoA
zsz6T#`=2LU%YQ$f{P5$+!qru0no>mD^V@zOUi@})qG_@F>=l~T!cj_TM}Ob>$I!o*
zHE#8e&wFo8tMp8ale)IF^c?4^>SZPjRvwZO_k*VP9;_<8YP?&jXN~BDpvoL>_vI^=
z{+IRi`g%Qb?aIn|{~B|ri7i+&{lIkB9`CIoCo5VmMeM!H>6IK>Xthbi$alq~xhxvY
z)>o6B@3IchuIAe)#<BNF(Cw$@UY;VU<w2q!ZBKOO2nRg*dLVm^U#v_v%Z8nj>a#Ns
zlxcl@FMB&lA@#WR<mks;n|H9hE;-B^TgE))=7c9f9=GkgZ${3}lkL{#lelwC>*P~|
ze}5*=Z(`auJ%YdRR?6Y^rt2eq|DPA}UsvtgGqv1<M@p79dpq0j<ybbq=cjI#zDxS-
z@3T*v{Nagt^Y30-?Bi9pa)15(y)SOwG|rsRiEpPY*Qo0}`BwW|V8ziqB^irk#w+J7
z4zq<b)^#1ScyVz5^62#JxT5B%^Y=vT-nRctc;<&qDohE7`r<$OKZ#Vdi`d**DR3rE
zX(jiGAJ5JuB;MM0rtni3v*4`Df3D~Vzv^3F@c89+h1JprYGw!T7vHIA8E}~^sr{ne
z;nu%-sk1BAAKa7asQBqoXy(@Hj;)g2cX&6JzP)p&N_rjpr=*9^ZChQV6Ibh{FzKG2
z=N|h`BXDcW-9pKgX}+6Md|vHnx}|8Uv-rmY$;dKYci~@Nrnj%IYnoQFH(T*%Nzl65
z^V+3h@x{-j<?VNwhj0H-+$^xeiRDz-xv0sjBO0H-D|yBc;J5I0|GW4(($`8#H{WGj
zclXtuV=;eA^-{C=x;T@Hipy@lc(ip_%aRprwx4QLgu5hp7j-i)&v1O#=(T>`M)mB~
z>UTSCe7f@LeOHTBcXZVAi__;87_3~Z&c2&nKSF|izg?=3MP|do6PEWnCw-6(V@@-+
z_;YVXW5->NIV^QcQa8^u_7*9f{zyc*r$Qs|Qp&=(zV|UI5{W{`>Z;Br`Cob<zuJJ6
z^+vyJzz3J&1$9g_G#fOhK3L@XK;&Naq}@lWJ>My<n4Zd87``H^sk&^dWWV5gg*`Xs
z<??e)+j=d6$-*a(zjx^^CC1u`bNuvgop!xe|I)hp{&ddG(;DyVh50(Xm)I(HY=!Ix
zlf+L26P>1<l-T55&+EE#;f2e)cTLO6SaHWs-6Uj9Fq^N3S!QFK)zO)k`9h|zyJl;9
zcg8t0wx-nc=RQ<eXwE!&NAVilYuyja#U;+QZk()A&eFoTTTn8zbOX!s1AT_40tCbY
ziz3gR^uI7+V&SQaOP#+a{0{At@|^y*#%glqLN`G(ft8+#s;Q-M8LK-wcCko^T-_Np
zcaD&%_3EofzlJ>g$=Z4@Q9zPgx!L}Y<o~@gb>}6Y>UHbSSG>EPnJbp}qT70gxTBXf
zJ_JAiq@>X4ow|TAB&U{V$9@;aSN@+xWxwxNcxrI?k)b~KYc7e?o4I0qQjB$%n0S>u
z>s%mWP@>Isfkk1(#VmeF)*l{i@xR^)U6b<XmRhtz$7oejW@MWBjFZU;6E;u%5hB1=
z(z$V)!2$1GF1vCrCwzEt^>#_u8HEMM0v3sHvz&5U<yEBdu1^O(+L^|jXt+2{(=|cd
z)<oMf;+5(@oi**f?_UPpe{as#xAy(FQ}4dNdG_$VX6m{xvtl#1SzG<OclEm7*2B5C
zZ~drye)r<Vg8wOJgu9i#@J`O&bV&G*O6%T*k9b)B<f&T6ujQPc6nH4#_pkJc?r7@|
zZwyT89_kj<UCwSV?(E<B`efPji{~{&A|wSqOUyS|>^aY{w{O=I%LKRhUoUx<vd8wd
z-1qP_xZl(AJ)VPI-e~#l;`0YML}y)9zGnYL?>}!Pi`dJ3tBp6<F5Ao$-<n+zv1zG4
z&x)AcWt=ZxIU6)&6v$24R+=g_`RD$Qm!HfU_j`5MU-`kaVcA6qrs(<mW}p1k-{kb}
zc)zsy<>((bUw%5sbl}Rf7aD8}KUn>7p4BwT|B?Ow%^Cq=d1_m)e$8KV;oMe-LPneZ
zhre#;DjiyG(EL-$V}sVov=3LK)R)|no3Lt`<g<M@H$7BxbTH)&j6AX?bF)_%`<jha
z$9WEab&OcXHbv&}u^X$;6lFEYN^STh{;uHWx@BKmZvIgEkk0tRV4F-+qUnj%M`r8`
zbmP!u4*mYS#M&);e)+egQp*z?{w=$-^XS=2r=0IP<R!cPN#Ze3uWR?6Vf}00$CYlJ
zvpr+P+s^$~uvF-nwyaJ`uJ?%TdWn~1La%pbcBQSE&K4BB|NFws$JH&KM<=mne%n}h
z%>0hWX~k<YLOLDMJ<9G2PKy}w%!-XqP<-mX+JayFpn>nf2rZ^lCyka>d=g*4XLIO_
z^@&Q|C4cX3TFf0DRoJxjvDN$ak|Bp@aArS#Xi#+XSE^61=7-DcyO*!DY)@WseDk!z
z)vc|wvnDQDbtuv@Gtai#qF{-Bs?W;PpLN#=hGyCBpR!o}_40=oUwmyBKhxAGe<%Kr
zeaP39O?!5<+!dR3%0BT$v;47&cF&^Hv$x-bU%t1EE9R<Ipym6?^S8R~u)7p`LDJ*$
zI)47Sk5zOpP4!(j_hQ~h-DZ79L!A!0y$?Er6Kns8#O(K(cIS)By{7AyD@>w~HHIw+
zWvaf;X??=*%VACb6cai3)s|B(ZcQ_6{d8Hq<H*a)r^+<jvgg=YD~HRzs9$v@gQ2=3
z*>%JGxrSfLju`YUkocW5DI+|1pO@xw9jkV&y?mE@WZBO()oe|1=BR&q(um8BePTyN
zIP>HcsaAqZ&SY8LD3+hTG(+9Hi|<o*(gxL^*QPv5y?<rbIksiW$D_g&%eE|$t3SO~
z>(WjURzF{1p^mqU=gRkS&z$S0e=AgbPk}B|@@|JE+O-WC@n5^dew7}X#31wLeXT_P
z`#C*zQhgi4e=S_R>(+7m{<!%)j_>6A`3hnS_kY}WE9~yyzy*6hEcYzCD)unE-n{g?
zq5p&{2HzeXS~f{~>B_PuKFc}L8@P%${@0%o%5q8F{-%6sRP3+JJ5v@c)KT8L@nfid
zk3N&nMbp>evMFYLKP!J{)NlEpw&!zI{%_uMw}eWbK6$t6Pm|z>|5j}e({=w@8=sDH
zt~bwneM0;9$<&D~F&R@<MIGyrm-Bwq{ibwoQBUaO&?i;L{*-zZho<ggTWD73QZCwf
z;^Gpe=@oPSPW<s}UTL?r-V@%{h1q%Tq7`Br8Y<7khu`~PwCs=mmd<03mt`cR3aBy%
zHcdCYo6xIy`;Ufp^F7Hmor$;Go`xkA-I$lVtY}mGu_pQV^|Q}}1zuPlTWR^-Yqbu$
zZjifs?46b!XYXCJm#9qA3SY=@@W-**kaF?u)AE)rJ-<VEQu%>%Gh`j}qq$B+?KiET
z)ce!*nXK$2nZ=D6o~_zH!Yf3&KASCaJX>MP>k+KPRm%2oV_#T+^rox?zG$a;MeF;P
zx^?YsJa$t)Qgxe;Y{{gqV^UV?|BqhcJ>4NXwKD1Kyo^MJaFfUn%R;ZrkiWTM+N^TL
z+pn9`6qkRG747}8VXlr(=*sJJmpptUQ+0Iv?ga;qwVe{XX|bE<`BAy$KcY+StHiyC
z)A#(;_R%EjY)1O&2m6=l+H2Vzp7hM=hfn&|PIKnH%Bj{h#&Zj=?CU;xwNyUOYV(n$
zYnY=1x!g`nDU@IAE#Vlkz%%fy(@g8dPG>_lRKAe8e8B(j4Nh_IFV5$hGM^N8ADX%R
z<e{54k5s6gkul<)BYLjCX{kln)F%^CRF*P2F10D2+~6b~`H(R>@w3uN+4Q-R=Vc<F
zoxHyJY^%`msfROmyRAz*Z7%ZK=5fjCGEafnE!<Vc#r<|4k4!k~xobhe-gnt&T3bWa
zGau9k?Tbi>%bvJ)b=K9RE=;R~1H{taJv)Cf!I(Q>^U|w)@6UPv<ShDgL}SaB^vA9B
zrpr{dx;%EIiJVetSouguTCQ8hNZ<2IS;((9-ErBi7tdH<JR_%>aesk!_RiThp&}(0
z1y&#Bw$sYkEylQV{+<_AUi|aBl{gmXb*|@`wqoXoaNUx9O;)+qk9UQZ1#Db#S4yDV
zsc>!JB&$cy%B?oOt=bX2>Ok(rsb&X4Sr<qY+`Mw}(fbyM<Ibw56Qq7ke4aD^cj6mM
z`AMQ)DdH^o6-T=R3ly#0l!`WmJ^YxnAgImPM{?IG54mCuM&Zw^&lvp8VG{dz{HVg|
zbPp@LO?y~<CbURC-W)uA)#KPVQ#(@<1(mOK?MZGuHp9nJD?Ox`=lHfz&kGBzrXN;&
zdL`-M${cCeOA{<#J)QC>wJY4AaK_!s-5X|^@87ocv&PJZob6^QtyZSq20z`dPs){E
zUpklT%Lk`0IqNMc4|$$Pu3u-r$mu4tbI6XCKGXltoztt$lB)!k{TAV}oyYAU=KkY{
z@&Vrn8;z?|RJUcb1zNQlw1r9fhsk<-)vN7aARuwLDL#T%mDyRG!$*H*_t%FCH!K_1
zT{Mkz-Q>-2^KeUpP0?zb^7@;()|<2{FFd|7S>a~%5%(zW;O~#wx{@Wk-TC&0&fJk2
z7jp1^?BvDUIL#kDjQV!jqN`O?x#oF-@*-}xryHleIo!nD)!G=DCaEW8d)@oaKII0D
z_v-t1n7--g&s_2*xy9di-ovezFFo2^w<0-qii~WbkmK=OCpp&MpHG%ln<f-}mzeVJ
z<+I7gEL+WQ{V)7|^<IHZO}){b<GI%#SIzh_qvLKMhk?$U#m(pEPW~jNaoudrM}9{;
z>E_4D95=jQ$+XTrGi6h|k8*-oDW8|%RcZYdi_!!(9ZWQ53RM={!n13x&pNf1fZ)xV
zjDe=RnV6S}HATkW`*|g8zh^F!Ny<8*yLYm<+3IwsWzE!I#`)mg^L<OMyqa}=W?`n{
zj2h9qx9`<&-v77kN7?TSkE}M|U8!@+bj9@&ap7%AJhSz+noJY7P0YH@8qIR+u^ZdF
zt&0wys7UI_KO&Ury4d8$QTDfc<dP3G9gN|t_jwq2^^Wup1^Jn?5*k8sLmbxjEp@b9
zpZQ|qPSuZp^VS-~PCK0beD@8-@MjAS>slu!9XKv}_gKmW^XZ#fm!$kT%i$@!x@xI^
z#Kxe!yx*+$3wLf4yL2aN<>AOX%Nyr4o6KQ7XXIgibnPTp*R{8H-n+WVu-g6Y-jkuT
zr$#$II<ufM?4y?IVf#rxTKkVF_q|fS))Z>6hb8m)n&jJwhp)dV^B0>DcIdc>(1v-B
z+ziZb&#WoWxXi$EhX3%}yALn^sOXSB`S|eL$?|=gxh$LtHj{Grp4D?4vOT`g`M~VO
z$DdR!JZ=4Gs{BSiVF{K*yL~6jq%W*IY;K_Stnb&|jOE?SZ%hk#eIq>Lv5)9%Ns|ei
z8E@wsc6r>dI#E8W-RYi0Ov9ck#l(w}x@AFP3y%357UF)vP*66ht#sBC=X962`JdM8
zil3u3H}2ex#FA6GZ<nmL_?)m}Pf^8Yg@^+St~#_cszp>d%GfXKyS@HSN!q;FUBAy3
z_X%sgJ?^^5@|VN8od?V#uBK|g;n-h)cF)ZN+s^ol`6<<z*&SxSbYZ4I)a*x=1r0WP
zIU>yVpH^UMl3F*@sHZda_^frWrntv*WEutqeY1HpMX@yQrt~y-fzQS2uFt0GMEsf}
z-@}*^dE@!S`g1Z_)<-zc^a|ARmHl{YSF$^7QhbEep~=z?)0!vCCopZ^pf167Wm)Fi
zyOm#7FnznIY&<dLBGb1!SCk?@BtDhdUNpV2!b3PDL3euY0!Piw=`vge=_{9T&V7{q
z`Hj%6S<@fBwJ)w0HH<uWCUdgQ^z6A^iz+G=%44U#Nw)YgCsscr>(1Hcd*6csk`FJf
z+OA~xnl)_Vq2KMivu;^d{Lb29FZ18vmaR;$d;a$OJpE?{1Ijl{%ISSycSCxwRCf+X
zkja*ZEal8S&D%HJ>Wl0B=B6&6r7+X?Xx?n8*IzjNn>2kxj9bpI3hQ4^kc->8{Nabc
z1<&tt&V1JHe)#(0@2;!r_)c95*fwjn^rG(?9vR_ontS=ej=zsHUL(;_mh&?$JzZzh
zkN)!Z_4oExHa}c(T>joZs~gU2wWS3czJK|9j<KfszTa%0*^vg3b9evU{B3Rjx9<sY
zGX2~8Cu~?eUqJ9nt&CvwTlo+PZYi0^LM$cL7B-194(j)IJiOoiVSbF(oY3Q|7@|*4
zEd9%%;+F6JUs&z<!G9I`KQ0&WUk)$WV0LfEhs__0suGL-?|-hyvp`>=;#hI=vL8iD
zo6I)-(eToHS!Ubi?7-aYTrVRM*f6h{qe^n^qZPmEzFjtmOtm?2Fj3tz@v7;9#_!Cr
zlMgma)yw&X3ufdr7_SPR!r{f$l<;zXMVZ;WEf*8bv(x<goz#~6IjXa!ac@Et>!Usc
z-im;p)?%Jteg`~-pIJP+P#>^A?fQa;slf+W%30?weW5cW+vZjCrPN>ZBa_tAd{cHv
zo_MEp=5luW#-?)(HLhI=9v$mS9oB1`iR^jV7<N(rdHzqaEzFmzgF<uUr(Mmy68Zf8
zqo+-hYMjqzesft~m1AG>$lrcp`ECW<S5Fz&J&Z|T%(yJ3CcZlOPyJ3A3rD-Z+*wB=
z6(;>seD2@zGR=jlnfIJWK^IShmBPPnam~ls3E4lw%QnXwe6Rkx_TyL9Z?WP15&_+Y
zjaktG-#0ki|2g~fk#(DO7d^T2xNiErJGJ8JtDjElli)fV9wr@Uk$-dR)C6%G!vf)w
zTGlnY3!8QSYwo_waCN$yu>Sqj!>8UUJks1ZVcnt00naqH+_^T3P0%`Z*OQOxp|-w#
zno7Prp~gp8K7VD}p5Qf;i7V2UXS>cp4>g_=p=2Ma@5jRT9$wtMpTFGi#hgoS%S&f;
ztA%j89X)ko>6FO5nVf-)#^s?h^7k`bR;BgiGVot0Yde0N-F?H0y>f5+1G40$zs#^Q
zsF|3vIcsgwyp?V~F*BS@Jr@+r_uRp^Woee~<=tHeW))VlT{GUHe?8xaw=^fuck%1R
z(}O-FuAXSJW73hEY&|v1i=WJAWVfHze5mT`wrIHynYZ%uA9U8{oRrlFba>0q@ThuA
z?U#jJg;R_7H%JC<sri(c-{HHjYWx1(=5G>Q_S|Lb;XkG>&$sg5Bc>bNvAnas7EE6|
z^V*B|bqtqlwk-Cow7JH#H6!;aUoGdO1qOSf=T$5EAHTQG;-ToulgnqVmgD`ue8ufB
zo5qUUwd{w4V)@@WbUw(cyu;@5_Mo62PxR%W10t6nUtzfP?eL+#7jk=k{XX~O>cx!d
zZ~C1+g)dlF*fsN~)h@Zab9bBXdA9cBgS@i2g);+Y7jj+sA$vv7Lw{bARiT_kMdH1!
zn=O^*PJe0~*W_>}(Dkg-uDIEG5A=>!vZ}0kv7s%$t${h=tn!@?b~ypYAAaSWvYC~f
zbxre^WaedUUnTaG)sth6iDuONOpw}fz0cB4W<JmTKHW*d%Y3Xi?YEXIO32^N-~0Oc
z`@bEk^KPw(_r0-^_aCdczSRQ7T~X(jsjbsiI<Fe=DyC=pvIp-roZ7MU>_L%~q{L7A
zlb<ws{5d`MX~o)|1!9Mz`h2**xte{Qexm>8rTInQ*S$}fI6s!d*t%o#)ty=I6lEC?
z?%e%RP?-1F>F7V@ho=UKIPt#-6W+rqwl9B0+>J?2Pj@`%-_-nPj&I}!nI)_49CzI4
zS^xEk&&&0y+qD-&R+Q#We>1~8Wk*=z{r-hd){3l2yL;i`ZebnE_bF4Oxqj9vY@cnp
zy0}Co#bU*_+RginA8j*QmQbXpuMujUt>F1GU+u;PvD9Rpb3Ov{EXK#w7*AK~aIyZH
zrf6rktVmaA=cm<LZ0E}3KgVA@BPbr>V9#B^Jni~(CPS8Yv1`sv^mM*eC}7#ezy9HU
ziK^Zfw{JH7e^0hNNz1#J8L-jw<*%MAe>2WCbo!rMWhaz=`0j%H*=64runO*c+^ry!
zoY`sJrLtx1*Y%dyHS$<C-xFJ1t-4svaEEH<nJrZl^S@6qT>L%1U0>rk|Jm=8I0d%d
zwZ3n3m3#N21q`MCzjKN&@ZBx&%l3HI(OJ6_eGAlYEn|D<Akq+W^8UXcaf}JQQ!IZS
z>)|ZiH*x6#yHj;cTkC{avx@F)yZY1gQ`Ye<I&4`@Qyx9ub@F;mVJJ^x<jK9)j)dP<
z`Z(<azv#(ZDRrCDv$NCGt<5DD+?x4v-JX=wwzsCJyFFKBz9k#6GWBhmpOt3tGLd}E
zi6^aWTtq|Fv=Y`Hc71d%ZDuD|!}rs!Y8&=zNt>qiUyMA_Qp_%w6}@+6XP?35#HrmC
zN=Hm@bX?uzZ>P2H!!*m4E+6V5PjY<Ue$Lx%iM2uS>tDWiLOd%kzv}z?%Yi+G*SW`V
z-@0RxtE)G-@uglkCDMJ?>$=^}58Br1yS9aXTcT}kwt0zQS@g6c?kBHi@?Q>f|GK6z
z{3*}8X$CWPpV)rw>-E%=yPhoDUpViI%ai>#Kb0SymUS+T>&(MvFN=znMlbvGeUfXX
zCMR>rrN$Y*I*$rJd|@~7SdhMb?;joE>otaa>$T5GY;W<~+caIN?&Jz_iRJygW_Jsh
z-Z6^!+Hx}9H#1FR!HT|~RgLSFoBB$`E^1b3yg4Jfv{vkyxiia&-~Sl{yqQ@<7#J8h
z7?Rd)kCI^Vk#}QYU`S<PV30vQx+6KUC_P_4K0Y%qvm`!Vub{HK-~Y_X&i?QXp&ieH
z7??`W@0oOEQPZLjg_Y}=1y7yy_vzHv_tMc|>pD_YxK#A%bFCMtN+Mb*&%~aHPt{O(
zc{R}C#UmyLRQpZm*0OA7XJ9y~%)lUx&Hkj)%$$_eBE5pjw~@K|x6K6pt&2anOFm~|
z--XosOeqnQwnc9+;S5W@A;7|xd(kj`<`)+$$AB;FZ}Z<wf7^G3TQjhaDP5NB%!zKD
zd$RB6RX?0q<7*eY|M%AiP3LC@ym?@g>hzg4{imSi%?m##$;znZFTVc7Cr_@pZu^xd
z>+MfIynXmE^N-KEmg2Kg4QAx0_?b>u>SAj?SgQBF@{~yArkuk?u3|>&n|03z>AgE~
za=E97@3a`fACbmdCKo5IdD(T<M1JNZCe4#d)3cwX|M8m;==Rxqn(d@1XCDft?MW|8
z+3{fNtmie&UK)p1Fi8uAsCD&pye!#x_4XX!<t^(SqkUHh1W7Lq4cX(ha+yMeX4u|K
z{n8;FT1J{Gs-BvOdl&9ZsucOiI#Xrx{dM>K&)3z|f4ltiDZjg5qrYQ2R~Fx8my6%e
ziFkgMnYsUo2ruIc<->a(ND7yn?d!O-vv%qx)|pv5laiK1Y?BZ^8*FT&_TA(*Q|7`T
zqo1i(j=N4iZd*A+rY5}q!Ry%ych_E(vS+vxd2U5oi;%O!lQ-pN*OLw0CbO@b?xHVw
zaz}zo&UNE2n=akH*|XFouT&^>QeT4Fu5GiFx&!Bbn9_5lY@bVlV|_zK%n3>1WzP#I
z?`307opS#H_tm~D>=Vk4voxPzu)PrNYsu<!B1x_@=E@(_!gC5?EKeHJ_jLPx&GD?Q
za8GzUV?p<%psR+KKbHNIz1hCwL-d;+;kN72jkN!8FFv+^9=p9{m-oy~i}iG~gp@Tj
zo6;;yl#<i!I;>Busj@Qf@LQRr!OZ?iOT;$TkLS14s$+h&HAbt2*JqtwAs{b4W2yvC
ze>-DK&W;~a+ZBvV_IW)pnVj(8O4Sb0<*|%O>AbET%4^(fu3XudzUEJ2=DOtdzTEfY
z^tPnGU%K$+mhE!ya@Wr_O<AwJrhTvJ*8KHT`M)(iTzn|)_=}k(#SEr8-5E{J^FA*B
zz%*^5-|M*_?>#%O<A0(qJcge^rbwP~j?$C-S<k;*++I5=reJCQtjfyQ%auNrHaH|2
z9!=cD-6E{<+)J6s>Cr3R)kY7_CNMS^OlA{X9L+Gr$;NAY-=^2wQg_}?dbC<0!eG^j
zjmgcbd5cri*mkr<Zw%FuJ+@I@dF3+3%wzM;1%+r?eab$|dreB@s*clk=j+y*^ItD3
zzISl<wBloHjb82Mp1Esp>*5PDFZ|J*zR=D(c3Rk^raJAbKicoKZEoM&X8W+qR!YJ#
zIy>-?Y4qyAnC2kM2t(Ug+XIh7PH37e`+RjpO8@SfSgGp;U!UuR*ME$8s}o=?KKt{Q
z&0lUTtY7%*MrUpO2a}MzYd-p^Q4tZkpOQD!NxfjP*?%BiSv2jy)R((6%Pxnm%u|fg
zTbjWgVQcck{t|E59dozNe?>O^H6~_T_XL%0xt3<MJo4JRkk@9Hx6EkG*72Tvt)b=c
zHpe4>oEP%3e=wiPleR@`+lQ&quU{{bUYz~H?6TU@iw~9w9O<<>**i%=UM^+cH{sy6
zY3;|>xqVmlGBtnp=otUEIJbok%XTl7SrPl}>S5tM%bXM*KTqr5+0}ny?^>$~tPzD_
z{HZ&CUYhDws?dAj>e-@+Jg57v&Q!l~qHmX$-<!}mN5drQw{6-e`Br~Ih5q!a-Y35U
zBreXaTRQW+*MUhd|L6QVpEg-qa;@zHyUN4=Zd@wbJwZ1#gMD^;Ty<f!+Q-h-vJ<u6
z_{2Cj<U~|Hy4s<-_y7yP`wgebs-l{K3F(r@-JB*L&uCx#t>>-gvR%3}!o6nmZSc>2
zaGP`Xo5u?s*KYl3wmbjAnY-OywtuS<iZ|NdX%0W${Cv^d&wDg(thYK)C(1Cp`(=1z
z<$<FK{0)u2Z!%Qd=yMr}CpJ8+HJG*Yhm}O~)Vuu8oepi@nD=q7#yy3-+(p)f(q%K>
z%U%zEyLlbg>nSm<{kyap^aUO;$>lpgb?R!dm-c9$qT1n6cJ;T(nV>$Vgp+%CMQ&^|
z4^m%LEwAEX_{&8{jDew0J!oh56!#ZQp?=qyS2mfjh#n9+_w?@a8~++t=E(00`K!sc
z?#9Oa`60i{UNE!nW?r{p?@^t-=R8vvd}nsu@L77>FC`fcncnk8mhn>snO84=RasKO
zmhU(5`tc(j#j`^C*R0GuwPw}E^YbKZ9XfvA-*Rulm0$Ur*50yyP`qyXg_h4h`*tkP
z%qrtdG-qGDKjr0grra!jejC~9rOn3~Ehj8{xajw?xl$dk=3TeBuCVC!s^e$p9Gv~w
z@&6S@<y$GOY|{*$mrRR{GOm_5x2>#JA-DMJzUfuMduBZ9-o$iv>4tawjX6pGH0Ff-
z+xh5`&f@6P*BH&?dG5#*HI#%nbgWwMyUS@d_vEE9GtN1-OU9gtz1x&<{_KWeo0z^p
zRogrRl^VwAYiHX!OG1jH<eV?OdM);%%PWpC|IVb-Mn`9Tee<_!@!L>`O8wWdH@Edo
zU90hYhg*~Kv(s9ueKuS%6`%B?%;(IqiuD#h5|&pQNpO|2sZ1^s_Bar<x42hVBj@hw
zKSs<cDy+uQRW{y|!haRcn%jtWPQG?>x#{VUlaF2;jd6Xz+cNR~t5v&{&SpsSY?}7)
zpog<|P)uUpte2;glNq*O=f3vmww1w?D&OpVT8oZ3x9cu{#5YSI;*l5Q1F28GHMc`U
zqpZx|$#JRQ{MFdi&+R&^v9?8p?Wt18ES3pMQ#V-rl18oTS4C}8_TgY)D3oDf5XV;6
zC#R+B6;$q(yq)*>*w?x7h7;sHn2ZE-x)&%sP>OQjEtpij-RQEK0Z)}r-<p>}D#p%L
zYxVv({_U-cJa2h;_l`-ca<y|*s-E3>-)@<_UB3R$*FRovN>?A%2zGCopshLOe41td
zwMTz?zt1f_rnk9f^^?oH68`^Eul{^@w)yi9U)i^La8Eq2^px>Y?wL!cna=c?wp8!N
z)7{^7o_ldWjTD<ZB`QOW`>foetCJtwZ3tavwkN?TRWRIN@&If0%A0NZH)q*%hpk~f
zpyK&0a+!Zl=rX}g7xo=JC+RPAd}(`0w%nyP4eZ&|j`bYh=n}wi%V?1Vci1zX=#A_*
zSDbivgY|OjuKEu*?q73~Y%6Hch|J^g(Ve?7H*AxJ_T(EURO5cA`8&*XsT11w^}~mR
zyP^vkHEe>``aJFa{otsQxMo53k_+E?TY3eaSw7K<YUY_d-M&`7?*H-5?DvNqdyjuy
zmh-*l(YpX=%Y)X_wg%m7Ykjy%$4m9lgp<5G)-!lFah~kHwW=>E?t{idDVuQl&MkMY
zoPRP&$9vZ4q}hvC??`J5{rEBKQ~y$*q=l<4KdVS?T4HyPWA4(<nl<a!e|*3F>E%DF
zLOVMRb|y87|M^xZ7x&L(|DVdj&vHskc8LtT4xcp>uYY=K<KY8kXOCX}bKT&_htGeG
zF-&=|$J+XYU8hLnTTPj|6@O~m84K?(y32O@=bKp{#99OX2nIw~SvNd<vs`T3i7T;Z
z*ByOX_<91<x@oS*(t0!aqHfPVJpFa_k=L&t=Xh3K;MMOwW9X%~zl^b|vC~aY%>G<{
z)6v~WYb=W_ckhz2-upB6$(Lu&21QjrAO5N`E3*54T7R=*?&+?hU8;{<HQYa*w@X`i
z`rQ9JrfUn0SUyaxNSqVM+Zb|Y>IJEumy*AK2>8_;?(krE$-{5GfGvQN<G;wO7%tb7
z6=K{jjoYr9>i??M3D;iJ(O9lp>L|$c>AvK1Z`nhPE_=_*DT+RLB<sIrfwe|~Pjanu
z;fof7FrVt6>=o;oo~%mTcSFx*(c1^tMfU5x3Exv<vU^9uw<B#Vz1op?rb*S!v;4F*
z_x<~sK6AO2uqU3|qaip!@~^hQ@~aEWo9C|;3HUZgP03c+FZjvL<;p?}TqZSW1WbLa
z+~H{Bd((GXSM8EXPc(wU!`VF@YpvTvj(oNYau3J|UTt*c!lPr$&lz5t(IYR+VIRnL
zS4a2gx+QI`)jZu#%{R`FJKVJD;7S?2zK0H_Pg(eKwcZ(JUZ^@5{WMvA&q>7-E*+b{
zy=U`si2QJT)1>D&mdWNGVdD!un3-^1g4eCe*O<fK?(^ETekLxa?Bg@ps`5?vx?F;*
zHop;$=a#dM;QpJ(&fQ$Cbu`&m_l5aphFKB8%kFnKv8`GW!j*EwM#HzY_3*Aoek)fz
z^wf&ux?+2Nf!kr<{qw?uN(~kUOuiCe)qSR6(xZS2k&TzGuBrOdd4J34^jih*x3hkD
zxa(WoT@I}vyB?`8=1Hyp4zQF2ugHCE$8>l@L;R-og<BR(Y`ZHKnWw|8QdYzF|G?>_
z$>PzAt!~VB2|ILc>x5q26Rm4DvDfvO9h)-$y3iV-6`O=xw-)vkBo^PBT;I>v{`G}Y
za$Z!k#afjaVN4~$XBRZG3gl0)^!ng0u-m>wEo6P=x??MjZjzdHpgw=6SOJ4rH|y7@
z-Z7R1-XAm6?)kr*W^^-B=e1!^Q|GZM%}yqqRYJf1e4nH)dnRRV?S<xfp<innj_{Z*
znZ~eU?d-s`jeG1n=BnIpsAcxP*>_9DC~WS8wEFgJpOyCnd_~#+wrB92O$ly(=d>gt
zRWv|!RRPPNWhG|ilQty_SY^6)D(!4C*?D92*;oU1%`3UB3OrHCtq;u<R!a)0N~}J(
z*U><hajDxi{_@GkN)5IMhDI+jUGn;!;Gr{l{}xzXxtQDW)={3LjP133h!R7m!Ojgm
zhg$yXY!>pL#A22+uVH0U%yZK}(~or;9F1F`<ZNi=#naO8u)@Ij+p~Sw!_*=iSgUv!
zebe@Okkowd*p`e71{H}nWj?n_?yuT9$HnDu<)1T`J+{d5b{Stwx^Z;oq{6$6Y$~%J
ztTpS{xaZaVS*PxDv=`dS-23&>=*)})^-wEAi$x~B*}ESLct!eaPu>2jxjDI{IJUf;
z#W;Mi_K9~XR~%RT_!?TY+cQKprT>8EqOe8}$0rJ{wKo}}oBr?T>ozXidv^N--<7c&
zrq*bQ_L!=k3*D2EdTL%P(=NlMU2UBcPRw4wxb*XXjlKz*QU}sMX`Y>8VYsfZI4-r|
zjS&0Xlqk9B6Lwkax6YaR*E>pF;_}VT#pm~3c)vQ9f7fH#<=68P<bHGnq_{dw|Ie_A
zbBP-7>^9rkciH|*PVL~kr^fR3cFQ~N_E$^AHRLWUaBr?z*~mV{v(MZ8@2^efwM>5l
z_@q@W5)w9T<9u`FYQQ4Nx{SEnl~S+lX80Up3USFcnh=sWvGt48xrtji9Tv`+wY|LV
zuh9AG?7EYAQ;p>MB34Ye|52o(tns~<`Grj`HsM-}JC`3m68wl$hx<3TFUyh3CQE{6
zNcD0aG=42E@MYDxvKfW9qx=*0ojY(yTJE5W-T_^=jxzh=H+l_sr%a2oyQ8H(SA6H>
zxpui4c`h5zB^~ekWEAtU*Js<eEys7?(wn50o3qgLqmTbGUUlchPgM;w?=>wob2oUU
z!Pu!^S>?gYZ0hxM^+`KPwcT(2)OYJ|)mc9|ImXZU>h?CNv&Me*r8W{*wRZ(*vX`&g
zYwhOYu{d8;u&dT$%7&=U{^^gm1U1YR5o%f`%+tZ-kd)#tdu@l*wAMv0Rec|~-reB2
z#OLeLe8=OxJtEOpCrIVh${07ct$oM!Csb|EQr?8UtGMdrlQ%q>a^u%}2_B&*{}VRK
z>aqKL%SUa1Y?EI1?4}X}gF*)bgFLndNM>G1YEeN^Y6*D2;i&EHvfDehzW>E_t#W~h
z@@3CkpBIImH<^5LPTE=B>_;zCS4Q!uItgWWg;Z`_TlKT~T>cz=>)%Wb3>>G5CcXTa
zWh}&*lauqt+H67k!QbWg|GoXwo}=0oHD|xC>&2AUJ|UYQT(yhLJ^J(Xi=QtdKkT|A
zzba>QZqxt2^B+9@JYE0%!}<0s`Q2_$K5V)*J@isas-e`}xpN<0&Wh*!VIDC(bc0s6
zbf9VEM$S0(tIK%Sor;xPk~CLTvTRlJGM+k-(nyx|_u_lq!lMH_6&n9vf9l8LdQ;_e
z3`^y<)3dA&Ob`4JF1RFB(5!KXpzDPY_7+9<MR{k%j_*D@>#YXowA^XS14GX@vF&a*
zHQ~JWDC}U%#Qg1^$``#q?b)-od0n(YoLcF&rswT}fnrHUypxnzk2Lv4E<2c8w4id^
z)=rk5E!_=H9~c$ZPl`%duMlaPJBi(T&O441*BJUL<#b#FI_tMas$SyAw2)f6x=8%U
z$6dL%yp9x3c)OxBNWr!vNBO6Q@2r%m>ZQ70l>hn9)4keU|ES<o@ygj(Z*MzU^ffp1
z+0KZ_1-G@>6)xJX%vzXuc$Zn~%-3#b6Z^OLy?WraNLDkavuRP$Jf_;L6tOxfLEQw2
zud^Z^p1te!MsRxOhjn+lmDWw(8eq%RYj}Y>&7QZca%W(E{^}I}|0~koPr6#VN$`GF
zpLFl0(gM-gzklz}{_%DG{XPHwz4iZZE6w`BT_M3~(X|^>GG}*dSD0*yIxr=<@Or}?
z0q)fcS8dX4oN)QU-V@i|_<KL=X>QuOLi%y&_dbr;nd@B&Cx@nPWIh<O_FhT<nQ4*g
zWe3(dZLPbn$GEco&><r;l`}IvdROK(zHG`bN~lW<OSs!Cw0?Ij=LUyaS+9I+#A;Ss
zyvq$V_uMFyZ2F#avf%$m5yojeTB`o9E#@&^jek6OzsgmcvteiV<gHqH^5Dht8zpt3
zd$stwk2V$d)$6Y7{<Q5!oXo4$4}_-kePEM#e4$Fz&$N>9++2^Rr~FNW{@L%oyq)O>
zugSw#51M`}M#nKub@^=4aDRbF!SRzBEU&gOvU>2uvu{W+U7IWThX1UX$;J1J#r2mh
z5O7$^5!b)w;51H?8|er8ei%CBvUGP$*reI8N7Rd3YvmKeWjkiMUVr!Md4ByoR?k^X
zdrS{RFtu(FH>>E3dh~kYo6hX7#+?b1&Rc6nF#N4&Qnk2byQXc!yj`qXuCs31Ofg7o
ze32}sHzSbYd0(<fq@ML((T~e#q}#InT6yfWm&)}oz7tk)+zUEw9vT`Zd&1V>s>hS9
zGd!O?|H<r{f7;AH@V%aE^E9rE3rx$KyXuP7!*p-UY!M6Iz<V=``;=SRiPN8=mI%e|
zKF-P1+Z-C&l(EM61>5I);ZJ?19pcjEcgPI#JUIV!v_bgQDdAJU{4?7rXz?Y;qoTv$
z3)74hF{_w*&zY<+7BGrQp62z+)J^(Jn4M#Bc`xrP-9?r&y$Y@vMXq)6J;wR*Pr{3S
z{*)avPI65uIvIb_LzhF>P>1t&S4V~+-`Cj!mR5D2x37+mJ9>Zr&)>g)tY2UElk<w^
z7YX5>&Du>|W<__JrtKH|nb;J<;=~=J?Q6GbuUEk`59c>6y3Mg+*E5pNNhp1A(G#fM
z)XdS~!xnMd^gQFN?Hn5uc5`J<+@`%iYZtRg#5@y&jwbcDfdT6zFPJd=SmCr?>Hgx#
zc2gH=m#}pcE(qVPy>0Tls;qD$<BPXOQB!ww8)c^a`SF<b>&nFsWSQHZp1B?3v5zt3
z#KM9L4^vk*_iC{03P0MGUOqddh3kevz`0Vk9;vy#39=EEi_5=WTXdn{XWz!$h^4F4
zI3;@z$TA=EyCe}_))Nz>Vr|InFi-v9&v1oD_ZRKbo1WpBQ2JtjPzR&nQsXTT1XoVX
zkP_>t+sdQ<LVZp8w0~<RMJI@JDmm#K%NG0MSJYcLL%C64MM{i^WI*{0ria-=Nd*fX
z0vaFfm}O=>^|fEIn1;04;_S6dEE$bl2M#n;JfGk5eAiEtfX{J0XE@&|Z@7>fy2dNw
z-~Cv&^R>bo#7|8y3%Dt{y7t3-PL>B7^JmwKC?+O9IN@^C&*fqjkM7fK2WHI)jGjw=
zwjE1oO>E@-{nqtqPs|ez!KQyJDurIPpW1I#)2qd|Z~2+sw^R71{QTv^cUsu}h|2!8
zn|GJVPi{D3e&CA3nvG{mKg7Fn#5{Vx!BmU6OJqT<o0gQd!5_&A|C4$N90D#E)Kx@#
z4)aPdcQJiX6qr<Xn$bt)qve__cK!`k4=r!4wMcpV_uT~LvmSfbZ04<azJudd@v1;i
z<=W*dW?bX+<nAb$$8cR|;lp<u>=T}Eko@~nYf<<HJC_MFG?_%Y${nm9+^Cv!&MN;<
ziOK|<=DcG(e-3hdwf|L~@XqYODTk%Y`<DNeJ)iOGZo1U!&%11zOZ79iTr}(mzqp=t
z!{a;dTUVy%1<UhwJF@#{Ij8fKGuquMo>K38Io{$?L(n=M^~ns9a$l6Bih35@?y;5J
z^7+!iCkk8h8V^SnoN!vM`bF`ehT%Wf0Glh~jUvn+9J-x9Jp9A_`Wyep_LVYHYj?eh
zetY4dquuny3(FjS*Xuqxv;JW4bOi>n=>M@3?!-06DxWQj4!bV1^Yf4OsV;W|9bG4E
z<w@G|yW#O-iD_<p4bHi8yIcQ>zS^^8TZ!8#F6T=h1m`k(aZ25cYM%0Tum8eW|Fna=
z6aQCn$tUc~WKsOGPR?I$iW%S28mAiG4OXf>_Y$72dbKle|BOkiSl+fUFG%C`Wlk_*
z`SRqsN1BF=hj8%USl87{@{T=J|M1g*yV<C9q536`BheAPF-LTd7aDFlF2Q_grtCMy
z%}-0!@9q^S(OP`y-|VB0Ixf6@<(r<jhH>kXze;6Kd8;#CR3&cfsF-15w`}Es$Ij~%
z<5cWY7!QOOg&hcFS(~H%$zAi=W1T+D<{$PQkGiM${!wdARMc1*vE#<g)1TH@PMEz(
zwUGUJnW~G|O}(BkLQLTu(Jqr79SdnP_AzHy(3)exvE}Lxt{#gn|K^LFe$$y5MFKM)
zW?Yd~Wxm+$klCA)xag>JrPIa(`5c0a)e2^vZQHZpf}g%*g{i2Im1=ZSi>G(VWY!-i
zSKgd|jZbs4sHfKC-XBvRa|s-lO8T$yV{4vamr)3l)|v-zas~gic;8=VaI{S9=BK`j
zsiE6WDzH5Ee6h?&H7JoGV!ffEtLvFbZquqVxC^(l*GsCgHBQOs*x&fL>G$rAIU+~?
z^p!ME<b1f~q{NCVnO%HA%askji=JGNz+=LgyMa~xwuFeGv-q<&{~qdaDPNnETqE>%
z^O>$f-p0)y$7B0XrWh$0&kI=pIp6d2Lz9|}NB1{BaQ{*lFy-FK7Nbfh5k2m+i7K2=
zON%yGEpHM}s@q#|x7X68V|DAwgBuhxX4ubUxjH{}iOOc@&4KDKmt`!PplYP9Gn?(h
zx~7Ub*W|W@UwX!S^pEAyH-f2op8uvud*5F&>8;$7MRB2$JFhg~6rSf3`^<bspZz6`
z%!3!gmPps1c;&YD{l-fXN-~Rsqr%!x%S4^F&^{|6zIMy~n&01Ey*+QwIOoID&*J}&
zrY+5St#)m)Wm8bpx+vLTTcg7&s`a%yPKrG#>wjG$!?)r%&+^hOk>{*smv8AbY_Ps1
zaD;11{4dWb@r^;Z8|DelXJMUMu$Nu^t;W776Dm?(9WAZh(z;{unWM`Uv?t5YXG*%S
z_waO?n9gaV<1GbOjj9$r6wa)-NOb&}dQNS=2^;IdAh(~sSLL232<)G9X{nyxk0j2z
z+5dZYcpH2+_#k#Un0fuQ2QImL|9+Fqlz4Ab`26vw-74!_dybv_-sPAvOXB{~k2}PE
z&bp&uy}qemxq&xf>YL-fl81#~37$+BdNV&G!emS8s^gC5IUbvANqzE1vdb+iOiJRr
zPtTpVU)zfQzUitG{{66Fs?|kdcAqW!c7?~j{#yE>>(7PE4Sc$j1@0VP{Zq29cv}UB
zb;2bX$N3+{;~i$7R5pA0cOhF#Per)&@`M{!SFgOZ5&b>u;>E+O@2F@zv0C+td+}3N
zb;qZRCFC=gKb^sAykuH!l%~Wi#m>_e>0B{pAEx(p_2&pDZ(49F=vwo#7iIG|z7AgU
zBc$z$@YFq?ubLz`ZI|lW@SuC=Pvah?IXQ9Lf6QSleYi5hhf|DcR>>LXeGgSPYPN(t
z7TDk3lYiY~X}7+A)47I_E9pH;r(Klsw{13D`YK@U(^WHjpDH(hpU;|~uz>mZof)T=
zPVmq-Ij*hkU~te!vV8r@UJZjx#l0E&(-U^o*1F6qY+Pq~Hj?FgS5eiY4;N?5IrjJA
zLG>Mb$~L_Y3C>!zVb-^c!Dqr3Z&)Yuu6TOtiN%vvs_Et#XP@ou*muu4fa70{$K@~{
zMmv*p@~XWn?c*gjuXc=!5zaAj*d*jDIP2_HbBm&u$O(TdlJ*`v`24(h*PDmo^?P{I
zZFzhDUVj)q{ku8;LS?;<5SPfuB{i3W7ya3196!nX1kX!Tg})!;Ok`ODb<f5`r0fzA
zKfRabPVuJs<vBk)Zhg~ylUSRZvgzJ}U1g8iikECpm{Yht=Jjny*O*S;n))M*_fpOl
z%5P+9-Bx?#>ORX~b@NS*Gs<j~sFs}MX|Kkk8@?tw>H2p=@&CzlPn~~gFL^BG#MDW_
zOMDtWidOjNyFHNCIKO)tlS=dLB?lD#UERGsYK!L8CHoSL#G}$&gUh)l%bJ}r_4#F#
z`zv?zJeKAR_0Ztt9&5SgIg6V1>|u$%D4r^z>UF8)ja8fZ=joeUg9L@6Jv;8ms<1rp
zZ~S|RJNjMLL#?O{JpWB=?rF+6DT^PKi1Teaefq)C1oI;)@v}~yyEpxa{rkL|RyDp~
zqYmiwt|*gSA@M`~_SW71vhL09{v^;U|9)S^HsgOzXI^|xcKEz!*%_(4C#6}P0bV_C
zTk|ISt8P^}Yk!FQlggsr(kCjv8<^kS{(SJ=Ep79V)g@;N&oK7Sx%l%Dw^Y%mh+QY{
z#DA_lv1Ousag<k<;$D&U^_8Vx)s8i77Ty}PDSDZ}(R0pgW=%X<8Memm@dJ(MwYe*A
z8yj<V7_=A9Q$MPvwfZcp?mJi2Ym1m>asI2jcR}TK#_czs($9v?NnTLkH^ZxAMTO`5
z3vQM!J1;K?bj|&7@Y;p>+`KO;M1-eSZ!$=D{Ap*vf)~FHg8~-E1{Kx{)&4%qVbtM0
zH6g6CXl;W?ZQz%W7t^={H?6Q;_Vvo01v>G)_U)SYp1)PouF0^o-2dR+%-fc2jU3v4
zl7prkO$^`mHN5TB0+w6utC!^$i24P3$JaPA+fLK^(Rl5LfmwP**LTg|JJ&7OHlM}l
z({_<RQhej~kZXc<PxrQLSQqBusPlAXmZjsJB}}W<th)60^WSGx!fFE74Nk=!`M2iw
z@xo~vudme7OuqeFIqvn_&=m?7IkrtXDV?xz-Kyu3Vf)0J%)cDiz4))*JtwEC366PA
ze1ATeD%>vOR7{WEnRkXEJjvCj{MiNR>XVaf)*M~4Q|Zo@A37>pCzS8xHv9KKyTdd6
z?4om-W%J^)P6o<oyS6`+K54dJU~a}$Pp$bnE*H)!JMcxz%Kzk=@#5s;B=z!y`Hht+
zmrgm@*4|sSyu0Q2EBWIOdAlD?Hk|PH&c}LbU8ZTmTTdtl{|w~2vhe(hRnLzlith~l
zr+lP$PiH@CvbpEIq@#YDj#ni`F3)Z@_%=s%+otOtUaDP-wXCK!pLkNR`_5;^hFMwH
z4!mC0B0aa_VY0bIVo|L@8&kx>oz09!3yhv$f0@zP#m6AZykzg!^I?r$q7Q@@W>5WI
zCcB%r$ok#%$kLS!OZDgPj7;1fpe<_t@#Wf+yX+R$PFIwF@jxx^Z%o=U0Rf#{DbK6N
zDpF&^+OJ+ZB%u3~N%X)Wk?O0CoND{0wE69y7PR?As`r_Y-DTIG?AWv~Uqe3Mr{ZEU
z*P#!|-)4%W3C>VF`TTJ}9mD#hJdw*m)#oprI8&f6xz5)zty?|p-VL84E?L|YWu1}_
zvmD!BKcnPm^rkw`)Z(ezBsc$@Cbh6w+{%+p(_^z&+Z(g99eQ)E40C2xSzKe8u;`NS
z8JP;XQ$HJiy)rvF!C?8sBP~a#7-YVg@Ti!#p!nZxey2_Kw+w<z{(ec#s9D0g%fFfN
zk+%7X2o}xTvUgOK_sSfw(5~QF+|#?|z)FUI+AoS3wS`7<Hx}}{YfTGY=&|=o^X2@N
zA&n{<w*LBlU7tPTf$Ew+-X~eU%=~5`_w>QJdfRh$YlPS%*;;4rfBDJHygG9V(@oWP
z=bLuF5cn%S|L#fl^U4)1{12MzSmwW+c#r2rK8vf-n?o53GBVEm{CxC?Wxj%Fcg^WA
zXI0ma4^@7=GOF<8WZ`{!RA5T!51U=nedU~j3llGeURvaB5Ts!+El5aO(r0SR_RMB>
zsnivD-)5daSHFKju;{VF9BmUSpBD2tRK7o*W4P(VzVHL`=iVoNVSn?)F(Op(OTjk7
zw+DWC37k1MnVn^QyU>ic{f&FG?%v|Id?RI5d(my~mFYb<Gg872?q&Cnj!HJWd2O9r
z`gtqkX--?(p8gg1H}SrG%H`1b2%Fa*R_9${blUG(|FN3w*|)g-_U5QpJ|gEne|(l@
z-u2S_iIk=U#}Nw+S<m|{mmfQ<O0x)&Xzu&9T|>{%WY&!(|Knt?MC!C}f3Z@Cb8pfy
z#@`27g^!*+W20%a#p2n|N8WEzpRm=nR4mb!Iu`u-$&Lb3eckC{eg8zuSFDI&&#d_W
zfQRLvz;TW&=blZU4^C%%d;Y=BFpj_i>)0E~C!gI7kPTcemVY|X^x&7uOi#nZ+K+`b
zY9y?yVwXLdy(cF2KZ|_Ns@r|5Is0e$ozGOCurSiqwIU{I>r~SNH<EQ{T{W8~ERh|h
z<vyicy{dnrT$&Xdvpw6JYqwU-DzeG)oH@C6X5x=&Pqv?2IPLaxk-3@T(XDI~nP2VR
zUjO^!S)R%MH3vfEbf$h(?hXh@->u`{VQ=>#s_4*{KYKLJKjnDtb-*q{*}zdkS+zMP
zcWL0}O$k#>4s`CVs#krz@1wz1L7PYOt(u-c(}+FS|7z3PFr_xp;2H*I={5KL8BfpV
zwb-kpReNe<_DqRA2amqq*i&1XWOO{+?EfdD8PO>Zr8OL$ZT2;MrvG|d#K)Bmc2d28
zg8Ls9Yd#hz7dmv3$-ni(@s;dp>~7aiD$A^ny&lF`clfJV?2i{sW&!I~Ju%oO7`-`q
z+p^8?u1l}ID9$JH`S+ov{jUC(7h1c8tQL+=iF>-yYfJeY);N20r=?R8PCl)ibyeHv
zcGr|UilyBifv5gx#xXL*oS*4qrE6&F@agAA9`8?$48GA1%Csjr$@=>J2x-^6+7*9P
z_Q;d3KVH7+7BMSf|FQI&^1kbfZ|=JNt0cMm+|rd>H|>&Kx$WL3=A+8H#F|eRnOt2s
zf1^`ya)+mV{pp;|E=#TbUL9MrV?(K0_PgVEPON^hs&xivQblv8j+>|GylFd4bT&O*
zE$Fb_>57rPh#UjY?+x$29@{PI*K#3R^T%-?&ObU=uLg$SJm|KzVoiZjBy+x8$5q27
zk2;Cy!;uq0;`nE-Ty8cs&E!^VpSh`x*-du=0f7Tt)6dCeui~!V&F%fcil6&p-Wv6&
z_|u2~v~N{0dm3t#Q6crCw><R!#qA0GC9|WOb(N-VSm$#-(O`1?*6M^`clq9m>Yr=m
zzj&KbqfP7=pQ?NQ<*1XP6}z$&oAwC)Jh);fi?2f9+(+yxeb<=N%0)T8dv)&klDa<j
z&Awd^j(P_v%T_1YUQG52F6-e<6kTp<#W-(<B-174zaGaMvV$*NV76fVIp@G6=4}RS
z<q_v!``psBo!q?jO4jn3A)TiWPMWoA`tHZyZpz9k@yceujpx3&`q!18>+UgzF^A-E
z<gQ;8FX$o5SNePQ6RUYep~9~ZZ#Zf5JdImfr+2O1UnTu{9osLwp1068Mq;_nOApg^
zQkJKSJr}p$3Vxgaue_q<&eIcZTPhMFm~PMUtd!KUZE-a!k(pIu?elHMO26u+H}SXf
z8dU$CSZ`bS_Q?L_VmvNiQj;!b&1N`k)qG>ORUiB1`^P?p2)?@TRQ--%{`YFDR~_zg
zzqPZ^|2mN*?V9$z$cVpa+v_zCURS@9Wna_%QtpdY`!w&w^&D62zOC@;;xkRK5pb>A
zI`uGX;Hztw?c};&HuhHdlwOFlJ@ijvMmE2WN{79varn2-oz5jjPfetzXx7%H1}y9G
zDl}eVspXgE9F_X>sEx%(FXv;r(HqKC@3&mZY<j^V6=(Q0@N{~G?TtT9?-~zGem}+0
zgfCm9Pu;O_hg16fXFCHY|C!Qc?yC^{dfB`=yHz#CPQO^0&9Gwb7suY8i{3A75l`86
zt@deRmHkI4?Z}X}zf5ngbnk0@Ipy}BKS!BXcO71DtFFLvW5&lRwrLlR-u~jb>$c?M
z8IP_tmGC&^uvkx<&pQ7%OF;ec)`=%xzJFuB>y`hrEh6<RcQZb56nJp{kHdDC#7yVo
z*WC{=8rZOff7Io?m~dKn%fz4?`)2Z<f5pkS;pg{2wVQvE=UJVy`oD1Ma@*xwOXV00
zKg)7jEZXv{eui$$4!c?W>QcJg4^`f<>9*Jey-i_0+Z?Uc`^Ptk`;3Bg*y`1Lmv>28
zUQ-F!X}RmkM(@5AQqo5rWv$-6<;60AeM)`-dl%hyl>ObNH$ykHeABD2SI4?l4lu=h
zNDhh&RVg%?!(S#HA+U?-{ymYmi&Ol}OZS~V#~ZZDXx;2Dm)={P)Oylh@F*>!=dE(}
zPJc=BDc{qM>}+`O{ZnN|+Tw!#w^uxqqNo1&^t9k<MYG>RbI<JblHN5L?#z2kGatX%
z{3BrR_5-hrCu|nJ5X`<Om*=4SM9xc6>nC0MK0h<g=c#Y*jPGlHesZe)xX3Ov-C5;n
z-Rit~4?i#b<IgS@>Y*BD!f>y_{OzUH6|s+Zot0hiDr`nsz3!1XvAZX;^>P=T*c)Y^
z`Qb=X!TLNIx6)QAm$}yqjUO&NTq7l=er)b`x99BBcUPZYxNgISW65R*R;5>Yrf%<F
zza}SlUUpSV$Uc$BH!fURR42uBW%+!zdAp-UtLKUzQCwb>p)L9Nw&ai8E#*lfPi+^;
z^!VK3l)K|znd`pYU8D2qZJCXwi?*IuDKE&7KDk4wftz2g?7%TUqb*&jvo1K@3tntK
z!*Gg$Qt6iKJyUDaS!_3#wOjY-eyK{CaE5KcubeCGPh~z$>2%wE<AZSI>tEjrd*9wp
zTwU3|Hf-aLH;?l+w08Y8F}TAmx%+0+`mjk~RZCiKM?X^Xj<z~g>aG|5n)j>mP0rxt
zkAe<~{+bnUmZaQ~tG4)c`1R(p(8Tt}+b%g$%B>t*8>64D%m01e_V$vZY2Ucl3r|@4
zc;U>CiBk)A=-pQ0UB0UMpJ@9=nN*{hQPo+0d++f*v&(<2SanOcRz_mp{KH!9RW?5*
z=K03xnf(7Hb?o*P=7WX5)~<b=xVqrOd!d>|H|B}x|83ipJMGG!fN9s??$hplvFzU6
zrnQ?b9>hHqWMIp!RLe=~73ni<DV$pwCSBeBX<3O^l|E}l{)6>*Q&OXy3-)Po?=udM
zJ2qG1!=)VGoAP!$Ltd>3lRY_^XVbf`eCLu|EVK8-T+%NoVfc82MSMkqQ12w>ile*V
zExN>Zx_Qst&8wulb}liFPMyvB?x(cEOO56^&gF?F+sgXQc3k<@y<*eXMm?S@94oRV
zUOI?hmASCK`3ZaPtbOzLM%!=R)Ub*_&(M9Y&d=>G6PC4BGb^>#RrIGcd}oqkKYm~~
ztI4<2iL1DMRU_6t4{Sd!@#g3D^78WMp|+D>%$MhDKfNrA_3l+aJ5xFBi#`k)OP0D?
z?Msz=y(46ewClw!@?qx=H%>fsbcyo1>vA^S3$oA1O;LQyVQ_{0Jo7G>ibof>{`Yjg
zbo<fwW$)}Sp825_(OanI{`S1_$$qQrtS(cZ9Ayb!^X|d6tgTnGF1=J)P$J>i^E-2%
zPjTj>KO*Won2*%$v2HYYZdfvVMq66Mwc{MsM{Zb(1z*m~So!h2-If=x*p@pyVb8zM
zXd)xB?A}J(TIY7fLyzAySDm#G>~p;M>!?Y@{yB>n^yXaq(X7tt@+td))biz*Cw;fM
z!WqK8JnnYG)rH03g8Ld-P52If3a(HSlzeuze^nv3Q+g0{Yo*PP3b}P3tDeg}u3TXA
z=yqwIN<Gu2qcdl<a8}+uXe7To`=3burtZ6$yn9^R%J`2?o*Vvbwb7SvmVt}sap>AS
z+Qy^1u>H+(j!G@H7bhNUvd`V&e#7^#?ysGHT8mT9Cl%dUzs*bQ=H`DY?o!3wm6fk8
z4{)91{#PdW-s#_^YrLsVD~vkp(p&#MJ;k8aWoRxRYFQHf`D10}`r7Zt`IS3QhE0s*
zxixp|24SmLyvMZP%{H}rcq>L=<*i-({8z(dQ$s$QJ*!##HE!CvA8|K#z51B2WBSpL
z^9(+&THvm*<eKH=<BB$M8+$^Ocz4PLbj|$~q^N)Sg7{}6fpQMd3l9~pT*}aUv`44*
zh-pZ0k_}VS)%E^oocz`bzn!=Ejryrcp-csz`g*S|-kq}ET>MTPvo-Hr^+iR^^A%s-
zJYNy@(?z@gr-=F5@KbI-{`D<lzj`WK;=`7^fjJC50_D;F3fHf>wM+K!ev!V-4^PgT
z$?W*yLE6K&ybu3hzw_4fb$QXGi>s85uRU_y{C!Q;u@GgU(wQH>tx|2i=yz@1Gl{=P
zs?MLA=cBd1%&dOvsx|gq8tyyJo<969^Y^yKFOn?p*Vq?jUsegrzkPOvXi4#-6DHfX
zyu4Sk>wMkww|?Fk{43{2S6cm@_^zQqed+yOvkP7HYo`V!%)fFVNx7!dPk-(z<$sZ`
zw_D04>`4pBv(nynad)m%-u?qjAGY@Q-8n7%DN*(R>F*C8O>f`l_Tcc<BC}PwXToR7
zz6qFYrgeAYrDmDbqx1bFl4dWkl#+PF`E>t&vDjSA{|n@K3-2%dA@I$ox4Yhb&f?+#
z>2+tKPOsU2U25H&gJ+&zkLz{hKCe~ocIZm8|ILqYSP%N0-NiY*Z{OTalQ)D_{rvQ%
z?r(vZpV+efd52jh2ziws{rvRiucMJKp2*MhWJ)aZ{&eWZm%X8Og;SY#&)Ch8rp#x1
z<!Ri%F#qD)Yj67OvXn9Q6ymw->T#%i&DG=2EMu*BRL-r-*MGlPpM&S$HJ6@?TdvJm
z_U+?>ysu%FyKjYEI{diw@@w^bcXDop{L|}udQj%zvxD(`-wUGr&fZe~YGO6-B#*7k
z^T>X?*3>tb@~d>_8&AoUT$BAu*5wVKA-}+ue$Aid^VaS^_~h%MKaRmxm8S3b_MNEx
zt+!erTD^2h-Rr+;72i)+|6+gnV+FfgPsNNqA*>}&tsXch{VLP`WhKpa_vN{R%{Iq&
z&fOrrefRUjminvwUrFp=m-Fw6(Z9fxrit$@`<;{jG&uXzvN!PPH`LcwelQRJXl8i4
zFUmebv~GF*C6VKX9ah{g%^q%?@qo44cT&8Sy;DPd&|;xh-Pem(DQ{jhdqtssfA7TF
z?H#)|AJ4k<_e@jX(t7LjSsgt~AMKepXM+b%4A*0p#e1IJZTRG*RduUeEhYQ?`A3i9
zr~eNM4f(alCilU`zu&WO&Aq%|jm0c?JIkG4r5C@fKKP8e=!D3z=@ChXreCao`Li@7
z_Gi7LoPf)er<H6WyFO1jwSHStY3z3E={&D0Z-noC5xFw1`AI>7w9cY;|GC6JZ<TYq
zcU|hv>Zbh(HRm_i&S?4j>*uypD=)eF#-0DnH0}4JXRS2_2Ltp?u5gE*zO}xd;i7nn
zwc_-9C%Cgq{wA)s^=#o1tJZ4I_jx4Ea(q^D?Ai`J_hZvdd3P{zX>K_5YjgZs?_<4<
zCKn|B+1~TXl*-`Ve077o(ub(UXZN$)@LjE*edR^iimTEYXVgS*wQl(%H-mrQ?$?z(
zs}p2r{PvDN_)Bi~fu@5cme*M4TQ=!`an$-+_tfg&-_@d9u7vsjGXEEDtF}XM>&x<|
z^9vgGeW{cCRG#qsc}e)BUwyMCx-aCObjXhT;lK84l@<?nd6|_2^W1yy8o*|8e{O#C
zhaO3vHFXg)UtNBET0o-5V4;7Ozz?IB{_l)8epSo%d;F?y;<UVP66)HY9F@O*G&WkK
zZ?TnUwd@qHtAAeW+Xt*!dE|AXn1-!b)P9E3Y+wJQZNZs&`I~wI8v}!$7z6e#K)H!|
znQ5uTC3*#wb0Z$+f%f36U#@UTK9Aixqls67N5u8^7Ker$UaR%D16cHQ=jQ5dS}}2o
zaN-T-x2E4xb}#nm6iQXktUGe;?njTicfa4gc>ad|b@Bb@*ST=Dw%tr+YZc69%sO{(
zip||aZ~lBq{nWE}a_ZV6Y1udG|8M#{{rPj_Ki_S4>+n2T5wbMo4o9TQ$&)8fF4AjE
z-5}PgFf%QCWyGngZkuHFk4SAv%%0e6=lWPBQhR6e>8HDlrZzpD)G1qK+#}v<a&4vG
zoD)};YMAw8Z!0)0byDaZ@4Wl(p8BkBVLbX-bMfI6aV68>Z=C;DwKVB?-iwdX)3g6~
zCa!X~{^ZZo)9rnh_1M+t*quMGW`1(Ff4<oJ>D~70?zbP)4xHet7xrc1)py;?J}-Nx
zn0xe8?KH1tn`Ql{x*R`g>Yx9U?Luz#k>{L;_jg|QS@!K?{_p!*T>F|&?y2q9zqMj^
z=JI>ZizH+=KA3vbYw5+L!Yb7*lCKmuOFHlE4p<O8)ogPfcZ{Tl@r9K_OC>LBKA34+
z9zVz2wA{mPF<0l5?E&{ar^?nfPm#Xiq55D0r`3+D5qCCz4^{n?^Tgrk+P)==JU(kR
zA6~e}ex3g6P`xi=U$r$qJ8Wb=Y@D|v)-%*md->k?PhKq(|7*Iw$T&Durq*ZYl3(55
z6j`rrl)HYw_Wo2$nF~@a9~iH4aV_cH_i6q!=IbB-TxFk^Jwr{uL-XE-1qCx=j5o7B
zYjk|yowV*%oBE|W*=OxKs!z;0`I+HP<7e^DN8Ww^!Mp5)`-^FzshdUDs%_w%kn)s|
zDOrnsecY+FhaRqKohmA{VA@*qEn6==*fV!SW5D+}211<ESZ4XXx+o;SqS<pz_Q#8s
zn+|Z4JG+$h^KmJ!udR1@*tLJ9p!Ubm{|*;-3*0P<Puf}DUQjBx;|r^uz|T{19l4(T
z;pSW4EZN6&|C5f+-VL|7+WrP#l@N^1(B70Hl{2$+s%!2dr}eqk4>LBj@0pj{ATK0)
zyR30`Z^zDgoWAi7_OYmz?NC0SE8P^tsCsRd=q83N<CCmY0uti=Ur!9Xtob;vxZ|~G
zj={`TeIn9{NnW8c$rg{2<xhI$B{^qKY|xjO==*Y4%AGDLqZsDpjY%!bn0$|%ZC{x+
z;r4qYc`KHQ=QqyIa9Z_B=?}-Ysw;BIDOWF@5XiKPlnpTOX55fl<+SK#IscRi?@p#G
z9q90O^oZj%s%>Gu?I$8<sB`{&$o%E|#de&Y?stn}f2NqD=4}gKNsgY$NppHKOs0IX
zHCUXndydZiBHsMY6Ji!!O_Gj>FQ^<llF=(vdL(q($&#4F$kZ!!OHO>wQtlG0H1~4b
zr5n!rV&X1)v%5<z_8;as{xTuyW!nAOawW63nO9r&M6tbf`cotEIWVW^Ytr-AUTfyP
z>wI<9dc$d*ki*HcN3wW$P89{b(0ku_L~T#LVAF|Z76Lo|uui)8@nBkxr=+y^4Ci9u
z4Nnz6u-b?|P0^^;nA5o4(Qn=Z&3P+VT$;Y^5_@jNj1>*;vInYTeofwAS$9BirSiE6
ziN80yJNU$|sQbM6;*Whh`WNY~S*iJZ;^cDStC`7FkqZjex2&wV7u)%AN^#zV6Jb*u
ze_oe;6Xx+ce&&Uq=jD5@o!L3>kwe;xqdWL7&c7iY<sZDq+W5xQW$((|QhQrHwpCAb
zG+X+#JbGeYq1Y9N+27mkZ;8IYWD&tN`FctG`HjyXEDAmQ&1U@uMN{(v8`Fo3?XtaW
zi8gm{^W8t~+xoEj=e<YFGk46q!1iEbaq6Tknte0xu0AGlw_h;#?atqh9#v(NE;nn>
zlx6w-eZ#w_>g}snZcnnW{-tHzSATfdGr1d!jK5^e?%_^nxH@~sSy}T>XW#CaI{Tpf
zme*Tne2BWRY;XC2Wtsdr%F7@A-GB76Nha^SjYp4n_ZP2vRr1?PNcli<%!gk;c6fw*
zIQQ?#)v%{gt7Ogha(>(#aD?&R6NQyEQi@Y+H*a&@>m0pV^L%k-`-dbiFX12_bDgO#
z*x$SQh;h7Wm^)$m_Li#NDGnL=?;Jn6<v6CzWQq0Rx$9f}W%FZI>)G=+TF*H#p+0~?
zs=sUY(tuq-&UYS_w_Ts6t6%CY>osjs$K#f~hIyy_{C@ig#CYEB`6+QreBY#(Z@2%~
zIPh2H_3YNKm9rKH|8`E*FMYBkyZVdB-G^J(gjCcX^G>N+y*jr3Lk9o9Ui)O5k`pf?
z-tKsJyw&kZUf-P~x<~)<qpsI1<Yb+_mxX~Lhabo0(6ZE`;>`R!y@JZE;ko&b+ywr;
zi#POLV!W>@*~4D3BV_5Sl1riCTWeOdXylv`u-;f+yE}V_iPt~>|8Dh>>DSFR_GT7k
z@+sa+dp<Kgt}M->^?v=|m;DEiTez$%_>kBeb9}bMQ;E7W5fTp*p0J<OjOlvgckKGa
zw)%f<fd*2%FP_TS74&j)rmCr2-uR%exTvT|^M}~dHgC1{tQXu}g;))*Gu1h&TC^yg
zeeox>Nx?#E{uG&XWmm4#Pt~sPJn~fN(UbsFgLAFh9-Pvwzf>N1W__dP49mXF$9Nf|
zChxs4BPNfxe(6&7X6_k3<&&2_|59pL)*xrvw&qF1<KRoWH#Yh0+m~E;OmebL>#UQJ
zTdu#CE@Rzs%D}`hv~`-xr~cp?Ma4J;v+BuDST?4lL`Hr+RCeyV%JrW0qAxfupJM;*
zH`8;%N1NA&ef=_|6&*M7zOvT7SKR#aa{Bz9Ba!E`=LM9c$b}hkiv$V0%8C?vJ@0n;
zURObeiLVQ7_pmJ#kt|K##<!sBgZP&8z%?flvwtLcdBz<sNt$ynanhA@u2Jb(HD%kx
z7V4io?0D$MR{bYmXCAekyu-26=E!EHGvy%?&8BG{fsYkg@Aj9>nsbZg)Qm@#6Mk6s
zt1b(9nU$}xEmGnA%qv;quUA|z*1u!7L-?~%sqOpDnwPuI8znDwubQ`6JgJD|sogH!
zufadgrf4UbE#-1Neo|_o-&+3N8hpwgntPv#To$-|+0DCKY}PvQd!g$T9aE?75H0+(
zNW0SebMK?<pXKe_Hf%ops!vGSQEvKo?c|Ln<qN`o^Pbfe70o=`{@69NVc%=n(?^dj
zeQ{_05A}b&9hLd7ZMU2YDiShbn&J0w&&(;zYdG)ZKR@{B;C}U}y>DxFe0WeTVfVw4
z`>NVs&hjr_cbG$3&nt@x929ohEOPhzx}7b{Y-LwFq`lj-D>p1Yw9ZHA>&obsh5zsU
z_-66PjCIRmCZ*P|AEmUk7lyHZ{+O^MV|n>+pA-9*Io#8k$b04CfA6f_8h+iHZND;0
zGz}c@7;W;r?t4SdA$Zc$PP62RnS1vAHp}GUo%q=D&5PdpZPkm<Zk-$PbZ>c7h<#3v
zbI9~3>f#?P(>r4$e?3dj+m&+F_$9;Hg|+NYuKfM)q}jLS(9D+`zn1ORRCuvd>X);9
z#9A+5YvzvZh(JS8p^EQ(VZsYiJNIoVu=iwkwGzCow1#Q*g+`Gp6PfD22rV%`#Azkr
zdt&SKiqBbRuSb75zx%IQ)86}y|DB~@_ICa0C`b^y;h3>bJT(0BmxFtjExN^7xmw}u
z%G0;_vR{2E+^;8IJSS?q%V*(V2Ai#&3d?WFIz;E*3gldq#hkWWD`&>n4LQu3yEVf$
zCxtIio1eh_=G2#(dCSAo%r`&N`qTDFPX1cbaqSxKg{(J9@1E-2eDi{|`lT8A*4IuS
z6a4mcr*e4ZtiW2Ihv{x}H!E(kezj>%->VIrGt;)VykGW!ZC&ZKf9+E$+S|2{{a#z}
zvUI-UsjHGncQ((h%ly6P`r3`(6V!@rEH3U<*)xTA=Z`tTxtH<+<lUbYUYK~YXwI|D
z`CQGrr3{u%^QoVGYqG<_caoFlb$+ycX!qxN!j{Ru4}R6m)!h6w=u83kLs_4~ZofV8
zU3M?o%sK9bze{Z~UDFiu=eBXs^LW%!uT7)VuaJ>}A&VKaJ)WDGor=6Azjl&g_F)5o
z*7E;d%{-BBCZuIAboR7nk&^OgbJBF0cz#=lE~h8o+5PWtZWKB_rRu_mkM~}_oR_}g
z{@%K@_dyGaX5<!y#EA*L72YGEr*$T*JJqOptC_g==~IWZetzI+=SuAM(?0RBXR8_S
z&jZT&LPGLdFCDJjxwvxb^B~I)Pb`YmSw+?g#bq7MeyP7ep!m$e><w#~*6Arsb<fth
z<hgl^szsWl?@QiYaVnh2d)7%dr~mM3*!Q#QwEvH9&5OR?I(M1#4tH*W6YDHJKNs`w
zzm@79Y;%!U=2FtCO7_te-|_g`UG|v0@_$qH4$NA;>8a|bw%G?<oS7r~T0>sUxZcxa
z&K#=b_eQI;!hebK{f)ZJTdxGx9&>!ZJK)TBORLA_lSIPIHwf&?T;Y9FBG>jvwWlK2
zyhHOp21)F1ahW{hpcoUM_~U>pPhM%um@Iy$d~?NO$Cu8c6W@geaDA*7h`Af)6Ce8K
z^?chIZnb^6hxMA@&o5Qqj~Z1ysX0-7JPZs`#taNnXd4Q^QI(vZn+vX=u13Y@-*ywK
zzrH-;2>+CTNZ-q^MX%1~wwN?$Rq2}pL42GtjZ0Td-DBwb$>Y?<#235opLsLsj_UMD
zbF5hX_|3L{E>BOdGgc`*qV~Q`zVCeN`NLD>`^9a}90~fc<h)<<`TY-%udmXNcFz$w
z%HJ7rH|5RM)ADtRm!;3$`((m(v+4dvg|6!g$Bo{tjb587w07oeJ@cDt57(VOV%0aP
zr!r9@HBN1jL8#5%ds3k+N%KBWICXLF`Q#_3cPjmw_RMGcm#_T)CR{E)WYrN?r2B1?
zwC`K%AGd<8-*nbFB>FkXEO+aXNxs#W``^30d$9fDgZ__4XV-Nfbk}_LaIVLq3E!3-
zaeq4LoaUh(^}<6B-{0}BJm<UW{hlRPx%L!n{TOy9w%X7-v0vrQ55M`A%*$8rJ8D?_
z|HHzFn>sd8RrWS#uP^$UF0{Mm?{A0r$%l4CoobKUb?oZplhNOq{)totU$WZyags&+
z?>BcRuD$<pe^m4#H6i^YPmN1gYP=NRc&4D%N&N1$ZC7Vi|I_6cf7jJ+^Kp}gp}BO|
z2jj>c3%HlQxYsWx6K;Q@HEOT7;@P-IpXyz9ePl8_X~r$MQ9jN{=|#?Zog8}ur58E&
zQ8(fYL3HGee+N4jZ2p^*_`6fkG5z<^L*M+h6z9I3n#*l(taRc8o4_rHB{N^I-y8i-
z?}t(AfjDo`=IzVtd+xk^`t;|6?Uz5cR-4($KYgY8_U_fE?-w7uA{)<h?mj>FquUps
zd}8WY{Q30dg^J5Ggu_qq-;0m!)m!%N^~a+xuez68?7MZ?VrNagsYIk?`{K`+`xh^?
zwy?FIe`UpslNlL$^LzE%-d%nA^h#~H)!(yAJU3777hV#+h0$0;#($Za;8FYRtqL=I
z+CrBI-29n#we3(l^Tn*YFE>1nziHFO#3{fabMDSw@4qU=GdLtUzWmX6$gTfbV13Yu
zI=#rwSj{%$%|+kBY?$Y8nB8felx_XFmqV-}MCQ%BIR@=5bA#@Faxgu0m~YpQ7i+}1
zm!F<fx~*W_(tOeX%TBh5n=owg6%tE{dhWRD?VAqX#TQQAa8kK*zKNaTTF4rwX|79y
zb{zY#>8taf19^Ka>NJjY9%TK`-`msUvOIv{nFYgI57!xKaW6iXE!^b&{OZcQWec`P
z)iFHE`5-n&dzRnrH;%G9uS!Vp{<~h`l&%!8@PJHFtYFuf(%YK+(_*)|C~cjm*VbgT
z#$WH^_n!61Kc@!0R^r;aVo{r%R>Ot|_LC=MGbhzWCOdqc)EBOM_GHWP&Z0>=%OfwX
zKbG<G&+myQJN4e)EPbf;<=TaF+iSl??AZQy`kFbD-47c^xUGJwRd@T}s}oVh(;K%p
zZ9U=YlC6Gkx}BBdIiKq18_Ia&(=Tbxu{mUIlhn_s{(14&TioJ}9F|;(+U@tG8AYdV
z%vc$AdD<PmgHL+){g|!NnBTWXdET$M9z~na3JX&M+t&rHT<>(tu#vT;PfFE8>Wq_B
z(qq-r2^LPt7G^&#Bs~<7IAizValLuqvE4@=)D#ui`YqaN-o9(1aP#tGTxWX}A~)2(
z-P7=?_TioxGtIj9*0Rt3{pDolO^!nmTXW`3W8PG*^!3YIB{l~Q&L;7vv7%917M$u`
z@jgtJhw)W##Np+sn%DRIJSE3F=al^n!2?yjM#j6BDY?Fh^2si()p{=EHK#?0JuHEp
zk^lCDr~5Zew^Y6=74TKAr6Qa!Aa0Y_>|KFt!#@4w=KktnqnnnQAr^G&rN@yq%&XV!
z^A=rgEOjjL^0mZ(``@<~|6%jHeX4wI_H0R8sdWp!aoTBEu*hqPT)r3ZLu6u}Vb%Gx
zSh3G3x(oF0YBHP?zAxuyF=5|6Ex{Cau?Meo>t7gkXbZXeGdx)O)=#&yu{$YQ^7*Tk
zUE7WK>c=q^e_r+0r()VcR+pY@&jUAPH1FcO(%m$@L|D1ygKNL9h5CfZ)6rW__@DH&
z?_5yN*m6v1f%V3iW$Q~rc2^$jyZL+dXS>}eH(9)`|8Ki;nI-F_oWHiFM<17Nxxuoh
zeDd06Wuvk+lGaDq<{YmOb!!p7$(!SI?{}ojUyi&GXWp)mj;$@Nk6&yuOJ)AT@#2Kz
zlhnC>#u_?vA3s!PDXsp*u_-z|j8UY!D(gXMuY>arC!L*p3NGlM;bjqyu&^%XD`70X
za(Ba{S?WP?JL~hTgC!Jib{~JsozwGW|19ka<(`!fPi|~G`6;PIz>i-eTR;1;O4seT
zBEb&g!IBdev8A}@R9WtMbNX;}p40qGZ@M{{%$`r+ndAD|gzJIZOjiMyQ<v;hMH4Ll
zpUhK~4SVrSsq@hc{gjvY3;tizy?N`$ag9sMrx*o^H3dj5db{EM4cns+_N_Eax4N)U
z<;%~&8F@lq?oamC+F<Y^h2K_K=R{;}(T79r+g><IsY>2)Pd9)2+wUcV#%h%-bqWIa
z+1U1(vecyhyzXVMFBh1<=GF;2zP|~ZGvsc3To`D%!Cx+j;iK376+SOC7)}0!%N|&2
z;rrmzCvCTa!`Y^#i`VM1bY-f^@y<3$&%S+Z_7ro^EuGTleauYLI<MJOFMoJ=&C6ph
zTN7s8I%soN+#u}1SxLcyw#$7!_jDhe;XgC=;r=O8BM+UQpd(tc%J6JD%RY_1rBlRT
z&Yr{d=+h1#)}P8dcHOsReap9M-tvoTAD{ZP?@YXwwa}@svF&xFyD#?-%cS&2^SS~~
zG>4R*n()|WZBBsEl#ZqI_p`;aZOdSs(DP#Pmqm6?)AxEGSa~?JoS{qX%)up#j!P`M
z7x5+JoU(5CtHg8mUvC;tUwLox`w2Uy<(=IU82n#Caq+9`hp#SMtW{ESs_WgGyjM=M
zRv&+;P(An0i;brk?wk@bKi$#5|FUll_g70p2ieUVzgr3=?q0K?FHCf)P-r>3M&O(>
z)1&XoRysBqWF6o*v&M0A*zVA?l6U+swS=rLGS$~LJSnsK-kt(oIce2=(J<B3=6e^d
z`Ets<nDO`45T-&F_0_@q5}m*7xzf8h<j(fOh)V&LT+WQ==kZQToFw3V{`|LtAqS^3
zPhF_$TO<B}vt&Y-)-GPrBHM_MGuaq-TTCqTejE|Wo))vUY_hMwjxs@&Sd)&xsqBqQ
ztM632j1XF%P?edX;C08<XCu4S(<<-aKPQ$xish|PI20{D`O2lq4M!#yuQd)WS8hFO
z^KrxUH?P*7sGMgUb=ZH`w{ICwvhpq*P2&rml7Dv92an*D%hq`LDSCe0wM)C=a1g(y
zZ2<eXi|rR5{QdIf>(3J_BXvHid)=|<e0L=2`wl_X_afoW*B%sK^77YrGx~e8snI^l
z?)jdTYgbPfJ2fpNqrL9Sm9mgW9se@luzr`?7i#6SaOFbPClQCsA}%?4x(ChPCsg<C
zg|@`^%q8lPTl-y=jiO9N47U0^AG~p4I;VS?RZ#9?uatatQ^U9GWp*rF`S1dF#|`lb
zO@-~Vn0|h<$Yne&dry-2W@1*kPg<yt&5g@WOOh8Pxf(k@R$S=fwz|2abIrGnD;$rp
zg|C@W`C`WMZj%)4g^wQX(_T2SeYWY@_P0WRa`=5NY+YLHcH;-fquZ}8_d2UtI%b`@
z$ot`+v5(Ptv)zC1`@~9~T{AUKjr}IG)XYhFZ<4y=z8S9ksXZ&=X4JgJb8Y;&Z{9a6
zOWVoiS3K`@f^GgH{zV0vVY6H0?%GE0ve$i{6qz%1NwDgU{|i0z?#(E*be>t}^*#K_
z+?w~_uJc)aU;cB+)cW&fSA+%EF@@%QDowamaLre}>%G`no`CbW<hOrSFUb4%BJTY3
zM~r(zxuhfBHtw(da_mC!p$B&=PffOdH^rUfd)klH{8P6UxO#f%zddzd-sH_YsecPx
zALxo!751#xcv;&L5_RWf>CC^Ztt;j3b3WEta_@b(Q^@(NO=Z2|+c-ij6;^(XKKop0
z$*GUddrZ$SS|{~*wVy+#Y2NnPCRy!aJsjI!ZZ&Di->}$vo{E9-j#t|kwz^K_v^l>w
zzwN{2KV>U4f~z!EO_5?(s^6rt?l+U#1c7I>g_nOy5&YKZ^Xp;I!YlE2XXfjFS-SLd
zMRz{a_P&~vJU6p6PRE<Pp7eA#ziq;+k5$gw>~!-g@4Y*D^Uv|*AoJhnW-SUmF1r0?
zjcM%ssxx8sMRS*}%wp4ac4eDx&v+%oep<!l^QpVE=KucEJTq_JvD%+K3Ds-W|LYuo
zw7==lYK2+Vj&TAL=7=TaN2~9OIp&huy~8Q}tp0*TF0sQ7+fI2I<i63->TI~F(cfk6
ztDJPMfcMkpy}v`;uc*`uta-A#s%YVgDb^e32At0d=qy=PXr<yNT0HHpTt;!YZdAh(
zp7Yn8Pu=s7EW7BJ_$d0=D}mMij_dNLdoEqNUs1=p=WSOT=elVTCI{a9yZe0B|F*s6
zvsS(NQ;*t<*;*~RE`ytaVU;G14rgjbYI12wevw{5<=v?0{M#o)>%Om_v4(rXof9sz
zYBj=IxmdPcX4&1@yS4e<p|DOv%Pq^7S;U+>vFX*X{om&pFR^eA>YBUccYu<3=N!vo
zz56?Ze!qG1<;C^p`Kel7x_tN27nvAMUo>x%xu}2sk%O;)T)k&!9ddQowCm<=d+WYF
zm%sV5H$lE7O!f4Uxf&r`8*0yR?7MOMboSN+&q?}cH;H*3da@{JYvLZAsSn*&1-*Z3
z`u)qNRjWd^wxq>uHr{>p&XuP0O?&dn=UwhC>yHfo!E<f?_U&00>w<P!+V|bQ+wBy)
z{kzzSBE|K$(w8s#$KZ4-$mhn&RW36#<{f@+9hjY9;(2w^Bhxz*tRhbu1#91(#I$dH
z_Pz_cD`n)=AKmNN^~Cj(&D;(Bt8Dg7zr}F+_}Rn3zj>xi*!=m&pY4|)KlyO?<3s=V
z_Wx>k9e=P$SSv3t#_!?lxbG%?u9fQ9p_A^-Ha&h<w>&leh1;XU(yVUf;@@1Q40^IV
z??=5zO}xSLGd`?!$AqOb4@{rT_4af(ckZj75033oo}jd4QuM~Mj02N8|Eu;TFSvB4
zK6-V1_a~nj-1)qM^WMK*%E~SxTlZl5qaSfgyccJ!K3mJAZOdok&3N4BDT7g>_~b>&
z-=6uM^w}(3*Z#n$EA!y%FKtg(rCl;<5mVUGGI{321tDtQN{fFkDrJkjw{nVs++{H<
zQ%~`Nb5nJe^WD>vx%=gd&HUz|T~ieuJOn1VTv6|`xa&4m<a3JGHKpJSpC|eR9?d`X
z^@yq2q^gQ75+_{v`1HIpC#hUnbVB`1<Kro;d_v8==DurH9T%TGWMuMnBge5Rtb#j&
zRyBOS_sOaI#4JI58?Cq#MwuFiCOw<H|H#+gnWty%Kl6}fn&tgJscV0#oeQ@S`xasJ
z;%8XrhOX<cH=K9TzH#QC_|Gqu8y{sGFt680$eP@_%WeOP>9&5Wr2g>q1$kf2TE5@m
z$tOEUkL)c^&kIy?aBTRKbT9bQ-j$Vy&DXC#el6e3VacZu#*Y&cuFPaxAJxFHbUU|G
zo&AiqePZg&tKIBEd+vYix~^)G_QLj{w!`zhhYWSTcDyqd$A+&u;ne@}N0da6zl7^#
zMZ=ZbbB+ox;^ba8O}es8J66)Iv$?G<{!~<o;}hF&rPj(<-(AtUCAl<1@kN5JpQy|M
z-u}>36BkEEqx&C|G=&aSNJLDw4k+BwSfQZs$y?Vuw_;}32HUJdTnz48Wb+Sr?=EYQ
z=AZ6-@pnLqK4aa%gBKsRo7>B(FW)b-zxIE2(XVHJ?!I|w=&(JuK$xwb_ffrOWLvZF
zqKtb-R~Ej%BfG)vuz>ZC+iKR9iDoZc-zTWNFI9TKdGe-+-6xN#DV|Z@xn}FaD@<F1
zj-4p`vf$)4-(3qAycJ+kG!)wHC~)On#D&wH8|P2b`_)*mZ*_{~=QBPry6X?yY$%El
zot(g5d#PW-RO4()#NNb=6IVCAv2H$U^}6Wlvy~bt=jN&N%5}2yHea1?EN{)j?a=1G
z{o{h?n>`oRnRaWeN!`3W>`sto^HbX^%VQPvk858~T%uaIcg{6y`9sPRS=qT}8T_$S
zQiwgrczfD>&d06`!#t~nGna3@RCP_C<<@FnT_gW1xzaq2KfYWG;%OIhXI9#4;<}~H
z{oz!t1)+LJ&4hgKNZj>4*0MkGgP3DJqtVw%Cnnsy`|{N8PYN|3Tq=5+7Opwp@-&CV
z$bWg~n;xOBKV&ZKZpu5q-}=j@{6!@vCMSOQsM66^bu0ZsMuN1%iDU`yg{()JnD0*c
z#atPCs)ko_rt~(UgR(AfnSNjS%3&z|Uh&<{vZhDB)&6b$do=uJX7vTW`Hf9$#iT=2
zDtMK@#=XB-9DLqb^7W=YuRojZFZaE!;B3C~&gqN6=9NJLxv>*+MEaK6v4qLVoIEyd
z6RSk^jU2s&<~4!#dH#j7e=m#s?Y^X&N94UL(~1S+GBZDlg$bugH{~@6K6*Ai!dZ69
z)mJvVDokr_zn3+w2+f)48LD=pTe8};L}figxooFxLk5rcqY&NhHG6n?R!^T0?6bi-
zj5Sv9_$(zpi9WYK1wO%#>_n#~<{x}-ujTwl=6dPvcm2hG`PVGDBJ@05`{IsR|F)pD
z4WCaRcowi?%Yve`_Yanx+9YnxQZ>uKnx&DgR?$={(}$;)cbe?=Dz&xe@-0~AXF0nj
zS8OWl*#6;~JEPZ~-W|UZ@_#n0ve}`de|qwyTCJyl9Tgj;_qJWw(O{gv;8%maR(lJh
z>WLud9lM)?%-5=#D4F>={dQ01EGn!E?Xb9!XKGQrTgaUMlI!K3=Dj&{cwZ~1?ElIC
z_qTJ&%KiCw80=cbr$^e<OR_#OoA~-W@5;5N$;JC(#p17LMYgWD=92sTQ}0Zp;DHX|
zO-f6eMW-B2v5~QL?9_j!JyGhyeX$#?xrezYc0XH^k=^?!#QX8I<;<;#Ypw`*USK%M
zRI{&h+PRd(S8Z-@8gBjQe|q!8lBCyFT$}d^89uNu?pfO<H?z#*eoWEh!;|l}Z0C(}
zdv7hg{_KTKfwvN}n%JhgPD>HmQsm`pEV6rE)2yFS=DW6>JTbeoOy~IqS@&R*Uo5*@
zKiE!tkslzi=*N#cg448A(<|FqoNK@KNWO`8{$u2D@|x$#Bk#(Vbno=jTKd%1&P7ex
z-`6#f_v(rd^^5gxi~7&Cn2>ALaB&GIr(k43n}$}aY`Wo7U!I-{H@2Gd5AOZGocxRH
zPyW7Tt8>_5TBNrrKdNZsTHyHk<VDWi7JuLVxqI^XllJ{*mg}qzbzPMB{=zw}xzFy-
zyZ+@j%VGZc=g!>}HTxToUv$}bMy3J7#JP``%nIEk#5Z@f)6(rCTwCI}WG|nIF3@c~
z_F>bp-kG;pUQT7{v(Q-m$kbd<@%N|JS0P7&jWv&7F4+^=mbUF*#!r6t7}@n#d7os=
zO6C*xN?g7!qvb|W=f{*iwm}=sEV<_Qh5tIdjB&m1%r@zTH;-tki_A#<s?)#}cU7q)
zsb^6r$I7+$Id_~{+Is0k<nus_MXI^2FXRrLiJ59Kk6ol9chB0tQTg-#HbvztIIL>C
z;`v|M#DPg*e@m^6Xi4<%%Fgvdzj=(d%s1v)=hwmfVMg|BwL&58X^l2N{e3z<exF`A
z+2HKn&PAsU_EeO9P=0dabVe7qUib&WX@6ISA9spYF`jrKThMBG>LGdG$6qZqR1}(-
z*#iy>KWvbm&)msY{`Ok#0txF)%TG(Z($X;d@XX`jliN?1+7^~v4b$DGbZpTXlU+I?
zg@TJp9NN^9AD8T#viajYY5nzQ6#v<<znV0?g(L3Egm+RqN;SXl+!*?*Lw?<kFLPF$
zjQX<Xb)uT@%1wd=CWe3IQ<iN0ym+$z^ZPpLTXk|iUtZq+dhWui7n9=!7ac$JSt4a#
zo5X&PZ3#bXHIK@(Ok1}t>dvA4iu<&*d*?0GY%n-iCRFMjzgXX0qQjS=`P+p<s~b;Q
z^m(lGoM*~><0I#jcat(By;>ynCk3t1C^kJD^Nsbvn&4CM$2Q)3HuJ5}hs5TN^Q>jj
zpUtHWWNP!Ande(AJyv+=*IC8~u6nB;^*46^&to`u?9utM=?@R{IoP<}(6!5ns9X|N
z@T$X8*(=6HD5qZW;0?y#?;P#w#4Bt~dQ+<3-p&yB?T#^j{Z(Sgyx9DxThqHA$G+Sa
zIH`Ee^~G=OYUeb|rfk3Pnr+&KPti)Lmlvl8J&sxW*Y@}a(Pt8~cKH=W9JwtP^75N%
zagY7NLgB*8k+;ORKh`g~+g!tD-^^3ALUz@W?D>0_nlCqDUS`O*_y4RMwVe(tD*I1y
zTL+~6+~l)2eAyQEB{!@ZxBbbxc6+|w);ZgX8}BMG)fGtd-u5z6vcJ2l!L+#jTb}Nh
zkn4d3_ZluUNS_pB5D>ilZ{NZ7*0(yH+?R14lT|!$m(Oa)p4)eL|Ge>e*y-}e(#8E8
zZ>DrmAG>X1in;gqmEY=R7S1nh*u7Ty_MWvKLBA#jyPy00_OgZJcXQAGtf(#Y`cmmF
zr+66{nvF0g!ol+lX_+~xi3OQ@1(j!|vhyGB__({Cb)%-j&gU8O^KUU&DopoXxASza
z*z7Gg4waT}ak+Wt#H3a3Lgf?x-<zqZ87TBNr8s;GTbXjF@!^MiET1s${`ceG=Z8ys
zT*5jJcSodb^;x3Pf5Y?O;;j}n;(KPwY`DDV#<ZfX>u&Bg&;NfW?^@GerByb`8+Qn2
z#^o^dUv0`)o4n+Vxem|dWqDqLZ9aKjd)7#v-?Zo1)-#*E4zmRAyUD=GTkwl}zi2xD
zL=AzAW%uecQl#de4teqYvW@qXRhpd_T#~Qdc1qJerd_sJlfCVQ+S%||(Fb3bYE4gj
zpu9)wkAA58YLUq&zn)#*-T&}>dj0;i<2mnKrDxojZMa^<b=T2$)&9KKliU}5|CD^P
z+q7<{a4PGY%I=dYUX`Jm*9t||<@Nj2c<MHKIJg;2E|vH-)nl?`^rN7|5lt^9?p(=q
zM81#xt-*&YcHbQ<6c4MeZ)uZSus1Dk!L+7+2Jia!_o`}@mi`D=UUh5P#l_qf3;}tZ
z)?TU_{|cIy87yKxbj#h<b92ATpVrWOQzowHyWv})xw`7!_7+yH)Q5+<a~?}9_|9|O
zb&<wreWg{-Yi$}nu${SkN{7!oB8$u5VVgL^=dG*<=Zinxc;mqSE7n04i3d+}Szf-M
z&RkKlQBkK(`cUo`#!%-6WeW~h%-N#0O{nz7WX+qmrpVUqciuMl;#8(T=EW<Hy6)Al
z{H{{V`)2kE|F!n_9enSGgvRd5<TJ1;5@irwxb1u2g?1ZZck5cE8+Q)<xATza*>AN^
zQ<}r~5o4I-v+ZB3=59IhL?c=I;*)^spYL(}+gFv5Zjd55Sv0thA>r`;C#p7ko8L>%
zy!d(c@#8n`qEa&UGtWIIP%cotyZ=T~#*(#D4zYC13P?PzAe`T%zgOb2BJ201Yg{9`
z+i$tgP{=cLeJXsQhw=V`6_3k<F9fj(wYn6(F)c0np`L$hrqitAl3Wgt-ESP!cs^ZM
z*uuK$ko`W<)hB=LSaU>S{?B{uGG{hv9azM=xF=-2slei`&UqhnZfh3LcsFCmhBH;7
zkDBBX7KqHS=RWYo`~CbcUk!ddw)gO<XK-RuKk2RJ$fJBMJJ714y>#1V7U?+m?07cG
z`yGsPjxLhn)$u-<ukL(P@kcRB>AA!}!_~zTyv3}KxOmlWXiaTd<g_?S#VJ{1rQ?6Q
zbGEDpn9Dd<sm(fKtN2cVS<qE1@l5u+%Lle3|7n<e=c$p}?t_<<^SVOZ_JrAlS^r#g
zhp}Fm@gei!jf!i2HYKgPb1hrpr_j80g%eC8gByPcwEe6(>i9K-`Gi)D+CQC>vKzi9
z-CPrK?}}^i_W8+wBo^uJ<nC;^RKLh;R%7<Jg5A>{^zYBNQYg1DT>Ftz-R#JQE6prI
z?Gsr(_g+#H+h@wS{*co8C(ZV6*Ur17ar3bM^>F!Pan3Sl_SSS-F8L%@%iQ+J&*7qm
z_RLUI_TFDb$C4zk28++=TI6!oGj$z<*xK!VT791U=Xs6uU+UCk9^H|sx#+at7Ga&K
z_n5C28?2YKnV)jIRhey8>X*;Px*RKe9&C8Bt!?)luhy1zyoDL-9L0<Mdn;oXZFqf;
zQHM8i>fM#X=4!b!0?c@Sc^tT}<sq4n)U$c%n%xXMbDHkxaB*oSh_49ScG6p6M$wIw
zHI-?J5|3n*M4lZvrL<A(Pu}SR+>w13uUJ$c_{Ze$!R)r{JdYPAcjRg#wNoO?U9K)M
zb(Jj13<wl{c#Z4k<Sp^t6<LA}J8ri6BwbsRnPeHq6tj#qqGuD=8I}+FEJaVtmRsIo
zF&B7oMCQA?@vWsie->&fuho)yqrn!i>!;iH00owNTiz?44m+;rvNS_H&U|5IQ_5m_
zL+j6~9-CJxzA%{BbVK)Yb?$>QgQR&43+hS)w;X;{v_Z4j=mkgfxk}v~b?2@uUAxFE
zTm9|JFwLu1{zRy^tTxK$nx2-vChn^Ls+jOkOFl~$?>o6Bj^|CH>ZX5T-rXsG0*~>(
zdhAi9dF`6&{`SO#E8A4oI6m**Cv*G2UEN!5I}a4(2^<&YeG#?keSf4@LVDs^+f;{X
zO#SXld(Kp?Ir}uphr2$a?!+3wb)9T1BGWhh3QS>ATJ2D6|2!dy&#X6NKXd2A{X7{f
zC0^<->lW0KT02`|)l*iMz`_nS@!fAq+V-3ixRAQURKM`)@7#hPHziBcrU~~pMNd)n
zI;2&7=En8oFAr?yQ}~u(=&;kqcV%*jp?pYagT9l+tLRy5+@d#bED(N{Dd5$(<G{oZ
z4FyW_K3AA0RCYHTEe~8j`Cr5jXE~FD*WVmenCNbk!B_Pp`9{)7AN7x|&YPJZW$*`>
zT&c@X&^f9-Rb4nT%yi1!pSmyNY(o-68+N45>@g4wiZWfPB~~sP{n^@3LA=}JSeAW*
z=G5t`_rtbm9q~;q<Gv{o^o2_}r><Ysq-Bd~%5j&DD|$;s_iD8t63G?5l+Nbj$ivFM
zcxQaGd+z79iYfo!{b&xEoqoXNic`;|OAQJVQri?R7A%NsFm>M}bhSt5hwYL%QB8&q
z4;640@;!CB_CZA0Qtc~O8K3F0?+e_;u8Uq;b!?ey^2!*iwp$;rw|TLIJzIBg<4dkN
zbEns|`rh8Vu;AU)O0J_4)^=@4@-si)*?9QTw4{S~yiIDSCpLz)9Z57*)n9tUno;-X
z_6zqH&9=?wy!Y_wb$5M+%0p^5-uu4jS(RKkbwlR9^QUj;&;0ynW^v!uGp93j-yiuO
zahdu2j-6HYuBt!RZ`5GPd!!Wbas8?84RvRa*seXa>Q*x&@2}h+WttaeDrp?rc*pFj
z=}(P-2ZcI@6JEZ$?&_RZ(9bt<#nV*oe$$-S8?-Z&8v-)BZC~Aa$gdK6y2X7}t$X3`
zg{O5QmN@m^;@;)v$kuyhgGBkwlFm<Y(+&j3<!!vW+W5A_v{!!8A<ymDHOlfC7Cdda
z*Xhq*aB0a)cJ@P|-{QiyTVK4kXIDVv!{EtEpA5cR7ML7y_d4PJx8yNH_{4vc(pR^w
zulmF59FvvMaQpK4`Ez-c&!vi&%wV70t-tfkAG1q7=~sdUnKpl!duBFQwwKk5sAZKU
z+?>hXYMl`&2dB)uV?0;8U+RogUd!bT_tVvUoVLZhkWDH0_Vdk`_2%mKG4pnY^3D6M
zEOsj8BJ<&zH@`~)p9PeMEAd@4xxMHvo8#sFFx%VLd%bK=_8F8M@Y@h+y7+3-?8{2&
zTDq%sco-M2l+sez)iQ@mWJ<HtviKFc(p|MXPPUyjxY8UEwYfTSz2fJhJ5$*Ya#XtC
zGhH40yE`;LclmjqZL&X?A5#Cf=;}L%7W)+sg=S7<JYOmj6hCEgS>lO;><8sX6_i#@
zH!+IJU7xpPOR<k}<az$sW$qo{rakYl^1JnML0U_Hz?p}8R{Y^|lGWgUtt+afnYm--
zEZIjl7VYi~ogDD=`LxWxq1_ohzbvi=wQ*YWo(*$f>$<lr&gjOZ^%=L{u6QBbeW%Yi
zHCyCH=9jOpXG~$We(x#SZ=adHQ~qd&z(MPIb1c-7&%I69q#%6#iOlWpCHiarKT7%-
z@$P5#+rqEAb<1Te_gkAiGrZ*(xP9hU*NwMqQ!FpfJGo*#V>Ay}^DXf!+Y^75%uRmQ
z@TueBv}wPl&wU*dp;stoKHGPG&#Kk$TrJlu+3<7X6W*4vxm~w<Sby(c#C~Vy8H-8Z
zT=pc33)@fl{lG=3S)=d6zTM1Q7O&{l{L;(v-(_{0`}$|Be<ia!Go(IT&pEY!sebaw
zLYLGVg*U{lzDd08dvdA&%$6In3%7J{3)7KlKNr~kq?6%8bmX$jKbKp)bAPjZ#<g7C
z!!uVeUaBwi<HPr(y1H)`HDo7WZh5KK`D*!*Wl!2axw=$@cE@b|yGDA>y51X>^KM>9
zWDp6RmC-kKs@0Pqb-`U%nE2mZuU&ZcL|*j^<_S;daeFN}SM)lgu{HPixn&Qs9-Ot^
z?6c;kc(Fji_mgX6_U(`4iArtan?BQDAw6~G;S~FBU0cgL+aH9QYE^%K!||1kyJ6nO
zgHrjQtT=6wXJ0>cf^kjM%JVB88Sa~wuwKjR)mbJ*`-}4Io81L%`q*Puy*2QtY}<QO
z=2@A`f&5^he;$F0`=i3IwTKwDy?wTFcVg~^-Hx{|q;y&yH%YC3&vQjl-=XqW+O2J0
z;$~kId^&R$Ylha(+kM*)-dh-Q_{E;)Evjj)n-`uayLVIR%g43)_kB`1Za%;C_UxkR
z@;;~6WW1U#<H6sjd)NKa<$azW&gps2WRDc6BzSn0^T#(|khe*1*nckA`|SPfrW;F{
z=3cV8x&8XDKTUi&OIIdlY*`z>rm?W_@g<Ras?|FuZTQ*#v3d>LlvOX5WHGQOv08TS
z{3L#Loz35;Po8i7@Ob&^`RDxd5AB~@yKCQ$Uk@_k-|cwDdE{NiEspbXD@)HW+aC}y
z$M3<1E4$^=VwoHtNY0(kb7!q?PU`+Os`Dj^eTo=<w0{2ApW46bzfDSm-l8unlMa`P
z9GJK|dgENf3C_|_Q*_O)ekhv}r^PTk`NF$(U;18!-Z{^BXD8E)b?^DCVwn0$`Tbg-
zo(uA@?^_-6KfJ0a_G?w=KE4|-qg=MXExf*(H~!>{(DGWB@0Tp!p15$3?Zu|B<uPx2
z%_kY2Gbz#HU+<Z?CByde-U|yflcpR!x4Z0Ab#zwuL(YfWXG#aYj-24UEydG+)|rmr
zRHGl9hdcL`{|~9`JKnsI?@sgVck830wjI29*S%TfLhQqfUUSVAh51=e#MS0*l#kzN
z(Js)h(mA1)GpL&XZrS16byM%3<?`RSE7p9MgSo6*#`f4<#qkWYBz2EfYV)O7mS(-M
zN9_Vy%nvAtXJ=qoF3!Lp%fP^pn_8TomsFaWlcJvt?gFN#=A{-TLS|{sM#SeovJj|$
z9vpFfD${n8tnY7c<f(c&^UJo%UDzG1D6+G&@eSK-Zy)YezwYKA^Xu?s+8uS*^Ex}%
zw=?<ws%#z`8`bUj`+AQ&YtQmGd&G_O7FQmbB$l~8b3@8=`8(aWBwu!X)$0`V_Oy$M
z`RAnO?e;EG%YyT!are<G)*2V1U8}A>>x>Y*KR^G8TH-$cMOUL#CIy^pU1B6;b2cN!
z{C>1zh>Y#jYsni=Tw~f8)wm-^IpX5_GyOsKDgLuvb)%>5E<GaNvMeQNwQI3aq56Dz
zoBf|xU;nw*d`I?Gjz5_eGcPo(&78DJ<@lRB%+FY^%U`K7j$U}O>132{O7S9zKdg^+
z76z%<-Cid=ZCOTeY~%BK&f3h0A!@$ap`5vb&jThUPyU<ppND07j&|+N3AzTEJKW?i
zRlJgTWoi7WlZPdpHM@CE{9>+KS;q^f=;R9DobA9PoYnOyZpo&q`4?IyitG`6@3G~9
zQljF_ZkNK9Pc=H8tn-}qh;@>Z;>rlaqmwu6HxG1M8(wN6`kZYFSH`Iz^YD<@g>E*p
z8dQF@9Bj-e3S236P=7*g7w3sN<>7o6n7G3eZ&<4&PMDD8%Pk<y>Bn5yCAcr{MJbPo
zhR<WG9bv8)%a-<ezFF_e<>T=9oU+`txyvr!c;75%c~W#|#?74zzZU4t`D@f29Ohf{
zQbCMk<~AdTjxCd{&a&=NpT2fxQ^1UBX$6**{C#oPk4C90|GY0TMZQ9OYKwxFtzzh_
zX-j<{?b)|?pQYZDvt3>r7DsN|b8*Fn*j2#~*9&h<>%23!<B8-?;m`fnLLo~GRbqBU
zzRudz6Lcb5&fwD_4~+>ap7Rx#{?xOdvaJ3<eC54`7N@J8?)z(~#?aG#b(!JbCn3My
zEq+`lD7aoaATKS6<vF{KoAc}xF29v;1rs#;v$@hkZZ*2r-3i-z@@k#;@)O2;XPnh~
zaQWp^pUx9P!Y?nRaXYl9SXtZDR0~hJ;ij4JStCuoX{qY7xNR!8_8sXyT)U97{r3X9
z|1T$AUOq!mlcRds$2PAYeC9KDxt=igRocosHTja<-Adv8w_jJU4QHs^U3O=_)YO9-
zPA!6K3m&ZDa5M;4H2A})z3WGW<dxm^5`Aj-*4~%o+qHN1@xba!(tOAIHeKV|mYdhN
zKUB0VT5Y~u>%4^z-o6pwyC5Kvl%1Jze|KrF@#FKoLA$KC-#hzw?j@PVQ!D3HI!un-
zt>gA@;`Q&hlHcFvuzcA0=yP(#vWK4!HGWunfA`1u#y@XoPqaMqTUgObO{qKJ@P_lJ
zM1B9{X9XQv7j`gUhy9xsHNX7#7AZW5t~+`1zx4Sx7rnDYSe?q<epw|dn&oc~R9OB>
zYu*mo9l0Cc`4lpGY1Ji3f6uz(YwmQUr^x932Z!zFe$Fd4miabUtn=k7%_S+f4{-;q
zeAMJH?TYk@f2$vx6f)cGdTXa*S|eGu`$zr)yS5)UcT4lQ&--Wll24v}`#EVx{sR~J
zE>HK+dwuR_o%a5G{oZX?GY_{d^|`j=NMUU|FZVyU<?jMkuPqc5-M+oiOeVDH<K6y-
z#z#}@PEF*>=9(9GJ;^Zjz}Mw>b97?Q=on<bKYWH|--b}buY0z*O2wq7=m^irG2nmc
zDA%K|{QmoKvu91OqIi!azpk%XY&dW6K6ANfr|xMNcQ%#WFw>gx&MmI`QE%VJSoz1N
zr>=bRtE7iJ)aGne=@j$JUrc_No{RhT&8x+Li~ZC?)~fm+>Ir2Z+BO8Mv~6VXo4fGD
z<HOFTnPpD83*Y`|eV1^|>+)Hz?ds<Jd+nw?V7zf5x7_B9)WYgcr|S=1@gAF8wm&~O
zkXN+Ob=~rHXN9M1)Yoaa*YoLuLx+mz^d#Z-1Jk$;U47x^=s4@a$4j4;O6GjdaNJ<)
zJ=<c_OpXruO{Q14jxn#8bj;A|%Dakh@)FgLbV?Ndsy;O`U41_GzO}uE)OEF*^osiX
z+rH0!_V32-_oZ#ME1rv;bw4h&wmo;n2g5BB7MfbWpSVfv((l#g^LkdFy7A3pdrtUT
zp0o@5zW<5a&Xrd!w1(+*qDf25oEo+%%|BQ8bjubvwijME$^ThkmvoTLZF@SK@a26g
z*VTnNu$hK1-<)`Sa?$GZiFP84y`CXk5}*84|Fp1!J+A90OMm^%70GKFSgIM9$eG+r
ze=^N;+8U*G{dXsGl)Id{`rYZc?a$Lfa~OBUOq}tt$|?TTUVR-u<yzGk>!)^~dn#<s
zsD|uZbL1n-;+NNp`g61#&z)4AmlOQMdU?db#K`q=p{q<1G?#rTU)gNe5-_LhdE=&b
z-ksAb!@tgHerK;1csp$K-(KnIVLy+Z{;p6{;FIuc@ozUTOSVg?&HU3f?cRuPuK6g&
z^yg-@$7}2RPMhYi920)*;TW=~G=e2kPPy^xwZK!gf1V%O*?Fz)ba$iu-S?93KAsV@
z_}*^%TET3})J4U%8Pf%8_glJtnpq`jaO6pUu1<BRO=;G@tv+^>0u^Q6Gfe(1)79fs
zwqk0>{EuDzOIREHo9@rP@pQu>#Y5$*B)BCT%nvHn=rMiQ(TtY}U#9rVVDZ_Ub2S`O
zw$`KVpPjYobl5R71_rw)n5W8vYi86_<=@u+Ex&zY;)D0Uv^PB7%Wkwx<M!maDyOpa
zHmRKdaBSKa70bz-;q4AC!A-7AF$`NyWPIHpANut>yThq@ci!$6-zVA4vTHRMtXjP~
z-evmp<MlUd=le$lZoV6MtV?bFvo*K+`NUs7>3h3Ra^I~=LD{L@rBm<UGrc%FeEolc
z*t;8FFt0wXbm~UBnYMWG3UO1Nx$hkwuHL<;Pi^y-w))eHJU=h$lUh+Y`PxsFS$f@`
zlc&2{ot|A9VlZu^PS&XvQDT8nYZmXxh}gP9;t%(RQ(SVh&X+NAg=(Z9o|_qZZn4Tt
zz1gWpC#jrz-n}Vnfm@)NrdiPY4@OrsLRO|ujNIy@cEj=Cz7YM0kCy9CHQC24IeS-U
z|HSv_9zO5;F^^e~CD3lgj6c`bh*uU$FD)%moh9#g>Zi;KRW6xYkM}oEW*rjic--)R
zpV#W>Ydni0qweTkj-Gbr@==9ZXC8(!=|A}26q*?v#woJq;aS<)chvvb+6n6VewOqW
z-+A?lbwyc)osjB{F5hVk#}BsIi==KypKL8*x%$G?8mkLa_0*p>os0_Qs`Xku>*j&=
zAAVZentPjFNp}6oC6V=QW~W|Yr;CW-*0xPAYQpaEEwU_9;OYOpE#|{Q@%~i9pTC%S
zs^c~+-YvAFPGD}R<m!mB&Mn73`hBuG*}X)|yCPtt<Oe~8t5ZDfe8o~@pPL)syuUER
z)5&h}eEW@Cua-<RTd7mXbHC6eh4Dc*>z_4Qe|-%LV>erF303`CWOX)t&9gm;fA%D2
zrtQ_wx0|{2v-D%}lJ4o#bM;q!+UE6q)xpW48%%so7ypY{%yGqV*N1m+9=(0><Hr+|
zomP8(Jba>MY5S+3Xk}Fne|^4s)A`WK^IeR!wcMM(Z#g6Jzm(<vy>q8d?ydXc*TMex
z$%a*zw*LHF*7@jI1ygfT^o{fPm{xDP(ol3W#6a`w`@pmseWPuc?Cm!^TW1nCU+=m3
z8Y73b&&{9q{D1fU&6_8eUu0E$J^j<O=*#1i7yTDsmjAXg=JgeOt?taa-D`sE{{B2;
zFC4Qvdz<fa`6Vh3M0=$UyPS{<tTCCdKU-wRi`qDIgLS@^n(1jjXO}QJPd>T7OZ?ua
z`)PrS5}ud5`!4pE{cunge0Cr|vV_6pXM{ulvC?4PfF}M$(h^e`JufyUwPY_(GGY$t
zz4eP%Agki!zv7c!oW^qT)dKJ21LTBy9@ktdV3{Mfu5h8%xoj1`Dd*AzuV^+Dl}>4r
zm~;4q&x4mz)0lN8y7E^Ri@$w$X~KbDlNdvbR3sdBrs(X-p5?lC|91CH*%4ve|J=SO
zJ6rdgL(7I;H-FCwvt+t${j1=|WzV9zZ*?VKygz+@cvQ2%r|8SWKO%OAcc<Ciwv>yN
z+gJO3+Ri)ea<Wr5OD>jd`n#(wu5aakLxzg4ug>m2%KZ3wetr7iKil80nSX!pruti@
z`-{15FR1%}?B7rJ&(B|n|Cr|C!^6Ev-D~k|85VPn$r^uolKLLbn!j=O)3>@4WGj+6
zb3$FdDy?52vy%IC&9sL}r(SWer4()d{O$3JzlOX|+7B129BVIWd~?n{V#4Ezj~y30
z{;OfPOrQC&rq|obf92C2zUDUjEqP4LtG6ptl7EqhQtabfB~>+_zCGsOW2D2zvm@-v
zqV-H~WI|*ZI`ZwF996ApWm418_$#?9&`F(>^~I|#Yo4hvB$%CzoW?x)%r$F&Yip-9
zc{k6WUVV7=#lTN>U%oy1@JRf~0=KK_OfhxAORq*P`tk7159NX>k?-_aPtH4YI>$2D
zcITguA09oi2sp!7{%QK;#r@$YmPE9z7CCX})8Cu7|Cbh(Y?WMl@#WQ%M|U4q<~H8A
z?%=AueG`?Y+xMP3nswQX{ZW7T;_r)B$0t45wf#MRe_fURu039T=j`V6-<uz!^8TKD
z-VD3l_J?cQ6`S>QSTD!au!hB&FVMTwbw4yT?9XeaFxP-->R(R(`lw*N{rl(anhoDS
zOaFTw{qOnqKm8f`@1O6#ARqg>=epJ7t>^N7%<uWX^J#t2zva*BrT(QK{lCW5)^zW8
zy>)#SK0k~m#%KLZU3u#7*YYoK*30~gcdrr4uG%L*_um#)-S5w0j^2u|J^p)D-T!~q
zugjy(uD$;zZBfBP;R=QQZ~ZUtn)&qT-k%wo9w+L>QWyTn*Vk7QJv>!&?#{gyRrMWA
z-~V2_`}1K_l;zKj&yM^qm@~8F(G}hRu83XIpKLW^a=yKtt$2p3^QX|X>fa}Gr`_h4
zbGV~(fx&3r)eToHCO9yEk~{F~naTDu#-GhsXy1HuO>c7A{DVsb&Tp6>F5bR;`ul`9
z+4*zkH+0z8O3jT?d#`uSZi}yfu@^JL!YAS{=ctPAPSw^3F<i;=eO1Mu{gX?+zi;1N
zU%T~p`|BP1CvVK0awT)3xk60uE!#io@~KJoxBklgFS^Su&+M~)ZsOiOFOPEeNZY**
zj=XSxg@ulN;#0A;0Xl{(l3}K%ubB4EDEYnP{A}Y{J?fuT`r<D6SFxwP-lX;8y=<P?
zeBIecH$8kMeWHwS@htVynGbGtbT>Ko->c_2?$I^<@AUs%PZn^w2yY1eq~=*=I@_1M
z=B&>qnK$Jjn|a=R_`6|e?u9jXwwo$1%sjean$zn9mVzS_wqISmIF&bRVnw0v>+_R&
zqfL3=Un%d+n3c-p?vV7~TWTqzU906f>(cYrOb<DIEvqqoqE%w0yiIwZ@|hOVnGP@I
zOzf`MT-+bFpn>y~)U(jZO;w#o4;<SXXxyQByD!d3nnOrc&~Xpn^oJD<OpME_Ci`FJ
zJf3#7-+{Ly>_ioZ+rBl{2N$qExmmF5SNf%$Yp3sGKP1R##rR9A>FxATzNlC$Z?B{;
zy1PDyI&8dQE2dnx;Z{@L{l&i`r}Q4SUf5~4&wX8^{4titm&GrvdZqSr&bd!L8y@eu
zbF$&chGU2IXJ-5kQ~!L;?^()}3)R`ns_%+kI`OJ>ou_7;@=6olAAba6x3Rukf6Z2S
zz1ghamuLDXIm>1FmI&{Xo5g12An}0NPx)T?-YAZyWWfj8Dk8f4sh@p*CI;PVJAK!U
z^OsKb-xu+GI)AH-1wNj6l%y%}Z)5U~K$&d2*$lg%NlG32A@fmk$LdEHq6B^((!KsR
zyFO~hJ-z&@2OlnQ^_f}6?{DAX@w~RaZNYgf{b^^a0yng~=zRE*zGuI6va3G(FW2?!
zZ+qq4R1930-)P9uvZzSP{#23w;p2Za`2rlmZ)zM~dzIOg^@Z2`-DwYQPw02Qouz!b
zI%sk6Cnd3CE}=~KlRSf>qSRNNtyuPE#nY0z3RY3q^p*BseYnl(dexK*j;HTlTc%*p
z;?SCR{e#l$Ail1mOM5!(%q-vboT!~7C95hlHzUmNl4S3Sola+kzQk~Q`Q7&HJnv%|
zzP9;Mivmxp{l4q+QgI*Vt$qEn&*0X%j(>B`O?$(#Hbwdq(~7HmPs~V))$H=@uF6-E
zR_B~nGv(;~Nh<d?t`wFy+q=bS;ZkYmUs5(|9ClluuWb|*X>^<Hu4CqteaG@d_+Gn5
zZJ#<0Y>Ye`qqM~^UgEA<RlwyMk!X!1-xu{Zx(jydFF7jKu`RGss&wT6UW4??+xeT9
zTll}bZC$eF#~%5kZJ(uEEI1yzR2jaJUDj~ZX$rH3gUgTWbvX=8*N^G%o^k0zV7%&{
zFUq@9Vtrde)lPM?zr8kFV|lN|>Ln4kT@+KFuKIp!*DI~1JZiBXwnaJDz8=zO+5hId
zN?y8gtcwlDv`5P}Y6~u0x70C^_lqfKe(E_Mqub}1OP6i_a!vRA{JmQeAEe3c-O#8r
z&D^+X%Bd=^rIYSW$=>aBOl-w9mC#=sQUjemAOD(XEFU#Zcjb}DU#nb8gjoB2J-l>Z
zS~D*5&nbp8D>cgwao+V_W)<3OcdvZLo|rJ<WxrM1ufE+sY0d5FK5B;&9gq4J#ca@A
zU0|*iVy~~ZIdvPW*H@|Uv$yN`_%!}{9p1Nqb<3WgM;s0?`De4p6fDd-WI1(8_p&lu
zuP%1yc}fQ#<o(s#7yCqm`QFkEUKwhYf^)-F7xhiDjy*SP1<Rb(HpxaT3a@-8?K;VJ
zF=gX}_y}W3t3Arvs*8dc#20%yO59rbDCdl9{emS+1z*m#(K}cpDYC#Zf0@>W`<cn^
z#nYs79?fPBTEo;kS90gwBa5~rt_^StU9lnbm#c}Ehx)Y8HQPIGsJrNdU%t9|Z_CPW
znI{x~uznCWxe$}n{-R(?!Ljw<*W1SQ8_vn-d#%%_DsSRBGwyD=*Zc>|F0}OTPBD+1
zl|S*Z^tLF5?B_{~?Pfj8nO3=Ex}aX_A?a30rXJ%tQ~B4t`uaU^_j5hnZE_0U6HBvQ
zSb0CUoy`tdaH!eKmVb+}i@n>rC987yb$)x^dB5PC&HC&f%>dpP?>-gg$iJ)dx@X<p
zy(f^nG?ahwi|iS~4Y4l50p>AB)OojD&DX68-uUI-(xa@qTW=oIdSyK0A)Drj*KMCA
z(*E7IROj5;X2fwX`9qhx_?rB_tOl)bTq}-UIWCjo@Zbb<D2q$+hV^k94Vem4Ip6<F
zoaSg>amDv+`K!z4RXKL$bl&OXV_)6YvF}9twxY#xh4shYeSG{%^P1j0nJJSsKg@ot
zQ^&WH>F>d9VY>vg<TbWssfw?Ee({03#0$wh!HZ6^jZ)07{W3EfxOjKY`h2WC<-Ww-
zkoAK6|E{^X?RC3$NPKl-T>QGm|Ie=1MKAmIA@yyfzy{yVdl}R@ZuWA^6<POleZ47D
zdx^p0_9orrG~JvV%v-G@o?f)eX;cv0^vY@#mlb<z%iPs(U!T~`oH}#m3Uk@%=4EG%
z)6Y)zvFdZ2&s57CyX+Ca-GTi9JYo}@?#=k8?WoUrFtBcKTy@^;bNgQL38b@Y7p;75
zC#pAh{tc@K7beOVy^(lUd{k_z!F=nU&-L|B?lrfZ`KZ#Ezr}sF&0F_=FV3o8aXWM!
zO1blezaQIuy?;G>{=5Z84%WXtxc~S3|Ih0s`M>|(`!N64v%Z&$*35PdWtx2D(23{2
zJum%t`MtRBd6__>MTU~j^IE|}Vfy(!@uz02l*rP1q{-UzwmNYG<8p@hBFDoFM^_#E
zDwcj-@a&1j)Ag0VXr^UOz1Y0w$loh-Zg0qH*;z8XIcjIbIgKqR!nuxrbTL|XzTu~_
znBdZu$b5$k9jlVc&Qr@byg0l5Z`m`3gNANxU9xQ=;@5sZS>GkRuk|tS+G*x@djGDJ
zj|qIPE4=35fnz^EY}1<FeQ)*#sX%>k30Y6W33E<Q)ZGzwIi*yeKioNX*~u#$9tv-x
zc-b8JU2i0<-zrk~sQ+kfpq<FY$E($kDE@l(@#|&t6HSY6FFLa0Mq)|mTHSNe1(&nT
z-?iBs{!z~={_DWvZyJ89`c9opiR4{8f5k`M2`oGzGZPNk?5pf*w{clFJ^76Ejl4n;
ze*3AF7lV(y{LVht!Q0>*|GHHTD;4bD&PrH4wQ>G}hZ^QtMXydARQ{9v?(zx#*^DzY
z*ldpNzWn*3AZxF$xKb6*yg4V-b?RPC_;N>sudM%;!8Rqe==>k2&v(DrG-tCK`(?*Z
zPQHiY-rw=~I$y`f=A8m-Ah$yhd;1a>hW4vGt9KmmSfAj!cTK=dzmxZ}7}>o`j=pk@
zOgXVx_|>E>yFN>upUiWAi}3l&*2kRWTEaa<azb7OUvJpvCbvz0uHA+Siykj}pxxA`
z;HoY?#oSihX2n#F=tUxJ6CYnZD_E$=nI^YQ^5;9>DSnrvty^BUPfIQ-c)(uuYldV_
zR>J3v&#noXPsyAqlb|j7`@E{g^;=obn&xnIoc&Ryu~_g-fZS=#%G)dghJTjm9ofkI
zHcD)pW^7@KmEWoz8N4aim!w&C=&-&$aQ)^lyJyqd{A;q<jw^(1@<@tMV=O*c;wJy0
z>sMgHi<s~&tDf%7T$^LGEc$NE^`<r74rI5e7O&DWVXplrlKt{VPncYV&T9?XYn!Bm
ztKYe6aW&n$H)Zpg$My_8Z+%az?qu;fCfB80nAzC)pybxs7`5cXKb<DuxioXiE3pNg
zy+6BO*ml^x3*PnkTUPViWujZoI2i6ZtG@1(IDeV82`9UuWOuZiGl%(H9&rX^{k@Hv
z8*?H~1TUU*&9T*|bs5VSC6lfx$9Kn0d(Bo*w<12#^WM50L2qrI6mH+vD6{dG-u#8x
z9L~RgI(eKH(=c>VTFY~9jpsej-G1AXR&-YwEqyNk=aswuPwnRirdQ?7`~7Nrq2G-K
zSI+Jic^m!De1W@thn9ww^X<mP_jXCkBqeUQHN2)R@qA0f_b_K`xAe2EcWyQ1>0C%K
zn(FFPa$GS&Ov=$t<jIOH;lHHKJg3*Zjg)RE$h)`UMf>E-le-VEp8UAubbXjl!4<)7
zp{$UJF^xT|rt`40*f5lESLo*#nBH65>G63^{oT{At4_Y!dwu=>>aW&||Mfp*mNS+p
zxc;fgE}r{lpl*85PA8UsbFO=D_@*~Ib=vd=g3pi1J?FOa@NR15EIQ!-z*EFFhnG$H
zQs>$aIicqj8bjVLYTshk$oM?#Y|j>h3Cb&YzMcHrZu->mGW&tUhnFS&QF$XfyIDx?
z?;P>SpBMa0F9fN7U*YGU{*+lz|L*U%ukY{w_wKg&{jxXBEfJ^m6j-L7j`%2$DgAxD
z?ca`VN>?}fe-)Eu*Sh2=`Tdp0(|s1V(thrKakGs>=8uMqdB?@6ThyQS{fpajtB`w5
z$&J3Z6;BU(`6(ybbogdP*e_)-x_oELk^WUz-~JJ9ls}ev`<@re0!?)pJwYw5h3$-4
zi;7b&Z<Wwn{qT=mx4r|5xUa7(`<$<nKh3+&6DD$Q<y6skS9%3_7|WS{3f%tsV?k5n
zmJL_BrwVE|?{W<@k~`{SD|zgp-Hi>4V{adMALMjPp-su>=#P&la)Jt;?3+G=pRqoW
zea?o@N!sroaCb=b7O<;WZ`<v`q&xH7zPgY$-CJunnnbGgq@2FoVEv|h2KzBte~q-5
zXUdDbJ~UfwU$sa`I#@QAu_8u<zwqSx)5WqipK78$zqM3ddRywZ=&~9K+wR_NIrmm=
z7S`IAtn2L>$-y3C_4+C6ydDSsHyj}hChv~Fd!*d2`huY;f#*eq<EL83G)BjzcC*qo
z?^MW^=Wa8&y!v^=@j{*xsu$iz?VIbso62gvAXKYQQFZx?$lSt@{<>1RFPHG!a+lnn
zv*6#i2>1EhvX8es+q&e-6W^BNXv5XteWyNa(x1Mq*hjmHgTdJ~a4L6y!&#|li>s;@
z`DH#f^Lgr8qBbpEZe-B7Y{%i&I7S!Nx@`&qdEBR*gBNz_=~+JbJHe@{%5ICp1c{sd
z0mrvlTbJo=?dmmEeYP*i%g@?oL&LE@Zxmy%Z~1hu^u0UtMb9aYN9zjOEhUycx0<zK
zTkFL+d|$d3c!xMI{V>V;&?njZ9G`7E(o__LZr0vd%ErEAP4wNn9o!vv9UK<5w`fk3
zZTQAAyZNTj-7^R393M;e>TQ&4s69Nv$~)ro65AIBuOHf5ZIaDpUB5oUrS0X7cd4~S
zlILX-cItgE_MUmb@WnROF86z_7mWLlypuitcJ&;7r#%~N4<|0~PJd>ps<Fi}$m>JZ
z1B0>?+m#QO9`^mPeWz)WcC}N-g$bKa?{~S(m9wOM)2{9AbFCi>{oVHb_}5vhH_7Im
z_q-~q)G7b;&BFzI10B{c`f$B9$8gC_r|7yzF1HVDo*gRhq^xUD`Zwd*^3rhMYu)9g
z!psf_`l}23&)hhiS=8(Q-C<`PyMGDe0;9hS$`*zVnQW^Tm#D36+%_ZPSX}eg$>(^U
zZnNUmpS102xJ=-gy{6$ISrZ!;txeo@V83nPjh-nF0);vS<#m+R4m=R&Sa2nH&CB^K
zWhO9B59OSszxIM<o`u^T4vsr5%eEMZa5Q#v=11pvtgSAMXP19<b@G?XCwQeNt@{$j
zA2|E=M0wtv(gF!5mRSqLI=p)?pSrL~?`W8BZYvYV;!q}&DclPflwzmwGwfayk?R(@
zD6gU8TA-zArn8*W{P}kbH;GsGF_r5D@oQ+^?2rl$4E+!rxJGvpv(+2po82#X;-)f`
zF=lJNdwM-^ecT35JJFL<(^4z_XMUQM5v#X!`h@3Ezhd@RZjEwRG7OFPQTx)wBBiy%
zakj3yS*V4^r?4Om$1mG6Bl*<3S&!}c-@BSCWBQ?#weLT>%6_}>y6ne<i<ka!UU9pb
zmTPWxnlU(wGulzQf^&w!1hp8?Q(iNUgq9p;a0+Id)#w>iG+lea_65)KrW**mR%C`=
zoHF6yaVE|Ank`>>|EI1qJ$w70ZfBOSGQ+P~%mSPBE`|xU^%a!1U32i#H|u?|<MEX0
zisd_B3Qm{*-I1SgKSsyeg4KTK=JR*%AK|>R>DG;X?Z(9-4J{n8DGN;01({M<=N(*o
z@g-lgaqGY2{S$7#*r6H}?Q-Z$`v$(14wE)4K4!n>_sf$vWe@tXcsdAa1WBmfdbocR
z|JQBD9eyiqyBe>$M4+=q<V{J|EdQ_D4lF72U&fR%i`VKw$!V*k+bi#?yl+ch;}_f2
zE_@^R?d{0T*E#db`O;q=O}>2U(ld+uJ9e%3x;=Hqk&`YqQ=Y8dp4-lQmeFVt>z&0-
zR+GfIa}^pimdb6hY+jO?Bf4z)+IMqvB@ca^&9d5azsLSsh32mzjn`&%erPWVUmjHJ
z9VjDO&a?T>%*NR^yX=@&8b6#pIU!?xp}9ZX5rO>^)P-0kZ@shlf!v43Y)YYBlHr1O
zjvxO7GtX6L+ot)V<xz3XcD|$kC!e};d-iheGuz4=YVMh*c{^+kN<2|$AgXpV$nDIe
z$}206UUT~6x%ji+s+wbq-^(q$njKZLNlrIyRg2FY1^x>*i&tAMn8MBSXYF6k+h4DD
ztFUikU;LoZB0y2qT)H$Qg4K5F=WXn(<sLa4?BB8Uz~U$TYYty<_ImiDqvXCJ`&r&a
z^FA!$u|M?sw3@Z>%}HmEyFdN2?1_HHVrKXBeQ|5vMg%*iuCSORAZ04GBRSaheMiZ3
zzK_}WjTY^>5_H;3na$+!PPKFFU&KE;r=&G7>RGL5*_s|U`Q27G_1dM1I>L>;Q(Tr6
zF6Y$c`q=9IU1oBZ!_8f)&pe#VFIj42G^$?bvpxIQ#iAzqm|rn-Z)wWZ&r2p=%ynP)
zWYha;1%Vv-kLQHCaI&&^zSwtX`qf`;ytW5*j+{O^?Mxxd($!+`CfwYlx#tC=n1I;A
z_lAqN&zt_$JM(qP#gr=Ml;<z`)azIBT{B7k%p=sub>B@e=>5mqJ7Nv$PVbi$zQ4$M
zqWYEe?ry07k+<(wm3Sz;c$s`SSBo!ts*!oCjE7dHqkzy{iAk!r8Wj@1^*VlNOz8af
z>yYDK`8D$93EPgW`#o3vPRH^WQ+myvo-L1SnlaO_c<)P@FW)|^Sw|H&Nk_LGExe!0
zaGd{idCw-TtBfbD6z_AL)Y!_Y{qX<Y2GMfEvW82~ckFgJ86-QQgsDl-<CtEiw1V|)
zM`?v>=`FG|&b+$NIW_1*^g{{5NZA6O)_P-=iK0o&Dhq#aZ;F0$ZO{8TJ0#rp-(6yQ
zeyPI8s2x`=_g-pTc1r4!C123f7Y;ru5e6)qtAE@!W;*n&n^VH!I5VG$-G>0?9UT+T
z{1(3TCim<=<HDXC?f(*0{KngE9l!D|H*LFtfb+IIw|2>w@2?$KSJm#YeYs$k)c@bg
z^A^^09qaeMet)%b$es6(Ww*;@*qmLG|0R0KO_}VL-hhPo!dtI$p1=5VzWu%X@ry?}
zUnnhTnNyRmvh2~_pxEu(UCxRW3s0;GWLq@j_X&^d@A(&nORf1byF6QW?%!{h+-A->
z;F$PrqvuYSW`#q~K1w=lnz!}i%&DoTcHVs$?qRO_MtdTE%BD3221Ywiaz{<&waQze
z_}I_cbc)fnNnboIj)ZJ%xTcxqpDefb(BxgLnsz1~e^X{xNuOTq_y5++rD?~sRL{L}
zc8y7~lFV4jt6-%wZ`ah2$o%Q599K?n3ie6=sWM@E<UQsOPr_!LzpP{|#1dKAv|`ol
zyXrH<IPRXTEX-b>V<g9RR;hAF*Ys)aE7nZ1a?@>yFxY#^UT^YLU(56~nJqpu3v~6*
z&-#35-Ph8a_a~e>^mf6m-}Td%ypS*W5MLu6{ODwiYTe$?zcZ$Hi0QQ7FZO@?ImN*v
z+t511LhNnY|JTa<KRkW$m{q4T{N(M6FCQM&Kl$;+qmv^2_vQ$Dx-w6?G;gNjJ=2+v
zN7FxU=2a>><1X5-)A_>a{h!0#=_M{FE1A!(Td+=dcT3}TKTqv|b!R?l+9#>1W~sR5
z+dY*leY5b*Ed#4PM`xe8#hE(o-nQRUnr8Xwzkau_CuHi6qs2$^ZGJ9fsz2MFczx>9
zvlT2cxiROD$$iV4vvPl&q>9Z(|Ge-XZEmaJ2@=95TaCE(>iLEpz7=Da_+*F0DGSf+
zI~UX!Y_WCsUU}i|0!iiuNlBrziAB%4BQ4y7luetA7QE(Jrt{v?R`c)##gIK085g^(
zkXWdpv+mE96*g^pKc^%xWvu^qtZLh<<ie(vsXdI|Z|d``UzYB7vWuTQ!EyV_G{em+
zwq_)jG|pH(@j}v(vw?rqG;V*?^|}(j^u>b%k4ze$>IOf~UbD_?_N@(xiitcPiadGw
zCzKwCU!QVWcFT`^zHW|=i)$vTYOHI@zE;$GE%W~VjS5Ut#J-+<o2M{;de^Oq99z>L
zR;T^4T{_{1VwPLfKZi|XQ{A@ciXJ^*&hugIsi<c&9)!0wN-XlQmy9Sr%yRNcYp&+8
z*bPq>9-8|_>(xaYv1B$?u65n#8E+kaces3iuKyV&^CLbPj?5z5jRDQyc@v&J?^(oa
zvd&vKdz!?DTSa#s9#7vP;Kux&>v-Q2wc=YlIUOHL6m8=_vR8WR@tO<sBwwuDoEjl1
z5mglT;SN_FS4V)2VBLhNDY6r-ejM1fwx>-?uGYeS_l`r|=g#%<t#?abzR{^8>y=`T
zyoh6Kz|z76jRyPXE;+<sx%oxi>U$yczE`Oi@f2t(3h{n8`Tgu;^)qjnSGnn(OK|-k
zXrm=FKS}+fa$Q_P&bKu?SD$+NR#xu%(#w%?hL*4LehF%Jyi^tWbot0675f0zwE-N8
z@7BK2eYGa}*a07hty?0v7aB1b9ti07_!*eV91_WK)OpU+xJTboqF%4vvb8VJ`0AAh
zS#M{(yQNVjdGzq^AGhLnuF<ugCtkEMhxdF*@3RLpALM>EELdzUa&K-}V&k1@r4K6&
zk1fc^wcvMIzC*_TAy4q6ONvLB|Idjx*f}?rJt40$Dev%77Tp&SsRjXSR!PhK)>vep
zaQA4ZtFm>^xh~0@vaSnyn7ugk=e5mnPY>&HpKwWM$KuwNbCS-5%CY!HIX3iL?Aa1#
z#<%~N)tto*;%4tP?<)BoEWcm-TkXhXkJ{65igE8*YZa>_W_@Z___k2=+y{<{e_pg)
zwt8{w+~VE)`!!peBpwI9Ub6cn=j{9*qXILnGG(U8>#W7*A8=ghaJRSc&nLZ24zV-(
z7#*AZ0_z(1?yde@d~Kum&xu-V)(CxK*dFK}_AC8I&%Zy$HEE|mNS>T}=i>E3XU`jj
zYYHdN=6+=+aF+31Q*sRZ%jySz&voT8pYQsX&wR#s>LF*3+<kkW#OSrjKRm|y%}aoJ
zL2m7DzYmAzu6>ke!M672`h7Zo+;RgisPCDrbE@R6n)h~Jc9ET`m-&v~i_bjlI{hU>
zYK2;K`Q2Wl+2(gD*ZqI@w#-WXzUYm_3oA_5Bs2HE`TM_j_y3~JB5x-NcKvW|J^3Vh
z`_1hq7fat_5lwG?uye;cyR!GzPbU;!x+wm9>8%ZlM=hrWr960AwP2Q(JWE{ek_FAv
zgw#2|&Pwm;h|b!nyX&Ru9<>|`vqp`M12qZa_p;`n<h%Iy<C{-h{)^_y&i{D$Ubo13
zd$TipjXH#5^X7ETZ`@t?<Kq<Fyuyi^OZhC`?`fXj{#^O}DMM%39Sn!vRZb^;EqZpZ
zw&bwr`Lo|w`JC!G`|y8cQ?c#y^y1!V!Jl(AZd?%D8y_|${-;$<slfE6QfBYjwYMj{
z*p-{Qr-Sd|U8${%JzKXqa<cDKDUxZAe;wU?SLj--d~Em{5BoF4c@2WnUvo{@%3cqc
z{4jUhgvU2F=qbNXI;zL_)A23q2U*tnN35bwzv!r(+57YEzRN~i{`-09zU#lRFYWlc
zy^T)_Px5<RdU>Mc*mj!}M~)mRekK?(vp0{4<ydmA@MKxpcjkQWq|y&BVt%f%?@Ruy
z&o`~E{oh%}UoFh`v}R$+lHA~D+hryRWF#C_wBO*xe#_uQ=b!SD_tox9C$7!g_N>mV
zuQ_nWHig9@>m=@dQ~I-IVRoZOy3#&d#rDlB3l<(<AdqMISn<^5zb}+!wRz@rcD&kM
zWO@1t-<w{$7oFB|kFNDb#=7x%cE}lQNi*n;xBQy2>z>L&xecO|jY1c#mO0U^@$cV*
z+YevgKhz{;wd&!nGa^S6Q?0%(x^QVv+9u5_o{c4Ye<+_f?x}1S&3shnAmL%cn|a}~
zE|=!@$>F7|B=eVDkA1M!v~=!iox-Yl2Y*>;2iL7sGAZHN)8*}>zfA1gg!1n$l6r?8
z|NF4;l=LpA^uVX{8(($hNmcvUx^%XSeEQVrcGu;C?3zZonWsH>CLBK9pMPHeoPqn=
z`~I8x8AVd=Utzx2I8Rl`Qavqn=Y#g1owrwsu%8dO&Ad-};!pE?jC;Z#<X`;D{AcNz
zTT{Nc%>T~qBlhK6&><e)1>zcM3zl-<;%@yYbH?)@x9gF$Jd+<E_?x&<`%<fM&HuWR
zs>;$I|7wfs3P0t2ncjT7At-fO?)HZ)Ru9h!*nHtUsw=2<dzq!HyE0$WzKwn+x;<fY
zIKMK9?e==t@TktM@Ay>v=~M21Hl8P|V-UZBS4PxsrH1?b#H$BhrZ=iKJjyz{`k@MI
zunpTmF@B~`HU&Sp4b1)Oj&eo4QQI-uoT=bScSpe#cV{NQmD?PRIlgBcl+gZg{n?6-
zvit}AqW1B8{XFla*5sc~ALr$L`Sa%Qix<<MJU`rh`Ql6dlaF7$eDLP3_2Yo=A72QW
zPo2{=Juk^*;dMU8r?GlMHWyC5IyP^z_~}EDhEsT#eOzMeTNP(;#`KDusP5K~%Gu1%
z<z-(tPk571tT;K*QXnX7-@G-Kl~kJNHiqR&8!Qa2Fo@51Q6khFHQ~F3gwK9SiHJpc
z<|S`x-sp0su^m~P(9ObVSHK!A(R03SjW|aNi}C|`#oLR1-`sGt>Vea<4QG!&`WbP#
zs;4>m;L{0L1z!E!qIyGTeV|0@#YJ<T3O{g}w`bwAIgO65wbEpZw|)+bdKRh8&ldC|
z`&dO<)s0PlQv`dBM4voLy30LP^7#9Hp@_(&kPnZQt)0@n41=AH%}6>Y5~}YT_~lZ>
z(b6jn;;|o!?i`x@?%kSMI~8g_yjO8_-p>BZr_tcx9wCzlv(k+`#d+Nt3O|26Fk$W^
zl`7r1ojoDGY!j^l5+V+)+TX#VR`)V9>IWC!g^vxBixnzc=eL$^-FYA(xv8?MCfblK
z>-p2;ix*Fx{CM)?8GK7Zg-z7rJ_ehF@QLk+`}3~gi(Gfhp7|;}bfmN8cYHc`sf+Q=
zeujwho5y-{=J_p~wsJv6yzH|B=ND{wyiD=@&9nOR*SwVTEPQUg)?meKR<or)BVOEo
zcyL;e>)#6dh?F(=;_bH{j9#$r?&o9YZu+VIG4%3fd)@VB|CF<(dwxqzOQ;R*_~<3~
z_jZn!&*Sn;yT>cfObtwn5m^*`(M~8sdx7JQoub<_fBVH<jIcj_;B((|Hi1ckJu^(*
zEQCU;zP$KQBT`_Ik-RxtwN7v%>yhGbld84XgiYvKe<Nwzw$iTeI}BD_-5>W^CA334
zZ?6T{Iv>_l$7@OMYVw7)3%Aa6?n-!l#*{6___(F*_B?Z+H!YEJDarTEPcGMZ@k++|
z<Tek^w=C<uR>=15^o+e?JyZ3)_U38Z&1KIhE8YKo*m<?g^ttmC&hNcxcfoANylVc9
z?+d;>uyCz9Ru*?kc5d!%zo3#IFW8bF9^S`Rew%T<nZWHCpJrXt+17E=|1S5PRnM&x
zzvgaO8+Wz$T(Ek;<vG7pJec=QDx3Ls*P?>-J7@pSPMi6uBIvl;F?;p(J-UI{W8dv$
zxBvJkz<bjAzq``=PsC22cQcvs><w!^HNNjM>^hevQ-3H~ZF#>r^rV=^28Gkhw|u>2
zQQVUv5xeF()73p^oOiXR_DDyqdB_v#Fs1s4gl^i#zjZ$^zp!~&DXLewdeQAo4hbgB
z8$Ldst{NTPl+z!)MM7$|MKp^o!^NjBHeFu!$h5#^ismgzv4dZ86Q20b4AnV%E#vGJ
z1CD2^O5s}Wayys0EK;f5-^u^C@#4%rhkHHZ$0n_tmbdTg0%;b`^h>>;w6@KAEu6b+
z@{6r{39*@CWj)C{9-n4?W@78@_gn9$cTZMs?h(OuvndO?9PhZythrY<J;h+wgw1P9
z(mpM${j%!V4IYgqA<qA5$7a|#{bsxN>fBm~#C>`4-k+miZ8~&-Gh~73HSP7joU4xo
zA5eLdl)C8Pwlinkzx5h#I`?kI{e7F6A~I$~r`tB{{kvz=mVo@vXAb_1-X;ImT+Nd0
zVm{Li%by*88%i2XJF0Ha-S>u_O<7>ktW=Jxk>?D=g!TRI^xs=nYB%vw$dj9au4mUY
zY_q@l=Grv(`X7~_l}xhgn*J=TcDVR{)?0t6mO?3sJt@z<4K{Kv`j{FaAt>A&u*6Y9
z@y~}3F0y&|E7g}+TOHis>b|}x>B<W+hp(4TD=v?V{QPKA<A&2L?>kmcd;8{4n9oD;
z0GkPVH-Ff@xV37__w;w4yp*aAKJc%LzVWfIqHns1*e%m}Q=dN4{*c>$=uQ1uof}NM
zEH^s-GB00sc}nR1N3q9ubgY+}k-)cZg1Y85pDO!XXRp})UYp-~xB1<f-CMpbTAH@z
z#mpa<RO>#?^u1>Hbc?b7{)<yBPt8$cUVh?&&b~y>qvj`+FP>WJc=cRMeq-5M$NYM0
zZT0WVKOEh(cU!>G`I$wWvrlc>F7R>Lo_0C&N;gjKi%TA{KS(;o%pCFf**Tl|z#X|~
zHqVMnoSP8wcxp@9NrS_xRvmFC|6k}@;wIDc>Z^>~3iq|AWxA$+IioiD;+nd<kN<XB
z{;Cx>DP8N%HIH%5ylu?k>sbp{)Hx_DFkdro33u6n^^F^)Pj6mwz{@Xt@tUow|4wBe
zZH(4=ZoXzxLg*>!s#{!9`^^q?FR{7Na+^)$%<}A;9cfHKX)7HgKF_>AN7m5ys^*1d
ze>JvRs@;ovc6d?8<FyT2^EU4=FXBEig=@d)r|1gqO{-HIwlVZGU*)<hb9wE8iw0Yo
zyjN?*+B46RIbGHfVxUm3H;wh4t7qf6y%F=8mA@{Y<JMFwH-FK+$HDP$)gERy&Yk&h
z#Z+lcli8`ZPfpdgu9^Ndv&H_l`t%y_1h$|vN0RTno%F{~;P<bmrEeY`@;sf^Gl`{r
z`7y<59|Z-i{o0idZ#d}n&(C)M*1+D$IqORwq&9Z=t-WLQ^X$iy2B9;11KTItZrilm
zTj7tJ<L9c44344t)nb}Q<ASsqpT>Fg&sSLBVY6>*W?SX0kf{@AG0XkD6g6%C)TNm^
z_d1_NwI|p3uDq}P_STbVl^;j6&Nl`hP_S&1`(yQI=5?>2nui;Tqqgzv%>VK6k*$)Z
zPgmm(uBq+0t1aa$f>ksG)8;HOh*;iQY@unj)2-oB$duQQYwP3Jo69`2U2~6Pn)tNJ
z=NlT&r!jvMlQI$uye0E#UXH6q*ChSwNuiUS?B5)JXSeFaRObn~X7e^bTX*KdDg)I^
z|7GX>bIAQadGY`H=NSj<s&-7gYqFbfV*C8F_rGPirOE2-4o%vyE@GQ#ZKm(yNku!F
zwb#ThS^o9DR^bL~hc_)%NfGnxXZ$m=`qQ~v`XcWvk0;sYpRcUot?Ee*aCo8f>Iqxy
zvSo!&H!s)dP*-{qs#uiRwe_myx1J5z8w7K&A5*9bX^i@PaP3a@xt3RMZeDEZ_W4%v
z31Qx83oiMss=3(lMWcjCr=%kOTEX{eEpO*1JN*hfKFccT$I*x1qS<c*hpFAkVplTR
zzJTlArKzFkJteMBo3-xhu0z4=llrwvrmt1ZdvWOWTHED~o9FCOoq23?@ZV?RIc)iR
z?{L%z<v1?uo|1a^jK;6l!bw+Vo+)Jt7K;jee|*!muNH0V3j<`QT#mi+JkgG6T2k?B
z!5=$+rEHpa=En2_Ck+!9o>eM+7yaij%LRV5uKYP`jpUB>EeEYT`4-K{D}C^=U{~D(
zuPX&1X9df|KTg^`@kP?T&2zfu7+A>5ue_-KyzH6Y8eOjLf_9gAe~wj$eZT!Ka%u9O
zIsa;;c(+_EdF!uvPUTq&+k<<*`u~~i*>m;Gb1!wzxb3%QG3_uewhCI~`8yy)=0fhq
zJ5x5FRJ2{F)XKJTPWck+6G3{bt!A1$DeLf<;5IL8s*~yy!=wEZMPfVB{JtG<)qAp1
z%=5hY)X<f?Zu8%Ic>KhXw@=o8V&A{IYLVXI+XcGM!es&<D=#>?V<yM1JN9`28cz8O
zi`e{rR&NdHik|(iiuLQMN5>!Tb~t9)s<cw+*^*PgWo?Z&Km5P_?d-IB&rAL0mGUio
zF+;TSw$k4-dots1Rd#Q8Hra5bx`V6FVq-|6AisYh%Z?6i&BevqyRJ7sOh3$<)Ts39
zmqETy$*ze?1(gvNi#<ygtm0j}<u%*JsY0Jazbw1*FRt>pSAM?gl=xqDQ+yq^Mg9zK
z)9SBWu<6CrHv!k*%~>=}zSdx2ZA80fz{%qbo2;j$ZP+I<{mH{%uT81(`sanEEdwf|
z0t>5o!?wH**c5u_Mb;u|wq$?J{W1cR3cY3;^%Sw3WaVe<XkI?k;P$kN=wD|VlS-Mj
zPi|1Mp0Ogq;>iw8okg8829NUM>mn|{n=|<gPs7P2EqpvzgN<{AD+8r2BpBq((Yq<a
z8JxZ7tAU00Hp$|--!BGq9a^){CHBzDtG`{$or2$95RzeWvQcx5+i*mz*mbGuB7xif
zf9o2)>js>AQdoR-?}EAiv*wBWu-%*9y6x5MNq$#8y{HyDXWb?5BB;%|`ox(d!bPqp
zA2G%ntyx>Iqp{{fk7&=n$|;6o{`Yr8{<)KPQn@}w>2|Q8zM50#ykq@A0(K8`b;?TY
zmd)ds(tNzka?dH%06sbEr>hcnf4Gr3UAO7&Cf7H-jQY!cf|k#>DRWiXB3yn<(Yn(-
zW$%j`Q|3Z_wY{HDtPXdxQ)1*-Ra!D<)jD-iS)qFmKF|I8B#n3PVwp!0zRNH2wd|RA
zsO`goB{x;S+T755?Dcv2uf~0jE7vMosq9$4^@xLIVW)r6ldxlc9IInKM6F=Fc)r)R
zEPrL8)w_Ls-|p{zsdk0$<ra=QojGq-JBoPMc21J-7HZoa_Ik#3zby+-+fPy6@a$4-
zNrX;tiGW9v$9m6e*ZYoK{Mxa&HT>wFIPEvPAHFf~>uoBrIlJ=BBkgsY%=I<a?wxvk
z&-V1)(eAQq655!1)X!bKe$Hg-g{B<c+27PwIn<O_)tM|Z>1LGg6}Zc8vCl}iP{HG@
z%6+BuuAC2dzpsx>Xk6oKCup3rSMbXbrne;?OB}8q^nN|zgX7AdJ`a=q3M~^`19*J}
ziY*qfCGOrc)6x8F;{T~GE#~!lor~P~M69gbw@-66SGoToGjOTv+{I}bv+Qje*)*g0
zGI)bi9xRaDDblXbVKaU1lFzdio>^|Mn*Myo?e9f5PNquVbnL%(L*U~iO|y>ox;9~V
zKO8l9l~#7=UPRo4yvfHuS(nb7?)BWstYC&@2!9RNkIuD93wwCJ*wsx~`$S4^kA;k=
zsPw9U*lo>Oagpt_^%ux|7A`$-refXelXqK>+>KssdGHmp;90|I!44(oZiESUd|fX)
z<42IJ)r1hK74vvQ7RNbxcFXS!ny)aQeP-b^W1f?o@n4S>o%1OCdUnZ5{eww6|JE#!
z=6bXI)w@Mn`nNxAys#?OKyl?Yk-gU+zHIs+<F`^RZ~cjeBPEjezCKFZZ6@(lD=gv3
z4jv7*S^Gm`0yr;9{B`r)__}dpS&qugHzyn(3Vo5$c-Bz*=i=0`1*})g4QggqeG=LB
z{olqt56aigm1p8MdVg@wnP~@?&U?Jy_Wu9!*ZCdYs(oy)*=?*fx;&Xq|Jjk5t3B`D
zw5^9uX{F`f{#cw+VkG<a)L)OzeG+f?{`EM!T;lDnzaD{oWxu{Dn~Eo?EUjpWe;dHM
zlhJ0|)x)nB1ZLzNy)n<G+Wpw4CvD$TxBN~IvlDo#QFyy#t^Vvl&yR+y4u9j=S-Erl
zDUQvz0=3i_T+gvYs4TKJJDja{By7)z{|THA{kSZ)p9%A}@zB{5l{xKcjk0Wrbfam6
zM6VCO@}^0<RxP)QHr--*{Qfkf`*}uZ&dNIJ*?eqUvM$?aUyAp=rtO)@g7)9!exAC&
zIiqyy+If$?kM(b^+{kslZsXaEU2m9GZ(qEZ<o+mo!uI7C!oMEm4T#8<pSPguW6b<I
z_wcsF^ZPE!pAVIM6EZs>Y<p$t%HyA|@%Uf(b=|tms4Bxdq=7BcZxh?KQllL^#f@t|
zcL%1+ynlD<@R=2|1v{g4xs}}S+!DK@z46cdb9Qla>-YQ$mI(^ld;6%9dzkNpbi-qA
zz2VR9KE7tT@!M<D+Ju=GzMk!V9VPs_g?){j+w{}Ys_li%3)5yeh`(JtyHw==$Nu^f
zA?Ahr^Y7cK&e8bS8mzZ!-5--*J>nY_TvsTvKh-Y?3|hcZb<}Fs6E|@|^CywYySS$}
z+T51-qMz`6!JHpr8p_|&wmY~_c~f@!=f#S(RaH4BJ7%nY9dmZ0Y0>PxyS6IHb!dku
zeQbX1{K&oA=!wE-QLBsG87~jo8S2Q~30ttZ_F3NR;)e5gvhJqME?sS0pQdu{+u5wt
z3uh}IsdAVdzVc>K+^2XAt^KPe6^TB4v%LRvr}LyrL*2RE3!fV5X{&FQ{gko7WI<3^
z_C^m+UVom|qPxB;EfSfkF-;><{jRC;)$eA@F1`+5|Bqc``PnCWuQrNW*{j$n>Di0t
z#7){L^jr5}b+WYj59Rr*q>60*#+>=qW16@9OIIK3hU~@7!jJt9c6~I-zhUSke=H?2
zYws&5tJc2xr*BSMzUPah_rnK&Gp=2|_4aR_+xEL*P19{T?gg38;V28582mf0v{t<9
z`uc~q(bpxe{XyRXr`jeGb)ScU!BGRp=Jb;M{G8;B#7xjtT}z{?^B?aJ{BJ+M>8{9x
zn!+vpa$U|`@~<|}-CH7T-Lbd&ZW^=Wv==kP_xeqlv!iW)b-IU_lIqQy+ZeBD2Om~^
z{#W|a@{~I3f6srKe$G7e@@J^S<2h?3&gz{o`1;4x_Wy%D)|RS^Rqm#}DV#f*|GnKF
z<!)0|^C{|voG;qiJf#lWObXVwvW!gibcrbsed6jCJAH$O@1{8wg>#<7otrd6d)AfH
z*A=6uv26bky075Vna`Q8Qs<;Sy?wFwyNkF*o%S)&rOuCg=O5AjmLYI%euS0RqA9H=
z(E;<cv+O&SZfst}v-iiw4{|G|D>LW+5Ij>XpUL+>X;x+Bq@8i!PMmH%6&X0gX5O3?
z`kdtfU7xh$#Vxr{=l?WI{iyuWBGN<6L~qfgvn=zTX86T_dVa?Hv^k@z@&O_3O$B1{
z`ReapTtE5Z^3^Yok8(EJ@09=L^q1*dMu%-+vy`k>N2;d|PsrL>-j`GM1xc*0Sj9M3
z!)bMP*ltGkL_^uN!UYQ_3)_FOSZ{9pee#rB8rlANb^m@&zrFjWz1m_{Nr7(h(<a_^
z%j@zww?97lHpOb5k9+*bT!&z(X1zaaQw`!&JYTH074x3P7~8me<BX^4vWunGP0^k1
z;GpBIA10r(p)t^x*<c$}uzOG+cd){O_LX|>hI&#-Ur%mINPNJ?)5JP=yZ<Ggq=Vdd
zL^Iwptugn$cz^E)xp?~qpUW!CY>WPFu9$H9xcwbdDK3o%mu2))8_S<A_FV8*E@MkR
z@3*N6JG{OgRk_5<VDxvjXGAAo$koq@Ld6G89_T#8yS4gR&mNPUopom)t=+W5!)hvX
z4Aabz30FgA^`CrgFkf(A*{A7y3=NY$YH6DDY%7?e_p>(mI=}DPMx)Jh0@s~i=N>;h
zo_)UAU4J8~ik;#6Yp3#RB|kR3F{Syw>1^j|%kJ(L&<x7h);#$n*R<q&Mr*D%&J=aJ
zs(omVId8n6wJVo);O!}{XVzxCiCZ7{dP+~G-)4@v|0{hzn}+ZtCNT9c36Xvh(Rb5Q
z^H771=EDHFAgL>}8{X@kiVeBFR#!c2`XcUKlU8>7%%0@YW%_mggo)?MF2v59^YCl_
z;q{-pxKsYVpT)NF(p=y5`<-HWZ!y|sJkeTyZcXX6m-oIXX|LEPz2cU;Nl^3`(|yz9
zPGsg<oOot(diSGyiFdwEo1oAoW9%~Z@qFWDHqI#lJ}brNO6P81mSN14yK?wPV{Ms#
z$2^6^8=tu47ew_f({_Jz{%BU7cDuL%Q_6u=kJT9)8XH5Oto}TI&Ao>ur4#yj_B_5L
zFo$9Lfv=JwF7`T1qTaoGtM2#;pNlh?c50_2>jAOy&am4H%xs(%-;&^dF14ll{O30d
zujx-}c=&$p=Z`Paeq=t<OWXYV;`+m@S5{Y++Db+|Sra_*>od8Y4H=>u$67C*jfz@Z
zqc(lt%roi1-@oM**-H0GbHBc0H9gcy&?126pX}pFKLt}}sjPVDK5Jvd5{<ma?AQJo
zer|R8wW~<3W!r<7PSH$LQ?8bBOwy`cbldJ`MIxiqF_$L}1zjti?z8yG(<pK_cM8`t
z$@de*C+jp!w+x@Xf76NCvbXndw3_*S-_fvO<qv+}xt_k9YG2}^k+?QD@|t<_)XVRG
zW&0_n{HQeCEvdK8?Qr&qCVBPCC+`**N(yh;pzt$3%<#FxY-T;Rn75JvHJWJ(8#m|}
z+^7<n`64^uyupnJjCyRYJO{QroLl0Ob?E7dIj5Xd@3VHsE2xOxk;=JNIqy^V_I%c*
z2aGwm?rCkQ>U*<e^SQ+VH*A_F`3js$nV6DRkgQ#8vvbd^rfs(_Ud*=ioau4zPvv#B
z`}+;m8Ist)MYXauOMk68RLk!*MZE3F>`ODg_|>T}Nog!J7W0`^ozT$n`ycCtG%2V1
z8PWImG2YmIFUoe~A#YJ}{$Kx|nXE5x*8Y1%bZv5OXKYB_nt-N;;Ij3`oBTw>Ru*&}
ziJK}=^<Zk(!F5~pgPfMmklH5O`60Nd&Tn7HiZv;%yaqQPUf#EJmRYRM<ugUO{+ds-
ziY^_OUbU_;NjAi_&2&4LsAP(|Z`$%*CKll>Z8KNzGS9E_T7Pus#<Ph69krqrGK?A-
zhZUwzT$LfX*xG5)rneS6v(I!buVlA~I{Pr8HduOXaMo#|<xixzX5ZM>bof{qr~k_S
z=Qa%O+ou+^E7!Lt=Iv>7m7N*)ChM@(nhPiTr}D67?c#3dd&TEEFDWlly-hM&)byLu
ziyP*$hKskGy03n7>Xzd4zen>PKe;{S9s6$c`s&Aj=54rf&q8VPmv8H@d#&ZY^dZ<h
zX2tiwbCx{14$to1d(k5la$oBF0*A>{+1WX#)_v^>J*oYPCA%el?T7!(^{VAZ18!f|
zztM5=s@I%;Re?t<!~Xx6*8Hn=<%gv#y`R^AKKkU?T)up@+Ki7g_FucPlH;WDw!}CO
z3yYkWA0~X7Z}HKCgG=e8mxxT<l8TI_rFF~ShK86HX-R#3msXLjCBL=L%lt9ZuZ=p1
zjiruj7FNBPEuz@nEnZWvD<_pdKT<~Jyv+Uo%jBd*R`*;|71xeA^jQCM;bf%`MhVR<
z$v;E(o7<#_wMTEr?=yR_=t9+z^FrsIc6K_a-3YKZj??-&vr)|Pwx(u~O8>!PvyjIc
z&k8S2@jB1U7JcA+$j7a%tex*0wTm|G`2Ff$?YvvICf|(~-<v#<bG0zX3yz~D;TzcH
zOs4g3XyV>yk}=QCL}t^MBh{-@bG;i{ZXJ1XudG(&iO2jmldny<rYaNp=v$uItTWFy
zTkq^UcGRD{{Hd$XovaUwk3M}BKl$d;->GG$W%;Vyuhmyy>V3j;>*wqKcat0w9J_tj
z$m{+!NIQL3r%~dip8M16%`8(Fuh06JXBMq-@`^~Xgi`fU)$K32_a5lTOt0Lk_U*IB
zRpa0P^<0!UaZi{fs_80tlyQ&p93O-1b(4}#Wr$y4yWjV43ujEv=cQae5~l7>rYc2~
zpS~}BsmcF&*J|I^Q*6h0TMK+n2F_73SKRB-^0Z}J3B#fy4|9>S_#>fmYt&3aW?mGn
zKB%OnyZ83)(5?FECT0v-#jdMlLzuYPn+s*OMNd2McG_gV{Ozi#9?84sTvN8^KfyjR
zXO&ayN+m9Zqe13^%iovnoLjf`&fnkdeEV13iT12#yL3J;Z{hKs#p~PWFJBz5uGLk#
zd>YSvTa!zU&Z=KeiSysBVit3_esZTZ$L-xBv$fUDzNSgEvQ8*sPl%IWTlud2nqaAh
z{EmII>VmQ*_BdSiZ}`u5OESEGAtTkYK26|}n9rAmtj?>qnxzVKosB%M!`k7qDzU!O
z_K!t4=ck%CyFMSSc(SYcdzIFk7S+4#R(IoC9J|B4UJ1_f)URH%`IeBvHpaNqmQFSb
zqGxTF#Ju<rKZQ|g-^aCnUs%4hncd4eUNhr)G-t?NS1a%S;Ff@G8*Of|2keaaeE-cw
zp;zsy2AXem_)|C5#MjK5`>@_oBI$HPzhd;G`kCUZ)wd)}$~(Fs|1JNrpvM|NJ2IY6
zD?3xYrhDCoO*0QN9_e&WQwxl{8>IB^gVO=ggVQ)_<X=3?{KlA?*1YG8qO((z-a?1D
z8|S|e(^uG~vrN3Bf7RZV(gsIf%IMEIv-wtoUblPnJ<o~1k|y^!2(<Wra&6imrf_NT
zxob8i7xpZk#H`J6EM+?no2|=yi`BWIbHv|nSdzwb%h+wg9>0dAZy(9r{;|qG)>Jyw
zlU<?B)%8i*m;R<ylMVZQ-aQN7togJ1^S{{jfzywqZtNATXcaHD?vB{RsNMSF?Q6|v
z7bn-rYaVc8)!)hQ_4WFXb?xRY>$I=LRm&gJxxV$*8Y?}{4QCoI-F>pMFkNA(ZH02A
zWye)R=lvoETW*(17M$Q`%yGE-ebd{8o4HjA_Wu?V>*$X=QdV&JsKNSA{d3RnQF`n#
z_h44hgYzyY7JQv8_%^DL(>qT=!eHz7EwlgBT`k$NF5`-h-sF|<-8>y~cV^prb=4^3
z?O34Ja$c?>@xJ#_{)7s-3p&yrww9-k@07Z_c*DN1gBCe#!Ig^@Z+7@svR*#<AgAEN
zbDgqiyJ97gtIXd`ck6XubGNHr!``<vcHWQLNtNd{v{$&>O<!hM`pS9R=GVCy-y|}o
zaZ0$iPf$12+VQ1k-p?og%%9GkIjeNqt~!$E-Q|ht`nCd0{GSy(r+z>2Y^F~B)9YPp
zeeP*<`-g>QGTXP>rBDC)`xwhbeuZ+5T~V5R{?5~GS3J7WSRB=T!t;Q<rKRL?KN->b
z8qJr+|G#=Yn7@AQ6}=jz3miE{x<$rvvLCDUcHasJui1L;@rR11?eb4*3>V18C#))%
ze%r|R?K~M5Tk#ZSkp%m%Czq+~NgT<UyX(zvleE;`X;XHV#j7Qre0a{MAvR;(3c*`R
zj1kvG)uSsWXvE}%7vGsaW7A9*Z^y)Gii|0Wt;uh@is!%iw)fhZ-=Q~;WS-s`nqF+V
zTiW*+m*xKLXY`h3N`8Ia^NVXy`6qeQW4l~lG>5k+Ffb%F;W!+mq$n{twIH#mIJHQx
zpz^Bi-|*WWllFfO|1zQ4|JxA@#p><Vr(4em85qA2deCTWZ29;q*Xmx;l#|*g8`_`N
z?_c#QZ{_|RJEN2P9`8MQBdENzw6wIg{5Pw$_08X<j}0V0u6ZKOZg_rG%A5~L-EYq<
zy4aGx=jFb*>VsvUZ!YrCQx~oNT=n_<8vBQDnDsyR9Q`wE`Oh4#zY#|lzmzh0=Ravu
z@1+$j^`F;tO<I#8`ejGQsgxtfKIep}R*Eh4+?pWy+^|1#>gJ?*8#SUgsI0Cq)VBD;
zz2Os++^h3u3|yrrF2B3A<HT|up5vdh;yxIpoGh6pF8bxfC#^${r%W#{vp%&v*dg5P
z#$SQhkN4hooZm1pr|6_{oQr6WM)cW5i=HI@wRp0<!6{NG;^NZPv-~dq39_B7lz8ch
z)85_BSif;HvNoK!e(lNUEJN>2-eObN=<hnWC~MJI>&EquSSRwR#jFa?G~{>RVZ#*`
zSpSQs`MUCl+pm^&q!~P!@pboKfAzfu-<RKecb~7X?oL$l2lc>bH%o(_NUmM<=61H+
z+O?fWRaSlN&N#w9xrdv<Q2sEJN@P%L;_4?acN{+EdFt>cCb6b^E1jd;b~MS(YOj$J
zo&HqpLCK6MR~hE<+|GF{Ykf*I=8tnhY|F82Yd7vroZ9ZOZkp7Z+;4{*7mEKo&%~~A
zfcsCp`Pux6i<_#Hk}fd(-|m+GFGxwdciEm<Pc~KrP2O+Xn|Jz&`M%zc?b1y*Zd_cF
z*|uZFS)Rtl&t2X4x6aIH(fzSzLd(*39IFqCf8gmbSW~}i^X=P7<?G*Xe`ogo=H1!9
zuice@ce~Lx=%(!Rqb94OOmnSy4_fhdTJaj*I`--Pqb=2up*m52-vydHEv&cmu8dA7
zm0en#r=xAl=J(u%Y4T(StMxWHA<Ap@eU4YoI`|^GR5(FvxvQ&k%hwNi-H{W|R|Klc
z%n-a_H;?nA$&2#ulLXH$SbRRsf@RX<sNEBeY<p;!Si(44H0qsu=F7~ePF=-+TO57m
z!ks1W-ah;4@U*-Q=?aBs&nBPaOSpS?c2D1v=Hox?KeJBaj>|Y=d|x_XwtkwjD__PU
zyQsw{bfb1wn>;g~cXU}r!?fmwH*-w%xhD8Mbe+^%7?ksJ$r0J70vBF{iY>mnciv|1
za=-dFU$>t#K4xZC@^8=X>E~IrXPq}Ww{rf=n#%I>d3Wyy&;Kpem#}d6@3i*h>6`y)
zCSA6XS!~AqFnj%+)9N?AJ~fLL_h)L@<N9KacIU*B9EIkT8*#b`6IkZ9t+rCjFS&9+
zwpZ2UBYTQpTB32>W(Kv@`xDY{Ov>STGr5taUGs4`fAyh#jIR?+9gn2&XvKYWWq&%m
zea77-k1lVzYL<B82ouARquXO=g|GHa$QP7rkd>-+bSv7Dd})j5AAg4*PMdEpYv<pg
zxuQNKty^HTuJ4m=(^usk+~gG=d8@+CIrrw;-5p1H%k1ZU?YC!<eIVvN_1Whvv-PuT
z*KC`<ccSynfQ(b@X0|s91I4bNEqVARvu?6@_yK<YHzl|CSUMhFAK|t1qKH)6r8Sek
zojGdbnQX{&=$(PV%54z~A_E;16&{!{GJlfl&<S<fKjU-ivh$`30<|qZ=g+MBbfU6F
zC{D*I<XiNr#Rm$fPTPEtqx8X1clN~_XYzAJ`u?-D43G+Tb~18oG@YlW95IcvKPgUN
z_S}zcr@az>eVe7Ga)c++PHYu#?W7e+2~0&|M_;tuQMt-u-?q3i^6BM(Pf}LumpC7!
z+?lq`ZQ(W3MitfC-2t0cm`;2nC3krLv{`FsvR=*kdsHeq-8Cb<X1kbxrS+6&B??lP
zHs_T_v!1>+NtRnS>tEXXH){9REnz88_~LH1&YXG5?rG{*j5e?ae#-mJfA_3CYwodw
zc}WLT_@40RWQn@Q{m5Z<mc0<vxS^*~N;e_%YS5=>yIG5QUToT%y8gm6EsGt?m!@sr
zGvUs`BU#*hs(AuAQx5BNsj#inD&DYq%H(Jx7G4|GdD#yRC~AEwI_92q!Y6>oo_Y7e
zS3=pz(QYl9ADv<MRdLw*!L(f0cXESuX4j{<Sp{EHV#2%R@*|s4#J_}<O#IYn>({<y
zj(~pKKJJ9gO?wr$G(O;}NQydl(55*0qVa0kcL^J3bhKPOSo88FCtro2D7U})&tsR5
zPZ6KDF0J{gKnqVKpTnN_7F&YdCiQOncj~hDtRKCy4`069vhl%*?>m+T#x(45iS5iu
zWQ@L7V0xtH8%M^biSj{{dM{O;39LF;cAC3<(P`;licJfvRDULF8f-qxWudLUV*7^=
zy#-S%%!)2<h>za8e2>mz@9OFk%jcRdHuMM)2;r32-y5^|EAztu>035u7tffgydih>
zx~qHbA1>7sc`TEAi?eNiO1+}Ld*zvn(^lP3VcHws6{wpKESGwtxM@~&nR=ooQ<>}a
znHnqRL~3rgEt)5?NMV`OqP2O?g#1m!HuGIPR-~AzKmBX}WTB@4GFrEG1k6$6)j6y3
zDI@&41B2*qG1Hvyr3seW68l~DOaGWRCBVCt@1f$cmgvU{9OveGv_+V%)bx0GYND4L
z^FpoAfW~mI8wpwke|G&oZhrTAEc=uFcho=J_y5VuenIx;Pc^N`c}uz5rZ~28?ve1$
zd3UGszJ1vY<6N~3Z-kO;mvcv4kXF;+_{Lze<3WO!kK@nd4d*+m8`ETRe56Hm1ZFoC
zu^Al5FqkM|X4${{O~M(mpE73-2HG88v0Yr{*vVGKBWarbUUwL{&F0671@=Tc^RSh4
zK6!D<Nk-i@^Q~XRjk5L)_tnyueB9rv*=~5?*yn3+dfS>8cv|$Pt&0*DyCWveA}!6r
zJ4fMbAu~_Km1)k|`5MiEub0lsn%lZ_%UUV^y|bBuSr_uWP}-n#e@ACmPV&672e;jp
zSn6qTr941ZT;qrR^99Tolv%GY+7SDj?VUG+&AN$9(cLD;zs*fmy3anVQdL=XQU>$!
zEV)h7&vKm2x?yqEyJ_AM;h?%L20xM)thL|_c==SwtL?H*uTNL$??nc`PsH?GaZsKd
z?b%y(r;cyq*Jab<FZp`?N-9^ha!J@9-6=OA=?g=e>yC*(_vPt}HU3+-Cw_V1@eRC>
z7vvrgH@^MtG0Qq<nMFTxI%Rjss!W%B^JRhaY^m?h%M8{Zlm0Jj@kPKSzPdo}t4Y>b
z%>bvJ9R&xXcKcmedh|p5$sZ+b%N9Q5ng216PieB)p2)Sk9J!)4+}OgrqG9Rr<G0s+
z-`QBf>-56-ht{356Qs7kD0XI;r^gz{-EzF~_%ppPpA1vh-h9lUs=r~6z@{I6rT!d@
z2#S1E_IyG0{nWkDB`+I3G0#eC_k7c?_S3&Bg=-(nh5b63_q<;>XyrMkO%$wJGGp<K
z^_HFDJu)^?_NlTDlvG1k?%e!TW&U!*Ra%*sZrs)ujWiSuE1BbyZ+GmQuBS*;qR*eh
zJOz`^?#vBb_q}EA)^#)Mf5~Khzx=}d+?B5D$5O->&t7>Z%CyoVx9;(oxrZ#Wmmcf-
zVo=_i*sR98=6Ut&mEo>jTmqX9O)<=>iM4Hb#`5%1MwOuZs_)lUT`_X2***WWO7_WX
zxq@=}<)<TOh5Xp%%OaHTy2hpWkE>YZ!XFB4B6^<}dgMoKkDBp|d!pR04Q0twGhAbG
zU$*4Ma;vPfdb8_UP|hl*_u5MH`h1OUS8>$5X;STLRNKtg&C7GeU{!ZotAxhQgI+G(
zFLrk=Yf!!rFSIF_^?z>1K8MxDl{0qCJz8qM-EXE|YRT<9zR$a|RoFhRe>>rHgu$T`
z&g#xrLZ^q`bz}=+<?^dyjj}uOG|l2yqc5k}`OV)_+g)T{{1ynfwN7rg?^Br&sj{mF
zR?RHmb9&X=15+gLv?rKp?sPw3Qhbuno*_L``_is=55kM%X9mdlDdahHMJ`r7w8ZhG
zUdIcSqZ^ygNG3Z)Iy+Y@3mEOpU9x$$=rMD*18rJ!U0ZTpa=P!m)YR!NOQ=aqkc;+=
zec2Rdm=Un>*SE{9>+j{gcw-_OnUd<*^=Es^wM*3{9Q^$=dA>~ZWn15#k+*jJ?%ogQ
zvkfYvAKm|@pK+F>S8EUBCtHaVXIg5?d<-Tx&*FR?qLyd<CT&uWTGmBnwKsZRPA9IF
ze%Kbhd|Be9hT7ZRzPFcdn<m22W$(pv`>)i>9+oYQzaqoT|9{%VBqo1Q;JkQ!th)WW
z$|4DCmGpSFZw((3?WV1htrPURr+47fuJ8IcRu*WTJg1`Gzeh>*azJ)hm{yk+>%AFK
zN<w#w5^lSA^Q?XK@mWe~W0s*uOnX$MaMrJ{M`lNw?|j>??p3lpCoy;aHRD$PO-6wR
z`o7Z61s`nA?To0aTYcGKU#y*Pde?{ZuRN7ZSIfBe)wi`h-nW%Y_*BqLWqT&e8^wHe
zVJ~@ldNh(coE~*pbN_so%(i3a%5;Ah=U>OJTx=H!jeNOwveC&?TBqFhw9d8KVsq`^
zLGcdRw77@LeoO0~T6Bj!-l}^3W3u=ivBfI_lp@WiZk1_%VA{61@B8<U_3p=iy#IIZ
zVPyZlNA~RYa<cQkH7Ty`Rbt?6e8sbQqV9|9_wD~xY*~K1KqWjw#r(!0X<Z?^Eqfyl
z9drB6WmnSh^;T7`5{I|IWG~?pm;7H&Ik|}ArS0YP$c-s!EPE4|$cL_*yJW9S15a}&
z*GFy6Za>e-YV)5NnkzjDle;VZY2S=^t^ND?7KzM=XRvqleZKE%TDi&0-=E*~r4{A3
zwv>EZKYwkHp$*I4g(Y))f+y~DpHx&^`&T_-p2!Q=Q%k2Mhe$1~ye-MPJ8)N_(OD^_
zrrZOmhM@-?e=NUPx{h0~<%^irzT|w*xP8pq3!iT(zrugMtlz)t@VBmMyRCQIf4vdC
z#pz+<oc<P028D0^{^f7??Oi<o{fhs4nHESEC*&Tf6bmWUVtUSH+j8XCrDU(e>D*@e
ziFTH49<Lboah%V5+WFvoYUr*PLQ`b^G2XiSgemN(>zjRi{v|Gn45@$JFPiq3+%9as
zt8u1fmY;ZzllP%hfp*Hx%g;zIopE8GAUE?R?as!(rfjRPbFni=PktG4EN?@Q#1qd=
zfpG~OQfyl4fphLZP%&}1Aik`*IeROsG%urirCMa`9F7H3BGe4ro<$rDd39%L?ybF#
z@9LVZTot+V>nl;i9CLlWqszmE=bejN>aqLP)GcQ5jOXrpn);f?IkOv1+1I^s;t}Zw
ziCw$cj>s_<s=i}c6}0YllYjQjcULSs^FudkZhfy7c_u%a@$9)<r`eQzr#mvgRK0!W
z3+vn5YriCSZfgI%<1n9qRqeJfd~AP8ybCt3Nntw~6Z9n9u~O@z`LY#8QoLMS8?Pq3
z=3S&NBCu@5D!Zr$QZc6wl~sFMc6CK?hi=N~(Q&=hDzNVnw?W%njl~jS7jDbGU-aPO
zR7(lnU=!!}Yo~7EJ;*1$#dYh;H@dfD@>WJzb*=Jo*u1KRxm&C4=H{-23)flLOkld!
z!6$doZBfz22fI%GY&;(0a`v8rq1V}2GqO(|7hR=YE4}YR&a+=fcy%jtE6OC=q)eQ@
zC`rXOb};1neA2ky@NvzY#U8U7wN_}yyXuRC_PPixQh(PaY;~aX^GcoO&kNfW+k-k;
zC-xm@-1Wv~iOkX27U~Rl^OXIzSavpx+>Nx$-kWDO^8oLT#*-agHt81>K6+0Ki3xQ&
zd5fVdV`1v?#S!UkX}fP-{5aoZhHs0&lmw581(J-Lo%gx!Ut3bKb!MZ9@s<TryKeV7
zL<z|*7i(ra7ce*RqEo&Ln{LdNi_4NeSt}`?3yUzeIs76p#AsD>lwtSPd!c87?{3YS
z5SJ)iefzM=ThE`?R||t3q;uwE%nQ?1+<j!`l-<9-ITz&q?(q2F!u?XRs=G~ambbDg
z*AlmHc7ZybhqgWEP&4V0{`;kBN7CH0re;;VvQe`_i{j_6cvhiSx^$bf{5ge>+-|=u
zlZ-ww73FQaklL}vcj8Y&hW?}*mOYcEEG!FS)mA8Z#l|l0*XRFx@7`S;_ph#9J?+{m
z*A~-ruYx;lt~Es-TD8Pw`z9UR*S?2BH0Fmj-+I4DI@TvP?@r9o?y3t}3oKUK?NsMe
zJaL?1&-d*7@5%Mg|0eeP@p%;7o@&v)jAP5%wSBuEZ(VdI|L~%s4eJlhFZpo!`1}(s
z?tkyS{MTnv70YLGb5Y)%xXq@Axb9W()UUV|5n*pN(b}y%(oUt=(ZC?=ZR3q^h953V
zE}eN!%kJX0l}jdsMm;c#aCJI=PAHqLEWtfw-qOmtR_n!`os0T!%xKb$Jm8t4czK<r
z|Mg|;hu*6&Y&b3RcJ2DBv-P92%a!+M3jDPd>$J<^3)h{Xp=&%n<@tw%=Wh&OD@xV1
z9@Y5q<Nv{^hMCiSo@?}TI4)}Iu(~o^*~Z4=m-L^{|4N>JSy29s^|$W@scA+LY%<!P
zpLFq`{kl#3$B)19)w}<yYX4zb#A&fcZ&}<@ZE2o8Vy_p!EGVh@mH7OEs8yY5irA0!
zm)u@WxGVhX)x4#veR}q2c~7Y0nX9c}f3@;f)SBMM?^g-U51g{lyW5b*Anw511BW|R
z-P5_&O1_D)sylr-{GOHH$C6+cvolkz__bc$dG#Zb)7tjXZKV>Esb6~-xeD9Ne+2cg
zN`&cc(%R*ERPVfO^M<MuCuX}%KdG_j5qIFWsy`d+KW*$cDDStgxnX(haKC&RU*Dm<
z_dMTctS{g4n^V3se@AKa_xXN){on20eS0`tdCd{|S33?j-)*j2@%8u9A0q49IKK1w
zCGMA<Ul+9aTi>suj=#)XZcJnR`}*VW4^MtbZ1??8{Qk>dzyA#WZEV)+7HoCDDy~^`
zJFcs-uvm0=sha4wI@^Q)W##5DUW<zJ%!%0Q`!;y(j_D?s9<CE{<eNDmpHVWD$tlMC
zLF?n2WoK`=70o|&=fjq@<pEp&@6QNH@Oa^WhQp`i8RxXf<C9H8LiOsCi+4x`M~Z&j
zeZl=|+z#ehGs}#**C{SG{cY58V5isTz$veoZ*SQu^i@wlyzs!ujEAqpcAxj=%Co(~
z^3cri&Kbo(*=t|fN?!UZ>+IPotMo$4wPXK==3}O2y_b8o>||KF<mllID&cFGo}HTA
zeo!wul6%Xfsr<}eM4zs(FAf)M=5NdET|Hm^RpXo{)jyxvZ>)?8T`&JJY@J$GamJ$j
zl8Gq^dY*lu6XinX1!`W*m6dN*Pk;EXeeV9Rhwk<-7x`DupY-F4uwH}MO6jRT_egwH
zZ?dxfSHZPy5kqQce*DSaIN#*=-rLW4uWhM(-rls-H!kE!#*qqvX?r-Av|T+Dci_^B
zjUv+)Dosf(wS2zRVnM(*o42>jCM;{q&8)w9<mD>y36`~Ajf^($jjhkVc0h1{_xWdr
zk|qh$XJ7kK6%ntn`BaRU?mpi)$0RP9w8tm>n*8U)vHBb#7G1A4F71{xyj+(PelWLP
z@cz2rgy+pX=DN6buNH85+4M(-a+}TVS3ATvt+VMD!*1PgVe*lAp7r-Sq^q+<UVT0m
zUmyAPqMYdD%R6L+AB2^ydg*KFURpnS>(w=9UY}*@J`?-5=TNHWH}5mwuE*EkO**8<
zcmCJ%1#A=7r@Z0eW)gc-9l&&-JKQm*^0*u8@<S5b(=_6bsVMI|9-*xBbILSpU!^q_
z2Y&M~B-M%P)@=~wTgbKOp`Y<(-Xl%b;oMhEjFg^zeKTFt+)>QOe!krNFMhx6df$7p
zW;1arT4XA4{(bpwSz(#nGuyrd%g!s0T>5ThxFppxE$iexxMvQtRc%*z$0fc}>5EMJ
zSARaA`ngaj@HDsA+M@F^TMFg9Hrl;hG0k57wfCc))B0XnN0@lEZIiEyzOdExm!v@T
zPMb*I>UA3Nk76{tvu^%%5z0tS$=Q4Lj(<wm#-eBMS5?3DSYRL4F1qLTGP^ZxW_@{8
zH`i2_Uo^cRy)y8xM6Zlv&Uy8Nm72wC`ahI}B`G)DSgqcpvF1u$!e5hHHS97!gY(nZ
zmrEtxP_(hL`XiF?Yp)%D))bwt#aiBbQ{8Q5Z@a(wObmDVk<<I)&pEcg;!EvaSbXMQ
z^(ndkTbNw;C^`ghW?E<_I<Zj4QgXG&wn}woS-zw1ZOZx&KfZt5XYR88iyvk_`df4Q
znVz?YfdWSuC#TOYMUQ!2<?IK7pXD{~+s)%>UJ#}==jyhdH}7fbHMEy{|9G@)e@FfX
zQ8}4Dy;C-G!|xqF%r!;g&(t69qV{}~T%#x9r<;|%iX$^ur(4hLYV_$Pq00Y+exJzU
zjne7km6B}`<#T;0cT34<MXxyj&WXbNKR&-B_BnTrL;4N%S<U;GXFlIpq>=fF#o9e|
zucFLyp0{n6m!1rf37w!Bn9w6#Gcilg*rjq}j9Nv_&-tI{=oJXPil38u;lS0-<$VRb
zS-)L0N&|ydO|4T*R|yqYah(<OvVo`ZN?YKhUw5Y2L>xQD`dq{G#V%8kfEf#BJF4qc
zYTayP<6X)X<r3ad*dE(ZsxqOY`vu$S2V1^YEG$jV*?hWe#R^}MhneCIdattX2by?m
z8Fbe(@7ls<E&X4b@3w5~M#kQWvemt>G|s;Wk}7QD<gZA0I=kfT1SPlq=CR)ty<XhQ
zF4_L+rqf)dg~>`DjmHZuHhj17I@-<KyZyh*oxe^7-QNy*PgR~5aCCvg!X-*GUbJ;b
zpGw&MT>QGHojU)*BbTqdQJAsm^qe^yj|_OH?P%}F^^%ul=1bP8oU*m^4e!T`X|<uO
zFW7c5+lYBy53zsug{fG1vFF6}llhPC8CxB96Or>>^k!0al*{}J`ZIpGWc?HUVl4bo
z<m5xy!qrhW@}1qCEtih`j<V`%UhMQdI#S@KNV@W@(vxO}va1fy(NsG3Wa%R=7M;ez
z39IfeeLdlCxE3GJ>+c_*?X*$a<@2C}IZ1n6(_#BLi4h;X`%*8kzCYEyIm-1z`9{vT
zf9?-nHJy;JnP!}kP{#Q8;u6uykd-;w6Tj@c#<5am{;rr1OO-{t-%YAm!#OwX-gKre
zZ<#;Qa)(9tilj|cemmXwt@pAgNy-ZqKdp`S3cSx})?W4g*#AS9=Zh@9d8;aTdisOs
z-!Ay*aZG91BCh>*-nr@<Rtp#WUc5)|PxXn<MfyuG$8LC%D9-brhh0bV)x9n*|E#($
z(YaUheSe!B^sGIiK1*-)>R`DpbE)sgOFzWzT7CTbvMVbiAMaTe=JxPjzOZTdK6`mr
z!LHbYtZw&sEbd#Kd9h4)a%k(()B1XUex2D^lQY?u<?9j6w2#5!T)8VZMXlD$63P4_
z{AJ_!s^9GH?0=gdE3e|n$ZGh*J8jC5ANlEjo;{iLxK4BB71my<nSK6Y6IN92oMkib
zwc38kPMc)==|1~jn|A8$ZkPXFRazuISD`uPAKR*e30$AHu^+s-d~;oYm&d*D-(EW8
zw69~<czgTRwEMGvp6yu0|0^a-D!l2?nw8(qozA;9`|6&wdv3pSHG}wnyP9OKiw+IR
z)Dnu__2T`s0JnRkzrJQFvi~wV`me=h(XLxpuRhma{cM(#MQO+0e@mNwUHJ9Sul~8g
zo4NDk<}3X$_7UpLzsJqIr@TBk>ZXV3g08&R%LBp;U5hWpT;n|3^+bxpPi%2bNci&C
z{L`l-b9p9<q(psZxyZkdW8vo1KU=!nZ7+z4Z9Q`DmeNl?&ILzq-ZD?%EVR6JdGg7v
zt?H7_$6Yob4!iZ2f6>yX;Vb@UaqqXRNZ3(0iE~X3$32b)$ETC~-}CdA+1htMG8YIf
zoSMRGp0ihH@5~OHRds2O9a^zgnNHr1TIc)m*WG(*E<4No(dwGFCy$)6RO>%Jsmew?
zP}Z8??ChtCvswCL+AB8H+{!vQov)dZ>(-`c2c&-QaQygd?aL?TXP%Z#d_S#l#kbkI
zXNw))UOT-jD*J257E_Dw#wQ<5)BB#KdE?!NX_|jcGH;aql-YhO{qK{6xm!g_?X@>g
z;xCb?nI`(Jtm#wX--J|qezVf88-De@Q`h?RE6w+Q?zAwDC#&yTSuz>MoRHUZVhM@t
z`x?ysEq3<pW3~?Wq>s<{;C+8~e%7^Txn90$CF{#~d|tU-{M|blxp|WFK7YD>dVa@s
zqq!LyH%KpDVxlc6v(_Q@zLxN!M{+4M#s2oa{V_%HSndCfHDdo4WS2gTU4L(N!ZjY3
zkbUAMbE|K^{53aZ{rA^XmV_?8*qeU6(kX^<lg>_$7v{#3Hytrho6E51_l4bTZ{N-?
zQ$3jaYR5j=RqIyB-4L6&q5Q>itCHQ@<L|%Jd3=>~hV#K_k>>YN`GvXnwr-cG?*81w
zzNJW7ddk^}_ROcwZ7yF^JMX2vcZKAt_$K2;m!3cUzV_Ys=dmB94gasoTV3{h&sC{C
z_kMi-kotSi-d5go`Ei#HfBy6*=f_|E+;4{~rRN=HkZt+)@NwdQhA$rLb9>bDN;V#o
z{`1#HI_dnf+*yzHUH5JK)cE7eT8%G@t=n|hoj&S&;p>zqUs4+8>?#px+g|4I{_VtV
z;U{%eEQE}FpD><~`m$`ly#cqB%4(Jcj0bK;6)l|i-|1ED>H@FT;TuZpoo}-#@439{
z=}P_&vkVq(_S3m}SLD{CZ{dq?rcOMczSg%`VQ1L9w)zc5N{_ZX+w%UuoTJe?ZTZ7`
zOWxqAHz%6$aPRSDoA_~ap_bv~s9B{GKbUM=lI0z<vZ331+m?cP8oCpHJ!Oks`1f}Q
zugt`}r%U3E7g=6fd`(pR;q}~yo-<`rW_f$cPRv_UDrCOW;J5g?tmb*UqRr)9LRlmp
zEZL>;&wFo2lZQ@SuK#W`zTG@bOQhRo&#|_hUV7l*M&=2>3T54b|NLeC_Cs(&@CNp~
z8P6YE?wvXL*v~ySbD#75xM^IdUp@1Pk!GS#@aMG7hdq<qo9-&TKhLDUbInJdot|^7
zrU-9dw?ZpynQQo*b&m2k%XDUyKRNFt{MX3ltg?XdPK{66Gj2~_chlyRSW}me?BAaD
zfIY|ZBX?y!c|UE*MAb)9NxM{U>5G*-73lL{G<lACpvS^1+fOWfU2YfGc0kwl>60ld
zH!0ovk-OvSzlWk4pTgh1XRm+1&uH_R8?hpSv*!lB=U-slARs$S)jO~9&7~_b;cI3E
z+N-{_PQGmsXK*;+PRgpRy|K?OT)%kjX4aCY&riG(vtz$&yzk$vSG!+rGPg3^^om_S
zZo^#eJ-_(Gxa)J(yRU5Rw3=43G|B0?*o=?2YxP<+eU|^KdiVAJrI`yogN!F^NqW_3
zmtGagH_fq(^L9(a#~``q`=4z8e=O5WZMv|}9^>1`|F*eKSN{E-Pe<g~!MVT6`gaz5
zZ+Td(_RMzvw~S{c1zF{tN9SmFAC1{~{=G>!v+Hviro<a2AB#fn#OSUS^oz-G-@fYP
zW|4&7&x2IDF58<f`mcBHljv%j`4!VXTrQg$>-X!xlO=tbx7PlZM_s@$ceDAY%j^sc
z3#1qr6tLYp2428Wl30|UT2ic6P`NeYb>3|Yv48KED@<Tj**<YjSzT{q*~E=g`vQ-1
z3YA}sRbCt*l*)aPS7qvr%P)7I+5Bem+lQ{^-hH;s>lzfqD)r>g&$V*?zWwt0Yc`)e
zPj#4bdz@Nqpj6VMSNtZw<LkYB5_1-MPJ5rR<zB&;e~<oJZ@D8-;u|q-QG?B7i_^jn
zoaa195xAt|xK3JZ&w?YRfm5DHKIK@RdCahX(-dBj-nZ$VOhP7&^B<@`ay!G@5x&N>
zGxnWYVc1$#r$U*^r}y@Aq$-4WpEbO1VwV4~bU}S^(7#8!ZM?2?7;ll`StOwQ_UZn7
z+44`Tjepui*GTaT*m%h<zoBlqtmi_|vnNsu^p5^o8<QV!Tcx%yW13fWM$z)Pte`_5
zKWnhPnHsV8f(n<1Ur<4p{KT$zR!KY;!k;{t_nYOoAy=18UrlDpl-3hBnZ9Xv34fY&
zQT>RqN`K=arM^b>HDxU)XBe>Ed?u;P_^IqwPjf@diCE!xVMp?MEEDh4hPj!uzK@8i
z>{!#^QMjsS`S+U=M+F~izg^7!g>kLi6-MJO4i|~8AkG7E$7iNX&6?1APr_N%(<WWx
z;J>rBTn`WA9Jlaf&{tiNz$#PIUc+-x+L2|s&ZCRQD<uwYcj}zWRAYTEj>EM5#bNf8
zAFN9s2rRy)C}-dN!M}Ufew()5;)fi;hmExt9)9TXy3;dj+LNH;uH5y<EP^g%pEedr
z;rPUq`@z^zB6PWVfI#4*&pq$7B&RsIEj{sL>H~%oJ&wg2jc#v$zj)FCHevM{vw51@
zSWLG~{rc`;+0B9r&+ln`eXOLguHfXp;_2Uf^_sYkYk&CMY$dl`uut;G)io35nt$+_
zGS~g<y^j@_%yQj2E(J-4>}w8k>~ov6=4J8D-0mcy#>2PmuBip9%-AXL>EbmRv$H!-
z1Q|*EFihjQ>$tUZzUPJ`A`RMsm+}%;b?jbu(nH4UGsn89sS(?}v!~r_(UEJGe6FP0
z!uh&nMZ_bG+M>e}>l-&!#igI*=Kpjrw|L%>McET(KmEg!Ab0c?%X)^%hOSf3#)Mu@
zWi8#gMc(*oefX1e5mUN9Pb>Z<chcVNSlvz2zRgaiY{%Rf?HZq-EfkW^3B1+EwY%0+
zu`K*pT&h@Sz+bU%f`UacRw69sXSz%Z;thNq=Up&pv})fwW6hGa=a*_I8XfBtPuL=R
zT2!*VR*+kc@zJ-wzRI@}5BIg@ADEo<naAR9&Rn+(<_Vhx%u-&oDr`I1Wzq1bStRfx
zZ>mHTPy0y+mPL8VQ`Wfpi}U_u-ZRDb{E}n&%S6|2`1*V4*ZJJ9)4xA_D<Agf{G5CZ
zk*<gKJ&BWT4_f!{kPG<}=c#Mh6goA<){CLCdYgfwmWi*Q@qB}f%G3%ukEZFoD<+A?
zUFN-bJgrvzF3XCq%jTx<tXvqXp?%NZ)$-6ri#zMCMH!iRPZv?GN@9<yU;gStSDli!
zno8H*^V}($4lt(#-tpaNkTcOG@o=eGiC}ziuk}Ojg`wBkzKG?hamYuNs9bxoBr0&m
zM)rjf1x#-xmOCc*=N$Z#vp*x-$KvkH=ouTCz6mkrWfZ2$8@6qV&pCQAJJH}n!}?u|
zrUb8(s-025@$lFS<>TCfcQ>$24&)3!>&5=$?%^M*IsBOkvArx$JJOXa?N-m*=2G^R
zOMpl3{HuF6^bY05dTU+obre-Mc++b1QEv6N-=!+*a_?CC_cHO_Ty;NW?~79tGpub+
zFw0p#S$nwa$YaMvHeZ8ElD_-0N7&D+dUWB=+R4*5|4h_NJTEp~;%QaoE>1zIYgf0M
zHN0PBc_olBKQ}aX|Ku4H>sHU5)42EPmYH|8#G~)7UHs8Uz2njj=e62h{lQO6h21k&
zdK^6%v7K?6kS&*Fnq!93!{$s0g^Iwa*z_W=LmAddt{neo&Gu1ol3*-4(J1%u)xA}Q
zH(pFK%t&4|MWY}!THDcit+=uJ<W`Zkb36-H+ztreqP1Q_GhxT~BP{FH|9m=7y7-A!
zylb{gMeoCPhu-!b2q@h?jX9^#D4csroRxU;S<5MHc?+8Rm-6)Pvz@q4%BbnBeoIWc
z+sl`VfA1_WD4Q)EUwkoswr#HdiN6JBZ?Ou8B^)$Z#rje3V3;z)3F&Q7%MGJ-=I&m7
zy7TclvB^KDuYBy6UVbj6ve>-%9q-M+>v!7L%@ICzRAf*2%7og(`+Sb&#^&Bu3Ui-g
zcY^6x0mt*2Z9m@JyQ7zG-hG*&>>cOw!`Uyj3g4d2=YDs!;)TxS*{^Tkl<9jPb5?Bg
z{+cDvY~AEeZCJ)urTxq$tYX<m={-(+Tlc^HFy-;LgO-naCq2!#SknAYW%?WKH^<9s
ztBbdnEOXeqV^;02qVh_qT}HFxoQoVv;!9S9h&Y9d=e9fzxEH3sz<+N1zM4r6tnu3?
zy!aB9ayKshj%D%lPxmbK7OKcx`SZK=_4||A^NiQLWwn2{IsQ(*!@s{v3^KoeJFI89
zB>BGbDZA<|_9C9{75Xh~_kNyrX*=H;rulx2`t4-@e}dgpuGn+9_dmFoGSyXVO=)>$
z(0R+ipYyK#UHtva6nVaf3;x&{o9tCvvHaZH%`>dJQ_p^{@1Au1t8Diy<~#OwU3{9a
zW^Dc}xUkSV;C}hP-_Jv8o5bQfCuZG~W=h_edeDNmc*&kF!@q_d6Il*tJTo?&FnMdQ
zoV56DPq&k)f-W}~FKcVIiTeCW&d2yd($T6(wQE#_G+(@twXx@&6`#290na~n)CK_q
z0|NsSh+tq~P{h_CNJ%V7)Q^wP%*!l^kJl@xWJbF$P0vyHw+Ax=gCGY3gECG73W`#5
z@)J|^z?Yl$h6d&@wh*X0zh2^^7q`{Qmvi&t%jOp~zFXwo*j!SsJvU|N1D5-YeL0u&
zLZ0rwpU^HaDd+nq2ZPUNpU*sRoV>5-eX~xV$E1m_HlLaA&t~vg7JYNay%tl}_=o>p
z3~RYsES#L<F4s%m?C5$PZC-i8uKKZm<c5}?wMEsx|CM(%t(S{&T=~_lc7`ACJGT>C
zYiCbebIV72)yzx5uWj#E-<z^)o!VsW54U&SbMh_L6nQZzOXH<6GgsE(B0udFlDQR|
z+3qcv`7o%HttfCqXJOG<_Dz8;wds|sB{d^lx35vKT&tBTw9Uci?GfiqUKg5df`6K=
zd(dSU>ajCxc1-cblCDLe7fp-zpSz^dW7oL($crk5J-h4XE}g&c&bxbz;TMFzcs^Nl
z@y%|wjZUh88Ub%FyLHt^th;*lesA-a<@QV5l|s9=X)O?xnisHy?PTcb2P>~?JQUM%
z<G#T3^EI#g-Q6BDrZ}yVPM`BowC336#7kQDe|}gN9CQ0elxF1O-w#aYJy@w${Ugq%
zA<**d`}BIYlz$VJIc`y@Z@H*bt5P?ksrc_N<=f|ea{7wdFZuky=xoAflYH@3>uXF$
zJLU(f#U-p;bnJLoW|%x*@ImhDs$Gk=tnhug@DuBrmYRi|44MLWhIup_m1!&foMj%d
z+xBprO;iFyTk8YPs~$#OUn7FHZ=O)he*N0jcR_pQ7Mijh`SL$~`;YA>J|=KX)0ozC
z?_bMziK>~Kt{>f?b@9}kiK6Rgy!vZlEpjz>2gjy5!9%(KXDuldT5{Upgu=ev&Or^+
zg)9Y{`6M4~D?V=`bZ)ms+@S{#-u~w1?dyI2%k<7$nG@48KU_bY!+4INY>%_~ygccz
zYGIns_;z$@zdbierK85+;o*$g&EfW4Z#OO5RnnaA$(7j7U;csn&o1_UGXtj|Dqr?H
zvVT7JXSYP}&c%iY=4Btb;5*ehM$C-m`g1FXsxW4$fWv{e)sD>YIk!9RgS#}_sn-#c
z5+{3W{=c?-Px$dYHz%9AmaLF9K3ZcPnR}m)H(PI#xUu$bOWwD~OqR_}|Hk#uqUri1
zxvk4{na;G|{CU!&^YfIOKfgUb{XlpB<3;klX7&+h<e2B5N$+-LdtUqR;~Go*KI;#c
zRG-bed#~`3?>}bLoV?1p%Egh1fuWEcvuU57TacNPT2zdjkxM5BX5TgtX}$kfo2B*y
zoA1kCMiOrnv!@H3*mcPyK*IUNx2=oaruC?(pWZ(|=jNs-E|u2L?`X&Ve74*1_Vnf7
zf3~F^5Iu9<vcQ*{>yvcU6_wkE|2%wWx6`qIk)3zcJJYHi|38WDearZlN!8-iLk^!S
zQ(rnuc}$)0Xu4XeiSw(NrA?Y49GymiSEn?Fc$mJtGp9yDb-`shi!70+s<T9cLSFD)
zTqPFN|8+A<@*#<1FRXt}R`@*I_S?-j*Ir$3+uxKm!>q0J7Moke%^BWT0;U<xDqHvd
z!{H-`R%vqmI-kAzHTQa!-rz+H-;<M+PM_Xjeb;}*As5XRL1o|8*iNXa=`lPrXOhSM
zmW|1+E8~?f@t@d|u5s}MkImy|nND^7m^l^yCmhU+ulu;|?4!!9(QE4RKIZMNi+gzX
za?$39-1dl>Zy&rn%zLhEd(67~A8+U1*|tlTNBYRyq`PKq%Vf69l<#+S@>5#cxh(R#
zVB)OQb%jzhQjacDQ{Q;z&N|hH8*kLSdC{9Iwtq{kQ;CA8cVCO^?v%wPI;WExtu89P
z_;ow!m-Ds<mR`~S4k+|%O*H2bcpBxh<LMHnR2G$Kw>GXi{yn(-FT*O?V~JU*2Ucu#
zbDAsn;|=fk{I^?=FDqR)$+A;s`n7TntIWuvO|grFnGc+MakJ#sB+FxBY0GQ*)=CCs
ztmSAnli}QA_2j+T&pY}@-`U+cQL6FQGJFD06T^uOM@?I|9e0)Zp~2?qaLZN5I=?Gl
zfQ_RqdBy9xhWH6AA6Px>?(!YXF8_?yvvgXU#v#Yaz@TElz#xrQ55SXOVsWlsLFHSi
zzy6OczJ32EYWJ2u)71C$Cgm-wwk&_#u+x>>_zsV98UMl)zH_b_cTV0c>&5?Z|NZK|
z&vT7hr60IiPZc=1`R~3zcCzh8ot@8HXP#5}Y;)+b$;4R!ibB4o{w-2GIy!+zC&w+1
z(cuVvQe(g&csNDKcxp$-d2Sx}N3%}59PxRvSbF}_j%*(>pX#(_&(#ZkTmy9c&#;89
zsY{QmPtLaH+Z-%s80lxRfx%ktv$URw!NSx{NuP=>-*0IV(LSaU7bqGmS-rvK^cnY{
zc}(Y4#AsNbxpd{dY`)NyJqjgtF`G;tC|b^+^S`j{iR_=Mk`K2(-mX8x#!?p+7PfMk
zd-T_tg5vWXUp%Te{9T}%aptcu^V;+I`G+*WPLJ8poO-DCTGBy(mlNV^XC7DbVPj_G
z`cUAW^iMvS#qE<MN9l>$T23#?!=E|BpZ$E*^~WiXw@kfPL;PG%Ok8jA0ls|}?{>>B
zZ_u%tAg}x6xX`9-MRV0B%lTZcDwa1NJkY-)=!x!!xHm^OR7gDi)xRPlrQ~2kJbP*h
z&lL8nyBYsDOp98cWj5EX$BVK0?P(X)g>J@kj2@<Cy;}bAN_nc9gXbC6soq-GgX3R4
zy2&f)IzNa_l_zJlv+^7dmengS9(Z)X!^YO8YV-e(PyRgl@qRPUho-_aa}6^Otgk&C
zc|T#zy6#lpFMoeDS95;pdnVGP$9Z=lL$Dbq<AUm^3=`zPpIErNC_-!RnQJF=W-*jV
zUAptMO=yEalDc?I^}T?N8ZyH7+1-;i|GL)4xjRvC&(;OkA6$G8ZQQgi;8Xm+LoQW?
z@1`0*GO>}gc=BL{sKniCFAq*U&bwqbdx%u5Rqum`3-0b^O@5uM(5<vSWm6l|P5o(t
z>ukR8ZFo~T$%UcLS^4Oi!w>yaH7g!v1Zio72d<nNB=~sOiJdLU+6Q+W^l>c-31oab
z+hFA$(d*v)z8eyj&0#6LdC-ziVSSi^<->z(6!%Nc4nAr#d%BtlM_X!;lvVNjs76Q2
z#ewCq)4PjjZakI5lHB-7WLfzA(~<_qjFsNS_X=spsWb~HMZGp`zm(y6{Zz}8tlYD^
zv_$G=C05+7e!JjDo8y%?EFn9--<n<QE3txu>CL*}>%qy7y1Er2S3c}e*<|@>y|{se
zjOkVONC)LWi6SZH19oq8d0NjM{dhb2!P|AS7_MDdBpp!6U$$jR3Ul4_lK&5`mzUn@
z`kKsGHM>A&?w*xx0aqDXdW4&Px1Q5g+Hu<TK>7C%X7QEJV{$`M)_qh{?x=9OJf$;%
zBf{qWv*)&RURW;PCOhNT;zag<n;r$Tbl)6U#PCo5jMRfojhZJ*X1(OPJmZM~huE2x
z6}bV<0;_aa2cBTrZ@9yDZUvLh|5=e*u3<VK^OiBsu-;tgtySyH;MnrwURs*-#SM~W
zZ>|+Sj@Y?DR53kpfx)BQE91P}n4jle<7^Gk%G5KuCb8j;NHqKTxqmkWM|I_04{hD`
z`a?(T<_znt-^H`1$Cj++<-cJQeMQot-8n+;r1@o5+iAhlQY+si1b%L0x}`Y3Enrrq
z7PoU<u%!NlR~;`{{L&3y%;Btmt2-k@Quo!Imo{r3Sx>rotI3~#ZjoTr(U<mfr7q3l
z>2flQuAXr6&-rQJv?k8q+u-fJE9{x`vUQ<9`Vv_#KVM@X<Ph-D$>Y++Sq{?EqIFzY
zO)lG5Z0QXN;xpW{{;5>kxqt1!L0|lzm@OCj<9ctRLgFcb29exZ4Y%#Y-kmsj(|wY?
zvq#n&XD-P%j2oAyGR6D|6x;CY+tLvIwZ9G=yAqWtmY>+K(Gq!!=Oe>G3%kN9vtKt9
z*PrQ;3SP0)$5?-<(4pyVS<3#8OV&-&kiT%cE7bbr>uY6qlV1J1Z}T`XVAi>`K*N0>
zAFxenc01@IX6$JyZB{8+`bcj7oVQLZSYjLQ-2HJarjAp@VBNFsILG_;jyu(rCK}rD
za35ICGO75al|kuF>)leNixPyZFSBgW-?S~#oS7y5@`<P>#f8^jZi}l4-BK9w_>m)P
zMFV&3$5|?${m)##;Lbf)Kx+fbS4Fq;%5786K0MhOt8sI`v7Y2b?{x?Mex2l~$Ru}c
ztFY?>ZX2ZrhE25z;uYdCbDUmxXY4twap-yT_vi8oIWKhPmZTip^uAvFMpRw>+H3N&
ztqX7J=-s;P{W;8llZW^1e<}aPs~27UxA<Px_1}5k*7<9$hbI5M8vKC2jh#bu!{Q9L
z4MN|A=3bLwF)^5AuxP^i{UTFyqA$IAo>SaB^+)ZS7>`*(Q+DJ<waIQU+hC=(uu<uP
z)rXMgQb*2Rj}ij4Pns&5sfNi!g*D_|bh#>dCi3-;=;s~0r@n<te7w_S_e^lJ_KUk>
zw}Y><&5q`Juwi@ttG1O@wTwzXuG?Qf#j|+5u62i83e&ICeA~*-U)Zb{5h(dCFZ7*F
z;L%4>n^(RPQ`q}fP;7@`_d&O(CTz_!j!opg{qWeud)e2c`nhi(iaF_|)>xeu`@iIL
z@U|VLr^MXX1_ZFw^PK0;N?ulX@!%ib{H2OVbtW&kse0PA?W%x?kkjSa51%m!^Pa0*
zDYkc#r%K=^k6UYRD$m;U^5}d2iw}J7=e+qaZ_(D5Ru?C4)wx{%@%P*x)qDT%z4zbj
zb?q8Y?E_!VUuIC~eKdoyf7<6)`#U^8`@c20ZSmk;g6n@-8@0_rl8@&{JMEhj_5J>Q
zJGI?RQ`0v7b*en`H>&bY<av$#A9=nlb>9BmFCn34#sQ6~|2|c-{pOPF`JZWg<9o~3
zP$4msJ4#*|4cEhbws8r?`_ANACV%c;z0JK!+pU@}{`_Du5}x{dtJ?Zq_l?xPFIjRz
zCns&;^PevFemKR|D6FrQzyI!Y#pBmMF4xQGn^?ZQdNKT;TU>79<U22xa<{F1Ub>Mz
z?NHRDDj&Ho-^<F%<fi;P*YEkR{t2h>!{+__MW1F?E?g%k`)l3J+K->E8nbug|KK~j
zxvleE+_yIFKaz{19i_iaIGy|B^n2EAr~3XVB}nhM&HiU4KS%1$m~4TYF@}3~Wp8>J
z9OyRn&Wp&pwZ{W<?^nEH_#!j+*kkUy$DcL)W@0hfa`;~3vE_>%C9S)>ZrASX1>N6P
zT3(5kxyrlo@UOk)jUS6oZ!k45v$L+cx$hP0?3KUEern9ytdMX}vTu%T&hEz**MIHY
zUi0|xyZ@(c-C6hEnfG5DwN>wJ^7HUNK?Vku76t}MT+OOvP@~HBcF^q;+uql>%2!O7
zyRp@G6LZC};G-6AB(ppY@%g2d{S1(b%(^XA^6?t$W9N^K&&|(GpSyKebkJ(u(`=Ij
znpS$HY^~BQT_5*-Uq<_!`FnqEu6z}7r9b2Ik!5vndSs-^PF%dQMQzK@<=eNFdFanL
z=bUcSc`|PG-s^X=-){A&cRCp@#cH?lrD$pMO7;UP%a(;R{Mi4Wb;jOsj?er>kB(ny
zZGULOarOr1pS5cPB`S^>xOvWLxnj`q_~7OlGxo_JS>v^3tLmvHkNLAcs_gB39(-J0
z*jTBy(d~NhhlEp(t{Zpw&fk~5egEa1T+enMw9x&$A%C5*&-{)1<l>{JFq)qb<yHQX
z7}02M>a2A@=S63JBJbgz#}_2k4A0)XZT#=&$Jp~0ufE&Q`SWRGeT`m&&GTCymG92+
zi=B1N_Rws(2W2r*`;Kz)2A0X)7Sz^oie6Vd)A76CL$%hhSCJ1(!+7haU*EOu*80m)
z^@rZ8?pSbTQGn`E_V2bk^w-N;XYT#yS;=esWz)a*xTxig=F_r&JuX_It?uPx-X(mS
zbJInu|5r{wtme6)%P#-hlk4m1`A-}wnzzJ7N!LAkQEhO|*!WAMB(JfIJMX^*0bxfT
z8W;*h%<ws|`-x!ohfDrzlAo_h7G>_5d)m!GE%?^Qqj3S{5^9q1a+`M-y}4XymX*F=
zPtxp_YuF2)<X7nun<okRea(<zGnR^T+nKXe^{IYD%ZIdStap+QT(<Dpalq9?jJd)8
zWl7dlyRaFTdi3VbsjID9ZE{#>`_0$c(JcQ8=A`p!b*?zbwdchtt!XLF8$;P`&6H~Q
z{(rwYdGYt#h3~&lF5h1kv9w6{t6AsSh2D<7fwQyMnD>c(e;%yGe6z%>_QLIHlV8s?
z&%7D4&hxLf_6K*rYuC3gcqlu6-jBr&E1$PCp1)FQHK%f7%;nNQ-U?n-XXEU@`<~zE
z7r8Q~-f`(Cwl8Xo5(+CHG3{g(trpIT-N*ZeiLtHo@vY3G@gJ7)FZOx7mg%pg^uHvx
zDJ7dX>ArH?vUy9C!JpYt4bNVDxnl8tzh(QP#xz-(EZ#+t?brWYdL$lq<5}xlv;A*A
zpJv?s=3{!b{?F8Pu}?bc8O|v4?s%!z_11BBapCHTfdWE1l>7WIRdKaEb2<3%;KRh_
zwI^mP-rb)itEJjnz2Q;r)4KSb_6=-#xs7?9N|Q1#MXg`4^iq7OpX=;CkF>8m-0s~o
z4@bG&4Qyrzzra_bwPy0O^A%46eu%e!{=@d)iR)j({tQF*jwed1y=K~~DJUOLlxX4N
zyWF`VX?wQv+r{-S*^TEfX|u{Vy1CEs%l6w*bBp=2&L5FcHqV&0ZEEQyhNF*;v?*G#
zt>Un{&G^u+bWsI^?d}YR%PY9cy;gpZl8}_LIMH^zbwTiyHnu{g!(7c8uO=i4?C5nm
ze`7v#(QU<9Do3L{b@gW7;9BSGQ@%iyC1iKQy}jHuQA{>oG1pJb(ph-m9LI(#zb~>y
zOgs(?Y!xQHZ?FH(VNm$~O;3T@tcKNTyA(~|S~8~k%-P}i=D_u&LiZ*WmZrFi8i!{X
z&4}~**mFWMmRlv)Kxk@-w)(;ah30=RYLx8MzHh>!x%*Gh`P&+&T{bTKIw#dZS+Xvn
z!NYpr(KiC?8y6`QdieP$GBU4y$u7gCYUC<D^TRaD>4uJzBL(85wh43Hn{>sZpmWJV
z({Fw<yZ)q#X@sT}eemf>x2k)qRq)1Yr((nbxAnJw8RiP@{y*`~zwPT+u01;KMcW+<
zW|Pg)-nYXt#582$CWme*;SLcnb6F&{p~sN1ZQ(+}vwIUCbnWvqioK-pr*X&3wvs0?
zpJ#V9wufoBWKIyD%5c3fV^gBD<&PK4&O9?Nh#cL${=3h0*Uh#P8LO^d(&O5yuf?MO
zd-B<8M<!M!-R)na+5!wh?Hdac4{Tw-tSD66yFoqRx7%Zu%T`TA25NKe1sv+=X+FZi
z!}{lV?z*iLQ%&BsH9vc5ePB%<lg!u4yzXVci@*6i-7wqfd3pQ-uEHc;C4v8n+zm3f
zB_7XYU{$*15bXG<L1n?MNW*-Q%8k(uTORk+q%4r$diG`fuLsAKBraT%oEo_(Ebiks
zF{{{9KMxglW^LrFI$`|yR=0T1mC|EBcsqM{{XD<wV|c^@?fV+HTzB;EjJi0jdP3AW
zE{3)_0;<6q-j~K6oAP>xx7Bg08}4srOsvWXxZIF#%4;$uO#i`^$t!b@Z3&Y}SaHX5
zaq-_|7v~P&ipyD2r|Mrlyi&aA&b81e<zII!6BYg5Eld&gPgazebZ2UM`l+27E3H_5
zCLY+Tk+tOfGtMt^Sv!oY&-hea{1PUSc~a|i^7?H~0?O-oS<@aJ(@8UL$zwVFn_Z*$
zOZV)0i+@vJT9p-N`EI%MH-$;@@SP0Z3zM6>wI*J>6_EO{b*eyhs=yQWYc9*&x4bgn
z7sGkp%5v$pm&g0IGD)*0olllnVfaln@CmE<_IQ6yM~ky;43RGEeT@fh^Q8qa-#vFo
zINPqReQTBbRoAOtzAm38C3)XAYj}R*o2#!F6Kmh03v;-8w>h|c(>uRs$s%*Ms2frb
zR_P1HSoizhH*=o-=iqNvCj*|d0*`Ap)N61Zk(oW?p+=xsP*zgsuNWEC62Ic}B09R=
zi>-?S?mn1zdE=WSt|tqm*d(;|LwUUC-U+#)GO=k!I1kr0A35O(2U?1PmCt1ANKG|Y
ze6MqZZQ9J92~NxMFG?{O*@iz+sJLI>DE-*kdaF`>!eawXZno{qOcy4FGtX>%&Ey&x
zwX$cCg;%P|Rh3y;y+P$)6jN$fq&RGExS@SaacZCGu|+jDKcWM6x_iYQiQcg7f=HZn
z%$k>b!q)Vz6cQI!<;igr5sQDLm7~zBvM7S%;3uCGfiLDBD_ePbp_Mq_r;TZC^Q3R<
zxUPO05h1s~Bc->dzIn?2%<Agj<^iI5svlc~KE%75u<#3hIWpmxu~%(hhqLesPdmpO
ztchIu7cHmp=j=MhpVn}+^Td5m5$7MR8H<-zY>bJBTa&_MGxuYQRA<Ytt`j^5Ix=rx
zxpw(m+L9B(M=dp{Jo&gOubAoi&h&}%Z%!;onj(;@+kbhRkp0KD8F4LYzh!>+Khb{`
zDV7=c*EP*STFAF)=7ILTPqt_uQZ5sleMW=fN}J~#rOd9bdO_<2I#X7@X1Zy)G)3t6
z<rSNETbDiZG&-^(vD}J3=lHUlSId;NJ0%j!<KOPTm+bS7)#1be@fkN(*JU;FZFq9b
z)k>p%#;1oHZvEaJ_B-MFt=(*@tcxF<J7ekM8@}xDq7VU=j;kxK1e(tXl&IXWXGTEl
zKhG;ZyU+jbO}@LNZbFZ`>!%Ovr1pN>_wnVA!#_{{F1HA<FTefkH1pr5_FKMubbR`F
zul;HHWap##_XPgEbKbjjd(egHt{0|PMc21Z;5eP1a^V|e^W7GfcoP+d*)58-*FIid
z8ReU__sTy3ZWXf+cP(Ei*tKa$@GM?&Sgp5o?YeytGuN+8ZDfDG)_HI3ij`>_wuIJP
zvR?AvbIycQQayj}s7k7-3jB=u7*M*(;X|*K{#q8HITu8)pJMPfYMqvJXiDU*q$9oW
zJwL1M4?fOXdt`OG|Gc>jc3}arNBO_^ZohgkT==2T>RhF_%f&M98~$xCRIz#V(XfB&
z>cd8B?rQjRUu%pz^L?iO^I5;xWS@Tt-oM-|Vn%;%@+n!Thk5osFVy(z$_hUuF|>DA
z88uH`_aRe6{GX1C)UlJh{oR+V=l5*Bmp>_eXYahH+IzSD{iAce__Uh$pN|V-KDFu;
zt#UurV*8qLzL)Mpo1>n(8_oXIN;}U=)|R+*Ywm|h@?pEq-;`I*6SI2$Binl#*EM_j
zPfGWGsqyajJZyjD?}O$^x>MF=PCNLQcVWoxmlaE+wmtY8TCLYm{djxL#Xo=fW?Ft!
z@kmN~WK@}TTjBPZ)?<G<#U@WQ_H#OAyf@%&x61$hi{I=&BbngWtFp)_JRxx3hc5lf
zlj2tEBJP?py?AD_#KFAVP0-jr=`YV8v1++53nc@WEw%Vo_3q-MRd3ELo;oc<KP`UV
z<mO+tOT(5p#zw?x%y@8jYO?jS{B+x7-na>A{xxjrKFelbU3*`@f63!tOJyCitz54k
zO>&kIoql?C<;+J+Kb>wl`^m2LvaFrDCun25wy@XBGivukCZEp|GrMV%|Mri|W%hWd
zg6^D;8JoCy)_J_ys<QFGNA{Qe{}}3J#Gab%y1s6Tb&AUkm%DM^`CG4a?)vlAX}iN`
zgP+ymcXHci>rRXa{HwlVZ}?rIg`aOp?v2Vky-xhwqdPm7>dSw;yFR?9VbA-OMeP$a
zF4g^VHe>NmKE=2@R`AAqj*n`4YnZHK1)bEMiK?zM{m8_TUHH+%=3uLl#Kebx%&sfC
zEGd=ZQE_%E+#bAbiHd@87k8M@b+%ZuQrXj;jE7GgiM%$$y;6)tplX?4LA>j(|DGDo
zd#09!o{-jjw<UJbj$o&|>o+)U{`{?WqAve|JDK91;xX}lm8z)<ZXf0^lWu&JKK)JQ
zzUY9JbF;271zs*U-P9{8p|O7M+ui5g8dXg~zVmSWZ+UBQ?(XDIxhKxw^!zz*PtT@{
zv1ZQaOZ5DncFzsZ`J5d5hAS$28gsD3=IQZiml~J9Qp}J&TrXH<KX*b^TE)&JwuG-W
zEZcs)tGGUU`3~!QhkA~7bxv77<4yb*;rDM2?LBt2?5f<I;1cF}=bV^LxBseLV>RLI
zt(PyCZ-2e^e42ZqN$mGir>Cdu%j^z}m=+stq3saWUTeoVZ+oZvW6y+c)r%EtxNmRj
zNS|bKQ&V@RwZzLD(~_k>^rqiCzqcp7aM{~=n{!^D+i<tO%-1d}xwf%-PpQWIQv0L3
zHfz2<za-?$qBZjzC#L(KYS9os`e>ug)uym*0?V)GX|F!S|8;M3j_b}{59ZkanKduF
zb9q!rs<-X+9{$tY*V=QNZ(H?GN^aem$gInjrShh;%hdHd_5V(+sP#?H%suiuTS3qB
zoV{y$&-`PoiUl6J#>>7<{&2x=bMUmpTZ-<2oNiCvF8?gY=>BJcV;SQ%=A0vw<~>TA
z|5o(ST?ZZEqthmOTJPE<7-VZ{AaCBIny($R^GmDH;sz&8g%c6^yf(k1w%X5-`x{p1
z&`@pPJ*B97QH~i~N~f4yOwHzF&JUZdZ}htd2=t3A&Q0#w7CVbUwr5N1wx5d+KQgg7
z`X<asx_kA8%6EZh?ewhQeUR%@VhR1T=HlDQ_g<FGGdFL)U_CiCqr36CTgUu80^y%7
zEZ*JXf4E$$V$DmjS^0OPs{-s^I|hCas_hi^@i@6?*OAAqr9Z-**B()0D%4$OlH8uY
zG_dT08pGn<a>pyoG^>(keimg{ioK?=xii_f;LwGl=8jjl4gOuwI(qo*oYkeDa(4fB
zTK}rA(=4>#oAvahT;J1IpUhp->bs=h?r(|x*T214Z}M&OrXTx#QEY!s$>-qC6z!9L
z8eX<Oi_+?soj#9!(xrzlr9;1pgj|hUxWHu9Qm)MQJ?slEY+QLo@JU+THZJ?5m}&Ma
z|M0o*Ynm;PAucT&v5@(CVBL4CqU}@OoDXZ9_Is1--_C>e*R{M~8ooGOx`3a5`qEEN
z4hqDY85sX;Fl60#Ao1&*|B26!-to0!Re8HjOvR*gxo6BVwd}WSQjB?R3#EDfzq?m(
zBl@eV@wQ*@^L)3dIV5LQm~@>nd~3v`6}R#AiVd4j_NX7?XuQ_@EYQa`FG9<Fy`qG4
zW$KMe%Zp!H9~ZOVT&8YzwqNvfiQsPr&$RNV=O^a8dG|f3{Au7_7N%3ut9l;Hy(XJ`
z=Hc~DbszhpDSuz_-|YRPE3x-`{Gl7R#=_-FH_Zft*dBF9Rz^sQ>|eOmu<(9&XRv!&
z^0O)CHa6FO_g%d$@9(_u>(a{{zxwMX4!U*f{@lG@=ymve<NsVYH~I#>G4|!jX==<*
zDsr@Fs$LtmdV!T_>rQ9856bO7Cmwgcylc+J$5(F#ou4uHhqFuk0)r(xZcXHQ$-&Rt
zKX;kwIlr%LtV}FR%?_Vlo~B!~cbe(5uU*GD7F;))@I~<amTwo^w{Ja~U#%y_+~-$w
z`Lm|Zje8OuPq{aWAKQKDyzXzO)h~KKd3@V##B}m@m-v*>tL{mG?pLO;^ZLD5zr%0N
z+T+jUPZ?e6_g!Svo5gWIA^PX_;yUxLimgg%@ed>BO^sZ-$Xn#jM)M^<61$Cc>|fsv
zy!lYQ%luZ};<tA5w?+TD__}vj^}JVoYaUlGleaxDyYEr>h3PL1KED0Z%T;|z%SSRN
zwEnL>>Y&luuKQbaSQ!{%#TXcLaSj^Ar<LX<mt^MW#V3}O6lErrmZXA~eD00N&A)9X
z@NZsxVL?NbU+nVCTeSt#a#vp5%Wykji{^!V7TrLxz%CJuQ+?u3_P_TyY4-KmiK7Pf
z8-4G6zVoqSkM$>+cf!+*JGdpK)}`=;7)M;1<GMg)2Fvm(0$GQjayf}^{CU$-<ygwk
zKc9+@p4C~Nt)=RlrX6`^O5DwZywP$0=G?t>Xhp!uAEH+i4_(h`3pW2!rg>#jN>fp#
z@cm`^`Y)LyTNO8o31sy=JAG(F<gc=>S!SI4!VfGt<cu<VwNj3h9M(HrGHY=n2Sdb)
zoYg<I3<X+*D?a~vB~`cB`|Qkw50z(I0zW)nB{kz|-h=6(UOQ*BYW+Q_yzxwko506C
zCR}%!wcPGz_@7~&eW-0V%apSFs|+Tr>Nsw*B&;OM_T>p9lYZ&uW5u04(H@aUx=Z>m
zWqG&WbXs<Gmb*q;xcIy2ic=3BwN}gS3y$yGx%ZUGyZLdOGuU=apPG3sRjY5No7t@W
zkA9Y{=jAPkkzQpwHO>04>U`Z3>*N2$P1ybWw}1Vf|3&{F8s9neSkmj@3@*RVA7zd`
z-YC66UXOQIJZtvR#hf-xY0EAM#oa#;?3?CUs_M)a?d>68aVeoiX7S0CqUJl7_ime-
za<O9HbII#dw|1_nDfoNr<D1A9F3)rS6YVCdHgJ2VYG$%u=M#;&def|Awy+-S^fh@i
zWiu~VJeqvcF#WA*M)KpfV8ezwed`|Ukfa^fYd35!ve~=SlCkHK?-o6$#a}XIRF}=}
zOqr#9_UyK9p*v#RJvcvddVDy%yZrily=*~YLmT&s0)LLZ%qkMSuVU2oe=~fnY)Rms
zd1<Sxf=bfD6UJg}zkfOwHe9l?Jr{P){KmIu25bEzCQi<?XtPaNHm%~!wv@BQ`$Tdq
zV!2;^JZ6z6w6-hs(&QCojURW+XFOr3oK(mecfFm_X-!>$Y5uGSnT~gJkIc5zF<pHB
z&r0?8-|PIpCHu!c>SonSF52L%Re7J=Yx$PXTXwx@H&`g8r!f0aj#>6+%aVrW-m@yW
z!h=`L?Jt@Yu=kT_$dp`J+b?4A=hs@u89myxW3I|fr@ubelee6_(kd~HXQQX&oa6kP
z4(|{)wFzCc<~d7VwLHJHMZqrBS}FcO({sFK(hE21?>G?V&}nM@K+U(p^VS24tX0N(
z5|vk;&YTx=jN9$8^6k{+?LYNPzixkds5|bkSLONMpjIc-@^2?jY5kOPwzh~`5S-+s
zrOB;m#h-dVaHYZ5Vx`cNb%!2#IrJW0w*D-qh~K?*hus}-x9!|g+JEC%#JX9L3$5R7
zd0Bn(m3R2ehnb6~W(T}=X?lHfL+#0oA8X@Yo&I%u%f>0reovg2ty;c!<IL*gAuk>Z
zrnl~$I<@WT5_PX%&ifg^XcRwNSJ-P*aW1(d;!N&xpA&bF_t)1cq%i5nRV=Q*t6O*c
zU{tL3>UZZB`f6*%9_*O#y?p+%mIc`{c@{5HmD2AYws^f@QpI+wE2rmpHcu;;*VX?p
zVa4tTZ#it9i*7pMpTXc=C|@tMt1s60`W&<OI=mCqLt`u3Tz0>nv7^AZIJ~;WH{nk1
z6Gq9NfDW-kJvD3PHvJdNcq$}kyPmOCN$oWk-+{+mAAVP|t_wb(w`tuYhPBoCcfQ@<
zQ*`J-Y~8uW!`pJ>s-ErMQf5)Q;L_af`@D0PuV&Xex5Y@}g}RJd{AW4ah_7u~olDa<
zZ1dVzxO?N`C1*HUb}tQHw1oF-<wrlmIh?K15oaGA+xWfe*z>qTn~SCQll_)1d2PwA
zsabw?MeM<XMOxSRuiaa|dGpch>-WA7cwUfxzehpWV5`351s&l#`=)AskC_&<Q|L$d
zr71Vlw;eq_ed}}W_1o8ZUC1zOI{r^@$M%PLrRSREck=D<%zs>eX2<{cP9Nsq;hT5v
zA1i9HExhUWon>YW3}4<eV64T<hppgAhOt0n{<Uw*?wD<QP;bk6?4ISDzUZFEXXY9&
zj=XE#rK5i9#KwMAb>r6`6K~wj=ro-D#(RTm`JSo;wY{~Q*77s3cx<p&QJs8qZ*AY&
zJRuDcE{BBy@fAAf;_d(6{ugOBv31h#<-w6xZt6_F+Gr8AWU}_o|2lQMzDLMR?+%?B
z8+Y~5&CB}p-r86HdNXs!j!BP}hNLPk`xN!;X%gR5SKZ4y!yo?tlfUBg8}Bur^B-+l
zk;<pP+BI@%X_#1b_2yM`x>aWCzD`x0?2=Mk5#GH;<J7FK6?<(z=hzs=tE)Qvig<pr
zLd8o||I)846|Ky;(@B=*_cup{l}0{0WwRo@d(94!l|tfoewnPj>^V<Mb!z54J1I^D
zce|%en^O%H1C~X^=}zXn<oR8>@9gZ#xVW-;idz|;e*0W>@b8s=U&GH;8`K|s_MPc}
zxlk{@w|>&(Dwp$qU9Z<@ajX0}dAw7_Kv{0eGxMo6v3e;JSCps;JG=?<bAO~G9lu7b
zNJUR&+vKp-&m&nEoX+~{9JXiOsUovm(o#!I`q-9-fB77})9C%>S4QVUa_`Ac|Li*L
z^s5!Sj(nWm+5O|u`}O{l9_Rb@?YI5=?ltqFRj%!xk)A4he&_8u^J%5#2ho2!8kVKl
z3Z0KXA@aPZsC)Z`nw@JVrZp^|V|42LX3yTcW!fhnNj<x)vwO?c1dq*5^Tal93OzUB
z_LLI01G+QQkFrNbn%tYSzmD;WMZ9R~FT;R!vHyOq@_2spNzc4pPj3f1D_7No9^xwF
z_EYUKU-QiK+L@QnpWV#r@0w-kRMg=tqxj=fZ4|H4cV82s$3>Ao{BJL3?ASg%=7;Gd
z?wVgOE-vm~?Q?L_Nmbp8Ce0gHGzLD{a4A{!)J%`hGI7QxOJ|;FU$iH%T60V2@kfh9
zvUWaj)#s{A_U?DFYJC~tygZ>`m1QA^A=|fN;rFsnS1tK&Ffk!c=TwpxcWvbK;K;*Q
zj%^bD!8euFzEga)#D;sfcTaj564n`YF72lKflmQ7UF#OSzbN{Df5e6P{qi5roBxPE
z*8l7&%m0|=-8}#OHoquaFZ2J2v(`sZo1^v(k|LEowJxVl?3@*HbJ4Wc%O`)RFI_n`
zEa*VP;ZH3S?=<JzJrGem6r5#s{_Ff1a{l4JS{FU5f0P!#j612`fTuDlM(?t>W|qqK
zHm>tKpZ?NX+qz3@`i6g({;0)jE-()2i<`0QhM>%+oj!>x@)K@cR%&`0=<`Wcz-ph6
zPb6#oLT#=%k2l}Bs=6mIKKbY&V_#_`bl~QL)oauZ8EPkn9`KdWp7>G4DA$e4Eq|Kc
zXRCXM)2FGh8>p84zqeBA1&49T&J(KtJ0Ab|TfIc;?7s{l*$&1(_ELRcm?Z+LjxclA
zKl@UCX#b0Px&J38tG~Napyu)H>||}d>7phKlJ+)re`o!>;PUAGeHXFzrzWW?)5JC&
zPx|(J`3C;KKkq--zdZg?ef^?JMs9{{yQlo#A@m_Ub}8$X)<=RlZ3c6n?Rc=<nK`Yc
z^}&9rvd)`H7a15I`C11kF|Jpt5MU5{S=6GvjeRcz%gghZ^?#n9|APN7yTJ$l*bDLt
zCcb<>g~8|RDMSCnr5|3LnSJqKdR4=-bC0uDW>rP3eD<((ma*u|?#)*Eq0X5{OUhQQ
zoSk#*z>nFrAA_sTet6++oEY{s^rT9}nu46O-AbXwRXz3YzqYS6GtYm1FZl*@O4Q8q
zuG>5BGRMuF(b=DUZ}x|e>^p;+AKp`8ytQTK^|x`a7f$+mVD-PgXTN?g{1Jbsoq@sp
z3imZ9!7RStx!wI*OAcBVDn&8Q(z^2Z_FkL)^VB0(b8RqsSH;b%edg$7?He&{^M5{R
z_!#G<z>y;?8{)R;?xhv2{|k03Kb2}aF>ke;(C<ZC{TY^9Id44vaM`TlzVJ5Bhkh%j
z6>}QB4LR^_Tf{Y9?{?Pdho7~|NJhwboqP0R_2vB!_+8J0#GG;pYdFeP`83G$#y^K|
zYZv@Kx|HQ*T56<$4y(@Mgv><^%T?<A)imOG+CJW6`Obet*xJm%yQ^~Uy@fMwnoiyp
z`SS3;eM+;E?<{wSo7pvc&Az6*3vSk`6NL)n4Y|`NKHK=RL*XZ1*~4bnP`@QXom08l
zoRwziGC0K>r5@BsG-!V47pre)QL8@9`A(U}ypA@5>gwnD@p~-(Mi+h5vb6s7E?dKf
zb>c?rj}cn+<_~5XC{5z&oIT5TwZQfFFB$hqb!OK*@(*XQYOgz#&foc3I5dB+gGS-E
zKSys~y#D;adj07dS%=)JSwAtAajN<4Y46x)`|H;eo62gwL#0WlCcoHNHsS08rT<$+
zcE)z|youkPn5?Z}HJL$8>S%OC?bJO}<QFEWCff?Kg^JXF>yMb)Tz};Kym$Y9{+;}=
zzGeTv?HwmxbUb+^bxlH!p+sM$<FpCO4MEZOvchpEPcOc{{-e*OX>t$tPun9<*n48K
z#G=Rh|DLTsGrOYX&$a3`<y&7|4gddm$LA)+hpWXlq%H1^tI#ia-7~Mc|I0q{+WL~R
zCwnjKPWkfe?a$W!RW}bUdb~fr=JPA-|4SE%KmWDxLibvoB{MGHl<Rx3<yBV1icHhq
z#NADd7ECYa-4s71UJw^~QOn}qaml8|7dQ0pzu@)vV&okALz?^dO#66GuE4*X_wj9J
znMn(8{4Y;wtZC_4)bVegvuDbp5*K$%`P3+@x5C#mH?J*WN@uZ>y;5^z^%K(%GM2It
z|Aeh047HnfGAao;#)wtKJ^Z>RLW3=EAA^vBK}fI8w5y9)q!zr1>T*?07s^mrkT2S`
zJL=u3Xq}Mld^!296OO5V2-@0`Ia_P<^0jVGr%yKd+jP73S#z2kRx<h5&t%$pNpGT&
z8e^~YgEu7;I#0GVIF~B!yHQ;C##;3;&yoZECNj=)OMF!KX!E5Vn5*g|S?tsM@yhR2
zR_nDFl(;aPv&mH@OgQ<#qG58n(#}^N6{hXHVPB-KDgEtzSzooha&6_p2BEJCU5g*?
z{;Pj)cWlOtqH1>Y+7H|6&R(0%dHum%#v79)zkU0cb=9f4@>gK0{prK+6E5<sRIRe}
zoyB&1HA|uSk=JHBw)Gow@NW^eTJg0c?Z&HD_K7=8nqFsKc#x^~XaBJyue#=JQ?AG}
zn9K3)q4}lOX;b`<&;7nlJgV;Bb&1|>8}@(Qq~m$8>U^r?v6EN1BUcqw?{7US@v3sO
z#Lp9-ve&yZyLPvIv{|bjF17XCveH1^(%#)Z67Jj6tbKRyNnE^tYvujJZF87k-@7Ll
zY1p&w`wuTayFD$<HyLzQK63tHkJ!-q;OxoQ=Ii_X&jtGRJH%aNH<~8X7r(crwyLaY
z{g#eH=g<4?|1BoJs7Amsd-_qM#=|-#g8h;27yXqvm)Uw|e@$D{zdF96^3;9te#W0g
zSFK>3&{w}wduA}NxBTD6@>D%v)gQC;vbif~`u>zwusExK_H#+sDfu6)UuLa--Pu0R
zQSaKUAh+{>lvsYcOA8B1PVr6b-SX43!pffGvRy>SZq4is=KFd7efe$Mm;TLBE#vu&
zbo<G_tQ(spR@z<MmiT2}MbPp0>y8yqJbY5r<yZOptquRL{4IR>?*~)8%kTC3I?hZ^
z|8>&%_Y?2GPrQG-yj16!e@7~2dC{IdUnU+&z0~})+a!F`L6+$zjC)(oF?&SK$a(6S
z(zv|yWx|@Zb{zj=uDxGV_^NjLwGS&#Hn6<DVW`gP#%i}|M_balMx&UX*~hQl7yHoK
zzQ8d_H(6urMZWLT+vGn4FX(Jt#Jy=wc=+mNIcYBvk5qZ{@rR#P@7SYvzr}6A?2Q}u
z9$k@k@k^_+*P$a)S8ly{meeRerSihDTO}(FCEd8KxavoM{^ICk>4K{ks^40|;4W@u
z6P9bnSN~$7iuAIEd-Fp=BTH}Ces5jg(rl*582g0z@C{?m4fX827u}QC?v%{&vvY7X
zDSYVhNZjq|#l`ON-gb#Wvr}$qwMYh8Jb0+h+;n=v)|JL>*RA^xU08bIz=RByzN{O)
z$4*CGdjC!=b3@{?`?C993*I`Oc=*!OHiMqcFXmje4}ZB;Wd5J;`&Z|&Zc)#B&~R$~
zx{r}da{2VbyQj{W7PK%lBXWT%$5z&w7p|W!6y8@*;%*g-t*iD;PdD*X6Mq+0zP8<F
zZOWmqAx39KJ~z!PeCyYEZB<L+#kneFO9hppKS^Aj!831V*#?i*C3(vOR_%YtSkok}
zGw<!)rYjcO95vY=8Na_^5Y70o&xvD~ra0paj}2RRXX$COS^Lb&m?Lt<{KYTDoSUWv
zVJ06dVjkHsY`$5inz%feL9Fe@^C{K`k1jmi$bR6!c{^9OHz(dCZeL;eb}kD`i0*NP
zgA+3D)~H(6b>IBpxX$L;?GjOot*vHn<hfqVUG<Q?^s3Pk#sha}{g~~L<NvPCW8)sZ
z&)Jp^FF##a`aA8A@*2ZE#$4669{ip*KXBDTtBVzaU-+7p#Xe+6Ts&y!cJpm*f%=`?
zU(ZS<dH?1LsXSV;Z&iwwD`(;1bxGSMPP7kYSkoxT_`AmHOH{-5Vw2uG>{d(;7bcn+
zy4DGMY>22^lX~%mai>(ob?Nne7K=aHmAtqxwQ|Ex=ezw6&skq&x|Uu3L9H@WuY8JI
zgVbar{f$Xm{L~U}=%kn)UGV?W$%P*{QVtlF?wEJ|;5q}LcYR*nYtGe8vo1do5_4NI
zIKySt+l9NCX0?562%gf~bMJTX9Y^2wO5ZiV##p2n>TA_Mn{nLtasN^NCtnwD(#%WU
z(aLOR`m=U{>H>{i<*CUwN&h;-tTm!6F2qdd*LITFu25mw@BH^!bKCXAita@l-(Cz|
zHOX?#ES-%JJbPXpnbr1w-ZqZ*`C4bE<m|k`n>KBAr~fw5Co4OZ?jA^}@Rn6D@!@yc
z^5e<E!rf_+)vWJLoW-ZBZkjt+UE@mk9?5jZgUgN_dlluze%nyxhUZ0&Ni(W!wzu)t
z%-kN;p!{pyfrVY{-|y|odfuDXlqUZrMyf23|AT_wn!-AXDb2cu$q&n}d0gHj^W(p6
z`YbciTb}VAmadLFqmCAyxq3EnN9m019Fqzb_HQ~H=J8u8pk&Tf;ae<!^^WB%mUj7V
zY$<>G<vv~U8-=TW`Efspay<L>H?MPEu0`0MTU(F1=|o>%rh7H(>g%HabDXVLpT3tX
zt`n2)`{~1P;|uvm{94WiyPiI;S;<vBNmWwzddF17Sf08Y)<-6r{_e7C;P7H;QVo8Y
zsQTsXX2*!c;(WtWcL{T$&iiahR%tWTFZU)CvYs~GoAos`Y=S~(8}r>llO+|cH&#su
z^?ac5lriIN;Z3(tzr);j%-q)Sa(yvqd3RUkJ)eru!D!hFb2+wf%?`ifx}M)v_Nu`D
zkhG%*&Mlv~&F+o<sy9;KBP$kUzi&VBbG1zRr1;M^k9~sH-2Bk-TQ-%W_1)`pCuGXz
z*-Qzzc%pg#i-`-Piqlq@$xE&JuyUc%aW-3<v!Bx%-fX^qYvRIJ_Qo&XnW(c}o_lTM
z!d;JdHagoJQNMd`?>U~U*V@}&#lOGuK<9V6oiU5U|8M?0e3!oMxuCOkcj8)KCQh!`
z3hU&zxfb7jR&~%OG$yux+qC`fInGSKC*S>9`vF&Q$}R6Nb7lujQP6r(*u3WE=ZNc!
zl51u>`{3qxX{lMIt=R9i+a;~uFMKfjnq<~p&O>&$G}9s*-KQmSm9AK0xqgP+L+zZo
zg?)i8Y1;o3rJ7}J7GD!QI=_rfF@M)XmTk<14-9tvmH%|{pU5_&M?&2#Ni`umq@_OX
zI`&iG#MvK*?j;v)iFhKBHQE0t!%r>CqDAl3tyzrSgO*KAJiO+@i`N$dnzJRsB0Fo#
z4n;fIKYMw+#cZXG`gY;BzBwy+Y%d!hyD;Bv&V4IBk;V+ic{=);Jl6yl9$b3XW5HHN
z$<W!kSIz{8|Jbm)Ui^{YXIu4Eu7?jS%2$k?(z$fQ?hmngE1rb;=pSWhvCH^hnv=Kd
zZMVg<8+RsT-<`R0`*9ufA4)SNb*z>ZPmF*3A-AS=RnW@!r_8<GgFdo~+uBxM{;|4u
z>b0*6A4#uth?4qYczV~g!a_TR>e<b#YcsyQVUzm*^L+g>^HuYvd7Ir{IQ!!5_w(lO
zvH1J$NoC5tLzY|L>&o-*l&r|z!)o;-OV?5U980%Sw5mc^>V<RpA>3*{j-8Bo9GkV8
zuP$wq3Ay#kQ99kZ&+^KbDcp*S41Q~iownL2*ZHMKx$Dc}?iuI9GV`{Gi0rew@La2?
zLWXh18oMW-i#mepM75q@|Hv7>HKQ#rZ`PsqmlZ<twWWWA<RpTUL?&|9t@552E4E?5
z#XB5#(zEvRwCAnRkYjZ)*?n%=6G{JxK|H54Huh{jy0LFf)X_&3k)a#zUs%TaKk$H{
z)!qFz|NqVCXS`!#c60gdj|E3_^;JW%BN<y~A4@!ZQZ+Ac<+Iloq9?w$9u?;0K33`3
z7~{1}G$>~A!iQfKomwwkeD}on(=XmLANHHBbF-PJIA4GDM9aVLeuv+mH%Fa^@$j~_
z)0bFknNHT6ZFWEZQr6^r$*Gr@|M&RKv9D9YV%4WfEX#c-@k}|Bu57rl^I56jw|)IW
zJL6w#x+PBt7TtC;be6*5`Nbc8H_EfxFFNsoS<uq)kK*6?fkIZ=YM&mxQ+7TY@Y#Dp
zm`>MS*X7e^Ht{l5tUTW|XRqu^q1XQwpX@!MJWpa0%W2gOpI<k%KWr*#DpZoFU7n|v
z#P)A*yzrCE)vS4}ab=49e|OD_Rk@bBHJX|4Se>k|qsE&3Tdf`iNZy?Ed2{H7nY<C}
zem)g1PF=rl{epKHtD|jv->iGT|Hw?X^+uD`7ga8Fmy3V3zK$`*_-vGU&z0B@dulH5
zhU?1*`5gXJ6uawz>igRMf4`S6-_HK%*JbhTkB<AF&#V9Q-QCadZRqi($>(MtP@bi7
zWcg&4eG@+^N>(~wUTtAM-@|3iqLSw;CQ4V^zVl_D%eg$VWtH0Ps))zO%a^sB`fGR1
z<#$%o;TT^T`RuAZwY3*_O<Hc+af+kp$Gh(DdCj{%yl;4V^tkR`C*$8QyT#`|?qMxE
z<nr`F+QIwxYYRWjQ|kI9mTYVq@axR7y~544hcdPN{(6~wo>lc$Qi9ECYK?`#mFO+&
z)LGX3Da&0elB0NOM$9h<#@?EUJx0G*Hg59>(MYSYVLcYUbi>nE&2M^BwjT?5@gQmM
zrPi6D65j6)1U<dOna~ofze<9$Y0`^#;j<OeU72sU2zLed2<gbaj~0jzI%Bz{y7QB_
za*zr8sdIrxmUh|oSRCDMp|EDQeAPo~-IN(if+sxRG^gf;slfc)AFr35Jzbl^vqpVI
zRo$2BuNp%8#hd+>KK%V{O$XclaA&QYnG@PlfAr5)tlF_{#s;(XoW=%^`V`K^O%3LM
zWWvlhah=o&;f$^P275LaBu46QvO3!+&KDK&%ld`bj$fiy2NM2Y_9@Ns=TYu*x!TyP
z$iHWU{Ga2yyw+-*n6zAdZS0Zb3O61JKA4-RYIfzxUVWps+D~_DT+5<+X7#uR`kR)8
zcx;Jz*%^5zWX>P`AJ?AhE}6)`^n#Sj{_xnl)y|=fll$BpiWAHCJ>+T&WpBz~yHekt
z>1?R-S*{x*HVXy2m?o~<bb9r>#}EEh@0{Yr>X0K9{V`G^E~6&0rS?YPJD$x)?M)uN
z|LgI7ch5{?iD+J_pV{6PeJfc)S9n^5rJmD&rM>j{WihW^&!_o53i_SQyW6)Vu|j!I
z^6~5C8M?kFp0)a!Ontc{u<$kKF@4YU-K>Ij&c&Pm$87&Ba&>`C+Tnw~-=CQAer4aV
zF-J<hYc~hqrFU=sCC;oZh^TiqQ9Js{>eH&LH8Ib$90m0sGKgJqQ1^*A{K%YD<PPiJ
zue$49qq=XLm>;!De6Q;wz6|w^*7K%tUpduivwSOmM*NG5J}(YA8s2ryw&szk-M!Lg
zOVLuXYtkuulA^ktbyW)NW?Y|arEn&bca?2_&lbO{{eSo#-Mrx&eRmK0nR)wm3rI&K
zDs67Mm@B(&#%}YsO_v*@-cI^!svVW2{<mQEmoF*bg^&IbOWrNDDYM%=ul3g7u&nJf
z<!Wx+Y1=7MZt-`Qlwt_i3qwEkj^Ln`uFS{Yw{eOcK3^=t^sHfKR@2!WJH1nOhd;<z
zzYTi1Cgsuk3mhAi&%{ZwFZ_N+nr$V=@eeL{XG+XflVNzMX0Yyl;x*~M`o8kW;PcEe
zDmn3H%ecy?E>u*I&fj<;=Fwi)(=FT9b<1x`in^z9PWstxxf|`fHtcNQy72HJ#s1fw
zTdNA({3geIW?eop%DU#A%k1UyJ?o}yb}V4GKQUEU{<in&$S)_YeebKyH@L;acsJ|w
zfq2m<Z#CVrJuyBP7rSd`vWG?9o_|7Ig-3byhKvU;?_a(87`XA#@`%QM(Z3A018-=h
zEn(|DKjm`p<lQ&#2blaS+vocCtgGy!+FiVk*{=6DtPwBi=JUFq$CGj+Zlkb#(TAX~
zCM}bvubyd8B=Af1W1$S+e@>TIZ*Ju-v6;?qK5fgxj~YI+r$pUpUoEThYhUw~^>vee
zEj?26Af`p2*maq(R{8WL++EV?U(HQaxE}lEd7WXl7dLHk{rz`Fk!8@bZIVl+)DBvF
zE_3JZSiI}1&^F^QQ<Sy`OT6@q^ob7bX=iXdyg4+M$KzVw3@_DHsg0G@SEovBShcEM
zd;LTwpDH&&5%(D?EnB<x7CX7;-?a0z`?BTtRQ0=am)+SL(rxV<_)~B~z&VkpwzIqL
zrBvqmG8&|AQ8!T!e%|HqBRg`!#nsz>Ugej{u>bet@sW*s0X*#$U%nT0wzaFK<-{EP
z-s$@^()qP=;kQ?B>i@l)$i1ZThuGu`R)08dvq?;SDcq@Rp8D0XP;Jl7l-bAX*B)Yz
zXywdiVCtS2&l2`b>hEK{Xx8u_TfcK3RQYkW)cH1#a&XP}i!G69CI(MVUQNDrZ_Vs#
zkF9q)I>h99*&i&p@VsT$<Ewc#9Wmld^Uj_;Te9{`>Rs;H2aiq`oH-?5tLMLopvl|g
z&D%D2Jb!tcF-c~RpopHAc+lzf4e8-03XQD%EDeP>&5mN~UR<(va>)JQAOT^qH@c6W
zw0Fv`5B>Bkt(<q8xP(rDSElEtnR3ec9PTm?ugnuLtZMFUa1?XfSaL$k@xhF4Kb12|
zd2<9WzJHi$zK`|&?oLftF4x14`5qs+Q+z&C{r8p*Y5iljng85n*#FmEkYoAf*-4MX
zU+vIaCwV|`(&V2ZyQ3b?uyQSxVXaK!Gf@1o+x5+l(0$*-la6n^)xLLK-tlSu@<n!f
z7n}ID>egqhdn1`~!{kbPRVkzM&Y5zrSdDWwa$S0I!?UAV>cEcl6AUUnU3s6vcs#lq
z)IXK&xcuS`>#feX@TaQFTrS0Jlyg`<N2|I2?yDCrx1(dr&b{QVvN)f3dCIvh#!t3y
z<Uf8yUazw{SW9MZi~Qx#^A~fsii9q+TVr6uAa;>UHqtOug+tM5?bRm3s~;*{lU}`f
z*s&=!(^GRfcfpEhGJ6wV{*vClFNr;(MDXa6$fa%U6-R%)=03$&+FYk&zwr3Vu*ZcR
zTwbwnPBg~psPwvZP0ZO7A<50_r#&<5!pev_=LB?&I6Hf#Z%o-X>!`jNYeLU^UVjBm
zS(CH62A{2FpS}^86m;z3w`)Hb)Vt%8oUhE^eOk4Vw|kmy=hbVIFZbqT?A>;?gn`N0
zc$YQfYB94Mmbo$u=4`#pDfuuWckkK>6V7?*=g<G+@Ok6i)-V>PWgotC?`f{G(~mh4
zWp-Wf<U8x~i~Ch=x9D}>*6{w$t{e9x%<>rL*M6l(E3d}C<4EV9ntfs$+p6xS(sRpS
zy;IvJ+R(<Bl=^RLuIt%fC9XfV>b*!$RO8XxzTiN?4f9mKyYhBL3lFxoiREtFUBI*Q
z=J`!??w<9MO<>&r=;f1t?vvK6kbmcLsO8RIjY-dLs+xXDNWLK1W|sO(_3wR^RNdBh
zWm)Fs{u#d>oo~N>`<>S#_Ju|BC%ulDG)pUY-Q5=%JO0&&{*UN-V=}dgZ~4hhC+se<
zc)Swg6D=+C<y*cuFG@=I?<1D|YYd&_K5ng>Dy#J6_J?=M2T$8o<W2A_j9jk3RmRgU
z5^?L>PY%Vi+>4vPmW54KkgT}A>7vBz6DLe{7+S75AFUTVxrf7I+0<-5zRkR8{J|0S
zw|6Kp**y8p{_IzH#M@udJsVTi^Cx}I@4Gk0X8E+Of2|LCY~Wdc|78_F>&=T{Ybvg-
zneU%1=BB{iwoG6mcmA9%tG0TxGmEYFmnHH~Ugz7h_1)}>KBvP82ZSC7EUdl%By7ot
zS*0h0UQ}<dFHBLYvbwSUvAOQ7m!H+nF8=D5dwW(&bEMee*Y&>9(GrnUHcq+mpi|rC
z$1}@3!zoF(w!F{rw)$G6{rYs^W^>+IX6^69j?UZ{EzS3_f`8Ix|E0gqt#}tV^`ji?
zijbLmj{OMnNuI#<|H}5KWm^ubaPge|n;ux-Hz&U2!dCXn{|`IgE7jr9U90wgg0TIH
ztFxY%AF?{xV6CvagWu{`<GS*GzXXHpSr7VxcJ6deQCW1E$@N}sZ7+vMOmUcYf|lSu
z7U2_%UYz?8B;VedXK-3AvsE%hCiod=+S&yc0h=ri*{prJFUM$u$dXmcGyVU%x~#a-
z%djK(?y;JQQrSJ<LM#)f%arUowEKP-)3dVP>;tC-j~+bRxNi~DUiEMKPAu1CPR?$s
zP%Wumu=hxQ)tnD}f{P?OCi=JRJ$Jfiv+<cVT#H&HI(EsuGi8=Zc|P~(tMtD{J2iFE
zKkWT*>&fX|-_IYhim;h;=ft6{#o}yxdFM`g^5szevPW%dvu5X2MZHW3EEIEGkvd00
zG4p)C*+%E9N&S5qg<QdNM8w|-_8&Xrk}X%6dAcEU&&9K%8L6vIxlT>ASrmPz&2&<`
z;_Z0>VSUUx$JahzkeT{s(*c3VEuk;gf8NrNyD+P~M4LGy{r1c74?8MYKg*Rg)?VAr
z=5qehx18jC7sO8pX*}oVdldQF)Qvf6`qV&|jbS$;%leNVUHyDLUkTHmo=w+7Ck44J
zIm)%4>E*1(<gjU7Vqdo>#qWLHoNn&L&BrL$Hg|W2>EiCM6FltX&iz(Xle16Z**oC{
zGq=%);$87O)`Z!o9DTh?C!P7!#TCb!&&>Q<lUQcGp4Gg+sb0I!?c&+XhuxIk_sM+@
zyy|lQ-qXT&%Wkf1KBTl|(xSrFoi*l1HfPr;XDwJ*u;Ai>l=V-188i;>vg(=kHRr#-
zU|>_x?N;LnmsbB+b}H*#&URH_5wll^Se&ZGw%K)D;1X}U)h5Hr+tKgq!Z~}wmQQT?
zMwg#0t$en`-$1_nht)IYKLKH;`_4QKIMd_#KzQa%<@$B3yt~fs2&(_v!f4w&=W^+^
z6b0*sU|r`OrD=BGzwc=24AoWNTAy=~En|=R_NhM8<0EeO?{DO3PW4sG={>Tc_i*;^
z_lA=nxUQLXwc9Pw=fKMF?bBPh?Avy)5og(5a`i(=xRcVV%_S>3-%Z)bQds^eufc~u
z)yM42v?&+G=30F-+V^gevuAtg%<2<~?rVLYIexo(c;;H$Z!TXfCGYjj-O|`{(M4zB
z0gamZD^q99zkWJ1EJ?~v?5|}vL*{G-6V7!rCVtz*s=4_k%ZAetl4f0!Z|t`fKG-!~
zvP#$~_^hQ?9{<M8-0Njqm&I^TUSB%R&+Gmp-@>%G68#|U-d<*#i+-YWZ|KGSX`d2v
zZv)e=Q+Ioc7AwEmzIyM)c6M9lYcoaaHMIBKi@Be{Z_U?Xq?}&-a_!9x9Q!?1Ug&M!
z&inR9vPje2r1y(9KYsG!P0u7D*W-cJGjuqaUi&gz*x6bAd!|xZS5^1r>P=4OUx(PY
zNL;+N{Qty{rg|EjU!G6e{P}iZ<I$A~&6Z`)B96pqzGHHmF6y>$Yk|pp`<$oo*#Z)r
z`?t0}-+0kNP&P{Jx>A?+!O|0l&hDOPWg+tAwD#^pDH*%Id~4FLws@oTzl(F$KmL|d
zCW|)x^AAs3>7Ui@U9j%Jo{Q|o?v^|G&p4kxGUc#pkhS;GMap7}tNraFpPiVJ^)2pZ
z_J(g7w=O+ndi6&1VFh<dYh;S&4QD>Dr(E;;Tg^|{7`cRO`c!|~P9o;4_o^$W&Zume
z-Il%g`Q1xzH6_pX+;Q7HX=|`r<tL9R6}NUcZdKY49_Ai-UM@W8dY!z9uQX@MT5gZ}
zo9v(1ZZ_r1-<~whTk!cd%Ve>Qb?rZ&TQj|i-Q(3~`()MbpH(}yUbm=u&>k7`xccJM
zbZP#e!;`kCd)(k`iE;Z`^Sr9#mCuB<)ZfR~xH{NH*#DWg-($DF?%iqC+S4B{`_Qx2
zJX=|p_y2~cC;iwLy|<8MW_Jt=<gkoC_d7?j|EQ(q>zOWoNe$OI_*rE$zvNDw!oer|
zWR^-m$(xG|4dt3Ao90HH@HC5FXtzV@V!+3>lN;EXSPq)xmCkid&Pu=5^?!9r-}EwR
z_U4nJ7p%6<-P!gr;jXQN(e+8+Tf}~wZ`j2l+`tyCUN%Mf{*Rn3mMS(fe%G1qH1Hhx
z*On=EEa`W{KCugNJO(<GE;j_LY?Pn6qnc$Ozplu;HzE)BJihJfbdO#1Zl80<1%o>=
zQ!VdXRO)};FFxySW9gJhz7uNW{a#zU&HVk~)|dAukL@jvmYZ`yAw8<lp>g}A<c_uB
z2TjGyE-m&w`^L=o$Nqh+3_GNj8>p{r=<o3ho?*QC@!P}Ozb)e}kG-PpRp{&Zaz}l$
zg%jVkU4j$t?vZZs*|^Lz<JgI?TV0u#p1+dYa?<OA&f6Q&+nm16@!mWkxMBXJOc$ZR
z&zs|?A3vbEKFFa&W~W9DQ|hOO=B>7eGfp2AygZ{Xd~3-2>;CKbcxzN8tXi$U^UTca
zztdN_SK?>Iw(tbgolfP_>C6s#FQ2>JP~&fAKhf|)YX6G`9O-qzF|mw`?`&Y&8uMn0
z#F@!I)=jS3(3_n9n{QqXYoO8T%chs}m+MA5tJD?yZ^&!6aj9)Kdd2MU?6t|WEv4IK
z(z0V;#yPImkLS)RWuNZTn=`}acH$d><F9x5i(a<M>)l~JS@xr%+tJen0Xn5N8AWqf
z=FE8-`Sz(?<MQZ^!?rtx^ENT%p9#}ub=u1=S}SkXbt8Ul%eD}K(|PGZp^rAHl*L6g
zuec{FBas=pwC0dcWTuw!rx_XXk5i16M3lrj*GHOOcE5jW-Rb<OLyTMj_nGbXd1e)@
z&Qe<Y^}_D(oK?sB-n}zSpBt$AY}I4a?I+Z3d*~KlkzV&zFKUX`;bY%q{XMJ<-EV)X
zc=vSqy-St4x3y+}kPXbQajm<^cPH3otBJw0p9yuc_W~l1cv~#KykNI*v_I2R%ivDQ
zHCYzM%Cieo_9a&v&0EMG7IwgB`J@>;JN9k~llbAW=*gaoyLW2MO!GdrVN0ZyV*8pc
z3Qt3dLp5D@pX}GXx81<$IBSB|OrvXk>-+mnyToMTl_t*IV6mli<t>X&&5&PaO!=z>
zoOJy9&mVapl3<znEPqBP&)jPt<T#xt_MVM!h$}uDDl+TUTgSc?{{yo(vAnmxZIHR`
ztMnW1?P574$$W>-)n@G%nzn53R*tZuxH#{*YCQUDxqd#*DfXDFZlJ23aZ1AFb>6lv
zH|Om_*5Q|VxdYy}*R({P{JS}9B~$5*kVifD&KoS$PP_Br)XA#e-C@h_Y8XXCt<?!z
zVcM>4v3&EoiSG^PJfGmUCc->;dv4mrue_2@Wrr4>>zd~G-Oz1%)g4xiR`IUP)d|Zi
zg2Lo~*(u-n`O3KJYEz5Vrx~5;UosCgsE0q2wV5?F^~*d5#X04(`o5T4m^@>n!g;pz
z9t&^#Z&TheYv1{Jd*9)jtG(_%ueGA0xO2C)9kP(#_4eUq$7{TCZ;rA)>;A~!5H&X;
z^T*{&j~}!yzxyY7e(xF8)z9uNTYl`k*T<<o-|Vi(vIhOnyB<3``gzgiod>=iEUJB4
z^5^qZv$IoYGyckaSS21hWBDfD*iBX82lCSYR6AK06@0&TV7KPgKi%xImbdp$$WMRp
zmiw=a>4fT=kIohRT`jfy<nw1Y&u1F2&ix-0cluACX2Rj#l7rhr53AmNyUFq6Q&x>h
zzZUJxTvPA3F@4s`(7YYnJ?occwm#R5-LY1G_hi2tZ<E6}9<43jZF*^jwa0d$hd(T~
zd7NrL%^tMzwYH1yhHs&KYF5TaoFC|#Ja;L`%i+zcICpj7%QstYzI$|6`itVxduL^`
znH2)(7;`3Xv~qnrlY39bsU4T|a<5%oubQ)SO}Acpp9x>O@TYy3?gd=?)%C7m6JM1_
z?ui9eFXPVcwmtlkwebAsh5cUbvlm}qKVN^=rTZHl3(cQSUAW0RI@ihJD-ZLvzGDVy
zc`bag;TN|2ZSLHzx%;Y=WWe#SG9Aj+>*jnu;<&J|>^k%A%Nn2d&O7$u%>FM&Hiy@K
z)7WYlziXd?>E@eBkEcIBp079QegC<re-ob_l2~_9M(U>KZN@K}N`GsLk85^psd?ZZ
zrJpDL$?y1!rBY{?2b;f8d7d7~k-F=&1;@4Hw;k3k4_s}}v$rfJLB4ys%Ish<seK!!
zpK)EH{WM#uaF4e>&+(lsVh?mbnP@Lkc=_W~)$g_@mp`Xc4)BJz<$bxTGAlTA@9k5X
zmt?Fof?c1?KOD&~=f2(XLcj&ayTZYbl&vCH?V7WlW0za|KevC+gS33E7WV`O&M0<&
zFtvO}Oq9j<JC6cSyqqD_zhkMp>{JE6<^$6<7qY%t^KXB_^tA68`62r@WK3A^c`3DR
zLhk#}{eeE#fxhLpB%3CBmxpcm^3^B4@0v+inC#iYW{x=xHSOJRzpXTFjL_ZKa#*n>
zX{B0J<>vqVrTU9IYAuS=gFjt7Xd}?V_Ev00RPDOOOt$q;_8Dt+<=!qc?@IWcVqG;=
zjH}Gb=C5!^ZOg{|(yt9yrl0??sOsal-Iw=s=00iorRRKPVdjw)>%7DzIeuxn?s$Id
z3rB^a>glb`-((;6x4Nx&JbCU_YGdLWN%@JE{<c|Fz6X{h$sZEi@r#SY%3po`InU#c
zyZrvnF0nFy)L(xf?p?6U@<VqNj$OOllu|Tl<7tM<fQP!b*;Z{8_!tt)q<vV{d(K{q
z{^$t?qIy4H6n~3e8R+o8=8Cnx2cxQeQq!?D=fdB<nqE+GKw53Om-+rVAB2PW7+v>S
z)%SU_s-2p|*V-4cN9#zS;o4I<R#}ZD?sw-(G}xTI_S$6e8&|7NZlMJ!e>d-x*g9vc
zLmjLC=97&(R=sYu`tj%U={5VJ7OnpD=kt__KkoFz7%kh>U%Bt?^2a&yWjnT2on=^L
zG2`^6J!e!Mqa!M225tCSbME^4zwTzXe;&*K`*C!--HZv}_^T||rTlU%3`#8XI&$O2
zntyXGj>eQGYjS^l^HO-@q|Bvt;<uviyZ$~uS$uiA`pMPe`se)hCaw3=KgZZSt?vEC
zAC9kHOKmmbx_YkfUQKON>Hi<?PySrJZGK$++r5`presfUZtE0hR$DkhGeI%5__=YL
zc(CiP)wevKOuw|}wa#RrXNy{eX4TZbabMmTF?&;DuNqI*hqvqJ&VKT4R^xnm^(FdA
zJ-?#o=PryE=xu&J%jx!0`+L16vxD{4uB>g3e%JHa?xdy#OZ2jUMC$^xw<kp&@pbIZ
z4qhag?HOSoGW&QY`=xi&*0^z$?Rl*GVd3TTYZlJ+pI>*X@;lSJCl5X<bQFHptGc#t
z{ob_~Kin@1;;4wbD=2+?mS53TK_2yR={)1T$%i*Q>0M!U_0^+<$9<n~>R<SqyYa)C
z`A?R=-63AIclUgccfE<%SF2{;h@ViwZ@qZ;I!(Q{C09aUzf&?}|Np@C$!z@w<>=#G
z)4Sj4>aI;|nX~53!mn?SulsFoU!kSW*sJeZw~Sl()^>-C!>T8^uS-6A$Lh#(SH`E5
z>-G|xTZXJE8w}=X1?!Z)nE)DGWLlDXygqT>q7(HA9bd2L-jdP2;J<o~Q~SqF9F2lp
z`?hUXl#1&=r`K2UM0w{;i^^@!yFNyK^~qWD<UNnl@pXkOO6S{2<v%FO)joYo<8J1b
z2j9P)`<u(iR(sn}_s6zfVZ}R+Y%t#RN@}{f&pt)Rs-OM7y0a#)IW51Y-Qd92Z~Nx{
zVpdtaS@W2&^+6ejg&+NQvnIaadc>(?ID4i;|EV=Q=h-DV7u>fy!{;!0F3<D3YPaUB
z)hKk>oTR<qY{q@}b;o8^+s%$V?k1&K`^YK2m5J}t<!61{0+^=uO;3%gEG}mcPGA>V
zn!3OFTgKzm8S4x`+L@hscXftU3=0S6nXS!LrxX7zT;{R;;y06vsttt|8J651AC~P^
z$n!g`m-kEeZ9~-hXD5u$-DVfcmbz0F_3mQwtP^(aMZ2HP&eFFtJG!&XA|h}8<*6M<
z;sT==eO|R|_lg{`)i1fvh9BJ5vt!oX%r{|niOZdi`c-e(`il8?s^{+otF>=G5B52|
z>&SFn!Js;;w%Us&YbX8Rc}8nn!2{mzI{ByWXZYIR`D^lcZ2Z4@je(?llzy$~k+V~u
z?4B0EcHm8s!J+B1*FU@BvvK#4-95%<*vb;->ng8GT|Q;WdFdA39^(lw{_&mavwk|c
zszdwz*L3r_2ciOQv%h$)lKr~4tyO%Uduard<-JLlCPjQ*Dxq*;QQI|_dy99<9Ia$D
z{nlG6&l|Xc!**?N!)>3JAu&^*vhVvCBCZ}0zTw&0N0T+(z07w1DtVQ$rO?!9&HfLP
zY~`IbMHgT0cp|}k^tqIevccR}8OGelH<>Iu>!HJ~#I}^-<GN6VyYCNaq{}{OIxX0{
zy2@>5B+E6G{Y8Aqbw+cnQ!W;*s!HJv`{wn-bB94|VBa;}c1P(T)5lS<-%@loozd9R
zTrf?Rn|1k7k+bXXab;-+_AfI_h`T+pG~r>z)2p9X3D)`Z9W{Bv`&cYydisXhY?}^t
z_~po1y^x%r7_`N1&aMhmcR}@yhtJIvm0b8-|6JcbyZj;>26o<{BfEQACcpcTYIyF0
z<@Jo0M?}&-=FMKT(c9|Sr#JsHw%PP<JGgcBaZcGZEvv4_(_H&B`0N8z@AWdzVGf)V
zd~Eq%zNWiNJm$7ch)$WDdH2^+-`n4J`<?sw=aKZ|Wj)6H<(cYrW%uODy}o7y+^evD
zaqNiM2JIT>+gckfX6!T7Eb++__OtR?bZ=3J*5~!xmj0dYpKqni*XDD*ihG&%+>FIb
zo=#ZrrsSL~HSM92n1H`l(iEGck{ZvXe<!F~Jg{|ge^t}){^8uSso!_U`(3$t%Z6*Q
z;BNETm&H!{UMkJ>-D5M|Y$vCYxarCZp(meNaK>mZzwB(OlkfXZ)Lwha-k#$|8^2oI
z7d1WY{wCwz)Mggrz`Kg<SDiQZw<pQ$-rU2W_kEB4kF%46;)0rWcE5V8cYm%&-HMW%
zTzB6rdq2xyS8WhqvJ(sU$9R*QKmV@ZCG%6c@Wo%QR4pU((4FNmazPoLo}N!#s)U(q
zc05gf5}*IcEp4SsZSc4GTc60K?7f@4Fva)V8;0py3m5&Jy!?CJ=6R<Bm}{=CI6QZ^
zRpFcDPZNBPuR3$Ft<9Bf>g@Op-(UHZzYk*Ot$S;l`}zv=!-rOH)=k;xo%r|bVR3cV
ztDa&{d#|5bd;GiOhcDN6u0Mb2p6R+zFAnqS&wsAJ<$14XZqW43Rcf=DIqzvrn>BCq
zxBkArVYd_SRNCB~W+<jB%3W3Qm?y5whs$m5AB)+Gt6Y9L_I(dF+C7)QB5zx4+F51w
z<&0-MybeloX>g}4spJUf*(LIo>)%A<9gf;1cl+P6XeRFBJKgvtb;`#TD^?rjn`tk$
zSFoHG!x=e4t-nO(F&nF6`MPV2M^m*Gqn3)j;a~mNNZ0D(?9bOvn4EiA`6SV;+Hk3W
zf#8#X8T$Tw5>vOz-o2VS|J;%Os0TVZcX(KrsW)6m__28JzOMI&)_$De7|<(szUk2K
zHD_`rUGC*dlg+>MuI#vhMO<9f%GDzFw^N>e*)lb3x}V`0D?$0S4}GOlU!^X3EG6;u
zo=v$)_I~Zxm)p41SG;WZtX{bJOY)=~wr8`{?JBF<Zr9C!c`5VHj?LR&CP*3IDd;H9
zepiz|H!@32#_o-=(3dZ2^?}XqoW(DjO{Py-$ac-#Wn;>RwIzAGuQ4aykBHIfo#fAU
zL6^fjDzW&+wFh4$778q0E5rZNIWod_xpnvTs;9dJ=KgV<eM<T}i+fzrB4%^5<<pWS
z__y5u&Z?Eq;J}=u)bF>YY)_QolJ^r+P6=<AQ_bJtvoM?g$Gik%gS(N8|MzU(v&_Nc
z&AS&LBmzH0J;<`!{J^6kVE6Mk0uBtzvVJ&D$Seyu<j^2;`nAz<X-?fz{@LsErgfz3
zJP^@%#P`#a8%G>lDo!dg8<ako(%H4!>aO~A@s79Jx6LOSH>u6tvgHGJaH#X`I<Z(;
zmnS^(Q)D_DC95VxJg8U{D8u>P@Wb4~llpDWr}_dqe`am`<iuyO<&=uUgL#$82i%W4
zf9&(#C+`1aVt1v@POZ(Hk|ICu-kTSBa(bnuU$HIY6$Z|I_uh-VbXj=VA**;v<YVtw
z9|Wo$pBW}@Zcf+cy)Sa?``lCsUd?{4y{iP2_vRPs$y)uNRkWwKdB>z+zd2JrKbkFL
zwPkkUC1>O3Z`#bJW(B3Pw7#2dktw<8V$Jb1HW6vN#M;{HtWzFlKKmH2bzoBB;R4&Z
z?$XbtQ`i2v!Jc@YM|A2V3#SFIOQR~q*9UMqFF0&^IwJa($>#Jc68^OoTLP@Y*4pXp
zX}Qek@<84$@W#HpLKdOcce9r|<lkR$<X!FQ=((Q{lvrJFZ@a#eK`rk2C%^Z*Vvec`
zY!JU?d-CR{)0VrY#<E-sd8WBA^pqX5^WRf~&$_Cwp5i&O;`qO**6+G1l@_^8kYZ)8
zSrRM#lHv3v!`%z~r*l7@*ZTQx!RhTzeMjBdP3K2NFIqO;vF6v^@9X#3TKa$3QuC?p
zO36dkgpl8J&DSk{ocX%%Y{?<ZHET{k-oi95bfeV=H@B%**kiA+`gfyrSu5{?QyK#8
zxl1g5Jr0WJd}Q_Sg_w*+pKKqWe#OF`@NUIdKCy0E%hMY^^`7~BqcP2i`Qw((hsmX$
z&z(vx<!+f>5zel#=FCkwZH8ldLEE$zF+OKJcTu8x@_{>ci>L3f{{H2|#(<4?#h8UZ
z2%lfW9H*;ne3@^DsqEie8B4}5_x_`8ayyosaY0a?f#J{|1_qqx1Sc01=oM7HwapE`
z?Y8;;Ptjcuo8L%BCoEV}_{wg&g~`(?Dsvnzefjj`$Hb>w*D87Mo5Zt2=HKtRGixud
zQ`xVo;wxP2C+&S}uI$-!=Wh3<ZD0F&v$*`L<@=5wYPstFOULJL<M~I+N=*v)3a)-{
zxjXuHnDwkPN%a<9Yxmwg7AO1f`;lD|hOb4v7hQO@Ia|zSvSG=#pl5yCx3LwPY}<AB
zpvl~0Yi@7-^HHTM_%!cfjnZIyuE}e43-b+l_nLGyx!mgzN`JIWxpL+?wK|I}caH25
zD3EnO)U75H_U@ZSN86`+5{5i~=GC}K$ltH(*>!DAwwU^d#jjl-cS;*uvc&yjw3+-@
zD_ZOi@8Qhv$J{GCd-HlGXP@75S<JR~^|y}7@b!!AR_BI3<%q2+mbvYF`Nn(S;AL*v
z^*=8BeR}tG+4mQZ9=$#Jxm^7CbJNvx_p2)O{*AWxktsLgoWWAiA}%yF{Kf*ccXQ{?
zUH-QvZ|2{<2lfa3y}i6Z@%Qsvl^@q;vF$${y>wqrabeKCL%qkjZda^1(Iy`EpzZLd
zxa)OBrOhgHzy0+%`|{`SvTOT&=Qe+OXVAFm`sspMrH8ovW=i=Qo%t`3_Uu@%^Mifs
zr1_sVpFFZ7yXpJkDXc{e!h0AFSZQYec~@Q4U0l`8I^~#o;F4>ZO7|x%&iR()s6S83
z&uZD~q92nN&RVj0dU0B3udx0%bxm$jm(t}eoyT-~7fXx9tKMvyTz-mO<D10&3ONIJ
z@p;QWPSKy(vNTEPgXV0XJ(rFvgtA?0E&h1?X5sd~uM2-~pL|_^_7;Iw3jrZ#MRVV~
zaR=&>jjz=^_s9K+t1_Hzus3+VZv@Api=Q`({&KoE`=xGV#aq{h2f{ah<7!zUziD!T
zz|&hl3q>X!nUZog@1-uY{T?PmmH(lK&pVaBsa{?Zo*zG<T&D4x29xA^^EbYK7wAXZ
z9`EK}py17`=w|%qj_-`Cr#e~0RMuE-&%N?{a^=fw*Dk)y{Ql?BQOi5Kw(LFLKmT9G
zb)7#OtF`Ojbj$b7{PS`8pNkXh`JVKvKRP~7yZ+57d7*Rn7T!I1td@tFKPO^Gx#z9@
zIVRTMx0!Y%aj(;{-;%OBhW~dIZ~fY1`@=Y5RyTeOf6(;6@92w1i#BiFdNrL{o8_L0
z=s~yGgH@ttS%*GsXqlKe`@q`eb(7)_&Goyw>VMAOJ}1YBgjBOlQM#wu49+|=|HyB>
zXa_snnj2poC9cj4$>@w-nx^w$??c)5Z(1g7es9dNLQz)nm=<$Oyt`snYSwyr#!oA!
z`lugKD9<U$Um3V&qV%^$<@UZ*?HR}B|8+OndhFeqU4<7lI&>lycJTlCwViiL;c~}c
z`L`L5u;smCTO04NZ1byYVjX)_Hae{HT(@eA??=u0(4VIjCQkkJrfNl+=lU=qF`g_j
z9U-?XYL^b}m*l)uam}QlUs6IlaptSigvbzqkWRjRM}E&;)pR5?rP0N*@3F=?-iN<9
zPtR0v_*ecgRN`*SG!u?Z=9}d1D*pNHZm^bxbLqb;vX7)TJBr?n?&69S=%~B(w#%Gd
zkn4)Ujn!-?7~@qk->oxfWC=g?>P6qq3mLO6El&ICdA)lv%Z_dAV$o|YzS^DGxhyq1
z=)7L$(NxK#gQ@GJV{WxMY_|STw?n|oihr5og;0%bg%7DN+q2xh<-TUIIKoupaBJ_&
zznp7Q3)Q3>JzugJ7XLPW<Y&K@@p^li*19zrQp~#RBNsJzJ}dU>T>E0RM^?aQw=0^J
zi+ie?_UQgxtmbj`(SMy+t0ymA8lSQzbB)SpQI_(*{DEvHpEO=+A7gs<{@dRap&gso
zrR?t#S2?Px8aCl>-JghLpEvSuu@iRGy_h)dnR8NkFF$vJ-rFjPk8up^gV_YW#E5%-
z77SRpn$xtfQN~!$>ByFQE+0krROy7ZE!)y~+_X0LIg9zf%7izUl~m(iGtQ3Hl>RC?
zqf<fV?}j4TpMO`Cs!zOKn|AlV^_I^T%4UAy?i;wPtXFva;kn{)<@2;F0x2vKZxqr5
z=dbc~)_lY2;p)6$<ATD?4|bnf{&riayibJ9x5-ELr)^l(^g_+?X}Ei~MiYC&aUoZS
zf8B{|XHR_J*wj>ZCfW1RF=Jl2S1&e7pVN7u+Wo;>=JlE0;QO=L@?_3rg>n5;U-R%C
zN0`AL7bEHKiyF4Gu8`9CpjXIraKq-jnuNES8cPIwxUF~s_7<jdYAD)!%wf8_{6o;x
zRmS}h$x5e^pJ=}QTDnZ@fjWmxP}j<|kL-_<gf=(UpVk*!Q#Rwh4EMD)|Kn~vH0!;)
zZi~geRs{(?&jYhoJvfwk_{l=gn#!5;|Mgwmw%NgDwf)@!vy`n2Dd}Nb)-rIJ?Vi!J
zy~?wyZA<ULyj;7}%mSCqe3o2YH~I4^&y}}$7iHdHzvlk%4*QEDyY9_Kk8aJ4KN-0o
zb?b|-(}Z_V{rgA4!Rl|+FITlIjci|LE!}p;)h6}RU-5wc(;5+l>!unB=p-C|^<i`Q
zfvZ_vmY+*6o_U`lCKkh&b9>+8CwtBtFie#5ag_Q~;@-0Vf28d!H4UwIKV0tEpT2Oy
z)5kgG-eHBMM!`C_mQ4Dz^UsQzkp`SIKemS1A7yjcst}MV(P4c(&)_Og;FI*ZbM+UP
zpK!jgTSslD+R|QDW9}>)*1%TbQ1*zm{Phc%4MO{r{vG^dxZzUoLzx$1%Q?GjJ_v1C
zZlZK_fd;c+{)Vaur)&RA9x9dcT-$kn>SC3tS|=ZWQDb_wD`AhC)hFI`zxgx%-oMf>
z$rZI^-=SS<F8lv2lCt^n_+4__^%JgZm5zK<VM;65!dKmQbe*AHBTw$vzxy)IyFc9!
z5X;bDc+|jAbLj!^3rb2|{flSJ<T$cmQp4kpEY>}i6Bt-HRvAaw<vnUNcsW^Y<}sba
zygg_2esG9qa44|<)@U(ccvZSE_?PgV-#a%&*G?<cKR4~*Zc)y|3HQ8{ms!UoZ~r88
zJ9B?!X<1QK%+VJwkHl<oSkrm<I+uB9)U~|L8w5`HzuA0GWUou+z6d?HgiA+u8E@E;
zzi9T);~#g%>K?fGWTK{3h{(gsZnb~Y{w;VC#q~Rkb@p6^d1amkVXJOx$^A&&fBW*Z
zO*?y@S4_Gs!sVWQtDHIWSM!!x9}av?5prMWzV7`ER#j65-fsS?b>&N=Z6u~Wd_ARI
zW`lE??dF41{Z34Kd9-d8+nJ4Zjjo-62IgN(O!u5+-m7p^)2*XhD%JhIJWoVVjIM!;
zjF7^C8EZDZWVzS5Gx_zGFMqXVB_8zX7H+)PqqO1nFP+pozO9*`Y)|iXEKi=cu#`#T
z;3J0Tt&MdT9sXMSUf7wmWQ)XW<vY{gnq|rLX;s8Lnwnd3C@81FP0zwffzi~%t}Uz}
z@VN0Ip3JT<A=y`Bn)l1hoo8pC^}nrfg>|#P%bb-fn}VKQPPCYM{$=_`*7>WKaV1Xu
zY9H{oTel)$<w~Xa)W7pn{&MS9XslYfC`tA2&*FcZFEq8EbNL@v`Ty^l`h~3hJ39Zx
zRsKJ`X8*lMao646X7-%vY^y!<<Q8M5eCvTIC9YPbuuopTF56Cav8$b0?KEkj9qZ48
z)W5B_qcfjgS~kJTtEXX)QuT@dCl}qRczW!y!rRr$M6Rr7Klt^=y9_CjihvWWmjVqY
z9L!o4aeLZ9zeC|IPOdu|w@iKXpv3H=65kK?yIC6z<W46VhfL72O9~L|&r;J1iY-~C
z7S^WXs=Bo8!{<{?zZb9?A8!cI?J8>AeNpFdwVw@7t)1$(se%g56I&LCFnupOw{mJ=
zm?+PN=f{6+osiWsYiVjljZo0Ch;=u3ZY!u>SQ%=kxaG~E&0V}4nN=K#R+l~H&%Er?
zEL~6-oEK;Hz9Ig6aAQ>KqAF9-8SAo6t2XPb=wi+}IU`d%;lPslzihdVgmWcU&X8sL
z@Z#cPag{^H-Ns6%^*>Y}n6A-VXf7;v;PG)jlXEY$7uy?sVd{E&i~V;<hG&tN>HIA|
z!F`uXCYh9%Ib>Fb3uY{G6u7%!?dHet-k9^%|Jb;3`|4T6^1MHTR_H_*COtb8dc`?n
zm04oo-aBt6WHNG}^<Q+j`S6(opC;?=d;WIqoRdQ76V@?AegE>ra^2$Z$Meto-`iux
z9w1P-d8w=StP7{v9!L~8iTx4I*nB`u(Y`|OZlKzy9oH2KLN6?v@@MJ8Sv|}F<&Ux+
zH+Y(LKClru-g_|X<?q5tx;K=Ko=q%1{x4qdzN7l$ImdYp*6=dD%NNRsdS|+6(#8DE
z8RtEtggGnf_ON>V%r^OuQ1WLY@AWx53}>i(NpoNLuc)ZqbE`_=q$eq!liBN!-maWd
zm+*B5XS1W`S?#c%b3eb7r?n<56nK^3Td3_kp=I~x19J`cNZ(3Pc3Z7}=1f1!cRP~;
zgJ&$FlRropMf+G*rTlp9Z@?kT`=lgegNj(571M5wnTPTnn64FR>`Bk_p1ADJ!IQ4L
z_#O)FX&1<!ooKdacBHqA1)J!}nesQjUf#X$hOu(0SN1WEj>OwsmDkMzEX$G$df#TL
zFJ9JB&uo+Nv}5&?pi_a8^5?^*1U%d{|NK*X{_vY3l5>31zJ=wn3hmjc#1+1F-L9W6
zGTs+2Nf-SQ?!u{O9a?+g(uFR+6~|pxJm6Efb6fWC@w(5Ce1$6+B@VEDlTWM8_#d@~
z_2B!NY<D(2VB3DQM(CPqkks?~wr!iYO)+#hGeI<Ss?`d$r_W}ckO{EPu{@jjOza9*
zCwrv-%D{cg->O%HKe-oUBCOlxEqC_ljTg;t<1&x@yJ4%obLtk06Ry$0JMS)=`fW<d
zvlELoGNx`7JJchT5pv+dy8nFJ^tG=4dSA!Eb@2Ul^?N7YWjJwOTXpaGIk)N0Hf?^f
zH0R4LE@r(q8^f<PAOBvz{6Y8LiX(rQ{(Y&czUF<~%J;gB#~N-J2dsP0Vq)3x#_jpP
z&(V8V&)%CeWpkDOL$jjId5@STe^E+&BDLPP!O%$Q*t;Z;9ZUkNEYpRSMjNs=%BZQo
zujtA=arc|Y1eLYk^8y1e-)g+x{(o^u=MiI>y-VNAFJHNziFID{g`~V6o+cK2g<)&A
zi;Ju8EI)kXmX$|vjjm_2e#?)aM_0N!2dyw_-+kuagzG`}i$jVWn(j8t>&r7(*0a+3
zmvFvWOZ(J0&v$-#>Uu0qFT>*f-}9FxB;IQD-Hnvwy|$2fIqR{{cX#AB?%6!$Y|Ao5
zbES4Yx369y)2G#09hW>Jy)0mY{`&XtmrZ%eIxFb(?@ifDcXyrK!fqyV>sImAt1<SA
zCp<Xvz1`?c;@uOKmwdhEs1@-Xxg?Y(c|6M9^SaKQ+0z?>efBeXoY@=2!E@vulR;(n
zHUE?q+nV%`nwzfXj@l>~Dcn8l#Px{>LN0&WV?3`YZJjaap%{m>wwvAWyuY;A*Sy$g
zQTOj%>gt90Di7s<dOwJ}xg$N<bNfuG=GTvRO2jVMdn{9;d8?CBjuacun!v<!NjcJc
zo%gx+|F(D_^xQeasN%wR;r>a*GCZd&18wejmM_VVEPrjl?)*XeHOH!Z>mLhD_MCff
z%e@udPg&o7aFqSt`l>F7-Fx@D<reo#om##xTYjhS=Ff+jk54{4SI4*Vdf=%a&xG~}
z<~hwivMTa!cz&D=cT$1@_ez(a3fC@v7Cvs}xa-3Si#DfEh1+B5taKCHXI6bXzxG&v
zndco{`^F@%I@_w>kA8eT`FeUw$m&04$FG|GWRVqoa@)10X=aC$__L+L{^y=*U!CBm
zG-1YcpIHf7Zf17fA(Q$I=k2bzn>;0-^=DwrI*}Qs(@eCiB;N1uvYc1>>eG+xlWd{4
z){B)KjLDjPGAQ0hux6Fr{jg4Jy_wauXPzEZXb`Zvsb}fB_>3!yNn>ZU(eg_Q5s7i9
zpHJ&=(hHfC-CdAaa__;Wn}%{pCdwOjNKTld^Z1a3V_)-@NOyrsza3|uo-J&!;%+c-
zt<<S`HECtM#oA5fl6DU^@2NPO+9@bf>9||2?#J>Tho;R^?i^=5YA5WRIb%8JuLL1u
z#g5-M|9mnreAW9{^I~;LUEQB=kDi=;T^!y0cvg~MebJv^FMht<cyDd+4L$X5f_l2C
zESC>(E4iv(UeFvRv1-wld_k*u-ghQlXT3YeFru*h?_<#}yEjp%o=ji-nfrE1m6u<9
z-*JBJM}aeJln!m0YVgr5c7ykqr3McfZ3R0Y-DbEs?|)3{q|Xa@4=^ohN%Q#kR3zhx
z=7ha}85FMX4DqNnPc5CfbLtJ**M`>_cE-hMcW68aw6XL3-5QbbuZ`#9&lMuQy%%|e
zYQv_nZ@I*tvDL{SXpcVI>8lJk+1-CJ>^wig%Q16Bw)LJr-?p($f9@e-q_U>K>fOWR
z0txq8W&Rnzw$FJ}8TR*=ea&WNNmp|wx!h#|Z|=V7zwldRar%XYmzYh}8m_n={=Xvj
z+$!aUxyH-h+*Q=rpV?n_Qf>1JekZ5D-OE0hI7*y6cX0AyTRp+WGa>^u6fOqXUu|r*
zmECzn@v>-56GQ0hf)qn@z8Z&cvjgA$N!-08m;0Qf;+VEtSn~OsrDd6u7k+H1>)NBg
zFY>&(dqu*m>b;yx-<@MIxpn{fN?V)B%;j4GW<6&8w7Jc{Uz2+$xA5NW`sL3Gn(Ffu
zm3m{XtLrlC?w3oQ`*->MhsmA#(woK3HB}V`H%xt3nxP%IvYy{uYNBPs&kROIb3vDj
zZn-&6*v@r_Ixk{kw&-2Xx-qIt^#6{?RKqNfe|I*CEQ!(h<IVa;^!=KTy&iq?QIGDo
zHva29|IM{_n~!xhYwxVzdRF^I+c%^reaSz=&!F^v!MvLCruWgeb5Cz}_@}IQGjH?x
zZ8y_@vwgpL=8M%8rw<+b?bMGZS@x~XewtYxs=QIfys7yr>k`4JleNd!*~RPsj@avL
zsvK35?dKG`Eq?RGb*nS4>qLrv%{=Bde@DKt{LMpcXS#Ol#AgPCb$4^DZWec(IbVE<
zxToQ&<s!Tj-=92nV+o6-Th}qk*)0psr>zLN)|71<cTiWP-X-SiQCGJ8M$7erzCLVt
zo~0eSTKe;AZKM5WnSSx9vxNWLPrM#jaCU{8@9AZ!UwBn4*5(-I8_hA3^!sc)$Ih(y
zsqm!5MLoMc>u##-uQ`5Fzq0Oj%ApgTcT*1K7$xqT>N6uIi_1XMM_KHfQhZ3rpT_%(
z_H4dfEbL~s<V4TOLje)pVcgD{OEdR>_qe=WOzYCJZ2|oO28XjJu<ZN&I&$}JC4Yf}
zd7p)Y?!U`;l>5zYe`ego;@>;D9UAU-s_pJrzu;v~)&JG+d8UTwn>hyV6yfU$pLa9d
z-qIm5YT2~V&XuXG@gfF?w_X2!dfMB~wG+>pOkU8<9n<0Utcq(v;O#%v;e4}mIh^BW
zocVav^_be4J+FS(pB0P}%<$Oq>+8&zn3E;t-^%9Ry}Re{x(9Y*4O6!Tw0@NC{o0;&
zAz(`P?j=9{FI44=9x+;K8ZAFR)ICD_!#}SEd#1<DQyKnG)%>*8{YT<d!EblIGRm)G
zsR%FU_%A7G{z)~=YuU|dr4LsWlq~F!xEjU1M{v#GSyvZ(UC>EebwTF3{<Iq{YXZet
zTM`}Xr_Ps;H0Rm;f1?-o?zt@co-b!$%x+i}v{dfLj=mt%h)l0(Kg3rF>2D3XQ1$is
z)-0RZPv@F`oqshuE@s_N<It>QPW_KWHTw>0#>*X7ycsS0)aq)tD3kflTX)z3pGL?>
z9{ef%+Du<tWKWA}YOVF1FD%)*LRT3p9gA0en4Y%hi|PA1&7!(*E^A85o9zzE-CCr(
z`cK~RH0zi0yXUIZ1X%6yE_XbA{>QI<vKRBuPS%<IxN_$AEc?Z?Mc1=zUVUzTj<1le
zU(N2D;+iq{R@fc8Y}ocAak=H0!zu?pZrQl+J>TmhZf@=m$HKigU7Ys(*hB6${N-Ec
z?ELyr>SnR`q+e#4>G6Rz36smd9dP8`;9RI1@!sjbS@|Uv{bH-5pQh#ba7I769241I
zS02Bf*MDo(2Jd4Q7Y|rvZVwf#*uxh6N9z1k(bD+kAI^omjbk?9Sv0TP^~uL<?|_pb
z$ELVB>vMZgQG4+{skR_aZcaGIAv6E_GmA`rM)Y<aNuN|aW2+|T#`P~t{x{sW7O#01
zv%!J;|LocOo!2hpd9%Lrz(XyLHL^=8g4nipyuDR8d%0h-<~Fw{i%Vj%60;8Jt>1L_
zsxapyF1;PIn)DfRUoFes#PvK~^qg%`u;1xP$>yv*rk8lP#z}ww@V=PebL9f%9lP_N
zp657dztDYFR{!=JPOm1UZL7>S*%fcF_LH|6FR#}cq4kY<FHc?mbG63Ltxi}@eREZ#
z<l7aztjh|*%C1%Z^kgsTzwUHgNJaSBPv-lRpT637tLDvjNl}@D%mqIUizW$9e)FUG
zdv2unlHadhoJkNo=oi*Hf16v#sT<C6s%z$%OSLX%zje9!&}H>om(_nRFWJ^zv1|M6
zdM!WYFkQKi(*0k`xNHUMO+N;|IJunt=W_oq%l(V|Evp`_?3~{?FJt22^;dX*@BUFe
zTb@Iqs6dl*`t|J>&&`V2`)<vjB;~^^Le*{<2v6BRPtoQ{rEY}({q7{TWBsdtPLJ*B
z`%ovUX?8I)LLgMXwPRTzmpIF;D1|3oj9&BJJbloZCK|0Qdtvr`uI8EhA_aVkn}2F9
zs}U<)^UUdZl<eWqqKt3H6z^L+c^y{s??nH?u<s}BpDAnHI-*g>_;u>Dyjo+qtIWBf
zwhhVO3f}p51}jhh&%~en{73i%_FbzY?y4W!SGqn=Kgi@KU&hx>7jMPqyxmh1eSeCi
z-t&et-vfI$U0#{V@7k9WwRL)hQ;gms<NveyYOUD5@qNi{@+@bseb;SzbJIuhvzgac
z?dyux&ip3ue0u$l4+~Egn|(+qxUlWs)KxL_T&_v@M+!wdINW;4aQ^3{P_B>OY_;Ou
z^Owh1_{QYQ>K@;_>f9?!>ui%ggO^(iH>}!xxO$Pmbz5~WuE*!X8>}?aCLj2^!YFyM
z;~kHKF?(zZERJxy_8pM_{YOEu=lLh52^{>fYH`2+EU8`9HCtUdT&^iwM*jPDJ@>d3
zduKlV-7?YZ_QFMzT?{8SD;_%Ed(4=}ez)eeu%#8n_K%GHo|^`rthSXp=g-bITRm|3
z^fdN0oXHN;*q$DIeaw+}r-$X7IWvrek6iEnyXpsDan>~J1CwUFKmWZ<+J4XN^;x_L
zD_#F=(W&E^A^qvC-hr|PR!2?~*?BRG+a6h%*rfL?`p4w#E*`jAwPWq;GiSuLVzkyh
zyjCD1t~p0&Lh+wjHadcaO+R-|j@#pPc8@vxLg8-LYZCl5ziUmlf8J?3XXUA~J5T59
z?&$TG*&r$XKr#0`PhZd-m7N)aM>tBHx_|#?uK2w`^;`3m&o|_MZRmRvR&>$!)U@nb
zYtI(tw&*^6xps%P?pG#z=kQqB8<8eHHEPFxWy!}dI|XjIJ*)I|zry~bHw^^dJvq9D
zbDc?7%8|vNgtl!nc@Uz!bNiw1?ipw5Z|e7V#Z2(#&^-G;;FI`4amSoVj$2X$YF~Yp
zC^C|=UVA>>=z2pjZ|&jNQF|?RB`FrPm~$@U{HJbrUm!@TLegiE%ayog6N+zYuKIhz
zTV@7Z#r=#4L5&$=*Os5;`;qp?VanVYfxg-OZ~r{KdNt$!u5UMexqoiHXL0AM!u*F(
z6H8|lRvfb}xbF2h(~4;phf8)zlg)*j?Z^A{jHkb2j@ltu@!*ZD+#6B54NH&Z6+AvC
zq}u;!yFqC3^ZLEZ+-!FTr=_i#yD@Re@6$6nC;hqpbIqSzMJ=7gq=kNJyE|Tmt#_TA
z<eSvleK>ETxK^6kK90H9dMxsn@8a01F5f#VSjQ#)$h%!XT4!^_m#=!=w|%>m>5u2d
zN<8;8D|l+McSz*xaQ{y|cy#^JCm)+FJAU@AziP){`RdI(t7`V@-a~DB6JOtWqT;bw
zY!0(f5$kSuxhd~XeJ*@E$1rKfS^4aiH3!q|rxuk;o$tDTGufs6Pl)}S&9`^vY5n_H
zu=cCm^XC%##b*4zx^MOT^9O$FE|@*N?%<+_Wj%Ej*&j}d^|Wlh)3LDWaH;-`{1Z7j
z({`GjPJRA<TX>Q1-U}%|g>D7^7pdBJ>Vkd$zH9bVrp<bHFlFz=8@X#%Kke?Y5}l<R
z6*T+m=krmv-044x*DcMJt98zIlxbpo$F#{#xY255QDETXYro<S-z=8;^7;Vd<5^p5
zViLNNl4Xy2EI9S)i(FNy__QL!GUM_yPO7a;8$xw_7hPQxZn|&Q6o2_kyZ*GdZV=aR
zpZe%l>zxIUo|_z7Tlv%Rj?&4#(<kOm+4xhe{eNxtL-E|K|J$?-Zl?V?74KL7?lZ@i
zBx6_iig#^)zVFmtRWZT(*xG4cO|$o#N3L&X$v62V{Wz-r%%7M`^}R87_uF>{yT5vP
zCB)Es%iE*d+pN2<OTYB3zd!5CwddPHYVxD=UA)#^HG9LQ`!Bm-S(*LhuimeO+X4l6
zm4EdJ%zZ4j?o3hJ`$cc}@_ne0sG8-s%&j-D&V6c41Ycpo^~(8SSAK6Uo&I&det%^>
z|D<N_KJLX{PmV70cw(+)qWACLuKNEyR+g89?npFze({Gh-S_HM$6(7_V!k`RmR`E9
zb+WZ}+xFeNXHVYB%DFpt@74alZ+G6i$}9KHd#7*Sspc>y^&OJN;?9vqrYF}|AI{m{
zarc+Ri%aH;0<6)BB|Dg$7Cl~g@1v;q;}>m5!>c4uF5bRg>sB*sluJtKoraj6<NsTZ
z^!27i&N&@8<7=xFo2sYH*BuX1+9Ib{FS%XT<xyq0?ogJnPpB2!Q-`N=9q-TVOSq7H
zv;5k0>8;7Odu};;JvW>AmF=_WC8ox5n|B-Q=6^l^;bdfW?!)71@w*m$bNi+H<G0%q
z`J$_Ce{zq+JN}8})_wmU?dtXwKTfi~WMyEuF2ukfh4Yl}V!eXOqtGM0-^CwP)W}%8
zZCV<K8OMnY=X`H3@D$f^+<4G{WtLTRj!KZi${Y7C{NJbiHR+_jZ;Z$cdls|G?;qYh
z+-s=*<lVQk@r$z$I!Z~z9#vR7gZqMF<y_-=2VUq{yq!B?<EiUWIzry({Nm^KemH;r
zi5+7Rvzw>TVdW)S=L2R&Bt)(^zpkYmXriC9P_e7yMA1^+#2~HHYXUBPsk%DL$nji`
zk;<|ePooMAmfhR5VUzdSPtU$vi5EG}Q2c&X&~bt#caY)g{vA{LowQ%(?2IWqaW`>m
zj@A?AjNtBnmF2&~mK1ECHf?Q|!@5l};^sk*vliYuf5gi}m?OC9YS4aT<sVz)cNuLx
z)jQeM{rMBS9shrSGm_fBU#5P?uOE7E1pkDD9i7nZ@@QwnvkT^5Z|&0M{4`P9QoK9r
z4cmGTj~$bWx2lF0Z)l&k?TJ~n=mU#D3BkQ`<`bRRj6e48-_r52mGk0E^QPOK8>>3*
zuW$W$e|d0`<G-&De%qP&&zxYQGWq3)4HsSpGj%U#iL+$1T6Lyv`j_lO>Bl+#m-K9~
zbo$}VKhtlfValBrzyAdeyt60BwAk{`GTNzegXsg4hWVD5p2R*$jU^ibub59b*Ul0)
z;Zbhu+i2-Y?mT6C?o9Z>Jy%;cHC3eLZo!Sm4F?WzbLO@x$_mALyyQAj`=R~3-LzlL
z7k2b}9a6|i@R_)Har1(WLi*dbZ8Th+eDT73iyI0Hq8%&c4o#2udSCy!B`rZ%)VxIJ
zfZIj`iO$z6o~=0_Y^<<2e(rba%O(jAC$;o-dd@f(J;jP=n%>P@KXN{tsroCn+}c9;
z*W!?sQ5sfnm8QBrv1VFz=vnJs1;yG)sSotOORiA9!mn8wnf2E2+wF;89q*`S^p@B3
zd|#}3d6MM%9lnlwKMW(HZ~2<Wxrb_J?C#l}xY|PA&0g_+VPNLL$XV-73Ux$yELBwd
zF+1eM5k>ZvJ<rw!PE0+tX7UrB#dTpf#BRha5lfcIZ|_+*C+eZrPRT`m4><J{_Nlm~
zI(%wBy5g14idNm$lRH{l7EMZ0|K`5Pa<l2l9h_wuiF)rjiZ{F{d9dQ;2SbG$*EY-+
z7Lz!=#nd}-vYl+~MaS;I<v|f0Maw?kyT~eRxwGSJkJoA5*;k&JIbF<~Y87F_Uz67A
zk?d3U*QLfv-F45QLyv4&JNIOzExf;VY3P<a?6%^QKk#@<iQTzq%3HqX^(y}lEaCsX
zmQMeALO8)8<(>EbxF2g;-k2|295{J%ftAD?%RhUpWU9+6&is7tKCk}W`TKo+dVj)x
zeN@r%QO~{;R4eK{iJ|-9%4*9AbNNn&PT<<n(zUBJBVRE;wBYcD+X-dr2jsQpEWO09
z%N_k$xNQ5i7cPGp*Y$4QHRIX3_tRE1X7B&nH>)=9Z9?+x9LdlOzIz2CFE7O3HYzzW
zdv$rHvxwNdI`49i7n7{2cXkyT?OV_~x4+I&yU-;}@AvMB52rUR6_a@IHK+ISa_L{c
zr(C+Lp_R7s!IC+?@AgQutJyqWRu!jhqb2zGO#^3ZYSR8g)8}5jD{8V*^!Luim7m=>
z^1O}iumqgtk+}Kqd0DsIgJUcwkGyQsf80Imfmz9hltbUlwP&R4h+yL{;(pT3U35z|
z*f=raeeq)d<LafI*PpZ&vfd3nwd>VlcJ4Fs!U3NaZMktbwPj&@`3?D!H5tAZcOO@Z
zRnOPIu(kKh1=hP;1Y52gaNNoq*v`<*>%{jvVtoMLC(hqLTJoQNE@IuYA?MjG$?FGJ
z9V=bD<dwkNUkj3NO?<e7-{_7AGpE4p6+HK|q;8+#HC}pYZqTP`iYsp$A6^r&g?paC
z)2J7U^Ni0|6k2_~x;N<C_U*xp<@b`WPMrJoitUN{;fddEKdS9cxcsd5kw<=<=4^KF
zzhVc^9G^9P;f4Rd`F`HAek_^a^GmWgaMz_SiQG>ou3kLx<G*yyqSms1^Bu}(yvt#K
zf9!GFCI3SrI(s*}>V&-Jtmufzv-s=Bc!O*E+MGM$GwmkJST`0F&*`~(DfGILpZ3WM
zf8`H8mHQhddF%4M{le?b%jX~4`=0^zJn`xB`}eqLGcYi$VqlQLSwWPhB<dAZUafsy
zbldIHi+cN`Yf8T{OA2pLxxI1mnxNwobKJM?J38rcjq2(h3KlAY%?!=mdWAn5&t=b1
zx4vsDeuja$p=<N+tBF%ng(SX!KrNf~n=fxauK#!1;!)<ozmqNfPge+j{?lN4x8-8j
z@81XC&6O>ilAHIbVyD*4fA8+?<FA+7yje7TeZ|D3Ip_2%C*@xIV4z*OW1HNM{r}nL
z-K=Lg|HeK^J@cgSj+yzJY;+#$>@7~8n4WDmS8vs(Q$I^iJu<zc9XVrJq^EC}b@>z1
zd12XKZMB<xBi3Cxzv#^4l9hE+&82@FJ=8S!Bwv#Q<2f^?jK`m>PELDuOUixf5#!SQ
zlJ<koBda8zM|Lf)DU&T^GEU6j%<I40b;kqYEK%{xt1afHhaYX(+moJdE^U`M-9~@G
zSCdoMW*a;&KekEzkF0t@@YfO*eV;4a7mN1W?LGBOrei}w`oWv^`)kc?f4#hU(cV99
zzr_MM)k~YT{GM^0>;Lgs=gjmyCbv&)TphN4mC+p4KlA^zoxgu!?PCiq!PL(SE!zc|
zl3fh1`^&A)Hc#`83-&NI={R<S&wKOz!_43QJbV}Tc&CQ9_{Sh+wl(6*|ER>Kr0rJm
zvuE6R<-gR-*(Nc^FM99F+LnKAF-!H9Qw{gu-`Ob~`njOXB=UH@z-r&dq@#=zBwrTr
z*_bxI*MHo!FFt02^S7A~s%NY81ix>X8{ZN6z3gNA^Zg&Lv@YH8AuT-q=H&2iU#8Yp
zrrw`zaK1h8qlDX<eESL8<zHyK);>Ka-uZvd`Bh7Mf9RZ^#CK+XyXV2|J?B4l37=Tn
zP@(R1Xi-9bc;Z3#9e0}2Kcv?bv`5MBt^E4!$<xi{3}=JayuLVhy88P6n(MlEel%I3
zd?2v!t4D1h!_nl++uzT#wf`wP|69H2d3ml4o-_1T7o1$_%<!c1c-f8D@qK+alsKoe
zY9IFBaqV&sBd=D<7NrGYm!Ip;-#24lZB<p(x68Y~U%s9{Z(nucD$c|MAOEU&Pp?x8
zFZrz;C93^E@#d+0^<Vz|(6nY=RNv*jZM*mz_UbpX@gHQwIIi!l+&BMh-R$E#<;Chw
zUYGvy%5vA|4U+fD@2aekPvSqgkF)Y*FrU!W-&I@h{ZL)|e-Yc`pX=|HF>F<MAGzSL
z%E@(qv~*YTu2Zu6{`JoF4SO2Xq`o){oA{N<J4M&BWH978&*NqO#x_gygqWqn&BiYh
z4tGC4-^(lVgq`n1p#CF<o!c9m{#;=EnZ;3*&&>LBBInGorveN2Hl}fX+AfxI(Dv_v
zy^L9!C;EL)bZ?l`_~qU4ThbZJ6zn&yG~}7F;^K85$A9Nq_Gqr({_y#~w5p|Vq81eI
zJGr?--1Yq8dH-{?o!-Cw>aDs#aaMtYRxbN3-48(q8F^e2ruX?Vl<4R1{yL~|?O$lj
zI-X@L7mi0a)>Uw?k)3N%b#cMksWZZx=a~PwxM2TQOO@!HjUwi!6Ps){95s>DKg_*s
ze`nJhq04_|7aZKio6>Fjqm=Vp5Kr6Y`mLuP=ub$W*`Cck>G|i?daQX)WyS2Xn(S^i
z<#Mzwe8I9_A^MEttrP6d(-$*dZWPyAyNP)f=S`u?Og5H@_X3tPd|V(I&+EKxsryEz
z_)I&E<-ccVUii(sCOk4wORw|tj-JCR|C*mW++7rMN%?G8@t*Mb;-<Qk&BvF0DW2DI
zJ%wrMh7;?}eVxxsXDoB9zx`;B<re=#U)OjqtYSWE^5VGen)V0P%x6t9x}C4_f7>1y
z`}gb@sqG=xf8B16ZhV)!%rW}R_7k608_aKZ{H=L*UC{n1GRZgh-7`DO^2hyP*n_3N
zO(wqGma*)>?MwRJ-utyG*1vH3ckK6H@8^MsJ<jI0nf97r@NwKGc24ztdZgisRK4vJ
zZuI8_e-eIPyD4Jp>-=R3(WjSj=v)3Q`nxT--k9~K(T_zf?U}b*vz?ZuF)w?vxa}bO
zA^w!RMyz@()10&RzFzEDf1APfjlAOhuRGnPwz$69e}T95%7lOo0n55KXe@ud;mwtx
zdk)5ozX~r1tWK5FniTVC#hD_>tW6W%<u6mXt>wel-NYF=P2``N&SJGFhyJE_yYi$w
zZnGKav9z9D<fXhk?>pP9%nRGprNk8@{SxOLdwJ>X&3g^YwH)j>s%A|LwOskhPMu>~
zlHAuVffIDSp35vg9XS2wl3QQRgD2=Z)i3zU#1|o=v|P`8YVy%)=CdMC+HEI1xAAfk
zEZqLc@$XrY6mOsU6P44>?=&t+eRSuxkK?wM<L#F5Eulfb9NgvB9o)mPEUUN#6cSNw
z@(GQe*+=^i@uo>7TwRmY{dW&2159SK&!6<+*z?MHPwS%AruQjUS4g+S?YFAAByjn{
z&V-k%IHt!2&APE}c`I9P;qfl@+ZspYy6>{wz4EA4_uiZZ^*8yp9F@;#75?mgb5C$~
zWyy8_T_wxn9`5$LkoZn$@+#STcbT?K@QzPeBjx<bVWPqQ#G8i%cRqXY`SYAq&Fg|W
z)1K<2C_KErF#ZFto~K=UM~Xt@J}&cCo|w%>lMiN2y*+D#q)tXaIFEwyYq64pH?5lO
z_51n~Zp_~ysZ;;++1KvBm*?NxV?Ddh!t(b@QG??GWubYiE~zj6v>^MR&Hm%PSEk(B
z%xdAGIN?lS(AjFm)oOnaeq{gl=3J3Ny?Mw*y_;Om-4aS0*Zs2U`LsrO&-3qYT_!2n
zvY{`<HrW3E8#ZBWstRYvw?nJgpHE(^aQoVZj*PGVN@o^im>V?v%NSd<d_KLl;NQ7}
z=RaGhZ$5oi<-mE_lTy-~bPx1~^t?FAdi!&{?R_ov&Cd<~71fI^@0dARMS*MaLx<0C
zhkrOripO(ZnA^?f`Y>!k^vR|>o~+W@7uSSGzB4UhwqstFVPA4S<JwxC?^1p2ALenX
zl^Jt-^uM(@l9Zizl-DT!?wZ?atQXAUr89E{y-JMaO<r@EWL@CT`KhS*og*{rd)n#~
ztLDyd6t_Ic@It4@uF>12?upelwX3f)%?uUlpSSUJZ}M)bSeqt0(Kvf*JpYHyIoId!
zySQNO(ugUa6CcQ#O7rF46nhXg#ffL-5k1Ab41eban|V%N+`O{BbjN$&3;eS^V|%K;
z9#TCKCa{+K(>~`HUz^!ZY>K^~Rhe;H?m<RV`@Mc6r)6b-jovTJtzI%+<cj=~whVIz
zUT?qY+68N#&AqXz>@VL&uB{Ok-4h(AAG-9mWV4)={U+U(JzljsO_B|3W`A|sHZ^z7
zq}B<_%?%TGb;NqhotgEs;L!6x<&NYT9Ctt1*6)*j;kIC#cs%c}>w;Gn$d@JPh6YQm
zo4tvJXZGf`4)$3RSK9LLpS;qW)|<!jB0u-x!acipu*7oDt8I^XRm{-4AWYb3=aRo`
zu0P*;ZNgp8cXl7-%w99DQ;5DZ@v};|lh*&srRr<#5_WzOo2_v|thnL#tYoG-hl(%l
zb48!HZ#%c^T=Bl1O<HfwKHKb$Oh58D`nJuFWNFv#vu!IAJ5_nsHmdBFdBA&jjk}I*
zUP#LW<)iPN#q#g2i9TzWH^Zd6)FP*%V$sbHK^w1~V&|H|yNhAdO@}>a79F?YoBmIr
z<b2LG;s0AFE=xC9I3anW&vT<Kvv+=G_MgSYF#lje#ebb^XRDfPt_e+VbF5#{X47zv
zX943aqbnOHByh7WOgp?_E$ipsX^*>;9^A_`nf2B8ae0`^JK5teRMKA;ELKXBuoez9
z@zgVxahtfImZvN7;fB-9-#T?S&8eNW!CP$k-GiGMrkvd+(YwE6*VT%?)-^9vMNT?}
z1tjNK9p!3%SrYOg#V|3jCG|Ud+Shk2AG7-o?mrePnPr<0vVw=hcWG#SLb#RxyDc0d
z;+HkfcRgwdTwAc4F>U7ZQ%?2<uP$ATv`Ls3xbUr|oVb|9BkfnG4nMiG`P3F$9nZSC
zOZA?Jg--JM`hZ8kBIoCg9}f2H+I`O#7cSt`^jNWS8E5K6kDe4ILtBymzH9dJpOqK(
z-R%4|HD)nGuy}+Dv&q`~WtSr(KCJ9IVHOo-{x#Y9%>NA!KO5*i?$F%4AVIW&Iq~qK
z(5cIF;tEqTk~T2awQ>pvXmTC6w%~#Awv(GHMIWYhN|l|s@bRp{5w{Z?7FU0lIK>;b
z?$D%@4RHsj3BH*0iEUjnuaIydw}EjtGxLpAI_5_Y{{8LBd9RY~NwmsM(Y(?f^7raD
zY~Q_md;XDooiZ9XRy5t^G82}6cy1E&#jL2b;6);?=iM!~E@oYOm{re7Fu4CA*Kg^t
zN!dk}k2kUk&sW$X{MF~y494F6sQtfw>i22xSIS-V!QR~FwsZg8<m*=+ntr>KHkqL(
zUHCvojiSoo|I1$eG}RBkxkpU&sMfQSHC@6sM?XF`UaX<1Hp6m45ySe&KHW=sB@%o8
z&-iKo;BD2sPrJ+Czmi|hGQBl(ZX?I^#5qjrXEqfb?eZ0xuBxV;W<KR0!?#6KI<wX(
z<~oUN@Z8p;?4ULG@CNUB&2A#ql^=c@>`gq{rS4haZtoU3v59%(#Kw&>TJsJoIaSsw
ze^SU%s@#~c^3046N?eJP1fRK2W15&;<-^Q7Q={NR{d%J_^E+&v3TC!F&Nn)so3OmV
zcWa|7^J#VM!ih0V8h_;Pvff#-WTDrgj9E43{ThBB;$ZRJ(Qr`e3X@5`#^X;Hr=MVZ
zW7{!z&zhi!{U?2O|N4Xo_FmBreP24=!&D%9wt?$Jkq!JF6J6U>`B{V1t~{7<P^j)~
z0;h|L$RUoCGtMrIcDxp8wx6@4`bpa?**dmuJ6~V@Q`jTEXZO5)1z)(LeO`&#FG}0<
z`{UxDJdKwBe%^a|{(E2jwd;i~FUk(=ZJMrZsCiKISL#u<o*%aF-~In}{doVq9mm+k
zOiMaG3kkO;Rq@nkhHbxQzNKy6>uc<~yqgdEi5+RX>6CK9%%&?aV%;H`XM)?s6!~uW
z_KKfXo>g|>op6{$jIf1OMYBwm=;0`aYwkB~nvdV+WeitgO0eY1SSr$V+pWv%vDvpD
z6CD~ieb5ltakb;I+5CO(6ML-RL`EF=#Z~AXFpKjTYa&zp#`-zatq(ht7pN!by-+@J
zh((<J&5eYtC10XWuuQI~xXBo_!S!I;o;{CjmbTx1;{36U?~{Ik_pv0OP1`5*2weE#
zw%opXLaC$Hs;@8p$Q<imQypkOD`t-TkLrYix$!-nl?980<l>qZBu8xY<rmSNG3nAg
z@jq;f(xzO=TH<>`_FKp)%ZOvMPEUxikP5o{Myo~C@0VGI&2PpP`){h4=ajSxJ?z??
z+M4FbBjUg&pIg+^e|U1TX4ck@Q>&LWatU7joFldHkK)TpjcpSm%^SBBa+W8od~)Qp
zZmsl5&5qM%{|`uY+<2&{S17YSV#gwLb9Qw`o@vWJPki1h+q3?G?EgC-e^~mc?Jhr|
z^gK6tiJF$J?B9x4?^c}2zhkbW6IAERq@Z`Zd12j(U9;v+yZLO%lSLNGrQhg0f4Dr_
zgSlCPcitp3#%JP=qKkAjuRm$2uv?w=vwM}~wG~gwV^&>R!WghJJL&VjskU2IWlKMw
zP*Iqp7s@^9h{kt2zgMm|lH=D_?t5}+pUUR0eNlPhkwM4a^L2BXyPwwT_tCM`xxVP+
zlVXv2bDwLwg)WC{y4~^AjZ@S-t;4Jzn!Tblw|2n<)m03tp5LxKOFIy!_%Fro<BCI1
z^X`0IUle2ZxoURG+W24xp*dQ&WiFJ9C+IC#mO4A*@8bz?Wp{M=eE-V(C-gMS$2I#Z
zbv2kb*8~>J`Y}|5UFV9Q)s`8PGNXUCFvq5XOr{H4-X3APzGP;+)T`u~A=_UoFkDyD
z=T`ZD!sz>P=GffZCmCdqWz782ySS0vO0x9!X@iv?XPlVnBq#nz^>nt~b{n>n+<X6S
zYwdB|R-B?dJC6NZRq5%KewJE^lUYO$7rba*dvtkAn$)2U0iW00+A>AXa_))DOYd`5
znJNgs<a_?dy5q{#{$Cxei?7U^kvKcg!jQ>BdRIjhXI1_q-Yo^2yB~>!pJ#q^%RJ$W
zU%u_Vve}Gtwma>b-oIZc**yKZVim{!mJ1(^dl-A(U0dyJAd#hF;wGjTGuwa09gd*i
zFAsFR-hX$k_2d|x4=*p4h8d)G87|lBHBX!^TFFtO#URk|kN-*{gRt7<!eB|YS?3<_
z+3={WcQS`Y-Sw4jy1KKPmv{H5IK>qnd6#rk=|}d%<-2nxhp@8AoU&Lo$soNv@cgRT
z+dheIPChPe^Wl>Q#~P{i7Z%Nb8rdOt%8G45f>AM3liL^WEwjBZTubB=He~+IE`LE`
zx<d4-9cQ!@lI9#<ta$VK=L$uBCXG9<u7<R|niX7~r(1hMaWlWF#W|&<=>al@4E%OH
z-<Wt_ue<n1!1(BgC;d%tCSL#aW~wK%LFFlKB`zx|m)n(W_L><^8|8~usLoVLJb0^G
zQJU=y%gZp62Tiw6PFUM0ny_uUxv<Kw(CmcX<sX{2DH_yH(Y^eG|B&``8UBXG_X#$x
zMJ-12w3?D^d|n4dKJ2klh<~(c&F#$iGhQNJ7JgfNcWRfe;B3i-+upx6n8=f(sl|M2
zrQqe2imL+yMZ#E|LljQC&0eeB^RSRPrQ@CopK@**8_Sz#76<wEI&xUHw}vLMyuMl5
zaZq)UKL6sWCPCa+S1;JdUBb7H>Blx{K~ujxz8Uwv9d*m_XEc~mQOfE2=VMEx>v6sf
z%7zvO(^g8dt~;J|=uOu3T}$_z`tYivLT&DnTw$(E-L&wTH-vc<4lejGjd>l%-HVeB
za&d|FPfBTVJvf=Q&AeBrFvIETZIQ`ZD*|jv9iHuPJ|1>OP`5|4DPB;CCq91a)`wTh
z0~zOS2>L6$phD^7_e+dc%eEYzGsn(Vh&w+;;)PA}$12`)e5_Vy7j~uTok%)xYVVvv
zkp-oHtpyIrY?WASd1Uj{Zd)GyX&Y4cl@{)}I{8bGVa`QeB?Aiw#;|S%;UnuE`I8xa
zS$>(nEA0*4{$)yB$kR|a#a)b@pVgkK*abgj{1;c)8`ZO>VW-0!TcNwVo=s7cn$A<y
zxZ`F6&xKP09EzSsOx#605)T<;E!Oc$h&vcB&2nduIU@J$?gmC12K%H34cjjG2kQ1P
ze-n|Kbf<X1`VYODU*>;M^-(Tq%`AJOb^4`9f~qpVUY7mM4yWy&aemKEvdBC;a<eD*
z=DUIwv5z%X_9)s%TAU6jQ#o+@1oQMcNxvLABz{ag7j}AvS^YM7xteCvcj}*6{_*e$
z?GGw;dwcUi#z$@20uO!}KEB_x`6ad;V0_)oyk*%k*5yYYnoq9Uk@BVEtAqD-(~mP4
z5|jAl3=Xb&u=G}eazewp^9E*JJls3duL@msa8*8g*lx|mC7=2w-yWNA+ir<qTUTsE
z_=;HW7b$1M6<)c_U~`=zBQ?+K+NR|pGG-|(CVHA1KPS&v5HoYJFKa{LogJ&y)n8uc
zS!n)J;LwEyoRb1urd-@|U~5E3x2w!iktny{rOT=|PWGR%vf#v}Dw`Ki8`ip;MNO-p
zRH$)5a*1`^wXpl5{z9jAWqaQAPr0yJW8<nhy2cUD4NDn|j5`bK7ainP%!*#P-Yn9w
zz0jv1OW8(`-#Vw$K=<tABYv@7Rb3g&`(kgYa2g!i$7gTq+2rN%*?>>jBBjLjrog0~
z;gPHk=|R4W?)hGvEzSM(*Sy{*c5A1Z@;EPNSs)`l$?;Q+Mnr&u<f=K2dozwT%APpd
zvg3=W#*$Z7B5So%F1&A89Muv0p;h|Ef0kzN9UU&shv#sz)U2%5ye84*{bIMECQIdq
z^aoD={v^D2QvG7{f8X<Sjz?AWJfC-H$nKDmQw!b{Y2o}=SxaigEc1l?j|El=TSQpi
z-nq2aBOz|dizYYe<cWVJ+82DDF8ZUl)9g#b`nbPERVvxK@4Qb(MA$xDbHbsA`}S4F
zunFRBQX8I2h_Pp~=xlBgWoeQPDO9U)y^*|QRv~9{66enu9HPtlHiWQ0FmOH+8zC3T
z)gRaD<lDLF@hv_vE19PkUYn=CkV}&6)>$TQ7xCm2lhUFG{}wNmx)>C+tRryWDVLvG
zhd+gyeR_Vec1@J6&c;^@dsn&es2vTyBYNP^sfav*rqt$zQrkZKiMJ2Fqpa}kPtlFO
zS&0s@PmT(TM7W+(6j#`@&SLg6&G(xfo}W%<`TErO-qicDGuP&&1wZ_0`1|36x7^Kq
zKl8&k%zuA%dV_MI;9Qyg^)uJpk6G`1@BD19iz<88{AEqNKB-S5t3IPd_3JL?c}rjZ
z&GA{|;BLxsS}-TD?<H4-)w$OX#2lwQmE&8Xq~AYPzP;hO5v%9!6Gam<`ED4B9~IWP
zyEIk*iM6M9f_oijtwr%CmsNk8*_-Oh6d&<rSVn~^Je19J{PRWaU&GuRiS=h@seKE}
zv^UATwebBC(<#o`Iu=t7|69nB!+D~)x$M@QL$hK%R_bkgmw5kTv&RdM%3bvj-yPJg
z&z<}H)@`0SpD%WX{4R9Y&A5MPV$+@TN5bBfPMxwb%0<b@_h{ggD;&?<17)Vajl46_
zZX4Ii?ULIj-@Uaa?XvFchmYU>Tz|B>iYetFYr)-?x4nTfwRd}X4*Zs%uN3%?)heoE
z@i!mN4W`F$GY4(Hv{B`tjazJ<>~Wh%2aRSVEZL~>+IXhpo^yuFeLfYQd$&sV`uEjJ
z`}LjU%VjGc9D6d;({F3~?TM0xVjm_qcQeRtIJ-jk%9_?cDYN&?U)gqslW{TMQ5&ur
z$&!K@DtXGTZ3%|$O`T;)44ba-x(k2QIe5+exWjrYb_>`24Ys;nS-LY8_qFxARPc0{
zAG*KEM(^T=S;e2W9oQznoqK+Hi>u?04ABlf?^Clf6&GG%sXk{|aL<!NmHVVX#DkBn
zcCztL;!baCykzs~#M+g!&P)8fTb;Lg=d=q<t4%)Vci&j_=W#*f&P%!zgQRm#=<PXc
zyrcA)8UNk7FBiOf*f+GD%;i|XULvjaXXVPDUVr{2-6|C|`g-uyI@LvScTRLp=<hh$
zc(eN+d)U<{5@+H##lN$v3jXDn`1wQN(fqSZD!F$4EUZ2wVaK}oR}hO$KuJPV$drV@
z?N1^Xh8#T_6I9Ze^2kb$i|e?C<CQN*&O3B9o}c#m$CuO@#~);znlZyl(f6s>MK!-b
zhm}<kQfaHXLbyJ~+4hybbz`f$BRTm;j@*kRIbJ0`1wr?!2N!kXt+@O{zx3H~O_UZ-
z3=({_D1bjRT_;u8NJxHn;_Nj?rpGo27d>v6lYGPUd76ZVnEP9X<i+<Dn(pq}6&qH4
zeWCuF8>yNBmEvj6t~nm+EYB^TyKdX6#;w0uBDC{`#1F@X8ixZU*cPZ+iZ{CMaGj_u
z_&%%c1WU~Sy>^x_vXcVVaWFP4d#0tdl8Jd^MQ`&P=Orvl)Z|)4j<VFP4U$#KY@T*`
zRnneBBj(e5a*ofI31ux0T2q@QQ1bis36Vb+mAx8H%1m0K=r3A-S!Ty8H61|(=VTAj
z^j_EYJBNbj-ss*^#rglb^!9Z-5=>?sbM3KY^O^q2WrY{}!oZcqM`b^_?g-~|?clxh
zY;wcfMNSM!;uF^$V4fkf*!JBF(K;)c8*i8FjSk;(`)=ANDdF$OB-JJ^^!vO<bmLYJ
z5t{`TS^=#gOBcr-Iyo)H$GJU&KX+y3eVZFWd+VkeZV#=FQu6TrZZ%=gpPPs8Zj^g>
z=gYqW&TsYlO1D3UNH>W_|Ip$4Ce&WgxjE=V0MGFTD~Hp&t(5}0H{RnsyjWi%bdl-z
zxEr>Q7wX^s%5rb%tK8G`VnlY;dddm<Z=YD2xrODd(d+EZyE?lzyv?mk3V*Y9^`)v)
zTUeF0h@TH+agSI1;Ca2zcDjjNZ?EG5$xt8HIn`R<rd{%oN!>3bANXS>W5*pW+bqFD
z6-O^Ie(u?>U3t6rhU491KW^Dd*Y>GTI``<T?Xiw-16J{JFHVb2Z8fn8CYvru9M}=y
z<{SRFYyCs67Z?6bEca4~Jjrd8Q(&z6(A!wy+}$~=%vpMm6<oh8^_=0l(qz;BUnbn)
z$?>S%yn1re#cB7X7=Bj^R=j!Nv5R3r`CloY*np=z9odFeQZ{miVlJVwf0iFPqIlX?
zS#iVSFYoMM$of@IeH8aI;cN3^)-_)&4oCmGSF+1zQ{)Vv<vl(&57tdl&uOtg_U5zr
z<_5{b{0_{!Qs1v_ofs;pk?HVYMvzAS=bYx3o6dgUwsqbjwe<#>GPlb=1g?snJMBcu
z3y}j;#rKGO==-qnV*SO<kJ-)~<&gg|yW-K7t`A?8dH;OaeB;T5zey}64=g`ixV!(n
z{jzfP9G39o3=0{*ai7v-pQ0mww0-ye<Np<6_VvHNTl_`!<EFL-6~^a0YZhIsS4?eS
zNiq1A{PuvH55pn53Cs=&jI3=}zFVCAbgbaZhN$qj+TYe6Ra)6KRV9)+sg_?L>(1n)
zr0x5n4x3h%i!Gn@w)1au44Wad=+xY;M^+VYtgzYm_+o_L+L)OZU&^$0Pgws`m^+el
zO6QBpoHCJT=FI0aavby;Obp&|Y>N75Tc^CZSU{nI%T#tP^P}e%R-bD9&yo_>!J1N7
zd|f7%Yu%?EPn2UmwoMV3$f9}nT!o|S?L~Is`yaf~@)J_<>0@<h_1M-Hv}_WCNyEZ$
z0i!_0C*9ls?XCDdZ)Uo5qsz40(_TL06nmq)ilum^!o%zcwkywP_OyuEoLbQCJGD8S
zEkt3qXo}t9y*DI;CZvW(%;0R|{%H8%ihAKm-rG~2F23Y?=5t{6tu-C0vK<N9**lW8
zEbqvj)>52y;OGv{8`3(Wt3EZA&1KxD^xnrZM`iVbZpI#skQ#qx5gGM$3!Gg<XD^6t
z`1Wc`%!8hlH#Da<Pg$6IsEyfkjdsWB=a)4Wxop~(9a1FCA=9mVex}u@nnhE3Bz74H
z8Sp5c+dkWPC2xj>g4m<dt!4+FE;#OTc45JeR%tPl2|L`?1!E?9t~!7Di%a~yBQYsr
z>)xx19yz&i*F3?O1(L@+Jxa|a{wI9yGV}BjQ$3sR+SQ|bLD(g9L8L*Ttn-=m&QFbm
zTy4ECduc!FWSkgL$o8kRwJS7AFjiLidKgo$lgt{2^j?K@MoF9O!g)F@@h6(O6GawH
z(Kzyg-AE_!ro?lX4|8T6z475m)Ft1y8LfTH5iY^ad)<0tPVpUH9JnIRXLDw!cWV=q
z^o2(oTA07xk6c>tc<qC$d~3=R(i|SM%{sY3b<?)_O%u(JmnWXu``L(t<&WRdJG>eO
ziTQr@p{glL9~D~GXq<3qVrWll;k9-u-p;7l@^sy+U$2g^ik7U@6;z$Zwz_t~+2fy0
z7gqdza{J|We&(`S8}F~OT5_S!!%QvCWcDMMlg*}8H(ajtc9*qjZQS9)7Nq00!gtTt
zIje+JeKNC~mTf#OB71DDM#N<kBktb^Bg}dtZnh@w&r^yxzTm`5{Yr;lp<7m&cFbD+
zb74?p-sS799Kvi&2@h)6-tTJs`Qzt|vV$zmPZkKPyl2d`VcD~{lPPh{giKzyCwa-@
zs=2F+_O37A@*%{fr*_%SL!I-w=AK>rQ9Sh8nu2NTzcGa$NNOur5cP3W@Lkw6<FQ}n
zgF7laT2mGnUToN2a3wp=<pf*ER)Yx#PsCc8SL`*rbt}Mn=kJ*PWqjES-bJR}u-#K;
zc&1PzA^+&tKkJ`Y9eKF^Nd@Qo^$))B-k72oaoz0y=k*W%r(fS;E@P_xYfsGEa)H&3
zHy6ieO?(ogwrY`t+pI}Kc`HJuiYbOp{LEy!%PME7S(b11!_0#M!3P9auP}UVHgT)?
z4Svm-(+X;Lop<{<nbiCK-f>%Co2cnW{;TCT>k4llJN)u}q{1^6E1L%!WA+#rbR|x?
zWqsfP=eob5{EgAej-IWWrfO8R$!XH*3!OU@>pNySeq4O{Yf4|i>6Y5dzZv$mc<lH1
zRm<gKEgm*mw9J~j@4%Y_p7!?n`<DDURQI~%yk!2b<Y}9CnDthbMs{DnV_Oy0_*ChB
zS#N#s4DmDhwsKFDtk0zMZ{PScXs*k%mxqgwicj!PTJ+$Q*RGDFv<FQ;J{^7Fyol@V
zjN@HXCv;xVJ<+x+)>E%#9ZTtvdb@7F{Z}?BTCX~6cU!RI_x%N)-g6&a6123wHB;ep
zneZA3XJ;N>=UqAlN%!w;U%R2AQGX!==LLz`zg9?>$t1Eb(~je5727vMv6VG1f?;Ft
z^KWOT&YLK-LSiaoUJ;*R{zl1*Z+e!h#``}^{9Bsz@yf!VhbJw%vhwo});kZ^Zg@E}
z;A2y<mR#`jWA#_JgiSe{FTAyWS9?abTm64sm8J8Rx#!=1XFKQLr#E+Bo}7K%;)gun
ze(tipzn&%kes*tOWqJMf!gBfdS(2V^yEKf~9e#07d*QKvC-Z;Abnw<(<;zPlQ>of=
zv*F&X?!`ZY1eh}7T)w}1Yd0bO+czF#*2y7{_P7@*I-Ko%u-=X(h~?tigJwOZcNKR&
zxN-2X{q=*7*IHNnS#Gr=)9%W_f9uj+I1`k(taQC)c4waJO=PKgWS*s{y!z!ICX=~`
z_D*c)T(gn&i_E&kE#cB@?u*;7^BSK%@}%!pl+^YoC(fOGCBxX_mN>WFJ@S>o?0Ylx
zmdd*(7)V^SI1*CS<tui}AyP)`)19;pA{_^q-?qEgc)4A>&MUcC+kmOm$4X9pii`Fg
zi@^NfQ$!>>1J3X8WLQ6Uw{uTyc2M>0Cl1`NUFUG~vz_Rd$gy4=KTn(8<lx$>2WfxV
zGD_vX-I{r8(yCjc9|R>lR)&2~<XIhRo~wFjncAB&t_!AL&gq4+Z(1RxBDU0b+l#v!
zyk9l{=9<cxo$~pXz_D{bnckJ2ooX0bw5+G|*RIM#Z%@8q)@gjRYJ&9fR-2$W#&tn^
zEefkGf2ovgV}7@uWux9-5#~iaelw+)b$%30`Jxd&_g~Qxy&8R`*)uHdMFQ7w=^Rd-
z^>o^_<sYg#xne_WP8Ml!UG$D`+tzxz;hp3A&h7o*zRACTU$?#d|Hs37@BTf$Y|b=y
zmRQbBCUff?CT~@aQVCiy&(|a1WKP%T7$5i7E>|Ruwccv))O*pww<znF%7%Cwhv_N_
z&nx|&Kl*CYere&(AKBqk(=Pl!(e-QAQkTq6|LvdL`&P81zUY-=dFj<im4<+>o+M7T
zvoS{u=f;GsnN(r6_U}W#@=0bEua_IWZuoMp-Qmdrp^)b_lZCZpycw7NKeIo2YM4oT
z{_e#dE>APADbG9MDEWA%N#Hy63Tv@-zAyF}9^~qua&x)E(wkS-l<t<@V!qqAATL6A
z^}M`QeGJpnpOvl<e|)9oNm|f+h1et6HtI|+dn{JRgq}WSJa>(eYiR^`=rgGe({~sP
zmaxv<-DG;l^2aF)$*R}Nmfy;+c3(VFIAzE8XL|40+$StKX>h-_QhMe)so6j7&zpGb
zNcQC1J5gUl@-9_<+4J{>>*6i!$ENP)vAyJad)|b~)sAH)-m-nOr@CKRr`hvgc*oV+
zZ34nmlQw5%K4RgTzpiug3bv06f39krv--HS_DLJ3ef73ocQ3tletlFroX=HlN^p<F
zeHo9OH_261mp;yW(OGq|*n7Rzu3gXV%=a5gl>XVLa??!cz#O~3e<~+W7TmS!rm@w5
zEWwo~4f~XWZB6VY+KwwPm0?UNoLlLr%~8Bg`@qS9Lv7-pe0(E)eXklk-|^G&ZaH^x
zQj=@4?lYU2X`And%&~}iS<Y~xxahx?>9xl8BMnyhdaO~JetTMF9ZgMdpZ`==vCC@h
z?$_aS4t)4BA>hE*U7PMNR^b0R&-zg4R+n6kWzpI@)`#$y{^ygu=*hfl^2}!^TAiQG
z%80sN^(fH%>-l#d_A~U=&ngQSU=bG<ZdD9;a#N-A;*C>6CPfm<_t?z8J7v!fgB3Qb
zj$2J!k(jD4Wb^zrkH3F;m7cECR$go01+&bAi@#h8Q2&+?<yG_K5wmc4wv%;R(D}_P
z{EtOXJFL7sTD4`{^@X{e`#Kj#-{{)@posT|h}n%rT0ce3*F+T8tUM(0xF)!?sB6KF
zX@56e-14_=>AWpdKPRtmN}RnTlTSKTW1IO-QIn6CN<W@(^`3N6=2pqc+~D0>y?!sg
zixpKEoOtuM;KaAG=D*MCKFWSG={gWIVWOx}w{-gCf2Zq9|LE7UBsE6gG^}=wel3{7
ze9v01KioFqxyZjpvubf=(MdDY0|gsa%sQ^fnsQ;@E`9!aJNtcKdi^~YRh6CgPC4m&
z;qGsx8?>&U?5mp|HSPB&9#4s;{5`QJm&-DLm6i_9(2Hw-=jTwGynny#x8MIK-?(1$
z-7BYg;rH6CwplB}XM0b3wc6lign$IwAttft+J8&$Rjh8$E8W4+<@dDv#ne=(^F2Cy
zy$!o$W?2bVdTe2^v9bQzu(v0D#&M=n<^8Pr_id~Hy}A44%kt&#=g9`24;Iv!@ya0O
zbFIIuy20+3sh5vQt(I9jRpE%BugE^Vl39)&drB(%D<uD@c{)s*-^5VA(e%ozxU!rt
zH%-Dfx?axvUHsym$M<-ZWQ}hMT!kl-p6{qV+0nMX`?SY&hGc`NecfD}f2w(OmA()z
zH|Fwq^5fj99e?iqQ7nr29>3qR?%SW2zo)0```2Ab=m^M~5d1Yj*-LB1O@)MVj&kXs
z*<C6=`5(TjCq>`>8-85k^0EI%>(h(ha~};(5mq-!cE54mP|GVls>PzA-hKT!riA<3
ze&3Q5D{FkW*zK$<U(lB-1*b`Q;wk@%PapMow9QIboUK+RHPT|5`5jiBUaooT-8QYZ
z-*Jy`?~7%=O#h-kuCjJs^2>R1>5X{;uZ=9ewn!`8o$;Idy0*p9;|nM6npNj(_ehNM
zLqmMpNmYrSUAvvbr!n>K5?H)#@&}<lo%~*dO7Uq6XU;z`y{5~(w27(siS09Y@c^HS
z=^vUG1Xu7k_UmMb?7bLi%Idk~nnz9cgZgaut|@nwcbwj7d{_8qrOi>7!(tcb*e3=s
zPSsqr@XemvtRM1!$9b3MKjxcLQ2wi)MfPr>u<%5ctxsBR>{7lz>Gsy<(tx}zg@(H)
z%@z3J7OOGW)9h+{YDwjjw>f_c8kej*B3<O0VjatT@oRG2X0^3?&dKq6$~0$kcwf-o
zJ<D`)*6D4<FTAGxyM3&`W=dR=`G!MP(-!{Jatze;b)1~QSfmtaroVB@)q{KUxK7(X
zYu{G&qd!pATIT-GdeqgoepZ_fX0tFbg!3>k$l+XlTUnBkpQl$)xi{=?-fc6Heb<BM
zsEKd67;!@AO%hwsg5u4(FX9_2U$iL*WV}4_%xN-{=gq5Kb{FE3{kJ)LZK|7O@>cH|
z_hB{u{hz<j?YC)*UmyS1u39-LL@YgAQcJz4F^x~3dtP2anb>@{;~OrxrXHz!{9yk6
zhi|^T*)3UH%O8Gf;S%5AjKgy;Xr1c4=QQcbQf*!}&JNvN%LiVW;yO7Zva+&!V<OWl
zUWqGQXA_%x`-1<;tGk|Lw}j+#D_*=Yqi697$HGv>D^fdJQ$wn|9$#zL%leX5*&U{>
z8TR(u(p#L1uTJ~4`_GId1G`4q$_4VB<;Qu=+WF7jKHQzw$aFGMQvd&seLiCQWAx(U
z_x`SwW2}{0?<??j=k}$KwL8~uJoKjaMwM#N_BC8@<PYg>VPEt%dYzZz=4;Q~|EHfk
zD-|o^y7I|2v(%i!bGO(p`>b&wKzFv&cI(p0zxNh?5kGJ#;mDy~Cw^%sY95vmNlFub
zT|G-JXoYoAdf>C*8G9S1UfZ;;`@hU#c9vJ$Hr-R@cxs~KcOdJAa!Si9CaJ<DO;Rrl
zt|(meIOrb}^`<8H80YlrxSK7Pw$Htv`o}Gz-1*9`x&4NDH*%&GzkcEEQD*IOd$HlI
z8tGf@1!+A?yu+ugbGB-%a{Z`#u5rUYwy4ejHg05Bx)k<Dv@P?&^8I>+?VmX7kH5W=
zDz*0gp|<x049tveFWzK{=QRhc;^|$J!B_3@_Q(OV43>q{UZ352#H}+WLZNZx7O!h7
z+*FGjZzwi@uvh<~{%PS&nX|<W-LsDhC+O?>J>D$;=yS2z+df|J|I?&?mE5tLb!1wl
zo?ThZ!i;yOlP4DDXX%6=3gvv6RdxNzuItbAPPSwQz3n_G6XDMu@!_MN_M16Nthhf%
zNl2|ad68}D6}f;k_u#S(x45@A26SH0u9{|Ych--`%>7Gh*o@!(xRRY?xJGd5_Kw$E
zn(n8I7g%lKs4PzW=(u(6lQj=-H|oxJ3Q?*~vvZbO*HOmLwfK5lzV2+k?)V9JYL3oe
zJFDm+B+|kwbt>2*O;Ma{|CRXn`$}dARA+pWF;xHf)ceP&tjPQwzTTIc1vwWiE&Hlu
zxifr*x}D=Kewzv#!`9!8%31$?k4Mx`<qEn{n9-cUq4cbE{@%`vRkv5Oy}fr`de`M$
zO`DIeH@#N5D0y1b=2S=X!zS;Pzs|Xr__WuCSL0i*x3BXu&bPi1#(P|v?LP3n{dq<D
z$Pe@Gwsl*kt~)%F=M(RX=(=`ahEDOToQgi}u}RlWZKbC>Tn}06l#^0!7v*6->z@C&
zM{RQ_7F_=Jc6-W=xIO>9yWSsO%f$U5f8F!*2f1g;KA&zkEB@7I@9v}tiOw?eU!2cm
z8o%SNS^aL!_l`uzF1JPQ=Ua+gqdurFOFZ!E$<Cae@4tTdnD|j{zkzP<;@RJRO!$5G
zW?^K~@dE;J(pC2B*5!X;aju%lsV%a%C!}lg;k%F9s|3QWn=EJ7X05T?92aV<JFnx-
zfjR$0X4%_zb*t<vs}3x$Tp|5;#Y@AfVw<+uUNSTJ5O#4tYB6<vr&1)3JOjg#P6h@^
zT*Xuh_%znP#kY5C-2Z#M!`qhuyF7f}Jh`;mdROMTqM-e^3f0biy;W$d<?1AKUS#EQ
z{?k_d|G#hF&EV0%^7Wz0+wAIjv%6gwyN@RA-^jp!<7)fE_}|YLo`2l){XCQ0^M@)=
zUK&<!{_scgz5Gu7Z+tgAH$^OcSTb$%V)1tOzl+7)-QQg9*~~pp)sXv#Z2zRAGFF@C
zRDa&P*K^jHn;9mWpOl_17UX{3t#Wpz_;Js7PZNdGtE)dnPTI+>KY!(V&G7k~lJ<BA
z&rhFOHEF$AqD^YtF}stBG2xB#l+^+)!p`q4k!p=xS7+z>tlQwx%h@HfR;mR`-2Y?}
z>}wZSTfyzSF0Am~-PLAXYqGA~O#V<Vb-y)J=y8kx``Ud6B){H}WoYJCmOu6>=w5Q7
zSyWr$1f9)$*D=iqcwBVB``54ZeL=#XR2R*(TqNJRy+-6ip`q--E1TqOLpK}kn|o$Q
zef30^J>h*;{O=E26fZAaxL{v5_tl+Sd25dBJd^0<t>4@D#l&RIotD}n`@e4wzkKn;
zf4O?SUG@KWGXw-0LcSNN-O7KrgJZG7R*8L2<%~KmDm~zqW0wD=sGn&Naz3oeTkif(
zPaDqVt8TIu<VbwpTrug&t(8}UbholziT3JSQGBdGwEFV}`{m24ep{7$u=u5Ma$K3W
z(M8<jp8TGk&5l2F`rRe%^Kz&4)IY1+w_UtPt;x^jU-E*#246nE*72`Cmj2`ZS>7+z
z3LWRJe4m@Fw*TT}CBDyd(k*Sueog)qy*|s4N3Bjwe(Qae>hAcf;&00xn*#-wU3pS3
z^Xp~cmV!ku^7zi*-VoXEb0NOl_riV2xe0P>l+Ur1TvOa^t5w}!T^;zKKS1@&;dl@I
zsOdjsL~fSmmWodlf7Ec@yvR-ei+=Fm(~5P4zoxhMRTZhsm$9@x(0=@$#iPFh7Lu)V
z=KXy+?X&Cs?nVDBI30veuhUPxK7Duj*_7+?A2`p*UVAX#?EA4RoS}zin?FnYt$Ue)
z@!e(p-FXZ@T9bVk=K0Lc4KGld;5zf$$vs<i!mF)K_xha6Ki|JcC;4z?0bkqk3x0Fk
z*1eMBj@`b0zyJ9eFKj%6%=Sn$UFE;=^TQF*-Uq_78#%v6#GE;9lX|ixYGGrt!%?QG
zMb{R`{nR<5V(>tH!(x`p?6=((Y??WJk+Z?GpOZdI%=&Cu#a{egEXTb~uXnY8a5H-i
zQy%AsEIX-EBRStHo}B_$D(5t}N_sv#+A1>bW_JeT?&C{Mnm=wXWlTPQPu+06lu(;N
zi}j&z2B`-3yEz5;W;|TWK5KtY<V?n|<p+LQaK2#p9MQJZJ~?sDa?gMtGH24y9MJv!
zce{_`#;Y?-zb{Fi?b`pg-d^FxyY9d17DUe8dVGK7v*x7RXMXorr;0~4X`XktEO~t6
z=6pexsD8cI_3OXev1zZCc>d<^e1H2syBeF?>Tlr;ufCjT_uIOLLtFEc>%{O2RX#S1
zpU?JRv@<&}J!7eiPEL=}1RplO>SbT|7_tkVJ7}N2#^Bpxr3b$>Ug!wdeA3?>I_>jM
zLuqx-D|QMxie<^oj2%rUGap&rF8{9kVy<A>4VS~*KbN2Q$uWaN;9O(jfzxLbd5=d5
zb;^H=Y+ajU;*|d<!hL=EgN;Y!fA(d#nokffb&<HkTpJK%u|jfQmF4>xJ4$@57&;HV
zemvdWLwVMZLT1~||4n%s_vlvH1{d~7tG|@7FS*h@U--gI)pre7zn*?PJMX&DFKx?T
zmH%s|Ka78C@n`k4hx<bh^Os5gzb$+G|F+aW*NgtlUvw{zW6wRo#_KH(bMO0pSSFM7
zXEAqTi{SffLHl^-&Wh2moTc_sYHNCP5c?zb1zY!O-sk1{lEvDxDpx$i)S`RJ>5f{K
z#EV(xd;DfcOq~6ZC7@1rib>PrH8Xq;{pR9h$oNuz;e}Q2Kcjyvr$w)q?AwqWq<Xkq
zCX+dvVSn`6Ehj%`ISDT>VPoSjYH*+NXxUYczqu!t6>utMm96e^U7qc}%u;8^RQYp$
zuT;$EBu`%7;B~A&`h<|e%{PbZj5YpdO0R1=5*EIA_q>Xa9&I@Sx0lE5x>VR6|KR1f
zuz4E<?3%NiqYl0f)8Htby6E4f<Ig_IvP_8j#I&dCveq{Z)4<x??HidaZf2RBp5Ntq
zr1dkK+;v}n_e9|p2Iq=CoZotEk`~j7yw49Gik@G8T)Sgk{=74-vK{jl)ZV*z^#^11
z_kZqUtRK9E91|v7Oy^Nvq>&)UVk4jxFh%i}>9MeGksSteP2BfaUn^X6;N`Ws#Xhxq
zdqr7f;`%N&NT_}|*ygapDJ7xu(6W8~iH-t(YBo!syg1W+Q|OnPtH_lEHck_to%7wb
zBQp4H>O^@q?rYFcQabl;&x!{e^X0xroKaM3Sf3onJd-i~sf2}!PQ03dr%B;XvDC)f
z90iWK{x&_@1&2(Sb}+1C^sfBz)T!y=)ey#irCND!J)brGOj&FrxwM8)Y#Dd$rlf<H
z{jTSJ*gkb<!(G#V>mqh9H(q~mrR`*KUw!7kheTozW!+geneohnFEUwI|4j5?WIp5*
zG=0VG#$&b|7Vlr)ey}0?J+t%9drZ9^$8X<h*>RDleBQ>w&GE*0TO7T2hY3b)4&c3>
zu{-rQ(`nZa|2zckcO-3AS+VGw&DTddOy8DH6ufQGxxDb=N98kOS0qIo{U;^cs`KPY
z-&$yJW5Eu`eODuVp6oa6WQ?5Ua?eEB(o%k&&G9>}Ghc}r)ChcKn$sqtCc(arPqvCn
zqWD(O%*t|^mg$EL92t@<;x-<AyG6hFcE;Py^RCHWWjOM_gMlNDY5oEA13FwuAt^Sc
zMh+aCSp!Y89^?x=WZpKXkfrliCR^6wWGDHstd1?R`{Nt>m{f$ac<i$jjQlbLuWH=(
zvy|L+-~N94eT}Cf+m>w=xKQ9K?J4+c?g^E{-dV-D1#^^5l%H;U5iDPQ@w$%VWG{Km
zhZEZ$3#gQsYJJ}P!+YYQI62eeZK8<**$-|co|z@(oIdrmcEFB1{OSwWe>~0NqHR7k
zb5ia?KSPzMd~WT43(_qIOjTG|T}oTlFXMYKk<IQyP{t0yUn>~xPQIJH;9~IUH>*NF
zEI9q%@bMMFwX?i<Bh7ob_g(kO(46etdrE^VPnQ3Y1doRJPo1Z637ndz56+6^RbOD=
znEx+V{?Ke02{X^vb_e|qwE0b6B9YSZWy67@7X}Bjs*-bL1=jPa`)$vb{MyiZSz;^0
ziol$2y~<O)+iPSijDCGt-oHG*ZSiXJeE+#>2l*X*8@m*Hw<(>SRJ6qSr-<Vt;Z9rU
zvhsO`Enm#KUapS1Y_`qxsC|ywPN9E0k4<bi{nJ+Jk=~4xhab;AWn`}2eMzQL;|$k?
zyA57(Q`M#f^)lFeN{Gtb@uKAVhqeDEu&mv=#G*`o&8%=2ON;+o_9gv$dfaYDu1#-Z
zVEEI`D&H#Yp9>f;95nh_@#e-(rZD5jTjng8y61#R(xn>BO}`BSE+4kP@Jqn_?e)O-
z$$azJf4|sQ$Nc9{FDo0%InJuNKF4eig^Mb)zu<pzhW&VjR!)0MZsX^~X+4wQ{QQv2
zIAtC;gVJAqF%zEy=OfM;T-~dm*=eS(zHOV5>){hW&3~RrX=s~uJM(Db%r|%DXW!BH
zXnrx_Po9HE;gjb|VqGks)V_pRtNou?nd!wFUCDn)Zcgi$f=w)YEF(7YT;E$#<aa7^
zK1Xk<c$HYfRQ)S4OPRm@`*itbVXOSAtN$c7+GbrpEUsU7`p17U#Unlkj!H;zJ$bNy
ze)pMUsd6sqni*{@bIgOpPfYo&a(e3Bk9&L4eM7DVlqV>!&-FcjWmeq(e?QX1>-RHy
z9Q=8XEnWN{!~eUp8`L%xd$8Gwz1y*JCRe6d28Z}erSLDG4l?As8=F27UQt%@qxD4D
zk4MHY%kCw;Yfy4tTD(+yZHvO=8S|BzQco4L{hPfw+u!o%bC=V6cI64D4jk&dv-nMv
z%3&+3uBCT=vueNp{Gso$-y54f#{;!e-@CprSZiSFF!TJgOR^m~j{o;enOGF($dwQ*
z<SM9g#do)F-$bLUKU}=8yv-8mS$1q%s7=C}{KX2d1N<F${~u*Id6+}R@oPce=f)4~
z&nvt;IMLzK&J`aoGHv8@V3?w`PmHO@LpIdFO;d4VrIM1zeV*?XE>aw!iypAZMI8J#
z+f8Ce<Dt2=#%jUFI?CJlTtYmzc680U&Hve5>e<h~fB)7^o^aLRfN#DS_X3_OwG*3f
z_kZ~F>bU&6e`Q}^etGoc$)~?ppZ?T*t>FGwB}v@VjC+rmT-PMcBk?ZNJe9K84kSN*
z@|nd(-Kuf1&K~8Ur)!#@b)MZTs&~|8$<s}~3@JvQiVNHWCM|Q|iEzKOP~+$Ut#d9F
zz4hO=1+_k3s}+!w;vxUz>BqBtR_9+-mDD7=E)|<|TT#{{ZQ0f}K~t1It(!5a&S4|N
z{hm5c%c>=o8l4%b=e6V$gp&Ba&FtAB-e~G@@lA_fxn^u<s9LZy^ThI%!guGT-9EJT
z@P6NuoPW>DZSZpP$~s-Kc-r|5leb!aTVA4DGC5O$i>WB0?q{;JvFsE*!Jug6htC5x
z%++GwrN!c6czN!^)@nPOzYmX>C*9SY$d_0h<TE?tMv<}-tNy2I5&vK{4}+A+V&}Ji
z)}3dvo16cLqPD?@LmO`Dn=++-I$?VBW}{Wyl9Nr#FM1tK&fVB?h4)1;=a*RjHAQbV
zS)0FAF7)}lL)qhE>ix~)sceVNxs)0B3axZ-amssp)o-J|(2WW6R=oC~nP#}c<w*01
zo4NgSD(}SXy%1x0a^|x`wXHL6PTA4w`ub<p#S~w&y{4fnCcTsndLk_}BYIgwna}?k
zw^!-2xA1p$q(8dDUcX%5EF;?YBcrwO(feL!E*^`FzBcpW&zncvKW~=rb4`2s>x1f}
zcz^wyhq+hn-ki8Kta@eKqy~v6J02)Lyyj=y%wE&L_VCXieR1c|_nDKYF7#RaLzOWg
zXu_T6hbJp9Jbm)u(wat&6`C3wSSQ;k>Cb35Su7Nm8gcHi`I6_y|JiJRQnps5zTVQN
z_V=^npZz^5ZkB#-o3r)x-1%KDQ!a0v*|`0o?fEIzolfnc%S*m6XKwH~Y%xEib;pTW
z^*gPq3V-Y_6*ilZFprU~Qaak~!u5&IgU`qJZnEK+Jh5%&g-+hwO^(xVn6vGhrxY07
zwq^h3w!dqCm7UfUEv$%tYh3kWwO#3aLG94Fy`f5HWyNZ{gWp_jvwD-a*U57(Pf)7X
z%!+L*O-xo)nR&z?GRTN|ojA{Lr&y@W!LwU!^b3nGKUn@Na#^-1-?WdJ7q(8yUB&L*
zn-%@1>bdKtSFL7KKVMDiKBfKeNuAqK;nH<l^N&suZEFZ}|F=5v>e^8EPKnIm%>Is&
zCp?=aJ)W;vW1XdcTyWluS5v2`zRkAo^mW)O7`2{bk<gE@S*v25LRACiD_mvm*!kk}
z3s0Zz>zVb`FRy-_J%#b%Hnv~2CEpI5=f2~7@NcKm<EQJkd4yc*6R&vqUE7Q6g50j@
z!7(cjHis!jtX&$$7I4<~=9+`o#Kd=&iY|L=zWvSOQ(PiJJ-4qe;Ly1qvS0@9ww3mQ
zn;c|)^Hbl}#P7dVd#LRHzRuL>O(~zBtg-t!OQy^7eARQaTUQRQEL*l|v6t(anBEOF
zEIr2j+w{(aPFk_Hfp<>&HHT~6@85_rvcEB6)BCKy{>CJ0BQdA@Zci><IT$7>G<S-t
zp-Psiheid5Q`O&9`mIYM&bD1-dUv&<uy6VKjeYOTj)mM4I%@2nb-`g<=*wGoQq%e5
zm`-(BK2SSi<B_DU&hhAvfPb+*i)z!MIA&4Sf5kd4m?umT-NS3x%_}Fd#`N6QTT?@8
zR&NVQbTf?z{o3!)TqKpo-x+mv(;CK{Yxft%eY`V8U+MhwL%R>kKG^^3p94#{5x*LD
zs8pJF!Az?gOXWM>y@-FZ>NLx9j~BUpi!ZZr@>S}^rWL&CK00x!=XOg!%eI#Io992}
z$o#W>@Ufs!Y;9NJmc>eZb8la%pPIMf=COMk2GLKqx*5qB+`gjN>87euxq<WMmJiD+
z&Ya@h^62BONaMQmvyUgtNL*Mb=wAHLM{YKImu_3ok9mF1YOG!?{`IQmg84K%r)NFN
zd3}Y4ZaNCLrQg(<tIk?+FL(KqTe};BK3-Ni-D1A#(#ly)f%}|24c2^^`b0}JMZo=g
zd!^Ncw7qwyUoez^5nrWR#{6|*Q123PO+_n(U18p{D-EYj{#kJ=PES8iCVT3QTRT6`
z%68|vW1~Am)%8_zQO}1L+w00)8(A+3H}7f`+kC1xL)wb1WY*4Cs%6K;W(cieYb*0+
z|M+b(!<4%RG!<O_@@>wLd~x8|PnN1DdY28@OP^SjdrCCSb2)ra?uN3>#XUx)GY-#Z
zFVSt@5?It~SifRU#^0E^X4}_gT@JdyZy%o>yz`>$q0O9&Q{QsyoY2!L{LWsg&+;*4
z152jl+I0V%mmW(ZSBQR?x-Dpv*G#voVYiPe%NlIGXyhucxHkHdmEk<zRWHr`_hy8|
z{CJYKy4vs#|CT1x0s$%A=EkVs>#p65t$Ls<RVFXT^|_%v%W(duMb8#hDBdW$T`MlT
zd{uSo{<9Nid9b+}I~2~U`h2GJM*h(^8VU#ggxQ$B`u18Rch2eC6L%$@_0K5GG!<l9
z_rapawTf%H%p7i=lB1WRKSZ2}e{f30`~auW%<KrGO?|W4rbV5#H0Vh1@13pv_|6wD
z?GxYRw!9DC#2}Venlk-eA9qF7`M*lXh5u}*(Of=j|HrPGuUC0xHe{6CsQ=rvD9wdm
zPrCEVP8;3mooiS8m%iDb)%@Cf?u}p9<?1dOD_t_XqvyIH;$Gz<u7{sfrY!w;Y_rSj
zB%jjg);oGRXHQJo9wl+6rF*q=#VRHaA-!^e?$#aa*uD3QKB-lknDtbiSJhER_TjIp
zDF>(b?OYb(BIYS0EWP1h;@fuKmPspDTTMN+FTTem!d;My-^(FAv6A(&*s9MBwI43|
zO!;TFYx?t6C6j40UE*b8uilz^z@TcuZdQ@6s-m-=FEREycub&`<wfh&{vh+0_TS%G
z-<mA9I&@b@RSC0BCo`*y!gNOq*TY*s8#F|#zqodMlj~P0ci%bfMGNKG`428mmeQ_0
z^M3ZPZL$GZ&oiuim%71V^{-6k-K!pR^R`|6RWCYC_x-*Kt;<miCO5*iMxNeLZuNN8
zng><)_GUl6`>RPITJpStLge}V<x>Cet$lo7x6MgzUo{hdb~gW+^6=+L#ZP=|VwjhG
zH)Wh|E}Q!(@~z(zw%fA;_N}oM;#sNpM(E}=mc57G@?K&5U1GV%X4>z4hXrQH^;&FQ
zyqno7cH##{_Q{(fOHNJdO1#Xn{>!9;^Vkf04fad2r*aqiOWBIGrp^;<?%>vIusZo8
zeeQehU8WKBZ&GFEJ+9^4wD^O6x5&P-S+k$s;Bu5+d-#U?4Kp`6cgJ}}mMxW^n<RF+
zFUUzP&DSVc!g4@GYm!p(x#9?Be;o<&pXQNn=8p|;X=FUI+Gb+7&{s#qxWjYfxy8B7
zQ|{}tY!iKDozk%SUQ*TBo~l>d1zn1NR|y47)?4;xrqIV90gm-sa^ly&k3ReT;-;J3
z+doR~d$a$eW8G5TlAfz&zB70HdNS{+&CwIf_N?PDHa1~Z_P*6&eMTmWHIBR0AY`t1
zpj_XnJ^8%+y8JipFq!mSOn!1@@sE{HCox*yUGuo5;@c<w`hLxs#qB=Rmdgbu1~?bA
z&z@mY>bg}nVN&SCbqo$W>noQC`8zA^5zx-#-oq1opT*)p*0~(Fr{@=WO;3q!2wbk=
zYS49Ff8D<#rVW!%%xCP6C^CG#c>7mQwz=gWmhtKw==||u;h8_S-&F6|rA?IGd~MsU
z4?><!2~U2%kL!=yze!|Ch~Z<Iy8Rmqt^R%cl=1nl+zjjR%=zc<3CA0|#opV0gF)H$
zdg#XVnd;&E0WNhtjzO=td(3J0?cr1%yZ_slV|(h>xIfD2_<C&ZX5U?G*J7MEp3B+i
zvNm|@#v2P>xt~!C6<Ohb+;-=l9|dJ~xAqvW{A9lR-3<QxJGo1jE$_RRRk5}-xpc#h
z1G)iAS8jC7opSrZt>vz3Zg4(h*Yb~D{OZx)-P2!+RtEKLRXcR#`|6FImVI@qxo67+
z7?$sve{JW+<_63D3@f+y&+e}MHt(NN#_b%%Hof=q1@>Ye-RCtPU3u+P!j`VRx`(!>
zv0nYhvrcwh)Zq<Zc(lG=X{qL_Kl?1@p}x&b4>5<YfudVysOoQ<HRD;|v|jFxo;NG^
zT-Y`7tBRXJPen(&K(^VP3u@o0ReDXY7}d{EooC_qlza8=&BbeWa~x`sHNLf=^O60O
zTsfAB@~cgn_Z5Fm;L))zx8l!QD7SlE#DP54j~knoDo_42>1oX#9~%k9-%os(yCf^G
z-kuxZ*!b^gz_}^w+0-LGRU~}X`rW?w)=It?oqM<45YRN8W-DN;c-}4Ttm=N_GeKRp
z9aCSMu<#tNk&y}0)hyyr;H+O1rD_=`;+MHbU(IHXo_*=Gyl|hhtUvX|IHP9DrapRk
z=!5H$1ar5r-&LyILiVqF{!CqRT;_t3!xaW$>18Z0D^9BUJEbpr*v!sxxl-bF3d6~D
z5(iVmJ-J?N+^^bd^LyVHfv+uo{|)$So~?BK#W^STnPJPELj4J|Gi=R%=XBP0oh*4}
zcKPPDjBAqLI_0J`iKKO0=r|Fgt)AICZT|#)7a!d%-p+|0x}P0ZfBw-fc5^$+>#+Q+
z>h2q>xT<paCa~u|bUDA|$$=l&LZ3#zf3#@TgG=`$FRq>>|LRkIVVd#DPZ_EebrGgw
zTeroXTUPR5k3cx{iu>7DXZ%WK{AxYlROC$D6)FFJo!{mDL^WPLP#nw}wlikk+?3a=
zHxwMpwk*AEw05~z*2_78vkx3jzUmYAJ1F)=_qpcF|2e<NOf~z*qBNyQ-dk~t4v*)W
zdruEmJZ<>fpZ7MuXZyC}6W6j&>tje-A~@%(^1eGa=0Dr<fRQ8PMSjDv#&@f0+BW_$
zeEo)Hy6x=;$Fu8QVs^SSD>{{4Ejs->eOK&Tv&vUJmOm!0QoOd>^W*xO!+z?5qMJDL
z_-1@RVVKUN?CQzY$LyDCvnb2p!|kW$t5PEmoO$tDR;>A2kswpc4)@3{Q9i;S6{ktR
zEZy?*S-e!)l5HzyZT}K{I*4J;d-nBr?pyzgoAPnr994hIy8)*!{!3<?n#Um`RWV0x
zyUe3`Mb0@dAO0=*{-~Gfy`SHW_jeAbOTFl`IA{Mn=grUUNwpEBPZn89>KwV5s%J1S
z*!skhX$MbOJ=*-1@B0>kYbC$GG;2Mpc<Ldo$MLT#-0AwujQfHY(-ICZIkHfu?s1FV
z<F4Xh+qmHKrPm$n&#_ICx%BJb)YocT{!jWYCbROp*ag|9Tg`LdU9`XTQSR^Jx$iI5
zzuGBwI`&rfxvdh;r>>V)T)Y&Wx_i#Ti!NuF7XSTn=9iSyV~+{nd?JDiXUpAtwSB?q
zcduGoD}Far@&x^QduVO+=Jt$m%T?v4<F2SY6=Z*$b$^18`dh9&PVMjNcS%gsUn00r
z=-y;yui6h{Y##!{XYP_0V-kE(?^gY1V?$&5+0)S_E;IBGG=w=j9*|Pl73?MaiD%)J
z^;-}9u6w5vR55M2%PJGw(~&REugb8yZLP6>Ei1<+J{9fz+Dl|Lj(n_}lq$Q4TjKVd
z>7ibhKb$XI{LW>0eW!c=d%>j|9J2Z?uH`eBS1i#wBDi&5^^Qvi&L~JNc$l;P#mgD8
zv({?~z0S1}el2~CJzMSClUI+NtCrnbUUTZ>xdl^pKdPJI_v%5_{nCGOHoteT{&&5!
zYOCU|uM;_gk{uq0mvgaIUYz(`qI611NY)*%3mf+?J|#52>%oLL=kM7iHx68ulD#Ir
zxs?Bvy;|3nk3qF+W(#HBC~dks>var&e3a5Ow}wPF9V3m6EHd#Yw(8BEl&+YwaBtl6
zT{VUZUvI{o`yg_Ea-PYet_u=}3aj|<c|YICJ3rM!F>6D~m&M|$JaaB4zD{}Z*H(Jj
zhNq3qTpBa39Z^@lcHAY_<iLkd+0zp;H2t5tMd)d-n6Tk)^TnY3Tb|x9>)3S2!7^~~
zEzVEx!nsuURp?6Hd%U?cCa8ILt^2FYz1vt~`YweoUD~@TF4M0gwj_AlOi%S!VXqE0
z|M<S~+=BmM=eGWR^{Rej_ucr{N!mv)<roS*U-;tf714>k)5Bh?R@q<ty7-O!(`R9>
zd+IOTjaoXn>;2-1)gdJ=adS4#fBE#}BB@BJ><#m6i_$Lcp8N3ViBIg|6^}HRKmJ(!
z?r7xaRCD%EXYQWSc%=6*bKay~%;BQjca$<o7MHK|2#ARaj^*lL-Ltjqy`SHg>$B}H
z_8<Aq{{NMm*@r*;_fu{hvz=1#kGsYu%f{fG>{bi+NVyB0cXKb>MrZwH{`u&^53}TZ
zR}S|&o27gTGb?PF?Z=ZK%YHiSv*8DoWn3S!zQ^$j#q#ujpK;-3=+7>uh7+1EeG{(y
zW_xmU!r@nkb{|{qUbdD)?B=}d>tC>KTdURceCB)~wb_aLY=m@mCuHkp>t54YYB1-A
z)b6$6A^RTnb#nhc(%_yq&0_bupWlvLZ8JIXJMu~{gXxQC=3Hx=OAHBRYnFIdsf%o#
zV%J^4-N_KRe%Za9UGgo@pHB43*<06oa^>~)zaAUtzy9^~fC`^}|BL14o*uou?w{G}
z?VhiS_twbY@-q0<dQ-t<#<_0e11voI*bWGP*9h3Qt|oZiE)SdPqOJd*Uwv#J`D#O5
z{I*~9;Sc|3fB8OjvAxef8_i$0_a$$g`}An)izmq&Z*erW@P60nD7s#MpTjS><x-2s
zUygMX{(Xp-zEnH4W1Z=<o4@S?yqQ@<7#J8h7?Rd)kMjKO`SQOR14D`&BLmKrJ}Ids
zsmUdvdGy-c^4r@cefa)|E9SRldyta0->tOW`;Om!e9H6H-m*u+)|tE4g)j9yk>)co
zYSN~)vtR%JcZMg9W5NQLn?;kpg*{i9=8?d_^NhFoV8UEk*?0doZIoxVIr;Ng+=<Cb
zQm!_)ldOg9cRY|j|9f`-wVMia&un_}XHmj=^ZB;-EB5{TV`;tb!JCHXnTMR}jy^6i
zYCE;&!M`6D7Y9!3yIEi{OYCwFf4h#9|D`nvb(5B~#=B%rI&Jj#pM>L)i!-$@R~~ub
z+z@|{rKV|V^_$cp(bUW)UkQKy1>J#%*u^z@796)*7HITk^XEP821W1E4<7x{m2Nq;
z@6*H5DJ?Hc?<KdtY*9aaN51g$Zv(&c=PPd{Z@N=3Y3a+18NJp0yH@SD*~xV&MP%-3
zzW)-cb!OJz&L^!qwIV#ZVL7{$`$^Rj*S*&BKh3c+5z(*u<SBIbgnGZ+$wfcE@K^~Q
zi2j-)^!upB*<-KDkCoo+&J;ZQD*WK_$$=uTx36pqIHML=bned_S!ZkIvOD(wzJ7RG
z@Zs|5gZAI<?YXDK(>0I%Wd)PLsdfBMm^b&-J+HEy`Qmzedmod*6s6C?p)aQXc&RbN
z_p{T~D)#%bt|IeR|FCm9#QjZmU3q$^eVF~(TYFSYLN71a>)ziWS@!e9{9~-zA0MeJ
zPCk3^_uI<(?)^@Iw)dIlymxafoFsl>;p2aGQ!anM9K7wU-Q6VbA011T%{;kNeC+jZ
zzj?f5s>t1!U6Rr1)t(2F%@)}4&a=5_y1<~jX$Ir|e`|I;$l+?{VbYRjo!s!z;`w!P
zo5!`BZ#ybF4zdJ3HRii-!Tm_?^kS6<o3?J{mh*SJY%y=G;esoxHJ&txa4L2D{?oSk
z(IIy$*2W1>-Wcxx*sL_~VDP!3`kwWTGV<L)?12-OR$6K8xzi@NOs2|ruWVp_g3sih
z=M6Fm`5Nc`RLo&I$23p0Zi)l*b%p?@nM;Gq-m14s%%0UItp7pavAP_?m#Q<9|Fi%2
zzw?Lik-DOF`*S*kglj6b66KXIZLmIQa(aRFg`!DD8cfCwCoXIFZw&sy(kjl&no&>{
z{Q7drqc>M4t6$Om*j|-fbF^<IpJLK^52KBOd%b^{c5Ib+F0hPo#r*a)9!I^!R6`im
z&7aG-N(yh<eM$G^idES^CjVMI?{N9uS^pF#q>5PnKmR_(-uuMMo9?FkemT=mY<rzy
zvvY!CVCY)$C#(GYE?XaC@1O9ERhY3*lkv7Zx9H`U-yVONl|EN*gZbwlpS}I3lun-H
zYP-?XW%;_OrwVI+_P)(53thW#?aBaN|3wLwFT|KH3Nvd36f^wky)u9H(zf(75)2~o
z9my;kI$5j=ol6CMJXPLuEIo4gdE$(tHIrf_U3HdSJR{bdH*1E6uvw5vl7)NCl=sd*
zt@xUsyCf`}5%*DDrakOs|G%mF+7H5|LkxJYde5-=Et{43lW+em{m-v6mfX8k{`>1x
zdF>rPwqAO%W`~EU(NlgIwc6io^VV<PzBo{1!LlQq%8fqyt?O<-O&6RYnPs+^Nj>D+
zyV<oW(T=kcH(A;%ha8m8HgOfxJT&S4*@I7<#WgmRy-j@hhQIknti?X5{3}@u-{vlz
zto<i*D(kWWvDW9(Q!jS(nS5ImWcBg$#w@Y@OjT)LUI<EB-ufi5DAUyCLh%1N<p&Pk
zN}87#;^<nl^XLfyCL?*Tg}YOwf5dM47@wfNSM~Aze*Y;S%e7b}zSh3+UsZPXK!0+|
zg~^k>7K?qjJkKn<m2ufojuVG;A8c%5KWZSc%JFN@cZH}^LX$gJ^LT2<a@1QYDh5wo
zP%ue4VWw}_{dJR$9NZ=IuV~vW>D*`QgpN$v#q+OdD%WYHg|BTpSz}r1cY0|~T+V%p
zecdLfX)h*yxoqjAsC6pvQhvCnQc5ge{Z6mmwLy>Df(|$&*hag4UF`KU`d56!@mUl6
zKb+S5)O}Pmc8mWMp`cXHiJQ$c53#;q*_b8fvw63%oW$?x7g@qic!r#5JIKnfxBW)s
ztVdc6)0W9E)NR_-;JVTJK=j!r$C49r>x@pWFybhYNy*&gG3TLo)wAc8H~xLuo$uhd
z`s@$QocT|<u5FX#|9j~DY1XpNjZ=<ID0gZ9P}m>He_HYNI@QdF4in!gmmaHWb$&a)
zc)<;Y&)pA_B-|1rh5qF2&8|9I9wd8prGjARCHK&p2ST6JBW6aP4sw)t&WUB-$DaAZ
zQA%E5$IGuDa-@zXM)JO7wfc36-Dzq{k<HwOh-upK#f&-n?W{_+=NIpPQP%Zz*NqQ8
zPbNJHT+4mCXWERU!pgUoXLY~guiByWZsYcJdG<&3e^g`nKD_IAnjn1O%<@8(7tb?P
zr)Vc#<(|+Ote`b(g@v#F^2rMg<k}nd<Xkf}P%~JW>3XH*pVGw}TXZ^fI4*o-+rWD~
zsQyv9<@61lPT|+1(%&DM!+k=$t}l#NVr?C-zXE6GwW9M`!3zYwSo|wk%dOJ+IN|An
zq905xr;Dp+oh>Ziu5*h)LT}fKi~TAOtQxg$CR~jFfBbv(@7=N7UeDYWxMSrGpF8op
z#o^zyyVEQty4mvySTHLHvo2&;N`GOUtRABD=%?oC#zPE!*GnJ2fAVa~wQuGej?!L7
z7C+r|#BzUVrEjX$UH8y=%a)1sdW7x!Fxi0ZQNZFe*1Ohzl8ka?|Hm@7?vz2*`~%&>
zhv#Zl_=krbzL%sYX4);fnNvNGaq*`RbK8?o^Mf4cC#|ZS*890w!~D}d_355fb2s=4
z9m-XIpLbC|>)W+po#dWHGBX=Kvq=5XwOqDTB1rs~Noirj@pTvV4^LK@tHxTxyWQ*3
z@tIr>FCL{#_5HHAseh~e+Ix36ZdIH63gx`~?tk#@`!{#?KgxM4ygycW!}AOC87|kV
z%&E?Z-&}L3nd6#H>G6e2PwFndqq$!6-u5ku-ogpLY<<_S`;^zlcYkHo@|sx@PBrtD
zKZX3R_5Sv7m*;6a&cm925<ar5V%+I5W!B^Q607o*P9JT0n$-PtmG+L{;3+Trv`#n2
zSRMMdO>OU+OMj+b*Q^eD8|Art<4q+lQ+w<AkEZZ`jtu%?erd7Ex%EwAXRn7(vE5do
zSb6KhT#Y5$F6Jhg?>%>qnX_9|$@87I{UX;Z_ahHgawrKE?yLV(me?-4`uw*Sll}_-
zlMUy8x@k+T_(rBP3||TluG)U-#%XB-{sVIy4m;&(Y~1)?FpA-87yni(#=F+7^BTpz
z9So7_T_nvtr6NV*U@hmm`Tmbqyr`&MU%e?Z_n*OI<td^el5NY5*>-K(^CFR5$jtXk
z_OIT(LCrZcmI+^JXHvfK?Cmji#)o1nz3lSsBgM>Hx4sN=Rxr^%c_>I???1*0?wdDz
z-cDP!F3agkxs90MgS!^X(m$`M;L)14*z@YkTc4A;S4O2zTlAH~Jmf;TZ#6UTA}+Bh
zuiyM~lF;4o?SJFjr#qUPOv=q{|1WH++UVKbmKeft%JHd}qt9+#hijHLJDxn-$8BSg
ztt9ncO{qS_b=8dE<nlPa+#<Qa<0}^*$~d|4`x{MWS1~uc-!BDxiY7d+lW<$1KXInr
zqiOLULaG?0em|L<!1yBJ<mSWItFPHzpEZB&!fT2VcDv6V5NLYHo-kpNlzWa%tK!$`
zG7}2KLMGJqES5gp^mrEc{g40d&946v|L@bJ6XJo^zD^l;(%IeR+0NX^uhDpDKfQVN
z6zl0(>RW>2Zh0jw7P>!yYuYW_i4I-|Ce@x$-F^0w%rxVpuK&-RKPh-yaJ?gwXSKM!
z#>L5z%fr4c>*lRdlGm!*ka(>@`{nAQDN^^ZT03rh#cjJ+SGV+Ho$I`YS#H_iUh>cL
z6@3=5LcQ)=O>yyM<zV*xE6x7Cxt(wJb^5255fzhOdjI@#wD*^G)$=z!SEs)^bJ9p!
zI%wgP)Pq)=yANp@&uzNLP%N_Q$|LzFEev<(Fa#(VZHU~yH`d5SGed#-F(2#q&?nN~
zijLxM-d;Sd!+fP_$I34oyzJDi5*A-d5|5R-vx-~0D5Lt6FH_{=n|GSpDh-y-6O3Fl
z(Q$ri+2d0?)fO{*sMU3RS}89tdfC9Mwe`-$gAy`3R-D)p+I_p_(6ZJ_r_)<+o9=#O
zTl@Q8#p%P-7&rgbJS9Fss)6k>?-$R#GjDGfEjxYQEW^y~N|N^ezJ$B`j(QnoHtPzk
zcxL5Pc04QVl6Yy8iHh!4Po>~X)hAPrSQOvBbx`W;+lt-nyYJhuOFOPD61l{A^TVg3
z+xw=Ah6(x|(&!fwnC5wax2ElH?B2Rr*U#QPbtdC!!=1$M74_u@%udMNzW=`<VTO79
zigMd&Plb2>xp6K3gXAykFT0M&9eI7X@tDb39p{-ci{{-;jc1-Uarc6mYaE33zo>X$
zaj4k-d&|3TMz<uQ+XUDh%P#x0pLmv5y#D^4^c~kk*WP70AD5%!`D4GsT+5RBGx-in
z-Z5$!N7+C6u5dPC;X84glJgA$j7#P}`*y^%YR%OPvVSHRxwMw5KhPIrERVb*s&Kse
zZ92QHi$^}Qf=B+oFQG@p7|$>AT%K)ObfBB3*+p;Si-OD>0q;VORq`EEU;mB8aM$N|
z2W+SJt((R>>yo6x9odz66ZDU#+q9T|RorJKv*Ts)a}H(po9*#tT_&yDy24gHy>VXO
zu~dI;oY)Hi&XaGaWHJ7i{8$*e%%?b_`QVzw1qUzc7grn1Jo0DZu8;fP96NXKPu`oq
zn~dFOZp%J*ew)LM<`wFjd2`t>ehZZP9XVxvhLTL(n^gyIOxET$`jc6DIrd56*L&)c
z?awq^+S_hk{7_J7`7QCG^*rCS4N7x;(qjEB(%Ek@Chka0jX4~^&U_%?%-rw4-)yjZ
zH&I`u+iBgy+?mlUr!oX?`g&pi>ME@tiMhFNUmQALz@N;+(owshB0K6$Pl9Q8m{F7x
zvq(T#&5DAUuSbP=y083F=5%n04Vt3v>T+>g-$ucrT0vHE4sYj63|8ye7bV`>KX1`Y
z>GQjGgft`t9xJ+7zVwaZ9j;$%9%gK3oj-B%`t`@&e8^_E{i3_2BrlwEt(5blds>>)
z_itS*S#fnw^V3^**D3EV><-8`zxs-!-)9Q{(RWinTwOgs>G9g&d>hH7n^xSqV{Q0-
z#!-gkL!Ac>7yhp>d#G-8W%jr1ql=C9MDJ>U^kh@m#VKD?W3^SJv$FR)bqXf)pSd-s
zBx;64UxGF#uSZ_#G!5hXX1g>)8lTFDYSo16em(mj<m=v769RNgSD#xt|1Z-$#?P-b
zvY%d@EO^P0=ZVsvs>d7~Iyb)5>2;QT66X};_ogIe=ie<e(%ePv>q;FFXR33(wLUy1
z%eL&SrVvwww5o52LfyKZcaAQ)*VXX0A)Mi<W*6g<A5GuxyT5Q1f9}2R;#^(6SRZ4S
z?hdE-k@wpI8+R!0?a)Z}s7aV&rTv5VZRd6OV`_G?|2`}|qNymkaiNHy*X)Pp1{PQP
zcPQ+d(f9EOQ=Va5;*z>qUk+NWcbNHrkBPI|Qin^g_ws{DvA+WsvW2~km>BjT;k2!0
zs`0=2%Nzn-kHjQXl)}@G9yOU>`}D=igH~qSE~Nafd|vS(Y}V|ZR=)zw1p{9O{_y(Z
ze{W_)6z9_f(--XXuQon#mtyY<pJXD<en5X#<)6(m|I5^3xr#O|nzd@fI!@oi4i=uJ
z-$gV^bW2Y;&RwywY0t;HJJp|`MX+5h-+fL%>~V4Ug(Fw^8UG#K&VQqvHRjvDE!Pfc
z%vDodAiH7R!ft2xTBVbHFCy2<omsw)>r0s5{MjKNUWC{`Nx%HLubhRc)ld7O*mahv
z<~KN|9r)a>yMFn@>(a;l&o+0=SJT)3wYKSiaqGt9)aYF?pO<hcaBP~r?d$qgQ!mzD
z*!OYO{_s+USKHn-3b(BlT51)1FYn{pknBshedBrZw_hmvvQ$TV&)px_pT3PtKVH4-
z?eEg?dGk7_^sO~x+4>>k!jbcV!RKCx2x%$U#I)!iXk&Ix;!={@zSP6nqI%1m<b7K#
zk1gCNy5`RP^71>(duDBqbB>?8U2fLQ=Zm)AVaol%5c<N5Z`GQv<tMLP^fftlVXBhZ
ziTcAc{-<A4tBgEn_xWaHR@+K7zKA3jrWxA{1+JLPj0unY>z>ZLro{cIsgCarZ4tvQ
zi;V7`3(ddmyD_lzZOH93qj!h0xcfyT?XE?fS}@D_1gqY<CgsC?JwG_DpB;3a#5D2D
zod-{r>Dah4GnIE;pLNW4w|2&HPZ|AJ)7I`?7`-)egF=VEo|v`s&rQyh6j8q~X;vp0
znQ0Q>_Q|s3w9TrpF!M`|?Z>|x?NfZ*lsHM%V?Em@zwf-tOMM^j5X)(vKdCA6Mu5k~
z4IGogoTt~nmh!vd==eXiW}0vDUX#lkA1UQINQ7+A3wx?{yzuJrw_0mTgq}akn_Dy2
zNBp}0x8&W;4KEY6yqcN0@r)j)ibMKDJI1`VwXu2H8uwOypB45+Ekyjlytwk~y+$!f
z-$fX6Pw%(&K9)P%{*}Oy7u%-pKa=!%`eU0Di#!hsn-^zay6`k=f_vn)PM0$RrS?3U
zeep&?b6z)yTC$2Q(m1ns*9yks)iGy(D18cBlV0ExsbLf16nL7$imRk;Yb5Iw2O*sU
zT>RJUtLC<8C;IK;yW8-{AtLU9P$pCNsYQYlX607@bP>4v@z+0T8~?I17dNtW9|`}k
zLfL8Mw!L)^CN^h>JYT-+oBNr>Jtt0=A3j{JAOH3*6aV!s4>zz?yjlEhP4rV|1D>j!
z3`y1{%cOs}{Y<aFXKA%TMxXD~^^|<yq_wL{7ui}~U9%}R^i1sYb@#J=_<y)vBRA`C
zt?0K~Cy(WPDEaW@WN@WN!o_DrW^NwNToc$s()Z}I-9Krg>S(>c)qmIiuTSU8zj)98
zW;@@`7ZFCX^A~QOa<9yG)6blelXF9NYaUL#vA8(o$@Om&CY`T%u-Lv;=5GJz?h>i?
zenSh+LaE<@N_P&`DZXi7xc@l&wA3O0l}vl~sfSHgH(&br)T@C1Hr~sHdFC;h+?#RN
zdhN>`XAa9BE?fpPI{zxE-2b@1F*kC-hY2yl1``U^cCaaK=dw*c^!rUpTrZnscf>6=
z<qtQ$TwT3#+Gn-TIxi-lm#FN@Ei75ad3a+uW4mAEyUUihjRKjOPFUXXdGhS|=G0pS
zX>xu{7u=an|Ln@=_qjN4%e$$Id3Fb0)8KtBQCsv}{6*Q38R8df&Wb;O$HS4eqD@SH
z?#o$+#Q*awytcL3WSXIOgMY&j#)8)EdzJ=#_|^Ya;#Ys{nLfE^T8nS*W_oq`){fBP
z?%kIgd}XvP{hvu}Uw5%XSe|d$`<ycE8&%rhwFEwg2U?vyTDWwN<F1e^trr*Y?%3pG
za>~+of$T|!ZeE4hqKPR6ho*T<xpC{tqnM>RTjm)u-n%}}D6y8$@N&+cbCVsKYq?rw
z_t;w8vAp-YFu(r&kLzlgBE2nUPOU2DUN>%>|DS)#*nY~%ZUf=od(i>>4Rf>?tf=#T
zFIkt>C;rF8GTtimzi(=ixMdW_x1@7(g=H-7|4*D&a$^2}TecN@ZY0h9_gH?H^gJ2W
zDHav`>v@d7JWKVJ6O?d2VeQEDVVOq7H8n2R>tB``1q9lBoRgzdQnqJCcj&>gS9^Vq
zsa~;OX3Jr&k@u#=RIAQ%-eil6{ZcXM$#?p!A3sfuIOV<MvYBGv6y1y;5ye8E6WCU5
zHVZoKKJ!x1i{4YgsY;(DxexG}-Dcc0t<?K{YDivvw4~^R$FlM=wV!JyH=SuIeapzm
zru53^e73)jlCAdg4dHEB52d{y+_F|$HC5a^Oj=(icTYyn<D-krzTG&toB5){PLl=G
z`o3$OJ-{3;eZ2a!l!b-WpKsFK-sP>U58j(r7k1{&(#!v*W+ie==Irj7qj7MC$M=sO
zcbcy|NG-mu@;fZb;-*dM=lrdAHvigW?xz<kF#o#ux}d$&bUJ?7?=+E_^!BT5-LsQi
zPB*$rOnpnTYjbzMKl_!bHG+RuxPX-ASKZrP@!@h|kxy=}UGZ^xxQ$>Mqq(5N^8bH%
zj+h^ne{pqnhvSY<lQsHkr@IE+7hJw!@3SA?x$a3D9lgCb>Fl1e{c2d5ZfNY}!y?Dk
z_>E^yzA5qL^8ES>d2`<;Mzl{a+^Ao+;rp|%=a;w`>~fmp!p+t7PAHJ0L}k)k^<efD
zduAM+b97<B$-pE0y#hS5w)Xt~ILqsJr!H3npN5Rsgikt(xjc^>RaWl(Sbq0W!OV&u
zkqIJOB0eii$1R<1b7YU4%x9Ur?k(b_D^+rwt#7Z~9sT0xno8d%ovW99eQ^D)TE0M-
z_l}d#z4WXeUaq{pRKxx2VcAJ{GVGl_t1o$3e|=VcXW{X(GP8Y^>mG2`9hrVu{Qj=q
z@K;{ak3&Uk6xjDn4)_w;!m<Bs<mp-aVwczbW-8lI{H@WjjPLu6cZyX7zQVmKz5ItP
zxm>&+t#38^Fd-oO*M!#pizZrM@R0nGam)PMWhvV=n``$!*l;SS&hATnmvFU@%+1Na
zJ=gvHSo-v~eo#QQq7dsV8-+Czyw62+msD;&nJS*NgE84Y{!CrM?@Y0-Ih%H5om=g9
znK5m4QhH{gqIl8Hj+J)q?y7t@c5ZiVue|&vXoso)g6U6$3s}CI8nv%@*TWQC`Y%oA
z+f?CWYk!?Pz_lYM(eSMApU<b*vldm9zSLjz_<Csm_i3}HW!wMP{mF9w-?Y0`ceyt6
zeSTr{@#O8@x`wH)%X|Jx|JwO?&9u`8w`yOhzr(oj!}{6c_y2K+P5SZv==QtkPX6aB
zH~V+|{*UL+j@8fm_xk@sy9qZx9sZqiY|7Gf#(OFipH4r{esNRmH}5pwH!u13SDvaB
zP&7Jw@BTI0v&CuoF>@Idb<Y-W>OQ(O^w&AQg-_==zRpn>mvlPdw)>pMiS5VPn5~o=
zZmxN1#>{HUb>`BxEjBI<s;{y|eqLL=OCrM6UY47qROsQ8Eqkx*oh^7>qgMC!S(S#J
zaY<+HFYteGhCi!eQTK8=?pjV>&bPN-ZTuSd%eM4+mr~d>pNq5kt9MshKh>Go{z2mW
z-?Q`An@@T9c=_Rj1s}IartUxTX6o7hk?I?n_gtQ9AD<+6sc7vbmC*kY(l2zc%`Uz!
zr7PeS_FIVU-+s-c-pv<O;sYK=9$(|Td#_EX?))(S`l;0i)^4lc-*Kj~?ES9BKb9#c
z@0!)#|9dFz;DkqQ50c-$;Mp`=tj<s8tLic~>3>?!p52rF^wqUswL+n(|BU5}6#u<)
zyvuvx&3u9X9UiB=4CkAttkiEPzxrjq!1twU6L+unt4-P;ZIs+T>%b;W+twY~cT}GC
zJX*S@nXB}>*xQC{o6BE>D0sgyvHTU``DbHHz4p}UZ>qO$d+WASOkHJ8;5PYZZa2Fm
zqJJ5xZ`pR~!1Io^S9dS$Q;1eRcI{nc@r2ye*J(?Qlu~qq=g(enQ}`M0;|s5^ZBt{M
zXMDTyS3=2e0do#*#&-elIjs$wcKGf7+I;BoYl|4(l@8*s<a~Yg!?fo&$7QH>go*|A
z+}wUmB>2$uL_P~<zn%Ht7lmG1xHM+#CUJ`e{vLsW8EFOYHy@tyn<39?VawmmC9@=d
z-nOpX9=~+w(~_X6hW6e|Qf`-cc~zXY@ycU9IBm<O6#|>hlDIyu`pMw@oaOGtBif&$
zm+jji&$|1>d^uMytJdtjQ`zb=U)`2TT7U4LvzLePG_eVJ4>clA@+ltZ=JPqQok4WF
zNs5ZS#|52vGq1~rR4hBC|MrMOYSX)9wlD|VHI_HDK2Pauh@MfjYR^rF_mgTaZ7noD
zxocs1-M1C2+Y>d@#6uRYJ2zwce6Iex)uQ$juFiM;xkhe@`{a{%>}HB5-rXPkDJY6z
zRsPb}_o-i=JZ#lh?n!y1Q7Jk>OSiA*fAje>Mqb;(Ciy6)Xr^y0C}w)9I@v6<Dr!Q3
zS4{Q;FUzZHuY<eacx#`ris3E!uQQWJjQ#p`zXK0)8SK)+lPf+iys>`!wYt}CfqxP<
z>Z+CdXee=J`kTw9&G6Y7w0uwDZsC%fpU<9sZ#FOA?)SWxwc-<hT;>rJ5DnxMm(VD9
zB7S)8%by>9mLGn8ew*3;`?qS$WZuZ}3;Jx`xXFH>PtWv4eW!OAteKbl&Aj>z^S_t&
zztb*TUhraY2%jf#_)qSXyS-}@znVVl=aTq5i)HUMV}}D3dM;sAg~xJw9A8iFVb{pI
z9`ai1Nc+}(fs*If`JR{-@U4+&>w!IN2b6zwJQ8G0|K<6y{ETS6LxAOx50l~wwe!y(
zyUZrN=l<P=vFlE+NVxA@zwhrhn=Lxa)21(*T>JTv{jd9V`vnekr}r}ad%XMKXK}WM
zznKM+M>o$q@QnR{^PFy$wi#?Z?Y7C5OaD4wp4ly}-SbPtl>1b`ajO^QOI=f!>6}gR
zINa{#a=1;fBbTdq+ubEDQr~1-US@IKpR_zYr91YMq{%|nGWR?8o1A7fTs*Pj-nPx{
z2~~<LTXrvW&ipE*<XI^ZSbX?fdHmb=d+eC1PHP{3y6#UzR}|+%mWEr^pT35i3|Q$d
zUUAk^jjfxh*8i@0!%o+0DHHkhFYS@&OZqP(!l8CUDPhU=Ct|7Jx3R45-5nHZ`nGUZ
zv1$J1%`GbVdY6+H=3F!2m|o6&i6Qi3?(1LPLAkektLGQ<ZfDfp_R=DyMLlj=pkt?V
zXKpBWbk5t$x9;DZW%F;(vVDzn)LJt$PhEcZHtOh;)o~d+wYuGI$~+5|jQ4-#UAuAl
zX^F}mJyWMd1<BnB_sGt@vu5*w`2jP+XIcrY_FYgcc=sod)YCKkrygvXb<y}u;9bQ?
zyTh$z{1QPCcYeP))}MDHk#QwshfDY`(WB?nN_bbkY;In8@5h7CCf4az0hRI18${!#
z9q?^V)L3zU>hI-$E6;>wu3IDJt-kRPzv_qj&vCKEH}}MDH1M6;bj>a_R5-#bJhau?
z-cqD)nzz8xrG3UCrFqLV{@6Hd)A(b-f7Lu8!S9mBpDA04j~@xVB5!m=WmQVnimo#y
z*P=_Sc)muK==nYP@Gt$*hvN2RwNQaPaq~K@&6{hE=}4_KwO&8@Wqk1FifVED@{{+1
z-FJ8hf99Gl(=G7dGU$JRb-dPJ{yLd=-+wP>ICS25!ka_F+q4y~T3%}W@~*z_`m`$x
zUMLCuUaa&|PN&AiSLg83ZLDqcza8K5Dx;n4pHnsOTdP%DwJf6L=0w+py(?^3XSed$
z%N?$he;4dz3@Z!bv!CA__r$XA+Yv?oeW5=lGp$&~^5yHKlkqB_7*vE5yCT!yU%g#^
zoVT4vYT0A`#5WGld_|`oN&fUx|FojS(MRzf>lA-p(AVqJc=Y+H{k=#1eujA`Bocbu
z62q>qOZdjkbJcX)QTJCXqQy2kEY;VOh@Q7FJI2MV{#{W5w|%^&sD8DP|Dr=PzI}Rd
zJAU(j_gS^O=A7HHZr_PCtIqzNvX3&wJ>I^PJAbI`YInZx#LJc&9@#kmh)i6k$hdA^
ze#VxPeTs~kH|IG2$UI}6qPV^6UyWYt`O7DYwQo&%=@WG&;{IFt7^TI6by<<UA1*6x
z7Ob1LDPY<Z0q>i}8<i)BNj9FyQhs=S+DWyJ-n^!;*d^byrsqy9x!1q`*xEf4rR<AS
z4#|7%%bXMSW6tD@yZZJprg8K%)yMzYJNLtrquZD2KhKa7-E;HU){W{~_w%1_U{U@j
zd0isEEKdJhdq`R9OS^l=PWN9~u9F`&UG(h=-Cpk7Z*EuqJ^I%6#o?yc8gDGuv|hUI
zyQ@;VxL(6J|7hZ?@|}`5JCeN4+uhSI+q=bS?#4$f@(K^`R~@min=5YgZpGJ|zpo2i
zxyN+iuHMA5Z@2h(4{xjT+2XN&|Cgi3`2~Nl>Rw+bb4>C3{du(|cOrE*IO?yx-Oc*z
zmfL~o<pN)K|2}en`ObM67PkGjkL=&xotITyesBKsSLUA|?rpN$pf17D_T`t=%vmbg
zvisB+HOj117*AjNzV9U4zO5U#8nkhrwyRLOvGbvM(YfY*IXdqvX4n?Karb<#)q6<q
z_Y#)x&+gw`tNup7VE#KlIc0wRjp6Mt&%M~edN*$Ir5zUyubR#fO}VALPjJml<97WA
zoM-1mzBoDA)IG>Xy;1Y_kw;rCPcKNDe)jIBB5Sn=-Nv!ApWJ23p6a=C`U8XAmx@mA
z>D@Lxw=A$b-ZwA*ZRF~MF^-$wPD|=smT+>-ExjhOy*vE9-cFMZJ5wVc81;QY=q2MQ
zp)F;?so%9@;%dIE537GB+^7}&WB<e5NB#b^JuaNR?fEuamS?(&)0q-is%7P!EiL;~
z_C0r{<ErCar}oWd==+ly^F)0S^YR6!m#ob)ys6|I?6~AYeeRBJh8DTWn{x`~bf-Me
zT5vZZs=#S~;i6}k*It*u=$kb+$nk_-+0%uJQ;IE~9Vq%g)n6z4)Sd~GxKw0~g0{wQ
z+|T6~71yzSuR-BQmi#Tv%fwBW%`pyT6#2Zw*<jb3{WmsOel!X>wMUXQQ0tvz<91W2
z<v(XXK74ViZ+Ksw#reg_9fpAsXX8GLaxUJ|E3nc3QnLudq|yl;wFx%$8xDs$?z^(<
zI(O0a#^sjJ4@|e5es_b?-pi{t&+>d;yw)~bvgTHd&iy>jtap`cmGu)|U)`H(DZj+i
z%KUfKz2i!yZijBWT~A@SlTe#$$D#eV<Q+qpsdRSQyH#`6KRbBZP1)7(MR<l3%jQQ)
zu}?pq+`4tEvXZjk%~LMSsdb7K`5sI^!&EC4#9u3s+LU-hLu`dq$(2{pkV#Sg$5Po3
z-(5CNvG_4f)b#MRMb8dDpJpgOO<0ec|JvHk`M+jQQxQD!V4CV%muptuk2h!~`|K#+
zGylkr@`Z+%XQf(Myomb#(vgSb&y`*do|BO(OT7FqZTt1fbX~@}KNVlKrC3(ETx9>T
z?@8A&#aago#enyTOC~HidR4Dw#s1IYPTkiX*6Plmd{(z||AVYBCyQL~buD72g{DYx
z?9l7h(OW<9%;AsUKXJ31ZvPnI-I|l7GHC~Q_&#Qa&tg0`8b1Dbw^AbJ*3RCQjj}&v
zJjGqwnUuNDERr#}ppu$&@WReq<L{mVU#711Vr850>~meoN!N-4jwQk;&;I`66=!ho
zTD`Mz{4(X(uYU29FGOawpO3j&KhM|BS!lme5vyUP;|8CnTP7xCt*Y48RyT2LuW{Uu
zY=tfEi(jyr=bT&im3z&#nHJ@z>`rNS)xZ3I>%aWpT|%FX&b!T$e(@;x%4M|~uN@}G
z3i5ie)_z{t+2|<KsN}Bubn|PTDOSgO#CP<1eq}Pev|>SbmC$;IqxDCRYO5?<ae_DD
zk=7Es-!m^iJ*nB&7q{3#`@pJz>(hhp8m*mr<HkWhlh{dm_q<+qRW2w>`?2)PT271X
zMe(oB-dw}v`6_tVGfQV_HD>3KJMz58c<1eKQdl5iV0ERo@P^gxgHu8z=O3v%u=3AW
zSE=GsUXk3%Q)2_CJBQ|5avMCKvFn%ZH^ZCPO`a=m)L7W-yX>aQ+11mPr~dK$pefwh
z9QyI`oe3*8<xI_8WiGJZ;CRPu?T?S|yp3v#{;=8Pc);N&I~D#3)Fc#kMi%ibS}R|4
z=8D_x-(PEaJda2#U7Z`%<l=d7azKpSJLXnZo6pIn+uf?}{}Nm9J=;oE@6g`mTUEU5
zeoYc?5pVMlUtu;|t;>0WWXyzPJG@&g0}Iu!d5QF#QRi6M`2F4~lfomZ3nEk^FE5+H
zu`KQR0s-qsR?$`y-?NKKG;FD{YEwPB#yi1*=fRFcA@?NJzP<FQ+!Ww)Y@%P!s_o+I
zySb9zc`Kg%YjdcYYyDrzMTd55UdyWUxa&an8E%E`dl~qWY!+p+cuvsX$zb+lO84q>
z6|B=P8ub-;oq0QX$KhG&7yK(dX9@6Z+L$%H&TIWo(Wh;yGg|~zkD4yjv^*YAJFQ@%
ziBwny=dGm%_05e-wo0wqF|B-+y=~!1TlO~QE*@vCDFt_W*@T%aOS;4o<5;J5`FUT-
z>3Q(K*J4es)~}Om9)CZ0;AEG~(}d%bXBWkV@0!cA`0z$uZ=bTa=`&Uzl%4eAq{$5j
z>nYE~pXDVl*!J&~%Kj|9J1aA7D(u-@zAy+Ms$iAQjJ7LD;mTv0oF=q!&fe<!5*vwk
z?-#``dy}<by3V22lJfyAO`_5aLgAUp{Z$h`ORQC!kaD%=Xw`(LPd{u}GV_d8>>ML`
zW#=0eQ9oKeY8ute7Zn?bCZF07KHK_k&f`j!Q`<a(?#ep4+n>8+V%GfpOuszy{AW^!
z>`I(1=lZ>B+<ig)a79^u?(0V9`wnL&^-C;sVco>dyM*Vh-8vbDkmcN7mtU976*%oU
zuj0{!j`qLS=VWH~ta`fiuCM5+u&0-;tfY-!P2p=0^4i(A{dn?&Esx~{&*k2m|Kq5u
z{AZOWk0)7kIeu;E{_^kS<m<ZMPR$n2pUuCe#U@Ra<@=EZ^Tb_$CCHYTNniT6Wv0Dl
zv>(GIsmGpui{`kzGhN=nF5;F{=C!eniN{h=Z?kB)y~eVnBB!o<=E)0hm2Wu7wu4P|
z=61&1y!x*Ex!X+>l)^*wBSm78oPraLnx68l;Vz!l93ohzQE9N`TE>gdR<|}?KXj*W
z(u$5h7QfVwty1|jYoWyg!HFGCobR^erp&*fIkj-l!O7Z3V`3JR9a)#V@r8}&W-H0l
zHny|0qL=PG?l1lC+C+^O*}HDn<DN;`TnPTWEjD?sTyN34h-Y;n0@a)mzf0uo^^Q7h
zZ@aP6*UY=|*v9FNM&C|0EGRNa*!fV><IXmLS?51B_4g)rvwJt?ciUEfbhKuUh?}uI
z$kozW`nh|g?#0Nfr{)M-+NN=6Zpd@L*lXbtF}>*Zr35{V){SpcG$)93|MY24WIoHN
z;x*xPQFf(P)`OxM#~0TLCrjxqU;5X#^v}0eznn`Qxlby&Q{SX<MfDtcmZTzjjwRdF
zNn+DAMm~okSBJ<AR~>Jx&~W~Hg)`jht(O0;YleIJnx?-B@XFdS|FgGl-r3)a19dO1
zc{+JYQ0ww_n$xcB+;sKz+lh}0PtNAAnl<lq$e~v!=WO<x<r{nJ^;?e1%Tp~G#0{rt
zygwhj$@nN2W2yd2-IyYVNp@Q78+kjzi~|#Y#T_{+yX}-(sor%3M_KJ(8B-^HQ9ti@
z`t#Pmmx5k0d!8!oG%4Dp<hL^HlV8hQlaR2=Svl{%Dt+g1S?}Vn=e7G|X|8n}zc|;`
z<cC7h%&&bac6LsYy?*R_h*HhN7nhI3O-pFG;URPNe`Lq9eJ#27z4*(fvHGlTy`f)F
z?5pH%ZNO~YX&dq9Uf673p4#H$7W=uhtR;5c;&eFdoAW*QYt{C?KZ#6}HioB{z7Bg>
z=>H&oXWG#svyM#(Qom=;nS19>v61+_qE98u{=F=4Dc>Aa$<=go-F}l}i>uch>n)1B
zGFfux8D3!~_mw-2RZi%0n`h0}YWu@hV_`P;nL833zjv2aNL=c@w>-~-Kd+Vd?X*c3
zG(H)}CK@(r-nlP3;ZWlGho?<CE%g#wc5zk)SsgEDcPpKK-sSmcmk#kKHnRQ;rIRmr
z#HC;6j9u6kzUU?QvM>7>HYA#`1%9gee6xGq)`u5%DBP<kyJadHA*;`Kyd(U*%>OcN
zztxsXYt<6n<yc=|w&U8^#KrI<#iXuV?r=vF+a(rVu5HyDx>fx0QVcmeZ^&N|epv9s
zOJDNDbnTLtKVIx&`6tNd!_stl%0ZTe%sN896*HD}$UTY@%9(1iZ_=|VNf$QH++@~!
zU}>9&PxbVLiaZB7Ob(o{-S&T0RK(51{ZB8==sq1~F!O+((x0HWJWRP~8`LlUJU_Xl
zs?JgEvdVGZO@<r7)s40b3;wp-bMoky2Wd`i|K4fp7zb({E38`k!eiIZV{dp~9Bx=R
zP2z~%0nf@azs0JXgZ5~2dG7oA<)!76x$_=6ZeFgb@Ktk>wac+8DYr_4vxRSdUVa}p
zW6zVoS^Yr<5ffj3;oJB?;{lfv@9&7@>o1o@s7FpHwiCOyAfV3S&Wpusr-(>TIFYL1
ze2<~K{kY85ruk>%7J6?t`BS}Rp~Nyq$vHM_9JE@N|CD+@!R-06CtuJ0exvcW^Dm>9
zbxmjYBhE~&M=^KQ);4$v@7m{nA}Gqp#WCbej<bBe!f{u7hQozlRUh<SUw>~VyHgLx
z%E@6le$S7|XBlruT+<wA;rc4kz`FgpFK5@K&HYa}@2~4V7x+DeTSffdYxbpg=DjUy
z?B929;_Y;eFS;uarLB+VT-jfJHKD72Pp{#<XTqP~`kP1uyxcDRYC}Zx{eskcOc&K3
zCPZzTwc*FwDIDKVd=LHZ@qlZu=HrW>oI^71=M`NG*yxr&Eg`N*Z&CKN&ftYf)vi^k
z&6*M$IulGq(iR=hG+VvCh4lzyhGmZf!_Sv`mnLQ1HQBvMM88GiX>-imCDNCfVnTP8
zDKFZ6;MHZtNahnNzV3%}cy>g@xGgH`v`&kj)BAGb*P8FUb!YRl=1qScTdEi9l9Ur|
z6>A}J{&3sd{H2rQ)PuKsMHK{Hn)mhFbCvKOKlY$$`#GEzaP`iL-L~H6ZPhO3OTTst
zN(j~QWWQZzGly&Q?#CNEZ!UiLd-|s9s<Wr;br6Z@NHl2@mEa24`ysusN{;o>y{7l^
z0p+g8GPs#$?s?UB`eS##=G`qjZygo6Z1nKUu^+Ra-@BfdYtvB_zwt?4!0Bx+?_cgL
zj8VO~Cj0;1D{;z`{_%<|5UkoaYegZ;*V3P5pI>K`?0-=@y?*)vE&GRp|8`urtYrG`
zZsn(BW%JzT<c7B!f1R&fFi$Nj^ts2En})mUTR#L^*K9jiRunY<{=>a{dNzn{IR47)
z_VG({f`XMcJ4}>Jy%Y|;Tp3bx*XCu%f={{Y^-pqa{dpo)|0-u_ZJ5$l@!6~2DoQf#
z>Yv5_cuMe>#df?uuU=+xnU&u0TFr3Rm5-9;ZU?W*FZcXYv!|$$#bByM74!YjiE_WM
z{wh7tt+V&p&D4FtcK0gFFMN3R^hZy-B0vAfvkwy@f2w>>s@wOVlc!zeu$$WQ71ggw
z^HSUweejGrGyURZB`eQEL61Cje;u8gu*sF_#`?S}lX<@mUb=cWuc)(Y<BIkt9GdLP
z%^9`X?RHbE3lmPaKjoYEO6+8Y%m%@ht#>pP_Wlel%-6lMXHr7jjn+%AwMyC+d${Mk
zVQt*=`-Yj&{tJw+GE|D4A0A|#wIx`PJx`DCie}%Rq$rod|G$*D^faz;HjAtde5v-(
zadx})aeK+%OLzDyhRzN3x0AlKX^lzW%PR99is}!KSf9D{`HcMHoO6MDEAz|x__SUd
z-ZT!;?&JHO@p5~vna64QpSvpGyU2-01~PU3mR<X4#-3mA9D^c!R&|PSp1c%ku<|GO
z8R5Ch8n#?L8eX1t+v4f<f`-|@eD_V2EOOIk`Sa_!i^Ix8JSG#IIVa~lt9b9DT&H1v
zZ+9Bgra}vucxJA@IXowFf>wV08YBHA>x7@q>+QKh?$-m>Wv>_c&h+1x^Y58yKU0KE
z6wjn)-Vv<4aYp9N!`Iad_*buIsgHjcRk<hXbV=#4OPd7s>!WV3N_!)J<C*Orri;lZ
zzfEc=mFbr~vbbh#s>WnxA5V#d1&5DsygtG6?SZACOX7dL<ew)~T%7$vt;~$$y!;|h
zftGdO9vIG?aaK3XFvnz9;l>q#TaxcEi}IeA&sn|9chf9o9k+W6xxW4mdHHIsWCF_{
zZnlq&8xr4VJdAEzb=c#onbOWg|DGB1u9-b}?samb)?Lf%3*vHogco@!@0zM)dGOS7
z{<W?NcMO6{LzA|Y#)}{Sc+bvsQ*dJaS#QTbkB(W#YW)8o<HWpzD}1Z>>isEc{Y(F7
z)EnN7_X$tjRr>AM+26~j{Ek|#>3-Vtsc0noRO9E$?{7s^Ol&B<acxJ2b6iijkmA1U
zFPUDx&#u&ImihOxBQdHXovV2Dv<Ke}<y21no?#Nb$@beMj+{6CEWsBTKI~ihg(rCZ
zmE!@{IzDsT^q+1yeT66ea&bWC`(>U=vWgY6s=I5o?(P)XT#{{3<g(<I%d=13o2|;H
zuGDT2(x}S3{aGL|aZ1kf%f_AU{~q3Z=zV&w;Y)5c1+O2s&2Hz&TJW^En5gg{O(<hk
zKeoNj`;PUFzVjaOGn-<MXY|~k<e&6n`+imFA3Kdr?ies;v^X$F_)2v=n<8Cy+~$FD
z>TI_i#d{(GO5&Or&V0G?bF%uQ8&`gM#65iXxKd}QB-@hi<rCLzVcQ|zr<E7+Vb2A_
z&U?qaPc0RayCA=^T8Go;w4y*7gZDfWxBV5$zZcdUHJtk((ClYp?CWRx@4EZGu20=U
z%#Q-{kA>DXKKyrX_VvTfbDf#F3MKcsEK^B)-Q9dt@afBsksX#wn@VPN$8iU$JbuM%
zabd!@Q|`($&7E8)^!(9Sw)x8Se{24qICfM*SY_f;Ps_%d35BgTnjgG;-1ym(cKtC;
zU>5S@ICimPnr5|^q^j~eo((F;IqO!oMrB{={X6pucYj5i+>wjyEHb=CcNQBdByC^J
zQ$CNY)ZzAR4mIIzh0X;wUKb}$Ne&LY_MAa?;m@>+9|svaSvq@sZ%)ivA*W?D$2BG=
z_|N`EXPe^<5C62*nw89b^ewbT<mur9HExfEN^d32&`$7o;h*p#|B0@Tgj~>bA#cX=
zm_@6P|2vqzWX5jZOE=SUZmEi-n4JyG(B`Q>6n97Ht>SluNgua5e7PKQ#-aRV<1RN9
z)sqY7GtPfHqpI~%vcmUM$=^#VqQ!pK#vVvI{P4qzw+Bx@e0MtBK{MHINwetw(@7e=
zPcGbe?{@M2)MLsoV}tj6EA!Hc(bQTTR(WYb_S@AbvSq}UhO(*HEo){j37Mo_z@zqO
z=hAIXS3>8>EZ@$s>dd3QhTS_X)}<6qSGGO)T_U65*^cWGKYt!N^(FLOhR57RJ^hyi
zq6+q&=JHic+@_n!(`n-QszCAUSN-M=wJlp6MNA(5y?;lgisSULv;N*U&5mf4Z_i_y
z|M%ou>1Yv~8Li23f2`PqTXJMlJ3LOeb$C_txo+yuwsBpt@c06a(>9^U_FjH1x|l;j
zb2rDA>I1E@PcAF^&G^R<`|0Hpn?*hIuZ5kSzCFxt`@&DtUp`p3N9l6nMb);_J-1hx
z`v`i@v+1|~W<TlQl&OaIJ&#NC#qY1Qm*5K&%J(`X;qIAyuz9a}{{5Rr)m57B9OW<X
zW4C|1|Ide_`|B3B%@I2!du`#luP&Eu8G~4Nc6J|VPH0^r5UD@0xGkZPN7`Vs{e+In
zZ7YAph8<B|z<lcDv^gQHmm^=?y!O(@C;2d+%k>Fihu#?qH#Y42&yTuwZawd@MV6ur
z4A(0d802xCKAV<bR8o`(Iwkw9ZFcePZJX}@)h>8E)A^;#q*T?qm8JQ?H+^ff)$KZO
zKk0k?aG^(l)8TeK$6H~x|K6vID|mcZ*gn6sc<o6SB@P|2--q56Ij*17f4qAB?e;Uv
z7?;0gZf7$rmhAoY<m{16$G6;lT@oI4QelpdvYFKJCD&u$Z+*C5x5#MOla5aY3VgQ9
z<19WV8g#CFx_-@$z!$=oOD0=%uE-R6=6^^-Eli+gqv&RX2in@1(Kd58B)I7K`GriL
z%~B@QCKt}D=<ir&#T8;PF~RGsozjzyiMR6F|Fu+_JbG1^+<M^nw;SPERwXlfe6*!L
zPRo#8GM78N*>LNAxmLd1wI;y}>~^OxzUNTjdiOv;PoyDff8c}_arw<Evs(mqBt9~#
z`L=vPr^8Z<X{?4{ue@O1!yxc0MEB+|>&Kl>YkP#-TQ?hSwB^=VYjCXlSKSq9H&3@s
zwS}Sgi;a?2-TrvHc}@Qtl?p?j8P7{ZqPub|*pEHfHPJiFB|2!%H~n0#8QMP!PPD0C
z?o{~CReaL(`IGwo?`IF{|89=wzqj{ox7|vCB}NO?EWMJlUtElTImPPz(Y3Z|$2olD
zpIqSNb$FNSws~Ups@zrImmJ(F%cghQqk={15L1=Fj>MJn-G>}jG%rfLx8(bmh!3I}
z3-)b(xxDeI@$Y~wul}A+@e!2haSlk>yLiE_S6_wW<}?&stVm5|ZD}a}WPGP%jYHuY
zLk+H}zplPn&#^&6yVG=0%5;f!GFd0A`AQuxMjlAIoKx^>r>>L!%HtJx*yCgmeb?+?
zym?wu+57{k-3$Vkr{DPAeL6$%n6EXL<@?Es5{#Oxt^CYQ-#Zshyuae5YG+r3$Ft~r
zD+3p-DP%icDbBVfZNuz}c{3NTX*_Ur$>CXlbLK1xU+&U%d2^49Br8{Ue&^9E3KR6r
zmL6O8>!Oyz_SNxQF1fxxwLYzH{<(Wflg`fRPwt+5=o{0D62=NnmBpI3)dWj#rdBZ)
z@x@$lxt%ew{#*ptUY41HZ0j6+eVv{eI6s=cI#ZTI`Ff;s^Hr6%@)wd+g!|`lB?>8(
zPBYfqB(Yp|_ho~iw+en7W{lf(7M!tE)i3$AM`4@k#<nxbAGdsF-I8d={xDglLGwY1
z$Kx4pDtw8vpImq(<ej;QjjuYc<zo09vBLhB^_*gUADm{i@vYdg^4lJ_Wh;FX6Dkf%
zR4x4b)jDC0^OpIOHDp|;<(m}F6XzBa>R&6dBlD+2kc-H*Lz+jI9(lmOVrSr#O;f+_
zx|{n+_?-I+_rL(FHnmbUCEG0)n~kruF3`vhQcksdbNufqzSsw42fw{Yn)dnLu}FuY
z1hxVZrB@LfRW&#cc_~j=E7R-enCjYX)VXs~CHF%`={ydTMGu@<g|1JVqogjo-JyT^
zvR)C7ldVn3RywCjLoTj$adp%UnKVbi#z$%PtQGGwUZ|EZ$`qVsy}%arxVEzN&%?jB
z`SbfuT%6rp9?x{O?87^j9LCCtp4%TxEhskm_-;>t^0)hMUmDF@7j@ytmGI0%^PZVr
zQR04`{qo0lmT9x5D9US{3-j9Sw7dP>ngwxM{xe^EIsM|QRl)MmjC5C%qW#8m<#l#v
zOqRZPDD(8a*DIysXR-H~uGr>lX?`$!#xrBRIS;R7+@8$&reB}aUoF9F*4&v4-X?5U
zeQda-dwBn>^wBI0_DEZPd8OYSgInwi?te8ntfF_I<?V^C<EJ-rg{dr*D4OD?C303}
znc9v83Kk1i-r1Az@y3=mn=em#E9RV^QD(GS?_AC4$iE!wx|grs^ky)2oKehK#B`3y
zqvp}&6J42$JG!6sK49lDvVQwLL7l~yb&(LuBy$<5zg)XqE0!CmzFS;$!Mo$2l}Cr4
zfScXFj1_J6PGTmTwlYjxzV~0Gaq7ZjO-euJ{L?HC%sy*j5^M1ChqdaCGIMp|n&&SL
zd+}a&xFqsxQs{)c3v;w|M18kh+x)myT;pNtE6&@8Wm>9Jdvc^%jte}D__jE=`dI1I
zo-9TK-uDg1DyI2LHz@M_7F_erJE_FtO#Gb-2VHf1ITwoZ6&8B$cxdvrWY(-mi@E$O
zt^9f%v#w1Dl8$t~C=(Vba%D#hM~s+-g81PRUCT6|KlJ)+^ZE|M%aEoEA5%pH9~>3<
z{Wa8u(_{I5tK;(D>hJwesQdHuZ2MnZ!_Atuv7ZlhG2K|PB(+UYJ#f*Vo+$Ng@i$c~
zW&FD8!v5+l4|aH0q{(>X*4Lw__O4wj7Sf)7a^-hn{j>}V;U#l6rJj<$F0)i?>hywz
zUqi2)Rf`qh*ddj5Wzi~`rS3<zn>@Ybp?zG5XUp7kGv-!b;L+!CPF|9~k!w<#-Tq6O
zWnQvw_QjJHuIBtM)i5vFgxkS?p=@qB*V@n0%LOY=9}ZY_N#mAt%bVy2K_}ihwM#QB
zj0{<#qjhQ$qs=y^<6Sa5OhSI%jynV!iX*c&yLOx}_kVhJ^DDi^7ug#fcSU?qf26aU
zVbQs*A%_;tD4E&tWjn)zxm_P7Pf==bd|G+p)aA=Xdjh$1(r(V3?YhpXCLpQUFjDn^
zeTT^74o8mGdkm}-S^o=NUUs5o#?2#-4m^&KE@qP9O|i?6IWBxJK3cjldNPlp=B{tY
zSC>i2u3LIP!SRsi3ElqnhUbJ&UEj7#a)(6ANmCx>sr7>U#KNjocNWBE^sIPldLUA=
z(W0?5drkSQwcn~%7f${BVb{%^tT@q^-#fDnw`_Smw}$(ass9<Cjw@NkS~`0K#dFk*
zD$W1zJm7!%=GN8mCjPs3UGG>a5&W~S_=vFCVW#T~wK>ks=skAzndOY$2IW0$7v3(3
zpY-)#XhI#|a;N*VRf`f1?h2aIqd4J+MT^Cm(o7a*jkE|ojT5y!=7r*-KiMS9n>H#b
z)e7!fT2sp>;ue{(^uVFOlEZrnj^vzf<~9GJ?E9yo)#<zRmJJsfJ7ixROU|<7_$vSZ
z0*_RJgzrT?H@4|-nDx~!ePN3&>07LOV2@%|g4Kp&lc!ft&Et-B4p;i}ay?5!wsWV8
zD{B<%CG*vF3%ard`}XxPPiIlQu|%by!Aek7xy-M58rK|ykB^l%8ZbU_e4)+3<FW5m
zszc3dA*qI$cTekv*L|winehGA-P3Q^{dr+>=+A67^$Y5rsy!KA-vd_Xc^{Hz*l8`m
zf1yeBhG$Fnnmc<X4zKZk;INM2P;5nn%Tv|J^=}!!9PqPWQnQj>*~Mvz`_<(3zO=|K
zIWHM}6Rl&#1T&?C=3PE<)WV_M_e=j0kq`SC_y6;(>d4V{U17yysV%<M#bI)}+sajw
z5<K&2>h<qjn2>ost^LK<+Ev{3iuP-~kM@Uk`E0FLi$5x{@k0L88j;A|B~^)HJ4|F!
zG}b0XItL3qsEai9J-sHHVFFvn?+vMm%W8Z6X+6-M<?YSB_?<!GrHeZ?H_5%xY}&1M
z>DYALqoN1)n4Qvg$PSshDrc5;#Iw|C|93xCozl{2uz%7e!FS1SiT=MjSp^c9W`(8n
zZ!TLY=&|Det*QGwCk8oLeE8<QWgTx~hU1)tOFgf7thcK)3g2G#eoc(I5vS|yh;MQa
z^GxM`Ot8C~yLV^g`Rj7Jvv#V#=XFtWmz=xqQFF(mNeri6&a?}8cJfN_qo5NDTbV`0
zZPS-LSeO#oy=2|>qNa-DGctr0Zca9d*v|RpN@-Hsj>&g5j@ibfvMy5Dk$S|~`kJP7
zg27y_^>d=SvTy6~9DMhw&7-+7@Z~f&-K`T_JD;C;IoaX5_s<_C8a|Q7SJ>z{hbgn!
zlpT;UJMAc)UVrI=Z>h9##`pgXzXh9C?vE1|*J60{iNVk$S2*J7hJ-B<w(CUf*BOc)
zaGvj^vYa=@%lymQ9}kO}y00Ye^EAp)?Vp|@u;j#x|K3`OdVjqG6kkj~&|uw_c7yX|
zS*DIj(oC;An~iK1N!{72)bh~zaZuThhh=K1>$u%K0&AYV+q`Fj-h?YwnylOY<uva9
z(xFvrnQne1<l(j13wuLX_f`J3Ev$6X+iyDU<R1s?B}?v|H9J1-NPK{ARIB{vPq+KT
zRhR9UYA5H~%-DROVy42A+3VYN=0z?Io_u26vs}y0#VV`iCM}qF*DooUeQW;bQfakJ
zLGhREf8)MxNaXX-WLv2qsZq^)d(II-t{IBF%2ByKGjr3QPRMUw5+fM7;;Qc5kkpC(
z+kXfeH1AH`-En?F%GaY!UAvF3nX7YgTa1(C{+gnVo@Y+0xh_rJ=v37C(YRZ;`0OQ@
zr9HK$+V|+2M0ARGvv0jAm$b$HU|GhK=*|g=drwcjX!<L{&x$=US$0>*gY&W%S4%VI
zu_USFEH$h@7S4S<+49hG&eAmsX^Ywxy-kXmcT*?tbb3Rv`T~bHD+?IkCoX&4UY|AF
z)Av^Z@0vAFHn_WsStvzZ+_+hBU)9}r+KV69PI>h(bz*|rw`2Uf*ITc*j$J&3Thr&O
z&~v8?x6N7h-hHXZSyj7RXGNM(q0Wc&tIdfQ_cxYgi8_RQTlDDgy*ZO^M6dtc<@&KI
zetnAn_Bnr@{>B@%?0w9ib=>&uxid<uy$T&KZf9<p(!TKejYq~miqGsmx%|V*!-C5t
zp8a^DJ^g&<*LE?3fE$mSk{dra`YXs!7N6NPqihXll?v}-UfFU(wubjymEA`dZTb?h
z^T@Lfv22CO5rL680tLOHR@`2f!%oUQUSY)N>F{>Xmz~mfFLzzpyYT8C$t}5$J7@Sw
z^j>Q_`NE$q@qm<kySQ3R=^Me{`On_ueY<8}ed|F|q|&Ny7w7%?HGSd2x-hi^FK;@F
z2>s)~v^&IQMYr9w#~r^s0)rk^U7Hj2ta8a;7f*+kE7mcTRR=#*K6zwq7uRu-{<9G>
z`Gs2F%qCskAaH+H)`K>Y32ZMXGi+{ORv5RXH?_ajdQMkLQC7KW1Q++39v92@`wd5q
z&R`QzOo(l=h*ilFWy@}!u77m%^}sCd4Ux@Lw{0_--E?4eX{>9n%Z)`L>lRH(N^zd{
z?nIMT!R^z_d}q68PR`!Kzkbf^Rj1c{ood~;e40|rh0nd4lLRl%h~mrPoAmPW?&Z_-
z1Vg2tZn(9>v+8Bo#!_3AO!*XviBm6j7GxBzoc8YS`->fOn?Iadocid;%~>m2-uW#1
zJLd%hvlGXZlo}x;hTj%nH8@nSX}A7#P7e;L+j!ucP{%&KV>~Jq5`nL^r$>D#Gssw7
zwY*f<Xtn0jll?nS&aeD==2zHTuS=&Kt_M8)G(90S@zdX_0@Gj1i-qhs!FAxbf5yqp
zqPtTc9^^XtnEyTdZ+ZJ|T{?GlV@x-9c+Hd2VGljJxuvvlYS7~68&>_PJhMTof7UdP
z4Oxd)r7l{wNau{rly4X2{c_^}w&lgf<@Vb?vRfGaSo-r@h5ECI8!H~1FDZS0Uo!Ay
z&)nWk_s*V(myz4^yYzo^=hO4-^EXE9{ChIn^Yq~h_f6e4d|E#5)sNd6S0|qc{ZoI&
zKE<=K`mE`bfc5fD8)F$ZM~A-a_biA%byoPVz<1}C_FGvWEFueyPVe5Z?2p>=OI{2{
z*H$nqpPqkbwxGnle^+i@WS$q*{BXCaVmim3PwH2H1aWIjoB1H<kYSOaaQ+kx?#REV
z)zdoWP0_E6dR6)R$Fyzzp-jh~WbF69XTfI`_Ni7^plkns54&!S|H9mJJ~Sn#yt^>t
z*2a}V4UzL2+okq!Yh`uqtf)LQqbvQwjFN!8o7a^JMSPPAjjxPi%RXQ6C`pg&`vx|P
zqS%K^JO3Z@s5z?CQSKU-`OvI$`k{}D8GCgKMGUgL7prVI*jeIJ$@eoecRAN-mTrzY
zs@p<ydp__^yKi+`S>EvNz7}JBf7OYRoRxR?`cJ-lJ~Nxq<5aHKHoKD?oljm*U(s>h
z%JAq`x8OZ(>-Pja_;>kHLU%~g9Ol$HTGFduezcxH!@YV#eayEKy$q4o(CtZjCQBWY
zG|c5JuGW02dtV!$GJB_yLRH`Nh(71JQaZNJ9?jNEk(%-|uktDX^8ltDW)9*y=Mog9
zUh>*#WggvKv2Np=TQYM0>Ox-M)A^QmYhL*~Y1e}0s`$)n+B?&%d}rC~n9bg*@a0h8
zipgK<Y*$G2uY3`7wJN|R{q|;S)90I8tWCp%PQ9MkvY%Z&y>a^Hw&}HJk51(EzqNm&
z#=QeOCo<=~xtVcz-rZU0+n-ImJInOpwJ-UvuH8BGe?n1Qsogu>jT_Y#epxNKE~kIq
z#*JaK(%)YGQ76XwMPk{HjA*%7qe`{J&gZu+URid3^v&IEyr}w(&YyScn>OFI`C8ll
z=iAr4>0;cTM;~uzPrZ8ip2TnSH5+QL?YMRI%ms_y>s$S+g5$1dJ{43F{ki+o>-Vc?
z8}XMvxiQc7Ulo7<A|sFM{wC%Il8zceM~%F-)^C}gX7cg+*4J^plddv$Howv8GG+e!
zZjR-dUr#F%?j1XK;;)^6!I_Uo>h67*fA;+5pOM%8EYY$!@PFoC<EVwFxQ~6kepWxg
z`RBRA>AZiYnQS=l-{@cXb?(~F`L4Y0k2}}vneX3U^f~m?&(F{8e(D}5o_yuy0e9hb
z>hWEAy{WHce>y0hRj(5M*}l>EwA}ekS6!2HT=$7vpHf-gz`wWn|GBidCmHh=t*tkE
z`*n4t!sUNcviSdNHS6`ZiMu5Vz19r9s1_f+=YfKl9Mk+JM&Irtjb$@6*II9As8auz
zz5HiEX;NZ!dUf?~p_8^Bl<yut{70|yb!hGES!^3iHTf6axYQ$*c+A6DPUWPS)4#d<
zO8?#W-KfTU$2V;I&Yhcg22W2A-f(-vtXI)*KjsU6SZUAWm?)Y4Nx%C=ciXk4PrTOg
z{1@^{NU>28GCAp(ykBtBM?LPlFZbSCq4%XRTR!2uOR|;IcjcKL+s@sToxdP|!>s=c
zrL;Sp<>NVc%u2OnO$zp3Qa!Nk;0Mzc!S+2G8}ID+@apnX3D&iC-Pg<JoP8S}eeT$~
zW7mG2^ZWiaY`wR6OnLF_Td&{kx_bN09SN(l^SW7<Q`g6frn@|~4wFsl6;S`7{xql7
zeMjqdm+ad&E4J?CeC0IvY`FCL?Xst1<%51z)g~vW7bow2o?{h#``on8bJ^tYi+QX(
zFUoX#=9<Uxl7jxvuS9orq~7NF?=nvzuPTK*USf4zz$BJ8>ptz@yz|CW@0&jv`|te9
z{OEgYn|toF=y}hW_pvX$SyQ|Cc-%sXPe<l#dd^UD?)lG|*Lwu(UmCA3&%bxi<2@61
z^0oB6zn6W<n_4reezNmEYip7B`+ZeET3^~1a6Hp8^8l~T2C3GIA<B-SvfLG(cTH}I
z?>0T^<D`AMOIu|9r5~%-ZH)N4<gRY3p1IxW$(7DQ&(8k$mgwcqSFN0J*+ew{r~A+E
z!UgU8a}V{fo+(j{PE#`E`m*5JRqbEV;oGk5jxF%}ICtyRg49EAW>4jjm*+XP)T&%7
zW1Z#Z)~N{#ikI4_Y`587YMFU&_s6q-Mt|8+M_nJUY4Y9A%D`}xpMgOJ*Qje&Vp*bI
zLFLr&+eNp{1Ztm$FF411bft^+J7?>hyECr@MlUaW)oJT#)z!v4(Ob}ra|1)h$+JK1
z?`C*ErG`^JhcQCu+`QN~dT|q1pWZ${{kaa)x`Z+@=Ic6%3e2CDEePb=oc#YprK_K7
zq5e&)t51Hs`1+CO{~wQa!3yFFSkw*gII4BYm<#iol+SVLn$waP^eV_nLTH+}Q<jsZ
z_^d3o9Yu4h{8qf19v?8*%z5gxS*dSV#E1sDEQl)Pjov$POUCi<tdFyuM0c)Z{85+p
zAvNbJ!;H_?YOLlS&u?>ZF)y9g>k_wtXGvCy|Le{w+w|yTQ_qJS`=NWn?Unheh?2bJ
z=R!6=J#=DGE9cH{>;LbZ)4sg^od18T>i_N!1pZ_d9C)vEP<UHjNvy)-p2L#<M?BUs
z?mgbO@5zljQ4ce<E*$K8eCL9-)Ugd(*A=H`iz@8du5+n-s=!SV_UAq?TQ3#uR8fDj
z`syF+vmz`h56@j=6qmX4^vb#T)0^g%O+VNC*hMn5YtLb3DIvA~VB_4AUzv`tI;{~u
zy@a=7U3S2(vS~-tVm?LdncZ2da@arLZjZax;m<#h|NI%6&3vft2+QZ4?(1B;yH-5u
z6)byNy7iOf-&M@BQk#!H{`hFh0}Zi@aWCcLwEhO%6mo9b-cq>iaKR!4?`168CM@K1
zygx;A=iwbk0(d*N8VMSm(Z0^+EMFdRt3T0%^~l?!VvD>^>2OCcz5eh1H?<3A<l2wy
zb@#7!T<tTJ_1ERk(QCR>ySK2KA28keoR8n?CI22j%Uf@y=bxTbyeA@;WsAsK$M$2n
zW*OP@j3yWB$ji<Adn<i)vo7Oh{`Gtkt!EFti|;$fpn0+7+mv+E#p~^F+P?FctWg^H
z%I;oP+hv(~jJ=+VC#$NTXp`pIb1PnTUHyx9j-tE&3j2zzI(UX7@8F{Rja7TBy$%OC
z-j6aCHI6)<&1J&&(<uFIaGt>Ru6CA3|7BV8^b36a^i5k>r|$4ie$pzv?DB+lQ%<a6
zox5#@^umJgOz+}WFW(<}a?_5~2Zf729!r>X`%&(}-%btFEj?Bx8XbAW%gmsBq^rI(
zJuor2$9LZ`G3%g3QzCAk`M~I%m*b~!fAaMw;(JX0WZr#dZ2ea1*!6&l!0f1Bt4_?A
zcSSVX@uBU?)IjcEF(>Z)$te3}-t^J)^tCBDw&y2pGG*JQHLZHf`=hPtr8Bgit`#~j
z*?ua(Q{1d8Y1(f7jek4yUO%|OQF*)jMV#lcJGWLJTlaOV=ls2IG?j~k*RQ!2y!gs{
zuQ@-Dyh>BKur~A@&+FHA3)UVqF;y?&GZ6H1X`J`&?a>`KcCeMJB)ysBcPB`F^Lzo_
zZQe=;y=+byrk%R)(YEo%m&iJvWwvwP{5Vv4ch#@&JTIo+n|JwC=rN@ff#?GrcQ|$4
zTe>>0+v4KWt!gNF<o52XR}A0O)!p0tWrOi{>t=zyeG3o$Se&i#_jH$Tu-dCdZ3nkF
z1Z_O!I{U{G#a-(U-VfNr5NDtJI7Kw#gyDquekU$Y2=ScRv{(0qN}=y_msxUCYPKfy
zJa$SwIkSRaWz*YYWfy_JQjf!b=Cv=<T^RcLO@5Hr(#e6XvJLB&wK*)d$<xc*np524
zYr0QUdG+jvtvU(v^S4eruCd0fFEeLF%kq^q)6V@ATNHFTl&#A}$YA-glv4k=14dIF
zc+MUx+PvRie@0vdgNplU{x#S7eO^sU^R;&~3n>gwHqx%NIoi~4adoV##RJ_<5pQmv
zRA+y3x-XM`x@3R}pS+CJZa1fsyZMX%bK85L*sI~`^}b;RlTytp*RaJ(vqc1U_|3ev
zKJd_f)yWC+f*TpSb(e2naeU984ZlLwrOrPr{Nbb!^8Wgitk@L~J{0s;E{mC2etBVS
z`3;@8zcwjeQy1`A=HxJ5YH*v<udtbIU5n}o`-+#nC->^bN3$K$THA8<^P1NwXKtr0
z_uR04R^aKjs^V|+Yv=MwZU6VjykzcUw`J93SG#7edd9^4F|u~?_S=hY?ko9+R`B2K
zG;1nhWnfSf!&C6*CuJpr&Z&$D%)f0WQ1^ZPgGuZsSLiIcd6*$r@0z7+v`HrSk;7(7
z8Xdfs&**jGRC;=Z<J0}}B`%#?WS2|tDrJ7eetXHgzViFB`;|*Q&e_lVV`rJlS-?1X
zyJo>jBeqhPxG<B*Lr*Mhq+};WMy|~++dAdRj~72bvh1%@_^dj?SU^=>bB%)jYNn~3
zEKxmfk+EVbeVg6POph2Qx`tkx6mZVlQ&oGXMDH%ko$Dm_D}_v`TrS?0x-_-t7Q1Z?
z`|E~3S_|x^XIdve5mx^3>5GZo{P}Zc|J<}9g0D0`<C<^DdG4~)J2)~!pI(?9&@8E^
zc<xGYxY0??U0FRV8#hXnI4|9?^6<Lq*PDZ7-h6x1W$yOMG@osE)`B%`EUHO7D>W)>
zoU{8@9Nn_-mE4r>^PR@M4CyIy=l=irp*3%BrD^r|Z+~BBxO}+W$Wt?QicNB@L;8$@
zV-I!DpW?L)n;w(CeR7Sd&&^4ekFR%Z`)PVfJ=>3a+MHLB(fb0fPTqX9jd^ow=hqBw
zJ*jES-Cl{C&PeWfptCQ~IK6jCx6Fo&1*@kCPdo8*SJTCemP(PPnuwZtl5=X+jUD4P
zA7?BP4?LOsLUe-WN0BRW)^nZOQqNgTE_}m%VsnE^=Ph$Vr}|SZdjvM^<KejD)VH|z
zrf5@3pDRl{<H=K2dQmJ&;$05wpVrLin7m6wNvV6&8RkO<nSvkJh*Vi`xphQCKguJc
z?xE$)k9vj&zN_BfnsV()<(=I*GXoBmWIbMS-I$}z`r}K*mw^Qg8O*mH9uZ>*{;Xag
zGv`)wZCRAZvbX0eKHSq|H*fhkp-SiAj@7%r3C`SeBe;^;Vugx;(Z!I6s>c_$8UHBY
z%~owLb8cDI!8><hO3(Qk{}WfFt<4TE^IFOB|6Hd;tMYWqTK$hr^Yo50JA7~6D>Y%y
zPP5x?e>Ml)nJc0&J@r+>1f#&GC9<<)A7v|S&|Bo2EthBIp%Q&CCGD-Equ~A0p4N#m
z<)uZz*RE&mcvseb)G6Y*7-MCXZfMQnB+r?z=2qR9bkLteWSx*+e2r7plqCy#ey^Ui
zG`T2U#`@R9JN1w5E!!{k_ePn%+w7hBdx~YaJFa_WIl2lbHX3N>uUT|+=4rEMtfCFO
z1xwCYt=spN_n_ihX-lJ{3ZbGde*3KNSI63ap7i6K#@)r<cg<$cdSvuFPy6>Wr*f-Y
zoxW<XqiIh!yt=Sw&b+kKB~w1yCkK^?&*y4qf4=b63-Md5Pp`@8{Wb5r!S?(8q>T@6
z*t)FR7_#JT&?~tpxvsNXeZKtG3)my)Eb!I)8tE=yV(^GN|C99DVx62nhktZE)0rD`
z^3v`%S4)=Owkp3jQG8<e=~~0e^MNVZ2lq-H-)(Zj_^r~NQ?sgmhyVE(SSy>ts(EyA
z)u#?qn;F-$J3aR}ZT=U($$Osdq@34_54x@jNa22&aKHY+39Elu$F}$Fef;t7x_>gt
z-rJ&bBRy;Ddfpsfvh33dyW5Y<^29=8SM_~;;1;ZtTX=E9`zu*|zAK$%xi-Ch$Ly}`
zs;##D`W(Lc{Vkg|8kQtlK3EhQ!;yUWcR=sUsaLG>kDLlx{q!^++m{>zuAL3;Z&w;O
z9ceV{*}a}I^?Er^Vl{)!bmPY9vYwSpc2bvIUb-w;Q{NujtGrD**OzgXUiN|D`?D83
zxN?~3*!{KZuHLJ^HEqfJ)OUgV_pfA~J$=XWV_&Y!cysK@l;gqKzm7*uHZ$~zxmSPr
zagqPg_`fr9nzUY+O0b3X?`rtsy7qhWZ=u$W3p{>Q=)|({@7%d{Pui>hez*S|^7~m)
zbt`V^{M8HIoOxlkl<7L-j0-vU_t(D9ig(L1-OyV;<zQLA@%puVe0=u;<~?(GBII#u
z6Hk`If7Zx`J&X_D3e8h^yV`e(s`j2k&n$D(owgYK5=L#NACR26s*;s~p;r{o4dS5E
zx}X4DUPtHOHWLAr*SFYjcIYg5d6=P8@0z8fv`Hp2sJv!$^e#E$ro=k2D2e6od+Q}0
z;PSeR^%eW+CFlNrlD%~P;?tua*FQF%7O3~~hspAojjW4HyY7XkL|^(CSY%Prw`@_=
z^*3oNFI;@sz1Xm(wm;3g>)c8anWrVL+<{XM^oXcFP1vx)wbLNZWYtQ|V;xhct`Jq4
z!|f^}9K**}=D$|^SiZo-jI^JVTteE8ZLBpp{k=qX@qE>_`l0vUS^QeFO6KM4&BisB
z*858GT_QI&U7NdN<=qYMz01z;@bL&0-6FhD{Bk#Ufb#jTzbAZaGw=JPn?GmI4V|cE
z5{$fTSC>Bc(RW4W&*3HeHtHYwQ!JL#{%LcQgT<VkRTp1pOkX?ASFh}LrGag;>+_cl
zx)*e2{w*tPTK?W|*?WKcJ-+N5c4jxGtT#F+z9zVeuQPqlyict+79?+dpmuuNrzQ74
zX>uRSSA6#F<%<66bEfE68}GKOUAcNi!e?IQW!{XXFNM!Zhdt?grM`EDBSYqbn#E=3
zq+Oq}wmw?8EvqkbS=#F^J~rl#ty5k+{$qUP%F%2I7yWlyX;b)mq~<oY-3c&poamPt
z>iV{Oj^2VNlIdKJ7cM!f<QBQCTBG&De8ZLNmaJNz?D9U7adq!qQ5LQqZ$X{pEdr)`
zw>6d|S|lyj{$bF$Im%<^qMZV+JrXK<t`nyp%U}<mEtBgiEfy5x>e#j@yWnH<gWVx|
zvlbngdvYGf+n!YErLyz86E_*##d_@0U}4OVy_I+*j6v<4yNrazNAcfJwkXcr(jS<=
zH(p>N_hP%R35A`q_Z$QtMeo{{cdm1ZKt$FgYp2K8Z5MqtY|<+&$za;58Y;K6aib}#
z$y3|+22GC+&(d=<3lm;z@UiK7b>hy{V8`D6NpqiBG23kSD)KJ89UQTLlOAK~t>~m0
zru$6!4JwtlW}j<6&U4p@;Yrl*x+zsNQdC2|Czgvb%RQKLa+N~%n^~nhau;6azw2*&
zG_1tN*5X4{q>#sFDd*a>?blvf2i|Xbam#Ead&h-5IWaf4+3y<TV%3V6CC^94{9=qr
zQ;OX8??|+ORlNV#&!WsFx}1*>PfhsAVQXQ{AHPt4{*SULCHpq!YqPN)y)aWMLeg1|
zXQ^V&L2XTM4f));(@SKXx)<lp%&wPnzjV(#VbX)8r|0S~U+?0vVA;m0yJB0HMYuJd
zS+cTd(Tfj?8j8U!2RjdJVfpd6k8$z7yZdvtHi_NgWt6xtU3@_P#la=~FLloRJ%2&|
zOzU=|1Meai30I~1Tu6I+@PB<#Ma#o~o0X6Fw%LBjf4s8Y*MjR?&*Xh8_6XhFa*=KK
z@>bqUBB$msofQ<=v#;ye{t1g39<|E%toJzhsc@?9;@5p=xAdI<EFkNqxog+G=b>Mi
zJhq9vdunm(Xd_=w=a;yvD!0~ud^-8hv6EfTSk_736u$JJC~&>#l8<ah`2J6bDfy7H
zYj;1V9>a9E^jY6OwfD<BbFZKIVJ-K;j4!F;Vy_Kv7Hv&kdgiA2SN=n6?}Gow@U6Xb
zW_8pH#qSxLGb_G-Sn=L=t!{%>?27Bs9{WB!T*{vN#eV;@IZW#8uOkHFCUC7fV7=q=
z)d>l%dtNqeT{10uMUKK5!-IvFoi3?AeOb96A(6%TziG&6S+=HxkboVb2AtFNTr1d~
zD^8W(!DDmb(*EYm^NPEqpUcSx)jnKeBkz{1Fvlg}(1$y-{Ga7z9G|@NXKq}`p4$m~
zDnsu`1>IkEWxHnUA+4Wg%l~b&Om+Dpef__x!~ZOvdZ{(hBBt-RM*s7?$FPFU|8Z0C
zx$Xb%yM%JDep_E_y`l8A|A7i|7VC)GZ*Oi|ANt&+v~`I_dN=D@%^ivt=d7~!s$8ux
zX~o}i{)~%Uc}cF0x8|~_@YJC-u@!apMJy3wV34%N)5I<+EiTb3s61=^w&=D;(f_X^
zn}f6%&a>#8+#W6-W+>V|tvpmaS}*$d#3T_3mNpd~hUUWzlPa}rFYI-jr*qfV_`rka
zX?tETIi%IeVsQEL-OKlFEt2H#?frFjw};X^?{{;L+pM2ddg!!db!5xMY1PaBeLN@_
z-H{ZoHaqvIU%$WK-ph|K2bXPq`i6J9Qo7;(rz<s#W}MNIOPkC2|1bZH;$KY9YtEnh
z+_n6}1|1j4u+9_weAkwqh!9xwdX-+Kzy_7(bW!flF(D={axyQfUt9HSDF$Wcou~?(
zqVy=pZ{~zL!LaDhD;~{Xz1v9VOzFwl>bsRrn(It?<F)?X@3hds6{26?@|^UZJhifB
z+I_X9CnjFld|q(*!Qi7TuYb+esE|8RaJD%l$IQm;fk_GT+ev!$kF5XN2t`g@vL}a4
z=S%O(pIdKydhx8c<L4CD%%a21GuFTI6__TSa%ooV&+z{r-|0mBso3`8<)63wo0-|>
ze>{5sO6U$R%QfecTTiT3S+%Z=b-Vh<KW0Kdt!|oJcF>qKXa4i-i_+;5#)q_z^+o9Y
z6FYa~wY~iO8=o(!>}PB`yM5;Gtm*BMLa`TOt840=O{}`tGH`BVKPK~yVTq+z1^3lE
zw{I$kmrgpCc4GhIqoN-shqJS@r|Pa|_&H6rUOiC7?|j4A6RVf5Nl0J!r`zSy``6iK
z>EBsyX<jloIae||&i`s}^6#W(@xJW^%g!)<i0k@gY+rWf^W=-q)z5yueDV46v!BHm
zpN}^=|MW$1=XrTPzNCF=4)qOJuCvxK-mLUlvipy*f8(8*zTa9Z|8rgU>Nr%w=@cQZ
z86V}mD`!_&QDsHN59gxO#bJ$#j5p6Gh;9>8<(AZwHH^>+3gUXyH|e~?5n%y?8yEkC
z-T5%%uA1UOrvk3{8MEb$SXi5vCQK4noFV16dWPZY)8*mMr{~+pJkBU9t*qSm<Kxqx
zx1E`}mxXxQ6^I4IEtc>O<7}OE{>IN)^QOw23G18Dl6h9p)FArJ+7myoFbEs0OG(*2
zqx;Lp^NDOcPNI5UbH%40Xq|MBxka`+<Ip05bZx&AYs+|AG?}_nA3WT&KyD6aE0a^(
z#jCQ{_pEux@>nxmW47ZCRl5yy78FdlvgFayo98+2u03`4j84;?%VJmKTPHnk%HuP;
z`gAhq@4Ry|N4=KMZInOCw`l*)`XifE{5MI>j4V3mz}6rYpqzc&?OVgsh9}+6xSoit
zGi75JD@eZX&}0#<zI4s3_VVZrGc68G7k#s0kN2vzuPe?i=`J}p@9a&_=hyCCZJ2JU
zWY=Z*iAPQA-IMqPU+=|niTAh8Te3aV^0edB57Q+NpM1T6f2zj0MEjE-XMb(JIw?@f
z>*PJ=)4kD!XZar-Z&dQvjMLe1X0BKE%!~d~TuI86yXGyDo0VwE{*(Xa(Vw^HpS#EY
z{@(n(cK>@HEKS_E@-VNLbZ577`Q#fh?tM|_KfXTwz5T)ZrtZ!0=k)As4jy>qelz6w
z=S3Sn9B2#?dK)=o*`sq2R#Ih2Gvjs@-rB$L?bG!Z|Mhf=Mb7haZ0LWwj>&)X&qF8J
z4<A{*c0z_}z?DRIr5hVVC8s^;T$U3W{-$rU6x$K&9ro!7G8Syg<%{-kdIvT?Wil4N
z*QK(}thF-k=u#s`i=RK&+sDPt*;}*!$Hza@jpO<6goP@mpP!%aaPGC}G2!!t>)L-i
z?4PF|bS=it-ty<^{c~h4uQ8Xei`=uHD{kNa#vlLGbPTMjdcInAgv{@bT=Q<iv<1D>
zR4gC(9kN=xEJ0%G5(ZY!f1U0Uk2ROwGDtf5P{eYL#gvn`SFCw-t}W$ig2W%!g5B0x
z9KO8W)wA2|^f?arggQRZVw5i~4Q6Xn2s|!f$g!q!!b*XZYrU?^WbZEbS884%BE)l_
zOUEoj;7EY+vk1Yd#zxt(%QG*m$=VrtgxzfE<E&f#Tq~@E=lF#@opExS;gnLwu*65^
za}M0SQj_8FK49$%iOBu_U+(;wQKm8Lws<_l;uAAhufJyV$nU3e;i)&T9|=A<qRi-@
z@A;*pvCO6}_J~0Ij_<w}@4GmU8frXOs9mifw36ZMx&W?lM?c5i#eXj_u^xY@kjr;&
zfvCvRI-&BpCknnA^xZ8>WvJJ7jGp7k|5%3SqAvdwM=l4>6!#5{%%@+!<GEqLq2;vY
zs@y+?J8#}f@tilj?_F-<{9n#5>k4mfV~(Ixk>_WPIWD}CKQ>-Z)T-omXj53SyFtl$
z?dA;UW(&=&RZ)>A&zy75;G9zH{lzub&1S)lta~nY^IazGX4A--7j;R0>E%u0-?pw;
zeLQVZ&O*lTjtkbD3=~^janL1c(KNFScaEOh`iPGwMj~zMx>ogF3hbRdE<A1}@2*_E
z^?S9kW4h9{2WxgODsE9+9Tv@Y=A5G7^@p$AO`gjymta^_dTpOvOjS&}<dOMHZ%j#i
z#(z-L-XQml?Xx8c42n))6sG-sp=S5}CRc4Do6!_M0f}4x^bB~edUhO`@k7eIXVH||
zk~3Hro!hUi*iz~{k6%(=O#e=x^dpONR_u=w{ne&PZ?@<Etrj(_MV`;d;z-Aig-z<J
zr%v?xiug*tQ2+hnX_HdGk?1;^GiqP^|GICzU$f;(!;X*%7j~&lJsc?)v9>bZ@_E%K
zUx|t@ca6jstpE7+1;<y3$UV<@R?W!|va?&TBAmxeQ{l}1qS<}ZSToW@at`J>Pq5m@
zz_2_pZ-LEwd-p|8HcQ@}efHi%ajQflzWZ+@<?L4qu<n+3f8rf<CA=#8_kqv1%Tlst
zD`)@anxKA0;H7=kY{#W1uWnFG+}Hj5*uN4PU%{WJ<~7}Xup;&NUK>>(g?%!sOLk_n
zUv4)O-*J7Ns`K$C&$-r>2kwaGb{Q(&s_?k~vT{kni%B}onT89R_kJ|hn)FIqFy@BQ
zuYYD!7;ju*csko@w&B^>mKjG(SlN0a!#({zS}k1`lyGDpZ@wk#GXcl+DZ+0R7^ND5
z*Sx)xm%FETR_nC>gY9|^4G-*-y}iYvBITmyiGBLf!<4#Y?ZjUydTTotXk5K|N9x0?
zH`BM<$H!>=)H*%UeVRcNBd73%D}4nY?G<9uefP3&`Z>utKs5R1V@{*?f2`l-wrL;#
zsgaW#W3QC4_+gW3aY?$0k42LGhgD~vYjgx^@=C=&UGChvF^aFv?$MjV{f3=Km8OQj
z<@&PR&sb95W<7(GW>v_NidP%kmsrFmU(7qd-9U7IwQ+UZqI6-YS2>F(w1#eBb@6`Z
zEjR7rHQ9w_$725bPp&T#i42zc^Xz%|>d)Pux2MZqDYR^|*dW;Kki5_S!hua&-FURS
z-m=J?zxBZFxY>ix&N?h=hEHDz9(nnX!$<a<(h-p*nHuv#9wpjnueuw|b7uOthou}m
z>Ws1K8}3b5EKyuy?mbheI=fH8!6#dQsnd0v^}J<o)WpkoF6F#xw&awX&a6ony4)2%
zG3G91<(_Kl^ZwA>kkYV?Y2DAe)6dVyWD~Fxtm+fh_}q7L?TX7YwoMUP7~OYz*_s_U
zD|Y!NUJozUxor^nK_l{g#)^F3+S-4&XK%iFIa}?1eSJ~Y9jWBA6D)U^?=ev_^;LYp
zz2w(Qm#0Tp?&5lUdxOW7tHrSbjMvVFWFD@3QFTnPk%4=@KrZJyanB|D8>eh4@K@WX
z6SU=Uh^)Gv>du4jcbPW7NSU?ngx-yUt7k7P6ENGmXj}WX)&gHmmt^*}DTNbeEd2W@
zvPmrK?ExvdRoDN-9j+*-ipYq+8Y}y*g!lbqahHt?kD7F(?XA!L)mj&I&9UXLk2$yf
z=_l`N{Fe6fMHQ)gE3Pu*Y+ahZ?W0+nG<){rw{9$@ek)(P%>HyND!b!cc+^wJpW@43
z#FqUtW<TM<5_isD?eydO?rU%5PSM-&>;8l^*6YCq|Ko%Bq?VUv$M1dk{etXT^ZFT4
zM-FZMbHDzjZ<Mo6$n=^zjuqLrYgg1Rc=7XqXZ%Co`iN|)mUAWkqKfjNTk57)W<L8K
zy6e7*X;<$3<z|mBi`4A-yi2BO^M?g)c>zg3kGe57y^}1~dH=%a>jkq<hr{Blckbs|
z+3?t2YyQezN{%0D|5s%#{vfeJrM=fDID13dsf>-EnAcBR9eecY)}z`gMO^D_8yH;f
ztcr*iEnr{6pcWCboy9+Q(!Peb|N6IH+2S3tJfH2)!h7sr&u>s$^vixyrnKkEP?1in
z^(W4+j9SC$(0onZX%?@ehS<WpR%)h`PxJnAUd2_uc-g%W`C>zl0~=--RbDz#8eO=v
zy`F#b?_((?YhOP(DEXpFe#O>_Ydw;E!oqD1h?yOkAt1v#BZ=jqS67H_L+$0Jdpuli
zwcYFQ-dxx8COn+W^U?WW(di##f|Ac9-_g^X>?kl#Cw=*Kk;-au<wEnOze`p<&pqK3
zCbn>Ur@+6c$6hn`y?8gjc<=HIH6xGLl{{t4)~7$*|JxGw=je-!*2T8%7h;+BeV;G)
zOxa?#|MV}a1?;O|Gbfy%6;!Bqil=_Z+*=!$t~q&Wp4IMoJls`h_c`9GDZVg$tDe`b
z%piM-cX_UNPDs1F-X*gBjN6n`nU}qktkb{mpC`0Tca}i!^v~5_@3LgLYkfXoXLNLJ
zNHXW|2$M>dZF7Vp6F!_?DJYfHdDU5b=|SCFI&7{QVZ8c_6i%84ujx50HOcZs@S1yN
z)~6>*1<11=RX1|7>G`|xGxOprZo<FMhi%nq^1QU^hMCOif_oq4cDghy&@t#Zbm0Np
zZ(9MT8+$nzcD4N0C|u_FW%HA#Oi$c3e0F_}ZJN_+zHGjWD~q^-&n`9Rr=M;73MRaB
z{Jv}IF7XSx0fG7<=cX?Ud@x6De$D#*|5xqv_y6*J{>GrY;)+W$^7$6;OsuZ1;JUZZ
z_T|$z;z8cO3{q7eW;bq+o$%}n|2#D>h0S-qPA<?94p5#w>t|i{1s>sKpK{MBNvD1s
zbUOHD|5Z;;^9^|d?V%irGg*0r?%!4kJE}j$|88K!a>XC>8vA-(k~Z`!h?_<G<fYHe
zzdUiGsDy9nT7lojzoX9nzG+#qzoA*y?e-?`<x8i05t3tbmTnDOb1>ke(D~XxfeG$+
zT04V{9OvFLShIb3_Lb5P^TeL)WKNSv<DIkFDj;*S=;SuR!o#;6y3P7hHg9bC-cfmF
z((+xRL8a#}#9d9u-K{EeVM_$hdCxaDtB<g?KJ8D=c$MO-eCmqmyU_VkyL~g?Tzubt
zvDj~#%#0X5#;D`I)7GYF$i)85U1<3-c!l*#S+0-wE@x!5X$6Idb{*o>5e;Mr3{R4G
z&DOcB)bg{I`Ncu6Um>#Vs-+~Fj(m=p%96>q_^NNq=^Tf>SI+K`KeTb__tRWIT9@q;
z+vTD)-<f?)`4ds)4W1c$_OKc=>LzGJ?eDoLI`_w|wrz8n9>x?_Uz15IZO(s{5v7;c
zvf^aNvNGw}b1i-!e3$+%^tyH2v_&;s*ZU+aJf7`MdS-E5q@UNRry(xT$m(b6yp{hh
zJy-Hw#KLcNA<}r$YcY$cN)@51tG3414vW9LZS;3a$j^@0*nPX^Y%Ep}KFiPd<4wce
z2L<moNOAvWzRCP^$;x#r%jV2=OAGO@cK<Z(Z;JFpy-6=JW%Mewluq5*<8#Dj?qMGh
zm&wepx->orXLOYJ|JtGS&_6mtQ1)sn=R4jC=1<+CwE}i2eyV1(r%e9o`m*c;PiEXy
zCEuy<_uekD*_B<L*1CN`^3ImO$t$$3U+oMK>O8p6lGRMdzsB*fGS~iRZw$oSGtQgn
zWbtk~EIYkjxoP`_)SIDuKZ;mMh&O2oZed>)uzK+Wh1b~=GWx3)7R~G4HzO#LO*?ni
zv}H-wJZf^^b(5cOW2-dh$>3Y?k|X*4lXG{Jzsz1CI>SPvxap&Gsix0k-GjXBkzLlt
zXD?Ug*XsPRy*45D`M0)9?;>Bk-n3|2L++K;_dN}Ki$6y(eamB7vZ$p%=YqfWG_m&=
zBUf*nxav>xrjBoK=2?c-)ZG2~SM+F8sx@!I1Y4dhX6!qrSp8nEwQTX4rp^PxM}qh6
zP38|g`KB)Kd&s$6SMwsTn?9&);3@EKQd@O>l1;(9YSpN#&!>EP^gr>Ich9whi%Q;3
zc9+OGm$qxE-RzI&J)g??-(a4)Epu|h>r)esB&}QJlwt7v@AdjWN1x6ve=eRr+3=DN
z%a6A&H>*atw`HG*yL4cOsny;K7mxn8p7!A5=acWVI9^=W`*yASxBiYj;g8o>R8P5=
z6qL;@<(q$Y+2ZR#TX?OmJv;Mp#*FfKnG5Fb0fo}lp0CZ9m$AS4FJk&$X8X)-dq3aP
zjAQ+s>0Wuee;rrkBNM~*nmRA8&Nz3P>sxDO;=>Og0(wK%me+7H#BW^~Rw60(s<ho>
zdiFYlv%gvlH~4K(wP3e-GGop4Jxk25CozYf4anCjiN9?4UN_=>@E7w0{$=~kT-9wo
z_xep~Uf%U0XaD&d>=*Z4cmBEWp>mjDl*>uq6_48#EzM>;EvkQPd{tcanqR@Bne%gs
z0zch&e{tE-!2PigYHmLZv={qz|CL?+?{A;J9{kUMIwi40fk~^9lY!xvGy{Vyu9ZW@
z<(X-q;jOumxy8442>x3a->9~iacW1&qixgsmc8@Iwhs57b42)c+NHn{ITt6PB(4Vx
z3sS#6-Cr)QpgCbu?WdQ`x=lC2-`MTu-m9|RTs;19_Qb->ikhj#nMa)pY}M+uBey;J
znE5H~!=yQ@i&h^kN<H~<_V(q5e=6P8wEgUg7OR~6X{#TylPxL9GMb-_d+jw9U-7AH
zP5gtEt}VSZ%|LT%YM4eQTXU7~=V!B5K3f_lX`bdX#nUS-{H*qF-PRbPv=d9x=Be;r
zE?qdyA)sp8*VCq2VI7s5Uk2UdUaPXI;^&0I?Uhfi^3Qv})9i!l*(<wJ7R*R*^Iy~u
z&b#?@Rieu#r#l}_o`24oX|$JRHCvLS+Q}#L&8NToX|H$QKBo3prj5dfmzlQfT_(2c
zXED$EF0Xz18SDQ8+im{8iHq$x<F`$fzq2T=h_ihf=e?jflkD3C>eIi^oW#8`hxNcm
zu9NGZIDP$Q+Gq7(cR{-16IqL;Kks+l_u3|Qb89s3_wW5n!XDHtRrtlmyjhTY_9F3X
zkM8Ta&2c~ez;{bcmd=mrNip1y_nl9B((~u|$K|O9Tb3jn&F%ejX!eIhNxMBq*`?~2
zojsIU|B(MLtFX?We1j8QX*@e!b7xz0%+f#n@xaBH_}X6uKUMesEc*HHmG%qHC-Hk{
zzc`btF(W1{=j21#(zf93Iz=%WUB6Ag_7v@FFcAv6VbaT^FQ$A*zJk$CqJ3Y6a=Fi(
z*<xPHv)|t<yng=PvUBb;OfH{lSpM8gR9Q(u=~xTfN5{tGP?1dSlu17(q_hh2d({Vh
z63EXlX>TZFYB4)<xX?Ryl~9e9Pt@UuU!*oidt19zE#*J){&vN+nwL=}Vs<tMkIgQA
z_Mf+$>+nGpQ_~s2_1W>vN;_m%Br|b6@yT!LVe0;v{IzV4`pt_o|LD0Iuw1k5@L`y<
zd3Q+Ywlz5>OZjK6Q;`wrP2L<dTcRULCF{_S?KN7O7sSGrOv*oyk#|mQmsQC*_d13t
zA$$&XZrZy${`0(&nq9p1Jk#zxb@BQ2^LT_gbOPND_vyS_VD;sYr8d{R`#+X@ubp~K
z>EL(U&QPU?I~1!v&U4)K?1<K;C(~+J=UVLC`@`WveDbHJJ!&=|`()pJyyzowPg_Rt
zs|{DY8>finA)^}3plx^5o_MRC)L(W=wDQ1QzCWHZ@BgbVWItQOA5|ChZSSg-cRtmZ
zwB#B6zA<SE6{+^Je!s%jw6#?6^8?p{t@=L;xzC5PYAJu86Fu*0p7#mggOWMoTXhoU
z#jhwyRoLpfKKpQY;jIZr>Ulrrq_22(!O`Qudppzry;mlEzO#gF_XM4<oqLj-7<Rb#
zD&C*EuTZYOkICeofv(~w-!ndMPVm0HdF9%t++9zKj>}ffJ{48*WLsN#MO;Jm-OGlX
zen#D}$Pt|<5Gx<6A$PB@dEKMJP7h`U*5ATUZY6H*-aP$D*jmeXMk#Nryp%0>Hw!5B
zteJ7nFs^8NkA%06P$+|kz=2=qx6fFvyeYCX$JI!Ud70#D1-`vL*X;z}KWm98_U7He
ze5<8LxF@J3ME$^oUI)Vqr_!cgyYa<A*UKr^uqEGaQcPky>&3l74o9{nZ`!oY<niRm
zss$^a-B6vkBdBld-Fjw*bMF?MI-afeaK4@9!ZUOJ{CIaaQ-Q%qW>#8r0Hc-hPFBtf
zuRbxY*{HqY-fiBie4Fwow}i58{@8IUh`s5x|7=r(dqurhy*@8H*lXe&S8M&V<I_IB
z|6kvxe0wEbrS+?9(w<-M-?uY{Eig-J(fN2|$C_&~#;291T%62Tbx7-g<>hM&wku1;
zUwp`@lWcZaDtz^{9qCVY@CP2ay!USUrIv>w3CWF<7|!kv{jznr@3g4U)GuW>{3Y%m
zH-E{P*tK(7()NYV?lb<JwPa5Hd-cTSnzy`<R4wuJiR3sfpA%9n;dlRxgXXL)tFCFj
zd@?I*qX7TK0{z6p+jTh_AK30RSst4df9ntr|AnU#HV4}-O#V`ka#S)U>y`AMfQEX;
z+WQ|DJe_&u!4jQsPfVU%p4{_6ic6<J#WpCcUv!I#X36Yz7B>8kWzR8XK1<(jcWPZ|
zT<Jv7uz62~&nvn~-3of|{qkD>V$<(;en)Z76b-!>c>BBOIuXVfGjtoS-}2`_exgXT
zQ>UtFRuQA~qi>bB(rf3wj;uQV;A3XhasG~;?2UiF2!2|*ncu#=rhB%5FQd@4-fL3Z
zmVMA$Bw)uFpmbStjk46$JCo+~UN<m2H}$&8tA-hm_oS8Y5u5i&(EUK-jojTU-><#p
zxJk}R=+<quh4a2%ixc{yCboC0e*L<LRFyWz*r*ksRK7i3Et#qD_Ck8zB$M>Zvn&_Z
zm())R{_|b^&u8VitajN90yTv%=ENM6bx^*ps$PG5zwmaJ;01f++rJAgt`c*Ismsx+
z-4*}x%teb;=gX>^<IYC1GrsEkHBVIZd;8lhSzGu-Z@DrW7d#Q0bad-UqsM{*eKFVG
zFL^kFgQ>neOg?J+j-B^jZQbqlLZ)y2!nEph@4^h(Cwkp?OrQA7skz82pMP1&{wb~I
zdXEFH-;0eD;X5e6Sbwm<;!ekdg>PPV>uw4+$P-<%*v@akhEqivPoyp}-C~)X#Iigm
zFXUmoL-6%mA^Be4^?l}9AKDe+a{Vt?*zRK*^$ZDb%-mvQzeTGU%FcKCaaEVw=%#MW
z<-c~zPv>(f8CKX{e7)`Jgoc10s##+Dv@`glqa9Aad|6?3$N#F{@45eZCm%XAp`o0A
z>-3LTqK@x~$(U5^lQCh{6-(apb~|2PjI3sEvn>$1)4KEfs!NjP0v$gjr7m{JDo$p|
zug(8#a?~%O;mU=HnbY*R$^?Y@-W<x|S<|W)^?6R@vkgq&66XiKDbjg)Cw%8rwmt2#
zJO#Y9#p>60i@)G_&m0_J$-FtCuVT{a^|LSJw)AZ}JXMrcI9WtS(W370g-z9*CP$>D
zpH{u>o0q3~Gb3Y~vRCHH)-4yipLr#kKYM8NY@%|dq0E7EbEQ(R?KR&0QETD3ueD0|
zzP9|cxN_{_QmJiw9CLQAnBD8K?d17cJGhRjNvq{tu?&y+a`I_jGQ-pRUk+T1-7WKL
zuF|4~7Y#W7Clq`;`f~lw3`XYZ6E?D?b;$pjxnP>+y@e-JO>E2##7!zz)7)_M&#}E0
z66ae}r0U}jyjER&qV4dMy7zih7OZ1D@Nk_j&k6Po`;^Uh>~2xC;ksj4v&>%a_F+c<
zjB^DQ^YTybo4vqbr>11c^c{Z#|9@Gw`q}q6QjZI^9NVfq`_8}hPM6#MIn2KGbK_!3
z-NRqgeT@45v>4reZZ7>t9<|NJm7yY5z{$W+q>N`qvMezNwAy=XWOV**3$eQM>mMla
zPujN4Y%fEz;e*JOJ1J@zw^)4344BOYGCH^2Jh8~Z%X5$8|KIbRJ11$J+`jB_yNmdz
zI~98OEv?kdufP8<758a^Y8S7*(zKMCb2DWoUY^qCZC3MmzKrbTPLJ!8^ruNy7JvG6
zR^Z<spS<ZkH7Q;yDoOl0VlTPOCih&tdhudRmndgb<-DhpSQ#I#4mr_tK}AsV><*7B
z7XyF#XxJ~kdFf8t>nZBoPNF+?PyX0<b6?ldMW1<8JAR(AG5`MTZ{()~OFaU%ZC*ZM
z>4_Q#xfvk^f-Ol?gHEzNnRGtyx~6eROWbmviQ2Wl8`qxxzN7cJ!(p8nBK&IJV)yDr
z1O;^Fdt4~?%lmtK|N8SyC*{*8^NY`~lb03zF?G#~m?JT%x?Z0`^g@ayz2%%Hp80u5
z=MTs6!@^|~&$wpKy}122%h{>9-cwoBy&3Oah>_ShMfHKCV*1oW@6T>7Eq<!=yf9_j
zpEmRD3*=7s^&Og_<@#@lp()p{XNRO^Go=iD#VlhDjMUCC>y&&6mYezeg61{X9KLl&
zh3Bz0u8y#g7x;GMLYuO|7u7%WSNYrvZMRV>uvREmYz|%c=)|?s1t+8I*EI!jEp<y#
zbFop7S!1K*clcSK`KoOzZCGn<_D{;H3O^arndli1AQMt^?Af8!olR+VJH>qh;%=@_
z57~I&$Ez7O;dQU9j6b}M@R*q1_x<cW)}j`jj>;nb>T{WEX8g5_2nv0}=U`kr?Qz+W
z9ljsgj{GdGd9?rU&HA?$Ulmn*T(truJ}gXQcRQ3TC;4yH+o<ROBM%WzMIKAF{TnAd
zD+oO%SrI#l)97RNtp_1dA4UJqKc~+4W2V;LgH>|Ld6)DS+%%I}a=5lC{c`^eop=+@
z!-_A{Tf^Thd(P8dwYS(^fpf;)mW7jY(+UDI=S60{Q0I)@SbOyT?V_i*86MTgZvMk=
z;o)n0VIF_x#w$Gf?sMntoN0S$Lz46#!8hTouVaE)n9DPMO&6bU=Ww(0);#-7N&Bw!
z&zh4xV^a9zB;{2ukKK2LweH-rcZUBuySVt6c{lf1mF#X03~m?M)cWu1^Ubf%hfm%-
zd$z1j(8(Z8r)44f)0h3arupsN?aQH2QxsVDq?lJf%(M9{J|Sb?-#V5#507LDRxY`8
zDp=pcx8KK0k$-Z!#d68sb`4eqovYK%P3d0N@=H=-Q>-M%oD%1!FM5qd+}2B3KM6hi
zByaXL3DwGDOd56*1dTOp4l19Y#yD3~P+Wi0(uupHL`o7Jx8KPBpXnp)67y~Y;}bCk
zZT|pO1!bXWPqfuCkHtiboj2o{*81{=xJL#<QQKkG=?602^jJCF3R!l5V{*dA?^6$6
zs8f2vr62S8!RiN{(U}aJeCs9eR>t-7toQE`;5T{N?$x-PU+D4IlWLatq%13hj#VDv
z6MOo0;i5fvRZdwea~UiWbUA-;(;n-PY2{JV$`o$!yjl<-^5K~k$3~?o>;7vzseQV(
z!72L<|BtN~IW2BYw&!#>EV^BQn^z;Iq4e(UyBU1Do=gzjIjc4`(QV#I^W}Ph{xg>x
zv{@FNU6L#swyZ7Uf{$n0v8z+Lt{Kj}u;ZN5KGxY^g)eJX%w-9ASoXRn>df~wd%AL$
zZi;5z{p`(B_GMch#dh2+PjM-6z8muGqs){h#l?lr$C%Q3%^QXIqu*?q+#9sN!167Z
zeeX%n>$k(R7}KrGH_SBF2$+<vYq}`Z;g1kk&+ES``zHo$|C1)kXtI$ZJj}0s)e;$p
z)cEc1m=3#z8$S1BSvJ>G>-w?@pCVZ&Z=D#mF3*Q0ap5;jHiz{ZRZl}0uIR28D4ILJ
zmM`z0#owB5am8*EOrHBYMuvCaV<@|G>W;&$MY@YWZaH{s-Mp<eQfrEi3cr{=X~NF0
zvm4jh*V?W8?zrP>dFcb$*UPL`Seq0#3Vi3d>A5W>!*AAc$%8%qC2T=W2?h<^L6Ulf
z6IotZ<_CDY9GoI@=ur05O#<m|6YpQ)@ZXzQ>iue-O)=l{sz{kvZ8pvOWqTVUgW8_+
zpVax`{QE`j3BFT~Rr?FH*1t}V&)s<M9pC$Z8;;rE7d-zoFv8IGU2o=}sauz6|1_M^
z$@9T?p38s6?Qy~{z8i3D<<Go7Gdbt8Pj(vPB9G*Sym<?@_jQKyE<Uv`z(Q7jy2adE
zIb{W{J+U!QN=uCtgyOHaw-~#`e}DMy&d!T@=afFhobHI^PX4fS3iEsUm0tTSmh#T=
zd)yMb#V_Dykdc(A=Z!PVtu$XM9ElIQ^7RS(BvWINIg=umW;qzyZexDbt2poS{HRd7
z<~4mEt+JNwGP1g8!p<3bV4=I`<tZnZdD!mR?)cNHDqzijHHE7pt&$PK*BWgN_k2}1
z>3gY@b~)4f!n-wF%Wq3}K08rzC75weRo$yM3RmrQ7%%6YV@Y_oY*N@#PH)z`w;cAG
zF7+w@+S}b!ad**D@uI6ulVqK~?Kvi=`8{`ASdX^&LHWAAj$|DH(O(Q|mcLxGYl4$(
zvn8HxdpKX`L$R~x`q_uqFmGkCRa+hy!Z?RX?$HzBO{a2l-)1l0D9*Rm>sgnLQEYp#
z#<CwTSvD74HAq-@?Qn67XeY}g39j&I|DCq=h!k+Se6g0%kTBeIp@>_<Tx8MTR#jG^
zlB%NXzlG9ozbtW`AEOZ*5gPOSexJF*)w|R6`=0NuvVC<wPN|pWb(Esovz+bAWkR^7
zitf^RQpIxdPN(s?+p5>|X0CoDA|CUg-M}fFiAP63?CT7!`n%f_#osSkeIrfDm#Mz>
zVTHtdWjncVT*sA<Jb0G4=hL=~%lZw8`!36t{VZEA?=0}rUnq=4a>+)+9<Q<&%x@De
zwmJOiI>@*o^tUbBmbB!j(~qlqe@X6<=e<;N=8OEs+_qgsX1BgIw;yW#_x`-TfBk+<
zyJZh&I-dOPzVYq1mqp)~aB1qt>pd$kId=SP(WX<OZbz6WPip=UaFI)Y-RXvRDF*s(
zR#(?@lt@LUZ;21SW5?xQ_<EwowB+M8Heb&lObh?ywtbJZz@`1SzTOp)<Ce5omSW9j
zzIA(Un~7LQ=HuCa70<HmYj2$C>$1a1k?HP_5Z_Jz9)v$SeA|XqvHShnAKM#+chA?|
zxO-bduVLo)`$p^k95^(s^t|Z?6B+Y-Hio~#p9}M1wtTseelm|uc=P&Q+)~1)O>254
zRe7xaE&6i0{BMKga_*HWT(gU$cWZ1<3Gliz^XCh(!uvPBiPip|?Q@2e`8N-Dc8SHi
zUx#9{S2C{+*d|!Fcb9qJtKTC36}h6z?}<I%V!F-ruRUr@je&uIfeAz~Ffgd&8ePlH
ztjNqO){l?R%*!l^kJl@xWJVjLTPYQ2m%+loP|3x>phCcy#DapHRK0@AyJ5HU9-9f&
zUJvJ)#D245ZOk@bakfnkug<=cI(sxix?88mVZqXgN86OPs!Tni@yqdVZ(U^jqLkD3
zL^QhWuCmSPcrs_EWpUaH=NZ2D@AI#(Y`XNIVA7&3Hjh`h7esDSIsP!RL`ddP#MJDw
z;X7OH|2J%&yji~O%V%YuC9aOMcZJM~T$dssBO~Lpwd#?kl*SM4>1;+zIoFDCbZU9&
z1<dZ~V|82>%2+rjblW9~;|I78Z9K3fWLulD<K~p>s?)U-*q-%9iny{$sj|jzD>Hxh
z^OfqsOYMh@XSjb}e|dGqpO;yGPCxnfScBo$mT!g4w`TZvE!vc$`C*o{w`Igsjg83-
zpE|Quxs_I$?z*K{+Mg$sd%kyeD?_WJ{4vEd#eVEO1`$Qvod?vfG|yU>6ua)B<iaZ%
zfy)w#-Bg}rY*3y0!}m^K@r?sp?bs5g7{@6VYO<_2Gt;TjEL^ivSvzg*v(u**F`wFT
zWJ_7}OvVdY&CkP1T$?m5929*cC>yZxvGkQs;XXQF<`vI-vUR_UK{7|AR_uk(yBfVi
z?LTR*{~??kuDa*{AJMJadY;P1pG;h3*pQxAyy@-^HMYn{$yvrN-N$kTShkw4Utjk7
zSm2fH`M(w~FjG5OyXcN*o920=D;mOGNuA#$0}qL-?G)fS)?~Tx>YU`yDMfM9Tmofp
z{*74r;_K^x$3LE*z8P9mZrp1h6JIx{H}3kyLlJ)+67>%~v=!ZYrE8A#(!-1`hkd4M
zbQ{%tm=GfPLAy}x#;GqnT{#R(_63IL*GlYDZnV}n-4z}>`6YWght&SinBXU2TlYSn
zyhHiNY)y@qo!w2nZ|7|KcJ@{A{eXE|CPrH(Y*ts9Sdh4rC3x!AJ##~Bo-ypW+aNl1
z;}L_CJLYj{O6W-Xa*4d=(Bqw{{_{Yl_agpDOXq!$on%(wvwqdC-yRQ2y$v{jBn5h_
z-I^m5r96G+s+3zNvt8zfWO^3!vKT&_waC>t_R+SD!CN~%tyo~_!J8zuj!RHg%3PcO
z_6Co4E=~`tX1a;r(drDjzHQ>+vyQVoT&GM4owKn?nEjYhZtrRj{hG>Zxo_J|OXSyb
zykR=@_|%K!g+glE0&ZJ=x|<n#>v4?ejw?U*n11-_Joo6njE5Xzkrs3QJTs_U&zP|;
z=xP5>AD5|*v@eOo*!}aa{TILD?wrDy3;X<=Pfs}!nYHZt-U${w*;#CT58wY>YX8uA
z|LoS&mma=#Jz#P6-(Bf-<pyC>Jz|5cmOoJB|Mh>%lXIuHttp8<a;2m+a;5RDRolEL
ziCQqNdVHYw-i@ypRz%-jcI$JO+wn!4?Ow>e%6PD0o=IKT<+)2Xetp8`xGr?-sn?zp
za`a5=4;H-CZA;o_Cf5BoMf`5VNo(Gil|8<)7xS+D>Rf&3?ism`KC`uZty9y2KW`WJ
z`n-y{q)>VlhsH1W>+kLS7M59im&e!4DYdcttNE|!Yo*!F-KDpx$_uN6E}G|*-+%XZ
zURnA1ck%b{_SRbc&0l11Rb|`!^2?jEaWeV40x$jhdGFuO`~SI73%uV4^sXneGcb5d
zFfb?)DyfQc!MhxC^KZKe{aY7rSYQ|6q<U-G#6<!VtXZ}d8wwqFd*vL>!L~7K-HNp*
zW7EnrBQ-zWx8Cd>wB*f^!u4+--nuM4@$}s3bEl`LeUq%Iul)4*$=WAQk%pGutwlwe
ztuqgvp7e3*44=o%2aPSRJw0|J=V?M!fyG=O{$=b1dTYWabVW~my~)9;ph>j(;H4K#
zlTspgp6XCxjGS`IBEc*3_?#=J_}HqetKYk3wzzKEz_v|9#<jRW>W&wKF{@6b;%D9$
zss*uAjKq%}^RSY*VzV`O-koJrw3yQ#uDYhs_t>q(an`e<i*+ZK?oy2VTEF@IQq8{N
zWt%4VIvxD8_Wv!Rmqr><`TIVs&p)#4=7m)^-aOd3N6=GCEOeT|<eOE>>Vmgze@rTv
zn=Sl}=ZVm|N2}-S`A>d)efjbHbNBvcn=$+`&EhE4?hU*5z;yEEw?X-@uVs8Mv0f+6
zrnFs&qk=75yHi@nAi^VvH#Ym&hAV7czB?PYGL*~|)^cSxbdTG_#8s(&QETOfIr}EO
znH8&?%o8SDsAj<RY0e!_KE0Ocmm*6QMT^g!aDB>R80DoJq`z%b@`0<f<k!yNV%{Qf
zWL<)JlZ2@4%?0B2-0u>0#Ch)f^y$K}Yf9-$eH-7;o)x>wz0jgaE&pS2=%JIp=eI13
z5Ng<XKHp%;u?^GmTDPpt*rM>*arv{B4~xXCB@%9^iD<U|dBJ?Uy0lHtcH*70Yn`)W
zj^;1@dj9%#kDuM?qEjs=Yt1_Nr%FbQ?}h5D7#WwdUSeUJ${udGS9D{Y4|99p*OLp@
zoSM7z$gCKj!}}J``lKPn{O{tyD7kHazp1*3tyN%~|EJSg<bU7sf0G_GFPCHvU-tG?
z;PZ^XhwFOQy)<B!*OBAQdU^O+qKR~c5X*w_sgFv$rg?AYJlT-g;u)r(v}lq@ss8=>
z=0CPF#~pE5meIuFE8bdeqm;BP<dW*i3tcsqO(*Ri%nd6os+y(RwvhRkl=tj{#cS`@
zEuEh@$!JsC?j6nC%gbXb4oFQ3ICn5im9dfaPM4I>dd~}&f9v<T={~>p=j5!JYvZHi
zA6Y)T{x)uX%<hSI?pSPDp7H;AY`Om_am{7?fd|a{Ijw%>rm(a~Z+Eizq4Rh7w11L&
zTy|)RnO@iu_RvSQR7GW5l-|?18w|ZKD;|6BV)gcW5AT^J2?S0KDq4TkEX(TL%+f7Y
zrQaU^)V%i9q_uXjx8<?@TmMHZ@eA}F|FH1Tgk`_vi*gTn<wc8i{GA&3<gJvW{skSk
zWlVjuWjZ~Tr>(zvtgYzU)h(O<b!@VpB*nH;L-1MaquDCLS*J62b`|l(x6W=nE>#o1
z$nM|ULc@zGLJ{hXo>vk*K19^_M(vw>^hi?3g4r9UI<VX=<c(LIDjMsWsX297Sg~q^
z)*0ofZ#L;i+P$Q7`cG_LbY$Dy+V^_v{G0`OEc-U`rifOpIGy|c_k>^j=EX?`vPW^P
z-)m;D$EMDf$!b|XThOb^7R8I!t#8TJHL~yLpI07{-Re0}Xjuh^OHR4Qk`0DRGldy7
zs=w^`$i6aY@3s%J8eW^(X1LsX*e%7{`e^U*q!u2Tpfu^^jPp0|-|-Q=wKO>E&Z!5Q
zlTy#!I&oxQ5nJH$6c_(<{_6sbr*-~UIQsspfNxXz^_7Na_v>w!&pH0=`_8-0vzBG9
zf114aYqoJj#$0=?vh82zn}3nD6bZQTQBBpDr#kV-otCJxExK#Y9cJI2Rk-+Oi$ikk
zdWPU`ozGiZr=Hh#pQv-$+J@JomCv2QP-5d@yU&69mmgT?d@enB&F32%e9kE;sNHVe
z9$0Vv_t&3i8k2UlIDFyd%Qc*<v#e~6T-(`0=c867R*PLJvYQ**|ElP^Vcz`O?dhLu
zUpV(l2f7D7`9E8;J#B)y)3XaE8wz)?y}#&Z|NpsmXZySSGp=sPT(*<-nzqb30o4vp
z-klTWU*}0q(kXJhr{4WOOK0P>$m1g7|1!Q-*wj_%$=Uw(IQ`=Os-wCbIS;1yt%$h8
z`RV0yLy@Va8$MiT_{Xp~HZ?l1!*bfE89s-6)>iH9X#I7xo1=N1_L6_!r1>t)5Y7^_
zaQ?MZXlo+ha$kEbv%7VhGq>-IHpt<eb-E>uFRSkD+Cu^THT$wk!t#&XL<LM-yfb&=
z6TkL$qt)^{hi^=gcdf`4u)LL-|8erCiV)$8syxT_HY_}~^<bF#FZmZ)`se#*vn-TQ
zkLPf8oOdYc@|RclCPf4umv!P%*7_rMt!Ldjlf8{c>iC7zn_a~uFQ`mkCa3Z4d#u8{
zQ!zy^t;Bxj#PWQ5BPO!n&73zr{CL^>&S$!Rzt()aBDUfs=cYLS57lLB>@$iFe>kCa
z=W)fC14dI1p4wToZU6k|+g;cAZtKr3yT9&>)xqU6(m%~NsxAES=fjKJeCGW(uB@KW
zzSQZ-@sqRn2>;*<WGeI7nZO|_!m#q$J@*%SvyQ)9*D3fYby4>ev0!fD>-V!hi5dw>
zEZZSyd{D@KS;3a+tsU|+#Fsp(oZ98-aU_m$^;=Uu!}}7Vjln$4AKez)=dQ7||9IW{
zdH8POvp-kAHTZnIJYoJ$xnK3t-@>yF*Ri5j&|Bs5oLE>H7_RU#Feo!HFyy8d=jSDr
zX6B^mC+FuDWagw673)KLB+1D|6?z4gOT+Jj_l;kVFU*ijSv+mRE`PxZiLH}!58hgI
zf@w`_B8N%orW;;M+=4pqF8u$yZ%RsZ*&MYQay*^Kf4{qa-1-;Kzh5O^Evxh`yqYii
zwq5FqS>X2|_H0GtMH4&za|z2{^@^=Nbm+^UvnGq?bMMd=uv-u)WVGja&{a{*X4f!Q
z$918snX}BdU7WE@VO3Nnw~trqOi`~{3Kd^pUDdrN#k+EAc0$&ZlzGje37r4LRHf1q
z%)0aJnZrYMy{=5y>@{Wf42Gr!&SA^yH_whbAv)n&>~nXS<5NFx7CC)yVs@qemPzLx
zzcxL7Yo_`dnRkzN>(5_z`KJ8!&Gz|r|K_nc`1dz`nx{RpJCy%(V~~o<y%RCAd2b%d
zZ?w2^i#@e0fA6U^(Ht90Zd4VyMT&1Z$k4oW!vSxvz4IK_nS{))V&><V64Y(9n8oPz
zrVIhCjbc;o@$i-lrSEQjo$GTzWBDGZRY8$Wr)n9swzQr)A(d&Ey*0v2Og6wTG5uan
zvYNwc*?G|yc_*%LVh`V#|Ds`4V{X9d^(S<D<hTxU=l4%PBjGg7EBwpemk*3g`)*GN
ze>CriFK_tv_ztF!RF+5T|J{zxJJ7s=^<|!KFq>q4?JMP$)8}#o3f5g;xoA=NquuFo
zr@ow03HhUa@a>%luj8?Q;w1j>i<t0gznr!WzwnIqz~$Z3pFd2x<Q1l_n$M?_ziraX
z#*|%C_t;Jd$=N$~rt(_OmWd0m7YP1&vFLQc%{6U_x>L3Mk9?Ib=4q}>f8=NWBDZ3S
znCS=6CdtO{lCod*AFF(*T7Is7`phZWt{l_l_647KVO+x3{+3Cw`&Qe8L(5*CNSN8L
z_>0v}tFzj}GW1r{<YTt4{9ehOWtsSIqp{tmV+TyOS|_rt(9AiY?DF>G=aP=YAI0AD
z+!Hiho$BuSz2fwolUuAeuFU)tv*zLvozrd$FV^_aS4#5Dyv)9=+~oGOhC}o9+YU7M
z+CNPGzh%#xRoi1rj#wMjZ%F@jL$0Eh=i9fP(y`9BBC@(yPnNPTJG!iH^0lVwo9iA_
zA5^QJ`lH17wfFO=1<8zF+jLe6>zeP?z2B6!`S$tAw!V*il4G)K6Y|_Nzq20li^;#$
z;NrBvRcrqHDyjdOEz3+ltt$Lu*zkInNX!jeseswJTS~r4yB+TC6WCp$G2uyo{*vB@
z8?`LAc^_lB6Qq_QQ!ONN!YIey@A*r?{W%Lgjn8^-V_haV)nP}u+aYm9tMZ+Tf;NlV
zEw4~lSmM=twxvdlao&*y59dvDs{1YP;4Zw-`)a~n-aDTvMJsB~oauka_vgmfcjp*i
z71il7UOzlPy`0_X{Z(t@{lEO~`F)GMoVz6A_uG}BD^;GqD?H*o>#e(O_n(Eo{WjJA
ztURUaoc^hE-gCdz3P-M;TQK#)LeY&Id!)9`e!tjY7uWH_x^=T>D+X4p?&Mi{u;Zsm
z<R6xo&rF0iZp_*A-1%>;pHi%Gbc|h_r?{K83h$o3t~#<jF;>NaYg@NWbX-;`crkMM
z&woNw78<{gf7YD6ke#Dsf`&l-W8spCXK#HClrSzo-{C3K=l|@S_U=8r&o`<&o_RIv
zgIiLK$BnRk)+~AJF4-Edotbtd_|@%|#Y(B(i%*3mbmz9eF~9iH{9D7y({594Zfl&k
zY-M`lws~7ZTs&jrjk^~s{`fIt{^uu27q1n1&whM|C-7Oy3E8Hw@1}oCJ7aA&?*6rF
zdf@&Kp`4bt+#L3u)t_{<LPlm;K8O4tv@L-rU0w)A^D!_S&?P(`lbn;7mkt__iFzG;
z+e7I8xp+f%`4s(aJ%$e-T0Pfu-*oei(*v=*$+~@?`j&3Ab)2?kmf(Y>Kkl!umb>J!
zsWIkVV5tb}C7WH<zdp`>Cz(63`}6ksyVY$HHYVKVSL{}uUo?&P<m@SI#n<kBEjQbC
zqHvO)vE6L%O}j7Kzk2uX&AUmbEtR>|Ce3JhGtJd=SHnpcqg^*{%t$-g)N}lD%ri;p
ze$MzMo@$)Ek6nUJPL9aQ$;r#xH<M%LMF-OfnUe%LP5k}p?B2?{o6MW25V^!ANpj{T
z*8XXBJ~wX|Y!OPFf5c|G&8GaKnME_aSa+Hf{n(e!8t}=j=F$s~Al<3C{S`HbjS~Og
zPRze#l9WH)utRvxigkQ}i{#w5hQ+w9eOWtazyG2Q*M9Z$GTARb+jqHpe!sSFYk^yY
z_LZ4ce<$j`Wmvr}>Bz=Bi+P(LJTu{(DQVGNY|WHn{m}dj&l!i)!9_3Q{}uhqtNC+y
z_hWhcni~6%rgak^noKVdG8AZPjheUJX2SH-Q$o`={+O2TxyI(`nVN93(6%<6RKp+1
z2O<wXU7H&%w8{0+6LTw-`|sa=x!d_#j6eHO;J3F^?tlKFA7Wsn<-WmV!^2yNC!cV0
zKRM>sz$VY`IVB}|*4ZNhCatUYGNr#e@R?Km)z4p2YPK3ha%WQ?@t&M|eQw*FbB|m+
z<T}<V83oO~E^BPGYq9snx;5{%El%dxoAWl|E_bs0+AA5`SpUZ!ebC+NuY4*wC28lo
zjJ|a1RvF{VM%q!omMx9n@@CewyNgm2qS#!!BY)g{FS_#Td{$rYiA)mg^=H;7_+I_}
zZCfs5^h(8BX@91bGH>_pFSoktbJm|j_|h@fsI50L__wNm6gcv6O2fQ7&YL0*{l{ba
zj_V#=l*vB3;>?t3r4biioC@7>sU-Th%)bsB*1p{R3YYbEH!R41!I=J=WyQ}A5wa$X
z^|G@WzJ4}YGHGj<;E&G%4sNGsXZZUSz1(WO<dWdY6rJaiix)=R+|HnpS#rX%f1~k%
zx6D=AJ@X~3_$r@mmA@^0v_-e5^4qr@j@eA&EK52TsV3A;a#x&bFe#|z?aEt5CSJnj
zcV&%EE_FV|R5|0wJeA_A(^`lBCTTFpi`$4zI>s0rW-{9$o%NUXwCJ_9Qf+Hb%~FqH
z^U7VC82N?e{4u=`Uv=_bCwNYOC{`)#dh4Vk=Rw|tRSJx~oV_kgQbDuDe|`wQx;o*&
zjfU3|PcCcjPoFhY+%;}@PlM#-R&UJ?!-WfOC6uQ*fB9wha$niQWig@06f!$JWmDI8
z{k$H2`1Pc_bGkmNJfHaFW5jV6)h}LYlT|vUV!kLGdhAsZD*jpNm0!*Jm_F}&?5lMD
z#$1kOp2xf0tGeaowd)!i9lx&fe7{S}L+VWL#HlP@f(01{9}*T^pEIl3-s(}ZaLe{d
zJDr~~Xy{a@F-AWLo^&^$V39@0%7um3Yuug%Ejt{i-<2m`H|cEE1+^*$p7Mm1Gv&|x
zm|tP>YX2+#Z?PJV0yEu8*e0?)o2J7YEI3nQm+k`x)lLafAt7$gK!GPSCU2PF(AKT6
zxq-p+WzWt+mWPKFSBK0jG+=k);o)U2<aetwi4(eD^7(aDvu)pT$0_Y=x}{jSx$T!0
zy{q@ExMTF|RmS>_UaSHMx@-58{oW;4P*p6&KI8GuUG5X)%#02!7g=x0l*RS4<do6W
ztA}r$`2F}XpWgRA=BgQ`F=>{{<;83_9FG(kdMeG};CMaZa-UpMPhfKO{Fo&=4Nl4d
z3)V5rQ)X$r&#*&3@qtM{v#fuNo@~}+mveza0l6#gMmPQp_}Sqh){}G3aKd{vzju$$
zHu1b+H(`ErHiNCT#aVxbdec$aEgvQ=i7Yzp>~`R7;#{TqXJ@PsQ;(|K<Wsa;^yC@U
z<-J_29+@9?m+$trE7YxD9%1TQpWL!cYdh~n^@+i=Hdb%oyJnP{^n8L+%H-5Yra~6M
zLk_}{uXboWFq{8q{g-9ed_;Jc{!wX53Cv>D;N<JK(R((-#odM>H^Mi}<wB2WkHDS%
z4%V^->~d$W)-l~KIl(H%rdYvi@UE_F^18InZ>s|@Kl`Kn@_qAj<>U<<OOkzNI0bxW
z{LV0aQKd@w>mNKH=G+aQan8VgL0it<WjoTgyjuU@U!cR&^=<|2lUgQ~w|O$p$}%-(
z)h-wLEUaU;Wwvu~&4O#}|F(Fj>M)z1zMx)zmN7Q3qJ!@fdpnoXEC!F+jeVaurx|eF
zy)s`<;GoIY<E<xVzTjnZw_e}1vwNxUqwavVI|3J;PQLW%#H{t%XRnv~Jd52O$<M^9
zwUkfv-^ZITf3{C9zq-fS_}k6BEbDWp@_dePjr-o0X1He4>dit77U?W*mLVG445v15
zck;bv(rw*#uXOhz)}uzMyZP^F7VLJ4XGp)EIVqFn(|UL2`uq1kX8oL~yt;2g*h*;*
zEsk01c1up1wB_}L+~Cip1-k<_?8@B{DlD?Pw)y0bu8cf07mm^bfzM2;MpM-MLV0%m
zUUxZS@-N1>>02}&&tX~|bhOqdX<J)Ebjo_Ahf_tjhhH$NKAy@aSk@XD>i#tBoE%e{
zwyX2}Lz$twE&e`Of8Ea@#^b~r!EYi-HFj>>ZCW0rsH92F6%aA0ImCUWAVHg<{gkfC
z72&?w?0jBo4e!#$pA`4ckNxsQ*G6x_fv6|kNj4n};TzTj#Kaz9(dQK^yl?t=m%)1G
zwKj7P&k_pEpT7O7*`bsN_Oh?+53Dmic_TJIPfo$iDD24ZgYOP<dn@s*v}yAVeHFV!
zr}y8{S8k0rPBVYlAX&F`=G+h6R(CBV?;BPbUrRShs@)R0==iZ-UP)11+4hqwYGNLL
z^k+G6qP9@zGfR~CONq(uvqM%YlqQwbT78|$vCXM9^_a!gNfsN{dL3WCu>J$nFXaVO
zuiWT}`r$M~Yy07(UwlHPp?S_l99tKBa%piba4K8BUA`cA-R2j@358X0uWDbe7g;vx
z-m!o~j}o2vrmAn@FyDLhyQafO<EKZ2>+VO@Hr&?PbGuY@MGV*R(i68Q3p2jtStC4c
z4d2pGqaK6SREJ|Rp)VA5-duT+Xxhlx9k(h<>flzzCa$>#n*$UT-z=DAln_1jq10uk
zGhgrR`(5|qAX{o^+1|SL=(UB`7mpm9e>L%D)5%I9v1^A;`Dcfn=T!38TiSf{L65Ut
z^#7MeEl!)3d{+sOc{XK7NtS;N*V+e__Noz%H~$D1<+Mk5FP;6ML2@Q5ql&EgnjNtM
zxhg!KJJw&e{4v)cw0p*tji!kk<af4vPME&(@!}1>A_A|^G7HBZmGfy+<tkAORWB^b
z_#@`>aKazm<${OIc6MY+rIoN*Pb~F0%COqsrmxWUrcRxSl3dWoYsZXr7D~4&o4%;x
zZFT*`#Fcg7Yn!*z{aru2Zm!L^dQpVukk_xDja}+bo2CYob@9J{$Gl8v(lsxg`BleH
z<p?Mz#B5%|{`ddI@3*wCo9K$CwpV2{FMN0An$fY=>~{0A)l$KnQ<)zqN>9H%v2nH1
z>*{--MQ0^Q@y@gLWQg_6>Q&#TR;tRX&S8{TtoSM{RO@PN>7Rs24<<ETw+L!Ty)^Th
z!_Kz!^K%-?uAf_bIb`|XXFL}#o+^*%URC@|ao$-6w;jp+dJU{{n`d{Ok3L_UDtkqz
z;KI|7cW$n3wrr`ZDXL^!{X_S;q;S@DC!PkWBDQz@8q5B*{H}f_$UR+p3+pkqm%snM
z-Sv6>-2$oUwO`k|dT&t*JyT@&;{DeNsr-q}r|;eSck$wCPXk`IoD1*ye>ETc_wHQE
zt^4<HSBvhM^^M)JVuSzhc3w6$oB8MDww#%&!ZdBysuMwSA5sMJmHH|dt$gX!Jp1a5
z(3`xcc7#p-|LymU&}kJ_p_hMcD!Jq2w<No>>$Al6i+L$?moL8d<H4)h?fs^)J2Xv_
zBwQ}NV6^>pu{dAoRi%{N{0Dotm)1(VCwSWEGz+mgCQn=8^N4TF!gCi49MV+$_b%gD
z_Mp7`p<BT02)UX6-?|mW>rUW3G%dtPTw1E|Z@llPu3YE2GX7UNH|cM163vK-J<Fig
zs5v{fY;j}V7M`34i(icFc2%!Fcuu~`RjGA1Zl(F^-&%I{ytC{=l}+`Yw|%wldsTQq
z%A?KksN%QczC}xARyI%hdSGqWrM42an^A?A7%F#ZdQ3T$JL49Qk^k4_n!-0WT@YE#
z@>XNsgr-^C$6M!yCASo>o}?-2kk^%d>2>qT&OcXGqI$oEt@~^@W47F)f`z|TXLelV
zQxH3PM{#=RwE3@X&q~OP&OYuJ`H_`hJv50YDj?(etphVU_NZBFZ{9Oqd|~y!bFY$j
zEiVkazeW6;Q}80mwJ}H27PV`d-P<g%D)ehYhmBdkV#$$EJMJA57G{|4<KGz1nv<8e
z%52f{1v46VW*p7g_s7chZn(ipzg>NtNnswF1Affv(RF##+Og}~g+IF4slm+I+txPk
zTei;Vh|HAz3z;PyWH0&6-pZxD{F#Z}JNcgay6=~dwr}q5;9c+j`;^1B&l_%4z9@TF
zx2{Ys)QbJ;xw_I<`dj0Sw-?HCF-@<0{_A{?S9y~sSLqztQ<n<umN6)=YA)LIoMAgp
z-<SP$_lwUf<#J6k+#{KCNMBEO>ZB^8#!0)E^W5Q{?C_=T60^P9gn-}0J3GPzk~h{L
z&#yS;<R_|I^Sbufd8TcC8a`7Vcdhi9ve)3ymD$->ez7y}_>{Z#%Rk4rY!6;r$n0x4
z{BV1L#@%e&_Pf9H9~o3IwjVSv{PC1kW*T3+G)LU#bS4*_t~nev6*bNBB?nyAKRWT^
z-j7PDAAd!AG(2ZMIe)hE%Zt9h_b&do?qP7ayzxpKheJe^&gG@y&mS;Hh}LzsB!tg7
z`jaESL3%^yrYi}b|NOCMoOAp3c_;Np^F<f_xOBc?i$F!)J%`n?;%gVw@4r_6!T#Xt
zF7Aiy`R?sp+qZ2mXM4t|aK`4%&35MBA9h#XSi1F&zv(-R-un+etuqR@s4Wz1&|#1J
zJzL`K{wWvt9e(j&{m4H~)Dgba@1{n9_6!Vnz7x|q&CCWZ7I<4*U4Pqc(u4p1L^`%?
zSI8CGG}p&$anGdEl$(!bZ+?m_o3mz3s>349L>?v?8<j$nU+=>E>zK~Ar&t@8?|-a6
z(bHzt?$xVbUk$x_`{2jd%lGr}U+z4iZCEq0V~^kRl^W&E>Ypo$^xFCtw}0Q({5NTz
z#^ueQtt$R}xcK<t<M#gjeD~&cKUlh=%f{nK>xr(PJaK$kg6H4eojvWSjzsS=-@8+i
zOt>!H+@tYY;oRp%eXqBiSY7@7U2bmfUZ3@sY-XeshIVSL=uXgSdS#>M%5?vgx8kP+
z`FmbXf7$t)JPl_rpQ*9>#l5}XGi&2aF5Ib%Vx6vZW|PB#<g+$ATC5#wEOR$0cs`C~
z48Qy*W=f{)b78?Vr<3M%Mv4ahKi_4sJKRUo$II5DU*E;xa9!(Fg&j8j>I~~dmQ8+M
z=qoN1xHR4J%NIMIS9az9;#k+J6ox%XV({;B4R~@>X@}0K{tugVW^FFsZ7%re!9Cl~
zxt<eKlMdaOIDMI~-O6sI%i`xYC9T=Fe5=OX*{%P=xW2B<I%e>sbA{IBGc^nMUGJ`(
zHJ`Ombk9@E*~h<DPV2kcvbSx1k=bI6OP3?&rDlefuRA|M>cQK0y=yEki*Gjh-!WO^
zf9QFe^Ro|sSzNK}#N$XS%O$g2<eDGsIPu76?VM=l1t)LT$QwL}xwdx2K8+9UFMqsE
z(!284LD~7zlwAw;SEzscdFbEH88tPLDqM$Lqf86KuKG?Adv$UC%Ug!Ahc})G_nz@E
z^MhH{@7J%JFaDd)|Ly;$M^``Jt!AtV$rm<c|0McTMReE0<*#lXsw`1??ql~g$t?So
zgvT#|v?ryJS6C-Z{M>Xx|I(%tnWd+u^PN$B9=Q3?w1o@zsBiKrc)mT6^W&z@=0dI=
zXBzkq9P#NknxXs5;oFWoF1_57!+3Q%yw<Jdntq<;eZp;_Ia$d9A*}mq)EcfOq+Vuf
z6=z-ZbBR)&!1dCZeY2w!7G!pv7MPuzaPm+nC;$2>yaiikIuvaFvDm@Ec=_7}68}ZR
zVlPbgmc141ZL5Du@=u&cf#=2kiWBKCS?{o=eg1NG{h}kGEPog|S=7=F$Y|)7Ty8j6
zai}&(nde)|=I`%p>x;j<`}*SM!^zK&7i<;b`nuPM=kWiRe}7#4P;2&r{o-GK!GxvX
zAHQpV@#Nu${^k6??AQJJnt#xK#nGkm412v7)XSv3p7&Sa=zq4ok_q4IUf$pB&cXF9
zSE@c}Ua0L!38mjj^E+8N7*AHR{P(-8ec)c)1@3lzhBONsp5I@5lqRM9yYbs2N_SP%
znJ15beAoP2%f9~9%gWL(-x9<>^p%7OtnO`6XZ*&_nGttI<95=FyNk{wvZ)#ReN;IY
z_{^uf?MVwuY25YCS>@@^dD1pXKJIxVU@vK&Iqk#sxs{Vst?&PN*dL$&cze*FwSu9s
zUELuueDbyINuO@F$JeK~eO+O?re_!bkL~-Wo~UJicV2PR$;RFV?u%E=l=3*>e*A~m
zloS@u6)p98S9)*MN~?K(OLX#;y?mefm$m=%ru_|DgbEk^HWCRx!PdrU9Nk(PQLXU9
z&GN(-?u)Bk%w#9j+~hr`Fk`{g^aIMS_7eXX{_tB~;e7C-Bs_R_isDp;PMxFnIy)W(
zsch+E44bU#*jLlq@}mEjZ_GjsX6*;6D&8wg&u(X%wr#<Rjr`3&iwilk9EEhc+HP=n
zBnjTz{L8t<j-ig1M_K$p*n;rFNi2sIO@gmkI~+c2ykMPW;dIX^KPdsf#<K@>GrT%i
z2E3lhVA$t9A%$s&h>_tV|D;P(L=*V0w0IqP`b1`?^}Us1n+>_jnR$OV&$_sX`Fw_|
z!W;ddpHrUX1WVM2iY#UId=>HQug8659ly=XtlXPq&vvhR_w{S+0dC**hxLjIIgNEM
z+Q&!qOGjR;-R8?Y`4Q7m-cR>+I*$b}VEFNU&51Yq9b2^{niqsMx}2Y_y>emX0Re^$
z(Gt=HzvUhXy4~VG_la%6ja)ff+gqu7`#X6=ohK~jUUX39;Y|09k6(y0PLkH)kybvP
z5s+okyx@Cf$?UrOM^z_2>^LD*U{&*EXQ$J;V(w0DSr(=*)e?L!&Yty|Qm9*HV7XT9
z3CF~hQAJuwPHz=i&U62mDRLm^vs+2tt-oHixi=U83jT0`zs|a1+O!il)HhUlHFnv4
z_z@xW<<RfGZoTbq-#*~@S`zc(OGK;f%88a27R@q^oO{mrVYGqY_QDu@3*EmPo=YDt
zE0DOq=(mBP-~|Z*m-AabD^#TH*!;*VvHtJrD~5ly{=V9?M|O{(al}N%(|2VPz8ESn
zzDS*9+Nof@aMJ6RFS4o&O<8^((`f88dgHi`Ct<Jh*9I0({#|R1u|0ewkP>W`wY9*>
zw?{2wo0@VBll4vS-##BaUVW2Z&Uc`2PS2$$SuL*)t(z2@88=_)!R7NCYCe4ID2P?u
zSLL=ea(k1_5#{G>J0~+auMyOLut4?esrM`9ul{*hd!OE=jBnp`d{5ukPAT7@Q$6!U
z=AMHF6<3yT`+K83-7iSx>Sa5n)yDb%!fqK0*)&8l%rRbaPFrcR@&~1ge95+ls`bkS
zubh-Gw|AaC{Y$Cq=KFWo-7NLZx}+c2zRKm&=KCKM*mfS>Gvn~4i`x&hWS`ozwQ07^
zUZv2YlrQ!*<t-)B&5mJSq95%e!xJC(uFqKSHf1XB;)Ukj>sNhwpY%R-BKOjDe$9M+
z3y#KKsPhWae0cwEnSQs{A$H~8yxx(rj4LWFr6w+U#}v8t?+LYKiPt~vEZguow9=Sk
z-BTUyngd7eR?M<{ymEQymDqQ$u3fvfv7~uvsq5yB*O9*t#qGb=mLfWl-E-3B>&F}B
zpWbmMbK8XNw!Z31+WB+l%1GY*+Pi6Kgmsnjvq&4kHL7PH?Qwj~sooN~FJ0>9><LYC
z)m<gyudQ`rm!7crSNtni5!dC-4rM3mW2^H0K6Wm)+;!s7n<MY`zS);o7j?|IQS9*Y
zat7U*y;5w2ie5YVlieGata(_zKJL$_*BSp`Jbf+R&Yth4AGg=G;`6JM4_|yZ>VMoU
zby;Q9?J1q!2hFC&E$CwS#;CE{{qg>H&2Iin4tyz*Tl}uaO!}7K3mF*}&x!3@|A>kt
zq;<SGWaK|1<#CP5$*|i~1y6j9t9ZA9x&7mPamH@~J{b|qGjtX+ww`wRCEk50N{i+8
zzU|q{0fG8T{O*|>7K8~1t~SvSy&LtTo^giT^66@^Nzxr#&Ru#VF?-3!=4+;mJQHWX
zTF?98+!6uNq}7bt>s0jhY)o~YY20euelza2nf;3*=F9orUl)80>zyIpcf-V>xYy;{
z!_@rKZVv13&u?Zu+2MG5L$-IA>jsCZA?B^Z!s*jLE;6c!$!lp(T(Lj-d#~Y1gSLbm
zMRuptS@&;Tb!_A^vYW%M-(P?4`=QOL?BBS0<{CG$X_l{f|IJdL!Jbp2Wp+t)lO1P!
z<-z>c<#q)P8cyG36Be;AWeqM4vOM|X^O+uxsAo?NuBDawJyVOCxyGidaOrHzg=|rC
zJ&x35iM<huR6E$}`C?yA*i#O3^}KemGU2^>$*zSHZZm)Jjbh}ko%V08SyvwW+ZTz_
zF&D3VUbZd0XMIDg?lqs;jNNjkpQC0gxkQRRef#U@ynC77LnEES(gRy>re2)F^jV>G
z+T85Zvl(3*MCwDHM`zi@^B>aKGT&@MwA-{->pt#NY6w2x5ZAI`)@NV&#3?y<KhAKe
z+bG>~O^)Tj-2|(gZJ%UPq-NGWIp}`%gvCD>ubP+UXBEopodbVL3;dPLVEs@my4-3a
z^9QY!(~`W-_`I@MeSF)Yt$gcyJZh{T`OcafwWRf)t=u8M8>vQ1LvESmgk6*IOTPW&
zZe)|;0j29NxMgSGX<&_Oi*>m(tGimZy#0u_)3(2B-X!`ysngzcC`T()a*AoZz1*W|
zLN&j?N&hiBuv|a+PJ&*=>eeMwSOq#6q!>5GO<A#$<;ev09=0In^*ZG%?*w)|cM$n(
z#QJ*f?Y^eRSEhZqed+%~#mA==Bm;wIG_INwus@?e+_HOTafd|8MH2~=H#!rRO<$2Z
zNA$(2qX%79JY=*8ILWX_Y6<Idtu!Xy!>dlPzhKBuThz*6I`QD~Jv&-vx;xIhmdM(%
zY^~-ktJywB_T)X(J}0j5O1auJ=E%);dxc{CIli?|Ij}DG)W5WfDldQEk1LtJR|k4c
z-@BxLvVE`1JP&W#?K(F)7p&R7#Yw^T>*w_se#<?my7hkdv$tlu!*`r)l$zC@P&8Gf
z@^)gopJdhAZ064olo#;5Q2w(0bHjb}#q7ITbUJf3Osh=$-t_K;)%q(>59NQqJd5qE
z$$QIy#JkgykEpI$l(KX2BbhTSw_4_?WoW4HwJ(_+Chuf8F(FFuQo>p}8N0>a%xder
zCr&FmeC*7DtOm`zyDV$eypN0O|BH+{>@jC&3>W8v4<3GUZ|jPsYPO2^IKPPM$YGw5
z;eYSXvn~BKCk<|k%2YO=G=JQY`sbvK+J<R6Hf&ICcAt{!sC;<hx~2?6mAmmlA6ECj
zoD=O_ee!=<sQBjvOy4F32OQrbwlqcIh4%VcoLaRK62Z5uCBCKel-rfnhJ~Amx*um>
zu~p~u3Hf4v)%{+&VQps_%l5oKo7nI@XIt~3rsoH)s@R3z$WzPSJL~whYuA1oJv*40
z%AnrLv($UxF4@c9#NIUu25$c8`+KI82v?DiR}j<2dhLdbW=fl+zeKUdu5C`)Di;->
zdmwksA&;dQreXODTW?5R&0bl+>U;F}#BD8IP3n?vl^5i=%ZiHljI1iEDk2n@&SU1j
z+;CxjkoshH{<iy%^vq{2+mq~{^C5MXeZ73;?h9u2wOxIexDVIe_PZrwx_U~jaXz0-
z!xO)0d8T`pezdOro3uaI<Ba-qWrtnK9tTu2B5w(uku={{za+6KY{Hbt$2){pZ1$GB
z{k^0iulVu0vi+xWS3i6--|mJ;!m0!Dwv8MSQG5Sx^L=yE?-oy|-}BFc?N&W0E1XZ4
z7nCa{O!vRi<kv7!>W*E(m8o&B!#)?VuglBZcPsbz0;!5^v-fm;-V(PVsB!Mel-Ey!
zOiNOZPP=>P4X4)K+MdfEYbNfn^Y4-F5i-m>SM|{FtHz4JmFzE{1-MQMOZcMW7CC3W
z=|{-|%Ox^rv&$L_LTwZ>quJ&g$TpQZ{o3cY{9(7&j47_6k`b5I^P3sp{jq9Sr^xdK
z3q^e`1zrB+iuymyJMh?Cx9@U{oxk}aA-Bob7Kl6Vm;dT7CpEX6?L^b@TZWw%A9jb=
zZ(M7#ynEe&uwL66+)n%Ct-fEaTRQXf3!8NbfgKl9JEH<`e$J83O}1cb+wWPDxFkgO
z&HIEqdV5^1J(7{I$&e5HkbP0&ti#dkJ1=B0*2wK@Dzv(k%*La8A<r`8V}#^W1F1q$
z=80vZi*tKKEUo?>-P*^%ZYb3$8oN$FcEz5g<cwpL3yvr(_Q=SVxU6Hhc*atdxqglv
zi3O4wxkitUvoCt$du#RkeX_N`c_U`AR?kyCvf}fpO(&;WbN>3t8T47<L`uT+i53TZ
z8V~Q#E6t8$ztSYSwm5Y9$ByG$j|W^;O8)1V*2b*6x#o_|De)b*d0zR<Vz4nx>~*v{
zzePOqbT!|zmaWl;*G68A6!ciK!^L@Z>-W^Iif5WB(Ou$m|C(*uel<J5EU_)$M=P7R
zxvoG`X+E<V>y^FYW?xHw$VNx7YVCR#w7~nK>bDK%g%egUj%H3<d#CudS-bwNVgu(_
z7cP3p*mnoM3oJMyS8ih2B-#4ZTb})a-JOFcxeC88yvVq364OZ~gTi%}m#Ku$tP+WJ
zEvVG-&~7)oIpLg`mPpsh0|NJS7S^VF7EhYWbasw_y!F<|EpOXHSG51WR$+SMCyV*x
zNlpJA@nqfmE47?G<+8|z)49!mcKCd|vZiY0j!7~;T2+4!O_vms@A1?T6xhVOKj%Z!
z(mM06c`s^N^M57se*CN$&lWW0Y0-ovR*&oD=JQ?Fh$v((+Igq!>QT*O>Dn$4kN!01
zIBbY^P<bVhCe~sxSy|xz2CJ&S(obHWm>&9kYLV>Djjq1$;@MWaUXOLXyzgni<cWqy
zlrGE+PYTz#HAiNm#9Plk({uMcxaJpg7`%uvdwt;DtgE`I)d~kE<`pGv)KI>=`{5+E
zP5*hT4>7Jx`M$Vq$xY?$oV#wevD_=P2o$khb8(Ky)`ke_PTOTA<>ieb5_1cL81v3r
zJ$?Rt&24}Fy1K9LJ`^Zu-YGsk&G$*ug_4dx;dgqgG#BkS5U{QL(c-k@EvCvF9nJ~|
zZQZ;gU(fD1lhuW_3yL%yvK3y>m_9iuF`sAor*+0#8Vf}l9?LkoZu^;){eFAs9owuQ
zEus?*&R*<h4f?XkV{%<Vub)}j?YFjn;%-WR`ThIBGv{~ahi#X&3ZCjK6Z$my%LA1|
z38i8yt7h;t=>}MyDL%dFK|{6igLBI+|5bJ4;#L(c`=HmJX<g~689QxZtNk~}t{{m+
zo;R*tIuvZa$E|YaG?UEZ{qL)ie4Qrqip<+)6DG5<sk+H1VySWQWdok|lCtJ)ysIP5
z*~bcB%d3lcW;t<6#6&OW6*3VPw~XV%rE1?Pe19W<ZH|)j|2xLNcAtMfH|;XN=GqO;
zT3sh6hZa7+Ilt(Npi)dw(@Tasy!(pYech%qHRq<>$J|@T`L_K#Bh9t2MlGaM+I8*b
z>}@(P48C3QVsO}*zWwg9)79^~|C<=4HfOF+p0KyB_`|QW7yljn`0>Ep4YtpxPe0{8
z=h;KWvV9L1{t?}~pLhCW@x1*ew+`=@UHm%XhjG#Fs^YNpB~{+bVy*Aq+u2{eY0Jju
zEo*{!4X^RtV-hWGkP=?y{9^8c(>A#W|H_8<dM&r~`(t{4-%ADeyFc#Lo{iP~F;V3I
z1)GZE&1J4v;%8**mzwMJ|CllH{(4`Zb1K_CE?k&#^pVI*y_?I<UAx0>=bkrh%O~rr
zw@!U1G!&k3CGzIaL>Vb>&X^eo&Mw@Qe@|=E17EHU*B6UzSRA8qT(s<g(BnT1b38ir
z4a}6boe7ow?9jDZ_{7NzMlTx{KeOUY5<O-bpzk31WJAEKY#-aXVyWCw!4Lh+wzkil
z^kli>dxqkgGkg2Bv(_sXC(J9l(roSa{@>RnYuv>Pk3AE*kfAwgN8jS4xNy@y3dx;j
zN2(rHlms4pJa3Jd*U=?MZu=fs(QezYWd7;CHcej#>Diul9yVrf>DTl6QEu*Wz9{1j
z%RK2vtmZb3QM!Bgcd+Kp<!e&c%AZ+Ry(YBWzQnp>lFC85)Y!Lg{(s`GxBT^T|F^T|
zm7%R|pZR6QS$7!j%ar85<tE7|b%T*zU;4U*z)_AFcPhIc9WeBhS$x8;ell->L1}hD
z*kkoqzgOB`_$kAjec|?zgN%lG<)4E*ioH@&zEA$Lr?2}K->RJ+$(_p+SY}ADw)?*n
zH<-^I6ZSl$x^dg`?jkooed`LfV`n{XE%%W!*?1*uk&&RozdLHF+}6=gZr`drrak4A
z*O8y@4hJVM)2sM?wP3Z+5e0iUF+Gm;s!u<kSdicoGi9@a{OjFs_&T@pzPu-E88z*L
z)I^nuqDPOX*-hHVCK0+b!kv4^WusG*uAOR%%eY{acVw$(Df^tK?X#y{x_;(gD(B-T
z4_D@hZH{mVe{nziqjrpX(W$>j)@KMftczuSH|@R~cVqR&d|lVAdgr-L<**f9)tR;U
zbgF|n`?(h%wiRo)_cb26Et1%_Zpn@#yu3SSF8n*aAXiCgs@OD>&t*-Ej(s{QYWZ;e
zgq^o<H2mB(DQ@C{HRts1mX=@AWbZIw5xG`eE;7aYz^w%aR?LRMPZgsV>#n&JFm3gQ
zeMKzu7u;C)=IGmyTT>VOnRT&iu0qhPn&z*q3zE-xwn??#31iNin&PzUdu9IA<lul8
zt9uz|@0O@pEpXxPv<sKN%Z9FgeK%z8CMWC3PS+ltT)R$>eSK{1m9H-srN7(uee1Nn
zg-V^%if*gwetDo?W<KHL>?zMzE}ZjCHt+SdypM@TDi^g1zr4JyWkq&jlxyRn3Y&{F
z_5W^NAyRpDip|CY0-tAbsU#ZAn)zDuoSEB$HE-7ay*=&5?>nZ87nhxMUG?1VR?c&l
z)hz;FUs;{K%d+5>_IYK|D`70%1;Ne-qc=I0OU;Z;D&AH0|HI*f2VW?82JtL^A|ArR
z^{UyH%a$kg&z{elPI{Hydt{Q~|3$;D@9Y8T%n<QQ;y#sgcC7Yxcydm)?dG@6iI+m3
zZ7C^?++@h7=k#;By6xG=b8A|rD2u-l{BCXZUu;(UOob_3@7`QtP5r1lU&&V?ZC1~j
zcejhUkDgPT{pju4g2kCfr8^zJxe9NY`7!9T0{6XjTgA9e=Po|8YVAF*2B9@(ECn<3
zF6O<PR&IX1*Y4=@+tvFMX6luMDdfJM7Q%CU(_hQ(*G6kKW=#K*cPp=KM^m7@(W1jW
zS6Z$%G9C#qzN0d6uT|-eXQ#INTO@sV*?aRQ+Y`RpR-VQQE7|l+CA?K%Oz2hRm5cD*
zBEddY@#EPGOHMel9+f=R?af`?@;^u<RjD9y+kwPV_GgVbF3smA7fyKbA;4_GwtK2P
zr#7tV7LzfuOKF@DDI&wYu<~`s)1Mw<QJ+@SdmaCllDGY_#gorkY)6jG40(KIveuWY
zfp1ODAJNEJc_r5IxK_wr^Dj^9x2>INy{dG3@CzHyInou%tEH~pGO>z(*cUQSW{==}
z8!5Ye|3ly3Quw^A{+De`eMQ#W0|&R)&+-;%zIx`LOx{CbU6Zd~Q75`i`-OZ{u<$>B
zZuj)?FK^Ze&in9g_oQ3X7j4&nCEw0y?Nz_iVZEDVSdWY!Ys90y3)R^;7Tr(Wv1(dl
z<h9Ee)SOeUUuSus7Q*pf;Kl*T8SbJJTf7S1ZEb6mdV4iSwR^_0&Tg(RLJ2=)pY?2f
z>EPwBaJEc%|IMk6r}`bY#_04nXeziZxO1;ccJ>{6A1>*eH%s?qUoeinC*a7u^ZfN(
z_r9_vQd8zETOEIMj+$<c+v9o`<*Z%jOJ)kiZCu9iEUxtFvuX*MJM+G6`xm|`b^X_W
zMQlr-?>~9FZss+eITpobUW#h6B?57~GnyrjvrUM55YK9PQGCsXzC5Yq**VwNva*~|
z)Stge!6Zqd@WwR8H+=!WW`(oOUsG<re?iGE!@L_oi<GDCI<s?@oI#=9e9hj^I&+sU
z@pIa~uWn7_nMc|x{0AOft@rtv{BEh`eQCQrzuqa<zY)D@)M^~Eaf1BHg80{RUhTV$
zv~^B><=o74*XijB$I0&#pTB!*>H2o<Tjv5^0lTRdKH+jK{nG?>?7lS5nJ#Lw&GAFf
zj((-u6+T%rUvqJNoYG}hwJrR^;TcUk-#^^``(X0A*kiJ<_B9!wZZ6{7^Vq&f{+-ya
z-A8l&yxe@I?dr^jpI$Cl{!iulA^SqRN7|<H%r|Ggdpv7j*shOrc7!Hz$0(b-8;gDI
z|Hd^{!(s1wZ5A_0bH)U=kh3@Dd$xLP*k7{Kw8Y@{q%CQYSLandxW@5L?Z@|e{#!YZ
zq!{j12&?Q;S$g{i3v0&YjsJaiYwcj>-ZTATOp}Ai!p9{)I+Y!EhAiH9?lj{@mSe`6
zH}qz87=8H0EM#^hwQ<@*FZ&yua^*61uf?z3Q(wO(`Xlpn#cjR{K1WTSoqV4#<IYu;
zNU^P-ci-GU|0K)LmcLC`H$Ld|y}i*mH+J?Ej%#8|S~p87=H;EJepB&#+Ukn+d={5>
z6;G@AF`@Y%k5xe3wQ}Eo|GwLWtm)t|l0LgY@BY~j@q(-=z7nn~+_83cAJ5HHT^gv`
ze%#)2#VxMaZld><SgmF5^*!5Wn)Rab(u(MP+&Z2SKC0yo_5bWO_x!kA!}b5q)<2as
ziGIP?v#jz~=y4tGx|0`sqv_A--AAwKwqE7QmGTNQIsA^f)9~hvdh;i_v(DKYxBl<j
z^7p0Vk}dg{x)lEwF?r`#+?wN>So88ou3v4o#|8Jgr6q=cy*qd5Ev#=k5d1ayz0P;D
z<FB7RTHpIsUxih2;&$N%=6CjqYjt@Z>)0+9v)^pPb1Ua?bVljg+kgIhTmJkRKCP(S
zN$^a4bK=#_mD0A8KkwjCyRYvY$$MCEYwyhW)8BQMy5vRpET6g}(BjoMcA+Kl-^w=b
z3VBmEaqE}N)i3_%Rb~nN+Uc70;px&<>GjXPNAYhLy|!cdW#{mRtFC_h-?3-k+!LXG
z5x$)&mC=$%;+@Xz=8aku$Gl9vtgwsMcbmDvOGz7vrKy6ee;3tv&gq|LRd9P##Zs$~
zPUcA$zIS)mg@x28`M3Q`;A-Ss<vBA**2^a|Q+@M^;>Rg}?8OcmOg+3$V&9s|NjG*B
zcd}fKV>+ynF0m*#igoUpHJ)pjgPlHyh_q){u3+$6wOE|}@v}2CeMAeJKm2($YwOE1
zmsEGQW_;AunIHPS@^9~a#hR+iA(2uQ-d?Io-s!(`78JaGdhp}L)fYcEZ(qEe{e0XW
ztA={M_&qfrzdbnn;>X*`=K0&-yeX@j*>A#ia8l&QPX|{okA8NPtDEhqlC<d*=@+>_
z?rQ)0R8ms&;gxQU<ranr&V9dT>0h26%-_ki=C#q>z`F;mn9J(dsNdB&lFc1${^@CU
zFH8I8+lA@#D*j)6$Upn!vxMBBJbR<YytIkQg)T?tuAA6#aAM}1uQ`?~m3-lH5*8CV
z`w|}ATmQD>Y+_7N>9JkQve(+(-7Ee}q+jl;@vQCNns%5xjWY=6IkvC+szI2y(Vsih
zVi$cWSn+A~r(<`o9XfTtWXr^LN$XFgzdHPF#ior5VjXO5gzoMB(xra?LPx|dSBca+
zn@`*nDzCg$w`0q^w%g}&zVVdYX<OFNI<GBJ?`HqW+kdADwfRN-TWPs@$<1I}Grc68
z^Xs+*9O9gnaPme_@5fb__g>lHS2A6WrDE0O-rm@oM=ysRYUa&YfArX`mHd8-*S~qR
zb>G}4)0sq0G&tXOOgxa%z9xz_P=1qfr(@y)4Fy^8^ZMW4i2oA2H~0IlM_1~y1b(P!
z*=q!QMXvMH-5FJ6_d<8m*V?kXY-)G7I?6jDLm$oQmpGAqexs<#rgu9<1D_v^+#|sq
z`E9z<d_y5c?Ib%dLG523Hy)Vs+=sn9`OM}*7gll6MQ_|^-`G)jYT<&)T-gkRxf2ik
zi(jkMHhD&uTC1%|$Gh*&-OprZTzDbW5IIecu`}*e!@mWRBI^{=<4*a%SQ2!=F!Stz
zcXd_YYs@RACwG2}>77?q;wzgxZTalGE1FKvjal!Q|5~c8npy0wX&;{ngVKxH_tf7R
ztXsSP<L;U1xi^*A51nEDT44HM+SF~cUX)DDN>$DEi@UcYaJ_a|p;rEs`$pP1#e4Qd
zwsEdLV_kONMBo38YHO81%ll74=S>}C)ndvnNk3(J!aB`v9ruw_E5sr`tX$n+&XxE2
zz0tSnpBgo$^KMn*dE)rC^^^dMlui1-W2^Srs#f|MZaVoSS%mk5TSU31@oe2S=9(KK
zuE#Byq7u~q<A!OZq4|rWVQH-M);XvP2d`QXoFH<4xr*C6CNZ_J^!CH`AI>SQaA-^4
z$eB4&Rm`%D%Ou4sc)5*&j|w~E@#UH}H=jSg>vsO$-dpzHrt{qAo41M2^{VeqInJ=0
zV7`=h2H`Ca=E#TMXxZGS<1p#)gO3M4E$j+n_iYoJ`NQ?*+V_8_`S(VbEc__=QEQU1
zgl+xTypozP@6P^f)bU$6DYs-h%btYt?&LFziYx!DfB7urh{N>_9dB+i<exWencAx(
zu6jiHQcF|B&F0CC2j@kyCn{(v-rm0B?zT$-6GieXmiA7u(*N3#WcBFw>NiG5_g>A=
zc`skSjrGt=mjad)mRk2qu`K7mfB*WkSa+4*5tYLpalSvdsAO>Z&UIeMo3-dctm=)K
z7GjfkD1PeO$mKWLTfgtisV5cJjOKCQ(CXfyYsnp2v-O(JS+VqGVY_PT7P=jpwfj|E
zwvgPGG)K`5v(9W@cIdxuxTuoSja%ENwPYW<bm7ULjU9jLIH%ozWN2vPV$0<te64@M
zlw83RS`W1=_h#+hzpRJ9ug2j(*r$j!u|GXyrX6)ut$ZHvOyiQmFO#@=Ity6*<kR?W
zKVp@V`p8n6vD9t0qIaK@N?7|Fj=#Cj3=3HeR;SM46?W6SI&r%2iZdUNM{Hcyn8vc8
z@`~`g&1pfOGQOOe8T%}-{Hc$a#<Rffk9@keYh3%F`27RR?aNza_lSRr;JhODvqql%
zc<G;sGfgk^&zD{FrF)iE$i$fKQ@{T|WO#K>xW{rORnE3qiXu-s3~wfB?o^q$U}}>>
zk=9Bj$rjf0a|Akamd{!k>}%JvROd&5`6L^|d6q8TJW@xDw=GmGJATV)v61yHR(UDc
zr!j&%+!_|&SSt2)#?zmQ@oPmc-*}h2$>8q(`~3grhOb=BE&a8=r~lRbzY5>9&Tfem
z>dD`EE_9-W>BdtJTISEUXL-x_`)&M+Ch0X_m)}Z$m(Kkw(u%R}K--c!F76vMJ{K)r
z;6K&B<NSeZt{Y7>PD)y}Pg$_PZPi)(1M@n({k|V%_FZu=e7@hCqH~I~k7b4hs+mq_
zUgX$NGwt|Zjct)<kE+aFR@1YpB>kYzsy>Oi*2_Q3vG^@7&g+pfke@%LNPo}T<d0U$
zGerzSkNEYLc(DGyeCK@G`wgAhx(^<IUbLot@|HO!D{}pGZOu*Fua!M(Fp|Dhb4prK
z>Yi)NsYCA+=T)vwm*Z~<IDPo@hCgB_AAhV;oaVykzV7b!q}?|~bPfy8y0E}KEH1=!
z*^jR(C44L|SWZ6Pt=+A#vvNjE7Egc07xi|Dxa;>auKDMrNnQ5jz3_EP)|dFxj(0M+
zCs-*yvMGw)u<H`X{CfvdKP(Y7(=^)oE9i9N{#<W%t7orw=)L4nytDSWQS>XDh5O#t
zaa}oi;=qJk?q!c3p1HP4d$)UZbe--q(-(IaJ)Sl7-G<f5EKW;geyrtqaZK*L<b#4m
zYvo-Ft{LuZS;HMsU31N`FFnyDe8+)RyClQkPUb3{x~Z`8!>boRt|vb*s(BEouxPW!
z3AN{&l^pLW?M(@(Kd<$s>Akg^=!yixn+7{>TdbTabNpE4)X$YXLEFo>a&G;z<k7?o
zRyBdbnM-GcCr_P}nCU&WvBpY3HmGB5mdea)9HPon)$S9ox5@dH8c$mm{Gq>oOMcI-
zFwuj?^)ZPGFMq6=5N3OAW?Y(JLjRhHAJVqj%q~jYVlh27{A|s<rR#Lx*v`Bd=3FSH
z9cj98rHu03j1yURuEYiY^!d~=*>vX@_jRu(sJ(Fuuxm~X)h|hsxHN}V<DG@0&SilW
zo>D!1^TVqQQs#=iJQ>RFJmc;=uU-$mZj-}*48EPa;r8g`<^3!bPl6Y1+U6UtvTUjL
za$VU6uDj#)H*hImwhePJY-6kZAF(q;AoTo;oa})3-1isERwO)i*Oa;1)t4hEs3mGU
zC0cJqgC)<66-8Cmhw|sG{UB4F@Z(O#vC5YH4+G7nyxsckK#<nQ;GjUwty`C`-VkET
z)VTCrTH)Q@_46aL{tG8BH!J=;?d>k#YagG#3*+$@yn1P&Q`nAOnY~%9xh9jk&SXSb
zeopI>ddSJsaQ$^bSZqRI<(ErcITj}mN#~m{IXqc)?c-$UwCo+cg;80uTg2ACIQ(ei
zv_B61T(bNYorTQT3PM;?&uL8(&^FU}`!)KJ)=8b?bE6Y87WPLvtrmE{e5uhpwjA%s
z3n7NlR~AfVvNdj(PUW^LQ}b6pWb`3}L)hoI{EiC+>>YmQm)uWigdGn(`c&uOj+H${
z-c#ncIK1sT->R{BZK`_qpAVOegV!XUnp=G7TZVM-Jfm!n!$H4Nil60Xo&A$zpTW2=
zul3WPoU3M)VQ-h85lY>7y^y)AH>fuIdEJM3T|brXMx?8KjcdC0p@LoF?aigNze4XX
zWOP3Lee3JyEqfPDd|sTn$Y{Ce2Dj%kILmYw{%&B`2^LA#edLrSnWA{IS?1#fkxIKw
zX*WyU#6Kx{b2E8}@H<_d&a`HQ&o91}R<iBA-(G0{?+Z?NxldPplF7ks#){^$x%W9X
zR&71@W#{H|54OyoWGeG`;UeLf<W@6-RTJi4NdC2D#<v?UEO)x<KWvh9D4oK(o;TLZ
za?|P7;J1IXvl-v0O_}v)>YK{`&;@p}yUn(+_glX4zWS^_bW6;>gIgD#mtL9mQh{ml
z-I6)WW3R8?I_d7RvmY6=7M9<Bqc(fBT=lQz%(B~}l5^&(H0ZMH`dF?nX{^65x8hgj
z?4Z{{9d&w)yIuxL8XHP;*V<)jcg@Lv#JYXLqWur+7fyLHb>DLRCsn^%9KOCynBVvD
z;n^xP?w4y)Q(`5)9+;d`GwIK47AARbb6(Zo?-{3xUo^EZ6#laR|Ah7}X+OEv1!RYr
zp9oZ2|I9+~`m*T`yVve0yy-iAwTH#I%m10!1s+5#sG42wwfx1l|CP#dd%d53w_`~*
zRXwr#?vvg1D>J7pUmB7V_)sk~GST5#2fOv7Eb+%C@wH*=qgR}lySmRx#n0@>v(`+H
z$bXMpH6QeDd}Dk|$@t-uY3$~Szvt{;R%86B#_a8iWd@TQw|n0aE}iw%;>q7<$K=Y@
zl_c)n&!{&saJew4)<u_rZLR0!Mh(FmO!L=sn~UmJo)dj#w%cSuMdXnWo0wL6zfQ>3
z*z$C<;l>%)e!k(^w0&;DQ&mOZ)l7M*^Vy!fpLjg}-9pdT-COtin!KH@=3cu~)YomD
z`-O^7u~Vi0L{IQL-O4NQJveVc?A?;nUlyk=?ep-}F4_A1*+iSQll@-q@wNZ<_z$zj
zDUmgcU$4HnX+h$|PnlNNUiDZuTz$z9@#1O3ydAIfyM0tYI2u*u32&Vl>btBp^2~}g
zD`iEuhKEetS$cD2SMCB&-N?C_uWfgSE0xRiMQL-~U#9Fn-N^a1&+)b8vd0e3vkANY
zQz+p^g-!9v$ZflBZJlTPI5yJg0CQ1=#q-o>u68CJ-V()6vV^C`PP_4Mg3-U$w!XhV
zmpt4pt$tebmQuKh-c13=Pt(3AIZrJ;{ZMzw)X9rCe~GAEE53#0uk6ul_oWmM-_e;|
zYEo5R^C7L|$CKsFhcCW1XFnhJ$4F|WM@>+MX7g!_x?9pyv(Bqeny7L^{PD}EOVSm`
zIXRZ!^?EQp$K-tXDlgUW%Y9E7chA}Kc<19c7wQgrsd1ff^l;R!pIfZpGP!&8&KXy<
zS`|JiO;>uf_RSo7`=2vE7u}P2FTZ!=rRr@>S65nU2_Nsy{XFH3vU%Fp!~Rao3vVwx
zAa!Ni!|eBhYZ^B!tBv1w{;W_$TuZK!>-G6d(og%&Jo;6Yb@|D8Hwy0VIy9B5cAG!D
z!Zr2IyIv{_OXO~~sNVVJ-`4N9c+=#W4f5T}euw|_dW)COJ|p?X;c8fgsI=w3tvq|G
zUf+6oG5qS;uyEOoQmLye3NnurxwqZWxzDsw#;N@Ot@vxcc7AV?lK*+REC1Pdr<Cc9
zADhw94-qpJLT8nFi9YDo{AsEE(s-|k%$d;F1{&GVAAP$cGC$X1=YjL*(v12Xr@Gl?
z&M!={Hk)_ssj8gz`Pr#ff7W0A)ll(HXWh@1pEp(-+8&<K)uOP~f7=JaOJyJASaJ$?
zuCl$OzvtJx+Y7#beO%b}HSu%K#mrBW4t~-2+O^I{Ed8{#VYk}nG?U)+%xwyrTG_0=
zt@CbN&G}(+Z$P@Y`zq_8g3Ou(k>aqP$2vE{?|x*udyO%8PoPg#!|kS9t2Z9=kzSs~
zU1VH(Y~|iFx2w1O-lfBEEG76r@;5f=)eAT6E=s()dez=p6|#{Gj|xLmc#jpYp8H2n
z@owRoS68N<H@>94<LJc1Cc!(*C(kWT`z;cB`i4aCn$%Y>F0B$>@1GSldHR74&kYAR
zsq(Ds<>@-jctYvMzr*JDZS#V^yCs|Zi8(bS9?w{RzLWLIYQKLWEpL7;X<jw6O8;<8
z_mSD>*UmS}2s^vp(jp_TOyKtH^CE|xp3h$KucT#SmWtC_HUFyOFKsdRT~c1{WK6wM
zsTa6^(o>~kr_1Frs=4o47)w}=$~@yd^PWTQ-^(AG@}3;uB5fY4U#N`{y{Lb2eXhpy
zQrq=q<z;&M`pP#$LZ+l!U;dGAy}~cdT4bt3da0qmdT2@9`AxZbzYJuzbD3;O2#(>{
zw9xSVw1u?>Y)mO^#%}BkC)mpBPyRWuWP+r|QVZd5-3kUq)6aXn^b3*&jQRDv{dOL{
z946lAagJquwVj>*RQA;Y+PVo2yU$#2lkyhox6psy(4FaAm{W0X-iC?Ze&57Q?zy?I
z-oNR?-{Tg)`U}5kRNYv(RCLL<u4xR<P9A<J@BjXE{jRCIuguPyw(3lXQ?vAhy-A{n
zn&)ifn*3XAUqG3I)ynIkejST4I%l=4yr~s<N+_%|&hysYlc`Bfm15W5G)+{$*VFrA
z=Jd?KWnT~74hnU)e#Eu&tEWW!wnLxdT28!-j6e9G%X?m7kwd{HF4?0$q<!w>U)g=X
zLahF=Y+`uR8P~@4&zsDpG?mvbe&87<%6xCi^zVk-7~On+cd<w=dv7i}BfXK?@6YUI
zGw*ZA_MT(zUCs3PtL6KogX)u3P1w)*RzGq=iE{E3VN=aH7A{Lm4_oK)8qABabXh*Z
zZt{uqn#WA!ulr6CYfng8z4+Fz-Ba>R!>Xo><QXx|>i1Et=3ksC^Xi&P!(<kLHJPto
z{g~U%exbfPj$bt~GpehX`Hbzn0^Rvvvlm_6=^A{}>DxlBIeGak@vG<N^6^Z&ak}}g
zf>VhR^Ta#Wa}}BSG^!@~{eI}eKC>t`$l&nK49D3)f*qMv*QUhq&Ix5QVk~HyImPQ^
zc&UnMaX<jG(DnG6R)@=ZElVtBG+UI<`&)eXXxTJZ!=z{>*}8JRC%;0^u-^?{D_FlJ
z;8>HH-@`uZm0f{09|Rw|ZGLGkdF$`=yM2$sj?3<13wWsc;XB{WO*efGKKE?VSsh}S
zH9242?#N=TLno7eF7>-zn59q`&+@x}|L#qHinW;MSIEwN9X|1`g{euK<XmnM;g$>6
z8aL|lX+M8fqRSWcdTI27MyJK)4m-k5Ct5l<{7tmop)B|zg<CA?#MC7c&f=GhbuNE?
zuAa{~Z`+KXDKpMhHbf<=Zl5x1R^z*i4Lz6liBGUHyl5F(Zu=z4ahlRKyPEL5CAZ2~
zCLi^<Z&&#{>3^`>tykxt%dF}?vb*m~w{O~Xr_^b?*9*5i*KbG*WnwB_Gp}m*exv)s
zy+;IjPtD-{aoDhWTD0dBj^4Aqc3rOh%*wl_%EbEe+s}BjPdvso)%5(OUE+(TNnLW(
zD@lAG`2Weo)5>!;CN?&2$>+0UEtuFO@=f==ddIe?30JpY>T<U9s`h$(?%;a+<YUZj
zPYMK0x2)H`-SwzPXHMerw5;#4{D(b`YahEUwj{!l{od=v%D)Q3-}rLrOubw*t18>+
zhauYn#>0G<-b^=J!T0cO<Du<FP6=mZKds3)zHqsmEQ^Cx^{kE!0<v;v^(wlfh4i2P
z+L9@LokL^s1~#`D0t>Er=Qpj){?yKMHL*Q}@yEpDg&XAZFRyOjwQ<s{TNjtT(BgGF
z9G+Muw4n9a+Xp+1k_BI1655jLS7E>9M)>Rxak6_^Mg3<VO6hO<5gr>5_I!tqT~fe_
zB)7(9U4=FOCZ6vKwld(K@a<Wp@m!vX3~QEOJ8AW5&(}3wdvus~i$0uxZ_E9e4<^5S
z={2wUb6f0#$Y8z=cMlk8bMAj0r?=$qoAnPnRoR|YONwi64n4=37JcfEP}~+HPLcUf
zPLv(t4S&60x`{^cwgY?4ToqmVT}C$dW~;{*|M_K>-XFKCxt2;rZ`<=N=>8IciU7X;
zzLVXFyE99biw+r9ww;aPZF^L2kj@}dwm<vc4{na$+-H~gE;G#CvUy*$mF{wlC^!G(
z;zvt=PP^^ergh)Ma@P9dO!Mk?{q1Tuv;DJX`^0=cbcB75^Ua;yE?Gw<c&7{6GC6<U
zr++wHg6G)5a<{z7FH3JZ^5=^*HMkc2JGJ}p_0O{#C2yM^+@W|}c&Ts9`m7y$bu;Qs
z%-`84imR>@lll88x8uJ_D%0jo4~v?Nj5(&S<yq4B^6$6Vg}c(MbAC>1(NSmEv`R4R
zTq?tvJvx)plvd~+*nXd9;Y7wX&X6y6uJ?aD#5G}!#mNnaClr4;`Qy2>jKAExM`35m
zr%jh!tiNS8x3Jig895Ihlvfr$5tG|+?~~!<vL-=8-R%-Ff%D#<-f<+!>5Wphv6=Og
z%jc4o=86}+SRVZJkBXW2=^(MJw++*bN-i1C_g72M_2c?-{rnTTuOUlWHa==@YBl0)
zZ~t<&?yrXX|J9*(D_42`U0HG0z)GUwoO}7?zb)tNf@TYDah<o|c;oqvY4*2G_BqtC
zzna)t{v=w=f|Ic_Mr3x9$ByFVvZc~9O15dd`?^A)bzWHIhF@6>JEU(!=ACk0u|_J?
zo1JrQt=df&*M|1PJhA^i#fE=8d#kbM)0$$pZkrWy-?^{UIx$WUIC6*exlOh72H}=<
zd@tgP#dcTk*zPiK>b4Dz2hDazX}+$QoAv+NqInkSEua6`>uxzP@2I8Nm5mxs*Y!@_
zistnZI<1~wx~3uX-&DP+oM$6%URj}fB#Y5U<m;as>#WlpgI-VlVt9_l==8E&p{kls
zE$KJ=)>f?Ii94sAlGYgMaVBKr?K8g0Gw1q9P55fJ-(tbRhmTa$f@^)AFYzl7+F`eB
z;~^uhjv(%ayWuf@o4)kdElOUYp_Rog`Q*;s%0_kfIe+=LU1YO!`dwMv)Uu_pDz7yp
z_IiTAA6K0d-xSZAUens(*M4ko(oWu`a?W;*TNv&v7yg|2{lUW470G*zy(cc-HG^F#
zHz8typT)YY2lwx8Qug>UrKEMKS7b|YTm1QgEsoQ>GSVv6u6p-1`o^}e9{2d(-kP4$
zXxYa-KhUgw>3Y}I-#t>F9Qd;=e&r{rIlI{X*mqq!>d+K-_mi%)nat6X{I2Zj@z)qx
z76krgY-LeRx#iWkU3iJ#DRqa1TS}+j+uHIYwDR)uS4Xz?sN8Lmj@FUbnBv$v+va1+
zB((_Jd9U`a;5fNy*{|-{FB-G^+J(XwR|YN(-@8vR=wFAH`_4lq7yQH4O?$P^@k8p@
zb=yN$9J=*}HB2kWNONnL^Q3l(<kPF)oRVInr(ko*E%B!1<|DVf3$GR4y=SxWi&%i#
z8GYuriz5<xHNUY2h98-FVC%)}#zqt7DSfVr4`qAbA@M@SX-b>G`?4FK-)g$Pn-=+Q
z)xBNf(>@(|T>9(5?6YATmh3lIzwj_v>;B|O?VZ~CbL#XMlOH>Zaz)E6eY}Fdta4*U
z&>3-C?RQ5buf(VA+!D^-b7l2yy?E0PY`Y(rN7`t0ub4YK&nT%`dbi$OVcRRIit}Am
z^kywrWpG+%p(K8C*9*V?@(X5;_g_VsW!YD|zcYSs6U@6YaAUEL)1BhmXCfx2OW5|L
ziZ6&>arh`>>n}g4fP+i#b7;?dacI+Fk&@<34rfie&-V!Z)DF*ku-4Z|n0sAL(%WzR
z^B*eRt1tWU<mblwvzKU@UYs4acA3{P$2;{#?B_Q2UzL7W{6}r}(w|M<Rwb{~8w&r4
zPGG&8d)?*Rl(pOa6FQ6MS}uG(;cL(#wr9lx5qsMuZ>{=RH*s}x+nWa0A56<!jE<}k
z>aKXXXmO+Wwwtpz{8jpXS8f4kdE>pdhm3!>Zj&{g!d|_tH%&4>?E3}{)$>Qr{nOw7
zVfy0v|FZAbOb*}4!q>;>aqafB+9NG*cA1o|xcW_O>lJ>%V&9syk5#ApMeV$Qs>~I8
z)HvgmTDn-{Vg3}OO|SSkCJBV?Y>W(1ej!(VomJoLD9>GYze9)rUYvZ`dELZ~`5r|k
z2mTv~pZ)f0uiO7GE4r3DZTHQt>R)(~J9A&SX|m)(`Mq@?Z=L$~+G=iXwd)+^w%pZ!
zg=J!nFW{_Z^R0TkVEyU7AHp;C?0U8>XUiqm-(5x5?&<%~y>al}`zuHLGOyomy+6l1
z^Gw=)HF5RbhmY?ty|PX!Z_&|ntG6vm-?8$k`|j1ky|NNHZ|=AS-*&kn!F4HbqUmSf
zvZ+_YuUjr|D2O@nL2_52ka<s!#0Qz&{SWIWN1l@t(C)u(`hJ<4(t_k0+g@K3V_7^W
z>$s42`i6FE-_Umpg!yBuUp`5`a3+vt(~3?Fwv$HHb8j)%xJ`Am5TDn$@Q=Bn5$~->
z8E+k5^R?SNzuWvh%(A^ItX)px#^19su0>g2vu8)Bwngafe!?xGdT_4h&+ozirf2;t
zyKddJfAJUTl6AqqYx{R|eU+-cb2?{QM$13O2kE8pR%VB$2Yf0$9N+e9S4p|{+Pl~O
z20Zz!Hb+o3>a7W%_B@t8;U~Oux4f5z=8Cs3-+n>GZ0b_Wn;z;(v(kcIM=ZM9wX!Gw
z%Em`p2g6^Tvfq||%-iP(kC~F1?eviF1y{DR_N1}0amKJQO_=Nzz4%wm{HJEEQUa>;
zH!adzVPK+KF>$hD#XNHf56_hzC4T3!znplm^qfWL&zRlo)2tuFZ(01+^4QA03lnyB
zM}FH`)i!(m;^-wi7-v5SFJS*;<7aO+M=wopollJQON%QGo6bp!FKnHgT5a63qR(!#
zjQ^`I?iGs<FW$hxcPB&Os<-3s$f+NX=qCCZS1p*kVfQ|n-t9hTZe>aRIDSrNQBe4d
z@Si6iN8f)O6O*?n;gGV7U%@p_yTw-+WV@{&Y}$AJ`*-$DCAPoJQa<eWd&;-uaI(hL
z<zgODVKG|*vnIdTdLTi;&-Cc;Ia2#gYvzkPH`Ik)*?OYAv`}-?T1L%zx(m+apOpF=
zJ(<be@&Bd=JsC_9;;e_VnP0c`GYiRtTa_-%jV_$6zfnYWp2D&k<`#}B#dQbE7_UZ#
zREOA9{<ycZ>Go0G__eL_3{B|^j)eSPziP3=vdn-5hh+BNH=SGTq8pp?QJ~z_)pE^w
z&26Wci+=3;dgGq<{jjF;H(|$XGY;_IVwk6^-{$dh`Mz~kMk_xq&IpriN!<Rq-=J>K
z?!X84tD>2N&#LSw`P6>*vfq<rasHbJ%)edhJ7Kz~T>133V#knBpNO?z8bd=5{^m5~
zJN~S8$%O!p=~k(l4-(8Ib2sqKi<zR9eQ8Q)=pA<d6BAuc(y|{WGV$wfy>_C)Uun7V
z5)<VJ`<Srn8i8{dEYv?0Omf#e_sB@GT;;-_TmNp_nU=(Fau<2MNjPrmyMrfMr*7k0
z!2ezAdaF@eN><1fr4wc+4}Q;+(ee@szqIoD5|6}}n>J|$@9uhZ*Y)&Ul?CAwB4hbe
zGxff-F1i1?Q}svw3-PvdM`|oPS0vB4G}EB5|I+Gj6H|rb!c|+Af7#N<KV{(>u^kT!
zq^=j5P03+!^A{=Z)JqYXSG4eiM=R${&h(e8_qQ?>&XFuEKO=Ir{LKUDHqpTDtmww%
ze3|pk->0tIcC69lHD{4?l1<IWSNd^Ydw%b^H&Z6s_m;`dH1UkmWrtQxj?{LpuUOLj
z_WaV&4eYv_OE-qM?Uj%JpBdLBzv%bg$^U<Tcv!OffB*lRuO5e1{JzLvQuz9dyu6*u
z-`{`N@?UM%t$bhjT8@$F@4xo7FY505u5sluuq)BIrNn$pbKP{O-(Pd>j%Hok$h~IQ
zyv;Ax=*+6*_n))ii^hu;f4&?3>)xBe{&9U~sJP&YSmnUEVkVb%9Y68nT5kPOE$cT+
zqhET;`#HW6?U1`=@apsjmMbZb4b$XTxr9CUu)JsK&$O6-A|Lmf<U>&kZVy~uY3y!E
zPMg!Fld$=V)>i*125i@>o04xw$L8cb+H|u;^ipQzu2;o6%v+rz9cG_f`s9&niSbFJ
znRh(hKc>#yaVTEQCR6B!d+?oeHAmB`vtP|E*=`xqaJY2EZjEAzo$YT`oVg$VYx)uA
z++Qcz^hBz!<dH?|C4=_JwLTGSi|(~Y`@S|>d^l2e&b8F_teNR=PaRIod%W6U`S#zn
zOb<W2T)mv#es8s0*<R-5+KaXsuGjdx`-X8lN8)$K{GcR{vb|dB7sB_}e&cy3Gxc~)
z&|39A>7(VxScBFmg$K!Ye`cM_skQdX2`-M1+YH9H7BDVLTU9K(_oIC0>nk4vMJ^`1
zTwnL3XYrgZYA5XW+?n%b@uj}<+bsUFo9|~XeZDO}c}<RC{D#vl2iDic{k%2RZ9!cW
z<L+mLAtK9eP29ov$>&|U<&8J{n)@?dcQ7Aa-+IIU&Tq7902-569xJgjFbMK75WEHe
zbP8v3Y7ywV&86YFpo2I6t&1-#;5y-!da&@@(qmyd1)FtWobJ*)940Z(A#lpsX-ce<
zx)$^PeQ*8h>L#HpcfTku=r2Dn+h5MFFaF{7@9_F__X|!fN&I}f#q)IVxi4Jnik-ga
z?Bfx?$GRpoE^FWI=m<T%>BWCOGrjx9bI)k8ipraLoKw>?c&1G}^Eqg(QOBY!8(Px>
zS!_;E-R7_)WLm_!B_H>kO!?IKbe5#a>ePfHw~Mx{s}CssiAw!BYvDsF4ZWQSQbCgn
z1KTp*R`RYfdh4~hEcNu9)3O50<twHiimmwm@vrZee^1l?{`z+Jyf*)b)rWWvPdHh<
zD&<sp?t=V}Z(=q@&s-Jkx^C(kzgsKreOc6)CB5Ng_}Y`Z1S@<b!rY4*Up`rp(BN=J
zH=xn-D&rC_=dfq0G7<^vbS87AwM9&qJFM`SU*_{P1LwPapYI;nYR6=7O7gwLvUrYw
z%&9kfZtnHEARQ%`ZQ9R$S|*_DxS!VcR!)Ycyz?f%U|Ox5%%`V3e<t%OwtbFA=Syrg
zuzh2BH~ilUg<}evLaYwoPi3CIA~Hh0^7#A0-6tMiZSSwxTanMR;lqpcJ^L8=?!3FW
zt+-cGWlP^mTg5*Yc6_yY6(qY-CiLh1P+wP<_h-2B|BEg!OV)YzSg+==@78;H7r)Kt
zI&+@&;idS4Y0_7kT7N%0UmyEpZHoD%7_&*I{Wj&Ooc1fa>aotMGgIZ*{i^s|3xvhQ
zcPDPy81$&Kpk8TR(XNE|B?oWaVEXWUx71Ijb-lYktm~cDUGOpX!WF(>S}|9XZodsx
z6zbS`<W8z;?r%|}#HcCj`pc#?J@{n2th(wv=b8UMVp;AhA2~hqdDiqy_7_<pM^(gB
zeT<b(OQv{jUe#l@d|i&nI<Ds$dWz3OIOQ&@@#`^9486EeVD;n8k1v{Ejl8>Dz5eXw
z5aTo*F@s~@bA))zzHaW^e)P(&N3Z+ti=EjLdnPO{^{BARckTamx(DqXem$CWTVs}#
z+9k;|@rSHcXP2$*{vkDa>QP_c-RCpgrkq%j`SXNG<|+9ZoSu_>K0ZoMUu`GzGRb6#
zfSHxRUGXmp#<vyUIegTfdcUspV1Dz$3!y(w{OvsV$xyb!j%~M9_{GBb%!!TV{!ukA
z^|@B+Dm`-W3eNrhy|m=szgrVrxOHPsu`xunJ&)L~t9n)O#c!=Z(Zi7ju5pHce&7BY
zE_<oA`1xM%FQ!~q++FK)y53$sF5MukDl`A>t3}^?RMz|}EK{mmGizy`_%AsPmHHP|
zK}t*SZPpb1VbpWVfT3^w(^o%U*4+C3WY@0sYHZ(M1kN#dHJx|%p+G_RPbWVnI<`4k
zo#dJ$7-95MpeX6%RF8ev_}<-g5_MUvEO$k+OsaV8ehH7co_U7G8OG0+G_Lwxu<e4*
znHY=U^suFAX4kBFtyFee-@CGY#g*fW%F6m@Z7q!BE31r}8ne~1?E8$>jm^(~^?&`P
zwYj=iRb**XiD=v6^IU%xXCD9mP42SAd(Bflol``fZZBDFzyG8Eg{Vh=$~3InoDL~k
zf3yGLyy`?mP1m`kiFP6@vsPd3$g-#rSN{I$AG?o<?NOPtu4m8kJ;{3~^4##a@a1c1
zJ>^0k_ODF@3xZFFJxH5pEc;z!_O*W}`hyQnG&|L)=8<Jl>z+5Q$0KLT3iCJnlFx^6
zZq9wfx%MclxTpI%fA;4U&FcIWQpaU{9u+K|xOtiL2jR2>YR_h0<xbI^<M3?zzvSMU
zoPCb`eUGvhKmW1b{{^4Wu8+5Lm#uv;`BBlW);`DFxHa20&oqDcKe^(4JnG3OwF~~`
zKWAlNm>|Hwpi1Cu<J6p_qS9i$g371i5A$xD3H*D%{J|{7E#c7_K|B&X6%o&>as$@$
zZpeB2AcaXc&@6hEh=<n3=r4`mq^dX7E>ZFBx}3sn_U1Ut5y6v>KknZBzHhnmr^`P#
zZ(qFAW5=eNl4(UxUDS3+PQE-xHQUarbKaM}6Cuy7mBX^#|NWRd$HubK>d^V?Pkb!(
zHf9v%&Jd3JS~c^cw9xU$hg^pr&*<R2CX?uuDejW9{`-rIi!U!NZBtEbO1UMl{aK3I
z^koMo<hI-qoIBAazesWCM!{`gs-~`66VQ1%>Q<H0`}=qF#IsyysEU7`qC0KpMb7Qj
ziifplT=Wt(J@9<hjPCC>QFALa8m>n?_scobp5T7w%&D-Xz%38Mv^A$~{j&4i&Mw{4
zKjMz$f4deYwEpl1)%yq6^~AV{@1J-6(aY|eU!LAv{rs`q!Ql5#UPVc)HRJHxTYb%^
z)Ma|>giPHpd*x#o)XVqA=}$a!>(ueBGyg`X@t<n$e-&_rQQ?r#(V31BDo0L!ep%u%
ztyOvDvxtlL&hE6|e5=l`)==eh_jTu_nL>Uw4m<}NMYvR()^blzHa^s%5TDFDPvQ8*
zlZ9J)s~lTBPPPQhRM{f4+=h8IOUco~`$aQ(PrQi!<fR>_^o?KPz#_*j)1^(kZwTtn
zd|D{m%K39gze7Af6T7Kkm(B~LbK$f2IOBwPOLC5$p6K;+Q^eHw*EU<8bPeK5Z9KZB
zCOxch-lr*XwYQiLC}}V0&Yz(<lbM0rs_O8PCE>9%awqnG;gp?x^lE{A(T@ws9WpQW
zmmfbFYklHzLr4C^8DIVh&$rtl-zTy6WaX&<|4Hmy3V&2Qzvgjg|LSkS>mS|bPtUKP
z)9aaN+3C!6#Juh40_MV5Dg{QbxHWQ2{~5FMt^OWyTBZ5l1gm|26wYdudPp?A4f;@W
z-tNp%kAlNz^!!>kHnuwN&-BUAmTeT|E<CZ#@YAjo$;sRc?}$3RvXnkiEqJ!Il>5rT
z)oq7w9lO9`nEQH5zmUj%vFY9uS?BsczWj4e)!Y&<X}+By$*VLS7&D$c{H#0OV$*z;
zeOvtN5-u@$eR!{7e!zUwiH|9^pS~$(+}q(<c_*Rp&V?(_xnfS#?)vdqi939!-QJKA
zgLf`cQ_pg{oe+Ecrnlg=o$g$X9kTbQ>CNq5l7Ffzpi?Kv??ub6%kK_EicapB<JA&w
zF=Ymm>V<V*c}+C-wI1D9P<8Xg1B(Vnh6n3~(lXf{dHSuzuJ=FOaV<buVD6lqr70GZ
z|1F(AT~y_}g7@65MiDRX2E6B}(0L;LbnB(naqT%fwuZIkzEi*bf0pOe_J4^=f6Zln
z>d5Z9z1@1EiK~pvz55&19$jk1d34F)S-a}OzL~xGX+CpO@|`b{feB~gl}?+*%wHV&
zV=v$S*lj$vx-GM|Y_XsH_tUHAKW)}1q`Y1FdGqJU8PAX1nJ2%cvbWUX+~QAH+cjJt
zPx$1re2+i(^xl0ROYcbJzG;z~=RK|9)`}H-q`CgwTl~-Kzs}abhWwMFoqA6+E;;+@
z;)!=Tvgdcth->cr)4TlAK1R>()cY5_e_wt2bo#y3KW?A@*Y>i{uSZ*wKgmGi&a$Lh
zhwXN<CWk{OzB=O_^R9@8ea89E>#d%iW2-J)@pgevQT^QQf>(mOaw{yP7fgGf<bTNT
zfR=~2tKQE=ruI49vP`jCzB)_Tm^JS53cvY$^X^%k6VF_5o-Vv^{hJ(jxhpsFZcbg3
z9Gx=rhS^JQ8{S#UMYDD=?LEu4UG8nkLmS>N!M~Qhxipd8dt1wcUI*<hPjoFeZ2l9r
zJ6DyJp-Q6Ag)t|u`gSXSPvP(E#k*EUiC^8YivNAZBdgfJsTSYMUH@&V4ti^QKXFm!
zbK_rzBJwA%taAAN@1*mxT#m`lN<GXpycPbbylK4uC~MKwcagcN>OU8VK0g#P#k+ag
zm5nQ&s;ysn=W6-XaE2{`rvlmJudv5nOB4`^H;yb=zx{q-i`(SK+5Qm=5137TFt6;T
z!IPNVOzZ!0U&*~Ma`D~4d;3ejE>PxpG^yr|xy+QN4;Oc<x32#@+lH^UWVdT3>%W6r
z+`pwPm8;?Si*`m<ho?|1GaCa#HXj3nCZU=lw>Y^dv!En3Pp_bIZFnH4NnUq-{exNT
zksWJOkH$Sac$n*W^yX!r6LuWfr67>;GRJVD$J8Z{I9&h#ey4G2+MF$S4}VFBc=GYx
zkB__GuTU;4F8%fWNz4)jUY~PD6T;T8zR;`={%F#E^7RiDi=^UE)2N)H({c0veBq9M
zcEHQPYZH&$!hq1u*E3k-*bYXmo}_wm*S4)~Dv68MOxf1sy;5hplczAt`nbKjF1-p&
zNsvfiS|K!P?bI~2=Tb(~R`J~6dL!nr$x`p^jXytT=z2}g3XGKT361Pz+R}M3RN#li
zsUxD>E5B#W_Bz4)xJ|b<s!*o<=ZaNlpBCK7T`jQsZj1SwXZm+vTW6H9-R(N}C}zzx
zU)HyKX2)DzbmCF%x!v`5CskS-oL8)^=%0ODcI{20xVk-2DxbG^|J=Q~+kQFY;pN<1
zp8_*fW#8R9nPhKb@V73;cEkAvOr0(stZ#VycW+c{IOH(<wBRR)1)OsqdPPhV^I)?r
zQ;#$YJ-qFJ7H>tI<Yvp`%qI^zRNrBnnH)50;f8y$)6dP2bnP~8*rUm{?AjKQjazn}
z>Uqq(J*+!4w^3$otIM^38@GBS`>N_q7G<ZDa6Vc0gx{g>lw;1au<sM1%x*nXIvcxZ
z%Y$PJ(pQ#rzV9uczEUG^`yRo5i`eitUw$cPC`oOY!pHy9EG;^*IA%9@uf(S<XII`<
zoc(iyqd>yHoYj?6@62{Nv1NtfZo%u)#;#m*xRdjHua*nW{&TJVdx^j#@sq~MCH2+U
zr4(425-TmG&0Y8}c`LLVIq&Q{^y6O3#KWT9BI!L(Z~fZoDe?9?Z}O((9$`PV?`chc
zuE&@^oYA>^?$>!*@sY1{Cn|59w)dn$f%}EkKfb%n3S^g0dm<)O!nsN1;~Bq@+|{@G
zctl<so^F}8r$y7*<Jg)byJp#~HeuI3_x|#d#p<#OyuT8^<v7-q?%lC#-yHqCykj~x
zlaGAxTpG%COyK>+ls7kSEpxh>ILAVZXY#`Z&6dJyPpz7D?i{sEk`Hj5u&~X0$;u$t
zS;ab244aL7KXP0T+3`d&a$2D8501Vghm>LqHy56d51*?i9cj{GtbX?1Gv2<3F3|xg
zi#8N&J+a|X{oPFMS35T@d#)ecCl|d`e#4v%elizNTF+x%&wcs<XPrx&aq#-<H-dcb
zsLydO`Np*9dAj)fHj~2F^Cuit6#6V(a_jcWy))A%=d*p>>-4BX>p|z%1xFRFzpY+u
zJ2j_|Bh^#!iSs7CAIB<`7T)lSym9&Zho@O3Ulj9pZ(0#m{&1gMP-|Di<QM!~C9Gw)
z&-vB8@rRIbzkFrj;f(9aZm&NWFBK4v$;;Z;sNZ@1;?6@^+8aF=|2jKIRIK_D`=S>U
zE*w&rsWV-(=T6d^kj%yZ7<WEYJg{Z<jBu5IGfp3g(Y+t1e{YUj`1I+|PoBML-+eQE
z`zvn=*+=)U6|(E*o+}SxU&VZZ|H%97)8VWS+7z?D*J%ZL`<Be-J=k(#<}N1Nu1EXq
z>zlsVI5fNcXRm8Mu>Hk!m#yAEn3by3baNcGZ*+5xnq>US%<gE*4s$2@ixmmtaaW#l
zar>5DF;)>a{pKO^Mt9Afi&IxGI@reH=j8W-{b=(8uJ&_va>2dxetF$_w061BOXh&p
zDN?4#%WuBZY|Xi8X8rQv^{agEcFO*_%UP%`vitCqivDVr<ySgGJ#~*>*3b=D`7inU
zE7z)PKXx(KX|nBgxi}$Y_ieAs*K}`|{Nfj#_V(YaPra-D#+k+Uwlx3k+0Z(%Zb#gU
z%?Gx}iC5{VT6{|}^$%Foc7wOS{QCm?UHLw{tJN-D`oH+vm*bDDc2@p=R#o^)N&Uv$
zfX9<`uM53b3*L5UUz7H<U2Oes-U)GczB%3J&Erz}RVUtF-nKBRLd5z4TS5gpU*o@N
z$M3eqohn!GpSwW#x9{`!3eEE*Z64<BOS^vh+qLLBUz0@@+<(g`XGN>CS3f;;;9a)j
zySXnOX|{%m94cP=!pp<_=)L2o<IUH&w(8xGvb*Z^Sl%HdklRA*`Kc95>$mlMJNRPr
zil&e?(x0~YYrXT-yZgyVs8?=ko7Fy}&d+AnFS@Pk-0mOT`1u2`g7xIxhd1pC5NfJt
zMD25&JRq9QAkDz=CxY;WXX$yRdIgnNZEhFcJ~rw7uP)7>j8D26Tuv3{%uRizvSrTV
zuGDPh^tV&ixV9ab;KIUWA>knO_7nTt{5R8c%g^%|?6|P#?VFWRQ*{N4U(S2^@}>2U
zj@USx`se$4m?nBWoY$(PxyV)Jlkm6XW6e_w)bCxqr)=iE*;h_CoOQNL@BE#U7oTj|
z8_Bs%%*Z!FBhPhCTK0@HTnDfBa{m8(-yprHr+8m-x~F2&i!+-|p1V#_tFG?0i8a0-
zKgD$>_x<#XQop#4O;*v(=(uzH_Wk?&Ph7sOAu?(0;@=t*b0$7}^E`b2Muph)K%F8^
zW2c<L$1mKjoRvFs_qMUa^TwY$G$t?bxEwL7ZOgAIACpAgi$Blc{_HvJvyMNr;_8J*
z)w(CCKAyDqqV-3c^Er(j%?(zvg}c^BUG6c<{1tckv3`<q(tgj0@nQ?J0v~fe+0*mr
z!s_yf$qt8StZcjK#bW+EQzPL&_qSu!pMM`+Y5)89%Qw?EhuhD8WB9|c`@>f^lZMS-
zcj^4F5z|+WWO&+b;_>)c%e7VKuNFjXyYRYJj`iqlUp1-CE=AH$Go5-CrO&(O`|Uz*
z^{MYJI;~NEloJkeupPL#xiVyf0-N0#_ajoTeYYi+H>K{>U@>sp_^2RCTd_4!;lWad
zYJr7p=><JAd<s7WF`PbP=q+v`+7Z9zQh=e9ewWRx>8%b9-5P?53w57%IIeDM*RA9<
z&(amRGmANyX+bHox%cz>t_2CryF*3RaKsA~Ycdv1dX`;rFQXvQ>dTdB(=Y0lOqZ<w
z_xin(yB<s5@yl(-G8=cVh&XtM%QRpDdzNond(Nth?+(V+et&nDQ|OggziP*)1wEEJ
zF*+`KLJ!LLkL|IjF0ZR%TFw4u=K)vEUFj=(-bJ!pw~GJZz!0S%$$dq2&8+WCHQ$^K
z^{3mNpZ<yEhM?t>EWYpp7XA|%;hRpZU!RyMpSf1wVxGzFU2+#6&)#!H{dla^g-@CJ
z`7@{3ZF*?+%b{oyr$j<-<LeZ|exc=UZ)7Z4eteyn95roMYUI|Q($hP#X1<u_d9`Rw
zbl+;RmC-4C(-yH9But#ns2kmt^nB_1>)*K^N!f=+EV;1u$H}a@SI!FW{<|Y@`?Xsy
zGQM>je_VAcIseX!SvO)$<?6Dpb<JOM&GT+dzn{yj7vEgN{9bOfOWzrJ{_>6ey(uRB
zk5=4x<74=H&ckJ&jPyiix$@>@S)Fl6y3=y}?!?f3$z5Ge0kiHl?z+pvyf^Sbsc>R>
z%H7b#{f>)HusifeEWUYl^Bt+pYH}yuncSb5utz7T*SP10k!PwP>m^l%;8$z<jP^a2
z-dVfm)jEEOme1D?t_olKQ?UB<XBL;4ET(eDU8GgD0=fR%%x<jED;6-*=s0Ym5m-5a
z<3q$+A)$uFDKZ@1Y}0v;T6l%C6r~I3B=PO{wEm#OyfSQw!Z+cGpCw$9x-P4B**0Df
zdg0%AL?_mrRj=#0#)V)_k(QW0n|l^?&R)6hj0?lJkOO&@F<pYptqjEsVR}h@0t~T}
z)Yj=F=-coYI_ONZxv^n}`sqpfi7!*zq%OS4)eDnZT0d{vY0(#L?ma1Me~W4EU}Wsg
zvT>B1q?739>UDvskVWFTv;=pF#KS4Sm7ed=YS_e-?fXRU)rB3)`1>7iwM(lBU3stA
ztk|@zx5>_{X$Q|j(GQw;rI?)=ErT1%m0gx?k&SRKa(y=4rIwLLnmgjAeL~Kx{2NBC
zch6K7G#@!|+4fuCp2dQzzcXK8IiL8|a$XKY8GA&N<+?Tp7e*PePfSVe*NhtD*fy(f
zV6k?}kSh{Bw2oh{pJ_+pGrb>HUD;LM5<jEn>&x{%WHbKE@=J13ft>Hz<4=v+owZxI
zuer@sUuM~N`M}hR><^oqVwnmXy(hi&-@o5-@0RutYwvc?S-;)?-Zj26B6oHyZ8>Xl
z+uUK^*4<6athZjcB`_Fl@F;pQ?e>mxN3lpPC8>1|v)}YZFk3X{gg7tNU_96FWX^m!
zZ2{l+jpZg+iZb`I{awEBt=58XFCD%+PPm|Kx-*|ykNf+4)&B49z0XW8)?CPmKccB0
zb8+qlhsmpF_|01DwZ-iAHNk?SO(o8Z;l7r}n=F|uL?R}tv-W0|o)YE1ygN<W=-r~b
zBC3IcjJ)<88*Y|PcRx_*AY;RIcWLX}e}(eBhdeG7?%a0uN(*P(BVTF%V~+D%WLb{K
zvSeRam~i;ho~@w<9?er%PtD1n?{TWM`tj11rRypuEPs2~_TBBdmi)R??iiff{rTA4
z%2cJFOnQ;C(s&PTIp3`}_1e|UdyO_PosKPLl%2rD&b0ro@BY_5uNEqvFWy)9T=PRy
z&Su3Oy&A6*X1?7jsFWbor!qs%eD_1Aas&I9iTztx-W||gcUdp}L=opE!3h$_)4Pgx
z)Xtjg_~6h4kD81awsZBxJ*qRTR{!6(`&YD;m_lzr`NdZLl9>maU!JMIRU9!_RWtCy
z%-?I;i!^>+yqd-PZ(aX=k%$0p?*ggBVqLpnJNbLxGB<HVG0gwM$m1RGhA~Pw!CQ6h
zY3_e+Zx(I3axNyC!?pX6Z$NqD#3z#`UNT>l^w9IYs;XbZ&B~TfOQll6{?^`KHT79`
zQ!v-(<`b9g7Vaq(-6buvN@c<3eEt9<q4(Px3+_ZFo&UR)!}@$<f0(Ra&8_XmL9PWY
zr&CtxJv%I}$tN$hS?$)A3-+&7*UVh}#PPYwG55Wj4=le~<1lspGCj8Vq{91FG6Ck=
z+ZP9DZ<uVi;j>0h%oUEJC^lV1hH%q|jt|ln*d9E^{y6vUG=_`18Fu1x`JU*BhbH!Z
z3tsPQemiO3)wa^x6S$8ho6op&d0l0q)O^{U2REm`b;~$#v25|u|FQcR-V5|rZrE(F
zAarI#V#{BfciSRFuFhRB;nY#3UF_R})3{>w4V0H`n)OerIrAK&%`u0<yC*jNy~eAx
zN93`0uA%CMD`f{88OnDo*7B4sU3P8T;m7Z)9`G?dG+WT1F;A@2RKRRk(2?#wk9WIU
z*x7&0kV~1-+^nBIv$=V(*<l%(9{ZA6YJ0AR6l}>fD}MOMaB{M`)7_a38}$z|t=1`g
zu!!fbOYMiqZ{jykt<Z4(GxZ>E^Iy}KI%3=rmC@R&?{cSzC+J^3bIo_%xpk*KG>RI#
z4>p-FM4e$O3c4v{>vpfA+tW45H))-cU}1V(f9~WZkL&~@!)Jew5L!_mqbE8^XK9Cj
zDSNr0>H*^t?tM8cy&l8_d^2mc%MM<kbzMp6-VV{#Z;}!v-ZEb2=<{}8`&+a}>QeFk
zvkW%-WcIv`<q<Uc?^xI{hb`VftK#@QhCDtGqo%VL10T2T-?drZK;^_Fr4EPHX7^VW
zFW23+ce836_pNDv#HRN7am{qkeLTxa<3RW84DqKjT{_~&!cLpnmai<6y6*6MZi)G?
ziyK;s^qOr>?P{v&UCrKeU~;tWmAw18T#MAZti2`dH|Uo<y|O;{TzPfD(x+AKvpJeh
zF@N3B@;B*kspzlSfjK9t{&6+#-^{gq$&o+j_j`CQKJ((E*}<Rhsy3eDWBipf^U7+q
zohm=Qjm}N#XWKhz8`}c!o+}DAdE(6J|7N9^a#$AleYoynpDJl9FEc|-MZhfdVWjzn
z-B&7B3#Tb<+8=Hit$)r@KB=y1!?W)aiL>{42^-#FzTG%ern}Glhn2#EWQT-=PhAx%
z`3Lrizw)s;zgsSl<3o$%;R!qK4VIg8dp&=)f+c0k0!=HiQ#na<LP|pZ>F?gPOiao?
zmuK%G{#D^B+h@$2tQPoc;RFdD-}_hpou2vs@#*QmPne%Ov+!Gj>>=ScyVYlTZ!+$V
zvUvB`o#k(*5$p0Vzo*q%bIrDI+S_zJzGnu%g3qp7yB$v7IlkfqL&If-0H(`Uzu(60
ztNizCySZ}AWs!fYS({|_Tm6seJ6K=JJ=%3+e^TX(OG^$!cfGTn<hS<l<Oc<!%+G5d
z@nkbynxXmk;{@f+jfd~4zyJKb)p!lt!9bG_hnccCo~_{!2zWO!jdL6S^L^)+JgD5z
zWcp#x1d)e!g|jB_zAYX8_rZ>mg8uRYf8RI!ZeM@MHuKB%pC6v_DC{|IY;m%n;Y9oV
z*bgbcoBSOsmT_+mcw)Rhz4dd<huQ1n#TAZtFS)UFR!gbSJh3Ir&qK3>_;}VCc`o5K
z5cIIS#rw?mn?2Lvx?AZ7ydxtm=5_HXi2HwkxZyubGM{{#bL&^Z-xI|SS*$*+$Mat1
z-3+m2OU_fb9}9P1{<7@Mj0Z+Sm1iHkVVEJ6r)yWi!D-L)uKmcP8M5JrMQ&$TI_Oqc
zS5JAJZm<5-dqSj|t^EpZ!2>mqP0~(1Z~Xq)e{*rhh3(AV(I4`&x1Bn(`o*rPv)bnd
z6gI|23Qjg{(-doQez`S#zh?A2hK6TX!b6-dvU2=VP<eG%aQ4C(iX1C4&!-vppLK~V
zxUr+q&~ll^%@~n#ClxJSmV`qYj)g0m)Lwm=c_llLRl0{gLp14{`hh4uokM{p!KLCB
zYNsNrreFCTxbr}l%a?~wZ?2B_tN*HBXIoqNjqm94-)3@_tN6FJy<c4a@;CDr1J8ep
z-Bwl#&faU;?w#xv-?PiuKJ@81g;4eWKd08s**Tw8d&=%&d%d8qiqWt58KrL2XwC_I
zzUs@L11&9G8dp;G><gUW+Q=rw`TW;pU7?SD7u)t|L@tR_`MX<#^Rl(2#G;LtUvQdv
zzj*V~A=hB~!vu?*xaWMXHgavvv$%G|pUSW}oLC(gzhjxc+nH1)mLGHY7sgGk{2}^4
z^*F;(_QYoPM5gWB@0wTD9&AzT5Ie~<Z-c<Pc`WjY>#{4gOfI~9&HeKAihif(9^N}`
zO}@w-3+ve<!dl?u(3XDo%rrK;jhdg<o)P@C=Xs0PZ1xqOtP=A%*BKqwzqwnm`Rl|9
zi?|rm-mS8|TqrJ{Zfp<|^;>B7o7Id@t}y(x<_fTDU#Ji?CHxM<y_Kp;I?C5FmVc?p
zRsOc<{DU>KU$5hyZ{o8=X4_l?orbCc^|zl^Y8%%dU)#uV$tF0Mk1apiXlCNRBT63o
zJ^u3K3h({E%C_>&-)Ogz_m_I3Sf=&{v$G_uU^HEMC0r!+#nm^P#24tP^{>y_ziM;O
zdC|DahMEhnBn+PhZ0Xy0eDRG=QTx}EMLe8TmkD<75I;3boju(vwZM6S1g}9Tm-AyO
zn~HxL`>xOQZ`GSMD`C_88?Do=H-Eb3rNb)`Wq9G!fxiqJ7qd@lyt$@KN%P{3RfX&A
zCaGJlsyX8CJ2SX(P1dF=zQog?)_-}@w!`yJ^vm^^H}t%`vt(~zO<aRYUB&V(6_SBp
z3<Q{sC+2xaXMOVE`nG!2Et|8SP2??}x6Hq4Sa`C)O6<y%LJl_3LxnlIAt$3Z#BS_b
zJmJB;M|}nJSdz<}H-{t&&DgCuGdbh^{f3t-dhNL7Zq_fk<S_ANR4B{S+GeSj*Tve*
zu8VyW&u~BZ>r<6+q6)Ll)I*`+(yy}wl%=LlyrL|^C>Pqt=-+U%!v2MqEAOdDw#Lgr
zE|pyowW5|<`$Du|zFar+-o;|68qNJ;MVitM7Yj5JXU@oG4r=)NK6&Z}ek0}HQ1%_l
zvv#g_v^%x1?R($Vvw<>;?o>5=y~xmas9NA|MY-WQcWYUbMt<wM^paAeooYKD%(Fb<
z5O(-<-Srzy<*XWpM;55bZs-e6lR6=~<{Q)MJ+tP-@Nc!)nsJL|edH>AKGQX}oHmY6
z^{z`famOB?w99Y$LyZ|e>V1hq$B(l3HZfYTxQXie)mpANGke|i^=3uW7svBD9ahXy
z=DxG#-;U<Rf?Qv^T!mbmf)aS|Trd&2{H>bx-kYyKkKR0eS=QlR;f{<`y7QA%zfb65
ztbXe7Y-PrTr?WMiQxv%rG{ffKE>S(FE0=WK{f(}M&_XReZ><|w?DmRO9Ag!IzxtEM
z8>2X*kA`!b3MYx0guaMy<z)M<pd4|&@-4sZx65srd-EB02)_`T5-~4cA#G)t$Y-Wz
zF`b9IazgdjP0McyNYV0JA^%P1K**1k3RdcTk$z3V9LImoZoYIcqdhb*<<pZ72IAW%
z?qH7V%fB8sOP_zfy=1?7GWU`y=|chf?WT>#eW%V0%4AC~`&2h^nfizHbH&H6@mwuh
z-m$;(!LJty+B-iSSTFzN+{p*8_VeA}zh91t|M|K5_xk6)YH9zb_tn~J4MSN&v%u>$
zH(qRJI96oSe(xbeV8nt~3xw`&(V69P#CqCF=5<LXuIrj7RNZyHb$F|;xQfh^X%p1`
znLIQ#U-L<%>-^F<7D0jgt26j*byDj%s%==VS?#I+b)^22M9k?Wd&&<^u&k+iQTcVh
zpZUJBD=g(<8>}};YRpmnSgRjeyM{SlOT+o;dDhd5FYNjHsIo_<L2QS&+%f60?LwTl
zm#9u<Va_jPORD3nY3fer?mWZ$E&Ej7B8zFOJa%mMzmr_eyw)(mfwjqP)dR5^g&7+j
z6!Fe1N%49g_+bgFQ(*K}HsJ-<$&Qh%M_+xNS{thA9sJE**W#6_>=Blt8qa51toBRy
z3Citm`K`6)(^J9Uo2Rg@6XjiRw7p04k*mR~hE@~zYVj4zHYG;uKhp5Ov-n2lZT}y^
zPiE&S|6|y{?Bm)4GK`HE&NB-glACU~_n@)FH$S#LS8H-xv;W=K`WU*u^TVv0u^+Vb
zPscS(sGTaNZ_wkdmT#Z($@x}q>ZN;k(zh{3Z#?#X!^~%HuXZ|ni%i%T#5|jAPN4jJ
za|X9HZ+*XK=pA4A^yT>iQ^BOaW-bA&U9K)^pX3iXTb_3;p8u!u*=6|zLA`@*jmP6A
ztjKPxIn|dDtrwcdUVrQ7tbaMZ%eJ1ow%~z-b!vk&Yc-Ea5dY^ar&Xq3URSaDE6!nh
zc<k`%kEPEw)<u<-#4HItbLP{%f4MAM4u6+=!s)inFnXzuj1|`xg|pm_^Nlq;?xZ~1
z8gkAcWyL+)CnuNjZSMDYws^(@150C3QI*fS1s1_aH?5xT*3+(J{hP&GKKbOeGG7m)
z_qPo~^-M~xHQTM8bt!#*p#RlC>DAnuTUIu!+ZIik=zF;Rx>-$oyW$<G&TF3XN?fO2
zbh8&szH(GNFXpRR%eoVVR_*<pXB}Vv=B%4ee^l9yQqzTo0rCF3^W0muEZyT6zM<8#
za!pIeymAhSD;ekK2e10}$6kh8Z0nu^t&Hn?gN`2;pStf%KF=+=6`TQ))=sQT&6(Hj
z37W`%RDbQBxa(gIcRw@jIVzQx-*BK%`D!muo4~s2ZAD?_TKT=3Ty_7;%Vvvy46x=&
z+Od3<V}77`iH*#Ii;a`DJhu8gp76<#`<L+HVC|r#k8DDB{gttwGs%jjrMa&p#$x}~
zrA<<IJ@)pnS-9~C_Fehyzp+Ynt(5Je)Y_0@yUM%P&7n-(3T@Ku!NzOOa;dp~O_g~X
zHgm0Cj`Is6rXF2=sY$OG|MSlEn0w6UeFQH@@P4gbu6Bl9@j5=f9~chuYkb`LYS{|k
zy$8C5`sb=@U6fexW?Ri1rxh{h9=>_nzrJpnSc%D*-#KDBldosGF06WGqjBa=M-Ef<
zi<e5}?^o=xI=!ns#I;TL($(-iv2O}<)u*m*DbjYm<Es#UGWm$&hHXOk7n<A*4@o?5
zH&AhE8S}>jpI!E<FE+E?eCd>6+nt2}7TFF_?<eg0k(hC4+A+p_^>y`sGM|}>i7m{$
z-nHM<XshyEwq;7f+M)r|qXX>@7+F0iVz6zCV_h~i{qhHf^*>p<em-9QY=K+VhBF^n
zCmcNP)-@q6o7M0wkNcXL!mR7AUu!r1bH(Z1`U5SY?_a<2&Jll>G1H|;?%mELwYwa9
zz8s#S<$1f)xv6qG=bF#mP3v2JmvG12;l1{}Ui8LCLC0KAX;<^;&jGjdI$L!^-dt5b
zTfTU`md^EX_1L4ACM88oP0}x%zUP5*S>Jsx!DUWrehXs)t3HaGt+*e(%k}jxt@>Q)
z$hOki+zMCzX1>#P@7Iw1zBW_cxaXBf^twD-78m`F=79aLz297r%3kDI5N@lW!#e4~
zX6|JEX3-7?#l4{$`>fmUiAGin3Oue$(9iO4&CC1xr?Pl`Q03goE9d?Fd2IcbU)!3_
zoL{+3mdReUJUn7zT&?#9r47ke>uhB1y}QoNEBp7(>yU?48%<U^{h#o>>rT_c6oGsD
zgz9)Dqc@vN)yghi|GIF|5=Hmf*VEKrOjCG&=Y5^Z-s`vJ3YPvWTW89)J=*SYd?;%I
z=S;pctM#^QoBAc-*uHbVYjy7a@I4uKdS^&M&Sl=p#h=_wGlFmDEN%bQB-8kD&Gx69
zQ(oUar)R>&bLIPy2k+Y)j(%C-b3JTNoVr2il0{J;PF&d*`82;gP$qi85vk;<%RWgr
z&s_CRv_kjDc7~0Cwf-)LraU{Ypm25BYJK4iy@y<$>SR0T$2EEADaF={Co4+dT=hs!
zTlZAMzK~N4H)h>*^m=uNZ)s7)+&M4(S4`lTvFS{3diUp*X4`a2W^sPsm$ExZs#o?r
zU;O$1b0&UUFo#zld$q)@RqH?BWL<yoR{!S*4IAWSYGm)VJz<`IZSkAf8+&R_yq@v+
z^XhWVzgG3jD(l-Nn!3JCUfdSL%2mSG#{1&$Y?jlahTC@@`M&sV{^X#{?vUEuooDAt
zNWaydT;*+hS<0z@e`{at;mOy1ugba2xbZ%%TH1U=;aU6W?BdkJ?FToUn$sjH;g$I%
zu`Nvb-*nb@i&`5m#;fkTyX~&jjw=r>{=T))J=}4q<&~(+%1On2|AeM<WJ?=}Ep*|o
znE$j&Z-wrOH~B)V8<!SuJa{ohg<;O;%crle{}aA{?r-t^`{vD!i<=i`R3)vt(mUaH
zckGL+b!&8b1%&Tp3(WWzJL`S`$3~y7gC8bum0Trd-tv2)?{>Z%+e>W;S2m>{DeH^$
zpZ#k8;rdJt_TVYmJ@+QuxtY~&YBPg#-_jd>nbA25leJmOv^8%<8yd<b-}x(gRMG6F
zwSY!jLTEorW*_S}!8-PE<v9hBEky~ef<2q-`tGk>zHfWq5tFpT7v1@EYj-cmTF@l&
zvS((#&87GY9R+`G{#f~c{__2C^Y+%Ymj7&j8C;`z>f+qV<!8^O_nv#4_WVcT;_u(X
z-j}c1p8T`XI(~BT@99$4uC#jQo<DP7<DI8UA%>qGyfhYRIcWSf-KI>c@T076z3M`p
zq^;aD1n)9Fl&)VdVEb3h#q{BJ<ym*?h1(v>8pzZOx7{y4uwkRYosM45?nFnosTZ3s
zf6X_T#4J4bnBe1s$)RioM?`y8I41V!=Z7%9y0~`z51B)OGvBW(xi!IdP1x1llQ<Zb
z$o>#pHDg)r%|hPZ>gvLcug|(l|J-c;{n4WT@8V)g-aWXnuld6NCI9>W$=^S8&NOF^
z{l4ix-e}&P)ZDx{`ER0)nY`R={`<4}<)hwbS$vtd|J_`f$i4RutT!{Qw%B&6Pw~{_
zXVnGqJugnK>zEhO@$dir{{O6~^Jh}EKIZS)85rJ55WcM}Gp{5y2ef1_A~*lBnb5y=
z@s4lmCe&_yGQBqQx&zmfO_}FzsQ5{5zq?yOAft2A&449dL4KE#{#Un)sGi<b{86rq
zpM8#?%cYLbhaMhIZ>#EDxBgx|&$&#W9ZCmv6k{$=5wdhW&e|8QGNVQLy{eVq(Zx${
zdM!Sg@rO@0jOD2dXP?j}H6Ibn7mB_G?<!Y{SavPia%HJXU`s|E$4bFxF&S%CJ~;I`
zZcjzwo{*?VH@E_{R4yeHA2UsSprfy$EVR^Od5@52RovHQ6Ow#|7hMQ?A$n+qK$jiQ
zW(z)vy~-NvM5{MXp1f~sRpaBIrWXDeET29-d|>zT1(k`(=U*~EoqFClZeDZit>PDd
z8FuXtn%7Znn$bFK^;fz0=YO}k_OHtNq8~DKM(k^&g-N%q&fNbTlhm^6{g-6N%C-$o
z+|!R4@Vx$Wv&4AUn)oaKLTwL3+DA_O@y<!*2=AGS$o>~Tmv|#?YfSCkB=<AqiEqfF
z6=LUl=iffg|3olt>LS-2Kb~LBEcw)bc{2az)0<beKM2nj+P5sIfLmgD?JmK}hOPbb
z_I`qK+_M(UIJF}sg6Ry`A;vj|3mDsUp1pq_93gh%i_nAP#vLu!D{kocp4nh@SpRwV
z<(08VTbArdxwUrLOjp1E8&<d^XwUFxTk)i<_Pk!b+jniL^;xp5TN(rx3-CmpH+=R$
zc4d&*B&~>@j9MG6TyZ-ir~5}}laBEg9ZhcrcdrH20U91Ym)(W=XRJ~_w90JXrCkA+
z9|m-W+)ws&%4#y@wo|duxN4x+wP0TI12cs?sj4}>3=8BuCJAw#RBHTj=-VdeHwTX-
zW`EX~dYpdik5r-5E+uc7`&)CEzs`^q<C@8P_S+K`!Hq_b9`0ch=UjDm;i0MLW<IYJ
zn^GOQ{CefPaO>j}T6gMoTvBml2u)jY<`H)VUvGT-;ty9DdhZ|jsvC3v&{xx#{jIMh
z*1c~y)XT{2)?PWuCvbw~k=x;u44On4Z~mDo`ecf>glVo@#3>{5_x}I?eU2>obNS|1
zk+NUaQm<z(706-We;)EudcoJ*(IqYawk$sTo_&G%hLU3I3>WT5sZRNne+)loU-`AY
z?8Nd@SN~)g?!HmRdhLI&`u>C&MfJC*+kaZS`say!@6CHJZJgY<eTlI8+#Jt%%a^Nl
zR~7|@dfVUpe<02M#CCx%w%cViuXvtX*|%t(lFr-352{NvEoPcs3*pRo^Yw6A%>K%+
zLbBQ_LA&=nJfWm0=u#NJSTv6LY{G>G)s~v0O`JOz;v@<rZkTM5&ePeNb8gGlpqVpb
z&$9Qih)&EFc&>U!S}D{*eFeiS;Vy}HR`d1Q4ixW7<!bXx$`GyC^dxQbRGI9il#?B-
z`I#P<Egbi{2TIws-bg;URpiX3$H&CX-z981wpF7vFl)*ov6s7FOq=w;n!|bOPHmsi
z@=1@aSBU!>DIR|)lpuHYDffoUQ`XH}Va1l{b<%fn%JmXS(T}GTN+mZ6y$XoBn|zeh
z(<8`Mbmoe@q>XAq=||*C))wq$T^)F;#JSKhdAV<A{qIccu(nFEwH$s6rZHAnI4o|R
z+mj(2w&aw_QhsTcgWGN}cnD=2w#ezJaQ*&b+5{dQ<J7GS>l!r{Uifn}H>`3S|Fweb
z+ixuxj_ej;J;!l}TU0D!{h|9TPi@uT%~s@}d*#jSjgsz_XHKyQb((Ere|%)wqq1^4
zHuXHcXJx{__bs{dP|_p9_4E4veU5c64%bTusGt1X>%BtQMt{+ihibJKZu{K6d**Uv
zv);<Q7fuY_OdM{@cpPVL+Lop0^Yyo~_Z#K?_IFR+RQtF;e4)iV6Z<5N@0}OVK3MzY
zs;NPj@BbUeT=@1rDOtX|rYh?R<BdB~3}?!|1x^T<!|LLd_~2o``{IkyI~sZYjP;f*
zY@T$#u<(4~R@eD~^85d-3tC@h*re>{o3B#o_x<ebzU+>jTWVLT?4KSYm#|QJ&&T@_
z2YWhyGxyX)OU``T^6<wyxeHTf9%ih(Hs$oO!dylDsoQL|7*iO(x4l@B6%{V><U-Ra
z_tzW!%r~vgpTH%kv(ctWTR`VwSP_fR>1P?ek|D;+8Ry*BIFP;IgW9Rv@7h+cz8Tzb
zT6e>~Ove?Q4=*)XBcIwLY&@6OhyRiK1wMzb9_tsxsBkUcE%Hbv=i;M-+Z<PCU-(p8
zZ5|kUa@h$J-}AG!#cX)FBQNV~-|TOW%iiXCpYtiNmY5yAefGQ8Y1jSK8$`nj9z8E?
z**Z<cz;V%8rFW`N(uHmv{PyJTktN&i+Sr%6y|w+y^keh8lyW<}1Csk{&*b|}U?})5
zs_@5(_rr(yD?SB3?!Rbg|D58_erIam+>&^9n>)7|`M;MPI9$elC%3VA#?ScG3_C9s
z3*5{RO%af2GFG|wRczjQJ^P&SkYp8>3BvQfY&$*2_t1yqye-S;N51$bX|d<Z+pGW1
zByGQcEPeX!ziIytH*LRv<A2ym<Ndemrk^j<p2>D7prAB2Zuhy6*WHoqSM_<_bL|?E
zM2sEe8(R|J{?V9in|?{<^P^wWg;_4Md8s}79C}*fq&M5m!uv~Vj`>7H|N7QEcWd6h
zd17tly_y$g{zqNo`Fi`xjPih($fr_Vi~eSbC5uIuf7?5|`fWxrUoYD;{%K-m`Ilwm
zXV#e-9o<#_IK22<v}9aAdxov#g8i<!s;(PamhC;KH{(tFs)Ug53%2HK?p`T(aH9YB
zYsne5*Cx-sy7{O<*0T+p%ijH3+Q;V0EAwy1{?PyRFE!6>JU#DPbo;J%6Td7-j$L}?
z`#&bs2E*>FHx)`*85l$a3Gb!KEY8Wy%T6uQE2!KX{x<KnnaJPu%Xbvi-_R6MeqDF=
z0NWbRZLHb5lMJ_sIx1WcN-dn~(YWN%io<dl>o=<3R@A&5G-b(8jWiZdjfv0W=2gFI
zkH7Hq_hfs%`yErf5A&Zl(p!6i^*Z;jeQB8o`Qy*_FA^_V^D3;nH1Xxti{bY#Y<loz
znzX9s<M2HprLDy&maEyS|Nmvb9bfC4e(96Y`O>u}o1IQ-oZ7ld!}HTIvsvn#om}sA
z3^k{IjrI}oRhzv1QIv=C&P!8PtrAnc-j;JvXK%`^{Y!#Q^jDblFS^gYXGzz|ZQF~}
zW^GYO%b2_Dz&Q=wnKAML=Yo<e+*VK1s^?#=A-pWjOm`8(s|1GWlJx;MnflX~{^*!J
z|9_c`!Gj#1o}zs>XIoWPH%(ue8xgr};_a=65-rYJ=Qk_Q?N?FJ?6h?<x_j>68iSCP
zYYwJntzGAGY-5>@%ZIxXawj&l8qEo6`+Dc2h^uVlwzaJ>*7nn6Pk#P+Cw`;IYTeVz
zKY3-S#$NDS9~@`B@3Fvzdr>n|lv9?OakQSuw2ZH-sGlYCzohEV=bO9b#RVU3-g@AB
z$94(HoV%{+|L=c0QTRP!L;ckbqucK)-imoIyI#YwYR`G=1@V7A-O)O$9493=r&jRB
zQGVw8Vo41ZrEfUb-rBXa_wk(Qz8@96ifIWuxujeag1#S{`R2j4f5%d$So5ss2vnc?
zyC7U9@zs~ZYpy0;jd<5kq`1&FeVd`-!_4;Q^Iot?MijD#8+PzITs>g6^6Gq>ttPic
z4r%gz+jeS#S9n}0qh2uk+y&Pjajl;{%dhS)!&yfa0sn)S`!9I;NHf-YZ8hc<S{Tp2
zX|H1K?U}uc7C2X(?eVx@;W&ThTeJD=Hotw9AXq8z;`86IQweg5T$KurUz(<P-t6|X
z<8G#kk5tQF&19cq?5P*CHr&?lLDW~dQl+ac4)<Hax8|xpxRbME-sQ-?>6!82)-mEU
zwsngNC~}<K$t|wsIIsBamN&`o3j*au)@0B4e2?v`sZps@^3n~u3<Vo&_U$eDAazjf
z@RALWgs*q*PGI^vYvygK%c9!S`y8_N3LcA-Sgp_h;=}HLRvOo970$SM@7i&P**V`c
z^D4);R33TL^qG+h_C>I~*C=ykUDnX~RAhN%@U6@}&GPjQ8%tiSe9i2swx!r4MNE5d
zu|rk+qpuqCgViPrJa1XL?wZQ2EBEsGHwUefnR`Ec(anRsx7k(dcs(U|x9>bJEx+^~
zOIE<$dyK23qRqFR&#q946z!;~S+lEpy7aYKwjY8E11<_*SsfGeKCz&#q{d2Cj{j)U
z5~<gxUoDDHPIgL+|Ke@w6}#E#-p;5Gu3rKSCWlN|B=Pg{KiMa4&(Cgoes0U=tvM5}
zi2K=WoPOcPGk%_01-|-YIck#ermtmOlg@Nh|JqU^JzI6z0geejBY5?H$ZRoC;8`Lm
z^<dHcUvkqpzgty#r>V?#I%rmPHMVfqaXsM`TekPgZ?2J=#rgN?UZI=!U&QZQ9_g{}
zTW)QBUDaX365FkwQa8U|YY+Zw)4nJ2*37*xLv?@rf9komr(iaJpn7F*<iS#Xk)2yM
z=9oTv&FOPj@6?r2*KKu2Y>!(6)k@YITwa<{#GhVm@$sBmUD&HOf#VzIyyJX#z;Nx!
zHBZutngbXX>V7dUidmh+b@i6Gu*juDPj9W8edlhM@8s`(mWO!n{5`X<C-cjhCAZ%Q
zn~0oj_|#xh%VYiU*FKRiGe2&wUi5M6svk0@iL2)u?P<@ua##PoTrks)-=&}Xenb^W
zevkbjBeJZfyXRf5T*-7t^{8{_ckYeYD)B=9_^LUv3EdCN$_h67Nt!1+J@Y?r5&ly9
zW9Qvlhuih<mVaLEueEpHi>B&)f0-Ue<q~s|Hy;mY%zC1_+g+gl(+=k^e)jU;(00LQ
z<S^cp=44<<RU*9TJ~y?bD8D?lC>yjz>u%)h{M#o4|F7GhG_htvi-*<BDi@<!&fM<T
zr8*xg7~YEEZC-F<=@!GC-UZXQU2*>R{hVI>?*y5je6HQEnibFed1gB&wm)vsdHMTw
zlKa&am&x?&EBml^a-KVXF@BT6oyQx^XMT%Y#63;6c++j}C%)(R82*V|JlobSe1>tC
z(w_$5X-gG)Soki*>7R@2s<GE|nV5XvUFB?qUVww9aHB%cr?~e=yT#`hOiSiVQsw=~
z)1F}G(xkZXO7|SwM}Ox1|Ki<e$luJe*mu{_z!v3_kC%_G4%bM@bQ7Ah*uulJXimee
zxb>TkSN!#rF?K4~c<^G`r#z#XOD_Fx$;tk1_NDPj&nXMDc7gOuE7{I$x^$eYdad03
zhsqM&7tcO<cD-Nv|D*ib-R0Be|5e>{{;*Qju$Duz_vE^1dz;P(b?IlG;YpC?%HMxg
zNnA8Bq<;5}#~=Q6x$bBe?(=TeU#Q07V!?G`8i$BlfP_G2WZ$LaGM9b{$3v{k1ecf#
z7#){cJVl0sMa;2I)x9csW%k-4wbpWptQjgDM_1WsidBm>noi(qIdO8EK!jG8;x3Pw
zx<5D=w_Z}$tYp-kmb6lj_ua;jDN@@6Z`U1N=+J!Jmh=0mxEU;Sn$u2w5}DUObyo+k
zdg=-5PYiFAob&Dfa;;^!dQ4-AWYePl3(A7k6LNi={hBv?S=lGBcjcLHRWFkz*eYK+
z`?<umY&v6i{1E>qS^IXc{i+LhuwLWXw_iP`cK>c>*8Q5je`S|hs3-oHx%=&S<heut
zR;b?V^}2BQ&XdE%r-jV?x14D`8zbTKrl9b2T-2G=!%Y?O-5RQD3l_fGuz6)c;G`AJ
zd-NuxH$ID9u#@#rd@RoelM}lxf86@^$F9@Mw?4gm>+>#$d7Q6`YH}_2y(_56wS1?$
z+o3CKM)V`TV(*-WX|W5Ia$3!<3KkCy@||&=^K(wb^#7te+1ze_DM)Mbn#AW3<8X;#
zU(K}S`z|3{q$bHS<!>}l6!mS_IUjT4)0vhES%LE{XRH)9|BHPeZE0OFt@Z!ShlcZ`
z8a<p&&$)Rf@^FmLS{+ZP(=oTtl%C%5dH01$ySK<jW%21QpLh0)$+I(Q=StMdc0?qf
z&wUq@Znf!inAo$PlT%yTc5ay2J#FWv<k-xO>uhGfe0gT(*_`Cqn`Ys=&MrM0<M%b-
zPDIHz;j=N}Z*R^Fm@@6{jBh5lD-v&qO_{a#@b~X$-lcjnHB?12&HFcTu~^Dlu>g@=
zkDKY4o|hQguedUty>PKrP%Y!3f*9NHV^8l(G#sAV%`j`>V(#MPW;59ty{wisZ<rWE
zn{{P9s^cvR%GJWR>|VC1K11N&`LjEYe(FBTa_IkShB@^cXXdW)_d9-_JG$ti*S~PL
z<!>)|mA_cIbJr&BeV4fQRplDTXP=pRHfHOYqcd%dM3*L3^WC0pmwaRQ)XU!AzeF<d
z_idS{`@UOt`jR;{lWwfjJk`m5_EfRZyO)yR!}`8>SuaaFXJ|Tm)|(5(j0@A9(qt#h
z<eXXVaI0KMU)FwF@ZNBK_T7<<MUN7-<>lUJct!F4R9~hRFLdkW_L5`wgXY(-U;9Ah
z>6FF$m~3h{ugyEZ@6P5WPvWzbOFm^zRAmfYc=g&Um)Pv`iCvRSr)1rW*`B=Y)V<Q#
z8&^HK{y9+lxVBXO`#*Ip+mD_rDL)<YNw&V8^U1koAHS*TZwT6{ZTjuXKIhwYSEIWe
z|E5Oh)p)RI{l3&#xBgb=ofT94cH46?cQplw6y-K?)FwPV#j4tJ@AT1g+XAu|D06+E
zbTnh>@+bYXdt>IXSlc<ymsDDG{-Rj1;`Wk0H<5`l?Tc<*jH&za`|Iwr>Hq&eZ7-kg
z|6onmo-d|{3_m@rb7*<bZ{hbyQR;t>ok3LY=8y)%MLr5A=L)=Qw|u<k=_!9XfsXCj
z#pWHq_fLEw{m4}<JVPd_Swuthv620%<7$5s*I!)0lgr%qx9V>A^fmuXs`oQWud1DP
zhVe??>-2|l+rC^|zDn{}`F)+e{f>1-?$_t<nz&SFp|zgw28(so8yn|lp1m)ymoL(4
zk&chDhFIB@GgcojSn>tE6YWppU*R`##{{GMx2)VPx);jVdd!G_cQfRud(lfZ$>$u0
z!oTjHIYp9BXzIjmH}o&6oe*Y{W!tuMmG90rlUue)sfVYSt`|GyUf_FKc)^ATO-no2
zG{a1Jve@0Trfc4pysDFB!^*Vy-+Yd<To1j^oS(ene#YsI8buDDJ;gfywxn|k{!m~G
zjX8Y#rEFE}ugP|QLVY(hTNljbjXPp!$<vlQPsQ9ru30&}_tHMGsL69~AA9<M!`UgZ
zXV$D&TYhAT-pZ0$IK_2BarM+c$=-L_YG$r^Zu#cNExrq<Tr2L1zLh!Y_{(|jHIaR5
zkIEWLwtb)6<}Tm0`gU@wz=w|3SFT@k%G27vPWMRlFI({IXY+-1aq?x;c_w^nm5kq8
zx;e4LV{)j$JC}R?zm^%4I0d;x@cWsii;AnX$?rVyvR^3rY@BM=p1+fn&d=@qEaea}
zebZ&tLtPz4-&5>&Mmubhtm%u=Q|kCp$)%~ibk|kYl-H*(zbSvg5*VFce&a%dRqVf@
z$$u7H|Ke9Z<=(DWIrdzN?lW$Fa+nzW!Q}KNq1xCpn<h+5pQfnn$GS=8^l8Osf69HP
zo)x~u5`6i0C6~Pw*WtbK1)uLS3B^>cx}M$N%<)|Pxv)%&xXh$mGJHXE&%9l5#pF$a
z!$$ANX&-kTbFMWx8Qm*1rM~UmLKV?+c@L@QFCC{G;yodfyUu3n?(-SNpHG$CzIw61
z{9NJ*yVZ;OU)@*I44?k({HtxT|EArH^Wpa5^V*yv!<B!PS+0e%o!hCjF?-DckEMpz
z*Xys=o)U~xIW(a?kn4FC?}Y1uO8tVV$7k#|m~gV?u%haYKd!|W<oCbj_w8spd6P#+
zLvQETbMNaGJpT0CO3(l5$Nm(PbE(t!z6=sG(&EtFaPUB9Nb@}p>kncATE}GAD|g5r
z-p%qq(bm2D<(c1;Yc;wJIgKjSB?O*N(fgTu{^V;v#SQaWE%!Jxy_>yn%S-m?bCV`1
zetSDHy77U=!$YrT<T_4TF;nV(zW7z%i-{rISeCi2dbgN4_~(VUlW!NlU+42K)m_i`
zWAp}v-5W%zuKMu&%-;RSXa#4y<ih4-UjuJSIlsNXTq}RsuY3E^Hlrj6>aNaWVPNp#
zCcGJ?AU#vBpt3jYcHV6_f!gQcJa5>8HXN~f7tFcCK|#7x&|ENzIafjANLNgk^yJ;$
zcbBG`eb`^#79O}M`?Kq#f@f#mzESjlxc=%@`|jw81(`n|sXe{a=~Ezl(EaSBIr@5s
zir<S&^SbVqQ_L>@T)wV(_Z;VwYbQ<k<Q}IHn<Qg#&g=Z?9xcVb&8I@!jvICaX+Li8
zTq#rR<oUW%U0q$?{F>x66Sfmm7~5y8_BWrfF-XL81&>f@R$xK0^Ox^?_)c7nI-zU8
zUB1`zrrGK=J^drg{C6I@y>6a?%z<CaJr(6D=6v$q+B@^+t;+PkTb)6FZcn*o^Fq+6
z%IRtu!~I#e_4gdRWVD0({l4|<9zT8l`swu9>*p)+e|V+5vqr@2WSUp(m#-PKcJ%qm
zhwgd9Bd4#EFFfaw7K>Fx!Un-BBJU2LncX;T>$=3_j?(XT_!J&Eb8(99J3kxF9F?bL
z3)QFWZhl>S=AahWy`q@dzzbF}n@gsz7TKIAQhct%_o)SAs?(<}p3x6gF5Y@L@o0$0
zs!75zC*>>{r%t}Jz|6klk;09qN+)O6cphBinzGWT^Lr`#^i`2Jw(Sw^|FPpz!Pn>I
zc^#rM6V{((o|MdI{jjJ<Hs~?S#B5%V`-(ATnYQP%Hwpg!)$aH|U98e~ipRzK*P|b9
z|9-=8QjEvLM;06QoJia7Lw29mP2Dy<qju@EXg|SXy@$^a%sO!Yh}FrzH#eKRC}^$b
z5`RA<b7#9?cKyfp2^PmcZTkE1{c=gR=Nz6DszTe3O*TFLfBPY`|L@;xeiU$-UjNR0
z!@l|cz48|-LJl>aKWbf5SKH42aZ8zH-fPw82ftU!m<Ji^g+__WJfFAZkjcEqA3m~#
z?RwyQ{ISr4KT{_P{OC5jHve#reDJZiFS`OQc#OYtSgBuI5V~oSd&7#@X^CsxJ+FPg
zoVC@XFRMoJ*OrTWUAOIuyyUr0bW;_RYPXe4OhCe{SYc+T#ElVOIMXhsEUOi*W8UgM
zS^QM+tkXfqBM-La1uj`s8(FnGcFxLg{8e_7&hynKsZZ6qXMQ={rLwlCJmAENH-F7?
zv%3=(hkQJDMETUN{`;q$g?gDJvePE0@NKnHd)j&P*s4Xf4?fxbf6#J!v)(O#zb?%#
z6StuKhN72(C)y>NE2yknqqQ@!k3IMUbCN>!5vyGek`BDlcYZi1EPi-x{;tcWN28Oy
zgeIE3;ECU%SSmKj>hk;r=6?d5*qrqvp8itWHUBJMy0z>4cfF$4VYk1}nSI?acGB@}
zr;I+D97}%iu=2IZ@upybB%UpXXIsKgpRZupJ=x>^uKle(SI=#GKlNzSooHWsonz{r
z_Uo1(ntnh|^yHQIReYA|n)TTqb1!bYq!PAm<pizRd2?kwT<2X{-Mg>0N$;$V$&a;R
zHlGsOqK&=?e)69F#Up`BZM*30Pi>N&*ZyS-IU9d??!IT?>ROMPfjJwy8N6Q!osa7~
zF=48``}*g$Z>9E^{!4$WXMW?{##ukBi=OQ_y}jh83+ptM80&}^Vj`ArYW_UXe6j4E
z(Z?^WLjTxNNAcbi-!*&0%D`YK$iSdRU;}nZVsUn6Ub<dECHO!j3!Z=T;vIA3=PcN`
z-giIi4MykLcST=cTgY7?-E<%z$MRyDcbm%kvt9qbD?j~iv3r{}Gh>cdjmN|qkEf<J
z|4M!y-7h9Mz3q3n;q)+-rq`Bx&PHx|{7=V1c5fT^)c0F&ywf@3cRuako02lV)3WXS
zcQiN+{~rvVn!bW(+UA@o8B-l4)LL~-_?-nJ*KJ`{Te|5Cm+IM!FR!kyj-HpD7qEIt
z<H^dFYswqAbQbB~udA#7`cePE&9>u){SP1YcTX1X2$|MBCEFuH?NV)n$Kt?Lr<uRb
zzAIMTet<{EeW|mfK+2PREwioe+&`T&R8M|BT6?7U)8d<JK3!Uy^}hFa&H3*cI*q9t
z{`|@mjQg{9hl2cb<payFt+6$E8{JzJ$mwQdy5~w&??RCs2N{}sHwY}1@V9Ms$vpAx
zr`$V>gata&4cl5HyLul^=&WwMcl3_S7N>36J8m5l=}~&Bd;G?7%@s#lO&^ynPukKJ
zbtX#Jto13&6pl_uwau+FnY^@ZCcR+NR({MfedGH%4V&iW2F%X4*<`Tqc4x-(H?Eq-
zY!jDWlB|2Ly(7Z6>C*|&ZFbzu)3?VP&Yxk#7g2Jt{LCGZcP)1p<|RuhpICHh`LC7_
z%Z#k0BGWu{?}#Y%a%!ejWj~v-f?sEOP=sW+U?ki1LlIT+>jQruJXl$Is^!bG4N?By
zj%Un|mMJXgI&s8bt~}ht-_m%G_9+9y9c#6_xROJksVqKz?Kam%!3Xu0HD2=b>Wg1p
zos_F;>D;;6aGj;7q}vtQWlN>6Mq9PcHjcU`lP$*SSabVL?7=IpF^}ez7I>drGwF=f
z$x2nre3fOBB-WSLJwN&2f%MW#@pJyjD&I4C9`~xr`oY^u&No?n(^P9>)gJ#!4Kh0S
zd5_SV34*TkmL7WNotMb+;?Iq%8#n_6ulugZF}o17+p$Rhdbs?3{k+5e+q=ud<1a*?
z|F6Dw+JuN3Jgp*TJjdIXpJe%C|8Vgn(f=<G_BHJl%rF&D>)B$oEOx28apMyEYa5Pr
zeph(pZs6*tdyHY5MadL}KbK;|;~LE+O*_tAU^{KLW_OJ2gI}4q?nd~=um>optf{Jw
zVKGb0nrd#lEn&rG_njSm`llzQ?p<2?`Rk3UZow4Sti#sJyr(VLzS>mG^kdCE-6{VV
zcmJ06>RQu2ucT(tEjfwb{=GL1c`YhWUHJKa<;8>>w`He&)Bh@Oow!qEqHNj3V+>}k
zvro^q++eY6zQ)RcsTQ}F$O!3_ItL#qJnZY=A>mu&y*KVg-JU|tH5@{-lsu2vnlmc(
z+oo;W^{0c+Vxp4{_w!Qk&c4aHZy!I<-lEd=JH+F)oyY#$)*7>7rWWvZd{z1K@#MxV
zJAR*Sx~q-aYf3j+2HdaOwo@!UR9Plsm9u9}UE~V3!mdg`-B`EZ1*cQ5SBFM)&%d)P
zVQ2oSU!R?}dl~3<yq$b%cDvX2j~!o^tnK_J(qY+f#B+9aZRyGllaDy<+Y-0rllNZd
z`gc37dF>bI&1kDMwlm&$*}Q$j()ks8d4d)9@4s`i>w=w9#xhoUi32~Lwc4JL^HMoI
zZ??ht<8gNbtv56r^y=PmeA%3vv7yot%hU38&d<{-l}TU1mR}%H_17}&)Ish&%KKs~
zZye4z{_r6Gde5&PcNdlSR!Tl)-?3Wpk-^F1dn^6kysRp_!20pm4ee=~R~D(Q4&L=7
z$yf6B?9!<RQztI3xjOOt?%LOE_u@|-Qc*E?oUMAOoJUq~=f(X$-45^nxM+I78B;x$
z8*w~$Zyb+nXxrmifB8UNL%3~-<l<LLwr~C$f2FpHPwuMiuEo-)&b?jk<>8<DDx$;g
z*OEpV&6$^66(qk2>0G=QST`}?x#Q)-zf+ywNM2#Tn;NYXbmV_(;yII9+bSOOXzo$G
zEirW(ciHu#Ew@b8Ov;jJ+jzmhpxH?GQS}l_)!C<&9?y!jd)MsGc2j)y&z!d_{Qjs;
z2rGEYTYU3)^g_>F_ojQP|KPV<Fq!qs@`-WBwmz6GRCH$!>)x2N&t9K2SY7+Wv8ZUR
zQr?+-o~x`y-{Vnh3HSTg4=rS6U~m^;U{EAfOMsfQOT+Ky-!>DdyB=SdA(ygv+Jqgi
z5A&o%JV=?naf`MUb9ABvlkVJ{bwVpAh6t^H@qeGPYvjbYCVa2hovl9Y`~CG}pH;KH
zeawH^yPrf_k7Z0-Xkhbvg<3)A#**fX7IysS60}yYee}Aw@#D{<7K`@FC+>5sXpiDL
z@qv#!a_SNuwn#~qos(2mJmY3ZB~D_{*IvnEptvNl&3j?<gR85<<u?Yc@LW5wah-wc
zXH5ytwg=CD956Z4Vzz4A3#p*Uussf}mfDpYdpT7&Y<69FJNaf<%$mlM=l7;t^m)I|
zJ{Z2%*!)qSwx-Uzv(8;pOB**7%{czqUp{Zr%Y5_8_tW3k&t-AgFUEQ_R?GF=b=@=8
zUc%xQ!aMKWzi~)@<Bi+5*p}{I9+vuwl~GJe+W(x!=Q(B>2^$`<U23|t-fe<6>(gzw
z4%sp-y}ICpM(3FuK3Of3><hdK+pM-~U)$E6o!jH!y?T$^s*u2jGqHkRCekw}nqEpe
zrm=4oZ`6W0htAEp8P(sgMDDy-h_8#*#Y0oy7)LGGlrH_`mAnrx&pUIQyB5`%2e+uD
zD295zkLI6#GVxB!o@eD-V!{jleiRODSk>bo<7*$h(Y@gO*|w7MWtz=8xiwkJE#CQN
z96bIiQ};aiZ~0EuXYJP(ullpWn-%u;zW6yU`}>}lNsq+aMZ#DgE6q8OWSPbC{F`de
zKMVfolefH6=Dkl5k1N|axo2<6p2>SYPBORd{5DDcQ0j-PKj%DL759B^tY@Un!?*fp
zHl;m(9dq>s!*$-c2S$9KBWKTd{B1CY#jiQNMN~@8Y<)<v)zz4S$tujfu68Xi)GPE`
zmoE!GxsrqJP1c#xNm?sQw`bLN6+U{r@v%9_bK@817-X;OzSvcyevr}i>>}+*8NO!O
zb;i?;CRV(4xn6lrKH#{{X*R{nsTMgeN?c{M!{^1SuL$aky1G)t?Ics)P1~5Inv*7<
z5xB{I`Sxl>Stcvqm;)s>b#?bD-7J$!6DL(Kvzqoc%k^cf&hK?!%<P<xf4jcn!t_e@
zElaEo_HR$G$>HB)$5LJV%I$XVwzjHAzdU=_%g$YKQ$^JOZj}2<_k(43ESvc^zwG0W
zv7WauVRe(x{#)C&#r&^4v-qMiOOpE4&K;%a-)xxljdzFSO}4G9jV&%tT6?l<x&E)+
zsU%tXoL#^!gw=m%rHjI=ty_h*_5EFOsdsshxHzlH&FkEm$rUTS`bs?|8%0y+Jlmvv
zm@TsH?CHxttsYIksd35YQ`6gqOg~?Rni8qQ;)+q_!Jew=*)~f%{2e%EW=t+D6cXIm
z=_qWcx#PzlSqJv!gUeT`Zx7yXv6kt0+Sx|}Ip@3AU9J9n#dmHF)3&GcleRWTY&pfg
zG`nhE?$-O$e?9iBmRl)1rCN1`Z|Ll}Pjg*12>CCmm2;ceep2(uX?@v4*K3Qvub2{|
zUu=D7l6h}$)Lg$Aeli{Rj;jTUmtM0!b0+7H=dxWd)|y4wg@?Y13FFnvRA~R(c<Y2>
z&tc`fb9&CNc9wO2f1Pgrb#`>D`PJ-$@^iX7Cw4B-y7y2)_eET}!KM@GyI%Xr#n<eg
zs^_cwQ(F1FS$5v>Wt%T^cPl;HXyzlC`@XE%U>9HeU){XfytZAley`x3rhjbmQ{#Yo
z(ZwD&*Tl#jUZTD4;i6;rn8d`6i7Iqy9c}G2F`AmEly%0cM$qg2%-fS|Gd@XfUbU$E
zO9TIR?t5#>S++c%z3#Q=QIU`LE<EvGbGBve7M)qFn_p(UG!JCHnzsJM>RIA9^H^+S
z3&StGNxTvw%6is!m+Hd>{B|}vUz3VHmc873d)~}t4(&T%HtU|4w{&WIg>QV*#;ZMV
zr?=EfY-y@j5pRxFdGh$tqqixRGIE7!Z)#`mJ@V&A>$T(Oe$)y6{_s2aV3?fiF5hb!
z-=tIuyT1K6=k$Kt`?)uCWtYAzj#<X*_$Ptm<?c@xgVOJA4erjbe)%7@d{63O$m*3~
zVE7%tz@SZ_d@su^E=|lSE-6jP%-1WZJZf{h?6$?E_y4#`{y1bR2X1=2BzbP(dzHS)
z-!kKilFBFL$;<P)I*AE&JrP)vn(JqmQJ=g&XEhfC=e?BO%hRp+H@0{$4A8hDdn--+
z{rwubc^vcIC-L_)%cUmiRahmi7djvR;o&;#d$-cs3pe>4J*$+w`|;e`vYiidPNvFi
zY`Fi)z;BvCf9jp+uw(!3|3CEMZu%RGQxzO<GliDNsXfZb&YpM7+idQ+&pQ4;OHLgT
z`epRYHE_;Fft_2wJ~=r#+<4~FdH%dQ-7{MX7tUBeQ(j+K@RLZCcwF0MXFrb$LF>Ig
zDm<7OF6caoW}4>zeBSw3mYrKuug&`TELrF5@|?LHFWM?6#b&9*Uf12=o$sW$+0A;Q
zlE~&XcZvHe+@y?7yGra}ef3n`_+NmjjNXp_UrqQb7!CYHIKS*D{`HGH-n^k*=~vf+
zulJb>UbvdKKb&3qM7OoxX|6+u<?a&w`s#WU+dn^Fe3<@tbNOUlw*O~V+3XU{lo5<I
zU9fo5N+Xj8oc#^eH3z$0@6Xt_)$|Jg(eSthrA+Z(mIbTq`nl(*^GQ*o+Xr%)61<*m
zoOxn~Jk#l=%x3+;+hWwSw>{GFtYq`nj5{F~!&Kd6&B(&N<I6^N@#_!HNHMD=&#5{5
zFy-)sqs4Q$j+_xIWLSMrNB?w?;c4T(hG$BT7<Ff#W^4}Q<&VB3^X}{<<sD1ee=|Fr
zK6OiHUhTuWV^ynLKZtLcCtnrB^hCpN`iI)J2U!d6heq!c+<sxM`kS-u_Zw^u%$oD_
zgw%nB%-e)+GCdRXX7+rzNMJ(KBKE4AYu85q%qiz$IeBSL-sO-_Ib45q)DJM_x6F@q
zyv|^!eeKhs)!yG(Dr9G`U%#I5k~z~`o$2N0T4F7g^}mWw?(SB8UgeN}B$#i<<vJrZ
z%Qy1xUiTbcdDi)TTkXkIw<T7#f7d7+d?r1iYu??g>+9}*Kl7^k>&MMb4<55}@0?!X
zn>Xh$)5Js14x1)1G2dl6bkC33<>vO=7oXp~SNi>m+SDIzHhl};>-7Cdc>VjD*u<{A
zH-h)%@Nw-pefn@u${Z#pgIJ5L;?@7#f>*!Yv3q&9$lCUVU1neZPMs2eD!RU_sYLT%
zdx(#=s`sa<SG=A46;^07SFO2b!{2o@FT~v7kz~fomfs6pYmfdcSW*?bL!oBc{W}-_
z%Kp`ph-tt0{&>OEK$#_XPJiK0TV(0QdTA<4{N%Sa%Oe8c|K4-w!{$Y)2j*Pd9qM^I
zspw`Rhtum&O~dZT8=6J(ZKs@ORn)sYNBG74*5Y1;?H(&O_B%a`tC;w-u_IUTzILj9
zM`S;ne1lwB{9Zeo*0z5s-47N$JAQg23-{s+_f%{>3T|ZuudKav)9W*T>Nd8e{Ruip
z{qM(b)QCU#U{~V`{l<m~&rhoyE{-~+`IE)<^z~@{Smm56mJ3@dS=^uPJFlw2_+x{@
z*49_06%|fik0t(n3z(d-Ilbh^mrTt`g~Ib)M2=|R3}@<0*}EuuqkLz;bdK0yMjp-s
zJW`V*ytZV;IBRS*oymH6>U6DnZI7Fbe}3UPcjOBrdsOTRlP)Lo1+_m!a>U<U{MP&X
z_05mZ?=NeAzWjZ^f1jOC|9QQByE%KUX3mq@zc0a`kzqeG8@rfkz=U%OwH)V;Jd=re
z7nS&8`P)USTTfs4+FG4`*HZNu)6tX5^XFt0Uz7{6Ho99EnQiu1zx(6;?OXoIo^;(~
z)%VAM-(se$;Pb|?KPkx@4_#wC%5+R~Rk8x3weUr8f99PJ3iQPyr=2*NA(D7J;AVPZ
zm2p&+;2pm5iMoe#chq-YnH=Xivsvl?*H3RhsNPVk<nlR|mc3Z!#50DoQs?g42$j2>
z$rSTf77*UP=X$zk{ILu}j^vpQwcq<EGMRi4kK?-aSbm4{5AHj1yQ^*#x?Kz9cos0>
z80V{i87toz1W%VZ`!8K%-Hz#P59A)S#C&2{*U<4Gt4S~VXr)9(M+Q^FtLc?ZX>y0U
zr{q4X4k}(JzHZOfEfq#xjmMKG1$^TSaGrOzUEg%GXw1I=H>vA8Jx*Wp-z~cA!Y7gZ
z-m9xpUoGG3r5&~4bq*u@`rVE?S0!Hlc=PzDzPorq`nfvGUknlxUxd^aEO_v{!z1N#
zCO?140izp&=hX_rFaKK-(ZN^EW-?ofouMpD;{V<q{xOoumFwr+H2Em*vF@gc(#myq
z_q}#hp8HyEF>U+t`TqSg#94ICJYw|DOA?CESbafjz20hrCf2L%S<5E`8zk~YoZnf!
z@%e?1msZ$);xO4)W4Lyk_~nZSSf8=keYf55=+JkkwS6ZU!n^ejer3ttJ%i=Vjh4ts
zD;>PgGauntpTxi~c<8h^|9sx$?9H}Y4CERcrt8htaCn@|aN}~X{T0JKWnLR*eDsP<
z2<v>txATamdY^Ic0VR9cH*a?D*1voA@87u_FVELVu6o|O`+Xl{xGu-v36Y0q&A1Ws
zimCgnml><t6gdNH2?xLZPguUx1?gUxvfJyDm<#)?oY1=9zt_s%-jzOC%UA8?df?{5
zi`(Au-a5T>iDq8>+PNN=(htwiF*Mp(@$J)}vp-o><*eiMKA&M`?Rk7}d7;?v!WAX5
zI~_9C7VB#~Yf7KBeBz<&QGzx9Q|`Xb4>f4|Z9Vm8jov%27KTqt_|6>czBh+!pY8QW
zEcRN7ml_`GPw8O4AF!))y6%e?8G8S&m!}GKt$Dt~?|+ujot^9aOZKu{o&RW&)U|6b
zowS>r-O6OYd+RKk$97?TzB_+zUPr~LTUVJlx)-jzR{PR|F)Mpz?D<1;n%*|ai3-k{
zpb#DS`<|-WyoSxT-J2g5oeG?FEK^uBp=nY&TgM-fKR!;YIuo_6A8zB}Hs8L=VT<4<
zqlKkw)HE`dY(LHyk;NhU^?Clzzi)G!?w@&i`QnRMo-<j0U*9?wJa37i)ZX9;ny=eq
zW(iGS{N2yo!XV*UL8v^hp!ubS)xE#$8y3g2iyrlj|9J4i0YjHR=Z;=r%Wg@CdXV|?
z;#%=V`l*cX;y7BYyF5*oDs`E1UAcT9`(4j7w)W<He>VRsH!nZ<_uY!|k&XAKGj4%f
zLtMSZ>%8oaEA;R?FzxwY@a5m(pARn{J^GV<xoC1qq+?E`PEqb*?b)#cc0zNF1p*(m
zTm1E_*uy=~RBc`V$_ooh`b;?wyj!@9(^>szT-b`r8{uhHbFZxJF-w?QR^<3zanH78
zx0PkXeG5c|?61WAxP8vMJVt%@#>WrWf4Us}sdI&7!sF}md?g<i`l((z!|FI?mHW<w
zn3CBl$3D~_(AD&pbhNr&aN+7y4<XL~hT*@ZuAKS(*x4jREWxVXYvTk)*~J=Z3CFVD
z--}ac(yrm!uGntPuY2j9V4XW>#s9g7to2o-B;<a?*culG6iac$UrLt`$(SJ$dERpA
z*HDFMjeMr%#visFC|0i5^_IOI^uI+>K$N$#xJXH|EA-fVjS~Iqrz2%vec>+P+}3_b
zJkpS5k2ANJ#q<;GIgtqqr@PmO96fzuZcO2(O(6>Q>vXRbZOQMu=l6k2Iw>anWM9?U
zMO&B7W50FyTKtxKoB1Cau?H`B88fY=FFk%sn%S-?KI(PTzlyy1cU5BNxx&OH!R~SA
z<sRtOeJ<qZ+8yMaJ!ggENlnwEw~~35-7uP&H0R=*iSFBlt$jaF;9hjV!uLQ$@jurW
z*N@q#zb|gk<lb=6cAHkQDJ%P~qrYw{v1XY}FI%&9F1!A}@=f1E(w0Xo((QQE{%N9-
z+q1-LLZ6J71H`zLIaimL%;uf$Z8@itC&Hd*NvUwnlfS`&dw-kMlvhN|pQ`cbLB+0#
z3l6k)`Cnx}+`IVbe#@&%FIX8S%y}QW<->gWWRI&xiaZA5DgLuEzgpW^*8Tl=_38P^
zyNniG%=p>gC3s-(qpbR(SV?!gLfL1|jc>0tH2$4mHIc`#<KMeC;i7D5hYRG6F9=Rs
zIepzpU8hTn4qVgpxLc|pmna?g>zDb&i(eMiEwJA(HM=!xcEc4moyygEY^OpErsTT@
zXw5oobkk#{i=y>{iAqZ^L`yp7$lj{D)y4O9f%8W58>YE@OQmy8?wnrdwC<o`+_u2N
zXjS&Wcl~{x{bw_l{ePjs;;eXj*6+75Zx`fRHt#pK%1b}}dwZNu?N5e2u?G>ApL>?S
zt)A}T<}X$qmKgUm#oMazR;lf}4T<m5_O`#ROMl*<U!Q(wN6XTZt`25Rb~WzER>x$M
zNq!9v-$i-2zjIQYC8sfS+ry@X`T@`8?=|QNkD3+4lrEOe?e$}|f@QE`YHIqLR~Pm$
zyq`Ti-Ei518lQ8kIn0(bnAJA)Hf&w4>?cv2uC+#f-Q8!~s;(-pI{HL?+QroW&Q}BH
zwpUJ<@!j6;qZ-ubVcFngV%(PNGjZwbZ<oV<oegz)J=3A4*thQaXO(36i&IsKH_OH_
zMeTUDR<K4kNT}DN?bZDSN2cD>yJGR`OMSo4c9~hP?oBCAo*#TZD0D@Jx9Lr%Us|jI
z|26Gdmj>-W>A551Awx6!n}=K~jlXNTo+*EqE)Ma?SF1L7%J{mi>h7;uxkU@Cwi~T{
zdZ%ag)<-8K`ni|X{EFfC&Ik?QJa{l}t0X_)wn>Y=TfT7c5?Wp1o|WXbHTlM+qWB9-
z^^TrCwEO5GF#)$D-#*^a&`Ld&{IIiR_HD^YH(Y*PTXx~}Sz|laaA_09j$F&5hvy!;
zcy!^b6Jk%pzAn&I%hJ}d4!C(zN#f?-@=c!2yBjz0R!-5c<PusG&U!C@!_FPE-o$A$
z@=7}@xH4<BsLc*}7<+Ki^%R|lON{<?JoW#vFr3pvtXfjz^{V?t;tZGe#qHaX)PEr9
z|HOzl!eYG-N?G@OEM0XnIQd5PLhqAdn^=~fYGRasuJxE->xjXOwn^>>d|td|FWGv%
zu+P(&U0e6C!12ZHJ=3|ABUXeun#}t1%53R;^~Hi`zVBbOXjZe=kx7Ry+867c{4f93
z=6>zI|Bv5QZ0QJhX0R1;)`^#HYLeD#oqx<|Ub=IAhLYi7p6-yg$}gr};TI=_{Jt>R
z*~y8ov0Kby#e=u4?hE<09$d%aH#^<DAzM)5evPO6>#Y+-^<$^5dGKFse)2MjlK&#M
zMSCt(KeqL`e|Bc4_cg~|GuEiiJU-{|$BOMD3?V#Dg&S5r>J06=r2kfN))vMe@AbTG
zCwa5~n1ASZg6E2)hi;GURM$OHY-zl>v2gYhRkg);4DZxkKR)ZuD!~=)3nE^HmhqHZ
zGj3(kner$#_bv0jm(c~$%`ZhZ&bfZ*swV&Pk8ivsZ3CIEKiRpv)nDk$9uaL})0T53
zljVMhbTdELENZ5c&32ECuTsJ4;F4uu-g6pg>0Vm1(pd3c)^uI(=+$p#CFXneZ9o2W
z_p6@<YcH=Z<<a236|i>h)H$;gL}t%#GJXC0g-Y{Ik#>u4_cC8Or`p*Gf&R6(c|}*T
zZ{ELgZo2j3Yr59<yB<f0-I=x3{N0?bj~jSiUtJw=?EJ5}2j-PC9<C_W-theHfw&UJ
z+wYmaZIZsxAA6wenCykJV|Opal{wvh*|hC8Z|;8KTY2JJc+)rBKgwoZ9ecq{=Fq=9
z^DSlnZu~4{-jaUzLfP$wZ}S_rUFUrpslDZ{@A40Oq;JJ>o7npY>zwuvs?+|_CHiuv
z>fSvUSR;xVuWySHnXkMfivP>AbBeC9g&IBFGp4bp$Vr{qcXQ`_`AhHpoMi&ny18!K
zc5>?3NiDCQ2GpO(VKMs}bEl{0sNt@qxxd%VS6TJV&T%!nZB)Sy;hHsp4Ve`i)5O^|
z&Q$eX6Z$qS=dCf@?kh&d?+Y{EzP)~H%G?XO8DH<$*<SY$+;!-nqx>T|drs}HzVm$k
zb+yG$R=f#lVOv|b?czM~T#e&Jhe8?OL|t~3K0Ha?G-czA&8nTfXSc_#Sj)6&%7?3m
zZ2xu4OAWVpv25PI?1Nbb3TF+EE)B10dK$lw*Xq1-eU#0!71vMXc<APA(A$31TG{00
zMHThw1yOoNbAx>6YVoRl{(D!kZ<&I~QESnEVtXv3{8F+OS*|~^nrn9G+Qi!DYP<fN
z<vbM7y4g^QAwJ~RnV)tWR`dPW`<Oa4o_oO^jn|DnB_HN4KC}CEskq!i>6}oxmwWDr
znA?Zm>*{yRo8YyqW98%>9_NY}k8Ad_Y&t%1r{;q+uH~XWef-4{J4LvfXB*68{4FC@
za_5rg;z<jPyxcz)TZy^0GD<!BqR~39=jC=&i!}`ix=Rff7|n91jNbF9iCO!yk`8a`
zYKy;Gr{AcHT{~9dxX|3m^69obnP7=85v(l=$NXoo=S*dLA<x2d*IO&*`-h7cx{SXZ
zT(eRwPGDVWg;Lg|IPS`s(&l$-`kvhU_CVtIwkH=A)=b(P)|l+xB(iAz2i5Qw7kMWf
zSjMcvq0sbosz{Qt3-1k{FVm;aUU}krbwSt%h6blShu(KqgzUYzweng+Ops0Li>k*7
zdlPqT*i?B!XZf+Edh?h)wy$^~9x*9=e**t%p>r37-|jw|5L}!sxOeF+>C{P@&-s$3
zB<_lvU2v7LNLea|`<l8yP@Ky}c3EHXncZtcobq<Pkd-l5xRN^|;^T^WcOo}jITR7Z
z$rT$YIn&-*L1Vp^=>h)r0gTGEZ&oy{;EYnvzPj2VS}QBN^yRCAZnw;4>NT#)GW`1T
zKjZ&M<+O7(hn=c8o8nf!ifG{3^-z%QugBgE-}B>ENAYkK@3H?=nXrHJLUj!}wZ&m8
zPrNyNImcI0hxu@-{pS<ULrykso$)1W`f{ezdqSVFxJ4OosM)DGgt+DFe`#(KRV&um
z!FEe0<W>Bu@`*-0;X=E@16_miUq6@p_$KVgPM+({O3qyJFXn12UBGl?)~yD<4Uto4
zZ<3r77TK5;(5YbYd)n*E%5xjH2Gma9`>Z&~?TeV@;ho!3)aE6=2$`*}=q>4zCz!Z+
zg-n0jPMMb_Uo<-A^_S0QF7a0@|0e74;i%w-uga@-n@`EMbojW*XqDQJQyWe;XRp>i
z#3(;`%60zt7t=IDwtC9N%)J|!_*b6i#}-RrErY$E4=t3vc5Q)O)zt_~QLR1vN%K|K
zRS7FjEdH`NEy1gfJ!8f8le;q5e0x8c7IB{JQrrFINyt*QB^zA~Cca`!-~a1}<le<1
z1|s{`FkW2md`+V4nx1N!b7jEU!n{wdI+j<f*tQ;<*7d_Zv~jwh@767ML%g!}mhPVY
zss0%g^T!#>)pq-zG}e{Acp|ue+teJF!bG>KsB01H^|oC#e3~)0G9zC!tS4%>$*h+T
zLNZ0)`RfK5RbDl?CVgo7v|~IM`+xplp_(M8ea)AD{;j_s&YRoM;&=JPV*4YmwR>M^
zTu)1+O=u{?rI-8>d)Ke!)z+z8%p9x!W{H6Lm$2kFcbzXXmjAl{JM?nsr>8nG;pJ@8
z7hgE|N|7bpKS3t*sP{YRs^?!;`@N2zZegf7N!}_*W$mt(e-9pCc&P5hE;~bK;!XCa
zhq7y}BuqnUF6!`_?Fn7l?zKMPlIzoWjgz0&yDzk>|7R0e+UfMO>s7kXiJxk%Vwa`o
z|IgcTRHW}uvC4EYG1I4C#h>h1yIoL2Ld}(Rx@Tgr*Nru6H>K%nzWa8``{eRn=VpI%
z5tUx$n7_)yIj2V^clHM_0glpTiZ8WRseU#&vT2XR-rD{N(hd1Og$yAq>wFb$*)v7j
z4o>hoZXGAV^L)b@10KGv#<_o@?{D}OlXLmeUHi3vWV;tlad5xPtta(wndiiuX`Srb
z{a;i}{`5oRcc*3S?IZ4O>bJ{&XolE_Ft{;jnCs<*`YyU@^Gt%1Ns3p~eeSW@=O0+T
zNVNYX%*er2aBrU2;@ufVttaB%`gVwZEZ!>cF4%&>;K+<G&O8~7m)K*E7vJqTFsuA-
z?nd7itdY_GmYr>Tm3)BBZTGjUM=zwV_s?0nK5**F12W8U3|+Yz&WGw<Z8t_PXv&O!
z`6gM*P<zITE35bY4SD~4hSfo>8Mi{t@*b7Y)(vW3-o7pW`}sBD_m9c1)s)#Hy&%+1
z`S_YYrK(>GRhFFDDPw#8ZhhpLYx@^C)b!k(va;++6<-a*9ND$&*RA^<nrXcF)`@8!
zB=<hh*s~}2&j+jhmW$S~Xl<$b<+lEEPycK0D@z2}jy;GFY=7m-ae8*z{f7TiFE-V9
z-b}pl?#2xX2d@x$tM-i#vrJebrXF4Uh==`Z-eE_poi@jx^ruU{RA}b%44*dhk#KCZ
zP3Qv?`O6VZ85e$KN9L-Q=(>l@JOAh8$&<%}-IGidowjfqcJXM>%r=k~(7V4%>BH~I
zSqFtxf0Q1)D`UbhbMc_L%G9}&vhT_LJ+^DXN=t<a8zO31V%mkCs;Sl2vYrzVRn=@(
z_n)K2^+#{<@%_`HuRjnwtHS;(fB(TrzTagM1=9a1mPv2%Quw+)@v{FbF$IT3N}a!*
z@@C%%sXn!J>8|F-qES)o{?oEqdzNMJ7TxE2Au3go@}jhj&qZ?f?2oPOhK9d7O&`sD
zIK4uR|J(`>Yo0f?nF4Q?S6NO<^-svqd8)YFg=6Zh)ppNXEhL2n81IJ21}vL1J;O!g
z0N2N7Qx1N-qCbDd_LPLAjLjZF`wp+kT6CGA;_y|Cj1Ru`87Cu!|NlkX=hAO{zw{vs
z14A`01A{VwS&fQhLo?XICNlxhO>Y@?C){)u3mcdWCnUB`&OLU?>;;cbYa)k<Yvgs0
zC2m0*_b&Wj>%R9!*qbfqmhrchJh3g`Q~j>buG#)wzFd>_6DKJ_pCm<HHH|ME_r!aa
zD@n9HzbDxfy7A%;A6=gF`fZGVV-A{#esGjfRTT4A3U>87mB4!1R{x?_yM~unbe5oN
zL*+uq!lp%&j(xtjr}A^8NR&j->eK|TgC}j+S0AvdcoOwdgu6l_eowPu!Bp`XoV=W;
z4R5!!Jgns1Vf1$PT@j7x2Y7s>!w(spnY&t2FDgFosc@F++{@du^|+ohCaN0nE{}hg
zzxZSR_Q&_t<?CfD9sIkMo(P8<9Zco^+_<PE$R}mdy!@Pp{Sj|+a`{us^4Ff)Ay}bg
zyy)AL9;W^+2N{}KqaH}Q#`7x#N`3O(*f^D;Yn7<cG6|#COqncCcDQvF=<t+lpDSa&
zeoLYu(63TcBQTOpYh}>{?%AtmteGgbIqdPGEr%FYOWy1-ik`(dVavf{p;)2*qK6NP
zzG=t=+}p^T^)a-7dv9o$&Du8~dnBDt1ihTI&zv`A&9B7TC#rTAiy{x4eXj4qcxn^F
zB8~bbDf|hoW~z7BW_Bq&-s=CB^WiST*Ol3IAN7K!e3ALT?u5AEUK3@nf4oK3#?uZN
z^1i<i^8T~s%74L$KV6Rn{8FBAmVN7kJGDO!E-&6cRfk_iy!T0xwxrplhharGJ@mE<
zUH0g)|Gv-E?s!t5-tKdHQ%=Qw_$L0WV)NJ1Ri|H_URW8r=V7D6?H^xmP5*ad^|xdn
zkA0h8UuQaHHPzH>OW+k_CGTGXe^}(F=A4MsRGq@cooDJI9LOrYIl8nz&7;RAtYPmd
zi5Z&;zL-0R?r!8#T#>!_ROpNE+bhyP%!`<;FST#S@=a%E_RK2k@|mf!Lrg8D@Xq2D
z-~8|Gx_8?<Jv}vTvFK&%Z8^z)jf-}a6>OJ|waS`hQfcuoM8|T&r`X<yhP)NOm7S;m
z_dRPmt9NPH_L{)|xBJwuxGPOtd*fKhY3p5YTyu|ezlvBoO|MP1f$68_t@HwW$?aPT
z_g*v%@Yr@@g{!XF+RdT)MLg1PGKJ#3A6LEW+WB+o9q|RSJC<!_)Z}PvInusLHtS<}
z=d6?`p)Yr2JFMyEvAku=wXZ~Ko*B>Wx$S&K0<81RezmW9azjsoxnPk*W=Qy5Em0k@
zug6y}$_e(J6*y_5uEE)Lf<LOizT9t>A0rrkBj`{66>m{V>BTmk47zRd9--Mk-5<VS
z5=hmMk8h7`p7gHxLNn(jmkrA0%vRRAhR2UzdL!^|ru^=e7c3llw@>Ol;M;!r%{zy*
zwN=T_o@a$!F>kypqoKNP_1lS|6IGtibLmen5x2<bd%}OW-|hGGrSEs9#H=j)wQ_Z|
z$^@xhmlv<7F*KQWaYsRT!#w#rKmJ~Hly){hnbEmR<Xqe0pZo@D`pG_iM}HVgv+PPR
z+iS<>cHN_UlgM1wiIx&O%F3FY7H?@3^!aSEz-jsG1K9z)&fS^&###3N1X0%5YgISu
z&rPkWJ#KGq_0mg1)W>)cN9m;#H+yazTCpZ>!^>^yTW7D}>aBH~<k}gzCpS~ycuA7;
z9=R)11Sb93kQVl3*Mq;#^Uk=1f415&S$X4|Rp(DM&3?7@QuMEC!ClQQ@2XzKRjqxn
z+Ue%)U4DLN*SUSJyI(E0U2o5KebjkhudE}%o;(Z;*$NmXWJ+p5YF<ieUUFt?v3`7f
zW?p7Ve7s&k<=e>Dc{1BY|D9j1u!Lzh_nKoHCvRzB*j|vLEtnMPwnT}SC9%!=@Xe*B
z#xj#-)|xy16RmBqbCTEfzw~~>oVho>FR;B`zo;!YlmF!5!^J<(rTYJT`}=ymW%cT!
zn-P^|p(l>54Du{K7r#|0{^Vxylj(1!#J?y@zEbq`NB8-8{~PbGRoOo+%zV!T|4o;2
zdyDUQ1{xppTAV#kr)6r))wO1Q`=_nVIbe1F%+JurOEO(dm+k#o;!(Z)?$UR&l6-cD
zU0an_x$t#Z=p~t*nWrlLT>f0MTFgyCMowby&nc&`Y2NMWynbnIN#gTpw)oOjMXMz5
z*YDowcP;r;(5@|$7Wt&^(bN4Es`^&PE5bv)`1<LHRm&_k*%uvt9+G?3;Q59_izB?O
zpJ)Eh)+(xUi0Vwc*?1sgR@W-8;D3|uSN~LR?wR~y(aDAPeou9N`(69@`?oLISG^SH
z>)lrGY2xm0mo(+@(u`SkiRZZ;_`bwn&aQtKu>0}U`0Yw%wgzQIMMfS+dUJZWJW%#X
zIqe$!!Rcm<z31kKQ{z_IB<i$u6a*x_)+wJAen=;E>%*kPxq=@!H;PHyov=z;G%IL!
z6pKA;ecR(3N>R5%4|%=|JJdRRM^RXq>UJvu*+rkfzKxE{$ei8zSo>qk+o;dGPKWO}
zctG-IN3GMx92M~&>7}}reI1)>-gf3K)mgs3AnrwN;K_7@4O>oe{IPp3W;1icze_zL
zKUI1bEq$r;c<c5%VZz#Pv`f<~vO{?FCG79yMrEE)?0?RgFF!qfXP(#ABhSS-#dD)Q
z<D>#lZ#C-|yK-K*u25G_weGLd!)w-B$?sS5ZF{gZ=5v(u4>!g`JMxya^4wpq(sR&S
zn>Q{ZbXxl1zn48%eq~W&_bgUknEWVI^YsqB!bO@Pjz=<hnXeyMy>;qh(}>>e;0J6G
z-7=H(_`@34Df$G2<cY}ma$b}A%TllNBk8gDo`T>@n(gZzu#0_b++O=8!IUZT&N|-f
zc0n#ji&+@+80P-;KG9NGKJknMccAN`36D1TTs$d$_ma?T(I;(5rGX6-Gxx;l*cKQx
ze1Egx<<cX3FLDptmt5d9{PT4E{~43{c0KJn(r>5oJ762<{%el4_j;8Y4$hU>@tnhS
zPtDppUHy-BSFFD9WLI#YqQjdWcURUxj}_^+HcXtMx}c$_rZe49=(e@t%KZ~JeYm(?
zZR_D>ksqe#JgK*1E6CE}Xr8UCFJ_qXp@9GSO~r(?Vk4V(p#h5b-ug`6t#GpK>Y|r>
zZmlWVlf8GY^i1z;O%|=IHdU(68P6|plt}jy2^7(~G4t&U_IVp^?Yr}*&3CyQWTUiU
z+Ny=&eNEkWWLNFGA|)+TDd{No;EAW?-5*cxw(E9RZ@wRU@6M9@ckkRuU9u}|^|9ZA
z8`$!<^6lPn@z&W!;SM8(iFI2l&L%hX6i-W?`TL2)Mn%0h)A#?CW&gZN`-$=Yg+blv
zTe|ONPSWt$esS*h@IA-#`+r@Za@14*wk^wwC3edr-R^wg51hkr)Of{H_MFqD;i4Dc
z?bO@0;^yh9a~@4)%<_2=ah%znJ%9I@+iv;s#wKO1(=;33(8V#c{5V^m?_u<rTm0id
z&6)?rPYyi1oN`Y7ddkb<y6JnucJBWE`~9Twv(FOC_USt1T=z1bt9o0z<0s$!c^7l4
z+txIBIowvs^JX}G*)#v#$qm6%6OEld%QB_znD+0=3EdSj4WgG%UK7vAZuh#Vs%#b)
zU}GC-rfYj(&y(qkHWj6}Ph4lrd;3y?&YREAi~h`W`)}TP{&DCEVJ4mTwm;<jvs<H8
z<sVGB{GdfxX2u!0vU_gke@-utt>DirS#kQsnfiZQKCJjKZ%WT(h312W%bq@Y^J=;B
zrTH%Y_A~$5?7FjAk^TNdM$YfsdQx^9&;4R}^c_dR-qY(vou<af?Y#aWhvPLv<nCR)
znu%Mo6$5h&PyGxKXv*u{<vLB4p?872=G27VMW)jGEj~}2mAmx3+jF6^r%fRjmdNRT
z+5Y|7funJU>=svc`-Si7y{$RpX28=4b<aHVRQ!5sS}SypfADy-DE>v8!Az|kchXCC
z3q9<6Hc{^w->z^bE-t5=3*Cf{%+Z=O;kwj=tr0KIwW>T9JZAOZM%mNoiEg0koCK+L
z90#W8q-@{HF=N*Pb*}$0%$^gH`xK4yI>Rdrmi4qgVov%!ebEe_NVYQ*ESRj)9taDi
ze7fh5drYyO<?@Br4-C_K*Lk^dOkHyA`st-Fw5D&neOdGA0g-m2E1E%{rp9f4vwHUI
z+q>_r&M{Hma%}(iqk$WWP1fm)G~Y7*r(wQAnM+?#ETV1Gt|@A7uZv&FoD&#$wax2m
z*kS8yjwiV}`xh_zSTA<?_%=zOg7=H%^5$O4xF|S<|Hp!0tIxL=?zR6J?^5=PscG-G
zc@0Xzi+sdRZb-f`X}d*Wp~ed3Cu=tt%<RA6S3A)!p!TtSz4k<nGMjXx*>4NkuD{hZ
zSy-N7KI!)E@bYl+C95yK6*_Od>Fez9`+F<@N>9GtH?1yNZT4l^D<XS&HvP5V{5Hkx
zk85#zpR1{Lh0k541!0n}0+@cZ9AGqh#wPnFAU&EXssDNC((8-{n$vrW<d^ofmhId5
zF+yZQmaDICkL_#iEGCOE?~5*fmfM~Cb$jJZ^HndTU+(knSnhmZ=u}i_TT7YD@8Sc`
zh3vb}1<VuJ80eb#=Hp)Dzb<)igS#iDw|wx~`O}X(U*@Sym3Xf~$;GEx3$>n_E!pDs
zV~yO;0JiQq6Yt!pQeAm;@%3X<Hcz;%GxzAF+pl`0PXAl%Fo`2qAYc1o#-jr{+Qp$t
z3Y=_jdoD$IEZot)N+hX0qAc(5^r*?q>z|w4S}=#Nw(pYk=aoz5cP*UF%$6*B?2aer
z-?k;$E8XY+JF@LzMV(IYnVaV~KgfLl;+5%5;cW;1O*o#Uo#h@|6kqD|YgN+H2bZq=
z`D{OV_ASfLC->j_V$1t9?%i{n4GXrHy!e`{q2<>5;+cP~*iyBV>L(qqc|ZKUsOR^d
z?Vod)z8UE#*YNfEu<N#H-uQd)fNtggx7WqZ-|Ma4XJ@40n^(VMZ*}os0lxM&tFJ+O
zY*t;qnfHNf-z3pPlcvW`{vGo0@iFUI36mWc4*&X<Y%^g&VZNcsk&Ws-yBt5r#m#Gt
zSRc?FyYp{V%hS1~D|VciteK{1^6i*>rLQr2{ricIt?ykjbB<jopY>r~OYrBN-vS?H
zr|ifP$WNJiA>94>7hBV*DZ5hK?|*o|`^$^2gHzXg-8cIk_~2Z|f&Gp*A9T0$PCa#S
z(+vJ(4Vgs?)+BPU&PeU@dRb-tXHMn0tv7OJf4Y#LpK)pVb>8=TH<*8|xTg_u`6~Ah
z#yfUmF9lWGD+RmWf0<im<XSM@<Qnsa>jy&XuiF)SJ8Tq_d!Aji+8{<?MM?jeT&FuO
z_qk=6&zeasKk=U{bkULz@wpdDCgp6l?)bP<;l>UBSt5?wpRS(c{`uk1p^mRi{hJu~
zYVbuJ;4E_d@QCf|+L-rNku0~Js^_YhbfmqR!r%BLalQOCFRhhtITi*^7TR;}w~(~v
zQm0_%>?kI0A?Z6Mm3{xu|5*L(#B{?I3F2}7iKi8(73}@tVElB053|at$iz+RJ3>#p
zS<H9yva2;-SHI3#Y)?dHgNj31w99XyS@Zu++#h=FZoEt1_wW42_vutsBrK0pHgNbe
zt$Du7lMU)7_2yhZe1sK#tXWiOD^#oPvteVowA9h725et<Etg}_`uJFFna}IDJD2ZV
zU?3>!b8}68_`-EkGq-kKUUpEdQTmVB8NuvRoA<5qI40KrdD}Mm&;7**1%CehU8eY8
zO1#i(C%d`F*PF>mMKl~@S@QO}?ACMg-!nqLhP<En;g0IOus0Lym;5T3{$*j{?<q<D
zo18eU)!1G+y;g|(q5AIZZYP0@|9hhSEjJyNoa$ZJFLtb>_r6%&-8#oDTBr0o-_^TG
zW!WiR?DyFCA=vSi%C8TJ)pNsB*5=5W?p(3J^!3aJi;k={HVe!yJ$2pb?<#rg%3Hgu
zYgYtVCtQ5?C?WgaR`%Zsy`{AUqAO0{$%)#&e?!jnt#{OKO?7y8`uj<)kDp2$a$>gn
z3wtbh^`N3~L%&GETSm!4RgqsOwkqFdG<#a*B6EB7dZWc>|A@OE{_a+?;=ZBGmxB^Q
z**0tk^7f{)zPhIJ@AC8GVqzVWpPw%eJC;<sir@YJti0DPr`ZyeZpSXtT_wJI%Gc#v
zwJ!X>75gbT+_o#tTYCTVWC>OuyIuMje;=D|v)iTropb+vp#a@KueP75-g>OA;BD2v
zb;qlZ{bxb#i99Sl`DddH1H<_u1_pW5v6>X*o=8$+aVn@6V*9q}vDu{me?=nB^Lt6o
znte8Pb<i%0$m8F9N<KfdyuI04bAGq$<OyeHD2Yzm<o@~-^WE$_lVi&tH#2aY`jld}
z^3>ebMiV_2TzrvlB6Y#I?AyB+hwr_%d766o`!Y%W+cncZR~_P;=2><2`@XJycPfwZ
zt$w=e-1F<Yzh9l+|L3;cpU=G3`=7nx&0jSs_0Kf%t3`}+BTr9mz51~JpY*Squclvq
zzFMCXwQWzs^sk#%O*UJ9N;adqZmxOGH1Ro0LvN~8-rOLTkiO@s=C(vv)APY*tFw;T
zZ`-3cnJG@MlJmwg%X}r7{Ht589?H1M;Ad*Gh9Tr^f}Z)wIp#VmEl+z_?Dk<`^gGPd
zFgKES@8gPXS>dMr$<y>14o_1}jojLju~}Juse$p=oksJ-S`UQTpJKeaZ57ww1+n^{
zi_T4Io4eY5b?Cg#jg>p2Rs{Ax-0Y&+b>%SY8Qm0am5Pb+E4OEEjW{Io%FWdKVQP%Z
z(>;N{A>vmbmDZK+i~BTTFC*J?Rr@{b8vZVP@bu&HDf)#{ioZ8%ZF;imfqJ<8;WJKb
zUveI}_Bb<1K6VXScU404>qU<_7p{lb?EUOxcB1j)*G+8Gu7!IZ4m~Vx<Jcr$STU8!
zep7&L)#>+TWuGLi`_I)^mCMNgtEl;r_3PWyl=g%3t$*4{@;znVY^k6Bd6$-_kLl8{
z%A232<?yestoqDsW4=3P?I)#RUiU9-|65|_sehfr%(*-@YK>9dl<U43duKK2)bogD
z&kFc%@BGsHVddN_uLbs9TP;#};@qmxxlZ0?e>Se2EaIX5gT+7Y)1<`(=`7t2z3ge?
zjXs|&j&d%{@cMH9?iv2oMbpmr|KMR^Irv7P;fL=%lM4ZX;++S+Stos7^l-ATuJ)nA
z^mKLINy`%5y}GYQy>r_p(Z{+&f#b{KwyU1^KJ?s;U3@m<wdtaJVGB;Drb)8BSlV9n
zLGq`-l;*eZ-pyO&V5XtLSsgt!#((15gB$jwq#g~}9$Cfvt!v@mRbi=Of&XXecdNKA
z;k&i%-1;zG`*qnHJj*Mq-_ADX(Rk6lO`uIxJG5xtK@~=;PaT<Zx~qB~=S;q>bzZ{#
zz=2|kmb;B-*PLRoQwf?gf1=`34aGG~fA>D~JT__CRc(XM+=~01t=j4(=QjqPIlZU%
zap2+Zn={_ly0g5z_29mc#-8M_Of&l~YUq5bpY*fG@r*Q+pwa8f#(l|$W^Gfu@%-ZJ
zJ(>CsUN5y}>3F?L@8;2^>2pGN$85dE@nwmR*q_Ua=A1s&x+Ts{dsn}jZE-rANy_N(
zJfDb!8Iuwke2P?R6psmgX|+^Q(3o^Y(W<Yt^Sk5DcMlkLf2h5(#q+M2M&M$FzUGa_
zLRlTkb&Egt{k^rkwoxQU@w&>DgEw5hamCF#)Np_I#-}{-DhV7mQUBVuUk|<3bK#(8
z&-{(eq8^`{)L(ql-o|v~-MWKSjXTOt?J;{YpE)n}o{rQN-n&~?8UL7GBg;`6ch6+S
z)bKr-twC~o?ClwuMN|x;9Q^O?t*Wf}^zG;uRlB%*XTAq*s(keH;q2z{<3E&QRm^Q(
zY`J`dlP%)f)!e?Ss;z3V%-g0!2BohNP?J{T*x)JZA}8Q6!SAukdW${!`4w&j^%eHD
zwRW}Lix-M#eh%vWF8@F&V)K(syVs5S`3HQ?glpt4`0w!iYSSBqEvu$w{QnreInN<N
zWSY{tNi#S%&G}nWR`-XkUCej)%x5kR9WvL}MCxADXL#puXYywL1QzLeS6-SPoPBjc
z`U)vt=DQ4^;|^|Vlvz=iG~qG-^X2UNe*E`j{y%>5MU>A?&9gkDSuXGhyV3$RCJWAG
z3$8|s#yq}b=w}}2a86|>%aoS4hn_q)xU}wx{)K|xJmx211+yHEK37*?-+BK^27kPE
zhyH<*ct?gx_Lh8!R{Pw#sp1K8EOzeed22QunzZ=)d!CfbS2t}u^5*WtgVxR*ms2wL
z*4h4jD4!o!!rM?<-aYf`6Z@$P{v~l~S!|zTC%5-MV|?0b?UL5HYK#2qxu3L8e=c|=
z>PM}}m;3CBl1lx0{cnB<T$#!CM|x}Yghl0P%oPj=y_navFfEvIsBiY}z^H~dN{P?U
zvItn73f^>K;fAW|DTxnur~YFS_Hd|TZF6Ayc=L8cO=Ye2O67wA_7em{R!-@6`Ohu=
zW9f{&=eJe$s^4N4ZaC1T8_?_cT)4$;Q}2P}YG(f)UVWmsOS2^^_+fD5)ap;OUteLH
zcxS6Xj7s*x#|?7FEU)IQK3H~q-O2C%2foO-NeBwDCOus6+v)oXj~nYkqgF4`SY>Tc
zSRTr5^t^Y=_M)pyf|qq$@=x+K#aHy4X<&^#m-^z`%%4xWuC0*xCCt#|tHxOvrf`t|
zY~jhKgW;E-xgK0MIXcC-!+J)7Wg4HJC-d=}?uIORzqfqr{xE;Ndvedow`NNN&P6i(
zdlvV#isOx2k*8UrgUrTfUR+%T3)EdD!?I&U*CmMBNM`UFFaOUOU$Z0pi8)`(o=#1b
z2EIc_qw`JuA8!4ZV?OcqmWaae_LK{(Oa{`i1%;awlMm<4-+1{+-`l-v{=36V{3agC
z?O<^{b~-dDqhBXRyx<;#;oOT?oYPYn7=2j7oI@tvym9qpY)(Q(z?B16&bPbi-2L+B
z{NnGbC3^$7zrJ9da3c0tBhxpr`h!dR^PWT}d*!@P)VZ+FZ(87u=}A^8TU*Qest+Gi
zSbcZK+_>LtXCBRr@a5KhzBwgy%d$=0mlm8$u2()Nl)9*tZLK@2NwLAi2F;{57dY=+
zt$yI_{jK+);gUOvuYYDm7BtQ~8guyA$M`L+i;rA(Syy4Zu;@N(VE=^;?du)~o^CJO
z#o!Zgf_LSVd~4>-`T+;@)w-^G7U!~kNT{s(xSJ{ITXSe`?zhc%HoY<D-Zyod)-nTy
zzK6n5jTUtY-*2t6^?4$m>MysCd)LATimeB4uQd$O=cpH7aQ9<w(3*<tp)bV>d4n?)
z0(|R^1fQ`Fd$ze);K6CR>Xrb7K4p9J74|EhXjD`u?Jl_+8~O6!yU(+VJLKxD?6|Ay
zt{%$2lFgUa$XX=!(n{0)Sx0j6(>CtZ%fDu+eA4M*tnZI~F^%(Eih@F`Vqs%KrpUiU
zJu`95@azAg-#%HebL)n?vkwJHF-G|Rw<(>zyVhnNv(mvhy^X2oBkMk1ee!A3_0^{%
za@(fH|Jt$qwvC^;a@DWijOA+kRo5<S^1A;=EX3$+kEL#OjN*%`t`qOxz1#Ohmo;<K
zbV2TbSDTL-T#VSCd}PAm(`lut`5FmM=MIYgJ>#+bi}I;{j?~wg*DStFI`#K=(iGQw
znSGrfXQu7>v?e)xe(4{@*mKE@aU7?cc5}`Q7Co4|h2g@ij4S*V20CuP&1O7)RsPXv
zfA#Ihdu(^Ey^*Kx`tPdEdx1YJZPIhMKiu}gVYcj|r-8Xur#d#fpNto-jFJ)PKbj{s
z!DeGntmm}O^CuQh`)0lC>NQ54J6^}^)g&&p<lOtT>@G8xYo?abTc!TbpJa?H<>Y1x
zZne!+=6mORr>}kO$~`M*iCsIKQhj>cI)lG%yC-N^US9k-je|4UMp}@k((JgemC+_^
zFLS#K;X7yfK5V_|u>XB@@l=h-sphGr;cRA7r>3V?-d&!O@FsJnCx`m#cZZzz?_l*k
z^GvUNXXdXfY!6ykvsSA~Y?EX@aWHA`*~v=p&a}4tYn5}*`|czBYsDw&(=My!_f}{b
zcuthl*}LLRWV!Nc@rX%v5yf|y{2jvI`v`mfTD|?zM2#6@PEU{Wc-@rBU7UBGWwP34
zuFonf)@M0eus+>)Xo<ucmjjd1w%rkAym3$NSvbqgjBcOVA7t;J39WY4Nxd}Fh~cvR
z>J#j2`drd&ON1IVu7AotQ4r5FJ#NA0;?&<E(drSempCvQHuWwuw_d&UlmD@}n~u|-
z9tsp!I{f~_Bfs>iAC_K8dBQBg?UNX~L-q=<wxkKuZ3gDPPNf?gpY30BpyAM(jM^&+
z_D4>9Y0$d4u#t23+ymTv-)>Bq<2O;`Y=zb~;iG!NANH~AWQwnJWtEk@8vVtzd&c3n
zXH_K(*!JJKZeP)`PvY?`%`;Mt&F`&PIKF&*WVB_;pHG(_t1{*)m|02R`oFEq<C;>K
z$BD<vxzj=~Ke1rkeeQ@rS%;R(Bxz^GmIyEP_RNY0oR2*xGdCMlb{x*K%a)iqd5Mo#
z;OeA215Y3B;ER4ID;%d+9lgl8<=e6=u}uekyE<pz<XYNwLt@j+sT&qAeAiG}x9`;i
zm%w{MITajYYQ|<Fp7!ZKoZJ=uer*!H=W<dgQ10OK!u3nHoPTa`*nQgHCu)<e+${}y
zOpOvPxZ>`eIVyH4L3qEY*jxh%nYOhN-&`&nO5$yvs;NKmUWHPQZLEULwPK$dRym;-
z^D`UR>P^0EkFuV2XuF~z_r0)H!Q1D13El8CecJsm#J(ls>%=&1m0h{fCrdUxJSHc1
z_}5$=t~FC9Z}_lrLFN5hGaTKw^S>`&oUkr=Azy^JSn3@8kIfvpcf$NnZ@PE8T2q*N
zeS6#@kG_XGOJ?m@$faay`eBN8f#UX<Bb+81^Wvs$thvwe*q=2(^PjSFl2Cqg7W2mf
z`H9(g>VMh_2u4p2zIph@p*KsTY^_79`dfoK4lwgHtN;6OomaT`!R5uXuYEiCtZhf}
zMCqS3p&HM!Ys+I9nf}^kZG1ju%1zO%y^FSZ-xoN>cTCbvEcMj(SnqGsCf#G4W6NXP
zu{ZB?xy+qbhBz<(hi`QFCfIhnUTutO|LUpfx~SFCAv@4kJbzOEKZT_F11}z2`&?Pw
zIX8H}xWT8|vsou!U$nTSboYL?EUVXKgPAq|AG}$*qN8~J&ea~}&KHWVU3=uq`a<IQ
z8*ScAv!e>X?px|wc35xOz4X6VCgmup&YyMSe3`Jj>w<-!kL0Zj<Nd9qtg`>x_x)2&
ztZF;9xbdt}#!5S@lJH4gQ^M!JRSPOA2~GVj6<g+C_O^7wUe<EK6=_>Euf5K3HhWrQ
z9I|*ROODOPZ(afOes6e^wrQ?pXY$k3t-Wy{T$hGQJ&~NoT$?T55!(2^ccx^90Z-t*
zn|F>e{ntA7TCO~%b^V@gWuIA=TzFizE3V_atDbPRhr-2^T!-@y<h*>Ma7K0+$BzWw
zgvWWFiL#t#d-=C0BtL9ZzJ0J+-(<OvOYaw7jYpDQsd>lCTHf8~m0()vyeRtM@<RQh
ziIcDK$lW;g`u)9`stW4edrYsN5KNwNGI%C;%=|~Id~#p>?@_g!a%qLOmghSKPX@Oo
zJGD-_9b%f*wZuDcw%UfCJ2$_SfBAAm?)J?PN!!%?7ZS~>7q19kKmPks!Tnd9*ZwTl
zxm3aPY~KF|l^fj`Mt*eHUwke6Wgp{)d0ub+%B1?7Nq5?K>_p*e%~jKOa%(J@>39BH
z6Wg417X>DqyL~h0DT5@_h4NW;fp>%=o(K7Mnp>@A`}c0!=F-3G8IR?>U|)K<>vwZt
zH>3adZ_JbJ{yOD+srZs+FndRS9jA5PyVw3f`Y#-ly*C`nim$y;w10imR7T(ZCAux?
zQ?GnKeaq#R3XkojeC1asieH>cdokTqeuA59!%I(>3<KqoLn|jFZVLFjyt(J&^V=UK
zgckijANjY;Qd=T$<>qHLSx-F9UU59P>h{5N{ZDt~_1e5!cIH~*RxKkY*2U2~(_6)t
zzBt{;GUHTL<>m0C{VgI#3(qv)6uBR{)!6HF&TPJlq(|K99|e2+PBrkh=ww9hzVI_S
zBl+pd1VNYW=ev5FoUPWc<noJ1dYcuxX7P+0QRjMd*R`<rv$8(Y-w?ok=fV#2$rqJH
zWV>T$^*^~X+akKz_EceU%G<W@`#<mTJ!2^F_Usbw8NzClYF9lAJE{NAHaY*=Y16r#
z2RCPFzlglNQEcP;j)kQ~p?8ZI*{}Y2s<qNM{6kgtkLMMW6nztJ%Kkak622kUvc0#@
zZOQzvrq0W{=N<n0WY61W8dol!<JHXMwmh?D;Y^+*4;l?Oa45WxD13ROfBLeoZw$6}
ztY|Y9k{ADRcb<-3<T0(U|0~uQdF(oFboPJHrHc>tE51CEVn4M+$^2jPr9G^CcRqzj
z+_Ig)eZN5Gu!mLGq?=Z89iN|`5?0=K?6Jh$KpllwT}9oKoqOevvPR~}=Dlalymp&|
z|AB1j@&Xol??vn%0@wZ4c(DEV--@ELbs80a3J<??dLd9zvHju1V#CAke&&KtKAv)D
zuD!eAqCj4jj`_;Sdr5YeErZs_?^bs{Abes$y20`{mMM$Unk>V9Zsh*`gqPLyKkL>b
zPnOlNrYw3nD=U3Rws6Dy7t@UowEnzn>5;JSR*B7#oOI^{vwHU|+m%qP_R7$wwd9^>
z=wYT6Idk<MEfh;#&OS44d;6yUT^keF6VEL1{jiGt!wl2@BSvhC(nGFH-1jN5<@oWm
zJ=4r=CHm(w9{h3gum8?&(YbTw=lJvQ{xbbQhlrnPWqH+~M?XyLet&%M<;RIrGPlz;
zco-IL_#Q2PPdJfj_ruq_SDpK^(3a)U<Vzf1=55TpyjojyY2VjXDN|4IcPUgys_0Hg
z|G4*EZZuQ)@jYFx<y9-V%zYMLwv7CnvgGP%BZ0*8LhakQe)_Xt`FmKnu{fMbZR*$O
zjiMV`Kg-+9wb*g*P|~{I!XwG<j7uB%r~gytQNLMH__FN1#^u-9%fx=mUd^e#yX#Br
z{>f@{uX3;NIIwuCy1RPCi!WVWt<jYpL5ctWE?0cOnP=6ht#wB6K+<x9Aj^GCmlZZx
zKYhC9*1F^OTMicT*(&#lHSNjyqS27v<G1vrkXCBYm3yz7K5x62T9fd5_brbug%=B=
z_eb3Di<`kd>5pm@({kC(?)N80+RjUKbH2utowM=L<|W#aQVL$i(ZLHBHtyX0;eL%D
z*MGBi)>r-aj&-Nm3050CukVi!|7@uidExQ5{_7EQk7!CH`v=Ia+O?`{jq!$xdtMXt
zDtN>`RHw-ENpF6x({Z6<-}X#3KY`?<e_VFP)Tb=`$D#Mf{FhUI=9&$$Y^ypB);Fa)
zF7IJCoTUEMr{-UXz01EP2RD?*TKxF=UBF#zxw8oG*NOkk*<${mw%+u<Nb9xEoc48p
zcO5=H)#Y#Lo_|-9lACYqSVgO-HHnvGb{|>Xa)a6U)8566ig9L(TJyMf+}#q;w0QpN
zJu<Op%9^YH3B2h#eN*G&@`y4^x!=!coqnuScj((n!9Ug(Jz_m~rgaDjnl040_&Is|
z+^mz8ISb=hgx5cqF-<_HdHeNG8e6!hc>YoDx&3!T(Zl;}tcM-=U!<@#xBZIP^Pb!8
z;Iwb?dKve_bUiN#pMLsfski?g`OMWpsxvOk+cWt@@aiphe{HVUbUeTLk9<d1vt4!b
zd5P__8fQ#am{@ru&^~d~)Bs))-@H>jUshgU>g@7Yer>;P$S)SbtCIQYx@G?_q$Ymb
zEqbF&XqV>8jg}Th+{`wtVa{Kx@1Br;{dUTJkuSx}yWQ`s*tVtdmbYQ;^2cU}>tfHE
zxq8kwa(iA<fB5pYiqM6>)|f0_9XCb0?t}QNFzva#3rt#f9ZYw<uJr8f*0!a2t0$!w
zD(yPsmFn&E?fVjso<z5cxtq=$H9TkN_UT0IW0whS=lM8eG|Kg(ttOOqtymEqW^i<I
ze|_iab2(>@{52BN-ryGV=D&<xeV)P>R)!yk8WoOjTd2B8dCRJs92<9?4c^x-r!VOq
zXJnuJUez$)TI<0~X&b@tsnuV$Oug;mVETCF)oU5)2mXC{c-TcoIBQ*|@Q*INq$|f;
zjzr40RA^jWmTY}J;$>fpNomd#3C0e!f(s2R*319*v|XkxyvCr?<iho~+l&&s6fRaS
z;#ss-)>hlSYXkrPzZXxRYDq7Znfowo{?1jp@9*tmn<s5*=zH{&CCj^*bw5i*7c+Le
z;z;w%nsfhG%*kcT)4O%@*Pm7OPusX_{m#dR8DBG2INUesKbG9sex&c$ED_z=p}M)p
zW!bGurmvBXedpm4`0U)#>3s`3FX>gKPA}+u*=e2j*3r9I{oD$MVAil-6PUyrpKmrj
zyFGr@>y&lIub;_>ByJ8UULkZ~_Q`GQ?1L+F-e0}x_tVLpvDPO44M(HZKJ}cN8pc^}
zp~{}KF0IN5H)nY%xMYP%1RviKCjC<0ZO(NCO}l5E|JDEZ+!Q_K717_;GJTcxzO-eP
zai!;n?OfN&4@vk&e`i?!Y4HcaiHBDoO>;F0cT#=#>kZ#LPS%>``%kC!zG3+k(7bZ3
z*r&FjK;?z8+FSIBc10Kmz0l5VpOLj>g6!gl|29pxUlPogwWzIh@59#>+q8nep4;Oa
zb|=Zz^;1RB(q>Mza!2t`(~2iwxv@h3g^=N_c}ab$nz?)5on9m3w74Z*d=|%kw@0FN
zGO-?OOz-Q@4d_>qO`bm0qIgfCLQM5-?yTxXUY91`aWhxm6Qd%Zn%uw|?`FoZJJD~d
z!S8npUn;IR8g)M~^mrJV!<%gM-|4XHO!EtcM-!Jwx7lq-4i=Q&bs?17zr$$r`X^~R
zrJL7&UTUSrsk>69=(5<Bjn_>I*H8bhe}`@Ak16^aI5OUU-TsO%+Tru=cUcUT3Q~K{
ztlgu#ZQ+wXjSuT9i<HYANa<9r`Z$d_;MJ^{+(pG#E4bozCM_&mx~n{lSJUZEOX|;@
zV=oK#zS4RBtmM{d;hRh{aYxp2ZHO>B-lQG)@XB2_RjZZG+|zg&ERWw{Uh=R`?9JYN
z@pddrszdH2ZaBE7afR6p)l=cT^LpfcICp5c#Bw<q>wRN9ym*<K;EpdI%{|?9Q(aal
z-CWLn^oubkYbT50$(<aG5lU_of*d>EUEF5+lg*_1LHJ_r3)?L9Q-9n~_`t`q<l!Zj
z^_!+ubaAV-sIyc~*mi%1aa=rOzH#j@lV#DRrw{j>-#z=Nk6eIZ%lz-JdN$p7bm;QQ
zS8Xh>{o3@TCYsmA+eIzE%>6yY|6qyX1DAZ)@3%TH&-VM-^rF=>Vb{CrH8HCM^E%ZM
z{}+8KJbyZ_W7{FdF5NSnzqZ?RyMNi+r1!o#p#0k>k2%w?S3X~8c_~1;t3&lp^~d@%
zqQOU;UZz-@-%Pn*e0^7iX_$2Ha+84X%F?H7^gf=uW#u3B&PV-w%mX>e>1neM{^)+$
zZhl<&RL<q8Vj*96%(kE5TK7t6*45DeXF}WkTe6EHel&jSVG8`PSIAy;vA`|UzVGjq
z`uF$j`)Bp*5=ZLG=Nu}VGg$jpae9XqDmUy3jPY@0OZm~wJ@cQa(5^MBg1&F`2neZ|
zyZl<~!y^w*ER`_W?{8G=y~F+4qIa_j?ssjuzi+qs9rm+(%>H~T{;>SJv98+mv^q1-
zLQ$^|3x2rlp0Cg#CY;&ICT3(*VWD$z*@s-^)g{iqo=*v~mt<?1x-NBk(y#0JcHh4&
z&6szR`@^pJK9i0d@9zER>OQ|M*rln=aEW~MfxADSn4Ns7C41HX(A;x2womzm8q_*&
zpK-3VHd|_xA$!mHaN^~C`B6WZd4<#e{ZiTb$*jpCB=x@L>@wGR_oltwR(#~J+V!A=
z4{C4z{nu!{ne*w_%zq!kc)O21`KK6QUG#U&mW7hFwaZnuypX#5MBh$o-jl}-m5!fc
zH$CUusrOa4=~c<9481+OqTSQp-?dep_IcSwHsL4!dU}Vg<%)N0-|JnT6p{CDk?`MN
z{e?f%eJ9S^XSCsWtHv#*H?JhWc5^4!O<$Lmx!?rz_HX+0XLc-H#lib9QsZENZgO<+
z%m+sP`3XN;=Lk4zW%vY!n)533SgqLVdingVvw??C7&tG^*KZOplGpT_oO;h`$p?SC
zMM_Meoz15g{MMH*sSo@pSaC|5DMyXp<>c4CeQMq_JbFWt^|x%lu{O+B*XFnT5o@)T
ze0IIdp86>DWt8u4-sT#2$hs?5USTrd`X5yWPXo49YJR^EGIQtW#ld&qXUqvakoRV7
z^>*i}AIkZU>RMO?GCKaTn6k5~^Gnd9i+6u6pEBXQ>7R?UKKb8q481NU+{LwgdG5SR
zv;Ehf3bt=uJmYKgkI;GXhjlq0@t@H9I@xu<^8PRD)&8QbyF9#ZU5=|N0|Ubx1_lKN
z28P_!;{3d%(#)I`ebm{`{QTk)&>=gu@1t*9ZTe9DkL&*7d&fOz&tSScPtQMdx>yz8
z`Ae6UU%0z@`s~-)LaI9~wp}l4xU=ui`}b#Fw5vuI`kY@ln}5QI#TPS7q|WxZeOgxj
z?d6B<4?S(tGEcT07oHaO(IoBYyz&X|kG0M2aL&uksd~SuCi2MU)u(P(Zrf{pr*hlp
zGuHc)?y-lZtu#+G*E#vgGUS_<*jaP4Wv*u54;AcMA;!w>tUvF0WMF0BthCUOqmfa0
zIUSptPUcTu(RIu-WZIf3u9sb{)@{-WWW8$Ce|e_()O(isD*dZgtL&SiThlau(NBd5
zt)Eq9o1U6bv_j+b<~b)O_4~hke*Z?0((WEFHF>#BbCw=h_3_h-yfYj{59aEg?mGM0
zebK#^(43f)vkqK-ox%3^G5_b+H!ZxEfApDHZ(Hro%4_p^hm7}%SE~{(F5y`&Xt10?
z=<&*OxjFwoUk?27?)u{Ldh35bPTy-|m%nH}?Ow!Lk;rphT5L`}8+M!sl5%6L2ocY1
zkeIXVUhW*fO}8)I{;F1Za7C?t=d_!PwDzt@h}(H$quT5@jDLiMCUMSo>s}(15cj@K
zRCPm-@2|Ky(?X}H$lUtec5nW@dGqGYZJ+P&e}4O;k~unRIj@aQpUSEbzxOde+P`VF
zP5FVt8HbEzf^QbhTI#&}>!f2Z6@Bd&9Nd#|__Qm}+1O*5Aq>ry#iuhTY&v!I(k-z#
z*P}mPef@CNV)paGLtWSRc)tJE#kl+9!+-D2UF&{suv2Xw%dPp-%^yGf_Bo+CS@=TT
z87;OT;m~`!Jr_c^d8oxrnKCo{;ET|iGA2v%`7XaMtKj~zZBKp2#(SR^I4YUcn4VYb
zZrLk$ZneUvE&lo^kC|-VTl-#gL!#9Ez4w$-^ydjL{&mIn`ti=1Nh*#mN0j6LPq)|n
zFK%TMJ)y-dc}`Wt&W;7*nJmUu3=brp6}*hyRJf%<l6w}X+^1Vd7#%8DZ#9P>{@D0V
zy|C)7>t+turq8U7&lF4x`K~U>(zv0crM9AO-KOXj>?<~;J(z3w%y;vl<noI$S_LQf
zuUb`;pZ)sVH?sxzSR)N@&q_&7aof37cHfWU9cTB4^QbV)j|u(U!tLUb+AUP#TESf6
zmKn<SV~2HCtH6<(npn|`Gja=cH)v!ma1xjy&|3P*;mns>zOHR~%=N7+R;+)_Rd*ya
zLiDzb?xR|!uE*X|_iZbUK5TkvB6mDcsr2Cy;a>|{+~u~e>OE)TEtK+2R5*U(UsW9+
zgIm=qa_WV<b}%Q}rc6Ju%yzmBtHGkf*Ux=Qu&(&nG|i&(xpBak?2xyA<7}2MIB?#9
zMRxLXVYwMK7pCjJzgxsMx9oej+R3iSr}Jhh1heujs5Uc;?wC{X`01GzZby@O%9i{~
zShl3ZzkYrH{5O^*O9k?dt#|MWFpS|zpL{Vu!!_e;`sUERt>x9xKfL`kS@`BB7RxU(
zG%cTc_GaqAyjW+G$VHQCcR5*JbXLz^>3A^V<~bXw#Z|ih7nC{3OTKmRK0Y=6P*!;5
z;}%!e@UMZpz8KB0Xcdn=7AJbvYyI)2$Onw<zqf=nm-r>f=J=d6QdnY;xzpgY>SmcM
zn>VxYRvzBb_2e4IS?_&46*|3oiHWQg5e4~-4B~Nf4qZ@JX<1zFeZrx2g5C4I%-u?}
z51;qsJfi3ob3v#qyj-z!{mk!|4IZ9hntJA4+vblI-z^`=`8g<+#s6XXu~$y(>DE_o
zTz}+b&lAnbKDLVM7Pn*MqK})lGUS??n7m&Wk=eH45`#+L`}H?<*Xc9subXqneJXoe
zP^73~0n_i}r4l+;JA4XF+m7su7qJNNIN2ak`tkwqIs*@}4@$ci9@Ku?rM!kGbGBlC
z#=U<_mUJ1vO8fKK?D^%pr^QdKexBj=$K->9qH86e(ZsNmlQaT&=DT}G_}VTx+x^JW
zgJ+iD9#y*u{}Z&YnCMuE&erYxq<Q6l)5Zypr7AD5FZI1v$oGxYLQbJ^&tq4%GgH2)
z>M`5C($zh?wUni(?D0W~hXH%uR=;m_Du~=;xF*~1htM3>+l}RuQm?x>pS`I)AtIu5
zkDU4bBU~a+EU$N4H-49U(aI)V?JD%EK>fxyJ~f#|acdLw4)&{arLkX75k2EDhasV7
zoy#_D#)(Io9&&Y^S!KBRx8X+yW~K@6nG*g-F?0twEKpYUI$5!LPm^QI%;T#HFND9C
z->ewlq^{<2dBIFIqa@vfO+qY(4piH2QCD8IStC=<iP>PS<+a!?RYEe>Yod~wofB$W
zmwfK~lg(JhBcSJ2oBVkFtjXdl-rIg#|M$DWE``65jLe7YznH&J^jZAcWVdglv(L|H
z+plZS$I5<T{@(KYd-zi`HqjrmJv}@cwHhawoHsQ8$p3hedO*W+20QJ7eO!m*PELC1
zaM)@>8W%%DAw#{3?jMDMh7AkmeVqT(VKvA3t?^tra<!}<@3^no>o!$4|F>k_FVl)S
zS|3C|)V{Z085OH}d}8EPHpcIBQ=F%+{NJmwhksw-<qz{W-2MHo@6n>ASGinu>z$K}
z4}Nmmu(SV|fJXPM`K+tOSTk(?Pc;pxzGuF7X?4DZi0X-NzpuLqd)oGG;d@tk^J%z1
zWEMY*?Mi7Db}PM;%09=}xL;t7_Sy3BT1L)?q5yB_`_)eiQ`8vrl{j{vey~z@vD@*;
zvud)gKU>!OSU4`x$*-C}ZNs}|x2~wXw@Ke}!TURhPTrgqhwjepSQWGH$&cesFAL<k
z{;o+_Y<96IOHE~V!u{PJz6RAl=)C_jX`cSyi)`;-`dnk0lQ>h|@LYEj>!IqmqITC$
zKXf(uv%mRaeeb+))#B&d>LqPo{{G9`$}(+*fa%oG@Aaq5H=Ca}pKShf_LsBs|LkjO
z=d*k$SZY!AOTBY<D1XVkuO~Dr7Bs9#a6Z^@mW}s7#F78u?jA+PdW#DRpYq-C(4TeQ
z!$P9y!uDm#w@&mW6;He6|GeYno`{SkL6sXDSgXz*G7C~U(-NzfmM38NL03Sx|CE;E
z?;_W|GH+NTzNshjY+~MaU{A;dsoVAsnb>>eHgCEjrZ49hQ1C;UrFn(cQ;A6rCU5xm
z=fL(7RlV~`2VTz-Kkp{?m)l^=`-n`Z-1oh+m_@`c>YiI}Z4~paKxmeRL-JkLLd(u{
zhk*K0=d}_S(qem6_deX9q1q^4bN11e^aU@J?e{N8Z1Vl!u{`FtYWV8ZbF+k-bxzk#
zE}yj1dG^i~s$XuZ2)_8!dQM^kqvR)5D|uV_jE}l+-@543$G<r=Aw#M7*ei?4m%4&C
zM4cAWRhrw;veY(N;P<`PwfV;{?l9%uf6%D%J^KL<gM~gK7tS|oN{ZiJywC5!!lb>E
z-%hg3a&Q#e_cOKam*k%GkNO=?#Gi=QxxT-=zx={JC(aE=?g}Z!b$3tk>s^&{txEdn
zh6KypgH;Ew&O9_-plj-}nq|pL99Xuo&X>|z)fzZizVGDw;Et=aq<-&7e?4=_YK4`x
z4jrKz?Nq0<yxx@<T&}jkI%c|7=aHqnoGzOjCh?Z4?G~SYtLg6MXDxn=3KJ)EtY|;~
z%gQQ5HsXa**Oz_&oOk?x!Czdz>Ci)l+pICs1tIH}@XIcJP|WoCc*;}-k?qz!bvZ#6
zjmk`=@t49_cT}(V?)~mA$J57m-5!_*YQ(uIFf8u~u$X2OJSlMgQ5VO>-5FY!Hk{Ya
zzT(@`X7RW^jr~>oj{dLZnH!R1lI*<8$_r-gsmMDo)Ec(td7<#?TvoPOl_C?o*?QL<
zxD|2Z?<M!9M`Z;&eSU8?%gEmOeR}QzuB=OJq0)?X_xjFe^8Z-5_)?Y{*X%-BVc*m|
z<?W#}SB2fq`&j<NP5pTOQhSzU-jI9U@kO$?tGDhh{(s`%#A6#o`7U)?DrLyLI8}7v
z!LtQoe;t_xUnv+qWc$h=ydXMj;vQa^B-;$GeBoZbp607c+ZQR7-mP#sm&80{cbDnr
zANePBFK<^V`?%=pA0ZCb!#~#R$vmFWWSeHXc*ESxNi_#eJGXG(wpi1g|2ih4<_PP&
zzpvdn_B{LhHanzT{j-+V`Y$j08P#{29r_aDedyiK)gR=ib4gz3);8g+&-m4_=#8ex
zyq~9X1hSd4jQHOai+^dClA5;P%;S7y)U~f`MOX4(UlZBAUMY9#v{KdN+N{;aD_^f+
zKUaG0<JDEXHdhO+#nzUkRr$N}be&<|5dFtI|6YdP6zPa{HZ1$aqT=suI2Kz`{@h$m
zZhf@3k;Lp2%j=KQ&lyJQ#$KDW=Jwt4zqd;Fez+RuCL8+6y>_wb*)4BxEIA!}Wp?fj
zmfi)^-5PU^i+!ENmXyoQIg(n+=xn95Y0G`n(%JXcCkU&pxwk^#ht0m{PtGp(<mz)y
z__3^J_Ub#gZ!xL=%PQ<#xK{U;(t@+K|4OylnrBaqK3`w=bJDKxv;_+?^0h8+2&^gK
zn(SxdVVyALZ@_j>E!~_F?quF&*L@mo-<+xld~j~k7q5VYseAfogt)q9a3^<8FlkMb
zb4qo1YjW<5#-a_EdM2)2Dk9*SKYs(;W~JySdvk@EI5#Mi@ofL(-B<1HwtoqGn{@4g
zEi>3dgUfDL1XX!XI~TF=!@@f{9LihoG<$tX<zGEvNzIv{(=|Sur);Yi-TN%Kk+Iq5
zk+y-hzf#2Unprlt&csG57K8}go6i*Xaq+UL+J78Zn^`$-D!X6pyFWEv#$!w3#I3Iw
zBOkAntgG3#<*>t#i#O%t-@NHPb8k|<!1mHh4i8r7)a<*y_5AmokjKKV)@K*J75q7~
z@$lK4+)GdMu1ppy{q1VA>Co;d4WF}<m-{jb|Jr;kEZe?Qaf#;%uZ91n=r3Z~m6#F9
z^5%MJ%(JNv!?^=v<Zla1T^n#lensrF#E>&`9jlHdm3IiUEjnAz@JjD)<Edq7pZ_J#
zzaFL<dtpsjvk;TPH38GA;6OQ*?H7aGs!}#&xqtcKwZeJhgO0W8z08|9Cnu~;tUrE#
z!_%Okb?2)hU87elwM_O}mG)$f&^6!p5-W|J@-}w4@TSCT^08*$H(BSkd_~kZk!i2j
zt{1Jod)dH=|F_k=U57KIqV^tLbo|}2EgnBBoT~X>N${7y4ff4_bE+`#rgD2~wso_^
zm8sk6DiSjDYAue0^8fSw@xS<E{-gdkb)S~)exZ5K&h?iIv-6Mg_iJ`5O>=zh^jPwz
zG8gw+i?nFri#MKFM^y)SKi{+Pv*_C|F})lgFWfov?|bRzn3B&mq2}^e_AGuGbyfYQ
z&W>I#pNlVjYcKt%zSs2LC!^?F@4kE8OH$4(el+`Ciq)lW#{O@Zk}IT+dOoQ2l8`!*
zY_R<?r*=cZ7ulbEQb*71J;CgCLGAP<!`tqH*%gUj@9FwYmt5^MQ>1U!t~IvG%ek8r
z_%_E)PA=Zs=js={;uDY0J!iv78}prGB{JOHWQ|{4*pfQIZA+3x9^<uxY@1#Ou9~v>
zY30^!W=rkr+!q_n@^rqhIKeV)M#R0;JuFS#R%aEMj5V|$Ti-c%b+XGVVO87TD^9)o
zqyE<8#JoC*ln1f*y#g(Jj=NlC*eAc_^u)v2n&Ot)Rev24pY!d>H&H0$+oR%@-kovm
z+uy=@+2`1QZr-t(^V5=0mUeMAqg6^aM}osXC_9MVb2-`6`au56l|;FW@I@bf&$0}j
z#v|$}`yn`iIV#jAI`UnxhQi^K3zqll<`@T-#g~Y_eDiaajHra;uiAZwUGD38$37`e
zi)=mfJhpoh_Zi=VC%bygwKrHBSROx6mfPOG@1h%ry36+4eeXVOaB$5MsPI@hMXT}r
zo2e(BZu!z`6UC}4yiCBwsPVb2<-UC@Rup>fEM!ZXetTta&>8pR56dpaZG1c<tUo(@
z=9wjYlaJWcn+x?-UHDRw{Jif&xq0t#?+3?KC5~y-3M>20O8)*sQ)>VHlB)uY9^aJa
zZh4W#Tp>4oMb#~3vv$dO{9cl?PbjD5mz>pSx%%G3heg0m_(O%*^bJi~Pm^WiUQ0?f
zythqfm8h8E#&!Aq?b`aQ%c6BEF5K7~ntbs_ubuuhxw#DoBQ<XJvZeKKicC?IKI_BR
z6&oIVpX1RHrDYSXxsLs0sxs@Jyi}N5J~FZIxyj$xe|2Z=ZsY!Hr|0#+OG$V};K6J=
zVLq29o!b`1-#XM}&6s5@pTYm?$|kj|zZ8-)w)lxfg$KKO<=#8(;xIE(LcH`w*poPk
z)D`FdOw{&lUoQI5V^fa#k$vA*^gnaS?fdatVoUO-9D_ia12V$5z2;dss(+Q}Y(9~+
zsC`S+EpG<F){yD8XE(DfPpR=`U+twP|9R?^eXC!(->Pb`{G;f;-#xB7`Q?%-xm)}T
z9Hyq(9@Pmjvt<6M*syP<=l(|wpTu~-*;pw4<1&6!%9HZ@k`Vi}_ttN8H=UZf|Nq<7
zY29~jOPR{HD=>JuusWv}zJHxnU=@37vg(1zGxD0Pre`i^-w0W9Y5ALJD}BOpr#?Po
z(bbjGd0aE$<Nm!#Mz--fY)hi&XivzvCAjiT1NX{#)}8Va2I29kh3{AEar}M8bK%RJ
z5^pCVlU`1t$mF|525SPAd=+U?+h>-b=a?9O-DqExQ<3NL%$?7FepO7quXx@5@0ZCI
ze-6&{tF%qoG*#<yL~zcF6)&}RJo~VdS93zbuFWS_AN|^sZ}Gx?j%Cb(;3Y46@7Mj#
z<^Rdf{V3Fg(X^Vc?H)^Rtj?~Z%3D^(pFC=GjY;991RGOu(?tF|hq7NBTK4v2cH;}h
z*&DX+n(NH38!RHrRc<}2E_aJ^*3R1x`CYAlEmBzFta>u>Tg+zR49C4{C*JOU*1+;G
z;+M4UW$sq9T{@dn0yoCRTfJiH|M|f&?1p;K|II(zJ}QTPyAhzD>$b>4%1Ldlxo1oM
zSJ%sv?IdKk%u6ZZ@S6PHcE9V+M}Z&Ma(~}5KPVTyaNUa4rHrq*-rc=@<yE4&;a*KY
zUn|Ef$)zb<PSq5*c(Z@Fq$;zP&G5`mH~IMo7;G{poj<RcdZOgcjyA@~wC+PPQ{_%=
z3AnFwR&4X?efL7&ob9r7{^lM(`~UH&78?DVWzLpNeABJsVB7C^-+QsFd9bTT^f70F
zg|<IkeoHxC%sp{d@ND)YJ&twXKbG7SF6}9{VevO>*%-NYgCv`5`|`sv3Aax6<kx0t
zvan?33$Br~%e}cESfIwwHf7m_13Pon7P-WWJ?%8u%5}9{A-?p=A{}3y*I&-9h*S2}
zJ|k#!O<mt_>8(8zUtX2zowlL2aJi(lse9^V<+Bday|F$_>Sfy7g3T4J`+PG#-LC5h
zJe0`Re9|!Y^{G$lQ@hvw$jGi}Z#{f_^LLHHV3Fv&7jN6d9=G-T*%`|35WX!n;rs1p
zdh-@f5H0k(X*K<NklW_jYkZF%P%O&r*!OLA#m<K*#vQlUE4;QnC4bS)w~g&pamb9O
zWcddI0oM*JNsg8HcI!IZ+|@f4TzUS|MDWhzevQH_Nw-X{xL12+zPy$3*m>5(U(Z5L
zGkK~A3Ylff>X`b>Y1sP7Ir+=hjd%X`F|V<by0A36+2DufN?9|`w-q;MajIAIT=iJJ
zYmu(ZGF^@)iAiSj9<r;aT)1(tovA%{>#FD}5fggC4tX0%cYgeJe2$S+<tgQ2;U&kK
zRxotAeVfpn(qX83P&H$^Yu52ews%}PujlkXaCd!o{eWg<UWfbTwJJ3)X0x9CJ7?J~
zPoED}+6y^f1!PvQFPnEiSpVDpyTR+fmzpkD&kJ|$-+uMEy~W(xcD0Z*haWyn@ZF?3
zcT23$ti()VPj3qs#;>{TE=l<-*EIZ^b}WM}?qx>oUjAjPGm=fDR~=}5{^;nv6KkJZ
z2C%E#+H|SrUb&0tniB?U;U_Jxu<n?e!FbK7tT#jSA=4qbPTz-9KG!YIRla&&_p#mn
zeT+@=GuJKKvelX+NWT2Kn4bBH84W>m^!_|F)Vor&)nwa)Ysv>C6<fDSTlBBJ{LX8I
zeX&o0_+IU!`x)QNILVUir}lAgvtj$jh)VaFH?sa+%eazyeXYY${dY<>AAY7?dUojY
z4dv<ceWyG$e7CPzV&RK}v*N2uca$Beap%eRS-kpCRQQDc<<H-Rx<sFkX1SDl%t80?
zgv@7onFlRJ-PbmsfAnM5w#hlw9;ULdxI|BfZ<@roKv2+RNqzJ@{WI>l=Qp{zYHwzF
z@_YZ{&;+in%v0QDUKm<!n*582f9}bRChe9oH>UA9H1;j><C@N6dbGEt#P8IFt#93H
zCtSRLjCpl&wnT#5t!r`}#`ou(xf;s2TWtUL*cJO0$Cj}t1-yDIwUgbbsrg9jj>$q^
zx98{UN=)RMD-c~08gWPLuIO#mT{W*F<F}L_Gf(;P)hr~?(n2JWW6x!i$ZMSDS3|=-
zt>EK#%zjZ(;LK{>^I?VC^qr3aCBLezS+d>a7@wE0pG3wJ#w&Y|<!=9{<#X;r|HVry
z*1n2mU@Mq*N1{<)HtlG_?trx}3&g}zLOFz_m)lIKIL^LB^!=-+E7>-$WxDfX#r$=r
zoUbQ-i8y)ujHc`c5s^z5B$}4^YEBYbXp{OteHr(ih$XeId-|8UnLnKvAgVEGb|Kdi
z$(BuJ@5HCSc9_zY9h|RJ7`wvMODq4C$?>Ngla9Hq`mwA$OkP@ZZ_UE^t20(v?{3gG
zJgZT9SK%%T`;}Aoqs#T<TlDAg3-5`~v+x!_+h@uiRO$0ks`lU2H($c<W$p>>E8m${
zHdRYp*@5RrmVtwH^ZC}6P3{L@e9@M(R!C+3b5z0b?XTtyF6NOo6T=r|o)Gx5?ZlVa
z`<mM4z4%#K{d?xRo}M?+=}Ic^XTC|kYw6{E;HLPycM~E{`!6}ZTR%R7JCyh9BTL7<
z74Q1bOfa)+bq})^QabB2k#}LXK&bz-`sJtPx&$?ppC(+)Z$7o0&9b(aPx3ft<)Y$l
zQRA;07N2U*+;rCAs#BTzB-5+zv(-=RlfS&}r2I<3o!?VUE+2P%{4{Azk8@twhJO9a
zZyQtOs?E=vu5G${{R4k`eSQ0H%aYD~x&HOjAN^zh+a&o{h<9F1_M8mX=DR7H&-(8-
zd|se>e2a=e(?xNiu+tOrpYd?*xn`zY_hrw~zT9h>UD;8wQ&+AiPHw&1$Rho2@vBCs
zTi4&;NZj)E@z;OHrn$RL6lH#IF?WOY$G;06U5_#PmHRT(r|9z54C8kylWJ{$3&~8J
zayNgi&+l5Lvlm-EU%F_E7xCVzyt?H0nI|#L4l@q0iCGF?3wfG#I&ZGp<5^}u6FJtZ
zP0iT)BsO=J)<UICe^MsB*jM-|+JEx)3X4~5;_qE1Ue}S-$&pzZV7x^2EZ?>7I_WP{
zEjRi$gekpgw$IYBDqB?8*T(O0{MNIJqIO!ct5^MQ`<FaF{-(*HgX+&)lN1t?CB&s4
z%FS0(WjSHGy`0lcQ`I2&*kq1b7hA-CUuS)MT;SQw7S@Wj-<-@N&-`Xt>^k*qAlC_z
zbDAGlJ$Siz$8W#W9804fH6FaZBc-u;OXq@fk57Exu(B_4)?D}NKKEj~pX+PP?@#|I
zdh46wer3;3O6z|7<l*ICygSIdG|?_q&SgsJ1mCZ-AHOsTeZpk_GVK1uTQ5?JpSxO}
zpOvV(KG`9`MoH`3<?_isftB$KGS_|KcwMyZZR(t|e{&Wpeb>?rulsOej&zj7jnXHT
zpQlCHh>K2{nRPwtm3;aR*UfUX_xVldX0_V3d1YK*!oC*|b)rR*zu7T=zOTLh(VW}b
z^ZD+dvI(~N-@9&N>)Q`cmVBw2tzTaL?+(As`-*94C13SsvzPr(x;>ZkQ|IN@;&f%R
zH;R@WjwUm|NPX`-R=Vdv7aMo+fl_5@xzM6Ht%iJlCyRp(%S20CY#dx8mG8fMXx^4`
zp)w?2D$rYM_4+Gs%##<r(_FM}@r!;PcfGSxoI>ARE?!#LQzI-nODIq~_t}h>eOjkI
zQw~ZVH<^-Lt;o1WU|!a`KABqzi;uDVx@A_GQ?={phkff#7YbZHf8gDTmw9LJY%kt%
z{mFqiiQdN5g^I_V_RAbOaXn0ZmCVd*dj5g&NeO=i!jE1)wJ6rj@3Q@)*yDSO=B&(^
znxx<>!+55<g74ANxx6=y$m(2Cx+bWr9XX+3|LIE_Paig(wYR@tyYtpz!SMD6f%3<>
zTVEXxzjR5e;(krx>>o$&KXxv<f8xf(2xh5{t4^WIt5!+f*{qpVqwC<m_e;k8=iLp-
z^N)$0-#TN?&aJ$UR5MGvmIu2%eZG5=h3wRD_2M9f>kF1l)ZEWDf98Xg4=10T)%!;L
zXXM1UFBLK$Sbo^GvLxn5qx|=q9)BcuKF@BCl<h297<AaDn$1r@X`)|<&D6v%yS(;4
zd}Vb>?)KlP8dZkl=lLgpSYgD<l`YE|6Fc|F&O_niGvDlLGduK|E$EEclJ3kN6~})S
zt`+xJy}zLxAfOzatfYR`Sohzu<5pqSMPl#o@XW3%j$t_Bt)6q1d6|Uj<4>9=*Z+BP
zM?LyX_c77_E8XUGjQnT5$ZzfTY<{@^_HCuyJ2uQWcD>B#5@XL*QG7XNR{nR5i_IOW
zmo}DXuIsFvc-AS;F)O96>5|f{#hQn`{!Nqa&e-fa!}i+glMX&U>$%^HK1!Q(PeAl`
z)sow48xvyhHi~_V{Jq5gi`OOpjD%|*bqraH!+LL<xLnEDmeV~+m(SZ`Zhqby(QfPJ
z*xlQFr$(Ip9QL`HU&B}UR;%FjW7f}m68O%}_GDRC{^}9emX7uk$Kzl1=KPxE&9Jx7
zW1mju>GrP<fz36RCqC+CrWXn|&pI|;ZtlFTimT%%w`8!+W)r$u7_~8l*XVVd+6&jU
z=l=fs>akB%M{LfbWZOCU-N%-F*GmlCbwW1h_^V}S5>9sQt=`+@{rb@6iP0JlJ=<NX
zer2m%`s}SdC6y<PRYxyWM159bPOL@rEWy&ZLL6@uHl-dG?%n6nfAo#UmrYx(pPc=(
zW$KQnJ5!@KaEH%Zl5_QU{VmzaznDw8cC{+ZEKjqZ+WJmZ>H4FRS!)w!?((f^wOllR
z`^v;Edkl9M#_!)zK6m;t*(=&1b7t9RrT%_#Tj$e}{bh{u{n0LRd(E{z?E5giaOW8z
zn-`A9AMz|;c4onb9oOD{Uw34-q<7G?IDUgek96`mL_A&|?Jhatepqa|`AyS(x+0;O
zY$w(|R{2;_dyDf?{x^~LMh|@!SRbp5@Y{EL1>cg6Sdm8)HnnC=yF6R`hjUM0yXcA&
zauSV_ZXVzNx|+)FyK*gZO9_|Qhvvh358Z#_^Yi^D&F_5w>%RPa^W%&1pJ)1pmABYW
z9yVvb5x04&ZIZ;F_lZrPl6xKnvA+GPW25G@p2K<bbLokBy9J#l=xDz9m{(N1anB95
z?>{4*e_XqMu$=4cRoUcP-@Q9FiQLXNxhdlJ_25a*iXZ3uAD;Ype81=FjwEiMeLu5;
z^4UI}5KOn(_eVHojiAV<_IA@}{mUDE=<+X?Kc@OiveaO9(yJZ8`xWCm$`wCveZrf6
z>vyI38E=d5eL3%*&wXEabIw(lxm*r28Rr|m>Jxv?ul=U|fWbL&=Utr)ha;cuWqzS4
zRQ-peJI;oE`ThO}_Z_B)C2Jl0TOVn(-Rn_Dc=zk9&ldU{Gvb^R1>0v|FR1i;@mY$;
z%OWJsdFoDu#cLj}=y9HA`sD6u@ra`E!yn%WX{l`Z%`2h$qo7gZ(DCZ(FQ-4czn{Li
z-+ey+xqiM%MRA88Yih#RzHYv-f5ViAx8E)CdGvMHqrH>=oZa$s(!GD$cfM7n3-CYr
zzsEcO&k<SoiKlh0`BwaRzW;;z*KN%e-)hQ}iw}PkTQP0>%$3y=>~j16oUmAA5MaGL
zP4R9-is&V=d6lczmfhy}zVf=iXZHG^eM(z<?k%kRKWX3H9q%KjTYYSI;j}Z+4_sv~
z`cXpl?&&3;pE7^kA|1W%W>C%S4MjTpq;~T1ztUcCcz4~5Qb~?S$NotCNVgM+wy9ao
zcC5DP_}RqR!$*um3TKIY_*!Yy`SY*6*6OG|Ybp-!%3nS2lapw}s_w!n$wiA-99;Ki
z_JXf#U)MbNX4+a+_v_)0xtFf}zWvXmdD+Aqr}=Z`=Nz_oXO+79mwRmoTj<m;>{b59
z!d<7O&8<>$h_3qd?)v%V8%#>xbT-7@7T$g6=lc2me0+xwKi=HDUERIC?)tnm%^NQl
zr0*&XbKL&*`<KT*4;sEWa4t4X^xuY$%vJ|IUffY{iM_md@%?kxzdZjwvHM$idKG5{
z@4@-}_pXYpe`@cT{U%@BvUQ&KY=M27-#M{|$wp|eNp4py$?mtGUuVg#XjQ!>aMA6F
zAKxAG3%PzlH$=W^rocS;dW$NPMKgO0%awMu<q7?5pJdvrZ@o%}@8+Sy-;d`Xl&msg
z3;O+I-N_Z!J7xad_uRZEah38}u02zqO<ugYe%@U9+83*?Z<VT_k~Cj5u<q*0V3|)7
zk4EhEUo7ltTEacM{~^D|W&VD3S&{i~mK|Yvp<HZuGEH{n%&mp*o_v|!{`t&`wP#kG
z)0RB;#w$$s(>hs!3)#C0%S!$|z0Cjqj12#^p8ubw`_%>>=+}|iH1}omidp|OHceum
zIQ5Ufrd3J1twTBfG<Q@T5D@ypuk@PH+2caLZ<t)UGRFhCnNv)5_p09w<6^wE=(^p!
ze~*8B_{ej2&y2>Or;a_e@qVoJIxWUbYwLyjx{_}datY_k?>Y-+zVz4=`FvvQ!j4Ox
z*Ul~wS)hC7PtAvqAHF!RuKs1MarE!fycVG+%Es$bSocn{ef6eorm5WQJz7%n$u5l#
z&z?H!cj>BrdDx%ABXOtl`Bk^A`=Q*aYwhMHJ+)3|V&=5c&B<@A?E74NuJ3yDOxGm)
zZ-&v~LX&-q-dumbAS|pdXVLC<&TH))a$<5nnw^<N7c*RA)@?{zTR)vsLGRFe7Zdi}
z#Z%t1?fF|&QzRibZw|x8A4<}nUryhw{Bce044x46<N4u>9-XgaXMR+9e1<}M&g*|4
z+uz;hm-)djd^q)-Q<zJ|oz>ClU$}B>e?4Em_`{3O2X9V4@7|wcp<BQ{IqirDk9XTi
zv$?w-tor_bmfQA=zUKRcA1G&EzukVjZhL?JpS$@sCZdi@Ek8_YTioA%PKSNovk(6n
zQ4gHB!z%HORe^!wRXP48SjoAG*{R?YC;k@SHrurS`T7Hv=FY1ozEpWz{ry~c>bz|0
zmCHNlZk+q=u7#YOtD{&_*OQNjr=9!y|6iFn1LuSVIooS%%Z-<xIU?k#Bi8-*P}0Vl
zbLZ^j{+$0-E%<rMliTjb^TLw!DmI?}_DLh|!`tfzPp6;1SvPGxcj49*H(pO)zwch%
z-%nq)%l18Z!>qq~%Gn>h{+ntzdn1o7e!4mRvr_aXgE`kjV?P+AB+X2BJ-W!`?5Y()
zkx{GCn=(U+YJV4mepKq6#60h_NI>WH<ZE^IF-L8VZ+mw1bLqMM#j4>KnpBmhbgX34
zJoO=L$>ulPWV};&HRLNlG9J?ivP(-1?f9Z4sLCT>^>p>Bjz?NOrv%n#zW8XgD{sTy
z{|xqg;Wq15uaP)C|M`Wk`kt;yueIIkKXvMOKXO&MRLK26=UmYN#uKvf?N{6-M8g{j
z870)sV`81BJgDDsRC|Y}{vn3+nyC0p5!15MD!Z$ebvo2HXfZOa>7FtD(?^?CVr(1j
z4*B0ri(6jEx?|cer-NU&uh|)<_sUD<S2%0PZrw$De(pWjxJ*au=FiRPN$1Wrf8Jkb
z!}EQ={hj|0U;McH&X{e!<EeR<EzYJ_R4I4qsG41txg7V(Ml$_nOw7yYS8U{$em+y<
zx8y)U<-v#l88)ywJr+^8G)w7v_-~dM4d)ly7Tw;QUMMtmsf!Tfujh<K58muKCu}!q
zaa7u7tA~o0w%=)O+|RDIi$QMplHEnmx^z~TP5k&GD&)vH_svg@yki@DOrk13{5Dz=
zQ02$u-MdHV!L#gXXCqm!bFh4LI`A#e$WZ&H(k@4>5J_#zq+`z_54tR6(0#o`$RHw&
zbAq{A5K}Od;1nl;m%d_?=dc%v+*ti2iBaUXsmuFEHWrFMJ0^9vEtx(&C&}iqe7eTs
zAOAfTeo)r;%2@Jb+68BsX-cA}t5&v^D9gWEB(UoBh4$}hpGrUUE^jy$7H;#@mBlFb
z(T~+hXKVJIS#4T6DedjwK>iIEOAhJT<e%A-Jh86x!|CNAYb44H#5wgpp6Xw;W^v2h
z(62rzZ?1Y@S*yR-oB364n1cDXf{CnBMT*i6_8!yHuVfs1&NH8PXP8yp$;m%w=$_Vo
zv_<fC-Q!CuCOLm#-V`9d^0j3ByRG3jWtsSbW_+q%z`3G(jbHliH+)sQzPqtmc?Xns
zSy>b~bzER5sk&Qb!hGU!YQS2p^9{~Yk&LH4t;%7Pbh^k~QJA@KQoENy;L7Y<7p8{o
zaPVHJpuER$b`#s4Ju-_Wo;f_*a_h&O&c4TG-FJ%<TINWEEvbyvl#xhsHJYwlxz%Cc
zGtZN~Vb8e(z0UT$sn(v<(zrExvnG3YYg@<p8~1L1J{-&%9l|8h(~;$1xJAyRw)0Zl
zB@W>oCfp0A?@BQbR9vJfz?R8wWD%T{cVMG>_tC(v4j022(}m{6e`sQV``GR9`%PJj
zM?){k{b`!%nB*zqqPbRSX^hbaI~D`miz|3`eO|**s<xZ)=XtaH$0F_)%UuYOe*4zb
z{Q2+QhqtRQZ~x0_zWgRbi}1bKNk;9xnj4mX`SIk=oNM>9-EJQ{w&ayrR8Qdlh|9OK
zEWP*Iq%W75YG+=MazOFP{4)!r&0@cQVSZK3%w(tfe%H+N4#r11Ih<Q1l{_mNqi^og
z-hIY+j<^B)_3bY{EAE!<*fFW5MDESf?1bYgUh7}I=;B}b-|!LFzQoujUaw7>0UR&c
ze{EyvIMMsz!EFwS?u=$%pGSL`FZ1tGm~@6C&XL7t*>4r?h-;R=oPDJ){rknaXxh^`
z3%>5okz>2=Z_oA5;w#_g{hUviY1Yj;ee2pxbH;5dF%0Jxy<hsE<W9kYWio4cS8$)1
z(W`Kd%dUHsMur^6vaKFzVhmHx#IqJnJQ#IIPKKkaVfl_P5=mdUAK4tYcaS%z)T}$Z
zEI#RP`PNT*x&nW9Cg?L<>-sZQbXD$R;RVz8EGf)N{OWGb5E;L-Chfz8dpXAz-SqKz
zX0n65O6SM@Y{nx7mWw3ik{%~4Kd!*^WK)5Kk9R~~Q;)kSr<E;-O!)Fg?@jL?*yB*0
zs<>q8hWCALx#|iWdp@{3DnI_abjACL(;xNfR9<Jg$MxBzUh?LQh5Hy<KJ?c*KS(Nx
zlDw3|_fLJxc9oq$fAa<ZZ<?ubN;e{w!SsTvxmshwHt&f7^WGE`NH$-V)c??TbFxUu
z72#Chu*5j^lTo`GdR4boEsRdQ{%PB+Lkx9nae6$-35`rq5mNmx#pMp)3FDB<QLjm!
zwpT~6=UZfi-lNwoi(Mxvc|KeDppeZi@x+q3^JV5V+|>0j{WM!+Wn-1Y{o5J5GNFr}
z2ArP!*HtY^uIBs87k?X@cLg_U^J+&ui0-)<d5E=d>8Xgz8yU2hI*Tdn&oo^q{pt4!
z5rZ$MbXA_{{E%JB!DpRdK7F2f^YKMa>q<iGPhB>zGL!k&uvd6Xz?#noUcXAsTJE}k
zy;-+MgKe3v3B%Hfy~&eeSw)_{xIfwK#v_FtN^^C&W-#1OusAkPVwZCMi=Bo}=KFlj
zP1*l>oMqD4xN5=@Zq>y*d5W_%x+**kWg7BYr~UCuIe9(mVD@9Xdl^p{F8A{Nd^OGV
zrE~<R_&xEvJNH~+yE$+E^5&TmO9C4;d3wJT<RoNlvR^7*yhK;wIfqJl=A1L4hB`+s
zzI0u$HhYq}R^<Me>7wyQERi~zWe<C0F0CoZ-?!a(p8H4BSv_XE5~|cDY0OQ(u&mm4
zrRai~Q(9ih@5<*bw|IKOG-$d^rTvGmxnXB+OxyffciS4r-o^RrD@+Uu4Cj;wT>Qs1
z=i(x^?;8uX<W67Xl}UJA#`e|fVfeu?hdB-L8YfP@uGM<sQ+adYYW@dVMsEI7a+Ni1
z2o|#P)|e$UuHn%TQ$Ljv^=q}DW!l-R`ZGOzKR4bHJ+)xnH8<_#9b6UeB`>0mpPn{J
z>cAoniId;A@qe>_^S3~v&cgD?mwyI-c9j47dn8$Z#&>c5M++A8+;LNHX-!v}mg0A4
zC&O$1U#H#Ir>!xRDCY@TZL{EO%$k%Nm$%EVbjWPpv|fJKvbCnt_l}Fns=jaGpY5Jt
zd9d%T??KtO9Sok+P4uV9ainip)|NT%V@&UI^<`bzXB-aAFg<l4LQ~8}|B6?kftK0#
zeN){mc$RkYJd`ezY5Sh0kQe@!!G7YJ&HGkvXxjHL?%w{7Ya$jdUHh~ubYbSsOsz`~
zJFaZIA@$^*)s#sM>kgV|xt<BB*&n(tTKV+Smdu%*KV|N0-16#pqN8GyqJFVl^9;oR
zV;=5#r)E97$W^$pqPCQ~K0wG|8`F`VQ)}jWnsA-^YCdh%`J2%nrfYZoy2Pc_B(KGF
z``eEVN8hsMUG!R5@I^PYnImhByVLGB{Ev^iRcE;@i{8|{^Yr2W-0CY{I=nA6eeji4
zy5jb=r_XQQPC0n+;qk+dn-4$!yPq%N(F^+>x-Lg+o1bRbGv9O(E{G_dW3F|W<M92v
z)s0V5;{zI+m+zC<X#Qqt$n`jux_#;EWK^pg<xUkEs=f8T8F<iY2k#dnHTSC3mtIOY
za^<yOJ(XYl`4G3&M@Hs1-JR3kt=oL>(R+@985OY=x8EPg6`Xz{yn3<qnafshTjqXb
z{`KbSj8xNq=er+;J~lnJA!jP{$LJZ!TV)$|Pg;?c;l9BA!rxsAb1!<`$_<g?zWmNX
zklk$Nj$=O~0_PcA%(iCzTJ$%kqy5V#uPEsf+x00Y*1j(hO5av{x3juT`+zk=)xq-?
zvk!Lh94~m!yKdsMdncEFzI*<qY|yWN#a;jT{QW<21<hSoG40n~^=OVOotL&=v<#eh
z{>=ei!4LelOj^-b^V}Y?Us>^Y%E_x=j=T5Vn&@G^cXROnj=l@Cp1QUbubb0$Bz1p6
z=8c=`LCsm0S$4fnc2zhP!@xbIgDY9!-n#bsx=FbQ+WQtueU@02W?mB3A-zF<kI~`x
zypq!_cUChpewmsd{^`z#J3`T2cQ+n?o)Z{axpVjCVpg9Zf5U4#oGk^G2t2(m8#v8W
zzx>~qU+3@hEDS1W^?vyF-yiYwWlGj7&P?WTYmIjDow0Gva-$p5gbrN0J?*-FtZ~P|
zZERDH_MNI$u-Z0TL}Ih%;*gN+r@IfnO?|DM$kDw*f+^v^nKbsvAEVZC9;khP_~Ffy
zg+IQ%_@Q89YiX$-e*Me&+!Ky-lU1(PD^<Mong91I&u)endLLHs9prv$eE(h1gGl2;
z*>^UC31kR_@4b3){X*fO=Q=g@C1v-P3eLB@B$D%;>*L?1A8`wUzWd5$yI+{-SEE$E
z{bk>?OM<CJ0++L;51jsgs4PP6z@i2-o<mxnKQn~g>0V>-{MefXbLZx5cbvN@J*CW)
z=kOfU*Vm3!E`BqiFZ{urd3!JaeSh_h#6}I}&K92vrDYOT4fgT-!{Yyamj0Tmsy~&x
zAXvjL(O=%u*C=x7Ztu(A8rQAanh<K+HBs=jZpP31%P!t{c1Gdskw1oIKg>LSo>X=X
zICcN%X>VzP-VCSz{p`n04ePh`OHSFg#vu9j?KjPLazZjqyc`}dyY1mQ(>RlDFTdL_
zexuYAe*|Vs<LYN@>fneuaE;ZxVBtplWwvTPHxEzrkl3=*e5e1)-%k1G|Ce`aHW=oW
zr(fFq<GtEV9gi-lJ&qUN|1*l3`bfU!Qrh1OlcwgKJCW+HxX{6E^UKxd57(Zp2yspp
zV`*F{SJl_)wCPZq-Lc*P&oyq2lkPsM>t9&Xu>R~hciZPrpS%&M-OBsHeZQjOl64zS
zHc0Q|@4tG@%w*bfo})J!lxo<R?DpCgG(Xq%HcWH7u)NrPEo=GAbd^t)eH+!XKJ%pW
z?>7^^@wv?Vn{L^cv^D?UO%O2M|K=z+--Kf-6YqQE{W0nK<kYrPCssp$>+F_wv#;zm
zFOo3PK9TmZp`c>jkAq9NCtmv#`F>s5pOf*TtSef0uI(~ReX>l|-@EbH#{F_E4LhF9
zx)G7FQebf%clGq&x)VOVi(92@Vp#s&=;Wn6n`CEC*OO=1d8xZF`%<j+gIbTGn~&G)
z#l@DHoxc67=m;}Q7*nI+8+H~~p}#&_{tc^VoMoT7>$7fL&1d79zpv7b_6gNWS}dO9
z*e$!1?HF%jPt_Fv1W)$;GySISy_&f4>-|ny^I%u5SLe1{T+ZKjtI$RJir+R<zl&aT
zvU&LasLtVSzM;Uh>MgVHQp1R^H+m+SG)OaV;CBsu^y$9(QL`fFBj2vORhys6TCz-P
zvxZ8c+~({Ly>85hugOn-EPMIK0Tw>LyNjbwX<R(NMAe;7tYTNwFJJYig~FRMjgB1t
zY+%9eoVEPwS5vo|#JlCnX&XA0mu~HGUU|ks=-a;Q`4M?MCQ%&aTiqT{Y`Rl>Av)vl
zj&4te>4ysViYhcNHA@`2|3!aSN6FQflP4Z5Ei4Y4Wc=jiS?2D<g*IMW_p5I2(qwS7
zKK%DbfPE2bZu%tIy>nN39MpE&aqQ~(`7bv)mnW-yPAdOB`*g3vX~q>#nG^mmp1kbZ
zg_ddUk1p9R>=I^Qw&8HvHKt#!p5N}bTnxD#e@6O8<t)8lZ@*kPY<0qL)AAP!4hkl3
zDn9d!^+C(V&vEZoyo&z$Wk<AScUSa_3l{^W4Q5rBo1FQ*ppnPuQe5w+JH<cL`;}W8
zubJ*@te>$#f3|MI<D)qYUni8Y3))|OzHyJB=MCjqD<<pT)8BM)*^-&ZS8iBb_Hp{X
z7d<U~SxiO3TMsuc4z|u;n%R8qh)nCgi)W)MId*?{xI2}v`h&K>^rX9bpFgB=O#e7T
z;8Mm!-NeYVWiytG@%#vVdusZ;rS2&@8(TLVej>N8vbADW{@PCs>kT6B9$k5kkymGG
z@1MqdpLR_4O3<BEKiQc(`Psd@@6}r61t#e*O_?2RzeQN}xl5YEBcICKw=Evt<|^i&
zXxiVY;J)Q%MP%$lP7e7i^7=gDH+}a0$vk+uPB@Th`opjTKI$!EOqVAcJPnoa*Wh$z
z4v|~9ZN(0oGpg1{g*zE)eIqyil5st7PUECQ(?6>pY89CcndORq*4p3uyQ92nzv-f9
z2Ad^)isvyb^4+zvvut)u);rC5zlnQT<-!jOa~#{b%3kEV+Dz4|DI1>cJaYFi+q|8>
z-l|>QBH+RI_u`BDGsR_H>b{@p{$?|w@QmyIBi<Eas>^xJUYc6?8CwSR{F__(F*+qK
zCdX?&gMG^H2NmxRKXi#Y)Votm{DV&3i8;PJOJ=j|>eKiBSZ;i}V8Lg3e*g1*etqiY
zvfdvJw0^70+wBV68PS-ZxN8<Kdz@W^V1upoeQWz$+aJu6srC(VW!ri6&YV59uX9;$
zoc7(AUp{&J+AA}7-?jy($-P=r|Dhy!a^1JH_St#8*R;RAytD7dAMIz?zXWGoU=RFs
zXvu?r+NoD_JXXBqJkqvCYPTF~m7{F)iFoPCKi4!rt@^N=`;7a%4;!ot)HZs!YVa?4
zd6`fAuf<-Q8LF3Fx6ixybNyLO&F8_Fv=0jVuV<h0^V~}<uN#XlyL3(bpkwycxs>sQ
zW9aebTbJGCzkjR0QC%*v&-Q1@9ZQ*%1vh8AelS0*#eFgPc*O+9#q}`<n9_p9^V(m%
z5%ti1^ybCt&5`S>t?ewQ+qTK`oj>=W>-y~aket1GY$CFrLN+={@4n|fI(|8O@0?9K
zw}NYW@7$aGDw9v%lk=GRv&cy)+h1s$@?@P^Vs(1Q`YRu&R=-F-lFZY!q-#>Ajr9i(
zKC>%F@{PA`ynQ=eZvVoifno8wDbwzxuTMF4ZM9c#R*6qS?{?)w(tIZ)Y~1JcZTV2;
z%^neQ^6DC&Yermo57_J5T}ytmYzuzZdvo$56W%ii6Vhf`e_1-eWv5Jy&Vj|!JKyKl
zew$&trav+=cl8>L%|^}#?4|~-NEFn}`(U9cWl-rLHLsa9Xt_gE<h6s-Pr6%#e+i$z
zlQBE?=)n^aYG&%mQP=OUiQ0Jaz5D&}bL{gY({IYMyA}RgmnESh`ZBO@+ZsKUP;W0S
zKlbapFE9KcVcD}+cHP!HrjdJA=sSwG6}fDVzQ1>_M0*mu{Gkc6``F*TTct1ei2VYi
zDl1DpTh_^U)w_2aU3tg1Eb`m`SY7Vuh$+9`G}eE-S)8MNYjS0yqK(zFE8C;^&&1>>
zN7h^U3F<7o{U_;&Xj*9E&b@z^MMkEd%-Ox>S_I?5vo?WWsuPk9^0~R5$_uSocA&{R
zLL{f_s>rH}i(!6FI!|IYXT~O8VPM~}WGREK*ROSYJ8KWg-C)s<_|nHEExJ(e_q6#;
zdy>mGcRpo`Xw#cJ(K>1G>-e)(2SVID?j;;iy!WbS>NI}yy+@s=E9KoT=Dy5y<a;Tn
z-h)V;r)(J&_tMkf|Bjq{X30Upm3LU4X#4D%x_L3TmS>zfbBNKMd-uN`J^$Tdp0rM_
z+Gz(*<J{;BQ@NYGedz`rwdETpr9Yfqn%OQk{rkIP^S!$H9oruUzJDszZXmsSLRjn4
z5(jnh$d;WFsvGP$dSdtw9KE7j=&?-mY02wc-WLhGrak6uSdq!OYZF7zv(66JscX*O
zkQCiF!<vzKqQ+~tXOFf#Id)ar(n^}+s@=QQKlY@%^ypvNdN+1w^}CZXJ0?ocn`5D6
zG&ybiSu^%kQ=+E&XMSzJ#ZyuL<?hRSFE2ivnH;&wK9@mMp-_4MZHd*DTuy#LvrMOy
z1p7v=o^-Tm=B*3S4>tablb*nKylk&z(XWQ9>@RxOPh;p#+!}Pd^hI@6L8zs~SI65-
zXRSUn9<~>7HBbDp(eKK|kN<xAv$yZ?Eq>OUar#1-j<MbUr5pJ9?#s!_&u#91#x}QO
z<+q=8oIl!TN<FySz>=w=6DhiJZROm&jeGmulec&p6dUTl@c6#f=4a2*)u(m{1W(w<
zCowZFOnj5nQoXpPEFZL+mrI}Hy&?HLwtC0kDa;b}bzh&`=Vr}!xttKU;C@_Oc%)p)
z(W`tDj9X2EKbJ={SARWw+A+c<JWFr#QZbv8<w9pNSC<6{H%Z-|I7jAElT?Gafse%F
zMNw+!H|iYgeXzafr>}<Hd6y{DrT;A6ZtJNM-miF<(f;Eft&pz!Pp`j-n)a)vHu%n^
z_w#jC3Qlk65>S#$-1+%MVE%T-#eIePN9}*`=$%%rD)wee5!%sMac8$|#Mv|F?tVTN
z8_K>`RF7FQ`Pzls%k`x+^7a=LESBUi+HP=nuF@~7+l#8-Ti)(Yo*)?d{G!3PNS@W*
z9;YX)F=!9m74+JLU1z4<tToox<mT!b&B{1-f>}9v+SSn8jm%QVULLH=7XD>!8eadp
z-TybwRY9(;9<GmB+qyjuUyV|Zdhw!F>c+%lRXdVoJ<c_LXftjz{l2aLUDyVe%q<Io
zUQ0Z175&ql6yxj1!a1k-9`_dK$-YmM|LQ-U=VfNzoOFisqU)lRUdh*!s&`&?l(*nF
z<dphqbmxT9U2gTa93lb+E7L<>HC&q7s=c^eK&$b@N1v!Q?n=&Y?q0jL%RjGldtSem
z-mS3n%ska{n+`i}XplSEXpqwW&ExpoqzUY^-><Gr2$?Z$Ro+8Ko|IMWxA$GYoG7ch
z)48l@>svPGkDuqr-dkb&YnooK`PyzRne<#&=d#l$Pn<K-;<?#>I;ZDWUPs8qoHw)F
zv#(yd9<}VT%-y@}&W#8E9S`nW{QjhI=>ELUb&KMjm~A|v`}A|}LoFrt@|3?*{OWsz
zF0Py7$ouG<lX==rk<BIRiXB%^+i^1g=$3O0EWF)^&dk<iTea|`iQe>eK}#&|tePIe
z!nSOE%!OGKz1p_@vI|~%?NavR1*;$KlS&O%Ie$t?Xl`|H*9#FAWpA52trJ@_SETA&
zyL)i|pR!_d*8=|h#0STt60*xKPc;xR+wtJg@ns6UMOk;YY8}l`(f%FDt6{=@eXYO;
z2batX@)Z#-E>+HNmae&b_wVJUO!oivCppU6E67T}v`gC`Q1M~$j}#3z^9Otpq3^3a
z*PEpC-_G24(a*lI>PzK`HTIGTyXzOJq)c)-{Zc1s_1T-9%<{|EY>hrP?aG?EwHmoU
zO1ABqVs=@s<uK>Q>#ExpRj+w`@zsHOk6HdL+QqQ%s!iuQtCKDf``3g$m9IQBebtM+
zVAjb?T(2IS!uelhSJ8{?(qoeR&sTS+tz5N^&3xXr_maInSNqPl_cp&U-`>`D!S0@S
zQMEgl^vy5l+zK~*-B7QhAH6&}wy(bYpZQvr9EWAE?^m7u;uE}KrSFccRc^Ig`b<pt
zSG<W(zPw`Pm(HD=ibJQL(NKK)wUOm?cBP%j<Lsv_*CT$^@g%G=*u8ANn<T@`_qVo~
z8t8A-T70QMs{Ah>w~uY+`E@s&4PRTXlA0QF{mPlRX;*EYGTv@oSF`J?TxLnov6%<c
zysm1-r<oUBU7^*M_{vU9I&_^*-iila+bU(7Cce7v!NVJ{ZH~m>_bY54*6vZxzI)sE
z#gX}&PexbOH|)$#E-{+0Fvl)%`H9qHYHc;$?g2Whn_jCZzOw5$WpLhW<DpM}kF;1f
z%LTRU3Hh8C@LGfQbja4$dA&!XC(ioVx^0(*pY&4pO;hfd<&~{y?Dvm(Z+Ot8FS6sd
z+`j8=cbP6<=iTsVb^0f%Ym>W;yJ~!9gol5A`~Q<wb71kzo>Z>a(UEH+44Iy8U%j@v
zeo1k|$@Y}rx||`~KHXsOx&8gp>;+Q=MdR)tKj8d0;PJeO1K)y<EiSrSawh!Zq<cFW
zXEN`&X85;MHt44L>m2FtGkZV&Wa><NBW0idTyk;ovMt(++W73|ePnrNkUE9w@)yS)
zCwLD`2@Y%4IIbZhkrR0INZ|d(KqH2&Qx`s+7u;7rW#y#ySbH(au<u`+6%yWm@4H`n
ztGc|RZMK+l+sT%cySM%pUFS}j_37+sjrRpX&3gk+%z9L?`n2DMTk8bYa;MMEU9+m|
zMedE*9WEPQ&YQ&A@88FNR_L1A=JM^Iwr$%c^Wh4&zti59kD>oqem}lDSEpj3-ktlm
z?R?jD_(<D5ubC;mWS{Z8);xFLIQ8r-`&r47y|Zdur^F<isO0*ortNvW`16i464R9K
zGUTe3T{^Kk&wZP9+_^&$EvJk>o36>=npfJ(d7@44_4Q>1k~+%ylX9k3+i$3za_Dcw
z@iRN+gO;<-mg;`i%^<Kv?^}N8E`bP#U7v#*?zMVv&sWe*xNfk0$G11TYBw-&J~_>_
zoHu0E70XO*#qZuR3b~1g5~eCQM7Q5(QSSd}v-#G6TimAi9k%)?Ur##hwW0jV-KeEI
zxvogrt@G>MQ1oHWM-JPbH0fzs%lo!6WIF6klvZ}T?!qoPb@!L4o01N{Z#=Pn{gZRo
z9w@(CIw7Ye^U~oBFI$xgzIHBny7Elo27_xHHY)_Y*YNkB;oU8nr*S`M^XsbQ>6+$Z
z$1|>buIt!UdXW8m@0UphAB&AA9E*$#5TBcrXQcR@eP7v?@P&o0OZS?|X#HQdJ*Oe~
zqpNQBi)Ds;UwnJueU|B)@O1M_J)M&M1?xq0cV<6UjrBgxGFkb{>8%%9R=>Zk%Eue8
zyumg$|39mY>PexKyX+m$Ule7S9<<C#@9IizH_`iCPd7h*aAF~Qf28uN^gB074;)hL
z?RBc&@^b#t2mYKa4w|0Z=S<sqdX0;F7Gtc+-QIZ4HM1AD+&-=p=b^RmOls-M#UVQi
zRQ=VpVx;2(W3F2KdzYOvOFc$9-y=rCvcUF{&fMibe9Hr_%yO#`FbXcwf6B1FE92Jf
z)6)zJkKgs!biw`cMg0e<sr#Nd)NeU;vE3n0XKkA2(+xTr3fC^L4U*RJ?ei{~Ti^1q
zQnO8}KB>>-a=`7+e?`{2XdZUXPe{7+{y??##Z~#=8_hrQyi`{HerChb-q!px1>PNJ
z*T2os_580Jdg*k*e$9;QHM<|a|5dku&sMiJlka32Yv%*k;Hi5nH66ZBRp?6Jm9Lkx
zvg79$ku^)#o_JRsY{vWS`YzeK%35y156o8WPIlkWrj=SA=c%q`b&aX(eE$7*1=9oT
zR(V&+)f_TvdNwik(-W(yXY^DfwPjZ`9A#x{KK+qbbpHbX6yK7SjFayjoUmEzbibBf
zapIe4b47w}&NOXExVh)<yu<I+j_$cy?)BL)=3wQL1*>nLxe=-KbXBQ>k4&Ck%vati
zmtQeWxqfb<ZC;59_mU-Vx;Bfj9O2bv_Wk>A)A?f)?5c~Zm2;0Do+4e`{<-G<+Hjra
zHXUik@{*0`lJ=W<pZI#FW_xSg-WTFBt3<TBzP)<2@XC=7#o-UG|3f>)MgDjAp%fMd
zh9VvY^!r6oPH{=jPb?}*tSr_ms5~3yoB!BMVDIa29y9ivE7mM~xzu#RqLq_&I9|Ic
z@^K-zvOq?r%I0YvQ<qGVa{XW3{%cc8<z`3!tBQ?BepcnD$<?y?_g~+C-tH4e>#>`$
zJ%>KDES_~Z^xz`hb9#S@pYt$9z7h4`&Zc*6|L;1t`nr~@Vu_tmTpb@-jU%5t;bDt>
zXVE#yvL!KSR#2h@(|PWdJO+wO65G5N$}ayoZHkgnP};7)3Ex=7H4S)It4-LSD0N%n
zdc=YSR*U}%oeev7Yw;g8WnniX{ff3z&CB<i&5+lbZ4h{_EOt(Ur@r!JtB`DGkv9=t
zyDW9eGF4m;UH<l`a5~%7_P{wUf*M=%d1qfYSnsX&fpg8DtIv<mHu&*XZO8uVh%>Sa
zmVawg{_gyPl`Ev@T-7zZF7b6sR{Y4f$>W><Yue7Y;m6F^-kel*hLtVaQ}}_!x%2L=
ze*feyzO}!n-{jA~y_`G$4!3<o+}-<gtSWx}*|ID0pK)oDkHRD$&29X%bA*`;*tdso
zejOSrZ{Hb`7&qPLTl1s+4>ne(YF#Z>`aR1%Z7r|w@l*SSem}qbjW_T0hl$yn<rpjH
z9eT6;+ZEf365n^eOgWOg!)D&u&f5v)whC9`<R`J~?Ug**V*NGPM6qA}vR2p;mov#}
z9|CT?yfUTW@0$=ilf+Wa=?|6#J~?N-C;dZbO!F>2-k9cvq34#GU72CCobjgfO2fPp
z8&nVF#!8sPeK>ViOw92D>(Y|^9<G9mfz}W19$U6`)AMZeq?0~DJd3(sY+SE9^Y3$q
zw)0%G3om(g#2chqoK{n>u1<=!oxSI!i>;Piiq8_&+`ms3N(VpBopbd{y`b{W9XoqY
z^K9i-X}Gpw=IOw>U%!{8=Ucz}cH4Bmu<pXtj0eBxdst3#$e(et)?8oRa;5k`70vgW
z+g2`$k6k~@Y_rp@1Q-1Um%YC2iZ=0nIPt-RORkcarQ9Obj)x!LqWAl7JO9=HdD%0Z
z67ELD%$fh6fzzn^?$2{Kg1nU)C;y6ic=m#q%-ieS=?(RgAx)_ctJX+({%hIxYIdFc
zvaLaT^E~YxF0Inaxax9PUN!gavL}%_Gq0rvp8Tbv;LiW9F7lGR*VM`n1zTtQI((?;
z)??mFpH5%8_r_>rxn8sG-OroP#J!9?-I(iP*=fCN=gD<klTThhmi4p3UG~I^O6FB-
zF0?C(-)VX1k~}R$Hb?Yd#QXaJue=K7RWj?$9a*MqDS1`?v3=96w%X!~-3f2cY5v*#
zgzIruQeNb;!jwgwrK_$<tqJL5k6dx|-l8>Ac2EATteC&;=@z})&(ElxGc!4oppx-R
zamvkjosgdg)_7e};mpkp`*An&(uRUa>s{xQmy6Gmy6t-EUO(UDB`2**kNd^6cj~y_
zIh4n5_`307*#)-(w(JD<tEc20S0DRia6*prafLWbQqRZVuV3;Q>6O{WSw(GI^Xh&0
zP8qgJ=Jz_k_B+V=9^Ss+bi;Gy8_Y6IOScFsi>OElcwaeWdLf7HZ{7W7Jp-jiwSvsd
za-Z<>isqlMOaF7Du5<d)(RFe<Cj$eo90LRB#Hm~yM@=Q?=cQ$)m*nT?=oM7Xjf^h7
zZ6;QCeZ9kD_DQ`*3g^^Do?Wpy@_44z+hy~5%hHTjO>5KWaPt+?akzD@>d*b}G7Soh
zlZqxk^-1bvIQP}s{6$aAzPkVKkLuf`E=}s5|832hpN+;lRo-jOy0_`5YmJ??^7KVk
zUi0o=d-CYd+1p2t{yZwZX<zCSd7sWnZ*JP2b`3p{7-SrECXHQ_Ym!R)vOE=Up+ntX
zCuUvPBx1UDr$*>*^?QLw-+a27d^W}N^Y=ALsvVQ$o-g@d^L551uJgO}uOIKKUBsHb
z@+d3Ul+SZjXBM+^G0x3qbQf~vKl69a6Q$EP>ij~cezsa@6kJ?%ehHJAr&d>&ms!<B
zku5e+ZBs>NE@|Dw!@uW_`kGLc%<#8qyH_%7+x%^F%D3R!H5D@jSDo0kweMQm^$#`o
z=jME!efCG=n#W(Kzh3?1)8ng8&)e7jDzsGouw_j|<@u!=Tm9Em{tkcV7uU35YRZRt
z9;FQ|cjnz&sPcB_>)mgHrm)Z3o4!ESdGh(ROuwm0&;CYn98Z6EqxWLbGRu8cUta~y
zpUfkn#Uj1o=Iz=!nneP>JJowHO;cF8%s(qZKw2ofihXz1fqRZmc2*pyO~~^+DQn#%
z?p5@?A+JSO#AJP=$l>d5Oa5f^Y;o!8`or|%#)_ys#&=R$E;1&@K}^dU+73K^*22mt
zpk9!&@*{t|6mzwsRtV3(MLDzBYR*ZVTA<U!qgr}=^^)4pUzb#bah-I#@`00)+uXdb
z!QA|bLnU9tJ=0qpthP+*U5YbaX*j*VmZ6*LDZ4Dt{r!8Lr3=gh7a9B!^<a;Gz3fpn
z$0OUD-9{U>oJe}OlHDUKWoDPH_q)t{1}6IgFV?sUAD$lKaWd%0{=5Iq{y7_1l(#We
zU=csV;UD31bu;!w9-q5-dy1=F=cH0=;V)aZOK;z~JLdR$j|-X7FG8=+)StAl<66pj
zzAYzTKT$}T<i(g5H<8~Y-*K8s!70Y$Tp>M%uRqLbHTrS>S<T1my8p!U<Jl($ifbIQ
zjC1<s<#hDZ;W-jh8?MZ;$V~8LQfFrQY!(pk;=9e&XEP5!FMnESt!}Bixh+jymwAf(
z<von@;am3o4K8*+eQxKfl{0u2@0eUU=gi>)NB%O&inz=Z3wslHWa{4w%o1k>7K=96
z{(C8Q?u7Wo7a0``)UL4H_~rO%mSn)IHz{ZNA1+j!;nW*sSJ-@N>RSDUf?91A{LFjV
zzP&Yf+nXV<DuDU7Y4iTPo5>TlXnkohdmcSK=s|+<i{kq%mhwl^ZXdJWH@9@T%J0KY
z1{1$5v`)CP`NMqa^SeIr@E0wedbD<*&pEdRdEHSxFZ7MGFEehPC)`|7*?Di7xlq(v
z?FZMU>~fRt*y;0Z-mJqWY`^BYGv8RhC!hJx)~(q~Q$I}K;pH<oo3*KkqxD+XmCnZ}
z%y<>N(+@qA{jSIOb(_=Cn#L;Tn<4j}i@7TL{j8rUy42Sw_8jwa*OZUV>r!MxPaON7
z!pb7P<h3$KjGotuyh+Q8|1K2@5V6|6;#t9iexIW=4(qlal1iT-^0?{R%Up}p>4&x-
zmMpR1;+mbws<3BcjaKXq4ig@m<606&Bv$%Xb=Qg?ov~gjNBaGZhHGbM|4^!vPTv!^
zXJ^Il>9aX!Pf|L!BxBVFo35o|RxF<`=4{B$NxEC88gN6X;ogCB9dbVFWBuk@s}^@2
z4ULwsI=JlA&9vo=`}_WfGI376EXa6!?ep2*DIRipl2NYTBV8LyMVZ77+!MR$`1z65
z@>#-+X;GGIOIAovy`Exx#{721<~=WzFI|YAxHV_S>pfcUt}5MM8>4C)d^qgvLG3;F
z_#W$fe6pT=<)*Ut>{;)MuDxa#_U>G=fb$mjGDpT%&+WVGtRLH5<>uP`sNtC3ynps3
zGPhQ}7kFdr*SP#U|EBvE3l2`**qCj?rafs+zv1g=0s4w7rXS=Anp2<s*`e;UN$G{U
zM-OUlZ2j@#|B0d(jtkyg*`AcYsW~acN#xNV#k(t;-&A<2URP$>S-1UP$3(*o6D8dp
z0-Upsi<sTns@AS8>AoRS-ytY}N6L-UD{f3(rJuj9u*A~&&5wM>6B$yy%=Igkn~PMU
z`krpT&3&V7+4;}iHnWxsnfm1!+-oYlpf}k#-@<9RoBWod-1HXR0>{hIeKCLLrQ6kR
zi!YB_B<}rb#)VF^nx&lcB6{2;IkY#Vw?$lkXdrc5rGfL<+GG6jylbyEusr)`CfGi4
zf2^E8%kLH2Ed#xM<gXlG<UjxAYEhxO2Fu5jSJ*Gm3lHMbkh|_97Nf}f_ffWJPVSP_
znujMA9IJcBwr{82!6jaqTQd${JX14c>1X9BYu0%m5)}V5SK@-v?Lr<k{yqENUjB8b
zXRpA@8`me_m*xn6@oRR{1r44Tj_p-f9P@blR5$rf+S8}L)jo9Yt>m@ge>k$wm)|Uj
zasTzK@Kw^Pe0kl@lUXHf!j>w6y%krvQr^Yz6s}gi#pk`ZT-=y%wQ+`;g-M`;klJ_W
z<aIh;91ESEJ5*@)R`we-{M3<Keqv#Gp;xe3;=9KiReNSG-<|M#%R;lP=7$CI70vUv
z3Afqt@ZPy?_M_3pmVL(I2Q@DQyVR0c=GO_Uh36Ycx;#$Ft^fFAL)Q1%zq{V@OE#<3
zP58g}=3(s@yKWv)`@FPE%R_bJwZjR^6AajAycKZ%W~Ke^UDk(-`@FfPme%ZfC;Hy&
zarx3m?<2KT*0!$nlm1(${;BrGb+#E7nV8wjmu!tq=6<xT=2zG|md?!9aG`~1j3>C8
z{r9t7Tq#hx{EnICpTb>+vWAutnJ0s*pIHA~b1>eBO<y)@g8)zCqw{y-kG}PP(Rc9r
zMTPZiZyKMBkYtNrXZQH6kAR)6d#nzNLC{~m$FVPNSa(^iu(Z3l<U#z8+T%$*Pa3bU
zSy&x0dsXM_G{5|bx$C#h@e8^7%jxvF)#swtZ;;GcuzbR$>~FW_xnh<s`0B29kHsqI
z!};au;<GQQX)!+yn5<U!h2eZ`m)iYo?vynt0$e>dnRDlrMt{3<x61bT{;B>84hrb6
z^_=@!F#E~7>-=+AmG1BOe&PS44=LAf?@7F08s59yH*2R{)6qvKt$*Ywf63>n7xnV}
z^<qZzN#Pk@2VOn?-8yYWd7y=EnfAx;#goLoyldq?`%2IFieKJLpVzsuTatg7<o^DB
z*nCo$d+6pzCXu&SW<97^e(M+erhFlLyx-q*mwgkQe=|>#-D}Hd)*@6N^-bBmUV8EB
z<(7Wi<8s!zZEWpVWt%g1X4w{B^?A0pO(k8f_6zv)byZ3E?=?7|;%W7QZ}F+d#djag
zI{EpcxA~%3P1|?7{|--U6`qw4sMWfZcWdOG&$c0rdf79CKG>tS?7qo2|FsZcU|3+z
zfcMJ8<kFNxy@JZE(!cX>ANyJUSM+)X!^wz6Z%Z_S81<%EW=iY$HXS)_c0$TAP<^JU
z>n0ncZD}v+?|-lT{y<i~Z}U1gfzwa!ey_X#vZJ=<|EKwz%`*=bA533=-Ddq|-&3nC
zs{@anG@WnD?XT|sW|7AC&|Q1i-Q0Y6bAI}V``_PunzcE8hepx1XY(t=rdZ!NlO^|F
zZL)9Zn+TEIS-VzNh-@qg7YjZ6$VUIw4!`agAGKFE&9uXQ6(9Y&-06k?*L^;pb-P)2
zPf0kvW8b+;Q`>&Z{R`nZ9AJM(F?Pd>?>5@oeo3CUUmiM9`0A^#v##5$T)ZS_k?$Vw
z&3mJEcd=g2j{7v}xx(_4|F85Osu~%m%70(<Z1=aRx6~iLoU3qQcE#z&ub#USr$2nU
z|K9#Cy}G*6kK3>3*U$2o_|r4_+p5}>^*&v(Gt>46Ro!i^GFTWoef}c;7?a4_n^Ppy
zpLdAb>*^gYcd44A>k_NGe9iZSP?4KOMxL7@ILa=rc|6T}|LHt~=`UP@l>}>KQw#Uy
zPKZ3P^TVV~UzVNmeqqn>RQIN!@SM#S!mQobYJ{14(<Za9`5$b#WV3eh32~d-J~LIP
zTYlD=$naqH?H#weEDb&x`DUds&8(XEemdjqzX$G#Sxz@PHa{%qxmkcf`qAr!vfGPd
z6`mEGew`5<a*?k_>1<`orG6E+_<vl}*mk5bCtQB!F>`9&JLw0FH<{TIw>9=}FqvM>
zu5zoW(LQueQ!byx()}OrWpsq!+k3BW$EOG_j`qg0Vbx*H=J9|2KIJastlIDSdP1$q
z`smbSqUqn0TV$Q|XGlCsU|j!4!9;7ytnw)<wwjr0ocr1yX41k}V|h#Twc2A_(fyvR
zwQ+im55BXP#~-cF-r-<$HE*rRl@*mMOEXq8tBO3Y-k+tQ@@~gP4|ydCw#{L>9T!(!
zI~I3!;(-OzD^4G{dROrG>v@`w=WmKWcd9GD;^?cU)XX|(tBKJ|vqUCo3TMtMsNn5t
zso#FR@a(7ao=SH!V;Ow4nRj%5+O^Kx(B3jqypzLG^!1cAe_1@2{!hDQlm1%kFVB8~
zFP>b_O2y-@?|$Q9WP1AG;<QInK1sHdL(V;szHaw3f7*-QoN4Ej1h!vcSatOKlpPK`
zLl0XUNw;S%d9y}-E0gqzk0&-=o2ALn+M#jikMUG#2dkz>_J5~xbqM<I<J;Ajzs<F9
zU*8qA{pq=U6Z)nXdo206WcOkL#imx@k6tAnJaY2tIs2D?IaSuX;wIOl&t4*t!ObUg
z8D(1p#o1Yek3a9<A{k~A_x`4D+?_?0MIBNJm!&r>jGNQwa{0=M^Sa*?W^S?d_#t*?
z#@kEQ9M0nE;>VAxZ`rw~E8cO_6O%=Ln|q$hgfUEttvSrexx?ey8q4VAq8?`JCcUnh
zS{U7AwBd!s&$ByE`SRSce7sY1=}rDOIrp|}9cVakzE`SF_tKtpjd@B(xPJ+VbaD93
zmu=R}-*fYIHTMt3H8*pd<&-#DgjOaeUen$$Zz=D%ly$+~{;NV)3|6PT_LgpB4UKsl
zxU6Aoga1kf^QEP$m7;%(9XoK2bz7?Rt&4KEBxF1vXo~N<^;3M6ZP}iEde?GYFL*DL
zT*ALt+uX8Zm(-^eK?eS4+oT(A8WNisPfQP9d+Oqrdk>^J{9dfuQgo@7ZRRS|)gRj4
zH(pOD+%@OR4QW0}4fCWUYhOQGw?Ofr+x+C)ZYh<n53YFEN1WDw8YIb*pxM0i^S(Aw
zf#{=ME?1VH-1u#C;c@Hhea}w`DR-vb*}%l*<DJ5?=BgOi(qi364XZ2G*PrINY5J`U
z)oV7pr|?3m;cQU+cXy*d92r$JdK)=U_%Qv_I_Ppz_|1lE&t$6@eh6Q4Uc`P;eR`)$
zW2U^*zLJHS#+`2ER&F;mSWlb`SmpFF$=JBGgTHD;il5{uJGX`;ZV7X_vO3S;&>QnC
za_-&!!M90h;Tg9#r<FE~HcT#STXOJSZr8#+GE2NHr<+XZTFl>k^0kfl$5mQd@*eYz
z<YzZ%PX7O&<EYSf-3YA>g0fd%9$}5-ILlWZIJ+Rd`Z%Y;ocX(zHg*Z~y^!Bhp|W`?
zpY5cCUtxb054-4U8uB^btY7tde*@FpTdDJ2W^Lm&5$Kw>ZE|1qF69EQM^Q$zL=LIN
zG|#sB6Im2)a`VhfSF@MLx^m@~gfv8bz3|Y1S#HU_>-ma*4%stL`)3!u>el5+^<vi@
z&gxC_d%zhtJ4&tU|D#XoyVoDwFf(cA!<hx*j=y%ZMmoAaVSjT<k<<6#Mgf1J6>GC1
zAH`Iv_pb2Uq||Awb$8)*;oq_?hA$*GG-t@V?SA*W=dq5n)xwe!rs59@l;6GhTp+#a
z+T1_d{z^t%iNy;Zw}0Mz`NNx2+)Qicy~|CMz0mBn!ZPbm1INU;H8znO6MrvS$-~OE
z=;`zS{P&k_vC3Iiw93KF<oettv!kZ36FmR6?()_bmE|p;5*FDdna`Q-^)L6FsKP$e
zk_Lsf5~rgbg$*J?9D7^X){9JQU@;K7n6*2^PpG0Lf6AKd@cCgDjGlS3Y#cY~Khkl&
z9rb1Aa!r8<Ke6{=uV-8>?t1?9(alZI_X~=B_E4|cAS}GdD_e4gNRaC11P!);i75wp
zsuVBi*s1+=_`Pm}pW}+(pQnX5A5s^U%>M9(q0^=CL-ET;$6RlHN_bqmq|b5oG26d(
zH`el{d0WRh&omP%DEX<niY4{~=c=do^cM3q_x(H4!WVl!a7M)^jpOx~{B<tGKhKa5
z*sZ6#x_FPB*pu$tHetaFe=~o6&(E0p>CdUvseCG@rSus1R63&HoLErH;$acMy;oqd
zW6qbZO*3Y-u`oro$y+H}zDVP-j^Rr=H_g$!*iNf`$A`M~t6w{syiGswi^OELUK8%R
znpV8T$yqu~yQaEw|DDT~8<c1I-MXA+*YQ>GhRL+LlCr9KjciNbmfqQLYtn+SQ<4)-
z&bn8m@_f?o8{8Z1kJ#7MeLt=J`FMNzd%d?>XAd>nbsTHie=zTiw$8LC${RACp3-H}
z&{%z<EC2gjrIsBsOqCm+_HX83KXJh3(8U&83G;_83-V`~%n|v?mgK5y+*(pMcN*)?
znv5o<4k4?cFYjdMGE5EKm?v~@)|~r}l8qA=Et;bkW$#{i%CR|(bI;D&7n_8?oN>)>
z(r6Gen4~7U?Vj(kWYG=NPM!!^$7h`(<}mZjCb`_1-1mbzWb;dTcgXM^=}z6=V;vUk
z)U9G-Z?Ko0XVZ3N|MxY^OI|ws)>6~`oVzomxqY3AjHAcDrOWLSzARj!xV-ze$fEMs
zkrTyr+9e&H?dxh(Ha`A3#YR{{k?(!#hAT%l-i|mCkUO2vbp3|auhP!l49<_(f49}Y
zI&|f`uoAh$!G~<_72a&vTFk5IAhoiA<>MY>pO5wNflFJjzI?2Zo%2)Hch%Pg7uN5o
z4?YyedUmSCx5LX1&cBi~@zL^oyxWYJ9)5ly7jXWBoY2(0{%7yVFZs$*GUb`f3YSIp
zF>dqYYJdFrbvIh2y3p!(U8PKgt@rz~&AGjH$A8Aw_g$YW`0&k6Zq-%qQ-WXd+%0`-
zcSXL8`<bJT%Lc2dosW!4qd%;7HMN+?EPkZWBKqh_Ubnou@bHa1cV?*+YrWgKwaDMn
z<!8sl8ci48+noo)!+-m^G1b&6Ijxfao7n#{)MNL>m#_5hgt-R)N`E)6E;ZxG%E^z9
z?beu;vo=fHYMy*fjro=1k0jewL;c#-&diycaPW-$i6im-JXO5^dT(cHOxt_;!<Ef*
zo+dKq>}5+|w)T0CSg^>vb1%(W*Kgn2qujVsZ`$FmMbodl$~7^T@z2d;Oq24O&T_f6
zNI`Rhz3ul|RmRo#EJbc+D$921EwnlMk?}=>u5E&Dz_W(sCU+_?8i)RI^br(ue}1F-
z_uAT09v`U#%Pq2hXv^5y2rZwZJ#Wqg1@p+pM`v7llMX7L;M~2}Z{zJLQ>P{vuIs#e
z^O4@atp{fATPU(%?%a9vc6DExBla`xs!wi>S2y#{Yz?m5J=IZ_9Pc?#Eu8+|s`Yxt
z9NDfLi_6N7*ewvTvHi`+AlH5M!r}wQ=X~FvxnNb_)X~uw%6Rh6!NzvAg68MBr*6y@
zHY|-wzbx3(ZoZ}>BG4)G9&?YmjFnqo;h{M5ocbSPEsIOmT%YvWf$M=lU%y1}W1HP<
z2^N*y=l50Lo8Kp0F11D{L}!};|2$5f9aB?<A0Ibz*86hf$I9gfxnEoqEzAm@cAC{R
z&A7FhX>kX8Q)c$5!|grJJQp1oOMc^>reqb;zUutNV=AX~T9;{jX*&AnrqK)e?>C=s
zUuIY4aM|M3o_goAGADTN#B#0YPCR@5%2U-`ksa=~LEGo7k@m~|zv|gti<^u>K`#Br
zqxV|7X!_P~@nYL^P3rZcNKc!Ev3WbDDI9gw-CX|tk9GdJJ@rd|Za=@Fw`Kq0_y2nO
z-#xg#a5kSu#4D+(OvV9TJ@+~orj;spPgvF>;rYetrNhhHoyu|wEJC8USeYVjZPuP%
zUhwAGJMKB!eh)Qk7?MsI8Tx;CFHu->&7te$_PfvP_sqGcV67Zfq++BcaN_qBWBWLz
zdYf>Ed%OGNPlj$6kUjo9X8+91YWcNZ^B1?oz1K;8aj&IQ=7wwZLgmwE&T`Mm*s(aU
z@@nRvs@bR6?uJ}+m5Muc`JkH0sw=F5@$cr&axhNiew}q<Q~XPBrIOQk;+`$q`TT_I
z+(xhe^<4#Kvhg2${uVF!ZD6U^u4J+Oz0OYWr!}+A+BNU#-XIZ^n#WMN*(XkRPHJjx
zZ>ImhjpyF1cIb+^#X9lE-aD)6<?Kv@Z%$qItK>kgiT>hkK_^A0w0?P6@U-$T)4^@J
zv&3w-$zRs|#~W9oVs}B}xWVb}<vZROIJkUod*Sr&Sh4n<OQ-*}Wt?8Q#>V84TiMai
z8&WMjeWyxJPh{LFxT<RPDT&}-odt?~TT|IGXS62%*nRNfNAZxRLbLZWetdJomE87R
z4gVu{{$~IA^XJs|v&Y_ME;%Q8b*At3;1_FV?Vb`*m!Kprr)+Qbj;ZzFgEOshC0o|b
z$hg`5G-A)uOf@$xv&@!Ni}KU&9}e8se!+PAT-&mogGHJipM4FR?wN%fH<}*Gntvj3
zxoKoUzMFS$-NT~2r5bs6H@07x>*VOQJ@;(m%&ysiJ%V9Z_U&U>_w(zWh0adf-|{TE
z*J|VSnW_4vh5wHEJ|~m+sokwEJHr?y^>ZzE<h^4Yd`i_XzKUECdfLU;AOF&6xzOBm
z(R+V0o_ev|LUm^Fnu~@dG0UR3pNY=%)|KtN7@jOQ{S5C)tHfJ|B6hnqKXt@v?d!Jj
zeRPJyn_<E1cYB&QPF}R;>Dr=Imp}Yp66v^Iv}@7k8EvyO<I3k7o1K0#?;Q7craz^H
z+39=-^FAIc<gA^$N7(0Oc<w^)U%O@Ri-vOjyJNUqKi2EY=_Nhpp&#Y{+zWYY|L<J=
z>E>NpwbJidGo2ESt9*#j)jY6e$<mbH2k-iE)pob-S{5z;!?nMpm2)zi@~vB6&Dl6q
zWzSvy&K>ltEO44y=G?dJpS1qnFx&Lvx=+Zy?b#cmjO%s%rhof6q1L>@M{SwJQsens
zWi~I!dK$}6x>)9G?p^ic@6)bw{5`$s)fI8CuuTn&t*^Y#IXp@}!k8+__I%#*7fI)I
z-i0fC38+`hS-4-M^xn@!SD)-h9dxj;^!gpb!@yvp!oZ-2=jM`>)RNR>(A6btqq6hw
z925P!Z+}wOVuhIjEl(9#ceO^}sJgLEH+n^?dgHEy9Zw3%mGn-2QmoW|vH$y>$_a<t
zQ&e9tP1<pI=I?#a@6Egz{O#qRAJ3b=D?O_`%YRSJCf`M?Vrz>2X^nfInx7xsd^ET$
zWXf-^oNc_-|K5CPZ+?D$p8Te6-SqT5dPUPdWX}_Q%GVuvc=6q&iD5_kS`%-X<sLme
zp))ozgtz<Co{U9qB9(h1UToZP!btA4;ryk!a^|iR9|rC{cjT5&&bOr}%ym}XY)unb
zvv`*DE%kWmxTk?-XT0Y*_gB2%{O{+J>@(g;N&NFZrbVkf__{E|uiMQ3S9qKA24!Bw
z*2Kx3QesSRjc2$&`I8ZSpu*1j`BXVW?Xz96VL1zOPw6#v$Di{*wAftT{r$bVioG!g
zHD6NZ#dohdv6Qpd>F)$n<KBb?S@~*Th32mkxBI=a>(nImU%xeVvR?n0^?Xm)hcv~`
zxEjun@7{j&yw~u8`@|2+_NjWWmwmb^HLpSW(=qj%w~ZcW*>E&n&Ds#NF2tD4nEgq3
z*3y^?xufA1+v4AN$3^FClu(`?9KY_*@s+!xbROxf%Ff=F7P>oZ3G4jqIN9zUAE$^<
zTG2UeLQ~t6C)*mlp0q3voNfBGK(21>f&*{w9`bRz^WG&^IqdL-wUyI;z3F;C-Q;pI
zd%b)>*qxWnKMv?f%)U5jLGm@<1?Sg!6d6dL*>Pmk)r7F=mW@?h8`qrOG26;$#`U!)
zgmkWd6Wqg>*ZE=YV_miqt-d#=pAI-U`-Q4ZsCob6-;z~br;b{mH*<`6;;ZthDx*2+
zue6QAS%-sHvzJ$%o!KCIwLoT(PJ`zGd5#U)uiMsI7P`JuHCcVLYt~Yw$7?hrN@6=&
zj{dd~E}YWne@Z)pcd7VNKAwmYwWvL=8EP$oJ}(5*0{3MaItYH~Jk1c{S#C08ufksQ
zJ)DU*14<lTJ-gWF{roVCdEi#bqvu^e7~NmL#8qapZr`Tv4HtIQv$w5#Ef9J<{mb#s
zGt-?pKTQo+<vFF@ETp==Y*A)~P+8vnb}y-&LY#*=Z&$ptGq{?pAGhJ~{$FqIm(8&7
zxTbY!*T&qEvk&>^ZPxI7z*n(g`D3RL2j<4Iqw87sFI*w+aN-45+=`Vf7n^dYs29k^
z<vi4Of4QvbK>GE-Yek<nB}sI&y??OAZqhuX=d;31H{D6>U=9qmd3;^4U~0w@p~dF)
z&Jzl17!^XaS^{1_(q0zsw1|y)tFMXs-CfTnEfX?Gytu1joB5)fo8ld9?yO|`uzK&B
zNB=Wjk4`?$wK(JYlG?MUIRegZ-s@{{bdM?1Wk*xr8O`}eeQ)qLacAiqKGi0=av4wT
zgDDnS+3%vaya-khk4UlP6uNS%S#zpOz>2Q2%|~SpADMnAx7*Cy?Z|}ogoz$cJBp9K
z_T##$6_P7=<JJome(uOQ*_!sR-o{;QoXs1Y5%{^$zDsS2P@BV6smPZeCqFke$+0q~
zsKk43UZb(@)+IHiPZrt2a*MW0>@-{YrLv-y|K|4C6F*}Y{FwH>_H^#QBkBLH@cd)w
z@LlE``psSI4)1H$#tkQ;Z|CW6?pd-=Q%fT<H!4d%%cihNgC$v)+pg|#>y_76&b*!X
z!1L#Wn`#0pN=k(ldtzqJ-Z$qlFYCevffP;4RLhHg%oAL_Ph8?UAkchL>u>yqwkjU+
zj_>hKy~nQR&J;TMxr(zgtpA5^W#-PiiI*Q&O66ANT05u-{9E_GYpbnA<-SMjyrb;7
zRh_P+ioJDi%3a{<+1otlbwl=DivvHyKRN!q-+5bQ(ZR*%kL#a}xU??w#gEV0#+z=6
zb}04iwOh<?e5=6q<5$-Ant7AIxJ%U(*Zf*6d3w`p+1|bN|DT@edF$oqoc=ujtjD?8
z7M__OnDhJk{LfZ2ez`H#<e#8_`t!6u&tCU>1n_59eZ72r{ulB3!sTA7r%Hv2?!JgT
zdQ5M|i>{3~vRdZ;R9bb5>r02>rSJug4~h=C&-4v!+xE%!(c?=qGn?m%PW`~|dM=gM
ztapWRuH)RDwTH4Y#RG(5f5)ZTdAzn_eHtq*pr_?>%IUd);x^I#v{_tk+EYW$n{HlR
zIJewt`TQA2{dZl{n3Pg6h5cNuOs-;iQMk*6M-^I}_466B_MVMX?0z_J;?x9*U&0I=
z7nMtsR+b0tm~;1b{mN76`z&kCKS($RKc6<^&dme!L}I4;9__F-+%n&1!>2&CEvp!B
z1~7KF9KD};TE8nG-zU|J`CMb>&G|;Wx{oKRzSXpzvcutX<E9QPF0NI<+aGZ7NiLpz
z#kJ~4c;Ce{Yr@!9v;BVX;Og`3@B33zx16~cdgL-k#v4x`xwX}wKVEKK<X5Vb!@#rP
zZvLv+=c2jMd{T<P<DSRouA8^l+k1}a?|GKfe)VnayYpE==wwF7F&*xe1#4G+JR*11
zVmrIgD=rSXs^gLG<2D3Ln#a6p!i=4#Y8Z^}Z=2m{n0xV47BiP&;xv|3GZ!dK*%dSM
z=7UWsY2VJ|?VLZSAm^~rq$`D1-#5-EI>zL^+HpZK!_MYeH&)DU(L6lK%R+qjy#gJM
zRDao5DH40byjZr>pBFaY$hGZCg`WP47td#Jwb{luk?B>F>y*kX^^ULa?z>~%{5898
zt>4zw<^c*@Pc`R#U9#3B=7dU6Tf+822cL$x*#ev=g|Gh(E^Ut!oqaClWZuua6L@7A
z6YY2BndcoZ%;1wd@mBa&S6-97p~TUSjS}@Mj!K@LdNudO96c?el`a45K27vEdnEIC
z+R>@672cjHS6Og;j^WJqgH=ACe~X`rpOklDq21GM#x{#8ypFg}C~r2H82ia(x&z<k
zw8BGCPck=#)E)BsUAyt7%j=%ts;?_e6qhSkuj*KsA*1l}nd??&ha<l=%6D&_XFj!6
z#%Z<n`wP=2W^dtn_IA5#K-?>j$+M3=xBW74(xc;V6K;ejzgBXd6(!2#nffy(s_f;9
zle4*gyI=qL^oj7){qH*-^XT7IP-k1hZLw*WW8jzLdcB$JHM#Y?65dD8tXjxe@I!N>
zagf^jJI-2b0_`@dt>L-B|3XK1hVZ85$y!UF>~%~0m9X#AX#@7NUd%iH%dcLvvUo1P
zeBz~rn!)a#NAjM|w?6-JO3>14hVzbX$mGvGalBwk_5;;9x{r3OT~R%ChWkDb*H)i~
zlvjU39xvd}VqeuO*z0=!YV><w*H4SL<SlMH$CLER_=%?IUfrjWG8;Eq8y-HSw0s7y
z*<7gyDatG6>(5`?7P)}s^?f~^N#-$gL%zy39(p%3nq}|K1ARO6GGte&U0IfFx;w*3
zUbub6;++1zCNs;$33VaeSsUvYy*e)}`OipU!imi<?fx`$oo6dF6c)46D^c^?ZeIJl
zX=c&wZ!_wiH{P9nm08z4T%-R&XYFf_uLpbY1wB5qk|(Y7!Sd7X>t4U8+R!TA=_$5Z
z{8jg~9*eIPnfKP6X?r?}{Z&oV1b4Y0zjw33`d|I`o$ct$Dl7dgNXxx>g7vfarMnxp
zPs!OcY4*BF$CX4sn(S7XW3@oqr1F2olV?32Lf)Uw;jvt0Vda^5W~N&7Q-Qhe2a|O>
z12%7)cD>T)en#Y$E4+ONB?{dBGgT~FtiFG}knQ^WPZ;$wW(RBS*?976%zMinMqII8
zqT&1QwDk0Cu!v2RJ+)gaXW@p`JO8iaDzsbl!c)fix90X)J1-k7k+f=PJ9JV=g@fsA
z&7D0RyYjAIGFUh1$ozv^`M1~u=6k&?5=oWZYBGI#K>oXu=5IWc&+UAyYHpBr-sqX*
zQPHdBQ@`iW-K!S6a>>`41jo`FpLWdNE4f;4S&)X>yT8)w^!}E7Kj=Nx=J4Xh><KQW
zEoz$2{QVYf)0C-<UnKX|=cl@B_UgysZVn-;lW#?RKmH`F`SF4|vI_HpH!7OVSr>PS
zYugS@t;z{9mt(s&&wA;}z*lnfQ3C(ht!G?xX65MbW{fj0xw1s1Ygy>LQ<dAkr#+Qa
zzIcj3@PLkUQ~YV}xwCc8ul(0tc~AD%rHg70PcIP;Hjl2j8(Y2o_2W#}x3L+!?qxdg
zhppn?l2}q6QFZUD`l{bAS9pI>+0Hii$+T#>0EW$1R2ComdG(nG-yg@+v}^V&E*+m!
z`{&E%JqaJ5y6x|tyHo4pYV)qmk)nqDHq3MLzdndi6DaM_*e|%#dY?qV|0@?dFa9@n
z7o9unqU39vYfj$<f3?lL!YX2I<!m-{+e3%DVfQ9G+*NsFcQKUd{)=ziyB6e&lpJ^a
zKIfBt#)`-ZyX5SuzokFBHfQtldP|!>3s-Np>XheDu{?Ogi|Z#lbH<i$jH@$tyy?{Y
z$Bx=1$$PMMzLW|BgLo$cgB;#2Nts?j<<r>e^4n(9{@c%IdVI!mid1K1>F%}L->plw
zUOU_3+ciI<xia#6s!nFfURNef$?ZLUzxF*d1EbKCrCa9CEe=axHc|5d(~ccGe%xh0
zaQxAil>hpNx4(=y=VfW*^JI;e`bwQ`N8j1V#h-fE{o&@~<4OAS^}D}3+9aeu&$iyO
z<$sO(IlZM8lTz)3JNHbBw43jg8hEne*NclwPApgIQtQqNJfR`<vSgn4)Q<Gcd%9Me
z%%9pXw=!Kk((cmz&q4LtOa7VluRg6~>U!$5>(sPo>yKu{JxPw7)pfOK-Z?#&m@ebL
z8JlMGuC_Vvb#=XFS=APg%_=_WQ+1xTw*2pV6x7x!^V~J&sq4z!f1-|AwAFGhJyxhH
z?5e_3%BjR|E7OrVE&fIP(>GSSpCmuJ^oN86PK)(de&b`(y>OA<+RPV=u5Z$4^uA~@
z|J-9IzFGW>GHs&yTr?ji)kv<CfB1e?!@=}S&dD71r*E(7I36l8UC=JL_n||nwSkUh
zv!}d1f8Oz;IKipE9!^}N_j!rT0iJLnj>OlQYTS95a#K%lnsixXZtrGSrO8_~r1u|~
z@Z+WC-`HTej^^luUpnXBq<{Us`Dx5PX1<kn{mVa2efi~{;GaP8tFE7Js_b>RHmm5%
z6P|fnxIS032yXlsT9cTT%w%)AJ9W1E`k(BfIkToE$1dBYlQL(@#Uq-A`*%Hvdzqvj
zE`CRIwR8WaP7Chyb+(or-|DPxR2Tnvcl@n8ligN@oi2R|vCE7rEoMLIE%I%&ULk)|
z^{dV_)5Sj;V^?TSTy=HtX_*q&*a_34SthY@v0UG(*DpNd&GO{sso6VQ1A^TaBpwUj
z5qFzsmP5A36G1_V^uoxl`S)ebSYMt!J}-0C`JTh)P5i}X>TGY^n(z3<zA<FpY<c<a
z>+SWHRyV}t^;NU<eOF&^ue!cTB(#rta%V-cu(-IwzN@KGO|MRhM=D*qxm4%UsYPy!
zy;pCNGYRGQ72N8u(fs(96OVeTzq|-kQePr*$~)p3r``-Dy=j3vXZT#YJ<oLIZKVy*
zj3qie;~JzEMBXf0zFfb}{()6WSx#>5+{Et>>kSrr7jEq6mQZ7AV}HEoWVg18>ZS^|
z{V@+-=s)(-P&}x#N^oAg4P!1#)Sf_f@5I`7w$FBP2N-OW&`s=hEWGfmvt#q@ib$>m
zlMnpY;-|gbcX5C4M&&gd+g6?YG}+W+o_&PwWdq&CvrDEuF;6`|t9Zg{S3_aOApRFC
z&y;*r(Ob~A|BKL!b5GB1HsVjni+E9IGdVSsTZTJfy=HrtkzYCsm*Lt)E5c9ZFr8sC
z-PU{AP+;}4&s{FOt}LuCgs0kbm#3dDo^`I=(r5F_nw>LFFS^d}8+@a~IbK+1hUYEL
zW1lN8tj~0K-*C}D)_PSAN7D`N4}xEwm(H2G>HiA7eLCGT&+g9ExKX=MJ(Mfh^~;-|
zT%PNur?z}e$Zb5p(s;WjvPb!jLc=Tdy9a~?ZDOY!4gT@=r7P>6<M|g9-@mV{o9L;P
zQhW5%*DQ8Hhsvej7Fl>E<n}6MUo<Z%KcARX9Kc*yet-Lt6Fn>`Ig|7q_LR>k_T!wU
zUH)PZ>sOKXz`QHMf36xoJ<{co8)NO0%rhz5?5TjsvOtBsx?1~}x-le6b@)I3%Vs*~
zm9J;eQomgXa+WXN@vXY;uS%{0+uCdL4_-uWobZ-u)pWrwJ+2FtyFI3zTleLC+5S0`
zE~H<!-Yzd^<zIGdZ~pe^XWdKzneOWo*j;`^n!3BaIwjP{!6F&v{=WR7pMece!dsOk
zJ3P5(i>~+}z4i$Ej2jZ?q}FVXaI8Nb+4flKis(oG>1$e8w@B{18dDaYGJ97&tGU>+
zdAytL+#7VVtxjCKl&HO_c=yS5dw4D`;(V%mVA7`WZ@Z73WGRUJ#l51@nUVMEq3Z_s
z6`Lk%$W5)>wj#x((S5HN<DVCOHRlrJx6GF5Xi%x)&~15Kc;WqT>jlf-^}l9ZyD>C2
zgG=A5b(z)aZq2%vYqQjN8owR5ZT&vo`H_F<bF=IxdqP7V3Z*Yxoz5G`$}M7HbTV7h
z)Iz|%YVWJ954q;I+5ftpaCFke)RTQ~Ed3?cj+alyolpMV@aBKvf|c*|zOXBBO%$=V
z_S(iYTV40Z<%p><SEqS#A78_J^p|OQ-=~jP|3`ad8vcuCnGw0|&O?_w4JU&<ww%%u
z$$4Y5Al&Fv#v`@}B}Zn{wJF=SXx%^Zg7LI#&D`ak2Wlth+@9&pJl&1C!*Fxfy57&0
z5sTNR-oBUi_SO6u=byi0J7&AMuY2|uCh2XD^cFaFY^&HRa{1^Fp|#t1WHU=uH&rzX
z&1iUOBD*+MBk+}2a!F@r_ZO)%=@NI3E6sbqU+P8=gK*?3x2Z49<5MKx_P_h_^-hTw
zV}F6K<c6CU^F5`ue!cD5(r(&2J*lN^UDNT7Y<vBNwLJk&s}H$v**Nh#gJi<`70>Iq
zTFegKkJu-DNqDQT;@*{8gf88decSNm?6v(ITXtF8&icBY@mt#cYwb_$I1LznUFLEY
znH|!$I&{_V%z}RcAwIhnJknaXiQ%7?cTkjZ$*%=GO;7rgOD>0O2?)IFD;_!ZoN;{V
z(|ua5>s%V|+IZ?sDluYYTJbf3vFTCPRlhig?O}(PxiB04{~+W1tTXkbgX!0|tv_E0
z9ed8!v^DW6o4~HCiH{C*b?o7^`X(ITS{J^a;jmS%j^g#6yHCw`et2xYJ1j8!azt*`
zOaEd|+k}R{rx!$tZ~vRUFzS+0d`njEmcM2pzrVe0Up$Mq^vlxc+(*9j7SH;3bXSK1
zLw-k*-to*ioIOt&uAN!8+_|rzfp51D<I0$00c&<dB$#^z9p_rTu{+AZL-zi?Rrx!T
zQ#oJquc%bs%=14qO1I=!qEqn+iPf3Ud_)-U^}0pc>^syTHDxDv+wb?^_~Z8eH{9`m
zxsNrcm8<c^rC0kjzRijIo_pt0lv*X@o3)Rc8gvzfzJ7RW%y^@FhyO(Okgpxz(z;)I
zu(r+Mu#rz(!Mx4>kF9R<J)RArj8hhRs~%Nr+0(mx!+ahWJK^p3>x64RZ*^@;Vv^YN
z=UH|hdt}|@LuVM4ZE`dC^DNu9;k8I`w^vl<>peAsw_YERj!>{u`mggxVq)I2%omz3
z?cBG1IeT4@=N5BDhSH&mzM!`Sa=&tKy2{Eee|Jkien)V51gq+sdlE0)R&>5uD*E|v
zUxj2{w_5wHGe_@DR!^y5xFo!O;f>QDtds6se`w5p)7dk$&&gp!PXl9%m4Vw9jX;MT
zSKggW{J~oFkWsrZ?#cB`rO7A6R~F0mhU}a0f3pYo?maid`ny>SJc_h@Q_uVFT{hJ#
zMS%ZUCfgO4^55I$uKKQVf7{25uN<Z_?h7Ah_N{xIqgc(5(Z*49K!&|mYz{L+K&Z~L
zNS8MX_3H&6zt4PjT}6s{`Go9{?bm}@Unl+C(`A;Y7hZTa<89g6G&U#y_kPB2Ov2hW
z=6i*2D7KrQ@{!f}GTVf=c{}rpq(rt#X60B<yA$C2)81i)w&Np3?rpB8AF*;IDf72f
zr+u<-k`Iutxqj!x&flsAS!(%8$x=6CD+9s<zuI`OdBw|iBatay=tPvVxl5Sf^P3H^
zT2fENyDz;867Q`y3>QvrS;xrJa*WYUQSjN;f9s^LU##^iVp0?+WVM+eKIKS*wB=TZ
zRre10q@50v_Iv9x!8r0r!tu7PH{R-UnS4x$KJa&%S@(_wg^$<_Pj1%P&nWuPC`BVq
zJZPWQ-TQ9o7kC2Qr}iDpiICcV!$4VB;t2D9{d~r+jK|oGo6Wwqoi&)WEWgvsXwkEF
zNvDa0F|SluN}^hO*VQ~pY0Ui?IO#rHNt?tz+nUl%)!#0cNwjf=Gf5jSi0`oSXBBWa
z{<q1rM*G#OXl9Xh(vl6FXLqOB2w(nGb!P9%;@pOd8~j$Y8P4LEv2yM5Rn`vr?u-AZ
z>1zIDiawn7hI9RLw(G^#M(rOM<|!q6Oq$ilS|K6Cr6b7nttnCLi|DRh9EqMQj?Z9y
z_|fu(nQ6g6FG*jH;G(smU76dYuI%}KkzIGSxTTKsh1LacA8W0<Jnhy@w)q^1TY3X8
zho18HstV}(#?59o(QE$V*5^Ho-o<5`*m2)HJaN}7Bh6CDXvPoII5zdiG3@<jDVQ;P
zQMa7At<V48ml}6B@U%PovbeULcx1DAx_;~OCr(^jCpOR5OncVQ+Z>u6?wn_;5Ik$&
zrGVG-GrzK#skHLma7~+H8mi-wl~{Ca#t&xR)mxlIjy(&@RjxEMpAk95^viPDk7tsS
zIIAMFc3$xPrMT!@^UV0wNiY4Rn6f55*))e$RHKFK`XAo4E=2{*X{@mZ3-$-39$f#z
zGWprDt3Nh5@|?cP+?#%Sc7^1&?d{j(p0(;#sU1`}V(G+?e9*z+<qBup+5M(fM|Hig
z+^V+cj^1whN__A9Ptqw&6D}WP?md1(`B?A?ha+M;uBm8nzIn#N{Yc=nV4v|^{$KOw
zUG1K0sn3_Fz28=&YfpyB<fr0^O77j<$Bzi{)v8vkc;}cl(c?n?=8DA@jl7l>KPPlO
z4Lp1(*n5@g3}LgS!M6+-EasjQY;<+v;ft%kx95LX{<Z7B_6tqJsE{iHVwo2f1?BVK
z-@Ea2vigQSu5Z6AzZ=ij@Z#a>;ERjbZg9*nWIwC%cx9w<D@(4;(Hy&5pMPx$OWPKf
zblAo_P}XFH?&sDHcZv30DTQ7|OH10gq*`{^8P0I??%TlacGX~|K!V@q@}DeIyeBnn
z+}dHhc3*<z)GPxB`QJWP7cBO5o-{Y?TjtnjJKeW0+NNmwx5sW@jlZlo+%(}uA$zCu
z!Q=OopE<ZLy#D>b)ygT6otyuyvE0RE`#nP1Rd~YPNj)M*3zu_#iej29usAb6!q=l)
z`04%bi$O6>8at9R*9QK{czpcsnt;P*-`wKb=S}%!=G)_OaNe4j2>xgLwi#C3Ry`MX
z%z2e)*P2VJrrZ5qK4CD}KOy0SdUv6f*XAuz+q(P;ofEtzSDjeW&MtLG<o|1{Z#%y>
z&Tx3FJY~)LcOug7qAi&1y&5%s)$QN&ttR{Fd;Qk=N`AI=6@P5j+~VnN>nhe*vvarV
z*4VtWjrnF%#lt=e^y@xYJTHmEC)!>|Vxy+rH{PbhJ@@(wCS`^$-paY)n)TItdzXhP
zS8n#Z^f{~aSYYm2JBL*D#QHZudp3OGw6zu6yZ+eEM~^;fn^df_5r1{Qu32sEf3MUs
zW-qq6F|CiL_Qk9TNO<EQo;vFUo3G_ehN+BFRSb&HWIl$MiD&T!Y^}P|Fz0gi2I1`1
z<;p#0>#|(BR(HOUeIk*&iOIY%M!J2CK&1`OUa6uTja6AoW?eXvyI}sc=<t80Tkln6
zty5J$xruSN;V#RRbgowh5w?pIn^~^en;xh+-2CeUQ>oQTk+hR*XP0Wvi-@f~^v`I0
z^R|f}pRFkqpRp@WRrpbM<N4sJ6E3^V3y}Y}rTNN^ozZ+f$u~sb&gWd!$CbKfvUhMw
zMO*Je7s>Mu7e6yGS<bmuox*)zLtejITmPV2ikI&MCNt)i?5$td^#$&D(601#`bSgg
zAQpzkIzC~a)v19D?dt^XH8g^M=c->||1<N`<WCo#&E@shJ^1m4pmdk#_7xRN%9txN
zPxjQ^Fgqw;e*W~UoeuuOj;psF3#xJNo7|DPPTM%JF-T-$K#d9yo5Hjyw=-@o2%BH{
zXo6$|!%6ltB`pjGXSk`q*>lm;)i)@kM`)X?pj;il(_iNs+Mnw$NKUI)iF~$d&;6E8
zsZ+&#bK7nP?cT&_c-Z<jYpuM+R<4z&#e;t5S4~#hQGDX=XMs&U?HB)Vmi>K*e-q2q
zsump<n+B(rnK$l~_j7Z$#F)woMZE~j^>_TUrT7k`;GVt7kG>z=)w#Pv=^gWt6&IE`
z);*PRP|lEe*Vyep;q<&UB7b@g+}ag&__K@kgnaMM=`rlpB~86w{JQ?xP1I@ho)&K=
zmwG8>OXg;~Eum%FeTV0<#7nH_d%eNh+cNFXt=jVmEJkNvv9<IC1S+Y@TC7Vk)crlJ
z&0g8s%hI9fX~ChRS{J8#o$l*=5F9(<{Kl6?78jztuPyzPCGwk7MDzaqMEf@>YE!Q9
z@HO0vT#&-rsC}ctO85EC3+(Jsg@OAE);FoXX8y%{w*4#X*$pc-3)3cL@ZY;Ud5`Y9
zggtg&-hNtd?(1D-!LqhVd(!l%t0yxTDNo~#(mprOWcwNeKcP9F+jf0AGJWgX#?60S
zN>{vpX1;O~{}Kz+L)YZ^r*!_w<M!z|oO{D+?t^Rjl`8`s_MWt<c(UudMaAB{x?lNc
zyw$(<c<Sws=9shMZ(d-Y^X|T{Z!So@Ik~xbV_JjLx}_)E%hfNcJ>su#dGai>vHh9?
zW5K3PyW3xHUdOhJSN;xbN>xI}Q@JmmJ0%wO86W+nt1RxK(7XA|`=Ex6d=9Uz^n&gL
z+~J7&{h<Da!2EBf40{{$7&v~Z1cbecOy~Cqvz(f9>89w@P$tuzZc<$<7bx)ldtAmK
z94EKvLdv$|=4~M-xJ=%}KQECHXydBVk954hCDEw=nA~3PCktNcD|`I3%Qd$-bBkwM
zWc7KD0_Nqq3;9khF5l*NTl{+FnaNfMp4fg8_IX*wwRiaxxfNmon~XzL<}*KYds#SP
ze@K(b!Vr~|=|5j3n~As{HL`qtQQ`NC=auUYB^%FFs`zlV$CiJ4f=%m<pnnGn440>9
zvDuzT$z%97vr??z@x^yPzW|m6_Z!dK7$tjp+X_5QnK<v5dUUz3{;S#@PZf8wrxkUn
zndap0h|IfdyZgRVo$f&%r^Qc=Wn<K`SxQ^Es?`&YzW&Wn6~MZkF{Fga?ECZYwamSL
zPh80fp1k&f-fsSFvtm9z{=iV1)_7BH?M6-^fvF}>V)_LpIs2S_z*4%QJ=(6W|Hj$S
z$`sSnpI0BX`La>gB>z~Z@4NnYv$B^?C{?>vs(ORh;+2%Hm*m3ll4Y8kGs<to-VgaX
zC#Pjr>6CL3f@b{E>$$SmPUra^@iNKiOsUBoo!2eQ$9^>Qg=l7+IJhd~{f`$<e%w8{
zdvkC;yAJ;w=FY(T-SzzQSL(EjE&9O1vvnC)+{ZcEULLL=QcWbd7SC(Y^}f!aspGiZ
z`NpbMw!F!^etP_L<YmiC|M~N0`GEqL%2gpoGe0UP)X29l^;>fBsaIR1aq)hp^f^qj
zoPRV^558lN@nV^stZ#AiZuREhj~z>X<h_6U`)_l`{}0oHSEoDF3TyplU(bJEcAl)<
z{>_~Q9zvGWmOkFH$R+qittETaVIj|?D*wHa%{Ldm*)DNbIU#f2K@|lx?c7F(r#-SM
zci;Fee`WEH`J0*alf4cRdk@uUzHa%W>-$hQOYW@Qml#Dxakp)J%OXrW)xNyBX87)n
z)N}2QwSMw3#<>@^CtN#I`}=Uwy%%pdySeAqe3Z8CKU%%ZF>Q~=>Y7upm=!}M!?sWT
z=(Qzh`Ystu-34omwmULkJaoBRVp(&jkcM1n<h@5smsyi!YnFdzSkxYwnA-Zh^^^3>
zFQONnt(+o{2`jP85nUj2!E}X}_Wj2PmaJ6IwCv+9`4M<Z;%UzA@QSNqimTMOuAB0F
zSK74692x5aWEj*pPVe^Q|H31gn9CL&Q+)fl)xvX4T)+I8LT0U1^SC(a_Tm>uPo0y#
z>brEa+p0b4`KEFmYv-<2SMK-sD}8g*N@ZWX=cAqZ2M#|EyTH1$=as}W?lV=w$_-oJ
z6nxqizdq;vOzs<zHnuqz7W}!B{>{;ZH@d|2g;%oiujFcv>nFDEzWFNn{yuB($S_NJ
zrN9|4Qh)r3j^SOf%7Vvefsn?pl0yb_9sfUGvNLV!`!&f^8cLoN9gn%s?vcuu-1Q*w
z{8XphR(rAKEAG9P75na*yLq;(l(FB13+x}JOq+hgb*(^_t84Vys0N1x*&j{Yn4?eF
zEu6l%`SRoPi~8*U|NawbUgv)N_xt;DbKXVpJ$hiDv%RO+t)|>{M@hebLGs<&-D<I?
zFMl-1-P^eTw(Tp0H^TbK;@{=-9v(iZzr2H6?nSBd&$W&-6c#&w{qgnn0ckDXzWWcY
zwwN#5`6w{ODI|CKx5$cZGtwv7hP}9GXD=Ty?^Wp2oSPs2<aAF`pDk_`WPSN0|2yY(
z$uorQ8owF@&1N}c^637}cl!2nbLP6)sjn%Ekhm59U}D;PL*)tFmfb#^R7#o!78acg
z{=M$*`$FH6>Z;fm>(<{A4ijd)e@U|MQ%~&n1yk;RW7~H0*>`tlGlsVpEi!vAPnonl
zg>^YsY0b9j*DhyjhA(wnFhzA%!w3CKx1M`wpPP8T&sXmC%MZ6_9Xe1XFjsbS#2v%h
zXr&JgGnTzRD*P<mdac*rV^7XhUgR$<3tX~!N!j;OndPoRjk~P)<_a^c=Hhyi&DF3(
zOytm_!`UUL<|==xX;+;8$3?i4*SFM{{o>`5trg2Q9@knFukP3GcU#W?d)vFWqSx25
zT+cFSJb!%U`pz7+4_V?4ud_U#HnSOa=lgu=P5pH+mPcgqKB2F{cXd^6&NDKeUC+AA
zG=Ia#*v!pwXC9c#O}hKw%cjWvy{7}6i+8?$Co|=%Tv65eotjtUv+cfLv9>fc^}V{X
z_S8Y!>96ioWjd}uoN#KJ%=4ClRU&aWV>~8QPiFom_*vl0$|;2tr!S4-E(=?+Yx|Zn
z7kj;q+rC_N{_*AiTf(c?Kfg2I^R$Mp;JKsEQsxvNJmK)ghDZ9xPR89<89mcxEm2c%
zowC^IVYl*5Vb>bQTZ+-U`WJe;&O0<Y%;iz+x+#py*JxYsk}>IeTH$!!LjS0)+Cw|p
zWc8^>mrb%#d-9Cu_SX>gqxUbKt~kjNabcs{)fwt0I}Yk<JehjpUmh#Nt=aRBnZGmD
zU!k*wRch+#NYVS>PS^@Pc(~+%aM^*D%pCsqPcnZu{zzSW!8vwo;GCEp7408-PE};B
zD|F|LUHew&uK)9ATOM%e-^zV|X?oqR>4lQ9O_EHf6dy<)E@b2Vbj+Md`T(EqiQ@bk
zmBmL3IHm7a6;`}|s<Ui??aQ-=^Z!IzYc6@{(6U$M(`V+^mc8rtK3M-EKlFyo&QB4)
zCHJTM{T0|D&cf?5*>u}Yj<>Pd?uWtx?h8KLd9bp%`uw$<5_`&B*59eHKYwW%$DG#3
z5^EY3>^(hW+M5&l+PV8Q?U<fgxShGmJ+Jlt9*+5}HBHY?f3<6SWOw}f#?GTR#iiC1
z+pK#jQ2MTDeeQNP{#$wu?_84)eZ0A&Q2Rqw`nQf-mD7J*Ir7!HyY*kfTF&n;EcO*M
zcNJ~B{50&^w)59Sm$H@42%WRESykl!`=;~PgXdiPv5f28ZSI1oxPY!Zzi(dE**|lk
zM;4cD?@C)qo!6<4C;W7}dD%82J^6Kqzf)y)UF0JpujR8AFw9)MZqw!CJ$vNT%`Fz^
zufH5}?zisLEZ!<1nJoFqKPvzCe!N+<zB<oJX+}B6H%6vAE5o*3@sED)>s<a>InK>x
z@##5d*7W8bGZU?@i{Jb6?&H$!(xLh%IQ%~(>DJl0c|4z2bxr6H+tal!=3FPjXQp5O
zV0%PzX6V!9&)3Sd_IY3a%Fbqf>dBPj2Kp*;Ci!1fDo$nnco}`~`22l(4#zKi{J7lS
zc`LvBLl^tXUyeH~|8#QfyH?_Hw7`jf*<t2`k#^5Y6%#kk_<H4U?yC<!gPpsAr>hsv
z@=Xwbu>XR0-#KQ6AKe*3{+Dwq_Z^(OE_LdY?yTdl4xD^=vhn_2hj$_`7FLUGvo`O)
z>igmIyY{;;mOoz1e1<99vRv8IvHed}P?CzeLUD+ui2BT)le*4%x2!b8w}no=y46&e
zZDlh53a!5{!y@^Ximvjmzvf?i#Q$-Me|Nxht-~)LN-i}&rm|z2#G4x{66PHhtx|fc
z-Szsl_LsTN70(%~w$?7K4t6)K;A}eiQ0<Ilo#FHCQI`8xn3}E(Gnu)$PV@5PA0-S=
zJ=`3oK0KJ#7?~i%t3Nrx|9chJ)7|{r>sEW2>ReCWGLhl@(aXR5?8Aj`KlFcHaQ$Iy
z_lsKLBWvPCXMOiQT>Bs`yo9N<uRMIq@&2;O`EQ=3iq5^dC`hd0LeBBpJ#9}vd|)-c
z|Gwk-!|f8HU-WOZ|Ng&oLZck}pVj^OjbUrMD#DUJY)Q|)=__z<)}7x<-x72GEuDMB
zw_<~^eGvEc%cefDt=h5@=O$|O{C%%*?(NTCx4uiSnEz9zGTQb<f32Au_v<6|k9qlb
z8*RFNX*2&F^~m{0LarA(h(~Q?KXhYtB)96dN4i0`T6V_99Q}4JU3=QU{m-<&EX-VM
z_E+f3>-vq%b3SY7D&L8n`yt%@gyM#K@0%p&?zp@_@xc1d#m2dYOp|^rnlR~JNbA8w
ztB%wY%3_Xtgu0yDv_DC4`+aoc_Kg;IyOW>y%wdhQT>hCO3#>h^9Cf+yXb0Ecxl4Yw
zeN?d6Q*0siVQT9^Gmi%*jryiHcCU|IY4fa&XXdOAsR|G5|6cWp<!5mCeT{oR)6+fW
zF@O2~pEr^J$+On8ZBC(&h-KUNEeHH}?Oph-JT%uJpnpo-)T!qT7S4L~k4Ks7<c|ei
z-4jo-{oQ<UA+yeUfA@dB7wdkRb7wvH`bc+2%Gc$3o^dx`Ht7{yu$Z<u$1!tPuSBn&
zt=FV0Qki#|B027@`*GAc|Hg(zV%z_n@vt)6zGJKY)Y^pE*S|h^K3%`&>z}mg>yGXJ
z^=fK&<h`3xGinMaPTN;??BcuiE9<^popUnF)%D-iaQ=r+y1HJa>*voAaA0pQnYmzV
zz{`j>(K}Ap<*WK^{0`qr-T8mn(@kHd{8z8m{cHYl)}vUyll8yPS*X;eYC2w3cyMjE
z{@puo9~2iY?eWwW-8GRZcg})$m%qQ-6*Qy4jB~DT2sgv5&}(Z{!)>zP&NSS-ZT_+4
z^E#s?C#>m8b-6zI^B&bqo?nhfRp$Dhul?L#bnAuk{LId-+1kHVw|p#XyLG8hpGlqT
z8}GB#(IH2F&7GF8p?-&UgXR>;^?Zl6n*1v>xWHeVdGhQ&<8$A>OK&tY<lA@naJTEM
z2RH8qes{Ry`@LhYnN;hc@Ehf8cDwC&uSgEKc=M~^-t{ftK3t7WwYs}^F3ayU{@src
zeV=<$_usm#8E)TCZCO7xaZ$xB-X#kEy5j0~TwAR#Bk$N_t}?NHfm(C)%V`yhDz+|K
z9Tq*K(>M3)QU0?&In_e_S8lVtdG>?JT29YIHs_LwrlHEF!z^={-}E2lOxs&fcEaS}
z9PzE!C7d7p&cFYO^@?q!VpBeI-6@{G-y{n~e*FHE{k;8o{OkA>Q@-Ede%tk3nt9db
z)J@mcIVmO2V(&9Ah?dPLW#46_;BiFXCvwWShmVgZP2V80|KJTt<_oJc6`uy5)?F91
z-|uwEk@cThcCp3=wcog%#~^6EvBOV(W%-T^qVr!o+Q@O~ZBYfcdP4>8-i>$I&t3^h
zo3k{`U(agp%dd>3-5++m?vuBj`}NFgmjhhlYghf`T-uwi{34(KrT(;f^`qO?{mT6D
zXHL?C^HPi-(q3#@x6!s{pVp5&{jY1k8`rLHyx`?^`N`*{D%Z+aegEEgK02&iDWc$q
zMn=wSyZEVAyDkLX;jIpsT2}Jpl*ZP-k2bpNs8;_f^DO?=lP|m|`*Pctb&CrpzCLWT
zT1TPh*y<OXmu>A`e*TBH&YF~`mPzORc&@B_+;jNuK85l_*(w(_!$gj5TT^2iqqcZD
zU$Wcf*Jn50oxZn@d;1xohI7oB-gW(rKX(?2Rk*fnD^;7(UtcEw*W`2j=Uq8*N4yTm
z_AkxzNlQKD{XLh(%t|4at!8fUBumxG*~trDi6p<=k$ak>I9ci3|BWgdz8;wuJ}<Cy
zdM2D8u<pf+5`JOLJ2Q*RQf6=J)C`V0=U{3qlYVe7=OQcH-?9;o;nK28XGl)-*ZQb<
z^owU<l<p*x_2~zn^*&}?^gZs#(J6D3S=|r)jOBa9xy$=Rb5ni$tKE-%cb02xULOAA
zKBI3_re(|9Sr*=9=ePV{`qbKOnRDU#+v{ex3eRqzQ?Wd<BXH8%-Md!)*4-z>TdaK`
zZBu1=tkjB?$Bs*K%KPyf_UfHxP}((PMt07Po4Ve=XDF8(%3E?y;rKoCcD2>IzgO@(
zK2&p9)_1UE)vmntm4On<Ud@><7w?8|dKH%-WcGT)48Nvh3<4(?ZthKQo@#pao?iIU
zaMMH8v1_lT2ZnFGb3^&gnwYb>TQzG;9~dvX>$&suYHquPYmrA@-wR!S>B9q8^W0r~
zWaj00%v$>)Z&R0XP3e`kEoTd+?z$ruw#eM>K((9*=l{FvZ<HK#dw#6Dc5ro{g7o48
z%bxHYzV~Ra$ec@CIo1S7lx`7SpA-7mZ1qIZT@#H&?0NP-E?RPAs(qot#<EfkfrdX{
zt4-b<s>o~Wy2L0|I!`!z)}{4VCH<wiWcLR2&Gavwsoa#Ax}$u{?`H@0^&I|F@aNsv
zhy53Ce*73cmFb{5=ZTM-9`Cep6E)iOT0b*R$h6|ghKBg-U5AU}Sa&AH#4IjOP|vS>
zqWFWY{MYN3HxEvf3fJ9!=kc}Z+?_M5mc7<J{Q0Vk(EgA9FT#b_8LF)M=+3k9r<d{l
z2{r3i=kjz;ZcSwQk=n}`_)}lne|drxbLvc&1N)tKu5C<D*k{abvF<-B>Z+oagMNBK
z5)2G`!U?P@DoxTWsJv>EUHsT=(*3{M0{*!ZcP-pe_oS%v)tu8QZ%&@eO?!08CoA7O
zP*a5SWRGT$_k?YwcK7r5zdP2<z<F}k>MK{~ZZq<3c38ao;tO%9nuB&R@&AthIBxTF
z>4V4HCG}_5%=}z+C@y!>m$v@%k0vh`e^a{k=Cz-%mL;aEFMs}c^W@FJ-#)f&E{_RO
zJ^e#gf7Mwjw#{wouNN;)ja_@QW?#<iZO=Yip1wYNRbE8Uw9v^Wm7!c$)#Fr}USALA
z=Usn#$&M$|aZFk-&64hZzUq9++~Qi^pB;BUd_Or$J7f0k(5R`WYnD33-Cq|M>}>8*
z+IzjDdZK>G^$)w6^ol3yR352Y|EXx+6>Y(d)^Xf3O6P^W_6_>%c(`Wnl-m>Aq6E8~
znE!VE`=f2XIqy|gsCxFr<v*jgz0Ujfb=QipO}*3K-r{L`uKYEo_-_d3-!Iky%jVC1
ztEL~WBlza=#lU?j@{jxL_wSpv|KI7WulMh({eSpL$HD%z3AWE=476H(S&S@qpSk>O
z#cP@4d-j}uy=qCQdBse%n_pRVt{UkVr!cLa_U4~j=8gQw-3&7YGw166$ai4i;PeqY
zl$8_79K^~Lk<zraDLrT7R3|f~ip+@|2lZ|rRpnKG*2cDXq6%C6Y^BU;p?l{s?6rTk
zXlB>4c{8_r&b{}9*FVteudP^aTnb0Up#^)HXD``)vWwf8BVcEnnagtNI}Hy$9DDg?
z;;a<&=|Z-5yxlk#y-ixsaz5ARlG^^}zV208K8x>g<of<z>+e?lc$>$Rc9zrM%qtyt
z`|K<J_+I04P(XNSvF^@iPI{j{UCTLjC+TH@tlfuYj3-<44DNp~^LE$KS{-hxq5t6M
zR>kwKS0!H^4LfDncfXPU4`cIvyX(GdFZFGIt)g!qk~_C3WzA`^#9QS&=cc)Cy7iH7
z%guG>^8&?+?>$LX6aTa-=hfQj=1q^cz2v+%;qg9Qtxn#+T+Igiu*{$h++rd>1OjG<
zwca>$wfF(U6)hW?C@$9Ttj<ptP0_hA+ehEk{f$hO&L^Qt#jV9bK8~8(W;gj)-?DI;
zlxFPkqBissW5>=E&Wx4Z-_$f)?l!X&&3kGZB%G1^L+_@>?4MFS>^enf@5Qk-nTiU%
zFuOG2=k3!!cZXl^(CKmg+mo&Sk?BN#nrc(dTvp+q^?}!Sc?IXhrmnmjB~qT9qv!K^
z@)3i_-Uhc<Y<T`T;6svRsg_34v}5fDr)}a_Dy#0lCiKx|<3x|Tp7^P^XX-k=ZM*(Z
z!z`GGw^D*3zj>nZ%r?1=N}A!iD<*X-aJx-Q5j!pMk)`j!|C!>af|hozRXVq2>8>kl
z`XbEYKehZ3ne+Gr&ph**y^6~G38v3BI6sq$xsk}AeU33p?^BS8C+DVny?wh*R%v8A
zFzkPQPm$r6)rz0?xAr`XJn$*#^NkXNh7x@SmEQ{U63r`~FqCc!%HcK<aG2yL%^tJW
zHn#W8?iX(wYZVLU9$xT8Oj`HfTluW_oBK;o+xJR{J4!s-aHh6<ztzcus$YN1O)U6%
z`umY-saK~(%Ix^zZNKcX$=mr6kAxORG5MM>aeYhRkxJUkdYI$3_G#Bm8b4g47oBJP
zT^AGfG=kxpL67{~i8krC<~eO<VVqMH!{Nd%BJgvQ@4ge=dv0#}y=Ujds#Bs7TLm^$
zFRf$FsybJo@v<l4!+P=MAAe@n+`7NKxZw4cvJkrmb_VyAX4Lojvn4Dz{zpx)_>%yG
z$bA`(W7FhfeC$)J*xwxb**|%eWB4Ck&ub!<ZvroUY*Fg<czIQ8$JUTW@e79BmzVHJ
zwY6<~cr1xKM8kl6ovn~r*G+wCfr&lY$zR^GD$kSMopkQtIo^|pEmYaA1~)Bf6Z(1P
z!YR2xZTr&bcHN3uTTbxLI4<y9eZk@s`HzO&@$zoZKK_erlFg||+bsN7GJcEp1tFPl
zcdXpQEPQ@2WvKK_wEok$JhwUej(>T>-DZj88A~`P)(dVfGm}&*d3^ZdiJMox&zUM?
zqMA@29rj(s-&6fwXO&gC&^Ez+7hXl)ULqkqpV_CH|FK)&$EUXXT<m&#mu(k+;m|V8
zv%NB5wu)~P<K~P9{EJ@bX-3(xFLD;PXm4Z`R#+?R_I{n+pD**$*!L^%UHNHBcXuYk
z!uYr*ccBYKGuU~~T>n|$WZH9KjhKy~jC|rk7L&)xx0uvkCzwgOUNhMdl_kV<#OcGN
zN!v0GcrM(jwCuplcEi#)|8!QfcG+4O=>D+f6@PH4p??>P+wAs_T3gf4t`gam9{E+E
z@yPvB<>Ozb-<an6$sx)sDK~qo+<SdCnS$^6^(&d$yZo#wAGWTQtdO{{VDidY+z%Fg
z<SzJI7?RfdEy_w+{N9OWVT~W7s<-;`2Fbqg;CgQpn?CWb-E>BY1l5ODOue&{=cTiy
zzMSKKx3{_ENu<Rr*_~qEr3(7O3O?!YvU}RUT4#Ds`n~h6#a709A>U=KpLu<pWpHHD
z;w@TSH$LfTa?PFo;<=_lU&gXV(Ut6*Ih{je5AUzc+?+18!tvmnmnR;*o}{bTGH3Ol
z6ES66=G#|y&V4Mg@#FR>OA5j{ZKS!F%O^bjQhQLr&Q-PL^G230TsN9Tl<!+LiZ|ps
zS(inMN>*H3kd`289y(L8e%2~>Z^;`ce5bkSm|kRj>2@cr<(kCDR|gpcS-8D_IDGFh
zSrWN@$Mv1j7go9bamc!E<ES+~m+|&4roCLbr?>fNrhj`konQW7)FGY?J(82!tHPHh
zaW*l_-_(CvENR2^dHL}Si@tRK`zQB{?7Z;c)||Af7q&GwW>qe~VSnJ_!JKDbcsFjo
z60_~{jABEh-%TlwPDXN}FLLY{<Y#6oR~PRr6PvO6`RDfqS5KDlh*%x2`=RW7_O+A`
zkFB1ApVLwEfESG)1FP8N>z6Pv>q;~Fa%q2RKePJJqHTstp6qz=M86^T)v+6EZZ$4i
zyK3K#2^Z~8Za7%GPUYd|iwUXnWq+(X6n2ZT`agCL->-FLepBod_8sZ=+^Gu`*|VD`
zzdz!$e5t*BS^H+&j%JB|TPOFs(mm;m=Z09G`dmD*t?NVZ3FX#jNmhp?@2JUl?yGn%
za3?qP5&w(_`wf0nU)@x?X=)j-zx{!v@b4Mx8t$0pMH^^{++EDM-_cw~Cbsb!AMe~P
zH764IKc!9MbA0@*$0owFe&u`D2mIF~`BeS?Ja8>zI_w|$$c1NH*z^Cqns;9c1|G_o
zVf0$3WYa-`volQN=UiuQs*EWy=?V>P&WrY6W4_#Qw-&2Q#D);h<o5W4eL~h1SM|6p
zPbglRmwWKRvz4-s=Nz3fyWCxAX0PP>Z%lKwB0er-ePWX~UG%Hq43(pdGCoGaZ<Fru
zcB~cbiJaH<&2h?SM}sBbnN&_~d;Bl+oZ-B0l514hb$-Mjdm~!mCHiGWsEFp3ojlyB
zUE8cHMSILM-?;2t{_LjR#MegWzipJ+wcS6~OJZs6JafNOar;(W)Rz3QyNc;UC;L9J
zZPxRI99r$!t=Yw=?>gDM%TD7@qZHGp-;22ZS*yP6(fKMS*~)c<`SB+gZkPHZZu_3=
z8uQ;5FI*8{&d0I$s@!}wE~8^7jBI{g%u-;FF|W`#JU={CNo@f`pEc`*$9e~K{O+&s
zf3o`I$IV>z4o3q*AFQ9hf8!5_SB~mJ+5h+#ZqBQFE?i$e<?!;ATa!&cmxXM4uv&pb
zGthEIjfw5egO}&lu>SA-lzZPcDN0wu_O$UI*2tr(Gnpjxr$u*3lrjZ9H8m_|o_M<G
z)1HT_GkhvVoLBu>-LyYeJ2^MzIgi8tH<t6_d0zG2-n%{VD$~o8G3TQ1#Idbky={VK
zQkP3;S8$qiF7G9KHHZH-GxARSbzf#Uck;UptDe~I@y>Hpwf=T2l;1S|>7s{QKh4_4
z5I%q6zrN1KqtmYDb{_lWz@F5pULx|sYu4|&9XyVF>VfisJS%G+PV0K$_4n8&o8UgD
zn<}SN9twS9Ki%^CyzYvtru&1suW8!~=FVz*_r&e@4BrI{xSb#0d!z5g8|Avxp!9G1
z_l|@WX@;H8R)xxIi-`B`KAtzpdXAuf!zvShsWWF!b+*s`%qpm{%JhBoZKeIDU&D>k
zm2T`3<&~;gIU_Y!peQoRCQLV=AnCly`rEsX6)Ak_k(l~<!DHs+L{*M68-vdmu8HM(
zs`!@ek8(Z}<E)o`tN(C#6dg*bl-&LArn$<W1B{_JIGsecsGI(J^3O))HE%`GgC!Po
z?r&s#GH-b>?_6W&?`+f0e+#T$-EmGgqkLt^ZQe~Y`2Bdl%Pe0JS>5IK@zkw^W`iqp
z+WWtC=Wb6>U}%joXkAgjYj9%r?6o2Jzu%c!tYHp)b&~s4ufeCZ?A-HL3(ucWWqq6W
zcBAGbOK1M0U+vlN%?kN?EB*3>w7<H$xF0KSvTG^quYN4hFRS?WZ<(g7w5qbDEQf2g
zljEQD&#cm}vd%C%oaFteVvbnFqRyGy_chs>Xt0>ywb5^xDji}|{;en>b$Q|14fi;%
zXDTjh)QNnhe^NnnowDH@+oFXJJ*T&&UCof?F_PHNd&8S)GyA6nJ67|{Hz!!yhJBl%
zaAU2)OIh|OGmqCtU$NO)8r2yue!gket<UHAo}_>1xG-N&ZsLvQ3yw3E#ECMO9C*5T
z_k6=YYg~TI?qt@OCbwa;^TdGdOz#s6Kk=5DoniC7T9)NE^WSsR(C>yOyboL(Z=Q>q
zVlBbG>g}CZzP~$+?iW?AxoCDu-)aeaB=5|N1?9_FFRn6sWBjl+w#$Q4>uurNCH{sI
z>K%zijaiyJ3@cp?lCsi%y9!m5yn0v?A+_wr+Qha6F<&QjTV~u?v&)=4f6t!o>kBMC
zPwM`$Ovv}nSI)VMkFUEsS3+u|h%o<KrihJ`#Gj{2Xm4-2{wZ_n(@%`Mx_m=LMZE5R
zaQeE2tB-&8B9)r?TY8&rJu6wkD>PeF`{uNi@{?}<isznvxDtFJ<mbAlSr2c2nmWO?
zw4x=zEN;07&s3Z6#T5=YjxE=xb#rZGl{mN2B)s|I2d%}cWc?@BaX3_&HuT5Z-fp?W
z_e7$Db&*@WJ?~!gnb#U33ph{C{d)Y;6aQ-}eyjF}zHq-JT;&q_zw8xv#W(g{|9<wY
zu(Q7Du;Tx9<EtnCvKqbLDLMD@i}dub>6_=sI<M;ya@rct7s_VwN;SCa=>wlzMw(r$
z6{YMeIuc@7^ci<8Ra>!GOzHUh+Jkiuv_6;}T>9m-w`BC8cPkG1YHL&!9xDFyLPS7v
z`phZzY@aLE@FYsyZDvqdb!(aU!|4}z*I!s5z0x6Ym*BD^R?=CEHpRu)w(5MmdOU2^
znd_cggQe%*u0FN&ZiQWv)psk7PwCUj98(0upB8&HIh(ew^!v_!e%>m3f34EF6Q3P*
zdgL)T>cQcPp1;+0E%yIjHLkcF#B`&`k=6BWlFn;J4yC=DzH0xwa+1-h>g2L!$pn^7
zf0*tD1wVcCda119E6X(|5Bc{n%xhiz@<+)tR)>yRm1hp^s!iV}{@Lr!B%RljSw*=c
zwKaq_ijS(X2Q9eowav!)iQFH%sTIuItC^~IJ>1&D*)hvIcA@*fHNS#l8Mjy~r~f*n
zl{|AgLv-l%*iPdWQlXcnZ=HE{Ro8UJFUyZd59l1xjuBX*D!C#<&uyZ!_mYAwUxZ~>
zbn^O}3i&DiS-y1ZLh~7+{@13}p7#5$u6=K->*VCLqq8mLQk*@G9N409_2$v{e@#5|
z=RMBWQcLzI*mvjD71j*ze-oCd?bR!eKA2e}HlO{tb44}RUVatk606Vxz7-2ZTGVxS
zHLq1*liOG3{Y%JZ!}~L08;<+=ubEr@VV}u_|Mj_nAxqf4-drdh_I&#P_irPYXWW=0
zmGH>)pz;S!=V?rRd|aQ7g=}0Zt@xqnxuEO&4YHMOlAc>%Ppv;7vSo&CblU}cxerSw
z=2YpnuKM9zzG6!Er;96#4)@G1Fgp0@Lq%|Sx#g~a|9w;Uo#JtQ^(Q)7U8^lP;qETm
z*f)2y-*-QbD6PL;vfcmbng6XGPHQf%&JI|}+7oe#+o)tilX9scSFhZZBaP|NB0S~|
zdwyy0?<wW`Iq$mF$v(ltt4x8qU&{58OZet&U*%U>pkOI{t^D|bhx2Ef|FZeBbFy{p
z6!Sv;ax2rScd8Em{Vhu_1#YQvFM0PN>jt}?tnKN`o4+4s-__svXnEh2CtG=*l!kK(
zmYBRU7Of54I(^2<%C1X!v8xU=f8LT|d`@UuV;1{v$DIy6sc)0GXPFy|bFry?y}4U)
zS>4A&AIhY7-mPY94l!xD-w|*|-l4`NeEueF-rVpsyKkpvDXspZ6U16HG4zx~r5CgE
z@(0gfPDtkN?YQI8WWI2&e^~g`J>PTRY<(sEBdDk+XXh%m39T=aId0!-uL$n^llbSu
z*YMBl_sNJyTG?Cw{8du(_1Wyt`ul(W`g8T?&zI);``Z5RwX7~KDy{mYzy92QtN;I|
z+RopV#}{_@<jUUIwGa2b%Cp<?cGl^<)!(1B&T@)nJYy`D7SYY8;*vAfGSs2W{q4jA
zwl!@5;&a4ha{jN}^(We0<!!X`kFukCKd0RbS&}+ODR_41T!)PJf{*=oU2ymEyZ`#+
zr>B!HpA0&#aqwEmww|kJ(yDK|y4N=sipnlHu<8HXtLNX}-}ir^_0?_fX02FRYB-6P
z*`&(co7YO>^r_E5_m4~nIPfX>$=pTz-T7o*KK*@1i+xkat{=|ZE>GSpQFeCDQl8Ar
zgzGz2TJ@E0n#lEb<$_HI-6UkQSZ`eBJ~bik#KFr7H&<s*m|I)x%wTit8Ef|GrqkLt
zkGNN|wfYs#U9uru`SzsA&zen-8vEEBnx5Cr{^Bq1^!9^6lHsPI`fpz4&+JN8)e^pD
zt?A3*+<Cl3wpo8^hLuHX$@-&uiK_dLFMZkdykq^ui4{5_?(>&vf4ltepun@*CV8)w
zTXvb;-}}Ov|J%vB)aLh%CYQPo1ScJ`62G+Y(r=B(1=Sbd#<R2d{ppc;<p1i8-?At7
z{~l@2J=(hQ(L2`Q38|8L0b9SEd-&J4<)pZKVlNx#v2*e-uKqgp*Ev(~{4eIeg_BYr
zE|A&5AAiVfKD(vFx>T=rhl9-gTb*7$IQiLgb>z9+(3JOcFMj!a-raad@k=$!{@g9|
zW_Le1a9HQH(xHWK!nH~`e8Snw%Xk9ywkK9yU+iqQqp9e^8n;OP^!INZd7@XxKKQ1<
zA$MXM$Nq&(A2OD|GTb*?)S<(<X6?RB3uL9Yt3K1Ode3vE&Sja*)_=BgucHOlt(|zV
z&3w&<&)fH|@3e5A8luay@zKVj7sV@=)g7*0yZ`1c`KIWI-rVrgEh+#1roZ``9((lS
zQ`?fDro1Ce>RU7yKRWEEoO9w^V`1OiD<3|1Rh$>u^}&5!N3{43_V?O4TDuJ|a*2ib
zHmzu1wEftfefQJ71!6CMXK~`V#k_O>u{^OCg$nLb-H+ATU+vtIb=a@(w?U!gn<RnA
zf^Tl=W`ES5>)$!d#xaTa^22k@+x|sGNUDBca`^rAvgfj8D!YHbah&%yhA$>tYsR9S
zgmTUGr)^gpIdUNNy!4#=OniBEQ)QA)Za&pHX=XXgrJWV4@`@`z`)_0TD*G=ku(is#
zcuDJ|q&zzw_5`OKsh;D@*pf|bXU;jBBVwrg?Wlro+Vj@?0dC!M<gC0mdQF|9l=!-A
z_vCNI&%RIFdQ&{hSfw`ZvuNz&-lZ+=2k(AK`EyohS^e(%C-)fx?GJ_Stm;sI^G>JD
z!pN?8`k@1NXIfvMv}mUPQ{AkPJ*!riUH<*1Q&Qo5?zgt%TW>Uk9XlN<Xni#4!;WVO
zH-qi|<hc~ITj@&7lr!Owny|wBCv#Vo_cNPmCP_<dJ}~!QIr2quht8aDg<Uyw(w%!B
zI~3-4PEVXF9awL4;*E{fr}wopSMI)=Sl@HfQ~zm%e8R30?oTV_-7h{i+t7a7?Rop|
z_e}4m2L5bSI`E(AAM@g>`LQ#Kgx+Xh-XF0;l&^U4><GIhp~o^mNqm-5&~9n@xA?rz
zUR!&9^Y6t+=YM_w`6<7`of<oi<#$Vs-u|C(J*6Vm_D=}Mw>rakvsa~jR}XH~@t^or
zG_F3ZQ|M_!t*d<VnVtU{6Tiqv2r}Q@YU#0X7uVfG7vp66+pgPRXIGj&{oJ7!lhq?C
z{TwrYYR|9?_@BT&|K}C%e@vf03MVVpZ26J5^xadL<-vAhleB|OTXbUiJ8qcPZF5!d
zU-2;b8gm8bilBl!l5=kT?C}4Q{q58Bi2uU>h2@S}2-)vYU)0F=al-sF6Xk6d>7Cj#
zr|#GGs=l>PZ=KJq)?_|2?fN2Xh1T2;85ci2vChAH)JC@V%f6|p>IYLU_TJgh=Q(Zt
zp80GqPOVYx+#n(Rw(5$EP5*cMn@cY`r+pQ4;t{xXaPy1VtM~GMdt=eW>2&steP`f-
ze<n|wlcu;ls%Jo*O)$9p^8+&n14FJP1A`KtJ<4f`$tC$km3jr0M<e3%Z<`6!e_yU}
zi~V-1Qpw%fjbgrcmz=(3;`(^uZKlJERZl%rn#kmN^lMw~g4*8NO?M|warx^xJ&F05
z`0Xnn|J{H8?#qmr`ij4gPg>72Sa|cK>#3H9lIdBFe%`a*+&sDY$IB;%k*7Yb_>q@?
zV)OF*HPxTqyxg3BBJ2DK)yqK>rrg~aGmSMyt?lBX;)m<)IVU}yn}4#^K&QQZ)s!wN
zy`w3UG$SXRRa@<|^hTO<1><?1g-#yHo?lWPo!{i8;&v+LI{UMTqK(QSlc%PO<gZLK
z?Z3Vzg~`XOFMYmnn9^nqi#;i6`oXqE8$*l|qw=}DH}16Uxv*zdMc$5#o32lOt>D$Z
zC0wtq`69PCx017-O=adHR%?&a=*e?y&AR4YU(WpNQ`vNni63Kq|356-zJ;CfWlMUB
z==!=}1=}L)%D2^2fBbhg$?1Wy3EL4v)eN~id7N`qN@|i@Y$Feze9=0i(|X;K4V;1A
z8U0SDn1nT+-=6hGXi^{dwmaS)Cp(wsxb8`8a=hi?I<Gm=d)D)k*_&t2E;UIya4XJk
z`2@pP6?`)<?@gKiX!+mP`I!rzo4m4lwc=Xsmah2ENA6@SR{Bw^)%W_}=kl1@vmIZp
zm0tDWP{R(x+Y{H%jkeQ_nx^x2KhGcWS@vu%9?W{Ncg?3MIg%T5nD;I+Y(MmUs&3+}
z$3Jgvt_pSRN`0cCopfd54BOV%Kk|?BBzk!^Y+A}He8}~fND`Z}k+P-kHqEUu(_ELU
zweRbBZ1E~wPh#?ukk<<KwK`(w&bar>{bWvB5~{vd)AI5<hAu9HC1(z@ZVF<s+_*dI
z@8ccJB6mNEyjaP=yyKzC^Zg4Y6EqAL2-+x0&1m*ydcedPTs}QBJTpMQJftu(v*@(z
zs);5cs%rDU`7pSPd3bc*`FBd_gH#4nUBb%LW4wVp6QUN}kXh7wM(Dlz+xe_|A7e~*
zF+4uZI#Db2l=Lo#sp8wFKG08T%QCqooBX_+`F!!2DMDwx1V8ldzoZiHDX7cHnx)2b
z$?}1V7Nb<w76yq^)+c!99TH~Z?U^)bW!vPl0uJtc4>x%2GFz}vz3Q!F>#c8&zSX@u
zgD*}ppJUA#aQjIOo6bS=IQJcuDj^RyGnuq19Xykld$&Y-N_Ni;-?h8^&9;VTpI^9@
z{U~qtov>=5!%Xg-Azd$nx<r1jJUeg4#4<k4BX*aWKA9Yf%C2De{W727-sO&*g*>tI
z52sw%t6{cgnLYE`gE^~BynY?MxAB)<d-{Hh(!lLuTrARZ3zto^Sl7EH%E{-1FwYI)
zg3`$y>#T&1uGsiB(Nj5EvU<98uiLEmEJrUgH*=bn`K!ld+`gT?P@J#uRNmj~k_CS+
ze|_~v=<!SA<BCCnnU_zsPBN8HSXCz46c^Lnwz_9Zs)1;tZJwF&*-tu3daJ~QXZP&c
zzS-r8r}&|_?GGauKl5;Goi6Pn%k)l4;lo~$oEC56+AE#cT%Wbae5sprsD|m_Zb`}b
zYrzkUi|h_<^If$5!qM2QuRk0Qtd(BxFaLV+M!7`OH-UYeS;v+;L_MfbFGyJw70vj4
z#eJWi`0VoPjpEI}-TYP`t>t%T$+??wC*6L=blv+8MQl@U=<b~rUw>oUn_un4_q#tH
zK7OF8^6S4pkItr*mVVV+5#B9gVZ@Vk{i0tWpYoRz(+p?NV++rH$o%1sVT;la-roB~
zv(KqB$~}pcnWi3b`6u^>Z@=YZKSkYszV+VS<8>SnS1yORe{a<O#T;)PSMGjn;>|bQ
zpUvwGB<tT7)cfpnpB|9B!QGsfV;OJvkGw*WPXdC+9<JP^VlAUqdFk!1zS$)r`=nn@
zQr&RG>eP?ZVaL<$*V)aRS8ub|=6A{0k8c;<HB6S!C=i?Vl}qi_R5`BW?<>FXPqN!n
z`*>5Xj|acxV!2~>5hp%<`ttVXj0T2xix>>#&)oRB#qeBWr5k_pw^!}m<*U2DC*QGp
z@zJ5oQBc2X!*}<He}A)%F|w_eSzn@Uy=H!5F)wRUQGdm5^^?+%PW@eaOkBG2^tEj_
z%hPww{2kRJqSg4d>SFYhf>ZZJ@*1N{%y(K^RyuB5;FYc9BPl=g?sop_H13{jN163@
zHnS>h?Ns!=qjbepOf1q@{HpQ(K+&Fdp`Ee<Vt)(WiqFoPxg#+w)BM9PRi%lpD<#gf
zN?j0k-^;U!;mRt(bLWaJ1d?}ntu$p%;VP*vb&(IcvFuKOs%zbs!^SVeD)Kouhjj^m
zkkKs8dQdOuv(KV;t44BlLiFETS}CfQ{ffp3C8fEy+e_+n3wJkPSSFg|m}qn^%Ke|P
zmg0WLXcvD6r6YDPeyN>kC_VF4ZK(i<;q3F(zNe2qm3eIRQg)p}+ruB7pG%DE>SC|;
ze)(AT=8d_)>_v4`=JxHeo3XBXXZF^mhgHwK4L$aCO4X(|ho>93mbl+9h>&V;%-#Ls
z!PfgaIh!Y%C)~RuQo2~q<h{kjr-j#+_pCN*?M(^${BrmIG?o}=1+8mlTocpH%O%Cn
z=rYfDo)^i-T=21{>BrgYlTWf7p0{(l*u0SQO|g$>^{$n&t2%f<V9%6UP3JB@+`Y<b
zkwC|For&+(%FWu`9&^6Xbj{(W_Jd;Yw`PakJEuL__O$o!RR{AHF$cZoo^<NSGFFa_
z=J9(f9OJ(A$}#?3R^PwJxvaL_HeZ6RZ_dp_FZbO0<#e-Vp_kmIZ?;<|1-Sotz-Ap|
zvy<VI<S$+=yPjF8_G0G}&eh#a`^d<#_37nlOrPv6*fy_knev~*v8l`XYT93~6;EB1
z8!jAgN))WVeP^fr=6`ek@S-*$_I5SBZeeF&5EW%$P{G%PC`!ytEzd8?)+?x-8Xld0
z`<PJO_4N`*_?HBAdBuD=+Q2`{sx0e@Z%xAEIbv-JYfenvV!HM8JH4d>j{mCD%PQ6H
zE~}c5TJ-Jq&N|~_HvaGL>!a^<ws;>F->x}5EQj^F_y@i8lk@b?JvQHLyd$V`<<Y$S
zhkwrAelPw!|J?mUkLMj;e@BB;)BcmsQ+6AkX`2t{Y`gl3;q}*T8(N>eHtld;w}n-0
z>83MWs=lhi`7<7Vef{0$xlpLbspCe^<!?5+7yP|hq#Jo{U$<4!_4&f{gyUMp<UJPp
z<Yaj)Pf!*;_<x7lyY`JyCt}rjZbe^P{yMnb=k1@(b8gnMzmxkvH*|mQOl2km=Kjqy
zZyZYg^W*p5ufJYBf4w?B&%SQQ48}UG1igMI?UyzovitMo&!%}E>rsq0-F-3RyXVX2
z*G?6@Y1!FszI5ZC4fn34Ut6+%r$elrWpm`WFB10`PV~=spT#=;L!hT!aeDB+qXL|o
zZ>nUa=H)6+;3#%n*U4bIuVKOB6oG@EJ73OquGbf0mwfoXd{d0;1jC)$H~PN6Tjssm
z`uT<*{l6cIF7LlA8vor%@R#=^+3krBR6aafezoSFjIryvQj31+yT>zy+2+LD+;Nnp
zI6W}eY4y9*zl)pu*L9o}ULo~2Gj7g7--)Syxf{5oN<3Phb%ySGll*1zr%B1PjAuAS
z$o|V{vfS=>MNwSxT9UGp{8^T;GcKGh2i;l2yM1hmSM*CI%wo1Snz+&TSaaofv+~O&
zY>fuZ2^WvQ+Vp>c;aAovr#Z79t)1{P;L=n1(35-G&(F<mR$A8eINA2X0tc;~9vX`n
zIXo*xKmCljbo^87y!1W1iyB)z9o}gqHur}r26IT(iMA~-w&3LYHE%z|v$y$o<PNV@
z6%VqJe%>6o;oyA_2KISeX_aBeCRd!3JhW!7*z|(KM#i<9pLuL3`f}>2hrMKQo}s(*
zOOLBRYwlfg_*&$`#5>zW#3=As=)J0&^R)J=%<!A&R=3*ZiO5z?nMKJa3Bhj;<rXZz
zV*F80HpBY^cjn)z=ju=HXZx#T)%?GB!kpzHTh9m0)tE3NT4$pyOZYYEc^jIfCh_)k
z+vJ=Iym9`){%`DGB4ZmL+^}XkC3fjlLAIy!F4q$(+ClFwBwu27UdfiB?p7O|xJ+Z>
zqs(QKZRfft8>qJ0Y~q>EZ({q_wdp?3+$^?=Fop7oMpG`{lVgiMrFdehV3<s${rg{r
zE19>samlr4pQ)|-^0%AQz+pxT|1TA;=iHGW#MiBl*xoM|e6NQ&s#^DY&FQVh+fG(G
zUG|Pjjq8vLv3gp?_bTG_6ybunI|&;sI42&SU>3hq?bE8mf*&8;;dPV#{G!1}=wNN;
zcdvQLkG3pya$mrAn!WtxC%+t%%TGToQ<dep%y9W|jXkTeo&3RN8#V;KD86Ko7<p_t
z<Lx|={!<54b@{R~tT&(YetUIBBD2kTuNC~9zhahTIo-d#uRcJsG%EZ`#mm*dqgNc5
zdsOeQ?px(I>i#UH$_E!J9^bfR^<j<dyQ=^7!ewjJo_yYQX~MrARX0&nkIb}dAzkwi
zD+XT-cq`c;;vHznqviLE>3H$WZ1cmM649O9let@0&tldt<hz-q$#d9MSc6k|8n;24
zi1hLKtnSN~7}}J)IOX`zbq3EdTaPKrZl*PO1}suKae1D%Lcc)Uq`13okvEbq?D@@p
z^|I{dUyd@}p$FI3{u9y3WBQSI>gww0Gw06`kC=7n(Y9r&&gXysj4NmGnZp>eXsThi
zO|sZ)R&(aH{~XRM<cdh>l)O}b!!G|WORi&sr^|<j2eV>2cJ#3&+)<N=y>9VxTln0l
z^&!=zh8CN)o0*HBPTiWDsA(XTc*64Znk2UCR(&-yS1nnv@b25F)A5m?UOwFZbm}A%
zCsCc~e<k;ePJEgu`Db70_auSa<{$6L{fcvVT5zLwp>xQr-+mYQPp|l5bAkJEivFGZ
zJ1e-Sq($Fp(s=jpL)IMixien|@@s9EntJPM`l7u*8Bh4X&SS_*Q#Aix!d4N*5<WMS
zEq_lr@22#eYmv%HDoVGatAzU>U$nWGnkCG({&q|pTk}rQ*s#V}r&m@<z2@H*ZWp;_
z7ho%~rmpt4;o6D(*WCBZf46aLv;2LL|84Hn6l=M#)uwMv{a4SMI!AEs&x`9eZ51**
zecjpn{De~mvAd5vtcp%FC@i#+zx42eZ%O2xQj48B9$ZfhW0Lkye3t!q#gT$j+}fpw
z*=p|HUSgzo_*cj7_h(P2rRMBaEh+2kV*2*R!#L{k)P$s^Z&-|e%ru^p<zvuO@cNp5
z{Pe8>J|#yBc7;p*+;{bJ=EpM8^}DkV+`sxc#fiu4*0qe7^+GwaD_?7`l03I4tkgo}
zh2XTg5t$i}lU~ea-a651A9JW|W^L2X6qi%A&7T_2dcCof+~>A#y$;J(Sq9T(KR2FS
z!Mr^3W{I-X%54{4%{(oUadp9-+{c$#gMZ139+>K;a^COEb@9@3+jygNH)tmAZRw3(
z<j1q#rbzfi#+2O#Cl5CVl}$03uj8@)K*7o5=_czgKG;;U=&(?+lFK%UiTf25^vw)k
z`Fs+5S23e7`l(T_kNMS^D_?T)axw9LS-f!C^n{r2T5lZ}8_oEm|A>t@&EPjTYAqfY
zW3}oU2Ll76Gy{V?o?1L3CCyZ?pz^Kc?Y!F--|ogcn($9D+qUfG0)A<Q-PQ$@)G}^~
z7|+ZVU#Dmwlv?N%C^gaRmF}na#eABtl1|P`cwYK9;iSs>zkc!)<L&0wN8b4`!}F-v
zb<WANmd^=Y{$%;2W0KK(IOEUvo!F$YUG#p+tUZ;rpB^*q`{(!0$j#0m)ML^HceO4f
z_Jl=}XVV!9rx&^g=}B~Quhg90mBHXKBW>d|29++}e$S{7mFHS%P5~#oq6EMBZuSad
zboW+kTsXs6^xUOYCp<-#Ze6D>=GyW+H89g@sg8+jOO{#owM$XQc4@Q}al8HwGwfcm
z#7g+jy~Lj^_UUEnJjGL1Zm*11U6XWD-{<_veAelLYt2?!*7%DSKR+kC|8{r2q4vb(
zmH8i;FGo(aa0u`^Wqx8QbNsBS))6lgW*rX8e5Y{ZX=C1u!y$G#I-9~~wD%sp`fz4>
z_jREwvoGxkbm3UPYsEIc9X}<X@@_x7>E5)MJdV&Od{^d7+Wq03{d~PePp=;R^!MxW
z^5w=%^F3Q+h2PIe5pCUj@8N`#?s1}*cK9(DUex{S|8CY(<{j$Ob7qP@*t7Yjj#!9h
zQEA=JGAG7=N1_U>jDN)Mttxd*WtvwNFUs%Z#a6My<XzVbj*N<nD<ov2S{V`@g{L+7
z7o98>`PtQ3;-_-<re@%-S(E4GEI;zP^Xb`>hlQ&yYHEC%bG$0`-2GPjlW(j16okx7
zBP7c6d*uTg)vrD2snJp4KJiHY+0j+9_IxaUTh<Fi#=Y6<ejw|u*byGDAF|(`7p&0v
z$hdHYw$|R~e7bd7rw$%hpL5%PuXOu|-Ohh~6y6B#UFB^e?0rJ``pm$T7p$AbOy6ui
z#eXQQcEygyb8{wHwX)PE@(2c0o(P>Hw$-QXM%o086!-TXE0oIB)M78Fw0=?OJ+f<=
zQ%>gtFX_|Ew+g8F3dGJ}JsH7tsX(&Zs_{i}hiY|`>6WX!2du2uUVF>vQ>ehMb?1Y$
zcqM0E%B2$%(kF0<IWNszD!S_Icd_en1~w^EmPhir*tD+H|0Zx@!M6RJ!U=}{sUnxA
znKQK=wo|i_&sckJ&N}8#&5jZa)P(umB!%Cw@Md<-OR!Kr{^G^u6IRi^Eo#Tpc{iQ2
zX*%70qV)))Yu7$Cb02rz2YR;;NxVPvq)h%`)4{UG{CjVloAf0&;@FY&hiWSO?_CeN
z?)X@~_iC?lgN9|wqPL5}9`J{on|V5<t;%3snq{Zt%yN02l8L8)ojdb^V(zJYPwrUq
zw(sbzV2r%I@kT)g2czTU)&rpuCs#78eR9Cv``J9loP%OJa!)NyoN(%`@ZER2W(7{@
zlyfjo{o=#(^?rNq=d&}<%3s!FmN;-tTmO{Hl@!U(GLKV|#8-Q}*Z19=%kt)M{M+9%
z;`r}HFMc$Ag+{hZfQ{$^gR4jW<jB;Q&ia%u(WuDQcvVGhL%`IgZ24)=pQuF4mALX?
zo#8i5SFWWo9TWOKEKE<Y&=dZB#8>rMnez&k)6P5pH2$dO+#kmrEqQGDLz5XUTvG0P
z+G7sX-qI+3*k9Ox;Go3UiC-_PW?inzJX*Kj@`+N>epS{Tbyr(_lJiWR43*6L;?EQ&
z*L`Q;D-NvYFnx88UG_+b{xg5wZ&e-VMJF8z=|6fRMY!m^>JH(|L)X77iT(WHgcj?>
zzAG0ei)m@kd*k{3|J|eUZ}i+Wv($SJ?D*W_6|dL+HE_q*hnqIas5$FbOG~fZv|V*i
zNoDGs{l_9Vs{VR<T5i>DY35zWkM|kukzHgn*HZTDX<McEcj|MkCSG26Vz=Oq`!nu^
zesmF<Hz7ArSmQR!B!=JV_mkY8Y<|0OfmzX-Bn4Jw|A4%OBD?Z7-sf`JDa+7se4FG8
zU3UvJ7c+sH-!B3um$4?i<^H1nbX)uWoAH%yymH6d=4w>`x#z?Xz9*Y&!~T^I*sq@T
z691ycoyR4!aDk5VeTJDE?$0z@dseRDEBhk%42>7I*Q(k}vl}+X@N^vdaml&elDEkF
zhThia=YG9#OgnKhB>4KA(5$P$52~KdS!KL)-8ScL@l(D9tFIi^=-Ib;zO8ic*2A0L
zb4Vy}%;(viQ@^~#XMxl8nteO}{rLCjxiiPwJ-<KfOSv%Nw>s~Og&V}ByXG1cI((Tf
zBir$9`Y|bv*;B#|w%&N4nR8%4^^DuBljX$?^AhfSy~CE?EA=$oHs^t7g`3olMc1qs
zta!z@?(+t<8Mhp^oRhZ=3N)@y&6a*PfmKDI;z1$*t;LtW3LO6E9dN?w;oY<IR;DMK
ze-AK}Vs+Ekl$kf{LY&c*nK#)jJ<opMDbBLwV8hGuz*lRMOlH1_abG+kJ6P@3Y|mZh
zZHo-<&u105=bU_ny_e(5*23_sIX-uLOAjt&`&hs9TJcVc<@`MfiAP`Mv46SSF{7)6
z`6%1&)9PF&vh=p_GJ3aqOZa6rt+iNNnmFn69gDvc>TdhYkn;&VA@gUyPFB>mWs=oL
zvV&gC@j1?NzRzA~h3J<jJz<5<!taHDH9vfLzwRH+kNee*$2)%)tze5>ZY2HmiQydw
z<H%p?2hO~Sw+=7<_x<ACq#rN;?tc3A`03Z>!s7i4?{>b+%g>+JEXmbon{{QuS4G9%
zUnk-$8}=UTooy~J`6J=>&4Rmq-<AJebL&03&b%=9#oDz^)ps+3_bA5xm>2zRja0IM
zR{N`CR+BD!yzQ~hp7XZB&(PLFv+CV%?Fz-I6By3u8eS`!b2Ro~n8n{GTXy<w>5K}O
z;d^&aYn#UHO8ZU4|03VBNeL-Ro!yfBAx48umdR&>qr8;9t=sjzio5Kl8ag}k>sYIE
zz3`|_oAl^GAMXU-=DaHm5waqSBr9ey1TJa0bn%bErgQHX{$!AS@Rf_}>XZis!smGJ
zJW{C<{>QQVq06-u9&r!$N*4(ywe~MK@K!pkG1J0!hm$dvwZZLoFRYh%K4R{hTa&Zt
zbjYrmm)OlR_g_8htF+2?Vd$lp+Ywu>F6)bFTx9Yt^V%uVe@OMrl4hr?nv2hW^;>`6
zYX9jIZ|jvRsuvtg|6^<Zv{)tK*5c0J*B>~{`Eu!W%91@(majD2U0D9!|3}uPH1|xi
z;`(VOh0Pc5ov+$#k2W{5ebo*VEpY~hbvgK(M7f#8$)F~Y?cd_t+a~RQz24#NY~`z7
zJ#$TJdw<W_8B!P&|HvYF_w{{+e<V6uRE~+9RMyaz>i_@!_EC1uI<LOBclPYbx)r6=
zc(g8gW5j~nPrm#;ZQq{H-0wPvm%mml^`J_^OS#I40r|(;`sdEQXC`^{q!#b8%{?~v
zZq^#L{I^j~H+Jij=vRKUSzGMbNg1ojJr^tatLB_#@>6p>(IM_G$*bgN^y0zhp2|pu
zxrZvGDpG`&r^prbw<`8V?0L{qdoDuiqQERQ9j2B&4Ta0iJs(>Z-aV-lz2r=(r-A<?
z6J?XGM?Fdo_g=3|pX~Z1wNR$$uR`jt=xtt28D1Ld>9(Ag3Qbm6UJ_z^e5?3Ch^=(+
zxi62WOYOaSFuh;3<IsVMiX)pM-+XTC+ppJTz`bbE%Z54YDvmunDtz_y?8~S3+<w7P
zH)F0Ae_Wt~)!E(0E~?B>694q?(Md_0mA%TXi=><G=)atjc|~0)Z*Gq1gN7Ai@AkM9
z6<JR8crow2{&J!ATR;4CZX7Q?o&51LZ*-%F`ja!3zmNZBF8^}-;ES^lcVDlzWs<)-
z(KXyr%H8R6$n)k$6EAL>+I3wgNwc+lZ`}L+T2pRZH?6dKe}9jh?EdP~AG;iHoO|)&
z=<Md%b?4KCg*Kk~tiFyZlX+S75u*v4*_ig8Vt;dRZu3J{!RBXCs&kcpW|(vz44PdX
zr<ZB<wEDoh>5bFpe%6sa@Ll}kt3?}kDhb}+&s$Lzr~GV@f7|)5(W@I1ueFM>O1vv!
z<Z}Kd%6D!`>b9lw(X|)3SZ12Dod2N5##FqAM_^j|)mzP-lNFTA_DDN4s~ogHuu^B~
z#H;!TmY6UYXB+rbC+)p@V4dj==_AaJpIw{04%Teq*(6zceAC6#;d~Et8LCY_G0#t1
z^B~mNoZ;u^?s;zeoQo%jo&6_MKKb6?zfF7gPWo_Q#RT`D?QOe!@3pkfDJ|Jh^>cTV
zR=Zlq%DL6P>I*Z)E?menxWULIBM|VcQRth3dv$#M%kS1Z6nvIUWS+esq_}C?lxbTv
z{WP0@DjOYp^>xdB>+3O2p3~Nf*EEX<ojcjBGmky)Z1e4{>R#Fx1$X2Lu+DsaYfkHA
z#?BWqKG8Flf8cEMmMD?fxbWG6^*URB`|(LQPLsHxf9ueUb1i{}*`E|XT{xDLef{U`
z&CEWxnZ(aB&tJ;&tm?hcbGJDY?SmYbTXVj=^3}=ha{nc>hTKQqdrq7<?kVt7uVVR>
zruxk(;;a7`uD)-)H7enOqw)3b=bS7oD~%W55#8i^c}rIE!qR-^RSyrPKY4HSIh8y8
zTTIu^`hCTL*NP0?7#tq6D(vt-cZqfNi8WS7Z(U`t_w=brGl=Rwk=Ao)$F@`t7T2XM
zL23#-i@e1-v)Qh9bR?bldDP*sg!7(br(T&bKjdC?>hK*W`M9?4S^J+_{$2g@aNp<4
zkNsLdC@Q62tkV5(Sbsw#=boGubrv5N>6>1f{?JzHg}M49-kzYs|8+b<0zbTtRq*gw
zR_%{_b^A$&8cTYPP;;Hynda10>SA>U%bWK%A2=U(jw!z_P<EY(VwYcXk?UdB*OPVB
zro?QV;#}>{@MnJW<jaR2moIO)P};ZdYsK@A@7}Fr)%tR!GUv$6A4%@}Z|Ls7@i%h+
zjg@<TXx1D0+zf4Kc8*tZThsS&zS0+&^(P)?xRlMeobPQg&r8DI%3u4y{5OAm_pRvL
zr5$gx^3l%EpU(yVTy!b<`O2D)JFM6){BhZ*@%2XSw>Qu4%GPY0y?@8ct&+<(y6o;v
zee`H?>BI{g&t+^$<$jwtFG4kE*P^4F-b$SM-R0D=_gE-XRNjNzwSvdpOSrbhb3WeQ
zXtH#{0mFzJKMy&2Buh;As1$sk(_`Zjb-%k?rbH#r=r@YbuinbW^?6ct#AAIGXV)DE
zbDLNG6)KU;z26pl(qzR)t=UUICUMCbD`&irto;8=fcNQfMyaY(PpsbE@0kB{b8gWo
zqZFp&uAe4-kf>jy^MG^jB1ezoio$ao+ATT{8^k?IS>itRvhewXsV`R@ES-JDV#eI&
zsW)>qUR-y4b|!+~-{dXRsUu4BMOF&^nY8|o;nna+p=7)BjHmk>M7J&d;-uMff?Z^d
zv~j;)f+ueubIs(lzh=BSm9azrj>GnxtTQ1jotA3?*)Iqz`E_e+Pw!K?{q_~*U*gWb
zUsP`AIRCN#kJs!n7t3tV+<CV+FG=LuDb2&;>z__Pf2_OoPLr$ctC`D=zuMloQ}?-6
znr7XrpTF-UWcOY%&nca-tnilCg(Ff&yDx~hByg}C?D-~Awa4<T!FMy&>&HCIMIRm5
zJoU)#c#fR)YTlC<DhYf@xMFC)SL*A+<aEFBw7}U0n`QI9AAI!Wals>Y&9w9DCFGkp
z!sXdr+H6XU4zlD;+N9EJd(3jipBZOggbFP0+j_2j&!NnI2LsQf#De7XFqe5sdrAx?
zo++JZRWmwu=C;&_i&qnZLs&OIkDD5K_uv|yy{D`4-m$$Y*RGlSIQy<y-7(F@(`8p~
zaoew`_=rVWqPbdfgTf4}u%p2ek!qsd3DZ_e{e71B@g~oNkM9!=OY9eh|9-SW%4e&)
zpX$8)$@g9Q`WG9mdBnQVAXRtAjoF$^wj2FUv1sqOC>j=iXxG<QnI<QERXH_R+{<`)
zIVq`K&}G{8WkuP~tY)5HYig)o^td)QKFYaq(>?EB*UtW#eMEpO=ycD_*Voo3@=X3G
z{_@&k%_*j05vJ}hM3)N5vDvJ7wMi{(z3Y5~hQ-?=e(a1nB|ckEoa4Z9%_E*=|NlEW
zo?H9S<>FSpEv7t6HT=Z_#m>wuy|{YU&9uGxPkC85jPnBw_8;6WRPaH5)x6EAQ;NJ6
z_GG0l`P^N1+Jy7}tw-LcYHnLuSX$cM+^oQ(eR%R`^RB&Cw;wLIdi=3sV%L=3)TxVq
zD>S{}km=}+Z#a98K`CX{r1$&V<-=1CT;H0wVe()9{<en_HMRHmbur6}nLe5SsrOIi
z+H!@mIz{vSTNZek2<(o}D{7W_?%z_Kld$JklD8H6j>YqW7MlGoo%(y>qR85ZZrQ?R
zk36pIxsm>4ckQO)=*r$Nvkv!1X5Q}gC>8(xZ{msbISNjS$Byj@GCZGU+!P)<efsZ1
z-{pL}jvp1<d3Q@RpOuz?Ky=U{CgB%$Q+D4u74vcKYS}42cP+mZVYTK?X<7N4<1N4J
zT55QjuM}-E=vbE_@nc0Bw~5fbEB`rPI7m#AY!R94DzQ#LW?|g61&Qb4Sj=Qr<uP&W
z=MlOd@szLKSWGP}o9+2K!J~JTI4@7ktek#z{iO7axs`>js!tzw9a+HZSMs8B=cQc-
z)}}7*->TPmi-U(Ju<6w7=)bpkmQ=>yW}mLq=j<aZeQI&*xq}r-t2fNy5#!Gm_v%nP
z<P^SUY2J74MDu;e=Vkqm7fZe%z?#)^?e>!pm3`BB+7gS;Y;fZVk^HxeJHqWylFGbg
zA$uA+k90F`iI95~F>661V_qk>!jf~xRoGfT<Q+R8yv*>qv!=KKZ}HWlAI~oyocDn7
zq4CD9X45M@Zgm_P46CRAc-{4IQeSP_JENl=#<^Ftj8zJbH1!vj@8NKYKh9ca8t}qA
zbAdqm!=>wPUH`dhZ;;IDQ}uIt8}B+46t8uEe*DHH#~nrP%QO=&=qt`LYS%wj#x={@
zEY+ptl%n_B)pg$T9}J$jPHNHd-&Fr!e${-#d@Z%ur|-(Qc>IvPv!4B~^_}%Uf9XFj
zlRtNM`USQnXD??S+{b&Y{)~FLfUZOQId$1Xy5>K;_wbvROA6K6dWCzInJ@ISZMmp>
zy=eA+m){o>J)^G#G%re5XIZkpn`d*_r0XY3&b?cp5d7x;LYWW$^tb-F9^8Fd@|o10
zcT+CgKA*Fz$T#NE<!L!uRY|Ek+Z!dd=D%t!yd$w)qW8$<o<l|3Z~57oUVD8aH{|o8
zp9dr!9lD}$Fz4sGHP#%=*RGvNOOswv6&LAZbj2k4ft7$Ej}qe&MbXq(J<q3pHfOq-
zb#9sA>Uf91r(3_O`q?GrevQiwO>5OKb(Gq7+gu{Ny?1`lwz{ObUJP9_MX@FS_4aCB
za&Pkf8FsiUqIZM${La$3>8gy^8qU1*VraSAA=CQkl*~=0TNl<}*7z>lH9<n<^z1vS
z%lYr#y7g<W@y`Eh3Ibb8rhMJ}Vb_PPMrOy{b{ZcIzpXOKf4-Idt5)@S4-W`SU9q-P
zRlak9Ln*58)~f5D)OmUDG}L|D@^8(;Naxi|>~pW}IlpWDq9@7gcO7D#6p+aK|Dav>
z)hV+t<Q%)2oh++WY0U3%ZMqJV=jX@?1)nkwUUq+=E_ZciSCr4fco(5NPZ`*xA2j(~
z({?f7nr5}oC3W32;mm^z4pb<$$@nd{Nd4(hwOLAGMzyK|SDxsrV2h%?Hhz!2V`9YH
zU3N@o^L!>@Ti^YhC#1O3O5qqs@`aQm4+H0<^ryWl&78k<OP|>5bjO^(8xJ34Q84pL
z-L`j=e^lzPol9Sue0uac`x}=d|0#v<-uw40yt(_0yP4*yEB~Co8SI^Z!FJZK6wmO!
z9QALjgQvAzY2G#?S20s2>DW?}*e|VjdTZPEoycsy_D?Za-ShG41L;As7mp@5b@w$J
zoCsr>|H<Ofu08DE*$TrAjxJW{{yAf5hQy^cEE^K$wea-D$+1Xx96Xx2Il+jLL-3JR
z+RaIZfr|{TTfZ~tU3WxqljysfS#Eds@86j^H`8$S^W!2HSiG__qC52?8I<Qgx0gF<
zf9}k#7yMeXTY`@X9XXVn&93^rVbRyW-gl*|?Qe-J;@q%t=EkM1ro}UUv82v8>b-Gp
z+fG-pO`5$%9}1G>RCg%y+%oLjEXn!ULQ`mo7K7B2cP0ks8$%AQ;a!zd>TyMatM%&&
zmgCc%#h(i9v8;%Uf3N-DMC5nahZ&~VoL`)GD-~RNY*{*2^z5({)+C{$rd5WDr(7Oo
zNW2VKYVb5ILzKDv$j#t63XKyTCG?&d*0*dGX;<)F#WW?&W5;impch){y2eK=({@z_
zOf~Y<vtIil;KD(P#g|PU?~o0b@I2hM>?h;e!s}s;k?-C1&z~bVXV<D5oZVhMZ{BTn
zdH-x@<eFIDw`R3k+Pk&ci_doE=9<3QQ#xUm^@7qZyNZ8l`k62K@%OY~&}+H9Ki)r{
z{CknO0LP-+N(DdO{S#PWATy1pOWpk3R;PEzR;}mxl0LhqAUj}1%D!@wM$O5e6J#E}
zG2}P8khJwq;B5IM^QEF`r~YjZ@|dfCcXtWHu2SyZn~q<-Yw^7In<Mil+fy3)fgu4c
zD-?Jbmbq%*Zn1ah*)=m>e^17*DXVw8J&M_Bv36cl1=qIcjqFzZt)dHqZSK#r^j*DM
zD}Gk<DYu-E&IMhkuWV`Fx+2m1An)9zkCNhlu9bG!DU@gY=Je_t&KzOu_f1R=v!0t?
z#kAzg-8V7)8QT5dUL?BOwyto|ywj8M?99CS4m+1hPp|ng^&Kr5pBUe+U3>6a*#GJL
zg4bFbrd#konKU7BCR;*<;^FKc=_UfFXQi-KG@g}N%2&y~;JWOuLpSH$?sz<X&PyS$
z556+5cQtdFWF62wU#8i*WB%q?q1N>!dtM7Dea=73Yg2n|C9|N<LdoBAav!iXsJ^ac
zFgf0~HqL=JJ^$~qLk4Q6EqMRl5w+P6$sBjTDb&8fB|rJf&X)Hl*9dmDZ_C>3dR?!z
zYJU2qm{-5`;(P8Y?M(4rpBdA?sK6{MhwaI&Ne|ZAHXiidpStp5(64M6qo;r39Wy^4
zV_h8cb6ts_sQt7(4$S?Dr&6+(hOBrnM{(JrlfKEPHpj*$pFHgTA>T7Kd*9-^eJ-V{
z=f9s6p4jv5PEt<%tcQ)WE??eWW%_2`ytz~S7i7y^y}$a8K~?6`G`UW#3BRjF%_r;j
zc1!Lxo4N7)_Tzu=zIWd*cSo|8*`Im#uFjC6Yo%{`<Na1`V$9dpcD&1G)9c}WD?%-I
z`xluBcjy0l^0WAp^3O(=+E4RSo_}5)UK@E!OYd{#ALVV56Xvt0ERR>qob6%1c5(R8
z35{0AW}M4x>o1>s{G4#tfdg-Xo63)rOmmLvds@?#D0Vbx+kpc|m%OQYf6`UH;9J^C
z+2#9k1G(#`&9d34;JhjN+p0}2jBJ4?!oC@A*`D*MWybO653Rx@K6BL0Oj$qmvG|hh
zJZh)1AL&cH=jICwHCg{u;7D$oRmv7&E#Kz$71_F*<6IebT5dm6$+oXIZb9a<*C`Hj
zqk;pM+>k!UzV71GYLWYHN-2q~*_{r|kGRjpl*VMo{(1cAYK=_$(LIa)JyM%KCw|Lu
zo8NDrJUDv#a?+_x8}5kW?zRs;TMj&lu3UX<O|Pd}pOe((m$!@T#q`(iSR`=0Ior!=
z*23t=5ubaW-)yb^%pCIRqtgBvJbUFg)i>CA%l-LsWN(w?!iSUA9qA10H{3tZi`^@=
z^wcejO|M_|tGS9cSl<Y=f2CU`B0cr^WB>L4ZfrQUP{XR@_<Xg~eO?<c{azm#t-^Ni
zg+%maS^r0Tf&pLjZ%i;tnzi}y^yAe}9ux~Tm+`b~CeJUd-n#dw3hTCmQlEm}Xo~;y
zmXVp%KC%1s+YicJPD%BO{<Y6vMn!IxYkI^sdFotyv4TBkSYID6-*#{Ib`_4iP~KA#
z5%*csdD~xQ_^aw<W@sP$_FBi%&F{3e_f<)*KKHaEv-|@%FPUhuwJdxzan?hDBU<0z
z8NTP%ver6X^qHwa#V~7y?c-{@rc%a_ZH`x+r{-OE)0{4N=dY2^$78nEc6GPE{Q4rl
zJe}SB)h3^r!T-&7=zP|`t2Q%!->XNWdtPmb3e-=S#w2n3SC#$0MJdlKT2*=i86(YZ
zRPXi+x_`MNT;=60ew~XG*{d%EOg52g=XvgBs@}vN{N-_sRr}F`IEGC@8=h>`Jizlt
z@=ZCXaonDkXA$w6j#xYA=9|W{J#v|5=XgX?fltIye2-I@V^Hj8Yu}6J)A>Zg&kL>Q
zdzSd<S+yZ|cIK29%VP4@%j-P3ed1%-nI#MFF$Y~OIW5)lD!f!I-FoYyq@`IWOYgKl
z)~ZyCJzMR4y@dUKN%ZrQ{(GJwjURR9U0+`*w$4GUs6Rw^#;?>y#e*`P+bw*K=DG;v
zKbaaH8Msj+Kk1mlwB!kDuNYDvsI3ck^#0G%EbLa<kj|RC#@PGdo{t7*XD;t_6{_V|
zoF_ab`*cpHA-luM$7k0`WaQ1+v}oVzHQV@Kb!<1C{waIwL}tfTS;tc4%+~uJd%;v;
zk(}nLVHWtb=*|P}3cuI@ty&wdj>f9QM4z~Hb;l2tJzoP}@uVH-J!G*bPwo3!CkrO&
z#h+E99Wy$XYpd_r+0nZ(*JkE|o+A^_F^Rsk?VU7p(T&)1PP@L{Tk+_O_eO8sF00>-
zfx-I4v&2=Wr-~V_U^}$XA%xBOa?hi`j}}~Az$78vxqyS|<&|^qCAaGaY~ftzmHNHT
zRN?5WU!QrGZ|U31aoPHb_|q9*{wI7|{rX)8yXy&ooBV23tWIs0!%thSe|_nBpJvMB
zmy65lo?QFvx~^10Wx8$E`8~!CcU`*Aererxs`t(H*zP?`wfFB0`?JbA-nHhk%jehc
z+w;%!-Phc%xB17q2+{ZE@liU`eNVq-u1x(~uXRB?)~Y2v@oLG;54;^hZ=*eTdEcr3
z@cib<?r?SeKE8hzc9oZ_y7wh{1uj~5BG=kz&8)}&4INb&zpb69vhWC-y@=0;!@Lm<
zGbfm_X`I~Z&M)q}C~HUM4#zKFR~KlzbOaYQ@qNr?4oc~_?%wRHw)Xfxt&ZpE)~ug?
zuIJ^@sIrp~oXZ~bx<%)?urF)P-5!=VpC|m-F0*r;LVx>j)>n_NHGb{r{>I-{cAHmc
zQ{~1NQ_R-BQ(G}>>!~|jtF$8T@Es~yum9nWs(9*;Ih%z}Oo|L&U$T0F!s((34VR8p
zu>V>$;dxzbNb$osX3O5Av7xgzs5wqxi8ov5amC<{v7@i3hwm4YkgXvnE?QT6O#HQv
zF>u%Q>5&)Gv?3NQS$gYWNSNtVvw!?8Pp-BtU!Jen5%%-u-{QYH`S~j5^##pt_J_7r
zWGsHAbk%O+r%6w9SLeB}tg4IF$xfOWw)~S=fqC&h#nh}TGCP}<)*aW$=l%MRA9dw{
zCfn!tf?Ny?J<1FWa(GrA<Q8P=6;$4p%Fe%S@o9HG>-xV6FOyb#M!kvSeNtd+p4;p@
z`@t*M-37dk(==v_M+$k|>I{6c|2~hW=as{Lm+mpPn_lR3Imh$-?}BfZKWqMed;MaP
ztBG()iQr|QO)Y_TYWZCTQ5P?+thcG~Q>)zgIA`aiCtrR%dCKwc^DLk6DK$%!&U^T5
zH#ysFsvzun_-n$14>i6`3O7&iE_ZaevFpT6mBeXJji%_FKa!AeZIZ9pNgIFHoeJfw
zr>Ciiq(tdGy{fjnZO8k|Ij1Y;tqeY!=cC%2A|N_jf%Ce~-KiV0pBSfh3w^NC&k*Y{
zSjd(n$Q6~hZ|MfkSsi81%LR2O++Dc!$HY^ia@~ogQTy~FynaroxyR{w-E_%9*{6|*
zrfDQs9&%ahlem<5P3N?Rgyz`=o~<{1oB~AePu=~@G$Ol?C!lci74@(~_jJBCUQ1-2
zHesdx-^agfX4F{B|5Nty<=+a22iL0udVkDIo6^1^o$-6*qdjq(6mOUP;IKPpWEJ`J
zL1Xj52lBcT@4T1Y`}_L-z4K#gtI9v_JFc<s9_O;~@aeU;=l}m<WBb42J#W%10fXp-
zbH$D=hJ`xo<}Q46`=6>M|Fv0(4Y?ccG1nGLe_AThJnjA_k8>?7>@$DmZ@RmOJ9~-i
z18=n_YYzXoqr7<k^xb~_mUDKR#Y?4~=B?ndH0Jr?trfdGrp$(w_1JobnF{lZCag$0
zrS#Cnk6lh_#)h7n_PvS>BCP)yuX@O(ovZbIX1S9|&ps}Gg2i&BVwIg|fAa23Rk*+w
ze6a6Hk!z)EWXOs+PPa~+$gvCX4xDjRhfj5_=#}+M4<rgix;i~0GF?}`J`kTE$z!)g
z*J{m=6(KE?re!>qd-kT8NsVcm=d44WPo-AbC2V}1S-UbfWLlMk>&jw#jee^aCpzM)
zJdV08TN6FovWe$y6|?u>c#VkyhZZC!vA-~Tq7$<uWWkrL@YMK826|5>=o~QHFe9>M
zl7a6@CL=)yt(MRek2U%;eKrXw?XtV_ZL;xGyT@(ondKSh^yi$HDd;_UWM(*n$=e0Z
z#kLL)USDq(@!D_W^Ykvu*(Uz={im15*Oxxqny_M#1829zPL1GsU3x0*)$=Z8{A>%;
z=AZRmQDrNyz?EAJice%j&%d;~-}Lob>z%K+H!S?sr*F2Djbp(>>3VVF(?6fvEx5Bu
z=Ujg4>t5@hp4PX|T-?{cjD6!J-cZHwMHlRzE#NoV`k<Y)YG0R^n5&w-?NL>}i`sH(
zH{L6<cPKSo<}i6tXEgPC$2o?jvI|@r+BKRg1SPDvxuRz#7(O+rD>?IJ^TmLx$yZV)
zE-V*1c}8UJV&yLtHM@2j`%6r1@A$qt=RBiV?5w;+i@E0;?9!2)_HU`t#G+NRqF6(w
zHwFoYzJ4LDI9<o*E}Q!d`6{Wk3tel<Y|NKBYz_!-+`LMrf_>ALcj{|ccuRHbie}ix
zZaS|pTX*7Sv9QS9l^$X%&PMK9&1LdSy`)$9t{LA{9-p$;+r0ki%A0>N=x1E{a9&We
z2xBU5J*($UUek$+3&cH=6BsVV9E?0S^UmArWmkW070nBOHSZ1krk7J{mPO5VZ=cut
zT;c1)%yv2H;@Fywjq2=S?Oj|e<;&;ID@=%x{S?7(6dO?cBO&0Nme!k4foNW{FW&;C
zxHjr*+}-CYtaN^!?e9Z@W`0id@(<iQRoV8$sWhbN#jS-liVt}vwDMcb3e5S!T)?5$
zd_dI1w{2CXr0~@V-?#kr&$^?{s`z87l;~lRz-Py<uh9^fo^asnpRU>NFK?HHl@yCG
zUiN6}%CPF%))_m~O_^gubb&07zwldUBcp{(H7Y;515a&|{u;sd@kw*g(o1@K!oCzp
z2R8aT9F&-|)35T#4S}OP@oN?5Jm%$WxS6gs<5dK6gT{u1Q_S+GitT$n?YV{l?}kep
z+iqFazC3qi?!(67IRR%5a@>8zHic1Mp*crM^60u{3qQ48Y6wtsoTfO7)zrq+ny<9=
zLizFw%0cryr{!i$W)OJSq-VjK&-Ob}Dv#;XUT(%G3$|<UL`N?5Yie04^l8=J=UJY6
z)ykGGHp|-ja2ebBzO#0(to%+Jgb2$Yn_|oIxLVh!t@>w==-aU8+=0(l3Ot*o6E)FB
z@$>|JgNLhDu5_w8{kf@UonPtSdqMjqYwu~Dv^ro~**T5YnaAJTP6^)VnQGhcD4$nb
zM`P)Xysjy)avuG*d&XYyi~GY5w~lOEyBLv4E3O!tNeA-DrfN9v*E(&yHT}EX=B`V7
z99KS@Br}&WR+Ra*&Ak-~y-CNm`mQPCopzb`41=UemF)dPIujF$0-CnFHy;rf>Y8+*
z><}yKp3t2NjSH+cS$ynJYI@YqwUa5nU-r}5*|iVZ8}gc082@6r5~8b6@5mINP*b|f
zY$30=<@ueDzw+4LS`r%gb{U_Dd#Tdaxz&+1e(RiN_!fjSPImNdtLnUUGvVOJ>cA+e
zd7u1(5<Hn#RDW_*w$)hNDZTf8?=`Ch|78~b5|&#lEW6}ZkotmS^9z=}KldW&=#lUx
z?mKIjmL1sh-(D^$+sWE}(JbAkg4{3OADdevzBDH=_QFq{u*UeilfIf-s#)#{;BE5~
z>)lXSSo!h%YxB$eeSRu-+ghsFv#v0O8EPE<Vs?kKN&88e>($sL2i6M<Djl`XI3H26
z;E0spoieY>&%CAGzD$@HXT5Fn9k~tvz4|tv&fBs`P(rht`OJ3#SEeYTWCIyFsf#u$
zU(cSGP<If%w`<wLz>Ti|Y?+029ZK{z+1?~q<+kUG?Pj|@J6<)P5S)4S?V^W=W>#<h
zm?=BwLgzyN35VA2bXa>ef1A7Ji)Bk!t$uOr)iedp_zM%<wWnL(f24f>PqE1EIO{9h
z?@AcyFt1#@zvbbQg8tj)ezk9-d#_1&d`!RN)oG~1INP_jGk21#-%}=b7m3I2x7}aW
z{1%Q13qLCH)MD}>$$c6@YO&9w*}9_J%U^wcb7Z#c`P^fR0|Jcy+FyQLZ(A@$Y40ch
zzn87T<+lZ%bzj_m>)Wx+l^1UL{Em#4x_5=+$-mRVtz4g2_<#1zk()p7hq}Ie%BT91
z3wDLA*83ox6Bm{<Z;#r3af>;VuXBA7O6%Ue|K0Q3f5qzSOW#lR`0(oQ0-ny#dqo}}
z+5LU>^x*gRRxZtYw8CLU9_K9an7rSowL)%u%5tb}OA|crI?v<Ef%ygB>eq=n746x|
z9QEUEh{k3A6Vlpi-~RUt|MoBH{C9f`oozoGS(ZdNy*K(kYeI=w^t61JU9b1<%DB^8
z);5LtzT&OVtLFI{Fq-Z^X3@3v!K2GZW_`POcx`^;)&KGj<RljU3DsL8#qe<b`RsVb
ztXl!C@Be-CULCoz;8$gf-qWX<ul*J^ICm;u+oQGRJZD|y*C&e^QqKo&xcsMWdFD+0
z!#8*(Q_J^>+Mldu`)wd~Hv73+V%u2}k+m}Kjh~+SUw+Ogd~-x>P4#EBy4P~aZIjI=
zTu4etF1xre;@!e9og)7kCuh$IkI$BSVz*GxB)$1R+M129XbW#Y83u;<T>P6+3bNCa
z^YhX&(?Mrs+SY>>Zv6ipyx`;6fL&fCZ@%39`o(YVva(54ua3;SQM<SA@#6p$m5(!(
zLYp=%dj7e5|6NuGCKZj-g}1AhX9{<+h;<+RcTaWmc|Co<f7un&Tx^7EDx^NI@ma>H
z@Al@aQO~oQiYNQ;+)h9KvnW_)bLGjtIJtdNa(iv8Qo@VR-7B7$uJf$i=InIt8E3rY
z^uB#t=DIJz(I9r}>LzwZZ?V&RG$LoDR!UCuoX2UJCOPf1$;=mw;va(VepFxh;McF&
z=T-GL8Q4Dbp2s-pV%mXM@AK{4YdQnieGa@}U{H!l?Av)u=VyDtLD7Qx#u?Ju-|wZA
zdrnN>(Ye3XRmd-hkKtVR3~`%%Po6f!et2YiLFJ@H&3VQGg+nX9+IoDx*>jwE*)iGk
z#S7jf^q1EBo2MQrAZ8rVp%Iz8Wc|f6FPC44n0NX7{2y-j<Hdfi;Sj&tkU8lnWB3)W
zD|a1T_j6Y|p1-zPtYQ0an+HE$_`G;lGSxM8-twzinH#y3QYPD$E?lwisZ+i1=PC8q
z>`$FFI+>;;@+K=^f959b|F5ohn;-nxpWjz+_4h-b%aTP$pLpEzR`ZdXqq<?b!CLoU
zbqfxx5?tPWbkz}N8*dlRXuZ!G{@>4V?y-B*b@Y|@vlF2+mmKQ<)MU;!Ph8zIh1b`}
zAt$on$7S}G3Wk=>Jl;KedFjV1&3x0;WzKafd%t_@nyKMZ`&y*Y=WvI2P{q9O%%>V<
zw(1>Px<o$u-nllxvkosb-S>EIN@%;I<;(fu*@=X^ueJX_=V^=8Hj3NN8+<UItw3nf
z&Idu#GiT41HZxoBCF5Gd#rWFfof^LLwm<oJ^Ce&R!FSD^C(cb0Kj_q#wI;$bZ$q8%
zw|1GMlK<a$Z>rUw(08$E`e&PE+J^Iu4tneQI@TTUR_d(uPc+Qxy58Vh%&hM%`Q_#Z
z>!`etOjdzrv!j21{aDAFVXo{wQzTKT!nyp*vU{NuKg^hFd3nXGH%u31G#z`#dx1Y^
z6H}(fO{pcuKHPH0q^G5L&TPs2#4q=IzR~*N$)WP+BQiG%sm?CwWqpzO!&Eg;%f7N{
zEsMj~U!no*qB88c6Pfvfd2g0gd9qF4-0|Jvo%^yS`PP~SYMxxlZaGX={pWIb_gryj
zHu^EK`Q_<toLUX%(=_#$o_MvA&2EGFXYmc33*M_Mq`2~}F^p8ryz|<4o)Y(r8Nco4
z#m8NJ!@64O{QEOWYRQ+LxOm*$T)Cc8Tt)n4_Qa6O1s_z?Z*QMI+o(V;BeZ_jdZQb^
zRvhi)QlGMZ-N^?nN4_}E&Esa1a+d%1zB0d1@-c(^J%@X&{R^JgT73Uy*0p=GM8T2l
zt8bi&xMOc0I=&)q{=vf=R$W;byQk;W^`l2scT^SRi^r`?+rN{!F#h~U{=P|kCFdFa
zF3#}`6W-u)aOvef?#Xe-m~78+Enx7Tv#DosTJVn>3u=Tv+ea*Ld&B)!<953Jr;?Ks
zdRF|uk+k{F8->-&xQe?X_N#82bx}Cb_t<M@@08!STX&s2d28Qp(YBqtqBD0~`_U}g
z?)0kgY2t%xK?*-Ar2?&7{+#M}3jDT5?<2El^W|R$)WcbCooBt!RFTphH>0tfNu*{`
zRz&I%@yt`n?R5o5olVasoX#`5sC6o8*Zn0-JfE0*w>G-V`*S5u=GhhS!uHv+wbN#a
zSd^#ie$D(%MaVKDMSao9qjm9FTeqdjF7UN5O<Hdz!)R6HctO}^u3aw&U%O~y0tah#
zll|M%b6;(9bK_FzQ@i2eGW{asZO3niOstwZuL>n=%FVWl+jUU>)29$=7P<YJU3*rD
zvx<u>_Hb>`i8)~B8foII7*iB=z*TO2(7J^N1q&ytM6JKjH?JeW#P{&bj7P={=dI6P
zZ@kelNk4}#dt<UsVoJgCl;kH|22+g|*IGS(bbOo6N0aIQ?zw#|S#^QAEVf~Fe@5$S
z5g8pR1~xmdaEYb_uVa~u$`^#q@{!px$!dY)(z}{JmS5mE+`eM@M7CXxZR$0yaltD+
z-W{5>Ote9~p6{u)gu<*u!L#$rS!VgXO}<dx^eZa5_?^?6<z9=MQoE8%c}rNkmc@Kq
zd1&S#Ms|lcQQo$1-y~{rzdxj+8ggdB3<GiNMVC+TE?j)YOzE#yaLSs?-}+YXxnTUZ
zQ8vhePin)0B`2oI^k|0gUf#sCeBJf$+AO<!m1oXYc&6Ha%0che<od{U2E3E6Z*Qx!
zZmHee^m)zmzrUVcdcE3vvW!#P%Imw$r+vJ*(J}D#SNUIGPn4*-y7zKT(S7;7d`r(M
z$phVLGH>}qciy<C^hak>{fCV{S)q@9tFlcn=>M5w+Uz?oA+4D4`J}T9i~QDXu5S4n
z`tiUuPfPR4x%JN`PLaIkC^zG2<h^qai!Bov4LWTeaV+ta|FG3urio`|;JiC0d`~A|
zDw8@Vziz|F8GEP96SVwxTj@>PtVM5X-gEBazUtiE(ZaZU+b1pG4l(VdwmeBS0j>1g
z>{>7Cb{x6<f-(2WhlO%>-)>w#BVBD5CRN3;`Tio&KU<Z#|4!beb4hrsli7j|ty5at
zWae|nvVK@xv-9QG*~#nncF(`Zdi=Tky?Oh%<L1wu`(G&LUsdJTXSD@?zP<Un+nfLD
zjPeNWqLir<PcnU5`8fC6*BzIl`#(qSHx<7bKd&jRHoEGQXq$!W!zr?n8BKG0AJ%)j
zE4A0L8a?vTvp$uxfV=N=s8;FAp7cEq{jQH(&v<J+O#Gs`n>|L(E;X+ErAk@S%%(}p
z*D^obowez|`MwA9&&^0*ZvSUxPUo}GNp}wks!LjV@_oE>r>Fhr`QxWMuFgMj^8a(a
zuk)8|(kV{KeS6yPU%AbPO??t_mhZFfNC<vuj5>Kq;9TwHubstuM*NHT7ijPBUhQ(`
zX3O;K5Au@nI;VS!T#f%px+RE4Ig7J7oSBupYIl_6VIiH@fr&Fetj*JOn7A~npgZsU
z!ezzV=d&)%2n$PBzjbcfMz4dllF8q?R(`+#{hFlxpYG+?ngZX~+wHcpwf_6z*u;iV
zp;S$u)6BK(+L9sb%<f0@_rB8R&+WXrz0Ax!UWnW7+=-yyokbki_smY;R1&h$<YNby
z@%EQ%UmsCldiAq}%=yIszn=0IhBU>g8(Q4+b=={)zJBx7bh9b(TRP5eIP{P=y2y!>
zGeXQ)>9?h~U2^ObzS$E#@qD$uHsL_;f7O$ZYIOgd%21uc$t?3=SIkre9f|1yn>$@(
zU%37}TqKv~v;FrE({;M8asEehB@!c*PfR)WD>89i$iGaX=8Z3Pi?1+vuCQEu)&Btp
z+sDOCa};K>{mea^v_e{7l1d?Wm3NJ<LGD76$IlJ3oo<`OxbHAH8@1T`ouTx#kf4gW
zcedIF+w~OeTej#<toK>QmMT5huwGq-{nodaRau?4%~-mP{f+C{qxui7w|+bwXnN!6
z;_%O*V(aak-yVA<-N7+c=lG^i23fM1;@PEIvDT}DWXomsPJb$H-k#%GP?)>?`NB7C
zUYr)$MWJqKujZ-*?R;oC^H=gF#o0&RiONjv`tVE7ZqpmDDf(gu>>V|jwmey2bs#&<
zDqx+kXjaVmj@hS^l9jEVzud&~?x2+aRqhuoOz-$t)y`qi`u}S~sMXgEkMk-Hc3*Mc
zcV)u%5>21zpIT-2Z^<l64=MLox{(^$@|shkjknC{q*I|~Jg1rFr|5Y<-;_*yYH{}a
zUpCF%Cpzb=O75B4xuDp>p?&(|#bT<{_Qj~5N`7b1Cdzv)u~BlR`sG9^HO>Cib|=9!
z>vxkUpH0nAeAm8biKu4y>j!tFHpXA*Jsp0-Zuc{zliQ_dNk+Kd)M`D`f34^D8}}VE
zj(-fdHrRRS8`I@7rp~vALKR-ycUBb&rO!XGdv1IA99``POtF`fSh==-+54<8=vHX9
z#ZuQ+e_in#jT@(l-3y)O&Z5}&!7g?Frq4ZlSU$|o+qtUfz^dX0nLqUBH*HD|^vD%m
zAnC#)SJnCbu+SkvKZ`4#C)xV0%{(}(KR7(rxVbSZ^wpznArsGQZauxm!Cg0of7erK
ziIA=A-#3T}oM>JWqrGf{>c!)}(P7LJ&+cDzWgm;2XxY9dP0o$NkyAc2r%3Xg=~^uN
z>fj-_GwLk*Yubc)iyZ1Q??3Rl;MfwW{qIWfI`^<+S5y|3np}CEyQqglD4De|=u6bU
zKAH8WoVP_Uv;X}p>p<X(mSxg8sVeslsqifpbr9i_tm53ydbB}MLuTXjUG5w_Gu-W7
zUXXbDwRXbRRJ}>(_inS=l&PQ?6zrWAc==_m1oMW;9DFOk7hPbwZeGdv$g+dC$LI3V
z*Q@3CHgcX?aWuze;&ZXb4Z^Ie7W(YikymtwS61*0XF<^UbLyTRYmY>5&pjQlZ$EE-
zJgfS0dB)Y*rsq2r^Kdd8m*?a9yX)!XfSkq+g{A91SiDMKZtt<?F2goC=674Gat^Fv
zHr+F|%$FtFv}eZJEcMLk45jPOl&vj&`gle5)SBEUwu;BZLOmX3eaT#5ZhF+*YUY_M
zr%q;VT(T(3m*eh}O$F)x7cR5kZJB8j5UQeb<8?dR;>?r>Dv2sDK5Won72Bw?*LJ$D
z(PqIJU3=SS@|#b|Z%CCn$u|2{+8_Ow_f8#Hx!B;a*XNKm3qGCNAEg^yH#gzrwL*d1
z+8hI)*DD2%&rC?&d(Peb-Rd*TZ%z+sZs3UGfBAuNtwc?xs&|zCl>~=(9^bX3X0Lm6
zV9Rlq^=9YJR#naQdbw5Jpy~4Z^Jn#@OIJoUb4rVTxxLlyR+P`WKi6+QJ0_^GEYU2w
z)z~hJ&BuSml<o6NmGm86iR(CjHmhpRdb;u7C5;Wi6{gE{Z<`;;WS$!;6?O2+o>T32
z?w#7DyKk9x-?=bRlU1koT%Nr5Ma8v+J5M;@-TicP`AJ!}#?`5}OP5x%{?DB%;(Nb&
z#s*{E>z|Z(zg~Qpxb4x0t_fGaTg?u99{%RyzI9(8uZ+C1`qiUD4}Y3WR%O{T^>Aik
zV^8`qquR@|D(^RM-_!H#fp20WgA(go-?h&RPHEM;udBHmoxr%_im!u$l-wk?{-2+A
zz2{Vp{+YeFsP~3FU$;{774Nb&&aG~j)0bwPD!lZ=M!LME;Z%^sO~nw84JKQ?DmLAC
z(D?NMzkXERE4`fb-BRcBvYD8x%4e>a)EoO~W7|^Cvfno(9v{hFx!q0FM&yWT+Aj@_
zADaTArkF@&SU4|CWP4`+KHhG_@5Ag1P72mke*G}_qQ=rsTQm-LZ<z8*nInb2jN$%-
zIgSP^M6Vxk+i7i_zR4=#=WGLKOD|9H)C~+}k>2O88{ND6wBeo3j++eMocYdt`1dLQ
z_$CdJX`C%r#b+1In|(5$$2lPWY@)!4)4x@!zn`AaegD8t%MQL}m3gg&O`UTzj|8fT
zX%rq;mU+H8eg|8a1IMI8S)Wewm<s+?xRJ%$KjUjd;F(&3^WriK75+>~W@=c_o;2ga
zERmeW0!=yM5%JE7Yg{>Y{&#S_`O4B?V)c#977lDrT7NtC>H8^Z>|401WbvYP8b^|6
zKMb@!Q1C_SWyf2S>Dyjk`mS{N-EX^DuY}fb5xG1w$iYoGE%+MalBe~2=lNpZJr6p$
ztWHO~d*OBW#k2SAKeBV}$E7v17!TaF@8NqVzo%_q!P=T%zt`2gijti2m1|BVS7M|7
z);6|PzcWuPJHXYiyvul2|H2*GnIA$Fel_V<{<V8_i}`trSi=2{%9CPMPCew^HoH<;
zyy~|O)69ia1k2Kcew^InKYvEM7|Rj{A2H6>hV@e)%s!u|rkVeqC9>4#MN^aS!K1GP
z&oHWOiB4mksAi;itNoJGEANIH`Hl8Di}kK+JY_anQumc7;@N^MgTvk@#J+8sI^*R!
zfhAGF>%*JhXoN=oK9zQ(uKT9X<xL*9I<l@$<73;PZ+QRq7r(SuZlSx~Lk>6nFg~9j
zD83@K<l?4;<??;!>+C9(`%^D4aGWwY$0-nM-W$v^;fDmXM*P9H<!j!}HWJ^kz;s(?
z=&6wVp{F@bc72^<XtL1c&Y!mC1zw$eht(H;TWjpJRZJo_@`vexu7K^SG7bMX@s&wr
z9Nif<Bj?WxgEjZVKWsPk>E%DWd7`YRDF^r2Z#%LSZd@^lZI@Qu$?7kxD_z9aQO(%0
zllkGX3+?TOr<b2P?P@$DJ<K&)+BrpdRry2Zn;A{*nzv#Zdfa5<FI_k+6QbwR)NB60
zKls&dwWErWze;CJJ#}|k9A}E%yiY4a)<$y#oN@kOxVqEbWMkE(qNtZy4!ggtH^0&;
zwCtkR(P=CDXUI>vIc-+W`kI32?H{u`gR{5G#ISzg7rwE$&S8od=R=k~6GK<Zi>_QS
zCscTKh~0~GyH%!D*12##zK|iO_9dh5+*fb=(x7(1kY}MczW;Ivy&-W))y-qlv2=&D
ztbL++`b*57pNgIp{G8R{U<vCam1Vrwg?m=!GwPUKS2y0^pTc@=hoZF;qd-BAowfd?
z$VGBJtXyj=6U%ImREp|1zI5OYpX)bIpM8_x=1Cl?mo<IbI;15h9DDL3N|;&7r*-b>
z!>gsH^5pTSW^&XE8ci|}IJi>T@b)yP1Oo?-nM^xsUvBo!D|l)*d-~I$9zMP_hYwd-
zLeDcUJ#?~vay-9~BE!_?@c$pDAJ(7!^X%!x;pdEZtSOj$Ys$8;51F54uAF}Cf#^I=
z8>L%wD#a^L-&rM6xsu6n%@O8xlJ4i$+;cZJic?>_+4`&K>ghdKI3onKcAiL{Hp_!O
zW2e=LllKFs1Tww;yv055^0T(G)#2uQ;<<ygvu}Ni+FSRvr}c2P)Uqe`b01nP|LkTe
z^fYo?p7wuxaXUVidig7?SEpOaJ-wSQA6nAfqV(WLQg_sTt;iKzmJTOmmK5|dy=_?`
za7ALm>C2&|QU<#hT{<Xa_hQ~W+f6GIx0nU*ndaTL@J5U7f!QsOS$KJ?>K;G&e)-lD
z5u3Xj&B-Uq;xaC}b%u3`UTyrMT_DRmC*qUF%t<#HY&;}I=Ik@S5|R4FVZkB}w+Z{4
zY7<|{&RUUh%GXrO@BBr%`!aujFPyCQJmPHj9F~ibxvT~UqjsCE-1KQ(sO`L?M?#nq
zs&6QrG4on{Mc|~}qZ;3tR)5=mNLC%vyJn`nXtzjmb$r<GqtDNLjCEC>mT;bZKi|Q*
zGXnd5EaTq0R%)r?w);!DbFZfF-L|^@>ixLnn)(Yai}R<-`yP6~CjH{(${5eQ;0dBF
z$EQ5z`;{*rzp_pL6hoZ#N}<mj8LiJ5n^b;V^J-=vWcYJhC3@?<x=SlpP2F~N>XT(h
zv(mrk1Wo>TX(xlTTAkRftd9%DG#|;n(sy8bRU5#S6*_BXYP0*CH3#-hyDq(B#_M>|
z#FEuE&u+bEY2<nTiDipzi?C-)+yN{7ytA#Lt3Gfpi_&BLBJEXwIqIEQbj6p+Z+6tk
zl+RIE%NtNqbk)QC?dI~Y&73!L&kAatVKCC3!Df=K7A{z4{XA&)oA+mS?s#t%_`=}t
zp?w~lGuV`lY*}~oWaOmxt0&#On0Cp2&Xe-DE?a}c?r<-ceJR7ZZRI8p1La*u%VT{N
z&!`>#BArp0m1_6n+3o#%tbTpFzt47t>%{;?^C|k@r5{Nh7C2MLWgoPoGxz*cgOWAw
zb`Lpxm3HbC%B_86{&Iov{G=uQ-=_TS=LsxaSXdgk)5hp*ms_^zvcA-q`B~EwZYb|-
zTm0>FQkelG*CXvud<^1-HlO(S+cFsI^iKTn{HfC2Vx0n~&WVRUoM*Wv*?6wOsBL@V
zQ5&5(t$lXMm0mj(oipaf&Hg;&W3zW+V_=xY!|PwQ+i!bLxGM2HJ8_E7(NC3U^Uik4
zKUgVg%bWFcLeaMaE-T(ztnz)`x#{H!b;h!a1HNCLJ~+2fSYTmUahZ{6g2n5$V;-M9
zw&=Y+w)S(%hsW#EUiM#I`#iJ#r<}FO>l5<+$7%v3-!0PKl4!l>IG_EzlCLu&Tm`JT
zugs9vwBERU^MYeDC0m#8`~62}*NYg9n4JE1_iQIs#K@o2J9T>PZmU#*+-LIowN{qW
zj4ckwQ}QI1wWslZU)#dxWw1lB`BePBOMW%KuINt;U3!u8*U9s&k{a=D8{gfiSibb<
z&Ew_O0XL$ah&%}Xuh=3aaUd;0Z355Mg{*8#AACzWV7JcYrd!c`+4uY*zJ&)WBm<2k
znzwft-Rp_rc(w7Aan@?~W?f;Qx07$1%Lqh%pUnHj#yIV&-<(zKOsls?tL(lRGk0h3
zW3T$Koc9kySi;YE)~yP@^rX-3)FDo_{}(ndk9lw<bn&6BU%PFs5(=w6?U<z?;lJfK
z`ze=Wkslcz=j}*WF|s}|ll2ngyy@;<o}76)pF>NfCRJ(OiJRuQJMZkOOFAJZD=RlQ
zt7Qtrq!kpr6JPPwFZZJDTEFRQoLAjG5oG`BCuf@P-lm{MpKSMB`Wq>}Gw|NFMnUO>
zX-7|$y!I(9jXI)`uKq=dLE=v9&6oW0@%4YE3Q3l3y`2;Drtv=8#veaZ<L4<q6SQhL
zDP`NAuCc{Q{qRzb<f)on36Djhw?6GrC^=BeyUtRp`QglO(-`^BM5)ZUKK0uJ{|(=7
z$?cHSFt^|KbpI67o-h1m3>i}|<o@HG{W<4yykx-+?bdg#^V{@gg4DguGJa1fR_~QF
zOLt%T?hH4}zB9Mie$Qg?Ef4w6Fkd9`@)yVCgXh9^%>G=i3TuB>p(Uk%L8x0ix28_N
zWt(kk_j&ntAHnb|J1>ZTFL?XV^=!7l-}fhyt{y+!#p_i(HN|CV|5bx4k_9USR;~24
zm)s)BYb{rj^}TqT+|eWbHj8I9MDKM<KkHCGr)$Bi$5Z%%{e2HPSu$K+RTi;x?V+gs
zv-AsJUkdtdv~%&R1f!2@e=|6o@m?48?NY^p`SOdWUp}>Z$xP`FDIL06*Li;L{xDzt
z0FU&$zD<hzW;68Mn^n-J@9i<&XkU!gq+;_a?AduCrNJTQY-NJWFUAChzLni8`uj~T
z-@>}Z#g4Xly(wN5Qrtf$lsUb7)n?>iq?_KbQtDDxeeg25kcT|J#)3v&f808!aYdWX
ze6d$%tzUbVaN6bhS8kSFJ}mL`)+5a`%M)DsjGi$rwApKaM16T}(B|mPpPemt9X4i`
zkewU2a`~;Yh?~n!6$kTirN%#9{hvqSfvldvTK&(p2X!<bOu2gWli4}tH`7_CE#g|U
zCM^73g|B+-^=iJgQVTopDy&l5rQMt6&hanMyjr4G`BsRa_{(Dx4GttkeZ6*hu55gW
z+EW3R)yoqSc2`e%tk}CZ)Ka#t`)8iT?r*cV1yzZcT-(z+f5JSs1B|~Enf{(@+34Im
zDLeK-waBq#=F06;FWPn<{rd3i*M}Ju6_=+Z{Jxp(yKaV2&D@aNeyX3RnwtI9UR7Dd
zc)l>m$oDI|p04<dh+7}h=k3~dbH8Hz1&vp;45q5=G|FCUQ#D0gAVc@_8ohX@3)fx+
znS@VZ$*D@Ywo~)U+G{nYx!&pf4hsIbnXaC=k?q*jOvcsaY^D5VCs#aMu>aBTo675)
zrHnpZ+02&p<Xjeu<LRDQ6SEzTU$vyBzF3kw<Hq(~MY8@^8rubhkDX<^YjL#xwR@oN
z@9bYe{zAvZ%v;@Vzg{c3#WlHgrQg-ER3p)~*>hslANt(C7VIPZ`C3NNG)v*X2hz@7
zzo9o_`KmU(+S8R1vzNJkTJ_USn1wSd^rLU^IjfZ(%y-`xHXhK@_!!Uka_j8Rq7jc9
z7e#rb^4_YNe04ux#1@Wx>-p(Y66ZgZ@D^I{EE2l3LVDXjb=G+tQTtWbaj&WS%Xanl
ze2(3>)>U<1Tl{|d<`w$$O-pS*U#U97W`At<s#*MOGmkH^VR&q+?5i`^Y~9bcyYIe4
zf3Ed@w)b6oW=yZ+p`s^in_sv&dvCJ5^<hF;t^JJGt-+g4uB^IWG*xU-c!y%{Q*V!d
z;;4(;erMc}_`}4&5WvpBpp0j6TR~1@Nm_nUu3kZ9Z>VqnZ3CXYzrzLI9yAk^jxCoE
zSa7(@>~2@CW8>2eiX1#wmkH}`dgAF7{{MI2zmDYHN0&J#bX<A-__6!BhrbWM?SG-|
zA1KxH&UnhS=Q3Yq)_G5RXRxbBe^2p_z|^Hb%hDfydh~X8N8P={S?wQqdnZkJD9jZq
z_C-Qx)1k%Ut7Xk66gN)L%9NbWrek~JLQ<Bctx(qK;1g5XYPPLV6;9C!6l$Ha_;Z@r
z47WpCtec-ixGXy|<;7BgoWMnCP9YBEIp?36_3VvV%`{2H{zmgL6~?$JUcwzyP8o?`
zsp$3pbAqSr*=@b7t*g9ZHZi4d$k6<{?PllwN0vt~J=~h%8zd|Da$9<|$y!6bIc`n%
zW#6JU%PrcwHPq9S!Fa<bn|X(|;{Mh|sF=?eH;;ceef~4K3z>p}c7<zG)|UUSxfov=
zr!~Vc<Ur7axyx$)Y3wyWXtI2R<5>gst2>^Uc``LC&1ZC-(Ol2;>U_fg_LpmC3U7{{
zcWdj$D!2RBH{EIxsBKs}>BfVd$$YA>6ngr11W#q2Z`t;9;zIdrjk`S_3a$yb=@{T0
zvvpcUx7ml=(Mj9xec7iXYknnn+DVb-Yw2u9%--DOb-e!e`7@E0sAa{H`!4qczu$9#
z=ip6`kNf6pU-<F+fNAUEWnw3KSSPLK6`23^%iKSO`kWiHJ$rUu?bF;EI%(CSC6<@}
zdtZ*%+R@2!fA__lc~a&X2j)qLzX=TZzx?Z&3x7_nk-M#|T<<b<wn{krr(I1`?H*iw
z@obis;&D!1&!|{l{X2!CYCAHUHZGnlv$1JU?)1x_b~l%<T5MT7x%G0wl4bf+doog<
zTwBi>Et_ERwMO%)wHnX9cbYrysOMU}KKr^Zx9NYuRgY|6KcCWtdk>nbhB{wlD+`tJ
zODjM3a$k1CvAbUzT+SG*KAo<Wyzzy1zM8;dmHRPQEe=ObaJYO!|8+%-+n4JO*~;Nx
zjaE(P7G3I|*}@=IWB+gI4jwmKF*6VO-soSMjb+O>F>bpmv-v^kgMGJc*WZ5j`sB7-
z0v|6Psjg>4%{;Pl`sz7i3=ATH3=E3+GEZemMt+`NLFLn!|M|BqHvPA)XI+2L$?V#+
z$;+mHYnp!8d-j&u*SB!a`f^K2`bA3TwyhIY*Y3OWmHX5F`)4Lh@#rj?6l?Q<@BE8A
zp-vgT_QNyJ^R(Yfn=XDl{&;%efyqt%{?7BJT-15=lhOLrpM-<Q&)=Q9Husy_*=v<1
z@l)RXJooweo2-L3+2fXQa{nxsTYgjM*TzY|Pp@4YIZtoq^Rufqo!a?)W5&#-l_&qG
zczW;exwPcQtx4z8LWQPeN{K6flNONPC{m~Wv%hHS@0kiyem+&|Th?`o_0P(x>92LX
zo}JOZF;(VjY3OcMBlf>;Ig-nZf0n%xk1;**$>f3SL*2@q9?tK}Op}h=Jm%z3h?xI}
zqoQriD}MWc(@ymzThIM)uRrPj=85~s&qw-amn)a;)brYxGtWb>$z-N$@tkdsp7Pr6
zY*L?lOi{lw;F{0xgKO=dx7JvGcC7jtwKvylzo>r5W|@eXr9anZah!SfFZ$~i<Fqns
zahq#S`{#0tS^LJ$tLgt_vheBjwXCP(CWPKQ6Yo}dSIot(-I2SOchb$)igmM=s{Gt_
z)$;GpdFvgs)83rg`>U+*(cYg=pPc=Dx&J-iHi?=Qi!ZS8PhmHSRBz}Ok#l$4dDY~d
z_+9IHAMUi5M<w6Z@t@^h<-N3g)lK#r&Vh&S>jd3MY-&{a*4-4l#&Pzf%S+B&R${JX
zJbvQwf@ftF3bP)odv#svPv$pwE@W^zz;@krX1~Or_scTFD{fjv%Wu$pG3nnI>oW^}
zmrN_Z@N&*?MgHjg#~M4oCdf%{yjc~whI^p`ztNWmzi;TLXYR8(aGdvVmRWb*jPs8&
zB&XVZ`J?kG=l%ZQl~4SW_hoK*Z{vPeK=$Rz?^3>p7N-8r`?%u)yW8TDU()Wnw}P}S
zdM6c>U*A^EzO6mW_2eVQz1ixMRgO8$IoF%9f%jO^+8wDcd!{DjwI0++SX3x-=*S|K
zhIZ}>rvG9)+I~ue<ok*^L|&RI{%L0X(WUG{-<U2K%Y4yVzeCEEm;cw%dAoO8zvF(^
zzJNQ&W?J)Mi#nmHuMI1j9*EuWYMeUfY*PKXRVu&sI_--H@oI8lkBlvn-*aNp<;#!E
zPT81FcYfA$d}}S|;yZ$S7?wXUQj$3JnT@qSU3pqV<)W!lhPl6GUr6U4$qTQu%h&xm
zwR*~${5JMkR;f1fJa?-aT71mj3rU&nPCk~fjwiCPaQTu@Av2MWlZ!v(dm3|W<GGY7
zcJz*OltFlv+4BVMqj`->SO0h*<-*V{9<HcAXSQJRm$-8quC4FC`YGwJ`V{Sz({Aos
z8u|bJ6PX3e@}?NQd8;9CY{%1nwzd18`j~eMxJCXlV4cuc5K~uE`*fZwE9cv1Y&-tW
zP^(GtnP~T5hs~D>Zr8=QSM63S5m@l5vyI{YtWU2aMNht1_@|RiwN2E@<@W_0|6~^4
zpURvGto0@FUR@vJ44283-d<FHLHf~su`Ui5=d&FTbatP8QXP|+nDK;pdEt`VZ@AO7
zH~8&{(rh>$y)SKvUc>9IDQhieoSV8|FJfAnsD*lFQn=s;OW)_A2c7nRiS2!08FeHy
zWP)nUukA4r*#(b#delA~5UZQEwsD8>q4oDyrp_=5xp{EH*-J6X>;+cw><Rnbe`w#j
zyk(aDgpIdVVh_%*^JI3hDpFY1aMB_zc%7j0+<wNsnY-1!(q1waR|#}5Z`y6#@>=4<
zVatT_?~B8j8?7H)jg~iA_FL?u`~PU!_AgtEK6>~s7Sr2Uc<aBDl3>Mi5eXJmo3dM9
zILmXgF1l*Yj=DbM=&=bwaWD2iewPvZ{_NE=3a5mAocZuBWtj)#)qN9>d9gb>oBgvc
zHGR{$?P#JjXQzF6PS{Sq&9C;hOFe&H6Y!Y*`TiSn8`jUBGEec_zYhZS_Bp+ZyJuYz
z@Mv3-F!Q_F?j_%oF8382{wTjgw_x+7Wx7E<qK1!__;UPDdMB>>dvDW<H41NnRb!an
zDlrMz7cg0#S#nD8RnDymu^YE2I9n8Cyt}N`<-DEalZG~T`jR70ADWdVUgkAqnm2P3
z_q2sC#ZUfg+W2$kLV2k(ZRT#(H|B8^aErcdIC}0{bK>r^TZ=1;zW#jl>d&7ymwwk&
zK9Zdu7gxK_%650j1yf5`$wMYGi=*2VY<yNvs{3Tq-u87?+>(a)J%{FhWZd8r@lfEO
zw3(3B=dG5ebIc|jsA-g5UKhc`Qt5kGqe@)&-}6s@9vkvsnlS%K<*aDW(mkBZcoaU(
z3;W#oS#9m32?k!tg{dEovDu3rW|q*?lI%NB$0hqsSb9N&@$`ao9jWUA+;R+LzVRu`
z?h(0qaDC_H+uLmK@-A_>#Xqr0ZPu2=>`4I!o<5usXv9-%nHh9?PQu~Ww|rhY2-t63
z?zoyoZjT20Ub%FaX1?6r^S2f3-5_hC6g|;+h2mWGW0@NakL5FWJreQS)?l%7wOFQ1
z(znwu+1n22$NPnzSi_t!$9S)kPqY2m@Lexk#g294dC$>R*54cKzy4O`)?HWmmgR4`
z#klpjv-wSPiJce1*gF}jc4^dHc)Mixzklc09ClpHF?*&szt{81`7aHT7Ya8w_&#}W
zB*63`yko9R7$Xm7SoQf@(@P$UcC|NLUv1Rnu*y$8(2b?nUWh}i&Zzy~1F2;UpMx?O
z{~ThL-{yNM>Q`=<=)XC;-<Y<WDphd!btj}otX|PHH<Yov^+#WZfE4@t$qkXd&!moO
z^8evdRIgg(@#VmS`48KcwkJ&O+H|2|6<_4R)xQq@TzccygKIY;r-ayN+}dDz^T7;%
zWqZl2B97oV6+h3QjFzAmMYDf*2uJc>QfcrFJfxqwLbLz!)NTP8Mm;^}RlEz?Id11j
zF5H_I80ldCVSnJP-ESr}o18Mz=2M$&x#L_`*TSPq3MW6h?inJ|@Iqa`tUP{}RQjP4
za;@2kXQkO{BFZ*5Ty&e0{%mgEt$nO(vh`<O<ZWTg)Nw0)`G4B8D1$BE1GZdy_aUag
zebd$(67QJ4u88=t;#hFpI*T>2=bj6&Jl#^UgZ=o|Fx5<Pqlb&z!vlqut#(S)F${N!
ztl21kxyDW@X#*>hpO<SL+nK^CFH-cb-P?WHxJBH3{dvE>#O|k-7CjZbRt_75cf@e)
z{?Qn^Ex|CXiQmCy>+dXeo3#_OCx`uzEY^7ZSWLZ2iM4{Sb)JWK(i49f-Nr`(4@{Da
zTbn}9U2{=0etqd+((Jb%m}O2>+;McOetdu>A$IMCFInYH*Au63`*g6~|Et?Osqtlq
zMqTNLfTN5H9{VgdyCmSEA+1`s_vV6Cyw1j*1@FJu7QWxY`b1{_o_~MNS^unhx<GE$
zp0EBto*xdooZWlDH+{n5>&x@c_uY&AchfM-%Dh%-SLU|VHR{`#G9G(gJrldMWas?#
z>_vOR`g|{$Ov-6m#P(X}m4BIkpU+#}2ES!5tQM-dNfw>2ytM3B<%Wz!x&|Gwcf)ra
zWlf$qoz=}*;7h~m=&ic)dPn=if8YDpou>HeaPv7UkBAjjTedM@>iQP{)_&ro-k$!+
zHB$boPAh-Qc$XY?vPj2rhNb+XCwIj~I~JJgxf(>O&QSMyHCePQ{lnMkf8-YEv8|JN
z6VCHO&g%Tyhn3Bi2i*?bdiV7SgU`)~U(Gr1CNTI^xlB3s&#1-zUG+)H?rn{aZk(U~
zx5aAGyXnh6M|S!C)YrUGr)lN9`_uK=9=}+0l~o?I-r=>q`Oy8{1ktFd;&TbAle13V
zDs!LlB4=$($MhwMQQOX#>}hW2|E?>RdGDRHt}(xZ?D^_l?lT%(HoK_*Uz9odaE9>Y
z$$A?~6HM0|CDu5;6#TK9;kp%Lf8gP*){33g*Xz&lIiFsk8(^-zzB}ws(ca?AnQhm0
zPR&=$zI$rH3BiwRrCWEbpLe$T!OYqSo}<zaz0BVV%n9UX<5#RGeDn9CGLuSypu~<9
z3tStmUwB>lc4z-rp$#4}Nj&B~$;+*6|6FL>`r+RB^z0ckrJnnp`SP#vVUG6d&X0*-
zzAM--%bO~_qjJV#cb*H*`{%!#oW3(rd+YOCCtuj+&FYt1Sl^KQP0UGue&8mr78zyR
zgvejnHnxo(i}=nhzV<WF*^B4bRqjF?wrexH8xpI_pFchQcOiE)>w`dtR4<9EzwZZg
zygDqGwWBah)9pw|M6hbYN3Oz}kP|f<51M<Y+fG@sywO2iYyxk}r%5$Ct>(*bysE?{
z<{-8>CG6}|&HCv#4)Nz1YCHP;v~)B*W72T>;A36BWqd!PepWhFz7Z+DV|e7P?GuBw
z3PQY_I2@N8IoQ!*!_f9(-Bx|yS$qeVM6$GSeH3MxUQshGEj93ve2UJ?AH3NjY^5vt
zT|`&yH{SBzc)x~4+I8+O6UA9FS7J4OZTl{y{ponbqJ6b*ayHjrs@92%a{GV!aDA4N
zgRSWDJ4+upJSlDBYP!YJ6qO*crEs6b`*-j5|5#nyEH3x;ON*K8shJ19T~Og|3p2?4
zp6ohd`n*XE9y6obXBpNi+Pq@74tI=MedE_#hSK^aC$>H`lPqzZ<nX|VN6=5l`&Z*m
zw)KH?1?PDvO!*L{|IR!*JvhjXYu8cF?8p<A*>gX>-?e99YmeSFxubJ)RhHLlgzA^S
zcDU-gD`BcbE?eK@Kf4O0=5uTHo178Q<dU4uKmC72^DkyL)_U1srByu*j>{gLc6+s&
zRs5>msRmWm^Tr46J@}M5$8*~Snfd2d{H>TN_SEeaV@}=%?~hU!Y66dLxn(!|=YeTH
zc01oFJvWwEGwJe~ogCRO-nu<fVL7|GBt5}A>lO2){F#lpZJ7f6R_7PVXN0e0;GQeo
zd|=O-KN2SU4OT9ao^)=b{(2?OLm3aumpb1S5VzIpx!18lzPWw2OK<Pn#n+ctA5TwD
zU%uX6w)WRI6@kq&H_Uw`-~N@~|M8n2{}aS)P2>aEUX;}QT6v9m@rPqYT5g4TbNQA!
zy}f>Q4`;b`kM;8%dqX~SXPGtCs%ZJ1(|7&$Kb*n3Zd#%J^yhM`EHx}sm1C9%UvE9!
zJ-NftTlnObgY~~SwV!Q!l6EKA==jlh1~<wA_x_#K7xwUIL58i4$)vZRZf<>*<a_5@
z<s+-c+g^8~m@1yy=vu}a@O*urUuZPbaAt>ih0LNSZTA{|R2Uv+Y|G24HppjOu#iV=
z&&h*pKj<=@iJ4`wrOH^g{^jEGzO$Q61FtrPMDJQx+>z%wEnz3)`$!*=vfndy&$W1?
z)F0M4KV?g>yPd&>=Axk1-3;kT8FGR@PA{BOJpW$p6B$Ql+ZoFWEmm{~wJCE1T`0Ss
z_`iCiD9i8ire}LUt3Tfn+b;d&%7pBg%B5c}H40f)huxT0d}+$ndH>#e{<UlU%3gHz
zo6W|!FL^ut3^v$E-{k*fF7xpF)J?OjcV%z=y*k?cl|uKWaQ+b163)fFoKaziPkiiT
zi)9skDrx+D(&B9==bn34(3HT(82n?+&ZUCOU*=9#bYe0u{CLdc*|ylj$t%w%oD1er
z%RPKzS5e^I_Zd%>r-hd2W`A+;-B5b-cFC90K$VvDOBP4nxZ!jst&scV?UtwCRwX<8
zoloIxtW@~QQ?Th%%md!meXCt1t}gvqSaO>2SlgnIc?nrkKO~&fxysCpFShRN-4ve6
zJ!7^0iErVo3p^EGunX8HHEK25P5l$#^8HSDZhVe4gS)5AHxDW9pK+1?OG=X$$S3D+
zzMf!F_-3(AcjC>^n@%BCtcNN~SyxW}=H|U$Bs{&P_IN7SUm2ZwHkV5E_Qn1!`uFke
z^2Pk>@#pOK?*CEp>D!mr&C5%^PT*Qy?*Hmd%h@IG&8)ecr*SV(d7YOS-E&y0TY2Ly
zjncmGGY95vH>{Y=&Ah`uAi{%%TSqN^W5F5LJEj|1yL3Nx8^6~7n4uF<eB=Dwjk|7U
ztA4o?Z@O;D|1}#X9u((cTsdd&Sr3<~I^Q(T7+rh(!)#8+(_gn1ypOwGKTG|h*sgr9
z|7>YjBl^C@9(VkGu>OP8mgS%F6@I7j2hCVe%@wM9b>qsl+O@jXZk%_|Ev%0Z_3c;P
z#1gjlREyL+xvrfyN;C2UuW8y<1RjlAub`&$n7#O1pisrCZyV?RsPsEpJAH%D^}C8u
z6MwxtZk|5B-(OGRfPAU6aBiiM*187UD?G*4rI)31U;fsb=6A8;(n;<nt6!>KTRIO;
zdZgbrJIu6n(Jz@_XLrv2P&CO`quV6z?fw}$iawFQIKyrvT0Tz6f4<&Y|66&vx|mf|
z?z{`zJQeEGLS_8R%FD{W$GzhE<?u2re+QR?;*`AN|E<O~QuA&Wm(P#>*t3@J&Ecir
zpMH7#uiN?gF^4Ipn~YAEh}Avp^q#ru&CS>ZyIYx(Tz%i>vRS?1vE6fTXQj^?H{XBJ
zOTHW_{dQ{!Q`gs1Hjg5H-Pb!5m@4#jtz>#O_iqoz)6$oiqy1R)r+8Jcz3;I;XV$&v
zqT20Qv(uuqr`<@|`1*9=q61B<v}8^n&2#4}jTTw-NOGRWQdS=QXFB^u7+x1QPx%$F
z@gaw?yf)tkzbXIHUi=IB`FLA|S99qW-OyU+7(v@Nb>9y>SohhK`Q6dq<@pS4^Y(47
zVQ;Md`S#PRCx`dG%m{f}x&QfsG=rxGT#Sn^RpkgwcKCdwwa>q2rtB=?s|OZM(oJ$M
z%zac{)y)+Bq+~MhQ=P^AsZwDQVk;_w)HN?fmB=5ISsv<|X|(mBS$gg1j4KfwD_?!8
zI&;D6>eTOTN1_Y1M5(U5xGp$oz0tn^7C%cWtNsa|5f(Fv-gU+Ff7UtaEsVW8uc#<b
zz7V-6>=*x!b=g+(N6WOQF6huuEq1xO*I7K^<xRKSyEAWvyz|+py0h?^#oWN?sS6)l
z=gPi&pSADZ*46Wzc>Sl^O4pa}e^|>fvG>}eFQVd%F*DZ}26unBvY^RLkpG^;o=d+Q
z#JOxHJUwt^g{<{Ym(A(FZ5TH$x?8;KeoDg1-4p9p2X^h_;D5iZXyfjwdyeQvCYp15
zDG2V{ApiVhYS_B9_tzV|sO#p+37nd9s3}R{MaSK{-$ni^ByL}suq?|c+xz9S6^Fx?
zyGpgs+i1SUx*&2^<LA2n=Y*}#Pi{9*ewbS2d2-cs-WI*Sb#*V*gTL?I#?$Av^WpZ(
zJ12k3_grYt7|m|zm3{kTN2Os*EyMI=vr~2&cXzS8U<>&=*UA0w*}s?n@i5nY*dc%0
zeop@e4gq%8PQliDekBvUR<U&5`Et+3>%`-89=0#}6d6{l&3u&}UMkJF(s9=*-rLLk
zchB%E?|s5MFH-dUiF=*iPi)vP9Coy?Tfb<Img!lJ3wb~8NJTtanL0lxbM1v`2h8jf
zF4}k&*S(#dYA1Hx?vV84&usG(ZgG3?zFObebU;I2*<S9(PN}Q=lA6`Z{od_Au{xOR
zTIYJJnagI}I(&FZ*u1ciM9%CNn=Vh%eVM&+lZn@hbq1$OUGM8URL0%0Udy=Cx_qn2
zhnCLwX@VEx-<g&EnDuneg55?heRw!?TBanbXhi8~u=+N&oRCUujI8SV^Xm1fw5yD5
z^}Ty<?^r3fSzvGW|0`Qxuzl#4x@Web?aP*lp|_53t!J6HEot>}?}f8J1@&ca=J<8f
z>Sxv0mn+V>MBnsgxybfydtP4tuHt2l8kJAi$npg<ZggO{WtSjqc=hB=i*<9ZaGr9?
zT-PsIck|)S-;4LMrW`#xZx#EZ-TlEv2f9{VbUwFfUyWCML9%3=_htLKyK5wqCAY3#
z>TR}mZppf{9nsORX5U(uow_G8Px_R><s4Nn+f?I^?O7cCR`=hkWm(Lsb2@b0zejng
z^+E2x*RIR=-J9>R=2lJaT=&lVhkftYo8FRowR!P+r9~?*=J(H-{^H|u^{dCL-<NAE
zKK{>yI#k`n>8@iV!oXnX!@wYmXQ;Zc1hnDI=5^8S9asPV6_NPKzH+0BdgSf571!pf
z^=*C~sos~JTW-Csoq6JdGyWo)lNaQyJ<k7SuiN}J&mTB7sc2~DUdpwc9HG?M%sl6J
z>n+vm^Y8z++SkE6O)RHIZqt<GfoDD?e=75Awl=GKy!X~k)#W#f<{sZ{?RRfa)!(}k
z|9&&iykq!jqG+U-)3zkfZ7~N@4oSwEsQr2TKk?k`>juxymOrt1s?*s1)9AEj|K^f(
z^;4T!KmJ|uB=ua){3F~I$2fg2_jD^BJ$Ej_pyK>A9o8>RrkzPYCWxz?Dmuj2sqMFD
zj@}LDY3FSvc5Pmq=)?TiF#T6>*bD!fy*-yD7qZUOFxjK2JLA}bxQ}lP6TDqgQ||mZ
z@gr7DEGuck(m<QXk<(thT>j`B%eyPZR~}3#6f3Y5I9KVH?&G{_+oJjNZ9mPayHIX@
zVA|)IF){uBZRVfcYVE8n^+6}T-28{5UBF=*+k}ZJo6p%UsSxsiI6>Lyqgws%nrHL>
zRh0d@{ByZ{UpYrimeT~?X@yNCtN2{*8L)3Gx$5#y*&ue#rq3p)q8>l8@n&s*nY=Q8
zrn2+il`}%M>wCJHG-4GuY!=?s@#FiQ`G)WGKUcU~etvA?acY9-J0<Rq-SWp2*jUfI
zv%H(axqAN(?Hl4Bns*qhJhngR8FPenf8+Y?pG3+$Bd3^nUOO<aJtgu}(~8y;vWuJQ
zA5VD`@B8Po|Mkh+#l`>ir{~|F|MzKCyxz9|;Xi8XetOo2P8Q8kvk3BFc&d`P<-vw?
z`Z-qpfhA5Bb0g;*ldRm4Y$+V1^iZJHlG8YB3EzdupC0hJde{bVHw0V|nYOT7)u*as
zr$q6Ky>(Cbsu|dJUj8(3&E`oqDXBt279M-w|J`)r`_;sE_dg&0tIfxB{@c@(zrJtN
z_t#(2FXRa5u9~-R<IxbaznaesKA+9L5dXC|YuPL=>79?*D?Bt8YD=k?aP7WY(zS`@
zh0CKR2K9ymOuCIJuVkJ&v#NJKU(?y1J6*w`@KkJb{hp+mNA8r`q*r`?Rpzlzz5SEO
z$5WCSN2c7l<CSANn@R5p%a$42m;5>Rd%upKZ(Ht$=K%}F8Rh*PPxmwg?+6y)vua3p
z>K9sN)?Vc}L9$Y{v9(Lho8eQ{*&Pj<&lWi!ELyOBwc;DWB?}99=d^!4_8^)udPk>&
zL~uZMQ}1g1f+Gy7jX&RpYBBtJ_25dqmeiku6@9@gcp}8-y-MZ2AgWU$xL0tF-Me{n
zeLhW++_5^9amMO2DHEAVlZ8LsEo48h_VUV}b1O2>y{I|9WRGF~l_eFAJByFXZdxuO
z{9XNu^r~&YS?3!6*VEo%-+TGc-uR1qEZ9=N+VQn)l3K{LTU3h2E`#&moXs2(@+Fu1
zr(YNTFPow9s41n_W5UxDI**<-*=TclR&Kbg?Y86?yX)$oc~M0Nt6669Tb{d6CiUWA
zz~<@6>z*q(s_e>b6e!Q1wK%_g4fC0!bLKTOMjw-l-0-tN?cUM?hK!^Y6~fQEKbNQP
zpEtLT@!r)Qy?1g8Ud;Ltp4@(`?4g><LGC+^@lygt>~}4Tm15KiEc1~$yv(X#^9N@$
z-Sp!rT>CsHe|cc@_rQ)!J(ZZIy1<TCMVzY`JN65dh!<SwO*-_}i6iR|XW^Wv=dO|`
zmj7pXrB<yG<2>ubO1I^T{9I?`4sgmAS1h%#JX_hwb-I*qPU8DF&3sadXBj8!A9b=@
z*N~}yBKXIT6TeN;XE7*Dskd@0u6(e!D9T&Y<^jWJ9lpEkiUgILQeV242sU42T>8l7
z-^UX#wZw!SWiCn_m{b?>@8ZGJ4+<`n31sf8V3g@eD3R(9uU~Nc(2~l6?@F^6zQ0J=
z^DCJ>>)<Zoi}SzAWz1{pD^h;Gb_oMx7*nCr4mnAitp$~GJT2Rt_4#ZXjpi=D$$V)$
z^WH*Buev3x`}wXnt!wRcQNJfS%Sit_^CVdn5tCP<??3;zyN|uAy(Nudws`UVa_(s^
z%1zVUGMPUtbd;3HGuCLfoO5i=(l2WFZkN<rE7|@Mn8PvaoL5Ig-|Z~HBmaV@&3d*;
zW4caxdt9sNBjtdL+1DTVeQCdS;jx^}mdA%&=6Bq^v&V8@E+2#ayoU!f`0uT^oh96D
z7*Mxuu?%CbP{^J~%0aI_1ndoY*!bzz(pxMC<TXA>%n{0GVg8WtAuEBO^8-_wxP^P<
z%(9gGA0lq)&6~4C^ZjGy2M6U<{roPQ9+F*9|Fq}))c6Gp?`;e1Ep3-QC&utStK(LB
z)=&T2EFp{4e9wNCF56JuxJzI87gNKtCNC+$wzKTvmtMwyEEk#DZ8k&xvHOkPH683h
zcN%3mT8&vYO>nwnp8BWJu_ci8*`bQKh1^P)ML9VCEZe!hbz_puM-2z&^@lTS{usNI
zz3jcrmF+lZ?yJpnZi-fJomNokQj;y7Xn5wy>$$ojKKqRfO_?Sg5qQ2$L%M%YgI==V
z<R9kG_-;RDuv{x}Y<<4<r=@HSCUQJcZn1W8=hCw@OXjZ@j6Hl&GGAfW<s++9Jq*g2
zsx=Nwcb*%#GWzAct!#&b7Y4Q+7P~O#?sS2kjRC)_8MYPKKj>*>Hi+n2yfyl+*dMuq
z`HPA<UT24{UL&N@v#>HLW7?Z+(|)Dpg$Hvg4X^*4BIx|!i09jbvWp7!rs*6wlJvsz
zE$_Y0tgM{3Dk3ZnSu7NLXV}4L(UN%}hWU|))sE==#D>Xi8vmD`FxK_rXk5;tl+toI
zW0j$JkiwJD75*3W9|Sx~Q5Ev#uWos?%*B^$oluY0iPVn9<m{NIGLx^&I`QeGz~j{?
zpZ@lqu-E#`fdoDF3BHjBx|*K7<`UZVZr{mWO8-_Cd|Ul|-Lc(v_p4^iyK})+E=|DT
z&xu6G?MzEb_85HPik_Tg8qmEUH0#1*?<EtX`;YN-`X(l~+zY$W6gcbK-Ce2D2WKfx
zWV|x5M${_ph=NI5-4m1PEUMYNgtv07|5~zt`37&j&lO_JmD*3dKk&U~0js3@{PX8s
z5_t18cwg=kxG1&8<8+Jk<clIxy%|of;JTK;*>U6HjGK!NB*^SY<(amMN8*p?CI{8q
z*#i9Kh80Iv2p>o|wbb9%$T8%?Ox}#h1tksb?ShJ3^9?0C+=cf|+qqTf?G%L%6;a1H
zpJ{PENIx?9Y^h<o<}~N&(yB3vf>lp!CbbK8v#3TKn6$NQ@3~Wgkx5a)6WF4C<RX~d
z&+jp_)ix9J^Oo_5l62yG$RsfHvc*J|H&1&!w67(9GLe|r_~~Yf-N|*4?T6Ek7yQ)q
ztPbBPr5x>6&(hTxZ1}sykNN%E-Ix0dk|TbrUSCmov4U&YBpsoiB*vwOX5SM1IV-Vc
zVcpd-8}1C=g9g02pX7dOc+=~nwt3}@DaULzTxF%&8UKhj@Si$4S4vrD!O6bQHzPu&
z6cjoP&v!Fxw$$!$T6gKjo5IeQx)b;wa30KIj;UnmNn>#CTe3uHrBRXc0gc82|269?
zyglSzZ8^1O!3)U+FSwKgWEzE(gf_5#(Ar>8!|ISdA$sBMOhb34&|uw`ocTGYi*Gt_
zoou{Zu+G$EbB&&F)~>1U3b{>!mWg)?cRQ{<{k)gwP15b757d0NdwQiW=f2EV%H-P_
zq<$-8dBg4YrEe6YwkluvpVZLDV!e1t)`m6{eYTi{)vqiB3LSZu{=BwUt4_U-D>Gri
zW#9hf30oIt1?UGYpRm@l%y?t`^M7x5)_!IZytY;INv5p7$cpZF5006n^Q)Yhu=}FM
z!YiUmzcV<Zh2wT!k$jQz_GA;c)VdV==udyE^Frbaj4!=*biT;EE<(R0=g^_O8{7`v
zSmbeCYYDr|HHi~KePJ9sIX_KN<vc6+YVr1Ob+^L{fB)n7>dbEvdUM^kgRP+<-zH?;
zIaqnHi%+yWTCsHJ0<}MG(;5v8Dv|^4YdGt;ygiwHW!@R@RPK;8x3Eh-8_Lw2CM;{Z
zSeH1rYXU=i?9#`V4Zd_2y}CZ_&|c3MNm7@RTdK2XNbAm8V6dn4%ye;ct>DSOU!BWU
z?$s^XEtqfe@xJQva-A97D%_LR95TvZn)n@De>(Zvlj4saDW7LgOp9(j+`jM6{uzN!
z7i_<A(PPJXUD*|}(X+FJRiD>{z07f0a_OB}E+>1#V?~kvIfb9D+<CIuS;fY|c*@H^
zCo=mPUmLQzS9UjUiRIjovr<rRMtE%f<#5rKQ0uKP6D&_{yd`+D{aQre;*g^r|CcSy
zWV?DGLHCMwPjA(Nf~>VO87%joz4U-T@e#+8X^Cucn#v!<8>b!$^!E0u<w#yuX_oHm
zy@Fv+!KPzTcOOsvUd^}mR^95XuHXZ=4nFpiTIAQ2Yq51zgoeML!;j*|TCamnUzkr?
zznFMAQ*n~Pv07R2TON#Myf!)A#h2sjMc6qR4}?1{zIA(l|0!?o?YW&_!p*<k{lb3g
z>n^Lb!$RktHJn{}^Ge4d1Lf+Yxq>s+&V2n;;0?1`L<8^ihwB;irLsF>Dtq20mEO4O
zv0ci%W}#iDah&D;`kHG3l1JiiuR0-U`gOV0?_Y09+)wZ0KYd{$n?c<wqazjJ_e%1l
z8xtjj4Bl>h;$-9V#N=gJqRVm{^}8=yUUD5<D$g#((6o2zOrr%acS)_f#G~cMY@lRv
zWQLGz@Q=?7eRJIH8Z?8}1}cZRhX1+1!0|e?@eGF`YuJIL4;?lBeQZMg7FkW=%r-Sz
ze-fFaCW-pwtoDodh&tf8iYIe|?sd1Om@C0KGo6hWt}5eEuPL_9IeYYr;jRb=4Tsgv
z%if<9-e!1pd;5b4d+N%1-pq-4xh#tHG#68euiI>wo004Fqt@n3H4Vs)J{nsTYV^T6
zblap8T(f!(ToM2Byd_y}{<S-&51-k>>6N)IBgp9cG0FSN3G6YN?1d&eq5iC*3AVQ8
zP6-79DeOXPuH0#>C{p^@k@El2TL~vi7Hhp-#{>eN7TzkVP{@b~HAww@$uQtssqiM9
zIp+j#Pp#~l(~(qGP}%!N+lfDR+LS%Ds<)dToqk=ruPN|GX2+3L4K_)J4%5>@*PlMV
z-G1)R{c-hn)~*Z7rCQ$Y*eG{Pd-L?guk4u<%UqL}#yDSj{NZ)4aC$^i;Sa8V_qM%W
zcSBrZj$!$Sbv=^>u5R`4ePDLb@${yh`$BWe61pv3ajn()b9&jLK>w=6r>}kLS#QWJ
z(){O9<RWI(qGd_-y`R<AS!9I%mYBISOu@$YqGYq}l9FSezDXUmiR((vHpy5z<Akq+
zZyF=F_f5;J^NAVTx127XcI0?lSr6}Vxfi?IGD1vt@B|*)D3z^ynf0(7U$emj-xU+e
zoy8rRo1~q5IoGhoxw6MT5P$yO=fv(O={fUftyBE6?)M_o?kzo8Pj`JY`><8bMCN+$
z+1%bQug<rg2~jF;y>Ynp$4aXvk(89`MQ>hSi5F!oJI{UJ|E50ktb3wmH3{cUJ?18E
z?D?=-DD8`p^Qo2W3fvtJW^yq*tYk`mx-MApS;s!F<1Y>b^}NtnGe=8mE7LoZh+0Oz
ztVYFkAD-wO5}10Tsr}q$)k|+VjdmAW%{shZ{NVM{-Dz>5WeT~oW7eiD6*M}z`>ovN
zvz8C0-O<_dV9Ut`0xq}WrWP8^XQ&dBRy*t+xJCHtuYU2#n_qV>?LO16T~?!odC@N4
z*Ad0bVooxL9e=m%t)FtyvG<OyHj)$O1qNE&ZN91J*~1(%X&qm<b)=QAgY?r6uTq|x
zL{uw1RZaT-<Z;76L+OB=K(}q|UwWVHTk?6H>xP~!_1Euw3AxmMJM5BZ>6f@&>`Ufx
z-1q9+Sy{T9wV2bH<Nuw5D_1xzTzcHtQZ8dxY5C{%vi|lG?j{jiPJiunjXUE~YMk+H
z);_Db`7`VOw*B00#ip;}qWv-7r+mZ84NE^41t>FbWN=8xShD`nvx$#q2~PW6{{H>L
zdj<I~LJFkzeK;icbV957>CHti_eoXl>=F7<+ERAOdH=bKCyu_@GyCR>fV-<Nas9n1
zephk%VTB%n`BDt?O27Q8Ue>y6-cFW#x1U6be&Kx}Ev(tWvF%)BRYjGo%i+dX*>Bgz
zT?y)&dLmrs%I@~6sxJ@rPY_w*R&knVhcgpHQfJ-WcPpgXV;h`U-kBH4Z(FtY>g0}|
zeO6bTY8Or`PHYMNe$0B#qRBoEnOcipD5iKb>{;k&mGxad)H-O%y<J>7V$}=Ta<(_i
z3;gZv+7f7R-#Re6bk>C2vpdzz?k6-y-G8*oy1?J(`DXU-yC&UtxTC?CoA}|MXz``X
zGcz4thLpY9aoVOV`blWx?@2FCTTIsPIj~P5Q1|nEx8)Zu>KFbJ<eBlp+V0;g+q?}2
zB2Rt(n!YAEI{L1Zvd<a59825nlSAdVP58GfYya(ywMY5?cMIHJ=NVTnV#<0cf$4YO
ztTTqM!c6|PZ>vbi{<6{R)Jxw|?S%Ua9&Gd0yPUFiJJ&Vg;A4+?9}2qgZc-N#R@-!|
z@ol^Dv`sN3g-OeF#U}F<lzveC{ekbpUfYyg6W{z7$~~dve*DUlsxJ3`mwdLJ+%{2z
zO+TP#%BqQaMmK%ic3k_LpR|xcIZ8&We)oczEANI*T_tosV}kBtCGp7gvIDPFH)hF-
zzMrGBi6K};;QZtHHUjmNiX@rTJNhjTPg6)+a@@t+k(Yg=(LuARcH8%UU$}Cik@%~*
zB94#tJu<3Tc}(g2zPtw0=*J&}@^6J7T>Rr`_p0nWLQ@ytzIn)dPvFP-7c1jc*rUU0
za?70ZR$kk%fAxl20(V@hmovTja_z(Zs}pOB^?rD<9rL@et@ftN!~BqCbw8&%RZqQ8
z@p7fUQm4#I38OW)<X4_rZZ#);^JdkYw)CWl_r#s%TJJg}KlKDdeyUiA4m(%Hw6q^=
z{mCD--gdU%56xRr{zqPLR;(k_=Gh(*?o&H-d&+M-(cdpqdH-$g#keenXVtd<mnN;O
zSAKD9=W})?t@i!<{@Ko-{LcU936oV4x{D9bKBq5UIlunb!!MsMw||z`vCn>TQvKhP
zPoExzIj!i_s*Zc3H%lh^zf6$rja$x}jdSwe1?0XfSbbKu?(o^0K2h(Vtr2ufFLuu=
zc8|_|_d+`F+_HPs=IOj<1;zhaP=_5ar@PIpW@lg!B5?P5adKi#VnJdu=<fBU5wZD?
zkBQb^Uq9m(zlvbz>$@zK1`if+-z?<4y}SFEXVeZh!$oeFBA)OVI(vn6{rf)8`j6O3
zli9D1iabBJ_j%pi>ZiruE>C}5e?~4vXNu_N-Ae;@#&{;`-8|lNT-xxrK%CFHn=$F^
z%GYPlsohcW|LvQ@N87o-Z4rDE7_s(7&>NRUn?<Ha>Qz|HT+`zhDYCX}kAYIx3?Jj%
zqGMApS)N}Swr$eMihZ6>7K#06T0i+!W#|fv>sA}Ta^JOi+U~Q;^zk&?(5gcL>3;cZ
zUvB<grO$WuXH#_G{Mc?EjU7_*a<2O>dPko;qIuuU>9c!HrmFVDr6*kHTsPvlIBmUa
zt^MtF$!o)k?(Wzed;V^B<2=#!{AU5&VeyN%95SA${Y}K~@8{FLCjW1r{qyhL<+o2;
z9tK-#U-6S#8*@Zk)co!0btztwuUvizMo#rQV=iU+o<oi?i}5~}D$ntoDMmkE3;O-P
z-yF~u|1SUeeEYu@<<_#tEa%wQ?b-j+-ypI}bhDwqg{#4;Ex$gznp7$4zDF}UQ+TOr
z+MKT!s)O6>f82bxGxD~#%ZI3AKR2H}D{@}`>cgj3dQZvk`lOKi&&J`O(1x4*Ussw7
z$-ZCe6L98gkY1%;RO;hLZ@O&v``nRL`Cb0##FDHJrXO^-2Ffgav2ghp^O){C-%l~K
z@Ezny&Slw9kj2Nnx+!ImtUs5a;)c4*D*L8OZWK~mwT|8K!VItNoH-RgjJ5sKJ-_`e
zH(q)9jPeUv4JF6PmM5P&e%zvd>qWM*$fuq?-)8&q8|M|B6y865+40})6WwMB89aZs
zg^R(!{QCo0XX~Ih^Y$*glqR+PvX7F@+tXIX^-}V+Zj4L^G!9&>*?mpo?ALH+t3`Si
zzk?sY(NIu6aCud7hSAEEZ+A*-TsgQP+mXBQ&|2GxYV}WI3nFLPT3bt7mhRjgywk%Y
zHKOa$$;~1cBF}F4!FJ<k<5Jf>iQKu{k~|+C)?w;>`%^JxKi4vrd(UPm7MyG>T%O(d
zB6mjI#;G;hM&8F&KR(alH|2><cKCEsaZTVfiH<FcJhW!IPt14SG|NcDGUKG+8HvhT
zQ9;$1wcIUpj+{RBgfn*Giuy}lEV-^On)foJ`x`fX7F@Ky{@<S`TjzR99M*7}FR`{$
zBV*66K&ckCV8xr9_6wp~%&zZ9S@L$l=e!>izO?9mjZ-}IV^;DP?cAVw2GJ>p9Q-4<
ziqyJVeP?=f>a_K%upr&Y*3?rbB{TN6M0ULMoRa&)&%mhV$^_Px4!T-mImdgSbhD)1
z%vx-+;KS2=mV(2@&)8&z^Cg4Q51X;6?%UugvvkdMmdk3N!oNCS;61!mY}$jJw{D!S
zIee|~OhPt)`xm+I;;wx8txKo#2Z`pN&2>3+{8aHAP7w><-5aEGzTKQ#?snH(BRAyb
z_hw<|)!!XoPYX-p`K`hB_>{|x0KJ={C!{+LzO0>Be92(*CDwOw8|5v#7QFs(na!8Y
z&mpO!Y{rBs#@hr8^<(bYC`Tk_3h$nKe)*IW5#lE&H9eig`>}7A+1F!Bw_iT<H`|DR
zH)GDD@Z`6<1B=4Dr9)JFN|{3vF1o+b=U^<{_xVKLiCMwXmSI;{$E>Pnbarj4Sy+B(
zcFDvqB|#C~TSGIr*7v`dQ+p;-X~)@{j}F{f=kxEHI3uIU)&2uh_KFFp`-CLAzw+3o
zq<Y+9?_=4CMvU6-)i*WkHh0BU?w?Zj(4M15+;b~KOl92iGu9jLZQXh$<jvCsEXBnV
z`__Eqd7k|D<!auYy+*lDZ@<4%k+IpO>E5eJ+XNrDY7{ZYxAyLN@bmBK|9k%Oz1z<}
zPyd)|`?aIdIvXzBNmSW;S7Pzm9h)Ur<q90R8?a5wD>K{gv!nfkZwnvR^=^z!{}Q1h
zQ5S7qeaFtLr`B@GE;j>-Y45`?oD+-{(LUpSi^cgx-gV1~S5}>N{qRKh-rnS+nmfa|
z(xzRy^7QVe=hn|2zL>j2^x^OKZc$%USij|7ny0wDXZKo1QO(?EhgiksR^>i1Tau`E
z-tqGd)t(bVa+jwtWvecd(Y|6|!FXfQA4}KuZyi|Ac~|}l_40pev0VOe=)q5ksRyj1
z)+#?Qcj?~hzAa1iG3zbE0Q)x4qWi_OI>fJQ=kH<seXwHMmhJ`9Z<zDm3D=!!|6%#n
zGQZW)(_fcr72jSrQTAY~gJi;zIcMe0$*|8oTj%?sC0skxp}&Kn%r5%>p;AZ21>N_q
z{r^=e+3M#vHM_|B%<JFx-ZVNfU2g7-l&)$0|Grv%9cSE4{x`QD_O=Sv{Qmz%k@w7H
z-fP8rEc+WW+Wu(E-u)5ky*GKE_R_MM`lnycUd7*BXUbB4N{Kb|$}6U;>8Fj{y8i`U
zR-R+X<r4I1lHmJ)9pa)dybelSc+fE+c~@Q6#EoZO)u!;9iDzz3lnr;<TVgfMN$^P<
zzj;?_>4R@Rx29wiKWr=e?DASyv?jG}*QIIu7uubbuiLk;@Jq^acdoU1;$MW4w>vHr
zn%p9FcGFGSXw{n7SFfdBWLg(}J}I(xdST^$rH^U4oTtC1=1;qG@#>>8Q4^=l7h--s
z-LLUPde-MBLV`Zci{tIDiWGR}sc|YK9C{Ymb+uI9vi^^dzrjy^)XMwHO3CeMd<+b+
z`uOJzOF`$JZ<Wd{zHRnxcO9$QJH8ceNy5u7zpV<pyK38;jM~1nM_y`3O;b|rG<Ds;
zkQsUTW&Qo{3{Bf}pRQ2*=wTrzcds^~|4xi-?Th)Wa@{Jg`)kEi4=N=*YT!w}9=-A3
zzQ3zByYp4<5j|Kmb;959_4mI#Jiq@$%Fz>+lWmmjcBd=$U*9lO<xFgO!toSQk4+p-
zZZ>kNc><o34zSHvJ>$)EL*!HHgNdx-Ew(B?E_oc24Z9gw^%Hj7@@44LmZ&s;$1S#t
z^YhztP9IDQ=eW*V(qzfUdCgFqvv6^Tx*pTCxqfEHmi|<m@l)+`rOuAyDR$Fy9xFr%
zg-`Nycix`MT*~WVcI?BcL<953&$iFpZpC63F0<~DNBP033j2puosYfLc~UMZfA{e?
zaOL9<tG3^k+2*&(cCjgRzhgeA?0S}G*|J%WkFMNYaNTi->5Ox+C(kTWcHaB;#ld95
zON+v#Y|>A5{oZ6_a`V`mL$S<V=Fu}Zlp0QMWWT1{lzON#gU>QVSy&=d=bFc?Rt4Mg
zcau)$6fv?qNV<LGYlJ_;WwDeb|GK?WmhJiO?aLo`PiA&Kd3>djR-4t_KJi^alO}Iw
z+Ols-=>F*N!(VSQJ<;fBI#Q@}@{nu4i$gcFk}#u<c7nV>lvU@q6L*h^dRH>MkYkNA
z3Vp5q&EVF#T}%E8?|dM5+5Lh0GDG38>*xBrL=Jj?;60G1exGHFL(hjx-=wY>bj+Bu
zO7McXy7bJOjU_eVIZY>CiLtM8F4R1uS0VK?#X(Iebt-H1lZrnNYf2pMHU8mwY>{%D
z>BFspLUnG_J7$e-jwR0(wlS1?{pQ}xeZomU@%Bl{xm)L#EIFz?xptD*6)V=u%x?pC
zF<f&BG2>>7l6&f`b7!uBgXsMHC({F$b<W$%uw%io;)h*puhvd;P`uTc`XlXszG`>M
z)o3N5jswL%f)m1h#g=b=wKObYYuK5uGc(%5&nRzsKW*V&r^ppeZ~fv!*Ynq0vDkH>
zmC5C+nDxiiQ$KK(rOp(RHN9iwyo2$>uA?<kUm|3yi`-ne`U=l_xLF$c3k!YhdVYFE
zi=F?ayu1mEzNjS@GTzNHUZ}8?OV?y;RME6Rt~Bj;*}`)?`TeXj91=WhU7s7S{`P&Q
zQL|HQo5>Y9&bt{in}j6-?Ec?fe0NhVb9rp)yMw_>>%!LUoX?c|@ZB$l>XSm<X^XdL
z?TQN8IzejXg)$`$#ajW+VZqgmix$6pd1rUxDV>0ac1ri-Tiyj-lI$px)OvfZPse+q
z)Qt@eKl<#hX4x-pVw2n9(`?5vYl(*j*Zv3IAxjxw*)%SdV0f{0a~vz*Swlye;+p}l
z*8877qP*G0i$ibfjolARlIA-uY5HU^`=D<CUzMc4&AaBwJPr@opNO)V$IbY4rt@yf
zR~;VJkOxnL3oI_XPy2St;EIQ$q?Qol+khnjyO`RRZqVtx5w=w0o!~sBMXnZUniBe=
zbHjCdUaqmWy`i6Au=LLnD>kwC4=$1o69r^M9(Q$?Dol*XT5wx!<B>~Sg0}0PuFesE
zqWoWCO6N}F89pl}Ru-u5@vvJOa>6i9W%6E~oHK4~x$N5Bo?=>Tw2gIX7;BEAcE<Vn
zPP;d)6}dhmw4>_xs`;vJAMZu6uHJbiY)VIK&RP}S=`(%Se7et?r60FvN9;z9Go=E*
zUPSsv+zP(Q!QsyH>7e*4afwG0wEtJXyXP1YTOn|gQPJT4q&3a#&xFg*CW^k({M5-a
z!}r*O3-2VW+7G1b-CVQHOp<ACafbGR#uukGKC;LwZ9AzIpb*QEzci`C`@*vuPj_G8
zv`n>Xbo#vDMAMv9vkL(#MZzlD-QP0Hzlmg?{&wL<(_N0}ulAB&1^x<UPu5OY;T?Xa
z@rKJy=b48TQX>DJu2n6b^!z|Y%4Fq(kB@5z8a_*YcioS3X4{HKmm@tT5AZ7cUTJ;R
zczlu9eC1oJ^3sNlPTp6p>)9o~{c&<@3WMApd39~ZK<3(-g`v$=+yTAE(j4;c8Z5ax
zZG&6jv9e?yqcyJE^=zv474Vv7H;TD@l$VHSh+h|I%I05jx;mWYolQ#f<nHq4hc8e3
zG&5~Nn37{l>%&Qp*^|;|m`}bqwYj1Hc>3bm>I>3MJ3hY=;4z+hN{MH}ZJQ_4bWVO>
zU|qUNyC`#U@aFpG6B4EdwhFiJlg|)uJ*f9?Q=zNok(<ilOmkJ{%~+fuz-p|bdP}fZ
zup_f;;$+{x#;1-fGW|9Niw`bh$vYj~<8+m+Rk4Frp!<*5W6Qs@Pk)~Hxvs)i?q8AF
zFW$4#cWQ-O6gzq4R1><k9DDaP;%^vhkj5OQ!u3H7;=gv(%hmMQso5LnALaae?ANo~
zdb%Y-O^&|%b+lOKi%y@s)VAob#L1Ox^LiT88Ol^NZY3C)e*3Wgj5LGU(&N+L>-Duw
z{`j=D*z8~HxlIl;#8xz&ZeOwF)#v42IgP;!4*r-vYrW<E>a|=EH7oXQo47x|&D>$d
z#jm^yLH&EA<Q-}l{#U0cH?{Ec7*;Qcd@z}<m3!m*W8sUNd|J()C$P8(ME7!7MF)k}
zt%+)UKYzLR>!XVP&i0FzwS<V*6&y;iy>Rc`MNLNK7umlS&0=&~#g%==ra&c7Q)`FI
zr(1Of6SSha&M?N@eK&(w_Hp;;6!(prCmKB6I(PQs&3}`2cq}eEvto(-JNt=#Q<ux1
zUAk|N)0fJr3#D$`8y04rZjO4p=6l4n&pwkbbLpJ+(wgaU?)2?;|8pJY{F2qb^52B7
zIQX>j`qai(Z;W<UUq1FR>F4!xbLXF$nJ=HmEYG1f|NN}I7XKbCiQHfx#CGbbwd=1r
zpLOPMky7;t-ExjQa<h?G)^0wv)z8JNeXcMjEfDA1wo4<(RHt2g+1jomW+TxL?z--`
z_dn6%d&2U%`)YB^id)}{lD=$eaVy_-e}(l$Zof@Scdb~`=f7vF*Cxgi<4IbQSDI=&
z7J0E>l*n3ATBwn5Y1v)23011xJ*#r2Z88#@7L%&Clz~yX#v%NvxZcHEU5-cE8s{IM
zB$Dvh(X2tX-~JMVl1<T%PpRu!d@aLvI<0qj#*=a8uUw;tb;>%QkOwj!d;jiy_V}Tq
zv4W`Hf&Q|<KV4~Q&zZH4ar9^Tci-Cb_@Yr{c3aD$w5(vSLdRW37P&KvJ&)RSG%?-x
zowDxQEca;}g)HARWt_0(@7H87nIzxZVWPO~X`(>T`V@^da_c+u<jiKWWr%$Gu+<~R
zFsgIfmWf3o9aHz#^9B6;zbW0|-lJNndpj@c&7HgdY@vAB&joP{w8XdDZT}f;^!u6j
z$tW|fXs<o*MMGs?-Va@z8!A@&|J|FCiidY(<{sMGbyBmozN`7%)q+pcu4Vn5Su^8^
z`h<5eQCk<=`G#@noRD&|F|pKJ^0fHmVUvR<9DSOdo?$iCsnMZ{)$h)Eyh*#fCZZ^y
z*nINo#iyBbnT#jz3bW1KV`3%QbW`Ej*1{KR3w*N^PAgR~oL+TyO~Q@xlseuwZIa!y
zq%Y~*dNv`B^V8w)e=TP`k<r*VWA7Hn+-u+M!z3H#iVDwtk$vIVo^w+V_MKf_obdCk
zOwG|*I%|!uZ&@|}MgP|1i}k+I;i=E(vVJ!IeO6Sp=UA>pYJ};m+hO+}ecq9fpcnJF
zsbx!ej9P5ykBT23*`K$+&lLWzR<=d1Lgb^{wXFw_2+#iU;|@cO_XG2c?oCnaxvo4}
zo4zh4d*RG)k*Vt&Z=Q~vTfaGci>A2s-1)J)cirCdr!0d*>e}_$O>B*kx-F-5+8RIZ
z+@|<!mCM1#x~?BA?+$!vX4HOEu{zJTBIkyd&W4CtSLWv~o_A3B@@h7{>L-WW`PnNk
zGIh^r`7IIA7_#=RZpV%krlf6_hcf~<nC@R6DR}qdjbmpr;yzDpbLIBCJnh`);MhxU
zGT|&QlDQsE5<IqC>ekU|#&?ojlD6wEyxDYJTk?<F>ni@F8>KRN7oRJtPt&}1jalGO
z$g(^R;a?M(_9<{J`m%7Hy7kt*#jVwwzOJ=8R-AcA>WkT~qQ52LG0gw<!k@aC?_p0;
z-T2^H#g8Ld4R^B2LdqU#*BQJCe&4Uunz!3F=Q+1l*yYA;>eG8AT#C65b*|xiR?|J@
zQzVa8bN*J5wFgq$*0I|^i;l6{BPD)1x9GHnirx<go`{vN8x|~GWz2j}<fW{OZhBGU
zH<9kZ%r)^<triOwA6c|{X%vUu@mJGN%@D{tV#f7u8l$v9GSl<5%?x{43_1)QaxG1}
zrE9iwO)~dT4*eCiS8Nj_|0Vt_6PA78)@=}fG1tz_>Qp$3O6i5hW5@GkdW_gkFLF_R
zB#<Aa`>8!%VL_9D@kX&NM<(0v-LLcGXPJqORP6J`?bDx!r!PLa!h8Pe>USSFf2Ms{
z<sRm6v@!3$=3H5u=-|5#nK!X8-e`E2x@`KN<;!C2YkQ?rSZ~GH?`Jw<BYsuoXHmz~
z?Gw4uwnrwdsQbpD*7NMAs@1&TT}@L|xkE)$j1C;1VOU`k5HU5;zPRO-MfI-#7F%EZ
z{7^srdcy0t@@kg4Ui~ZU&0mQ>k#5h=ymoQk*;~G`EAw)KWgm%nguS1=l&jJs`qbm1
z`}eklpMT21`gVifJn^I9I-(Az4>Vu7u-@)Q*QKv>5-+={8uv2<e^pJ3JD?ZyCSsM0
z%xz<d>x>JcWhZQR3i!=wC$&MfxOMv`mW-Xdm|Jw~4;f6JCvAMX#d*@vyZhI?T>Wo<
zy8hb#ay47NUVrC(;fEFLt*0E9S#7q?wbPXeUj26IgUp=0dF?m9e4FZ>G?jN!qDZJg
zl4_fn>?)-&=|7RXkHx>JJrL*dH1Xn={p-7}mu0*-smOiyl-8N!UpC+A<Omf^lC*ku
z^wol&5uy8U9NZeUad~g}wr^Koo_zT9=*J&Ro^r0M{rviDO3A#fy-T!`ELL4G%&?1p
zTdMUVak^7tM||0Vz_tHvbiVc&@7!aPJzK7JMht)d`u69GZ=ZgBIgH`P(zAJydsNQl
z{faPFkM84~)g{U<5`IZaauWj|=S0r~pO+Xo-VaZUtj^{7_}3n_gSyZ?$yS<~f#DDj
z1A{i6MXf1`C5igZzKPkXKAFWO#d;+bC3C}kix)Wv?0p_yGE?S+>eS*qojyHL*24$#
z-gY|4K3>D2mk_ja%KzGGi8lSfkbL9Mao=BGKWp)Q16Kt{;F(~#I>va%38^`|Pb+jM
z&Nn)7&8Ah9U$W*?j_iA5kH~2sU;KUgPEPE0!r?!<{Xfd~e--|ge_nXol{&%pS=(6o
z?;i`PSFPJ<XQPxl{Yd>yrOWf?%}ZDmo$N0!%(bIx&+f?&%L-43$4jZ|NnE~Z{O^F$
z{*MyE*~WJ(T-)q7*=BPn*E*d{u6yvl>8M&odf0|kgNh&9zGzzVe9-X@So7@Gy&N~0
z!XS4!wgpODOll9cc@3{zjlFyz_?6X@vzOHk3MShgu26V&J%s80;v>@&>XZI0V3xQc
zwkTrD5eJEP#l6=u*F6?=bggC${TawVzn!hbDoU#{bsFQI%4Hi4&pVgX9ib<B?NO5)
zOLwd0<#U&$EzchhI>h+SvAk!#$Tdf;w#0KTPd^-Fp2OL;R+6dTXxf@4*3;gXqppeB
zZj$v0FyC3$u<Mgdtlt@7v79Z_mQ7eb)6DJXCv{f4W*Ot0hQ-$PH5;>c9VxI?FSk{<
zOv(DMwC|l(&^?u#ayP%_{d7tzXUr0trK}k}_jdZ4n@N*rZ|yp4@b8FaOTWUygElEI
zz4;_>Zu@2R#Hw%h>sK<z&ls*Pln%>H=A8ES(1aeJZl2RS^$IS999i+XY$tEbW}~mR
z$-DhF@VQ<-qG48KQoGy4UHx@RpPy^1{`RTC6V|VOb*bn1iPU3BPom|Yv<j=*vrN8F
z6cJ@DblGCrQIqzXd8bytT5>qmU}fmWbC0WRY-B(4tV<Vi3H>XiA5z|EP?f#k=k$yU
z=STd$%U_-RnAU3JB&*1>Ry*Wks+{hjzmvX}?pn8SRs6*2hqmj!x!Lo-f4Q&dS<&6_
zjD1e;MWb9Zuivbhd;0p!n%5@JoqWXgw`Tdwu68;&>0xwhx=r7&whhPDa;>=do5S{B
zjKDvgg=v9*Pp$V~z32PX=k3lvdqN&Wc}#dPtAVeklACL<W!xQ4%MDX5e_V9%d1KAe
zAHhzVY+1)`nM(e;%Qb%5a_Pyo@a<`DI)n7Tpye@Zk2Tj0urn~oOE56#6Q9R?e8POe
z`79!`c(#W?-Szb|CIyRzJYDf=j=54|JFi%mgWuCmCxcCCy=>E*<MO@!*Y1Aa;OJzx
zh+R5uSM{$Sza-Y3FiVqsXt_G#o6n7DM@oIayZXMGV<M{hwJ$W~w2{}mh`pz0&kEVH
zPO|=o(JrNvc6CcG&MVxO|1Hq-e`bVd@aub#tn2nG$k&~J_vXFdl6(Ea37V(=<j=Zt
zt;9-o-rgOtx3~K_JjgYY@+@?nxADnMt~nFVyqh-vp}W{Q{~K-1YnR&o=99VDyFc#C
z$=<iDd~Z_LtXey@`1yV7i#2<{+?grc6mov|{_b~k4#a1OGAY#EYBUYo5yh;o7+w~%
z**PZIg2zvtJt|D+c|s~%)*;~wIiDvTJ9#eYNUXql-b37rIR9+xSso~;-v5z#>jbVn
z2l|q_C(PWxqcH#K=|gOFH%whJUmuy4_G@F=+yJihXvLr?`@rAQ0q-tO%Ac~_q51rW
zC0E&IAM{IFpLU;VQ@1wH+qNW`lZ{6O61UX)NvzM@*(+>iW!dpV+vwki=nwM8RXD=W
z^>2MU@neMCEzJe}?e2n;qB|D;IeFM#n3LoD-(8!+_bbJeI;V@R3s;gzlX)9p?CYiw
z?#AnqFRk||>22oJ&l;!setR&f*FO6=Pc^WH!Q;4e!y7w)PKU4~GtZQnRJyd-2TnRN
z=ZOr%{3pMa^j7vf|0Av;cJ|NirTYuS5({|qypm2Z9pul+<eM2J?3bx!Vf<_TkNL%?
z6q8TQ2#@SJHBqNN;pEm6%XNg`OmOq$d%<+=tg#GVK(}{WmRJ4ab?=m%DtNP%=k|Jj
zcxWzBs=|@DX-oJ9Nmk?fmmXb{uKAu!wb|6wl#%_g{RuC7hRaQX;wKxAam`&m#a5)D
z@$tzgKGqXwuU~QfAnT#Ue|9eR<upj(JS4)!-yl@$(bZ*^`EO-uxogtANv|e~Hr#QZ
zvvG>Uk4)7T-Yi~Go+k{S?3?!V=N2^1eKLVXbpg{og)>2}vrg?OToL)@z$Z4Q4uM%-
zbvzk!LM>B7{Ea)bx)xlXSklz6G{n*<M6S5ucw^tm3T9QNH|^@D<Ry-)PWZL5?=*W<
zxYFhb)r-2<7p+>rdD|$esa<iJyUX^7mKEpre7!T%ec|4wDZ(BrUkP<>5&iZ0=_SFR
z+BHe{Z?8+Q|LVe*Br|zOf@#Hj`&n+1w?p(lXuS-4;U0f|ow@zPb@EvUbvNpmR7<Cb
zdimDyo&2lpc(|})y2X~*${G*bw_CQK+<b3_x|QjMp4Uz3V)h5zLXRtXvsejiKK0Yc
z=R(AjbAj_ZID#CS#9}UNs@ry@`ftpIzBw)XOI9@*OkU#sQ(=p9`LfeLBChjhhI;B>
zUl#Xk{ub@8DIAhTXFHuY<b7bdWqw>NZ%a_f)mTTrJ3l{fW$zVR-MaC;zH`Q{ZOgwO
zElGTny)CZZPPFPx{`^xc*SUF19}7Na_$$6Dx;54HtM;cU(<8Y`^wLe8Lr#iqT6p7t
z;py2ut8Ou8T3SgneQ64D3b745Bq~s_-Z{3u;ZpE~CaZ6q!GV*$cCFEVd4GXs*B+72
ziHmq&J8qn$woUz%uSc@&I?jyDKU`PSGcvrdH@#1Js>*EARHfr4bkdHwzWR-D@{Y-&
zk8Ab>Z@iKh5ol<>@>=ZHFeg2Cg+m&w3TDCHUEik_MJf3u&)}c8VLhYT!MVG>uDBWO
zb;0z;=lWApJ)#*pUHi;mPTrEbOF43TJKGJjM?UjDth}EZ5**qX%u{a~>YH?dYs%qc
zt2>SwES|Mtm8H-rtEjg>_g-9Z{o<DF7QvR7SK7KSXaAmHbaRd7saa+}zr1x(71{Q_
z=c9W>!i-)~Z%v(?4=tHf{Y7{0KHB*{>YU^wJ(Zi)k9SPeRknT4WcK`A@9u(U`o6_K
zs%!hM^2#rexVvY*;U|^V-`&q-pWI_M^I*Y3?t45_QvTjpJo)0ZcQ0H0B(F?eR%ia=
z>%Gmp%Ir?^g+DKww^yk+HtXTHW`_l#zQHpX9$KCL%qNu_wfNrkSBn~i>n9cO_-yti
zN!G~g_Q~Fy8xz7q4_{Jn3*6}RiK&`t$;LePit3q3pN+p>%92WtzU%p^Nqe2`jL(mf
z=1<>MQGR)%-JVpPOvdmcofw`~zuVp=$+Vv?`!ANocu(njglUlTq(uT6&A!P@-LGWS
z)eSdp-#S?%V#|uF99PUbekVRy|7C5^-(Op|*Y}#(v6rN*eRfDWH26_@UxegBnLDN%
z5AriCPv3Xpwac+BfBEd$=X|r88qB=<l!P>w!h$uqnvWJADtI<0{_oP2ja)(+aVE=U
z-)wa`+UO&DSI+u@$l|9n<0cj@^;mQ35z9k%&ANb(`(mHZH%>`(@7`9)_EyBoHT}x;
zcVa6(htw{6X{M*^a$*0Sqibc>6ewLP{o@j3z3j`YKMH~SlU|%p-Zg*j8u{aUPhFh+
zk8frE^kqDC?EyzGp0bmEd|y<tvbP|S&3rmj?c}iUt5@e2&Qz<^T7Kc(w|_3K^6QU$
z_gvgOdAV$E`kRNEKR=!2;Gg<<7dLOUs8jIAniWc?zB`}GS^GlmK$utkXQuC}#~$>{
zuHMJ(Qd}-NXYIW83UiCB9(!I}5_11}^{QDx)>BQ78=ReRGO9m3WzVtx^gWKf_GODK
zE+0LS?Xs-o^oLc`K0E%G;F%l8c3xrX!dWxxm&qG)F3iwk?l=1BljN*2@yM~2%wKdh
z0zDo3cL=vc&Hayd;8_AgmqiyN149oB1A`t>je&r~k_^whw0v+|Ao#T3AqSDW-?j6!
zx}6riyUSb9=oLRxQXt&7HBfEaid;jrCI8=jVN6w0yXI?L{LZrYd~L~Gm-R|MPyEz=
ztN0u}9=9whS$Cq*?e7c9C3dFtE%bg@D`l2ZSlpERUPwm3Zr0of`w~->w(pRh(kRI-
zJNx54!P7e1Jp>k*v)PuNk_wn}W3^V$A5VjYM~<@3KWCj0QnKU2F}{DU&G$BK-X3=O
zWSsWvCmSwqa6fkO?Y)C;-{-rTU6RjR{nGlIfl5fOt8LBCoU2N$!A|n4XPhlOA}-?G
z6&&-Gw;^4UJNwlS=LsjPb*>xnn;V^NSmeB8ugi|!r@>!$%Es(}^No2$NdC%>Yti0;
zQ!RZXrxY?wz4t~|Bw)saX{Wn*&Lqq3kJdU9#aD2TZ>@>NzG&m4d5eptrk7g%dL`|C
zV+WJ){(JW?-D#=OHe#F~sI_=`L`r$+?U<B(<=?8_FGvl3x<w~f<yVhMT&(KXzhxy)
zpE9}ohAcKM@3q{xw{YqDOIzy~u}zPj(4o^E*K*Y2A$QryN9L&AC<X=w1||@}z`&qE
zC|2X+GxIV_;^XxSDw)ylwu{%DvF<n{1H%s%1_mWmb29TvQi}?TQcF^c^pQ;Hope9z
zwt>j8_g_WYzbw+$Q2hFiZFk1xO{`%WCgRP3JxTK|Zl!oyPuu-v;y0=4O(z2%M|fRx
z6=$n|KEGt&eO4R0GyD6d>I9fuOjFHLzb^EW`A$S&PQe`CWp9|$j_sSU#*A;%%Tlv*
z%Wj(Lm~(u;A;GI^x7cXgx1$dNt^^*OfB(YLa?|&T3uU$BRkA%SGEI^fU(_g>Xy-QV
zLcMxiiq84gph`aZhtkaTdgARp-f}A4A>Pk7obleW;_u(?>3@#vJBB_Eb~<<FN|@G?
z^KMgjpHjG=yD?*KgytJ&>%ZHku8R4^_u|okHMw(E{uht@;hppN!`}N#uAH2qYPN2@
zd6n*Jvo$Gtb2@_MZ%<YIEZd#(W>0<5ntG?+ed5#NQzlQjll%A6mH_?~Eum7GBWsld
zcg*>au6^=-$@UX<iRLa!GfT32oEA>bKKW(Q+`_8|8a`;b2ZitbcI3t^AKuA~><ZcZ
zUCoUjW$tbGv(@=y){lKQY!51WB1?DYetY>o$jCy*@ZiH4Z6DT|pSO2-D4=*~Ve{iT
zWy^OyoFH^qG4*NBJ9UFc1wspqXU$D}ot3{!^`-CB^A!b&*NYFtNC*jvFJaDqXun9;
z!}*%U?j-b65!dlN^qe5e!0>Am-ei!RpIeZblUk%#Q2EyOZP8=1N&o+fM4adMigf*W
zMs0R<c%^<^^yD4KlF#3qcQ)^52#>ClP`O5scTlpmp8bWr$82wwKJI2<3|f+N-eP*7
zs$3_FRIgk8!ix-X6F!%>|NrsJV%7zf<?-^ZCYp;fT{g#V+Rvj_{OjxLhv%+w7fsO1
z-<)Ble`59A>Ff8^ZT<X8b?1!WPt%@dIywECc<f~n<5W+_=GMT6_5a%w3fFv=we;eW
zI(#~3W}2hm(v#Oryv2`vU%onNYT$kKi%fB%Djt)zB&dE`tNSr$(lNuiAJQKQ`i61;
ztlj0M<~r-xtJGEdTv^Zdgdcrt<dvp!;^a{=_e6^+zVT}pS*)?+c{xeVVXmjk=U2N+
zP8P1RiBrgZ^x{;N+;ZceIg|9J1^R4`*=JM#|JT=x_J6vA|5yBfa-7jJS~cAy{%C9H
z;dRvq<Ymshd~*1<$&yW8EH3A#Nw)3}cl1mBc<<%a{S9;Mmlk?#X7s#No++2IS!Vyf
zooV;Cd3=6u%3E;5@5NV#-+Ee;4Nf&{JABBfnk2UVa;VTc){2ltR=Z{fxZSApwQp0L
zt02DAigl7whtRCpJ9;kzjeOZHE}49>=a?dq^{YE|*6$x)+Z2xlG1;Wr-@g$3G0s^r
z^-8d6^_OKQnmiw-f4RR}V{$HEN6oy;3bW7rH8@ptQ`zO<{09Y!##|2Ri~m>EmzY_7
zx&OyTA&}`S*Z*Vzcg1fd4t|$flHNOLEqjtw@$r1Q^8W|RFCLt|c(Q!CWMyua=LM<K
zuaio9rd(~fJhNl#e?x{NH_ZLg*UHr^c=ucAo@41``*hH9@ma+QZmVCtI8eFkl-ie)
zP@VABxRMT|r2)To*UveZcB1NdU|i1Br#r6vHc(pd_DiB$Q(ODRB@z>ouZTLH$@YDu
zaQ<Zf7K?b@jS9TqH{ay?dS~|Qd8@A6zZ+C@)@^dzZlQBa*;zdHFn(l-e{j9T>g%y8
z?%#zb-m?xcNiMs1R_|oDkFE2ecTC&~>iQ3lM(n*fb*k1vdl|V?^4r<u>YFEuHvfN?
z&MeGn<ym{BpVdGu|3BB2RaMfelPg4nQi>+@nq0n}o>f|L#QQ-&zjW22har!W6U<i_
zP4-)-5)m*t;;x5McI;&xZ{v%e!pm7#v~qd9X3Ke;cu*{iRbva&tSPy#*PabCNmtmp
zk7*n8L(ScW?9MU&&HUECogVet{vrcU%e772Usl}@IJ`pU$?WSPhrSiBuibk+P)N=_
zJaWR_TVG|Q+?Oxj5+S;69{W!F^pF*TJ7i*~cAiuJQOT$mG-a|x*W{yI|6&4#ju?6_
zU&3(zrMTyfc#aq45{^Z(qQ#%M^H2VFZDzi6L_%4`_0+36hVCUB9zT73wNYckOpcCI
z(q7wE++AbpqB#9TNBE^>Nt53TCtUVsF_<v#`iELS<A?PHW@ZvUWCQfQ)fJRXy>wIA
zj^;#49A(>-=P~JQTcfy!wuaS)wtsE)`V665Vm<a&3~k=xU(fd~Xq|0%A+uZf<o*Sf
zjd98RwXYs>{PQ?@<KDf0m41zHjRHCnj(f~7dLDU6LphTzW?oH0{+WNg3)$9J75w^k
z_u|JFJ#Qw;etYoa#S`A&KZCZ`OuVb5Kizt9TYA;YmD}${@I-kmH%RZ8wBp0xIKRg)
z8&W)c*J}LoJ5}FcKI{GCOy~LQr(KAvU$KBuW^vYj9j>=L;tuU5XWCb*{z%?Z&i;g9
zowu5UMgDYg&G|p}e34pzT{wkDmEq^^)USIu8XHqn|E;bK-B1t}`s3=lSGDu`Kk#SW
zQmEgj8S5aU)-9E^hiB)fCDJc@*;{t^7^KW{fBE&~_4=cUn(lqf&t{y@l=*c>@%oAT
zLWj9_$~VYsE&a-I>RZ&Jbe<Q?6PWLAl{3E=QGLd%?kCF($K(YjfBtTkKc85%CED+q
zp6OQ`w!4eszDPv$n;w<CHB0f^1si^Wc02vX{fl3|z2~}Z5%bOK3?ZlPJ+0Vq_5LS*
z_xEn<?TaTjFAn6Di|e)eKIg{E*6Rt8%-f}(nR?hyb6xrV(XM-6<*t?N*Olz^<LkRG
z-}mS6;>}V~H=f<Ts@=}KVOhJ_oqfFv?y@@kynB=5u#?)R6Yu!8?2uPAc<H#%QTcj!
zzz3J3GF9%i?`FKan^-7tclzPE5Bti`d;45^qTF_M(_V{+m{vx{`)7Z@KO+5)`%d#c
z-}x@VLW~jxeT*UR(+=#qs%~;lb0_2Phx6zBs;{musVOW`YQ6QMFT7Ct;IiWF{*QiH
zF$6fwo&0yZ@@}IujJDT~HeR#T`1|?An>Sz1Xq|sv_0EiKj!d;fgFPc7!*}r~xfAYq
zg~wSs9kNw${m^(w`oq7Oi<)0;ZrQoK<=%le%KKzLY&VegSYO;Q&AmI7$GNXhbhgZk
z!qxF7Sh$`=+wBO>_xES`TD&wllz)P#o~kVSl2ywdc(%TO*qNmLBai=BMK^0v;j3j<
z)3mB*^3OQW{y$|k%Re^Hj=dd^6p}j@-7mk_vP!}<W0&+Lvqjm5yWRxz)$INhrI6=g
zzwD#?t>BmsvIUM)`5R;Y`7i!^_+q5<`qz!`c=q2ebda5}eoLafv+(cd``B0;%oKmA
zvwOU(IBhWh^2=%ZQ_t@W*{o47x^bq&xkY+2YgYcSvM^u0<iNbFgTEGL*tLAx>lOIW
z%}S<9Gk8IWh~8|guR>vy)BPv+2Tt3hA+tbVe(lG9OLanGzVBK3|168gwN(44FqYZR
z-LnoIs4rb{N<CYY<5gmN=IK=n93DHp-&b*^j7{jT*X5P78aKqtS~1lyr}@5Tt-mD1
z!dB)Z@O1LFkOQ3SJNPt>GR|8iBr$2uFJXK5e0%q5lQM@#`cX_Qd)GbNvU&-#SdJ>6
zO1!&+-D`$4NAYkq+aHt9DHKV&MLQmr%IGTP$ho;J_NxQix76CN3sf0CY$)oT^e8?0
zUQEjai`0W_lYD+IP-U3VEbxVidzqKSug!ceJT5xn>Pu?2F=qdC3{1Hwsxez@^3;5*
z7ZYRFy|<7$QTp{##0Ku<CfgnnMjtlQ_}nYp+y!S}U#pq$blopi{~h<s6*!{g)hA2n
zTLs@(@m68;&pPF(-Lo^aHY;A8tCFR2<r;_aY6dr@A0B^0n_kOIHd(Bsw7#b}c_rVH
z;2Tf38|d!6s2NsyRVd@-EU$=Jn{VmP;oN$lTqke!#e+SSOLbyGcP-9d95$<1`qI+<
zC(;k?Y>khavBoTB$({sz-$%D&4NY6G8%D3$usHof6aT*dI?Em$uFA3XWZbV>{(W9x
zQDbn#Y8i#ZDMva>`iiF)nI_FjQ(=jp_5HBITFaOG+J@TCHmEzUIl8WF?L<vu&$d1K
z|Fo9dt~WZVcH8PnuHnVB*iIMi8)oaaAHMRc+Km5E&7NINfyW+Zn)4qKy~OG5dh4-U
z$<)*ni#(++?PE=xq~<zhO$Pg-o;-_PNmnm9PRz(MY7)**KmFq%<B`OFR^Lv@ds-a1
z@21#u;)a2%se9!y!NUoiwJ#p_PvU9FoFulVg)^vw!)Sd~oKA9v<3^>BzRW`k&uTw~
zf0}f>%WK)S*^Uklq0<DCw;j3XP``Iog;TL}!d=&ZFB5bt7IbaD#(v7+%B|LYzV>f4
zlkQKtz4Y|;GQ-7>9@;XP>aN(w=33>PJT+5!i|mFkOzD9f{tAk-jXqmsr4}%L+M2Dp
z_27XpdEUanjdH2ktk<ul3cfPxySLPMjkTF&&(+575xP=hEBO-)H*>7Ku-Z*{hxP%Z
z=>lo%?Kd#-t>NJ2`z*vK+OUH+@|lqQ<w?JCzUddFU2!|Z)^fZ`=j4>VYmS9!+onWD
z*WXbt3$8hP_xknY)f&x<!lN2o-!EKR{rm2$)7>8?&SJ7sNMHD>z$hsE5;x1z`&%X3
zjv0JZbb1gKGK+t?t;g4nkE>+V*D~&%l)`q7@$afB#%CW1W!<f@y|b9HQY5hK>CFYd
z?oG{lk+ikv<*%)#Vy~~?kT7)my>xndp`MgaB%i{qn9bS|M;9^Ki6}4IWAV@DJ(qjj
zu8C<ynJ;%w`CPxx<l^=2&lg{;{5E&%m1y0Hc)QI^kHTE$?tQu1aqTf>t#3_}<zB9e
z<kF44xKXdaR&X72@;X`NPSzD{UnVnNvzj)kCR3+3tRnsVlOG!2)gxy~A8zkd2;lsD
z!#OBaZ`E_#&W{e7?uH*FZ_nDb_VkL{2quHa&9=e!%o>&or<{KhcF%Wyu=wZ1_VABf
zcb>`BU;KWfX^sNh=hY_com1QYSKn*&ad(qmp5bz7<#UJW=97;tbaRf`{AP2YT*mvx
z)~XtZUw<3hR;%XjxnN~@=)w~RoxD>vzaM5-TrKwu*?KSh*sl;xp42IqHQDA}yp&mX
zu4msv7tQT$+-=kPx2(>tm@NEQVdmN<$<%L>HeJ^GF5gQI{nNS0!?tX)@K61Ero+rR
zQ!BnN^DH<&cNrV&jSKf~vMKj`O68fi_{j3>`_(_~&i=BtKT2Ztxy?~$7pUFYy;`fc
z=~?Rq^;6{sm)_ktb(>_8*o-ru=M*_P=$0qd`R8$NC|IjAE%UJ2?Tu-BgxqhJ7jT5J
zEL!5-w_>#l`{Q>%_4*3`DK=S#?a;PPz9M{nL(`Gd#<sGGfnDrRjUrBb=Gt;)&EC0<
zCyWn$t)F<~@V+9?Q114q`CB=4n^v4!=*e|jn(I)2)t-`9{tMZflgb<lS{N%jX8x%w
zn7Z7sts>I*xQfi2oju3u4(`1pus7@UOTF5nv$k4WO}DJsCc-=2G0esB&gxmZ=bYzE
z|K*?Z!sK}d|J>87Iyd`B8%&T8K3((j+KNB7P6?Ubn3u6irT-~o!JaK4HlNyUHwAaH
zvk2Z$xZWlo5YGNmi*Kf#OKs`$k_NTxJ8ikjU*1-qf8x8{rb}{ygCAG3?&ji5hlSR*
z??1elFlSEOiI8huJqM4Jzk2a*-ql#<4?2rYURM5>nH&8eW}*c1!j<JkURC8`v%ml4
zTEiQ{Z+y$^|C!mnpLYecY}ER@L{aEo(0X65SNuyGuiRlO_MPL-Q@N=B-pp4_KPP|p
zG`+DZTSs-XZ_mGrMlrT$n^SC#rTCw3fAsd!oF7ZV7hOJ{%d^>HFIQ5LLSfj1bDDQm
zKQC(d`NaJGg_H`}M#&|KB0QIKzVZJ1^^9ePm~)%)f(vhsHVP}Mht7VPJhNl#Wy{=|
zQA=iB^?8-GDr9rznVk8P{;oOtepjW`e3oqI6J`%~u&w`c!!jZF+&3SY)j^Gkw-&A3
zx#}`+%qQipHK_+T<)>aeUbs3!f8NyF0Zg;l6W{I$KizoYL`9@f)|(mZ<?~kB)!f^&
zb8%A5ysTp}rIi;pGi)mVP#AUYz>fnHb{94Ln{apYkzfg%g5DznkDQMr9<2yVj(oN-
zV#dMdN6Rw4xaY(lS#xC1;>p2l+YUe8Atv44RVtLjpTj;et&aQnI>Q|duD7zk#H=dW
z(AC3Rxkb^d=I4XdXy5tyOJ056x-0Jf_YEu0onP%0Z?Z0hDKk!QdaU2xx4V!2-FAEt
z2X{|+#)f0Jd|sJn+7v7~vR!}Lp-jy!7yl(`$ej*&Aa-9vbIKb=`%R&DVw(cpYrYA&
zPN=Va+B^TmsVBQ;o~*AgJ2v5;yP1}j=C-FYj@tK+mV|uDxxME3m08>^q1&f?_L*Y+
zz|X`h^H$`8f1G#groVbu+jJqJI#*9~Y2fpf)Az_NnpFS$+-?<%os&iCm;Dl+yR)q5
z%ZaQ&jW=Ohfm7Zt;@cYYmwn}-Wub4=mvCL5wO`*(_j%{?m@nno`|s~F`t57cwBp1y
zZ^v@gXEEj%wjbCS+MHj0WtHRJTgKU2&oddlTKWB!*fWd0$JTUkT>tsRvheS|%^Gr?
zSGVa{$FADAVO{-dNw;tF4w!XC*nc`TF~udnp}Y7@cd5pc=L>pwJ=cm{<)s|6{!RYM
z^#xnDM(9dk<P$E4?C*cq+_bNM=P8}e_~lxr6VtyWo}Q)T=sCG!Zo;lJhn=sldS>PC
zniHJ+aQTW!dGn9lcz7#F;Ks#FJ;jcdH`f07@4%!HwCq|=@usgX{q?`ib{{K9G{3&=
zmZs8`^jn5W>pZt4r_Sn`y>0)ly}8C(YemHtZ;4J=V|({*>#>NO`g=~nOiAkNubguB
zoT@&hvubCBopGg`THy6$O*Rja6)mMVymz{Hgs1k)B>k8rHrcXEas6b!&PS(BCoMO~
zm}1u0)h7JwoNC;KrEGy$&S^>rlydND-?!MAr{C%J^4H5R%&HgX1al{tUVimlq3_(1
z-Pb0q{QACJYwo$0?QEJE_Gi22Fl7bYIgz>8JTUIV8na-(Y?iG@a^_~Q=xeyCA|Jat
zX8M#k%b;fyjV}9o{+U#z+mt-%M*obuv&yMe@m8sRo7e7FbnTz{_WJ8Ru~8o-?o0P_
zUQU_hD9a-*YQT0h%d;y((dYE)_M9o-`nZZ@pFGj>w!hHgx;W#=wWl}YOfm%L#Q2H-
zuyZ}dlbZeY_9}b#Pdl_W^K?}PzuJ*(y!_UQpKmUm$__q}eRgKbyj?Y)&TV`4GW>Py
z$AEjMdxb8rvYt};a_!`^b#5O&Yh*rH)_UZ8vyN$<nV-b<t<U}lmX&`@zG${_`KGkF
zhF8x={7&-pEvt?3KBe)uBrPO$#`{8b-`B_0&DO739G~+#eaqT4@~bs{R^Qk;`2y4b
zP}z(?w>O(i-pVX`{h8@%v-byMU*meggqDUVwV>+s@6%)dZAhOiSuWe+C^%*M`<SeP
zV`2*2wVxMheD5^SKe7MAEzUiP%`UBbterajX1K~{K3j8=MWn==NrwO0huTkyp6i7>
znWB@KJD>B^A1{*+T_R?mqj=%S=Sj{Ir{fHM?U=ZJ!3RDo#+usaZRP$J*AwJ-I&>w^
zk8u7u$?rqh<_Yg>u5z5+esjrnlh5jo=hFLhWc~J(eLIyp`)0y)tIn^lFZHfo_IZAL
z_>IiXiEEdiIPuRSZ&Az6<>zv1dlKr*CFY+y=yJ&Rk=XJ3z1LUT^zi8|uNIBBKQvXp
zwB~-A<oz|<%#K89{-0VFu|@3d#{RzCsoPc72^H;J@;QCp_9NwdpG<@noe1Xp|L6Pk
z{a>>G*2FyK_ndh@HRI;ouU}q2PPZ+Ln!LMm_LAjZzt37-pZNZY)zy_-_k8eKZtCf`
zKWn*7=5p7^b6K2zpSe1<N_XqI;){ASM1Q)jG|`?~bYgzMQk(8IC;XSnFRQry_IV)x
zT8Vw#VHt5rdGG&AEWLZLzx3H(=UVx{0u0`pIonr=?7DV$D*K!Ao1f#??wrPSEb{N$
z@4wf7W?_GHp!NB#>;IQ;Jtg%$Thl13)Bnvy@wst_i)@p>%s-L6M&M=Qy2UDC(<^^W
zUQwZFQ2r<0_i!@D=?nkA&kuTTAH?=3nKLHbUwFld4h{Xu0$O}^n(>q67hNxj*jBbq
zE@X||_ejk<!W$}us@3~yCgg-Lr8aHe)!4Ag^B`Z|<`rCfg_e2Wi?1=U_3XaxamQ5c
z?2ZSEPsg!rUZl0)t<;1?ov$mh^IpH5{%z4F&+z*j1L6+7F}<H*Zt(v6<^1c)&r+k`
zP5Y61PW4{a@#eU{skx<=9NFt8-IlETJ)KR0|HaaMhKs*D#&Ndw>^J|~;=ALwfyl3}
zqetu)sBM;+bV;``=GUcTrpE6ceY5iX%w1GiRpHfSV3MyUU>^Htx!$*_4A&>`FqvC3
zBUv?Y={AuHyLst{1h!0Bk#lTUTg@S+bKw=$#ZEt~RQDgWTwFZs!(5^8)lDLw879k3
zda1=;^tegz6%(%%x8uXutc>F42i?Us>i$TsTb=0lQYn3ANyolt>olexDGN_@c-Ip*
zjVooljNN9ILk-)r*nKJmt4hCjy>yBU)zVf<3%y?XL5$`3!jGa3udJqe#eQ#-e%(^G
zdR}QuHRpr4TIZMZULU{xx~e2+t=xvEM$dCH?KZGqDD<m!e|9Ewg6}hrZ85^0Z!^!&
znDdbRWNV!6<x7{|U%lRO^_G^z9GPQH>py+8$yIRgm!50>W!rPf4K~*e-%P(G(_^S9
z61w(g`U|1k;w#s-HGf&WPi|iPn|PV2?UxPfFR)Iz+4?P@{+7M8?5u#^ye(}l>>bU!
zwqJPD(8H4Ws72d2sV^ipb^FYNr5-EI{xRRI*?eDr_7;gK#r=HMv!}X-%Kv`&^s~d0
zh>nHX8%vfk3*4W1Rd$o;^ElVl*Zo8G?5<||&v|H~wehJd*LtUf&)+ihbIH85E7xhU
z#|bafo3~Tu1iPR6UA^+Xuh%%;Z`{-9#a(wg{mjLO+f!~I&o@mxzTW7genwn}wa=CB
z3q3-tvso10K0P`?d%eQGFK#iB^E{0$#dZet9XS8(+c(SS@oz+LA34<b_*r^I=jvMZ
zqMxBp4Hp!AH1_Zo;$aNCx>aDhxci~_1E;$V?t1ZQ)zcJBk2}3v^R_(DU#LI*mHW;#
z&bUbmNACZ9Tw><@|Iv))H)3X8`|MDb)O9^w;{7h}2K7DX{=B;vY|deLsp40y($fWx
zT$L6ZTfSW9q+MNEzJE2Ni2ItA*MEt<p2RjsJVZ@#)e`Hwkx9>%lrY%k$N2L|+<RMe
z^X_}o&kLs1|DD=!ODW;_r73gRXIrlOA8kLav_OQz_h87TQ~}}UpKCX#nI>&JrEi$A
zdac(sJJ~bK7V}+NR$D6GZ&7z=V`+Lqc%1y~BE#y#Gs?X*&DJU8N^ZP<D!hM=A@jG!
z%DYLYo729zuAQbWzASN<$mCeo;`N7>+`fJaeB5#RYstpdyH5u1pMJ6J!CRjHU-lM0
zD*GF{!td8L`PQEbR^it=v_jV1HGjLSb85QS)|<N``4i7tSTdDv-4K(gZnu^H>8@!Z
z-{P!N)8$t@5NBH#^N;JyMx_~*OK-}Z@hrA``G~)&T<%$sl3+_-^7WYvcd9d=p0U0E
zb^6sZ$$#>hg?fydc02NR+&`DG?d2^CM=jlj@k0LG4jZjYjBFM-u`R#mvm;kg-ul@M
zn@9GhHFLI!?`qL}S}pDBfAX8`mZJT+{>qCoZ+h-g5ourVx@w)^_v!Lx-d7iTsueIl
zG4noq{obSLmvSO?ccjNZ3pn*!>*4NHr!$jYt*BL#_<4(?>g?4Me2GsdUOBdU(r$zD
z-O|$09}?34X>UK9obUBZ^MCF2g0~Z%nfY@(+UzECIw;$*IGtI|rs|FxlkEE2e))0B
z&Xj(hADy>){k7aw)74XF#d2LYJvaZxdI$fC^{?2<4O>j}%G{H7E9N}dP$J#X_WGcG
z_y3O%E@tf6az|>?v|IVS0n6EP3XOj~&OUgp?C-)?o6?rZM15)ecGB`hZeH{KiVd^h
zFV4?=AEmwReAbs+{YiTdCjGXWcR^v-!|fZpv~H~A>*niH>RxvvvpDL8uv}PBoq50g
zr{;tcbB=jG+^}kMVd!HWHzvC!g2_3upKhO#pEl7}+^YP?*ShPHGkyrQz7}ZBF4ikO
z*=+mgnyEvYti`XJi<28JE^a+$*44Ata?h2u3@xQU`lsESDeSQP^V{B8XYFR5RP%o&
zdOh=)m(7ai<EhSPa-;H}l<id9{$a0-==?KE+K-RrZcdx&n;hf)qwet(KI>&~D(Ys7
z9PEAh?vJbbr(fONcQ?%Yb8NrY=DlwJm|9uI5)bh|Z?*gP^Y*6x)K>G*hsLWPCKj!K
zaC)hZLb0cd)O)5=jVtdM$4$=WD$|~&`sPlfHkY$k<*W1Vvl6u~M%_(RP>j4<c#r*=
ziff^TO~g~zT{{|*wiMV}dpT7p$N%vVp7l_X$HL*SSh<<yqh(f2>jE-&X-!*wsB6l<
z5AQ1ezj%`J|Lu$R#E{8%(gl7APWtm_@#N;m-`kb{e|WLx=eP2i+!{(d_1mZFxCP#e
z{BnC!#!7!Lt*rqvrRl3*6n*w%oYEB)vQDzd_i)DT_qhkP1bx3A;hrxq9pJUO@zIUa
zqGpSEO6ez_R~-H@MRtP9mPpR%1~v)t!=4kwZT+_to{O7f#CGa<##fiX!-qL1-JZ8C
zXI`?^D`(e6_3CGDesEt*nf>~3Y|uetj&z|tEyqJoo%ZFo%G{+M6RMx~PbK!@1cqGU
zfMA=Yu8)s~ip1Sw-oA@#aZZjvB=gtnuX^{&W^6pPSTo`X$BntNKR!)qx$r{4D1Q08
zbNBzn-dtPlug#~*y8DA&L7kz0rl5nYq_CN;Z0oD4n{&=6&p2MAaXqwU+1ivFJNnx;
z2<+ujlg|*^r5LU=Z?jMLk#n<(O{Gpr?5>#O{z0TBqwD5`<*uSpAum`Z?>2aficOz>
zMEdZJNaL4NTnuJEbve8<x$Dl%gEdMI*$;{o?^1AG<>>wMY$T7Loj^iLZIn;jsy9a6
zc1>H94I8Eh-T4u6=HsHTpH$@8Kh9)&_Mn!Rsbrn~iez2uvcSbJ7*07P9=epiMeRZF
zg-Xp=HVc-$xL)!4KLhIW03O!V#Fv5$430hw47v;q47sVr`FTmDnK>!?$kX~MsRgNd
zDXDqMm1&7NIZ27h*~Orvgk#<p-8K{Y|8BX%TmB{QMEoW#`|cQAx^B8jxc_7|<HFmo
zE#!Dzoy@Ykt_UuX?bYWmSzqX1w)=;(jzd6DOnmiKpWsdwvF@Yq^8Yh@;H>`s?Wn!n
zUM-_I&VMgVo`*)S;ktL`#`W1IyC3z>Q|s^dyYabdb8gq^)zfTi|9m;A{NuT#_3lS+
zOvOu&#(j{EyC!{)WBJSae|NY4YnmITtN$={^UB#<bYH!Ck#Y4(_O^&MyS8QjNIKYM
zx+gm_DzsF4Hpg8x%>~7qGcEo^>(@Vw)b>gKw=nn8npl%R^J6c5s41+SZ8m*ZbW+sX
z(^VgIo=e9atl8Ye{r~PJ?NfJb_T*mbt^6olQy=^M&YtMUe@-X8+&sC<HL|1Zl*?_A
ztEzSSVYfARGfEyjA{M##-V%eCrBS)OYpax>=XmU$XutpQ-|ABvGQS+MVZQb4x4FEL
zUbX+t@1?&ty<2r>pUIOBpXn<fv?b|G|8iwtjWVlUs(xkH>o2zZ=gMuoD}QPBhN7su
zOHwD+-;F8D4lp*fw7QhM?KUq*=hCLRvZC5$)8_pB^KJIg&-wc+|J{B0y?*}5hiqL5
z5^Bv8+mbI&o}#@{C23Xt-6g&i9RAnum7ewue!MvUwNd-SzP?RHqD>zEQlqAwHrXw<
z>S%|7dX|@EeB&?i(2IIv8y`H?QiwQow#T(4NF*a>>4JXa3HP-xY%dPj+wGwIV8g!H
zH71L1L}f-r&C`FqYfnOPz^pFzDyIFJ;oG>^uJF6Q`HAbqlZH#r#Y-3oe|w?*GxgeK
zVOa%N8_zdas&}3{St9(qBI$S26dBbS!JIqK=G1Q&t$bK^B8y?d7T>+ko^8Ax;nZ?H
z=wRFBo^W&5;P4e6;*vidd)rjOT%q>r)3NyqZ=Y-{_S})pV{(T*xhQG@ljZ3y@0H<2
zTZCtv-}_5bxh1T8;_}FgXRe!unZJ4W*nRr7fV+)1ezxAu2sM}7eydN5Z|woU*5i?(
z?=xAaENMO1l;K_M!_vV0XIhQ1^bNnsVhxUpF+Gdru5bU##Ch!c?6TEu)$)7$BNSCi
zclO!ztNpuhar(rE+^M3qPyfyNZhyS8_@ZUsy!fRrP9I3#sK5M;_J`9e-aptHAaq)Z
zecHqosqvnwiRq@o((@V*cYmwo`rNrCxhCH5?MYSPHO%L3X-{d)6xf)(Z|~aKG8Tbr
zn1mNS&78-xG-+D*iqp$=&T8#3oAgTd-|xuJg5hfK%~B^WeVdT@W{2l4M=!&FA0FgP
z6i*6X7M)qEka+v$pO38P4%sEhh)i-VjJkTYEVevJNcQVGmk-<0gLVpUixRuK>RZFF
zcCLMMgVh%bSTkHze<QlzXR~g=j;6}AQr6Q9r<0Bf`70f)S`er<_sieL%A-tPCslP_
z&nqrkk?~rfD)TCTiG1Ll<jY?pUcK4q{eDNdjN;Tv-iPXYZaKY~Hg&E>o<*d~*}r#s
zA18gSaI(~|OqJXGbB=9Ur0qhb?yyo>-<hqmiznEg5fY7Ez_&!{!kzE8wON)o?Bd;U
z-*w}LJGSrU@3?dOg1(>z>pq6vJ<7swHr!scch&A`jp`bgQco^zWjKBD@ssZJlaGHm
zd$_JYw?c1f{i!YbjO#?r6BvW9cYi24@$T}?g<m)%4Hx+;cDzg1+M0N`b6V_DbB483
zTdsc-6WQ}L+fmWurrF1G0oQ3CCv5NB`XDho^JwjS$;lr>-xoX#KaioQ#H!5ut1P+A
znwjBBneijL<@~u{&5gSE#0lIvW6*oWIPizT=S3ev!&A9`F?qaNzL2lz6wAe&FSUuS
z31N39u(`gv@7Y)M<l=(2kAyZ{w(Gmf^zz|~xi`!<FMO)YAj2qIb-P(-y-<V1rLJ6m
z?|_?%idJez?#I-q&#+kZ+BdpoX`8l4+E1;8H_l&^(XpTJBwf)j$F%I+XS)!gmItZ|
z*{v70t#n;@OwHrYHJvBfPrYnrI@wM45psH?uIJ1w>vZY}@5Rdxc~ut}`KPd3tXYs5
z8B;vD)t~cV>D+SFHJ16CpD3sXY1gsxu{|hQ%CPCtcJ5hAtMA2W%H&R1)1?*vfxp2_
zfp6CXFXq1@N-HK`;9eAS;^X7a)l&@K9+fItz2et~re{LGt}-oUKX&iXFOAmDzm88F
zYBNvFXTHT}6LCXK`P=30vne4fydTZkP&qMYm)W+KWoI^uCmCnx+*9Vv>0|uJ|6=`W
z@21uJcdC93uv+FJ=IL&5t+T%>OX6n4n?=GVzG@2-v~Rd4-Me7S8(t7{Y5(E|-zzWF
zs?J^6_-Fco`ob@()~(-orKMxStsPURaEXKkXmEx`RjoR`>&)Xs3H!ze=_fafIAnd>
z_lt4Cs<@jE?|98im{h7>KQXXx{<OX`oD*hE{XhM4(>w`2J|p8*Ze_>n9KKnvnbmjn
zgK*ak)@e&OOJ>jR^PkZ$WBZwn791zzFFLVJe75uQeeLOUznAuHiZILEJXgC(@T1lz
z#)QUmOAh!w_Smj;t1<LhYrN9T&Aa>iLN%fmznpxW=Zm@W#Cuu~MZza&J`Jp>47+%L
z!#h=RjSVI<WPT){eZPlY-j<j1T!F&=7f!#Fo=e6ad|tX$OYflJ>ML3S-;^K7aJ9Z?
zyu@-w=)?)r@{KFw8^j#9nMa-XvC-K&!{>$H;YTys=kp!-9mjW|Y47`7Cdn@T+jV#E
zeC=C!;RxRXp98;4&P!^U-_SkGIALbt_B)RcI$gRkyQ+2WoyLb>`;9_Bd<pu=G^1nj
zf?D3{{@u$LId*UFJy!6Q)$#P+4f@SF-k%w2-dY~MXR&ssB-;U&Ki6hwY?|zG^P@$V
z=BeeZY2p*KQ;uy?znF4oyFlgqolX0iY*J1t%D?1%%4r>|$se5C=+z}Xd!4u96QiA;
zoGMqU5_<!eIf#7Uu}Y9(`z-YrA3aRNrM+9`=_M{QpE_IL$2xM!B<3uJom;ZLo>5%#
zR%FS-+waYM3cXHr>Q0DO=M#%7Tob>hX6kCj8B(EVT4UC?RBm6jW?|H-P09s@k=xA-
zi;Oak_g+@|8FBUNzMtE#z1=7yWA7cYBikxBB6zbvO2m|`iOHV6en!qWIXYDrR7@|@
z-^AkeQ*4>zQK?6zkEU45Z*y=Exuq|p(dSe7jXhSqT&v&&zs_ggC&89iH?&QUp7S^$
zcTH5ovdps&++<&^lN9+~d&cm`3sHOjk897*xv-ms_5AWI&Yr4Mvfo8-?Aj76VJCS>
zdYkuM#tUsxca&U=wQk*8^kNG8<+$q${(VU1OxdPZ@@m72lTX6xlUkgLzjmI!r>NE-
zufMEd+vk*^wbB8{-!Rz<)&+ccws_5>2}>s(;7$ua*rT{%^Ss%2zs5XR#va8l^s@9x
z-V2iy>(%-hvCOJ3Ob>Mbuk)5)dMoM7MDeqH@uDW)N7*}^%8Irex}|xhvY{-GL(|o1
z$HuFPYxLhsrR-SMeX;3+yxXcOv9P8We=F>6v@eXDB%Cl=R_0~F^Sud65?3yBe!23e
zx6Ui+l?#`5U66NJpnN2x`0}n*vrD7&HswYg%}Sbaqg;2jh5M}E5{J&teKLL5ibtQX
z7M2{hcRMchUFC&l=Ru`A_mlpWH~m#v7-uG+eC*=+`+K-gmAXtRx*fb~?wNT{4JGUu
z3r+T%cl3x@_^H3$)2wbq%FW%!y!Pqc<c{6!et%trkcyq^hP98`oP3Y3(0X=sgV%An
zEt4;N<hu5|dQ<R`O?GZdB3oBFE;&8*c<l1rGFHaQrDY0F1RhT`2$RsLFPbH=uz9jq
zwBNSH@@o|SF&r&ORS`<HW4-q4-`?kQCx7-xDNak2s$eZs$(mU#aN)~`b6Z#Nekh(b
z`R0;Dp^Ni4|1aoDe72w|D$C=Np3E#iwhQIUOl!AJv7c$G?z*k+5o2kqXv2o}hbQoc
zGQ2L9bDha4q1QO;-iBL(cUCfmWwn3SSQPv*Sma8g_3;hH$IkCf(Caz-L$Z|fjsLq!
z*3Xj9#Gdu)I#`#M?tc4VzLa$QecRM~6Y69anf)%CRO4!|;vKB#d0Qp&K*0qEv1*%w
z3HHldiX3=NCT{pUvwsU)?<%2PocEN<#2!WEwk(@);KS@i?^v>TX|2&yzvOkmZ)tBr
z(fM7xi&EEZc8YZ}P}u*>U}n-=)ud;_tDet3A1Athd(ivWMpCa=q*|yvc&T2HaY5OW
z+3)>=?YBkvIlq2PcH*&2a9F$|u$RkW)1z58n3XQAi_lVOEi|xNk&(T5#lE7|tLHa2
z-)>Yk`Q5Z)+s$1;YL;_*l}oSb{ft=Qplx?OIo9XqUH4t>&C9#lmR~={R+!`c*j3TM
z!h3bk@m-30Sp>X7bJG4V_B{OFr23Oa^3!nk_iT=vtUm2HouKr@H*&!`pA(iZ7Q0&+
zO=ypl<(RB`k=cyPo%u!VQPZWuEZ<fxaB{yQUladg-_)8*{I&TTvOZ_O;<j5Q5oK}1
zpvBPUgxdVG<=2vId#%@=XbPAe;%XP&_N|Chv@TR@)%(@%6U0M8%9VGyZ+#xpH$95=
zntfH^W4Fz()@M&Heflonxnt($r`Oj1cJG_&b$7<*jJ=wRn$LyotE)aG^Q2c!{rtRl
zcFvl~TkBT%PRrwyeyzLZ&(!9-B~MGEWX<mMZ+g34W`oYO?XRyUGVjxxX1}-2Qs%?W
z<vbD2&%ZV@)iUSC@0aEKG5teBSfcYkx!KuQzpO7f+cxiFzR-JnS2^DE(=+G&TV?it
zD)Z);wnNe1w@qxS%?_>TPkOdn_pTw!mvmoqhN?G0ueIdXu>YCAUf}@y^QO`=ol3TM
zSB~y_u;AFN297_rInnYPCS41*^gg%C_vFL>=MPR-xHD&d{~hVsR!=1a94z{FNW6DS
z;yFF3y8mg5t>+sy&OCps*~Lq4EHYa=r|CH3?!wxIF82cs4DWrAct2(C?SM2ViJDnE
ztS!zhTk9wLRIc}4*yrzYvi;=_RhH+99-NUckX=-1Xy949@6gPf&(qSLO<5NFeA4dj
zif)IaHWfYG-oZQ0i&*42O?EY3du`R8`d96Fda~PAEq?t|XX9$)vWjQn`d6FR1k5*`
zQMhLA>boEBvI`Z8iaqR(7ZP$>uzOwcmVo!`@^doWUg>P?m}9|b-MX!1?rHmawua=5
z@9Yn|b_N7q%k-Y)&v1Rm3=dz80Nx2kYk6h`mj@S5<ucbV(J+?ZX>ixr{*~y*1sm1=
zC{!yv+Qm@I5Wg_8c-M>c8|QeW&hhZw@=<7)x0)FDEnV74;p+TjTUw*;OlOr`{Nc>k
z_b$^qLNA(?aR+`~CaU}A!p?-7ja65D@7#aZw|HKHN#VDZE7X$aJN9PVzf=_5b#R$}
z+k`EJH|kCWOuy>qaroM8-kpb^&vj@0*OAjvkR!Z(HFst4GhTiLi+LfxydAF}a=v8i
zVqj&!Atg{Hk)ZzjW!wAPEyoH%KEIavQ+8E+$6>F|y2X#aU77SiS2O8yHBT(-2}K>t
z|6+6ZIe5JfnqjQ6@OCo8>WUMdYVWp($Gku8vB5y3)WVI!YP!>7k2tp3Z*HG`c}2GN
zr0K$|#Y*nx3sldF81Ayas>uCsJFDD_n|WP6aWAAZ9&$F{2#Ea_oNl$r=k9?E>F&v`
ztNu81^?XoyvHh>;JMKphqq{FnzH`2nef>t(zOECJ59Up_dwsd$y59+%H-*O*7_qPU
z692>~B4T#)ltZ)GpJ^Np2$A^l_;p?5?_hrRdwCK*j~C1?UwH4Hppm-9a`pqiz8o}s
zetX%07nA=sm9zA(lysS#JV#SPBwvapYVod!*7oJ4s-fF7YPTxOEZ8I|C|f4}jg>R3
zRa8H0-})!_bb2o+rE8_14VyP%Gw-r4&&p31<_J#-S?VeI=vrRN;+=ceW_CJ69Gzz&
z>18-|yL#Z>3f3O;3q55Y&MaSTR5baBrDSitE~5tTt=HF|Pkb0SPv-s7#-v{E60H*(
zSBrgrzf!BnqQ+*&|3?M3D-O>5b^F}j!@}Q=y=nP%+mT`Ut0RjwcWgbd@rBo)V6{&c
zTNwVmygzq?38$#2UH8Lj=NB?8yKQ$zc1xTKf3bM4$DDvEQ@_5NY<Bg#!^OssbGpJS
zlHZpflkQr!HE%KZ#yhMMCoEsjV(V~TGUu_XyR6ljc)s@&9;+7|=d<5r@NAV`)~Ykk
zJ*+KXLjJvNxE&Jl;6?9j-gj>&EWY{9P|!QSV42Hwdya`8Iww6`)@r9))crtHxAain
z)4mm3<W<=htU14Xg}t$%$n+y|yT!indkFlIwN!d}xM+X%qx-WaJ>n0$<$q&$$lsd{
zC7ipK_BrtMKT&w9=<z<{3-hEk=+{l%;p5J-oX@~ec#erd75A7C()f{HLFJphuZyJJ
zHyQkh_rJJIX&;-7fZL|pXNMxr&6<=kJK6Kfq$xErCX4T~NTu*InuzgEc=Yf%`>pFY
z)Nk*(qWbz$FPrN5d4H1x%~(sqQ}1rtWVHFyClkxc|G(_#@6~iax<_xGY+v`!Rdc2s
zEi%6u|77v%M>ow6Klh)fwtm&oyPNjxiBi39Q~&Yo=KOi}pOq~4YE9bi8hdtfVPUY(
z>Z3eb>Z_IJTZ;aB|DXF+&1c<fKl`5)?9*EIp=jrdX+Kx3dFDUQXWCVrlbcRfZH*I)
zoHoU{V!PL;pL?PLC;mDq{B_M5HqY8{{z+Gj<VD4QzK9By=PTWMQz`!1(M$C)XYx;_
znjV+?wchROCW+^(@6_Ari5-=BmK-8hdg0WTU0>#ha=%;i{YO%)-|@uRn_Vq+r#WW6
zc)ntmzZdi0vYGl{y#LsF)HUwUUtK8pg>!mRRNRZ_zqZ%ix86|v!7zT>&!bx!R@(ds
z>A9x;r!eTi;mpX(OZY1?<Jal)+x2#}R;bkd5Ai)7@%hE0_@f!76_ZSA>KZmCO=o0!
z5Mrqx7aQ78*t}$oafJR0fj^sfNvT}0T5vzsc*!GSy}w$gU-O*io3wh*vR#p}2ku-j
zXNWqtIW_d)>+eT{OmANQyy%*z|7pR$e|GM;{9gR@tD>3beHxqnS0`DXU;h5*Pld|%
z;s)8d@m23lI6AGQ&Sd|6<2Pm2fg>GE7XH6-IjvK7Mu>g*uC(5FW%$*asfP=uEidnW
zRAARATbSX!uVqs6ljpZ<Do?%-3&@%i`?xvke^f|m+kW#cChPBon_izCZm-SJon)yU
zzB*}*{F&9YKfbqT^6@`6Q2y~`34@H>e#b=(5<xosjQPvVzm(bTU*s;iWqaH?^DmA(
zz6<U?{KNL4gok&%;LPmLPedQyIQc6nMlU}6^P?R<?614-y>;P4wnL@Eqo)dztMl6@
zmtTF=o@Fbazv7qkMCGeh;dl7Hlt&y(H9VErb!PGO)30{T;CIQKx0m-oW%x%PzKn;A
zzwbZ${AW|dr`@~^udWI`llgX;eL+XsHlErQ$6jYXT<~*G+s|6>^NFi3?a#_q&!6eG
zgFjKl(bTs19{0}QIr*$_=RDucG~v;vA4@WK)oGpzzfv&wNomoSPxIp}eM3I3{g>x0
zXgTNLwTnkPXY6fdU)6APOZns)tD}ciH<j04SYHtta@B+1^rEU4n*?Ww>l!s%Th=R2
z@{hl^444oYc>Paw@J`hS`8%&j->3~2|5;Qrm2uf>ulLt3ugvv$Gv}bN@9%>D=>;qL
z*D>nf(cAZ@;K#GlvR(Cm9v{s7_E}$@=kwKzx3~X(A9tAf>u;0CO~3Q&ZvOwO^2@;5
z@@{?cgS}Nhv%md%(EgV{-|uYq;qv$PbG%Npzu)j|_M5K{H&)J({quaaxx62rz1)HA
z&EfKX-{bdLZur}6`}_I7jekEr`|$MRzmMy`9gKc)D6#Cz!w|D~e?x4~_T8H=C%4!7
zBL98)J=L`z-d%louv4Rx|L^^q{O$R7oPHemXJ>Oz?zZE;bNA%-{$o(JlaraB(EaS}
z!QK7mzHet=ZZEsHOm42sp8NLq>}@wa;Jbft%3iwzl{OWu`U?*KV)fskE8(}Jj?LDJ
zL+)R}muF`$>fb!MKL5VVzTY=}KJK2sIiAnI-stGhlm6~WXOb%Yzt{6HoKDaGcK`2>
z#Q*Nm-|zm@T(|$<&woE2Jb54?x97fiuAKZIdHIArWqE#ew~o(mU?}@|b@O(U)_=SH
z&6+DyYf+~v=J)>}hj7iG#chRLcPpPBYGrEQv1Hq;mj^p<xE(MQsfhcmpWyc@Y3jw!
zsq3{|c^f{TesE)t=CltQyLB5U&J<m}IxDAa{k;v{shsHrmB9kCHS-mFA1j^s$I<uR
z_RkaXqcyh1Epq#^+jgz`y8TzyUajT7u2;qOef^%Ac#6UP-w}b^FGWu96z+K?7$B~q
zePMa<XO0!3MQhs{m)B45G))jIKXA`~(&dLQ*T3iA6mBoO=hx2<cl&pns9z~(n=Sgw
z#&FA5U(O@C^X)deo)s}X+#I`epX;LVZX@R<_Z`lC-OqN<`=4%i75i&}{}m!}0#UU(
zmpt-5E&X+D?!<&zvCkY~wUK??XWecs3hb&4T06ZUf<d^yL2zRQ-#n*uvFr%-D*roi
zycU7ik6J{Ap46P87j{RG&GG2#6#lgThh>(1^Eu7q{KSP_XE#s1PQzW7wr9MBcm8}(
z{g>MDEO6_ts^B<><qdCh(;hxN{4{>;>rm5ViS~j$by6;IN31tW{$P}!d~}95YlX{$
zwsX6EE^{4;YCCA_;TBw@{`_sm-dlB#ZvDDrv+}OmO6E5OPEldsQ?|zRPY9RQj<HVX
z5te--?i*aN#YXX&aR%$gt@p0<++vq^bYMGSzvj7e)^kyV_!BMj=DsvzzUk8+dU^|U
zeg53}+CBz4H?(8on)+*-eXn|-eJrA&WW2lG|Cj%~o^H=cnta;3AHIupy4RflI_dhE
z6E7z`7r7;^BG>j{V!=KCd4HL`HgnAKKffW_=Vyb`v{Fm<E^B#Fp6N>;|63QCtzoSD
z?9Zn8HCw0exl#I|L3NGF-o0ASr1m!|Jv*IRH~kDltwY5=%}Fu~W7e&klr?FO2X9Lf
z*N5j<wO$;*`MEgX<Zte6*^L6+zR9I|!B-DeR(@*PCbQw}=E!|}l3$p7Rk$&Iwa)9S
zM@yIvt%%|fku9s7ws-5o<%_B#@-<c;+;w{X$0n{B8ms5+IGSB5=VV!E)f8iR^7`eg
zJ7m^Y{aF6~+N`JZH@$wO*X-KRb$<SggU=opE^}D*aaDZQiY*eRNw>2bs@%@|wg3LS
zyV&Jc)~vgZo_~av^L6;FFuD0vP~etf5X*V_B+Yf*bB}v&^;x%&`@rcHbvzFZ=3TYr
z7iDN&x3S0AKK<3{pLrKHrp7h>ked9fdUD9Z=6P*T;%a|p{haXRa_YqX_Y#W}ttS7@
zu9)*}uGoU>##e%SjNcib`F?X}ypra|!(M_{cfV|(Tk<{a<YrmT<)>b4%~*1=ZhPBL
zrlV)&v?SZ7pJw`2@$2<L&s)o<B_<ydxoEv$_TDdd18==|PfR}eHrlsQO?+jB7Hi=S
zy-OQ-7YV%c`NF~7nElH9jC=6vfc4>S#{{#L6@G=;<Y!&WifdzdT@;n_de@7kVNd)M
z9&)pq2fmS1)O##5hxz5_hxLC-f7ndDt!($+H(95hOUnLzsr0&Qez}%Lq1qCM<M;hu
zW0-Sj_X&n6`${{!G}KIP^QIo^7oAfO`0v}yZl*_9=2Wz9OU=CHX}mzO%^<K=t-Q;L
zkypyVa#4QCk5~~eLwD(=J6xX1UFuMp&;MrW;kj4c_>xY{blZK|$v)kAUeml+GG9(h
zXU_4MA3OiBMD@Qvyk{7N7$42c{IL4Dy_~@7CR>B&cPnh811uZmTJk>B>s#z#|C85u
zcUIcs-8J{R=iW@}@VI^U##P1#^1dH~&wNp0mEw7Hc+ZZx(>@=vfBEI3%$lCH^Ovl;
zFMhRTP52`DIYD#Jh5fm6BekJ(ALl*&hE9irh59km)3aEeQs(yyt`xRn&buNhuxPeS
z$fwdzx(|XsEpMrRk@oPrUXO&ryMzA|gH;#((z>?WUbUXnD_HS}(AL1C57@av?2pLg
zpOq;IZkVx~>7NPHg>#l+>#zDO-+wmPI7;v3hNo4&r*0+BnX|6e*Vk#ME%WTMze%(1
zr>+*NcoS+D{pN4O^Yzx1uRa}dXqowV@3E{oiYL-<a;?v5NJ=UF8Sikl?ZD)9>7Q>&
z_Mc{aD9n0Xda}%JxjO}&DLEHkA9k7X{al{1NSooV!}|k$C%kc*`p|pMj0+)7`o#{O
zmv`E0a{Rw=IPYdbe6p_X(W+EIS>JZ&B{}n2pUu4N|8-^2W&XIr``>qbR-ENleXE1p
zf8Fz|Z*68z+V<2hbH)T8;RLa!ogTehj<FBw+t!C4eEr+A%D%Rt%krMhgYGF|#a*j2
z_13j3bf;ggsoQx@zj1<{_q)sWPt7ZTeR$A#(E86s<pVZ`i<kUM)4pW&!@2jIv&ET5
z!59C0ivM|Oc4LTX+p2|Astz%&w20`xe)-Xk8PDdw*tVzLE7Vo{k_l^HNfXDkE8R&U
zey0R;B4W3=Syrd|s86e4HxIehp}j!-hr9{%4EI|a55%r%I6S`c^mVA|;g>C*yS=Au
z+L6$@)av`ICEs7=*2Qwvd1OalC}KJ{F(s^y>DHZgyC*%jrhAz)KeG6q`TvQ@PR-&s
z$2T2P{4g_ejhnNr)4LCLvFsms`Qwx>m>&Olke~fH`};WAIR~`%R(v`VBbh#J=f=|&
z=LHg7uI4V&zZWDHdHEtw+o2tgZ62=n-u1maUT1-k!X&%DXT2TF6%K!%+PJvolaJx@
zUmNc?7TL{OcbrwZscPBA(ErD*T|dt?`Swiw{)SicKg&%0_AGqsDYX^RrxNn7GsP`!
z`FLhEU(GAtH9=*pO?o{3_Sec=ewpW6{5|b=ggNq}&*{LONv%b0MX_w$hUsF7>FLj}
zXYsmwY-P)7RGt&M@XRc=kap46QQo^^&Ku9TB{?bm$jODORqd-&w!|$;WlvZ&>y6aw
zz{O6=g&X5kpK9&YT^=0UcR+vUWHsC1PiH^uY^V)lSmpOR%Y0|lTCuP1=KrsWT(|C;
zc)_8w|9nI_?*Du}|MV_4u~+Bo|9|^gERnEdVs+!smh7ucyREL+yH-vPIDcqKc6e6#
zVW(G8hb|sov6|z_o{9Aw+Lc;TDV~=yRu=BO6W~;QX48@daudC(KEIfiC2Xl25T%(M
zdpPR)GsdT1Ppw@4W=C7brH@5Xz3c8Doc`=p)4r;^7Mfw{y(PPsIy;n3ci1?guYa-f
zm9pf+!d9B`duz|Ge`Rr|Lu_pvb1uudGYdo?pAL{%EvSB6Ty%%S-hU3dtEN=2-!tNy
zBrsul=^1yA?k`+gzAGMlS}7neUClM?d!M1my||8S<Iho@FV>X>ai7vWcj0gIa`x1$
z=hrxReUd_-KHT+OZmY(pwN+&w4g@kSJNmPz$#m@}!<&7nE_Oy+E(m>f_GR!-?+xPl
z^EFMey>xHz6R~^Wem!Jaf9hw!UIrJfs_&XxXTFQNJ!M{O2jkV3_7w(K-ZCq^<aldZ
z_)p+z;r59Mq9&^ZS^KZ%Y+CcLJ0dno=Wf&V%deRF7J68UtaxGID7Kt&SwDZ<f*sm#
zW*<9pEj+<|PTu0|mIia}stHYk%Rl8fc3xYuqbl;~_R_rF2X0sR+WOx69Lsv&>hMoC
z(bqz{r&d|cNjlOt@!LtBRE>|TI<>5BH0kQhwVv9Rb>h$OT{>b7kDn&$@aCI6%rkbV
zm*wd!oVnch^ua&BQ*7l^OE`sYvOM;QWIgw(^}n54$HJ*MlI3})OxUP>#^Jn7Q_9l`
z;jf~-+?#ao@2;0P;PRuIgJ0b?xvt&Vg7?9S#?D!WJ-e<?w_%y^rPA?_{t4ArM&5T>
z=B*PCexvmN^fb2T%<P3%oeL`udF?+Cvwiv`n}a<3HIe7VpT3x-7Z7}N{)X+#ob`HZ
zX32=3|FFbK`{92rp-{O6R~DzP+_LASKI@03&nYpD7KMRpE}VEDf7O*~lGq=aryFuk
z<|-y!>g9cBwpr}t9*rqqiaWQr7+Yj`UYITR*n7%E?F4c0Ew+=r=6E|yem0q@;+$YM
zPeSv;PVNl{%I3c^%$gfq@!*xvVab9%sjH2SVyknyUN8q;D_0lx`{sEy_{EAJtlcFc
z_S<9^*(!yu%8JZ)e6!@XrE8*DZ(n?`ShfrAo@YzDuj@9(gnoThoVa0ytV5^VlypsD
z?$DV(I_}GKm3{d%-+62CPn(yevp7n(nVEDQ{<A1o>A*L&sZ5W&&2|Nqsoq(0^S@nb
z-i<#jvffvxMIV&TI<2yy)X+eGS%#SQg{;*|j((?qeofnvxAN?P-gTM`8TWG7ly1yz
zyT_`!i+Sof=H7zTh3^)a`(*C9k@jJAlgPByUzHd#<8v8|bw5YF{1Kz@=qQ_jOa7fx
zUsmkB#p?4&)I;^UpYP`q=cievOSkm@%X%3u&A@SYS#<244EBXPV}&Y>Y!YQ09=^_d
zFr%`s=~1}!feDpSIVtC6mnl4clvMjNWSRPGEymN#wOekv@i+ai65hdPAiH|Ccg*%p
z`)=m0)mpJ5INIhuL&DBAciLW_Z1Xx+c5ZE^@2jZQ%4s{K8|US$GEsl!EPgvL_V*&$
zmY}5S$EN<~q1O)egh$)oi}~wTd4-kXOLv(-&dt{$&)lU~Y5x7PBZleWIwmEN%Ke-Q
z1!pg3dbmC5&Qs{RnN-To>wfUX^t%q3Q_FcKRbA)3pflgS@xbRihKQeHtqZ>t-92#U
z?1u@xhaZ+pGhB_FvZ>>_G^0ykm`y(WhxK=ICF}B61WYa7wW;v>MZ3K9>)!pCv+Gr4
zwQKEOCGAz|Z$*_w7IK>g#7qhH*UpO8)@x)e-R<db7P6__ATRWHjd8;X&0P8I;p=B-
z#NVCy?dmbEn9N<VES&NA4B~kg^`e9CmLI=xX5TB8CexdS9DmX-=Uiy5+#>%hbh_k;
zV+sdcmo?7IXAwA@RQPzqLaWt3@9z4tX0MVLx8K^(jRy;rV$Vw(UZ}mw_bjc&sqJ(&
z$T?TPt_%*e&0hQC!5z;f`TTx;_fqBW$<9lAVKr^hqMfU@D#%~FRkf&M;nq62%gg4u
zMO**-@b2!z-SV3cm*4#TcyYblo=4mK<t|#>;z$uJ3*J+~QNri+^!9=h58K_wyBvK#
zv8<Y~I?~j$t~@`xKKz|cjdQG?;jY7*R)}Af;k_i2u;2UttNX7NXUAt;SYZ&#_5c1}
z=|}ekcO`c}Jn%Ge>g3%lahl$`3`=zQUKTZ;Wy!h}^vGr7D-)}nSw7amX_w}z%~yNh
z>%ZVLlW%9)P1k}Q{r|)-{g0>*c)OT;;XKQ*WpidLwdZV+(r(?xwCjfVHt7yg=B{<#
z8>a`X5!kQ3cH1ZBN1Jx{=FeIf!CWZ&<526>FZ(2w;=k?+cw!uTIa+Po`i*j(zaH<n
z{AN-S|9;o!Gi;Z?a7fJGZN2V+P1Z`!_KxUayR3CDe|#_WeSUG-y-%#`-ssq8u1o*B
zW5=|=cVnK<|2c{K@bqUvm#X`^PpjX3HPJdQVy2wA^N+ypB{7%(+=*zm{W2%&&x+iC
zG4t)$Z>qW#^S{D&dT>ge+4URlrE}LP%b8sN)tPFsZeg9t^t##S%cuUc_KLf5Bk)j7
z?5fOb`)8fr&vtOy=||heV$wdI5fkU1l`XreApKWz{r0Ph4`okX*)^$BV0CJTht7rm
zS#2j~n*}}GnVwbj(6-NU!}OR2)8npt=P@~TtdKc;`RUwBVcV%KZPhDc>tr@Pwe4Y?
zxKI7m-j<bH7H#|#xMm;c@g?u03|5`XtN1CTDjM`L>!NDK8|Mo>LUnS783I`(o^H<h
zp^%@;;xF>Jnd<?k+Al3phd=KM75DGn<LJ9>Nl9mQ?47G8MX&h$$dZegld?BL#QWP~
z-++^hzoo6uwRMXaCcN|erM@82;K<b%Suf-k+%Pu%5@l-e>{?NYfKiy#lgeF-#J5|<
zX{oJY@LuP2eOC1%E786Ut<sApa=bG=H`($>wj_^h(wX-X|0?+M^tP>Te_QPrZM-Ae
z&%XES)W%worf&6%Qi(1Kp@uaVTOL1o?xps5pNT<3=}~ThgsEjyv$uUUC=dKsv!Ehx
z`<9%adzuS2+OzfTahf9A@4fA#@oyi=J^$V*cr?s9mM7gSb0ML+Rj4)X!_7^zA4X_*
z-Jfc}V0}pSnU<CCmOVOp52v*29x+!x#pKfav-k*`;o&5v#ob#Td~mtBXGbVsLe|t%
zJHI-sDJwkwlh>4B;xfa!U$={G`5&JPtl{=WwmVO3KVtIklJfQPx(6(mx-0^>TAW>)
zf7NKhb2%w>4f9gYO@7SlMYsQrTmFKNdH%~T%gvj%K8(1}^DVFK4bOASIY07dm^*%8
zU{6RXHD}I=xHe<@tPKw?x0!$Q+~aK{?xya?=2qHV?YpFS+VX5E<LL^`b95JSwXK)k
zap_6^#oXr?6na>+RPM|^{A`|@z0AMox0_=h+c@c|JM40^JQ~~ZxVOoor@KaKb#F;F
z6VFo4b|!@f+`mq%%71oUSvdL4Uv7<Qmv8P{u{-%vz{=e7^X8Y&NjxpP-G9T*DO%H`
zeT<HN%4qG*I<CvW)Ojh;PUBuvhsKLzA8uRe@YG2q&0(oY>4{1B!n^*vq5rdM8@PR#
z)+%X-*PT0XXzlYSj;>t2PyRhy{q%6aEU`GoZ@%2A9&2p^OJ4Lziylpi>Mcq;vGu6^
zsv8$>*q2!qxCk9)f5D-1;t50Cx1P?}wKBVY+L}E-u8}G8QNXn1ri@iXvU+WA-+#vF
z$M;MY%Gpg|?^eq@CCPqDH%~68r`1yL+ZTaW#)WbX+jbN#<EULP%hh=;zI*n!%CjqO
zXC&WS;2m1L{Or~CCybKZcar2PMQ(>Q)#jYC2|dyrqm)?p>18gTkVA%~G}~mubKF%A
z>jQd(bnCLupK$#(ZO@L0ya5y1GJ>pA&Trarx+J5vH=yKqdvaFgge4sHW!rZYOS<r+
z6<Mb|xqsU`DE;4Mi9%P2lRLC-tP@<qrm@>;(w^q}9P_fKU5<a`Z~KNBxT$&8&-mW`
z*0#YoWMj(%`HjIB0~)7(`p~UwrXwerV;gmd!QoZ-JJv%?GiNF#p36P3<73X9>0M$z
zWs@`BtXRQm<nigr!^T~CUFGg49DG$JO!#@f{8YGX#$V2C#rnB>*Q|BnF`kd~e|2m~
zS8<e7Q@{T7Q0s}ZeQXa5ZqC0J8kB7Lj8p&m<(ii{Tx;%Xw@p9%<ox4D&(43%idh?8
zE5Ub6+u?PlO~A_k6*CKhr!v&{zN;)SNLUhQahBEQMr5ni4aZ}trzh0-%_};^YvTET
z&ZF~Rwu`jPcrv}nZe3n1J8NUW<Zm2)0To6%*-`64pX?|oSFTfYP+e8k!Mtb&&yS_Y
z=UG0<Xo*?Xv&M1xigf|kT6i0BXT{FsIa#s$*w6P%O`2C;KVD_o#OfGbo6{Ar{%rm!
z+asBd=Aq#yq^`xioDp)4Cq?SU68^`>8jfEo>|pav_bDnVY7kF)tKjsF<({w6oav$Z
zHQbwT?mpGX9Isp5V3)Z!>ArYPz#-1ih6zoZZ=cA$a(IK+Cwq-2k0;!z`tI-F&mUiB
z;mUsh`|soG>^FZeK3u+BqWsOzv=gVBV%5Tas$TMAs;)?JNc?mD@AvnHbF|s`a}{#@
zc_+`#X7Tq6dm-D9Q&v<R+P7{}^e1}{=Z#H@E2b*yH`Ol;Fkjbkf3L&6ZBBD9>K3pa
z&d80Dk6`AD%oDf#X>3>esQsmX@e_$h4u4|PKL~a7Wv+O)h1rmSGryC!^sC01doiK5
z>u&OIGighmm6H1|KhA$b(FaF)dp@P<C*wG$<W&p5&$%@H$JUZ*8|@4odCs+MKH0GG
z!cBAj6UGw`xt$k(d&Y3lhOZ*#XE;;r|Ga$h<V%cS)9a6nOG>t^$x>VKSYb~OckF4|
zJnknc?^iiIsDG>Au<nwc#CG0<iDJ5b`ah)j1SeRXXSrfvcI(QT>=$PrU6EO&WFfXu
z&C5E|(CbV7#daZgk4st#uWTomM6I}IBDSP+<?HiDW0@<D^1I3DJbzuVcvV8z<4yfv
zUb^lnb8gXkCt}F`V)BxWI*wfnnnM1zHizu2**mrFTZP}v<asUq1vO?VO?@gGUN3T(
z>k_cccV7+1Jx%uqn#Z;U7R$Q*lT=R4;OSg9W0x^Ysa#)D&%tS7YL}S(Dk9n*o$0wK
zxqVlhew9@%V~<#0act@PlAV1%ldtUmu&zwtb551tx=Gw>jQ4kI3Rc|`n11BvKAl5z
zH_ZFLY)Pe(QviRrw3QTtx7$%Ur33dF8GmhC)4_NzDy&p-(u@Z6tVtZviKbsW>=s(|
zGWO|t`kp@5D)P#(OUCBXU6s&{lRXWrmxx7(Ptan@N#3wal3`amt3XLrSg+`}#MeQ`
zLYn3Iw^Z=n|G?Aje$xELqg*q0k*f-e8@;7}-3qo9xnAt=D4<X&enVRHUR9KW<5FMV
z)0<D7UK#kb-_a|^asBCAoMKB4Sjpr+E8ZOy|4?n;hFde|R<k}!JkB-eN{H64)o(Ul
zE56pxl6T*K@?@@Q4OikzIyWxvPP6{>>YPp8w!?=+@BWXyc+fRmZ2Q$uQM;?TUIdt0
zxqfZ?`C{oZ$0f^`1+QHHIctVr;6lZSD-o%06Q+tQTgUyGvGP*)jO*uOPJ3SLZ`>T^
zQ#@f)nbC}SvU3)T|81Y^q0svv`CRh{jtDUsA-7ziuWxzyb&dCl9M0T(!}j>jHvJt!
zYuFVsKTEbbpRnmX;?AM6YVDi2HRAqHep$Mj>|U_g`pCE0It6Ok(Lw?Rypz9{XdPxy
z^qzg|hQ8FD4{?X83(gzqH7D*X3Hha1AKXw~r`*J!7T5f-<p!@ykCMZ&rX@^MCe}n;
z+^}iZq^%x2o*z~E4xV~p;wRK0bY;n^IS1;JpJ&Ov2@v8i-h1M;=Dtf$ZUr%_tPRav
z@5#J$+m)lgHkmKI;{9)r3ICVP9CKM%mOH0~?dV+M{U&2_kxas$)QtB9)$7#t>zsTS
zvo3VHk!NB2`)rrT!ABW3?h7^TB#t;;{_^3&U4Hk78}olzq+16nu9;LV&yv5~QKm$C
z@oS-N9?y@d)dy{9H`{yZd1;BxC6nB%(bE&MTBq{g(|oZ1NVuxfISaXtw99fG{6fJC
zRX;ys%gyad%InihnVojkSJ6Lr0(-aT&&(Oy^jdHGznvv7WLfTa$oB58l0ska-&L0a
zGAC^7<~^SMdB&mAekPCO3N>!e&b4(0#-?WKb1i-v(XZX{==R6JU{>R&8w~2N*!W%w
zzbbS1sm|m@F1AsNnhu;=8C+(PbWCH1VdU}&b9whY+0pT;#bA1VK<RV&>W3P+?$VKK
z+Fq*5mRvr@yJ1fGPd1<T6>ZyP^Dl<pd3ZK<ZOxkWZ_&r6J`<jMS$9TczCx!V>#4>5
zKJ(5=s2#7IY{nH9=wi6SXxWe00+vtZyPm{OwfJyVmVfrAZYj0~k@-_xMe;kiCRD#p
zd?omq@q_*9nyg1FUgep6UZ9h)>fEm=*N<xJ{1VDD_T(*&v8@hUy`WfYSJR%oRiB?$
zR9e3}{YmNHrJn~*y;u4@LG0$rImKTuFVG4tS6|b<dUNQ~UCUaEO-t|3R++eV)uayZ
zeRo%?MW_0=CkF}IAC8&6cjdX|m&|uMdGeZEIJo}XxpS@4R3~xzW=9v~e!sNw(wqsb
zoLaS8_@3$CulO~~qidT(;p1>2<;#ku`%Y|FwDN`2vF!M^%3E)Or>@qOxL98QaoIx4
z$XVtILFZDW{?2Z@^Lf*w2O?X}G)68Ecg|mx%C;?F;j$vR2l=T}x0Ih>7Z_#!TOi&{
z*e*16+l9_Mzdk<FGL1Oh@VHL$Zrh(j;oMTI1mCUiTjj9rM#!{TyssR7UR>gu#TH-u
z_>dQ`r|;ySo3FkSEm1rua6U-=Rqqb3nf+(BwqE;w(D=?euZ!vYidVjJb!>SW@PG0=
zYu8P;S9kSUY*(-oQ7xTj9_^#Qt|RYwS?;kV8yi!y7;f$S8S_f;jNVHw*E}6Y&q;n4
zGuszgO}w}M@1kigH;bMf@|j|MKE-mf;>jsN*2i~>3b%zUR7p(C@II8WO7*R4?wX}4
zLO<WTeCAu3@2)AZ=Wes3%gak)?2ShoOwBg5&RwzQkdxB>6(=2>{vVUzc*SS-VB5x3
zJKkRMH*|R!CZM@Yv$}!1z`yrzM{L$UcXmbgiV73Ind;}S6{lu#Zn~YslJbkMOd#(6
z$%nf-wMDiZ+Y@kN+uf3>H9=kCN%_}&mQ9sNpUANGPu}6$XpIibZyE-3XUu-EUBl7k
z+GJg~Q&B&TeE)S~-KL4N&t%>E-2D08m)i=}Q=e8PU!68<+wY9cLZ@R=!&)cr+G4$b
z(ZkhCuGQpTOPhDc_}es(ZR~u$uNM3%vul&$?a1I~c`281$a=z;;@fN={z%@Clx%59
zeQ>EKS32N%>rtblapw1JS8=4>>e>;t#v@H(-@eeS2VK$Kymxx0|I59+G(jO`$CQ|v
z;;R_6UzwfXc`q=3QM$w7cj31}9(yj%zh$Z;yV@^yTm9|K&!_za4HrG>Jy;qPUH)-#
z(5|46OuzHH;@98P*DTHns5p2&F)C+ahpBkkgtd{rB6bsYw*BM~eQ(REvL;PER@6~g
zH9>jtsiQNtpWZhseV0<hR=<Bs61l2nWD9P&ahPzH6l_0qKX9vCbHxugKG&_YHwTGl
zT-BWA6koVV;?b9FJ9I4+e0>f5-kC08Z&tl<(mUh(y#uuqssg;W7)GtV_~e_}{Ph-W
zN9w0`&y$Qd(7Ku#yC*Yd)r@rZw`SK07GE;B@TI`-+?>TzC1oWa&-R|X{E#nuaDi9_
z>sejD_d;$OSCk%}y`Z}+bVk_r6|J*3MytyG|H6^xdNA0qR&!bVvA$WhdfI+lt-=oO
zul<$wmC-0;qN@2`gUaj&zXf(#u+0qh?3pH`BY07tW6xb36+5$)PaL|9r)bRlBQ-H7
zLw?`y?8QonQ}ib|&2o0~?$R+gb9&(NX<^ErJ%P(a9%qQF&F*)N_dNPdDLzNh>cr|-
zk9Vro?UXZ_JM9bSn~c8epToI~Up#5K|NdsY*1Be4?}nZeA%P0I-)DX0I(4z?@Bi1I
zI!ZHFhOP1mnWD~WKHqG9X3Xh}JQ}Y(I&bpHFDct7a^>p2ZA{u6(;wOXnKY~2&G5?h
zYV**RlfTun%TG%cUXs7)y(qTN=e+AI;k%i4>!Uv@p4q^_qG|Ht^4rZbCxxDy(X2N6
z>Wp10rfcymbea9+Oa5tr-5Snk`X^U>^ZD1ov4W?Ucg_QgISW?))R_O-mZx1xV!dXI
zqqc)OOTN}t`)--PM~&TO#nS={YRx%T|5^KJBkzeLAKpsw9NT(SF32a;)H-*kYGH1A
z@|HGMiNbX(%A2*k7p(YdU8gtAweIf2MJukdUtFX2B}3yA@0VXY9G(ayTnp2QpFTA^
zY7TF0QDDIHu&csG9!-7Ue&@b^DY$FLE|$cgBV9L&ww{}R?vm^0_T6*;78ZOuakuSI
zg2vlc4u&^(r~aDD*SYb!KKnsK-CbF-mp=;Le)6`=#XRyvb^m5=);&8P?YnZ}PmQRe
zV%ED2@08X3mEylkZe~8T?5NAH6Y?`}nBCVYU$iBB_9YX|*7?i6=H(lB$!LC^V!pS}
zZQ+@7%=;~u7sWm~eR1mY<2|o*o6D^AZaZvg^y2^g_)mY-1+K%)w|YO`%=TWSymY%t
z)4ffnEWL#i_s^AGZ0q=`jQ>lG@u4FJ^A64HJ-aP<?X<SS`rz5KZ{P4p`EYrG`6bhm
z6I1r6z5kjzv;XwO2{TqdDL?4^f1T0N{Xc5v_p)6%uiKctForAFOxe2bp90sl9c@<@
zKTEyysilAZvY#7%>WG?4v<q9jcz@#gG~SC7|1MURyI%cn&E`i;>6a2eYHpY*ks;}_
z`gT)p=Cq^64jiFTAJ{i!cej@EnOuyp*`HS1^0PRZqviC^qbFupiwkm_O#0n&!;0T;
z$%aFcdz3?}CRDU6&9vA#BTsdHRAKwe9mWbi8*7X`YN{TY-8*Ek{e*gya%0=O^p(B=
zv$t{0O)~p-<U8YO@#-(-3tBhXeqArH!Szl4LhhAYPX%*6sdHPmqwi};<ffmdZhfJQ
zuM#Y-oxY=Fwa~<B_UodpTfZbdS>s~4_7nFyQ5Tcve0jc`wp41x%wA%6g8#Sty*X*_
z@BJ?-sRiiO{@(7UJ8kRg4D+^$WdfI+l-6w$Dlbf$YPHLWbsMjlu_EV>x<yXAZ(ZNM
z?b7R4E^Sstk8^Lv?A`6Q$gJOnh0jRjJy$U2_ulx+E=xG{AMc$cRyJdONNUJ7*K;m!
z+2_k$m?j%u#5rZDgx{JQUbjAL#pu*H6m@p-BzyV&D7gPMf0b15_EY_ZVFjyZ|6S3T
z6Or^nTI9?9@AuX&5B?pXCdziFbmo%}LGe91_6H_E^FKE4e?o%$uJnDCH;=kJJ7s*?
zER{1ho`svM|IMP%+0#$ow<}W5xbDkW`h3liw?^?i_b+|+<vuli@5CpQ>n<gpo4mrQ
zUQVNY^HW*z-yYxMpUaBN#qRv-p!tIPPf+2Hy&d{~E0)eUy(nsh{h`9Z`~6uV86Tt-
zYi0i2_x67>(V<^I;el=A1kYXFIR?ipA|J#qXnHFWetyG-chlE9OuVAF?Q?1K!?OFA
zFDw;o+We*O>kM}x=@Q+zoijwl%!;1bzT&YFD$;N9^ZZ^lzwK*M)Vivdab5SCj%d~;
zF^ey6TJ75PzJr(dUj5(FE%y|D{>pxT@$lqly$=@FOP^Nmb6J(wq{*c0+-5sZzAKZX
zk3TE>hpN=$k_Ah+&rNpSsIz+G^*k$?WmbpvCvQ8SUwY&ZugOkhnRf+8=I`2}vh7;#
z-KRg^hW#=6+*356r{Rfd-PG$UYg0-$X5`$y_?&%h?8K6_Y#cJ;Y^LU(qVI(K{_dJ5
z{wwX@q8+F5Pi5_u*>-nV$;554cdndzr;xd2wL<&k*>de4HFjE@693jyqPpd$$Idy+
zPTsR;$bQjcF7Q|@W!H}Sqk&KR9B;6-y<xNV7TkNW_QuHxwd-$HWZaURnD}dBXp~dl
zwO;4V|Fn;7JsVcNWS6hPsdIZ9jx{|v+?Ok~R-h*@Nun*3_s30-BZsBUPkFXGK6am(
zx8>&guDS%}>KE<nk^+`T^<NU1DInZ)_p6xsu~W<%x0SzGB&oeWn;<vmM@zSKpGU=c
zUfUTbzb?Q0snUvXbt+?WdCQ3vsaj7an&xoHY~GsX=xTb;dzzZxB#Sqy))Ez=!rni)
z{}?*=TZelqymd1_m7ITmrBTe()tQd7T0(r9Pa7RIjbxjbvLq(R^ZKOpm<<z;YGsT4
zIyuv4bJ&J3@X`+cZEDA7Wf$oi--&hU&A3;~E8E;weI_??!rqQU`P}P#Ib{ESSfik<
zm}TrH^0YP2)+KXt&Iae5nmyr9Vk7uPZhd8c!#ORqu0*0KIau(zgx=@<T|4<I5>Br)
zX54Xq#{)4-8J8IUn9pCfTi!qY=<TA#)q)WY?5&4Av~2!)u}}LFF)#9yddu0RG7(wg
zkqJo~6Ia$d>z>}TqEUh+E?<jZ(2e8%RmQC?4sF{OuK%RDw8uVqW!JwIlXU$5#@ylE
z!Xn{S_oDxqceqM*<t#zdl(^+*CYoEerTSQ2448NC=hMWCtCxNH;rGgH*2>wpB$Mu)
z`|*3{9g$gVY&_fEZ~PQu%yvMnFZEBzgKHV@e=G_7ASk%)g8tsdx^0t%lcsP^m8g{3
z>0~`)@>eE~xY)^AMz$7qc2@U%O*e*IOt4VfrzqW(XU?D!@0;XeH&10fU!tvpno6qu
zm+r;IYSwqo@%2qSbv*gIq3x!L+H9-htG_&2=b(K&E-Nj^yw^oy^QX`GpVK&Jy}ZD7
z>tFuDgM2exZT)hRO;;3GDEwI*YbhFdqU7449EQ8Ag0t4oT3kLqfHzatAaCw;g^-xV
zN;_tA8GcNb*rlcZy6QHs)Unt<Q;tswmxu^2s5|~TvoMFN{Axt$z3myPvF?j@+xf;N
zKM~uexO{ERO6F<W_iN^~E{M9qCs&-fGQeN$;?;y~=1RY~#)E4OO=}r1#osN6?J`_7
zb!v_C>wlq3!&hJ278iX*U+YC{SCRb2JI^alTR5K5du6<1W}}tZPPZ1f3qj%CN%x9p
z%c@v!x31u1U(PjQ`reYgvuu7#vo){^Nvhuye(?Tu=*41L_FEncI+NB<y7hMc9HE)T
zRhJkNOr+Bn2c<86_p@}4*9^~w{9`gZ^Fnmr?fKard01jn5O2Pg_F64BF^y-*j_=;2
z91r;-ef85nPW}~Jra%5W^~TfcN59=V3S9JzRl~A2tohxs_akqO-}+U%6!t1h{#Kt;
zZnpD5%#@{bCA~gRS$tsDdCS_#>??OLzLW4^c~`&C%i+3!jGD|rV~2H~CvQp4W>}@T
z{`lpTY5m;$8n?&p(Onq+Go@*QrJR|hQYNe8hFw9k`ZG)qeX`2BJx}<7qE5Q;(-(`r
zc}CpwXGk@;TrKz7KK0<%+U4{8Z?Vm?4f9=En)<UNY3XZ?e_y=Sm+-AI`+M0r`h}aW
z%gW`azuGvlf1J9q+i>%;Q!y^Kr%$La7oR9;ec%6po5pMHu$-1n{jcwDbu2vMr7Yt+
z`MTj*Uvt@u^2_CaZGX`wwSna=uWU=!o~SE3m;K?r{nf~5N2;sCG@tAxw~7ODqM!SG
zcGTv%<yn34uWIVn>uPrP7sDQ~yb@a5bMm|Ag%hS~_mbz=C3X1}O;}aLRG%j=6@7Ni
z_lR#Fr#p2|_`FCWyDR3`1U8RO!&OCfoD3UJ82_<XSdzQ9<KSEOEWY%kpMu2t#j<wK
z&bv3w@5rnj%eH&|P}Dv6KfHB5uTjIJqnRDEr0c(m)p6X~xc5N9mU(#$1rn*fjz8LE
zR>-zZ^KCfqw{wSlY*4B1ab2F>8SY0XKb?2&`gV(}-(HDJzm>EW`*fh+nbYTNYhgG0
zS<@OxmGtK;l*4rS=Wdrf!=t)vZ^EkT_n{IDVZ3|N_t(vt`%j_sG>hK;SKnoC8-7&J
z-eN9N+a-3+@z9>t-Sf6f`3s*tmK+rL=y71f;{~lN4!3NLjQl^-GF9JGDT;+%tLesN
z-OC~j(OXt+;-1>SZ29v^lW!cgJ}1<1Y}<-wO1tW<UOZg%b<0=Rds8OA?wO?c;p(53
zHG3)>#7!^nYx}Fi+W7mJ?0t=I{NL~IvHYdFIO3heb<M>oGRN8NWn|>{RI5I=KG`pQ
z)7EUG^SixySJq7TkDAI}sVwSx_vQavAtAx)QmZO&rWE$I#;mRXm9#@s!SVFnZPm};
zHLFiGoGC1RdQw_?)|;LJVRpu^cND6ozpm+AqriHq`~2d<Gq113&i&=I$~@!IBe^Et
z)bACW+9$RBa{YZ<KEY@Dqg=kTX%||omi@TjBv!hgKVyNV+UCdqHU*sQ(X{VP(mi?L
z?<2jy&DrU%>iHGs?)1`F8>5sWwQki-lehEDCHbR&y^-KQ{&>QTL-87-jCEi5#2Ve_
z{9!gaZXVp$*cDVXS%2vgcGkT-%tE=BV>kT`Y~3Y&_s^930esmvqJpPves)V^_F0oG
z8-2YKTN5w5QhikuwD_rmC$p+M*Wm+gkKZg<ddU3BSFr%o{lUH>TAmxvZgzWAd1Bhp
z)Q_1b&PCXM4Y<83vE*#zzs|b1dtc1At!A7P^w_m#^_Nxe4?ekbclEP<QFcrE4j<QF
zVYW+S1@F0EYehn3#JDo%i0%Eb@K)(EyUi=6dPV4pe2|*>?fI(~$H`wlPrL1~q9AsG
zk^6NM^F>w5qIxX<uHy-LZ@uAqjG}XS{ptMTbf)C43adE^&J#0PH}5-WcJ+3IWA8no
zHJ<aYmu%DMl8k2LcK)r;;O(0E+O(-_3s(uh*Uop>SAWQQpULv#<;B;^Q~9Th^n_bR
zMO`&rHuac>Zfn=$(>u4WoNoCt_UpoPrzINC%wNpOQ_3rndmzQqb@z7e2a^|WuQWRQ
zp6k_n-$>s`ORp`vbJ$M!dAGjhnPjwFUuMD4CF+YKkG{FvW8B+NuNiP+{|Wts?g@4b
zyVyfgX8Lr`K2*dt<MD?{Ooqz(hVkd67`sXX8M&Gl$!>_4-#lab^FxQXSlG0Fdc}4|
zQ+WG@iyV37akF=d-c9f*I<h%W<3jWFtcJ;MUahllUu(|K`TAp-&89bMtfEJp=QZ)Y
zs;J(6s9QK?!vpz!E)xrWCEi@P??hC~tt7n#;WkHHTQ7v15n8s=HqOJhYT{MPQ=9&W
zF0tDmR-EG0$k^5ElJeF>T;_CM{mwI@f&A-yv>bj)ZFdw_Rqk$$QU7&N@L^l}ANi^a
z3C9<1)V?=wg@pHZEr0c&t9q|1PuXI)^BbSF<vW9V;oVIOmFM?rc33eA>?#hlHTt&M
zM@HibGi&}LkxscanU%2)>3XZVRDM@(-S=eA%FV0PYM*vArT%tzaSk!rxap<LHKpFQ
zl~xznLPRFc319I(>*-(Co|%ue3uIPJ2oGpif1)+{%fEX$^VlV?$AqSC=_%gcSDfB9
zMN72s`vsHzwjbgm>a~w;KUn%yByz$x3A0z1Wu~rI^xW|wC-LjVu67yE-L7#<{ARjc
zTjwajm)^cdw&1{N>#|M%-o1}ze>El1?JnQ8V@4krt-JeT!nrBCWe@*6@@cuS)KTa4
zrt8kC+~s87w|VvNReT=Sf}EcwSbx8M;Mu!3671(?U&MT}-&p=ZeD`+a1&VJ1W__J2
za8_Du&vU<tAC4S0sqxx>W6F0S{V6l`#6)I_cw7?d`)|GG^mVz82kYi87Jd_`Wf-l(
ztiRj*b*ztR*!~ssw>mrO9Oi9$^=BDdRj=oUErm62PR;4zKhdM|O8>CrGVN*Vm(tJk
z+<3C=AItoZ&ub1GnBuU1;;LB*Rwep;Q%kOI+`}Gw)yzfKpZnAso1Mik*EcPc$=mhv
z&g091g`cj;-Z8%HHNi)<Sz?oTQ25#Vw}aGb)BcBk&8=D=?ega#gZb>L`)#YDxi-i@
zyI%0?+}X67JE!;Bzp1F1V{9G&)^aVsGi%HB{fQGEzFU^(lj|=2>UVaCjKlJiU!NsM
zG8a#pv*z04O_yqKmaf0`_t~D-01?xGWxl6Udp~Z;7h%lbbyUsn$J1Xy=N@{Smdo@d
zo@qHS*FB}_UGu)5H+^DKR<8}yYD;J?$ZA~up>5%tvn;7LN_&|F!Z$y0+impxRp(kg
z7xO*-E3XAh);V47cbU7nA@;<LtHEkpOn9vVc!Sm@Hf+BeeqgTDoBcP<SN%V?PS9CQ
zuI2jff<LE<Enc*!ZF}X?_qz4*DfXK)@0H$<OEp=Wb=O$jqfqaBXPv<5qn8A@6nmN<
zwAyqWGfT+c_SVSV!aHTLvPHjSpZJ@A=FoG?@_1!!9VHg+U=7i@pS5#(rTLqgl~1n)
zTzs_fn92Oup3hG%=Y8V5YZ6=bZ}Kbt<8nV!5=~OwB^!C#&K=$RtwKO4VwIds<eg(p
z&PQ(Fm@#RI?FSbd+4k#GvRzhOJh!Ip!BnZF^=*MVyI8-3U2-;&oUo6fdi?~eL+=td
zzgn|o{pA|Dwsl)p6$S5!{<drG_e;@V?p-<7;L^BT$7JK<3DH5%7xHy~I=$$zfzas~
z)!ka3R9_v=PM*?SuJy`k_L;%}EwKv|$|hc0t#;Bv@MXN_@3qP|xqlm$=g)Wd(0(3$
zc23jYwpV+$<oZmx`Sx7u<j#QlXD59#^pjWZS$(CYK4kBQ%dx4KwXU~JWB&U?l}D_8
z+v8g49W!q1U-)zLw(r~c6UEMbtJ4r_*c7?{uis_+ltB5Xzq=;thkJeB@K0LE?fJyR
zGlaXm{QEuT6v{^(k-dK=@yP_!vj)retP+!a*?d;A!L0DD@zt-#Rz6<7d&9T(Ei#EQ
zyN(zizPjJdJN^?xcY>z%`xVElw34SeFH@f#etP5H3#U~~)Z?@2Zn1wqI_u~5gvjzQ
zT@ps+Hy2H*GvD!YGRu(@UU8=+;(vbdK6pJ;qC);`&PAiwk2&X*iyRC~y>g_u(l_z@
z#BDJzUTh2gqWbwk;qsPc%jE@K4b&OhIvkS2l+}u)6!`D><}Q)Vji`yfu+hdRZe6&i
zony38M*p1nzp{=K4PPH>_H6s#HOcX8lvz>X@<x}b%JF{d7x;1c|NEXNx#l~^#}3}W
zvb?OmJ9~4_uZVNrzvR)TWe=*BY|MGX{Cnr?c^~$d96x2WZoOs4XPFHWuUVO2ayIOf
z-R`o^{XxxPlbJfo|HR(fmYH)qd;1nl$vd@S(Yq6i+&*kuqj^X5=gfVlHeLG>B`Ou`
z{JzL#d1w~*=UWS!uj@_{Vw`C+Rr&e)=+}2E{SLjDu!=R_cF8mEy<eTr{yM&nH*&w|
zRsIJO=2qLS8(+3XneUr&BYASnyW;u|t#>)0HBn!g_^on(ewr<>850@(VAqT@I~U$$
zt-F=eY4_^rp@3z%jR6Lwz3=Mef9}tJp>d)AT-+RU!`7q=%f5WRE8fW6eVeIZlfGTD
zhRVIni|c+&nfz7gQuv*<OLE$8ertcZfvv3nW?Xj&Cu9A!n3;drosO<|7LWQYvTaJf
zN36tTm93{9+uY+geLtqH$!ksIewklVl?<h6C(iAh6r?-t|2l;~dQI+(;RmJ*OKhH^
zS5sGh>!)lrzq-RMwIfx@oM{g{*DUbt()^^LFjpt{$ztA4qrIG*M>Jd)oYME3wM%Ge
z!49h(o0MFem%OQ7uKW1zj)(=vBP=yvU7cw;G2qwp@9VpdMt|KUe)vS=<!|YqZ$5Om
z)hzMr)9Tstos6&QMyYl!o;pv&A?TQl`}DgrXY7~Qb*<?uQ(ByK@-DqqBIn{>HoZC`
z)0DBv-)=HP=yy>sKGh2sB6o<|%xcw`8hL?*<AKt*eI0taR(a;V%cDxJ=-%VqzEaL~
z^$QWVKDGs%jb@dZy-~|=|2gw)7wcN%wU#_@FYM>6j(I%&>7M8f4tG1x=U?d-mEafN
z!5aQH@zK1u**z;-mO4um#qVAD$?)i_N&EV?OuTSpkGw@8cctYlw?lbb8sEN9Zu4tA
zl_uezu76M?Dc^9W(rdpP1sTx?&oKD>-gx`PF@?+vcC5ixVfzm+KI(tX<b%5Ap@p;W
zZIRvSb?3%~{k}mbo+<Kqw)V80ICgUL*5CV@ZZ7>{SX!nr`=)np<-!N|;$}xB9XwR^
z%A_Zzruup6{rBcwj&9tSH&0h>Zqe_&_iV9tLT-F)Xn_`Ay_J>aSJ^evi~&7*@=QDH
zZR2(=>xurF)ni#w{Z4n~t}i}w`3|;pyk28DH{`7(_y5P%yLcxzKAO8bbmEh1*%~`~
zw?^j9wY>FBFXynSMA%*V{`)iLZMZ7KbHQ)Hp8t~`9g`QnJ9ByDoUd8;V$G+X=VIvf
zFAONj+Zem-(5}~y^3JD49W1}e5p1wsYU+$HT2gxFmTaE+A@P5A>%?a|1x5THrsNvv
zbicJQ&DmWSl6GviU$nr)U+(MT_V+%sbB$v?JpDy$@WIea-C3nmwdC7Zv~FCz%At2|
zz_SOE3;(2iElpbO&*{^>;%sz$c+A}mpW4l`51*2XcTPW4(3hU-yRFV<PwbwgwbzaP
z6?vl_j-Fh=c=*EP)m}SAjJM`@f9syV%;fBkmDk^V+HyV9_x6enE#K^K9oTyDvBWw<
zpN9sgW85uwp7zL`>Ap#A_MQ4$xx5-;6CED=uC}?y<GH!}y2#=WXSQ^weF(d!?<|zU
zn*F9HV6}xKJ8y@F$-!ebXTGON@E4e<et+Q{`=!_Z`uERVUf1m#47O-J`}J$l!5dMk
z((e)yWj#+W3W<7S`-4Az_SFS8S2?%dJiJ9ITylbEK=IVwn#cFw_L}P@=yCBtc=dMk
zM;!fb<wy80FOs|cWP{|~MQOL@d>6ZWWQ#;n-pRsW)3V<_s{FUr!}Rush_ZJVKD9DQ
zb=th)jcL%m5q#2)fxq>o?e3yE)?1ZVW{C)V_K<ogqWpTR)|z~&oU#v3&cA!+7?;X7
z^HxG&$a;ggs*J~?25up?C&HZf-oKRCP#c#j5%$u^pn#d{(`JjEycUauO=k-pR`5F!
zw>Zjj)!H5v)9WYWGZME4%dYOzQ1+U<*ZZ~Nnx}i#8|IaycBsYXyehOYyq{hYQORXm
z`Ymqjp4HE9Y_15YI5hjli$;;M`P$nrMnq*SS4y6_YTIgF#niLsR$NFsv*=cjmhuZ<
zpJUd7)`~^1%{sEKHWvgHekfV7I`R9SxZWFEFU@T;cIG<A?i9Xu+po&W9^US@uKp!v
zWmi@*J?T@4U%yIn*~E#4M_z|~=TZ;J;#n)DI^S>UOU9j_e3!?pmXp&x&icX5L&D{V
z^lUzfY_50rrMov?|7zCo?Ze_7URK-=1;UQ{&1-xg@`^AX&bT%?WUj2tMx7Pi(;D5B
z3T7*-JFQ9)w%NL+C8s@l*L{}rENg$ef7-M6^LM|W?7}m3_AFl5q;@IdNRYR?toTor
zJ661P8&|2@Zkw`v5`XRbTK>dyUqTySuj^E~r+Z^h`^-fa71kfJ^LK^pFu$EMy;N<s
zp5hxh7N@B>LQ0dKEWE$t@fW$|ukT7u&9gW)OW`B$7L%jhGi6-1d2W~8$@!sR%bF}c
zohuD34pZY2XS&?Y&x|W#-tx{i;8T9J_`QuR_m=WA&C|Z3__E~5!=5kv;YUjvy)N&t
zp1<dXgo^f)KB+(7J))-EaZsM}<7B_Q?w!`0#wtUen#D5@d1X5|7Fo|+pOKWa)%c=h
z*G5q*H~Ev%*Z&@fJ^b>vbHg;AB?lK>QDu@>idNs6zUt01uSwISCH>vf7YCh4zcu-e
zPp88Z#~D6`QN=DRxzBK2nJ>QGqV=0?$k|7M;qBd7j8|vmmY?@hFXO+?d(Nj#&|cqJ
z&9hA<$8YiCg?-mIyPn_qYr^9XK1Ys9$8KD`W0{}M)2?jQsceiftJ~Hb`ILGzm-YYu
z+QR7b-p&&1)|(z!aP;j|sX0nd`)36<-AlCl|LyoW^-||uI@>vd-%l6)P;J~5x9^zH
z3Nt@V&;Ca}J&P7wFX}g3wAbtP-?wTe%MZm)OL<-SAg?0g=-H(rCGzVR@s!<s*co?d
z{r6DWgUZIuvR3Cl*YjMCKF75w`1R84l2n)b(^=N*bA^Pe@BVvi$srl1_KVxSqY}5*
z_{=Q|y~}n=>WgdKvtYY`DXXO>S?^o*lzne?piZpVOK1Ccp{lz#)Yfb|W|8v3BdjKB
z@7d=+Q#ab|Dri32^I*@a$;?@^(q?ggN!ofSW}@e`iQQ?-ep#>9pZbPxbLwH8R|4j4
z!7~2Mq3b6ue8sPOq0O2_t4AW%_jpBq#9GaQd$G1p<P#G=d%b7v*^@tS%GC+YWioO{
zlUiq=a_(8U%_Y8FaD(7gk<@dilURR8#m>9^??BM+*5<``B)QU`H0}R*-C+I)sef&I
zGTCM*Ut=hX+NLz!`wv^j3c1)Ld|wjc-f%P>D(Ox$(JW*7$kp*<<-ASyu6*iJ&zS5p
zW-SVS&#)$Qk4T+I^u^hH(~l-`S?@c3wLtjd^d;u2Ek80n@GyOO-00B*^>;FlO@+di
zepzZ#UpRNszb$h`_pH_UGtX;=%fbSUnU`4ADj&X{ktB0RW0f4ozxz7N3^$cIo0|HV
zFBXl>HfZ>v;uvk)onGCk7<tW>N3qsb!Yi?-K6_S>INt^9$tw#Zc^nVOYD&AE`qFkm
zs%l?ik$O^DW!8Jsh%2Wb*u*={{{F|>XfMnBqspf?KC|WaTy*h3)>`R#9Ba9@&uDEZ
zo_}o0ZIzutyJ~x^m#wQRzuUdHL(t*&ROLvnkCNItj5=R-e4X@FZI!XunatT+t=$qh
zbW<zWFVWezG)`>#>&$&;w3Im4`H94B((ixQuXC{^J~DoxcR-u@H<{_L^%i@lnC`uO
zR`y`m(U{h)Et@k~AKevL-){M#>_XbAb@9!WQ;Mv&E|f{yb^F1}4cU&958V+|6#IE+
z^L}CBhTEollDBmRuS~yq`sRg6ielb}kN3Y-eC@jI6YuY~2|xO8T66GUJ@#|LA--=v
zmRa)W&)T}wH+IdI%6XeyErogK@vraR9hFwFs4D8_#Oj@2>ohMJewn{$!^G+4R#$tE
zpL~&58hZ9})aIGTY8shLi%hl(J+?i6c`C#7{ty@QJ<U#%r_#1)i=1&OmuA-A93Gq4
z6teL01BU~vwZF_=9Hx_VgPp~{m2;PN*x@HjvyM-3^KW<(#@17v6&=>RWnM9})9mP1
zCLz~8zSwY~%1*!FdotfFfskD7#D_I??s}iMv}NtFN#uxkZ<7f(C@&JckjdbFWP0){
zIq5AbuV*<wXZpWa%iZJno2V%=k8Ttm_J3G&cIH~emV<4V16SoQc#){SvtquirahCz
zZKbZ0Csytaa{9RJLQ2nyiv~BOer|QNFS%qYH}CmZo!XH3_utOnGxb=Q#-+TVc9$wC
z%lmVJt&+5swVceGmb7Bsg{!m8OHRyOz*}PZ{gFr3Zk<#feT4~?B7)O-V!bWjOrFlj
z7{zzTQ2GV8oO8<NXZ@{bH>Y=RI2?H0Xx5Df85e&YUnXpJ%CbV1Gt1Pt{7^u@9v4sN
zgI6kVu0Lzi-KklumijD=@v-&nAMZcPtvtDvW1$4!-vcswc}3iFlAr5HwlLoou#P;#
zS-L2+<ADF--b*hxJvne|&VqT5D<oHKDDIEH%MkZ#G0zeyl{UAZYivJerTlzUHf?s^
zfk_>T%Rad+JaD(nzm#EW*1Y8xbpz{k0t<f%{ujRc_Sa>-h+UHTU)?9miuAg@E}Zwu
zgd?myVb6|Wt_`yuE}WKF@%huT4!6L={8fKMPVO%Hw?4*Ib92-byE#Y8Z}HD#-g5no
zcfD&5pYyY1;awu)%B^Ywe9;Zft`{%)t^clI_%lhl;l2Envw=qYC42wb?01~h^M*-J
z{P>cOSszR9e9@CFQiy8*btF8@@4kUiC7*8Zy4o7g`D$kl2FApcc4{@x^X+t4u!C>T
zi6leaZr_K-VsjQ;o}~EJ=3EQAJU>(2?z7R352vO4`@ZOm{XMzdM~@FnHeB8BlC*Q)
z>zK+9_3bmcUkmctc20l!aEB#Rd8GcbpK}G7K1?!{^)wPz6l!C8V|H0C(QU=mugfkz
z3T_OqKd}FMC1=~A6_M7@TN2q;sw~?4dgCQCNolrK4YkJ%ZnvGfAnmp$Zd&s9@+<9e
z6(<T>vV1(*Yl@CdU9mOe&S8n{;x^-gb$wag*L|ZHZZJ+iU31Ke?Fnnklp8uslj2{h
zo?9fUJa-1GyOvyeh2;CXDLXeCrrP{qxnx~adH$|Yjk4Y&Cs*ZQ-QOH4Q&_vdNpStR
z=q?o1TX5z*tIpf5Lw!$=1o=;nv(#xbxou`%G(U2g#N!ub3Dv(3F?$_#b?<sSOZMZ5
zBmC!BbhenMzhNq8d@?J*NTrU?{F&ml;JJy;!uCb4x37Cx+FID8(amrnqbJk*Zty8h
zei5IO#*Y+CrcFFj+ub&4#yUst6>5zw;u5w-D;e5K{<BLM%2z$)wKcoTBa{8By3vT|
zh`CcOyVE<JWjdY7mh&_!EEeg<6yN$#_OAO*XT#MQA=?a>*esXdZ0_(uK>OV8{OQY2
za(?YNE8})rX!1+X^b}Q9wS}iYzwTP9aG*h{@Y;H_RTDfd<<nnf^3OQ?N@@D{eg2ap
zD=W8p>22ItXgO2lir90B)s_bi6s>KVdgJ>w%cvtOw%1J#^uNTLH|^TZD_j3Cbe&!I
zXwAZ`#j2}bq;)x&%Z5y2n#1In@8Om>ap~m=DW^W1<=N97a%X<TD($NKC#v#qx~JdT
zU!rdRQswooCn_5b742T*#Qti&pzwtozm9R5-TZOm?B2vpJ5r4$pP!un<h1+Q{rsDl
zci+%pI$e8Oa;m|0kxOi%am`0GL~k*!Jg|4x+z+qVUxfZ)5E9NhzCnH8Vix08KG!R}
zTUt5tHh-L=Iwk70+0B=CrSJJ%cV81y#QGtX|L<InWny+5A-%fi*o8UbWCd5vUBm6Z
zrLf$Eujz_C=Oy2s&;yZ~{X+R0*-lQB>aIL6XT?+3bGCXumwn4GNcX+lCMy=oH{rUv
zxyp~^L-EGH4euBjzDO25cj(Q_cRkrXN%Q2_Ke{|`m95^hi>nKpT@L2<bUTRDG^lCM
z4!iob>Z8PyPKnx*_(^@I6`fr#EYsyV`GBEADQ?HUlu0E=eYS7gyK$yd;-oTPJA3)_
zY<7x_oM)ZSnV2ya`f%>L_w!VM2AA)FG8y@&YO`0=>^!pM{hi`7^?VCGJS|Ee@$3@d
zx{`id`Rla5cNP_kt!-ZO;cRsK`3DI$D_Wyt;_V*SXsqcj_P>!(XnQ1hr^7MUy!}ab
zhq#j)PB4^aP56F&`ke1A&ypwg$4nC3w`@TxV^mOilHFmprHvIAZ%K-6->l;B<0WsY
zxs!yHip1)q0=Keh)xXW3pFN#;{j;u8bSYod)4LC{q<zlqTK=^{Yqxpl8Lu`s?H%`9
zJAVE)uw0T8C;sz?WR}881FI?GTnbNjIA1TUy_!7j;6kl=`LEOGY&u)jtFr7>HnXT_
z#+&piBgQndGz+`%%=fpXO4h%;nmR9S#hrHDfE&g4Cp}V_XY)&AYu3?SCw9xWEuPx6
zVG*Cin*AI3cNt05T5Y|W7POGlkg4OHH@AuU^_*94z4z3AJ-^zd%#PJekj*x<tZ`n!
zy(9kO8}Ik_wM#GB^<z4RlgIDonOvonuU}L&eRysp)%M_&q&8boAlo?=ewX~Y&c5ZI
zEtj{31&GXa`X1!IBEa;JTXR{HM03#x#)aR~u3zSQ<@R^;35h!^gbE)z&wl?QjyvFF
zr}dHv$2vn?CIsp{Je|F7S#)=c%?6ddU+xP2e0)4Ds&vs$ufn!!x2^N;EdDuf=h4gA
zNtP`Ja|^gP8(!Y-KC#f{aq@~HM>W}`=B;v7o93x?NtRho;Mn{o>hG2{uG>o$)XX9p
zPpfWl+xz8u^W<Z$84jBBt&V&wtC)RV^1Q%?W#Z+0kKfErJCYXEwJ7U&{=%g>7hjkM
z9@DQrWNP+!=6qAp-#VtRj|H#an0DK6>&Bqzk5>wMOn<y^WnQ|dgGOiN^I0K`CNlQ(
z;#&F_etWExbzR~Duk7SUmhDz*SH3-xwKx6yRpfHa4*fjIyil%Z(SBEZcJd!f5fFRr
zePE999uDE$t6SWjKFQp<X3sqT<>GJH-W90)UsljIL*n+9FH<wJ;%3g14E}noqG8^L
zwDv1;xi1R7e0a~h=BAO#TR;CJM^4N<=<sz{OtFc<a>v*`%lBs-Un$1txu{^dZGv8)
ztelR-qT@zei!3+p)|5^0`;ad?(|Ats*2Qfzf+sFssdpmbbM$?^WsXO)ySk$V>z0^1
zbWgh8*SBD`Ue>(s)Tq_g!HZv<Ip!H9Yun_?D6J_|e^l*kMAH9>YjO;3+?Zrpt#pp5
zEV(bWx1RsJ)|b_bH4}2ybISiapnLm>&(Z5sDz$3;ROc5K<pq7WpQjl(U;j`V3-{KC
ze78*hA2)7of7q?%_q^#?bH(2fzr}Os&w5$dv;9?vTk1m>$+_K=TIL&Q6xE73S;)tU
zzF6iQ=NldK)-snx^^lK2Oq~Mj=4U+y@Aed3RR}!ztS(Am632<R4?CB>h}-10i9f`>
z{_K)}&iaN&w=+EC<Lk7Z{juevdRE_B$L)7n=DoF3*X0ye_nrMrW0T+Ji?Md*H@!V3
zZdMXL$6FTvO8LxwwkXSLvzwmpyW30Jb2$UNv)XF!y>FMPypnlb_K?6eX|a9Z_bmO~
z7%qOYyRdfU!a1jAcyIQq5&k?=E9B}TeaSpczPzl1-#vfHBzn~TlbCrzZn6D~V5wj(
z39pB32SZ&2M1SVF86Mg??M-rp<VL3_9$O#1OPiQ^zf|_Y+tSo#^F$6S_PkZk&F^kq
zzC8Mn|L+~rPktrMPT4-quY1evIhEOS`qF-uDjr~EeWM*-{)Y9mbhwekwp6||GA(=)
zqCHoKSaY-~n9tzIls$QayW3jZaJSy{ii>h42V1k}?YFbJS^x9d1B>53rzaLR3x%9N
zGW*ZF_jysb%6~6!m*-!wq*f)V#GTo2!Icj`Ig3jFoX-$8v;Opa`=_(Z!hB@<48&G=
zJpV1PC!v3Nv-x@bw)<6yw)?}~{+~YF>Bo@zQr~TUfr-HFqknP~kFDKe#8bsrTXEmV
z`^@pZpF3g-N_I@#9`d1|bNauX8!y~;m1&>R<Z|bKQQ(=`sRlXjYEl!X#Z}EZa(SNr
zMY+k#wg+k^C2?8n{j^f6Rmga2$`x1r(Rj(v#Ud<PF%rcM)s9)V&+Sgt=WhR#wtH2<
zuBCyqcHUQW51ZN$tgN2ne`AY|wifrx-7Nk_4Q(gaHT*Bu5kH~4Fd}7x|1<3^bFL|^
z=Lq|<+3Q4t)~k$Db2h&Bk)6tIam`@M=9&HP8vZR}*vQ^*r@X!K!`ydVAKny5oe%$N
zwsn8t*2XD**B>`Et;`AjzjIZ7M7FG?%>B=AHZU^Hw7t>Jk=I?e@AvL3_uy~2uU^>|
z{fY_R{BXjLx<H-ur(7Rm7)|yYbKgu%U=lm>vhl>qi;edSUT>4HIp2Q&U$1ek!8eU^
z&xL1&6StULIWAM~caP7iKTf*h(wx6Dny)7;dfUBw$qe1F@*|oHJjG`2p1J7@ck4mR
z+s87c#r8NlOuTe*Y3sskE1a^|m|B)@)X3&=+?k>5^u_R9a`88|a(k&)XEz$|Is0l(
zbDZl#mDDd&F1el1yenmK*k5$V<7;<0lVexUkX%&H`?#}b$;%&)xc&*Mz4BeK;wYbP
z)>Zq18)I}@w<g+p{5e=1pc-H##Qmj5DZbmkZV#XP$>15My`$oPncgzm{xiF{D%54y
zliggNv-ce+mQ~(*V8_+J8_&mTq(5i-o+j6OyQ-OY<>aXkbXJt!<3FDL-D3eObK0eK
zwK4yfrd8#v6S}f4<MrEVwzaclCUnbHUkE>~`rLF0vz}v?w)NwAH6HCE%in!*SQ@y|
zXHIq8vCyQns4q*McW;m6>8zXn_RqPs`9+qGf2elY9eM1*k$555bi?{@AzRrdOMYvc
zw`Bbk_epbnm%Ove`^PM_r<(1nflK2jHf8RGvrAlkG6Iu}zu(Ex3A!3lI>+|s72jDl
z`)hPnPRThR{gD2q?Cy)1Ss^pmxIL&yjC<Sm*tPBdj0b^}@AS8ydaWdRuq(tkRc$g~
zj<utNz-0sZgX<1oZkZ8sSN2hgt<9Vxe!B8ggp@;i6wSXaOPhad@fkDLZC9>ZAKm&S
zZqK#Ql$^RFw^^&6q@BtwT=G+%?ak^FN6s=9$^R<+CbaZna94b?^s`gn7!G8_#{H?y
znfYDFr=sk`{Pp*0EF90CIan{Z=T|}3uQ_j?$NT-^m=L`8x9``5uU9W<JF|4&k)57m
z4>|)+^UP6m+ccqQpO^5#GmlSRY=0ciu730Q-^YI+%lj`{vn2R;c6p9$g<JIAx#>Am
zUN#+=+x(<u&79Z$He4abTTiq|Z#WR%YVl6Y%*bKJAz$&?M{^WQO3aQYMhnfBwBkFo
zaO)bc+8WC}iu)ICU3$1NsA;)~R--aQWt(C65lKrqL#^Wx{_pgqubAyC6p_nZ`r~9M
zU(mnVpP1Bst&`6zhzRb?Ipu0pWb(P^Hj7{J(iO`VZ9E-i#Gm)yDyO%KRW|#+%rVCK
zY#(Ou3OW4v^`zwgmk*)eo_$C??wjQJ$NZ*>`W3~!AIj!ioM+bBd)8@}Zb{_n)n~I`
zDm-3%?Na-PuP6O~uZXyxq|4j!UoZP*PSVC{pLWKc?wfKX`mDvm7k(-+OoGSRjxqBt
z6%{t{UZ@or<acSUp<=@a(*+D7|F_EWHavf*@+`k=cG9U&TIt-^0?+U+dLbs)sy4q}
z#jdO6#77~k?{5A3au@IZEaEt^uB9=A<Dix8Go}51S3gy{eUjnID;GANFUNxznH_{1
zx4W<3uFS;qaAL`W&Eb~2uIvfEA9S24=|I1I|2pp<^Y>4*Z=S}j^l$0*bxeO}wEkVA
zdUsELa!<~Vu3i7n?%tZq{ZBi7o4%CD2XURE!gYqvL_7ED)E}KE+jQce=l&mo?9VHm
z%THBZD487AWBF#wL082aUl(f}lKuN@{_o?m-%UeqlwDNjUKf1W%lW{ID>E)C1zmZ5
zad)D;`oEd_tab<1pTBjELs#L!uRfPUAM!j67KD~nA2s|FoLirmuPv=%t30D+_rp2m
z)f@h5zQ6W=)+UDZ<pKX5Y*F^I5dInA_5WwfJ$L5D-@036HaA=l&^olr-E!Z#!h}P{
zNdn0hEZ<J<Ing7qM0X3*&Wcy6VdbaZs|HQJ_{Qx6hh<2!;^EN!f&PnrylIoRc)M+z
zsQl;FS=ZdFt52`<`Sa6v_obxl+j7tMt$fSJlapN>d;CV(v$|tvIGEn9ik_`=A<xa!
zVXw$Fr}ciD!3QpKJvL5$>Bw?ktoHZAvoAsCC{F1<{owg}3!{~M^Z&hi@%HxL@)P>A
z1Cma~vxvTS3AJ2w)b(Kb9=0i_-;2^rLa*8yFIUSpPP1ULOYmN%yrHYe_x~P-h(6od
z%fFe1<v**ubLi}yMQoZY9zP9TCH~Y(?8f2R{~xb%&Plhg)7O2-cYp4jcl#@arKI;s
z{JXk!=4I7*c{d+nX>aH1=qYR~UnMvfzCRJFapxjO<72JBKJ^6NOP@W;p7byNC9<vM
z!E6;hi+B9LZftZjD?GlgZNmFoGB@KEP5*o($1`bRT+Y;;x;uKxcP&f4Znl$k#|`C#
ziVW3!b-iwXNe0#e(N&$7?tOS&$Hn6CJZ^zdr{+P&NiWm9-#)nO63G0ZG|V+<Z8-Nt
zYfklKlgZncR6V}!=c3HINYd8T_2--mjpuq7yz+{!Pz`O-d6jhRpmgwDFNWEN__jTm
z>ZE8ExiDZ}rS2q?Cw@f-_Sb9{?Rv@oZ0VD!nHzMcBpa%COn>Kkrm5+=%zxhn%$BUL
zrTh-=2=|_znY89i*z}skUM+F_852IR#=kbH+kMrfO}6!($9_rC4EcHAbeh=8-+tJo
ztHe5Uf$Deu9a~rLYLTs&{zSVXVNnxvgQ7d@;r#83&m67Je{?Z5`$$>e=|^fBq7#^P
zcvy|AE+#I_F;3595_!F{D|%tmqU)Ud_8isNG<nY)tt?LO3eGKcg~$I*dZDmp@!!iy
znX^t@@ix%(i?uLJkV?4wP($On@TA?15+B7MW+)_S?Mx|rz<b}NLYlAr(kt=zcS4E|
zD_xE_o}(hXe^>jp%xhXKa)}IE>Q(gD%+;HI<Z-rp;>SJ%U9sOq&D*O!sp|{gjQsUR
zva<iI;r&Is9ahfV@ZjwCBgS_B?P?CbN&IolXXWpRGwXjJnw|51>72@*eJc$-I~qKa
zmj@re*EX+XvWxA-cR%)o%@Ca?`P^q;d*77BuXoR5@3np3`gB4apYpBVS5@~4mhCWB
z>V5uP=BvArI8)P8{Ts2rbfVN`1lG*TxYL<@@s6C4;_O?Cjn2hxo0pzEQ{&isE>~VN
zFRuCJlVt--**{;p6Lz{VV^V~;cAw6g)9(}JhaV{A58kLAcH%<In>pHHKW=mL>o0G3
z!1qYs<Su{wsf0V{q8%<v=-lJbvdiAKO5>1&?1fgx*9>>IdmY<*dW(y|DYclE#k(H*
ze%aC?5+uBL`M=(MM?!B4-+$a%u>H+R`Hx8r{MC<k3(Sr=)McnSb;6!qA<u8UG7?xB
zK7C`hM$}cF;Cjt_zx6LoIXQ9J<IYyrmb^<HlbmK1pP$EfKlJ#O^o84())qVE?rmGv
zca!CuVcV^OeFe|geX^R(C^p66`j*v8wHl8+5;%FO)w4hQP^Ftw;k!3)_9&e;>XWmO
zo9?wvv$Fj468VgYb1h<nc)OTCP3fx)lYilpb7X-hZ`(zsDQcJbiqk%SeX}S+?W)TJ
z2bl{2-$M5+Za(bU>AvUq_xJbT$nUG({{P#9H$OM;pa1`5^^uPE@$cr#oJgPcZl%Gr
z11o%9Kdg#dl+t?m`H!g{4`#AzJ(v8q;cLP!164_%o_Uq*|26Nb|0@11P_^oH^AjGe
zdF(X{W1^Lg+8Qo<AAD6|)7G+xXNBd>mpo5hbSn@2{`F9A1pnkW9d6|tw#weV<tJ3N
z!Mx^D^wiWm&$b!s1nqPSE<Juzx&P*u$`^^Ja}w_JC)%o3GB4Y<dWFDS4W4-oHaDI+
zn<R!G-XUZ&uR(3ciGpn&UjMF?bUJd}dKdI6bZeIF;>O~T+M1&q|391lH{M?=K4rx$
z%Z@#DKeLzJ@m%!F`TfEWIoJ4&%T_ekef)axcXRoAf2H%A<oWK)u;_nS`1#F)yT@k~
zzpXdXSekOR%vE%bRDJH3@VO$a$21bWR`(}7WlR74;rp>)i)$9%5mHu=S~cU!&9`go
zzHfK?JF7YHVli)WkHW$HGi&c{JJ0-e_LFnlf)4d|vu^S@uvx3=xzM%^5`p&pT5L;y
z%{8gqu-s8DV(rb%tj<N&%jdKmt2r9K{gOzH=Ry~b{p&S9KF`^Es9|44iI;HlpC4xy
zO_=j1{E-UJ&*KZ`)o5ldT7O+9-a_Do*Max!>+(1>+XOd>bQ|?O4vF4Ai}&Acqn{QQ
zv)*_du)gxd?}k`a<U-~CQv%U7Qoh$sqeORq^l8qV;JAos;<dL$DVn(~f`2Y_?x?)R
zbT>VC`Jv)cWwV#x%siCeMrcfU`DN7siJRU}IF|==^~Qxy$@NgZb+yK+v4(Z$w`JZv
zOZwcdKF!iHezvINWMN4A$%RGC`%dL^O=gntmCBo*vD<-9YRcp3N^ytxKb_PP$msWV
z`{`GCF~=1ym!zDEN~jDzeZj|aYF+EH-#e9`7F+z5xU>9E-;|PFvke5-7^UiEE)aIo
z%qv`T?diIR%wzYMJ&o-ar97U}a#3~r-lPgkADx}=i?a_O5&ZJEC;ZA`QLEy90dK7{
z-#10AY&kk*-<>b>mDnw3?tFI7bm<}CeHNOQ%AeMpc)q&m*;Afu3x_+w+s-SU-}5NV
z*7x)0wW8m$6oVfcyC+TLthnlX)8TvP(~PI9KYoqPyRFNc{%dhk+$@H#GxWHe%FTXn
z`?>1j88NH!m1<c*l`EDwly<0YOn!cMO3=Aa45`O=3C_LJks@?XvG3;EO3BYH;j`55
zmI_W?6}NT^=k8UO``y2Vh2GzHc$NF#8xOO7J^2=5IA{LtU@INb4IA#4exA89ddY0J
zi887dyB|HCP_c57Zh%<P(&K4rhC-L$b?dZVs=U#9<Ko$OOBy@gFDk5l?y2<q%|3JG
z+9i+gJn@q$=b4{$<w&6Gx5ou9yjS!}m#w(G``QIYzCv~1Gff-~EA`hMN_Lw(cWHA4
zyQlvBaIPOu{{3Xo?_ad#*~7reI=4P96Z^U7iRC75{Vjgk7kn>IF4}i($+5$yG(I($
z>t30bE;|2`$xm+UH`h+6yxl0r$$4V$jES;_OJrw=Ssq!ZJY&J?dE8U0y&10Nd{IsI
zx6E34XXSO(M{Dz@><W0<Wb|Xj(-qa){`~izHU-LbU#xar{_NZ~bIrtCAMKyKa$%MI
zrpL?ia@#)fLOt6<?$Yam{;<cn&wTTqwY|??&g#Rrrps5%6`Ze^KD+1>`O_eXasKH|
zYwi|wZ&bHr{=~>`kQnGA_~YIFV~3N@+b(`I-Q(cQ3pH~^R1eRu-6*nj?!Bzypf9#F
z75^HqpI0;YeUa_<=L~Xp*Ji~<?g~9F9Xz${LS2=W!|glbVGL}y_CNk=6Y_UvyV6-c
z9g({%t|@$P=e-ZODYSBp=ds0E?K9(2{@k6`Vwk#lZqW8CxfPYB>z|$HnkwM4tYEi(
zsR+k(;lk!WDPB7LoW74ryRWEtbxJQ`TNocuyIDqS{(?4R52r~FC;XkTI#c~U?~6q*
zd_S|@dG|=X@6?{M3WGjN$@|OWGOw@ie16<irL0C$>QVEt_mfkDqmSO``YD?GChE?@
z6SIGP=$fVYHaYyS?WxlYI|8(8CY|U>TyWRGUashC=Iy@F3AXjC%?fT6or+kwBtUS<
zog+aTcll0M+Nd`FQDKH|`%|5&pF8K=+jenkp^R~o=b6yYR<<uAEdATRRc>7LMD^kQ
z8n?@A>{EYl%+<dZ@zx-?@OJJ$%joO(CuptnZ#`GNxA&y$;&t`kVnh!lUC(s;e?jhM
zn0430zJU1is(sR}((ldcD%0Oh`M+RUlKEo8x`nSrm+bNXvu)yZgWx?gr)DU*>ur5K
zCt_Rc0oEFhZ;#!Zd73WGY|qoW_jJ~g-@HXKZ0wV-Px7)`ernCiiPtAS$}L}d_Mq>^
zJ(rz~Po0lqN&OfTopvK`!3w=uvTd`}Ow=5uf349Ivwd?`Oz`-fYfE!I<}s{Qs6K1G
zfGMMnJ3hKZzpv~HcVcUr$?Wv|YZ|UR4K4Kke2gP&Qsd=@8yh;q424vKW?C#w3=`sC
zoMUls{r)o94b1-6lk9fQdU`thY@-Xu{Er;BpX}H&RXpTQY1FspuP-+X7ft^fn_N2c
z_|KzmmUGI&ukt0|pQf_Mgt>Rd!JC_T-hNDqt9o@$W#5X3*ZWUaty(u@smuxE1uj_|
zT9TK~V0+Fm*Wliv%Q-o_pVgl!$~QGFywkDhsOGuriw&GoIuCP3pEvwa%(iAy*W`C>
z>y0zDb+o?<?r@*O+H$nhB4d+``1TpMrDskGy!MJi$C~K{XY1|K<oS#KJQc`_)u~cl
zbNQ94l+gA~GM0fa)u#Lt%2?F&W(%9Eb>>?2mwX}jZ~DGl*e0^9w13A&!S*RrdS|jO
zJaOrNcd|iWlYvE4)vW6_d>YklN8=s}i`0E!pRM_N`MNja=CU5;FYl;UCoQ)X6)j=(
zaa?yr)q1z}t$!}ooR6PY1+M;GG51YfL)(EFujZ{WoU*!OU)QNJGu1ygYl{2+^N8Mw
z>x#T^$>)LaueOy3_Z93_Tyw+y<@4H1m06h*UU^~qTaDBho=PtNe|24s)p4G?iyr)O
zR4!t;?2&%kMxgSD?=01d>V1qA9h>5~yY5{%>LsgZyEsg$;m+ObhqN4S@6xpUC3pAU
zgx1iR=c?-#FIQH0$fv!0+RY=YHPT&M=VX1_|5o+9^-7BliLb(;lV4d%vY6eKnPn#C
zJ-Pb4*zt20l`WpSE|Z-)@8U5f1HU6Xj9aR2?}`y^wB5T}Wu@wJKT)Nmpd)Jqw|aQk
z{F`#+oHf(JaCWxT@0p9fW$q{z^f=Kky!Lf#c=$8s3)1%j)TQnz3LU$jvm@!_sgE~b
zZ;IddHebZ%Uv3L;$F7A{wXM^_C3nT-y;$h*g7<0O>ZheoeyM4&XKY*LcJ*1C_~}hi
z(^l{9Wqr6}|B9?^zV79F5-;v^u~`0}Eq%{Zab5Qct2^`WGd^bjQOu~k=;OOzHyQUt
zv)NtfvA7ht=!MU*9}Uw4K2#Vjw7oF>(e5(d+!Y>ucW=%3Enn`Ob35?9ZcO@&2lM`^
z-V0vsdG*M(O;d6&#%HJ=@!F|!{!(I1rpR{f>6L<o*Dlxk<t|pSo_#%I={v2~CvEcs
zf^}}0EczqH>n-Y-{JQX9MEsdJ(VsgO+)2%qym3o(52McKSARbqJbCcr@#Z&w|Go70
z{pEkHV0&Bg&1;TJP8zz||9|-6?Cizyn<mHK-)C9#{j+Dt@>jjDJ{qby-_`Q&yZ9#M
z<uRSDfr&pSSpS|J#kep!w4cTD7qiT!scW@wdgg4Z4}IkQqUT_Rg5G@5q$4p4OCOp!
z|8k3eU%~rl%TL9M9~)NZez7?8J+>)vosF}l(T*qc-tkQ4XPEWIX|9vt-3@%}n-qV(
zo@f22<BQOV3Qg-xQpI|U)zY-H8KQizuU1;<cEfTC&vwo5qoI7JT~CEh{+@Hv;nUd<
zKMishCm$4Awo>(ymbA2ijD%Oiq#0V72|VnX=dZdPSo2!4Y-h~I1qMMkYRt95uU4+u
zzU+g}h3d{}5BE6kpQ5r#J;wHBV(UYe{cb|>2Qtou94z)-wbAMJpMa$%w(^e(*`KB!
zx0&5_QS?oe(_72X&x<b1p6$GKeKku|IMcR6oo64fJAHuRJ^!QK$-y%mkN;SH_k_+L
zAFW-XtKX+d?7no%sq%cV{mkB@9JY7E^EeB;+E{BVT^eo|m@pmw;@aohBy9a7phJb-
z?EQnu^SbMAt1SuN-n`-AoaQ{cZ#}=0o=4xl`AsZ1<z_K&-M@|Lw=O@KuJluU;<=`+
z4xeRCJkn)7D=Cp*X)-^xJX2xu<)W~4I}GNx{;bhq_#`sn>RO`}F8?*HgzFYOn#E(h
zPHdZ=aL?QGVT+{$7-F)7QZ^qtUt{|?=lR~M9c#od3q5(PsPMA;-_6b9_wI%KTwA5G
zMCQRlLk|r_)7t(yp*(*oeVo5DUDf*`_wQ$QxvcC1#>>^&nsYxhFWNe#axYV-TeN+=
z$m-~jj7`QT?my*ybVlI%_8sCC$7X3P_2!liu(}|f8Ikq+_qVV+R&QK<52PtF&UQVs
zwj};UQsd0b$qws<dpC*B_VAt3<oWrWnb9}#>_1l>YD?I+Z9Q4^S$0><-5YD3Gdk7B
z>K%Tv=H0vgj9-u97&fL}b`}t`|99(Xk?l<5S?BGymgvt~`!wXBPpa3QjO$V+0?{W~
zH*jYdb8d0DKi#ZVqj!z{;+X8U5e`jkF#)oF9|?&+KmJB3_T-MgcV=Gysg=L0lkwEQ
ziSMsXxN#>=@uQ?}VyESisEHgBp00vd*0ME+nuNWW$ep<J{z}JG#?{+{qLin7mp^*3
zmTg~loA2Y_COf$29CKn?JMFdLKdIFU6K~~hIBI7S)vg}I^2s67$^FxZ%S#S62L3lV
zdvT`42~z>5^1FJw7BB2B-PNpQG2@Etr`HFZu555Pq+wDj#PagqydUmXvb`eal9H{{
zS{N=${O><6^x!oklj_Q3lh<E0dRZU&Tc$<tKJmi9(o((C_&{&yu16h<rZ=sNDpOD|
zm|bD3$n>`8*wMMwr=D?a_|5<9($rP$PW$gquMqN*c{XqN3TK`vQ#d<~dQNCD>sYxh
zy<seVedm9b)vI#fPI0_zpuNFadC!#;_HXyMorx>?w2qrExUsuenq4_Zs(r^FzZXUp
zm4!2whb}&9s<Z0FHGv(UBV~6p<sDu)yY0lv{zHrEnaw)?l^)jm`*ZO|?|PGIvBxK#
z+4zL}#oV+rvrTTh&D}H6@RF+XoZicCx6COJy4^SN;>=Ce;vL6+rRC2$uXn6+5_50(
z%aE9xuBvxJGcTA<I~aLq_o-})L(}&9PuV1HedN2re2$}6YmGh~n74oaMZOwwmy2CT
zeUJOwT&lYBYsT}B7w7C2_#Rm(x%roohv&;M!J7<Ur<F%WUe8wjVHKh!%cpBwb?@Tq
z$d|rTO>^h+*j|ooygOy4f~sUtabxwtqxIhz=H_qh`X-c{*Z3t;!E_bl&rLqQCLUoc
zDhqr#3ucS|teDNW*!*x&sPYpz?d*9=qgBq`d#Gi7GAYvMl)uM>DRI*l2Uh64c``Lx
zcb>1|_sNo-*W(SRuAKi~@!nL~H(i!8dZ(p%vce^QJgKh>wRq0b5EhmHgFo%Vsyz-%
z&lVhi*|oZ*f3u+U2aWH49~aM9sJYZU_3m!*sDnHGOik2nGR-Yd3;vw)P1&dKwAF0!
z?QXW)mYj)hy|Y*P(2jO<^Ir@u2V~c>_xgr5Zr3>!SNnWkb<?zTnM{G+^Pe<1f*xC&
zIqhzI%oFaVm76g4!zb~p52PPm+H7tpA6zrNDez?Dxzwv)=WUP_Ren5E%ixMy>dtpI
zp%+g}y<(WR@ZMJD^6<4mH<Du)%g=o<!}|%}B|jNSC3(ig-iWIAB@b8sQoQQ-!vAca
zh8NepkhpW&79|&tzgAj*T9B3X<n!{A7dd^-=GvWmpVjp+PI-&y9v687R`2k4b3-oI
zL^j#<?yiqanv)&UrDm;K@NN1}lY=uHRLtM6@Lqn8|Ma4Y%1^uOLpJb*pUmxBb@eq<
zwSk<t#HZ88w3aqrvzB4#JexJiQefs%HCyKys;t~@Z7aeiZ4$fZdoB2zVQ|C>BjrE^
z)wV{?#`i*3_!Qk&9q4%Exzs84;DS??k5+GPd$#1xlD=n`i`|y18^z^c+`x0*@$X?n
zje|wbXWoXY|M!?DyjQgUpL<hZ*5S!-K0JB+vOaGEM`=icmX3~F&w@Nv2Pr|;DPE;9
zqG!tbw2!o26>Tk>wfe_L=|`4JHpodCS}^{J-WAJobG~j+PoQk>2EpeW&O7}MlzSq_
zFZ8?B_I>9^`{HBw?W;GwZgU9cSvK#c+|@@X<-@igxUlm5^wU{;Gj?CUtQD!T=b;g2
z#Qs0schn3Q%rH8)%I#M0w;z&aF>(F{Extbsraansw0WKW!5_R4Wnc7f$L7`EE|3&E
z+qU@X{n@=vHOf;3E|eEK+>V&|U{meFC#Ca~?Jt!bY}0aGnOPJ%@Ah2>)%s0gGF-an
zmo_Z-bBJ|&DALM*bhGy)t2%K5#}~(rt^aj0y!uNpciY^l{1-dD$|csA-A`CxJ#Dsg
z&N^QI^hK{7`1KmgoUZdQSfq3)=XNbN_Ux}zn{aujxN?<%VATTQs&~GIwwKu3MJG+1
z&@_c7GQsQeEYAZGMH_aX<(PTRr&Bs*-W#3v%O8HfdGXYK>bc1iH#r|txFfIk{>e<E
zCEr(_aL(#t@!B$DYU%SUrsu+*W;DvU-{IriH~n$bd*NK^oYfNNLpMAA&707-w&23;
zq{vutnfO1`DkSIrX;h9^yR~f2hh?)qY?kr&`s{VGX||2Y8Fib)-BP!6%x8Bpdw=9T
zsPcc~X3teqK3dH2GTmFXEpy9l--HeP`<IwD`NU`}pElR|Ozc)4zK4;o4Kg!#Ja}mp
zl+OBHs$hxs23?+}GYh38tz}m|de-RYeqH(MOo>xFE?jfB%%3KC-FV0AxECe6BSTIm
z&CxN8-Q{rj$YiS(yd9!hzwY#J*2$T+?(xNKp`VxC&y-Aju}nIW)$saEs~1NXCvJ@>
zToG+<G~vjd4;+D~d;?FJY@b@IX!6R>yCC&}6#u{SEz)21<ZyU8O;^Z$Z62`9<J3HZ
zI@Tm#)fY)KvrKLX{c3CRZ8cIe-<BdBnqjVEvW5Hem6qzoqMO>!F3eSI>YSO=F*{Fd
z(KLr}PLIuX8yyAS)Y(3~-ocq1Es@~iDY)&5lJTnTxs&7rB5rInioL7C;&yFmcf=20
z=XL!LxSk4g7=@i(^LAG7+k=l*6&zRkaZ$Z6{F0sD!dE}zbGQ6gE3B5*{JGKGb1jei
z>@(W>b1K$nCq{6&a7mt6u_!_^?(ALe=Tlyo)My*N*rU&RrpTo1)9PbO7jJugb%oVE
zC8o2gTQ7xg{ARjL!KiEd-96iEwClg!U(_w?>9y_rF~wOmYegm>{ZXiEex&gIi3x|)
zT}z9%?$JAT@@VX&em8~pXT!CGOctDY`c$^M=*O(MYG(5fEUWZ2`63oH?YyP&(%bCx
zyfcDor!Q~vVDqcL{$}=V(ZhB(-U>?vx+-7I>h^h_IDNsAG=;!WmyD^aza{Tc{O^+E
z5h!tVx$fh6c87SKHYg>z^*ogIb3M@a;PBc@*ZNoeT(YOdc1B^8?B`=`CftW-*KOWg
zedvMlxhcn8e5)_A9Eubbet9K!P26Iw+T;|IQ=z*XR<^WOE#1fZtzwOKf9vecX;=K(
zquv_bI)41LH%rB5jlhyi;%rZAj&AOm&U(rqz{z={;;n~%ccV-`%rD~o|LTJWugvY5
zkcHuEo;90p03Tlw{i-?JL)}es4zs|Ptd;ep7td{-`kCiO;~BTRJIxa=3C2av*1x};
z|1V$g(V2R?W-5GDs<_5E`GfFgPNAvu)z;78R#g_^n%5aA8JT$2?857xtL7AGsrJ0#
zVV0WAZ}ma7qNi`VXu!I{9LAC(S$7g!gag;FNZa&)%cW<3%dRBT-J5Smo&5is#qd-4
zDOQ#PT{V6==8}6K{BiyH+GEmQ1%cFS4F!uC;;+8%xm@?|?(+XmF}JSny41dQqTuWV
zg%9s-)~EYM%sBVy;-*XQ*cvCdzcbEUT(W#;Fz?CtbDEbaZ$7VfMC)3Zd)xh#{g-*G
z49knIi7EPr={7!nQ@iO}NxI!Z5%rcuQP0oL-SF$P|8uJ+PbB>XmM;-oxbXVsGi5CL
z<yZ8lub;lOX@yyC-szOcWwlc-{w_Zf$92LfSjBahQ^Tvf#_en~lglRGzw`2!?%Nr6
z8z1~#wp?uWL8d=$pMOVNeQDOL-2CC}w9Nt)+4t+W)+k(?x3A_Hi$*n@*UDB;gI&#B
zpWpIaRupc%cU?;O*7Aq9-Ibc7YGr;q{9RhHa_(=x&EMY7=iaIBGp9=Z;RK($WThMB
zXHGs6SRPTNI9a;Vz0qv_qUjssLtf23vt;!ID{CFuqH`jF7i_b0DyMF8nquOqlXA=c
z>76BiVvcgiPkguLedzg5-Bwp({clXu^11hhYxCr96<K-OZqMzmtTNukkP*70<ht|>
z|IIfO?e~ZnY}5%|m~<%p(URbfkJEbVPGl<wPh2_G^NT2Z^vdf(=|_W%PgTqiT`)y{
zw)6R|w<D*njHwWN(7S(|6H5%^$#kyXYm%`yA`H%??<ih)>8(eGTJgeXeO2i(uWA<D
z>T7g3Dt&m;L6NHgSL`}s{>{+6d~J_b>h0;iAwRUDFUeN;{9OLE`i}K=jmQw)tGOGz
zH<nl_oqxgqJ1fUNIyzOcb>p?q+84ztGq|}7)U3bj-D$u3`#@2?1?$U{INLWC6EvnT
zY1>@PFDhSVva~#r?-pC7+Oxx-ebkNJRkml;O_KZAwYuh@S;(Xn>mR93OlRH6;32nl
zzCgd8Is?}$o~5p`)50y>uD;1IKi2fhz|Xfpd2`N#m5m>F{IHJq?pm6D{a^2k>)$_2
zds&+9{d!rS$D+^sA|BnE{FhZAQ-E)}>LmrcPm7Q5Jv@6m%h!WVepb@U<4#{}Qe}VA
zaP4lxiP$|0FVFap8f^7xfBstK<#Uzi+}hBX)^BF2cHa4|+M+8rZ+Wi$8Zl>y^|=!-
zgG$&h-=4bKXugr_ly$WSY#DiXu%#8HAD?mct%LgH|DAhV_W$=U4gYobSmBfXzt_)b
zkZ0TAc;VATi<(5UEgqI$DX04<y?t}3=7NC4gycpE9X175<2(CnclW(pw~viMQ~sd0
z4wG?hXnA<}^^e*w(w6r-zq}KBxO-xU`Mg&xbzJHuhm@}T-@UVL_7?Xh+Y4d=pSLzu
zp1bo@c!y7=<b!S28~LZ-4CQ@UlP=}Y5@|Z;fymWE!g=8$UhRo8nJ!sP=MO(p(Q)Qz
zR&DBRzq@v8LDFT(qcIhU`&LOQ=-hc}`oOG5Q1^G1_e%MOn|~x?^Pl~Zy}lwy;aqkr
zdrPH(O}ExPw*|qQ%I?bsbEhqu(U9Qt@$FJMeo59C-M4&ak1m>{zl&#Gg{z;&iWwZQ
zdQMF85UzZsdfe*Z0?pX)@U_>h@6N8Cn-QsV@K0aIDvql8!Qb+4bew!;{UX6Q`qiq8
zpH+7RY_zPhcgm_+lwEi3y2!X{vBiuB+P|Jya4Y$3Reiw2J&*5_rh0jZx{bn#lIwmp
z-@~prHFoW4db)LM&o+aY@SLAqyxVeK^32rgkkmNxc<J;FE7QL&6MyIVF6|GW`oF#v
ztA6M%%h<m*{HCwr;VX}&w>5Uj$l4r|n<moV^2YVC`ou%&|Bv5^*<`-<zC~(qOaSXe
zl{I>~kx?IiPYEsNdZt=3U+`OM#D!N`em)%wj_$I%U%38R?Zs*8Nrxx)eVoLu(Z8!}
zzQgj1UG+P@Swzi`6wi-(^x)#7wH`0G&E;rb5M}U|k0a6fVgHU#37VTf^jM~<p1bxU
z?akG;mnS|5K6h-_xN=pec}3|D>-e)CcSENx*pZvn@psXZ?~6|-l|59QbpPbMNg=ka
z3LEz<Ji6-IE4ga90Q>e|>24p~)Vb=8uKgewem{6~+qov^y5`p}tET@>TT*fIMNqp=
z(ZvZ{FG~1*-oH`tN5179#~-ErHS5pBT0G9VT08loJEy>DLBCbriyywox>Glw?^^Aj
zxc$8j?Z5J4=Wl0Uf9&rY=ZwIwTvpGu_;Pu8p6q+9bwYG!x2vI8ZL#O$a~k^JjX&|8
z{`g`;yrS`mI;E@bSKbN#ZwZR_X_Sf#_IeQ=cQ(;?rt|~%$ba>U{dEm29%UUnlS1$C
zoblyL+z|5Qz{<_+7b++J_-HBlAXX;tP_NLES&o}!uCLzFGwo8yOaJ1Pd`C5(*&My$
z<iG04y0*~Sre_}fIGnX;+x3(nCjW`;PFvcx_2ypx)@ha4u;*83dgE(fnKEC2S@#4@
z(u6CeOOF?9x6*okKET$pVL{HK5+|XjJX0TYZj#z^LP>6a*5;t4GNBG@Y^?OBeXe-t
zp1w**D<stG*`$Jg{|)!H&Y5oDE)lxzsqDKSv4%~H5AQzw(t7QV<7e}euWyh4)~6=+
zRsCf3q{TB5)Ah<a=P!7<IOj_15`M-@Czf(tKj<7G5PBf_KI;Oj^~<h)5_6E?;(F({
zbHg5;b*rmb3vaIq(bNhwy8FDj|KXQw`+mPF+1Bo{HSvJ-zU3`UCI{Qr<*`KT)aRCa
zm9#3EA7c5-8sYWJ;-S{0A1seT{>gUR=kMtJYi<%I{bH)n&JvSg2N?lb=9ZlBc~2U+
z70$@ZoQe>6XJO<j;LS0ATCT9F?>nW;*SaY!JKsFpG)Ge9Enh14mvk3hovqw8vYpSb
z-dMzP=UAjs*w)tun)hXXy0LU`Wr?2ca%73v^|zZ!O?z^fN*s8;o>5xYcs5Dt*W;2S
z$GW=?ozM}LYyB@1;Qhn5Yya<=oNp{PRO^U8@9Eo>zclvBl%~)IWv`!kI|KGqMVxgz
zk(=tZ!|slgp$CseQ<ZYT<7F(dM%5pSt6qCtRpk?Nm5A6NV9njWFmFpn!1YU_XD!3z
z0y^YWX7N3qDq!liO~m)Y%e2oPhZ|I5_cyOI;Ai?T=%B8APCxQq^0nhC>hiA_Tzwb&
zwf$(V{;^-z7P!4QzjIRTy;BUU-0qftzkFFTYWefGBIPS>-={my4ZI-tqV434C$F`e
ztR5R{i1EjHzG6)ZFm3t0#I-AO?+&NS-}k5+F1U8+))xJlM>Kz`^2jARJ?WJ<oVDRq
zPR?Zulhr?EMCaX}GyNCyt*z(fx4$a!-SEw3joQO|`)gZo>s{QrWB=;73o&2KcV619
z;NoP&BV80e$5wQPI-lp(8@6-je>J-}Z)>%3z@Hx0>ZIq)#~m3Jiy1X}O3V*MFZ|@C
zt*2mn*yo2VkGf=yc=xkQ2|Aq~dt5YM=G@|$9lcd&oseLO<CNeN=eBW{-eNi?Vb{4s
z{cP)<%Q_DNf7>-q)^>3(h`4!pf~#BJ@vciRewxoKQok&_Xj))u9>eEde(lrzg9GpT
zUr?RC{yqP<nCV7J8rBS_Rd49H9d?bKofDFK`;v%K)fQ3X={A90g@I?{m(JpuQges9
z{4u+#=l^$8x6b|OWz8P%m=}32=cl{8nrZl!b!ic?-=h=aS|7RnXn&XdM#t0VU{I&8
zd3TbX#B_nKt7kvk<O!IZD0<=ZKz&yuJFBc&%8Lh&(|2mv)-L(?r+lwbMG{M8>#ei~
zcIMVC#Wp6tYF;?MF6`|Pn7ct~!;+P<{hUwpAKp8ye(gc?j}KW65yp2e^kk|vJ;+&p
z<Hn(M-oEOX<J!wOk1G6~U|)EoN<Z#P!6ugv#twapqXam7mM?Z!kG{!U_+)kTf8Uk&
zmfo)4@-1+!m+9v!x0C0#+|6K^P*6~y^N?%BN7aW+D?A)uPg|+DIsXLz!@k7u=|`gt
zHtBO*VXboz4rNYTvE9Kn;KT=!!~UHoEt7m0UW8Tp-aW-`8Ok8Kv)J)3GponmT{~P(
zORe3K@wEHXsv~zquibihNw~$@S#I-*gn*-8mhH%W<aF#*M251uj*I=LM7ApN7mD*P
zTZy0A;kR~a0%xPVc>&vs#j_j*_WG^l&b_>|_ww``W^3$9mzf#z-oJ7>D425rk6>WH
zUE$e}nx47I%9<`R6BJW)t8~jYvaDNrD`;xV)DzP~{o2-4_3fViOerrR%tr0DYPZk^
zA=8duueesFMkSR$j`7&IyZ6cZ3_bB53f9jL^cQ*9PGj)Q^C{F&FY22<BSk#_!q&v&
zd40W68=imN{btvy<r)(IA2NR5@sp|O%8%uTRVr-`Jm2c@*YWKI-DMdo6fcO^_$D|;
zeJc!aXtqwAIB)u8sV9MUt`)w^wq9!6CziFXVcGfRs?WNQ-MQ8Mv7<p%zxnZzmQ<bm
zth-N-a4l?H$<`2>c(&kk_N-TPdfv&jy>O5-+^+J$%lc7fVf1ERu`;hsmRtGOUA!*O
zA2j=ggloCUnn!kl`d7?1FZg%lS?l>?E7!yypMUAjvfN;xP_H*L{Ngd5ThA8%k`emv
z5TJHYKs|buPbXW@5~*^DgDHvq`fofJTU=A94rSIeFX3VE{C-)P@$JqRaaBuKa2+&j
zQoDLF#4tBobLU&Pvh#IwPJZgI)GrKi|25^{v6D>N>;BAH6~2CT;mp3$rhmySqP)qz
zkM)9Xrnwj%Iq~p0%Qf2?FX5isvOH|H?WOP2m+!i?S&YlDK;o0$+}>;!<uAg@Vz0c|
zqxh$(UU{cGwP5bO1&Y$)mo!gZT&SR*@~1($c;yO#_Z~kSPik1TymdM6a?a)c0juqv
zU5fAibWOY${UTyZfaQ++Og0DZJh_v6a&K{mccR3%c^4R7<XjP8+c_(rY5(Kt2L3Wr
zBuW?QIkawy;NJZzJ>Z^H#n+^oeY`>Z>Adorto>VKUDn6P{_wQ^!n-U!zPoC&OiRyo
zU-p>QGoL8EUVPyHn`=dX&VFC%6ZG!R-u^Qz?T<fZhd$Jf;hy-1<;H|<e>b?fXeo<5
zP1rQcZ~cMC%VwARw;z3XzJ2%q;xem072nVQ`QH9}@Bc1)hpo%<7#!a^_pdi&l_{HD
zz^7Qx<@M>;q%fc7uMUL$E(`2^@P<v8H9>60i9d7y_VJ}`wf)E}!NRHbbMAW+O<|!I
z^H0>Dids_gh{egVwL&QN`Q8&6+S}$X*5wNQ%C}_SowW;p)(dlYt~l6`pQAKqJ^R~u
z^Jcf5jNg|<+TK<z_pg5P^Je~@cWLq~f7@nFy^*|9`|=9*HBJ#i$~8wKZ%#Z^&#5#e
zmCYc(_*;<a23^id_8%^7emnXup3#ywb>@72<Mc;A+Y9e6U#iWh%h>wh`gOkVou|}H
z9Zqh($fMsXH0MXh#6>+^*FFl(Ek5|dw|Y<5>YLHx(i0vy<UHk%I&HfA+gan{9%;9m
zqTCl&wLg>z)-jv&bzgzR?t3zBCLcc*?)YJ0?fsOuDYepY?fLGP7mgU^C#ZOc{C@V~
z>*x1|`Dx!CeVDy|pY<QEeJ*{P`*Xf*U^;8NX4BTN#vPa9W#jH&nrCTp^U0sb+=nJF
z{yQ@=+TM44?PANTF7qDV6+LjAcfn-8r90-`nQ``$`GTFd-_`RxEZr{eU0ZuC&--V@
z&R$P>k$-DX%9Uv>*d4ZikN=|oud?m#eW(}uD!=Jn?asq0&xBSny7B!nnOnbQ>5_S7
zKR-V>@j~ZXp3?eVYnNaCxT^L+irTM#9h_l{zJFLH5xdHJ@dTBxC6+?Jwm9_eI@_~$
z-}<iZ1H!U0B@aW3IS*!JvPD>n@~%5=`%^?_m-<Q1fKM+vru=@=#x>E^`R>ZR^Is(Q
zrOmbeA$&M+u4C`b{F{?RRo-Vt`n28J@W3p}<#YGPA8j(-4SvbVx<_WK@8dShbZa}d
z#$9#GC4pj(Zx>uUdcXK37H1ZDFPt2sl>2O%v4(qU(+x#wfeOWA%Rh;{>Uu4=adFPM
zwQQ$nO?7?}xqW4^PxsNisviDA@rRub=kpycNITJZX{JED{qK&+9zm<#e>t`3;BoWR
zo9k}N=?Z)n$$0f4ZuXZ|7VMVtwZ^L@_xjB7DpoFD;u3MvZ`<$Yq<KekB6|g_*Ubrg
zK0~Xb>hu`~PP;T;LCq!4Q+Wk*tYRhxw>G|vW4`|OU&Ff@i{>uV*<4g$C}1C}H~n*3
zeg6AJQE}_eB~E-7S;6(IxZfz?UG1-v^X={*+<$W0_B($cr~BLe{j=G={@-!-upi6M
z+Zn1h_MKtf_46LT|ARBPem@lc^*s33bK_s_7e0TA{msr762oknY<6wyZ=v@$ckA0P
zthZZQFZJtr`kGIwrta(C?9JJ;rS(at-{hB@bLy7up5Kvu@z^0wmORI{sjhB}->u?G
zcAlR4fbTfZB-6OvTW_;U^sMlB?q^zZKl1hR?JIW**6LSE`0Q}+W%^Yc`qwA%g2|Nl
ze4YbeuU0WAyZzg-Q^EPfdOJ>whVJ8EYh&iE*Q?vQ?tO~;R~>fIvqdcD3|?I2*mn5M
z*>_7c8AKjGFA}$5T6g;B>?fCYpMHCL2k+bMzkAFUetG(~>pK6P@BE)`+}!q*D{M;h
z+V!tvO!nWCD!6p*o!RM)QUNVYKj&3#k?-DGe<Psx47=4M!y8PNTmDa%+-d71zfh%V
zMv_H*|CRmAGg@vPYc;W$D_<jfL&NxbXmMj1vu)3t<A3-z_I^0mJkdnrOZETcchAMv
zrTOhkku{p<KGFG;>anSd=Y`MJ+<xpNH}8M$t!Dz}{(Jl;+T`V?jVv*TCw*<KKd$oG
z?YP*<wxok>Hy?_y*6(2Q&Hugf)RifRm!ACW{-ZFhC}{EeiE%x<W%y0KLes-|ewOqc
zS76(izn~@R*MxTxB9|tv@DALm)6g!;&}&%mp7)`s_u1tWgvGv|f9m7?*Xd7A+aHb{
zoHoL@T<b&vrGFHyj(by^*HPEWxupN1<I!!wHQ8&g$L{}sR&`BQjk{UxzXSP|J$uW%
z8~^=#SI3>iF1m%^%JlQw;;-5pZ7$BQHFMs7U2@V__nq^S?`J=(VXe9&_U4^uwBTo_
zq^6v23R2qdrrtPmOOkgQ$CABkrwMGBY`FgMrxzUAk?h(|6FvuYpH16+KiX&I=>;>&
zf8;C<HpmtfWzDH-mw!-nt5yE@&6T^t>RR}H>{w>3Ouy{ZTf6M=ROY4gFYq$x7<T?+
zU;gBbBcA{Vf4SJzk2{wh41M_e@%8%p%9d5OKYqRXar^M(!`Jow7gh2btZ!QWO*quf
z;qv#pKDJ3bSv&QMcvtb7S?<g~(i~QoX2!bD|9*z}5drO#X*;qczfV1&?rEK)<P;d7
z9y~cB@Q~H+E_t3vXX`0*eA&btWUVAEB371fFPQkM!>;_>X6w*jc1$nSil2m5UA<Uo
zxBG2aSSouzJI~BZ+_6#yg7=<fv~93*Sf;vHYH7dmjM^Jq+UK^bYyQq!`H(qd(xk<r
zju(w9InGV}I)gpSV8(~zF)k9OOQSv;@J<w&SvY4(iznNkX9fpu86W(zS^KNQ{|`%+
zOR`t#nZDb%rPRh|*6LL8mEtZghIjIncDKn?+SVV4>3!*}!zg*7T58IY+5bC!ys6F;
zm>WOKYumI>i-I<)Za5gQVb4~T7nK)Q$_S>_7@XL;plNS^T3G&i&Pg9DZ@kd`o5^|a
z`zOmsKS~Q__upTh=N4Y1@^oX>rSo?({-*q^_}VX8EvC)&uIJ|2uvaJEePgKbXlaSe
zn4#YqaG_v=QI4CqvYYM-J++Bqa<U;yt_v??IVg5TXodJ`6OK3u#yyFh`i8deZ*9L>
zoAp<AQtBD6*u{Y_EuUo9UGB|1^zvw0Y3b64sBn*Y7o~)XH%;DKSNX+ATKCnmMA@2$
z2d*j2*<cX)ldb<?>fMNKvKayHDWMXZ&!({$`MUgfovQpqVV{xCtR%BJ>#l5@S<&3y
z&(YM*xSUJv*qU9g*?;Fh%{8}wzFl;8QE#zL(AIjXqpKEs+ea?Fm}k4`Qr;d3A<@it
zU+l#UHh8jb+kTHl=*HUoH&Nl8+Vvi#SD!u9Tko60eMjTn3#LTTvPj$0^A=6%JrFR9
zt&qL!Qx|)FMMpy5pXoaKBK*@cWNJ=Klh}SdG&v=0;p87l8nyG>3ob=%N!oBb?dyNB
z-#0%__TRVQ>F&w4t};r(+XBx{nd8*>goo*HV3dSDQ_sEbQ#TeyxX6Z>AKfBqmcu@Q
zYueYC*;9^f-DkLBpUBxyVXsOuKb8M5bVv&nVky1xcIE%rmEXO;Y`d@Ak})qU_5gQ$
z@c+w&(aAy1iZ6J34zuLG$>0e1`pMPO`S6X3hDJY`$m9DO)jTeB$K9I9sJQBFq}w5L
z%|#nL%J&>{P%`K%oN~`kC1R<$!Jic09g+5z`~J41EBjf@72d3>-CTKdfq`3``LsJN
z8;mAyu=Dgh>OD!v{g`9J2czdX3v_M^Jo7pDvecIM=N64NZ{{Zl!=HZo63zT}U(bf@
z$H5O8zpG66;4t0I>`#i&>yUZ|uim6>()Rvre!lku_KF{zBCxerQ``K+_PhD1KaVZp
zN=)Ip9dBqg^SMC@LqM_RMNa{yF1O>SCQWNzDHU-2b)8VK?6H=&);}~iewg7q>v_7w
zy9dA67y`N%DNfRF`m-f@$`O{3Qy<G&E9QN;c*rW{+RH2EOOm6e2zRKh+j}cTL0*+1
zyhremoTbO?Pd`n(A|%!?3%R`Wplxu>aq-wo)vRn{tOpN1zWs+!IxmJldIx7nOMtJS
zW^47sHe=N&Hw&91hD<MHCbL~Jc5sdTo$Bdh@UYxrNB4Y<U2~^gek41upxOCM&!4B|
z=i_B~`{&K)F+BV1<j2jACqK@gC%4}yIw`TsWKL(9M`Otr<F9>h(xop=wRU5W^b4(;
ztfqDA<i048=g$k)1PA@B+RE~HCjSZsb`RN!yk%!ra#g>JGK{_P>-5zWr9S`V4okXh
zRqfse-c0*b=0AVg5{DUKi;J#JaW4I#DduOnm~C;d#-h^8JSQI}XGd&st#B+}&zqt3
z+BfLh?nbE}MK!i7gSw6>?)kKM^><y9W399Hy*an$=I=Lr$=PRYvJx8CNyYiQ8$924
zdeY7M!-X>r+>%{azFhiP#<TT~&)?qHK04#-IRXCQW7XFC8Vrv%Y5(^4*%Ehs_q`K!
zhXWT@<b7F|T=#gfllhXqyd|k6g29KkJ^iY4&D-_OSDsY1nb)4?uV;U7)?jV-MnTTt
zp9dr4QY?>VER`+TKb?EhaR*k9+qW7R70;|}cwEf=EdBS*1cM(}t5X%bu1z`eZf5k^
z&HD3fD&uRfO8w6`EH(L^c5QOQiF421_>@^jIj(x3Z{GJu^q&LgS+hunFLtRlS#_RV
z!OmyDFHvE0+Oz-OU$K&+s)gUHmtU@2c;r~CA6vr@@nAFFJ!!tmCsfXRB&p;YKKgss
zM5aKQLH?U#VSQ?K{R)fEzSov&{8}8YU$v|#Z^P+bC-+VCw3X%Eo)~$>?$a-|zKEt{
z5f1xi+{h7UnacdbzJS%?S=)?hi`<@UyKwu-1=XW#vclfW25o3eu#DErYk%_SW~vrT
zmtUd()9@Qrk29@bO5WS_!oNCr(dqgPHfKuO7j7zH?!GI2cXsh*CcB#}tbfe-yM9y1
zJYlP@!ee(ocy{!)d|EO|%c!)aw?*mLi+K#moOk$>71u|F_H@gqFOTdl+<EWy?3I}Z
zgv?LuGfwPEpRhoC@xjRLs%F&_J3gLSmi$Kgx$31uB4I0=U)L{|xOnH)YoQmSJM=dD
zv&r*sW4YIPzwyCl(K7)}4RSM;8TOwM);*N3RG9wE^m^a&TWiiM-`dBdBwDt&`4eju
z&xQVs<%)cp>`qJ-p0##XYOQPPyz|GN?yh@saM@H@VSz%+I!}W+yYy6L*0?21m;8KF
zto3EIbEob>$Gf$QuIc8AJ`C9z8)7nh^;N6(nRkxPwtTx*ByB|*ccwz+-;SQM3)O-*
zp7@+)qnAEMYSl|6CMT!w3^^Qs%9c25>1~YdjW?0`^~dm``h|r%kN%p)qrGO!ExR?s
z{YGpj<+rQ66q?UhP@i(VGWo$&j<+3mo5U(MOO;ef_vl}L7MpyRccPM<T@aH|TfD&X
zu8=<xP0j0e%<jFec=0g1|4f-1OFqAOdUE>t{=UBblKbpze!lwg^~3DL>-*z#P2P0M
zlux_-*XX#9+eW`Uvty>thOea$N^GcnyJtaoX}qlObNjciXVld!Kl)c-l8r{4!2;>`
zj?>Ox$*!EkP}q}jMev=FltJh+exF*ltorRoxl|ohJvSczI{R*{UeN-+`}4cZ<*GVg
zUJ;X>G`VQ$<>T{<7j=95Wqx2&Y<Agh+gw45rO9R|G*7KEpUx21@M*&BPpKCdTuZqz
z<@369pGN*)OQ(px?QEOdvmwHBg0{a#kl+E$X$xA;#|Ql>INZ-rmAf%l=%m$_P^%aJ
zBLtLIWlf4baD^{{dBxHBukRFYe`n1!-M@SC$8E39{7CuyDOn<7tFA?MoT7uR;4`7;
z6T3qTXBeA#bmg4RS^q`5WcSlY9Xp-E|8#81e}5q1#7klJ+zrVmX6j_?9V`#IYjRHf
z!Q-VG<&iPd`D|YEMFyO#xVFY^dV*8{yT{rv*P92ctXA3l2`EWv6ANo$^fu(<Et8lM
z<7=}l{)l$Kyn8QS9kXpn^7-&c<ATinX<}h#1P{7Bb$57Dwe73c>*OB`B3UXLbt>*>
zIf&nq>f^c~%9GeotK6FT%lMlVzu~o78zJ+L&2w&isV%Gf>6Xg#z~$gM*-6oTeobrr
z)UNKnw50V&(KUljoMzttQa-$tx_%(!fw%R;mLD>o|4(GR%_}DJ;?K%w&+VRv9bT@q
z?rLh)kC3lY8ywq@C8l$5{!Zd^y-=`OX7yM5H4Jxnx_<jzI5*2?DQopH?f5sFrVC|@
zA2NHAqQ|K(mUHyB?q-gSO|E7UXB%gh_*Yua`>JHE^J>yz&0zhot2;Wkh}8NAF!Zd_
z{(76?-{+aTx>nCyusfRN6l25E_9M%A8V;w|n=tT+<=v|-j8@oDCwBE?X1uQ~>xU+Z
zWerRI2bunM+OD-ndcr}c`YorKzD{B_kd8|XzWCuN5BICGoZ5=yN{`wIgBAIGZHe!c
z<}tpuo&Mm;ORnp>y(&+A1J6ggO>CQTA!N<8t?Cwg&&w6^+VQ1tvNmYySRT8^+wyGA
zyMpyQBL46x)bGtI-&B8a{gMxs>?u(kueFxBNifWGI(g`)(d$+D3TO0vA8lPN#Ugj#
zxWVAV*~q>km04?U#CD|e2Cz-q9>6TA<88w#A|G<5KIA9E@mC+%>jio$b5z>4hq+{}
zx!3qXV)h~3c}nNjaoFEpJ=sQln)%c#U)PHKkI@M?wrCIRG+&$lgW=la^(PqDel*@;
zr+s>*R92^+_p2+6ndy87w;!?eY+&ZzVs-D>iOU|B%|5?!l+_K247{J461Zw&F&}r(
zsqESPmAs}-W&4@yVvS=oHeM+I7$RHuZ~glI@5U7tmoy7{jK!-iF!t=b>GkA@tGnHb
z)jxIKvZpLnHCmmo!(<}#)6uyxpm}@P?%QW)eqS)ZDn6g#*DdABXHvK8Z->{<@R-M#
zQ8~-u{I1Ee=Vytgi~Z+pNskD#lHAhk;`FoYTI09xyPx(v*&MrTMy~y?3!2tJCpO(W
zxJSzJw@uA``8%9DFU+oW+G%0Q%J<Iej%(wO*qG~6=YRYW^E~(v@6p@O+J%zhrtQ{Q
z9Z-5BIe2d9ib_$vQ>%YTX<gZ?eA=v~IV*Ncom1yzL1+1^r#>tTm%b4;Z}Yo@yRLo}
zjB!4ZtD)_fbUyF=TtmlnwF$EqoC}XFdn@<)^xw2MYLCnpdmW##A#PP{Vwk1(-sG*H
z4n|ww4A#}W<Z?bse{!qp^Bks{#-wvU7kqg2D?Rd@Y24~{qOq2SUh8J<{VKWY#S-1Z
z33vD2{ce`>#&xf)V8G-r(Z5b|OpJ4A$a|OCcVYR9AARXboFBBe=)C6X7xp@Pk0(=T
zm(12B`;u?Jvd)ZV<)0qR@!g^7;x|*ZKNn_SY0=eJ$q)PPmSSA~bB5IKhnn&!Mvv~-
zC(gXINyxvalD{b+e#csw9|y&i3Ii6mJ&{n|+hrnD!gu=htFpS+Pq=u0<sMy{Vc@e{
z=697rP<#D#mj_mp3iB3qT<17fvBcH7&HKUL5}&Rc6Z?*;en>g4bSUG7?)z=Rr~a?q
z=#gtS>wQ{&`ixTtUrVjq{P)ed-+%9|a4?t<?f#Qjoo#bZ+1W)q48>lpSlso^qtNNu
z9P{&cIP$HR`7QrEWtOWrbJ*>ONTz;ElfD0>i)%M2hW*f5V9<43c}|xG$Be_X0;e>x
zPHs7sSj21Skn$(aD23}|qGp**UXQZ<sijZc?=P5ZUohRlDsh^CsgN<t?`dECBbXLC
zShh0lo4kjuT2fa(R&2$I3l_`WHQvpubeyy2_Y8BNv&*7qehyo17Sn%iTQ6(D+D`jP
zmw8^ij^|?CuYK)yyXws?M}$0=H5+ZH<6&VqmGS@XI``GRpZ-~xwx!Q|6CTfU@bbPZ
zyL8uzPp%H0?;)tu`Xj7&;r347j%%#ki<_C!Or7hMw$40fc;kqhg!S!!^qUq{Uzvo<
zOp~NH*9pDfo&S&N>i?-5e7<e$G_T!v$to-7(suvu+eM5M?JM$%_Q_W67GgZ_I(hHT
z#jjRA`fbiUJ<!J_k9YacrGMXkl>Wi##&}ovguSa_^oP2wy9FgX_T9C&mprn4<-w~g
zFWYbG%X}=`RV-4xmTm7I$yt(1zdu%xT=gu_cJ8z{HfKwjbq(G(_g{I?)hVz!am$*z
zA7|!FUob5;iJiH<!vE9mm$tF$w%$|Zj=v0fY`bG^hKpOqxoKY-Rd!^BHm}ovEB0c}
z&-bo(x<4Dovu&Am+fF`y@k*g%8|uCuTDktdt+15G@7GfNH|}Q@^f6p9vwQAp>GJ&G
z`_d^v|8iuP)?AcaTJvGI+|%o(Ev#$hRrZSaO|1Jrm+zze(M7o_uQtj|_@#C1WAvBk
z>ipvso=Mzl*K%qmvBn0)b_RNvpH2_Dm>p=p$!3xG?tQAiBb9<B?<?26y!N*9cv#kA
z?;^fcydO9EMhUwZpK^4zk!ife891l7$dpksFFbVHhg@~*o7$zTk{mW?<+uDQ$U3C)
z&7pJF<ONMu%h>*`IH1VzUaK)He@<oW0*A!jUk#`B&pved;I8Dqv;I|8MK(VYa=zbU
z^in`%-p#97on868FT5LSmFM2;-{9ACY~{wCPjnk~?|zM!kNhC<>*!Krr<WFda~7_(
zESUVxRreE5mg2^eXRNp8@AcdK)VX?6^T&35PYL%M?A*U5uVAg+{Cfg_?oYPRiUQMG
z=6@6aeBCr}T7F60wbhdZCqImozbB>t>gSyovqRM<{xKJwS?BRPF7}KA_g1kFLG>~B
zABnyCee2$L1J*<TT1~F6e)#dqzikR<tCKhB?@tu{CY^lBAaYUdt-uWX5}|JsUtVMO
z+%>s&>ATSB3*NWKau=VlZC<PL?P~762W#^WHS3Gdm>jWe<2}c>TW;AUH(3Pk{=6q>
zyJf-A{h`u!o8J1(PFR)1+{t1iaXs^;>f9*)y~ZoM)8;g-e5Ld2IYaxQ6Wl3kE({AQ
z+u3g~l=i6%>`^E!Tlj9qS@xIfW{LzqS;gUKHqqzPOVtxkB~mBnGH;Ic)5tg68dPU2
zz0Ubu;>{Ja&ziEm)A3!FXfWfOWs60yczvl=$SU{k*N!gFFxmXz-n(S0mF8VG;#vQe
zC&aE&zj9qyJiW(~d;39yb0_=z0(Y+zJg%CrckuXEVfB@4cRv2`veS_|#lK*$;vMtD
zx0M_jF6REqiLGDUY7=kU#r$X@@5MPg&rJ;4k@c;|;bDQlVn*iqIlGs12v3e#q~zx#
z7Nm4;Z+kqap?=4TyQW@AZ`D?AyKk3z>rIzlRg`X!_53wy6Zqdq{4rR#h*jb2qHLvI
z-W4G}n(Jy*x4X|?)p<{*HuGqMzuFe5n|Wo^|A)kg|Evw+-?4EL^HQsT5(mDC3$p|G
zd8QOaR(bI-?Y~mRKb_^{+J)iiG2u;a9TpGgoPP1Xwcya#2isL+Jj}jGnuj}G56J$>
z*m1&Ml>4lB&V~7R%;a6FO<Q8_bN5UU*YWyn?PYn1qwe{h`;*(BZ{}iH#mL!^onEgv
zW!uqdd2Bb0O|L)Q%_Q44#p0~Pi=8WaSS3YNPWs$Z=3IXCh1rK2`B$>u?wTlJy;b1~
z!%P8ZjkNz^-sk3itxnvRC$>0+Wo`Dc3<DFcd#cS@hNiDH_0vv0bL5fZTz*kkSuglw
zq@aRDP5U3shyDFV;UBu91sepE7M&Jvs`xT*F{3$))PJ$vkNm#bTCbRV{+#d1BLW4f
z%?$ll=fqCV&x)v&=#l=V_1jPIDuWSkvZ}_(pS<(T+5*!2pHAL&&stxMIpX_Yoo{Vb
zS@$fsXGmN7IvBoHn&j}dnV;Y7u=U1Ro!)mWAJ5$^wb`<%>`eB>aGQeFAsy>h3W}9C
z%rSg<RQvm4Y4z7<6aAbgGd4Ld(eihl^6HcDmIsE8%1@g4cU<yWEts_U(`;s*#;g-P
z7uP<1%8(E!p6i(3#kMBEMeD@2yD6SOd=9X*`FcE;-#jCM_g2LZ>m3XmG$NcE3a)=y
ze|`7+E!=l5Oy{_>PEk#`&2~@r#`ABl9((fJ$^ZYVnCewK?kH)QaU{Du5n(Q1I$wE6
z?8M`hYg`W9?+!H$nd4o$*|c=MMxpb>lXL#%_*(w3srgrIJ?RZo3S+_3HwDwJOGIB=
z{CycQIZ^)5K7}J`j1v=2i{86pFgKUE>d=>{j7WCFLr2-?E}CYw;i~`RU&}Zrtc&81
zQP1<17GMl#o)xxAu)tvTx#Yd#`cvO~+}at+<IyQ`L-fo4o_<S~O{MSN-$-KnbZ(K<
z^ap*b>Lfx>pUHKLouJ;o|M+SDx)5U~y&rp$wh8*=KHF-&PU^_I!;c%RxWE6A{I}y}
zYHVGU!Jdbcmwa;UC~0r^Smp3q=2d5$ae3#8LwlT`T1T;8FI;3PIk99?=^eXLBd!e#
zPw0HrOD*hF@MF2#!&7&*E9bt9;HzDFXLP@0t&c3Z=`5d8`QPDFv24Y21??XTW1Vi_
zcV8LQ9aS50e@$fbzW09nb<d|)7&%PPdeM<^&cfUG(tEqcs`Yy}UHw?oRQF=Z+~sfo
zxaL^@7K~F`G>gM6-bU0-hqZ5e!HwqjuHAySjZXFSbl&NZUHtKEg3}G_owwK<Ppo>k
z(U0R|LsW*}&Mix<mtK4E_!gI6YG~k&dpm?4e_s1f`3`fkm7%z**_E&B_u92aJ>B8L
zQ#p0j%~e+}v?MSTCWhZoY0l=F`t9=UN7I}IZM?&!Z$)bya1htEP)$7HrnI9_bIZ@P
zSvx{IgpW9IyqGoB^rYyAb%k?{glDmL>OOrXzfED^@^i~;xX$%9+8k`XUun#8G{C%U
zvG23<6AHe&-M_zc@-BuSoy|u~fAEPl9ozBy_bLzOj}Pvf2HeWXPKj)e*emuewY$5j
z`(OG3(W|!p>@8ahDm2`SHam8=7W;&!D|snpT<2TSse8n@|L$_J?{BC4-8-+(u}xw1
z=`_m~{|Xeeh5ffVxLx3$z58X`84<rNMGX5n9+woeN*Gj&&y3s^xcl$<&o0*{xFx)P
zHpj31mzcN6q!Z>QtK+A3{qBi(;0st#u+t)tWq#aibDt)`n|HqLQ@*nCnuzkdlsM;2
zVHP_~D)v6!#Sodd<K}bs<M;Q-&6D9*TmAA2m(!bFG26ta+a6l+d(QqFCFL#llhWm1
z)>W`Ccjno?`tKW|lM%jo`~vUv3~R;TeG#m;Qo1Rbqoa0RcyeC1XYAP(+|Cm_51e^?
z)cJYf@3j`PuE)z4_dHp*?OB4iKEv$Snwxm0Jh5i|ou8u0aW6g2yrsuY`$M+Vr7ygk
zMfOrPuY>i{OFdLSb-tPZR9C9E$@s*VU0=)erKM+Gy?nKmHR+0*x`B*~_O_;(qIY*b
zKIiOp;mWL#HK(3xtkrBka{IPXOPHI$)1Hd(A3uB^T>7-ch3Rv+alg4!(~5rIggS#a
z5B`=amvisAe$ahqg39%v4N1qJeknX%y7_3U^ZkNK*NtZ)8ssP4<FY;2!EkrS`u`7m
zYy)MN>%M%{b}r?ZpzPc$H#*mzm)NmS)v<u5%J`M@#9gOf+c(O{YMsCSv-rUCME@?w
zjxS<`*2;I(WEfv8*c<-u->0juPy7m#?w_i|JuyIU<Bq%2FEcgWxwh*-n09ruvfZxD
zsU6(9MF;oUcYL|B@aUo$u^+_#|LHan{gN#j^Ze|^uKQQ&&+SoZ|FKPCk9~-a`Z?Pb
zN<SXzi0(}aGkN;gqVbr=7a;}N2J7p`=jeZk-y>oD{GQ)8{)oaEhkxIW-g=l}D(~;R
z?2pBwmKe#kuUc~5Jl^N1LW;-tRS#IRZr-$=(W0gm_HZ)us~z7R{w|tV^X6Kx+UtV{
z?F3~nSMY=jC>&m}YKF=&*^2A0HBEj`fAjdPYpqt&$H4TbtRE*%V5wjDYx~ORshdLm
zH68ZN2(+!^R^9R;W%jL5&a+Mbsy?VZu{{{Yt-i}t=zH^j_5g2Y77+#p1`dX#b=#v(
zui#c#s>;9+eu#lVhk=11H?=rFFR3&$Cq+LquOzjopeVH@wFsG=pOlrFTvDu8Q2EyO
zZ}IJ88~49nzvI+p#+yMMQ`It8uQUo(x%ss?CsW1prL-$^^OHa)UM3wom5ow=-{*hd
zR}jzO7*#ZD=5x;+rX9C;-@bkK_TAgJXN&%v<8pD$x>rqZf}YR1_pI=klUgYn?m2I2
z^rO&qbyLkX_lEO-tq6P~9JT8F<eH6B_G?$g-xd9sl%3titNZAcn(whqQ-dpHCI)9n
z)^{2uYS^F8oS7bQr*6J}#ql-QA6t1Y=j$=qAJ*{v=N7+A&Ha0m`_o0*=KU2}ZYtXu
zuKu|GqNnQobBux?UjEp(D3X)+^LFJ=^X^5yPqBVn@u@Q{_~-hp4^7jqW=;(Msp6k{
zQ)P9=Mh%TWwte1O-F(|TzRy2wv-*+B;-g249Pg)Wu5r0{@90s}|3CQx%Qr1>jd^-B
zLsTd1m+xgk%esH>?LU=xaW_PUf3#Sdw=?uX{6&eC+#gIQ?eEucn86UYTsu45U|;5z
z6Q?=c!uyVVUT*zY^S$*Y9s7o?^_O-ub$V}lEx5<>tT&(b>HAzOO3Mzj$%^(^gf-1A
zY)}qjP`ey0HML|?`elu!+f8~cbQo4IeD|ZyNmBCh?b{Z<%PwrJ^4q*BB%klIrfk&<
zl_QSslclYGvN%r=`D}My;}TQAtKah%ZMXkif4<+J{~Vv5-?<yJFK=JZ?|*N9)n_X!
ztGchx{u=I?@?m)i;}WmUo|g<xOsv`d<Vk!=;jd&Py+=u!Y|Q$zoP<P9G{07wr){w5
zm1h0=9f2FR>$H`$v8b)o_dTUG)6sjm!QRM_W5&CdJ~>s?=-lsJ#P~k#iPD}Q_b)$w
z@j?E0d;a}B^?Q%2^=wx@Slo5du4QuNpUzhuQ(gJ*A7szn^u^0$ck9Zzs$B2iKRU_#
zLGjbvxOJ`TS^vsEdh(ayJ@29k%J%DzH)#Kx-TT^1?})zV_cw~!_tMXOuz7r`{mPUl
zJ9<`3N$uU?bkE95O;q2;^YJE?<2Q4Io=670vWz{_^Y-39n}F2z>gcX$ugHY{DWMCU
z3p<}L$Z2M3TBLXC$+UM93;CLgwXN)|nVag$|4F?lUoTiaUHl>E<CPYBTfVJZccSid
zp}>VjC%QRStm|2yX`sZcVH}iWER&a;>-(~YL9VMJi1GFR-F{q}S!^=<t5qJ@A4-mU
z<1>ZJDwQQ(rO=7d!Fc!GscCaUEEc~P%q=hzeCSXpGxtG4PT|}zna+TRi&ngx@TR7J
zPq2PaRp)#6mjAiQlZ-_?R99#S6!@-o3|R5d`-gK_(X1&aP6ccH)AIA)byR(lxLI6R
z;Jcf?U5Xox4m|LjnUX4+E^O5h*RzCApiU!G@xsB?{NF`{7D#0niplYcNY397owZbo
zg(K3$d7JCOT#57#Mt`22e|S1!$J17!YpSv)pWjYt3QJ%}6g$82USQ4iDHD&}PRJ+=
zIjnwe_Aj@~%k<9f2{m1_dexd)y+Ly-*RBiWx9iSQy~=fj^MvXBS=TPG{&bmMUTLVh
zG2-rtJ$jCzi`SS+rK{+BtSLBrk#|LE?;eGG&Da%_wy#(;QAL==W7V7~3M&&dyeEa5
z8$@@Tu(?jTb1>g))$AotToact$<0=@;ywEK=*f#G<@6)&Jt?(1+9z5v?|xGplhp^2
zeNPRJdCpn3q2aXCh1p8VA1&5TwXqk}(meF^?(Uol=FCXD98N!ntxjiOdDO~zhRoQs
zqD4&I+(Fj$rdr3j$cf4tf*kAq310I*=2dgbL_%;+tKCUfix&3?#v@hM7k)~6GoOu*
z<83z+U?}L!`ki3K^YSm#2G%L@JZ&j#!B$5rH%0Av^yl5rtPN{kiB9+uJIVL+ZlQ)p
zDL#jl&TGHOjR|=g%jC<x|Bq0_lYdMnUOG>^^M1iv$B4))A{#7z{<!Ks<Khmcri4j~
za?RVq!X3&bf6g=)jXIFfrDk|R|Jw1N^NxCUeJGIFQ1te}49=shcJn8CPMrRfFCdY1
z{__CwX?hWVr#bv}-J`>MVS$Uo@vJQG)tY_LWoI6y9xU>*l{v#?_c1D&|FXO3fi;rK
zkCa7%yf4TH9bfRoI4r8TXzSLa)3cfn?bJ26z}tK}EU-qks(*@%tLL<kKogBjtI3b5
z*T?qscP!h_urWKyZT`niaSCT!xoX~BlY6Bh#w2^P^MA^Vb*t~VZJokbJ|#tjMbcxo
zC(okplhX`u=#^?d4PAL*?MfdjotFMb<}Mt~3ra5>$n222VtCk-?~%f~M*?2c4c3cD
z8YLMSoRa*dJY$<<!v<wVlZLPDZijhp@%k=b#8twy_Orl$sf4rd9_37JvSJE8HtXoA
zbD9N5xA44XEt$$E$Fz}+wYo^*jp3uGVKV|7McOxQt9chG+fq_@{fbzBtv0h!h_6fL
z{w$}w)3Y8G?)_-=se95))105X)D8Nwq^JEXJ6pFiHfp=MpZhPS3K6XX_Z@qg_|{MJ
znqa_}5Y(butZ=YoYHR1#wh2oDN`EkzN>0Bc`9}9@$eNeQs}6=e%iXn5GrQ;ZvIR#C
z`Zi0;ScO)IFGw<Gt1kJ}e9?d9@3ohG1Jirsx}<#7Rd?U66?uPDMoYZArsnpIRX(Q;
zm$XDE?wF*!MIw_WzPBT!-Xwbluf$fDcA*;qF8N>IeS1A!wSL~l<g+R3-`%`ls_Z&T
z&dG^;rny9s_0!w?wX9n&b}9<a&$QSdU2L%?x%WV=n~JgE{Q}=B9HtjFcD)f=H@!eR
z;s=+^?JfH4oG&jQ*veyk?R4mw<<8j)(}nePyE5Y9nCs6mT{QgkAoiBL<5EX=`&qVp
z+TCiZd@_}~vwtdY+w3mqa?oAasePgb1JB;e%TCAb6e|(f7g1r`^1u9Y{hcslfp6>M
z+AoJc?#y4i%1dIN=D%Hu_Q94LIQAAE%m~r*wQ1hda$NI;cZ*e6>8x}vZK+lIq21G`
z^}kug{>-$4=jZN+dHHv;yN<EFxSsueHlus*&#USWIn^98!(Kn$fANx;!~U?H^51er
zKXfa`cO*8xUM_a1_v$B>pc_|zxh&TGvN1}hyX&^w(YLFY3tv9<_C|adNAVH$wZ5Ut
zm;agI*6(-JYX9tK{_?vvf9?LKv#)8A4%4r>SG+IquM%9DwqVUpp;=<{-PP8#CZ1lk
zMevQO{(SNMd^am2CMAp1+OS!L8}0m1G56|CP5w-YALYlMzMJy;M$y_^Cu?@4zi+7O
zlH}5VHDjKU$?m(^cNX7ryW?LtQNhg1f2q;>Zcf+fa<^MPPe~{gj%7Vnb?4*MQjL?V
zl=Q`Onpal~c#3UglXTfAdbF&$X2)ae_|;xVx%V}v<mWv67udeKAVXi^RvX8eTPNn3
zuGjyzfThdT$=2<s6-V8V4^{rk3R~}PWH`hWZGA3h#VtFb#U6%ITTcDd|7`rc$<uD>
zq40>X%X`+%Vi&j`Fn#*k%^8!<KR>`x<52Tj;zY)hiAPr`HcXuHYNG8*<=R_rHF0a|
ztk)e_w!F98XWz@0u8)!@U;P>Ue^mqLTCM0~*9vV7r^X&m;I5y1Psi_9q2<j97d_?U
z)NOCfUGu17li6iq{`=b>TuQA>o-B1sW@FyOwDj()k2i~KoGX?x@8=ZDGf&^}o|Ny5
z`uc-oQ?$l+fj!oC_LcH;=hs+R+w`6D^V6G<A@#1HN>l64hlgkT-8a=7cFa9`-u_R)
zmuEbV#eCVC-=F<Gdh_JZmmd|Kcs&IEY5Q+FsM@`Q`+w~71Cifr_CJ&Rp1me>ht#eD
z`BKg0{!M{JMeTJ5_VC=)6U@Fck!zOxg&XX7E7yBVNFR8@miSq+!D~ve#r<g?rc82T
zeSU_Yh5KR2;r+~C<0c3Alq`q|x!Cpa<?PGJORYUtp1!(n*@cTA{omXF`H}2wnpwxI
zb!5jrITnSdhAlpm?!_5oRfriLFx6@{*!p(ns)$({F+Co9ha|0T9<iRe)jdh(chIxL
z65p?8xLa`k{;+@N^5otNrV?Ki-@bX{5p(c-!i~@yx2%gYnf^c67B285H`wyr-D9?<
z1xsJ+c-(emndPaz;YhMWKxRyawrJK1{kw&wN9|-jSt`rR%h_-Gn{;Y>f1&ZNRo<UI
zNU$m92^_zgpn9;U=N`}6Jnp#_i7Qw=TzOY-s+$;oq5FH~SFQD%H7|$!`F-l&!-O-;
zuiU@P^D9uVRAT?}`%|*Sg!|tWf7kUTxI5ptAj_k4G2g<3_sg4!3rlitNZ*&6y6obY
z_nwOn+c^6(>@aDlk!sI>zCYM?XI8&N-uC$%H<DI|%=cAhKK4J0ll#N#^{Tlh{<p&4
zt}$LKRsCZ3|2+pBJhn2QomUms`tU{R(Z|0|<%u|+bvo11AM-$&U*^`o+lNmdxBax?
z_m98ZeEl}fm{M@(sifhdE~Ou>dh0c$cJ5xkp^fqDG`IdGTi3lv_Iqv_WOFPc#>jTU
z^=H*aj@D1J-t82B^1#f0*$$S+zj`OiUSL_7x57{U+X1T?Nv+9_Jy#dlnz|*N<Ed3Q
zFFYBbe5})c=D)WaQ{owtmxeOEGI-eXY3hvPLysRsdYp<qlN{8*Z!kmr+5)T9lcwz9
z+5gx3$0p9=NxvHHgjebRn4bFW+)Ve+PsEP68o7RPyuIC%@3qwT{ZC$q2F+-iE))8M
zG4b!ZiYMNQK1NmU2_eh!7W~}$?2hRV@sgO2GrW#<YHbKoC=C*4-6EW-6L#<Y<x9Vs
z*T`@%Gwo`-|NZ7+88N+|N!OpVe|OmU__g%@h{NCG(j~G3H_s?(-)_Ip>ca#^rII5X
z`wmvLl|J^-{F1RCJfln|WWu)k?T+$h)AP<O{Nejst$970P|@jK%e+sT<&^4VPMdsO
z&b(P~d*m;H4uK={{gt@_tY=Cj{ky(I#GS+NSpIRX_Z9U`ubg(o?6Z@9%)6v)%IwvT
z^Esa{dcJqUKGBDU^IyDp@QC3<0i%S)`+C15uhX6rPc*ok*W_HMBDX2nz%)L;?~&HG
z%#Jgi0#>f}&gMCdKjPPlI-R^bJ!<RS>3_A|&b&6hD*ZISs)^y#q|%9(eueJJbE~{t
zJ!SrjAk)_UzqgBCooVUyH`d>vI4b5c2fvA@!r9rrB@g}1PS&2SD<fc`7AC#ArtjX2
zDS{cUQAgsdIi_rsn^yHC;mG+l5fgkI)kIxxCU|@7I$pY=Rw7;L&!$O}435hN@k%?@
zK2QAVupq@J({01Tg59}a4H#T>JfebM?>LZDm$WVNWvp40<Bq1{*tPGR*%b88`o&Z_
zNy#j-Xy@Cq(&U&+sg97$>FG}Q9S@!>ogb@v#AW*Xwc1<c9fKrH^?sOcxE&JLn$rC7
zc44kon}28cfq)+7N9^~S;_GgT&8uiUvms`Qrzyv_uMNNLCL3~ZlQ((LU$Ni~=QGwY
zanHZff_AI-Cxu;Ev~|{x`E%dJf8brTgvD9N$7$V!C&uRrQuAbPCFI54F-#17VSDC|
z%F0WrD;$4I>b%^t;A07=(TizO>E}AFvd%6MvDRn%f3Zc@s@w9xo(m5e?=-KIaND-^
z;F=wmtV-MKTNclnKOx=j#<s}E$4bJ^AK$`p@+hyW{LSC}N51Zqu4l5F`pG4F-cs*7
zOWjP0XFR$Pd$ZPM>I9SLwRg5p*E(%<{WXKxkq;;D*PJUgs|)F8eA@g#<k_^jU&S7W
zsP7266W`w6vq$A~#YuxR>HZc)n>2ftEl8cq6uQQVL&x^aTaLs2!9k3MArc0>0h{Ok
zzo0aoTVl%Uu32sVy)*1CF)#2qBw4rbj>Fjvr8`T`d~vJ%^6CGp()Hmdw)I^1v{}XN
z-f`UZp`^52oXEx0`d{9=S09QGK6R-k(D3x<OUEvTN>5r>oyl?PN0#%fdhWfv6LkZ8
zf<tC3Xoz;!cqq=lZm;2_b1gC4^DhOopXw9y{wDVPk<Y<A|L=LhJDq3FX?z>|@THra
z(a9q#*LrW_<f)0%`R}4F?R@E!xoqBAQ3bpH44vfXk}IBHS65!=W2-7!*kLBP)B2*n
zOW3WBx0^qo3GA<4^r7Vw_hNzV%wN;e!}opK#3*+2?(K_`j<q)~y*#qpa)T4gcGcnw
zvofQrH_TmKcc+DIf7kQBo8@wE?OnanlFRJQ<r2PKubGpr<(Z#OlHf7rp0zi?Eni&1
zM)LiP=S-ezckF_kKZo?(x)YhZ>Cnf_AI-VZd-MM8dBL;K$}q>cMp~(*-)FVXK7;lr
zFAv^4I=fkZ@#4q92D*Ib;^rqaF|vhxw)Ok;Q|VwwQikz_lO8T<6Kmyo%{IMW;`z-p
ztigWo>yA%*U#r|yS?hRH=xWu~hmHZORO@9+uk1V7_W1Ksvv_O1Yt1(|q(8~Mbw-yf
z;aXAmIfD%@R`+f=`)`-^PHio63k%b)V%o8kRZVx&)uYMhPgNbx-qNZ4?a^h^=Wjjo
z3Rm$~d|hg961R})Q^A4E`M(ZtZandPpCaoFQ)NHpsUkTm*`C+D<P0kCZ~3g<`11X)
zW1dq2cj{=b+Oy}CYdwQc!kxQMc&mD*XMbS{R`L5XZ-aO?!;VgF-Q>oajr;b`+884r
zzv0~MX730=Il13#={M*6ykh9_Yto`yuWp(rN6h|u`p8Uu9jDT+mqnc(iO<4c_UQQL
zE`GB4n)v@^8P$Goj5!ZQzrMR$-$mkv>9**s$Vy))&pQXEY|_k`cqPX7FW;3bVRGCC
z`@2~^ugPmnNa=4$v{1?5y-;y0&HCHRz;5H%uj}~*LT}tSmwKyhi~rJ3f-F%RcBt#8
zc;p*SRy98RP0(Y~#bv7Zf^(zqMt!bgDe|Z<SiELV-L7X=ul)-Jcc?t{47s^xtJcyr
zEen?}y;5=O)1g~WOg~+Hf9ha~!sN0h#h3Hm<#dQL&kvcjVA<tczp`db@6A5%@>_JX
zM(`}&C~uyV-&3x?DNNqg`ognSl<)D%u*;KY@5#NLl{dQ}|D#Ph=XHa*(QWB-CnZg-
zo-+AM-jC%UmY%6va=dKjz2N=Fw**&t`k7WOY}=uqBei*QlWE1IrM0|=d+OI5;@xH8
z_bobo$;#)SeIhqM2xgJJekE(>b*^W|Epg17U0;>X*ZKO*VAJjuOBB3B-M`*du*+G>
zaj{MH^8QWc;vdqS6(2EwcoNj|y}G^hj<)-?=lyJ=wGt{ERl(bi&wJqVH+J>%6L+@7
zu)gM(``@(9YOAE~+F4#{tF+!leeJty|Fogs<csoI)AMJS=r8yv_C5W{xBL(7_8d~%
zmJ2^zBc?2NxqL}W#`+aDH+7z#wOZx5-RaOJy=tY?ds?T?cpJTN;lq8VQ<UCMVJ~D+
z(+aR!FrhO(zc#Ud+x2_A`?J^PYzRs3x3!uzH}UYMPtj(te9{ZVC+=USb>;5je$!a}
zTie;*IIZ1RGk1ogfXbf!-dBN7*K$uTv0g8(y{<G!@9wu*?=Eh?qa>{zBbznt?x}Ca
zD<coi_UXR=Tuff=YPw{hutfP(z19Z@55G>4TVAoI+3#oGk5j${-=2GhTBzAfS$EX+
zq^R2Y4IFD-BX5^K+vuK~8yUiD9+XyEtC<jzt6CU#{plgst0J4yO85H3hI!21C$-l5
z^Iq|~!>^C;{POzWY-hRu4~l<_eNo%{GHlC1(|sQ2PgJcsWW{s7N&Awul-xPfqq};!
z<`-S+o5;g25_pr**Ky)RDTj_pTH%YmKkqTS)*+s%mdRmaVRwsn<-ztQyQ;m_*^d7c
zA})XQarqM(^y$XxXH&%9nP2vl5)V24E#Sz>X|w9)U);SSbfw7WWr;rRY5sc{w$8e<
z^YHAs46j!1s-Eh?JH=l!$lR_Zk8zgFqUw9qlUn}^b;VD0`e87y$!b^2oGg!(ro6}Y
zwjWrt^6_ple<xO^E5U({`)WT)FJm(6(RXBBvrtT{qwjxZVO80uS*d#N*(^DYjtciT
zd9K|2a^GB4&%8AEYwY)@ZDYB%abfT8o0}q@=au#M_{V1jOHW>4BE9VD+37b<&AXZ@
z^^$kBIFrNs+I{Nxy^FueSLbT|+%rea)9?wG@1xsO>wI@_a=LKfTT0RViHGh4zn(Mk
z+NWKd^P|}pE?g+t;>&#AUg+4tv(a0Xa~m#f-o)MXLSNo~!;$(I{0xf6lJ?&8mH)}3
zeB^UhJL8er!4mUM9P-?JtZRGKqZ<J!7iXlFKQ=Wv-}-oR@^<mMdoEtj(l7tGd;OS+
z-QRQXh0iy<cpx?T!4msdo5kPCwNKvaI!k)0Ma$FNkl1hAM6TRiuCxDi6YnC8J+pr(
zm3Nh2{jA?M{aW-+o}^6<((`tdpWogU<+@Aka>@C<C-OIQ7|#0V#&l$!;<U`o8#eyu
z-x9f0X3OzofBx^gw0{5kBP-@f*53bC{;*cj=$Xi#uT3%&Ecf?MmKEmqI>dX|f|a?e
zv%2uPs!r6KZF)xDL0T?rcbvSep2Yli+W7^}2fB_ue5%v_@@jUjRz~TB*Gshw9;saC
znlwizOSEp+ir?W~X&-Gor&q=PTlRgc<7JgFHi7zAb88oz$hh@H{=o8mkz%hlwrc-;
z)XBQLx&L`e=dz8aRo`8AT{V9g+kW}C=k6oYuWBPFx=lHMQ~O@P`8dfh|6JIbE-T+V
zamu+?_v<Xi@)=_JmBMe7T((^|Im+AC>E&p-?9HYHnjy18N^Z$~i}v&p^R^f73$cE^
z*faEP>&oJ*7otwwn)F?NbFSVVy)Cx6{b484XD0YvJhx^-#De6tN2Z3K{@StBJXSfq
z?C#WOC$#c!26xnap2hZJ(aW_LC$FgGOz)j|!21r@t%}SWODDUXOZyq5+7xE?&OW0@
z{MPp1K8**9XT9?Yd^2O#@@qef`l2K6PTlHcCy{?4asD!gbFnJ=r++By>E0{8;M1xP
z7qj=D7r(k`vv1^~@ZVc+oS6NoN>)SsI>YKob{XPZ*4$dZB_lDo^hSxx71?Jtf4%00
zlsug)`h5+D{miWAC)78+o)Iol>-EYeB{uBmAEu01Vf)JS52)<?ZhHKzXm7mB>9+~>
z2loHeet+`i5*K4G{RY42&)58)T|SW#{8wY0>cfi7n}oNqzj*oXZ^BGlr8D-r>o>2S
zWO+7whFzJ(4?TUmjVXV^UNFplrZvA|;=M`#>jPCPCx&=4zL+NVc#p{U{1VShZ;kE+
zhTp>?-6B4?#(A8bxAs(%$k9R>&zWhG3v7LO>+>7MO_=5%(f_>J>|uaQwNdv;%jf01
zE?zIp*PcG|<=TT;m5!VDRvLA8?rc(eH2r6!k6ew|ewjBLB#*4Me(*E+qr|4oJ1bsp
z)_IUH^}NnujsKZq0>!=Mhd#$2`}l>UVD0=Bbz<wj>*raVb_);DyZg>H(1P#Cttrh6
ztb&~u!Ywfyr}3&4K4n|boXhQD@jg-2K0L8()*9IbCypsfJ5BG-sC@XPwM@3wapq$t
z(VaatSC;;BcM&Mxcl`3oo@qL(tJ)HSb(;7UKH2XHmU!N7`0S0e8uzNyCG!9EX0>dK
zDAIoNR)&A|15p#9NjF*R4o_OMZ^7ggH5=VGP9L?7M?c+YE^jJQ!}D~~Isp~2t)=gy
zoaWvO5LZ1Yne})@ty#^cZNHyQww^a-Mam@pw7*O9IVWvD*0p+z45Rjnqq`$c@pA9&
z3;Jc9rF6@&_~7c`9v($sq2R#sz1<UY_D;ON;Gy@Vvr8vA@OP<xyeza=EH8j9dVP+d
z-m!BmJAdS^7faUT^k4W*GdTTcuChe@rW2>1+>^VIA{SY**r4o(-oGW!RYKR~GEKOV
zw%w%jzP1kE{gpX?WAEqw<NY4^kGuT;?{_=a@@&scEwFrMwL4Ks?U6ulsZ*=ub{XBG
z%galaDm`TKc$DEHQ&^U|gWpW%n%uJ)x9^v4EATaU4!<;;P48yig&QvlckgUT6-wXF
zGPO~q$Hq&`R=khLPR;m1vtc@?v-qpM7qxF|=(GChF6O^~x7K_5yxramy{q1a&G!yJ
zEU3<R#Y9!XUTyB?s0u;N6<j(paS9o~9lyvKbjBtcFW$X!*Q2J{7ixa%^v#U&imOye
zbeexEJToR#Bz4{NJ=Z;TzAgz_mwfkud5gMq;JnuIpIfHgnt1-&)%~y6soL%0Xx->_
z{q((zYp-`D`G{p6GdjP#q3V2IbZ}Gqo44JIvLp}O@r~-Avzq<q_CDpN_McOjj@CXf
z<lZ!womb6TM&t9#sF$lYaK2y)@KD@ksN^{9{ey_|w63Ct3l$klZwe+p>nLI_{=I>@
z%Jbv1&vQk-oGWQJj@*Cj$sC8ptQxH^b$cz=bQ~1oiH=f9`Fes+jPtSQR0frUi9H5q
zrd4j}SDXA(rSAlT?+hO20E@qkIm^ng?S5F$vbxyu+3BN~e9TVDRNwO1C~YFg(z>Ve
z|ErdGW|>!;U+$g1U3CxZi>B|66I?yn_{(PZJHMUwP-XX7`^GD?uCeYv*u0*_X4#av
zyRW@uFAvyweot?4&8v<hm5p(mR4>_!=$$l4KgO`P|9M4xr?KW{mbB0oc2~|Rk{Ryz
z;yPm1*{n|IJ6008Sva7ibEVf$Jw5w~CD!#bW1F0hzTfrfThnvCxvH*_orm|$P!YR-
z_UMskGcJGSo5-ss;LX~_+xWLP>rP1Xl+V%u8Is#{UQDXUvD#R)w@B+k_5Sw>p5n_i
zqFXeM&y<)Lrgq_1&;rM^x9yWZ{ZO}INGUx!Q@W5du4OrMg_=H#$fLy_CflxgUbEIY
z)M~drWj)J>{z>2N{QJ&P`#tn|FC)jk^R13&;!6ePQoIY}1G4#hUN`lz1jx1b7R~oi
z?N#R~N%ztfy=!@|^8cKKp0XnztBNEGvb8VO2!&nP_RW<wZ}z^xwJk-xOvWEHHnvO)
z&+5JARh7J}^t{LJ=t!$DrNxPMi%iSvv=%>Fl`DU0?vqJ1p$i&+?#kcLw1U;jUE1O8
z<<IFV-aW5{C+%Y_)3_~E8mw1ewQ9!abgn7)Z4CB%<b8|~;R~GeC3~H3v7PN-(X1Ih
z|ML0!pD^b8SO3`;`M8$x<g3N2XWXeM)0a`)^owhow4>&RXNU6dEPQfGbGx>~ALh-R
z{07pp>1G#g&t`4ked+$OuN+d=0y~xUBIMFVWs4qd`)zW!(IMSQL~W8$(#2$38*!PR
zY|otjUQ!ag7ka2atH{~A&M{vlj=$z=V${>`@n=^nPkH0WFJj(TH&5yM%u~B}^gL1g
zoUx~;WbTDUZPO-yy`@uBso>}QXR3U4c-q%}`Y)VnikHn_TJXC4UfIKqnw#D-@U(B6
zBh<{$)+PCOMkuSjY%QOyw8`V|N!(qRtllYaeHfb0RQ>EhtLWnio3y)*FD+M)mb19T
zdD<?=rHMa5N@9un#1E<Gg=-n_JmBED`hdHCVXs~F&Z{|V*Y8ZpOL%+M*#4r_?1`V6
zxh^}{@XYr7u02hc{YUQ!#>L6%M=M*WSxuO8RW9pCYQfVTuZ`TN-T0_@)+A(>|7n-?
zT0za5_C9$w=eP~8dZlBi)1Ns%Rg_|uSZr`SsxvK@EhXAG@N~!CL$h^z*c?1hZDvTm
zIp=%t4!z2<(w4QHg?rXnU(kOlXmYG8a<gKvL{Er+l*PiQDx3ZPf0s=$6Wb8FeAd<}
z&i8k$yp?dW_d}D)#@*ZE9p&G3RWPzW6Pdyp!PFEllY8~D|F&$^byWv7m>VJ&s(X~4
zV@!I!f|K*Jqvv<-8Ap>OR3F@0**krO#*G&zXC8O3|6uPJ*M8CGV^E>M#FG}D6IG5y
z9cW&3Sz1f_;k=oKs*`71>~3pRnYm-{)9k-_(QO|bic@c9YTtglrPRN`<TQi*LB$(y
z6@2}lEPP|PCqri4mML!A*T)|JZlAtX_?k+0;GbQeV|2O062f^eM@I>y6(lemFqv;)
zba0L1fu)z{blvXIocs8Xaev&IN74pOs&g03)>UErnVcQ`e9ENRtD>e<$JdtfmPGeE
zzB{u&>GHV?r|RprHn{#+{XVX4`)b{NZH|AQv?rXcoTN7Oxk0auqw?j>uhHf6KXUY5
zEtTU@J}>LFHrAq2X8ZZ2YwuMvo8SB>{rN+Zw94W&;u7BB7ldcTU1L9EU=_}=*(PzV
zpKip4)3);icQ>YUCw~2!{ZOXsj(C7?IkRd0^$#kYDOzS4U%%~?RaWkAPPtxwqPKsY
z=9jJ81zvw=yEifRuI;APf0RFb*!u5j_VMCPU5ob$e~z5C$nh<29OJGM$LhQ1nHrt<
zI$5wC>aFm-pIH85(>a6OML+i>z7k5Bo4Bd!HGi<U^&QFk-mg9^vRnAszHlQG)07XP
zB|iOqx2MgWaPn&0kFej*X3Bo@FXKDBV_pZZ^P1f0C#OzUN$x%R-SUsrA?urI-^)^G
z-8ggay1wYK-3Rs8++BE>d#mOXA*aa~-0NT8{b{-9#pZ{_6(8gM!yKo&OVq9_;`?y?
zYerBh|J@fArq!1nnHh|i__@sdaQ64&$MvVq&S2${zgcj)?QhL&Ug<o!1}!^w-~Z;X
z^-LmLN_T}W@hFOjpEaZ8OQra{ubutJSNngQwN`BkU$fyPyKuXts|Ilo7&{#wz0=+J
zUiO~3=VxaAQe(Zm9%Ij^OtLym&8!jG-207v&emQvKJZ}@V_6fIq=|n-V)h03)edqJ
zTii>!lCDXs+1wO8GAF2Ii*lY>dEI%1kmwJyQa{Oi$r&8o;N0G?lXoHZf2yD4_qpvF
zHK&e5&fV%=$mb;b@v6PY<Q*}rj@nl$H}Q7vl<f*!!|Zpj@PMD_%ZRz_GPk*}c{F>T
z8*4<itea?|*;zjm{@oidZMzxwHv6V;B;%2bHU}3-zq@_!>YY1ppI@-MefI7%*{>z%
zA4|7x3=U|^`{@``shLzQ^(}v2?%5^h{v>~rJ8*c;PVvk}h8yKmcK@mBoM;oVt>3z)
z_y5;VUd%Or{;9tel9_tqufNx|Y-{UdHHB4Kmj$e9|Lu#+D*v(FG_hJu)N+1T<%J`w
z3>QZENu~!S2u|GRcD_ea^1kiV=);@#@;+6)oyBb&;Bez(%JwP6^DUaDe>JGv`z5r<
z`B40a%VBTieijCO{F7?FK)>ZlXpw&f3yXDw>ESD{D}JX<if!kcGwrC7Md@*K_Gd!u
zyPhcK%!}s>f2Oma`($ODh_|Sb9-BnEckOyxHnpEMY-zd2R`7PLoe;PC?YS4thb?>y
ze;;^QId5Csd%kzCK8T7GtgZj>bkg+lle-?~9ox5eRr%Y!2@#*vwQ6rI>*w9%ul4&`
zzjvJSB@czER<Xif7gWyX&DOuUw&<F%(4(l+rMs@~@awK>`Z0gr=V%vezkRn|*YD~(
z`%$TS$<lXh*CI2o$>jZ&M_umqH%TEUmWP4ig9!tJ0`BEr+2x5v>7XTESEF<D@9Yr#
z_b%R1MgEbtS$B3rUE~5+Ve6Bs;_*E<#J>ng7==H2XEe=a>XMxI{;%%8(0|Qy-^KIF
zz9pWG_u5kqPoMd)Aa0)It9g@FpZ;8L^Z!6`nD)0nu?MrxhR-?4T6yzA&Ea|bXZ)}E
zG-Xa_n)c7C#V7awca8h==h6A|5Bv8|DBqf<>T}A?W7W<T{gJySEmDfymQ|`9IZZI`
z;1snj>srmUubezNS>3-b^)|aA_otwBx4DieSKZ!FaaBfa?wlQW4Nkr`UDy>fKZ37J
zCAnX!uj94t;_L;%b3VtMKf%6k=8~s9F<uK@^&VW$cdAeNpR+TiRoP_z@42U^O+Q)?
zU=o&QKBs%tL)FQRcV|j};O4rvLF&ug;$_dgSIvm8c&EOtF7xP=72f;4Xvbau9@8bY
z_2W!0zv-&M#zl<Zk7k!`6D*i*{E2PGO?!Qphjq16!lRnZY!cNsFaLe<kFbcGME4@r
zTc7tVDtFwsnfu4_(A_ypew-@$yRkk`BGx;Kb=G>v_nVeIT`F6C`U9V_!TLXZ`KNXF
z?unk?S#|XK^Bh+8gTH4^)V_FXj;4kB)a=&eg6rBvw)_7*{#07_?ey!-@%R6JD=Tz*
zus?g5$&5~=`qrQKvjtvvU%IsV(4AX<q)r&@_|zC<uC89`IaMkDmQ{VE$n<Xo9&b$~
zPWg8WA68GC+O?)drHXl4q{z+rMz?w|cTJC03RCGht1B7zJT-a&Q(ocaT_WC5W!CxW
zWp`fgG<ST>G_x?1W9puL%HK0M4YD)$Ct2nmT-Kn=^|UT%QunWUp1hmZJy=jtZ2ai}
z$BH9sRv%pYPI71Q^2MhF7T4ZpIyiNi>7NBlQ?}eVw>L~D-#g{v{S?-vUw19dp0Rsg
z{R6MZUmKpyeHGs*{6JJqv~KId2VF-jy28IM56eu-Es@)?x;NvrQgmRP-ie@&OFda}
zh8JJ4o>+I5Vb1$?4}?@ViurhJ^ZG^I4{`L#_r2C~u3_zpJ&HFshW}VDyKAF~)XCN-
zRkt^$eEqBRa(CD}v8I41!;H!66%=x`wBGyeomCdKxad{Vuf~nD?quC4$UgI|?4{=2
zGB4-*ul!!$IWhlm+mY7(N%8YGy00td&^n*?Wacv7e_P$yemFN3&HL(VUVh8^aGd+5
zPq$qC$~qdNOY~CL{hPLWP2-G!X>0cI&U0mvFy~~SBdF@|Tbk{A!?&!xeiM1MXNN`~
zx<83G$6V?4n&b0XnA(<9dT_D3v3@XTwSTC#Ei5nXWXh$BC*R2h{M>#}KDMADGXJo^
zn<Y}UH|E}bzxS=oRqY3fhd=W!tUM?6;GD&p>F3%%n)F;_x#E4YE6``RUbf}(kGqs)
zzPSmWS#ptA<6K740z>^XN=IT+Og{fC__sUhQ}5F>*|%vcE@``^?z4PeRK8;A@2RVJ
zmh$|mT601BSWbs<f!&9WgSGd*`M0VpoBL6B^+92Uu6H68Q>3odMXN`@X)G(9ukGh}
zC(EFO_qd|hT7}I^og@6DLw+`u7#5U=bSur^&njH7`=yD1AHSzi&}TzVqYQ>Zrgv{e
zE_kp_D>{GR{}(mq+1~PJ?v!5Rj<|a#rKNOH`HfdiFMBogR$iGi?QX#*ofNCv&3?~&
zRVT5!Y*(GSaGh0kQNe|ivg=rk%d>R;ZExk&kqZ(N`N{G0Qu+>uYP0kQ`lmlV7GiYy
zKX1+JXKO>$!jHFHICMX;OW(Vp@&RY^(gN$bGkLgPZ4YAHmQ%nngL7x^lhpoa9FnuL
zU){R1<^HMQZX53t-xby$-<p=CdMd~!B`ezUu4`Gd(U-Z`W#7)ps(Nv7&#t*XhEw(x
z&RUasv~JIZ{S0@KR$APgZ2i>CS|#w=q|3MWd7k2qs*mUNo_INA!RwD^u18uOo0m5~
zc$ccN<4}PD`^vjrc{v~U7#}<$D5Bw%8P@xk)vJx4@6IaCcXHzWp&2i0va+SKkIzx8
z31PVBw(#~8bM~X}1CJ)3UNqa8;r+iW8`OX7Vm>zeSh`7zag^PKT$$I89`fj_EIpX_
zu!y^`!u58LzYce&VZjf+Q>G=${z<Q|XU}|8_`O%*m|&{Tvb~EPd1Tucy)T?<J@M!}
zqqL&}Ty7_|+w|@yZ4172dtuS;qm_!<F~2@9k*P^!?b`BND8}Q}+~wj&k1aoB7_GK<
z;Zi22>gL(=FO|qneDktairwmb(}(8JYoeEPjlb!9JF$t~b9S3Ahiy(<MBVEo%XJGj
zbH#L<FMTQa>y#K%a>1^^OXjU_3lq-HJ!P7BjJ-*VKf2QPw@h_Y=Iqp!TLoLpg3{MT
zNODKsI``tq5s@W<3+=Bta@MbT)0^@7&=x8G+QWuUv+GVI_{^T|zIJi;nqwNv(pXCs
zFEaTb%6`+G*J<!AulpEpXvAB^!@);SUG;zR^Zpr8%MPm*RX4P@mN`EATq#g5B)raO
zv$=+{)pOr1(oJi99^@SLalNuo@5!9p*K$T-5syu+8yL)aE_Sp>R+#CTGwVo1GkSef
z{o=ek>s#r`4{{G!%03zEMnAJsy<EHg1lw^|)g^z8XEzE}%119LT=nUs_RL$~szcTb
zl+W@!!mZhQ=0NR~*H@QLy&LMgu$Wus_>-WY7T+8$gqFQ`iCwbm0B2u*q(!V#_KkIZ
zo3r0t+quv#&~&zCZjN1VVD18+^Hl{qv@hLReDKXg-OXM%*K%85ymeeeCv9EO0<Krb
zWL6o??P=({^gJf^@>hPwx%cJ8*DAcy)wFW`RrhcH!($<f-8U^;Vwn;&`OYp5OJ0AO
zX*2XT^{qYB7IwTKEyw5|OWYyD8*NL%0?Xa5`<YcrRUbc=f4G0YefQQ$s%Fo2d|Q1x
zCOFjAnqeQ?QdQ>{4)(hn?oQmH$GW6A@Qa?wryUz?I3LH`Z`yNJ;;)d{(|D=Bho?JE
z(EKmqyv&AAi`h`8e!A3LFQvZ@8FOZ4@7u{4XTlTc*VXkbC}m&rBtN~o%#TwH|JQE%
zcJ5A%-ab#h^{X5T+>-Xb6+C_K#+CxbqrQi)WhkvM|C@JvuIb_Sr5bi>(F<eQw}ftE
z<X4m1DrefT#aiswZQDIsl56fd#WF0?+Ek)H<^9Sd=8~)e)7FRi%u@fyyOuZcdyVEH
zW4AM!NspFvOLG<~CtUEEa3ks6o^xeWzF)oide>328$u2*ZNqC$dVk)r-CpcH2QRZ@
z1#4;OxzcA*`~J3N?9a3bebz6xhu=GY^7$EUk$>{6`;uRrh*V}=Wb-a!!L6%(tidO4
zUNgFDxORrw(M7dZ>c`6MPjY{|&(>VmulkGaiFb;)xt%uu??ZbpOgy^I<jdM6?mx|M
z>#lVD`{(az|GBN@qEaz`HpMPqFYB}+|3S*P*<EYC_f0+E9D6&sb?rCTyW;1BZzsp)
zo;9_*<Yv}&{=mg%kFbkr7rPr}GroEG)Vxeox_czr|DH*(ajxN42NngUn!WR8=&Bt%
z$gzCMft8+)Jwlg)1K4;{WGp|N<yG`QDgPsre};x?EK4ZwY0Fa4g|i+kko%F<RlTqE
zR=pQD#}c(=tG<L7{N%6UoW6bUgMOQjObJ&vKG`dAfxY<K>&73gHy+Qqtn<+B%|)r7
zVoE&c)fMjUdMcSat20u#c)I6`<hw@{q@w44TzTksT;=k{DT|kN%F0fcea;@|{3qt!
zDt$&XuY=t@)wMrLL!(YEU_W8N*1vF9WI+C!FK@W^uQ~nDNL^1T$#z-miMz9xd}E&W
z`O5{1Dsf9`quF13PuPZ-Ij9PqKXNkjBbQcSV&R{zb&q%DdR;rJAm389jkDbU-+|No
zQeWKtvNkO5XEw<&-?4lX<Hm#c{@>)}x4msw{4w)u?}UcfGa^<S@1;D9{~<ahv%9VT
zq>j#&w#@G-{p)=XoMzp_BJtu4`!y*?{wVIBk2p^4_*HOg#;-nwylL`2chk=wmTZw_
z|E$rsAWp{d`jZcbJ#RmC543+3^|!6ra>kQNi`w0P5?-<Oy;(fZL4(~<#Ji?n=f0Os
z`0*RNt(?@w9Ay3OthK)ruFGNVRJHwK0w3E+S-<;w_A{zVWxl>Dc=cF+)|ZvspY0Ca
zj(9u4?@MCV0po@|8DsJ9XFH~v_4t^V{!N?xy&!*z^8%UU6FWYHYc1}NyB};B`7u;v
zL1*N(tAFEP+Mca?n!>)s=h2=^o6c^W7_~zwGr+2L{-gQ}EAQRC)@RLnS8-W3^B<3A
za}MU8EUV4E{@*VzX2DynY<JPzo)3Nc*^B?%E3bL$(r@o}=em{Gw&FfPyI(#9fB1NV
z`K1FlaZa-R@K^U}`_ls(1FvQuVmP^jd2-Gbp0(*I+ie?@&-V6Q`t<4LDcc;sFCuCm
zf7LUfc1;4+zFbidVqma|W?)dp-8BJkP{~cq%+o8Vyespz=(gFX{qvc&)=!ufSmC+s
z<yV`>vv>6se_ir(#x39XZp$AAsHALM$RX=_^J2;;hwoC~Q?_^WGbuQ97ERe!KFdev
zVe-a^H+p3ox#vuHz5V?Ee=m;PEKT*5k4@c@^QqErb#T!>uS=}8UrefMN}Tj=WCcIn
z-rZ(X`{&8a#moEW+bNoJd&OOxHC1JC`Idy$swHZ?zSF|m|NohtQ2gd|Ps~(a-36PX
zHfm)Sg~^@O-lkG$6L0>y>zLum=>b<KEYXQP9DT*zeUlFBj91pHuWnD<eCl-cq$^LJ
zc{p?{v8Hyu5dFC(dfr7*-Nbd7ey{WH=FAnJ$-E+Ad$PlVMUj_O-db?&%lgLUF>U&n
zq=O9$RtZLb%v@oX|Kt4hlEtsWMR%{Av^1~4eYMv47tw)sYSZPVqNaK(a)<1f$%tI5
z#r5Cafko<Y(bD%5#e^<AeO><Xbo{YD?^mCmEq~7@zdkO0pY8vbf1aK7-_tU!yzrEl
z#P-C{n)&A46`r$MPun=3oiu9|qtm`W;k!PaeG@**EcsKD+KxHvU)KKqYuT!ndFet<
zjmx(B0;9-1Nu_f_wtt;5Vba{g)5TpcnQUp{>|6LmceQKo$+&x;^A8``C*I5Xz9jVA
z%^4EHJN`@v+GnS1`89N^{%5uQi{F0wV7Y&BDDT>Jv$-xz^xd2N;n$yMukNZY|CAke
zNjii1kBz$d#k2PJ;*N>i$HeW~Q}uUyaGy=P@(;^p8(yU58lCI6RG1->+~lz7dF3sc
zmvMnpHa*qSXVAa;&q-`XZ<W}j$BQ%$*WXbM+po7czHY(GU7l&IdzXdI6RFf)5?OBO
z7BrW~iu=rErIp#Al46&2J)f_A@J`EH9rxw#Z!b;bTz526`^H4w!c~#ItCVe7wYW3A
zyH56OOv>V`o|hV~YNFHiddsQsv!~<#IA44JIdsnX$3544r!^<Jc;x2lIUMmVs^&Tz
zmg^dp`zR~+)U#td*8ddw<#yZ9QTqS$1?8uA^J%bpdVE-!G}|-avYNzX1~G=rp7_b4
z|IMxzFI~;@#c1`Bn7+Ov0dt<lt5)7r{!nzK=bYo@=c)IO6h>T5vJ*S?WeUrm{4ciu
z_?e~mFqX3IIB;Np-1-dBJ|*5lTjtQt$8%?{@)z&#sTBF#(eHU~iPQE~KF@57FK(R8
zDRk{(6>HS|Hu+|i(~o+DZ7oE7OFBblT3?yKF!8!?O!2zS4_-X7ZP4T^d3e*bx`E~D
z?E`fN-w(VA;bpP%zV!V>rqF~xmRpS1#p{$`6l;mxA-<q%<FU3TRc6N}o}EFm`VBlE
zb@V55>2R=~jkXl|uxr(Uny&0^>w>t}1Z)kMJImIw%d<*hn<z8my-R9gyL*~ar@duf
zmQ*U+e5a|$T$+1E=w@~gt+gupA<K(29yFa@F#WWp-_bgTr%6=`Ql`v~dXuD{xj+8R
z^|f-h(cDLS8@>iyinbKk5ahP@C9mvcqxpx|tvZmOX;d;H>Jxwbbg^}zRx(rWMe=y;
zDzI2!nv)>S%=X`QgZ1QT6CFiaPX=$*zfj4S6=9{o7qPiWA;DEDJmJnPTSu`&?r#rG
zKFZI`7Ob=7-?y-LoI8A`@pVOPQ<vzk`w;S$^NXK_ZfwJ*3IzlHwBN~B4yNey*!A{p
z*?KZEq)%UG(uG&LYXV{z@-FsqZZiJGYCqlJL5uj-W#70X@-sKN-8xwK=l#lF1uI{U
zkM0}p2|Orqk^4K9#a1q80q>nduQC^Ik#5(#v3ByxZ_)>rp2=S4aC%Cc#c4y%@+L{i
zZ)SB{?#nT5xZQN@^{lqf4|FRSUtGB)c4hvvoY*v%EcQb?<Q=5kj%W#dQJ!{ZUs~}e
zLGcH{8!kJ$U#pO@troLoQ+M1DwmSFtk_1ilhci=;Own1a%x$ndTct+Yk2BV{d)6)E
zZx_!db?~*e1#o^n_E2NdicinaFYbz1Z+!fJr;aZFyedJz57$e$11;BFoOt%6p#8=Z
zPJi+O_I&Hrlx4`Ar8%!FJ2>c&lZ<;q(Tt6==G_g+&N^he;(@f&^=-8al47S`xEi2v
zL2YS*lt(#R`<;c3Q?A5au3wvYdg<CHR@pb#$L>(BVV;n&xJ&O^>EUUc&M-dRwzG-%
zfAj4P$`8t#S6=XKTW549*Oy^k6o;ju^ebkrD*mtfLKBv3%Q>etsX<ydW3%hNNrpm4
zm4lAG=sGDhn=$iY!!6b2OrcL^J3e+5)qT{)$<4ZF(S?VaA3lBVnp$yAHnTiui}1yQ
z8>_yrEeiL3Z)mPLSvbsn^^!=J{hRi*%v^M*vEhM=d-5T-8dk}8$GGFy&Su@c@-QRI
zW9Ki1c%4tP&S+)?Pte?O!#stNY41T!lP6jclO~xiVH5Qfdoxcv_Db{TKh5l6%^N<P
zkUXaH!c)v4t0CgzZ>{_vo~sJDr^v;sq=q?EUTK&3^SGd>?v_uQv_$iy%BEWt6HWe1
zZ@O8aRjt4|d6ycGN07+7h;vfk*UsHt^21ZfaFb2rjNAil^VMH3dKn#3{`}H{wgVr&
zf8XHM#D4NYS?c0koAg_<0X9dv3J#oY=2p;M_hI7=zJ5!2frT2mCm(D%(tBBtPi8@5
z=39o~@-GY1kH3wO`DdGQ!%o{=qIp$Q!2O$oyuMuxs}0U4&TUNpp`cv4gz-+}L&nAP
zav8q_oPEM~+Ff?$X0gQ9zt8Tlr5{>Q{D<#!3;U~NrOLlO?_D;OS)O<}bJJwExPW7k
zwhe+$0vu;fWPCLH_+Eu4EC2E7%yaQKX$j2E`7-Zhl@8zf?!wJ%Z!IjBd`_ybS$AUk
z)9Ej_G*5UiEm&yB!<h}z`a2S8!??wL*Lyy<))ZfM=SgSc%Tu~;j-M)~M>E*Y>+`MI
z6|k63{jf&TCgJwu%kQo`u+gn}a{t_Albm~>b)}y*=(qaa_h#jmV-tQ@O0C<sOR-t@
z*XzbxS+lnV7AAP#`SY;r@X6baOS3nWNHE?$FUFnzQcg$QcET@K=g*1DUmupd*t7QU
zIiDYM%~}rG@m&1#<5%<@U7dZU&W-=S+i*`?@?^K-wI$nRt)EPCdm>c!R7RuG;QEUV
zSDpLk@B4Q;vBz=7c`=D6tBr+N=354Tx!xhTRHEv@x3`IDJEl+DxbxpasbkEk9c6~Q
zzGh4_Teu?K_+{^*Q!ebUb<6`aO&A|sJO5w7x9!xrp!<f?{-1FC9(BHoZ~vLF6J0kh
zq*^}R7?OFtbE6;6g1R1sZ%f0>5B-rAS}psl-%s0G@=<_D(1~wz_bfVW%W&}hoHw>x
zC(kTY*w=0QyDfVvL&>xoN;QJ33tIekt|()^7tsAp!*|n(8~k@aT$-*H)PJFtZ)Z=#
z3%;zE)8vvOr^-cHUc7pLQb^R3w%}76dTTcN`)b=B|L5>RK1jUyPo2N&=GH55>q<2L
z9^LV3Le-ysk97ZS=XY#9U^2Hlxc=XVu5)u&9}c>=^56NFn&FGfFRwdx%yZMiYkNH#
z?XJE(fBhHFt_Pe;=NoLa51z<gFMs0Yzat*L!nWsgBPZ>@o>Qq&;ceV<*`CX7cg**g
zU2<xVZ+2#EXjV@(TN3Y?nfB?}hk0)5J>3hB-z}5QT2OWQ`MwigZ<o#ZFXNG^U~C`i
zGVAO!BY}tcckW#_2$?$j)~%UaEwT@O*kKqy^}fEEbj%jc&2Og!o9s*Ep8PI5+AiIo
z&*Qs!U;fcvhR0vbbQ^B$lMRUVzZCAM#^%AhV5Ql;vlE!-6}%})K9zrD!t|2j$j~*f
zN_>g}O7{IWerU6U@#jf{53`q4s5pp(+1!XxdHU9B=h7!XlC_%ZlLbxVE{f<cNZoVQ
zow<Hr66@~vqaKrIeOj}t;7jL<R|))eX2J&i$4=&4y`y?muX<UmN=BUdhvxI#R_ii(
zHuK(ootUU_$<5ubCXkmUj8~iai=fkDkNJ<TFs|Yhm(}hzm3ixEuKx3D_lic{9eGp#
z=V~5XW>t{B&G=(Q$AkA)lg;}UzwqL}5Xe?5y~aK@e2#qf>b>nowR3+~=I!|FaGh7H
z@7IeRy2U&Cn;x4<7RQ?`s}_*&v^n<0)id+5v%x2e1qZ)vS(FmCxR@beK_<)oh>dv}
zJ*m!@Tic%f*%?0dkK3BL%Nu`6tjU}!@rzMq6QAm>c_~v8rDAl~oQW23f79tv^2E|q
zl6kQh`!i;(&0)1HcdfriId4=ur(&IXvf}l$=Zoj~KG9h=S2=F8@jSukGs_M5qxm+J
zdia+$>A#NCpR@1EO|hAh+<!hPrb%?jG{$PO9ag#S;&NhbWvAsOadmfV(+*ZH-Y@HQ
znfLyWa@^1J{Xvq~ivP3H_iteG=-;5!|1ssv!ZME!O6w2A1SKkLiaESq^5_B1{d-Pt
zKQSfV{CLu?n1}OL3(xU8vHFRv+40-YlNe9h@@jeINtUs{jA*jUT5(R$+R#eavcG4U
zYtT#+UiYxg_e{B(Et46SAGfoWvwb*k#bxh>$<5`rTn_DNnx7G@QIV_7$m%KduzsOw
z&nrINFNVf-2fQl%%~x=3nW$`>krc2aG^p^|weL3DTUMNTsKXJh`&e$Vx56?<wNl^J
z$L>g4HFFdv^-NiLqG<E2j7uCJ%{N=O*v*)gqa*D({Y=_3;ZNMGtx;^emGPUZbNZgF
z`@pj3n1|Z)*n9G9>%|X*NoIcZy1DCw)d!2+`o;4c%#%0hKHxBLpTIHcvB|+3dIz?+
z)xGoC!rVFe%(*rZyKVlN1=n|qrY+?<CiK&I&d$x1mff9VYZVr#*M3~+e0%4U9}gpU
z-#cho%Wr9MUi5X}yR+wP?tJ0v+|d1|bG84iDRB=k<WAVCa=GZmf$b+&u$X7hW4^<9
zBT7beukWfg4(viZ#EZ*SCC+uFI6BTa`90gj@y9cTZA@MJve;E-Rn4&D`4k*ta?(se
zd`pNj<EP}J{U<K7?tDH&w_=V&SBZ4Z>w|5Yg%9(l3Aj|Y&J&xh*ISlV!KnDmdqJGR
zjNNC9ScKl^I%ml&vuKnJo{|3|;P<r&!cM!=Y&vJXUz+uR`BkG~<i)I+*GucJ?|u0(
za>G&i&r{ZmcNAY_mYVZT(rowJS&C_O_l-r>Oph=Ny*kx;JnGSH)_DS-M4P7O><D<!
zY_a3y!u2z^pZ|4WQrP>-u<E^j7hBGMy0Rm$NJ;g8z4{FemoEFfiVWj}e5U8~4bRUn
z7VOx)?IBC8LA;IAoI?-P4zX)ZIb9x?x2$o|q78~Y&3&@gDQ?`R4e8aTUngG{%Vqf&
z+P}iHBu#&px68?Vp;gDK9{h}5ee0Z6I#ZWyDD&?he1e>&LSh?3_@BS)J?Osf_3@{-
zwBnfj<ktH?cC)Jst)1laC?m+gKcbMm_M?&K>QK&tW5@l=mhC&G*Yxm1s%jxWPiWbi
ztfa)b?Q7Q^yt0@>*3YqK_Z|kOsb{W9M%Of@vb4mi^~QLZK3nlPf-h!9XPijNn);{+
z4vDC?DIu*+=GJYire>JFi8)u_|J|GA%AL!rJ6|_0Kk;s(OV@nW)xY=dO^=@2ef^=w
zyzG|;E+#15xPH*Snd6>!QM*Fhkpd0FBf2GyLY3<uB#Id3Z~pya(TSvhqY7P~!mk_7
zEIqemhRw__=ejciHY^)iK3#5PDl~8`nE$It?X_9qdB*7X!AjfKCrH0%uX$;(b2nSt
zOOfC4L56G8b&Pd14C1(bEH>-N6dFneO#SuwN}Xx{W35{mCH?*V>su>(n*(i52>xa-
zn)y46XZ!KJC)^k^(`9mA?_Ax&GVS1!y9`&hu)Cd2h!30M_?vC7*!5$E9|C*Z+waxs
zeSES&Mc1*yAU8tc?Ub63&p%U+Tsf!xnbpp_a_3ILdFpk?+@2MFD4s3%FjjT$?QOPe
z9?G^A%SAu@d+L`@VRZbFMc<Du%zfCUr=2glTTfg2R@TcG^NON&a^Frl$7;GQRrA-w
zvtQ3HP&N5nu_s@%l)r2HnvV6Kx4FLTKKJ{<mzI~m<y5O)Xx%dWbH9Rfci-U^*F!$o
zU%TSF`&HzsedlgpR{K>|DVBCSJMg!9(2a*lEZ2MIly$71{p4_H)%0)sD%O1DNZ?;7
zda}o{Y3}(AZeRHJE)O`~F;D5vJku=`1g=jps7}_Asggas=ZeN2?^QC7mwjDPeEmet
zz6-kzu6><<@NkJf(@pu$i<Va%za-An#C2XuKYNdWrreI+caxOPf4F)|Kq|V<(Bv~~
zSBq&?=%>EtubKqj%sxI#?)V0Nr|<r587_7cy+2A$y{BF*$gX>Mk&krR53c1kNyans
zy3MyFzm4+Vf4a*!Ks+`ofZyls=KJw)b|_lCyi?cxF`#W#mCa4zE0N4+Kb&N~@$S~e
zwa$WH-)(x&;i=WB@M2Z(wFq%{mcm_Ul5FAvlv_T%fAL~J>Hw1^=ZX9~atsU>RSXR3
zxCfX@DhpEMlQUA2vorJ3^$IHY+TJd^Z87QnFRs2%4w{P#a?>Zh{AM{%?r7MhS!Hk5
z=&H~C_{(4l$L*ZpCDWFqWZ(U_;BW8WO>4CnR2Z6eEt!1o<u={8hE+~?S2NfapR<?w
z`|FX#tPLvZ`fZBdT`#PXZtlB0pLKHdx1{s8Gi{6cF5fij&dcL|{{P?go40S?u4S~3
zvpl>c!SK$Rv`jIPz*$?O-j@AN7dsy@&H8%gvnQ@%zFf;A&dp#x?E7xflVi>4QEOl8
z%(dEAZ>#@I@^h{FtV0T|!YZCo7a}UXW4gGeiDpVYw^eWbZ>*MoV1>aP;V0)jdY)Gn
z&GEFF>uT7bnBVg}Q0CO`xrZy`mRt^;aCgI^=X(xTKXN|3@o(^ac{RoA7naTKO5AF!
z-2TV+Z}eoGus4~L*=oZFi&KeL5{){aD_VDL+LL(2JhQM`rgyVKx5S?MI_Z=jMsX2`
z+?O0)^5@5Tg~OgVQ{q@2&v^JZ$IkIp>+_d3vp4L~F7!=zap-*OdT!HpodfRvFZ*ir
zQjFP7s0h!9v#U{AuUoxkU!>5HtENBGTFTQTo991PNH@5|5~*<ZRAJpt_9WiPueY%C
zOcHTq*&@j({Xo_7)Rd>0Lhg@?BJa6%Nc^jr-}d2p^#jL>j~~of`QBO@UNGIob|A0$
z&V1IRYv*r{WX^qfUm?;Za+XiyN_(cxiCLn(X^~ZvSuYF4Mfe^1%Dn#`)4Jz9Z(811
zc_}TC-dJ+<^v>WrYzH<;7Vj%K#P;#&i&x&SReU8L?Rwv1^QX2`eBB)8s_o74yVi!4
z^p@M#OZ;fJ=jW@JoVVw;x(|olxm$M33ns<Ho=%?9rjQrfFSX|EPQmoESJQh~C;MOi
z)2$FJZ@MF0z<7zm2ZiGwlLgLy-FP;YWfy;A!WRXmLyceWpL={`537k}r8p-~b!PNh
zxjU|jyI5?CLhAz79ds=|A*VHWp0mpGPWwA|8QA08&E0oQxVq))q{_uVb<&>ZSIs~F
zqVk@oyz2>x2DX~H)0;UOEV#ZXJx`217;&Y2p-$GJoM3~lc}y#!bRYPrdpU4$MI5%^
z3S_Vr7Mdng`F>8JR_R>v{|)`^jxx%T`rbv;R1~6${xQF;>9})t=I$M?X~zZU&dxX}
z^jz+W?u2We>tD+4=MX4Z+s9n6f?+qG=SjOsK@JPfZja~E>tM2d)$p!8T(+}G?dE~q
zpLtw1*s>;BC95s0D5>sy{dbz1r#kz)<b_Kdw*S7eSWrIm!}7Az5?qlj%{qDlSDMz<
z$*7ore$b}5r1yJhUCuF1kB<}gACa-_DLy{!d!|^^t{pR#Cs)_J;&)_=s*_`n+@tch
z$ktyihT-uGJ`-<&wtZXD=DwRQH{-;F_}X{M+J{UnHP!1&YI)cEl&C1I>R*3h1>+^t
zx=$bUPCHE9?3bxz`=DDW_QHfD&kq-CC#PM1XS37$((ffMJQi;^-YvdW!}($9yUDj#
zO`Iug>h*~!eRfk-I7heq_qCTy*bd)kzR~#5e6hLFQ}NPS`o2@-@478`Ql!9p;-Rj_
zFB6`Jr5AP^BtCr9TO)KNqikXW=brhj-YGk$pKF?;a7pAjGn2oi%5>R=Q$O!kN*}R&
z{Y~bh-~)aAL$@x-Yv&iuE#?m>>?zu?e#4s`Ul<f0G<CC=_;$^C!@sHW*uQGIMy7?!
z8*Ux6Vf*R(vtiyb<qf-juuZ(HCHiP#pjmpylCO^8jfqT87^OG3>|~j3*;}+F>d8M<
z^94I6{Vd^`<2FU5BF577j8N3Sb)Wg4r`Gmq2K+ILFi>|WaQqN&)g!&+&ePK!m!CSA
z%RDK1?sZiERHxvCn=du}iq3`H&8yv%U2wIlYfIl1lg6fCy$L}E6N9fUcRss(rDY43
z;j-TwZn2;157WI~sB7$1aD#aU>w>TS3pALG1ZN)W@+<p4Vef(eRqL)=?kbxreWhDe
z#XoO*jnGxsmdCO0zRa0!`~2%vKBWbY`mt`|L5cRe^aHrl-(9ZDJrq>9LSkxzb^pcq
z^7&p@Zt36hxKVaZY*qBRFHfQ#+<t3W|Jt(tzQn%Y`E2+9x_x;2bxyc6^Y;e(qCbWI
zbPurf&UxJb*^D#xcOvT%)d2g5My(IWPq3U~n!t3vpG}ALpTy0?pNxrtje#YH8aKQD
zIwO!S^ey&7qSXT1*5m13TbY(<e@R!pwdxR8OM|CrYL=#Sh`#i~TeoGjoTujVTyeW5
zDiD|OASN>W=)>5|jGarT21Yy;{lw^bR%Whzaj5d01Eyl)XD^6bKA3(fI3~62$>q6v
z_1`47Ul;gk={RSjf{Rw;Yt1<v2Gx&M8-uDu<<!MzIL%<`DXpGoY&c~@U+(#tdg<OJ
zOkE-e+wCWN8aS&<8qRKBJ@4VIwiR{C5tj^Svs^VWztetvMY+)O<OtQS4@K#MtmksA
zd_Ojp%;TP8Q}94BrswmOo$2R_MJ7B?TGHtho!8njwRp+lu#N))awj6<E>vH>d+MDe
zn@7x3H4Zjrt0`@=_uIv-gFnk=$~SWFI_16O;<8KpJMP@w|0+u-Lhq`G$fshNz0p<|
zUo`zP&}e(7AiB9S@$<sd=T$e$KJHdv`5~v*`az}TwcF}zlFX(P>s|6zaldX{$8n@;
zgUf-M$0Bkwo=;I`DlfI-WA+gX^iXbHT(aHtzlTDZWTu^oX6YeEw)jh}sdaVSj2rlq
z7s<Uj@U-@FXl_}2qUZzGCr(G&H1wu=AKR17F?+eA;m)@y@1CCPmS6wx)=&NZ{}*fT
zynJihSk`v^^*f*Ew`A2=7M##wG}N5_gu`I&H|0BZOqwfpbH1yVOpOh%JG%Z}`uqEb
zv{^G7r6rT^{D1Oq?(-V83;%t^gBw?=&*|QEEb4?qd~f{aB@W;7?qB>ec_N2Jmzt~S
ziuG#i4m~O=xNJK4x}%QX)BEAt_xTwaQX7PXB^>Qs%mcgL^xN8H>K$%UitpUBO~G~B
z8f%sX$(aumm$Xhl|7gXF9qb3VcgMaB{AQ52`Ov~IClpR!%4yA3Tv#k8UVpO1{NUVt
zxepE!M%+d#a}@6|#6Ej+(f83yo{*$UPKPRuU7P*HKgSz%{kbuz;{I2QS5Lj;LN;i&
zY&AXp^IV?m&5|&k)7R&!%y?C1?J;d`C%fD!od(e-i);=`zJHVU^Hy)mjXU?5G``H@
zQaJm-<{o3`tVegc)@y73asLsu|JQP(Z4Q2qGr7grKX||^QJUN)cwx$U=Dq&E7C$`R
z`2Vze#U3B4@)w!roLw0QV;<f;@kV6UKW4e+?JT`Nq+~giC%$<-GyVP9qaS{B+?WvU
z`uE-W<<FHjR2=_1xm^5jIq!lKC7szP+sl(qF<xS7j`MwA`{*U}MArq3F7JLbIDeYA
zfVKboRPUu?wi}kL_em*z%)`Osf6o2y<K+K;UkWO1jDNV{TJjc!HB~Ko^LKN8?6Zs8
zE||KrVtTk~&D)tvrOuU!@4U|R<viQ}N<$lInX3WMEs8&6Z57deSCq+eZ*E)pZmTfS
zc@N&qlbidl`O`9y4f@AFzb{ZakS^DrF^83DLI1&nd|Ebwa~D6X{D1c2gEJ27ju#!v
z4r{n4o?0^Jh0!I^b$s4pT~pPnH|&r6bZ=@X+x39LTfJJ@`D<S!#5`G?=hSvr-NBHN
zUnP6nUl#LB84geDZeF8{Up{cTsvdIK<@s{<T{dB+bytI<ca<Ei)hf17DqJBM)bZ;U
zd+zm+ouO4x;a5#sRz4SJ*wUnBx5#mCz+G?cGu#i?MW`$D2JQ{3I_%_fv}J2ZyP&+g
z+7-2%w`xCVRn7`c`#D7=Mp7X8l>*b}+t=7Gc?y*JCWK8$2sV<~_HpKC&O@h73KjVh
zV>muXiZowlkt;g?lUI>H_|yEYTsz#{Kh!%tWH=~O`rO@N{pWh#s)x^AzAohyzx!<I
zhBd9*<TO@ms7LNpc<{sK>NS>PVYem6!Zl;AOgpKPyJN-1>5Wrlzi<T~_;7o{!W#-@
z&8&@5VSBG;NKR17GQGX6>Gyu+8Anz{?0A^ESA<*cyWkF^?>;+zbZ(7%w<M(Ih-E;|
zieD;hd(!pTD$5ntglMq5oVAo8_^!H|t<I@a^^<rr!#<y%V|;8flg9Lft6KU^;mrY!
z3IEuAUdD<r&(%E7&==RXg}H2YbKlH{bj`LI4cZGI<!qi}8(U|3+Dq&7@{Ci@U#knN
zPTgt5bvbp`lR0lfHQTZTADljX@KbltORi5fcBz%2*F@j1Ik94*-C@qONUP+?Jy%wH
zFiv1A(PPZsINgZ1vA=ZV{3d4aCo2yv(o^NxlKrnX<j$|)ush2X@33nuJ1G0ubN=lF
zGiHN%md+t-dsff<&7jg+v()IZ2kXR3#{)mv3J0=$@A!81GuN{%Wx6KY=Wy(0<?k;1
zmU{fy(%HsdOU@g;T6WN$QTz}0UBkNavpWuDH%Q2d^WXC-=D(fr!0KbCZ&S{}MOT{z
zPNzyQZmzk#bBlr2_TS-m=XDjYXWFv6HF%>K!|gwJwLV>`ow%O)q}-n<N1^;Rb6e8=
z92iQsCttnbwubw?wq1p))#`{6Ui*%X*EiUEynXN_+1X}`SFE?_+N_l5IV_(~3!Jo*
z>F0N@)i|_Xj3Fy(yV&>489_VBO@4eRtBBz*`8rR6`-0-^Soe)RnLBIOOYP2T=$v!t
z@V>`#AI-1sD&qOLp;=sWWs7#htr|N%#XGYPy!IAP4S!qy+GfSin!Xbcp1i0jJ+f|_
z#ky?2O~*g)i8P28Kb3EM@mZrC$E%h@RUGs9<g%F=bIbRJ-|PE*Wwpkm$Dh_Idf(i*
zl`CETdb;kTJ@32cyz<?^WWeu#fB*aWS3dKWa%@-3I-ipo)A~SVu3xjt9S!@>ybUkR
zo^RK=xn?U%&fGegIdggY+5Ww3zxd(Hl6^O#7Hut(dTZMo9%XjTOTUC`vqs9L*;l6=
z=-Lx^y=?mGt(%^x-K{d}j#W1Q@*^a;!nFOCnwAB-=kYjA*+a7P#UE_btkc>*A^*lB
zwK(?mtSeaTpT180F0ssWRr{`U@qAOfcP1qlf3f^2QN_>IeQ}ldhBFm2?jM~V&JrT*
z_xVm`isAZ<Bd#p-wgkHbo9ORpim3Y1V;(Hnz3IYbW}7*uxDRbO{Ag8$V5FnVb*9PA
z>$2BJ%(=vUhiAe6E?Zj-0WZnc-|9x+_nu8?DE7OkU?$|?5g}@L=Ar3oAyZN3BR{4T
zTugI3wTQD>u))IoN@V((2mgvIK0Qo&67+CO;-3)N{V^NN>NnqY{-M78g?;C$p64>I
z3pe{bKQ|@u*_-+DeZLP+p8W6kLHo-5bN2VYoM->?Q$2e1k>A~qFJ7?UD{=5c+11-A
zKP;DImpqmCf3)7CXttC0ryN(-!iaXJrd|6c1^m=6om=>`;Hs*(*{95%W+vOjUT@f1
z7`gTPqLm68>%LmmOZCjI=Jbe;n<4r2es09{$k<7mO|yHojiP^Lu)pj3Ud5i{>zv7Z
z<3&+s%VO`%-mM|p-yT`;&tY55vEfksbwM$Yse&y=?`~gy{P?o}zn{;)A3r=f{+zVh
zgO;rqzFMhPo}Yf%!s}hp-dD*kI!#`??|CatVrmIAn{vQBELG%~h19H6IqBpRJ}mDI
z;?61w)Yq_!ZFF-rlKNHDTTtux>_DL7&fQu3pPY}%2kEWQdA<MV8+qP)-yGNG@5|GB
zJM-gl@A!s}HwRCyX)6--|Ib?)HFs<MpOybBv;7`kX8TyX;mm4HUa`g%%uV(oA|{{j
zduOi7bC@yj`9a<WHn~3%VaE*x7j2nkHMgI;d&(JZv6gwOg(oh4tZdEuk0YpNn%fnv
zs(*J=>ZSSfm2Mwd8FtgoW?#bvhGViaeSYWLnm?B^EqZe!dlFyOf$0}3x7g{Ju-}V#
z&pmJ2LSBdD&N7>A9*<dHCwzNwKva3k!Oj!+_sI9u+1ajoDL(IIVe4t7bn(nnUNhfM
zeUtt_{A5Y4_NC<FbDvjgH(1NpyqNzru{P_&)RQK{E~>9Jlm8w(`EY~gwe@BC>pDLE
zRPzX*cK@}td}Xe}{C@Sq3C~|dthQD)oUkL^Mlg0s(uByiXltcc%hPUDJ>^(=HhlA$
zSGqH18w;2f#mMm2B+M?(E{U1ma4fG+z*_B@;bh&u*&qKNJ1fJmu7BI)=L(h^4W1NU
zo%UkR(d+sFHyL_QUS^u##i@Sw;<rs@I~F8WDo^{Jz1yZ@r)Qz%tyhn8`PB|Fxyqm2
zv1wh+{^z<H;ccd=wSx7F^5S;P4&d>y?oe~=+uhV4zR2R4>&~X@aaU}MmG(W^d#FBh
z;pvC<QhjxClMmib+x#Kw{goTOIq_eLT(7D9-KU;on;!ivpC`dbY;tJv+8t}ogdP2n
zb!qAi(a9P$J8qk#rR~*U|2FORG>%o*viuG!)D+&dNm!zwwdR08`L$<BCzCsDixU49
zaH^>uO1gO|$4x`|yL-{pN9&&d&Zw{X?|J93?Dd`ZN_1xFvwYrtc7oQI?S47yl5CGW
z7y9~nrRwheK})tpEecg?*4eoBOpR%M%~YQVi*V1m&6a=P%%2}OM>cPc!~L?;o9EV8
z-v6`5b;`cGYow!<JO8*B_?^4A@cY-Vlk@iPmS(6h&WdRG<@V)k%Nvj5J1jkO74{e|
zeDG88o8+~hM>0~kF+^_rIIT{6+SbJ}XQV!U+cC-U|6;8N55qLCs1*mC)atlWnfm6^
z!nXG6teGPHL5_ldwp{sr_-1w7`-71$_O!oH^E6K5n4LPkd8X_}lb-9J|2w?pPjCKw
z@aFNx{|n<ki|fpt`=I=}PPBp7=Uc*@t5*M?bbQC+gO+KZ&i$PnEMK{BOX|}T7H3rt
zF8}p<yGQbWtBzSkVz!?}eGV_5G3D`B{-0k?&;7OdduCZW@7Gn=cjV@E`RPcq-??mi
z?s7$(fmibGO@V$c5^`q8o<$wp%6CJ@ySrr4F(og<XZnY=z6pp<UL|^qZJ}!2s(VFu
zlx93!KfCFvNJwe}>yf}`6;*%TZTLLiSFGRQq!s@p+<>co(?b!*f@qzytv3UAJQZbY
zi(MRV85y9i@~+}A>*=MZtL1f4cTZjODg3wQ0iM<eHtwueKltkTS6H>p_LiDwuJ~c)
zs;uojwX5eGdd;OYRsVV5#$|8!-M%auyYxwn`0QwggQ{9@v+SkrmmJz1aE8;d?s(?8
zYo})~co3>uR2FE=dg*6&?5_(FYaD{M#?`NwaC@y`4D-`<7HQ|_IImlE)J<vTyhpi)
zPQl4<bgVPfuRc^hvEm=g+ZFzQH{YoK(G$;mOz`TfWuKG$q|I+KyVO)}Nr-#>hUr9U
z#Wi`}nk>GUK#{yRK8DM-t&mloAG*|&hmpl^-kuq3lXadNeUA!B+F7>3sMbh%P5gSH
zT5*SELZt=2KjzyU&3JVA!Q6GTZbh$-I2PEnieXOiC5}hsJ4EVzPVF!H<b9N#Rov@=
zz|!COZSnp|4r#o(p}W?&bY77<bT09;{k+pGCoVq7y=xm-=A8ff)UDd<u6o5P2Od|Y
zA83nP+{=(XD{g|B{}j7}tCsgyPuQlN6*uQkQPHoLDa`%VpMCl^37=YYQSYo8_qx+2
zEL--dxy;%z`(<a}?!wiNtmB?UpIgIz(?Wkvmu5p3<G+8p5iAZHR(t6${B`l!wHl8*
z7Lp6RXPv*H!u9AA$A%d9%a1G1`rSR+%Uqv)_fD>vOZb7y*Cc1ZR8#5kkIP&YyT$6t
zgx{W7v1bB9t=#j1W-crF<#S+m*JP8*!0Kbg=L(H?OCRT(FDXAa$(?1V&z8^|*+2ik
zs(+JzV0KtYN1u#*j7{VDYp*6(El53XVDF-tn6Ppq_oDXM78myDy!;{0Kf8OUd3RjW
zv1KorjKzx7Me;k%t!}RF=`Uis-F1d{LNMQwt#=mK#BBAFTi*L{%DqgVcL(-HJ&fYk
zJ!{K;BSlcPc-fb%C&$_(Sgrc`7IIr_9-PdTVRON0k-WnDDbhY#o;^h$>(t+tO}#9q
zwdC~ARW(7SJySj<i2rtaBI*8U)>n?6biaDDZo|LbvmZ7nSH^ZN@A{b-HD$N^#ivJ~
zY%XsWjS~;|p0>#Q?BOjU!lmc?PZw!6>DO<tT6N{1-fUj;D`H)*u9~>Nobg?Ka^<wm
z7o0PfKamzMk2zClaFDk((T`jF!z{%Zk0)+SPp>$fZ`r2h|JijTd-bt-m!!^J6p3EH
z=+O3Q*TN=$%=cmmddIZxEQ8{PGp%bl8LwTq6!3P*JyrWKyN}z?N8V)FHEVrduWz@`
z`jxdV%h*=WyEK>2SJPxsTElL$%Q5e7yl(h+@9D*ty)tJ6U$<SI968H9rqwE!v1a$J
z*9&FhRAsW|stZbecfRxrKOB85(PHb}AG7DHGd6d&`A(9RxqT%&bz5V5&-Vy}Sqr7O
z1UG()u)LEkd{<@0T&I(l52>vGXk&XwcYb`lJO6zVSBZmfEU#P;jO}g|W3TqJ7ZkVf
ztEiBc<2b&tHF0Bhf7X)sA5R1vk&M+5y>HlTVd!Nnn|fL*NqKdDY~8>1%?EEkTrd6W
zyHNFPZJ)^v+nAHG?p05<SvqxH>C=}7OwH{AvnQXk=bu!qaq!E5-^Jn5Mu~@?9F*J7
z8tMI|ASdm@Jn3WW)z_`sr@DXH(gjPc)|-Y(=yKTEvxt4I(3`q>qu;geUj|(9pC9L%
zM9t>WU$*l2U(;lPrcSx@`PXKJ$L)wq7t9eYJ3Zwy%XXFLrP~k86J5K8`{(=ArB$4b
z|8kZtT^V$#)LTLNgtu(H!mLByt(gbT&eRj0nY`EiNbZJ1W-57;EX$7dUcM2}@VtNV
z454mOgRDy-GY=+h*KxE@)%99`y4Phl%fDLbRtK|*+cYF@`Tz6aaXEc7*0erq;g`c)
zyH4y|%yw$c0v6G`Uvf>pmHy%Cchr@O42%ED{7UYy)r{4fy-!JB>p45?>LIcJ%be45
zPk+b?k8RWbd}3|&oCLdb(<=`yyPEcBE#KWo)}LRsGaZP1{6hCldUHaR+P8npPQJg9
zG5^?`@(tp*O8@xqC%;r>O4mB0w1Kt6)_eJ%?=}Z-weLB4e&tWuy>r^{Gp;w-dw%!a
zd-bgq*Tnz4`FG`S=W9oscZ;@77x+IlaEi_6?&S8oeQqmipHF;eV`?p`+Im>waCz!!
z|KmS$>^GL5joh1*-C-y)@87O)e$Lw^Tr=-v8>Ahz%@ez+7@xh~M#<?-*>>LFSK=&J
z)-|*j-afcleg5q5)hFik$r)%|5?NH-y=c9}yl}>nmpWUTt+rWyUHdS?^JT%R<6HmU
zDz^K6WM|IP#62Evw;OXqi{0Kn*%&$DVq(x!M$LJTYSvq3uSvOBDDdg<y5&X_xAdo9
z?0medag9t-&4Mx}b;b)zmA%TV&&8du{OKaWQ2TT5>ABiZmR(;Tx3^|1Yi+=)4+o;F
z-gix2cHLvTm4TT@8Rw+E;n4>^Mjm3!&*ePYXft&SQ$l_<!@s?n3}QzW=iHlhPvE#>
z-U{uk<+35Om~S$(8;iPDZc%+}<uvO-XGdGb^iOQX4E-~b7fjImGMRhI^6ICnchBf-
zz43TO{kP1DPr0+SORI8kM`cR=+|?K^^Fr-uUYo9OcjmRdbrWju2yC5_u0Q3dMNh&i
zKfCjicQ?(MFA+JnLFIh;g2z5aR^f}k_B@~XFld##z0L_`Ho@}`!Z}>d89p`sQCd)8
zct~tY>BRnNS&tpL-WP4&x>{Rf-=?(JdCyY5t$qJW_Rspb;IzY&rsgFFp1=BLv-atV
z-0s(%CpQ(EF22dJ@tAsf`oy)y^{wBRJ8x_Jp3Yq@f66%|d*k|jZ;#JfwP|;C_TR98
zm`JHsyXpz7ckG|+vfI_w-X6%JJ@b~B)0-*{v99M`%f*fBP88g93Rt#Y#%f*Jo)DF#
zON+M(?U}uBAJ6^SEKV%9w<fK)XsdWiz3P{LX2nG>3#O%PmD73WFY*dwEVHTE?B_DI
z>C-FEEoCR)FA6{B{`caC0^tQ;+q8RTT-#O`@VM94;rfe3)7PJ#Ht}qP*WzIB<C)s)
zF2%3Ce?2efpl;OqAKxQS%>P}n>M<L4=Ej#_^A?3fIBj2^cQ;(@^fKm)l@$uCKNigW
zyl2t+GjrT#9$Y53m3hVXM*^jcQC1tbJr;O-wNxf3*dzX=<@=RSA5|NjtG;D@^@v6E
zrJ2pQFSY-ZGU^WBZ$I<@Rr}w1S6U0V2doMH&{FGFn?IrGaW7NW!}ZB84{UpR{d(8q
zB^Nzrc^}>U`1!-gJywe6rHk1D7OAe-XyzTiIDRwtlI;zT_uDTvyE&ul&YA$txQaT-
z2#vTZ&0b!)Njpkb$-aMoA<Ehy<i9RM{1kQjSH5yaIy(D}y;pa~TwLWPD57@pp3>b5
zPrv*zx~3(&v3>uZp0i0dbMJh;xbsWp<+<;})|@m9U)Y^{A=i*~<>K`-4qXtP)OkF!
z@U{2#{xTuXZl+%^*3^Hi%(lIr;ePGr%u=pP?@nI1{-r<T!X&LF%sUOX_{`bAvh=Uj
zns9gCvmrmVex`)HWfi@_CYW>C%;&0G$*z)wqOW=Wb@yi~T@O6Bz1fRtvO)BcZOhcx
z&k|Lge~(9a>#iwJTSWeB*Gjr#l$W)q!*^@UkCu**+-<i+|MBE&nwIhI=-TqpO)|Vv
zI3wsONA|^)d$%8+(f6Kj#VdW2NvpP={<^ilP2o*&ID0xr__d$6w<Ns%lpQW}@4c{o
zEUVwYsZ4h_Ju%+Bd*%i6ieF!1*Ssp1w!LzG^`@Hp=`$T_F6^7eAbj)bcJAsxK1REx
zs%2G=Hr%%Ts?GIi+3|AS{%(<^#+hf%{dd{S=jT4J`rg(W=~M0T_hjeI+atTrS=HFa
zu<Dwwrt@T#*>k*1xEJY!zrMcgW9X*(vnt0^?*C^FK)DM<Wt;CsK}H6K=S&O?y0|CE
z3yLyxGfOhdQj7KD<1_OzOXB183Mxw{T=Y6@Aky~!vj}^cVQa~mIIcLK@`nzAb9fw=
zq`Zxk_Ly8C)v|AI?Cp%C>v8|?*Iz2$$NDCIyZp(?X9CS<yy3dyH&5k~ZqAw$+CG=A
z&eDBw@W!;1NK23FFM0QbbDX~+!OL2=*l63kX9pIpkUVX)Fl5?6*&3r4`<}LWZ0UCs
z_3*ZH`F>18#ENgbQF-B}%Y5ETENX;z9kIA&J!x0Z=DNMiLCU>yKWu((XOFrvw_}ej
z$D~Iq4Cc*${83x~n(sfEwEb`OkNKr!MRaafpRm>RiNXZ4M~@$z5m#zWUiyNk>R)<s
zOVNavl~2mnT!>t&&oa;b&X?}$x~um^<cwo1ub$RVd3a<_fSvcDmjPPsE0fNxyUC9l
zwmWL)Dz0K-VA#pWz@SA`*d`VgC02sgAB217KQ<HC_d0yT2}h$>9QS0Z46Zpg=Ug&1
zD-AlrxXpm6ahsc2d1{dAN*l8i_3tNKiT<RvH-tTUQJUSk&(g0t?%b>SRaJA;?0~4u
z`Q!()RC%6EnUh+wx%u(rf=99wiznK8Z@ZgWWMui%VVbo<eUs3fBOe%6p7^%H-Q>dF
z=^h)^1E)N(nl9kl^43_<bm1IsUsK_j%D9co<{KZ|-lDbX%bYlgww~+>Gg<z`2D2`$
zdmy-H-Sztki|xBj*ethc7f)IITI7!O_B7qy=RUNGwMyi%7OF&L$JA6VDO!DMx%9$W
z{pl6;GlSMPE}rT;!)L{cX?s|*Vqy<GzOkA6^!|LkMeJJL$1Up@Xm$(gnFl(p4Sf2>
zZgEhf&fGno#ih$cZWk%<6fjI!BeaP}_sP%a-JkV8AC(X0t`1>oev@M&@{qys;tYvh
z7cG4~l_!KHDjaya@AG!o**iB}tJ%Ks^B!NXsY>ZVm(r(CUodmYRiiygUh7ZIxO2bX
zT2tDxJjr82mPEQ$7ZYoyky_H<T(4cf9xsazeq`?R-TldrDLO3d?3sE~lTS4VMmQ>G
za3_UyKU(%s?u*|MtuvcvWO2l;+Wzd5c~kbO9iNu_?W*aUb8Cn0T&DZ4Vl`jSYg666
zz}s-o+mn0x_H3IPwTa#B@~V0KH*UXb{_tr1?#-)jYjOthyqK}1WPhJ#rPjB*j$MBr
zYGs)z`!D|Jzd-Ez=@)+s_U~aek5}js&SSDooL7~Rf2&l0=jU_Y18H;mPt08vwQ>d5
zBo5C>bMke16W0g&s{EO3+&QW6%o!su<?OtDtILl43tpDD?p@yUrEyafHUHRD&DYy^
z?NQJ14_CgQ{1Sd9WZI?Y9hYry$Zh6byk*UA)@r5cbADX;vN?XWQO;D4=aF0!lkBB#
zy)DzeayH5Ry2h2L(-$T&%!)5B<3IX>b#KYl9l6dMmRED!C~jw{doNV8^Ho|?b=KwD
z2aAGA_vUM!a+;=A%CS(vXmQSroXkhti>y3S`W%=0T5X-Trqv@mTxZS76)RZy72bY+
z)Ua%)&rv6?GMnU&&d;~*EI44$x?$EQUY1saZG4CNe_i4;d2TrK>)B1K7CXw`Il78h
z*{o>W6ic3)5mk*(Qk1sNy2I}*+oX9-KXcWBXmwe4zUe-jEmko*PyH))w7ls4+@$tN
z|Nl?jC}~wDk|ddaYtPK7TO-9wZ2Q=<Z)WKqetjk|KKqRPrwvn9-rX|Ab=970uRTA$
zQnr-qVLbS%OlbM$hZ<Y6Ss35S$-mq9#QI9;(K$vc|K2Us^{A;nqPeYlWBqzI*C(?&
zSfcs6Z~Jmc$8ApI=-R_`>#NkS#S1^_oOvDQ5MH19egF4aKXu)GF379ZF4B7DRe9-9
z^5QvRGc`4K#csNs7WGDFt>@ua{6TK<*JS4uX&SB(Jg)q%;=v7T2b-^k)-D@#`4+`E
zKA3HLxc}Jn;5BLWLjTM-)hp7s2mZ90d`OnH=JVM{c8O&oFHg5||Cj&x`S1*nwLcfy
z+j#`M)fSchZE5`4@`~S@US6^9r|#{U8To1T<qH3-w@<d~-tk(qwzn*;_e8<_%%3*0
zT1VoJmY!)}&YSY=G~@SO6M|0gom!|jYxlp68SCdh6Fm95`guHRi8tNSZP61Z1_pn2
z27EV5A=M^H`T04iiJ*;rQ$ybS-!>5VJ8%CZH9M7wPAoM&M@$kj6eLm?O*RYFD4Ok^
z{p{Anw<4=D|NlN$7CmX2e6(H2*PlP{?*453{@~24X|w#(#rpXA_!2Fge{{Kdt|(}9
zGA*7Wrn9MX3w!zY`SowO?Hn@;=7(=NoZYvpVRD;q+K&1u@-AD$iZxE}+Pe1GCKkK=
zDccS#37HnTZb>JT+WBHV-B)hPfBR-0G&SpN*mv*;qxv_ePOj2t%5m2hIG$Y-)%s@B
z!Bsg^G-uA6B{2EbtBt#Ng{tZN{S~A)<H6O=dE3^R2rmuXa>_d;#;;LQB4|xpqTQd$
z>bQBabLPj!-mB64^K<W1gBg{nY${2t({3G8+m^~?<@%FZUu3u5mru1B+x6qlHoesO
z^ZV)Qo<*Gr#}2FvVw%bG*K5~V>E6uOcD$do*Ssv-@noBhaPy*b4!!bR1vA#H-rKN4
zS>G@5zw#Z8&c<W4%a*S8xK!ip?qb{ZMbfMDljW_Mt9<U6iEf_p=iZxL`rEoPa$;C=
zBBnm{*w$<kcG<V|fZ~Sc|C8Nnd0C<h)V#J9UDVF1@;mL%-u#+LD7==f>FjaQ=H;R9
zB)e9H?7N-$jqUi^gda?-XOH~9IH&%1T~V#O&%=Fj;>^d7fA}(Q(Wm<_?Y_Lc)>~S(
zYDXqZ^t4H5FGioLZq0jgQ!AxC%)29Ymc^VuTjVZ(%`#mkeQO?TSXgO8)3Z;rq^+a+
z57)9Kigdk;sStG8p!`T6V@vrfXUF2Q4~w?^lb-xTX`Ze4Wd_r0Z)N&5Cha`*{&JqE
zZGN7pQI2%u;zYZQJC{$iEM8ExjVV9mM)u~by1PmW-U#>by>rZzlHfWn9dLHV6}?vm
z3u^vIy7?v*&9q@Ozqjn%t^nZ)N<vO`YTEmcw^Rs6e92iMxjZg^|KZ!UzCkm#x6O;(
z=HTGRzecU<xcCP@W4nv9wWlS>i?#&Mt+h@ziK)@5+}q;5eL;)vrM9T(gDXqUer)~m
z>$An(Z>N{7Tz@O=^2HbWsJSIz-$|Rr%nS@H+zbqwM70l6GLuX63MzZUV*MXmh}526
zzhkkTilZWvobtvfmN$N^%xg3*ty!g2B;8)+@u=sm!CR$&zvHa$d)lk<hbGUju6e)l
zeWBWiKP8|4ewnv6L+#~DlSMO=3>Pakte&&x+Ltef>^G|woc+8uVSP5Mc)Iv=gXrKN
zZmQ=M7QHulSlLy$K*Muw#0QZ>26`ci84^t1#d;zWbRKtU95c?0ygK97Go5NyrNp$U
zh5O!b_6eNG-L>CaDO2`+M8o;VpV(tpuD9u2@!`w~k;0Uj7mAk27|*nQX0fn>_3+XR
zkx%y`j=irF{HXPMySm=)_2EDMuW!+CH9oV+dvdYlG!J8o-``)F)u=D3nw$1sB~h?V
zJWAAMXG9^7@qLE%`|riw_m%(0$5RnBl_fiPa!b!84v|ydVXG84OP&}oTBod1oh8>^
zCTe<fk0h&3_EZ7Qhiz9MS;a1WZXAF9%u=Da;I~N+d5@Hzo}?u8_}}K9l?Ej$zDfK)
zKDjekd+y0=WV|s~Do5P!e*^oxi<83bHyw~IiP`_q{h3_rZKuLi`=wcDm0yZix`>q8
z&5HbcBU|aP`L3<aLNR;WQYTzL{-|Y5<FEgDSF}S-IsW$<%wKo)yg%o+a~_vu&e+cM
zd*EfT)y-<#E8j1EyZ)E_|0L5Oyzq>iib|{-iy33hoH<jzUSx@0@J86e@@CDhd8QH1
zW-YfA<niR!DgJ%_^wq!XTH971c&eHc^Pb`A;m10EYIo@$f3b|;BbhJa^rnN44HsF>
zx{{~1WrK3gUD<gDx^sT*u<8^jW-OezwnsQ=u`p}XKb;v4DI$ipJsBqVuFiflf2wkN
z%8Dar-+o`fcO<X#McSODc~?75+9=*OP}Vekn{|uNJAXHy^=bjh8&%D3%qAu7Z(Vgl
zSjy{Lyt>5iLXjH7j>`|slAcLxA3Sq0J8f1`hMBU{*+)F(hmKzivC3P%@9|1i6KTOv
zmilYuE<dkruRqQabi3_s=EXZ{clXT>aa(bCi?EsMBF1TAG9`a+EZOzMM)K*Z^ylf_
zvC9k6kDXn6?a5Wc^^QT`eO6T-pZQ%iOtJLa;y)_)bWE%i(*KA3&7HV)qg3NZqmxtT
z?U*zDN_W_&YenBr_Nt$%KXY1bc6t7$y<5X(Yzx?Pl0V1k!t0Y!Qy4Si1a;h&JonJ*
zJ^SVT-iMqP`Od6~FN_ZN^Qmup|3b`e)zp0*=VwVwzBXSxDpa@m#;>xy)_?m|(%TpF
zoU3@N^VPKfNJVG%iMY2sY4a!YaoI)8RJ4k@x-r*4g!^?pYEF0EKTlhmg@Hkum)LqS
zGp{5yJ+(-$pz>^3Z2oOCk=pO;cen<4+)6P$d#^=p#`KD{fzOkBjdM7d8mDQ@?sZwE
z^7M-IxBKOup4(E?H^#B~@Ne^om7DkbU~whOc60H1p5;2rVlF;ZSs1f<N}%MS6$&3G
z@%cABJ}5Y+J4yFu(#nTVemt=~GfhNqrI3u!u0=C7ielJjO{$sTHPKmQ=~6w_UZsRe
z#U*Tqc3yBXK6rJ(CeEgYLf=$H&41@Q7xk{SW~ixKdc@(6(oyB7c0ND4QgkFwx@MXM
z*SS8}wO~?)V(pH3^-DMYQ`yw==*4H@iQSz3t@#IcY!Kej)h)enRrp@L453b5C)2tu
zZOr)wD_%Y@dCaZAm1Z&hkj{+1mBxMN?0e7K`>(TWD{Ed{RUZ+>#AUIRGoweiv((cl
z<7bw*jd1g^|0feKm+jD*E$YbrCi-l>K)Q=&_tpiQxVmrmU9>%9TOs<pW!VhlV>A1d
z!Y}H4bv(1bt!>NwG`XhBO3y0{Y?`$XX0|5Dg(g|V>fczP=*NEO_N+&Cj(%T*RJ1g@
zTQXk#+xs(1u6-rP>u&4B)ENH7SrhlCYfoB|+O_z(?$(Ye(`H;gR$;s`{XhRS$9DZ$
zYb8#ag??uGtSsTVY&ysBN9Wr8F0z$RpS*haZGjkJ7kQ&e=Y^T>J4@U;JI&<quPv6J
z|AZ&xEfYJEmfgLPo6-Kz_wYn1qxOO}_JXv@rwirh$m^W*yK~MpPT-`#`>C?W_TTMY
zR=dr@*7m^HS5;zP-KvW@-aelGF~jWNCFWOe7%r96+-|?vUf1$#cSYF=SLZeMciQ!0
zep|>MoO^3UvM%!kF3!x8$+tBE>^j*z_fPd%lsd`4xcAzP>5ts6+Rk9-OS#_Jee!+c
zW*x5^udW6c)^6N-cD^wC;(46Gu5Q-^)h)MjWo;D<P1Wwzs9*X-BP7Q9b}R3D4YkN?
z8Tq#2@4i_y^0KB&AKhMU()`x##^M=CF`0*wU)?gbJJWh%&xXh8%MY{dNSb(YMaUIX
zk!&F|et(VB8x}t=1bjbODgR(CLwrt1h^77#gPZT%J{~<jGvi5ng;dhS=Sz2rtufed
z!+3DBsSW4Pj=jZx$xSH^OC|(<+R--K^cn}d(eV|NRyi>(e?D(!$6Ed6(~4reI?Fpc
zx?8Gt|ID<CFgIK@yV>fqz4`a9w2=F{W;frKt+CpBjA^oj&&*5TeSgW-tgtG-k@wi_
zuv%$#>Xz~=_YQSV-2M39nQgqE?A5=ed9SHGU1Z)J?OQqf(plAWr9snD`{H9gCfI2j
z*H-n2p4f22f1^VEp{6xKFZVwAm^c0X>ym<lNwxjnADcvbe*AiPba8L-yST@E|BUY3
z<$AZT=*hv?EQ>Yu%KewFIUeV&(-UQ?71-HmXwdRuzcS;u&1*Z}t(@NSaOJJNe!I{4
z7!@arYNTpU3z)HfA?M5No3-E9-CEi2tg-Yr-_zMXf9z$dqJMuzYhLVLx98kzMg|6T
z7Gj4ViW2kEQ}qfeTZ8Ur-!>4a`yO9-q1{4RFjkINcZ$iHv}ma?`;sY1PkzkFu$XkA
z|I(T-_4gyUJyy9pL+;JwlKK1I@7v8?5pmbfZ-1w$SNG*DE-zhFFQ^nO{#n(1S#o!e
zUc$OB_d3pAJNTyPo8%_lL*-k%oI3R*wD&5@SUlOi!YGTqGOqGD?=#Dexnai`rw3WS
zYnf!$waa+>b*H?B=o5>?j!Ot%T6mG|WpqKetzBP3*aM&Tp5Kqe*WFdQvvkXI*WTml
zivQy-w+1iso~*w|>}l`KA8uRbx+DvQI3C+Hf3>UK{^&FNmz~!4^!V4mf<1msPu7b?
z8L`FL580<n?+GsLRQuO{!+7E2X)BL(#Rv!Ou<6&mc9mt#<7280cYN1;Q9NSz$HhAS
zMVJ%QV#o6tJeRX0v^w8@KD%jNPsj0`1(pfx+X`%+Oy)|P)%1YtkUig|DATnQHs@T8
z%$<2%wOnGq>^u7{%}Y<;KAL=q*)ybb{bc8V)?1gFFWdjNCou0ek4B`xswMvemKgtj
z(lU9?cQ-lF&ms@bx2x2|E-o_>ciCXzHq+Qf{K|*VD?3*QG8~Amcq==le1Vq6l<7-z
z7ach2<{rxNs`}lYb%xs?nYShVyR^)&ptzzfmw{O;IdQ^?lj=neejaA#RgpVoCscH*
zE-Ai!ZQwkI|7hp2OwuZ|Q{!Y{h*4o+&?c%yT3k{D*)p>=>UHp)ZDRlT)wf33-I%AR
z_rz}5T}{ahr>JF9mhhh3GCiRG+O<tyd#0^VVUBM5|5wg7$Gh%L)nVSr2fXHN?>qP2
zBZ+@+?dMPZe~YCi`%L(|xg~`)HsDbD3zg#^C%v)f=2xqJ!Fu}ooO?RlU*0^pskkdf
z=!>?Xjx*;@Rn61k2im!s!Y8w)Ym2ycZ_=>rRB{Qoe9U?%@)%c4z_iYjN6r)m)h3-y
z*?2Cqta*dObYWc`p2JhGOuba8`gU3Y<Dx|~))t*Pxy4p+ZNav6J2S%s<`pyDe;zTx
ztHa*$!`G^R6OSA{uj9)xf0g9Z8?WaS#26TV?Mirgj&<kdWP?d6g2fp|Wry;QtQHYx
zJ$axt>)Ui|p3hfb@Cu&|=sr2KW7f{iZ^V|HFh(xrSyjOEW8!9imCM149xQ0pyY`;t
zp;)CsV}#y?)QX?aXJ3AC^!#%DI?LTZGM80+>)D;L@{g#7vWg??8nwP|q2(vIrY61M
zOcdR>`R$UjEmKXm&+z}c++Ry;vge#6#S76-yW?2y$4%7!@X6}JG4&M2PFLe7mx=lw
zyJjev{kNFhIOA5^`3dPapRs2Ax7?K=c`+#Dg;#{7Jx6w?!f`=ClO+q-FRhQ*<kFHl
z??KZK{;&B@r;Bf1bHGISo=<T2V~@?gu~~r$aUIrCI@-U|md$TY>2!|o{k>AWXMI87
z#aDs$Pu<-%clp)5TmDGJztBg^$ynxtu7Bp*C|<J*OHGsyDTWz42R=5*XJTt++*P#h
zyQ^=s@0ZKsJV6W0BKz4igUi@|Ub(R9qeAJ-=X_hGz6VdAd8fzl@rK#jeAVmbuMYjJ
zb<9sQ=cAod;|ja%+ZKD5TC6>N(_!BGg~EK1?2j_u{5iC8`or0u%k$GugwHlQy1KII
z;@*upo<SP3b}`g8ziWQEWa)!eqnS-Rc)9%QtILb*+>TzHc*#)b<)g2uCQ-M-Z!h`#
z<@d{zPhY-QcCo#$^zzS_w-ViT66qHz#OLQ12TGa6-QiznVg3G_Ktouo<+5E$D?&2@
z(>7)aF-+O;M&Ms`5Z@F}r>7<X&i+F6LV0ZYCu6R6PEUWIE*d@M!fju^`LTO!{w`j)
zY=ioH^UJr7+%7u5tnJ;2v=vRNhWZNwWItM+`p~6uC%A*{Vm<?}!|Eq9wI<I?vsov_
zZ(C%|8!vRt;;HY_4GXSaKcvsRbyB|C?k*$$&ZeiDmlW(a3&!3wOV@cTas6C>0pr6j
zs^_mBELE8NK4HsCv5sv$?;Bo<8}GjuVr_WqpVX!3Yugw6?Y<fJ@@3S!ZyS>T8v3$-
zc{t<rP35)A3(vfCuDZL6=ln{Ib*s!iRyFtgy*iw;L@<ss*eRvsg5a)Q>sF@ZGJ3uE
zIH9oeS<bnp^>;g`y%1ooa^CgL{H{^Y<z4qrSO%YC?{g@UpS<VAmhYbyIPY3Dx6WQ<
zfw5|!X2<>wk8GX!4L*2&;F$QG?{Iw!d)#pzjf*;A?CX{9&Yd==IZ4BUlhbXN&R^~|
zpLD}Rf@Y;%V2^&ZwCCUYPtEUcT63%J&nV)5&15?*jWgduyZHYGQ7wzT9!@JbG*8x?
zUa~-1qfb-8(|VP_vT!XI56Kn&)-QfA9<h^C4m;FY%(&(zFQ;wz_M3*&E@>z1nzv=U
zh`P}+yYGE}`A?c3+-Sa4+30P~&VRQ8=Cgm@V3{_{==ztFS&a{M-bF55ch`9Px2e15
zw{4%iHPbC*Z`4ZreRoz)b_<r7Gbw$pjoDS!%)2)x8KmqE*}5}qyZ8dDKMr5`57pO(
zx9`7xx-FvAt#A6fjhQRfX)jw|6`AYxctu!o=?-SAm&r17)_rzbJN@2;ynDHEo38JC
zcWs;Q?RP7;TVH#%`0)nwYl)va?^&F77XRyUdC82}Ytr5mkEFH;S_E$0b7P9>+_wKU
zPBZ1-r8<1hi(YJ*`TFd~_h)AxR$Cv=)Zh@i`^M>uR_pVlg-+VKuI=2Iy(G$lLFMs|
zt!W)xEV?^)nLDYlc37_1$snRV?{M4m4ejoS!o@kZ=^UH7DT^&?oqIxC&&=Z7k24h*
zm}c!L*`=7gisfBmy-)jRx#g;sPv>miP%p6Z>r?qJM!F~CKe~&ou1+>l{}fW>U7@&M
zd#1?|>E;z`R^MFDrXNcWc^O*8R<QB9!Ee78-crlH^q8%A{_5rbjF`KYv42~?|F^sO
z|NOy!->+}#aJhG5+sgF^w&Wk4Q<mHnb|E!HxZQW>%l$glPRftw?O$LqL+qMN(Zz=v
zCK)rIvP+4ErA7s8Sn9@dS-kFhipz^?`<FRiGec#Wf8>j~op7HU(Y|))((C5hbsLu)
zx^sSWl4kz1)L@e-5<V@Kdee6KPF~Zdy&_ub{bBZ(AGUwJx83n&w5)QkTwV)<$^QJq
z!KLX>%JbTz*3SNT)W#yG+}Txk(~dg=S<}^&eFCTZbIHplUs0Ws-KX+$hH=Od>x#uK
zG22i7m>II!TQZ#Ig`;QnnsX7wY)4&A_@~7_QU7J`$iMf-4~cJjZ?BvD-X)fBXtDAC
zgeRNk#g>FmP5aw@tGabj#*?p(x1ZS+tESlAOsRFgVH$l`<Xz5Avz5oIJ~J&Z*?&FM
zfq9e7kJ-%Sd?JTip4~hrC$aCm*6qIi)>od#zB?KsvF7`}4G|}e87jmidws)qEDgz9
zF=_J2c{Q5tZ<UIKf?qsYXti2HsM>o%^#ReFSC8<dtiFCD!fwvJgS#A8wp*O2mY8%j
zdxHDBr`f9-G7s}EaQi4@;J8y*|LM{;soBLX5#3E|bQBeDxUhCaos72ATd=dMP&3AN
z(?=&A@9P<z`JETH>Wd59ouIU83X{Rh6%9M0Z+`C-nCs}QbN~1C6$`X4omlc<OWqFF
zEy@pCv@V}LTBj=P;%OW3SCvg+ZmFU6WtVM@3VqFcFR-_%DaK!O+ixyp_UygD&jPW0
z=El<>V%hXwF#nlQ@x6xoX6Rl=>62_?T2dJ@dknrjnRfNoFD=VI8S2jy3?6)U+<WtD
z;!0sPi|HrL*`7vz{v+TjxwBiz-tTCL{-(w+v%*{tZf>pW-Mc|^$@UFbcQ-N3)-rk3
z81?VPl#M^#Z>ybfnxIxb>t`~<W|6hKr$}D9$s$oX+3<#6b?L6twQB!wv8olnun>t^
z+0$IVK{7FrWB<z;3)eYM-Iw{bZ1I|R{O<~aB3YB4ZSW~OZ#ld6xQ#L6{TrJ@^sepo
z)>iQ|J2>ZDPr@gA)L{Yr9ox(9GBGgta56Bc;cRXtB^IaZBh9+jhDGP!G7zadzkb7&
z_B^2w-Rjv}+L_k2y<pv%bIZhcVyFKB<r_2KUikF>`H_#J68s*|t;6SM>s@%A^eg#?
z19yT@n=zBm#Ys&+dh)VkauO_d?K-D-q2)Te<8|p)x9jHf+ZMmR$QzZ%VB7SBNAQO8
z(bsds+_*mIo&F>f9y)Ka{)_OoFYk+viF8CY{Hu@q+vpU_$Fq2I!L;lZ>-Q)r=$Ks&
zst9#VS{|rdaqUt|_PO0vM|jpV#|a!MUi(%{PsVELCexQP!83)K1=WRr?5@^d5H`hF
zT;ulRu1TEg6CAcD-Q99?l30CiSWA~?`Uj?Z=?Q^1rkHBlh&61NGgfF6GM{>?wa#~I
zdkr_cc6?ZbX2HZrPEOWzmG!rNJ)Nz0T2EyqOKNtM+&)i%!~<<-e>8dPT=Sdv@n^J8
zwrXX*Ot!aN{o6fuTl{=e<98J>&1{>Q@Fh4zIp#*~x1(!n9=)1p-V@QMcegLgU8T=a
zHcP?sdn@mSS*LBL<Qn&CGH<-{MpAocYKfZjffxD8{@)u)ml)i1*eILK$@z~ZpVNr-
zt|@DngV3>v4{O&?xjujXr{`-ez6HjAd$_|bnnTX?|EKCWvo#y0O}7^>w+y*3O}g8e
z<^9HvjA=}TK|N<Ueae@;y%e$kZTq$(xx9apgT9nco7(jL!c{N(-txsdf_JaRXna{1
zY#GIT?BvVT<cf!@3_bQ_RB@+Y>v=dY%IL51FCFQfD#saD2ulU%sQIcn{}U8SGizAP
z^G)z)*o#J&7mLptUHp8DH(*lAb|yAk%X;pW6@PTA>VEXP82w_ik*jG|PtHG3v8Oh1
z(L=Kh(r*JUuj>}z{ye9zs^yhqZ-)H>!JIamt8?V5J=twExNlS!@B4n&^Of{1`6V0$
zw`&ummF?W@+7D_PB~)}An)Z@AO?mV3l7=SbTc`6DT$1#cD||Ffvi+~B@sa=UW=yoG
zJ$lQdxA@iMt9ruHE}QJC6K_j~Y5mGM@sANTgSfw~e6@>_fkBf6-}Ze-1}V+U$j?au
z51CC3KA82`Kw$50ZMLcm-mRXOqWQRQn&dc_?`|wzSS_^4wr}fJcc)34rM>>wsvh@y
zWv027U&!P0y*=Me?3&|OzixlA`@{qux6?8wyPOuxJLL0m&5;bD{wCuY-dnFG#YWBO
zITn5~#YECMNa>G*GH2191l7>D2NEV;cMQmgWKMQXmhSCoTru^En8m~`cep&&ICdHD
z4sE)2fLBFU&u^#W%zp>Z%#z!w(jApq^7{O@XGPb4pZJ-#e`09gFQGr@E^|#@>vZ|!
z<NZ9Ls~<V+e>n9-dez+u@!G_g-*Qtue(#!>yWnB==D06C=fW60=lqG&z40f_aDVK*
z+SzOm_D#Na>lW{I#|g=dYZh*rTKDkOvi#b1f!dqSWoOncHfZX3I%Q!yuQ5k?=)cFu
z7QD7t)91aWNX^>4dCwu+OPU!b2UmakCbe3bsn7l#w<i0c%PNPr#5e6U_+j>^`_Z0y
z$BH7J^9tPd@f`kjUza4Fk@$G)?32ye?0GT=e>axAZYvguu92G;_HEtfusg3ie=XUz
z=5MHiYrwyYMH_@Hu4H)6Y`zj;GNtnL+!L1@?_5?sxj*-U-?R24#SKf}ufE%8oKYk6
zA1(TeYE*Bn<78mCB8P8+1RVV!B0niBHMs<Ig~8Uy=>FR~MC-n<Pbia1Vc%rn*=Q&6
znpJIbiLl8`&+<9B+=nM*cFL`u=&9>^_K56{{qHUJcq~y}{xa^F;>MGQ4;TMD*Sk-l
zTt5DP_OE>>B-Y>j5_@ik);8A3#zmnQbB-_5pM3fv>rSz&j$+@fUE|{R{W$&Q>C@BV
zDI1fYFt27+x2#TBy5d{G3=OyMi!X+C*?L~iT`YC-(iD;3ULLL*&z%B8IpU&csT5ZK
z?m9KgbN88jDQhmZ<o%beUywR6zI)Emcc-WB$^UTe*1TIAHzjSd-K4uRsOPv#(~PIg
z-r3VQ=Pg$~HT#{*Oy-TYS`QRLopx=G+8n+6MatdBNs&1+7o!s#%~f~b{nMVRW!4^N
z`aOTn7iI4iH^jecWSVA)^MxLK&$;&GA%o?!&lK*hD*fB2nRU%E!RAeD)z+0$m(1K{
zW-YI={CmRoz>TWiDIeeW=U;lgJ%8Q*fA5|hzu9qMep>Q7??yS9x3j-47V%11)N}Gt
zz{b^^7Cex$DRb-zJ94YD;8@Y311}58oxOt&eBCsO=il3Ro<jLMi(}nadR{JZe5Ror
z^V4|hV-B%JGjd!Gf393oTCqSVETG!+VX@=RS^6o5)!LlHF6~k~XMcT*&T+rVss_=%
zJ@0-@->e%mgVA$VUv^ktvXTRDgN1<Ki7)Jz?piRjPP&+}<%i^k)0+c4cHiLI<?$iz
z%YPxiM#jn7brFpXvt+d;ohF|;yvBHK+K<j==4lU(NaS|h+46I;^*8Us700Gs<ZRAp
zy}iEMXJ+u<zgJJJG^n|GvT;ZI9S`U0#Zzu}usw0I=H*&qzD7l0{--Z>5nZt})YoU6
z%~P1B`}euK*8AQgveD(IKHB&nv0iol&4gPO=0aQiqQ1TB<J=I@>sEf2?ZV=Ved>8P
zl%)z~N?%V@W4$l+;44q+gR})<ADp%ZRP(XV_D$W<P&_Gmu0+PpFFV&ixF>yZW}9-|
ziwE5~3LjU@J@I<x<vn+=iX^lp9K2pRagTo1RjY(l-ZY<`pK{;$E!Ocr{-JKVtTkuT
z9}bQW&W2J+3sXJ@TrhgOnJb0==e!kLGqf&fMwm#8rCNnOo_3+O{YA{$NB1@cJWKe!
z#&m&*Sy0l##|#P=d?xOhXf;*%u}afSwZ>NwS3XRf%&Y9nJ5%`4Mv<9%b#mK}%RXMh
z#CGZf!}fwdEK`@YZLvFJW0I4`;uW|+@+IpG*RYCZ%_=$7@eBTyu8?t`cy^oHHS3M(
z9EG>0IJ~^Waa{Y%rv;CmIXKuTmAG6<7noua>L)5~KexR4(=++`>+an@d*`Hxkbv&%
zAKL19dEzf$YQ8Y7QtuZIzq_Hfan*^A8?RQSEotiyvD}}zKjEVAtVJtxmmW4a-@Qxg
zrQ*|)^Cc@@UuX?@qa=RGS$XHaBLONa)%-69o<6oCG<<m>{{pM#FJW&5pP0NpZuc)S
zBe`U*OI`mtmByL#1(~GQ21Q5QTATFxG=r(mnLtKv?%S0Po4)j|XDUkIjZ^-9;h%=;
z@ix9q+~UDg^0KV0I5<5{)H9#obTTKPcE`m_eIH*xiOx5aeH2pO5q$Y)&F`g#nc7#b
zTb<kJFYT44n5<&utezQYykAx>f3g1`WAXlX3P0bS-2CCAb;-om@4~+xt}yJsQ7^^t
z+^{gQpP{rcTOsSV`ffAplh@X*FPdQ4KY!irXU|tTCx{1Ha(v~O{w|o`b5T^>I*uiY
zXX*{ApSan@IDT(WHQSQ6ej>Yc@}Ufi692hhUaNmMWXv~tv%~FlmbAKK(+nBK&DWPS
z-8*P@@tl0rlHm3iuIH5l`S-8Q^AlbxU#I!1>3Wyb{<IrM+R7L<F;2J@cq+?k$*kbt
zYx;I3xGBwAcsEA%hy1OH8@C=(k?LWa@c-zkdB3ze&NUq0#OY~uV@{D=*ZSKJU;Nx9
zn3H(r-M=o&+XcH7*5?+UWeNMpl>R!*^Yq%+##jBij*EC+E{o!OK6~A3v8i5xDX|7V
z5o+d-)N^Ot-0)0R;m(IyPk8RLAF|royJ$uGnpT^H>rADWGY)lxMKLStZ;M`Lts%04
z?Kyv>p<VM-&XB~EzfVl8)c)Sy`1Mf1X~``wE)*qxXT8X1EPY!{Mp|^+Vt!T$(Qgm`
zFVo|n#dI!E_etuf>!+Ux-C8F*)iN=tX?9a}&02NGU0ZaIZ&2Uzvhd#Po;t^WE2FtL
zUE^|IZ>9LzGIReL&Vqyt?_=AY(j;C!vHZ;x{G)i&a;@8f5#JOhGdTBG>s2f{AakcZ
zwD-@3!-A!;2j(=?YQ${%Hi<oC)uYCznnwz9mfUo3?~GTUy!HOUu4QLR)0o>NU45s#
ztF`8NKU?ZoY8$iUos|h)^CxaSF8{Uk%=NmK@~bD8TJeh{PRJJEJ>KHme6i-;Q*nLG
z2VZBY6(nD`t=p{qzo2ve+{r&8wKvXmZ(shsF#l*5!wc2$3oDBcF2B3lVfH#-&4<CC
zYhTGVyqa6~m93rOt@ZCME%%O96l^l#azAgZY!vr**Uk6*-#FO|b}au?e4!~huhrs?
zv|HQu>J1SumKdr(zAVo3Uek3y_mm5Nj!npQ$oy<jaBAUyGr>(Uy;WK_mM{1a`9dc2
zyWf@Fdu!bd*zaXAf8X0W`AvUM^Ty3jcSgq~%2!k|6rcO0FZwO!&HnpmJJ!3JeBrw2
zAS;!uR2II)`SG3PC%n^y_1$kIN)$0K;8^bQ_EFC9P3Jju4lqb8K3F<upMi3M+BM6A
zkBeRv%EmIx-jyV|rR8Y-#;uo_>vcOGOt@T}c%d^_T;$QA`FjK(%$0};e&uBPt?*WN
z#-7v<u~+|EK8w5Gs%czO;j>{aQ(#Zh*}rGBCrKpm{aLp?;`T50m)lm?WhX1lj$H6I
z(w_CY%=OsNOD|K8d(BNeyMSN*Q11V=W%sHt<erqMFL=BCeRhQ2k_R(vW0*g0J26xK
zlv=4k*8DXGx9O$-`B!)={9VbGeG1zHa#g%0&wsx%E7melEG0GdU+mI9eUe`v8vV`g
z2-_y!6p+jRM6hU1%C@<NTkl`{m9k+0%d3AgpBk{7ogX0ezrgq0)RPXA(`|h(g*Y{5
zTz(q4CwKAt>CMTXycX|PyZ6pOrGNEIS<yXj(?9)ijyAf_XtL`}8^2IU{+YM_j<Gk7
zh1*733husF9Q~mvRKfX8HLF?d1PzTz#$0EUG+mZzuQF!7w2VvM=dx5$Mmq2NwNi)b
zu12!;{ZDBYysR%%)Soe{cbd=r)FT=j)J@sn==2?yewOYf@OP;!zW~><7drlb*na=<
zsZ-kR+5P*}7Lywb8dQ#b$y~K|+OmTovQmtkwO_YJEBNdDUhDMx$endB+@D>2X;A9-
z;=W$y3*~|{+hcy-?ny2X`*$uw(dtgYvGlq*Huo3**x&oZzT?k)-H!WZf4ETF{MFOH
zh|E)DV6dLTz@UM@Q=F2ToL`h!l3xUB^S!mr&X;zdbpNY%TB=OjnM=aAtJ|47mg@V-
zr1$#HNmzUKoul9j!JAXm)Y4~Ec3gY)<No@%zq9g!ru^|JvQX++IrH7CSF2uCm6m>X
z{Pe5+`Tv?9xrV{1i{<vsS-nYDtaa7#lbcKJc8BoKPwDTIQ;83K{d(7q9XXTL`{n+>
zd^p+NUrt?py4FuW)6kh`u1<{#do5bx7d3T#U!Pd%R<C83U9XpIo#i(<Y3sUIW+zW?
z%KE%*#VNO2DKqQLS7(`?zg;tBjlhdd7VY_`Upd`6+pT6FzbeYSUa$Ui_Sd{+*H|LV
zD<Ze8io4GB@Bh|1%ckYwKR3;=U#)NDvVG#a%j@>6nO4kw&qlyTaPv*0e5q76gZ>>y
z7ip*GhU%XE?K^k<Y-QWepJ)DyVsN|i;l!Dm+O_+)Uw^%5kH;r9OG_&)v6G%<pYGe&
z*#3Q`A7B6V`t<etB;{2<Ed03RX~^E}#?p63>Q}7ZHY@bB^6hIum0QofW=l(rpZmOb
z)w%kx&1P=9-oHGnQF(VRbIiZGPme{^x#I=4uHG{(Ki|Bv_M*jt)mvA6-e%;Yn)x$M
z&ZsJwq3v+&i-nUo&;6`gTX*KQqtqTh_mh=Zr+)TiIUX6ht(5PFNaamGzgK>|XC==6
z`*!xRfQg-{z}uXp1`eT()|DT#R;e3aIAX_ZAUm`0eA^kbKWDBoT|251uebcNqp_FN
z)|eh=t)5A%_8tjck;pT--Jf^w@dFpm_?&fApR@4uC7&ymY@eNa^g_HXG)-N__yS6<
zXZh9lFh0rt>b?BbOe@=y^QK-;@9`<Sw08O{6VZvM_OUotg`O4dDV|gtZSppAm7w2w
zH_ulmI7~d(x-3oina_T*dr@A(+7pjh>`G2o7OjhEJQC=(utm+_=lfNa+e7}8s|mzU
z;}kHO>9~GLl*-QQ9Mh75Os+iewA}ufZ^y;#fY2<C^`FBQEKGRfdNS5)>9eePB2O2s
z3SV-i;sV=_2SOjdT$HqJzshq<f9ILmdvdc=>a1SBl46@P&BM&yi%Fngl4V<SxbL&F
zCyu*6n+8w5ciaA@?xBX~J~cl+t<su$EOVt-|NX;HUaI_@eAIPU#S5F7qO^O`3+lKJ
zN<>__s;X$G6rlXlpeP_sQD?RMs<tEiVJ$BtrkVUZr%~&eRl4E9(%!!*cMhi4u4E0A
zRh>WcxXrpf0)lP%2YtTlwk>?tBG9iei{0emo{W%$G`5%ACj6{Yr@4GMxSVG14?Vdn
zi>qdie(w*{NGlVC);jL`vWHvR^tSpNP553mf$L$yR?o)^mwkyh-><f?_rx3ZufqLT
zn7-C_{0)oEUsd(bQ<FEsRDarrN1>e0s`QUaU!9Z|(U7LGy4~W&;ntU3S)#gvuNH3l
zr7Eu;Z&&r_glpQu<27p?0?+PuUH?Y^$&o+2Jnuif>U(U?^7Nt5L7SBH7j`c)+_O&g
zGxKa(@4#?jsx|B4wA!xC{d%oiodj(r+&{OcC)<L7qcHP^>2e3VE#be5KCa4&Ur_q*
z?;6j?6SEIbTD$tI!qxu7b^4!D7u)>0+xwtZRiK5hIO+t0O0>YjHrv<(HWvyHDm;+>
zQ~cu6-$OsX9e7-7yRfrI=<8{hWk>oHECN?ET|4||eP5mt|INZI|JmE@tc`d!pOdes
zTbv@l-MO#6VBP)x&p%$C+Mc>qbEEu=-o_1lhqfGby81%<5{t2O@51Z5BP1B?j98>J
z*b**!o~c{cRaCIcqd$Mw+rn85tEZMcC{pD;BJ9Axn^IxMbKs2uU-uVj0p*txvs#|8
zwclTMct*k9*vLC+3JP7#=d1#xUg#&=he@$cZsspjz4vb~OK|zAzW*nFJpGk_!67}p
zHndubh5f}s_VY8$j~_pN{-9VvOXEF**`YG_Gh<iXjP8k;XsmY6Su@K>tjb4t&Fe*T
zL>oex9DAMS@74@EYQ$bJbpnHo;=-4yTNx(@tFO*0>wJ67yE9yxfhn$L=bpCzntc<5
z_+o`$F&12xSaja>R@zn3R8B2Mv1kMLMLr+CY+#Mxx2W-ME>JOLoOA7O9mDl_o)tH_
zX2f59wxeXl`wmMR9`O@?C*7j<@4T3E;z8~5ZTSWtb}qciajRtSnf1$4_XRaSytd2z
zCy%j8=Q-vOof#*2|IObhnHK!YY;NA<gS@u4_{!G`UCX_bf4z%iaj@d5^q|f{_jgej
zn~WTCj&bUQMYNSia$h{k;&XA;r{AX5PnNSgT2C&};@TRuU2uhnv^-ml{+G}|Ki+$;
zoyWdj)QEigzG-=(e|OT)SnoL+x1t{_h+V93)h~&;epf2k_Cj&6>Me;aC%GQ&S3McJ
z^<BAqpvm3^7v?YisQl1l;`#2Gyr(%mrv155fAN4h>q6TH*F>H#kkvT5@R^Uv=PlY#
zD}%~b7l+7lv$J&BEV$SZ@Nvz-Z2@7t3EnNf#>{8uPV`Iu9`T&N;NiJq0~Li8mD_WK
zqpEv8aqxz9UpZ*P!v2JhPtmoZ{rZe=4Ih52I?$=|JhuCA%w?b1+amNhc_Q={=<jiV
z-*GSb{OLblmRr>QcG*O+T%34@SLK!Lr<;@ZZ4rL8x%$j&e$U4HCXCN@+#FJk&nV;z
zU9_2^?->%?JY#Lh<tO5|TIFtwc6?SidYPxw{b{KNk58#FOIx|`v^_C1N}E=zU1D4I
zn(=YT(;LxVH@M|QR_8t4pxMUcpu^g*`xS@7zjqD{k)Jp+CN{4qeJXS&N&8!N&er2g
zCw<j;($R57iY<O2qftP-Ud}vr`vy_9q@48S++CvO$<Ow!Ygqg$w(r<<x3?2QPyXC=
zYr~<6Utcmmx%w+ES9m+K!g9$p_Am7p9G#yTu8`d{?}l5BOS9#+!bd81EPPGOxF#lK
z<gR3F67yeE{Cm%gt-Iz<o^LWwug`lG!{o2k7sB7BnqEJ_ZLa>Iz2DYc_>bX6)`jbr
z*p)x<<B~tz(BHMS`NN5=ypxZAKlVR(q2B_RJL=2Ba$cOh`FoPR!Habwmh0^gnEY?d
zUbAz_p0A}>8(*$D5L|tEzJ=Bqx#N9RVzN8FsqM@v`^KB{<!pUqz4VlmY*WsuYQz<6
zcpkb*^OpCv;H;_Ba}ABz{8t|rTxvYsyYk%4hedZgOW)o+##US0;8$>8hwFk+^TXMS
zuO*nGuWElfQF(vKs_a`=H!y!$V}6D~m*1~1KzYKF!#%|djBmc-S+G8Ep-zJN2VIGy
zi>_X=KfZHO8*}Nbw|(r34t{Su_n*CUAHT0v^;|iH>C&!K7Bg^qIz<b-Fpg=6iWiK$
zaIUF->4Bbd-dB~1ex4757I$Q<KI6{8wBlB`n}tqvlbS@|nzL`Vmh&j&DKse0dgU(u
z;>Uw?`bJAb#2a2r^;+z(=8v?(rxyhZi`)a8PH-}WJ0G6nzWB-V1M~e#rN2~~a2z*h
zI=^&ngSSNSqfJikS&LP5<L8Qt$6hsEd0yS%UvQ#9-sT^YOm`b}t+zkuI6r@Cro;bV
z%p%;vJ6VjKPMv&EHp70G3Eysp<4LhP`OSI_ji-Nc7W5XER=uh>>uAw<l%8%--FzxR
zJ5Sn0#hbM-xoGji+`Al1e;;!vT<eu9o4qvA%|o~P#y`ho>y8E8P04chrdv9XJZ|@Y
z9J5uLRqN7RR-XFBjrR+KOcdX$9gBGEbK2m`;SC2HcI(T_T-vp%ZM8$%m$)hC4CB5C
zyk*?aevf}r`e)1cf2G#ji3zB0{k2p(>*M3{jZa?Y>KqjC3sWks$gp;~Z9R+W?tI3q
zoQoP3<$t`@>aE;vq#y1unR)S_!Oiyji9QV+N!OfS)T(EGJa%YH65~XcJx^<Hlz0fL
zd^xaZqSTD6S#RQxR_$8j)u9n>80j=Yuu9mQ>xBBIPbW8@c`deQ&5vCxe~AV3%cYB!
z6wV4hEm)lB&i-eEq1|!Wzf*Wbe<+*ZHhEmtbnv5w<+DHL%l1dluAgjE;ho9qq$Lvi
zEPXMb)Z7Qk3gtc3Yi%FTyDM@#W%6wwCH{t%5~0rHDvXaN2V8qJXUbx?+}qRJ*iT+h
zy*$yH>vi?wpfkVE+~Sj2p8e_2%Caub`CqH-!m~d#YxIVyNx%8O%^`UI21zEijywso
z!=-#&kC|-lWL;!_wk!R`^aY~(zPamceR#a|`Oe~ftj9(DcBeP=R*8QU{C4vP`;W54
zGb(Pa%H3hc8v8$OuZ~9XmO~ZGnQmn)w_xfzVdnHct(Mm?Y^K>R8D3%6)UMrX#UGTS
zPnnfYkvhPjz?2oZhnYphdfA)cnP1xLtcrqung-4mIu^+i6I{r}JHu_NO;wxKh31`}
zE?XkPDy=^$J9sT+3veuCei<npbzM7$y&_vLDEW4o%*_&}6_T5F&EYqADZfWOY`$2!
zo2PR-f5K&cqd9%Houxv*g}#1Tv_g8;f=Wx*<G*x%_PBM<{1dxNgF$*-L&bAut6RCd
zjqY!ZFMrV%TNB;%y>b7eO$MRKul}X(T%pp^(s6lD(d#1~we3eW?!0t;BYWDet=gD(
zgJ%chj<ST%#EfH_X@@+fZqCxnV=Dc+>Wal)kC*n`{g<aLS>vca>-fZNy}73{BQ9GU
zJk)XQ?WS{zCGv}J{Nnu@=6Ja3)f~3g6<b86W^ZL!x`z8qr}zpzt2d5ujPG{pewr!t
zXwAx+8J8J;*7*5JGPyolP#-4#g7b+Cm-LH#zs76I=dSfnc<2A5Up+lvNG<Z&Irbdq
ztut3$-L+RPd0YD<N3}iH=2>aW+|JJBd?=@(YHM)1i;MS*hHc4=ZaI#Z$3w3NoH=bh
z`;Ey%V`l%PB&inl6V{9M5;g>UvFlpu+dt#aiIS)(uGy<ZWE3y{4h|FJyItaK*Zn53
zvt&;5f40>Tt8{FHPHStK7QIp~G`{SYdP(?t-Q;82GXAi&Fzi`c|2LdZDntEE{4}pE
zhH5HG3k!>FJ9ZwG2xZ(htySl?^8w~hON>^xxtwFUW1PuR<kEaIZB5597s(>~Xl7ro
z{0JViR^_)=tZnlzoSy3XK-fGk)tNaWV1v+d2bDk57k;=_Y%IZ7y>4TVqg40hvTc*Y
ze@vc!y;-iVwO@LM>?P(GQUYx33wISr_II=TD)7($6aA?rh^hUc<C_`QyUbSVo3kId
z7{<Qi#^lwSK@ajaEj{XGleLv;p~lr`pLa4nwRr4nIrZ_x9)5*_E&N+2tXUmpdV=ld
zmow2XZvXjrG{DW#?T#ytuJS>a^RJq|iFZsrV)Mb%_TJy6(N81hPCH+ifA8(#FJE)G
zrDCU7&eEP_pI+Vk)NJkK+JcvFv(Ab<pFhj=;Z3%hqf<OT?>e_WczQCQsZG$4<T!Wk
z<tP8oSfnR?@m9gL=4U&uFJyng@YPCkLD=lzmg?lR?Y39%&wd*zb)Dy5!~;#`S4(yk
z`nUd>vh2rnuir^~;+c08<QUDCT2{L-yRUDV`rpqo68xK+&1=7Y&)+|H-i%kh*RxHv
zKdDxHIIU`3=n-5Rs%w4kZsyTmroh*4CC-RmNSZnEuf5U^gEa@_XE3fjB3OI-py#(<
zCL^)UmtS(q<zCdVdEK2S_hTbx>w=Pfr(N#)B{KcF-syZ|fx*^1QK40{4BuY(FmHy4
zUY5hY_|sQ8bJtrP%&FY%yR_oPOpE=d+#CI3E%t5y;jNrASv^_l%#GrIu^X&7Z+sS>
z$o?$WVWH3U=nLoOUd?9`w*8mHSSOg*b9Kd`Gkvoceq6>N$Z)Fgw$npCRt{#ha0k~2
z*M?WJbL^*o>CW>kdc3P|t>v@tf4*+_VVdJ;e0pQu`b~1-d8ORdE1xW!K4tbzkGuEO
z(iIyl_dh-B{QA?b&mu|+!GD^hUfeeAdd%r0eOajY)y1>=GZ#$@3cCD+o3+A$f8x<~
zs%vjgTFsR$ZQQZvpt5VgGOuGBjdz?eeJ0nDHl<>d=bi(fYlEbnHFgOvo#nRjo6oui
zt{r7uJ^`Yey^q~75DVp3J)yA2@z~dNnFDjZI(a7u{`p^?JNNY>={HS`teld&S=L`+
zvyAhasd~-y>d~XEmojq>OTP8KBbt4?*#6bFyK_I(=k1bolQobnnz8fIH_6n0Go~&(
z5$Zl^LDW*stXXjZS*pw`^R&+V>ejf<w(GzWix;oL+Kaa66n!{t=Gkmj6L^Nl;#*wA
z*MLT~N$;$C*pGT#__yrHwJnkFk1(uQ%%kGFt?qV{@y@*p|G9!+33i>(=KJ-!M!7&`
z+QL7JBrmSF-z?HS!9!d);O3NzCbH_qYbDj0W(DooCp!6A>Zj71Yf~)t-i}o?j$Oqi
z?|$;UhtIsQWWEorMJIYBnCJVLF?zqfRugu8dq9<?g=O+Q5sSw&1k2}qT=XR9ko?hH
zHQu97^BNX4sNR3EX~V^phN2Iv_RG(ct1FvfIX~}98)J~4W4WK>?uUvBB7#4&!qt|}
z4w!f-Yj$?0a&1R{tZP@)k2#^r)6`p1rS_V%to^|o%z2S3;Y+}s7MCA-9(U&!9#Z<H
zCi8Xk#N=mxP1+2v-g_+2Vp!^@DzsqR?hoNUZtDwPPWu)%_1?z$Vw&rFy0{jbST0u=
zOxh@G^E&ihWoD(;_FLf(-^`lTys<B`|98nh(dTb(sN|PaS2dr$c<9kqTL;;#`<OM>
zvfD9k;15{9^ytdl^w%f2=U))|7XRa_?mg|ts{V&$OS2TReZHkXnEgL$cc1Y2&qnKS
z8qe6Uz&$RL@sjVC`x}=ftx~_Y>Sc1W$p0e~x5W0&xp=tU+FH`4DZNfyIr+ks8vaSk
zbqwd&K7DVy?ANA-KVRqH2;pd36z(NbIfHvzQc?Lu500v3i!Uzdzq)6a{Hj~bR#I1M
zj@R|A+NRaOeJby5_LgnNhj*8hZoOIS7%_Jl??d*G4ED#5R)5`nUUl8W``qX9n+@jO
zyWa8TOL4@y8ifM?|L>XBo!5NdbgKQSkCw*Q;tN|3{Wa$()zkDoP`KVNah9KQ-|z6N
zGRd<0cut(mnDkgLvaRpY?wM`TTHMCl85VyiYd-vi@u9~{@gnb=saHR;EQ|j5+qxvN
zThdjAP0nre*-3d$o7`hHzx%4IxT(!pn9^-=ac!~4DThm$+OKjJs}`PKS=9C@yWi}I
z#^l3iI(NBUs(W*@c*RS<X-O&1RF6NK-q+sW?x&%qtLSEM^N-s$6=O-KO|ma`6<;lg
z{y1^*Q?>ou4pi*h8m0ePa@m}9!l53QybZ6b?6tmhRqj`b@W-p%2V55X(hRf{Zpr-8
zsDAfJRLgIUA2&KSr2OpFezczdb;pnMM+1De%opTS%3t*OMfu*j+-6b2kMFcNd|j;(
z^7#_8_Oi@HvGW90?CCso<$cYf1!re?{8C|XKfn0E4_^+i?AM*|W8N~Xz5ibB(3TFK
zqg=I*ex~hadvv|}*hDtls_e&xh0MP=u6{i&+hV@Hyum!AyQ1xP+imat9-CtibE`Uw
z7r%c{oguaDQ=6GvK~n6M7jlaGyZI9Df7{-3gT-%6wse!(`$Y@hMl)BvkoA9dB>zpp
zrewy-c8_-oAB<Vbtyg)URD9p_Zr!Fu`%fR^3NxN*D{*G?*H0PWYy{Hvx~C<Yha3nm
z-L;J47}MdZxYAq;6}fe@ba(Guw`j_fT_TK3JokjvJn|BSuG&ov{dwVqn{M`$$Ip2d
zdL}*X49rZq%^@SdWXoF(#`DWg*#>I6RBB#bxkX+0_IW{f|MwezR10pp=rm!66+3Tz
zT-EK^y_=SA$~YJ&{{N8eq|krUJ{PS!Tyj8dT5-y0<>ICKrrsO>>^=Hgdg4>J0QMc(
z`{VQvdNZAr+QrOjG>hR^gyGTK9SmA`R&s4BWtUrZDSPS6UAG_qX(_vR=W}~q=EZe6
zu{+lLy_Qws`^s?i@bbFU<>3x%kMmBF-Mi@>2a~mz?%NByq_&*BbJI<0TY0$0v4)qi
zdGda17TH{#z9-V)@RQ6>5oX^nTQu13`o7-6wt62=eyF$l{G+A&K1$k%G4>jBvz)y7
z`RG|zyUd6cfrs38TCVlk9_sRA!cM;ADdi;%x~CqO9d{I7DQCNkspGQr@(Raw^DmlD
zO}qcu@z3=x{urKhZFPl*MLTa5SlpQ>%btAFA|}1C>REBism8yZ0as7$Rco@fKVXv+
zdG;UY#e%&*ckHXlUif>{Vb%bXQ&Xb%^_O+T%}cc39uofWxpFr5lbB;iTVfiw{Jzo_
zt$(fly11xjQP;^+b^&p@Q!77D>^t<WSwbsnw%62KC1o?GiyH}6D@k8A+^!zW;<iC`
z3fu3an(qa7>c_A2)!MF>_(euYK$VGS!{+a2J<>wBukW9ICUMJY`FAzH9ThJZTutZ;
z{nul5zy4YK@5^n~Th8iQ{$+j^BB%HD(#|tEJ0Is>djG(~HTK!OMVGd(yZz(k(tk{v
zmhIc+_ZK)${eJj@Otlq{rDRU~)gpl{m&z@o-W-s-Kjn7vo8IO-oU3KkG`d3B<~=?q
zTF6io(%E6~Eg|C3!N<`V8<IOLLTtiRyA#zNV!gYkvU{7pm2y@8`a<PSVZ`sUn&ypu
zYU}e^{+P+${F=M|$kMHRch*}hwmjIaSJnRThu>YzKjQaRRNwApl3T!jGQ47m_~E@1
z*B#y<xXDts{VV5`yTy8OD^!lQJNA3Ze~#3>`T6^Kp_#kc-iFTnHi`FUwa?j}wu6b~
zpZ@K6VEKUW-ntXlJ$xq3p7vd~_V-@iUw7(eE^L&tdRP74Nacn6Gdt%$cgp^KdbD9R
zFY|LY)yo&u=d?clmQZWjWte~a*Qta1E|~Q;^L%%;(2whWCKNc~c4MSQVAkx-!Wz7V
zpLKLO`QGojyRB>aCdb@1zkeJHg+<pksB_m>SYQ9!Un*^r`=CM2^287ByLQ_xci-D}
z-`qCc`t9U17k~L~_qpm@%l5ffRqMS$=HBMr!jWRjf{ib4PDx@p>tfBcH2&LtX@R9V
z@eWGQjrpu!>^1)==+0=reeLf9HzJ}xx8Jhwti8;CM)LRD*z-x>BOfiv&X1n?BQgBS
z`<?xQMj~a_9RK#NxMqCO;Ktg^eJaQJ9reYY9eLP$sI{Ei>)*QL)rpVaPl(VJKiFXF
z`X=R-(Yw?`8&++5F!_)5>L;~suK5x-McHg0+{!nf_$H<7>715B(QF##yJNEEv#u^^
zWbEDD{+fB&-e<)Hoj<Nct=XGj@=v;Prp(?u*G@zq3rr}Qda-V+@+YSbe#HmA@wdLz
zDqZ<ve62!ojp`iV<%N4Sm%n`J#3yy8dB17t=|5%Lg>DPpZ<xMwx5I&x6Vva_+beSY
zeS^kx;};i%=gLg{RHwDMR87wQg4|}oj-a;xpVRl3@BOO%sO<Hg)Y6Hbs~y*5r$oMV
z%=vrlVDZP_yiIC*FWUW(z5Y@8^CrJHKbPP6Hz~;IxoG9hZLib*{CqC%T77fwVVSV`
zpQnn<U%&49_4&<J4D;&#$=ClnUqAh_=c1V}BvkIPSu`-TI{JP39Qp0d>Gk`X*^?Ia
zZ)}yB;{H5bWWMLK4|UV$v|WqZ7$*Ke_ezM#H_@`chU@+RYBSw^U-9wxx@?Za@n<X-
z^Y^;1lF$ea$XsO0z|ykTt5_`Y(X!`CQ!lNvR=Yjn*TgeH^DeFAigs6>=yhxTy*HK<
z-p&8mHf!4Ce>>`m^D8pm{5`w*H`96!-L#swi)ZS)ZLi2>{iEE#e(m^@N{?w5J%y$A
zzYkU2Z}UaD+;;Qk+6gx6KX_c+v&gCD=C2l4jRow^T8v2-S^sxfSo*J<T5OZ?knPcy
z-7&W|KK(gGF5}K``)sA3pC1G~&<*f=yCZ#f$9L9s?SEuACY`?}7kKmzhi&brKK`Yt
zF_)A&ORKZh{`z<<?skr~+qGXPmAU1k?rP8J3hgg%fAg9zeplPU*<CKKvDx8m(;n?*
zZ`T`qoU-hnU_t)cV-c?#>^~+H&%DYeGhx;49Wsp)iwqW(emK&tC0LUd+q;On;6?JY
zjOo!IgnGT$m#^xYut=w?U(e>IM)9hC{yD;5*!bNR96RFsKKfc)`}T{Q|Lsdz)2aP#
z#+%Nw^*)?)A6|>}Y`XfSYysoh-?x0#79@W2Jmv479D82n>XRD@cbVqIR#<X;SvR%*
z{UVm_vzxtZLgby-z6sd3WZL07pI7xh;<_XM>uKAzh_8P%1SU=Y|L5K7jh44n_jk0F
zwwunI$Yy#gaHr$y60^{}TIR>0UlR(SvUvr|FTbPUY$qqXQ)G#T{LPf#E|vC<n`-Rj
zEmUOgC1-xBEGTAgmkT(z<73s1_n+?W_S$)B!>$=Y3Jd3YFr~S+Zndklwk?g<-gBeG
zAlhu-rK_)Qh0ndXl)E-Ra;NPS*5jJiQaAn{+O_{j3D=^{8uxg=tiEe?Yg3o!o#ssW
zd+bjhc{#`~k-w##{(yN6SMJi=Yn?s+>8(pyz2tc5Yq^^un@V;@$}BfO`f~B++^U@Q
z3nOCYX8pYPP0P2TyCYqrwy^Pap!jO1I<3j)C(V9qv2*9nn|W_bTgxU-x@h}^OFvxd
z9lP{1=Dk64wjSN=Zr8Kx$I}Db7|mH1^*vqkT{@J{hJ7c8!`>Tn!p<F)f4C^+{<6Kh
zn&nGZ>=uq(V|7yKAIm!h-h#(R*PLd!8nb*)S@pe%U#r?@wz4|>zR=rWUOvaU_CsJG
zU)$~0kNKb7559T!XzzB>+GfS@{P(*&ze%d@X{d^SJoo7g-V(<Dia#9nzHK&4D<~5?
zRNLJDX?N_ArWuZ<-<(gZa9dPh|LdOQt0P4=)=ppf1;u3L<?G{Dr3T(o>9`}+VO^c;
zXgWp0;{tzm;F@RRcMg_RM?1KsR%h@t&$I07nt!@-sabPfl)HMtlSA5m_X9Ex@k$qW
z-feD~WK#3`g=L!e(<A<Nt5>&O>h8R^J!Sp3#xK>5YV1A}PS2U05%KWc4#~Xj7h43~
z)Na?FdU@IH?p`I+d=ssCUH7-7x=mXaY@<B&ab9Cz$?^)G>|I*Ff;kLsm#@Cu{6zjm
zfO7QbPqVUl8usrx)*y8B&*kGkyu~VHIP3S>WKIix&Ca;`PrBufQ~R~ne?0fX?T+KD
zrC+=wzg&OvG2p-3=f=%)UzW9;{BD2$!i?K*E-v3b-*#Et+r%eIq8Yz-3C7%f_PlRT
zP0**{s>^Y?^<J7OuRpBf+k5Vb$;~#tIVW8O4{1!k<n{eSWcm)Lm{X?|7GJc;DM`QM
z|Auo$&fWZDf302Qj%d%c5IV@c-Lv6!M&b7l=S$3L=f+1ZTVeTr^TnpgLJKZ)xZMA+
zwD#QNw}z#r@6(Qanm6-EfQFcJ{^gH_>r>Y&zHLk8+hOqev2;AYROnid#JU^TvaI!U
ze)Rkm2>$e7hU0mzTfX-X_as(aeVl(?ZBj<%ZP{;9XYMavsbVF`cVn)~cc-%0e}2;q
z6m@P*DP8yAk)B~{XZP#LGashcq+~5#yYXK5xr1?Wzsn_#t}&8&k`j=j_4(ebg~^=O
z<?gSA-R3RYGr#?H+os<AvrH>5Dhlx{zrK0+_5ZbJ-M5(WeOxK<?Ei{`A9c@7FZ~)e
zwLNlnan|qO8%+N4ez`wwZRG;~l~TRhTXJvZZG4g49v>Q7_tN<9_0Y-t6-^~VP27?z
zyISk_vGH@CKAEEQa>eraOLOYucdRk{uO2e-vE<uOclo_e9e$SP)vsG3W;rsi4b|O$
zcf<OkL)ZKkT~cWHb|~L6`r7ps=hD{1a}}PCnrD!nVZ8TQdQ5ZI{KI+qzazfdKeO?8
zzvjfkqmKJOKKWTKcjo5`$&ynW3t#R(-1TB*SdN<XzTHs|*}W~gjfxCHm#`iD!Y9LW
zNc79sD2vmlZEFOMy79~0kNDoN((>rrNi*SJmigCwn|JJ*lq#vn9>yXiVO`Aep7+kq
zl%MsCsB1h{P0I^h%E-WQg_+>Shm_3X#H1YXvhJl59kXvc2(-Tct<6@{!8)zr&TNI&
zgym~9Z?P?M?&eI=J$vi&y0WWtr*{9Z4G((bbxg7SoukL%ncw$qFJ|@cKmGnAvuK9I
z<Iv7yla)#|?_Aw<Bhkh`?GcyQHam-3?`+Pbo4<ebGpCOECf`HuO{M{l<hHI|ZNMX!
zs@hVtt;r_5H(%zNWk6{3b4RJ<y<bvzxjzPdZl85VOvU+|(exaZ#drT4IrO=3lW~+}
z|GF}XdG~kScXV-_mSQjW{`1l0zmGn@dcA*TLqVMAtE%spe1C6`uU~STZHAL~T7=N)
zUN`fdIpSY$scNmb@IGgzc+hLk#bK9|kDlNPPLSt`dTR2(R^a#7i{C4`_NH60bSTu-
zJH3v*<(#F#y?uMZ+MMK5uj_T+a(46@e{jrlD-5%7?P|$5Sp3Mw;#q3EzWT$(t$U2y
z`I3^?zPs9NX(;*alE{s1zWzypRe6(lvc=E7r1(F<DUzKf<<@V>=L@(iM0%_BD*HZ_
zYc`)UNZ8({{^xE&LsWTUd$q^3kRPSnH~+hT)0d~Sa?4!v!t;UtL3=AVP2c4>&*lGe
zt6dFf_wSXLBsrgCU|?9sNN_PvYDIEtK}lwQ9%wO7?*!ZYLk0qE<^Q`TM;w}<(bCK7
z#I7<S;N^v@NA!<my)jN_-}--_+tjGgSM26@KG~gr`Ni+WhIsqw(YFt}PmyMx|K_BV
z*cP5$uLI3O*Q#A9st~SzCv5sPC(f+Yc=2+%EzT+aY~egIG1D|1t(W>8>RWZ{?xTZp
zCwCo~WcQ){I-g?XH?Pv>zKLdbj!g>h&#(E>=O^CvsimhrGTb)e@+QZRms{^oT{`FZ
z?e!ny-W$mEPBpEzd1R!tENQ9oKclE~w!c2+)u~?4|9|K`YPxUn@-RKh%)qdOi-AEE
z|JtUE)SQA;@WQ6ru-yFF9s>W)t(Vx^#UShE`HT0Z->avWvP*WF1l?Jse%dM9_{Qyo
zY47y%l(hf<O)F<iPHvvk^5%@q=Wk~=ynp!e<NEiLtM?rVdiX@|aM0&Di+vs>ADxyx
zC+7I{d(}GxudaTwdTZP3)2sO>zdrq1d&WA!f3B)tCknb-SD2;nNZma4xk%G&!m`S>
z*`1kOHNl)K8>cS4;8Ps9%1ym5`sOhQ(Hg;n%aVc?=7@Yq?VM_wY5Lx)che+~{rS;}
zF3Y3CKD=2Rb5%{?>Z5Mw$Lm}E9F?n_cYThoYv6-RtB&Su%<2D{ee|@b0c&v3*+eP-
z|J8eZ^X=~6`&0b=L-`{{+jFOzG)21QSuR;_+7+#){QcXX?vqoy9;}SB@k%tY)jurr
zsVTEJHDL+o&L2@h62|+temiNi@446azGt5W)avJ0lnVwfiTN0m8K!4g5I1|$G5@F_
zFMg%N7c^(LYYM$gUOeMeWHO7_=?%e47hT`fax*UR-mfL+`2Na;n$;beZ#rqm^S%5p
z52&o#b>U<u%fs>+mUCk~5)OE8D1CjPuc&{4Ld(3(Y;nQ?;Xgh^c%AdSx93mVS8Gun
zHa)lO-R(V*p@}nD&s^1g<ESNL%CR?Y?wm7)?e|<a9u0XIG$k@>hM~{(MJEDQ^#vR^
z?Ku!=$hhC#XaB-0Th?*SnY+pALf(pN+)h&My2}hVHvFzX|IK6FxssC?7d6*&=3b7U
zwe0-y4@UcJnzvW`eG|-=eNxPFo6Yo@l(`ni{bLty`?}_smF_oB{hzbC?$+{yu?ziH
zM)g!p-{mUEv#jgOueo-!cP+~6dHS$wi~rH0rKR_Zo=L_t|MIl@_0LoL%%tmIdfV(Q
zjc=rEdHyH1>`3{^9fu}MTYZ?#d-q7X(>(*(-|S!1O3dZ;vQpE#p07{KEnmI&Y1#I~
z(7h|}1o>8Rn>EefdSS)^r;aAIU&4z$rI(oBh)jFPdoB3ix%-kIXa7GZ5t(4UbDQG5
zlUEZi_Pke|vp%(VpW~*b8yxEL9({J-P_eQ-KxCb0yK<ZR=c{any90{l^&0Gq>i#%?
zFq$z}^N08TV_!TMz38{JeD*&>&eu5Y-#cER8+(6lRCX#j_VqL8^@|5*@Xj|5xGfye
zEP8?WTus3GyR2XTFNixDaqahNH~sSR_!Ak$9?M$atmB?PVdm~j%>Q16e0Mi=T+ii`
z-P)L+aPV%H&k4QjX|sG%!auhExb%Lx)eRHnWYKVyOF54B-pH^$6j&+y=`eTrgL-2&
zg)g(1u4G^PRe0v8XzkQHHW%hU3wyT0G2f>sq{RM=PPnK9kI2rOeCVgHYQ0kEN|I+_
zkm|s9>MCeYi$3TeprV4J)RNR95MQsL@~v%V`QsfE@Ba=@c*8#_Ej90ZO7WWe7PIZ{
zbl(56_42!$Z>;LFqMCI2G=okb&O3Vkf9-1qhXw}MQ<qOZbN-TcM~G8|t94g^21EO!
z$L-<uc2$$lq=ubZyt(zvs+5^09!1#PKk|91%`d&GUrz$|oH4(xv@<UB(eCBv>xx<G
z>$J~>2kn`fI<K>J&(zF)k<O`sCoBH4WX)MWDd^1Q9WDDS!;X4}b#Z0I98EP6KW#NT
z+;iU1%%EIXwWm&cE>pV~opYI!>pCfP(+v@!e@tukG_-%)tlZ!v`pKkflg_8DGtN#c
z4HYjk6FylrSzPqWiBDR`+)k;-sC9j@o_SZzb)Mp(;Enf=xN36$XqxLeSvyun`sDh$
zX`feJ5k2nDQgcqq=icStnzm|5C3{z|{-HHhHvi}E`JYM{D++`In6z&!jboC1I{j7d
zoTJx$YpYsAH~#oprhNM4<j!|Ze~hL}FKWEqEZ*9aUpM7{^yy1X^HR2!$VI)Fm*w&6
ztZvWUN0o)K%A(%SU!JZ}{CV*BudIn8>p!h&wEpOpJonl4S2vx`eO6lc>Cl7UQO7LS
zy?-)SZ_<<-mz~5bme%>Z2A#Wdx>alUq?c}H8^nqvuV<QSCoH%WZMl2m?UfPB3PVrk
zXnnaXRB%FUv&hV<ZHo*wmoHk=rLx;^+HL;>+RJXQnky6KxTe(k2<Q8&&Y@{x={!E-
zM*Q<^0{x3J()lKtiLTxe!>Fzl6uhxh`_Dq}(A&HTN{@o(%yvH@R_?lo(Zjn?Ztnl@
z?U!$!wx7H2&%-x&<@+-gtSoOm_DEScKS@Eo=We@_x|%S{$7gza>%6}{Hq+BN5Ev6C
z_2~1aUz(c2Z+3<rm~_wKGOzgQN4a|(WsY!uc@k>0Uhjo$-MPj7k_8E$8|0H-a_jDy
zD8~Bk>{F8vi3yzhcQEw|)iFPoubZfr%D%z%(U$yLTaopRk*8{O6C08pYPfa@eo^JI
z&N`^AnPk|1S>!ikR}Q27ra;xYb&aP!TnZBxk7cgNocMNWQ|ZOXDlNBbt1mt+Nl?CX
zO11xf_R_1?ZTub<yh=+=3cfJi_$>R1ui`h`iK>N`Z;MtnD)Jm|m_GeldG85fGplJ@
zRrCK&QSaXPHKphbN3#>d>4_<xrn7s!XX-6ix_`#uz!SqHYeDz@;_n?QWzB0>IIcQA
z`NWl|zPL$C1wYix6wfYPuTT?g!*Pw<L6GtPT_zz0({(DV`Z7#57MNaf6_P1`81}5x
zaQbGY^V)~_=S`@~t;>l>=$Cz%JMa9gLkUd%xz-YM&F-s*)h~Q_B1^pO>aV9_&Wq#Z
zw(orK@1SmJsJdpvtmJeT+kd-CvgNeyDqQ=xtcC9hYZu2Kg-{PIHXD}kFM*Sio;KY$
z^JdXutqQgUeYSreFPwKhLE_sg#<{U)5;W3Jt4wu}S-k9?ctD_@o!26UGV>2vHiZWd
z8k|ezTz9^QL3_sYiL6V%WE)O?VEyaSz9Wfq-s)W3z%L$Pzl-ZEkIL)D=o?Aa8l3y@
zTz|lH!ZqgTAH7}EuKL(#mGiRL9~9L8o~*t~T3ea#@aC0a0S_{{dv|GkD4msJbo$}n
zi^kpZ@t>k6Hd;9@>UNEt5NWngH}ivs<)H&}7wpLX66JV&`Oi65npofGsTyx&6cBZ0
zjGq0_{6Uw{oxN;-qQX|!96WHCL)c4w(b~}C?&p^={g<Em;%T~(tgj9WhyM@$-%OJ}
z{}j6;=TLa8?|i!3gf&wxCPu_G1+9Jf{n3pk*EKSl91C=xTPi81|LWwvee6+=<|Hnw
z_@?X4au<cF=IHc0bTyU**Rbbad-JFHc5@$#K$3P5L!`=u{29p+4@5jA6c^4C73H!0
z@=34pUBdiFT(@^L1@6q8xFsq-EhKz#U(L6=!@=UZMHz}x)ti{A=X!0w#$$Sgr$%M%
ziG}x9EWLQw!8!7ZQ9?G~Q6=_&PAcmYzcov}`+2-LJ#R_(q4m2?NU0oHy`iKft90hk
z?3GvR182lvG5K?QON{94XY6$oLNd;7GGui8Y<OP0;rhuH>!!Kym-d~oc6#1YHbcfL
zHiJz|rmL$l{jqFNj`#di9VKFMnR#B(!;+828$KCdp4=I{v}1D6EjtGn<%S6dlJ+|s
z;#krXaqPqN8J!D~Uz<KI(RuguaE8~~`48rMI^Q#4|1{~@lSDHYz8<C73_6V&PWGRS
zocis4S^96<xOBntKFhMzzGbtfYQ*UrixuT?ewDr9<*^z5uHqasLKd_y&Q@3bdYxgO
zO!?(|XQni~$)CK*CG6P(#)T{~wfPThB7S9@OFpM|Dm5**?$(#H2Sr~qO?s*}@AOB#
zCld^ho#A~DW#Dw6_O<WUUY(c&jT2b4=BY4Woz8f{(sHGS)m^2-X3N&-ocrtWf5k1{
zcY=H6{Qtb#UD~Pc>t~&IsLy6^Ugs4lmZr!<3m)!a*K!ifI5Pc(^BXO$GfXA|KUnUl
zbt#^^byD>7lerq(BSq^456o1E3y(hda3+I^yXoOKLd&g9F0M?O6?9^S+m8zgdl|(Y
zidgw4_~sq5iAmCMm5z&y-Zl4^RdAi}^aJuTGBe(r2ql~j>E-;&SNn_Q$NTjk)Ot6+
zmU?4-_Rn=`33i1=Yo1N4m^yiD?lB9!1LtB-T1Gh)s%vH)WBci)cTuq|ea(>x8Lc`e
zYaW$vkO~yA{dQ~$>wLxdNrE!jNsGLq=GbgDiI-&lbo*wF>T~mB3s^fGHcww-vc)OP
z=uc<ScP42kQ@^Q}8ijYBIbN}vc0<rDQGxOFV{fa-^Fk{peMs(EdcvdTgri|BV`*|g
zV@lS<tW|R_s<enM5L%cV!I$+T_MU~W>LGQ}t4(`+xRT<Te?5A+^mKoYw{BCw)Hao>
zXGc?9!xl4{7|vek)nBl}@s<A(58g8`JflzFUcBt*0@r)I2`ig|7G$rQn(n1Gk!#sj
zm8?!-jWu_wq7*isT*xAC@#sC{DW<mM&=2uPJLdXq;$F=8qI%mQM!y68j}Npk@_f(u
z;vT8-_$CW?RoKCQZw&a9jhq&5$h<IrZdASaBbk@H$#W`-ZaW74nekC&R+-rDLm8XD
zhb>#m)BNnyIc+2T3zs^UE}7Z1Ce){gIqk`b%v9?vZoS37c^_E2WKCDtCYsG;`uFL9
z)3y&keVG16|E6|;;_W?b(v16dM(s<eb}JKj-IUB8TKs^yu)v?gM&^&Z_ou^CI1-oC
zt(4%|FntQ!!ih_lF;3JwTchDO^-%lH**e>7_I6B{nBm$o^T3LRWd_f^pJ|88>}3pQ
zJ27u3)5l<uCf(I%T4x2OYNb8AamKDabGcztpuU!gds~4H<2@~B@7PA>>l2nOW-a?-
zoiiotm&Efp2@QqaFML=H7p+;=#5ikmR_uiGm-`kJKHE7v_?lt0<nM0gH*#7k$3M&w
z=RBYHMBH+{w#a0i^L;+ozi+NJGTJC`#Pe^K=*;Jt!A*56b5^z0>+H^O)YYHyz~R|3
zHZ{K<whH0Dr62b;ygapo@v_p%J<BqtRMt-1;byvGVQiSm)Z+|mTm{n{j$h~NFzR`^
zl|>`e(Cz8D66V>5-v~Y7`fDljpLH?Yy}L^8mPZdV%K0;xN9CS1jB9Q<>Ls=(Y{R|0
zZ2?kqyq_#K*~zHYTKaim#rJ=IzE}v@dU@rlY3w>Q@4FNG!Vn3eeQj@p4y(zf{LR{b
ze&K@|HAQouHhQv{uaZ2UKl%Qf-;!5eZ0P)YA+j!iaqi25{!0Izy4W1P5vg|We~DIH
zz19COk2TLMye7@n%{l4Iq>9CBUOhG9(m339JW`VBZ{OYy?o2c9mp>D)T|4Bct;A`c
zYntxA;`O4#y}U0^rR`+wK6~NA?nRoHWgpltDg7z4<NK^Og$o_pf2B3#f<M~cdeJUF
zTd2CB)_dc9xm^Vf74fTTmIUN5n6QPsYWkDScb)C(Y^_b}E^9do@@pGQ`#L8CyPH2)
z9eHfu=~y18w=Gv6=0qA?;qu>fCn<NHG4GN`-8TLQ#otISjK6T;<|ozGL)B3RDIU|R
zKOBgZ&wd!x6IXOo`s?&9922JOZOX08*mcZqQMky*vJ7rRv3DEZTSp(<x@=)@g4}`R
zTNUB!*Qb2k{&?y0$om!MC8xytUmpBz_r{mG@}maV(`I(YnuW)=e0Zt*!{O-#w^ydq
z>U^xvcQ1)*eCGG;aAf%P3ZLrr2X}WoU+tHADQH<tm3-(V-6zuzdU0`ApQ=*-QyiI6
zXc%!$TW_B`vz5Hw6(-BXwJke825>iS?Dbnv7I!b8Ltf*@rb(%v!Yv~f$j<AWq%--j
zW_+0bLB%`g`9cG-`L^CtzOe0R-G#>wg3Bg9EuT5ns`!FKK<`fP4Y99mAKWs###9@9
zeqrte>Emiw0}GVyEQy>Sb)`7RN553jb7jlhw~ur}!~g89xV2m7YxA9ZPmelDY%t-z
z(wH5?=XRxV7TY{O-+3Es<KJ%(6jys)@F&%2;&pu<Z_}ccO&;|bpY)C^n<N-S%i8w-
zd%OK&@YN3IjO#~OU*x<=<)2yk@z#>`zK8$&DmykOtj)N?H7B4heSLHH{AJq({j!4t
zo*r1Od_-!w)lspu+#PR1FEgdF3I8=Y$a6QuLE2|l{C_Tw%RXO24xIjKyKsXP_gQPk
z#ulf0lbS;}8b@8&_^zv`<)^yGY;DiTjJG@ZCJ1%%TA1FsxJ4r7|ArN7vOZV6sLL=t
z82#;9bVa7zGqy9@{zBEPg<dQnHKB7Xe(vwCnygkV!=&T9@XF+i+J6Idq{I~B_SAm}
zZ_9K%v4my&#(d8Qf6s1oeHJZtX!gn-u9i>!xg3aoU1U=^gQaBF;}a|@zQ0{;o62@K
zGc)(8@chno|FLQ9u8>_%IRs=a8Fc3DoI7jJ+YMiLyj6a@)^pdhnd>GO$?mPLU$-b*
zQRvVT4Utc!&%)LQv>&_HRq!K|F>k>&#`LU*8R`~SL}q$TTbsJh`QzdvJZlQR2_E}>
zK|;t>yGL_c*}IvW<IY@|)hcwg+C+HY^5@%^T$*)fp=RQ$ea-okIE<eQ=Nt}}TJ_1`
zZR+O0O<%$jbY~gg@hjV8(c%3~!<hHn<T-w4(=M5HGRI%Jt|nm<*SBTg;l{&PPgl47
zcW{gklAd{g%8pgqh5dyNt$fR*lWPjhsxwySX)rJ!I$Gv+r2G5(`x+Bps2`kSbeT<e
zmA-qr_raHyPG9+q=llMN+|2p(wdmF(XKhYP{MmQlP?cbmAN#30ReLf!))o8AWqRs*
znk&94VByw2mi-AGnfJeKnNab-_QhQ7BeACwJzf6)V%(HEDRINU)ujj2Yo@1I&QjV_
zC%SO8e}_5OCz0zrs-MsEJs)e4YxHIw=Zv539v|74nf!gVKU{j%Qg(mEcT4vl+O;}5
zzx7+k*JTHE-DlZ2t6DC5s+i%iW~XZOEY0gpjBgA#RP!zumE_UCXSMK{UATtd{I9*q
zTGOY#=1p8G%QrDwOltOm?cFP;WGq;+Tc4%8>w%KIS;dw`rn6HNcgt!zEWSRy$*3%S
z|LfN}Z@=Vx|F(O7YW~WjiFg0zIh60up5)HQ>hsDXvfaG*8DsbD3g0yK`<*+=8~P{Z
zl)TA%(|zvV&fohkJmnQ(PA_>TYHRuN)ZBm1mp{+9+jgq<@pR{kgPZn$@A~)g_~qx%
zm)mbURr`Kwb@8u@%+Ji%ENGSfe^0+ZVDBM*@ih_`_wU?t{H5wMkw+EE&L)BVMN_Z8
zWJ>R3eYX06z#{%wwd^^I9)5dhsOtD=-wdA5TESdh4uLEFSe~@IoX578{paSxk!Sav
z_37EWk(V#I`+3B_DFKG%lXh61TDq67>;IQ?`5WfFzVI?WxcVQ5uV2$-8TAzTu9}rE
z>idg)s-JbvOY-^8xFzY<a^*|Q>W#N@D&M_b8x}T0ktb^5!$s33zE)hfzQg*FeSN%c
z%$Hr-wRd89RLeRxzumfsA$hgy^7>C-^&h;h|Mcbl%;mSW+Zp$5o2K;tesZ-bs|)Az
z^@5Lg-<_)YWd*~7<=fNW+tuE2{BYq@W<l+V$mxG?c|9%Mw0D1pZQsS*we5wo=Qh16
z=3JCib|9MbQ`YTmyHl@A?(@F?w@;k={Qf^5o(13L)_twLUSe}obYAT8xSgLjZ(shl
zsQbw^?eDMNEH~S7$Nk;g-{I3P-`;Q{FHE0VD*EE<LkpiTeak8~`Ch9%gRBtqUIRJ4
zZj<ac)hYkJ9zB}7AzpRXChaXYXF3v295z-ke0rd$+T>}#7NgB=D{jxQQCqRNX~*v8
zToEqO-`w45d5>1*)Ld6c5ZNxehI7qheg>Ds1lCS1>+W-Ex&oQ|`?R;ZM10D6onI#!
z*YRyKr}LcLwXEMWzRca(dTm_-`&WTO`~SsCJY3(brawDB=*~wj-}B)sV(vc@zqLdz
z&R~D9rRly0S{F+vUZ4HZ*n9c|b%_ORZ{}W2`fkw1ZPS00KcITyoRt!fUs?u7rOYjP
zWBe*&*747Y7t|tOZ#L+Rms{DIvf$@tjU7t%rpxu`R9K#}J2&^?&$L{t0v(a^ymT#w
zx-0J*zul@huEvzLH9LRnyB`~O9A}(5x&7Nc-n`fBJD28uW1e1irn2DC139*@4;OH<
zU(Wj$@xrm+ZCdN~)j>CY7aIOL{3A(B{_oeH7yrk^otY>1clWP<Z=dilUYQpC?C-Yh
zUGohuXJ#ozeiFX-C)cWW+UfR-8lf>8-y6q=oamO1I2+iQ`TE25#M`gk(_0+-cHiOf
zPWW82*l)st<n9+IbiJZhT3kNlu-2fMr(pRt!IMd0SEU6^YV69Mw;D;WE?g8Weu^`1
zxwJ9Mgk$N>=a~YQuxz_?Av5KZx6S%XYj@;3*h<{fs=ONW_}p%(FP3RLj!W|2-<keJ
z+>`UqmZe`WeSC88-SWt)?N(inuii86QuH{qsCeV8t0^Z#1om2q+-OLBwE5H=;jJOE
zl>vMD*^e1i+*#LNd~46XIL`bjCYzMw&u)<06uf<|;+~4ClS$@ZpXg-XY$|wH)6oCl
zOeC_QzD-wit-%bvGa<RX85>KSa(tHlyJ+a9_D^!=j*iXQCnsHZe73Lf|IX?=5AO<?
zC(LKH{iC6L#cS@@hqH7~HJ&Q#S`&ZymerdXY}w-eC#+b$vAoTfV{%xN+TbMnf6?&+
zw<g@*vLWDdublHE_5z=?e;-+Rh#f51XsVi~xK{O@-GjY*c5L1icx+1huDH*g%LL!~
zFR|HYvA27>L3)$mf!<|e8&Y|{ehd)cZT_|>v|@qCc3!6oDyod)Qhirj3e4tdMENzD
zmYti=&_2_O>EPo^_7m$YMO|fe?uSpVOY-c|ui|={+3aj!?3;dw{qtoXzuNOT3(Sqr
zGGs+`oXuR%e)#B}%Jr*uP5%6+IOXlxlUAD@%H!py->^L#*89zOW9UXU4zmmMn@-mr
z-IVvc>}{Rn<~hdN=N`CAa;&)=TJzw{`Zv>bEko~CpZT?D-LCG-=kM*c`ulmx#f{A?
z-km$WVEfxSE=D$GDSlcPyEc`UbZT0}oi(dGxpVL8$ap8a#v<cS$Cp*D-lS-CO~3i=
z4x3Cq*>8@Q1a+2qKT%12RF{&yS#a+0=l|Ai{x*5p)TA#0PfB#z*X_S&vaUb*fwPq?
z#}AM1^Wx%XWKEAdIMZuKSZ%KLxf||#ugZ4&8)`n{@RnQIJgu_qpH#9v<Nl+0PN5f4
zc%SM1%KiB9tb0k#XTkm_^L(Q-pYA@_B3CWSq+aoMl8>D2D@}(Wt6l6b`Zzaoy?J>i
zi0jtk!|#?o|EXtla8>2xvu6Zz6EY8TI-1;hqf`C3&_gp~_w?@poStQ~&rj8NC|Xl?
zZM%u}ADer;n@&&4_+k4yVdvhNw)>Avl$H#C`ruweQtH<NgDhu`U&d>*b{|@ms3OI%
zS#oZ<_3W8F5A}GQUf!1KsjX1pUAcDR;Zr}RXFN*Gs#w5R*6?<rX0&m{f{=Qliu97l
zb_Ra@Q3hWR-rIK6UgY`v_`UXd^I3HF{T18u(&TR4@3p6z4<#R1?=ky)ctw|{pV><T
zGyVVek-HX`E4h904n5K^jcabto(=A^8NO{i$=JJc(Y_0nDJrb8vDPbk(%<W+<(5y}
zxvTlk?w}vLHP-UGWcl5)%lP_<VeZKf4KpqXKE35EsD1ICl*}7n@BZ(v%C5bRxO}ba
zT7!>k#7X<8gVLrsSCe#OK72e;Q?}1e-?qe~=>DEV(NAXW68GQ2_AbCCJlN^fo9Iub
zaw0E<w>(<Vx4c;EY_PCfF5fM;TFYzFN@}vVB{nQ`m73qlcl7j*H7{CfS5G#XtNX!6
zHXy8~i|<QeUvY@(M5lGToF8&K9J%)HQ&V;OPqq0AJI^Q0)z6wxFu%XDgfUd@ex=EA
zXOX#^zgx;&=Gx!TbRgLLBa^6&GtYGE333-=6Uw*C9!l9g)5vkthl@|Ex+CLrCU0QL
zh@H6S__uTi2jASbgCSqGtxys-S>&}?Pgub(@z?DyB5f;PEI4?=Y-?lP`+$1p5B~#?
z=YOuXVv1RQ%6QRUkGA}|FJlVpHo5bEIrsXJpsnHaj)TkxR++qZUa~0Wv0s+fiTI|n
z>Pf#AaVyr$y&Bmsntgxghf~6~$A7$beQ>Sw**)R(*X)6ttMyAcL%-jAeluX%Y5sKI
zygeV+z1DQ<uBZ|@yYmbCceZnf8;$km?G`inX?JqwCEs%*;map~-m~eO-<`*EuQ$Y8
znwE5il`HnnV@AH5CvUCR-d+3VLj!vm|GC>|v;02J{b}?@vgO3fV>O+vn=0cT2u|KC
zv%dF6<-M(<6RPH2y7u)NCv%#;*<3cx&+l3?uZwKFDmXv+>Agh_?h_-6n%-<Vz`-T(
zZ&CI=MuiBg2i;-{%-c(z<rZ#}tvA%nbbGR<t?k=>p_NCNBLw-{Tc)1MTETdBOY?+X
z3uo{Ct2amC=JC7FW>_rT{X(m8+o3Sti`#0V)Bb#BtYKU9h57xJmIUTGCoh_sd{Eio
zy?N!%_lYd0FZ#Q@p3`UI;GDGUr@*4^iJPab&y{CiaDl7C{^<Q2uc$Rl$`&Fo8J=_m
z*Blf3u&p`y*3J!Fu|Ym3FXS)RkiEIcWwtfr49V5{(l74#XuG8?Wt(fA@08ei;)=uO
zFomWMH(s^qygcX8y=|3qx3zJPpt<>_he21XPRxB6{>*pk`5n^l9L01}XV(~CTcEx>
z?H^m0m$%fud5ICf8*W<~{MzCfl(jZv#<@kGF7oo{e`N0q&N}w+n}zngZPuMT4z}_c
z9Q+(7d?nW=)^n5ezT{<H%d>2)gpSMW$mA|Rsvr>-S>fY(z2R#~ilx=k$Dw@h@(qr9
zFx5X=%V_E0$aD9z&QvS6`z8M0*DbY_nA|PBS@yP{{C5?X!pVZ1uUn1<n0yx37cbWp
zeZBUjZs~`!C(k)IOO-CwXYLUby1f0^;)^fz_pM%Z{oWNOotX}E^d6~k&ia)Vl-xGY
zexmJp*PRoK7o;RqEZcISb-C*FsXgKvLh5=P2Tlq(?UlN>+3MZtReBOu)yqzQVy`||
zJ?mpeiuL@p2hT?t$?Z@(AO2^hYtiI2DeH1i9JSiFF!=Q6vtdtW9?g|~C^mJ~#nOo@
z_Ulg!aQkq8qo_Iln66Co>MLCf-l}FTmpI)Vbt%l8>*e&rPQJk(--bwJnwTqoyyf$O
zAy+tEe%eEa>~*hJvB{;!l(X(?XOlQ!zGKUa7ivlt)+Rr%uB-UF(BkZ=T@&WG6&_c&
zT<yZS=P2LS^|GlP>z422ng1c`Xt>paBXVI^R=i~}@wcz^w&(PCuwzm+?*dt20}-ya
z(B{3;Drar>t$(@T*A1)0qc44a=d8R|@w!DuSRwej(6=qSa=x&qDc%$1T&jEFT7#N<
z+ve2Drn~bDEF&*%Ip$^E{xeZI|N8EyxehDJBKX%9Y}QKnaEo=#&WiQIbM9YsOzaZi
zovYxQaj=ooWqIc3r+L?WyWg#yVBMsq$gh222A|PmwvtQ#iw+jMmu6Va>oUCe;7!n{
zxj`kH{vGM8zsQ<oxpm{`PaCfJo{Tu$71LaG&^c<t@8_O|>n}&#Uz@$WXm8`TBaHE7
zhkTpNSFGcCbewCl(W-qR>^01nmz^lwmk{eRLq~T;4gdYAN5o5{<+VF_f;WDN^_yrR
zy!uDjD(eLmf)26U-1p68^{+cvQa7h=_A{@TSBn;AK6)p1^qWmd?UOI}<L-FQZLAQ9
zm|a&UB|FbxK|>(>>5W$>y|>+dde@9r=dZi`IE$QmQm)R}W_?}o$noFX54tm`$;v;N
zs$RwMX!V}3aP_Q1A1z)N&$#9}ZO!YgKjLh<=gnNb(q>Y_LG5C>N1qZNE!^-p;r-m%
z+he9ZTg|^`Stg&Oum8&k-7WiP?z+aB=_Vw#bpu!Om5qW&k1`$n_-u0e!nNv){T-P!
z-7B}8o|<8}(t1;W(#~goD(#tWM?;@KbuW=V8q33#-g(e?Ubfh6->LD3dy=P~dHJI^
z=v?-m9eaYpyFQiXRWd|rF17pET$s??`90x$_>2c{*6%E|@VLvq`sKOr3T=KHi+(SA
z7utU+^iR&3^?9>gw11{fjJZ5>x1Rcwisv1xOG8x-8;P$`d6O-h^X0{+NAu1)R4!Wo
zt+Y*BfGwN3??)D2?f$-Js|+1N;;UzwP1|2PKSf|--<yRG4_}O0W%e_4iT~Fs(-$|N
zEy_AGee1fNWldj08s6pPPcSN%EWf|`X2X`gPkXeOuZn2>T9kWw>g{!xRdzSVO*7su
zr<U_zx}kH<DwFcsiW55zw8gS?xov68$cyH>D<E5PQA9W6*wd;NiV|zJ-Tv0FvhuCp
zwDs8bnL6eC8;aY1>iV!ZtoKfT`po8%^&-7_)35r+Jh`+p|K#0MSs(b~cK*7W7oB_R
zc8*Ba<qv_Y=b6rElnxW!@F7Z%e@^A*$A>~#mu)W0&u+hY;$o@oT(>j3=lR8Zikscs
zov#$?z$|R=dSScv+@KqG;_r3rT)%Wzo@F?5Ld1DvO9__H{J;ylxUG(KKeGH*y{3!(
zN?yYAo}bSymYh&cXM1=daDpDM&aSPgGgE$`Uy6{xf7aiQk%2*riQr<j{DRaX(0N39
z1(l%_;=K<Wh#bBDTXP-H$z>r&k8k8zr5p4jD%M=GW5<oVw;X0qQTh7$_L95upQn7b
zR{wtQ4(F5g56}5mG&(Jomk*GLD+(#*hzbjNVSmrIB5q|0v&JsAipyT93a{SJ3%}x%
z9kFnlQg)!B^3^L=n|HGRo$0V($4V)aJp~U;Z$5Kqyd$I@UTBq3e_?iosAaA33xm4t
zuj+i#7lvLxQe0GBb=Neer0R&U$CL9n^v;@H6TdX)%$`ZHwG6Gxf|-0;Kj@~e{oT(b
z&K7#x`b>eQ!?bh%QcK$n?g}$aaXOjRTdlG5)#F<Rfe+4v)}7jP<lCmJ%Qgq^PQSUu
z=VP5cpG*F2g+k+CuRi6vxi7DJ#9s^C(0NTvmwl4UPH&xmta|hGURqW(ihoHGOOy~_
zF{dv$ySPv;S>f-d2Of`2ddkG=YJ}eNqb{4WOtf^o#lXOj&&a?ahq`PkCo?ZQwFu=_
z+SoqF>_f0+f*#yzM{LEa1eOMLC@gDlnvy!(=gfn&@|&^IpWjOhCtuyUxBq*aepAxs
zUp_@zfz>|uw68Q~Ielm1);`T9JTFbBY3atfi))1&(u?PP=sEvzv17zyb1AJqj;T4f
z`xO`DNUolnsrYxATw_#rOhfDGmkpLLnRiL%bf1;h)UlF%^77I;g9OQC|Ad?WX{~u0
z$Z9Wr>0iga?)Xbiz4du3mR+7|XROu|;>A(XdN-i!fzISxc^)6v`r7R4d_SkE;%0Bu
z^`|K&Yvty?`?){#{QevAsG-s(x>8b%iGkrEGXsMZ_E3SY7-<cP1)UgO`+fb6ruGIG
zqht4!a<!7CEWF64d-ED+=rrlPj;lw?{x%-lKmYN8hP+FE5+c7pzEj+nFTd&Q@%D<N
z+#+m`pNh3URdt_xC}iWJLlu*HJmu4ZWKHgeim5%`KDokZ-k#<?PCJ~HS#t{ew}$lQ
zvvsdgT<EN<@jc`-Q`aoXW;U;t3!gob-0JDEGL?DCv~yOyQ<(CnToIcgaLMTOQiB$m
zWQ~~Os@u(vlGx8Uy!)*B#PeUV?efk3pKm^Y`d3Nyf&T$NA(85JOF8!Rz5QI=Ay9N#
zN!{;*c)QAmmi0G(O}jorwk35xo1*>q>jtWfJFma~yP_g+YiYnQCxeATYswc-=>4R~
zdu(OdEYF(C>*dpH=O6sNKqc|qse=YB;+yMTKWARcs+_9m-WI&~(fJ)*c4bAsH~gEV
zEAQ~Q`|&O5+Bx^7u70{@6x^Fo_@7tgRa-RkrTdC!a~%xIyl38%v@a4q+IsO~^6~0!
zRS};H?`~^obA?RHTFl1wx`^W=d&Q(p?<z`SX5`IiGdK9!Q<MGVze&l@Bj>grlP-AX
z^7fdstnQwM2TWdJHv~Nb<(*=Wl(5v?X8O1C@{4fy1G=ku=iPjF;Zm62X^RXlANPBw
zYPl{R{qL^)pzT&yw@C&^(x;T8y>}&6%U{0U95v_3lPg~xUal$nRy5~p{+5;HVgJP|
zE{n!Tyo+7<w(R1$S(|T$zy2wHA=K>SY1cZmi=drfAJqQM&A@O`hk-!`dumEaElEu-
z(JQEY8dY6<`<USW`STyS&Enyh?ULHNdfA*r>s2b+c^c7MGmfuZ<Jfm#q6^D|02zmg
zg@5kuuI7K_z%=Ep*SxY-naM)iw{PFxf8XvvZBc3EuYLAiOw+io)k|*L(y>hNH2V{a
z#Runn<=@+U&d&1TO|Aa4&rLFNHr8+C<z(b0eVj9qTdl&&X<LHfd7&FVTyB&7(r0~c
z`SEXy&Z#*+?K&s*JZD{)d5SyA#YS}2vDpC!&wQG_`m}i9nRQ{Aj?=5|8h3l1Nq-jE
zbo|)GBWp^nS^k~7<T~ZE$We=EHl4%8RYgxHrR#iUox5q?*PHBp#$w-2the#1ops)&
zpTq5Q!aMy4y@c}PZ%e)iS{lzkVw2|md1*vypp|mS1j7k_CvQmquc>@C|4%{Lr^lzm
zpEFnPnPk;>DLNrL#V&TKNoUi<np?`xGb5{$a=%2B8g9P5YqhWB2Nh=Cu;p`Ju$x_6
z_D%1=g}_sO&t&c_xXgKT%Ctg7wt|_LH8j?_GJfja8>sT+`D|$;6?yx$FW1R7n(@|@
zI<ik+FFVWH_R*OK^QF6s6#u9t2`qCHJ7O~Tr{f(T8U0EBuJsu$>AmujY5%p1bjJ%G
zT<3pFf6{V{S~}s1N8dg_$MXy03+z)^xw(ArnW{<N(0U_Svc1=R5l3YtPsbJWn#4-I
z{X3TY7k|{VH~bH8bA^}e)6mWtjVkAEPw`7~<MO+*(`ByrG8^@0IiF4+_upURah6fu
z{^a>d|Bw6ku`l7&4H0;F-%9S<p~=gG60UP(J}G`WZ;qS55#NW`SrrxAmUN}53Lo0f
zd@aiO!8PVb5w{N{M{Q~CKPbOqf|c}oqq4UW*UR#%vQK8$7ftR<SsS`z<$R5D`73|-
zxzF3OL6h~e(C^4|%Ptl<sLeUP;CEr%p?w;$AEGzZNIYHeuOc))@7c*|u70(Tnb$8}
zmr=7<FlBwksVN_`FFd%hBB?22ad!;kQ6`}$I!jo;W=Q<H)P0>TwCl@<M9=gy*YbRw
zZBtmTIZtEAo&8<q)<KiqlG-0Sgm_<ab3Tln&U4UNcq7M_Gnb-WmR*0?WqRVf-nx5p
zS4baes=e0td9twT13Sy;v_cUVjYu{oL5Fg`XFBOF1wm&r9p6cCW_URS{W#ZA#(QXa
zP_<mNQE|9O@a?kuJ3hR4x?2AHy&u!_&&BPj@mEqj8_LOh(s;*Iujv&Z*+tkDH{QSg
zoT+5R>P303EP|ew8%l5cz3|k?czj>$dhjN@D)F=1LJ}APvUvX8sCmMd_iUT_hf4LC
zwOQ$pTb3W*CBL}d@x}%jCf8f8mL+H7rT0Yt)^BhAq>*A8<9KxCYrTvZqeXr_miu*$
z>xGt@#Q%J7_UEg6!2zvxGFIyf6^;tbVX|HMPQq=<E<WA-$=@gOtmEhTmT9}wcN>GR
z<h-fwj!j&@jlMcQ2;1<hH7F!zUjX0YcCHt*rUvGIzpx|o#@e!s%c-`9s*kWcuD*2E
z&quU->$kZVUxeJ7UCrdM@P(Cp&<;nZ>7QPIn8`hBZOZ}K69SuTmR;JtV#egp;rYDF
zwEUW-COtP2mgdSgsVWaV{NkP1JLyhyg>9yHwo6Fd{l-(k`}%0s^xab<m+&vxwSCj&
zb=h+k*v~)m{mv4#dR5T_>WhwU*tMeR?8E2r8^0#mE_x!rZvlf(hG*p;fw`HpeW&WT
zT|KTfG54t27uAP+u4`*^S8Q7+{_UjynaBg*EYeM4CR%=IlnPLrK4p3BQLZAs5cd+M
zS({{M*)DRf-x!&#w)dXKig$*}r?$`4Hf+o(yj3>wx9+~o=~l<Zg4a7AsI0Yg%QR1}
znD1~=wbA#*q-i#uFJ5uZ+#ng?#j)TCv&tXKvzZK;$Fnc5OAEQ4=e^~=@XnwVgF?s8
zP78QqpDS?{>HXMJ5VOWU;`XA}HwEGjNuGP_IKI{zv>&%Ln2=sxe7yQn?f<_Q-@osl
z_rLDXGp7IbU+#RJ*AUOhecjD{=k7ik1=eeU&TG7O72TcvbkCVx=d(0YrWbC_J@@Ii
z^76~ef^}H-ABeqPvEYVz!bN4vlG(P7_54o{%;?y_q1CN%&&&1oM3!~y=KGztXiI7P
z7N&jgt_{;<>0E}e5VKns_gpRA_q}O)!(=tXq@6w+vRGdn7LxK!)1T1q*5iM#y=48d
z?0g&cA8R{AMS^qx<$ju9$*C4Maf;%uq7P#8oPT?6u;`v~z+F4;*^}L;AAjV(&*=4h
zVrEydS_O|p?19dE^LBmvd$#I4Q)272b$5>}yZEVoO=oRKTXBB=dv>w(s%;9Ujhok7
z=dAs5fl-8SqVs~4Roqsu`WHpJ#l;&wT<IYnGOLm^Q1C?Hf}1S=6-<s?{gEATSwbar
zv2N2T<-10qvB82Dn_AaxO<!wpXRF`ZWe=NQH$CXuv&=_Qjm>At={5Rljjmg-Ge^%n
z{<6!VTUN7G=rSXB!Jhi50v{D$b_vZ0V*ICjz?0c+nL=-N$S>dOpS!dZ4hPpV&W?L+
z=Cej&jqqLmOuk3AlFA=z3VF)5U!I|r$A4)<F2~O;*B1UzWs}!S__FMQBloqdLSJq@
z-Fi%-|7KP+uWrp+y^97{e*8(>HTC8H(Dc=5^9<)#D$bs=S#JgFzb!Gos$1pWn}=Vs
zm6^{sH@Nd(N0QY!alz6p>varj^PZGm*>4qik^jWE3;&8wm-1M!FVOZ+y1R69l=m;u
zKCP?MTcZB|x|F@zX7BNGabLgPZ+Co`-E@0;H2=ry3HRRb_@n<J%PdtWPm(X>Zh}qb
zA`2GFRVmTNSAEz1?mxWvx!eVBV-3bv;@9>#XzhL~KUdE7epy4>RMX-W@7KA6i%ZRl
z{TlSf+nqCP^16iT75`TLn%Ej!7`N1fyV#2Pz{EJs+sW)p?|!-D<x{(~eu@d3;iT$k
zivJI?&Qe)t?wXdunmRMvye5Kc!R8p3mp}by6b8>RcbqD>jBnq4VM+hg(w)bmGuRyW
zWd;06e}BOGMWjxkVdS~PMh!Opj;57-j&mInTTXE5+HXmU$XYa?DS1j)$@^zKH9WsI
zpIraokeIm+H_Oh+!moQ+f5@4YRG0P6b-b%I_nut*@>HXZw=dTkC9!VV+VHMo1<zIo
z-#uIRE?V`?DLJt8ZKR*NS@Qbi<ImFlbgnt(9aZGmB*>*Dts&6Z7qYE?lj7eAWqZ}@
zOYN6T6MXnUE@<vPIr)CKce~E!q-);4ko9D(m_YIBA5(n!Udo9FaQmHVn!E62Rlu~i
zoR#+b54)(^=R4@^i@PECviH`mbu26Qv#hwkSo7r$-yIjMDrz3wIP@=gsnN{!XUt!p
z+Pr1W!8gxlzmYy|oa)K@fAL4zSk9NZHof6LWcEZ&d-m$<qHX+UQUce4t$lnZ>cu;p
zTsI;4$E(EIPoGt-V_vs5F6>rEy!@sFf9uB)Pjk*ktlGM3>esEh(Fcy6Z``1(m@{|Q
zmN_$Ou4Rf__ucw(!Y%Uuw?|tl|KB?KWgC0>N^LpkcD<4^$L*WuM?B^=sqa}UVe{_O
z@-tgct>k50sbi-QUK4dEu;D`Sv`sOMcWyH&?C6;BsGsL`weN$6U6zRtc3f{akL%f+
zbggvz3w6uI+pR<T{>(Aj>-#e{Ys-Tz$2W!@Sp4M7vCh!53M+Or+sn#)<)63m{?{+R
zS**2!pE;*|jFkF&>`?paU`Exyv6iXjYk%b}?zv-HyyyLryR6y2J)_-h>VE#aEm@%K
zz2TeSr+mRJ=B6$;C;gd!@lDG0179BsB;5bwlNwpTH^HR0h_QlSR`zCn*@wRe<#o4*
zsQlHh__%N;pLWqE*S%`T1VW{G3h%4gm8_qC_l-f>w4-l6p1m8kVST6Bl~qq!uIyfL
z@U`|Obx%#M6)Bu^#da`o8mUM6aR0g5-_Y7{>gDY@nQqmwf9}PfIC64EsP3-nCwg7U
ze~ldfnQ`&oO1OEsMs4Y-V*!!k5qln`M`~~#W#vwebYvIVxAk0#?b&y%R$QJ>`UO6k
zt*BFF{+FeH;FjzKE@L)@VxKg}3zOZQGAEv1s=>jtK73EYD|N+cj#{>5J7v20PRI$`
zB)YP+{@L}5jg5Cp(uU_ZYdK6rtX|xj+OgAH&GrMQ-ZZtQwK+R#&nfq@%jK(m=w)X#
zQiyhAEK^)~<J~$Hz59Fq{l0m!Vu3nSk#^KE8~*TXr~V#wxxX^8^XKmMZ9jH>7fJhG
zZ<%y;{qL{gYxi2d`6G?m1-<dD@YF3m28M`l3=Fc^I}OkdI%wZQ?aQj$Zkt}z+q=qV
z?qfDmTzIr|@&`BLiK;g*mT&pt)%Dg=s#az~Mvz1!L$j;U+t=*7))&ru6B1g^d^ci8
z$CR}`YtB#eSg^Zl^}2O?uiyMR`|tO+%InWJ&)Ci%E2nbrz~jL7w|#T}ndax;o_+q>
z%{YsBF84lICElJLef#a(vu|_D3eVm&>_6PF^Ut*34=Y%vMjo0wG4NsiKl>{;>(22t
zxBUKKBh@}}az)~YH#Zfy+}GTeUE(SAF>iXMa>aB5b&f+VT}RH(TbaIh-!F+{uY!#v
zs}D}FG~6A~ucUYImaY0Tu19$#PwswD*5C0kuzT*@{gqFD{;3gCIk#6Qcl9D=nThYe
zUMc<>yVss0Z?6VV!5a4OwRXqywjHraxgQ#<F7+#J&Wcsl4>Ne)y6wIwz;2cx{_W`f
z`!Xfp>uhiQUVnJ<^||Rhbt$p)wg+F_61VBb;p7N&{Rh?871yka+c3Rq-)gVDNA$%n
zIOj3EK5cjGsGoiHw>9sr3(uS@%>0$4XMKLfy60sPb6g&EpJv~%Ebf8o-8|)I{}vqm
zVSBvt#es(Y2k%v<?9J-B_=sO@Q>x^)#a_=ZEa;9suNvWd?Vq;U)bKtF1%HKvigl5k
z3TFeox0Ua#oO(U%@`YB;uBRFwl=&V`xpw2DzW$rTE$)8jpPMYwe(~E=q9DsR{&mpi
zU*5bG!P)mYciH(CUVo_^R=T)iPXAKzwmQDj++5w?d(JQPR*v{L<8JKdC$rpn>I@mV
z4;nG@OZx~;PMUUXN9Tqs`WHC5Gox=zy^#7}^w`a~J9|GfneXYA_AP!@`28Zs7RfUQ
zLjI_<bjqe>R%H6FRcvE1y^`an&-a`2R95tfMKiA$T$&NEL|jtrNLi(a?lo^=GmfKw
zj&0FQng6CsbN3#tg=$K%`<6_VUFi^fW8q`Z!flU_==zl%ZHVT%rp<Wkf+EYTn>icL
zD=Pdu@!Mg_&MR|%3h}cn;_Nn`r1se4qN4Vd3XUyx72MV(5iUnt9|+uh<Cd(xbDrt`
zMJryrUb!tMc=b=VZ57vpAKe;fT&=`Rma>Z6+?Vw-b_VMyZU*t%cx@ea?S`!8yn}~}
z=f!+e<LqC5s`$c=79~S}DPP{(lU{dN3*BVfXPjy#HtTW0ndXZ-cmkP!D3q*qxRT`+
zymL<BEot|M`z!1XU)XJ1cllSP)mLuWdCCh;ES&w-h<8u*t0;5M-HbVNqwl@=U08SJ
z$?~Ub$~GKJO^-@us=Fq$ZSSOGS4uA1?A|k-kKMsI(Ly=zjD_9Rj~8d03lg^28T@d1
z*cOici+;bJRLN*{w|mZsX6H-1k_NNi+}io{&Dnq6Z2^xWXFUB;eom!M!7?!U;Nn_I
zi-NH7OtmA8bD0fpL_ZF2?vwRfGm+WnOT#%`4R7Z*{SN}?+AOTUF#JA#g7Mh5%{<2*
zHvFB;w>azHlAr!J0~1axp0a&Ir-K8pMS1eH7ReQIhR^MeuRV6xE04Kg1~YrtYvZ+n
z3Y)LFpZs4NG^bBP;4#Bd&$n$heE$*+Z(P_u@AS;Y$BxHZs_R}1{_)(Qci~k3eUBS8
z0+0SM|1xbO>#H0yy%=TTiW=Ev`?&vl6fpgASg|wP)c9UiJ=1MB!|S{^4)EFDXMB15
zUhU3u9{yRAp0{;Ybqe*Z=&0$?);cZO(aF7V(cR1D;_b)V|L?6Xtf;zl*S5O0?{@9|
z*XoaYE*kK?ymdV1!L=LZdk(x}xc5}OZ);?YfsWk`ExQ|fb`^0o0@?g_o?2~-%c?Hu
zE}ws3Q!k^Wn&hwRTr9~m_<e;6k0sY%l69|naQFEhGrt4*jB64q*<P6|z6+i)-}^`P
zQHPq(Nme<{cKHVuPg`Jnr`@%2eWb32hlbLwhS{=#JTIg9B5yys;qgtz!fx?QCWVVB
zsxwX}&AzXca!B}9W5x?Fb%SG)4Uf;<7h5$oD&_vWDQrL2&RC(u*=)~!vQu;o-<M_9
zLQZ+=(_MKsZa?~Io=@a!t_M=SX1@>aYkWEH2&eo-O=jVgr3ZZl?y-I<ocf3HPCAe7
z^sE!lujOdos94)8)0J`mOwuCz0H+#*_*2UsuKkm;?^;-a`)rrZ6U;mVynd&Nofca;
ztMbxEg-4G)9yzYvlK1z|$Kdw6b$^ch`}y&*{r{|+O<T++os2m3vuyg0zP#<JJzJ0J
zq}}|_wRge7^F^C~x|Z@pM3)J$?BHnm@Unp|OxZri?$zVpSGLFn@0ybS(nR#gE{j(a
zDw((rO6Hv8^iH;jem{X#;V0`>o`&-GEr%G+?cc|&dPDY4aX_I&)`dB@FBCU^I;yE<
zwCBmJzw_ESHGeZr@1678r~Y7#9M9y}tf3<R|DBmUhdtTm+v~l1RV{Bm`nKLhVn+Gj
zBWv$p5X!xN^Y{1n))hL-RwNaA^04UX%=WdZGdic&xR*&r_J8!!9p8_t?p4>UOIp5e
z?hb3OzeirD?b_dz7Hs_{>uKdew*z<YD@iTbZrST^SJagFipO$w!i=YB7pqpJ`IcPX
z#>KI1&y38-Yn&lR*ZLed;<m4Qk4j^#c+&xf0LvT``#srC4{v^YS+qzq=kDi%B`akj
zAOHCCHg58+BdPLx6*vP69ww_7J<vRKmE#QSB`(FU&WFtnc6uyz5s$dx?2@!XR7q-8
z2JgGo5}r|PY`YAagggo)3eL-L9ai`4e#5#walT0Hk45rqo+7_IUMM?q6>k%KF7iud
zdFd*@pM_I<U%!!6e{24VS$WF;1e*+bE{P2q`=lQ#nkN4DD%5fjTq$zhVaijDve!Q}
zw`cRq&xy)6$mGboGsShzvV_$e`5%>X{z<KzqcDF;=>CtUb9U-Yyxaa-#l&Ip1z%sA
zeJd74eU=p~ovYK6{N`h&)&6sOe&7AAAI0=oa9o)Drb1<j`$O3iLhjz~ZO>Zv9$70D
z)Assk#@@sWW)DQ9yx&b|s_c9a@9;)tgH6EFfEkDF?^hHisNNU(z})tT;p?X7DjiA2
zzKZRS4ZdwCkp3aw_gmnmY{HdanN6}<Laz3l(<AD(a4WRfMb&;?s{d-@b7o0vg&URf
zKHO4oryULHRlOSBvzoVJ%bZVZtIK&UF17MTl(YCTM(<zM#$a(?=y|Q?I<<tditE0K
z7ugk@&YIs7E$f+;9{G7yd7Iy|1qti6-Rn@V@Hy|G6r7(dkv~oPcf#7D9UB@=edlI%
z@AP}*@S0KFkL%m5Im-Pzg}?GLPkiml%|HA8<2U6?weolE%v3xge(le?fExdj0~YLY
z`F-=eBsC`F2u}*xxMPLW)O$=qbrUsDK8q~iZMs;_I`yjSq0VFfCj_)IJ$gO){tWxj
z6BpUFctf<e__97sx-DR}W47e=k3Tw;ES}rW+SoC<;tk8>n*5CwMz31!HY7F48CZPw
z&Y7z|!!luSLSDwd>`s^9_1^7I^@R1z*7QG5vPx6_bVjn!;@DA7F85T&%20m0Wamcb
zrewo(3r`#UhKcDP_pCN=xcj{P{TvO3gl@kt9ewrk5rL8MKD9Qd<?4Ak4lmwleErqB
z&6j<)Gydr6-o%|VH>odO)~-D60_#pcjb~ctj!DMk+%sD>)tI^MO-Cl9fmms5j@hMS
z9Gwi|-g$d6=f11-v@a1~aB!J+$YG@~Q*E_mjfJdUGfw(xbB+Jt`n2y#%jGBK6(5V?
zc<JQlQq%jU%<cB;-}1|u*M_ZFz4oC(v64&l&kYu#{K=0WtZ~WSqPB1GhKzYmZKpEs
z-YDDM{@y!CTtuHsG-%3Op>&<7C7Lt09#7xa`grBn2bXQ1oN(KoY_rIyZK=PQ(L7sc
z=OEoZt6n)BI-k>-zt^Jl&u5j=y$0Xwazq+Exm#9V+`q-l&#&Jvety)gU7|gvGmGwT
zaeUcT->~G3@O;<TKMWTCia8+vVp@ohw$JWan|N34H2J2!_UQI4632H}@0Xh=Q=;>2
zZQ#RKk**If-`88Q;6=ho2KO|ngO}{4`FmZQe&wC^zX11Bd(Uj$a^dhPr?SxFChJeS
zf3B>YaxkQH%>$-gD>@eiJ?ytSBGu(^Wx*_uEj*JJSIWp#|JCR@?3na$;=R=c)k`ML
z>)z(4k#IGr-zzv@*7ss{ayWBVTI=fekTq)2r(*R_*w+4(R5CEI{(kSw&xK0$3nZP?
zt7ZvZp1sdN@aK;?E9wf0XMRZE*}FXXg^%(3^2`N=kJ>8OG=Jn@IJ-gGnmO-A<HgW}
zS@F@~XHT!46SHnJ^TO}NOTA5B75#2f?^$YLE_mtA+Q&a5u3U?r=DzZ3|KdAU4N+!a
z4_)eKd|mYalv1d{mzy^1B03A+U8`Go$u(AW@51gqlM47f?z~wr{lNNDssc_MCFW@f
z6)a@CWpa^)=j`84#n;p~`|SPh)TYM$bMNct+jIU0-d%J(P~<rC6bsM97iAu{2j2_J
zO$cvQyYr-I=9l9W`XbwW+Ad1H`7&p3d#}hZzb6MDw%lU6@9&=2v&VwNcf~59gVGGS
zEn6Q<VV?K?%bere*!UhA$WOg@f|KiTW&7HRl5DTJ>q}oYU-Dx<%goo!@%q~=wt%u^
z=d!g-+ln#-%RZc(vHm58mijc4j~2!TKf6jh^}8(!TenpyW}D1<BQIrjKHk=^*&r`u
zx64#RYwf9@Z<Us^TwkK0$n}TK@``_BDO>QgACu3_oxswma)zU`L}JI|l${FFQdzo6
z?T`9OxVqj7NS^iha3XRBSAPk|Z_%U%9sBQ+Ez%BMZTGiy_zUWI9Z#`a@O9GngGo=K
zS7aBbYn044j7##rz{vS;hW@U*d!hpr{(p*mq_)Ov-ka6DIU8<0OmI(sJ$-U*LUGux
z6Ek)@oK#PmH!=O^N7wI1%cn)2dh?9qUcBV{lieG6(nY=>K6qf!-MPA^dy3uPePNrI
ze|lATXmr?=4PHg(jrLu(GQAL}eLJlB?~8p^>AIV?%I&aT!!iAS)H{*drwqI?n#cGU
zQaKNua}RtUT<C3cgZEw*`$Bm>=Nq%ar2E&(W>y>!dopRy`~1B>ioA>X*KX(K`>|5z
z)GKl2SI0Sg-mwT2ey^BPvvcM9#Vh`?sPB_~6|BGf^`j4`eM27ojWpOIn;E=s``(>9
zHPd5#_s=<0T6V17f3L@pmJRbR@84Oh6#k=B>2%w?6_?cc<=pNl>dkjfOn9}YtbWF9
zvmdr49#-jEVLZ{>Hr4G}@wQ#-ztfcPJNF;{ZcQzCe{bTW<$7NubEkMstk_r1G&e);
zvkKSyiW1@13fU7sD@rt<TdN%%-uq^~0BhpvsI^9mw+i*j?0n!i_wC)ykKMjXCuh2s
z+i`d+XR~c-4(#8pSAPG&YV+#PPR||}+8@5ct?u^toyn9F+3JfvBz3Lb>2ZVWVxFpZ
z<;LnhxA~%r;{sZ%Rx8wVq{}RPuOXgxYKNd@`KQMsztekTx9+-I>cy>;Fe%%9=lZ@2
z>o>8V-|64=-lx`#&$j5Vx@l)XA;X_(EK8kOimuzNayd9_ow>vZ4St4%L#}>ok|_^V
zR2aBatb5e96)b<j_;Q~kyOYARyj$O^f}9_D)pC95a&LTG-s<P#Cp5{gudPbq_oKk%
zHD`nD91m?R?#bFv)79!C<fi9te}YHJHh??m?mCOTPm5+T%<C*QZQ$5kR@r}5=Z3Xp
zgJQMIF3yd5aRQ51=ge^Xd22$r!NP=R-r5g2=89ZZxqmZYjkNS{zxl^4#CK>d(GcP?
zv@Xu=bY3_==yji#ThBSyWV2oWo!LK4i0#x(Jdm31evT!M`AWf&liZO_n%g_<zA7|Y
z8Qx~7kan8Y>a61N{`O%7(d_-}6pQS81PVP~dpZ|6yT#d*OC0ai*!%tM_OPDz?B&9f
zqtnFABAn`G3&~U)H?DMS)$rJLz*j?k<sIoJfm_}lx7jsbR@Z)c_l;%0V&jnm!CP+J
z-OB#AT~d0PA4|8|S9jY}4ihsMOx@wN%a&I*>P?$}*`XW9)Xl8+FFM#Mu%hEy(ed-k
z7-mkCi%kx!JKrVpazbk241w<_Sz{}nO<25FeR0e$Kb^3?FRX6*(vQ<P??mVX>ipSN
z{iH|jLg|F$)w+zYUfFK#PhsBV&ii%lp(9&tZS%H8+})kC|9RLX^TaoIrJwywelM3b
zRp(n<<Xbt}i<>>}nJ<6d{{D7c&D^7(x)x>aZrK~H?~_~-cuaSaim+IJKx@Z5SDSAC
zQ+K{LF5{8evf@k7#-kMi%MQOzI<n!8@03fPNA)L8ivDu^_!JEZFJ2ArfVla8)Z~I}
z^%dE5Zg9`=;@W7$<}<A@aD&-4skduB7v=Q_PL4gj`l|Id{TGV)TV3}mRsRf#KQHr6
zFzZvwQuj}@rv3O~<q;SZA*8Hr=-PIP*^n!!kwbFTOAhb6FMO_77ccJen(3T3S14w&
zd4VUt1y8N`x7!yl-cB|#{GF%$IZ3#^bCu&+L8e`-M^=44bx{5?Q|b)qxAFex^*1$X
zbIH2fy~;fPAo}fP-E237y6=CsPk&x-zu&?_uO!N9%aggW!gajavfH+8oyHtH`BiGo
zI=ig=--!b4c2|Ssw{DkUE$n|^cVYgaSr>j)C<$~%-O&+aaAYvgF5!NCyHxo_qzmiz
zF4n~+4$GtWo+(@DW3fp5{8#ZSP8;R*ul2l)R_NIl<}%ONN=@A$V4=rWIRUFc!EGs9
zZ~NU5o8Tp=;q4Yy!JO2t70ffGNZIGDQt2XH-K}B4DfS&xzlW@>5D?4Ok?%1qWfP2>
z9V2*qsYEyXvCk228Lw;ztDJS>t3c=~v6g!wE3Md9y`9^iz1H-gdEmn|&(+%lrnsA3
z+qP<1bF}Xl7B#;ad70PLGg4-pzfk7y|7)`1&5f_uo>E;Ru-E-g#_0}*)t2H`C%cMn
zSV^r_c$J(rz43V#w@1pXGmX=X+iXn~n3q*-yZQgt$Gl6kPVUo*W@@zQihFrtbH<G0
zS2`J+f_APK@5-NXi^(xd+r#zN$M!Fx^+$TQpNm@<Q@UYe`L9<~Kb%}BdFrx9jI~C$
zv7N*M;jbk&U56u<6mLA?v~HQh)31V-4LY;;lpao+HuYC1>n_cztG_hn)%=>Fe@gxL
z;u#ec9cSx*1t0gavFp8d*uW&9LM|(K;!ZWm<WuurO*YC`HjX)V_=NN!Hsz&K8+7#4
zUH+VYdGq1x!;|k^<WJdb*Pk4FG2+VKXNy-{OHA8v?IvfqoKN1WE5Q@jaQ$X`_UFr;
zuFakbw<a^BuWoGE`;j-N^`yDP!lR27IVN)$Fkdg*d4B3Y&GUY%9T(hC{W8TVbk6DH
z8^i<5C03-(jd||&nL{?v`Fu>QU+X84f>ni?8l|T$cg>m~(;GeKy!P9SWt}aO%Hi)i
z`V&r<^Bg(q<Fn($E*Y%@X>)ZJxU+iPF1&l}#xq7XAJa7^l7BKxzq(e<RE~aD%C^R;
zCa0paVp7naJ(rm!wS6ltUo(t89QsY(<2Khtj#bOA@UJbntTC<EM>}z{(u%~=HHX5Y
z3s&5UaE)1fVwt+K#P3dt*#6C?Z(I+vely@<`}gGk!rS?q#dl}d8?R`3_J7LM)}TpF
z8TlLS_G-v!IqhHACvfDj#?mE>*DKZdT|RewKisj$ob~jY<+lYU9QhZjl^y*uI?1Bv
zL&`)cTa}_WCJF8<HlF*#eK)|HLG8d-H7)7J6Ll{*U5%e*g)85kuy~QG^Hs}b!3~DD
z-^`sJvp7lYq4<M;N8c=;GTSw5qV@Ujh2K6O2vcd6c(v-wPu7GbryGTw+0*-eD(2+*
zp7;O2*7v+yl4Z_bRptvP%mjs<%T6$cFL|%E(MvumsaQPVMZm0}6AK()E>r5Wb$Znl
zT=XsN`=f9-j+Z}l69W$wX8cq$_{#ZZ?xnVj2}{dN<(PE?jY|u@cpaOW<hsP*l9}Lv
z8Kq2Wx6Zb&@Q`>T=eTlH?+ugFB}-*<*m;w9H->JNy<)bawJ>I;X>WM20?(PW`gJXt
zc{2>(WY39{I9uIadsu4f-3;jl-%m>Z54a|+JU=z(ctw2KN7L*F_wx&<JuKh&&qrkO
zzwIueF*98=Lv{YFHa}4txj3lc)4VvDk{gl}T@TIRzqjFj`rqt(`y1chS<XK5{K;7_
zIHR`YmDs;4K6kTpQqSXa$Bqe<mESsCv5a@cE9-*-|MNOxvZbT#|84lXr_amleU?i9
zuEWdT-@2l`de-qmjp!=Tx#r7W`plAd=K8gN_qP-uQ>C6w@~bDGo;FS1#7`r;rD2hg
zh2~_Vw-K`?B&HTL%&Bk*V!Wi+y?g_Yl!WSjjr;R*tAD%O3OM+t$t(+;-z;+Mt$|eD
zmrD=X7et+7Tk|beeBaH#3%{G6zkBoEpMO8UdtbR<_3`p&ajU2UY8+Q)Z2H5wL2u?s
zQ%CMiAy>LNnC65j>52ZmFri6oj$i&q!{a^k>rQ0PY7trP?w6`<tvu;N8+&1zi`<57
zkKTS*(RsXJOX2pVj9t!OBqm7CoSI#8PO&OQ>x#jhb+7sI;tTcN7qQOoZpq;(FVyK>
zwtxAHxewZn)+@|wl3HRT&MKKPS;NQGW`eVh#>0uz74)nm1j@^875mw3w(VK)e)&2+
zo~KSXn+;3S6e@i(?LV7jE#q(7_|1C%(%zk08|BR>6*xQGxWpxLKX>xag<Lu|?w7cq
z3$E)vQN{XqvZU-Ef%*#*o$lprDp9vSI<NH0Jk9q7XMRX*==boiViv!9`GIg$%Nl>B
zw~LirwX)SJpSl{&&_4h5r}3iXiPz7_8ksn5E0H_n{_?28#5>oed%qed<azB_q$7Ad
z?!&LS3fYG~vf4dii#?D%WwWTiCEsI-zwujs<@3!*yS!k-yc=SDw&!Fef3`IoDo-p?
z=Bai(#+>aS^X31?TF0c17li$k4{<R`$LD>YDBQ8R;7Jen&n+yvi?5x0c___YDO6VV
z=Yr><CXtI%4f^-ke!6hI!7l&HpAFkT%A9!CeRkgNuaADezw@tKzP@Pt{^D)(?eG7o
z`!M(O<>EIFi=Q7&sCIsrv_?wh+t*(gzm?nPZtvf=|Na@xg;ts#=8J`HXU)jnsv)(`
zsok$XN|ixr=^T-nQ5(3o6^Us)D0ixx@N$~zX_;q{leNm6;}>Rma4wirF2yx7c7<-{
zmj}0H%{Exc_pX|+vv|)ZGueo@Wo>8I_H!Lk*L7R0#Lzvd^U1=6KOUx9T`^uExqHcB
zJE1H8JM28?OP$eh5^>F8mu%5aF+15iu}|$jQ{+6)+{<ABjFKzXvNzA{yq#U+5S4a|
z?d%;t1D&q*#=)vnlUCgozaQD3e62XpoB!zE!s~MnOqpJCir=7Vt?~OWHmA3Rp3t23
z)K=+eU&>dn_NG&*yv^Sa?U;3R&zvrg;A3;XE?t`AR`BialE;&*YNPUwoa$K@%q#Vo
z|4dMrtYCmy@st3^C6_j?o3e4U-Neg5YR^K|uRbn(b>7D@etLu4Yd_m<3(Mvoeq^;y
z?{L;s*F~4xf;a8x{NA6ospgm2E!Ve6PXbms#r@>iQI<P<;_dkXo{dlBRVC&B&b#E0
zTYKKDWTPq1p^2B7n3|q8#524ykx_Eq_iVT9)Mu*~n=Y8N_GMM_bY`gqEDzV+e6zLO
zJ94Y6$TaS&*IJC$&hOfCE6B~DQmC+tVdb<}rW%Zg8rhTPh?u1;Pk3J_us=Yo;7+u~
zshHV+rS26TV2FM4@yJmXqbV$tKeiotz@iwkQSx?g_Abwt`&`6L3f$5gCO+pob@sqh
z=GUrUzW3=ri@xLLR6FG`Pj{A1*N$Ufi<>$>)QkGu(2VP!?zZvEZ(*aYk62rETxE`I
z^*eXHHSi3#%ZnZ}waK4?zF1qmyd~n<w$J~Dsg;8EW&=%=SdGrxTZ|RiO^V*_-sO4N
z$A6nc+!oEXng)}y?Aun}VEK}tsCg~C_0h~a#f4eQuUFplG`>42Z_V1o4$}v(Vl*U*
zPj_AEI%HCDd7XOF`Y%=*PrZ(=`?n*rWS2$g)?fKNZx(r&u7BS6#~?6t&83p~ys+51
zMRg25Qi%meMHr&P!<Qa5I<Nb6`4%sG*54nP*Gzo<M*K-n1AE{$=S`-6=T#lxTad`j
zr?T`)bFcHYds?w+kG|v=wDUCFRQdS(d+%HE+xB_?KKwbpref>QsQmwhIXC8?mD<yx
zYAU<C;Fb9*-=)j8T2xKgX|Za%xOT{_%j*Ptrw3)MRoeYSDpQh`B~jn&(6w1xcCNX@
z9bjI2=7RaZ()8-z*43+56wZ0O>H68&Z(Yr2Wq({0|CjOqX!)|Pg=<PP%DTFkZhw#U
z=4UZ*yyC{T<yBL}D^ZE`6UoOTo6;2|4jo9+K3=!-r0B1nJ?`rtMy?DGZdVmKwEDPS
z_lE2@%Qt+y{m>#)aD!RG*S@KbBkp~kzW$r|8;e(4J}2Bg%5GP6rg6LKif>yIm9^^p
zWP%bE^pZ9OJrH$T$Q1wN#;K%$8cE^)=i0Hq6*e0mULA0xKjEHvmBWNh0@^ow53Tuq
zY)Spz4S8h?woSb2FCXsxe)X%{eO+g!=)OtO*|v~FVr6$uQs!Bgn^T+4EO}{d7*i;9
z>GpcoN%=NPc^f7$F~64*$}&{ce8RNy(pv3q&YgPKtKUj5zBF^y85iHXSBnqD$|R}j
zZ)-pHy({i$Z04=C?>)sD120#x`CPwu<*@OcsoV<1cg$CJ$~MTWo{wwq5G~ZZEB5d4
z=cj2`f`!A`3KHaJEmgj<=X28By`gG<=il@{wsk+>UETIR4_9Tee<o}<<pSPYzfm^(
zd2-Sm+s9{vnEoD1SQ~S8(${OtLSoD}FpFkpY&yO8ZsMV&^b_5+Uzi?TZOq`DoZCKi
z_l&C%ackFy+}K*3(YT_0SHKLXr>XB64R@_JyRH;_<<Z<_CE0<lEAQ#<eaB?0-6DBr
z#^&=!bzkJ_Wu81%yuZermpj4P^@ZF@1@SF+e#$QAH$8sN;K-tjAu~doC#h~bx5w)4
zhN#p~-5bHL0~cl_g?_ub=kRLd4b#r7mdZD~yhBU!<o|DN)zxb1k&kqHml)0LzWK_~
zDn0-H+j;g%)zt=FzbBfrB}&(}HfU#R7oLz%+ou^-Aum(gA^3(pJ$-rl-OH2T<*WZ@
zU(e^y_igv{di%P{s*-)1cQ*Z4F6o;yHR<{Pj$hAC&GyxLUl(rT713Rs|Ll_JH1D{S
zZ_6*Q4ZGX7NcFzS_uRX3BK$4Y=KK|J9G>odVfXoq_PgUrNoUzp4E6m_nXg^CWR3Sl
z?UV^?S2wLmJy;a)7yKriJF?q-Mfj4xvwvT@Z`RtqPRsrHnKSv^%Y`p~n)a;JJMnb!
z6NZg?Zzg}}SrFwKRa8~iu<ef9z8S404i#s$m!3X4$J?tVA~vS#<+t<pDv^4!4`+NS
zO$>6_9(90EYV-H%X#K2C#-$~ul@pdb@^9)}J40rT!dzyyDHEg^m%MwcT5L7put&8-
z>x=oO+KZX_V?w`pU)Z7Uch8PJF*xGq)OBkgUD~q#Pu%7iiB*YK>$NuRjgpE#Bm38c
zW6z7LmlwZV?Rm|aYw1y;Zvj(hdRFfX`n6Q^ug(v5`P8XGAMC9;<JTU0p#3xdndE12
zwLjv2?j4lAx4^YBx<G7>eZ#JQODcF&?k)PhsdnPzg|{C3dV0RqUi<p}Z}T_B9nPv}
zI3v-qC6<FnSh-$I_W03-V&2)a;_O!&Y^Zqk<<MF|wWpc^i_RCdyWH2muW0DMKIHA8
zUZIN_Cr_C6p1KtJBK`Q*JzIr)=Pj`c{rXx{GkE!>-puNCHNUOY^P7}snuovJXSFPO
zYqkDyqoOp83Inl%^*tdXE-trOFP!Q!l-+pZY|&)P#!St2&Hg>?%XbQ|<k8Uz-t%54
zDd-pP#Fe+W*Hu1IEqqp|xF_M_)uaROU3Qgsr3<>v>bi4v^+%(tiw<+?EtGm06)WbR
zqdu>PAtT1)#*Dl7ztjgGKc0R0^uD@Ku_#l0i@jYU4{A?7Z!{L0*><9{e_8$dHoYI~
z{#M6-53#*jyH_QYiDSkG{mwZGpV?ck?*A&&CZ(w_koa+me$T5vZ7caB9`H<@u&~0C
z!`ZCu9K&S2&1MgTeMDVE<|ePpYATWbw)IGIFZa{}riZ+;Jqh727aZ|rdNi%9H6m%-
zhrKz`X(37ppQf=S9@#JOcVSp4yX$#_{nO9B75jFseD;)+jY7)=%9rp@V+h=}w9hW=
zPyYuW74dH7qigIpN_-MgvfAfxY`?msZs6?lytJAlXDryaa;6+Oe5Qk4b>gbpjY+M?
z4>>u%?EBTIQuk?D)q?g(GS^~*<MkXHA2)fGG|q1oe4WVeTbOC)7gOinw2SHS*N2n7
zNGn{4nPn$ewfb}4&+P#wYq{F572cf@<D0U~Ws+mb2J@h=X9{z3&gJe2dBbzhw7lng
z^NxM_Dn=R(OLkYhdYHPyEcHkIHRr6dS#MsRZoRlT{qkg~(6m4;`Haw0yC+AV|2ilB
z{+rTXU;gS{9(pBKMz2rpwESAkzgIE%?%Wx+X8M6WUR;yiclzJTsGJs+vGDe@P1Vmn
zUA?FtsnhpQC3^ODIkm~Q{z2EdKhM?(FWK0`Tw}!gW<t7~44=W?S)V3v+<))OrU$<I
zkF+-b5we~1>z4xSeAzup$G#T4pE^$^|H;ul0Ud+T`Q7FPKSg#da=dfHzT)TY?AZ<i
zHUd)^eCmQuyiPSsFtZ9+QFFX!YhlHv^0I=Of})MpS1c`$Dldxo6})y`#?+`EKb6)m
zV~d*Fc<z$t)|4zWN9F}AalbAlMZQnn`ddCeq&4$t_=NH^-kJ;hDm|Zm{CRtC+VLZ;
z9L2t@im9xYOI}}YC|y*eUg5O)Vv5Z|6JNpD$m8!^>JBGr=!c(KcjNH<)Wrw9yteQd
z1nsTiKJEW3+pzURSdBsavtkz3FV?q3y%v7p<MG^X{!;5)W!tj8ko3yKtHUmaSAL6@
zhEBc&q(#*RW$gb`=6HVV>GNJmC-+$8i-<DM@!7iM=&RzpZkrVI)AECCIGkcuUfj9q
z<l@8AXI$U1ICfRo`~%sB);_7#zunzkU00s2emNm;%F%1Rn<eIl-I>0^bkg+I%u!Yk
zd>3>pi%!f}+L`|?{@IF9!zp|ArU`DJW-7XFb1={SUfVOtf4<dJ7i*uNsJ(MdPlvMa
zN4CjrlFwh*>m<*x_m$r8@!j>yi<|En-zd#Lx~}-tp0)o&Ip*3;6V+JTcu}}~L!Vop
z#k@9~2ZCy+oO)MY$vq*~p*x5BD}VoehJ!CezTB6}vj0%@;?Tm)Ic2s}H5kt22hTQY
z{krb@iWhUf1kRi+*7alQ+G6fc9#X>PUaNAB@7LLITtX-O^d{fL>o3aYb#+bsb2TSz
zEzgQc)zt>kVaHt)Pc?b3*1NYjZuNpq36g83t=TsDBR}gs?~O~WADuV(>uz>#?w`la
zlKm@pn?9Oxl&|gHk~vYOb2=}6336N>yjaJ4lfn7Ej<zkA4NE(lbT|9isFX`*1>et(
z3Nf1b?x*&R-z=Un%Wtilu;}Q$>F@Ww`@ek0|E;aRoi8@1x-2R!vq&hv(`E6xaMwr8
zMOWsYn$x*G-Din6gX)I<{5^)jhbFNdo7l&^fssYKJJQ8al}GiJc;T5N{u+_OR;y-u
ze{^?!wOZ)YyzQ0DU-j9uRaU%Q7nU8K`goGx-7hmwueLR{+P>*ZoOHt@hL(g9t)i;6
zO$+vYFW_I>Fi(z+^SdtVhOSxns^c?X7HuhUJ2E@mo$q9J_O7OvnK_D`Q=UJ1HedDa
z(&v+R{1rRaq7tN<EbuNkaltGF-}f(Puz#v<mG0Zqb|Px+l>aIDrSpQ-qSJS8?|Z&j
zNM<W%meuxcZ*nKz;$yjVXP(`=#T(wVeW^aj<39E7|AMoB3k`Xf_#gK_Aa#S~T8r5%
zE%%f5O-Wo%J{6b#IfSPM+!9_B=V#lr^uxXnzl3g`@-R>0PJGu9eXLuxTChAX?WJW{
zac<+QUUQy99n$HS4}XpnaQQMZI?<=QMXJSh2fxitj;M!x57wJ~a4);^t4J?w=I-nA
zZ^ACw-`cw<UcdEEmFAN<)19=e0t>ZxL!Le9XL&UF>Ktv)Px3)u|EIij3O~r!{$76a
zOtufH`)+=G=k3?II-qV_wd0FGzmk&qufOh5>^M=J?IeGK;p&$b_YKDn&7Sn*f5E&J
z+ZL`0V_{z}9e&X%`PD?8%UTzUB6Rm8`^DI_F1gxK&bX-eySu{6(kE|M)s;PN+#?WF
zd-Yvlihl6S$cPdz2gUy1^(U*na@${u#vMFaSn&SA*|=5gN<0lU`kRh%@|EPiXjSOC
zIr|&`?b)-xiQS#Hc<XY;Wp3K9t$#?I%=)%Bu<gzi_KE9sg>z5%)CtNj6Y($ZUpe#Y
zzGK}fE-Ah}+vA@6X^s&r+5W)H<0|j#OZ#?}tdsiiJiqt!*>C>g_swSCKe68LH*>A)
zlWnrv@qyA6T3=N2BQ8Y#+?LZAy42TY;xVTs8@bXu^3F{A_#{cpz-67VlJk`KL(!2Z
zcAT2xbE~4fkN?mFYr%;%8?Am^)k!y<(kpzIYi`H3-9Kb6zmNX&ce;V^i}mgIoUhgY
zQ~%fJ7Lu?aZi-E^>XT6EcZundH_xv6l;!?Mttpmci&Sd+L`m@((pRU;^du!D@49r6
z`&h%P9UE@?9Nn^gj>3TjO}n%8*0t<;Cj7-$`?2obM(&nVdN-SV@1L}vTQg<zm(WXX
zpXRL)a``gl+A<AOhP1XndnWAZI&<yQuSCWF6E4bK4_K11)T+SkdCW$04Tm|J@)Aeo
z6?;;C@orR`pjo~@EBIUA>Y5b_5)XV&Otk2mVD|XQA6F}V#dn%(lDGRkv3xdnjYG-A
z+O7|JsWSpzx%=5)5sq*!VV*u^Ld>mQLEAge2ydF-yC{2yVeg4I+6lgU<`i6>(^P84
zTUK^;ahE>tWsQDzJ%(Sp&wiPvarue_9+kUtX5Sw3r<ZPdJkDTV@8;sJwo9on>R5CN
z=L@HB$qDMamfn53%v`oR`c;F3>I<>iUO%1o2h7f>+B#*`vJF8umkAv2PCO^|nCs!z
zo}9;<%4?Ti+rXZ@piNhChse>xX_gh5JC7-MP1>a|e#lB}g3095FD)V`o=v?kUA5u!
z&5g|wX%@Yg*POo4wkXJ2M7E;qrp*zy39>1-O7DD$z1!MXq2@HFQLZ~7!!da(qs#Jh
z$F6SN=q4-XC1a$$t~PaD-szp@>$KmT3VxaLE-`t#`i+j2;cR+yg_KI?y0-dso{I=w
zn6JF!sQ=ldCvVrb?c9Gvq{WcwpL)q=#-2pu0@Z~kr;Gy1@-KQ6OcPQu>d9@LXnA;s
zi|}Nj(vvawlkQ4sx3R@3@19ca@buq`khRmwTK6qWdCjJwqWf~SuGRfS^?d&C{N<64
z*PPrEd4=m;>toL+yz7Opy)c*Lu)4o}yZQFI5Yg|4IQrC%8+=&o!`?D)O={)^+vktp
zeLnl{TUh$%<>$VYmFNFo)UEKvZ9`^Z%L(sGhc6u8y`g2d(Cu4W%%k7v{@b`cZqJ3R
zL)+Y97ZzA@IMy{szGw|_<(zluPX6Y_Tk0P#tX@+X`0BQjlT)F!+jO=Y4<=se*thk<
z<;U~(z0EPzza8zmW&YebOzAP_@2%)75nws)5WC|>!qIy+Dz$yrgeL9o_<lI?LG6T-
zI$J(VE{XVbyVupG?#PjKCoYE@B>Ud)G;aJ6AbFZ!NODz1ZDsD>DenqYc9c|H*7q}!
zc`$9)@zVdx&%S*><K9h^6IC5jO(w6pcPbc5Z+`dwz2~f}3C`JtR*%*#)nw&b+#a~?
z_N4ze0yWvM^ej-_;9Ogtw`0Nv9$q#jH;pMQyN+4T)|$g`k@e*M3xDfwX8%~ejB81?
zw8MY-m8nyFR<VU__1<x#PT%alU)|(4vZ>EkNIlI|Q1Xi2!Q66A$z`il-b~JKitTLG
zD^*=H=FH~Z_%-ss)gH}t8}FFx5NZukn|mtGpfNkeGFf(;Kf6wla#zvBRlHJjM3>u6
zU6!6K&~_sJ+Z>M<{@dQ<u4by!<lEh!;$)?zd~yZ%{%iMdy0@$UFD<xMTU_?x)rY^A
zra7g`AIbK4@$bR<nZMF@#(Y*`YBbx`xqRu2>Yy`E9xrdJR`_;Tar?&;8RqrNRKMtG
zWgq(R>1+FjMyokfpQJmdE*Crb^+jXw+r_UsRvu-3yecT-uVUxHtV?Cr1SWyzwm;6C
zI6t@Kx$}GXFx?i|-1cGf>dgy3e%vuXwR?9#(w3C#0bBPZDV>V!7r&6R)!%$=P>8Y3
zU8i<C$t7BPK1nKSn<~!yzQ-`rw(j&_G3&cYDGMCt8u7<0th@5n%JPjaZ`r?+XuG>+
z^X#tA6Z`eirpWcNk;kv*$r^Sc1u1PZO3ia_FaP+QH?1z~`LRzdRr{XIuFBhXRaU<{
z_|PW~JLQM}Y}6<EAKU60abe=~?iWJ5mzWp7Ib+b(eYg0`?+*@Utisn%E?HbC_P4K1
zBXqvtbD{H+(K9~ZDm<1m-AGF>yXtpQ;l{V+bq86?mz!C9t4F)sX2Q2MllSs4Fc@iK
z>{idsPbtkwMcJ*sHY&dOwwX}<_2mba@-KOpvh3v@Z_~%Km-Su#ap}lBx3gc5T`f=$
znpCiiLyY0=3!8uMwsSWqI0W`xo^w38`^meajlXZ(N4${!^zhZye0BTJO;@|-#!Ojr
zt>)~^Ig_XJ>TY}UWcQofC(WPum{gxMkM`a7``gj)DH~It$ObP`Q{A09HKXi+yUF6+
zoC5mWVkVldm(X-stGQnE;(-l|x&%*3ofHWOKHFHUtMYKSo5x%=>%eOz$0xl^*)%Q5
z{Zq}|S7DoM%2isfZQan5^(b#@$mK<gybSBT-%H2kbA+ZmR7s6gPrUkR)trg4ui`$2
zevdG5%WyBv)Vsf__WPX;rT+S_7G-&V>+-&8`+RGfkQiHi;nc{JT#75jE_JUtdfQsd
zJd17qx|T!zvc=1N+_fUF2JD?X(R`8C%T-C!SO4GObpC{O0mu5AH^UlsTfKAZ>Rn>}
zf6-_E1unj;wX5rm9%gSkA@+Zt)%o-H=FH!_x8nch8m9-(1HRTZ{<|i4%24n7p?)7N
zgL|*H>Gc^%%UGx_zOFmf`1i|WH#D9|>%IRp&GV%9HC=rL-N?gP3<U>gs@Gq=d%JxK
zbNT#mo{!#7?^*p*UK`bL`N)H=J;JHc8~Gco(|EtXxoP}b@RGtiuSKj2LtV?-1U4+)
zz9{785rNqe4e?(8N()`%;$j6NF6!zW*bphkz<S*!*Ogl#+VIeU)~$<gT#DYo*nKbi
z!{1{k)<_;+e(Lk&pab$9ybm(Eb&s5!$H8IADRt=Akz1^*3z-s_zcR4iO<J=^HQM>e
z$62p!{6$w^GZy-h<2Q*x^yHK|f13A*Z{5uCug3YF(X|IoQYZ5dMl`!#T$FGus^P2c
z6K2g@XSbP$sk7am^Hgz<pR=u+;X<LcIuUxTI<|{WN7SBPy5i#cn{6-e1Wt=tb~&Q0
z^KDFb%t@w}9WT7+Yvnv!YWwZ;43pIjf@T4}TeTg!8>9B@`gf3#`GloP+iXL{C>{Bw
zeDjXzxN57em=ivsDa-J|E4gcnQf4mg*xBqV|2^c)qp%stff64iCcCmcUbEdyvbV^2
z*NO5i&$5?&Dg7}+Y}WlvcTPGyJbi|f>%u+*(X~4oJyZ`ZW9IlQ_9$%LmX6|Rz3f8s
z=2eSN$|{%3Y+_;4cX5-jh+ZpgTK})+@YijzsjW9`%}o!!$h5b6?&auL_3zPp{eAKW
zuD>*hShQDqvQr!Lo|S>wJJJoA#jY3LKG-~?<g~_`ni#XDJGSy{@)i#?xNW2-<!fzR
z6x!#SG-qx7yxdkRrWK3d^f`QG3Yb`8^C|7gzeFoJB?;Dk7LWM_g){GL6Mi<=?&Ga!
zf#xi}tG}645|j(}o~T>P*mm9P^vt)Zn-)k%>ZMPpxjCzTmhb`w-bs_WXRj8&d0r-g
zuY9`grv=6bW(n@qJ(aegN;|t~FVCfQIyvVg+`fL)$^KH)qIshJZ*{;-nJaVKS2eR-
zSgL&Rp5Vy@#{M;oVkbqnESPnT)%)X5o?hd*@=xBroBAaG!>rPxeBYl1{omy$rMjHg
zI@;%bB8S!AS@VzL#=Cl}x?3ct$>=Uz;p`P^wRPIu%3|N?m)F-YN{Mr*zV+o{+`+Tv
zjm(|Sw~afWmCoFK?{uTk`U}!xjj@+!?QOIBA5>?+J+t(jR4vyBne|gA{k>Rp@|0yH
zXJF%G@lC1j8L>)jYaL@3m~Bg5eD!PM@6LjQa!)&!SaUs${HASWDB8e#b27^TChrwn
zufH{Ay)G}v`K*0S>Z~u7ch)i|m(1O}^UsEYiJ9^CFK+MtVE6w>S6K3g^KE<Id#HSO
zaL+%>!Ia%lQqxe_@_)Lsf=o$#Bu9(PucxOx-_?}es-5Aw&XQMu-ZiD(UC*!ld%dS1
z>;G9N@A+)=mou|uf0)^<f30w`So((@oa++43&z+=cH7q2u*7ybopD{~+qRA+M0SU@
zWQBQTo9?0WPInSwxZP7G#U+{rSp~9bOO@|Y?p6H7Ej2~&x7)q9GTpxy-8t>I-uJR`
zbBZ;u;x*4lW$OjM|7Yxyxtror|6JWzw!_54vS5u<$bp+?KfA7Pus{8<@6Ph}g(-il
z7p$H7%d(bz--#a6H?sp?tr0iny<V~{^=NP9<+IBKzRt=|*xqJs>mcH8{{1MAnOk0F
z-Q->VvOIyMITrrBmwp}C)T!3joY8n-{#w?OIWI-ZYL@Q2_PcFoo8+eH;X0kyYrCam
zE^t_G@F?M0KJVcb*P|s7-n_39pT2f9Gf2yl;M1OYI-+lV^znrWe{O1?iFj%Cvi$Rt
zdy((;KQ$&ysa`y}dbyR|$It2xW)<;UPU$kNd|-d!Pu%}F^?ubArI+46^zIXtzE!zq
z^Nop<CktN+Ipe#nV8($$VZUz|I4Wi3ciHYgGs)RoLLq3~jQL)vY1`}mtxQncykx^a
z=WUNSev3OH`{rY8j<B@D;+b}<K8bZJSJpN-%ui(2xGf_6Jhc0j<J~_^QU6<5q#2YP
zcE~CzKGu%Qh`#=ok9X#K;nfjF<x)<s-cD(%zI(jg;L;qeiPOI6UhmW{;XJjiq)|IA
z{?E5}HGb#vBXgf5Jo=r|wlG4xFw}U{ZS(3467P7qqtvB5%+{v3JXluft+<z+$(+f3
z_J+lGjZPYU5<2vcZ=w6@EPt=YH!E12HXN84Vqx`iX@cx_WqoUQ;p}eP^-~WCUXs0=
zzIa2YG)uxs_JEEu>i{<yg9VEsR{J`#p9v{GWWII6!8Q-$H!Zxgtkm_Q0=B(Am*Z%g
z)B9#_{UZfK$&>|4<iF1<`?7#{uka@}s|U#*(gDu7ud0tNh@InFvAMj@dm~$LUAgf3
zH)}$p-iW1n-&_0E{ZDqj?qY?G)3Z!B9NZZ#-f*i{ihDE5HD-|y<zH4_7S_14+;CMp
zL)43FM*p=herZcQc4U>M@zYG^jcw&7zl0gHCN%S%KjE&YbwJ4>n)#7oZu3ip!q*O;
z&UqZUk(u2Wc-(_4Q{sf-|Ex=gco{aCwe#~G4`wdCQ}o^9-E;P|+o>NU&XwxL$DTX6
z{zhc0@w<egSI;ferZ98g<gh>g=ioZ~8Oe{&Ph9aaLH<bh^^3>7Z45U&etme~w)}s8
z{@F|Vu8rU2E-63Zy!&M58@ojXZd+&_YP436GMe_*tiif{o$c4>I_rM49G<#vG5@u5
zp?rSRCgd(CXq>wL7GM1(wfR#+FIIidczEcR_z|7khYv58NX{sH@+3L3@`#_7cG=RI
z_sYzxP9N$nu$teVJZ0Sqd#mQIW&U}WA8Q_N|C=@6wz^C$iz9(I_k67R&V%0%1hw8t
zev~h0$CZ3~j#!I&Ufj7o3vb+u_#5X`Te|+JO2TukQ%~kjxcNEi_t{?eU%RW%X}z#u
z;=69KBH(ug!&TpCxw%%ZZBj3b&USlB-j$a(j6CJsew&kDLb&AQ+Dk7>ck(Q1pZ1`Z
zA<f(T%+G6&u2_8f@gix-37LI%B7DEy|8$66e3S9$Z)L@bwEl~ie#|L;<$ts8$hKRT
z7O&hmzwlkbkM=LSZ<V(v{IggcT~IQsG)MFu!>RJ_i3cwlUF>x&V~dg~h-ZJ^RF^lU
z<oQg_HFlhRCX-X|?~OPXe}>CP?X3rIy!~XuyRQx(nSJJ))x@WVxYNyTCbP_wZ)*N{
zroL}Yec<||HJ4_-mA!oB%<q?6*8Z<LjOra;2(Q`6)GnWYZZ0>2G;8gWcJmZnHqJHL
z_cVOg{CwFJ{%3!`$BUlN^X?|z4o}w36P3TUEc*G(<H8TvvUauiZ=H8{#Z9}zIbL@K
zpFY^~<<Z~l7eZCma+c1r&at-*X8IZXo7)H$sxQiAzL)T_wq^g36)bmW+}-!kHBYi?
zj@^zK{}=vW)VRCmcDZVrlh}scEep<QntL+ksMo63aeT~ME$Udi<dExZzui~My&g$d
zCQj`z_3l4?aF39P{z4N!-A}r2O71#^ecq5OSJ=!eyx)1ZQM~@g_8-f>I2^y^5Z)QP
zGSKD?`^F6khdbGSEn>55Jj(H`*6s9}yCHWqD-<r2tQ6a&ajI~EhyLl>;|WhECp_C=
z$MQ?@TddZPTgrdWJAR!QTqQo$X}?>zo#*5K`3-$*?y7IF-x$(U{)V;o!16MyZ=wp@
zD)WpA=dO)a{gSTDSzESi+pRviB|Ir=opa-VRxUB*t^3<`TXx38ilC3u<<*C?GNx`>
zJMYTP?=Gfm9%Se3-@5qjz2KSaCu@8Xo?iCe^MF40jmHfk)yhGRTeD>f<_ImWTQ;lf
zwaLjzFTbATj=r(WCxLTe`7VF64eqT%E7o37Sy6G=sZ!)xSk}9=YR9!4o3AEbkK1g0
zU3=!AZ;gL18ojt)(|x<Rx$d6m-#ZVPC(k*gcc~{(=sH8ciR8knXWD9im#QD}(p{`P
z$HBUMlCZaIhWuH<eIdmcv;?kOK3E<<!}j9Vb$<NIh4n6fdA={}$$>JBx4l304m?k}
z#q&1er}#v7hFYo9?zcXuU;K}DOxLl(Zl)4#1_rh}3=EQ}yMf^ypF+_2L2qkcSKSVq
z^q}6BHR_gZLoU}gW52Xn(yC>ry`p6A>-wKxbLJTP#04!9DjE!1)?CZDpB|q)KWFv1
zzd;O+o@I01XV-Q5Fg?Gr^XlI#D>n=8sr~xJzI^`E$vJ`PyW214Tzs<GX0_YF$*ESB
zr_1(t%ICag`Tg|Mrc?gsXFZtB&cC0x@7$&bm0{Dn6K2((=_;~puX3Ecw0QNK|G)PK
z{F&Xp`@{42=EJU&ML%qcnihKN$<w6l?69ey6+F{cr-i0^3Oy;VxX$u2DbQ?<$KI`~
z^QLb76E=VCtUVL<&pMsD&w}@omBplfyR+RE*{gKA`MY?m%UJGjJkqEYl)C6+#I~P%
z=B(>_<I83n`NutK&8EbH4=Woz8{<BdFKSv<xam~)%HJDeKIK{WKX<Lvn(w<gbz4K_
zyeE;m_s@SiYI1VH-mHmYomz#KJoBXP^Sd;r|MZ+1_JLu!i2MtuO%pBk{3gy{@$ljM
zX8*}OU-KpYOc9s-&)wXdFTa_~eU{IupGIpR99%8rpjK)X{P^6)jj2-)#&e2R#Vnny
zwsO<w(74pgPY%0A%@q<&idd$@STd{Tz*V8E{PBBit3JJn{Pg96@2AuE+g_R1)d%Wr
zQeNT0VD0(Zr|E{ixbH0eO<bqt^wLy$w7do9Citz&nPhgeMB-1=-ADQ2Pgiehi{GmC
zLut2!lGMp}*FRm~v_|-k?(Pk1PF>cTyV|w7(RkK%-X4#2XSCy3Hk66U9CiQy^_9ZS
z|ECZB({I<WlgnlOuyDdV-3L`^d$t;=*yX3Zync2y|8j!|k#$)~M_*U|Qmno!VUf_F
zB=$DIJ}P*Ue|zK!S8bOC)34rM)?{gLdS~#{bNyPUPEKEFr)(PfIFirwQc}05se3!O
z?3;sc_C-7Ve7tY6(Y;p}H4e?QJFCvCZ=-o>7vH@DGs3T`+-ASj@GxwDj7?)?XUNTi
z9n+7U|Mu;h{>`VZk-p3`c8MCzx0*3E^a8`-DGf}VnlsYRMq2hRoW{1%<M~aFw(pYy
zv!Z0K`<jO3Tee7X?_pikJTdink=B``5=Gxc-mibPY>vER`lhz3GLFrkJ@@^vWOj1u
zs$`3>z1C}Fl)j|l?IZ8q!8H<#8RTXOe}DJkTJSf$_w&}Qud{k$tgyyvwO!gtqug@~
z?s-OvJ&Uo`SKmHQr{SaMxoeTr{2X`G{PmuquXZ$RmTK^Xl*!B1eDVpOCfoLD(@W>L
zKbdh?-43h0{+3mKqKKKLQ|nXe&a7#x)qaZJ*wF8?UTZ?7>Y9SPt<G#>8}7~QPB;@_
z>3L^T?eyH7W<!Gq%M#A5UK77Pywa#yeEYl2P6~d>CSswJ=dp%Yo^QIbW&e?Q>9%_<
z2mh+B?SC-Q!Dn6M5%!q+8s#hQ!rm**q!<?b)-h>$ETE<<!=~tC^pCl_>Ay&5Sjqy8
zN8dkJ8ahTlGl}k)zv4mYP0fbJg{_Y_-V8qI)W51EQ2Y+pOC@!)>nBgDX1v{85^8d9
z)>YpqkuSk9C(9!JeH)cpzGdy*xM^i{M(aa??E>!_)TM*D*T;oVo_EI6llx8QyV9s9
z8`hL@W=Ax1ZvHdbHh0c48(!Am#`+0@yLOqRdsQ9!Y9zd(LeWS4lk8P-hy5wRo@<_o
zRA&SkGqbUFuVJ*=D_ya3gVuY7J0`0?2UkqLvRXCk#?33LEXyjkD`aSXuzsnd`XVn@
zF(s$8T=5B)Wkjd+gLC^HXvcC~F_2OecyZ3~;htGNO}ts(uTQ^qai{Cg=a-w$?wMHg
z&8_%|c+aAJU#@S;QruT_@f+8}E2m2yF)R-M7jh;{Nu{lM_vB3)4t(jsimQ3sYM9qP
zPSbjQ?9kC|mjAe9?>|4h<Kn9Y`;^$%Uzje${Q3fGL94a%u3e7nRyez4Pu<5G@$zj#
zWX_jo3#L5t4!+;^t2EoVd{J~==$)FiZ*F#o-`N|Okg;^Hc0^V7{wOu!WSN7rnoD*3
zN-k9XQO)J(UBDKeo!%7P;NTeK(B8l>S!%~M_X`rsH5ZhaSZWumX8$zdZMrM};JF=x
zhkw_bA2((k`gq~#yySOB?%un1&po{C!kneN#d`}*9L)S@7|kM{DLbWGM<e}>Y(0l<
z;yH=N#}~3^{OG7WvT^gZTb+K9zWqHPHwm&<a|Am}9JyR$#{7msOvl~o!ql`)^Vp7T
zn3`L`vN@M?>$w04gXJ$orMy3`Pu<s%<z_!o!$cy6pE=Ivv9(U=gfPiK$8X66vibRz
zxr^H8e=hsj;Cu4gwR88+H59V0FPxqhbnfOkq3iY%N1H??mK^jH^Eu5{wcAJ1nt5|V
z<utvp&xsSv8@6>XIH{K2UBkp(&AD`Y*`=eY1rtS&zFV{AS-``D|34>hpR5&c)_CtL
zSDXX)$7|;%OTD_{JK=2F3vs*V%+^x}*DLH|HhX;L<+SDpHon{ylNL#G+f-yPKey?@
zn#^fmU;O)<Y1w&xwuS!t`R2RtACy<v6l*u7%6xjS-_glG*31--KKXgN|9x9)k2ssk
zx(R!#z9;?X5ZlF7-n{zt`}z*H<L{4ud{O^*{{Nqk_w&5}Tl;?h{}2EE$#1{kzA*Of
zS;i|fTaVZ8|FkgH{>I<SGwO{0C4c!>yQgyPLHWaLbrp}zwr?&xrds*r&3s;qXR2qq
z*t2&g?h^j;MSa4=n*Yj<&opnCibWdzzM^+XCit%Fgjc5{i|&2c_TcH&w{uypyL?{p
z%fk0__z6GZ#x0-rD*a`#2)?J{$+E?ax#p_0zH)JKn#2KyDW{m1GF;lu?7Q#Wmt$`e
zOr;NmZ)D>Z_{txep>C1W6qDDrWXHzSKV@v3{g|h)8}HMYD01njrok?*FZ_2BT+5Ev
zPcdeev3q9HSCXF3di5adgo!OI1{2)g{?ppd|Ef8LbK<6BjA~maH~ZgAxvJnS-(UDu
zcUt=cH`&?cf?^T{>#b^<JD=Pwxah^WciZmMs?oCRrzw<fI+15%<DDI6EA#QutAiKx
zc7&XZi43wY?DE@jTq~1j`qVWpd$U)rGx6QNuIge?;ndxxVU^y2D$dJwY>K$DA5BdC
zDjfTzYJsQMfmJH;f+hiv&%HWvCoR>5H75DVTTP>d-A10l5+`0S=aJ!B{6cVnnSer8
zlk=Ase1TV;-#C0(H~nUd;pYb`@eN%~sSmHNR(G$T7$k2m?%><={Olpy1K#(hM+iJ9
zUEwP$Bcj#Du(q$oPNC%cCMMOV8C!LX{J2-he)wDTuRO=Q;>cs+)+2MKtzr7X_|@S{
zYx#Zs#`&jhw3j(X9$zuP&@%rj(<kWz|79<9|50JSwa1ZrS6Z~T^_kDpKknVIV$Ru5
zp7WR#>-&@cJ*+l7Y5(Aq%j(wOb>H^{x^i4_nx4$VC?fD@pH9$>P_wr^xq@4lJyptS
z;_v>Xv}3}mM_GaE7rgavU|XT0m)Ntwj`2*l%#UMSQ>QOVa1`==)A;1GG531Eb*i7{
zm|uANdcrKh#U?!K%UgwOmfkb`BUyBn``GG<m*N~Fl6w=5M^wq2KXo<fmDrK<OIWU^
zZ#=avMqrKT0v_F&e@`X6XJC|V-<`Dc(8f>|ZH7MKb3!*;*dG05pRiQ%qA}|p(W<$n
zrJ6FglW%eICG2&q4q4VDvR75eb%LHlJKNUg<gim*Oy-T58x9ndEpRE_B9p7YB>9^`
z@8NfA$wlSG5-Fjqf3GXrUo<*)E#S9bA!~EB#Suo=8~?f#8y6NOoUi2BBN3wJ@=2q{
z#n-k@&4Ri5hUR-y+s|&Q5-s1OBE%w;*1bxdXdWoR@ap_!|2Nm~9X|N+-Qhx>Nn1S*
z=5evF_}$9<LN|i#;(@p`s<&b^T$9Ast2V_bE#Q-6*m^u<ui{PL=gNU4+oF8F^=y3`
zI`i~I+kfW|EM1gp{dA`ZmvWTUEY0cjV&q>=SlIS)-SKn01w3b0hD|Y<Ds#w?L8JOg
z*ovBN#^?+4S{B*#KK!2{R+QO$=5uNB(-*t0*ZelPviYdF;>=Qo;|#yr{%}<&@EBJ}
zyqhk%S?I@!hn)Wxh3=pGV10&+UhxLriR+o2j|(hGsN1=R=iH^IpMriDN{Q_^@ytHp
zW>m)+mDSDB5;*U7GWSudqc<NV$4%unnbn@uz<ipU;hRRMjP=3uk{cE;dT{xOgz$z%
ztn#f#59x`{e-t=x-QNXb=dPbx!u4$7n)4fU)BeW(@%__~BxQa77{5L1B?aT!tQ;2A
zFPnsvn?zT7Cxq#|$?mGzbkWh|yX1AAmO9?%b$*{&Kg$-Z_wo%E%6%XC;%0t>K~Mfm
z!B1tk*2Jw}IZf+O(ATcZF;gdsD4b{V&~&<d^V5&QZr;d0u939|ESaq()3R8d_HyW*
z7F}^dUXr!pR!@`Iu{MdhW|;>ipDa7gFCbTX)^GOh2X2R5*Z!M!xYmU0`i8=5Pdp=i
z76(*y`-Lr6Xe;12lvxrqRlKz9|JRH2@BiKN`^9bd`v-Zp_$;>9TbE+wojg5B!ftEP
z$^$a08e&#FDN|&s*C=SP?OEukZS!Tvm!@{s>I2T#ef29MHn7_)-TsAX)m9nanT>Tl
zdvxa)Y+S(ls?yX`?5W9WWv@P^drIs2);L5ZzLQj&_j1a$({tus$xySr_aSn^^)sq{
zbqO~aHVesq61*CC*XXUTf8UWiKm2FBJbM4yYT<9*P4Ast?)K=&9$vgD!t~Dh`>P#4
z>+<htoW3ixg@=EK-l{g`c`l3C+l;mg|0($~|2)6j9WCagf+5$Y?5?=%xjCt3|4O~U
zi42>b@x^~({4e3+@K1d~Xgu42<*$0KudTll+nDw3$43RGl2;Ej(o9S8&p3rfE($up
zr`w>{VXwU0C2aEpC1%kJPd2O--f~qfUE{=oAZLZ+{KuATJkNF1w@T^{V@P?7$e{~|
z`j1L&f1ath=lKa0%V&A~ntvurF#Qeju#os6#!~0EO6RY`i{HEED{Q)`nE870wKq#D
z=UTSQI0XNaoBh`@FGz#inpeW@kWB2?cfU$sl<&K%@^H0i^DXuyl}n2Yc(@YhNxZNY
z2{m=x_|U?+xFk(xPxQjoYwQExi)CmkZ7SX}P0oJXv4c|&M9yJ8dn>~8*aL^CvIy?A
zO#yy+mt;2=bw4mZ=oz|ag(DB2?Z)k9j!(OvuG+|4?6kRlVf4HwdlHh|wdUnLu=0%%
z=5Q00FW(Rp8Z$L5&5A!@m2bAFWTQ??h2F8G#Z8^1K5iRzU9T*cS?Ow6b+zlj6qiXN
ztKBtT9lXCOVIt#e1{Lerg_GtM&zJh#py)l(V*2E(j+1x<?82|4&N!sHuE35xT5i|;
zRd3&DI>!i|;%ru$6_jvd(PYNW5_&hj$?Lf*@EWaEh$|9mbe!7|>bljlp)Tl(s(lxe
zv8>N&PGhGT#d5p>C6}AsPNs<*4T_3cGJWg13r5?vFAXm56I;2WW|E=$&#tq*oEkrv
zRTWg?&txz7dm`$I*!8n~YxsXMEr|T;>pvmK%|OCQ{KBPuOJo0N{4l6<UoPnXM)6CC
zc1Ie|x;_@!r=?Azvu#aG8FVJgRx8f3_DL+MzNW-f-lUVhOe;bCRKc#0-FqUhTfdt&
z>F(yIb1q+;7PoDCuc(lVrpe)+neh$F4lKJjY2&&zuXCpO`&!3E`p&Mnx^<8FY{%@{
ze51x19rgIS)U}>QR%%oE*X0)|yUBO<I2ky7O;ermkpEHsOu=*BtBR-mSzcLZ6y$4R
zaHY6Z&iK+i^9hq**vp(!-tuv`)oPde3KbrS{Yq9oGxn=EJX|PU^nA%0fn}?g@w}8O
zYPlDAiKBe?&X*=B*7twDnWW6LF=W%y(&vK5LQ+K+Z@DhC>q(v+zlO$wTAu@MwG#F1
zua9{1OgXenY|-J3+K2sTzSWfNQ2zaaEqGPIN|QsMEZJ{~KeuwwHWYI@vp2D}QLA8D
z(R|J-$I6<so@Som3dx}_)cLgz%~-7Ee{ufIL<P}RAC{-H89W!@e6KQ#TQi9DjC9`C
z2;~RtH9KR|cYQ0{v6{WaqNga~Bj1PntQ#f-ho*H2ZFKm)p-kkw#k5CqER_mYlb&~p
zRyK+L)Yg#GbDF(tNzREh?o&5&Cx!*opJ=r7ao?o9<LE*gpGT4p3N#wq))k(NXzWW)
zym2JNvD*DW$^YHE<)oHKS{-b!)9E;~(e1KS#-5jan;Tv}ox0Pi_|TV|+M8B9zIy1c
zrkL`wIkrExCr3}p)Jig5ynm+TzPy%p$>`(*oY52KBz>H)Q`3{}O?z5_+n?pq21!g}
zM|lI&S}tWwT>gPw<@pvi$zK5<FCPn8Jby{_t8Zm;31v|tPhBUSoql$yy3B{m=k|&U
z-Cmy&xUl()`DF1ZtDby?tuk)!beEjH;M}~peXWk|lK!pjJ-e$<8myTi5!mdW(WPe)
zyr^$0E7zsnd}p2}OB-CW<9>9q=;Z5;DU6q7Rwi%OoUFL4`}7He4cQ?QdEFK^XI7g@
zPIY;_@vwqP>ajml9GDJusa*;*NIa|l=MGEOm*qxf?WQ|)x$@ZM=Ul$?`WvssO52Y8
z)eJHXLK?1?iDgRySk+grV%l(K)^#7wxe1r9eXr^d{MwrGHHrJ;(+IgH7oENb694*q
z<pZTZ@YTF+U2rJdS!Tt>Znm^<$Boi=&p7soReZ-v&LV*;k4{QfRY?AOd1IH{C;vrV
z3b!_@ZkL^S_`7z-%*mmlM(YhrRBr97D$wP(mpYiTquo+7{HVy|jskCs9aR;!Jlk$h
zNU1(K#pmIseJm9RD~rFL-O4j5eZ|JN9Q9r+I@cY2@y^$AX7%R%{bss-ZFl^nb}d}W
zeEM$R>ej3o-_A#@ajZW7^L^lPrsCzZ8Kd8Pf4Mj2>${f+SI_60FRS8z@6VrWpXapi
z-n~fe)Rp6l-aIZ?!z}tD*Yz2P(QbupvMON)j9zJP65f{o61cr{qImAp4Tr+y7hh!0
zbi8K9bm7?YHHWvKUVN*}RLa`UOGT<U;e==QTE52K&p!`23$2)~-8q46&f2Vt2Q-D9
zg<QVKp5R~>i|$pt|7gF1NZ0~{e@@PkX;X{Jj*2aPRA`oc=hDo(PsO%P^VC~sUM)0f
zmR(!Gy3=zuPp*29%Y7xN<c;7boljB8_eAPhebXI&M{8O|dCd@1trP6OxU(?XA>C>5
z6TSHb+f%-L`*io>>T-9Fyzf3Dhq(Ir<5z^MaSERePCWU;a$alrjeDkx7*mUi|LfZS
z-={9#qSNO3O=O3r;)3OoXU|PsaD{j0mPd*nZB-?uZ$q|t27IvfTp-1`t1K*5{eM(S
zh|&CG&bLnX&;K|3)Td_4U31<>{M5+GUw)VO8hhNCKe2Wpf&DylZtb0v5W@4IY!9!H
z*-bf%XDW4O%Y1Iyt-V$nydrebRIk#NeqO0Z%@$ny@Nxe9J+=pm?fMT}FN^xKf>-~N
z?6u~GkC!KRxL*9)a)$d}!;FuQAIGu>?*6q!<JMc2h^OTVf0ZZH&-%1~rl$Y34d?eJ
zrPvj>MDIJe@Y_4PMSFHv)tZ;T-_?1`>;vN-Ym*mB@e7>AzvvYz+5X!b`C;{+^2}Z9
zKb=q9ti59Giz}V>N0Mqww^?@k{<(YmnZe&PX6+Yq@@7ZxY0nkD#MoFQy<11xnya8e
zSUdgh!<6Jaoz0W)RlV$wv#aHd;n*H-lKa%uFWGADCl0}~g1EgY%l(deTASBu)*0NX
zK7VY-rcJ4{w!bmk8q}tJy*=kB`+jfN<82KI!fQ>ArspwkleFeuIhj*oifvJ=;Zdfy
zJKKaS|M==0nGkWral4k{HjVt1-Ub@+n~g3;7hf={?Y))2?|WkB{gW5!?70Ld_AFcM
zKXLk`w(rG{`(_3Hk9}L3VsUfN#o5~Rd<x3>PogybUt8+L6q&!yxr#IAy5_`qKlv#k
zyLQ@f7;lVI6nRju-TLACg7ELNj;{~ccuYBDzT@U=3D;L$Gl`7ctz35EbNKS)&7WQN
zSIhqXc{=*VjifN8enmymHH-D`*=jzDaJeD8^Rj5G|11XgJ2N<!o4CJH(UuKh*8Xoe
zzw70(c}CB@Gx`z?1JmbUOxIvFxy;L(8T<a^!vLi_4kDghL9@2VWH}yV2)g;iY1)Lc
zZAX1p6g^i>bqHc<JbrQG_Ze<ybfgTW)l8W^78iV<@Y8mF+q;dTw<Y-uR#sbZY_~Wq
z!Ma(g+9~yp^2b?HS9yMwPmOPv(c=F&U&Nu<^Q@Uzq=e%AQls?`H>|bzp6h+*>$H=~
zky=;y{yok)@8@klf9pp7j8{6>Jh^tyb2>9^^4h)Ub~xyEl|-5?K3e@ipDATS?v_2e
zhXM~fKA%=B!0FrVy0hjyqe1vD{*8rp^>^F0tYCjoe)HItjpDxY4AZJFZfe}Wul8q>
zY>C~?BP!L>x2r0?oLl$!W&8Y9wLki79?xstbIq=C_sS0sHa0TG-_cH-5_ae2F|B_V
z2mh$^Nv_a5W@==^kn{Xdsw|&l1<QL=<?Z|&FASr-W?Lt&lzS)ery{6oMR?7N@+Gz9
zQ(j4J-GAvJ<3ZzRdtB3PzNvIv+-l)=<y5Jq8{3sx+gl<zzPySmPQH=DXC9lso^$Ix
zvnS_wU5it<x_0a3HQsA8x0iL7zI)2>+5BdO@E^l&$N5WEge9HXS^H49+g<*XkIm1Q
zP3+~#4nO~>*vC#?y_L^Mxm-GP)$4?NU-vE2>u0K)zCGrxX1?6bCp#sbYIcXcWP5T}
zdhdbYV=tchN|jHkc^EeJ@%!#=ub%wgyK%OkWs}^I{#$=NU6dYMXKs{r@5~OeEAIYZ
z;#((peM#}!vuE#2p0)DZ2fs_-XC`>1zl<!@_l|nLe##uSCAyQH_}!-+oHXHL_`TSc
zb?rX<S`05Ie{MP7n3mPE^8THbs!I7E6(-xcg(hutdd(0f^ZI~?t<TIwS$E$WOk?!8
zUv%N=p<v<a{tvAY^BTTQ@P3$hQ$=mt?e(AJEg~=1B;9Z@2>;gP`JI#h>Dr68KM7B6
z*meEfL5sIWo98%xTB^8M*0sdF!oQX8u=A}~Ykmq&oVK&>N3q;AbM{%MrYFo_btB@o
z9osRzl?{BG(k(AWDBRFEu=z}uqgzV+!iGe#S4LA<B+FF;g+CwM<(4&d(hs?wz1Quy
zJ~UkZCUG>6=LhGEt$qU6_WjB{V5@g!roQP#BQ2R<`wNP#cQszK^-Ik-&^J49+p;N!
z?EMcaqc5~gSC_Ouawz+Po$uughtASfo0`R3INcR`qjYO_zcaPGZzQo#dy3oH@Y6Q4
zcP)5&)-*IYo%ciN>gxG%tVL0py%T1I)pM>rCusVl!|jVjr__|NCE1hrB`|d@ebN(U
zvoBt#Fd{a%aASJQx41{`$1Eltx@)V}E7!vL`n}0XfgcYdYNXe5{@pOC#hCT+Mc=-!
zmmg?6J-=6>|JpyEqZfCu-Kthw*R@YNHtwXs|2?Y{?P`ACoo+VKDr!pkx6+#o<rTH@
z{Id`C%NqnHeRgQN_FDY9=8K{%o?P#<)0VEPfA+TM=8I#ypFG>M_P*ZqvwzwO*=OzF
zd^U7KL(%+WmCbYRi#C6W{B`Z+4Ks(I&SAGC<TR75?`-;GCS}jNATLKFqw522%*8VY
zoWyD$E?d2H)obHupYD6kxBbO)^1I(w#WNM>oHH?c-1BN(rS-(Tb<UwB2aJ9TM*cN>
zGiRRGw#P@O6qwz7^N;^rQ^hjgsovUUyH+}UnCw;EV}4XenfG+!VL9uQ-@jPA5!8>k
zwfW1EdpfyG@3uxPJDFsD%a!@O@ZJ4_TYYyWN|*LjPAxocQ#AcThWw8FwwE50KQSlo
z_Y=FkIdro4hP>0K^ObCkor_sq?gbYgH=pY#Y}k@>?7Aa!k)Nts_U0oujUPPknqBgw
z{cuXZVce@@#z&4n|GZ7+<0O-ivZFg5-Mm$~^g*1!G2gwByWFad?_dvn;2ZpO(T<QM
z1$NWfgCkFP7nl|ryMJo&&XV%oE;iro3hO!_=ISSBbk1u%$&}0Hd7u4UY5}iv^&82E
za=Y6x-;N1&FL~VNcjETEm8s5ZVr<{5I*u&RH7q!@L+(LncH8ta$Hw_{9~2zC%;{@j
z@lxq=c+-cPSCcM2{wL&rbvj#Cx8Qm)#RE@$Bc#(`UKaLoIGeg&(NfEYIpVrxT61sn
z{wd-&kM~%l?KoU~<@4DMk#(zr_9nZ;#3q#&cKbYibud52x#vE&>w)CRQvFRE4td|Y
z5vo?&aNVoImDR^tGCOOfdV7b}4deeJY9&1DZ+tZVTef`OW>ufy;GY@Nlb^2^Ugo=A
z`17jhH0Q9DCu?3=F28>7{=xhoi6yR!mlvurHfuF-M!B1=l{*nNdv4Ow{&QSWxA$gc
zy>d{Q-*>*`gG|~ai?4UDv@qtsy?FSEfNRUT9nUqltaS~1@?LgwR-XG(HQT$*m-zqJ
zIyRQ^re2jj-=xOBW&7M{)5wRnieI=zYR1b>*_c0h!OXbT+nrAAn<0MSPuc1>KNu4}
zY^>RQLT}P1mXA!Aw@BVKbeZU1x0W~R`aH&_8w^ulYTZdx;C5Z%xcg?+ZSLKjbB<(b
ztZ-SdRP}9yma)g}f5*@2MrD<=%+`)9F1y#ijl*^E{j_<f#B~3w%&loq;@PqzTFOJ+
zsdl@}jy2b$rEgzcs6X|S)kDKPeyP;6mp?Z?G%Pj!nX_3*b#lh>*&JTa)?^+Ika~HC
zWuI#^^W|m1E^4#hOx<~)`qgu}tyTE}%I6p&#BCov{y6JrR+2?W!5cPL#T2=l_mdyJ
zT@jM~ePZ*?8)_n7Z}mDZ{Qs)tbPr!u`g&LEPltDDwTaJEePL_S#b4o8Gw*umw{C}(
z+gA%m3S>Q6x}xpyl>2V`#P9L<_D27^FvoJ?BUjgLA0BUKt0<oFQ%$#Mg2|6#H-Dy@
z8kjTeacBC&exusOVg~<l&zVfG8`)Nv+nH`!xP#Ae%hu!n_&gN;#5LJow0s`c{ng8t
z-)r&f6;n&sbr^_6#ak(|Rj}|E2(pJw{ITfNY#pNwx0M4wo>TQJn_l7nD<#!dXzJS!
z(UT<-H_Y}qbGGR3set68!KKD}k;nJ%_22VA;#QFNqV=n;l(p{(ysDpcWqSF^?&!ET
zZcn|nU9b74O8&Q8`_8^cp5fVa1+CS;ceE<jXPi5j_uMz))=jO+ZTTUs_5Bl+?s6}D
z&l+mc@y`9?@0WXD)biA`+w=XCR^(^1|Hp5<=kI)-%PBKo^l^Pia+&Pa;2Fcv&Tx1A
zoTgRV#n;Wc`EGwZ^B#^8GufMU#&u7PgLvaNd90Dq+rPu9-+tov1KL}I?y~yF*Bt7r
zD~PaRX_RHYxWHqh&GF>;4GLVfN#9g9F>F<fIo_H6)Oym?%lk}9_y2ji$kTq~K4xLT
zyBzD*JX^UtEaJZ8R4=2Xza9Roi?;U2T@sa%OT1QbMCfh%zT(ESZ$gTWeK-}d_Vt6V
za>jig+CTP|ny}bc?OlFz$${4|3)#+v8`SJciqqM7b88sOjT`G02(~)AXC-!uEct(J
zbEU=WYqcNMLn9T<PQ05FTlC9zyVu=m8@cV@I8|=m<#$C@?^Dm*ZX0=v^7X487VioD
zI(7QY${y}7(~j)lwD&^=-~X~W6G!FmSrcocKAqP5nX51(Zq9nU&-)BR!f!5ql`Wn+
zXWpuX#v;AWEeW>4_6cVWFm!)XT77HHgucAhchaxFSa^6^@VrjDiobtm-g}?9(5*H%
zzWT75q9)gleL;WCIW#Zqt$Z(6GGYF^Y@sTXH1myDgQ8=eRHVL;ubbcV>CwHH7yoK|
z_wU&EetQyU(}e%hS%#<NBO3ebbnBFKr=GdILhruH-Ul4{lla~Cyx?ZdJ$Gx>xp^hw
z=9S8A61S>mv$ct53q4$*+wkLDRj^)DsY2>OyMW@tJ;n*snQu2dv1U8|_2i9L^UwR5
za-E!XaB67#fnb~9C)rEiZkXD%iYt1>omJ10WrW<!R3~rJxbbvtE#K<@qFHY~bH(Xt
zT>iMk`p?h)ncMTkUV2AY=L!Dgon-AC_4oNc-Ba5P<09QoxyVd0-O?~Ed0U#wEDp!Z
zX)cG?U74|bx{b?Mm23vzX6_%hxAv}oF1VgGx}0sc_^bmr1dhagII!u=%u6eG<raJJ
zga&>;w*K>sgR{=%e3a=j&Nn%Jy>@!u`k6P_c5bSw`8z{E?c0oZZ&~^G2J9~Vt@OrW
zqY9s&X85s1yXwA`wMTxhJ27jofV^_&lzF=sP2c_K1MAeY!T!tdHpE1!-xTeLDBd8p
z{K4sGZvtoh7Tz4Nfn!VLjf=_43>2>)&fyMddFXe$gs&#uMJd1b-P=hw#6|zCkqUa5
z_kF?bB^LXN<I?UV{Y|Z$b@zkpN3-Pe=ES9EMBhCPla}st(Qe$qa-hfUVZ-}P34Okd
zyrPFTzGgSst#r6(VgS#7wJX25Vycz}C6-3b6%w=FpJo|z$d0`^dV1XrtH|sd4b{Kq
zo@-z~CXnsjW^jS!{=D*}WUj5OvudwIoDDmjnC#6cIw$qPIkVu7tF;Sto31n*Iehkd
z<fH78gw&quhLgc>Vl}sTddqYi+;jVK;iJ~?yuLR+&gZ*pmV4mb6iLoWXSKh~(bV&r
z*1w?q&LJI>)qjsIx|z17rQ@6B!jpX|LGNZVJ>gl=TWVGC?TpIZb6OTt-fj-qeW0&W
zsP}a4m-UTSNBhs0f95ph*=HlNd4nk1S>uXcQ?8~zZWDI3y3dnMdB*WTe8=G*f!3a@
z-iVyo<@Ni0)q>=Ay=%Uvu2p<tS{C*7XZLEsyw`VkwS3qZw5#RgsV$Q)#h+eP%6+0H
zGwhVO?9?;U-BfdS#4QtEpZtn-<K4>}FE8%O%aY=HYBgJn`Qy?L-%56MzAfJ2rfp{P
z+GSP!$FFX>GPf5*u2TFxar$<T8?Ey`sQhT_jI{APd2Vy^k)(_42j@RMuq5Hyjg5;9
z-y8macQE5puoT;`o0Y!b&I*KnUODB}+anJ?)_3n|h%a6;J?6eb<HG1k4}Yz5xxLU=
zqAt^=X!DlNFL{~jmXqsp`NLP8pYo%y=z(U?rmc*;%&AkCtzNj!a9Mx+DS?Pi@i;pR
z=`A|@w7ae!<B+#2lWlDK&v#g4#byzv+^x)q4qb~dy=+`{rByYmeEVS@p6N?ZI=Ji-
zd$7ewZrRP_YdGHSEd9}AK3}%YJ^y^CtHA!&yl1WbK~@tY1h*%w4+u2&x$?tL{LqGg
z$G@#?J1o6@#BLmqek8|!l}WDiLE@kMPb@3ua-G!gzIZdu^Hsr$NXNYfeui0mDf6%X
zd3M{~@K64{+B=5Z&S?ZJ%l-0n(?^SFj`(efd!K%Idh2Q>M@#Q>y}Omg^528zPCZ;v
zk^3aL;i+2S_sVMr6Kcixo?U;txy1ZX9!Ft2d#sIZMd^n}FAsMAJ>0zg*Apf0ydD2-
z{vPOiZPr+MD|T*iO1twaow;#MkA5gBr(e2Tw!8ab^+Mm*=knffV7Aw5W=e7V8!zj2
z$YN$?X3Vqn6qN%T>vXzBOZM*KaqvEMQ*gS~h8DLCCpKxGKB=VS5j4?mg4FT+$s1pr
zpAt!Z<!{!xO;&UIG0xC^xmNFAUHSdoKK%YE_o@FMZ{D7=+PeIP%++}-g%?Y`2-2~3
z_xg6_^0MFIq3704(|Y^omG=^pY;QS7)mb}2ojUC}FYnpH85Q|zwvM9=@05FL7dR_#
zzO&&hf0jJyk%HkIm)TWQQw|6=JzCT%FM8B@l9Tn3l4t9swLg9;-jetDdB#?^kJ=)u
zcC{}OlN9K_xbA)OH-D9XPaW59+9de$F=K&J=KGrHrdKT`oJ;*SX-hU`mYUC7+tuV=
zD5d|a;@1rONC)nFdo6ih8T)MOH)MXaP4&wgHYGL7e_vi+Hn3>@w)TWZaqF(+&C$)9
zp58k7AY|{fji!1tqxYxU=@`uBi%*iZWo3JIGk8HB!-ol;-`Q5J5(rteypCseG}r96
zj1Q%iKi;ntZg>~Q<jj>+cC}e1AzIns-KxavOX32Vcl7N&eq;6P3(+-s3Mxi3u6}tg
znIXJd!7u+tS;xMuFTc3&@16FFQ;3z<xzgKaahgtb>HMdH3R1>919Nj~7t~c9%b&+)
zYW%<B507Yd_^;r9@#pehUFH0+>hXU2n}6@Wd}lBB=3iz{Tjiq1H-6a7y63w_&Bl68
z<<1{!jEBEHQ~4#gV6!=&y_xaK8Mmh%J2pkS{P`XurI&Z&I?ph^TYG2j?B$DI9cW&9
zc#>@T=Iz?MM0PLoG1=&?vF2ZdUh(0VZ*mf5=vj(g=q}sTy@iE=JJVNwQt$L_-}(51
zPfko`o56mL^?8lC|I_)#{pT;Pe17C$U!cQ|N6B|2-kh;WKPw&>H1D!h<!Wd3LT4pe
z!Ipbd-~0DOKJ2!N(U>$XBKQ$|^sJXXU*z;^Pi|Y{{!&GBL$&OaDc3y0X9(?d$;mro
zyLjTsm=}j<W<{5)9KRoUF8bWGO=SWHex(M9p8V1lD;9OS_JWn*g4HK}Jzc+7J!$<7
zuS?I{rxz|M3_C5vJ)_^9^}_X@@&}qVS2nM-<$3B*)?{`k#I}ohiSH?4wp&MB3ntlB
z9$3R~6t+QTQ-;A8PNNUox!+~^Z+ff6r~Ou?_Ud`wO_^CWcKc?(nZDiY{7%Mm|Bhvv
zz1QnpR`0#kx6f+lvs>CXYitzWPZbDR%V^zmulwoSuFT~ZvzW!!ByV#+7Lng4bDb|U
zqWWzS+uw$|xdl@ss;+;PDdSEH&?vok)gooP@xd+W2fL@AJkPGrchAPs%A+Az?(g;0
z%zGyBZN6(@`s>k}Da%*nm>Y3DjyL=*Gi}oE)mQiqv&}v-uQ@MQ<ow&~_j|G=XL8xK
zGKX25?l93`nHA>H9p5{1Q=O^0PRf%6;Xr5WIqo3^Jb{O!1-q0tOv;_*xZQnfR&eD`
zcbAZJYi}BfKU9uiv3+_P+rf;rSGIZH?sF-wR1sahY)TB*@!c77a!z$maHww9$&~+|
z&?&d?<JP$D_yZPI4OVp?>gUV<-m{x}IJkXVXk63TT={2F%O!UEMQ)h3;cW=3T&Gb#
zPvH4$Ctq4TofdWLm)zD_PjySTR@!A5-;S1?yL9P^;KnJ_9^^fImG$qUThQi>-?M$6
z9<#i3W0m;Tl-%bo%8|Ek>zFeB@KoA0bBe3v+Y`mbvn5tGdcT}+@itPd-)n-w7R}><
zvybfFU96elb2)0g)Axt`$vMf77}_2dCvcppI4WBu&0+2^`~JasyBgnDM<gphTHZc4
z<LrsKH#&b9=DH>;acWO|+G#vz>Jr)ILUX)qvi8qx33I&mDkjY=^zQ6^UhK8gPs(P#
zneuw!Z?*~3GGCXbHf%7v@%M^%nd{g8>;c})EFugH3>*we>$XQ-zT*DXSA>CKo;L%7
zGy?-eZfbFUUQ%ghPKrKkscv#^Vs@%tLFHAO?BK^1+wOnXHhH;r)81Sj+ug=nr|!DR
z&HVCZ$mIjACI0uhBd1T+=wv^B?iXW<=C|$dEvq6X$txPv><lsQ)SavRa!-HB5$mGT
z!cVpDP3By(SX_NrviEa=+@&q<eb)|_cz&<@!e{mVMB%1;OCBc8oGj08_ougK+LW4w
zkwTLt_bv|H6vrrYGIPVLl4qHll=j){e^Oey&;QU>E6-w~BZZULD`y;ubl>B(^3Svs
zy+7ZtIqoar{MUD=Gw1X)S2?#&n)lZnu5fJX={XWGPbTrhgu_Y+4f-e7bgc0H@m#gF
z^T_?C6&mq#{p*%rj<Mr?T&Ywz^@N(M#Mzilhg=V(Jcyp66BF@n)-i`AnI6WRlh)i^
zrSinG`j3zKrrKRxc`I{dSzk6i+rzIjYwJ&AEB@qJKPw+O7k66p6wg{0%(Y+jN2p=s
za?W%Af`!gz+`4d;Stw9G!hEl*7w3V~2mjZ|#_{?6Ilq5rN=2Eem6h#R|F-FGe(H3-
z<X8|Rbga&;_`hDqp~wm9zCY9*!`2;pC-CE^2lJD!l6%Xo-?+|+QITACM6`eY`=7$q
zGRJuS2JX@b$Z=V|P%80*!O|WFCI)en&(}SlY0vp{_wC-Q!^a%rJ{^Coa*laHRu}i<
z^>h8y=S-ex{_B2sWBs4Zf<KiN-?IC^rk#GW>1nX0yQ;U~(Kjk{p2=R_IYmUzC0yZl
zNcPj1@5@eRu|_HFWPhQY)zQG`^mw;{Z_+aFpk-IJ_og?eWPB;+T<*=?a?Zhx%hB~;
zfjGmSww~8q@jpzsHue0O)@J!v^~9l<t_FK~#lA@UPK=R1+;K~F<s7;8gYy;U>ispC
zc53qX6DppIHc57{Sjqbx(l}#oJLzfWO_5`faxN3?xeqG!+W2iz*wtqDcvG;<niZU7
z$J39*X9cq_oYBrbA=I$=-yOS;D_@*{Bj)!Yn<swV%)$?SUyn^z;6Gr)@F!ySpIs+J
zMb5ZNitw|`?k}5rYtj_g4VLn@8=5l>&g#Fk?>1O!Tx)wMMABKNp3yNhq9tZk;LgrV
z3jT+6o(o@IcChu==lruJXCkv}Q|I>CTkZN&YQSXd^2@6=x7#^FZ=>YRC9Opc?fvKX
z$H?@y?dS1tU;OX^*MoIy7gsPpYhUIh!gy{MQ&uf!oqyK*LpLhSD;Sbarq8%!9dTN>
zcjqIW&oy(ue)}$-xKBrI#kt?}56dj`{4RO-n|h$p&3IPHj8k^oStRofRo)2qUNc}a
z=bGES`0;u7{d|8O-Yj_Xzo^8tK{aC9)ym`b2PUp%zA#yG{-LvH7xFRmr)<(xo%}1?
zZo>KdKZ-@t+BsrW{S*Xd>NQt58c$MJiEooUxbBHvkCM?s6~?(c+0U}wZvRpI;e%m>
z(;+eEOG;{Nc0CL;YPfYCOyIw1eCn&@gr5O^4`Y`z&q?|0#P}`ncH`{Aywj<%F?@D>
z`xl!l-L<!stGE2c^X%vAr%xZ`Jekk8-tESxE%8AQiwd~j{AVk0U+mu=TlD4h)t@h~
zUp(+qL6G+m-@bm8+>_xOsyL4rD0<AlV$NiiCucX|x9S=zFD8|$eLj<uHmWebd?z01
z73MHg?|}bhmDAr?9JWRJPSTh&Nuwv<Gt6hY#H2UPNt5^P7j8NHKJNCZzf;&Q7EW9i
zEp~@>er-utcFDFymhGk!-z6HHY^w=WPpn$O++Li!XSJXkll$@|Eu{|L2cMf4Jr20=
zvT5zF4X;ZMG%(vO4?e=NSn*=q0|(wSJD5!Et*jr;3*V3`$`F~$W9jgy@`BR^R>5sC
zmRs#@AMI9G5v%@x<*3+<<2QeH@a$tgx=t&Xg*TTiE3w|DDd4z#Ox(P~RRI=`90&ZC
zC%l?e;;bUVvbcDbQv$mX!z2E~tp{1GPA^R7)Zla3&|=r{Q`vq)po-yx$@)ho{`$Dg
zzGsT;!-GEAxvv@59!{3*P*eQJ_t@ZjtwOFzxub*n>p0yCk-szB&lzz&beLh-#w?n{
zQutaSl;aIs+F5fYAwSJ6H&ef_VPMX%j<Ymu<y`(kQEmd~9|LKv9lw2*X9;M}(w`jp
zOf;J#apm6(-3XV{l38CX)c?+nK4ktcBK5-li5Fg-E#8o5)7vHab?FhudkPaxOl;eI
zD_k2J?BB9IPCk&sv?<)$$z9=#XhzLfnJ+e)k7l+c^V>Z?XWZcL=iX_=W;#QvRYIbm
z@|?IOcZ<xHZOZ(IdFA2~Ll!QvVx9ZeymMj<voq(3DF#kW4FL*=H1^ph&&m{N;?ML7
zd9$;XZ{lySzS%ZR_g3BA(W(2X?)N3rSAx$rUl2Y&S;Om{;oQS5Og^d>2Ae#)rW~Iv
z$L(=(y>c*z)wTzE9Li}2f0S&x=lkc<#i@dOH-1^lxNi20Hxs2D*!Mqa{$4F~>|6cE
z3PWw)<M&G&H_9I0C?hJdPnjp5t&vB^<U#TNrL%d8*t+gn9!@#IwoZXJ@(R;`CXe&t
zrok)=zA+22Nm{ULpO;$~$ZB}*bkH}(Ro(IjWd6($zhF^j(s}SK(~$$uD>RD3|D~iY
z+IDoZ&DOBPYa)DPVtICLET7-H$4~QmRe0ty!_GG^C6{^&h%i47+}Nif{>e+kcG}N4
zfB)w#Ss$(>d#9zZ;Et}z?C-sL!^U0Ygthf0XXCj&Qhj{K3vWLCar@xuJS}g7l$|D9
z&s>_x#&$Ao4+9&E>y+=hYDq6+c^M{L+*kVG@0ZQx0h!w7?!T_y75ZSxCGT;E?NXCy
zUH9Y)e;ZrP#A1s$RiUh%`hpyD|BD8nXmPl|`IFx%MUnd#xxB11qoQke*hxq~6O>-p
z`e=e(OW~JBzwSBK*WIc!^S(E%tr4l1Kf~y_OQJ%?ZLis!j?DMJFbl7^cuet5XT=>m
zqt{IOh9wIRp4lw5tUJp7Uf$L1XFk1EYvJrr*_z2<QM`WZOQv}F`B`Cp+!qCA-aZ!B
z%n@U^&R0}&vV24J(gQ}9wwE6{X!Ccgr|TU#)>78pInfgTH{0smoBj5x;#>LoHg_5u
zU5wqs+1_a_{jZ}Tkja)S#=`MZ>%`kz9(kv?$Q(~mF^}h|aZH}Y<XXF~bl<TxVlkoG
z9T{=YnP)lKo&B+Jk$Fkw+GE#s>~7C{XdU8g$D`76^GE3`IsftrVI><*apz8sc=2+R
z#8Jol+<H}8BlFk1WiU{je&yQb9)}Nn3*wIND!P91!L)!E+Y<%iIq&OLi~1`R-E35s
zxc}yu@QasHn{RnVz4+_yp*^QqxHj^#w4h{EyzA|tx+&e-;o5yBQex}ZHXhw^e%->J
zWAiRP$}(GgX!Em@HuoFWXMP08-n<c(>fQJ}b6ayE_YwR0k9Au_R)3Ls$9t{wIK$hI
z%QsHEu!&J=+v@UL?1|2^7!MTR7J57T{*JdcX4c$#Cq5t8S9v2nJJbKNUF*Zsa@m=)
zM9-w{D~!?j{3^=XcIP$&pQEz(Oy-<?>hYm%nHWowaR9r>dMSn`)2f(lk&<pxUdCEJ
ztO~Yfx|5LGq<7!E!B1Ig$tL@118dur0x`GK1@=syw_{3V;iiL2mOo_iH#X6_Ak>$#
zrn^A(&6SqBB6D7AO)6a6HpAhbl9!sJihT4Z<J5ld9lIiS?)ZJuD9q+uQ4~)cZ(jOk
z-6<aDLzgU-$oEduo)sPJ|7qX-ntAKq{5cnrc}aZYx$P+%cP9tB$DLYd_NC_LJcpz5
zuZ(Uxn5({S+E=scb<Cu${=&ZxmzqpgJCwTYuWCuqgxoKJwq?t>&pqJ3?85h}NHEK&
z!Kr0Q-ACbv2H&1`^Y0E?BUvf@RH|xU$@Z0BD(gFDB`NK4+UIsEEAJui$(71?olbAM
z?d^Ln`eK0Z0;Or^U00qF-{*Me+Z@eje%qydY~|%oO7Itc?7TU3m7d^jPwV;2;xBmu
zYIzp*Wcg-JN|<%T*}cZr=6403e#pt`Cjwn&R6mf7s4_^HH$QV@ng4yKyQ+(>BxrwG
zAr~_9_RI<i|G%8qZca)6vuItbY~-mQ&vw?Oy-3d0mC;CEmOEFAW2)8E#>Ah?wyqXw
zvg*hQT<|MV;Q5aF=`EYL&TsuciBq}veO1*)kz}5LxR0(92SlFoRUH-z=1Sq;v*}>8
zT4da7{=1?4ci1+3kYKFLd$S>Ng8J{7jrYV{UYB-ena9+u-?T<CNp;36fm1@N_7x6A
zJ;(1He}8}V!_O_X`bAz73Qpc})0$*&J+DqdS;>d<Y3Dkz_uZ$G4702gO0#kjxvpl#
zNg3@cSSQWD@?3A@Ck@>dVKZ78CL0{vBUe~0@S*Xs$7ENjHB-{kBaA10pINwKv-g7u
zocWJ8+*vn8H#_Erj%Lv}&W}<)3sR1|GF`iQzR7Z{_nnLnM`q4_JK_72TepPO8LM}k
zZjhe0h%fVf_@7#_WBb{!Nu0R-`*g(okGCEh&r&n)`n{2z_xJh__vb|$Xg{$1;^$m-
z{2Wgu<0`3j>S5(PJAU<BJyYMf=b!Tb8llrE=Rf>RF@3i)Yz50=pXm-Wr#SJn9<AS2
zD*V}K`svS~1$XXzdF%TB7k&4w?@G&sKaP;wal9bc+SJXkMECU8t{L--)O<LC3;u`b
zNW>oSyPSGgze#4fPFMe4?l6@Z`nhI1wtGxY%B?Su+RomxUXb<7ABivLRf8&KK8sXd
z@NEB#itSxBS2yO{+E-sIG?85zc~#0+@X+q3fs)FzR{I^R`zIKirmVMkK``6irxT<1
zhUK5`l$!QGgzKNo^2!jMzDdnX7ya1SZ<6z_E}U<_=%OI)v-ehae6Wn#uXJtGwyW2p
z&U9Sky1mtD9+$M^mM3LSy@#WEm!C7>J(98{vU62w@|5tkO$<@()}e8c7jpys7VqYN
zrXBa>`@U&r40jo>r{7(<HecMy{iyl=O$=-QTr*m`t|7<9vSlTM!^@^EpK?WG6Mpa&
z`5cY2{cwuiIA{8FmYnY7jau!IUu&!G^}n|_d3Ry9w&|LQExNMG>+WYZO_^eNV6A)K
zgOjTk1{@bE+1mHvNbl9=FoBRB)daz<n;O#d3?rYnZgRTvU5@u;wb0csi8)v2G|RMK
zy`Hkouvgsk;+-T`(@T*?jS2TA$^JiPKCSXk^vs1TopybA`D}sP^jQy5E{n+aoxfqa
zU2ftjf41B`vnrBv^5*@OR(*b_$JxN<nD1+^X@!5@F8-feP-$vo-y9KhW~<P);`6np
zfA$}=EU}ZH_d{Gvd;g}=w^x%tz1mdL9m`i;Qu*hk{Jgn5dTbwF=df6;R`c>^3Mo+h
zY3>~ncIfSzgXPy1cG=urb@laaj=o(-0%ipoEaQ~v`MSsK)wkR)f_cri7Ej8S*&<u4
z#;5Y%>3ody!wNA4!&NCO%8Wuc|1tBqs(SrH^_r!gm!~M{E^)tPBk0oj;ezl~PuF#}
zrq{x|&AQ6Dj+8Hvy0tA%I#zm9lBMvO&c;n!xhgmu8*3Auu9;?(zdE(f@3z3N#cg-j
z1a3c-oi2B;%Q5W6949~SN8fAxy02aPHYxpV*fQzMMt9o<YLdPwxE&YaK2*qY@3+{8
zjQ9BuzBB9G==ZfamcPJajrgsEnFn=}sy}9Zn<8lubj$L{<p{>hdE)((m1Y?xcQe08
z{oh}+%is2sNBxO;T3Rd@=T&-5yTn?1!C37t!|n97O6As9cx<bzVno9}8}3|f@lfKd
zR-FllU=icaHN_`a9^8E-zBRIKXVCo(`b>(iww+z}yz5`lG%x8bOIJVb=Czh?+`{Md
z{!dM->G?;TlMcVzzdKc4RVXTdddd6UxrZ44`doS-J&(6w;e+B!{falQdU1qZn=PtR
zzw|?<vQ_DB?T$z7#TyEX!%XL&_6$pipSLIH{=BS{W+uOz&D*xcoi8f$;+xSE?HhWk
z?61`H=>0hvn_p#Yo*gW^i*v76>!JkHnXFG3jhaH<y$;y3S|pd_M%c0jvDF2^hL4(8
ztV`S)BY5Imb8|JTJV)!D-rqCY443awJ1z0~;je@{ZF3Z>D{6(d*)F|RxA~>$&ye3s
z?Y&o@ur$=+e!RcqM#!WFqr@fbZc8sktzvL{u}tmN3!a%DK6Fi=@A$xSYThn6p-*9g
zf4UhOZKr1R{&g-pV|<WdS<d$dmYrN;LQhW5J$4~lvUNkC^m0p9o!M_&&NknF@$CL{
zo#YEn4{~@nZn`TVaQf@akL!7Awq|+du04O`>QkX7Ij@W_XRNq%Fm{s5-rxVHyIhQU
zq<3=B#5{>=mR&z{gZba6@@(*w4()uBx@N~AeWR@Rk9Z}_zSM-WE0`~T_0c3^L&~XL
zUn?(9nZD|m;ST%B>yoBM2eaq4H^y`SX_k2wQNnk9=jq=$5A{|w=NE-nXPusRnCHM7
zu8h{;(j#p*PISKH_|h$RV=_bj&AX!WQk_?cFa_R-?eG4)`eC`#`wX6Yy?@v|6N=_f
zebBqH{&LycIYC~^X|JBFS>;{4N8xbuvkwP5rYdeqHy19oVmy9BZA0$g!^dXNJy-wu
zuHWzH`wxk~-y3>7capEt+Bl!9i$XuYOJhFf*7D}ENA8#1vn0N3%D=j4^Rhb|N~G3p
zTB*x9{RC^}gVz#n2b1r-4e!rduyoURLG_nih3=Lb55zUD%cj2E5PLWMdbVt<>T;Wp
z>8w86WF8;YteLGZAzc(xS)mu6KX23Vo(2z&gtD*B=B2Ma^v_>87ydKwD|=bU*<ZHd
zrN3u+n@3$){r}>GWeNUrkDSijjhVJG_Re)bzPev4-#$5TN5#mCOY2}o^pUe?7F`UU
zXC2dj_WKR{Ir&mbA0=7$HO_805qfUh+GhQ{6JK@9_Qw2Em8kpZ+`KCGYv7l<(36|j
z-+yMht|~PD&919mH#Zjk(Yg>D-eG$!ui0U7)!n%BH|i`ez2f?zH*=Fcb4z`G!_6)m
z#`qmeG|!jqJ|?s4mKei|xgF-N2fc3=Ro@rB{KZdb>xo}(%YEF|%!>;9xlT!H+A6;l
zlNUt!Ctg^4-RlC^j0s-68?@#>UD$bZiJ8;WsV`S;ovC{3t#|YUKGx$$*NSv}s=VuY
zf0FdcSr#9>{U(3CW?cAq(zc55z0><@=d8WvqiLp@+jK|&g7?+4cbS9BRr<^|GPBGQ
zwm$kY?Nf1t*8c0l&lFQW{9m-_&GI<iC0ES~p9pOX`+OvE?zwsf)KN(5fK>--`571_
zJQ*0IaEwBhrX=bWR6dP~F221(wC?-*18V##*^<|e?s{hxeZ8>E_-2Z6Z2E55$i)ji
zZzMTS)Y9K}+2>#NdBzGxkAP)4zSeVJDK2t&aCoQu1BP?npKc$&UN7_ak)=+@&5O~~
zSv$)gZ_IEzXSQu~l6&nf+X~NfhtEzwu{&0E$^EyzC!cmr{I0{t{AiQ)v-a7hJ<6P$
zud}n82kuZi{nU5X62WM_&h7VF0-fF{a0pv}JfvV}apIQJG<(%}v$z89H#1_=IHs&C
zWV*lmoM4SU+pT>iCuF;m4n$f#tV(8fyCz>>Ww&Rs->X|cR}@#+oxk_QcCSL>MYW_4
z`mHl>3Q3gODKp+&z@K<P@1d)o_r-JX^yP#EM1B6-l?2Z(?f6kAeW!(8>QA<H+Ru#7
z4F{gv@Ce=Jj%X2nuz{~q`p(UL&*!;r*W@yKH=+D{S&4QWo8o`QUXN9~|E&3QtL5XQ
z|8^T3)|fw;6!-7%<D;McJn#Noo^Suh<Z*D(rk0NBI?L_PopiFgbA8@qnJII*`&i5O
zH$I#3CG45O`=8r#vR-JOZVIkUcTe&=zWwoxIj-kk_2%C{)|9we;fzqugX63U>WS}o
zEdG`@KTG-j+4~pwjbk=`i;g-m%v<W&QSe0MS1s29>3wenwmv`jy8CqZ=hNNSPnXxv
zo@zAzx$^~{D~8+*I=^PR`So5@O!Hl@CY95Ez+!c9gosUASxuGXQl2Sl74F8Oo6KIj
zvHdAtcdxGEv$jA$)SS#Y^;NZOo26r|-dxhNS?W0F#&x^X4_hzf9Z=qTz<ZjvaoRuM
zc8;xQQr3C~^<C!e_URUDUh_$mhyA)w*h1;cC6AjDXT*1J|53T|ThmhM$_L9%p9zgW
zv#D^axol}h!E=j*^XIZEo7)&3f6~;>mpblxrflN>np3}K7rof-V^@E!cFlyaxfgu$
z466?HNKA^C(9)gCf9PD1^r^LV8%sMr6v(t3n=kz?@<VFk#Kqwm0ZW%HQ14!3z_fXV
zo8aXY#g5l9=S-Mddz_<s!`vhPoemgqx(NFJ5MuiD@PM-A9k<kvhB-}P9(so_{C}fb
zS>a}-_#ohuINKkCNo#Vxu;~}fcya&r#k}Qzbxw9^evXkeJUD^>3-jh9ED83dh8^`k
z{{Fe6WRdR1Rean3F{|F~4GhAH9PR9eY@HKY4C-BctP4D+3i(8v?Tl}Iu=2`@94>o-
z{#vmaD}1|a%Dt*sL|8K?R4A}*P!V9Qw|uYXGG~USiQ6`IM&s)RoZT<i2E5QbDR4?)
zWk$`(#f&AhwQt1pN*-m%-EZ~Qaoux6mLmoHMI7&wYYgA?zx3p9?s?DpvN=QQQsDG&
zY{#~rd%VHc>f)h8C5yRoruQAtYST?Tz9qc<ZSRW(PPzFW{tYdK*%7>38E#)az?boT
ziRv2<Z{02Y+8bi4m{hh*ee2<!+y9N-^u|Gv$_#evD*@F;vJ20p-kAJy!nfsbL(Q%P
zbZ<~N`uxDW3y!j7ciNY%IMlbh<WjzVi||~5V|!OwE4&d1xt7nnT9E0$w^tj~tpltt
z9PDc=F$zswxN>{5>X*!TX70<OI*d$*7Tmv=_uJ~`qVM4=?}~=0vxHRhZrk5H{cFh;
zKKGKKz?%geSGFCyGJ$JGvnTK7`_s;?J15w-SL*kMsFtvf{ke&zW(*AKp+T%U(c9l<
zE#>lB6KpN9b*Wf}sM`8N^R6WN@5(sx*1$0~R&GV=nR_jMS4G-<n=`$A&Mdeqm9~D?
zem?_cpIZrj7gz7_6FGCR#Ob%zT;`6Q&0(B^hU$}N&0-6V5S??y;P=`R6V^h%HYuMA
z7q>KV?%96i&83ek`Ya_cCAOYB$@wdn+b6>0K+}>wOS#6Gt7kk;^u8xJnR{K6<*ZAM
zv(~aLF7)2pZy1|hA<y?>#iH+t@@H3zs##2Od%wX<a%G)~g=A>S77g*$Q~w^<G`#en
zSl}MJ+r_7BVMq1ecx=@UFZJZne&zM`_!Q0e0_E#AZCbHr<yMuQU#6+5-M<wmcBe8>
z;(=Jly2OY4*1u+~J7lr&<8+I}Y`fNk+Qh31)+bK>xidxX+ttjFr`orRSACV9JURC6
z)1=tO{Qpn1rd?Is(0asi`Hu7n7mu9VDCn(K9&t2m`=z&@zwgxSubP=x6E?*^Wzo-n
zX$!@IXMOx6Td-8=$oBn0PAhLs;(Wud^|boG>U{y`m)>9ZYHDR9iFscOGu)&#)qW+%
zv^@_`ZQ+T38!}s5>D!W6&Ub>W&u!;NpT04D)_-%8ySEo*iY$EIQ4|rG^*GSMp+l*I
zQ)ZEw^iC%?CAY_4ZkarLqP4SYUDLVm-OfFm?;p0;dh6lrBUqJuD7*WZ^nLFikHdC-
zDtam;apcr7BmJ4P&-tvKe99`;WHRr=2(45LQSWsj#w>S>+r3h*xLC(~sGe3^%Junb
zbn@IkvTHW>`gXniVNy9Ya&DqpXqJ(bN$9Mu7hL~uDjoE?t1j>SdC#Qp$#rL<dUZIT
zZaRACi;v#i;#sPn^{Wo<UelF(u2uZ1@4ammN!txKiZd^r5-D<gQ@B{AYZc4u><Gnf
zMaAjsSBUS9`_q4cTj=xZ!e_r<h$}2LO{u7Gn$(+r>s91ljVy_ZD$)EIk3SZvFR3s&
zZjxlU(xEtuWtYaBTeEpLH>%H<=lQT{{<4x^vS$)ATf=OcRWn!$x>TL6#N7;x@<@$i
zHaO(){OLz#_RCw3#muPqp-|AeY1@&;JD*A}pOg3M6+3(5Q-ki=vIP>g>+Z-rs1MqH
zb;Z(kj@(a6xePrW-yZuc9KrKR(e=E}l9j#2mTO8n<UgrgQq=ah{4127EUoeIXHE8^
z%8!p+KmKV8R`R-Oq4_;CiA|A(V>;`%Sw|1G$2ab7{~nWMf8b450{52J2D~vRw%$0M
zs^{W){vd1V#fLtD><L9GY({r}Y-3(l@?Ldy6aT6SG4Dhz&SvcDT5-Y3+xT%<7f+>Q
z=#r~<S@x}bFL1%s`J89z_QcNx`F|27IKNnQGv>i@&SsV}4xjdJAM?litXv;Vz0Q!+
zy<^U4kM{GsKNz<y@QkQ>({@heuTp_!<5pLX!xATNecjD{Gu~+Nx><EIqn|3@KeT9S
z%9<UWv$~3#Qg{Csd8`@uRz&@L|4%{xCUyNzDOW3-@@11=Y*d%C(EQ7hzU^R3{G|Px
z&R8aK*j8*SIh^?C!?ofE?N@~DSF7ASvib4j=z{()QtK^c_J0<#3AVPY&#zBAe!Z@u
zcF(rNaw*yFtu-}&*vj6VxNFEElM$7cQp_2g&U<)C<c;RTW}Nm5n^%<2y~h<E5?b_&
ziRlHmkLLHpFOqkz_FZ^<@~b$fW@k>}#79;v3>;Dd@d5KRB?4JKroL4*WR(2><>O?n
zh$zc@k5rqUzEz7|6*y<Xa_RhtE#C}g>}U4e#4-QgZT{~(N`IJ6avZ9^Wn6Ue{r8ZN
z_TzQ3I*Yn~S=M~ClAjl%qw+t)Ew<A8TqLh}K;^5upEBLP9!?8kUVX>kX=`n~_SG(y
zUsjG9D~kN?$4xS<JHTvuH>zy*gM?fAHlEhmleBd1vWwIBCZ;DkwNHOzw#j>P)BTP4
z-fdG$GmO?B_wDg-^Ev7E^@Y3s=V?XrudrU4ckXci^!l9C?Q^BvCoQ$R+E8)v3+Jl8
z8OQt1iq}5Mw6_vrU&ki*JS=3V?AD84SFQN7dduYWnFqd{RAZR(<|NCpYC}d|bzPqa
z-!J&@kp7=|zjA`6*!iHpJ0=OwTV7Ono?#zXtofq7I$?}?FOHb(_#AWonK$E{=QAGP
z-<Ui>FyF%K$gF1?O>gp#zu^#T*`RS?w=RFl)HQ#nX9_s`@hL}y%icAZEgZJIKATVK
zO7VrwKBD|b=4GsYytj4r$+(=*<6hj!dwmLz|H+Y-&ARmU+_II-HzODCP0uL#A%9t8
zi&4aRwGEGpWg;%C)i8Hzf0Dj^a@x`K?1%$KF@L#s{nbCx_qas&Sm*BaPm_La|8Afk
z|Lf7^jt$mg3_&yQtvhu){|IlSj0ES&n!qn>b#DAPaync8fwsw$w1sasddivDMn$f6
z^VMAw+VN!OHLHtydgWWL9e0d6=0C;dG{dV+zDEl9zxVvGG}$&Y)%xqg$zSKaNKx3n
z*YakDd}8onudAF!hur&b&3z)aB=O9<V^+74f7P?R<t#I(+$7ucEsg#0-y4p-Q^gox
zhM$<XW5F-gJ;@P)N1o4jUSnfZe$sy7pRiLQIyaUrz5V7O$1x5~-wP4NH*PBY>V38$
zv^}`sknM{N@%~!<E)Uh&<C5kr4?NOzq$=pbdwca4!k?Lfswdt0*MF^#Ga(|<!QTIN
z^YYBu`l0fd&8|(}esx0j(Tc(iixRF>&+Rgv8JYTS<GD_iH@OoXte9IhO@-5z+i#w$
zp2H>3f9`~;;q6mOJUU%>cFo#X5-{hxaJ}1=l79hD7g)5d`nE=1)I7;#?t4-8%Bsh!
zonP=DxH4bY@8$N|ZNKl?9gwcgl7Ha4&CLE)=({;DzkZkDo~Ez5LhIt6R<CU3K<lWf
zN&A})WD7lOuGtW?m5+PwBgbwgZ<nWYJZvR&ejnUa;JyD3Lt$t8g8sQmr#`>>ud?x)
z_3XW_`Pa{ym9bh*Va@A#ZoKSZxMG;;l$7LGX@Ny52hXOvS8yvHj=J*6@5l?^SHH8Z
z3lol2e$Uutv1iw!KL_{hGP*i#wf5;>7hg>IFpFdA>D9p}m|Ej|B1)df>#m9I{vP_e
z?dHLYYcdR;xBX~l{PAk$hYU%J|A#K^-dGi3@c8k^4Jj7`cWssEZ|DB`<Kw!=-fTWk
zuV}T;?2h+Uc-47~$FZ&C!n}?@D|DAP^}p|0yl9^b%m1q^lde8X^?P!tit$i=E_>h=
z!&|Phi>%hnVAlT_cC7oD+JrTmbc&7cwRWs|wY*RMRmY7*m)A%HH-&sV%d}>bVII?C
z>6JlR9v4%@wRO!Bj5GgiIVYH(!*sGNZ&SoFtGhnZC7*laU+F1%w$FHUe&@&d)2oi|
zwCPId<llYevCrY9i=`h=-f=<iRn;e5@lTA+Z?8AC<=>Z_w(LcKPi;liguvzNHCLsd
z{;ae<W2vU=v81*vc~wiXEeDF7=jl$~I&0y>si~Q59WS>!Ul3D0`N3QH4_E7~Y2Bw)
z3Ja%3maI_CGfht}TBrJuZ~xO0b-jDjG}oz#EuQp9=ksyNCwsG2&-tlSCEfZ`&FppB
zwzqZ{zlE;OD__1lead^MS>?6;_v~-k)k!OwdIcQ$HD&HhrL*hmXR;lAke{(laOSKZ
z-yh#qef&^#+Tv)j2LW&Tgy%gAPqbJr^Lv7XY>id#^*y4yb-x@Cef`+jq%SLO{g$*k
z^*oDDb~7uFtj~J*Z2$A{+q}K||L*^G^qSjup61p2BCj--iiOLE^_*TOInAWB#DJZ>
z;;O*^<wE>HpZCvL`TM-@hkXk7){2WiX}MwaW0R$HrtBYS)J}U_!@?g`tPBi20yvir
zrQ{^$rRx<`9u3dUzilS)?_K=CMH(8Vn<lXR4PY_YFx|wV!BqD`ne+rUCf&I?W|K4~
zgaoZWQGZ|dYtpGnd*5B=P$}#yKmPpQ`SUlA^G~nWt)H$L!Zz)?WJuUEp)ahzmx{d<
zoA&(U%}18MeXm;Unn#~LcRp@!;{0s~?llIAo_@f{6*^txxK2k=<C*!}E^UYrI}j8a
zsi=KehbtvPajQ@(*Vc)er>CZUINP+&rE$7x$d4+m#vQG$woc5yYxZ6V;NXtjb7HGj
z<fJFPxh5){lT+7jNnNyRis+IXI%2YKwUb`kYpYma+%dhPdwm!i>%En0G!>HG-hZtX
zF8lmIl+v|%W`}OvjsLdgu1xqG)7OogBmHNlwtl-VWxM$LA&2wX<)$f~Ykicy9Q$%c
zwQ|pd=41R^S5@7fq%hvy`*)g?Z(m1*A}?Ff_J}2|25qroi*9WRV`IP8F3#O{{G)0|
zxvuuMB=c2F?$f7kadEpfRf9)I=IgI#uWW<9)p1w2`G4s6xcSG|**|*Pb<^1_kDbZ%
zWMX!eGd%y|U7^*om5%I*HU__Qs`aik^lgZqI&;TL<1;-EeiwMR=PzLDEpeI~AoZy`
zET>42x5?k`*1acu>kd9);$Ly5w)~j#@x(`ypBt!eE<B)~Gh=h#*CdvE4`rGPVh+E(
zdDr8e#)7Hqiv$>Xo}6s&UlILBTzyW}fxqo<Rrlu0zK!{_Kib9c<B?;({=J>oCwA$8
zqb}Q@PoLNOnS}dJJzAUi$42kdx`t(*r!<+j{ubr4w0iid*feR0LDKjBFXeM~wjBQM
zI{&rtzR#}~@SZ==lxsU(`pYZFr=g3MBrOjA%TjAK#V0FqyT&>npZSm0dxbSlt}1Qk
zWtrczvhni;_j|^N&2w_qKA5y7f9MyQ8l3&5QmM^!iBV*3*q)6)Kk@R<H1L`Dep%s`
zDs$C79rc>Rg)U+iq7Pf7WB%NfUzG7+?KQ9S+Dm>4CC|}v5&NLsxXUO_RQc-LD<WYD
z$5ZA7v$?8Fzj9V;_Fu85g4cA<A6OE#>&)V`m@Sj%zF+K^EMDtt#s5V8r(ez#gA=!&
zO?sUj&&T`mM$~^FU)k9|)!jTy#Xeg8iV~G<wRhQ*Vsw>TPyTySvvkXfeFdkl9k7}+
z;isHJ^1DRwjqIO3%Vp^3PEq4fS5q{OUTbiCkLKCs6?3hc`QARuc)%fex={4s%bi7w
z3#7hW`x9OBq;J*Z%tH<pA2XS5*%{6k<p`0wGkeX7AdUcqPh!0Vacz8}3U)nAH{5fa
z{<8&7`Frr9)I<Ht+pnmIx?cQxbiw&0rltx(CFL=Khg@TyT;Kfo#tWN<Wk(M;-w5<u
z@J8;1YkK?XJ0Ft@Uw?SKdd_^2*?be_L+>n<K6x%%dU=O8)A|L^qs8l=*x%bPqgi()
zg0b;+P-O76+WkwOc9;FRnjMsp(J!Vpb(42SJ@=={3uX1*hBUrPbQSz?N#L^ZY00xU
z^OrQ5tH&+~4xM(xwrRrOCz^-mfB5$1QO*5%1{0-XH(KS{FF5;P%W;eUDY6wDd%q@@
z`QLueT_X5AqcSLa>%~Pp8OJUpxP~t@wtLCuwt3m%w`|`Mg=fy?Eta!L`lB1Kx4YzF
zIs36{fg1J=>F(OE6Y2yKoX+pFzwDpWJ0a+*$jsLZcO87Sak=&Z*>e|*V!5OXj@^D}
zlg>RaGWPsU_Z&8h!!dq_S;-BDeV)F}>JfL#)5=-(u3D~|<zEAL@xqCj<t_^u7aHD~
z`Fj4PU4|w(As#bCr61j|%m283*F%|@#6S5{O7n`Ht&-#&re6vukx5*3Q|_X*?sw%L
z=epjVu__;z_bd4w?7rCYCCMR|ky+sE@k#9ZJ|}K+@6S0TY~jCmjUxAtv(@i3UubQ)
zKYyi2X7H3n6Y8BmY|?!<UElq7y87dKUfYzIKg_5_HhY^w+C+W^hVAAI3~JcNSyL-Y
zQj78ubK(n%^0QKtL8r8?mCi1{z2oEVI@YXug`0~j=Vi~nm*FP+JV*U`=i`bb^__jI
z6E%f46)xkL#&7@XWBq$QITZ(|O>^cw)0=qW?$M<CyB*3-9{qVSzk0dOQdi&aenwFy
zIVUqrRr61)>|I!G@A`XkY|)9+$Gc+hn><<mcmB7NPkB}4GtY8Qx@bM?a}jIBl7%O;
zj3UEoTpv~3G|P2;JYz%X$<=Ktt_No?N!+tS)MuuNxn*=lL-7yG!26YJ_g^))tbI|p
zrF+vO&9%F)pG`j5l|AXolc2y}lf94I*}k#7u6+_Y`|^Yn`|X1tto||UiLQ;+;_ul9
z{JK=bS**KO&xvnOxwy&Z^7^2CT9JOMcl}?skpKSNeYN$1^)=OXbw%IelrKEedwO(I
zY<bSS+TQ*9{>sd+|Mx|%(KNx$JF3Ad$jy3^x~ubQrIY<%cDsw0gxrg}ojvD%oO~C1
z(*YyTmB*5QELfxQXQxNjD#3dfS+=r2Dr9g|D3NN;U9w%HI$2(RU+a?>KmPo9^MYyL
z`bg#q-^!^bcLYTBXSIlK*~M~7<L88$9saAbe~L~&{V2L7;B~y}`s6=ruSYC2lsfiA
zUc7wGBi36_KRSDPo9qd=wdUjRIn6g7Sw$|ockoVQ`(bIma{_)RW}P?9eYAT?(n+P|
zg|6#gI(r!L-9IJsr0aF-lk#(25u2hf%DlC?&{MRrX!~dXN6*=RS<Kv^y0b^`e`TGF
z{J*N2AB;I^S~CPXE}ctW)w@->LFjZ}#4Vqy2j>!&YQ{I*4t$&|qP_lN*w(16ym`;3
zTs>QPRC?a0J1yd3>lfA^l%KxAl1th)=XKlqC;GyN19qnF{&Z2w<1$05jKdkV7XioH
zy7p_eUQw&Ly+P*hrbWy>{-OFCO#ENX`oj0LoQZeY<Z~PfA5wUdlJ176-MX#AT>01U
z^08jEy#j|91pO8X=?U7$<n&o?&7)G;e9jv7rbni8C$WY{9pZ19`m(C=fxBDBycelo
zmNta0yY{NsZoZFN(R>MI!*?&v_8ne!@2l2M)@yUbRJR*W+@quDyrIdo@Xd9Tc&j^W
z-B!;PI=><DJmWQQUZxLPnnnwk^fu^y+$FH>LKk!HS~Zys)AVAu$j#E~yq<Z^IOKWj
z5#y=P&ptnR#o+#=usVTKBmQ6E3bh~BJZnoYy)sR*<7WM*T_vAh_^NvRSDAL<wepf5
zHtfRHyf2+n)IROe-?Dlh?+neQ6OSs$Y|%e3;Xw0q<yWt2+3(wLa&&Z*<$3!xg}L_(
zSAg63YYSgU*h@>_WjLCf)bXM&d9n6q#)7YB>+W9L()Bd&;rWGDt4z$kE>sattXf?e
zy;LOrw_`?D{sPU3;@5&+-s9_NSlShSuR%)NLA~;y?H8j0?&g@7MNOu9Y77RiS%UQ~
zJY1D$9$LuIGkwpe-6C(QC$vv{bCA0#NZ_xA3SSuayRIp}3MG?T80BmZsI5N!>7ulh
zLD0qO4)5lTf2<{&*RWgHHg5c*dQ4?%-^M@u2{{M5>>CU{kDiqH?RP9<;<H@0__V&g
zM`HX}CQsn?+3pb*@_D6<x6SL?yy-PsC(LiC?Qg%7>nWA7V9MMLv)(MZEI)nDdjTF3
z_v7Nz-PPxR{p=d_w&ltF84>?;C+tqI^qX>ef~tv}!?uhaZa)Kq_v}x6$$QC*i-93<
zqmN14M90_C>+?K=K8l6q=Lt>mzZ<lvqUBZT(f1odT<SJ=-3^S4@w`?owL$st7iC7v
ztwJq_jYBfuNUuL+I8(u3X~v|9v%SPj&);tAie<D@|2}2OqT4E-ou1tWFN7@*6y0z&
zy|Gt;W6qKFPu4!#!`WuJj{k<yLEii3O6J#Zg*@8QWY>M{)yDj#zYl0k<=GUWW0}3U
z;mzOXIUf&A*nO=_dFI)U^7%Tp(eAa^pI6_Xq&iK0(Hmv0{-lW;<@es~|F)N5bGN<6
z-mZ-rxvRO1vSL2;uwCQYkT$(~`U75t(z;kx?f8P^!%{Kp4gNB<6qIjeuNVHpZ(Q`W
zw12{T+jpGq-`}1QJ(K(Ifbf#Vv-jDUrF?M{_kO}25uUbvp26AIjmB>#ZGVs`U>x!I
z>Y?o}EDyaWO|V)U!KoJ^Fte@GqtLRM^{g!Ki%QSiAF`udzVg1AY?djoR*-+z)~WGV
z)ef6(+vIm<h2?g=w_6u2IhHrq_Q%1rzqgi{uc%tE#BX}`)hC<GYgof_)?YIBZYX_P
z{d|7^{kebC&ZPVQ`uoPg&iccff`pu+0EyrCUY^t!IIk)?v&mY^Uhc$nS<9bw$~)uz
z&RG>16-qsMa=LF$&HjmZPTqX@a{A(APoc-|7CzO|7oIo&Q2)f;wk7cCt8^_ZmUZ7E
zey&krs;ro5BD-k!4nEJcfJ+nkx>?vtH?Nr2n)svfZI$_+V`2xZtL_Q^ubdcjPTrIy
z!8S=D#Jxj!Y3gsM(~IrnW>z&Vp00W9bjs0B?q9wwpW8nFzQeNP`yZLt->tltXUL;>
zB)j`|(|z%EY&XAFc5eQ)G4I8xZ&pu*_Sfy&@rH-BkzMeMsa5HBi*0G;Cs}hjc4=&B
zx^d>k&1l`^MRPW_J^2vOve)j_(=|JKUoxLvXuhGU?9TB!Y=;ByvPncLZ*k4}_N}Oc
zrD4ytNi5pB^1TVItf})vt}9+VoG5tB{c4W6)xJ$>69i9H$r%Q?+L|OAtY1>`WunzV
zFZLHk8|4nK|5va=hHu%$gAH>o#T@RMcI%bPMGNnOo;kZ51em@YKhvJ{dz);p_lFQa
zufV`}Ml~y%S3mr=u3+ZRJ*!v$yIj=aC~!G>&XHeH`?}H-g%0PWT-@IJRj4$@ULuQq
zYSPRH9`~L_PyEND_EFaC{jBSPpJuh44f0CA6`gf#t?Zk7W~-Oo?%6ce!u;{4D#bTK
zCnDwhmp|#?E}UwSHN{$;dzM;2;wopgA7Rbyj}7~)>f;l0<9SanaOHNj4{_psUdj74
z#91-JW=g>9Q%2mc-o{M+kXa%;@q2o_$2{IuOJi@#?76I*zxLPJzc)V}`D>BPAtWO9
zjVUxU!cR!b|9r)gXWiEKS-7q(>^tAQXqH*7<syMHGcybMiEdkBw@KFAa@xAqWOi)W
z+ZCR#UhT|iO`R97cEjfilUULp<`b6BwsT!Q)YF)KU+eeU9FbS2F6OLdE1Lc{G${1s
z;;8~I<*e~l-0O~5Dt+t_=RBib7$nJAWyk$1L8s&FSyS^6&!WG2$0d#LpWb#x^OMpo
ziI2x?_LXYy;Lcp#*4iSz;G#gr=i*roFEUrT=k&LJ*PS$L>47hk9xJy@O}F2qz`<Lj
z^z&OVPmf@cM7nCC$RXWYp2GW{v(0yy%0x?8%dq*ecHZ5)m-TPqGtCH>s}c$Kyx%|I
zl(Uh)QOGrOV$r)xA1Zd)NAX1%buce#kzsz6&dB)eT9t9$zYob}x7@Q1JIAGL|GRyE
zef{=c`R``RmXaT*Zt#6v5|X7@IIlJ*f7u}g-Yanmd+vtJSsM}i_zP$A+?lLLH)`9+
z&Ohpu+%9=oLiNEtL-R*Q5gR@4>A2}DTUz)$k(}!B)qi{Nqx&bF!mU2%dL-T0oVxe?
zw56Z#*|4>-OtiVO+p*8k_g4F{eO6x27L@L6-H?3u+A5{R{MkOM%oI+9y_UT8{(hsY
zw#sbJ1p=#+SbhsgUTZjdD&CWG&6AKtSsBZw%Z3Do9#Y8MeeT}hiK%+!yA~UMT5`Sa
zn5tFr)k7>lFXr91K4`#p*o~L@n973VDO;u-Z(L$6vxO((Y4ge%Z5E5v;(l~IsIPx1
z%b%9`WaaEXcK(jxOeF^wK0Ff2yK&8i+kfteu}W>4x4-fUyJ62IW3eAEAD(NJTyR!V
zDVt;NCV@xsuJRWWc1j%Im-R*Gm}L`tpxq(w(tu50c-+3vo3Jze&ZLKm3i~#>u6_K>
zSNq_iGd3Bs_|AGSdML|v{|UR#54q(5uBVJ|d_9vr`{}*&_fA+b+U{B}A+_<=JmHj?
z+rRcc{QG#qt(PZXM4q1T$I|U&Nx03HEeECEZJsHlv#HX2bJjfHP~W>LTUMq0bzSn}
z(We)er=MLapl~oOt;l+s{IrQCi2@?3^|L1aJ-E-sXtI~^wKY2P(pYvd^ovyZt4)1=
z!mmnyRp2`2UaJ%Tn}SSqI-cM9<Fj>F%-wwf&7aJdUHeuN{p-p9@+G-X1pVU$KlYR;
zsdx4zAO5JaQCj%@Tf@?|T;W&l2AhA9<Kz|ykg7VO#&eG~BwTZz-OJ5hr8-y6Uz+35
z6wSO=zb)P&#B^(8)|}=0T6m(Sb@XvOY7##j{CL*n`@Ye#ABrzOxPDvlg>$-ggkxjH
zJ7JLv8wGq)Zne)%y!PUlg?XIzl*GBFb(UR1hh`j@#-|`Mr+(*=pR3CYN^1VSd-CPS
z0qGdwol^g{C6%y5MNf5>DUc{RJd<}8?-^mC^s|g!TfE97vv%D*^UE~GL(ZYW{M?@J
zTNZ>~N_ZwUk9Fem^yI=~5pDO+LH6pG*!m-$<||iTcTX{^JS5NO|GFtW&`2ifnQQbJ
zFWwdj)_+!OL|q=woH2P{hm-t~HMQOu9jDjy><&7(F!wt9`P|;wvYX2}mt52pd;KTD
z>;t#+^HqGijbcnh+7`U4mc23E?62ObV_nk<_j<@(W>uTF=hsi6u=3<9-<Qm+T*Vsb
zd+y9-b4CN}-gm~i7EwnV8)O8^eVIl2CuuXh)#pETuDZs1dw<CV)zw|R6W4!xzE@zf
zt8D*!DIVvaC)nMNn}#(i&fIfJXeR$Hq34snT`q7@-Vm`(e`?O@bw`YRPV9L5bO%dX
zNpX_bD)(LitM7jEa@ywG9xsVMIM42@j`N?UM_KyyK~{zzm&`9|e!p!01Fg60`VzfY
z-)QGK^L!Lrop|2UqU--T{-7N}IcHQI|NMWs^M9SGe5uoco4dScUs~|j^t+k=xqG!u
zwqMKd|K0c4(A^<R<D=TG_I%w}l?y-lZg`iaZn*A8({_pP4SRjVMR?a7oWcM9B%|CB
ziQL_<_dTt-adF3bE49dFk309h&ak=lY1-p%M!wCBp5?VuUW>`JTXXMkHhy$3;~ewp
zo_E)N-$;M$?Qdna$o66JwkbbV3NDw=zmdD2E2OL<&BFS?M?*2UXq{Ew2LtX+dfU;-
zlD1$)eZz&n@BS+~xxBBabN?&V#G>-??~AkX1uN7Xe@{v1`2KscW4&sOTJuGFE5li$
z$7O@(ikkS;uPm)#kN&XjEKA*%GiDxE&-zRE`hIwI@w&vB)g29+_wzYMpIJR2#B`74
z-c0{3Msw;i)GYt{Jhfcxw{^vBart=P*hSVW*YA9~=6q+t8SQn?uk4#Cq<HX4j&1bR
z7Qw2!n=6GK?peI6kmSwbiRd^nA*S~A4zJYB6W{;1`y$%gfmgie33F4%g$IwM&*e{*
z*I%|uUhr`%uldtoe;-~**>k)#Evj@Co6rV>gI^76H>#xnU#iv0TP(Nk-I=pRnp?}u
zzfBWqKKY*kwNo$u-O9j-mw}<%jDbM{d#66F7_@XM`Zef+$^Yy2Gd-?RxVreJ#ar7~
zlJ}2Hw^*yba&G6;Z+SIxY)XoqoUR!hm$uD1`M+*AcLR(3rlq%bzC8Q0*_X-N=G)Kc
zgugAZduo54|7)J9Q>6OMUwGp5mpY<H6|LhwRw#a(-|Fw~e}j8xl=#b<z)k7?{B;SF
zTNCWLRg0%}WKTSKRcK%G(g&w6W`vzk?Oqfa8rIsOG)*sjlZNE^;>b@%Q+Hlc(T>yG
zRFd`k{-Nvx_YRq#y}Uki-U;beUS;QP54iSkS|4<CdC^|4&z6t7e9uTZS${d1%elLG
zX8knJshtfk_rGUZWAMK<J@jtLtn*8L?)X<V^W@Il*<qQ}ZuHeZINc&%9LV;@b*a}*
znJVkE!iCZsF8`U8o>>%gMmuHNCg)|9nq8ra56U^J1q2Oj|FuLLUY;{A)~E0Op3b=c
zQdiE~&);v8Y3kEgzvR2|%x=yeBZFU4v=fils9JbE_qoIJ<}0s`u(_N9zpGH~A-2@}
zVL`6HY^S?Kt*`0idf@RP)N9YtYm;wBtO>Zr$fe^H=<c<KNvLYdDvh&?oxC1|C>rHR
z_g<2m-7>j;uWe`CpOR0HzP`NK->%GNpBtEE7~7!4xx9RF%mmR>swF=HKX1>x<?yno
zFKmV7lOX<&kM``);1)=6$lp+8m}PhIl@#adS*zwT?EGic>+LI(9;5lq@57U?yf6Ab
zz5ciH8UMdGZ{O|}do3NQvgVq;*<{w)D>pRwJ1a<By`t2g$~0NtC{*m7PR5h<`BBDO
zmMw_AU6`zp$2<Gkswa_UCzb`J-Myyad2p%Eq2fzi^I{KO3AbIO`r*Zfhhf`yKl%Jm
zV)4YdKdZUdO4l8~^;XUAeB9j4%E!;u<}cgRQ0afzzFyq!>#<ong2n}Lne(OvKGB|d
zmg!l>A;r%!r5}&w{C}TP)T<G)RjAdT@3rBa^~ZTdd3daX^->lc%9`3>^?Uy7xIZ5+
z<Sg;Z-|Os~d%xLCvMZ5|XLHK8z0PWR!J%5-OYT>xXwOrh+EjZrW!qBcF25T>4~v&e
zznSen^~|bGanmkeQD?hb@Z!N*|3`Tj_k8OViRUU&<6D?3r4XmT+2sF|ORuK!W%4OU
zDAl|xSzp0;EsgU_bUTag1)&GU>#dtNROl`WG7BjU?ys2oF~Viltg}*gGq#u61-{Jx
z%JyOB?bxo=yS(Rpzl&d2S@R{p=9r#HRpJJY<Lb?}jr|Q~*Z*f4A5^&aDdOwrN%cYu
z{4?e@HMM-3G$%4FAo)O@?c6^l|LT~|I#l-tUh?qe<>Pf!4SizwDdNWllegWn*E{W5
z85yG#FSUG)EA*ScO;RgT^gyEQmXgUQ)?apd_9EB0!&Hz}@zME;J2Q4!SLClS{JrgJ
zu<ygqy9BQpmGxXO|5VX;By-JOcV$J(zZ}07UAMXX(e~6)UzUCBQ<~<~9%$f*eeql7
z&*M~UkJ7`>LUj|}4@6C2TOynHz}TnhzL@lloPBPaKE7C|$mVjDLA?H1?YsQX+`Byk
zD=)-m-2cb?>zlxj>mMpYPxLFXS*97Oxl}FL{b-fL=iVX?yT{hk`DQPEYW@0tQEHUu
zDa$i*!X8)7D<u7%r?!2^m*x+@+t=;cpS5J}ryr9~2nXGqbj0_aNbT(1>X$Tg)8Y@m
zID2B%w)iB*T})Rkn9e06-B_=4tyft?wVRQ5!CT>1mmcUBh;kb79y9*3^>x*TgP{|a
zTV6W1{_&%N^er3P=BIAV%YH0;>~Vx1<2DAv)kS+X?apr59puyU`NBJa6t(bGU-!<G
z``^;0SZ6#}LEvnb&fU4UJGQsP<Y<MQ%wy?JWwo%FI5%?2t5+?@?%epWr|s*PXDbXJ
zC?EeVQLMD|%96K#7WntcEeKOR-g|ek2bb)XB~htO3~>icZXF9_Svvj6akYnq`}Qfx
zHh(|-?%M^swcMf8{ny{hE7^1QT&%$6v)68av0FPyCgL!2dkVYSmb0(w>J<Lmdoq*P
z`d#tbxqof;`OAJ<9u|^Zo>i|Mc{QR^+R^feF7MX2@!|Hd?}PP%JeIGrajQG{hs((P
z=(SBvnJhDP=Vllb^CT%u*db=wC2F52a3cTvW)X%dQOZ@TkGtisQn9Z4+*bMjTZTi*
zPLB)qRrjmTT3Fl<DzMo<(Pzbs^%p)K<Bt1q<JplPm%rWH`e%;utYf#b;`qArFBAtf
zUHU9_<JS$L%;=6%NfG8K#`S!R*IF+mZM!#Va!O7aN86+NL-IEqzHPm8aBgD6=>rdM
z=oJ}s=f0el`L9`HdhA)f-G}z<+`m$H!>#&!|0%q=yH%~iGG=<EmwSBJt=oF+*2UQW
zdD#c2+U=YBAi^|eZ}aC^ou2!qQrAwNs#xXn{K_;Vi3NX|c3)43^6zzIeW3QlSm=?b
zkNd9%TTeZukMA5#aTK4uSj%BKG41KWQ2sZUGXHo6o=EBry<{oE@OP(9!)5PpJ0stl
z`Wqj47{}oq`)Sj>4KoGLe?9EtvwG)y#*X+<Rkvsf=0gUPjjO!sg@2Uq(rbOiCo16o
z<-GvwgZ_v9E%z-p>%93WH!;ym=we3Q|BeJfy(77k&M}_O&o?gFwOMgb!u@a_oy<79
zrlkV?|MPWN%d3|!l!%oGSk*qW>uTCu#aUNXDzx_cFp6%QDjoPkPviK!-DNf3-OePx
zkbiJ$zZ^%>rWd7hIlU9koZHvuB>!f~#UDpESMRrw*w)xA^_FkdbM1MWhF|V(j@`H0
z`zOEC6V;iDy|=qXo{Ky0dhfS+DN}jhmDsI!A4OfaG<~~h>bC>d8o&9TZ{E!`>ssUV
z>Li;JowtlKuGa41i?p5_yKvj>T(ib9?|-wUr?7w6o48Z%^~cD+Gh)_#->qBzl|B0N
zWW6<Vt+Pv1{<J?^dh_+RIWC{xP85ynv7OO>cd?dn*6$fz2c$~=Y@C@pZJ+MuiFb^4
zA7<Glc-7~}>$&NrZ5!BC=Ix%UrI#9e=27*wGmh$Yj7BrVBP*YTKF#@`fA2==6`M+)
zId4o;rQ+squdc4XkuSJt9aAKO%97U(9BodA-3}k$67oh$QEr+^VTAe{H<hm$U1|KY
ze=ol**_&3L`*B57rv&$|Ne#O)vtC?k?=6wwu$W+RiRH$eWn3@6xouQkVJUP~+~D%o
zr>dVH{tj(a?^KOzT@qop?AVUpX9_|e^b<~J&T?2jlV9?lfrI#a6LZ^l3$BFsyP9hx
zPhT8+*7VfPd)%8IpYV9O>0)=Am#86=@|8dL&aT_Jw)I`xo>|*YeBGLRH}*a=f8X_;
zn)gZ=SDmk7cSyIo{N1&|tZ>GryWVXUQy9Li_;6f`&wGi%OK+bCU2bZrj4JKZk10q!
zU82i(T-D7a;=KFJXZsRU64r0=kz{5SQhzAQaK37{QOw)-%O{@u5cBM?Z20qnea@$s
zch$^W_Ugl3&A7|vJ}#m!xPM2jdwd|SK+d;oRd~L^jD;7qPTcS*oA#`)azXVD?ffMz
z&g)$AOpa&$oLDQdSbpZ$owGkoI{d6O)9e2?LDLUD)7Ga<Rllt^+xXLjH=7NQ>GxIz
z770}CjZ~Pn@O-7GU*7M`6Pk-k&s+G+2*`}GU2S|?_#2<b=SZt|g(G=lFFIblW1TLk
zUtxDVI-S){Jh=44#LttMzjvBW*sS{EQ^mfrW6VBbj}!xy6|C)+7M)o>`#!(g@y~}1
zcy4Uf2zf2_y>spP%g1@|>8roj^E-cj&qsD2C;Kbf*X|k|`{De!c}2#_m9kGglm2$i
zc&UGjE9VhcUY3Q{^`$8yGyfNT*PZ43CcB_zr$2*Mhbil;4!&vaO{IJ1ebexj$vzcZ
zoxAPL*6WF<;$N4svstiqm`>Udy6N%8e@hyf${ceo9xQ0olgN0y-mmac=!Np#VmdF9
zyqh@p7CjNmaB$+5a(GZ=koM`)ug((9Lw=l7dTZK5?}<L-*>c>E-|%JDi7&gZp5C|p
zdClhV<`${E4DHP>)g6{zA6n);E;}e2z2>FXCe9sF4>VjBSn<V59o{FE+)&=b(S7l9
zP3TmXoJ~IWG7>gFSeC={jG_AJ0S!@x*<OzptnvDja`O6#&I6MEo+edi)7GspXtUuq
zi+CVh{9H!);Hz%s>Um8v+xsP6yxNh(e%M0fT#4QzkCVDnz7?K0xZ<Mt5pM<G;<sfb
zJQt&-?(9GPUqbw?nqlsQ2Jej5>$}U$zT9wL+Ze~ra`*Dv1eG=G7*kmVKB<?zeEWX#
zqK3+a{Z7$G_n-Gae{bJ>o8`wpe;2NL7jaK@!=BqMzh7^8X}SFMiDz6Adv2?^E$pu{
zGxcaYR#;-0kt%I>K<LH02Um7vwoN+!+t?vFpDp-%>6KMX+`E+eyQkRPnAl#|o}_*B
zlYU=!S;+~Osq@%Be@ysnq_^HIt-<%Aw&?EKa(}rOlk6Wfyjys)=Jgea=Y3yKZR?Ya
zp8x)DpUVE9-&^X~x?XSPwAFt$o6E8M;pqdCOq$QbO1JkhedJBuet71M0M@+bz0t)T
zISIP|@)q6S@v53zYvYW@Qx(?Pua?=LoAI_Mm0L}sevP;2Y!=3v-O8`eU3J+0`N69E
z%g^kKYZ5N-RJoT_PF|kM_3^p+!}{dXUl#G~Z)WGuN><BISi9l>#D&|l`k%espLyZ?
z+4jd5(Ko4htgqMp6wJUNK97+B$5A=ydHK1ZqjKKX-Y&ZBvFX9?{Y=X9H!CdnytV1>
z-MsmWEx$!<ioW<MRd;8))fFBVjwU5Hm4l29C#72LGU}7}=NP}9ReG>>(wmp<sV%xf
zD^Bf7O?|poj_tVo_y2Y_rzVwzE<1cUbJwa(k<-NVo5EjP%v^q0eerRAIkxqmzlKhn
zdv^7MlaKGdZ~t(g|KLd*-g`?^_i-(I>ALI0b?+52A(?wjwEo=x&s;jsrq#-S9&7t*
zt=I#nlje#SPJOzXo&S)5&CK-F4QH0mc9mMw{YPo`vQz_q@z+~8(q@M?v7SztCVudC
z=sq9$y|$;+94G2M(wb{Gf%TDVSS;&PwVCXNl5?I;u3zG5dL}G%;`G;3L?v0$SxYK{
zRT%8!e497Fs<AjL{Nhk^<V5{ujaj*?d?&gEPS9Q0EjlIYsp#v>pAQ-<rX9HP<og=0
zZmsj;OKT47a+ZJcDthP411}cjeqG|VKV-V=p0NGvuibpb^Sl02!}kmo>r2%F2cAFh
zX60txTX{S!TVT)GuE{$rytRM)^6Yv0++^Oecga5+!fj*DeqwAsSzqs!_+WMX<D+Z~
z=EbbN>}odAw66F1%pd<2=>J-3Wp*>Ad*xq&WwyH4T)F<=UO%nFh~ZA<z7yx47_$ZM
ztJtf#x<>Q2Q@!lEWiO{Q`gqOCSygf9nR4t>)<;JJ!<=3ozRLRG=$FvKZH{krQkgH8
z%yoJiI*C!OqwL$$&8ry?UuFvMvj2QlX6^a&lWI&)pHu1Sf1bYnCNr0hZAw6T;Uuqw
zlv!>YzGbpl>sh*sOsKW`QSqVfzs0Yo`OF_}tBNa14#>;w`9JlqZB2d6r&ljDZrT4y
z`E%_3`_G|Wt2I~4@2USAUGnGQ=jGR#JhpY6+R}By<Y;JI#V)hX(;;OUQ|r%o&-hcs
z5MRIZ$^Cmv4ByTA{&MLrzQ_8PTJkTrHCVjKEYVXi?BFqN^jNdXqWS8PcaIlKIc!kk
z6q>w8!*|B(Jv{=e)~E}fzZ3Yr;gqBH`sbDx4lt@`u*Xj-Im>yhooQQ;m95*A-!l%+
za!a*oF8Y5W@lnP6|2t2v7TN!L@5J?%Cxvut6YT3fMTHn8Ewmpk)hn1N#u~7<|IbdH
zFg4e0>rM$SunOXe+|}?`R+qus%ur})WPy>@&$o{qzx;aMe0{&nzWU!yygdgWu&8>e
z-VD%{Q+(JZUbEW&`{pH83$j<*p7cCyC~#oP9@Fj5<3F<B@89AxN&osyrK{baqHGql
zo(MXX)ZS9`!#n6r;^TcC-HiW_UF^8FS^O_=$wTMD7*PY=EpzrNd1OpvI3b#tI@vX5
zS_7MEz`RXe;@$IR?X{a<@@I}?@kEKbkVAcO$DVd4Fr_!?O?rCK-aNDLD8Fq*t&vkx
zX;j$Ji0P}&Ej}w%mMWF%khX}0KZScz1wZ?<%Bky>e+WMQ^TS(rb842jBD1h|$(h|b
zJ-&`f-txZd795S-6B!cbJjcpya}QtFxt}x4en`uF{Ff$XnDjmJ?iroSnPR`=J0I_T
z_VlXIx3iThude$v*cjxSvwCjnny$I+{Px;C2EQHn1+Jc+eDS&H6x*pUtPWX9Z;`D{
z<~9A>l#yM^x~*2wSSz$SVUl#0+U%<(iOIglCf@mPGAqsXuR`iV%Vbv_jzzwV4&~iz
zT5OIr?%l~O7d3g!`IJpkl|qckJ9}3DI{0B{Z-czudiRstcFsGvE!xFle%J=?oGOLo
zC&LYcZ7Ny5<WH+zskzNdY_{g?(1fzjhuULvF1fYuc~Td4;9;wQj6$BThFitijhiog
zwGf(HdQey=qHx*feFnF8O^-BPFL~pmjoyThvqcISbEa2x+^JTQo7DGMO*he#@#R9n
zzdKqMOZa<z-sl^ea(K#?lVYOWT^-SVyswN;ir))evLb%&`{$kVuTLu(ZtLA>bMDoo
zWz!8mRi>YAwbc3cqx<s|S+9xZN?FTzR~-;O7&51g!AOQBai>jk{bS#$kMD~bEMEBT
z%AP1asWP9LM^;a}uJB~4Z?)d<PpoRY7asXkW0hIKyIjw}Z))khnGxxF-w!-6c;RLl
z{Zt|1)7-erb6lfr|2lqLAUsv<lm6`x)w2E1Ow6t?VhLRE?#?vTMyaM3GC!9ei&xE@
z@kp;^wdh{y^C4PYxsDnyrp@s)dz$U=adS!NW<%Xy0p_J=(_Pe_Iy))<Su!E#@Gd1L
z#%Uk9_;i1B<XPHvUTgMQ{;J@3@jl_@4D1FWR_pZ}jwnYi`Ixm?O@!@%Ru@zK&jjy3
zT5ck@{v6r8L*x0!MV)gy#HW7@jl3@!rFCfI%**}F+qo}muG4+>bQW(|fwasn?doZq
zciX>KuqK@sDO>$@2XFA{&pEOm-#$!bzWuFdd*GF@DIK?SJjHt!+&Z&o$>|k)UTw?V
zZDc+7*|nD+tqxahW%3nWoNz6G<;RM)?R>>qJjX)QXR_#3mDg>!rPFv!cX}mn=kDKO
z--|YxMkH_cN;AAvdhv7egxlho=VeZO6Pd;Dx79mRW@(y{y!Y45+s~=YkCW8D)0cno
zX|&;7&yb}CrXNntI5z8Hey~L&-(tV5js;QTKezn*%9FnPVX609t#e{u*Xz$}j5lH4
zpTTyHbK7ns7x8PZ73m-R667B)Vy$juaTdKbO(`qkH5cQl=JtbiX0sQr>(&1IY~{rm
z1&hiXOF!tjEoN0pK6A$SQHfTw7QbJY?=OX4ub&@Y{P)HB{jR^+^W$pmtST37-Sp>9
z)4WycF`ZJk+GS;qM3g8Te6N^cB4^XV_pk2L%g`^cE=OOn556(w;0Ke1{QD-{)|Fu`
z%s*K2k72=i?-R%TkN+{>cRnqAiShfoPQH8fb>%X9|9yCOxBdHt#mQS&tYW?~JDANO
z`<nYp*L^!Ys!w#hZB@(Vas50kZl3Ms#ayyQ9FwmlKZ(+M`@44eBu9z8q6~@&cc!#n
zKJ|Cr{Ef=$tg$VH_7eY&-eZnAzjO2E&)V#>*wRnP@(Z7nyIj^BF(Y<?$?>nAHb+ex
ze)3FjSa48<Rj_0h+w9T_=bM)AC|Mz!xNKkZ;^uPp_x@}L_1X9H&e;0ydbs<1ekVT7
z*^JIfGoEi@+Lo|P$4v80<gSKGE7qR%+7_@{<*D$&!q%<F>K?Nx3UvC3Gw3vYU#{Q0
zckhFhdJnT_n8z)<7nGz|!hf@3&)y?Nb9Z&RPHNPfdg$PxzSepBZDyXF6?S&hlHZ#R
zVwaqGR6Vz5d$sV1uRW1_KQvl@i!Sp!TW$YC_)G;ufQ|9giCfQHVJUt8Z)-%K^u6L;
zlN{ovE;4ygReLRb#-@azC(j$cT=wnyBFw3Of-Qh?e`M*UCdH4xbH4V^*vRl%Vcrwz
zCCB*XoTgTWu01W@FE=;!YK^hu?~{u~r^y=KI<?>a)TyG$)B4NG=i4iXs?FY9pW5we
zW99t$hlc(+xv8K37&Sd#{6y#X{G46iANQZ1_wU1>#%n(g35u<~R5HtN=_2;>r}5vK
z)EB=mci+9?EQ@rn!cN&0>5=nQ*BAZxcb0v{nzyI+PAFA*V?QCqqGM6c)X=~y+Lw>!
zIJ`Zq-!$Pyjgwn(!M(4Srp_*n`tnPewfV}s*Fg*wM`k=J$(?hj<z;J})a>9Zj-i*d
zOfAD}#iF0<+s=8rdB-}&PR97vtd;+M`1l7r^yQJ>xXf*`D%bhFg}%1)b64$LDHR;L
z+^g;Bsd(nO0b%0Dc(et7C6rDS{mJ$H_xi$#53fx7H#6qowS68xU9?zNl(JN5H?f$X
zU;ebCd`Ee%z`O$9L&Yk`MD{%}eX+SQGDdIVr?82obHu}r8Y{9bxE6bD;rXmvf-91?
zE6GJqU3ckd)U+e-%fwd|m#m!FyE*=zlHg@aKTr3w$IDbxjFk?it<d_iFf_5UPrXNK
z%8!@&B2#_pww&r({!WJbDD%w3k4y3_1OAj>W0rr#Wj-Z}>AGBHKw!Z6O-Vvg9%nw!
z$zv*$vhkMndVDeUQpBGPLJqc!`)%uV9IiaH{ngyMh<$NL{_4i!3uZOzobRd65Iok!
zo;dMe@nq4LBJ(z^t-Wmi;9x+?bGOYkn`eEqQLlcR@Vz8;PPpatG-18@ZSo~vQk;up
z^=szliv=I6^?CTlQ;RL!EBwIC0}uDOJeRd_n%~>Bq0;Nn{ZG6F`@<Q%GVUy9^057!
zG?O)a!*0uxh?O;rPDeG~<QqQ{_`RT7;m6EfTr!{Iw5lR=!UFknL@oDSKQJ?V;<x#e
zmz^=2Vsg>PVD>7-i+0wVA1S3CaQk|rKjHV?z_p#XHwv7H$#|BavEsp%4SFn>=kz`>
z(m!{RRq*_z)eOCp4!&RACdxli*~iSaQD=FK+JwptO9Kn$EbB>~^R(Nwu2W-6<l#8K
z$EgP__K7DRUJ!ZRQDe@xLu(}uZOAkeWZtpn%-ZYKIoVuBUpJ+E6RLZYX(O0%=)|Tu
ze*AJbesiTbc#18rG2=bOr@+#xVVOPmv7Ct5Vr{iDpTyio_VuwX7qYVssjiqYX~~nb
zo2LHHKgVLfc5d1EDZ<<4CYnFLbu;|vR{Pq2$!}Zkr)^5VnI*MwbLRQ&f7uxKRULe)
z6ww%vHOpx)UxZTBF^^BWeXJ6P6;pW{jW(zE{EK$|7$dMdbwy;S-%-u>;OIsziCYZP
z%Z)8J*|?fE2gK*i5Or3R+fZb;{n5ibU)Pi0%GXvpi}tLDY)YM|T@od!wwU{d^{xXe
zJg#?39C=XCp|+u8j_9OMo0+4PeN?v;ubJ7%qJFX0D)pP(3rEAOqz{{ReRlDDD(o!N
zt8hHOzSdiV)ArtikelwJwQZBuv+eOOySc31bW)Ez%NN7Ldu8q9YX1xClq-8UpUZ6h
ze%P3|fBg^dr}IzOXPv(@uly_1o2&gCu7RRa3mz88v$XLVO_?`CQHRl8W`#qHs-^jZ
zAG3tl-fd-D#%iw0CBIx@`@vgASG_Yjmsupga1!wkxO4XOMXPnsl)qejYdJ^jG2_mE
zTdsdE*z{&E!;ROkds)_S%U@q9zyG+;-sU}yt3C2I$;GNvEStG}>V<gGdBt@nt=QR2
zRc@vz91WIOYMYv3#y-V_Em2mbB>3394Lj!?;S{*0Is16X+W3%5tZ(K%VqjY$oGgDv
zaI;*x@trKu_bZKsj~>;CQ*OTYxYR`E3aekB_=;<1muV-v-#!s;5WO|S^Us=!*ut9!
zSDrq!eeL2}uH6DZq|X~|OWe2Iygb75YHy+J4ZZH0dlr;%S7lb*mHT29WS(<K>S@?p
zy({gjKPacSpV_R)ZseliTzSePFx;p@L~e2}qe5WL=bKkcHuQ59)M&6K&NrIBw`k&)
zoxA7Vi#qVoReR?Fr!)NNeD}pF3+uNi$@~+3$fy17KhHmL*<V~sniHb#CdM~sm-7Am
zdLwMT_+7U9M;>u%IA8TG&P&*_R+}SLEb`D<!|!{m_WaG?l%S@4bx%}Ug3Ifmo3~y>
zuMuwAaat+y@9*e2>$mAR{VKSzPi_@+gIL@Qp?02|lg_MK&7Ll^-=sQUTsM)Go$K1V
z$ZH=<97GFcR8MFhKIv$$KCyCMdaoU8%iH>2i#6ST{NefFe1uzWO3>?sgsIE8*0bGQ
zz5VW=@7u+$R6KB9Es=7bUG(c3j_JD(TuRg~pX$DK!_x=h>YcAsHpeZw6R*5vU*y9b
zp608T7+Ig`>`q&_*|T$A$LHm|UJ1))h91>TEfHV)j(PJYW5d{1*}cJ~<&&OX`B--G
zmVqEkv(VE0nHi6sKK$K3-#^Z4d6Jnbm+Xf8PahOL9+ms6r}pN$DHOM+95FS%nYH&}
z+_!+qoZnX6IqdNBK|sK+_Sv0}4YE$2HLc58yDnQzLM>xyw#aNA|C-sRsyVt-How?@
ze$ip}1xJ>b*goptH6!oH4Ug3Rghyr##^>dOAI|4lbg|A+uzEx9U&p#>8M_aj;j%7K
zE1#k*s<kG&Z&{qZ$BgTz->)|Kv3Ht4%Vd)qQ-aRMB~Sa1ulex#C8q!Tw{LU$b9DV?
z{YPtj)^@zPHz}ZN{Wd9nW>1-B{nM@oWIlH`Dv7b}PGpUlG2=^v-)h!1bqCclg`C$u
zFyh_d{KBQ>R@ye5HBa|!NRa%=-gI7dm-xbkVw=Mf>=`xkj1r^-X1p=pRdZ}At5;~s
z<BS_?X0dI3f3v-GM=|G$hRGp07X-JSS$5}%>av>~zZXZOu3M(oTIt)Za71E<R{ssA
z77ZR{k%X?#N7;^@{E^DPAbbmhROrSqsp$sYp%XSdsNXJiu1V^bhIZuQsr8T3nq0~Q
z4i=<Gx+QAVif=hvVe&Yta<`%V(baF=mYeBJit1<FoBK1TUwB@AdVBfp;@od#KUY3}
zbMx5ENpfYmn+}_8UvuWp!VTJgq9@$BAMRnj%k0A3V-X=o%c4Id=N*1lD0s~&RLaJ5
z!t#F(a&OtbXU<{B+ElF<eL(Vb&tvPvFKoxOUQXP(c+uWRXM_@O-#hwz%7>{o(*+HV
zS<Jm7%A)!<v@Y^+?z}3su3*sxJq`*>Bc1*3ZCO9{A<Ly1UtT7J9-8&?+RE0L_f8UG
zyGoZ|nr8R4?89zb%fCw+!*z1}!a`>IM1C}!#43={w$q^?M^#7W%?Ir}56cwFTy}0-
z`)twu<=h{o9&=s%U9;<<)%q!Xd(%DzE_nTNkHM<Hp>aANz4>Q9{LI^(an2%F&ih4p
zn4|D)hlYcmw!H1mac$fScm27M(6yvNaml|z-3=)kSD4Cr4O!c#goz0#RoZ$;+Ip}`
zeTrHnbon9Q&Lz$F<LiFZD5>bIo|YGRv|ixCE#v6vB`tNyCa>07w$ubOHZp2#{xFLp
z!CX1?-jb<@e&tQ=vsoJZh+!|s<Oyqc99B@VTo4*_)T;4Z#=Plr%NB1t-06KK+bVl%
zN_*XmHP_?UXEW?Be*R|Dzr}~odliVXTLrEBlI~H}uxF7pXYs0NU4!U5QWq^#TRxfw
z3-15-&N}4&r-DcO%A-AB@65J6GB>C>{%fskrhmf|-w*o?O>0g)+GH}RxaHVm-O#Ba
zS0?VBQSy9}fbZ_-Uu#!CoEpbs&2q=DU|wA8v!fy2D~+UBJbyg3iCy{0y63x|S&!j`
z$=N+EIjPwl$K1AQZLF#Lw=;ikIcKx~f0OpibVIcbEaCT9IezQfW-g!k&rh>Nbm0n%
zSSFi<m!dxE?QQ2b_Lj6p{nec7W3f2(P`lgq(v7#RG>`9VJ#luEgOR47?a$S`JU_K8
zPEVYrARH98Rw!-Z@*1N}N@u>FZ&>QimfZG#_D_?8)l7dMmb^|g;gvq{^z~}Nf7hGu
z|9xOxwrZtaEU%!H^@VTzc1f%3sup=VFdRE|>PGQ7v0y2)8<zj29k<lvXaC*u^~9Oy
z%V*u*7IJENP2Za3Wj~(JbE#F=yRu4SS-t<C(l{--s`Ck-eZ7uLFdzK!-jnfw%GnzB
zx0WJzqIoiJ-CH?5ug~^5L;c|bZHu*y5l7RjmnUwFT<GI6`>pi}L!+I(pH5r!n5=AG
z`<aoS=f-U&j$~ca$A?lgC;zx|^J$7c+rgE8tiB0k<#BxRXW6v%>mKKQ>%0=y2fyp;
z&rSNbcAnS78{A7X7!P!?i4|WKnYwavz*?`}-W|;GackE*RYyH9Ie(F5<+F2}XHKa6
z;rs2One>HcE1#K(-LEpv+c@!z@cKmYiSoVC%}WKo<@Y>dQjP1KQRHeGyY}d_M@_e8
z{PnvME6Q9qc~0DN@jFJosTNrkA19j4-SEQV?{l`grRDxCC!X~k&n-4ys6V&I>zTog
zTc48KI`$j1+D!SFwWhGIZ2Ah3x8W{+GJe@TDg4d-u2#%!p4#d=HmS1zQ~DsZ&q{OF
zo0o=KtSxCyE1lj2CgledWCqk`aqFz}Igq{V!i+<PXZ|f?6-t^rQ*7rX#|bfh-~a4N
zzsqHszqE&ux2i+>{pVM_yZU7l3@$1Bm?3t0jZ0gv?Thlnq|!Me<u;z#UzRIR?u}Dd
z-Zyz>&$s1!A8Zs|e0awesn9n%X&bG4<RfSLDCylcJ#+fyyC2VvzF(bfmus#zIo)N6
z&hL4FufE(}e7#5Z|B3pIl`kdd%0KuuIeBx3z9f52T7{60W&GJd&PQ=qx$EOw|6Ue9
ze0Sr)3-{ZnZkuemLz8prBB^y>w?FWFR^Tm>{B+KyUX#quIDe;i)1#g2UU5cjOHW}J
z-h5zj?%6Yoq`37`<}zJTuKf~zfdAQn(_wPrVd-ZX&8Ioc_>)|`Z2!fy-uZoPg+FJC
zWY)afvoY5uXWgwHYrAZ|y0j!yUe3vNJMJ{dye-w2-?4h$_nqfV#J$g~n7ZQ1>-#^X
zkA7-qNZgRMsN!$a!G_9*d;7F~+NYUM`*eO|#*}6OrQOmM-uAZ_^VaRMus(7AnjimH
z=P#?D$g#DrK2Y7T*=AvL)cYnI-SEVtC)cuP?Rg})Dd+CZg<Gt+OG-`TJvNIJhiEmQ
zw*12IlW~r13^V_g(>qeMYS*!>nGwXXb@~}IDHe4Gr6a#pKCRqzEqw(;XSnLE&yy;i
zGFtTq`ijgDlJMWxa$MLjd)h%Oy%|l+v(s$Y-Gr(WK0UZ_Df#ZVwG7Sew*-G|XGybX
zj+?M0`>W5-rYRjOisCCCgsnKUIw1HkU*@uP2L%^i<@eo~_g;q2tuAfDa-K^zhu(xv
za!xEeRwkFWdPniEo04yNnr_vqN+?a<_>uqcX{M{+vX-sAV|{(m&)Kp~4c6CZ8McXc
z%ssVuzveQV6z#rShm1OOmsK!WgcVI^U#K83;{><q&5h0nN}sIE%6%rija&PA@=C^K
zYxTYz-InjpK6i2PvePfh-$=D&o@aRbLu<A9I>Vb@7Y=+1G~WJ@ZTZ<<kpeT<Z9fwq
z%iZ^(qfh4~qvXz)PVv_cTqsk&TB~8kc}&o+|L3m$*VanSYq)LhRZjDmxqj(3J^?--
zKc!8xE@_pT)(GiM-t^aU*8B1|E)&lOFbFF$?afbE6aI4PmDL{1n|`dk$p7A_=`we8
zasspH(UZ%rCR}Bx+_SSs_Zd%DX&<-ooJn^$m==~C{LXMSN$7>n30?`l{zDI}FS4q8
zoIE0wKJ_od|7{XHk*$uhDMsfvNqxI!WU?o{jN_Q=3{P>j182f-GDUV8-?rN5JLkXu
z?%iQ;=YRHo;@t36k@4xR3oKh~bqjKrH_9z#ZQ5~&(b3H;r9$PWY<S2ev6!7*Gd8if
z{G2+YWZC9~&5sM`?qxkyv4~Up!lB?@vf8_nj$OH+74YbgPw^pn4!N_BjZU?mOR`9L
zb^c+~`z04{dhIJaYgNsp>%Q#rywfVb8+HF&J-X55HIK%k=yoC7mc=)f?6j3F-s^;_
zS+Bb={djd;i`C11rRLkIW?wb-OP@bl|NiAu%S~sP-u+D3XYQx`R#L@J<<kMLt)7o8
zDh{2!EnXIS=GgPw^SU?>?-non->^zxyJpp=lOh#7rvqaS|C-~;8YF2H-lW+vX|}0w
ztjjf7%|1rK{YnR18gc_-pS|HpoyC|_z95fX<{a0JWS#c&tK(;Go19)U#qQJ@r=u;K
zEmjoV+Zv(#clM&AS7cLfPr7>6;n!1b2HVq0we!7?FHQJY>!Krk(EG&NDQ=qj+Q}<e
zwr*QzE8rq5b3T*By1&>^t8u!=!|TD<-@k3$6JQbW+F6dXSbV$LyH>eG=C>=?Z25no
zFt>kCN%PH%G7V82Gvz)^VV2n4GttyI?^)S-o{xXk5>IDNx+FC@z$Qy}vzYy(jq_C6
z*T^w_e&YM7;jm=_=jk24`sR1WiLSN2()UN_ugePciybTG)^vs(yIUbypn6L3$iBGi
zsrkj0z8`k)6WX-o<t$<STT5pdOPWjcpA*e}7#H}aJa&Hm+K(ITzl5xopWLaM(z3kY
zcBb5u<$1p{{@!i-W#;(hYW<~v`<tI;TwTr^s#$p1bYAaVt_#O=!=%kwLlV3HY@NQN
zGV`pe>fsN1nRkOORqb24CfX_L{Pvc4OBaXMcrTycGwqAcOtS}GMyj$>)&iPwQ||Cw
za+q7AQt#cFr7iQI*7)m><mh*)d}UAPNTwU6-h1VB`_j6mIj!N0=UaDfzPf60_{5c$
zzs~C2cj%+a1-8u#9l}FQeeWd(e_W9DKeA<O;Z#-c(Cvp#)!S=7_PlxcQ0)|9>F56w
zKd{aEkm8xTZ}-`6DiW?Sp{(<F7-%PY2=}D3`L!-@$vmJv?f8{|mk0FI?34fAn>BCV
zIR}OPVgdPw)Vl6@+PuFsPwbktDNpJvoug-ykKOsW=N(7D))ihRMPJGu-1IxlGuyW-
zf4P7Bjw4I9Z83QIo}uvOOJ?7-=4=XG?^rj_efTKq%HEqFr?J&o|M|VUS^VJn!lJ%k
z^M5FvU*@y6ziYKo{3Mgluf8Q-H&T7ZDs85g`eXateV?MY-Iw|`wQXg#NxSjnkhW!8
zEG}FU&q=Z17N4DTHni{+>+HZAqNW=X*si&9#r$OLS4#aPD|Ioc^m6&(3m5-LXGt2Y
zkq^?9Grr?&duIA7^?Q~g;fyPLujS-0)kg~aRjck_c;LM6_Dj#$6dUYPRvq5g{%+gM
zh0>FB4)4FGqw@TsY0dxO!ovoWW(O~~vf-N{owxG~M==-g`*`k-sBMwoT=hczJ723W
zcHT21Z<9y#(b8o)x19ErKj*HR;P*Z>bb-QR9`m<VML~>tr@k|vHtoKAT7HH}+C`Ug
z*Ui<NmYvJk^<ZPtv{j`7Z+?}}Hnd(`VI?~E^9+fjp$c1?mP(jxSG$z8>DRYx?(6$a
z!nVa*bH(p7X7^KP<9ouGYChHH;wtff|E(UrEjd(YoVNFEk+kf_^DQqk`u_`9#d)86
z{Yaf_w_e|;<#sl2HLSOvI%Ddze)ambTQBX3idep4<z~G{OPW4sn$B6K)F8pfAj?u7
z_GEUc=HuxzzO$~g`}n}{<=T9;*&)lPyr_~<%-tC)<zjnfgPPX;HibXxIULV4YP9Qr
z2U^^@cx`ckLd4=9T_xq4cj-Jbb@s}$7w=R0(D477oWhrL^Vj{kbK`x{C6!woS|#mf
zb9c-5tgTS>@IB9bry&33ihCcvoK8#L%NMcvgYJfoL$^Ke`flSYQ9IJ`dbOZZxvWm}
z+-%dP*|OWxKgJ!){uAHN`+lL*OO>v?j4Mw+o?Jco@O35i2g{rP|NZ&l^1-?<uMaMN
ze3<`zW5t_4srlt!{(iprj&JUPStmdD&H5PXc5mr151;BLPbr={&uJce*qByT>UM25
z>2-cBB5=T6NMklb)YpnBpIJ-`jg<GDdGhHS^ZBXu9>q`DGvxB$b#0!0b<QN;lkYnZ
z*_^ORR=qt@>Hpr2hly=UwS`T^t(-gaPt{N6({)&rxi5PKhqzx>Z_0O<<7@{tUtgIK
zBh=D)>*62Lv!DOO^dx_3`jj@e>V3KAyc2yVj?CLNsn&m@)ADEC2`cXwOP*|;F4TIh
zHsi$ni0unZpIheqzq2cH`Y*}t=XP2s+*`3^P1L@(rgu0lerKHI=geCv@G@02PQuIe
z3X@B0%)@)ij&7zKcA0IMEm&CorYj|5v5amPum7^U(Z}LXy@`J*mlQYu!DP+;;wg{p
zztp*?MV~hfD6y2eI$27H+jXw=*Et4X=I?x6cCPzil%!p>TVkU4v%k*wp5F>oFt`{h
zA=##5SR6KGq2xJ*W!F4bb5EYl-*lqqZPP#RtCqVMzoz{7DU+WfeY#?Ut<Z{+noa*7
ze(v1dl`WOAb-TDtT6(vf`?+vFW6{`yFC$-yOpd8+I?dAKza;3-l_Oz~mU!~5eAXxR
zcF~2eVr8E%zv9gLqwt~UcaroHCaY_@L7A_n>6~o58_>0qC#>oX?;FD@D<AhRysvYt
z;Mk>i1_9OAKRi`4Q9tebY??{*#upQs+f2N5JKqXjmU|j{K%@SxtZCcBw53LIZ(^f6
z-}ubfC7LSy;(LBsl<4Gu)2U)yDSKaB(4DrA^SJm&FDn@fiF5ZPwVaN~HE!pcee1%-
zDccxSE?+Rba4chLt<PM`dj>U!-#gsCa*wg_T-eL(c>*7w^B-5=^FPmE-kQU^6kk^#
z{`e&N@{)p(bWa5j#q6r<t7-$c+zH)o(q(UQ)u->(kqF&phfJ|WeT%M$eP6Ts75_P{
zmodz>3Q5d6RTj;QU|1WW&F3DvjkC>u&Fl4t9`dOuKjPclp{{cG!R_zz_hfB8eKPBx
zrnyCQVSQXw*we-G^DAyWPz+5J<v71DVOyk5#WlY(^EL)J>ha7_zsKPh7j~;CG0b@@
zN5{{YW1T;FE)_^ElIi?wbg6e5Blng`_d43z&5Jcy>@G6v%=0U(@vbb~;=y;Q{ZyXk
z`5Bj9Xz2t^RVX;p^FuDfM6S1TinD(lm*LC9?USebiTbU+=~`vylsK{Y{=RR@iRJq1
z+E2}tJ^c2=A@7OiKJjnNnYCgTN-ul*lkaj6a}c{-W@0cK>!Qkn($=EjnG64~IJY_^
z&av~Ua-F#!Z%RUl?Z)yS6Qi@!D@tlVzxb7w&Qe_|8E$KPocVa1{)H{~zZ;v~T9Ko)
z!tQyDYxvrk7fly#)-}An^O|i-U$@@RbN)`YCh6J-b}{b=?O<JBG2MWh@8P+HVlqC@
z3%LK}2p26B_562q*YXG48?*B69Np%=QsCp!z$2D(JyIFo-2KF{G+biOv`cA!1*3xR
z__|zp$ud>vio<W83zt;(C$gn1{1R*S$Kc2B`~UwbRmiUYu<o9NK;621PD+ROuG}!u
zw`SVE{^|NcK6grIESS;plkXwF%$&|Yr|0_|o*m}5GM#U^TE}emg8M>@D%wZ)hFI%Y
zcP~12JR&zgb_ribZq1F@h4+P?v#^@3w0vft<fHffPwx7Jom}@zHJ2{g{8UfP%roxM
z1n<1xGlFl-s*T-t?q|Ym%_)6a&(=iLX>Ok>+P#L8yRz9~`RQ$wSL&TQ_4bQ|($7h2
z=4_d1wttf76@QPnKQ}HFf0(-Eg!%=puHGFTJxy1wG&WATRJJvEjnOw}@yHw7*!*Ar
zd^p*sbn=Rx@W`ouxkK+56j-J_Tc}YoW8ZEi*QIHkcYUX%o4sf#T^y2<SjQPSSJ{Fu
z?rTh#rqBPFpEuM+=bpK26l!L6Zd3Mq#rr44o8AO3Nj>?Qhx>wQp4&EVzUNNjh9TT{
zds`2zwv;KpY<*zet3>7R7R+t$^d6WC+t)mOT*;!&^yyR#-y_M4#_RuzJL_)F>24MO
zS=5<+X^NzNcIXwE4by+mWp)3Z-xs&nR*v;{jQoc`FF(((X|k4F%0Am8q|ZrpwqN=7
zJ?4`>r`DX4bqtu1&X`qa6eq^%R#P}x{!Q?=rJW(`y%Lp0OReN*^#&xShK8l~uMWO_
z^Wkoe^E>JnUk%w7o9FoYaG&mr=6g&f&sx`4<ytkCPK<rf+Vv>T`B0n0LXAV$mdSn%
ze6#WP#tv(dxOvs5e^zUm+RN>o7+Bk2=@kCdw`A>whsO?>y%ITagmKILFMDzsrx$Q`
z%vdDLX7(p;$I7(B&kLp<S$fejyh?NDt<oUreMznB?kH{)-!g5(Ath;X<(jmzb;~Ry
zY`ZR|GCsPpt*k|F&*blyXB=L%hdCkH>;lX2qHmQ~49`iGc)C2FY3NhGIiOr_<2&o^
zF*#THKiAFsRch~iIC<io_g%)TtS4-k{VR6)xmUMbRyN*t?=813vkukrzxALjKWxRy
z$wy|DUJP*zI<aHj_G#s6U!yk65tDhn?d`QyR~B2HUwrxA-SuHxqjQU%e*HbKtSI{J
zi&NeA?7SugzTJIp%cr_ClP}gy3%S((@9L{A?!BiHylNbdtmVy9d$ajWePrYP*cD=Y
zz7@A;RqfsuIB(6ig^Air)-)P*dv^pr@A&w2+IB8=)3n8BM0e%wusJ@t>gR<kH}kw6
zL|uQL?kxADKgZzLYJs!+&OC46WW8uIDUR{|&PX55Bb@%Lj<4acvNoTz<#Z+6*2y>a
zOy~Y!V98%`Z8NW@!&id^WiKyU3C{dHWA*HN;fo&#%!-;~Dc<35%JFgd0wYm@iqxpk
zhR>?IA9Q@To^f3K&n2E0_b1&>a%J1@S~ibOzP?g=@4pZK&OW^T;>CyczuV`tvE2KZ
ze>~$AW8EUJEejXjSfli=ZP_BxNWaENoky+@m+rpNd?1~3SzD!8<;@*M^6ML#)*TXh
zGGo&tulk)$Z>E_ls_-0f+F<qY_4Qlzrk)=jWu<XtPnmM|b%x(z6`9k~>m`5R->#m_
zVtnWDGPZ*+?aeEXw%oZVKCj^m_v9y`my-{CQCP!#@X7KjgRU=E924En%-f}rQYzSY
z_pn#sym{|EeyVZ4dZ~D|Vo}7&SFZB^Yb9Upcgw1}Hu>t&c@ZwNHt(C->=2*SQ#JM9
zgSe9+VvpX0?M{$dA@#^e{Qt~*CoC=)?^WC@|Nl?*4UXrRi<0Jl@O)X9)gAfgn|gWh
z;qMhypQluQ`rvoHa^}LBf9LrZzC7oVet$`fT3!9@*?C{sZno9UwEa4{vs%TJi~n7B
z9Me=IzUk|>ywY*|y>wC7r9eZbPx6JrJxdPV=5pF9*mgz#&%2MU_pPcfWc=x$G<VAH
zM1||23{Uk>@$hZZepYehQ_a(stsGZuxm@?Tq{}cJIq{%(Rr0a>T5f*#UU=&B#!CK^
zXPI_DW9Qoo_h-BgPFZtKCHBemS+!dYKlFKqNefT5<%v6Z<%nC5$b*Lsf@+_a7@O|C
zY&19OLqXLR^UJEAg_$opEt`4yoYx_CpL2aOYjdl2g_doo_NzL)__?Kx*#E6Tv)6vx
z^6g3LQ-NEXuH?Vx-n=yG{B(=uVk}YOmD`UTkbRSrb60QevO~qChYu&%hjZTid3DD*
z)r&hTCGUAeJbI+G)uFSbO=+*K@QR-3+N<~4#UyrZ{&RSTf0YNHPDZaDkE6{={Y(E&
ztWwsAK7K>+;lZ6koz|N+^L*x6cv?o??y^bb0f`cw525GhNh{b(dh@Q#V@QwomO5jl
zqVww6vJ+DlOx#&{WlQNzyG=#g*96|@c%HiaUq!@!b|2o#_B;JrtC#f5yjjKf`dQ!M
zBAM7XkLKAN<kd4cb)xH!QrxNQx~m-L9=q*ka$>tKBkv*pQ=Xo;Om{4_T=y{SoRia8
z(Zc3Z|LXfclx%v^t1{fS%-iwN{9waPBMCV>sdx5Lb^r9&IiEQf=3yFm?NMConw=MB
z?3WCVs=Tz-hG&tvyxm-xeLr=r{(bm)`8BiXan?0w7c*RzUl_&bW}5!))m0mbI*A9~
zZgX!2pV@b~V;k#F`8DOMyZ_ico$j4*L5tt!wBYmgdXKfMtIubMc<9T#+sv`^{G0!W
zH~3EqnE6oY_ceo>i^}1VyBOwe{`|=_^<yCSi6FB%dM4cK_m#z*S?qqeb?2nR<~Dcw
zc6UtbIli#BXIVk1)#Ys6y}CBRRY%k=Pd8<Mc73PsCSi|R|5v{kRGRp~XK`uVr@LzF
zdZ($Y8vAUJ$gbIaeU{V#=`Z#i({5@_GH`h(f6+j^usX%k=I!e3?eF{j<78!B_y6&=
z7Z!Y4|5x{xeZ}WjpD&)&*n2`;{J?)E-PY!ZA79)|4w*DTioM?c=NGN2uP@(jWPJJH
z@A?n7SM9T|O1k!swYp}<tfzY?Y$`DDUjI2%lzF9Az=vd2frmZC0kYB6%bDaG<%(MO
z>~FQ{tZ-pE@ZL~YQfu-CMjtcn-9Pqh>;7}<WrnQ!^N*3q`afsxi2a`Cut|L4j;j8f
zUkwiKVmeg(k|j%V-~WBv=0BSD;rH7(w#j_1MhX%(c2D*_+<kMZbku{>&nxbJ%fFpd
z9X+dXudDPesjf)f8@qO`_+IhlaNgTlx7hqlS;Y+a|Fc+gFPrl6n?!y1yVzpev<s7S
znR@@kyvlxHxK^g)QLqo|u7LiTvy|T4|8a}qfaC|6%8lDQrcch4sbTcf)QkKcG{HY(
zQMaU-oKo%ICacgn=5^U7+)ep1dqa5c9oG?xh|gDBs`i-QbheM*QRB6oFRkZ$MCY@A
zG1P4AFnaDhr?N2k;FgtrB}TUw_3bL!o|<l6#k);2X1jb{<<>b*x~r8IS*5esKAo-i
zh-=B(69K2qo;YRg?_GV(L6tXn;hf9cD`r}5ntV?7YDjeT1}$^e&u$5I422(}eqT*~
zCHmx2T>bZ01s(+znTg!aA4{Z8PFO70tyT0?E-CKXy=fW~KDH?2omw?xX-4YGCW-YL
zN&997KKyuNLxgUSP<r&Y=KU<YV+?ogdUer6hFdvo=IXg(X;0jjZ*eMl>ATL_ZB>Qa
z<c+b9j<z~Trf8Y{Y>J=ZF6`X;Oyr}Fy2{B;_1>=8p`OhVQ;)n@?#Xa5`n0a!>6N+b
zPiL0<2L-(Qy76LqnfUv8A3|h>{6l^2E?Ua-PUE`o{gjwp84)kHaOnOO&aZtugJp%n
ztw_^XdydVDJ;KB6z4qae+2@_px`kJ3hdw_StFdIxkpx>VZG~fQv%g*Nx*Jn2U->zx
z=hp`{^?4_E@*X?#ah8F@>TBgvuDp!tZ$zv`gIC|*k)@*^no|BbW#uHdEQ>4op68}*
zIjJ)-;GoYT!`4+FPl}#4)p7kT*XGP{N|51cRdCABWhNybYnN?IU(q&ECZF+c(2ZZL
zyO-^mGVw19SKMW-N8ffDRlBHbO*-9o|L)S`%kNGSKExv>`9vx>|JstfODfHD%?;kE
zsa)*8XX_VNqux`zD|5Zw+V||YqoVz<=PJGs@722KSg_0E0ml=rGe?Afn!URn`yoYS
zTl&e({d1L8bMHF+UiCEh2JU4uO(Ih!s_0(o<vspl=Js1HCz==R+rU5dtpdycIf*S3
z-^_`g<Ht88q;~)72Xk7^<~A2={a|~(=9?_Ld!O*sgDd-*su$H~-iry1uGZN(i)-@x
z46iAvZ(U!XyAtKTHLvm~Q(0d}=!TPg`CiY~Gknxsd+3?b>KYCGrx}_WKP}6?KVFq$
z6@E0Yv;9%HvC5Tt-kpylf(_qwv`qf+>G1Q(pqYHL&;w@@I?wT%?dO#Ic3$x6(^Xtc
zZ|;!m`J|9^Z~BkDJ14hW<VdzC)_GmqurKN5{^|qG7tA8f(>>ZsH=KOl5icxg5is{i
zYw&9q=HF~Buir(hX<KzhZBBUldbxUe`|4A>WH*1ip!!+!yzSa0Zsq1@R&_|;S8ASH
z9Q>L0O>f+#?8rZFbv>U6?)o3vX*?~<S8U^q)N70P%{S8c^E9hjF<kmh?0Qzd^)J87
zUe(GL@@(g)DQ?>(SFQe;+uU=ID<(3I`O>u|=8Q-7p1xLW;h88U{Y~a!-mZq`mHAB1
z?zg|4y?&k2g#3Abjb|R$SuknC(zIQ+SC1(Oa5K;CTOK@BQo!}p-VOV>Yw~~3Xlu)R
z{q})M&*CKugj;lP9_C{%eBZf1YWl8dpE*5??d}~u#JBw1gKbreXVg_?yw`jQ`+j|$
zdv$`D_j1q9MYn{^mhJ49&Tnb-at>U1SZC5D=KS4h=bxP9=kbmEu!L!ft<kLN$;Vb~
zyb*rthhTV-YeC45oOMw@Q%#uCH*Hvy`_STvMSOAT|GvyUw>i&UUVVDcj8)5=cUqiW
zrtzSB%c<p0RFt!mXEGlD8tnV-zS`kMQP!82OV4!9dVa0S<nsLtGmfg;S_gCYg;i{P
zcXN(=?v)n~M?cPRH0w*=^^7OS^FYk8_Jj9Z{_QwrxNEJ^W#L7uC!N?}ar&IuC0YI-
zUd*RXa;*O5WWL2|Vd?xcJ6@{454ZK&Jvo?j2gkYnuO}E7P48Knmr|`c$IWe$jOni$
z!PX1@_FL8&w1w;ZTX;71^s56e`xr~ve+2MlzVVyEA75kWR2FdIKu1Qw#MIMYAFqvG
z`SI}f_KPR;<@x*g{!7)?lz#fWmUHuhlO~(qHqDfIp*4H4ob^YQzNbsVV|W-Qd~u9?
zD*svN_|uO(f=2?EZPA=uxvS^nf|qZ;3%-%Bv8mWEzt_^n%AuV<w|-MYnUSO6MDrs%
zUHip+?yl8wQ_8)v@kP??iz_@^{Xa8bS^0)>c19oHzgaP#HkY`5`M|QnGGs&hqbS2%
z+fPd-x2sNl`J}z*-tQd$&#lkuX6%s;QZVlE+LHX{k=^TEc6@G2-f^5y30a#HGFjSu
zp@a8T#mNeupMM2ya`)&`I@H;9N2sDv(pI&~^lk0r8S3iSUS9e3ugUPU>cr^es{DoS
zf3`e&l5yUI^+S7JtC6PBvC_Alu??$=ZytW|tL=mKU$axCH3daQKmNTfEcx^6d2{*t
zMSl<bm#fEbIvdrcvXP;p{%7f(H_GL$D}S?px+VDTP8(YRzhLlL=}_BgWyw*_nF4vG
zw~bZ>PTrl^vt2xL!=j!LyV44;M;4oWP7CeYc>KpP3yY?!KmWX%;kx~F0>i_M^~z~3
z`$Bhph`ZjTDzl|<wYTHl8F{Z=3$<5-doTMs(blZ??jAnA9p|Dg%sLjwE$38eKb_xU
zl<VH*(>Pr*T<y%Cs@<j$3sPt199#XiZ~OH4f(-{JxpyA9lW_h}NTb#fZmrM-_b)!S
zK5bxh@<*RUtM&m88JVr#MsMsS;xnesGcnXZc6-^ZA0L0)JqYqjSNKvsA<(wSa!p0t
z`=$-u;jKrma+iPMdczU^bdujbnbvP}66{2CFNY`Daj)9^&~<A@+788D0~QZ0(G4B#
zKG{<bznyGR>Bm&~kBM9Cp6c6>c=Z=T&a%<-7*alGJhItlc(QzZ^NQY|yn&TGp{KXi
zM5S!X+F9t<<FVeNP-*r&Vcq2G(j`47k~VsEq#O0#dD~R%dde_aKBeyI#Dj{Dly8eC
z&%K>cIn{sm)c<``d4kh7&9?YCK{8%zo$ZU(N4f`3rdA#^D!dXhVf|UD&8eaBa&bYK
zpZq$@ZhW;n!m5(h;1*}-BPUSg=crJ#V)gWe>2FRq-t79jxv*T~x8%8*R~{@8dAoGt
z`xOesGcrZr9;wcLyxPz9puwSxtHOy}QZ!39ESl=uA9vv!uSS6ML(XZ-=C=2Q-kq8}
zHRBL_w&dGrj%l^h)4C;=8z(4EQ=5}oUh<%Mhql*)<4)a6d&L~olpg*}JLC9c(s7=T
zvkjak^I7d?DL&TAAd)G=_}chSN%n(##*IwoUzl#GUiG@@boS9S&N&{BnszPhnEUv^
zktI8Ly|iT{=NhIgowcbWH~*N%r4Lc(Z=MxU&spHWFB7==-Q``fvs54K>ffB2-PtX*
zV(IVbD|gq6n7Y0^wNL+7*wS?>)rmqmlS3AI6&=uw+{N^b%e2ncO~K}3f%j_Ny-#gj
zrFU)LP`*!i>*=(uJ3h5<&{LlG{X@zT;q>F&(?jmJ{#(UbsG(jLbj%?7OmVRLLh}rP
zss|#G23d>s-{htx%z3rq#H5%hJcS~`kKghpue-u$BIfc>BSH93{Olu}Pwcf#_PiT>
zRA%a}$0;1PmzZnwR=iH1c6;*)@8$DvPptoQMV(bNrug!lPktStYR_L~h845-zc+Zo
z@UBK_)xSHZPj<+6uhV^VS<wD<3}3xs-_8ql_4C~)dS|dG_qJcQcP@0XTsrG~_}=?R
zGi+w;Fl9M!c=CDjYUdACg~m_b9WRh8yYABw+3p-H>y~`$^ljNj$H$r-^50cN*caw=
z*&OXDO80J!R?|Pa<%P`M1wI+!LBcWX&5rxuEm8I;x4Ux3GXK`|O|C2Z<_GINSZMm`
zgRQZfS6=rFb=#{fyMD%<eEE6L=1qc!o_!ZF+VcERNAIiRW&X`p%YMn&_wHCAb}TA&
zTlM>GDgWD^D(QT@w2kRSuG;j5=;af>a!cB~g_ZsPARL{&^Ub_ggQG8YU4O@Iy!GkI
zsD`SR2U5?YN)kJt^E`XY-xST#&Qa#5FO&5<YvR#V=Dn(0!Y;3Tm%jewrrqs%<%&%u
z_k8can$<bsu#AU<uBFJT;uz7qoEHfqlb+UYYj64eZkwdZmY2URyI<ecJ7qj``N_&^
zf%;mz78a}aSEYF>f0B=Gm^IDRxVZV_x^0*9rXBX1cx-M?@z#^l20E|!F7K*c@m}Zm
zr==e0cR%D>UwD)j`AjAFQNq4&5znp`eKch|^l+N$gogFDEO}=-cP#&J+kg0u(7hC~
zyJc><N!`{D_W2yUosj<ZddH6FQ?={93o*DV{MWgoqQfh?FDLL{jnz-Cjx4<oLM|aM
z*DD-s`MB(mazx<w<@Q!>k#lb{rZ?WtI41vPowMDE03W{{O@)u**}g5y+wvx)cg-7)
zRo)A0`$~OIK43j?EI9eRyZE;C4zdDz0lPk}KA<;A>`&eaqvSk?cr&g^vl<PRZ~xQ_
zC~w_<^{3q{t0);U3oQ<Fz1xY6Z<Q2hX#HMxt1HaX!DaUi@x>u#msvai?<hXHFmLNN
zk-8n3{|k<q9oEhaH?Q0;zRNX4X4SsU6CQry*5P~h^=eq9x2el<ea1-R=gZ_bm`%^U
zCmQVg?C<Uc$60HImCm(%Y*5YMbS^XG-*sy8X}K2Z+Rv#^7KQXb3!f0ZL+xyn){nEF
zvmc0cs4v|Wzv7MN<fW&K)76X&irAQPw-m8Ga^JbJIKs|#^UF*3o?g<NXqm6_erx}X
zq@C3V+?$2(npwr%>$O&0EWu*@>ROD2<C;l7GUq(Y35>m=HMcx)`pl0kDe2EI-#NLb
zr+>n($Lf10v{?q$x5(|`u~(AaeZxle_Nr$mm)AO;75%ziO}6*U_fzi9&1^oYo97fy
ze&`ThwXVi(+5y3QS4q37XNT9<l<ht*z%b$CO5U&8#_y7T^Zfjl)1J6oX1@3wu`sim
zpGHqA{M630_LWF)w_d%NV^_4##mBb3U9tJep_AM+rTuH3TKW_@EHSB=s9NRTFMUI5
zc~4~`kL(}UO5Xj-<){8HdeD5oWkQDgFAn`#9y?PvtERVeZ+oEqy8Q6M2A#QP6U5go
zKgN_(D0$G>yYtNcH3pVP*$<xMbUQPpc+W=8#~Es8+&7*vI4Sv9GIW21<g~Rq_tz}5
zUKZ68{cve8yU%CSx1Y}5Gc~JqK3BY@@Z{vTuFN{-2C@H?;u_;GaRl40y}an#8P(J(
zH~kac)9OT|`{EN71m=dM=B^N)dqK23O(1<n{+F-kPEWU%nRMW&tm=aIJ-<t~#b|W&
zmj;L^-{<7o^vrjH$m@GtzAubVDF$b3cu~rA<%xWXaGwy%tjtXJH`{jk1^4=9&o9)!
z&KMMwp)C@#T`|02OaF`v?<WzQ^HbG2KdCowI#=v0|IG4L=9O(Lt)<Q9{oKAg^XfjC
zgHLB|2(ElS+oD&_d&T`{&q4*OOYVPP_l)oU#;;#j-SgDko?ex2-t<;-_1gEjZ`)jN
z-+NUR9kYwSZ_B)yul`LmKU?-N`hRTl-q#l1&%cCN%KzwSvk^F*V%2-`Qb5}Dh+^#~
z*0oc!e&_JNbr%f}=Z?EsePRaJ+iR2EG)gBre`ma`70)enf6g8A!+T;qo)=t9y<*yT
z=$u)Z(5e|TC+F!d{VDwVX6LOroPt41-)+!yeE(eVsEo#=Td(<!{m++urXg(5(YWo1
z&ACI_x{`N!K5m;C`1NRKyvXG(J9^fi;t*8%dgHe5V%wQV+b*~zIXqwF8=I2cbM5_#
zgDQT{EG<l@rRQk7ZZpc8yoBe@tn5OYHw!y%eQ&kr=<L1zwtCg4-x>ag|MIV2TrU63
zUS8IOYt6Ct@T$@uc2;%2-*p^Ko}KjZ#$^TNj%vo4hRYhJY|AoLh)@66)pIUUn%B}-
zGv(hhuhXlRTb~HJ_;#hF6w9Kgwu|Mn>fc9t`yCFB<+qcnbGA@@d%S#(m}ElC$xFq>
z-)))y9XN1&BY)(TtJA-+>djIvtZ<%NX0DaVUv+LB-<J2u?H)0!-@9u4)w!ap&{9y$
z?D}Zc;u0^V`bAdm8?Tq7uH5tU0z<KMeZw-hJz>+9>D~Q1?a0R)JKk^j8uHsbuH(g3
zbD^05%dR|GVc_-2bZ<3}xWTJ=4bxTQKHooDBA*$d>VNQEsvzg1H4`Un-cwR^c&6*A
zX=~zl$?eo#o+jnW$+^o;bb9Cp#j8`-Z!X{QOVgyI<7)4^3%5V7oODu6^6=|}tIs4X
z*E?dk`}&_oX2V-XH$Q8d$DG{$w@}t?2Jaj@x$Ay2LW{N+pHxq7emNok?Bl}%X_NN;
z*E#&ap4q19=bh7D&wAg7-7@4#Hq321sGstw>5yI3yBkJTC+_XmEod>@{M0`>p_7Tv
zV5jXJ8Oy#Ei;5l_eBM7%>iGLi2}4)u?|cDz?YE|_kGp?w#raM5KE&VI#Q#422D72;
z4{sYGc}M;WDStd}@V6}7f3&v9>gI#68OzdF773laE_yj`UR5l|_T7tP-pv<V@3UF@
z)z@#={XUwwu)mK#-F>0&?(Jm@uJQAhTdq`DcURW2eow2ihVt*t7M@>w<>%g+vBKML
zIhT_--<_nIV|n$TcFZgLkkb{udQZ}x^u_k`<}KK#`{ZZwl8p1}mzv7zH>KXZ%DU|I
z67dIf>Lfo$=S`4R<2tC{@OO{;owbj=qo;|id=YRx#q{?JGX=pM=M~lW3R~Ay-V3R0
z+Ws@=THocVXH=g&h&$U;RdaI3?)je-g|CTT?)ACHu)Y4r%DV3xF17r-sJo}uN=)=m
zM0s;-|LL{+6WV@wB<_#nK6UAtW@|OK^ADT4p!kM$vjxB2{wflAV1~M+<YXQL8B@*v
z+UGq<77rFKSz61y>4|ZT<m%s7gkMZ`JG9`=8bi%|tH1K044bF9-qQ8j9HxC^pLnLr
z{nOm>DY23r8vdezJs*<`dcJ1FN}L04NK3cxEqnW95r6akqpZaXoz!=W<jWq<-N?{a
zSh!UGYSP-9Y?_vJyRIKQIR6{d*26X*51B}w(W&X)UVc*ZMeOCc`(G}~@pTJ5;VvuP
zIm2-p*R%3lFWx6Ui0jU-ak_SuakoL7kIMw{6Ni?xPCR_<+BJKgI<_hf;|(6?A3f>P
zo%u%po|{zoK@<1aHsxP0)f(Mg+p>dAa&xM`=CqtS_H11f<tH!7UX$|YVZgF1nOQ9c
ze#g?X;@5_5Ja@5hum8fUGgeuJxEI)7*%;2~Ve`_;d^XQZ$#;!U@=sYE&t01Q*5*@{
zbLjf_mrQ2st(X(KZC(8H&B_%Im+dn4=(M{!(>qPZXOq^AIlAjAqBhTX+pYc4Z&~J{
z{cqUH-`x!DbGvnO!re_<g~VO8pQya)OwZbKyj5eyty$r=^=nwZ9`3rTn&9GKID_@E
z7)Nt=L3Tmv%GfzS?>xMgH=(}KFg^Tg_v$?lUmRL<(zdSb-=w&e(b|F%6W86f-nG`F
z`1PW^(7>guL)n$vRtl{TiMXd}(#~zTepTtuM;8}wUK4d>vS9j~&yU_*ybYd`cl!02
zW9qcXuNt*xe;-zUdi*5wSIwsi^LcNMou6lOckY?G8OQv~miN!Eo$s@+fByS_0$=7O
zC_PjEVz<cr=Jd6<y_fCY{M>)p`Sg?h=gS_e`^(w?{r7Wn%6HF6HaF+m%szJV&GC}&
zKl}Y7s_id)yWm(pyO}HdHhZX&52Ma+UEvt@pI@}roWAXSSY7(X?wMO>7tZDt;jmvM
zanLsOqVIEs;IE6=`&3kBtroq%ri%aNtO=|$MSiBvl+ylWf3rm2SN^}r%s)SV+|>E2
z>8a*F&$qtHXs+G=hwbz0I^>tz`>35y?_Yj0FNeQ+H|tGV+pl+9eUBZ#p0Hw*)~$nU
zQrLu!g&%a@DZi)tX}rOo0=G<Fk+oeGhjk>mu8SVr&a|rb>OuEQwQDz;v#_o_Cvf>w
znR#^AkyCQcXaCODQC2r!ZM9mbSoM8qbXeGLNB7^#dK1s=icD_ZQe3!m@~!;E%RhgJ
zdwF(F`N2h&UMuc4z51|oqSVjJYDFogQS66|ZCg6d{NEw5^4Ryc8!nm5tLA-fbm{IB
z%RQ+Td#Y=<>=u1FFK$WqF`gsm%mjM^w&y;I%(O4R|1c-p>Uze`_Jf=!;x}!%(N(ci
z^K&A{zsFH~c1iv_Zu;)L#(dYJ+I*Xe^xWi9o2ss;+wAsQey-YLbCexI!p^+@dRAar
z`H}onFFL>3oNRAc`1<Uxzx$@nd1TkYJ+q+wNKWAdt2HjVe;;-{U+DPb<NQs2|7S6n
z1*<T}r0-gCeVt<R@$09bJ05$#Z_UDpU8m=XM+@owDN%@9v$|Ks_1)FCpVBL?ulByh
zS-L!O`5EEU#b*q|%lvH@YON5j@4NR`NOsTvKkqE6{yx0BoB#dd_<v<Nw~a0|TwG@w
zc5_GX@#v>*8OCo+v{yYjzU7~Z>vHM*9*3J|uC+p;FN^j*c$M-#BFabU^KK>w!#38*
zWm^s|*)V^3Ecf|mI?Jn%ABuKl%XuNAU%%1UTyNXUW3I{OTYMeg%(#6!=>A;!4Z7Et
zeV?wbe(`s<q31)chXx#MQfAqUk}kT=vVG6{<CpvD+k0p4n6)pouWVMxxmxC#+xb)O
z6)Ld(`57+J5hs+STzEJ8T=>tYUIK~F+&s-z-|EPkypmVN++BC(=R4&chBe2ocJXd~
zS{4-Tn!{|oj?L=qmRTu0+v5JuEp`@_xf3*z>yOU6rJDD$SQ;Agl)Gm?aXq*v>LZt*
zPVe`I50k}~3oc$MZsR6sks_nQ;2IUXxUlK}G5uF;uWIBrt?rKNnDW!NitkD)Lr!h4
z&ygE$KE>Wqa@GpDn$C*swnyH`yeK{>DX}vAEtk%9&6x~MkGFn05p)03(}HK89CyYY
zSX009#Isk@dM-7O{!R0GxrAj}u&M0yoP}wTfnf)jmp_tYt8({<5&1Zkb?uqvhXIV9
zpF(#=K2puUdg9govo|Im-qhwj|1{6ZzPFR4++W+O6y|;jxpLrL!qNrY*>O_G&QH>4
z7K=%Xz2O(?&AhdP*-lpL@Qb*)v+m#h8S>#<)^F*ZH+F{W_*p%O-^BY*wch4W@z<ws
ze@wr_{7=>N$Mli|`=x59OLj7;=1z~?xP~irw&;(vAG3}LY~H^8=s%a_`b8V&XD2ax
zPxzdyr%)ahviCUi)lRi1q2IgC%{~6?!putwn>QZnXWuTnd-D?Jqr!X{>{;bMuP^4-
zeY9$qSN5GJyc@Qj(SD~?H9s!uQ(nj;mt}w27N+}8Q4iQWWleUjy3XpV*wkn1)#U3{
z1H+zd4fwNUYRYQ2p4)4LQX;mkX-hk<yV@r>LH1(tnr%(WYdckUZ@y4=CVZc7$!vda
z(Fn;6)uF8{<<4)la$cAo6-xSGHm$kK^O#ZQtmcb_6KAP3KRVs1{Kr;jHutT#GaGMa
zF1Lw2S{OdF<JajO+qaoppS-dCV6eXAdEO6k_eEbb{W`|h%l+0f`J3vu5QQu4&9#S`
z_K3v$Mg(b3%zd(n;Tn6&G9?B{Z(~!Ni;mk?6&*Wn;KsQAmhyxnq3JIksk5vz@|~`F
zq3N?pMBXIJ{WE!$FR~rf@|IXWCG<l>x}~C?PDj8C{?r-&UNrqbx%cGcaHdGjKj%Mv
z7yY$oG8g}yApTZ!j}4#aKjmBRP~NRreu!J_L*H?=&$Ub|KI|7c*DB5zH|^B3lZTlj
zodir&E}gjX-SB|+pL4dXlHs=`xK|uAR%YHc?L&S+!n+$2w;$EfTAbOXktNHvFmrJw
z#}#hA#s{X>;Z@>)7hJb)_I$xE{&!XrcpZ$Gs`<V}7u@c<_;)=D`g!1=Rfo@<sXK}e
zwW-|8H$CBAA6CA|AY5mUtICZ^&7E_mTOXV+Z>gN|LNYx4&a!ml-P!pcznIR85e};S
zJZWS8n#pI5i~MX`P(Cp|%;MG8t<!g(p7dbNnSWE+(jz9`zxCtC{#RX#LV{TH<CCVx
zZCb3B&=>YpGw90e?DuOXObtCHdsX|uwCNI;KN`K*`{(P`i_e?CufHd|hh@rrMf>s(
z>e(D8j#=s)JFAd$h<lyYF4ed{?|9~wi%5L`KEJ>3$Nz)9!LN?ZHC2e(yICWivGYV&
zr07x)tEPMZCl%j)&;D-JgZ8zS-A58n?-ZZo+M`$_Df&`!PGZ5L4pGJ*Hcoyv0$Vg*
zyxrqs_t4h)-aiMO;QMct>oVlUHLLc#vf~Rex0!l3QeaI<fA50z8&0jMI{eY)pUHIp
zF1=&Fx<sa!7I`<%aI%zETrauq&SJ~`&S5v=5<d%z&M3~2I;GbvIcfVR34eDD-bFzh
z#hGNcoo85VH_xMjBXORm2_M^s{`f?m%ljQRo%+NT8s7b-@ussEzwRpI`(3YQbo?)f
zJ(7Of!r{yYnVU~6Ki_{-mG{oUde;A=D(1&N_}ElR|NZ*l?Ze+0{~vt4SSTD?dMy3o
z?{|-P=U1KQ-BFa8<9GB)_1V<&EUDFeyYqKFU3A;M_v5{sx4WNBzVF(UU957=$Vlnx
zR|6x>h9{zNO8y@|UOqVc@c#Wh5jpbJMSniG`>PkIY+-u;^>?mC@?6&K$7gOo!0@(s
ziRsJhdwT26M!%ST(Z|+s@tc)b_RQL~Y3&wWSrgq=HEY|ROu785QR1;gapw&GjAt#=
zCNB1QbIvu{j%m@2k|KdSwsx2M7CfrjFYa?=d#j1@*XEDk&fn{-KdAJALA&Bb%-vgi
z3?A?Qv)IMs@y0DDZ}eqq`8o^Fxi(X=QnV!4&D%%%VCji1cD?6&#V6{wb@Mv07i~RK
z@NlE@Usn%~=`HIX9nJI-dp*hN*X!t3(HrJBt{xTbIQy;r!<#9^ukMz{-m#io(Yq?B
zU+qHC`J4}@b9S_?XiiRJPuD(dUcYZ<f?lh8Pmw{+vv~Q`R8E^Oi|5zXWQCaN{8*a4
zpfoQg-`?O_XQ9#@?yYy6Z(iSZ<4eibp6;S^M$+Yb@3mhEe7{3p)VuXbFWdjb>*CJ$
zR<7uoa@Do6D)Dv9s@}DGvpIfkyI#A(=VEN~fy1G3VFxy--oA2EZ^2%h^Vbf2+2X70
zwRrzjG5O0Tx}Q#K#I9Sd&AIRJQr@!1(dRjjB}|vtdwfIj!S^#)uJ>hHE$Vgu;i8U`
zuYNh*X0^LE$$GnM{B(-{@WvqT$tK1LOG?{cUfsIwaN+bBiBCKJh%{IH+4b)BQIE$z
zy)sz$U*Ze1UF)>|(w@nWZe5Hpe|;qL!&c$jseVh$>sDIMm@W2gx2H7YS;b$+)Mqbp
z2;Rq&eJ=gr?Zr7lKA)%DUYe?4ob46AQZPVv&G*AI7_zUqAI$&R#%^|8^i=DLio?%-
zH1#(<HsQUM$C=tZ<4Lz>oW#|-18dE@k1kg4pZ{0nTQtMsFoz4xk_MjK8?8fCWiD9y
zKlc;<AY7CwXy$8NvnAor@z0;E?jJg?{o>KH)Fnms;c;=+f?4+M)@hesy?va`DzA2w
zcNO#J1#Qx*zbec;>#F|!ST3Jl_$lX?$=`=J`|WM&&8mOBiTw5V@$-)=e&zE2O=h2a
z5w}nN)3F&`?OSGi>~z}_7OXOD9@~+)<6AVJlsG<H`@#77SMT=ToqXcDDP7FM%@1~M
zQ+%iOJZmDKVcd<28F}8v;x(_VUTxx#cIEu$^8VAGveb{wdooeUFD8ZeW>nCGO<g};
z3oqW;nC~yW>FeQhjEOU{or1T|x?r%kFq?UaZR3TYE14yqLX3;zt-ri{F>`kP6A9DM
zj3=?NtdC@L9mAYX?Pl@hN@x18{?tufmS;v6)+)AS@4c!K_w%XETjpb3lXQ3u3S+lV
zuJt{$z5D6c{N<4qXRF)wB;!T%eJdl+zk0jjw!HkBQdynp`g%Pvk*m(H473sxS7?g~
zII8qIwdvQ)QnsRsBDwiX&rTHFG~uw8JXc-ov#?a1;_Qz8i6^d1U;ZWh#oQa6%=t>e
z&)E}eR#^R7{KCeYJ80cy73O=Xlhi&gOW7yWle?xUwo+n`ul6Jdm%cbd8|9e9Wi2b#
zD$ANzHcedZ(7$ZUD~=aB3{z%@{Yj1YU2Y_pc|h-07L)8OGqIE%SEZt~wA;*Pq@Vk<
z+{;jB<NLn~-N}<YnU_oL>4>nLxnb+tIU*j}r$jW<mK^imoieA*T;PyBV_Jh(59g$q
zCEr}uP4dwbb?3=pcII1BlI_G67v(=|s&Q~xNY%S_AzvEH#izPnvh@CzoA3QV_JM+g
z<o8(pcKHRHw|m|EJN1`RMNp7y?9Rep6*a$-e*Bf_zs<Fx(7@@*C#IkXci;98K5;h3
z*x$ZyS^q9F?9R4VzyA1KJG{{}WJ}GiTDiM!l{@9H+?8Idd*ZLxyP3tu9)%0+_*J{@
zvdq@H*F9&BOj&ULsqc$#SFMdSUQaVw*%mmZqgq}5oBf^#Nk(xlZC>4zWW^hjo>$CY
zamxK%?9WYH=Y${pnejZ%O4X$6Vx;N3#*Jyro9{Ch?_v*&?|t*?4#V+^zGKQY2Zd)9
z7tg6)a9ZTekx9oc#cD}kt&2I@mev2h%AY5WN!II`;Mejwobi#(ZUqvn(tR3^Bu)r*
zed|2ou*lc6JAKk|Z8LV;pS<{Czc|w|zWMF7UwY37mf!tt{q$v&_y3z28{TzT7Jo}=
zeLrJ!<K%yF{%-HD1h9YK(d5q8^>ur`-^#CtSMYVGTIqBByWzL=yg>8P!)fb`YL2FU
zk$ifUwf?Bs^zvUCvp=v*s$vpZAa3e<_pnHqhkU@Xxxp&4ch&BnSSjM<na@^tUURk8
z3Z+k%OF!TB<@s@Yjlkv$3_`7Hx;rC<v$rT;i`$#K+4Q4sr@(e2^NU%pwwiJ0CjT&W
zt6kl}YTFuT-Ol)O9+QNH>zS_K+d_3OYq`Dta=n39{r7bS?aa{Co~I74-e#T_(PDD#
z?n#X!2Nc?GXNh@riNw0?sCJm1Z8hOm-`j5fBMTo&O&6J5nScF6hTJbPn{r;C2Z<FH
zcg%7cgj`e~uA2D7cezHZ_m_W+{Wo7b+}ZYFV!WOS$CqBy<_F9lOkB-;uX?K$1XrB#
zc(!v9$M0j8*o6;E%;}#|GJpNUds}}LDbHKI#=iP`R%xEoV#8GJ*@EZ(R8<LoGVV(I
zd?h3`$FG6W`BF!fg_>w)lj@FIdkI$q9gYeq&Ltb<=STfb4wu)Kkq&ll_Yk<65VrT|
z#QBN;E#E9lwtc+hTz<lrd+*&hnWpH58>M|OT#>#`<iPi*;llBo#a4=Lbet8~!`E^8
zh>?5C*R=8}m$eTH3by$+ZaNYiH``EZ)f|U)&!U5G-QCSHBkjIk;0niouV*~CHp7@z
zw0DuAdEcYLkjbxheu-Uh^wE{CrI%w&I}Y7f@?Y>nbn-{N;G6aW-*dheX0rQ6D@iRs
z%U$_=itC4y9BU(T9$!$oQ}D7S&v?Qr;i#7>My)LR`+DEai#OU9zWm_*$1KO5J4L;l
zJL#U8)`Q;5SC)j<mETvhzkhqVg-Hm<am!%w1M3bu9Q2F|`yn0Po+wuHpZ!FxPol!r
zi~1g46_xX1MBJWkHaP1oV&vuZ*I?S=l?fBYf(%ywP?nsdp?;4+z<>FH&H9(RCAubS
zn{1pO^3%sG>rlypb6<08nfo8`NFSW`_uR9L9VQPy^H`~7tkF8Px-6wIO`tIHf!ux@
zx!=n|Z@rRuU?1AV^z+}ZwpII2-h6Yn@@T8F+%I4Kv{DD2l--6E9QqG_ho4&iCW@KA
zc7?O5CHG&kr%rrR9v?PxSL?PBoBI3HTEV=N)>3CbvqmvY|G4Y>x8PImx__r-7Ot}X
zG4tw8sW<1(sFa>Ru(_J8!-p?t?r+vrojK+mOvwx%n*Xy0cr&wzFfcH1FeI(p9`(qv
zzTHZMfni4w1A`0$14C|VaeiJ>X=YA}er|qBX-;afenx&tN`A6lLFHbX?EKqq+wOnW
zP7~Gf$kn)ZQ&%jOIckaY?zIz5^n|uo>zA<V`S$6UiL5-`E*pFJf9?61;?G?@^LB+h
zBuz9fes-qvY~`63tUrHTK3aeFzNqBdD69RaGOvohZZdoR<aX?=+!ue&f4upGwKDkq
zH{ZhTFHg)rA6M&~XEx=J$L(E8mV1|{?!A4;;?l(u>zQk2S9woLxm#ZAJh?^WcI@2}
zm9?vOdGB7d?$${aj;7hZ7boS;{jRFId)YqyqFa-Ab<4LXzTS5#!hh2`=^}USTL(_O
z>U&ap?QsYX-^=Kl?JKP-cm>pj4MXp`EqR;InB{gmY~R~&)^Fx*d*Y@b>3v7fzI;Os
z!%yYI>Pmm!vvYZ`sPjA>w|Cd7Yg;AOxZVHeI@3L+`-?_*^pCJ><(q`Fr`X>Ak{h0%
zf9Y9Y*~E_}p-;bTmYIB6w)MG|c7saNi`JU${U<`NUR>sN`r%xe$b{4D7Jm4jdn?G&
zVvfL%n9%Q;kx%ZMmG`tcELrt$WnN<4x36!R|Fe}Ws{G_>Q|li5MA_%+1)aAUa)uH4
zSqV;zH9H&cc}(fp@bQl}`^MF`SsH!P<i31)|Ml&9lh;>*gy$OAUrF_omS>ow!pM2n
zPBHrEjqjzdf~uAdMy}iH!wtSYx_$b*<lTibC-*7nm;3I@EnVqg^#92H(|KR}x|h8u
zJu7$rl5NNRS$B?@|NnbA_0zNV)8_f>@733z>p03*^wE2Th$$<>#k2ZdYi9Gzotjg)
z@;3*Q|JG|W!oIr(hx@!%*>+fa?{YW8o1e2POfLmbm)$0($@}J^U9QEdlf01+x)K@p
zFY%R7F+bR|Jtg(lwkOr=c6?cMZbw0D)>>mf$v<0M-M7DdC!_E;hB0wk?sb=@KzEU}
zr41rKexxci{MBeXX`4I2{y9s-ietXpbtjhl&MJ}KwbVlNc}>)#94ocRo6k*dF1@?#
zXx{s-ZN|G_{90S(ai!EX{g|@bJMo*lA8qrT{qU(;ZpOMex#*>~JFVZp6nNLA;(cpZ
zzR@g`(!0HDCIxdpX^?xj(BzT8$sLyIX-=gabqUkvD@(qR$=JO`=lsds*y)o!{jRg9
z9XPw9CGnx{t<R1jlV*D``Q(MImYn%Nw)$BTR~PSWam^^UU8gkIg#=kvbQT>p<Jpw5
zRz~q-*WQ^vYW8t^{p)t@+qt7|@}Hug4<BFsS{<<PfzCg*y3#T>>l;!jW{#(?9s2#D
z#E@<8?1H6_T{h-~XV`MjnP}o0uUf;+8y&Syc~Wk1GkcFxg3O#$zUUkthZ`>>K6q}b
z+U>jAX3oUv96aBW8t#>Iul;}Yss8)=y6<^n#Q~9XgR>cHa{oI-vZtpky5Ku$k=8C1
z!4qMcuap)Cce{Ox**;_92i|jkT{=6`KAkJwEFqZpp+viN_2UN(#(%nRp7>(4^R9YB
z+O6rbC65Ch#qQ;1-fhWnZds~#x|)ccORuSP;noW+^=H_&m1SgJbz3;=3va^0^*7$7
z&CuPMf9yK%h566qHO1K&9%gd2-ZamgDBkPhd4I!<o`Nig{tHp|+qK)<xK2NozJ31{
z^UuZoo=#5v3Co|{h?=ubp~%_gkWTZOb=MADPp}g|mese0YsU<?6s!5qU1#5$R>Jor
zPvdjSY0KHUQY$_A>KQCFF0XTET;;f}A^zj~QpGR+LUxxlg)%RF7GhYi+a@}4wb!0&
z5}rqXWPiEp`+K2W(t5{RYu4N}X+Af5Y8$uo#F|yF+PP#s7QVXkUg#9x`kk+$ZyOwN
z5;u6nW-hql)v*^9!uuQlGX7NfZ7kg$&(<n#7Vno*;J&Bjpp52){mX8&Uj8YfduyFf
zVtWJog9@XoOWGeEd9hSv?oBqvyk+Ol{&wnU@lZ%(VZ9bNwQ(v-e(9s?sk%oF7%#~^
zB;~x1$8qb;1KgXZxAPYni)KAozBsD;W|Ms0fAy;T^65uwYts5A2b`B(J5ft&xwVMh
z#x0H8wtP94`1Z+<N=Lmcw|{%s9=+eqdrVTG?9$tHw>LAs?X=j-@PFg&t<U3YOK&Tm
zXB6Y`y?duNbW5)P|8LXx*Z4X;YjZBCbvx&5^!dPn1-tJypZwt?*OkZY#>$fMQHV1-
zMB3nJX!twNU3+!k{o0jpE3i+Mzx1<a?kl+zPUqKr%^!Lyf9t-?`fzl+bpxaHkzE3t
zmn^y4Xj8qw@yY!+ti_Epc)Kqgonez}eoo+4nkHLYP=M)T1^W&Wh2Y-6pbL?Y<&Vyl
zXW_rve2k}GY$8W<rNL+Bg2KwqYqS4sY^`tE6|s?VL%2Qr9CjWBy(!1J-97a-AFSN*
zWNvuEX5J6$a(W)89hPBy!c@`dmN(r@L8?6CX<_#3=vmsD{I?~a?>hJCM$^ahylWeb
zlWsov@P5WY_L)qPnwo;A*cC-zYOC&iqIfsDA;2s#XXCxeOtOV`FArU_4__Z>#wWq)
z`Kt88iNcyFn@tn_51v}GdHykF8{xLXr89%3trVE8Gb^OzQ>$z1@#ixxPwo-dy7ZUP
z^-;&~f+qcjj-3^^eKxyH5?#Jv>a>eo{ekOu_*Vv+yuHZa)|V(}U!VV`{ofDo!-u2l
zCyOcUDm$gk^CaA;mL<&I*K_yE-$v@&r(DUNw!=!j-@j0RnQ?ojxK+#JCl4>{@3!zP
zc<m>Y=f`?b)o=C9Gheesc19no<L?)|V!(UoiY=SZ^eqdw#w<+W{$jX1!C=Aj2c0S}
zIvetndMwl!)-A1UyWilq<(;uXmd1KrB_+0~idxfu*OJd&koMob>!yCh6A{IQMsim_
zn;Rdmz3k%l;K4;v&EwwZOs-xtt=^oRzawIKMG@1~<~r#*zpr<fR2X<Bzu2{5kJ_QQ
z&DSayDBX7PKUH!=-uSa1r&s0f*OG$y?(24?^_j)^%d-~FKe21U(hsej8?IdnPCF&;
z+kZUhwdQ;68S~8;x@v1LeQDYB@?`X`{W(&za~&*IC+H>i={fa^o_2h5{lyGl-Lk_r
zMvE7;GS8E=jCGA)n#^o)vGKLcKl>Niv!0hdQ8x*H`lMo;&uQ+&TRzKJ!<55#+!rq?
z()hM1<#pqa%du(}N)Ix=l{~toX5S$pCjQ8L{@=@Gc^l^B{E6wE|9FMw^2U8rxes?~
zc9?0dVp+W3t8L|<hjXl#I*9yuopvr_{y~TR|0@1|Za1HPvi<ez+1D?hIMtG2`1E!C
zpPH}l4!u!#t~($0I3??N*_@=c>N}Ej)pzhb`|Nv*&n5DX=wW6H&nNucMP(K%q&H7%
zY>qcDX4iZ+WA@z1-vYKw+LD|p%QEwW$O#=Qrh|TSEEul*n5r&+gt_CVOvdE1mPW<<
z6u#VZ{dE0VUmTmjA?Ee}?rSksEt4*-c#ybF@3OV|#%3;Fjzz~-$tdJ;KbX>9)g&u!
zSp2v&*S}G2pVqSUdd*cjf}DZ9`Y+;6w5S#@VOVe~foZeCi51cdR!M7qTzd2`UyeTS
zbe?A&R`q4>(ef%M(pB1z6qV*Una!X6e@D}#k9;5h8Ck?I>=)r$5qBsu^Qfa-oZORz
zmYPjsp-r-4))N2yW-8l+e#^aixPSJPDL)k}N?x|iVO{p@L`>%fwfMf@Z{xL`COH3G
zAv|s6bbFi4dlcj|t|dqCt>~<BIc_DL>T1vER@v)Oq>(n;y=BgqwOcOwd}_O{tbDxn
z+lzq3E(goLI;Y7b7X4D0v0Gr}hmEY6W^=3=ZFcVEI8gI`hqiL6qkr9QOF6c)&;59v
z*G>y|xo`3;Z^@rjq4#qy>l)e>_w5i4-1GLY&UK}DxijmVB$eMub)KGjJec!>rrooH
zFZdRO&DbErx7YT9L9(EE_3R&Wf&!1&U95ky_n_@%g>^RfW~zNmUM=-?&X$dhZ~H4k
z&vZR^-+H6(Nu#=~iGi%vyAWTWhp)>Ow(XpGPgIh3{c8nI$&)+9%zgd&fAQ-$H_lY+
z_jzQ(J?+0o{_S0Ftn&<<&emFl1lnxnSuP&OA8O8@Efw7{S?BW_uN)5!;m(fJ#%9wd
zzV*;<miaVO)#65kh2WDIx#CKZcL`1Wjk5i(`z~phyqTZ5c3wJfV#jU|J(se-Hv4=x
z`y063*ZX*Y?KDHvmYo~+{HULq>bl75^snkgxeS*ja?H4d`QBD->X-lQwdL)$9n!{`
zH<@p-X_^_>UiPba7G$Ke%BWh7<J%er-v0PwAM|<l$@}#cZSN|$^Q%o>AvQVD;sLwa
z<J-HQl=X_9GCk>j$4uiu$Ha+K<T_{Gd@Xp`@-y3+eJOzodv=#{?K!oPNonHpMs~}#
z*^fFqj!!tNv}H@5t?lEMIU7FL+{tvF7r#Cu<8>HIq@c1c{}jW786qL;jBf2p>`2|;
z^5xJ1WzqEQSt@OhJ|(ZYa>~~^u);;>?42EKC%w2hj!c})wtr8iijE4`)&rkaiptFm
z{eDDB81H`-w$WvK@YOT1{U^5Yb3BxqG1Y#h(q_J8{WpGRYF(bKIZ^SC9be3$lbupg
zMwcfVtnstqGA`CCQb^wJ%9nRZQ&n<`OWm1vL%RsexULsVEOU}~Ci1Ipc_h;FL?rNs
zW|YFa+h2r5x9zz)cjN53@JmbOocY)<KR$h4z^bg`-BaaUt{Hn$(+W~6FUIYPShu*^
zgZ)l?8Ati6YsEQdZCIz-IH>wP_Vbri_7nQ=C-Gon{KJczmG`?Jkcyt59(T1^Z`P*!
z=i7qTK7J}K&~!6!jbhc=XGs@gPB*iz`m$}ttH6UdCe;WYIq@W~t8&R=!6T8i$4>Fj
zyK(lFnU{#|4yzI~-($AtN*38(s0}ULbVGbX=duSMUhP!l4O^=3T{z*4?ZV|%l6j#@
zzg922VEa#0q-KqMce?KHcWj%KpR?Uv+5UB-u!O0AW{G-_#|H){_m3(174h8*-e3Ei
zuW-Zv;DShY(MRoUU(9&q=Fjm6JAF#wgXQL(W??#e?3Pp>H*$UU?L&@(^1Bt=!~|52
z+}VA4UQvRuKFii^DVbXirnyP~xb|pgfZ@YaJ_Qmpc|Y%Y|L}~PLAV?1ZuT_S9?fG_
zIx^>8wKYBT{&<V0qLbJEUh!&XkJeYed?aiFbT+X~EW1&^&{6i@Eyj7ZPxwE?F0a@m
z_GL5E$Knigp^X{bLWx5DDLg$v>h1B9RBwN%;AB1@UJwwx=KG)i?ztR7ZytX<&2WgV
zE~z5sKp;=dh7+QiHp}H%ul4`!+Vb&`hh_Vv4Km&>1r^+}S^fPMC$1$wHr*KYW9eH7
zmfm&U2PeBbeeAel`}T3<QNiC8C8GOsa|##K)k--`Twk_%+VW!8zH9enq;*m%4Og7b
zywP>G^x?bX$B%v9{Qhl{=F^hWlEyt!+al!NYMy!K^hzkM`LL$b#eyl@zsdHurdhUa
zU*|k=OJwjHt3rvp9KJ_m)smC8EMFWrTWi8KrQQSlpV^ETZ(3U}@PJ7>;@nHyxZ_*r
z$eIW?W_Vp%qy3I?PW5!x1^IJTg&yxw-}Uivj9Kqb%Zp3$SDtC-IVK&fYn=4hX<O~>
zhlO@?nwOo~wXZAwXnLa~L#}z@1&Oe8VX69FCcnF`&YAs2W&2T?)UeJaaS!}-7)!R=
z#(c;q+48^SRVPQ{lF!i_8Qnuahp{CH%d4n9lT!ZjL?x6l>(VR1tQYqiWqbZcZ(6-|
zjl6TFl%&h2GFFKV5o^=KcmGW=7b~x2OZs8;cbe|(Jzt);|MhFV{JlgyxvU|(aC%bF
z%)&b-PqxfGVLBuEO?2n4sqZcnpS`{B(#qK2E${w*{CTc(=F113`H!{c*R`&{e{jp@
zh{jhviPQRbEWNwzT<D#D5*ZKO3iN8uJq$hc+n)1e{n~ZcP9NWXxYll3O;KCd)W4li
zdrtWN$=%w%+`dyqsQ%$HCc(ZCjSbwDhx9K?FU|K?^wH;k@$Odum-SwOXLWpj3%iny
zqq_tm*B_Di`o3`C1^s5DtCDgpYsK|V9?kizvSas+i>FV1I+JWtclajryB6*<6W=|Y
z_gef{tfhs*)jNEv9f}IpmwsSA(joEa;-^=uS8_}3z4A2t+Y|3KJIp!uzOQu-eHd47
zVm<3S+gA0zT?T2cg~fuC4sKD?H+swUnfp`nuTCMK!xP!N%=cUfeL2haT4b5)x0OrS
zJ~#$l-Pxq#IKh)CEMYr;X=2`Vx7xa;u?1I_%nem!OWeQ0xUST4OI>e@TAqFU-v95U
z6nOVLE7>ZUyiNaj{eDBY@$8<L$8Ll^cb>GQ_aj#em+afy&x8!0v$gNb-FWz1+0$PM
zsyPMxZI>_o>I|Hx6?U!QhOBFMy(5$9R8{f0HyO8XS-7yG?}XKl-;XZtJ@7vz-uScp
z-)Y?+92p{i+~1dx!6)cqzD9SRrKDkXxRDy4S?21$2RiO7J+pmTE>}r@6yJsWymz;*
z^}T&MZub7Ki}sXoi~5+DzuBi`eBkyXuP5E%#;Tj2DU>d_wfDNducCf=#<X(P_3!4t
zwvRc)!*GoGoo7xxYx&NyK3n@$>-`z`FVmQRw6UkGvaLN!oV&=((nG5G$)0N~zCYLC
zU&-;`;Od&XGIbu8zsw1I_R4~qHy^d#wVoiFH_!geucIRSrcHLcWxt%s`KPMU&)>G2
z4PCxAc|7^Y6WFmd)h{?MP48ND+wp?u89Of}>{n1$6+ZuF*`pU*Cmsk{Ww_?h{gO$)
zP3+&?c;6hcle^g@?1uhHlRe*!4!ieF*8C{%DsHd)VTxWt{GZp?KdydoBFIKuu#Wxa
zr3cc_`Th$pc)RJwd+YXhXM3E@{PgV0xgzZ+fA>hOpBFCG<}m-4;!EwYFDV-$FK=j<
zc)2jRT;SdL({m61ysNdX-eNzed5+p8fv#I~Zt#@wE3f^wa2m(&nl3J$@7xwi-j|=P
z(b@j^=1Jqn2P~A%o|oIOEAH3@L3N&{^dn7Pk2@ycQ)f(Y`lqUMbbrY7HTfU5b5B}z
zZtH=^)Bb<y51l7q&mr<kM7%($*0_I;M9AM|{h|Li6pI-woMC0g7kT6HoocJ|Hl+s-
zG4Y)i5EYhvy-aI<l-RC0Io)s6_ei^^gr0I{IK;xM#cTDa<JSL+1ttLwvKJnU^xfQc
z&a%7h$I*|Q7WPl%eQ=|BeQSu{fn-kKOFK_0@wu<zI^g?{7j?|>Jk!?q0wN3y-VqE8
zQrO2FGYu{B^a?89+GH2sJ~8qBSM7pt><!sM**8xfJ8tz%<@Bb-Yr@MSzo=@;akDZy
z3kh;4FswMf^2`18)p0Y#Jx*OyoqFd}v&)$;V2~|U^Defg?)&qL$8{84o!!zkHE-oi
zoLKcnHoS0?(&F%kr<<SO^NhTE^=8r4s`YVl|DO1UANk#ClKODzlUYwvx3(3=c|ZDk
z@Zci7>v1BwW^b3N1wKiAy=qOgzFya+-rH+*r1*l(7On5PEt-8ezp_lz$}XAx|GhOu
zMcQ(=c57)*i@Q@1+@~v&?3W)M!F}el_sqN^qc1o9>$AMj{HJ}+eACM{5mRb5$kgsU
z`RPhd%;TU&or`f{C9;ct3)lXcc_;Gmry|W;n--~-h6?|XX8Nka^h_;$2M1q`QSZGv
z+uuL*s(w#@arfo#$Lr;nJLlL~|Nm1e_4m*6h2>>+hPMBH7|xQbUvPf@KEJc;%G2Yw
zr2nal6HDPT=G(ibL+X;-^}=~e3!|^`-O_v9#?f_evc&ffbMAa$XnSI&Xr+IStLyKM
zxV!+hS^FkxdY+QXoS^J~YEkdzrYj!Wd1o*D{;9TZ`kU;)Iz8!%thOEBReIOuU0J>=
zN2x~aa%kz!HIGXdbGgPI`I&xA@4&1j=T>dwoW3OYWUlstY@y|WeASyf9V0fkn)5EN
z|5+n7_s_#GPo8i7%>S5~-%f;G_(%uG!pX*UXA+KC$XD%{^CfoL7WTUunu<OG`VSHW
zmYOdK(nwgg!Qj%WyIjWB`%W*D^C(S!nYHfmtcg>e6ka}1*_L@P-I7z~XtN>n0spX&
z*=0O)e#|g^n<G`Ho3PdRX7BuEYun#2wB~=*SB^26n=@-$%=hhcMKyQIW^qUgyor@n
z*Y&iI{Wn!5SDCF|K|$xh4iQbMS<!2fh14yMu%3IqY5kooC6Nxl8qKmxD#e$k2<8{P
z*sF6oCeh{cvC4OOy_eRwsTocccy8=qv%TR~#ZCT}B%PmYz8;v_Ti7)3-Kvz$tFsSY
zHWb@r@j3tcPWvx^rkI51M*b`={cpd)_`$uu`D(AMcT7EA!7zPE{!UZI)HMF^X(iXp
z>UB0h3SaoIoxAj!*+r%mZ*HD0<vctwzIUtS{o}uOs`1x9tD09_{3{}Iz2~Ntv)|16
zGk1skLcLSIb0@HQepQ>7z%A<S%dpMk<?T(ewP*BR?>Oi2_>rhjseo+#&jQ1DIq!TP
z9*{|!Cd;UL+THA@kAm)H*(V`Yi7y%)3s%lP^X!e}@6AW=rbIPcml-tNyf5qDf3dcb
zhcoEA4X3QfvFG~B#g_-4;+pY(p6_NBvERw-FLVFPX!%w;Ws2s^nz{Sr_kL{8N}sdr
z!uDl+0$)z7dwy?K?&`EZkNfZBvc(rfPRSOU_VttdoM-M6+D^~8@P6^;!{*N)u8MuG
z^-jB}Jows6l}pP-&OWz&tA6o^f#kkdl3TWxOD^TKw|HDP!KsNS{yS5s%!{i(LY)qp
zOndfG=!Lv|pSH!C#VK1fUYFi^bwWd6!tX5g3qRumq@GqgG;1uKt+gua!x}M%S9%F0
ze3l<p?`?RzO38KCbBUnqsj{L^(*9Jj7Zv>0{P4s4HskfeTGi{~6V*B$o!>>Nw^;7x
zSin*KaG`_4v$z85o%?T0eqY@rDswLC#h(X^SC(HsRIoZ|YHs@93wO?ltarM6ctwdE
zU(2c{11s%KW?fBfPr4VDYpY!S#BFo*qWtQE2NHCyH(59}GN}p0mok`co3SFpdKJg#
zSc$+{?oIQR;)GvS--zWkPQA24Yguldb9C7aHbb6GybB_q-OF3v`L4a}=Bq~YUwf0C
zL*t7X9do>I3LoOk&)ZZc`a|(V+xnbI4;Fk+dbIHzA9J$&WR)AzyJ7`>gjUKjrhi%>
z-M&miFUZj4O|{0Y_<*q44-_xE9ArAj@PU2Kl}-C*-<j>il)dxZt4$8c;#x-zOi1|f
zfPWsBZgE0+BI}Yfzvs$qd~;&rdIKd@j+Q;nyX8xGp2$urXTGDW86$U6v1FcRT|#hR
zTJ~%ODds!-7H*4lHvAlL;kIr=o5Hr+uS?#Vgc^pcdi$*77COuua?a&{%<J?J&&DL5
zz!!2E7tB^`3Y500xtsWwE_uUaw6<NQT4{pgIVJW+3zo?dw==f?^3AelvcBo4n^A0b
z;lq!8>o{~AbIqnJOx@kMYS$5ueD(!O-<+>kwej`6$~B&1?_4c;CP=>2Vb!h0eQ%xe
zdLviLEqT^hS6ucu()D7n+;fdpS?0D8J4*9-7G#9-d{~iq;GG<gX5va)3$KQQ&o7##
zML+bu_(VtW?N-$p(W%X%4;h5@&lOBNG-cbavq3BMk9}L_HQRpjgN(bvhwqdna9%EM
zC_TVf&0EaD$i_c|S>l)oAInCs1zjieI-7S1ZCkj&t~F`$c>`~ji|uLCS0>JG6JK(*
z^ioWrj?eBZY|QNPn!-PGew7`bW>ym1-BK`5>fqXgiN#?l9P%q(>rC1`G1(<!@s!|8
zcWk^gWDft*J2fj!S@(5<xvJDl#aHfAKR2$GjYyB3Cb8z5hJ@YOg#D~hI~!tU?t}>V
zc7N<r%x^k=cEvI&IotFH=Bsz8t+ao!xWRi{*RctOnWyEo@9|0BzIcD-5p|*WwPr5_
ztu)?D^XpPs?6X<0s3>PnY|A5=#RUzrTkUwiO9Td5zFqKj=XXDy=jWJB<(j|mX<E?I
zaYnN(R8HuEdWvLerS-Q3SzG7+%1=119C<J`%)(;V4zKMOWqmiEpEkoQdLxg~(lxKG
zcIR8D`%1sG;Hy2HTzGqVYxbXvlLndXKOL3}<bJIeulsS`NV_HBI?LLxrkxWw4<4v|
z<Wnx1nBdEyFl||MM(Qc?9KR0^A3x3X<!xSa>*)I(fflUFjvs|QE~jPtTz5Zdb#^mT
z!K9>{>n@yBP2wz(D=D0P*6Kjo193aKAghOrFQ?cnv0asa-}-oc37fY^(C$^9o3)B3
zl++%LVOu%-O;_@VWp~YdvINwaH|VNy{rr50pK-kqM@QtL*;d(}F8VV?j`7%9JWS=<
zck{^oE!`KTuev@@vF6d5botxOV86aOk}n@c^h>RA^0>AncIwK@*026py|w8$;j>XL
zdY$Z!52r6yC>--oHLWUr7VGw@Wc8`vcCT|Eu~+-<Jo$EO@Ik9%E6nEg3BKIC`LOw(
z9A$%37Drgm-u(I7UtwJ=qx*w&1CJ9u%9+bjkJYG}E?X8m%h&Z)g21Vbr&i>7hFqBO
z#N+wXxPGzg72STV=j6F7E-qT_KYw{5i%h*q!zMA8)n}ALyqSV>jSuAWF4-=2jXl}2
z<Kzi%Evsmby;Ji=w$D(xc|p3{a_@qj<wE>NZV1lWpEs?$^!Dxc-xqFsR=#={YO&zE
z-5Z<#pR6<;Bn)=!3!3+^S@ps8JGT}-V~>s6>$hy4ZS}FPKB>ZMuKT$8riUjrbw-+H
zRY)<sFI(nU@#D@-6|c+Ja-`c#ISyZ$|Fr&$NDPm?PUp?wS3e(o`Z4!$VEC`Y=cX$i
zjd1v2RP%TD2i5Bz-8Y%F+phX*8LM~HO?h|BRR65yYZ@l?-gRBDeu;3yrUtGJD=MUT
zb}71joRagtYlTk0*4{YIwkNyJtar>zTVSPrp!L3-lDLRQWp`%dzhexc(++T%|503R
zy5i)0GX-_cy^~A$9r(Bl3KyTuwob{tenjUR*SoWy`q>Z8Z?s{*`>*52$x5LuSN7<y
z>iqNbLh|iCW*5te{{9`IE!XD?8+hbg@yS_c|J^{p_hr%IcB8Dk9cG2s1Xh1IGwJrm
z?>>&7&OE+8>C(qf*AkBI^=@LESH4-PwWXeo?Q(XaxzknCg9jY7F3b!_FK%)D`T0S_
zL#7ymhl}orOzVDj#Oz^u)x?Y5j;m^!FWMeCEWP$|3Txa$7c0;G8`>s^&TKrn)IEE_
zq_wl^kIxCa+Ub}cegEdXgIa9-e`j6cJ-x#+y!TgE^NcvowaRbq*hEEFX?1aLJTv)5
z@TS`LlF7OIEy8=hKm4=$c&5|_D@)s^J)PZQkzN0PpFI8H!~NP&zn6?HXJ?kQccv;?
z7W}ZjU-B$KOl7T1^^_^ExoQ?VJiQm7d|>L*ECcObH_{vL?d^Ka_<62^^GmiI!PD0o
zMUzyMB>qdRu4XK*IJhb2_`SVe4-Oxwe-g)Fc(*Qm>FrG$e=O2fHt^e}D(!V@$Fe!A
z%dIlDZRwUc+*7`Icafl~#c{Vjru-#8F0=f6*k7sQ^?X6OQ;ylpl5Ov9tf`*kKBfO_
zTHKN4>-Y3L+kTb#HUHUL20n|=`zAR@ZJqV4LM+GLV#TZ`W4G5&iw-!yvSK#O$eJOs
z&V%pW*20NQ6V^=sv@1Mu!3>rz$vN4peBMm2^Xl0x&v<1&OQki7%IWUI3kwz6d`e20
zSUA?U&B|A07JIWh|B8jAm7eRdvyW_V_%ddf{k*kxf$0Qk^||MCUo3SD%U0WZTJo}k
z^Je?`);(6Q9k~KTgM?pNx!*5QU#`Vn-v9gCS&=`s>+b9d4V5;T7Pb5d+wK-NH;XKL
zQ9u7PY|m|P9J$qdk9&LPR{4;4tMAR<c6?v_-70TU&HKHDvjd)=-<5ONVe$KIz3m#)
zrb`@{R=IhJ=<<gi`rn_2#kJJDiAygRQF>VVy-wf$-&g-#^7mP}nL^&IeYpSi`ivV3
zkDR{u!$HjHFw^#F7OS52MrAG*USGE)!g6cjhMoei_jiP{9>{hEd085`m7O`F5hTcA
zEb~x$Yq*Zl-4Gj<@I?Y~SN0jRIo@=6?JPO7QK+e+V%d+IJ)Ln1#=_3;Yk8KtZrRw<
za;xGtr)u_`=%2PnpFO<4Guk@1ZRUh?8ya*Sj`f$^%I6gP@L5Lf#HTs0*re9}S$=w<
z>B}N^v!tC<Houb=tqIm@@zr+7W=Xof>ty2eMlsjf6^@~NHgU%9?kX%5*qM5IQOnf!
ze|hnzv;$c(e{P&UozvAS(Z<)z^xkhb*O^v&)gLdfUc2HQi~ni4wD7|g)AxONKXKy!
zF#8qV@rOIpm&e5$H97E9e?9S4?|}TN)`~Y<e`xuwb6~u9XbY!p;pXY5W=n*7UpZ!?
zA=&$Y^P$@JQw!LacKK!*A3giRWX``|?C#tVA3Lj`y1U=eoxXTQ_PvLtJ47eGdd9u|
z-$cb`<Ftqsj)(WodDht0eRmDtq==Qgev1v7cGd|UtI<4^es4nlkI$z|GaYZ)O_8|z
zRyy?OsW*4nGW1mH&$<a4TvN*k7x~-s^+jmfEvL+v(?gu+znXHOaW6yh!bdd=doJeP
zcF~^9`OCsd!P#KS#V<^2l@Dy>_xjkXtaa7fI77Iu|BQ@wwHQYhN5zZQSz<>I1>g0{
zQSq@Xo1mwqz3Xsq$RF!PrU}Q-a2&O&ev%ydGC=0`PRsVFg(s)kJ7uYV=hD9-<g;Yn
zrCg3qW@%PtmoNJp56hmCjCd2^clZ8UXVocwJB7-<Cf`jy&eO6%!SE1QqG(90!0KlX
zQDq6K8$PE7fADa>x>ezd^1jHNJQKaNqLk{M%ilL9%RjVryKrL7;R7KqNiQe;YZMi?
zYIbLCyPvy*S!j>cRu>z`-F(&k>*Jc;R^NR4%v9<whs+#@eNDXgj3l<qQP69BSa^BD
zu2AFor<NS5{&tZ&=6-1TJ}t$Jl-=QiruSAY^Qld@xKWmU`R)yg@1|8ho%-}L&hH7;
zT=%v-bXM-{T7AQp6Qvcae{$;tnO~B+B=c7A)a9qYX012abzc5Z>C1vFou@i08utFK
z5c*qGRap4v;g>`5H=N7mC&`{<_;cpY%cA-asZQmY{zX&HocZx?=Pn*U1@T|^odq`T
z;Qestx9~#A%6#7Emd!glmREnQ`4p&fbjvOy={G7q$Mu-Rxtrn^*j(<p==)+;rf9Qp
z*UfZ>J&Si{JKUWX7sY3Ivqm!hS-CS$u7;x_!=@~?s$YhJx2kj>e2A1&+Sj*PMn7CO
znDJ5z*QAO_lP`X+e7n4T*B$$EZ&|FMT2V|gV_07BLA|^QPS>UGO*_gKqn=veE1(^B
z=aH-7G9xqIpjMl1?)>1Am_025JfXEwi)PDptYBFm{C4M-5MT9kvy3(^sr<cKW3uGx
zh60C7OUYSvW|NGn?AYvod753>XLG~$`CZl<D<9Zw7d>1!@2GG8!{|kP0Tb+d?=F^q
zz2<wA)zqw1!!<t^Yt28Wo-DC=RY_&qs}lbw^S&;+^K5bFj2v?<#+~im&!zrJ*q=AO
z_wY@p2*2-JjmkNCwVSP-FVDaKB3YgHxxCN+35vy)ZA|Cyy;GDnSX8uF=wrz|rN1@P
zcdyXTn!n|}kL|Zhw`HW>G_n>gaE!m(6=v_M9bQ-U)px44mD0_h{^7eH`5B(RpMGOv
zQd$4Ix_ybK3*0Ym-+g1L_y1Kk|L;|aJl*c_Z=<N@t406%vx8jz#`>q-<bAcyLh$eX
zN&fGSICK6InOXS9r-LO$bn&W+b5~{u9@yj%dgBGB;i}g&*;sSe|Jl{Ct<Ex{ZR;h)
z<PU2O^=bL9Sr;sI^KYCmPn!O7=HH>W>z^7ilx|+3pq~9RYon%*NVAN#yWRI?^Y7J4
zRbP$W&7}UN^v5yp3#;3lo$H_WzCE}-RHmfqmGr7vjOkewX=PG{b4>XUpWW0u?}Sot
z*Z*yr(LyR~<`_Ay48CzWdf$b=I(=rMj}}Zi`SHu%?n9e}LvoBe{AV@vy{i0}e(>`5
z`;+EKY`XYuZ(FFR<IX3=KPunLo!b08d*<Q)zm3@6E`98|d~LmM+l@e;#LC^LmTs<>
z*!NN<HvMJ`lkZ#M9X?--R4Z=DPiH#4^IVrlg8iMv4vQE2lqb!-xBSmswg~pWGx;Og
z4(31JZgu>aetO>5oz~|=1Xffp?FxRi!dqfj-8YxQz_an{um5@qIx5W)Uw3&oce`AC
zz=6Eg{?iPsUr)Bq+1twTW@*XU{q;TXe|-OVbhrGK$|(Do2cj~JW|F(5eGaSS9oV|H
z)=Ydp`#10MYrkcmEm`<u?mYPjy9e#^61zW?YD>k6M$Tpo|JVLu``k0v7YF>?Wxh!w
z`e)3k?x>tM4<6JrqK+d*)nxX~W?^7p7GPkI!!eGSoLXFxUzDp?P<b{yH~+Soz`u3z
zjtk^f7&lE5ljV{)F+s`KXmPHP$*H&mi6))7!g@w4CxwXVpQyh-agv7DwqTvZ7hX2!
ze6BcNJ+FFk{KVC#`S<(UU6h&8a&isBvKL)VGbVixop%4w6W^K#dzFswxy4acy!yoK
z=Iif0inyN`dz|xN{2uTrtGCL<aoe{&Qy*kcTDCgsD$}JY7fO$|DoG~Cq;?gl?Jeun
z66pGTNpFR(>rLL1DxOi+h0E(cEx6!(<=>g^T`e6Z^Wz!(6Zfa2=1xz`IU1e1dheRd
z$R6?QQVyQe?^>n4@K<HHZ&<~odFcH6EzWBX6;3*LPJjL6FOSz-mrR@4vZG;6w@;y>
z_0s<Ov`22gMKUV_mXudHmhIQl3;uii^NTK(!cV`SdRG1UeDdS*n?G+}QT{PwvQ%2o
zi---+gma%VpPhO=e;bFi)4B;|1xwalzI!fm|C4uXSoRCvjM^0_prfrn`|Gnad(JFT
z+3|(_$*BWV8%wq4n9cs8T&Y_$A^6D8PA^mcN7-!=&terG1xFof-4VpJ(arb5BjbdI
z9;b!Ar;Z+qIz5q9)re*Cx&Z&^zt5l9tp8XyP1!eQjr6gmz-^@pY0sC7Ke=#n^8x$4
zHr4-`v%J^7bw6U?asQu${DbXMcTZ1Kl~G&Nw!tvq0GD^O(W*-(69U#LJz`0I)uyO2
zdHxB@bc44)S8EG6N<?$_<=uGiw0WbZwr^+OL7B=f9oxkcWk=@NIK)Y}i*q0O@x#Pq
z2V3cBZprJRjc-`{!&b@f&uV(_Kl|+4^C$AEiav<H$XgfmIPrAj6-leo%cbH~-P!N*
zcii!a|D74~STr@li+90-sqd0f-la3`mTKO+Yi&)C;l|@k+q~ZNlvnGPeENH9$LGjg
z-TSN8zNp&&eeRy6zcX$m_uNs*5?72b)?egku=}~(N{6L~52T!5uwvI7%XJrTSslz>
zP`37L1S9|MwYSqlrtLCpS@^p4vOaTmDm#aEu~iAr_dR>s8&b0^zTCd{xczV3?HSF9
zdi}q;?7#ev-@H-y!v`M5_-w5O26GpSo33fuHX-Uqb#}(=3g0DpT%NI0FO;@U-~Q<6
zH%{LT%MNEIbX8`@eV^Jpng2ao-eaj7rmqjLON?r{yQI^jbdGYbL2h!dY7*OO*7#|C
zCnQSM>y*8gI_i8>5U#cK=@Z(?^=7N;xqL%krsro?s3znI=LxnY+A~g9ja_;wh56Tp
zxk`sGhy7dJ`fW<q-9RHVU59I@o4RZ#tqr^5-FP?n;LLryc#nRTT`Q)3`^oBg`IEi&
zKW$riTSWWgTgI6g=TBTbTG}+Ve92PxWgPu~0-G!ZC1foeq@<T{n}7VRaO%&}KMP-#
zFF1d0_Phg5`{VC_O(`pR$(ko-rRUCaZuc9h?;2a)Ex8tvePZ3SMDv~Ar{d<!nNrJM
z^j1S|(vIo-?5gK2_gF0X)}Um`Y2U87=BvH8UY-3m{LNY$?PD%=D{q=d&M{f_&s<>k
zYv(5}**s|<=er+jT>V~JpD9~U>%4RBJFEZFD-Q9jf9q-HvNC_Ivi{s#J#)mKF?F|9
z3h&&bcY)pCzoz!>@<`ABP2XPa|J$GV!+n|LlC}32|F`IEz3^KawOET>5zrgV%D}Kr
z5a;wrR$^JAUP0y6h`XR7t^Rww;}ZT!Ofw5U8HljiY$?8UE_*iH+UOhup2lhC1f?Ud
zXq@Vdeo}uwaLGQM>dfs6kA8XdqT>Gd-PT(ECw{-~zTdvSk|UGva3sshN7;NuKJ(Ib
zdJ-%A+?&-?v^LFsV!l!7`Qp#UM*WR@8e^8IH0i1+-CiIQc)+arU{n_`XH)4yE>1^>
zA8Nuug432c86I_=#m_cvnxUwAP3YcLvBxe;A1X51o@I9H*s2GfAuBaCqtf2bDciBk
zb={G)b5D3R_J20>R^IXbq_>Bo5$nb5dCKjUuV3;UReQ{NV$UV%#-;#PQQHXao5GJ)
zGR^dSGDUkDbFYF(hL=gyGNsU-#mt{$**2Hx)_h``;dh;NLBfi^t31OCo=*-hf3e`<
z5fw*~6ea!%Q^MbGpQZTzXHe?uO?!?;Y+y=d@M-eDm(Y80a;A;|quZRYGZ{ZW#VP6q
zJnHS}a``-c|9b{oZ~IM4R(RgB)V_a?;p#iqj>R9srf<8X6LevtvcR<zzvuNa@obml
z^_Q<t3)er++~j{<IQfz7A@-={e?R%?E<AgsXj#&1(<KKLd?MyezJFtyq;{TtPQHzX
z>A7`rdsHWf9a#67^Qp{y3*}#zJNjhK8@O#a#`i!o-0{J)32SOE6(!#(J7E0rmAbys
zgmv!Op6e~0WFve;yET@(iX|%D(f_)#ZjN;K3x%U<x19u-yA4dw-QbY7{I=VR@3fq7
z<%^bXUXd3iSMDY%pD(?6?5$K)%8%mM)oOJ|nog=8^laobo+NTfce>J5VK!|&#^!Y2
zm*TQ4m*efu#Kr3zpSyz3WbN(Xx06>*V;4y>-lW1V&3(2zRPCsG$gL2MX}TZJ$Hqx~
z_MUt(-S@L}kL>FCNAFd3?%kGR>?s#s;O5?2Q@(FUX+wX;%AebOvJP@Ci}>|*$1?pL
za`N%k6ZiHRr|qcSt^M^%$=pq+9o=tB@5>8X$53+pv+0z`i7QSfy%hF+{`zi;-q#tE
zKcpYrIOXZ;@(Ub#XQIoPGmfyt_wJk)=ez0P%XOAQhcBM{*m>?q#Q8Hy-U)`wt)jdA
zrrkgF-RseYSiRk6YhM`7y!uP8Vuje!>&3s!E@#hD{Z+eDXZKd~@5gPQy!I6Q!j!q^
z+gj825=Z`v8r0j!{XcH-XWxt8jSGxtzp6IBT`#!7l`qcznMumdBH7n{)5=yE6l$zu
zOO4w+Pe(0a&)EpYqiOE;J6d$N?sh3|D;N3~S)Q==)IV3%6i)7gwvzLHJW;XuD8;pP
z%CUyCyUw}2wSN_*lg)SMyw#oa^S{a-I97B<^02w#ANDibmiDz?`_#2br`e?F`nl<G
z2lx+8x82QeQnpKtA)oX9vOP;zOuPJ8<;Vh^UHma?PDO_(H?T`jbJGZFzU;?ae(~e7
zD?Sh9P9<L6`<quez5mmjUw7X;{`@nwz_9vz&i?|5_kpi=2OfF4Z_&-GU)w9Ak8XNu
z8y9lz&pnaA>s5wPucBUhC$yT*z5Z&cV93)wZU?{pxc1UiO1^E`#rD4wYkpYD9lZbH
z*6at@KW^8b)6a2Zmffmw5u=uxMYE-Zp9=@BSQGGb$*#4NMVIj=nj6a9*dF$4{shT;
z+lrfZ+?;qj<jzu;qdpUje@*E-G1o(OskaG_s$R|kV}%*=Jdr14Rnya5l;6KuK5d`J
zl%vhRXRNoVyLNm<Evw<}BE`(=OK)oXcCpQy7WMA`@~Z#k)~EhmZisul{x+u<|JDNy
zN+(qAzv>p<CAA^+oz$l17tiWWipkYGsxxyb*Y_KIjXO-ew|e&8HQKu|XY0?D#D5nu
zuB~>h-(EN^A$j-mt0(H`y{jpzy7h)ZWy;}wKcAR<j7(mue=&ITL9N9658|jrv93ov
zQxr1;gB1tP-7(pzm1T)JdIgnJL!+~A8;I0>UoY_GpqYx2bcwk0akuGt3tzKJ9dpxg
z+t@F>wl76xXKvW9`{jN4g?g`N$O%RMI%j!*=c|spG4=lp|ELKEh_y`?nKF4Mi||JO
zR*z{0HD}%L30hx0dh5i|OB=5*4$o)*@_U}|^aFYavW^DrXpa%so|49Q<kV-Q#o;=A
zn=egedo<%@=)&G)C(XAllcOTfXP?`WTb>u|u{Gh)rp(2S+nXM{xAO$Pb6TFt#~k+G
zKV+G73VW>J(wK9%i&x6bIK=SpTx+Y?vM)cI4Y;ipHcvR#y3Mdwd3}%X&o9rvTG;)y
zva_8ZQ`c$JmK`6zI(w7lE5+NlXT9S6#XE2MlS5Hue6On~UKc;um!J3~)Jtu8dia|q
z&ods}4^8^l@Kd?2=8XG}&3<Q6_3E9goZ9n07_503e8PY^$W#1yW2=qyhFMid{>UZT
zui3je^)!=@z$d>oVjSiSA&0{sOtad$M<=L6v*J}==FgpCE9I|x+~VK$`gz+8cW>1R
zSF+4PIAzj>n1eXB_ss1RUTd_|A@*EL&JV`TpCZ-r+U7smzVohtdBW*CuGJhp_b(T>
z7p2MOPOP1fcd~>r>-dv~Mz4~tqZN;)>q+nX?7Zq!PV}x*Tg-H(bFKE0-L<Us=@a>%
zED8@2dDgnDU(uK}(@rV(P}0h!A0!r({0Lups)BdEtF7pEcGaqkzK;`K3nD(pE&1i$
zDQc!5mb853iKX0sgmsRGw|_mD%+#8E-!<;g4T;=1F6KUk&_j+6bDv8ZX8a89n|OMj
zb??d5vrow_%~${C<}ruu?Un~uRiwk6Zge?5o6ouC=oHJdD~xVlF6*>$f5SQNcHHWn
z57z|q9$j|nwqkI7F8{1;b64vfyuccIwXEjcg(``%w~h;zb+4>tn7zY1JYY^p5VOx|
zrS_Tomp(srC!yrZq5ZNOcDIY|%$%zEf62A&|6dq(H>zE{nGqa)>DcF>XMF3=x#XF9
z9$qv(Ol!$1A&xie;&0D<k@<4l45QPx*Xx>m+z@kS?Ky9D!=+2PeCiE~1HNC%aJ_qA
zt)4Gaq1MTz(;HH>Rb$q7U09iMe$Tc!XFkP8t@^*=uC`bY|Gt*FyRFsAOwEoctbV3!
zH9txB&Gb0c>$4ZLd|XkHG0WR=y-UFl&IM<_-(NDze{tFCjal(6_NaMMVxe934n_us
z9%cpxS?s;O-29Z1)Z!Aog38jMgIRYBME1PamV1&Qy+@7rOHzi%%{=MJDZ3}wZfQxH
z^7V7nT3t?0zgg4%RjZu773#67S?A^6i#=&IOxtJs-xs@{(;oA9QPu?MYepfeHB(Bi
zKYX;tLREc($S2Q@wdoJue7ReFqm09R1#3H-{08x&4HgC->`qatY%5-unJhlEi_Oeq
zAy2@$)`e}H>rU3B%u{(>y+CT4@fwc1*)=hL&B7+X-7k3dMl#>O=#OD%&ayscn;Mew
zyn2;k!_FO5OS0A%@4m(Hc3R5@v291c{Z0$j*AG9vI_vLJm4xHoapw!OTa!Y1J0F!g
zgdSh~f5DtRhkPIXQ-9aPcf#|+`pCCiDi?GKY<j(N+qMN}ae=>XO<1EM9J%%1A5lA(
zcS}wxNF^`yd}b|`ldI5U9DIG{v3+M1CxspRWE?T)a8$vUXFC?UcWRyOI?Q`>W6FCi
zHj}v-C5ESt?V9$_Hsr3yl1(9{?X~)oE-^1!{O7`-{A*Q$hq!kOBvg2`%)7rRHY!yn
zmX9y!)`9gi&B_m6m$$4~efq|C^LaLfOHM9T{+M{_XSuwZP`XZG(j4WUZ*TaQ-Me@_
zP0sks_uHpdRLHD#PkSPX8s$Q}e3$=KW?)F3#=sztJ<1ER)06Y_(lXOQtA=d<7T-3T
zw*U9~2gj<NGqsHUZoPY(>9_aU>S+HvCewGkeY-=dRY|csyX(oMDY<j6|Np(0pMk|A
zK;HA#+@02`$0m9_c=+()!`g?87T@meul*UX{@hb#lh>R%N0nAjc2zpH@%tK%#Y-(J
zrRK=VR_lLC3RVk0eXF|a*OS+imoN99UnTDS@UOxuo6kvw%9r*;IHs-_d-&=_M&L8;
ze6#2^uS+%4jP)Z$D<i8Dr#&r=P_GOtoT%X+EO?PQR86eAVD7a-p{p@!e6J0>4zCjO
zmHgV_Et0s`XY$Uf-(t6FxcmE_yx$Xa|CR5=l<>HSN^zm%4xv@bdGU9zI<Ovi+HMoK
zJn6~D|LHfC@<pGCzi0WP_uJCvy3@Yvtj}Jn^xo!A4(#C3kWpQfwLe->aUuV!%D4!Z
zpA+l$iOu%gYqI~<%Fln6Z~ol9*?jZ#^!I7@`}SJ={&==J^wJR(jdkl6*+i>^&#Jo~
zuK(hocW91rmfXD5ts3HqOMcIJ(7Z_GgE<3Jx8w%jlHQVOAL7o{{rLFQ|M~hf`~6kl
z<u1<H`!Ds$+`X0cAK(0$bK&rPd;9A0Z*PA7)UNxjcK!$}L$QewzxG0hdUdBK1`>NF
z{^IkPuEdos`29-jJ@-n<Yn3ZKS#4JzRuNV;>wIkcDeivTQ_=dPen&TF*95GLca1yy
z;rqqFO&|1{y7%v^HLd>mceVKX^Y{Lw);u}bE|uOkoAYSoF4r85x=x#WB6%CHSI^Kq
zRB^kfQgGT-jkDoy;-M=yKNH;k@y*%zbp80fU)37k`%5YmXKrk?ym4gT!QwyFjC(~)
z7jf6Fe^unQ;oSLo`^^~&e|}EMo3^;g#Cz|4js?13o_&4mP+nv4Oz6i>LDisi9)_8h
z4}S^T-a20=rt{zSZWU3BO@CFB0$o#`*8k#Od%C1&#cTGfRdVX7t)}NDuiEDQc#h{n
zdE51YE(d$=_3W*jxBQo(&qpJj#(TS_$xO@KeqxQrWa$M_^%sNw)Xts4W?-t&&?V)X
zvRK7ReL+>mef`5hM}8&pEBox$EiL$UHp*wyD!$7lY|0x_W74%}X&aw(w4KuMGSQ*!
zW<=ZOjEQaGw$0_tU-+ME3X9F0dho`bNuE58Qg6cLDhzb^^!DakySs1RzW%>a^UR-o
zDlb=mf9%#0yDMW;@~7>`vQMAb7ZF~%FUj&@RT*2u`(>9kPjL5MY_NKj9roS*%L3(g
zcFhO2pV*=euelW0eS3G#F5%m&*99jwEKxPyIp<UU8}CgweDqFjm5}9q+OW6!>wNpU
zdvDvu{pR<6f2WAIan_CM-UI57H<)MkEod?4UM;!B`o!~k>FN*cI!70lf8zaQ{W`*g
z%kiqJsP9A_p@=EZ4u9xaDi)OyA*xV!JEC{Z)H;FEA42myU9V&aE@ghSMC($4aq`>6
z^OjYLY*L!oWl_Pm_1+Uh?d%2lYDr?h9p1k`v_<HGmHE$03a7s->9)M#_*ynC#nW~+
zuhvAp4Z<pEywM3yGF{vf46Z4botVb5$~$<GuvFk<x7mz08Wu1`O*PZ|qRqmW|H1xu
zYZh1Bs`X`!Nw)J3hUB$q&SF22GyQU&V}eEWt6irWC*2fQns$eMiSr$6FHh4&iu+RR
zaye=Q_lU<xua@4&)e~jArE#feneFb_XA9<KP2!7vThb6x=(lC%YT;$aJT`UsN<2+q
zv7ffF;pOUGj?K3!O(o<q_wghflt1P0zPF{#EmD<ln)ZrI9BbKsoOW(F(;m^JI?;X6
zDha*mhhN&4d=?8y&bTMOR{XeJ#7>K~d#sMHH&D)Rd7EQ7^TO{Wr;eRJSnhw^E+#9I
zTqmTMc00p?X|XTM)tu>EuYAvMxiI$)kGkE|y&ImLe{S~Tm&!y-9y3D@<3E?voUX2{
z*Se*aTK@R#xesr=tQ;<MW{7$7i(Z&&tH}C&XG+uN<?H@6Jm=zNXULg$q**cI<hDKe
zUXR*KS3bS3VHPH;=UWiGS++*n<LnMztu|w($#(mW+?W5jyK>&K6;C{)dEMvLONYfZ
zmNEGLuhO*He}BSf`ONOm6U%kYwpU74JDf9ZU00M~ETUlUxo_Pb4we^T5f|o2g(=8g
zNSJy2$<_`7w+QYDySIiv2|YCLbXWpcCxg{1`|igoyEpCfVKI3-@u66?XkhghKdG{Q
z2EmEPPKcUbP+xf<rm60jmCq*8^*bZlJo<%JwQVh*%@DXKbw(^_iug*sy~_{24AXGn
z?Gj<TcRM8E2OEpo(Z>lpCasF%ej<1%S6bwWJdd`kh})NEhq&`Usfc-$<~LioN!<Im
zJ;3c|p75gOzf8C6i29`2X6_&>8GLir^KBee{72Y!D%MFGrrgju`{rZqeC7$FQY{|h
zDcxL_{<prI@D~-y-Xc)Wu;c<?cjm<D8d4M1-LjaVX2oq$Ep+(7!-gGaJ`|?w%$g9(
z@O1qFi>UCV2d_0!7N||V$=g?)T3M#_`_w%KziF2rthQ%e{$cIL{N^m%_I;D~UvMkA
zaIENq;it0Y>?Sf+GYwd@Q&*oU73i6IhR>GCVYlwB$FeP~pROi!pWvIqpK@48Q(&F1
zx%-qGjeD*bcGvLgTHpJ=cxCIJ&3vUyy-b&ru9tc&jym>7PPS;XcC)dA=2G@W5_?P^
zA5~0#@NUNL;GTm^Kjw6$m<BQ(>=YKbYW;=xiFV!X#iwiItUhWw-LWcLQO2LcJUzne
zLhIXYR}NH8=FC{1%Bi*G)Ay{6LU)r=XE5+?d7^an^D8|e*4ZLjPcCNEy~)xz`XXaC
zUr}9(L^kuSjd4{`6Xw1+>9w%6`Ji6SghRY0zQ=n->XhGeUD($yU#}tmCv8jWg~Mq!
zw<o1tcY9^fo_;6&kJ-72YI?%Hn(TTBxAxzdb69a|Zua*OvvZTa=yYEy)rmVa`=y85
zLu<o?8SO`&#)bq|t7=4wmUMr(xT~c-z*=$VaeMY}DUKW|p#_qyn~V7lOz_{chwDT1
zhwU~e*?5F3_NTX5pJ?1%*B~%U%V6q`=g;136THFItIaR_joWgztb^^jHz%0gb$u6I
zvtp}Tl3TP<FX&^Z;^}6klgg7r*UGn5s_cE*_p|A|w37McBd`9vzsP<2(XHDi*<9~>
zG9<%fzP|hKyYT)A5v!P^cUxYHo;X`!FZ;dz;IB;?9@*E;c<t8}Z{pEDb1Ih2-dd+^
zK}STp_w~&p+<{4Z7~2eXdOk9(_<n~?bTw0b#gm-ZH>#(GKKNU4{&Q93x+KAbjs@F;
zpT6|9wo58G(pRPAEorhPE^eORUE_`O88p<@s_ZW9;tpfU=id@J^-f2p>}*r}Jmod=
zMxH%<Ph`)WbUe={z<S+~Ir)LxDqZ!ny8`!VCCu0sn(o=G!^eBx=b4Jx^+c6trF@^Z
z%XRIR(hl=#KJ<T2ncqu=6ZgJUaVJWv#E4B13(wI#d&A`?%j*BZPmjMhaXDvaIVDiJ
zZ06%9KXTHhOuKmS#f|Ejljnx6xqM}jpk`3pMV0i5;tS^40#aXtatfHN8Iqi}x&)0y
zW`)WHv8{P_;IYU2B%Zmc4|NZpV&p%Z8Y<M>zdd5Xnv>%5b{u9<ZfGb^&@xhVzxURt
zb6SSQp=5RiAMsNL1=m`>Gl>0=Qa2LjNp5Y(SJ^W?X<m!uDXRz0`BSZ}qx2VgsIfF2
zndtB<v~ls1YQ;UNvEo;Me0==#*D5YC)v(p;Uhm=f^yyXM)-(C(AJjV5P5STg=;Y+f
z>-Yb=zC8MiWzpP)TdQ*3F{fYjFjks<vHI-lga5=PI=}s2Y<*;Laa&+SAQzutc3SFt
zu{WFfpJ%w&eK0VYcSW>!({`rI0um<~`<}{u@Z&qH{NQ$rde8M8$GkQNrC16lnC?hi
ztL;;xC~nRE%*HbD%`Tg5!9~phlTL564zhdGzb<F(3pt)clm4<_eJ5BcmOSx9@}~Fa
zH&m-_wYb{MC8R3aSuLaNIm@ng<KZhoca|j^3#Knoa862ICHmp9p!3a$2jw?+s$a;t
z>b$JXWnS+d6&{27zt3x#&-}PqtR^qed`J4x!-E@Kr$1Q0X>k1N?&JHfco{5KU4HY;
zLQ&1&Qp1=_eEyMU1?p-?v+r(uZ}=*LWvxX}x|4OY#MwXF!qV<ot_`l{+7)bOwc2{V
zVq0SW98Hle?)SHAq+B;WY`oT7ulTZ`Pm#-cm4&7A+GhT1G>+pc<uW#BwaVl;e$P7f
zL9<}XHfAl}CF?U?BR6)<QWib-Bl520w<*yX5sA#stlLDcO(;DTqY%Be$cJP5!A9T9
zJ>O5P_7;#>F*j_7<ASJW#@1aIt{Lp`>pY}4am9`$cQ$@MsPU1}=XlNBV>9DdXEuo0
zf3-Mc_El)D`IhZY><h%Y6GhKIQHz_Znwu;7w&7LUsjIyQKV7V`IU-u|=0sL-&aRKS
z!J^t$$-DDdp9;lwNwQD>T5{vC&bN}cY#!eo9^9y&mN-SOjeCZuuC!_Tok|xA-Z_(3
z-`+LXv_#M)F_iyL*aXoj-K@tA&h09>XmV3NBDyClYQvc|_VJ%Qwd3AQ(0`HsFlNHH
zmA09MUd4+V4cN>-%v=95Fm&@&kCSq2F09>i6^c(Bi?zPSl*`arFzwL;X5SSombTj-
zyRXtav&U|xu*8Qr?!bls&c)dwD`UgHu97M2WQfrW``Mdt(^>oOgNc$849a2^_b1me
zFIb}c$*bvTsrr^bv)pXNQsY_$k6T4@3LBRk+Ho>+kKO@m2F01rw);+;_r*1}^2#->
zR^4E$tg;*Ss?oRhZ0jvvUv~5Mhbv|azou*p+p*?=O7YH#Hn;sgU*YzC7S&{(d}`IL
zAdP&7lLo(~)|v1GO?0`wfcg209S!Mm-K#hjPfN0NbDULuzrw$1xn0<)^`6=fF6Un{
z-mvf1R<Rc`XAcKmlYHr={B=X{%E>RQI+x63d#!XVM$Nil^~zhZ@26FsatY4X^+-Dv
zb-MJ}C7!k3A}7vI|7R|2vhn}ifBzc)`TfxU_p|NZ&*0hTT>Z9rGCY#%d9Y~m!^Zdf
zKl;f|GswRG>Qf0%>ar~*kqfe8Vh_FFSa)Gtl=i*8YZI8PHgGkH@d|#(c4nVD|D1D+
zzUC3`y|qm9SgbRvuHVg_aqvxBx!k@#F(FQ2tz{SEHD7b7vRqm<UE{(f@p=6J_btep
zzVgJ1KU;ixYHlxdi4R&9=e<oMs4HvkHEXeT87oyz?s;dkd*PeYp3{2`_b6^w-Sv}y
zl3brDgByEuzX`vIEXO{}D?idbPF(DGR23T66zQq2rTkFP-uB##yJ79SET-(~IHTJ8
zGo35P<?PC+``n-IPl{M|F_j}r)yHst60=iW$_JJ1z<fpiO^L5ortGp<_FUTfl=?f5
z?R~vh%9Zw=6MR0cUeTAW>TkXT-y&73B|GcgjXan-ORtEC%A5L0xK&OJcr}YLAX{I1
z-m>YD2_i>gcQ6%R<}lw>u;6|3?qdrKrxnyso^q@E0nZjeH<hTLm6KlbysfzY{C>WH
z<K^AAo9h`K+}+2y+pMH|<>zw|FHAOj{SLT%^sHk2(dJXhb6ze`@RN+2Kgp*zgyAT=
z-_%DgNBO>;Sa@$*e%*ON7wfCbWENOmmRY^+!wlAvHqPSN)+TPOSKbu%`K*@pGS8j<
zGCpRqspd`PjjeN4_Hf>pu{i7#vQ1-^x~Y|G#3Yf06V@*0)#voAI*}<A@oCq!J3CHm
zZa%hio5d^k0%b#fi`~nna!(Le_;kud=f;}Gl_H${Q`t^UQCa+ULgZO*1H&p&W#${~
zYh&$d0xV4ymJ2WAT=q?52Jc++);;wVZ5OTnCfquGRP89|pNP4Q4kC+7Qh(V7omPFq
zwm3t1VcY4$;gTIe*@Dk*2&c|8zxH>#IOA7C{^-q#6M5g|_^vW4v0{`lw!gvM)Ntha
zGKQIFIb>vSNxj{6>#B_CqHldw2_OHIs=f}mo2&a~)h)BV_cyY$-V&@~+>oSgvL*P;
z{^z`oQ;c~Qx9Zu|bh_T0Ww2zruC`0zH`$_Za}O5;%*)a7TM(N+H#Yreu3GbA(aQcA
z^ZPc2M=feL(mK)AcYAAcoP6`f@=Y3!Lie9NHH~7{Pxv!$?PHbW@^{1SJ1jW=X0i(`
zGzykp$B=O_a%$hAIhPsEiIgQh+PR5)$+Jbr_gl3J`mM9Rd_(4ky5_=~cl_H!_dLGx
z@ywAO`3nyo5^=nxwK)ACqqxANGm24_7p4YRKNndTb8JfB{mG11e>`!W$&h?i`q`?D
zUHwhdx34;}ll`(6cV)>t--AlmYd7j=?Pt5XQLAFdt7}E)zP?+@dDi@O<bOV^)fxY%
zS?@i1a?L`yyqmMq#LEsI@8nvx_?oJR>o$qdlEtSEKG}WHIMn3pvjrVjo;mgv&3F>9
zV2W>6;_~e>SyxKhwDM0}tqj?7zU+c6o7>#r!f(%Z%QFTPtMzP5choJFaV|H!x7cLm
z#xplrSTvkZ?4Dp<c%b6o2O%l<nus=*CEI=_PwDXaDf%Ii>DjvPjr>0(c<e)D=4>i|
z`Y6%nX0Pbg3*GkXH_cvh#(0W@{p!UmAxgTT^Jd=eidV1-cz0>%VTspw?Ijkv7XRL)
z-B=OZQPhy_xhW=lMFn%{(nSK_ujPCZRsCx?J#4>p>;HrwUJuS)_jr5L==}Pn$yV~S
zH)@s_v^y9x{@$GTd{fI*mlOSGJhW2}Ebv{st!rEJn)%j?uk4($XVtotGpjo$e5`5`
z*|vC+)$}&q$G2)O#z`Gp<GFKY%v0CZ?#)wdIFGc{ZQCRewN>MZ%DY#MtL*mJZ2c;(
z#a5B0B^PtyOSM_iiMMa3$M-GQOU$oy5IMK_=*(3DfkMmFHfE^Knk1W^kf1YZw<L%B
z^>c2Kr%En59!PZ9_K9oa<C=X_)z<L6ZhGkO_u*fbEAsrp%4XYl$feHOVRcr$XBwvn
z<NvDWqzz%W52}=LTzbAk*i7a6zD}hu8QI%WPj<>zq)U3sPC2>5#4X}u(`18I$&AW1
z4Q;#{w>BMVjh`HlsbF|uP57|}%}v=SbUsBgFS`_S#=xT6<;8zrp`e<1=N&F7*8491
zVs>Xn_Y@A<CGVN|{jw&eEwN@7jji3B?vu|JC1qeX>-G1?!V-*S2MRb0mU^>Bth<)T
zsiT~-LUQA@n?+0GKB}Be<kfZa)?KBzG=<%LNeWBIQKr{kAM(yG+q{K8G;hC5gU7_g
zjgDHMYipaYGt8<wqm+JwbH%BBW}7CR-xatqB;=p&_juWt&pOm*Nz2q<l-wne{Oh;X
zdd=nl_qmg1$%hqXUHoA)>5bs?CYOC}ZDrf;U0y74ujB3`sqUxjvsVPT_^{oW@p@0R
zf$+h_tnq?NXCHaE(d}G@%Tq?F3mGRH=5+0R6M2TAZt7*LCC*PiOt3NN`+Vj%E1S*!
zwP#*DXzVPHx3m4bsr`Ot&#c7Ev$0j&o2LEaKg8wl?fq_7V`*J{ms0CK-kP4eY5&&G
z%U^Xdv_kj5J0C~gdm4O+ZrKqo3lFL*&a`fedB0m{iOZCC=Nslrh;h9?V(7Kvt?4S3
z4v*O!2IqHhP3H-bPb<C0sIMV^eDPwI_{53?ZH>!~6V&CCPDrHM1#uUP8_Y6Z|Ec8c
zNuOhSN@h_N+xPrGUVZGz!F>L+2P)WYP8qa4i<mWy?{<=LF8|~ew~P9C)fbiUAHJz9
zf38$*_RekFrJG8{WIV-7Kipnn*^y@-(B^CU%2FVYU*p=!xT60PH%@R{onGDW(lX&q
zFvF|VJZm@Othss1=f8K{_<FU``Pa;4pIu+bpFFIl@!ikFug6F9In%V7$cCjXO<fs*
zr8S55tf<`l=g96ok7F&ZE<Ls|Gu|OKo6CPo#_Wb!JZm$ioN=FU*{`d91Jfm!Bg#K|
zE!Tv5n;M5dbX#|D%YhR;SuVMp|CVU@Yb@R~+xF?J&-MpwKX3K=COzd(`!-JBleesV
z4xFr+TF5b3x#&?wcXhIZecQaIM8S0jgB{klP0lvDW3|}w3PbCW^ltb4xi5ORbQk=U
zoHcu8v%;-~l@FRr#hP=s?3LIPvN(S;>$OP-cYo8CY0jR&U-GKe?H~8^CD|{XZc1Ew
z@oV8<zpd^0`EqNXsZ17%RM~%P!9z_4h7fUuHSgc2E^KdS-*0;$ahv3wo8AW_N^ca@
zHhY~no4_V{b@99}_x2fD6qG)W&||3aT+#T|n_I+WqMT-4#gjFf{j(RYOqvkbCRzRL
z$cf8;ZttJEvY&fyY;sc0?8#XNd{#bEo8KGse8KHl_RJR%LVV`GG#|)UT?jA8_@s9F
zr@z19>B{XK;q%MXOc-_^Xq9-|yye;6o{T2p*^(`mdyZ!Cu9FbZIGvoRuC%l5xaTfg
zKKZ}{cIF><g<MX*v}0HLxARwyZ&Qf4o+BT1`@-&9lVYw&zV-dCsaBEH@WuM4(3IQy
zie1({<@`HT+dCSHR%hP{SMrWv-Sus2^yKV6w+a`o>bdo7yRgI5^`||yD3-MLs6~kL
z+-OUb)lFYE_wBo8tGPip<tzS~xfXMZe#%WdV9Z=w_T9nv@56!{XQL*y1-5Vcbo5M-
z|BuM>_l+{9q3p&}r^;X0UBA9j|M!mw+v1MwQ#DJ2g66$i)+KOro4<C>{VyNG)SW#a
zoE7vp2-)&f_xX(en)(-!Qa?U=eliJ`l`)!AX|Y}1)Z@d0#S8RyooGH;zW(H;3LpM;
zzFM){oQ`+j;d*d@{fbZ#8`Cb=$FurO9`c4oZF#g@g>A<5QiElkc?lmB*!godOmLhN
zeMaWoBAM+fet$~$TKwE>e`IRsoINt!-}mx}{JF8sIa+bvn+<9`w<H{<d`>@|mVCry
zfkXGK+{wS&<Bj88*I4`wIW~KV^u1z-gWqz`Is{jKJFd>ba&vp1&5O5}{x;v0<#c%G
z8}xTmZF%QP=Vvpj)vt8g=S^SM%;Eh+cgs_zJ~!#tk`Wopf8NQIxb=G8)k_=Clrv;b
z{<zEaz-+U7Y0B)6_k1|`VSYp9{e!jD=W`_THI5YeizP4DaJ!YLCcUtCp*8!pwx5@H
zTJK12t&WbE{xWVteN{Q1z``%z{Ph3K4?XfU?pWL|(Soaz>SD4xxcgSlELjzM{hgt(
zP;zLs{+9bMnZLdd-P?a~`R=fPD>+zy-TABAagwb>A*)~PkGSuZQ?rEjdAZ~+;EirK
zN%-J@{GUO<ft%9IuQg=7uHT%i**QP7_1qMzkHNY}@67+Vu;u{o$9sQ;|FG3nKG-{f
zTW;#}?@y*S><cdxjr!&BM6zkd!XK;aC*8BJ{c-jA-;Aa06_2khd+hw1@m_r=$ChcI
zn%7+|Sob+^*G)4G&!F!UZH^h-^7ekWCh+S+k+WBR*6rrYj@_8BEc#jHt)q7xHe46K
zd8sXN<^laUDfQpga&Fg^x;=eAt$4lF$RwWqrP$XUd)t4^RGo2Eh5z@Wz5ChxY~6!*
zY@Dw;eR;_@xrQsp-{dZy6e+vLiOV_HeVcjY$(C0U<tFBLCg^=%+_kCbvV$&Pp5?z~
z+&2!?i2q;7Uuf(1VDhJb4?q5O?vHh_e-kR3dP%DH(YZq=0WlkDCv>n{yvdrl+g#^z
z^H=%zmMmXB{D^NT`=7MsKj)qAk|(SFoizCy`=Vmq%Ny_g8AEq8eNl=`%2Q{X9vEr<
zCA+#l!XW72y`q&RGiS8;p5yb;32={Hzw+<Glor#a<!zrlnAS(>cYL{asz&(9d!2LT
ziQB|q+eb>Bh!H)uX7=h!|K4oBcm6`b-u>x2>(#fl%Q`gjF?X7tG^y@3OKV}xs&x{T
zxSVS%eOlr74Zjj8ul}1)jC$U%$?OYkZjGwGDb9P?&PG7?ZqV_4w<`}UI8wD*cR~N9
zCD&rYgDu+on${*B_0HJAx~?$OeMjEecTb(Guh0HD@!d{U&8_S85+5thb?aC*zf{@#
z2ZQ$9yUKssr?I}f#y*QJ>*KESyG@H^4o+ie?`2=`@%ZmF(Z#)I%hudcxclUlSxaN9
z*xp&ed-QZQxZ~2JGV~ra$=VqO)$n(??3oaA>+#-#UF(zH=D)rDJ7!{i+>C?UC!hZ7
zUovUAa833-(Hk=Uk8<4hm)`A{=#aMIEpUjAQ>!@fbNa!R`7*!m@3ITD&wp3`Y3p;g
z*jKx+bLLK%SSdTXRP^!%&T!tI^L0+av1;rYbN2r`b?j!##UoNRrMsu>`ds*8T~gfb
zZx?NiHvE2-sbBW$&3U~n<$De-+ui*x6`1xrzt7`Yr?zZ^_SbopNugJycM2X^?ptm2
zf1~A`+c)*Jmfzp)t2x=uxPOiJoxh6fb02rr@o!AMlddg2V|w$dm5oPc+1x4&yr(=_
z_WxPA548<-MhjvsYLB{mKg{P744+)R$3M%5-T&cPHh$}<EQwzy9XGsr&GdU-^xsUq
zH^JW>e&sg2vf4fGxY>?xYbS9@aR(dkyE5PB+SP20>f^@_UOD!Xul?zL|GAk#I(LpA
zTe?i--m5#DcV6gPGGBSfS#>v1k8$<$xu0&YJ77|tJEL^l-I813$18Vd?f$^!!pu|u
zdPk2l=dJdpDNb9$bw8}#-8|ve^yRwF`Ttx0#3*IoJF<A&!<*mRb8K(=mdOiD`LV@$
z;jBp&uPns*tTr+q*C^fLDC=afESRIp@#aF!(46%e;o3%5Z@o$1v#7b{ZXy?Z|F&?s
z+YM{}266daH)DNM(G{C@)!?XsOS$^F#GVT&B_}d9^c$>NI5nK!Hrc89nQm9PU}Y2U
z<2rlyoPz@Q4^EM>*l|3d_<7f=ebSSrsPx{>KEq~sa>orP&$z|m<^~f^e)P!=H*IF%
zS@C+$sxqI;?}|;*4;jaX%za{-IV)^h=JQV**C{`oVDoLxyycZ8cT*<B&DwsoiqF^L
z)2?4U^R}J|%gw*pdvfplJ%^bkxQ%ywE?v8=B0<D2c1~}5U$=E~@F|b^U0vT5+P3^;
zuPuwo^{gzmGZ48T8lZf6t!>c^IStPW+oxOozFhTT;yFIo_vt&vxAqyISf7`;{LJEW
zOEa$d^ko(AvWh#ibGO~SY3tHwt;;c6N%O`eN2#jA%w3beXcStlIjXfQYVmnlrq%9U
zH@|<`qQlG^`D)^~E2X|^<__MmCH(&<doriou;%*^{I9>UsjO4S<jnHi5FL@6*6Yez
z+fE3S>-Q$@QvG1lBX)tm@XpP=DH(g7tlW9__u5^-BFp%+!i&r2-Fb9ZCbE69)`jS*
zsXAs0LM`3w)@(LmcfNK1%=3>C$Cp2{E86wEZ@IbLe9z^-uCX~x(qdyf%V#EhGc7wP
zc+<;D<@3uNr-(}*_G(xd@NJ$cYw1*m2+oSE0;?ca-;+JZo&05fTUXTenbfb`!d?5c
zo%N8~^t@Z49`YM*yqqm|^s?N8EjjB~y}Z3)?$WP+7r%WJEj@9%?n<j^b~9#$1ef2K
zExe?5f35fCm)Y;%I?RbGDNwa|^+rY3hJRY6Ym-n(?)930qcLg=?mCA~+Wuoxtl4Jf
z#Ana%U7ssuZhLS`&OJTPPvvhC_b@&=SW~;St|2(~`l3}2&0XinJ*kY><>OhS%=gyV
z>&2tIw-e77{NsBdZhiV$S^3_?HRZ~_)#mE4_A-+XUPzgB`c9Gc^E=xZX6?~<uBq}#
z&gxd=@tJ-dIS$8tb_7|cs=era+c|5#-07K*J*-|wZs+K_+%xf)f7ALoVxRk3p2^v4
zHFdZcKUep}kv}u$TxwnKXYoO<@X{6KX=iyZ32I(vUf}eQx%ruHad>`0h;(S5Re-_#
zYX?(rX#_m=nfb88`Yprb6^Wdpagz_*DtRq!PL~v!Sg5J-d}5Nd(c&$sH4@LJ<?>1D
z`z&0-V5R$iYOvbcg8x=uT2um~8P*zfOO~%br~TcuWf$`_%@vyrw|g9L7TWeyr7f$j
zU;XwW_lXysPML>q{MO*kdEKQUbw<qk|10kvSJu0<XTpqnGp#rL*Y@^&js6zjmHY1h
z@$X?voxd;`3SIpA#$ig)OxgE7k>;;f-)Wr}yW{M%=&i=Pq&!QLZk*r3U3P!3MNs5w
z)%xW3uU7~*{AMcd*brDf|K+|7Pb_@4@I*yiDZSGhHL2sN0n5B>;|#ykKlx6oi}&8S
z?K^9)(u?R*f7(}`J1ZYqb1<ySJ5kFqsy$qI9{;fy@78n5c=OKp-uZ>;{<@4ae_f|t
z`g#AvCb#&fL5m;V>-?28*CIZ&a!SkA7rSPN2rgXU|9sw@1*Jba83nr5Yu|J0z9_OF
z+Vy+bm71xwb8nl!?|Bj6cW3o-<s}Ol*Lt>o(|o^da>tw5>MC~p$|<vE>|r(d_snzF
zmDz^#8XYYjPBdGT*H?JRTe{X}DU)Gx`K^X)7OOo11&>KcEebwlvNA!9wdPROoX=mw
z6Mc^xBwZ8osb-cEU}k1d`Lk5oiX%WSPx!U$l(Vi8*Ese4<abown{!0Vcv4ROw$-cO
ze4n0cu)}K6x$8y0eR?0SQL?zLo3s7YmP@<;q|ZHk>QGsqah1Y?y({k7_&;vkskO0m
zx$IJF_2Rj|7T)<8*M8JT!28*;oz3#j`Rr%;7k^)9@_wG;wc_mcItH113l^XD6|2y*
zS;Vftd)es|AIfed)onZ@yyD~E{`dO3m{t_u^Gfd&@}DVJIsJpU>rcU|V-*(BLd#Cp
zKXwvG2<iEGOLT_jhv_j7ug$EyV|~-*x6R&%7ymP$t{e(skDahqnt?$p4d(*Rg36MN
ze9&P-XW@qp3H)5ekf#x`ZL)7zxz}3xqOgzNsg>oElOhZ}_&nEmG#qp`@n8PG?yfEW
z7aq1LTkd(!U6sRmz{lU;fB*7yIo9do>;Kh#F`M1BN67uT@x<#lZG@kCeyEx3H~rCz
z%$k}H8WoW_WvSaDt{uGmSiPRlPS^E=Ux=&RnIl^xL}#0R;m(@4j-T&Y>PEgvDfh1U
zYEDu)ac%aZHO(gHyRFu4R$9-;cV)MxgDl&AhB=7=A%_=4nU!vnVq1Da_tjms)8dX%
ztn)>lL@?X@4q`sX@IKZsJ1j}!#Qo<#_XOzrUN&8{>y+Bu@2is*-WQcV<Xiu1qtMgr
ziH~ILE{NaFyOgqeW?t!3@!K{lr@c;^7L$9qh;eeo&5+WK|5*4JZJU4Y^UNPcJaGyv
zfB&vm5>JilzIl61)A7^0a+X=Vc(W<v)Jld5gY!mnox1ra#~<0!W<LG2h}4OfSzFSQ
zlo@L5&bG`v{CiPdtjW(eQ~z!IytS=e>cK0&hES&Ylh158WH2NBr;eb*dn5nwlR5S~
z&aR7NO4caQzoa!g?!szg)(4Ap#8P+3v298<YQHI}YT%@Fd+Q6QbmN0M?e}I273iAg
zC~8ig@+jVyO=O}sLxJngb6E={oUiJfUv}m}av5(5)4E+Ac6)xzPUrYnuK04DyYHOJ
zKLKmf7JWI$@Jy8R#Dy<hl{a*}^z06{Cl-AC_~z4_$NuRjkAC*ISIMtyYyJE1=kd+q
zCwKF&fAH}Va}g8E#fC-A40WF#En4y9%%?}a^A@W$)P3A^;<X90-{FaYPHk6y+U)lW
zzxk$eXGTE7Ld8Wk-e#^-PxO6?yxezS>)oj}d&F-m{*LaqJiV%9lhD(jF`pkEbny4&
zUNY~rb%1HZz0;|TT`Sy`mP+gsY<q1s>7Qsghgkhy_j$}4nO<4ncVIr-?Ei6jeaswH
z{d$Y)pU?jMjrY&+V~Ng^eN=JDAdN%i{+m#<wSpCY13%t%ynT6vnC9H+3qG>^&dTNw
zVmbUEG-~;tUjHdGIW|v|n`x0B|8>ikuSr^-ujcOCH%VCHXdr{BY|h!1M@Q%1&#7)u
z3O@d0zH-JEtLvIC<bQed>1Nu-E*0f?|ITLptCFo%n|sfk;_*un{&SPTeck~p?`xjn
zi#-F^9D7!L)hA6dV%I9Yv%7tqd|s6#er+*Jw)>VH(3w?Yl-1DW%-h#7t#vYkp~3p=
zE;G2;oxbX`?_{oQYffflWSxCahS@g!*f!<#Dz0z4OUwm>gcomNS>ABC-_k_->*>n|
z9DA+oSZ1)VEo6x>UwA~NMNj+6kp*#=e8ui<N-Nwvv+<5g>}#tB2l@n}=B;yOsxdjg
zPr;*V%`8j1dvY=wp}+n-j@M6ob1~FF|I`C6v73Qg8CNu~mauLXTl?{M-3bfbv(57|
z-T#L9uRp2$VWCk%=?15R-Ys8(ql7+pmWYWI7fe^teirO#W6YzLG|OzkzssTxxnkZK
zixg6O_yr${$eK?$rfb5M&SdxY#8ob%3(*b-a`tgw+NHPIGq|~H<*b)Nt)h~7D;$>n
z<k@3z;f3XcaBh(kTkfzX>}L89Hf@3BE7b)Y^(!wjY3?!nsz2Li=9>enHLlIhagAB?
zoWrL*sEfyZNoViz6QbKEX&D>xuQECRDmJ9^s*H_O$bxAiEk2vuZiw@~Qn2{N?PzVt
z!++!O@l}k`61+*QB^OTpl!@MQ*3&KFL<Mt+%jps=dEqbZW(H3?0vO!_cn>u$*AFPD
zkH2}~`t^m8F`ZH?CYr6D<-y2R9M^LwJ8;o~_T&vaUak^iwu_I^{c&~DB*g;#EWT##
zjmotiEUowF%+qFCs;>U=;wz#3ArC89{vKbfuAc0dK1IWFlWDdp<LMISWowzPG3lv3
zZkWPwyYI~uhWcwSf}(8ChCJQzOxnV@SE1I_ceNE4<Np9(D>pBXcBNVEmp=C7Gu)28
z;>z5u&(YJXy=Q8|CM`xuor4=$=1YW3XIiP4Rn+mvO6G<F$43)p#%t&NeFU%EoWAnK
z!R{p+xGfoE<=057-gtDn<Z8%+^Hx4fJ6tAPzL;UoQhZCbw_I+HS=j%}3O=)UamYqR
zIx`$+;!#p~JWFfg^~Vkj{OpNanfGqz<NwyX<klRE$tFIL46_f!f7ExK7A-V+n&hpx
zC+7lIe*SpjOHMj_(@oi_7v6keD%_H8#UES9zteGU(gL1aa&8SjwsY_aeoMUY#Gqa4
zhA8ja`nE2~{eR9ymK(7P>{)sKL3_8SQfK?NhqGmvzI~E5;W=P@Fla&J#LEFjGHWi&
z^6l5{uDR%*YgXN0tNW>P+lDCz9K#JYGg(*He0+S|*kCuqaTgK6mu>>rJ)*2-)fzL@
zrrYnUDE+tb@<9us6z?gUY<L^xPTu}p{(Sy{J@)%8-j_U%b6>8%=R||j@`sauMAq~y
zh?~2&?%(6v{^#TO*zOjd*s;LyimrO&?(T{9T{2&H271k$5ae&PA=PtH$*z=zlkM1Z
zBn<qeqc;9%$kwp8+E}i`t#X;qfqOxB;>*g5yEdtm>E7P*k)<Gmt)}f_x{dAu&DIDG
z=KZVM*f04kIUw}mwvsS|TU6i7du&GB9g>^8s(mNsIBVN5T<)HCziRu<*0tU}CnUZy
z+$a@kyBlIvzijR&*12vyyM>lJf1iANCd-K};g6n}FluJ5?D0QW{&KF$9fRGs0)yR{
zC&sefZIt8kC@W;poW6AF`m)4b9fzgX-hR1SJkR;UHt7iW%YL@y;!69y7^J86Wr;WL
zFSB0Dx@Yc8h9}2@>KC45S1~H!_D|9OUaNGF=k2{*J+JS{H#PJ5eSdi^V=6U&zIDHT
zS6^PoDbKH^ale1ByHs;=3HQVoOM~X#{r>M>vCr2RdS4#oZ}-to(z+XB|NVUX_G{<=
zZrCbQ{Nq>be~CQ(f9LLZCqF&<qD-Op;dj3%y+?(*rW-crAG3Y&VXjehgZMV<scFY8
zB-b0CX}dqO?Vst)^l9o+5f-O2-yHrSE!NG?yg#z_`?jZYPFr?sZS$NQtoPtc@XZwy
z*mV>8?`S5sawM+#yz=InmLBuaSxYCsl}diHd8(|Hrzlse)4a$;K1GXWMRDUVr$tn*
zXHHq~ek)pHv3c7(xn10~eT!!==so0o^Y4VDW@oc65AP;2THVg$`DScUmFd@)rg`nC
zY1QLfb7z_)1Z2PESDI(?YFas?ZZBVoY>x2;{=^pz_U-QuRNbg=`<u=4a~s2iJ31_^
z>kmii8M}O7cx*iTN;<m?-~Y%*-zATS#}!2dt1UY8$9L}9)~nuT?92-$dCyKtj@jnO
z5a)P;iT}?<?xWXBbB=zAX-<26R%=m2&5AauEf2DiHeC};sB^ikAs&5ag~Q?el!*M?
zhI3Jjr`@cW<v%?!h`x1}&yJx%#>!3bU++J@e{5|g%n1#btvo)gN<W`!Fd=S@=&zHC
z2|su7tahI+@@j^u=i=G78?}W_{JRo<tMkP{#mz-k&1D`<n!Xck=cqaP{A`PKd3?+F
zmTiy3iY*MSOdI!I%j7)2sZ?Z6O8uO4GuFg}9}H!uu1l1uUH{A3|2W_9gG5%?%oRQy
zI<{*6Yj$jDc5SZaby~38H?qmg^HY+V#PK5atzYl#c=6#!=g<2~mfzfd|I+R0ZcB|@
zCU5_^@Sk<ZL+2prx%bq!U8#26`g+stxi-#f-if=^1tbo?zV$0k{K5K9*Cw)`3OLzX
zCG(}vt8>MgX{Sy2`{QEY?BKQC`_l2_wZJM3xyvr9FW-kbZ(8Yo<O#cON}UgTT<L0u
zKF{t<2RRk<+3X8eO8piHonI%qN@|T`*j|f*H&@$jepsGPKPt98=%CX|N2Z9G53b(c
zzQR|v*uFb`_0<4Pm#UBDHNw#!9CRjay`yPrWXbhe#Mn}2QsAQv;lD&?WF1N9Gu(2^
ztE6_-3=5-$y)D7F{5w9{&sW+SeLTd@!EidG{$n*Cf5TnI-_OnLHWcAXn7{SFeD>&`
zRW~2hDZjh;`Rl{BCB_prs$I%_rQCG=#RVBQz14sAh*U0^^nWu$n`r8Xcb}F|cb;m?
zwfe!Mr;pG2J-hWtwdk<P?1t6s#~4a_o-HXq|Nq;=<UjBJ*#7BP)&Hh(fWP(8kw08+
z3s%&1J3lTtt#*E82;)oROtBr2Dow9-c!Ls_3w>WKpL?ogqn}`Kii*JOlLi(xCB+jS
zuyLL;2s7L@<F(23Jk1NMbPTOIEkb70>158IamVS=Rm(jqmzcVme3YG#^sK=>IO5F8
z*3|wb0TI2To~K{kV>|g}L(5^&^(OaScP-^v-KeaYzGvOK<%&P!e_0D%ap*mHtg)ri
zmFI=?OW9?AlAor!C-z8BT<Cx8gm%E8sTXdkPI)OX>*Gl)o4WswM`QEP$Im$tXKwN=
z*T^}K^F32+*Hi}fkBtXZGuD>~EU126eEF98<e9U6hF8c1dI;F4s9ldd^nJB#w$a)>
z_jelHUAQapmh-U>>nF6w+^XARa`oDoJ(<=okA?kMczbbM_G~+@YggA*Nl9H6({Vh+
z-@okB#}_xZXPe}<Z?WI&qxfh_<DHULYhj)<uRrhKZ*AS^A+|%FC1dxM#CvW&n=8#i
zZHw-R9qe^ESiJB-NAvkNR;Aa9V}i6b!~ADxYwt8%Bq`tDd_Ozm%cGMO7gV{|i#n{@
zU~waB(dB)5TG!4^f4A|(>?OC>svp(b*|s5f5~Gmyo9vof^<`qFn}U|i_;k%^X|4Sg
z=S)qdd9zth{yP0~^N-yZu6mX)YP#7kY9(|!hb>32Y+J3>BoEPm&N;PLI$cyImYN;Y
z(~#QG`}VixH7&s_+bl2swvG76Vb;9=U0$X3$w$cvPF6<`F<p@ITI`-`VP*F#@6Y)e
zb$4wf?e?Z}rLdjZ<rkjd{_5qWly|lck1IDv1+MO>-J&G3<)WBPy7`s)#<Q~Lv+tFX
zl}O!m)w7`Du-k6ip0|JR#eLhDH1)&&c}M;4^1k1_q4IRiTD~x`Ajc)e9^FDtC9yS3
z$$WL9+v+(Tm&MBc;N7skTPY%~JC(iGHmu-rUzPQPX+4W$pI9gu@Gy%?w_f$Dp8GFo
z%9g!>?sxw!*dK9O=l=C8mvX#n4nNj6S3mB*|IVrZ{SVc9RQJ1?d<t-Sy6NWR{}T_b
zxV&b~l75!;z7AVoCmgqy^<8AA8euZ&gocMxPest&h{IQmnCIj*ZVqwgJT-sKG|3Db
zNymt`Zso)|oF+|WCaqlSWRE0;O!fS{yk7L>!rr;cCZ;7?(#{vJAGn+%@~SH%=;D+)
zCTEu=SQy>8yDBPmiPnb2wRx8(=pUcZyDTWwn=va^tdUn{(buW{ug~<IEBo4ahCTaZ
zdiUoEsW(k(A}>g6IB<69-|zFZ(yHFSd-`UjCI3J59h^t2m`*PYT5x~&)l2_Wly4i#
zB&B`mH!`*eIxr=rKHuv=FGrcmg_}YPV<!Y$zuuPfT{)#l^3>e^@SOXbVk11KNs3*1
z@#y}}IU+hc_8Zu5`mxkE_tvC^47ZgU*-evvh!^IxeKNIBH9qXQ<8pj#>I2DU!9b2k
z-mBI*%iBMR`<3$h-<cfy{q6QU%D(Sj>A8ygdVTu6ME=A36SK;n9K5^8BwA4+=ixnF
z&-ZN$CC_Lxyko1Fedn60%NyU_-5K{v{UT=Quc>Mettt1e@Ugv6_~)&mC`;n|GVV+J
z#oym;3`ttvy>d5;RR8hvwD-MpHr*=MUA}`!eVbQ`*G*jm*^dkiXIa$l-#B))X{m%|
z=dmrR%aSY`I)CTpZdrUPxWs+cOR3Kb-1cYo&R@f5VyeE@D8u~bxBPv9cZ<@iw=TYH
zZFD*^+-cKy-n-w5dW9o)=){Le<eh2ko7yML{_T;W$y@$wvz$|uFWhZl;COU6cnQ1P
z+V0>V<~%w)fq8z;@8g6NB07cc$bX6R<6Zglc7Szx-_8&3?*CpIkjEu`GFj;QspkFr
zp8R{Z{P49fhi|1ef2BXErLSx^Ont3Zy?dpVwbd_0ZpE95qDmZdBZ67)Oh3{UX3A8$
zbw=~Kp1I$|OK(~$?`Y)<{LAZdY1PME?YptfX^h{e%=^kby*GciWb-=~<<&2E+D)S0
zI`3BCbvL+QB@rh-*;xBx@U<_Zc9VlG?tki%T6lcgua@&6o+q7-&C|5l8eA)CP(AUT
z%=`t1<+a$SJzeAUk@3asO}e3*LUOV`@w){z9Iq8FI<@=T)Gu4oC2t+Q`TpXpGM%f<
z$)4|KGJl#}Qq{U}yBlZytD@(<m!o#|@JuP&?vR$yY@SpeHqG_sN-m?tZ`ZR;a(;R2
z`{|H75+!-2UrZK+72Rgv|KiQzy_FZQ9KU<A-|y<3|FZtGn(nfHT53DB{o^xR_3yJk
zs@v4^R!a%>nk@J)FSBanOM?||H_|TE&YE-dirRs|t(HgL7A*`>xV!7qjs<_ao~@p`
z&#La2`vcB*jm3QdYP*z|vjxtVw5k99i&>|-`aEN|M`Bq0k7;RFt0c-k{+n0K(6Mjt
z8mU6&!_lA4pPu;iDxb%eZ#DCar-aP?vbpO0`W?&82+AM0BD!0C*VApX>Z@l>ySZ%I
zR(6xrt^1BC+W%Hs=G&W7uG#Q6EYfws&5d#?xg0ZVI~~4u7Bk3M=04@Q!u>9MZQbuf
z8qXN5RRiD7Sbp%L@cOy~%*|`qITQDF?^*6?)h<%KZPVS&9W2r7n9lKNELb7xueosk
z2Z#2hCI|hO2zU!kN)>(XxK(GCXx^{OavGb;UGt2hc;<dC*$~9eH`^;@)i#HpD<3dC
z+UDhW^}>=utvi#~v^aDnTwZiWO!9)_1jB?4M;~uW-RLQP<*AkT+=+AcIJmSf>pRZ>
z=;`8HHf>_5v5CAcA~(-{y72J~JM$@a*9dRp$+m|oHcu{H>moQ!<!Bd+)$KFWl%`1+
z-pxv#y{|OJ#56N2|6)^&>R!dOQP%G)<s;_HE<7foGJDyJ2g&IT#>*AidsePob9FAu
zzw+ZeX@>mX?`%c=w^yGz`L0y`S6ie;-p*{@JsN>euk0_hTN`nDx6~8;kVQ)aY|bx<
zSlK-<cvhXM$Lz<Kg~~0LZg}u9lee?t4v)iCCsrQ=Bi;oc%b1cFimbMuH0s};$~Ns-
zv*Dkq=O%G-RB@h~dWPw3*zr?EEwUmqFHiOOXGyv)R<qVVy=vp;h5z*!H6KQ*U!Ay9
z{gCZ)f8#QVUEeDbwlk#8eReY@#B}P{6+ZWSrQQehmRszz4Vo;nSz>*`t809j7Myk4
zdKH(?`jkDfY*zf=r}{5?qE3DEJ9hTW!)?_Cm1%q%etK=*Gx<`H>#HS~mp(ncKB?MP
z$?Jevn9q~TNz<NoU*53txqJP$qMiQ~RnpH^2}f2i@7(>u@A``yDG}E<xXt@rYmoG5
z$?xC|BALgN4Bm-}d1fZM$vs!;$)6f>XJ=Q!6~(+7|1Pfp#uaDkcS%0`eP!$W-xs<2
zEKimcR|#)R6RGjq{6*#At$U~VPkk$U$=bdAdc0rd|5P4<3D+X_%+%?A<n{B(WZ}vs
zrye)@Cmqk9n$DLNX#R4AZ1mbbIo8v=?uDrL%ja*8E|m|DnbLjSxbSa<vYF_=@{&Jq
zcH7%dTPS>wd4lg!?Y!UTZtM7~Fx-+@uC#2Cit&YIDs!t-*3_u{n!IQF+dCc?{Ff#z
zP1@+kIq7EK=~nLWIC1g(={HL{H{9Wx;@-GR$t(8NqAgbg4!fuv_<3M=n9ssHbCXXq
zovo}WIlSET*SC~2LQ8|DxOE5{nxA=}!BsD(Rh)V5%zyQJ?$fSMtaLoI=-g%J6Oyg^
z=kD*f`p=PKnX@&$$;pEGO1tBs*J}C!H&sHd#5KZlr01<F>@IRIw@WxKQEq7VtyUw-
zlXK7G<y}7N|C=JT&TcW~-ueB8<nrv(`EzIVEkAPgs_L~`)so{9C!Y8HkqEtgHSuCu
zca$6ZkxhOnyQZh!-R$?uX5;^7@`sP-6#J_#m=br_eMZ$@&oc~pA6!fI5|j^EKK#6G
zxlIMfCNqf(`W5d_J=${gkfyZh)E`R%ue>w<sh+m3TvqYIsw1~9-Cmr!XX*}~GxwH=
z{3}RU_Gsy5(?b8In=>p=J=6UWd0=A1GxcW=Ze015@F%$ESc%~qku7Iko^Ac|RF7|t
z((*6i7ae+5o;whJI6?JQz`4>!@p6;d55#r4Za;h(r{&HcCH$J<N%F<s;Om*&7QK<u
zlMQ<wWNYuEb$I%+06)H)A$oh(>{Abq*s|Pvs}0xxZM*aK`|<3W^*nsdtJtK39p~d~
zF4kSU9<gxQr_c-!(HDsf^*^_>Y+omqQj?dmKQAucPsCYp54Uney6C(V7u(3iYuD`Z
zvs$hD)AV^JPaOZs<mE+ka-$w4P8MS_h%r<>TCb(A_R4b6ji~;4w_k*K*68dldim(f
z)xxhbJKw9x-TcR3W%*q*?W3b%ZUk%B%4^2k@0aAwm)$b`O2CTut&5*a@Lj#P@!g_+
z_18hu>}%R*Ch7B(swTeJX>1aedg`zIgN?ci{?shDDYLzhamMZEW8rF%SWAKK*GZ+l
z&--t4ezclxzvb>NncDU#)qk0`e>%4Bc|p8R;-}wtx#bT3o!7idXR`RdB(6#C-IoOM
z@rN!x>=3u3HPcOg^+Tz@H{S#b@a|jnpzlbhyxO)2shd*$VlQ;A(Ukjt$b0bylW)>C
zg`v8ai<sY^mhm@w__1zAq%&u*&Af??2NO1kvHD3p+i}48SL2#Ff!DXVO8gX$uIOFU
zvLRe4zF}@f)5c#mKi2phO=siZwc`4DJN75vE|<0^>^czADLQTAQ_;8-S@w!AL6%BW
z4o+?MGn{ygp=-;ju#(*e)1R(scRzpV<8wvctNXhCv*_RMY-qhRGg*UYjvkACkEnym
zy|l{Dto*yzykyGVWvzI1mDI^)Z>pvl2mEhT&2C{6oHprN<_2BE2RfOmU0XTUCA8%V
zS>BH@@0`Vbuc9uI^<etuKu^6?x3#y+AIsat)FmAg2~6mePXAq4V)INVYmH%)=G{$e
z#kqG%s+w0j*B!bW-D7#px36S(na}avr_Hw*+8qBDvg>l2MAntvue@&`nZY{iY~qS_
zJ1j4jE>*}6{PB<Z>O428I)j@t+43H~T(JJpmg@@)IZgNVsGsi;eO~wc=BJBQOj4n&
z_k~+eO6&Y)?hiAp)Z4!0g3QOf<j0e@2fJ_ve%IRa^qq3@ED7UNw_9ztzqobN?J3*c
z#i_^lPBx!s&@v~-NN%H+#^U?;J680VKlpOwRkhMYGs)+<CX+H-D_4BtGB^0AyT10x
z=PuRx6NCQW%`CX{c=pXLmn8KnYC77}*Y>b3j-8TqF>mAKIW@mDE2DM9LMA)DKD1=w
z&XQ|cUxQ^Iyl!;fQ*&fav?J%VOzwL#-(UK$&g&X``34TJ>8I0VOG4Q4T{g!~ae5N?
zqkpsaN=qFP(>6149=6A|H<{bEt(~FsBzNIU)tPw@UTEDra^WJ=NpshpxW8>mEc>lq
z^)C7Kc#`$2+xdBsj=Ps-&bO1d36YGx=(<~~;$MzDbIsG12$S?HH_pDDySdra==75X
z=0Db^z5BHAxt?2T;gb6H)793>|0FIS$)7!ev2uIlo3-!1p1rWu-0so-46&Yn_Rp3w
zsCO2rEwSIo&=A+Sw7=r5pZPQC2bp`DnJc3dRu{g0yx+CN-IR}Av$H$w*%dwES67}m
zNM|Q|a%F8=a@wZw{^9s*hF@X=v>3IT81FRyXASUXM!LoL%#|>K|11m);k-D{geU+{
z^BL<ERQ5s-0(=+ms34!i-Zg8Tv$=%91wGH(3ckWu*mfP{;E1xiIY%`}VWmafg#Y^%
zYn+<$X5Wiu<$3RV%lYRg`<;06@6-Fu=WQ4lK73=vnpknn(f7pfNvhcvzjf{8=S<*^
zd?ymWmiOn|KVNSf|M}T`=DI_kqqk#FMN7;yRw-fTH4;2Vs@zVQVKcoLm$ry64QVq_
zT$0%4y^y`xZCSb1M5V{t`Ublvb&Dp>IwS2~_(oR5EbiR&-aFmv=kYx2&&yAZdMY6J
z{d-i(rRs<<8~?rkG8{hqJl*xoXYB!(CyOq*i5(BSuGG5x#IXP!!wL6v|F<4_vEtiD
zK^Bd+OXp)2-_1EIvc#@?W?*QN_JngOONA~7-sIRR8nT{y=B2Y@e_tQGvHV0UW2n}F
z`x4y@BCqG?<mk@Yl0N@l{oY+mwwF);^6d7Tj+>J*6@D8v^$VJ=4$69U&FP-^+xUE`
zr9vSGdGn5O)-(j2oSM|iw|Xth>GyMGtY=QFwE6%1Usqhsu3bBJ{`*uIB)<H%O88XC
zZ}Ls+=f<+Xzo(TkN&C_FoV$LvgIIev1aMt9zt7g}7<}}5y#2WoQ*_K!CU@m<i0{=B
zzH>)SYz>3Xl#Tc2x0ksZ<{X>fCRpeln_BksQ^UT=b25G3m8a<*l@>3)()^;rXoY#v
z-=~LVkKKP<YN9iD?$;W*{XdQEj&Bz+h)F6mbA9+e%%Y4h=){Kwg$H?;D)Ux~O$@$%
z_HuCeq>b5awI!{(a=nkQEm*(nx{H4y;|$MLk5~B^etEI;Z`ORpAF>x0ovX7b46CiY
zVtRUqgTl4yFJg@=md`QXxatPi3uTShm!iKswcR`|IOF7*ThgUVt0zxiHsyWQ4|!R+
zu%d61zwPGQ_gZfIw&m<w9jkLgT;yhM>be}b_mhrz{ex+4bzZ);LRL%WGJoPae|5*?
zEw^9r2ix)T`MX5SJFUCcC3fx0m{5bfi8syj1Xk&C`Z&2cm`ju<RW8vgj<`}f<9L~K
zH#1j7g@e*vtLAqH`8MpEb}JxfXCo7TgsdUk#}iXU$^wqE_L=KB91k-r>so6l_p9&k
z6rSK^+hiDTINsvi+0qkg*|$-Op(Xpuoy7NTDUmbVm_4){uYU=QtTQvczGdmf!sDrr
zIh3<3bM`ybsi>Y&pBh~|;qqLC`*+ln3Ou$?%qe@SxAt&$XHOVsg;wz~)@UVPt%Q!<
z?^B!G60M}vj*E)(uf6j%<D#Vj|F!EMc6b$ctm&%Gy*lBMw(1>2KF|I0UR}9zLt>|#
z`qZEs@meXj7MyBcYCZ4o!hH3G@n(n5J6k9$7uXwno$;Meq=?TFcf;x4J6C$`I?}XS
z*0u9i@2$giuNf*gPOFgaw!eG!nP6u7L5r4U{0C)M?DM#o?Y6VJ`D1ml)i&qNoKie9
zkKO#izSs7Z-j|E-4t8cd7WQssQS))&ax}j9T7TPu^WXMgVdt0h|7Ga3<Yn^f^!`SL
zN98AXn}=q-x)&V#{k8tm4AIQmtuwA^b$|YQvogif|8@T@r<J?8^Ow8J#=QA!8b0-a
z=k~>2g(-_{zq~npHJEAX-r4<|9u~iTb#!r$WqzqZ5PK!xo&87tIVH^(mhrsi<k+|U
zuX}-8bYJP3HFpXfT@>PuvIti^_5Sm1>NB=;AL9FYzeWFFGIQIx+(lmnu3mn=a4*Z_
z6Y{ri_B=^DWGa4RqRsJd+b&K2_~`4Ad$)3g-)`-AyzXCf^XiG(36nj(=am<9|B^>7
zIi=?;uTo@WU|?cmV35Rqv`S%#3Fsu92^;ec83?qM+aLAhQ4#9YSmdpuwROt2KyFr3
zXY0tYA~x?%**DxmwZCRbxmbN+<NtpD`T6IJHEZPUC!2>ZDx2{{G%F}*;n@fKM4$3a
z_Owc4o-zAd#?>-+1Ihb$oHjZ~EHakTvPsCjb*$JyL+aQPQ{DnS>sLBOe5*2hRRyA?
zg_iV`y}7d}dG!~umgYx2OKbea6P)=EJ-ieW+xz^BP;1({rHMYC8kZhr?|txj`q4k8
z@wVwaHLOaZvo35C`&+s2b9T33*tJ8J`m@`-7w<DWcjJBR&sQ&H(`<81?p!XBXy4-W
z@_T5M;PZ)xqxu%4pZ&GZV$a)<TK`}6c1^Y)nWLWD=b3$VE4wsz+0+$R&D|2et!JII
z`?Z_n%jR>h?#*lLzR8aouAk~A^bibJQ%Jb_9fpRh>?{x85UteC5ETtpr3_6aW}j(S
z=R|vV&b>9=>*>qFg4Jz}(l&SM=iASB|FE(0hfmy9v8{)ftO%Gqi7S_{eC>^QhBKE2
zn>Dp&`iH&!#<KaPFWXbO#MW~eD?W5=&6GaRxG+Ov@->qKJKwC>e8O_YGSg`e8Mz)4
zjBaf#?)F=I$y$K#l<~Ar%&`sSyTtjzm%YleSw3CEgj<(4*~@9>wD{So@izM6`bU3h
zra#aYSb3>s+twH7xnpCZdp73k&iTAaCq{~QYvH-N_gdHb^9|%P7JqEqR48+aYw7*)
zOxHQ?eA$+bji&Oy9(~xhuWjC!`WhzoNA6qB)!(uC>~`(-uT0gfuf2gY{$@8m`L-)C
z;Mao9RU6VDBz<E>4OgkjWp)~j3=G`((yJLbTm!ui8wfPq|E$edlfj*>!K^N#_F_&{
zNpX_=7tNNhyI5~6@m|;b^Yz&?$6hsmpU}Sh_q*MvMQhf`*<B9b>h{(^SL@1>tX8x3
z-G1w~&*-Z>wk{!US99oW-Gdg==>d6yVlR5yxW3<*vF@vkz^Q2)Z_N^GSyBB;my2=L
z+aA>kQPPt@>2=B?=jC76mNb8ADcrc&_=Df~OAil))HW}FwNqqL>pI@#Rc(`|$FJTw
z!}ff-{?SjG=?|0zVltg>M}B!fQ%_Ix*tOo0bGy|N(`>e=S^ky{)serSV71}c#Xhx*
z9E*D5?|;zoa*A)=Y9Ev7>U4x}b`=YAt(}N^;>l#5-aqv<EY?ERTh9G|Q1Ynv%?j%>
z?VBs|dz|0Lb1&IG{dUtO@v7DA;_P~fXoqX%hdSJ_m0)0K55jr&Xi+KnWUZ|>Z;Nib
zP5S>;r1%p*gJI{^&C~B{-_uHsoFp5Ua#H=|$y`Gn7M3<8C4mQzoQ1-lvhTXSLw)zV
zdHiR196ZZ5t#M&%oH=jazjyQ4;y0Y`KmOm??yOMUl^Pr0%8Mzdd%}gwc63e_m9LlH
zcdPnf->I|PPOS^){k{Kx>ivDczFn30S95%s>*3;xh}=_Jd7C!fxE&q#be8MIO}V$a
z+yzfx`>-alFmMVl@5=8_)~<ON8a!?1zQ9+jyH>AG+kLVtTkQH9uS0R4cj<`bPFtSH
zb~=1^*WvrFF`o^day|+S+Zy#vwqLN{xK2I2{ng2nwan3MHFi@nXMYwH{vTH$5&uWz
z`PzM^y3>}<S(7d-RJl!JV`*I6>g6p{r5^3qoqaWP+loh8kH2>8J=z{#SbBE0pmo;k
zWij3PmzAD=S9a)7&lT1e5O-MDHMwp1^X~f<mkzx7zURRP(|PmKN{w$NJIf2d;HW5;
zejZsB5xYJ6f!2W^>vu?PJiRPSc!_6K<hIbJ8L{ggaWN{dik4xl@p^LI;jOOb_1QYl
zL+{3B-eX$)co$pVwZK_dceI*BO$!a#-t8Ouh|f)@zdL)!#+bD4d%_%e+1d_d$~7KQ
zH9t|{>T>Jl$CJk=Z+<*^^Wv8$Q@=buuUuwj``hqWW!2Z_k8j&QUl#sV_4Dw<qbCbX
ztZKRA_1)jRdh+SizOHlU79Z~ZKE0{$`TTWub-Na=yu5kwW&h*q7e9V^^yI~>KTOw{
zE1u8S>q~ezpHDwS$Xc7bj`c=gM3{?dzLJv3sk?Co8;nJKx6WU@DdQ1OMCa$g4Q@-E
zi=LdUJ!HN@S^3*z*$sg_4u_Up<h{4z>UQ5q_ea%%bvoIFJ0D)P%64$e_@pqg_jORm
zv_o%puvD&=HudD(5w@hKgyp?dMBS6C>>GqOD4O#BsEs}P`c}y1RUM!EAK3}Me<GJ6
zG2@NR?c1lPz0un9>-X`=FJ81yUM#;n{k{4T#pvSJutigf9<N+mb6M%+?J4r<q8C_Q
zBu~c9UTj^s&LR8C7VaH(ll;$I)VyDC;gS-g?=_a-@7t93dapEj7SjAkw&>S2VP)3K
z7k_#FdoN*c629X5mK$4E{C;%1^7e!4=?;ZU9&@=Kp7C_k&p*?`L#GuTJtfP{^J>Qy
zXZxd~?*uHjUOy}T&HmA;sB(#gax&=|QGOREAK5vhR3mW%^Ayz`3_JEMe^=EgG4)Bp
zh8w%Lc}#e^!#Y05qK5lbm-&I1mXy-XDa)3fZ|*ePYf-_Jd_kd{`Ac$e%9jnRKLj(*
zo?)wG{h7}t%w1Z+Yu@LYLt+m!zfQK%&Rev5O=RW?uVc^8%?O?O*`00S2ls1!ua?c?
zmQpO8AmHFRIl$Oe<4@D?d9N>CYTF@fH9_{~{WRCAv)u8U1vRXFqGqj~r^0+9tB7+h
zyLd?Bi)m9mD-O%e5O$FKA`l$E%TP7*Ov^#9b9*(Ie@A?Hv98NpnrFrt#d?PC7ZbOA
zG%b8T=S}XM^GjBo-*ZITQ2%C*P4Y3P3nomlE}?}HyUIUu?wMcI_-kRANpZq$p97b^
z|IxefVatjNw;vZjr`Pp;<h-P0(Dv|b&Q9AMs}$C}%3EF|xxKR3V79b*_5)@64{_}R
zm8+JDtl={}AHb);nswacaJBez({{@Z**jSEj8-Ymcv|{=MQuZ}VAw}C0eR0$XPz@k
z*XQ#&IdL&F%+u1_W~cW$+-6N>jH>qjPj!s1HvCpd5cs#DdV;}})WaDeB5_9fy?*RU
zNz*u(j2acZqtDF}dcoQk<8pdU%%o|{QXjpQR50LRT*lSw6e^r|vHVfg(y-sZf4ArO
zZjad9CC%2Rxb|k(bA{bGoKl)$&U*@X3aE9=yu7*mxq?)z&YQ^^3;yio+W%YIi1UW5
z{wAB>>i!c8*FT7JC{|XTq+-MCx=eWbqUuuu2gTIgJPeJGSuQ*z)4EmqrLv(*jM`i4
zO}0$DXJ=`A%ATih7<RcXBWYJcl9Aur9U<EtMC>_CS(5WE^fGN&cu(<<wMM{Rh7&!X
zWw(3YRyvj?yj7&@`9h7E^R{%yho#;vS)m=J_T>L037OgHZl?EM2pSk~yk@iEz|G$#
z7M$J{tZJ=4uQ~f<-W3oDzLz3%CE(svGf(DY?vvB?lP?~T>-cEi!S_q%N>%lhS>~&a
z)*dcnjynIBJ=>ALcB;9c^2b|#tM`Od7@IoPm9lx7Tv7OWRg&dmkkH!4OSG=;c;{#S
zWwYY$9YHK-BB!^C#D`o|iYxwPyrhsfMtb81kKJcimrX8CJlV6P*lyCpCr3V=yL7D6
za#@a+`T9c*mB;lq@M_7Y8XC?JNShQdvg7C*tKCmqYrOamojd&a6_2g%=?DMCw(vYV
zEWRN|b9r_4rmiQGZwk4HB;62`dB@AHt(F}4M?*i7do`QF!>09tu{*BV7}}<UujV=M
zX~%@*?oCn6|8HbP+}@PB`o}aK0|Q1L?(BD72@+OPH&)$nJ!|kGX~NZ1PQT+{BY5W+
z9u}Wiq^zLAk$bKqzwYnX@KfvG81QUb>yfj=EnKGU;U04axhqrVJr?JYsENLG#UlU8
zW)8JK?=m-BcXv8g5W{`A&o$%0=I~4YnoDPHm}xF2-0)Mu?8l4jYj0m`yod@`OXbV<
zI-j~GeZ!LI*($96n7<i`Fn8!jJzRINC->&ZqxZL(EUaaW+<S1(hQ!xqk%oMe4(<-v
zAgs1l!~YahK>QNReb>cIKPLFB;NS3C+cil|(!{5hi?M@M@9NiGW^b>Uw(-7-V)K-A
zDQQr2DXnvM)ew|5U9tGmv4%-M=J{nMOuT8sA+ua8{ejP&MbirMnpWs6R8m&8b8=7A
zUAiUi!|w}+Y+l8;OlNC<CcC54`+S^aqOHmjt1=^=T~fcQ^744YjnZ0jc?<PFow?sw
zvH#Z-{k`6NjhUy+Qs;J7xJjE%NoQf-nDS%6oJ;BU2_l#Dwm3V;1nu;0{vo41`w)wa
zhtYYPQ(Dht72`G}&nqs`J9=%yvhq1gQy-eX(POhQizxD0>)|OSlKJPU)wgvUW26sl
zat(_)Y}fCt6ftL+kI%iGw!LlX?(TP;5|3Vgs{373s<HXD(BHGylhv2i8`eoi7WF2#
z9ZlPR_?X<ECfR4Ex3m}8S(#0Kn>ERl^_bL$bjj+IJdH9^7j0c@Pb=gpP7>L`w<~hL
z^lJ~D2^RxyMWoDBP}b~r-VtePnial%C-Zs64;E&xHm|6tN#=TdevYV2>&_I30Ov~~
ziCb8^?uLn8a67`Vb&?;K;+D&eYZD!mVmLe{T+9V79!%iyveH-du8qC&?pXZ1uKNlZ
z_jCRp_%d~yQlt!fU53B4(UF3dM9utJYt7#u4!j|(^U#FX_~`p3g`FmsmL1hx{l<!U
zvS8$kS*LtcqPF|$w62M3T(0|GLGoUTLwcZ-gWG3|)|&Fk&UroWruL-wa7bJ@b7evM
ztuxA%Cy)BQ;Ym!`5V>uk<X*!=>Jg7mXfw=gZ?xGK^ZcV+<mtlhV@}7uEDu*?|MtXa
z?(ElVl^G;N*VSYgcJT>adCbwhci!4J=H)B+72+e6SOpRvFYVwFmyA0dBdGuS(vL~U
zuEs7q9qn*?UZuc?>I~lKM!Rq3<!!=?m{&7?H0xQZe6y<U)Z+4USD3Ao%AaoCxpGr~
zahRHY);-5|r|tcEO9Q4I)v7q9+-NCwktgP<PHwhLhN9?`;QMom*7j*MD@HTEp8v)}
z<3g+D>h0Yo!I60xa>}z7f9NRG)p97ySzW|0z0B^1%sF2j;bncXy5B^%M}~^M;C;)!
zt0Rf|jbV<$+X+Ya<h}5aOmsYK{;hC+$1&&3Gk1CH4VH6g$SyoP^Vc);UpXQ7i_S-V
zW&V7|^vU*AzJ-0Et9kEi{N%FD{D=LUgZCp^GYjoEXen-D`LsJ*Zr8nw*00~|v<MvY
zV7t!TWMfpbRZn(hRPXZ0#T$b)N_>tR3aj;pakNBEI-FwkDt-UnLZcrYT}G`_YZ}Yj
z(-wR*xooAFxA*O7rdMZfsa~sja>qPYzE#9AREBx8j^wY7J!Q@Nol?F&*>~mE^B?D@
z-IFc)wZr96`imHrk0t)DH#YOT-8i>daNFYw7Q0^}j}soG9QJq~8#-yqAEVr$(l^Iv
zxjgHece41v^Ods_J*Qrp**Up@vF+_qrsANfrLq@0_v;%q{4?OWsa&_7|HU8Kb;=SR
z2NhnQQaJkI)$APSzwT4cdjEPEEOn@f^R<7wslo%*TNWux=SJ8rt@wPv$HH%8P(!2P
z*1i)mQelg<RBkj(k`vOay5<ld@n~PJy6l%@-5Fc!lD@=7-feI<D=Moz&Jj@Mf9KHO
z;@lOPdTeJ_IBJ~eQH<}ny)0(2MUZ9L#?W@p|0nY-?lY`yXf|EF*_7k!x;ZQ7?~y*;
zQJpMP*-(1$uW!s%o4eu$+uxXVcPgu>zS8NvI@=~&A@A5NGp&{KEo?rErDCVNk<aav
zHSF>8yS5<H^s~8lop``4j+OpBl{@A1rrcxs&gtWGbqnhSZh=z)F)mf?FEdzG4sEi~
z*`aAX@$_*{v1$qa_0GHV&ou0O;CbiTltqlM%?mdl+Vm%E$_$I$nx}Rvy;-$1WK}}<
z8>t@OIkPwO&L~*E=t}tfy08f<+J$Z@+;PmC3%5Vu5dB;clkd8$zjF~Ie~t*RMt6<$
ztg^!o*ROr@w<VJGPSZ)bmIrd558ZEwsS`Jg|5U$a!u5%%M;dN23bTZ%`n@{1SX+B(
z@aphf!?3^H(N4}zoH>g-tdy75Y&*Q}>_qi%JJssuS;)xrWVfGZefo>RTjpcp0`2!d
zZHwQCEd4UG%-*#6-aWoM=Zxb06ip7ineEA4_lvzRe$$P2>rC&joW;C=WB1}IsnuLN
zqIa7n9ylP@lDwfHd;6oG-ujxiZBzwL^N6?>vR{7JF56w7_UVvG`Ki;s5!cUsKF+rC
znb>ZF(k0h6`@E05d7_PVi=dlTry0ALmP@6Tc$nvo$az7fdf7Y{GYtd{n0C(!&fRqO
z1@l|)gZT#?5>qZNP`|0a>CyIz{qA!D*mY#RoLPSd9Oq%LdbfFTp{b+$!(G=uzg!VH
z*PEYpeVo$o3c3EEvp+6(1vNV^sJHR3KCvusZMxgdeHr0fXD@rpm$Te@_x(cK3yX5i
zBf4cLI(Pl3x|~ybe`4pObqaOmH{u(oGm1~J>Tg@Q&db4}a{i;zt8;i(ylnY>f2HSg
zZ|OVRQvWY}t^QkvNB@b*^jg#9vRitNvdvn*_7dZx+n;_tc(}1u-N#I!)=Z&X_MX4j
z&4m2<%B3F99p$RuIdn5R&nfwIHE!jTQ1?Z8{gc;JxXGzMx#x2><^I#)l{f$W`*%L+
zJp=dL2~i@+?p;-l^B0vbezvf(=$z|wwxhX9&!!w+S-MMYad%?k&XoPTWM|)gCleX|
z;EEwbPyEsCEL)arw(l@ioR=S#Dk{9;<Cp921awTw7p)Ix=xFY%5q7*5%>UCgP_ic_
zMA9_X<*agD`K$)F6X&k!8J=6tR{2TcQ^B<?$>R;yzO1(ja&HMPUf|a`<8uG1Q=26g
z?K*pu$=sIFu;AFj&;A=#{G{vNnDEA^os+jQczrGCVb-rXH@xyr%t#jCjn`1xbZ44m
z%KNvAmfesFVlr5<)j~!{h-Hxy|CBRtUjF$}<K$>2zWks{CIkN`A%R;Pd$J#Foc{dL
z7rnFzGO62RRy4Owol*L)PLwf8q~SV)@Ji>tMc%1gyH`%Qb#gO9_ZP`YaR-jH>3ifT
zIY04T`KnZ}y0~3be+%2OpRs#XkFI9@Hbpn^RQPf4RXz#lraPQCdMwy#?G}a7jMZBI
za$fc>=l?!`@48%5ZpUw}QZ5;>f90xwZ*jWi!P+$U$H9!_602@^C?34??sUa3U#0!^
zY8U*?)OMS#xx6-c!>)Y$z29Z}5<f?7e5`VwZPm}&MYpCLy}@Yut9ivg{e^!F>WY#V
z^iMp)vUCl*t<x1Y#U~F>3Gn7j4t{T9`9spky7Yqdsn2o&mv`B5-D$afdfnM$_a6G}
zviFe`@HwFLv#Y0XjzW@?H*4WsA${{Dv%XJya@Tg_rhAu;bJ^>c6!FabD>X-G*{2`+
zGdO&t3cfAU$xFC<?@mU`|BqbRwXak+d{CBf?2tUTi^qFO@g|Ma%C<}sYdk_6dTyL{
zOo-?@xVA6#;bqp835oZ_JH+4QzX|<u{km{j<hshqYgd|vgsk{xd~um7S1HpGJFB;h
z8e8YBP2X!UJMugGvzmH^>1>~-ivCcyoX8aZtTj=i<nBF%-?J_9EcR5?7k%App7`6K
zVE^hBUjyV$zLK3jA$!Yg3Fd{Hk9^}}V_>^5dr`MQtIL~U7j?#uvb(x{tO6z^-eFL?
zb0e=$^~mitIoZq3-DwZGRo$N<mbHD+LCz=a=DVtevu<o?vb)Li?uVNoe+m1UC!aJG
zPE_((mhEXcAXi<eyj?Ih?~sY&x*L6WqAoXt-n=?xU8u)8?`0x4uEwjHY;fj&=b2e#
z&GJ^fH|I)dgLOi9YVkq|K|Suxi8oCbarOL9l`MXL^-=8JNzA(KrzB?S-gonUII-_8
zw_=Wxy@RCi``T~Pyw!#)eHoW*^Z0fkG;#OR$RA-7!(z8*UyZ8!@@eUuZrKNxVmmY=
zSao^AXZv>KCMk*N@&@c#(Wt=W6qDl`<+9aUr!IMWb?ZzY_BlmMx{|Llbw?<?o~yMw
z<-SGR#h?2_J+3gb%ZmRfZwR=iIPHtG)v|`@kU89G>z{AFK6&SAISbY=SF1X!)$ZB9
ze%;il##>m#%K46A-nu>NX}gQtKlQjvN7{>)_$WT<teIaoRmAsci){e&(%O5>bCx72
zZVYBCJHv5K^SrR{U4?H8#4_BDI<^+tIjOBbZM;ULd5QnS9}BkqiM;ysj>LB1Y(d%C
zr)G6L(roL_FukyU&Gy;3?v{I;b*KGe7eAE3YPqXt$@<Slg3pyc9riP5<(cc%x9bb*
z#~YSi6JBi3j;ft0Q0l+&)ED(%)^^LXe_8)?xjx_KdV;{is*BY*?b&k=cvRk&{JZ+V
zZRz{LJ6}KbR-bC$q9Qw2W0mqG^P`)MEAMy}^l&j-=Sb=NzW7;7@0E;ydi^ewsqx*j
zKFz=TGWX!eDeGTOE0mr5LB7A6yXT|aWZsH(uL_x)9GAaddDW`A+vMeE!S=)hI&2T!
zK6Y$5uf4kd=46&hrnCFpc62l-o)GlDH7PsCsO0`6iG{%duWR=xFJ=vAsnq)J>-iyZ
zWq$n3=bx0f^~|=IzV%k)8Z*_y&X?yU)?^&ljNh^$UZ?IPGk<i`hftw!!C~7A`TREd
zZr-FX<)0J!+r7v(!l7H&aMN{RQ{(*W-yY~oR=Nw_*#D5b_JLkm_Jk`ACt?!+9Ay5p
z(Pw$A+1vfAbHkS}`F(Wuskxoe&%DoGxteKLlD)ZjyI)c0GF9)@MT=dWRx)!oN~&CY
z%ND=s;={FE=l;ETAmH$)&qCny%>6ayOY(kH>MZ+}IwNI&1<(DA=*#O}Ph9W5+Bngw
zc15Uw$+4q`=d^yv23T)U&Ohm-D(+u!>SX@!Lznh8<<%%eKl*N<<h)z@`J!&w^xmV@
z{*O~1mc^gUJh#B`m~{qs$`j}1zyCUQ>P<S}lz-&n!Pn+}dXl>)uL%zIyf^ptrs;3Q
zxepvLyYF*8VWoLeeURX<+rNsQ#DAUeKJoDu=RGoy&c5U7oH;Ks<;j!xBK(d&7+Z?o
zoU$^F`4s--kF8J0z0{<G!Bwr9=29%Tzid;poh)=ovOq#{$9<_q_7A%?-%eY9?53TB
zeXac(HoHeXPwPyKtaCo<?OGYzXTs9#XR$Eb<l`H5p-DoFm1Z{bGFK{_4jykf%Px4K
z_DBAo<5OPnzkhM=<H_UYmoHB?4|}jQxO#I*dibnq^J-pau6Z+w=Z^Ewx{mjMImJ8n
z9I#z8d7;UxBOioAJ>)8~zSZpB^m>oK<|XszQ^Ie#f8SBi{PINO_h*k^KK%0L&4<G$
zXB(83#O~2i;GW9<>Asvytdgz4{vEw<Px9JW30P0MALCIPl={S!&!#e~FH!o^tV>c;
z!nN+%)NG5Je|5TbwPeW2tYurLKYK7c?Z+v9ox0adi%c)Xmbk5wWchvXl^d&d$jz*W
z-7=|L?O22sy|OsHVI$A%L<P>~k6VOGSFAgimHO1@$+f@V(jNELzAE@veEs2@Kc}Ys
zPxxolRWs35UM7d}gxj7IPNITUy+`XRPYBOZJNCAR(KUK`RP(+S$9%uW?o)a)^^>`3
z%AtVj`SRIkx0!kIvTT1;K7()0d|T;PSL7Hz_WpjIy~uu%Xy%TKlHKe#@1D_r?fLG1
z(v*u0Ywl%jlA88%&+T28XNIQ!Jn~VYlv!z(M&ORyoTt}yU*g~@-}kDelQ}O_r{kjy
z!!G8+@7)fM+Ify}2hY0ldEZwNF1eY{Zz{<MD5q>m*q$<T?bdVpjNk4BP0aOs<X-w=
zdf+CB`p>Tati1lahwh4BDtKgCLXZ4vLF4AV|JhOJbgU}uR-a;JV3@#<bJC$WGdD%A
zpmHmG>BhmW@+w=qrY)0YlQ?nV%GWSueciO}*@+TN%5!rM3B8;+Wv<SN`uh{7=$tAP
zN;tryvg}Cv_qy{J^-umdef+(<xDNBW2N_eCujia|_;&K<tTb;6E6=`a{gV!B@>QdC
zOf4<zK5Ng^X^d$Sn)75sqthC18+Vfno379H4xD5%H+<Km3CmihW-FR5oWt#FDjf5*
z>Z^6_?z9@m6-twT#Y{5!aj8T9Myby!C!KHQ>$St4oIUL`B|EGk<m|fzbr%^Vt}9#@
z`cU6wrRaKm)6~FN`5y+J$LH_=XDQKl`SboHqj__D-I~87ePNV8&b}ljnAMYS=7f;$
zu=hWwojTfa-qq)tg7-4hC*S6F^{$_=JbPi#|H{;I>F3gxhoyU89teo-+M}hQ_U^XF
zu^VSks?7ZJ!^nqyep~bBi&y3U${q9%Z?QH!*3rEE_3sM`?r&Gmu&DNN3yV%(SoP$?
zLxVn7RpWsBD@=maI9}fT9O*b!iMiSCe%sb3M<kAK;x6lbaeKx41!8f_*WXv$bW`i}
z?0<@;XZHntxbyF1al`iW4D;L%>^48IG|#L#Z{9cI@AJhDIDTkukSqKAe)0S1&Q71_
z%n_ZHt8n<;k+0j|@84tTS+)3MfsxvBl`V&ucq#>UtKNF6>%Zsg?XtU-2Rwf8?^e#(
zzx~c$v#`fjPTH|&dm?A<4&wVhYmw%Ri&x*zzj$Mt^PvQrU4JBws95;jQ>=ct>XFyw
z*Gzuuo0?9{J)PL6bJXH;rj(Y(GsBOscE8{5dL`dDJTbXFaFg}Rxt&oWUEW?7yeF<+
z67~E>%fq{Q*Q>Ik)n8bzsO>0k_<ifh_t<kB%&iv-5=y*YMm?^c@3m_|pWpYJg&`6q
zwQYxHxpjB8?AKOPEZ=CQ^6=^w=jog|E*l#sTo&@1$s{}b#-&vkmWMYvyF6ps$#y@v
zrgQDun~5v0D6MQP<(#4L^x}~d>h^P!6n8G-<Lg@Js<<ulXn0J{&d-f|ROA&FPi5M~
z%A(<zG3{W~`<0!AtFBCL&EOHraGh4d%)&0dlkLH@8C*W4h2A{(86O>y+xY*Dx^m&q
zo3mLT&XxZeZl>}hS5*DlyO7K|HCrcCKRz&XW0aHT1)04mr}!kC)}J-zGJaehe%0)I
zsi(Fv!>@lP9i4)=%#D{gr7w$c+uZj3H?O<<lNaVLF$PPQPky3(eBJD8{pZf`m7h-%
z-<qQEV~(y?=J7x7t6t_@+t$a@YI;%K|HMJNdFO6fHe}vcy&dA3o1*@DQc~tyJ?_rE
zQ+V=y$}Y0Fvo6_kZ*ok-rkzLB%C7V8Il5<s=pF^_9e25AvIk~6C>ljw$#l5Aq3!U7
zli{-upUAFx?RQI!-`{sqkCrSO`*At319w;Xn{E3NZm3sQr{?3l^3aKv#MHOPbnh>!
zJ|C2_z;d@^Zd!7cO|^k{;pw@vwzd7%uya469LZzr%0Fx8>^`emYt5SHmMXmPYfkEt
z=z3xQB6*9uah&7&>$Tau{;v<1)v4TA>2W;bL};3iU*J+@pT#z}!tYJ|w1V~7rI`=n
zE%>GKa$dPjv{wGHPkzVl%%&Vkw($9Xohoh#ZaMU%`1yfJtF|0@mT+vvDU;1ywZ^aQ
z{2KCSh}>aN^7-^X|7-o!y%Rj9Cw@q_xF?>krF-+jBBnJ*{L}BZWje&&?mFa{nZ7!)
z(cnNfb7f56qw<wM6OP~fS#Yc5P`1z;mG{bf`|iCD|D(HcAMav!KcCw-llgX+UKd!B
zwI}TA$<22&+Wh#0)<;(Q-bl;PX=U<uu$ZPIrE8|+?yz*%D$V!>Jt8|Z_dhrr<|^L6
zl2~IptLa>1;1jVcTTb^WKXmh+mDsIOA~SR4SN(6IWz7x6Tb0*p|1Dj<TCRJZ`kf=|
zl|MOJ>E3^I_r(8;i9a<<H(QqIP7Do7vR)GN#NyVWU3^J%lmmTg&hwp_y;rJ;S!-cL
zn~nLTJ+)WjJ^hyP3Ewt4=9zkI?M@D(s15ZC_VJXx?@ODsZF|J^O<PUg7rpj#+gp!z
zlkYac2Xn4*GB9ZCFyOl2r#Qc~C^@w_6?Ci9QK{Q`w=KTK#yf7|pT-b+LgYrf>4c*t
zleP$NnJgx)pC+ECU?4U%L)$xQV%8(gU+=5=^p!MEt}9+EFBDtBcmA*2UX|zb`~LrZ
z<-9RTG=06FaagC4euTApzSOQ=Y3t+E*$;Xbg_zIYwquvrldlK$>(#rn-To!)S?6(V
z-=<A@*BIPc7Qa?Fal6X*lF56Q>zhnekM3F-?U)gIwW({-x{3wzoxZ^#;Vng*E+lkD
z))r|uC`9~mpIfTh-TCYP$4~onR3EGp{<0~hx&70-EvK@3*BmdqDVl0lGh<_0=z;gE
z5^8?r_3oK^bZKQ=NYhr|(+}ROK0Twu&CIla)xVJ9TX7#H^zPq3q5bpG6{op()<ra*
zIsV~`wr=+u-|DLiuT=bhvf^CB#qB+d9-O=3E8`OV&EII-s%WiO)1-s?UU^+ul=L>~
zvWMgmmr0BC953m3@7K8XB{ul8$osQ$ZRyP)lV@+7mipX>#c|?f*G)gpFQ5G7#rMgJ
zzb{XJ|7?;o=c+3+j23U2r>3H6trym?ApTBwMCNN5pC-%vSiiGg?mf|AyR0UL)Gf_j
zvrgoES3{_$rF#A*A5G0SFT0;*G5*V27ir3#XD<??BYtwf)`N_btPhHL)hx}-XLonY
zZ95Tsu`Gur&t>)=-2*YVi!U}ENJ^b{(wZ%bSu@3h?|$*@In(|){${X>SIa;3>F?Rg
z-B0$syCurJ*ece1slW5(DYJ7`4&;4E@zZ;~i>FE9@8|E6H-Gs%zc~BJY3qySj(oZ+
ziXKaDvJ9SQ{b|_-mOF-=<%zvYtUcb{HN`s^_FbLa^K^^$(TAUyYOOd#4)4|Y$Jr;K
zH_3Px+tU)?lS)rx<8QQmZ)%=9H6(sd1>=*aM?<flD$trPSm?`|DC*|AL(d|UQPX4o
zf-j6J7g|ij9-BR!5!*NSd-bE|lT`mX9KP~f`{x812aAP~$BZ&N%YI9$uikZvYi0;X
z?o59kmL=1ceNV6auRBpVF(=eZYqg@dgWSUSfS5B(f-iRl6<p6TW@h;^$yv&y%_yZQ
zzgWumjr)NMR;S-9FLvir{eFGMo!Ci_D_P&2T3)kgyTR;vat@n~_}H(8F-uy$y<_lK
zT220I(3O_DwcR~yy2`Fj-J+^{nz58sMBVGb{*9t<85W%5%)Y(rXi)QIZJs|tUR;84
z7dEl{{QCQ7fMe>VX)nA=wuHQ5u1<(>UE#ryuth0DrE_7PkHtPd*)76br%W?#(bag;
zwMrmUswnK4Vd12AcYM!CIc2TLj*xcq<d?h|-k|JgJ;NZEr%7V!bn$;hC%)A;a>`EH
zo}u|~x2f>;(qog?opjjzaQnZtJ<k&wHt&q$n7%SfrvKU!g^Y69J9&}Z`dfZ}ef@Uv
zTZ47JI~(48*1a%8s9Io;<l5hItb5ljh>5Sg_+`l@&aKxr+;Z%kzxjV@Mo)jtj2|KV
zb%K>&`E}$jwzpgU^5c{Kuh9{2VfI6!@`U-Zy`MVxCpA~!Z#u2<v)ZZYNBoCHkD8jS
z4&8ohdbCC*T7{*TF|1|##P72bRpc2n5`7MISWPv1EGpU6UU$~}Qy-`Ly9v95ebqf!
zCq}y2bRK*>Q~A6btMv`G*-gCa5hf*)lYUM(D=6o`@ppnxQA&dR$FB=E9dx{)trn!p
zD(5EV>fik7@S27L`nP<e3hp&(OWBAqD5YQjHffUCf%bbjm!J06RGx3D`7*mGU`zAv
zAGcQo)rQ@lX{NN~rC;5qqZ_wO6PUYtQT$&$t2tj=CDJBF`Yd2SD&D>-{R2;lNTJ<{
zcTTo8uXe1s&fSnY`MjTFoHdi%lc43h?r(UW>XGvQkV(k5lMAe08NO)Cd&d6vF7M^f
zhVO$--yK=AF4sM6o@=$CKKHfxC;u)sko=l>Y?_<ZfdZM6XYT$ylTv41_+nvaZTMun
zof|j3+&TC035K$;@IG(nj)E@t`&Xl*9R9vNbLY^_MY;>Fw8gYd{h6-AWq+RIY#|$~
z<F>mGrU)4?_$23`n`UNrg7102<gFpWEf@bBj!clrusQ!xT+_KY{N%JrVY3T5XCGlJ
zzoWdPqiy1)9KDTl5h+Hkui7s^lI+)W7U_BEoyS$^tC#(QSuj9NLxXpNbE8FN@ODY1
z@Xx;PA+<bPeZMUXx}tGYvEA=+LeP@8FKa#4zqp#?uFQB`<u0#UxbIhOHT@sPvkmP(
zimWtLF<ZSv<Cc2kiFHTRCf41zZYghlbkcc`>RZRcOeLM0emT_{v-+I>9Z0Eeeso00
z@_$WNKvRxQvBktjCncx;BhtogwXZ%jocT9L;G((Q<TXXs?he&86WSLWXSatvEUy&Y
z8C$`7XMKxVq^Z%_OEG>I`W=ia_FoY->)Wip=CY*riizJVJOewW4C`{HBuqC>FEBft
zBy~38*5=Pib|yldY7$Cp8Rb0b&yy2HgukB?-=9;S@;?2!&EZqB5#0Hc_q=nsGI8xE
z)r_WtMw8S&Rh}?76dAcFPQ)Z8qT<Rm7xe}m)n(k*HY>3%kaxSRuu1X5HE*Wxu{pvA
zBwV7jw@<NlzJD^}Xl2ryQ(lT?ysqb-z2baSa`VBAD^K_yL@Zh%bNz<y&caPsYK59!
zu%!DrpPg%`w$-rC#P+uGxz$#|@}C;HX9~QV_s#d?^7>u3_x=ybcz3+-<%UIS57Y`W
zk4`PAof%kUJv}@5XSs^qnOO^2wjcYMocS-yzt>lG;wh~JgEW@u!A)(KlFBChd0Sd!
z&}~!e!=pMsPE+}8PB!N}{~xDv>myd2WYjgO+7(`W{%POJ1rw}3C={>Cn0+AW^~RZ2
z@8_)K5&SMXdC9H78OB2UoI97Ssnb5$&Eg+_)n?`Om#vFKYlEzP^j^I=uqs0}aJhiV
z3zyD~&W&A_%a2{W^ubFeo#jc+64rO^7L|RC&eng56iUOArDmS~D7dL<k=${&Q<m9B
z-@QFB(_q1R^RsDYq7A0byS`oQygv1OiO0Rb?5CTBXXfl@-1pwjsaU6HN@6C%!74L9
z?pu#0rcYO#le;J+sr1exl^-9^_%yHmV7zc=y6L7hjDKr?%h}9U+BV}ef2na;M^Z+R
za@AkEQ_@};oDCY2bA|d3SRTs?n)Kc`<9Aq`_NDr0mNFv_<KmMCxHHZ5c^>ngGW-12
zeXe=dY1a>&%0X9r&jyuy9<V?0S~7sml8K}2_*c(jqie5^l)t;aMJsG&guNH@hN?#<
zQO$44{j>zn$9}M$GeOGjY5o7J?}X1EeEH<u<dZ9dPtH}JbU#<|(Nwv(*rr7l=O(=q
zJZ-t1Z9|qsc;fDv|1G~>zMHjNch0Lx=^u7BEHam=nUJ~ftd(u`Z$X`_byY8~nC?3E
z$MxEb+cHn><V7qDF5bP%%$<DS`NPR2bKmF1>wI{eabxB3FHf?T82wk~JK3b(!|>8c
zQ*;8`zoe+3eF=MGMb>7`e<&CAnaf?|k38z2fPt~&8hdsI1_3b!T-SV-CsyVp=7Giq
zrbfi)-!T)azwdw0jDJ!=lp=3c`{761JZ9hM4Lr_wZuXMajRHG_%BOEtS+yvo`uvCT
z{gOdTPE38XqiVy}Cx7PO=V`BUU1zuVe{J14<1kM%`_qwEKk25QZTb^)Ip_Sd{7Kh0
zhd-ISf}i*P+vrcvzRos(qMVy|LVwYX@|a2gr+j$**6qJnQQ7ayIoonwJTH~p-Wq%O
z(v%OI#C*LoLOZ8ziwP;ZrqB8Nnp{@gTaKwISGhfS?w_pX{>FIQePTIlcjv$V@obM)
z>u-7S=2GNVQQP88FDoWW3%<9y*;V8^TQ-}QaedUaE4<D7IWy8VE#}-^AZUBJb;S)X
zv!p|-LpGW1UCMesQ+pPtptP2xWKCja6!**~C&};o^WS}0fB%Dhl+@&4H$xZkH|IQb
zW{QL!G<UnA8P50k)ydjpSv~i1j%`nwy5`@Hl1cl17kqlReRFrbxG__|&?4oTM#83<
zDRYZAOcpbAT>k01O?Eo-^xkcKPefI^EO*yg_`i$1wzVX<Ld9}*B&)<Ji_KQ|XK!ux
zetG1qz&u`Wz0|uMvCiHvlNPSb_~^NQ_mbd+yK~mvVq3IO_AHl{>dsRcUw<F}e8EjI
z>P2qNtGwV3IgVydB4vi!79qzjE=oD88`ib`#OgIKiW(*{JZLs;ue%>ue`>YNntWHa
zu1sl_V|9s_N@YDnUn;2m*v6dyVe9H&Pq#j0E;hK&ec;$qCN2Z#CD%94y!L0R99Ps+
ztAh^%LnWEd>G|oOytHz;!H&x{E54R~($C=h&~~cw;Q!;FQa?C<%8%$asXw<Z;Mbl<
zxwG0PiAJxHn|-Tw_VbQ2^+B%NBx2rYU26$UQnlDKQCM+8_k{q*DVhxDi>ny!O2s(x
zy3aAU)<~Z9`B?JgTw`B-Mnlo;OT6EkcYE1|e<-VEIdx-Y|JJE5x^*IVi|_Q=C8d-2
zu=(y$b%)lMwUI2{2O0jz{!WQ*2+BH?kg@k@<HL>o_oMe)-h2}!JK;|Btq1pvS~`xb
z>RU8p$_19Q$M`2|dz){&uxge-=J%Y>+|03A3;48E+#Xz5moa_$mI({;yPU5->`1;^
z;&1Rm>aVqy8>`Jq-VgjOIh|iWC@00A?#f}6IRBgLh4!t?wT1_0D9#FtjWuYvWI6rq
z*4vw}y`J&nf}YR$AW>thzipoyiyumCU^$nu|Ja90*IzPctAp;k)c>q0`!{b&!I#fn
z6NUJEH!a`Z;}K<aIqpNpyP5qiPVZSO5<Z6?vWtmZ+q33~a%)xVssKkxzTW26M|;i}
zKQZi;F%}Ye5PjmJ!UFZfeP6!>WlguS)vtJ`QL?m#bD4T=z@2+jI%hQ&vfZB{GWS^a
z<}GSG3>+f7`&s#!PXF$zNws>kRzb4$Lw<yt^#Wb~uZ&@<7PP*28p|e9&GvdrqCk0R
zz=?w_^PGjIJ()FmZG*6wl>r0q)7Jan9X7Xjuhk6JdHwaf;moLh8UG(uZ=3j@S*^X|
z9_eg3;|0Hd;)h~yuC{%QTAeq(E!Spr-l|q~n6G@%$&F6Cgtm(am@_zEOG=1ZaX_WO
ziLZ59-ol~_>8!%#TP82cHk#%Y8Z6YX$kX}h@z-A&Hih}NuTl%`xHD65_m8g+jNGnj
z9DNYQT=QRBXSOQOPEX(4wMyA%uGC7;Vx1#7QO)GfNwIo2!5gNZRZ^AQJ=b|Y<k))q
z0pm^i=ifXel%uEjyfG{IVY``I=wC|YZxPnjd6mjqKIdjU`L!b`d5h1~qmN}|9Rv2-
z?*8$m@@v@MxVpHN-@mr#2+v%(cjA6eGu340&C(f$-nmu(Ppf~n_T_JBxprfglZoZ0
z%Z)$X_awhlFX;DIJ0&!W=TVxK+<|Wv_l;-0US=XWVPeSg={^3dzTV(EF7(*XVE*?t
z#VK>OuPOikaB*3!aEX?Tn&95>^AGsvKR0|4Xw!MP@l~Xb)j$7yJ9dMu|EJ`itmDf5
zv4<i5hs)xr%6DF}Sj^14GSS}d|KWLtW<vW+U;Qjr?o&T|nr)Zzv6B<I_g*t<pP9Mi
z&<*V`pMLns+SNQ>^jX5UKj*I?&z6elj<;KFrF>K8{nVE``ytA}C+Xc+-`-@4O}wq`
zy0&kB*VP}YI6ftay?R+!=?=GYi}pi1p3mX9z{(bRU$>J}=3ra0iqE;)$?8T9ce<)o
zzD2QC{9gUoAU;5Q^Q%+5GAr|Tf5?fn%jNFlNUm<<SK#!yvb$-i!JC$Y;{NkrZSq<r
zY17FZx1;Xg<rvSu%N)5Tt~~EstC<#i*<ree_Wp&l7v9|M@7JE+^lqo+wIH_OS8r6m
zSjIA6EOM&e6fAnBfX9#H$jlYnYPR#R?OU+F{_xi;(RNbvt4>7yu$vnn-M?>V*a`cF
zw7kw3%lj_P+R4&q^5v`gjwj@3uk!qm_p)Yp<IGc%+y9B|;p$%`!GG>Z^X84Bub*?S
zHMw-d_DqY>k?${DO}E}MUi9oR`;$tQoe8({RZp&7xNqb9Rh$Cr{50=+1eWLqt53dW
zIs5E})`#hWejg8e|9F!w`aZgU+xF{^>RCVSTaRAzsvVQwvWlC5VV4R6&YCwfFD1Xc
zSg)Y+Y*cRXZ8M>N>*5<{$FzqiT`atG?`)>qTH#1P(~q}r7G08dJ$^|=W#KXoIfq+?
z#{b@L=N3@;p)`N;x5I|PGg%ss?t8yEVgAI^pAW~k9oJdXx#V!9%jBN55~9kV)OZi^
z%I^CV_if%pPXG6;(fLN7UOoNCpR#Y^lNPUe6FTl)nz1}O!re$Jr+V+y2hopyueLeO
z`nC4ZHcfF!&Pgrlj>jsLs`n=KsQtWlr#SN+i)s1I+EbHEIaOwU=Q=cRq50oAjHeym
zwYXRMu)F-9tEzo(#>)7ZfCuV71&&zi-kUDGO~dodI`$`4>4jISWIu0}O!jnh)zbJ=
zbwKv3qw7OnqevgSIrIGe`Ts7y`SHu8`u~LiJTHFVeEH<ZtAbbZ=k%6M{(19gPSs7v
zA665tbZ4A!olvOA`;^mvQ-f;AnZ$UJVu!wr1~0p%<;<V{=?P@p_Vl>^<K^@CJf-O6
z<IOkEpNP@o?BPA4F3q>j;KH%Fb$pp!V#eJ;2d^vL@Vd>W#QCV$mai;!;!gAb*MDA_
z|Ho$Tp80e4Nq^;tiDlc#lE2_uwEmOZQ;uGl7QugGvX1S{%*|OV!hNsqdmQ{&O*J$m
zzU0IqAAi2b4qltDvUbevp5V28&Q<xBl@+cgOFf^gPgo|?xa7D`8uwz)_Z)5KkEE(4
z+)qvRHLZOYt9sy^)6QAn#p<6YNX!zw_uRK==Et>i(P1SKLdPmy{&sLmHN_j;TBd27
zxZ=#0FV1R9Tv==v#ISCjzKu`M>8W$+&9h$f(lh7va_DS|2y*6Cv-)~b^^Q*Gi|47n
z!7CzFDwf^R>oD#A&;N@3`5iXTD{DWw$sE`exA4-T`9123(_+t5-4m(f`g(7picrWT
z!<*sfm0E6x|C+k1KKDdz%gjH1uYMFtOJ1;e_2$b99<k7u7fRoKv0A=9-KB(;bC#;k
z=i2Z~6{ZSd5xpJBu2YhKHk=98y0b5Q-PW+Lt0NsQe0Egmc|OZf(ez2Ck2r5BuhrEp
zF--!?Z5Eauik_8Qp|aPeSD|)C{Hg5~mabd}@0Q9~EAL(NH7P)^X2TYtMvcU0vwcD|
zmizc<@E&X3wk!EY>9ks-KNqXkg=~A&bYwy7BddkX-iJ)Knyy-uu{1qo_mw#9{(!Bk
zXKn1zJ}$yIdCSE0vBxvEL@a)#H{qxMxeJ$>j1&*tcyhFR(z5X4K2Zywm8+Losi@_B
z5Yq0o_F{}rzwdP>{Yl2R(<e(@_$&?B4H|P4t|WQY`8IrvzM(B_`FHAt^Co9DKae^k
zzhl7_r2<dQn<<f6?$y=V({ev$oBW*T#izCI>sz_WM$3!x|F>WNeeG3cfwQA#Cc~Xq
zrzUwY7z;ksp2T?NCW{hRrHk?vzF&4(pQQ@U&&|!KU!ASNHb2&P@BH(6&qD<ntFJpR
zNqcwb%2r9+?yLPeeU7r<RYYWr4#{2AQko&cnCyBYpXtD>X?NH{m+5gZrt{veh|vC<
zJ?)2KifQ=FYt2`EKCl?xJs`&OXZwlJW072y7gEx=KWM+c82!<v^G@4o@jV)f(Tdko
z7<n``SgHdUTUw7^*>t~0ZL5B_!Lof8(Uq&2_4y`!HR$;$cR8%*JO7EbtDha$*~xf#
zG27bblX&bNU9#wFd-ZSOeZI@-Pg)j6{?J;TH1&zl9H~zh!V4ygq_`G~_Oae#kDIhY
z`BAyVnNpTh%8g}{dY=o3m;TJu$qZ+@>3J?<i(_$n<?gpP=QgX^^eb<bxZJ53=W-=j
zc-o9O-S}Mr)$A$KDG$>ax;_gY_;!(}ds@u8&EJJ*J-vVLbI{j&pN)Rbta)tvfA!_L
ztu}(+*sV{>$=6#bifw%|t?Nzn3EuV%Lf)kZ-|W7u9sEsRG3-o*(9!-G75m&i?3P-6
zdY9v6#zs3P<4Df+=PVgC<Jq)dNyRg?JQ3e<;_YPd6vnpfmd9cq9Irg3Itm_(nXz6n
zC@U(pnJ;_ZZ~0n=d)s6sstx%670;cUXQFi9v%SWB+r6j{Hl@G+icO6QV?EcSGIjRW
zX))YVccv_U`{Gypy8f5GITtNF<RAa@EZnf0N9M}!okDlED)L3hWij|k?dIBWWkHen
zy}O;4es7S-YEj&Ne|zM`-eu9B{z<q$UE((X&BbWB`$6GOvz?Eh^M3z(f3^PHy5fJ6
zmz9;=yn1?*Z<*{9sgf(NR>$hJaul<4@Uq&Uc$~8*f{&wb^VPlQCd^9Nf5b;OQQpz}
zZNoaf%ZoBKu3pWp*)2K!^wZ?%Z09~Nh3K-wQunr=3tZ*Vpcl<@N?vi5$;{Sk?}hd#
z>@8n?plQ$J+r4wP9*`@WCaZmG^4rP?>yVw>#I`Ijo80l1sX*5J)umwf$n7oFhS$D@
ztUO=x<kaumTRGQ<>A$mjQ24^zopFiKj;EKrn{yujJtq02w|RT`=Eu(eAHB(`YY>$@
zeBZ8U7vCXi0q@-Tnspy-4)p%|n`&Je>Fh6bFk{=}C5%=w*5)&ptjrI2W>S!s{<@($
zjHglc)#~HBUuE8vJAdLROHRiEt_6DP*<6j>Q##vgdq2%#RH!@>snfy9aGPPnro`or
zTrzB0mm2QmM(j{bY?vW8i=lJN)(;<T^O#&;*)EtQ@{5_l!(bVkz;#m&Kf5#f%ck#|
z$=0(pyj{wS;U4q8hmy0_Z(gi?XnlP%@2jxMKeLY7HEYSbr1b7{nDt{*ucz3#xI+sK
zijFW=Yu6Q&ncD9Uy7yS-jNjF_msZ95ht@RO&brmUif!j}xqhY(2EJlR5@)^R=B1TL
zYG%Az9dv}x_QUe5gD1L@q(ybAw;t_qonxLfclF^{`t^eR7jAey)n%NL_?GqdgSe}2
zt@ZL8rsV{4i98i)Ej+P2Y>6eK!v80C-8;U2UGc_wYnbAS6~~WO@!$K)cQ$&1y7`}T
z?dtk5o99QE{QD=rKK}aABR*`C67^Oe$x&C^u$1|Kg4mw?{b5GRc}!wL)7Hek_%`LZ
z@`1KX+nVNS$*p!tN$nCl^fURG#HU!bgHNs6LzfrJx)(UqZrswJ5YA#8&NO#dNq2I)
z<Pm8(?kVa%tNd2YU%z_JGOxa<XA^E5)O0<4^mOWS-8Gk(Hk&rQ*mlZxv4lt2tLv7L
z&#q6XVA~NL|992=GS@EaZL2xIzc^+fdnt7dAKw(E*u68iA8KEJqewjJ&AmOpq8>8N
zHBC_U5ZL`uJM*F|GsC;oUlxM73!Nk#WeyzJ|CX7jhUcEi`k<#PAIxZCc<?b`?v&oI
zs}00weE8eqE<2Yo?)(Xv%~dU0iU)Pm1)ohem@va{MMF#B@y6^2vO*pgKYL&J$d_a#
z<6z)*Enzmx{u<A&<3TfQdUxDYURD}@PJGJ}t#=ou+WvSIC>*x<mx8?0@!*<;ing}b
z>MLSuwUf2>x0e1b3f5t{wNy^#?Qz+4S4v$P#pPNr9WmYF754jy`=<MQS=QS>im*DK
z&-lpLL*{5Y-_F~Y_Z`~*LF@0Q^B>I4IOjCjtU5J;!T*J%?5|sEwKaB0e+gT;N9Q(+
zWaezX?s5U==hAnzrymV`yU+0($I~@0?3y$VT@G>Fn5XdQ;DHM+AFPipyWRNllHZ+g
ziEZb;toUy@gY}cR-}Z#lzh+MI%lYy8wbYD@83~hih5FB`crGKfh12nmShtsR1;c~B
z`+-+;MI2XiTnW=|JpPJ*$!!z12@kERXRN7N9^YH@>xz_=sIqR6=x5f4Sr5+NaIzMd
zz{aicmHq#Nx3f>bd^vma%f|1n%#H0<96xrwPuex3e9d=;Sm)$qzLZ~ci?3{tF?DzB
z{k0@Eo_}`y#4WKK`#NPBv`aWDk0nJO+9MU`s@_(?%0Kx=%q!hlx=*)1&g{-#Taw$r
zu3r@OS;{NI;_$+=cLYp~<mSoPDLR*~|C4^zvPQXear5DqmU1s-uH16nqq8Pm=k77S
zyzKjKd$yhboO5Bz@3kj)Sf|~XZ(X)>@82ZGlZzjlq%QQm@o|~KmmNQDTQ0QuCt=?2
zdF!(2Gre<`YktZGD}M+$7!uOceOUHSd{~tF#Q0ep3+~%Z%9+cwb6O#LN}}yTafP_>
z_%ls2{`z(6A3N)RrsGle{cWW)M69pvugd27dk=lab?Jpw8?P`hFz7QfFvy|q`!7x|
z$}A`;){l?R%*!l^kJl@x^z}RKb;Lnn&-rkXCz~#w-88egU54di_X2?n%?p$aFDJW|
z$$cqt`G3zdqVV^n*sHOju@4vSugrRP$3ro=I9sD*bKj1`p;E^>rS{%l&2`=I?}pzq
zSgP*FJt$PV6Wqtxw(o_&WPK|R-Z;(E7nOO9Wbatd@t?^0_skV>FHPrd8Ji@I=g+^`
z+M8*e@=&)Yu3hTv(@WN^LFbfQ94(_B2Kg8jb6(R9PJ9#B*Jcs#khJNYblth8BNxvo
z&%Gma{ne3`ExG^Xbl&F_e(NvU>&@(4m$&=+uCV>6!;LELFDK+OGccrcFfb@$50B)W
z#Ju#h{G!}M&>VDaXl(Z#Gm+Zw>vx<L%9*@z=E-2m0)-{KB9}@s*`qkRFW$IroRxdh
z<5S+B_r+gLlh5as%U@G|d1rm``Kj+7tp6SVPjlY~w$@{hwu`ksly%?Q-mjc}E@F@V
z_LH(TlOC`6@iOPZ-?Hz<GUqt<FP_E}RdXb+kNIY!qnV25@+S<XcYV`>BCa2357c7z
z;mDlvFzAI!XZ0%+qoo&b_netiUDw0*eM^sn?du0SLME^1ol@I!v-GlYVbN~s?RAfy
z#mFyT=iHjBt8VP4He<Sm+|EgdRApkeWNa|J=dFJAfZl_H*LIwEDL8c**DE)^DHd)w
zRy^_C=;(f9{e51ogTJcx%da;0eBvnQj5g;<2DaU8PUYQPH6PXp=N#CpoWT4;wtC%J
zIliajzv?c#+2%O(^_~3Ndgzn(&5SI`yagZYUb){s=KQn$@TPk+p9Rz~=$)}+{1rVV
z=KZ#SgX!0Tt=|Z~Pns|(<-#9#-kk7xvRVrH6(_}Z@Gg;Gb=U0ddNzGGyA_<_9RU`y
zN8{f=h>j9jJBxdfj_PsOkLFscp}#h4+Ee`N%T4C%4u_h<%qG9J+*UAW#pkv?ll-%0
zcHBIix4UR_io>@c$56*pztqiMi)8#f^e`pmRfp2SX}7kh?46XIc4p4qEBn`ch<(ac
zT(|1(B8eqwYtE|hDlU%`()Lqb>U8be@tX_I6}8(aZS0y}>}x#z>6ex4huP0>a5}A3
zopk5V`yDCTm$uHVUSoA{@#49c>xCwZXZ?G?yt&Wie^!i=Ny_)&rw^|`a&ujD=F)kQ
zrca*_El7LY==9UTd#`QyvbP_jf`3c<{^`7R<HoTp<x3g0opo%_JK8qKNd63(Ct@yP
z(bx8q%e}>~>&s*vu`iyJ4DLz#u8i~jP{nhXCHkG-<v)RQ=fu3f>zT2(ed?OrY_W63
ztEFdKUpyk^?KO3mQMU8vDf{x$zq*x8QJGy8?3%kjY01+iQaL-TcuVF~+>bL{7#<Sq
zu)F_g_Hpld7Bj+lZwj1>tB%b1pqe01UQo;3{rlkcudgcVwzBK3{1|5Rv25?vhw7GJ
zb6rd(JL<1H^t-`4|Lbg#drn-LKi5A|^7F2{del`||K76e4c)6JecD@Txv50bZ0{a6
zlR6WPLm}U;ojEORRbAcL`steaajRqDng)@crC(d@x?fsv-Z^1^<+mi=Ph6qv<QCfe
zL|ZLV?;>A*nwf!N9Vf<W5m?y;&Z{MvDV2H!l}p3C`)`{G?0X%)VRm!MktFk-rHrf*
zDwZN1w^?_!GjTgV@KT-~*%k8h#@4_u`^(#eQg7yMV|>+Z`^0Ad&$JijZ@%yLub&d1
z!hFl|XEFD!(|%2R6Sp^Klm+a2e*LEOw~IXN+S{$q-;3Y>yYue*hQCbbGOism)-e8(
zaoncE?zB~QRoL~|4+ouMjc@WFt5Vxy7FUtE<@BbKwC&9s_$IwM^f<wn`CM-t+rx4%
zJ2mlg4Yg4IzZX1BXG@t|-(=Olsv~=6iqLk)>-Qw4-kEquW8wCXC9+S&UzUGOeqpuY
z!Zo!Yia$=yX|9`g?M1|^CyQA5d*%05+?2bfuAU@uCDHGPfyds|LmPkV2)|n(edX;m
z&jqy?GcO+YT~l)Q1<N-Lt(Sjh*|M#?6?UuS?n&Dn8uvfnXLAZ$!M^L(nuwo`o^SJw
z+T>ksZtSwnS){W2<^<2<8#Ld9FHQ_udfx9v*uhzWY8lfSp8cJ?`2NuZM%fU<V7aOH
zHqCjS{U**`+|s@yZefq$Dv>PH-R6Dfrz|v%Ssdr~ntb?Pb6$7*o)+7KVQ%a{XPiw7
z+17C8lFuHFm-}ySNn+xk-2HWb>Wk0k6%H=myhlbOKEJ!=WtK>Cpmxt>-@TeAW-$C~
z(yefqYMi57t9xk5iZl6d%>-QEJ@VZcwW9FiwyiVXb?;g7$bkQ1!24BqDw~-f=QjKa
zU42X=nKS-{OTfNUtyO~T-)BuUK4{iZx^LN(4Kqr7mWUXpU+Rlr@?J@cLujStZGow)
zJWeGUJt{tMF}$dDo!MdgUtYGW_1Llx37+(B@ohFNPTz22;-b^`vliT1(RAJS!+}NZ
zlXz}ijSqj*Rc{)kUbN=lzEk}yb1J^-c`po_CRh*_s-t)|;Lr5a4}ANo*DYOocy9j0
z&KRqQw#(|zl&Yn<PSIgrcX#9B*@hpsAD1dz7-;Ly&)awJ@wuHx4CKU*N2x1J{&w+S
z^@X0WrLB&gY#r8low=VXx!$QBI2~npd!~~8rajA-FFj&1ueE)SUteyI^X4_mKOI(N
z|A}&v{V6%0Ij=gOvFmg#OV&%~Zx+wr-8o((yJga^%*Mwxm+b>{WCWWQ?>ep+S0KfG
zoXh|I?4&?p-NhDe$5r>+RZBj*p0Khg>TG@9w~gz6>Y8@kQ@WzJw0zEI*TqS{kG1rl
zH|$?+5UBm`(zzRPJ*ThyY;Nk3>(n^4_Lys!*B|Fb?mdRPf;TCiopLwrsJoWQvewF5
zLIL(6Z+<B~KYvZ?wZsC?3-i9&RNqW=aPkb+RZj@gx@yvr@b+kj|H3$D-E$v%j{ZOS
zvM6ew@?nw6pATZw(Jy!U-EniV6cYo(8)gOu1zdG@YGPhVQEDn^tTH$FVApK}fxW-A
z(@q{VR8hO>%)c;F<ED4wZV|I~Cl0rb?jK8XJv|=ZZM#(eKB8~(mNkBtGQK?9Te+BX
zPfh(F!}>)+z6X9@=i;5L_C@>0qmanQf9&E_gl|NYe=1oc`A+<_|Aw`K`w};>Y1JG)
zwkzx&<KnEzF4ec40$=o5_q#G)v3e~z#c-PFWK%`YbB5B#Vl85~mma^;qwfARyZLda
zf8QCwkcQkzAuA4Ue<OJK%Z0#TQBltK2kO`icQxhyb7?FWx|MEF-;kbNFttG^*VbTy
zW%{v*{c0a{y7s)tnozid^>*O`u7g<#fpXoRYfmd*Qc^ANdOfGfszozB{79Xpf7^1a
zyGQhT9xyS!KVo`9_;!iVOT`D~_kY@Fe&ct@JSu+qp=w1!M10r3Eh+1C1-{<woi{za
z$kut%F0p1$$q&;@QrRvwDf%&1MXgG2QH`$u6)`KupZ|Zh^q*7g>QAcJN=(AmxW8Y^
z|9b6v1MA&aXRiEooWEz{H=Y$i>klewH}5vpS%0)mZP{$Lse<iJFHaVl81*Ib^_!iV
zprtUma?@P)-+2d4HaGnAbwBTs+Akt|?k=ZYc-PgK;AVdFm2#;)ygJDWvr_NQyq~vm
zzT+$Y%xnBh_6fahJTf=2<nysrS*zHO6vq7S`EzVTMPIn{J&V?;K<0_ddTNUfrz_Tb
zoYps9_4fabD&EY%EnPl=OPD9_yZ&i)QR1&{(d)iNeiBD*3(9&3y@_ODV0g@pacLN$
ze#tB-097u%VYl-hn+eoj4;MJmoZ=wXw7{P+C?Pxl_JZBr3$8kI9~Q{SOc7q_(YWLh
zSNGrVeEO48Pv<RSkDmT;=FDO~{qiU4r+>YFT7M18!o;63jRtGd7Ra4kK5ZI%gk8$_
zi?Wd?w}t1_8$5aV@1go6`Gy)+UDlNkcz5JT%eeDgQ0vN4l@1aqO}Aoob&R;|mC7ON
zB$YKo<W~EXNyQp>yA_u;%__SSvc@E^LiKAw`hv{tV~I8IqSd~&WKC*cGV_&7;*uxK
z_ddjU{8^sG@3#Ei(}^>kH@<!)B@)v5#^?6ThKan*<+6`My`=QMA6|ZJ+nJkr96!5w
z3>jB9yZj6K#H6*SQz>k+&FTM@KV#O^{onKJ@z2}&{elOz6{c>=+$g?uV_GiT9{Z1V
zqWfF|Pp-U{ay0Vxx9p?$0z}vwbrkpe7zB%Svc)amcg_9(^uLd|x7UR7v|e%3{o_%6
zlX0f1tGyrBy(c%tmz`xx-X8tQ<maTEZJIZ8#Gf;`uVP6!W)od~_S%Y>vb|dswzbaa
zm|1Y^jn*%Zx}`CPSwmI`ySMEASgb3WStHugS-j1k_h$AI;XoTsg?lq59r`77(rxO>
zh3ePL8Oy5Mnr0mh>${OAoqXQdcXQ$<8|{^5o;IO+e*Vqoas^KJW7;=L9Fb;AdvWy;
zU+F*JN0)XcL|RH8dAaALt4Y=2tY8zL>^X9+@)9{hLY3YVo}Pa)TSQoG<NwYb$&t@l
zG!9hi9t$t4+QB$OXXW|VDi)6ekNAc7oqEss;dp?1&DD@#tD>upCWf`1mh!&u)3<zn
zkg?C^x5}@zuXWGQ<JH*p_}U%ql?BtH7vG*1{HT7W!EMj#Z60e+B^^)wnPvOHI49|U
ze8$a{LM1f^JGP!(FnjYk&gP`ok1wk|3wdL`t6ieHnk#O1lKyeUvVO~zhFX@9s&g0d
z>ckm}PfOYP-QzP)de8YapBD1e$vsF@WNSUQ&qVb2Q<mxt^_}kXnzwM>GdR{|`1@F(
zOmEZn?M!Q;R-Bf6ID5y^F0+P1=Tl}CJpR0h>9nd^#IBI=mK`tD7Uyy=@_O^)bxX{(
z-lunae(%5cmeoe2YWKSD3Nde+-LBguwH<g+zJy6CtswKD^&Bnln2x`PI~U5opH{Rw
z@j&YT!+(@cB;~ENE-`tz<u+#l_x9Ik4T3lDrkw~Z+at8`VAO`FIaPZtcQ7}-=-;y6
z%vCLDp?E>&#N*O>H#8TlH_x4SaQ`teyNwTbgq-Oua_5;h@6fv!F>h9?`v@zaj1yXO
z<Y>apZ@klfcJ(d^pYZ0FkX!f#y_qYXPCmMEvV6;%Z|u_*KD0zk-P0tbv~t0o>u2<g
z=Dlp_x!k$y?dP=rjyn!If1an$%zlEuW!{}1d2ha081lc9{P618OMT9W7dE@ECd~M{
zaNF+F6$VAOxvGv;yS!Rslb|NPeJ8)y?%tgn_V&69>Saz%FwuMdbfcG;-32kjd6}DK
z-f&J>Rd-fIu50P5$*s1x!qn}5^?tuK(`@EE!O6j_nkx-%)}t0l&sevcuV7(dIKace
zpn{{S%T3HqjV~(Ai%%{|F9EfC!+rB_TL|p^9ln7x;AFJB=Z5VpTmmZhTpPC;3W--6
z@H9?yGfVCa@zmP7{YCwKMb}y@Kfc%9PDK{)&$7$Uyv+Z6>7?h{$IdtIpOCcPyy?HC
z*U}T7B1@O*sk#UzRw^!0n^L@RWm?nfi!0_$e%<87`ZZ$eYNsxVDOqV|OVc8aZ>>I6
z>-beIdG)RDJndV1?}_)U=L}7;lTw`^6j>zSc;&R{O!oL0m$;WcE%G^+$MN`Amdgk6
zZky#cfxVu`i#(k+Md(bw_94@1ckQ0J_BM}}l-Jh2?S1n_^QW|h$EwCVwR_#GCOuo=
zsI@yQdCHE(edar+zBXcCmtJ<%-{I&aQ8mkj-}{%iHa=T9p+(J8WV%<kO_9jn!sDq4
z*H(UhTAki$u6XZe<RO(KQ73Hq3}pq9B!rt<UT{xcSl)kGsBTKe)RyANLoGQ9+5(X$
z)}D;rJU_$n(R|Ljdo7}(Ycxs&vs#(+KFL<i-^2Inu;G=L>l{oxJhskXqQm@E?OyZY
z$vI~&&hj<>mtabkzhHFvVN&E`yOIMOS46_9*T~;J6#b!ey-9&@sQmKyeEa&{^X;rA
zT-mLvzJJ!VpS4aRGp-qUNNy7s%)DIL@xtolx0b)RD~_)#)OmCKLqMo?xXA6O)^8Fw
zwl0`i8aLVK{P&5+OfO{o@cqEmxKyS2RRxP)cd}616QTa>OOZu0`*xX$U%gm)wD$Dj
zoBDdwM59l{x&9H@*Ld}i$fTJ}HH`bNNl&)9ZfG{Wtzhr=?GrYbu)fsFsuK#BX|Z!n
zP;#H7v+9PMd{T-TYbF{PKQv3tnZE0kqg`ppqSz<1J_@<5HTU7?RuPfxJ^0<vN4+{Z
z_?!EQqudE{LA~*wbyJ+0rFaX)(x-cOADvcu*r!}zy40_WGHgX&^R}%~m>^!2Z@hSy
z;UWuRGoIWNcISkZ+j1v(sn2+o=e{#?LXm~^<wN&4o}G~V`Xy?A+t<yBwh0Y;-h9!2
ze@x}ovtz&Sn!hN_$nQ`1R%vEykn`xJ->tq91$o_5$NzI)cDZj@GwZ&6&3yTElb&0R
zhN-WUE_LjUt$ue#?$Vo7$=^>Z1=d#O@=v?E<;v$xs*9fP%fI2_H6j0FzWh^;rva9l
z?XqSeD%;8|-W^wV{JJ?YFXhOb9R`PA85e$Ry_%ksCs$njbM1_Wci0|DrA*kI_oUrW
z$>DD0+LU?U&1CNi|C!?Byye#8#xI7m7AV~@YKY}={r*$v&PAQ(l(61qL0pxlCp^QO
zC)9>J#fx8a=r+3dgWaku@b!VY8sGeWu3G$8|8ToY5VxjVpYXp!t3K!D@ZVi0XqVpd
z{jp(lqn@>^x!c#TmWtWmxxCJ7v#U|pXzZVPC?=x*qR-aMa;=bR?i_#3`kDot$5uI7
zC8gE9+xO$#OD^vI{Fzf8s$MMGvQ_mnuiT0mi&8EHExgHgVpU3Hl6k<i*viMs^Q8UT
z*^Vb|x%=srVov#tcX`pLUtF#}_{~RT-=@EYb&Fy)%bf6?eevL>-73457J9QEct7Rz
zv4GiAY?5nUf4>}R`;qza9g!pE?)%QJ31oeFUGA7))U9joY=K8UZteY_`9SxrYoMQG
zztZ|ejsFcLl5UyLN@lxpTEF}BYSpS={HP_}{9JEM4@L%te~h>r^|>kW`9<*s#d-zB
zhPe~`{SP?^9DV;+M1Lu}R8Di1aYjJTDOX>M1?ro(1zX*EckM2#O3V9qCl-BtptgIa
z{rkUan{9o3j)yGTwCw2HGtoi1ktNsm1U_6Wr#F3{**6~Js8_CQKdkw}q%6LvM)_vM
zYSEjAZs_UzR4dM#|9MH6&IZrLCoC`VEk3Vw<gx4O9h|>39)5nT@zP4~{N&>=OGBh`
zlodjLZGW<vb9?aHJ(pM$&;9!H<mts(P7WvXc6>Bawi8))=*PFCnfElkZ<Q}R_jKNh
z)ZGn#SPLZ8mj2vp;(9dHo@3%g_D73!lT-M`>bvJgPA)YyJ!`*r>*~iP`<V>3ztP-n
zd~UIPe*5k@cAh#{4^DjN8vg0^d!e^azAfl=Po1{wNZTJlt!WvFQ}-k;-ut40<GijV
z$33m{ZifZ8^4)td^})2zqpa+uhngL?9NzV;?Sj8V<YU$eZt<wG(896aN1l;^VF@F~
zmP~jPI3L^q_6<1bb=W~*@B46@TivZ{OFmv}R?v!g;kbc);gk(|YG)lbNtdZ-*q^-r
z;q)9A*Y?!%w(s}$+>Ctm^W{I)+nbf=Yuvv2q*Z#^j-ziAV!b10il=q%Hi%K0AARsS
z`>92DQmSH;pSN1EJ{DLc%6HGi@XLx-X;Tb?LK~}FS+4z7Fjkh_9HAq(Qd&c4=ZR(q
zra4jz9`*^Xc~JUfU0Z?wPQ&(T!e1u%T1hO~Dkr4>=KSOhYKrO=*`BvJc_oC;zP(m(
zSjsWhY5jvE%k?tdznVWw-*Bbx(A|91>4}SOwlo_qTgF!SCERS@WwG{}^PYX4k1|`|
zu)RsmUa)X;je2m+_tWbCi^Sx*FH03~vRs=cwb%NRzx|p1yeIxLp4*>oH2mLns0MB1
z%6`_?M+uw^3~pLDN8OY2%TkLH(^K^dDz8RW_ut+j`2YU=roFj}mK&$!tlJ^hZMDPs
z-G#V9-X=9xrX_7o-d|=#c3zoy<(Av~ebwn2LDvp{JN4V*0neMmm(F}RURk_^`_sR>
z-{lw2uQ=6`cClYlxNW^faQKtmla^(R?d^*9(>oy@`A%eiob;zxPoKu0Xg5{<pA^M4
zX=C)X)0-IVk|cE1CQqHj>NzPiRqN=amJf@joD$G#F}YHpxn;3tz=2JVDxYP}*zweh
zOT=t-{_`5knH8L`b}jMREE)J=ae0-S%AXfmky<m2c>hnovZj$$?@-W(>R8En)peV-
zckWONnan@g^H`Y5)a^bOv&BxGnlklb_!H+p!q=ZoHp^nXvnfc^d&-n&Tr67quZT~Z
z^(}OF>$ldJICaVJchO5DCq3Wp%5*w*;?gNUbDVC?&)%_6Xj|&MyMpG^m#I|w?l1_S
z#(!X4#W|Cill{4?TXT1MrXG86>U8JcL*dmcQ|#0o3rr<-*q`JtP1xEIvzb}N_`CiK
z&*rBMi&Ga_B(sGkdLC*^e<ir(dtkFdkmc+nvrYZ4C(cgs+Oe(So5e1ntS#Tt-szot
z^<T!u;q;MPB0Cq`H(Z@$y{aIJdpAS#MV>v5YkrunEZxntgw1DZq4Jk$pXTTlv$-j-
z#q9salO&St=akaeko+&Eko6C%sOZ_xvKLjoe`cl2_D}I~J=b`rh<A6Wyk=$9V$aZ9
zp>0=;I~Mg^i198sDl|7rIqtB?sqH7`IxtCis<|>aZuR}lH7EJ~9;q6RM;iN61&lV>
z@17Bz!TZqhZ&B|CRd3B7hC%N*9)EDRd@0@4xc^wj=3`SuTQ;Y)73?|FRW<Wih8F8?
z5831e$KqAQ6SYsJsdQv7T2QFu&uzD^m+$rM%hS3SIL>{kpwOhTYQM{h-h^jju`&gp
z<eo3;lzAT$cGHgg=(*z!iyL%~99s97b^Y@R8qIbF6DF-NiPX}%RQl+1FEiI|mSgw!
z{!A?pdBc%8?cIbEC+*hVzU3sUDP}zP(xleCf6QWkFs$7B`RklNmUUapi@c2XMH#m4
zjDO#<Fk0Gt!h(*Np9&jq2J&yd<oUF0Q{PoRojcd^d^aqa5Pezc@ZK#&VFD``Ox}0f
zvg+cA9S-tqn@<L$Mm%fgYUWH{G*wV)*+TDmAJV!t{lc#w+|v4Yf-2w5nj><zZ-3Hy
zcV%{;!E1*A*R92pd&CZI-C{K3Zd2Y%#q*vCH~FldINXzCxKjB@OY2!nLi7{HG{5-N
z+q?E`x37_{m;F+*E1xAPBj(a<l~x{^Z(DxsS^ewz-JqHe%&Ts(Z5C`v5Rp8y>*d+6
zObs{NlY4&6=o8#tkRfebzOzPI;PR#vCGNuyls)ohE%+h($9C7h68-L{FRs)+ez3e{
zSJI&copk|Lf<37MT5d@jSsU8~BeuO<s$iYK@zw0cs{p<JUz|7Qt(w1DwYnz%Wh(z4
zn}yq5e$TbJlPeXu^{yMI&F#W_?-}Kb=gaj~|KtzrU;bJC@U~~)=Vcsw!q0qrj-H#R
z&1p`%1^?dp$(Q{+?jxVE{rCp^Z(rQs-p_m$b-YC{X%E+(4Ug+)TZJ5PTu?B%d+MIq
z)^3~RjK%L1%u;u|IAvj>LytJeQH!$g&3uzr9SLOHab0=Y?8iq+E~{?Sa*khb?Nr~F
zv1{tIvTEJH{r!8ScDzcwc~5+|ZfLl~iw}_obH547ysP^2ylGD$Pi^lZ!B+7Xbpo4;
zm~(EtQA}=mZeIPvv3_g&{t5+lv8*8W>nGc~eey~w5}L~<@0)$dRQS%t!u=lv9;v?l
zJ>`GSgFCJ&8X7WOY@E^^v1$rl3GSa67FqwwHaIG4dPU)v!3DmE1zqM{(qikH^7sFW
z->v%R>*^@W`l>R9r0w=K8|1$HT6tx`b>%G!uJ;P*{rj-!(yODBy2X9&G%^1TPq^&E
z_xf4?eYu0W8>2*wtU09f9-Vk~V6WyK53Vz{`){la`(yX>V|%~-9!b5V$+o}VE;xR?
z`|Z1Zg7<iz92S%5itSm^Hh-4j*&TcuOrM=QytlrV$v#$e_@n6Y-sInFPb|N*@k^;^
zp>wODO>>Ohx`gfRLW{X;lIOg9f8RjXwY>XwgrJjK+5TNx$8>+cIa2a;yZLR_pXy6o
z-aBlIH}sLt=qZ^hEo<M{tGS};!G`n?^YWJkYuP_ObLD0FhbxzjT;f;%Ph-_-D4kz1
z{TYw@LbuO7Tc7Q^w!gF1CD6Yyr~iw{Le^gW2J^qYJxTV4WmRUMX8hoAdvSF2<*R>n
z4z`*e*?0f&ZvTa4sn_oxwsnqdp7zx|*kr$0(8dl;)v3n<^Hmo-Kl^TG#BqsN9owSY
zmv79T&h@9Ndi}498@9#%*`vFi`^LWp^RSMG$Fg)Pnr&xnzm>7|InNi<dtOz#=7Gm}
zp6--88&VxoBDc*@&R~w<pTj)vJ-TxzG5ERUNZ(%kBf;at4C5K>^RN76IJmKh*JkZn
z8H-DdnT3}Zze?TqKf}$=T~Me(yDo2;{}FrFztTU|>Nsuf?c8n`oUL+NHBEqV>ipFC
zj}PA4SlBR^{qE7Ge`4nYKAGQr9<DC7+L2Xx($U8~!E4QXi?aC3YRVoSa=D-(CUW_(
zZTnVt<_DQ=Tlu>V1~*%sVb+hSI^KCJw%MBH(}jbwX-wbm<`wgwX{_RYZKcAnl6hlq
zYgep%S6-rJ$Kw~XblqweNGeUeIdx6guPbLIs`pga`RC1F@YP}B6s}Dv3fm94|Ezl;
z6+Abjt3CL;UsF;+mJsioU$vqco1IH0oU7KlJKdQrl6PZE<J#RDA3WmDJ-*}iJ86Ey
zwIX(B&X%)GI@Xu7WY@*7dsw9(Za?8S&15g5eNVJiQG)(k*56%xYN`Ks`Td!@YuyLg
zp7L*gGYscy#XXws@cF^}dv)$P;ojYu(-Jcx3>C$mR)z2`I%89?j^+Ns>Dz){2OKn6
ze71ANw(rjyg}0?uTJlS^AIhw_zPvx-=B<nx8I7%L<b-N$jMzM0ue_{$Fw^@@W7a&0
z-nQ`ckM2&-TE05mY%yWuo^s=azf`n@Nl7Qqxx}k0<yOTBcb6zXd=h0={#ATqS45!2
zh4anU*AH!f`-*2reMJ9BenW=?*VjuFt~jAyD0BP$&45{%KmT6bGVAB$l)D%IYhL<$
z@{!2Y*SxZwTRb`3XZ79qx6#z%j(F1ayO*A&9-O6Jrf2gx>5;X+25;j3&bIx9*FT=P
zY^u9%|Ao3=g|n{yx;XEmvExm~+p3)lSodx2%zv%w>A2HF==-Y$_cCktBs;Bf`oU^a
z^84kdEJoGW|52N~XFo4G(Z<NYFoTJKK^glHOG;`^d1gsQacNpwW`$lsWoppDtj7id
zdtYm(y;L-tJwv6M+czOozg3Lu>_UO23&$2$Z2RWnQFQxHt^3By8`k7~{&H{6@{4y4
zoc{dx^_z)&Cj`^^O^cMgCBi=3p6%ScIn^}Wyx{pC%?lenH_XwmJGjlU;?N6;teWH3
ze)^S6xKQGC^MTccTi;gluP_aG9_x`XBi5)>#(k;VnWLIVg7-{$`J}TyK`CeIs*6r9
zb{agC2;Z<)PIFnTPh$L`9OfgLOC9(kGYS)?en{p$&3NuOd!p!MsoVTszHinpJ%4Kc
z12YTtdtyodmoH;D$$3@Q;27^6zAZhSe8PEZPs^P<qaLa+O$uCPJY&vz-fI)ymVf>$
zDP!I9AgR97^1-1~hU!<JNPUS`)c7NF`ryG`46f&_S#4Rpbx#?0rWRdo&%EEI=veu7
zDyy0CxjWi+Z5u?3WIx+<9bEQjdQslR?Ygu1R43f1m^|y%dS$uf8=veOH&o?y-tX!z
zdB8G7G-1Z+`skY-HHyDCOe@d2E19(RxZ;!gbBCvP?tL$|x_0G02GnSLv)sGLjGciY
zUl30;79=Jom*$q{B$j~M*}dU!^B$Xt{awHOfgjh2xEr5TZp3bJGj^D8(yzHJeUtG!
zahbylR8OV3iG@z;I)36=<2Tc9C%?r^+O)(XGh1P!PVBw&#pm~0CC<;g_s{5`<FZ92
zNi}mjFP)0vvP~5i^*2wdnYO3T@5a(q-=fx;Py73R|C={oZ@!fH|L@p3Z*4A{D^oAs
z@d|ajxH^2j-lZ+~uCZ?S+ALFl^`-s3e{TQh=7xreH>EBTQsr41G()A!j?*wzI$PU#
zu20$S*hL>Ia&o3=?45V#=9iMBOPe>J%&RT4IvJ9sCc3`GOt_-JjC0rI-n(Kc)?Gzw
zx8>|SlO3JCF~(?TYw@&?n?kPr%ve<L`rLts1#4Z4Q;&-8zP!ik&%N+XF~)f}bh=W`
zrJa0pefH|7Ps_un-;dv4Z{90mcP^vpgwLtd$DTwd2I*>VvP_Z}tZMN&XV&yLOxxRv
zd+RjK+YVp7Iwmb$HA(67E}bJ@k@r4|`r9kVp3yq?e(D*8I{);wO`8%j4tLL4Ip?pp
zf>K$ywD+SFSA)>otG1;bDU+U=H^ZdIcnN>$%}++6Yc6GlcI0mP^Sxg_E&TNCZb@r*
zvq>Sj+L0ZNeb3`JzRca((H<z0s`R~zeabRT<1qf4KX_|@yUf{8Uo>O=j=MW<y*J}n
z6Vg5*algn)gSOXuts8n48LTm#FLAJRS0P(loM!D72V3v(xzA#1qL2Cfs$RR`LRI!P
zjzyX(r<^v(Jt>sAFL&g{=XpYBj8uC*AG|WvJ6*G^Ri{vRm+7fAq42FCjBl5wTIVeb
z^gqu$v+B+L-I^@sOnKD;xdIk8i+enlv>moyqNyr4rEAsO?(M4rqkK)TbN-Rt_OY1r
zX20pLV(oPvmk+qVa&@ZOmANKd<6ijo*ZJ}LJKgo9Lk>PYdz{}scK_aAJNE2hXj^{Z
zbM(wxmRc5zjPxe#Y(F0GYU>7Xh9_}pPW&-i9{<=g-^}^2M`Giod{^$~$WI3k&J|yh
z|FFAhU5)yh?!dM0T)d{s@ZS8;c-Y#V(adSH<aL8nO@WV#e{D{PX4)!tbe^K8Y^bHd
zse*t75y!aZ1<GIeydWk@xvQpy&AT$UCHT7Ky16}!ae+$;igdjg&79TOWksfRW;<WE
zpYV2-ncr-!haqa0nzCgY#Xm?NOsy`6aXr!aD}-CaWSz1{bN!8oMYB)6{B*@bF)Zqi
zcj#<|td9CAZjv5s4S!TtRz~O7_%kf9dS3D1(x%C-jR&k5cjmom;lFOh&saDi+@t7(
z2$$+f>948%QmJPeinwOJpIxj`_Nd#$mG9>?Q;o)nOco25?22Y7J~R1CarlkJ$4?50
zeoFEw_t+Bf%6RE%Z|e`U<$f)HGi%0T$F8z{$~R)Jri%IPocH0^?gGxzvaR2b%P#y@
z?78`f@GaG|j`dD6c5SFzR;nR#)YK$Q%4)H|ge}YGew%V?p3VHrJ6q4IMqXh5mFaJF
z`dwX<p5zhV*$ehR@8*kS^IuhY=WKS*J-hFg?>((V*1zlc{yac)`-5j2=SzQl<nbwT
zd!d+AUyAdRvx`4`-mB%RAi?5rIN{}^nrVrBB~1_aHz-c853=}h$<(Sj`NCPleXqIh
z_r15O5&a^NtLwJr_v)n^rQg40wDomf+-s9>d!6$<N3{N(iEmr4*dM%jgmL4)IUl_y
zxRgZvyt$*(XwkBjy@yv`(XF?VuGZ}0k(S*oQnmPOc*T=-N5!Rr6&UX`Mu@Mtxpscl
zvU}V7tIj?wc(vmL$Eqg>zbs{8*5hN*^{bm*R^0devsk6cD}IlBpRbBO{VxRs<i)1v
zypff=ti|+X``YH&pTq7i%4eT<C1`)f^Ui6_UmopPoN#aBS<BTmo9$lT`0zqzPez~D
z{^<d$`o6aBQQfm>rXfdq-`CDVdkTKFuxV!)Z%Z_txU)TM!|N4WX3lAuCD2&s7=0pB
zUd!J;?qy~D))xorOU^_cH*B@Bj6Hw+n~JsHrmK&o9yPSsJ?xE<QMQuxI3>83wUI~T
z@H5wt@8*f0{J-6-&K9gV^XQ4+$)X3}U(~#Cm@2$tPEGpL&m}XD|4-z%_$^WHY0}4U
z9c9_@zT}#2l5!4*+T3sV?c$dBJU9Nv_I~MY-<N+^U$jX2$ak1kKf9~#NoCLN$Lk*}
zu2rs7-;}akwW;&&x-DO<Pk)lj&)m>A!$05q&8x#@&dVkkin_5cD*9QrSL9poxrhZ7
z7qUxypT0cuspQF2wqv)7OtpS9IAz$bJl47|L^w!px9$YnA4LaWK2)x5=sTXd`Izm2
zcgg050v26g=(J0ZJt6P%;vIF5b{aBCXDIG@GGVV}db-CysoWixxn6rl=7--Xy3i`X
zpg8^7pQFr=0<@~;e+{o+>b>1;-sByXL3hFouGKHv<zCSg7Bo?$Yw=d63+iu}CTo59
z@KE-A^KQL_bp`7$t_+*8V6*(+hL5-Zb?us*Eva$%{J!FAtF7ZaR{u??kg%Rop|F&5
z%hzqZ!r%W}ScpG(?{<B$$agCa7NM0X?9YFd#+UzYZ<6>~eE0=g>q%~#{DB%_1_o1a
zoFiK)sRe176{$s_ku96-;@cLJ?*G-^@S0yFUFDXaO#Zd4_oDpQy!mmeuXy8gwNN?n
zZY4#|<gO=7DLHrV{rmp<SToCy38Ke$wg-uJtL(a{|Al)&*~zcRH=m!(Eq2-G!pTaf
z&6CbbK0W?qOUEPCxqG<2m6x5|y(gl0Tg0>{SN|P+&H1O?C2!i4n4pR2DhuN?W{GPv
zsHygbSz8y+Tkj!pZuO=|COn+cqL%ueQ&KA>r|O(Pa_(H;KFw=~YR<mSXKFLOUny!H
zetK0(W^L$Mu6f5pu1t8kE8%97OVgbUtEPn3lw~<-FLpfQd}^|D+0z+18E%y!mkd&w
z^z5Ipo^=vD`|{kmujkDlem%Q<_T~8}I4k!SmkHO+@H@XOy`Z!qe7@bhdw+Vw^PgPR
zm;ds0wf*B#Ud{P&@wFCv=RA7gyl0Qi{|ec<T^8K>{`PJ2mx=#)@OJ*cJ@r4nU41xP
zcEXSQmutk9s<^36s66L6^ZCjfmj4TCi>nF+l{S5N_KJ(~zWYjstj8uoO><mROV0kA
z-1S(NX@1K&M}D2;REa(o-{;9eQ(_J@Bp)(*Ful{D^}X?dcau-XpKP~T%q3!<vyS~r
z`G?>GOYX(*`6bu-v)b*?R>?+Vc6;}iGVjEnxIfaZo~L+I!}j~h^_KoTS9V^nUAB<#
zuKIO;F^SJra%B%1!gZyJik$lRV*6AcWKJq*{&Iiszvoi#Z@;^|`e%)>fsI_--<<A+
z{J%D<cFX;E?H;Z0|ApfMw-SSr(%Tb{{7mzd$(!OLU!dH1_|}^1kz0~JnrQ#53c0<*
zKI6%QBNx`>H_eX_`}p<e)$2F+uHZW5UKfyj^?=m5^0zC^q>YbXzY!ud?IM%I)al%-
zc>cWmdm^YaP3?h+mz!?r&wp?K#fm={{~)thV(HWp!E47JKa#%iSFMYkqfT${-zU4S
zTvPjSAkuT|zt7wL{hm8}^}cm&DzhAv!=990z07g+`}X#0s|@}`FNockul6{4#S4Lj
z*KeEl8v6X_F=}u9P@i$|;M0qVn=ehdWRT!@`RB#Njz2rPgLRw>WWW6UwpGwHMOwe%
z*XQQmXx6)N>5RtbE@vq2d;IF2&C%-xt%eJfH+Zo2$z8G7(|wCYNZiz=gYQ|5o%ohF
z$9W&`UQs%ua-Y_g%m4dkNz8jVTh~1G=HGIsvzsda+3(i4uxim1-A(UT_o*-Y8F$Aq
z_Um8Y+{Y@>M-xRY8}{ZtI_h(jdq%d;z5u(^t$chA2YA<K#P=MqRF&zOSbx`Dir41K
z{iwE;PO}aulrnC;w^sP^JBByk&b4}kT#97A;hAy2BGT&IGiA?c;Y|r!v_DOpTlV6`
z>O(SK@#lQJ74%xx8y)Jo({Yb;TJw)xv-FhoGIoR%)_&MI@#+T-UFmFw+Mdinp~=Ys
z=ZY`9U9P2lv&-+}srMWASg^V-yl`h`#gPrmOphh2+}<`fQJc~8(cf=x1yr^Ry=|A}
zHT5V+TYACp<Bxvh^@l&WA2`v%Q0S?)@$-f4N7n4zxKl8u{rU9p^vi*IO(OXjt2tdH
z*L_;D)Jj4`|KYZUM-qOR*xD-p4~_r#>*b%ctXO}0|NA>TtmfpMU3>In$Unxm-7BnG
zZms$4Z2Ud@Xw4E`fzwi1vmHP1cK+qrt9A0zrmuHo7pu$5yxg!fk?D!vY4?BIi!%(o
zmi@XGoqT$lK5M@3&bXgJOmaVB*DKDsyy?+QmxN|jldX+aVSQWW-oBL6z0Mn^uvh5U
z(aSk&^Blegn3j9V9W7yd=zRa@tedy?tzY&{ZO6*4DfdnlF*zTNZPsn<NS>q45qxZg
z^8IZbGKJLzH5Kmv7%m>39k=IujP3hLvsEP;J1m){<1YkFu<#0=HNlAe@(Hzu*;53k
z`=7GOXY8KyC$4jnL)nC4uT!eAtb4`M7sVbA;o_Uq`|MtIPr?73MR(<Y?C&XclVm*9
z*>ia9R?TZl4yL`|cIPl(4p5ifQdLrV{ZZ-VqQxt@KWA|~dvT%Z<r9&%X?1DS9w@DT
zV|Q9!#M-EE!%st#JueqWyP3^Z{c_>&vi>~g#ZgQ3-7L-uiKR-GuDqUoer<yE?=qzi
z%a&Rkp3{2oHrLeenI|^*-#>X}PqXsF-n*s+1y7#UOC2n@+0}bPtnXKy`P?fn!UFfC
z-1JUracvST4K}-V^v3*8Sv?|~xA{&@7oQ(pz3qeO>6kLZ_El%~td`%)Nfg%adV7-T
zUv}zt89m;4OYbG^+<2!#?cAEEy$W_8Wiv$d{ge|<O*)?Mc(cf-^ws{}>`iO8e+=3Y
zD=IY2@!2%p7bl+WUC&}*%ofP_GTo@Cy1#1Q#>=ZqyJWP>9ps!RxH$jGiJi6A;E&6k
z-L1Eit+OpMepEyx@l=Fx9?t*0wuUi4vP=GMz#dNZI)xD1qzSVs<IK4OZmx?p>)j)L
zE<~#7hJ*ivG>5vzhwV>_e~K!Hn6n&YIr!f4w41|f)uooFg%+pJy}WXdTbWn?)H5Zg
zN>zpbYUGBV-e!B^w@`@0v0ktI=(4KkH#nT73$s7pyAm;bmTCXh_rE6^Tz*`-G-ubo
zjwRc=`;@M%5O!yXovTr}X<N<RHFtD-*r)sFbQE1N`0TU$;MwK^8<qOIn_MOuY|(k_
z=9F7~Y|ly8)}$h{8}s6dV{J2Eot?Bm)-!l>VTseX-AeNsyWUOJ`Ts2E<n>3cUoG4c
z!rAJ>6)g8pl~om){_Fq$=B4W-eJ5{Q$i~_Gx#iZ>iBlZ<KA64!%Ef9h`*w^z!*<@F
zPe!x0zTc%YYg>49<C?&P+64=j&rEoh>VM$$V?o;wZBEa0m|H{FvoL*mRVaPUEuYzA
zwFlGb+T-%3c{~4K4Y#*nD?BqQOLw-EWWM8`$+P2gT@S9^oomZ<=Jn6>;UT{6{r<t(
z3VD$l9Se=cP8pwCxJ8ubMdzj&eGFAPk<y>08YFDq?sD*>lGgO-8%3M9Hs_SP<n=wW
z=nFn<bKdUOyw9u8G$!+X3#wV^?E3%ooZJs5ICbYe?$|&7==J4Ws&-ZM?%2NZS8tK=
z{M_2_b8O8vNlk7F-jTdKDt@xs4kf28c|pG?IXS;kTd`Sg?}N|ZGF#Uk{j;QFyZ<Am
z4?cTD_<6$SO<H$<a;i&H))b+(ZlzRJkJ9tflS98~==<~ixqb3rEc=d*Ni6+hud*8c
zIJjw^bu*ebne*U#w*B`_r}Wspn3=6qXQI(Av(9DxgPM?F+q<80uJQz>JMtu5caxrO
zqgEWsccNA2eLLr4C7sU`E{Fbe-B!Imvr@bFM_!MP){n&9_og0qE99AG+~j5x=M~+h
ztP#Fo3FFtmb!mq+*4JhxC{~=8JE?R0_@*zBib@S4qRSg!f6l7gaCd3UYmZM?&i5TX
zFry^-RQCdtcYCypxgVbP*ssr7IQ3w6K>6IN!~KlqP5o^zdF|qFKAgsr6m5EPWmdla
zVttY7JCk}F<~+{4zlZ5R*RS3ad%P}hy>mOsaACj6I)(PvW{1p0-MXrD>;62+T-37d
z;K?_WUdx27mTGfKba<x~HCZD6wDPglTDp;pKAn3W8K(Rd`w+?&a@b1UgeiLZP3@F`
zvmH_Sk8W7aSaX#t#q_&dpPE$dZn@2F;vud=D_hsSV>xzPwtC;}Kncw)<t`3^syfH_
zXq{Y>lxcKwqNKZ!E=R(YrhV6pEDso~Nqlt*JbR(S-EPfGu?CHd9`|#q0jzob3%J8C
zXKs?^C=vTwbbuj5IDhl?t+rDnX52W@_%=E`S4j5us>XxThkfQ7axDm7C;y}F{GF<Q
zRRRAyrhRjmBz8;o^dh^Wu7?p`*_Tf6CuDyPS!#F0QQ{M8vzS@ufp07|on9Zd9V_bo
z?K&sDc$>nOp6Z?;x82Ei-Lh6}e!+MwfN85#%_ni;9bb5--<^6u;MZ|}hqbd3TW_bW
zkdAnoIZyWhOT!7Di9Fr%C-~}4p9q~LGr9gB_dZ6Ay5GqR+ctEaO3RvDUKwgRf6v#N
z)0*4ld2{A57S?G;EEHt+yyUsCJRqAPhNVliXD`$0?x)_o4>qQFJlYh{t7B8OWy;<N
zw}@(2fsM}|{GGZ}dA*g-f$OG`C#UNs@J4z(i80~4V)wMmZKi@DM^@sO)kju750XfU
zX5DkCYnr$9#T%~AS@~8kIp96Da8}cDgB69dwY?@@H?28-rC;q*re>5qyJb8}-xRG4
z78OztxfLvTF5kk?G()Zb(L|1oU6(}mi|iEOxnsr`v$1FGo6nbaPvUQBI;pVlxpBnB
z2!93loj$xG)lP2gM;B{IE(mLhnvwQk%K_=;P{)YG8SA)|%+EPQYo7b35Pm4g(|475
zlj~6f9!_cgrINq6B62VNbm5lJESh<2VZ@X$)!n{Z9!;Fvn{nUx!N$@%j`tVKy*61O
zUC-{9zjbl+{RXS&m$QowE6luW<@=Q{)7iK0{jJw;zO8Zd5q`M1Nn?W2>MIjtzx|ji
z<LZ=iRY~)euQT^U-PhCDs#0oA>h{}zzb0{uqyMJtwuN&n9~?VqcyHg;9lIy5nznN1
zE!EofqK020H*C8pzVpEn@6e|+?pZKYF&E8Rv6y><%qO1<^&tkyyZB@xwF9?gor*52
z`97tl`oycQsDmf!?r>JNE}eR}O0By3N$&P}g{&KV*=r_D40DbNy1d7qA;Vf$`080B
zO&cDmTIWM~r5$H3>+-qY@=W;uQ}yNg<!#%fR^Bi6$Q3`BXeDJb*D}7!rPjTCYt77G
zP2J4(9FjY=w=c81wMpyKRE|`2%}4w?mw&dZ`kdS{Rl;0%OH$9wmor)v<~`fH_u|^=
zk53l`T&x!U6TfKJVdvt8=J_V;dDzk~|Nrsf^wHM*C6O#%J7;J<ST}#G|H5rgb#9b@
z%DLcPy7b%2oDYTy-9MZ>gs!sep0Hy@?jE)53y#ult`WgU!mrD@XujFBY~>wIj)|hY
zd|Lk)O?Lcid~m0RaURRWt1Hwvk9Mr%WlCHBVXDu<h4Rw`j(>2Od@7nNKy=x+nKS*C
z8d#q?!YX2NJa^@HQRTv;mOetqv}<;ssje^mdikaLS3hyRZ6f`x36tWcTG@WDJN@R1
zP3UvC5B?1c_ZD=^@c&yF$;>75XqJwJwg=CeV2AG|yk>ps7o#-J-eEcO@W4z4hYOyS
z4)xi_*Pi+$y=8WZtS*{s!SLb9qq$j%TRwa`w7@u|S0!}&?{ZmAlT#O-HtbK{sql44
zp;H!XZMXa+1A*0xO}6A&eB04v!!2xZr0CeAps$q|ZKCd-w9JZH{^G_;nTWSt=C#L4
z9(!&6?HRtq;e<_7mAYi|U1ry9r&wE!DyP++d>^_jZTXW=F7bC=F8tol_|u%H#cQAA
z>8GbpH)hplRDQYs(*ODk-_CvA)xZ5kA0}`3RvnXJ>al$F65i#WPgBnSxVWx+fzG7v
zZ-pyN_N~5NTF;ti+Vr+4d|lr&ul4Ee(+<kHt>$_sA@(a``_Hvrv$_5x9{TVi<mAGD
zL!a0_OM8TT-Zr1*k(xp8t}PcE?wYnT6s={-O_O%C{yEXvq`kJN@I_n9^K049*vuR1
z-&H-Aak@6ExMRz;IonvQF29@PAEIWTlB8ez$=tF=KXr5EJm+UE`B$1PzCXEZR4#X;
zO(DG8VY5r=b6d*=cNcH$NbXFpUT7^HzF+@UNryw!rHu<csvMaT@>Shz&q{R*gzjT9
zWSi^E#g`MB+<Uoey2(ENi!BQBFIm1=X*aUOr*Ss(DsorOY~X(38NZF?-jv^4_`jY0
zGvRaDuj0L83R^YJyjIu*rYN0%FPNX6<EtPsiHjkz@0*4BrH1a)FVDVw^5^jHy{9kp
zKYzdcy7|GU)$jcTH77^@Y;*c=@bgqtyQpG?$%T)dFTX077n?tIn7?q=-cP5vcHVW~
zUM8pPUM{Av&US9zmFj?d);3pdes=WjUoW4zDz{~Gy1wGYV>x*#ckDYleO66<6Oa<u
zxikLXf<5YKMPDXz-jwU~;$SuYP_3l!MEt_FCA+3<<M-)%EhBI^`APP3?JI^x&55F^
zIev=&PM%Y+JGAqn{kfWgWlYRVPpYNfHuO?2R1paI=fuijqH*Q5yydsng8cU2FU2pK
zHtu8*dc69?ldU^ATUcLptxKE2{B;vIt6t0wi^b<QnlItk`ltF-D)g?!oQtfdjTCZq
zq#Y}`J=ZPeU^yS5RBe9HEG+7*{&s`QvgOimXKNjbH;U-c+HG`x{_L5#p}u-o^!rNc
z6IqT#H5@;;K;eR0!J=b+1^R7Cy$hGtul<&GVE1Q_rK-Q!!`E1I&JE>mTHlfMUMxaJ
zxKvEee9ftd<Wm{}YrZvym|XsTUQaJ%cHXbbETKG)wn;JOHx$l4e)VEWSJwjW%irFx
zEt)9qvf?(wVZnd8LSM^Q{?q6BY3`Y-E9tQ9#m&35+S(;Slje1ZFA&{2r{S@=d0yhl
z?ar?kn_ufw`gN=E3}^X{*K>lZj#wSPy-{<4Z}EeZygrw0UrcW3Q}Auc*eVetm$4u#
z<)(RvEn8%9`FS?62QKDc?5|cgoieLy?a@EJb?&pDd%t-+aNlq!G|XagVM}a`!aK(3
zV+p2$+YAq^=2WWR&91oG=`pi|j?e-vb=D{S85@|apA`Lfc^hV*G_!FX_pzkObN`&$
zq*6a&sm(sY#4}|fqBAu2-iznFFQR!vKaIN}H(*ct(ylz=nYUl>QRX~RouIT(Rm7aB
zKR)YO`N>T>+=Y9#Z)aGL#kMK>?aBKVlfE|o+7%v>xvRXS<U^KtSZ>Toa}no%zx?y>
z@3FPGV{eeXX!pHFgP-$!lwa<PmvwSC3bH>Y;?d@2o7wlC-_JNjYTDkF&Mdbjc0?bs
zV9OIf8hxYUaT5EU)%!o+N1ZOKQvR3B&B?$}rigLa6KtVhN@_uIa$=rdLFHSi=-@lM
ze%98v@|7Gb+w_|8Qu{SqlZOnJsk6A5Q=V-(eQoj9)PP4@Wjxz9r+#Dqn*U|`*ULxa
zZg1lBnQd3Hi~q>9eZOOi$}T?rc~XCKxrt({!sg9WL?)$8`M@DN)ncdW=H`O@P2GKw
zJD+`d7PhE)Z?kPlsrQ9yrHIC$BKM-ObqxHTP2sXP>i;=6?w@sV{{2OpohHecRi3n%
zHbr!@=dqhyM+?JFc1^Z$D`Bk`dblVdsJY|hk#(v%=RK3Iy}6YBAl`m++SVhV%$A>i
zHdQUYC}{u3XP)c4qwXl^ToC<m;zDS}*Xf@x|M=m*{CK_H?+?W$jvp?6k~}fvkJdq#
zu6o^P)>@p$e~QGe^`12Ef{Wipb~XJI*Sm@)<!QD&6jG1(nApauYnS{xX!6cOf7(t6
z2OW~qob)x7>6dU_SW3>K%!sBJ1*cD3mwxs9W^Dc~9a|HBDTQ=%lY>9k9MFE`>fvGc
zmPsWi^wOLqn?=1>&p9)Nm2tz;Q!*38Y;_K5&9f2Rq4nZ=*O>@IY4>QOY2QB<9orZ3
zG{^Ocu6Ol^Yk!LKcbe_;o#@`JvOdV@@KN7;kw2mgJ@*`4q`2R34pZ`@;&bmZtkRNp
z|K6XOq?IOOG&$WuvA?<8w~Vo>r!{4&ebSmqmqnkwmRy|@c`{!+?STvb2dx_S)+--s
zTQ2R$W;twi`QRhAJeJe@wr@1c%~r7#W11^4u^?)d)>HE~&PATh#qK+_6a|?kn|IH-
zbFnehU{OcFS^0ZnlTSYR@yEuly8hqCM_T(VSU(pF-MaB<XL;@aL)S#=`_k*}XZ<bB
z|MvUn=?DCA3k3b^CEZo_XSoQ^XZ|sHdqY*>7e%|@1%KXMKABllSF-fPn?G-(_H2k`
z^Dlm1mHsgP{{B6D5B(R!mrLFGF7I!*_w}MUecscrpKh&KDZm`@CEneB4^KRce%<Dy
zd;fe9UhuuZ^{P{S;ahE{i`l-emjnHyh34z+-lOffY(4MpCQ-wP`N0|=Jrl$ipRkeC
zs@46KRx)+Ys<)fx+t=)|u(jJ|!~1JjPvDJJR$h)PjoR|AmK3O$PWWck`?6H?<O0#l
zO{Xlrv7X$#^6lJ0wj;iQ&J()NMhlp3tnz=Vo8)jUf1$(Ir{4Mjy4%hy^4p~OY2lSx
zeZP%IE++d5Ofd;LJm=vR{mluN7AB`M8T`I-*X(M*fwKA8d#|=`zpC6jJ$q`cR`c_y
z^3be?Q-_yv=L@;pa9&GMKd^1tOaY$$)iKL>i*|2eoG2J!&%Pib;CjSQ<vh-77nqAa
zA6@csJA-z1d}Mq2s>aCh=NFunubA9iq7!O=wn621>voO{Z~6l?xHo;(@d@POl$FbS
z$o401#;n@IF`MtMaw>8>_Q9ct&(D9V+0}hs%tGm_+*kcDGET1G`~PjJ;a69Ov?HIU
zb=^2NOX1ReCdT9`mzx||&0U=R3Z%Rxq-r_RryXLceBoGeu8uuSWsb2PpKVpJ!Hhdi
z0aGle?kkV2a11XLHu%VO+U4ZUv;PA0e|P0yIA}Dle8a3=rd>CtT&`$w3Etu6=^(JB
z_1&t)b*zdLVjVW~irp&+oBFSg!LrVOhrC6`?t(gp{NDPDvqE2p-50dbT;R3B(oQwt
z&Y6u&4`U483UV$NS$v+s(v_L%xRq}s*9YsMcf5&mEy=udGK5Y|=Hg&pvesux$AyJ#
zUeQ}0JXmysm$f&WEB8}a?2OkJqFZ)^oT+iXWSD>3RL^%a_tVp5pAPf=+5VPCw&{S(
z1@+GzaeSSM3j~(0ys!MqD1XasBerFJk#Z&~$3p~Wcs=~HOKG{*;Xh}p`HxPTwzE+C
zi=y?j=v(}@X|pdBr%LIr**d%G>!RlCldA3|FU#8KCVOm)PmYI4Ue1NzfrfK-ty@`k
zacRq<&8_a%`I5ICt?d){Ew1|NcPwH{i@5oj@{57o>*p2))LfjjK()DutN*N}U1)yU
zmYjq99i|6zPM<pdThOi{@X=KUiCGJ)%G@jd^V)H+F5qQuvcIIYv0;51qxTubuWM%}
zr~b28{VC?^A4lnW>*X<ByPorGT3PM*g!S{@R%z*8j%jBW8_D*Zp0Yvd;HG7hD*4yh
z%zm-(bl&6I{ckc(e!g=iV<BI~-glC|Jtv}dO7|{bE$XQ`?Z~f1dfcnMJY>&`o_)%2
zRP|&Co2HQGQByS^QN>-m)*jice0u|5mY~3|jiTq$3|S(c9Cn!a{B@P5>pKyZE3?)J
z>MUYWSYW5HdhWZlRbqT!FD<;Xs=U4?$&PmdtCA+O$yHsS<1D8$GC$OvKcRWSKV@H=
zu`6SirZ}h8OWBjx^Bz_%@$6d?SZ|c`?AZScAwS}!epns<yZl`B+{ORCOI?}wc=3D7
z6MyR4ewe3qsJUCcWR9AxBWP23EKz`AezDk^)Rp|twr)7E<@UF-i`B_l)-x7JhbE~w
zM^v-C6l1H-PdKj|%4_ChnLHy=-ZNKcqk`^a$GYj3ejTsQEchjTo-_SMz{D_R9@i~@
zn;24TRWr8F-E};U{p7)iE@68dd|Gy~)uwIvFgLqz(q-!xJcd*5tbFxlYuW4%3m5Lo
ze3{%?#XoyOTBmr^e}(5Y$G!JTt!6Ayx!~kB*Gtof#k4acIPpu7gLqc+W>M|CaqHaP
z&JHU*e`)Wjt=recwS1fF9ansnE4uoxZfRQM*PX>jZ)Y5wy!^#N4%e?=e>6W1`2Mf@
zN!+UjU3=kDb(UrGcBMppzxsLM-)p)R_4SweV-qf3Us>J$WJ0*tx!J2LYu7K?IM*rY
zwoZi2u`T-~ihpSAX7-)C(l#M?#zU*T(&rl=6~35qQ9$Qy^s2mzTOXBX%DhUl;8<N}
z(Bu^rk|%rb)~b);m&NYhSW*9%-zzNa`sr8OD<^S1-t_(G?DOBm6GNR;Cb_#@Nh;fK
zvh^l!_br9K8h&Y>g?y31-jA=C`$gup-^{SMuJ~<j+?K83ljH6eJl`C1)A+>-+4-sa
zkDs|_9KQO<xm?GbE02F2OM7r?e=R5f+>dc*ckktlsAqXm%N!8@{_vKlsde4jUzUsU
z-|qOPCVVxyBJ@Xq%5L#nck7b%*B2!zFi+jiu5g)mj{7^y=2NjDt5qL%q!y&?T6yJv
zlz{z=X}2;i{AywRxZuT$+QfYx2PS=<y6E@S!$L;WwrWMB+`ad};GaHfD{2k*+(qV$
z3=B7MZ(2#oEK1Hu%u5H)fBH^v%sy<u)B66OXp`)u146eBm1&e1+&aCW`CygAl%zc_
zo;+J+be3=VUsp8iP>sR2&GYW1+aCOW{oV3Ax1~Ba{>hlIC|9@5bPxZscN=3uxxcbR
z+uvz=`-@}s(N9aKycOlMJ*2)#J>x@Dy1j*=v&-WtS<U4OO0AC>F1VI(_klBu^OMD$
z*MzmFrrs=LpSGy|7~6|CteiZ~+05RVFOIETxRC8b*H?)^*UmM2i#>N=k8V<76Y0)h
z{`v69sVW+#?$vc{a`o*GvY(Xf`}kP%9-DV;mz~Dd1n$HoF}prU@m;-FWK+bmoaxkd
zm)&6s-W?|`T70`6KYnDgl7Cxd>^lFfOSa*q`qOH*iB6UZSmykH#j0C#&i}l#MBqzU
z+KgAJO|yAZqO6lWU%xr05WnI>R`R@x%dSrPnp-rk$Om{cvxqP-FmNy=t=k@DesIq;
zIY9;nc^90=fTZS?8Re#B=73gtZH=kUzwIXUKYo6a;&ugA?<{?dONScxp5O3$)SWB2
zajy3QE*4i^)oUUrA0OT(@Wbx+**D$0Ra_1IvJ|GeoI7{s+_}fw*UL?q{rd9x#oY%M
z2fDdG_m+CvD1YHghm88V?aLO2KaQ_vf1={IEptQE^Cwr=uaBE}+f;SBNw@N*CHy8m
zlX<r&Tb7#doj3oO^dpP9iQ<~2GD10%EY5aHyB5BC<|vcel=kx3I`LhRZpNNV<ajwX
z1of&PRc>olH~e$D%XQK*IoGb7*e8xFJgzC$PO|@$E99d6DD6oYhjjl^9x2<3!YAyj
zUv>LRtWJ;H<JmM}nV0d`1#X6Mm*!OMe8u$juF@G}5xvYgC+-HkD0?vZ_Q$u=UmHJv
z^7rP+_Rp)!-EEobFS)$bD!knD?ZAWZLcjhKk7v0ZiPeitzZBY-);3RFvDDb>jzRZF
z-ILc#oIgp}&pb0>(cDJwXG<NKcCiTleEI23T2<-ik59x+KIz|_)%I|O%DK9ijn7V;
z4Q$F;#=E0Q)l^!(yZri_UQ>m|^-Ze;pZ<ODC3$XVZm*m7u7cqFT;8RHYBy3&%rg1g
zn04}qlYF$=_Zx-zvI{y7&fhRyTk7JKvoCK*ZSjn)j0^iw_hHG&x8J{e+PalhJ`i0v
zTPVR%E}`R~UCU=BgBC&8|HYSccQYBD@O@d|t+4d;$=s-b5arYAVKGnaDq61|WpJ1+
zV(IwH_U_k97N@tY+sFEzVdA>>#nu})*|cSxaqQh&bf5FL&~$@khk7I5lwDL|I>r8L
zap=RC{h`yDCe4yxzSvc;<+S{wOR_BUK9~KvSXo?NSJ-v)38TyVK;}>3e&+Wj7?xk*
zSMsWeX4<=g|G3@8qmOp0oPMS+ROf%WqfLMEncMq3)=U@CpUlY{uT}75_iTkbb?q_N
z{<%KN+`@CmLpZn9ab9wj;ytUjUGsd?t|>(v%>S8oFVOg$Ra46L=*{=`hn#)4@&6?6
z2Hp$5Y(6E&iH0n-X?j&IRq<2j^kv1G{TxQ$YVFj8<KE|9<UHPfqUZA46wW7mes?Pr
zU2dq87e2tp+4?0ey;$6_{gusb1JS>S1Ap4RJ*2Sff1TdFV|$m|uc+=(JkNNdaMptj
zyA`u}d@r81>^vi~HpFICw5Ni^x4q>R8@5a;Jb%~olJ$dwEc?q9q&Ki1_giBVk*c^V
z{D>->_W~{<?x`^klfx=nIFIjbzISk^|F%NMX@-n8KAT#q8uzF2x+%L@aXsf{W$)1Z
zF_*D(_T()cN({{x8ZWR0q$@f|y<|A4)bA+4^r1ms@Wsq!JhPn)mPrSi?yTF}Tsr6J
zuC(p16@)t`=5SSPU!cK%aItjaLhefzNe=P}nhqN$zka=4{P_Dk4%Qb^P4@x}A7~$6
zxVM?dK)<r!FjGmp(H<AO8@>e_m`;4Pxn#{C{GIQ>eSzk-jqKCPgv{e_3v5_@g>`$=
z!{mhE&vA`&YiCIGOstSed8ahlm(5-4BxmxOBeN~58`Bc39AAr`mHp*ns~4R8vbo*k
zUHwtV6#aIWPvI^x%-5YmGJae5OV*bylQ%KjC1fW)e-|S|r+>!0%_hCUyZ;v-vpLk?
zo#B}<r*4<szS{fh_S2bWmdXW7WKC0*IU#<f@8Zh~m-Al+*V)Mm&B->X=IuPAYQ1QG
z)4hfAioH2GCJK`|e{Rik^b}2Toboj9NuZleN^`JKb97?LLb)dszNjC0byz*<k^k%S
zE6yj22;5lbCRQ^y^4V$U1Qyete&_igc_a?oNuO@`srf1{-|WBfqcbx$9y`-wwolaT
z=*M)iqdVs+E6nY6WPWz}RpilxxJf@2a^Icx;pTG-?*)gL9&h9jE77?<sj%r*H1otI
z)~0LBtE*mJ`SAI9)a8ng;pz)7oBv;T`slH{F3F$SUOwF9{kS`LvEq9pX~~QgYic#t
zs2^X@>7b!)vEooy$RxKFOLj=OY}%|kbCYwkMQXI`l@(Ldj!v4bw@pSl*!JK?uU*cb
z9Rcf7BxBD^J#G~+Gjd+**9pPX-g@x_Wv+>vqI*^OYD`IW{{xkWJS<!9?V4P%w$_)`
z)ak92f@Jcd7rbn-R}3Oev@V^LnG;aBN@A(imue9s$*Epn`A!`3<%r&GWn2At&-{CL
ztlqDCH)rx|>oqrIvT`a`Nl(`}E$7e_WAT)k{ie@}@MUdVIVZjOns0F0deZ%)e{OQc
z{r@O6-|k?0#grrcCcb;F?>{KQa!=)l=sjC=?eae#pVTf+b5doo_0e}$G{3v1wtH<v
zZe4u)zr26BbFWw3-MIVyJ@fRc;OS>C&Jd7KU-qSRqTa-xT3T@jW;N#@ob}(}=KbHA
zOS^kIC&af~t0Z6a(M$;Fx8gapYvJRal4o-sizoGan;+a7(Pt-6mch|_HTcI9zg`Ie
zdqzcL35JX-t(J$yxOX2c(@34nupwi@ddYPu0m2u;y^?;+v}4*Q^f`^;jl+!fmv=<0
z^%ShkHjlda^u`3O4>J`zLRGJ{zSg<GBsF3EPph1DR~bawa#U~6X-T}V&CtYe9xXd9
znX&lGiVCOX_zn8b#R>23ANp=?zWhf_A6LbuuWLRFYd<MmHN(lIV?o6a+36`#wmWZj
zKYYD;g|<y);`H>tlTSb9Pe0dLY_xZe-F}PTH;!*fUb1~kIM+23|Lt2<GCutLQz@^0
zCP&8Hu2LjTL;l4y#^;mt`M&76=I^_6XI`vT`0?rKJ@rRF8OyAj8QQCqZFm3hhhLAs
zJbCjh?bOzLf<nBD56QYr*0?m$^!gm1T=|y5ns}Aox@A5rN)dYuEBH4zDsg7MtPm)*
zxSJdq?8A5ESA}HP(sZRoe2QK>K5sTXps<P~xNUlW<Q2b;{Myh>^W5Vn{`k3i(zlpH
zRfn~2a5!bxep_xVCov`T|AbwSG*r5Rc6eEyUe)2;E_m(P!=B029dBJ9xFs@7l-<nA
zkaqoX#_61p=zE8h&YnD$w3u1le_HgDjZ1H4Y)&bj^{b`!o`Li&U*15gB3+ir%Y4qc
z=7{@jsok`3`?7m`58uCWpn^lv;6N;I!G#XHM=C~-e+yfOv-a-SiN9nrH$%wpyj|?w
z*chHKHeIu<cRllyvtA@-X;Ec%JwwA<>F>T|>xV~T**KJWH$NzTd2`3E&fxlEUOsLK
zNm-ejBixJ=<&y<ORkj&Ee!f0&j_&2<dn`^V76yO)Q0E~hBCnUhwD?E=B<a&E-(T$H
ze>0OyuHw=J)q?*47QBmlHqV{8+(mF}&0?cF3!a3m`|hvu`qR>gN%_K|i@N+Cc?H}&
zb@j-++|J<VJ=<0<a0xpr{Us}!|N8%1p*h!mgZtL|UOPT*=8HG4zWn*Y)pk9`@_0=*
z=fSovE=h(-D@|`K+;Y}SRY+EDo504K+(8@l-<CAV*SXG%@@1L3r9fD4)8>-URa3(z
zg(&og&XstP9W=EhK6akhB?fcne~*{#u&8obv}1~kT;bYD>J<lSl8jr8r&MzpJGkZC
zTOvOH-+9R;aWM_SS!UZ)Z!X+uS$(;YIm*m$Td&QL-Fz{JQk9zvZeG~NIALm!#D$fg
zllp&0-OD<1(1wG}DkOW=ey%kepT4l*Gn7AnB|F=c>r!B4T1tz`t$RB4`s_QuB}rDF
z)qQfa@m9COp$+G<&l~fXAK>APnEaDd=wnG-*=n{-t!=JLXR*C}&clB48WWQy`_hfp
z4w8Rt1R9^TwH3Bsm^Vvon{LGun`H*Jhu;ZyH_jKdkvZAkynkc0!t>iz+xOcWFqUjo
z{_(Ojd>_li`t9G|I)<yvELmOkVygb{yUyL+89FZ?g>HSYnq6w5)*mUJ3+b*^qU*1e
zPWGu@zc=7%fOg-WUt8Clk`9<`d(qroCFaP{f5$w9Z?j$a=2>BE=zo~aJ*Dws`nk?e
zzDl<r3eEmi=dtGhM^E19?hav%2r1o)C(1iid-q73FZ5lb^xeHag4ssln0fw{6EANI
zU-S9J_AZWRR_2F<c^~4MJ?8J*_;j*G>!Wbp#Rgk$pONEP#W8Jv-i+4Ok<%_ND0I(S
z;VZA&EIT)0*85lYMXncJc~-x6vOq^~?G)ZwyE{%M2lYA}TortuMc1F@{+-p5d0fwx
z=QI>tN$%Sq-Nq-SpM1GZXS?x%wO^+u-`rZ*xVu_vV$|2EBF${~l1-+^ewWzRt=6ga
z@=~}+X|B&D+q_1_!}lCwOmsSxPu5(}+nwmRXLZ8W5Kn#ai`t8<`!gyxq{Mv=G-D3w
znm*+*L*Rzkk7s3XDNpvRdiXDAXH4oRv(hw{1?v_TY`)a9CG!3`tM}J;&ufd`lK#{w
z<yYleZmYHTpC3K`Yn9hU<9AN)GXuj+*DkEsv3>8VtWCQ08@A8YI=)G^{=x;n-r~w{
z%gppd??r75fAe&+8Rw%r=j6U|se9b})0l8(`tnU1XSmE}4Z3=%aidK8!H6B&w;GsI
z3I$o`*q3ej>T~6=kh<HCs1;?O4%)CK&Iy|Qd-dj>v+A=-x9H5R>A$nnX5YTB<2$5p
zY<W}m{?XF4sdBSqFMqpS{;IUF=Igt6KknY_EiPw1BUAaq;qnHXtrHd}zVS;JpH-?U
z%eJ*pYi{~c?=I;F+xC3hmw0t^r~6t?<xAy<zW0V)ReChR(KYAf#|^h7Tc;gdX}spE
zlSBCKYflrGZj}^V6`p3YWoLcu-m2$^dUw7!KhvvvRkZNq&8z*-Eq~mfwV&<pwm7L%
zQ|C>YzwlD;ijC_cE=D9DeH<V)-<EsrEk}c2Ec2${jJkbSqI_B4)EnnZ&UgvmwJnjH
zx-<6kyOx?=w_mT;J21^?x7v}!ZrkihQOgdi%1r9I9(6t9{ecu;iPH&L^X9HN|H|dP
zYS8_1uhn~HW>m)<xV+&O)BCF?yMDhdsk->))gDcc3zZ>%q6GCnyts32f<asN<ZbJ=
zb9{X+y8Mam*(-sM&dI0R-+P%=x91;&YkJk!Z!$)2f6l)AxqqwAN-YT^jvp(JPs+Y|
zI_R<Fx}BCa4hN#ePB-XZXKK!yb*E<MPm8(ttn9sH5BT^=9p8Cr(Y|htz9JJn`zz*a
zeb%!u%`DILzWZRqm)A1WcEu%rl;#iX^!qq{huDIhn(v$%WAE7bKi&5%z-!ggyX=?W
ze#p8rV^i^}eWi!`9Jq^fJpZpw_;g2ow!-PA4AT_$#-|T^E_wuMe7Ro!%lVT0SN8Ld
zxeD6(l75}b&282Zj_UrJda%b=?^Rj*#@dJ5a&zq;PWgCrcln<y+v`|<DHeF<mWRFX
z(b-(RZ5lhT#frrhkIkPjmkVB6<J+3{VS)aO_aEYOCx<Q0K6#uiHv8Glt&`fX$6Qeh
zdSHEMv()32R+1Hq{v3Kbk?*rKpLKS@#-NST{&wA8)!ZGGRF|)LnzOw-HF?i$tGXEW
zd$*>wY}I)Dq`H7t>!`q&39$kbZ|t>JdC}&b7Bh3_y2V0&eH|RP8Zk75{FUC&m=h$+
zWBZ~t-r`SH!pq0M{qyBNym2^S?ml5^(H=#`{(8=LZ|*&}(mSLYd6Y%pwr6(3C*iYS
zG}+6$to$y-^10XRue$eGVy&Xl8V!q#&9i!*?7y3_<8V;q`dr7Tty`lvEI4<N#kqRT
z(d#w6JErXE*}<}FZ*+`ST0=#iM3}@ER@W6LRxqm--Dq7H#2i-naDMLHhaILdwolC?
zr@YK93=F&L%5*Fxa!IP}#k_kwTe2LF@}@gfEfrY3&?d8Gn&IL*#-3LnhAn^bHY&Gm
z33LAC<GaOIaDA>?>eam>b4_oMGW$&ahHmkiBf{%qGh<ro*XS2I+L$X9isW6jHI&-$
zSD^5&H2>~Xzppt@3l=l<sn=!A{1_O!?cbJIyWMPRspcG07tNT?bemzr+@tR%{&aov
zvG)aofs)Mv|Afa32f6NvGV3y&{nuK4`O}OK%sVH|<Z~9d_WIZ9zLzF$bvK0l(!{mD
zAKtmLaHTc#8Oc<eIv?iK-QTJk=1pVpI(6%p*_K1i<-CSriBbOAZ)0wL{TBCg+dk!}
zc{>FETQ{}EUT}PmwwhnQWoOoP76t})J_ZI=?0X?oD@sy}@)C0jit@8klR@WA%?*#v
zzilQ`cYXbX3+!GibW>_?@l-f$EOBl$<CPMZcp$-~8^|ZzDdM4(m+)i%dzr3XH@l2|
z_&Z(do_~n3m)oygzWw_DGy6NHcprW~-&k+$3D)b}pEf4FWS(E&vA(JNiGS$cjE&VB
zo*cfqe*fgF%<Azw11F{YnJK<X%ds!w+$n_<TeUnVJ=wa})L%&Hlvk$rj47v#w5OOj
zKDa(5^Ztx`p+3_0>Sk9(XHG3jmZ}xq%-?!r+o`;Vn_F*9_c|e)*tX`+!@`(Fxz2l5
z?eO6_{j+DrDgm=b=CeF&w#Q6&`joQ%i|}>NRau$M3c524pIr98F?G$3tFI<5FB24~
zFq+p~?$p$$VzTE%x=ZM}wXV-yYYrb^>X7f3Qmhe>_P(KTI_ywwAEVoHPqi-$%-S0a
z+;X!6Q`9ZCm$ivpiU<=?kJw+;rg!BX3#WGaiu85cPx1Wypsl_xA}nmDM%#hBT%NN(
zG%u|0NmQ+N@|k~dL+fKdkrK{Z*@=~pN_XhEru<{y893=X=S}Y44jT*(E#x(J`d;F;
z!zYxjbnB9>XP@uC$ic1izV+kD<Z{0mmk-}~__*oL{rlchy$`*FJ5;BA;)yr-8PKfp
zAg*)51;LN=MExIb5L@(d<vDl#y>U4Ta<A81?B%*8t5n3q>u$8gE4ukyo5`|^&wM0L
zJzHnsxNq~bKLIrktDEO#&2@V`St~&#^0OzyF(#P<Wqi9Y>|kExStDKOb>iWTBNl9*
zz0;hh^v?9uN<DJkpv!bUSB67_liAC^whIGG!W3hV{Y&mG`Eh+!icC9K#1i{US41aG
z^pv}LO{MZ++257XOS|H>G5Ik*m6+ML<Iq0ldy`G)o?rN!=Zf9kFAJOAggmei(7(m{
z$-9X4$n1#|{?&eNu3=4lwW`PA)XRBK&tC7m+RL=*QuC6ZTlYsW#@?%ZqOrW($>Vmm
zllSB;XEww~pMET|Zel@7zVNlrC+6I^lGPo_%6M|Y(`Wtdncw&pKVI;$<d)Qg7g23j
zX7bF;7VYa{{Gcze>14qRlNSr;h1@SXe|Sd?+l_}7TQ@GdKL1_V_4)fR`>xJ%xEZXz
zO>sfp+osLBNoG^#^Y;Ibf45usn25A*?zg+5tjnjCTn(SNdFxKk-ltcY{=Jg?;1=oh
zQtyP;Kc$}7!;jdc-${n=v%Hmlv`RF-`%3Pj4fhfRHa4rj5-fZ1J<3Z)Y)_HX!s!k=
zU+xRm1f5@0@KF2jCB<Xc*D*8wEV=dZQO?TEs#_lRa;<r$&*>uboc+s}j@`{)R^AHR
z`c;lcxY@;SPvvpRS4U+0d37s$m#Q7H-8k*uMo*8pE6)-qWW~*y6_nXg8NsKuY1+O&
z57U~(7fzj%!07XO$1ACwJJuPorS)o+PLi!<+sI|K?&~Ibh2)I&`SxLX>@tyN=g!3K
z-Ee2}yUkB6p5}8jw0h@%d0kU;FE(Oogk%Kox?i>RA9@<Z4_xwlXK<yc=cUKd*<UZt
z`CQl8x%aV5wrJYbZ5!IZ3hkYEW?5<bF&4%$12coZ<i%;S+ZW94F5K`Y?MZ)C_~Y|!
z(c2%tUf6h4=XAlo;@^sQN;72kc4RDja(YIY)4rZp>5otENHf~kb1?d$(V=vnT~n5x
z$n?%?D6dF*_-(Js&BE8J6VlUPy}ZtUdIC#-+5cINQvXe6Enu6z+`jgf<!;9xRu4ii
z%TCx;k9LBO%I+omnpqeaYI$+4mq<@7DM_sWm55uza<d;>2>g2&zi_dR*Nq#VzaLsK
zS#Ha@z4XHCso7#;UItOo+e){p&R59~>ihlPe3I(^CrewJKet;*owbp&tulGc{pC-|
zXWg0v&Zk{%-!-4kO6@tNx@(<h(1j0LQ7qywHm|s^a+<q$o!E5y#ifoH^FuiMf_^nm
zTeMDrFVkz4!igm-0%X#A^Hh41kF1LF=;e6sBz%@7-0?w<)6aUBXQmUoer?R!cRffY
zq*U(L+B6$?mxZMQ5%Ha2u`wmOpO2}0Oi5P@el9f8q_=bS><2C(q7OCg3}xHCW}owP
z{m5fBZQ`;k+BLT<Rc9^nS@n63_o2_lv93;DTo<12)V_G4r7eh~HqGJl-<%Jzep{FA
z7A#7)mJD6FXOWS-;LV%&x|8O-+^djnCCQxWA=H#Q|26}gN6@5WsvOG|vlgWY9lkc*
zBh%9L;ra|&TZ5(X2|FU$IOcJG`E$(lrs71!Sc6uhuppNAAu46AvlcaZz1qvYHhb%w
z^V@IdPWh}RWHeuU;!E9$CGR|DH9wLHI>#M5)lgh>?scU&opqbqe;?P6Uq4^jIPqi5
zJcaCqi)Ou0`W0;O?(#gvH%bY`$6`-!H{+MizQQ_DfA+a8sk<B&EvtFdklyjhWr;z=
zL$~yY`W0F4g0C%}p)PzWh3WRQ-@$sGT(4(@vmDu2Wn}vyG4eHAIPbx=-_N;ZrB0gl
zfZN8_<=ys=7aw0&z06$Wxp3KsYbT{%>Mh*rHrd)@nft=`E{88iYqri=sIH~GOyr7m
zw#1rnZ?;P(Kcrurl3OR)?D96yy6x<}|7CmrH}eZIOo}cwwOQACPE$TJyX_Bap>ufX
zofFe}%}p-F@-4M+e%so2w)NdnE>HcrK2x@xoOk8q<@c|5|8BqiyrXcs&76*#E50wc
zJ`f<>Z=&$L<^!W{`r_|j<WuiEOaHRh=&@7S{w5;noroTDwl7!MGQ+3#x28PgpWNim
zS+d4+`_I15d@H!C560(Re|<au_3YPQzn=Xof4+j*!)`&W^B(U`>$oq14>_JZ=qQZ*
zHdm)<QJi1g9<v6o7v?IJs+PRIf4G>N4jWB271=WHn?du!<t1fbKK)>CH?L4p68<NZ
z{8{KjcKPPUqdi~lwK7$O$p)@lVrE+4?D)NU*7v7-<!2qL{la#G+vd`rh=&f3>J{#Y
z=_$_@+qeJy`}uJ%6OL8gyIj=0aru*n7sX5}dv7y;bCKBf|CL9+U|as~<G%Z~bVY5;
z8J*XP3Op`dT*#iDyXay9&)JF%1>a*6OH$fnS}s`c)an!y%6HooTOyiQ6tLh}yK2_&
zK=wbo_;TZyxob<`I&>&(l9p-vg<bCNg4e9gSXcSe(z@)beElz$+*5N-6kM9rD#yBf
z9sdEhH<OsB+^gWq5=i?P^Et=9pUq?K!nxV0o7XQpS6uP()`m=jH3zD1eX+LxHun;H
z)u%8H>7DxDe_u?LpH;f^`_p65yM!L|?z?uD&F0(YX5Fpso~H}FVjU$^j`f)y|F5a}
z<uaG<wBy!C<~>|c_O;{hTG@zO*<}+J+nV|x`*3O3y>C<Z7j4|S_5Mj4t3Mq(c>b}X
zPMKA?<mJEPW?-n+W?)dl-mXh8$xg{n&PdHE0MAs;mCDS&ZSie)J*&E_qV&|O%s2iD
z9Oyoob9pX9rt}ugWz9JXCxmjdmActHpF3RqzwiCWWqj7w$9$CS_jUKbU-Gr7W^dL1
z+PcW;TSQCh0xyPLTRrPjaM3pHQ@nHcpT6f4H=%y>UE%fDr9JQMt^D0@`RB8L(cXnm
zlttI5itb&`dpoyrhDTJ6`ef1c=t<94@4Ztz>-my<?<A%#$%t0tj@%sPqsFE-&&6v-
zLHzgAvgxX#a+_|R-nH>Q*S>qAF#)<tr?;(e4Ax)U@v`NB`^(aQ5tn4SyibbWzGx<X
zv}@TCv7gR&!`?Wqc>XDqH~y-!L7VOY`JJAk(i^k0W;T0F^h<MFBpMQ^xO&#}`i;A`
zo;tZa_U<}Q#S>ps7F~Ig@-XDwxgS;iZo7iCFV8%BvTK!-W>(>>GtZmeR(dv8PtvmN
zKH{8~>~gyHZir$pbI+uPjmnC@UTgen6BB*fpd{nTAf<X+taSG(=~o>x33FOPf46Nr
zYNqgMfpW_CDclxc`Iff!z4yzLw#nMRU0{ROH{Jt$H#X_q>abz5>7JweU&vNW@Po!|
z(*>7<x-54niGDuuCQUcoJMXE+>CnGFPB7|*tl_pkl~Nt9tIQ|(K%+9)(&=->lqEW{
zos~6hQ$mATtlIAPpYF~){l9(6Rw22onXED<Cf_eC?s@TeUB+s`x+=r}(m93#&sqgS
zjvbuHzG1P?tJ2dJrj|!OUwmN0BA?po>EKZLX`QTdU$ye;MMpmQY}zHdDPxvFs#HLo
zLH?(`{%+rHaz`8bsU-8Rj4oR2Bqwkso+qN_Sj5Hpi?4p9JksB38(PYx^=y{-ZJDzS
ztm=`ccXv(w+_EQVj_J7#c^$%&q-~u8j=fyRc$>-U)Vax$A$m6$FD4b;2;y7oRB5ie
z{i^29b9&i|`7KYjYii0fF!gITN}c8Yw`A37hc)L{nTenEbtvGzRiC6gcjC|eSDNp|
z@9jFdFoJ#ckIw1hPo9-6x|UJRe}C1kDZy$+Kf;Qyozn@v&*hWO(sytx^W~Z8ycH*}
z-u(KWQ%<1ZgSPEK$=a41tClsCF3!v|zUsW7pw+Q_^UTHk7aTnMCnfqD_F7~s-Qtka
zF8gV>f6tG%r*BTT|Ga;3^7KDDcG-44p2Z(|TbsjfvZF|#-tzpQH*AiMQSVYW=B!v)
z>$vXQ1$M6!0tIesQ+}Kg2-&Wx%Kst0ajiPDe_LvhchhRu-(Lc3QrnJxWt)?BT+?IM
z@+OZLagywPEo(Vc_ygChys%?;$VC07b%M6hmY<pa`Ck;`{$X!wrCW1(R_)%p|37bk
zee>+>%iYntKgzlYm>kOGoZ0qglS2NVca2u}yG*Ozyn4d!@w4^6%4(*fVpqAWos68V
zcep<(KPim*YqOL0F2j{x|2rGbcHQMWFLmv&;ipAnTP`d5PyWBH)6T}(YO~z+)c;L2
z*@~$rYok4G*-W(mGI3RL%Vgz%c$Vf%PTP(OM+R*YU!|(H;s;-kjKQSYPLtM3X`kZV
zz4+G;1(B=gxCKI#ukO6{#qv4NrH+Ip3ylOBrDL5EiZsl36dq$eIOo=;c9G~pk-e>t
zZ$8@g(0T{=m!CUU-i`AL&`U_2V&0wNY<YIm8AXqOBDW*8WoAy-n$7p(-oln!D>tvm
zx?DWhd-<;O=Pi>jJ@MTu!(j0AmET<kmhB9J>GwSr{7QJfR%^fF)wP9RRLy%gv3-kt
zafp9zwEE@bgHlbigG{%yl;$$rn|||k%-eIm^)^RjR!v%KvyEly(&iQK&NMaaC;txZ
z_1nI!b#6$yZeF%k_qu4w$(C1EmFBirI=ns~!ol1mZDJqEIM-^`-LFr~OEi1D3RJIh
zte6<Xde*zpDNf4Y;HLOpZuZzM8`rJja823VWUBt<pn>thJ^81d!@83+m$hYxwKEGT
z6?d-=3KZa3DQYHdAYP+nC2utE%=6PbI@%8Lu5<6*_K(ZpPL3V>2d3)fUXhEOq!pwu
zm#vU^x^#Unv-GFJHIvyT)UTJOml($ieetzv;Ol(IvUk=i@w1k0_m-4B-qd(+V}pRR
z`>RdHvo~@wnbjI?-!Zdhiu$_wn^L|A%82&eQfR$u7jkHtdi!$G)Cr9hytyxmMG8-_
zn-)eK5Bb=!?dyTn`ipYec-yRaZ88I9epDCd(k^MRh-=>T>EWZ_$3F*u;^msKcl{~5
zD-r2mw)BPao(ej8%Vp9ur?>2ZqRmW^-G?u3d3EGs)|Ir?3tUWhNprv3tz`b%=xFWL
zxA&&!)v8XPnjm%Ob;;B|iv_KE+zZ#`IozM=t38YTzL($2D;1l(=j`g!U-xrf*51XJ
zxN{bkUAZ%9W}Ity-1RFJHL*F1H*;Oyb+}n;tIYRZ2bye|6%vng<ayUBD{M1o5%YU7
zFXY$dl{UtcMfDs-Zg=ZWE%@?S*QWL6$*(sG?|$TxR=jq;ntA7=xdNA2j^+61|7e;M
zD*B~(%K4*x(<=O91g*WhD)cAB#W*hrtJ=KC)i?K1v0!^*)7zi3woP%K94Q$3Jyc*)
zJ8!OMA-}8<A4fvWfhYVoZhf7_a`;{2Tg8-{Tu#EjFE%|$OlWwS<5R*aEcC5wb3^xs
zGq*(4D^?x&73Rwux$kbF**i^xS<_?xc^RF($nW_#Ox?=)>f0V`?jY^!9MX#u*_O@G
zw0!lUdQ!Xg+Fv|7pCp!8RJ3x}^DDo~^LhB{_~94JrUw6b_LJj(&}Y5=kES~Oi(fh(
zEM<Py;w#=Tzp<Nhcgs$X)oWx<{k>*j`ujyn;vSYjZpkw(F<df}6#D*WT(S(ek5rLu
znpYwHXV%%Xx3@3fZoK|wLQ7OR=kp2YV*9#p_aBwLwxQ_cjk)V)TwA#@Qnj1avukgP
zXN2Vc&Fu>%qXSLnY*uCYD%_@V`1Xu0F@>-sqlO>*7MG}B(Fs4%&^${taozs)l4nkO
z@6vqG*&cd%tEFVly&1l1HX3%lZH-!WIpV=drM7(<HWw_9sq_oBuG*CMe1lldpPwaO
z7Yz^f^?BJFcyjap7hvUM`nBQ86Vo|v1uNfwKF?htFYw^@Z702g>&+R?=2r_jrDip<
z&HBI5=|#FuKIi6_3)qyd#Vpi(*q0$zr5BYyr~Bv!mAqqod%pN{y=B~1{NhE#ohuVB
zRIl)KSi}%vP_S1uVe6X-*EAgG+X}rD-sm(xcGX;N2gQQs9|bG7t@s<X*6H8(*ZtE!
zYGkskkjp-Ex}Z>F`=NgZYgfdU>WkItr-@3+upfUdSk=AzfJH$<TzUF8ood^J7Z$2K
z6ZVP}2SlYva2`xqd$#??jb{_y#(CuU9eDPF;RXM#Ri^URLfV?D>p0C~?634MdE&#7
z5gjHH^=FdS_8^(sxVWpY;?jQ9oLPJJ1f%WhZ`L-UvR75Qp7FnLZu|aB^tII-z7roN
zt-3uiKe1sp-}Z;ApR}v}n;H70&UyCT-A^pHb29ThvrjU0>U*|b@b}>fJFi>Ub*FPK
zn9|6o6Q;=BFLdWxsa~0n_U|>Tnd@~I>|LNcOQ!yFBYP?Dl|-S}PeZ(v!~5EI%ANnX
zQBPut$jW;jx57`)5Z#k<YxkSrV=JPIJ#%d&za`dv3aT$jZ~gznn(6VUZ{>CGeZ-o!
zy-=7b?=dO9-nY%j!J)GFwrI+Ij*jSGeG1%GN*W7f#8U1{zc|m&%%uB6(utX`_Ta&4
z#)Bbm8yjyhRJmmN+!xP^SMA6yai7B~J5e-1%JJgYJ^LFs9NYZ<>5{#wzkm7GA3c)D
z|1N$R=hiomZ+=f_3%lcOl$@=WywtYew|d=FzPS#!j6>ruHF_F-SzwoFA`_Kh(G(eB
zvA1&1xi8NrxIZ{38j$fmFUvsVRNw(kwjb`|oyv0_-M$_e_wndyiOmw(b7sFz|LyJk
z_UnutigyYZ-Vpe{U|)l}{Q3QL|E9#({Hm%gtDG5MYx%$6V{GioAM!71ZDwtMQxa&j
z`sS>rN$=0^kK4chM^nCv%D*JNbzwg)*MFFG?@Em)bDH_#Uw7Dan0No)Zfmu9XFNxd
zAA_xdGvDQ39`E9qc#aj<f8xKn?@(r-=@sWK7yTCBe%j#v-AE~@>c$Dh()SHMPO|>f
z=AMsuCv$V_%dle?gf?ng)be^Il>dv`A6DG6{C4|4)p>hn`W#5wS>>*F{_2)_&$H}K
zoISGcep<tXL)%#QJKWm6|6um?n@{Rddkfy1)3?84WMBwq!P#5L$S*<eEtCfP=Fc$@
z*!x-gP7K4;twnt<OFdRj@e19YwKIf6kv+}aFH*Yq?6RNVW$Qm&40+Rd^vrDY{ChqA
zEA-do`cIxKaBJGh(<?3-Eu6CLkk?wDNk{T;oymVzxv40^@ABo2UChoGCNF+$?9G4d
zo6v1>-K$Q@A8fcx4CcSRt#NfG=iyZ<9|cpMHa+@YF;8#7n~Uz7Y@Bwy_#Jj6VwxOZ
zkfe5-;$7AQ^4*7Q9VK7AHsJa_N6e>W-RVzmJ<2QoEmOFtZpgcB&Fok$RlN=IFES@N
z`{%w_KCw>x#hZs*FP6MvuD;8<NJTM{M}2DGkE-KZ|3amrrMrF4@y(wR@=Y)C%jL!L
zQ4e`co+PV$tACrnG=8dff{pJx<BXaG>sYR~UG8>STe1AO`KDXP*C#DVaQJ9EVcp~P
zuRi|X{<!w*3^uOxrP^V_+Y&!LDNZmr@G32M@x3&&g^T=KC+-$K$#nksPR@7k*YuRL
zV{KMB890W<*xtMNAvXL<)%RP|jgQ*&G)-(Udcm>CbD8qbfK9g(Vizo}UJ#=&)6qCM
zW`k(<mloMAF8j6#{ra*0hxMcy#m?|2@xS+;=AU05#vfmIp=;U8u6`E9)aw14Dk8F5
zpLW(&9{hK!Xio&oiLhl&CpTXz`O6r%SW|nBLjC-wVTYct%@vn6t=zQnz1dH0)YMXU
zu|sbTGXsMe7X$jW@vxmlnI**~`T03|1(kEdqVq2sh}4~5Z*fU(QkPne&4+-M9?8rt
zCK5?=TS7u7PPbUAxKa1^P1lb9=Qbukzf@}Q!aMu7_5F`OYxHcJR_i~%e~CLRU|r^~
zjZ5xq=nCB05bW6{>l>eX{G#9-&Yufzl%+qo`tf9T#9NJ;MNtJBFLl?p=3L<8QS}uG
z^)i|8JTyDX^|MTba;uSpg?O8U+KxV@{puw@T(5))EzOL0{mo4)FyO8-Pj1T5SBx81
zzx=x)gLifHi{_LXZkNMaT{3H%Qr|0Chu*$+?|ZkkXPVrkiJQ)J+Iv58GU0ug`sYaD
ztb1G5=v|()vZ7BbWXamIMs-5x1X|sCPG7S*?NGwD$n^YHkC_+UI;wd1qU$#~+GxHx
ztdp#ydUOVR)7NL5r`?`>GhJhNJa%tS{DR3EPR;?k=l63T6IKuG6Vi2%Hf67$op`lS
zCt+%=LGHC3duKW?n3v~n@Xugg_#Bff!3(_>f91Jk-eJI<epu_k8R>{>rIj;!pKLy0
zT#&v%RX69?^aPeIvz$~#BwTl_i+z<Qk!%nyB0T4?=aaH`Gj4vhoV9kvS(im}=VmTy
z6?~;Qu`BFNoo0zz=gm}em*DD$DlSIO7iUI&n{+nk-z+z)pH<7<0}@pE#E)gaJE6<k
z%zE?c@~4L!Tm+=K4h8mbWivSXIO=jWrHV-GPL+Fd&?z$im$URfd&fRzsXi9Ii5IJD
zjOSLo$?1|US^voR;<cs5YbErZeLh@{{wJ0B*W)wuzrB%doNL}@s}x@A_`(10{_Yi9
zjMWbQeRTh?eBxG#RZ_=Rh6}s2CMj=KpL<~AoSvzccdoCS>AOy4pT%kWy}Nf={r&JR
z>%8T$7jLc|pRIU+MfG|}()<d^^L#9?^f$M-dy4P4*8L^L_^V5{@Bj9!Q%S<t*)kNB
zwXciT1f6Go$^9ZO%jrVtmosVA9!r0=lycoa{b)^g%E>DWwrk81(toPvu`Knh&!g^C
z1=oY^|4a%~vln%9Yd_-bDR0`E@W%97?EmsG<%P>S-gj`EP59Swwr<zL3*UDg_Nn&j
zS@i9sb<Z`PiKR{379X2?BhBvRp38Y!OQaua%$MhWcbbpwt<P@jpAR$R_Z?2JJ3jZD
z?Yh%Er}AeWy0>fTjb6k5`u5NB*W1U<c^<E?A8wYA+uya@Xy#cbcm6GhTV5WXv*G>W
zMGhD47jSMod#YmN`pb_s%YKBqtxB=$oyYpeT4T>c;}>u4ckMsC%U*bH$7QSUn?KC@
z|KQQNryb%i9vu12i<+&CJASq+voSE(3*cO3ots*mpBJB6kqXM#;ko&b&3OLJi(lw$
zf8(Ig;_~*l&TRQFer=Myu$6VzVcyrQZAsd_VbPaVc4ijbsF&CDuJexK;hu10lg6iq
z%3VwRPW-)lRQ_}JJmbV0e}WITJe5B8rD=}lto)mQoQte16`u#aHLbrB_37c4zsD{A
z{Bf8T?N*oW#uc<7J<KcgU{aFgTD8f&(?m~h^3BaYyQ$}cmuD`gs8dwdPLVXDkMEao
z`lsEu3;Mfag_%x|==u4l%2Hl!y=0WWZ0h#vqeqn&w&@&R9rR3Onn}Q<CENCxc<PyQ
zC+NjT#6|DYyJ>rQ&a^ugDU&@9nx({k-c%q^Vx#(bew53}nRRO}UbZ&hIYZ!wNs~&g
zua@47lcwP-?0e5;Co>9XznwgHnO9>|?-kyqoI5A5>`>Yz#v*a=bd>N;VdJ3CtJhz2
zzN_zBW_y`ax2vaWcA?4q>x&k?$z3@|>&}Aht!6!<aZbhp;&B@kxfs$Oc=Fsonmy&*
zf$-It$Buk%(wQ86oLN_X+DX>)Z<{w(xjjhV%EXqxB%!ZBFUMK$zCtKxjq&;5&-czN
zdN2N&qMRLg<g(wn#^rYmiqaUYZtcGk^~&Pc)6eU<i~NpWU!iDy{nCs|J?*33VGGhe
zy`B57{mqWMi`MSE?7OJ()#CXYZ?x9+GfZB$!gb!HJw-gT+b>^z!|+>q^UOtM(*DaY
zU-O7yWRacBzC+Zt|77`+`~z##mnL>!H{n(Jtjl8iPRPe=@&V@S0^OD}|0-_1b-i)Q
zFFj)Vl~oJGnh&1#VYjX*@h#vCTde&-etYrZr+%72$$cv-JKmj}w%=94$uOZj$w#%`
zQ}5BmEQObfU11K_ZqKe*P<^X^_eDF0JnaX&`xncK>ok2(y)!qxuRlNUmWE&LA+F3-
zhiU>oeSIRD5pQ=lX4^XU#B_$nlr(Oy7#mrO-)bvvHvVw_@?44O-IQYQ(!8xl)+KD~
zW(^Q8f03rrwX8ExwSBw2oBNl=o915eXT9FM^W_oVUflyplNEj?Hojb`Y~bN}bXM*0
z%nfU=PrSZ(N0P#Ys}r8QyL>k_{;~1p?3?z+SDyBmUH-9#GwOV-qw>F2ZpNjSVUC_f
z8bv}y)~$jeUe4NXI_o2*TiOUc4`9x1Ic+KEr;)<-an80c=REdlUy@62Zz;PN)MR~g
znZZlZ))a&62(P>ArBB>i)^Ut?#<e^H-Yti7W-v5p9h6wfdj8{*>Y&D*ZIyX4zAr9k
z1Piq<+U}t0Yk4x2(PYV!FRJ#f=YRL#FW2@z@%K~C&!2X?ckDZtmpA?9)wj=QbFb-$
z-=Xp3oP&s1$C1$brV|N#94$g2jPD)n6eew8tZKhm?_JtBJGkJN27@2}qO=Hs0|#Gp
z?YhFB6d}+x>tXWIUPomHmTiYZnR|Y+cK&jdH*#IQUDGOj!3Vcn+B&kncVAlDXRkef
z>&qW5-}ep6j#_Y=PTePwCMe$iQSBC^$+K$SBmZ?H4lF8}aDmV1{?7-i>-asa&lhx5
z1>Y}txG{WI?g9C*mYWp`86|yv58JjSzjN+Ckj$T<e%VKz)!CuYU}_t?g}%p1Pvx^A
zp2aVUtaP2VC2lxtuVtO_t6r>c;x&IG_H(n<*C~h=cUvBud%5h?tG^Re#OrdqUVjoy
zv&?Dw9Hq~9>EHnd4+f(yU1piRZKv{r<BOK*?A%+v(dw4GN897GZ%qE1&#>kf&RKO!
zPAT`Ey5HjaY4vh8tC#1#mrT}34z4`g`&uRZ@Ux9?&#?3EojqwCuj%GG?<dg-->2Jh
zzSwcs=Z=hLOzEX>KPIda4a;z5P$>JzY8ve$dZ9dk_oQJ&#;YciJ(<;>8SBoT$&R`1
z+q**Wl~~8YD~Gjy@|25aFsxXS8ToFqfSqpKmD{gX3)K~uEM9yzPWyY^My{@c_cq5=
zVkG7Sg<tv8<TqQr-L%*E@r+Q<@~a9HY^%$quJg0{KkRJuuD>3$eL5$Dftj60u5QHz
zX%^?DZ}&=F`|mu*$?WHTcD3bAYh>@b3NL2=zBKVmU*b2vTWJ|m>$z9%U#qsX<@45=
zeXLIV*bXjTcXOiL-ix13rLMXzP+@jS(Av0Z&XU@uw&Tmo)0;ULSe<6sqF&&Coa5A{
zuA+&lc6|@R_-y4$aw~2XFl?J|*rjmuFIuzF^?k*%)r<@bE17Y2GIER4({fATQxdg7
z@!4}61nTem8%|)~8tVD!LOV0JyZ#ghDW}KI4=hqvFW$aj_vv>PCM`AJ`>NtvuW>wj
z_x^t0=3>_K{=26?ah$rsR_(iJR?t?b?Tu@vJ{6pN`%6^JLG$GJxmkTI+pn9)E7&Xj
zamY6bsW^1)MqjOihP7f=x|K%PuI2X<0~=ngDP#%CcAhllVqAx0aqrY~kN154tN+@k
z^WOQ6ooilP)w<j8WdgV1E}4|+EhVpK)oDD+OgZ#I$1^ol^wXKv#!K6lC$yT_)*kru
zbH}mBV9o7rYM#$$?^>+zEbZ#1d`<3iCsr+<q+)qV-!?ldPPg>8Gmq>f8_(&iKW5Kq
zd1*33SLa%@CbwPTGJ!WN*IySLFq^QP|J3DsldWAQ)UYniRBn(@K7RV~viYYa?41?s
zwzw_k`r0Yl@Ah~{=+`&i&+BJh`j^$~U%7D3#mtkzVs74cZ*_kg)Nt>+|Mcfw?|rwQ
z-M;(x{PTp*{vUonDLK)+TzvDCX`6Bn|J9klOOScHWyAUDQy$i_Z+P_W%#DimAD7Pi
zZ#&27#?5KnF%riuyV<YlT*y4Y*X`WCuXe_H-4j20kDzVXntu0NwhS`^gD5-BrbIzy
za(-?BWW(0n(1Ur8%|NHCFFWBV6egA={^DQ*la84s%Zaqx$5^>o*c`hT&yem)@x0X;
z@a4Ysl-$U&J=3o`PCGI4`@KDa$HPB-`Th3(WcJ9#-z;{DuV~Iu*=1R?ZBN|el(0DU
z@DE3CoI5$awBhF0FXj<z1otg6mtx5al)N1z$MPiC>EI_<>GlItnN&+ZT##T-)P3ow
zrE|bLR`~?OmPck%VX`;$*7VL}{QjZM%XP|y$T{yfzPMT@n9b)@wJ#`wa|>U#T!2rM
zvKiN8mu=T}Fx>YHXFMi+F)elO%8SRJpHuHO*1fW9tBUff+v;z^BSNOD{LfKgThVaC
z=&|>e=$Acu@dha`ukT)--~Z;{$IOpEA2$B|c>V8PCEW*B=O?=)7&o0$ns)v<=LONz
z`5f!@@4vtHs8lrEHbAzw#$B-X$Mv!|bM;ii|BG%gO5}}xr_!%i^r^(Ex$5j(`9zji
zN43iYHSM+qakw^K-|b-FyMK?e<fSAh*0Y~W?B?p7?%n!gQ_YRsvg*x0jU=zNOz4{?
z-+L_ij+^Fb&t%q`r^(kYZg_6IIq&^EvF+dMH+>N<)PE>!qF!R}C!@+Ex#_0hKPRjH
zy1o>l7?H3`v!Cgv`PNOUxiM`X(<Y9o^A8=FW|{27xaP)I-EaMu?(L}BJ7oj=yO%44
zZ?)W8)$gc0apHoK4AJ!)kE^U=TK2Pj&Wg4my;|qze?(l}xc;jhw(|DAy;Qs<?#2Cs
z6W_bN$_cML@@vJ@f?j^#G6t<*m%21|9LsuWR&wk2=a8@8m8G=mpPfDb@ayruG>>aV
zy3$_~<JUfD{2uUp>D+pWHT_9C`Uwp$1Q#_X=)B4~pruf{+N9q(>&w-PW)qJr4AwgA
zy6t<83AaYml%R5n?m0c6`{E-`FHO_A>nMAJv)e87<lWQXDtEov?)S?3+uX1vZv<u>
z<~`Hb)x)dR_w=uT^n<k1H74eK%GWclHoA$JXq!0MuX@>@_wLCFo&};l$szr_U7s(#
z==18>0bkae>sfy;K5F=<?bzeY<^91sm)OtvHTCMnCC@q9-$&#-&3XUi>yv1y{=W+K
zcGv2cWqjK#GTq`IJ8B!f$f9b`Ts8&<LqP@xMeNhM1(hWk`FZh~d1?821(m(wuk&x4
z3H*Pzzsa@XB%8?2Oal|%XSr`Dtz*2T(qO&CS%70o$+nv>SSJ-N7X5j@+&xG?+VeKQ
zrtiJqA9r6q*j>5wiH*=tnNPaf*?ToVoqW>JSsLe&VB;I9RkZfTstG>%EOIVfcEL*h
zjhtscxP@7EXC433Rd{rt<E%*{vC|7)r93>pNiA}@j$oI&rjC$?>X8`dq8Xx|QxBym
zZQ3+p*2*Zs`k)Pa9AtlncbJ}b5UmX9G~o=<aa}oeqG#02hrGYTLNc4`pW0q_eYkmr
z(Y1rlbHcoG81rww?|%H?MTSz?5=D)j_wMZ5!>!<d#eAW8@cENp)0PXj{TK51-Lkea
z{-VHq(NoK>?>G^jWII!3LsIqy#j54nx<R5svuCZUV3yQb*Cq3~jc@&t=AREsEGFuP
zJE*Ug<qujQ%_JN1CV(Y<@Aa2wx=u|!*3()z&Ei*^g2LfPN~bI4wYYvMePtPSzHr@~
zR1rfiOUaD4w*_S^cC{vF+*mvPu?|<znfMIP7@Kc8d|^t@SN`BXv`A(0)MBrubt&ie
zZJ)HaCHvi6zKYq#wm)T6#WJH*8;-R4Dz*7Nlj)U6zQ^G2uqx8uVP?_Xt{0rS@3#8K
zdsejF+xP9o>?-Ny<?E;Yn<(|jDm`6*b6#?$*T$z(uccN8<Tu>C;dX$HxpU>g{XV%a
zkxou$Jw=+UR*3}sE)Wa%5|3Pb|LH~dpMf1m*D8LFeb2mkzjV<2M8l00hd-NYR4s37
z6<r_nc1ghTty~)xL_{vAREodc%s6jLM`hL%j{_OUezXNmxlj=C>BqduDX)BztE)v7
z&I&c;Zqd8?vSy!KmloHCea~gxZaj|B2yL7-e~(>VbIyq$l7DYVtmt4^>~L+1Z;qpK
zlW3y6($UioZsaq?J<&{(x&C72tFKBkgA^WY?77a<*b=H5omk?L*Yb@`)?iC&Lc+q#
zdT!Tf9UC9+OKUim-VhO$-#e%D?-Qk6FM3RE-!k3%GA&oqL)7N9WZ$NLH{|Bae)n+-
zTCXk4|2pZog|_9Aw(P%mH?Pu9I`Yf5qD14G$;sktHYY`5Vs!2I?%l&Py}s7sf5kqT
zS!th|r`a+;tM%Q?_*vnkz5bH9Joox+*z4Oa%6o0+%ogEwwhy@C9&^Ggwmn*}^Z9P^
zLe~#37BaHE`L%zpk;kEL-wKVMJ?0Pn-6NuBb(c9q{(J75Ye$QhPt0jgJbrieg!Ptt
z+c-9t8E3qD#~?jp=c+KDP}QlTrYlvgTXdLY@;2sgmq`@hbzfNR_;KRY$4l;BF)uaN
z$-Z#q8%I`$<a(YtGfi3Mi!QTGRb^^!wyiMu>Qj)(`p~06_k8AQ#~UYiI6l|R3-e^u
z`fl=A^pJX-a*z<y$s}!|J7-c<wmjKXmSp#-dcoD6(ucLnruwHH^V%Gf7<w)B?p6ja
zfi3gireBluWm+CPb(fBt>qNikxJC1;ri;JN`}g<D!(UyeR<hk$eT*SXwb15Ewdld?
zTWjl2e!Tg!xou8OX5`yt#xbqm%4LoDohmNuy|>7+`%r;W``JemZ61nDoaCd!$g{&i
zC!2R>mFLt{(_Q7&=FZR6?4|eU1%!5bbNl3Kw~4WCxIUpZTX(qzOY-&l&u_i5>dwdo
zE<df1n3>_1c%z}vVO{df_Okuk0&HgXgdWRZW-x2w;#E`cekwECwda_`Bcabr8ieQX
z&5K?qc_DDCTet6G*4CKY3;!ISZ?mjNSLH!i8}}pqz(}3G`*ZgEDm4lc%QcyOOM<O5
z<LigqS99xsis=2X{QvJ!x8eSk`<CyKncyEZ@uAbCmOUbgryaRJWyr*~?=5n?u<72)
zl59J%;0Yfql#3>mJ{EdqyFV%}Cf@Sx^V8ExuXNP@y1m%?b|Syw6pagi+P9UOO^KPA
zuN`c}$1b}0YvY3Bs%{4oL=VjmJ{6#u>-MahN9WnYe;vE$YAK5CIB3}|a9<<wL>%W<
zMZuddmuNRH>0l1Z&SLmvc}_Z@O78Zl1BN@J8d?5q2s!AM{?d_C=<DU@iv33xKFcoE
z5a^%%ELh|}V@)sHNx2hG&r3T@R>{kjbMkqvb^Hi}%&Xod`VB3Ax9;~2o-7#Xy;*{F
z&uptdzaJUd?2g!1TV7e$w)fY(<gJ26Q-qHCzC3N{a7N?mlzka{rpZU|v%P%i{mh4L
z+spVa`QBzs{A^}carSw)xx~c1=ezx8Y2T{VG?RRHvvcv)hGm!SwpM3cxs@})sX8lf
z`-FVm;?Imf7hNyi&fKuu*vI7jZo|Gk{(KeEGLut-68Zd&<XK7>?w;P;`}a>2|1a}@
zPXsUjun$1l<!|sMaoJ>M28KKiocFmDrKYFm#V2Q^CTD}!EKLo)-FF*&Cp*t3{!M|N
z1x#D`*<=>n%;{dRQzTNEcS8in7K=?YmwGgcTmSpb=Ng-{e&QCUuzL&7-QiEqd+_i5
z_V~}=7dfRG)*lbF4CFTP{;@apD&Obuqe?p)qwmV~-gqaoCu+|h)8*ImH{4UKaab){
zaA)zAT<22{CYX8#N#Avdymqg$IhAu!=GMXkQ!e#cE}ZH+>E9W-T((<$N!qK_J0&Cb
zXZEhU&=-Gaqi7cQnL}2$^t-&IpPbov@SpC<d{4Q3`4L}Ry7>2(9jHB~yQ+NEHRgcr
zu>ps_`_KI$E+>4dcCWCQ)>~C}wY6=$P1{c_yvDZgURIy$q=Ge$ik~jAoZkFS_r$-V
zqN$GMQC1fhl&;B~9^ifUj?Aa)8!kra2`^BO5LFQAG2`mX)m6F0!QubZ*P>BWbX~^G
z+oJckSQJL*?3u9V$)Oa5XUnq=R);K>xU<IGM15t>q3wd&uLS@7ihQE1Wy7}eB-gcL
z?r&%JNh(Y1^4R`D$KZX5^V{_^rno2dy119#k$HId?`#2sg8W@#&Q;nISBmVi>ALsE
zo}+g=pVYUOBmB;OCY9@XjM^1q*p4`hD%mR(@E+MJVL6MTKxFFGOYPVA)a)-VwB+z^
z`K`1jUFhB1=T3(mJv`sqZAgBxcT>~impV23et&+aEMU4n@u@@guhoqf9T!u)Id|Ob
z-fcT;@$J@>4x4>v=bmHMn9a0EqbX~8Vz{#O0>x(zDo>7f-`K&e^<Fo2pQ}D^&EHG1
z`#Rg_Uc2e}aLf9#r>^4bFRJc(WBrT$qO9`vdY9K~XBswL@;xjPe`r^Q{+j9y=WNn0
z9N)<zWWA{V3YT*2sy1Q4^HUy*S9pA$qt)SNI5REXW_QJ<m0RuE;&zMv=gr@0F8VK|
z(dpgin59#k{{K&2Zq&Q6X<6pi5Vm*cHNIEIN32gflk+z6?k=xD(P_*}zfDQuXyy_-
zz~7xQ=l8O`X6$|@oA&t?P7tu`)s<6A|5^N(G3vtV>vkO5nePgzwh1)N_qF1`ymQ{M
z!!Ksp961<w;l$(3RkJ+LM5(ZGYm00Q3boj%GdrT}<u{!_ulF6l`@uej-|FTLPo=6I
zd8;pG-H^C8G2lXq_IIBuoy?N+$IcphS1&D*%eDD_jd|0%B9-L5%cQG}R<v8i`(zc?
zzO}h+`nh}F9H-+`&b@n7QGVX-P}8+C-|pCrYHPk;<+`*fXGTEkOgHf@=eYmq-O(|y
z=5V?3_webb%2OZ4qvq+a)*qtESQ!{9aE~b$r4|(Bm!uYhmr;l3f?BKp*2O!nVNOZk
zc1h%S$^qt>>u;M(^8|i7w=WRLc$u<!vS;s-TT(~={eHKiJkoC$zp;RZSbzC>+wZT$
zbBg~zd;Dc@hlA9Nd&d;kda%5Zj83t!I`Ad*!=>tj)3mHJH`+&hd-Zg6{LOC+Z}@s9
z>9pxjSoNmk`wZ5)FMC{8D{~)K*}k*QAmz~v&0NXpL6Lc_la75pRsJkR&FA6#ljSqR
z1SNj`pAbDUOi6Nkd&rwr>%UFm+?jr7gKn1R4YM2nD))0u-@krZ{hf99&)T%jKegyy
zdW^J&BJ0740*g0!CGeY-yg%e2+aGgGu4-49SlXM{j4F={-}Jn!_4}u|O@}qF;o}tz
ztJH4{?rEa7lCKUV7YS^g;n96YN=@bW&%CWaH{7$)S)ZKubE~DpEI;YQ;<ra9OxU);
z%%o_CAzR&3=M5U?-`(xBPrH0yU{%YZ$4+(`+LAvnubd$EMKI~$R))v^bKYEF7yMwe
z_4D=@k}+bB1r_K0KBmR9_Nt}LLgBw>p8fm8a4~)jV^X84607i!$EQ!k27J(VN_%Jd
zef_+xA%-a$3X<mUeohWP%5%f!cV|x3_V?H1<-#8RP1+r6yT&}{oLikj>z^}+L*BNp
z4Pi1&5s%PO@Hf`ox1ihq)PkwYr*h0(k;vGz-|a^EYV+;gZ?$4-@2tBv`!@en>EACt
zu=t*v_@;6q_pxZE-RIADx@fXJ$W$yj=DCsmz^(gD2SqeD&3vWE(<)-d<IZ-8Wwy(+
ztkgEv{S%gdTodMVoN+0KQ2-Zf>93NdT_H2(Pyd_o$Kv;usdt|$9es6OBd%=01G)Li
z_hmDjV$=$1Tf3UxKYZzZuy^C%?n5(V=48Kb-PnKZmH&!|8{0J&IdSb4z58ir^@FQ6
zuVSpYVh=kkY_ohb@5aQ9f7w{X0s~^FZ4LkNetSikg`ZkOJ`;CIwLsg{H-?-7yOVA+
z&P=|uY4Ryk=W=`JmRPy{E)`3r@c!C&{LqJ3u0)ZG8zjH_Dd%iAI{$0E><;6|<Nc>{
zr``T1Ic@2dg>22X=eF>9bKMGjVP(VPlx%)+($au{=r~#PCExd~`k60fRy(0`LVQcu
zr;G7=;uePwnQxzc^!0b``9cTwf0XVO?ciQ@VWQuypcy<nZ+$-Ad(A<9Z5vZqZF0@B
z)hD0JU%z%Ib7Nr3Yo?;>Ggmt;k-Bl<zU2vyRaO~O-|4@(SpLaE?8BDl2h?rW?{-{!
zU-m!yUy~Ud`7Sis$MW6I+;BbGduFYm|K-5ri$5A4lC5yg^!t)M;g7|E5C7X2_szZG
zE%kMssmNRlN4GSWZtiD(E4Of_E!yxZ^Z85On|b#Vnk*HUzszx(a&+s_r%4<9+J8Nm
zSr^oMRCM-wrr+;dXIlO<eEigUyVO>$O%MDO`J!%k<rSPia>AlY?S|m&|GOU<AHN+S
zE8eYnQC4<yTlf`kU#ZJmO&WK;ivPW}A@u3S%{Q%=thiu$$!kw}TJXwznK!{(rGJKp
zUl0GgEq+t{$^&KLPYyHGKUpwA_tTu(lm#yD-W3a{o$AP6+ZQ!Ub62MJ(-*J$XB`Y>
z>agb8yD{dr(ht${*yJ!vv#RD>caK`m{lxLAd-9~aoVz9GE2<@N#fr~Tsf}`0dJx%G
zY3cRHy2f$8-ivoVwfa;3JTBLD(E7EqY~8*t|A{7y|9Z97sjFK23T;hYw@*y^AH%V3
zi~B<UQw!(hcskkp><bs;D2x@kYx(=k8Y!tAeg{v~``%r##dWXL+oq$TOpoO3r`&2P
z`nBko+v<#UOhpD66>HhnvgN8<cON^tGOT>nF4ryL?sN3^&MkN}>)ZoB<0T9CT)rB4
z<l5&|d)IF_DNjsVdFJ-&a@AOe4Zp5@T6XLA7G971NVX5UO=mVut$q;tEA-x@1q-&k
z4O;pv?G5@ct@i3;+i$QjFw_g<yx*s&G%vmcGQGby!aM)Ag}}bw;RTnQR~$%_uh!&Q
z;;`MfJK?ff#@%;Jan1=Ur_!`1YI&L(cK!Q4SJ5?c)7=HL55E$Kd{Q8H-)1KJlfzd}
z?@ym@Bz~&vrmNzV$xB7j{N|b4-0!$4{4L{C!=4LgubudMY@&L<oV{vyuR?yy)h>}o
zvsaV^AGUnNvR-}ir5CeOB5&@x)}f=kDQ`<*i}q64@*r*NnMX`_hwi*`X501Ni#s=%
zy_>S?ncn>){x4e!qr(6GOP?THAH6ed&#V30%vM||*uL^f>6Cib`E!eUjvn20>Gh6j
zuXjzHYG9TZ7PHp)_OzvYM9qS(W_)dUdp(S6`r4(lC!LR4)iZnRTqdmr1-esD<Zbz>
z<TLGc*v@(F!q;5cG`2B)>IvV=n|Iq|D_g~hB%_@HOV!d-4vO7&t9jHm@4+cgtC<x)
z9Kt+(R&SDiX?D|eg?5jI(cN9kN=?>xdqtVIKc4;}E-F1tbEd6w(9WMN2a1b|KJ5!V
z(&+9ub=GR8Zyx1&UQEtc*fg2KlT2$0OSmUqD{f@J<DJ#8N@1zll00qog9elGQ$i=4
z+k42!>ED!4(I-E33sR0NKGzZtecIg87+3c<d$sJ1$D%<@4KEV=jxC+H&QbclX~neg
z(}zzag+JWOB$mHb=-&k6+m%!Nq;5Pkk9qgV$h@gJz0Aj`P`ju~>f+1(f1i?L6|deD
zd>c2fzUueKPoL^^4(cASh>MMxd%u67!83`&{N2;v+v#08*%0LKdF}DF1fi>ICs`hF
zW1hR?tn1?w+8%4S-`d+`qj9dck)!d281o0kV=_l;Qm%(;XMB2dbF<3acRTC7ydD&@
zS)OZ}_R^3|;J?Yi0-eBHGB-Ke*hSaBPfBE&qT?#Z|FutJ564E$rcc&;Q#mJ^AKH-^
zuW%sKDyrwlgY5j(lW%SKpnRS6$;_8qKFkUUJJT;)X)?1!Yk~5+#?-5~&fYw<CF#MX
z25uJ-?v>~BctYa4vKwD@>^mGZ<!98B)$^7LX-z$PWKToYiS^nWkKEe&D>GmkS7*F~
z=9eR~Uq9Hq$zs0M$ms3!Sd+8<;G?Tq>$kLurTl&*Ui<UZdi}qG9e1Ce3XTr^oVJ+v
z+6<4Mit8>u7M;5+^TWX%BF%1F)QxZ5{t~?QxYc9hRbJNbA|8}So#QunBO~mTt57HI
zQQrC`&hC-%gM)XDy^z-GYkRlQ#lJPfA>ZxJCf+ZiFV<d>?%wuZC2_mP#^)~Oy)IL9
zN?2#TYm#-^(x}JCp8e^zq-WleUw=I}S%+ud<(adijg2=h@WK(JJ5o>N>x|+=B4;R8
znI2aEUGVYOqqj-B@{iVA?zgD_|BR#Ab4$#kr;5I19V`knc9c4aPH}Tia5+3tE9bIA
z#`ertmUpXoM5kuXa$8X&c&EKI#@6kin2n{3XGVEV$eI5S!sh&*e<An%!;^8sdTVF!
ztoAyapUFA(=%F7Dmzn!Af=_apSgTsBs$jN0CUDYD-te7N-kK8$EG#!d+eGJ2i}?Gz
zj_*sL#f*-oMY3D(PHho1v-@i!yi9uGiUXI}4NIqOSvSYlH|WfQqVs7N?)U3v97;S^
zCgi9f<apO~)6Lg>bCs1-x9t4grhLbud)37!j+5lNB&3d2TuyK(y<h(Qxuf;NYkgYv
z$MqC=4JSRF`bWv;)HJp!2SqxnCW~KUIZ-&NC3F4%cQF^Pm&RCsIV@<-w(N<brtmk}
z*1t16r-tV$PD;42>(cdo&+0=2=AJ%x_U`HKkFranYjs639&CwZ(=ER$dCSvh@rsLl
z!ul-Csw)nEm~Ez*ApNDxMyR4E+QOk(xVFA@!RaNNjQQg?b!~Wih(W|4`S`a>doRhV
zTsY6p$y^*A?AczJnt5wx(TY?4xt@Oh^7GVQzM3Z&shtrx*ZEMp_yeBaM20V(`U(?{
zG(CS=waz_|ch2LdJQdLoU%WW9&F53f)J<Z|4RW`0rEbW7J{aUT*|+GxU+Y<E^(t|~
z-LsCIm9JI(zTvxg=(PMDAw2mtGv74LsanGB$yGLOh4qZ+zCW=>nZ^e4t7MAO9A};X
z)0lJT_j85EJ8xZj_v_3qb5}=$+$GJ^9t+;rme|>Ldw-Ve{vA`9@-k9Sl;l|KbQje9
zbJb=3JO0w1jW6di3obdJdGGy)E5%!7&%6Kr`~Qu{|M&TN6XG7t4mh{{@0yEK&up(X
z|LeWV>3+lxu}?Ce{>yOcH@?%FaP%af?ta4vOJ1>aXFq-_U2gli)@JJSD>E%;ty)~v
zU@Gf->G-J}mO6Gzo}Y8qZ4^}EFA?wIlKjFoqgChb{7vF-mY%6qpTl+{+<yLr@AIqs
zp8ek~UHko8t@X$Mhh{!J^Ht!BVb!&Vhd#{r;=Ci;Z}#n=?)t^Y|GOUG49kqWu<56%
zeObDpw!>ERy`by=`(@l>Wnfq+fOExLQE4$~fh2gy9X2Sj;RgH31|6LyyWEYem+qSI
z&SG)A<`6B>=HR{MY>N`>q^Rq>pWe@X=qeuVw}?G@`ooxWb0qolPh4(4zJGdt<<TXH
zr_D_#PkV21x%^40_iE<oeHwX_r9UmWHTl`^W>x*X_&+{j>~8lA7pttiX)L@dH$iq|
zkD2GD%c~SqcfQV99vLZgZ;My7)6$S>QR|j`RGKQ(6#C9}%F3I4Wrwcq+2mQV)MwA;
zHJRlx8~**gQnXY3%7jpZs26_I!ZZcH9(^8k(Ee(5n(w<fxt+FCZs%=Jo^^HUtDM_6
z7cB1R-YzR%>L<1E+sEK$MecpQO79sI^==+^WURCNd7z|1SX{<5ckze#g8zP3725MB
zx4b{GD&p_whoL_|9ADjTe}7MX?R0@1hc0=U>bk7vbxF+$`6T#G{?K%lh0j#9UCy$)
zrpAVOz1xxJbvabjSZ(#JsDkA82d+f_h?ib%Zn@HA>zlp<hnsZjRb!&^ql{0?Tywy)
z$p6K}qH58#D=Hs~Iq5v!`u)i@?IWwNF0gl&=-!*=llC%OO|mLrdAE#E%$6&1UH)B%
zmq&$We#qY_@zW$|zRJ`E$1F4)?npcFoSNjFciPC<=S|W4{nr1(|2&)ADYI&4*}~^X
zN^Xa(_IGe<X0SEv??3!x@1&d#MpLm9DgrW__Q*BvVm#8Oe^V+TE?+E|)qR!f>Wfzv
ztN&6KsC^rAvnemca8-lPg|z6))}O3J+vcw1YCO<YVE)&pi^s*yfA0;y%u5yNivNSv
z_zNFj6&5t9G?-cQEXs3D<pRxurYNfqrLtG@)S?;`HH9o)v-iHaa_NSYM6{@=shRij
zIqpSY+V&h0JT?90tGSG|g^7%{3yv&ZXP)BM{rs+LMfZ|)akce1I}9(BoZ6sbpnF4t
zE6Yocqjt)_dy6yQ%)9?rJ6vxE!<y9HFO(X^xMsdidHd<R>WW`dwjSx6=EoA2T2JfI
zTDHjPi|FI%C6Ckn&xC#qnpfkwrpsLHRhjmLAN*d<$_JDVBosfYUwFxUw&#<$=T@>7
zGx9jh^@L)We>>Ugw+J1WT5NazklDhm7ejZ7uKLw;dU4kOc&V$I89gs0f1Nnz!GHXM
zBm1xG_G^P3pYB^+&Bo_6`!mm;l)^LDZ5bC|iJHqh<;?L{NsrPzc<dBes_r~X>$E$6
zMt)PHc#h<R;~w27#qU2-<oa{E>6N$c+O+cuEid<6X<WN!%9h0IDmyfFi^F0T@BY!J
z+4{tH(<Z;@RgUT(J}OOD{&QjD&wgdb>Bpa5vfSn3p8m<Q+3VoHtv=Tx+pLPd6d3lu
z*AY^v3;hvY@a@z(HC>msj-Lkv?&P<a9C%-K*mUFCv@f6EgsU}KdR&;UIl=N)I`8&>
zd{W1RwrPD=xU~LyEf+@&^UCc%gxPlZ$Mz<zJ+S+b!_w$xW$(5yvFmG(xLn$H)Fp{c
z{~?Pv<HAZ;^CQYWd<Gps+mCZBSZXnG*6v2mXOG$f-#qR+8R0Uu*ka0M{qQSt{63TT
zvTu2cWvCpk^lZxG{=7ZpQuMdAytB1dye_z%^mV&-t=fskxt|N?ZLACFto5F|{6BAH
zCQrpx>*wbfUc9yIYvhyQ(UehJz%I>EJFh1_k~zxtsP_z$`4g*U(v&90y)1iv`YJ!y
zqZR}G%11s|?$18(S@6*GED4i+m3Q1Pf9~X5*cbWh%gpT+Uk<*s%*$VQC*hfo@yb1_
zk8~PObH4ks<2z&GhbMu3W|z<S+NkmsO!l;V^Sw~%+q#`crTQEm-8`HABc_JueB}GT
z3yO?1_;%-W+A_?r*`83q+sY=GzN_)!f4g~$xK?JBPI0<eRpe)ICT*E*`=wr1-Le(h
z_r50U$SGQg{;{`sdFJfdhlggaD^2CO_GpC><B7R{c^D5HufM+Ru1G;cY6Sa@7vhTk
z2b6ML(uxvh%UybKAVgNcX-f3{woTHHUL7wvqQ;!*u+QpR<c)c50_|u2{=V};d*kwN
z%ReL?{ovyD_2tBDf$(2bbUzrx@!RydZ$BMeA;y=lEN!{+bMf;7PyaIppo~{Dt^N8W
zn3;h=gM)!V9{XG@=r)C<(#)I`y@JZMq2Aed3_v|4AL*{#U1gI+syK2ME)n6<WSQlh
z7};}8>b=%fRppbjTQ2>-H}OgMjcIbX_Ewno=f}-=OaJio+vDwz+^($95u0zRr7qR@
zjLWWMja@=v<UIBCg0;KVmA|pGPk%1{{=vJ353Fm$4t(qgD%btl=zLAhGr5F2^y-&&
z<`JO^xBR5peKg<B5RSU3BAK%7eyQ8_jJGP5U;Ivde6r!Kl%iqMG}Tp$4We2TnmOIu
zx2~QN@IA+LUe4Jo>%=GZ_iZ&hF*AAbb-CEk?RzFUC2sAx5Oh}M^P-F2c0Dy$`Q@@G
zI!$NR$!q2gU3W8nD2QC=-?nH{N$|{Tk}?I>&-l0xM_c)++Lb!JZH(N}z3q(OR?mkQ
z3?d&+^wqt1#kP;vM>Xw7M^HpLYxz^&TJvi&-*T;4xpRT$uL$iMp8G6H-DJewSAOpf
zo^$fA)1fo>?3~Xptl)RrxtirgIoo{ED`%8mv@Q7Rmz3?OWUXZJs8e1^K!(?Cwz|{h
zy^orgUsaH?)V`s}n}7ZN_Y<cVd|{m=zD8Ya%G>gH|I=0Cg5_=oxX)v6H{i1mEt0Ha
zTJQYHQFd18qI*kR8~eAuv0N5n-FWWnb8Qc9+m7VPpLBofXik4B_~h2?qdnUd=d9E`
zcjo=3w4k)&t|uZ*t(s3a=j*td-1~o2>RfU+v%;m?AeH~de?lG!rT*o4S}t?8?ZL(D
zKH-YAs;Pfl88&j9I(}JIBL7^wQ%Cu{-{(ujoAdIv=&L5}iM$bePU2$P2Rq5K3H$eU
zbu|jB$R+P@G>H(8J1Vp6px(L9<!MVcuC(_H*Qq*kHKfmWw&g~qjp17ov`pNjckeT{
zeRlFdffQ4)e}HtZZU%E#m_jVi`E>7@$~XA3_ZM2)TzI&k`sBjx4_|FzR2Hk;v~kmo
z={FW{xP5K;YOUE<mpUHX?9ew+HuHqmf~6+s61I6}YRF2dUs!f~rbX~!@0yYo727gj
zykcoM#Jr|HBl?%yw4C(6=GmX-Ynp@<J>EEdw~jUMmdIzD&Tj8kNk0Bh^>oLF`b#ls
z#?LMFrhGlgJ;k?t;=KJA^ZaI5tc;l!*S?Wotn|HsPK%Plfz#pNQn}VEv~JmR-Kkf)
z{zi4TclAV_^&d_O8}8#;J@L!sU;{g*(_i<`+C5W!KLcuh)XH*_xy;MJ5MzY%D5K)a
z+@$=R)QXa##N?8E(EY@3qjQUI?-2aAF1~SIy4Opki__+AFZ93uF*feiwL+VX#V>nT
zP1F>cRIrRgY=O?onSZ|9aW{yp6p!9{WTxM96Jc+ahS)dnnvcF?x|uv(T>sxqD`7={
zll-}EHYbk+6qKIvyQCoV`P#zzfZNITr%M(d$(Xb8aPzl7?)rI~RvV`0@0iBf{X@4u
z)#_lvw2uivhdWkpyx`OBwM6pqXCKzYWsz-)Rfdu$B8)9l7^OR-=NZ`YiS$S4uxSNw
z^N4w>U9=K0{C@N02BSQgJ4Mq@^t3)!ko>qJGis$av%5(`joR`V)lY6mcBE)rRXM@3
ztn2tnHvJ3N&6QZsKWTf}v;0NckAyEL{g*#jblT^S(~>zC6)q_8JgR7{)Y4PSJmXn+
z+LiBO?VQw?AOF=^2+gz)nd2UFKgH<lQmMC-SH$qOU-(_8A^LZwkIT0I;ew@oe7D^b
zzdZT);O1q=AAb}otZXVS)k(2D+^l}^@$<tEFFr8nm}keG?X0T4=Dxh&=9Q2B+8tI|
zaw=j%!lN{~U17!VH@Rv}5^N3#|Eaxl_Jx((LTc>gZ56wds<PiFTb{cAwD!|B?wOyK
ztZ!C4-^rdeh0W`8)Y%%%YnpLC)w4`gLt|%5t5Sadm_6_ce@yb-?5$3!Tl0FCp4+2l
zV8*ko@S5dx&gJTJOKmPM%(uRBqwV~R<11euTktUC$Td5YmZcR62^GC(g%9ZS9^<Sn
z-{bxwY<Jb~Z)^TPd~)~a%b&0Rt-ic@`h;$^km~QB-hBBZ|K-}&MF*>obH*<DKC>fP
z?8xQ>#~;26b=x8{EJGE`1upLkU+w52=Bqy0RX*c-spVOYJWqp%#~D^;ZMfFoc7Nl<
zZ@b^``~6#_Nn(rf#72b$Gd^#r*^>Nv@n%UA;hQri?mcy7_L<p^A@f>{4&CT$Uv{l{
zePK+7DesnTpJ!`M{J2lz+uchm(j)GrRr!{kZ!z8)5p>6B;#Nz6jP~QApHEpRExYjX
zLby#w!@@nCVjDAGJ=wd;S@d|4=NWA~e#<$RwKv#Jzo~8MyJ)(X=T@aJ>Dsxehn(+c
zoLR9lF?5EO#g00))I0N8wGKY8vVD<U_H;hy+|q@+;wJlkIq@<yT`;_B*8OEH4;0K|
zWqyTi;Su$CyWG+2+fSJ*CAGZUR1Z%RF;Z-;l0O^rZ;9Q;{uu|<=hwzCe^=K}f1(x^
zFnfbL!@vDP{kBE9(~Rb{&+oR{c<olQyoY{Ew8qp8){k{2bxt>Yb+Rc?VUp<E^_-t9
z56Bj-{#+$GPj%|;z&~aR^{#vWXkMF8^r30TGEbEy@$>F*sZLf^e*W`|#k0?%Z*NWC
z=a)S3>h$E@F6+`eclX6Uy0!W9(z~gthkQRRT5a(2-|yLx|9+`NN-VtaXqwD1=NVmZ
zdcPi>F>C8=KjRldcc=5+We`55!sZ>;8!LVxZNcHJE!+7rTdqfhPAgoY`b#{<x8+*H
z-}J!wuMz}4Tc0>QZ)JWwlkJ?pD-ZLPDav`~B{$CuF=yHLR_D&<(6?QozdKb9wY}mK
z+xuz#vJS&t=j5Lx{N>TE+xOG!k;A+GC&FC26MKJ~tuZ>Xn|<#wKeyXXm!q<!FYfjY
zRov<L(KlP*HOr)xccTUOg=||@ZNA?2+pKi8YfI!r_FZ~!leScDnzYFNn4NOD{x)(<
zYO(7@AFe)9t|^mwpfApAt0iB=(OHwjluei(zmqu@n3GpCW#RKVd^?}86@JpYKX3k?
z%9nxtmFIifnx7QJEQsIUBK4-7FME0mpF#E!Ns*1peJ7a<?bO?kFJ8MzU0AzJJ1XIo
z(h*^~4ZKBDw+J}sz2TnWs$x@=Z+5KkH2<&YhLWI_NB=a6czL<V95sKv@yTah^;c26
z#!j6!S~EXAQZ0QcEp<WA)}qP#TZiS<L#DUp-EDq+IPT)U<9fy^TxQ}z{|!0L_)he4
z{Npy|nv0{Df#r|h;6th9q0%DLG|nFDa4>c`So!7V5p73D6&vYPEkWrI1`f+yVw_a!
zU7XwWR!0ael5tl)>DXsHkFVy)jo)gP5<adnH|PI;Y0~$7{?>lJ?+*l)%`uWaajUB8
z$DbD`FK%u=yvfY_(Dv$|@4Ul)y!h*qQR!PBS22IW6Bo9Prx|&_CAZtIn|1J&h@$6q
zmme#xYu~)HM&{K+!}I@ntJchR<h`A)dqb7sM&8e;%9KZQyM7lW&YM=apyl7)f6G3E
z@@~GGA<ePZuKxTa&fmtx>y~CJRAg4(6x+jkBY3yL#BISk94S+k_}@Qz@+v<rzm_}l
zz4Od7|3X&R`lQz@OiJ#0TeRxv4&S;`SM{{S&X%HQ)jve9^hzzAS06lG_vPuTbw3*a
zcrVa66!TrD_4CSZwcWf)%(e3r6hj$<ICxfD$-jT|{NKy&f8Fut{pyYMWRq8EGt4tm
zx!ry0Hsglk&6`RaDz1O4JHl5jlBqX;{+FtNXE!%xFs2?B&)h6;W4JnO^T8{xq8{}(
zy?$78sHN$?!;IM}|IYpHJb%M9;f~bCYt`3w?ND2O<iD-xgtH<uQZBFg$7$&-<=Dt9
z!R~o^qru|Szj;>Y8LipX9`nDob)jcf)HVaBSb>KQ9XvfbSGi_n9b^xX?AA8AsPeom
z=e$eHgDT(1zq;+G9p7<YZO_+#IdPE!%lXobBh$ja-Fo{iaQDN_uPye?-I9?o^FD)=
ziO!b#_xG%fs$W!p{{ATOaCg__Gn;3&-CQD7-YOe^aB`4>^@WS_6K|XM-H8*~vB{&F
zL-ftY?+JcC%(bUn70fHxeO1z!^&#)s`czKuVD`)!-kM1~#gBtLCRu)4>>>Pn*Y|m~
zqF;hOe&_%4Z({kKwHN*ihD+<Y8Be_Nvdi<A?gpu&AB~<^9S!e%&zx{o=;d0UAEzgL
z+j{V;fYgtkCD)R}f4Kj-P~QILn$~r5b-uv8Q||dS?fiK$)4VI`ocO`b{!@Lda)q1i
z3Y>Mb4c1;ct<}0U^=?m22KSXI_bd2#*0(JBEW%Q-;Qi-HOMSnodqmZY<2IO2-~Y#_
zz5B!>UzYGMZntmV)X$f(yi_6Kd?HL@_mAsaYaAZso_onNtLu}_(f;cSWwA@{D{XFf
z-#EowXG6eVw=MO(TOM2!T)e2n@T}3ayN8mecxM`Cdi#8KXjMB>5}NIP;+r@}nxo#c
zGqS2bRe$hs2!37H9xo>nb!F<_82-4$EK7?_i`IVdJR&z!$9smb-TJ8~BKn@V{jg40
zcj*4P*?x=eerjQxw)<H3X5%1^E612mWKS>MxawrYlC_h#rl}NP72JE<;fUHvflmKv
z#*7^+3!b?CU;2p0Jh;zs(IzM31gTprvS(Jm^fGo}^k#LMqY!CPzjEh!y%$q?>pett
zqE^(m&M`Z!Aae6iy86a4_FG34qFPmdeDdt-6BU}OlzCIUB)a|h+OqXKbyC*rNWSsE
zllV+#-TKUFJ;jf=2y9y;HF3|sfKN-K3pO4J*=J~?<F_r3clC-B{K0dU>z~}{$##AB
zy`@XGXWV~~uTyYs`%(Q5=9BmuR)!ffZ1X6bx#Txz#GSR@r>AyYU^Jc6c<#JVhK-HG
z(p8Ux7oH0h`MB!!-=fO0qJOuh72INXcfXgedH<YN_&(vfqbwy~%5ERrzjoV(t&MAs
z^8HeH8(J9|@|$Vqfj#doZe-aVwIsms&fVRU%lB73jmq3|YyL*>oYsg<uhs3A#a}P5
zJa*#uhk#>SPM`11JQbj(p077gCCB--(2FM~lRH1ooVVC@9$$U=*GZ=*@9x}uM4U}J
z+HUs|g=n9g(7Em5dr$q2ZSE8Lx%EM_rPMydg{RNfSoz;~X|&5`^eUZY&8BtQk<G2_
z4WHjfzxJjFR+EhXCNP%Sc{5$MJs70AVawxpHvhNmwi5_{^R-0kRZYqHIXz;}7o}{L
z46mt7h_KcCyN2mt-_8ZqJN16E9gm%Omv@i*k2{LbxHP7HI^4O>hyAX|ewzll!pV08
zH}Y=n_|14T<#crTYyqyRde%FnE0?BaU%1TDcTQGs=IKbaS(o0J?>hJ7o##zw?fJi$
z9t)kD@y*Gycd^jIj`WfXb8aMW4A44y_)JXI1)1&!uS*i9ivyn}Xy1?b-s^p3Ma%7!
z>+8yz=G$=3J`+=A%zP%~rP;#ne37Y3SMsd;VZdR$vMZr7R#^7U!MwNC%Wh1$e^GGO
zm*|6OS6AkKmXPiXe{oo`YU+X5hUQ7_N9Wp~S<1iE|M^$8#vOmEY(fL~nrxIkUw!R_
zx2^u<n<d*e3rj`|tebEvNcmptoYfbmp3K$0_0~!6;mz<R&)&qZU-sfYpIt|Lis?ni
zLxp~M#a!y<(~LJ;Ot?HFd*htGg)h6-o-D|4TrUuOXPMs|KCew1Ew?UP(iygU+1Jh~
z*SBo+@!9eJ_rx6S$o=8D(XSHze~-F+*(GelwzneH$|a|xPH2bizVEuk|LLj)<ujMR
zdB(JJ@3pM$QyAUf#K!DyOJD9`yjc3yy>ARRPQU;2tH*ESbv-k)ur2#u^B(>4+0|V1
zvwz|1FM79U?v3%C{OeY$!)AHqnvE^)8)aAwqxbLNd3njz=Wm3{nWwA!-rjbaGFNix
zt(=Q8TLRdg>v_)B-=((p_37OyC8f=I$8Vk6m$@K1sy{qw)vokp{`3IOBJOX_U;pjj
zne<=z_rhHj9}Z2e@F}*ejmcmN56iz@o=_sqnHrqTY%44^^?93s{5OLQ`GMseZ#eRH
zJ&aX+ydwEWm&(+FjrmKS{(S4UJ*OkAQY?42w&nLtx2inS-{qf8H2K@lI&%a6wW-e|
z|15KKpZ26pV?D>auGZT+ZF-NVoXWk@9L3xA_B&_M-+i2kzy5MM+<#wvd~4S`&aN*F
zo_ES_AK&Y?_#4^^r2DbavieL644^}9rLd3Elq9AXg9d1V?`PjO5UBeeU${l&w&J%-
z`*bfjMsjPXC~vUg*_4p-`%Q+$qzjs{hi?4eH+gD`q2}w;UldgC_P^i#-tYQ{(tkg6
zXP@K}P5c(KxM<VFjO8B^T(%y2qc`8>`iH>Td#Ap=b@1+!Z?-zuIOb2>(j*nX;d0vH
z!Uq94i&ku`Vs^clbN5<OV8b1WTv?8#TZH|xTmwrgE|=I`+-4FM?jiE1x8SwkwBrvf
z<NMd;<uA!{6wq0;;uxEi7K`Z9dy1B)MJ9=C;=gczx!{LMyvk4QQv0ku`zBfBFYUgZ
z@a?qH=FoJLqTQh<jlSh2cUYgYF#VOB_S-f%sd;AD-Fxx&wzf9MR)5sI`?@=3?e=&7
zcvAk^)O&sYAoulR@0$q^<fg@VCk16}VPy{bDrE59;_Pj|>7F)Hd!>)Q6qv}JI`QC>
zNnKG<VoocnUOalsRj%h*R{L)5`P>MZ*C&p@pV4doe+v7K5}x=ihe|}}z7(ksFZ}21
zJ@re?Wtq^W**=#vwk%oXCC$@2;S}p!>-g}W<|UEG!p%!W5A&MXPCr(>^G%xHvdMa$
z;V&&)yTe$|?6cJW8~1JZnH`36Zfy7@Ys~v_-rI?*g?0D3eVuf2|Hs;Saz)?7RQ{=Z
z*f{QEd~vrmH<PQo=9v8f|La*D@3*|;vcKYUc(<PV!pAAva!VVZnnnEZ56!kuOV?{$
zui*4Q*k5z!`u*pmN+xNEeE1!(B>VvX_7@Rzo@!Q2<=NylsVhAsbVfmk{%zinN5^0A
zqYggg$vCP!U|?VfXJlZ|#F5NWi%a5j@)J{1Q{r>;Q%ZAEL8;Dm!a=_y20SkBe{y-t
zWbnJp`F=pW;0^CW4U>0y3knzAxH)P6@wMB2m`LsQITn}Y_u$T@C7~sJNm@I(Di-O)
zC8?P`dsz59xUP6vu($ribq^%flBe08o2SV+wfIN(F`I)W-8?qeBUnOAk1@o{W+`9S
z=u+UmeaX@2&c<U)54Q;z*>bPB$^O+?#Xoj&5MQoq+uJr4DSLBEtpj1TnzO8*FUi=T
z_F&V0gCA8-xqZIbZmQXE<-B0rJ%vdzJTLx;Z&kOEt6SN{^Lv}wmXL~wuYVV`Z|LXx
z#%|5O_}szpE5<^5X4#_#6C1Pg6;N)R%z|^wv@|a>uec;J2XuHuZg61sZ3mvZ@9PDg
z9OU!fvxPrd!bsvRTXRm2ZgO*JOSgYt|IPAeD(Rd{|JQ!H>HFC1`=iZE-v3saYtr~W
zKEM8KxSG4S#s4K2H)-<x;<;z8rC(S#S8oyLogL3!oL!f)BQ9odV`=9H$&-;6b{s!t
zy7fUr;MKs8itxi}!CUTB-N`v{rS~(>si@;!y_-c`o6lZ++}q!~(K>+TwZ^JD>kLE>
z2|d~+JhQtoPTG6Ts#U)|e;z0l$<%S!?VHUWuC$J)<FClG_Yb-^&u~>(9<Xduj0cDK
zL5JLV$`@xYEs)bn7VKfYzToYOv<9>Cs83PHbj3e!|G4G(>po4V8m&X~Ue14L)T#cQ
z@$SjFC6~8V7>R{ljg4i#GFxrtyg6_BlXqlTcu5~k&GL|*&+;QAYNg|>%4Z_`_BWUN
zT$JVf{8hN-$?>iaN{hCp&sp4XO!~BEO}D7gE1h`<TNf<n+aGo4>dDr28R<6uhsujD
z*#0p7J8xe{eoXY&)K?2wzB@isY_6{Hc)an>%U1s^=V|5Njz2DONL;f}sI)4b{m1Db
zzsi0lJFdS0uM|vVyK4?hz1FRI5M)?#*n2{C$RV!V%1?AR>aafj^uQ-zm2KOpZ5?7Z
z*YfluJ^d0F)n*GnEuV7GDpvB*eIxbyLoVGB_q8Q^1O$6$i~V<bY`Wn4x%uTM7Oz<(
zE2Vtn^UZ_J9sx#c?tEc=dg`r{?WT;N;C7ylnK6kOIT2Z!UB9Zfyt&KzweI}9_1OZw
zZi(pQ^Bw2rO;KcGU^tIEt(7Ggmn5b`Zt7baa=Yucfk5r|aG#s(w*_XWEc7;95^&2-
zWZTjUHX=>}QJFd2TU8ZL?)+1GeB)e;+e>w?JUD&EBfalj&vU-In*U#nt3#N!9)HvA
zA{(;ug6M~XMS;m>^Ys^7|HycAa^)(%g8eaj&%XG`Fk9-OcGY6XM{?51(YJUQE2UkR
z8tWQ_l`SkjA+h3`lz2mSE))N$40+eZ=jZ=n;<>x8deb?MFJImkaJ5ek-Np1SQP@?;
zTflAls-)_Nkq<%_oygk2ATM*UBr$F3p3HeWD&&0gt<)!YK6Pt%zFqKXf}^J1Ij;UQ
z$<0bLGM8qgGS2=J_;Z8malO_zwl&65-5f8t-kH>V5ii^j+wk>`jU}h%yqf}^96bX3
zMYXC^;>xmZdTKZhCcc|!9jLy2jac%em_-IclTFTQr(4Zlb7{~0oXLy={Y<$H=bwvr
z#_gGxc1hE!onPxpg3hbJTdWI~>1-*HoxJDfZi~081Mf9?%2n`BwSHpc`8n|Rld#7}
zbv`--P7V2e=TpG*3YE%QqiY6xAH_@dZrmR%m9g;4n$0e}=~o_{{dK4!VC6>(`!i?P
z^}a4pvf}?cF}9}Te{a%E`8ixOd}=ObyePc>vSs(F|MyC~+8L9y&Z)i(Ia;}R|C^7~
z-}<t@xtufo=;3!gT0Xanbk+Ym8}5w%`TU>p_arYflO|^=QK@Mr;$E|4W^Mm_Ct|%~
z+M1_c#$x>J%PTK#_wuNkSk*k^-S*W<)0bUDy9m;eJ@Tn8BLhPW69WT|c12}kaV}^*
zz(m9R!wLee<#k6xWph>=o|4g=x@z6pD+i-R6q6KOdl?TZYX9FSk$n8_E7pT|Yv149
z{HcuLSjdqVs>uu3(`}i|k14t5`YNPUehxogJK?nLk?zmirYq{`SCrq1X=H!FAsE!y
zzsxWBA%pDS3yl7Ze|I*16Wwx<x$#TtlJ>`4%k%$9v1fkJ4u6$)*=?sl&-AL;t!pRv
zy_~(~ncC}3k7e&vN<`RqwCFbfOt3%Jm&VkRvs$t8jpV(z4}{e2@9_zoagS@}GI{Gu
z^X}(;Wt#VO%dIkd*+l#IUk>EFS}j%{d`&Znaq)GHg*qEo{GU2kDdu`*WAN3wu;;R0
zj9YJZ=snu_IWW)mV*QU>U!J^L@zL5<!#B2Q$<Z5pt3C#qUak-2pRnj=t?fjnu9PK5
zB1OJE5l5{q7#J8Bm_P&r1A_u;ty+?rTac4jl3J`EAD@|*SrQ+wS5V1}HYM=2JN3Fe
zD+7Zv9|MC5F8#>`1#rXk3M%i0zs|dDCi3t6a*NVBk1S!u>A45yEOU6hZ0+`K+}lK=
zFS51hTr?B!67tYm`|wxeH>v7PvT-Ti8-+_)zok1Sc(*_Q_3^{wk8*#?KK|)%zHXBq
zw7I$P;F5>I=dK9MyB2Ae&VKx*;?3s3P<@g4XL)7h<^FO^FJ{Z1u}($gO<U(Gy^DN2
zr%%m$cfWq&ua74g>uUIuGiMxd4Gq^a-ZQDiCp464>E&Z4U4dMCj+ipfoHDggYZlAI
z$SX1D6fPG?p7D~dyHpUkq;2Zf6Fiq!p8L?bus5T2?}MhjNs$MyNGxsnpc%7l`g{Fz
zFJD~!`QrJ<+tZzyemt*PmU&XueC^v{)9jqYSraUU7cHucy=*2i$5F(!I_B9TO$nQ4
zQ_Z*-E1XWm9b6V;wByIu>GRLIPyh1vviWm^h-<5UO@7*TYE8;&#$`<trb<rVSbO4%
z&i(e9d72eJ1mg3ABJ^U@W)$XxKRhTYvv%n>|Jg|vXI39O@c8((gJ;_hYyak8o*Zk;
zyJ=HUywk6bi)H4l^A&YIp(;~(GRt+_A6~uZG0gwkw<IPk-8*Sb*zx=il@(qW<dZJD
zo_%{w_f6AdiQdI_78mzTT{yRTN1|7<{sDojhc;jT;Aef>|6IaN;VRoZeQN~U!nVHF
zyz)n&_SBRkeTxo#dw<h&%lk)xEe~|+zr1*{`$g7#l@^gTX+r$2=LF9i|Jd+`E9^;^
zz_**zn&($0Z|Y3gCsXr&+NLX^i$AUF@Xj?-G!S1b^=$K-7O8J>v069otM#ePd}f)}
z%_zjb>4C7-{k$_#shf?Oy`J^FN#y@IPp9FZU0rn%PyD_dm69+2RJ}Bh>I8^B{qW}Q
zkFUixG9@=>yqe{CUm-VnyHnN2cQ;>u<ggXd5#N<o8N+eV?)K%$5$Qe|-}H6<?)*G$
z(}UnkRy)jB|K5{+Ov5g-Cw02TzK65?cRWaA{HRcJRKfGt%6l)@&7SsKsm$8+lFF)e
z^5NfFCdH&g<v-nAl60TdZ*87h)AMPKySxjFURfPE(DSe};}mCbA(Q2|b(XHmNAnBj
zx2tGWvc^QLy~BR<%hB4Ft#hoSmISAqxH|cF*UM*SGT)4If1XfpG^{H)et%;0{k+{`
z`O+DS*B+AE{%516<Lvcolhu{~r-xWK<S)L(ccj)u@%_ZidEXMMFFd;4{QST7y6Un^
z7jl|)?F^roY;15-E}hABhl7EQU8vW(%gDtwHLG!(h3k%1Ud!y7^F3QjxgAYQJ(75)
zyOw;Y=}upy-EOAGF5JJ`^!C9|>xADYRJJ#JUtyPVlD@s}T#ED8MRP)$%64!aod21r
zuyfzHc?)*uFD+X+eT#5jYF)m_fhA8({~kGeM?8V~_wSRtx&JNXopEDrO|v>{;_-<}
z4IRG|iZ=(xiXHR3>*KU}S&Al8by9)Ou{e<q>Dc9u%oOL8MHRHVP5t!p-GpO-QmXgE
zX1@Nl<<Pe9Jug%@lx|rt`^(?Z-JO@ezIA$hv)4pRSurNvxGhHYqxVu36M?TX?XF*L
z@I6*ch*)C1FOfAqT(E83`t&VpxLnS~uP$s6dU98D{==dO*Q$v;#|y73tc&5Ea89)R
z_|0Fu(vQ_%mr3}<_W!t1rM=_m8NrYpZ0@DCf-hFs_o=_*b9UeN`$l^5$<slTh1usj
z+T<VI)@Yrw-FDXct=l?2u4}v!d87Hp#l5xl>q?!Xwue059g-g(W39hs>$k97yE*SA
zr#)BndV5~fEBWk^lKY#M$mP{-RXKe2>(wjY{&`$y3p2f`v$*n>dJW4T4O>rs<xgnc
z9=qsx&1hx@hGU!z49YkQ*kY9OHS8{^eBJjvc#f+0qz0FQpqv9TOB|k+I<%$m&SKCO
zU}4ggy&a<wq_A>H<3sjW*>6r(X<S+-vfF!icU*{o&dWb_HqWh>e1G`s)%Wl1;)`5T
zKYrNb^z?|&0?EUXhflN0$vs!z#xH!=M$$0e!a`2=FPAxYi}#i&$5wug(%{MR7Eit&
z_;$ZPrS8wG33YXC#ZLn!T{5{<puQz3C#{6n)i66YdxM6<l_kXore0cSyz%0)Z#$Q*
zoe=tNL!L@`M)B#FyeHk)$*NC^uJ&U(c7ti@71zw}t;}<rCaJ6y&EmW6KkbNmkLlZx
zE+Mb?9H-v}YQ#O}n&!<`GL_}f!L7#k-oCnf+y1^!Uf2F}diMi%>`hJnVjr>V!6x^Q
zd%C~g@D>P}=&ctbH7Eal!|a`BuQf6r;R(_|r5|wiE>qm$70bVdH_Y_sXr4CXe{RcR
z?u7<zXZ~MU_Drv~jag>DJGa;GmbLGD&VJsjWBt<A%tJN2V9T_%VIQ9!jWOp=Y<xFk
z5<`F3>YDcn0dvluOj;E9W0^^b@hj)`j<Ln_w`#iipVXFIr)T+L)1|WW>?YGPn36Yj
zy+5dM<ju<X`G<-Wc*;c2RcOa9oZXj~QaRhEXmQ5T)-PA=YNy_j-O#g<OFG0vZs~$s
z^A5e;q#v=-`q+nNcK`jUuYZIjG5FuFec-)1I{2Gw6UVWoORk*TBH{2gsF!`dtccQn
z@5!3m7y0nj9MTC1>3V7QFn(D@@{wk9{*domLUV0ho&W83@j5OMXYQWmvfRHqr#F|c
z>up^Agvjr2Kfl;(mazYDLG4|O+N&nKr(!R4iQ4hCyi_}vKP#ZXb)$~pBp+MpdA@-c
z1fT4B$d+Fc^{lz<kBjW-eGz}<Q_rng%sTOu-U^OTNBOqd%Qvv>zao3tOjzi;!@uNh
z+u9BNqBmA=yS~ctl;4lFl}iJ@A6=}lsBdBPe1F+zHY`1o33DekyuHkFN7-V(;&CO1
zY+I`bVih(Ea;<x7&)y8Os_oAT4XBFpYdzv(Rbig6ONlG=)HbD+22YmwGVF1lrB*rV
z@BOW%GAB(Z9_h$pNbGLE&_37IZ}SFMpLLxqXG2pyKKpb2*hdY%+yne|3v6auuY4bo
z&$I2HW=_vGwP)PvVb33|ylz~(P4c@>TlIr=YYUV2uqHg$*zAwmcrrIwe)0zk14A({
z#(6vN{HUJ{XX+JHo`r6|I~QN*9pJ$yWU7CoeW!QhwX;$Ax#BsR+ZOS1L|NUA$?#HG
zxuxy3{FeP2<F_fh-kkP$S*-n8kEECPD!$+OsJNMbf4trA&o7pq35>Rp5?e7>#@nQ}
zBB-;b%YFGx!`tnSk!O47_{h$YoBxL)Jh&x1!<(1&-Xg8ll0O@r4PW2*_t|{r{CTn$
z=f6)}A*&TMYn92NlR?I2W>0x6<gc$YJ7IZ3@}&&NT5oY5oo*%b^-Jb8Y$y=Dn^yNT
zP&ag<<(yD2i!C!nzqCAAd@I7<vsFJpB%@6w)u->F*6yn6%7g6sdTjf7;_crXFYxb}
znQFXpX?E@W8J=&sH}@E-y4Re#J@tXiB$b=%duE(rnPTO>&3_`djCU{V2m7}5=lvdD
zUcR-3|DK(?=JPF5GbhQ++b6lN#*OoX>)TV(S58kjQTLc>?S%M!mA{HC7I3gWI~6u#
zd27&*i|IE$9}I~6!#~eAw|BYTlNnnX-<^H6@5LcYW%sS0WqmG3XFm1NdiiX^yNUfP
zrrv)2b=S%|vpZ=~54%03*1R<pe;oC^&Tfa8am=#4?mdC_v-F<cj-6x`UfTHKagr2U
zV}GXFw0_Cz3WsJL-7Oa%G>33yd`oD#py0Dsco&0_l3_Em#*%|~R$4xB(liX>SZsMk
zthcp@=Un?@l^%o7J!j<GzPuFg73<p0z0@{Bhe?1f^NXpBebVXFHKn_^>0XvS*i^i{
z?)5&gmaT_&IZeCyrEu~wACI}e*b~)$Dn1ELeDI(lE-#$(;(_IH-1p}mKI!$!eyZa6
z!d>4FGzpu(IQY46*4Zh0>(_th`}_Ot?#J0)`@VLu&NG?xv}p4yS=sm3WL_k!esO9_
zec<LGt|>Z?ydTe(sfv`_m$$Nf-_Kg3uJgV7ICn0rtKsYJ+pw|Q`P^x(0I|q@-gX>|
zJ2&k3^rfP1T8#WAIpsW+M_YCrYnnIVg>$Q*)`6)461~qj4hlU{>Avi;ug+jElYLU0
zwS6_q`w)xw(ju!5ex7haYFa|YbQ#;-o0m?`KE|~sqkZ8yRkqznmnEEB$Gl-lhoiJW
z?E_v0@oj5-`_AgHPP}sM;xPrDIV&%E7u^%Nq;jR*%zXXq7qf2v%n8xj=P2FsB}8nB
zr%So=`MT$(2~ury6&8kEKVWim+bX|Pjuq<ftHT++qV9j-zvMfc>CYiMKdHk<e_YU$
zi2B>5w%?iK%5n#Zl8(-bs#{ee&yA9~MLqk(mM7Vy3+L5L^~!L(vv$wIg_lfTzMHVj
zbJ~}EYd0A@iu5$jOS$Oz;GAC5*(LASTghxlT=#t1w#=lHGx8+NlbT%2X6^Gi_UOll
zw#6$t_@XaXu}FwYe#^RY;kD7irK@Li&Y#MvczsSmrqiT7SCTCiORuB}U-8)9Z=kR+
zhJV7@UY_df$9sD@#W^!(3#ToKynQe7PO{jHj4rRK-{;t8x8?fpKYhRM@6V)yqw)5Y
zrHs|FCEx$WyWDBxQdj$XB<7)`bo%CL5^IWgl`8xy+x0Ih?4QosdfV9gnM&oK&zU`S
z*%sNoZ-e@FPm@hCvwB*lwlJ}DaaI^9ab_nLNN#)`S6*E!_DewcK>s=Ax$2G*?iO6j
zdoL{CcX8_5&bXU*UfzFqjIH|o59w)lt#6%DTDCdW;;!hb>fJXBpGV%j=UIF`b>YDi
z_iHV`U#~wG+?^#;*7kP&f9@Aw!>x~86P>kX`dXPinfYtgzOS)f!Sd0wY?`e48?+gN
zit^;|8mtTq+I$%6$l!&gesXC_BAlmJP<b`{cHV6_f!h1)XPn?y5uW{FscwKJ-vo`k
zMP{D8*BqrSjwQLSTe5b#_!~W0?k>9(`!DLhe$y%>sk!d=HK{h2bG2#d=X<_AxZXW|
zzx*CSNqtj$iRXJvlC*Y69r`>gwYaWej@%?$iO{c3oj30s`1tVR_X5l3AEv!t)iURP
zQRG$DSB($Xyg2#qt9qCGe3=Kww;Sm3PCpS+x^#wMsOO20P}TseT%W}jOBJ}DNG7C4
zN~$mNRG8_idrH!Pce>-+4e!)@Csbxt1bV0K@H0KE-e<LG>(}N9e@xRY!;_Z?DJ?6Q
z8CSQ%V)^3h&lk@>_CAi6^TGVhGnch$v}TshUmck&e7R+U<@8O9A}1T)+SP2_u_(iT
z%FLW1K7ZGxy@!NslvDJd2L~4I`0@0){CW53U+#Y14(T;Er?*X8^I$b2TeGY742|U9
z2d?PcZqGR<VpG?nznxQOx}I5&<+hlL5;phjRevw5$@6VqW%%LCO4EYs(u!Pp_JkX}
z*8{?)y_)P{U#G*qJUjI0#uutGm8Y^?x4q%jd+x;iuYJQst)Obn$d!F}6Fz^KvcPtY
z@A{l~2li>iZID@9c4fWami{fPPh`3M7Dz3Xjg7vf8!jcy+_pks-rhCl_Y>`{n^XH=
zJpGUoq0GBB>w1DlrD$!^sw3YPT{8Q8)3d;1qg49M$?ER+Bd&8QTCT6`G*=OhxMjQ}
zs*F>+$d_aP=FW%d*Cfm)-cfIRKX=KZrR$`omU`MAK74O=YIl&dnrcx`)(&pg*>{gz
zY{{IMxaEby$FI|poSw&*WvsoiCLv&|q<ZxYpM93a3-<TkpDT0t`FUwB+1iTM5U-26
zT}rZXd*t_5c7AWslMcT7;ZnKR?T5M(<Mz~lOtW#~wmiRNU8UIbpikD-6NR#SywCn`
zUADg|Zu6O=Q?{_Z>wRVS`iz9CTJJ^&;p5w#x;rNv(ov9WnJ1y*X@6z?tk-Q%_jTC%
z^mcSEdVPHA-c>4-eO|AvnAZ2E`atK^vo2j{ngXYbsxM#1$aBWxUeB@_1)}N`5}(fs
z4hecBcD~Z1X@a=Jv8<<dCzffyYhCyBj-$$4rKolD?oRhL-|=vRd{(!Q9oLtSbD5dg
zi);73P1%#jFu{y>^&KTob@p7jSttAo{+(Z#xBS@ONlw=eU)6bg^=)AEgSy&(?iQ~T
zOV6(po|T`~<}Y*6OK-tN4zFcQ=Fbm4xVG@)k_l}$wU&vk=w98FoZ}Gw*xESkx?xks
zE3FngnG$z){p|uOyXrWOEEY{+S-fw-wGVtX<+c)UnF<)p<6^YzmMCty82N5Z&WbpZ
z$zGTE{1VqbS2`Z?uQIKL)3N;g;%Qg8ZwYQ!n!aey!uc&Te{;w`xZ$ssuXm&U+Cu9$
z+bi5ZBowUYa6K}4)5e=m`&!oqnNPm3R5S8a!<-kKlQ%juy>`1^cUQ5c+OK$Fz{()I
zZL(J^ycR!UG%nZv*s?>-U;9mw>Zdq{=yI-Ij`!zpjkbwR*Efl~<+0en=^*dyLYI|7
z`$N2(m;?LsX1MS_zaTHhGr45DX~Bn5(S@&nrMY!$9Y6JRqLjOb<B7RllAD;t8<#%W
zF?Bav<owO&rW9<yev6m=vDlk3WuMsoiu+Zkcdnh;yv%^fy~9wPvEx^E<s&wUs84T?
zzwc>XyQWjd^ajtBo$9x~y-m2&_q9fM8*4{=tk>MGy&bX-*WTPI##LCWXnj9*t^LNb
z{!LqdgzbrMEQ>eZ%@deazb!y2TW|SqF^{hWpI@s==Bb4T-@Z6;o#>j3O^J)EZn0Oa
z`4Lz(NzUy_K57&7w8QNyo-7Ouo46Sm)NpklQ*sjX(vi#ByGT7q4HePOSxaslm099&
zvBaS*jeA=RPXTYEkmhV|*D4j!^9Fw$s(Wp3@@bx$np1xIslnlTtLKk@J}$4Q;M#9<
z=U>%7&ybkNy1L^#iWZ68@p<rfQW$q#-PHIA!9NyE&sKiM%^og3{r<tnO^0o_M=?G=
zAM+};`SpRqTRj`<|8{;@z5V%*uex_MkE?2(4U&G<64r9X%{)M)^mWwXZYGyzEA|l0
zw@gRed>+?MT{}Uid{3m;s~u-`kJigvKT-GayVED@8Z{NJJ5`!jWLC7gJDq6qUdbKy
zMePCGB$Z5)Y}NKQuF|{fH}^gLA^2;Sz`9#(a&`Y+w)e}+b<5wsUw<T3efH9e`#+u%
z?J}#WZZc?O{a_aKn&;P?a}Be0o=w=S*q|Ti{EBtwldN}QAI|c|qy;{Y*H)HUztqb=
zF0$ZDXLP`=*%`H&x&MA{wzA|_TQ0u&P1W{u1#9Luo%Y*wchbg<$6GfvyqD11^GcUj
zxa--XmEGA*X&VgUxx`NG58swycy#H>9a1M}PT%<9^O@eGwJn@YkN*4JpDDBA{@nv<
zDsKvUu5X#T?!xH<>@I$jMNPT9V?569oxT0!o1T;wgMCl9enxYyxy$Qg?tF0CnF96y
zA2vQNziJibb?<23`NKQR!?rJz>T+vSU+lhK?39(3YSx_0N)FbWFE1@w5*BiDX8DZL
zuTvKNk@{<PH$PChb-TxM^Yw~vV(+dxmCmQ#XtzOs!IO-Oo2MAR5qVZFev~DSS(we-
zaoxg06*Wx(>lSW}@Vj7Yk<X`WaAi$#%YM!&NBPaWPAw{*@=nA0kuyVnRY3S$<`;s=
z@h7gR=ilYl5-2!+%h2oF>96y%_G{RzxK^k8Pd(Rl&EcAW^uG&ZMJFc5a@k#0zAO4o
z*YcVjL-AFyvb$5F#Lge;3i5b(&2D;Y!i(?stBuMM3isTvzN)cC!KTBP>ubmwmQSfn
ziYLW)ysO%8EMe>LUWnPcwL0bc3dxPG&YK@iSyZ^{*0!GN`ICD~es!+SZJcKydraH2
zFzVf(HYe`TlhYQO$S~e2*(f`4ndiI|eT%DoOXf{<SQ4W=xhG+<0N)O-!yEovzBhO%
zdru=zHMH2J&5^$>ccW?1p*>p;)E$4a`<?$}1#hFK+*t0TTqSnqTO3`Z7v&$W&o@kM
z+ju=BYTnbWd7|FN^UL$~<`*CRsMb`uCH2M^lal=DPYmXooSv(<B(89B+pVt)JR}xx
zeJv{2pVu$>l3~;CEZKxbd)iBv{cSzgrf2_P*?q@oNkOR_&Pv6Hmadrpy|Sh5>z)%I
zst&u{o$JLiGc|WRFaJlGSL;J=w(vZ1GP16Z+o-}(YtGxZ@o)7tzT$!hvilQ`SWR_)
zQc=Pu@VKxj<;0r}?DzWT9#WaMjqld-srH|OPp8g3_|v-LOup;WWfsZjHfW#8*(A*(
zdr7|O?WM~q@;c|g1zb)s*gI)vd<)+vhYej(YnHyB^H=inTGe`H)WYb9A*-$d3j@PV
zE(Qh-T!m3ueo;wLVjgmFbT#ZO==9QkpEZ}Abo_QmY!hcy1heJ@wVP&l&*oj&<<RZw
zaN*L4H0Oy-o~njDwF~wgvx{t>k`le`@|RmOGKCh#f1b^j|0Gejd-t#8KY?j0Wc%`q
zuEdE6y=BqUny6b)Gi%<4<Q*ngFP-{%=<v&vx62J;749rDmMW@oNnJJR&4I-l)w}Nh
zQ~P>(v*F(we)C(47x_j@YVR?bweip_Aq)Mi_~<7xDW27GE!U2@iyn`f7#|jN-qB*l
zwzO1>x-jpl%jHgcarWz#Htm~`6Y~7^-jE9C>|-g6mrH&<ziYbx&(B|<4xe2<UybL5
zewFv-psbhHtGTV$JA3pQs;2Kzm?=7|oc*Asiszwy%5qDZPtD>f?qZm?B*@`LVq3%c
zgTl{5eEF8RCK;Vrdi2a{)f6X9!(fihs#o~dG6y&CzkA`J{l+MDjY*}i)R*-JZLC^T
z&TuR-lZs4zs_d8;YOAd2qqadSYcA`x9b&3=sXE5DxII;jJnx*p=(L>CF=1=Kp2<9I
z6MJkeTdNLDaH_cZrQx@%#@f%anmg@S7MI_M^GV!(-uuK6ziD&s`-%qcc{Xvz;-p&R
zTkMj1gRP!V<ElKLzh;N*@g;x6RZAQ`s;(}(xWn7c@!G9pN0n18kC-T4{kHpJmP~%`
z{{p_%^EO;Oy-{H6r#m4V%{@MQe^Obq?A!ybFAsl47TG6>94~wkz!h0i>J!i5wmKrm
zvVwVI>54}Jcbd#TuX}gGETrJZf%G$3@~f^~jQWuvZGKHv>cv81nTa1&CFB48_<i=c
zc9zb*ReLKPnrhES^od^VvYIUMHSBiN`Zsoye5BW2Zaej$qWjoX<E>{Wh+jF|+i~hv
zFt;H4y=xLGv9o3sNJR+05Mb-wxo&6lG~>lT7MB#MP5pBEz;~x-Ez6%)aKBx$z30ra
zM@mT?AKK=z6>q=FEZ187V(JzCKc2r_n?Kmg$o%1nDqmawg0F{jzbO9=X@x0kEfO-)
zy2>JUS6#c7aVl(;r{MC*8Z%^!UH5$ay3<fFD1FsAPpRY6Hu7#`zT`Mb?Qr;E3xOXK
zjyn1ChVGhL$$ucu{h(P!*RHA=#jjo&cs#lzr=qfOW%!9oqc>%jEwh$LtEXl9ZaclE
zCs*Xt{Y}F9{4XTBI+c!Tc!^h+H7dDFFXHo*F=I|@^qM(cujAj5G|A9qCo&%KioE)4
zepoO>MPs5$V%`0}zkW`CeOmK>Nny1wU*E5b^0{o+1NW58nys#J;Npt(nuNZuiU0c5
zZoa<!xWM?`x5V2`(igQ`cUi~Zx+bq;{4m9Bsl;!+qSGsi=QMxkbu8EIzk4{@BJty=
zY{mzh`D?`A`%Ti|v)C?FxMR+>S=F7tx9@RVZSa5F7yi9z*Q%=T#qayOt>(M_ZE^ia
zZLD54wm%L9cYkhl4(&N4`&4bV`1K8yQ(aHJ>Z(eev5vRtRl#Q8XPNsSb==(kGSchL
zKeSS3x)k?$Z)OGtWiC9u&8);Sl-}muu#0}T4Mb|chu@jnzNE>G)ntiisZg?wK`(Ew
zosW}7(d66L9^9DtmLc>i|E>Htr_1IpiFG>Nwrp=s;FV?HcJ4d=ecs~|_H}yq>)+Oj
zaB6k${VXz7Shz8bLEX|n?S^&7uN-#2Qake`tKxzS_v@J#OCDm4TB~rhdWzL~4L+Gq
zYg+&Q>wUo9Zu_f(_xY)XOFSoMAD(-mYh&j{$s-?^6to_+V4HYx4)eMxWvWN6%{cR1
zO5ADL#KSt%?=0-qS+2fBVkei))H}C|r4oA126)Nd|5Pov-YJ2@QNUoDc(SIDhmDlj
z)9^JFZQc<&5*JJbySz8db7l%Z$6?xfT7SO%oVk6E{ME(Nw*;h5l&<aWT&-k%d`-`q
z>Fb=|Z}m`o?Bp1+{?OSgaraBYJO8Mv3H*BKv1ryV$vsj|`&mC+zk27Ao>J@%jpeO#
zLQ;9&II+v@cjor`eU$q?hji(#<F^le4BWBd{)}k7oBBp2ZpMj?@2XZ$$=)8z?sfmv
zR$cz53uaH9ns2f+=jG&US1O&lxNm*s{q|=Dzs~%37b7OI^KgXQhfm15dhE+>MV+W-
zQN5#_`b)Y?<4*NVxPFk?ysJvYTmR+5#DdMocl9itu~;curK!uN<+W>Z!pS^|!|wk7
zr_Js%|C>`37ZE#SiRBYk!SF}YIS-;=vaOw87o{<2+7y$=K8>o5o0_<r4Yw<CerpJO
z9kz8^(jW6D{y_|(Daj@x^;f1<vVQ5%3|j0Ja^u1}N26`44x3-SkdSe=JEQ8stY`KQ
zw*K9A{o47ptJJq7xALz&xIyrTUv_6qpsB9sv;+IT-nI>QT;!5&X>M^TQE01`^KaW%
zc^{wd68_(>eX@Vc>Scz~PjjP-m7biw^Zm$9fAN}Qb3!6FpIkhp=<H&b+zB^ly-mN7
zzr$<cyGQJfO7ae&-2N-9bXK*P7Dg1R?6NL!WMY4QzP8KY&Y6W9YIFp5u*U8GoNKr)
zRbXRl$uGXEM$7(eIVsYqw)gb)oM(xVGhD<pd%2t)Z-w-1?`d-sDfwSfymXP0?<6Co
z+`=0dbWJL+v#YJn`rG)VCepj^Z~G$a6=$N&Ipz2AYd@X-_@6-jj<nPB`%QBWC!OCX
za#|q&EL+9nko<;Q?JvGvF6F(y;Nuy|19fN%1{nBWZdPMtV0grcr$dqpx&;Nf1(4f+
z-s`Y~z_ItgMVM{3*s5IVV&@k1(v7+jWWa8#dpl*)x;OS}!iN1%vVWwk^K}xud-%Y)
zKl}3cNgn+C@0)7n70X>xlXDyUN>@%4+rXt|pJe2pp2U(ZA9d;K#6-K@JKElKd}!HP
z9`L|gN<QZb<Kj*GZ>&GxabACN#JYsn623A)AC^Q^tGjsKYnqaJn0Min1-Ww!HJ;nd
zpAglt?|ANobxfho*Ir+Wx|y&c#IibzJ@@()QLCP48`ox`O(xZM^Pl{x+gx|!-8(U+
zN3VT?R?mIrxOdU2pO&icL|Laz5Y}?btoNJR?lwE=(P7OSkIwih?rfY}e&Z+Gr~D0n
zgi{3k`~!Hd{=Zxyd8mjp`OkqpiKPY>@8+;=-_l>mrZ$&*mehauUb_j4%!=-#wzlM#
zwY=eCWng&8%fO(HtF@J%l$DISI^%5k?L297f!gQcK2O_YCBGdL|FY04=fK3fF1dPc
zuNUw#H7_XB>@=IcTVZDzi>v&V`!A-KR$NR~J(~Gj<nXq#_F`LOn<d{Ke1Cn~p8tNw
z9PPvW?5yEoJuKI4cdUrCd)TgiQ}AYUU8w(734fhAGP3_!%!T>#cdir>`O|nBv^GO0
zJ=OdB`~3lbpL`Mc|CfU~b>|V+*zj4AftpTkyR;fF1tv?M)npBPG>dgvNb24$#lV#1
zTLY34*zy)dzC6S)t=N6$)23->iY808`OD-!IduKJ)2HimL}T~^ygDQf`j&nE_^az%
zeEipX**(=)l^g8urB9pc#JPLJ-V2Y9iKcNV2JyUX(Nj7osp7dQJljl9GDPcn3csy*
zjf#kV!#~4{@+zkIeQQ*<{QoHGrFk@CMORV9&%_VUgoGDtJ{I;p=4`D}^+6Ufr>egX
zpU!raw-vFOzU*0Ll*dW?-8{R`NltJ3&we@}dP7L7#KhKS_03hMtT%^sCnm?TU;g4K
zVJH%GLvxAjmc-sIbMv;(eHDIp?eeGg9S08H>amnI)hhq&D60L_=B=GN%WuJ5A-wND
z?Yfr}n)9;z<`I5o*@rP_&U037>p!f+qhoVu@dTlQe+efP7xcVMUd0gNWY}1%(eiBP
z)Zh~{r{ri@@+`j~v5q%HdBZtbwM8@MrLFjPW_m+?jJDcKrGQ(lH_tRLwCvm8wD@_7
zUH{j-Yugv@Iy}?--mwEW>N$@D>1idK<~{j5!Rus;*InkzkN+@y;=H_Jf4@He=_Lgp
zg12+o&pG%p=v7^hZq?pBSr^`NKY#G>^2N2)ZyHj+-+B0QNn(Gh?Dj{x8$N&fdC7Cl
zPYaJ{pGy_Wcn<MN*o5Xh2zdR9Z}to!kF<}LKRoyXM0oBh+ayHajrkH_XjeVg!J#Dg
z=O3Ol-NXys)eT`=(@n1YnPOwKcEb4;C2uOrX5EpSpr^>Xeq+hHqQ)C@4lcjBE5R?1
zbCR~v`iI(AK6EPo_pq;Ly}@Op`beP2;D+{;qk%5b=2!C?>z`F7-+drelYZ^yuhyqm
ztUegDomaBlbLUaZlWWX9r!TS;y41|MDdbXP9=f<#&h1Qhi;>uOo}`4*!*f-(X*`ii
z`j#MQcVIi4*ZQxorX63kFfEEt+w=Mi_T7eptgBSzBKGrd$U0LVTJ2G}@ye;&+}kJp
zcT)>mQT<Efjf%(vCTsi567j!>l@hL(e%8%v7E4UfwpsYV@%SUo>{*F27kbX5s5tTT
z9kqyazw^RK^gjE-qMITbUrj<^PI$+cIV;8U`~T2q&uvy0T-d4+#hH_<9^wD%<*L7m
zZ`{kX3U;fpP5mfVbpDu3r^mzga~^XPrG9XCXBbKzb3U-aV}Igfu6^f(d1CMPXGV&4
z#3bxCarBH^IZ@(qQOwz6F@<{;{$Tw0)T+T}UF-b==kjxU_U9Z}WLf9tl(Sj%PU5r7
z%tK4p>??Fz8~EYTj6MI}{?!lvEB));qqm|Zw*<=fWiQLCeD`CsSbZ|%gV?QI#ZlJE
zTl!As>daUB8LRXE@1;L^t8S&N^a#+tXuj>E+E2G6pUH~GO2>O2N1jyno)F&C`2Fzi
zy4ZMkk=x-f^ZHx<wdwpwe{G<D`iS@AH|{T0IAR&Id2j6$oz@low`S4pdnaV2vR_%R
zYx3SY<8Irxl<E7wvA)VKU%m8T*tPh*Z7g5z^v(|YzO?z$l>$qvg5PJpgx$B@wfCx8
zZq~ZXdD~11R^7d7G%NjWq3fIe&6nS3DE>#QxK3y6R{GAuz%ZQ`Pcsr!oFdm-NK4(k
z13b8dOvT?Ezq8cgb=un9aZS2M!?rLwdT%+}wuohtSJsZY1$&Rp%V`%$jovnU-TyXL
zPaWBLugm%DFa7@T`{`!;{<zK_?Zf?Umf>MOEZ3PUf;O*t;J*B&;m!8M(DPenh>7|2
z``0zCZaSQur^RZy|LLYx-dmVYN8Y^r_qTqCy{+}3diz5jk$Q!J*Qch1g>+5mT<5i*
z<kAhdVlT%jJJK38LnGHGc?jH$)V(4yqj7aY*sc$c-A>qS-Lpn@^PMGa4~5;OZ~pw{
z>hZ5>^PJa$UYvr$JG|E4i;uhTu)F)=`o-qw*;zgu|Lt=*NF&kuwtCgA9fx=nUAhc)
zGsHR1DRwRT8?`y}<bohc_1`Znp9?Rn;QP{larWlmAD>cH7asn8KF~|k%{g?+;mhTV
z!_ONqTIJ`I9=>`=ebfC}4(dy$zn`~Hiua=PIpfT%c}I6n`Lp@7LE*U_CV#ATZr_UX
zp4!d%Qs&O=tF`xLZjI`Zer+XjeEXq}jS~)?Q@H0Wea&O{bd|p$`(NeR>i&0R;k%Z0
z=I4^YnX~y<MVu5b{L~@v#{KrvtUsE!b3!s+od0~NpK0!c5FI(;PahcEBPCw^IXHKM
zP{FT+GYgMO%sw8%x1uG9iG2e1S!3<=35J?CBZ?%>FEEUeUZIvS*V@O~*w#Dn??Qcs
z|2x8bF6jl#IZ*R%;RTuY_=6vnH$}8$nXkSbaQERE>3pSxH~U)>HO<Y$L!)f+K5NVj
z*jSxVHA~hh%z&4j{YTO6GaTu5Wvf3Nww$B0^xg7n8J3;j<s>$|X|w(^XMUOeQhEDT
zd!4`6{eJjEYV-RwPOa)|Q#MBESG!-{-t}$ChQQLbtNm|mkf?S2{Nd8B4!*f(B!4ZB
z&RICSk?~dQ^RT5~cWwLgL*|)n;%f0_bHlbi*SqpZ;I84?2|HJm*i_bu#mY}=nK0+N
z#l4tRriqsA{GUq?HpK`p349W9IDE!KVfSSd>#h}T5Uu!hxbbnq22&00<o0cOO?R38
zpV@qDm*P<~kuz4&`!~!9V3$4iA=1VD{I;_ClD7|!K25mv=*5|926JYwx+s~?ehOTO
zvV#lJBjzj4Zt1mX(5v9SC#BMSZ*}y%Rc*5(E!U~UCQH0=RV)hWwpmm6Y-8G)ve3%e
z1>3KjzQw&g2waFtSE=V*6r1p4MPY&19%pgA!nrlQ(hJ;qZm{{wRLt2}&^IehCe2v2
zSn>s*bFyaNUP04cK1aSgtne|j^s<!=-Q`=>Zqj#2<LAF!G7IXCUFK?!>E1K_z%{?7
zuS?#qza_u5E+?IBdsa$-<a;UeoKq8vMe1HmY5BQOH#kwy_S~Tg4hgZB=GhSkue-J^
zd_7xJceTvK>`L9ffJvcQO3QZ0gk9DQmwB&PXH&D2PhoQAL-X~YrKKLP7r9`1+}}g`
zb`ER#j7lf19aFCERlnGkwR`f1PusWa>$in}IXn5f_=fAp%ir%mdSb42ec7Y@6QXh@
zb=R^v&s9CYqvr8n{@%T_cC(KNTcoT0I(F|)%H;#4g(hik3S19X9$V}+L8qs2`(yvZ
zryCOf^UdMu$oDwWSig<$z0s#b24@{3wm41y8<k(i^F1hc^~CtxP3DE{2WEY`_BD5<
z$fsKubjvDV$5)r#Z=d!m`e)r!t&2|2-W{K^Ydy!5V{NB9?;ECV__b^T&ot}fCZ^X5
zC+YFd$=Vd<_IZo_!j2!FRnz3$pP=1UG;7xUn&Zq241Sz=N>0$}ZpbC))zGuhF+a6$
zjztOCpPS`gxr#-kY|p*$PAQ`{<Dn@_l+?|f3@_D{r921uuUvmIxzyv-HW}-T>NScI
zmp;s%nQw7_LhX;I9}llzJm015)Pom_?y0Vd0sRkak8W1&%bTQqt^N0=TNxW8qIT@u
z^-oOAyTw1li`BBuH8M>56LWV>Y0KZ&{!RDq^u2g5T@fIrs{3lyl{;NQhG8#?STm!p
zY`ZpNnL^l>v_|dFD1O79t!BGdwnQ<Q8)W_s)BC?i%*bD7oz_X+Sw{-0oIg$6op7JC
zlmCnFM6MYslkdyfFZ*s^v*-WEho8SEvwit|aZ-xvlnvJFzgGqBp4GuHIceUjTQ^Fk
zv%OR3TJ-Oz$zmsi(3+<{d(~>hrWD+sZTRikq;H-Q8d+0!CMD=DVbS7!#_{9Lrv$&F
z&m0ttjCZueWSm)Z$Klx0C&irx_Z@Nrq&2uV=*e8X7?Us5v_G+x$?^9p(djSs{B0U8
zS_^D9zhJV@p?AxEu66e|y`8pk)jZ~%rq(;2@2@@k(&vl7GW)Y#u0GXy?8e))iVN1K
zJ@=h*@QUcmjGCX*Due4^32ff*^wi<qQ=;9!KW^jNrunZ>aQ+6FL!yEO8cL4*ri*SX
z>350ut}6Lyotxzo7kIg@rQqU)n{yV||Mt55=9h_D%x^gb#jNz7cV$i7k2Rd$_+aan
z%*e`*LPf6@FF*FI+=S)&MS(@8*SnU?@iMn8-+nRY1Y3`##6{ju-OTDn&m$HtT6l&<
zDr%lt?BQu=YhG?ixU(lEb9HaPs@qfiX7*}k&)xbf=Ve(_f4|+`O#vcPMXcFYXW!ZE
z6Z8DhijTZGkF5hQ70KIuRJWO=sd@1947Tap-P=|^&lMNC<`HeT@Yb>^b55NwoIIzm
z$yPMJD`4iD;!VFEYLqUhJ|^YvY4SsSs^`Lam$q*3j#8et&gA~tB}>Y(Cdvz1T;wV7
z<Zoh{u8~^#Zc2ghu1AX&7j%m468w9yaLOWambgqQyOny6=GnWw$P5(8-0i!sCUEb=
zz$FGV^?&}!cYid0YybIma=*@Jy$%t3weWrMF8dk(cE4+W^88Lm&yS#{ZEt&?Wbyp*
zVYS^By=!+q+v9>aTW@~6*;~HE_sQD6<mIaAPd2yD{qp|mJ+{h=SIQ5lPY-7=(Ybbh
zsg=$=mD;B*yrw~uUrLpKPoH&+E!B`^op@T!4mbA4e_y^^-&!%@jjT*bL4?}(ClRq*
z@~@xFEfSU8WNGD}{ru(UpQp1Y)d<X-E48}4MDEp1#Z-q~$(zpJEtKEm;Jf&+sodE)
z{mLq*O<(m$znUfecdvi7H(U5ObJQ+rcIYh;9wr8c#jJQrg5t#7f}GSe@cBWNdIgoe
zAs4eiLvh!`V_rCid-zP>*v@LEk-0l9d)tPTWM!7cH?H?J>2iANwQPb6#XUXI*?fAE
zjm0&~?=dICzu)1W;hSIoP2RQXQd0e#MI}nY8EplND>ohcr?4wc+#skb+ht#w!H&AW
ze9y95IHOb*kE-iT(eq^ItE?3H{hhy+|K69EAH|McN_1Ru@l=8OloTD~RV^0hw8ABO
zk_A)?`F2b>byacN#)h41#f;eV66H#k-meesRO*$Pw(9|3?w2Ef>my8m)(KdcW;J*I
z?l)N+a5&YycK>02^?=pBi%Q-9mu{8Jtc{u{7V}K@>sojJZr{{c_ust-E??rUe>Lrm
zaO3i&o>R+~Dl?tezSh0eD*3v2S4~)}@a?N-uicrW{8md^P+0QJ;-BkZ#@bZvkgk=h
z|7nrpu-__LWU3R_^%Z$Oah2<Dgta`KBBi<D#&f+LTa%fp3iP>Z9Of;uTvMLEIqKPc
z$>fg}Mzu1REY)JF7wfDswvDQr{$vrWZ2s!PjsCm8gz(BPw?CGhva{v;hnV@_jCRVr
zv)?VQu-10R`a0(5{%zT}1+K`<v-;wpP-8D}@l}IZV1Ch)#SXvjsjj-Zw$Xz#H(LF`
zJ+&iSdIUQX>K^sImCLXX>&WJvB=_4l)!(rB?$@K1UQ2c^JEOhy^+i*gm~WzA?6<tj
zzAnd>`O0%eex9JoMEjzn#W7})>u%ViCMP5JA9}j13=EC3c-CJ+l2c}G0cgA9+sNB_
zw=F<h&;(90zda;&M}#|vw_;=D_i1_g4xcx4=Y%a#J(Z^H&E$Esl)3)GKezok?Ne6F
zPL19qyg*|S`@xB6d?z2Cnd$sgr1syJN9zw-KfB;?;b5yb^GO@GpB!`DkIcM$aHi>-
zIg30c)>_Oyt7;`}SKFueTx9QZC7uc1`77n!xIZ{gn&f)&+wb~>x^FoQ+v6{|Dy-z!
zuM{a#ij*j^lH(UYv2Aa}u{pQQlDI3>1v#4nvV<?boRJ=U{0~p-&!a1Us)h@4r*&|Y
zaO%nJ+M@UW-<M1C_EcK_{QT(f>p=E{OWQZEVdb7-l05fw<Qg@8<x-jX9F2C9U7uX$
z-cc$ZBJ{U_=Wz7%dY^lToA0eyd@<(L!8@YUa?4r2?zK~@QFF6Q(U%O1eYIC~0;_9s
z?$Y|{_wNPiC7e8_@ON|0<96>;vPvs-4@<AgvE1rn^R}qwtG;B7G~c}V$99Lz?rc&N
zUZ1x<{8-oG6-}Y$E=kwc{;*O>n)Kt1bZL3@^S02ARxf$$c$2y;-nEK)(v^zkn<l)p
zKlMIV>LNqYwZsq!;|et$!Jj^5h4SA8Qk=iZ1jYxHl+Jzg;C)v3$q)}e8O~~3{<}Hp
zvVNUQ%>H`KjhM93|Et*d3lGe{DDq_N+bp=mJ=tQuujRwlY!QO|itmcHic6+tcyrz4
z`eCUzLymuT&PC=1X9+pJuoF^myk93T;b{F4{-CP%j|IP&wBWG`&n8q9>90srSkc8g
zv23HzHj5%I6KRE>wfc(OyY8K|Z#?AjH!Qa1`MSdO^-T;yJ3Clsn_fE|QMBmYES2JY
zCTA*&iav2EY~h^6B)Q{+`avBvW368Td!@VXO^Rl+dB5nSW<>d|>9JDFrUcp6grE1$
z)~=lBUOG3J$AH;H>V<lk%ac2c;%80}*dw#k;lZmYBTM%Uy^a^zZj^E6aDU{C&2UVX
z@y`FC{eka`()u^+_0C5XO;hU$T@$N)^MsztDe+exy|(8p_Uvce^8M29kcOKbz6%u{
zRJdxmtHXuG*9702b?i*}$7?61tm*6Z-Ff1jt<%Y+Y`fG~I7RhzYZht5-I6`-T3cWc
zvGQS`dG&{b2V9#x3bH*{vj4ocNnUG_?W#ki<~O<*%s!?!WA@S@frdhM$u%(_R)jfU
zZ58;f+TZ1{>Z^xVxG&e9Z$8rR9Rj$`ALs43{%h&#?=#lR`2NWDEzLOnEpp3t>lsPf
zI%|X`#-7#++ZTD`+Q&0*ZoAk;J4!F#QrC03ujtUyCS$(p)dJ$LPgGpJ9x?ZKmH%Pm
z##^UeM#{-JK6gEt-tp(;<Ru%jq%O8ixtz2x?bFS^+_|;$rn>v@H<-_s{iAW#%VkMx
zXYQX^wmzcj&)V>^58Jd}eVKANVv(h)-jk2DUc0nx|EM&*JAQ7u`^T@w-TFt_Jg<uL
zpU|J7eD&du{!{8H8qcnWEGp03s4N)RUU|mRykslS&ei+Y&G64SmOf>Usrw6=oeZn_
z?$xw9`Ty*>p!+ddfmc#VfN!5w#wklzwaYGrPhLIzx=v)dS=O3fzQdgTH}xK$eG~m!
z_s!A9zSDB1C8jdAyW?)3+NIRFp-4oqa8~Bjt}WRI*NM)Ny1PC2q^XNdfP~qUmbXU|
zyd`gVFl?Jv$KJW`tL>Z(w@mKr`W$*$=Y~yeYLKex@}TY-k#+rtwl)^jE}j{EI(%_*
zZ$<7uUbChD)$S+Ut~K>*l&&|+yTA5xQrFl2xvySpRu-iGn)B@A>%TG+jxP<^mznOT
zaQjpL%+#a1tS&R3SXkB>Exhg8uNz0!zA2lv^IMb4U7hm(?5Kq;qqk_G3Nr)4UJg8U
zcUdB6$6zjG-ymqKU+DX++Xe#v*Dc?%l;?J|)V3*(*DoEsA)&n{AVRWvo5az5CQ+#;
zCqG$t@CkUI-`terTPKTbtBtX<xODgLyZ>{)J^1|d_xj(U2K=LcnSG}^cRCca<a^K4
zEvUDuJoxRwT)pXTcXVWY;`h|>igULZZ;5j3E7vHE6yTHjl%(+cwR)#N|F@T)x%{R&
zd-?=tfhW;+USwVJa!=9JgC?wj0_PdSy>=@kMbA8Rdse8^GvRhu&7IEH8|V0WNbF>*
z6A<!$c}^mF!4#{#k0&k9W|`w4;#wZ{B%olS!nSi9rNx!JckbL^c{Pji@0!!4Pt{aE
z-jR89(S1GVt4lBPXY365$Q16sZrv3P%e2*^%2S!M4_@V+t!t+C_hLYx$u|>zp5<&c
z?Z<*X6tG;JExdyL2;0TUE2?{1Hp+O1gdFu*p!#^a%AJYR3QLrao|$gqb!@hb?dQC$
zXLhYmKe|rxaJ4*7?dDS-XC6_L*!7)x<=S;V*VK9cSW3m%Mr*v@G37|%vO@xlQ?DJp
z*b_a`H96lPv*^r;ud%FOx9NP<a=I%U{yJ&eRiCb&GZq^{1%KDu@m-G$FZgflp}Qi9
z?|f&W%!!cOx}x{B^EO=EB>k^PLbm3vtnKl&w?FLLbfu~Ge7|J2ZrNO^_wUYDlq}Wr
zSR9@po|1B9*1bu)ih{Y`FtoHT|Cu2ZWGH*s@sq`a4ZLRg4*TvOfBl1ha@_0kgMZie
z?ti|0uIqjkt^Ln*<_c_?<h?@Y>G4dC*_<-EuDdxbm6O|Mt0rbnW<7TJLBy`&=NlU@
zcKOvPoqX@+cq_>H(X%N2<=KAO@8&OCy?Dt^1DCx#DHT8B%7tgVoA=!`+u%#%kL~+B
z7v^1-Kcw5?ezEHC*(c_&qW*3$oAJYG&d2EaCa+GI*-vqOFI}MJ^;_X))-|(REmtqS
zj1E~nr6<_HGHueP+22;l2TeMu<vw4CDf9A<-OW<&lY8I&e0;)5-QT2ijo{A%jcYeH
z?7J*dy7~8s!t96Ky{9X!gI;gfv&^~{GP{0HdEJ*o39P&H!}2xC_jJ#_agD|P*BaK2
z`G4kpxK{O!llS_)ceOV<^LKtc(UrI#?aW)yUR>CQTp83^o6?fZ9K4%xBTZSh9b#u-
z*doQiAc0M9a(+=NC|5>C=if0CuD!lKVKRH>?X44jt-Nu~Rp@wb(=yM79p*c@8?}4O
zBE1)R1#J^|{8yds@oLxf8>~(5H}S{mTFUU9pR+Td?##XY)gOPK%%149^x>0GwyA<U
z8MY>z&zhI_;E73{kWJe2P4~1m-jgW%_2l*C$(PlaFMm_S{3iXvrX<Nb4vMdZ#EqHv
z@HDyi%dtM+WE2xJOH$;DTj!MxK_QEBywX&HeUFx`a>*@`VcDO%U{jO!yg28n8@UuN
zt4#m2Xv1QkkRO-d-_QtL8>w|VO5_fQ%&DbHb4B~u<Ma<Nj6VAM*6C?`PJNlfdAKEQ
z(VC@3b9|<)nP8I~v)M@^m|^wyv}P^unWn5S7}T>?ZjE>-k{jH7NdL+-rr-k?6>OMf
zEl*6<iJbJLH&aBV^M1?6Rg;d*S~=I_7_UF~I@2v}Uz{7|C)^c|U;1|O&0B{TxK4Le
zC@PbT|M&5ol4X5m;lInP&F%G=+T?d1ZF}vj7`FD;6V-q3(&x@&dB<Zl?@iXzIBw=H
z@x3WB(@n#rLbN~5$*xc~mgw42ymeCcQE%BBC%a#{X+-V~)j#n)J>!kO=)2NV$;$^s
zi<10~M4bD$rts0y%!-|FME0y|`8idbHzqH8gVnFCYwi9&-g@EK+G9@}k6ya?^pRfc
ztPB0Smd|w7;yIkx(Xr}D?$NO5?L6vpB_*G{2wAeubCQSi#Pc_&$E^L@bn<HagjtrS
zT^YGe9<IH5ggcup>bF~%!FDUR`A#7LCoeLoly7I)86`9C+p^2<<{n2g#LACFZch7a
zb4zM+?v5$@jtQURnp4F8*fX2y+|7LU!@=B{oD$NJ?c9P2D<|*;M!k@Y$w<0rn0Cx>
z-~5Ut_T0zLTe3}NJf?2+CTs?8TgEG<xlBht_I;0eb46#unmu2n?O(HKoG_hX8}(}{
zmqC_x)YC~m`3z}>&KK=WwpEv%mXN!D@coSfH?fE}+Hs4#Wsl`uv8^`Wt@ztQdgHgs
z&F?y`-JVEP=hv!*Iz;v@jy*8d{^F|0$0FuF`6<CEIj%punZ!3Gr|5sJI+!!z@AeNe
zx=HaHKb(JczU!I3`IHN#r)8@B&U~%z`{}yl_?d6Xf8FY>%6n~1%Px6GrpS07ia!07
z<ME-V?~Q$~f86~1x&32@_Zr_8X`a><GvYn7cDa|+*0V>u%KAJlqwassVNUrc#_xQU
zKcqK>S#+}4ex0)0lMQDqS}Q)cYQEn}jsK^nDtMQgY`Yn~{rF?^DTQB87+;R5Ir27a
z>S^KbZ3|*rCF&l|X{~6H;<m9(N?oRY=}Ee2zz?aFI`<1?xSh|QWjmhxX#ubJV;9z|
zXL+wJca3J)pk!9c_@lP(#ihjc-$dqQo_yivb|y|vG=9><@YCn!9N(t8NJqK&b)-q}
z#N0Px8)WV?O!i2=&NktD^0#eT+tys15NUMdal%bMjbxX}I(=0cH|Bk|oniK&VEf9H
z=DBk`qkQ^KE8P{kW3TAFaoei237#8we=w1#ykTXYze+@W&BRB?H2h~Z-cDbvT4FJs
zb*+=gms!bA+*U5Wnbhu_(kFh-aMNuTnVW`O{<&#9Ts+IPt+(8{c;Tkx&$aAtX7L8g
zehRF76y2v7)$Lex+|&K2`~BLAPlX5VYW{xwJ@?7|uA|%ZO~NG8w52;eoBUIpC!KMh
zA{*g&c9#1@xt0I7@!poZG(Gyc&T39shkf04HE#sfx2#X}*2tdyS!uV*F~gRsrmeSi
z^Rm{o3#{G7HkpO%+{E20&unnD;g+5}zef06+VN|xpFh0Vb2a<y4yU)L*;oHJlWBhH
zbcE5Z-z+v_Ls*bl_sVLIBaaMwmc%J8%xJF?`qH?0@tcN8LRWT~dP==MRI6Fh?|w2-
zFX!1|gNw|ECVdRcoc_+Opx39Xa$4lM^JS@jUfoE&r}68^HsSRN8hsOFQfAHlFq`8D
zmscgT@a}+x)>jpMt0!IImswmFp0QzS`q_}r4USVd)t^XS+mkq}KEQF8zC#x`@8#W|
za{m;ivlu?C%UI13+g{mdTiE8>WD;n&Q71`0W48X4;~yNR-Z<R2_g{G>SE&4A2lm;f
zN%>dat~`BwkJ-_c+IjpgCl@+dY;E`=uvX#ej{W=JZnp@UUAQ5RFW~jLHxqx!<Ww5?
z{GaFdPNanM*BY0i{qK&d-e>!_p80kE$D0$s{;m<awS3k+<E4|mtz0Wwy2Nv~3)e|}
zDZX@kcGCr?hjVv7*vEG&+;_d&Kku$nUkiWjxG2~7f5P3&#T^+}EEDS=%sw%3(#^f+
zJW@9AGT;{Ut-bE$?7ipkJ@yW>uz&g!KNQDTdZazx)-x-5y3(g*8baL%UTjUu_l%q6
zyk4!w+njBk{Q_^nw`_%4uX9b_Eq{M;Ua#Kb#X3e!T;@^|ckYSj$SKsY74yj%)i3F-
z$`D$<*>ZD-IJ>X)i<RGkzMWL@m~ds&x4P{Ges_D790hFN#wEIc_&)ROj?LdvkH{|R
zUAX6moPqtLuf4ms*M|j1rFB;4TRg~p@O|FCmK!fuM62&+EuU~B{NI&&ezCT<vtRyr
zbdDkI!K1m-9PX#{m+m^(Vs%7$e`}!4#;fTn&vWEEm+e_r&mt2#ojJvwl_y?)?taFt
zlcdZSu0Frw%FXEFzz2<!CS4a!K7Q~*rc6vv_R6y#wq98172W-1S3}P7Q@1>8bziwW
z@npNTK#{#=mgukcIM0i#7ZljcT$$_iUneUZeT7^8d_l*#j0_Chm>3wawi!U}@wEIR
z&{-+DfoHQohvdK3Y&&~!w$N(n=i4qg&5B{l)F|O^73j(7ef#p%qzO+{>z3?uo4-am
zUEEC7%JaqVneS(F|M>a%U-(ZC-CG?`o84xwQ09r=@pYB#hBZ&zVh+sxT)d#pBOrI(
z>P@#ou5XYQ*q2-)W+HdN!rn+yXw^sAhwtT2d^oeSk$v`s59uHDR=Awwy2xto6k8rV
zi|Lx_g%kChQ?}~qPS7}#wKXfmC8M`XQ2ECLz9lEWCB(k8DVdyW93ttpc?ysCqZN-I
zy_}XdUsCJPyBAtdPv)Ae6JNA$s-evx@d~|tzA0a9Tivg}>lQyav5eVuLx+`9(FKJG
zvIYT8yk~hjZ+FN==dC}ximg~SpV6o;r234qf_CBhw|3`^G~TCgT+&p0c&)$z_vGVe
zCoB!Q{<>q??k2UxCLimPxTXixwW_BV?mqDOq()}MBIV|=-V=#2Q{t97{wqtluHLAv
zacs|?OYBxFTINr`?xd@C{;efz+v5N1Z96SjZk+k6wD9=Xrx825w;z=;aLHqc`L1`r
zo^O3Rqy5SY$93O4Sv%K$!{?Z(KhSzy77`ud983%hW-JU0lGvJa1^LC96`*tVf_$^3
z4F&eT4(B<SxcBI8i+4*Uf;xo7ePXQ>#F>`rbd{xaXDv-t*&cW6--3U=|2BC^TYubT
z`6b}4$>)2s&E>^6?ApEe{4=iwg)`22nZ$XvnzX&1)vcShxaNf3gJaitSDw9gIHSVy
zl-uEps%y4$$X|$LR;_c*eXTX&pz?aFmizk^4k<r3J=5bZJ1HdkQC#HV87k3^fhXqP
z7ZhV%q4mV3AbCx`V&BHN_2ubvZ#AzDWT{tLWOA&jUtojKsu!-S*(X>lCr!zII@_i|
z(z?SdagSYHO|bT6#&-#|1rxcwD@-nIGrP;ZCVGB<LsYT8Zm9c(l;tIrt26SBPG3>-
zYkom{k0|SPt1YFh^Cw--`83mT;m+4Zzn(L_oMFhZ-bJ!a<d>^f*FI<6;1l-_9g>pS
z-tZ&I;(DXz)MEh`uVwt2yWpWHpTf^+JPf@XQY8+AZu)FgJ$Z@0(Y#sdXMfz<_|&MY
z<SASGm72=W`)1rb+<*Ch(kGqHw=xUuJI@4^Y?~t#DRn?LXz3ho;XLNd?FGvt^tP1V
z@VDl8bn4;Fb-zxY3gftzKao#7YO<(A+FF?c-xH_V%JlN?=R3bp<dgMs)!4ICt^H-(
z&k1KI@3)Fr7d5}|`j7ZMr=H02w+QWNJ;B%a;m!q#eaY`^5_SF>&#<!XO!!(L$XszW
z^YO6_=hpjvK2-bXww%4*rRn;wR<1-F9bKoHe5*Nzf#FslBZDlq<WriLS(aK<oCqEm
z-TOQGj@u@KKi2iFP5yG3ZyaMDm2S%M@G<bKxNc^{rv6**jC!`4ZS$cXlZ&h~1kT<6
zcXjFdNo;J7Y^(Qu);*tRGilfA-K%%6UcKt|rz6&ORbTtJn!gN4SsG#O;S#oVafrz6
zd+&7Q=5=pfTaf&;bNlr3&s?qS*6&%{dv@*CwY_V3-#>||$akHY9;c*tRAs*J!cF0w
z6}vWV+O%ueuGhYo90kRT_2nyF=cxX?Vl6&-rpBJYxxA}Q&Oh>uI_s>ldy|pYgJO~1
zSF7|~L@HmFOcS3fo*o%@G-BHmrOi96*mu18EoifD#ipYbV&Y3LoKIa^*R^Kes{2p(
zT(M`|@+)>}aB#6fi2d@fOT5xu?L<;%rX_!^GV5F&80YglE|UMr^L^6~KX|02|3KVk
z>T}`3-v3uZtzK5Qve}<e7dG6&=KABrXU~;wrkbxZI)1#b4tKSgeDso+h~Gvpj(<U&
zFLS2&wfrhj`VfEM@9HfL(>^8L`+o0e@WdDV>lbd3`&Gl{%v@8c{%h)vbsJJ`@0C;}
zYIQ6+QS|kLwhrT0>(12`7M-VqrWAQC-{HhoYULSnf7#@kGxrZA#=X$H9CT~HT$iNM
zviE<d_)n@Z5NvObPh`>7etE*0)BoT5i*;MRU;cORKL5SHJN7<0DBnNdO~7$^qO5Y9
z=oRyh%@P~xL!N~4b;KJ^J!CLRd3r1Vvdg;;ncZKKx>P&j>D<CMPj70-UT0l<F5IAC
zw@M$+#D!e);YSlc9^NCQx;A3<k`sEDmCk2;K5^*xv#H$0R?U&xUY}2YX^p>e^fFJI
zoi@v#a)IeeNB%!)@rixAL+*fq<o<}s%g%K#_^UkYy?Lciv4BR(mu)*0{zb~(FWZ&V
z{3}w#yJ1($LI$DjiOynwzIASY-Rr8>Rnjq8+vY}2k)WF}gDBHaPjCHsKA*IIsLw85
z`O0S9p5llTN^8$GUN|BYp%MLo!Rw8s#rmRrg@!c;X8Ag4$;s~hSXQu+@yPtgN*^A!
z-v7>4Iak$M{b4%~!`y8Xue_Id8=0TVT7D~$k((i0>QE|!-9GjW22VCmo%&+Q#V4Kj
zqdV<P;_4cvYX`C{X5-rVcy3VnUwMANKX(7;oL&9draPh5r}4q6?eB{$Pum-dm1NdQ
zUzF=r>GJyeHG=1}PG$2J+3$-quCTw`@$;{l|Ci7GnM=QKsQRuZ`#|8z<LCw1nQGt8
z6<d^E@y`Cc<<)JDJ*(#~nRhPX#Z3(>@r_sSA7+wsDbmsU`piRQllWWn^+z<=X7z7Q
zueGt%Z^^j6F}^%h=Tjl0`eFW!@6J>U`cGha!}oUG_LpDvGugI&o~U(khLwd>n|L78
z(#@-8xMxOQb2=~cc5jJE|0|wz*H@f*os?0#mV1q8?6knh^Aq@{Tr}~2)u}n@$kEVQ
zuE~L}K8A~SNX(mk-sTd=xx^Qa$D<2%+hpS#BziBseip4VS+@0Zj>Sshi$7DRly9BQ
z|JXCU@($PA?N1fn*4XM7a$3e~9buUN*~LyeUa$S!>?E#k#a*YmxdRUrtufyFX40JL
z&rjTPcqKc5@pY(T!$AqIJAAL!?wEJbB0=ex={~))zgKk>ws{?>S=rrx>5z?pYOnUg
zDF<$bvU{>T30)`r+qlexdE3IC2?rUbvDc}-yucVZW%G)r+<<w^6F1n$9CPiO&B$gf
zcKzFQZ5M$l`dUw(eVHC|n3YTJ;qnzC#$WYx7vIp4t2s4E$zS-lucc4$ktMDg555-I
zwTZ12@03_lXy&Qk@^@3maRb50KNoCC>`Q3goqz7}mqpv=zdrPDj+mdmdS=+|^D|e(
z6dW*4>os2*%NP-LXRX<?2XFId#x7g4dC!)4i90ywbbp&&v}k@p=chRb#E!FneRy3a
z?!d20U)4UoFTSzm#MQ9kze3XlE=)V7d`0__<(Z#Lu6eZ13t#E`G{Z~KHIikC@A++|
zYqAe@Ms%L4P`Q=A;6a5>$;JDxM5ayIT2Z&UIO3%N-`7O~8;UM_3x-xs>01=ZcjThd
zr4KjV*4?R!F!FR)4veVYuwt{u`8&3U+S4B&(G{<o(Rkvq!p!N}%&Q%89_(C|sL*oh
z($5A_6}h*(y)pqe8CcqXDd@NM%2%Gde6M}$)(56ROIy<T!-RcqUwN}2%~N9j%N++M
zJAD*-wKk@IqRI?OfA(oP(`G!JDK2{1^}Y6uz7M<>%S4|U%-+Mx&3fY8+J-w-ML%8@
zNbhh;5PevmYHP#(?Y)g$+?SuJjLSc!@F_*bF(>oaEO;V)`OIaR8o&MzQV$|+Ol|JY
zFiyPvI%Qd2_^!$|xe2f17!_?>Prk{XHbHI{vz0Zo-}`4}uBU<@d#-DZ|Kr;vxaRPV
zRb32x>+L4|Q~Dpv@NVz*k4r@M=ALA(cldc#_@M=hjLcbnqX~76e7buWKWsg*&#1~v
zX4Us^KN#3fs|xX-FP_%p#QA1{Q_CT#oi4qMUZ0LERNne0RzdHWtBvl&oo#Cm>^LU3
zj5*@c53%$26z8Z5$$Wf!W8E6h&8lk3?``z8Cw^%>?7xDsQ1-B6OV2)siyOaelGzpW
z?663Ks?aU1%?DSnt=s*^u;@a=#tTzkT^4&D^zUXD!<StB(2qGs@4mCx-)`)7X61d&
z@JBiGe_HH(|H<dY*E>f!*w^Lgq+j`7`<F|7?TPh9?_bGmWpImk?2tZWwEhF5;TfYf
zs*H>>S9hEZEjQ=NnIz8mkWopD)xx<pKdR5O;B|Fn?AceRB(3>^_yU~{*gvp#75w7F
z%bD=yOgMwIk<N-!_D)NxHZOR7Fl+k!f-;*o)+g)(`mX9IDkN0M2^e3DK6vlY`UH!m
zl8#@3`+v!8N^cNM_`FSeQ{{c-dsWg;_SP^JWD0-XyWC%Y-Gm(FId^mJeZIEO`Qn<k
zqZL^p4vMnDn|Kd#{(I86xP^1JShe@-ZAxnnOuD@|H$qFxq*tFMfn&Nk&nKy0F~4+z
z{4<|2GQ8lkne*`y%bxGHjPYj#JDJ-GV^pov=A?1-WICwuP6<1q!!j#O{HB15<@;{g
z{KIEL1(!FZr>8FX@^s~1gRaD*j8(PoCHcf=zjLhLA=tL+*A6G)Mf`8<?RC%TJYbi;
zZ{Xl!wBR&P8kgzH?_K8-It97DEnLs7d1giy_Xh*h>@dC%y=j@rX-^W~emwc{#m*hs
zY%(_vxxMiWJiL02VD{Xv^EtQvcog5`(|VHQU%9$k;VWSUUh6%pA2^Dz+V1eac<eLZ
zgPDcblWsI+@)W7*<Sxo>;cYp3_&~F`pUrl*c{ZCZKm2xJoV>-QYX4!@>jCF=wphLI
zET2&+e^2&LGOw$^75Br(Fa378V5eAk;IkyZ%z7E7tDCd_9(prDulww$e4CyJk}KF&
z<p!SQ)Ay==ccsB;qN?hrl1BM+&-S@alYYz?wfL36N<rZz`%*jJ6m=-;m`<y@GPO^Q
zLuFt7maj){cN_2j<WRD<lfAil`qZOxVJro52hOXX&`+p7VRB=`FAv$}rICu)+e#Y?
zBR5|?yHIa$MNMz=-<jpF)-%3-`7<`5rj_NW$OnUOGn0?#U749S^VbQpzE>xYy!|8P
zukq!-;@qP2hn?TK=Y7aj`>7=)&|&FR+Rr|FmzJ~X$A7o~K0aK2@!rGR+jqZ@b5;L+
zT>ZG+r_Bbvlh`+ynRtXL{;`+%nYVnwRO#*W<3+Zw=zb!+ZELwoY+N7nt!>+vb9<Ow
z5O~`><Nw_<$>)rhHg9ITyQ=HwHs9_`la_I$Sg^MC_0030_eA}Gz@*Lt%dgcsFUU|X
zX<THd!!WJG%)s%<`R2d}+rvYW_G^4vH2asi=l&!9%Z&^!oL8A8oiewDy+WO7a^bB;
z`=i?<ZkUw#-}Rfg%vblAgcb7(hkKLkHNHJNeDd|y{3VO(IDS`3TzB{qs5|Als?N2*
zs@}aHcI+3LBjl7&t8`Vxf!T46&a~FvBNbn^<aNDtJ*zQg(XEh^n(EW$6o{VRSf?1E
zBKc&8uID2Gg(u<~PaouH&y%!I6!w{`Y7)v+!192l_f_~3$MBAp3WnqS6IAo0&(|Jv
z=a6>UzQ}>)*AwwXTjer|{@VEyo&}2+yl|T-{6$PRrF_xvxCFHg*CV>~0+)PvH`_Q?
z>Lusm%^Uk<Dl)5!)fQb;``5UDgULg84!=vDKyid`ti>U-gWeemj{EL2eXjpJt8d3F
zm)X*cAt#jE;&pdM<SsQ0@(Wq<JkxRFY7v*fd_BfPA3W@s5{o)&Y#0{34w+Zme~f>#
z@1YOAkG9-q>i;`K@%O&!J>>-o*Z-T$JN=daj8I9Imgkng?8@)HPSLowtCsT)cVL21
z>z?epo$QATzPIn){^8JxwtIR8rW}W7D+u(9{=8?&$o=x09N$FEd*_|=(<?ItruJ7z
zzq;)t^kn0*J$&qER^)H_8PIUmyGQh8oZk`qFCKf2@au1!ZMbUvgEQ^t=0EQg)BMO0
zC{@wsb4YcfeEFT*aT0A@p0B=T-hNZoFLK{tVW!V>v31D;Jr7&vElk^|^3{9(w(Tzb
z(<H<zZHv7;I=Vy-ct#gol<EI{iJM{NQ5iNr9!LL+v#$p*oz8cXZ+mXY7b>!<dS3hw
zgWSSnUj&wXa;c9Dj?a*MymeVvy2gxXjZ@nb<8B(P?+VcloyPPl^dje%TWqJQ_?Wl7
z`Qb5x=}^@2lU9F>{e-VQ42g4i5uYw{c@IPBd9}~;+RAed9-ddnHsR_ay|9-blHT!N
z@?wsDsu}yXt)wXYxg6J-SppH3mUCx02v1<Kyqvr?U59_m$|INR3R#7lPj3kk(U*_8
zROt03Do$?MqCe7K-156WubMUW_UqT-;o*u}_MZ3WT)qBCYI|+dGnUsYR?8nM+`ez?
z#*bHzeO~+gVWsI@i@lY;vjVnMDNbgWkTPCy%E^8H-E(u+N~<jN_1PV+#J&DfcZu30
z6TZ($d;0ue@7SuWwtwPQ{rNKImp9i;;#0n=<*0o%`VjB^yaO-8I8wC)e=I+G>*h<*
zKmT{x#94n1oOdZ@q3@C1|E(JStk68J+z_J9u%taUanYd!G0j^qUMszgn!hrpS)EOB
zq5u5Sjb-YY;&;Q(huvFP)%P)G(T+zvcWYdx&IuLLk1yb4`En=Z+eM!@9|Z3B?>Sz+
zW4c)um!Y;w){7Ypb=E${TI&0*vbU5sr<)zTzjJ45#)re(vlYU5|F`Tp#Ju}^?dtip
ztCMXjw_Gf|VsUvEv%KG_eN{JSxk@pu;wx#-`S(0jFG6?z`Gn(4t;?0AuGM$MoDw<O
z6*qtDN7gwf&vZ_mv`-;(hSUZJr!Lb!^ZjrA<a+;)Rr18tNy{B4t@KUWAn@VQ;bIN3
zFILslUu{$hG`iIEtD5P(%0;d8q>gW`D-H-Aux_a7aanU}Vv&G(-nLz<4IaIWylrA6
zA$2)o@y6YU=WI@!a8_lTifx$7&Q*C2Y@a^uc(XOg_=wPE#feUpq8HiiO3pmmaFuz2
zZ^-5&*Z+%tWxSyq!I~((l`HWi@A=ZXORIj)D*1cmsC1-Y_|8{)B?S?_&n}qBeRx{C
zH*9y=;h?;di5|vxmrJLwaAIC}?5&>jujKaWFA7UO{5$;d_qt!RWB$L|_iMk-iv35w
zu7AJ!KmTq!&iA|=$G<yT{44nI%8%n|^RI$>>AULPSKo!7e)RA7clX$@^Yy!bvwr=*
zN$1_$UwqI0ZPIyHAJg)CzfO1cZvOAvFIx0lv;9wsd?G*Z&y~>suTv-PU+~ZTw9@@`
z?-%$vS?m=5X+QtZV?U0oV3WQ4&#wuX6n-(T<^NyJNvoI?0#~nIy-rKvj`J_6e@C>W
zuS7MZ#ILZf)NDTdUnoI}<({?rv>$tqvlULRjK8%xydpm8RP^ghx2wOMah~fmKZI?A
z(X(>}S(RRVEa5HcYg|Itgxz~O)!_S`f{yEFOeXJ=SMAW0a#r4L#duHjgH5?x$2WGV
zYv(f~j|;!wv1+o(_bGzm^0!@i4a(&U4&Au0_hogdnd4iwMn55Df!$l`ik3K5F7~tu
zdz^aZY9!<3{CAgLzK`HId%XYht37fP3=*$A|5IEW=CAhpe$C%M*^`1dY*o>1H<kbL
zgdu_DSKFfGk4KB6+-|rX6%SA8^xqzR<X~Tb`Hs659~oDFxp&8ZO<VP9+e=r?@BiO&
z%c4cLH1zl`7CxC7y|PzMo85@M8W^$j)$-_u>OL9czXkR|=O0M_eO+hOf4cZb(|?vm
zrnLf!g%@7mj4^)jSZ|qRxt!xQvtSOT7q(p=*_Ks5-gb1lr9|ci%YdJfSH3Y_`jyl;
z@9@IQ*WbTOy(K+2+{bFt?2?Sam-<_0yBhSaKmDaV@viuzgo}^dX1Pw%O;M;{{B>4L
zdbgNtQrm<JGW&PhD|fsS?0ui}VQpm0JmozLrMAa41u?JIxwMJv?>AQMGKV<r-E03^
z_FO#U*>bm0&P*l$eo2Duz8nAk%nkBZ4zL$1XOD8@cDrfy&xJG8PyFV`Ooh2KcxUg(
zV2-g+xtm?eeo8>D!NGFvzWWF6)$V9goOq<`h_scCr>^az-<u?6eVaRXe&4&Bx41LA
zwI1JF6SZ}YZBqHt{K@C{x#~@qUF)WQXnHd1j<l0nHaZd}SEjej*3#|diS>5OKexa*
zLGSMSBXgye8(q4}to{0;#@>CiFIZ<s#&|zE`Gfi5o08(+Ixcfl5--=+IvH(xu(4Kn
z_1i@s6nPGBezrEJ*wutDo-NDt)NWtD{yCC!0&4d5W(gm7dTZI9(rae=<y%!1r3|cJ
zwO`Ho`17{zv@DCRBl)w=Dz<*wwx{5wLrV00N7G*}?6Z!um2*^FWPW0NQN>kdZK!w7
zQE}@#Mz*C+hT)g4d1nijzV+LxSfycI;2xS-7qIlFr}*~5X4y@W0`9qKi)Fa={J*WK
z-Fju)L*Z)0zZaJY%G!xFmOVH;ck%kiwNH;dpD!qREANM$;l=B%JJJu>{O6E8A7ITY
z6J&SEr^d5f<io66EyW5`r$@G(R!@_05z=$AD>>4uobabZ^`=DB*XwaQKg?u~&6G-F
zsC^e#5Ycc?|3UP<r*5VhyV|=>e3s~){L}0k+k^T*sl$`=?3XW{aN2d_fsH@bifzdD
zi;bCoGS)Zj*0Q|#+%ImKJ6~?he4!%sFyDTGQFMj&5@v=YJ6|n6rtW*}+~4f3Ykuo3
z1ASDCmUo{EiIn&I_+4_QrMPpl@CCaC(WOpXY)?;e_<kUYVUvQ-z1w&9&gZ-L*8P3i
z{de-o#&&aCGAdiy?*E&qSNNsw|JQ@|Z=4jTed=Xyc<d*!K+f9c#H!jK;gvHEH63$*
zIjQSWx5mXR*(F)U+|NV9cP`Ic-e@5l(9i4RacFv3O7M&M?s7^`w{2XW#$5WQI{xZZ
z@jp-Q^x4<_DERPfYS{XJB^5nxr)Tp|IqUY1H{OopOZjdm_RTv&&Ky{qb;~?pH`l$J
zO~$6nuSiJFn7h;9=G1)4fGob)3~hbg^p64m`HtjUPbxoqF@LgrRney2*=Yqr|4#fn
zxcuVDnM<rp#BaxyIQd)1eo1&J@oV0rsf*0w(lc(qGg_qRs=ik6Bgd1T&w|XkbLM(!
z==vO-qjxn<zW2w5)x6c(f3&COx5w_UW)zTkz2eAhk<_q8FK*lDx%bvBzcy85!Ih-s
z1m5}+9|{;FRx~<p4P}y%t1M8t#QZ;I$%+Eu8rj&Vm)1HS43M(8W2AX6c<PqVHIJ9h
zoOHP9efvHBVuv3l`;W+K*+<88-HNYGZDe)-uHgRNZJ(0%rNXX%8kb6#uQH!fW7R$U
z<oB%?rH@bB_)gG^h!f&c;|q;>9B?_yh(CAAi~FU=^7L<?ekiK@b@!>rNfVkhnE6i3
z4ynqReo%Eq*Mt1oAI!Plnkei(vWN5I+}vx*<qcZNVv=$PAD@{fT&Vc{>$}%6m$FQ}
z*s@k^-BBxbX7S6Gx3gp=TB5HoJ^R2bl~8XKZ$I%=@GiOO_m*qvB`mLPdOD}w<_U9z
zYeR?7-hdn5_|H#xHRqa^Bx@Se*MkK;F&}n1DSSDW+U+7QYRuB_y;(?{B`~b-Rav7v
zlgh@8iIW!Z{n8+jtlushvZQmZ<iC`_?f$Rl>)iT$GWn|0XOBl=F+w{hq^;2_E6-o|
z;cETlzT*@6R5zaflI-~Kyq`-6=gz)V$+}l6rmG(Gan~}gy_g`I_4&T@t{10bH+0N&
zDJr~kUP9+uvWJgxpGf$J=asV6b-G^HBE;KPy-k*wv!sMmS~Ba=uO4>Iw%DZLthhT{
zc<mK0*_mdxEP0U^ZPqsPTzUQV8F_E6==rg{wk&b(n<cg2w`tT)z0e6C<2(2^GkBKm
zQFtZbn3i17|F_rn$&?v^%RjM%SAEl3a9BzIq(%N&At&#Pdn=bZ&o}+-yWh@8LT2Gq
z?k&p4-^D5>IzARsdZ&8#W9Q2?v$nr8)ydmF`J)M!bd^Ex=KLiqi>J?=G)KzJ|4;^J
z2UF?NZ7*#0C*S(^xM-cv+rsqYZG4+odwmy~_EN+{)nERl2E*G9EeF1PVUzwl%nNn3
zJGi}s?b3>i-Yy3pdpguiTM_5JNpEf5jinuIs*iNO@I^ceK0MXVB<JwTg9jN_EfT8{
z+VFL1N$Ij_JNa%J@Uooj2+A&P)#B56FAx+u;m^Y2)1uQKl&m-SvZ1+>^NC8-l|cU~
z&TPy1USEmuy}V&3clG@C-LKUA%jYEgRcm?bF*Ek@#V<Y|ZR(p6EN$bvvJ4*|P?wFo
zG(GgkbIqI1D`&X=PKlRUk^Szd3FFV6lz_9oIfDGo+?J<U-^Q*<^GKX*7&+_N%-lN%
zcVuY1+Q_*)o7uFLYqr|vSM3YG_S}|YP2-e`Y2H*YQIW-YTM=K?t4*!Bvow};H%^&;
zy}#-3!Z|t)DL?;e1jw8^_UYtf2Alq-rA^-@GDO0j2X3%X=x^2PTk%;VLQAT@aoOGV
zF&P|gQfWFZH*%((e*a>H+P=&sb97#;Gfm!6{Wr5q+E_mH$<dXw^;l$bmTtHew!re&
zMWz=LN1YBXn0GS5Gwp|3*d-<b-fFh`*pS1e>y{oq5Mh0YZ}XQOtZNw}<~~{A)z75<
z*ibUU=)vX14J#7@r6kyzqojg3pDdn~cUi>sl#kM}8C4<u$0Bp9K1YAs(c6D;*_n0q
z2Ri1+&R3eyDqdLfqO5%`_XEc1Gg5yPwA*hiYgk+#AAG>Qa=S^0UqPenr`BHmkPWx?
zO+WK6{eE-mo!672zc2T+I&E+GeL}VJj{`mIacK*bnyg-)jHo*Bl<(OKmRGW;A5@*X
zDl&K7(#vy_qW%W*{EpbiJGakW=DY)|QNiKrIlpeG?%{}ZZkPF?7+A7wuh+>dTnr|A
zb|)rZdvU+_>t5-|*JZbNKTONJ?dBA9!8xO%>yZ5`soVFzEqLp@MJyoE`uh#e#z=#l
z)U|7#2`f%a`SalA(|Z@$uPya?EP2*6uH_})kC);1_Z(1L_fY=vjz`CjemPoPBcCk#
z<K`bVv6?w&+v4r--#D=T!{(1q*T<XNeQ1^8Yn;AN%9?-f$0PS%z52XTifz?%=Ge{o
z4PRa~`P(aTn)7DJyi@DstMf`{3u~GfTX)uc*AMUZvJWpO`ZXV`nZ0jiw585#@5BI4
z)@363ACGR_#q@od`^SbCOWNiK>-5*H-=G>Yr)!IoTITI$NtSoTv-VWH`xp>sQ=Xt;
zohI)Z|3UHR)v(*UJm2wO-xz-^bQwp+ueCiV7mJD2^R@^2E@apBooRZ^`gClElJMm9
z+k6yVuB8aA;y=4AH)DlnPg<jv)ISZa%!-;LtrusxU#)+nVSBOtLh!ZiUfZ7iTxcQL
zVDNGUPsN@|?^-04YX3?Ztg||t_a!OH|54l3_IFnte|pz_eYEq<#jpj+(Weu6p0!G_
znk7~D=8NggHtRn2RR3gq>IzFqBT2EFQL*bzAKmU(yq~Yx>C?7(evdasIDbp>eRah_
zPceD=sjos#yV7qxe{I3_iD^Z}$31VSt(zvY*5~@&IX-vA8E)UG*|%LnB53te$G7k9
z-PB)H!vEs>y}Jh_rtnw^%E$$;=-jt`wbJH`n@zJt-2B(NmxPGkT)O;G)wD~wqSuuF
z?CH78DcQc*x8m~A;wZJq=QXFD%WeDi|9bZG+V%6z^ZO6y|GUKfxTx%IgJHvCZZTi!
zAffnWo)x0$$zNh?H}3m*_1CrQub=-6ox1*`TI6KzvfK$_l7DvlEqGdH-Wbr4_1pbD
z|MzeG{rvaccfbE$XJv8o|I?$z3!F1b9vFT5G{Mz?EtxO!5#xk)oVEN#fsc6kA|Ef}
z<kEWNu}yy>*XFzcO;Z<TmL0#cOMh*-`*81M{`cSi8ZX~`ZO{MMGt!D~8B-@D`lWxd
z{O_EWlrL~`VphlD<n|B0`wle6i>;i#MDFGD#LmLYJC$#3nL1CSZfcbVi_FAR9Fy+_
zJculO*|KAjtNzXT=cf1`Ib##UD;cm|Sa*Jd+M4x7C#Hq!2p?BY+9s8l_oQNp6UQre
zt!<OLuJ+b%3VE;~zH3sLK+M<Uf%mQKG}b)0zTt1=q7I()7us&>$38eSJN7)53R(Ni
z`uvZ^?HlW_<va@d9rWAr$Cm3E%mJ&T;*Y=G`S0?-ciO9c*6+WwV)-J8YYw4mca!bq
z@0)(P7GC}2hoHpCmddB@J^j%U{sya9WM=nE#6<GnDOk~aaq9H5{O3O0n*a9W#c&A)
zFUE4-cYAmESRVN&dzs_Fwe@X@Mioai*gwAC*jIE<;^Bku&)Cyj-k$%)@lw0(>E1K%
z<Q~Z~7e`NUwh9ipvuTd$@4YW|a`r9IaJ%;CSMQS*Ydy{`k?GcGdf7Mk9rKg*_p^4-
zoS;2b%jJmRJymaG-^?j17g?RTx|OjbEHc$q;gLaK=2vsh#k{feZ7*#)sI_Uw^Pr3w
z9f41KM71a6X2dF(1#n*ty}N*qo7wQlBr)HdTb<{Mj_HbUUj6hU!smx%o#{=xcRV+r
zOw!!na^0CbsU$h!?Mz{15$4csJ5^iGx3iqAc0DkmdTrCE8O@)*txWfuXnp97`B(Mn
zPgUFPGd3vM%fH`SEBbfO|9Lz4?bNcZ{8n^{xYn9<-kHRd`6s(?!KF1^8(zF@3*`K;
z{e9V<v+JXSL|ui8Pcgdh{Moc&Sz_*?&i1RfH)@uawu-)+xAelT8o__2cRnl?6SgoC
zoOH%ZH9V|f%5nDg_lqVU-tYeY``sI|t@1TK^S=J$@O!-Ve);u(pWj6CFTJ5IaeAgO
zm!Z9)vytZMGO>AHDgkPL-IcgzzJB)iV)W7W8w(d(%kZ9FCo#cAq+oV{NYAC1=QbZx
zJnH6XPkQK?G5^fD$BhoY!J4{#-mAN`R_zxo)>XFBaF!Ik-uOs8ymx{0#ifT+U+iU^
zZ2mMs^k7>5qvx~S_q`4{AN|&~FS@+z@|79$1#(XsmemA&J13WM_|^S8RR_;on{T(h
z|MAvjMyV%<Q{OxKwdctEUOUV4y<5|szvs3e^jX!uBXmowmdc+z<?=iuDZlhpJ5I5S
zE@F3HTymKG@T(_3;;)?i=xk*v_+QCq+uXPB4m{bvV)Enml23{2?D}6lQ4K2owxUyS
z`uoUl=iTow{b*d}abDo1-*KNhnf}W{4{R2kX*;;}B-_I&kIKGV)_jkg|LgwK>EB$K
z7$j}lF1rY(bj|Eq-hTKRL-dh@PcAk6n0^29%ti6Fwri$Ityv;dT;e!?iGuY^H@2jf
zK!&9AwePPSH?#cBY&}JKO>p{yt=`9Xmd`c)5$rD8wJA^Qpp0dJnAS|5cg(Bn?ytQY
z{W9yc$tIl=)@|wY_eunOHs|Rx5WFdo9KE=dF|4IoI<o2Wk06i3`&$lG1Z8qJm_2-`
z(AZTxLCob%c&FL2!daeA&(2t6w`GpS+IvYR3Z-klYMM=mlYW&Ia(Akm)_i`Qk2PX3
zha9)3-r#>4S$Tg~-VsN24L<8{cl%^}X5MmQyCPulxA&FManAqq@^YgWF1Verf3NhL
zCleF)?~u;<=CQ%LyjgU=t<amt3-a#qe%-xWeNC0jmHhYf*8g63OD-`sdF#@q2CgrX
zZBajZbBwk;GGDqrH~Fiy(_5z|wfDE|)+tNvoxYsa{Mu#psXF@?WKVf<?B)D(6N9(e
zEZBNqG4F_R`sYoVONHm$uQJ$uP3g+Ah0Ed&)i{2;Z!_1^a__l2E({S}`%^1L?|zj%
zzuoE2F}vofIo~?_U%fx~@^H%X{ic1kcjxTtIij@7<@VMMyVuNd&52}wbKCyqd{Gg;
zQav-#xl(n@FITPdtdb1R%#56~%CV~c#r*mSmts_&o|^0@P-6JHx8dL8qtE3(eU_iQ
zdimUdlRm3I=|2Azt37XzMe57;fTHdvvl!paxUXmUI`7cZSGw=tTW8gMd@<|$g=gmt
z*Vx}Y^z5(h9pBBl$)}HR`|#HG$KJ^{{w<p<DpcDh&k$AC$_RUqvWAK8_wKp9AAWML
zJg7K3qt8b*yndxk%KVB5y*nQ)%pJLA7b#eLD=nD#G(2m6;U;!Y`S@uECi}Xc|GabG
z`lf9Ai5s7;cZrm&>nX9_(;6%(J6W%_Tf#EzYP96^$U{FJk8V~<&N&nFcwy_#mkHP9
z*lz_dXTAMZL;JS+uhm!69(c1Xm1&yXq#v|rEkkSjt_@m>o*s#RY;6x&yv~vRd)Q^s
z;WW)4VGWh9cLewKrmxCcd8T@;UX-At<XI7xkb|!tH_zZJnUHZv^xRDsmE^aYdlMe*
zP@bzDnVKIoWsQK*oz#c_?d2z@EB^U!U-R1Ht<`;vZ^9*)9%}d<N{k6>>@N{wv}oV$
zvb1#1Y_=-fso#&D3wIBEVePax;giX^pha_z8s7Zyxxl!_kFWWbSJbj)i!$C<h8?Z)
zo+8S@C-=14af#N3gNB;dx_54$uKtL9!q;<}siw;!>*ezPq~^X}Z=3Oa_6O~%%^$B`
zYZE`irFho%>Z{7he!-vYldrCgvo<}G>Uf<k+_HPhi-!sphSF&lE`IJ2T=H1yOWncR
zT2-6OmH!^!o40-E#*5p_&N3{S%gx2Bt}Q)#@}@&fH@2Ua5W6k<+c&^1&E}Z*shfu`
zrl!Wm%+gGKuIfDPVWpNH>+(bAmVBJBd!N5WwtU>rf?xX{TJ~4>sMSck*r)QI&u4C{
z*Vi7td`qvci{a-d%?LWBYRR7Rw4?fEhTif?Z?7Aet=qLQyjUWAiqwWRE^}5iyx-3u
ze{4?2%Q>I)k`Bw9^XKX@(wzMC{|Qsk@(Y5ib_Ik59{hg4?xE?wc@_UPyK3HQ`7+d~
z9jg(xKl!=4(c(CRd`{nbretA>_VvGJ+&I8ze31LF=I8eBhFeaFJbBEu+-=tE?&)!>
zlR32IKkaS561jr)mzDc>wmB;!V;G~S6;6oqlW3j4<&?7in>L^8_G;#{|E|5AR@}OE
zi#V^u$?kQfE(c!noR(xb8k^(r!uInV`@2%2X3a5Ip3T~`@<zn(*Efw<{l8q}wvVs3
z>}8aL)_>pE_sye^TOPNnWbfMhE&h4TfmKfXZ2naK|I6Qg{P(MUE0mgr(k<J3L_4LT
zw!2TweX-~a`^U9=>~Fl#EMwZ7dgRTe)|C@8I$vLT<H8coKKX}C#;t2^J2px(bvBkx
zSpP_1uKt&A|NaVHcvVr?9jsel!@u9`L3sYx`Q`zo3j@<D++HaMN>1LLxk>uk<jm8%
z{_!a<x;Y`)*(#E)IoN(?Y|nKWVHuO+A8)Vz;}>L;=)6}~QC!pz=6JUI^E>;Q4rlXT
zJjkd&IcrAl*;PNY{y#65zqhCGY8T^d6L*b`=i4kAgU{S%{$i2wQvPAJa&UCCeuwk&
zKT(%V!k0z7vi#HbcX=AmvJ_ciF)ao+zEo+=+&@=lu&44*H;Z94FmBrPEkC}(F?-*t
zv^%N=zCT`<MlKM&)BSwX#xiFYze{fp>0aTCmE^SI-6pp1%&B`j1(tq4D_i^i%u<o-
zw@&m$uv}UZ)p_&6O~Z9dgkz@qxo)0)V|iM5YR=4cd1X(Wf)2FZe*MpgIf^}QV^q3w
zOKHf#^N$|7_HZtpyU*~PVQ|3aYNPnShc9$Yy~B2@*k|9JhTKW_>;-I!?0)9_m9Y?3
zaLV%*%GkX&@ZX2FPl`+DFaN;yI;HH2+|-);5e-vHUj}wOt`vyXU8$cJJ;VCl`CcA{
z5>xl}cekB#{Pp1&Tc+?Ig<R)((+~9a$??dT$#OCGhAL=fFZMhe(PG4KOyJb(HC%d+
zn;yklUYocrEhx%!m*e+_%83a+pBPv<&qse1_IR?=E1`prZ_bPlciXp5G)cH?|4q#>
z`dHNw`{aMEP74wZWlx{bn>b^QOwhcH;1m@vqgCNAN*t{1O13<c4pxht^CnP4$RsK-
zKW|_8Q{N-|ug$!BjCWR2MB8qm7m>fGI9**8`uX;{#r?~s<&@RCF&AulQOb34@|l|4
z!wXa<O?lh&#pD#X-RHcN`+2{Ej&JV#xis+A$J={L*)^4CnYKNUyD#f@X?@}}@4hPb
zihV*ea!+q+)GN(f7=FaiG;49G$Gj`fKHrbE_s)(z`&Q|>!DY=&haaw)X1yR)dv61O
z2H#9I=d5LC)!!PW-#pIxC;C;jq5G93-nU=>{wEjpb!x|n=^;JLM}uXKSb4W}En1hu
z9B=gC!f(dCXH!H|G@h_eejL}U;uh_auve|v;zGCPnuhy<I_nnP`7uX1Xv4;^7l$qF
zo@F*j1~G8%$YEEVskrFWkEsvRc|OUBb2h2|i+rvi{`_NV*QcJujtP=yPFC={_|FWP
zYV%y9g}KAnhJjV?^2QSn_AdN1bMm|wd2Lbebbl)Bl3(%KwtGRDfq2mh>rd=bYDq8l
zANc=6F!F6_wzYv;*^m3{nnEV&d|RXzk$HUifkH*`1))p0FT9+PYm~`-bACYa8P5kN
zS87d(%(<&}YwOcV+2PZ?>}u!lbH0AFZ1OqR-k&F4xczoqZ6=vI>-_TD&!khQZ+Lj>
zFt>}xEzdyBw8k>211mIgp7pcsf8Fr)S)b8w&2wAi&a=qYa(=Z8U*97;Nj#^yU0ZJU
z$FG@=Wr`h|85iwTuT;O9;;b(g;kjv1UFy=}pSF#x_Kt$0feV;Krj&Zct(H+2*+1cy
z|I?RqALNFwyW~>c_-*dW;~Tzct~W@HSlqLEc6`3=|FrDY-_4iryq|R@cw&&lv=Sk4
z2icTkUSB4$ep2#?X6}f5y5REaV-Jj;ReQ|6mKTzq^R4HIqP|5`q~7e^*Tr)zX0PSH
zu2yKauF*EW-P18^uUX9G#j%GkHhr;Pw>(SN)Iq;Qa@D$^5(m~dzAUFo81}nVbBP?e
zzTM2s{JQzP_4&11*A>~U6AU}Ws=NMR#`Sd%mPoB{jM#E6T4k5h!aXbxo6bDm+kf@=
zn`Fh>>WfuItBk)q?KLo;y!yO^=)ae}q5sRio_X&X+G^OeNYC{`C&Rz}7HZZtSBg?s
z$F8}RJC{|yCzQ7!%rtfVhwxrwDY+76fw^7@x6ZZBw(t@beiIeEL4K08#hVLxbtl_?
z`pB+(wZ7K(4MXhPhLhe&@_dUVRU^N=VJle{zjnUQC#mn^Nz<Ko_$IGZ+rNIZ^;&cP
zy}IvbKI({35q6qi8tQn)VeP}cCl=oM`n`8T@eUuB^tp-K<~v_CWzT9nq&V5n-m#AH
z`)`Jq3Rl?FqMvQ=wEVy3l+3LdZG$Zfm}PB^9jbL-+Q>z07yKqWy+Tr>e#7phwaHIe
zxAFXFw@y6%d3yB0AHC*#KU<wW6K(!yXWXY7m;YZ=UBA6t_{#Kq*A~4ENN<|veJEuK
zf4X?ux_3Ig6|ZNV`&w!|pWD3SNLY4AEXPxZtDkm;&eA`4QtYnMS}Xr;tFGH7d2&pg
zdS&h_y^}u{cB@YG2tVVpk-O`O{+g5B0iJU`V#URBb&o&0-=v!H;o?@kCkgM>+HKs@
zS?}EBE}y(b?9i<3Hy2;MpjMK#pgee2`@~(ppKnSQ6PqB_d?d9$Bz14j4As?*?gF~p
zQk#Fgn5GgL`z0;O<H!8B%R*<~wp{w0(QK}f@SIr}V~THdW>+drPhZuj(!XRu(`u^;
zeVf%E3dUdZe7uG8=s_2?-Pv_h`P7o)`*L^f*K3&m{iGkm()kZf_6httewuZ<;F8x)
z<q5f7>dY^;7k8QLDK}g+XFvPZ%Y|nf!!P<@EMNOB<!JInlg-&Y4P|`gdrkfI_9<x{
zjY!t{`c<Lg{^pCR%yzHBqcnEzU9YS4eB0Hlg`Df|3eJuwQA^yg#UW_rv4l{OMMsnC
zUv&Kx_uJ0%T>Pa3+wCw(F2V4dC-Y3&rdpgYZw`2_`|rh#)*s)GSa)5NXW-*qwo&b1
z)k>W|wR4pJEC2m&pI5Ua?VtOP#9+(sr!Foz?zrow$vPIV6S)(cy0w(v-fp;e(tVTE
z;nm)|=P5~fbj~+Q4NrJcvHjSWk4tR~?Dm-`D)j8jc~oZ6IFqO9%`uJF8xyB+ZN9Eq
zdPCXls-OAx>)X!FV?4Fy*{t^a!tY&t4C{IfxM%R%J-M?}Z?V_n-H*4eTxE7;&IhYW
zt60D9DJwl(<+(k~R^(N+;B1#b!9zW3Zmne4)>FT-=%!cfop&;SUZu^Rb>IT$W4nYG
zUF`mE&*`SwEK}WNqWph}hvkZ$E_-JRE{!;5a#X7>tF-UY$0R342H!P2eRY1<8MLI0
zWA`oc5^YTOdTd?tly?@pY}xVaw%f$6ayS~jnrHj;|EY{E{AmIoPFF3^sF=LT;Ov{P
zw{uH_;$NHW=>AnzD4O^|LGs-9`$vA%a~uBa+^lrb=t7T8$<J%69~Cxh1y7KQV^`7J
zsXTF#X3w_CO25sd{{64z&}e60cg6GZ?gbZRT*c1(zpBoCY39<tX;bv)RL4F)z29Hw
z&+q^LI$h1yCq)Jxv}&>9oAT~(H}AO%u?G#KEY`8R|GBj>azS(BgCin=!nex~Ssprc
zm|OeDt;5{w*Zy`{rfy;)x6E_9w(fr0LfOgO3{fk>ezrR3Z`Aj`|2xR+j9Jzs1&LRT
zYm;q!YhK1oiNCk~y!f&2m&|<q_o`Qv+cf1>_+PhAyCKf$6o31+^?Fa4FRlkp)GN8K
z^<{l<eeHU-)?at~XWn0Nf_aB`N7&PtmscYvFWLTZ>it)_&A$|Q-`ZUbdB0yLRz>Gt
z=&of>3A>Zr+haCe&Aa>CDA6KIEpfiC{zmK5{x8+`Ue!MxYLilYX5pc>l~b-?e3iF;
zr|a~m>hJF@I=x|b|Ba0iz5anL+PmLqrn1}T<@}QIxytv*f2Pn%C2_84vYzgX?wcLl
zFg<d0^}9z0mo^-{UUl~G>FT|c6;?Y7HL^|LJMZd(IVM(p?{<7pn6J3Rdd+w33+j2C
zi<jzIIVap=Uwv2b%Ex(^1n*cEbKR3H+aS!fwd~q0Gq25=)8FeZc|MnAE-&8~p*PQ5
zHLv+e%;H|3)Nqpj!j6brtS2fqufHkzdhU)(rDs<Q@Vi>*y$)je=B4_NadP|Ce)cK$
zW{39M@SFeLclGrDHsMGARPQ+MHk0$Ro^DnDf+hEDS?T%WpEH7e<)i1aEUdhBr}o6h
z>+dGN>kB>?cz;#Vq?m2i5AL*Sd8HX9FsN4a+`D^uRj%f|+bwZ3=gLf4;NfTKxaV8-
z{oAp>&+ps5@!NGfHr4po58vu%cj<c0l3gen+b!~X$&WJY=NkLwSL~i_G~IXdgX4V8
zK{f0b{XgB4kH0m?^|t(x{1ZV3zu%UBxc<A&kGkiNkH3%qb|ZMwq<YV6hb_`u^yb`<
zYpAtrEUbSy_47-G`4$2HKSb3x?D^h1ZU0{;sXED;`Y&spj+ZabzGbOlReh~`Wp(qr
zB(HY@Hwz{e-;2C!b6cAs?gZ<UMUz)N+F|v-t?j4La>)~W9-Evl@rh(lKmGmRi)hV;
z`tKhfdvCx0VNv>5o6A`pyW1B?H+W|4RyN%+ul;=PhmZFEDsFDJD*ONCP}p3bM~4oZ
zOcR;=$N$WC_bW?GPOsQ`)pp0?S}xJ)3%kwE-reBFyoT|O(Z>(_{v7A^Td=x5LvP>h
zYVrA3TdS|#-(P;*zOwv9Gvl__XAeHUaX4wapylI{+giTsL=&DgZu<Is=apKC_4!HC
zmW_c^oFd%Js-A3JduWn~Ib(Q_TC?Qz$A@m!fBF_?elop2eR6r+!)?DmTj~|wp7A4R
z^|SewuZx&JG+sE!r@7B9%6)URy|;ZsaCFeO++_ugKepVt$}+h%{LR0zrJGpza(x8D
z0?!zH`!X}>`(EuY%O5wG@@TE}wB?Y{S-oWyXG7=bYE~bOtqe-6m0wqPh|X{OnX~Wj
z$=wY?$+B&YX?#cfInx(SSfwe(t9N7%PY*MXB;WEo(e7Fb6SI^mW34}R^ge7$+qO9O
zdKlk-HJ!udS)8+viM(BV;U3?n{r`l$uUyh<+;-;X&T6-R+4tI*mMY(RwZS$ovHnQ-
zy;r?!x9*O8$~paam|AJfQpYuBdVCcIT7RG4<=UXv=<;{#)Lk;C6(-0>T^IdSTm9wx
zxe3{hu3h&;zjGvUF1xz4j=OC3hm5Kp5r;P4+4{_WBA>3EoVBZ7-AX>atCh;z%=sB(
zf5)x5zG7F$ubb76?q7Lduk`h`!F!`C{;xUZ9N6A6zu!NX=bp*6r*D}(li1C~UU*%(
z|DWxa$4_D1O%Y-JdnA7QsLf<@)>r785*-@bdu?B##O3zDYkpz(E+$MeaXYBn5gTTE
zBhda=oZ32pr`G%YyH-rJZgj~n+Y{JvZdHU|?&oFp>eu%6&y-`_b}?1Rll@Th+=hd5
zPp}5R>yZBFTDf}0xd)8K_aD3FbLW5eVt@OW-&<wXGKtH)bqm!#?YEk=SaQy(M+UFM
z|0z$f=337c;n5Q&_xib`USsIS%@TVrgmUlYaDA5NkYs;ULB7XOZlX|sXOqiI4X;ZV
zJr-P6=-V0EbJl0t&3V=B@8jI7FJAop*IYjC?c}L#`~Q_3t$y|PTBx7puSZ_(ZI2C4
zWr)ipDjnIh-r~{}kDwQ)Wtb20o`0O9<26^L#z}JF-sP{gwavF{Yp;0nXxsg_a{EhX
z|G)jo_kZroX**rJoabD*9BI;HG0A1Z<B|t@_JY^19!%W+(CqRuvCLOGXExtCXrX9$
z>QT|I16DOs{M|N5_2=6-qm&JqoBKZOJIl*(ZpreHm5VgqZMiBbwy(CGaYIz8m8mw%
z)4-b_?}#oElKSC)Nif#)PR^aWGha*(9b4;HnV|6foz?00`59qH9%sIJdh>!=#3Ko<
zBYz~%PHUCiquaf_S>>CAzw#cpod@r4uW3&*;hQp#Ni8kaasC_CTNnRL_uk5X`quN+
zQ})ly-dA*Dd*!4FuXl?vd1z183{t30vDn4Ur`oX6xM|_hPmz0O6|1jae_F5V+n3<`
zbAE1!-rD9o_pN2=`z<~bQuS`XX}{c1f4E{#DEAAdu*=8S9P}xj%}~nxsC$#y9KPGF
z4NBV=GkUz|lPM_?)OCz{5MACh_tk3tO9_qV3b{6E^xp6BaD2`jP-gKc<7CX2cel=7
zdbDwG_glvw{tc78-Q|53WvMk)SllkT@X4%R;B0i;tAqRZE9Gy~2)O>~i+_3OCbnNU
zlLUDDA56(BVw?0>IjzB;sk(Lh$G@vr*B!M#Iq_~xPWANV(&>Aw8@Dd(T$=0t{YUDI
zq#%t68gp)O7#umtF++Kg-<QmE_Z^GNFD%`+@r=g0l>4fYKdzT<I@$SVck;{V8`t*K
zvga=>yk0(WUD!pXwj%~VB6ex-6iDrLu{QdabKHQ1^N&yaM;7MrB(3#Y>r>^jZV4)s
zC2o*;I;TT#-pm6W>V=IvlRFJ3Xf7*_Plzk=XgaE+tQIfr(N?he{u7n2%h!sPO6Lkm
zpZmGrJ^Ita!~YJy>KENTW9F&r20O|tze;^&;a$vXEj7C>@$H8o_lFnmw#vuuD$$5a
z7s>W5?y_l~@yJ^CEOX49+w;zBF_`sWZRN3B>YdKFkM<iIzHrd{^1eFB>SFG!O>M;m
z7f!a^`DpPZ?@+koCWdyM`IoOuW;EaX?B`;M6<XVvj@xSKX&w?<ldbnD=zHMP$H!ik
z^q#XfD3j)GnKyTxmo(37g98`8uS~c-<E@DOsynm${5mf_u>ANWxbHRBi7lL+Z*<h9
zH_yu5ni=J2t!Qgm<+baCqkF3A?&aKXbyZ$y=yg?`o95PNvi*^WMeVnnJw4l($MJ1x
z*&S;)yX`E)hRh_-aK8`tIzQFkDlvS~XQsL?#VFy%giwoz&T2v*j3yilD*LF)<f1#_
z&a#gzoJ#`)7w5g0e_PFZp|SAqUgLwWR-~@Gw(>+);?H$~(d)LyK7N}r`OUtVti^I%
zT*n?B$k4O+;dlRiB;(E7#y2C@ie>!T-uyww;lrvUFIIKlO6fVC>01=TE-T@-D2~lx
zQ`NFx3fAfC%fEJp?>RMFaJt|$o(tv5kGA$%&zjS?X!1VsS_Vn3zI(a+^V5FjeB9N(
zNKf$2b2G0+H8pQGZ@g>K+I)KRtS=U`c=Mbj@6<|JEpT)C^-toXo|Wa|cMHvqI5@3~
zdu#h<t)LqVd&}0-PK?EW7Tw+V!Ta34KE@RZS8A`geg3(cX=wzDEH@`#YqE0GMa?Wj
z1`S)jw(Ba<HiA=p?%I~uJe|_2;chCG-g-!Ie(B5q94(=|OUf$_a~R#S_{x`HvAOKh
zoULn8nz<}=1d2WgRlC;Ni1bM?Pf2V}v354)Q2yD$Ve4;ZQ*fZp=6sRdk~P<Cs-vFs
zP2HraqPFY)#fA5Mw>K6)y?o;2`P%oE*J}IwdRJ&HE9wjVlR9DkK8-xh*BpN@8QFfF
zV(pXrwaQKDt=-R{+e}wkHW!>b@a%_p`7ho=zOwW37vir*?#vMEiJ9nAK5NZ{s3@bK
zQ{tx7yqRAr-yl?x-TPT{$0Co5Jd;nn`r%dXVjm%}qA0p(LdB_Wm7uTUDmxEm2pJhQ
z8C%Y|Tl;3t5&hZf8!w+YbU^;ZspXNnJ-p^(>b>?iKlhcc<G;24?B%;39`Cxvq?vog
z?qS2G*>YJ=E$*d9&eNZJ*ir5D%G`6WcAM_|VLtcC;|X~anCj=JZ4q7RbN+)_PV9N9
zS?3!cHa^W?VI{F5?&IBcKJP;s0)D>f@m#l2(nr(vvHRV?ONA3YbQZK}a#vim<QC{M
zd1v+_c&d2UsaxlZY}c(@SEs?68X?H(x>s$b@7I<oQkqW#8?P(d_<q&y3SR1B`qSvi
z(Jyz)?^j;0%|CaM<>`V;MyDn(;V)5=?oKFnewV8wec@x>-DD?;Gf$U4C|UeI_v_y0
zweMZ;|7JT@z;)<ec<p=r+V`*beGm5x3C(KavJ0ERzedRAHHR)ABd1oG!vY<Z*;)1v
zFEp=WUu%7T`-_Tc_n(LaPWa4`Je74V@15t?&C|48?pbd=cVtu3)$|o&Qw_axe|&YG
z)wrN%KjZI`<9E4I@3ES!Uwz!^EzjC>g;(sgPb~L;nY3rhqt%;p{-*g<IxV_CT~M_5
z&Y^#NGC7g!9M$Yr9ACQqMEXKCfnEASUqhogWt9JgCL~X?Qw{Rn<(g@G;K{-j#(Qq8
z@IH0^vG3)Nm93TOAzJ-a%ZzV75w^1^zb`AFu&VUS`30wYH=RnK@}$K^FErptkm@@I
zzW(=f*9h<MH@~qZVnct2{}u-YS+VE3AANcrZeeavY~)#DYO9@_+I>gz=^ma+*H)>W
z5;;Nt__8gc3<ONr9{nl!B*jtpco{>6m<-p2B{wZDy7WALIOkjc9V6>6_wBytxBt6+
zz48Cc`TP2w`Tzg&m221Md52zm1ROYfEwZaq&_QVG_3kxWU+-y9nS3K-$`orAU!93n
z5Bz(X|EpX|^D|>|npC{Avckv6DAURN&f-2bk^2u4r$5zrf2qIV|J{fG?7w}VmT<?-
zuFYO-%bSxLKiPIy?kaT4x!q8<=Zj>RoM+A2a@{u5qs+Xy>8D%k{{_ZPd&zJ_vMcQ6
z&6&zJGZRi7SfXR5^=`$AHy6&EaBbas@v`OIS0XWc8a<;JB00^C-X2rT+->x&Eo^Co
z+Jx|lLi39H7gc08{|P#=w#C{~&*G%~o0CCpCLt;e?_2g(^we$Nuk?Afu|Ds`^6om}
z&kSF)g5D;tJz%-<31611{WrZ|!OJJ?O|k!;n37Qc&iJImzdP=e|NNFwzjF8mzwmVS
zfZ6WBl17r9b3~11gf9xoPU)Q7;^<JRb-2BmL*%mmQL9Xe>&DxYxfk?X`Oj;0v?|&Y
z7}ObN!up=!V*2NeMaQQ{RqRi9J*sCnN%E5I^p?D2eunmoGu}(<AISE+|7^0HyYro9
zxlY%^+gI22J>1=E%W!8ei>`dX>m}C<%a$5`ck1*|sr$b<Ct&HrpGzGiC0p}Uo`x;|
zaiZh&rem8~uF8AHsNB<WT|cvC?sIl#t71JXpRDD@f=Y?yQH2s~^v-!)Vk_TV=C$>@
zvv;P4yN43nSBnqV&&)UN4(ps)&-`M~-EVexcTAM2-acQT)tuw^w$e49c=%rWO$rly
zn=_f4(=Nl-^lf&G#iUx%Z{msj*4(-Ov%O@G#JyR)ZO?tbe|Vbs#c+3HeV%>VTepqV
z&GfIX>62e*_2+Wr-r~87O-?<#c%if=!8z#9)gYyZfmeSnTp63C|77wHrfZr<YuJC7
zR(<Hq-qW-AO81K^OJ`4gWSzOGICJh<FUPaX1C|tCyPFvLE_B7!3v>Q7?z#S}=!$B-
zM4#!AuBbV=Unlx)X**{VzVk-VOBXk1bE(2Ng0D4=zjx1BwJgslR>a0*_3k&*wV0*b
zras(~ed&O?@9k?l^Z3m6I^GgoG^f?UJNDMbOyeR+%>_MeGZ+<;tfV}|wmAOVv1H$e
z35BQU9J%Lq`i9A#iboqe9Nw<jGBI=6;w+0-?*E@2+`X7z{h;PjjyJXb2am_e?Y(JR
z@jdVRTRZ!I8>;u5_g^E^lDmcD*2DJ6W)>AcUp?5ns<-UnombxRY`$U4*JgwzJMhIU
z^HQ)&;@zgSA#g)aYJ=`JuL+*zKFcDVR^2>Tbn13=(4wX5S6M6zmfgJnLfaHpPJwfU
z4$locxXnZ6x~NC2cHU#ZU8j8M{YJk(56W*cpV%PSGbgy$WX6a0dwjPi^R`49cL+_L
z>8R~`Q7K2a)i6Y)JmKxU+Rq$sGN<z`v-9ql{^PlI<}95((Z^%5dmRnGMWwi;-}K&l
zW{<W-^Vby1C0<K!2U!1<%W6F;@3(%NOw-b536IzKpDlk}f4b%7?VymXi*=WK1rJ{}
zmA4Sx(^skYf{k~*%1ds=9XbAf<sS@^YqGwt-Jh`WdsSPGL1m@D-Gs@j&ih)3aQ;~y
z)F*bRvE@U-DZi@1<6UV-{+^G$#5Mna^R+F9zC4e)lJ)n}s%h6}`LaFy{E=mCwg1s3
z+1F;Nc6>WkesqPV=hSQVDqk>bT;Kd*?Vd1ohgFBXmwG9$-D%``;)v+&?#lI=dZ$;+
z^ZBxN&)tHPR{cQ%$KHEL8cv(2Cr~KhKh3K__UcEI8K2giKDkIU#kjA}P=P;o!bcYK
z^bHCtdDVp{Pd?&(a9hJ;6Q0m04WEmtW(Sp0<9)*8bBZpc8yn56l-XLpqJ7J(8m^?b
z!JQo|_qbR;obzr;vHZq{mAr2*O<Kc!S@HOriEN6yHeV^W>{@un$Na%bCdSD>s`ywu
z4@rFdXw!D#x90vs?>96(Gj8nmek*h)-TlkN)<~~4T)gK$&swLLA^bGR#BsC8%xA5o
zhe8D}@4oQ6b#nL><3mCR5ADgG(#rWh>_$vSi;z$CIq4!l#iGXMqZ{mUzBImY$nNj1
z(EGU5NT>Jmt37f7eyV=@TkYnae>Nw6RZRWAq|e!V|GaEZ6_xgR&waOgCC~Cxmsj?M
zXFn~@l(ars(R$#glHt*LTY}EStP;5@yXMy<rRGH(R=2-ye7a%PjS{cF7cvV2VkSQ|
z+Q*=ECeiVRMu*Shqjx5R++qIVbm^wU{Ij*MU8YGalnT7aG5zs>#kra(t8IgLR_N_`
z#ki?*_ZyqK2`i(QJl)oR|Jcuxn_LQ+8y5Sh>gh{|HM_Yu+L+j=%y==QG;zn&XDeBi
z9Zx%d-Fw)+X;-5fAJ3JmdwiF09Jqg?sj^s*$5>?XBxB>F0uL&3TXwxQbAMy=DD0|Y
z*UQVibq^dT?!6Hm+h-pi>ef;*OF!Xic(n1No%{PV1KAr))qib>HPKvkAa=9T!!rNw
zKR-Gu1AVn8|37bKEagAHJWJ>NiBN5xC&KyD*;cGz)ehiZsLXxLmrZ%gt9c%)?7B{`
z5?v7SNV`P*(9@?%W%}lq>nmUSRnPW$UOpl7&*FoJnKoEufAl>oJT+&r&hw9M(^Vty
zyvuT|os!s>8j(C*$#i<ts;ZYq{x8|y{oZHJ(~i{G{=$FzlAQkPJ~=#NhKWST&Ixn3
zPvVVjOD?s%ve)TBRj2O0-oQJLLKAy0YYNR4Ju#8-<eKm_<+91IUtT<6A=Q=t>Dms3
zO)IA~3tI?9{b)V1Ch-23n@K;Gx^6MmF5?%;md-RVn;Q6Plb%K1rdY{`kxMskWz2Sq
z%=X*zcY~zs{zma*%3Mwo422%S6EtKZrIwn$eee7)X3|Xaf}KqlE$@cMozsc^9j>H&
zwp4MM<%!pC3w5mY<V+-HedwKD`!id(t~Jp^K$r1`Y`+`B)yw|gS3`F!SoP}RzFFUS
z?#_D0-aB`?=GT_`vTui*-sPNW?_Btzs9gK!W%*>IT>+nFTseN>*Y(qmnN=!{8$I6Z
zuh?)xV_mzd%R<xkbuqJw7ag5msr!%1-K(74A>*TsV5F^TeA&?)Q_(g1SA1aTp4J~6
z_bowXcfsUk+wbry+$^(Ha7kIPbdpnYPy8KKKKEBlSG><NsA_O`t$v#3wR+o$Ph#6*
z9IjR$Xfg>s-~IEP`n~^-6UDFh6e(;vlGz<GAz@XfW4Qd>-)y$C^yWyYZIkXR4J`a`
zu=Vwd&F9`lF5To7|5R0t-^_&nRYdiy|6gw9Jb83=dBv%>td~y)SYN*^{C>l_2NfIc
zlxplY5sKYp;4a?b=Kkj1C)M6o%Ldnq?G+)bH*Q}M=h_v!;E%obr$RyhiIct6GhS#k
z>uNrJbs;V~cI`IVEmpsuwQHT)=p)gXdL>tyRdOwtqSBV2gV|RWoJu$7$(`;Yd+>$T
zyR$crvRph;ZZgMaUVro+v#FBrIh8JkU+rQM*zil+?*xyeulwiKK9<gpcvM98%xFBk
zhI!ulM<-j~EH-`mA+f^l>|_S5CmB}+!yTIz&Q~%r_|42Kyy}C6)sLrt51!oj^-o>>
z_t5i^smfFLv_|E&1S#%2bjF<B=0)+`b6bqn%58tH6l#!rc(P_8gVUd-&T2u*i<#0&
zV(MNBeyTYg^Hgxn-Wn0n;5k1Nw!GCfzS(|DB>bL;fOTNi^Pep~{Yh!Q7ebsf_tZSS
zGN+@{!Fr|Emojgz)m5^|-wOY5wuiimUFI5FrTXe(!odl5H>~N}w)=<F><6U{2RwI2
zoLTDEbFh60pUXDiu)ST+e~2<iX~arwYB|8M>7e4v_>a@StQVU+L)1q4VcPx4|8Exk
z|1AD<zVGY$Xdn5jx61A;%oGfsVAPcNZ2ME4rfb(Ust>6(#ICFenWM;S`6epyRdV&q
zlDF>yt)&~T=D!W=tG~478OLP*$)zss+cl#mv^{m{h`g}lYEEp*7B(Ga=9Qs0o(f-j
zb6Pg;X}7kg@Ppr0e2YpC^89CU$<|W%+#~)|^kanR#4OJl(R<(DOWfl>eZjKTt5@e=
z;=Z`kHPZLY##@%QjJd4=m8BCjKhM4L#5hop<!k!(lb@^)?f717{{JZVlB;v4PF2*I
zI%(4Mr>q`#)=yc&+470wxqe3dtCugA)n}f&y|m(3yRhKog94oIzMfg_z4XhwB~OlB
zcRwdG=Y!xZZr8wou9GYJm9KpiD3KGYTE(_)=7QBcnfZ5T&5?5Am3{C{G(MWQ$~$pK
zF~^Ow7q}iYCM%d+G5+;!!o8JM^H*BSB(^<Db5mOsEji^xw@cZCnY#{55EI-OcuAu;
z@kXllpQfk6nWwwfRb(7}{#tK|v)G9a?t)i4e_ZM`TC&9RZ@!V~HHlyIBo{tjv|8(c
zl!mC>t%+)DuJ}K(2wQUC&!KPf{+}ElZ1H6HHShnG?atzwiOanADJJx(GB&&4s}SSY
zf3#5|$?XT*{5w{&BaVs-PQPHmDtn9T@8sNF4DVw^Yu`;dC4cF{rOW2p`l%J6M~wGR
zc72nzli50|CiuRL<JPrOrR?w7&bs)WugQ}%dvPt;^nC2G`XB#7L~VnAT{(8A^!r+F
z207c1$X5NrLk$wrj3MQ2nUYH-+ua^azkTbFWc;?N>m@`Jqt}N`vI>cm*5>KiS0-zi
z#(Of|ZMBslpW%~kk3Lt?IW74&^Vt{YEUI5+CttR7vrkOq!6c7m$8Oy)`TfwNyjJ9h
zft0Vj<%z(k6SE(iINRD?n0mpo{6~&Mb6~C64Y|!?nw#dPn=)>ac{ahxZDPpUO`hvy
z=JDAzhHiLeFyDt|<#O-cJ`dg`+~u9VEZNw|Y|Y2$t!+xy0k0lf6vj&hXZ!NB|2j~a
z!*hhq@0-s=%Z3>HhhjdPDzXj*FMN};LwMrNgkWpFNnK8jj-k>EWF#_55|}mbn(SJy
z@#-j#ne)@1*LFq6zWsS7Nb4-KRkx-09?Q+KukWx`RuxxYyBx?B^;=^7{-<lrN-PCx
zitlw+x2_J8bKJdi-up$2ds|&THDm^bPMe|SbNHps>K99zg)<LXE<N<?Sgf;mkU(a4
zs=})R8(EJmImgMaZ)dlC>{3|uiQ{Gd;*WNnwr?Lql=mBKQC!twS{NC*V)j$xn_=b5
z7dxeuTRs<Tm0~jZVVdybEw8z$u9wlpWm#)27<yTXQf{4J_NP2RQTm|B_9e-6maA?C
zlrn7#yK<8;+csEZ$~CE_3i4YPFh6`JUM4!xOznol`qj)A?Ik6%G=uMmh}z{h)p%_1
z_;B>Fx!$T)qm60_edjdYb`(yH<Jxye`KwS?yMbSruVU%O(?59Mztgat->0|yO2CRa
zdV3XkU0?8Sx9|Hj=f|3h-;O)Rd~x#6o)Gbj>5=s!=_xAHPbo|8i92+<yJXHHJ#)D!
zKUqY79%;B3?yeOmer%HSW<!;Y4=apVGa}rSyzX~>zM8hykZG%ktEGiosh*_VghVY%
zM)xZm`!4Kf{qilS#HGPV{fTfsf9{G4v*vvHZJ2DU`|@4jEiR>i*HxnOx0BO7Tck>+
z^&erW<-DNXmoDDn+0bxix%J=cs#bGX@#*b;w8YY8=GUefW?S1tJ$RTcli71Va!h&j
z{q56@i((eru@}We^dA-s3yXO@yQG2J_`vSz9~4%9dw74|9#z(TMe%Vb1Ga>Foi}ip
z%jV9@wKeR~kL7p2|6b4FF8!xsQ+3e>_Ws#lD!$bH|N8H@hxo0cd#g6ZXZro($PaXh
z{3jsZ@R{>j)?$xElM7A1`dwTmm~nm9mvvF6KjrYA6!YeL)fE={L|gKVEW;Is=JWy|
z13AInp?{|NOx??Ibmzo3Hif6ZKV<7<SJh5e{$$y}a_ygzt7Cr3Cx+vbzAX_u2i{cq
z<iT9GTl~AL>+jcp_e$n{|IuXAH@^FFvU_gU`&T5rk^MLS?_S}Gx_z6HbUNA!7Oh&n
zE0M2Vz^&AkYei1d6sEm4>B(^>>9P$DXI%_*8O5foPBk)7;ppku&uz4o;Z=xo;tOxn
zRTtKtNSMYT>hQu!HICE0XoX;$x7^}MP0PC$i+byJ*)uFz+FIo_;ac)6Uc*&eKBrBI
z?%!ZAclkmF$&-Kk9*Vp%7tvn&lc{v^H}5SP#{NrhdpaduS`&26yDKjL-VxIYa|D+!
z*8N(MSjyDCRNhcaCr`VVv1G3azsNe(Nx%K~s%1x%90}DwrnFlpFf`!;%iY;Ni>joi
zi&riAXtQ4XYs<CMm%o(X5_%=u-rre}@iKsajh6?1;=JyXWpY^p*3Zv5hb-Iwx-Q|A
z#FV@02j=^K@qV?xPV156$~9NH6)X<C>3QOJtl_|}YVpS%&VlY8XRc(QTYuv8sh<Ur
zOmPn$mbqTie)*xnx~**Yo&Oc3rfaf7(mWNLr*1o9$Dq2?N7(V+e1#PM<a3@Ye_fxh
zsBp7UYDRbAH1F!l_)Z-)!@X8-C%!y<*K5I)fLFc`8_o&epBzzK>n^YOY_d>b>!F5o
z2PYMDol+3wR!U`f+Eb9K$FuI?N{0X5ZTA@1HeZeQa=sMi8gZ)ms9Wukt*?^ath&<C
zvh<(ScGi%|9~wVy{t*8?cv5iD0^aYsp7#`{saZ<iHrsdVV&$9{9d}k}iV3}86Moae
ztU5g_=DkH+s^%4MX-1i^M;-E3zF8Bf5E=H_RVz4Q%VtkGby>E3COrr0RlO^A#2fyZ
z&3Jv+zdZMc<_&Ik>bf_+Y2;Nlt@NG}`%lpA)X5i1WG?V-ycJ)=#;>`D(YoXVZ*0;^
zi$^|p|E)S)V`<v=@u#8j`*otxHz#zy&RTfR^?2sqbxiC{x+2Nxg}yqwuIwn+dfL(=
z_V3O4u$2CbOZ3j`%0^d5+Bw@TimnNZxa0Qpic%}X+8TyO3-(xYEmQGRU+ODzUgnU8
z!4(-cDW}OoJnI)N+BWI6&zaqPp-IUPyyiZ9WhfZ*{?73uize01o+JP2->$vJ^QvY`
zvmLu?DP^|h;y2yqR}1vZ{7vFCbI#76lh3gHD95&qN_|rv?|JxM^yDS^3)<bw>zfw7
zU|d`5@=A23^;MCp6aFrDN?5X5CWGHKFF3KQHktqYQKj61u4A^LRv-6q?N3y@Z1AXT
zMqpRi?So5-J#HU6E-b+?*H%_Etf%Jkqdyzt8WwNoYwnx;ex)eS()~v~uZr3)tzB@z
z^hA-%l!Kb4-*`9L*-bbgFLs}AmA#hq)Dvw^yj(}N#Y|P%>*M{PZCj#ezU}_~ms}2n
zMepL2+36F?{dmVrmk*D=vHkztUOw4%ac1f6I_K)Hx@z-`O~>t7PcWLd&e-Jm?d@NU
z9b0QOKCJ(}ZAE9Y>Aa^*mu)K?`XyWcX5?LZ8dQ6$r{MCP*mvI!EM4FF@cV{?f%i9f
zm+MIUVlB(pbgG*+dvS8|2LB`#TNbH2t^&W;XT)_PUwFUWpnPJ&X6EF58DUlHD*`6n
zJN@EdQdrB$Mbpd{w~BA?zoUCbjLG-C#<58aZ%))lTTJ=xqVaG=qi|J2oTQJZ=ARC`
zFPhAjUn(`$7`?x;`<zJKsav-<e#mo)oMxWHdqiK!MYd%5;r2;V(>~5H6-q1(3l)43
z=uy{OSpI&EN4@9U%3eLa@EKn>*|cwN?Rt=WIepXnK*dW(cFBvq<?RvF$n_Ifa@ZVU
zrF8Y+?!SxgPM+T(>bkFjX;S7<DKV8&Io6!X<x5`FX+JV*eas(vtiX-S=T0M!Dr5I#
zm&iMs*9H0BPF7H6VvkcwnPj&19naq6gKM^bTE!~4ho|t(^Zl)rhH>mBv92GCWcn_@
zznt>?XZ*gKcLL^}UJ-WCCH%xaC1dNOTMS;*tA+Mf_&jFxy?b$0{)_ACoooGBo_Ad_
z-6gd1&FL$OeL=IfT=$y3?)iCc7Y)^8SHJGkxwd|PrQqI*ePyiw*>{%Ke7$<@mx}C~
zpt1}9@BI5Ac&g^l4}Og=@$2g=KYvuNdz~4dW6Hk9K>J9KP$lE3i>LDx4DM%C^+veA
z7d<lh``y0pN;T`2hZ<?UKRNZN_p6&NPLB-jGsUJJw{&58t#_g3O{Qg&=nWN-UlQl!
z-u67VDNC67xvJ*fA=j>N=9SKw2NyeC+7rM3UFH3E7qqfB{@vxVTH0XYkz;1=el;-?
zS=9w6&%X6`{-|8H{x{d%oEom0n)jdgHQ((x_U*#$Q(mi^zIQBg*r)3x|9FRh$+QVY
z!k^iD_CBcJ&b;^2ZF633H`Q>l>Nml2VrTSMop{OHEBg9M<bk5UpEfn~%T778BUbsI
zN~yt>{D6Cr?Gw7n9aEGOGbTFMSp{!&$p28Wbhl*qYd!0W+vZ(m4k**D&}7!1eQxFV
z^xTVwgC?X+<4Dr4i!E?nydrsm{~q}=|2;(!ON=vJg92Y{j&PrnP$A>=f073~r=)}Y
z5tCSFTb8Z^8zNqm`3m=5dL{Zs%7#xk_u!9NcdoD3xc!D>+wVSkzJ}>p?R(#QuYN0A
z8QP?xlqP;^S*!5=P|y1{*I$2m`tP29`@M&+ub+#a^G|>Ol8(%S)BUR}8n2sq2ps<W
zhkwh)$oX&oygmJ2YyDiIcYl6vYq-13LdElTZ|W&SjvK-*b0^<3<}dC|E^w=_J^z08
z!HubxjkDFJb1Ztpv#d2<^uZR<mTlV?ykDdDz@x>1Gnz|QQhdWz{q#aDjX71zIhW2(
zSKmARN<3RwQ)H>rs>OBDk*flv>rSt`ETzSM(B_f4EYmLS>y26ECFzIFcdT_i&-dHn
z(CYgqoo1(|XH|FiOZhs?xfx&brslduY0Q<(c^#H>CP^-QSlRQl+Q6XWNn6H(nu&)E
z?e84u5!?Fw_64hMgTTy&gQ0Vla3@N9vz;8e@M~Rk<JBcnaYjp*>FWnhj2DVYjqP(R
z)x4JR;MD8bOFNRSjTV(znb`l}pXKn%fBKR`N8N5enid+$uC!t5>|;4+KC(`)y*9^a
z`OnnDhx69VZLu%X+~oJldoD94+uau?98)s>PCk*X#<$6B@$S2a{NMKlp1<_)D9hq2
z$2>2b*nKjrBJg+br2_?Fix-<`$OiQvS6JY3ApNw-+(n18UcBJ_E*0H<L0@^+v>DeD
zp4^Y<y?biUl~vXv)x7KNx);qmxKge5vBs}HmIul2Y*T(1zFPLGQHZZ+BlFza)iTGY
zHBGM0&JODjcb<RNB|16rYHj#|=*fD=R92XDN=cWbebBb56FTO6Y)7_}l6~!o7wli+
zZ%uw9zb`Lxa!Konf{(w>EXY{6^we#emD2abYxBjQoG)PrIuX>nEB(i-T4PV~evR<i
z8~mr7>)N8IwTVr8!rcV9)hV0gHl1N|Kc;Z(#joI(xq`uMW<1~1E|nHPJAUSLV}V(M
z=RZkHtth^StGe}EPf7=tCFGpb`yni>RQXB%%iTQ<|Fv54GA9MbIpywhZ4wk)v2QL{
z*}*9vS2xtpKi0V^@0HFuulOsc#eec_HBniuu)EZyamk+iK;=8Hvon{UQr*E49G;ZN
zbl|e(z4XIsTE&vQ<#w|-Z`NR)pm)-QsbyQC-sFY_Q@jgQHg$Gr9BHcX%;Gz=Lf`v_
zQ_n2L$+bGaB1PP{INy8nruNn4lrK(^)5LckUR&aD^Ss{fg&l8<bU*QgdM@0yHef;S
zO8?m|9xMG#g{I$%Qrfh8%Ys`b|4j8m4hAh-`}VWYubKDv`FeA0T^>HgDL(zKgWdP&
zyD#FFcS}X`EWfX!dCDX2!)hD<6CJi0M=O{4_*#hvyYp%6lFM^zx_11|t5>gHhe$06
z;GQ#e))R%~R~n+)5gmsg&wS#a!5Oh)PQq;sIbYkGo;_<8Fua&>vCMMy?cFCFCSCJv
zU$c4X7N4amTa@fp%=T!l7q;23Wb(vGn~GNPPM&`}VrOn~<U4i#xn8TM{qnGWSvGU8
zY_79<t5sY}SdxwT;x4)P3EMvH-?Vg{?bWb5=^-v6PjyzE;|^TpUHBmCNb{esajl+5
zx(fqiHaRi+T`%dnth9K^35AR)D|$?uC9|0#&%4j`O!0Hxa$vTij$M?G0E0;;m+kvp
zpIc5V0!1<>b@;R&SFE0Gc<ye)n`hcw*(u*_Hnh8Xt$y(K-^Yi$U;O<TSn}!e@4t`d
z^WERWwRKhZB{jE8AJ6!0{Bz`Yz_pUd?^my}#vhydQ{?daP305MtZ6wSr!3N$?JfTI
z$mPzMfcIjX{rE0^KHIwS{qyP8_snP4-+i^9^g^S~-niKd${#&6ton5NpMbCW*%vH7
z94A|}eeiW?jOO7pe(yW$>h-eqCn{#%-S_*JeDup4_TpJK79vK5jEDZ0eV4!Z?zjBn
z$CJP3f4l$H=Zq`&f<qkHXEnG)vIErvwq2OpsOq!)xBd<1d6g3<?hMfU9A{*4V9OD%
z-l(N>lbS6w^k4Wq7AiX>BW0OWw&K3q`|#-a{XdS)Ie+d_>_+ZS`(MAl)aL(I>`YkP
zs>>`}OB?TRT=d88`g_UwS3LjxmWh>Yv|j(Laf<1sg|8F8cx|ZaDB?IemFsxuDGM*H
z32Cl1b(xF!HhMRu_2sZ`$eOg7d7`dJ&cZ|+$!o$%OL%Uo)-{!E-hcIi`IneQPn-fK
zJ_y|VaHmJlUj_T3&ne{|c2Qp!EcrdP>kXUNZtE4>v@<8qJI;ChSEFlVTS%2b*!?BU
z%_eCfbEM9{T0JXm=1!TIh41-Q-zV)jrdOclJIU3JeaoB*evO)ilT|(5+&Ea3#-BOq
zx%k&Ld#+cnR!w=eds*J^x|gR82;H<*R7#D^aXNMOTd&kFIR%O0xfQB^4|sgJVidpq
zYV+0pZL6~uFV0Y7{V%cA|Mv8W`p0&B=!?Dn&QQ+mmW<!IO(zBH=1lQY%GH!CIhEBs
z(ZMm}{_d6fwY!xsJzwU%n8D}he{R(4#vJ`lx-Md6V7SfCz#z%Mz>u3-oS&CenwgWL
zUkbhlsjN6PuS~C?a&LHa{%tdny6fu|=CGe?Uc2S!1yRO5y2Y|*9A>j@eV%lJsd1Xd
zY*XJ|Do?q){(Yajc(&^8!fiY=;(aDQulrdsLt?K=;*2GFrZzmC5$m=TwrDPuEq2m=
zU3qlgwx_3-U7mVTaQoGB;;Tb<#u=JVPl^&eAFQ78^XZSGsT?Oy=dV;|i;rt6V{u$r
zulaS&jqWWEpMG=at75y|vHrrACWX+Xv%RUCmI#^M;Shb@`*uQ-;ITU&PqcE?M17tx
zGvi%loP?3)!IyHCA2|N3c&ZoMntl4}tg=1s3Nwww7oDAC$yYMvQat<L`|nTOJ=^=d
z@#Ul~`)czm<F@^LyW3o<$5!Ff9&RI_j<6@ic?>QlYLf+TxV3EJlc@Arwo+Ljohi$6
zR}=H2XLA~g61PMZJ+)F`<7Z{@o2;p>7TV>j%6~$j)A3f@+fN%NbZDw{wlexZ<vX(W
zYtwNBrEcM1>l3WgH#L`iDdm|JBT`}L?-5aa$A3%b57C)fy0@47F5b4|)Fb6dXYSP2
z{4J|%uxD24Q8M?5iVMn?7P-e_{H~_TT<U+N{es*}%>iz^B|8>ASG~~ReDQ8>Me+BQ
z_8jVq558r&{!o7V;g1ytQkU;2gkIh<y_~U+FW>#~YkqlycM>Pg&RMO~;dHhj`D~Bw
zA!oHi%K}`Kryp~g9(k&2fm-32wasU8TV~4}?5X_v%XeC8#GjDD1>93b-?z_y5qxYO
zkHfmn_RlXieR%8D<&lu4=&Uknr}1y0)vwRY*1K`W)#Q7o3iH0FTmJTJQ`%ek@4QF%
zys0IV^1lTg^Dr{~&A;ZZ$GoTK{Ce1~SGSAa-eq2ucH<M9!s%bP%kyuqHEVn^UpafL
zabt%}N1os80xr+@Qx8boIlRCBmsP+$C8Jxfj+m}~SrpOGvNI<7#O8;UY_BV=0vK2h
z?Mm}DO8m)~@r(2A>yTrWs}>fW*v{;D|K&Z#Bc&T^_<uOI9F=%=Wo^*&@L6(F7q_1K
z!R~Z>E*tAxr3F#${M*CXYNpPKtSd?Rab0A?*|^nrC#P?byQILMDR*(f`iEr!466<<
zk?&!=oWt;wXIp-KP3M;Lw{(`I6@K{nH-XzNy84i)?DC1Hm;5OxnYHW5-HU2l?oE<q
zWu5G>dhPL?t^N}OI@?4P0~^F5_xs!l+^Uc%EVugfi8(u_eYg>+C%h?Tx90z+HL+Ju
zWwEX}<+--NGfsc&A+1|$FA6Q~<X<l*pCMcSaf)5oJDb|&zki-RbVg{?uJ0nOi`4=m
zUhZRwc^4nIJX(>}c=zf1L5h!0m$sNY9g}C!T&wIY={luk(apF;99#xA0mm38#^wE7
zcvC#1!mjMeg?Ubgtv4UuyD0BJzxedRyBnU1{^fq)#Mu!cso&RofyH=!oO^&sfJDJr
zf42*by|<V`k{nzUBTZgbCng@b?VHfY5}LYJaq`oEvmHqme@l1Yz4*8Np~SyTSHaAu
z3}HEf6N{pFKBay0R<`yntmd`gW6rmfWZ#~1^0DFZNU^5Q@GgJz2Ti_{U2>{TxKr4V
z9q~B+AikezN(rO42hV|*75clc%zD(^E7<qDG@GA8Xl7K#{AXz@Tc2({yQlm79d^;>
zO!8JsW}R_9Y96GKSDifhliHrSe?$GAy=U2zvoJ$AkEj2%v3<FPxv<`|kj7Q6m#5vD
z+LI=-^3+;Bg|AF)m-ma<PArQk+{5&}nawYLsmh#ZS}S{Ju3Yru>nx`J+b=!D*;YEX
zdJ1bjU0${IWbN1fpBHwduVB=eCDP3oDZbJ9n^BRi#=h%syC$XUdaL;?t4TPs@U-}k
zQwPmulY}zAM#(Cram8202W?d_G)Zr+JDR0%wdJ_d<D(kiHdL@YzV_2%I)6o^%4YR*
z!uoTJHnZ!`ZF}Cj=COOwyP}7A!fQD;FR^ry@3}fNp=D>5I`ev7;~!=pU-Al9h#%hE
z|1{v3;O6Z7!`dw@5?fB4S|2&<`m6h>1-nzI(A3AE%W9Z$6zt`hdB#S11(j2S4(8o9
z;Mx0HyW>m3?hU;vyLlL`7GxH4%t~dQmB`$7Fd)@RP|cf7b^BNKx8}c6C(l{Z+Z=an
z_KELuC*5NY9RB<Ee2yw>R`<<KE^kv*C#DtLE!cQCXIB4B);lwnDet^%IipYga*owJ
zzl6=sKf11EXnf?HnwjO#*1kthAnw0Y1N%Akh^+Qg;wuf0%r%*{vCD_oHE`=XRUNJg
zTi07Yh?2hUtdqR>;*0hxODne}NQ=}t2^MfUpSI=jVJ)5EcG7)Cl&;e>?U%dmY?ib>
zaqXMu1nYe<*FE;K<|P(OsED_HuyEdg_mOMD<^EmlCSAKv1=O;fjb3>w+EZKkAIs9q
z-{(Z9tkKvJRJU3Chv?j}#rJzSkG`ECJfB;|_}BsW&Z*x|>i2|*Y;+A(olx7j^`gaV
zMnxy9@OhD*t@{>d1{`l*^2~IZfUUdc0<mRZ*kWAQuHJM$@RQo(71h^yHhy0#{;_3Y
z(!JBOEIj)+T#em0Z++gopc#9zlk!!Ld~QDR>2}kJ0Iu&ITen<`zN0=V@p+>5!k(iR
zk_sK(-RZ}>7PAK{OKf+x`g5tR$02{)mII=S`qmk_7W;4iypmiX>*c92XQ5vE(e9Fc
zv#P`W-hRK?{97}o=+-UCoKM+zYYV#ne|z)$*PYG%)6s7jWoDf}bqX^BgBS+`gEVTD
zUtW}0pdTNfnU`4-AFo$X*&6Db|JY1m@9%J)4eU1?bQNyi?Pk>fw!!wz!o6Eu`CSz+
zTso2FJW<OtQn2ga_k9cZ%{ja5tg7J8v}b2$oBO<tb<Ww{R&v=&{w4dLy*KwPj%N-J
zvG)IXs>I?;+}8GEp*~BqrBYWnU!3Oo)BE~{-r40GKX*P2(spiAJ=mt~*STi(RKxU8
zJK2}rn<JN;`g+YGR5imRRV(jiSkCFh-HRpVm;I3ZFaNP)!G*ce@Bck9QgZK{JfULk
zamJRJyOwUf7kK;UwbqHRoc;FiFtyyZq<FdS)=8ITUf3u!ZxcVYv?|GCtJ#i=TUVGa
zQM%^pbanQ+03Jo9WC^DyY_9919&EIH^6Ef|LS3FM`@*uzuj2Y_&VS#c)p0(y@51rz
zC(@Q?voAicxcJ|y)7gtIZ`d?((PHECsqS%1)6%vaefq%4e{vYNugC4xiVLR9O{$ii
zc$F)4vA1kI_k8t-?{kWyd>abRoch#jSn7Ve{jT;4tN2Ey6iL-ac8ODuzCYFr{Sn3e
z{7Pb0oYl&sm%41E!x}ZU>fN5!GPSLKtq>^WIG49u$?<AV$}*puQC7-lcC<v^60lvJ
zHb>mbZE}F$qjkG{w|)K-zTB3N`HA+!<|X|+HLK?Sm%q+!@`XqK)r&s{LB4ChdzE>w
z^8Jz~=y-l%OV^CU8+vSJizyvlrWRh`^4qq;R{o9iNqzSv`V(edEKbSac>R0y264l@
z9P#t!TGNs*&&a-T?%bvmp9Q|1oWH7@&q9|^a)LwEq>iOJlMbf5u+rJR`If+oUB;P(
zKO;@oJ`9}cW}CRx${=)exqIWn!=gOLQ}?bn-ui!Xw@p@ucR*n-%lip`+TMni>aKhj
z&(GLh9PrxcmfWq<O}`dLJ`(l!+*M{4sa5F{?Wmk5xshXrh-aHYFL&X+O?9^}rxrZ8
z_T-b2x~x`gAY&Qp*K_v0yjju<LSB6^KlAzc7cXhiCBDD3s=L)cpWG$)L2-U<L{ek+
z-yQ>AqqRN$YfiKA+dP-vA-75NqNsVQ)iU9~b3+Y0(v!-TwEu03`+w*6XOI5;#A%||
zmwvxbj+-I4fj@ugp%f_}!3q8MTmNjnsiG>Dxb4&b+;X2AD`mHQo3QWwycNQ>e(tAb
z{Jz-9?v0ruTsxydSaeR!oii_2YAi?&%we8g<=*b!a{jT?mEt#hRCk_Pn^n>CTV~N4
zkHZDQTT>=YUnJ4KX=<yk$^(s`LHBa<45BZ`A9y<3@ZY|ce;;+bT^F9t`>c;z%ridr
zF210_z)(Mjfk7NgW(MVGy@JZKwb{kDk4<_}{+G*To$ds6l@#l3?<3!42_G#Jy87|;
zu~TW=MMQZ7orMHB4Hz_LUc6er|L+WQHkGGy_LfG9wllHY+S=OQwY_U=+rOw^KJM@J
zAHIfysmjOFcWT^Dit6}fVHKM?d8dTEubjM1S6tX?-`F$Ha=(1}IQjX-pD`}^uEA3S
z_41A^iqd_!cZKN9PY)8J!cS}XE`MDX+ilX@^>o#$+Zx)ZSDn4JNK5*rn&*}L)2^o0
z6Yi^r-t0R6cF~SUVU^d?Cc9oUSrmBotMb=#yW$*vFA=L><9fNu-!(RT>-U_gS9=4_
zYw@PfGcA4-@$crD>$w{P>bEBCoF&HnH;Q@j#rxO8SMQp|(HyinbB&;Hw`A$cj~U%d
z*{<Y;xmtE_QnNCzt<B4SowM}cKUojmm1R>+A00Jz?OH8<-o<id(LwuZi`J^YGXK>)
zfBhyg_GNWH8S48M@f+Cx=$-9z{ppgmt6G<RS`@cjIEB$P_Emd4<Hqf~yp6jjuM)E`
zef3jF^2n>N{iTYxO2W1*esO$r@r(WI(o843`MpNY(0uPd8$s=qiGd~2Qz}buFLAh*
zHS5~xZDLGuE5jD~%+6V5t=|y+DpdDD{F0tmuh}Om{@yFR-CC+HCZ17lf4ArDM6b?&
z2OSN2&rSaP|KA6z+MkzSPycUG{r&MrM;7^`rn$Sl)Vi6bG1#hE*sRn%qpYKoQg!v0
zFQY_CH*?mnuq~gp`u(n4?w(QA>mFzmnRdNtU&_}tUHbfdx2g{Rwd*>^Ay(vj(PjU7
z=?LLa%|+X~685QG7fkr`@$qbr8ogQDBwc+)Q@dSDW?xm^bJ;^->x|UWK8K`ZzE3V*
zmAdA!GtWiNee#-~buKMe;&K)xg+2Oni#dN5>mkk6_C{4ar`3<9t6!|#E5_cG7X0X!
zRQSV<*Wa|~FrNPK;Q96c*0%Q5zkmJJfBxaa?BfcBb$?&J`SW%5=Kkj|kH_z;|N8Ik
z%bV6eG>@51j5kb=UEA$C&u3L?O+mr0XTDv+Uj(IMkL>W8Sacxk$Nrx@|8w&?))=%b
zYP;#yRA*sZ|5JF+!PhoB=Za7MsnE97Xy)<5&CM}B$`#kTSOW~7u47klm?gGE`HykW
zvHuS_raWQ(_j_~3weD%{RTUKyS0fuYafkOl%b%kl(9UKvK`zB3PIvR7Bimo(Ht^oC
zv^^mI#r2Wlla~nzA2eo$`$ngEAH4gxeOGz4yw79ny8m)N+3%lSG&?8o$whtp{hif~
zYKzXyzP)HJKhtI7nu_V)UTplj`u*L1qKi{f*A-?q9GtFX#h7-W^!kzAyQVgLZc03}
zS(@>65~~iw-bYG`1{~EQqN)!jJ-x^yrB$M8rC@QbwDar?Lk|H%{{zOBvKyv#7`yGb
zv+B0UgHFzlg^yowsjN==A*eVpZ1uHTzds_;msEbf{PTx-!)2}`?Gu<)H=Wr2^+c%s
z%S|&M8vR`RXYG;a&qbA+v{tkTPM)P{zWrtzi`K%-MgETsO(nEB=1-cjfa}0=`MR2f
zkLl-y8u$I_G-24Pak=>T6I*|^$jf}cIt@OR*y?f2>1y2Xb!};!`eDJ9x3lifi<p#V
zafQRf@#{ZjPR)=bA5xwwolw61W(fzEcjc_c9VY|7-FrFlzWWXzB_rEK)-7fFoU1*p
zT1y-LOq(ifctA|~c!Fnws(_VqQvG^e9{cP7U#3vugh$gC<^2!7lCabF#F0nlcLh(x
z*`9l2vhZM&?KF?vMs0Dn`t=pBm~UA&U194JTp^YEx~#8E`TN`>hxr1g&z;lBf12yf
z$8%}BtNF7ek~pOH*i5m}O^uT0JhWp$Pej<yD#ag9rDwc<!}X8Jvz9$APRWjWj+p#i
zd3XJj=Tx=LW;ZCBiwA8{J@|0P;R+F7?IXOM-EOj7UK<?EKI~u%5KUN~@h_42zkXoD
z%k6t3t0nGDT7TPWHk0s2>9i=<c?T}7ZusjLu$7;GiY${<(1aa1&l_Hwyza0wu$q-I
zb82?Q9>s;qxgDFB?)h%*^1c+cMojX9x%Us@NsN=c`gZ(~7Z#OTyp}0>`i2{;TIKZ2
zrYIUQU*0Lk9r10E=fzWUEg?KBC#?3>o|WwFRK2T9^!dk&ffr_3?W(L=V&zqro_ytP
zmWUyL#N<X{4kb-_hHdv>_8v}{S)12ofAplafnWRF#4r61Y$`*2ZgF2)^894x&Ye#l
zKG>0HvpeJAf@MFJa0|1wJ@yt0oo3G5GWiM9^t%ZbQ$pg`KiH^nYiUL(-v{ZsiCOb}
zbbp54S!TY-E&6^{Q1|RZRadN&mRy*oIs4tb&DKYr+U?!^VTb(vn-+IYn{giMaCa>9
zng8#l+P5XHOE?(SzP=5$IZ|q1+MU2v+YoACP@~A{rLC(fEFFH!q25@`G-vCz)vXU^
zHq}45v%cClk=OaQ^lO%H`?|A)YOn52zp*vJ@vmFC)F<0F>se;6?G-r9HeENT_dtv4
zgNe6{1-`zL3iK^FKlj0|INnE#D`uFicD;Bhyj5+>o{AdJZEwy_z7fW(G*k6rpJsj0
zmPftW#b49|p1$z>WK#L*$%~(Ydj0m@Q}qotZvSXLUHRXqFPC1pNcS)2KlWI&bbitI
z<ahI4B(B-ZldHZv`p=TZ9-lP-aQIG&3esq8{dpv#`eufRrd`{!Pc!RM-|SOzzf)<v
zpy=@C`mj%B9)9bO^Jq*y`Txn@=f4b={A|@apZ9NFR{e@=sd;h54J`M5P4Hc}d1i&`
zGS|oiX-%F)%cYujUY8w}#e&^sHoAA+P;Ql7Uvn!jOv$!Q_1iqF(_%YLB|P)|*HggH
zG3(OLyJE9%gqd#Z@qS}{aNR@oKl6V#w{zrezpI{Cd_>?UqhM)$;*)|;Ke<<(sNT-m
zuvfEa;_{sl7Y%YIzUPr_zxewbmu&FONeX)!dwZ2G9bNj{Db8p45-}g|FUwnJX%)^~
z)V(pE=}!2nT{A>4G*vyAdH1>L(+2`OckeEV7QAL78+v%rtM98c*cWOt3+_)6Te4lp
zIVOm4_v%-?ersp0V0m&t;hOy+rmHnc3=JOw?>c+`$$fC>%Qu6CSEcq};)v<?-Qtoj
zaWXB*^QrZT6YNsfvB%SxlDBl}zPX!s@lW0!G4XG=r+e+{e{^6ScQxB1g?t{Vl|pTI
zeS-{_PV>CD<Ys8F?zIID%onO&CVWt|;I;Zt@WO+KQ-6c0vy}>G@BAwExwp*zx5Q<#
zx13v}V#!nTT6cj;bYtkm#d`Dkby=6B3G)aA`d`TJE@s>yT_QboGVg4a4fp)>HtkyQ
zm-ob(q%ggy)?weDd9-t%?d3cu$Mdyl(e{1L-|Gw`CpCwijxKq-%;tY{ZL4mr`J}6&
z%Tqpn;iyou%--b3{c7*!jc<ZW&F@%>>^;Zkc0$8ChdV6j#_FZr|4O2Eb9JaHT3xyy
z|Nd^doY}Lx%_i4&8+%A!+9=A-Aaho}*+TB!BDUk@Hn%QUeUI}DGOHI{cwh&!kfutH
zPe!uC?Nc4%^6QyDTY0=aezH4%((#0<bqBr7noFxwHXl3jQvc<(cE?)#`h8pTV~%hC
zyyoaXy(O1r?|!+uYhK5XOK)Wa<{m4*@h5JzGk5T$PrDdrWEh_OGjC$W;+e<tS9xwz
zi0*e!;^mFi6}yqk{99?>_T^1K+Se4wE-4VK7l~Dvl>GIxYW3#LFD5hn=wz2!>o9%t
zcJXhTFPfTcCHOBix4&P=zPzzfujt-fP5la?xm%<D9V(NacD*-%Au&1PHq*3&ceVC0
zRGvNOFiVn^<r(w+)|v5#?5|FAU9oue8Z~9jLece8OqN(py?2$T;N>dOCo7Uf)^3mw
zTsM7D+uq*|4jaO_tzEib#4lRz@$Gox+V-rOX{=jPcCgkp?YcN~t;fT?%iG?3pDE<F
zW9wFqAO22n6@#BX?8%;zad*w~%a4o|PrUv1`SLp_&2FKy@p0GrW|x#ax+1z+D0~j%
zG4VILm-raJalGe?b$QQmYOiC&ZZ3^KuNHbabG&5p4{dBpx+Z(8Y8ChD-M$A5TL0Y2
z%`Ics@_NlP-Bh2m>+jURM?e19dGlS4{DM^Lx7*_6?EJDcYkhLwF6I3l&Aw)-ZfAB)
zBo|LxyW^2yCsvO0lPm7}9j~8$PPgP&>C2aIUNb1qbev@J`OVAE;w+I?2ZYXDme5#m
zI7QFy`B5K}w+9ZbGG<LYtd`<g5}Q%>%=6Qve+vXmrROj1GtJ7p>(|nkcu=6ak<a4j
zqNoW^ru*I3<5<?du(JJ5UCg<c7b@<Szvo&0k^k1obF1F^l~&iw-0fUHtGe8oW51`J
zr^;=U4T0VNY^yf;r{{CusAxDBx;|)uYq`YkKWlyj314~j@zKYny`rjI5$g}|32l{R
zeH1D7bN0D;3uf^?S)KQ$KI)3^>J9H*<DxYA+{DlK%l7Q-H91(4cg)V>Ur^litGb`<
z8#~`|+z8*=+ibS6I3eCLS=`KN`rNxN7d-4Qyw=n)zOnk)db#h$`<@@1?lR%B*T#HK
z{b{l$zkMVwI6c>tiCbZ=&wrJtS7Ui%@Y=;oPk3E^^65kL^wrxH9zAYUyJ8x^{@iy`
zsQF%>t}vb16K1vetvl(`G}rXaqr&)kO837+s`f7mX4oH-W+1je{g}A&8HJ8jnJEqv
zo@E~3I~lb$xcb0UCItm~Z*hiwKl7`t_^TY=6=~j(cQSEJbJ?D>GREfA<^rEHj&m>X
z+O=_y>vzY7*m~DP3s*G0T$OG3h`smJqAy=|8M|NF{qv}>%Khh#`HJjY?K|~MEDy2l
zxYNvVN>RGDHi@zR!;e6PyI)dl7?vs2#p#E?J(lL!zBq%S{JM&jVcR+z51BykMHU>h
z>^|O{!jqN!$tC*?*Wv`Ppt~Kr+zuvJu@&Vqhi}oc)j!?nbSlpNi@1UZw}2w+n}6$$
zs!f^MI6vW<OaJL}rHf)0Uw(6}Bk;@5O&40;_1HE^7XO{rI_1K)e9?PmHHv2&>N|R;
zy6oUBU)*(3v4;Ks7oW&IS1Vf@b+$aeA$MIk{f~?-^OVPhe_u6TKX~U!!mS&Btki1z
z_Nu*o9`-Q3b<sz4$=GzKeD^hrr!rmSxW4LYnBmqtp3RDE4d2aYeROs+Jl?+hhD&_%
zuUT`yCe%!sp%{53Gd6VXmj@?zv}FH%b#g{kw797-SI1|&vYh<vwHI72ZumZ-%sS2H
zciz)If0w5|oNaNu@oRUhNHF7)!=bFtPV%@sOPOh%xH7OL`s#IuipS;4L>@R~DcU8x
zc|0SPTW|K%6`J`wv=+`b`?WE{cbb+>`Q<S6n^NZ)L^O_;T9rOJ!1MIgijY@Fq&s`}
z9QobyuQVw4%Wb~AcVY@EYz5r91|J_-*Cr$={If`GI&tIGd4_7n2t$=JyDV`#d*!;q
zfA@}O)-144i9NLLeT4d1XXme`jXTd?>%L~fdW><?w1p?`ZfglT#+_TLzxawrze#MU
zZ?=0k^CL&r|5tu-u(O-?x_#r03z(oXrL3;&)3Szzg&rT?zV3g2f2q7*{J+Ovj$eOy
z`to%9y?*g?|MCbiZ^<^0$h@|i%SEWdUZ7Lui<8dWt&&~8FIjS`@9^?J^zf>#;<LS0
z+-x)DIhr>M{rO?G%;c+?-}VQ(&L?-r@hIQ<Z1gN-B1g+#rw8In1s}v`I_GHGy>6A;
z_clT#Ey_^!;A?NMsqzVXU&Qn@#5ztoUBA-*&x7OM`%Qk<eoC2OGw1Nl<nn~ZhHG=0
z5~4IZpY+Y>yl(u+{i1Y+@ZKYf6&<#pES*xgPE$A9;8NvOw~DM|0+H+QICvb2&ps$&
zJ6~OLNB5OU>>C|5<bFkazuzFR?adoo&!vy<1s^gj;qaDq+nSvuQR$G!X!KKW>E%P}
zi{9S)7yW2UK@P)<b>6D|nI0Yo`_FnDn=s+8-FA<Sw{r^b*4hgkJn*qN$n(D3G6QzQ
zDJO;QUHy{Rc4%6l`yH{nz6Y9n<cz}||9`z_d~|c^tmlFI;`Gc<IUPExv|Ig>X7;KH
z|H=bCh`y;U`0SOIo5mE9H>2~snPU0Fp1V7vj``Q`eE&4cSZrrM=P$1{`~LBlJiFDn
z*duu1ZT^jH`)&vyciMc$;s5^@)iol`c`|AFd=GAh@8T$bA@k+xJjM;~t2tU&IL^PS
z+S{eE{_YNSITPP24BxK4i924e^Ki}l&)>NB%atFOn{e|<^x=P&9uF<b6S{95Y?3kK
ziVd$V&){hL;j8srafk2wJsX!?*2zEkM<+~z*-WtZ=c<wtiS|PqpM>_6DSmukvi;A7
z*Bfpe-hAPCXu-1m?Pa%AZZ;P@+;+Qj`MsaoEK>~r%?~(#C_HdOc1T0%*7dTkL6e(T
z#RkVLW4<idnCPU}tov}Yu9ek(rj$~(e+j?DeN8_ZP5PvHD)XsMg@gHv!|zO|Ouhbf
zorRg4gV+{^=w%ka?A`~K6k6`#KNCFPb+5nvy6a)34}YxM!ZywL%)W(J_<3K&`jxLw
zod1LQ(p-xv%J=6ny_nH1^I~S0<Mz06ZddC+C6lIR#@(G}@|^7s69=Po=w!*h2K}U;
z<-+l|4sHy{+QGd*-}#PZ)N6TxThF(&E;~|NmEIQ};jZh$Y#({(Y}gB(HJN*!#zsw?
zv+aPkUcry1UmP+A0`^~YWBs?-<~y62!Vdq9zpiBdtV(Fxm(~(z^EuIycj4UMVsGVx
zPRPyPc}Op|t4eK+?G=qx3DqnrVgKf7gsq#u!$17A#f;yJOk}ooPgKiv(cWv#++uu(
zeUo<Ouj+!^f0xeN!g6b|`Q2@o7q3os*lzf<SHNiB$qnCg+E>qt$(Z54#5O&ZHDFrk
z>)eBP6Pd(UTJr5!$Du8~aN_laf43K%Ihp>CQM1jDZ%4z8@);LhFD{bRk(w2_R4&VN
z--7OF)rtysrd`Kna;7uNOZHw2)3bOGtGzwn`KzKql#=u71fSO{GLsHk%wI2EWYTbC
zjiuA+#A`VhLyQW0;(G3w=eqyy{5!pC;;%z02VSmdSYs|L>XNp@xk}}!Z<u%BCVh=R
zH~6Z|R8(}>kB9Uvy<hg??U7dsPx*ZA?F@Q$VeYrnKf2}!yb68&?8F>@KQUk1sylL}
z<uaQNFI;4rs$P{L%&u*H^l_3=^qd1n%eG7vZ2xoQ{jRo`X4!KE_@4bK-Kk=7f9||(
zeqZbMF3St-v-A6qepq$G6e-)L#1<FkkH-Rij?X`vn)c=5+H;!TKY#13ySeR$!ORm=
zAK1y<cX=CIAFU`<_+{UU>KS=b`-NFg-O$+F{Px*|pw5@c6|?-m*X4imdb#D7h@#rU
z7fu)SUe2lKa{2b=*xov^s`ZnFB^hoS?z8>B=5DaZ(tPJbhOT=zM~Ic{1y!!_bZl_f
z&OLvMZ%WdYtm|jX&6Quvm41$?H>!5px>@LKDxY)*r`BBMOm?qxykY$|4JoqT?F;;#
zmd<U`x@bD(_b%4b>C**QmiS+v)pReCH@eDs^@%TnLI&OYJh_;8&dlTwelPzh-ryvY
zS=g5+tD>GTzfdgL^j1(OY?=A*{IxHOpZ8AQTasleZ^qG}%&=W4N_2AeMD@91YTX9~
z(z6#i-H2RO7Pv|#nu$q1$40=Y@K5vy-ai%XCRMj1JI|D_61)9?d)X;Ib(P5GiT56T
zUZB32$KFsb%gFm<;1@B`Dzlk~7e$_QN?7Asz-Ba0bC#shSC3OUoE9@*CMfvsa*<!z
zBeiLrVWTs<cjUh}5p|v!=ig4%nlSa^g0rW$e_-Y9YMYe$CoRPMZ3OGmTUk3d%(`>?
zasA4!Wr3o?&-|_|<<$~AGyl*e4e!n$QYHL}$8Y!EUi7j@qWE>`P0o1k<J)|;pFj0!
z_r}%7+xs?5fABJZw?6dH`9)it*>0`sh;cgnfsM^1f+bSllYdJ($M<PQfqU<N{J%CO
z>8zvj+`7)4{a3$O?D|~ranky?fwz@eIG;<H@w*6q*tFruuQCPmO;VAi%KjdO%e2K-
zYetF5mY4OL&8w<=DsG^ra$c&=DVTS1ZfE7sl+M|8izk)~A8ooA>OMD0xa{D4{kyF_
zrIx+6K^MZ-K6AeC*(X(6DDJ+S{WYcRnRB_lzlzE}VHRUi?OA-<Xh(6-vqq;K=_@U7
zPGDWPHPUgZ$<C~a*%qF+#f{s8?xsAD68Sybao*h&*7Cz|e@E!L&E(DIiOrFY%$r!@
zv;5j@=ZVvzcNcH+zStW4fqT^|m-OEgycX2F>bZ1a?MhwE8?J(<SeETwP<&nPjHT?V
zWqYUmn4_!dW7y7aD`}zb{(6~R*0T*3eI6BZSCiP3H|0dMb*ILEtW=%6d3NQ-tVQz+
zcY2#PsK*MuU;Fv{`g`*3`yc&WVU%~3^UzVXSvmnu5AIxNDxKc*AjqZvoK%otkoXKy
zgQ?z8a)~ajrNN?>jz_=l4H1;md3j`C_p$p=Y>jO5C%stnByk~oa?1jB7R&VsB_}SF
z97~?rIN|W37}-_+tFEfK+H#zh3!m@J?$_h>*4MfG;OaLk>$vYcu1HIeFN;rVIe4Ky
z`ALqzpRVja%~P#b4s$P5?wL0)=+>8oA}{a0ZSA*w$0rgI!lBT*)c&y9+=JYc1*$LJ
zGJ16Q=bHlYH$Qb6vgG$XTXu(2;1-Lb-I{fA4=Q@Q`>W5f+0R|D;28Ik(@BSy)@{3d
zF)NpEMfKv3!fSTbwrMf(|GF6}d@xWjhN+~x>h(&-43Vj-PXd=tn`)#lv-Qkz$H_M?
zo?E`jM{e#pxt~%33u8G2&Y!Jn`k8duH0;deD*frI46UqvQ(3!Abw1o)uxrJ#H4&PV
zcRhL^acKQErYkI+tBa!#WErwXhWhCgrdlY^slK=Lci7+lw7>+{?`b>sDw!_4WqD3U
zhq-<CQ<>0-TW7k6OSXP`WBX9~Or}|ytMjq=Qd!6I5fV#x2_9a*twpx$7@xI9$(}3r
zCae9gZ#a4&ndMDL!k?TqPgifsGR_F_2|W3D?wjp0Wibu&B$s5qxHY4H(dM=<Sql%<
z++U==)Fu7!+Kxt^hTEbE8v}25oC!TFy+ua1!00~LX~)yXZxm!pzEwnSu*-LmUK{?V
zKAA<hp7UQtnVd=MT`$)Y%t5KrwVtov-+p2GMSQJymr0YMR_5AeGk)}VO`axZa&URI
ziH3vB=ktjVYWcR#ZA;|8x7>7UC`Z7T=<1C<N=H5(32~E;Ik4tVkEVrieBT;@jj!bV
z&8-vFIt?9ea~nVC@E5wKUfospXlZoN)IPK9>mkW1jwXjMJ!qU!8zSqm^VTMlC7*qj
z|H$VA%VgKzwNg*q|829v+?G2xZbrL!?>fz3zC7EmbVg~H^2%QmzbRH;dQf+K|C`cT
zm*37WPyXt2;aPED0&9EX1c_B`yYGZPaoYH2e$%%3+asHcE>-Q4y?rk6;UU|EM`umC
z>;9O@CCfjweBYZ>;?47BS?|d?%lHnb95k`FNoYxZJ;CI3PVv#-<;#w*idri^<rk+>
zp6V-BiEryK%v|c?ylJk_ME_-bGq$9fmLzKUe5?2<czSnImWp(6ri;*wHIkRK*RFZ*
z8~v{}LH@3k{=9;N2e+vnFJAk!t>gexcGN1Zy(jOTZt!{QH*uD6_V3j%O&(=)8LcUp
z^ZA(P?VwK|lq{Rp_TI=_xbg0Z(w$rvV%Oe&{DN=ahN-KkuDZE2hjZudXPrHDJ7&+B
z!sj~mX3~OF5|$g@>@mA_adlP4Jn`$#%5M}j>9NYNsO@~@7VUV2eX(!kZ=SR{Z@Je#
z&M|(WYE^SXR=xM+(#129Yi_?`y{sy~sAsOou7p~ffa#}S_bvPK=J&Y?sn&PbRQEK$
zPd)JKOoD0J*Oa(B0XxGt=;&5NbMJhgd{?^haIEVl?bTAoA9&@}nU6hO%ya0me9YzQ
z&Hn2pMUL>l4X=GAb^2ODL(vi+gIq=Sq*>;yH|5I=gx_>u@_d{8eDkT-o1(M=C;Lr%
z@o`Vbabc0r$hu&k4<Dku&o$3)$n;ybL+9ltA?3>}lrKqd43$~rIotBS=Y#7@&m`_C
z-gCX-l<N1ednMa0_^tG;kuPkJ{IyDZ`kZ;zStsAkIc^p9VcXZVxpDPJLX`>+78TY_
zvJcriw<`CAgRRu#om%ob9}oU|x5zchE&P-A^*;{pl%LPAt;m+qc+6>C(I(Aw$8gyl
z@2CVFKDC4w-swlUR%<SpH04~Crrr|mzB|!u#;ayDC`jA4am_v#t*CwNwbH=_&W(%?
z7kwXUrh2EjpWj#c>1?;UzFhvr)-zEn-d|mL;{EG2bI$nxXfSEzJs$qW!?dUN{f$&}
zg=KtGXK`J7_%6HgWXhSl5{;dfH=dob^R*Uhl&)H}YyafG*Q3N$A2B;T$T!QrHAC>j
z-oQe?dr{og^S|$oQ=9r_b>+rvhN^9Rn+o|Y|6j84%IT2Mn%*<*zs!@Me(r#&O*gt#
zY~5G?QrEFL(th@uefG0Mo7?BFnP*zfU20j$r(O2=7XMr}r-#{M+p02+=N@{IbbGHv
zhPJWNidxGx;Wq_5kC{HJH%rjmaO)zo`{o_24j;vH6wjDt+iWZ6NM3GUuJtSX=lisY
zS9i@koo#W*`6yfRqRqZyUvF&_lv;VKqfF;@df)LMtCW*P*Q`D5935@-?Z#`%Cj}Dh
zQfs+G)?CrLwsy|VXVR%{TtEE%XYy1&JM!vF`o(LlJ2p<5@?ovu%ABp24Qp4<lG<0a
zp)2>x&yYQ<L|(D_`_1H$xcVUR>e~;CPx-HWR90qc9eFvuyKljowaborKfWQqb`9S-
z`GdPtQ#1r>O%~prCv3iM+KZn`9-AI$?_2hLyU~(86BVXQOf6V;P4-N<`tP%w>zDTx
zK96b?Hri3&EnV!B#A#h{edm|_1FXGISG%!aU@3cOToNPp)a9q%lJNNDDo?(-ndUtI
zxUQLH`OW+t^B&B4x8(JVJDZ-!N_T}QJiqxk@XMo{e+>iv+)R!${rra0Zn6C}?H6HE
z9scw8e|YBejggH}LyJY+zV6eP+3Dxw|E%Bt|8?fKzgJJ6T>WS3k3^}>p`N}w-siC}
zCRSRn`MD<l<oo>evm2WhR^Pv0BUWBB?ek4JxxL#Lu{HK=ooY4PSiL&rKJO~#Sq=-j
zf1bIt#&PX6?JJ@Q_p@f*d8R&hia~Wo?AJSDb(PoFzNp&0Tes_YjY(M4jGdReCZ64I
zvz}pz@y3eB$?0hiAIb&){%C){_TmzzlIcDlcbG*#{C_g?nu+VAprxH9LBZRU3|3e%
zAKm_l#h<q%@9xf$J)&0@?ungtdDF%3I{7yz9#p>Eme-TxBz5^z#&Ld+>r5KceAOHt
zOw(80v-VZYSxe{5dP=Kbr5)I7WvtD(!&azZiu<4B<;PaNiTV0+(u8$WlUD64x6a$W
zn8Q9i;xAMF-llo;ZTkMP{kN%2d*Z*{ZB1y@WPOP?wO8vNK9SX#@h2wXY|ol|4;*hW
zx~ckqxFa7r%i^PuThT^=wE?QGB2Vs`cfNWprRw^&+TQba-AUI4K5y7QKl}ae^q2QX
ztT^R11ck@VE9p<UsmAd@c9+FAjkT6{4&P6UKcQw?siuEITKx3X719w#A#rzO!cTGh
zFcWxJ$09!U#hTAQ#0{d4EjNDf=7+_sW6vhMyf}B4mt~;30rU0JqsxU|D*v$cbd;Jc
z?zyo)H}iXxRNca|ymba#eaGy!U7V_Zf;UU{*F46$*fs`_5QYCo?!R30=h@SBXJ6`i
z>GXF$aGHHq_WHqF@&;AGrdqYBX6H;w%j;{F|JvOjI``SbfctFXESk&1=HET`<G)PK
zfBTic49~v!9vSSj$olTj+M4^Vt}(B9Q*X6(Eqm-<oR(l29X@Z?ZIPMh)E6$SD^FK@
zWXHGU?e}!?oeM+vamM-mSTiYd>x_s~QiqddHvMrZ-gcE`z0`7^EU!h$?2iQdYWNo~
ziZ=JGZF=do^~d7sTffu)?bq#kGH2e2|Lj6t5i`Edk#66A*xbEp;sjYoF5d*3<b_=~
zN)0%@^v;DW$rM;yyiw&jQ}Io^8KT9qFSh@CS+qt#*>1aqgMq&xlgWX^%XWhMd$!DL
zV*m8|<2%a};z62BTr36$C;x4J==x_8izSCq;JI5n>sL3cT>qJ-%CuEp=7ir$#y<y6
zO|t(sPc`~#hyR~bUgs8WJh&}a_i+b@LWq^<8J~=fdz~MY6ulWPEIN2;TjXuF#EDEV
zPL(@&{rt$yZsf3=&s$ZspCe$0v}O9I9B+STlb|1Zf(8+Dg1**yXZpSrH>oe-4}P?E
zv+wNWHMP4U%!~P@BJU&wEe|ir``-NL^Y1ls2PTVr7WPjPeaG~9`Pu-k4?OQT3orE7
zn{~3&_Wth^(m%D9=gj3<^Z8x|+vSB`<r=pu9y``-6!&lWnJBLR<|zBOIT{r&j2}Gv
z``LZd;p=mE&&*;s&J><&9(%**YT~T)Wg0ow)8jRh1&^A%neP+oTcp9(ys1R-;`KnE
z3CZcn$v<7cE-ljgF@fFt?@H~Rzh_5oKc4v9;?FhS=E6^f0XFLnUv)51_pv_eP*hsz
zT3{8>pjAIp>X4n-7s(p|rMjD=p2wKa&I`2qxAsVPujHk@ZJqur7gyg{yY+R>#3P5_
z)#)7l$W(mrS(Vk_MQ0`7^ljojYCErI(elMFZfgActx@&qkPFX>KAEeLi<ebvnC-6F
zde4&0Ec6VU^=Xes%ePNi()ZPRCg&qN#(B#w``p~Jbn*F?+DRo@KEG@iZk=Sptr*t4
zXERrIdy0&OpVa!zT&q`>8rc?v$!@E#nA~V}v~kgvXn!V?7j4mB)~<1!vufXuGy|I~
zHTeS3<{9(axt{FEI%M@MEB)(-6^S1cqdG2k32tU6|Dpa|qVeVrYnAUm<}R%K^QAS3
z)qc0QdEF|tgBIs{B|LP#Z*~2zX>=gk!cYF-ge}ijPf)uW^3ftGyl%4GimiG)>Yu)Z
zf10rIs8rkOYNtJI7yWqsAEh47IiB3bG2gCLGS1vONAz&{!^EVeWotetZGKy#amc@V
zsj=|6H<u@tTmH^ku<(oJ<o{w9PTuC)`uMmN@7=?ve%&+Q{-fnr<^Gi_{xjqED3pBC
zDsZ3w=Aw04hQhab+l`KKeeU{tN^IVXdF$SbT7ObVNSM56-TsTVyAB^bv-gdZ`<)*w
z3mz^F?I>^NK2UOT@>dBr_rI4)%`C1zd*vBwF3!JLx%hv$htQ4UE#I%^y-4ik`?&7?
z&%Y19&AxLe*n96R=O6PprAi`SZ2Et0cG%It*K@8q8}U57I`3TVOvhle3icP@Qjc8K
zufO`xM_;PTeeKI1+t2y#U6o+OAKSyX^1Ji;?}zvL9kD5x<9P1X*?XbeCw|*h_#@!X
zw34g;HptX{v;4y*@p?rAAIF|cM@vt>Ieu9uB3pNb%C?2-@jSn|_ZTnU^md!!ME}p+
zJG}M_dbsU;aiI8e%>kQFUbCyGmQHyfF*DEVTfl=i{LOcx8$PgZde$>h+o{jcGra7b
z{FW~#bgaMmvsMHhwDP|x?7Z}Ho!53N<Am7w_v><l<v)p7KWzE*a!UBGg*!#h?ce%^
zk;&TOyZ)r>>vi^g6TG!)jn@h_zv$0zAKyNg$goP@?|l5fE3WSYOLpxzx>t4A^+e`x
z5C0zD{6DGd!rNwpm&yh&)FgKuO?>=adwyCk*P75T-yYZ3^ElWnPP+HPJIj@Mb(q}!
z^H-J#gy>ys?>1U(=q1~*S;NavEOnjQB>t+hWG$ofv)wutW}mx0>(c(!>R<LNEz|wl
z@GN4|IX$b#vCmzb7EFGs=YITnu>D01yN{*Gsq6atH2#}NUlg2q%;19m=0(*XuPZM*
zxx9rdp+>5IqD*p(+kB3B2OMgTr3$~0v#|RcF@^V9<~gPhbtQanWs{S(o$;2tn7^I%
zfeOEU(0voJxIej~3@5f5ye^)qp}#w|`w0ufL5)Da{w9Bp#93-(s+(ClEswQXo-sLD
z`Ej|D$Qe%cZ6|JTjxd&A)cslDMBR#KD-0K3D_YoTyE@Iaox@%5p6JiUMf-itL~CC6
z&lhU4ncBU}ZsR2_yLtOxwfGslH%KhbRPt_O)62c~sr!6M;JjP=W``9gt}wTYe<$g`
zWa5oE?X1SLy&meC+ker>kNT^ju#BId|LgbZ443Sdb(v0G^xb@snt$%$t!5V|suxR7
z{NpJgq*|cqI%$=+Cf6!UXYrsLH>#Y%m3mgqsP_-?xmb5nc5ZNT<hh6i4s&y4Cw%%=
z=d!g(O0#rY-cB{<z{&qau8Rd|2sh|?C$um8{^dc{z1QzJMVHKb@^Qh>jEN3bF(y+I
zqBBkE1WaYGtU5LC!wlAPqxi6$Y~8E%vM2Yyyt#gV&7Yn2jJ5JDOA0%?AHH<BST7=Z
z>Z0bvEjM)>C1cIA<iFH2qAr58SU7Q03nv3Zo+9=Y&7eh)CHeU|dIgntBXjd_y9xbU
z7r)V!PoY%(Vp+qtW(H9Y*?8$MvskwB?`%G=pi!7<xNygtcR_s#Kla}@{(Vf`vgnfB
zyLF;Wt}*Y<*?hL!Tz5?G{=PrQ|KvZNb-n9+{L?+xQUi;2Cg{(~+57PG^OG;1NLq`Z
zjhnVz`s}><^J;C6UpIe~b@--#Oy{hpHOI9t<`mAzoR_OU*{Ms{`|_fzYoBDEI+d%u
zBrP(Qd+y7iD_KT`*;(t;d^G;=5GxJ5XErk=rcHNt*z~FOmwqo>lOMV4#?<7J=+3F>
zj{Dzc6{&ANrhk0V!%{EppR1-`?b&<ye0P8LJ%L%0yPsN3-ScSXqpTlOp3OX$CS3Nz
zP~o!L<=4Jkvw}~Hou9pmr{dnDiwAv#_U};Lns~V<H*|N_l8W=!XN3f9SpDSH{CxdO
zpXK$=)z^Ie^}99k%~kcaNopHTWH0>LbT_x+>?Rv?u8G@qXEOYdW}cfmRp`sKm%R6l
zbYIkKRCHfgF<r4@tB&;Ah{(<Me@hB~KKuIg{Bw1c51qF@teRCm`|3%R=d6L=%!_Z#
z$~>sluT%N(-d@xEMVhngxmTEOFPgC7S!<H_YP*>NNAqm2EnWA+$V&WnZrF3JSqFDd
ziF3=|E#T|kB6PAo)B9v`z@ACECCNU`%kRlON~}K~7^=m)N??7YTbA;>1<SfpcduEq
zDfH;f?QM^*sMJn;oMCsotk7IvP(RyZJ7Yvj?$YV?t^0oVq-I|d&&X!HfBk@n?JGO6
zgWQXb*_g6*SnFwWW#zqCp~4XO!Rxs9(I=-m)>rLSX$<PG`nBXwS9;OjmnI2vz3ET1
zx82%ob^FtQ`<v|!Y!dbh#k6l+{>4zuyRpgX&gP39SwCi7N_@BXQU3x7^#p(8zbYvl
zv(Dx=yByd%&+4tMW1WM~wy)1476>fv;JL`LQ<U=zOVN4x(_F1TdJ<f>=3EW1JXcrX
z_2jVsiY)!8pTAG1gxy-cmFeI%je192?aWv5x$o!nZ|&8uyzP^zH~)j&_i3+wKGR&l
zci^%|F3;J|p$C4IZ$6}vIeFop-l{Se-DS_7JT2GRr}Nr0efdfA^ph{Ylqb7QxA-Lb
z#o6}o0*8fy#v#9a4`(0gcG`XN_}`}Y2Nyi3^M018;`ZrE^41MpjNX%l{=R#{e1CPt
zE)FI00&!V$zPW3K<5{{NNl&ohs``^#klu6YAVbN@pJfeFdlM&%q|QBlB>&XDs7*g_
zCM6tKm=XVA!~X*Aji+~B<lpGiVBELiK=zh@uWP-wXx@*x?<3A`$HZ~t7fXlY45cc`
zj?L9`>KIzYD!Cba>g(>?xSSJOvYBfhbAI8@GX;?bOP}`ePTiiMt*DhOUUEiv)|Kqd
z-0|keYo8k`OT5*$emXg<r$JcV?3mc*mBOKEs#b3fiZCYLmz?<GMYE;x1kuO?LNZ*O
z$6S6{ed4s)wbO2|q4eETJSWPQ-nO=x<8d`abt$97+niS_$FGFS%WaD)d-~Y^(FZ?c
zC)FvYlY^eBimqM9*s(0RH}>7c?(O38oS##-PkflNd}GVsJJ&q!E-ez~T6y7$Nvr-6
z7tIZ#?gb$y_MZ1>Fm8D?|6cbdxks}kXD*x1xjs3S=>)^)^_#pt>D)K|Czz?H;=ZXo
zFw8C6zagPMapKHS{-qmClKtOkL_Mx*d-}NJ5p(^FT^A};o~6BsICp46_MV0Ifro#Z
zN11087A0L5GJdk|)}~X!Jo)OopR1c0T&h0)GO_OcLYp1sVf^zS*%=GZ3ock`&gOLC
zT#svchruoh4J%hsh0Yi$<|L=A&gJW>c7FMyRT8Y1QyaoICH6yU!Ea6O6DnGT7v>*N
z{&a1z<f{LrQ}-BdN)z3?ukd8HudVBUEfq_1{<1ZFjB`)Bg*?+r^(?e1J-(*rVB(oo
z(|-HOFY~$F;?Fbdb;rEtTg*3Uw$IKvR`=vLw`Qx&ybp`6a~$qrl``ID7H*R>`Ry5B
z=JaRJnrCfrWRr2=GS_Gjc@XQK_)|0G{0(c1y+IirG7^tv7pdmR7D{i{{t{9BZC_}K
z^iiqA5YOJE+YbM2Zo92=zp-O|r`FUN-1_fjUmS_v6FIZ2_sHd$F&A%mROhmMlwGem
z!#hPk)P0xxwnk&-qq(zB^8BgH>x>pH{ddjK^6+)5>_mnD;|JMuf*4{u&)oUPQPSm^
zu#qX&=j-W$%TsQcr9W8WciwF2GP#P9%U}8BPM%qL@jc_i7d(kx^U`yTGfZ^8J6@H#
zJN4+^=*<hIzeLFVaAMyW|NPjUw7<=Yh3@9fUzrykSNfF{+3`Oz`$zmcuNt?Sk1t#@
z`}G&C%f9<lZPWdoJ-gp@9P};Ii+-lGb@JrK*7&p=MStgJC9F0vsZrj`=Vg6!h4uZ_
zT^>v^Sz>XjFKk4gHdO>9zD#~UC2;1fTK84`Nv~vnFIZX8vvJX^c~y^hztxWDomQoO
zh*4$vva46V^hmYv9a!VO)w<$_EKAVhzP}4xH5Qqtt$w-n-QkVxg@+H^o9dCWY-4kx
z?@u4O>oP)W@3ZwU9C0X)PQDeh>+HAAGR521vaTpweJ=?9Dt>hK{N`%I>+(<DrWOWh
zK3!|~+;hX+SI<w)$yT~>Tk`wgq@>9|st#Y5KOr~eA2VOb%pOr)5syDBH_WK+JnSYU
zSn@pDtov{Tmrcn|<5jno*uMPZFY;qqlhUIXEx%M+kK8LU+__Zd*xA~BqS`l8Lr))X
zeqtDA@oELn-AsW!?i@150>XVY;;X-MuJFA#vAgeUdUtVrw%w!~cbB<D-oC^Za#SpP
z^`~v3Yd?7^UD&wuV&+4S`!Qc`|EaF8nWApJdgAfl2_H_yS?OK>_odgpIY?-CZ16W-
zYw7gkN=`SY&uO`*WVe9xi^_+$7t#VAy)_72?fB<r^zZMo)wX-fqZSqyn2Wo1*I)g>
zU$joOXR5~BVomGn37c2=-@3IZ*!`URi;HLHG3ys@F+9sR_t3rFGfwZ*=PC;is$wht
zzBrcQ!r7@mr5`99o%84B(*J&E{GYzs{qk$lzpuVG%wL4O6y9BUa=YxikLLWLUkY{e
zR^086R4qzYJ|_F=;=#QOXYc8goM$JYQxduTPsfD16(56sJzsay>#e>1`-381Rxf?U
z7Af3pV*e*<r$Cdl;|-&j1v^-GIm>fjzx{N2U$UN3^-Z7e^EiK>3)&~YsqV$s!{3wp
z`2R9hS7eu;=nuL4{3kPSOmbiUhna~>9Op^Dc%W$0p1Z84^1RodEz){r`!%xeZm9fV
z{&n$Q{l7PBuBfWq=D$)mQ%zM=e%j*Q4b8&;<R00svhtg~yD8b6rR5~2*6m-$E-k(~
zqWT^?n7+5Oe=l4<xt=+|o0&y~fq{X8A!Xh6C<c?_;FnAc465u53~~(69q77-dKP+y
zdMTO3CAyh;Y5DrTt|5*tjv<ayLt}$)8wk{VU%%tzW?7Cc!C6wvG8dTSDoFZh)+UKW
zZ)E-DB+vQpyRD^~%7vL``J1-v-W5Iny7-leO%{{x1SHR#q$yK!-*vjn1re65UT&|O
z<G!!B-EE}LVpz(>ydom9aar2B9tET22A_Mx6S7~g=-8*}DD3McvTDv{v%9ymS)>EZ
z!<D2e!Zjx!D$mz#)~u{hm~^VldSR2nyhD5A-q!0KE<P;1d5%~2E@t0PT~5DcoTIh2
zZIJiv-L-tDcU@d>@QEqrmQ3@wHD|8=qtlUlWlNNsea7C9WgBw;f8<uU_eTF5YvqEA
z6NGi@&S`ur^b((<t-GRRg5{$<ttPGCCoqTw|G1NwTU}xB`1T&-oe6Fy+uB<eP72%G
z)U#yqrUk4#H3u_3SjFCN_svg?wq{D2)O$fC_X^X>m$x?foV`0~#@6EKFWx$L1o)Db
zy!+Sde>j(Na^~7?1;Tq~Sg3iQkaA{v*Ysrao7BSJ`AnyKH%0hW{5YDjaN4)|OEkBY
zN{hvBy8NHLf94ne=z<#UrHW20htjrRmSPWRyPBB1=*ic0d)~Frm2|f@wtIKx#oPCO
zFW>rE-k4jo!*yratfvoCY*)^{A6D`C?DUGYBHJ&D)_yq?FnbM4u*FOE|F>`Y?KA2N
zG@Rp8->-MxSw|<L@xf;GbPujcC#ydx6`op?ZSMa|@dIC9Bb&;X-xo5!S?8OSWK4+q
z9d*oBENSw;p6b;PvU=a`dDb0uefA&GRiB^DO8d=McthW<$CmA`Md9|0&mV+K3ieq!
zq<j?Lc{xhx;3tua*EeKjyBBp&s6L=0z;S<tuZg;z%ipjw%w-3?IzK)VIrBk$K@97W
zLvtdo-)YazU)i|x;2o_BSu>MUhCT=NdSoKjZ#6o{^v^l#!P|x#Z9R-@H%cTYCm21S
zQETD+{BR=AVTPW>D!Z=P1y2f{cO+g*E=%QGsCDA@wp&f-W~L}M21-89%$(u8KS1pF
zW}gf{N3EGL)xz&M#EV}QyxUZ0{tGRWX#En`jA3A4h-N_Q;b3Hva1U2kAMW!WzGpA;
zdh2SPJ9B<>kiiw>2Sxs8y>-2GPU>$8((u#O)YUk7{=8<`1%vGum``ODu|9o1{Y917
zYqlw3OP{5vMQTnFnYyf~Rb^SUrbvj?>t|1&FMXx<EVQVQkpYo&lh$pI^4Wa*i7o>J
zg9!rzgBs49o0?ZrR2g58pP5%utXEP|((QNdy!N^Cp1t~hdZ%<WH2a>O^3^?eK6pbY
z!)4E<Gc7f%64LUL(&mYFJYYhz@Yv-ue!L6}4BQM149YkyEXgm3&q*yy%>mhV8f3P&
z*4Z<j50Om+6+Dw-9}C!PGcc?SWnhrOX<Cr0vwx7w+C9goExxgB!)^QXO5cvnK9<{{
zqB7@$(}lzbE#Kq(>jT45^E90T)BEe^xVdVWY_e0!_T8^GB``jm;fwyK_zU};@<06h
z``UeeMeLXNmsZdF@AzMD{{I*87xI2f9sBS<|LjZU!ufK0LpQGRw_De4!7q5E^sq3G
z&XlD=;tmmE*P0H<wm7JKvwvzIvvg&*jV!~9`*8+KO0WL6UU9nq?=Sg3hPsF9mxkI`
zxPDy!_Wsg?zoOafW=mf=Roi@~t+++d`?z~}tFuyr&U)^J0nfiIdo-)wq)FEE;d`Ma
ze;Jls-TUvmThA)HSO51;7oEL(PTghs6pm>#_)kv}(Qs#sI;U>FC26wZhsSd*Z9dFo
zi%hyG+I-JZplRa&&+?7`-|ots%D3+K`e*%HGzu+N`MS-MyvrQZtgXxN`1{2bZc%Yb
z;wvBOK5tR^bz+wFhu*6d&OuB5ai4bGbiq}<X5P(AO%c2I%ekX_<^?U!$}U;)GRCb<
z|MG3c`;H<l`yRG!^<4d<wQZu>gElFqvbJTbCAc1JGVc|gEKnD<<zthiV{!SOKDFPn
zE|2mLRmR5Tc>i?bZl2=4fTdN+-a5dk+$YRDfQfS^lL~`Nj*8TczE!I)*qSn{ZV0~<
zfBUa|#2ZzkWsb(%`*&>9Fm4W7r=9MTRB*w06^E3-^t1@yW48;N12uT|UuxRbJum7T
zQ%L%Xa=y4bWvowatupwW+7+E9$)Db};b7E}Rf3|i$1Sc~vn(liG*#T~tgY@M@i`YI
zh39+Z?&iP#<xz%(<gH$>EuK5i@rv0kIPSbz@4${#U-{fln7>?<#r5jdynT7D-q*Gs
zj^JI<9<DX3aHmT8u3OUUHrPMiSNGyOufE{k%@<zr9pYg6%jC0rm)7D}rS{*<)^hdV
z@)0e4y2N(DB)z+9mc(7m(oC{5)c(Hgtggk9ld@gP?@wIfp0uTF-<_`s^H{Xw@+?m^
z{@l2<FVsuq*jo{2pF84O%2^uWY}?}J_gVA&%dM;zHou&AukdN6ZMkIR#E)7`F*Z7q
z%k?jvlGF8V&)fSpNHX$vSdidsv&9A-H4j6-i$~bT6xr=JG`RV_Deelh?#`5Aas7_^
zMHOBj4xM&Rn>OvL`B&w{SF&Pmm$!B4?_gca^7WeR+I#C6x+W~^J5?jNbka1}rm`Jz
z?S~JX*ve>sMwVsKhu?eK-Y<LDw;+t6uG&S$Z?BhOom-}P!eZm1=_*eh<)S{^I;`op
z<+GZ!%f8d!{`_#A9UGQ1@#7P%sv|~e<${ZZ9GA=%FE$U`8=>g!$yp{H+;x9R^ZnQ>
z>-*p5Ep2&tWZDsye7Dfz?;^>5uQ%$RkI`Rcb+2q%!5jaVE&}`o?F+A%N4;EnmHV8T
zT<smx7pi-<q-W`G@GF?BzQgJ7ak~eik=vH=d|BXEQE+?TBbG00d#=a6+`H}`>ni{6
zpU=2;PMsU;?{;Cait6^?M*T^fuIn8+xOd%!!VN2H+M5)9?W^*y|HIUsRA9H(&azE-
z$8=%e97UBhE$fGU$J^c{c&iKNam`)r`rd;@W&ehMeD3uHCvT?Au<bosepHmxYSr`z
zgCZB+)Y^Sh%mpXkC_S=1qQo|D(?Nr;t>z_PUvKl<!hF+w#vTohGu>T|Gd{5_-+rZm
zu`PPyi9-L$lJgg7?{!v~Q4_yoQQcP!o#+h~8_%CUpxyCGCQ$o2kH%YREtP~h-lsP#
zh`rR6cBPKJS>?;KzSGBE|5{Ofu+VGMxm97#+NOp*`<YfWU%#%pa;tGgFsDnQRZ&Tg
zL+C+SuEr;`|LgqDkeDql<vDLvh)lq{E`{qK0xXMyt&EFbPGVdfrn7!Q$%+cG675pq
zz8^|4_P>0?(*q5@=%4xB!#i0+;KWq+Q_>I4|25rsuAtm6!#Cn*rdj)*H?RBVK9X%x
z_^`Xh`Agcy?Mrq|db;%MROhuX6=Y54upKUVmuH@F^yt=x);UW}8*CR_bE)pPIR9~_
zdY#}-c_u->2L3<C`W8AEJ)CfJ>K*yYe@9+a9GP=Ig*i@gYfgTO6#MS8Yxj6Ynjc<f
z6nMSl;)iY4$9gl=(@TX6I`}4t$vKvCCGM5-oALUt|Mi}vr`2~}mFE@L&HjFPf6(?j
zuUU^XZ#B7}oX)sJBYD+{`4@MG%-c9SDao((+ruU5Z_Y%O%DyiUVZXmE{r0RKpHGFy
zO(}jVD#yr|Q`HmNclJ!X&~)VwQ-zO6GxtsZH%(RRRbJSpr9JPf?z$FF-*<mqhbjM~
zi)R|N89La1WH=s3?Ye68i1R7OoyKW1wgvE*Xzp?r<f(jI`S*jSFSmB5h0)2JS^cK-
zSQ6Ga<jA!wvhiQ*v*e5B+M1Z_0?x|iEFLwgb@!%k63wffd(AOo!BabyJyY%VH|59m
z7tYqdW_ogZ-Mvr#HaEYqsyn`7-nRO;+OMf{`x`j5dDnInKD<#-qt2H-{RP7f*_O~9
zFU190E*zaZlU-gV+GSw?&p)obS9Leav^suW@73zA(Kr3)e1CKGqW9KTikEy2^WRZ+
zuHh<qxaLxn@DYdpJBln#HH*vkUwddOb|UQXyY!vDYF2d@rfhsKB(P8Rr9m6tmWxeu
z^;XZT58dJ$z{C7;{Rz#tmlxK#vN5l#ys%CC@<cJ=>ED>1+*_JZyh%<VbawYM#dVK*
z%%XC3UYd4l@6BcJSt~>S-dB6Ie`fvvy4ZmK7YZGPb}KaYCY%u9N`AG}^4VnuSv|=)
z@#_SG#La(oc+6fCz1O9dDLiv(W&Qt;QhGM5#~qBOgu6Jm&dz1sqxaD7>6%Zx6AxVI
zTX#*2@tj&xzL!Je5%-m=tBgP7zcD(#>*nT^J$pCHtXo;y<+W(Z+U8?dg^p~FSpT}#
zS@X!Dw=2H4JT<R)l_<cpfAQg`^H%;?utQaP*5rcg%Kz;iSJ`EEu{XS4b;<Sll8QF}
z=v(Z{CwBAKEIxeyW!n5e_Hynr&UVE`ool9?=5r65m}AX8SC~!jSHR2kjH(6anZBl<
zocR9DpR$?CS333Bi%w@xS<<mMd6UhH6NhJTsjrv2xLuSf>6dQZrib!3Z<K#K92arg
z$JksdYx}V^Znp2WbM&GPD)2kD&3_&vbnW!sZ70;Fe@*nQNuQj0Z`aqe0Rk&7l(Hqu
zuUlwyN5CfIChNft-34>~|LxpA>l>fj%6_)b-M+Qy`Nt}hb60rtUH4hCF6ndv(}g)d
zIH#;XT6o0$)~(&i>xHxTG$(#JZrW)7M%Bo+;2%#K!@_kz-r+lTA6dwzwczf}qZd!U
zO<t?{lWFsuEgL=G2v>8y`p{e_ziqdz-{C#$EY$)--bTLuXXvR^+{p9b!s)a*OAgHK
zynMDyL#FEb!GzUyul@CwOpX3nQ@=obLQz#|fZX-hi4)Hp4&y$bwzti#?AY{}faR~J
z{cO5W{%rmEd_EJ4^NM@sYkkYv5V??-%U!AQu;QFaMGUD1TV+ysuE#yK-nm%e53})(
z{m)w6dG9@M50!OUH&5hQUI9z_=8W4r1w^Y}iNuS2m}*&?o_0?#KIqK;iuulW1Juq0
zJe!o(!kzcs^w6R3@0)I{=A2?Fl|H?X)o*U_h1tuU1B6ufH+!%5djGyMV&UnNiZ-XO
z-Ag;)*uL9j^M);VXJ|a_5@LVfX~q{DzIfT%M@KsOFKE8{_5H?44fkaSxm9~Abaf0j
zt#8>Iqp7T4!LPOL#!M+j%Xb@A@RxCXb-i%u^kRSOe05QFDVOSnZ7**H=P+owMI7l@
zJ|H)}kYAwnq-^FdMY-p9r<Z)xe-<V;JwIvFw(VCg)lQUJA7k^kfbVBS_aQ+xYq`$_
zk1L)_HTV^NJzy)#)K#DE<}K3m{@~@^Ya)&BZx8y$lRn2WMq&5W)^`<$YSvnxn#ps`
z$2)U%@iKGXqaXRNqz50!z9g<OC8OrohVy&80vB?v*A6(l_q<|Z0?WnPWo%ucZvG<Q
zUW!fJeo6WlU+-eAS9{7Mr+#C6`swMqH`>J?LOm5D)=qsA6SHn!i^S@)%eEdfmGSc0
zt;>0IU$Fh^SCXGn-b{Gx?z#HZgiFx^`{Wd5nHY294#(L#`rbPgeKKW+b&reS2kVLz
zua!LRosOI5IEk^%VP4f5-(FssLm!_1QT)B<{P#-To!@QQTi8qfzj@fe@x$@n!p}`F
zqTiN=t(|xLtM{?Fd|CkkHXGa|%5GE(ES=F@aQ@51y%Nh(W*tvYb*{N^BmP06amS0b
zX`77gJDg>Yw+kO!H;FrwjkznzC4BCzr^~%2@tN>1)N4FrJ*UM^<M8^lcmGq3zBb)8
zTeo8Ghxq;behI5*7p2YJ_W19f=hfa1=A_k|FLr))E&V1>sos~Jmn153O}1YWtdD=P
zKPn*hzh}~GADcbyJGLLaHuD14z00Z`JXYMB4JI@6er5Q;{JJ&#-N!d;o9r9*?yE^W
z_0Dnc#yvZu#1{TK>mdEwd1K|DC&~-=z5m4=FPkqrrR)07nXeAKNYD6ii}&N)v>uK_
z8)`2#uIrl_$){klbmFt;k1yJLo{3P?xN@6ohbA-UWP63Xza##x(u&EK*mXsIJJ*k=
zMj{e#OjX6UP5Nb&SYaFMXvO~hxEY&w?7X>baaP>?>%vv;C$juGob~7D7pJnO53_>e
z%J)A?oBVv+{!42(wF=5RKbFKvmoR)X@DKLhTyD|wuY&n(w)4X$i<*=e%w>=Gg*Vu<
z)D?;B^<<qaogCn&<6o`l=kC#WM%GIy{`S%O1?!v4l#-`!^PB%&ZbrYtgUCgJLXW2O
zJykZ(Ixe9Yc*^CGqy0>SPs~L;@u&Zv=;L{nGWC$cyy%ABADYgFp%!y1%YxRlDZIWW
zC34>Q@sG$|haT`>DfPIwsMT?zctjafx4875HaotFR`M|)>^|t4ZhGA!oK}6CdvEQl
za*me3`5V_uUaB*x+|zVQM8rG2X?0If-p#qavp&z7@j%g5lG*$k-{xDN^MpnIC(b`~
z_9xqV#kosXZ;8(3H+`{M=75L%{WI+rQ<Iw7CKYW{n%A-@b+xfd@%E`R;^&-`f4BFY
z+466@STt^VzV&R7V%*@CQGbtV)o%rfbI+CbZ#Im5Y*;t-`Zkxd>D}@_9n+2TtL|>-
zx_&EX*X1d{7yPlir>^jDmT>ZVx$}C}3vC_Qf3#IKS+H4)xOAMqaO-?ruZ8~llKk7j
zhi(c@oKt*ZxA?;9zy+y`wiNjCNG#V)&0RM6i%)i4K$H5Hvs@j9ViNiyFH*g8c1FxT
z>R$aw(Vx{_UF(fO`%cZ1ZYQ+f%C<S$pSabVuX!VEm70goT1Tsgix0fw_s|q%o|y5o
zW9H+-u@n5B`RCl2H9P)@!VmVVubzMT*CktU+a_DpO*A5=^M&u;S7xlDTC3+~B=-5&
z?PQI+I>~z3eL;bL%?JJBKJJSABw3UpY1LM){6Ko+z8%FjQH@=X*)%S@MsMRymEU<l
z=E~hL{{Ij1PM3JD?l*k&-*#1PYqjs^GO<aI_U-Oh6n>MJ__l@rkD$+zqt~qXkF)T^
z_^Dh_dwaLBeeIQl`<Fbu|KM)60MqP!?Jst3yL0aN0$u)PC%4bAlNFMxP}nm=@x=qS
z74FMewjWM>(f;?hv@FZrPq&&LT;#O>w1R8Jnv$~K)qV><{nH3MnpDVf<n70Wp>DCa
z^=F?=d||)dGoT{>`Q$D2`_|ZAIqg)oZ{A-Qamf;e3rq=1C%!iFZ`-xc;_dorneP-j
z8tN`gwEtpKANx_JKWpXYr;le8EkE=A`sy>`u{T1eIGyX*sB>Jn)XOSqe`=$}r=_jm
z=I*N%bh*2_EnfRp-udrYk!IK3Y@dl(H*!mCc(;^k!oJhtK0B2bRP32BoB8O$`g@mF
zd@$c#v+(?h1c#S*`ujI(U5}K}mwo&|%P{J-O8bIZrrcROZriF}uon3jA7-cZdx7_C
z#j3B%cNTA1{%4|d4*#83-3{TAe74svDlK}JCAoacW`pRhmVegdeG2}sQy<g2{)O`I
z1F}2`X+?{QLaa+;xnAhFRR8;G_32%s#>qD;-dncb=BjS`lm2pk<iFPodoHd2vUs=3
zp}jro*Ur9+y>`R&g29Ktf-bckUmA}EJ}E4mZ~c4!ji6iNnN#;aeca!2=1hgJ)4hGo
zNqTp0SB9?G$0vW>PF&69DQmOIsi$_=qj}W-MHZgQc=5{e)u-!cS*x$^xAtp2YkVMX
zt@}d}hbwVsydU*u*WaJ?gE4>3-h^pi`c&#qx&GhhB)tDxR*TN0Un@(6?Dyn<Jry~1
zTJvfn%gWYApO-P5D+)1q<um*9vkZ?{^IPTj*wxS1R5-e6R#AHYc2g#;M{>s*C)*2N
z6Y>x})4MOK^U)LcinjcRLVx3@)K!Seh^>`#d;O+hnfI?X#@oat%e4D<GIaL0FG+l{
z=4PhSl5f*2YjbbZsQPExSGn5vB>t*mP?zhu#ht?MD!{(umRU6CVN2)R9OshS_VMa!
zx>@%2r~m$8Gu`Q5<R8_B58>Tc4c;vXe^`?i@~Gh3rGjgZR(!3>uzzkFz*g0D<3?mj
zX7%=;v(3vSOan#TLMOP%GYc<Q{I>OI27}0rwHFv3m{?y>l{@*x<DmPteRd+r@8<NV
zERp35zS5s_|8@La6|>22c1o@-PSf90@8X^NM)v<R3(wdc<$ER{Xn0-Hd{ZQCyXdzo
z=be6+{;gB9TNq(wo@B8za^X{>HKJc5_di#zQ$4Wt`OIzQGyAG^K5ml|X?<WnseWpE
z{<HZvJD<jV6`MWjWbPhz|H)gcxKyV`Oi%f|cZF2?yu%jJJ9!?7{50PAZP&Tz`>Vu{
z#1<Y|bp2|jhI0P)8V89jQ!hNa>%X@$Xl71_C>v*S$?44}>nHrW&T(RM|A$*n7u>Dq
zwC2RfEqQy2Q@*m-+C=lE#r4Y#f^&k+9rw*!t=p~s;k#s8`LF7$2O~oY-TmiApI>rD
zXG6-5ii&5gM+}w~*)F*xwe?4+qCDfTIa@0F#quBIzua?b%PrSs>+=Hd`1Ma}N?pBo
z#|zc%Lb@~aWX{FEo{;b>a8|j9&!0UCiC?Vh1w|8rGY?EX@_L$8-}5C&sgKU2Wq2AU
z3hs=(V_eGe;MTGV4z{2h=kI(hz4GuBzu$rnd&FW_8s#Q!ozZ3Fs<JaOUvkpdtX{cA
zjXpmw)NEV*aenxtcdX8L*XA!}+RfAX{N7R}b?-#|sozSrJIBZB1$BLP+OIFSYTlx^
zn>QUjFu(W1y~<RR>#_fCZ7ADhv+2w{@wBYHN1|`J{<4tkmD$WS$=T)4+LhdTxtg`w
zk^-+@|G8BEz_a3b9Cxkc)e=ujqi>EMCpzqmlRfX)Ugz8CTDFNfpyC9BWB=@$JGqYk
z(x+-){<rl=;oNA=T)!74FAv8R{a}8ho6ebW)>?%3Yl%$W!?mwcHQt@PEB5fd_NVd>
z(d#Gff4c2`Rpa^PWo4W1C|*@6-K3YgJ?@Le%xKo054yd%KXi|_ADI7r{mIAq$q^=@
z8>2r&u|-%5PY;RDG8FZcjK4E^iO#9Hg38@nZuc;5+tae(-@$&fR&yKm$T;1nCXLS)
zbZ^vJbL3?~?AJWY6^6a>-_qvG%+%70Ox5d-sGQd%Y_IR}dFu~$-R0Me*UCPf{FdeD
zuJBz)0@tbrg?xPTWKAnyl8PwLlSSt@wEoR$dAmAO`le%aqVZ%e0p)3&8>GDx^3I(2
zT;ntA<4ZyF;slMTx1QD=hZfA2&6Lk6je5+wp6jl`H%q4Xp_^_9iSsVM*khG`B#HgQ
z<SnPCyxU>3rBk>?v_{M1mvT)_DF4;kIn8(GOs`(DHb=pE(OR7qZ4*uyip?!;Xv>a?
z@7S$++?u29LH!5m^I}ipZY6ck_~!h7eWK*QIbI^uxSMQwWR}^<uQC>`c38BqRf<DT
z{P(SmmY+A33o8{D`x*S>w|oCrYEi}1xb@6>3m=!w;N2P(ywlQp(!T!^wyTw+e)=5N
zDu_S0K|lM*O)c||ANlWGKen~3e)sit>Y?IA^N(5QvWmYs@&4+Qf(<{JKOYEKX^=Os
zG5z|5_GQIo%G<5D|5vL2J3srN{@>sJcV<7Hc0phn-+Ld18$1sU<aeERk&|!Wa{hgL
z*VVRp<!7=rZ<zhQyD0ABe&g-eE#?bOxE+=2$`G~Q`JrHi%z4oT;m3FLh&nHMVjO+k
znbkCUTj#|0yZ)d0x7p$KUG1*tj!&YQ<-S*Nxip_%>N6|u`NUgxS7c3ePYB-d%20IJ
zpqnarRPpINH8yAa*k_+T-Pzq;jq*BQbL}oI-<@#e;6i=2z294^1>B5h{t%zN&#~g)
zoDZ%m{&&Uyj(1<Lz`x^o>)fpi=a(Keou0$|?fX;)23xb^;ubrVkElAQaygZ2xF*=g
zsm|Z4yJ5dC-^b;FyKGiGTyi~ep4FS5VtgS9Ox<GX2HH=WZoWVNulDmdfu=<JypPK*
zkIFrE3yVH*I3mq1VBNB3PtTlO^3r;ewd%ysHx>t!mVG!G#-(^-_wAZi{%ql$jzX;Q
zU5XbU7j0Hpm?Jx*`=FeQimY6@8B-$TwizEbhWl;W++|oETz~fS-xV&t)2F?h;5UDA
z{oERfjhoD`vCp@Byi)U=dFL*{q}<o5`-+<_PA!gqpr+qs{ixRFQ+xLxuj+XJ1s9Ba
zbMoQ^&Zj2#ZdX-_m@Ze%xAn@Ah*yl_o0I(%)``BEplkS7UvJ}8X4fy*_Sc&1;8UK~
zvFgLB2P-(9KVLQbrI_9~E^X)9J~`o=>v!;U%>Ve&UA1bb$BcbXR|)w)JX!QvwCck{
zp3ZgZd0Mx3uMMr{E2wO_rIWbPccs~ZwclFnOI-ECE9zwT-;`mIWl}ZCm^^3EFNIBf
zmUqrGX38hnZanFBE|PtlzGv3lXLpx{+^8>{cy9Hh>s;=vE|WMPp7^Z1Lsu@1fAZy?
zHF=Wab5`eWG`e~JrcI{RSIap)|IMxM@!#G3ZkGG{lhTf}GIg)?pKWA+=e#lLz{=*$
zEOu=S#WTDXO-R0ZFEE}hHGbX4HR|>+bBa$%eY4?GTgEHM_x`Vd&GwZ{%crdQ_PpC=
z;q@XGy{>!B=NW&^-}XrVPekt17r$?~q^cM6c9>oGrXJI@+4Dtnclm`s+NF!<{C)gx
z;paE9H=`}>r@vSp`{QW+zaQ_uOk4HrTkz#?W_O$Yu1NIzxhF^H`H4JS>MplS_0krN
zh`qC{A9*W3eJy%OV@3Vky8Uqr3i{MtM7F&2x%gFC_36LBbv$>2S4iB^bJb}HS9y0}
zN7jL}FEpn7IIg|qZ?V$X(#|cvEz?=d<P2<HUthR$YUWde_9tAk7XQESs`~oNlc_Ct
z_3j7$-@|-S$mRYrkJmrlVw)B>Typn6xAB<zOZSDGY9BVN=d0Q*!4|&etH!gnTYeXv
z_&0UFi|gmQE)IbsH{2D@Z+RQl=&K`Grt0&6r$4Cj{LMW@J5=WJ*-BlHUiPnU!>_6T
zp1!|sdrmdLPGw28?SikaWh-xbn9VP-E3CUN-?x3mt?h@eZsDo;XL{vR|Lhp^`)V>7
zuPeBigdT6GEuHT0`ra0n+OJhbZPS|e*|Pm_U{u}Xzx#RP+1tK<u1@_U!QZuZQiB@X
z-Ro~6#6F!8PfC)J{n#KUI(v4mTg4mZliX_`Z!Yw%SyUI<ZW*BeYwHeYwYk4-C;cq9
zN_{okZz=0URi$4$-1E8ucU(Mb{c5l7$JsyD78>X#iY;J1@jOfI`whw6K~H$Kd^F?U
zi9U~iuWEF{qeSA{*J-7Tj<~<Nzd!zXn!uC5pY6BOQlHCMY<SeU!dzHtS++{ANK1#`
z$^&di>R8GxnD(V_PL=ID`dlG<w`Ak|H7A3zq#GFnywhhYGbfr<FE!>WjgX1bR(c&^
zx7>Qe_rf{$ceelXN)F$1SmbO#t8Vc$VQIfP*>dR@T2odZvG^D+@4;KH7h2T*kmHZw
z&#k|oS~ghuofKRB{`aqEvKpEPzP^}v*Z1cwnbQV=9X1l5xeM+kF@JsfajX4>@81OH
z@Ff>X&CDqbOyga$^ub{TDFFjZP4-Lg6ZhGN+nKff{G)Ajc>aus(=W^ZtKk3kai4fg
zlHrpXcjI>yZ(|V66Zw+WuJbtQyULZ>0m0=OJvDoNX58#q{fX=Q`{#`JviM&2MQJ+i
z+;v2CL;JF8c8}jZzw{<G@;sB<@l~rkQ>8NPqT}8>elq|6Z&l>Z40g7ySD1Jfr<hOk
zIc9wN(Yo%#D;>mEC9QB*V(8c(#<<W<`0*;e`#P`J&3t5P7JG9~sz@)}JE!HZRMv+j
zUW_fMZ(&;Lm7uczr?Fq-`^nGuuk^HS`FfjibEV}$Qvseeyrx$I3!~HX<JV7)?my((
zwXR!#!Qy>U!7}d?IF#(x<#A11|5GxpeOK1B$7>nR3$ni!f6`MG@TR=gUwz_?J4rWs
z0u${nocHvX`BU*fQ{e02>i8!WK1H`ZU!R$;UsLsT(NWJ;X038t%wq1kzuw%REwI}z
zET@ZM-}jih<oz<Y;+?~eonP3>=lXpD*QU~s&kVPn)#<vl!6o*K!PdPQY>b;)<=$*g
ze0tHUa{bwxd#45;{;T#$xtjI#y!SuYn5R3eI{o)&z`|ACvd5Pxmww-}R7c>4;I6;_
zJ}v2VvYjHm<Hd)g_a|xAJ!844W4calZgi9b!_JDGFU$CC?Ha7P{$#A3Zxvboa*}M#
z5w*;a{QSLrF~VnsHE!^kc3yh$MQquU!}2AiF6A7Zb#Yhod)01+cpqKa&&+T;JhFJR
zcEur<bd&bUQxug77$W2+NXK5^u6jW6&En#}-CcXKrYXNU+@<N&VJz<QlyCdryRql9
zt~?2SDbklG|1C{KBXkF6cU`5_i~KC>1?%qy-Sgk%oPKh`K|3S%SozqAh0K+A#D&wj
z-l|+?$WdD~X^}P0FO4+oJ=;7T>rU@bnY7~LVuATr4jBE2(92z0(w(hwCoD_nS<3#h
ztQ-G%YHWG4ME(Z7``+5;6096Nt2Mqt?b%V0q9^}uT|0Qnhc$lNvEl<<|1!Me*-U3W
zD`Vuid9FsNbX|&GtNODAnkwam&JRx{2Ua}&>@BQY`*%y_kHzXQFMrD2RXr(P?vuJ$
zN|@T)A6FkYv2!Tg$+&+z$<cM^9_EK~YCm<^m!9bVe)oFv_Q={VTC2qq%-yVtmWlpI
zO?dEqbLv_j5gD;9_aC=^*tLAk4~5)+d3AOve{a4%dvDj#DdB~j7G|f9$mut_OJ6rD
zSf#nRDrUbxf6DKZi>7PYUkqE6SIO13SblA$-|7wX;${C&y>RT!grv$t((OIsx`H2F
zmbBV5ulE$;cYhrx^V4AapR+E3A9R2HEnWA|aPba-jwdUHO(y(}I{n3A!yNw*!`g3)
zCzdV{o;&r5MJump{>i7i&HwuTH8uSBw((^1g)QpVw`FE8J3jleU!S^EVnI=)#;G}c
zvJI<N2j7b<d}iia@&4GJiR~seZ<)?;*~#Cvo5g+9GTrv|=IE`#nX)?HEwir)wtF8b
zdDr9orKaaWEzei`J8NIa?|PAYV}rqxUAEGBFRm<DeY;lai20{Ory3JD*$$?s9?md|
z_|5V2%vy&p#umA=!ZWK48{}d_1x_qbvoedjHS_c1=4IBuoq48*FWeE_+RJ@$kL6T-
z|K5L%c9XTYOKY1;JldWf<m+dvB<dlzG1QFj@!H*u?Rmwk?>RCmm_2KEX{wP|<vX~U
z`A_5{qmtL>a<@%=@qbVJ!ng~HYBri4lI|Wmk4o^X_V{K`PJEIq6%*-ouCT0&k7N5!
z$q&lg>!RDuc1m5ZTlW41v$kh_u~6BiSq-hbPEX19tU1-X+vJ3Lt<iRy*X)nBOx4TR
z?dV+M_bN+CNmRS9eWLGq=DC$o7xxOzcBy9Ou)kha^nUZVZK?5n<#ok}SIoGq`11H~
z+uFHWn<}_sr`2rQBJB1$<DF3-_r#*C#XhXNw{z#rIVGK!ViNNH!})G$w_b6UWJ|Go
zAGEgLuJ9_`IhUs@_dSQ*mzeA~o-0^dZ^rkte=mCDeW6?N?2RzyqxM-x*I#GU$=|w#
zFRk0f<Di&8o6*;;PZN7(4kkOFc*{HW%pz@-`!YW_y584)-L`T5j@l2`gjVaXl+m1#
z@$<W8TEtb2)!LOEa<?M6zGrD1xyE|t3g=XVV)vx??7a0WGR0NSvt3%fXNKZ+w}&?h
z_wZyaWO*jk!TSE{Wz~>&Chd|dk92Q@-{`zutGTzXcyU(KX?=Z;6^9wDiw-5kt@s-i
zAbUj2%~d@m@|ldllANR!TyZb{rR3zzbr5`|{Nw$Sf7O2aD#cRaGR1pJnoe9?H#uG|
zL3ioJr;7IvmGY#E^OaaVyq%u-`(D&<-~PpkH`aZSGOzv4cqz_NUajGSRP)YD>o^%c
z`Z$&UUh#XI6pOAr&umuP=SFsVZZ=P%nf`^(eiZtEYtLE9$C|ACH?O;I-}cQl{Oj?v
z3M)E=mE@0pV-3ib{9U6b?qs*?(f&!l^K%;P4;@f277FFyxg_8v6l?vb@n}`j(N?L1
z&b<~N)3oaTrPRADcmAKsw9u;m<x;Wp37&IbG%zV&Zq~bTQ&#@sg@reonbYJ<xAff;
zTCRKecSiO8eMO6(u1&4{%4c!(y?<Mr^BdNrrl8D&k3-I{QIns<U7f$1r^q(N=G_JT
z&nN45)Yj;?=W`cYocJ==Lp@4f{-n?m{<+7NUlzE&uO{6{d?KgNX@Q-Sek8c><$v){
z&HVNE?ZG0+wH-&x)-vtQjNG68?MCe7-gPS3`wDD+nM4*b?sUG+c7D29O-T3tpxEy}
z_szV%S@qklo_*(aLz%4mPw6(C@@jd_vq7Lzp66Qvmqx?&YdW>_C;sw%x5#4EKda&j
z^PG7ZZyRzSoRBbCsxV2}PPV%?aZS#Gci(3gm#22EeCA+pm;C>@#9i0fFKab}{bqIQ
zME0G0aAw=GSdo1Z3)Ab<T$y{G)#=Bazq=sb!l*jz^#ynTFFlLnubfS87Yi-eQ>_qI
zdDZho-3u><1(y#Am~_4}_+a5vP{p`y@9nNB=e;*BJ^23W`x%c{MO_gMZT#c-q_;1N
z<6i&GXB~ImO)i?Ybi=!qkHz@rpTChTANuHJXMOGGsDE>2Mf&o_f4!0sb*e&6ZR1+u
zwtX8JDw>b%EoG}LOAPsO-CER6FK_>}y4W1K6~9gGKRNYl%kR9Pc*wlM<YQZz)1=dT
zXBNL#iDwf?)VI9);bfu5lPdOF*|WcU<@ap=Y#hA1GVx$Q$EO{i4hVJWOsu@ONAyqc
z(p78u)J2<4%>FI&@;S4H{MmOaIp2MDoTE|l-)~ZU?40uCt5?#6W+=#KRL|MAM_Tj!
zzm0R7H;d<Y2KRltEjzy}z5C1JsXbS}i)WWiKO=VG@LCQ1IDf|M)3fJhJ8@l4I>hR>
z^PAe;Jtv+WnDfW<_wP<?R%z2Z{+fjhUdyM%X)Q3U=xD6?YQ!$*`m&UN%5zcUyN?P|
z+1aPPdEQj>WZirIpE}QH#U;MZ^Vcn&)TXgv*33_-XXaG1rk-CVKd&J<l7U_M-oy7N
zUkgk<?>O<i?D7B4gFpWdXkPa7^YPake!f!Qsr>AY;T+$`Y2oViI%`^dp9xP^vI<(m
zQm|Vh<Hp2jncDdr^^M=>--tP+;_lSERx$GSo!t)>dX)H_*qWrO@v|c8)UoGzLesB4
z<2!b*d#U(0b(5SU58pBg?(v=IU6iC{xw7>5$E5R%4!@i=--k)$dTPUr$IG(b@A}px
z=louH@8fCg@<o*%OdOTIN24pt`V)HQX{KI$vT@aWHW5elmO1lJ9<BcRNB-A(z31vR
z!l#X84sJ-BpH{o=(Ape3DaHr)1B}EC9@IVZxOsJ%wOn4`%tdtpllRZB`dQLww1<H?
zubn?E`+&6Xl3i6c+UC=rOr7U^F7RSl^>UX9bMA=EQ>dHp|E9-pm-9!wFWkGyB<XF}
ztC2TZ-gaZnI|Fv!L$OoTv`&gJ$6eTdi@#d__;3Ed*Qd|_u<Y64XO{gPIS=xzmK^@8
z(|hN__t<G{5vR3+3nEu1*#>|79J%`Zm;LkFf41y*-x)V;Q+kiX^Ix^EG}x;n6WLDQ
z)$KUFT(2+LbBE$K^|u0V{wlsI|EF%1F?$lL24`@=@k?1e3G+3MU;gqUKjp>Z?l&EW
zt0q}0?|m{mPRM@7W#gXOMX%k=n!M+3jhm&YwJ-m}I$zt$X@_kDj_m5Y!E<ZXpOpfi
z^4ClK=HL5$oBze{Gmmauvw&ey`Xi&{>Bqk3*QT~jsF;y>bL(YMEycU<Yrk|@M?d_u
z*!Qoi|91KHo2Anqg~=?^eOgpfSEz8Zw~a$#Zo78NriFL^YOH)Dr17n~)IH$_|BL6s
zcJrq_P101W66O5b!nW?E%7bb5dUw9OtE1u-l&z^hMRJ2@OvY@dL+>;1TP!*Hf9>hN
z-9KvXo?m@(b<5$<l7d_ET+=`LSh=z3t!vp*qVHPpYUVMf6}z;IzwbDF^1E=~{s#GF
z9QsPy2|mtV>~CM4SmW!r{BKN|OwaY#K?3XaX0O_{{nybm<v(^y|C}B9J^!fL;VIV*
zuf`OKY;}$;^J84y^d$K5rKCze4~Hd(xr#D&{{Aeg`aX8<{*LHBb#|%$ujw4$;(Y#`
zE#uMV(!H9K?e#7zcBaTmd2BRz+U{YZ(!^pa{@z1osok1qSN89p^w#do9|>6{(S@&D
z&iAtK6MY>QxLbY4gBcCizn@q%(cR?7SGf(}g&yfYniIzHr;1^E2romTxnDz7rrPTm
z@69`6MOYIf&$TYTAl>R+GiM>&oxmHjJBpv1&Nn&n^-SZE<b8*87+*Ox#vWOE)rxl$
zTj&P9dv;Hz>~-T#&9Qek+;2SJJ}%urbLRx6<6q`%-Sx`u#%A@`A?GC%Bev-Jd_0^Y
z$?v<>`mk+$-M4!ielY);RQfvoPs+;N0#W(vKg{f;T)T5p_uf0teKmx6lh+ShA=WEm
z7iByD>Iv=J>lkb$^`+75g}wWd=pLVxO~EC7UAMoL=~jBLUFj_0zhe1$LEYus4>@GJ
zE7b38de6S5)K2cGeY@V%Q+b~EnphtO8XXDQw_;X((DR<vrY9cfv~_&j(#6HKKUeSz
zv*D_?ywcfLYwta`5N;1R%d-BQAk#(BcKxFlHNSG44?HL&)0A4mv-O&@%k2m6zGvJt
z{}EuGC+Hja(TgvteVG&IhP=g(rV4QUU_PT3y8Zo<%}TO`2Eu)wLOq-Q*L1$%PkFmz
z`qsmF-|hd~2Y53wi7-Rf{DW2w{}f?<Q6$K~&}huSpu>OwTN*)Z@Evrp#m$K&iTWuZ
zqBtY5C{;f<F%N_d^}&kt4AD)FS}QkyFCzm(12Y4I7sxOu-qN^75N&S($WSDc3-WWa
zGfQ+0^%IjzGV}9_^^@~+^}x1(ufx;J%quQQ%*oL!$j`}4u0*yMw3v9ymPc*5{0t0n
zI*_%{P-_{sG(HqYvlqUnAty6AHLp0eSl`({Akx#%9obA!D1ppi0uc-h3}R3kL~UuD
zqzp9^>@?&Xd(h38y?EaWH)aNgDt2@;PN11lkXVwDlbNJffZ{ihJH(GYe}00Afx(5H
zfk71H04Uzl=%kM7j*`lP%)E3gMkFjqk}DKoU|4K|ZiKBCiV=xL={cFjC0LBe$hh}#
zdL;wHJOw5OVW<m0)RxAFRwzb*!vu=~Jtb<_-zzdOe6K(cij`YX3`ou|N(ChhEM|x&
zUS9p2iGjh76Wt$YuA!Kbl3I|KnUjjeh^2BG*Uf|&80OhBfNyL8`2mEtG(NkDVnk|Q
zS#o|}S|+yeyrywY(b<53L2WDKb}x_tAiSk9@C~{lnML_|xv6>B!qg>LZ)Y?c1H%Rp
zbYo7-Fft$#zkY6Faz<ueDh@B{Iq2=4Ai%&-ZH^wYvC62%B<JTAU=NlnFBi8?6J}s2
zb!R|}UPTjhGxE}~gzF-XnYXO?7#MbGphwLMcT@vXQp+HBTB2u`DQ|SvEfiy5V8?Jn
zXc(Fi*wg5nI<EB|ObiUKSkU8EJr~sg&^4Pl(pW`bw519o1A{6PdT1`m$20_cmYo=V
zN8p4I1B1UMx<mdHV49Jen3;zqL}#`4&PtPGV91_>9-=>+Q4LAUFUn2CmcV$`IA2+F
zF))-UpvUT@MW{w(=4E0tAU$bGNT~(`gX&!L!1%WY-2iC$j8T3q%(!^|vK#}0VHE=d
zs15>U6cFChxcn-*86`#eSVAIQ{IJ(bQ3eM8Kn4aOkX9(((zxaestGyy*s^OqZ<Os+
zc?O311?VB!%Eg3|&k7QYic^cQIN{>iU_(&}28P!G=$`P^LN%f|wWPEFiwTK0=iGEu
zU|`U1VqlPhdH_UiX`JGOW<qIFK~a8IYH~?27IUU9|E}*I&A>3Lh!HKP@+PC2Q<93c
zB<ImlI#S8Xz_40?fk6S}0w~_n*t!qZfKpJMo0O9pkEclP%wN*2!Nb5{qzBo?12v3c
zOQX#Z6w~qxN;30GQi}?TQcJJ~@$+LbP9Llo7-IjR$I`qD7$)WCVGEn}m%AqK6=7hQ
z>VckI4{|djM|43^etJ=2E;cjHzbN5)rOd#<y$aooO$sPx6s49IWn%ZrDxP1{Tp1Y{
z4l|+0^#vCcGZKqS@HHPC8rTG<@-i^2bYx(Vg@r5w1H+a^UpEYM@Q3c)n_F*i2r)4H
z@n&F<M=?q^1e;Ms`NajP;HDUsG#IG9|9}uP1H)84bay4CVHj4BUtCg9l%Jehj4ill
zL?|$qaWXJWvO%u{*JolHRRs1V78iXs(YKkw%D`|%3*DHQVhm%-GK(`y^08%eP{6?2
zd~zTT6mMzNu0$~=DKR-aH7^BU<Ta$Jd{vHPU=W?m2;Nx>HHu+NV<vX9pk`tVB?rY_
z&(yXvFwEm*W>A6|1WpJiu48pqUS?iaBGf=E!8L7m(az_L3=G$q85k5%%+u><LCz>p
zBlPp~^HQN~EXJ8{`W~=0kAdO&Lq_n<K$wYJ8bc;xHLk4K$iUD5w}INz+AQLk7#I{;
zAzKX*20AgYVsjtZKqK4+{#2NF3S^)HhJlZma2sfh+rV}=kGn}s3=HxZ1~#$cHqaEe
zf%@^+WREg4Fzn+*_p&MnZUfD68~FXB`j32O28Kf%=mu)@;5N__w}Glp3KiO!85rJT
z7<ii>r-4RzBE{>N@SJLA28QM3jA*HPu`pHxE0Xh5@FYVC79V*x1_p*y2K2fpE*!<Y
z<iw)%e0+J=bZ#xnW_AXKlgf|{zlijA51UEgJ`dJPZB^7ZWgiX(hC&(imf)#)EKW*J
z!`6P;CcW<2O(g~fg%0$x+dBh`A>c9+XEi(X@;CJaHU<VgG4w!6?8ahPZem_$8uo@n
zAt&qXy(|n2IsE8>^m`%}lgd(yiZk=EwRGDwI{gY685pvd(Vg^h8md9LiP@?6;;kn&
zC#sK!fg#Emz2coS1B*$?`MJ4RU9`1Ya$N>D1H&p!bQdKp#bQosMQU;>_8O(WRC>!P
zUIvC{BlJLG*@(p?P!}(;AQMX&YcW5dAfBCpVYxVZoy)!-i$UqBd8tK-*xfX1)9J8d
zW(*8=PteoT!edyB!k?a0+eD)7^Dr<tYM{Go$zLpnfer#o&cNQ|ae2`k-lD+3kko|k
zu6<l=$fbTVI31J}B_^lhY_ZSXZ2svoI|IW4DfDJ;y*4hxN)n6GQ?a(XK?MM;VSrj;
zPB6w|8mMoHFP-W+>i+g%W?&G+C`vElG_Ig1H77qYMGx$G^uF^d=PDORCI*H=c68rH
znWMT7G6YamjL&&aYtuO7I2jmJ4A2wpO-mf6B^KvmNwnT3KM(&CWMEKfL2s5BIO8xV
z8H+J%yY6qzVP#;56=Prk9eDtX4G`Yam>P=9nE15PJaGFpKCz^vC^M<FBo$lBN_f-l
zJIl-%7{0tmZwbjn<1!i+gjig9EIH$XpgaS^p*`p!$2bX>aRu1Aiz|MdWPQoXz;Im%
zy(IJAh|3^s{+lkpe~*hc0|Ub<^pY%RJ1%odQxdUw&ChDn!E6==hHxIpNim=Z0O2i-
zuO8ttsj?&kYx#P8r&1)3JOjg#PV{s!@i`8&Qm{D5^S9^A|7HvfDRSsd>?>^SC<O*A
z%JfrGOHz}u4Rx&NJ+{bFl!4)T1$yDbZ->LIwEUuyqC{*p+T%4%zWZ4j7>@Fzhk9!;
z4#Tn%%dmy|%}%qX5>^HVHH_-IE)s`H`AJ#WGSLCanX5qk{$5e^_|u8UV-nWXsi?Cr
zVu=s~gQPXO{~o5`FsrB(>uAIh1tzUZP6mcw(&*L4{&E~96_;nGVT(bo3>C2gP6mb|
zWpqasH{vj=EHMXLpo5Y%th84LaiDlhqii=0lX5dFGV|~jsw<@e?J`&x7%I6K7*wDJ
zf~YNxDFh5nEGWP_mi_yH-t|Ow1_o~l2DJ7w-vs>5Of14yT5pxhb7BE?qIuDK4C|-k
zH!nH4r~*s=Jn8a6Fq)5n;eal>m%q#*U|>!n)|rgd@1{n9_6!VnzN4EsaWx?mGqbTx
z2s9?KJXT_5U=ZYEU_gy)mDdDJ%+D=IPA$Tg6l)j!%YV+wzyKPSR|Q2f6mMzl{(#@m
z)SRTEQfvizho?|1GaCa#HXj3nCe%0(wWV?EHv&fH7AF^F7L=r7E2&N%5Y1+gW?=Xe
zfu4r`|G{r;dR{4(D3_}BF@Mj_!0=WAJ%a2dIItJV(5wS$W`fR$MQ_^dzIs!kl$C)&
zL=ZiK3KR&KSe%oYmyNYwmXX7FQ<{^3Ayo-IG_}<58=9M1Qj}kwT9l0~k`e@US7)&>
zF!*qzhh~pHeq#&Lu{HYN6yG&_#LB>6D2P6<X=Z}oypqJ?Z0wVP?)R@BTFA=4;4XmP
z;)$^$U?w&vCiO66^-3@>{0?AX0JSqfX%d9DG}<`eH?AzRxHK`RxTG{C6WgeNzw!Oj
zhb#;X)flCbP$YhXE0PV(up~{dtRummJPZuk3h2d~NgRrSDX9gic`2!R$(gBmOZ11O
zC;x1eVPH64gx+M>mxbHFq{L!u<<Q}E>vCK{WyKuy7W|raJci}x7h@}c?yyRHV^v^a
zcvX&Wn*Lhcrh&T_SVB(zcle<c76yhQ9`ukaI*Z4&{KTT7#7b=W<VQ!>$?2R747_p-
z3?M&)5)24$X%xSN&p^<8ET{*G#f{(OoBvt}Ffc4IM~{q;xA7Q>y{&6u>GeB=hk?OH
z1wD_Xy}@l5&bDRVgRS$WR2Ue<JJFk7KY!pet_+JmTMqi^2}v+8><LFV%U_lgxqwAU
z#VMuOmKGRX{`rBKgMlGe61}*ZYl_>fw8Z3+{Gv)MZrj_{^tuJKOhFXA@PA;7$GoD%
z+|=^?qHHWC#>H5zy2io4z$lF#tIJ$*o0yT3W{SnI?W=Z}Xo)j0tjj?+Y^NV?!*Vl=
zu{EbP**?D)<YHjxQAUpkg)}^dVIA8Ei?;CglVM<p&qWWn+ydNY6=bL5T%qtg<A%f^
zCI*H8cJv(kw+D}jIf*5p$z&{HCo89~o+HM<AQFh4BdjLiF%VY=u!+-M$3}#K!OjQ0
z+5dDIZsQ8E6?K=>-DXy^GcX8YB)XX0xQ!}KPRvOxNKD3-=&r1k+@8kAz!0mC?l{TA
zxJ@j@Ry!_qPqLK;4Z`!F*N(d`;x-CAeB|t#n4RjASzH1>w-LQnWbLu$+5vV326+hv
z27OS`3B_9)<*pKKu#ZoeFX)&?bi)%Ex-7aF85nw47#Q@R27{<AjoNpKF+3o#B*QZ=
zEgzfNAah`SD-93_inlZ}-X~yod^~8GLVP@y<QcC!W8HB^28JIj=p~sas;Qt>CUg!O
z-w4<`o`;?jWEmKKZ9+FM;30}Dk<EiHufaC4$iteN_)?I8!O;hO1WVyRPV?X;cx75*
zP7Y{d23uWvhmSkUay|n?;W;L>x->+P3%No-b}AAZOK6^6!L6`Vm4PAr5c&ea3mb?r
zGCv8|>V>~a3OTVn3=AJk(Ay>Zui-Q~yF9Td9h=t!)xKO&5Mp4kiAFEwq8{Tk4ZN-j
z$C?{U&J+1}<QNz%s?hryyT9Tzu%xmeH9k2bH5o^PTV<Q?ML|Xe2GGhi)X~d3BHXwl
zsGuk_H?t(O41WuBN9|n2RV)k)JNXzGw4fOYL~Uub5F^HDa03lX0+?>;w&)2H1A{+1
zdIHdrCdS;P{QR6$tRrIq`%c;{W@cbu;YROxMaU6ja!MxF(L2}u^R%^D7#O5^(H-oh
zM2xYZ{E&{dr?`9Fo^!7m85q=A(1Uop8ZjmpCFZ4LYwu6eDzj7LWMGI<L9ZEJX%J&>
zaY+&O{+<4g?PYhF7#Msw(ff>%Mz{<H^-1s*hwg7HU+rRKV9;bi&lgpu_{}WM%gE13
z!5XqfHLADPaWXJmkwZ@kmF9R21-TY?5mP<=i^x1h1_tXX3=F6hOr9fNV^dO-^TAVQ
z*ovA})A9nBGBPk+VMY(tpk(}}W)>$V<zNkf@{%OylMD<D>lo2pYMqML%+!kH)B^A_
zX)JlS#mmDKw2)v47kb~yD-Exy8L2r1sYTd4uk}iyD@mS#L8=42_6o|vYa}RJL2Fx3
zq+xMw0{>ZmJ4OZuEhhAE{oje#===hl^P855mX5a=7#Q*y(VOOt-6&>4hKKO>@!LdK
zN{TTtFg#>tKwGvqy$7pVIQ;4S`k?l2ZU%;nI_QJbPy4W%gR?Vv<6GgWTY3x(5#P{T
zr&6=AngsPFmcXCzZO!Dppv8Nd=mDjF3dN}0{FKrh{8iDh!fvJ#Z3YImJLpq78rQL#
zg}pU@#r><V2m`}BZ}bVY%S=4Tl_ktcxW+8316CcV<!4}!@I;TeNO9~2VIK-;YgqWB
zij{$(M*!VHeCk-uNy))Jbj{wTkT#K@fnmEjdP+a2gVmtaijvf#yu_S%=xR_b5h(xN
z%D{-1fuY-sfk6UP@k8;J#%VTK%}m3Vy*<{~Ykvx6U=W|j2pS58ngLp7_|FroDd~Cn
zx!CHoM~?OFRw4`xJA%*?x#m2q24&=zq~v4kU7u&#`d&bUfx$ZhJ@)2q!fH~cp#`?#
z?Wmf}zS%4c49o)PDg5a%?B*n=7MJ8>ogRr?5zrgV%D}Kr5Zz6CPGdC-$CRF~M?6y$
zGXsMa2YM*EU&Lxoc4}o=BDSG%iG_CAJ3#$3X7r-q_7$uq<>sg0SQRX^%Xj%-Wd?@i
zY3O4k=dNKj3g75M2z%^=wbBd>T50G$<oJ!<FkIsVXRd?^{0B`s^P>Cky%;aH;-CO*
zk};ONB0Xn$l_Dbp0}~T^0i`K})u_S}6D-Djs+-V*-IzvM9L8W9i;|jLW~af(z`%{+
znwxSsjKMahogeCO!&ZWUp*;vaO<E{mH3r8ttW|~G>QkTzD}Hoy)>>dSr#Leg+l>4+
z!3T4$aWXJy>!2s2^>*0J$uBKRPAyKwHnL-2?6}6Boq<6>3_bD>d0;iHJh3t-F%O%&
z)Q(ASS;fu3uuBEqD4PK6MrG!u<d<VBEtg(cweboA1A{(B>q0RG#i(NNtQ+3eg^K&j
z3AxM+4Cx%`qiTk+Sj|cXRW6_*I;{IW>Rsf^Pct(xfLhh4i@fh9;5M!#GX>jV?(dG9
zi=~(t7~U|Wch#S!;4myTF|VX373(@1Sr4H%kt_@hkGau{1lx2RrezisU~|_q*6rpi
zSQr=%@SqQtUdYC75@@wpd{Jp$d~!)TwsbZ>*IUzrk%8eKBf3v_72q&2B|g6>zMxpI
zpcrEhWDCc7A9+Rwh9!*XS;?UYyJ`7Y{b@gI>!Sot1_n1R^r~xmF%EOeQi~F?b~ev`
zUUZ_3k%3_b6Z$}jaV=J}Qc`ouGfOgxOViRavCZtiS?*nA#?HWyFNkj7uR0tC79=Jo
zm*$q{B$i-nI>>F4KTspgz+mc)?%TpPTn46PR$%Q{RVn{V=H_HzC{skw?3%N1nN^&O
zb+}>;_uNJ1j0_AnF_K39V(dm`7A0qZy8PHi0nHEYnI<R5z##8}UOGNmg4MLtyfUL)
z(3(&z6_I?)&aCS!3=Hmk=>0tVZP*QiwkL5nCslSY+1Jd%z)*`(+eYrjYGit9Nl9u2
zwmenkl9&IEn}MNP8+`y(`~Y^NO0rY(lOcUjEWY*LoWA`XBLhP?#sIJD8LZ|(nwB`t
ztGn2tH;0*l!Hf$%jTE25YF=hZF^-u><Bp&0%4`e__5$d!>U9aLQQ#5C_|yt)`M~vk
z#j@3m3=Auo(Zg-k4eW*$r>EtX;PmJ8yWg^9m>C#EL30K0mOZF#KlK(?^9m}V!`N6N
zp~#|Y&s;Xhas<>>u<!2TFbuQ+FdlS=92VmYz9cT2%*?=$hp`Iw)Dx`66{V)9=0S#9
zv1a_Q)*qtESQ!{9Fk)if3mgU(6y@V+5o@nLw*3Yh14F$qdWjVH4!dEcdGR=s$ol_&
z8Mjy&7#0ekr?%9uILs=>(KBLN`}IjMGXsML2YPC&`i<2nP{{_~pnxR?w6dIJF7q-l
z#2BHMAzc5l8&;W{l%JDY0a|;FeR28y*l1aOCI$vj(S*9sQGu5axy24^9+f0w9ox^7
zaa4K0z`zg=8g@iUxb6Jd%}FgTi3hEaPECo24h~@PF&ne;6_E2Lv!DmxIsvT4mgd2a
z9>Cbz+Hr2)6h$TmhVvMPNeN>$tSq^>BrzTPK(ixz<WpTn28I|W^mapqC|1KNv9GxX
zg%xaq4RwF#T`?4MN>XzRK(#U67V6jT)a&w~Jx+Y+tu0w`9Hu1~6u^zf5(9S8@tV=h
z3=GFGHagYG;4-lopMmBE%TI#l{fc?fi%cm6Tn6GZucAEpy9O%*gEmIR8l;NLywa3J
zd`6yjxP8Twg@IucH~QGmUM(C(f`^gtnR&#JRo8%pf#D_>`slHjJ`OXX3zqSjI$etU
zyf-rggEGeG@d0BTrh<k!@EOU#_j0ouBLl-DMs&~nnd2}LTtnhBQ+`>?8!lD`hL^nP
z6B0WtaF_{N7L7k;p3c~<^qqx)VLC5*X~=Ge$54FkoHc8H&2eVPi4~{|ogAHU7zyg3
z<1;cl^p*$@69dCyR&-Z-yW=pjI5D>%Cl&X)9V7Q2db+F(42`nrIcSzAUL!Me3$Tq#
zF?x#@sxUJ!?BzgrBD+5h^FS-H@%b9LR0CZX3F3qBmd3mw6eCMZGIQ{jXpyEY+YYfa
zFl>=RA2VHr%_Pv?cPyn?{(M2lxr_`9+nCV%vx}mzxCd0wg1YTkOtO&Z2<Kp8U@&7r
zAD60(!Ddo^G1ea0I?d!;%`prNw*nc__KNR_!(vQnUM6Tm9@b$+N57M<i&z;LZu6tN
zsBAYDqsof0pXcEeDm3*mD2SNRjqyK-#hCKUJYyp);ls>2f9e!w1_m(>^a1$H!zjj-
z7bO<po5W;%>|K08gMp!b4*Fh9v*VZsflR~V8jFP!H??pwFytwsyT<whc0;f<2|-5|
zp<lcVO3Wa<r18g3s6ntpnBYei!LDIOUatc(OAGCOT97#)yroh0FD|pdx78vW1UhR7
z{Z3hsAt1b^aT891&~KPUHxvEZSde)jyroh3A1=qCTq28XAjr4qH^+hu1K}-=g*Xj_
b+#?&{&B_K+`GesH1E)6w!z)dG1_lNIlO7JQ

diff --git a/python/wheels/meson-1.9.0-py3-none-any.whl b/python/wheels/meson-1.9.0-py3-none-any.whl
new file mode 100644
index 0000000000000000000000000000000000000000..57cc75cb13866054d42e3f37c895e4959ebe11b6
GIT binary patch
literal 1029634
zcmWIWW@Zs#U|`^2kZqQTes*BXu`)phh8AN61|0?lhTPQR{5)MlJxe_Uy_Cd~M13$(
zoRL_Rs-K&f2f~K>U`2X{XRWe}ADd0O|5H2Q^V2t4oyohkwpZ_SpPG}MHl;^C_2lFw
z$AaTJT2y*8n-m>Rdu9FqU1l!FqFMRq>{Ge;96^V2=D+XQF5P4=vz!+fztQ}7{*Bpz
zn{&1#s=KS-KX^SVBXrZ_FZVAg|JZeTQQGsYz0XqD-B)?}g?YDBY@hJ%tP>W|C!cnO
zZap>o%n9|(Z8`T&D5Y1e?u`&Wa<rnV&U)ue-*xLJJ(;Ail<h)=;_23Dr-PoH(O9OX
zeEm~+W5smS`1P)HkEjHh8TOpsdhF=Vq%_ta&!S`gsT4=*&7Agnl>qZHDdUjtg^`^P
zV{FxTt<(yY-WFgQy*lQK>gB9Nvpr%P8r1_=Wa)Y_XM{3Z>l8bjY|K#m((qC(+Hl?E
zWm7gdWiThttP(Pf=L+L?;ZdGnv2ji6O#T~{$2Lz@&~cbA`YCXUr&06#Y(4KZNyT}t
z*Cg!pTW;^YU=W+vc*~}^=6LWYo^K4%T3sv?b!Q1}Tj~|3U@eqnoOJDwiD+?yXVLPB
zl8sNNX>VEFs>QYS;uhl=KJGJaysJg8GgbOtxx%!AWtAYe*YY=W*CZCKmI^cfC*!6%
zQ%k()CWCh3s%;L-H*7Ud+j{if+u})n9tT!kvG{(pFG6VN8rQUty}fBB3a4H2wLI5N
z5!_In_kzQ=V4GX-Jmo7%idiBr7lma<Wqnjl%zfoIK|7&#CC_IsCyR;oo31EK=difN
z^J$Xw1MWE-)2eD)az&f0FE&nj9d%V<*~LQ*wuK?8DIXST&Uh~6-e>Tjz;(`9hEsA{
zO4j$)4t$)%u`n%l*~8Z8XDNKM?;f8pWs9;n_dOA{nV;VT9*CNdf1y`9vhFGKwn)zl
zMT_(pu1~IFne1{^Rk>ODj{Z5Xm{WH5_4982O-icRD{`!EPHp3V&rilO4pWa#n|esf
z<Q3<;Q$e4jLsQlK8W(B2Ji#5bdV#CwYS)UsDUr_v^9z55i)?hi^RRLH3%91NAC5IF
zlulqi9kwT?X+mnI>6OB(R}S5B(Ve!4rI_s~lXdf75hwKumg<f$nFRTG#zd(-kuybo
zH^juGw>cci+<A9Xa^_-Pqs@YU1ShJ-vNBBku<ygayTVsmTE(TNXf0oR!YXjKgJx>Z
zvJ2;K2<uDT;QwWLXTxlHg-WR%@^LKsfhUCcV)UhpY8|ibUdHXv@ZyI(=g*D5Z8pwV
z&sb$@;cC-Zu5}{h$h>7w7A<?zd;5fD%cPsUuP*)lP{*Mca#&-PAL}~dvV8W4n`@pw
z__cVcc3{ZcT{GAYue>I>?VN_i;euIVN1IMR%{jbXW4c(MwQkX#d|8j@DJNN$T*}~K
zJa};4yTxCt^Yk>hIWJi5JehQSGo$F%X%7k&4qeEbHS14wI%}rn4qawD4ONq+Nuuom
zT+;#$7iM#bHrLuXu1=h`zhnLq@2tp*aN*pmpB7(Pwcv)B_WiijWPOe3UDH$VhwV^!
z9h0@${fxz&if%W->r6G9+&<m(vg_Qkz0BNX@0u;E8N06ruD^0DP0^ys!c+Offk%<E
zmay8S+s7%mXzPVoiHKE6FtTaS`25jx%@3KwUj-JN5j*Jq<D^2e=Gy;9zBqdyVt->i
zA-+Lq$_e2h(f7YD@%brid$wTT`*r#H?wd6qEe+vs>DZNY;&XI&nND(AG^bEa7<U8%
zUwYQ!rD^B)JE?f^#q?OpY*6Ln>EPUdYL)k`$}_(emssB0sra{3_WL?Z=Igyr7KdJ&
zz0M*hP4B^zC9m$CpIBF>IrUYY$4RM0`vXKCu9XT-YLh$tnj@uJKw{_P$-#PCltTW-
z{w*@@{Jp+<;llmzL|=WaUlG4l>RQtep^qnfD=f+d7~XD@aQ^%E!YYZz_~bXo&r}3^
zb1W0_SbOKf#}!K33-^?~TRcg_$x~0o>9@DC=K2r2H`;NQ$nmwV);-31y)Jo?dR4(2
zwjT{&kH1MO>Rz#o$%JDHt9kh3=jD@qruc6PQ{AO{;Z?I{#)<^@m*w@I{d~J4vMqEr
z2&jhKddnI6ue<Q2#GE_1=?qoR%41ikx;)QMxZ1zzRRr^Io4<)gpAGg}@7}rhUtNve
z?7Gg1hoz@BO>?>&w8*@};K-MMx0a{>2-<w}#osGYbC0@N&OZCxWR`^5tW_d*OQN|r
zBp3d>zIg898Bvq2`F(Uh;C{}lN%!)K(5gvtPwxnreOl(Wmgk+lT2WFb%WRXamqeeI
z+|#L56H8lh<V&LZI=$;MO?*=d)=4!9vIu*7{V}_=Mu>I!+FU`2Q+8%MC9-F`IR{3X
z>Rn{iQvAH^%%|!Vt9M_MFZ;5J=fU~jKl<viemc2Ety~Eqtfkyn4mxJB=QeWf(Ri}w
z+14ZT52dv4{-Lm9f!nr-#jlRO%JQEspyB4+zHRC=zI9;_Pk!?3n=ozL&;8k|G6K(o
zrKBSamnbqXJI_AfV0QZEY9V>us8zWq|F=&H?0oQ>iDO5ev`1jL_r{M87jJ*DbkR+t
zX*TL9Hv&BtrZn7QR=ob{(fdP37J1gzR(PeeEe$#y^zT)TvF7)_Q-AlLoZ$7!J93ul
zlAT{NTaz!B%k=npWIKp|pL^o5NY0<jKmO#IS^a)t;C^>j8P`e|VOuA|zZ~U!jnC7v
zHa=T)>5J!aG0`c{7M(e9$|JK)QNCM1<jwY+387aNE;p|^`BOojA=~Hd>4V|_j<9F_
zGhJ-IVM$w1B}1g~e`^7s2`P*lcR4ct5mYgZwp|oa>2#ELmGScz6E?K;nCMy^yR)ew
z$F#6g^6F1LP3Qg{kL3+k%)jev7q?@@y;WRlO=98PTQ;a9XbJC_Rp;`OGlOx(f@S}D
zua<O4@GXCnes%`a=KE2N{A+^ml-+3RR+{GWDpB&%t)G69XY6|Omrs7ZT4L_(E(5ux
z$Jf>`)G52Z|3QIMqCoCBSCgc`7fOl?@|JAuvwR}wd)wS+@`_@YP$Qk5ho)_^2EMm-
zl=9z%m+vxK{=3SZ;r>gR((iIppKm>5pq4zZL9pf5<_e)jQrjkdGhCqO)T?albtc9x
z+xTlx0(al_++&ZWLrXNYR%^^k@^TQkqLjR@a++HC)K9j%Sf{h5=rqffYAwx9oV9C-
z-UH)S#^_5j^K07Iu-@CrYLdtzBGi$}>HR!t@rOiz&N5cH)T^Dpx9xIP=`G8iC>U18
z@jlAWa#_KIP{#vP8Q5!HOuZW$b&*lRBH8KzbHw58lQ=c(6}uL)M6(rL=QA$SeZf6h
zVP`{(eOt`4&w3HTNu>;jKWgbX7fMcDEHUSR<;kWund(~kS#gb<9v3a2H07qiC-swy
z-yB}sBBLI=?8epw$7-i=&k6SQDedL8*Ufodv`g`%pw$Q77g3s*Zp0at&nPoW+j2lp
zdPQ%ytm>Rs*Ec8DzI(MLylG}kc&mw^O0BaOpUwJ{Zx8x=<a6?CF<jG?{m$K(x%JuC
z#rJb1F4(<R`Td5Q^}~Y4&KiIEvsbh%HsI+w8YVc)xa!G+8NZI4PO~iu7dF#9GN-A8
z=dkjX`WxGeF3V-+T((WO4&QayC2{HF$Ok(Zdomw(l+IauaHr=3nVnZQl;1MWvUb|d
z_Qr8>uJ4MgQ4J{%GE!=eySuY|&J2I);CCa})oWj)n9gy_oH^_bS_~pWO1Hi|ep2)2
z+pBk<8tVeh3{`(t-EBC#?Q+k8E#3zW>^QBT+*&6VAI&Yly#B37Vuo$*g`a}^H1-_%
zxXe)K{qmfPp-H<QzV~0GqP~%@`_>gz)$<*e^A8)oR=?r*=5pt=`h-`nIS*f{fBSmP
z15uVIb9g1@?p5yKHoaYu(LHx=v}}O?F2#;rmM?z)am{%BXWzpaH3nb3w;oWFdV1)~
z>fUXi*Pi9O>lA)FnmvuXSnkpZfu1$eT@PnzJ-?=VBi{BZ=gQ8eCB0u(++BTI|CX#y
zh{vt+uvV!&_Hv6=50_nJbj~<GVcpx~&zqzoxQ^ag(JL66=XQ7E-5hnckF5nuDgxtE
z>@Rq`hAqjgPji;|m}33w%Bc_MP6;fP&z}@!o5FV2M{3jJH-a+#y%FEc@2NOy@vkat
zP?Xzkox5BueD<b*IloFD2PN;eUDn*Yi#6n!_8YSw*LvUDC}sznX)P!?yZy}L#trw{
zk3Y?xI=L(1xy!46x)Gt>ih&Ee-}2dHc1@~OSP<L1Vy}G0=c1kicciZ0*l8p;+uG0V
zc=tP3=B`zZDguIcx=gRI9jSQo`GVRTL4)<ZF$Jq<@?G23>%9BXrB^avn-^=YvgF#A
zYr0Ep8_UhBY37qH{*}%;JtICjnnAlMc7pwq<MmE=*WLW`O@_;eJ3m%SEUQeU@NU7E
z*sSAskA1zW&Mnvayzu2**1jFjqFEkxW!!dH+Fds3pvdLa-;(KSHGE&!=E{E2xsbf&
zDucCwcd^GI7tS2V`7xVMt*^dwV0&MfP1jqutChD4Gjq>gb9SyTY@4oP_-<a#%Cb*P
zJZ$f_{8Wg3-X80Ee428=+T7e{{UY~U*J=A~`*yeGl8?|-*J?cjn?KxLrqXx!$)AtA
z-`I3GLcr$enzei1JmuZ2oOAST-5Y1oRcBxBdS&vn#&}k3#f(_{2%Y@>H~#bA_~?1}
z{mZ+%%O}sbo4@P)&GY7u^>@F$VDI?)eS4&$#a-q(kNfxb>;JobckTK&zh4_Ke-VE*
z=Cb<6e9=p$0=6seEB{#}s`t_MK;Q1Yi-dnBo>J?65hi|)J<n6UM7&rg_wL@^i^N58
zI6HHevj=VHzrMJ;{o?YEZ(r<v-LtS=uIRgj*1T`KOZG;_9RFjrW<}O?Ij>z?-@G?p
z^lQsw$z@aiD<9u=ZeclNN9gar0=-jXeb?=iw{7qf`0N&Es3}tD`~Sb&>;K327MSU%
zd|mg!Xf==Ux_|a>f+{cd9a;YJ{e$@IM<4CD{C}x_Ie$a8K%~xU|2~QTe1cK`m1JkV
zo%AXErNpcG-(r_tW|>x_`2CXI#4`Qo4xb-+Z;^dauVk?Ifo;`3gP4fv4<}C4`To95
zw&k4Uy{{J*+i`r7I<wp2&-|V3z0y<cK7G}%x2okfi0hedA9w%XgF`Ql)n7P!|9y4O
ziz)m3trGTC-QKzU^z723cJX&&@6~Wl-}X&wvDkhS2i^BY8;T{_^L|b2a#s(?Tc0+G
z%U??C*yCE0yStgc&5q+eVjT7Bf#+hkAoj0w=jK@FJMX?|=eK;rhQpJ;Ce@d47ju^G
z&suE#ck_>eA3pu5TQ8MZ#}r-St5@CI{J#FVmb^aOvk=X=p7U<opUdyjKD+w((%OlQ
zzGY|bB>w&<=zKk2XS0uacWX`B`}5~>15}nb$_guQUiQGW+4SMjsnI<<_vQB=;}G4w
zZ}#5VH9T>5V_V<F-4oU?y!!jYl5-!grwM=CdRuQ!YAyeTlaFst&^zE$KkwYJ=_v*?
zRND_U-<>v>_lto^asQKdIpY2^YFV{74lmWX!T<R7>W{}cI;HDb+ty^=_<1&#rCWJD
zvy9%4s3ue9KZkc;eEQ_^`C5~*f1)=O>^uxU-G5eOsj<Ycb!$-j>2uS5g#B=hITtYZ
z;`^wTb3OhftGv_x{B57c-N?UhxdZ?1iZLnCW)hf})4r?j;<k%h+W&7!<ga(sSatpF
zX~|u7Q`T)Q?%9^U`Y3Pd`UO$nOij$XtZcY7R2NN24gFAXv^D0__ifIzGNxbOA+yMn
z*)6~KY~6%O&KDZEj<zz~y{Yx<n8Wdn`@g<FeCF=f=vO7D&fUINaZTuH<@>+JTg@Mp
z>XtQfEL_wg@Zy6K-*o$ZEm~U{%9b5<t$Xt<uT5hv_h#k}qfeO=`qmkibFEK2Vw}P^
z#r0t?gHG|n7w&s>wL<@hE!q3-z;T(o*FR}w-CmG6|0lo1ONO%FTi8@pCzwtVVcRaV
z_i(H2vNz4Q9(b>4%>JIQSY79~YUc`vX>;T{AGmeI{aGd)zw6o*oeEyo*2%~A%X&s$
zv3z>8EkCoSocjRR10S_U>E;~=*12xn`o8VaYKP|>$LxL6a;&7!zFQV1k+9VLq{*H(
z|Gy6ki`=UhGu1UzJ&(Vb{A5v^;h!zJ+2vyYA1Obu@Kl@eYT?b@-@nWKJXyZCdsk1N
zw0))VmAQqP6Lu?X;dr5N`QwaUJHPdlQ&N3Oe|^(c-2BCHUjEx1ZJf8y`2GI;pCJHc
z{3dFx-2A<a3=9p-3=Ccb#%~JpbFwo_bPe?rlS?x5^NRJ8^K<pUV>wBsnK>zXnR&$}
zi8(oX1^GFd$(3`1y!&Sx2<-c;9drM1&K2)a!LYk2+H0@4FG=IKRXomPAiZH_Zo<#+
zriPv#{d+6r?k69cY_reY^!3GvOIe4ne`HQyvE-cRROx?JKX&~(B7a%q=Z4=qZU5Y}
z-yC*b#eHR{qw4MbcD2<vjrK8V@Fewpds4!^!TQazW5Sl(?7we*D|tck;U2!vMhxfe
zD~@PCzjdDBu)z`Twusq6YxM3Y@HizjE&Y@w`&{q&y&Fce-2{_8`?apC*@m3hxA<$8
zzwA}Z-=<ORzD&hGugxr7=BF-yO<MD0=v~8UyBgD&<kfR3;ubvrw|UZp=b0M!3-~+o
z8)i%?U9>LwvZkHq&ouj4CRhAAzNk)_`B~2U)0Q=+zj&7>+jc&%YE)GSs9@Cg^4VV^
zw?gLR2H#C*9?b9Kd3Gk#ExagxMy2qM1ZLr%t*KrnGq$mDoBTU{aow9ei=w|K?G=c9
zo5QjE;Oi*<nE}bGN|?64*yooO70}<kEc=!GvI!z}>wKQ@u6)ySBW|YngiKv;<IVst
z>xUEO7ThVQH!m+2S$8<zzvsQi<FFlF%P&MSy9Zt9TX*Tz;_EX#|Fs9t*c7kt@jN;*
z=$A)Zevi-&`y2ZaiA1qkB6`b~M{T+M3=DBP3=C@Mi6pbQL^m@pEnhz;GdVS{IJH>c
z**_rC)6e~GRCMv}W1@B6*WV~w7M#hpY_3VB^z+V*PukWxXS(dnQ=8nbx<O$(+lCW*
z3SED{+D_lwxFn_gSD5cIQ_nXyH$VS0_x+rs+#h%Dchx^VSLl7|N~`5@HlLr^Pbs}s
z^62%?*G_+Y%NB28|M>Ow_4_tEGt7DZ&JJJy?f2i9OJ>E%+t*9oJGHl}k^BAn_jOU-
zM_+mE*&7+F`+mCl>a7*!#p-rz)^it@*H)Joe|@N17keQ%{PfqqcR#iB|KR2Pk)^jT
zWUaMrLs8zpL)pfk)n{>TpX{p~rD|<>z>_^ST0JGa^HPcEdZDcwlS)<zgnhjhlH3_D
z9w%ZKooODiSMp=E;@lMl-l3gm9oK}OblS)C^IFgCxj+17NZDmnoSTxode_4U{bYX;
zZQuG0RlB8IZkC_o3g8rb^-$r7#hae1|CjyUGpAU)ZLSPU&aSOOVr9`)CvGbSJLIM+
zuk-xUDU{sKuJU&31XWMYs0PUgk^09DFvmHrmC5I2lU<X^rMQ+$UMgtUfy)oJCx;*0
zbZN`lmwQzHFSzkK@pw_i;hh!fIxjEwZ!;G#Jh|%P!-MX|`l)X2g^!%#KLu?L-^TDg
z@`I4pLhFC!ifqbWoPNij?-BXesgvNUZM`$}h0UGoy-&|+hjsk*yZG_o?=9<9ZthI|
zCbgJzNleCtmOGEjcDZ|QU3YNS-c71q`+j`;`d&ZNn)zAcVRpyI57;(X{bIP2GL>7%
z@rhe$LQ7Dyw)!Pw+sUWv%^v&29EkceeQxZtxc2`S)cAKv1x^#Ktf^ppCAj4(pD5$r
z=(jSgHb*7Z8FxNaxpHkoG^ZxV%d2wkQTd^3*R($UlI<(@za@IhvP%Ufo{^$5Yj$sv
zJSj4vWsz}nM#<{J@(+uRziv4Gp=gVu#Zso%?RS(N<9O@?TK=s6TDIkj^^T>1k~Md7
z{;@7BShed7-yhi>$vGPKS=muPHr_eOw}p?BDe$6YO;B6IqI{|U8^wY)RC>f1+Af%0
zSmNU`J1*HtGU%LqG517<^oI57?B_0W`~5ob;%xxm^Ssqsx<?CMd`_-6`F5F8<IO|w
zOEU^Mly#RjygOu=#I)h%pN&zGj1z1;?w;@!{$zi6Dbqy}<_%NqrlcHcZOBVttFSmE
z9nB?oEhWs7CnEZUlVi00BPPBDa;diupW7g?K=#la@kf)p_l0lxtgI58{B8P4uJBW@
z*f%_C7RnGXx9(%O^LP*MpO<@8wmAmWD9c){UmUWgfWN1%L++T?ovu5rJ2%{aSv0+o
z(IUG+ieYBv)n>KuB$4LKnt2?oVrFJFOoI2$R+?2NMm(L;?4kJD`^FiQDIyzu@=Muw
z&-wL7q@UUE>f|r_M>hW4^VMM1-uE7R)=PzL4LbfOWbYOc%?xoXx7BO1_$IL5RX4iB
zwutrdlF4g#@%UY5aM?CZRkTxS^~8%S)V&s#PFXqm`hBG-zoqK0Jw9$J5Nvi^U+RK-
z%!;Lf{32!_Igb`Ro#`<l<%Zc7uDW`!pGw|cjDhzLT=Q+nHP2(Pwy9vb=XlX|*5oQX
z(G2B7ABCd?_xL=0cQb3Eu&7JwExE_Fix12&o$)C1)2Gy{ac3UQOp6n{{+r|U1`pE-
z4c8bX#9y@b=4kYN6T4pOVt4FZbbNx?6Swe_0U65=E=^JVz5CJ4Ad!vQ_nH5BTQMrV
zViPxa&~%In+oU8~#BRRg+EW2O)AEoAC$Ci#|8bVthuNiRPt1Pmrf(!M)5S3@cZ+nv
zouZPEr<up6eYkY_M1M=gN|Tkx6IxzII@=ryj9GvBVh`V>?Nh%AJI(ifqY<F@^vgEo
zH|+r~@)Hx!yD2qY&0+mEP3ipApKnZB`+t<$l$|(mK4{*ZhK~NX7ndcmpUM$AA{^l6
z>cQvr{Pz--l2_XWA1yza>&^V_Sy69`xwk#rqV>-ot@l`6aC`g5AB~ZnUr!vpdi>SR
zG&S$dGE+rEJSR$eD6}-3JMySQoWZgsnCbBAs|?dPAF^M#9#Y*Kv)K5q_oqG0!jF$n
zKT!2XOj^Bo!r6j~$Y|F2CIY+JgOw)C4=KL?|6$w0+fAYql5LND<h-P6@%}jP8dhzm
z1>bsG9QyA!oQuhlt$p0-dT;wv6Z<5?iBBiXo}W^DNUZFFyfOP-FP6Lincv48FuKY=
zBjG|3Poq*}Q=jxA?~9)!jo&lIvL{;qT+s29wRJ_mS!u5ge^)~mL*37M#=sug8-{}H
zHi6&POh{0h!{d9vj%)X+efb;in#fwrUDI>pX{fgJ%7gd*<dj)#P~tqfR=RL=^P5t?
zDBqir(GK%3T-1=wil6sG{GHIPgv*-of{gzfCc1?ApY9WHVJ>Wcy;^t0d6oQCbM7bg
zujAO7r#H>?m;E;<z6o5(R#vGOqQe~XRR8%XJeU679kM}b`?g~{r>7X$xMjLM@&6-f
zqwlKxJ?{#$+}6NoJ*I?>3u+#*xUcvjb0E++;pp7_t&`^%Sw0u&6a8~hD45mI=jgJD
z5*oo7Zneu=+?1cr(64L^Ei64C;`+WdVxpeFHm-d<2gTQNU)tcmMuKbK%x>$c{%y~;
zlxp*H-s}tHC<tKBGd{RDJwk3LOQv#;8PkbC8O6no|IIfl`QJ{{d+4taIWbDn$b)Nb
znC7>lT&WkGJNB`^sS<wmrghJg$$bKu(O1N;KCWZFv+7|7N0jB)-n)wb=E{Tw)mpq$
z*|*$C>f4=^>Q4{U0yEz%-cbL1Vc$`Krf-hr66$wscjZ*K?2x#mAsqc(SJHXooR{ZP
zw`~q(R*4X-D86<mxST;sR$lM6McxdiMF)7iuWtNsF;+n*jH@zu;zUlai;7EU+e`N=
zoO@Bsv+~FE8Pbc>Cpex8ZR5}lk+e~pHQD$a-^zlIo_^k6uVh?RZ3_FcKmX5#tDCQ$
z{rl<dSDs1l3l*x9Z~e5LP?Y}r$<3*b2WI+MZq)gyEi4-4&uKSB^y>`G7gr)TD`|Mn
z`J9$yvqI45gX0U1qtkDg3K!oyl>XN1Ae)hts_eGlpHuGXd*0+a!eLe`d}WH`@s!so
z3q3=2rkDP(WB=?q;c2C<tOIAP`kaH4cKV8b2-&ys=*p?752|iXIsKh2eNBjbDwiO~
z3x=DK3KzokKTc?WF`Mss@dX3rjR8WlF8r1)Pwa?ao_6k!?~}&pmljW&<&;d<p9om?
z>c<_WBUV0XpEu^5SaqmA`c3(#jx$SGuI_E!ry|U?Z6CAylk`P(T*swDm+s2SVa}cF
z;=>^J?thbYzhN(rOq)bP+vbxlm$hEZoWXwMqs6})2L5-W=a>e*((2fDX~R6u0~a4?
z7qfDGe10PI*u*(**Q^qErc2aFy`8($D9P|<?8KGlGlG|FS-CRO#^z$zlgm42c&YGj
zKew#XvvKn6Ri2`KYoyapx-2#9Q%jzCW2H<flW=>D_u0PvoDbqmH#(S$%Ui8j)Hi3D
zT;k%O<lo*xo4F@h+_#X~d?IJY)ZUHrWMWm9^;^sF7tMH;`|0K9`pdH_XSrsjF&<W$
zu`BH1w~5!+pK0iR^p^MP^xlWdcrKTDzm=UP7<9HbfN#z!k$9FwsT94B(uTVqFlt5^
zZgYu#@lxXhzn$|6<>3BRXB6f&m`fd5wRTI*`jR`<KXy0RGm5Y=JrWQzmW!2iI@hRK
zUZ&jA_FX*7C;pIWTTWq~m?W>?-YK;QX72mXVf9nuS-bNEwqEBYOU$mWy6^TjzkkC5
z>kpjMN{Tc^>MlR}YLdkq#&$385aV9$q|1$yZ%zK0b7I*8^LXBKQy8{gng9Hemvz?M
z50|!y$v4(F#qt?)E?PC4*?hy5%H-~;2@QKZ&U(*k5<Qt{_dPb~D^uywg$E0}XW92Y
zKHXWYU$~BSf_?OwqeZsD_Bz*2mm0h~{`7CZx%|7M$B*8<n^d}gPh9ux-G8F~J)0Y`
zrcSIre%-o;cNzN_>yEr!;jMnLMLX0?%~#T;I7qVK6@#zd%q}UVYOak5XMR8Z`};N1
zntfF}WA^TjUiYu+@8z$r_6gX>-rxIIa7)ae4K@4s{GaLc;_j!q(!I~Fvx~(Yd;5q_
z=G()+kNob`?by9HGQN20)7yvG^2Hqf%b8s*dF^0sd`HypFsn_vZ@%fJVygn)i>>_u
ze^ig0eYVslw}j6^P|p0o*0Pp2=cZU~JIV9v-@K{IHvV*dooRe}<M-*7HGFDEUEgoL
z^P)}f{Pc)Q)(i9V6l^2dYOY?`AY9VoXDz+8Wws8-0!4YrlC0Yq3GqvJ={(9UH<WyO
z?Bx0M$A6nTna+KY-mB>3ek!+6PVl|%p=r$f8XvqU`%_bAP~~@uoiDZNw3M&(?@orD
zVcUwV=RSP=>Vua<mF0o2T<@=KzMbx&p|GuHY6DAK`mPGa=dEll$7V{u=zW}Zy8Kzh
z(d4zqq8~qYo4&@<tw-{w^xewzv>mhjdGzM(73Pn6xKa8r<8ISsw_dBwm#u4Bl=Ca@
z(G&s8gB@MhgUlB{%~F|N^+sstLZymlz5;t#4?H;g_Mo&jdt-B92g~0If#<155_heU
zGl`va?cZ146Abw+ABvjA&r5!|8>8d3hBKqJVb6}wN}{iHH0|C^*yVru>yJ$zZob}j
z!0Gf{LmSqmp3k3bnwz%n!0jy83Z?*esZ;AhYC7f}Um*9FPo#X++YeVKnFu6rHghab
zH0z!3B$!{>x}o{Z^z~5>Y-Z^1+kc7CF}eBU;+x6pN7km8NZd3Qo^#GUe@lsPnY57Q
z_WfcD71#ZjYBV{h@zUEz{q7<a7yrqNba?*wNK~uE8rvlwD&99a_f^Jhud5f<ec(zs
zc6H{(om+Gj0~M}c?9!a;o_#rY=6o4uHRtfYvs(Ot-IsTMeD>g^o7DwI-3d8TC;!-W
zAL}u5i?wK2A08eNets{T`+ohr{D%{t+TUNmof*Z@QT1WH{*(3Z9_BAOWp_{Y;Qhbi
zdK!PSMJ{JLEx5|I>6nwWUCT<hiB><ORxc}J;$l&;ZvMxXuPN&C?9KG}bip4PMh{ot
zRb&xfxa$3{O@38+dh2|?xBuAZFm18pkN0}4rLV6nvsxf7!0GUDvD`lE6Q|0`%)56!
z;%j)`|50hmtg0}E0wystKK&IxGVRrQHT=#O-Eo+rnEZ5GcSf3gSK*GRyDPq&;<`J5
z%~wWmPGgbD4mX~8iEC%vtNArOKERj5M)v*Vy-yGA&6YX8M6rF#Q@;E)mJ*jzAL+CI
z_#OJksj7LN`}Q^aFFm&NShXg7R-6CC{Q_Eg9~yt0d;0XdhSC>h4wjgGe}33psJQ#n
zY{~*dw~!?kN~M3(oG%+$O5SXBnC8s!{rujdUvfKsXVv}{3R$Kaf9S&eM{@t>8jDQs
zz2bMj;E;FopT^}9KmL2{Xa1<RdF|9$D+HS6Wbhv0ky(4YPoThobAe9D@%(Q;Gd&-@
ze)lEjv-p2TM28);Du;oAfq@A`FfcHP!8+{VK^pz|_{_Y_lK6PNf=Xtzv7p(D_pNYa
zW?-md$JAAjSdx*GnWR@xIX5J?`-%h4zkBh5U!3#L?_Ia9Yu5sWeFqj6v2$@1eOZ>f
zOEy<MH7;*`$N#%$e9G^>o6Ggh`}WKyo}X+y-yJ&s`FgzHz0*Qd4^F<!HFfG%m%UBX
z_i9MnM5cY8y!%7fFUQlR$%&QqKN;*yIpi-)XyRJGVd=hP`wbeqR6H-6FxJ_bUUG1s
znk~q)mHEL|lWPsCHzxe!bDA71%JHH#H!3n^7UOO0mP2bBLk?&JMk|WeOk1_6m(f_F
zdv2ua!)+V4nXf*Yq?`M=Yt53pi$9leso&PB(_3Q5clOcAPd6WT^0OO8+TUmkajTMj
zD`!{nD?@UlzwV5-nCOEaH$Ia3`q5B?<6Hvk)GHCU%1%58DYRQOt9i?Tt6b?Tg~O&T
z%57&5eq+w7wPQ-G|E;{$d%t}9XV&df`F_(xnUzgR41V`Kwzlz37i-Yl`9)__=Duah
z9#sboxSW>Cex7plPJGzZEt964PvYCg`A7MS-}e-O70))`zjb2vB$g>2ec{PI6GggD
z?BBZQ*aPD<#;w6i`;V(`D8I>-e8VAw$6^j^?v7P#rfDC--d##M5%ud?hmG-WDeF%x
z6SOY=ZhYN)b>He`oU8>ODnk@gQvSc0>wik=_r%NdVq`Dv`FvLLbU?PQ)*a_vlUw7~
znwCy@zIC%-^1Q<<CI@t_;Yd|I8M6DW{>;0s+Bv?ncH5t~%y+Bgi+5h}WlrGvoBDI#
z|D8PXdV70vzklE3@2-<_0wv0=^=>atX{yNBVC&E4By;2KT@{;m>2X>6^rf#Qh0pys
z_so&seO%5_)BKFtzn)X-X09?hz317ljAyq$yYK3J@$!7=itg*30SCUkQ|mk{F*B7X
z>5b6mO0fv8X+|t(i(6;g$UClZ*VW0qf8n>DOsI1A%in@^ENst`Ywej;MDJT<iJAAj
z597!yd+{-Y%VhS^p1;9~ypOxAjBZ>jesFKf(pX2wD@OD4U9$_=)b-sS*6n69Jic|u
z|C)Jk4!->N`}n)t_5afO?>+lJeQrg>$tMS1C6+RqcrhINx{rU8Y;oh}=O0aHS3E53
z+}pajKYxqbU-u&mcnTN&IVWO1_diG1nKaH#EEhj-IC*r3NB-O?cc-v~=FOdSvZZ44
z+a>pJ_f<W3R<Pyp!?PFndDNlhSMg)dpPyi2U~pk)U=T&iuO*cQnR)5pjCVWhwu3<J
z{q+))*l#OzPx!V_B1-C3yHt==M+UcI$JVkG-8E%X?@pEd+W$-X@1}F>RF0ox?fIJ!
zn|5xdv9WtK-*)r(`t$2k8*e?V(F~}L^xDF`Bda3t;UA;D3C}+qHJLm0^{K;8k3MBh
z5j|91;?{hCSL^bX7Uupvb|?ORH(z%C<$GJ5t?sUlw<S*RHJP<>^XAR-j+#aU++?b`
z?y<LxE42CA(w<sluN{Z42WY&L*~JnQ9dba^r)XN~-Ku>-70JEkt%1o=D-K1>D_;6Z
z#_o_T^Dp0HTRbn>zyEOk($Cllca7DugWj<7_DKC{4JhDsJ^EE@<qj3rv@1K-1{@YU
z_{dpX*Xi=lE~}d9bqPyNzfPF;c=7Vi%OWy7f0BKVMYtLL-edAw>d(oyC6j#9L^^E`
zuH7yo&3O4^+P03h96E~U=WegGD_wC)@{B#Bt)7DKW!ct0&5wBJJ&9~g5fOHDp4t}S
zwkbS)`{LcF-*E~%Zt2p_IL5k_kJUp;Ww~kV!HYXAG#)WXt#rK~)vMGP`ubq#vQVZi
zA2%F2A?j5nl6ihktFFLjH?BvEVw*J=>t`+bIl1-4#KXF}tfh^f1!u)HyVtS)EVc4(
z&rW%rz1z{(=~ha?te~{lzYcBL*)X+EXcLpj4zZAl?dF$HnM7>!Dz%;eSe4JIKI0S1
z_BgS%kIcT^i}vXAdtmh~ewM&e|9}H+tIdAJPWpB+@RF;YoVj6qX>qrzuR)52QQGP2
zAw?2aw~gDrR6OWO-0od<cJIb5YY%ELeyZ%4#T%8n<HqC2#p<i77I<Y$WRe#z`8d(+
zb)=tiVHe+$+R}p&?Wd}061O}L+O5u%6zw3kQ9Jnxcgs@d(~~~-$vN@|ulO!_<!QHw
z-Vwhx#n%_v%UArH(e~jXZ=d#E+w51IOFptpu;P5;&#=~?Nmf6<UCU?nUv0OFooiog
zUTpMu<%c_(?6-gOqgGW33zFmt1sE6>n_wjU#G>?^%;FNgg37&7e~YBI3;v()-{>`0
zQF8L~{w;G`jEi1-6rEbBvvXUFx^i~L2aZWA`r1!F^b?u<tnrsr?WT8n4c2$qHBbAU
zmb`pLc0<G)y|Vh<-L>DoeZ9$lm|L<dqWfWm+9RKHOFi7*xE?yZR6>rueQs^ps!6_D
z;-`CL<>h4g`}zC%Z+;Eh5bm^k#@Qo#J3=-!ozxMo37z?2e!a0wU-7=Q#}>kZdwhha
ze)3th<MPbqSx40-SI&F7a)!^0n1j1}K3arH@?I=EW7B`wXQjt(#lTtqPAQv`<y*A6
zTr!^Ba927P{%*V0yk$qH<V-$Mad1c4^|^g>Hot!G>-hEOlP~X|H~(L5&CkCp4nJ@{
z%|5Z`z00b*|NFYPpGd86<llR7VU()Tr(<((vCB^As}NY&^SsORtVOYNq{?!hBR}un
z-h6KN>5u&OetzrY_R7W2**~*KfBpIUG5dDRi0Rp1ecJDaZ~0Z(4S5~$p4)s_=RZ6j
z*>XR#?S5YGyWHiMIhEI$S_^NsdAZP|srbjMeybxN?%lihTlM^nxjpGVXC3Dn=uA@d
zoZo7b7JM*GOH3zNb+b+Eivt2XejWcg+x+q7&7Zx^Qr=HjihlH4qWwvV$TYX`yWJ*J
zjW=x4o1K^NTJSuNrj)pV>7P9znjD?$CwcJP`0(cGRnY>|=^HQb)E6g|{NSs9y79XW
z!|$Y<LM>87x@@dlw<_?N%<s-%J{8X>Z{W8<Mf7{n(^)GG&Rh;TvQXhx4cq?+oofsD
z1Q#q7-(nKa84^A1S<~4@U&;1BJLV{x=&V`1Sw5A!Hu_&Pir)0_#)q23Z5+4${@z_I
zaE*I+@q%`#fD;XV4uu75=_gENn5M|&2wO-R%x(8Jxz>O9gK}`@!K=p;m4rVUCQLuD
zxu^74<0QA#LuOkGxE!9kDmiPuu%4-sl=frio>_C|&fi;|dqv!M=0?%;MqBQgz6d%H
zl(X{M2ZMVXeAZ1U@eyL_`cPoj;v9IY<M6d$3z5nr-cJ`@aJVP+l}AWb^=O%-(2{#=
zmT75q90(A7n$jdx;=Y{c=LPS1T<R&BCLFGjyo)!aC2?GPeOgUaYwkg*1Mjp7*zT`<
z_q#>*SC?g?d+A}j#N$UTi`*r*EU&(PaJ9|j%N~0~?Vn~inp=72|2|e+vOD(If2UVG
zDJASVLadj}IQsNisv0=r7H|4<IQ5NELjH8E{<IX9s52e6syLey3|?5CJ$S#7Is2SR
z-3z&t7PfVv^O{^)-b~SHJh8&1L6|LaQfJeIl%BNiGZHH=1<uk;5LA`smf(^*@SH`a
zewU)~#&r)|MJjdH6!|{m7Sjxh;pA^TC!!@V<=5YrF9Xu0Z+PcRoSoXV*lym*k^?Sc
z-#TUb+>IOe-jn8<skFQMpv(t>e4)lBVF5NT$%gEcre3O>+09Q}IdbO3*PC2_CM!89
zxX;)YxHHkj@$82k7WUtMOet9#7&>pF-P>m$KTMs?uKwtUYqI*@?=33NJ%soz<{YTF
z_L@IJLC)y6u+N{Hop){L*f_Jc9KAU!zvrRDnzo3{wHz;UXOym)=dP{0BDi?Pwb%Cb
z|70?fG$i91-WaCvEY|c_jGMB4{><+uH&y)K{N2tob<WoviPz-ARbQMnF$?O*(7hO=
z<m;B|r<YfjXZBR7zdG;F_Q_jMwFn*vX_4U(+IqB6#;f|l=@_ZcuKrWgkL6rgGbdKq
zw8&>=FW0eHg`G`-37(VKo#g_S8yK$Oy2{D=#Gvf9{A8P(#-9WJypfwF|K2hE)XCkY
zE>i=N{Wjh)JC*m8%lc_i=_BiiH5Hp{LljTt=*iEK6cgiU=fAfg@iFI-%`6XEmdw1-
z?)T`&^CN+hieH#+IKC6+a}l`HRQT=J+-;)0(vA6YiaL%ONwKR+En3g|7~W&v)H88r
z@*>v{&whMt-Mi6he*LG2lxP1pN(wLhrhD}C>ertIZ(3Sx4|&?1dLT}uP_^+e(}8*J
z1zeXT_KH1Fe#>_whH(#rZ)DJE9q%tM9wac@Y0X!fU>l)$X8tpySu^Led&;@8*Z+9D
zJ^uaU^&-mhZ$x7HBl!FGHOf5nZ;!7J_Imn)^OBv`l3x8?4BMAybRE=DDv-`d{dZ@F
z_@3L_=j?wZc}STpdCq&bgpEoHWfN91&tNp;&u>2bK*M6o=5<L8&K=vOFEl+omZEiH
zHp?5X*zIZFeR3^|-NtTp(aav4e`J>=Datj}a&(&oe7ThO{@LM!?fl#S|N5|qUz;Vq
zmcgw`zG?R1hugQG|5cy&|L5;KR}<^r(>d%4ADoVe+*F^j%Hc?Ku!LgVWr-e!Y34gZ
zp7I&+-Vmuf>|kQ${Zd=b@x;Y=OP|yQONzI@ShRa(>*_oGzsy|RQ@ysFU$_3;I=5*}
zW*ustS49dgw@F&8o6=di<yp%&@7t|=Q+M2!W0|ODVd67MK=09i0kLvbuWx%C+ZZ^P
z^`x53{IaFvS+i2jVx9X(7wnt8j=3}=xX$nTUR~kNN6L<qI(`=X3vE)E>TZ7h;0-%9
zj*h6EEyB4A73vB;DjBz2Pn;+$)}nYJgWaJjZ>A$_Q58#VTvO$g*Q)cjcrGeQ<2_XS
z?WCl@(R<GO`#18$nw`FON~ubArRl+x4_qeS7WQjwa8ot>Ff~YMqMLMy>ytEx*Cwma
zGaPahlgnijeJ?NVX3RhH_nl^wu3jI8cd0T)U0bwvezH6zYiP<TwM?w~@XuP|b-J<A
z{{n@5ToUTcx6jpzoFH+@+FAb@N7d4ngf@Mf!dadQkF3Paw_i2vnDO<9>oLzAA`kC&
z_)hIg_~3oO_7H2!^c7Y@tJ&T+r5|n(i8<OKK4F?=*iwNPuBu!!ws<Xd`xmFA-*fIk
z#iaPh#Xh^#9{fM+Xnb<(lBS+sbpb=SHo2>@8obRZ4jDT;c-O?P{&McK(v0w1Q<#>T
z9Wa?X?@>HUY9dogz1VbPiOzE~8_ZH1w79ztM;WI~NuAF-e=?u@zd*;MdDBa-o_n@*
zll1eQX|d+*i=D45pMAm3&hfn*=e%ovQ5%J#P9%F<K8Qc_B0rKRZtJ=<2FJ{c8zbHu
zcu!e5ah+JozI<0ho_Q5p3LTBVc&0C&v#qo>>5W~Oz{URo$2`@Xj<%WhzdLY5qkgHx
zyj2#(fvKksTbJmFEtS^DD+<<nb71A74*{A<qTY|B{l2z@MH{p~JfeA0mVf%A3aMvX
zbOcs;ZCPj&(C+=YB6#a1vD+Uq0t@vtwE29acv;y5uGVfk`Y!0qX+`(%XI`B)kGh)E
zy!+GMy9FxGZsu=!dFoQ$^`)|*dsLrJdBJ&2^9V!mLWbk|KBZEHrfalgzpj!?|0cTV
zV1TOH@^2R`W~uvpzN4?CrY%#HvBRpc)6(Ws%0Gr_+i%PlKW`WKW|`Gb*KO_oYcFeN
ze$Q6Cc>5{mxeS&wZTh#~E!}4IB1>S41~1cO*UTrMbeAz*aqwGm=ZW0~(Pd>1HrzcR
zrmgvXd#KzG)h%Wx`8C3hMXZ<;T6w!`c2B;l#>Lg0N4ehUUuS%$8N^T|_w!BjwYo>j
z-#*P=tek(Cn`6Sv2+<QEOlztn5_c^Bdw7|<Zt=%vk2fb{{;;jd{IKef*7CJqep>9e
zK56a1CnParYu?+WXO^nAZ?*Gde@(s;!_Ii*{M+fC72PRc!<O<(xNMMFApU0g5u5+T
z+!b2OmrQTE9`)!m%f52GOG%vfCW&URP>bs~+HhO$7BAx-(Y3uQ8{hD}iaMetnp$Q(
zoqvsWU*eQGGi@&%(6h{~XuK(RK+wnQgQctD1eOU0Z(K<Y$zILD_Th7IpNFXY`+F)A
z?qz;#YxFp>&%BM*{cAF_v(!1k%O&3>uC4p$tFS%d@D?_^k1{p$n3#971#WM#<ukZ3
zJ^IbBnPuOD!?$d5*eVsY*K3u1#s-(}Z?Pf^owjyHJafEw>)qNP&C~3=g;%LenWd>1
zEs?lxs-9P%;0i6v`?qgbJHH7u?!U#)5&r6I<Zao~qsJDwusoJH?LI{|N@U%`H|rVK
z7Q0ls?%%wI;pQv>vDdN_zu)-y<KHLQ?lhC|=Lv6jUe|pZ7tUb4?ET_{1uKl_rLi}J
zwsA|$6}i&Dd!q1j$m!~=G^R%!)8oW9I#jsop8qD3dh_(Bgoez9i5W4|?~Bi8H|>7r
zy7rIn+F1stIa42S-B3C#GUImRvRTr~GGA8&mTvdBls@&5)J2oKxmthM70PbVh$wR6
z{BtBbQ>y6t=@{uIwbRpXvHKi0&YE|){{G&I$F}jomU+soHM9SP6bF^IeRAJ&X^z&E
z7k9SZ;3-o(9<fP#<-w*dCSks;(xjFPU$@7d-KWaBZD&jN%Xd-7L|ztl^4lp^NK81G
zxures^sc|xEEDGSO0H|Wd;eh8%x`a|ot!+ww#sO8>cPF1%nkc2qyH7G%A0)t=2q*=
zUhAt*%$j6({qIbnPe;rqM%5^Y-IQ9m$~En)*%Wc{Q}Z^imQ<ge_4VANON*{OlHV45
zs=#6XgV!<7Wx7A`&UcH`p0aYMuAy=n!^Ni4tA2Fm=(-g09@_n<;RchY$z8==4Cj@r
zuJn9&o*%S4+-kE*==V!~L6_^h1d5_LQg>B-do4TpQ_1_j>6cpWuKM|)cD8W1^6?K5
zdyejUyKUoIgL|y^6#Abs%P#O->360<dZtX)9hK9<!TYyGt&a#5ZP`(#Q5Sb1B>152
zyZ0iB*Frr%{_5G=*K}*4k?7X2BhDI=qGl#|eUHC$R7q>Sc$9dg#fE*Nhqq_W`my&=
z5dXH!d&j;kwhAh6NcifI^<dd`n-4Arrb;|`%h!69af1EofQFUcA)*hqM{Qdoxpua-
zdel=_fpBK61&%A1FA9I~@}%+VwZF11Pu6yva-GAg@z(4lv9&W|wXDj-rY$+}*tUQ3
z`3qv3nyio96;-;uOh-L&&IOVEdwCeG=ed0D(EpO2p>*t0oyo$NSA|NheCm03G55L5
zZOe7fQp+x82rZI+<9UB~^6m*tQEy+mZoi*@?G#V=Ijz*KSvR*l`z02wCbW3lg=hS^
zvJXXsZYsucu{kb2@jvGGcFn)%y`#5P$JBg&(;~LUIzos2m*{T&<PDEp6z!7i56EZf
z?@s-5E=K*JfmGWBOObHD7b#WKOSy_Ngwx70FW%PsQLtxC+Pko(9uu{fYjx6Ar+m6n
zw=g%PvNl%a@&coF|HDohr6EUEQ&_G~h?<w&xWN4VqSM<;UrBss>&R{jbvakH<Iz3+
z9T(PD*Y?PX{=8nr##S`xla}}U%^&xeMwTR|9Z2KKce|OL8(h8n+WzYBOIf>fSHDP_
zy0_TdeB<4%(YrX?cW=<2^(7<0QESDXySE;ESUe@vZ>@A<L-yxA)jQ?;KOFnYCbR5i
z%+;Ivc>+v<9?u!fUb5{JdUaj<-BPz0#-$%uY~9)+zeMSA%#}aaFIVa9*7|lmvv)^!
z`8C5zVciGE=gs%(Ua@XcS$VXX#4QH*i_;DMP2sq`^_1gPH^Gjig(o(>`1R0h33tn;
z66IR0XA!p^i%dB1V)2T1tejO<c?N&)|9<)Qs%p&ohr4edC_G!<J)djZ%3p??0`><L
z9PfGlE!cAF^_30@S!WOMJDr-}IN#}UWAUa36-GHrmp*!Wc5kKci!=A)zW-hR+&c5q
zIc~$;P6lgB!_(9JU)+n`d-JK=))>cy!B<jPcHTSa!2NMokY1?SG3zBSq8N5wzclgq
zX8{=p^U}mKxw2<%vnIaXqVeJPGu=sE@qE97{8#s$(_VJ}_tHi4?l0ZXcSGN_@!;XQ
z?VsaO$0$sVb)VNYFfcgVGBF6F4$mclS3VY0zS$dDEq!vL#;<kpfok$x8yqq|-kA4L
zvMNe<<?TI--<s{dYukR7TeOiWQmo<70)`-i_Wys6O`AE<J8|NbxO0YfyII9HDQ!P-
z;>KeG>+0{1mM;#!x?zs#(~B=x%+Xz47^>H|IsJ1|MXa3dTl>0#8Mf=6zjiGx-Fs%9
zUEQZI9REK5e)IdaQFW}@R~_l8=1-T*^MCj>CsOP(JO8ons#&~jkFOSO)nIR4Gwa;z
zqej|ko2w#qR##msn4D-kbBc3S!mXZDg&Sw-xL+-}*=+x>I`rG7?cISpHQe<dNbWb+
zns&4x$i(;MJ>&i=NuLCxM{SR<=ImJWx--`-at)jFoSV$X%T6!+Y1I-r>-}}tV%wE^
zXXjtt6eBPv&P;#Wuj#uC??1cx;qZ||u{ZKhe|r3>Ebz?R`>!iacc1D~`yCgyYW_{Z
z115<|2OkGo>ZfloKfEfZY5uawzqBe$;;)2vCuK$X74|0_c=r5UGml;U8ui7Gih}m-
z{ZrhjT^q*t`sNGKcPjrv^s27BnVrS-+W+>SPmeduc^r1|{)UFDYijCZnIC=GRQ}Xy
z-i@_Z+KkVZWHHRX#=|L=7|1idd6DFU&vJUsH)p6tZjL#y=!Si!`or4^rmLsDb_`xG
zc6d{wNBGksgSNu6Tr+MZMEX6SoWyxwB6ZeP)dLahragVIY{r@gs&`H^zPq(R^EuC=
zL+soK!mI8zpPltV+<dBdPx}tHKYY4}uCLbK%BP=hes$42#Yg{FMuglD6KwgAV6d`V
zaE;@~>0cSjQuux_YhRq|yYji*rTt6o|8I_wZjrcl+0v)*;*Z^IkN4?u-;w<jb^6}H
z@HmB-?OERv4K&lj4JNR~$y}Hm7v`h(r6M$DW@*cHyECtD-&_#cd;F@qO|Ex?dB%qh
zKK37SWnW(1oSk1^@$K#D%?J6@m*?-3-Bb1P?CSLU^KPyTF}9HY%(`dy4xL$-cz(>@
zbl~v+WqaPve6R17Vb-#@sq|-}TkU_&?Jo{CXU(a-|Nr0qdwXSU{y#qb{6FVinactz
z+3ob19TXITs;<U8T&bhB_f55f>N37}y45mX+dW@hZ=B<lSz<MJUB>!&Mz(#?S58ZL
zOwOu{<gq^>X!8G-V$Iq5)zdDXvz^YqsyE8$@7+CxZnJ-uZJo1z+J@fc>yDO5^ayYJ
z{NCFpOaGOk%!JfmxqCCyS9{N}aSF(l6qNeBKG!?rQ<vPTYl=H7e{PidbZOqy0+$CZ
z;x!c$w(MEwu3BHc+d`RZf#TK0SC0t(xc)``ThuGJf<Ec(CGm$-?lA<owd9|cRN#0Z
zt>iIzF2kh12F>Tre}29?Ez*C#zL<m0r?_W-Yq^$uQ?}c(UODKAILoKdQb|VZ-E2`z
zy?WwDlX~@ME#1h!t^D|f{c)j_1?~H)0{6dVp2S(h!Fxh?PcwJ_`+X_5V)}LzKK7j#
z$C|*>`=aQZ6JN>Yjq2;G&+vX|Hj)1L)?)XXry>v2L*mx0>r3R=G3WU`4+dF%y&UIz
z-V2_0A2YL`%d5UR@F&x}oo(g~eI5d4jI{>xar}074()pI=l!RL3~~=x+CN*??ydj8
z!1<UVYDL-OKYa7=J$|fq{@7Qg!}}Rm_<OxyJpDiWy=8*W7B|lFyl2dR_R|jao|nwV
zvfr6?CI4_Hx13&c;q!w1KaCFDyf8m}>hHSXGukt5GhJ}n?^e%Wm^_i`(!0ybr<2yO
zUryrF=aYWFHE3Nz)Xui>r~e#_qkC;X{ApOh9aniY)%4(RX*G}7kLQhI_v|nHsxP>4
zddm(j5q-wLW;<f|TXapl51$vW$h>_u$Y)Zen-9Ao_qU5zS4oL{-uZL#yVJK%H9lm&
zZaR<WYm3?%`GWFql5f5&kqWaYcM7>vY~l6QsW<Jhf5B@%wS)8jv79|D_-@nxj_cR!
zx9O}qqa2f&;N-RA>0bAmkGtJZzdF{ml2>zrJ)@<#C{LV)_~$!|TGzbGG0nJk`E-@h
zj+L{zw%?C7FD^QB_%@g1gwttv8Pt!jI2Xg2U)UjjhFvw_S^bOl7Y3JtU73C~+WGu(
znJ--Th>zj_+QPlrY>{<3cW>M}{@1?1gu_|yqsSEbnObWSg;y!s%?vNG$&)HJW4QZr
zh3Mvsi`Kba;h%fG`sIuzlVf*_9dc6N5LSQWZ*LcCUdLh=C%Fd-tJghTI(K*9u8xPg
z-)EeP5#zBaJFrY;kG*)ez^q$pEJnHseI-*B8|=l+j~)=TaBz^wYV)!FbCc&v<*OC%
zE1nzNj`KP9_G|L|1H2`Lg%>x6hklv4c3JbR$UVt>R_(fZQGSz{#Tg#{rhAipXKt2H
zSI9`;wO6*Ijp=pqzh(2Lir-xSwIU*JHiL-3rZ01L-#qF0ZHef#f7+}YG|MZe_9t`x
zIeI4h>w|;M>(_j_H&aZ0_AC9ToP7JerQ14`ei-StnVx9QKBCRc$QhSzv?#T0>Z6Gd
zoMT%4XfN8*&mgO|*e=-XR~PS_S%>a_`_b^lCA;VE?#RT?c6am&j7vV%&9nV-@1<SG
z?F$N@*Uc-L_x*oN_+~yc7N^e*mFq4`3arigl2f?VDR9}#A5N9i*$vy5ZSV_|yrlX6
z_mkO7Vf(Zb;%-#`TO07DZ#|cQL&09z>Z<mA)svSqhMy~(Cf#N&t~fv6@!6jV_hS}R
zY)`bQSK(Xc$?w#+#I@{6c&d3y_`_!nuP<14SMbbe5O%i-xc<!V?J^rf<#`{DESPV}
z?RLDwR;S_0WY5~}>#~y;9b@jhyuab6a+N`H&5YXr-;UmX{AOEAZCl;7n;ab<jAl=L
zs-d0sdW~HA>DNLj8#8zAS?8|sBX-@i9~r!N!r3f1lg{yOiM_`3-Z}Ez=JfY|(joC{
z0%x#pY58{f&9=CjhW)?!Q?!pq2J5l^n^iii$Vjb}Q<ul5tFNv9{EcPr_p?uaq|f&w
zRBA_nN&Z3E499OS{B{Wk8F?>0bds90=h5NLjfv+Sk1?2)HDo-gDtNI)_=9HWhS}%N
zzE0Zqe&)}m=MOKD6Ps+*_OpK<@9qTU?n}2n6kcxIH|N~+Y=QjCySuhej()j!`?B8r
zgQ?p>vM#^ylXQ6fqoRx1)wg8-jXiI-JKlEQwXu9o@z04W+H-DyU;T3l%eEJ5VlI8D
zn)&<OkKR?!c8VUl=H)$c$tP|Hj+t`2q4#rkuX|f}{phpT(tdTOZg07~jm|`^2tKh*
zruyI8jnm{Kq{99v>q}(%bcDsIOg}V_i8+l+hv$yrMb8fmTJJ*nSc{_l8k@7Go_g`A
z`b=MFQP!W2RXtxKer((I^6|lhvX|HA_OrZKb`ntb{eL$ra9{I#*~=wi`pbT_?pSTd
z_^RyTa@JQq$3J{p@3(2s{qwtH*SkyXe0b9;>%ct*4yEKuec=;#Cny}S&(od$^}+cA
zM_!t`#7eE7yZm&}>`KAlnb!Gh!tPi<Yn@_W8>uq=scG+%^Cij`7s#YPpZr-}d<{?c
zx04Dk;hwe%-nJGjQxt7&H`u85r0(6LcC@<rPXEyohpAU9bRzs#`OSNJ@Zdq?i&lE;
zyHm?}udwf*COJzpjCYf7K}Lk~gpF-SS4>>!-QUV;md!GS>(+PPobBSw3w~WKG7#A3
z5y{*4RlYX$^Gmj#NrJq7Yh=&ce7b$|pcIGLWIeX$hPqN)m`<Fp{H0p`z<h$#?@3Y?
zf8?T^oNg>B-~GKlsgvu4E8kyB<2C(@qQ2j`?DeL*TP9)EcdNT16`P*Oaxd)T<k&Pv
zbq|+~zR7{9T5AIvGuYniD6no=e#p6MZ;bD&(@9QNdy-QhS%2@JZIyUoarU*HyWbz&
zRWjLNZPABrMzh%)d9%Fvt4lYYeqp~@{z}pA)oSj^A$1S$GhBHmbnf}rEfF<0mKwg^
z6YD)uA=r2M(KBYv*~V9wxNP%|NX$zAu^}Yc=F+x@+&`4Bdc=RY@}Wn5%eL#!!t&*}
zwCYCW*}U4@GgaQsq&k1O-{#+?2NuQ11xRXl@;16(s=l6d%=_JiJ$cg(SDF2@(NL~<
z{8>RGEl7G2kNWI4Tjm^gJ;pQ5V8QMSk$-P(EKd_TTsHC6gr^)grlcL;Y{Fo)W0rXx
ze?`E#50zZ|s!vA*oLMXEpA>V}jd}5Nerv-pkHw}%zbAZObKLX)Q}-PQ5|-Zk$o#dt
z(!Xw}hn`!cPTTdT8434{!kgCY-pO*|Gl#9~2ekv%_e{k37VcmyTc9)1HnHNwhA(p~
zKN(odE|yvrG3Dk8weUGPJ61FvPEcd2Q(AiF)3$RSH*b8IV7f=Q_<Ix6G5xu77_u)d
zVCRqe&8gn$y>rd<>rATI>t2hR%w_IS{ZM!2=!3j7>PI)cao0%YDa!Is($c-2s=x3i
zcgB`a885kwN^HvfH(Q1pFECAXty$hJG4p^|$=_LbEgsD*=<pOuGkd%I+jTRRcW>I;
zzQjsKEw@kEe*NkPE8{rE9n}X~o%xjwPif6u8hHCJ+qX%D4G$muyBjxs!w>Eo70l->
zo;)~be&cy+=dClhdKk84U7gasPj23NsS9G<fdUr)F8tm&RrQeJri6`K-fZ1-nO&~x
zR>`h?3M?6srY_IY4sUw=InMENhRE|Jx7#*aqy-$|Tpt;<`;w9O|LgGuvt~W?IdfUw
z{kO~Cvb<$4I9{|EsrEitu6D-q;qkc>&VEb(xp4a38=8D4oO2Csr1qKbU2{0E=+V`-
zo~==5^OCNa7~DSnlYP!7-}%oTac|zIn)dkh!>&N(?E#mC!u(X!e!ZMAU3H<?wbKvF
zr^fN;pFES1b6lZtQToc`)+a4`n6GX8y2q<$nUwmB^~ImF<k`C2RF=#V&v<!oy63SC
zx*dKjf0w6i@Mc%{JinV`>zymR{w)+)BtFk=ZIemKN1OA^t!vH;<uyIr{$*hWOQXr!
z`5Jo5cKcmYnxvQHtHaHwTkv6OLr(O~Wcz@3w(|2j)C~<L2H$#cvf9qzfo8J90sn1`
zjo<7TrbHxhXmo99RQR4O@9eUm^P$GcWuf17^?xh$UJ-3Jc@!>f^ZA+D>)@m%eXsMG
z*R-<A@3<uAqM~MQ!nPx!blF4p^X^vHn?L4CD<{>|s2<&^#{V$Gy;dURc#x3H!jCH*
z&EEb|@|E4zAOE`AzS?Y_n6j<>#|saBdi-9u>_SGo`csz`T}M+b`o-90zuRfHQ0V#k
z4g0sPk58FgKKrEp=F7UqoAYnn-=4QC*n8`nnjJCUT4kr@E}nYYYUZ&ty~Rdq<v9}y
z7v>wCI&ZP4wdG>uv=1MdKjs^~jIK=F5yhgme&O;38`z{vUaPOSNL^@k<=z8{8xtmm
zbNqU_=}ULfg-}+f$YpK{>%|T~?YjCwexb5h>J8^fmj5y&HUx@zUpCy;T<EB_SvbXa
zcT{;_w&Jeh`-j`iI7NN`*Ol`>dc1h|Z~G??-w9fq=+0<loY!y0{NoVgOD(qMd4}io
zPHa(nGAnGYbeB5!`>>Dg4<)O_JH1n8?6EQXsmt^DwNlJQ+Xt=dtEMUSO<4Fq^6_rR
zFwbTm+iACL^7~Ty8#>RwzUkYU$j|rCxa@~Z;`R-<MBfE_Uq1dhDbT0%`ifpnz1dZp
zqNaVi^XQ&c&3WF7)xD(}-`39Scx?OKxh$G7jk)lH1{252qZ~_rbIna}2yFkqHcdfi
zXI*72<NEonn@?H2_#VA}+BC06qMJS~wXoUt%z96|!Xag$TgHW3ruHi~CLAc}alB}(
zbgPwjg4{wjvy;9FXRPwuk_!46bIbfWoLDa9G3<OX`M*b)Rjd0OM#tBOvt&Y6%!rt(
zd4hRO{zN;Qh%>(zub#=(upoZc(F?cvjpFkcM*g@LYWewIcam&b17q^{gf|iqg&VnZ
zELc~&GP~H6na$u||JM1|{MybB$qNqo*KOTlf9~D9IxEd*wl6mewg0TS$Gz}){6>}2
z^K$kXB+6vWnSDu;t@2!(s`bSg4h#M)YL`Cx+sMO=f4gqciNXzctYp&G2WBP)3N5X=
z-Cy~tZ_gI1lQZ6Zn!j%n`@OcCk0<sYe=Qr4bH~HFqWOmK#|gZp>^7I=y&uRLq)ods
z<K>wLg6?0RE=p-qXPLf2Sw_*i>Bi?D6aH{cv^U_&YYN(EDy#cvChx|>(F~<R-I^N;
zepEBfdb(-R{gh8_1~a{9#W&YFUSmDEu4B&@R@T7pHz%HHm*I1IVv~PIXjZS{)|ooy
zUzSXfHfx!};{0^`RqtOXBx8Q2Y*Dstf41rJj1>Wa3;5Tx2+Z$4lA!cyZr{|mFPgKO
zg?`Hjcc0ntGInFY;nzh!91lFuE@*2!WZm@W^@Rfc^<fQ8JEoT~Y76Dv;M~Q?a9m~w
zPk!tU>AC}XA_luQ{kqwI{lM<3ZDKi`D#b^1t2*|Dub3ErWwrJ`k3Am}+T2d<a^>V^
zXOQC2-FAj^p_MEDG=;?h2Mnr3H3E+KXcrXle5^QW)ptf_R;6XjM&7%L4*S@S=UcfS
zRn%{7dS(@W^2(J9zivkQR`~JiWEXjFQP9@DbigWN%cGK-RjJAC{ZeHwZp}UWu!K)#
zx#5ayRTezQBK}<F*VVI<*&=OsV<-Dgttz&c>8~Cg;6Eq3{O)NEIhk)OCWnby&6=>m
zQT*?Y5B!ylChNsHm3C{aTE@e4$NHzFa?b+;L1pJo)A^I03hsHL-fk(d%b3gj@0<Ov
zM03+^l?!_wTvU6<b@8LW(H@Cp2dOoU312_w-P$g^Bj?J6Uo~<QR$diIwsue7l)kp<
zgYgTlmiQftVm{M(J?EvG*-UD^6sjyT_sGpRyO?yMc-CK63g5G7t@_n=qu+ct9c}iX
zzka~(%!%ExF}E2%NUh|R37c1Hx_P@evwDMq*kbqjmY2(14Omvsk?NE^uXS%h+OZw~
zzUp!a^nTp9UC6F6@&GS`&?yi9*5krECa;Wk&RI8+zc*3ba(~l$fqtdR>Y3u5H4A5W
zEbrsoc`~WWQme1jiq}Y^)OMq6i~8%2YTssaFm`-$_g@@+W=?hSPxi9qH~u6`En92<
z=kd?>ZaYKO#pirW-XC3&mG5EdnljBaxToIzlDXZR7Z0@sk|*4^c-S)SiGA{K8_z$t
zi!>#8_Rh$5*iaRC-CMQtb3|lOUhX=F<zGK;+E7_n_%EW+d(t%Jhv$A<c1Y=(d`+CZ
z@=N=52fJTSl6>tJwcXxuBJqZ3@3x$(&$(OvtvmE2{>r)j#bI+AY~O6kXnf|FY1Lto
zF=>LRd8z5CWvn{|9R7=bp8uvtt3Wzzo#ZKzIYMtZBIk6yFtKWm5uWTLle;yhFi+;;
z`)&`tjTfHWGLSX>DzfrUPS2kiPp*3^GRZl4n@@f%!>yB?GyB8AWBvJ?<u)@{KAJRj
zTk;pJgRJq(W^34NWLp1k$=hqW`6rDhPBMRKCedu2=p{2D?q}=dM@2X4zkU6D{lkGf
z^>qbK61NxZeO^30q*?#F!Lrzu<+h=FmUpJ7zUA{fxhPmIIc$Me!Cdjlx08IIz4n}$
zvE<OR??LM}yy;&Z8e?|k@{BX)eiJ#3gj<uAZ55H(FVV;;!pY&%bbb4whtUkNLR*{5
zgXa8vxqN<~>#BWxeCqQ)YMnT&6tQ+Qx8X;n>-F-1fnmR9^mb=8ZDBrp;bwk)^YfZx
zvT@T6ESX@Yq%GcUC9ulyWbprO5oa#!zqe%at9~z^>sKY8SN<z5(UMrcx!Kx!(QoEW
z;v#FD8V-s%Xk`V3E_&i{k=sxraFx>Y+iRXlZ11~Sy-Kxk{b44{-B;KA;V2TAq&Y`H
z&@tt{i+ZDQ_X9D5X-7MrXU()YC3da-r9@W!ibu>I4NC;g|1UHv+r%R&@vKXDdsAmu
znMn7&7pb21N{aINub!@aDCKInvTkcqwdt#p&Gq8vj@ew`u+aS9cdT+#;)3vcckW;9
zzK{P{M_sVrqOW0@$gwepvnqv6o2&Z8%>=XOZ{8M$sO<c8xTf=Y=KO}!5#_p`ThF~T
z+wr4?FS^R8u<~|wh|{F`w->nou6mfgz~aMUH>pXQVH=B=WhU`gt!zJLdn>OX>+>89
zrbF}7P48M5@|tbbJ;fu}<9^tGNwt8?^o;^<r@lY%Xt9!tVf%)u7b>1CI5hjU>dHA8
zQ#*Z+Y+GTd?5+4Jht=kPR}|}Yr9CW#s+;;MK22l&v@5kNdO}ODzGSV`>Z8UJzb-$T
zBkLfv*OJd^i;>aJqAOq5Z>(6l)p2R*$%`A<r9*Y5cl%vE{i(_?(QBtm?1q*7OCsZ3
zwu>6ho+Z<iy#3CaD|&~rCaj+<mYi~R;@#y6R*JRTEA$r5+*W-`YvG&+N4)RZ6{b&%
z{VaZ(SK*<;s|~81LHD?I?Uor?M%-p;=zeQ`sVvE`nNv-BBHt9Vix%rX@$Z$$(cfs>
z*qv}O=TYR>sSRh9{-3%VBNTL!e_O%ndD)9i?xr+IfB0*1;K?%ClT(9w=j?7^pL524
z&SEE_Faaq(@z+0v9_v0U=vesrVOC?8@05t&ukLQv+*4$-YTbmZNB>!fY6qoXn!7%2
z#cSpTGnlp+NrtX_B{k!aq}Dgt4cRv;JdfYXU)Q~S|KGVvQ?LKMDswmfPRXyQIUSDw
zzwpaUnq0G0M*gq1Ow1#**^_GmgATOzeY8#S`~Iah@o(Tw{@Zmd9*t^-XL^o4T>Qs4
z?Z$z_|Cg_d6rKDgXQx!?)@}Av{;sy$bn?=?AJ0`^sbqeeyy?Kg)SrR(_{%@<s*kOE
z()zmOe1CoY#!Pp|7wK1-^R!<EYV3$Sx!6{H)weAVu55b!M&^*g(Jy_goy53>Z~KI+
zxW+K;=sDQhHTiXsk^9~aH%lr^blp<T;$!_7@|P*}AAA-Z!1n9Ox2>}d<+4?>G0a_3
z(9={q_eR}e!_6|^KYm+taYcDn_}qIbYkirSXKnD{pTwT^UVM%5dj0%WRaaMhXS^*P
z(Ns6Be(LP%!q!3sRyS#V$CPIMp9<w^CwK(=lmquRp5bW!z_vN!-i2wQ$`P|eovT!~
z>@;1y^7}LM<@S5)W^&H!+PE_FLUOyyv9u<3u3hQ7IFeZ`fA8A0#$@>^&-(&T{UUY<
z7tEEpEOYSAu6HNT+n-kcy{)9Z_&ZBXtK+(lCA=@x?-oqwH(iyf=4x;`{M#jC<FK?-
zzvb3G65IFt^un{9%zwjW9u!CFUEJZ5DZF0gXF}J`>$Y|+o%O9NXJv>z%zV;b!?ZVM
z-#3o1#bU44Sb8oxlO@TMevql>+_CnHRU0JNEckT2lfmxD9~O(4ohEx&zs20SwB%rX
zW%<W1Mo-T!6xF%wFe`KJ`sb47Mfx*cvgS1O<^|6*x93#moqzV4_{#~s7P2aGOpQYR
zIyt>BAFOy=$)oYWR;kmFbHnt~0Hu$cC6_xDN0f90Rk$ABur7eL)9QeN@p(71JqZOb
zHI*Wtc}~(^<E=CEh{ghwimWcheMXzys;taKzDOJtugVar^>x}ehiPhn_LC#53iV|Y
zON`>4^>W^Q{eDaK9M?11TQ%}xW0u^Fm{&Y!^&}>7TOG4p7U8$DJFAtH@>#AJ$}8}l
zDtpo>yI7Nz@BZ@WoWRED>19H<PEP(36IuF0&ScKpJlWMEGK(a>Us0J8P*}a~7<-gp
z?j+yb=@WA|ZONXfc=VXhG6_RQ>FmOZg-b+UDt*j8rs>0~$#4Al{z*Hb$DWK5P7?Wj
zra6Dk7R)GZTOD|@G+~~7jfBIBv=z~Ze*elas`>HZ;>9JAeGj-VoesLiWV|cp-0a8h
z{p%jAy{cMu*Je@4jV(5Rz6M@3S-q+9%af1!_5WwY$?T~s`!=8X%%-|F?=NQ;{qwfW
z_H8j-Hvi)0hcO?yWjAZsMhcaOmKj_$OnuvG`7HKXpuSD$tQSWYFMjcRf~A>JVde7r
z4Q2xAOdoG=xoyo9(ReuQ-BOS9%{H^INj$eKxT!3Av$y&BQQfO$%ZxJEb;~y%|B)Zz
zuJiv=abB_`zjU5QYGeFa!(SWn%Y*WYc3!{h_N8M|m7sjwGHGqu`8m6sngj}L?&-b!
z+c|sDeV?;7Ts$V5_urVKlXm%-ig0#IM#G(mFBj@pPT^sjasTGmE0Z{k=aw8|YtX0(
z?fZ5zL^Lkz$pfp;m(|LJ^>3-zUYhF}bpMv{)9rn6#w|C!<M&^EQGaogJM*;_M_Xpd
zOnP$J?~jk%zb*2CeGI3gz00yw<|$vDmHouxO^Nd48{LzPuFhFtGebN)=mTfhl<<zA
z=7MEhVs08wulCGc9Vn-!IIU!!Qp)75XC(d{KFY$uY`Vim-%6fs_K%sF4y*4xjrxA&
zd|k$=k6l6)3oE#;zsagtd!Vs|yC+An?^l|K@3rGoJ{?K;w!YClx8rlrzfk3uMjk1N
zCR;abyr<OenS5dMUftUPN|7A5SLl}JeB5l5U;W&(Z_<+z|D7H`OH`%?UOpb|rI~cO
zQeyiYHb>@OS;lDl$gtu&AG=KYPAG(Xhn=6)A9o=+@?6dR<m=gw7$VFk_6qU_K3mM|
z_V0xS|FNKt4{wOppYS_$q&Q~XgB#Jg(MK2-zi;|dw9Cfn$Fy)O#gFTJ1LgKfhz5J?
z$?-O5(cgWGr|9O(m@>P4VTVlwXNIT#V)tQX-gF>!f~AdT@!m;F;+m(NGy_8<S#}(s
zE|PoW%CYc@KtD%^hf@x;`m+03NN@x%xp#1>oX%^;{b?WG743b}t<qTGwkbWt*WE+L
zi*=G)&5Er}KRxZMw`-j2@4O`L?aWXe+{^Ru(Gl%6EQj~slQw%``+jcI_bvGmofBD)
zt&3;j_MHCtuIkh@!^b6ZK2n!ACwrJ!Gv3<7)8i!@taKpTn04R$L*LhYDSEU&=jY-+
zaXrD<PitEJ?mzL1m?iK`!RmpDsExk75=V=OgZuRC<+oMee>F`HNLn3bY5Yn$Vq<A%
z|B08*jw~sQ#V?%o+ho`(Ec98}vehDcnn_7=s6%FPPA*^7W#8!sE3dK5IIef-dX4E!
zo2pMw?$`bP?L6u50>Mvv-Tmvnf4M*J-|75$cK^cJuSS0nb~SD{yW6UnrWSqg@>7>x
zb_(_LzcITX^)UNT`}g4z9kGWGdv@pMU%&Vu>S0OJgpE<FW~{Y-{#-)9)$XB;#M1YH
z%VQ?TNWR!`fA0&{^2qa#e_n1CiF%glbV(`feum8N&sFzMvOl?F$>4VW>bAs1@@!lc
z|H6~`Tuf?i%l-_Tn0<B4wuSz)|NJPvlzZn9_YD52e^;rTzp}JqVeppIM$)0m#g966
zHn)fG?cH$H^E6wFq2Y6p$VZ8-d|#K|P}TULctls2ZAqwY=Bl)&^K08QIX&}I?r3-k
ztPVMROn3cRP5twq--y(e&-^!oVbfKYm`^8{_VwJ6n3ivms6P4Au1h&452mf05h1Ft
z&1l*fo52>5ry^M)<XLF9a9h9OK?A0fx33&YH0a{AQCze50Y~v96|T&X-s7ra#%FH1
zxZ0j*DN~W^&<qpUVXO66<7r%LtLbym!pXh*Z!WWc+16<I$DL)DlyK(@lUkAQ1#ENo
z@Y}?NAN`i;{zvcE<RkxjKRE{6J`nq}aa!!Zm#4lxSu`tZPPh5nQ(Jy%R3}Zp%B>rF
z_L2M+qxs>|ekrypU+fP3c{W-2iC&|J!aSbOYL{=-uG|?l-B*OKzT>2-fS_7YXR|=~
z8qFEPe*Eul?7sY*bE@^{O%wfllG69yPrBb%TcEvn&dR5UFE~w^u;#I5o}}(JfnNu-
zoLbKp?Oxx<aAWd}fMd%il}S$gx^QA-=*F#a&*m*~s1e-1&il4P#~iLFL6xe%gl^7~
zIkNhKnN;6NwyUqgcfAb1Vv%!DQqD2^9bc|U!}1N<8-B72ndvz`4ov9G+!g(1$H$3p
zep-p=dobvjD!s~m^V4Ma_C>ojD(<e?98~v6@bi{)f7jPr)P8k(*!|<8x_M6Ut}}Oi
z8}93C?fcbR5hii2X^wJEN0;oUGydVX_)pZ_`grPbf{&TbF7uuG@04#YZaFFF-1zVA
zNx>Vj9-sJb-MW31X~D^mQ@=F7<vRW-IH&a_%BMGd`i;^k{Vg9pE{wT<tvgUyBOqw;
zfmJQjHZKeNbzL`j!St^tRr3^me7){*i_8@HcP(uVTg$Ho&J^aeAxi62JIb%>e2F=-
zednF&=F5JR8k;!t*j4E8?K(eG>_yez3TFN}-3M>4+3!2&Qe*hVx$zarOC-Mky`#*N
zGshw8#7eK6`L`}AC{}l`-|q1sui(+jMSFL<rk#lK;%&=5#m{`+URr|Haf|;E6A4x4
z9anCtE?{TcqB;9wx6zU%e;BrSEWV`Na#rXaJLeCVWiFGFX3SmI+Un`QH<cyir|yjB
zb&d5aSF(GbQ+#I{d(EzX*%RlPp?CLs=ud3j(OKB-@$N>Zdn9lDa)r6}`*xT!YTD0M
znqmLECa?FqbK(bOm3?LXy8btJ9n;jhYxQ6~_w0a$&ps@F!}p&%;qBL7tB>xrtNOO)
zV6m-F#10d)ABQ`=%D!869%5)wkhn0@YiYssw(ak|@>WchsQaY;_x>08=Wge=e>=;<
zcyZN9qp81@O;pueE;KhcZ~nO?Y86Mh>d&4Tu?m0JPW>+%uVwbk<G17syV85Yo3lRU
zaGsrTDS<ste*Ut1`BzrxT{lyi!oA~%;(Cs&!mLZ!P5vibv^-v?@5R35(474m^&#Fd
zev<-ExkPo`|MK=orPsY3HEXrGDq0m4KJ1;`AnvyDm5f1jMv1qNR#D-zTRpvcZ(l95
z*y&px%qqBcM!l@lZLj(jsom0rhQ`050{=&wdRR55lyv=3G51tg4s&T;HnG6`e82u8
z-mN!7uUJejpBtI;PG_rSp2W(8#Gj^W%3;%Fd@kJF;~LEx@yl<^Q{Goswaq?hgoYTp
ziFQ`_@AP6-tvYqFj5Y6yhbhB^3IollVn#<Uzj{@5(#!6o4`aHwh0$@jnb}L+%i?VA
z`K^!B|06a3g|%;wU8SGC_!8?KQ3qRe_C#~WO`jt5!CKOIC)edt$I!V;ejRFQcIrOK
zr1HFU|5t<AhhAkmdpg-|e_hbGHYaB4^Ug!|nZaCI!6&Dr?D^)f$Kcl{w-oto)$%Uw
ztH)L_+nC;V?f%8TzT$54@>LzT-!BTh^5oR)9H$4)@f-jAo*=oye8;5|&g+}2x39l3
z_1r=s(WRTz)t8=|S!K2+*z??pwt1ythFnTnF$=e5W$LqBc3Pe%P+rM;{yWnW#%sPS
zbK+RrruwS={n90^%p){UtY0F3T8pHN+S{jVU$`h#=Q3RW-XDKCLHect#i~CN3oktD
zKCK!XV>me|`)KOfsVTEvTDEH+dvNIq!~6w7ZK}dsR%C7n_SzkGJ6GoAJB`(B%j69_
z5{xQEZ+>2!9zXvS;}L5$>B18EfCIb%dqwOe+OOO))3k3lUYYjm#N?jV{;xN07rZ;8
zz94uROKat%Z_n}?t2wUsoL4wB@8H8FM_kxGw@hF3xGB?dg`V85=|4^$mzd`uDLs{e
zVa>W#k@mmqH6Emy1UWXl9J+Jh@YeR~6A=xCYuCN5Jn66M&an4vYp*L?2jBFC|G7=t
zO`ooKe9gYLU=MdPx1vwZv1{JStdE8CHuBF}wRd4pPu8#5J^_y=UR;pLC$>z2?_r-=
zDOajy_ItZSM_In)bDfet_HA9j>7{%0w%$&0KJ}^Z{xO-ywnub+FqkW@Tw>%S-X~{i
za^jrOk==POG@qWS<n%oAlR2j>`TDe-<zH)BdBP3u&nr-zwA(20<Kfza*2kSL#g$Fz
z^O<y}(5X+Mc3$*zd2dc7>0YM~+h;6pe{@Lidf+{0BP+8R`D>(h3v^zTdcn{U@n~C~
zQBIMW(d}2(=OWfzdd}r9vMf}1$)Syb{v!Q}H*L7z|6Kf>U*3w#(|GxrtiMlY9p{Ot
z-j|&F`TC`cV##&0H)?FzJzHW;fy=8aDk%x=lV`Vz%)SyjTl(#3zXV%OS1r$6u|o0N
zYvOl&S|<~5r^?$*joGP2D=$hvMK?&VEz0}mG3OOmH!(d<njw~Zd$U31>1PK6rN8;?
z+<EM0S@frub!l?3%iph_t1op@^ICc64c;29i{8O+)EUpnsp#Eu?qu;d%(?f{I4!0A
zs#kxQx!9-qLbti9au$TkpA0#-vQh7$vRChl&5cPr_o>)8OXat^DX7bSuAMk-t8e+8
zbsrAYN<`LtvweP9+U(VKtq8Lh*KThpOP-gwxQ;7ht2bM_wAjSl{JgDmqi35c_-IeQ
zaOr)<(SviRepy*+Ri5=$XnB%scR{Tn!_E@!1y?L99DnqFXSJ-5o~!7Spy4B(s8n@Q
zGF8#+P6@|`fAXi|PaKf;N!zaWu`umHOr9ZQMu=Dm^JJ?-R+H?Pcf3-$lr(!^_Y@1k
z)&J9OW>_z<z45zY_Lm0|a`$&j2Wgz2IDJmTjJo%drQCV^uY%@uv6{DC%Ka!D5n7+h
z$9!VBM6%||eHKp|6Jw@LmWuTDx^t*zf46kA?4k$3DXGjAt><k7bUr_NHgS*XOV28q
zuaWf+f)`h4)+gD%e%Cf@mYU3orY@sRQJ#CA9^vN<UmFn<=6y-NW#$pp=bjAb9@vZ8
zU$D=;W-wc92g|-IGTb83t<UF%&VD5;RR3*?`^U>lY^tu-e-kgN*W5bCUf@@@&2_d;
z?Yym*e$?j8P}{j>{ssFP-yh4SZavWOGjDtUPmWh?&X=R()4z&$oGo8?o?V=E)k8Ol
zgfHBZ=dJEmzm9*n@R#hj|ErJI?mqrB@0I?ZTOapbT<7Z%Sv@OP!O{6uKhx9NcWp&G
zFWo%+Fz3FI;_~S${&*Hf-k&mWSN3B45W6$w2j?@yKUgcaQnLP|Rr*h*i?wTRG-N)g
zy`x-zJ$ms0ty%onq>rx3wwyC3<}m*WJ2%T2{7e(t8YY|y>{+(LbNjr)>8j83MbFzj
zaw-g5J;hn}*Ph@>Jrj2d8mcB<(|PTB^ZdS8k?B9Q)MXC0s99K8Cuo`oH@K8B@-_Hd
zR_19r&fpE0e)P_RYnhvieqQ7F%qS@*%F;6Hf8@I42HWO8>JJk;`Dd8>y=63QVLiC?
z<@L|1>-o+#&EjWBVt0G!-28go(Tb-6-EsMjR{zd62VCMjlQ3z@biIY5{HmUZt%WvN
zWQXWfMs0O_qA#<1_Cohwd&MuSD-V6ub4dAiCE{I6)>H`@-4gHf|6}fmRBFgcFK+p~
zlrzL`!?PD3UY)*@YsYqeuJh^_m)CA<d~>&T?U7=4+568qRr~p#e&KzW_2!(9+AC?%
zf09-rt!#!|tFl+EmMmttzG0eh^@WI-hI+1(Tp5>6^t#S{m*DBbBBYR@c&()4^`tf7
zOrK9lEU}JtWLG_I7@d7^;oAPETQkFE9ATL`^Rlj`Z}{fdK^hYj11`+kF{9;DVr94E
zhiRtUgD-wvX?Sw2wtsJCt@s*?FS+4HJzM^s)h}Q+a^H3A?DN~V=cXR%Nl$;T>~ne}
z`++C1y^9~YJhtJUe&O!oq)&@i&q-~5vAZ*osrzhX%>xE4RhNH}m+v1o)Udq#XR4k5
zwLjUxr(4oh&)$CWWXi$iYQ|=oDn2PO4%_yvIX>_Ca?Z3#%1M6p0gF!`vHrEoLc&#I
zW7S1xzlm8F3)-?SNwh!uTG(+y=+50K(O;_)y`PpQNgs}3GhmKymT<eAq+C&X{Xw*>
zm}>Xtmkzn%4^-nk=1W8^V{Kil^vPRLK>loS)c!KR_&rDNP1%0SwkPall3cjj$BE45
ze+vI^@4xI9)5-a01Ml%yW>x(ay&H?Sm^}^adF#z`)cVC^yQde_Jua-0=+zL*z4_ew
z(-xg~+ZTS?QrlSnJ!Lzq7~>O`>5*A~mu%27^V~d{`Ol8j^M9P(w;O+-^y}~GcdK+`
zmwc)yi~cUjwkdJ`ZO>v8y=DGsAu~QEN~^lP%8C)T3g4jj=ppCf4R-Us$J%}na_ccK
z51D;&mluD={gkA6{418O{U;)rw0|j2L`Xwx)Nyf!O)vkcPSDHP(YnA}U3c>B!?(5s
zsvojF`JpNz{$tCrw4i^wVa<vsoKn-HYI0WXpQ1kJ-sv-v7rCBi=ar@2v6<@^ej<8W
z#lFV-vDXe)6|MV}RoErguX}Ev?oOT%=a2tSEp^?U`BUcOp&8u4>pRbIWrQa>n$F(Y
zcGsTKVQtLE0PTlyu71Ly+^2Ik&PqJTkRDmU*sk(^l1`l7Q(pEw&13(&K66c*#B<ko
z$>ptFM@`CiX-I2LP`s9V#$7;nfpOjZpOReDj(%W%&i3<t=**h@mi;a3PyC!eCArgU
ztNr0Wp4S|9?9=e>Z2b_+qto}~v#PcEg^;q%Y%b><4PW|hnDOw%bf?qFLEEF3#|d?X
zcnJG;+C)#kxTH29>ua?8xz>3pPhK{B$<=4s_%d(7x*r1kzk<(|XByq9eWqxhen+5M
z{EkcA<VT{aKlK9ITTA~aX;vKdtU2+;IkIL)#)MCEw9}5J{GA>&Ctn~(*qZ&pZ<+aP
zFAKZ=E&R3W*p8jr;nvT8zmt2V`JvxSX{wu0*s&!omqSvHznNC^$4+VW`<atAMhkMi
ziuw}9EO7IF^RIi%t6!e4E>zigz$YZvY-M(!!z*7Wrq2CQrSkq)DzE9;R%P8!RMpiz
zUfsU@eQ9KF__C^Lp=>MHFn2huC`nzupL1czbN!;$J1cWf7yjMfdoE9{?`??L&Ry{{
zO1w&BS*tlVpJQfXbbe~4{;9QhQP(BIi>4)4<=!0>5feVlHFN9ZkUT5t*V+H>rXKQ1
zPg&aYv)k#?R`mzQPiiy%yA{kgiLqO5b#dm7(3LFd+qSustZACz^Nu5K-LIFTrpDLu
zWj7hx&7Q{X<-L8+(LW3-O9WEion-tIFs=A;YmivCXY0Dp#%nkm?6QsT2OScY)>&RG
z(fdX2TEmyyGmrdbGk+AuaMF~&d`|t%WbLz$JY3n%^M0IpMbdfK%zFl|5vltpZ7I1v
zx4YI|>%sOCz71!mG<=WF@@|o;%Tqi3I=O9bjrpU#FHQdrP3^ui^XjQ^ISqf#6Q^bC
z_n)ud*yLuFSQ-7Xe}T2n`GvnXci!=M`Bkd!?Dj7W0=FhD-tKy8b9t^(f0dCozjd*=
z@YJP|OH;O;HTWogV)xvdj;)40ALN!TkV=|u<Mk`+{?aFh-sYcw{;YOwt%pju`*qC;
zhdbXdoTG1L82@wPWX4VZbG(g;rwcXz<!;*2|4MwZ@Z*+Wk@xoVU2)_SdAi4k;m~tI
ziK-iHFIRc>amYQ7yHxO7Y;NSu1J_u$^?vGg(U@7Hu*@NIZ(;PSuJE#kwY%2V8LT<U
zclcC)-JCCd8tRIb0zN0+U0D7}bJ9ciI^Uks<dsKKmb(1e^SC8KDDP0DwXxr74a;dq
zQg8c&1XY}xxNMr|ff=#!Pcx=G5?nLWvx0F(|LGkEzX~s|>NJ}!p3Xd}C(h77Z&}8_
zPbWIkSM`44J<UJI_VVh<&ev~FTzf@zQKDPv+?=0GLKXY!exAMkKJJ%pQ%TE|7%pcu
zjlKEp_g8B?IxQ%5(yzlP_pMOdl;EcyjFg>EEo)x%$tXB?$Eut|d(v-A_q%^ba6{Fv
z^A2~u6l-h>>zPyD!R=S_<mrMNW&ymmrcP13jf>se^4vrgo25qXOge6MMYLn7`^<^$
zUzy(huCz_wUAp$cjgBs^r}BL3m3K-rY_3iZ$UiH;DE<jg=#AcuI_i_Uk~fF6UGtUS
z);7^|!|Zp`>u)q%do^EYukXH|$k~1^b-7ZOTMkbYE?&&G>F`@IE610wIMx14V|wyT
z?N4i{h3n+K$KTys{X=|7h$7?F#e1VdnI9bcyzb<V3Eu>>ls`VpRx3CWJNeIT{i6$|
zR`_Qwzt&PVHNj-NXcbG`rpMRP`%gA+JAWeN)ni}vKvVC#>#Q0#ng6g*_Eo)h+k=0>
z-shJOe3%@f%+Ms3;k9zM-96n?j2cf?&JAY%bakrfx3Is4>G!zYTBDN|gz;K>1*GrZ
z%yvqz{g-9Q@vVVYK|Rez?I9Bt^<sFEdsj#KY2RI~QnOvA;+aT-`RCm9EA2Cr+HM(q
z3fZ3#Jez~}WxGp^G0VRhSM_)IM(o{izG8ov@(qKi9g1tp170g`>}^usBoG?deLlco
z_R)QNo|iM-+$ote<HU0r@$<GxAH(gm)BbL<w(sQU^~&%6yUx&U@ieVT8#>>uN?R2*
zt<KUbZbez(R_?5%qpKZ7Z+&gP(0hp4?Tp{0udb%IwYjIv6H&OhC?fjZ)Yt2R7@l9{
zSyvyeRk}Q++OVkFIJ5lh&C~_!>>{L2e^idy_hw<0^<5*q`43awJRb^Lf6YIt+-b}C
z!6WWom;0S}+z%%*Ze#6VV)E?YZROy<+7BkqJgNR@B2S69%_s3zr?pXs)|9;rl;qxU
zf99ILlKq;?OaGj7ycT&~TTkZf&lM{Cy;?aucN=WN5*v=z9XPILkj=Npe3lF6@lD^K
zi@)E@*FWpq&f8_*bndPGnQu`Y7dq?18`q*EYN{U-zr}CRl5t#U^iN6s&o`alotJ*E
zZdkfHvbQs#@7U&F8eTj#9{IacWFt1Si9K_l!1X#><f^)`UUk=1_t$Mfva$<LoVb)N
z;eN31jN1OwOP>AOp246txv5ZNCW|A}<&YJPEb1oD6L&bd1TUL0qclXvA?U?~powyK
zKFI_HM*3J^emUXt@sPca@$7BEP3a&0Un=w}z7+FpI<r~$<N0@cqh&Q*tfLDKx<$-X
zbiMJA!7B9Z?#t76Y(Jm2*fqBI5bK@fw}q+PZJQEP7pGi`4&QbsHPt&V@{bS~*Cffr
z2^UVcC>?HFW_jK3ww`lNgQ8crY-*S9<GxcZZf71|g|FamG%WHwpRn(w*=|m`li}Y5
z9rx9Kc0R^nWV+Ay`lN%$zMQEOz3*4-vu@)P9=;jPv$^+9(wZ=}@5kR=QjA*<<$reF
zyW~Vro{^)@^!Ur1yDu{fD(`$-Q$A5`ugVOa&+q0v?UB5eb70D@I=8#i&K4v(mKnt6
zwjV6<Jtv#iYxbDIQAl^mv@Gi?m3uEIR#uuHk$C<|!*Wma?jx6fHz&7RT${9)ZvwmW
zx~7fy436zOBE$K@O!9bq?Vn@yU9X})Xe3D*>}>B`-k7^`=h|Z)Q4bUrxH@^IE*DuY
z9rbMC(XQKGJNZ|JiXRTzuijVA<W{pKx_WcW)KhBmaniSr&04kQ=3(RGtiHzU6yD6S
z{xfG<`_1B#smC_XRta!VPMBTwf&a_3#rxxe?(o<xxRd0p<(%!f;8w@H3e!e59sR@u
zZx0`N{L`jmyRB5RYr&7L{u9s2dL4S};QW8p$t=76SuAy`aeHSs%eQPi_x{1x>e&aU
z^G0MSIQ)~CC}K5H?Q+sKrUxp2D^_;!JH@jaP58|^&%WZ}sy(c7i!|mm=}RBEARY9x
z=Dxfb@2cwwpNlqse*Qszs$27tWBh)yyEQkNUOoQr<AzBbf1Qntl%I9%kPelJx~8O(
zc{D}dEcwlrms^T2)<vFD>1kUow`4DK$G+n&D_?AIo>_6(<crnCuX>a3iS3)*_pQZ6
zu)V|4_SvP`FRo>s$`xB@FliO{a$$~LTTL@}2&_J_`@%B6XD_Nfm6@-5UGOi8sJiy=
zkKN)c=GE07r0pc!^;+)SG+BJgKbJefwJ4`*vhAO>HtzM-bA9<%&DzlBcS)$%!Hy-y
zeU<zUwdCyeNpqT(WgWlS(kasFyYsG^@ckv+GlX}UXh)burEE%T+%+SHF?`>ic|o5%
zPnjC5OguEhvO36PmC)p#%ofj95tCJIN`F>xv@ze-J`s3xrQzmddDo0eS<f!n{^(X)
zjKSVd#ea^ytgt^`{^Rs>H&y$%^OsBFr{A#XOYDx9t&8}&UOel7bgqm@^|cNCd?FfO
z^|GonSD#9-{&iLLm*K{s+vSIQk1p_g>>8$eJS%#``;a+%XLb8(P4$1c_|C0m*A#5r
zq%yoM*EJb0DJ+s{RSi63a(U)g<r6b(r%RS<`l~%&)s!~JlV@4`R~yxdi@#|XuE_UZ
z{K~R^#WT))q5Q&&2hFOMb$iWRzH;)$yTV^4|G8GVHmPUH1Fvb^Z4$iZ3$g@HI47@G
z&f4mpIkV!Psd{_duh0M1yjYOSUebR!^Y}~~X6fze&Rj3_Eg1UwI#ve$sdzcb=l;<<
zN?(i4Xaxv97c)pw`4Y(|8gcWL>*<N_KjcgF&)i;lWmZpBT)ftW?Wtb^ztqfLzkf^7
zhnt5UO#kn7Rk0(cNVX%}N7r=Ey-#{}Pq_JRu~}!``=`>!9jCVNSZeBFpL)5P^Y*$?
zyMzCIWfeP{SL$5GAd~Sr;#l(W^<2UyEzhTNER5efnZ<ucPWX(U6IY+zaVO)&{plV8
zo${xiT0NV@<oY7@`1vQXAL}M@wI6YAKd>WSCGbaakYexrgn(svEH(E7t~qaYe>5#8
z=j2PaL+twB{(RzI?qnSoan;vouBPkTpt3sA>1i+g-Y~zatX)-QvBM#-is!xR+xEkP
z&T|dlevc@N-hSZbO^JmczE0y)>i532Wy&*|`U^k&H-5Y;wqe=6sXdbSd$r1|^((GU
zxf(q!`R12-@yU^U&)VlSC`NcCvIW()x@=n~@~mK?^dF1fBf1=kpEfSD?Rglk^}b*e
zFSGT}tYdr^7uR~3sM<dlpU<thHzuBIRn#kegR3w8mw&%^KR)5Y#^3XP&R~8K^hwI!
z>gLZMTMxfs6$-yJ`^;=Ht3|dG1pgh_&+|dpD&a^;o^tJEZDj?O+?B1{&zBn;<}d7?
zwLfdI(fnN^(T8leS9LCA37er6_r|0qeZs?em-|<`@W0p}+Y*}a%l>@Xx6Tt6morRz
zIqB1qPHFaE6T-ctwVOlq)D|VGzn|tTeS$A|<+PZ)f25p)4WI90Nt#gK9umF&?;<tM
zhHYm$<2UUpi&S0x@{UNtj9!bT!|!~1-W$1uf39M@?P(|al;^Xo`eotSQxdjZ{#nY&
zqZx0zGC}m+)7h8j$L(j)ySS=xuC}tr{>eR(Z|$#5o;a89`s@Y2G@iVu-??l}=}Ep1
z27*)HufCWgzpJP9#6yOZ*ZZezp7Tz1|IMo`0?CiI-#YJk;&Ap>j!C<W4?M3m5VyDc
zrsVX}dC9qxD`fmUyd6*Jbf5WM_C3d=l9!R`+WpB&yVv}T7x?txsovAShjuQTvtiro
zx7tcKkLpC9?NU@zcr@k2IyV&|hgemiXJ4YG{Ms$txM>lS@6j`#M5{hpnK>$*krKYl
zeSLFUSlahInKOLhb;l=6^O!DNvV*_k)|1BTzV`gDHYU$`lVR}eOLVV{-1h_dK5q>E
zH?6pQa$_5B$Jr@O-JE<Ix2;TWl-XQ;^?li4)8|riPfzDQTE-`2&n}!Jn(QRqwA)uX
za`RKC{Ozh15$mMaI^EJK);=u0&%-n$BFvOa+IWLU^sIo=sJG|)4&IEIm%aW_%*3wK
z(d(vflA0ZQ>ExLt>voez&u3b#-L@s_VnIbud3k$g_~9cO7ylT%4++-GTjP67LUn?^
z;;Of+jxTIi5Z+anw(K6)O-G|??w-Z3ypk$rH5NR1>zvkgFPL-D(o>oouXpUp*<jc4
zQo5x0!nw8oCEGo(T3Y1lO=m5XtSPyr>r=6H7VqCG`(KZbXV3C~ty-{s$*TQru@hp-
z3wfr6-gwma_^-mFS8}bdj<c`Vm?{2w(v9Nc`LoyY-uQP=%{PDb<waq~I+?1wi+&pX
z{<v!nqxKa2Q#bq?74p1W?@i&=WIR&xkt5*2vN@qki-L}xk^8zOPH6E{mcL><Pnf=#
zqp$yF_hRAu*%xZcJb08>KYjXO(ahXSbED-is9H6s9a=2SlP4o@qh2@T(&oeioV$Lp
zWmjz9qQ@}h-_6Yr*EIjSbklLu@^<x^#d41I;UAYP&acRQtzs`|xbAV?Lh~Y?O{~TX
zm%H#tsv90z#kJ<nO2*vAX3ku}jlbNFxXoSbmiw-+ywAB|ZQAy=<rkk%@4PdaDJSA}
zp`K=Aug^-(2}_w?CNTM#T$!Q6=aKvUjcoCh;-2M3FZjPUO!;?u%H}wp^{Z!F7)^Eg
z{A1SrS<R{LL2u?SOL@L~&ewXmr+525?Yk)S<K|;I#}w;lvs=2avdw%e<5AuCBBdrI
zc(Vbk^=CJ6t~D1YS?tujJteRCw5ZzaPk)`Sb*yVUwPZ`>@+VU>)`cb=Zu)t5+PW7U
zeaZ&w)DxnVe`kf|7WhQoy7OJr?f8x=t`-wcfpwF*FXnxol$m<YOjrJowAI(!;X+-1
zAH>}_$-b)gOtqCuZCKs@prXZF`_v55-ak3CN%qFOe>$`Cj>_IquSuIIdE$Jr;;p8_
zwXe6%4|lZrW_G>(u6xq=6|65?>n*q4+-=uhYRDeB)4o;FJ>pZP$4<!#8^Mh)5-km!
z8+?TFlMmefoG@$J!>_x9Z@c{5ZtnZ^cSem9U#(cnsRt8J-N?v%x|Tua-jYLezHE~B
zzaPkZUFf}|*TGZSZLL}1CqAEV+P;4J>B{0iFD{DS*|^$!&CgFAOo}g`Jzd{_LHqT^
z{kFBA)+eUOPn)+m>dtv%ogKZu3N-_p7OxV|-ne$Np0K_~@V6(EOy6{`aFH>JiTK9<
zB#rOHnptV7r}SsNJ^C_4{_u<$chwGmkh87)^Lx3!{rj)?Ywo@N|7dR?W7oQhz9etm
zuo+vo$!tE~<Lcvnpigzm>?!$8A(A39qRzTq^)-z;c&Yo`oVOpt{ud;i3YT-aC1i8x
z^RCQQEVtu&WmP*Wot|(cKAP0<YFC22!^9bu@3)K1UVH86cfId_{tN6(+ZwkhZg!Tq
z)iWvk)oom|$Ifui_uYD{r+&4X>cTA>7tfaYWb4oD-27{$%8yvrX}2pPy{9`@%~9B`
z<M!~I&{8Rp=`$9svt7PsMTk!3VR4cA1=<(1Ke^|t?z&~T?m_i577k&K{}V5%s0f{0
z-?pf`+{a{=%AuB!Co2VaO}pnTQ+s^Q$%3sNSK93+?f+D(!u(7B(KO@m#D!~^(ic_j
z-ERCw=7h|9{#|K(fx3sPjc+rj&bB>qI9TH7G=}pH=UUD-cwCY5vYGT`)16y!g|%ls
zKHpNrGX3fHyF5GN)=XfJUnLbj<+FZ6_W5Q{m6;!AF3#eK`>60`j`wCo6T!^4kJSq|
z*rhj=-ds{BZks%R%ZmTLbG<UVMc;o9;Mi0B&)q%ky$sJ%m4qL0X{)aMn5P!vWZirA
zY)h?V&TI9R*QC>&CoAeJbbU_0YV*pVJIgI`<)p&NNm|oxZppKVnz}ppVqHt~Eu+?i
zL-n^cAGo_UT|Al>AeNbEC2lP<-`{zDRnF@>3NO2KW^Bk()4aGMDnMjvRO*tFTzmED
zrI#let$%o_?izQv*5-p2YYZ**T%4!8a??L$*<lc35GQWwbYfS-`(;gm)fPcd^8+g*
zQtnK>S;WOxoF|tdd%H&MzkuAy*ur%Nb4+XgM)-yY-#NM5=BPoa*3SsF%&0XxWb*yy
zi{22hy>n~ErqHiqDm!n@aa+B$=bpvVd3l-(T|$q%JNA8@7W31iT}cZPd(V~r&5bnv
z-`DwPndYhKCO^_6?l6QI7R*03vH1yaO4lcDx%P+c7lbuyguY)q5y@6Fqfm86)4IE|
zn?8%}^=Z8Ic*4A0UsgZy+if;=v*q<wcU+C<E(^W2bZ?MW`0foHKa94<ye!&MC;Vvp
zjjlP{nSV{q6I(NhNwlGDy2|Mki;6qUTPMx!e-p4P%Hz=X{$uB7d|vWBM*o@lx9n$k
zswer({q{-uCtvR@Zh3ptR|~JO=+=Zv<w%4Tc(Nq?=)7vVyXsA1VV$5z*nv-LJlx%z
zPnX`RKHTqkqIkPk`qwQ-x_o<2Z%DaOF)3`meND#97@>ET=H<=1TFRF%ynkSePTIOt
z+81tVMxRcXKO@`tVb;@*DH|8%FE@L$fOUUVL|kf~D2vv2o}+6MEuPB=FP|VRV#cB(
zXLsnoP0fwdr=DK8D|XFzf|hJY{lN)GjMlBm<_b73F3MJMsL?@o*{WMbVNA<+_5XTM
zzW=Xp(Z!Ya{by6X5~Wx8FiRA~6k8NMxYM}md$bnQmIFER#?#p&RxEa}EQvYB#vc7K
z&|KlxX`k&gx9r{Ss(t!%ufv7pr`xmdzs`%~c&+qItVvDpk!WXwNb73T@b=wnCttFy
zf9VkJdQY^)fAdGR>G!8hdNz0V%bi=Urc7UWbNhrzi<ZoZu3o|>^g`rTOw9a76^~1M
zpYL*h{)a0zLi~k)_wm0RTUpM<FLPgdQ`28kr$(rv=-xvWv&FJ?Hdl%>#3w~%iMiA)
zj5fHm&4sm~oil9H*Q(>T9^vNw_rEOVl;q#{AX%I9c3+39#dD(%`3?;!xn+NDoLuH^
zyR+lot*FU!(<VP+h`#x&@ZX(hLPvrlS0tXaPo7+1ztaEKl)QpD_3VEVTKnd^7Ce>6
zvDz{Fj=V%{MdID9w-cYW7B*~ln6z)-p5<jmd_OPoY>H<6Vj1ld`1WZSQ~R6qR{SzH
zlD<b|o4xPo8noVSc%R&#o#4l^>j~?@l8kqovJzG6baMUNc3Do0dcEk=&Fa<_?@!LZ
zd+u<$a*EfZ?Y$Cl90@n$t}xEd*|90}QN2N|@3gBisZTfDxTU`73EPpd+8Y;VR(z_=
z{Bm=K^GgwjH+*i-cy#hlB=T&0<bQO@gp%JUWD?i8D5Zb7(<l0OoAfy)p&Tp5gZDe5
zH%+e6V-$MvC6MQ6W?;4Cgzjw$o$gXAlDz^GOFmAzy?_24+aiSns%_J_Q`YNBn-_ds
z`Q(pA#p~u@*@64z{$4NQYTC{GMJP$s`l)%B%awJ{)}GU_Tv~3v(Xl5he}dw{mD021
zs{8oX_WC;(-AE}`@d)fVV)A?D#}yAXxPssLAAGDc`_eqK^J_P-XD4$lN=V$>GjrAE
z@Ujn26l!+*EiZA9FHW1_KPTVO>Dh;AKVn&ZW-G0T*qf1}q^Of>I_I0<#qRU_ZWw)@
zC;Le*eD2=o|LoRTC|-{L(G+~4?&E7;zh!~DGXjq<5>%X!bwlu%6gShe;u#BP@_63#
z-T0u&qrmpzg0rzxyWUi>i=^y)w#drc=k}Mt-L0#yglYQ~oYs4h@gVNL+q3*zalvl|
zcE5kQ^HuPNwqT1zho@Uz^LXNJs$AZ`eopoy7vIe9Ot#D_>{FZ6to`{WRxsLGSLf<Y
zvy-=&b9zVAf@QmBO!lzp5lj93&`WM&*`v7@it$Zx*%i_LGO4WmKbEJ5Ok?ho-Fx}x
z8D%k}V8LfyuBUhZGh5#D!-yr;xi}>%sP&fk?!ThD{+E~u6)erjwcp+7RBU3{$$B|O
zs_y^Q&iy($t7UzguD+@=JkWgo{JDR{A3(>aoS&38=iJpvKQ!|-O)pQbFt@GU`GB>Q
z+g<+VOLfNMA30`c%;&uNiT`Xy(Z>HXJ7m5pZEC*pGUwN9=QS>8`tvTbs7(4+?y*5=
zm+*zd7vAy7-g~;(lt*T*4foIR$Vcy+1sP@~#$L<4JTdKd`jJkTjUfw{Sl&&|k~Us3
zFW{+j*vx`!mwOi{{0cm~j_vZZv>VrUr=43X)bpsjW*6)A<F7Z{+p52tw8LWhH|v6q
zvRwf(E1uWsX&p**t-O_g(KD(~>`>X$`zOlU?yjDYv+6*vC7<!+#~T8@g4YDI^*BWy
zSbIgGK6lfJ;wKWExi{J^emr1Z_V~Ki@s3wUkAJwGe^GpKMyuo0Bl`m6ZDhPIYH%v(
zip=)xVA0;?bJA0N>y~+6T*S_8*tPQ}qs0ks9<yzI`HNPngqq&Wx!R>5G&Sa9Yu3))
zw)Ka&@`Uc{ynn+zmFYfL$A*V9as(<xecR^k{(kfJT!B87AQ7XU>mqCUcvPpV1UE01
z?V8!SyjI!t)Lc!mZ*Ah&ehJRn!rkW<zxF}Cp2qs$Gnu6?XV@L{Y5HCk<)`MmZN<8E
z(MuzqH+Ic#W9NCceV#;jOSobBX7kl=txtY4_*pVNG3UK`ZuL!v&wHY;8btm6yX#j+
zhLLJ(qp;cAg@S2&BhOycVvgRfH{GjKOX0Vo=jPzU&gt8)K5=RMm=ILI?8*-Y&MzrO
zRz~;j!=6Rk#$USr`@&P-PbS@W)vipf%393C7IJe<<DVpFy=A|S7&pnL%Su1HewJ_k
zzt`{UX0yz?@Ff4cPX6Wd#!G8_nP01YeRM(gS?TJDKUBZI7R=wib3@b0#E+>dr!5pa
zW_WaI+pPAkf4SM(*7%(Kqv{DaU4DmTJXzlI#@$Y&`rJ*i$sCL2O1DhOaa#SbF_B?b
z_X%kQ(Lg~j8^@oYk7kEFs%~0V>McKAOke+W;ob=cl6JPc2|wUVcswVVXX-r{`645=
zMTZ1h>}@XlMza@$_gSz;nXR?ByzL6-f~pOk!b^1SEx!4pd83_O?Vlx~7bhON9kP_~
z-svgI!gVLa3smH6*DU^*6B4{tZ}rSIvGvD$_<x=^{{Q}Nob>Zu|MWCNeDB77%dNjv
z?<4+v&S^H`e-}(bZgB_gci&v-SycB>a*ot5%@%RD6y^WXZD~JdbzOZqrHB7-635pZ
zA%o(esMyW>&+vSDvPkG*eSQ}MzXgk+%B9cqKc7C>a;(DWSi;o#pS!>3a(13cm%ewK
z`;39MdGF4n4>YeO-jDK9c)RA+Rfg{gMV?!4?9+=|^G#BG?-!wxMcb$3Yxzm^>4z9@
zTadnfL4(q^+^wopyA{J`WvxhzzAL|9zel6#;<t&{npAFHnJjvu=}DNILrtiEb?yS*
zfTN7P3Gd#`efC|>P4J^vfb4aHhSnwzU(uFBogyj>s*7eUnpn+x<g)Dh*CGNvUR?IU
z^K?5OKAT=HF*iDV(#1Prh4W0##od1Tb+Nlyd3|{>i);7ss4X`cSMB;$HEFVkjd(TZ
ztx4WXBgJg09^P4L;{HKr@ztI=Ji(!tCF6DG8f=t5<aaA-<?IzK^AiMiY2H}8{I1~H
z!`<E8a%}H5Jj(4f412yawW?Ee`#!awtzr669C>&3)h7v5{qGW8r_!#u%wz|P-$_>G
zXLXV}x36;M9L|zVoBMA{L9Y3)IjZk%7Kq+H{K}kp>9U>i*VxowY?)W)dsZlmvuTC3
zLA^!lcITE~xp9u`^sn5JY%hvmu2p!UGwaC(Nmb5wUUMbnUb|U73wmnwOX}PEsb~FX
zMMxW~y_O7)4cfmc?QU#FDU;ih9VWRpb7zDuj1Nke`*-@=_c!wlAI-j7xY)wN;)m4C
zEei{>mYn(U>~7Gq!@NhUR0~c%(fGdU)1^1xf6rdLEih9qQ^xM2h+mg!K&eG(Oa5i9
znOAJ~u-sd~#WmIabE#P5x{8Ln2Rk-%aI6$&x}T%?j58o{t-N&6Tw(cIm&N>HtM|`3
z{N?GjWna}=-zS8fKf-%`Bad8t#LtyhcYkk*Z%(y+@aEjI=Ffs_thFv!{mino`*nRz
z<+q95Qu{kDlyq9ZJsy>RmU+W_8Htyt``?)4%sC%g%6@3q<(E@JcX>>?r~4|^cFo~U
z7FP;eYS(5miM{wZXO~2bQHWmG+7rtDZ8o!So_cbZ;h>65&Vj9Re93Eftld5>;a5z4
znsB?bW2n-*cPVUXLhaj+U7T9(y87Xt`A0V1zB~KLTV4;A(=K1Pso%(IXL@w|$Xpec
z*U|SbHs8OWEq+pMx|?vY)T;LxD^DEx^e`*p{IRQ|{|x7d$)EaDCx86Xt4Z1?inR)6
z+gQH!Kh^u&VY~Qgw)IE->aI-F+H!UIWasO?OXa&}7jV{}nV7UEy|#0sRF9{X)Atqc
z@7eyIw<!M67q!48++C(dA8OsX)=%_c{NLr1dBE(m=hiI=!oeo0WrlB9WjkD^Yqzw>
z8t3(9%XW0DEspVWE}b#;vZ$Eir0pL+H79#5V~goH!u?n9T0o}7nfYc?z1G`rUNxBd
znyqE!o`naNd4F@C-`mp^CX_hoDr<M>q4EXUe^=Y-ojU$C{=wCMlmA`*mw(GlY3-pY
zqHmSi{VJ}UEIbkNHYlgvLgP<+Z&zna)sKUFmRPjRiCld;MYb{b_PmIR;!nOFE$@vi
zHJrXt=)=|S{5ad+-*je*w_jw7W}TAd|Hb*7)5Wxq1yX-zA50T?`)HrX>h-s_Wd_~9
za&ynRG#A$gG8=^^CFN$+yew&Z`}&CBg3nCdcKkD@T>5)?vTDZVlIg<kEjyoDwmtiJ
z`UI=JW#3)@55W_@yFY5Mo}h5BulW1(!m{W87Hsf#PP}BL6UUyCzvqEPZSj{YEJ7JK
z*F~0YNUdbj%QwE{*=zkg{J%n5u2;d~qf0Ff_VkK~yLvH9SG&LXcb1cf>8f~xs71G?
zxz2sABE0h3Gv(T2s^2y%Y@C;{?dcg`Z>~1>U_1NUwpka>xR*ReKf{ef_U6Ix?sq5K
zXS>wpzsak2-p%9wqP|N%Y(s<f1F?l7>)$1Q+ZDmLUUH-HKHruA*)(^1zbf}Hr#-*4
z?9_jm5*RmCzO&r;PFniJ-P@k4@9jSK^Z)hT6*oi|9x36DV9L1IaZ}<xYhUulSzG&_
zS-<Bu=BP_NY_QMzee56i(*iw}S{H8%S|!SRc2B+*pCa+;dRt;e{?FBigw7W*SzGB&
zzy9@v^S^I<Ws)q{a9oY%XT9tEN?bd-;`yQlN?YC@-29>WeBPlaK{DyTCOtaollj%(
zXof@l;=uWJ3tnwby#DIw4*jHuKbyke{tEA|GJS9JlB;-z{Px0QD!&7Ez5Bpt@ZxEI
z#N#{53|~(-?~mGkr}j>}%yP{LAM5s*&N&$$lOMgG^8Wr21@*?tW$Yr8ZvAXMo1J#9
zX?xl|#+w_`?wyvtekOb8`B{6Tr<l+9mw0u-{Y2Yye>QvWG=DiM{<BkE=hduEQ=`zc
zg|7>;7;{g)V|Z1&q4KZIE{mP7ZZI!WNC~r;`%(5^Uf|sWv40m$;(qer!GqnC4(&5^
zZOr(X>!y8Z${)dhpEDxu9|c6G$*>i-wUoTLIHRj4`kqOiVpHGy53$CU-dnaU%MeN~
z3hVJa{&#0d%P$viadu{(e+CjAQSEFcGBYm!m?mmiC=;SD?+{&C>#dtwcTxB4>!jM9
znYAasFeKgnv`r^H=s~}&*k$R-`LiNSXHVr$pOliFB6ZHyqO@vyR?aye#%JrFJqg_z
zbNk;h>uFQe6#gcNw!T)gF`Oz^J<reGi0^3iyP9o#^^%>Lzuz%?xk1Lf|Aw&0qkYvE
zrzG{qUsss3WZt}UJ5qMUtv>Lo^PT^-0}MY})BL_X-F=m3GS3F}x_^gr0-2gM8Mzi4
zEtAfgb?}F4mPzxwx^EXJ{+eu{r?ay;`4N+iQ9sMO>GIy~KX-oKcJ}1?k6D2}u_xQh
z|0sn1J)M^FamErCXS1hy*`+gLuW$FCxO;i!QQo?_6`U+qOSa^m^b^YG>9&0K@ndo8
zGR4Kmjy21ONQElJ>Yv`)XwCmGP5AB6qiuzePTgg;yO&pbR42S&!1(8Sz0T_cTjTdE
zdbeinGf(By2ktN0em2IwxM`c6{LxKw*=M>gSSi7y`|byC&+-qQ4|@KuzGLyQb#p^?
z`QeR?@|B_d|Ng%F__wg^`;&kC6B*B%yxx4^P)d@4f{zSOj_IO#cUwIA^tRsFbN!;%
z{K7j)>$!UzWDabaP`_*U(KmnZNG&s-FLK9Evs6$bHsDY9Cg~IW3z;NZ-uAIxv8}Ip
zxYyA$%Z|ylUCklo^ZI>tW#2xX-F#hte^aOQgxIgYcZZ+%yFY`CZ=JXI;)@TJViaB(
ztqRB!OP{~hP|UZu?$SM<+ggna#o4YhJo%HzJ;6%t(b@cB$H0iSt2kWmcJ|Lov#Ec0
z_mYO%<bQv1xi2w))ckMl6gav3#p&b~XTB<x?OQC9+17pRy+^G7MQMf;2P+SW=CS{}
zbvkBiW{j)Cj@)lnU(7FT|Fcrtup{9HujJkEQ+q_)PA0j|;a=(SZAbdc!!wunD5>so
z*AzW$#<5xY{nhDy(m&K!23)ULdA3Qk$U==TRek351KV$2DEsMO(Ajf%?)tXAu;c&l
zp8b2IHdTA`@9s?I)|-<q`$nXRE~{tyzx?`#`5S7pES02nTGtrz<y{DzK7ZQr_UTtQ
z2rSv|;bJ>E`d;NF{q;O^J{^ml?l+-+a`uADyuu-F!XLJo&7Eu9c*XNdw&E}L@HSIp
zy|UwacV{<eYWs>#_N?tL+hUmdd`((Nr-&)b&egj8Dk}WhfwiX|9lPZ7ym*@N+{K1>
zyw8_U?ekv!d6k_{q$ICGs_&zFC6CyvvX+_n&3<2gH&x&qTk@5pmZV#JpD*l>V(-}U
z_F8J|Rk0&1tPdG;L(7lu@nF(DId|ITBdXO-n=KbEo-Z`@lGbOrnR~j{yxX%X&+Agh
zQkg5qAC=u+bcE3)$2spzndc7UX|262nG;#%Y<`^bYM=XQzyFR?&HAj|f&D6pi=Ca;
zuKTRhC$=^})a~2yWc7s0{CkX!oWF42I%d+9bNjj8{yo0`ZPCfhiRp3X-ny67|9sne
zMCF>c@y#h;GM?C*B;ME>(ziIUaavZ}>}N}N-`nuNapr}B?}8mS7G=!x>)!d*_1=Yv
z^Ph7%+`Ze*Wb&?AFleK8i0z**m;I05<bHf0Xj<^>y8SYL-Lp2bO<TS>n7>#dD&O<{
zK7UoouTr^Qt5?Vvm>+a1@p>rW;BCwk$G>pf8Rt1=mS$!Rw{`x?wb+Gn+*Ib=6JIFV
zAXnHcINLYKt;N-5{hUWf(ys+D&bQ(yQ5G`o<59D2?UqT~c1&7z^Cz#F=lA?NoHk?4
zl>NSy-GL_yw6-j&JzUbYG%UpA-YIG2&_gcYmZ@n8uV1$3km&X%>FjG}a%Pr?8@USf
zUoMW-GI@7m?UseJ9;$c>`!~H2-+%Zh=ken#o$EPH?%TIb&CASm-E^B9aofI@?iG)m
z^Hb)*&pvHaL#HxzroFbm4UF?DURB@a&3R(+O^Wk$#?9HY1XIH9y=zdcUhMQps<^y&
zX6Ki;Z8^*2<v&G~tLe9kaXH6q|JaupF6}qz%ae1SM;^79EAHAm<Jd~;4>1mLDXZo#
zuTz|-cW%L+mqmG-eP%lTl$H3Y_(suY58tF&@j@c3To$36+C64G70=@e5AqyQc)7(@
zz?^?+nZNUv_bz@RMdj}|s=ZT{pTTkHcCW*o3sTGHuG=ZRdsg7fR>tEG6FgM^a&Dh*
z^GI;P=dA`kl`l=Ma|*u_o7)-sgLRe2aZ7i554lB;-{h43)C*N}v@DfPU;p#;=hwTW
z*k&o8RDbsA=KPDz+j}w=uH$aoB(=yk#UwyK%I?pZe`f+_Jtz%ceyZfyqqZqaxxZRG
zn`e2g{)?#nv;7Y@-K`R=&|92&f%*NCM*$k^w1Xd-Pj9YV>O0lpeNjzP&0AL63yb>R
zFWQ$7Jm-AjqTj_#9a}Qz3n;$u6+CivPfW?K+U}eV-@Ruvcta$6&lG=|{P(r$w=L<P
zcWmjpTD8Y^`!_W%qXpNu7fe6wkfT>GtMK;kwBV`xY9h`{@s#oW<oY{L#bH5kr~1X#
zFy)S1UBe(Jp_7m69-m#+w?Vkk$ExVu<@UT^Y7@ORRA1h2()?xb6tC2&eT1vaQ6=Hq
z35MAw+l~tzX#AhINN>)?I1!d@I%$axI$_#t^qOaWI9&7k!p>Oz*9rwIa~r(xD{d`b
zA@;Xv^MSq3GZIZt9DcKQrDm_3+mp6{Ue~LeGsBn8*;e~fW$VpVv)`Y}wA^cQvRk8q
z`R)1bQ*s&emA+lAvtO5Xf@xyK<(K=)IWHytne<!1!h!YIYD1PY@yi({X77=|BE?c!
zopOug{tn51-fw3LoY`4cCcQW)Gjs(<ViE7%z8Ok+oYS9vn`4-@uzrT`hN7i9VjlfZ
zmM9+Io_PD=nl{BA!_VpuSU$}Duy+2&)6vU})OT0NtnzD=%Q(+3zjs~wR`yAonu^-=
z*|@5^Rh0Sr50zdNIlVOTe9=3L5=N66V<x6|iP8e^j97|RR7fZVq$zy}T_(`=V$+n4
z8{6;fa25%-m0!1BLs(Gwk=n%T>r|tg*PQm;pz}j9bmz-v&Arcea=*}BazEdtaQ)LQ
zl6tFtZkqEny82)7<QF?8^9ye-_{kO8wLY=#;MGL8h8<NcN0Y2vu2)E<J_>tM(qLW2
z<h#A>^0dsuXSe>a_}8jtEu&}m?~w3Qy|Nikp6YL1EZ^>5xBWE7gZ296OldaLL|Iep
zYXAH&to<olxAXs{*Lzp4e|!1Zg}3@PZ(qJG;Na*xd|>_48oNJB)8@X(`n@Fm>GV6<
zDsiV5{d72UV)=u}>?E1r(-fya3Nn2l?{v9&;)}DTuU(zAbouto+Oh1=_NTY1Ui_Cj
z_;_JX(|3WiyXSco^5j<*1aR5b=S(iV@$SmsUNfx(3&WOcqU(x|Hfo%mzERfQM$f1y
zt4+@P$O6r+FG5XsUus<Urf*BKIg8>e*V5uyX>Kc>WUt$QT0T9d;Q!qNI~@M}aHwRm
zEWYl1qxHoxKTAe#|M_M`+rJ#>w{Pan^j{~Tay54&<Mub7E%tM})%YJgD%kUF!r8DB
z4C-ugE0!3~DJ^|)fhq2Dsmn^%Pf`JHZ%wM*lmzT9o}77hbHT+!7MK6kl+2VoZ#P+X
z+8Wa-N;59M*<~=_sQD%1Z_6$=@sD43Kex495XX1rhE1h$)ZPi&--NG(#W>74wc)&5
z1V4kTQCG_H7hnCZ>i?eMvujzffJ%vlOTe7#g5ho7b{sr=w4!2-+@%kzKP2Y`Kel=h
zD(rAL<*0+{ixt<sZ62}QzmoQ(is#P!(!Q9pT4y9e%@hqHI+o2djci{WnjkY{-Lzwu
zzCPX>y>kB=O`Q;@dkITD{Jy5VjII&TQIy{zSoCMf$^}d9EFRoYoS^Ebzcb8SG4|J5
zTf?hmvS}*cr%D}Mzo>cFnzTxn<Y3jK8z1KV;t@_3b+Fu))x+FSs<2B<yUHzfu1}Gk
z()r0J4+Pgs?+%QJ{<J7vSaRZTg}aWOQIjw3R4o>`pipLZ`u&gJdv9$BJjpam)BM5m
zzkeTRMI9*Jx#HB#j7`^iW2ZW=t_YsAL9YM(K|fFbmdl*KCQs+v$25bzapv*mSE`QM
zJQvpAJmv4dy_OS}DI}iA7xA9$KV_%b^sw8j+-1Y++#idSs=B-DEjd@q5oL6{Z%LG@
znD$H&?-Z9w%wKte{!MY#xpe%a@w8@!z-OfoJFf)&_<6KEnq%e3LT^ca35KcXKmERG
zRasw`_ioW;=aR`B2gFpoG8vkGWqlPXs9wU8^fq#KQNH5C<+HO?ww`HN_~a4Onp&<q
zE+v*hTFI@c(d}Nr68k1dZd+^kK}PfDuB=0a?4km`3XwSpw~O^U^By~0zE-kOvd)$H
zru?zK<NAv}{A7M~XG4<e7a_5CSsFRhPW;|Flgo1RT+93aO~n5-&*JXY@#$RU$8cf;
zgP*l~&Y5btdd1!~cb~t%SN1)%<WGj)UB~)6$8_etOb(iwc(d71bLa2MH+`3)?mZNE
zZMnQ?W%6U?klmNeqtE<2`MCb)-NzGx{XS1t54zswBEMsemEOm>sgGY?tgLIvDRq0f
z`cwDaxxbECUcJ85Z*R_PlZM?_HoS{95UsqLes+%n&rL&D^9}hMc88wb*tvMo&S$IU
z#i(7%RN8cLmC4N;%dT!R*dxoAzGG!j?2X&yGCnP`J~LyIkG*$oUX*<K^43d-CViFu
z)_PJm&+nAv$JwBDKsIep)BY`auxRGyUn?SmR(^VR>zaUbx$8RVtU@EZ<aV{{*@ljH
z#j<0hi$Y}9iM=>u7rEN{?%oc)t)0hTZVc3vSvTY3!Z~Yha{d*PZ>Wj%Sy9R*as5u@
z!7MIANdfn-jCx0llG3`LmU?M%&p-cQ$Mcm;)iye-5^gcL&N`@cKOs>&CdVu2^ijQw
zOjdLCuN!h4;!~cyEj-e2{>0uXPqU`}4c6rRcj#AtS<&nxcE^|O+^b=gah*Ro&t|!Q
zvzqe9fA!_>|NiwXDAv0w%5NMxJ1}NNjGbq6TkP$V``yfDFYykWq2boLMA+i3a!rF)
zKhtT|McV7PTDOVb;M<wfD}SkTWmY=x1GZc5A8M;PD7I$pU9iioZu>61mx_vi1TrMA
z6*&pE9I*fYu3GDJ>ao^1?z2_fbnGrgw)92bH+uNzfK=SpCCne+ety2@@vJLf+1H(v
z;B(q_)`xvp*Tsdg6YIVm|0Tw4Jku-GBD>^}+4`NAf{q&H#~fVY)UP#7f8!PLa|hSi
zym9?|&}sH`(`)@HqDJdF<2G>yDCiZu6wF)QzH{%oC1FBOx6NO>aIf{+b}o^7^CE71
znw|b%e|hhbC=F!=bJ2BY7A36nD`ao~wrOd}0hQ|)Te$^(T|fQu$%k)MwJk3SUG^Vj
z=v($$`C(<>2Q~{Q)2D*os_uI<-OGaeDuVkeBDv0T)~r&!cbV~ha?kx!wJ+S({&9|8
zq)@EU$<A>u)#?5--*Yo(i0Mkb^WSSH94qqs_J%{{DGT>CTs#|=cWF;ml@#am{U?Pc
z_egbKF?zHx+RLh8?bcTYb$MoK&(-bYr8u4%hgfl~5}NQXf4R`n+rRG}eHc)GMBjgA
zSKbl-weDXfH@~df=V#oo;i&oB!#n{gs|r%s7caT0Q$MZr;tG48c_ls{Oy|#jlxF);
z^U}m$>wlInFX^4)RsOv`J9gb;VYaa4r!C!|s;|9u*Yzq_zU-f%Th+ncCQCQAAGhki
zP^VSr``Ed(#^btg{%-b!n~BPdT<&f@zp{2Vy^Sko`^xrXyMddD+;ow-9)gd=l--*i
z2ygTk%P=jCls)MGge(80M#ZMXq8GHD+Nm>6Z@tCvX1xL9+!+BuHn;v4m5Izb!|1h^
zz08U|tMRen*0l?wd3!ly7{XrFozQx}KH*z;z`^XP9VXGIF5i;&?PzPh_~7TVnC)us
zr-vuJw$PY*Nys*(YhS{*#Z~*>J+8O1Tax#S_wTCDg+G>L$<OeVe3EJ-RrhM;G$Vy=
zHmu(k`EP&Ozf-bpUe`~f@`kxhGtSt0CALptcp%<odGcK6y)vKwwkzK{q|HgGJf-o!
zt5aP#bj!Wnb3-p)mkzxcGy8nFtNg89htB)eJE<~+a=JM#TvFt-;$<Ym>*C~B+avu%
z(%5#KJmef$D`WEYz!o0wb$^4e|K(r)Ixoxf$Ngznj^*1$zPlw;tWbZZ;q$JjxOD&O
zAdVe#raXBR&ssL8vBA}^CL;J@z~TsF`=87YFRgmE-C(2NfykxLg+zV4cXa+`u3E4&
z?!ggh>9x92N~+e(Dj(J{u1d&%%%5}k|KYV#_1fCZR<n6_J~?XtmZ#p-`mp!~t;+UX
z`K6QeS&x^z+?3%k#rSyDhB?a9r`)%lw(k8y>1z2y;%vq9+glD!u`>?HDeKnP`8Vqd
z%e#LQcRQ%cOyt|M$@jFYVYXIK;c?}MhAUQl<GjTgQk1TsS8BY#IXN}w`TIrYOT~=&
z#Tch0{+Mle?N^)jdX8oFlh;q1!Mb}oZ<E!BsAJ#bXHMO&Rmhkwy<p~7o-Ln`i%*KN
ziY)f!O1yJWrBCoyt$9@N<zph|#R47IP0s#%_KLIm;E`9HzfOL)>E38QVe6J=ckaZp
zQ<?vMW$c^fBlq|8<on)^dLaeor&7N2epKJS^z}TCse5CmKP~Z7ooO{Mh_gRE{Euz^
zSI0E*{F9qf7XHvL5B+~a=!V?|t>9@PlRHIzJ~42e^~ck-(=B$Uc;zCS7|YFES}HaY
zhny8e9{j4&lh0M$p|gI~%~y-1u3S%bwlhC5;meKry7>tLAL_c9tFL($I$V5l;Ywo+
z+tjj<W6Rp+EX>;IBsJe+r%9T;LxAGqfQ4dJaTnI6u_>y_);vBSf1feNl-q2_hDaAJ
z-`7WsQg(lQI{#dE`1)O$@~cDE%n#1rm9BaHL&I*a!c$!9E~Y*>F?;{9Phkg`_f`J>
zdpdam^JdYf_YQuvGh&=_?CP11w<eqBpWc+S#`@Ue=lt?o4d?kgeLp@DC@<mi)SbRR
zB|=bVpSJx+t(@q}Ns(7uswB^Bm_GMzSn>nI{~<nHU$u`)NWV$BQ*0srz<&C5<vT$F
zK5uu=dYW^M%f@KM-Im)OTpLOs=Px#X_C_rDwX1~8`(4+pC3o|=CNJbY@yOO&T~v1_
zgJsqF-1m~tR_>oLHGL*)!C!+rEyrdb`7ct&(Gqe#E`#OazK?l#l}#4$Uf!3nqotqY
z_T!X)Y}Q{ZcYmor!Y7+{-hrhh`On+W&)waQ8Y=G3@)fHv4z~J|dt2=u)9mtfshZK|
z=NaFM&#yekv^(EKmgn}u=xy7ksvUo^iLqJGe7;IxQPrv~Ka+mH==;!T5O6EMhxgc9
z|2^$?tyRmJpPC80&&^<F2+k;;QR?7iW!3cD-M6#quJXJ~oO=>Zz3JE^@I+|K2{zrs
z8{hP2G^L2Gnzr?C!ZnM(#Xavbr+ocg;URsaYsdfTN^-A5osZmhh!pW#w^)8+z0>?7
z+tY31XGzT}nHX_wt-#g`TYeaS@LIU5{P@`o|Dx;*8E>ACI_ZB`*Sh1p{GsVLd`?dM
z;<@|gm4{(=$r*vI$??@W-}Lvqwab6^Fsc5M$QdRpWw+mKW(^+C|Nggn|Nnh=_nOQ9
z^@XZ_{huw-6UD=;%Qv&yS7`sOk1iJ5`0qXL*ngox=HL6aFZo$pU)!25(63^66um(8
z<NBk#|AZI|R@Ox^MDTe16mPZjsxsS^*SEaQ=Z<@4UGnC@M|(@;Q-YktrzD-_+c`Z#
zwy(z0*K}c$Ns(c7#4+xvu^EYn#4q|SZV=3jvuNG5@!r{Kt9Cp#E7vytuY2)sW_DP}
zwIkQ(CQjd9GH0XT{XaKT%#$t#na}lK5W*3ZkjJ}d;*#13)4S?&*3O&rTRtdNrELBj
zDeh-pc69mH3A%f^yck{xM*VVPQd^+9G=b?-zv@G+w7=RnZ~wWO6&cK!ZI*QL;sS-v
zN6m+xv#hw;Wwe*`d5+coEqq@Jk2r5R@=t3<)xy7bRv$gQmoq(NukGWDcMpg^lDTxO
zFzZU1==NkzoyRYI`+c7<a<K&55>R}j<HXJ%Y_^a&&3op}N6+`>#PQnyu$U0{t74bz
z{>O0!0;PNSH`|BuYPp@CwmLAhJNHk=g$+?cJ9c#4>AU&m!)Jf@<L8S?d^kkj&g;9g
zBfa-!%F(s$?ghuhzTV$|JvpH_Fs|QZZgX7O0pVnJ5A&`5pBqf%*w?=6-}LQU+~4#~
zt@Ucr7mCF<Cr^20y(i*Hndkb0E6dMno$C-=mNg~g^N#;dK0f~Uc;40qF{|&N)|Yzk
zV9;56e4?vE(E8N5SI_i4uFnki<2bypHm#=k#Tpg1!{I;u8syofnD=@aJ$|g~J*U!D
z(IKXsJ2iLh<Et&P$pyz$E`E~Gz5DWT_J?58u!f$S;=${Gg;%97W8JTJ^ms4F%L|`!
z*xpqvb6^ra&hx~4VvO<0mtBWnx*ZJP5MmXO{P&{IIoHpdvR2MoD9M**v$i24ZCdPs
ztBTcTuNR1DG=HDMaH??YeyhNkm$@(drdRnqz9d*IWo@4HMDg0{MGOxXv|c<a=Ders
ztYc>MP2p>GOLlxZvN(QjPE5|M-ff=Mk5;S|&3riV@b<|HHWAw<ihapp&%7ySfBMlW
zwfVy9MJrmA6w*qg3SwW`$ZcEAak+Ch-=v8NvL9FHneWZ*|I@rH)%sDlh2_UBdwM!2
z$a?k^cwSs1cIe5i4-vOdo_UrkJJo!tk#P(6tw-}8<R<AGek_>Vd^l(Q%(;iAtSg;y
zNu4dz#H`^IOT>)~EzS)WekOh6-ta-;?_sux0{j07jA8|>ZToEIbgn<SEY&c2)uXf;
z%|12L1hZo{@x|M|&n$gz(XwvgPOmTQ*|)wYS?p-@KhA&bro<7(M~}BD@J%zgon&#s
z(p+|{V-4r|^eDbWt<b}F@<a|TymaQjaob~g-8N?1^=EuvubRH3=;IzYbq~KO{hEJ2
z8TTdxeV=qgFX-SJ+rQ$Dyqi9)(EfM2{7uBl6|c|tI(HoT&Rg+_Nu+FDkJBxWM|Bfp
zB23k|O^i>iPCCW6VZt%jEgJVl3|G}v98(n3%+h$mH&e_)c6Y@dFM~t-|DN7&%bO!%
zD%LPL&{gC?{wt-NkgQ|gGyZ>*ZJqh5j@SI0_Ti`H=QMI&h!*KYeA{Ajv&VLl+IDM3
zu0v{Pm&(U{dm|99x2M9p{Qsx5*^jetXK&|KGDw>LY2MHG9Io~g8QJZNX1wX-vHo#U
zj;YwznB!}++K&T=^h-FehHPA0`0xF_CVB7U>g7Mm+<RA6|KFc-<X--lCDs4i{}}I(
z=KtMP`>E{np~Vw+e=u6LXvY2p)@-v^egAv+llJnRlaEeO<vGn!*V}jJ-Q+yi-TpJ0
zja{}g-YE{ediKNDSEpk69@jYQvzP1I-;>{PxW={SHY5K(h1okjJ~nII%`?5#^M38`
z)X9@1tiH_o+*%jA;DmbZmaE4??TZg-FTL`RH%#!r3HBAYKL2FhzfMw9XMfIe(|IDN
zQ!PIW%{UZmDqHB9e8$XHC)eF&OJTs<tvS^*rFe~PYFO&OeY2d=$n?h7?flZc{<X0O
zE;QC99y5HvZS`ULsvnVw$FyhO_Pg7j{c`o`oDSJ09$iT-!BZQy%IuMxAlTo|c|KNN
zfN#^<CYM#q-Wq%}|Jf2(t`nmZ?0zigM%-!%`}xu9CB*(Z1bkDN_}C{)jQ_Tm$Z3ai
zt>B*d`jM+<JbW9sPQrfe?cGaL3h%t{mRf9mX5;z3z9YS1i|RZs#~cVru;^ARIezH8
zdV>G*uO8dQ?tc9AyEZW7+THn1;_|}IKbGlCSXv)^?^_{n!&a7(H%~6E_F<IZ%~iE}
zVk`H({=3CFiK~x(O`VfH-|{<e@UfWRXJ)Xg+<D0I>1$5=s}F$_xK<ue;cwn?G~`Uf
z{sNC6^NSm<eRQebG~M<}&G~n2IsZ%8<v)hKSy;J5a?9gQ;p=YM?knF|I`6sUzo~`F
zTya6Xo}XpkTF1}7zc}#2rM=znR=Sz8h~%8xxqM>8nq`+wr@Ah*VKa-86m@3FJomKH
zF!8zRF}viH&%9N>OxikzHSe#c>FkYO_50otlLJmC8dc9;nb4N&a$w&~J$}2yduN^3
zU0V3GVQb;Cnys7<Yj-ouTq!em>gmrfF1?@WC1y6=H+gFJnz`LAa%X%b#8Rf2Or7Vo
z<&xSF-{cMnlj{~w7DiY9YFYW-#8hO0rd44|$)r5Lmv=tiUS3}JG5iXXyo}6;gPKx~
zzfNz}kKaC{Bba^D<Xy7+mep+P3VkPc+{*vhr;vAFBK~^FUvp%8_RVE?*wQ6GLyfO=
ziv8C9_CooH?#a64R|AghX*+T8^b#d=uPWbF%73;Pe^jYdnSM0W`MYHNk(kpO@kzSx
z6?;CtJ+?;fUy2zAQ|I@ix33ue)&2eV^%3Ks9$t$=t)Mo~0+XotoiWmq7o1INu0NUT
z`L@>3eP436e2_?G_U?dXA@gd=-WMd_(>u2!;N8)-jfEFW+iq~3nY`TQ@2{h3HyEb=
zsgAzHyp(_X^{BZk?HS)L6cU$?lb^og^zBVmi;msddbeRk>vp}3J((}`5AM3LLxb(j
z7P+6=&DP(f<lcRFw`qqL|H<fQzKbJFiet{K?M^t#KgDL&+vQ6n>NIAay1DR4{O7|p
z%FAxda&#&G$oAvfQ;i+F)2}TzIMW|+*@n^U<EHkT-}B@5ES*$cFn#5vOD8&gFaEv0
zS^Mk%AK%{m?g>_2D;C0Y%;DDI3kSR>H@vycd&`%9)5*OoQ@L`EIc;{;zckUl+3na<
zd1VQ`*{NHP++8AZ?U?y%Pv@c?WjD>()c9SQ*%NoXae1uvv$<NXAogA3l9vW$!j4^e
zHqSqI=Vh?*pU~m4u3}O0`J>arY%){W_JvbNVC#YVP4j2|n{;vBzMuBlo3gLnsb+Ix
zJEQS6sJrQWc=O6=lWz|;m0mcmakTpGBAvy%In|FA<;)g2{{PtGX$vxbKKswp!DIih
zKJk>Ml<YP2uX&Q2%l;j{@<`FP{o0TI|ILfevdyZS(zNuYp4;UW_Lq5Y%BLm7?78~5
z@7KM<Tgqf>FF8%Qw)I0mciVrVE;d8shkQG<veakUW%YlRk3HlTvZm5XU98IRW{bk}
zGe3GB)irkr`P^Rq<wfUH+l-gf9=}#KwB-mawy;?G<%HZe)#dkQt=Y(WEb+(PQ?4!N
zuKjttKBKzCep}>$FWSXE^Lt*DeRyBq|9<ms_3y`T-o5<W-sRAQ%vE#eKX|6_GQ*%D
z|B0;Wi<Nr<m9N}=@mQ*3<D}PK^FOt0Upu4Kq+V?2ous0*9ehjUK5`0NoxEVx^c?RG
zFQT^ZomqZt>ZyAxZhW=f=6Zc!cbot8y&kV`c`&=3TQ+|c=l5S7UxI&RZz$K>D;Xc1
zXS~<fW$t0WY4YYOvA!Rzm7n@wb1;~GIQ!|JT$@!Vo_5Z;XR8{NmifWwdD<lBy1gsH
z!>`}0RzA4zed_z(Jq-5~)$h;dt?{4tW>Nl!?!}WP$<ENQ5uWo*bLsIz{4ejXI<`Y2
z*u`b1irt61o8SLmVeIlSKY2}<=Mi_A-|>5@mM*Ae*0|xEa%fRi(7cp=adFHdYAg3>
zOx`7tXf^-&qY_2`)i>EgZtsk|Fe!n*V^8*)sfs=E_B%DFKilzk&(0G6*CkUp4xXMi
zU4ixAL8*r~Ry^iq&w8RQoouo{#YVpJYw{b;Pl}bh{+k6%nwux`>`ynp>l^+mN%_??
z#Fo9?CYPR~SRkuXyf(-4_}ZII3+z;U_q;8;rKg_vhU;MN8@|fvDN8)_Qcl)*^B?(J
z5zApO<f|O{+M(FMZia=xva1``St#(g2uwZ8J<H%-)ZC!iT3PDVo1bqup!~5t{nCd;
z&mAX682E2p%5b>)%b~(uiQSr2{neM6r(5)<F}y9Gk$KVV;kLP%vx{E13F^f@`EKNH
zvgJjy8oPG?uYY~>HcaAqbU$n2wBP*-J9u{2TzFEoWcPvfg{k)@Xgob2AJl8^5o)Np
zDpKH5p4N%-E71iKHH)&PmO4Guy`ZtmVnH*<y`vd5U%zhNJUxHj-nyTm_cnjn{px%9
z`gwEr8S=)cZ)?BtsD0f6t~IVPo1-K=794EjE#vpLHQvROWSmxJUv_H`Q@r6yi^CaL
zkIY)y%rzsAv+a|-Ug)~|{ssO_rZ1GQx2#&@r~Y1i$}Y*x<`4G^Ex+~r$MStF4y@0^
z+jVB7$6ewt)W2%0f66Ys_?6D5`3nP|KmT`rar@o)|Nq~{M&?Vq3)OvJzhEmj59<Y%
zPhM-7tv|8_2vjt#nJn(8;PxnBp>Ng}V`ojKh5zSS{aW!V*+MzeQ|_AovSqt}y<7Kq
z^{RTYZMT`F4C}csEVPvGe!}BYWb{j_c5+VC@xwkT*?i&-HcF3-6u;%}tU6GUEm8bx
zq59GdlQUg+l&1Z6`P+HgvuXbxk3R=pk3Y-t6bWt4%#k?XEj!QGZn04NU%ok~P91nH
zvzC>=-0}1I?YmzwNsFhS>ALs$<%P|vYm493&F!75nD*w+S@VgHS;9>1D%p337P_<D
z?2R)jp0qUg0q?85mHfx$<4d2co_yq!T4MG>QKpFXM@t=UiRrd)<X#uM?_7uR(wTlq
zdmg;JXnF6_qr>4ArW3E^G@d^wH{*0-m*nah)r%sH8Gh9Dt>O5&R_S<{XIbzTiz8RL
z*ZmM)xtTF&!`5=XYkLn))Vtu{zImJb<^UHLc3+W;Q^U^`-CQ<np0CGYz1@ENH;?bK
z-dr&;%eC{4%G%Jay_vnLO-gQS_8)35e0(oD+dB02i^Sku;T00M#Z9wrOcPS&6PESO
z*iy{uA!e(_<D@Xn=`H6E6}bXo`97_vXw#c54LiCY`ds|C``4_zBD=u!xrg3Q(Y@#6
zwlvy&$zFxPDKQpII=xNG1(z3p<cOSdFuu`I;<=XV|BAOaIHtVr{n`+DW2&!c(KN?o
z-ZPgYCw;ykxOyL};z5%`HdlMMtef+3JO782C9BkQjkwl47v_8ZTHY}``?O!lGQE_2
zeDi;Qdix}y{=(aioi5*=mYUke?g+A*-t<|~W`&>F!ooEXOWtg4RrUMKn_6@E+i54=
zlgR=08(EGjZ8dPTwY(bO`0tDAUk&#ead#P(Y!2Vk(6`AnV3RC^uqpr7H%YIjl-~=p
z*?#qLaH^5oECbn94K|S{mUPZv*|au{$D@{EQ{1`q38G4ck9ZeybN5W2__BA)s=r?B
zW|>n~Pfa~^eV3KTkKD(i;(iaVhj?u5Zr!mXjYDWt!q!-&tJ}XBP5c$GK6r!Ij+u(w
zn<qNHIK|lVA}XV2Q=Y%?>gBaEUVi&od$`u`O$l>ZeCO=fricGID-!4LVlZ1U?fCK6
z99gR)rtN;OoyGCw-_}>ltay_S_}1(@<{SO|ir@ZF)n^|%Z}=bDqRBd2ca>~j(p4!L
zhLueVvSV{a9k~lHxTJT@`OEYA+*{R<&Hh!nCW2MU?u(`>WJNBT|J__MVUxVv%{Td*
z_IT*OzS!>k#`R0@p=Yi6Iafl?pZ@Xv;q-Z(ZkxAdD=8~p;#&A6`sytQOM|Yf|4ylP
zY0l2u%;xFEU^S1^`PaMYo9ElD2w%s(_RxcVo>eLb4z=iCp6sA5$fP(??5Lvup?5o0
zF3Z~;uN)KoKjinmun^vDZ~Gq`9+x=cmi41u@#^N1CT;7$>M4zS54YGIVi09FkxpZ|
zJWbqP>#1l4`wOn0pM_=xv(9bF_PdhruNHD_^QH&seC;k#O_>kx&1^lO##w)J(k+$z
zn?;8*_U$x2F@5sszoj2d>^SbN7XE!B(7@>Pot=D3<t)3HOrFeqU70W8SN_DebKV3;
zeK)1Hf&#<E9t)q$eiFKN-QzR0SL*|7*IJ)inNg=Rd*RP^`{}-B1-v!VTWbDh8=465
ztan-P_(I0lkY|CsVSP#mmRwcp3{a>%msFA={%bmK$Y1l*yRuGOX0E#)=Bvh^&!+us
z{^{LDXSzJ4EuUL*RA1)FEXt5yE4g%z!om}art^zVeKYghvF2&VO5Uh<-9F@X+Ie|Z
zT5&CFS<<|f74B;9KHgw?_1dyk<LS@Uv1V;u6CCUx?TMHYI`Mkq4|Yc7m6tDuy0*$W
zh4Mz&$FwcosmQ`2@V_YTLK3@ZnS$A;qarR=-{dd+68SdgR_3b2z&T8(cI6$ETF@Z>
zdF}Uw-8Cx<*?4B$6TUld_V#_xVivl@n$J^F(U>=Ro|ug0eV(^=CEB4fGpD57%io@~
z{BxQ~YhchPF}=4YKaW_{va}znbWc>Y%n#r0H^CyjGkkmF`7dT)W~P<@RAzkEU}NkN
zclT1$3xC}k%dRGti(Xoj`0?2*G2Ks=K@+7EpKSgA$H4c;m)#G1J~035SDbk-@tldB
z<<<Z9Hm%P*WIm<Wdt<UjTh5`o2c9{f7N0j~&YtHR5}uX?-Jf>g{><&COD4*Oo=kE(
z85kPf*7=mnh2LwdtZleRCEMOytDXlp7xk`i3H<Y&efFYTE2JNuy*)K2!zg-ArS+op
z2VYN}thp>2vFzrZM2@y)_X@Sm?y&?p)r)?fQMe=h*sP)j23AeQ)-`A29=3kBJ@;~b
zYVzDyTQ29MOZ?rkxzp&-$9qB&VkfuklzACc=GU@S$fkYoud|EQ_Zd7aH`sgNbP4~u
znU5FU+GXJ}Yl`%<KMHZnj&~<<eD^uhRqtvo*z)%}Z$QnSAKL<Aiqq44OiF)=6b7Db
zh*6y~?WdQO-o{y$6RzJdemLEqqeI2&pyC9TRz-#G30><x8(E&3%=>(EpZe|(DmGs0
zeBIxC`7!whe}LJM--1E^-Q9Z~-EBoBP32<q#PnCJ_<rQ{;t7+M%ro@8C^B*VBK{Zi
zWZ!Zx>O14JJc{Go@6!#xkIGKSaA-*Bkv97DUcO=BEVr78Z?hMKFDx;AdhN##wz@|%
z8~B2>6Ms6IZsX<pFY+uwtm^Y}9kW?+lg_oaX+>Lm&EKayf#EO1{L7UY;q4o&Ya)H#
zF+F{EH|LV#-QaI`j@-WzIZ0&SnGJt@4L%mT6djybmEy4D&k+}=$2Lq;wlx2}v15+i
zA+_y`w{)uQOnd!}bLvUOX}qplk69F#X>}&4-dwFB_$PT;^mV;iy_eZ$JvJ?pyqw;9
z+ge?hb=mgT`^KM^ipKs3vR$$JDGz^PxVi259gzvEUh=)Ef46Gc%{8m)|Hs7^PMN>*
zfBwHMVe8H$Jvx0pXU9|51fK-kb?aM>8GKjPczSul%_WhGgbhBYUN_xncFoAdoPS^F
zU4{7R#qP<)oo?3ND+F2}e~4XnDn#Vbw&vZ}zubt;+@Nt_a_LmQqlM4@zkAmoH}7hy
z*W!i`(+{NIxmLRQsfw|-*!dSLk1P(^x*{Vv<}gcY)Z^=Su8Lfd_gM3734?+7k3IgM
z&c;7nc<dHCd#IpCfEM?^9VOk%_7$WEzGptRmSv(-W!f5*mq$crmpWYHUfkRAwBUl8
zkmzmIJJU<|-o5ty^tVL!Gf8G?=R688XZh{?Z+p^Odi8Ca^NZ3iWi0QG(>+#SY4cNc
z>!R&*UwpAznd-at`~=pDTW2nA+2hyHb?5qpcQ;ml*>*Z%(Wgl{b%&N`X73MHu;o(B
z+GG=)aAw;s-Iu#^pHH^%u6-2WD0fWaG2^S!wu^2R`g`~1#c3YNKhIUSDoW()x9!}E
zc~(vP&dW4Ks#NO5<FBtK%}<THb#@)oy7Ha3^LO)pI26IWPF=0pp<l$~h{>T7C(8Ke
zG_vj3S0yTOrr#y#qQy&jpE<144JP*P_*(VpoZ?c=td)*V#&4%Bw9`#q5V`PZj|^9u
zggH~Dlt$NGd8IoG?p|m5_fXeip{%k&;c}lRKKB}qM7>NE3q8j!=X*fGsr^LAW|7B6
zAKYJL+D|bpQqlD(Y~{a_R~&qBwfn)vx0RWFT$rz27IykybnX9lmBPbo4}SY!`tdYx
zWbWE?6Z79X|K3$;lE1Z5cctaMX)mPgQ++n>-S{GHq3Z)T;m#`0%C}jJ(GHm$_hw9(
zp&@wbxaFL{%SG2Y`j{`@Pq=nIck7aGwfhz{-CF9t+`wY1!s8~(4DB76v%2o(axJ+z
zt^7wsap|+fG!u&u^BL7EZdFPC2zt3&cJ21QH!<gZ-fYS1uPwcOaZ=ry-SP(S40YXJ
zToqh$EJ9p9yF%o_mAG9WH+AjEQD?W7-H=yu^`g^3hSi!pIR}&H>`eWb{Vcw@{(#=H
z%ukz3B4ejYxINov6ue%Y?On?<t#BL1@HD*zJD-?rbh7*$xQQd{s^$stXDcVZuI;aU
zkZ|GkfvMAWS;W6B-)@m1@pk3SZu1qKpIWP{92Zx7We@OXW)WdvVBlboZI+03U185u
ztH{7`yOM!HjDdk6H?=rFFR3&$Cq+LwzbG{&u_RHipz^Kl+oIbRlm7n|k$KL(RJL>D
z+&3|cwDQ*`TT5O);;HrRN!jVwNr6Htg)S3gnzpR{T6zC@+~av~c1g>#ICyMJFUwxP
zF3eu2lSQi6t$gu*hW#9R`{w+~{9!nE!<@|zZ%%nyYULei%GGx&WmCf8=8XL3t_3ku
zUTe+OfAt_C|Nqqw3GW|#KlrqX^?8qYr9rB>j`k_h627cyYu51n|9t<#bBAx1r?aOW
zJiSV1)e^t%n)LKA(bWol>ArVEbo!c0Sl_==IQe<eGPRm?ce~jP0XG$c-iAdQ%Cop?
zMy)z`b&rqMxhwCD=IR);o&BMZF{@<Nyw9fM57K<?R(2~r=E?~({m8<paBsQk>NVdd
zyH0xc=<bpeMrI2?UcG((>Xgu&s!4uXrXgqFy}GTXDf&-)NzAmq(CPR57~~f{e|fj%
zVh!6t%LNmjy{QO1z{T67zh;s@+m$_kYY(M)PQH55V)FWBj~rvda;DwuOmE^T3{$y0
zcb}8XB)`Re_Vr1#E@&Gb&^bFJt9Z|>x)%5M4=;+V6fX_ecvy8vCqHb~x$d63nO<v7
zo6L8<{6Of}*{0JkKAn&Ed;D15zrWt<_m@PM6_;)-O68ft{LW<JpCHjv#*+J)x3k)2
zY?}1+!12jb3Lk%65;3(Q|LE=fDyvTi9cq7{vY3!3P?KBqHFTe4+=i2%_RKJ1-ejrp
zXGNp9$dl9gA33$p`}JIVw@X>jK3u$%)!6i6tg5%z)ljB24l379%sbqj{N&8#J?pNy
zO&3X7-So7r{y69L?$V1rjWPQf!rY?MFZvs|9hx1Iz46ceNox`nw4d`9iWD%<?lM1d
zY5MC+bN=t}+`O{s3txRq)1Qq|I_FfpE%^1sI8Pk@__MR&P<0mTZ{>?T_PclQj+gXl
zP}aJkqmiZ%yE=4|e>0DSU*}GVh!=9_UM-Vx*jzL1oMSVOiNzaJ-%8o7$~_I!I6dBE
zNh$A%I3)ekUGdQ2GoN-bB&<#8F|qmcVHa1JXXL7{lZ`Xk-}aSBDoU<5IlyQmXg}!<
z*Mr#j?Q>T*eU@nD-(B1CGJyH79lO(A1ApeM#PyK{E8N<|qSD>mcgB?FC@W}pDwL_G
zG3%`Sof@3>#_O+t!6J=aax7o2raW_ekomN0qQpDa3-w&DcyG9M=y2RywvaP|ebb!x
z+#!-Z`ZuQ3F)7VoUH*F3M}5z|3JUhm4FWIb_vjb+cYJtzyu|avy0_|AI1V13)+TW<
z=zmbiN8T0uDseWx>BeDSe=%wp-4Om{xytOP*#4p!2fAFX^%)LK-@>Ey?YbJP82>BR
zAolovOP^T>wbn@(-Jf*uvxtSto$hao_pX@rrv1XlSmr3<vfG}4j@LJxSkCdwnah82
z<pg6h)(TgHv`zA*lRXZsIsErU?iTS!G6m<)InF;+v@k*2r};K(bG?M(<V$UGj<-cb
zSoozxm_!<NwDX#SUI@tuJUIE1Wyw{OE%q|++!M?>R`9x~d}mz0J%8~7TknGT|BvJ~
z-&W#({lIMHkq->MCcaHGGg>Bvi(XE1a*`-X;9^x!eBU8?^zD|X=690blnbuNuA6<W
zJC4Kl@V*J@yM5<`gf`VYFL|0e?b-$XH~DW$Oz-S>Tg80T+}v`9+Ko{DXE$zNSt4H}
z|K>NF(}zHbzd=iOZa2<(XPv;nvY_>`<>~we|D~1=r=(h0LWI^g=C{{#7%eq%3+kxL
zw0O7pF<Z-wf6k#Bz5X9t#(Zg&=xK>}2AdageR>r3O-gt=)8P-U7Z3C?%rRoSa_z))
zFI(ZuSG!kbJnL={*A`<i4(q()%3!Pg$<lwhjszcP;Q})cem(~2Xy!GGwoIGHk+|QU
zsp#O6qj}CfAAJR$*gRdmWS-8Jz^j{cb$0$rl(=+_)!L2qO>9WELfp9n9<0xt<0jr&
zCdS~Z?C#C<MgLsqEFY-}{u>%ol^a(27#b8@wpsgl$MHxrX3@#MSG#&!UQMZ;yWC}N
z#nI<qq^H|1QT-kAWX;{Sir__jU0)P7pGy%-$m^BtICm}bu5^VhPt%24FV>vb*%P~D
za_fA)C989ySiYZQkzb^HVSm2*z5H~}Dcw9QjZ(+-ch5AIFe#mv5oZ~A?e;7)={wBT
z8N1w;f9T)jXBYpk;+JT{8_w0gm-B!8_}u^fdAkFPYd0p&lmA=7wV%)Bx4qCC(beKd
zLpC!==^7U0<WDLTStImiPpZwf9UY;3wkKNOZrab$SFu6MA@I^V@iPZi8(*r6uJLC4
zyvCugU~%GWgVPzaC+v1HntSLw>kbVmF%3@#Ri(2Hy8{b2_Jrv@cPenc{bb@Ij>{cU
zQ910c-`=Ddxa^lb&%J0*`o;sRR41Ka{nR1RYyW9&etn8@_kw$g1+KB{-cH|Gz`XV1
zGs7%1J*8JaezOZZ2b@@NAx!F|YQ*H&Y&V^MYAckd`>D+fXZUzaW}<!O5yygNwg1UH
zFIUKx$J{9q?6I^n2;i+bIp651Va1KPHywW~Y*oK`X!%16M>US=7bSPt?>HTk8#i?=
zOOMKle`>snmV7>clB;~%WY|@?ZKklWF#i?HF1gssqs1t^Z%stg!%0jsPd$U0rgM7D
zG<mKw^9s`|UE!eJO>?bTixhQFd{BC2KAH1z&9#&bN7Gz4=6D%o7GB@$x%^PyqX$zQ
z^%HhYSIs&1M1iSf=fW)Yqslfrc3;!{rIoc`RPPY$x#9-tdY#8i%GPcVPfb&_yEM~A
zeBY(1pL*HlR=W8aC28#4#~t#J{q2?T?VK9=Df=S#sQf=TkNt<p-hizh&kb|py9)$P
zSjtL$e$C@ME5|tCW0XtmwkFe5m6K{){u$;UWB6Ift5$J$;=*ZPE-&%ha_rL=`5Eh!
zGBv#otE(is<QV;h4CI`dInG>)oW;@WFSJbJ+1<};y!P8yltkQ;sJq-zwRfJ8Os@Ij
z2d{SJ{<^>>Vv(*?cQonKq=r)q{^}p-Vcpx|WT@}4Xm(N8AssQ}fYsVc;t59T3RkzY
zsFj!o_G;g9K2T)5=?BZ=2|+Htx$H)jqFRNwmfQ;{{lb&6K)|Q<&bRtWsY&@PrUeuF
zXRSTTd?3n^iJ9@`B=N1QZ_GW>m0thyRaabY$BG3%5^rA>T(e92oYb$W8O@6scIhr{
zSp8?pr0fOC=KePe9bVQYm~LSBxRR%M(N3Rge`yn|*$<PyG+GLH<!SRM*Zr_r&dQK1
z{l;p;^CMQ9GgDX>e0de(cZ93W%yY?Fwy*Oh=8H5~S+8BS=#x~gMP0XUk*Tg)gV?hv
zn<t%*5Z6C-?1Z_5vaoil>CG<FI<E=w;U>2-b2h4Z?3=e?n@4Ns=}WifZ4iuF&hy83
zqP>9+Un{5Q>*A*}SDnvGMRV+B6!&$sPuMzpMwdg@?X$)E%hL9<SZ{J>FkEK*UwYl)
zsnQD;%f#LEzO!j&|H(Su#ShsZJ1>%UdUr_Vg<HZlhP1uXM{8=&S3UYu>HXG|?OcTS
z+q2h-Rid_;sk{Ev&vN*)<7#)@<jFl&7wi^!FPJ1PVX#W}^yHEb!3)f<SIy*@EgTiT
z;roQ!I}%Qc=teLW>{-^QwQFv}v707Oe1n!|Jp6e4&1v@)hMNvu`S$%<*2HsDSsmVd
zl~Y(a+3e$vv}m(%^>2F^=P&12GNm=$^ND?ONaDg1xw_t;Dkq<r*<<-KwdDFj*{cF+
z6XdS`pJ~18)wAdmezQH2)=Zo{`KR&^Yt@L<Y+KW-N0nZ&8Y|CX+qmP-o!wf(%Ktds
zRvgc?6Ky;z(-QLLno66}KISiM8V(5?+$U#l>nnSduN2Ry^-9{KRHB~yx6+Swf9;=&
zPPSRNQ$3}sweh-;a>xh!Q;W*}E~uV$Uqm?5t*IjDi5}OvERjsE6=~UurzMJ4iYp!G
z`s<-FrB?AO_liE@FM?)P4Kub}`l)4J&2Bt5L?Wbjd8X>lHY0|OXBJ1U)VQvCgthCr
zuhmo8<H}PKUkRL9WB$JHzTEtM)y6fS-+jGUQ2#$A|HreG`uZK)%eR#ODU-jq&yFLv
z+iuRESAD5Jvv;o(+V^W~t)uhhn0Q&)_j~^`R>{1Tm*?^S&fnMmd;Psb=grs0{rz|L
z-oM|I7nkS7%ieZnVE?`UzIE-_S64rr{XO~d!`ID=!w+v?|NrsVg8whB-oF38;M1@6
z$(PL+o?kA=XyDKs=JHHsgNxFk`nYD5h9`j~H{S(qv^+ikCi{=QY<2Z%`rR8B%>H_N
zCi~O5(f5j$-Sp*+Tz@-6JD-<h&C~!#rmCyPDu*XA-$>zbdhuZWX<j$CoyVrGj11j2
zb=#J0zUR9dc-}O0NQ>!bZ(_GH<m9@+!8`p^gwMnv^(yNF=er*`MF_93uaejzn{X`Q
zqPuJJ`I1MrM~$RTDJ_~7$j9M*G1BnB+pf@{9aqY~<}n<bU9n~rf0^>)_Nloni<4Vj
z#KXAOH8#2`cm)=`=Gp17Yu38{MeIw{Gf#f8yEe@!Lb5!2v1u;%WV;7jL{l`jaRywu
z(fy>YQE2^vw5V<t?o}5}P8vjuiCBicy^@s0W-`+(^kYTTu9aSE59WlHxvAC8>@ZQ0
zQEm$MnJu*;FI7Ttd-rXwZNJJkHayxhQ^#kGa=41=ri~Y~QgUXhaF?EcH0?V>W#9q1
zQjJIXm(32Ux3L}BS&~(1S8(Rbw<igVat*q&eg+4paWB52IqA3S`s~ylclMcnyS%yO
zgy!z9dw*-beSET=;m60%N0(~mO^fSLj|hJtv3B8hCS@1rYdV2k@|;t`eBZIZ7mH9x
ziGBN|F>B3UlV6&A`Ti$N_VpeusgZO)X_+5*u~aVdas9cA=QNu(G1;qltY~1!l?~zu
zl1*5*d7o>h$WPzHC0%zyGeUo_zw&Dl%kj|PMj9)vjz(IwJ==II<=w1JyKR?k?Mu~~
z^<VJsj*>@9gyau?$P~NHQ=9QiulGrRnQVi?clDWOM@|T9X~d*VO6FO9KwC!UJCi}`
z@jWM`F4!k;Fmvqf4(h#?Fj>5DfpOT(6OXjMoYfA<p0Q9R)+&;rZSTH?7ZMXWLnpc~
z(Y^LfD@ugVclXsB7j9n&J9hK3m2_*UwVKw8$1m*eUAS>|tE5EsC(Vd!<_nT@SKsK%
zTNBi$sv8}3fNyecW$!M#R#Vsi+?TIUdHg=pW$ug9Ja1X#604Mw%2n5BuL-}pS-x@g
z(dy0nWS=u|ZCT48nsbqNro`HyK97p%m6<CqbiHEgY58A%EKI&+-laW>bEoTUW^;49
zWwLIo!Fk68ryXB4%gws+T0KIB*{1ezi>HEX>#NvlFMOL+1DDNcTiBImZ?N(EbJNq=
zdS^B)nYN5yOyyB_U@2?Y2e!++wwjOX7VS0Ya;#8XuyCJGk)Wg8B2MMk2ZDSq>}|PL
z6m0G-t*fN;i%q+;N+sCx+@b2rN9sG?c}|fJxY=6ga`FS?e7pCJ(p=IxjVI3>-mo(L
zuz8|<?}Dsn@eIq&mDpeXG`qv_tc+WN$+Y{#yjP(w-l<%^$5v(%IfKn~n|3v8pHbhp
zoSCXdZ_=jDZTfsEK~zt&YDwbdO{X6-O<K2B$hAbJD<PNd?W~{GS*-<A7ctGuePX}9
zCviy$Z#J)&^p~?*KlnsG<<8n~#Zi0lTa}}$XxxVbhC2H_wF}q`_6q%b`NX-VsH9Tl
z|Bs)4Ok{pc3I6eYdLY~Gif@x1KNH*a(&kSL`~7^j+M;h?ncmKs&bvNNYJ%Gr2c}Tg
zI%WRyMSZSo0?uVt)%`mdUKo31N3zwX#`_G+lWqsRJMdxt{PnxMt~Bg%T>J3&6Zg%>
zkMSkH*jUrHX!7i-&nl%i?T_EyzjNiPx96XlRsVj&bhgX#!;wAW`;NCY=5%=F&Pv)b
zp=QCf3yM=c55K=3*^v7udcpB0+d6pd-M{C^T70m5V0m!5@FvA@&r>stk1RIl?ti(W
zTcUY-PSf-JWsM<I8dtp8H{Vu*N0XN~=7m|qcb4X2=Qn>{Kjf`F*S%o9c*nYouWt`s
zkKL#(pdk5X`Kf0jbE28qIHG&c2Nu6=nziDl7vo*m<8~+WCYxr&3Y@WArPY;_w00Jw
zbEa6ImOz<$!^zThQ%)^roIkxhzpkUc!j?s6*6xQk`8vTDd7s{hS-i%&<fYzuyQA~>
z$IPq!S5lZNQqXa-{crZun53(!HaxvE_NK1PU-HUOM_|_BMGMPLXLbi|aD8>&Z_&d>
zh76f4wJ|k+Elp=t8O=RrroCg|%BK6<-AuEB3lhAPa#p>mWLx%e`sMW>e_s69pFZF3
zZ-hPn=Z?D~H+f(G^vZg&X4?<nd5R)mc&GYJ`IOI}m18Wi;QxvG6-m<NDk;pbEN(}*
zEZ4Xq+%(%n-(wk<fOttqVr*H@#|!C=_XPi4-aIYjN`y<U&+^653oBhBPxn0%{SoNk
z=XU48Z5!rpWo2=Jt)VAZC35e%9GkI1H!u8Lp6kj!!HpryzomQ?nSJcuhrT(xQ&N7<
znVr4(p~}uxT(4d__TEho^^r~#W>oVq>QU%!ms++p^yN3%vraWGIXb_+#j<z*Xj$(q
z%{}G960VTjcLUu{rf~jV74&aam%p8A&ep~G#!5aXbKLyO<~`f5ve12J&Ox1!fUuLY
za^+E<HrOV8F_tK(_)>gMOHuT$=-03B&8+<2T?*aIb>Oh<X0D}dvk#dkxU6YQDG^wf
zRn%kl{v<QkJgc&R7pu2?>)CL<b_-LgV@&am>*mwXE{t)pEU8@gq^;fV=^v3_Cqrs<
zTu(1tWD)&UL(tk`mv5>>sO*b{URSKm4l?kq_?)kq?{G)|RoX1EeeV{|^mCgj7?Jce
zR_Bw!s;-H3Jxv!Zq$FM$B|Ns7c5Txli5vB57nANx3HIWABcLd8;-T5q)RS^EK5JR>
z^2WNVXt_lRHzaUw;bq<Bn`9~=Y{l07VkaX@>@vO->1*8&{@$E_&foo7q?FFB^UQ6n
zzJg2R4^$tV#9jNX`>Bk-&%)^U4$emcvbz&qC-^S!<UO;Zit`4KjVDjGJKqfdqib!%
zLpaVP1hlw!rs;iKdBR`BlXYkDc4xV~g@yi`Cf^chy%i=HrR$!1ba{rvVV_>10K+2g
z(79b4U$g|CpIW}DvgK0F%bL5rT_3aDn;#vwnxj(Kc_Q+_E#-~BH8f<c@2#A9{BM_*
z`d01ro94dyaABFo`)5j3v$LYzE^G{bej)4rvGW_wTbWIo!C&E;dGz%T-o5=CrV4+5
zv#^|K)}C?qYt-KB{?=O?j2>Tq$jZF_shA0m<-MrqFUqg!tqwVI_@aN-r_{JR&-z;B
z?<A*5|2+5Q=8-4=UI#49|GB^Gb;kFr>bK{}MmP(2a?R3P7P~XT`|jH3vn(dDuh<_v
zN9~enboV9$OYy`_{^Bc3<1gR%_kEwq^!-aGugS`OByvn+b>+nJexpY_6F1*#PkNG-
zU$}X<($Uv*6y4lJ{#%KL&fu5+TQ;F=L!9Kk*(H*z^qP5fVpV=Wdbvi&^YeyeE4E)#
z&)Qb>ZB~v+Il4t*<wW@>^W^WOUd?G=*5CK*pq!2T8k^cz?cZO8pONCR;gk5q_(@&y
zg%r!BcNxcL9Jm&_CMP0ypGW!ZD+#4XlU}U7qj=Iw>TH4lr$gdS(Uypu?wvg!_bcx|
zbN6Y0ObE|;$E1WWVs>5pTMoS0?d*8s?E}^(=GCihCfxbXa(Kh$!1LQ8?Ym;V<tl>X
zE^b@<;{K=a|0Dm+G2OO3a(-zd3wN$ziOuhH$4Qq~{P?}`u5_y8`=bY~-jw~nU1sEe
z<)_`O_wj4J*Zf#Ep@iwc^?Kps-50N4d-3Yqy4NP$?+d4}JH6b<Tw0VCeXguDRQzVB
z*0JUKnXlGPvQAm(ye0luol@e02k{=7GIh#ZP4fQpOq#fD`r+uQ&&yh;EZ}PUb(DEe
zC1;h@7REoeTYY0$xtQ)Twl=+3x#m+<(6&Pp_>I+^54qLsm;a-9!+6cDMKRrurAjSZ
z>W@D2W&5W0p*@LVU&bqmWR+|MzqNaXujtI<^xR&f5SwQ#t@KXok#DED!p)N$)g8yx
zUzIm5F>`kNd~MsyHjydyNhbF$ZtLHD?Sz~6am&2Id&{0pTOgtQvQMy5x8?YUsylMh
zml*ckWa8PSt2}qbgMMR?Ix%k>jXga=a*Ne3zb=oe@ShWSeYU&i<!GJ1CqsQ_e(V)&
zjl1J=$+`HpeN_vuy_NC*6MPph&EH<g+;=kJT-JZt5ci)_`9)dG!M`p|te;`7uf1YV
z&Yj*S@0^WN<(6D|YmC#5RUg%Q;x+qBqjROilY<kobl!*-))~6S?sdC*RO8L1`~Dk3
z#6oOtPWg4nk#)r!UEQm4Tr;*+_V(tSd8_GdV>L;oJ?tmP;{T!zC4P%e9+~6MJ!ejB
zuYK*mPhUksW(INId!+lg;+<Q{Rrfh+cc(-gom>>CKHvGH<i{_9Co4^kBu97|$t2&~
z>~=d@I^x~6Gr13!^*xGw#Ky+*{?fr{UFWcOmxRBmC@)?7epf)Q(v4qV(xMYiOT=;>
zF2A=neEDaYv!|0~w*@*^ZQ91Sck1J9TPp6wicDWI`_O|Qg5Re~8omnMG>!4iBAK*`
z*DKDg>NcKe71ei~!{)<^Ns4Qy=6Ucu2rMu=|I$eIhSHb2VSyj!FIu$5?0okYhQ@Yb
zomGpo%Z^lX^mN^R894K4zt!K3P0G>7wfb&Ye&~{SS)w^1cH5+&+6JRTXL7jiyj!*C
zLvHz`ADcE-=H(k(|C$)K`ku($K$#Xs&E4xybNBmQ$P_sJHdA25?h6MPk`qo{3+3l=
zw)+1-anABS{%c&PA0FC#CuRHZZ@&*~aO9S$t~ch`z4IvV#AKFlA2!Eiu3c32-nO{v
z2Ji2=iyo`z%-nXUVv^>c6^lD(dbvw#R3}}^x^-5(RqEW8Yt_lSE~c-X*ZK8pK;2Uv
z-X}|EW-<#d_ZA8`8tK;9*mAm|L#vhhz=qi^o3g9hMc4F7yB+Me;8)H$C^F^pM+Z^s
zvmYwdpQT)ETJSDb_JS|Z?p@|{684E`JiPcp>{#l}qdRrX6aG#qWL!|665o0MF@s<v
ztH1G#Gk5ZnjGC)A96hmP?RCQtb5(;qGCll@b|xx)KN^rUWkq#x|1*!os6g#KY2U+h
zb7IoFZJ#yj%kFA@b@#|-rw1=r{oVM8#qXNfR4HFc?a-ZqoKHSJ|E!-be{g+Gc}Zc`
z&Dy!j{yDBowRA5gRaP9|^*hOXHE-oA!#MfZY~hCrZTzxplBFN++UPANG}kv#{p#sJ
z8|}V>9;MsO1=#fi-aky8RKeo#jG5Ob;Qt1h(5E8Fy3+XpF^L;j>f{Et+}oiTJ>OV(
z+O3M0A_<3@_cLg5iu;|7cS`iS$l02CigRV|bfa1G^&c?>oQv47;`OBdxP40&rOo8f
z3DdvdIp;+{;{FxkH@p2^&sNOo>0Z{?f66HNqqXCV2seL^BQLxTYp$Mb@>uY~rQrG6
zmW$ZG$Y0Pr?cAe%fNk;>&oYgeOW(Lc=AK!mm9<fIRdK)(zYqH(!lxcL@7`8g9lFzY
zin`u~cL57Nc4TX`A34kveY{4e^?uRzRoB_oZW{?YDrBnfV9!@!X)a7Hl=~|t%D}L%
zc=_%vQm)K}3{HoGw(HIpSydNUc~)rNmi4VW*>jg^O5K><#jUdC+c~d9{q5V8A0BA>
zZ}_%;eQV4egQF|exMD@rT@)tl<a%oGaO);H7lwpYdQ)%2d}%mqw)bfDA{NCbvLY)j
zT-4Ze<=d`b`&Ht%e5>~5T6PBEIQI(Pys0UM%%{FYop{vZd|S%$(<`et-)os?g||vG
z3at7Z!oG8|gFvuMs*-*NtJ|wkk8^5G&nph4NOeg+FJpg^A$h>ZCbTsmYP<S0Bdg^`
zlNU=^oo#*+ye!Wo|GA%&hkN-y)}S4s3uN*nXD-jV{rLGk<GqWL%9WpQaaiwDx5LcI
z_*|g}^MdKdJ{@W^eJ9Lyo+R7pT)4DohTX+I<(JD3>&4yN#Cladh+)TH&$T^^<5y~J
zzgzR`w8bCQ&^Z=wOeg<Q4mteal<n4<iF>bvbG<Xyb^JfyA@+)Prz1ydYrgu5d&?He
z%g(gsS$F8+$-jpm{&kk%oMCGiI^)jgWtD$LG=m@4@iU)4^l-v0o{eV}=UotF*IaYa
zWCCB!`U^XmJKS!&861e2t>&{LNh$ox@$g0a%@V4=zGDe|mr*W~9D7>z<Nw6w*|nwG
zR~pxcJxa4*R>%Bn+Oru?n%4&|eScDZh4h<zzLLw$+g>)Vf7$&&Ci>Ox!>oGDYhLQL
z@aO+Ks(6*_{ruy9`_2U>Ot`npJT9?oVn8bw)0@`(`)wY5)uzp22ic1_znn?&|D%`L
zw)}&&SEKo7%eWQEbB?}I6TdAzL+0-Xp3A{;JVFQUFS$)CHvM<5Uvus8P0kh<4p(ms
zt+#DxuD+msY=2MBv)et->#yjX>biS`&EW6X>Ia!MnsY=Z+%9rny}#Y-)}I*O$wAv0
zc}4!uVB4hMB)-r6zEkmSuYa+OzZT2zng-U394dC(m)-Juf6tXGnb&rm{4&|8eA-vL
z4V{lxrA!uCG3~glu1<u~EVI=@>G`r&b6q#DdC0Bo!}H?&53BiK9*8#SUfC&Cp?F^3
zI{DTNPrDHQuUp#^Ha%We;Zm==dilBEE|1FN?-zOemk&PL_b)iEF(c(}t;Sszfw+f>
z2Y$1xU-{tCqMSwj8jObm<@bM$dJ*!{|AOe>J#s9TVrc=F(ggmzD?c6m$8yp`JAVTw
z)z=$m@;N0LHOk4X+Ara-`t85FZMht8wlCg2-95dE?NPpKZ_~6bp8|GnP+%*`71mGu
z+haEWit+i6W*I4WtsV+^rgpe`t#;=A>MmYT*z$Jrl?}GpDr~FTX54nazNT(co1fqg
z-kUpKb#v@aUC?;-I!B--qsr;+EJiVJB|F1}TXxNgxTAWz$VxWi=h-!W{tWkC&gb7R
zTYF_XOM&3pOWVuV#%TU9-~NC0?d^rt%O9|YF5B@hSY$c(wD9kWGTW}*41VIu@H&4^
z%irfpA>5Jwothr6Y!Eyxdr?!vrfXxy`!fow!`h<XuQmP6x5i>uSh3IZTP`(Ht}mYl
zzifT5Z7oxIvCZF*m&S*pZdLVfnDzSoLY9V&U)Ct!S+&q*zh07QM81tf!O|yLqJp)D
zG;a6D+t(gh;GVue?bSW=snUi?oBJ6Kr)=5Pb(TB)j`DMcY2JO3oLj|gKm2eBwBRYu
zcpbUWna}z9N$#(fi62BhuDfKl({t6~*pI&^>?kPz{O}#?=~IV4G;!W{;_xs$EL_QS
zz#(?A^K|i|558JF^-Hx2Wkj`Se3}0tASLKvQsJYWk2$!v{`QDq{G$?fcDFgtgNBqp
zJgGnS@*W6O2rKUQN_!}8yw!hl-lM2O+jYLH?p=zwlYUiU)$KBNf63dI1HTwsMEzoV
z#W1aI-IQ6EPI|;`wB>2qmL_4p%c%Boq<y4(>u+6$mn<SSR~-*s?3<du<W%aF!txru
zr%SKvu0PU$UGd|l*E)X!uB?sP<6gm^A=uCTq+R$cLr;6P@cMR*A53~ozphW5T=4PS
zrS%6s8mG>5P6}E7-oC!JysW6`m*zg3U%wuHG5S|hQdiZO7ajVC_y4zoyTaj&?G<md
zr>plJ?SHuB*p7{VbL>uXe?Mt*(cfVDgflaLS9h%3b?)%)&})@#KefJYh!Oc2_4mi8
z$It!i!|V@81;)SBi~m`B=F`cfsUhB99pY+N*O~47?C|95k)72)JDU9@FBN}1QgHF=
z;+2l#fBc?5e{j&b{&_tk>VggN#LKInGchpuaWXK7qAu7-Ni9gr%t_TNs9YKroqgLt
zr0)9q3ojJRe0{EOXEl=0PHnx^Ys%lOB5~F(k9A#+PUYe$|Gv*vJ}s{5Wjy0viQfJ4
zJgaY#`~TN{EiTkH4v-Qvx71MP<~%#8ex2(#j_%V>n&y7g5B+=RM7#T8eSN!{C-w@@
z<6CEbmY%BGBkKG0$mJ~=zPBA_75xke?|taB@)U=%_EO1Wqt7wkUk|iC%RUyt$GYBi
zv7**eroB&IKRM>0TsL*Y#bq~-)_mkl-5xaitX1T8(^Ge+UMaTQ`KHYK*hiDxn~HxI
zi^qRFd#+0AqD_Njt*3of@rwSHOT0Y0o3aD5Hf&mDS~36Zo24tH{3I8tzBk&M^g6m=
z&7`Sn3yS`_&pMv5Ep&6mmW9c8&kG8MHZzr|WjV~-?R8K=b=#Wdp8_YW{rvIhysq^V
zp8n;zJze>Xb+x6*`(m5zzl1Yx=kjlVWyJ9~Rn%{O)<cJv9h;b4cQE8XN=(^ip)YcE
zPE);YPuc<7B|J?|mWPU*j><4^$Z%O1;M+fiLHCYH>(>&G*&Vx%6?O{f@kuf9Ju2id
zf0e(eLU@n(<4(6*<~N$%`*QM_`wu^~n*GtYb&}mW-n|E2R<6#Ra?)tRiT_tKI5O_C
zuvtm;n?L1!U=$jwDtX##VPWd6jzy(K>hlz~ck^y<**^E(!f3xW-*-0sikg-ul5v08
z%8*M-GM6mWdG_bTBiYl5$_H%Js;ky8UlMES`xkDs`AV_4+S}vP!}B%Y`ZC#0&x@{3
zRXBZa0?)6dH8<prlz-`DYhKy8&7^M;zmn1-(N&8r3@VPau(=ffIXZJmb$+E^f-=Wc
z{X)i`g&P*0J29_o(-Ol29~q~5URd{x>-P31+rsuQoyJzA^<eufyQz!r^u*rTdDiSN
z-=rGL+=lDrB^z$OtB<de(|1+p`IXQSGJV1P*=J8im!xg;dLp&i@oCh~Ph8Ui@~sZ<
zb+G;%T(eCzcP=;cy2snRH=5_I+bX=5-<oyfLDuND=?i@)OBNYs{#nUrE$Q)395rVw
zmD9LxCd9xn&z6Bf95rX8=9MMq=cQ$)>lIX9wZ2_;+hWrDe_TDE9W<4-UzV8Ner)_s
z_IQ|3?(c2WCi@+GeYnlT!)dmXC5xu(>&Nx?S21xkiKKcLSIN08zpYrf(wZyO;UlYb
z?A$tAi^+{0Q!OOgl+HbM>3TCkcDc=r&Svw!*Q@n!curbpWI6Zgo3pRw@5vmPU;ZXd
z?Z(ak&ofRN1p+6XOEfyoI{*D!-%Tm!YU+cYxT@96KUp~|#qx3CoF_KZJ=dI>G2yvQ
z$BrPUsm(c;=Vb;QwKzM;Aw>75*3^$v3XkTQNC=95F8aqXkM~R6O*3~ZWlOWOPqR%^
z6*sH6v9aA}o~YDn`%Sac$*%9n(;wx6PkcK9jjsA?o=@jnqg`?L_GIC*%lm(pnSSuM
z<MpePjH|J^ll<YbgV3P_OF0*&z|T3Qp0e>3AsiC~IOJN^uxP7_s2F%1a*=b@VgI>!
zO+=K-L=Mvo3B!q(m6R1XclIQNskd!!WyrAMi=3e970A!srNg}E;;P$=_2gEvw5(ck
zN;LXZjhlthLFXykR<y7z5VM)AA#?S9HRJl@3#QBr(V1S{xY_97k}lg2%fpce98Wk|
z&UEmX;V={X8PpNs?{tULFG)+&D8PilN6n{kC5PC_>VtLMlYA65@Be!9w^F(%Pl@W$
zl4HwSc?890iy!RKO}9BNE@>USfRRB-TYs{WfA=3%r{mvuZRwdP8+6^}m<`iuz9mYb
zA3gcLJY{mZtiIRdDzj0>nq{?ZIcE;2#h;Rxuwr^`l#*0?AS?UMB{soIZ#EV-7A@K7
z&FMAobi_HwjoQ=FZNet2%<kTBzHV;gjAsY99cC?`_~V?KLB^Tp>I*rs>I+XC3~0Qg
zCw$+r({@RotA{fqPvgW6k51K<>>P7N3K#Giy6<FMs&&4L!Lf1TQyGz^Ju9@7-!#YG
zJATsWTl1C=>NR@GoQL}&+Ij9gw&6~Df3M2+v(!@Ky!cHEs^;82?iyytmLIpjE;s((
zPW@MPp?2+BQ^h7!6vx~7eUiUF<@}^@6Bkb*|JNyJ@Bd9%epYo&XW^0m{vo<6i{{U*
z)T;fxSd}Y8bLvu-j;dt#Wtk6b!Waq;EmE2sH}~EP`}$4i@1Iux`Zzvr_xaG{XU>JJ
zRF0`yxnR}O_`NziXNCXxxc1fWf0wPFUz|B5U1<8`?bltGo1D36q^VS3>Ev?D?BLM@
zMoi16Y;dqvk7)h<{@$<m?dJbZUQPdh_~XwHITjLcr?<^t_epY%eCBqUg8VJ^4|cIH
z_xQ&i^HZYgTMWm(HZHO9-+PYQrn8woU8j9&VxsT6^Cz~e1>P-hZ?b;Avh1>8|8my(
zT~faltkZ3G%as*;Jo>+==I#8LdGWmG*{=Wl`SGe^jsXL|`Jw2DZMFi@W$aFs3P*ON
zo)7+DsbI6WZjbY`xpQtjowDr8hp*XN53EQG;Z<Y}e7t?O|8()PuZfpe%CgmQ{S`H<
z+t7RRN4ZnQ&wu-~bEUMmg>`IpdU~VkZ)Hg`yMD!yjUP{cyty&A$8pPzib5N!cC*7T
zX7;?-Hv6k_WzMhk<$Rk{KVM((SDg{%fA?UU{N=9)-#YR6SZ})UVxxyiwV!@b#;*>~
zyI&(VcPO#j&sv|L=vc6+Rr5|v+`Qamw)d$$3qoI(PV9J`y*td~<#FZRE*&SjK1H1V
zednpL)4@rnPp{7R^N%>={dHcQ-TqB?ig~tn{CwQK`C;{KzQWcHwJU}ecCvG7H@x<2
z(r$Zp@xy!O+iZFo^MrOTo}JyX+%3;PYFqRgZ^`zV3qJ1W)Aw7?zW7v<UgrLDlb48i
z8$AEs^6|-^AL8Ag<Wpb&-?8@P-!BgDU*0JFdfGi=s<?cc{913r$#*Qd=bc*FvDGo2
z*Pic9QrDuRcNojdzCGR3#4Z-J>i4T(pOjZgoBsZkI@|um##MVw_>49NPfSy42++#e
zu4%^pS@W?wPkPeEEqgOMMIJS5Z(p#Qk8jbM>wo`Oa7!L~`QTMmK~asd#n*{#lWr~V
z-5gavd;0xnp<k}N+P!O&ch4fRvLe1H$-AeweCaY5I8ka4{NmM)KR@1Ff1IzZz`Lzq
zHD0qnN}nyB?fMM~=eEf&%@VHe-(&H+?d(F2S`U@5xX$NV-a!+e3J7Fw5GZq$Vrh(h
z_uI-&tDehee|Wa%>YWN^b2&e}__nNGt2w57y=~wQ=ZSF*WhOR<13Q<*A8buL=RIj-
z`*B-uHJ5e!PB}-cl3jH6U10l)t$Nl!X7(l?4LM-U7+n{Wn_8bXkMY66RFi_~+4)l(
znive9hCE3t>7Tb*<>c4NQJPhYca(BUr?frH>`Aoc|HP!6!pz+i>iCd_m0RHUW=WR=
zkxbscDy>a5$}67E@p(2cNg`>9WWyvzRvos8Gn;iH7i~Ph)<;Xp{M3_W|1H^WMA@7F
zHRjm;@#nj97nvLx9-6xp-B#OWZOt3xal+O|=ALG1YXyIHS@M?!>^J0ku5RAL>%^i`
z_SPaI-)GXk6}$PWWIL{inDib{SkK8<>XBqzv`MV@QQ;Ym(7kH2?HpcI+<5-=#J1hO
z=Q8AOu#_#*wRXvh&RQ&7{VHVIwQa0RuNjyJM1RX)bmLt9@?CH4DI{KwUM^>*9RFU<
z?u7l6NNwr2X*2U4CG)<Ja!#0)dD3;Y;WECTFUn3aPq&krKWB|qW;biv((89_{@HYC
z|CFMIym#Bp<6L&GY6<$DaG)(*{^i8-i0^T0eeN~<&irsQ=ArM0a{o2{4HuM|wx{wl
z&qz3y`sVRNr`69s8oXN9`|#JDxi{RFhKqc9nzl{aV_wQUed$%X%#150D9gkeyDiz5
zTNAG}zduw+bmt3`yK2Xsr*E6Q|J;(Pb=N8x_VmY^)VM@2eY^JMs@ZPeMlL2HdjrAF
z{&erDLea|8%zW1|-}Iclw&GXngw1p3MSI-vy<WNP*1R3NzOiQZ2CA4e$lBbFI=!{<
z$LDYIa^KgMDYEpXbkuV@+GPo^uQk&OvN<lAw#DvQb;Xx!246k~^goYc+P)~BQGCVv
zu(J2N?wZ}!obusl`9po<o_m|0$HpWd+JEA*>Bc{feDBNmJ^07tbUb&@oN2EFdpIm+
zbYH)5A<;bh?l&F2^}F2!DrK8)yH3pFshGBEZ({E?!<2afjlUS%%I(fCJEeN--I3Q{
z*5yuGo3gG^|H2y4g3{{iv7fsHbjxKX>VG+;JUM#7H&g%U^)r2M+?1JQY$moLr({vz
zM&2WD1cE<LwL5+N<?mT3+NzN!8MJ4u@mjY}{~x2|6uv_*PyCsnTB3V7?=#<NlU?oM
zZpSLjTF##hdFk=EFnGqXDcvgak2-C<99mMFii<0&Jl$VT*_o0wPbWZ5t8kKYiP3~g
z?Grm&9p*nU;PRTbb4GOD`=h7Mn$1~o&eJA<!S+IW+<C`$*EVf^wu$vcdA-Qfr*EgI
z%Ko%Sxh=5Ea<7Yo|B}gXO}?KvAUgl@+o_9wOaI89qtmiGL|W*bq409qcRJ~l8~%Hj
zxSW>D*z)Ayt{=1as=O81_(=Gn^DjGVC;Pjm?t;&4W}J-RdF**<<^7adtPGN@FWFZt
zD6gKodDYfXeI-8C{?*^BCmvO@%2D%?sxZ`hXueyv+f#Vz^ySLe+^<dM5@Ks9e1ESg
znf2@fk<)LNFPc$y{;M^Uc(~f7Gp@{A)_B%E`g>LIwqmt{$*hU)pTiVuTRJx6RK5B4
zCNrmA`Qv$4J8!3Mx%1Z)W}b3Aw%AYL;68RmhOTEfH_I-%TD;<u)~fgo@vPj!d(!59
zWX<s~jO|>snz`{s1hc-`XO`H_T1Hlt3#~6LO$a>XENFGWjnnKn(<6x)2bsCnyhxjn
zSNyExzkkQA%&X?sqI+cW^;~@_IC*6EPf53UI*q}4(h=!I8OFQbz5W&jdGWuB&;FNv
zF*i?V=B$gXB0-n)+a%7vtyHLztz7B1{q|yIceD7VtF_{cXRSIaFm>4(xlnHBm!Gz6
zusUY!$A5;Yt#azY2eac`ek?hAs=DO+TD2L>2^Q~XY=67`<<<kmK~VxXS*;4Izn_=m
z`EmSzukE+zUsp(+zwYtZ>tWf44>!J_viO!+bo#*7cQFnoX$RJ7&$_j9y74WSm9Ndu
zl_n-wy49cDEaB1e=WVf%@C9`P<`)Meci6JsHVfZj{h~@}l@r6`bDu+G_f?rr{kcZs
zyW*L8SI3(>CIqgKk8hMXP!xAG>80hL%&oijNV;DCVYHaXUzVTk`2>k(!=9&CUgsU1
z)cA41|Jsty3t~@&5_8rlIsJZ<)zPO}`udh(f9a#MAGaO$i}Y?(zIxHQs?V(2^lEjv
z?P1^Z7p|@jusSGTQNQP`=QL^lqHo{7zujzFqLa8V^8Zz<b9ZyR_4>c;6+H7X>qYZb
zkz3_Q)~Ua3iSb|gxGyE9=Dwim*_)ikXICimRc^DsyxgR-^gv>KU!3O;`}hO%Swk-#
zI6Ue3!8b)$?#{Ac`1T+(s9^317Gqic_!sr2F@Jp)Jp8!v7;FDworw?oa%5gdT6bPZ
zSjAm<>}l;r<xl<=>FQTnmiAeQ{fu~f>RaoH`~809PHR72DRh1!^}g?qP}<wBy9rqm
zdB>J}+H{8bUw#mkYsvgEzwuhq3gu&SGP38$Cw!Rpg6EEvQE0>6{B|$5Ktul*$MUDR
zL~P!|8|HLj!!xDZp{wQf?e_m-xm*_X+9WT+c>3;L4l_31el?Z%yZUDJLaP;R*AK5h
z&#}ed)R$|$rnQ`t-uAcRZ@6DD>uX>3@p)3daJ6En;YIxt%SEeQlr7IC=p4J5b<DWq
z(rPhgZf&*H2YoIHk9Ko(-MP{)u|&!Fc;`o%Q(8QwXV!E7E#d6Cvb8rNgJZUd+6DF*
zQXL!Ot=}FxZ0Gy7?F!eSc}DHp<sbE;l5S>vyY?+ulK((>qNUu9t^A)~xflG($SB`+
ztC4w2Zia`9(wDt6<v)f7Ikb6em`P5~);-U;a*c6?ezM2DynyBHd6Ra>E<GrbzW%!8
z6)n?$D}$KD3#RJtTrN99;;NCH^-?#*S+=th`McwuXB<iBdwRic9_QN3(+3vc*yZ)_
z%on-WE+GQlGZRj`Tw;D2{7qn**X{WpD|J@hGq@JcI;GrRqNo0p+}DG3bJ8c&C>Y;h
z$q8Y-aV|4swM2g5wb<JyH#i2(?@#~x^6!-p;hWBz%Q&rtPyJeatM|aO$RCUEsF+N3
zC^6WRZ}?t%-ocG6p=$*yP3Lau*L>eq!EpAm=<W3$H`*=o4i(GE);`#9?%L7KdP>t9
zcYjJ)aV@%R9iwpIOXjHKo9(wcZr<@vQu))lrL&S}aLtMKQJKZH$@KFj=GmM1H_fQ)
zKDnlP$*1p4d;LE}uKjmA?Ca%+8grYzl>E|uxw<Lkr3~lQ#D%7h^B6QUJ+{7B@Y7IK
z_nY~d9|nJ_>@1ErYb~xcxTn!H*YB8R@tXFTI^w*SY=5nE_TJ30*NS;Qi(TBzeE&MT
zB>OM*Z}yv&IylJ(9OXO^^Ke?5=V!Kt61CQ?AKrdh{)5wNvti4VpPa&%)f=j$^JExb
zJ*u(i_^^4_xo5W*Y~6j~)#vGUXL#P#>TG!Dz~(!_;IpMg#EZW&##vL_H$0cI+`O(W
zoH<K8@>)*(ZjZMyeJ`Z8K7VBU@JH*(sdbCreOvqK+q#{rBaOCC?EUq)W${1XC5y`h
z`uCRB`FZKz@Mu2jx>vq?>4|S2rQ9z$%FQS>JYK<n)?U<8iZl3Jzv7A$1rj?_i*E+3
z<>mc&qSyA9@6nys)}~vznyO}P%3#c1n00fD?3&BRP3&?le#Oj{<2RrFRC48AkptVJ
zCAO}t&_BB4?%k%Z8%uWz3h!E{{Ik*Sz1gSb=L<?a{L6!zN(>I}PgMHAtQnrv^7`A?
zxpv%_+5*KBGMOSydN$Wvta+d9xKdT%*er>)hVH&8ulf&f%j1469U@#{ec|@4o0?aD
z%&4>u`7~vz$g!GGEv7$rl(wiY7E`O%aQ*aRr_|nS-&W?o{P<h1cJ85-6NL0bbj;%n
zyj3h1*Js{-+A%NjoTtd7C;L2l8DGEl;Q3{C=f^fl4V8K6EH3PP+R{n;F3tb@(*N%T
zrql0_NyUqQS$#PA?5a(U=C0fk2OF+0Kcc6RG)Y7vV0v=>;gSdDix<v3r=ja0b-O%s
z?VZkp7dbY)XpnT>5cgoIx=s9Kw`Xt9F!Wwp<!i1|@wLfpwc(to)$;#?!p>~JQkH%7
z=B!`6qIb;yKCTGeufOhod06UC_j8-qUDZ22;Xu}od0yLOQd4@~P28#({MG$utY@~@
z){O>7r=;&l&J|Vvnmc*c$!$q#tJ~DCeX)DG=uGv5ez|q_L4IG4HhpLCaq^e^#N@k2
z%;mD$3Aq(YE@i*>^*?*|yMK#E$y;%OZSl|7>lLq>t-#Bu`gJqA^|7_TGOzppmTX|%
z@clpPP}8GD{Icps3=BDY85krnhMF>q^7C?2^GfszD(}{27T@-m_MrT4S5B3(Ls{U5
zNWJZ8rp8*HWh+ll6Pfnv#RZLo2|klF8X2S+R5$MZ=lI+F+w`~ApN=@nK7BPe&NU>`
zD`nrFxP8{~c7o~4+4tw|_djN&{q);Km$XnL-;|BY-==-6(Ays0a(>&qj=wcK^(Nii
zBcwmiwtnN^M>o6EAJym`WsiI|bH<76na@tMnuty95sz#B|9Styv)$8gJc}-z5^B`i
zf7D3-k=Du0Yu9E@)OQi_4Zpf-LZHed)|%BWb5bi^Lr<;M4V@OUX~icS-BQOmzN1FH
zt25(t+7?Z44qUfz#hmr4RIW~4_0{NPnv&kpoqAHwGqsL$S@0@|JPTG-FBHArC2n!i
zMDl8PV(%m$zsVuj_C4`tt*bYz<PW{)H1+Zhja0?5yJ?A!cgszD7v%gVpYz8;QTsiz
z-c9x*@)B46*|girbX~5|+`OV^`H$T?SFS6XZmpL;k-5ifb;XpTt)D9uQ*UoCnyD5l
zB5oXUb^rQLUXR}MtesM5IM4n1CXGr3iw*C?jg7ahZJgB+#bw(s{Ohy(&UNckXPpnZ
zxamZ?>mCDNzWl`Jn=Ndg7VUL1+Aa6|rpe5o-d}1b9X<MMPWpnh(kZ^hGqM;@2ZwaF
zyo^cx=_}SdeRYPE{-i0VzS$oM|MYx^$A(->6XOjhHbxw>6J4rhUjLif<CKP;_fCnW
zuNUggI9;K{{aO7@He>Ua`sLTVH8$S=d@;Xa!L##0ddU_BMnSf>_<ycysBNG4X~MGA
zIX><#{TjMq7bX0S>eZJ>t({b|NPC8BOR|~h^M^n0`|&USE6?}6-o~nKyYt@?pR#z-
zEmt|kPv%aV`mi);-J>mQ!X~R+e_OX~ld)Fy{Fsws7Hc(%CmiVNI2@w1u<_{QOY<L>
zsCqAd>no`LvVPZB_Zh`iZx5PFbG?|8f05m`OK5kaah2R7eeu*#p0nFeuU)(L@#M!Z
z{@(kz`^ASJ&tE+G^5?~qA3Uq#1t!!L{Cd1Q<NuQ%Z!hkCQS$yzdxA#O)2lj<RQskC
zn)0(bhnD|8e6PR#;>+WQx4ZA3b?Y(fgM=+Q4OVxqz1nYI@w@K*UCC=+>X%LCP32p2
zIrwwoo|swd4N`8s<LLAi(^u&+RnXyBY15$T`y_<nn47`%f2DKYaU9#%c;jC=V`>je
z$3>53?;F>&&K(n4&G+#)!!8ys9kJI>trqNRWl5UHxnjY>^C_Z?%UrJ)UTohraZ!VH
z=`U6dTfI-4?g%O$c%;~%p(OK_ue62Piof#yW0CLACb3_C{q@ED{wsx=S`U0bnaK%P
zDGNMM7uMSAR>Ha0E&0bZhO^UE*Yv7Rs+sojIp;^KdqS3iH8mm+g++71Iprts@mTd$
zVBaAn-=n=Eg^I3hI&Y$^Cj4koaBh;iY~g!ULoS|^g{5|l(dE-N`r3CrIhZ}X*txcx
z&i7)S%g!?SoGaU$9S#4TtAD&!)9>2a;cm&pxsd(-|B^5N6n+&ya5!Zg+4k)Hzt*^d
zkG&j=wyVo4X9>qVn)Bru$INL#GgeLK;*@+4S0%jO`{V6ZYs`F4o;!AE;i7}B&GIoV
zCt9m#q@0U;E5Wd3>4wtEP8mhbguM)R8Em^7S28btp2fK)Dy}nm#`e|*`^8Sj!b6%i
zZ@wR}tz$J;8$Ua{f$bk%|4sjnn*89A{j>6i&=&spm%jD(=*~HDG3(lVwi_EyEPu4Q
z@pr2Ls~_i?@+Jq4%1R}Vmu)5wKH8j1>oD7FB7bz{0%ke3ZQ`ZR1pb9BzCPb8XO-I-
zlM62$@2Fgzb3L71``~_yjgD`1)-SO-D;&vK*^&16&#o7j|0`FXb{7%v^h#JM=DF-B
z^XIpzKZN!jxbUOF`C@bef04q!(>^Wde)vmn*~O5zC2H9xCUw&#D`WXu^;Ayvs5o3~
zSQT+QHkvOnI!rQemT2cM@w5#aCf>fCRdDd>gGV>daUV1FeANA7u}#^W@O;4&iGfd8
zIla1<91#mKxKX&_pThK1F@~KxeHo4?3QwHF?a<>QdirBm%BpRDrEbMuZvM7(wVmka
zItDd;=RBKp>J8s_KavbI*VS)ZC3upnA?l8V+MoBk8RulBhtH8@2)QHj-bH}zVEx~Q
zFvkmza_iY@)*gAT?|4FD%|Ypp8_qu}uQ2vMR@^Pe{9~p6y_<YZo38FN(7Uws!jk^~
zp9A=~|HVI=DtF<3dxmSNT${!YDgL9vdz*4IlES~=i)eaelH|2>7SsEiE4_I)h}>8f
zy`Vy=Z<$92x8xM1v{Xj}gP6J*mn1q$z1CE(vg0|*btB2NUwiMORgT){H_lI7*?b`W
zVppNXfyx}^yxHsRii=+P`96Jnp67@6gVJZ~%(h9Ee0JKpBVu){vYnv%4kL5UGi7X>
z%2&?3rlPlQ+nvOP4y}{qbJ@iN=Ij41iz{0{vHMbp(7PR9+OJqK@AtZWB6ghzN0Un-
zD~E^kqtaK|bL)?1{C{Zor-)&H&Y=l^cecD`w_H6%=(zhOKCK@c);X9=czo!%CttwB
z14oTLi>Gkv$vwDYr*!F``Td4BGZybSyJ<z>rn0vQJ`Y>fb=y^D8P+mRjDOwc+ENt7
z^@u4+poYW4$gtsKKy*jQLn9xxmbNQB7t`)AzURwWyJ6k}w)h1WcD`Jy;*ZXhI>+q&
zVdWR3lBy`TcgdpS?f!Qkah`Tm+3Pi-VTG)U!mkF#k4!sFF185#%ZnB0*8lawG~B8C
zPRg$r><US-HoMmZtK{uls>XhcQNE#;IZxwJWDj?%MbnH4D=cSrK3G#xRmI7;TQK#^
zmNOx8HWQEgK8{$p?5^l$R_7yEb;`f*O(?k*ai{K<%raiB1he&Gnd+az?$-uRI^D!3
zUmj8Vw#4ZDGuBN#&2^WxZs)BwNc^!tfB%g@!Gm8qmwpc2I7PQy@z(F}%TB#!+4NuK
zQc9CXY9;@wBi$Ef{Fe_{aP9KM>p!j^>)PaJ@F4U;OoXogT=RUTqh1^pO6NZ8$&k+1
z6#FRk@@XlPQr9b)9|pndSN1qE#W62RyZueMNqooRrS}r@V|s1(CSP$}kY4`%*{>OC
zeg_UXPg>_HdvAIBLi3pS7g9aHMc-MkopAoJ`NQtAz?;uYo<FRfV0rhh{+kjGvq?)?
z1=e%?zpS)Ww#M$W$O)zw{Caf<uQjvv?ht;GyljDg$ILGEn~NR0cI8U(H$7hbc>g<A
zohZH@Q6=YR<%zd0w&;kMb+de7pT+fJdal{#gY#4OM6gcp(+hlZA}IUVTe~%}o!fS0
zecuz|dA_CblGHXXPri58pUf|u$H*QT8GGPz%!=b-Z(9{swX(B*T;$xkP_(*7>M;Ay
zhpT*E&-wD><$VD&<H&DsrECu-o_U<wd2MUay!DqlJJdhS-@$muQAusX^};zy)yxlh
zo>pniYWlE|Y1%f1yT==^9T$DB7il9}Y4vg2lk%63d~IWbSM2I)wLewGJ)<k_VS&i>
zlnZauo83Z>i2h*Fu+_Y{<1+uYjrP~R&zd0n;s^hmpWli%>N0Rn?W(wWmD#gOZ(csj
zy1rv>2_;@;&Ih$z=a@XaB6{(B{H!buroiI~H*RtNWjS^s{p;1+jENU?mDX3M>BUYJ
ztrt1^nQz*wOUj+o*tThU{#c#;&CJB-wY>UKmM_5x1r-a5w3)Ow`b~@Y@$c_>`8kJO
z!;%(oFSJ<ws7be;OXksK0e<H;Q5Us*l>@4;OI$1Z>%Yaf-JcW_(KCt5HlkTEnp0>&
z!hx!VJDJ@560;B3`Klgp=Q^fkq}|i^c*mIsH_jC+@v;|9IU>2j@6^W6EgJW2_Dw68
zq;7Cmg*mp#K;{KkZA`-l79lfVeue%gIwv=^Ol8+O;2N|cEYizM+sE(FJC7+v-chnQ
zB&5`&kDN8ide5iG7ElzYt-`me@9w{Z-$yrpunemHcl|fR(TI0b?f!FzKd;}*A0qp|
z(EI+1SNX55-Y@uSUiY#*=GWZ#U$ea9e=ogX^m2RMOKrW{r_=X6xir1*CAVJf!|8U<
zFWsuBG@bW*wPUf^!T3Ly%wv8X)BoG&z5la!d^?9l#oOt1r<dOUwRHWCFH_@x8662^
z(f=Q$UF*CwKWpjzz?bD)FI^A$wJYqG?$o;5O`=B>L@#Zh!@1n9R!ycR+T-Wnn~vqo
zYPVc`%3^*s{>YKlj%q!}voHFQckbZ|&P9h>UI=~=5PvKxyEto}L3m&CH>2;jJHyvs
z7k>ZwPnSEx)S1;Cf;-<`ls;CUeQ-YOv+Wr+5|cJM%z67>cJg26>K`Z4`ArtJ1nU~F
zRbjY0SJg*yTC2?I&NIh+7B1lbvQP4=Qb_FrW#PXe&kkRZRhVEW#x7K5G)bV@iA&?R
zhkFH6+C%k4>C)ewK04Pm%k5H}%{XC_DCY`YjjX9joJ+*kx*X7ZFrR6O&b`FA*PK^Y
zI!VQwo}U=9ymDX5{q7pm+0NHz@mjp|$)4@Be)1=UC}-~TGisMvd$2UdEh~!N)P9#i
z<!6W5-8(Ctj!icGX1posvQX^NCk-l!!JX;1ZgcJ7U@T8i;W0Ic_Fkr@JtKNgh{1&g
zxlAFywmoWPeiWn`y^phaap9$NpZ-1bG!lDIA!T-ISH^KuYv1+%zUZwe3;vaqzBJBo
z?~;387Hrij=e6(P@~ZRk;^7Qfmhj}^2SvI5M$@310{{P+TKz1%kR`qEfYo$8(FWNP
zPllIIyq@i17hLe_cFcc1qk;oE`&=?N%vyb8oz+9fFV3sG_#<BGcN%S5*Tp0tdqixC
z$&}esb9U`xzcyid`}`T(GHw5y$#Dta-hE)zD%lfV(fcL+16LmODz9YM+i-2JM1bn#
zuYbSGXW!rWn?J5b{F(fwFE<X>?{8&aH`gxV>B?VaiisPKZ<+V>`n~pZa@*egIrHw%
zzu3&O@AtF%^BT;any0q>yRpx3_4^-*8Fehv=KW!Gys)pSp}B#nae~mFrZS$0|M5H6
zZLdgd+4aP#GdS?*(@>4Nhr$NS9HM_5`)K85_&Fi)<x8n0eLRhdMj>0eyx1-&2PBDV
z#XpvaUHH1D^@HoiQ%6pV-(FzIbz`cK;j6FOzk>S<T|a8>pY!L_FVRg(O<Sh?6q*`2
zVah6&ttMPH%oBYZgOsxvf?a-z&v1=;X3?;~>1f{C<~6UlTT|834~Tfp^t<?jO-acz
z`-(xA<`vb=MiXv`1O~koFZ8W1$~1bmAoY#UdA=LLMyY$|p5D4+qME^(Y@sgYZ&jh2
zG(09w-+rOGNlE)#)QSD;g>LcRv-)JZsAIcRNPC&coUL<Hf>UZ&mbl+Cbc(Z#)8AV4
zs75Y5{IY1q=M>(A$yT$@%M=_b^X`*=RN!~;<D7uot!_UyvBhx(8*%K`Sbx0a)3M?S
zvzYC#bskkdBIUZsQQm)ov+$+Uowx2P%c_}5Y9%T-e`Z;5%0~U6jho}#MNfWwu;HJ&
ze_QYR={=8MT-Hi$RW^%ew?31x@@Z#H>J`IJKh;c5-Zo$F8ZVh}%_DNf#fB-O4o<QX
z4Tn#Kx7MdTIPU6cX19kUl%=Wk_)OJi;TVRep9N>K8?Gr|T9vU>=+5QS7k+&%Eq3r(
z!MHo?+QH0iPXiav$&_&0n!R}WvfNvn{9}!m8vB`D&IxBR$UFXM`HQ8i7UY<@O9V<j
zs9Y=meW81lMB$fNz8ub9`)mW*TkJ0>avY63cX1X+^(5oIV-4*h`#VlFbT8!B=Cin_
zrg>NQ0n3VMQ;!^&{=`cw!a?lBAC^D-+xj*rinMF$ZR`s)Shk5b`)qV&^Ri7Rxt#qT
z1=g)K>zlFt<5erapA(wCdR@0qc$Jv&*+Or1-38G$Ssvfq{`W7P-rhf+EOX%t?|&}Q
zq(cdIm)G%K%xd0WlX+cf#ieC_Gp6@nt}dCf=b!A~Gsm*@o*lN)Q%)-N6e}!9v+r2+
z<mv3|fg*RVdh@n-ems8jmenW0T}`)+{%O}zyK<}H;`Ob`+yAYz&EHX9a4+}sqxxNo
zGcWKzeQ|Gz)6B!~;yqSY*Y>3yFkLEa?(oAVakj3JUeBR?KFu!&7U;at)3*Fw(-|KB
zIKn<)+NLDlg4%>Gh22WY4O3YQ4|wc(Ar`eXE5v=O6uZXUlO<Z*&s28&I(FD)mnM&v
ziJ5AOfP=1BiTbId;=MaxBq*&8*eP}1dF_iJPJyj9%-iOw{ZCl+)R(dBYK~h_*1=2e
zEF!<l%)93?r>d=NoGljA=e6bW!o)K_C!AchRc7heYy9=+^Jcde7Tq=r+WVnGm_t{n
z@}hjpfitNWuRs2B#`0^LR?VJk96wF3@pyl!)i@p@wBc*>{)l$T9M97S-Uu$A8gw+k
zZqn((4-LNxH&*;zwbrrcHq-p9-aUq|t>V^b#0g&b^M3Lw!QLm!-OB=Xm~O3ortW$F
zRvX__>4b01s(HtX{`?Y+?OqtqmfP^-a;<}=1H-YNsWX`p4g}R6n^o~t@8qgIbJ*i=
zS?9bFYU~sjmV2xFfAXG6-q70)2i)AxIvP(Ynz}bCkb~h*(cN2nVh%04vr)Y}C6cY~
zLK%Z^$FxNu9lTi^7fRWfZZ+8>>GCS<%`CS~HJ*IJKfd3-=K127*E-9SM}DhB-|e#d
zdE~KaLR#OVG|LA!qI%aIkZLr#m(}{_Y4>u4g2e@{abHz}KTOyZcT#Ec%K*W=T^}M(
zwhA&G|EzRg+uiGkwYsz7>Ozm{6#+8?FF2^C%x}Dut0AVKxOnGQCaImBKPT<ddOSB}
z>&JWB?wov`D7w3)bGK)^)xQ20f_^XB_|E>URr;p3A@Rh{z^8k(Sl^2M3JWvt`>U<8
zDeuDZBmF^oCu_HyJGMqJYT2FZi80EYEfzVmc^}jU_3eG>@cp^GNZW+3P8uZ+z2;9B
zd~urdF1Oys>h|&4*n=}(+?vST#NJ^e-uCws>sIyr;7ty)7AvnMa?36_xMkh1ON-wd
z99bM6y4+1Bz$A0UhxTLru~t#vn#*2)UH!iQocWvS&T8{J_}!PMZ}3_1t1sfa`)QVG
zhn~EY*(lbWRXg+c)!vs`7jJOJ)H^A4SWZ}>S*#-aQcmVT@V0kLt^Ug;{aSb^rE}Ny
zC!%ZC?KF1$?7w(X^V!*Z#n@as?i^u#l~$pz_4vfUznAB;obG>QeDGKBN7nVzg3mM^
zQVII%SdrT{_kzE{`c<hrKYw}2({~`NrBL4gZEp0xubDy96x8g_KH;4&vZ=k~0Q1(;
zol4%XmW#UX%Q-$jgV(+{QN%ycsETW{OY!;T2lzFYXkKA`Qtfr@zt*EC_P#}53g47_
zu+H9jOt{d^i+N(-j*#|V5!=OgYD&cp&ti|e<zw30de2KVE11)Uf$MW{*K@`k7hku`
zyi%nLdP}x>Pt;-H|M!A*hx+mCBsPA|-P<>nuurJ&xXeFsCa3+AZf$-`17pVGl%C`R
ztIa(&|KLbsG2{DUAS<f9daK#b+qQhi?V~^Zc_owN{Qj+ShDnBC{r_rihIq%cV1-%F
zrZi?3ez|$Nzg@nc|GvBYH$VUWzWZ|%U5>X`be;@*BkLvc^tprJ-vsv=@#ZaY*Xo##
zGH%%V?<?clnd=jhzusoPrFG7&cXhi7i;do=mMY&s#ww5Kybm*`J^sq$_UFSzzei46
zcb^U8&z$k(sd7~4_5Q4~xd{p{7tgwP<Z8vg71Jgw&3k&&BsMwv_i<*0GmoESwXXd+
zoqfxk)GK-476{gVTw)hC?e`kx`xBj*WkW;y7jFpPaz(HBTyRL=k?jvZr#G=)>g0NP
zy)0%*+V<i`pJbcoJ07U`hIj7~IpX`|NaJx!_A7rC8GgxZom9kEa7-(fwd2*v8M5<P
z>@+Gl7}>S8?h80eH!q0ml2)pm^30j>8Z(>Hn-vSP_RS6a)#iW6rqO-Xjs%5M|BJ;R
zmRd4=;dq^9dFDjmsuOL?S8uAY^4hd~PsgoDzTbP!swVH+W-#g2!`@lp&va$mm}X@M
zJXtX5#5uz#=Btc7EM8NT#p<Uye~IFA4cWa_?uWCZXPGs>-tPD2e=@^uR{Pqx1s?g%
z_@#Nfq2>K4e79Dgt+0M?*;qPbPKx;d^{f+*E#><n=A^2cQ^P0XH__I2?RW9|5L4av
zvYjFgTVD9Pt8Y5R+O%e7KZk2`*XGc&BDVD945pQjRK$$WUST~sPs)-1;;QAxE<C=X
zZ~S8QcgbVFmx`BVl>N9I{PDvM=?lis1C`%i&}uW7R=TffZfBg3^kbprm1{1pJu{iJ
zdhK;VA0vk4KD*tn&NuDzGheu+u~*-z(sAEv!TK7W#*047?UYRJJX`wQ^>J9;^*i~_
z#jT$%Smd6lUr~{?So-V1x5wvH@!nn4;CG$-$1f+#&DPJe{?z|lx`{u%-rCy!kHFja
zwRiq2W<&=st#hmBiEX|6^62Hedwtma))_y3`Y1v1kQD3gXA6$W)I@yGh}wO3wchNN
z8n2{RI=7zi<4StU^f#pG^G$)H=e(!pC{5Io4Xoh}n$U6lF^e$wCDw_ZM-qzOMKEk!
z8!*Lnf`dWYq@FD-Eq|VA#xCM#+G<hH$0Yl3;om<#atpOB7N=Zo)(hcaZoFt~k#h0-
zyv!+UlBezNJ-6%Dl7Lq+GxnQTD6#LG_V`HO&D|4n8|1hd{SRiup4?-g`CR6}ya0oY
znsxJEF)C;jY@FOI+&J^(4T%L3OIPF-eLNXC&wl~)T7zp{PIp76ZIzH+C8EXFU}t*$
z<>%=K)r(iNo4v5VaCBADX^p(vjZ-GKZ1#SZvW(~Di5=;xOf4M@OMmA*?Au*z%5U}N
zzkadjlR1I2BScwM)Q(M@J>}Vj6*mk;jn;IBnp~>una=s*R>L)p+>jZKnRA7139a7j
zwqSA-gJR?J1n;;SyUtsSdmO84_#0v#Juxe^dHplYT8=M5_(~I7n%ZN>dq?&xc_#Mc
zq-6ggPKSqYg3YZAF8px5W3b9=ndY$%rhhM;OVe1@W#sa9g=vTJ@9!HIXoVR)`cqow
z^lig0k0Z&?O-kd=`vpILlCa1|P5wlc@tjDmguTn;>NjX|{EB_h_;d^3%$x+j-*v~2
ztVx_O_tI=DrT-TmFizOI_etJ~ocE2*_I`rr`QFBTj?;B?I+QbI@)CoWEZajB^(8qH
z{)KA<#LVqm{k=ClD)D`Yi@~xbU5oa09bY0c{YDc@kD|Q5zugnJC+wNwqE)$MviZXt
zzT+92{y%KUp6<f^=SJ)s?Jcp1A{%}l7TkL^*LjaZXWb#ELp@hJTe})2TgrZw-s75i
z>}14qx2+mm7X&!Qau*dp5<K*!DLZV*53a70Ei*%1<MdXtha0Ucy(BitCwTMMvfSBe
zTZ>{AY+9rBYPC{{@U<;cyEp``b{J$F+FVf}AF-;8TZTRJ9kWOHcST3<l*E9zZ?8AY
zZi?4FwLa_myJ+cEjdp7$%3V1Y*1JG=GmG@6#vLb{F4@d0sF#q*zqZ`IVe*z)XH`mg
zD!g8LH12s{^r+>VoMt4y%(2&VoZCw0vEE;B>SIE04@2zc1<JyypVTfnzq4*HyTEq)
zOz)K?^CKhwPng1e$7XTaBA;7Hw?f@{{iFLN%T!)xp4gmoOzl@{=k#Ys=B%@}TE_J^
zS$}%{6yp_*oNFAdu6m!;c3CMZ8ugYXh57Ai$Ku+vQ$Cz?ZsDGwWVlQ^@?YiGjHu&o
zwrPR2bN3d1)c7E_tTEx@*MhlEv?u-7h<5Q>B>3IPq-n|$AG0lDx&q0DTA#FM+P1zu
zAUglX(Tpp3apA_Lg1gPv-d>=5zA;^T$NR9h4O4?(n7*~rFJ<XWEG+!LlE>{%c*li%
zpH?Rxer(XRVbN9nCi}H&^D;loO#k9K=ki{ybjhDa?)??kZ2{}29XOLWY3ZAtKfP}6
z$*n)SAp2-Y@(qT_b7yZAOtR!ETphT8t)9DSw?uSwul4jZMeo%W?)P}km3=ssf$LIC
zYJ<W52{Zd${geya+D~MOoZ$0%-gR`o_L)Qf(%m0_NGU5jY4sq4V+*&RhWmnr*|lam
zg;5U*d+yFIIWTvDlX|J{^ah=)b5;Kx3f!b;*<9p)_TPc%K9(nEcRa{e{pwThv*hHz
zMK<TR{9V)fVuJ$v4JW2Hg^q<@jIH4Z=P5lb*d(3po3q?j^k3^_i+`8AS?^l1CpabZ
zWjY6Up3+@EE#jDj%i^ytcaMd=mTL74sz2`-aINZjS;x++Nv{I@3N_xnx$Iw4zrQY#
z{bkPPFRL#W9NOw#-mqU~#<M7{T_Gv~JNyl%%@oQA+fd?Tutv>$X(BV{&z|VF=QmHS
z)OIRKX_aFX_@jP1WB0rn6DR(<T*a-?^7qJxHxsMPCQQ96;u*TorGNXHE2#oidloiE
zrS<UXSuV@j{d?J>yLt6|UZESGJ<#6iRvhN(x#;4KX*ZXPe3-}`zPI3k%<LZR6h5IT
zCA&0uGfys8TCh=}BjH3Rm!?5ZlxO%?&Itl~Asklm(>OHtmozvx3v-_>*vR#CO2H%k
zj(t*F&!l};-+9&MsNkv=vmZy}yANNpj!sLRa$TkQ-0I(J_@pGgT?0>F?a*tO?eTA7
z%O{uEwT@c_Ij0=UyYpqzqvvXRUl*R{@wl6L@5#KPG#M@n%^;TpT*|F2vsSujq$DK$
zxfPY@XSgCLe$Dy#ZGWnMWdz*+w_EAemqjstJ<H!~3NEag;NXAaf7|sXd;G)1ziBdX
zSWVe<$5ObK=iOOdwI5FwHd`)wxv#k5?yR*{e-F>Mm@DWk!*S?tak=`7ZyP?w7|WQw
zece^iWLLkkvvRioUhbpUa+;G*>|lI+IhS7~G_Tp|b8mp}7ctMpDfd_Bgje2};dWX3
z?xcC!QnPi-Hh#R7|Ml?6o0Zm+KHg@|wQ%F-wvjmc#$q2|Sgwt!><<U!dKD{)J0T8o
z&9lUoicC13Akx;HSiILp%hh08&MJ|%*{k_vUmB`p&3I(&U$|=5z7LA=X4PpAzb4jd
zH-4Afdws$6U-gG3hNu+j{hW64PGDzbdr95|A+3w9EQh8^>FnFG_MY&?lU*FAHA4kY
z&z!ZgBKPLxy>hSI^^8s(y6}BRK-0gLy4g{8ETm3UO-N6eqw8~efo=0EXMfpKTW>#P
z4dK3ecAsZ`gOjSg(#4DojS^cg$nCpWD1Pxp;*y*8DgGDM^0`0xa)OzC<rl9BELB#e
zGB@`e=5xzl=_HvI=a;F!d8YESjc%*{+U@?f<le<27ZuCyYTmziMkZ;>@-vNjW<{zB
zA(A1yvb+o9STA<EdGCw&?)Y`(;QgQt1t~lZrZ-a;&k2^_6&|U7`ES<kuZ6F7XSv6u
zeBJYAP1b_jm%M78a37X=yh-UdtKu88Q$6dX7WkQXUz+uCLZAEdOIb`FVLdNymZxM}
z&pdfz{o$l7!or)s?601*U0lL=)vHTt)#VG?t1A1pERM6fAz&d~bL2}0_nsT)PA@wY
zzm5OQ9Dx_#8m(<U@`_xjIkavz?~lcCOC+Dp@n)4(yvcHR;+)#%Pbpj0d`g?4koumZ
zmiO?zy$e=L-2eRdQLZnqVdE#^-IsUO1h1Hz&QKD-?2>aODe(FC)>!`Z5)W3HZ7EG>
zlA@pfEf*E`ikdXZ+|2O2mO%7{S5o&B)%YH|m3-KE<VHNZ*cG<c=r6*SCUPllOPkbB
z+-{lEY`O6h_thur-1^U|>a*5{Td$~kwqR4t+m7sK{s-ntt(utRHMg5jqi$)ZzLMAE
zH<$OmWG`IbxY+e%wB*C+LT|6$1vS<`uV$S*lEE9YRO{N`wC&D<7P)_&Uozc&GxhWC
z^{Gv1jV#9mCDZO5`)=iaY0HLfUowlY&E}eQKuG(bN{QE}-8t*G?U^On`IAY0_w8r)
zufJ|Qzak+2W97Qr4*M^NzbII?>#E2E|Gm|rVHq;VwhMoFX(#H(QWW%P#%>AO54*4P
zPHp+YlIh54ea6_}+Sfe`CWnaXJCp@-zw1<$m^I_<6!~2#yIs4*qiPRENR^(5*4k>{
z=)Nw~`PbWT3%?$J$k`)pGpFvffNhP7;~B}WexWzQDevb=nRB=N(Y{;rpl#MX)-~G%
z(^qdZbX~0VouPaO?-XX)R&Hw*XHCQ1ztXRMo$hVRan7swq0ht3vSuNNEg~-nI{z2h
zmeXYJ5EmFDUD<o%`gYOs*}1kCW+}XVw{7K~UT(b`$DL<A=&#zx`?X<4bJqEok4p|F
zi>xnrVlw;6g!{}b>usO4+kTyv*l_IA#+;8%t2@Ng3q$I6zq)@++Be{8=YtnwFMbAS
zvaYR5Uh*ydckuk_)4y}If9H97ZuffWzPbKOs`tu8%2~Y8T&<BD+qW~_-XdrE=l^S7
zEZTUBd9Ui376X}6is@=^<=FDCn)&COS4CYcPW&kEYE-7ZBTm|n*;{hAW2$GG<m}kM
z{W0CrsU_=gt`7~E`|dL1_0{vA&-3OFP&&LJ@Q066^vd3C*S7gO-xHn3$b9-wvZt$V
z(DL@zD-?sd_I|p=x2QzygxacIEBJ3`UR=Wc!+HCG)lR3C->3vNd3;ug%iMY3Iq#LY
zv-v9?os>#<{{JJ(F!PX}pUmm#FQqSQdaRDDYm>F@zG&Mmsl_-`dwJqD>++=`S1fi3
z3aY=TwoZ}|$<VS}=FR1FMZZUE(x-LCC8=*bWcKuaRBSWZ>XCF@bSL{48<tngf*G0f
z3sjt9gsScxJzd5URMfI`bw!x@{jFt!$0mEuKk#7pvKjh2+C;u*u<m*nx;ImHdQR~3
z>xKJbzO%p8XzSs+mHhbI)}6DBH|YO+)$KN=d+B4xE9s6;ElW(>+UKwM<+<y3%?`FR
z?lP0A=63qrzAjPt{8iEE`{KQ=T9%UydCK0oY&cxrJtg6~(UDyd23wjYMXG##a?LMy
z<1J;KSqifsa+(&dQ7kuIc<sU@@ddMwU9_8Iab@e|G~L_N78HAbJbv=-@(-79edNu(
zv{J)vV}sGz&;ESpAJ54DIB(8T2Cj}7N;aNXdnALjw?$?isf*p{vobTv;)RHToZ_^b
zFQ=(3Wsx&IKY2~%RHYZQDnFZ?{C)7DiT;a|O?)fQKAMu>nmbQ**R4H)N1pfCN>AIM
z8}Vj~+PUMcUAY$>HP<a}dvw%dmMrtd=mUbyo$7YgA5-qEZ~XE0aG2t!T;~7F<>r6e
zyJgZhw`6UzyootCH?P^`WIlgyt6Yux1K0mm8V#poY6IV#-~2pcSx)`!<=bC;bv4@i
zZ~7x?{&ycw7JjLF|0A}f;!kl&QB_?@QB9hbg__xGUVHvf6E3SG`aNbgCBZTA*A{VI
zdF5lUih);?dA|3Ti&1t*{vI}HV%&E**~e`TyMP7HvQD==<48sU8LzVf!Om+{*V*wb
zeton0sr;4qE3?H<26()`SoFuSbLN8F8p8*jR?0tY=2i7N`Gn1REq;<O{c3DNM9)$!
z=Oj<v4N1#&Kg@i)L*vobO%u3MWyLC<2Toh7I6F)CCzIT)KBa5s$|BRP@0DG$(|8;E
zF|P5whs$M|pLX$q%6vTs3r<{^>vHB=M^>rco;R97kvk9SeVy--ukm-a#2zjm-KU%W
zJ}Gk#`4k~PLI1^W@%qZr?++YqKA9+b@ZA4j<_W@I7S<M=_SkFSxXiU!Fv|4-ga2#e
z8`By>AIZKG(_f!9k!$6R4F}7=-`Kcgt@DehsLS1-4Lpt;%~&P=Dltyz!A^nR9n(*#
zuFn0vV#Dd9o0|S_jy=>_c-j8c#%1%CXwLkZ7@%fbovr+`{g!^Ksp0=?KCx1njTwu-
zzLdSmHTfR%ub`x>o}d5N3g-9M{VmwhoHeV8k^kK8n4TXq?@D)x>?v9&D7{~PL$u8u
zT>(oqpMK%zn;*@&oaXelWx-c5$LBxG3$^C@T&}pLcI(yrvb`7nwe>t*zPG$R{i1*R
zf#yZu*^f-##rVko>?yDQqi>m>AMV>{!L=aq)^5I;uf8Qc=ub;Ja>V(<kB`2pZrk;K
z1*$JS{q%a=l)slRyRYeroKXKLDreEs**TAAt-t<u#&;?0NsJc9zfUQeB{}1E-4*9s
zD{3w<mw83^B*@OM&NnGPf5q_hujq@mlY6z_MO63Yc>T7>?wuq%E8)v2-o_^aM_6=!
zpWeZ6l2Jb?J#^Bq>u$E*qEELsSe^0-jcRSkTXJv3@16T*UTRR1^^8vp-NqfVy6a|F
zy!gRCsRc=~-I<#v<W0-hd!c=oJ6C1OH`{e3tx>ldXH5!A|N5cyR>eop_;dfCY&qlp
z<k{Bm6Mo3Hb1qNp`DvuzP%x|JmYu}qY47Tc%=_<Zn@?f;P;c;WXKXHCCU36v+QeOD
zhflWjR{e=dDpUPyz<+kr7q%U~$3^$<5O`gt651G&`)r{V%fmB9T$A=KX79Y0D|I+6
z@XzW?Y(AOX+NXEidv&)zxbDcZXV2xX9eDEVAgjyLPI0rh)?cGzJUOD}({qnsI2pLd
z;kC6+&KmEkmW5aEJ-hy4?wViGC#FCD_3OQ3d)uv^4=)1(tM|%vw5U0qym$J#8$-K^
z<;JKPnX&hdRZNyX692gCnjrs+(mj4jg};<H?3?^}yZieWiPcNFu3W9=yY|~vN@?-@
z<_n91(vQ|Q7?h+x(7dzZn%Ml8i`dppGxCs=nOA3X=f1VQjlvnbzZIYOZgz#ud0$cy
z>2c%F^S%AN0;OxG&p)VI`#C=NY3Vw)BDW~j=lL8yS0bLgo~CBOzb*Xjny9(lO%*={
z{yq-;E0MZl;g*uQi?`j_{%&&0-TCJ}TixPq@wi*HDu$&_NoOBV<n~?drYEb*WrOo4
z<UTtTy`zpn-osvE`D)I4)7TteDE;{N<jETwE313;|1TeWc<|zJ28DtrS2t|6TqC#7
z?TvYT{g=PT_x9KCb}#mkdS~*dqNu3v<<b}WznE`L-n;eQpY1=a`kq;;p5MjsZ`b$F
zabFIfY(Kp1pPsdU!pdo1Ue9s4lsfgwsp<QoLhi3Gi}?7wjy>$^l9^@QC$?Hd{O7P-
zH~*O8t4(q?PV;}%CTG0ASh-QyzxZ})Fkf#)$hR)_N7MKAA79Y&rh{2%!O4RY)}Gz1
zQgPt!>@8Nu+4fnwv9Yp;C~m*okhv=@l>bT~-{T`}!JV9v8Zs7d1Qp-2-J93YpSMC;
zaIXjVjIB?^OXkm*w8E=Keuu}jXPFz4SnmcWGoN99YUAQM@%KA-`_(bY9KJ`^Ht*YD
z6eQdpb$sFfu(*WyI-}@EDg_rjWq&=3t2GX9W#7rRSv8y4_Ca#N`m!~WZ!i2f!n(m<
zFrh}*!R^Z9X&O)NonP5vZ<Rh<d}8G5jTfgMex|ni=p}ohx=H5C`I+SofB$>hBI|6H
zq`{oL7Y{xB9&OwyY<{=>{vOK{$HemD#Mr*im$*2i$8!D5>y2KI78{gL?G0OU!M7~q
zWT{c#H*vd<>3b?pBp$f6*8KqIliziw#hYy8o=4gL;XnTAz}`duUvu!+-mv`e^`ffn
zqlNP;)gtpmrcaub$JElDKHc<QTY}?TwqLjF`)+E5`yH3k78B;b`g}qENvFi0B98A@
z>~Y?qQDOUOiG^~l!3(!^?sf&9J#s&0U4Q@H@nGgl#>r8-ZZCg*|DLF@^{jJbUP;oc
z^#+Trj!cVt`SaQn?VJg0S1z$fC)Cx8bM@UmT)*t7mK1ZU%jbi+oHE7JH(TurPI-9c
z{r;`L&kBbmyb{jgjtGy9Jh;^DTzixI#Yr14moD8VyrJx`8*lUP^}K?a{f7^{b1a&B
z%hcdm(9_xlH)P^;mwc@=$l0dD&+^>ti0@5?<>gE6tvR|y*=kxtG}qR-i`Lg0emA_(
z(RSiOwk-d~btx_~Yqy!GXt@1}xa;h8l=rH3d7mry;fjf2;Tok28NW<at~#Q$QgP+h
zjeqrgrnFY~UlDDYy1rcQ@@YqT|L^DO1^&F_Unafq^l$d}_op9|o|pI~b!zwFcz$nt
z+bz$_mVI~kn6&WB#!}<@T3Z7{pP(<&Z(jDX{?^qqTN|=|V_5y&-zTOyg~x{1`c}{P
zE!QXrsE?nw=-jQ<Z-q}P^xsm?x_M{$Z{O*Unat#!9z<qrSbKMy+4LF#o=i&(k8g9m
zi?xo`UJ&?Qp;GTLpJ(@0|4QxS^(p(g>Ne-McGi3B=h=O8`POHD4F6hPTjX|MW5U0{
zzeaD;=Km`Bt2kHd!P&U8%t~`SL*?&(@_ToGt?>(nlE*$7%hEpWtlND#I92;w+{fI)
zXy$Jxq7`18myW*?^Jv-x>pQGn{@==)YYN#<Z2OY@WI=GEUnkeSfPCo<nM}J<zAK(n
z583(gMzZJo!s`$A-oEd?Zlk|m{NwE*Hyk26H0H3(-B9<VWmVC`89dfSKQ1>-5PcsO
zlyKIeMp=)^=h&>!+e?px?7Q6|-0%7N{>Nka_BWPq5Hk7N`?zG!p&DPSiDu=RE4+^z
zI5I}gc@}TE=f5^LoA{P!1*@V{{~LC4+~v5z%a+@Cr7CsHt{G2{GS$D-x73&@D1JLO
z&rZ9m=}-3D>F)Ep>OJqQpDGb@-A^E&TlP}N^kAju(_YWLT^)a0?6~*aylwoK_o`RD
zKP=nq`R)Ci9jC5dOf?Rlxn}aD$2`Y2`SaeGY$VaeP?*0lZe8=Xub+c+XH4PK4f`8r
zdF}k?Ra|p9D(zoZl|M=AO}<*bbY1neJO^v`vvVDjn{PkA@a=)?U$!l>a(0KVTJ6dE
zop#(d-|2l-YeCn{!q=blf5jE-JQ2O{LrCYPm}halhxQx{6*RZMV8FYvY|_%1Hg;uy
z-u$>3aWgO~V`=`2d#hsW?B(aLSDCr8`qj+v<F|u&_xttnInIg=Jm**|T9g-m^r3Xe
zk{gNj`(<S1AIT^39^3Xqao@8GGJdDrbS<h6X)L?4Xv!zsg$%x57(%{U@GgAk7<2Qx
zQPpLe<GpWRn$3A5t-g`>(T9@2kJ+DIy_{#wzSMm^+qK14*L{EJ{L$b@OI*aA57TbA
zFSok>@&-ezro)pLb+z^v7W1^p?0@Ze^vb22m#4e$KDaOSecr2$cYWs=c*;nH-rAbm
zl&!wz`T_Z?weAP~FK#J&sCV$-{d@8m(~GX`75l#P%hQ9k3L&TT6HgupQ;!j!(JjN9
z$Q2d2O2l8SWaFg80wS(mzUP>2j6AB&UH7gOe37wz!Dp{;vPPlGA&mD8LT1W+`Rb>>
z=zLog<E=#zO3NiWmmck2ZuQG&f7i>S20kj*LN`^-c=-x_WgbYhrZYdVSaWGp*oyDF
z4<%goWq8M<W0p{`D&+E!+6Bw^&zn9s>!ys3w20qV34ZN)wQ`H!ixoL;{nfs!&BgDy
z+tFJqd>ACVeDC}fNU={pw#BS}hW9NaN&c|cDYvRVADgj_Z<FTgos(s|>}2J-w&hO0
zGmGKQ#2ki%?=ssNLUpD_K38Wr;n!-rXW!w7=l5SfS{Wd*slM*+;!nLCXBbzfx_^3}
z(LDV{)}sl=lCG1lZVD+E-Fx`MfsM<)%jpO=-U|48wdO#8^#|UQO9C}RlN4=EJ1_j$
z{B7~!yY=!GY!`#rLhPqJy!i3Fy1m>y#?Kc2K7LrtnVlzdbXP{{llG5g?C+Ia`bxqg
zFF)JFwo2D7=7KD1P>-k2=iiSa9<9C=yIOr3&*~bn)1hzoDz>dsGQH}sbIru$2E|ty
zuPyh5ZCh2uwOGi!vM_X3_VI6v&V?MSS={OtCqF0C&$4lK$`powYYwwDP1D*GH&Nkx
z4bQfJ`T;0+GPwln?Tlt)VAvqSz<{>9BsVcRBQq}*dd$z(h}U_y%|!maU;bc{{3ZkU
z6Px}@FjZvCS`vNX&IOCz2Y7khth#QVn&KGbxmSUI%k>+R-_BXw?HZkTX;E>Yr4s-C
z;{P61(J`@de|HwIO1dCc<|lN)Zz<QAeHJrLS8!QZU(CyomU;HMHLyHb{aac6kHYl)
z^7ra8m(Q)Zedy^iuIb$7tcHjFrzaHaK2!V8u<`S?f4}=5OjW<-*!DPWp7hI*b=7;X
zJTW$$xujK_$4AZSY{5Csm8I_@j(l6CxP69pt@;wt#Z?;TN>{ymb}7Q(Yeb&*g%!tU
zg)&|J&~xU@m0a7iY4Y`5iE&X&f(*Od>SN{n`Rc9hYO0I=y{_|ruslZgIh)YSl)b-B
z&E)=E_3%KPmw7JdGoJM9osW6aB$6}5#BDzAKEve@{MaW-n=k$3%1a;IQVUKV`*wSs
zYx|#|b1h3vIhRP7EuA{s=a<+f6A|nE9iL;IE&b=`eq`@Zx!x$uA7m}~hFxS||Aqrk
zXU@`OPg5v5GruxGti@^Po)bca*$#Cg{J|G=b-I5pW4ZBY+o_E!YR_D87l=OH`L`&k
z!rw2?RASqV#p#JxZrqJXY=4{}afhen5ZA$1CoH}?7pcE7{kJHT^S70Nrkj_y&r>_K
z*HMc<SbPW;<SBT@a`8znTlQr072G9r)L#fXPVt<0^M+Nia+{Jy%&yPH2OMQxm!Gnl
z7kTU&gV>t9n54^6i>KYteSLaHjaRYp>NzV8J>T&1!@*rImWqB>_KVZm+>^FQr(PkK
z={C>gjPTyf4^^eHa}%|Hmu_8I6XtZQ!bZSM--o9&EAr)ZN!|WaUPn)?onG|9`&f$7
zH09TpL58m-b20=@9ZfbcVr9|ji)R+xGjZn9@PBom4(f)<A3boqu2C-R%a!a42EIy5
z3lcoHIbA+;`S{FMdx!b#PnXT$yigmrPp368IQT~M%U@2v5^`ju+P5u9^=zFdVc^ZV
zro5#^dBO9Ih8bE;hpd)NymHO%;MdC!e9}T%Cv-$c%D-7qk<z^1*k5Vtk9h*yi=#OA
zYLvd~cCX+%G;euUX6aY)TXyGDc>X@Px_-I%dVW9kaPjN!`TEu0>*=|zZwm8m)n~J^
zsw}T7DDzoe-2L>~GQoA~-KQPeAAa7M8LHJ@-Xz*M^JVxgw$x+R$?raXH1GZyWwD*r
zyjQ|Jwy3%3m=%v??iOwpX5BnT5wV3EOlIzNjs3>UmzR{AzWkD(*37yK4(to__uZct
zXn4GrZ-(q5PUh02mb%Lkn^vvey>0FOMZG>E&P#5oUaK<EH1-nTkeAMDo!0ll=+d?m
z<)vMc=k+Atvhr+nsxUjIw%$~~xot6b|Hp`j-7DXn>{jKPdDP*9*)FNDJ7(!(wK3dT
z4gUkCUFTxqyk}jXpnc;L>$Yj1;{(rszoc<1nRWA1<--D<3Msp<EI#mF+h&f&+$a2D
z0s6N!y7s)h^gQwB-X)FS-*5c?vGczEi}K7)?^U1ULvr1FIuxcBrbG)&3yfWOTWdju
zkm?c*=giw@Z_jn)@{&)oI~{cXP|iECgS+^cw`nFWaJ^CH;rnBW(M$7P$9J30z4PSt
z->A5(RcCIC%z9(i>3Z&v);s4PTV`E4HD~*VA6!j)uH9I^!c4H#c;P9JS=L3n7tgcO
ziQc+AYoFoy;OfK$)*UTUJEND`J(+5uYxeR)kf-LX?<aOWiu2}vZgEKD^4+h$b5DhZ
zZG0W^lEp;euhh#fbFE`hFMphJo78X7dR9knowb7W?N2t$D<wbOR+uNgIoja9fPl0Z
zvl;8^e{Cto?~WZyZ1u{{kTtej|M7st&KDO{HX0n8Eq&!q>zV66*r#f~UV3V&yQ9*#
zW9^$)@OY}8{-qoI;nsoMft$Ne31oKNOY8or^rEO%<md^$zY9te-0P<3mwtb;bH%j1
z8-4Da?S9;`{DGu}Xt~A-JNL3R+RayfuFaVjdw9RekM0?}3%P1F>hm5vZu6Pc*WC8r
zH*BfXt0lHMrylZFJ4kN#snI|4`Ge%M)!g%s?+;*nzUc5}m%IPx&%1W~1OLuTEtg+y
zdiVE3)Z@~bb-a#~)QexL%PzRAUzk<tuv((di6{See1YoUORwWzMiyts?$_9^_gQ=U
z)Kh<_KF+;9_xGu%Y-VvgOw(TNE4uodchOUAE9u#HZly2vl2-Ti3G-XMRIg-<_L*Gg
z9hrN|PqQoR`jouz;?*OUw^i*_Pc~nXY3UTT=lb(0f7nrLBs~Yc-4g^D7^=+~&~FLM
zP0r6PfSfvaHoCg_@ixK#_vbTxUFxhgb;a)N<tJB!3LW3+omaHp(mK~_Tl*r9fJd^P
z1}vJ<Uw`Z_FK3*f;Cl0uN@lfjr>Bir_uZrU@-6c=Z2o@#uTACL7MtlcpR^uTPCde@
zpZ;bE$05`CHs9yT*(NSubYt4dtk{ju{pZ`KKF>aPuRya%>?5zg>%@aLVILK&t-8D?
z8s6`Jy-IKA`^_raE|D7*&bx|+be?#6@#4piAG`NxZEy8Rn8$N^$%+UauWdYs{B8Op
zHk@i*GigGrlJ=x2)dr7WcuW?$WK+u`cBc5`*~xdzn4j!gH|ffr(A!EU!*wRSiP<RG
zW%5+fF!e`Ih0K*qQPsqy$3z^r`b}Q?vYvl^)#Q1Zr-L@WGGADdFe^{YHGN|FmtV^F
zU*#F!`Z75u{!YuBW4$-o<(BOD;JM<Sebb#k3t~<hdJ9ho-qX6>=*F+v3TuDP@Ql0K
zx__e0{S~4ajj3~&Ok~gX)GWFbvH3aIk_XQ{{~5mMH&1@S8X~Z{`2C;w_whfL+wZaX
z`|;}S_v!9D|0H#%uU67fwYOrjG&(B0W#^IWJttSmY&;q6@W^ySE#vy|tSU~P=|3-|
zUAZz*iQ~MdNXQ-ayhTe&&K~X&aXxatYfkpEBsRC>vmA3y$=tfRL}N1Vg~AQ0BC70*
z8rlCByTvK}mC!jSt0{FPc7n&f;4W$F<)x8}L>i4c{HH`u^N2DC_!MlEy*oXpFgs#r
zbj9?Ym)98lIA1yc6NA_^R(?k<hiTvLPf9IFI#fDgy~XMWE^*zTgm0Cf_E(JvlHG7&
zHCH5mkY<G95}#?BK|ESYw{NrVZu`9Xk)^(4gWztzRi-j|YL{L-ES(Zzwr7fhWB<#)
zQ}0Y*&WoIMc+~-4j@WsNMg85LGDl2dS{nFs#RkQv^Q-S4Jn4E`N?QBy;+myzc@kOv
z&+C%eu_EC-&v66BX+kMAL7kj@?gv?W=2h8F+G%vs*{|1N?~^4Tt^Dg8wYOe(c<@1c
z;f}Q8ZP~4!a@<CaQbsEuEcxJ7)sfYgdqCDpZa-t+Q^s#Qcf9p;nf6|6#Y-JV)#t12
zH@yF~OuEa)FRbB?;O$SZvfXn#r`%Ch<C?eIhToN?<(XgX(aHLA1(UMx7^xj>PGNi_
zyZy;hrH(riCaab(OZ9s6Z~hzAyi!bIcL#r$a*3E%T!ul`+_Kp2AFWcQ4<EdfUGQVM
z<>lOPvo8_BeSL>aCJ6O#%|4g;CVIx&7spFy{qo?cD4sHFTEeQm%ic*_$i3!ey}9qC
zRo`UkuYSB4@9jJ+SJvF0YSVkXYB`s^?n|fn>6;g~ZT;)Y_57qswd&s8=gvrOPG6iR
zawCFk)sl09zq@Q_m+~3vF8aCLQ2hKlE9Nb|mn`HDOg1=mTr$tN+~hW6TkQ;~C)4>}
zl_=X4E`E4)ZPkwGGY^*3o;q5Zw`+pcqpZzW?jE`*me%c1`0vXq!9!m@I$g*zUQ))M
zq5H<8bNM9x3$J<Dt9JX$4&=Rl@A1xUxyAOcdj;iA{ZWXN`qq2IK>tj|R<XeB3$dpI
zvWy=d2<q4p`<T=Eqybxxi^j)-`CU5PpFFB0D`uOXm+YU!^;c#mXG=?3)`Vq`X00|=
zDJZ+0c;}(H&6?E=duAKI`=&9kmgC^51$W+kS;zQ%F?*G<;MLtNhoi!jUT<$wV7i&F
z^Lo$yFNPXxm+cn&Aewe@BMWEgwzV>9b9m!r1?8EoSZ|%mmNIyG`1Xv_zb|Ke{gW%d
z-2c<ts|}ZrK2!U5>4x*PCIiMh-&Qz%5SW>`Hk7x&)<R`Bzg^TC7ln&+cLeCXvN77Q
zP-SVY;f;X)R_<)~S5s_WzBd+%d3L~cPJ-Ix{DXd<MH?(CZuTeeX{|VPfZhFe-M-Bw
zyRS1_X0?<rwN=SkrI>c-)w)#|j>o;&9NlDdnK$B+(Bmm)DIZJPvs0G*xXL|Qa*^0t
zGp5sVvzca=#mn-Y-FL>i_f-@BubOI~WQE;I!BvXf>5IaY)b9qAHRlVsKi0G8uekCx
zUCgz)plo)h%B~qJ6n9%2bk4c<xaRWFJl$izKipQkV`1Q&+i<5*<$G??h28J79vT?=
zmp8Foe>=PT@4xnaZ#IZ7J>G4?vGcXTjrEVM7YnM`TJPEM?c?i-O8ef;y?P^SI`bK(
zsjDU~nasWD$%7NIi3$m~zPMSmOMMq)73@u@*0h+%+rH!0TbX@=0SBKHnFv@p_VE2%
z|7>pGyTn5Z*W-SyD$d(|;luBwRYnTA)8@8TKhu1DwaZ&;@|ibGjZMqTW;ZZaeE9yR
zvFxVI?ce8L{r}4N*L3-(dy69sl4ta9cRLX(`jO97_e`z&Htj!Qr{e+~_&6mO8YkZS
zvTeugyJ6+m3bI%5w>3y!N_|%m@w;g4zKi)8`yIEnJPE%tX-?~R2TSF$8=fLJXL2MR
z7SRzAOemXq|J$~L^duhH{iQiGm@-6ntxW3ZjSmuiUg!I!jq^*v$F+}xpYyl(y-l({
zz2)OUfmx4t?lnEQo~z=$&W}K+o4gx#P0MRz{I7S@@JIQo8>Mf{%}W@sH@--0`@Wd{
zw@J)a$1Ur)6E=pvcDP=YE^zF1*7A0(39J!&FNe2G`%xLY<j<i=Hg55&xMY^hUBF}Q
zyOoQDWtoHNgl!J5`+7P`%~c$8PZqzoJdo_LqsLKG@KcXz+k}X-rlz-jO_Zi=uwB*Z
z#FX_@dB*dPv$@WHXf?Ln`t2R-CH)qkygL`C#y#Pz77c#j`ZXpcs%X{bzjJL5f0H?s
z#xrZ<*4~-xuY2xbJFrG(<w}9q!4Fojt!(i;lIY{mqV!Pm-PSG!?P)>=-(K3yv$s+y
zxGvW(^Zi7^!&Cfb1zO>M?20n`=h&_nY;hH@ns#VguFCSji!*a_{x&$9Z}wnHnc%i*
zQG=?2bDHEbaqn|oK`k*&cQ+}lJK*x=%F18XjXO=R{ZF00&~_#J(#+57T^n@yf^+%$
zug7h&y?D31qIOB~>Wh5;G+x{cjGpmHL0(L+^y>wQU&l)(eLK8i|HS>AEX@=D#9feX
zxOF;9qOLUPZhOLy>TP1Bt0rxo#9r{^+MXl3q`v6S;MD3ZU3>5vgMIVT8wJO2JctfV
zbNF^YrAEGSrP=P<L+4y#+Z^&^LtE$gE|0kNagz$mKi8Pbg(sHT%)e5!%QHoG$);6{
zU3`o^XU|=C)O6bYm#K^F+Ef;<oaR5NhKV75@+tMxx&e$&X1v%bT(`L5#WM}n_LP#B
z(~gTzuix|M&8OL?_s3REfA{pnPOD`zQf(%j=-sk*$v!<6JH1`<AKa~0WIebu!EC0p
zcy4v1*a08o#H{kZoY~uMwZ}?He5pS_|D?%r8+q@twKicZBX*s8E>~jpizi!pnT6!C
zo*Omi<~1hW>zK69n{m^VIg)FGS<gh=z1|ne*~&6`_O2zLip2Z2@jTCB@2i*o65ag1
zIr*|&)`zq__Mh)8pSCZ)TWc7qZz$uIyxNP;=ta?8{UtXn4jf|mYx2OMmya#h>KOYQ
zs~eB5%QNz(GD|L)d(=(uOnL2k_wO}lw}0W~^)WtqG1im8vs3ieiHwk08Ve%BT|b#r
zG^TBS5qPyG$!$N|`|gd6rrxzDd^#hULp}Ah<=$-g?se*x)7sFWwXandhBn9YdZ=22
z`ThTNRQ!CuRZ7XB>(l=gyfT;BwfA&mtV!kG%{(r9P42e}uRHxnR(0j24Ix%Szb3D`
z=%lZ1eTVbyjP(5Qj;iW6TW2>n-Kh;ts*!NjowDWm<B3;NmYsV$cROePhr1t>zPL=?
z&42K$y=-WpT%)jV!oK&f+iiJs@(ZTPrMtHMinx2v^vzpteL2DRZ)|UcFMD&TTlc$B
zox_tYo2LhJEnM@#F8!CzhNCLnd4Ao$L_XclTDVW{dDGL<Z7ew_66U2G*IJ&K80cNF
zi$nRBxBjf$_Cs%OKH6|#pRUG@&G~OV%g@Q(+)}vR^!m--n{Q|AQ*AJB*z<Zp%Z$>e
zR{2|GJ~%TR4PkL+JiJqQvb%?XcSqnOEpb(!&vWt${~l0jteTu<eR`5jBS((^r41A3
z_B>=huTYW9dPF^=f0fR;&%Anlk~2hJ{d2!|yK`Qg%0u<C&rjo{nOYor-ScKSPW|um
z$=*KPi2c`ri6-F_7(Bbz`lT;CsqOO6>V5qDIs0qAKkQwc^s!MuR^OEOn34IyjvxP(
zY|ArJMZ<1rg={}>Qxv~W>hFcMy?(RqO_FWC-E|}E%9B-1CaL!Go$g;hx1x9dOwZRB
z9%{bM%71%7L!frYvFP9qM&BowRx-tCm?=)0(eNfgvCnXClX9iUnUaD}?g=RuSVV$t
zIh?=i-d0?-X}5F0otX#3ObvPF|1zGxp<Lp8%;IHHxf@pbJg`YP+qj$|`K_tumrRNB
zBaV|!$-XF6v-kWrExx|n`TRD4;*`(R)z_bo<Kg&r@Dl5n_bcOM;`Y5bG;Qlacg5=r
zUhf*N2}jqIT<7_8CgXJ7O5q9f<?PgM`YzyAI8o!O>$OLj%W;b<xBd0&Lism66IO_p
zFwQ)z@aN(qF2>&li;U`Q97K;)wIn-=T(k`gR+D62aM9Ovm!i0f$k((L^&vKKfvnmM
zr43!XPJ4Y9v#b96=*`{RoB5Xqms}6t`7F~all}C{UCNSzRV!O#4z0d)Y@P63_d>^)
zU-B&E<mHn&qwY^K6->Ob>D|`t7Yp{K>t9b(^($tHy8Iw?1Lvuo#dV(^{uX~8=HHhz
z$9jIW@2%qV6E|)XHH$e=GnXqt#7{h6X4b(e%}>O+_v~w63SW4!Cw7m$<^O~B_0Lyt
zT^{~w{r_)I&T{+P&;R@7)6>=S_0xWdu3r*2^T4-%d;Qd2P1)YVR<gG2ori-L$B9$7
z_8nVT=6Lbkg;I~d6BGU)T4f|v7<qQ?YYw@uS$nPbR@<Ad_-b8l<@_t8Gt#$5($HyJ
zDUbXO+iNzCY+Uwjt_BNkF3%NSCRQ9#?|$(|Z)|IY(z4SlKDZdLtzqgvbM(O?y$_2F
z`rYpNIa;(nUUTVp`m`mAX7N)QT_iXw_KH4<_~bY-dbjV@yxc#(M0fW!o_nxQwbAmR
zim^fGhXr4zvMT8PSg+sc{w8_xw}p+L3b$2n6T7bC?0xa_M`@41@czhpr>hZbWNwE!
zJ7wlozCZQ;(W>*^jmAb?E!lr|D?H+U<`gkoZOVqAL$^y_9Qhh3G&|?X`=jgny4oeS
zb;<TWo@R69{n3Kg)$J9_?lEpVX@BtGUi&3#{Vd<s%3Qj1>Q(ROy?s+S*z(?+Pu+a?
zMqg5+?ZgKKFZKlNOK>z6mwF~1VZLh%SD4XBhZ4tguDX}kGM-(!^X-y6&F_)?rGf>S
z|7#8z@0VGiSTWV(?-QnDbE^{-7=M3EQ=StutIwWkVeqTOM@}oAGuQ1t+wU0DzRY^@
zx8Sy~&V1Wr6RvbWcwj$WE=={gLPvOh{Jz<i$__mX*15EWODmqaD-@RV;@ZF2o9pMy
zTCp(Y+PpPi3eW5ENZ9N)w{BXfwM=Q}EBP;H_@_0_ySSQFeUi|8n<wk!99FM1Wan@U
zl{Pq$QJ2*6aP!7W<@ar|dp<PZcwF-6{l;^N@BbRuq^*s-d{#WTjQQVbuIA^aS-ZZg
zmdd}}=CHqC&(J&lhe4WkX3_K&H7~S_)V(_A=9{v2N1yHfRmrHv7rjPFBK-KY=xrCC
zZTldR;&@Hp!$(l;bloQ1^Rs5H*?59|3XhoFwI4f=1{JQz<9q#s`TbsV`#D994z~_<
z8UDV*ZaGsvvGV=L?Y#SVlHN^{NEK~7Jg2$;`<2Dp*F2svd9V8(9bbMMGh2mUmh-Oo
z{ap0n3bWRO7xt)Q7;JkUI(`;rU^wByz#xozW>ao*eqI{rXmFeC;wRfC-v6ro;A-f^
z<lrmGx#32ok5_NqQdn}Y{nVt%yC;R3xF)4#6n1brdd+(CmjBfK6Z+oe%nFVZWO~hJ
zd)>WZ%`cE)^6M_I!|ykr9=)mOyO+YLuVQcEUm2MCxo3Ltw=7w8@45mZxwmgO2XDML
z<z`ak#>tBxujha8Ho9!<lQ+847bR%!f4(zfeS*R2iaoD*e*C_laOR}9MDZtHYkjSG
zhYuI&p4xHBW#e{p{i9v37x%1tHOXD@bl8VANrizOUAs=~wY@tnbkCZW6H7BAjup*J
z-~McQ%(c*Iv*Q=N4EuQe)xw_ZXWyT-(iYR1_U4p{s?zz&Maz|^I5nTlo%?j<<!K$0
zmKTazpG{h;P!e5PIDhIQhffy%VIFod4VUMLhHBn97Nb)VtfPJTmsi;Hbo&oY%$BZ_
z3XR^1*RwP|-WJ6cRa{p-+miMp`axmXhs#SDI4{(GQSzDo{mW<feH-Pr7wq2qhV%O-
z%iUb-|9yW{TJr1o_2u^S_Ww@Yb^L*Af(W-#0uRSL+q<rsT8wuVtaB4Pb<|2v_5R{x
zD*a1Smgk?pGUt-{84msFhBevqS$Mac4Cy^8{?YiX!;#cbv$dY*9veAMoWCi0;q&9y
zt>P9~1xTB|+uYJJ`EF6!*X1vIBXl0!p2PmZx-<J^q+(aIMA+0%E&|ai-mJ}%joKFK
zr{a{lRMv6aoBiE>k7fP$S!Ww!?8O_tn||T!xc^X_p*Zcpoi~k1dxb?4er$Nc+MOt>
zaqQ_Lx0_8**Ch%zILz^G^pD*7#38G3zQJQIxyk3=8qb_^a~IPh@i+GO_U)_r|L)WB
z%g#$4E{yqPW1nGt`taT<=LMs#_&gCdZ_t?c(C3Gj{q6<o_gZ9Y*jI?fY~1rO;H3CW
zmX{q9I2GJ&XH2$rE&d~SYx1vo4`+*SV2XNr=C}S2t`kQ~<Ie86aNFqHg9T6ZdAdAp
z)8?_P`m{nTJJ0bK^MrnO-v4*SFQnUk_7jv*uF(8ovd-dj<qnRUF;`r<HeB1okUT3T
z#&4T)SO>GvM!BfsBh4QsZLqofoO8=L7Uz>JS=yPxrCZl&i!?@XehQ1J%PY*VVC(9y
zsc}8aHZx_ao8^sOkK0_`Rq}Rrt&ja{RNpyz%v_Uyed&+h4=NTXoF<tqRk>O7`2O*q
zB3~YbZd9Du#O}4|z>X9n?S@aThc<>gNLkG^o7^nA>NJ!4gU6mTy4mA?W&N~~mzdw2
z67^VBLuJir?t0<KhubAmg&!E+u)QM7^2X2N`#Sp*{pNAjf?t|W>XdG%s$Mq#jlJ=T
z_ix{3&Q|aG`TBT^@Wz_t)6PYQe0Rqkl42`iTa~sXPbAef%ypuEr5*ni+nyfBEt(Ad
zho5Oqa6VBW8-Chg-_##3XWv)tFV4!a@{iiYz-Z$X+W2Wg-u1L6x-(WQ#TD+izOGWB
zwtr?>OO}Z74^x)B1WyAF$xF4Hy5twP)GQ47H1~5-pzgx=+uiTZTXFBjfhC`|Xe>VU
z@`&ZE_p=>8bVRY-<EY-xn7RAfGWqKG`z61b9>1PzEj_3F4WHMXDZ9)1KHFrOhCZ6$
z9XHd}E3VP+<{7g!CsYFV2?{QCkzL0UrN?(IwTz$b%50xwJ9vaIs%sR^=`-3csq7l7
z7Sru^+j<Mr#)5;ZSG;}B?_j7_Amb*?`t4X&wuGQ~DofQaMuR7j->mk2pP2Gu-c;6<
z&pOW~t~nVn%I%9|u9(M`AXxBJfWf+X{j`LL5{pee-6rM@Dv~Q_i2gaaZSz&5Wh-Xx
zInuWKK}HaV@3WgsO&?9(*tj(?Xf5Ci6jl|B&6@ea@X*u~0#4tievv(v<@xeZpvA&V
z4sYh0B^{A>v@<-G{X0(nE)T<z=@G(z)6TrKyYW+z`K;K26Z@ptK1JMfdct&NCVz8y
zaKa_V;1_q4r=0$AWBy`ZpT8$nVm=)=iEfx);&Li-H{0jd=2suj{y1Y&&1U>PDR=*I
z#x4b>l<O8^TyY$W7?(L`DdoJkv+-YX#N?7wn%HCJf<&f|>V`L!T&^2P<oX^~cim&R
zXPx-lHJ3Tu?#pd;J0PKAyxY9Tuz+9ns$hWczTBqIJR&^2hhJ@!a({eNqsHxJW!sZK
z-AkTb{xZGbKabTP%O|4okBxrUTylJKS5>lg{#s|ZoNd)9w|B2hlW8vOem&>=&D%fv
z4wtBg$FW`tmEcP>QeUocVCB>q=?>F0pRKyYm|5^JwC5CiF&}eh>x;ktq=N$Ht|>`d
z$Tx*kT&by_^+=5Ky(RCz&F=}FtFh?3tj-~Z1sl6gHM~mN6_9c?->_z9`<JGm`i>R5
zT&3!ZjBO$%oWJb&sa>xmv2fjaUfXpF$G09iG<B!ZIhFEH-8;+OJeO#gzj1b6(f?#+
zrQ4g{QpNz*%*@Ms7u-0^BHQKmHreZQL70!5hJL@sM71ufsm=R@ZZPXu810j1-Ecl6
zZqJb-&Z&M`o$<!Ax0dl(yLq%{Oj)*7RHZqw*{gZW>~lUkSN@&Z8f7y@Kxd+vM$x3*
z2Bu4Q+}OaPWV69*#@Xn`2X@_#lO49G_+Nb_;@{x=XQI04k$#pf5BdfEr)qC-k38Z0
zDvPnQy{NnS)Gm(bO-?y+A%Sz!yPK9Lf2sZW=;%x>qobao&fB~fHylcoeiO9B>+Pf}
zy(v}<MZ4S>&6L~zU-e;hR$Xl-QL@e{La%%C)SQNuH?|3hp7}aq=?nH}Z+_fXRte;^
z_z;v7$8B=<(;UUWatB;KRtrSVk!FbAX*NybV9G)JM<$cLi@hk`D)N<SZLr(Hm#h4y
zS%^0>xCruv@n72EBb~5+v!TPB2gOqx!<elkt}wB=TFWFAH<Z;Bi3Aj`V~OW7$$q*a
zXsI>hi`6zF8yIG<ezANd+vcS=cw?u#zP-LcF5>dK@YY2KjlxvL1-|9XQ|-#)(yXfE
zE_OI{dV|ltZOZizazD@Ikkf2BU$S+skmlwy9%%{to=q^ickJZdGwjn?-eeeUbS^k!
zooKS;);`|%A12faZ<xG3`s#_~NY^Uf&FAj0pQ%5&PsKx__svpO@zR@oA3tUvcvCK|
z_G0JX&(>u=ZGnw<U!Rbg$j0(z{monNQ$96LUc<h(#-<=B?|9|Q1feUpk9)GkNLSkb
zcwWuisG!2XAiY$7<(^AH(wkK|*z`B<V!ik4`e`%KIoyVSO$&}S8va^4ZGm~A<0W^l
z)qkwJxIWD4bgE2M7kAA%#ME&4%H_B#Uq6;;BxZ{(JN|Z;m5H~;GQqspKYo~*ntpLO
z`Bg;M`ljZr!&;Y;H!kk?l(b*a!nj1>{+vfjX1r4$t9!+K_}E~5e6GnFg+uiWd}$nv
zG7?ft=Dv@uuG+Hh|4se1O%vTX>)U=jW1et8L$9TB(*LDxo=T?IeQLjSdieMjobK?M
zS*US(Rn+O14<9mpSebt?crD*`X#=yP53@GklSvC|x@>Lp@9*~eJPtBS+7*WDiYg{-
zs5Y3QbLdl~$jU>ESN*Sld)B9HyE~x9BH$X!VqTG$74I!Wbvcf&`+eb$PJoTS%c-@C
z)-C+s;LykZdiR3_2L6vPLT5Q`SYuW)O+u>q)52{Nk82!dwh}m5_m=C(lW?PZ%nvkP
zP4@nfvxlQY^Hei~LEk#Y(?+$X0jcRaZxg5f))u;_KQq5auc6_a-O{|6*UfKFtqqx>
zd}M<3flX65H0Dok*uUxpr&phWX#Es<b}_!UKVm)@<V<9Yyx^)`9;Io(S;A<~<|bvy
zsOG@X99wZ}k)Ys-Roy$E`US2RnmSP+;;EF1YlO*!<$M-<cP`tuYil0U?i+8}?02!6
zlt?KktbKc_O@G7Ru=4_s-Z|!9*l7IXhU5~NfciU~#_x_uw&$&~f3?*3)l%cG7!@v;
z&5rU+!b(Z9E11?<Cu}*s=)<DiB`OCv%+;@3GT%1~P&#r;@tOb6(lTd0Hv6eJRZeax
zY*O!ynI@tBJKq0S>HcHSYdjCU{gXI1-B(R^ZDpqD-mh+)%kE!Jn|v)K<K8vVSqJ2Q
zwk=<^t!SF+)vIZ~o%>%czNK$iF2Bz8Tilbq>zr7YZfl-D@7=L`4wEMA^qJ4ikn#6n
zvigUe&4p9W9=_C`z4O4d-4|9FM3>%~Xma;vzyV*6`)n7d>TaD9@X70W^4xul3N}0U
zIiG3WTD2)TE9LY<j&ke3d8XEZI%`ifvRwSNHrZlzYtoKq-yP(xd`<FtGyhA{4c}H-
zW8G_6&7DH)Lu2$B{={$HyG`Zet$jJ{MthV+7b)ro9lCi_H#;f%a=X+Vzpw+@yI!g-
zPZnmMop&YSrJ|8%=c=^JviE&%J8STYdn_|OpHY9~QN-?en*a|5!wa{|!j`%|t=s(W
z+UC7}yn8RFR`jl2Aoy8a_4$^@H;03q>hz0r_)U~-oMqG}cZyBrJzxBBfx7%%ujT8u
zUs&qsD12;T%GA)E6U%?C`&KdEUFt+|rcPR}MgFEv?)g!->`W?`H<ur~swvFy?CZ-r
zFFm@>{%h&qllxUX_mBVUO-DXN@k%63Wc};p5XH;p|8-mUFTTwyYOep0ew(&p;nMYj
zyW1F(AMgk08nzh;G^FP)PTO(yQqi{D;9wt_#c2^{LGvzJK6|k5>$aw_`z>c~T(tMJ
zjXkX!KH*Gup!^~3=JPAfZ!%pv`1(lYtA@+FKg!<Su(B<3*S!<>7s=PI_%%CP-<Y*B
z{G(kskKwtLrv1Gucii>)@kRUi+JgmCs_oY)p34oEZoYJW()9WUhkbfG51r$lla#wT
zxiM7fsi(r454J24XRihXoGjC_elcOjz9su)t1b3TUeP<HyC+g`;pJx{m%n=}UbuX(
zbz{$m-M?kbeGd5^D=yu}S2WeHqM4T^Dd+y}yQ-2$F8w~gra?#l@F#WI_L!p#{^vi=
zy?*#amzImRpzSCBE9WX_oaEqq)0U-tBH_CFifbM1-_D#+e0pkXEq}}g$9BP6lYVY{
z7}V7?`+k)7n&N4PAFZ`2`Jj~TR64a|-YxgQTb?rRp9H3}<|=<p&rFzQCnr}__FZ4X
zsQLKHld^a3_OqY3Qo3;J@`b@$UpLkF`|&1b$V~MQY&YMqQ*gH#V{VzhNo3jW)i?Y)
z?b?<-*l|7IR<xz3L1yJCg*%(XZj>dx*|c!hMy|JUH;<S`@76uU_J6OU)#qQkwbu%y
zES+|f!#R4Tzm6pDuYb=!n}<Jtzi9L4`HQ}bhd+ORKX%)S&<VSDHQSpsu6X}(lZa{p
z^SA6jCzSWDaopskdHIW)eESBL`yaOWzgU(jHfz3t)Y<FH`{O#doLl?x{CV@W#oych
zYubGKxc0f|JNC8fiVV_rT~rZ0zU$G2^8vbHE4F;vce&N<3TKGF)vpaX=X#jAr$6X4
zQM|4?KfT{s`p)k+HGvBrt(<pOQ@`OugV!>xcM&(19-8`Y>b0eN7hhpAPT%vQ$@Ru-
zhQp;smG1LyJLa#b$(Ft5te&DEGHrDT`wNjZj71Muul&KEkm7l3D_gy>*EK;+#`76|
z^Q6Pg9CD&H&+zyzU%J3{@wRqL`5jxEzC6t1dX#;7Bkv)PwX2q`xw4c;XKBg1^p^UX
z`pT~xm+mvF_%9c7p=e&@j*L}nu0@_ZT`x4(@ZQ#r-s0<yj5k&%?|3fs_5VY!n0Xe*
zoB#1<zer;6-mqb^_eTNEENc!v)qgu$O=>vAJwu)P)+gK)Oc35W%jf)WMe*&0>zKFw
z)3n##Xd*eMtL#=bpY7ZI$2dMM6TZN+hR5=H`1MAaGc)gUv$gFE=HvZi=l8B+V$_WK
zxO4ZkejJ`7d&K=yy`s^i_dO?9UR!M!yj!ck@4UNLaPLn}Hv8_$yU#WsVKf(iFuV5F
zuGgIHkLNP7JiEs(@$+J*{2sm^Z(EF)A5?gD{I^~1f-SW-L|q(bcx^YnRe15+M)A3?
z9WAbH%yh9?lG|VMZJJB4m&C357wuiwE=WFkb?=5<TW;jND9$~TKl0{FeRqsVH@5jE
zDt%kvr4q;HZ$6h!q?|X+d8=dYpI{)+vEX2}m+vtHX|t-`i;Y*D+bxu8{`dpukwT`f
z^DYbgonLc{WVbr8hr91CJN(R3Rrc5^rqn+1sD0J*V_z(GpYzg)b+uf9e>B(BM-PNg
zlzS~nn!CKB>C-f0AJf9%x~ZO-@`1N@1{hV{dDY2v>cTFrz#0FJtmm3^uPyKJlojHy
z%yQNTZ4<rb@ld{FL)Yq-zP;yU{&!~HRq)vp_4+%PiP(y@PoK8c=+|j(C^Hj}c%1)s
zzrOl2oupZ3KMGU?&Mcn(tfQUlyntk|*zctkhA}Cx_6Y6OJ#xn2{KsWa?2e0FYH;<h
ztSvFNwfx5s-<QAaxciT%E&D2LkD2I5->;SIj5%|{knzvb3(~O_)7qt3lg}EsJCt`U
zJ9FV<cBGl;yL}T}TB`RJTwebELe8A^FMbG#>2N<>bSLJ+(OK<!^Ui#(Q1o@p%ewno
zJu1mE;_TA$uNxPxyub7N1k;jJHYeN~tKKtMNxQG8Ul<Yl=<;DHms|Vg4DQ97UkI!@
zw0TXpM)caxiXzSL?rSRaBzpcT%HM3Yhu>gJ)X}v^_O(S#owo9@dc~dl=9^1Q>?F?|
zJhSs$*|vq=EXvm>)xMwW;ClX2+}=6s&agj|Qa-ZyX3gb*YquE<1^yV$nRMY+hJium
z`UAFUPJ1jjy|IW|IrHegyQ)hi|J55iEZ8f~pe9~kz35q+s?`V430qHZWh*xhi2t6s
zWbV6<630xZUgKN1jdR%|@9%Q1{H4!Nc`VC|*x~SERrBUrhwWNC=jOgR=D$W-@MM5q
z{2AB(e(T#jzAG!0+V)uqNt(=Ph<$ydY4VZM_nRKv^t`Qa_RK4GYR2k?3Z8pB9OSeO
zk|Iu~ggl*Z6?9|w+Ep7R?Eh|gEcIqf+)Cl?;$Leu6<+T<aqW-k!qj$ejmvNJOWP7J
z$Rz(}w>hh?)tByZnm4vCQ+w~1=ZqQC+&*k|mD)PJ_iN^pN&mWBo=81hXCQ5O_o>%3
z!CS}Fd~-x%vu{S7IC;;W0d<V<JIAq-IeZKZw=^*>*UU{xElbTS16{5u^*8^P$G7r-
zU6E05XJ}h^R!7aX*tlG8VQ$`SmGB*9;Ubm2wk-L7O69CY3h&&nd%sumb~3YPc(({^
z^}RjoEAJoH@>Y6gv06#r=%Iy9$0e21Go_DvzI)~<blT5-zjw;~lSwnvI@Oox+~0LG
z_ElQYl=C|~E`<t&oiB=g;uv9@ySmp=Z<CGZp;xZ^e4Bst?VNPhYOd&~sk?q!@k~<<
z-u_{Q*qcvRH*q-aKfg#}+D_@VDpMh&&feZ@Ds>#2RQg=z)E8|&5ZlJo^0Ogf^7?rm
zffww4+j1tcKWSX*U^QFe+hpETI-itE<(72F|B@~HQ><QeM?q#MThj^i1?789_eiau
zd_cH%TBpGM?<W16f>Twy&A<HEd}A9+&!H#lnB6xd8CQRM{q~6D{@FeC`*zh?tAvSs
zxb*d%>znESwU>l@X;064S7x={e7?H;^7m@*?^{ofR|_^vvYwas<d#@G>wDvQYSI%=
zZsl;U+Wfv`-p1D|;?CP5yJzg&=f8aNUC|Y87rdpo!nvNc866Crw%+x~Czk)l`ke`q
zu1q?YPB)pbuS@#&=Wt3@vF%?AyU&d)jg`z-G(L?yF0Os#SxAeH(fXW-$XS1*^zUAB
z>gTOvaZ6rkvS>lBaO+X_<OvtVjpPeAN!Xuwz$!6E;_jtL#?b8?i8r6ApP#|F`DMpr
zHj&8!h6hyk*qq$9=R3#GgK8(=i3Zx;kWuedvT^;rX-OMTg<Xb-q~K~5VIA#968<MH
zakQ@y*?NAN;~UPh#QC?M?>#R0wOfPrUs6f4;D7d-uMZ+VUDVN@_vD=#-*%m|4Vnhu
z{)-$~ect75<(Z(IIk)Ziu-HkY>-#A!;h(?ryOWbn(y7Qh6B1JvZU|7?y+MDU=Q73@
z8b!r<GFyLi`F%Q3S^Z>Zk;(I-UiI+2gg=f|o%%l>Y4+|>T(oAwf=*wC811xub1UO*
zDkjFudOT&4SC@~AkB#@Ub9y7Z^Y?=^WxhO-og4ozVeA)`nI&+8r%E+IFmY1Xn#!1|
ziU&Kp&V2p!z|o*6^2tn_(Brl|Q~1_KJn1w3?Kb~L%(I(Lm1?f3PfeA(o{Bw@weUaw
z@}`351Qi2OU4|nK_Q^5qf_?WLRsAMeuG|t_c`#JL$LOfksmolYhrJXlx5=7qSzO9?
z<=GbLzs7zFM-`KwtQFwi%arOl+2F&rA9*`{V>L5Fn;R!gOWLqK<H7kB7G9=bR)x3j
zMOA$F3wn|{F?v>GT()@1<B0riwT;KpzUC|tS`x;qrBP~l`haa)f&QQ9uO=rqvCR3O
z<`rM%dor-4&ynYFzg2L-?L)#-&Rw{yv!PRQ&WqFsPb+4ryj>((>YXq_<Up<gcX$21
zUGwhjo45D!H(pJitS+ui&)f_H7B(Jstqr`HkbkXl`!<Vx{~xa3bNt1W+uH3c495fi
z9JsybSvF${pYV3m>k?vryCS2PB{C@eo%>xx*XOj^pU62~93K|QFd0`?@@NX`Wbu~r
zgz&9daxCV&x6zq}53hZZOE?+zDkAs)l2ejBg6FhOwdcBDI%le_5P$Br`=$1&D;J1!
zzb$%{J#VK6lZtH^b7u0Y138`S?v}T9&Z(IdQ_u8x-e>N86)YdVJw9u%{&;5b-(QDW
z4o)|Vc>I0=pL&@xqxID2{M2bGFSxvKcNlSSH>&fu%rWOu`+fIp$u<Y?qJ-7W)oWkP
zG2OKAAs6qlf2Kb_<Ujwby1}fn_$#;3(();HG^W1!*0JV_nXuv%<4&EMoA;{R&6;H;
zB6OqU<MZ90ZS&u>uGpNttaI-n_qtXM1-Hd^DpK1uQV(treei6RRNIFKY#X<3G1PEA
zda`V4PW9o|sSJ&=vjiHYVy*=)TJ-zA&^$TawVlfM;?@QvD4bChO5N@qzHaWWti>97
z{A(hvKj90jaz56ZG$q@*PX5Fl4}n!PzPfUmuIaEf;I!Vmzxh|P=$%m81Ap(%h>Mw)
zaNAG$!a4C@2ZGKRwO<f(f7d%pxNlA3#O0Tl|9VpqdFO*-HS<;dE8k+8*dEEm1<Yk(
zWtwuSL;A_T!Y`NhSv>!Js-n@fdaB6Ae97lC(~?AMY(MaENHTqGf7{e@$o~SP-Ht>>
znGLe5v!r#_8BAg1vKM&BY8ExgkBN)V`(VJ17mU+0YA>4I{glOhsj2JZ`40;NZO(PD
zRm~DU9=qsxLwJzPF|oCioSLtc^td^3Hm(ZmS=Epp`pxC(Bu1XFfVGwhk00<UuNGUD
z|LO8;d#z~UkIG7BjIwj>R~lvMUA-c3vg=Xn!x*#5h{HJt&-5i8zr}HJ{hK2DtxI<O
znRJ->@^#gY*^7Q3FuQtC>Y^iK$*OH{&&6BiO;q=rv14EB{SVv|C5^6rP~Zq#bmMa1
zr>Mk?z}0IvJ(84m=2^C8fA1lMeaoMHdi&JhM=^jmASmTVnaz%!D}EcU_}X$|p~JIN
zGE#3G6g^wc-U@EMC1{pC?ONBXT7{zyTZ$%CSA|$*OqsmkQ&m>N)>XQ(TLRoxJ`Hb8
zK6yVf^{K!@mQ865-*_e;-gC)?UwUiPKbdcv7S%96%xU^G&2-7Ldam0UYeNHq3_Z;@
zoK%=RQFKMsjZ5szI#Zti_lRrg@-{u?zSdE^;w+PZ$H#jYlk!*c?M*vi^YWBPfOM|I
z8$*Wo42^6YM`u_2_~$CW+Pq)KbZyKz{kC02QM>uQbiE!*T-GQL32pe_5}y1h;CZ{S
zT#nkpt*k9(E+VVC``1sZ^3(U$f212+do1m>gV`LPO((vxZhUDplS@B>Rc=mmw``q+
zj<NaeM{~}cwdpWiEw-yy;pM_3j)E5>PakZ#+rZ+IF>Ps*=waL0H71u?e=ztwS!8aX
zUlw^HqHe){nO&)cIxA)#pMG0}rHb8QL4MGTq|A__@{V4e#~)8zzkcieW~;hw_U=3^
z%)XgF-aehhUm<zK@m<S}%AOlt%*I=v@|E1TS;72xUGApe`iAxn%cpL+@-E@^chd)2
zClutKG0u(1J^jNnV{_)W#H2PWrz2wL;|^3hg-%O|H+kf`PwEfv8PTZaR~IgF<mQbu
z6gx0;{TrVhcKa+lc8RVwYgIjcr|yr4lvC)h<NbWS5`WiC{=<7MUxanGh_unFh#Ag*
z?=7ftd30|3M+T`C;{L+Nwq1L|TvQ@t$FbVe&HYwUdz}sAoX!n`U%wdKHhTF*TBF*R
zMP2%t)j5w>vkz81%#Hk#T<RA+-Sb8CjPqW8RqC8)gxaq4eq__NE&6<*dBKL%+e;Dx
z3$~w&)L}WdzwM6*pIO5C+Wn4y4s5(LRbql)8E@`tmCeuh3iq<)a~}O)9%dQtt#<ek
z@0B;Z1D!9oo86y~yr=B3^}#(#i_cc6d(;PQo#pp_3X2MB%N?h#X>DxGDP;kESIbn7
z*?PHsWi&f8Ei0G5-K%uIrAeCPQ=68wmF&tB?Sdz7Id<sGyvFOXcOSH{zitmxZ2Z~u
z$f~8kYth9n$575gZ$A93yK+~v?77L=8|98EZ_3@fa?Y3dHT(NWK2=#@T5<WsRi)sN
zTOL;x)^+IC`lj5ei&5Ub^0nqdhUxphuUIYqc5&6}*tFYn#|ouZ@tJJkdbY){`D+>P
zl3SG?%kHe%uT>%aD)vu)+ubv~OET`RY25Jj=+Sj&ua)1N_p@`ts%^rr_%byYTnd=D
zsPueN_WanSBBg&C_vJWNKkK}8!+lMR{{05lE!$VDWN%|Dz1e>8`nMR))Z<2;hrZ2u
z(EsH~OaFAm(>nsTWEI)IDT|Rwc>Z*1pWM3zP7kz$V;T>7otYpl*tRNDGd*DIlx2#C
zR?b`>9lWyWREp2?RV!0$JJzI$t1WZOjnci)>U#N6|E-pN(=SSAb2IR&%zkC0-B_ou
zz5I*Wds)@aj0J8-LvE_%u*{A+v@PU^<(m~Nk`^i*Rk@sg*Y~^2(M5+ZIG(6!>NKjm
zdgjHsUweYJ_GXr)7(QBEU?#ck>CBh4f_&=n$9-a>9vo@T)VPqyn8#8V>bt(@(lVzq
zgCB~?2Awn26Lhw$3(aUdzc6P>V=tpS$JffJw<71_68>7HSl`&c{^#mTkxSGkr_Jma
zcl|X}sWDkEC@TBd79p|4vzGn$IDhL+*lI5K&yD3p%dSs+JA0uJ<C!CqTr`(_D!Q`$
z(dXFWh<))_f-cuinRi#(Idf0c%S(5|wqLtvT*mG3@W;H%T+d87=3kCquAdp!UEC{@
z60(r>@2kyH!86(;FCV@V%g3GZN^x!0#?ZuU-ZQJewmuB@_i_2KDX-)W+s0VtmCNL(
z`Gr_X7ibBbdXyh?!mVUu=hIZN#OVuEQ-4+Ev!-|2PhP<N<;3#&Rx$!Lzmz_%_*0=+
zF?WyuJE3*^{PsEdZnwCx<V^!lLg*2>qx*LoMDBVRp#Qe4r?i~6`sU`_ny)vBzxnz0
zx%ZFje<zlHZ<}ml!DK({^T8c^1g?q9o+ES2CV0WNqrLfdKKbg&9CeZ9Hh(_-eD&+o
zv(I0;@0^NpSszz-ao3w~d`H(>TJ1h=)jr*6+mq_L-+y%DZG<NKe_Xa_Vf;;<FU_m0
zU(R#<Sfh6R?!1FybMnRKF7l3J(s=&7`y0y>+mz^8CVh%AZYP@;ESLGj^LNWhmbU3L
z*<+^euU_=)%zVy0>k2mOe(MgK@+0Ypxvul#xx0*?7Mlt1STR1~`Jj8_`+eixb&RsV
z0=H+Zc8b3n>l^?7OWmV8e)@A}`%mtdU$3WrS9$Nola8Si4lTRb_|~?4`(0+WRheHp
zxfiB=shPwmom02fUS;uuutde{YacWm59eFHyV>!X;=^~D60IxcewgIGk(?s%<+RjY
z=GmEBCP<itN<E+Sus5%kb;Fd@;yW{ZvmOTp&!2c}^}1s(f9+f!CHz>+@!;bHyN+}S
zn}6N*nO*(d`HtW1Apx19pZDxK-@M?+2XR)OLw?r$E9M5YZZ4g-yr`nAjJ-8rV@r~`
zmG}0aR-NZ<{@PF2B=G4?d-(deeObKReDz-%_V)bBl+{QKndW@&n0%<_RTsuW)?oj<
zm)smjt&9F1k+>86_{l#Fzb~RoC;dvfrDJ;RLI0U5zb%$e{j)EazU<=9lJw0!FTLYy
zztM&Qk^4R0w#R-Ib`@H<{Xefz)XdLQwsI+GPPp-(5w$zJTGCW>o)`mzusZ|Bl9!as
zV$cO;M{Qmf-L{zZ|F6i4l+_+fRiE9MHBUD@Gwsqg>$fvYCT*HK_ui*n79yOU9h#GT
zCrnEXm&=Gxo}aUyS>d4bw(aWCvtMme5&H4ru6RS8-Z^{O|5nxOlV)aGTKlGitz0_k
z>B5R=myc2B?y;=ro7cT~&yA^BTh|?#9lrj*hTgTHKT4(ZI$iFaFwr+N@DDM%RdVd#
z_xgh$%>P?8+t&*$k5mn=h!m@o4AnZ%$2To?pJ3vSHLG_`Nz}N)b}v-v)TTX)6n{N<
zaKJ9+$l2>fp)O0OeJfx0)_iaF{&m5XxBsoso@%!Lm22R$jaSY-(9)W&mCF!T6ue{q
zbwP*V?q^@u1>E#<iHebsnzW+pk;$c~EN_?39qwx`)g;D0EU$}l5oOw@Z+FnYZlmKf
zy{xHfjc4*gW~LuWG=8_F)`XQa#Aw|ipVat82UC8%TJvDP_1+nqUijrDM=DHS{>aBo
zbKPIFXZN)uTTP66KA%-PHEHFKwP7C$macl)Sn=k5SgPl~tBMAe@oi6+X)T?@rMr3;
zN507g<3yY0IoI+dzD=zA=liZL<-!v;`$;M+vMVOm^(H;Ip14^2@5|dpS!$2J|6}-_
zH~HD>l?&X11)nc<QIv`)jajwm(wU0^_q?oEu6e1h@hT{WMg0HAmnt^Dem;4Tzg+&F
ztkC+3x{NKy&RE^ed8HM#<kQ|uSC<>D|777m_hIe9xpz*@P@i);$aUqVV{MC!;#Nyb
z9(yg*6VbhM#}~2k1sCpxRA~QxdaZ6}aBKP1bCb4<O4u<pRen#qx9|hg4<51d{5`gp
z%o^UFxO(?q<Mz3Y+kdkwC0X#;@0V+k{y8E1Q$WsjBj?7+2P0?tyG}gi;Vrn->iG6W
zQKx%X6#Zd2nESxA@cB-IBw;P#|DR5u{CS-JdAhrP;2Qm}QOjPgkzErnr&4q?RB!$l
z&N&N1*FIQV`L#37=g1rXh77gHOEy*ojz8|bIpM5)_3EA5Y9CCMlxKg>$y*=FIPK^i
z?+{M6dDE>`jM!SwJ}6e4zF_f+hJ-)b`JWj0Hf#8Pe#>(pWVaZ*KeLBqSgP*#lS>ai
z&}9;M@YZ;mr)GDIwv*<$&00YT$4lG(IfYL3aoN+iY3h}Ohcg%%XRo+)WMOK^@&hW1
zSM@I_Zt3H!;X2S;U}?a?!J=Rnmh<Ie0?&yxL5CU~=3Hl$nk2>&|08WL=M8H+hULfQ
zAG~FG@j$s^wT|Cwmva_VY8Y?6xPSawFq=wA+;qcNdNu4uGCLMr7Hm^c$Wm<lxRtG_
zF@MSHH}~a^nVwD;U2*@t%LfZ_f!<2RB)&sU91}g$Y*IL{PZa#Z7%5O}b7a9w{mmK7
zVQW_JTlpZmhP|%+SjYQ=-@aN^eQuX8+50i$3|ri+3)yi$eO{=o;NFn<@_Fl-3f_X;
zr-x><Y$$u=UvVQWG~3bnO_o6xcg}<b%U=XOi;LAw|NqR_phJgW+RsKjzm@Hfil9s*
z^Ci)W*jiqp4rKv`(=M5l7+)J`Z8+7S*gd!6`$OYaejlqX%u^Q}l_;ycv*_Ax*Sga=
ztRC}IW;(4CVq|wH{cMu)Oi!^*Q{l$$|5|Z(>i?cU!(9<sFTCby?ji@Ksr;wryk?l(
zmB9E;P&4hFkDA7u-niDj&bDJNji>KLW}n^gXNIEj$>^!e*6<7bk0`w;Dfo?Zmcoq-
zOf|j7S1|-n4rzN*=G5`cZh^xshE*N^TJFnqu?pM{7U)>^ZbF-|#Ny`MkVU7R3v{w(
zX5ExlK5e95$g)bzfXCjh`GwU!0o#_S)E90OS(vA@IB70&`S^a@#d9+x{xz!@PuRZd
zQ@sBSucd~DpGqa$CwvT9yGuE;XX^8fUh->GYt~M*;QGKgTlCp1rXAfH3M{XAqt^GY
z3Ts-r@!o-~HB!q(Uqtc>ILJ(VY;r+#g0)M>2iaox-&|_e=d52WV6QOkoLB#HX;s^b
zh0hu6op|P6mCT6UbIhHO^PZ?mMccoVPgk!F6H{H1ma3+A;JVBW(>0Tr#1HEK{Pui$
zOe(K9V;w_8#pF)qZ~--q*OtZXm%S!Fv;1HjdVN9vgafYDX|1Y43rsdACSHj-(ZFwQ
z*B`=iKrbte?}OBFM~Br8!6~2SUYF!cuxa@C?`{9Xi!0kt@&A~u^0(lDk8Xj+Oa{F_
z?mL!VWa_CG-7;Y}mra|Pv5;txj`CEeqaq!8X{<BstwO?E9GpX6_f@c6QTgihbgS4;
zu{pcqoSEE0PAZz7Kk6?~!N9mv)SB}lo5j|-LRBx!7PX$cEd7OJ>a>@av=TH+8GlZV
zS`i{S`S23%$CpoVrSjzo9$CLwwe4sss~hK%c}*4vwk!LrtGM7NxQp%gRgqtTM-?5}
z{)QN;)IIp`HI@JI?czDx9(Qm>8vpP-B`k2*W!eJgn|@1#GJ+U7of%w214_^AGyKzK
zamb0Eqi))Qe4WP1^T)0oT*<p~Qf*CGzSst?AC^BlCklyQpKxdTiP^bv%T9`YXqaL=
zHQ}(gLRu*EUwe0RhmR+eIGZjlc<B<_y7Q*kAzA(9UY`!$>SEGp@;LU-*Xhp*hK(X=
zikT*fDU1eeIs%`To;_@M?rd19%foXV%rcIPA7$9aJG7n9{vbDD-R97}46nA-7-~(>
z*u1#;;qQr(%Nqh>C#iH4Io|91yF{yDNpH`Esmd+^6M6m|6-$XsI@@4*$j@WdiV1R`
z5|pzW7O!8h#=vyLvr|1Ge8SU?S+YN35#oKI)zYcCf~zu8$ke!xN!@zdMAvNrtqGM3
zQ9O5+Y~c&$KJj~oQo$yxsKBQk=N_|p*%vUfuBZ}OpL;S{Wd7u7ip*=ZGiwDb<hK+a
z>dM)wxpKi2vHu62CkS|NZ7S$|+ohpe&2y{c%bTN{>r3vQztFlfd-q4ayCzzmv#)G>
z$riw}`u|Q=Te%Ou5kEP#94argJpB6Vphk|`&5Fe)6E@rbTC;G;p)D`<bG6(5btQL1
z{d1eu{y9UCJ-^=O7pvTih}M|_H&XU}S<x(J8@a^uJ*TfR>+6L(I5wCT>|Fj~f6|KF
znGM2yp)s*RWvulTEtwlFMBlI<=>F1j*sw^CM^Sc#)6|t(JhdV1aYk<02Ol>Ct`QeV
z-BojV`ZT54QfCUb%(jT+IPfiyLG0I+$ev5#ZeR6JWOf+N;0!(RzjU67%8W(K%YUpn
zzf35{veQO!*PQ#hm8_?>Gq(H6hRgh((WGnt$|0(k=}XP@bJMDlJT*1@*<a0-i);96
zwu$F<{%7?GYvZcYwv=C8#(9&sG;76FLAm+!;#<<??c*xiWuNgSO_Z$v_wn=1i=OFj
zi$7E^`}5=Hm%oMSZpu$TN~WvV+gtCoI2gxwL*TSn^u~kvrF^Vs-nL|2kN#q(=dQ+F
z5P$m-yIR21hZ>z5C)MdqX7Lm130(KN;j)$Uj$|w5<*l;3Q?K65;4qFT{QWtwZr^SJ
ziH7UGn;r6|w=JH3&hFpWCoc{O-n$x?><~GtRKE2&SGi2m>pSx}E(!j#ICAaLafMmG
z_FZgN=`g=C>%!ea*Oi-2#aE@@IU!{DgzrYk@v2Fzy6*(9l|Q{M7rna3TqI8N@S<hf
zuhk>o-uGc^b_h?nQ(pWri=&|>x7+6Z4aa6Dqqdj3UUARZ_43i<pPYP>hqjpfV_9kK
zZh7E?rb^j_gI$+d7M8DCWYJQebA$0X>&D3{NploVsN^Usev`hdcU<u8mH;p7*)L5+
zj)wAO9_aO9ePX=nWm&+i1Dw|{YEE9{x+gmKp<-6c?Z*qgEWOcK+_vJ}2gU!#Hz^3z
zpFjPYV^eBYxr5xM17|)<x#nesys42?&D}g>(G>5}+pDv^DvcLc9NVg?c%FIVHOEcM
zC){z~XnXurana9TS{G(W{?aY?wLP(UmymHM)2Gw!5tHSN6pb_aN}Zlv)~K`NoFU+T
zkbS|M38(p1%&e%r+9vPQ<8$35wR2DIVgK1@9@wwAy>fAbZlsr^_9W?LJCk)~&i%;Q
zc>dEN-|4(BCUh;lahLOt_Kw|Vi<j<H=IV+%6&ezhnV#7cBcd(5owIS}SDo{h?p}#x
zVtioi6?(9wYnIB~6;CH!H%RTA{A+u331boqllzgtD>r=KR~nx`I-TwBu_#6!w!6{Q
z;j)Db*#E~j<_o57SknIE>+{LmkJ~;tAs&^i7q|UW&*!A$wo0448hRs7KIaKCK6m}V
z)<tc5!mm%dGCgMh%PEbkwC^lhIRAxz=FN%w)?Q3$IAfg|=w-?0b8yMgUoUFkyKj;%
zxV~k6%8X<qtu&_X@*l0=>qP3TkNIu1EIaFvUcqLE1x7v#|Ck4FWZ7VoTz7tce0-H`
zwW;C{$BHdWr#5(`8=t@Q=0wM=LuJk8J0|SdD>ila{0GzTzi0k#D(I`L(%RU1V1LeJ
z%MPK<Z&|KX?R!&|cR^8e{onAt6If+TZ=Yq{zW!nKz8_4R4~FRZ8eb|~v3^(aL<^rf
zLDrHzpVdz1gq&6Az9lxRWXaWC+aA2oy4mq&;_VD}=5UjjpVHSHwZ4{WmX`Wz;(?cM
z%T(@U^G5yJmED(X@VmK1`ggs{2H%^vZdhcrCR!!5vq#)p9CEAh?o-C&z9qVehPE+N
zOW4A*bN78zX+C&((oRn!%>)w;mZd%m-!TV<?7W|F>+%|3!EINk{{3bvp}j})i$Qfy
znVNsw&C?o(?`l^6+*}?o-JRDncsft^zT$wu`zbSGHI6KuD0#x*)<22Z-!GpCOuM#(
z;ftF8tB_ZQGx>Bb$llxaclixDf9}la1@p@m?_YRsN8?*wp;_}%WD_QD)JdPeJ^#XT
z`8#fE=j9*oTyVtg#tuDGwpMNN>RY{Y`D@kL|Ihor#&|~jD-B-boxY)Jrq6R4^@2h#
zGOK4FPTJtuyUHVOUAkL~{^A49`uy?bb63W>uQ$wz^f|lXdVBbu4g962L-x$$S;Y83
zjGJeM#FV)cr?2<ndd_h~i7B!AS#QblJI}6Nvd-t&ZLaO;m~dEj<AiR0ua!P!y}xBW
z51F>!ZIfQ9=;j?YbDIW}_WQl>1J}&oyWZJ{y{=Av+x@iv9~KsTY>=0{)paoEl0@w6
zRc9hueNH8^TSeZsza9LlqQB0e?DWTrZGu@=nzubpD=oMa{k_?+heP*<dlZ9DcKxU1
zyOxjc7rZi<XK}#o(a9A?tIE``Dki6VtJ`Mvd6}N=-l*CwfoIcMJf~{N*)U2d8fA!X
zdw=t8AopaxwAj)V>4gc>y|12a{K>W@DBEMckMPpV)_>!8&gI9t)xLMTk|4u(_Q5=n
z#hPzT+ePAc-wn61xlnyBH=>+%`VIvxE}vc16}uz9dmNDsufDyc{D8S{|NQV|+y4K%
zvnux%b*JX-+qQe}679YnE1SRl)2R9V&-Ux-J<8iJ^zGDqlxY(e+4!L1^ptH$7v^5y
zvHZusx9#Qg@9(pAOrPf*q7$mb+FYWYwMBkS)SC0#1xgi@#pf<K!F_+T!@-q73!lGw
z&K&sb67wg+Q}cVT9NBd*hk-F?+X1W3e*I@X3LYBz^S8<`H#(&@FZaM9ru!F8|FaL(
z>Ni<zJ@Ia_RP8JgKFftaJ*3<Z#HVyt9|+W%#hmK5q&WE1yp59%^A=xzk(K74V7l({
z%ilUB9NedWik*2ow=wDA!wI){hiw!u&v$csaPwl?i7cLDry2{FcinH-mJ^$6QP!C5
zW_fYO->!6(RL*xDQeiQ+h1-RE&dSL#ObdQoID7i_ci(<}E~_s0+VrTH=d7Zput?Fn
z<h+8-(w{f<^gCP;UH{};)b-HN7l)_oi<cif)>XCavG0WGtEb=C$Mey_V^2_h*vUWb
z=JtO!&VB8`d2RLSjI#2tOp~3gI9J>%7X0vuwW=jsllxDiO#KwLtGWrhV^>%7R<GyV
z!z!B*aZU4FbI9*m9HyQ#zUr;bx^<@W(ex#;`Rq5;PGw23NQl;`Fl^r(>NfjJMNgN%
zxm8l&RL+*ol3@%shZ$E~bz2%}c~2~7w&AtFoqtyv&NsDQ9-ezSYs=^Ne?F(}|8{V}
zt-U!*81j4l;%!x5Jx-LiySK~!%k0nhUfxxEb#=`I&PT!Tq&CJrsyxOjAHRq7xMx0(
z(=!K^eXFMNr&%v!d>YR1u<U2Wgy&1G_g$DHQ$IzkfZKV|1I5cJF`dp=9?cfmTEP^U
z_Es-+_42^2Oy(vk-1CiMSMOW%ZXai4xxYg8)ybkiu3I@<Z}%?e+-ID=|JcdDW!KtY
z`>egaziJMT@u!U{8+RASpLF^?H(O_J3zIZItL(}pCi~xRzwB4@`|=#-9Qg~r(zlMu
zsA)X7Gwbo{zrJmJT3hzp&(;-a)R`&lliv~4&3oYeyRc7vNt-iIUEf%AFIea5A~p6L
zzx2zUjx#Hm+4kLQ&+%3%&(e{q-eA#mBz~#cs=92Ej>w94GMCS)CnQ$}rLS7_`Bl`D
zo9~b2Y_8ULzkK`jdmm5!Jo@pa<kG)u57|sKGG6E}lYVW>0XZxG%18DG%RWDzYPr)t
z%y;IFnfGLpW_4{y_gZW|qbK#ES?f##gDIKcUkIBeT=88leJf((UDN#xl1ft-i`=u`
zaqDjJw#5_u+9JElzLuCiE=-%0`bW9=#{pyi%+$XpRJ4=lxviBg*;3b>k^OSr>6s;`
z=EU_ctvI#K<6_}I>6lY?#a9aM?R3j1xqU>|ZR1NNi#zkS)s)@jd)M99%N$~3eIxgj
zB}=uw&E<3E$5#}X@8wQ9B)wAh#xYZ-FYh99_D}LG`}1bc@*T2|-&UpM)Lr&<%I6W-
zW41JFkLLz$-#MSx>b-BgvAu;kyX;xdseJ)o12hUmkMOz+zs?u<Gr#R$(#iD56Q|C$
z&iiKbTx?Q*_3kFq#d*tfLiSflZ77d<yh&c}*@}M}-}s~LEq@=oz4i9Tx!s<NA7#%y
zzu@?R>#H2%s`VJ7QeVY6nTE6X)@|;MZTQW8|JBXaOAr3EYRY%tFY~$0CU3(G@0c$K
zHR9qVwKJD}^tSPFZJFWMdjFM!vC#SCEzFt0n{78=?K__DC@*K)Kg)XOzVsr|{7Z8A
z#xl>C>-LCW(mBh{@+~1V@7#jRn&vt@=PV9u@xOg)^uO`&>c@+;mae<JN_W?V^IESg
zBqyDzb>4m0`0Fmdu$z3L@56HS`L`Y4IPKp4Wa&7Y-Qn@`Ki-RWyZ-${j;*=yPJjJ(
z)eQUD=63W%+>Qx1P3w6VFp<5)XQ%CqZ;J2lmL1t7t^eL!oJpG5;fHV4AC2hQAH2=7
z%M>%0U)@wV+vkXP^(k>>S&!3))obJhpWMHro~6fssgr$aB&Y1Q=@Tz)Dp#G`bGK^Q
z@3PQ4@m@tIe<wzLnj63C!{L|t=T}DBJt#~)rgL`jk)=(K7qIAii(i(NK6=e?#^XbK
z>*Y;O@hZIFQ<c4|D%rjuYTZ@=oBSl7>pTCv+kSdx`P(+%a?^dRVz*o_Nxe&uk(b?e
zI6&s1hm(=T+}x*W<$GqGlR9MXdt%vDv%|lO-zHyPXK8S+Irn;sV88U1$cuZQSc!kH
zd9YpHAUgRN%L$KjIkIhw+beFjC+B2nUvj-5Yk4Et&3(g-`hXq1bBllN=bE5r!v9yV
z;FhD*J5}ie(?8S}9NN}@e@pDeo5e3So~{ziFYB>roozGmvrfCi?1k^56OU^?eIowA
zT+eWgnasPpsU>ejmNB$FyRq^lU&#M!uGi<jOP#wi-tB#$wBqe+IlEqeJ+*S@r7bGe
z)_3PVT6T2S_g=Rksb-Gnu4kJ{A_Suk%?f8;v~lXoZ;stD{Z~VdG5y@}Qzrbo^zJPG
zgsq|iSqpc!8<bX>iT3WDFx!aN^|Muhx!;<tzO$^S*+jj(cX3kQ*LL-#@jK_;l8Ttt
z9%5eZ#~pmnV-Mqm+~8>oES4&-<vID|#D8~|e2wp>*HYWQ#^$O?e?KHYOYNu12H&U^
z+Y4Xav6at@yp_hvdq`O4t$?)F<7V{X>^F5>>phql7+$e3Fo-iSFyy8d=jSDrX6B^m
zgPAFbC5d_km8HQ4^KKjP?ES6H@gzao<IXzk9F7Z&uCsHG-cmYHbi;tBDe1CdV6>6S
zF7JPJQ-sw^r@u_#7WwJ2@4HFk`_sGSH?yC*STX0Wc*YDbC-e5%Vb4X+t=n`ugK7J=
zyOy^?c*3WLzfTBNv{|&BjjQJ1t!=$m7#HU)T2Zo%ap|c(>vk_j)3v2Mw<J!_Iw>XZ
zdQox5|EpWh%~?>Y=e~b^zG=9ST-S7_ty|`8^X~LltYPQ4w>8CVf$bWWZ7reOe(j7|
zaeICD?fmcl@y`TLyfQR4(SNe$WwmXHzTZNPQ`v8A?_^$^zw%gZYU5HK=eCHIN0MXx
ze&2ic;O0_;-z@&uWP%QJNk)1!ye_=#$+7IB;OBm2w^ZLg<tr1a*utI(efu?sXZw?z
z>MvhzIX-3G({sixr~Jgb3Qu$TJP^<ADdos0ismTX-)Qko!D~}SmI`;4(Tn9DUKmv<
zJY+q$MkTN5&+EQdN^RYj?|dqBN}H9r{+2<_BroRNwW$|=D9v-4bM)mGooAefU$C8j
z&XXH|Tz2~A{z9u$ue!gV`SzJDXjyvJy%h(-w)VxD@JDq7J`>pg$?Z<I&=Jdx=km;_
zB_#Z@H=6QD)Bcfet?wNUuP<u;$2Rk^Ng8}RR<Hc$Us`4Mvl|CK%51mX#$$e_@0#r6
zLzb_PJr&j{jqUz%u532f4X53Yz21DV`^~U3cZq4#b&cCh_Y2<Emh{}{3zaaqVYeez
z;!Mpuljl>lPPBSHUU2M&w&U}91wOu0v(hzvs<vzYuGw28yX<lKw^zKpN0;|7s~>j!
zB91zjQqdP}slv#>pvr`K1R5wE=42-66;$T-+vXiM;At(N+vL&4;F@c3PE5i10^iGk
z1rF9FqB&M-T9cbr+&DY2s(0R+qNpe9FCK8bU)|pyTv1zDb6zI&M3>~%6BDHlZD`rL
zJ+wP=rg$0`|D*4X+j3hr&6pk;Ii<KFTX0@r>%wDlbARZ~R9y5{kLP~8!72CiO!F)j
zc^g!4noZi^8MVLsNFnDhN4xA33k@fqOldxs+>mzssz%6$80V*Jw6f;yFubyK3df>j
zCXQAo$|ufwHkGBtzO3A_%JrT9i>9|Ts(7;QO3pvT7JRLs$GI!_)fBdhz+W=|W&6tI
z`!4=wmg>ls{37pDDRkhFm?U%Pfk~bFgCw&qIa=Q4OWfLYGx2Orro!IOyN-X|A9^wN
zr^P*krAghN?kuTLzIpS8#|yt*@~GiDG5U_c2_Xgse@pC{IyW&hPp_bIt95q%ZI4O!
z|7uHpWL&aI=&i-fHwP@<9xR+AdH*Q?4Zcm>>klqGG3`q7zG=Qu*Vul(j}HBtFnNmT
z*`)I`I*+_dD=po-de@fodF$=}m41pmVl%y_Xx@iCV#NnnCzl1eeVpXq*K~MqZCTWm
z*Iqi)Os%bIicKu7Y^n~wn>Hu5Ao7XMLw_6HQ#^5Lrv01t?yU?>(cyXSdpE>}XXc4h
zi&jNWdG0EEb<v5Zat?o^Li%-9b*cH!&@no9YDL_#q+@Ako!A@~JY;$HHQ@aFm+3pF
zRez|TAnG}}sPg^G%J+@Fw~ubPcsIzyOk6YlgXB{lfwkAx=&&f*=xd2B)$H!p>Hg%>
zH}k~fEuJp>5{%ZlM4oP#ds!g;>m+82$Z(}~k!nQ~O(nIje-&D>V535V>iP%F501_W
zwP8{^c_1P71Vf;4f2!2g9oKAD^FN;wxK(4ZSJCH~_1;HxC%ri*uwtdFR`ZS(I}}9?
zpS`hsrW#beW}dwXxAhg}+-YLnd-t}Smt4PUQ52JEP~6WyGb|lUI{PLvD4YG{4p?P(
zFZn}y!0JUa&M*2A$a}8wj?#3~Ne7=lmJ3q;s`c;TJ4SP1JNcWEGZgmuUX|LJ^J+=N
z)4JVEWrp1iI~C&JY&ucNefv=R|G(k&=lyT&VJtf=-0dimCL__tByn~9v8;z{JcQ#9
z%k)|`JW^WkSh3`wy4XXRu=X8S_86rVzyEUQljxSk&kD~9FNoKA<i72RsJi0MWvYrZ
zTqivbOjGRHce|HqeK*6LYd)p@9rdZKJRi^2w7YB&JwM+i^vS`d>-)+J%c@Hy>vrw3
zwB@#+Gw0v^yJt_noN4~*&>AI0%g1GF9xXU$S?$bhGnH?u<4ntrB{>e=j&9d9mM-8v
zx@Rh<KuWT~gE>lSy7GtjE7Z2GkquCIx3y!o$*N1HE3{XLbJ=*v*G;(7B)90p$5kwI
zDvnNCc4+5)m4t|YVip_nF0K<`;G8p~`P4O;g<&?|v&8>%?tT`kwuFV###vS&dg8i8
zrZo(i-I1q^Z%p}?r;@XZvny>q^YW~sT%k!#-Z$9Xubi}1IH}dXSVciC!BjBnqRup*
zhDYA)T*;ji6l4;bgw3KiFIp+k^?!c)s;B-AkA$0~4(Yu!i+X#r<djXd*?RWS&SMj0
zpS*PVyFRaT-D2KdH(%{D<^Q)@f2Wai=f(|E4h!B`{%MctOgrEg^4o)3yyNPOy;2(O
zpTBdZ@|DQXxLdGI=<B4l6Ax^5The*@+JjL4|6dI&8N!V8=NxX*W4Ipm`j+Lwn1;O{
z*p6>(|Mp9Z@81dbKDW|X#fOUwZ*G~G{b0&{r^-FwFQio@KU=Ewyt48BBc)b-{>2M>
z9fGY2*z6W?e3H=ke3Y4$W53`6K^fk!KWB8h^7$=e-jdB;x8rPv^k><_`K(-j-lhf~
zzPDO+h4+*R$!zm)C^R3ao1*z6e1q*uodU6|!f%`%v$!U4Up_LS_VJmCDgRw(6;&5k
zO>ikKQJ8MytNu2ra)bEtgfj|n6i@!=d9uSzJZ5F{qS-voCaQ@qyyu-eDOq;+oSk-&
zfX`!z=`sa61~L(a2HdCECC~R2$rNv}`FUvH{o?ZpSDrtZcR=GxGMCL2c8%~^m$vU>
zs!L7z|6ud89qS&g<~kGGDtwm5?5C`Z-~^rQ53U>1729|`nhf7fn0n+N&*7baIQIo`
z1b+|MloB%I;HkwvCw-45a^Knc{n)B5ugx<1ue(m%_RY1u$h#*oYIAc4FT+=zm`;{2
z#jC;>EaWbXc@ik)_0j)be}Knqo#}U{i+*|`vrMOVQ>2qyO<~STxj&~af0`Wm^s&ku
z%PKxcsZ$$tmN-PtSmgaSx%fbzTe92z<$HGqzUNU}W0O{X(7i+Iy<(Zvc8fU~j$w~l
z3tw-4AIso9(IG@`SAku#h=NQ^-Tw=*ehDAX=;t^-pHn4Sx!7=X2$$!h<*}D~cWnsl
z;NUoBe=d*lMeGf~Ut3oM+kM^g&Etj|<H{LTzj*Fd%r30^$=@*Hjbiwo&z3WsUe7vU
zaB9-=8M{<ocsn{TR%6v<b#|~y4BPclWG+MC_2PZ*-nNU~O`b<c*>dR>oM!Z>IB@Ra
z$Im+>9R4{k^T@t`?QQbsHuEqk`vVPZ<!%gr&K`PqhHH^bL9#SgMuJUl2HWn-57zDe
zf2cUl)%2PDEvN90K{g-X{?4BKZ0oh$hE~b@q7#d^)}`xB&~?pRWt$vn{-9y;?&Ji8
zcO4BEqPrFOGYZl<8}0~O2yC3QzU-FN+U?8#9#6=Yx>NdEnxpa~>&{a967~)AKXU!m
zefwkG?mE}-=KP%d*FLtzUAN>by*Kl=Xm__pzr)8nvD*?C-!(}{`ZJ}=bj|;FN>5k6
zEIfa<H>!TW^&(fLXW8M#K7B2LFUx{mFE(9g<CD&rDs^9UCcjAS`&CP|JU-^^Ffs|t
z`q6)4^~a48O0Q;xnV-GgHL<saLG$<C{xIv0>~~HGw{vLbt>WU&;j?;iS4pfnw{gp+
zq{@)y+ND<4`Jeb6&zvW``Kw^AdYS7NKC$FaNh+P2G*>dH`syh7-|m_=DdqgJxy*g9
z5|6MSs%5lu^;7(LGV6V!I!ox9;~HNQg@pE1IIO8HW71@a^48|QxTazeS5wLiF~zgN
zADXq!GdMc_Nc%eN@<XHiJAMLD=U!$o^(|BTl5H*fTIzCHs~h7=<yo@A8I}iM*!`Z$
z<XOETmnms-4SS;X4#C%D-}o2gIbXT0fBm|7`u6R&j~srYBRqL?#cZLOjTd;r-)Nkd
zp0N4k{BDUPtF(xHi+8=4QEI^P+*dC7OdXdZ$D_jf|3PooPx>S7BAK~|^@?ha{%MW2
z>l^jh{?96wSTbebm(A><VG=6qt4z}be@V{}SHFBCeg3)sRfT0|{8lbHKTU8&hgZmq
zv&?s5Dk85hwXw5UaA=><lm#oq*h3mEt$zKydp_^r$p?L+%NeD2ZEY*s?$ciR#{bCT
zyT)?bt$SH?I!;YuzAqTHyDEZJ)3@)6nw!d;SG(6wI5^qwY+>~3W%lLnWg5kGH_uID
zOwn6-va?3nJNWa`*iKhfM_1J&?-@JNSkgVjohMW`P6{d8n%ung!mOmG+2T94IZDk{
zxy<l+uP4th`J-BrQ%p6=Bf@#N?^LVr3X1V#F8T0sImZl>UyL_6EuwW8tuNdb{F|GV
z^*d^cv+cY7I)>P%>l4qv%!%e=mRR)c$IV$wW^eAE{P}c$x_O`Pt&CRFv!$<|3*43J
zd1uRKSkBuNr91E4eHrECue%$Y1D3O`UCz6AchjNym2bW)T;M$}cJ!jCqLp{}t82gZ
zu^2gYbo@EIai=%8P~b(@Q_I#?iN>&a>v6~5`EqE6N9TiOaS~}0PaM7=EuzN1`_sMB
z=l>%Ex2Fp0vfcZC;Ce-5hlCI7F{L_p`DXWh(-gXFZx%f6s(06siJM)0K-X;H_Aid{
zdJ01S%%1HIUD~^z=VbqNrB^l{bNkwF7j&)han*S>A<ME&PSL_}ftrW)O^)M*bI&Wf
ztWmjpXx69dBXY&1-HVlEi{HCWcUr9xo~pj*^TCuhvm%9APE%x+60Yq{*!szJT9fU*
z?`qy_KKQGN1lsNRqxhtO?Zw)UpZ|SmJa%ASxw)jqov>MV8e`w?aj5oT6b;o^Hg8OO
z_%tEdmBWEA@FMGsbwNp*?e3h%*7An!?@Z|4GQ(Aqd2hk_v~$eqHzUN}#$J9Ut^GOb
zy76qG%<z=n6?s-#jf~Yh&fYIyuxh#Z1gE+AomW?XN#4=4{l6{GnTiARy`T7HXBRlG
zmXG>)K{;FZ5Wmsws;A3V+fI1%aBXFGf&c7SxB84tlWr`lU9jsOo1SPW(~}ifm-1Y@
z_p`;mTS{cfDbdx6;?ae>MD?Z%Zrq=7XLiWVDK0`hUR_sWX0xuCymcQ#&n2!W?x6+=
zoM{Vw>CThrIc722y5ME%p5NyckFVdr%%IHP=6;krIz)1hex9kwV_ON1t@*wRi=P^9
z-MGc;)A!yb%vLp<LsOS$Byr_#yZ3YMHh2Ez8~I%A^l#J~|9?B<@6E)h*tO>O_DG4%
zoN=zg?D&mKrqR{zow6!5%4_ntJKp{-IOMXY*0Z|fLG61pZ=*dbOK#ii^4o<a6eTlT
znO3`eF&8~1z5mmP+1b{67@wS*zdSz7Ayz=a;iiwytVI*M{?6KL!}%ePWz*3u@}{pQ
z{|iuwvsgRp%ijH>yq^1vs;|Ft`jPu#-r8wOaY||F;q#fxqLZ~*)-3RTwfyjdzkv*i
z=f5#mzmls_y(D7stKaQ_U0J(*@Y0U;6<go7{7su}EA0Bh;^Z;GR~Jv#%{3_O*1nf6
z9=P&)P+VJ^lWD+8_bZhLB8pPgeUx3>WCd9q-%oa(kzV^*;lh``nO@(VYHmz%i_YDw
z{kHV*va6gDKhx~Q&+m|vo4{U`@c5VO-x(r?dSUl3I4aLHUmGj7HE#93-00|!tmhM5
z|8%^5sky|x!ZB7%>y)7M1;)rr0nr_Yl~2n}-E(QTZ1bW>gWTO0n7-<U81GvoJ@wle
z--3pnTbmmvspRJBW&GK+!ai~G)K{xt-kK}FjbYEthUN2ucC(2vZY#R(y5Ms0w!(au
zQ}e5Ly=2$f=Dg&+PobOeyBnS?WsY;CUKMrvP7u0rhoQ-EpTc1^@f)m9zE5H>(0##j
z<q^Y;xD|Em27VGJb7ycLxZgNa?x4jDu1=>{)$#A_eD55Se{Q=W_}Q$B%NIL4F>-_*
zWqKnwy)eWn?^gDY9moBqaK`c$a7=g+5fK#NmD0nw%xi|j*1wH!cYeF6yL{G4z5P;`
z*DYe$5@O7?Kv>vnwi$C#H|u3x)955sX@$K#Gqxp9SlPwGCoMKLB0%0zTDJ6-q-^AM
zzr%Bn&KBF1l@%<=k?hpYTiAG3@&ixS3j^ld*{>W#JvvNee+14dm9%QOD7@9LW8Lvv
zA!+k3b^T7i^;5EZ=>j3Ms&^h|pDZ>HQhZkz^`u)ie%6fX8h*-Fj=P%lBe+;U3Pn8N
ze<@k>qv+qycYlojRMZK_#onJAAA7IQ{KDOJ)_ZqZ8gt7QDeRiD(ARu#_NM5d7aQ~@
z+}-DD@<Qy>6QPRL4rdz`?(cfN&p-OQHrpRJre0n>Wud#h+Gpf!>lRH)>UhJy!{&Qk
z;7ZxnKWq9$qP9x1tWDTyk|OF?cX>q({|(c!c}-?X|C_%)t8-_xdM9O_`0Li4vfulz
zR8{<bef9c>$2Y&8z4?-J<B6?~zjH!E`gh%xPEE}Y{PA}8clY;qw#?nt9<oNmdKF7s
zm)11-+Y)b9N13N>f4!$~-rL9OuiUryU)So8-uL4|YR^rv-;W)ZoL&5W;@=}lJQ0&!
z1J^EZI2}>Fbme0$+4UclbW$^IC)G*n{`eC5;a1f{&!bmcr}D(@ztk7KyUTCihv}NC
zJo$W6zvMo<bawjb)1ObrI|VF%J$v<kTkE~t@6YAE|95}pR%^-gTk<#0x#e}K_Hw{a
zvx?7bmwj_?yj?Q0=~<nW@t1CUWs|(Qee3vk+a6xFw?wY-iwDOI!-QjHEbmko-1FDc
z;JuOlAY}K82-Rt6$vK`)y4RAYFPpRX7}Le<y8<48GNIiJ6Ep0V+Z6^}+cI&=R-=+@
zk}qnQ`V5^Gy|lhJ`SoYM)lwe)wF_@4Yo24Az&3G`xayITD|RpE?0+OV=SbX+<nqrQ
zyEJ4Es8t6<dR_T{wAu5gBCGNxWj3vP#|3HsMI+P?bgSzfH{kKnaGjqxLH`+hMBu^b
zn?^s%OI&5&F!3*Yp%M8(Dn-tun(xt3VPU<!Rgq`5#JzoOmsAm*wE6FxLqb=~xE5?E
zVwlNMqy6w<H`n817X9{ofee?F`d)nJ*l|hk=iZ4SXF7H=wq6zNVm}!AYTdJ4LNQqe
z24^>`9Tk(C7d+b{;McD=v;Ka0H^HK3|9r<?Yd5@D^x|7{#$}m{D?T&r2{Jx>=$zx~
z=vS+Qaw|W4`|F<{+nii~qv7v^k5wCmc5c6U>(0No-`>4pIxQm*_{!;tE$`(UhmSej
zQ8v=xtmY0>JKxikvf+25nC%b#hcX-2E49mn{_jgzyE*F$OPS)Q_<j2>?0xvIeC@5v
zC0ZSKoBfqGv1l#+A*kZRw&S<pOq)MDk1_reOEit#TW@|b{ORnd=^s6>zqeZV?ca}s
z29LyUi!GiKxU)4Yq4?`*wusx){2k|PD4cUB{>|0rUz}A1c9<?XrjQ~PaW0f$?}2a6
zyHt)%`^L*1Ja2V?_}rs{hUcz?O<Xv+^XA>xSN?^vhOAvEGG*59J#}CIJ-u){_B!|D
z-Ks@@q(gSf?An$)<Dcz<*H4VM3Dwq@{JC(qu>H~W&93_ymU&m)*3<hkTRKZ+R#7th
z=Do2UTXlVJ7H^X=S?R3TapdCFxSp>98}6?^FlWX6Z3!t8S3TNu_SA<gp3UpLC;pcU
zTq$B?pS9*_K*J6Du)DR%$6nt!HSOnFrWITQygUB*_g!DM>cEpN;vReUZ=PQ6<YxSG
z^^57pdADX;>}Tkf(y0qb-Mcv@{{%<+T1LJFFBhG^mnCOcvci2U^YdfHIgJc&S-$-Y
zz9ul~!R^-$TbJ_Q5Uq8u{?CLu_;pNnK7*J%1H--fnEQ>>@{4j4K})pn+GZEu_9(jl
zReM8G5JPU)HnZthT(|CtT`zALz9;Vbt?KC_OH&=61RRoNsbJ8EeEwtq^4-t>GC6ve
zT}#}lBQ)dXyO%FtzI^v`=FaJRD*t}j-xnvw9k%t&i=&f5V>fC=6i>3b_oUmq?91CH
z7Z2`z;<<NcW>@!Vy`SGMZm;*a7q{t&`n7AJn^MBptTE4CF}*}5US4L+tg5+Zp0Cc`
zo_nKap2%z8yCt4+p{3KyU1PVhvp<SF{AByPwBQhN&wFb5mJP14YrDFA?`>H#QDNSN
z&DX!=%=r_tMfXbOVKI&`=XK&YJ&U}2<pWpu0qtL^2XpgOW~e4h|2cbK=d)h?l*-$i
z!bB(ZALHDxD5lH)gK_@!ql+Gknpc)biap<SDf@?J^yPb7n)ro(R-K)#G;iI+a<|k+
zPd9((-ga<Xhg0QkU$fHNxwEPcM!DX7yp7pShg;{T(9V3Z{H|4(d48+zuRA+mB6VHY
zwij8U&wg&xVSEz*BRH@xG~6{f{L1P@cYbcunEp95aFbTN@ry&DpUOUc+aGT~+y3Y0
z&FcSuKDt^zM@Hqt#JhJtoLijEGNt_EoW1WIt_1L;T%67-Fk?D9JNuC@Pc);S-ri(f
zZEalN<HyJGYSLPVb6u-mJo~&R^=TGQ|EZ+j2e*Wm<n7kHx#q2dlG@~xkw(6oN@n#<
z{-Pq=Yq9l5=62}=2D3CGq)vs@%c>ta;Tt<iz(4+~sC1^2)P(&%Ck5+uOx$CocvC{v
zz20lXBsU(N7Q=<7d~f_-^!C;n1zvmKxGiTUPRN;B)R!Z@s4YQ7US&zYOy1tL(_VTo
zzMds5y(!1y(!7(q9=C*cS8>Lg`fk7b>P0^ri`$RK%I6vRV-#)_zhKhfcR6o&!TI3w
z%F~K9Hr8t|J!wp134P@dWYjO#{8W4m^MR(DOjkUe?*8q&+mXL|kIwneN3Ex{&+ja+
z>{M#J<Ph6&_tBn9XLp=Bt;-#{G>w6A<^gXF(`_sN7#Ug5cHUg!($66Gcdo*Gv&gC$
zeMhbz{u1DvA(3&VOT6`9lTO6*yN`<cW@%i$<o32LU19AU`76gh@6xk;XW}cp?M74A
zo}`nmk@JfU6!d)$O<Tdb<I_}|+=Wc?x2{gw%bp~EaedbAdFGX+2Q${}Ww|)_q$0a=
zYujnbO<85jcJpkQ_PH(hRL#LnUpY-OKM6ll<7x~#JBRB_^4=5PeP0fwBv(~gHP&nH
z@w&G8vGMH1b55{desZHK=GyhgPlVD87I0|$-tvtsnb~5xiR<+;-%n@TLQm^7UrS*~
zc6obB;6g@9xX|6rUYp;?*Ru=Q38>2dFZuHK&BcrR=i5pwt&*9#R+)X#r`so)LQ33h
zJwm+VmL^|`{=fK1e2M-Cp<BvzFAfRoteKrE$~JBL?ayl%jrRY3_NAocm#x?_sa-cT
zJm0C_PoD2n#xP^<ym|NRrRUx|zwiIEFaJ0kQ#aq2n|Cps{Xs2@#y!3Tum8QQWisbH
z^yq+Ev%=YZjZOE@*IC=LdYxy8Xm*(=H=mW^{Jw*ZC2bed_g}ou$YGc9L!NPo=2N*Q
zetG^DnbUdMyZ5}j^_q#T@Rxz<mi?_Je|bZf)IFKRDm4FJ@TsNAx*aK%n|GWkQM6U>
zRS|r>Bx7!-=ZQz3WtL1i?0h!hLBV3ji4zl~OR9vqS7<C?U_Vv0%_~#K#^T?Mc{iEe
zeCn$<obB3tbMfXU)<Nw*j@LcyE9nn2-Sflbt9Zzi#>$iV^JQvzHLuA}`K!(|DSe5^
z&lc?*{uD=6;fV6!Tc4W^($X@ypBXzdzWelfiio1*#F;aGpQvkaJhw~cqObiDgV_#O
zzo?}Ae-QGyFeOp%U!t;GX?3*<gX;svP0z0%-L(79nh1yO=U!jkqqB-b`n2e$f{P#i
zKfErxsi?5ie-}rR!J1XcE~j<*e?EP&C+@WT@&9G#zI>l_SGCaK|N7^$67{N4XRl9p
z5bvDgs_XZvyg}&ThCM+-Z2i^-Ul|YYNxB~Qyhd!z>p!-g2W3RAv?`b8tM3o{;9Ksu
zm&x&h+OfBmauQ$9zfSX=by@1i_ZIQ4Z*kmtsy|9&3;B+jzj~jtm-T&ac=j5@B_@+y
z_g3w?zd)+`m*5&(MhUHd9|Ko3tPMYx@AT|l?By;tKl`<sf8Q;f&UV-)f7YL6?iTO+
zQWV!(pIGL(wEb22^#>B$i)REh{xH3wS=O_zfH{DV@k&kXzx$@FYV2n5S5&QH<9YwD
zuIgKt-8p6b^`A9c*S6gM5o+SNV!?55xqpn>nG3gG+`u{2e`!(F(|YX-iQ(7Ye06Q#
z<zVk%X((Z_=k<g1-@7k{?5$cA(Y$=;E<s0u7m}|!zLl#KW_<r<RIgwCpxo^*gY`G>
za|i1=CV8E2*>mN{>q)h)LPZy^+~z%VRJ_<e;oI-fWk1qyZ?f#KJiAlvuUE$M<@OU6
za#iTRUdpxcq{Np+Ihw1U&D`jx9hGsv{c1})U%2qiu9-?tdhYxe-Sxjlvc;jk<S^?8
zgWdJ<Os0pn+~z%ytmLCT^G(22|CbLRKGbhn^7OUE*RDtFnLbULeXq3qq!gpP)(Z!v
z-D0uayi>jHU3&Z65|}mXP9NTQA!y%)$sfBGbG~@9ReZ*D!PuS!2?~e%7M<X?m~ml+
z+U1fS-k7+OaPiABN4}jsdtyz(vY#)GbOqgEwD*0WW}m#rM0rcv-A+j@&t;cgT-^Sw
zSlf}s@FJnMhV}0k_SN%ZpZ#e&<hScj?Too+H@x<{We`!kiQBpA7B6F$;H=mMi*%n(
zai96>$8;BKtD}xBafyNl`6s{MweGM&(uVc?KK%_d)Ur8de!TZ|#>Z9e|CpY6?}-1?
zR44v3b<vEiF9n^J-`izzrJLFRxK!7}cHiLqhH27E)mSWRY`*Dbi`E>tJ!dXgy@G^}
zum9}JT6Z}W;%XgIKlmi=2%avyBKvC7NB>Lxb$4QNE*e*yvf9SbmiFyY+4)0-IdMi|
zofA`*{&De-(C-eb{t|GcLtojcZT0cbtKv?r6xcuS#GZze{gtQV4o<#d^l_4J3C{-K
zPgygUe9z!KQ)|wtW8C)Q@x{EzrY{T|R%Y$q6SaY7VV`Je{)zI3Ulg+rWgfcCE?d+*
zN#NP0{c%TkB#FIvcxHJ}l2@_}o4DovHi>l)C-kKW*YDSlEXuVzpwVI#bm;#!&1>~n
z_x``>dT-*-th%^s-Q}m$!<*iVopu$D%KjyopLx&NVaZBuEu&NhX0zXX3JY_u{CLbW
zC4cY7$@&F9Pncxq+14#)_Wmvt%EvWN_3d2u^|8<6KCQ{x&g*?cG&^raLD9_SLmnlf
zRasX*eK~F7l&B`Zf9?H^THd8|rxd3w`s^WhvR?9^WbeZ8xvIteU%6-AU<o@cdf3%P
z>yeF_)l=J!W6QssWPALF>&&iwNymh|wS_BYRoU`4%c#f7R*D`_JM}9{s@A(x<-<3}
zJ!$$m7jzD6TDM}GjkQMGQO)Il7Y1ZbG`QStVN>$yX_4Ncui6qW^G*K$ERvt~d{Io;
zu`NrMYq1L$`+2OMAMmN?O3wUlr^_yjZq6v^u2f-@>D8EM#qia=xxiN7M9&1qSMdiq
z1rJWlbPfyZ`%+;VR;(0K*X!Ii^|6VyCDUJlmF3T7RVrQg6!O|=XgaZ`>u7;~<?qjz
z=lf66dM_|TlIP)tgQn*hoLvlb^Emn>cFAh7<u1#(#}qQd<mcBra+lm1xg~8CGJRIY
zc+Cp&KXT=4m$q<@8{63#r@r;v+4<#W)#bY`xq4sA-p@425}c4JJk`rP^G(as8CUnX
zo>LLcnr3|YSFW@1nyJQpCypPMF|6X_Nu9xQ&2OV_-^T@Q8y-Gp(cm}t3|*+vA6TRI
zrrL<#(8)FaNb@%ywRXvmPW)0{mnByhtzqiSF!<(XDx=A=m|=>-gM-uiq&9MKeV)?w
zagB?9ult_MnLf*xuhT1<@wFkusLws%SdFgv!`0R&Gk46hUmh9MDt~E~obGq0B^<qP
zzqZ9+Qny*M`%SARf5-d}*O_k_w%1Nw*A;z{{i4pr^%l7S`;*U{5n3Dh@xc$C`AW<-
zuWQP;&-^U%@Q&$&rPIv{4oRKkIsDhyH94HSsknc2;JrI*&c8NV<@@FJglSu9%$X;x
z)zjVgpuzS`nmpgu#}XTaEPl5~iOdsTx_n8&Vjlha1+V%ok6sKtAHlw>&p1zF=gE7k
z8QAkhvMj31ob7rhAO7+|M{VQ50-ydAj<e@)x$aAxdC{c(l4!mV|G_^KxNMUgx-KiP
zj@mpUZCz0s&%IaYes4WBd-i<u6&GKt-D;0pIrr1c!@Or+&1+vW`?ThV6Sbko4_iID
zyVleA?Yk%u>6C`!+}!aGr}h5dC~+mSZsS}XP6xh{>8}d~52{9&I-l}<#v{adOGND9
zp=6(PuR7m$ZnwU@<{{6tGtc&%6n{U%cc$e8@4$o!I}#Z5CDs)$404oxxv9ono@3v(
zDa$5ade+W;xK?YHp;UxiCr7{h>@N)e3>JHLUu4>+%<kXq8Y6yUy7f{AM@c=F86EP|
z8EUF`zbn7>lZESl$FhJe8^b#H{?+#Uxoo49G?(uCO(#Qc%S0rmuMuB2x%z$NE=7}g
zg?$n^vg-4sYvWGDzAbw2sL^h6^13fORvkQfTgY5K?*4{Dmo_hcY^=G@`iJza<4rOX
z8jlvNz57Y<L#e&vt9MS1Z1}1VKF<7f;_}Ab;muP&g(y17)hsNSQ}CbHKE5MpLep=-
z_`?fg7y{ht9ejTM3S4F#;iSXN(55n1X6Nqo6aMd-UubL>-|<p?)r~8+=Vrwm-g!4=
zo#yXOp#_VUyu5CmX{^Aj&UfL+bBT(|<-uo)C$5*tT^qR|{iw+Fi_f-P538OwrR2r4
zrxtm0{rtYnk<ohYk`X)m07G}+gNBEOPC<Rl(}FW3MeRR?@YzdWdUJ7R_zv}$)n_jj
zEO5KwC9#qBW}ndlp=y2QE}I51x5oL^TU^(lP1}(?*J{H5w)u-QRIgS&U=eDFPxd}J
zjpeW3(m#c_#l%DF(;7lkwsR*s%e*p*eR?(~fBGB!-P3Phd2VC3UV56o-ux*)xAh+1
zyf?_Y^1)%*Q*EN_E#*%bJ&};qFKbhMyCdMU&|fY|7rhWI3l`(Iu7%fKPgHQ6FP?9b
z>fZ28YMO1)fmKTr@?0e1)|8!Sj7<3cWcRE0e>El^Jth4&MQ{CyXQ6YW*6iVkFUkEa
zW;S`Quc71Y8CDM2pVL#NPp#O{eV;KjF8}M7%Ln9cWv4LJe~+zy{W9a=5r$89`{rLi
zd$`E*fT(5P;SN6SWW&vGBxSsK$~MM2O5XVP|GZ4?X{jDVx0zXc?w<@7z7{Yu?5$+b
zkN45nl5UpX+an#cubEAl|J#f}wlANxu3KrWIR0Mc>c-FEW;uVi={@(J_?v64^!aYn
zDUk}w-W5;S4Dyd&uek2q*K}k4s~4#pQOmc#In&Z}*wV>jV@A4$n{<&;8@tXOmy1UE
zyFDh&&}u%tHEX*4_6f^wnLlz9`suQ4ze?;<_FtOI?{ta&S}>QRLB(HN=tx`JY{9%q
zZgm}|A~^v8O9T&if8xA)+oW0EYu{ywI}Ov^r<c8)utoN8;8nie+Kq}!CapX>b&tQ_
z<4<C-@y~fL)SWDdcDM0*IQ3VHYDD#f%<DYzA*G*sE3Umr-xhjxzRO#cm*4c4Xv+yQ
z9uz$Md*P}GVGrp$o|6NuukgCeI+6WaTdK!m*Ub}Z8v-UC*l5PMenz+Cypm;3#ms-w
zT&IaoeBxX5cdpv0_Y3dsJ)u3lD{N_d{mru?mkx0*?-CYQTKR14tt<IY=U7)J#~1o(
zJwM2qxAWF?Be|tr&!(v~2YaviYjdp5?08eKn5Mq5l$_x4W{<WDiymEN%zq>H`h4@X
zhkFXb9CEqXb{xOhD&E7+U%U6!DQWwwJ7ic_Crz}CoVHi_SktkSypFf#tGfqZ_s=Z5
zyi3{r+2rt9`!ni~JKfxP?%C-Z*44AFZQkFOchB)fpWVKzMgIBr!lk);kM_oV{dxbu
z?oNZo=h9x%r`J6^_v5eYqG*F1ADh>=ao&_Yk>T^_gvE=A`{G`H3f^x&yMQ-gW@uf<
zhP!2Z-)`2PwtnyBwvt2tBg^)CsFx?-GO7?WF5{_tZ&D%BzLj}pMAp$)7yO@H@iF_V
zR-Ixkd+%RE!l~Um7dsrYy;D<}xRUo|Sa}ftp;jl$SNk;An=GBIGVi0!eFc7Z>*A}2
zXYy?4JL>A@dwzn~J5}E3D`$-~52RVAbH}tazCUTT|6sDlYVK(<@teAWJ2Ve<pI#JW
z=Ht(?+ni<gCWndM$!mG*c%!p7ProqdY5n69=KjC#ZIo7Lx{~~0hQ(Jt)jt~Z80YEs
zZn9;LKiDu!@Saj2H|q_VGxM5Wce)yE3t6$JMSaD4Q?F$fEK5}tuBtI@&2=vEdgEbj
z-x%vWvAI6HL%?2W{r;~9eXlK^<oxN&v3G6>t?4iL9uz#)-`_m5%AI?XjozKe&Byp%
zgP0Gkd~|+Qxl)vGg2U7Lk~dE-Ke!nE?d2P{{j(1}ns?>t!b1ytG);>%Uf)<f-$~7$
zYsGs%izPfav^{was))@rSX^EtE8DuQNK<X&_bF9R+<Q&S<y4N>1qIBo<6QS%pvO<~
z?(C@k{CW2bPF!OBE!2LY!;?XGiucvHi!93;#aeF8Z$ImQUr1str-s<PpP%~WC*_@e
z{@#XHTHPk;U{%L)&l7#7_HOpk-1a{@RTpHiB>w!ia&c8*5>Iu6&p)GQ+veZ4-{$k|
zh|I@-lRWolZIs|z%kz81!|zHy|2VBOBTn@nZE(1CKCbW3^SG?QH`~Ia*jT>Gs+%Tx
z=xpPiWLCcD&b*y(q>KD`?>FAAmrWBms`zAKn1$eif395XryrekWOCKsn`LiQ13pgT
z6W#qc)BJG@n*{%|_uK6pSyrs}Khn5p^X34<dRgbJcFQvoe~P4<gg!YOO4ym3BJKR8
z>rF>n?1rvyb;rxj)bIOT@<D5Dn~(SZCryD9toe6LykDl(DiC_^!iohpeogr`*VV&C
z(quGzgB5M>{C+ya&}oy#_KJf7^MtuWU-#~M%VsY<=iJq2<%P*U=_ZHmSol2`YHfD+
zd-s^_D|3Bm%_AS<ihHw}CZ>v|`>-s2GG8~^Z?3TUAx*U(#||Z5;?gm{P*k4vSk^7`
ziov@Nj^b{wn?Gz+eE8t>g&n8+GTQDuy}y0xor#92GjHFSx<6z2pAP@cwgEP;t@f<H
zKQUMO<a3U^&VAc|AC>Tm|H3dqw)o5Hx4-5b-G1cN_4#dg!!&EQO=Ms5#{I?J{AuP-
z!rerU^nFNJ6JmD6H}O@kt3~PmqxCn{)teQ5I>`%HwEs1Du<!2q1=WY9yFGF~tWzM)
zG`Z`jME<H<jxYLoPd~nGclEZl;zyZ<yvzExyp{R9;h;gnY5y~}Q}$YJ`uz0J?U}55
z>o+}HaxXb`=WV$SJ!!Y@SWYfs>FQN6%999OBg0uT@k`#LusvUVSDY`bNL?UVG^r>h
zVLgk-_WjJRGE1g?|MqjU`VQ+$yRYcWzBn;SI9z-8WLBp&4|ZQPh;hmfTqc&<%Xr0w
z;mG4XyLb78Rc@Zn^}}W-`<&>HqMset+}ily-_D;Zceb0~{+xQzCjIWCqV+jO5B;2C
z3n#D2{_%pT?K|iGIblLoZ#ODxe6Kroe*eiy!4KbWGWm7U%eU<Nu8L|Ib~%gVAKl8m
z*tXU0?%Ax9G5I+^>xUV~xZYUU6uiH2>*<c}>b%VND@$FOzdo`k>1UpI)50%IBd_@C
z_a7Ig%CF{_H#PI$w(hEo1v|d$2)RD^96VS5dDvv5{f&z^)ZCuXbo}EjXU59OJCkb<
zXecPHRXgcjRw>2(o~3l<##-A&N6Pdo4@VT;ES>%B$wTMY4WD=ItXOesW!TIFqjcV&
z$44Dq-g@2NQ~T@D)Ysow^}YS-RrjXe&Gjyq*>YD%e``wpeKB5(74Ggb7X_894n>z<
zJvF!T-lF>cO=|t`9v#)Y)UU>{OK<&*i^7kZPCftdE%dJK@#<O5-$UB;>;7#$^>N?M
zb$%=fyE^C8JUh(KcCWvE<z@{ZM~>+?PPQFd*w>x=$?JpcDtn(xoj=vSZjE>z-g_ro
z*J}QnT<fAeHyE}ZxT^W==$(?u+c!&Wzu~hcdxx#p9FDDf?n@kvuTi%<`Tl?|gQj<?
z@~t0>@?*??TjW2No*{cbUAa{B>xsC`PkMoc#fx~&P6gYGO9vzf?-M(zzxv(YtRqh}
z_#EtBKT$P$%68(_57##pm4?|F@jn~co8x1fqb}^=a=VlMSbwhNok?rBCO_+y{;YgC
z-a;#D=dP&eO%8Y0oqZq2-}rG|o$n{J&JA4l6AiyDVyfy=y%%{tr0np*9cs@XE6QH`
zeo$Dy!g1BdEx!)fEmJ=C_Qj%m4ZD+{xZhJ$e&0Wl$8fRrr(*q|OV?R*hQHXhG=)dt
zUhJYzH$L1bOzM5!X+6*J&(~7d3!3lFzJ08c%MhLQh1XvBW<Gc2+P&scD^?z#C*MAs
z@$dF~D>{#9PK<1v$uKW**U4$e7p&R+Yi0hk<NYs;T^K%x&$oC#N9%;k7HRiQTuE<&
zKYqL*n%KT(-O1-A|6fkw^If*WDZPXJ#i@%ak!!+umWgeM*}3Of$b!X3KZ=RACiXAe
zxB6AKW<ZJjBTkcd1#@Kl{)LH$E=%nD!60|0$7I6>OOMI#mwPXMWw=1fS-Eh*v^(z3
zY?ZQCgH}&De7m61HQVK-j`s<Br}bA@&RkgexMd<|OV`)g({{X5l2~W*J#a?Wh2Pg|
zRkp}~VtS*yR`BgMrL&7oZcWmkapX<b>kS_pD)Vp2-|4vh(A=WSziYx;hQqo%N2-<c
zI=_|(?c0?j^vR$k`_9t+jx&0)pIteZ#;TTYt*q#i@rL#MCXT4W#hg=lHykU|$lZ3~
z@Xs!H3x<WV9}9M05Gzm!Y|YTIXk4-9Tj<+GpIWaLaDFZ978X0dsJgSbKJCNIusbId
z9NIZP2X3w}HJQbDYHzXH1^LApumAM6K793UOZ20nas@_(fbcah-8mT|8mG+VE8Ma0
z{@k=P%QUstJ+42wKK`?O+XaaTSI_+3P#brB!DEjO9&EhByTbqCqonGla~idw6I1n0
z__3^7VWzt5V!$PdUAZwY1fNvh&P^=aG4rrWK;G>~UQ>ibqD|G+c%xn}cdtMGWYc2h
z3EPkEUc5^yzvp&-@vQD;nYSMnzNom?^zqZAsk1Y?E;_!el~;cJvSjs>UH7J)elkb(
zwbYq5rZ-nV&ra$6+;?H-oy&LH&ooWe<a+O}d|Wd_dzCWZA%%kvGC9f*7n<|1Y~H%w
zOs-*Wcyg!A)0u(`F2o!+t-oqxIJb{wjiZa6i~X$6#aZ#`Ra4C`PuZ2Iw99e7`}K^j
z;;H_1`$~GXw<zga96p&c$Hy*`Bdh&WaNLzwcb1%b$x_|T9(d>p8<TAFi?x<}ziwj=
zHEoICqhju0Y-J`}^~-4gq6t^4GvvRSK6P@~cu{Uj#l<y>R|0f6Z!n1+n33=4z^15s
zM6_!L@AAgr3sN20JhuLqe>-P9<Z3wlpgAx}O_lT8hdEtmmc}04cypugcQu!)6Q-)J
z`m<R3^H*M&VYqVr4%6=2`5(4wtYWTucq5YCH%0dPo`|oBlYVW|w_m_iS$T?$;l)CO
znKQI14l+OH+|MRB^J32G9__|!Gc@8JdgfTT-<Aw)2$?dM<K^VpN>7pxb_vQ!6|Ujr
zY7bw!Wpzg8CFNso<y^w|7r15m%-yXOujzYz#ib=Y&sXrc@Afot@Yb3dm&zI|m$TyX
zv5Q+-+^m{PY{mLz{SU_kOWVvb-*L%loq-;!?9z=&P6f-tIP6cU`JPiRbhHTO-muo;
zZ{nT<9let;ef;hDDKq}ds(ZN;svnkVYX1%p>iweZdF6R?hLOv`H{Q3cr+hgowW0f#
z?#|2SWL^kvy>8_e5ZYv7eaK=V_dL!06S`8K-(D1R?kV5Qi4i73Y+IzJKg(GqEnai>
zv6Q2&p8M=C!an?F+)UE#)(LO;Wf*_|5(?eF{QK1<3UhPv&#P877g;eJ<t>}Fdb_X0
zr`Ly%Jc~a+Ym#boqeV-boUGV|%xhkf$J!F3;xBD+J1Dm0<gGtWZ<rchE?jw=w_p9|
z!PB$&QnK<HgfF=)^ih8$>DNBR^y?SSbM?pXl}oOEAbaAQ$=$Nmi|wTp<pq~keJs{-
zF-<7cdA>{Yr-ETS)2yIf(<GKnzNDI#C8;QIb?v?HDq34qIEsGkJ8W9a8!7Si+plGd
z!(@w<M8uyo#}{q6cfrqWgH3E--_x}hf_<BWEd*KJPCO|S?OeWA?K<y|->Vc)CoHkL
z7u&q6C*Z;KfPT%8r3Vdi8E?FJVp?CZ^M+{lxoiiWoGITn?Q<*bdYJj%N>k`+{uULT
z#oKNa&QRz}$zZ>=_1!w@*B<8A;&({D{l;p2IaES~@8TCl?P<ZKcNZr7Tinci^DysW
z<+Va>mZv9q>Xye`tC$^AKC^k|oRs^Q7;kO5X0=~KtkYtD_ceE^vetOkq=da%r$5g>
zC6&^~-0t~$PToV$Clk-F)tWQ?DC@drvy8vjwD0gJo|{{CdWG~^5#JkprLQCuE^2Jt
z>3_AzOZ(5uwOxI44*XvH<hb<94?%W5vrDd*DwS1s?*7X1!|;B}&KRT2O&8`c?0Lm;
z$)DrbE{)SEv3vaI{rU9CGPJ?|!=Lr8Ti2|Qem8+JeC4s(Z_|R!W#>orRNob!UinzG
zAjt7}8t<J+5AR<v@VhdN?aL9J`*RKyf9I<Xx@R-3WB0ZvXOsO5@ATCNivE9KrV}ss
zI8Ms<;*<BC30h$_L5CBR<<lPKD?fa6Y^}+H&0njWmzRi6wKy+(Ec5V@SCSq_o*CJv
z$8J3EVve(B|KqRkUb}2?lUsMB?8AQ4iF95y&R5o43=Aa-m?xcO=4FDW(f3N;&bxi$
z>)d$5RIUl9qGI0f6VY~Hm5DyL>-CAYr8<{(H5w?j3ki2ApP5j!W##|9&(E~V1c_(&
zE~?vbV&|OSbMsF;`S&XLzgc&rV&s3dMAw;1C54%bHZJ=(>1%!8xxMC3CavGD6s_a^
z>GMzjdgaTi%JMUwuzKETds?%%sd`CD$<xYx@8dtUOf2&B7UFjER_i<y_Ii$BWKdvO
z_9n4E+}+-i2NTbGv&K)nsk8Q!*M^%t2O{;noVuH)Z#h$;cy^|#?(|Bt?d<O!hURZr
z6m|2epiT9&$gpAuQDe>5Q&U6JD*tX<YhLkJWd_@>6P3MO^WWC(j7>k<6yUk6ZJlUW
zQe0|f()rcXjrTH&91cDwe)n+T8CLHM&$nw|?`|(Q4-a4bF{kR|hdPtFz4~@NYSz~y
zHlAeBpK|8x*_Npa=OZVI#=kiCb5i4nK;DT_YvSLgu3a+o)|{2v?hYPZvwSjRiZ*T)
z`0^;{AeWj(&YL^WvzNM8|MT1X@7T6^)0d`5`Tno8pB4MhYS*8)X@BY-2>#gYrXZHB
zrSkd8BBs?(?UV0&ZHN?qwfBK)e`TFp-ew_=lV6uwEDxH*y>UfAlF^pqRm^+)>w}JD
zPBXS-NXj#gv|E&0yKejZNsKqvt+>y<E9tH1x89?np3f`OZ4<L^#+}UExZ(xVIY}+~
zW(x~t$31bY<yZa-=RA6!<^R$Ha~81L)h(3Xs;3qCNPm8P=iBxB_Aj*Ll{z)`2Ybr7
z%6oC%Mi-ZHZ#c51Sjgq=rJDwwGY+g{6^&-U*~S^t(e}DB;oRl+?vFX2KK}ak>~e-v
z+mmX6r4{B(Ij_D)?f+Y}?*4=CH+S!q*#ABz$j5Et&x>>1qCx^=R?4fc%2@jUwfsW<
zh=s0RX6K*SFY%t~T3OF8y;!^TbN#w0>F0M##m3j{nS1V?{JVdKyXG*-g)jU1?fv5R
zlV|TrY(KwvK9hg+hP$rmGg~B{Rox18o9`Cuv7@H?GvD;Jvuxg{)zq3dHyG`#Sg*%&
z(B<b^-s5TlDuOeMk`76>9A4EB!Dl$}xn=#K6XKt*c8PVe{14RgQ#rgK@9Zg^Ln}>p
zh`fw9vu+T2qm;O^*V3w>Ma_msO8@P|fA>$$5ck>KA^!2Z>{J~^hQFMfxwkHV$hm_-
z@!&II<q6v#t<Sj7GD%eTvFgdLTkl0=5>^!SMKUhf>wM3Xr*cVxzuNgsr=_-%TUTTq
zlJD3m&8=H(D|;;{>7H_Hjz!MvuZ9e{Z1XRMXdkYYc1}^bo?(4uLgYWA9D~l_1nJ2u
z8NHuxSuiu@$-*Y9#G`Ib49y3RGrc?Nt-^L?-Uf&GnC>+i&eva6Mg82Owew^|+XGv%
zf;5iHikvLfzKs)@%RXu|Gc%kupRiVAi)2TuN`P;KG-L6EIVyWNyf!V7)(G2S*uCb5
z*NZvf6C$m>*j_5JXeUl(%38T&wS!h#{|0eRgSj=#TwN+E7k+JMREb#9W6UF$`M<yW
z-~P1uXAf8YpME}HF>gme^(nnxkF0=RH?`;^hQFpwO_b`H$io*G#@QIk^h544=k5RR
zm}<XyE@KV$TxzS4wZbvTnpLjnUo4C666^YdDQ6$)+&xtLU8(ZaDb<(XMFo<@dvli@
zbng^QZC|y);)o-EX3j*hFW+7s_dH=8mG#XbT<@9q$?QC(iF%S<dfr=`7nm%(qFBr?
znK0pZ_x^Q{Z+004C1!rnP2-Z7V3oB%)9BlUKjI&Iez9#%Nn*}xShw)7birvC$Knml
zViUzf?!NfbxOD0yfr6Q$lGomR;QpxU{mSF!hr6ct%vbd@WO+@IY)Ls@YpmimTP=3|
zXPs?_ObSIOZhITz*1JMMzB6fl=#|oY+*9Rm98C_szF<z!mB1Nh=Z_uVXvXxIr@BL{
z*T~YjAaVWmvY@S+t4+@Cd-yc0)A)wqc2zB=dyx}cGS^Gnlu2gh9N}a=IHTDlX`jX>
z`zb7{>ld6+ex>&zNc1G<I^K(M((}TMF7Q{i^)0w#HIcO>c~hEs(~i3Pp)6`XpKlb}
z{r8e&nz7RRbHk4(>_Q2l$2TjrI2pG@F-}zq4Kd$PRh{e<TlGHc+lI!Ht?ZGauP??f
zE!~*VDf+&vjL+#;)fuyW+qv#O7ZyBt(Z18mSjqpX%RaukQmq=Db@9!LmV%C-xI#;Q
zw_G;3dF_GeosQtI3upCSPl%Y?;ZSP0-swZS!JbPwp{Glw#7e)IT7+CKlj1A=!YZSG
zOzF>U&IkWgk1AbVnf>;tF_WU$Ekz~YhpZDL#iJ{qlyk3Dn_>2too7jG)&hrm=BK5c
zxBYJ@1!mkXxOP?KDVye%M>6Gxx$6zSCI31$O+TGOaKVX)l-EJ7Pxm`17MstriTT%Y
zd7b>zNlz>HTk6zbiFKTGCd*~vtY00BoNrh(HqAY__ZDZ|E0zYc&~M2d;hQ~{2%M63
zOga&_Ez(6T{LAVjq1(2s&evV4qiub|o?MdpWtREF;-mJ#dq*x@_vD_QxYfa{?O$}o
zk#jj6TMtVz8m@WkIQOm+Q`3UbI6j91m2-D)3<*9dl(I8eKsxrlvd)WmCppgr2c+2i
zEw(OLwL$8d>l5b1mY0eaUOUe>jj`*}g1N6Zb{~2)t+7GUkCRIvsbGf0{&<Gp`|?<8
zPS>uUl)uA1;-CD(YwwMF7id;wo2-eIv7Qmb)W_s+QXuo<YQjU-Q^sLOB$=-V6i?ij
zQXqd^!+qgXsaapGE4ruKbkCIWIw7aSd0Tj8TzK5KMcIa>Jq*<|Z##Bo$GL0H%I*r;
z{OI~JA&&`Gv!^aPG;{tk$NshquBrL4eV-p`eAp+;_%nUlgTw{bvR3q#E<B!P)Ys@^
zx;HE5=7rbhU#>+3xpUk%_^7fV<~py`lwU8t+*-e3>$V?`Q!fV2f3=vKomYPD!nnmJ
zKO8u4Ma%f>-JO#cpL{Pn;k?`2XFm#Goe?PGZ%kXWqxtTg8}1D|KfRfKl6S|?g^98*
z&3`A}n86XuxWhW|wtTAZx)9xIzJdOp`axNf7haA&scW|5#>+d>c|8ZY&)wb0-gNmb
z-??=K7nI-11p7B%S^CT-ZhI~F^uRqw<jyM|Eq-}qy>sFRvw{~^Hjg$HuYD+zQ?h)$
zb)4Lb6uFp8+nL91zwFT5xkmZ$zIWb*#d~~jTF<y^&S7&Vv0HQLVTaT?9@aJMGbc@b
zyff!@zkvRiEqn$ZlO6ImUFGBb`B{06sUu@*u=QT;*1PXx+0(cD`h1eler@gso}-iI
zF)6sa?=Y0AS>BO<X6;$FU3$~p7F^76um8oJrV_R^A!oW!zPwt4h^wyP8lel-vFth#
znMV?9m?VBS+OTD9c+aDxJ1xybDWX%i=I>n7LmZ43qRklEm24*;eEFg9tJ(c0&ln>5
z&lUMiR-Pl)qq?~_<tSU8&*B+g52V|VIsClyH!7;W;OP5_T7eqpuG-YFo#J}^ep2Fs
z2dsPJn%&l(F*u(yL)%7GrPn^kBa`#M-dkz%`?;Cxy8~=>9G1FDJUCI)kg4RL9^IIK
zJb*7RwC{F8rlXxt-Tp1{5iErfJXLY-C*LhkTpSiE_RqdFYr&z!qIZAMc7m5l+<6nA
z!NA}*2XiNQW?pegVor`;LFHN7`trwSMgM;XE4<zpbnC>H^2^>q+jm))zkR!Nd*tqI
z-zV7}?_cP8BF$%_)uc^titnDk_mi=Kf%DX-wA!_Co2Gdr7)bE288=HN1kaIs|9{I@
z#knW;Op0#rJoCC_)~TZKH)kK8+<K=<`dv;=SNYLD`+U}~%l=sQ{H%HOhx7KGo3l0R
zCWKDxcDZ+I&5ZL4HmyjtxqV~Cw4**Q7fS;5y(C?g=AP}|Bvv?2yfkLHYurks@W{fI
z_aA-djoq|o*6~!;ulbSFDi_v^O#K&j(#P-Bq8z!H^iS)4Zd`Hs%%7;3bElJ(RxkUo
z_h;1o^Oyg49hquzx!-GL0gq|Z^llSxH>YRYGb5kehz)&UH1Ey{n~U|@u@4Q_zp^;}
z?XgvuYP!b;9n)Gl0apHZYDIl1lAVu}^ggfXT3)2$moi88_}8!ZTJA3m-Qx3kNkrIU
z-iQAkCR*&3W=wo_)MnROhU*h&ET25v$1PG&on^_2cWqqrn`W7E$X`5ff4chXu31xF
z?lD_0Y&m~f`6iiz+gJHrGWxaEqj<Ycx#6VppzB)VUy2v&y)Wm?KPtP~;;i&NhCEN>
zC!!L}Rn7M1DuHe?K{J~->3Fei)chxMzA<QOMBHha*(a|42>h&QwttVG`t=L(6PZun
z_4=rMSucd)+`5ONf7l-v>WfYFIkH9L=pVLKertBQ@?Oz#S?lG0ImU>kd5J`KzboIJ
zNq$EoE55}aXTP}HUUtv#&kv8+Z~t}sv<h>&j_$Od+jlUj1@QBweg0Kvuj{_=((><{
zb<XB*xa2YC;GKzE&sIegWh7ooJM{fRr+gQSly$;2JFV}RIlug7@YuNG@oArVr;K_x
zZ&`G5x8sI01yTpHgfv$iPYo2GthCrDOXmBlT|WBaTeq}r3YCpm+E%!AXOQ!uz-FhS
z@Fn4ujh}^I`)%5>>PTGW)&r82Z13539omrj@apRDbgsQJ$12@q7YeR->=T{7ze%Q1
zlmC+zyWfsI=0X}Rv)H`iT$ZXBZqU}_zH0tQLD+TjYm5Dp-i9lbOz@8K|G&#4^={R+
zmQ|s#v+ie2+A25gyWocE)mf#J&nZtUxH0+E+Ti2iYt=v4&efKXmKOc&zoo}}mRqtQ
z%fa)~_Mgtj%4F5Vh$k^|H+HnHV%XB1ZOAUkV8nFq7*n;>rz^8`P6@HGsELPorEYC(
zS@x6ZitiJXxRe7)2Y8ZZrp??j#pxoy8;9b>TZ(z9oqH6zRz~HB2(k1Qcr;#4ozvnp
z=aiJ2$?2}tB?2mIUKJ^Re7|SPR2@eFjWY{QzW!mR>o7<3=`oXYTA906ENpk+SkT|{
zzI%6uq5q>OCe8DQ_%lQ2GmGjsL_8Ol-r!cJlO>TN<X$*wf=Q4~WFyBpl{0CKxgtNr
z9-ikg&qxnC^T5=1jc=k#p5DKQ?ah}L_b*p}zir{wiru@WMQ*z)vTmDsLl=jx5if5?
zYGX3b_g9sLKKgA*ufMCTsYoh#d4bK4W7|Deo%_cR8a1vrTx<9ETGEy644emw?D!gT
zGZXizcRiYL=)O1SXWy(uS)T9*8<wV>6`N3ZOF=M%A=u4g5u0bIQ3aE#^Tf;k$B(PC
zFJG=b`+T>q>BW_@N!LDBrwH2X`A<mRf1uSxW5O%}&C?kRTzAZp(1_i3<;@SJA2JVT
zg&(*RH7)b(=1q@I$}q>dPV<=3UAXRt@Ur|v!PTns>RInFL<{A{Ps;f$bi=)266YHi
zrWS+PV^fzc@R_HuVA2w?APdfUS#nP}SFo!JuJU1QyJ2r(d)wY-W9WeZ9>2>qN=N;E
z?0$b}?n5t^qGbXnKIqP1wXON95|}dezs!}0a>lv)uZJWgo;q@>YxS$h8MzO+Hl?mr
zXo%r^zq;@P`wuI|O6KCXTU`$(+<h4QLQ^k!tNfRZF%fHT?x_2(vTnyb+hU!mc1Lc-
z`Dz8J2K;HB)Ank|K85whNgVeNy|_Jh`O5a!FQ4~5*9<e&@XV1H@nq77uvHIp_i75$
zpXAzUak#<fvUY@GuFZX;dD3fy8n^v$u2G&kt2NtIWNBrT`$dMOuRKzMV@{rPcxYuK
z)o53(oY;5a)i*wm)~x%L5^c&+26{TNT-oh6MZ)&wyt2FUHG1{pU^WN$T{343VtIa<
zN$gTJbrXEiC@FGrzqwEQ7vZZ5E!X%jdEPLwj9tU!DDP{FfSF4Ivi~X@WX?Qp9P+4J
z%Y{L4#WdqTMhEKK>YhwwWLx#>LR;ugTQ+N^CsXqtuU;nj^~8Z2r8`(89Ii9EE>O&E
zpK5lHMZjxLhvbV7M~<F-HM?Ph!ZpRJ4cl0!1#WBz<=7El#o*_~>BXmWbH$9S*O}6N
zx#n=r>DOx0SkPKDGwc-4Cj03DUzgn#%!&OzYr~2vtF@XElTx26uCL#5Yf8*PXOl&|
z`8{8!KWtmcA|>G$+upNa&m#kYL=SOY;Vq4wRuO%gmjmuHEeorPa$8^ca(hDCBiq+I
zgcS-~g*+6kB{q5SOxf)4amNoSmWWestV>PX5~s~nN%xth?J72J=~UL!Q(P{(&zdP$
z7IH6HM>ir?f3DNgIR}$w91!M?U{RCy5>1zCQC)X^YR>u0SxWK!t=9dFE^()WJk@3`
zZ4`@lJgk~CUr=HBySb`YmV8_4lB3ns(7gZov7<$XLfZ?sEikYC`IqBNbA{4Hjc|V(
zqeBVrUW(3|aI!1%)ESwpt}NM~96J3Xb~iltsCQrQvt-%{4$;2{MQ+YGBC#+j@)J*F
z;K5I?3Pb~R*K9g?Vx8raW0$yW4NonTk9f2x)vR)fn%#qM2UV)db=A$ER68arJo*!-
zzhM2lxK3{o@f9AAs+Lx4&=Py<a<g7z`H2mis+u3L8!Tmf9OZji%<u8F_li?`J)Zns
zd_(izp323VuY&HxK3TBL^;X)H#1IcrxdcYJ7}Z@L96SC=&3V`S;JM9)Bhyy8oi|;Q
zxoyQd_O2%m%^5|pI>oc^a2s7ZcgWwe;EAOz(^}uPTTacta!q>OsU*YtJk>83eTCN?
zUANc5y4`A7$@?Ai8=qZLy14Aq^0q6|(*lHpR%(4-u}?36mGy1&oA`>AM?^QMpLy@a
z*!7u3{@TlwiAPm6Qglrcg5vbGVpe)to=>QHloaCqh3%-<p1f5@Igi|UW7Ii&>8aca
zN0aV+<yQD59pz@e%48AWC*CWUcCsAVvR)vkdg5~7lUm=FuF1|-m^o{yi{F7f>y)S`
zFPg3ei643ON3MhA&%PZ=<&R{ode*(JihG-ve>gbe>I#>LDdD#>Lv^3bet-W>&Hjs@
zqO$tcC9fGO@fcUN8BdxvTV(Ev??(=7-Z3xcwPw`P@XDU<J~^(6Z{DT3AO5B;iJ9Nb
zCGK;F+oR25x+y=$?CBRT{m5rD`aDBTr`Xh9<y(kOx6KlZyd7o|&-_^r9=P(g{z#~B
zx$uJZ0Z(2<o!H^zKUqipRBTI6gEzyjpN-`K0ora_E~58m^W_FMzj=MubsvMA)4wIt
zUcNk3&=tEa+V5(d^t#}Erh9}%HoWOj`L7bC%lve^)TJ%Xyeu;fnWJ|*$*mJxx~XSj
z8<YFzVol}>=3T9y9{x=-exZM3R$@|w<mHx`a_UZz(X}foWfFI8-W9OAkSpchmh-=O
ztm-nj9(Xx4H1q04BzibKz1e+1Uc1g-tU2H9(OL6p1$SF^GELrkk5x15VUuaxlTUek
zTKzuT@}B$^`m#aSV0MmdXC;$b+N6_y+RDb~*EvM#=pFVny#35<n^5KIeV>-B-uD0J
z?d|!}ya$wKM$MaG)aB^zb*}H{`ODtnw<p*3soZw5XV!b3W9Jc3nR`|J+@eK~mbPq-
z|8*;4-HsbKHhbxdY;n6#!m~igZzKQ9UX{(<B`v3aOKo+3E^51*L$7AqYbD>Z%9}fl
z?#K0qtugLWkqfBJ_HU1nt>v*_AGg;ks7^BM+D*xXIlDBNcDWonuU>LQ$nj{&#K{Ns
zPR$UJ6nk0a%gE;@9DC;7a|IjmQjKpH>bp&48>G0jZG$hYPL<p?v9!*5@yef?z8x#h
zr!8Aner_61-I+@^Y1azk);-JgKI~g8!nb$A+;cfMqWCk?w_R&KH7jYR`j<&!+ije^
z3q2e>vQ&2beI6{%xbp34#utq3FY4W2d#P>dG!=4R{_3=*uF03fLdm+q7Hb9cev8?t
z#CEQ|R<PQFJ@j$D5tC{v+as>Z^MU&5g{7B6MfI(u?%urk@1ovoKQH~CYJcQhYs&TW
zI{Okzq%)@WOyOCxD&g;?EYZCV27(DG%zHmGDYbquh+?x=(z~eQV7)`*;)1K)EC+=j
zZ_IeL-Pf^tsh9SqMV~rl0(`TwI2QFj47q+qZ0(W@543qV*R=j^&E#MDRCLB{7USvO
zN_xAB%evn0`^_i#D#}0hTOgY-SN@70Z@1sycHr;hh(G*_SDuEIpX-_BRlD}an#vrD
z#vlCUhjbe~{T?1Psc<+EKed1Nqu{=|3b7nLCf)r<nlq<!*?DZ(?A7TY@4hGIVVi4*
z-1oF~%A3oU?=s!Zy!T{}&4QHDEo$?bUY<P1Tz6TEgJa3TGd2#=HEq+LS<al+QWIh*
zrpTeX(tyizQ>=y6v3i|Vw|q3(1&-}sJbhZ)os1p7)Dl<MJIkM6<hd~Hwc>{*eZCSC
zyDXHaq^y;_e5E<}(A{l5vkL?o8o#pn*5B5OzFhsg*R|u^rH8lH)^3S8IV*efb1R)w
zcdIfkG#E{D`g`HQ7nR%F3VsKOn0HrdD;?|?65_3GdlB<lDP_xJGdpd=0PT);ErTmY
zOCG3;w0u#uvH0_2`d<Fn`!BOfJ|Fd&_VP*h0^b$ZuU000v{<|4<HzQ-<m#Zkeakm!
z>^b&4MJIaC-HK_t+-%G<FQrKTYsfk>PxX^cjAx1e`I|0ED_1_hdhzDLbrwd!UU$T~
zw{UX^2ZT<_z4uu~@uR-U{zTOWz5Zdxgri?%BqsUKR!{HU-O=vP{ZZd4SSB&=d*a&8
zhkdVqIrUv<Qc-<Z^RlDUlX3N{*j}Mif-i6VE<g12=IxrQ4~*KJp`Ayp@}-(G{wHg5
zG;h6kc;yfFy_($0EO*(DRNNM9jw}#4`Q7h#f8nf^FZA#3+5K-8!@&t>-g9L0o@2hc
zK}AXZVC!n3N4wav9{x_6nB6K+_wMcMvkluO-H^IJ@$MVzTc_=w#pl`<30reVMFc%@
z^qp<)l-PFpy6dLSlq%yzb<MeXj85{*o2`y3X1a@?O^93arqxZ7Ysn^FCetGZ9tX4D
z%xYq5Pv3rrYfs^9<7(**Zd!JYCz~3J+BmaB8=D^AfABb8*gdhO>>dZJu11}&j#@$E
z)!aLW>;3=xZGUl|Ps_CV!SlHaM;cBXoDv!Smg|PCMAv%OY0^^i#@nQfq=Z9?_A#|?
zUb}<!ePfNord=22zBn^A=@yH#fnkBycHWf_L`0sb=n21hRulN1?asq{Nh<0aL~0JM
zxb$;|?Ol_bj%@B$0#nR<-Zq#@e0H7IIL+4g{T1fL@{<f2_Pg!P?pgd}Q`T*_9<5zM
zYZe6G6?6XDsTb_a{CuII$4%3#YAoS_i+WNScv4tW=ANCn?Cn~~%d8XBmmlT%e&y3@
z*BaJ29Nifjeg&*cb}pE(uyLW(>DNrxELo1nF{fOcJ?Bnp>E@mKuS%AEi_ART`c!f^
zN94MN`pVZo$F5B~W$Re2Yh~r<ZNuO&cf&T5L#sI2G@PyUC+Tp<c!#~e5D<8)ab-ZR
zoV8E){DZ2l>%+P=CsbwhI+>midJ@5UsC3B%6}ey)3&sOCH+{8gu;&VhwmhZ6qj^oL
z>wdR+t<^>C2kCd(_P47!vYxu+eaAiHnpoc{raZ2ryCt4ZpXK#%bt1cxm1yDN!VhVp
zMh*h}W?55KocY;T_W5U<$~#Fxhrj<%cd#US-uSaj(ecXv{k<J^ZC7qwIB1fkFS<B$
z#RT;^ZbvV@?>fNe#&^eJcA13lB(vT7MLPs$+!bl?KD97<3WvJzS_e0k*?(P2BmPGy
zKi&83*t?8&k3)?=gaa}Hs@`q+@btrDwoP?Ox@Vs|7AU3}v9TDe;wiV%nJ%}l{;k-7
z2d2+$U%2Eq6l`d*d}>j_t(yKK=_+6SF@-rMOC+=|*c2N2O<Zkq>g^*NR<?s065E=l
z8VJ4NOc2pYV_e{wxi>jpAe|%Q+(Qelqvq=k&zx&f-cwh*d5c`dp8LIdDQ$}%dxY=`
zykL8_;h=-zMeaolqF)?eD7yEnkjD(QUmFipyq|u^VfT%VomVCH{Iy>2;Txxn$I;44
zlNB?s&bZL^?bD0^<G(WwSV>M@a$}!>meqW%oTw<n<X-1@OF5FID!4em<nPfCx^aL@
zrN*yw`k~|3uVww3p#O*Ur1OX0fiFrA8hCB%-6qGDlJLMe_UgeE_a9$gkRo~M^(EFX
zOOM)2zV^;EFT%b#s5s!nft=E_KlrZRnO6`qH?`NeXWDj$Hw|a|%jy#Z=N8NO@+e7k
z+MX=_u}$x>$FuF{*iJ@vSe8Fuwz^7x%8JH7fwJrDZ}&~!%5e5q=E4uxJP!RA6MOrY
z^TH3QvSq%;YZqkkZTj}(*3LHnC)(?NeMz;ub+R{``L*IdSM4c*6OB2gQzw)M%~7}7
zv3YSS(^<!<Z)@$p^fj$smu%1zXtMDo%l=h+I-gyYnsCMWj&MF(!0|bKN7n3$N<Wu<
zcIszg+q(1y<2ME!+hmn)<sF!t>^=QJPk%?SLg((+i+(<p@8>h~t9p8Q$qkX}n@0QA
zpNT7FGSxKk|9LN(ZOdN6{0*{FJFibkP@kZ=kxeT^Vy{I`!RD2D3;`V4`%IrUTCBa)
z6*F(stpHQsKd&RM=eucWE}E9NJ<H~g@fknfjVxl`8LCHeXFhGe)cI&bgCe(u(D|pG
zNsZk8x6>0n7VDOG*H#@rW4vl@VScaHy9`cq-+BYybEl@rZnE0F((qn3--72dx(Aok
z8a&vqC9gaG<g&m$mDNu95d~HPyFWbQ*}nFjWp1PL-<x|LC%AEk^{|*#)`~QBN3P$V
zxzS)}(ZX+YR;yjvC#GyA<XtVM`*_YFRYUDA=Vd~-GL+6cznJZ!b<mmLC*An6vB|$p
z+8+D$1CJDF9cy0YJNqEt+>AMM&y~i8>TC_~GBD0dn^z(5w)5kBw%Lzn9J~~ker#T4
z^Owb(QrqqSo}01$_#@x>?5C$%vGF}JzM9F{;c~d6-(nNL&1Sjiih$Us&KK^QvF@_o
zzklh<EgzYGT$*k7^m9d#a+Zkc-0K0Hucs|`bC@BsQEx^090zAfjT2o#YFX>Avu`ex
zHOSG<?KpJqT9i}Rr~R|EYnMvCtc}=dl>L(HDCe5Ymn_vyoEt*Txx3w(WB9~Azw)!$
z$k{9Z|D0Xb%4owcT7Q;Bi`l<DB(wH9%iNDyeLapED~fF<JdJ4cTIi?z!6`j<Nok(r
z`Iw~Z?&V7BC4WCxKk0SC@7(0Qf0qZ}wt8Bn;<0>A_{nC~d!^4eW`v)%whNEn{ku4j
zN$2g1=68pr<HIIKX&mFq`R~<TT^_US=qbJ_=gQ_Bb9|gT`L2DcRK;qkPx<0erM1Bp
z!M+Mt=SA)7cr>rcBp`cDY{b`<t=_zExPJO@RBTOu-*(VyQndVgNA>CzYZ}?rq`Hf0
zvbl@=Wq8)D>C)V(R=h~=iN;!`$p)5r8C@^?uL+bMN)Bs#@QXbsHtK<UzMm%3j4A$;
z-FNGplIFSbIA)&Cx{n4k1NMCK(o~F_+vIC;{bazZ!k+CP-zKlU^<<&sdxIJIci#&t
z>vexQDKI6?qb~Jn^1g)yKEGGZaq0cBLA5>nVY}dIv9$&lj%8d}d0$zZ_s^l(MGH)?
zcQkv=_6RzVxGnqA9ov&Rt9f|JpI*BC_(!Gt@vAEq>wlUxdEWA{ps(_xiWWa#^>+y*
z3b+54D|WKJdEm#*d16P)R`*XYyjhphas8@414BrL?Xu0AzVK&jXx7>vaJv}4m3Kzo
zXF~~o#%-&lIpx~5{$Ia3dxg_#%@y~LUc22Y7bCju*~_?_W%)a5*e)$NAttd=JlQ5M
zarxw5oo@=3?XOEZnP@L?crUZfOoniGtI*zk2g8FrChD@SQqa9})#Li&V5T-(K5a?=
zb-t6fd4;aNA=WK<HYlwoL-N=cLrW+9%~j%wp@*|i{$rgy-!rP|%=I20!Q(U7S7w+B
zg)@9{+`CP6?{-_)56f={v;MvnygvG^X4fxegS87k^)j5P__}#N+my-|bN&__x87U+
zqP5t|zKU_>wrkDJt<naucQ^IMt`_{hgr_A=jP?1Igefce7BYlPD=fQwm`5w~kgR*l
z<*xr1ZocLCQ}g{$^6x`QyuMpRty_c2r#k;J_<nsA!x_IVK?^QSXJI`iRhU2dfYw{J
zUa6I{UtD{0D{GZ+Kil$&x#t$YICPkQo#2AUzxys(B%1U3y!TqgEcGG5vXfDFd*;+@
zGW*uJaVhV=;P}{dugTS@oG0$lvY`&I9u{vb^H{RgP$8GU^;%<c=G(swB_W#&*IcyB
zIlJihf>riG*R-okBFdO<zVHwT@69{D`n7-j7J-Yo*CPH(-L9KGY0u`i^ziB5^ORR<
zt;ueUI-RN7`{20CWFdRIVm`n46uxgCQuv#GynH%E-(>FmXQB4p8@<;Zjpe;xn<(~p
zakSF)*=zeZynMRw+^X)mxei~yTu)11y+J;`eRXZe!YMMHp#^3~e;=M-XK}z;AaF|T
zqey`$$^XsuaW{4gzg_u-=YJ3L<u?<hEw(W}oS(Z*_R6idEtfjxN&mcU<;->XrPcEt
zH%!~h=9Mk2nR-radR30L-L56q&tGe3JQ(!+VrzmCKhsqHhgyNVD$2h%i&)fI$6RbN
zHFWMe_vGZt>{(s24=qVuy*Qr1^1@fOk4<8ZGhBc5c%M^0dOUOOq8a~pHFUDy*DdJ#
zC-?2b@%0jBQ!LFxc4pW(&r`g3zaV{k;HKFNKE`bi5-MWMUXYo5^Pw@%yYH%-A1$AK
z^wz2~Ki9ndcX4%DAa`dv%gnMl7E>5jo_&36_JcXAO<nX&W<312GD9jhW|GLEC*Ni!
zN?E%mtPnn?cXeg3@?qlxGA~vy7giP8Fzbq9#E!X41+Rmu{FI8L!qZ=`&8jtR$QJlj
zWcq70<C#Z)K5GZNadZ7S-*({9i{k9;!rwI<dpA1Du6!64{e*Y-q%{kcUC+G6$^EHt
zZ~an}ybBMK7n&8GJ-04@>igaq3WnGAH-G<K7EmYNm>lbGW7Flj?z~Ibwp>+JyX()x
zlr=S2wLUnR&Y#e~NA63K*{gYVE1p$*oDRP(c>7fH>x#I!Z&J1>O-*qXlz70rl`ApD
zuh!mSE+^LmP3bLZV$BaXY!_Lh@2h!#-OZLFHixh~mnK%SMxKx=wuzf{`LDOlI$@qI
zu6&d3T3rs^)0S9sHabY;N7#qBU6BPdjQ{x6UuS1}>zB4dp2uqG?bl|q-(}{?$j)_r
zUw7ksf$XxMmMbf+DrsKRoGwzh)z5N9h4tE^clxDP|8|7-%a@y%mA)^XXE*ovQH3{u
zN@`?e{{MWiyt(}1^22`}-0e+SKD}8lameUEuW0V?sm!nVmtWV^-)<#5ulTKyorz4F
zlyI7w=BC!vJwKN)S*Ks=6?tg){P?_8?9Bd^0u#b#%!|!B=J$Cb>%#~7?DFRqO>W*>
z+t1&!$y#Ieg1=m?%xA=6%qDcHa!ok+e%^-8Zy~HNjMnYs@2c5yw^(#>>+#8)=iR*X
z8=b;8{c5(@fB&35%QE(7oN^pGFJA1v##Wh~uwe0(!w1c+Z7m+APd=yFd(xGuIq8LR
zT(ZuM*Y~P?#Di^Is(JfANb?+?6l}qie}%Q~kMw=LrGHF6Ubg*n<(0`I))V$D-(Pf`
zZ$AF7>`%e3!pj%JKkocjQLfs&cTbd;YSzyqoKoTcce%5$N!H2#n0?Tb`?KL}ei828
zmY;{(Hujy7F%8e?Ig(w&UUlp3&)Kp6^(K6MX#8rS>V(;oQ;j4pt-N(@=G(Og;)G6b
z>pVW^0GnKGzux6LmOCm`X2tk-&5KC=AGv!)$t>gCA1iBLus3}U{VB1FP4fO>qYU3h
z-vuY1ya@SVnLgDs@(H(=Rw<A6!k%>b32pmI*{8m{bTdh8Tf$t?n#T<CYG;4Tm3&Z;
zZQE9Q>&L^%E^2RYEe|qN7uK78T41`Tl`-#?n`<j;RJSi=zn#C0bI<Po$?XA;H~Ibd
z%Kd!n<AYhh9%UEG<;)GT`x=|zQMXZx<MHRHmrlo?F4AX~w$GYb;r>lav(6>JN^rlj
z?-mzZ)!el2&;Kw6zCKnJ`P5;4;8PpJ#BJs$KNQ^FU^MaOxwf^tZFd=2-#&a*?Xqs>
z?ZUse->hx;ct!c)-ns)*)3Vav-|mw-_~gnwo08p=6KrS4?RZ`_``PY9fh*A;CrnB^
zGm*dS^4kEj+xMTbZTr&FXKI_jE$3s`vVgg|PY-xFKTX-Xdy!4l=Bq-R-@1D{|CcN>
zOP_f5$Dy35GmLxptLQ6o-FnY<=irr+ziQpLv_9Ovxm<YOn!n4!oc}!tzWqP*vF)b9
zoO93Q`7ba$f7TZJKchUR`j1ied6Vl4Up=^zcqndu*71oSf^tF)qh~TqD2+VrzC7+)
z)wTyK!wUEqmpIH%H%u0-@;mll=4JB7g`A2!rF*7z$DC#s{%QXAdh$lT>;=tlmhMP8
z7Q^Vf=B&WxbVC;Q#V*r4X4Xp1H2%H&#2mAKuTRXIE~2wJom=d&Vy&jwq%%&t=5GCY
zLj3aI`lbI*6vXaTpYC1#xOVEP$8Qdp$z0W!-c`LpP3!*cd-*rszQ5h}x5o7BhwRn2
zHcN)(YwQu(f9=frRWrBVyt=(`Utd>f`O&*uO1-(~$vQtex$c(o#cPkBS8XlWa-q0P
z-&g4fw`QvU4!vEcD*k>Cx%Fym<kiibmk+N!|HS_epIkTl(|2~Zze+y6YuIz|px&#z
zJz}c!&LoCDzHcX6cOzfRr268&Pwn#O{rdd+`R^rubXXyL>)gvl4?e8#UNp_GC+^Vp
z#Z42my18l%#P2HRCVe+KzUIWN)_3!?&+yyNoA<W%hrr+G%MUjj-|FDI$08eXk0+0R
z%HPTVyZr2GO$x$pz1{QpUuw?UbAJ7KY|mfo%v)dP>eOf%nVP4%eS2K`@>M?t4C*hw
z_#AGoW~{ANcr1qPf05di3(-nXw#+%`+`Z-Cb@LBddZ!N-Y?uAL;OKc><FmXq&QZ!m
ziBYE`O(pE?)|-mXe6VfTJf4`|mgd$;t!Zpa9;UdJ-w2geoKd7!ZFN<mAZge8FYJGA
z-1DFN)*v#Z)G&Kea_9duefz4DmRAJG1)Z1rS9wY(^|vA0s??&AX_M9o`(?8@$gcHG
zV!y_>du_pXzbmQQ|Kh$bxX-!#06*)?nZ9{8J&LlDY?(_RTBb99&klP3ozGt8&HHT|
ze_1N*k*ntmnZxUM(tB6!)#W<5U5^)EK0Kf0u2J+$nTh84`-9DIJ<{E3oWjh0L&V=U
zc45Wdzw36ZTYR*Ln15Y<tF!yL{2ccQx4$i%W3w)V`E;kd@a2t)`fEB@rrkRC?{Lf;
z*?%pO*Om0tuWQZ~>D;}^aNdMd%O73zEqvrI)4Fu0@w9iJ51zU4qbo<ap()?c@0cIw
z^RN=xI}8`jI>_2J%`f7A^R35A_uPZ4OOH$`QZn!r)sj1(QoZ?sd!~`qLKdCJS^}}L
z8)sgfxbvjsukac171a}+PR<Fx$=S5*a-3k=YpcUjolK9<yB}FP#bII7IgtwiGBcf*
z22V{8d}X~b#NPVR`mRS?HXARFtJ);!*r*&k>HEfyCcaKh^M9G2yyCsfhS^_AlI8is
zqm?y=4fgdCbKd9t{e1NL;fL8@jqm-E{(EHaL;?M>;H%E1dsyWkp44xj%lUow)W28v
zert{2v;1&IlFw!7m)>`HjW3&qoGDn)tY=ipkhRcgYmLi#=fB@NU(D20ZSQ1nl~D^<
zdZn_=t)%V2o}HCdYtKDiUjKfp`svNhF5wy53IZltlw91@b(-1gm3917j=Y?dJ&Iji
z)wz22Pj0Q+Q8)YO(w;eH6GF?vt}{GoSQPd>F=yq|ybYPVznVH~<vpKkWfFL`ch^#e
zD4$0$dksHEJ<IW^xiiZpYpsT8Q?FoX*_*h(Y=%yI#eS|WdS#Knr}X8f?!wby(aB!l
zd{0b`*=5%sWL9?j_T|e<PM?omeQU<$)iphKfe(1J=TE<q^Uh9^`Jr{z_v<@&!dMnr
zENskrE*oyLBJI-~c{yg;#Oudr|1DJBn{<3j9+TLbeOl~o3m4iuFTQ+z)%w-5A0-@{
zHSNmtgz!h#z1BYR$k1)tTrJ>wddIAf|H}DIA~qOKW658)Z_-X3!;%v$kAnA@$7wz}
zU3Q4SDLn7xzviy<<$5n9l62nm*S~qD5ZMskV>$KJ9QnLi*H!AJ82{K9it6;Zl^xc8
zF86C!_40ZCQr3pQy($A92Heh_%V;0(wBqscZ(HpO`?~&Bm>s$OsOh~-&ilso#a*1;
zhlKY`El%4MWdF40la=Ozl2nzfcWy>yvG=Y`_!ky0TeoN0BF3w8c(Z=Rw|{9cVlccp
zKlrcPJ15gkVOO{Eo%^g8pv*YyS8AZ=eNRJ|bhF^Achk#lHvc}le(HS%=e|1!x3Enz
z_;aARWar<5(ouW$!`<JPIv0Q3d^5)5&J&54A|tbV{kB3SvAo@Xb8BN(Gt{lCRli&!
zvp#G2AI|C8^KYFL7BT&ty2!_8&s3=;+us+6DJ-q>zF1LlWSi)O?JHxYuE?{<w7vD#
zmx|kxkXTYS@7exiVg{mrOIq6VFIxvo{Wb5lT=o4|5trTex$ho?wyUp_z7VW^<l44N
z*6o1>+{xB5);=k`3zVvs##DMSFLKWfiT^n9<AHyi;u0$x3Yz6JwtwT4ITtB)%yq()
zqc&NKV%g8_TypKA5PQ$dz)tpxOO;~R3dJjya<f^_n;*Yo_ALEf%V(73eR_1kZKucN
zgBOhDr+Avi@A_r`+h*;CqNl&Uyt!f7_<Z^NZ~cq>m$R!MEZE8wI^|`ki}|5V*`;x3
z=H9Xuy|g6yUx7T&wYl@8!ski-zZbqZyeh8wPU>eij#k^b`V$wNP?TE#&|r?fvbE@$
z3zLrCn*X%6|2MDw>__4}2icpsonz_+XZGZ)#vQBfT@!whmwkJ}mrDyPE!G{W6ZP`&
z^0*+LcD&@{vipZpu00W5FZ^!pRVMTQ?=#+i`P_ba)n2=mjRy*4Z%<)6X>RbLI=ol?
zWcN(&|K(3|J6w29?se&FyuaFFyJp2x%@-e*YF$q|DED@0^V;+*YtB7Ow(2^za#e^X
z+_YPA*kxm|!uz>DAAEjRz?a_JIa9~(YH8><(<e{5kM4BX=QC}ahW*-{#^>MKw(aQ<
zENnmhA!z%V`F(X33yiup=t)d@a$2arz~k2R2{+~6*4|@Za&lj`!1Kf0rN1+@R-5{k
z&+E9gSJ9up^I5n0+F%)*UC-A|3=G#;T(wZ|TKlc3HF`6zBrrI-&x(0g8~>m*{l$uJ
zd!|S{miPTQX~H?FT?<z&*1Qr^!!||c!y*5`2NHMp`{)_0eNuLZ$trIj-`dH$wgxpU
zs148XUHc+;Et`$b<m2nKk}?_liZ(4QJIc=bZpk*i%0mB_+l==Yp6}f@W%~r41h)Ka
zaq}rjs{{AGuoOAqt9<-ZWZ_jU@5^_Xn)f{@m_57olGV@C@6C#IZC=E5Fdfdkwr{Ij
z{_+<cidr{!M1H)cU1~Gyp3$cFp9A@PrkqdY*3PkXPj2Hf*Nt;>kE}}U+k0$-q<P4l
z#kae*&fi?XRP|fI!B=v<Ie)HgQIq)jg-2W^X3Xr$4lU_c7g@Nw<Up0Qj#qQT1J-T#
z+0-x2xh-kpYxcg^DzAWH?cePS7BE<OXhhw-)+A{dx=;1+*^1ni1{%B4q<FL2C#W1S
zOgxmzel+WVe^>UzxrctO<1=`k<~cLo;I9K$U$d+2-CuSKT0Z1tz1*>LmnEl0a$ew~
zV;|F&EX#g(vvh~Fcup7pyRUVttme*g{&(g<=da&YhdK7<Y_xMc%4)K)ylZvXEIvWb
zBO<bo-vl30KmJE(_u5mHb3bV>TeWIisz&R-V}9E>raF3Bu6)nt7<|oY<Dr?G4a_RC
z#XXGA^e?ha`?ZX_Ct8{*R`Y*}^tLH?ZvKcz-S4vP*z@WHIR=Ic<qQlW45(KjW#*L>
z<%3rsW*6T+G4cLa?PZTvGX*RZsMeplD`;-f)2(|uC&k_t%`PrKx?zWa<&+IfjBE_4
zhI)U$zdpXlkU>*@r*-HiHFjIu-g)!p)t&v&`s2&TxAk-D<JYC!J^6X{)-}J2f=_*O
z+H+5IwRPn`-+!Opv{qbx!<SoGeZ4zBZr`u3mVcg`Kl<g@C7*KrN|LU8%GEd9E<}FW
zbYtG!+*@hd(@vk=cYk})PLZc&*SGA|c(v<g_r9E0@7}x--~Z$2*Vvn!KjIbNrEHzN
z_C;9k&eunmWgfkHyIg8x&hD5P$M37M?8+Zqc;kA1&dKBZbi?*)WHa0s3cL6=ynN9M
zm(a4k8D@+0Z$;lMH{PhJ&G~=Lthao2Ta$uCx8HrUW_m3D;p^EKO&6^!{<v$E%jWmx
zzvW(PWq)k<m%k@$E4#;8_2{~c-JABEJ%8@ro7-adc33&M|2Y4A+1~dYo7j)-(SJRk
zyD)goyVSksj<RQDTW@^7WXII4Io)yV&X?tW-rORtaI2%EG+2G_ils5kLQ?gYpBzv>
zdLcCU`-f|xm5U{BohrS_)R%gFed8PBt9!CmaYc2WUzHjA<>)G{U4FBc%};#y<@vJ5
zie;|#&ma8fh);i{?4wk7>A>BC4_@$FKVaMRCrWVU>wV_GH$|OqStEaH+sZ(Tw50A&
zOh3{W-4v{}Q2ij}AoD2VA$#kx2FZ{a>t5~4-6gwUux8@hbyGjwpILGDYyPaN*hkIp
z10z<veD(JIjFY_0F;_LNt0?|so^z)^w^QQkimYR2tUrVwol~P*E>yVIYlZ>qr?Bm^
zA_1A4do&XciQZ|Kp7Z9u`Bf>-{~PzMpMC!8{O&CMQ2V2T%>MEJHTcuhpSs07zyAO4
z$Ge}-zQ4cs=i{rt@5j#J{Be2ps=cl&r=(x8P&o8(QJ$5xa^MHa-|ON`9iqFECMu_g
zI3H_X`;_f}{F~KwZ&S85YVP^@lZm4`R^F)aU-Z8t8(i+Ng#|>G*9NXn;o9)eJ6%lZ
zf5V#E=<byB3MV5!D5z-3Pna}!u43ngJJVHCy<=>=W1=-{n_7z$ckNS+dKfPkzc7E7
zjH><rotoLqcEX&AR?Aa6L{ug^%JAvQCrmuNKeMFgN$5YL`k6k-8BgQCZ&-BQZq@5Q
z)d3mB2X=f2I5+uz9Md%xjlbmqS56+9eZ%~08F$oCzxzUL+P|Mpn)&Qwyn)YlB{|o5
zx!=BWrO!UPX~nbaKcz1mKkBRc{PR(sd4D1fH~-ufbI{8D@9qelBTFmpUomQ0mp9G)
zbzn_0_rDVsN3{PWq;lUkIsTnV;Meo%N+*T?8}5^`IadFN-9^P_Vg2&wyk8c)30ix4
zkGS&EY5N=9^B*2&@n@@F;>iAEh3S8>|G#xo)|{#d@!I?J{wMbSiPwMfALZL>ed_KR
zVNKQ64M(=_J978*r0f$r8TVFf*S%GJ>BICi=a{WR+YYGa?LY0eEtOH&^OvQmM^Vbw
zm-m-Orfo>tzTU+{dS7?9Nl56?i!0l`Yi8}LT~oBRc1~E+lu-5KmJjzd`!ju-Z~Bw_
zBcJc=sUqKndV0!w%eZfdyWLlwaEawy-~4(9kDYbg+A4FUnJ%%ET{$xUxJl*i`|nO9
zRQ`QAi%0E;$0y$~&W6cv;@2_eaQ@w#^GspOX5$0hzqsC-K0Nq9X!n|~w`ZkXq^_^C
zJ}B3|DM4k9%T`Cfp4NavO|EUlA7)&g^>VvRgHEAwY}r{kHAN?Z8;*PLT#_?(5}jT4
zH}+z8ZlV6sc{9(p6n!tWiv1GSlfLc;YtE%-Z#hg8>ejV#8_V3V*?Q+=dx7tQ9~ub@
zPl;{m=5T0lW^9m6UnV}uUY5hyj`!}W71JlH)G~2Ina+FbHizN$y^iX0!H+oqaz0+Y
zRQvj4r%Z<!>-jz3mdPgfyqs*cOR<}8@10QBzgHJ`pHHoCkI|UuSQ{8NndM@Fuu1O0
zRGrr+bYd*+q6(Skb?wNuy0L$1e?!Q|)oL;#&PHFHcS|ubP4RAJyUl5$@#06s4}p&s
z$(2nD=l65B7uh|YeA(POaN%(!of{K4zMhHy+xA=8+pTn#0+0E@!kIUlCu*4Zw5Z*3
z`uZ<bErD^{NA4SYt11=k?t4D?SmnDev3j@rbN(3H5A!c7YH1a0d#HKpu9$@5Y5`Gy
z)xshM?smo#|Nl*wzt?#6|4aY;y4J;iSM8o0TAJ6mJAPs$+l^^y3#OF0Z}|4rZRY;4
ze!EM}2YghV`*<yG)Gg<=*~S<!_rNq8VSd(i2I9_fO{dr_c7IG>!uUb$`EyQ*`4@Ea
zRdtj<bWT#0diT83RA<JAJGHY#ejnyi)Y6;GcTIPO<y*O{A`)BvstPXJv+(r$hV4ae
z7pHhD^y%F1S=%X*r{Lu&kPv;>^r=_bbXkk;1(jFCR@f%Z`Q^hq^M+s5gC)lr+>P=&
zggiNq^=vuGA>98_K-Q2kXwKa5iaX~;`yagz5Rg9aSTb4DO_k@t=2skhMPwGZ2HG?f
zxx7EpYwmkF)F@WfReqVLvBCL8?_zyf7HVFQe;{wdb4_I9EVZ1&EfaGq?*+s>n$sM2
zIV7lEwJPrX(l4c7cUlzu;eNhr+I-&xUJFm74Xi1uZZ{g-Zp{k1(6^^_{}SFuQ}u;c
z7zPxU-n_DV(<7beJ69HN-R<-5@YGv2Gj~q%G;6pg$A9bg^<(*6kK=pX7Eig{l4f4*
zBO(yEPRO5c7kAwa&rFdcJ%a1^M67+X&R?|R*{mO{c(1s#Z!yk%eC<$cXYAAPJ6-pl
zH@KNEX?XSi^yF`EV%9HtlTiPX`T8s|z18;2Ggt3b=XqE1S>aGpwZLV|JC~l%-gV;?
z&)p0Ac~r7Qm^ai1+a;9?Bsnc{H2l{l5!`F}d4<07tJ>$GljDSpR9<OtrsnCWHdq_o
znyYglu=~TS)$BccEFW8ad$eJ~zwh^=o6CMn&sbak<o9pp@`nfRCPq*FT5GT<ZL0B{
zhjG&<-{8@>!k~Wf25a#W>+03g8~CPwIdIReFtoq^*@KzClA5}Vqi%8k2)@PDw)Y2n
zqRY~xAL%)dxR)0e74Cl3_-oZv86|}`JA9{_=AJcZYGPly;fUU0Tdoy5w-$VGZMbse
zaV96n>LT$R{@Z331N~FG->3hsIxBql=U+~)oy&SQyKi`7z&B6rcircFPq$D1Jmhp2
zFXub4E$^oJ>9D-n>@$D9n7=1~$=RE%-K$HO{~pPhR}(DZIDJZ4^Sg5`$<`NSvm(8@
zEP6{B7<A7SFI8ifxcce<YnEyQ|GZDyJZry-KWabxPT^Yb8v{}HX%5BF)9WWc68>5&
zCi`qP7vl?yNB44CK7Y9F)cV|{ze0Mg?rgmTjV}@nr*2E>tgXEG{jH@2!-xFq-1%86
z_zxxVL>o_#p7C35%j)cDUh6Am4EX=#Np~5=#qHu@mkOQWve~+6-y4oYGklpP`vOIx
z--{`1>fh-0bnO{w#<NG8m#3_GQ~4^v;?xYMfTa3ORu9fT?J%mal79T%p@9AH$>X70
z<4-R=mGpW&$J+Gptq*T#K1+VqozuY<Y3hIH9p|g`DaWtm+TNP#Jg<4*6`3>q?^KJG
zH{M{4HjtP<>zd?^xi>@B@0?lZ;&5b6<u=2H+bq1<IyJ)T%8!>PrZw%9_2fKs=0)6$
z$*T4pMeO`Dw#OXG^7G9z^Ii3bLE2|hs>##`YrdcR^YV=RazR18Ns<8$KK;qeE{80Z
zS1N4b+&$Z5cSTk4dr$B9rWOPC*=-T5x-%XxS1gjt>pX8%VlnHL<Fc$I+1Y#w>}>Ys
zZ#C94p3lCqG=o1$f2vDMid%oTnaqCc+DDBmr%&b3`kL_am)4$yKr0QgC--*fnka8c
zIWysn*NTP-$^j-jdLv&O&Y5@Semqli?bIm?&N<pn;h*XswC<(nPQF`#zg}|Ib$khy
zW|Qb)N!`y@@MBh1&3)0!dY2a`J5RB6XWr%7(Aqn3_TeDQ3npndB=#|W_UmNrlfQUn
zLrwnoqq>vQy%?0D!jINxMtrqoT3Re&aZTw{P571ro%6Qu&}dN&tL-{4!%FV^)jz$z
zHJ`{oS4cXn)@O1k`FS+M^IV%Prw^$8J!#V9d&#Tl+U~!3?#Gf8GSrd_6X&Y4zsP*3
z87A~>VUX9{D_bV_e_M39Fg`U+_+sL>o8j?hWtTSZePX-u*J%rm8C|A3<Ceeb5I!m8
z#Tv7#taMBNCD%KisVVypZ(6b{^PS;j_lxF1?SJa#L@$U84wSujLvr3h-wxGRQv6$9
zPAQJk3fDN3y8ChEJgs+ZEA^g96)xXuXW*B$&EUzr2La7GMbVdL_MDsdiAy(P0(+tI
zR#(p_Pa|9_1n$au>253gu}-B}Ect#$qF9wf*5&yJ-`&|B`%_`{;WHr&hy0ozvHX9c
z|Fu2*r}@wQ^N!rQ@SeT;@b*)E8?C<C7;$aZh@R7DtzWjn`O@NGOR3TmcWOl!_cHO!
zEYH2Y<)8Mu18X;0*F~+nX%w#V*o1AVsF!Jq^Lnmt(IK9Gwi3*%SrY2bS~PnE1Rh%U
zXL;@2>Cv8FmWnJ5O*-nvJL%(P4q5w`J5;ZkF4+EMvh^+hoj*?e)QH*e;MCnW`K4AO
zzdU6GiVw@?cuV-%XGtCr?KBn5xzO;2RXK|JzN<9XD(02?x<-*#@*>=Im{Tn+JhpHe
zIy{mTjPg3DdG}HK6=U%!_jv9dTm317t#O;hrh+Yj!ACg19$6#w+;>Xlq%?I2ja9dc
z*NVhmZC+caHleGr>8iobndkjeUM_z4Y%yOr|Gj&r$;)+`g_T3<EZHaQQagHFky}P=
zLPEl!HP>Cj%L5W!oa&ynObwoDe&%55srOD>j|y&a<YiCVs@54>&40J(_L}cgk7S0t
zjFO+oKe0f@sMs{HL3!5g1N-abl$?*gGjGgq+5N9M=F=e~4!h~5zdpwt5?*|nxnttX
z<Qa=DxwpDh>89(2nXgV>t@r8Ox|`wIvSogo4@z9iartxotzD1Y)r@$TGQFZNiPp1%
zZGPM+l9RlqAuLt<@5Hqe|J;sC7gjV!Y}LO|;!wY5dQL$_SnK;H_xMRdv-gEBH@|<6
z`)<40rwG=Y;Z^VBI{q%p)LO;xdC^<7g8P<z4Cjv91jc-xTgK|VD(9UBpTNh~-)V<u
z?L6?ebXS_P%nZJRFYY;NZm2chuk`hO5}$xbh0yt<$$R<cUwmht@FnJFz=G4$&#(sZ
zvv96<3=gaM{rKwl>*4RG=db^_<<EzYzg`{w?XMFaa#X71&!Z!APMEEnbzARbTi?o`
z#a1PMcij$6ouA^bn0lbn_dI`f)W!?W>vkG{dOnN!{Hg3hkLomkk>>TUJuTa2Rycf=
zb$ga{?3r!rE#`N>Pv3ob;Lkjf-HWA7x(>RqXdO;;6Y*@h)hFi8&o#?>+4sgxr9VZK
zLf5xjA9SwMNNp7jJ6y2w<JCK?Vxl7T8)EDN7Mw5J{l;in!&0}<sJo|~+k<>oPrH8h
z<4+U!x+_-yTmD2e2qm~?FmF7p#q4F^m|vwDJU1n4Efd=zWt~9BpBJZ@Sa~<7IR9p7
z-oeS4;5UDv@5F|NKba+=mVz2<o&?>`5MDj&{HEA-2Li&kIoM3#VcNiKarH6>qrh>;
z6H8X`pA5Em{LXV$Y<}d=WcAzrwcJ4me9pFA_DRjO{iVHtO~B}*gNNVp3-#Qm0>r**
z{>Yd3GLv~v<~H-Q8davVKf6p_e(_q*WcQ~A8rj}oRb<n2Wp0I8oZ_6aR4;Rf_5D-R
zIzO-cR~TLLz3Wxxx+y(RX2v{>ti8MK=tGff;v6%06vECYh;?Phc)L7L5Z&XS;r}rH
zOlx@ifh(t1$!JI%SbL|jlIQ*e@w^F#7B}pPl8M_}EyHzMZex>(_||FS%XQy8nN`Ns
z{^@(~wqntzJWE$jUG?TnL(R_p4YseAoXrX`)mVS|9k0K^jCI@oEbqB~vS35rhqSi%
z!-`X_<YX(`s)DZacYku4@_9P<TC?LPFA3I6H*s$1eP0~yux9hd#qlr2J}b(+OT6_b
z)Y`h_u!~UT&n3GSK0Gwbe~aeK{IC-rb#iZCwtKMSX5Zpxkt%i~&$yax)*I~<EZD*O
z``$uU-X&j7Uo=0h$5i~t<#Sez@n^RXr!DN~TAZFpc{4P{3!m=|;+}Z7!<Tb)LIGEs
zmU_v7BT+ofk0+WjwJtN>kx+m5@!Q&8s)c;jD!*!$+f`;unar&Ge?wi%@UK%$XYUkI
zslLCCvI+-067}}A`j@cmS^c4-ru4+koKVS=+|%t|J1X2Z47U{aF13+WU-0tNdDqhQ
z_b;wh4u4_5;?m`HbV5`lZ?acU1@mctWvQ>i6Z(2PpBY{Lp)=d4E$G~<>f)uHoVELY
zOkC>NcjCt$@uVY++lqg_@##IS6T9F6&&y@aPuwQX;@x%Dx8Uxv=bQF0H0JO6WLU~1
zx$E*Hj^;M^)lU6Co><wHx$94fUwUC)*oNb=wa>j?CfCd~IoNEuL#U$Hf+>S-mUabu
z_pv3PcbxO(_S<q^L!dcp+3`LV-bcyjz6#VOF8uenVaL0)r2dJ2*48ZH<XRY7yoGz&
z?1W&cmoM#ml^j+^l>I)ttY%5U>X+|rJ4!+vvss1u-q`o{t?8S*+cq?~=S*#=uCnc&
zZ-w7@(ht~hcvcrp@0ppMezs-#`+tRsChNnl?wxT!M`zt;d($YB*7M=N%y^!&?Y&#2
zAoG1EtIDrO3{~s)vlx_lo&NDgy?ns~GuP0CCp{DLoEdgs63-VAZM3?t`(*NRQFeFn
zJ;DnPGd%2E%5?nnMCHl9_Ee=UHtrSNd8C%HN4rP&fqTp$Gr2|jRwws2KjS|&`|`_k
z=G6xCw_T6p5>fc3y+=3wujkY`E)5@*CcFQAP`-<SwKL|3x&NQfvcA4rZ&^NiTRf9W
zD->z}KFfW>)1$uELw?5vIayuhG}~Q1`{y>-`!@@PE)~w3cWl>%+Us8{X65KR7fzWo
z@utkfv&TBGN}6dJn{Qq=Q$3r{|Hgi^$qw5MYj^Ljb<eCdx;tt0uZ1hT?EamO{Gk6N
z<@Li&%kPx-PJ8u?IZj<u$F_Pu@4WJyz^@ett5UC8IsW>=squX4<E&iS;B2k#y~}=W
z_qe)l@nwtf?03GB8QQmEKV(FtH{3nu$bV;RO~GX&pTpOeRa}#KvrpjjBvHGoFOyuN
zQYYswTste}p3nxx=aFow2b~HYX>kT0+@^GP;)bos+U3HJOy{1FQz)4?zt7~1wfF4u
zX+2UGE`9q@o-+O5^@hkjncdgYrZVTedEXc_T|!oQjn|2lULm#DzAiksFHJl7+Pud-
zD$g^Vi%Tre_^kQtyP5rc?gIXToh#p1>n$&kwc5J9YuU^li+3+MQ7RqhIB9lySDJ^+
z-O}ajmK5o);5u>GyFfx`|73;Ym}+CeC2Z%S_fGt{mieQ(dCkMkEVtY`*p=3Q7M*w4
zXHIROQoG*gXU&$eDONj{M~G|Y_qXZ$&yrj$YP`N+Quaj7V;)V#)grFW9B%SU%-fc2
zEM52Tr22Qg*+)Io{AX<M`B{J7q|o2#W%SOy=jQ)R*ZQrtW$!%8p7+JSf|j3aJL)sL
zch#5K+7i3l`Ig5W)(U9<R=Md`Q6a<OKSBu$TEDdf&Pw_FK*H;N&WlIqqnr*GaZ9jU
z70!^}y?NGJ`JnGpT$VH`zIh&)cS`+N&4;jxaz(jG&yK&E&ECjZW3&H&z^mEp7vDOb
zU-A6Q&FZd+hZY@u)a7;1LRap|I^D$oZ}_=<>Uk4p?Ta++;WC$KdA#fl^Of1GkAv>p
zaNOJbqhfB-oLtTtqu_rRTinfS*B{%j`1pTXqHt=V@8i%cmhbw1_bc59coJl@hxr({
zzFg-**1Fx2@yWIqjYDdi4We`!%r0+j&C~E@zmpRiVY6-JN~XUPTj%cnS+<a`er2`o
z!Qul~LRUFwZIs(0RR8()Q{R)>k?9+Jv-eD{x$;nR{dBGwGY<ssF^=X={=0Yi%IzCW
z#L~aDZ~r7S`|rljCj}qcDh7S1$@%v){q?#VlGin-IC>m=W*FL-xMlWxk;a4G<v*(y
zEclUd_sUbZN2~ghBA%>zEHE|s_xX6;ieR2gZ0F@t0}j0kS-8;q@x=G`Mg8*ZU-Pd0
zxxl$rVp50eo?Q|vmR;QR#(*zv`Ip28t7PWy>*G>+Z+w00h50d)u3p=GO6DPt*Y`h8
zTTaSql~rE-yxv?=ukGU1BhCeK>NbfPLHbkH%=Y?|sWS6=YDD~Bi6!Z~T;IHS<RZGH
zo}v9DU!Trn>mNm$K0B8RtIcv>$5ql5q1%~ZZucy~bX#rvae*MyO~UUC^<`dnM?RnU
zuSMb0slrotK6?wtL}fJ_9^wlB#^w>hvr@^`GH|ZmuEKS1s`{Un?M_nNTJIkHS^ejA
zTM1SnmbX>=S1-};tWjT6?#J`*0^h;gQ}?V8<vC}@Q)6(vZenYeK~dz(HyvKAw|Doi
z$+=*?<m7L+`>rYlcOU$H`8s97+Im;sknh1Kqjt8*%1YOjUdqrv!e7yva=)Wm^QWBW
z&xl8y-=k|&cNWhLQv5LMlb6;M#<L}JjqYV%$#i<AFTUW8>3Y4N^Jhkc-c5ZoEn}*|
z*SP{do%}&fOG{rhE4eVtPqyXY6y&k<Q+BYMZglkP^lMMuYSYiZO!#}iMdb24w&!sX
z$*KCyep`-Y#C-f!bGy9aT&pM>bIQM}g=X{fs{6O<)y(MpZM5TT`4`z^dOOW#XTHfV
z_`Wqx(L#^?h#6<-v^n($m#M#Rd$UUOTD<?x;;9yMPh=&$_g=gwAw^Qoq3I@j=l&zo
zf#*JYO<5#7`>w(_pP<$&OJ~nrwDs=wV6GG4!YdBiR5B#iY8?2?yX5Fpi{h#CX8rK#
z_Wz-v=T_$N|4G?}%4LjSrzY+2TX1>(-H9REzVlZG7KyA0nyaoIo?UADUh1gvwT$cX
z_v#uFUvB3!+pvUtk0Rf`H?K=KFVepA#LD~**Li=wA6=(P{-{J%xHrx^X4C0+R7EQ-
z;YNC0Vc)9SM>=<ut~|Rtk8ht?#fl%-Vrtu49e#8RRxFS8FF*ZZ?wLQo1w@|S^?0!&
zKmY0JFBQTD$`=klU{?yd@%Eq_gQ+Cji7#t=rkh<q#m>J|Vd5K?`7gDEUnd5d7Cs9X
zQ94=>6_&8XF!-`m)dO2~vxf%{?rq<s{ktvCZsu?MZw*h|l<mJSko##bHZkp>s%8zZ
ze8!T)_s^7y|M<R!+kWbnW$)_z%sp1w#_j&IOsvn~a^_;4!;h6i?!|}H{QYB~)w`c5
z=-NR>o!o5+R~=S)rt+k$PRqM?VW+>rmIFOomwt~v%KDz6B)aC<p;arozUO(et1T>N
zIdGv>X6}(-cFx#8hxoThKQ&3*%gGiHcZpwJqr16ZCwbq`+ROFrnynAsY`V2<%Qg+`
zkb_aCS^s|do4!5Bm|^z*%KJSxxcjz5h-ZbeU3Ys{zp}mc#)kQ;E+5NLl3QS|p5~jc
zl3N;nWqXZ~+~N%xw{9jL{G|QcW+oS-_N2Y7M_1n0_b*u~D(IK?SYl>)$YHPYFYjip
z)BbpgDJbCYhc=&&l4g;`f^6Aym`cL8$~m6n2@cNXOV}RtxIz5MZ^i}|8?TA#mbbTj
zynA0)*gVZ_>jQxqwJ~>3Uj2Kd&g9Qt-ur=HKJcWRarqjW@1-HGyZe&P?+tyAlAfNQ
z=+tm|$&%A|?oaI2(Eg~gXW6|H{Y2sapG2Ck*OX{_d#J1C_*LXfUAzDLOs(R*nfK$0
z;t%~*Rr@6=b!VE6eW*uTQ01)4zF(@9<#?I*E*Jl$X|?T&)HjZE2VME+C9&!hu5I7^
zCga9qudEOOH?h}WtQI_6p7v&^R{j3y%U8|*B`rMRuw>56H80NRdhVamIN4h;>i5U@
zAMYHFf46a&VeTo1k7r`mJ@0w(Yl+KugNDWRPt@NXm1w;2uJ4P#0L$Mi8&;Rbnh4o^
zpF8Kl>Id@+>x1pGcHfi~{~=w!%6xZC@Y~(HO@vDrt)-_vb^F^E;cl<-Eav0ol4o2+
z-ZP#}cC}SxwvzJPH~m{kWV8DLckYABPyc@7GkZSA>{X1{9nSThTE0tp*XyO9qeZIb
zct3wt>-ubI`mbL}|4RQ&p87nv*JrKz!4uZ5!BSGp%!0p{&EymG(|LH4<M~&kfS?0L
zi%-4omuHwCb&v0?!=}oq2lEg1$XkR<eVj6#JFc0}JA1Oj)#RnGR#(4Cv3bAp@x3jp
zS1GgJdZYLzbJFkQ@pDuJZ|)UOn!$fd%-&o#HudImw$Fc5r)n*Ho_WjYWAw*KbFWOF
z*}Y(mGDqA|!986H46HkLNh|zN>w6&G>yVl=r&j4t=Qcx8NB6td|DJZvtaeFVdF3+e
z)1<GZyv&l1GG#+$qz*V~$J&22E;=7>uy9#{SLc7rX%i(g<J^QIzi69_mp#_Lx=wt_
zdXe_RZ4-BO{ylIq*0LtO_w9+TT4#)YZhB#qEW1!D_TuMk?dI@D9gWiyW?QL<>^95T
zw7Izc&Vnz+moGF0d~0~xT5i7a^;f<X_J<}dwl|kp>?!$ZPuSK)-9qA#p|iy6R-fDR
zs$ovloVY#FPdi^+{IG6@KvPKTx%Qu}!TmAEj%u-F*W6hm*T1LZiNYe2521Re%76NY
zIMk#XdTCT#eZA@N<umb_Z)*20Oz*XEHjk=0XZ!8gw#Ca<yi79*Df?!RIwPGfe%NcJ
zC<B9kAOnLC+KhBge!5;k<y)KV;>Tu_?*G&l_{qGq=geI9SFgOnZ*@KX=o9mN<KAt?
zC#Nn>c2r3zY*!Mo`xCML|L-z$2O$Q{o5p3Yz8zkfro)wCB6s(NxYV7*=gZ&M-?sHq
znkbs|-9RjIrjF1={~PyaxqEN?ZC3I2?S|T&`%X_@oqF=#zPitO;{W~}(3{p&E7W=>
zLT8<;)^+WSGhPS7=b20J=uPuH_~3qlYPZo|X~T0}lhO_SQ`K&G9ShZp2<@0Lb<*7@
zo|+L_>(@<sbIN;D>zVL9J`CpbPp`W2_ep3N%bS>WEX{{Zr^I^(Cj3@9)q3JsTx02n
z=;WlrNyaZG2UhahOn++BAXs%zX}Y#pTlcCpMS^WQk!w@qoVtCcU8#LoxyvWz>Z-bF
zu79VT__cCJHrMGC)mP6;PkGPrVczC*H23r3S?h}>I~QfFUTx$l?NXjSheiKJt5lZC
z=Ab*%GL6=^uksGFc^s}39$=_nIpx!$hL>3zmSvo2*p<14;rgB!sU3a~)z6e4)NAVg
zZ)wZ%z25G||M!O<_Y3zQY>!$Y*m^<v1NS=ryWcooO#gf(+p#%-Ki+xHbjv?hXHzwm
zXZGE!{KPMKyVdRS)mhJ5PrN>6|Itb2bcDtq@%e|96%6Jxv->7)*`H!C<@BO6$Iskv
zF5D|V@l2&=as8VT>*Cw;s;-_EA0A#>F{3h0N9@3XhrW}Jep)8ccjH}rV|mJ|Ys{Ln
zKZ^D(P%C2a3Fx|7AhP6>+mpkBjL(>MXd6FRe&)JG?N!gat|t;d<k?&EWM7_gQfF`S
zBe7$V2aGT09y@S5r*!+iW+sMRLaNapcf_9LSaIP~qmyac=iM^DSnotwC!P#dD}HFk
z#c(U@@4xGlH-GP9iFcXTDe`Qc0o$wZySIl#PBF~8wX%)NuItmDp8B@l8C?(G%{I@9
zbzph$NHAz`$bsq&pL^1NA4oD1ozGCRV#BMA{2RY!ESYv9;wit4ZcE(u=Er;I_wgM%
z-<~eM|BY;`ID7hhzW#>~zr0EL|KN{|g>>e}U*Fhy>vtrmp4ifH*s5uUfTZD#=iJN8
zHH|(uscW7vxf*>iuK(B@H;2qw=PJLj&dQ7tT9P{H<CL>UC&jB9nMX2qT3?xL^M1aH
zpZ<<#nW{JJ3p<n#a1^Nv+$^1RT8F`k|L@+%pAY|?oLq16X^+9lLmG`=zkKJfotDD3
zfn8M5;8SRj-fGLH8k;>oeomi%Xz$<d!;>Eui{JU|5whWf%o8h)XS)@-_CH|wccAIA
zOP{|U-*<in(W@U;O_|lS|J_{K%ZJLc_|Bd4J6Cn;zWkhdvTxo$^q3R%{<vGtRpmo>
zIZt`=GPTrjFx4^b{+`l%Y1VQLmb8Xv5+y#|%GaJ21-&oibxbPY*xetVDXCY%^5{|C
zET$tXG9yk2yihE9!Q{!dHtO4<U#^q5R+kIRQIO*Iw{muv%5W=xD_e_={#v*0kWZT~
zCou;5AC{h%exS^C`D+W!3D$?xR^Pm8kTz3Xv6E-{JFg=Fau*LY{wz3i)k@T>hRxC7
z_8zNN1F_|DQ4%M)N&@)S#+gsezT$RG=Wp0e*5yUIM*C+PZRP6svul&@`)((ju(?*{
zd-}ZVS3ZSjFuY-UwP25K?bRpl?mrVHyDs~*Mg8aJo~Y+BFOH>s#exK>={KIQ5tZQ(
z`l9#JHLjCw&6)SN%zo@twvGB9^&rh(cEZ^eqORM{F^PDo>`PO!ERgUhJg{%!eRZFm
zPp3?uzgcen^)muDH2*C2a+qYg`LO2K3CGgX7j?I?9=Q@D_DK7qgv$y+%imK3`exqS
zyd`k^!ty9()epB{FrBduxHZ$$&%0!+$7I)T@uxhqF0GJ$yY6Fi*c{K27QPFYHY_-j
ztFmJGgy$O)9}BE`cqjLozvrua0{+o~Y=K=<BqAql<!oVF)+%R_w6>-7qLcIXO^ws|
z!h@Rg6gF>@<1oBYwV>(0qJ!1MBH2DQTji`Sj(mx=Ni&{5J#*y6{CBlB7R4b;yc@O|
z-u&*k(Qk6mjYIKSI-AQTF;$#*o7|M4!t;WO#r(8N6kn~*m$yf+TvjRglItUU^;m~|
zz%SV)0nZ*>saUwE+tGJo1&?iuB112e!TE!?we{|wxe-4jUUX;w{m&|&t8eGeyFH`8
zzwu}L4}(`{L>KOA-o(+SU_6~ys$*@-`;Hy5Y+e(8x+f_7@|oN(b31#Uy2gcLJWJjS
zee>J-<iWgW;i6&9y>l!pW-<0$oW&B!oR_sVtWS34%+>_+29FEpx%SRg-BC3wR3=4X
zjzD+R=7zVXcavBz9GZLNLCyg+-})`mF&*~>l%{Qo2-K?ZdmJ#&gioh=Df?y7o;aO&
z^HV1sJ~mqYoU|rdAg1n8#)g#cmTRoX?j~(h^(f>0VtnS7$GZ1zvSJsm9B4db#&Sc?
z-r?a=CgtLXZ?^Nl<5G%b-+hrmRNH&KX4Zzn$`zN-`@j6O`Bj1Wrr+5u%cG`f7N4EJ
z@SxlRrO7#2PBQc4daBJYJ>$P65FFB*ED@=~`1tCT^{0-$tN#^IWZU|`?T6ycvwT^C
zeU5E>!m^X1PfWQcvsr6#E)NrHiD0-4_ae)aE^9L6ORjw=eAp@f_S53d^cH1}XP0?4
zT-JE*sVKAH;i3Nwe6zYVHD%Z6UaS@|NczH1bUr|{_tVWafjLgMlHYUi|GB}-v?zCj
z$Lb`@H>d8zJ+R|l^|G|6uHndw$?XqRau3!Vc2w-$wt2<cg2_6X!t<K=u7(LTOxo_+
z*YtMYjei%-ggKduf_qm*uh!+gC4azRg+SB((<;)d*pgXq?&5k-``f&3`a^fy6|wcF
z^fI2W{hqMn(a-5wYoGHa?F-<$EH7H3w#MV)j9S5@wbv5P9C#PI{Lea5w%JDyo?Y3y
z@0f7z^p58{UoXBj?Sz~0<qbS16<+imSY%z&vg7aR-<}`xJ{o*x7R{Aas@X89!8^^f
zrEo=WZQrel3oTlo9<=pa{p1wGD($K_VSg4Z^VsCIqj!?hNrNbvPQ@+moHM`QFf*9k
zu)Z-esinxw=T`GEE<U?1fo2`WuB(cd%AY(ce{0Up$R#5adVC%0jA^&0Oy7Ra(K{>b
zcicy*x0`sb#T+qB7d?^kcVk~&D&yfBR~`r^rd#Jn>#lHNiaIdsgu~G&et#av#c6KE
zi#UBA+P}LlaV4<l;ENC+&gN;SuQ2XctO@8+S)eha@sgB!YgtaVjrfj#)1-R>rteNz
zy)WsX{Y-x~C0*T#6Mt@d=jXUs^xL<?{5N?|JTtJ%efWESdL6&?!!&=#8P8Ada(^cL
zYnJz`i~F3eB)qxCT=YjhO7M+ux3f#)nj3uFA48VJBo)Y&-=3<n+c(H&Mux(p1?8;O
zS7zBo&-|99ez<XCN|3PD?S@zDI7AMJ@t<flOBR!jU2VY~=C*P2`|P|R536bC^c60p
z=<pf+x*fVGgK@E<vFfKuPJ+(!#RDfXq{*L{^2y`JVg<3Zt1Hrdq^`CVnnv4;eSUT7
z-j}wppR3;POI>X5sd%%=L6gIsf0eAyuf6Q4|KHW9<OO!O#jKxjb)B}ZS%kjGyA^L&
zrxh9&Y)j2On69?^npw=8RMVyF<JPWUc<R6KQNya&fi_~ZZyJTVHorB_O>)RP!vCb)
zxjcN6xmSd5?8LfN`+lX}HIm9rPBH)T)Z}#H701jEw+eF3>^fVhUD~uc^tzH+h!1yt
zLH%!o51#6GuPwXIBYN<@R%DapjAcG+Z`@zq6cfQ?ej{w-B>R8mPs$z7-~apcU*lbS
zlV=J$m)Tv`V&B;7cI?Q)S?8v1(pdZGmV1D@(u#BDKN!vx{nTZfFnRionzSz;|M;%)
zvs&}(UhUfrABDgF*ruDuSogJT{dcbjoz$tvRL*S?Z4I9FNIw0xMg{YRxcQlXKWM~%
z&sm#!KF#>$<!Sj#t|)I?R&91oJMhY!GqveDXVSznPrjeC>UzeByp!$Q?=m_U9-nUb
zr}MV2U+1<@`P;YGo)KQTk>y4Gmkt)U#qUno&dQhHQ9F&bCj8OD`vLy*`=>~Udkb;v
zclOWXJNq&*Uj5t4iMLfA6x!%mznf4yOW4e5w_Wwc^b3=}Sx9-zEzi9Bobl`1x=+8i
z=hXf6Om&fTxb|<|<$!IwV$YjMUwM9V($Zy<wYkktOkLh`>zKo=Dd)0y*qJx)EphVK
z`?q3J%!(hztQ#!<oKM-N{rr08nyv=fz-e4!>XNMIHW%e69R9I0A|WR*``BJdSG`vz
zGIK9(HczuZn<iC#QbU&c^L7^JsVYg)b2OegTweBYio;V)i|0BudY3%?g)TgeS+-zO
ziS+%B!i@Ok>)GdixNw;@X^(KGR(@L@?^l;4Q?xfSrs^g1a6Ra}(Zkc7YvF4k{F!g@
z-DOStRLqWb$?$Aejk)deu*S9Y@Ew6$v;2BXzlqNBjdoO<RaKq0EhW3dYQ>7ms)*_A
z5q-y(B=`6>&zHG-#995s<p%+Zd_C+J^|;S++05H+C2jtespN`rrt;myBX_f^b&BTI
zGTxqYUuRW`&+G?o8&vnJ`R(U8kfVK7?(#XCWmT3h7A!k;VC%9kUN+N$*nK=0c{Usj
zNSOCENwh}s*Yg?IRu<fNexdvu`>gb5Ytp|h$$AxiA}(-adN#}C2mP~@Wrfq8lz#Cx
z7k+wm%HEGT4=>2G9{U>f>j3BWFEYA3b_xpFw^n^IkWilA%+b22F>&q;sWr#-3RQk=
zU%4{>Qo#98zj*PWHMvt~y^Gpx-Q=e~apV85UzUH_e%J5vuZI^mZ(MFH_VVPkf?0d~
z)$VS;Epb01!RG$1ibSETtKZ(c9En&{ywK_=my=!ljPnXFP78eXS6GwC|HoQTd`qoR
z=km*6r9FS;Ua2utjGxhVYT93W)%jLJW+BOo14TI-E!v(lN|#T(6Xl(-^VIG0>qB1u
zd+Zk5-nJmop?nRea$M%ocT)3@$nYLzNV~f@YThzugKHI?p6m&VJzr;>oqX%q!+l>a
zW*l*5OVxc8tP)%?!?NrH-|v>re;Y+ypG|LIoXhPab*OL3#~D-V8iREYatiF(;r#f6
zm8O=@m6mf|TRXhimzzmk&6S-Y(Q$54p6DG8d*4!qz|<y{rE?!GynN__9@}Rri|0`-
zDJj8=W+(_(n}lU1FPmulYHwA-y6RfHZ6DqXK0N#+E+cuCTxP9YL!Gps>7571rma7-
z*?h(Jm$~!qbxlmny{BRjnj~axxLu#)x_Gnkk{ieNq~7wWie8ZJG%>{H$LG>p2izx0
z?%bbz?cZD9jAO~?tDHL4&wcgTsG9SA)Vj0G;!haoKDd~6Il|B+I3n}Jyk{M|T_>cZ
zvNKlXI#=uXM_oVms@_X)tIt~Il<S8pn)rj#58GF7tu{FP;?2~{23#q>U**mVZWd%o
zX>xKXUR2DTl+9Ga+r@b7*G&tf0{*&L6K^%%oEMyYt@_3qzth!z-Ok%ryQyAJiu}6J
zWi9K=?8IEJNqoD`CbI86GgoZ(OvR1)GfR^X-o2-pZsfSJe!2RhMUp}(+AA5KyUnc4
zxHx;~C*HX`u21~XB&xN3N7Pxzq+0W<{kc7-Jgv64Uo>a3UbM#jBJ=g!*DqSVRer5I
z7dB_->_y&d+tRrkBFZJNsr})LJMnw#z6r;BQ~b9rir!qZ{LIc*ria|7aK0%x!8a{s
z1LJEOw_Og78)aqI#OO%e`;)Y&<42Ul_RCD${L8NgO#j@fxxDPdyBxRao@WnU)ZM;_
z>1>^{$S0Qb0uuWld5Z0MP<Q9l<Gq<v3~vcXf6vTsdLp;Q^I7Q4>5m%aPfh;fQ9W7X
zs`;se?i<f%Ml5Y$+I{Ht<9$+>o+??rF=2SIJ$=XWu-M>N6Hg{wxtPCx<D9dz)a<WW
z95H*<8+88CMz)^NcamLu_}QkExj(ij2%CHT*+i*?+=c9_Zmczx*A^~_y*{nls&Vz&
zFxGjC-&!-|o=UIwKf{v6W&1QUsx;!k&6%8Tdt)D7t-8{%qI=J?casBePN}pFpD1Io
z{F-r|qveEMS2nZE<h?wt`YW%hu!DHzF;SV#yL7+a>dE3>p!em=CF!ZVmh3CastiAC
zo9)vRFuj$1|Ngq~?>>FaN|+<jcETqyB3e6v;nf}PoW=7053K39;Tc@UBazct)?N8v
z)#uO^`F}QPi-fHR;@{@$*10&#=Y{nJ9<IYJn{txxmK*a07i?R5bv4f`MN6kE2OOB|
zQqR1ax_5))?qzc|cE+u=yECJ-sh^+ue&_;|v}TnAwTv#Cykp7HpA+Q$#m^j*p4*W&
zbvLK0^5lgd{NAMq?|;ED>HcRcru$C?YEN90%d)B5<hoVrQA@si?kT_KPuc44Ur&*l
z%5<TB!aZ$==QEGBy|~MI!~6WU%e9fFE!k_#AI`qI;Fv{dyz<{uEkZ2SUzUIUofo|S
z$d%mf_b(lESbRv};%0%BqQBOcZ}5<MDjHW;CAlPDddaVfpRODBWp6lVc>kAc!M_U+
zdfxruKKsvJYL4Wyl}jI<7C5ai_1Nzq5#tw24fjjj<XMz?Mc>7`xk&0Gx8MbZ`_C?a
zY2~WhncoxmaX%+lM6}tfIPrhBTWe<AxxUb8|Jzf10ZkW~T7|iMo0bMVt(Y77SLM!+
z1rzw$n)?@B5tlibckFi0m5BXXuBJz?b1Ht}`>i1<(b~LgP9yJ}C0`~9e5gC{x9dq(
zt6rGc#o8ZY@>`z=x=b%-inm;;ap!u;N%iFEQtBGIe?#IAn<|ChwW$<c99qkAR%=R8
zM@9Af%-}uWswKL1&AEMY>Hi*cqbeDl*FsX~o{0LgK3^o>esAie3mbQO{a>KLrKk4H
zV#bjx*^l0C;GfdB>ay<@U7p;n>sQz4e$;i}vtYaT(<jXGNllz*dZ#aHc=kfD*?C2f
zlEG{x&7)qe#S=yL1T=nLHY=+};}f(0{R@rnG#4h$NO{nGDcOAa_J?k}{xVKl%$gUM
zH+j?kP1|E@{g^L!{S{Kyc(u{B!189Tv2^duKqgiz)@Gynpqi;?l~>$l+{$~uL`uqb
z@4U<xi>g08`F-n(L$uM6*z{Mmf9~FRl==QzYi+TYp0;|%)?XVu8`gVoYYUwIOR1Y{
z3WLy5FJYArUeUj+dFCu+vf*L5@^e+rI-xTmYCUzujd@Ftl`hPl5pwwY%G4{Gu5oA7
zs{V*)iCoo6j@&wn`_{fIO@&(<)w5Cy0=kL?rYHHn;b>p{M6qmbgunmxIDYpf6OaC_
zc2nZr&z^H&U-;w7AMp|Y<n@_2?c%g5*Jw;^;ok6DLwM!1CD*h!r3gM?v-jHf;ObG!
z^F|l%ygHI`a7o?F>#Fl2&zy;IQjy-L{LKID)H8=?rmFACKN*l*v9QiMEc3m!<r<Y*
zCFy@58h2tZ#w}TTW8=q9OT|hwD}3@k9h&d6t|)S?`ee<T8+)Z5Gars$yLjt_AlCnk
zF)17K9&VSuDe2W5zwq_J<Sk$AW#`P7X_xmq_l^J1=lTA1N42-Tt6o@j+|QYfQ+DO{
zw=37GYZ~uSh^&pj|9I}_rb}-{rn=33{``B#Y}v2hjQ_H&Zn@_%Er@N^MAlo8wL)qo
zGb<Jf{r$7&{U(D|{jC$l&UyD0Gsm7x{w<rgLH6pMLS-eHy44d8Pk#TG8+Bk;cTJVS
zV|fOKq=gI&qG$uV1&Kw)sYRf%UEA#9+isKYf7MniTIz92#DCM=BZ02>Hp^C?-@frl
z_tQJ~0(rQU+C|Q(I500zUAyRi-QCZ1O$$`iZ>~;O6*D+L@7+8QIL7?x-`)QD`#&|M
zFYj4oov&uHesiYV>Do_8GyBfJJootEyKBs!Rz<{3z4>O3T7UWXdG8L`-=8?S*z4Y<
zRVPli)Ghm*w6o#Vl4UQGva_SaxF@Mx4&AGjIcY-9Mx9f$mQ==F$($=%d9>T-l9lZF
z%c~Ym)mc307YoBo|7|W+o=-3Dm~o*{^*-0vka*qAHEx%>=5TPZaku2pn|tz@<ev8F
z$-7(>Toh;SoFTq>?b;kKKQ{IMU*8#2e$8)R|L@zg7wdmVv(&B8d9So^y6FS%cE#8K
zrd-|P^E`Uj3x%~=Gk-5yRey5T8a=PL2dPmPl_idHS{^vJZrYdWTi%p~6fO5Z*A;4K
z8Q?khp4fzkPi&gyw1b#md0Q=>o)R_X&Dtp4jp|m4TcnnIdn}kAW+KlV*RAQf@k`dc
zX-iglOE8$2K4<v;@S(Em+%GvbRXcazzG+qS{}pS`-@gy*Yb<Q4Sos?o=JQRS&(C;e
z65p|-Ni)x8Zhuo^m7@_`RP`(IN7D1sUB-9s{;Vtc`-Uw@enPtS<eX_&pU5;kQ3zf0
zCqJMrbz1$Y)AqR<^_kP^&z!c;)3CpD_h(+o-s|;Et~cK^TFPC2c}Kglq{{Zs*R(G$
zu4w#JJU`*^i61t)mkkqEDy4_3_=|^>7gTXc%zl>ow^C*GUiLlbUiPg@{d$$T<f~x4
zeBZr2R{uT<L^V#2=c})){PR!1!+K%x4A&dEn>=2BtepOLH~*QBV)AVc+XDOF*tq{H
zEYs2SSsQbvm2v&)Y~HlgjZtOg)yxa*mwo%SWb>nDFN=T^zBzpp%QGVbO%->2`}5*$
zaT%+hTR>lAl9l|vrfG5Kx<9%<IU{IrEO26QoCy0QmB@KlJuj_&QFDvEvw-s|W5JWH
zbENt!H~Med^X{<5vqv*|g=Rlq{A5LK>=Xl|IXAZGG(JoW3xC<u)S&U~^CPAiavUw2
z8KhOkBWusyi%8rZ;B`zhq3;Uo%5&Y^u{@3ux}O?fiK>a{?%vxd#pBh^cv$h<rK5o#
z135la+s29?vwgtK^5g@%_2jD!Hs8W8H7&fN*zxz)?e7!UNSRr`s9rgXD{k5{F9YwO
zlc%qQeEz)3O851Wg{iR#zS0}xn&up0d17()q@?Rbj+ka8!_%I%ffKsFtWvUOStTIw
z$>W#t5sUZi*VHD={b2urUF4yY=(9ZvhR>FzO!8g6<wz>uEur3+lTuc~t3#S~S;a-B
z+$l)lzaw>#`BU01Mh}HQ2^*@WWIi=3&p0Qh{{HK)m6rpQP5OCGNM{{d#U@l5GsVd$
z@0Q(z<b=>IuGbC-+TFfxzTEPEef5FDRNuSjzMftGA>RF2sYknwi6wuR%8V;dgUgPe
zY2Lm!?);1&C2<$eX1p>uJHLNb;!BBD+6qi!d!0<*Jd!!~)QD}a$<~DmdV5~pykp89
z{mSWLR(8bG*RM>b|35s5`R%7^uZkmTSbng`?VtB$|GX26Za>LRD!y|4>Uvq9Cu@#e
zZ`)`3_P1H{OC7c&>u>Mc7Pzi_I_tA1)1NH);ZYo7svZ4u%O(fUL~f(#Md!Pc___}5
z*XrHlZ7;jWukm<w($OT*-RjNzFU^^Dvm#@wsnF`sxxP1~4umEL$OTTlq{&fx=-A1Y
zJzm02^Y^|sZP+_6_Ue|XWtLj1>Z_m5;gh`Z;e5x_dcWt|FAg>x3-N!U?)rsEg3ZkO
z=*|BZ48!dTuKZs1g6*g+`wxfd?>1fHv9_%a<I3$>D0i&8Xx>y)73U4AZ1JbJeMmj6
zSrT$3U#x-QPSwSe*REZgEzjTYXOp|v*yqyR`aL&(zQ1U|s2XKse<kaI|CdSA7@syN
zb8ekin|{SW#z)TJRH#PME+_HY%0Fg53qJjt8RBKVx@y<wHJ6LqPX7FxcxZ-*bkw0~
zOKw}9ZDbdJsakD&<MquIo}0UNS!F+esx|xYqC*wkI$;~$HeH?ndSA|4_Jp!|6ZM3f
z4Kx|{#krpgJD176+o{v~#@pPT!kpWfWL&HtEAQQ<af<WYve$mG>om69ocZX@f%crP
z|3M$yuDt)j)%UA3!S#V@LgfK_*UtZk(q@`+b*sKP8tMGgWv{8pbVVWS$4q9QE!p4j
zXw|;CbHiESc5$}KoQ-!TMb29@K{?^x)qpjhzkT@oG4Rvp_QlFK<ka%}CY9UE|Ns4P
z_2ef{KKwoTn=fhaiiH0kEwvM8=YHt9KI^QASQ`6k)egB^tY4fC7HSpD^uO}DS6L`~
zj-Th&C69Av_0C+#xIoq_`?w(Mz6Mji9ZMcnKdYR0z96OMq4vhw>ZdQt^v)Tpl^mOr
z|Ky8Xg@@nki^>n)?+Z@dIP1EkaDMQ<w`Ey*{)yo?WdD@S`Y!j6Rc?Fax9I%~Grqq2
zaQ)oNmoK)zd--y~_39fpzr9X7;UA<`vGZqEp__NP%kIOQr!Ri^?%s=w`MVE4syOoP
z@{gLI<uz<S4O@9Fm;Euj(`@_m<&(sOA6sUqpJ>W^y`k2v$M%h#gw313tk0@9tP0l-
z@k_SoSvc)SE0>1DT|LHq4)Z^&YDn*7k24S0!Xy5+HOf}|@<;bq%GnZG=3x~gS(SUV
zYIEY+XYo$k!#QQnoU`_8yKc?qy4|=*@YI%sSQYPAWf%ENHqKeE6>)Ua%>LKz?1~?_
z<x87AcGq<;WV`(8j_wZOBd)J}w_O&Ptea`cSMcO|<D$!1axebIGpQ!FYTNL<ZC`eO
zdFU&{LyjDiD>u9dU$`idsnzS8?Y>`%5oesw^EU<=uiyB5;jy&1<nzo+?barwHn^rv
zoF;E;_3!8^gG*e`d#;^HIWkq#{r=XqRX>cs+J{)Tx$#c5n349=CBxflfBF}z<<l3r
zdp}S6%h_wYw!7#=$OXI2OFq=QONrby(pkJa%;<LPo0m(Hazq(VvLC9SdRw&h4%d?f
zFE~}ji(kuzC0_WrVY7TfLuL5G!-0A;6-C6pF(3M-9X9WVEQ4Oa<d+eZJ6hi~&FkGV
z_iI3J=S$JD`Zed9H1BR^-2Oo8!Y_{e^V)o;E-d;GJ@LeW+zs2ea*G5#xv2l}5zplA
zCha$|3C*RZCVc)5yLrV9`p#fmAi>UEc&%ZcWAW=>6#;J-gsR-@y7Sp_;<|U+)~{-l
zPTTTqZ}IAi9THKWe)xIoy-z&!z`yvLaxv2k`)xNT^G<s!eJAtkf*{dHzPCQFQJpi}
z?6y$UvXCRUP1NeVEpD6N;B#7f=E!ZH_ty0~Vd)CJ5l_1$za$)9=KqN833JG*8yhER
zm@s6XebN*o#B)*i`=T6mskC5LvlC0R*G8=Td(gLrC1B!N)_r+7^Pk<e{dAS_=FRT#
zgZCHBdf0N?Zjrc;(#y-b42q)5J2%|9A|m9NwJzbvg3M+fTm6;BKjd!az489DEs#z7
zXk1C4;FdWTN{kpzL~lLh$E3IEr_8p>4IaS_VhQs(s@0n3<<}pTEc1LWvTaK9TZ31k
zP9H>GDCrh6oU#>SN->=%e)7~crfqdHCnn!r=UBEk?E9kxkD15*@yX9V<ZZ-c>@s=p
z-?@7Ox!t(lEMls@&h~7RVpW#YlkJBSt2gcctimJxZ-#D+Sw=+LBaeg1Vi(vWj>=W~
zUHh>0LW091iLGTymkzC25@x+~-a{*`*%D0q3?H7XTDaKkc%g-9PvM3fUWH91kNUrQ
z`)IpqOVsOsSP;IK$4-4W%d-`GZ*{mh?{fAso|td^Ea#Fzil)odI1Sy<+y@D!i=Y0P
zym;$e>ubB8-TJXP<$6i9_3sJiOtXJ2d+c#$QrMP1JXQ-{9GNsbC}~pp8~r_tA1FoI
z-pJeF+g4XTxikEQs!E^Ij8}T6zvs$E?(Irj>UQ&a1+V$JH_O8KE-+57TqyfHg8vm)
z@Qo{rTIa6$Bs9VL^yYd4X_W&$>w4$L8Oqg$-rI6XC}6EwX~pX$ZdD>2HANcN=d6mj
z?UE4jtoEv{|LWq(7tKo@Ud&wnt@mjO`^BWHqOfV*C+k<0yi9&{y<axmCB}PBZ$X3m
z*^QDL9_*Y{Q1o*4V=i&dAF4T3G3lwE3naOIERJ<>=5_56PYC(EHYumO;iISpOPkc3
zj86ORwj<rQ{TNc3S4=Aw_$N0(+*E@pUHi(+r=4%p-^qkqN;q$K%Km+R(&bftJ5t{7
z@HnF`DWr1IRJ4Cd@|^A_XP5flOBUOHwqiWw%lgQAjZ;zW;y)~}R;!x7SkNvo%}Yqv
zfg$n0a?PI2+EuSUFO$(eS~B(VHHl@FE7oY29(!3c?@-&~?yFV%9vn>Jn`HRvsgP&7
zfQwb?!WTEipZEVe@YJ){({sU|SPiHA>Q`lv{=RxbdBV(mTh?UAI;{VsHTP1BC*u~c
z6U`aR{WZTYVV-UF^T^&SJS_#~*2({N?Mqnm!NDu(pBmripWRWLa`>ipZ92X4TgO_R
zXH5)$A0@q=x%o$C)YOj2c9jo~a$EWc$fmo*6-GGjeXRWGmA7=1%%{gMw(LpT(oxC&
z#k0lh+eX_olR4k>w-`hu^Z(MS5zLy+u_beLZq%M0p8&Z=SH@kT=RRaCF73$U5_+Y&
z?#H52vprXAIe1}D0k@Uh#?1!<vO6j~w;1j9(CL1qd-9==<w@yvlh5U5E<BL4s9lHQ
z@oTA8hftP`3#JQnzeXi|x4q44eqohv*~}g5gtlJ1moBGc6!~VCYf`q?m)7q_>(zY@
zWIykCZJpTU>XXb+Ebzd?cy3gRDx-;^uGB{^!%MTeXBKq1KetX>T)dEbjmIX>brKtY
z#WqiO<%-TvcDD$O|K+&V>h-LD_iEEMP8mL*`r#pmfmgz({YUP4?OybLy;%CuKl@US
zb{B0sWY)AgU(0A_+yCIOtIm;1I{P;AS^vH&YO=*Q^qK3v$f^Asq~~qavQJCqofbFi
z-<8+hhqQm~=y_w)w?Ba`Npr%%!bUrXzW4lZerL`s*u8RT^n-ln(t8ux`X+7CS-EiO
zfxc~NK0DWMZP_tx)_O5c_Wid%pLJ?<j9`ySa?ZDSzVhDhCj}eVoYfRjZ&+ob)IaA<
zht{|AW+&XQX?$Iv6;*uV$c`Ukv$d6KS6(&kH#oa~S1j|6)B9H3e{3WjHHGPCL(He+
za*wxr=k_F@DCBR_ogMx>|4^SQyX&^~rMJy*TgW^($7x^B;5zxr%_jNV8q%Wo6J3A5
zn8D7^u*a_8!E>H|_T9~X`X*o7I8J&*a*0-@3+?p`RGTn?DMxJC%+2dg6bR%>H+*Qf
z_{|Ygc)_gU?`0;7)5qlE&S>kd`?-SSah|_@7L(zIn!^(DBKEsiFKMtj;O`ly^0?UQ
zUj}cu_sg$qt}^YlSbt+pkhkTE`g=j^=I~xAd2!RXW97|tf(KXaYSob!PxU-rdg$4P
zykp<o%wnB;PUh)(TxgHzUzDIxsMK;&IsU+wm@lWlXzh4(TKQG2^Vtcj7<9HT+jijU
zoq(S!D)j?)$Y<=7&)Jr#I8Ar;)(F*(r!&rq<i=flwzc`v+EqGfR^5B;ZWZ7C;c6De
zc69OfGmn{?>t&9HU!T&y_C?z+zZp3h3i-aq>kFnN<elW$dMBxO$)Q8D{NCi+PF&-~
z)>=|J-)2VpmV^6qIh9{+*dO#Ttb0vo*_umHC+lWDU9ebQf9K<{8BHZwI*d9i1)kdO
z+VuO5+e3|?Ys`KhWc!_$-Mgik&Gh95*ML4-_bIVwoQ)31yW5IBa9CDTvf|*owekfV
zs-}Ic|7@nPZS&Iq<T?A0uEvj55jvNRm~9pADcnE3ptf@U9;>?F?~b0&zb7xhw|~-c
z{a>vf%VrCP%5oVxeBfdJzb(dL)2|xG*ExIGWcg2={Mdi|_nEyaQ_J7Z)H>{V>WC`y
z*K0Yiw|4(^d=ccJaqMW|7RTG|Tay&5p3C;WG_$@bQ5BQ=hC8R?x?kyOL07-~i<{P$
z$=zZK{(JbgPJF0t*Y;U&j_FqRyKK1c`>yE6$tAW{bGMkR`s0}+c5cJdj|+5PwSGTe
z@FZ_ee*J`_fluG(O}&3k;X-qHiE4DQyP&<)=i}9@9~&;0{NAyK)qLMc^)E&zIwkl2
zd9i{wP*kpek>1=x(l6h~)f-N|_cF7%Htx%k8zK9+-KMS=3=_RsA$MTD*_GRpKi-%y
z{=3)z?BBF&&yT8j99<PLHF*|Grln?$(JVJ9zk&-sQLq2y-IQ3X9Pl-ELd@cc+&(GC
zA56)5#G3YOV$Xp%7V!<wKa?@f;(se<V7Vu9LtA$``?KA#A_5Go58|yOEo6Sg$#n>(
znEtq2CVnXU!Thi@U#q6}7cz2f61Ngp+0TEzBDR*ZEMTq%(`%7~5>|@mWPja#Eb#SJ
zVP}?vc-GH9)xp16clU|fZvHuEn%&O#Yr=M|z1OU#IXk2zgtMvVm2H(*yjRkR<G(Lh
z-9H;XwK@5BX>jQ$)BWH7X3bl-YQyyI9g_2A?C5#bXAmZ{Dooze_1%A$b)qI`e!W=}
zb>?&G{jkN6ZTndEZ+p9<hjYOy`J<lu6F=0}PpK`p`1>H@*ThDXE?vg$)1r(VxpaTZ
zJuI8qe?zGMUP*$*gUgM!R<~;^H=U5bbH?)ag-!eWtXeD_OF91EinKX%it+fQxl03&
z#0nktwqC!%{PKoF*1k5J%WBwf8zf!{I@V#d@tnp2<9R8c+!t&&=r@s)bjiOpMNN2#
zrSHDuB6l=5H8NaSx|m_Y#ULAV!L@UfBU}m|E<3J%(rv}}SvO?nui4|IRxdo`iN2u8
zrgamoKfaGG{E~J{;lbvWinErT-6XzHP{Km8=0szSb86!|?Vz3|4riCW_4z5+UZ2Rv
zTdB2Tq2s)5tL`t`Y$js4F!V1M+ieGN$^IvKL9PKxHzKZ732W?Wtay3cDreEEtk}e;
z<s2ceTR0L^=fBvbD)(Na;ZEq`7Y8e{JwF;vzqeX%WwMB=GIK>v!^K9HUu(VQJv(r9
zM~MI3tx}~Et{5i#QuJuz^5JOHKP#;3k;lj5HFG^*{mDY5=9AB_t?H7q?F#>T$?s)F
z`}MuAi=!Tj&R5{yx%=jhusP2w(odLe-MUgn^!`1&TQ8F~`+m7&GU3eBNS7^D@orOJ
z#Lf76h$qLg^!%SQcMD9GY%WY=YdyO0l7RBuFPv<KjrH{j|2G_e{wH4SuD1BYoevUO
ztnEtIOxL-j+J9^J5r>P;WqVRenqPl4eI3mbc~gCj^}H#ox2zAjwddG(`77F~>$R$n
zZJNJ2eA?fbROXuBGBFpKe>H40;j5{C&Gy*qzt8d2n@-sUC(PnvKK~&1443n&gWIP6
z)GgI|Cw)}?h0WRY)g^B10pG==;ubcSn5n%K%CGw5aPzrH+PNLi4hrjQSo$yg>N+d_
z;mPAO{0z)Y+ZG<1Z6&&rYfWHKX}8>sWK(N(8@<R_gB_>d^sr8enNVVPd>w!Bp3Za0
z5ep}OzQ*jKQmqmyom*4ylW>@?e*OY&Njn?WSqVS>@p`H|eOj<Na;w$qkCUp874M&V
zE<x#o`+Ogxk^+&X;zv_hqic13%AS0wGxh5{!`plgx74}Qwxx<!7(B1uG{vYX>FD0r
zO>>rCI(W0|%pE1Q`O^1~?k#Kk&Np%QM}6*#&u{5u-w4!Qve;O=?|)fxP*v!(GpQ5j
z?pQEead*Ydg{<B2?El}N`oHVP^5e~?ejIn0zd0%NWS;BlgX<=7ul>5|oZGRR6SQm=
zmzHjQv5PBZ-jy2D@3wx&4c^V#bhiJCe)I7b`Q@J(X1?-y%ku3f|I+mzy8m$9lgoOZ
z=&@nXTR#)tBE3bSr(>^mty}l-=*qG{)jxhKO3oPvEZ{no=BysJsnOu#0?FvPVtk1^
zmnL%fXo+uXaKCHy>FU$a2Lj$xoJuZuzdNL{<NOYb279@u$JZDK9OSCVuux8!UAf;{
zVDSOT{|7!Cn0oTy4V$?4XU!k|tv)oHclM^$ho02N>fFC_$$BAY>%A?T8O-u+t0i@w
zt(kcuzszov@YCFB5ASg-mSf*s=KfB{e5VKN-mJdDqpp3Cb_P73{T5eF-h9b%?VbZ`
z6@}W)HP~KEbjYv_>^AvcCEKj-D4w=a^R(L3eXEYSd`U2n_!;q_kuk>LtRly@blp6*
z3WbQA<;gMeJ7X>tW~+EjX;;2_%YrMu-ah5;!=>|HziK;^(7M0uc<p1?<1e?S#Wmah
zXgzu0#}ToJV{w<|n7^Am3;6L*-|j<Q2A||(ljRdy8E#)ty%ZB;q#NL$c)D!CMWu4D
zq-fKJyH%TY51(#S5EM?d4Hvjokutw-!|VlbervsZ7aw@|Y3;_w$;`pmCB8hU39k(H
zxM=(O)AhJu+lQ-8ytXy_@L<C<$?caO8a+PKnSAv^=$W^(w@TeEI<Rm5w&xz4|Lr)w
zM+%?&t9v-A<laib5B>ieyqvQ|n=M&g(}a@Vb+E7CT~z<GVX8>DQD8!=+Ol@N{|bHO
znZKS}GCFKo+`r_Cz4_F*HA@2mmVd0PSCM@0<D^}-yxB_GVCxONEv|0`O}Zw=98q&V
zwD|DBrGKnhzxOAv-s#`%^2Q|ZbjQE4lij~Eq^=(NlXbFGF7KM&flKeWR;A9%W>DGi
zb2Eq3LzBaQv~T(>xV~Zjx88*_o?V)^yUL)wbZ>!8-rfQm!?u*14i)R<1Cy$!yL~g~
z`f($9I`d75=Hf@be3J!5!g;PA<@4RQronJyTHnmwKYmYgT39Z-cHWj{S1+eUB?kPr
zx88VR+E@1=@0d*;6JNiqDzeS>U6;RW+f7!+2W?q5bvIvqaPG9(+qQg9EA8GKU5BRX
z1-lIE)^q-@>NK7uk+$E^@U`BoAFN#IGUDs5vai*8oK*R=BVmPBPbB-didhBi%U&_u
z3z)P%m#co?*3+Jnk7Unq-?-BIA<WZL{AhX>n<Del75f&LJkKug+nv8&_(9{+n8ROw
zZf*&zmOjl=sxj$E%;Ts1HyI|rjj5i0z4XG5=NhbHqGt+JW9_HTED~vHdwZNcDEyjY
zlSss}$-7QmJKN^0ux+l$s{6P7IVxXWOw(#<J!9_cv@BxLgaCJ&PsjHwZ}7KzneymF
z*uSR?Csu`}yIu2*$g6#=YrJCdPVR1<yc<iiwz!m9R!D3Sa)~$}?bG#CTsR_dVSX&b
zYi<_4?xz}Vi}H8#J$QIv<~B<+pHunyu3jG#*%WRr`mo~UzV{o>Gu_=0`N)`eg5^oO
z_3B^C|NFms|E~Yaebb4%j?OCQ-_hBrQD}X3+uNTfDz0tuGFJTbyK#;F$y}DLseaXI
zGcV8E8g_S|`Lou<ojtNHJ7)-8{Cn4bVqt!xn~mgL%Wu5zCZ6B@@SyOSoN0MCmwZic
zT$DRamm%w(<em1L9&sFr?ALFlY>7E%{Etz$E^F@2B!geSZQr;X{!G4?H&KZF<+=5f
z3igZNy|l*Tk|f_b!{&lOo#I><snVL{X7kiq#miUnGfM8PR&ab|Fr~sKp?Ke)J%?qh
zQ@7uAn%k!O{=2X7@AHO@Q#HNhx&C|%j!3v%uJ+i*JGSlX+qs5K(%;4E%^R2R4;MQg
z?!6&zW86v$(_f2L&ieXjui(Tt&B}UWt{wfi7Yckal6&s27_@wg!}1?~(K6F>8+NlQ
zr9O}lELfV~<J^*;x$8uZ{PMTAo@eg%En2j-Bw_x;5{=N+za!`6boXB7*nLaAH0J%I
z_}@L>uHSodXWQX3o0X46P5J&>N=o>CUCzw~eQdWcXxwfrVUAz6ai7MeFH;4-Yi~3x
zDESe>EhAYG9GU8~Ewa8x?{bec(<Ikk&Q%sy_ta%oc$ltL&#cH#iAy$BG}N(*`C8EY
z<EZaGy`4u3d-nfYuB5i)t<+VotRJ`cmk4y-yY^i`=*!Nag^{Lbez2ZkIK#H~@`HvC
zS-0l0i`*+{oBH%|O<k+crt|6ljm{oXR4`wk{$u6$!rs2O2VQC~>$-RALR_XFU*?%!
zo)sIGS={c6{_cP5vf#fR=3)<ePlm;O`;q)CLSb6^;d_08wtxO^>e;9`ub=7hE8cmx
zuAh8=cuQKypWG8`WUSpdF8&YRq;$+GaE95O-OuC%R=X<aZP>Z?aC?SFrA*iDjIKTT
zg{Ai{ypmCp%vqJ~^5d%Ar7dlj%pYC+ykNt`w%(-N)bCBMX>&!k80~-HzU;Ho+M{2a
zUR~RCOQvNWS6Eg;R14!%mXwQ*S4!?4;dsn=-Ot*{Wp8@V#TERsQY_*-db{uJ$-aE=
zt@%mb-50J!=b!(7yJ=g=Lec9MOuDZ-pH7&@y6dIzWc$Z%%f-x;f@RH~+tq(lVf8mV
zd`9c>*{aNiN^X+NZtTvzRQcU&lWC{bY@t(A7P42Edn~%GW|`LCcdO_@&mj{f4VP{M
z);oe>FT>(E__cL5_na=6{W0Rjq1dFuJzHmS_(dtR9WmIod5hx3a<4NdJ_lao)4TS4
zi_r1H!swbA7M)Gv$GU%e_RJ`rv!}Oeb*8FPwu}1ZDE3_KQ^$0lq~%yu@~mf`@*+dq
zXjfOkO5uyaEtRKvCM6v^J<lrmbkFPrxwm(ZUcazsg3M9f?=!i+CN!nQ)c5&B?TOmL
zc(i48m|1SZiIp#AiiS?~;0a*qtJd>aaLSA2^QpM~S3Vz@!fDr|v+Ky*A6@1tGq`yf
zep(&#eiNM|uw#$dhqH%$=V*5ryxlfwM&ib+olY}8_5AXka(}|F(E0rBwsXH$nTgGf
zT%y!^M)mfpxj!`O68xCM0whJAUekzaURe71@B=x~vbKXNmH)~OBu_06)|<4qL8)zN
zwENm0NkXsnl8*DONvv_s*j#$hy^$~V(P?#Uug=E!-*pe?_K9EJd+LGe`ReqEH+(+1
zP82A9^`%rQsbpH}d_lv7w=3L^99NO*kuUtP^g1i|B;6f4wcB|MHr@RyaB7`YiRZu0
zHQUrBpQ&$6;_koAUTl<gyYUy-^<CF~uHCESA6Bth-f|ARf<g7Pn)hXS3-3=e$^Ec?
zR;)jR^zUa2d|xg~TPh}<m9=e`c}C!gu0RntB`?m(70aJ4uP$z1|0Cj>Ia_YY<9kfI
z?q03#W_l-Dvwq4Ci>+Ko4)~bV8Qx#DY+u&hCx6yErVFlLdQ0II+b_WvTg9ukMZ7rr
zVBWf{RVq9#n>>vF^i6s?`Ru-BEsO1#gO+LknZwLe@3VG>VoKnK{ldx#58XuWHEcR7
zvh~^7|4aei%q*azMmZQ{n<b(je4AZcCc(ha8H9NNX>n>vX@Oor<<XeeMURga{ae3$
z#%3?k1E#ENpQ@BD5}6$J{^&iK_fe@Q%Yvdrc_uLnX$v?M2p-LO+4xDSa#PJ+V`iQ_
zmFrK7`A)}q9`Nz^_rJfpefgtbufEpL`zxTE5_Dp7x%bQ|ff6VG1noJ~bTn#SY=yp`
z-_g}3x1V0jitXwakN^K!^54(RJ0iV5#))MrP5b0{EOXnzl)zI7muG#b|KDvXem~*d
zQTxtvPtD{#XEvMgpVIL4^E+g7m*YPF>P@GXzVFUxE?>$qNkzBPqp&Dx-qY1OC%7#|
zPcN8~y5(U0YKyu4N7WY?ie?&$M#@Y{oRz<9QABvE$m8dH{oXrI9@03*GAoTiZ{4RU
z^STxY%={Jla5C#ttG;J!GqwL@KAW;z$1BX_v77SynTemZx~2zj^eE<JX<j+ur1O;J
zoPuduN^fk>7j@PzPjYTK%=Lr!{AUsS$0bW2&YaGs7yR?=W2ZD9BU6p1_FTr#-2Z*n
zFJjMXeROR1&-JU#|E+$1f6uSeyZP_O&f}=5nCEnVdcUgQ9X5ubDKC|JXD^(0vqQ3I
zFW-j;SASp6GL+%zjXmNR*zs)TZCSImiT-+5MSf*e#dlS%5`WsdG3HHvvkl`k*XOBv
z;+aBj+6G?F&zhau)i1V@=M(G4g6FLBFBvg)i>Jof>t51|KXLD|PQ*k5gNDhWA-^ta
zF^1MWn>DjQ=DA3dfM}EagY<x@FTK=+-snzG+85mZyt91ajipl~)-<Q6y3TUWNZQcU
z(P8Yh(N~zAM<ug==aQZGPJR|{u(ym{|8H8i*zP4fa{7_${N~x)U-xiWV!uSyV`uDX
z7nTL`Cmr^!>ewFnCMCe3?~&5d?Tcc(KSX)iEAmV4NxNn%dQ_=@lTgg`j{1uK&wd@}
zziz+RN?pxb|C&+X`B?{#{yZ7f#&UMOcv0lPLIpR`3jMFEwd)K8)Bm%%2(PrbXRu-V
z>Cg~|4>eYQjJ&D@)YV^Yd0Bow?o#Qwb3!i`vRArYDO+ZmU1INGw&GDyS+%*HTEvBO
zX?_z@jUwMMvPGpBKi8eBU$KuzX%hQHyAwA3(}dLf4~JwJRxX|qx^!)UP5S$JVwF)M
z_3L#L*%O*Ab2~r&sI9IjSjJ?{=<6}@A%C;i-xLvX+oUk#j=BxgQ=*dRiW>2)z1lS?
zW%C*BfJtRx=VWX@2^eOn?fduh)vM*^*RNMkPrq7mY}>;#8Yli{Y?=D<;NnX8JCj+C
z-&!@h(o6mQb2V?{{skooZ?hx0k}o!;WUj8drnumR`c4hokHw0IwZgJACPqK(SnuZe
z`M6=ib;g!dy{W&NW?i}E>HIA8W&YXEj}$w!D_JU5#8+rtSo+g;MXAH96Mlc~nErOn
zJXOLep{X$E*>1U|tD0Q6?2b843DXIcmJ)LBG`aG%@5UtG$L}U-zYz_Z94>k0=#(5T
z{?n@bOP+2I+$nZY@brTpDS0k|OBNP&@x5GoYfb;>eL+$Ai9JsgH|<j@XnLrd_#=_I
zReSGLcGl>|B5zMGU$t%zF=780_mfUt>-XmG5wE^zqQ|zu^TU=ImjCk<-M(d>e{xIs
zrulD|%2=J1`kQ@bS{qH@#~&Q{YoB*iR+iu2OP|hLnN6}Y*;b~Jo)+|XR$?WWzI=!8
zRhE0Ie{B!S)G^KMJYl-Lz14ap;{j#UH^=8iy$<ke4YEmCo#UQ!!0xcyX5HNu0#|u^
zH9JmjuaI`=c$~XI+iF75$u$fDjw|;nR|uS37bBd0u32>p!%fYOgV7t-)$p9SeP98f
zjB?N^rB+7~@hy2uQ|~pL7C9ptw?$rXO~Qh`Vm!?!eeT@b8n>ZhM!}KY6Q4w}|9rP~
zqCvUS#-pD$9p91iDbr6VM`fq~_N^bIPF`X^SfeCi-I@2i=G~F-Hy0|u^v@QPJ8FJ!
zxrvvRa<pRi_hY|oPcLS#-LzrXdE0`S#xuWcT;f0TeOr7)%f~7EAMDcd`TXKT>}K17
z-zib~Wk!-LYL*H@PXZ2@)_Q;XrFQ;uP0h>Ti-`dSf`9Hk?VBRdy4U-tg{kEM-J^0D
zjGP6MtQ)UQvQUU%o|Ccjv)l623AZQTi#{F9JFS|3^R$<q@~1Q&`X9~y_I2xjf1z!$
z%a0t~$+Fcx)b-@FcyD>#(`6Mb5i^c?ugHDmB<1H|^HI6(?Djy%N0P@+2|1W)NIVa8
z)9gEN$1S2>Fobn=la0o;W@b;Wq$r6PnZwK359n?0H+Jwjl`H@K_~A8f@|O~;vO+Gb
z`q=VTU-JJm)^D}%k5vaO=<j^LkY{r0F5Q|R3YjmSODiqe&Cbr*{mt5uzmaz_i@NC{
zBOj?vKK$K>_#C?RcDnax@(C`Rd`ZZ@&*FsptGTI{CJ5C}c(Yqkq_O6R<L{S$->`|*
z&9RD_oFkyRbIUd{flXZ#lH(I&ysw13P_=lFzStwMt~vEY*S5n3ResU_W)mV~BY$>n
zIyG5}A%Ag!v+0UsYp;1OVV;t->f`TUL3b)n<*|R%{jlfpaq+#!d;a&92Opesu~{?s
z)w-KLQ$85|TNcr%nj&GFl)mt@qnpZBtKW$`E9Yl^w14WK@P5y8=1Zr!_mt!?`wM&g
z-D=zY?CH@D-nI=(I)1Jy4&wWxBewbB^a|@UVS66<T<Ey>yHN8Kb5Q)-lG(5KsK1R!
zDH3cg*y-)KlJ7)K(&g@RS9Y|B@x^QZYix|mnV#F8F-Jw}`@%|3=E;#-GsM4ao+cI1
zKSTb)4$ta)M<;&PQ`5D{{kzO^#>N-f_OIW%K96AIl(w4xJLl(;C3lylo?mtIS5u*6
zsNl5z4{aNh`5R?)DrK5j{(8QU(9htLi8*N*RB1C!ygpP%zwhv+O-ZZ~(~f#fE_iXr
zk9E<C3OSv3mNC=%Q(5!dH<>z~+h;mQkHPbSrK8|8!SrRT`tCaf-R_w^(VlPnd1lo`
zDx#ZbRxDJRGf(F!v;E8stcm>1Go~mRpDmm6EdL+dX1`sh+Bz=8O`eqMRg{)ByY{2J
z*x&4>;+%W82`!nM=b?WgsrYH2prh@_F5{I?q@P)MaV1*4x}27qV7=tV6~F4JlAMh1
zSH5jHwOw-&f3>jHZjKt!Su!TIa@+I#V|ADJ&N=IHJZJrKMJWSut~1xw*}oaBu&ujZ
zmlbXE>b=kG1q(ik-&!@BdAEq8ul0dVd%TZFyDnvV+t5FEt#jQGrKMX=o>_V7!<+Mb
z?)9sTE?rZT(aZb1VoKg}KEt0%BG*>iGc=d^CY_kM^6w1id7aTuxLa?}t8uz*YP6E;
ze2d8CFt)?1jWu)~7c0%nUdyQV(7oz!r@NJ|X7}QdciUs9uVDM*a+7ndsD;ClRT__0
z?dx7DURTuiW^HHgu|u;8zt<cwzRq-Q`L@uB-EtPM-u~EQ_It&b&3<eV9g|zM6GM{B
zUsti}cBH8?tYMD-^VsJWLutuf=9Q21nU}ck<&(1&jru*aE&R=wm4z8m%)dCbeYH<r
z-J2J*(Q0ylb99yb<bKclzeD7o+n=a-66(Zi^*C{M&Dv8AYJs0L1LCInod|B3;~o4$
z+0gfilb9>R;!Wu*=WjS=Y-jOi%^IVNr>@&8pXN*6ZE&^b&rO|8^}_F+7N<6Au&r@Q
znQ~V5lxF_g%^HE9W-_f$pO_z{a7|zQwe9K^Yqo9N;5&1{gBY$e*69n*ww;NHTa>-V
zM0^Y14!><PVqO+F++Ou1KVz${;*qcGG@i1Zi+TAefd9z{L-V|s`q59nethFtl~~!c
z@#*s|N0;zTJ0@A-vfT8{8e7kEDTW79wXQBcw&z+Xn`(x<us5sKUWp2aw;v`17wRs}
zQ~V*8r#4l9`=P|Q;v2jwI~C6M%-}v{svQ~jdFo1$i%gTI7=|-@NMseKJjjq<r@p$%
zPNYjqu%lh6@5G5I{cCs3Vz`$ml745ZX!ic>6<q(BnB9w(w_kdm`}(ReTf?hXgW4y0
z_Di_^Jhz{pyhK6%diL6lENidroZvHG;`aLEzoOW89@Yq)%(b+x^Zug$6ZISyzcH4(
z?03iWxX^a(3AOvL_ZXj5&<&|Hbeb4d_TXc_k^KK>OTFu>XNw&1oSgB{@7TjAUxmjZ
z4;=0Ki>&vB%=KHH`nbKM@V>Y7wzH3Ru1Y>Cv2*#F>$hG$Fw&nnfA4nv`+o~$BwDnW
z$XhO6Tw?jci>;~JWlN*cEfcM(#!dy(#a%O+&spZ*UZ2Y4vc~n4n9^xk7Ekf-97nWP
zWG;^H)yeu4A7yty`_Ct-{Rgz)W~O@F&*r$Bd-uf>nUk7N*Zy5J>$R00e~o;~m8VPY
zoGtM?|DMgJZ07SPX%~CsKTH<ReA{%kc2b_Ov{mc+w_o>E@7$anyJSOy@y_YLbx*IX
z*!f_`eF>9wwi|Y<M7#`La&~hM*A#{}RqmhnMJp%w=B#GhnaQ3vMdwjh_C_`n_RH7w
zDpsy-kyGV$UVgcB${DdU7a!z@USL|%-+ZS-a9)kaWA=>ORhpse{y2H;T^M&@%BPbz
z4mt%e&%QOYTb}u#e&kAxl}`>V+rwsVCO_BRg-_wO^>^j#7NX}5namAT{WbFji}h83
z)(av+o}5!e94|EYyk5q<mHXoxq0RGT4}?AEl6-B~s^s_evO~9t9LKcfnJ@W5U$L1l
za6J_A-0Atv^aGVu*ZKl`9+WJ1YS4J;m8kanXH|^4faEv3I=>k&e2@Ox%=9DW`188s
z3!GVF`)1zl+j&3#8UKy%!5`;_h#H;X+IsQjo=G1c{}MVbbZyI=7m{KJmKKHTy00>P
zuOj8;ug$;9?7VN}#19`#Ll(z7{Fcra6yflhRb;=_bB5hw{txrJbs{{z|NPv(K-l;8
z%q{ww?tF<!SJiHI=|B9qK1SAbvmpCdfe)s0_r(3>-f>`V!~Eb?GHgq8@8w3kKgm1S
z{mJ`St2<A-1A_HdP15>&IQYt^S$ZZb?=6cu^<FEdydeMZf%RoiXEn)wyUw}erOUS~
zi|^Te*nfKenadR~t$eMw8lBFXW^8i$r|Z`<Tee+zm5|N9e_b%Y$>PY(kEiqLg{oVz
zE#q_5Un2V;#!<E~eLk1hos$je>5cm39Dz|EWUq>!*qkf%CEMKnz@^?vwh6@?JzT<-
zT9zhakAvdP*dlUo-`oAHe3b!T;qjaZ8L6H7*9j;)8|%DVC>gT%c1~kx_2FQzTAjrL
z*P74N39j8B%(Z#Bn9beo(~6ZpEIO5$v8P#4IQoXXgzQ~U{ZN0suXzVOjugya#j@jI
z_jB<pr&1kTr#|vwSpNG+zWF_E4f{!JZr^_1^YE<xKmM0luKf?1CnoOty>?zdqjrGe
z8X<4hn+CfSz7+B@*gkOFZTi+tqTlkE(yG!wywlps%{mx0lJ}p`5@egLac`?-r`Uz$
zl1~>82gLK*ihVLvV0ZoaTV&ot@r65%^(68fUns|zm$KY^gYhSBL!HWViCW(h<yo&Z
zU0Z!#R<!w2`Ub%S6&4n!ltN$j4>Q-=e#ldhUFsgx#xbw+^@Ljs?eBCh&f9*Vb;%B?
zhfDsQouZePxchE{-Qlfo+0wQ@i>OXuzUo$L?3((g_TD^s)x=eM7*_0$t~7se)0C@Z
zBTscLm(|=$J%M_+E``fJnDk4b`=ZX7ABlR}R|Brws!d*SA<}K~k^tFRTF>tkKB%9X
zbb4X9%-z#&tk=pD9hOI=#~Z(x+3|~k`yKb)Am(*itVJT~FB5O&>gv4imToxv(XdeI
znVGo7t1nBX!b7;Z9v#-|D__Qbb%C+O&y!6>>qJgoKD%7ZAa-j=?b<2+-60Z79{c2-
z{Ced3OEETvn7wa~nmb6%Q~tgByODp&npx=^C%ihngdr=GwUXi3_1YPZn;u7p#}o#}
z32i-T%a+piVZ&ypjoxCryeCzi&QNMTXeic_F0)e2hv{_mrz2-~1#t*SM~LK|TeZ2(
z((;sh&{DM}6;~Ern$o$b%3X8A!WngpkE48MYn!|kvp3j%ilM5dIse@8w<Rw(-g>Z4
zTOv+AW6G1;zh9f|)%RHD@kH&fWOJp6b!TZzlSg)wqWIG3Z2y%y!j|08J}$pJC30_|
z50jQusQIeS!%_R|o;`i8Rs5#V@%x!SuD`zZ2RviWnr0V!l=tV?hqEu<ZJe30FqD0*
z^T|z&y8bCQ)<1h`yuyn2E60(wt&@tc&tAXz*x>}9O^wk}i&+$<xAa+Cl%1OSJ^9Q9
ziDSowSL^zCb&5B>`fjYY;CMs3@QW{&OINGbe4H#LrrCSc{AJeO{5ho>OXvEXyZZ1i
zg8|o^(2E>`cHcXk7v_AP65{T3%lk!+;r!zLu{-7-OY0B2y}j(+uDZ+lA$g4fh8GNY
z&gu0qtaR5jPpH>Q*pacJU6JR5R&eS+{f2uNU);YMdeLQ1_20Hit)<IsuO9Tjy)Kt)
zy5Ln;cO$_sCsK~zEC_z|^y$^z`@6TVnCRDED!z4c+LB}WZ+Dkn&Efpb{P)!TjX$PW
z&gftYT^;j$%lZV1^BwuGe=m7+?LuhSkvWbW<+J~q?Muv1nW0w`U~nUmch{YZ)AmoZ
zTXZTnclp<>*wudGZjWY6+VXYj&V+e~Hm{hp=+ufNo#~~$_s`w=pWXX?Qt<8`3(Kl0
zn~kqZA9%fnZEwnQC5`=l;Z-N6Cq8HYpR2K^x?@Vc)Ra@&zEzq3rYWtMeDaCm=fCFi
zeG^}21X&2bnqMp@{xZml`HaKC8Ta<DcH^|&Ja^WLNxlMwk~8xrq&}JMy(>=mu#QK1
zK&`xsAz#^o?Z*sSE|&`&+<ZOjT#uV@)3?Zpo7lcSKPdC#+-H&5AC6dC#m&*#%u{M(
zmuA%eBbuKfaZRmb{TyG1@61QnuhNe%W)6LKxIxP(VROrSk=*M`R<CO5)tixZGS0$s
zPq=>mKJ|Z^i<X*9o!@*~$Y0=^=#QlrwjYk)8*Ep<X|Z<5jrlz9xHm-zI2>zy6C-7`
z{#Z!p@+QUOSME&6OkJ|d(loV_edCUx>xX$iS?&CLd)dEV9Zw#bJ6g91ecPd$5IZfh
zu(EDn)1`IK5*m87RvX>Dvi`Xw%hNycdjCGoZhqZf^L=khV7b+y-{u$J%=x@-(`MgY
zYcx_8>aUTw@U9}Z;B)lLAg9|sVXDU(A8wg8@3W-+&U5beg<gLos*69K4!`2|-jI(q
z((!s`MyI)d?e&E*QXvrvG5=n#iQLf7y*gsS!-PDUvva-wtom54$Lo;ygGu`lXHM_x
z`F`_w?(W+B<<ZwwbAO)gUj9#RR@#Yx*qajX%Xr$W>t0N-m{WZ9dSwf9__|jvQLAry
z)^|6?*v<a%boGi8j~rYN-Z^pMz|ZU_i3P7j`d;bHduT1LDG_#b&6oG#hd!?0yE<KY
zb>f|pPb+6Ci|Yqv*&a+2)P2zy9JTPg{^RWi42!&eD23)HsUKeQTZrv(*Rl)?vAoy&
z?s@NKTd-&9>5XgtI|v`V6a4G+6d&t@JlnTC-m1HA+LTWj%FlAncg1Z~iLKH-bJz06
z1T(jFoHhEg@`lfMw(I|ycZki==-jziE9Y1>E_RIn=PZ6G!QjR0nxJ(a_q=~-6iQyS
zjcmVO!164EnPv40PyacYC!AiZ=(5dwe)amlkmhaYJ%8v+`$pe-@MoI4|7q3R(zbRT
zmw!cBO?_ON=aZ1<AgO<9qU%Y^z$P2DT@M4MTs1m$!erf)0IhllQ~xW4F23S!pJgiM
zy`E~FC#Sx_#BA0wnUa)-PJ;=D#Eyql&1}vL_S>y3qGscLwf1z&s;PzS;i(d(*-tIM
znyCJ&v$?+f=9Wo;>$B=Vg)jym-59^_ym@PEWr*HJ#hl{IHMgtJ9)2fncVxmY*Y?Ru
zuQr;MeZBvnlsm%wCrjJ;815G?$~BAk`7Qey#{6pIiuGw1w>L_}hc?ffWWP0{m{~ct
zA@ur*m#5c-_<Mcoe6*rtclPP6aYr|%99HBAinR_8KbQS7AUt%Z?{wMNPwTg;-1&X%
zb8g_`vL*govT~2Pp0qHW@^ic1=hnr^`Pm)ikNgW-C3pAf+tgfrdN!FYUSEklRybs<
zx&%w<YA)md$DhU6TOB)hW$%ghJ%+z5^ghS=TFa_ra0SmQKJ?Isdn!v`X!R*WZAtxY
z2KRj~9*bLPQmT|YyM(7VTgd#96YGmZ%lC;Jt@|ch8+Yw`{F4XQn=99xD>K`v_i5?8
zDT3T*WqsIUi>xEkSK3{3v$Kr-wNv@H|G#wU2a}oC)jRt>|7sE4`cAd&>^-(6#ygFd
zmhN@pWw+vAf98AGj=d>?&JEGkb_Wk%i7UIX%d`BK;$5SaUnDMbyxSnb|Eg&6n{cb9
z->*x%)?awa(B&<=!hN42e^{f?yr7)_3xdnsgMKe8@cR~Y@lxrQ&}iRzGD^1<Vyo7k
z-5e$rx|_ducfsSoK5rSef4jadGI!!CN3MIPmIlU#MeWFIew4PpP4w#Z*%wao)<;jD
z`cVGYwDq3Te;)fa`^)teANarh&HAMwuvK7{;9kA?Wquz+_JsGfZj{`xNOZSrm-&Ka
zJ-H7bM13-4*%&za)xY&2%#Z)o$NFnYE?b_}qkG}C$I=Xo|7V`+>4b4iz8ZNcgV&%h
zrF;4h?N>g=zdJ4GB})HsO-t*qwp^me?^)LEYr1wT^Z!Rr{xhP^Q_R@DZs|$|28O0)
z1_mhx)Qi%JOOpzU^0QKtON#XhDzDo9Ex&CxY5(u_36owgp5jrmdGGDFzx=AtK24sz
zJ$IJ)?%n0je?@q;sF;bY{B*eQ_4EIKpD{Bq3QS2+zx(#p);<@Z=7VPv4B{E4hwkKj
zRB_WRSM`y_3A5XqvYM7?oKnl&v}r|u-?Se-vrJAZ`M-*~@=CEbQ)rLgrf2ItOI6-a
zDOj2J{PwDtj$L8lle4z^u8Mkb|7+>S6JB47BXcIDZ49%YU8*|CL_6%&p+$G%R=@wc
zD|gcz!{{kT7p>I_G!f)q+_z)xq0c>adv#C$dCI;qWA>&;ZMT<1KED}b`%SFw)w%WC
zFBm6C%z5eUx%Es@?;rh})9Q>?crf04^3*HN>y=w<ZLCRXWd2bmO)h(vt!r8SO!d!m
zi4|j0v)?{5<5B1}pC<eCv#0sFHy&-9{2+IysB4V6w;|`gqi)Ccu3qDDdbJhXqUoo1
z+%lOeAoMSEYR=34R|#MEq@GV-G>fIa`83;<^!qi!^Z%Z|J$?D)#R(6bZF;t!SiNKI
zC(jFcjzTUyvPV27dv0L*qCK&jWl3sH$rRn@%^VAlo!?*g^N;@e`+t76ED$d9c@<HU
z;S#v`KxSP?YOvm^KP#%Y*-zSj@=@(3A^jsp%z`b?{(Q-_uJ6tWD>b-WB!2Yn)AS=<
z#kH>^w`Q3uIMw`aS~#JA{Z*K4kVLP)N#UzaYsHk#uA00cPpfukhWW-Rb%FC)A}^Nc
zX2ktr*~DOeZc+ZGU6$?3#D6g=aBMR?D4CnEN{l<_ht0{)Df7BNfA01)V1M{d;lSKa
zTIaf?mh2T$FS#yr@%xbtc`?6c8*cDA(^$PJw|t}6Spl0VOT_<gm43B}CF^U$rUefc
z#HDaAI>xfkUVELcolSiA(chbL%f1_wFF3z?34^2Vq~3&CQUdW)7f6V`zRMu~G;OlT
z%CiC!q}!|6ZfwupddoTXLgeW+w=8y~9aYK?7Sw0Z<iEXS&0~?(<<0)vZvVN(7^gm6
zYT3M}A79?Ip3!IEdB{`1&3<a6;U)9LXUmc#7kuiOoVD?s9_!inRV}kVw}_~9#2vcj
z5GTQY*`6`c&$YPEUSC4<0>clFknN{azbVdetQX9<u)+DKR`xZom2UrM=f)r0e}(@+
zXlruF(Sq=Yg-My}+?Eojdyi>a@NMGISN<RPtBGetj#JmBq{wFnj$QmQt)Xj=7++M-
zSN9dQoa#>O>#|Ck+z(c6({h-{6sY4BvrX?^)1uyaj57<HjxJiuC4J(ep!ZSpr&+36
z$0Tlw9$&%vxFV#x#*$Mi;`rwsp0B>IY45PlKXph#*-ql=(?_-smWJPbA-%&u>NdaR
zfe$y|P5&$5Gc%X(b@VFvzjx{uWOXx5-RIJMly$kF4VTohx7*^T=gvE}$Z6KoNX3A-
z!^*Z#Qtw^MmRg@)qEJ<*u#G2ITjAV^|4&$E%sO{S-hpqe8M~r;L!n_r<F_^K8>aA1
ze;EDqfoH+v#ZPrRPWPVfz8!G*riy&hgt8^dGd%?LjwWR0Y+{<XZgc#R3?75eWz5`f
zO&Z+YZ<Lzros{xc{!(dXcCy>y$=$*aDnFEdOm;e~R>&SzXKf$&!ms&$yu)RKu0<D?
za{m3y;vw9VmvZ=a;rA<f$3EVV%1KXrk^I<zyZ*<AlDdE5%@a+1PP?7c+En^w)}x2&
zFL`Y@`u$2uo@nfKsbooFRm&N{MTPC5Tz9J`Hf@}~`p5IIEl%r05?Z$^_&(2A>Xu&L
z8(6-8x6%CSr0T-?7eDZ95p*wYd;LVEqQ3S2qO{imuVzkf5&mOeb*5L&{#lw_){QNz
zk1X3GVtw+t))Mv24_+#|*!}YQZK3?}^P5nn?86bS?v^*ST-t5<I$>pZWa@m4<u76+
zZ|_l3n5Qncd#Y4tu4MGF6wfltjOKv#pW8f+ecZN2I{Kk=^3{dyllz;(*Z=>0d%F6;
zZX=HqOSzsUP295e!rF!fUs6r@Hc2hrCwSV7-)vFjbWI%r&t!+_3ClSQ9z@UUp7QpK
z?`(6)fEYdX(v<V&NmJh}ZQ9wE;qoIrq_^Bgk})-7;he^1$%(d(uU0Z`PU8EX^r2>!
z=XHVk?2~t{Sy%3)TAp<6?n~WJL;kz@C99`R3Y?g|%Du2hYsSvU4+_t7a>dSzFL7!p
zZj1as<809OLi6c<5=S=hDtzob(7+OFDK#<CWplvUM;jMbH<;b6YP<5{aPv!n(yqxj
zll(6&+f_D=GqCxG#;&q2=2yBE+OHNiUQ`p7yW8?baZ-qqY^(n2Rcrj5B=~(cPL$~X
zTYEX=d!L*3oje2K_L^f^r`n{OQxDa)8f!&=n8Bm%c%)5!?m73nXTI+WU)bL1#WvNQ
z^|66%A*<1*zs}7I&Dg3VtfShVOnNwJp7Z8ioD#<w(nPC1ZDG1|W67?gqIGYQcsk~}
zcC)19CTtMSp5)o{@pH#rCllvcrYp4jcrQd9HsE=l6}jkHK}HMPr3E=mAy@KllsIfS
z#K74SdvWsVO}asE=6Fi%y5xGPAZ+U)nS<O1*`!_s^d)OD@tqfBlh<~VzSVt9_||t>
zlN+jSQ=MYcHtqad6O#X#XMs=SJOAp<@78<X<C^Ct7U8Mmno#z&`t%-O%NGk~&$_Q>
zX>#j;(j%VynVmLsS$25%E@u(1;n!T_7!(t)dVQhsMBbv?!8?^1ZY`8$El}I3yfrEL
zTY#M6jT*ky7K@q;Rpzjrjbagz;NDmNo%fzcdxW&*g>xPijiJ1M*512(CGa)J+MNfb
z{*+4?XXsAMiTKJ|y8Ecc4Bj>BIzKKx+_i7bi|EApEpmZ{hw7F8p3U1kzoq>&PhHuG
zv&CEPah_Ay`CiZFhos1YJ`*`bqx7=M&?l*rwEmvBmAO(hWtQ&r4_iN1yf93TTKvqC
z|LJ?HJr@7>aBGV^(hB=?@I9NH*_;)h&Zn#FYZJ7Yu~M<|MdSy$lH@Iwi<z~T`AiMn
zrj#Ch_p2sn>H728%*#@rl*-N!6N{)2{=ie+%~Mx;<YsSBe~ACGqaOSBZdzdPoO1ti
zPR3i)`GsLq%^$6rETZYDWE;52p54@DlV$FSjk3o+In+;EoLMK^kTvm=X5*We2e#(!
zx_V}VLdOB-Z-+0;vfpz{`p{+F`x2dHQ(ka4`pK=3+Yl8foBdn<StZvGEhV>uui1K8
z3g*4a@yp{1V0=>4`%+E%S<+k)?TAUwbbaCvM(xmGz96;2?VkA4P?4J0yo;`<)*BX?
zv-4el@Po_1V6#p6!Nd&nt)koXi<Oi0F3HQh5C0%{-0f$f^R=^#N$Pecp_>?v-`s3A
z<B$3J-zNKyo4x;@qg9$YM}EhO@2#@oA&F0X8wyP`<xZaG%(9GGm&kQmg^%l`q2BH(
zty>y1_Z6++_#5jh)pa8&eZ^L*iOe&#F09#q=G3;b1C_lD?Yzs&5B{C8w$G_!i`&jE
zAGCS@d@6Fxyn90Y)Rei0pX<6=EDN5MT6AusrL%BOLEO)`vCpQ439eq#d3xK;ZCW$7
z-B=Q)*IL3>V_6v5d#<~0L1&0iRu_Xr2}_zr-{a5A#mnj)K2%0_$IAZtn>f#g?bL;9
zC5<2XEJ_YPOc!wp(EBjwl*-DBS5!YVFJuePcJyId+h{mlXs@%8#_5Iy?reMZbMpLJ
zxNt^8<KlS*4j!r3?uG@*1(k+t9AWe5s$u=QZEZkAb9=s*(3BW2nNE>s{c>*0^xoYl
zlv@;hd(kt#<(GA(A}c3}{`malpyBiF%kQSlS!6V8U17}GcC|eP5uI<k8}x6MnY>$B
zA@$Sj_M$4^#wy0%h+aMulVH{-vUTAtI}QYPuer3?QT5${x!eon_zX*RKbxm2`!&fg
z51#SgUMZ7Nk3-%_=()<B37NYyqaXBC>tB*re<E_=j=0;S=?7IeyfP`UWPZg}vS`92
z`*(^L`x&RYF}&(z=3Alv*>3^kfgf)z#T0aBi-~<#@$J;o{JHsuaq#9@p(nK-axu7`
zGV*V%JN1RfYf@?4f1wE8aJi?c=S+k;t9q3-<o=9Tde~^xxU>Dkp}85aKV@aid-$Zu
zogruLnk}wbJ~0j)vyA0bb_PWxnwecUF0q;X?8)Y@=||Hw|HRja&8eRzBHq#bipgd^
z+u3QKqde7jW{Tu&*d5OIh5tcS{Fl<Mt+!&iw{W<#$ej7TaU;j4t;;KV_y2o$$mHyg
zTjJvD>>gd&%f+sJI#yjPCwoo0&zF~Gu?j0CvZieDt?ZgJ*K|SVZs{Lyub$rgJpOq6
z{+e%xRAz5sKjSrRVZhzLyI6P5Y8KD=c2m9lLS^SJ)yYCEcQ<ZhNQ*RC`n6@z<B9|4
z*mank7N=`}ZJwa?$g%Ic?Tf8Vd&DMOmq<@s;aVIYSs@~D_U+LGrPjU29@I~GlE8I6
zqoCkTx08}&o6U3su8@{>OnY=Ti^%4$l4riKV9vAa2ie3PKiMmBL2J*EsuQW6JiSv@
zljerJ+~D!**|vi|slqb1Ze*J9o4MA<P4l?p{qOIkQ_Z&&*Elcw6+P*2>zaEXJC!^{
zek|(M@ejOM-rvylvGtdE$blKx_b~W*o763nuytl%#b<q#TYJr$15ykQ!JT~tS;w+A
z&Q`zBU-ovRIP*RG?>3Iy--0=pALN+7ipR-_somxKc8&Rl5@qE<v-)>2JaGEi*2%SW
z;?}t*Jh+dlW_77FNOIODUSa+_L+EXob<~FrUEK}mZm@e#>rGhhubA~D<Tk6A)GV|9
zdAYO1pQTLTm67|t&_ME+!W8Dix@DI>@=ZIj-rvLJnY^o~(viC!n%?3E)%rs3#829^
zwrGuj=vh8l&RSp1u=PGmEaMnU5AT2dn)l3!9K)jru8Lf@*z@md@2i*BE|fPsS>kPb
zrtH_ly-y;a9(%dx^QFnG_ZsH2%w1VG)wi~XOZBJ2{xtvNX)ZBZo3FcS*;NRI-0QP0
zO04&2o|>_22JcJ{85ye&t~0$XdxWgG*F<IgXB1<2lB!?VB~ah{K~pt4C1P&+#TD|Y
z@13+1x$-T__I$XT81Y9&uIsJo-fV*_+BUB~3pxhg-SgPPXXXF7D;LEXh}f5Nbi9gt
zFD7DY@Irm{uY(us^d+7$q;|{MP1<>GLTH}F`MhtLPA$zdv_mE1)ymF&61seT&Nlw5
z&JTB7Kj(2qup=k)FWa^}S61T>2X#13+A3I`d@nU?wt=bjcH?CdPhLC?KYRRR<I1~k
z*&dxnYWE(P+dP>yeZ6$CuaB#9Cd;GnyXVYPZ#|2#*RfNHc(u)V)1PHqb{z>Zedl{}
z+Dr+qhfzg$XXnlNWbFQaM{4a=sUqouQ&aT*SWNyBIw|q%O!KGbVlP_MXFq$97iu-<
zh2(<#yNmU2a*6-7Y-jx$lvJLv@b6up<yyOzTZa_PjpI*#?RU*9wphRHUgy&Cgx3n$
zu6!oPG#RCq%~oJ`+Vf=LqZuKGCUR-!@0!NHDtgI5-uk;!GXuqI^R%8dG`zB3^lZX1
z(;H2%KV@m9pYBfyOFo!$DIjl3R=uS}Pw$;eDt}%Cam>H)W`k2|#Iog#Ix{|T3vAX7
z*<e!k<8>zA)$jTK*%dmo*QhD8zWo`|w%GWv<nq=Z?epHu@|0<hWH5=2Yj^v4ezL-!
z{nBl<uRU+q)IIb*^y*r8lhBkGo6mX+ta4%V;Mn{`=tslVRe=Rwc`;Fsl3pBG{O!Q1
zr3XsXPi;68mQdw8U1{^lX>N==m`a)T9<w}i+E($N!MX4p*C_$hlqF>c4?R#nGczGZ
z{?4|}J1cgGX&rFR;BQIT@<O<8&WRTu8OM%Rm(2{nZ_gEXG2t}RYi^q_a|)g+AMMUs
z#>2<9V$x#qQ${+kPB8B*-Z8nU=$PcO3tO)9PM9n@i(`_%WSC!qhPL{yD_VD-9p0&|
zx_oh9@#&agt*i}v!IOXUYuanYzI|XX5?5dKg0VNit2K-F73X2*rDdjlhT7{su-~~E
zu_)~1s~g9y*iNe|O8YFmSk{=+Xmlj=50CaVtuu=nug(Y&KBc)Va&JbqlKj%x+BMPU
zXSdl|+O<7gd)xAzv&FI_*Y}+LG-bbBe&Qjy{}1{1|9%w6Zn*B>*VFp@YkvJ+9{+D+
z|7$7lSBdxZ%|mv`*)^{JY8Y!<SL0+~v36a5<xh(`nQsjYhQACxEMhu%|2J<rhgB6b
zhrqts7PrcK`g~U(G<N(@oWFWuci^UV7uFq8?+A&y`*+s1mX#l`Hg)Vi9b@|2+>zD2
z=q8gb<1BA$&IhtzvOawK@!tATf?LfN`LjxWKkuI1E5Oc_lHyjH{9Rlri)+SGi#r-z
z^E`J?l-20sTjb<)^`_|i1$M>EANEAgd~-9wx06Y4*~EpKhXemre5w=bdZ&=I-)`07
zh@gO1F512;qe^*MpZf(xx-j<bdBkpTj<M@u___&`E{540W|&g2{es8qut{^dk_;2Y
zde+7KO3t0D^J@B1-F2~TrGX3PhPF)bl}SzgBBWJS8Mrh!$l>3^V&|E~&W87;tx_F#
zhHih%*#35(agKQr^8)sTylh9yk6&tg^dPUh@fE-S#&)jm2ZxRXRCI1CZWo>Q@Y>C#
z2A2=VTJduG{ra7JZS}$jIu{me{8s%o&qDP0;x3_St=e2J3zPEK=zjcB>GIDrI*^Uo
zC&@%CrB+;P#gf2O7vbeI^&TJGSu^$E_Sc(St@V!>{q&wVJ-X;^gOKgscFPbGMea+p
zTn|2<X7O#E-96PqbL$;Ge(mb6{Uj6Hd^FTbn&b92*4~z5{O1$IFP`R>sy%eRHh61u
zXTqc1NmUXHngdEy??#)&#`EQ^u#VaEh;!KyHAf!*a`s~nrtDbKWpgK3q1fTY_w?Qy
z1-89r6Lik>Rw`c2UsGV1%3l2D+gr)UZ_XZ!_~`OJ#DV$K{Bk{yAn(1!*Iyc_<e7z}
zB!0bURDM9u{*=BVZ`u2&ufsaywjA=YPBmTdY{qqKW|JAS4$Sg4H(48FmQ;UHG&pW!
z;$^Kh7h_Go_3T&^?4c}SoS*j2c;niOeOwhG{GQsg3>Kbt$-Zb}?$-1D(BUn&6(1Pn
zZI+i>vC_HW;HGWzVy7M`9tfEFwvBDgX7NJ)_w$Q=+}~X@I`vaitMj+P6vm&k1^R5G
z^VVE!5pGwIh`1i$Jm1yz+gsV^f{o!keg|5X$Z9xCUR5+cv+ACehUQ)CwV4(C`SB)l
zCo~rrCAIh8+`do3-9b{i;q2<RtNC%uetdFVCc`S%J9*i!O+N%*THl|+^L34e>>UY-
zJB!-4M#s<2Yk#($(JA!lS(D6~PpLCb{x0~I&mK7QA+wm$-nm8Z54_uZV?}J?-MZbs
zRb1XjmOpsV#MgiEcVj9`xsJTW9<RKU%a_WoW4iPBYMW`p!DPEdf}xvl=`CiBEc~#|
z{=40&9WN?mW4fO))SaHCXsWNWsG?!wy{D0Dca<i-Hb1d5X@zHE?kq{M`!8>Hzu#wn
zJM&!PC$pp@VyRj-_xKN(Y;&@y(esqNcc-n$g{gV*(J$hGfiL!OR<QdQ6ieIoRG1%m
zk@#W4>81@SB}rd*1{e4)G&Ybt)gV~-B4gR!-^agg|J?OX%>RjXOu<{`KV`CZ3uVKN
zyq4^Bw2m~eaat)Ec;anTjbGpd({&$ib>II`^(@{%``}hHrML2ejuW>^&OM#3G4CGV
z+rsiE=K~CUWFu}A_lBAWMn8%Cc&~8*e<{<`-d4vat}E0m`ulBaZyr~O`mn7gN9gWL
z-ZjD7_M8@5cILo=Kdqv(Cf+I5S(*N|^34rq{>uML)t)-%uWS`JQOmh0`@#J#-@<=>
zcmC>J^zA7P-F%GuxUQMSn~e6{MLZ{*SDsV%lyUj`?qYMtJ==fUf_Gm$Sln^%;Li}3
z@MyJ#!8^YTds`iNJ@FOC+{I_N?R=;8ZP5dfv;_%EIjznzZuix)d8vKA?qTkPr9NU8
zI#1_34LWKn&a`ZX_0-ba>@vYhrb$6D{XUExo7_TnY}&na#jD5brC6(vw-|j365*F(
z)qWuQ?$ien-tQ}aX;gf^D>;8bSV4x8L7&fIpAY+sg;qsN?8-XfTXfdXp?0sMrQss=
zD2^pwjc(JrUf*WyzcMp7X5E41=My;cl=P<*rLR9#m5|FJdt}%4==Wbc7D_L+m8+O=
z?ytdz6v>!rJFW)u+CFm5f3TmGLrIL~%=*;4XU@*T68-aTUnqF-rS<Dp#=vP+OH!@R
zuV?J`im0CaH{;-w>2r5~{y(Aeef!I~?|(n5yk56p(rMlalja(jsLhgOzrnj#v-|>+
zy~)-+FL-WNlrL(YGxPr3OEq79Sfqpn_^=<I?CO+WF(qi}T%NBC=2cl&^OL@<FfYiE
zmfLq?TWWdK>|~o?{!2{xZ9fIYN&Btyy>quhdHauKu_@cud-qx&EdJS)GWCIBiiFy1
zzf^G#<y$KxTHS)Ovt_hv*`;rmOME>i(f_SifSE6KWkS@Wc`wd<{{7tS@Cx}CH**|Q
zyI<}2mT<C@;kMb5<^*S<ZefX%>*q_NE^qtF_5F}}Zj<`fhMuRos{h`FEj#U=&CmJM
z`ruuq_zd0WpXUYcf4bo3clnO=Q^yb5t!+KhShrUDnQg@P+fvpG_O)5^nm^@CshY_1
zbYb;gr(ge8@VW{l@k)!H6x{5)@|p6jH+Fn$9))UHrTts(KGBP3@`E{Z-1n3eii=!5
z`JiOMkGlOCmk$5lWA3zEK>K*`1Jj?6e8aBSOf%N%n#kRky!4;h0+ovT^>-c9mEW3G
zeMk;m_x%2)r;UNTk_rsBoqhT);@iwdLD{0Wvi7YV)|Y4Us_18nY?}A@i|;#0_E-ED
z+?@|uO<wmpH13@H!^g*u_aEM9tl{i9S8e(}AGy$JvqQeFP_10BV++HX_P5Vp`1E8Q
z3_0Rt!v1lk?<7Zchl4ksZ#wvht*kZueyD2EQ7>NZbqAgJYRyyKcmH$oe(h$uHRWvt
zvuw_yo+oFkLvH_Byezp>EoQOQ^iNY3?c+=5dhB_kreW5Rszr_bM|Qrj<@KBubhkXR
zp<?BB=N$iC*XQ4OZ&AoIS$Ce}I_bU*Rt|e_v8d@B@V~WZW}@!qe$MQP`RR)1oUIDm
z&tEQ@n!BI7>S`xv9s8G5kH9mTx)+#T&kOOZA1lt}aqnhmVm|#mDM?f!?!Z*}9{cZW
z#kU{yD646zJn&IqmVMz?my3DJe$CZmyX0}0v($u{IfcD)AKU%(X6av3xn(m7N>o%c
zCJFAoH{bpLx8pB97n*ojSh*Ig@)I<fpm>%m&oWf=%ps{0{G0sTm+>fn>$zjZ%6rAN
z^?6bGRX)?3-CoDed=@wLJ6vSO`DNmlPc1&~p9I+VbuzW2OI$Sz@3eXvrf_}Zze^9L
z7#-&(s@{{CRp_KGYRWN_QBwKpB2T@^Sz@P{r#QLnh`PFYxvb>RDIE5kneV(`Jzn|1
zCCE}OZT?*GvYC|%W)G8_PhU7MpjGyLR%QzO2@`|D&cEh$l0p@_cV|z$kt~_8?24$7
z!vWq58=<uD*@q?_jh?()XYZEcCzcnZZq@&1_4vJDL$Kt#<EM5scG?7(>$>VbexKxQ
zwC#ZKO&%6ix4NUZ?tb>?FqMi}n%r4wYb1a4^278$VvQ#(=9tW_j()`WFs=Ju<HI{%
zdfc}cE0-2Yik^Q|7$5O=!G-xO(N_PY(gb#df6Cd=duxGW{Pc#~d*oQZE;_Z1SGMS@
z{{4M6f8U*bx%>I?3YC+Eyi?9DzkB%WMlthdKOJ-Sbxw0bR!(kP?J;r2`u<sKP9D{n
zqNy8p#A0=-nBS)}0_VLN<U1cOo%!&>{m7QNPJ&{S{noL!hRd5RT{2y_aX06CYrSRr
z+Db#^FLm!;yM2X*V5j_{sOu5#juJMKJW=iXEFI^X_|Ke3Irqxz-DyRh=A9Ah6<MjG
ztjaop4*jVWWvf1S+GUl!l42`2c(VU-qTi;D`6?!vSH#xXHPvrFX?0KA!!34&u~+Sy
zlXbt&+0WV%a)dFqO!Yl;t>jkuyPH1G-<`1kpw`SH&r6H>vNU%){SJC7YcMV6Y{Zjg
zHX8GnUARB7k?Y`Joe)Klvxla;`l?M@$Z4>~rMjoU?cv1!yV=Yamfg0MZBNVG&$slt
zdf7(J;CtKZ*ZXPw)7$<pv304<)}m9^%VK(u?>6}upw${8yCnDMQmLax(TP0&-XC{q
zJyNH3>d@4__K+l{C;x&YlbZZ1g3X-Wc0}d#%=T?`zF&F0XG;IYWv*_i;!MncAAh-W
zIb{91_i=T<-+Y}du798R`}+B|fB(I`U9Ru%Z{L>sMDpMl)@ai`!oO95zZLgCdOfTB
zeabbVl+D_k4NguA@!jTgVa7j^NiX!uUabh{TGCn<`es!&cj38<fi8{bnT~JxCVC^V
z`St3ayZ2Xaey(-T|90!b$13GAsndPfi+X1~-0p8Eo@BdfvNHRJ8yy=n!s=&>c&Iif
zg&F(}f2iNO^S#Tf^eL$Yi_ez*E1$4kf^A=L{_=l2K01`QZ@j|wM0VwOtDkW;ZpW&^
zPWTpv?Tb*=)^ZSDyz%aPm$(2)2GP(-5AVlqYF3K>wlHLu@&&Uk=~j#WUcPoPByGmu
z*08zP`tIp@au(>k_kS1Ye<eF~&X1{*oKyM4_S^Mc%D&<pc<e`=Mg-4U1Jw&$oyK2&
zrB|m&q-wpH<eww|P|1D0S$F1}cVbM+*H5ll;P&au_Z$1Hr55|9waWbQIgrj?nQ-`x
zVdJEL?@5eTduLqzQM>DNw@cxSSEZ%a0h8Cev}iJ!=m$Nmip+m-;p*9MsSK^16OMIU
znU$&YSoWNhGoS7mi&p2r0zRvc-tk=x_f5i+bx$w*c9q?cJ>rMb{bsq7^{FqoA`Tw+
zJuKex%+XcO^zEJlVM(s}MZp>cW+^Jm6^?r_emrJ%{no2C=GC7#_IX<DGdOvWK|{3Y
zoW+Z8e~hw?MQ>=_j%ZJwd#aViJmcp2vc)>~@7VS3B;*%dwpo#<{>s<mx6;0#1z)Pu
zpL&0v7pofS{Qm3W@?R&-->g(Wsk|xv`yJZ}(^d6yKE-|$+$Y%9SKI%w?a8KHoxg7E
z=&Vm^3D`GX&RJyd^sCudGxvtXoL=JmaG!|Q&&Sr1>^x7zWKJr`b#WPf%ziv+*~Qq$
zd7hQR&y0^2gnoauOYp&zaJOAt4KG{r&of{6(|1O2pUE_XNlrHoZ(+W%_uE9_+UjS!
zKi)d7vGODD%$w}R%MEp_S2(;l-61%eWz$!eQgcq7KT{1JgfQ*9Sk1XvDQu4PN`2v*
zjCKjz*IZ3J{NwPxqe9ExS+6Xut4zo(yCdf7*8b;0w6D9@zA(;fk9y@kYghU1iq_A#
zx@^|`i?8zfFTZL#m{of6+154Z6b!HAZ=1G0YLfNLAF6j2=Y0@1Jy#h1&ZR$Y#Xr%I
z<edxWFtQt+Tz>rGwF;i!syDBml8^o*=s&aOdE3h?achkWcK2*@UA5%o(MkUQ8Lh3(
zi^a(Ba~-WXZzLxm`^sEJ`;OJNON+{<hWuD`>*6u4bBkV-^Zt`ZUEnZv`FDNyXa<H^
zMT`u>XbT)lQj1GKD;xIK*55YUr159JJ!|&;zkyjPYJS^qU)%ml?s{R=e6?-s-{w@y
zA8%i(aw1K6qL${-Zy!IF@BhryP_bCW`eo(2t9i+tENsn;1`<5aQnjtDE5F|UHoHcn
zD=J66&&BZk@trHm7VnKT+aq>cf3moA^u;>M-K#&XeqH(H)6sMG+aAu(U-UU!aIa`-
zq>J*$K%Y}LMYP<DC;FN%I2LE3f12};aA-HvylbDWPIYI@5-q=|A>Z%Xx-@^&ZmXLT
z;ZIGxE`Lngx58zX+s~4)u+JLWT}AWGe%`dge8(A`+426L8np_T?0+8JFvsV}gsxT7
zl|MdrTCx3T%$;++v%V&ot#*lB{eAQ9WwT~H%&#-nTXwUiVr|^1`O;hmUu8`T-FjjF
z>)lB+roVcwF}u6c?&^BijWbrguV=V><@=_v`)NNv9Cn#L-*?l`9cxPFYH7Qre)gWe
z`txd~*)QU|53bQ_zhU|HNtIIG*M952caG%NnV;^~e&JZMPENP0CZdn!i&AiZ-tx&V
zXS5Y3HFq9(XxIKe!t=~i4%M!ZW>-5&%kwTD4cDJy(zeQ9Hu;m6ozyhZtt;a$iu|6w
zB1_`V_DWyof&yz1W0|*dJ}c}`Y5hI%{`HjQVcZ&#T!LZiLwqBXyLu%*FL7QgeO5MH
zdB)Dg#)j`*mn+SFAaZAM=k?nihvsV=`saUgTJqJj;fUs)?tdDem0Dj0e_vE(cJleF
z-81ylULKd?xXP8M@@&y8r9HDZ{Zd#}5~0^s8D6$vPGt9k8Fl}Zo|O0{q{W2Z4B2nL
zgEhgR((lJk9n%wS@-Bu!^`$S1BaQ|X#T_boeQ~{U;M1Eb>oce3<ve-(!p8FdeRcMi
z|IV}j-Y+BfcZ>Jk1@6zQ)t4`d^LZ91@3mKZ!7*1Je*Xf_P|l|A=<2ibi+?zVPQ9vp
z>a^sS4k`7?Zw!y#7nSe&w5)<z`Ey5<ecI0@F=rm1=1rMpFT1yU)6qRH*E-(_v9aF}
zDLBV7&D!9&(jigFsgGaG&R3GsJ{ggid$;Q$Qyt@RR)^q;jF<PGOGsp%e$43r>#3tD
zBD^jk^(WGe4ZX}3?ELa(`r*l6zC8GI_vOWZA6GL=%+B9eDWi42_IpIgu?v}oT?yAU
z7~~TQ|Hw#Q;1y$$sPwhjwPvBr8^s^9KH6H?+S+Xu{P)h<<;MfD)xC??FZx?)dh=dC
zV<<yR=fV^AOjBmp)bUCOL^3e4yx~~fyS;k<(%;XQ=YL~77S8c#s>I<JjE{v`OZ23D
zSc>*!RLl*%DZmkMoZ+3<9k&Lf8s>jCE^`*f2Q&5G|HQ>`R!c$RYJ1Rz^9+X{i++0d
zf??ym-yhF9{<?kJ{N?V&hyTv^KVO#UxaZ{SpR8-<9nDeFTTsQ{Sy#!qBlbeht35kv
zKQ0nKxc`1x^_SP~zqabv%RX2?_xhjLv#<YneS3d-^{RK<{~u7lfAahK_`OOI>*Hlt
zsIQL~X8G}ZS2bs?h1T=Hi3hcIPuwGu!9CmE=xpB8a{_-a99N4!&_2D=`@PVO>c-v@
zy)Ua?C@kA_P&R8~LB+~>d!MAI{ak-#_xf3%>ch|fdpG@m)ZX8_H2?E|eIsA@Gylr&
z{8^vwuS&oF>*@aB_xrL>y<eGLUH4P|>TdbjpMJl(xi9|T)T-~RH0u}4ll}2Dem1kl
z>GyjsxYQkdeCunP0#88IuJSLJ4@#cfQYd<#fBounOZL39%ej0#Tj2LDe#5hsHTSw-
zaB>yvKCYF_dct!}XG;L*jj79xBmU3bQ7q_wevyS=f%%&)%GZttO~1Qi_r}6s@7~zh
z+Bek4WQ6{aKN4;A|IeaDvCD3I?tA0*UieRZ%l-fC3=4j(@B4n+!C_~8+2UNC|L0%q
z-}T;FIE7>G_r>XVzqcGX=F!t=`LNASEB_Ur$Uj9XhW;m_4NB1yeOVd8E=4nSr|B)5
zo5yrSICQx;t15r)sqc#;4)v5OAKtB9@obyo>PJx_xdEkmyjv3`>TGLD{}uld+a`IV
znQ`XtAEkSw_r7ucc>Y5<`@er$_428o4o>{DyS-kXgEiv0`Ol2HyDQ5VSH%g+9hf2_
zRit0<XkS>xQy6q*cU9EA1JTZ1J}zO+OM;(APBglc7(RXKgLz+-#s7BC_TGFyW<q9*
z^1N%p7JEw^8nPyQxuNm+i{WgYgy>g`AIzI@=W6Ht<2}p;+dDO^VwOnPUhI!ElU=!K
zk66?l|8J{SvwH3?H+C%YNT2-5b+OQa!wXscWlZ!ols=5Varx0^^Y-8D=lk#N^?i9e
zau4Ta&c^ercQ0GIXwf@`Ne$awo+mw@G*LvQ!|nf}<ySr^2lUKdR#@(;lbC$0_pet7
zub>Ij{lh2flzwo0dtbx1d;P_p`>7Ti0w$MDkFV*|6Sg~Dwfc5lPJZr*g?+np|19wQ
z{iAFG2h)>+<Zm8cT4@T=FJHQuRd9>%RtRdGF}2sNWZz`n1Ch+v+}nEnUkTmcB+|S{
z%p>!Jpn8+aw6!bb!hZJnzyJUE?ZKNLFW!9luQ=xX`PbQoGjq&aUq9cX#Td0p`c=U7
zRk8c0>o8ufvSnK7V-z6P?JF?1qFTCzPekgmoJ{>O$u<A&I`j+DL~COnt-WOS!2I=b
z_wJVtAsVZccqZNO2${Ml-K=4A@07=jc8G@g-1gq8kzhX2<BeN~t7Pv3hL%I~+E~(k
za<T$D*UjP7{mb+*Af<S5wDpgz^S&qlefDwhk>c95rusoI)=hpoLqt`<xoKYG+3Xpz
z2Fs1C9(;RT#rMVQ`PHPGob4McLoc10pdh-EaiP=YdRC|K#f|-(m)qiP8CM6d>}rbT
z?E5HqAhP#}*}NOPK1r=Jj;K8St{vrO+ZYuapegl4A^N_gF{fPFbmhs;s~d!5k8XG`
z?<!rpMrmzF>x<_XRz6GaW#r#?UhMPpf|OQ!?GE#kuPddyKHU{QCUD*}@SET?@wGck
zmtFFmda!Z3QGsLI;(*M1mx7GH7-}0#6wQ@Y7hIz}X*J9DHQE*&ebYWS)Y{I>bK`Zr
zc173I$IVivxUr?Y<8(m_bC^|jo@MJRS3C3Nmyf0zPj8!i)MH7=BC|H0-*F1Zf(_dr
zuK4xw=I+Cvo2Nc5kMViOQ^k8^iO#wX%@bEAE{<xL6@7Not&eTGpFclZYjNxOp&GkI
zGt(66`7XyVTz~H-cS?_UMywAfOUID|FSP{f+<u5&(|z~&2($XrtE*a_t9o)97jaDc
zCu4p1+4}2D9j>d}4&0tybS5KL&ox`2>)}_E)pj*vEfa2Lc4$01P^c??(amd5s-<4T
zJB8I}Ej^l;Y~pTy=+~&f_>!OBKR{XPuwhAMb^Qmm0G(yGgHG$8N#xXSf4IQ6NqX*_
z^YwPNH>yk7*k653?Vf*Hdf!gQC7VvV_$b}A=zF{<&hVkV(KUHjQ;pXLwtdxPV*6}o
zy7Q?`yXJ0@h4zvQ?ZtO;<OKRVJYS;a&OPCiy2F%?a`&TR6)u}j773k|RGxBo!LM&3
z7fvQJn*Y935tLS(&K~Wmd@VgKkhyo6ly3dap#FIsw|QEBq(0K0udKt#7s>f0Z63e)
z<TZz!-)lU7&HmzhtjSXD!<FA0b(pPHzv?SAf0?u@SzzNwhqP1Igzk!dGKpQV<;~|$
zce!T$t(wcfe(5n8?KP(Rw{QGoc8cd*+!v2dC)wVN(6gI%g%z)u*Qt2#bRWlNzq`E&
z7ZOyxmhBWVx3JD#EOq)wE_>)nAF+zLtFFKP)V%#>u3fCpVyF3*985{k@yzQN{BF=W
z^f&Omsb>k>rk0MfN$V$zYoG9RkI0wc-0k)>`Q3wcd8wi7=Q8p`CQDo}+aezHzj2O>
zpL?Ci#ox=M@2`8&HiwV(-`nHy>%@9qtkawAq9MKdZTmO&(iz^1d~4eJ&8A*isouD&
z@x%_l{F_nto_Ig9-|%1^Ymna-#fDVPvl$cJuCCd&vrd_@#{J0L2RRk#%&v<j$u%Bn
z-g55Pp%4eNT}%Rx7uAUzUy`=-#=V^?rZ0Xg^|5Ry{Piq*Hb=(tcZqN9{-kHlyti@F
zrv(e@b904PJ$coV*T%w=XM5(OgWD!S9{sqf*Cwyo_bgjcuzd1FgYL5F2@ZRgY9~gy
z&F!hW-Oc8^{^9#|VHX#kIvJp}kt-u%pIpUy<KWmS3*BTnzw)dKe68#t8?`R=^pD^=
z*=fQRTpH{jSL|)uko841^maf=w{p&^V_{Ew6#we4ZeQ9plhfqfYN@HGWY@^&7Vpga
z@~84kkn?2Sf<T6B%|j0wYt}mySh9BQKE1TC=2GR%YoBxWt+4(eFrUS0bx7v^u8bL?
zA7#p0UVPu=S7%#OTlVAf#e1`x!)3#K)OlaLdw;}bLVbABq_amon56Z&GFLM-ZD4p<
zJVVhT=}Sx3k$!Ra<O_|zj=fy8Luj#z)g14H7?Jm>+=WvwO3s~n(ZGo#@ao=^uU<IY
z%`~{+6V>YydhF7V(lC#Pmi#hdr>Ea%>&!3TwO{?>y(N0p7avM6E))|uaB*Trow9?M
z!fH-t8IBO{3~sh+y;lB|;26PQCMWGXIOoTnW@>S{vchX6=Sh)XF(*cC=`)@A>8xvF
zt)2;NI$&BJS0{Z|t$WtVldhHXy{;UY$}C%(|EgxAMo#A6jOcyW@^$_#?E0k2f7t)r
z3w|B>ri;EG)~?&=(wxiOov8Jcl_$=w>u#uN-|UT(=k9ubP3{MGLq&)A9=UH5<?czz
z9#^~gE;TbWKG@0erkeue(Z9D+BAl93?_NJq)^uYL#}%)xydJI(pC5-GSGoW1RCu=Z
z*V13lo2GrL+{7O(*fmXDe8V}%u*3C?y`E;WJ)2&XneVzg!ROqb_sM5OW!_jvg{yw)
zuI$#ZTUNZMF6mlO=>x`X<sDuoIsSM31gnpR>F4Gt|6Z%-rf>FM{?~W@i)n|#J?HY<
z-mQC{yxm*2C0#yHrhS{<$5}-djxPmsv$lMklzjS1DA)I0ZJ++P9n0j@2{4)U_|)$M
z3r=-buut-BzbE%#!Mi+(*HTAzX(z}X5LP~Vpe?4GYp><Mm&==jcPW`@ofO*fLEQ9w
z#+8moJ6Y}>THM7YFE>|y&bzns<^OT7&n%zj$Y56x{8VH4Ma2)6@(e2v-Tb-wartwG
z2dO(Idnj)6`t-Y^sNhT2djI5~Q=dP5xqGql&zQQW&yVkau=sKOkLy1l-e%6Tnil_f
zS^V<%elL3e9ejU5qCJf1&r|jF-}&x85dL%8pRdl^@`k;A#nO8-_U}BhTlwpol=nRA
zzb60gY-w&YVPV+sai`A8%FedJb;if=lS2P^#pCT*8h`J463dfrB_sRc+?9ReW@#VJ
z-7h?{p`*89&+bXv?>uey(^X4;KJ7L`bADmoee>q2GXF0bAJa4J{E*-%pR!oJ!QCQ^
zxrk$Jdew(ps@03P_%caX%P>mk3iKA=kiULtZp4({{d3lbX&0@NdfVVJ;nTKFYMoZE
zgN{ffPB?T*>%YIFFT?Y!lqi#5KHs{m>RBfloltzXtwG6livJUivbVOyOSBI7sA^1|
zvi5_r+NMq2hU>JXW9L0yYn&Onx?ExZ6!W^not6!&8)8Bg3?&V+HZD4puu0$@!%HU(
z_v}lHpK40kd0$#R@y1feZQo_uT15`%a!WG2+5A=SAM@+)4;8~^^V_@#miIjI#x<rv
zUbF53@7eh-{w>Sq<}C^g$(Q}o{<MV4sibRH<c;<(CZz(;!=A+~$khDzuw8!9j_jO{
zQy(U2e|9$c@@9^@yMlR7M!H!W&$i|%eXC2fF7yY^N;fiV;)xEm@;|C8!yeh=D(Nuy
zqvw+w1_cw!7UX95I5wSM$Ff#-vy|T*)fN079^E}M``jazBXVD2lR0ge%1whb`O;=>
z<LNhadHiFZTSuXDWpCZY53?MW)?9lz>u<7lhr7_x4M$>EuaXN{5irHafO*aqnLK7y
z-V?o9FK_QXtUM|5#r1pH30+I7)D2ta{e8c8d;X1AQ|ji)EwN|XpICTslgHu8#$QkL
z?_G~yBslwuazbx-`*L<Kn@z7u{_W&mdOtsLYWL<}pB_!;pDy11^Xbu(Z$ACKIsJcW
zq22yH7JB;nalJ3{zyEb`djIcoL;a_;_a|8QHeV~5+bw?keyrW=M>Fp^smx3*-lCqL
za3b#Z3&y$~siprT>s}-s{(mP_;9>ap`E$Gf-`Mr1NcP2lD+^m|n{N|ZT-W*jHC^Yc
zyQH?NY+w1S<Zt`xuHC(N&u?Ez_u;ZvVr`ppVmLgsv*#4<WQc1$(>Q}IWT7-`mAS&=
z=OX%=XO8bUvgT^*9gg#gE1uuVShmz`%Vil)`<V+O=jQa!U(mX&K>l9pWzSX5c3f1r
zb$sUAKue2v3+nk+UH@@_`IG#-vW&cZiO+J+f1YkjpR8t*s%n~R^_2Zthpo#TG0*i6
zo%VL*=YQ%y^w?nU(m(Ax&Qy0Fouh8w>2yJ_;^M3L2fGCvoY%x1tJmlKc5->ppT(BJ
z4aQD_kEd&Oe(H|w5ScXV(2qu@UGGoztqIJ{dbX<j%k1|jna=X@l*CjtxQ3n04&f;O
zq4SVKaT8OIZ$Q!B(??T|%r?t4FetKJ8S?Fj=Hlsh6%3yJxuz{NrDxqkK~BF{8~e{z
z&9GpXdnGw}kL!l$#xjA_aJ}LSkLPB|c=NVh+<UhA@887W!mh8@?8{FTv@^*nUU<@)
zrsMWYH(dGU^g_e851lW0JSe)TeX2Im`kln;X6c31*?W>$JZC#bt1Oy*wEu*AktVZ|
zTf`Kd)y$VCbvkV|yVlg)eXKG0&<4xND$a3Ptv#3jUbQv<%~Qa{d)d}=!*1zpktP3j
z@JzjD;w+KY{yJfPzv`!4nf414qt6+u9$vv8`u6htC7X_ze!bb{u|?A7)I;{N1DY4_
zsY@@q=Gn6-heu;l)%JP2|8&oqCha@FUh+`zgyxT)F7I6I8Ft0DT1sUZOD<4lP<i6}
zqNn%r5fh%k%U*ALc;piG_49KMuM+zowRqOOsmlv;bi_BG^OMN^!!jd+``nhLzj>@o
zWNz&J)@X24b@G-(u5F2*I?kQAne(n(Z)22HKBGj!i?cP$L>IqPP0%Y}5&0v?==<d5
zlF1G7yEfW8WcM=2*nE&vF=3ONxMbR_fC*<#PGZ>RbbG%_!`C}esym)VU3agDT~XO!
zEfoD|MLg%JBVRi7ct37b)?PowWr^dTMGdn2Wx<(TijrK7$J>~`Tr>H;w0O%7?tXve
z)M}rA>4s19o*&$t(Vn3){pD#rqnMO!d%7R97JOcp+GXMN$7J{0iu2WehwWB;m|-&G
zUjk3i;x`e+1~;4<dmX0q9}2nEW}>Ej>cNK8nnTr!vWik>?oLUaZ1raUv~6<V_A`AC
z-M)PP|GPi_mEI1xv3l#x$#VNweF*r=xjO4^W8&gfuY3N+X1>Y%#(qM6TF%Ghc_wEi
zcMB^BPwX;HsL065T6H;nLHJp&jQdGzlU_a8eC_A4#!CynG*`a9{q3XYDwgV9i!+y0
zi?B~OkehGjIB&7t+vbf@8@Co_{b-ysV+q4mmRGOyZ6B@v+jm&7vElCVHP$!3@B5QI
zH}conSv<<wU&OU->yCOJy`?NZ_u`tMvwE}tg<QDwfu+4tbyLvduO2DeHN?7CervjW
zY~t>la!t930(siACoXy^zTxfK)43t5i_~Z6E$C(R`sX)W_jBRQCATtWh7~G&H~CQe
zIx!)YeO3Ucq(WcZYKGT=Yc6Lvt?W;gt`$BRcD1>9S=0tM>n7*#HoJLcEIC)K{O(rt
z{S2e&lyJFg(J5Z-{|bM)?D(AfH~B!kq7D1TOtD*4MY$1dSrWIz|9)*zU|qiQ=U;UX
z|HnV}=q%p2W8$|78L~Go9(r5L@WEMs7n9b#+a4_ZlG(n#!u&?>|8omOn#oOTS<RNn
z`z!kEzWB(sORujN+w5s~q%yZ-<JRlN+b_E%#vXHd@i5r^ac<o8Q%C-7PD-7zXOH6H
zxv^_grToRdmKN8huWr5J;vu@URJ%0rdSqzFu6w;nEWeEZcU@;rj1y{k_+>@-r-v^W
zMetSx#V!4s^r7O!DZR#bo6nxUP&zB-;*?#9vFoLKzfIHSu<N~a*i&=rytS^qksqaQ
zXr1rzGxpqdR>w2gAye;tW%ZV5iEzstE?@f(_dKMXe)E3LjJejf>DB6ZhPY|Qfh8fG
zaU%B@Ts6IQ{gBkl<J~_ie&0UEH~W9db(Mxk>KwKUSXJ|N*e>wy551lyz3pU-H1GFw
z-}w12Z=QU3v9eM3?vBYU>z9<hyq{wJ%t73(@$C2aaeFE@8vn~mPv0zVx<4*z|GrIi
ze`_xbpPM~BKHBwv;@@A#etmtrY|j(+CFjre`Cpun^ZD<ir{?-`F0;QpdT!qC&i?5o
zcY_bV|9OA@r<>Q;|6!k!Gu!so`z0H<^PLfj?J`yPb5~C(cG8rYZo&)SI<2?Zb3bRE
z^x~7%(rot4Pmfe-1aHk_+_3KboUX{f2Ulq*GpeoET#~rMtkk{d`N~bL^@;n}KYw~=
zm)0@<+gsjgJ-@ep(p+(cl;$1wOENk&HuGsa3WeFt?F!_JS1-3sP0l-T^7%zyyO}2*
zrP$Re=SQlgT5c|kJmZ$~anY~RguCYrcBz;wUv%n8t!r`Rn$r_L^X*h=+vWXfLGkvx
zd*(fLRn)rl>R#0P+Rr%$%^V8qd?z+uxpb=I?uScKy3J)w+E(q2bMEg<H_zN%QzN$N
zZkVp)()@Ux#uLpM-#hlQ1i#w;CCh=Ir)KH2Ia3~FF8tbaZ5z14DC?ZK;8DfjUmLPl
z6>F?}pzt=7@#Oq4o`##YPtBSQyKlIe2kOX}UYpl_M(Uk~_6dpl-?o+^$JXAB^W3#n
z%lPi2|3xwjol-XMs6Q+=y({k5pQn0yvjr|K)rgq%x95>XOHIYetSdJdy$da0|GW78
zSX6Jj)#P)(3UxMC#UFj=!t?OUzq0g#kKK)ttp{TpryIm)EuMF9*Q8lL_OU4}+j)KS
z)>NI^c_!w3OCR!c3Yi@F#<1hLl4Sj<`xiaFzFm<d!X5goMC^S{McsRY+wEyZztja;
zwfEKE*w?<RcV&8mZvJ+qpE|c9!_{9Le!KH_bK!^Mx<VIs@2KC=^G;r=S5EXzr1#rH
z_qFuy{(SmIdG3MW7vAQ-qA!R3yynoAtf+kPl_bZ`ug)d*Q6am3^ylhj`?G1?cF*6T
z@9WK%YMw1Dkg!lckKJ~@@E>;Gx6H!*o}H{U3>mYumzOfxdp@1D=|Q5#{HD*A6XmY=
z$*PzBk^J)K=U%N1i?08e==%HZ*&mbBbH7N>d6l-P|A@`$%w)bTou3+XE^IuZAiwRa
zW!H&`fzynhX?)gfUA41rO`EiI4&S$pNe6ETE!wuxY~I?Y2G!p`{QIjfF0Z%!c|Ga#
zn$mw;KGzj@wI(M-N?u@Y<-9nlB~~^55rZaM^Lm+QksZ-Te+P>AFfE$C+4;uT{B<8c
zEL*=Q@Y1)d#*$XnQPmvP_HCk9H=QU@GP-WUZy)`_+Uo4P3oGXCwR>G-HTzEFx%pil
zHuKjRm#h%kmsF#zW#7eRJMY;d2DS({WxlqFz6SHETEvqNzgFqexWc!mSxDhVcsZko
z4A=Jdpc&u9j~4iUDw8b?n8%}7D%02d$k+bM*}}-A&x!f7&s{w6=f>fjZC`Z?)cfVN
zn$Nw~Tw}kuO5a3N=Iy38K?ye(o!e2mko5+4O)y*7zW-;9vS%oyI(fWWnLR(YdBWL8
z-y(Nz^_MWP*N=LqxqZ>(njen03LZYKYc)Up;XT7)?Z=wcfBAlSs2WGSt=N11V8paL
z3Ae6px~O4L)Tp@3Y1<F=n^7Jol~uP-@W|YtZN;}ci}m$})!W*hEsTwjQ`$O_T|Pck
z*FE%u&aYRl*M(%yUS76oQ{Yr?#-wQ_GfUprerxMdxF?YxmvZx4!iO4*Jw1K>i+wlU
zHrOe&xoEz}Jf+9l0{I>lL41~N3GLb6qvhL{dKqeHcS#jH6=ZevZJ)X0_m$^?TF+&w
zl_!4ey3s8!&$C?l|A(tuk3MIf5af#BQE=B&<z8{HkoCZW=a*BPJiJV5kFJ(dUn90<
z*WG~QYhLxu7wg;PY4~1jcHE|;PN$?8=Sxd2_xwEJ{$pih&j7O+qiCHcxg2MITe)T{
zJrK&h;2UuIOW-uo2=3n-c{eb%F58g5IM{;C`FW*4Qc2>+r8A$;aCH)S8LTg-b6v+%
zUvk%>Iq%ijCwi(bS+L^pK~~#6Q~oj7OI%vBzTvTs<DB_sUvDn8c3s@Ik0qmbz3S21
zcR3ez{&ds%xL1wSxvlk?fsUBZlk_h;R_Dn`vzA3OznWP8!puhO=JL&RdaRPWa!-Ct
zHk4try0Q4}!M%6yG#|Onv#G`4-eHFF)CBQ98HcBO+hlX}cdu)E{`pQK>+?yAvlH?z
z_;CF^@RU!)$@)n4$HUy=?$Mb~?KiO$P2U=0bFFoC<SgU!Q-67__w)2|wXL?A8opM`
zX7Wu|34M1LCI-c2Z!%1F&;Olw<)dh9^5-L47_}uh4P`tlo_@Id_qEy0^PAhxX&Ii&
z|Lw)S=iIfq{cge+<AqrL>YpU;eK_az_VjA+n8yY==eo{s_`+Nrt6H%AHOsQP&4)fr
zNRgQka)f6NuWY)v*5UT9rSnBMzbiD(@!|Wp<^6)~M(#Q;!TZn2MJ`yqJ!tM%1^;VX
zQ;(=b&hD0IU3jE5>4SfYgN#gatc~;~EwgN$)$ZL<RwlFJ&qU_jIi#+;eVz94)-$R9
zHXXZtEqV5gOyS!Pioac8eH0dveB;gDwbHG3FY$^rvx-@4|GjC=b#aIHZG5j+CzyW7
zyQTW}YOmc~ht({f4UB(>?3Vm|>h7-pvFm)lgg(#UO89#6f^yVSoox%2ZS_gvc+NM|
zp~3w4ce$xy?^ZhGZSRoj%=7qkqb7ciuEVvJ?=A>@*_u=Hy>??}zqa3!n6n{$7F%a5
zy1wwmmhTJ2-)`ai@>s0o`V8K(zq2;JpK;MH;c`uI+`^^j`e(E`+<Ib?=GT^cdGeJz
zXSy%?bUgB3$ilx!;X?oCq)C&yA2m+)Rkhg}ZmB5zcd16cRcr*`QWb~q4{JZ(Gr4=d
zJDc%BqjJ4Vda?Pgh)zdM&Gku4yuR7Sf4chbD>5H`lkIDC?Cy(u87^D@&rEHxlv&Mk
zKXO%XiD7L;-TUlga*wX@op@c@bhZ1D-Il*+x4*h@`QG~(u2Ek*XJ2NFTu^!SYU`|?
zR_Dho@yD0c-urX={O<bd-M_bQJ}b9>=d4S`wf6$H7kYn4%x2Zus{L`}?U<X2rPAA0
zTZ{bHt+ZVC_(guz>FKUv%)y7B2ePaB_v~G+l=5rJx0XILYpa`6Z2aF=`D)Hwx|eZE
zY|aa<0tIi=jVIkjPd`@pA;UjSb#}wTHv5B1);=sd{fFx+kDR&goA3*6Gv}T7@YFx=
zUZ^VTtd6@|FYEm9zw18zUFvDh3%gkVPMtlW+vRlG5vyHOy*0N;uH5uW=3|xN%n7F)
z?mbBSaj2TNBU#b3`o{jlZkyi8eXErCD*tQ7{5_}Ii}`{p=e-dv&p2L@A86oK@;G+#
z>|2+%M9tp)OslNx!|Y`oUF|ZlXINDumvH*p6?JLdyFMkvf6uniEpeM`zn;<LnVlSb
z>h#6c716;g6;Z)Y5_Oj;bk;B2aUgZE_F?t4!u+2-o#mHr-lgnlGC9;=wP$~}pOS4O
z$D3!*meqK^etmy-#$KKcemi9LpRm*}h<z?HcfSko#1qQ|mx`Qtp0aT2<R4b^!+$n>
zI(X@wo^h_=ib~7t7b{B-^~POU6Hy}BVlUD?*Jt<Dr6HlyPF&OEH2u7`Nv79z+2ZfP
za?>*Sg-`OWufE88RIJzNTv}J4x4PDWx~aVO0lscr+5E;{EQ}8AH(4%AFX+@+6U}4k
zueo$7qh64FHH)p=YPV$<vS%hc9!r^iQ@mwS@|A-P$Gz&i^QudV9W=ruPUK$^=*XLI
zxWl-6qSk4hxKn={*{itxT^0$~cAvW_W^s5!i-dIO_r3<fT$S@{SeJcrxc%UW>+~t-
zUzq81mrbaf@<dvtF;`YH@>Z>>h47C_Op6O<q)8{=TBEz=WOksW>h$FG@n!a})OK1<
zn;>ESSE0%%EvxRtqRv_O)^2+-P5tm>S+Nzq6D~a0vfh=;?&`F{&)voT*GF#UHk-Qe
zVEOt=wOtWc(@y(FADJyLr@UqTK6chg4=dS}^TflAu8XbhVd>1=U>x-0-@+eG78`gz
ziOdr+l4A&G*d(Sb@xpJ8P5nAek)jv(nzr)%UiIL?L-QHA!p<8Xn+lxczwv*4z|+$9
z%z5ii98>cYs^71^?SRkArtRy!x7GQ)_`h+bv)>b*S0|-iCviCoFqN@IU-W<OqkqQQ
zGdQd=%Us8B#d1fk;3djgCzkT>+xx>jZua!tzW2(84;zCrPT79@bdonH=wPMU+_m?Y
zt^34z_K{cgepj8poV^bjQ~n-1vG``b&*r8U<KEI0N1q<sAAK=#;T;Qxv(hI2erZhU
z>^&nYamQPT`PljZV{MK16YjYg^jDqKK9=&oQny<oEjF6X_^a6VoO6N?Hl}x}9{c{R
zt8wX)>1Ud2p9C$;ElHK!e<Ptt@u{f#k)FB*Do2&y?mqb@>F{yy`zHjCaNoW2R7k9M
zew#15(KdyKeQZznr?2bFlH8+jrg@!r#Z1-5>c%sVZrOae@~LTk$Rnmx-JN!?*X&|9
zJnUdDxax1gWyO{+?><)sc1=5eElx->I*yZd;?+b|JN<QPt8xVwH~&!Bt(<aWo9jID
zIZfx>4$gk$5P4~<zUiMFSNmxPm?BJ^PKvNb{A;b0i+mubdeM5Scgr+J@ek!vl3w#$
z5_WFXbZb1RU4QC%{w7D4k7BPpK6*@fsJ+LNX{VvZ&(8XbOxDpnSEQ6(s`hMZo1@b&
zF4TL+!E666>$6PU?v)RuJP)6mBgp+ZUs|=5D?#;n;Dy}k(BdMyEq6XKB=n1Ao36=H
zuXx*iiPKZaXswJ|k>fPa!bxtO^BXfwZyjNj^HfU;^H&nm`{8b;CV6r4tj#w)cO<s#
z&&jxTJACWgg_(;c`Mx``{#PgSV##lpFXTxtHn?OlQDbZV)&&xV&DN*(eN;K3y7=FF
zhw3StOQl|`Uv;dB5PSS5tMMZL6VaLl@^1QP9vtd_B3}MA#%Fur>Z_qMSQq43@LsNt
zZ|{}wlMs0}Gc9{z7Z>x(y!nTGT&{|$&GO7&KDmUWDCF+N-q#!ECU*P8E4nUOu`2Y3
zDX00|uKvUREFV6vWfa-wCHjDS0;6rdgPKX>8X@kF$z5%Gnt!&tSnPa%BmLL4%(dr!
z+UlOV&@X10BrDuGb#6?d%rd?Ul@hnlUp3hM{^b8d6I0~&{xnyAb@h>Qoz%wziodL$
z81)%ubMpA#*qrONvgqxWE2=7{Z!hM$?+ATTv1`Z2lEBCNS6|j;I=#4DL|Qs-iT8z2
zR=LjHhzFHT8xoTjR~!>+nXT0CQaSa)my*VpD-T_&kH0^iBi4UvjGgO^U+-rwUdwd*
z`Rh;W99i@G+4`sNiE`Qde|C$${L%dm{~l#;^*3R^ap%sR>*5(TcaLx9s1QA|EqBf?
zes?BOp@zx3KA7lBuDQ+Zyys!}BdZLR-A<glMdzMeux1JG(w^gQT&*?pQ*I<VWCU~8
zeqC1jFe9n$v%qO>PETFoU)Me?6?@HmZ1QrWe;c1wZeTc9oG<!8+F56IxKl*XTT7b^
z1+yy;viHyADo<d$Ep=eQBK{4%R!(7RsS7h=EH=6^shEi!n<BY<W^tinf2@R?rES&s
zu=X#OmbP~G_w4H?&y!#NJHNm<$UH9M{SvL`PX#WYoTL7{+&Hl%qbUEtr7Z&HnYSbt
zsjJ49CEkRrjJheM@Jr}&@%v4+%zu7;I^6rw;pq{L9tQJMrRfJ3c7$pR^&WAK=YG(#
z{bkML7^iKEI`o5Px@_6`Yq5;wz85(xDZw8l@1)q<`WSS~`ghXBC!|d7>H5R=wL7+y
zry7OwKkY9*`~PI?sT+wYd``PXbpP#}`>!!>$rQN^&nTtXOCDz)A9(i9tJ(I)GewW8
z&<vKpYxLe+akz2q=+bCs$)+{!Gq<^I?CMufy%w}^<D=;HHhD^o8=_9^VD8_1Q6qgu
zj+l&w(VV_D+f*|(G;;-*&74AwFF7_lfA?T)+CJsk#Mm&|yT7k_+I?l8s@JJ2lUpa|
zc6r8w5BGkgiU%)yS!?=NR^#lP{$J0yHgso3|2m-{@2|f1n(yZ%&yv_JR~H_O4K!+U
zIK3peZIz7DLFx1g-v6gc);Z)S#DBK#m0z<@t!vWM)1m6$56ro6P{O_IYi8KHr9K%9
zU-n*-OAbxF9WZs<gO^j3x-{qX<{Y(qr}lZ1z~o%1slv+dH!N%lnlSChMV5rZZx2;x
zt#Od`n|0?}<?6qto3>Ti?Y;MDLtKR2)-pA}lXlTXHd?<}^w)1wdMWLuxm(=XN95rV
z;fKiznL*3vMsvDZI!x>-U9D<gx;QI%(&3xZTb(NlqxHXB%T$ujHu-&Hp8h%0NWGm8
znuB<*Z(3G+iBtQdjl%i&3pc7RkU5`iny~C)S;d8vqiM5~=QG6~zQHhe%NnhUOQ%jg
zm}9ln=fX3~cgz>03s$gA{g`v5`SgJ~2bXcQ{ghE(WZN?5=G3|l$@X)ydiU-A9c@n6
z-J+(p^W^ObCAvMCbKRbvxu&}GrYj#W)6%YmR-6lFrUsw=o?}#A+N<8XW^U}wlP6?P
z%$GTK+5g^kqw>D`$XS=qyUVnycJIC@DdX2{RLmiDoXucKmBd@_d+iNe{3{~3SA1xQ
zGFq^=cC|--ReAnh-kbT0X72Y(vp8=bf4X*|XsTzB%F~6WD@tq+33PdJT-oQ=@}g#?
z_@tJ%m3omMK6+$V?>st@CpjQ~dA*)j#NzGm{21<TFzWpr<rjE*kBQooD5K!RH4Coz
zyT1>*V{_?p^XKyA?!S+(=eu+1+@52X&I!63&t|yf{gL-t2&3tefK1izVT$S1X%BdQ
zPd&fw>&vFJ>frwAbK|5Rnl@Tjzqs(wZ}Tm?Rt*csw=&b})HcuKf4^yw@?Ore#{rKD
zGT+~0JL+^dW7i=8N$cIyXEZRpZqIL46<FV>&~@SC*T5+P1<Q&X`ufze^nEU+hA;L>
zD4(IVFj+_EW%i2xD3=w{{(R5;wmB)89#XK5^a{VBwf<DJRF|Dcr&YAk<f?`5AG#DV
zI32N@r}-rRsrbfoTBhY|^~1V3uhbZK?Ay`2$*tk(n$7d0YSJZhb_G|f6s+2u@~bub
z;kO=@LzWLYr`=nY=i%*jGHuiTGS}HF<ykI1_#jhVdQ-;oD#LDO|FT=M%O^Yx+nV*k
z_jtpO&b_C%tv~s;<WaZamw(IF*d3@mXE-^(;ov;0)6cFK374!kjpLqn>N@AqyDQ3g
z*XBK47GPkcAyFw^vv<8*(zdVaca8M#Zxr7nZF{Bf)X!`lK8cRIdylTu%8;%1wW<=W
zpJdXK+;z9B?aT}F*q4eAsvC;5WFn@X$O@S{DVg_Yy~5L!b@vX69z2s>BA)P%b+(j;
zuIG~FExdh9kK>t-&oMArdFZ|8^k(gI#(iwJ6g+wC7j*Y}Oj}d1jKjo(%Y6}><&_;O
zfiG&<STfv&jFz6+tu#3<$|UOI-ft#%dfy!t|Jp3M<cYA@UH=tV48vsB>Xh%C`+ly3
zj#%`cExxUbOl=y2v+Fo`ez)pgUd;Z;H*C3lf<%k>k|fz{D^7dfU8AaTbYa5BPYnib
zZ>Osy_wAnHd-APUPlf7dNpqzw@8{OplssOV+;RT@so3e7Nplr!&SoqwHlH-ra@BXW
zr?=0YP75=uuIj7a#l|w%<no;24zu$yXDq%x+q-O&*Ez9*p9VtbSLWpQy-VYam}z7%
zqpbYtmV^C8bsw6`o}LtmO9^k9Q_1}OZ>~k+?A(9nPtA0RoA%6c_v<?sPU&{$3g7uF
zf7S8Uzk~(HHyZWsKQCM+RNGN4)$ji0?u;D9HCJ_VU;Ya^apd&v6R%<qEGX&yH_z++
zVRaR*<^{(~?`kF&Z7DF3pK7|{{t?MN!WBF3cHWo$TU7Grb>N!_r4<b8v?{dQ7M~4u
z^Vs_>Bs(u6KsI@W?T!hh@rz#Ah8^Ga;-8z@wrc+sHV^)(?EdJmUUlLfm23y*xvX|G
zz8l^s(0R`K^MTi7^S-qn@4_W&tWT})nzTpD&p>dALL}F=yBkj!D6RE!VT{gx@j~*?
z5s4qO->ommo*(okmru=o|ICZ&GZwb9EVBOeZb8JQ2G#TipQQ3GwzZDVwbz0ft*&-v
zYMtCLad)7$<%wgA=Au0NxvM8m%rc4Ge_!Rp!T*WL(hW96?)z?ppE}1R{_B6trRQ-I
zJj#{`l)Q|7B;oXTMzz<!1qrjn51&j@vB=e`ep+~=Y_Xb|;<C*@=UR*ZO-|@$O#bmj
z%xaf?Ah$33chjZj3$`lmKBymFWF2ere93v8U4N%Gb+&bxGt6!J)ce)PxzmenPr$kR
z-<G}P6fUYe+4E$rxP{pizl)Re!urn16!PX+xG7I!tqt<7`M7nL?wvLKakW9gZ|*-g
z-)hGarSp15>*JHl9(qkm4UB2!Di+x6+RI~}I=9ec7thP?qON#>Ajv?lv=wE)-o2SK
zY5(%&?B1VE9&69<yA$bJsCP87_qD^VjzG&PV#ZhAtbSa(`)QcEWu&3bqLn*5cLyEp
z3tx8W&HBI%-W*cqEmhJdcJEQCuSs69_#ykth1?roEfjwLF39OfgRAnSLlLKKyXWby
zw3K;i7O*B(D)qzX1t&aTY~JYnLf}jN-D6wYRvBo&yY*p->rSyn+FRRBODp9*oP2BH
z<YWK+XRELCPyT*nZBcTv_O1P5hxsQamPju=n9JtfoqTh_&ecz%*DP2rdf|kH^pj<?
z!)0u{7#t)Wc#gQ28Bg{sn<nvnT4>$Tnf%W~H=lgDdj8rMN$KU)&nG#RPe^664oYT-
zw^{N>?th+=@0-$qO-757wzQt<-?a45jt5!#77V+N@IJj;GRc>HF%Q4QAJ(hd;gXLc
z-v;fsIwm~x_1@d5UsMckIp33&U2v-E{c&^lm-+ekm;AP$KTk2ZW$W#ax1Bk6FJySb
zl;WXmp{(et>lFAXmhsA-15<Bzvy~rU(#tivs4LoP@u_D)4l|oK`)!u0_F0`dA-7H%
znQttX-6zx-)1IhM8Jk!C`|b7nx$h-zMNbngSZy3^kh(bJ+M)N0vV<z<37!eAy0z``
zA<p!~*(S$U{rZ0>T>RYB&#5v-K1=&E?{CPCGQY9q*yja)zqLZ0#Uf|3_}y8kGJE+V
zncY^MYhSRO<5|?D!K1*MC3WYdO-tn2d+!tu^ocoVaI!Hh4!D@KWkH2k=^up&Q=V}y
zIH4G)s`Z2Yag47OvwhBdnOxWXhn+HC6mZ-UIUHBbR2ui$X0}fAU$yzqK0oe%Q5dv_
z_vY))9cM4x-miSZEY(m{+5b`|LrWubgyrv9lkTQ%u8-e)T;a3b+BY*7Y|D?oF)2f5
z^V~$|JsV~mD*SmSWajC|a?Zhfl$tKgXb4eg?0m9dwPov`D;M`}u4t4xSbN2MA)D11
z{#y%rCSLXJv6Mb`<LDICvU~nwu3fwNFKp7VPPR4)E1ncQElXvOshUCOj-{`aR|dX+
zV#=WH_LSFa;tH2lmml60wNcU+4!ZSN&$IEd;kKydGJg_R^u#v*@Xma8=~Gy7w$cCW
zD`gxa{(aNLwwx*wSfCNLK7@7u*=(V;{23Y#9M%8DWi6=dxOj%iFR39}>#F>uM;Ejk
z`lYQN<^|nzU;JG9=k7^opF5sD@W5*IMf;Z7{i&MQgI<0%vp)MzL;LG8Klh&!7KTa-
zzPxPw)qgzQ(x!OUqZ1Q6*cM547+Cx+bZ&UcUt{!t#g&*n-_HD<Jk4WP^Ows%i_N39
ze%G8Y=x=<m_VHY9%WgyOXGyCn-_Or5Pm-DP&&MF5!m8<N=5g8OQI5@T7!BU>|2i3~
zr>3lxTjq72r!Z@+o6>_RPy3`&i;F*pyX4)ub9B+VP_OE62ipYZkd4Qsf|tCRa8um3
z;O&{z++}x?*Zq)SJMm1qE<MO5-OwUQ!KGfH?QYGRwYyp;obD0g^~^qUPV&^tgj}t}
z7ar4tN~Kqd6tyR}_DhDYSD)@0mSHrvSaaveU@NY>H`*>5dp*~X&0AcMo6+I3Z$+;l
z=U&y2DH7TVOXQZT*iQPOeDW=~<W8S3@vNCn@rGM%R+i`9m&y2G?;5HWR^fJ!KV|W2
zo(zZA+ePOJ&6Ser5WltTxzSF8+o~(uEozdVJYAI-{y=g0wU+P{hbM_M!h{%S-4>25
zUGc1R#XhTdyM8V|wr)S8fAay2yc36SoV@!->Y4nphSL{!3m(r1>56*CA(HqmneBFf
z;c`zc$BT<nSgREkQ<(*pioG~AGuT8^VrkDCzsgPPrtb~CI<fos44$sujk*)&zPLO`
z|BTJk4F&Tg#F<|4K3OckNSv+GeM?zL?9tq_cI97og}m&FE*94R`5|xey_oJr>(gI8
ze0j67>cj1S2T%Td_%YCU!#5ZCNULBk_c^RhtIX^2W-Yp{cCq3|bM}d{LpF;uRykkU
z@OtTU3)OS8dKX?>I$8Li^n&hPCqKvVEsb3A{SdpM_G?Q%cPq91J8B=y-SR|VFLL#o
znd`Gvv^P5QF8tdzaZ=gDb<qmS$Mhd|$4?Hfn$hvvlwIE=`NAWec7geEw-+#%t^AoP
zemG@2Tf5528xQ*!ue<&C*&nlJ=awzA-dt?kV&W4P&S6(}nQi+5w%YBy&abjo-E6yj
z+11fep>iFYxMn<~$<8xPt<$nq&rL4g619JWOOve(_pE6y^V|zLo^R$^=V%>#YvF}&
zPgt%+u5Lc|T$5{oDd$t}MOtedGBd?;Vnfc)5Vc+1x-R?g<C3^P`!7~*-11rH($<n{
z?K$k`kK&^mrxu5NO$?JTy;u|!x0Zj?!*=acmvoLANOm<JHWkim^GW%2zQ8JO>-MbB
zT`4QpZk)HXUsL9I!IQl|Z*7*`#_~MqAj=DdE7Rm}WS9rse=y~i)S)Kng1Sd%558F8
z%2M;))qaa}n~2}q5W(CK#viW(T>rR+2u{+Pr*vyk)cJ#l_g+xfK4to6@|HcTTtgNd
zIWBXppQmchSwoZUM$V3gcUN@xPSB2Ba)d!f!>0V{XQ`HjHAbrvo?TaU3qKaz5Gek(
zC(&e4QK0Kn-(rUDv{OaFyj^vVU$&fdTXV6Pbxq-{lZ@V*iv^X}3S?iYwX662KkxE>
z_4f5iUGFc<RNY*2WpB*!8|m6s!Z#8Vtgo6p7idxV7B4DMxHM$r*G_|y^@sK>7W-@^
z&$=#k`y#~x4VxRek1d0iS)BNwv_fK&>c$lr7MmXFN%^^i>7><p+}Px|p?kCTJ1_sF
zDRX51mDCmdGLta-oBNG1`FfbsEY`}qC)+-=x@J3G*m`p-gUPELeXWHdrOoVWGY)Ib
zC=+9p+b^@P^0D%{YugMiYn?Hcvr5@I!~WOtE|C)~cb5yhZMTfx<FSwL)wJ|wnMK;|
zq4JmW-y2>z9%p@}K4|*&ckAS*W&Z8kR#v2a>+lr$t19B6XW4p=G>hL~^3tK<g^r@W
zNq)ki!|%d9(;JU8mhf$6T4w5aFh{QS%swCWILp`@zvY6PeD1tzPtNX5{QXsDx8{Pv
zqcv4Ix7@b<ojN0JgLV2AZR>T+CK=~u{i#nbU^;IpGDGRKKy4@I4F{K;*nF4&lWy5p
z?y3o%CNH*m!Rr%|mP?;hmR?zyaMfjQ{KsXj&i6LEd(L&4k+ej}@L~Phyd}~W=1npI
zZmH`Hy-eH<XD^sh#{QV^Fh}%pdG4+!)6UCUq^xE58n9#5W-}Jc6uUnMa;~NJ+8AWX
zIHhbp@iO+s3CE(o75}Cs@0}i{ZlArTI4qY{S;pX;o&Vg#wT;Tt*;!KR({pXFYOPe!
zxuc;ZHO=$hy)#d?O*xXM+;)!rXxY!h#aUdsdm66D8~ri6)Ue6r3h$1lfZX%zT#voV
zc3$S|-8Wy?Ym@Vywq;L6(hXMr%i5B6Z+`gXw|}4Lzi;H*xZ~a&vrvbJFEggRnDH<F
z&aQ_$at)0fzPAQ7%nkIDwsht0k-EH$dG>bJXI#gh80mQb)s0Tu+@PFM>ROg_QgBM!
z+@u#TH$Tf=xJiZQi@=loZ`plc4<B~Xe6w76vP;*o2%q_>9eIz+;!-uO&RJ^Zzj*Fi
zv#I=_acjbqyw0sNcFyZ$Yj_b^B3SI;ws_m-rJ_xRdpE>i_}cmMv3$YJ2fMmVd739p
z`7~c9#nf`Qqv5wd)4yNgSfYEITk-GfhZh^)nN1SPUh>s+j-5b(g~yi0xZPe4mHz!N
zyZAcUZSLHc=XRy+N%?hgYC<!gjL;*!<=fsI`EQ)(n~>|H^3+sHN3w6vx$Pat3^`rq
zY_HD0C-Z)}I{WhH@BQk1rlv3)=O{{E5be1uUtmfb+qW<y=bkwwb<u(9{w|lYW$do9
z-BMXPbzPrCpsoC~;%_%tKE&GOpW_XfQpFo~>51|i(HSi1A)7=tXc#c>PD!4j(6i>&
zI<d(<&#a9bc#aqx{!-9m*Viy3Daf$GEbam)*UV)zbD#TcaGdBo>EE+%U$Ku@>Wm$K
zE=*(haq-^Or}C`p%@MvC5w7}&E=U_0+nn{>ekV0KW1-Pg9v8zs^U|)iAJF=?%KQBS
zu7)X>S^h6DJ>#ce_4DiXSZ~qNX^g>V{tM?aG#<L4@Zl8CTl2yt>>D&R4h0|FmSH3s
ztGD^z!>K8m439YuNE#dM(Ps2Y{`xk&dCN53z~ccE<`uN*_sHy4ke6S1oylnS@rsIF
z^)ntESTWh={B9}z?eD&y`_@<WzOJQS{!;R;Hp|H~Cq4W5qpxk5IIq~VGmB;iyqwl^
zu<GkdCaZaiQ~J|powG<X=Bj(G5Y?);yRmSS_kxYzO3e;tXzr2yUS8Ju=ozyggPw8!
zxAG)u{Z~J|j=TwSJTphh-_iH)wRNZEw&h=U{Pxx>=Kep^6;i=Z;%`3T@>;Nr^Bnt%
zoleU_I}Klb>zOlkMT?VrT-jaOJ1e&)pPlz3zB<3o%GRc;)nfbi+j>u3rt(T@-wW9h
z7`D=6oB5o~7wf|Iy_<2#_4}jN`ML~+e>AFPCNH1QSaH(rRYDK*#=X8rZn`Z}@I9mH
z@HOI?t&ZCxGllDq+SfYp-0}Id_Cc?fMX%=V+2+UooqqrOV)wS_@YgxlTy6yLo^D!s
zC2CQYQpVED3}0r|%Y1Qv@G6UM`U8R5ovRX?zlH7aZF<xuu_ZyYd!^NP#`1rPw>I8=
z&+NQnc9v6F(S@w9(Y=dSY0ob|JmG)LlS91xyEQJf_(y;6o@=x0XK0+lC8+~%*741`
zo$b2!w<J^KtgdpmD_o-KGO-pf0?sDYd%VnRtH_l)prud}T7E4=;k4gm!5y17YFzdT
zaEg7d!?<?&3w6Hr&w3k_SU>GK_Cr|qZrX)6{Ot=3KT98f?iCVJDEO}Qul}m`XO|cx
zxVFe2TsY&*Ve!^8BHHiwa74~*u9$V>-D0T)nP+~vhgFtMvXK)1D1Y;KkI>d+#VJ>1
zFWr0{ao%aGLtAL%Y?DoA^P*2KjyfK+I{ND|mpfeP8<<u|1m>KWFRZmPSE(jty1IC*
z)|t;AHn%1V&ungXQdV>@Dz;NRZD<&C!L?$+KA~&RpZsu17l?FRA$#)ri|sEpqdP?o
z#bi~cF3T_dlenq0$fWMbf^Qdl^f$dqoO=FQ<6}w7uOhyD(VMPjZt2*b6kVpgh57d7
z6AG0^ZmC7lF>RT(tv-{lO|<m$nl{zQw4Zt1`4@86r+P7NzH-uf*|e?wHs!}vME-o2
z$rX0b=;%r^pO@_Xuht}}@hkt0)kpR`+&5W$3IF+&IdQU=`V87qvcByoP5Hd-TI#hr
z?G-mncupVG%@IE^*MG)#)y!I5w#dTPg+ijr+arq%T3H;USFOFibl%UJy7ccxM>0aD
zK1fRmIDM~KZvWpU>mGUKC(kq8T_v2-bB!z9@AzwvJsCMGe%;!XDsBDW>frRJVY$cT
z^BMmbt}p&_OWAg6n@rcWY^J;y@0_Px@+uIx@F`C-LABjVt8UMZxMwrZzvWQg+bm<U
zwvgu?*ROd@{A}(;$pJofC!}{idVkK&ap%P1Kx@kso%XnppG$8o4=*!J;9SV6ZQS!>
zQ$qK#mZhps4H$h?7RqI5N~ufi%gCLld^9-avj5A8E7!R1WV$}F#ZmCZ;lxRjlhO}1
zGD!VqwPX#M$Fp}{^~LEa&u5Cio>3V!|9pa3R&A8Y=fl$0cN_U61UI!EJs<YP?aboU
z7adrWfA|08h^=%nb6R?7(Kofq2Mh`Rvm#aPo;_XUm;J?a?sA?PJOMw;{&D3ReTZJZ
zbDh17Rr%!W6K1l!+Zg<%-;hO3a+BJltV?N9yBjj|ZfM<})|X<u(9L&p<ChQ1m7Ntm
z0!_6V-(FJnxxtZ_yQyHgU!sgx=1;|s;a>tT3Eo}yTKd*b`OBr=vyLxZa_}K*=95o5
z^@Z2n{v5vk{+jgW&#NcB&=B0cX`SOuE_R2FCV%{rOv^M>WHz1UX4O9`^H%ir{HrWi
zl#Z8H3ZHGiaO%w}uA^Z$g1A<^NuIenyWD8fq>Bto1=dRQNPWnVR;+$;mV3u}qi;Jd
zi8Z{QAYy;x{A!&E>#JYR*s7z){C#Hnuk&qwZ1v6;b8jp>;^4pGwJO_<<@NK!r1cjr
zb$v4V)!`Z6m%e@Q_%-w6H;Yd_{%G2`{oBL+>Q{1hc<ldqYlolIxy4W9lH8{mvg~PV
zEKjp-pVY71W4QD8GRc2jbDVB3o78-}S#s?}J~!_Ge=q)q;ESQGr^Fdm7uFoM6V$%a
z&Q)@N;oH@N`}^+gtrX5PcoI}pQ6z9|;niK&I>q%lpT7L{V&0X`_nJr3wK<#ld)v10
zUT@PWiGAI-sCI4cT=`Hv1JUnC_~vH?&v3f#wRP{p$tUM<>{$JnYxjXLR`G4p#my2Y
z<je*CY}?LRaq6M)ukDvlzT2DE*Q~%kvp{)))F)N$%e$s-jXV_`@&2;JyURCpjKYim
z*|uF&s{Y!hnQ%>T&aJgST?<^-9CfjHHpwK`T>4Q#?ynR>Z=L-L?#hP)rb(?f=hd~Y
zjBLo+9dKFiu0ij7)pds_ym36g+~@M9)D`J-xB471ztQsM+^p@_5?arGd$KA(f3DQq
zUW;qrT{;fT+?H(3aLRYZ)!*+0uX(NRnRMf}V}X+7=}6yK+)i;>5oW5t8$Fh`UwI$G
z_b@eeme1je@Ec)WMnSrje--C%-8*^V&s%Y;tv7GGz9g4xzw^GCew%NXD0MmPHvQyt
zzIf(6-&3o#18;t*bw2N;683pswj<+7z8!Avxr<sng_Dltp7|uR(a}nDg5lClE)w+?
z3;s>qS-o=evDC{emib-WbK3gq?oHj*VvVOF@}KTqy!To`0Nb1=_omN`nbS0TO%@Z&
zQ;lVlf16!#G&E?Lm%Q+OnNo$~;|DJ#4+^%VZvWTFFmam=tI+qH%-MB?vTxIi%QuVX
zE}LC<KIE@hvw!y{3HM6rx6ebCs?7>$`ChnE^!&Uxt_vO5cJsvk-#N2RE!E6xdD6VV
zFOr+JRD(AjD!kG7@<rCgV>66IF6448*WmlI-0kzNzTHzS78<g-pAOs@ZoRVZP3YAX
zrODX`r6yXZ9$J5363?oCbCh=F&Mw+@^8@42{o;HpUzjs-%Po#FJyw5`!%X`Od)NA!
zzxxlW%iNWcTA%waeMOVx;z&NxR}1Aj&J_JvHOpm%Z}`G8i)WWMePEdEtD~VNzkL0r
zYu48K`(GYp=nt5pu-|*1Q_+FICG1QN#*d<W)NDhJ@vgu4r7FsO!>?6B2FGmpDkf^`
zJ`32gIyT~GfCuxj`|BBc9pe^P3g$5GUtDQaz3*wSV%(PA@I}TCtSmxh6AUgid}~_O
z^OJ9?jLMGheOVvY`E7VC`(m@9{9D$`M(Q5kyiQuiiZc!=94ea@@zQzWL(?hcl1mS3
zZCfP&Q%!#2f{r|sW#@mYNeaGl4L;ne^LWprkW<T9mM%(vZ<OoU5G^vPsNr0a*41Mk
zeEnB$Pvz5?dDult@<ivfJ{C8>x0y%hm)K4TUo2`V{4lHk)JEq1T(N@kM<4nbIKPE6
zGHqUQQ>=*Vxz2lm7rCjq+!NgxZa;_?KW=$3Vp_)Wy}loBa&X!A22P)MHXtEf-L7lu
zGz&&Co-=G4?_5t@^ibruU(YEQ>7AJ=8_qZHIJc}j_UYEcse2batj@c-cz0Cw`(4%c
zL34^{-MyNt@t8gApVuvm5W~L7bKLiqoOfXJW!N{nUFD9tlUj!8=Jm3xuB3!@I?iJK
z;+lHYPE9G1)6zZhsDu7a`5nuwj%9t#n_2tTD?;kSX^ou=GN(R`ubSyqd}2%J=8cDT
zL~cLHy*xkX&6g#I4~4B-UA&v~!NxkBzoHvvzq3ea-lxaAdveXCr|WrU^CzkNx{>%J
zjOBoGfJ4frCokO9U#wSP^}A7Q$K>9<`+$jQLV0&+>Bkk0*P^l|GxsX7pWL*I+xJl0
z;YVy5mN~~h-c=EoU-@fUE=T3}%o>fEp)tHooU06uN&mWb`y<OmLH?{uPvm}gYFZl1
zSyVfVOXUAk$r-LX!HLp)%(t()FQuMQXzla7+}LWt8`1JV4Qnoa6*kg7Ccyj2Gg|1x
z!zF7xZJdoFB6H@N>;B$&u04IOknShn9fJDRJF4BbC?Cv-=AHF>+vO>VKOXvqn9Wnz
zcUWK7uW8${-5ZaUbMEJq3%HVY@m#UfOV24gjPHf)H1JrJ(D8Ba{WH#QxF#+0k<I&l
zi2bt6soHPGaXxCNilSfk|5tb@G2gcPfydJ*NdcefZoG5+RnGp@nlxjRzFYS+4(Ck%
z|LPb0zdzYDvn4n%mUHJ!kCHI$jZw9~Rob_{WtUpSBd)Mp^j6NTNQNI*tv6{1#rCrC
zoz99=c%F3P$LW?0o3>@XmFuv59^ty%wMXpQ*0}hfeJ@=Pq{+O_v&>!8+<f)KwA)<j
z3SkK!uZMm4^<n#V_PrgSgU$clHW3VQwTo!|weyP4RoxVmyEFKuyu}vt|7M-D+h}XU
zhXZ!=4xG95)Zi6cyW`F9nLa@=+pE;tUd){`v9aAOuXnHQ83o>S7k#@~mNVO*zFBwq
zEn7vI>$&x-ZDNbNp0mblR&uT7yI&u+FeNTL(c1VxVcqmeb%!HmdaqTe9O>Dx<x1dM
zuC@ba3nqm)uM{xW2vzWsW}biFNT$Ey>_O3!$69YJx}spIw&|V$gKGCpjmdlc)=q!%
z>`GdV?6%!~F|y50YK2^t{8JMPF1WsW@aBhx?T@z#f4`QzfAZwPlsm;5(uPtFCDWwO
zM$HX9py7H_F-~RS<EdqaSBg2xR?Fry?Y?}neE)^wLjk@U_p<q?@Xb0Y9GUuM;)g?0
z+B46cJ8z=@_bszq*EXmBGiSOSJF!HVp>w5~lUx7UyN8q;WdD_v)Kq=YVmQCAzk=n&
z<9MeVk>bjy7m8lo%h*@UAjxmB)Zakmfb)XX$3f2p=UV)D`y}E2p9iAb<QSxO7*?@-
zD0k=jbMoHJNQRmZn@(mPFkWyWC^Uz2j*%f(+GmC5k%pHldjw2h+vF?Woiu0TQ$D}g
z+dFRNUbE6N+4(%QR7>Cl$F><kPL8EIjj~6qT~_uqpW7R;T~s5!xA&rYJ&XJ8r3d1*
z;?0h+{5XI5fZqwf%o$03Pya>w%zmqv(j|L8d17_juMZ#Q9Em>kTd`~EZl?WjrQh1?
zMyOnQd$`_z^%}v~yIJx$5_g1G@Q5tFP{{W?)~NjZh7Ik_C)&18i?dWS$TYlg<2L_I
zkHWs_yw88aK3~kZRQ2<@==x8qUxz*Tr*V44=|sUmx5{l#>yx=os&e}4sQ<F%nY4GU
z%=6q;jAty{jVH6`?mE}8Y(?O@=iMJ8R!;X_eNlI(^`@EnH-k2m&%RO}Jb!s=FV~@y
zNnD$zaoL(So^_JgxLhX1!2D+J@j8us&A07l+K&`DFZ=9!tzDODeRIN2ei6gl=7LpX
zJ0#dWm2UNkxt@z@kbW_%U!dV@!|~-0ONBJ|1hxFH_1t^!<<1utf5bYa-YM^AN;t7j
ze$nrXi*6mQpWv*bf1H178qYnaHm=&{$)DHknp=M561T-9#)QyRmG_2CttRY2OL@5J
zQs?h?Px3o?{i}we+^2=|)?WKKT3D5>1VWX)3beg<*@UQltvSa1YNi|?TSAL;TK}K0
z`x57>ul2v<^?CG|f45%T$2^B^hM8jWCt_`?cz?W$np(qoXw}V-53{mYe)K!dbJ4SH
z+d|*o2^NW0ZJBQtwlz5}D2`gQB}-;giNvZz&c3jv#Z!e2u21ni?7NiRc)CsRtlaWL
zg%Je@s$^tXRC%W^;r|>`F|TOKU3Tt&0((13a<ymh^OWAnt#p4Z)b&OA;^w0YXIiWG
z|NeVl{)^XE7r{R({{F8m{QqI!g{KCs6SsU#IPk2qI_})&&PjV_q?}$V<}VPZmd3`m
zB(o~yS#IviVpD06){sBTXPnMDrFqgy=B$6z?}d-%999&Q(Mokl408LBtl=Zun!70_
zbKV+l(XIX0!b}Rnn39-RYMrf*oy+hu`r_Vsxs|JJ*ktuoPyRWid#k8^m2c~s(|4bl
zUD)`*ky&28eEEcZy`Mf!`>Q2VXRW`#@5cF^4@&xfnOPq?spuA`;C<(-<`LC*0V*6b
zwsFT#KIrgPQpiN9`HHG#!pAf7&rjXO+qNt1pR=QwxGC$2m6mgqVjmTJSn{I0%>U56
z|L@{wpZ-=jb5W|rE1M^^>r2WVYd+k{kk;6LcCVV!m5eEq0t-~9q{?jYl03wBW33u*
z{O&NPzKgP5Oi_6ei_Se-v$CWh`1<8@Px#sQHHgLRHduW?Ii=RdzVL9~oj$KKE@^Y#
z+Rcw_i|o4E(R*>>>T`uY{2v#8J{cZasA{FSggJ?Id$ZxCEqfQPKAmzla9>Ht6?Wxm
ziD4I}b${P*=7_PgY~;l!9nseo1~0h#e&6eDF@N-bU%2M6p~K+LO@kS0Urg=OQnS!t
z`;@XkMv9?O#jHg2%E3*Wc7M~e3Y$4&ZfIHN)T2LUKb~J_Wl<aA9&IIgVcX1a8$I4B
zIIhsB68LcK;nc|Q-(vS}x^tU(_O>9;D-!#1EJP3Na_gPZbx!S!bdX=utwe2y$M@!4
z_GDQ%wMX0ke$j-x5x@R;vHm}7bJFiaT;@0T&BENJg;o1`-qw8i^@ufU?S<`gQ@2l8
z#kcKVcgUt?27(!PJ~f>TD38h){jvA`pA_pWlYh!gyV6o<R%CJM@5G=e3l)v}*H($^
zZXH|tdZP-%wSpcqVZR(9>FC9hP2xNyetzrT^PT6<xZWZ=HMsa72OHOA5rrM|I(fu3
z{w65KoZgdnH<oJ=XJ5ayfeyo+*`Av&7fP`w1&M_h^_wZSThEw0CGE}A$9tSYS@Iql
zv8V(uxNlx1zC>)J;g<e0??UdR8Sm(C6ib&XQI%+8T5R{iYfpA+ALl2X<nYI5uL=oi
zat8VteOo<K`BN2F+jqgIOFI_jSEwyWD0epGvrI~rRSYtc->l2uc!Fi=lUk3CAhX!p
z$LdXcpYj|qTN@d$`&(Dc?M>bj7*9{17<9Sk1;_piOnIz|OFw1_%(K>s|MGRQJCkwy
z>B?h#+-9o}=RNY<^GD3|z%7Q%$<-`BmK7%mY@hNcb{YqJn~_0C%f`9VJ_7G{K6c+T
zk<H9PWKPDsL%C&MXO!kl&Y0Kh*0z?pJ$!P6<pP6i|736Hb6q}pSmncFtNdiS54F)n
zmN_#O^tN7)sE@gDA^&B=7XGf|{8wUD1#g-0aP{>xv$Yd>zpHNx*3;hK;br8q^OzJ*
zvU1V)dnrNpG_skK7N2-i`0(0AmH!Hh&OVc1zr6U)!TPwoMYkmTm;Klw{J406`y>^^
zV`==4lU7a9O=CWB;>4zDB^(l+p~b~UQisw^MK)JPW|tek3W)N(#wuc();00HhoH!+
zW{o_vblJQqzml0f9FDcVWb^N`Jj%E1!#p(?w$ynUf+5WUAMLGzgssn5<nivyuZq=f
zZ@AN;+~oVr`P{8XLAAyf6~;bQfudXcDjs#tuzh4*!M3}8!xOC;>GN7;kCql*`=q)1
z`iYEl88v*xD-ZNe{}kEN7HRrP>!_imf8EaCsc-f<&RVhk%U#_KyEn1)s!w0A-cPw#
zhxadM=D!Sqs#6iHTr-VK=e&P0eYT{t(=)G%deM6kDi?lu+h<9A(#nfwn($k%)5StY
zqJX!6WB%0;U;dKrtD7!+uW&7_UelEIE2d=4qr2X3=cW73d}i{t?|XKI_9n$>ldm`a
zFPr!?Lw;Gy={xg+CBF+^X$hRAcuB2SXy&dNO?Ot@y0U5Q#fQvIH-pcVHTZ?B%4Xcx
z!#0uC@$C(<&b@7&3Vyzdb)HK&`+pfZRf$!;Qr<05^V}ujc%9XPYKz#Qpj}S$MVZ!m
zm7MBO)^2gy@Io*~ge91XrSF~Sv6Z*_kA2+h@*?s3ytkHnC!JRFy=<~YajKY0zR!ED
z=Yp+XXE+PLoK`wA#o0G3AZfYS453=i!Yds=K4~;hUs-p4$GeqR7GKCYv*6<?{y8ZD
z--^$x{_#<N8mc7yj$vuz6aKTud>+m@k`dTra7Cage4*4tC*6gjACuGB!{-|?Cq}Kf
z<2GrI)~T&R+um0!h|&rdQ!Fj1unrPx`aiey$f<vZ0yjGuFP)XWYoxGa&kv3!KjYBD
z$JeV(-1BnngP@S#>Njk=nad`7SuMV|;O5@RMt?rs*rXkCIP!4so0n@u%5r=9y)@%b
zY?$kL=A2?}ug8U1zaCvWH?e8g^X|$MGp}-~UYe8h?Cv*(1N#mvn3dok#(R50Zlvt)
zBm0Uc@y9N{<2v<Ha)iZ~@cYt{Q*Gv{pZ=Hd;skS2RYjW!=)5b5SH4a!?|4`6$8rVs
zoonz_d{_Q_U*^k&uh+P|=6db)UGr97Sy{R2o724IVLEdKvL@J7rb#f`^R~}0oWr!<
zzQ3Ha(a1LZ!pwBljN;S?zyFQ@ei$;H`M~mjpT?)3{T1Cy{@lym{z=2{-vK3=^=XwW
zn(NzFern5J-@w5d&S)*Z{qxp_v-!_AKCvpbUnl<Isn%@nK>p1$J9c}QUS4+j|E3di
zY==L6xxBWIgF|9wS71ZXjf9dnxm?@dE%|TQ@G+PFSmSqbwS%?S-1S2WyYp6DZQ2v~
zRKMX3)4i^9DYv}6G@Kiy7EbThl#O^0lKLym!Z$~`xXage$9p4zH`{~LI+bDtUtNkV
z`*G-A#+up3uI^I3U*Q|4=k>IOZ_E8<H`m#%3rjaIH4JH)t-@q^``Kn+v!;lp_3z`}
z#7I39GD)y^jBSXoKO%Vh&Rw35CN+|YFRq?_QMpC)@Gq-tX}RJuzJazPXYWqh(i>BH
zUGhQVy{)V6?C|;a+;Z1^`TbV+rbd;R@r1NBmjoVkJhtC!-`5wV;p$egdh?9(KRsGK
zy>auZzTCEV+%t9?991cNxuzxeg`fJJ-&2$C&J9Uz+c%Rv;sfs#>xW6P?D?U-*51qi
zJ-yR)d#C8XJ`v_}Lxr`Ick7&p*!t{CwqU#DC9^yJcefpS>u7wXse6X(oa+bQuGC;z
z*rv=^_bO!VQIpxRi|1wvFMjP~8=bT^p-1z1h)V60AH|A#A~UXkc{J%x?Sq|}&ki?c
z2Csdq;yNw1zcg~2Q1_pEtB&&MzPOX&bhy$~a@iF1Esm)+nwu+|51Q<Dy?tUk?CeD8
z9*x)}XT~STxjbu9*M(_2nDGno@A7^(&0%HC{Cppgh0Rjjo3}6F`H-t-GP(TB@u+h%
zgR(x!U$=6RFLc>D<8QL+R^d-aR=ON0VtmnSv2)Vy8ktv{R|&od{^ESUsyA%&TRVZO
zsDNEQXP8#?o-MJgUCNvud{Oef+c%yZ{t|Dw^+u+zTv%?)sZTOEH+S=yqNvWypMtka
z`nVUC_$eE16hCwH#=W-GPfOyD+>Kf}`9%Ail}xpdIeV(uw|&ijY4W(&O5tW>q@}a;
zy=m`OdQ9|jpI&n%sv^tsc>jSZMpsn~*FAdsx8pH;XW;rs;}y1h@_VdgnT*nle9D+w
zo)tCfSydLw?vmQ9>vL|Aj@r`+Np`PI^MX%4Dw$_D@$LUyvsV*O$)-G-&UdJ^uJz%9
z&=*fs56<Q7x%F=EpV-=$1-G0lwc3>abKISJ^HFumagOzKl)tWG%{|_f_gdg)Oxonx
zZ`Os)oPAMn@eZa5w<oR3x^#JOpBJ0O0he7>Ppu93kJqR#$v>z0T`%<EOsU5*OZQy*
zx@V4Uk(W&!PmgV&uIHVzCyI0h-m&%zxQT93y;QBbTiZNef1BgH``hO2+0nC)f9@;0
z)2H~(w@s5w+?VFQ|G2JbSN;=+OkR=C*T3o<V4bJnacb?IOZ#S~x9LZn<Czokos0S0
z^Tp@5XYqY<l)LjeBX8kJhU1ynvoG*(&3Da?_kH%2arT)rZF{8HisyzY+<PXoC5OkW
z$mp+VRD{&c#6wKp3bi}$g#P`xu>5I3Nv!VtqT7tzS53cV|6wV2{UZ6uZsyCJs96f9
z7SEW<)IB@l&+NWwdk#%s=dTu-tsk@YbCICcohikh&$r9TZMgR5`Rg^#e=fX9U0C>1
z=|lD2FyA@9_7y(i`gW<LZjuB0=U-8UQdY8uIYT}rmk63(aqi2Ua&2O~w4P#A@7;W-
z-G)uM;yr5=r#s}VuC@HQ^qhP44N3pg2M_nV-R?H%=6NX|cJo=n6MNBhYbGw8-FHf7
zf;{V-w}FveFZVUrCvVIDb5nvhdX;TWs!Q40BQ2XIZr*m)<V<>5Y`3KElIQ1CCMBrw
z@XbGUv^wI3amTSHuZIhKdpd1aMAjT!FHybd<je~ft7i+WG76k&=(WjBi+O6KVsWp=
z&PqeQ`G+gQo^D&CDEeATVD5ZPs~Mb|-2J{}?7G%3{`up#?M8VslI54JN-&oA&*X5r
zBGK4;mdmmm_pDzjKAIs_lF`I5bLaV*Xqk0RpKmxEOB7K1!2PdU@cH5y3~@h#d@71q
z`#yFY+>!Z5Y1xa`jEdsS>UUdXpFXxer!+&usP%`gXr``0AzyUrsVJ>wr%t?YnI*ZY
z#dqz*o}3(R5s6twGC={1ha>hD3B8(h`+%R;$K{5<nRb@`{pGQ3*{UdkBXv(|E(*M`
zI8^?4Y039lOzv|J6*Bx3TB;Sk^W^KJ3yv*$p3K_jFWEY?KvsLBChPHaGU+c^+HUKa
z2^?N;Q5asM9LJ`dD8=aXJ^6{vl<qBS9Lz$!H{3R5idpqf$-w%WYH^nFtffV}cJG(8
z{juhRf%m3>P|H_gck?pEJsy|2_v>a|o94!pU;OOW&4R>L1<^Cju1{Opes|q*E!9^J
z1pyjbu3t@hb|&s;YG3UjpwY?TZZC7gGyc}Qch@)+w!Px=DSN0Zm-KQ`7~9%KeJK+q
zXL2;p(S6-<Rr2eBH~u^VN&V-%+fQ~@KD+jHSBlwlkwdTbLicNm`RwR?xNFazd9tyb
z{-OusQ}4t~zG8GU(PHN6{Q)OVt#gVk>rHo>DN|{_>$-2@kLwDpFJB(${P(Kj$HeR#
z$7eCe%~e0l<69fp(x__hac0I{=PwG!BWf9%F7253!1bVB@C{k39J$ZkJ6<1Q(GQa=
zl3CF`uXNV49JZZ03k-`4_q=#(FRRF@w9PljBw<DcE6;jm$K08WT{Bzymc|_Dy%8C+
zq&wj4f*Hpawlr(Mk(g^R<Mk>jgYQcUO?P+BP&`+9E_><TqTsk<`6bec=XoUi+@m+g
zXK)|2ZC%`%oPYhEyOvwhOvTr$Io*<O-1%_kgWu(2N=Fwvug=|Dx{l*q$prP2?DuZ0
zi*)X*$gGxkIpKZn#G18+hs~UfGPAec{od*vI&DuVgQdvMl$<Tsk1zkt{<6RN_x?Ha
z-@TP@X%gC?IcfG1t0gRnZw{5&T34Arner&5^y$(!TgshpX=!h3dzM@5f6I5yh1q;X
z)9da?EIl3f*fTCVqJT}l(j@!Q?~lQL;#U-sWe@kv-M#x`Jp<~w+dMi-M=Dtv7*-1~
zFesp%yIq=BT#}fSlNz6#UzD1XSdyq$P`NccxBr%#z`t|rB~+*8gcQW>6XgsQed!ul
zRUW7>ujM*%b2|Tqqu-)-XLEFYx^KPto~c=SQSU4zfi>mNW_}l+cj)f!@cOg=CrE~|
zJ<l&%vnIy-3ipq-VmHN}>rZ|@dHIH*uYsq}UORO9xqe;a_vn^vlT}SJ-y>G+QnA~h
zaq48s+EC8SU3oc+4SgM_ZM`Js5~``aCS>Z&ibX1SQoWM()-WV0JeL2rFGa9*4}Zz^
zB@@>aYz<wqetF>5!#pb6-~ABlpWIo$$R~(<H}COX*EVf>nDTM6ZAPH~iDS~Kg^caG
zVG5sO!lVVNE^kOpV=HYuq|k9lV;}48qe5#Q<p=Fwl0D5^L+$dWZA<)F?PLGfl~)&k
zfBs7H_Lnm`8#SJ(Cw<PD^mx|AOMU?{+_?e%;=&8Ut37^+6q?NMUeuAMV8j;bc5Kr3
zpw-e#+AXDa_e3!<iTfr_4_{((PUgXl?k%gPU%VS8d*EopA(q~QGVl5)m_`++ym#Gp
zSj&IW%O{(XzW3^!$e-mB{^g3!;`r()7f#uz$T_xs5*<>;m;RqPa89~1_?qT#53v=#
zcm95oi`3?AU14U-VgBYtpVmY%Z{g~s<(lr+eGE!JZWdk&-=a{+&++4{TD-*}h8ZXR
zFg^8}x^#t2B}?F^?UO>6=QYjWIN_L||DB>*r&x2>iSIn)xgI15%xLV<R%&)IyRy39
zK<{zkkMN9>KSf>?3d&aL8_aflrgpCS;0l*c;~U+J9Q$1Ud9cj5<9cAOOtip)*;?O@
zzS(IhtLdD;Iq@}1anmjC?u$pHU!R;jp;DpO`@VGOL(fLxo_yBaHRoogHx@`ekks1X
z;cQ;Gpd#V!DRHmq7aT<kPkmvzx7GK^l^G{ZCkpIod$Go7agKLp*SgIzQ|=WiTOABK
zJ<;st)AeqzHjD1b;GV2y|Mh6rjf8w<+i$J6SN*Q@eswW=$A+dT>&%kYT|%rTQ#U@^
zx8U3{<%ach{|j@}$o!OfKl^Ok*2QwQJX)2E>qYL|*_Z$ONY8=J=L(v$_vWrE{mqg*
z`H=s~{BsUcB0B#S`qDULtOCr9roBDl!KM0%-7q(Duk(y6#UHN})EeJh;2SHoEG77k
zFaN7F-QXwQGj#6-F52AHrpErPkbT;+oo8}pwcUBYls)xgU*tZPJy%wHoSh&iDKp12
zTl@C?g*?B%UzzIveEs25b*F5l?RHvBoOv}WFXK;L(YdJ=4}M6=d}B)V`QETAbot6B
zFM{O?H*SvbHePC-aVO#GymKZB4UXR?9zJwK!6x^t<E>nox0(yO*$=PieYftq)UxNh
zbXW2U@UfrSy6{E4(EZhGKfL<7uW)b0hCktJtIGL47cVR7soS$o&$Z&nr$4_w`t_`<
z<+A!yHhIC8tlbZ01xdwlEiBvp;O3t@{_dgc%BB5Yimd({_adWY*<ZyT*5)mH_E!I{
zDy=U5`pi^d@0C?Wr!@_|u3wJXTCaVw##l=Ha+LXu8ILt)h8<gy^TEUKjeb@B(VPO;
zod4%cb63{ypCeuLUv9tmg!>!MEh$J|;vcnbx8?Dw4a?%UO-c9Wi{Iyz@YY3VQHz3i
z;^T{Jx2m7}`rb))g<;wq-^%?9*lHH)_*Fms=gj})@rr|%*Pd_tH0#k8|CdI~{C6Ez
zUcck()1r*;a{j*`{yfgFZ+GeENv3%=Aw?VJRi^&*@5ppsvhkYERmr#OEB~7<7UMs_
z75P?A@#Ec8iBIkdCaW$=@=e>_&1CzwV+Y?;!@2CPW(^<A`5tXdSu%6YV@J2X74O-~
zPf1(ra@OtP4_-3+Z8D$L#`@F7uP1y;VJi(;W7PRp>+92tJ@2|wmON%Z{QGCdo|pGS
zRv&*+R-Uxm=f=&C2H&f%CKs&9?&DkiP3sS%ze@FyV{h+&Uh?hh{`r^AIjXwU{bxrl
zwmb8ebZhW1Fc|4EFvy@5+xZ10nRz9tMFmBvC8<TAB0K7J@$DUg|KIIrntq1&WZR<~
z<vVAG8Na%+aqgALM^45}@mnu7mAQMu*)FBf30u~Feo_BkPmaYQh=2J;`x7d1-FM}`
zwX()f(w~3+zvYh!=OW@Z9ZWs+No(%%9{!UryUyj^e6ak*j~A+z+F{xA?%fG{vi$Mn
z`RpG)&+5sS{CVP(k~-(^<j9Rthf;zJciC9Y`kdtXs3I=hG`-O0($iHBL>E@Zg>3Qa
z-eY4Glso6;@~pjHpQW9=jlx8fY&S-n^vruL6n_3v_SH3PFYoz3`f3}!J$<c)zGVLP
zw4=RQUZ1-@il%?4_Vr%oz9&^=>CU9@3+wFC4RYMHr?s50^?no@cx=l3DZgq9_3xkS
z+OsJ0+z*La`kyNWCw;%s+J84yd5#S8pUtdFizIev6}4S<p7gBn<f<QiX_-!|o0w-5
z8}%LAU%#*8{J*-wZ~s2My8EHyz<s~YBR{N9Isa6tylel~yY}x)@&AdNPxVZ#7T?^?
zC35l}Yl?-Xe|o5g-4ch6v};Uzt-rCdB)KPr)YN_axxIVy<&Q@zYku9{t)IdYRChM<
z!joMZn<h*VHIi5S+gZ^zUvpcHhxbLJxn5rRuWQs!&Ts1RaR2<YI&Z%CBzHsB|2B6x
z@-?m*_Ht^c+lU%l)xMsR%DIK>pU>wv+Zd#^7beS`+?rvw@#dCehqhhYkx|$y5iNV#
zq@42r+fCu=UlP;nFRjq#$xhBbmdn(6Q)h9i=e`h`GO>vtrOz}a8b=stJ8V$j%lK0A
z?Dw-y6W(N|AN{n;B1QA=k_6dX)_KBvSa|m(*2sGvSeeN*!CGRL->(aA-!OJx{<_ap
z)^>u`+ATLVj($mSoa%gQ`wF9joyUu+<~GW;ED+7SX>)m()}Gqcawk<)e~a@QtI5^8
z?Nt^OnN@c52-mU$Asc?o(ThBj7%g{z$Fe)^XwlTPGvC$zFKf2<WB+d@_eWLEXYYco
zmzI8Xo0M|snLzR-o3)Q_=tr9Im(FqEH&U7R)ZbyprhRdq+gW3ewO2Aq{t5jN)+{D;
z`CR6TPB;12T#Zc~hlD((9No4!PB`9ceR~bt+-FPkJ0<4!Fx>pHv9QE#GtczdE`e7#
z#O6NB-f5y|J@?TeUeCnGOD{N-csFr>6g%A^zDs%i(%x4KUu~^_!^0cgFQWhVaZqM{
z)sm{W^4=G{qI$Zv{d-uv@?lj|)!UxCU-FbzF(jn!l{M93v1Yc4vyu`y@2K3m`sKyG
zuJ!GF`QI~3xrHO&MQ?UK^eJ*;Lx}SFb<djZn-@7|8J92T($*GA$&)K|6SmLzHPb+m
zX&<Be9OFNGAMAPH(Y~|9!dKBD-_WuCUG0*admeaC(_rM><RPb9SN}lTX!(Z;6ILlO
zg~cqNwwnK>^6iR)Wjq<3UF(Wgzu5fa`C}jUOA12FyPWbK%2-BhbBW#LVPL<B^Lx`p
z6Q?qkPIb@IB4+cS89!s*op|`I<c6PW+G*X|6&!c27R=qYJh;y_X$Dif)SVMf9zK0W
zCw_in$~e&U>S%tyrH9mIHt&g%XB9I{UA(71Klkjxe3QGgiceg69J5Mh&$s?$34MjY
z4#ss|iAnDd-w=CTUEWu^bAte5)2pTFSJs@E<@ji4`Wd-9zcy_CaqsxcyzW;#;uk{i
zq&s>n2~k!~@Mz&#>^3Xl#kmvPcpgu%@O~xfz`u_9(4rFW2{ZXSC#z>Xt!18R`RZ**
zg_i&GFZV87tBd~pv)5yCbQNFW)@PRMHfPUEy}v+s`x>AB37-8|HL{$h#}qd3w6I!m
zMCvKLjy!qY`{a~YUKNwv(j-^kIkvj0^6ZX;wADEiPc)aUU-Pn4CvSJoWVwe4^^GnI
zd`0H9PCc}%V$-4dQn@SV$Q@%`#%#-@lDDg|e#ZkPmGW~%pKQb(Pi@!vyI}Rh*!4RM
zvZZfSr*TQN)Rx33f9i?Uji1aK-JHKh(ICcIL(%9+b76<bmZzGnF_T;G$ophhUD(V0
z>zkq_&*}B@m-pyZZ{PeTeqEq=`Axkn2gWa=MY0=StyvHn{kLp^sh${5Sq|TX3F6J-
z5<U|wRCfkE6Z2TcB<LykSSo4d^v%*yOUr$HwE{U??st`5i?9uuaaZ1b|DHZS1JN?$
zD{(RG3fB@Z#EI5M{hC{Fbjug%k1R!Ei>AD2`Odk(spJFe+y}oKy4J|_yw+^rQ*?4w
z$u;KuZL)WI&fZ>~FR!zzYOl58F2&VPh1xH21btKa$Z=M9c4}lR=dH7w#6GhG|Co}V
z{Z={6wJ)_RW}VKZY!0(0M^}rx7_q$LGZXXkIBF{s!++~S+$C$XuhU=rIN*Esg!ZAe
zy1LcHpZg9hw~})Bw?mD!i@z>tQ>W@aFD?5g=O=tf)=@etlc3?%mYHT9osrb-De=G~
zGsN>7m+K*$M48^#qB45E`vg|qadhL&fAxglXu^R?woAt&Ma69z-|Wl%5Pjr~Q4h;^
zgZ2RBO?=#kLc(2Vo{H*_OnQDP$Sp9I)%RWZ9^V_LhTF~WWqEa1n|E|EoVs>4MAX`_
zW$V*7oU?Os*L>TgFMq4?{BJQcme<P1ay@G^<aIRWY4FS!evoi0$X8eW+gqO1SB^z$
zY+)_W2sE;~UTiZVYI^tLBx}>Rmd@plXXd8xWpC>6k59Py$bOA+WO9IUWZCuhxCgSQ
zT{B*aEhvuA7F*HZ!Vq}*f|qz>rtvrS5ACh180C-5f509S*7-c!@-qAOlQX|1A2H|(
zvJiW4IPS!3mYt6sv-Nv_a&sOL*e;}G5q^4G=gGN$XV<1C`dLJI1t(|b>D@`5pfhcE
zs`PRTz0f!NOSyddkL^jz3oo8)m~}t@NB^#MqO*2|W}Na}xGtb|*BX&oO&5<b2!1*F
zV9MvKQ<*fl)^5&vQn@!cX5-pTyR;|d#|D+?HT-dj=}MUJ=JnZ2L0{SQ0?*!x=4xEV
zYF3e9*7V@(YeTm6dGR`5cFNc?-Bonk8DHPlIJ<z~;gg?pyYkrvzM0R(^ZobNNgUrF
zA6H|se@~UTlwDl1z}5^d*Z$Wv6UD#pT*}zEw*D8_*?bZI0~ajhqbI(NSnfP)57VS5
z9;a=2<yAF;7cM>1pY!tLm2DNvlVqp%e7d=I{c@IDfxAUo7rieDw%Ey1K4EvAR<h_3
zX9J(Pr<^0aGAdtNG4q5d7w?yRm>Q+Sd!#^Y<8Gzh$@@Ix+@dE-3T%$m?Y$)A!WLe`
z9^J%Zc*^#qFt<m&j-aBi#-|hgymwB$ej&ReMK+ez<fZo+w-Xx{%$*l&KL5qZv<;~j
z#9VKmS<bO0?Z}6ZljeL*QZ4eGyy}ked%jweu=JyTQ!ga?&D~ivV}`#@TLH`V^N-#M
z?)fgmdqY1(=gi5)MGKcaoh&21_`QU=G`mAYeAAT`4jIgh>LI)>bMD<Zab%etYx)w^
zqA$*>?&r>SL{B^0HQOV2l56@>j{aE-eVdi48NNSzvBfuHiSedQ+pUdO&Z%>62%5g~
z_MKfHwa)o=o=a<ZzHr`6g_Th;%avo3fBRki<orx3v_j#n&Hh7KLTb&+P91uqShP*%
z#rHRB?|EwK>ik~L{Ad@~lHCuAndcrV^6t4Uw7l%-&mO(?!d`N1hw8U+_3^*@(7){0
zf;G+Ed%rxB_`RpsB75u8fb{NYF1OXyDK|df;>lWDet6OQxi0FDK0Lo#!M<o^i=W#&
z*1H=rx18MTQ_WVoN$<w@SCcoC7p^c-S{<?7`}q|i{{XAK7gppSomhEi@pPrB)+bif
zGS2;{r}pA}+?VCz)|=M^JXOotx$2tHb}lFL$hSG0YWaWhMBl05*;w8@wIyuLWuw_M
zG!!<wt?=C(yGMrU;jY<dwxpYXd7HA*y}gC!wyDR2&~sW>l6tQEw~bm<^#A|m>Q1B6
z!E>%JjAPFBZaOHN=lmvi;(bFse%q`2Tx9GSE-ig#8`XcGDOWlx<i_3w^=zu!><;{#
zwqyCS`d2$ktSz|Oet7oZSu;_t(ZR{S;mSLP8_TLq{8MFDsg-xkzE!#>_}%kri;V|T
zEGEC)#&i7Nkw=oBWxldrDgLE5aoV=oX9|7N*t=%EeZEG<*>b_V(iLUxf;>+`J5@98
z&#tgd-Ft5Nf_>_S0XgS=e{S=9?yqE1&MqjntUPSS?xQJ*8rJKV?XB-9o!sQ9<8slv
zLggTvOy^1MOS>9w&MNBawYl&|WyZSl;@DlcZ!Y0}b!G3_i>Llgu1#C{%JzPNltBF6
z*4?lDvwYsS7tdaoTx#!M#b&+P?#FMj<Exh0|8@CjkJ`gX4OyI;YQ?}%`jvq}6tjns
zpI59`Q2Dm@ZP8=5Ne}96T_bA+6>_`Y<(<EGC(Hd_Zu$1(vX|r2SH8VDS=7KoOtr_M
zfw>_ldrQ}j>pR?cl<$Zy&oA;X`Wbj%qamce=eyE0!^>g~tJbVqvu4eiHEYhWKl<@@
zv%UPDGtW2WJUQ6is&l($=ILJnHj(L{xhp?Z{3>|gSP`{0|J9#Ai$we7?S4Ib@bU2R
z{mtd6(a$&gMqlmC(7qVwQONYaUUl{=k=MI^b<f!zclZBa`;EWslfKpq=${G``>-)C
zy!6_$(4E`2uUS3S<MPvGcdr=vy6$VrUwh)zrmU47hh3kA1~TN-EIhqurTC_4-RYJl
zo~fV0uH}Y`E<5r^>GWw^-c5G#>7~kFKg;}D@josl*GzxYvWdNQsSPj1r~b^IyH(uP
z?)K&LZ_irkpLf01A#A$fC6^#mYKgyFHB+5^$Wf))qMy$4d^A~D&b{-Dnd|Iz**nkN
z|NVYLboZWb@z0*_xuKKt<nN|eds_64+&lTb=w5C7+0Bc%%coAATYgrjf6t!GXQ4Yy
z-gj!u+du!bso(6+?{=T9{IKhU^n!!4O;*2tqqg@{S8vGEMupEoc6(Pe#Hd#%x5o8e
z3k{rm*hJ^($uCdh@7wv$|M%g~%lUD8{ykO<UAD=_a%IhZrk%T=d=^T#&{li&d(V;o
zbMCBpI$7zw)W69uPaT^1%wdn|8KFPcr=?aNl*v!a7rh(&FkR@>nayE(0;d+TYWFRe
z{@&}wp_e=_vXo|RYg@ML#yQQuy#MDsoISmPx2CwvO<?{M^L&o*zYHs7{!J?HU9+G0
zgOT>mAft!V{a0UI^C`Yo-#Di9*HV6#>#ugM`73q&tx`=ObJ_d{TaF$qVBCLccj&d4
zRpB;Ap0~y@N}tMNeX72sLCr4ANz~_<i-DB&kE*Sig%kgJ-t)K`?NZ27+48I9v_s*G
z`R%Wb=Uu!aVsUd#H=jUNWtGv>pvb~gmtO?yoz-ntwo{&`k@sc!{Mi!~w{w2DVy4}<
z?|heAAOCkAE#pTu?Hot<M4wp3d;fydm-urlnLE4>UA}j3^Yi=mmES+9{Jk!IKHjc*
zD^v4=Z{H^5r>9=xin(*()@QdVMyoqd7B3Iqw0DKr0V!AIr(9xQlXbghzl^IoG^3&L
z&y=f+Rct+vRabA$sna~ox-R!e&8#VvKd19#K3MgzJ~6o><6l+IzhB4xeC2<({{HO!
z{{sJiosqR?emHk${ghD6##!f5E3b-d*y6i+)tj65awdy&C$N9JysP0aqqhE&oZ`HH
zD-zVgf8Kw>bpMLbwIFBTHAN2;>KEHTpS^5t7=y@!vZfhL{|~lJI^7y@Tl9_3fxXLj
z*j^K|pFVZRxx9kwIeJDFtsHDpY;hYie{d!^T2?TLOm8W3u4LHI5_$Jb;`6x&-tBl0
z8Ms#9e@;UCWQIdmGM5F<nDzeN-ipdkk4k_2I=TA!af4UUi+WnNOK*)5PJ8~#GuQgp
z#XO5|yt$^oCYnqBc4=z;ADe6OtoL5l9&z99oXh*3%yqXntyAah?B39IxB1I#o|dU4
zC+Dm)e4Kj8q<@wX58Dj6FU>d2vmXRJd>wf;ZbkmiT*qsrp@-k4#7P|5;?Z(W+;x{@
zUdD$BcSB}}*=stTkvZlito~Yrect)A8*aO9W_$2$=eg^@5`&+;?fpK%Nb>XS*K70&
z+jX8y)j8w+YJcUb&852*wI0)-7HT{FrO>Ya89vjuz4-OX=BVU}^T8sMzr6mbwR?)!
zv5$5!rVZj1J8m-v)qc|X`|{-J^7D;8lmBzYW*n`*{p9Me|9{q}=&$WqqyN;`%3bkm
zz~=W2*8Vzw=PPbyzGIsf_iXQ@)xUrLwtp1ID|=vTFjt<VgK*W)*n?BTX1mo#J~`5s
zId3^n%Qd?bd&4a^Bv0&2RlNV)_|36hO^iC`t#Myg=d67=MY5ya%WCHY%g<RN0a-Wf
zSQLs?-45`d`phQwZK=rFv}G=@oflovJS-`!zjA`+;vYBTQgj`a99b1a&6zC3Ile`#
zYqMYYGKcMn>mOzXJ+orVt2+X!V{eIs-fmE+Q*q-g6WKZUEyG5~dpAFv|Du$wH{p76
ztWNHCx#gFYZpgG&D8w=EcFQY|3o)Lu?@89(dkLvBr?{4gU(vtT)Nx5ej3az&-HZGU
zcPihURqU(x=U!&8ASiD6%ZxaaFr$n1my=a?EcsoV!Q*byk~g>F|AHOgZT>zy`|)Ii
zOwH>_OW7DVH+qTYabKOp5!maLf52e-Ra4D`n@sauqM7$O%wg~n+hWC|v2^jx+9gU?
zozFDNdHfN(ZrQ*xYsSIZ-Y#`~s~?`cEgrnx`dPlfR!76+BbCnVJ1c^xH*DOx#{Kci
z=5L06<^o%9OnF^X7wI4^ym18wU#Zx?UE3D<b+5Lt<yoq?#NAp}xc3=nX=+aPb@PjL
zt#2MrnQdvDs;a5NG^@IA&UtpHHM^EX_V5}+m2q)J-s{^?EiCwQXZ-5*^%oYgNk~uo
znf7vSRBp<~IT4@c@dSQa(w@?3HSw6Po?OR#RUg??9Xgv8Qj?n7Ox8LuJ3T7hswwt?
zX_@4da)m3Z25P>i`7XTfmQnj5#o_3r>HFGY7l+k(haC^MiM&0h5-^#CZTCG9ha*RR
zsZ739qQB(Io{JVzl9N8ROJ4A9Tl;g>>x`Lu0&GGr?BiH`MocPqMIzI?ysM96jpSZ5
zE46QXmw)YQ-@??GEfL+W9uMwzc{+9fxRuNIR(wOcT05utY3p8B&d2;7+b1g6ZZVyp
zFWi;(<zLh*{daHKza>szRrdMCn&y9Ad(Qf>{7X04u;f_s^pEWc356@KI<T?Da4dM|
zdSZ_HW6#se^gMYIQ?9yfekFDGScB#U%cR3*t1};!K8e|;vV7INfbMno{Qp`M-+F$u
z_H`h~c|jfq1s_h<f9dIdA&TtIb%D0*tLDUsFS`)i;JW>@$DR)*5|R#668|vVI)5Z~
z?+T5F&zQAqFF$y6b<PzbrmtO+H>bx36@QCv4=hTY@Ub(w@7M{Wk8`crmPm{LR8TD0
zaJFE>lHkh?rlHQs4jgGBi|!rYIM=S<=}A0qmE&xOV4dXdSuV!M7oHB5sdHK?JJUQx
z``rzlz9Sa}w?E#;<Nj$^R{WZ4IWs15$1nQz``fqf{#UvyGUhMc9$+yedr9v6f6acM
zH2!d%u-`B#++B>pHmpj(W_DrO!58v&Tnp!C{`xKG#dTWXQ&nJ5P`=WPUX#U&U(LR*
zH25F5rRLwyjGy<C<s2UQN&I)=`1@_~hoAoiHOm7(Rc7qmoKj`@KXAz%iIY7Oc>A}x
zujrS%x%Sdr=5q6+3x7nJN?FhUshk|)z3roK{=<)YFB$HnYMCs!z2Mm0M1~OK-@WN=
zE1vGEKd|c5C9au^qmBRQzuMi&5nURmm2+Tr;UV3B+>v`Cl#OE@s)JAMVvclnII~x+
za>lO5bDApJI<{AMIDV2A5&xXk>J}NO@a<y2)P=Je%Q!TGyaP@d+3>qY6@(ZXP1<@>
zmE+8veVelX?%MTo#<nnXod<utj{KgY;=1LWWI~@Nvs%kr<<&bjI=ys0x2e@|!?&yX
z1_iF>8vi7o$^0``{rrj}L_0ckCeMpCT1h4y3`*UCb`f_Ngo1s~8A=D%yI*ZIZ2H}1
z{WIcw(X1ZlvLj0aKRli~q2&7ifbfh&)-%gHKMLHQ8T;``*hZOzyPtOFvu%mi5UFbo
zzg)RhQ<78RxrM=1CFWc5j)w8gCCA=zJo~gtYhA>T_Y%Ku?AWw8wBW{s4Bq>5yN;PW
zzVa!}&D?TFN2TOJC05_=KXMg!53FLb%~EnWscO97M3<PY))B9DX`AxqsQ#%9J#3Sv
z?f>-Wx7+!Q&nCuBTAUIYnj!9|rl=X-n=E&rYjeiY$guZe-#t=-ZEe|hx`*7K_H~=l
zbmIw%ua$OB%1E81n3iyN3+ue%Q`(WnW?ej6E^}Xs-x}B*$9QYqCZ%|b3!B{5=58sT
z7Fx;BQ#4ncp>t=Xu+TzT%iCqs=JmFl<;Nt{-m2p-yjYhue_w&;>Bi?m`?elQx6v}|
z>saQ*eNX0mbL02boAti(PMc@sqObDC<jpDLx9=C+TsQsD&7I23Z`U1I<N113*4u58
z=F{!hp3;tdCX~BnRknq&!(Brq&tt*UC1QT6McsPMS9reveZSPJz?QRlZ|?@gu3s;{
zp~x;g{3XNV!&P3Px$gQ4maop*sQHC);oD96O{>`&HY;;ReZ1gcH9c2;NyF=^B3s8-
z-;xekHJ-h7woFN`*I#~K>t7Y$6JK=mKg=*ung4>Jd_v*xx%1W>_r7xbsKCJ`$6r3n
z$$uX&Q@&&6&uH1ji<tSR%g^=sui+i}{PX26PjZARwr749{U1`GIJ<K0`r3T4M_Mlz
zzHT+I4Se?2KeBhi$}_%t-K;bB3Z@#&yU^>}c>P>>d!zESk41?#>D{Yz@^}okKULjk
z5+vil^HG4VUBc&WN!>hq`FAV*mzp-;N-ofAnOtU-km0mTTa4Rnjre~u<*xryc4X`E
zbNigvWjiQUC|y4F({<+gmv^S~aop@x`E0Euv-W^VmP|W`+@m`$8B5rs9y#~@*|R3A
za@VQZKWECW{B*DQc*PCp*eqSC{<U_0XT>sb7S%`wH9kCLvHjzz<(}M=9E;k%R<vwk
zpR49Q=k1dm2|W!P+k`}yn2bA#Y|FpgbG#)bqWCE|cye}xQ@{S5hOp%HEG4&v)iMh=
zES`Q_Yonaz{EZslOYXk4nsa(x1N)<wt#jfhg)^<}uiSZWOROdHR-4eBq0g`JANeQq
zSNv&G`~kl$@l7>_s^3{T(q0^}ENu;BTKh*fH1%nU;qt@oSFBd{eA2mbyz_o}w5w!c
zR)N48i~dEjmjkMV=865~uyWsbDc$vagLd4(UzckY&+Tk*Tznz;pu?*g#pYvsoENi|
z8ExlQ*il~nFkkLKt@E>oYbLBc<GS6zK`W&rd~ME6)p^rrPhB(dr`7M)zrvAcZv1*^
z(>QmwnNWIp;;F{iNDt=j^hGnJ%BLRK8CbY3E^nTmamj++mWy0JdTP$U_OHfg)8#uI
z>Rfkb7CLdoCdJNCNa&qXePL0$$E$f3+WQPDp1hf7K7Yb};d5p$I=bq<uQhy?Cx89J
zKV8wCx92~2`1g;J&73k`0lCBX^r9=yon9;<JMs6HgCQPFUkc5YPK0fCEz|Iu$m$be
zWAVA~slc@C&9A3lV+z~#_zG|2jO}?zb7em$tN-)OSvOPYO3q@dj@||C>{+~~dY(rA
z&Q@Hixz7G9OQYjT&65+m^GXcnEt6Y&I=XnvrhLi&A0BEdg*6K*ztMZ=aOKO4ADfk~
zT=_WRzg~6<e|GfK)T|m_9(l&N!;cPXRp0+!>Hkns>ru8=wzkIV&eOAsK9)o;c>mtL
zW6`nGC)Y}xn*Z=p@Uu0+{&h*IZpw@9?^)O2yZLL>H0~K2^82^cMu-1f#5pH>%Azm-
z?rr#=knsAHU5?#rkFyL@yC1NWoZruI$^F&g<@cQSgq?qP)-PtI$|;{+dmOx3)Gt?F
z+wx@R`WlfLJ0eshK4rWT?|S_DgL?YO+Q9o4+iq?@dtqA8Bxh}%Etxr=l3QFK$?pH_
z9Ps8|tjxOv#YV}71woI3&WF#Q`b?v4b@|10$6s7~`D?r5M*llsLtV=SHoU(1JMVhw
z>hg(e?<k9@n!MYvx!SzTO_5u5-}bqMS*EkSzJ5C2XY_8Pmyps_;kl<xexHx(*}XJM
zFsAzX;spm!UYd1sEwkjZjN7{ctPQMYUzU5LEByGgUH)dK2{xNfe{QVk{a&!|v9v(2
z$;{jYwJGtTv#vfbVQuYu<@O|LT~yWu1)tq}%ehW`6?yTXY<iMXGMk5S!>yO~g$J`%
zEc?%Or7+dT>7nsYr^SuZH~P+qY0TDp67%8iEY)ct>ng5Ct~_(4chlST6Cz)(uI^sB
zS(8uJ@wM|E%ZGj3Z(W|A`>@+&-TMu1SD$WQ&Kc{lVtq;x+omn^)@{Bk=CuFntA{N$
z>9Mb`K1h;m2>JW(`~L3>bIlW5v^@LQF1kM9koxJkn@=9TU!|x1i{oarziW!xoX!tz
z3(Za|C!TiOoo`>>SNo;v3RBpbL(i)=)`{(F)!s0_^kL$)yxC{FC+S*N7_XQge|J*<
zCqC`tI~Ph_|7|z1>CEL7=O)CO?tOfC^JJ^G{aaFnix-J1u4noAvLvzhgx7YRRcmDV
z53+=uNs(>pnY(Ycmd*J((Ndw6+oZ#1*~Y5<-oAk+to%3US>=CsHzxLMpWJfm;<x<7
zTkaJ{dhQ-vzR_Q<Ox$^*``yBePF0sA!=6v?*dBWM!nNgD5AV7gp4!rU@<+g(rYA<B
zJt@{Me^zEHs#x{y5|%HnDt)v*yQ`GtEobax;nlOh`nL1G$>J&03)`)=Y-`!fuLdP;
ziy~vIj0$;DUv1m6_(*FOmsrtLU8@gDoCjs*L|mQSCv)j&nrxlP>8a};=qGhw-F@rr
zD-Xe|CH3|HEg6H%zf5>=qjKSq+X0sRj*<d*9(#VNm9PlsoML~UVfCB&@ro1tmwd@I
zbr3GNqI=$SHT(N*QZn0x!k@qUr=hTu?{Kf&mx}7FCke~*gS(E@7@TfTI}i|^zWLM5
zbMK_ZV($gcbDrDF716ed=}!EV4xZ@Smrc)R-pQ;zxsZ96Q&Z|2DJ9zt6I8d{jJj;I
z^U&ky&&TAytx`PpFNb->Y-_e+D|Q!?*Nw~@Z!W&1`QdWBl8%w${=KjFXk7TeG-~1O
zGp=F!Esn~rmV*7u`I(pXCR#4r#pq&Na>h^TtwD*kr+ik+@4SSh6Uo!M8#B`mg(**~
znZs7Rc6PJpy>)R%b#5M<^!0bM`JuieFRPpW+>@2NRxLl-{M?~J<{nx0lh$wF%H}V7
z_>Aj)Xz?$F8wHhr?DpuZah9>J<k{uC?Yeu7%`B6N+M7ZSdk94+$E9^E2TwBJd-l+^
zeOnX7*FG*>Uf^DMp?EX*{4a-=^e}mDeJ|m3(`k3t)R!ljKkmt4(9>GKpmlQG-hB`E
z@@zM=n^(ZQ@8jiemuWj#12=TJ-kY)C@B`y3qrj`W`9Yz%&oA=^)s#fbsoZ__*J0+q
zstp^ie{Xhv+*0XtpViUho~p+B{8L9Kip~uXJUH!2$-!?*3xA(p>T<nLaDj0x`_vEi
zj=w9sBE7={SeM<1^N#HLw(F9TlDsMN)c?l(uL|Z~z3IhpNBz*$`{(YgH~w>rp`CS_
zyylU`c1x6nVwCd4PqY@+O`Q6?XyH1880GC7l4ee8sNq$a?c$#yE9NaX>C<1SzZ~^v
zZ%F^Xesle)Ws6+OWL72=O4fRuj24)ieS)=Bx#FU0g4L<L=knI{CxjQx`&yFe(Q~fn
z3(N0EKK21C1D-btvR^uzZ*yaV`TV>&3$LD(%-Etn_tW9njb+)ddTL!RHzrSbzW&$5
z>&@i}&*yjQSN+s3{MAzZ=m)!rLF`YX`IB`Gb8oTw-mclZZ2#4!IYGR0bV^nV$Y`>s
zO=*ywZ=-y%!+F&N_LNq`ryK&TmWL)3?^!Xu^6rLRtMq;!T4uFd@Uw64oaXHePd~5b
zyLZ8xl|>`r+KVYmnF<ols7zT>a?`CLr-U_W&%G53r<W|X6|S%O>$f6s<2Tl)r^PyQ
zH3OASU)Z@!$baLRD@PQxR%iQf3SM|pYMIy7Ql|FA>=nE+Z&p8^KhLT*OYcM_o1xnB
z=fQ68FIMiX{E}f*|K&t)?V=;9`%bN%bF$>Kg1l1xsoA3M3L_iy%FWMgp0MxE3b|SJ
zS?<{y{?lS46g49o_(hkqS>BvHU4Lszch&yf!lt<w|GfKgcJ=d*Nx}WgZb-b5?OQZ|
z`!4N1#VUh6ecLyGuY5nT{)b@b_4ey^jJ&<fNr5M{E@*v?ZdcrU>Y70s`*aU32_eR3
zo2I>1nmswf`YGq4l?UxEzNyfS5=fJ%J7U>4Y4Pg=E=!(t@ma5q^46Jg@x+Ix;qj_E
zGju0M*HpWw<}7~pA|f%wdCm+jmYm6RAKzpTkY6Q|^T@n#k6Kl`^`!`|+Qm1-*Icxk
zS@lINvnk_auizK0(!DNs*H4TL<q=lPXc1n(T4CJlar{;DJ7<H(vx@6WQ@nO?v6fvF
z4&T_!VRf{@(ZKXH%e^~?W?y!1PcN@X-yeHq*51zx3{uLM$j-EIlf8Ua>g(N!w>jfy
z^-0Sep1AAl^68(JN#2cL{q4*)S>;1A$<4Yiif#n%*L?Us*YZNZoSz$I?=E}h)at+Z
z#Vs}ah^u#}Oy4kdN{ZSwt!e({=U5iR-O;n*4c8a&uMBf2clu#{wK3!PRnM(W<>p(T
zCA8nYUnTqT+{UfNTKTUoY+kd+FfGGcucfJZQ}>g3!f!V9thm@9uwcuqYkLE}?B!Z}
zjD6ifvjejG{No+&9u;!`=*oXf{aoJja|>3PR#@&#e$}b<>hzPX$uGkvKe_Ny_TjC`
zYc@Psdo$$ynv$>HGdtE-Mg3&_c1L^9jI-0H@m!lwe@}4Ilml%^A`5mH7G2Th|CYzF
zC!OE9xcCU4S-@{r{<!#aLCv{sEE_qky%$eDkXFZdCyU`vox+m0*^H4|5BX;=NGR2K
z^GMhJO45%$@fT(aAx2&%P8w!vCxtgihaZ^V7r^*-R@fTHqe~ym3thYN0ka0fHZ>s~
z883m_69pPdPk8p8xv+_6YtYXtlk$RAMyypi_8_&q!qDh@)St6n_n$Zip6p+9WAE{j
zf(F$eujl<&Jh+){Ps);%y@8V!6_i|fD;yuzv~&%Ri$=ceufm*C6@%yR_^)r;_<q|x
z8;(Qr5B}Z^2%TNBw?=KDcT4pJ$qM14(f%)f_}&jl{Peknk=3=`vi94f<6pkc-fnOA
z|KHL1m(BD2<Mve6)^r`Vw|;84IdrM{o!jiCUCUi6FBsHbc+#U)dO7oTNy5ut7tXx;
z;#s@zVB5=IwjVZgM>go}i+ttD?Q->Ww%yd?MO>>NOux8u@yyP78_VAcoohMEsCJ#t
zM_`?YMY%sudW}Tv)eSipzMJ0??R78Rb?#IvV_~9nsb2rgt!@8yZ7bB7bLSrC+kH*P
z4<uLf)fleTG}4OYo6oae(TR;UOUm8tB!|7Pg+XzX*A<`dnSOI@Ud&v#K)~JfS@k>d
zt7f%^B?W)p>0bEsu`poM!=wt97e^+|S}*ou($cTnHEtV)o|$Vl<9+6~hzH?HJ126t
zX}*8KbYr4(lkmr<)9*+w`OE%DHk0?!byw5;eQ~K@pE4cUw0{5XC$6)nv)>Zg9Q9|F
z6T_sVLG14~ud>fL!|=xQVuR5Mfl`UTE9H+>X!R}KbTmv`s4Dssi}SO(+QP%(w~Irj
z{NHsl`^tCuj_o4HBuy;2Wz8o!Z8GfS=w9RapHqrq*~iD1*I%soU&{Pgk1yxqv)8uM
zuWN`kcd4&<BawA)Z_>+lVe^aA-@bj{mE73)=&-eL*#WoW_jkk$6K6ZldGO(&N(txZ
zTj$jbq^y@4#wJ)T*yJ&9|McR%S$Yq8mk6`%>YG3PqymSqR+P$l1A(tb{0=NDdA5By
z!E35JNj|0R+K#vx+rETt(26r%l*_q^_m<ovft3%$3asvJ^@uC-c%h-Aw^eis@3h_r
zFIIk3Ppn|O^WfGtXCu3XcSQtl|4L^rWiF^%V7%5MB(_3)fmzXZCLjG>2PSLtyfk3(
zYv&X{xq8i=6xaV>icae8&3?1VVqfM3;Vf>W(AM09=8C6El|kqAKZza4&8lQjP>J(%
zNV|5Fal`yXnH`1aSKj||#Xfl3j+b90+a6q-^Y-Oz`T6yH*OndCN?rOn(cyp1wdeAC
z+9uvP`cL|~lIs0%=C&1lEUkJw*7rLx|Jix3%}j2O$CTtP*%L!5xwm*;I+<-?7=AL+
z`c?j+%fVI$ADnGZ7O=mb#9BP%@!K%r8UGs0;{tkCn6t0qk2&CD_@e4Uyu8vWrI{8>
zn*!eH>^<bes&MI<>U`rrQ_Oc{^xZzIwEjcYj#j_)i_45<uGJoXXg4LuQeAbHlS87+
zvH}Y$|K|K%!4+SEOlJr+Uru@a<*>`e3n!0WI5*YrNy4*JXMYMbe9M=*B_nX&JMPsF
zomtWu`!jMhOdG3Nye3<!n%p#cd-n<BhQL(`TCb*FU{2zDcyr&`)h@?>yNh4`reyiL
zpM9~i>I&okvcJUA3_8juh81pK@h&O9zRmq`9M@sv$4`O;e%r@;%wj7xa@i;JVIuP@
z{mpw6P70-@#QdK4v(Wa-VI7{b7hjsr<i9R0R1P>X>8n=0MZ3TUsZe3#x`u|PTH||n
z`L!4PDzN?#u>P}6hLM?1)D8XBbBYZtBuv&%QuU~l-BaniASQRRdqIxIU!9Om>=SLi
zJeb|0F=cvd*kR>A?Llh;;-;nDPGSA2>GH@&LgQVN{e!!LU1sZ>DvdK=Z13FFYkg;u
zZxv&W@P7y9`F{Bf^-MPdl-L)rEL@@P#4EdCily^}+*)0S&&OY!wfLL0ulm=sg>k8O
z1WsE2X`X3f7j}ASd)_>Wy4NfP?;hRQZ}n95qd{*&NU7$P-S>UpoSnG%xN|J;ruvR2
zEBj)Wo{zR<ZBE_Tzemxg=K{y9gnSLnqwJqoCWMt(2~C`npkaJ>dmCTDhv3D_Q;Ycj
zJzrwVXw=HSP=1TvyS^*?yia*Wd;R3RdUw&Oj6O}%uK$wDN<+79GF~0aekUVIbYe|^
z{@PM8$-?SD)4VhRmjf@SEnQi(w&96o{%7qe+y3sA-}kIEbdgi;MM*A;bBafApDv!p
z$-?d@mBPL2&6a5z|0i4Y)-Duqx*;Ci^i$JsZG6c2<+qs?j3Z`EeAX<wd0Erto4(pp
ze_AB?zFPZ0$c2^vu4~DMjHLAey!x6~r`?MbIaj~Tg7eSWqbAQS7cBaqKJ818@zJ_z
zYMI|lRs}FE5qoMdVef{A7AIM4S=Zf<n)_|$&8`;-oKH40zs)i}7~Cj!RQ_|9diJhZ
z|Esx;KKqiRCEVZJy=@ga&b!IKlrdU<UU}+kn;8|q-aU&7H2FFyJ3&jN{;`Gh?pc$9
zCK=3F=<9B|=*Z;79dk3f!n0>xtWZi?HSJ$lxla?@rS0eIed28^e;w|=e%^lj#*>dd
z=C=4{q$tR1ec#1e_vo;wM*V_ohRf6^NoMRcyeE>WHAzM5p2Y0zowln)^1DKAu|JaV
zJRV|Q@FnNj3m*0Ix0!uTN2~ZWCauVLrh4FX#ukaXY4<{Z#q=|+Ve;Dl|KW_-i>t13
zCFIU}6XW;2jZdQ|xX*a@!r6W~PO)3%mx<PIKY4xjGCw}oPg`@IpS-KG=8<&#hH1f1
zyAI_)>c3a(+xk`f>lIeX8D<|oO=bU-9r3|pYOTV{YVn-u))%*~yH_-A^NJ#a-|PG4
z|Ep+XH0WP@T(s*N_rK}?4__+VeW0Yy|Nfq;-;Y$+Y<)jZ=D)Q;Ba2P$v~`_F413jr
z=G@vU_Nd8c>F&-Qo3}iOWo}$>MAx8bD#w@B8DB(lR<URtJ#hZ!qKgc@J012epSb@>
znBRt}=5^Zq>{n}>)~9Yt{&dVF?)tIp=sh--&P~$qxuRXnMZCAKG}tWSop^gnl1u-a
zr>Ez~ExerE$$L&y?XhKV9;dKZTVv(f<*lsUe|-6+n6>xZkGgeJYU1{Xg0rq~JGcDO
zm-l<*^5-t~ZM!)oBDJE+yzFcDEw1mkRXk=)<o$4NsoTke=Z`*luwV_}i`+OS)wuW*
zmo7doQ#`)rVD`Tp$qfOUpEbn4XV`TA5}Wq3J)5+bEjrxt*>_*S#hWp_I~UK}m{hh-
zCFGCv#Vw-l#XTR`eC`{ny$qkRD!0z_T-fceCkj+PuUe6nDs$lB1>?Tt%j<sThQ*|t
z_nLF)D$Vlu?EH0e!CQr#9VXj0rq^UT|8y0y;5+lg%+r1Ex#=qLaxY9)MNd5bt<m&0
z-wlf-AGT9(T2>w0mE|EL(D$&$y(s#5-`@+jzO^5Cw_wq^OOf|prEGCq>1fH&oT=aP
zOUrGAPom5d^W*W)Km7mp>g>lK%pDI`&Ae{%++Mc3Dp*c{|NEQLJ*zr3gWmi%IKA@U
z%g*9&r`8*Yr3JW0zrFO}@Jw~_-8;?tCuV;X+|hUK*PEZWpRb>9TVLz6GGprAmjOLJ
zPc>bfzc1(68u2o*{MhePtGDv`uxZ=fTe)ai<eHCX^J*_^Hf{7uF@N`OPfYYY{;GRR
zKJUu9Qu@lSzqqt2PsKxjcIhKeanA>@WREbZOB}xx6MJ~}@<#p5S~IPBlUOgO_?wD`
zReq0}Q*ig5d%((TfwQlzd)#}!<-6y>&-YsEe#|buvvRhxdR!5Ubrqih@8VyVjqMql
z9TXjQ8!X_TS?;B@X4AscA2xQL>UnYC(oVkrZD|1svQxH9ob#{eaJ2di8-K3yLyNZO
zyYL%??=7>xa`&OmmaDhCx7?apeziq)+P`Z&mfpMW&Pc0yI^TAm{?dImekXr?*<0_v
z%xt^%nce$5jHa)uuxaTLJ+yF+xY5s}^W$yjcg+u6w!p&6WdD(KFKpIm9I>-~D=qU<
z!6l<Xxjm3wX3xFj2Cuh$NpfEEebKJ8@6(t}9TWas53OCfeqKN<d)Gd%&%e%chPp(5
zYh5(4QR;@F>@$zMOiy~&OB8S4x3E~?oM3nP=4Zt{VawRt<9_P>H2wEB@6Ha7`MI-t
z!<rI5=T`0de8^>cY{;9sV&&T&Mgd{hKK@=U&pILI<$(nqDcU#eK52{2)X6`)cHy3x
zUDJ2y2(0wm#Q6Q!p2)Q~DtQv}H_ddpJo86MbLRa171Q|U+}~-!BmXzzb5-mPamhB0
z+cF2LFPc?7+OWIRcH7aGXXk{4eodRZorfV?>+II;okzqbML!VHn#<bQdN+wtTj_XF
z)Us>Amt60!%ec+SnrF{bV6x!ziMg@cCOqAiGC`*DAfL^(k5fbqvJOc)Uoz$>+xXS&
z3IF{4rB|8sF03eh;ydA}#l$}A`&F$!c;+1V^?BVon}=RE6n9H66Em9o(qGr@-Gf`V
z#TN54%beesJX3pN;<MVmIeSI_iK*r-RKNGO_nqjHyH*E3{tiC2b-TUK;VGNk=bUw2
zzP_Ns^E#uP^!5pNy$vp=eht(JwA^Q!mb1G&@s#?Xo3*OJmDfsruYcWtl$*Civsm{v
z^Y@@-{N9~D6^&OrZ@hap+tH+Sx!obRoc-2?pU&Fwt=Zw@F35F#-pmluX{|w9=CPf-
zZu_R}#Uzup8r*-Hr@x(gs<B#RlV<zW3ekX1w;$|m<x^d(z+z*O@Z4?3-;UC|nKzqj
zUir%2b-ZqC+-cQz@Z}>Pu8+2<OSpWSUh$cybsgHW_wL;zi3eVlJ#_HnvcJ@lJ7Ycf
z&xjjN6YlZ6YKSkpw`=0^0K1P;T^IMMmhQ8?u=_lZTJ`?^fQQ|;YiFKzE|c1HNpas=
zk4>}Z7+q?b&T;9Czpk{8$(A24I6pC3Motmyo^n3qYv0c98SD-Vo<6we?$Y|7VW)4Z
z{iWU4`WmI~zWLf-vgwr9&U*p|=bhT59pWy!I_*jGyUvkU>U@vy@EHXc-&w26W+WO3
z9b?|HMYL-ATfdB+V-K5W39H8)nI>^9pz4<UquK{^x#Sfhqn!`^I>lAAkYn$<Yqm^t
z&!6}!_8~RPbXH!NvHUH);8l*dDoe8$3zQr^6#hT<;yW>>zlXD!brvnIdvMQD_Q!#5
zhE)wyYt=(^7X;?!e+=Jarn+*6z<x>Q10P?yTC!HHxy|;s#9eL0p>QS7$#<JJw)Zgd
z$~126yy2i6Hk<A5YlFS3J^MV?e%$#zq(^7DKzQ$ttE}%XeGEHhctD@2^y&7LeY?2>
ztPLCQrY$jzI>_{QNAj+TM&~q~IbZUe-7>k0`RCMWXL}l#Ot0UuYSO0806Dk%tL2M~
zEJ{Q9`?q=j`}N&nPlOb2J8SBlX>T0$+2ey6_hstDmO8(*IaS5hJUeysqhotF++91l
zc*(7a*FPJc)7cwVA{qWzBrSA%|DTK1rd8|b+*&7JoznWSJmFF10-54fYp=cOlU%u4
zTTknxh^JO;nv#Y^;2NdiYZ1{29@_3I(*1iHtv+g(CtTRLnK^~2(f4t4*}=qh`?ZgM
z_tOxW{ILAltnc|JJ|^FZdun{Y^St_fd&|mCK~EU74?2Ww=88C08LFGRX;U}P`)wsk
z@!xW-#e8>sd~;*rgwsC{WhhicO)C2)AL?8gd-qmc&5k**LO-2fqq9|N)5UwjdCLOd
z$JLs5^qxDYtF_?8n!Phleb06<TNW?zaXa6!Qcs(*{E~%p&4jMb;F@~Ke@1?*Sy5U$
z!zL}W7ggQ+%KmM76e~Mzq0;vClQ%Ay5qt1=d>v={pT>&duKAyf0%OhdxY%Vy=HCd2
zUR^EaJJD2JYfU19o2%COm)lt9W~lq~*L$8>$Yi7HH%%hn#BOqUqpRqzfV=<NwmH-l
z{(8}K$W+FyXi@c?iMziZQVCW+EX8KG*y2g#+_NuloZ}JkFD&ZOnyzfme?UR3z<X=B
z{U5u@fvPXQE|#^D;J=XK;m`Z?!-K%<U)<&^iSXH8(LQdv$zsd8<R!;@^wfhBI!`IE
z*WcXt@<;ZM;Ddo8%nnDU754kc9;$fM@_*T*FrVU=4yjcx?q}O1+}9nqEbN`J?`LOe
z;+ojgO_TgTt(+xVcK?OPY&I^r(1k0no}78^VUmH7@V)i}C)6|YSwFH`*qhYnZC9;b
zT;X%~?gD?i6FLD04lMHadzhNMzPc);Vny3_X0zwwH#GSIGApG|yJ~eyTlpM%bZ5=o
zFL&Q<DPgh6O>=znVDF#p8yfev?yo+S`%q5ebo=GW2m3A_jP6M_6f>5&BD?s=DoeSK
z)%sOi@44I%uzyjuJ9Y+Z;UwD+BC8TD4HQc%db(xbEuS}c%UY{9cMo3lxAkn^QR%WS
ztw>7Y#iC7r_y7M}Z?Zx0^j7Dp#IJnC3cm%VC+z6YzH_|1$6Rb`{q)~)hdhq>7M%_*
zm~QdfGSG6RkWk9^#T&jIcFl7xc==(*9CHr+^_Lu$?VnN@aJu$^hWXXD^7%WCZ`-W-
z>geUm>rIdM9q?Vg`C`fH9rxH)SS<9vS-l`+jt-xiS3Y0YpP-_GX164j1c{2n7Rzfq
zFHf-l+!NVQ=W=9S)0+*Cg5q93u`gWxz9o5KV@gSAp~8BP443<E>ty-*n*MaFT#CGU
zG4}qm$*Ub6Uz2{bM~@?V`S~tU;i;w5<o1YeK070Qg7Jjy%=OFWOuO$actNBf_ujdS
zuX~smeUaZgE7q#0YpuKSJtHaKQ}Py5&c&^N7+Y2HBw_Di^M$|OsmC-&ee~PNXt->z
z;-uZRlieZ%U0fSy`KVYVxW1Sy{=}D~`G)07C)o>iw^~$Yq}s2$c!k$X+B3QDbJ0>J
zuUU5l#P-Hc>j{&It<zZZy!P1QDb3m`jq+C8T<!Rex9NBu*WLZ<V(XXn-UlwS8RW*A
z3a)RM<k@w|cHvQr6HmO4_~l#|O<mILn;aHf+AHJd#J8WbXx5G{xi_~(_?*k0_B-r!
z5<a?nGpE+8-6t~b{vCS5YI}dZ(@fpfhG%ZCoH^yA*)QwYsp4vK8qIg-2JCvS^*y3Y
zZeGoa*qp=)|2wlSwkQR994j!MYQ|B_xX@wWu`gLFVLuK{zIXfITa7fQOV)yUChm3V
z$N2i+yj#haUKH4+u+Hk{jl*kG#1|KZ>Nu@nocbVo_HB(zJ$g@W{BQcZ_q{~9`+27A
z{r5U2l*Spw_R9vcK6g*!5Ziw4&CO%`3c9T<j&A!Ro4#+`@~qbid9nvHrt6-v_`GHn
z>l&S1uDUBawVWQFEK_u|O!*aC_<OhSDZ?2zl%#5Q)VN%3-qwGO?MiUSt8H?V6%DfH
zHJ9--ep|-q-x+BUpJ4LI_j1^3f3-)U+11J!i<Ay%XuZ9cU|||io450Y%pRe|0pG=}
zwAU`*a(k-ECO(;ITLSE+G1wg|Zd+CKdvd}9<{Iy}23gx`M30<QUj1dltIgSpd;jeh
zwL7Hq*>`H-9q&6Q1KRCh8@PY`7s972+9f9Ze#K(5+*vN3Eq##z-y%--Bn4Syy2>1|
zy4II=+oSR7MV;bLR=bW0e)8d(xp<*w)T5IUzYj8=+A=G)E4$0cz&+Qr;2gJYwp_>i
zV{@60o(z-l+_OJ}#lh)V#iSD5qTrwuALTU{S28hQVXrFA41N(Kz$e>a(fX{;?88O%
zd8f;_?tZ<=`_1mWbNp9WdAY<^<~-f=)@S)P`8PqC{8p>i)`{KtJWqEL+Z*RUYn-oS
zX<E%*cUxpF*S(q2PF$<yOCNmomf!pDL1;xs`~HZRmrvclr@VMOuhuIu5w5-4ZlAT-
z_kQvkDL>cn9qTi~9;e@zw_x1HzEEWA=1tL-UhC5KmZ<y3+fG_}>cZL`AB?ANHWo`c
z@R`r1+u(+4+;($WMS<=9wH0lKOB%y=ipm~Z^mxHqZa&SRJJYmFc1L$zjtjSTTAdKL
zD`-Jh`R-($#~UR+74S}MRAafHBx+mAxbMfao3ow0SVdy?%<A~-8XM@r*uMA8WxY!s
z#TUHKDL*JFD0_A~+b7E}V6s~zd#i!shvJ%U6~~>GN(VCZtt+0(tbeA>QyO+UbZOs9
z5%r|MQn!yt&+X<|^D}E=(1nD(SFV0MuH{@S%e(xyjLQCn4DIaf*MCO6I~<_2A;Ue_
z%wXG|hXRQo)YiY!d>*1y%U96wePs;$eh!t=TaHEM@e7~tVUT&)YuO&gc{Si=>Sg}y
zWfK#GzCJxrw2GH4Lu%&h;&se#G>ZOzZrm5;@GbsReq7)&|2>HYrG0%H(uKC2wv_#R
zWNMwZZi=tp=jC^o?p9}F-e!4UZ+U&1=cUXotHqP*Pa3n_&)Po0qgvK~QbgrZ-<77P
zZ&pp=RE-wvzGB_vvQK*6{@*ojtpE3K5&U52$h-ESuDfgDwqx^{7xoKpzmV@3IM3wn
z$&}{FQq6V;KK;J=)KKq<LfV9PoqQYiF&{sad+|Z(^k*O2)&IGaKiQblpE|w5q*X7b
z=8i`1tpv%gSCP{LLeu{|^UuBi;>5k9DSNUN+n6fE?#9N+yI){u3bE~tiu)$fUSe2!
z=*?Lp>9k|rngMyf|8!GAZ=|~ft@^YjYT1)7?wf>lpVm%lUNv=zLQNCjtO>WPm72GI
zEC0Cqh+gqW|MyQtJ}Yg0`}IESt*_r6sP8JjUao%W{Q}RcUALZJIC#hJy1^G!&e{%^
zs+rYISL*pTXKQt5oLGFhQFyzty)3)#G}->beYfZAKJ>Q#)A|eSL7M{ae%TWh$!mIu
zbK(y5@1HKca9`s;(e2RZXKTeP1LwP5ee{k!qJ$yeYR<A(Z+00v%Gn%R8hfTkQLU$5
zVXxbpV|nYdcCNcCz44x7?@sy6>wd305|`9u9{f9nYi@qssi#|oA1T)Phd=(hX|^KY
zi9@U>k9ax!?T9?wAgW;g(eUkKz9-^8ni%-o&Pn9Cd$P-E+oy!}`Rs_2*lw-hd{fI<
zUCTUx;pc9yYf9fPMt=PJ`+L`uZ_=NdCe0LjTEL>^Du22E+~JLLm8<`T8qCp=ld^il
zW5wCEDByfc_))1>iR%nqEFU;ltp8JeHE?m_n`1TVAEe^1Z#_{^d#);r_j_=pmQUI&
zj%B;bS5{k2+~4v2`}g@_Pp9e>Z)((Jay&2Q<>kI_!mnHF)|>j3nmwPlRrZ7S{`Cty
zw3jMxxVY}Nf_&heGpkO0&EfjCX^VX3!*=uI>dE1|`i^ey$%`)apTM}~6PtKR$n`%b
z1LJ0JpGw~R`p%B!`WG_o-=6tax2QgJR>sA@Ms@DzO>JLKKlb_Xu83rpY@gqzcC{Jb
zHF+wd6Rv!AV>+G~%;5ULId<M1pHdU69xf-rbw;~97O-e?w|`<1VYQyR(2D!jmLJ?j
znk-$0o7aa<2uXhD78tku<L92OXVR8GYBkIB)2KVHTA8r$v+{=hKU>oeZk0NwvGBnJ
zE7rq51oVwBDDbzQ60HC7xW4Yshl_eQwkPaPY%EhVejeg*G3de0&yr%hvJxv6e!rmV
z`8zA~hq+|U^sf$8e`FSK2)c7Y;7>PCrqH*E8V@&@P5vD1Qnf3%N3mE_rJ(Tjsva%T
z>2ehv6ZDL(++dz^BwwX2Xb#Kue;k_Ugu-vVOj_J`RD;>+K+4UJX<B{yA#3JK=juBD
z5ZQ8Ra+=6Kd;Q~oYJ3#SGBaLJaVg9Fzp69WX{K04MC04+IMG(=s?*)&f)ZcV{Vd&I
z8UFa}$EtbMbF$vA#T^r$)*ssEe4{t6`TtWfcb`z5JzaOFGtHcEy?ACu+|?HrIhUub
zIH*}$q;h}#L*vx*M|*Q*KCUx*@u7D4BR7TKrI$||uW##%URbMEYME~Mxl>?%TUB^_
z)!Fbn)?#n0mY*n_*2dWK?dRR>teJwmS2x~DzW@84s>^at!T+}x9%p})xm7Lv_nTFx
zLV0W^NZ&eR{4Uvyb*E4A-a|cI3`t%8dy-h^JU(ynwf~w{bk3^u0MqNu|2JB`=+V8p
z&+D#V23u=l&mO)R#lELHC2LCD9@p=1dK_s#?}gdYhk@5NTG-48ZClP)@O;hHuhx8B
zlK#?PHd$VARyn-B`kUf9V|(tO_UhjcoWH8jwC>xs^Eo>V+Lmt#{&o3$>bp37=^a<Q
zHvS5-Q&@O7{;2n%ZnaseyuwBLR%*^IPd03wckhV4>o4U`bMHCN|5aeK|E^%4y2qX8
zA!-&%9kTpKw$J?XYF@h4xmBfMX;oW~zSezHaO<P|JKNnKJc5$-4@IAw^Qy{gtxl@b
ze4~$BuFm=_C|PvWq}V!V^2B)lgUc&-{uYz?+4}lP^24Lk!WoP=mHgT^!*hB4<P7e%
zn@5*SsylPHx<vk4_k$nruN0ln`4OX0Q2){~e9mhdf%6t#I<Km)AF#gpSiog&WL$#T
z`s{$I=e)1XInhzPV7t#+l^+K*9QJW0Mqg4r_-I)%`!4%{R})sN{Oc+AW%yX6(8f`o
z`+dUUH{TmiR$MEMyV}sov7={GP?AJk*R%dcq0**?b?YB(x-}&>UG)6*HPRPvbS5$y
z?`EFfW_W7b)0kO~6=Fq#oE%C)@pHc=G35!bInsIbxBolO$|bvY)<|x7SFy(9(z>;?
zy;-=d7irked2eNG@?`Jb&p&hJqO`v3%ytT3dFvvxyfoxc&*gnjyjrd5`^vfs4`|p3
zh2_0y(n!lVQ+nggLQ|=!ZT4l2K>;u7&v%EozmtesvD@!CLy@&!!vDq_)e6@*ocHqW
z{5X5>_p%x6Wua@AWUtIUa$-qSW=qcV<c+7!>qps4I{d<-D%Eo0{-e=nT2ICBfBttV
z=Bbs3H}55`4Th;xKjzfds$1OMy}_34-wRQR*U}Fo`^uSDnJ%$o=gwJZy!P)s!D#+N
zi{6R-duTrYSv$Aa?SE`OmV%OnhyNY!oA~6*o5#}&A4Ev+$eX=8_^{ryyFWWiD!A^*
zuIin3@?Y+oO(6ky+S~hBOVR^Zcy~L#Jg~G{oImG)`M1S8z1d78+}HeIxO%krewR+t
z_pa=mw};oZynDacx9{Ei!)N>7<?q(K6tLekqrBU)QtQL_1A>mfQ?~X`{cgR;Xx7p8
zZM;)tR{MIll=Lgi`|)~V((>F*ryqX``MLFzk<1VKjmD?e-sauYaeBGAMz)(+a?OIh
z4{un1zc**%(L?Okn<Y=YI2V%jz4mpYRG`T_!_(1ITK!FKN4Gz%ntXrt@4&VX@+QA#
zU(!%BxcKphbeQbyj>H-V)?c5zc@{bEx^-!lqvF!n^J;!R73gHpy`t;Uadyh&YkV&~
zVjmt(S##IT`__-Qo@^IOM853{b+K^hXm0HNoz|+AA9<!iZ;^Dz-Js$$^C+`9k5l7<
z6xMIua=pHWZR_op|7DxMZLG;weO;`XV^{Gl*vVdLAK!v^D>pnoz!F<$Xq{Z=I+5}2
z>xkId0W6x|Q}W|^`1PC)|JpS_`QV2aGp!$_C>L1WC|=@gXb@ucJ8+SX`5T6{P6v`!
zZ{y$o?Y%YEQrC&ML*K+ZtupNXdPJb}{*=c*Uv0j2^XzkT<9%PtYp18)-Mr|%aL%<$
zEz_SY{qOg1uWyQCVc?a(=?f)moBx(GKf5{O@iqn5+uD8wKh-Oh#lv`><!G#1$GG`_
zn5pP~>!sHFC$3}J)4ga%aFmSj+O4}aSERAOt1Xk>dpzp>{)Gull@EfpT%4jAyLYqJ
z-)HYCuI|YG+8w~Pvg_zn-ikecjpp$Mo&9?3)~!X#A@0d;u7~A6yI$n5dKt9Ei)~hu
z!^Bx9Zm$Zo<usJu!S!I}s?ECbcfZY=uwdEYcPnOJJh5w&m`0kcaVGOV%`FT47A*Jl
zF)dDh#58H+k!h`LN*8=&7;{7_-!@oU&uNJ})ZNy7ME>!0xpJd-NgV1+K7SRA7rB?X
zIzla<OH`ovN>AXer@qaC%3WLr@y1nZHOA{hUow3Cdi~;BXU_7+nVXuG_MN%4#v<wR
zqUW+R7MmA#UVMJrO8axx<qdCBSL(l!`q}<y<16lC+RTTa)Oua*-5zo?Pf6VMh-3Tr
z71Aop=AT*9;qA&;J|kqmja8q^>HBIDD+4UPZM*QF8FgRk`paFD_lhtuO!Z)35JTOU
zT2PdqUX++ytXEKZ*CxC8&W?%qziMv?dwN3i{DuCr?JniFqK;p?wd(U~9n0O(U0nw!
z%#d`GX>y-1DNXeM_Y!jkp$ExJO3lJ|&fc_irs9Q+67yfYvYR&dudj>Rb5<x&W21$y
zYhe0npAh#qt|uq=M%eVvlatvrebb%Ln^nP^pZm|R-CgnT%g^AleS&Z125d@LxkGHH
z&US;DSDW(r`NF2&*<=xCS{mGGk#=+2l+d#kfhT5NpQ&@@;K9Z2{dS$3gt(TyeE*>G
zRMF0JLfa;ZTJK!z8v0?*K0Dnr?fp|@!fRG5&8RO(U|2s(Y30&0Q~x?`dw*rw%FTQJ
zvUqQOU;cK1*NyV8>&|qUKJJ?PI(EvQdrxj&%6q6>WAeNEO?mVZrk<DeywQg7HwC|4
zv|f-K)-he0bISb9{GnP}6X$hGm2F9Se(~pddH+Y#^ZnxfeSi7;x;r~hoYVx3b(_7!
zT(X#7FZq2+a)#pGhFu>n^Vz)JXJujGQM4|^JK6c_1tqDy6Dv<m-}z(1pV=O-ZeC<O
z$Tn+#!cw`@uXx#2L_VxyWNVbUq9EvSB`QZ*sy3uZCj7%%3#Gz?<v!~&7BoKM^LbLn
zy~i#|-fIf`yyv?u4d#E$x_hDTv(Ht7RRN`8%;Amx94CFcZ=|aRm2DPeWqccFebZoG
zc++z0vd|OK<zk%ST9O=UyB}&Cn521db;{$nj;WRk1xM=caLkB#xMCBNl=6Ggcy8C%
zo7S9o)${zOe#30@xeCWJ!!#`-tK=QnfAAcc8p`(hb}1uA^uYsFd{fRAS2E9zdUxZv
z`1Aaj36IQ9&JH=EG5>eNtU@XKy-Y%UVvZdp9Rja>!<Kw<JNjr_*qa%xjXOjS&S8z7
z`apky*uSVxv+Qy&CoF6A4f`0zZG7g_5vyO9pI_d--sDTj8V6a0(nl5{O7UlVLssmX
zRbFG?uk&30+~VyU=5trnRdP<af7<Cxbx!N_)YC%e?0SARKIiJ2?EY5K=eab~e)hWl
z6Td&smfgxw&@Jfs+c5V^eZvKt1dgK&AKlefG++J^6~g6am(wRHb9iOr^Mgr=`#5eT
zE=XGQ<?u(>lkOVs_r87oly;?X^&_Pzn{u{tpItoDoReWYv$3f3Os;fy=2J~9j3MO{
zyO&RI4&1<cRsP$X3=2M<D{d;`8jpXKEK<^PZCa+YbZf%=IU$yEoaaJ<QdMO(tXZ!m
zaP6#GbMTA;)^@g%X$%4en#|0d-xwXNcbO(F*Ix2q&ef}YZM_ZI41R3e{B?~)dFL^U
z>^>Zkdt{RM>mAb!AIKc~e>1^mg2XZ&POC%4EPrQYSV-tTnA3BZ;YZNK7AE$eL4smS
zR093pC>L@kEtucid@;KIc)7Qu%HqupJ`B10LX7gW9&T97@Vj33Mt@Y?HwKoaQ%p>6
zEwzj`Td;9+m9q3%(F-vTjx;QAPsmQt{1M)r5}d**B~-?2R%BarB>DyizsC0Dr4v&1
zE@&{^o~HD$t=W9juAmhbg<H!bKmKwr&~ur`KQk--#ZiVRi}s4gS~oLyJzTx+K+gk<
z2amOOFgw+EzI*U^dcu2?_UblQ-37KioAhfnZcBdei*NGWTh*Zw$MEFzJ{`VPfeqy$
z=0*i8rhh0sQO9tIsp5u4Cj)ajtHsub*JtLeI#?mDq0sE0|6S9%SSmBDW76xHQ+DQy
zrm?S!Te|Xzz}Kz!6q&!Tn_5|{bAX-sB}4nl(q$Dv<|^xD<}ge+B#`31sQN~@Ub|0h
zs_NvWWpe|MJQ2GhFZJDKx6m6Ujq(C3E|VMGZ1qY9R@`BozGQ2j3xC|9ZibkbJ#!Yx
zUKG~|y|N*B!~H!cPg-VO%$vVmPPS_<yYN%_vjPg?oF>jnys=UJCsZy>NGmDpoZ`QH
za)GcS&&&zWuN`2LPrUMC#=<*&ubsuGr8kS6*Rx%xyy}?f%Znz_;+rn*+4nHC@ytdk
z)(S2!{xiZ>j~=WR^-yd(#npEB-`f3GnmcT!y_~ZmC|`=T&)kDsFX70!o(nOI7Pl_8
zo3q4c2TbJSpQpTIhu^+++utm@W9z6R)-f$=MVjY@HZh6hxg7u68#`4T?!DNpD&uSA
zY%Jo?QlBEfR$H;l;K$D=Ix~E=)5Kc#2XAip+sCTY@lS2@A@PMbnI(Rj-f*-LV|#DU
zvN`hkp;c_x)|7oTJumH;apuM&>kp^w#0xm|Pt06;QvZO!UZKu478Z}DyE8}5ydspa
zdG@Loi3Jy`Z=G8DIwoAeTl)E|2}~(g7euR?{+E7ly;~bxdvN)W-@6y^?_gT8N_V|!
z>*E<SWRHK~%M>~O`P|02)#`^925N07W@VY_pvKW;&U>cG!&KOn>(c8p8&4f!Xxmt;
za{TB5=LFrX*9Nl#4u8CEBW_io^k~7?N9;d#`MkD#V)y=s@0%Z6JK7KO@jXp0yZHT_
z{_pe)M~jaHx;%cmYhGyZ4b~)%kDo8(l<&B(@3HCMUED%(NlfYtt3uC4)O=|OpRgeN
z-}y#?qoxcQ&fMycKc@5D<J!?IkW%wg>p{oW3#X?gJUQ7MHgQ$(2ZQI|_O4jPt}&-5
z&vA=K{gkB|Nk_w#Oqz^d-I+d7?6Zs0nSW;utF7{$B~<Y^z0zw)XWF@T*~7=HA4y8g
zFB41s;Fl-7(Ep8AMdqCa)|*+hdPLbDPs<ADHqJ;WeHY`h-=%TCM8KMy3*}QCj4f_H
zRPbAp(d5Q!e&d|j+nju!j1?))Z#sJ>hp|39dikilzI=Oq=a<<xA4_Hw@n)73G8rXl
zsU<${-|sR#p7VR%Ci9(r8@DhYJM%Nub#rVI-}((HjI5RE7Cd`i3f8%JF6>e8OUO?R
zZaaVMY^S~Z<=@qp{@<FLaaDVn_+!-$sWhfTD(>|=cGx8~7Hc){oGoGXYPt38EBr5S
zEtuZSWA#Wj>Dq=%jmn&H(>Cn4n(*ICZrS6f5%;-tIUaCqyVZE~v-G}To-4~X-8_{#
znepoBIoC6OD2dIx)|IPLvHhEMjC2y0?Ip%*=VorSXAHjZeHq7;qAP0KITu*8Y@Ktp
zK*yC`IA^)a8rcfTGy%gojUT6;jeBz;-i50quT*>~!_|Y!Cx-h<zFvFG;b)e()t8G)
z=Ixwz#`6zPv$nFp`#=-J^TBI=|9sf^p@G3gMX0Lqt<(><pVenA-TU_CfBqU6XKHvd
zZpYK@TEAUoCJVlkk(M^r?%R1azT}GNE0I~EisxhGH%)djeNvKLwaB5y&idz<kC)r!
z{qE0OARlw1WbG-3v-_-n|IG2TpMU=5>AO<XSQf6Ed_pzmK?BE&1&=0%m?_(Pd3?HP
zleo>YPds(yEuXi3+&_#KA3hscb6`oM#k`<xyPq{IXKqV*D;{`~^^$g~z$<Ppv8kT1
z6R+4ZwNG$9a@1=B_tq*C^(u>mZ6W6cB~#B7@yXmwsA9Xe>flZG9eZ>>>nyy)ld<QN
zkAv|uIjtK{qHe6|xG8JBTJzOJ9y`&UPc&^y8OoN}mT;;tmVe;*%6LuEB8WjGF399{
zmBWEM3xv+qSlkjxI=F#F*e`@j@`0&)SyPOLW5e8^dc_*=jBgutR{r6VWwbcnd5$Ah
zuD)@;#{Y%4R<1Z5a(35VCPtB@hDsKTgAv|b)`Gh}xV$MkHg5w%K;_YFxd*?u3oSCJ
z`mX1#wercTW&V8E=5F@c$$6%%Bu*`L@eVzM0E4v+vZWbL*{Y{*D#$uZJeni<OG)pS
zvK>EDX9CZUFI9f$0}nYrdE{lu-5>IuVXJ2Yrxkxm@OEQagB?F-Eey))jb47T?JKAH
zg<@@n?~+C(??mUWQ4%yOw_85x?1UGVE=R+fH$6`NmZMU8FRF3k8_N@ha&l|7CJ6}_
zTl(ES&b@xiBS(`Gr-y8p=ea&u#X0-`wxcWct{YD~-z&Ez^@`eFozEFg8BA=e{??l8
zG|1OKUQ%>_QKi`H9nsB~ERWY!G<42dHSfsDg|}udn^xv;Rb+ljOn3JumR&oJ{+hk-
z!?%wz$8-91zMtl_I`XdPnTz3SWu0qmZ>wYD4bLn;@}zBY@UrU)4;jCdyb8KKx93vp
z>YUzf5;fPw!q&GmEk58<9$EckLsrr58E&`LSav_Y*TgI|*^a+p=AzKA3%9kd6sbxJ
zc6iek<E?w?)WtLJ;vRnaeQ9a%nFUQw(dI%D-x#j<H7|?P{U>l{Lt=vI6wg(Uo0j`r
zy%^e}n(;^A+_FQ9@|b!agsv@kYhdw5O=98?=d!30n;F4P`OA$DcyHWP>CVLY$<54r
zA&+^q)g|Q*K2f*2v<ujLv<$B|o(<o+a^ueh?hgc+6aDmdDcMascQJf<jM4htpZ?Bt
z`MWunLnUIFV8x?p>ZTquS~i>O?3VDz_-17lXJfz1WSX7@Puc<v-M44AzbJn+`*HeW
z#-GgGv!v{`Yt~+wsQvBd-<ST!6q+B$cdp%|W|e>3SZtSwYt;?DZ3UbsUMxAcHN2{O
z?gtym$#d<_CIqGXnsE3U&+z^EuG3XEd1=}k>u*z*9Br=35wiIH=z)?!*t59{Hr`5E
z`jKzHYyE*KY_8W|C$830Hu}1HTcTLyjj*VL7dPju>a)GK-}BStn1#1Lyje9<Y^V8;
z9qI-CQlXhz4TaN1LNm^$_V1VH{=rcANw`B}KEvglGi$m#1*=)PtXH1h>H1y9yhZEK
z*TuC3ZuOJ--e%XW_1sjor|DI<iQ$2xZ?_9;C~Jz;ON%vI&6b}1h(+|j`IGcjTk22P
z&Af0lZ&Pa5I;(B>uluPr#Y|iOsNcUS{lAou&HMyy*~OWq-}WElo2|C7VFRCo`XXs9
z4c-&Cauj|E*@^|(YKWdrlWqFQbvNR8<rXeG@m{CrC+6+4{(Jkpa9O0>Ly-waIo=!2
zO<k$-BT_79Q&H5MSy#1o9~D_&_@wi|qixF!x;tbNKSzn4vpMuYDSF+y4L(eH*(GB0
z|9$!SM)-I2_m5wf_rE*NzwG1L6L*+-jIJ4*R`I{yV<6%<eb-^*>t{te+U^PM>D@kK
z+W-DC;l+{i+XK~t1=hTJS^Fz^^Q^-S>y9SeP`qv{{iWe+Z6(i!KV8Y@KliPP-(H=?
zR5&A>D^Ki#M^fRM_bDy9ArW6vb8}WSUuU)b?te`&p}KjhT^5rst4pxxdd0R2vhI<&
zLC1cH1nfzY(y2=L(Q{*JPQymcilceW6W3HVPd8pI@^FGw=cSb~8;$P@Z`g6}RpaC=
z@3$8vwz^yIGf|ZhlzBO!a)JG?*U|k|y6#^J^Dke#ZYo_Fb9CeM?;2{#rMYqv%;_^a
z-?djo=xfSN{>fZzdA3k0SLCbLjkmwI3*FJ`6wC-)y0-k6y>D2o<&-+H!2N4|7b{fn
zTfWR<Z)U3Sj*N-7{mhmc&#?ITWO=cEl*98rD|@y(s*G=+?07rzaooEt!l#~3Jm~Vg
ze0tIz&-FL1*E~<U_WtnZ++wS%>ux_=lDld1*@-Wfm1)#U2d>-0{dadx=jPdEifcZ6
z-(_}@w`^jQ?3S0E>&{AX-d_8wIzax?wYZ9X3=u10bNG%gvpVCq>yC?wme}0i7vFRK
zx}c`{Y?oM~k?gvfjFkseY@$so^McNsFA6oboe_Ib+4=k)2eU=-_q3FKmR@b_6TH=S
zx^HnHzns~Pn<~?9J51cx$Wl5xH99NilBCn-B|DDl)U$PeOPG}NJLpB~6a|xs4i!a>
zKD*S9{#(Ck(t>-R=k_a?F3HF>{os&e_VLlp1;-EhInO`xOPxPtQu~{&N6xM8JH#An
zpLy8LcvAa=!Z#)Tb+I2)F2vlqs^9aba<lCHl0CH*i=1ztn{BeA?7)nhuT1^_UDn;V
zKh^tv{-s0KFY49Yk1xNve)HPcIH@&SPP0u`IX7F~Re$*@MImNipQQEPDXEvQX1Y%_
z>O6X2womwlySH{~s_XbpSB&#m*i|#J$e^n4*``bz9h(g-VH3Z7>t^;9|7vja`sI^X
z3|=ke*|E61`q!=e*Kgki%zU@?<DtUvyu)m34IC!ikd{7^V`uQ=e8RKJZTlWSC_Ln-
z=(YJOmjOeoq<JdWy^I^Lh0Bf}|9X;J{LDq$^gY}{zj{yZKj`?Kzw$ooZSiRnoK0Vu
z{CzF6e)F}y->jlS9oMq9$6M<OdaN(kZr4iORqNip{k>Apx_|FaA9a57Zr$!<GuNG6
zkb869ZSDLU4n{YYEpE?QId#i}2T~`Nw9VNhwtmTKGqn{tR_oOLv}$;bUb<fiP83x1
z@#NvR-oCWjzy752)CS$H)>0XJ_ShAd9GOz|fzu#t-#bsyyq0x4+@3H>Hy+w}oL~8p
z#&a7>S^m9y4!wL3<Z`^&z%_y)^1@P<+f1x!Cl6P-@xE%!xh5TJs&gkz`%UNjzV%t}
zD<w}J6k1TKXL~()!Hp>Io3G67w%#?<`faJV-f^Aomfh2Z|7=UX{qA*1+jg!z`zwpR
z<%KvGG9SC#{&>NkwgQ$#vsI2sADY{_gzIhV1KYjvd(ZF9X1eW@xWmPqRcvd_gRP9U
zUw((T<r^iWC*~<12<m^gU%Bh;Yt{+36VeW_Zqc`2xb^?DrI(c-tXBKJ%3c5ehy2Tt
z{{;d~JzWo<;dgk<)pXU9&uaUw-pi_AMOJ-|+UELJ_u=2~6}Pij{hy!zm2Xyd?&%!s
zRhot?dZMh}zBjnI|J#>!*1zrM?Q1K$vww=45ObEvw%C;$AEy1d`gYfEsW+E-&dA<B
z+GjDtJNZlKbNL{nJbs0~@O#PD;vWyinP2rfTzj3PPPTY!S*<RYV|b|^n{7<7uFIFp
z8gUl9_Ak7Pn)~7tjLlAMsh`PUc>QFrQNGC5q?@Zto;`|7vG(_hd@O&T!A@{*P5mL|
zr#U$_M}mtdcg~aBwEc=yk6KW2Bk!DNi|p<)FG+lH<X6KA%M0vxWgFf#?tA`efmn+C
ztmpkdKB&E4RIR$sI{ebU8G8A*PR!l>M*R54<vL!+yLO&+eZfCjJS&{B?dMU`-Oog)
zJ$Yx7^Sk%^Zl5Qa`!i3!?fG`n;QRM?hZjxSVm3kBg3tTj);LqIknX(fs1B2-H)d@L
z&MNTTGHt0Lf5<VjBJ)RIWo;(hICf=s3u{niNU2AAZ}@@^mn{8GnMH2bcQf5F7vR+S
zAmo|V-?oS?_TD^^&05Edo}Eur*xo3_CbhFpiuZ2D`e(~D*O+-K&;3%;E+fG?=YrW5
z`58~VjF>+CKX7z5fBN%XmR#o;cU&<sT{fHP-I1BePRID?tk+zg`hU-@%)>dJmmm9U
z>wZbMTE=&8$qv4hE19Nyj^9!6*&p*%L2l2c>+N4{IZg|<&z|+_K=6c#=r=T&?9oh!
z&}CpqK87*iS(I8{lnFWH`)zG@@okSu56b^?&Dkr+a9iZfJAU!)U8(PP<bGe1S5+mG
z`}Iuh2MH4w5!DEl18feqZVUg{{ajHl>fu%Aa_61lE?uD&r@-LMsZ&++YAXJJtC#&B
zr0a6G^YP`NE45qKxKvNtb5Eq(yYP?mzgI6RKP|g?XY19Ysq_DQc=h}Lyg9L5Pu4HW
zezip8deYULYXSN%T{qe_9ZH`bI{l09X0HeDw+XBM@wnz1o4alGB5}_^^+(%Y{aUqe
zLcqE0S68t_oL;r=*Q%AD7e8lsZlQU~NOMx^Rw0f>9={gt6|mi#b#&KGu`lbqr{!)g
zi@)ss@9xP@p}l*5e^=JBnXkY7?>5oTl|gIGeQz^|m0lLVQB{5<_0yu)S8re5l|MUA
zSuBE~uA}TS*N^f!f4=;Fsh|HmeSQ7!&$~DOJiq_{uV-(*<nOPOP+!0MpKtK=EA!(g
zczt>C<?Vb|-CK+DqyG7N1a5xU{XMsJt%T2~Q(L5tzEW3tBw1SdW?!YY8Pn~^JH3-D
z%eUL*hY77?{k-QzOVjV_+E8=zulKvJhV@L|yq|gFE7v_<b(&$)7t2<?5^CEaZYm!4
z_{F6M&%Ts~&Rtz(^5K1+cv7=O-(<fpx6l6BCH(cP1Y7o2&0pR(7p>Y9XDa@fg)1aC
zSo!$J>La{6eHRy87MtyNEjGVvn=y-Z_Bs}mZ@Y54cgN2TdT_m4_fXLORsV`~e`P7w
zm&cX{&i-!i*#Gl(yBymKC%e{bu7RKX%e5Pyc88f2M18tHU(ol3*8i&gx61SiS_@j0
z#bqCqe`Pwg)&0}m<$N!%m3ZhaxG!6C@O!tP=!^Ge7Dv1EER!F21ZQ*HQ||0vm0C1y
z{@?fC-#^R$_xSGY{d4~PdOmqEi(OXK7I7D+s$-vh>;hFqSnmrjZ9H6;cgxhs@poEi
z$=sDQ9y7d(Dh=N&+TCXH??pzV>*V`KczGH!Oyg7ZX7@;J<!x$>{F{Bbd-9WKL02?1
zSF9HjUvQMIjb(yPSgdo=lKmptQ<Of4zu3}tokMUzN%yu}Uk=!oe$ub6{m!WNK0iNh
znrr-?Hx1jvk1s3u{)r<+#A){HHlwr+lN)%vU0a3cD=mKV!~MWsu~p^~irW{ay)2yG
zH~Gtt9ogI7I!y`XwokM<y5u#ZSwdh=_+OQ?4-GeD7shUxEb^hQ`j@oLK}}1~!itTD
zd6XC>4!HSNPhY-R_U*s9xA(T)yj#LlCvv2E@|NaZN%yu#*Q^luA$dYOr1|};M=~l~
z*UU1xUAOsdx!E_zvQMjS$#ieaz15dce!;lr+lp)U4y`SX2Lj4ANKEx)ZZ74!!?s58
z<BM(2d%ULm<SaS!x#zZflJeQrb*gGBlYE}YM4a^MR4?RvsLs9OyGMDUw%F}Bhr?Hl
z)^zW&dD#DN(R}ZdCL0TsLVi?F`}C^SBqH>{$-61DoVJ!Mv-)#=*_vtPRX4qLr_H`x
zGV8^C<@Fa8({9f*UY_~S=<vcg&!o%#&(xO~`K^k&;}J56$K|i=B4_=1iP?Xi&6K$i
zxQl;jvL!>2$$~jG8+PP4M88y9D>Lcm)E%#vbwwF}?d?9l%>K-pcONDwOkb9qRsZ7f
zUK?hCRppz~ZMi3(f4@M^B=6PrBwpXGCtpTyKUkYEi}w}Jg$1rNGr3X=TyC5G%bxH!
z{ThFbYToZ{GbYQa-mmswRdti$x~#+c>sLyre=kouzlbw><-<gC&;7<S$JVPHjNh~?
z{n@4Xe~et$*?$$5ZZ6k~y{qu!%52L67UsUuvs{z^i(JZ;HQ<qJ_L6CE^i51UAKP-*
z_qt-vw4kdSCPX&wo159Q;lLchQ-Zs5Osp7qmma*}<YHxev5?;=bmhyu8PzKtH8ni9
zG3<UIv$lEnKcVYIb7Ie%<$mToa%S_zd0}5T*n7V0Tj6lSd3V(gN1OP?Y1uno>T-81
zxw+wAzrSO~o2S~E5q+t)?qP>_JA@@)Pwk%);N^4Ic2BxMmCfgq$DXa)c)akToY|em
z8Ly%YwCV*Dx-V!P(9&VgxOnCCtEAHrp1Wok{+hpF=ER-fgVt^QQnOL-d*39T_dR@9
zj2D0I+s*8)X&SVk^Z>`pqjl$RNSN3NEts^<+V_IBkxalf?cLXcM5ajnIW87<U8v*A
z#=efl6--sXZf9Ne_hhv>9e=%iv$82e!i7a|ZRV%XjnF;bEV_iPS6;_sv%E%oeNIGo
z($-5Grm3G|Q8^o0XWsD7g)MxW%u96+7Wq7vnYHTs6#_X_9g^qNESLX$W~%-U#y@3`
z3{(PK8!m1TDotyaR<-w=BtK`8fzSo{-50+6o*B&a^wiW8`;cFzvPCltvM02vAB<sW
zWOrEj=gU<dQOlTlx_29XSgcs0W)c1;E;OWn=Fk5AlR^&up4#rV3@XpJuzX==VmiG?
z>nk@mN10y(+c_f>hR}%;KChM?pU1rR(7sbiT)qvROM7<;{bpF8d0;MM*QU5FD;P>^
zB|M@-5=>jv6i#(Lx%v07@sZTn#)~|c**D~$^XyCNe=mP&?kDYUCo8$qk8qu?v0LxR
zI{Uo)Vu_0#39_?9UH1yie5HRgMX>JX&AFF<&2sZE6e!cZUMy!_`G3Nk{OTCZb*qKs
z?uy)9y!%B7|Ex>0Db_*diCdOG?>heNQ{$XPW>a^(vT%H=%(6}@V9(+ild^3a{Y4Th
z(>zbjQ+Y3)AZg_Dv6B5!tczyPQv1ohCH<zQck{L{y1%V-Q%P%*2Jh2F>7kaV#aS~7
zR*LM~u;heP)x{s$QQ9x&C!M<LtLe98e^$ZV2TAEa?{~B*#D(zAIc;%6to*W#hUb}<
z9EYGOasE%r3yqK8pQ-3*@&9eqkLMZ{j%9O>xb8n{8J~IcZm#)@Af{J|tqu*$x5R?8
z4m@7cb>_~3yIr2&)s;R)eVOjNGIQnb9TBBLvnRfup(Ll5-nD4i#^)#RJGg8<yueAm
zDms=~SZ~Yj9=5s}XCIpLh+13wnTVbEIE%AmaiOUA(x8QlVn1ZE+fK~>pl^`5+@s}Y
zvS51O+^AEWE4~$neeV2s<xu72HGY4*<bLWdOm0|M=pS-@ffLv72R^wW=QEZ(VcFn*
zw)l+fo#Zds&kPE)BW7;;!uwX`#9nUQ?j_%wy5^a$Hd5B~i8T<KvB$t(?Zxj~8_s(@
zKFjuDyJPITwKbJ*q6-!C_Dg=dA{ADr^=(?h-wWGk&Wj1kt665zx|01GXOe<r!qeE|
zQinS)wmF=g|5nUKfveJEvC^D)-$^E4pHIB`=0pa&s`t$<$L|7v{(JpxH#na0Foh-C
z<X6!mcTdsgQ)gm-I?VZ_E}?kSH{0Da(8e!&%A)xG8)8y=TmA3<Q(y2kIGy?Zi??#q
z*IThmFqXS)s4-BpVW`^vxjUmVzGgv6{7w6ZJTu+?Y)m#Y726-t`s}vp`|Qb)kC-Ni
zu=#wpe56}pJpJSIk5`@s2DWc|!~5i}&BSHO+soG3p6@8$b1^GrORQ7Ev(3%Rg4Di$
z+gvj1P|>kvt#xMJ<wZ$1iWXd{6V5d|;JkY4301+Z(<X?QwjY#vvh(v4=jq-~X&ZQ$
zd_DWMe|>d}Hr+PS>GDH{-N!Yjw=461Si0%Ya=v6ov41yo^o~BtiYqPtczjz#>bl(J
z?3^inE}QFm&iP5NVoz|Ibyem}+>e{AFD~5H?>V=y>;Hm{<|f+$825HLA2#+<oBZVW
z1-~!6JnL_L2{rJwjZQgVlyJTwA=2XXdAs|1)u*aNOx7f1y*f8ZT*bD%%BX6S>Ng3)
zb=MjFlP*cPw6xA#wQfzX)k6L5buSVtx6jaCdUm;B&*Ad{^|jk~c8B&DrkxAA73acs
zkf&>c_=VtiQ7Jz+eCJpqc}y`{a8tjqkinb#?e6&wmmcN)EYXVptaLW(xsH)X${TM%
zM_)mqbqyUHtgb)(nWs#DoIm08s=`m1Cq8P~rmcNGnZNba_T<&-8_$U+NXxYr_028(
zs&u_o?BOa0AElXxHuhRxoD(+DQoBFwW9fx;-z@w1<@lywf4bn4cDd!<x63|=ZT_np
z$huuMeJ9T!F1O<UM>pKr9(JjGb^WUE$A0ilYdBvfSW|iS_*K>{{T$<UKPTJzzR^_w
zt@828zx?G|wygido?Mxh<a~MR#K*pOFV5CqIpfXeTXXjPt?&4K^9`TXcbD=5+aH#@
zz5D<9m-&;@w{r`V3jQSU*c&k4{4p<q^`MpdC)T|tiPq|#ZeM2}UY2>>uvRtUZg)wV
zYspf!pfIQ1kDvT&eEl)Nz93N4<>{8?$tUkTTe0b?Q|LR*0*!kzQ#~ej$b4G9->`aS
zhl}*CV>RjjQywh7Z2$L7=ZWpzJCBI(FFLZc$Dy?Dgi}~f>Knmu&fm+KR2NoW>09tL
zvSVq_#ZZk!5}&$nY}~kOj;ttmtX2Lm?+XXd-CnfTg6WFpggPw)K8vS9<yStRUZlGB
zZ2hLZQ@Y_v8y9x3IA<$k8}a!Fm-m+RW~)7q`0lJ)p}*}Y>o@1jpfLAJzvK6>Hk{hJ
zuH7#0ck1Qy)6Z^Wd*XVX_fYsjE9QV5yP5S5hP<CKJxBC{+q@IkDp|j6GLqdgbN>Ca
zOBp0H=5=qakWjg2?)&l7g9F@KLti9CpY1-IwxBmOH2!S9)@7%F_&bXx%$;6dx>0UP
z$kuxd$9eW1xtg@~*59&o#!8pGLlf8)&88k!J;!juz^|Oe>7=d6p^7!Baz;(gPF9o6
zd6*Z=N_IZ<Ytx;P`CM-2#P&LePiIcQt$JMfqI_M<;lPexU$}ICKYrpQTe$fCj-5f_
zUzannu;lGN_w&m!&XsH*CW&R)Cj>UT)UW>aPHZFpDPK1Kcd5I~x=(Qz|9K}BGI8HR
zWu@TnXX4DHY__V$?@a%<>0-{4hxt}rwg&s}B#Gz-YTDoF46@2uTK-D%YHhOgGxqC_
z=64>7PO(a0`NH>XxzvHh8;VMc-*1&J$Pp`8&S(F%E9>HOk*CX-y=Xo!JZWR7#>7Hr
zruO@PgU@7o@#RVfykPh<f9d*_7HtYatXz+53!AuS>A6pwRG+2wGJKoGS*yJ>HY>O>
zNHiHp^|IZxnC=lJr`jCY^l|?CNTD4wSQ57E(fGyGeCR2oT8iWWg{_CL+We?bcU<&P
z|6Ny=e2r>Nn)3PA-OY-sENp&@&6HSK{;l!)$-Hom%8Cm|?;gB&fUkY&&F1?53C#g#
zS3hvx{zESyIJEQ`ldP8M({+IzI$ur;q%^bF@_Np@7rM=!N2xsa-q+O4Z;K~=kZfD@
zJYw(Zn1aVG{ciqs5{uv030aq9@hh&0QQ5?^FM&JPT-&geue9&3@x09&oVQ)*m#k>J
zY+%Cv-Q?xTxe;q;&DPoKRLZxS<5$$QD0ZgOe!cEpF`WCuKL*}t-;!N)Y1{JZ4%5l)
ztbuI_Uo1`vim{#Cv|`U%-;hAA+JGIG<t~V&ui3b)_F`_p<5N!Www5dum)Od1_}8>E
zg;CE;leDDg?Tjs7TfRcX`hiTLi2f|86AymAblz^x_@&`z=o`Cd5|Yu=BlP>LP4;lL
z-SM8mRiry{$uoJgrCZ}nO8(qi)b~1V`$_G|!YnOQ*m>0_FFCc^qh{Y5$JA{GX1@KI
z(p^{g?0=!m{O8NJ&f`oxcfN^iTphS!<s-2Y#*5Zpv;OV9W&8c++>MfNS6cB_9XDLE
zKrolFaqBHR0qwqJ0wo^~Hyd+H7j|$>WqVy^%rM!O$FTj@1nUWYhAW*6b$4XH4eNOu
zdiqtKV|BSz&q=kwlZy;&cZ;lD(DBpsMc&o4rIWK%o>V2X?-z|Y8C!DP`}2c!b-#2c
zUppw`?P0lbcH+4s6MVNAPQJYT-tARi0yZe_e}06awtBjVIO_seg8-rY*RT55a-4tA
zH~D?X!7qo*yN;AuWP6yrxqsE#^OD5#wkc-M4%T%hU#f~=I(|XIK~{$+XR^J>TbJAv
zJ?`DIL5$LUo~%Ve%*W3>RcgAiGp5J1vpe3hSY?HTpz5xF3p5N*xF6|s-niUbn7cbb
z>4v0(TM19-niC6@-rlx&m^=NtUSi{08_$RgqxZsM5g#_Uw4Mzw>`d%E6}M8b?1p>e
zlD3)RUPU3w^Ot|$FonN7BJIMJ36Bm*ZP(W``j;Zlb@rR=`>X85lNmqXo)LdBc+tj+
zKl4|M*`7DrBlny8u{wX~%cPu*=h+{$`7vi#JMO+>Q$2s1*u1?p&uq8Ve!9nZup#@Q
zoy4P#^GUmW-sj7!{Vdlke6ZF=-STR+hH+)my-@KU#uqc2)@dsnf7!^QEX%Vtbefdc
zl7|yR=S|+spR4|#SB3T6T$i;6PBiS;s=nvEkZyXAC`->#?k>TX8K<=xv%P%`ezDx#
zxoSy^K*53X`*$BddvW!J%FbttcP88wxVW*3@2bYvZmZe94gTrJ|2{au-r|(c?`boS
zuNQKW_>m#YI&EpWx8qE)GhUGiPb>~dy%nzdaZ~+A$LcAOFZM7#lwQ;>J71&a#fenE
zc8Bh`wU@3-JWLK3OzEh0vrIeLHNz_Jz2;uQv=F7a7vAqKGkmb4>tgt_V+%iv9$xRT
zgt3c%a`l3v&1-{XR2G)4vsv}B;NZjua=Xt-?0;O%=Cab^%^79Bmn;8Q3C_%%+_0%n
z!u-PKFOqD_k`gPL9anugBE_#7&#Pi;m^6FxVXX<X6zvYleW+cN*v`XW&@Q94<cCVv
zlPlT9Y3t4H!%JVPB`p*vo7?LuK6T>TJ~z$_&o@37R9a-Vy8P4}Jv;wvcVnl|5x=Xd
z(N=DtZN5Tqxqh(UR}Z}}Pqwi8W^X<8W}>*k_e<0NNO@Hr_+Vn*wQ-w>?zA03Nt1I5
z|C>G3$vf(Lx1@Hf#Oa=b7fwEQ`)Ym)rtM=ty^vd?`EFU`t~f?rkCMDu-?(NUUR$(U
zUQ4r+k@Y>J{GkP>Yd===-<1fSFZXGc_G-Rzo?ma`HotT}lKM>ZPRD#N=cfj9&lzvN
zS7!U{DkCq~<UX5f&iaYl=P$k2<1zp3)hPZazTJgv+c}z=Ma05ieh9eU(P=pS7Ee)l
z*H<=Mo>i5%moK-LiD20j<Wbl;rAB@pL#5THvJB@7j1@0S4it&LdB-Ah=O$;x{}w-w
z*PF|f9()jvSDGHkm|XeFSzn*M*3#`$-zBa{eU4k#R^DFp&cK@a;lW*gCnb-XX>WOG
z;c#_(Y=HCBn_?la&aDpAV}2hK>iclQ>5wR|@Xe~aPYXjA6rN69?$;mVc+q~|I=5)k
zEwW<ftK{Z9V$NFFo$9jfMOuiFxci>yirp7K)t$TCxZ@9lRmj=LD~mIZ{pjVH`yf!B
zMV7PVJLh7*@;5x?<r5d4<DIDNH|>?fqL$teW)sfcKbz)U3emrJx8c#Qb*sHM?e@t%
zGb<+R<=?}ff47G$wcwm0q1=9K+1eFq&O4(tS4;1jP{1{<*VcQ@pNu=Z0v)!!{>gN0
zCU;}y+&I~kUm8olD4ag75wu%8dS<Lc+Unb0uKii{$<7%b1t&O8ZIC`c`F_u3w%vX&
zE0mAib6sfhzbcU_LCK|KVwkK(%vz08yIUseT;8zRul@U$&teOItaG_J<N8hy?}p|Y
zPvOH``NEx_@Yd>fZQC$MhfjUo^{M=e<X?H-U-E9+b{=JU*Bd8a@jolR>~q#^qums#
zsKXcM#GLC%Ilkro+Vcrg;@4M%O#SGedt>^URkkx$dxxH1d&Zbq=!QI>Xo!GhfAL0*
zZ8Lt%y0qx4ud=Y`eYTSZfBkEejF-men`x_UdA4K5?BsKT#a*mPw*8xQtA6sm`kC#u
z@NMCooEuNwd?#0=n|?gYd0yk#;b7mkI{6l}&TVr$l%Ly)l|H|6bMl7i=U%vfWjq@+
zb=jHwx<42FeI%TB{nv-te=FzxY337}FW#-4bULhLV^7^Xool);f^W%XR4cNdeOg`p
zv;Ojx>nrYi3*I`pO}es1)zs-q@Xo;Rwom??y{hqH^DnF2Sq~Xl@5^3ZUDLX7-iiyK
z%#WvSs`{J!sjKYoiDR3X&+SP#A7Eb0J>gOKXGvk5Mdg$CX2?E&GNt&}wOfH@hqLya
z5Or;DPHKL1WusEhy2b5Pr4#th&AqTEL|%AD@e|umhb*UiZ+v0xkm+|$Jo87ky9y6O
zWqbKN_cVnig>BJK7d+NWRBPJQ{q7!<n|RK>H*wB&5~oi*Wtek_m3K<?=Dkazi+ww8
z-{||8yCIQ>;ZgVm7D<i*;T!I)+Z*r7aIcN{+AI9m<oo#|*9xxn(gq?icN9K;kUVyn
ziK8MR```(O7mr?ln>52RT6B6G6SwZ|C(GqlEt2t=aL43!Xy<mn3rf*nQdk;)D*kAZ
z*mihV@0W(C2W!HL_FYwDP<uc3h0nGkro&Ge_ObfrzCZa};z_8;owkp>UjFUxT6KN)
zy!&ghp<dql%e03LdwjAAZ>O8R*36i3qs;twZ;|ZEIr&{;>*Eb4^W_I*h<{%8^vTCb
zm9u(#o`f2f9R7Z_p~*{qL5YCXvizp5vogHa`VN0}{_kaD2>$LRI=NYC+j@nUw{kYz
z{{C&J?thPK&B8^Dq8>k|KaFiVyr|owk!yXSQSp&|F718a8yOXum!!B@l%GD=pDFca
zqg2P`(`$=9Zb;}{p7USe>3r||?YukU)XuzGzlTwsZ~cPB6SXJL|Cq2);dylA*3XY*
zRGE#}a;<28exhzB>+KIq*pxhPoB6(X;9SxZdci5svryQ*q~Qa5SFh&77Tun>*EuU)
zH;KJ2Hb_gE!@=Y7>0;K)WTm`rSAHW_Vg1Dwla7haP1<U+^?YOuqnmFN=X}*Y{S}_a
z+{^NxowR2$`dy|Q;Up+x<<a`7v&?YX$=(kvmyf4je$w5qGc{#%GD}?Zyw3GO_kJE=
z`I~w&yh@VCN_vh<^AlCYL(*$Lx#Vr!rRi|+@a&j34<<3?&d!W_GUJw+ZM(hkYuz(;
zGA9;oEv~fpKeO|Q&eVx^5trmzw!8Q$%-W;!Ci!BJx_#2Y{^Wb+PE`V;DdFYHW?@J7
z@wB<*?Ujj)kT6j-?3{e#ZOOj96+2g53)L@vsxRAMv@9l{`_l&f3}36`)|c}V8P30d
zU|XeE@b}k>%Ad;ZW};#TN}Cg7pPK4%tInVPQcL3D{B2#k1vZK%@ZWKWPF}Hc&ZFJG
zv;=>;<}v=x2!5sf)b@CX;jK*Fu;T%;6Q;~|k)5Z&>~N%Vet~?pYFG9{Vg7LA1zvKq
zkJ>L#*(_#LUB~`9)@;Lqo|x(XG(VnBb>uTW<C(|);c=nDZ2cDsIvWM*zy3IuCLmGv
zgn!*frYsLLY2GRJ%bRzERaQKhethDNhYR-Xd$G>oswuDjYF$m8-IFe-yf)tv@6{7z
zW>IqGu>PHe8?(M|u4*&hek|lW`@)P{f7*_)d&YQGdTsWV`l+%h_fxISvZ+n1Q;zPI
z|Lk7)h5uL2sRe>1*~Lb#*#{0;xxWu#6i(FJdn>kV#>|%a>e`=nb#7d%(_*+F;#Od&
zbL&yAL!~_ezlGZ#-}-g4@9xawOD9`Z%+Z))?pKpOLC*Zcv6{^pR(^SNTO`cBoL(ku
z`f9^&)2#cx-TzWPb)K2N`jOMzt6y_Pxt+I!#r+gike7;^>9O-n!o;PjV$T8&sq-wk
z-u!*?T%`~E=S+VuGMDEN<up4XxK`Gs<T~?a1{;?T^;cf-Fxh>|U@~H6YkhZ~`D@p-
zI0nwx!`<BHR?A&hmw4cpD(Ca%Xei&?mu53gu8NpH-L<HCQp)z9t5&(*Wk`O~ofc}o
zcn7bLc~yz=wm$jQ`);>fOlbQwolhlf>sh|F|JrwkEuZn;WY)hc7os%v8P@4!tS@7=
zvdBHQkSoaDsFu&me3#eSJqx1st@b2e5zJb5HTB|Bt<)o}ua92YxtZ_H+S=6H8VOa>
zCl2<x-+kKg`6Anky!nAjs;leQEzUU5cJ-o~%KnITCTqDO&j)>Xvhw4%$#}i0TFmgK
zT*<X%X1{BWpJWO-J5Mblz*-=u@s9i}RjFAfU)UpVv~Oh!TY9(4`mvnndWH&yQx;d&
z*M$Fch<y4X^mJqz=T7apRb3$$v|pEWA70Jhe(BoYndXx{n{0$4KmTRz5|9(f|796`
z>eV@uIn#H%JNm(Llep8&o$TSUOPP6f4s*#?Hv}F_a%p>dXOg4sC$*<<E<E;#J$roO
zu31Wo;ZJi)cBpszSEzovb@U78rx?eI_N5u7W&!imjeOfKu*+EN6u0K?VO}xw^G-wa
zmUdgdcPE)=m;KQCJjY$%@#V?r4QIlxH$`5FZF*TC%eweZkXX;>zAdNE6wCLX>3X+C
zVj1t=uO?pKZ^)+2h>j}MdeI%c=kf970f8^o7gsepgv)JQ#Vo?<=hC?KU`qfS>*XNz
zFhjd7)4v=#?o@g*@iD`a?N>dgGd>b>JFg$rcyjvhX@)#Wt_RW@CWbSv`;@V%+_(LH
zLd|;HT{qWmXcRYZGTOnD82aP*q?iLm#bq<^eU`cI{q=BX)gi6x&HHVH^H*P<^w41K
z?4whyCdy_hXdFxUR37YoX2<J735!gHcNUA^XnIXqtW>SGm+id8d_~38kC{wD>}GKX
z@67R=qW{oMWzL*k*#?H<k_UMiG##)1DleaN;?C?9(hpWn+^C-FzLBfuYo(q>tZN%T
z<JR2Rhv#>`5IgF&WU<Vt3)f7(yi}Jw)7X=0#H;k(;rX_T&4$%aKh(C~zC3rg)AtoC
zA6|N!nIp%{vP)`_*(U|fmF>HxPW6~NYs2|&_xBOXxy3h1Q?+J)i0fP|JkO<3qiOxR
zV|M%h6-*P^qk2C~e0r@@pdX`&Iq%kYUBY+5x5#)ntQ9}DVRN{8CZEUKD|f$tT$vgt
zcy!0Aw>K<P_wQJ1^Kt3C4AySxfKQREI>$YycE@lTN2{*RIkce6j4f})WxL4a^i^`Z
z10CmAs-LlTTlgfLm5cLdeBLU(4^f}Q6h9~2%rVTH^>UNK{5(6KIWxk}6|(NV-h0@I
zQ{-=-#P0jQvqHa?pOf9IQP1Vox%RuklRkCJwOpHh9d9>Yu$eaZvA4R2Vu!QDnW#g%
zRxD+ykaXI6*YmvQ(XB5pJ-&7Rg}hF3d;ZGy)zSy=naqAOHQj0V4!)y$-Y&H=<;|N8
z-ECi3*%0!hrSHz-lIyR}-`U!_vqCTB+Qv`Od3THE`RErf+o<|2*QD;A+{4dL>@}`#
zFFw~;_TkFYeLAcUdIbghu1}3wXrq6tb?%GC%Nj>F$@ITnAgevMXh!GpOP?DxJ}y@H
zy?1L`adF1&sCO05qGc|;xfkRpR}*TS=UgNBCh7K-e{ni>B`^LrtXAf@Z-2nnMq+JE
zhhaqPtn95*Ouxr%Tcz)vP+qT*pPc#gaqQnM$`^~4EHkowwJdgW+cAm#K6WdwoHjV)
zxbVUPhHrN+O9)SzEZaNT-|+eFlh>?MUb5LNJ9FiogLAn+!-h98$FHnj!j$ak=0Ddi
z`@PJ~gNn{ti(7j5lL8-olR9BOO@E43x{K$GCrqdLtxw%KEqqd|=zRWBpRHX!TW+1}
z+kBYm^9RRy_x9SSe$9RHW^wn&{A<f@8SGPwkPeycDrjGCP;ujs@s~=GHqmz;r}R!S
zeb2r;KWU4F-kC);?r~`Wp_fZHY5l8w{(IS4Vd*J-HzK1-boNEP@Vxr5l<}xi$A;Cf
zvy<EouXyb8B;#>&PC~XwuJesLn-pI5u-2Z4GK<5@uhua;_o?`H{8eMCb24VuK40ee
zM`yZ~^YTa5{C7@!idz=EPg(o>4D)xZk5kJp#cj9SCcNQ>`rE%9KNR+4e+XH3+t@Qc
z(w)oj(#l1h0c&(#|Mq__e_^-!{PX2+?rH0ut?ZV$=5@+;UCx`M+f+YKG~RBlr6e-9
zI5yn9W&gZT_fp}_FAn|MHF4Ja0=cNA7XqIa96wQNaO`@PCrfBZWzK>R5lW(g%!R8~
zNIep3xhD7G!zA7heX)WGy4z3kwk?hHR{fQE!A!lOG3S8ejcry^ekVGb3QYC{-ni&K
z|H=*4%P%ed9}~5DWIgrn{7tVTnCr7E=ihCb=KrFzY}#|b{<*0)r8T4r^;sq!unRd_
zmAu}4-ocDO!@3J;{hAVvXSbK_7fYKQ`{)J3v;+O+A41yM<dmkb4bD0xc+~i9@n!2B
zvYOAI&k*8`-KycX$!xBiy0J|6POl0fuacyQWxlOyyP7^RWpzeR%(B~}ziNi((wKOs
zgTKu*@2Nd}#yBy}jUlRcX||x(*&{-8RkU>b4^}L9cQE9N-)(q%=AGN&ktcecF6myl
zlW|P)t*#i`!ntP;3o`CYI~owpY${ihX#URK|Hp%AuD?Ym#N=hOUKNX*DXrl6vsS6W
z_>c3eRXwd6tR}AH(>k)Ye6hw}tIdDk$V{$MF`A_-TcRc<d-L&)23Eha^7aP_LHGO0
z)~Gr&zc$M*zMymNyiNAqn{^lKS@Wh<|A=o0bjlR|)N{8z*2ekiK7sQYnv$P-?*8Op
z3Y^FJ<WKO76QZvcUyzXDNRnd7@a18jc0BG|%$aW1WjUwW@*hgbO>z(8)jRQ^I!rg_
z7~hYZ$|B7NRxi<iZ(yy`xA2MlTN$32uB^@nrM~^0q4d$fZukFhOO<5)E}ge?Qt}I*
z&8s(Wa90e7;=31rz4!J!*3TC{Y0DT$O$@O<zm(0_edATN>5o4YRTke5V-EbZd7Csx
zQ)fx18*`}yU(5dA)|V_Zo}bRXX8h~S`4^EUN^_Qm)PKAddZy{>iJS*9(krVk-^`ex
zb~%L2e|h49{>R7D15Wkqmi_IVtUHP8Pma9jKDWnp#`7HBxE`OrhUI0*$HVHqeqWBb
zos<?c3O}`So*UQAjaBN5VSYc`11e@raf)K|n6s)V$LgVluU*5!qZ{u8F8?**bf4b5
zXF5!g{1vxmXXS7*U!L^7#_UD*0SWOn-WQX8v~Kzo8&a#*-Z$@Lz{14~ekN^YY|h;6
z<}SM|i9_!>hk>M9>Z)Ix5|%}LU|hN9_8Nw{CbRch{kwj%JJ4(4-Nlg|JhHkAA~u&X
zh~LXP!YunZk)?cLN5N;;&8(}I>R%50l%G+2w=dR8WAEg92HA(TxmcI{+T<K?|Gn!5
zMRB>d^>*pc<6d2tU3#Zz`~Btj=eKZfy^>h4O=7v@+;C(2i2*tX^4wSdjw(6mJyUr9
zme<!rldmM0Bwf7qbGGX=oyY#0%I1`te6V;Rl5yhVgg*!DS0osJTze<(%a*wx#0qC;
z>6gq~C*FDH<@3qjo)6FMDt52BBLCKlooh*o^9otUHLrdNXR3SL-I*TC`DIz;`iV<Z
zFIcGsRkbacx3tfC&R4avt{c1geno9#o*g{zLu<~rn|}{)w)wdrZ(rzn!yGP?OTXJq
z63*Q??kRFSqR*1!xNA^a0Dqp%W!7b4Es<$Kf|F+)E%7v3?qyyQIr-$G35>4Y`|>9$
z24CX~o+kH=+lp1Va$U)pD`7l`WalUZKE0lOBlyH(-Rk90Th|{y|Kh_BJ6`9q-n+KC
zyk$=7{=e9vJ$aemguFd3FR$75dRDk&*HInI>+9EbKJR<3RgqFP|512A<b-Lh`w|_V
zy{Niz^J65>v+l$NFY@l)-LK)I`{&H&2MeZ6iBwyD<n5Hg8NFWw*Tts(D7YSRG3Qa+
zQJHJDpT4yJy&Sf2a(I-~<yTX**?xUiEIya_@~Fvy^B#x%*1nVc)AXZa>7Qkp3ygh4
z-{m|ysd(JE<lpLwG?T8<Wk-tF@BU}|zhg-n&xtt6P2Tp+Eh5*Z>VNWOmf8@Nb0{gy
zK9tw*=u~A{^SIu`;)bLUzp|t?wkCqs3y<$k71f)_G%4F;i-+J@-)jPIjO0Y(6{3??
z^Y#C|B$ArscRRYQ$xC6gwez~2te$4VaTO-1vo7ihJM;b$=`D;rl~A%dK4Qa0^-O<@
z%oqP!%?sz%&D-<vaTe=~bFX>Xo;l?@Z8on|KD74yk2LK>iJN&#Uo1{j&eChl{1SZU
zLWGILCwtHBe?R@GU&1UHEp4qGE)vDSvDjqVM4PK!9H)7O)_-}c^IAbrm-lSZ&4+=B
z8#K?kzGmHVW+Mkz6w|3?Y__KkeQ;oVk}~5czu5fMZcMT<?hj8cJM_-t>%`eVt21Ix
ze2f3k8!>-Ro-n`PV;_;YRn7B5?q!|*!XLl=DDOVm8JC2TH4@7Y%-(oyN{D8_%NpU_
zllnRNO2>^~d^K3jcV#(mVuna3$F9elSGrwRRWH$vlG^=7HY`<t^|Y9S7u1b}t=4Zn
zS@>!1>)(sBSFL1OyJen$c2tT+=M#~{gjs)GHy54ym}#!H_wc{e^3NNz#5c(u4qYoe
z=|e`|uBH<&j`!?0zy2?5eabDaGaK)y&fUhJ5@uhzeOCI9V*%gSy-)dlH+sTi#)FCm
z+gRk?d6Rg$S>In>wZbxG%`_`7MNM(j-Io4OyVY;m%=!7DxVUqX%st;k9*YT?MiUG}
z<oJKtS)KdAbof%{{&^<)4V%}Sb}cv{T=4S$%9r==@z3VC)yJ`P!DI<R2H!aX?#lg+
zoGLnXQ*-A>y#DF9dgC*pLy@aWlI7ZGG@lYOohY&7@RtK~jl#c*u6Q(c!MZ+!R}3q%
zPJ8&R^7=UE$(3Uw%lSm#<U9*enHO+5XY-5fmc1ey6Qv?H%Q64aT+h3Cp=n(~=Dic$
zOE}rS%1_gLnRn4z`*Z2Wi`qhyug$T1wzTcpPQLSUuO}7PZr&|xzxZ{_`n$K*t+(n3
zGb$((F%hWD_V_0&f3T>1wS?=<=C94uC#8qJop;Brf902rvyPsvm=jrUzAMA^=D&-(
zCNxx>nUlTl%bOKd^|P}Wzge)dBzqlSbzL&9D}{GMmv-aHIYFm>m!!VgcsnlMw1IK2
zoR8J(8{Cz(<%M@cmaaV28DW-ie&bQ6%njMQ)+`sU&uQ#$ncLB$xJbD>cJu5-S$nMu
zW++|m>c3fRzM^5zqSwy%bNs4LMlAdP=Bm~1+a2XHimET$)pHNDy|lbI&o-onlP~p+
zlkTsm0HZ710o_ZheSd99UG`Y{T+6AhWnF=x=1UTLj7+X{{t4e>Uc_A0|2pEksI={$
zH)iI$q^x(CSVv1Q_!T8xx_RcFwKugA<Lf16HwT9X+i&GD&i?E!8mt$wn&-G_q-(|V
zbH|JHb}tOv`@lWsL*lcE!S}eoiJn~fZoNVNnrJoAX|E=RcInLudB3`-;Ra*u+M-{p
zJl*|PNc|}@aS;E}czs)K=&2vq58E#6ezxpPhWyj}3;p!2Jx%|9p38rl+uE!@!Pl=`
z%gPM1-F=`@d!E<tr*EWO3Z&FIM8r}I!lp~_e7CFG-k;&=SI%pZJt_BQShkthoZOIl
zA$8jV(+kR99?Iy3iTXN}YhF`2Dx6caw>i@Khu`L{=ABQoPlg_EGi6$4rdqyd>TJF;
z&IjUOi)8mr=q}p5_Pdd&PKb@dt7*qpi5}Q?OmM*+)kz1gFS5<I`agqZM$l*bZK6*v
z@``6y?7n+uy>(!G^gheEEyat>lZ?V&1X-}CZF%5vJ8x0^;mra8ev%gdIS+SNsvFy%
z>^`b+@q@hemLJ#M-ZMP>8CTR)t-e_0bJVW=_oQd3m@W5xyDWWGw_e#jwk1tRX1mOr
zC%xuVR=3Y<%Lq-`%4IBXukZYQX4T9OQVR0&39FV^9>21<dHIeqg^<&`7+Ih0(Dc`T
zo9^npqdL0oh-rjg#`=IX+pDT3Py9bf+>}}nf4W3eVOyp;-!GG}8&{cbAA3?L;(uYw
ziT|cHr<(ibZC|v*sw?@$+!(Hyq+JW-Ew*i5!nu*V>*C!LQ+k}@7CTrb=Jz=5x|=Y~
zI^@-Y{1s~-i>WNtJ@8r1T;Z1Y#jxuywgfDH#t<bVs=a|Tc+<`2_x#Ul*Q%VJxBrD{
z$H9{q&oR#y_pyFpa$)t#eu<_Z*Sc(6{-1CNP}*B{`ATZ5e%(QCwM`duIvU$tnvb?L
z$hbefv8Yw;r*`yDxm{Azmor*_pBCDy`B^C_=#+oP<Nr*khfl2H`8Cazk%8eb69a=3
z>fsZK#U=Xj@tJv<CGqik1(l_N2eS@22<&|y&QtLr=}1-fLiW{bmqbjJ@?JP)gYU64
z#hH<1;RpA>S39Pr`BF~o+u7OQ)9&#lY>(Z;u02&DlIM`f$(7Ac#q7qqlX;q7Rw%I<
zq}Q6gvMx55d*_bR6vaIYQkz8lXKdE1k++!A`r(O2u-K%SsCr||l_#1$%f???#lq+A
zH79A(&Z2aMBO<{CJkLB7Uh;IwNabF*AJ^T>emmkp=qk2z$DNLBJoDM2t@?++gYyMx
zcjst^E<L<zPOil--IiW2=~$hK7d(#3PC2EKqIo&I?q2S-=-}R~PWPvT#@>_fn}1-#
z)d<!L#^(;(#ppiD__nL2=h5=NRdTJfzn%-XZ?%xnOSt336teK9#f!XaAEcIRf42WE
z_(l49)bi6&y8Ejx?pk-#D%ZmC|3lv8zj>8kxYbsEZ>hPuhvoXE)r;3iMStv;M-BY@
zKQ=EpD9yl7)WyIciy8Qtc_pbu1x2aQ_3*ZTC*R&ywEy?|1J(2Tmbj(Wob##Q@iO(*
zdXstkEav@~v~BU7fGHfFX9AZT>bG89_wWAh-3%T4O(Ol9jAwq!6q?V%)P3|_(#8m#
zY5g~Um#_c#`sDpdrsuu>J@GxWS?i|Co*gOY`7c%-pKrrG&#vlB+_U!Ni8<w>)!)86
ziofx-Z?k;G%ygY+<u+&et22&k$-R|#eEK>zXj7@w)DQXdLIWpFUDG7CdWFxmoZ$4=
zS|>Ma_^whuZP8zOX4M?g(qoI>oS3xc(b0tuKIk7f#jRm-dLDyF)`aB;7yC|pA1RUd
zYL#Av#HN(`6Wv@<DV3s$>Q5KDZ_?4fy8Y9QnzeoHDz`VSNV(2*&B{O6@5NNEh%@Ga
zbHfTZt#g@cu}Vow_Ihc^M5Z|m%Q})YXUQzeny#iD`d9W(jmkWhMy)&YixxdOI_K@g
z4FS^omj1l9_Soj#OHLT8R4^Y>;16;Sooko$LD6pSMbo;Nzii5LE*mfY!D<rHT7F>m
zkIIc}H%<?lvQML;<hStuz0a2B{1K{{onpG3D_%8qi&vt=7w=1YIt=Y!`r5bu(U4O~
zmFS+eQR9c@?z5kMznQMFcBfY3HP2&@;}<C%oTWSEsz+LE3rCra?T1B)m(_Y#b*1ln
zWp?&nIO~a{-z%k7Pu#<h_DRFITVS%T{+UJ3T?J*&HiavgzS`~<yy@1v;ETU=<%(H#
zSC&=Bsb+8HsWPaWmb&Teo3s<2e_wz77a+-d@5ry;{CjRaJ@$V4PR6IPQPb^ST;FqI
z(V>PP|8~SbT^Xpj|LM#hzvj+)^+>VD{^o|)4}R^xzn3q*?*Ff+^?NFRzn>lwc;Ts@
z=47q>6QB01sS{Lnla)WuGx5cW%yV7ezrKo{IQfZz(^EaIC*}e*+)dN{UA~=Bm_36#
z!d&xeMCi|QOP|?a-=#`jRSWJAmd@Ao_{+Zg#qmS`YI!HWRpmKx{m*mx1h;9scrxVT
zHft~W_3=QWny>o9uPNU&{v6f(!^$Opuq8Rs^Us_nz8xv4p=WMP&gYfmu44>*tz_J_
z{K(grDMsl({s(`(FY^D)GoA%!({`BYG)B6{$+b-StLOPsXbR)2`WVGG%h}?mzo`=s
z&3S2d;!~3R(kts$O4<A}U)z7w=*p`Qp2cgz3xh5gJl$|)hP>ue*1IhiSMdba`+LvJ
zd$#7pXRRe+D~@(r{dl@5v2n@SkkFKP;~dG3b650VWQlofwV3;o?{I<m)ZGS4?r~Uk
z6mnZ!n;A4!fhV&gk>mcR4F1&*?!3ugxBK&j|DyH<0y}bQYXrpqoIUoz$$8eV>nmqU
zSoggVV)^!*M@qNBwK)6ej)`x6@Ac!7d)=jd;nu!c<r_2(6vuwF`Vk!z#_{7=xcm#*
zyhSFluCH%<w*{<}STox~a9dB{tcNBWOX6pL(0`@UyMA%f>DBCk`xf7oxFo%x?Lyqy
ziMA_@Bc_%*3cY@x;9t0VSIptVDwk8=ZHZP?d-zJitN7po)fs)F7i24MO?g^cx?;7^
z%<Bfe2hP4uI_tb-f8DAu=fKwb6<r#48rT}7UJ2Un+{+#mU>vi#wPWSehs!3fw@5uW
ztua(cq*mrr#p&g#8?QB8)j75;<l>oQf|0*UxK7LRSwss@*?ILQ&zV~@919!7OwN9N
zz}Lu_lu(fN=5fohRxOE&u8PSwO@5j<Yu{pBD_(zr+sP)baYxRjKmV>4@6>TVDqxbZ
zRrE@o>J8^FmWFl<Vn58AzotxCgIhMi{=(hqua95Y;5jX1SzGPw^qAEV3vIrhNL*;L
zjp4$oSvO00-_(}Q?pqwe$)T&_6y@)AYEGz$dwXZd{{XQ?=Vvnn%;ef|H#xF{Ytg0*
z4ffA7{<?gMGMX{VMAvJIeTa*K)dz8t(2xSRW&B+WHY`_K)nz)JLtbPG!#A~L%PqP$
zYU7SPontHhb(&zNg~95C&)XDVB+WYTj-P`&*fJ_y^NqOqmcNq@tWam1zfeaxZGj5o
zjX8~%9$sNt?!2r{(<JUtAMdtRJdq(n|BAxcdD&+(YKnO^$|^M`SQf;T?YNL~WNo7E
z*{kt_U%GzrUE82LKTC|sankN}?cc30@NMd1^X%%q&o9e*sO@V~+E#zFvp3ch{mE&#
zrVw(XH2yjpmt!r1-K4TbVL!y9wjM2tzMC+8$=6$}%F`YnyR5fH<&WJOq4h=ce`-HY
z*WG?(`LPZWLygPxmLL6fOwRpq6)V$%o2F9F4hvt8%Zd7}W+1hF=?n`GVH3@aXZ8t6
z2c+cN8M=9%2A%Iazvk|fN%#I(F8pjdzixeH?~=%lt^OCjFRRqiVCc`EbJOW<PTBfw
z1D*|xSC$_?sA#`Moh2kWJUpvJw{n48^NWUS??vjjFzjezXRvL0E^5&zHp7ZTCe>Hz
zkLco)#;-+fUmO>()wFL}XC#~upEsi`_;|a@#GJKTvJP?=#=C60f5(L7<#ES1r}fv`
z?$YBgO`Uf)cGkKL54Qf}+wJ?%OyTaI$Bq&&yt1~0H*S&Co52=)`WJ)qELN$~-Yti&
zyPS0GHz>Xq(#regS`91P>-VZJjgGWjnX1{wqR`A+KPgvwvRK#_>FB7HQU!WFQvJTC
zCkctIon>|XtKw5`<_CYS@a$2nn)%F^D|hb3MSK@5GJ^MT3*J6lvZ(#|mJ5$p$sM~W
z_EK!&Kf868Q*_14H}GzAExEy|yyT;uyHmB~1dqFlN2iANm>mn^t?i65IMot)DNy;Q
zMTckg;*CbL^q#2oE?|B0wLOD>%l?#nvqM*<FZ?^skY;gq@~2A`3~IIl8JkXi=Ja`X
z^62J#wPV5m8rQ$>IwM?^>07XV!@M)M7{US#UoLu8%jDg3#NnbZ59@J-JMAC#XjD`l
zc$>ei^`qngwF}2tOue~&+kNxlz4tA38^eueE}n{#8449$%eh?l`Xwyymg-@@-QeST
zCDxU<tKhuzM&+oFroWEeux(%ad+y2d7hI`PC)!(I8@KdlD6nn0ekjs&3s;Wf_7|n8
zd9#<DD>*P%Dq+d?sa1Kg?B_QtpZa~=zmHRH;bWsV_4|(A_t+w|gdaS1$(na^X`R%u
z%8n-PlDXTbaX&U*>9D#dYsaITRonZ!ZU?S?+Gls?qXygLk2(^+HLO?L8hz4XNOH8`
zKT^nlsa#Ii^4E{!N=(JIlXG4-ojZMOvP<K`C$W;OO=~;^GH1N~J@HG#a?=;g3!6SG
zJ$(FxyZqH{lX%w+Ggby~C}vcgY|m_xnq6b(v9ajjJZD|jH^x0e*Nzz7>YKbk_q+v1
zkzJnJheZ-Mg~H|+%zf`DfAq0O#Iy}3rLKnDp1*jO`5pT{l?u^kDT)1A|DxxmB%QbD
zOT6_$e!2dOnEa5-yGtd*E|z_1@m!n}-8`dTy5dZtHruLiKJPf|H{P7&<tMP$(D?XC
zZML*Ej)7~sR!Fp$?d&dyuHow_zSZ@ZYvX45?IG7vr@lYm*zoIF&ojBru6en?XU|;D
z6_)(?U}o(@){U|}i_Ten+#o-9#&2JiQy#z9etB$A!8QN#&-{x!%Dx9qbX;1TcGs@|
z^+ad8<b@HAs+JGW8wMAgZ@v^Ie{P0(fUUH9gNE;-PkTDK&5n6&4L#6h9F}@`owV|s
zM*%wyAJdCkT{Y!Jt<huUS2^w<Lo!me{5M<eY?b|b$Kpim{7boO_QZxbzS$FPD0;(d
ztJyE%y{fYpcm03Bm-FLV6YEqHj`S5meHOmg{xP&}`EY(^^YhC8J53fQRK1LvF@yiC
z#blHIq)%CGPns9C?*Hr(V&%Fwcgu0+S|iWL!Fe?s#L`<QZ&=fmvG-Yf)~qu!R-KyP
zZf2(Nb7Wuk6ysXd!71{n<^KytRR^_solf7TYnL^$w?DeE($f2Qd-w7N<~A?OWZP+u
zk&Pcj4%SW#so6F2&zy@dW2YMT^{ra*=+bhVza0&BXD8HbtDkFo@W<-gPZ}n!+Mg!;
zJ%VHBpA!jFKLi|pHRWTq=`po`mlotDRBn4}ux8_FW-}YvH}cn??6UAOmvcXI^SFOS
z-KKkqcX+xlHMxJBxYpu)%jMa}-z{k3W!n(aHEZ)fN3T0aE{G`ZKAy(vq`9%A!qrUn
zlyO@q!_7}d2XZ|dq^GQ8N|<NPp&YPv25-8Jm8DBLPxR*gu<P@0y~%s#KIz~yv1M|{
za$8<&_&(J+8NPq!WS6jvLj~t%n)Q_(mgMsd@R-f;JYjFQkfEoDi{P{%zjVHdFGEhx
zvHZr_{Jdhdd*@b0CfS<H0xA3bv>&XLyrQiY&z^n3^>U}-T{S1aw9N-pwm4qixiui;
z*yk(FymP;lFGzM3`S18cCGu)(pXk{?><gWbTg(2CSa_vgz^vlYmDb+A$Nz**>`>&Y
z+gLu2>&}*{3~jcJHK!Dw9pLzpwZ6l%Z2J1t6i%~XDU;<64!?PvvSV(XD!$TodD+fm
zLQ$)p9<O$LoSiJ-{cz#oJF}vut(&>h?|{`>#)rqgTP%IHmi6wAiiE?NhVypleapC9
zmu9-nCE9uN2A&CwueW40u6TTLLaLit%Ka%zPVDg!vs%}DlD&r|_i%T?vdlQH4X<}y
z2$=27F1O&=EQZ{U2abnX`aeFOD7V7y^P{DGJbO>vRPTztm_P5Gz}YGJcNV|yn^p4q
zWP9A+;{nzBSyo*C8#5*@_-(cN$Xf31=f`|`=J$H*r3Rl&eRStyMyZhcEN9;-pAY=n
z5dCDeN&J1jHTw@H``uh%TXf}=-o)IQ?sxAf&)HsF)_&>ci)M!?&4fd54thwcE#AJ_
z@#?!8XO9nl?bgY&yXE)=1f`smN<KL}3cAl0q-%O}(@u_)VJkO?Y;`JluQhXibX|yb
zAJf{?(-&|C_UnnQsuiB%%Qjo^>&1PVX?00Aj;UwMsFpb%Hx29PZ)rWUMcO)#L6W&S
zuVI_@fq;y~Q)hB|yQpYn^tIaXEDPaY6?MAr*n-GrWxkM$OJy?`OmH?*Zquu~w{u~m
zu8)}i!{a<J`3hpH;~7qC+)0jYt!xyVa{fa9q)FTJ<owjnUlu7maw6fHLDSpUo0|Tr
zberwCZS!R5o|c8HS?<*q9q)_ZTyf2!A>^>%<28pX4cxW1haT9qQ$9_T@%OD8&ZY-9
zxc00nTbC3l_B;Ign$sbF4xQF|bGG(Jhj&4}jaB5ms9FyB%J5HTzQ(%PJQ2OOtMAf;
zJ*-Qw|4cp7y?EO0Hvw!(z2RBgN`G%ieL6{_{>jQco=%COnVX~Txw1;FeX9PgT=RWg
z&B}F~AMLi*k={7{!)sQv56Vw_joj~OEb~chxA*GTdKfC~b+6ah?AxxHAI^6M`pm7~
zIB)l+b*~o(N?k2k=#d@saOX_k1sgVV{U{V>th&2*e%5;5zYk+3u3l=k!D`x>hj$LT
zmZ%g*g+2UGXmch=#%@-0y3XO~d%a7WN(<kdKkAupzc=lo<zC)pGakx)yu7-;DC*y&
zdVy<~G_Kk0JwD^rGCkcV%ppr+j{O##r6u}t+r9M_AFl;T-)dZRTH|YLu*#h6WedGJ
z3X>Qmc6rR=WU8`#X;QMz>|*iUPY2KEy?^ul{$we&-@ez^2`*S-l$m05vq$X5lRKi0
z?{~PLTyU$LU%+|iOSx0eK3Zg6Kl6Okg=JAQ*7k_;?y|QMcFPs{$0EFY=Jm?sr|el4
zJBCerb+TkxZ6#aQ@mme2mWAiuNZ?ujbo%l;yH_v>SjVaTKV0p5E!bH1aciN8Qy$Ay
z2h9ar*z{k$ea$bC!w@phukKvghNr%jI(m}HhnhO`?{623R?pVIcF*tU-E~hh=VtEi
z_z)&*m9Sy$apfm5Z=w!-mo6<2$ndFj_KEvB*IM1Z?a`X9#mkuw`wDW;{Fu$7w0QRS
zlWp$lJbui^r6K-r?OTK%?fWV9nepLPm6K`Hp8Z^y;x9SRe`@3T_T3xzZl4{exglWU
z58JOUr+!>NqBl=v-`A^evOYd})K*)1RL|#qgYX8UD-kb5d(Mg8m)cQl81}>I=(_El
zLPhU&Ze6-~MkaCJt#Y}Klb0J>=|3$wED^-wv9&RIp^u$W=-q94H?6h^K6v)_O0t~u
zDObOZkq0tvJ516je#`&OYm3v@Wp@|zxKC<GdlUUDGicA_v?}pceTVXXT<;XVyWkqL
zpm^unrpbr1dLPBFzjb&=;m;P+JAn#}8cNx>zJAfX`$+moJpa>I))INg1^1l1!Tgiw
z&cDBN76i_^&fcu1dE#LnU+lKsFVxfbe_DO9e!<*c--iF`{Ohyb9kVPxg%xVEPFLUB
zVz_&5@QlfgE^l|pcXliaSY0ovsg}I^mUPVZI!TH3OMVrL%~PDMYZPaodOO?ZrqRlk
zW>&oV)}eDBteM0=_u$(9McdQ8Zs?^27uL_2(AZkpR#q9=YNRakPb{#|t+Ast&&$r%
z;M~)YC=U61CfReH(j~KAC(YdNa$$Y-uC3c2>fSxNZ|^2inbce(@t5A8Kk}w^28jQ$
z{&v6YNB6Ha7goKpU~4F|(_LOTae9w?t88iKLyw!Al{dPtdD`6e?$+EX`<Xwl4)SO9
zS3WaON$Bt1;G6#f1h}RiSIB6xeLm%5{;cUY%4+4K#mwqB*6qnQy!+>?veVy^pBs6F
z{1rFd`JFL$`3IMn<NcR@zv!5Le{oU!VbSmn6+Bt`2am7_28Rb~L`I*PCNDbEPB*lU
z({tkfTPy6+{&#Nw_}b*ypO75>Zw56xor9b_#g-lyy7gSTO-#Wc<1qIgty#H|Yct*)
z2wpLzc-tyNVZGEstxuvNa-5TY?^#inQuq0++mqM5AD1(8oc9U-r?|3@v3maF*nbgE
zgfxU}0>XS^WG77W?5r_nZ_~^;D0%4Lj3BwySB~bq<jsuUq_yj)h-Ff~=HxKf28}ky
zbfF2K{&WRCE)_dfr(?C`;lg=K7k28fem^o-bot#$C#LqS<X73Ds{8uWC7raT3CH)O
zu`l=&B-X|IT<EHdjn;~o)VUE|3Mme*O^0>PEMi(*ZFHL9b4Y>`m#TZajEQpG`Xuk!
z6)KrpuHg$#wh6KRuRmP(D6q40>ihEJY)La0XIJP4YjU5MzDc)EkLjC}TCu||jx$_-
z(V0G3?Pn`CHm1&f(aHEc<;vm~g{h5kD{l2S&2xXLBeG%s%?(eJ8YFGZRGx_*X1RWr
ze`iNyO!3S^ha0xWaIKPbRbdG?IW$AQ$(PUAt!u`LgpbGDQvWFN7HBxcZ&s~pnARc6
zlq;}kqW;N;&itAeJvuqdeHO?nNk5O7&~qv2&U=feHW!6f{?hS@*rfkv`i0<9*+z~Y
zv->P>suw)woVD`r5B9Q?V&cW$-W;pQ5ct|0e8<&m!x5Dee!u$E&aeix>dx2geR<hn
z&3vUz-=qyA4P85DaHuTFEINJlNuI&f$8j+>zti4zUGZIAc72A<6&4-ogR__Vy?WZ3
z=&o?8^{&~;9vSu8*)4JJH-DEnR{m_!`2s7O3%5)yFBoUGT-dh8_ThTXP>y#OxVh7M
z&oxhDSA5+&M_r(M-h|iuNyq;=?wptB_vMl>&xZ@^<^-P)ww-Txboqg)ax8i2(`zq2
zzf@WH>cs!coHlzOiWz;`c2g=sy3Tm2;>UzG>jrM_h7Xykf1FK^rsfGuc~`NWk7<VA
zs=mz%%8q+v10V22u&p!C%h&GPoBmu++sR+zskYh2yW1O5-ag#CGX0CtwU-$)=55Zl
z+5Kw&qXqpta-Lo2Hu2kD!ngO<7v~E>;yc#qWm$iz6YYJXy={S8EzjhDy|!E_ZKXR7
zoHD<l%4lQh#JytjnIDeKZ!ezq+WnkeFG%s>mLuMeh1aWZYgN80_v%5@^R$VL61$by
zcKnPw+rM%ZM_ReZB*uzD@4%h0e|If^Uc3178gsFStMoKqItH9$nt#PI!s}-a_vr~%
zCYx>7=)RuXzEy3DI)B5q^_PV&{QJpx;n9=41veh{?&DjT9slj~!mnSi%a)XyE_%^l
zWA*RfAH9gh_OFB1GN^~d1blFoVq9`^{r*MQKfLZdF8W%z%C4krp6{~yq7_#*Cf%A=
z5Weqk<?mLJ&+EP`ojEES_fd`c$ky9uWHW+Gj~+b1FrAS*_%#=osrv?JsoMt)bNf7B
z{LPxbpoVR$e)b7Fah9?bg|A%R|F>M*Y+v*?CfS1Z?3vZ8g>MOHeO>9y`%-_o!rxSl
zB`Vg8p1SMQ6%SUG3(cs}JS?!b&}tUP;TE=zmgmdnrSxA^5Bp_fqrPU+q*(F1Njc0%
zH0RiEXO;ahg{{=&Py2DlldIMK*Dv3!dF;YrXO{?9=6}r<7AYnca!z~Cao8jm-*sm7
zw`spSo2O2~$mx8now&f7gAN;fXSwSxKEm+jNQ;SD-e-TyGXErgW`<Y)9v-gq&`4Py
z`?b<p@hjtwr=LsTS@Q0$cxRIH>ifOuk{hpV=S~-0`#a=sp&{D~#-FdNtp(WmcrVT>
zl)1D^q(SFZWnLHW@&(I3YG^IneX074-B+HF?WcbHmEHIJ%=<6fZBuVGm0kI;?#<km
zMg8w~tlqYJedfaT%Vu}@%;tS8`m^ZSk{Rnc_&;jsue+knuO9E4R^(mvRds29z`r?@
zt}}dWpLQ`Lb-nYe*Bf7_^|ovms;he$lPf#<;3xOlkJ?s6s@HS=c^PZ9ZuacQNlLD=
z^BA|SU*Nw+PjkWY+7phRkLUHih}?H#L(aXz(7Vs?Wxr#S@@=^`)$3WBjn`|ng?+t`
z9xcjVrB$)_b7{h%re&+@wlltyv{@a)f7{gQMaCs9MvvBsv$iGWWW{$1&$|3xeQKbq
zv7|_u>eKyeRo1B)FE97WkWky=xVkG-$baRPxew%wI;+mzxm9;^=hHa{?Q)8~cHH2&
z`7+XH))xi-NKQ8Io;P>)vurzjx=KWKX46bp<-;voZe~4K`?r6I$=ivwYFjG}SG}M1
z=*ac=J>hejU0=;n$ekqb%z5EdznR^#sjK@$Hukz}KKtE%u~#q7;msbGZmI3}YqR#-
zu6?b#%S}a1N$Eb9*jlgOQ<q)&5Mr@i^vBJ2tMup1j=OkG@_eqG%7g5Dej}0K`8p;d
zMnUye_qboY++w;SPbA>-<KI)yh`X4}^1sZ!5hk+AYC)SzUv_TD-ILq-B{lmUE~MU@
zl^M_CKC@Gx(<qoxDE0Tz0&ZuIGZXkPZv1#HR6DqDLdqX0v5R{@ilu!OD*G69{eCvz
zlS@l~2>E{PnjSSlU!+R#>h!9_Nvf~C+_PrcrrEn}pHa4b!FA`vltn!2do4Al^W1L;
zef#3WrZ*AyL>}E!_M4gQdG%%V2A8v~tEv|NR9kuU@rC_L9lM2&&8QRFIYXmQF#euv
z=A@#D^`6e5*U$OgUE%RX=#8lFtJf{gR+;ltE>}CHMn7I!-rPSm_4Z};(^3apf4#Gh
z-}bU6{CUXVdz?I9X5Ly}bcz4jJ--ZXk%whpI19NCniX|FN!wsnF*`iJL}1N#x6Zqb
z=C2bXABK9WzfFkT+v4<`Y00UnC;z=O2rawz<kA)WH9LdM3!dc9mtShGzjU(9%9G63
zt0wQPotY{=)!;*t*ZNO$9^6pRbGZCr$+RCY4Fz9b6WF(VGi&_OViVapUS^lmJFIF2
z{u#Km?4J>_)3boR#ZKUl_d32mPPLcBV>|ntK6)3gGRf4xEvET#Hv9W+qO5A$FK69*
z_R{&-d*%$mBbH2uv(6UoIRE_C<>~2{7X(*VR_H#JS9d+1wBTCx%&hzK?a$oQy2O3k
z>hs@Q@B6;TU2^8tv)=MB_1!-P?ebMQ{uks`*RPF{ZE*e1jXL)yw``u!TLA_JWj6)}
zd8~7PMft@AsmUdo`FWt@|7EiCA0PX;yZ)%!_ePOb%I})QG<vj-+Sc?=u2%fERF|bO
zE?B$U&{fMjsH<p){FVI|<FC!EeP5($Jw0Z^6_1=wYh!C;YwPu~_n3=5e*3v!Zl4Z!
z*!DLMe@?m@yHiWjUe$lwmWa*m@hSa&aud?eemih_cB%WmiZ4IbKPftULi?JTY2+r^
z)wABReegK`;#l+F_w@{ay6x>-;_DTkmmb%Wcyhb#^17T?!VP<4rt4~I-8%Gs*}II$
z?Ms*+UEiY1z3J6!CdJIqGWH<jZ7JTDOk2L2F8ta!#bHvuW%GT9)ek>hsQo6ef}>@b
zm1X3|H0Mt>SIceFEB#LKez?f!cDJNy?l%|PtTW5sZP0x!?G#<Kk|SlNo6fAW+tx_r
zFK@ZJdy={7s{}8z71LJjnKvm-`=r*9*ZbB?lluL}J?x9@-gP&o)cF3K60=4#{q*#w
zrpx~<*uO7pnypieLVK&!l`lNZvz`g1=<SNJKOfF}eM4VRfV$M<J@*>3ru+Z!?LX73
zA^!Jk^t~GXl4Va~YopD7|FVwy>LYyVQYP2>18%2g*+!cuI7)eNu1mbvvHrfn;h$;V
zm8W;e)pN=0&6}q1T=?8e$2yzU5}Q~)oqGS=`{(yoBhH_17d_tK@FVhK8Ozlt^S9jH
zS!?BL{ls^7YSWqEm?_?;@*~81Y|^8{4wq^0sjENjib<RPzpi?k{qI+AZkj(||G%)x
z>4EyTO?<B6X(_BM7iFLFy;zrXdR^ho|9*Csg3`~<el}me<jskFFB30iyJcOl$>Z9P
zylI*B$I6@et2Zr>t!d;f`}F1R&(qI;KAoKZzp!lP{)+FvZa)1v`?`3F+q0y5Et1(j
z%T#{OEBX`cS$w#E?S^ADKT?!=OlEo+tu+W1f3xf5wO7?AZ#_vVEK)Mxz5Lbsh^?&s
z${jWevx}Ic<;#p-1W0hL)SMw(p{%AbEr<2@jy0$C&R?Dux>{4SA#C>g1F!rO7cSX*
zG3#Dgjp4+UkL-!Y++B}u=W{c4zu{?$c52<1m*p10>T^ciZlP4lT|?uSr#HPl(&Ayp
zplh~b_pGN`$qIiyZ+h`8E#0TnsrLUt_q(UgzEEHjw$w_rmuPLcb+Og_dWVf7|9+M0
z4_MY}9pI~uYc9F_Gflf(D%$P(v71&a_fJ-<I(RPp$%QY6G~+q{Gps59E7oJTTj<=M
zQwMidX{g`4{A!!(S-x+YO*T7soN+r@xb3;>jZF$3ub0-vNx3b(9x5$(a9P)k8TX$5
z&g1)cvq0kJ^t-!WDmn>xmPHoDaMoQ&SU*dw>8MwN_=BbkX}8v`jL<FLwE3xVdflYn
z85<*IKVLSp)sHwgdzrN>cW2|5>j!S!cwwrWcd)ycS3CT2)o!<$Grn4Lo0#6=5ae<%
zyJsQvVa=OgS2!&g^7k+CG_vfPnZ1%xcVqu;l_u7YHy@wtynb`$-!+zHF>QS*n`a#M
zTKi$LaQZr#0}uJ1DJvT<J$J}&>9j8)(}He4mYIA;s<T_=dhM%>6sZjNC#pZM=zQ|2
zpD{<Ku=86t{}LTeg)7Tf%s(}K%i?2u7hXL0T>Y!!vs+ez%4_|lyH6YT@49kOa*@}Z
z2HyLIHD~j9Z-2XTT5}37i`F5REoXn}b{xO-eO{|-3Fp1J*UWAAHVTwy2^Qra*?#(n
zN5O}HH;)<aabDEhQ!8^IS)iQpVKu|T!&|tQ&SRb66)m^K%u3$KLnMa9TI6`(N*5N_
zzLto(bq^QLT*#n)!YxL|HpS4+Cnu*=HB2xps?Rs}V8~k4S8MVNRkv5$KFZ;=)lo8@
zHT$c@gjOEiE5gl}g)U7rDD|Jr%_e$flE{`-2CP@!_zArZQg~zNp?Q%1%7P`k5;AQ)
zR;fR>X8p$YuduQ;Vfvy5;ZNqDe$>@CU1FTK@@4+D6(&EgBwHx2UwA2-^KFAot3)?r
zSZ`O1fwzpf+9Qn>qG9Xb2JO^2^qk`<-(#t^Wv%BmPZ$PtYPzZ|Z*DkL+rOxO!96AG
zj$clml3A+8OnjXyIt@>jsNLUb>YI{vxXJH9mRRdU$-9fxJ<D(Mz21H@fWx!#{>sk9
ze>Aj;6*tW|dA<Ae^6e?C=?}b1-FQB7h1pGe>bEz?@#t@twQscrgetf{zc|1bc{^NI
zs8-eXDaSPVMIYG3w;W`>+QWO~{SU=`ZZCBwO<l!)$oHC)BU|KIo>hyEA3mC3FP3v#
zFfeO=;k^$Qp*xqB@XqVxJ2TUP_1mRTB~_*Ov(Nuv-}Ev%R3PXiM^46y<qod{%;Y$J
zFI+CFvgWDpTvfx*4r?Q27di-EnW!Kdo!priE-9{i{4JNq4#{WzV*hUNRf`)xRW$DS
zlG)UsV5cKn&C#r_F>4xM@xDqarNr$D8-mM?K3jf%D)G*x-74a^;3U4~`)VY92|BpV
z>?)I8T|6bU;>^#-ms_Xutm3>Sn*H$AlO)fzr?&2z#M)nYY--N+rIS}{Z;Ic1OEK7-
zVePTR5Nn0N*$!DPd-tl&+M?03uID^!0FO+hLgNx<qX_=jdef!+Q~0cBCY-WnukF|u
zxT!-(cxP(0xF_dRVY!nJ4W1s^%dHt2{h>(vRM8e|jt|G!4ldY|J69+@vzKGJ+~hI`
z!y>7P51l8dJPUQ6erhpi#}&@tQwLZQZa%xVa;b3OCAGRw^Bzd8ymN5#o-*#mS>Y!?
zR(9;Ncyx*Pmuy|_3{452oyAYqNj%{ESyNZQ{$t1YKre;T9S@4vKa1vJ-ekOHM#ili
z@7<-}YJ;z>d~#WPMcW*IC)X^YRPM!@2CgpM5)NL14!3x8|JFrZJX!OuRw_8iukQ)h
zrlhQxuU4&Q3);RWFh`odun;a?uJyfSiQnC<3tA_{PQB0fSLAj&nZMjfR!AaGbxp(O
zP06#x-o!uOqt}zj)DXQQN>Zxhymyr~=k^5$vm(<i<if5cZLhi-nPqGC<hjh-+u6D4
z@q2gf_>(H)B799#>yPNf(AHaOdC@9C%0I$pU4Ctrb#I;3!R^mZ-MKhRt^CIB3Ofa>
z8P^PQ4A~_G6Q(BqKa#7(wdz6s<dxSm3TE%xyukP2vlipW=WD*D3I23(PZ4`{?B#?G
z#oKC}M^9*65p17-VLg9a&2yDQ{8g$)@18GCt7pnLQ^>kI+e_^7M4JMyeQ#f{yK}<D
z$S3B&M)uOR`A7GcmA;l!iVRbUn<0I2xt8n(t7j8dP1~@(IVRBF?@5_;*wd^Fnw}f^
z^JeAVv~H+jZ1p&QQ+lb*^oN{pCbPuee73<>CGSR;ko;0BPHiFO3I96o^<Isbs}rn$
z-}i~-;S4*4cIK-ZG8%6bkMd{jpYhu1jONBB7n$iDSBvxtWs1&ND>a-~eI@Ykytxo}
z>r8jGPRqMT4L00$XGu4^KFMY2BfY{`6;ED-Jt)!NTXp8&*BXm&>)NKy^Zs3w9#L^-
z&MzgmJ-h91e(>NdjhwmT)m729>nAs|xr?sOICExKVZhI{!>br4F6La~?`^JFqsZWL
z;$p!H&tOrjh3DqXT>O^j_@_l$uWu*tHQET*Z(4OTdAW^9WJAZQb$pwco$KGN@i}tA
z?R2$D!@b&yM|K>0gAcZ+Gh5knI9<tzPB?P$cw{w0C+p3_dUrQUWm)k({ckFleDko;
zo=XkK54p_#b^mzKg%#63%czK@r3v?xuilU^C@Z^*EB>s&iC1+UUFlmFe6d)z|Js5(
zO^%Ne#5|X`7Daw2Oi}$Kkh%NQ{;HZ1sVT|N#h1G)-QM^wSLevAZ_TW~BR58b<{Y*V
z$@b_osaFc>V9^tO_3`m~$Ee^Fe=|Z8t2%te|K8;6k)La@;@p7@{j7Zw8V7Q3dRg3f
zzTrpX^i5Nqzj}OVsmp8UR{=?(J9c02HG23)^q0n8g=Luy5B~+-V*lD2oE*?`#=_`f
zYS@Ks-h0E|GCY-AdE-RY^&I})dO9+1)_FARWE@UA)U~Md+L<#_!fDIGFG!d0<~^(X
zc<{rSrBkFU)Mh<+<{0<zs>LVO$|uPRQy6$pd4Bf^p285s%6)vzQL)MWYukmk3l~++
z`W5(2vwchA5m(>NCE9sD3TK`so__Z3;hLf(qo0!dqn@g|%)hbF(vItJ@P^o_=3P%6
zK7P5dbz_HlcI8Ls^HtTH9;;)Q<ZARq?<}43jOotKz0LOgC!!^nyCjE&z0$3$`u6DT
z_H>t%T93_wSDQ^uPva5kDBt&>^6=@|LT>_e>R+!?4rGx{*A%;}&of0Kqgw5;!~C#y
zd@EgNNhfjd-#gReWy=09H(b_<y_<D<>C1EF{R>)Iwk+RXyDF>mdvV&M2S!DH&)<07
z)D_$n!ako-r|iStmN4@@I%~SrS6vh>J<^wX?^SkRbI7+awF@a`o3kZXcFRmV`}6(*
z$!t-Xi;ejkv=_7J@A_XRwA;<#)~at2txwFVOr%b1E;fIlUBzw9pH=onBKuAbYb(#J
z%VoNJkxwQrz1Q-|Z^no2#=vI+>A##(<PXQKSTCoz!lHL$oSE=B_nDh4qyz-s3oqQV
zO6a;)>*@V=4oSNf)n2`szU9_s=6SO_#6tM~C5HZ+QS+mKz2EC*-KqW3b5@_cWUn?+
zZH4OY>_gQPI_CFfzkhY+ftgrZ^4@Ocw-YzEwUtUel3FV4_;sq<a;@~)x#a=6*B(!J
z@G5cUR@twnJ3cJC)tI&Ay1PBcw(HwJ%uM9ZKXd3A=Nfa7{R!uH7M_|ht8jVBq-CuB
zveLnv+t*b+aW&e{!o?NlZ&RG=`%1Ow@wvZ}Vn@Df9$VhHX0pQq$Jp!7MB~mC%@J4e
z+BvaK$F%dw#4M(qnU6zrYo@VH7ZjZ?btN%oL1&u_-_MOU9XuOPFST~x$#dM=W0RBL
zm(2oUvbN7tZ7-kwwd<kup9%LqAMq|fb~drGMD<0!Yrg%Az@#%VIr%mveo<W?Di;X9
zygMV%clR;wcRQ=(y6%3tyX}2cxbv$(j+bmlXZ}9QUYvC1Os|mLlr1M`o;q;sQkDJs
z@b5CEUh92~rd?aT&|qtL`5imQ*AJC9mu+pBWjME$xBpE+q)Uq6T*K<=Dx4ZB_d5M<
z^n5h>eejNPZL>kA+UHL`Cv_)gE#9`$bLrmg`FCDb=C~Ce{UCn!#lB0${gNM>9;r_#
zD6l{MWzU<lm+tpJ{HxRXRy!=w`h1+g-{vkc34evTJ2QT}Pd#TI8gEq_`2ByN+53H;
z<)a*aK1$NK|6Xqbuj*wTK3DG6pYuN5->l$1?M3z}_T8_he-p6p47m|9$)@v*`Nj6i
zjl~~s{A_N{uKs;HZFW`2@paR!49a5+zCJJ9$Gd)a<pSgXTl@O?-{q~i%;KUZ=qJ8!
z{>MzCWe3+B+$}X<Et@Ny_x`sZxhZ?sPdF}f_9EwzZd-Z%?i+tL`X<XX)e8!*?Az}k
zwdB<k<2`foJzxF~YV#=Q=iPX8X{3%v@kNen;_0?Crd>-dKhbTfomXsA$`v1U@OsNx
zZmWX|@3X&8YS(zzrT2Y(TclX?b_w0>o|E<**dDlH$+3I8l|=4XPwqN*hgInRF~&dJ
znQ}gE(p<YZXY$`&I@emlboZ46l&P*gHGjs>bQYPe8=@i!73sTG73VHHcDY_dMkjlw
zwp&Gz(hSCDMm3&4<?2G$f73Zo((fuaA@rnU^wb^iE(_h9p>o)?>;4{bS&jE1FY>mz
zco*v5+jT%=q3Zt`+rHfUvUIWd0g?OLtGDaEk3S^$ZKXViQp!z(pIMgs%nlSDQvE4Y
zfAgok`~$Y$$g1marQKZ_WLg$hoP938@Py2RjGXyRle$;MZ;FZiabDHHipzlaYP6`e
zR#R?en6Yz&QM=W9`ybt_?k$xxyU-t7EEHw*_R)>i-mBiPIwP?+^`5Ea^zG`YkC|5T
zynlMYh3)pwcBV(K1x}f>7m7W4HGj#2?F(0R2z*LvvC-4t*tm;n`OTBtl@?_iJV@?g
zSCF6O%2D;n9(AN7P<{UaA!Y`KseD*hNf+c7mlPD`C#Mz{>lIX<4a?2GZ6NUPU3}pL
ze&3AbTXoS3n)PZUBcj=OlNXCDy!G5|wyvb79(VHpTJ_tN8<Tg(dTf8z-05H5Kd;(v
zS22H{{rp<lxK4(p2Op}qWV)&Z^gl3pdXT66_`ikMn>TtrkFq(ZBO@=jxA`T{L#f_L
z0*{1`Y58jK>3lk({QRYl1V>Wdi<L{BI!SF1`FNn0L*Z0PLhB?Ou`)g(!y^J~nC5yu
zDB^R9y0X%(N@&`pl$h<joT~f*8^trHG9(A48Ta-ydIT-iW%WqidHZlhYyW?ho((Ob
zRdb|%FWn$>z*X${>hkqpHhc~_;r@Va**tZn8NV*)&p&_j$K#(rE<brz^n~#*S5AH7
ztR*qhNpD4W3cql%axB)Gt`S&#YvKM|IROV+Bm%{pxK2mhPmtkF_#u}!<w(-qzjJQ(
z&%IH=)PB!M&%fuQ{k)^oEOU!nm?vl*x!5%6f1}H8MQ`RJ{=81EXQEt2YhzWrdt1)*
z@@2k!8#m1+Y{{z@zpc-Tw<jvkewr1%h&R%*#c{ICZ}ozZrN_T6{#YrHki~5|`%s(S
znq$9wShh|5lJv2+aG#rXaH96>tDmmzDXw!%wQ^V{w=X$izUr>SfAmh3U7YoB*J0_^
zXIbxRXDxa>BmL;tY`+EXzFI|cbbESB{ru&;rb#|}sb%N9lLdDZUq4a0zAx5aYg6YL
zt^<Evj7zib?zBI~_L*mOU~ZRgXyh@|!}~qv^2NrjzhhGA{P5k;KCgYVGShcUq&A+q
z<0F4Dp|tnwxd^GFCePkyuKDw8@9Cdvl}#*O%(C2nYmUw7-FQl|Fz(CE2YeB&57Jhi
zo@y;#G~fSm*NQt4YEGM;Px!sz`t8N)Pp{waku&KEQhFa=DzDE~^>o#x^>y3+?ERxE
zk^N(tgL~7-ZNayfmOg#5@l?6f**~ZD7U{OPWr~R!toiw7x8LU@rE&XR_iNtI_FcYZ
z+hG<h&mTf6^{XA9Z0oa@TCw9ZU-_1=$Gq~(x}NWHkWJjt*kGh1`nKWV{E(+xo8GMQ
zEenrw(RHo!ocu?eX`jpN&pRG_>4<H=eEjTovDSal-_XzAzdhejX*o9o!&(;x21(3e
z$AY3v(53@WMv}?Szhm}kcRlNQONZUhzbg67H@qM>$AqycW6py|a(ofeO>36!$=dQn
zPW5IX@Bi=TCR9xjS~<1s>6e%T(~eXYTNpnvsCBce{quDH@%_gXQ#EbtwlC4?UOb~K
zxM&;aAyL~p!}_`pJ$s(bt`@w%#^}?dpC`SGHZFQ%>uag(UF9vjFOpgAWX1+Nh6mlD
zb0!&Z2K_i2DRx9hRWc!lJyT|qMtY)Hv6xC>nZLwR?_DaA>PqP<3Ex%HBt@kiADUly
z#ANsCeqUpk%Y&1SDnDlZsGE|$bHP6UM_=2zc?2ZRGd-Cor!nK_9+~KTrio0cUw@kU
zJ?4oJX-?1lCjT|n?cOubp#9TRuB|8$ik~iViDUhz+2-+1yBz!2*^hQCcp6-`zw;(9
zXHZdL!!t|oAU`|fy5k>iD~fw-arATC4_LUw&SfkA`s8gcM|k%yepC=AWfpdfr&6z1
zNP*qY&TH$lFDYTR`&P*BUn#$Tt^EGg^844z*RPPTUn3uXtzZ2-|1=XN16jp0vfL}@
zFA(;Th`)6C(t*$62ENZfq<Zz$ANy%-tMEbCUBUi`vlzp?BQqv?c78HEd3m!*Z@$E?
z%R6Osj>p{BUy;zbWBQzBUF`oFRzGQ)DEzZg&1{=$E5DP{_Ja5?2W*qQtv{LDPKYnA
z={nf>#$?}H<%W*US7)Ua-dMos!C|?64%f2=n~H-)FVA*Ne|G&|GVdD0zw3T!NZ!s^
zvvbMDbHaZ%_vFhi+4p|J{#l=k@6EVy|K4#Of7#DJo%tv4(S6i?cZK~o!B;*V5AKP)
zo^EkQ#%b>x=TD+Xw51Ftzu3L>XWhK@>sK1=uRX=W!ua|2?5}FYyZ(HZGizGPqn+t`
z`3L{4FAvgP<W*Ncn0BgRbJGX^%RLf_nQrSo_b|*3V01k4M<Zp+wHF5uJ#AX%VQ#SF
zTu9Uf&Lo8+{f5aOnu40eq;wq>Z!k=)49?HCnB{F0%&FaEvGi?&?Z>+0)eXAB9$J%R
zTe4sI^7Dl-trnei<>rD7V!nqHod5D{@$x^}`eh>PfpZ?SI<-Fu|C_nK`Fx0zkKCTq
z-tVUz$p2xj+<xz&rsbY5eDaNwlMXL<_1m!9`2PGQCY@;stUf1}OV~HcuzYd2^P}gU
zs^Q|g8R<4%ryMz+{Y;Zgxx#<x%yfpH=7{SLDh&RZc?8u?oA^&gP1RrE=I1kvN5$E$
zG+W-7#>jA6-gk+?wvC?NG7@_PEKS>mS91EP@!02IINkbz`;2f;nb^}r!2><>i`}xB
z^DP*1Sokw%c`2X%(_)}^o5QNTz*6vDYE{WegC{5NOHDAVKbYoxbJGl40SyaR^%)cU
z?qod7)zJGJvG2vfy@~e546nIl8gD+_Uq8Xqm*d`+%z06w>^4*OCm&kkZ5sOBd_vL-
zJ28!^+D{smuH3KR=fAEYtZiimW7o=;JB+@%Z*zHBn{si{3>D5&7Zt%NezT7`owVa?
z`o_xn%c^W;?A!eT=NH<kv3JjBUOYL<DRSqps4z{Pdj`d}?}8Q^v`ufE5*KQAht1RP
z>aUMVbDp1aQ{D7QO`xZ+r)1fhm=}+ISBBo&%(bRXXOol8vVfOnMzbabAG^IWR97~`
z<mYRX+^Y-a?j;pZh!QTa>T1za7cF9p-T7;Y%!lovIt&M5)Rwa(Eq9sq+B5gol|6cH
zYi3<Py!&jz>Z;aKk)@MXq-IW;C%v^M*tuQHv|CnilS09Z%6p0|OlLp#cl^1rr2F;4
zZoZ(4JuCdzsoYfB(Js8NZLVp^sVkO}RtL5nl^5HPyzWzY6Wjc|6IaUIRl8-%)TbF9
zdMEnnDmUFC-o&h{sfpK_vzC|0wM0x<)suXDU)FQYrGY!mH)@6C#>{h=-@f-tWy#CW
z2W6w}cRb1pyyJ2+>{x2+qr#2Tqa`gq<(x^mTVnm}T-8&<LmF9*2fvtpHS#x<nRvqD
zg@m(rr{JTowOrp`z0D8kbF>sSUcVwPWbKbqolSi2)@yb|<jl{En$i4Ra^4EF?)x)u
zJ-x-I(wp=>ZT&=Uj`FBE6|A+o`j1xMJyxsXm)*5?#wvMdOQzL@L07MFntw15y;l3@
zO2em%p)m_C^-Fzt_2gEog1hv+Yx6uy8-faFXjay*W4-lm{VSQ??!VlZ{%!Jl>XSIt
zwBeD<%s=XXjq|pfB(8S0w=vZ5`~Bffzy99inWuTX4%<|Ro|&(~8`{VpwySogcX2*v
zlJ_sIhYNSd87jC1DIGe;JZrmD&YFEU_JwIPPq}?%n%(<^<o`$ap44)Wtvd4OSGknc
zqL0C$jujFgQ|BAKuss`gXKu>thZC3i*Lhd!Da<L6JTsy0-BfE{u{E#Xw)I@wJv}IR
zy6>061*=1QE`R#y?PA#{YyW@sitMt^H<c$CDz&EOGhe(Qaei@GkKfyUGeS3;-3Y((
zE~EVGy`meBT3289oUr`e+Z^s!oW`C@Dz=JjI_P9J=l{86GseXkW(RM?)vQ#i`8aQz
zUsX<tzign<;@9g`gO;-}zm*CO@1M%Lf7U7UVDBxdi%J?MKI3>bS>s=lnZTJRlJ4&g
zZ8gbsWZh$$CoefOC*zT%a-WONcDc98x_2r(nr~Z`$$mB6I(Ku~nVi&fU5Wc8uU*Oa
z$-7&#)o<;!*|oclmhZ`ysT42$@#IFO{gVWDpE--y9Bos(wUlkO)vu-P>(>M)Z~B)x
zUnfWHOYw=^kA7zI+oIq2+<9_0GoD%EWZI{cOUEa%2B>kSPTtfuaZZrU=e7Il_BkJT
zDPorBRb9USN>7fc<r1;wGyVK@yGo35U8a`BbZuSDkuTK6!p%M_avLjek#6d2*|k*{
zgzny2ePH2(4SW41&!@fJmE0W?t@7LFed_ZiLK`-0J+o(WTPDMf>2qZB`s{DC|Kz@M
z*R1rd+>f4^P5W<GKTut^*fVLds^-?Jm#-cj-QT?X)1%f(QU0_AQGbq=cCMXUvqDZP
zk$E1I#OK2Hr2OEVmsf&CF1XJ*W*K_%Z4_(f1kqf(3!&@6&)+OqFC5!^T6{ui@}&!l
zwDi_!U0HfOK=#)MxrNMk&&FqO&d(0y7pi%$mKVQq=?0}8pWFT4*uA}$Cs}P8VS3qp
z9`DxGJEN4{Z+O?Pc>YE(dbRE0R;PM{+#f3zem8uqvG&rvxTvo|?Q0kR-L-V@(%`pO
zbQfJMzyI&+%fmZA|GRyFBPMp@<nN7o&(hz>>7TT<nROtdeC6qMsdZwXw%S-8{$u^6
zPSAf^Rp;{f{NU?T*}O9E=m&}RZhp3QqXXCL3rr@vv{sr;{g%p@aXIFm{U4YA)02yn
zFK#(>wZK?GeaTPlKe1bMo0Rm{y%C+ecG3#b>pY$IvZ-;JY`@+*Eic;IA2@MQS_F?)
zoBPeb8PC4-CN7gbTdu_$H0$C1jvFhhG|xU(oYgLNNN!aZQ*pf9$DjL{U31%1CKad0
zGq&4YOnkbUS)}`^+S^~z>_N@$Uo*eVTEC@2x$l0!v)R$w)s|@uIddgL4a1@$vpCu<
z7EetV+q-5>+0Lux9S84;M#sBVPmisYd|M~#xk;0Gdi(9|Nzoe78kZU6Hobnj@T1C&
zr@Q)3%HDpjTJEjAuW7RGJE05LzP+DPyj|L+zI93Ros*SHJ6}&x_&?WmuF!|l6Dd6f
zkDsgzeKI@B{`0%z46fz7gD)y>+SPA$V)nPaG7G&IXGKKXg$O$D;}OjK{+oAMV#w`%
zB8zu?doZh_(s5za(dmjx?~AP$dS^UlYV!V~`*7zv=7o<|*KW&8=etmRUz$Cc<KB(}
z1C=#B1&s%;IEWU=X8UV@4GE83|LsU#R!?Q}gZ~b5Kjv|mgqg^_4A+*5kKy(xTj1sK
z^U}g?IiI|@ivQJTjp602um1Kx_oGE$ma~hWafa-xT`z4^xZYh(kTYKX_L8>Q&+xOC
zg4$jkK4*7D^JAUu!`js8?(a9d6<=pv^S{|}ZKL&yYxg$K&;Iy<*FX8||G5{0ye_U>
z`ypig`S%uov*xx$_8n^5CQ$2m`R((*AIvVlnYEQO)MJ9yHO*god_^<U;>eR{S+4r1
z_&<}gS@2@+w35*2-1oSjxc|<)dnmXhWyTecvY#jBqjr@)o9NrjU}a#qqJ_0}UzS;%
zS(0A_YTZXg=ifFHsr$ZO;g&eNN6)%^?F)>av+@pJ+v0FJb{>nHRoBjdC2m2vcjEUu
z$LgFE)4Uln;nl$nrSICGxPNMnpLBlyy}z~J*t;DwEOz@jNK7*d$Ujl(_t<pK-nhL{
zdsL<y-Pb7FZ}#Nt>iKnQ+p`tq9lRZdesIM+le{I!Y!bcT)7x2@LdB~-26H*jyl`Z}
zQQ50HYMF{jhnFmvGm}@4fm7v($09Dr6*mObcvi$P)-BRs`62cDUCAm<UX}PIUTG>_
zmkx<=E$Y~yGyT+p#tCh=B&s&9xIfeP+!5P_v+jhY@zh4D@7nn5+@}ujLjGF|LcQ|B
zxBsu%)umUzd)J@8zn)z;=Wg=P+!bYN7U?(jn2mVo*5|kWoHQ{G3cba-WQLsZ8JCMe
z%>Mo-Zt6dA<680L+sTUs8?XM$I;;H0jXO{2_Nq(orf|$WFk9{3E2ip#=6tnZyAN13
za%CI7SvQrxVvE@7#v^O`C*KXY-f8Tm%Eem{oKn7Ej$>3|#)9*14|@vPvW_ln)GO>Y
z2y8G830E|^(aQAe!90#$lO2__-}n`kf8O@!f<yh<LdEPBt@7W$v=%a+pSnmoea+f0
z4-9&z{oT6gRowav8RtB$J2%cglI`v_?sWTc#4;vzXJL7gHgE0^_wPynEABYGpL$Z!
z^siC%qoT{7w>^y6p}2mUZE@T5OV17$?EdE96aI9k^{N?>=?M{UBGY51rl0%nw(EM5
zF8ApV+D}<~cnX=sV~*uzyw8-G>(}+%u<iK9UBx~Pd9gRzD=+U6<Fwhu&(UkLCfeuT
zU+#_h9y58L_<muYv9)CV>oA#VtERPfDN6Z9T;Q>J6u6=;e*Vt6tfiudyf(dGe4*z2
z*0k@3;<WB?TnOfjjnC3~`cd^qr+Agqz28~(4)5Np%KdrtRdso5nf#J(TbdGBgtu4b
zA6)WpZ?pQ>==(`#6Ege%oNJmVKlReYL%X?*9o4=69=NH^xTEc((Y~4k-c4m<7rW+H
z8SnD5oy+5|Fij~@Y)uo}->z!5J%VkjR`ZVNK6n%M&bh?>-xpisRT8sOZRbw$o7MIF
z)xHml%iR-~iMnP_zkF@#*4l=%noK<RcUAldd*`FNNXP$IT|niH$+Z_c>+=_I8Ams#
z-9K2n>c(X*8+Oh{zu%dmHdlW)eV(>DYFqs4S@C-+0{1CQ`Fv@*-BG!tdpva7!(#7o
zigISIzb2J?Yt_L|r4tK8t!D0Pa$oaV!dz!<)rYmd8|>%o4toEg^+Vy)hSFab<yUy^
zT3hsi>CaK81IJ}VjtUkX{=M$n!JSidCvI&&+$Y>VrTC!Q)y?b6VjPvX@8<l<7sJ56
z(tLt})XH~$7k@C;h`y8G_WNq3t&gTbN4J!wzMcsGinF<POE)+?%S>3r?>`}cDKl%q
z%*q8Pzn=Ae?!zm6=G2?V>lUxx9H4)$^+HbS&ZZOl=f2I@!Ee`YV9~BK!=dVUKkMTy
z=U5D666$_+2==rcJTq}Wcd+DQ7q$<cGLv~7VwZoN^6#uu=+A14)<sq4#LgV6`+3`-
z(X#5-<p;tW)2#K{({Jrra{a`d)puO-0@lr37c6vIXR+8q>;E1RX3AkfDa+3;l@tAX
z&i1PJjGOG=CtEeSnWrtE@=P<-=CGXiJ5}Mngr`+S0-kp_HN4H>i#u<*=JV&u-Mk4e
zKW;tm!schgEPM7xZ_dw^$$PH^f6$QoFhP%PV#~i<Z)84%iqH7Tb7qnKf6cr9*E_s$
zn%bjvKV-g>P2a=b?in^q(l>9Ic5Yp0hV0G%b0=<pdjI^iSdsWI4Xo$IlaHwFD{I~p
zD9yesIft=7?WX7Rl!(i3W#!g3)R-CVHxrXC==pwlYe?M8b;tOm4ms-FX1uEY<n8Tm
zu}AlRQ!Kl=VT*cMy36dU^fyr^J#RH%?y_sx|MiUC?>85B+n23YpS$~6>Js-1ng5AZ
z4J+QA<hSwt&yQN1GcYhPFo6gL1_n9Q!J4GR<m}YE6n&%vI+z(yb!Qf*emND*z|hyh
zh)Xxr6!5_5-v4E{EhZWKs-M@Ce7{(uG{x#<O>z41&F|ipOgi_&$LeJ7+<Eg#f3MK&
z+%z*_$*d)BDr$<)eK)z^d{=$vS8fG{CXuI0%EQx_DF-Jk4A2naYW=lQe$Kwyf1eMo
zE}8cvw5VW{$0w`UWuBEHHnGP)uYU5t^UI5absyG5+@JRHX{fAC<(D5P8UH;0&v$O!
zqzA{BXnjhU7^5D!G49}L$GJyVv-3|&-N?1<^3!GarkpI1TC%z{@S5YC=dQBXGbe^$
zN{dU0G+M5{>f-F8iBnEKs<c|a^Q_Xk$CYB?p^I+6aG(4@#sBsEN0Vmjng86Q*X3h=
z=G57eKIVt_FI#D@z5hJCaMtJi*E{x|x-|3GQ{6v59kw<-T>aj2U*yX7@(EvFRR^xj
ze_is=(ECdK(tlyGsVA2|>-U|T_G<mFvboQuJI1i4zq%M2qiE%{TqCIBtXbx^0(rej
zrIQXnIeU3YQGN9Eqp6bXqt1t0l;3FnZKJJsb#vv$sO6DCW-b0%GuC-dIQsMHmRma0
zUoKzf&KhVcXUp;6Gc&^s7W+dgODaFTS;Y`H+u-q@A140SEWUsG{(ZLh<B1;*W(N6l
zoa^>KSrdGGvyP?jDU)-Tw4Sx;e|o(|rzmCrv(l>82$k4-e&z>MwqIU#W6Eciif2YE
zmuF>MP7OSz|3~OwMA+-h+EBHtp%Zo0_>X0^9KDqm`s?%ilW&{Z`7fmwh|T@``EB>h
z&HMLOeEUB6x_&>$oIRFPHK&>ThiS{5UcF`2{b{bT2fPe!AAhRavmxy5e9mqDr%#{C
zxi(AT>V=#sCM-c`d1lSjy(}YkVpof&p6Rl)i#-dbg@paqIcx9q{8jwdbDDaeeri``
zn3YSiL_R*A#Q3M-{=F&7OF2!9?iX<UQ}Pygx?@l3rT-%7(hv4O<6ZX2<Y!2;gYkWv
z-Lac}X0ojB{uTS_wi@fRN9N1@<M+;*x3BX5yPMsYHT@C`c#1oXi|fSpo@YE`X>7Q5
z?~9wuR&`&MJR`7S+4Gy6YmWH8YM<^oZ%W}@9f3PXk2bgIGhf}M*PV6N>4W8otrOi!
zYmS`#*vy?L9Ixi?7&`se%dYUN6D^k&XA~@q)?l*?Qr=V-dt5=XAWQrI`%OuI?BiA~
z^xb<_?!dl}UK`dm{nBEylzM(p>#xY2C0|27=xCgJaPx4xgT@4HSGlHuJ8LpGW$ZL!
zT>ZdoCF3QXna5{qF<N*A+-2fsn4)q(eM8+_@k?3`Rfp`%_+Keil>PYd@Zs#6?0?Le
zJp2=tBhPNSoxoYLQb7I26b3uSgJ<&@e_v5LA?zSDjq%Z+S6BV*+0@_v=w)9&Z(m)d
zRqeMgUvGZ-`+D-`dZz6?hg>Z<og9|xJ(k%YcRaG^|Fi=V4}TnNe*a~fsaKu#KgDya
zQvNjjd=Set#pdL6R&E}(XC)J-osGGC;*Gn)Cr;V+7l)!el|$WjB)jTAu<x25_ot@l
z+nck+DWBcHJb3dm`p3T+`}W&Z7gn*=+b-OHZ|`#Ze<$?o+%GgHuIp-5*tn$By!D*>
zXC9YqSMM1YWZ2p7vn}lOs#r3U{fMeLZ(o12!OtnziUnBQnEy0fxjDsBXS!C9#q0Z%
z&#(m^fBkNIV#8ehxN8lG-&eczpPQapWqsfE)yw;*EY=F8KbF=#?EBA9KkpO6Mu)h#
zgH}5q%h@SE)-dv)c<l1a6<(WE1I7O3Shd|tnC0+G_0EAs#x@6B6DM8lE;8mlSHa8R
z!uS8S&xv>86Q%x{cXsjLS#GhIzbgFPW}VK@n~fSn9rD{1oh$i@1il;)+OlxLjVrHx
zd4sfO++`~ky6osXDZJ%UXwBROa~L=`bba=n)0i<s`9Vu%jHg^cNuvAh8m_vtm;X4Q
z$*pTWexYt+ih}EEg~+vze7dvVDRb+eH(JM8UCsNw=ZDJrtOEkyJLfK8&3Uk3m1+H9
zwVc0wJlp4;yR=95)%WJj=I8Irux84w$xnRx{Gj~edgq(IK`~}`#Lu=x$3LtQpUtB&
zPlmH2{;FHog~a`xn?DN_teW)6ic?>WVb8uFr9yXNmVRFSz%7n1%ylNq$C`ZybK5*;
z8Zj=L9U4>Xk|L>-aN1#o;7iGs_abg5?`o6fk9+)4+B+vU<f}<*?SYt#_1!j^Kg8tS
z4>?F}xOM95lb8cpHv2ck@A7)oy7RKs+5P>ik9_Acc%pZ<^KVAn+w!;v#StR=$|qbe
zd%1X5?80r=rH*OZzn9uGYkL-7Pg=k_=hg37H#*+Sb(nMMe(t01YZqT@>D)B0+3Ly~
zt_iZ&v>xtXe#e7v-hqp2x|zI{>tjt`ztor^y6CF*osU;vYQ;TXv{3NRiTg7fP3xys
zNE{W7@qL{XrMCK!)xm285?1r?HZ9q?VL{MmwzFwRKb_YWcv<jZN$6Kbl>~uw^N+c$
z+B(;)Dgw^f9f;ca;8FLDwQ>n7qS}qloaO18E}zkxspOd~XY0c%IIlIfCbRMIM<?c(
zgf-&Fe_mNIr*3<CtKS>X!iMT=`Z-?5q<5I#+;9Dv$3i5u<x8)fNTwav`-mxZY)|`k
zOuF5d8`j!>Z#(Y+;lHPO!ldjLesnp~^ti6~V&t`+J!hG}iI{!9W|>=CY+T^(H1T4)
z_xH;y_rBYw_34OpgY3Kmw`G#HMTtd*-SP3|Tz*^0{+$!Qvy2>Pmqww~l)uW`Jhyzd
zdAs^CkCu+qafWk-o!64TP4fSov)SX@gzt@t%}ik|x1v%QbPKJDmQ~cGtZ~oQ%zC5#
zmeJQrttM&ho(1{8)EgJ{u~^(*v-!y!SEWk{LMHe1Z5(8y{C;s*-aKb8Pp)m#`5OUh
zX0MmX^eX$hFX{Ew<iD#X)~a^wLPiMNH(_y2cRx;BM#G=i*5^NtJa=nZzs(w*6&BvR
zZZ+Jx9(H7!SI+JJ%UM?JPuI>`q!lgwJL8k)%zINdq;GO{z8o%TsT|_sUGZs}yul6|
zPqC|4s<z*pxmq*Iag)x;p5>pfCUJ3JOaAHc>9umMbuW*#)C(rfSB5$BAHOZz)e|h7
zGk2X(M3LC5sO-I(r}`J|iIh=iUVnN<#DV6^QRl9^Upp9I=k-t_=>8(JfY%F`=AJs0
ztT5^0gtw>W$?392$(`x)+PizUm+tc;CuS&2@zpqftJ?S;^AyuRe%T81PjAcIW6im1
z2V>b)_72fm73m-UDEH)gJ>$Mr_q4Nv-OA-=_6(k?`;Y6T9TOvba(z#3nB7+O^zn_e
zZug6)KV<C}<WTgOP}q2GW?N}v?xItRJokGQe}9wnPi*fo`z6Z-c@H_wc4eA-?d-Yr
ztIy3_zgoRt&i>VlTfYpu%u5fJvt53jr4_T8TZrRLw!$ajzoq<I4_d?Rnf!kVR3s^W
zcv8plXQO<h{WrxA?%a*`_xKy_zbb!NZpZR3Me)P(--;ie*RlM&(|%ySF3Z0fdzOEf
z`VYka68O>GdLaH?>w(F2YBiURxA^O*)oijBt}DvfT=xG<w)^*I`4`Whf6zbI`n+R7
z8Mot)joxf#_O2Q=+e>xUZ&X^lz0>=~`_()p;#(7YUU)9v_pdxxM5_0HlGwr9mutF2
z4n}V(nq0AByZoGqf)l13tDJbf(5ubSqUA`a)${BsDap9o6GX+nS6{ev!-xCUjHE`c
z^*MDOlX%>wOqeT{tLX6aY*DA0=blv)oqeJnv;NB6$e63dIW1GR^Ojcg#M}Ij&92Pj
zaGoywxlQKb;rjajzuvFE|L5`7?F(1ljBuY{rzc_c_t?b*`yYn?W;|Hn(7Y-rK&SA7
zgHOV)vodW`I%cb{=05OSbwTbQd;4D2yM0Tai7L;`otR|!c+J|Y+n3oLv#;z`UXv#o
ze(D(Kt!FyF*Bn&nKiYWk*U3F)c4nSm7c386mj5Uw<@K=z%;$tJh>8avj#$mt@u6z!
zmBky`oww||c)qM%@MX`c#@}hlt?#S0W<GqsRc~3SW&8H87Z>>$g?x99K3LhesCIs?
za&dduIYCR)>cba|57hF$Idk#U)EjjLn^??#=Q6X)C47Eu!gr{0k6XR+MDK?#Hw4~S
zylijX#moO8Lwt>Js$MD|r<-Sq<jZ3v|E!<S*E@EW^_$MasZ)=t@D?_z&VO{(N_h4G
zyLFdKH{MHN-otxx;d-5;TX}ls9=s@7yVk)@wIp(``S%wFU0K5E8h6Ap6%RbIh-F<o
zBh1w6VkHkl-nvOL1_x)K`0&8teelB>`d;6j{tei+zVff8N;m(#aK;O-MOt;4CbpS#
z_As}y+<&k_SK`{qv|0^|MSmOwdnR?hJ2I_ebIDw>*<AT&TZ))2D1Ga@@%h{75<yPw
z3%Qp+sAROIpS-%6!&YP0x8R>!1#@aFf9Fkp%=y<fQtWAlq!!DSM3bYQZp&B>9o%!*
z^!nP1Q*?g^zdj`vIsIpPSNPXk$E-PDJ$u%5^oCfz&<%%uGg-_FXZnZFUgNjCX7$QU
z$KM67gDhfa9Z%8!vQhW;!`?9UEk~KYDaUpH+0fJ~@#mpMMa`9{doS$86h&r4D=5Y9
z<dSVj6P)yr|7m(j!DDW_h)Bx~sY>Bn>p2e9P29+HU--U)zV78st3E!}s9=j${!pSB
z^L2H}*Pnkb9$g=3u`OZM%LCTM)gc$6wyT7eNV8_v$r$mm#^-L$eWB;sKf#ju-^=%Y
z#nHxD7tgP`%`s^!+vG(xt}kAFtqYrXY_r$K%{R7{KYnR;xJ>Eh_WdmH48FYh`F>-)
zM1juDm~GdV@+|Q!c5hf9bn(I4ndaGV&ONy(UOe^F<P*))4o7@jZ*l)_ewD~3#>?v`
zY+2Y_J>%M?Kih?F9X9=c^oX0M-HZp%9_-VbZuR$9<<`KO2U{H3sxEnL6D&yD@wfGq
zvdI!#mJ{(Q(l-o#CLO!u-TLO%h3pFPT(7WP-d!Jc|D5<_vZ*n;<;<jtg(Z*ELTqzV
z_a&@4u`6(IRI>Ro(d@V>+Lt`nu5@$|mOQjWRX}uMhL2b;>pz!{WdELdxBg$Ne5t;3
z-d3~aSzpxmX}*nq+Z^Fo5S;svMRwa)7GBMssD1HwHy_IXsebhCf(x6a^Y;b_{(RKC
zDp>9<d;X^dS`ISn9Ur^%+g&INzxp-i+&!Ho0U{IkO;Ww}U?JZNwiQQp6Xu;`c8t!P
z_vCArkbRoyu1quS$DhnRvS)=^{gS@0!rbJ@gRf${w!YfHQJ3$uOIG8bxnWzL$dz1y
z_(eOHshKEO&&Zgec|td=zqIN7<?0W1kCqiA?RF}Yp84jM=2rjpkA&tfc^T`@q5MU2
zS8sI8ac4sn^IuCO_m{tEDJVG8yj<Ph-{a=d%P0S6?e$}t;AP`#{GyZPG*@iul@m)O
z=d^PK+IlTI#w#b6@`IuMh1|~7j`QbS&XQU_pCMjlp8^lR!wvtX)4wGddIYEm>g))t
zkc*vjTwM9bb9=Yv{e1t5J{H*gbNkoB|If945qnWf-HBJV7TXS=Vf^ZRAh=GpI<$5B
zuY&tal{98N)>!vp7XR@pYpri@)@5YccT?`p{_=I@PH9`3o&WEs4KXs|oDr<Te(yim
zx^-%f&YyQP%%A$A<ei@V>2T8<yC=_k;j?*pjH;{MihXyB&($mH&dlkxj-MUV74mJ@
z*MOID9@|?Q#mkS~zk8|2F4wj{?X~90*#?29v_Aa(J$*xCL@?X`Q(qn&yk>2DO7Fwm
zJ`d@&kNiV_t$#9uM<nj7B-`&&{)pP(?|GA}bD4hU@JCHQnq=%>5K<H{e}k^4<f7L}
zwG$Fm6lR`%o9rE>6};=X{hdp*pR;;g-_d9IiTxP!AwJE*-a@+_^ZQFqT-7-9DB6ML
zh<K*NYLVy1FB;G4`+a4qnYRST<QsMe`eIaFrGE0;E|8qY`DUWRS;xZMGj`w3h<<DS
z*3z2z!^kmuZwKR*86q*arWM`m`}urB)|#IS9bd6&t~c9pduMA83-8Aj|JQTu&UpQT
zYn73u`C4_i?{%pc3}k;#`K-6=y*X2N#=Ne4`wXA!uDcS-=h$ePE$DBYb0Q$z`iZxB
zH(T<5nJ*n%x5YNt{A{25>}>O;BNcmHFMZp1%6(7i%(&xQ`>VDoZ0fVHezS7-jD}sj
zHgbno>{!dn?|3k>d`3#|!CceSzu`Ou%cmxt>&dmck=mT8^h3b!^|be^gAecHZo1d_
zG3G(MKx}5S`VB3fv$LA^?zR2<SLYu`b(Bm*a@W<n%yTp%8d#Kt*=;f-Vx_mothjRg
z*xbH7>npZditU+vTGL7_??HlVdtZ_#f7JWgPV@aVOXS1FT;IxGt4nyex_$AZg*gTq
zQ<fxu-paSN@%h`+Tb?ic=JAeOoZ-)PiMg(S-#t8ORG7ajbpxA?;MWqP<KnqLUagt;
z%=)C}d8Mh15#1Mg{M2uL``xi9SA3()S$#j<pJ}Gf+M%;PKU=}S{zXr2-sJQr(eoY&
zMTwg(>+dlB5)_g4a*x{a&z!73miZi&(RVWb_S0a&k)OJ83}+L}`4eU?5ML{MxqCI2
zeoxZ2%nrxoND=lcI<wYaKYL2+hgz*<RJvMT<#FZTGIu{#*l)jLmAyi6XZxh}ImV{Z
z&vz84&z$L*HtSH?_Ssymx;~m}ZVueemyPUJFMB&9!FtjvpH;rsT#npa@Mc*?OY=L!
z4OixSII`VQQS9*WUte(e(hc*~VR8rio?L9O$ntpqBJuJKi%Z*l|N9yjZImn)DBG|r
z_I{i12OB@8%GWD2s%Cmmemr~U%w1>d#pX8dEB|y%EU~KPS;npG$lea?&tH<|{T=Hb
z<{M092rCziOuM)Kolw*Khk1%-vo2R{bvwKNp!8I|ij4b@vhMX<aJP={nI-;9!TLFu
zWl`@NH{HX=a(k|7pHzSFIqM4B>y76RSiiW{P*}cCe2y%S_#~;`_PaX;-wRzh#>mlA
z)y$~-b5F#9hYu}U;`#siu3YuwCV!p7b)gGSN<OuBim58e@;+@!T~czQ?8Yj=jXN|7
zW?uT|9H*XD>Yh1wjn?%jSApf3c60MjP5QgG=jrc&BGwiD-OEeU8q*A9CS|a)vx`=R
z6r5t^QtP{TsHXEHSGe}Q?(3;V0ivm~mKRPaoD1TZuKE63i*(N0&#Qg^Z44^QoxMBb
z_lJr#ij4)j%&8N!a_=#0%MyGVJz48*_!HAtm;bMJ)0~y=`gGQ+*d?|~Jn4b!45u4@
zSp4Kkrb@x`1%dOw-LbVPTNZwK#aWU5TiG3L#mvPsdZs<x7jy5=Z`pvapSSOSk|^CR
zc0-KmuFICr^o_sOi}<fbFZ#Ob;Ze6|A2N5fi0+F~yYZi6$rp9qqfzeZaX*S~tU58_
zZOV}gWnE6L{Qf6Q7W}(ar4hpL=0vd3=E5(U4onXnKWsn!OE-YU`17ku&UD@jPnXFE
z*|>Ucij8-4H?{K7&OfL*&oAS^wuk4x2mW5e@-_2m>LQV;VeK<im+vyzBJVKG!1aD>
z=~A<&EAw@-{LOlr{ur;+``5VTM}vZ{!)aC7kI6;c)olw5<cx)QT@Bfm#VoCCTG_e5
zcqxO|e)n5-annD_oRiJ}QThFDzVV&R_Yq5*J$iq}$T4IdHY@(lcdDRnAAkFo&nwkf
zs$Txv*4S%kxqXv$fJ}zPONA-s&o2M@vf+7n%09WX(vpudxLtnpPDx^rcsgTIpSBop
zsKl%QHpcmJk7uR*JtDEdv@A+e_q5f<(&!7?N|~Y;_RjpsbHZvtMO$0+;Wy4pn5F(o
zzX+G!&%>;`r7k?uU3XWH^|nuSLI#pG;vw<%61h{_6W>VI8p;_=mStL3>~)&uOXI0(
zX}yY2h1BgQ?R39?u>LdO^_iLAdsPP2sme?t|EBFY6uR1Vx97Y&6P{exs5WDLzsqxa
z?4{G|mo2>EuyCQ(n~S!0Ps$#MZM44q<7Hx0dkxo0GajY+2UFj*dX(GWtN!|7Z_2ep
zuU)))uW|(4dcNq}xAfNnwN`Q*b6%;%YW+UC;{Hs*yF2@IcKW3o2+q~2ou_@Lapou2
zR`tb!9&=mm<})3Wu|072qQ%Kzsj}oVi5*jt(iT`Rb7wE?@qBB`?><XXS#`SLzqp-j
ziJvX*CZ{gmJ!?&^XU3|hr#8*X$ZyF^U8egXw)9Lm_xg7iMZMn@nt#2WY+1TQUDq{y
z&wlg6EXV(!pCXj#V)Wx{C%3(Xtc&52^Qn_`*pk{k1$)}|{uJD0aC-S{t%X-smt5QY
z*k;YP+LhL8+QPz^>~%bsHqP1Fb$y=1BsJ5?qP{|9DeJiUeT2`QxBp+WWU?pAq#z+?
zS=GleVRsTHMgQq8{&#R*ScLAg@RNTQvwV8$TBmT5o$(&qO0Kt>hM((S_%*&%KWLs>
zV|?|moHCc}cFQY!j1vz{Jlw*`w6sL=%?v~Ru+<V`Z+2Yeo2##CyK;;9Jd+b?ayhqz
zR&e)zUbi}NlF)^`nvY)vUw6)5_*<ZqJyfUp#>Yp8ei$Y)&4_xcC^=>J96ei^2$RPZ
zKB@JAd!|46lKDgT`RfCbvnER?b=D@H5_xL9yP(0-xodaRK^C_~y+5q{jNi<^>$s6M
z{<_2a!0ejLt1M21E;Dvmsm@=QB%zyl)Z9+vVa4LzMaSEEnAa!iM2P;)+nk*`w{Ks4
z{ij!z|9QU4n)4i)kiEy9;c~-0i6{F7{KKDa6x_-G=2_qI>Ccz#ZJ!)_MMSff{o>Dr
z%A}-*u>F<ueNIO0?O}U+;N8{DH#4X2OEjESJ?(SCrnggGeKWt`S>3kcz*;$;?2N<Q
zYvZ0Qe|6{KZ0_Ri6VfYA?DPEWS{S@>^VW|wb=8&4@BH)@zgptD>a!cCXh85{!S#;L
zR}aRW)Bk1j^^M*+{aJyxEtfoSpAtBir9s~`XY15CB~Lz{Q0#s>_i2eh@P;+aa^^+G
zAE$UL?p%|#w_G&5cKyXQVbe3hYiG^&+}LBowIlEFgN2jCp7-lrSmwLvr&?O)ULCWa
zN?iBSINP2yUF(Ty691U^!Tb13!y~JeZ>7HoVq*7|;&T7?>D1BX?K_lp#ddHv$bJ6y
z^5*?T+gNW@=QS5@-O6dYr|(5ocZlsBrYCtP66dU2#9#Q*I!1Dm*&l}6DphCX6K;36
zZOFa(;62m4wl|;qm&nh2$nb5IQC-04Q?+%$smk+Xj6b%%-TLC#<wcpoyW8b0rynT(
z%6oqG?N5plUhn%QEEL7<KPW8=SH3?-;{B6NKHHyc$?<yVu6xyz`NOPRYuqI2<}9+l
zpUk&vA-B)OisU_QyGy#wW=K3#+PrHMXZuvM4xXSQ<yGq*9Y6O@IjcmXB}e+=<d3(P
zt<W^dWce>IT=wDUq4Sp`w?yh2Y?`ZLc9*evMd7+8M}bA|#icUKrdI~4<;^*!wD-uA
zhsU{|gnsIjw_MSDs$-Gw#fp=1XI;9j>mC-f)ZbWrdB&8t^SV~CKV6+slCjun`koTW
zbq~s8n*A@7O>H!>;`?|?z%u>jvu{gdjJK`qk$?Q9cpuOH-NCVSe7(L-J?ygSJ10i@
z^P8F+`C7H1x^?PQzp%@E`mfjerrXcBurTJ5&8e4VkLD!yR!iM*t=N{T;1Oi_Jz$aj
z>!zbYNo=#tt&H{aB$uzO{H0&B&&ck!z^#)qmklH1bLMAG&J=I<eQkWF>2lpxhp)kB
z(*D0PUAU$5<I`sf{EBV2+oR;y%dYr+>-@H&SrbK;cgek2eQAcc=ex(6a=ylIP9^OS
z`26sW2}?y{H|wQU)}MFlupB>|zcrwp%_b=N{L!@g_f83|z3}~3<in$G?`CE%QN0kb
zYTL7j?j6ZLuW$Kv%wfvDVr{LY64}L{mszo;Gc9P7Tg0lj(leMh_ip0?la<Na9S`oY
zaI0pYG0DieVB$8u7K{C|57&8ExfNTn>wGo&>Kxv=VCuGY!dp(xi{AP8{CZEp=K962
zXUKeLyC@X5LH3r+OrbRw7Zx8pcdMWvF!N!<!^eBF=4`CDx_Yz2;kw}i-AR_IhKJ7N
zKT`0_>?q;NanK2VyhdrRWNyFkgZI8X5nWoEZh;SfN8De`lPAzQ+vIeHS<}Rp=)_Y}
zZ@-<2stuL6kSC;>X);-y%fU8&ftNG`@8u<G>Lr)CmdV`fitM@CDJEv|;x@-ovpP%1
z631Dhj*Qt$e8js|(sf0|uJN9GtF(5h9=rMmu9Y_glarVAdTZA5d1*c5e!_Y<NF`f%
z=ffEl2WuAfnV#dB?WU6btUubHAywp@@<Y|xtXK7R^u7*ZGuU>Z?ONg7Z-;UjHV6hZ
z#cwm*z^?s1>BYmHC*O;o;SRa0zsTc4pvUV2hS5*1huk|mDZ**R1LYI8QI{N2gx3H3
z`r_T^8}C<UIs`LEww24<%ioW!|K`p-zrE*$bMH~-;Hm~MyTIcz?^6~qbSYo3I30Cv
z+x^y}Pd|+uTYetwQaaJ~=hDJ`?OXShiJ1PMB^zCwcj2Ji=Ev*q<O^T*d6?+^)k@0b
z{NZNiOp#Z*>sgQWFXd#8ZrKwm)h?c_v-sL;TlTWtgw{^?7gGuZMOfyPZwXS!E_naN
zcypKIny`4eHpBXD&o7zo?6=B~s4m@AeX}lfCGX>i)vNOt_})KTy5%wNL9-91b9YYJ
z#<0Qca=OZ?mGin+$h6oUz4K>kUVOpzNfpu)ek_<5_4C@Zv_Haa2NPAyZ;Pmi@%ZmM
zJ9GQR$6H>to#v_BG_|6oDMfqLyIDn{8b;iY%(gCSux9bUp;c|LW^;*O^$f;kKC|{T
zPd###`-Mc^lNIZ3<~m58TPxI9bj>v3pv=86tBGElXXb7G*TKZ0E*0Hy*?7z4xL%1P
zHyBsu*o3T4Z(;r9bMi&uUwIY>wTE@@PanDaK6TEEf9CBGORUxet}wW-8TS8<#4-kU
z<zxmErSy60)23wc1aX;3ElG>(7M}jKS8VpxsutIj>AK=m_F3G^H4^7N%|3gM^+GT8
zp8n%m7pHA&JL>+vKX}cta8p(BD~{pS#wLpoPy4R6#z*1cf|!LS>2^Y|^LV5l&(H1F
z`RcvRw#|DX->OXJDz-fpTf0v8$9L5*uc&7!Yv0YYxN>u{j#k0)g%j`2Jm1^B`ki0n
z+GU}<pYqH!IA<n*OR#R9*{fr6`g>cixXI1~Kh7$t&+yXJQN1wjPcT#2?Cc=lt6D)*
zHnly_ot)PwYbx}!*K4KA%B6L;Ri5ge%>B5~!S(XF#?<|JkG{5Ac1Vfe>?jnS<Q<l9
zxsc^V%8PbMJwsdNvR@M|Ee~>jduzGomZx=YMr>SXH1q$59Klas&RN=gZsCO~dp<Ag
z4)oSK_ev|We0pkR*Da_2uXKXH-S$0c{A01?Qz?F-Usto{F8zAq_JnOyTV;KiG#)(_
zI4Hq>pRIn=#U^24H}$r5CBv0>e;%CQr<WsID(^lmDe~K*HCHS5?s_Eg^NCUF>3J_)
zJ8srTtmhV6bDvRcik|o`x6J?hZ7hqvdgv@|=2W=uSXFJhJ#f##x!c|cihkVa{rQA!
zf}GNg=?OnJtf~LW`oH>#oa<j>^Zm0D!gb?B&d3*icGK#-T{^kCe-+bY{=<5af>R}C
zd6dkb@;_+lL1)%w#{=%CCHtRLSoi&%#^>fEZ3!<*{|7nUDSCZWduH*!dmJ3K#k;&$
zReq72Sdq+RuE2G0+dff=1+uFTU7s|s+VN^T_pi!xmM_<xXk)2&JL+=o-k+?H874wC
zv%KF0O03*<{bH)<uI20hJ}`0Yoj>=+iQ+XU>-sF`JzDA1)oQcm<eD8m&)3FO8U1^=
zg5SAlsi@UQj&*X6JAEU6mi1{zoM*giBOkjZE;p`N`TLXUjh)dxGh%<9yfg31&Vb%C
zieH1%-Z5+bojv2Fe#5$;>hh1*A8>_8pRq6EHm+^B{YmD^DXWV+#XM{#@P*`l_`^E8
zC`ylIjjeHnq>Iy}(r0Vbj`LV8*7zhR`=|3x;G&(g1=i%JmCv|ZedfjgkXf~|_dZ!2
z=2`lz?n4~kwNvNL-OSp;uDwiY@sWtLA3}vDtYSSYwW-7^fj46P*S1ryGUsW0*q!Dg
zQ83BivTnuZ7iL@JA2mD=)cpE;)6SwCbBDmba^DB5`hJ@|`OCjZW4^8J-`^)+Pp_Ij
z_rlr0Gf$=C=I(X8Y+bO-%d&gD$CRFuj?VBKlD1JxXYORaQCan|q<iI$S38_M{PgU$
z%u6pdRQP_J=eFgx>=!<a3?=T&TdRzZuHv~UU*P6fv1#QdHYv9ay|!}m?e{qpC0^Nk
zLE@R#oObbly(vE$oo}zm{jw{0>y5~BI~>iO=32<AirfA8_++Y|{28~(-zv-AEf3U=
zdgv?Mdcpgs+9sY&dkY$ibW?k;H#)pj;Ea7Cx+`MApN7)^-2Qj<7tU@MvEQqhBv##i
zAT=yX?x^uUVIO62i-*!DeT0{s+!$5+#_rUQAnTXcSFGq!|KXv^a-)pnGwWZ?_Bm4j
zm|CyPYe?Qx=2^Y*!;8S};q!N98}M0uIwzoJulB)X`5lLQrNL87i{xaFhMrF5(-c3T
z(5X4)j@6QaKK)%*kHS7QB(01VPhP6gv!Wz!R;uZ(8r78#?;gA*`F_nqKc=ZS&P>)k
zEHP=<zM{*{D|vE54wvVs7d7607|<EIechyriBnF=%`5cipLles;S{fc1+zkb%RKpb
zas8D3x^#<$yT2#!ES_`0Mx>-IdS_M^yGvYUT!&vz{1V|MUZ>)^@B7tPT}#>BS^D5v
z&|JQIcE4w*E`Gi;X7RSAG8<FRCEj1L>_hY6ySd+-6zw^$)nsgwQoi%<b@*29Ad87V
zr+pK!aKG^ObMx-zRSVW-md?KZQT?W$;q*P~^>%d&^ey*hyB)t~ackutvrCIVvFqNR
zd`a~S%M4q0n+VV6%5f@5cavwTR>ycdL`dhIp1wr%+{wLvnYZg2Yu<6`RxaDxP`qvF
z1TLXvlaKoz`Vl(Y^yxwWh!c|z3W+5z{^fBcs7tj=tdnz*){k?(AC~m|;LQ#T+g7cY
z7hV{)A@1AldD&~5H}_1*zI5s1zpF(zcJ7m#)O&Vf|Gy<UKX&FPnf-Y)YnE4r_ssqf
zBbA!hS1(`J_g{W~-afn8`|4|pzWM*}3j9)0;d8h0wu1KZpK6(ZSJa;Oeqk;-G1|(>
zaqr;;&lz9z9(=g)<BG#?HrQ6rv1Q&pH?ikqiCU-EU#Ei;|MqEi3h}H+iQH$J!{NgD
zVv)V(B)76TZ{Ngh>5=N&^4i$aYR+w$S}x`Elhfwpc|F^@=V<N1XBvgJOB4Qlje94U
zwg0Fh>#p|~Ds0>u-CPV0X}Rs#{G!X@dT4mb`fq31-fa{U*lKh3P2-F+hn|Va{!QQ4
z_2mfj{JZ~u{kiDs{nO0-V4wE4D_hE3=1IBuO)5UvFP6L4T(RUV!)}dtC;L3>?JZpQ
zomuL{-RiN>cE!tEeKT5nYp10g^?gzx&+8uBc{rQByyHpwlP_Vjf@+<cmWL*kAK~R&
zo!t5PQTeRh^XqE1MZL&P@{R0%yTi0;t<+y`%kYg{%!_(j+O}LfS}-AF^0J;TM%Ge2
zGmp#Lzs|CaQt{N0DZlQK^T&6RifP@VXJ$Ogb608inPvW*e<8*r`0|=}dqdyF$4y@5
ze_6))X^r+5zr(*4q&68HJ9m)BT46$WW^0|?ifJ?0JeVa``OB=|-Z6*!vgk7A37q*S
zbX4{;`u?57=RVQ&$+-ym!&9D3I<|r_;n~@epi-?DFRYqYS}Z?$JXueAZT#`S(=KzG
zaWXgW-92sT?uUCmKHs~cb$^P|)x()j6?64Ioeke*R9F?`5OQFmLXO0bs?VIO?x~5b
z(zSecX?x_}caCW%c=yjOTBeu3H|txZN&mwNxun+{as%_CpDn1q{8U|0I>g{tb&>bi
zK(&LHrTkWG_B|UK@>e{?ElH}rZ0?d-$6vcRHD_{Xysf_*{dC_t`MA`IXiuh@;@opQ
zytd@zrrmtYSiZ^N*rKZ2LcIEnb@wbPDl&E*>pRr^yh66@$DUH@Hu;tkpZ70z`P6v-
z=B|;E-R<bFsUcB#Bgk)7+Bdx!;<kQDiQVl^``=xP?)J-nux!Eh8jTYN52nBRwyATe
zfWbcnS&9GGUIjkW(|%|+b$0%j^NQ~bZ69B&w_~+fc(UMp#H}PBfiTXCitLQ)la;zz
zj9A-TqHjiP{9eY$k<7edg~#OE)A*OFifwDPzrijfcekk0sPLD+g}=euMb9Edf2&v<
zh^g)DI(?M!mzWNdC5OXz*EY?J6Wx=(E5?1A+G28`(9-D1mY!1=uIAjb3R}Nv)y`#7
z9WB{DJn>Jo&M{tB6wA%>y1jbgkH<3e^u!K2#u;$Syvpa7U-cqx&$P=Id3|+Uq<^-z
z^}W&I`o6=UOu(SKQhs0E=T~RFciC7*EPwrE{Xw?w^5Q=y6?Aeg^SdtDv1hNmhvHMs
z@UTTTzvnP^Tz>VqGRo>oTdMWWy7c}Klh$9svl$rVHn2xXv_3PPe&&+BM&8WRuODuI
zEVZrLMK)QbWnpgIVR<fV?=$<H{wOS7!m{+y&6QQ2k3yH&{mRe@m&m#A`RWv-`1#PU
zMWx#t7saqKUzpZD<wx5zF{AWNUazH;FDD2F_yl~s*q|mTFHx~Y<#L|n4HMbzypFXd
zs!luSS>6qHKYRO3)06G1)=kb${l&Y8{g-jgPumy!=3e~~s@nc`>$6)EzQ$&4o#`q6
z_@M29q<!pP-1=EHR)2|~b2a0)?b4fjwtF?+oKU<a>e&Xz#li1C|2U(5jA6x!4-98k
z#_FHClH?Tir0+ygV)CI$`=Y9yx}6i9ub5B&P^&e0k?%vb=It&P`S)sgF0T*0#rAM!
z&fgQWucR{6O^-C}HrB72@@KWzEZfStQ`j%%Z+^@#>3g{|-9UDReRi_%Zac5&uH$vz
z4zFIW@6SK~?;qpZMqz*3<tfD?`i+{gJQ+3WfA~WsryWaubMaQxIuXu$y-PyYR<^MV
zt+<oU)>Jq1Vl2;xNliUBlkdemP%~6Blm3<C|KeDau%}wf;s1Y(`~H2f_xHGN`RBYz
zN3YlJ4f})^ze>C#VVZj0!29t(=ItU<cF*=0Dl|u_s&rlOoOOBCSs|AuZLX8eYDKL7
zbWc83`nl!YrOK}9k}*Q;(X;0&9h-99#cZolr08{#eJhe|D=*zJOrLj9PHjc;5nU6{
z2OV5zEUW%aclZA%BD3=6Q8mQ|{+}m!;{D%5oD%$hYFpJT`)}zIy(`xKW&V|Y;IaMf
ze(P_$I@}M+MrcnKQMt8=Z(6?pypMC2NA{R+&7biuG;2rjs<oG|9b~>Mshi@X&gpP$
zMvYF*l#pw4y3V_VM;$vDr~C5HKjj-i;@4kY4Ssml@yJ?{d%Ye;4y6-y!d}dn^(>@d
zVwk<!v)0Y|lg>9D3jENe^=#4!ZQa~{7KJ&}jAFfgf0_jz4Rbsf<G23)oV^x@ruwk2
z-fHptXJ5RUUf%JmRx^WLg@a`B3qlXgnzYsT;I_>voq-jZYbP9XP1k*^ni-qDE9232
zaj$!kO#-{~mo`q?9r{Ce(U-V?+}S%H6y496|KKCjteUF5(+h5Jr-g|zYj26I-{W$8
z|CO)*g5>8f+c@vW=2edz=C5ww{x4c<@?nEzT)+4@MOdA-t-l>x_Ws>XeVLlSN%>pu
zCIqk-noiCRIJYlP)Qk7dwVC3b!LKvyf7EB)WR|kLlJdA<^|Ju8s0SZjb*+07c;OLK
zcHGh2y|2GkPpy5YB;K|?@>Q?3UP&C!W8c^{k4~4!d3|kp&u#I2@|DWUX(1by+Z~;7
zsV!!)fN;anZY`PJo!*U>d^3!hzepx+W-&chq+Y?aCh$MUy2}<nzDn9!{n~ne*VT<?
z-<s!NI4x(YeruK?w`FO2;=0vmwRRkFdbeYpqx$x@r_Uam{?)IjN381kugl*22jy%!
z<x1D=sn!kuQ*%}|TS19s#<Y|9q1%n;{Z=&J@WkBg<t>L_@l)n4T$nrm?>C9JYmXm~
z`@QD<V=vixE18$nb=+&*KiA%JR|dEI{dBfB-!I-S+P%W+WVFcg*2I8RiBQ3hE2|#g
zsIk8^Z^Pcno#KntCKP^XfBc~T?~$0)qp2#lUSvq_tGT*{BdE^Ya)lS?F8fD4>mU8n
z*kNo?Y#hy_u2UB^UGZJId}%4Sy3rop3y(tAe9Tx>HzVN3nN&&rTlbXAT)G2i{aSL;
z^k%iGg@kq26wAA%d5oPxn%yf;g*q-@|A)cgOyIc#T7nbm#KpfFKIe^{+ker@P-<zV
zZBd<4|1|Z-52Szit9$I^`^7oe;>Ew`^#<Z!);~_INEdu?@#ymx=M+1qdQRA;qr=sw
zlrXvJ*NJe$Uu<*oi!Ns$cR#a#t&Ze0<*6q<C+4j9ygI`AMP#U`TG-0g*{hlKrGKi=
zpPn-_u6&A$x&Ag||I8_VPmg|+naCHlPWh}TzhmaRJe8W>i2+elZ$$m7$+CGmRps)%
zy>qiNtf$RgR(sh!%B<?U;-o3RdnSI<yz^%F|GdeILmS1|HdtG~ZB|(z+*$GTu~Jyx
zw<L?3yOUQ>*vBqkf3MipC|;#(*+w_x&Lb>4re>z7d~iB%d9ZTf;R{Z4c7Mna>WQuR
z(4Ql;sk?8n?DmABkS%>02W?z`9-pvx*=cX%wRvw&-}V-h40U1L+_Um<Wz4zt1)M@V
z12g3QoT-&fKK-Z4F5mj*Tk|~0?FY5?U0t_M^$pwS8Nv*Q?oBvn_#(5h%y^IIfxO0h
zas_TKtq&GkrR!a=m}r0e%`~<L%Pyn`oSqaTC{|?j^hl<8M7UGm99GL+n{Mk|Qql~Z
z#I;MV;gD*|@5QS{T#vSTUAh)wC1Q9q|0r|su`L>txb#;{xx99Q*U=RhCd^K#Go1J1
z*_T!85@qG&^tviVpI(2d)cf(@$AW#4N50HwKI+2GJ;C|||F`-XNk3n|SQVH0JJ)&Q
zFNI!qnVT~v*Y4?xW<LHsaK^UNkJnaLe{KGxoVR-|V`1K!H!r@gyL|X1f3tbUF%Plj
zonmEYg|GMNdhSbi*t2D4&@rZfeHz<JBN@`KuC(v#J<+oMR%Yof(KQ_YHlJ_Qy@)B(
zVu?Alu{$kRL^8KcZ`IXY)4xn5S6`c*di7FaOK7tEEB(n)sxNpfuFG}Tlq^izZ5w$*
z_jIM@nLRgS&0F)BpC5a<>229-{v|6z%ohBNxw}o_neSJP$-CygO0bhKdbHNy%%LeP
z={4_JBtn~nvUi;@(p$WC3-@M@B~t?reEUD;T3<DP>Ich;t5$Zao{2CXjsKW%L!;-#
z>TlOv4nH!vGx_?8*cA=Y<#{c7Wv{+nJJ}}lNGZUr`;FB>6Tg>x#J*c!btx(1(XWcV
zV!z<*g~hw7cRRNoI`!(pQ7b)7BQx!^#UEyKWW0HI`nSyFrJH-5CZD>_D(4_#V_htB
zvH8xU<NE?XX&+Pi9lc3YbN!7#g?FI`%_C#3-e);FC!6=YCYza!%iQ?=9NnQcD>JJO
zImhgsWT(=#`sJ<_0ViHNTy(ZGR5<^z`SI~({w$L+q&8G2UA*9|*vxQg*V}tneGZh1
zXl&yC@4clvj^S#?ywKa`B3t84PP}{j_HTn*rQYtwa36&=^Y&MzUY*y`d|JeR@h`1=
zmjv^U2*}4P8DDwA9g-BgFY@TWAgkt8X7d?e&E8=td|AfRP3(<zR>s#Edbcee3j8V(
z$a+-iG`+evTvzq*;pc*Kr(Z5P6q#VUL7mOu+kVgV&1b%ybyclCm^AOJ<kjS;?GG3~
z_IR#6!OQ(!qj+_uG?VV)|AD6q_Rmi3e<Qs)+Q#*fkb%!)kDP72=RVw-JS|XUYuxj>
zW*KXCUY~TjdWp3y-%df<GdJp6w#|5ap*W5G&(6~DB0eRd+zofuy|y|~zIx%kX?N2-
z7tT=jvgi{`-oc`jp8UX?CHG?cQ=dz(#pWF_n%KSjapWG01t-p%Y*$VCHI?thH?{eB
z_wU;tK6-KM^jfQTTv;Edt@#%EYNORQ(cr1UISKPVecLP?a$~pfjO{{;f-jXtS8m_@
zar-Oo8p$kiTQ$~*yZN6U$op(`%SsS<(q?0Raw5xJ?dC~$KYU&N>ea@=C(awa+<l7n
zFh#m2xqeDoo{^BnqP0o*bkZrmGo2mlCW*#5Upgt8{5!pKhwKxPIoDqB&d@ga)TJ?l
zb<bs$!&fK1VY_>Eb*|yENiu%3J1@BN?_R2VuSR!&z<1O3g<|c6%ekhcB~QMy@|Jd$
z+NK*RtMgu{ERPB=HM?bO^nyR~g58mHuMcI5d6n$U^H#2Xm~w>S+L5Tci@fH=@SR$o
zv1Dadb>F0y1rO)2>&#P#DlCt;IsE%zxBouD?KivwC$e7=>a!~DJMXhC`>#R&`DyC4
z<?3a1)(+CnpC_aUO85$DF*bkPGV#;BFH>~Rmj-!9^xY5sdSbG<%8xg{Rm>xo$1)!J
zm~&Y+up@mk+vS7HPyYJ(d*Pv<fqx@BcEqqx;5>a=&6N3`Yx}ij4gPC_oTgpfY4a-Y
zx|!p3ne^yuFW8!7{hRtvzAY46pVn=$Li<J$za0Dh2ir4Zm$CNT{~B|kY5wuXbyLk=
z3H$CAX*qg+LDPm<Q|`ho@fxWmauPlhZ1YsZ^Os70fAe?l;;%f@BZ~ugZ@!z@yrxS}
zd7YxN(QBz42{SioS594LCONe)&`inaUhEU!(3vTTKQgzNmYm{~EAVMN^>?k#y^UIb
zZ`GYO-gfWR!aG-aHMI&nguAz|bI9H`=|Zo%@%kC7l1~|_q`6&L9NW)(xP^a}t<~J=
zk2<wlpX>-(`>QwSWO(P5=NDck8Lk%mdhlw=TfdTvO;PF3zWs`n@Dbs^z3u7I8!0?T
zjxKwC|K6N=rSTK<=JM6-{hYh+@0RJ!A#1+ebXl7<O()~eRQ->|?<e*Akc{ZNGM~%$
zMb-OBOM3Q}T5aIct9^NL!Q2dIgL^xtZDGHyHd}~0dXLh&Ag_hVv9q;uH?U99dK=>Y
zCiIc!g6EmCzr)T<V7<ipmpkh)-_68bs}Da)clen6hokY$;r=_ir#~)f?wWh~p5;TP
zwl7JmrNry@xkP>4G~;IWo6~o$F>X2f-}%Az&E2Jo_N`rGRM+;jcDqSOg~Ovee8Q81
zQ!6Dlekfabc=DIH4{pz<l$}4i%`VlqIL-Ek%j+WJ>rtXX9oJ<`B3^G2ZvJrFvGR+e
z$nCBtdNWz}vbG+6|G4$k#VJKywQv8+_QmG1G4sUP&fjPC^WWXe<^Sg-*;>R@_^qzU
zseC-~zSx8})Bfx{x@Ga5_v;KBYen^izwhCaFI`&8dFp1G+xDABzL+fk^R-~_$xVlk
zfB4z``Jazspk&{VsjF7C^{pve!&{f7`M^~F+IEF4lT7Ovf3o`Tty8?$8@6<v%$D1S
zW-Z!XxPYUs@W~3%o{QVKSN6Z`az3=f`=L>-T6=cZs_vd$A7+OAlD+w+Z?ob=wSE2G
zT0%2sx(6M~F;&W)F7jyJJezA~-t(ereVfks72Te2*7ctLgR^~mzbLTvs@R{>D4CXI
zk;r?3!T8ydZ?QayA6_WwSyyaX{Q3ERnR|Qpo(i~|G54*zjsBa%twEu#x<!04J;6TN
zJ;{ex&GeF&pYrAODr1`k9DfxSl&BqebT@KZitu74qrglB4nETvdXG&G3oiOEE#uUy
zoBH5KPtXaM?Ym}(OV+1%A6KxDJ=U<+`sLn+?M}*Uj+Xzgs01I|`t{_5s@q-?pO;(r
z1XW7%&)yYwHuTSt)Rj}F-nvk>RXq5m=~Lcq3wh1H&b&G!qWPuC%|LhAvVD15-6xc+
z-@HwhL49uNlHKonq>6VQZ=WpWJ#(G2=Q+<MFT^-XB`=>+nr@TwKG3gY0r!K}U~Pt*
zhMTJ;rs+Sbv{`X>3p1zAm0o*;Ds?Vv-(R=O(>&jHFE^Yv>(-g{89#1yC0K_o<xH0;
zX)3>RmaX^JIg1<>-VB4UDgIA=KTqB`ZRy_76*m@av`=t8miqj4xL2k4!!jGOuSz!=
zqn6(PzvSmW{tmC$<L7OERymwoJ1tl<eSOY<_k*1F6@1(`l(~MW8vj*1uWK{EY0`YX
zK$U>4Qq7N!dB+`_)*>YPYU;EV7kDIA_#EL?x;<h2*ADT2_b1;DoUybxVk76(!h6$9
zw!Yk=?%l$(AoKNBB@>a2I}W^2T#|ON{nV+r#`)`{R4l651XEq#)iHek9`lAJ;O8yB
zo{Lf&RQ}%STX5$|Dcg&UJ0C2!yYWz#`Ik)DgDrtgn?7%K{JVbIjQ1Zbc5q*OtZt)J
z<i!)QKtgV>Q0ngEV*QKV7pC9lcV%9?;OyPwiyv66>elq@){tK%RCs(<5NDNr{j~+N
zWvXY{znhrAAGl!eUa5;2y7zCU7bH!!d62rX$#$1Ozu_CH%cktJWo&2b^*;FJ>T){N
zMBI5^jeK}#XI5g(U5&GI_O?37v+kX5)fO1ECE`TZagp>_Gj7_I>|qYCW%>5|>7?m_
z%^HTv43Vx%IUAl_kxI6;ai4oGblEhX!`btf@469pW7q4g>m7bJhJ??bI{AI-=@^OK
z0<Y>Le3=Xv7S9W`y}WpPYhs80MMHMm(j9BAofU11I})i|nteCv+nig0!R(iXf*Q-z
zr?&5V-hHO3t%x&W$6IAD<xj!6w+)&PCv5y8-}BTtZR*lAhay>q%n<L4W{$Tho+6B9
zCX?QmE%|T$euB)q?B8)e%0k#2{`Shh`JuH_uIj$4bC*c?qyyWW|IUhiJDFcN{N$g<
zCG$i-+<%o^WV}gV#;2V7_<X0;MrS-T_vuLKWxdp$y7Ghdp7b(ydj*w@zkK`WYpnPi
z+PQ7b?6tqYO#7ZY>&=$R+o=)T*S!x2ZZKob&kZZyelzYsIP(&#eP=5#%q<Ud)J)Z$
zs>0}4(4<{`Y-)+V&1J81TZ7np!fM+%ISUe}a~8jFQ(<n~acoM)i3-UlkF(YqtK{#v
zux-_|*y%5yrUp%V-0*|f#KBi1GH}gWnG-K!a=*63T|NG#qsOT4v*F2>v>V&*S*@P7
z`*ls9LR8XnHj#||N;U$&ZcLPx4E_EzoKK+mxIkV-jNYYJ%Dr8joik0sJD(IWxnw{0
z?L3@jwb;9)=i=qrS^Ey!n5<4})_kl{%5T+Wt#98YXIsT{nnNui(Dh*F%MEqKrMFi_
zonZbs?fz>np;A5lX%CH`9Anry(Z<<O%4$(Y?*qQfuQwBv6X#jKdZF<v{`C2&XFY%I
zTP&K%9nB{F<J6C^9d*~<pT1ps`f~D%f*J+(8H^0`*S}OUS$+KPGv-%$VdXoFey)kp
zdc1k!>KP}m?}}W;<gDYWa{rz8)|1Jz=iS-0K-uHo=G>W`yFUvB2OKEZud}QEUh?b9
z-P4!f+Y~bT+Dly3y|HSJb5@CSUl*^!`LoMT6|cX&rE}#Oow-v?7F|}=wcWpH>6ZqZ
zi<L#2TbJzcu3042suhwK(sqAuW&O8re{a5+e)RCi@`bu)kJp{KpxwlDLFL+kKE|W`
z&sRl#eg0-aKo~>oPsy;0sgXI?79XD{9kfn+Q^<~c7pv#*&kpD7i{@Oh(yndmJ)WrO
z6g%}5;`82Z?+?qkFD|I<oAY<h^q+6SrW;N4KJRv%>%3B6|NP~jXPv(L{>h!<!o)Q^
zp;2$M9dbp=TM}9CBw1*v>MsAXreen2%e#O1O&8(p;+yeNaFN-j(~&wStS+3f3^6+-
z5PZ4n^{WICzbBWrYae(r$0%pvnv&&b!(~{{UYTKXbC&MnLw^OIO0s6mQE^f-+&|&o
zThBj5Gv)@bc(!utsmmo5YC@~`dlqe5)=@iYE$7<V8V2qwG}gx%^SGpKdc5d#I@9($
zTdbZ(@0{~+?-kbHd$#!qDgE76p}w%h_^<1!)B2A5_H)0^VksBNS9`Zncy_+qZP&Sc
zY_gdf+7{Y<*>~_j)X@r!H4oqK+q%v4*W?hXSNl9a2E{C&5zlk2I#}YO)~$DTcAtLg
zPP$<mx%S63j_;SY7dd)YuTu1z`ro~uYqLpr)9Sq6t8B|8lvMWBZ27Wt$%OpY<&WmR
z|8(|f>p3I2=mTqhed@gMQ*%xX|L)F}>#Y^r{ycnggwM7{_|cj|{aLk@n$eR}f313Z
z;>5iaCS&*Y8y>D~{3(>T#bW<ylNI~zjkg!Y-gL~%>R!6;r-EKq#=JHEv?Bkl=9K*^
zCERKHeahSJE;|;rsJ7GBt)&dyzg(&nkgo`DT(x(l-+?ui0f%^GugO%lH?zLqw!!Ds
z1|RdqHyGE|xu0A*W2((^hs$>|(|)UknwB;>#`qs?6x_P&_qpJw4Si+1o9=b8<$e>D
zm2C~@x|DUc+;YqQrQ1|wJrrKg*=1ceuP5md^B>a*#oVgjA3U#^`I_m>%IamgrCXc5
zS6>ni`E}QGgL|vy4Ph^@<`sw3tM9I#t+%9z@#%h^ZD|eni#?y)E;e7EQ{JA(ns6d2
z_@?KL%ry0LH<ENs&P;flvoA#R%R|HePrS-kz0RC(UlPHRqf|8g;`W1ifzR~R8jbVr
z|2(=`J3>(Xw(IiF_hKh^o(-1Mb%<W(rMN<5@s)XZ^!Mjy)NlKE&~M*;vv<3ze*AuT
zuQ`WV&)#R&R`a#L`zoK`-MCaN@J300RLUFe+STc^yXUM=Qd#!t*H6iNcfDENSBbam
zyz*FwYo6BA%t(>;%{!J%DLQsrLrI@IB=z5VYp%eWx=-&uFU;zhs#&l$Vb$|p264vH
zr@wEm-&ecvzRBjp_KRyAXYBZ|wormGWLD3Wc}0cZ%f2m&QC%8o9QE^bvEUi0_2G#}
zq)%NruGlx{EaT-?qmxI=FE%)C7msl{wB<$cQTH`EnGcv2T$m#g;PI>Bqt+`QiT+3<
z{SW(6CO_xQ$PLZOYVtbvYmdm;9rGNQFObo2{rBk4s)DIjnN{80R#*K+TPDsq`|Cz{
zy4367m%A@@*KH2n71@;ZqAwwNMbL7kW!9^1MEj>^q%2X3*fUeiNJny&fx0?FWYVIg
zg8s!z@?I^Q*l+AJyKc2aV4+<5&5KhVKd=S6TbcRjaaK=Vl4sysxVY`o6{p<Td6w>{
z)-MSDy?M4(+zvajyUU8InKOgdFP~S^zHiexYcuQ8y*n01P2G0KHE^;+KuglS<Ndk6
zO1E9Tz2WLyub;Pn-kNqaJ6&ws*MsXfuX?|=g>kiG_txfO53Q?w)B2h!bN)V^x9IcF
zX)0$j!@s50Y*nl(l1=9;dc{@Zo|IkkROh+kQ+=@$n_uK?K4)M*x$yY)kM1A-m&Myg
zhbHvC3cXc2vplm^K7EI(d*!+ht-iChF0tvXn)5Na#yWT>--f59OSg(PbZ6e%66%_I
zO#9#Bjk7o0N`IzeDr$1KPu|No*x-PK%)=|1%~!&5)_l4)=SJ}@w{`xxTkmZZxTh)P
z+n?cXc<g=TysdHb%k$cItt&tOB|_>_3`6OKh}?C0jo+KaU#wc`m3MmA!m}H0z7FqR
z+*osG|9$Q+>nG^)8E>%JGV|hNzDe8qRqpNGeA#95(Kp<yPM+MoVAk;k1=HTVXz}`#
z75jMCqYu+uN`kvMoTlDmW?fwvb~SBj)|sM0Q=d{-&%djjQe6%nnQ}#HO2&&bdhP4%
zVtnsx^qgz|Nu~V78o~S7(>8lGluyWiy>Xtwow{pZWpnn5$?)8HIbG!M;&<2WqFn3z
z>i&IX)%=z7by>>X8PUazNi)4GmQG*L7-(yyzi%OPVCbdhV8QUCs_AP=PHKKQl``{!
zr|+H52^-`;_{Cnma@S0@?zf2v_kQcz&;Raj7QbAce{W8$d+WPPd7GB{Zq5I_w^Ory
z?_{w$_v72{{x*!CEupk~@$~ff_xDzR{FS5i;^4%><@ajVTgRy$^N_vWa-7M@!nXe7
zxAw{5`o9DtrH&cTO3p9o{}~xN{fTyR{N+2G5+(-!7N)3M_cn^`<_VEsxcJ-_`-jJ$
zd|Rd=ZpEXYb-Uo|@z?Ae5x;DAiqHM`XVcG{UtV-fE_>!bx$4q^_cNw$fA3dURkdxd
z>$T|9JqfE`Uptmn$8~1YcSFVAO5bE}yMt*~x^`BYYh_hVela=|XDf3%&L_4i%4L?o
zm-UrTH^}dKlyoITlS!2SLh#R1BAW{u&($_}dPKkH)v0>0Htti1gyjxz`^QS!(+;Y+
zXU?9i)6UBBzqR+A?j`1|Ry(;_zb?N_3%i=RSCDs=kHv;29bwLEmaBwI)mPnr^g?36
z)_dw_t9NFtid&O#=-CWO!R^LR52yWDSFB{kyX4XeAJu<tN}qo2j%{$b|5{-3*$Z>j
z)r=<zhMW;8*PkJM>Ue6Dt|!OietrM!AGxhN?{85qc2T>?>yvOY(lzKpjt~F)DP5P(
zZAv+M)Timb8SB)^N0dFM9=#eGB>ADod}?U><;2IbM$1zDPglBKzZmX0t?+%st*)%v
z<<DOG{)&{FnEmV_!wfg(bGpI0l8rnfCl^&l=NOdQivRwzWX%M|<Ce3<qCcI#eo8i~
zapt=YjtL*nY`9@{EOkw{?<&Wm(e~NaQznb6{QmP|da5H^%9OvHD;B*zV)Jj}L>{R`
z?Rxq5pH;6$GUg>q8}d$>sdSJlHu6yC8;5}WYe8?-w?Er_LSw!B^W_I`?R`?~s1vq=
zX_JTM0_|y?Sqo+sdw&$Di1b(<XLaw`c9WZP>euglbA4-gTv%y_U*Oa$vrAcaFALh`
zxWajV>W9bHS7uy`*%P6fsb2bb(vf~f=4FPFKQv7(o}Qim|3`Xy>pW?ruhZiVj(jwb
z`F)q;#$G*Bp`!I-YaLSD6$1LWZ*#B;>t_~i)pe<!_3O>0M1`qLt5)m$6nQwy$1N?P
zw13)~zh|4<4_4mzA``d6F>7{At_Q=(>`QEkxjR;5ocy-v<q!3fH}i6u=16*!dHq>@
zaoGp`MH%`UyCb^7Y;FXLcTc!I+qX_Oaofxf$HkZD$NBU6N~C?OS<U+>=??qai{;jh
zlIfG{B9_13-`*?zFrq5!y|?=M^Y`{z*8YAJdAXk5e&$?maYl{9>T+q-u_2~yKNB8=
z>@vGMH}~!|t>Z2ew{&G}GWgux#o!dN?77<cA9K^$`nE|oMwu(+UMhEZ$!(N9@x8{2
zrE%N`(yhzOpH?{SUb3Y!NaSUjWOjU*db?_vUd#VxB^K}AtX0|v7@7IrJ$doqh5eJ6
z`kxI}8R+bqTfuz`wAs|e!sW%<%U|^sOaJ|xZgAj;b>|Vc=4~;-t(zXKn^V6nsZpi6
zD<y75QcTL>WVZ|JCT2^PZ2T&++NGkWE;6v@&V}_6kJ#r;*}k~!RnUa{EJxSr-e>qG
zcekwH`s(MUTE1=PH8{0iGDfvOICOXWoxL|^sy#|PJ$p_@#g&A)I(LL>VrSN!zh_hL
zy!~=`>c*XWl<faoZpiDpxJFcM%C8w4gyVN>&GdXy-1jf&(-tf7N3nD4cNqvp=Y<u1
z{m5M$reUTKk+!GmHv6nuK23s^mzPKEJozd3QvRcFxgRc0ub6ztK5wi2@56cP56bOW
zYi?S3*LOzMcgf7{n>H|8m>W(JX1zOcTI$8CKJhPeGs~wQ;a>A@$68sQf@)<G;rpN7
zKA1L5<j?-Cp{2VQZK;oz?kWslD=N0vw!ky}Lu2SY^SzgDe2Dt|=J(oZ-#ZTRUD;I5
z^r*K-E>GWWjcIEBi@xn<!6lKi&qN5>&(PAFvq}5zsy_Wt5wmxhzFX$&9~a}9y~n32
zd*{cd_q$dHJ#sL=ezi~IG}He#o}1jgC(oLt=^g3CQx(Z6vbp9|&5P4T_g^#2NQ+mj
z4>asIHm?n=mS3>0YLi%|!MlPNuEx>Mp{vihhFPbcThe}nE7|DWrJw$KLN8mA_HNyx
zJAKzB5%sH+*DWcUvzTj@aO}yl^=TR@t0#Bf<!gJiFSI*rv&*&S?e8`e=>}*;oj-g&
zcIPxE&zMVQqGb(hxSBe*KCNo_<*staY>ok6o{yOA*~1T)^#9i_KcEpfMTbvAMK7oE
zHPf-PvKd!%L)BMX#qqaa-m|D)O}1#_8M6hB{|;oCO7#RpX)^ZQO#5)fQF6hO>C+bE
zd;N&ybe?m!IN{UgWey(U8<yL*PB7|T%`$h@?S*wgdmgRw-2C;xGq<qoo)6yiOp-A$
za(n)f^#;FR@|vKU1vxdnm)W9b^@!)1THar?OiJ=6^XDh(uh>|E?H|RTn_GX|b2a0V
zJqzE-Wlxy*v?cJ|!<jMSE3FspKHpeYb+BD{6Z2$6zPek+Z5!L)%~y^3Y4%g;m+Jdn
zF1M<?-ToGIt}|9VyS*&U(RxL0-L=<k9b(s>w%z}!djB<pyxBbcqD=t~7M`7bY>x!|
zr|vypT>o_c_CrQ|t0jV;co%6ddw#@sg@vK|f%%&K=@$cdR#@!VljgsC%fg(5uJ1D2
zj@*y3S@EvF@H5wmIla%bR?T$VE>)nV(=EN}c=12^*^<*6s%>-cL{*rqyWDWoYw49N
zUFDjSj_+JJXC8~5eA4{YT5AJ^vu#cKmo#Rd&=hBX73Sw2UBtQSuI@$&%K#DYfNxn3
zF0A=<b<t0DG0Qax@dgXTyz@Q3DO@vWPnw;7`12QqcHKKuFFMKdS9RtYboG1s-Mk&Y
zuTDOUsjcsKN%>@!`zkZ`|DDZnj&*aBQ0(!ho$O0`SpUW+Zm782;k{zorI(cx4?E^M
zvsyP?Uiav=$k|usTN={${d)O9t&>kuHg8?~7G_SX(3E(a6MHHr?VV+z)^<>t_1wI>
zZ29-+%=>dD^2x_#0uDvWTcm<I6&Idg&pv&BRYFnJ$%H9x7lJs_A6mL)sqfDXy3zaL
zk^tMclD+4Im@0p*ZqK&T(R4p(Y~`w8x7^~IbJOAY$yIW!;hF^oXPCLygg)H){m%6I
z>6!CnVw&!pYUHZjbMsg}UwZJeuZ8JbUTZQ2zPx|?nC!hu(J5?7h5L&?pAm7pp*wr#
zuPsxHHn(&BOek9}lDbPnaI@ZJ(fFiA_S=4R_p2=Xwc(^i%@4(6**|VQPTC@GqhBDZ
zGQ(+3-q9%qx<^iwOQdJUs9sf^>Yc&JpqX|uxU*GR{!-taj~`V%tCPDK47;X>DPIiR
z?XuW5v}VGEs!jj<;)`_5b~cu7Wtdx6DEQHG$!$-Eohz){43i&~PSJGpp7rI1>YY_v
zAHVsu>8xwkjUA1b_e}I^>r317uDtQinUIruRnP97;rv*tbUgOJvFXP@{P*0vr0?r?
zK6NQguVBe_ocG$6Fe_d!x)qpWaZ0MuSoO}G@c4#VJGMz?2krDMzjSQX#>MkCE$!OT
zR<yt<&TPjm-?p2)Rf3&wy@L;iA7->)>uU1p%I*!_34bDV%x3Cq*70xE*ci<l)ZL{S
z-u~ir<E<qb`!u{9<a4#!lh?0}(lv9Ck?Z;~QOLU{)oq?Y%ks9vw>Yw+Z5cjVv5GzO
z4PNah&wA2-kw%lC%<;uP1h{+pZ%cPN23sm!tmvtE9_`(~<$UyQ@7_1wfyFwSXW}-!
zdf>2+Pm6DD;Q#IV2WpdFbXx0Lo#}YB{<5r{hKF;)rupo@isHn$c4h@1;&WveXWA;t
zm(a{={YH7^&Y&vA6840=w}<oBKGr;T?QL_xY!>yoDSx%61|Er>X!G#Lp~*ihT)Ee+
zWr&h^zlAx_(jn4ehxA*8iMu^bes0?9S?i%W<A7lGA=Va+=*@fQ-eF#)Yr}1*E?+Im
z;e6_Dw~5=lM|E`)d%_>OPt`RG^}X~dv&qv{UMF+bwYhxn(@b7eT)OD}|HB`fn+JC6
z7g}PsU;gmjbk`cuUiVs)?nU-*o}8{Ym3#Sw;<<{hpx8C$Lhn7(ghU+ek4DN&dHGbd
z%Jcq~?>5J8ean4tvaM_Wu^U%!{6AY6{OkJuOIx$=S=ZN;7+z$P__a7UY2op2g^Y4v
zvsB(c>|s^EbKlI<^<34CllN7U3__Bm?j~|h+*f*YPF9tl$*apVANfqqdNC{I$gZ0Q
z_y3zFD|{i2?fc0a|GtVfuJ~8$m1n<vci#=?;P8oduG^$+zRa>}@JeY|Hm#FI!|=WX
z_k3N~HM>(<Hu>yY@@Gluk-Fm_?B}oB?SF5pdEw3#d<H5a=eBM(@qQisk^8xFMO5%L
z1_$2PtTX(!@y_|N%R_v|B-53a&b9%m>tdX=H(n8yu$n2eVE-!zWxqx%L7&{JUNgq6
z88^<f{#$cPa`K#;^{TtSua9$H;4<HQNm_ekiJji*B~i^2l#2PH_0zV`u`3mrCi31>
zd9UH7ZwtEmKW{jqdVZp_On}==u}NMhrT44$Z?aeUsT#Lj|Ej_N{r~^gZ|gk%`0)e7
z<r5~{?)9tOx%()K{jw=<#a8q!xU)#RLzV4cx0Gh*qHAmSy}InOvwrrkET_JXtEw;F
zFn@W!M7O|g`F&5vr?YL%r@yY<dMU25Yrf(w=kJ2AxXpfgzBhdmQ1^HK?v?L1b!}Ta
z|Gyk-qWiSpw%1O+-{tmhY5tb?|Nibvaeh7D^;@-{SkiO%)5Qu;tG4?I*IW5ZoJeg?
zervFt<F9#namzZbQ|GO6|E#I~QfR}*F2r_a>b^BB%g#@!Yp?#KQZ!Be%&GcN%lC$#
zDn6^Oka!zwq^j_8UBMz2)@q?Sr_)O3*F4?*DNlN~&cvtvlT(ko@&<kG3Ssz`ssG6<
z|Hay4(P=A}Pm~I-xbAcF`M0;B-^CuEH&&GOXSv%qBbb|cdBN;XKjvfmUWZ5Wtp8=S
z@R9nw&`005l^DMlobPM$xgsO4Iy^X2xAFSMl~q5RW0gJ}KgShyn(6X<4gH(1erOfV
z`=Qmq`S@Fx!{wXh4}P_U|GH*gB^V*Y#eeIyl$=#|FW07nkCp$stlQ?Rvf`yl=T)h`
z*u@51$DgzJ-_BJ2vMY)=dX>rf!`H;7?d`iEx;~ou;$Lf@vnkGPVFnI<hYuT6bU1(3
zpIpcN^V_;A>i|!e=@aL^zib|}YQd7Zs!yugbEe%3*ZuHgJ)c2L+r_y}UJ_M485;}|
zr~V9k^KDOmbaDK)>w%%w+&P|3?q3Voy65w(ee?TO>){CQ18U1I&8d!yKJ3DKIZ<hX
zI@gCI=WltPs(AH9QTzuBhs}FYxwQ%njY2Mamw*0r;;V{X-MmTmJC*gWNcWvt@T*&D
zmMK%%BjL{mmlmH>pZM1J)r6QtwYO?)F=q2r|9;=w?V)(n+h02*X@!(j@Kn9_xHnJ!
z-(P5?o8c!Gc0sDHrc`Fi#QwIlt=AT1UktdlS8vJ%zQ{Rchcmt3T#${moPN5e^@>`U
zdQ3(1Hn9@Lwxyok6&|KtY|G}Fp4k3xxemjgBA3J`wHv*~jXW-}H(o!K^dd>Xhn-td
z>c833%tagqhU_M99&9g|etXf@dpABW(KO-G{UU$ZsxVZi!NB3T(dso-*SARDFe!)(
zZttrxvGKQ23QByr=6FwRn&7QzUuV4ZzPe1_T`8*kP2}@aOR}^1*GG$Ah`f>(mUbma
zVg9N-nTrq0ubxzz`ZjQHTI70x`MOGbPWv98muG!1r@f#l>tUz*hW^@nN;=&fQ+1s?
zsxKW(ZjLo)_*1fE!+oZ8+V2&*xcZ$|9pH^xW)O2QjOF=(=~IgT>ICQaEuIu|O)zcq
zhUL3Hh4Ji9msl;{pZVHmW%-hMR!?i+8*9(d{=$F!oN&|qd47x2{j28(a;Y~i%Go-5
zlKiUnj!!ohn{$`{FiqFbyz=?rfrvd4&3BR>Z%w<e#4F<?Hv8%;vl8YghJTtHr$4=Q
z_=XRY?Ju@cX1({h9~6GNu<`wR$FWqg=GnUx4W(aYMu&w?CLP<qaAv2%C8hjLqAPSX
zE|(}4E-DL~Qg(G-K;$Og3Xhc=7EkM6wOly(1AC>>WC0F?gHu`z3iv8y)b808{pb#P
ze&onxt={y@2Y0%*>=sM>zR6<$og>pv-V5CD{XOU?!=G>CX8)<yVl>!db^q}Z*6PU#
z>mwf3e{^5@MDyv=?=}-3Rlg9~d5B3<)bZdnGoDuoNoHRf1x2qhGpmXJ4_qAJ`%&7}
zqIzSNs`+<@Yq@(IbZ5-}8t>L|cILio=PreIU3ZW;-&FqcprU%8&xdc)wl{=Cc8SOy
zt=tqMl)!mZYu)5cN47+kq_eo}(h~a@<kh#jaRuvl?Kbt<f<mcL$IN||<P{^sldZ4n
z)J+JrpTL#S{3UIl$%p?NY~xqn{_gzZPxJY*OBzhV#@4!Cm$s>%{d)7qg{dnqU$3oB
zH~sz3V9jp*)$u!IRc)&dbcm{M+;_O|@X4hYOvCD4Yb<zjrgC@Fp&KWrU*1x>=)x?U
zS92xL-<}f~EpqdbXYl%K!B@Qx9~Bb47RD&LdDi;UDA)4mVZ~?SJ7Yg?7CybLP=cq#
zWJOZKeBpgJHy)06o_IrXa%%bdw^?_}*4KVZ&u2Pq-1Gd-W0R@!$1YB}vf$;H&-03A
zuQbd4vQ_Q)YQD9~M%#LCJ~JxOt5<pOd(Ymb?OERZ{Y?R%(yIQrJG-)HEX!uz5^Xx$
zaEtZ#HwzZ#FwO8;9eHbB+1k0&7;f!et|)kgK|kj!kAAm`;a$I<&sUtVNKdm#V`n(b
z<H+}3c7L3x=)ETaO`7);1L{_tyY0Ec=BQpd|I+n_ry`XV{#<^?9r|bP;&*rVxjjoT
z{Cbr){fA7i;GW-)|9lgwlkYt)<NCh)R%TP-o^x;F(vO>0D%|y2l`9iAbHeZBfK^_T
zpQ`cCia6M%pS*&b-=nsrdqWYkc(<kjw}s!y+so7Ili7DAohy9FDz?VsR5VvY;_*G(
zm=_&2y_nXkx!uiA)Isw2l?Qez=YAfoxU*=ldgsBPley&^=ZTwKzOyt%T9xhbj@-*D
zg&#MSzS%2v-=S_t{9l&+ug@=#C{ivuZT@DtLF^Q3-B8aThIf8!S|GyQ`uf~0mE^|z
z1zolRtDB0qD_=cvaL>x>b*rl$8uoCVoxEFJC&BBUW2>!=fF|pS(n+G(H{yM)wwms3
zQ&mbh5_ost{r6wQw<SHa%3R9*k56HmpXKAP*J{7k{Cf4|ce(%lzr|fsrp(nmmYmVb
zJ+VlHEAc_d+@)vIMZ@hrGN`nqFy=-_$~~IVdMGBXWxwW(4)NKnSxG{7eF8Lg%d^dj
zTjdlMbMM&n|5rjP+9ZzrdD<9p`5_bQamOEbXMa!6zn{$XS5ZOrVO6kfKaWsG-d=?S
z-@dPk7do^;na^nTEpFiZws-lF?PquR#a-Tzu|Di@eb&`{bN{vJF)HleC(nQGc5<KB
z)lJ?O+ALuwo2RZU7Ti$m>hp2BZyQ^u@swYOrF~2b(kf;=U*Nf<<kPceljXK;%T=f4
z2As&sc%l$*TI=`Y6=O<4=X%ET>X!5G>~+4Zs(H?Un@QI_z$$;~F{7gB4PM&W2Rq`j
zuJi~p|It}@X{X&JgVnoA=dC#t(v^7UvsiPvwoPGSzyhABd(u9f65lfQ^?u>5D=LQf
zzU^O9-t%lp^7R?7<YtQZ-0OSCd{nCOkKs`UCbp!s40lQHq<;?EVl#b=IoAlP&R09Q
zzPL)4!PVTR;@{!f<`0jqU()0;_4uhXyXGA>bC&V@CfC{Sp_L|TWf1a)ab>T=k|kHR
z7(Y~0eYK2xxvaSD5ry^{Z@&a*|9B;nDC&Ln6??PD^VFgxQzuz$kh`X^u+lpBRsH9G
z2?r!Ua<wmQ?tF0Ct9RR?RZrJk4eXs~+SME(`r&Z#w4=9m_MIs@b~oo-?%onB^@CSW
zJzhJ@<TmT7e%{=Q_5=2%T#l1UX9ynN_j}WoA9unYMn~;udU5vk+Tb@UU#>dG`#^4P
z;IXEO)$e|s(5*Th_haep1?B8_KK0EJ>~DH`IefiJ?U$D#*<E?n!B6-^GZKRTP7{x~
z6B>5R{U-C<SDT}KWbdYC>bJdHaK`HGp%?$|eiBKZ^@VSzhQSmM9qz36mt`(({F)h2
z8?7+i^pdIF-`~>9nC#zeIeudj>*wIvn)2RWrH{-CUDxfF{q`dF?x8qy77ek5jb|60
z=T!b2P%g&!VGh@O-nCA(c}5Rf?-}+Vet&OYRn@0oUoXqY*NE$~xqacvmpi?GZA*QX
zg<yc(>E;zF>rP#4*SN~@bko}JQl&S4h40zWTzL8F>6Indk7Xo8xSRB^t`gZct=OV4
zPuSq?hlXpn=3H6iX<nSMFGFYlDz&ucH+e4;IQlFfr-iD_GxGhgWmcX6|3kCNS2rE1
zdhcD^Q&H@<X-YW%`p0L28$6aa3f)j#nDyL$xwzwMcF)IekKIZ*^X>G~|E$vbk9(iF
z?fA6+<`nM<WiPlAIu`epd{ejVUaH_2{8lh${e|RR0g=Zv1m*LtRh#_UyZ8ZL-G3RY
z@*`$Px4rFS%x1e5>6?D=>7=LnPadt`^Hjc0DLdi%m(xqDPOtcHxU;n~SLltGweO<G
zVi#xKEbZm}v##yw+ml6eGiIOc)%;OceDlnq37!VV56We~Z<V@ohE?|O(m9)wQVx{<
zdGMbd^%U@Rf{B4CyBHYqMVJ|su%98GmzkH92t5j1ub}eE-q%&PPfXSLb>F|y<1g<C
zG1u*PU-~SPR1HiicNe~YY}4d3(@c3hnuKnt9AtCw?s5BFdoFv9y7lX@?@S&y=gzeJ
zvrAWKMO10@)~vhP_LlXZ->h%f@ABNY=JVmrnfr3OA}5BspFF8GJLY-2fBSu#TmF8h
zuP)PCw{G^6m*)QS<PO>YpR;H8xyjQjWA!Fy{?nX4eKl){-z=MG3(<e~|Fgfc`78Fy
z=C7V*wAoLYxUkimPR&{rV^?Le`jo4Y)Y)ricb#%yyd>hlZncxsPH$SMv~|kNDW5Ct
z7OJnhU@|}Tb)~Vc+F6ClSl`cD^X;1DV-jbX-b|TywKPv_g?o%r{5tVhSBrnxd0adF
zXnE<m{PfpPmuQ~exz2X|wZ)w0xc0}Vp8dK<V)gd?1^@FOTvRw%ztdy#eKYgWZAP-k
zB<oc6cd4yk!T9xo`wZW&d$0J1AAR!JCVaov-?ef5;h~l%vtu{iT+{V5bkfz6)-$&(
z%&MH@YxnH*N}ie(^Yu@?teVH(|M}_iMOxE$ENM<@T+O5WmAm))(Hbd+In%@cZT8$5
zA^LgGrL!qlukKkP{q<kSz4;;GyE@iA77t>5cJ$NYufLX51=gI2zi`;`)3-lozX$xN
z*_^W}I@Gz>IrOEi*MsJ#Y$v;u{^V_L($`OH>`tw#iaoSU!l3PcV(r&IWs}wm{CqO;
zYqY?7oA#Aelf#)391h$Mc^b;9{iU79>g(lQIiCc3{s!(}>m6Qc9HcCN_Ec8L^w(U!
z3+G-{cG(d)cRibDqrFyyOx3c6soLq~dzQ_wKV|+YZehc`3zhS9?}zS;tc?oz`m4QW
z=3%w7%k>kMvTZ1}PyL+4<-NsiO+#$tnMvh`%m06T_VdM;{`3C-OTN8oSC%qPwp;j!
z<Ac0L_ubXv9ba$$nW$+c)5lV{^u*1ijd`0s+8m#j$TnN(+rHR)FQ0$Dz3i0Qh4a@R
z%QxCxsnX5f?Zr4{c~q$7pVhMs``=7z3b(7Xy{)s^)i98wtnY|t-Oa70xA@f47G?MD
zzBp;aIfIs^TK{bSzgZW&_UyMx?)%A0Yo9pz)W^;>7d^8z^xX08@`i<#%$tL!e(lnH
zXS`tco}>%sl%kcS1eQFJC}5cW^3mN7e}%l_maOl3+CNis8sDT{EA{kOe!Kns`FpqX
z^XKlhuKxQ<<`tJw%#wmdHSDS%->?7q{<8YZr;FYD_tpRXcK7z=@Wq?Mm+RlNuePfy
z{>1kxwEF+gh5xGlmme)MiuW)6Q8%&f#_l(@J1l<~wABClQtW@d?&q(Yzs2*O@+Yg+
z${&+|#k}T5d;8w|vVR{X{3!kZdcDux&)@4CUd6>O*t_i4b@?ie2QSK5S|2<xXMXf|
z=k0I1&av-*{A}9OB9<MT-a+D%_u1H3J<8{KDkxKYGR06<@b8O*uVfxh`8N6R{YUZl
zN`8CJeeQm;^zxcli;wp&f4W4DY1bj4X`9(TJ}ca36LY;kzw7CiJuBt?KmSS&UMH8n
z`cYx+-1E<Wq*_{s+~-%{)3ky6)3O#b`@3(#e=4oEyVk$N@yKi`zRRyw)~nytYB#Q)
z{A7Cr&yMNKpGuV(T;3CvWx-lfYB4WS-0zd-+}Idp##d?z%R(fp8ZJ-gPkdG#dh7Rx
zhp+$1C7iN}?pYqW$-?Urzx<^qua}sgpT76#hgDkFSKpglCogB~%Qs2A_J{gWDTbB#
zU)co;0(Ca;ygc7hM%CPPuKH=4`9=0u=5>}nSsiPA>HDntR+m!_&R<$x{^4z%{?nUm
zT3gpm`|(MzAiQ2Df0AmR@r<)Io7y=2Qg#Z(thbsewpsGhy25*Rp8PawTwCdV_HXNS
z`GhYF@g}<jHaIJ-KD=pH70-feH)|^H>O9-<YI7j#47*8czdU}3W=bCNRMEKl+F0$A
zX8Rf89_PindneuNo1hx?)Wb$ENTX5u-$#|bM=T@t6N^7g3h$N_SR?r07*ADy>hhm+
zPMv#kf7ZXhod5UkK3@O-<@|<}C!ekQOODLht1G)RCv$U@!i&Q*uk+-dT75Dl<f`_~
z8Ku9s<urt=l?iF6Z1&x;xa#kch(ley-G&BD((4qi&U$@FNBQE*U%v!yFDx$Nd~cjE
zX|3&#QnURh&AwjWB$=HPoN%_GSTBFWqbF92Hw*C@Jh=Jr2;(Z_vy-Lnz1(Y+(z818
zOTn2Zt1Hb;R(D)xK9cj}c6q?1Gezs)DHo+RbSwCT%zx1EXNq(AtR%)9m!NYQQY_tk
zf`P&}l)}%N`W#%8A@|V7?D_%S*y#nk<fUbtmz}7*xwx%@z2?*^rpi{Uojdgsk26i*
z)Fv1^J)5CPgj+3p?~*vbc9ks!obUMZ3R##R@GOXnyqWNsB|wO~dCi6v)#m1)V!jQH
z+zVpQ)=cg(mkQCBkK@hUQWkyS?|OmVCOIrqCrU7`aXsgKs(F{@v*H&uW~>Q2er$+2
zo5FErv7Td=hgijr<{FmY){0GYPyCPzy?K_S@!_kxOV7{S|MMTuxxL@l|NHy*b@}=E
z4~6Wi>*~7d!xbtX#9MHvg*vWL`j_+KL;Ji-yUz;kziVIh<<*<3`{(v>oO;3k{(Rhv
z&j#T(p6hSz{-I_0Yr~#9udR>%ulclXsloK6b6pNkt8H--&Q*O>oVmS6Ai8go;TOpV
zHS-V3m4BC<u;j~Oqos2juf9}#`(;(s6`#Q1G~b3NhrT>`bM>{Tq0Q+(Z70>PxOs&e
z&ts4>*SK^q<?F@8?&TcfX^(gd&NlFEF!XqID3>dj;n*FKhLe&e{Mp6_m3%!{pELSY
zQ9D&(KG&N^0#%ECho@GY*`egxZ>{^g$6P|D{kUh1Xu_LwHmV*>lTQe}nCbP!MfJkR
zFWS%3&$G5IcdJ_B{pIWxD;5X&j`-Rgzpm%kao=!WDjU@3->~%e-ie1^#wS|Lf2#e!
z>GRW+Vmro{_Uq40+x)46@y*+}57%coN-^FrQn=!Om4&(MT8#3^V^5_{DkX0W*rY5l
z)kxs_Y9@~$yC&Xhm)F|-LI?h@nHh81Pj5A^z?m)uZ38ipX~*YHQ^}T5RX@q(C!n%+
z!||W7PStbF7k-)GeSOQ}uU{_8we#9E*7miu993IjH1XSmjFUo>W|SIl&6}w)d5g*U
zY2mNmXr<d6Tkf#CWby~$^ix@^YSYwD&Xm0oR>QWVxz^m}=_%H?K2Kh*HTpVnBJ;hq
z;h*PtXa1|(q|~G|$*-!ibI;%RuD1_Ge0X28<7<GRa)g;)qPML2{R{jzHa>TG-8WhN
z6=VL3$4^$;L_E^_`E8=Z7Zt&_&MRpwI^`F8+zv3GO*ar*XjZgGZsj@#ou6h$<_R3F
zWX+wS+wir$BxqNE-6e)6x0P4tW_Zsk%bc+_SVAxSSFP`&XG;0&POoHZK5=38>&W9z
z8yH`#6Hcjo?t3`(!mRj3;S4M6-ZnK^OgVjG+11hp7o#Jce-yr4l-;|M>q&3MqQv4y
z&kn@xXO1fPW@WVW#w(fVrIrFS4p*7#&yt%|(arGC-GOiC%o2Og-?HzY$Le$bTD-3O
z+lBjw*s_mm+^KB}IrLuU=OklKrqUlbUM3v+@Rd{7pi$E4-$7deb{CGqyvUEtxA`_Q
z_4fv?Tx_#Ld#lt%sROEq(`p$UUWgT*uTi>kmaWlxmc@$Kf8_oZRNWGnTE9%_Rz-N!
z35$br8}bew4qoQe<GgY0I=d1Frq#Doyc1H@nfGsL54v`4hE37EH_q&iK}#mfT^H?B
zvU&OXiPid|q;q)zS+UD}i{{oU@hR+QJu_G2fI`&-mxI1NswUqrOZm-TsU&`4Zuo3z
zme>6(Ei;oRIUe$R&u!fCr#yJ=$0Lb$64p;PcI7I6^JF|TZBb(v!}n%A-o&ic%Z^pP
zWHc9?>7P&;euh!+!x~n*hlj)E-_>3JUGTZ||KY#yALPvV((F}nin-sllsoOFgyBaS
zPqEoo)p|``X0u2gu8R7@$K|wtAp@i9Hvf-j6R%gM)g~UE8Bupq*jk~FQ*7&s8Nc%x
zJNEpSiTvaHeb<{^W~Xgr7Ef$F{B5lpCu`s_&GflWqFu7NmxZ~MJ@r=yMljxTi8&GC
z?UCqSE~_H{qqaPJTj-Xqi;+%F*9<SFeQ#B}sLQVQijis6k>`(DCc3|x{Ljf`l4)T1
zjJ-?}r&ZrQd$P)9=SCJczZXkxbK3FBU1;v9o{-4D!N@d!tJj~@3ojT1<5x$NyuK#M
zoEy3SPtxjH_YTW1YSUiy$+OCI<`NZeomc*oO;)(*eB5YNc;|Y_sRQ1>UhkV!%qQ-<
z?;+3mGZ{ip(vDZAIE32Go{~M`p2+VE=C?I3<rDAh`ft+ZsH|qA5YJn$)1CUhDXwVi
zs`As^Wv>m)J#_eZ*kZoL9@rr0xMkMECGk2del?v4wVNY)TC?c-lIB0J-W@)B@NYe%
z?_SFn|KB~b-@ogR)Yo@$*B|}vvs-Z~S&MIr(a)oWML(Wg%8{>ly-ua)qjsQP#q$Zl
z?-))=K6MtiUj6*ViTlS7be$`RpOg04a?yd-54#R^Nqh}H;p4nLpI5u?jlk)}5}Z3_
zrR?nHZx2s55@G##c@2BOuicFcADeI;yVh>;LFxTMPYJUH;rsvp%-QZ#sHAY5O|h9N
z?a=KoRfpL(mNBX9D~>!k{dv9JSDx*M%hjJ}gzx$OOyh;ug3LV0Fol;(;zdtSd{KYH
zY{9fu{w-{E*L&U_HA+3orS+ooL)emzt<gKSOuK7exp;1w$O%1ZAFc9R50p;NU8rH3
zcJh}|LV@fe@p(UIE6w+xY|<NUEV6OyGY&B|Q`;k)4Ow2vYO-&I&ZcRK`MmoQSX0l=
z@J@E7w^eIH;klJ(H@MHu2t977agMdpXr9?38TIn-Cm$-_zRbVz#K-UevFMh6e361z
zs}*MMKl1nG_XTsEU%$Ei{=ehhkJ6#X-xMa9?kL_m@zR2%`Q<NODs1vxbI;oP?EBgp
zrQK>5Uj-BduxYH^IX^e|%q5o@ORQtnyPkY=+$kLp*=fByjl(MFa@yOF+`nt~7VG?D
zk1ZB830V<qdwH9HpbA&_*>cS(c{3R=-g&@%Y4*gUnM>9L6*-A{uUYt|fytq6o00EN
zoA@m+Y<1V(QPtMqn!Qcw`I)lxWS&)Px2J?^TwKfHy2)qGy;DzXCa0_p4ZRn1Kl>R|
zkbs-IYG#w?OYY?}c(bGYP9(BFS--~e*3C!V3TFdPy<sbvy5oP+r7syD((b+0O*;Kb
z&rHG~<8<s*O>VPQNhd5d*4!6W5-V$bH2L%i3%wwV3oDnbsof*6fN6S=MPlL6-z)Ao
zW+g32RpycMbGT{WFZkUl=&{U7?!D_p9>3=cXSTLstFw*wn;31sC8B)!mnT(w|8%rn
z*&)VaY98_E(MeU=?d20Uhc!NE^6wAODX<bz-JQ2q-F^DSyqT45-1+@-{FAtE=)YiN
zm@T^PxJiJ=f@F_<5vH?$9Fh58@>;oV!MET2i>m#teFXwPROYZ=4*dO(vHVQ2LtRjH
zuxQw~tfd>)zAB$`=zvx~LvPsYwiU-J*IoJ66uqQA>8@d2Xo#nrICq$eQpYce@+Q|T
z&eS(TyOhps4i;|x!kxZ2a#i4V<&L?656?B%CH{Yx)Q~*&?fhLER{UL4H&e5)jHkHq
zlb?z8kFBXC=SsHmoYP9qIGpEPygF+CBCRP>2KS^n1^;}z?o!yhysIv6q3E8ib(I%h
zKJ3W38e!neyD07QOAaY9o7Q}{r*bmsf;TVDeWq!(Vo{}**?x;X535X%E*9VSeY>yL
z)b@9UiOUaX?ebZ_e@%APFZoOM!J79xA2^6zay-JCXkhYOVE*IA#{#mmKmL8vvZprS
z>VHmiZpr?73tQV1Lk(g5*qkXoM{;DR#d}GvwrP=gloGqpePh`*IVb7T&TBbeX0A0a
zb>=fza!+OXR4Mh^U2cz<E+5s?(iQe+E^B|P+juDNmvzpmi<9oOSN+ZFcxZO*cFVpP
zw{I5&YWF>O@y5_I(Qn!NjNLO9$f#$wPttB_m22C!zL)vu_gix_=l!iUX41=BI(OfT
z4GG<cIK<LbCiQI;Ts-%D+~1PYSUq!1Yk`R|y>nuUJN%@U?of<8{E_47##Qp6wi696
z&gK0wHBeznP}%Zbe4Zvr^VjaxV)(kcG;ikY+N>%`iBx;;Ma6!Rr*miD$!yrykuYES
ztyIYW$8(nM4mVzL)xXYrR{G;_X&&4!vu<b$&p0CU?XAjs-d!vv7hD_Sw<t7dNjM&z
zaJ*Q+N&5=_l;XBuM<iWVZwmgr`Replug_^dUzl;`veudu!8uRQw{MN_TD!}iPyhRc
zdq*XXcuzlc>x1nZj#>ZofBZjCyDmFo$Kop|1-ERPop;o%`*88c9}X*3-(HfaXURES
zQG0dv(&f{_O?=rn_f)XmW8GZSf2AZ&Z#~-u(K6Te+U-v9VMQ;!cF$<sX7|eJ3iB7I
zCpV^A&sp=^I{n?d{z=xM@9lOnf7$K-mh;jh<xkQMvXk=f*aZl)rzJkxQJDRhEt~c9
zs*}sbGQ?F&HqW}=xh41WI`N#|4_Eqj9Z8K|Zom5avf!}wrWg3Vjhla;v<_J<V!Hdu
zLL=6Q6;F6NHP>+5y8PioOp1JQ*nvA!uDWZq>uhCBF+DF8B7N-;x8kyn@V(R2Px9FL
zoI7ba``n96MxBs8y;|SM$O{a6LgXACtNxsj^5W1!nXQozVwwGVx>uL(Tz7GA!UP?!
zic=r0Zf=^H&n9*z(^Gxhk0~0{g?e&Xe(v066C}j*{$PPW!wIwGE1RE41kTtfzGU%a
zrplf3B)(m6&;9fGcelNtY{;t)DFfcQ+3WALg*8O@_GDh!_pU(2AzzE@LW92aET!A(
zw}ToCeU9>9&)M=^(dHP3{?@b%)AQ3eeZD9nnzYh2x0!jZxw&)wpNQS3_zm8%e4p@G
zk(u>Zj(1mv#n!5+&w@o(@7uTKtS|5D9dmNDL$~g1nt#`+eg6EkwP8Cgf*nL-x+AJt
zwQ|m|tV`80f0a3D%bZz!xBG?KPv811d9=>(xDLk;J14^{GnSr|70z=I4tJe--^Hc;
zYN*v*<-Jo>m9E`>Clneem(Xyt-evlyw8=4t<A152%35WoQFt^_OfF^GtEMlPc^bbS
zerdU3TOZSfpfk&E{OEjG{%7v;7xQDDPww{;y>v|KF_+F_oA3>hK8Df#;?HwxV^8bU
z?wn_SG^@|=`O^~Hg$v{|X8)aj^Q_Iy-O=~n^9su*IPBQ2d3~zLiuQL`e#})AJ+evu
z<JF@K7t?=weVH01xRB}Rg9Rs^-3p(3hR^TLsrwoSM3Ni-yO~~yms4OkYI>Ph$l7iF
z?9Od-kKSywDY4mCd~CCO!S}u+KArY42Q&Gr*WJ6UcWwRqXgA-zc0tU4xhGY~2$q=!
zPGfbMuNKdDqcLvIo0Umx=YE-aJ7KBk!b6h1)$+cxY?WCB-sKn@1^X`6JDqkUaq%<7
zUSZ}1Yt#4Ki+fuWwSjwsu!}bL2BS8O$Q(7($v3AyR`%mJtlFcczSz}lrB|6!nDLT`
zB~l**1(+)J%zU178!G80x->G*R@KwAww`q5yq(}7t+(DqOkC9gxsNjA)<5WwF*M1P
zyg%z*&ob!*0gW|#&wl>FJ>i{37}MHCdh>3cUjE^1-Lr*Dx2{{Y<?9J;ozpA0PWi7F
z(3yRYeY5uarJHM3&G>v_b;AqBr+UkrO%u<!`<r?y@4Iu;_toko;g~sv54!iw>v9#p
zRC@2OvW)S+&DTpNz4`fSN%vljHG92PlU(E3vt)mKK4JQxU`w^X>t6n+jYZD=5_uje
z#TzERU6#VVOD1AX`qL?!gm_|Z9h>!)Yi?@WF43lE4Ie}PD@88LdH?m^MaDJfbajr-
z?VdXI!|aKR#M88I+@H96_mbGc_hI>l2}jS0MpT&Y{5Csqs@_T2kmdP}GxL-fZuHj1
zKD|6qH2uomf<$#aiH8dXB)eE*d!K#w?+y%{sKwhg^NXx)=gJ2W&fATi#YqU>{gxIu
z-(us<%bV;x9oHmm^ejHIrFqq)sw06jwsw8~&=s@NM0W9Oo95sS<10Td`>nn4Q~nR@
zJ^yL*)fDc=PM0q(F?BHNuRCfWIX@>aL;hcUozlrnwqWb_`4WelgiP{27P$r<ZBVM&
zvuuN5daC7_w$)pt*?8DCXMWH-P*L+}-WsdxE1oQ2=w752pU`(=uIkGa+p`|xe9;WT
zY%1ZOi+EmaW)!qJf0FTTQ}K#gg>?>6(fyj1OlvuFW&ZuD*gEgL{Qqau@7Ml*Fv~S|
z{b#9H|32q`d%63Ff$YC$yYuURzJ9;&=TmdWdDG36=e(OZE00}R|HG6$ZypBfcnNf$
zR5g*CXjFbArrD@{t$6oYkJWybIUZBIKTXb-oVt`VzCU7D==8TYuI~4!W9c($snpYu
zXj`N{Gx_O^XRNACLgu+so|G<G%C_{d>O{{ItBQDYT-Dwfww_a(W7zX8dG4RySSG&N
zDNT|&|I$nZyQ&wKZII5KnygY~=UdwU>gyA!-xHD+=yAPD37U02xcJY~WQVQUXG$kd
z3hmx0)0OP7ApiR5@<S6|Yw<husPF&vRDbbh&J}Og%vx-$Akdyw+~c-yv1s;o{}&o;
zyS~eq`{z&dx+XV6kcUfmvBcqzKIMM5_pf*t>^;%p+YZ*#JL~-KbWJ-Ybkrv0W=+bg
zpY5IPYnfB$N~|dRJ2}znDM#uirnY5sVxvS(Y}?(sUw%z(o1XIIv@a`<Ee_t~e8MgJ
z(^0SM1>a82KYz2QG0?#D(+i<{K8(^Q_smK89Alp+^v%^o<7>|?m4!>rO*B%OG_`5_
zY++Zvp5L$2*O$JCG_{>G<+9CAy|oRp-k(Dy|8|`G%<94YT<1cv_GtkoiAghr1F!rI
zbh@)_+2U&ol@@h>?ntVcd&#MHuZer0sT}2SXUmG%MMtzx6qt%EUC;bdj(K;*VyEny
zlQG#Ur5}t}tt(k$xIlQ@G`EnD7xSZZt|#`)ZQ`(QU$Zpa)ypJ-omH(r*mc7CYgbpT
zDb_V#siM&Q<Sc)BRnJWp<8@PCug;#;5b!@k(R|(pTj`exHIkQBs_IzEyg9D<X3^pJ
zcDuP%0UA+StuI!nnaXjnSom?><7{^>+3qa9-G7d4pWswcwL<Atsgdawlb269pFWd6
zcGcIN$%mSfLng~8GtM{Q;=5RvFhTrcV#xaR4e6hLDIJ(}x;tM_w!-P*sj7}iEZM7@
ze48e#b21x*?Yn+I?{;Xd>0b3F@8)f6HNw&c^FoZvx1}$7|0t%(R)JaGiDk;(PwPz!
zu0Q?oYx}}HK@GmZyY+=}j3(D3`Gi#sE-ty8{O*$B<VlRV=|&sFayRX*Y{{E3N5|ar
z+Jh?QSLUbMTZL{fxOQ;W|Fp{tfo}U)?m2NEcqla8;B=Rz2di_6qnpGu3#ZlW&(A1^
zY*4=b&9!oNkGXFjC%@%N*0YOT?q5@AyRmf5<l5FkDYdJQKJc!cy?N%R+j9<m{C)DE
zSjrBM&Pj7QRVN>DXYN&+etSb^k+JQ+qB$&U8cc1sxtD%>W?6N)fg$kcdER^9b}Z8B
zxb^vJ%bv*V-bGBWEO#(>7f;re-nJ^St@lgl$u8$qi{xihCU;Nxl$)9C@BQ)R#rEm5
z(_Ozhrq?H{v{$z5JR0H6&9*$?(C4WiH#}oLY7@6$>+7zN+9~^8_iuDvZ2D?-2J@89
zMUniIr<=_C>h)Y<rNMQ<zzHJ1rt`hcOgJ3m_e$){i7@Vor+%m`C}z5<a?8QP%$b`h
zXS1}$72$JVSX|c?+r({JI+>B{#^vlYH>L&O>#6tbO3W*FHfKH{f0@N@8fT4;@QadJ
zNp}*X(>D64PqFC!rsBhOxq|h6nVtK_1E*FWQ@8drS(dp_v|ZNs=A$ov7II!$rl27^
zb6+x>@RP38tql`)7@L1^mvt8nZW5S0>Gh49oyV&G-;}QVyYSt2y-kPr&zJc(|McQ+
zetEh0f8u|*>wg_y&w3%eTI^W#oJAWt41D@+6+X*JSzB~Xep`Lj;%~s;cg&x(5_#`>
ze|hrko|nMhY~DcmEt?;`-tqUCjP1Wl>t~nK&hQlMF{@kBFvlr5Ny=k!%BE!xEq!V)
z^gaKOAmf&`;=K4qv#yudXC=n{_$>5IX-@d0M{B1oiFt0nmivbG@~2DQtZqJQed&#D
zFxSdrGudEA?^g>RKfV!Nt#{SEJN5%p=W^Zeh8-)sW%qANnKMILxN4V%Xpd-=Q&79D
zO{Aiof4kAY#ZUTnm-xp&c(^y$BbZBVV!7H)F43a8cN6_h6^iU;nQZUlnzA*(t61Nv
z>i^ou$5I(T%{a4v#T}{HF-MwuICxZVFN%>ok?wc#VB-_Pk540{zg0hQTyrs)>8Wbh
z?imWlCOtl1r1f*}hw#{>HAX+r>PecYMHPpg(&?P5xnp`ze`a9F{B@z5I0EgH^^aE;
zg(jHU@f15G{&mh$d+7XXSHO?<dXHFx><>+$?iO0=^9!#WTk|E|y0b-G?8j+~i5qM-
zaFi^VCf&i+KRG-y%k9<wyMGykh5U*xdDw}$K5Y54bOrOdwMW+-`rO<1eDf~}!@S4K
zeLp|r@z0Lwo#pk(_hzxm?Ac#GXl-Ku&+f)zEdM>hsxLDC`o_MrRi{IP4|`4%j&|Q<
zuGaMKWzIR<1AHquYIa%wT_Wgczc|^;K~6l@VxzQS=er{&SJl*xH|^+iS)AD=vtPu!
zOtop<I(3yliznZiV{AL=%9J^0l@cxluUyA{<(7~no14P?lq0e$;vO$!emAYft-I3P
zfamnGJ8L^KR~TwPI-cappc1Iuar3j~cXg4pvnDIoJDauy27fDf*LFd$zNzTewUhG;
z9X)o7`H3%ES}eC|*?pF|Szj4XO%pkOt9Vk3)ziOx7q&J1uh#9qY%gwl>*IOpglXQ=
zt~b|mA8}POzZzwdvLWotDk0vlS5_2RrZ1G4>z?V|z4^<zmml{E?VEh~@)N(a@Ai5h
zsNi<ooM;gLCF8T7nZlwqqW`|6{CNE^*e3Sk;w4_Wnn!OOU6RgxJ525Oru9x2lD?Vv
zY|ne6S2b~o*3t}im$$6}jj2E1ew_Spa(>(WmXk-yt{Ft!E)g*PEP29g_Y<~|h5Aqb
zn`#{jJGMUb{em9$b5cJa9$go%YQ25Z({#5f%{B~^Y`<+wJ*?8_ANS?g_v+h+%D=OE
zZ!Qhaik|MW{>7bHH?-VW@N7R^t>*q|ONIcSoMu3Fv~3*2)D_;k=4#3=HdB7_F-(wh
z*WP9S=*Pn+cA{*Ie2b%fj{MxnXIiza@qoPfwh+yyHLfooD~DFQ^eInC{OH%btNsf|
zsY8Fv9zpfS4xu}N_1lwpuZFL7KXz@`^Rv?qP6#{~^}FNv9PW0JZ*rC;ye!Ha_kMko
z)4F#`4)Y|X%bUV1SLy$Gquv!dH(%uO>P(rXA_t#bjHy1bD7NijkcU&XMu(ci<W@QE
zQ_CHG#3@C0u}%3Y!y)%;`sxi@H$IAlwk}+6I(u$NanVla`WMNKNhh4&n(d#lid*%?
z0ZGUHsdtYXGOX^O$$wUGR;{-1)z{l4Sl8r5Zj8!m(pk@GwqWa(drLoyPns=S9eN;g
z<y|L}vVx|48|q?xPu%s|^;FlASKdAE?wyObt+<&_Z7P^^YOdsw8(MR+J_=s>E3!FP
z*gnPGmvOoOWZkg6wi~UoI&*e?m)!B6@3XM*tL1+^N-yhbgm3>K<+pspo#~}7dvrJK
z{^HfM)%uG!<J&hg+pJapz71P&{(|)e-bcr4m_0H+zD$<TpCf!TRPIuq&K=FdmBoym
z4l5p9SFX4*GpSU=<+OH1<U*rrg?LkM<M#P~n)bbXZXi6vz$tE_cCW}67nPp17kv9)
zoLW5Lec)bxRx|Y_&uuGT+<$rQp88(v<-5OckbWQ1|Gu;B-p$(G;@&SrJS$5oQ#wn8
zr-(*7sx(|X5S?+uucKb;?Qui<zLix{KSka~m}H+RJYdLEzWYko>mM&q>HYkBGd|wV
zUdZyF+V*BY21`#-y8zE$Cv%LCb*9dre}C%%mtc{5*^~ZsynO#UN15}_)b#fG0oDB1
z0y^hbFH~5O{y=T@v>6pvwXNrLOuBbG+VP-2bzz`hP_Sdv^Uir{mxO<wx#_pM-f!8-
zysGVaT|f0ge%MaCJ@Fc2c<15XkMT#exY9V4#T$<-&BzEdTs~*Vw}pBUwX8`#F-7c?
zbzOZYA81INBj&fw@cP5I0@D^uJUeSn?^^{9wTzB^Zl-1PZi_jDaO8-jNyKQJ<rQBS
zl5#R|nYqbFiHk;>ZihDB)HMF(l~`0YO<?P;pz>n{^7oz@^E^rYDf+{q=*sGL!~2Tb
z*8KJ9^;^{U|N2@kb|Cm#=i11>oilGt>o{>{Q}>suEz%WFXMdUfe%`G^RqMY8TogaD
zP~AW9o3GAu+pm=dCaNC77q2G1=!;Hi$w*36O}<>}+^}@6(sr@!3j<%W>X^RqvG;E=
z?D3nx%_+*OP!hkS{YiM(!+SZGPCMSoSbh6VeVy==|7K@5zjTh`-0|dU$(!F7q83H1
zU0PZwTV8W`@u7CFd3#%1`F(jNK8s>1|Mu-$-Gwg}2eaBGJ2GeQfBvR{$;LuU`eo|@
z=~oN-74KCg@E$sqpCD7Mtlae?NN&X`&t|@*fysZ*om2R_>{vjvA8+&PbES^89{M-4
z8&+4d^L)#;h&{YhsN}8QrN{{0#^!?@e{|n9E;zN2hb{H)$;n+$jQ&Xc?x<g=P+QMq
zziQ1bo4)hYx#SiZw0DX>Gq~8ZZR@_MlI|TbciQ_k+-0iP%lzN8J}Gs=2Bz4#3+|s5
z*s1Haq)q13<9h4*zpt*$IQ{XLP09NOU$PXhotDdSEKNHi6Uwpsx2$S@u7AVQv`rQr
zoyC`mbNLF{?s3eGx+!?j_n*_h_e%K>9(o@4*p_o7v(airxBZz@UnJ|=`$U&HUp>%l
z-LP}!+rSrp{>sK(+I;+_=XIGQr&d1rvUFC1^b~Vu|D3nSF7NMAnkva~ueW(akjm~U
zB@c|&e42ST(s$ke#MoQ@e#<VWFjd6sO`4vr@9{fbuia6X|E4$BF`=xe>~Pg>*Vo+B
zi55BF=IF|DbZU!WkcDgb8>Mx}RkV(0b8R(yQhFohtNVfN9gi2z3R!%6W1hQd@G^y-
z1?8`5tqj)Qe0JcPS&57GzZ(m0=sZ<jHq-oR<?5a*p=&Cd?>x+{dg-$N{h2?1+>Um}
z|G3GyQ_@s_?H|UeP1pGU)X9EGFbO%Wwe78l@iO-NDIF%$ty2vR!zA*~zq2;hSruD;
zDEeG@XoOqX3~SEp(rJfITK36J`4Kp8@*RKex$LvQZ8>{#?aNag$E1!PYI!WWw4lC2
zuU6t_k<LTsqNG0)CQGC|+0v3+mi4W3%lrOEGdTIyAFvQF?7HQi7{waf(9oGOU%5<I
zpZ}ZZWa)W7mSi?rER6cOURb|OB=B5RIEUp#=d>!RFa3TtzH81#CNjEyx~()dX-#r?
zD>p;dw&p#BN(poC{ZfA(|NqzZ#ZUCFOMg^te0d~O#aaH$ZOuThc??@EN+$g~XZd$Q
zdQJV;OLBW(u4h^OGkw}>F>!_F7QyO_?Q5qz{kGXS;$C#T%0d4ty|TMG?+BL#N-eTm
z)$oI3#*A>Mz|(iWGlX@oIvvI2Dr35Jnn#+kv4_(XTL*uJLuDV-T8-z&2BlQ#E-#wM
z68)C@{L4K5FBTtvbsMCbytvue#IWqF@~vw<C5KFR-(R-9c585(n8frf*Jp}RVy29f
zOG7tnP5g9@h2`Kuvyw+mD=%C>${cvMLB^~8#5{E?gS(zp6~(dVrq&)jzg^t3M<ZiJ
z-Zr(mXx~>qO=UuYD<uv)W`8)r__CAdWZ&elji&=tZZa)irc}M|W#7k4{au2gi);N4
zyj`T*AR|_BxZOB&Q@kaMnM0{7OWESh`jYAKo8s4scE0A=`|Ee~E8gW|O6BEeZa6<z
zGfI^I-23QJ?)Au{uQD}k-|kV)k6gd(@#kN!jFde&5*_ON%{;jlY){K*{aAL|O?1^o
z-h-uwHy&rWJ+Gte^@WRbn%bl7T<slSX9!B^e0i&=GULP|0oN7#desj7S+F6?c)@KC
zDG~NAv7!kUx40Y2B^4dAG^>Ktc6?@LbP0Ty?!HAodd98j$<wCZ@L#j<rMK?Izuoyp
zW`B$xN_k7qS*G=Qo$GD?PfaR`6CGP7Ce<=6?wSz3b62jV_PT4Kc1f(Cie5Pi8|;x3
z=<>JP%e>-QX6HlxohF_l&pJ;zu^u|ixuG%ZOx3PQyMKvawT*voowok!S*>#QLz_(!
zq*OwZ&Ie8k;n|eB;n;CLqs)*w6HoqW^k7RVvW(L2PJ5hi+u>N!*#_^MKTAtyrEKhb
zdb;4*@`64?RiW+r1t(A5GMsemRl>ZkqZRvJves@r_P+JT<j!M7H<jvZEeb?>y49!8
zxL;$Tpa1F9ZT1!7hqhjwsTMb9&##9yB~_nZ-F@+Q_2%;bf^$xUIB)X(*>nEg#qLWl
zIeNHr9u#@3+!vA%)AP(V%}H*Ne6~Q{yQGfE^@?7TMY_BHT5V$b7E<-V(W(6YBKhjI
z2CL;%7<20#qOPhaF4?--BO>m_$2T0elJ8zUezS19`sK{rU>QHn6#oWcmE+&HzBCBk
zb6as^>BAqE!9V$93|7oOY{hft{2w{r%7<tCeyw*(IydjHnQhmL!vCT!TiNnA{K$Qy
z+ZZ5g|7d+?&A+KRagN5~UzkG$f9kGE33~GV@-&U@SJqgCw%UGr|9<}E*r%_Kh6!xi
z7qNe>M}wPgYwUH6&#&#eIPWep$bFOSR9dw%?b5YnF`2q`JLarAvztGq#4@#4--qq4
zI9I5d2dk_0M9t(Cic5k^vRu>m%WboJaP-|w%k7a*vW%q8pXR)GiQ(^}*OE*AHEeHn
zo?rTMMfm%=A}!BTzR|LaI`)3G{?z*TxX4ilm%oQk$=PX!OP~L4x5A^l>HnIGO9S>x
zDy}v-b*$9#x%k=Aw<YJSl9^e>thFBqT{!fkef_*U1&d$$vPF2l7MUgxns#c*<!gCH
zc@G0k4lR(l*5}5f_D$@n#mdDI%1`Ic&GdDO*i`NRcF)hC_851rox6o6d~p((vO~)B
zXkN~|$S2Qs9pAXb>>|Iuz!8299Zt)fC>6OIAqTnL=N;_tJ~QXsqF(bS%2RbF@y#>*
zt#(}VrS<LtU)J-S?VDPdn;Ke{d7eJwt0(=9b!FBuy)RsGS_f~<G*e%%KfUKdZ}$nO
z{C4pxg(rHd8;)<k(%No*`*z8x_L-$ETOCWea#r1qlwOyxuEJnVZ_xS&zrAN)wk$ds
zd!nL5-jLtI{@LmNS2`SgjLRp~v#scw=zKt=UykVt(@LN1!LR!M9=V*w*LGsvBPCOH
zm46!B)FSPDAI*s>wBM#7!+bz9|9oiA5@80F7d*x4Oy09D>Z<s!Wxr%|x4k2}b+Y6t
z!&43Gb_bP}-eNOqPMr2)r`!tv@X(K)d$YA|JbSgK{+Jf{)3B#I`#M|HtPeN7>K>cr
z$GSCot3~DeOD%qHu5j*;(!brH&AduCZOha0#X|m(&Ck-ZCm))YzmMg6iA2<jmQ7na
z-tzuZ+;!hCeOiU6pW5pk``<R_1ev&+>Hj--ZdL{Nbp2%?6gyAs_I26m@WN5d>h0C!
zMaCDB(xSKTXukL_d+%PYxF@AAp1)t0UfX+8S+#QJu?{}(hRKhWF2#S%=<<%=zC|m(
zq5SYpq3Nd=EH`*+yj0q0xp{Qek|`NNV%}l3Ch?tK*OUx@ztLO0H{8-#Fyv~3#U07Q
zMQ?w}mCybYEw<OnoB!?cHCeY61ivh1cw&|H`sJOcUzu;O$nT2${2*<`H9p<Q%Wr4s
zig>Qz>^9_|5ms_&P4YkWzMLZtw;~&p?Ddw;J>YccHQS@l6LrH*1f@w#)%J*w+WDh9
zs`~azh553)I^QJjh3pj5Wj*)u@#SXbyVZQr>PNrspTNpARnqF!HQz^zw``oY@?b{T
z*2aZvy0m98oZggh>}l36>(a{`?|Md0oK?iLXYS&_!Xsi9bDL6@3&#FD=+G~_Nupr4
zb^oi@Co8VqJ^t2*Q}DuT%Y$puO|3s&*qRXe>CGQjkH0e_-<-c`^IG|AS<#vbm!&II
z&&kCebC@IZVoB%n6-f*>2Co<0?wVKGw?1Qcp!p6aCpI(9>0hf3@_9y7Iz40DH<4%F
zqp3$UGOicRW!G}qob-~hSfG3X=aN(rhF|&z%U(Y{o?5wBRr<zk^SlQQ-R*{RQ-s)F
zw@emcSv_%K#M1d6U-H~lobRV0evR+*_x@MP<q1o?-G03^zLXcP6lRht-8J#rg8OsB
zcIbIrJoxiuS++^;3Z9d5c11_CDYF+pd2oF?cVW;*)(1-J0vkoxQ=$%KWQP6Ls<<$r
zwswN4lW42}505~liqO>Bh3RLXN$PT+dcR;-?uK%O4i_J{^A9%a<q3yR7tnkyIx+Z%
zk#^|?o%^f4%=@KoA@kOMJG0{ki6d)17&Ol@jNIz8$#B_ht!dMecbM&6$Td&BM{~zX
zr8iy`lFxQMs=55{o%Euuch6sQ5WNu9_S)ILZHm!Wv8Rr!12sBCOeQEfY3)6&Q9t#S
z(yJ4ZFO##rwZFc4$}pf+;Kd}qACp#j&tLQEWd3CJH=P}o(=IcdTC{J`oekwucWkS#
zevY+!Bm3)~PjRnh&5KRS>k9b`9y|7NI&6KrWW(lnDU1c-3wDO2Z=Cu;|LM`LSq43K
z`bxr6H!RREnDQlvE5e!GNuq1}d1)Jkrzd)=-W%Rq{Y~}qv9qO$*Nyz{8YpD{Ufw4A
zCYE(KC;yVEM>{lCLl4Nl^48k0I&9fZrS+ln3-A3gYd`7vcxU6}!)$F+c`fdKG+}S+
z$$6IeJ>$YD(TlUnFWb(y5Y{ce`^9GE44I`zpDHaAn6mcSa^9VSMO$}!v(`oVoW3(<
zozU0GmqVuI{qCBVIc;f7;oY|iACo!Od~<o$cy#W>&4s#)>k@dpO7!mdElBS9;yA0)
z<4bzYO>1^n8NVFE8PTsJcuKjlK5V?WwQ2eap;+#l(RRPGYjk58;<MV%*k4If=y6S2
zXP>?<NqB$%&i#$y$6kb-3v>H2UB6;>08{swtwD>88aZzSJTI8I#z*kQ>ODtZclSs&
z-YuM9a_0%_vt=UnO-tC>@1{)PNxxpZOt8c?y4Y8oIbe+gi_PS+Ju2surX8Abx1)RM
zJmv15M1g0<x>pLaypE|XX}8l1R-4-u)3~;|e*UMK6Ut3biXWN1;z(!->)epo6zPS#
zYKooq8I-Bt4)pmP#mDOYlT~_qirfBtyS1tJxK^q@y>RPDzqnVwHd`Xgx=Sx#Ux=KW
z(K^+Mb+=XYfh!49FaNy1hV{qnFRjkmzQ><VVOz${a;Y+MT^nCzzT(>=vmY!`?azL?
z%o4797M0fZ{&bl5OugxgEao!isZQv)@>X%(gJb{BSiiZc;p3BUa6Vb#=eKsoWEI_m
z8@I~jHSbf4vQDe+OV}p%YtgaGJ4(2IJlV?AA5iN4(BN&njNQ(Vk4dg7?B!Oz%9hN3
zb(6NHF6p;AZlP%!U34i(#=xd8^JggUrDGq;4lId_xD_4OvtMYf!v-m~9|zRzK6dhl
z-(=0ruZj3wv})Guvxc(Yg1RoXZ11W*wJ39Ki%=AA(v6~&AKSwH)~*bF-)IrslGlE5
zQNXDeif8v+>Dh6^is3CwmPJ$2wwJL#oUXK<yMBJ+%A$~hNqZPlt$2KGx9BUjE+|P5
zYDm8H>%fx78haRH*gEGMXtcyEm)um=xvetmik8R{hAokKJH4;Ahi9I2c*myEaW#SI
z{ki)`Zd4_Ge(YcN==j11uHq?Kb7qCOPR!8ApDB`bR?S-HfL`~3VEOP_Hv)q%x!cLQ
z>?knatNGP8btB7fv51o|+Vlcu91y6CIG1;!a2el+g5@kqVhf7cf){-0I9byBam$Un
zRhuP}=b4_8?!P3aw&3`-kg|25p-nZm_mBMk&V2mku0xAY*XT?&S!trS?c0rs7vHQ@
zzI)k$FKM4h=ix(YsjWX=oouSRk}uJIZQYHh%vK`Tr|{RU;HX<ML2S;fZC##<oJ-kL
zuNP03KRi|Ks_@Cvaxyc6AFqszmeTB6zc_kY_Jp{}!gKvo!a^8TwmvYoWIf+hW9P`9
zuit8-ea|pY{m_Z7D|$EcU-UgrI=S6$F{e=Qibt*-rz}ho?n$n#kek6;6mg|G>)f4#
zcc(N>FmZJ}wu9ZhvUKC!vYi&QFE@Fuov>?z)-km@HR;mAmohKoJ{_O%K2tq;r}LpH
zyHpqLGOXFQ{NL90HyX#Ho9_RwwoK+WU-M!2+D&i&i#^+&YWw!OSImE&rG9&k&tE+^
z^I{{L{FMti{J%J!Cz}5~cV1<kN7fHB|2Mhv$CU)QF0l*l`~F$#ljTD8#r$<;Q+9k1
zp1NyWw6TuTLsibjuBxY2h&$+iS$8|r`rsBF2li;O=clh7j5?o?`)1-_f1Sy@y<$}g
z>@AOPc~Z3gtoxqrPqfU{8CE{~a4WaxgI4;#&IbAO-L97Q*UnC{nYK!MZ`ZGL>`z~I
z{CvK)C~$UUy2w^x);HW0FP0l_dei@EwJN7{px`;jH&?_2=G{13S~5T6pkCzez2UoN
zO#dAGIY)WZU#mE~W`<xkJtrQe7q8B(*VRgXrubi=Kjqe^T?%0j8_l;>ToydDF|B)D
z(igsf^tRixf+Esa8p(**Y};4uc<rBUZ&msn-N}<T@8{F_$rQhb;f?{@4D~fx`YqhY
z_AdS~S@fFU#<LDf^G^s({loH9p3(EpzTkUb9JU;sl5kVQBQi~7?Tfr~1$ha35@p{w
z$1O6>TKc76lXPN2QlWI>hb0DkSa?FjLt2jfVceb*)pv%ePuV5qtzk8n&gmCNZ?3kt
zt)G49psv22@)pBw`$D*6`y;nFew}mbQv0fDGo(LF+_mmjk%8YybIJA7EkB){I`!?b
zQy2C-E2vvt&|p1P#xG@k<6@gZ<l0Mj9~nnm7g`AazLfab!uHwr3+A_6#IKxr`c3Yw
z`tsLY`bQ4%%*>cCu<~*6#QQ2*_O^3$-t85r_@c3Tk7Hqm(W;U~>uxYNu&Y&H)_+v)
z=Elx1>U*wc{_ba6T&l7oEvGD$l1tIu*tWYqWxs5D^apRn;!Vmb>RdZ2AElXYT;?!g
z#q^{@75myNiV70yYK-=mbp}s+yYT87VK<&LSM|Hs_RL)Pbq{M?_BO2}43n3=il6@{
z?Z=nvAMUT8_vf=;Y%iNozV+noDP}inIjwEKl(TO>T3ui6u;^pHf4oTl<qKOj%)Vr{
zF{5q9@BQ@`_c*5;#9r%AzWKp)=Sk7LAhSIJPWu<cJl^*+Db&aAkoL~aS3f;CnC;be
zd5!1aMVH((?6<F+W6Y_yan`HXU-rFh=P$XPCRM_z@_^ms@v)6>ZcRBCdYp4&rqJ1j
z%x68xN;B&#N*~6|&4?B7{2H+3x$;Kg6YQ)W%$(gGdux`JU$JE4esWcEPpRlH>$9tl
z|G8DWEuVX#&e`J!FTPy**fjXP;_{P!(z+6Eg?PT&*2S^8*kp0x%ZGc;EZaNv^tu&#
ziH;T<uCQ3Hv6^~wrMmfB+lh7ok3z0;E%2~UI9&el>KfnW6Vns&d9C%Hx5U2BRW*rw
zeI)$qf?M*XlT3C0U#W0f{Qhx~^1652+%hi@g$Mi1NV;@3)Uqj{Y%*`9?S$(;pIAl5
z6)v)RYMbo1c+(TZ#*f?;VwHT1OD=4<aB^<soXv{a^Oh?ti?1oZS^lhe#npSx?~2ba
zS{WCZ5|Ox2e6PrIW7!)e8QpJ^Hl(iHd*fVju8QmafbizO1&ikd_2w;nY1qGIX~vc1
zVXwAw_`b8=Y+kj3Gs;x?bIta(D|5rH|2}_P>YJj8LeVT=wbw_beyUE1`f}~yp6RBB
zyKG-p{ZDt}5Gs4*GAnYL{$q2M<jaxFXD(LEi{B%??{GzInn_%O-Hx1dHop#Zm`|TR
z?Ty2{(A8SAO;|fFc-Vcol*H5F;Q6(Bosyf@lpP;8c^Bq(#XQ$lS(+Br)YdyMX2S;0
zf4aY?C{8udTg*Do>}1NktESs8l&?G#BzaT(N!gP?)@^-K>665EC)u2xFxgPEjJbb$
z@r%ZvlMTMUyEez6&U|5um++OB%FasRN}P3u_U|%PjNdIg@w{sae}n-quhi~sD-6@K
ztye8M_;1~T)4Csz8EU<}(*MGx=Z&V&6+OoFTORej^1d9T{op>I^tMCB-Kwq)Zw$n&
z-`~{Ru`0yFZ^Er>uNSFgE?XRMQP%iyr2fZmZi~*$nt$b}k96V>_P!+*2UeYk)&FHC
z9y48AA>6BXT8i(d?|ZafzRKU}DtUuJ#opm6^X)CBjz=3J9^R;I59}>CP$6rn=)2%3
zE9Z0Pck^qiR?KclepM#3^A1PvO|$Jw*-B!r?pngGqTyPvuwkvThfAXU)D)9GTQx>&
z#gB@9MT<V>ZTZ$;VR9g8!kjLvruUPNZdrfXss7ZnyyIVTm)fb^<~{3vEaPT#fbJ3R
zml50Ud^yy!$Y+IR_5+Umzn>y1tCwCfudn(0%KnmsgvK(P#meQA*L{_p{qp7S&*kgm
z`~2ef*HnIbHB)iVLf=Juuf4eW*}UxR+@12(nIaWNmygbfl?Xcjv{`e0&VuqMoqUfB
z>aX#d-rcrvPF()oz~E|kN!`auU4nd(xmS83b-%xQwtd4&vEYP5#oBG$6U99^A6m-Y
z<_~B8B+_?M|BBMAW3~Z0f7n*OW{>#w)qP#Cr5Q(q&Nj#RQhU|bOhqR9J)M#sRmZ2u
zTx#s;-_Me>@6Qr7wtaQyPE1$f4gK1c(a6NMf1+-k#R30HQ@w0n_QO4=cg}8aDLmmC
zwC7jnnXMA9rhWNQmGUV-g~j{bj!U)syHz3_)_f@p)M|0h^ymy}On%=Y*SWRr$z(-t
zn-;ZwnFV&U-YtqQ-eP}g1vgi%dst28f#)%qGWn-JAKtX-^onOumydsFu}+c=xcUBk
zT!N6J?K_E=;yfK0ay%M)<fiL~F4%NUu<4Ze(z}aSU+<M|*p<ya)uYcL&8a(nw#KS+
zqIOlcy&kqM4s~o3Qr;fL-#$lk({k(U$D<WkewLYBDO=LEv0(jz)u&9E4|C^kda|L{
z@WK4KF4<|SJ#Smqc+Y#0eDBoX!!o5(SN8t@`+oPg1fHI)lA%f4zUXOG<g?Gew_I@B
zSucK($2WcY7J4-48^^!;(B+@jBC7O1{dvG={$kO`t>vtVo22LN+Me;^*q+ptJukj=
zY&ymf&+vR7drv3}mts@yW@Y{4Ue3)mk4n$2I8bO(qpQi<u;&IFM|Rr-UlYy)84dpr
z^8MgR6SL<N{&@df$`1MBMSXU!T}tg=S@5iU`A&VFrLn5to$Kxr>>{3P-A})bS|y@Z
z!LzMfh%07Fl2!MG$m2`rZ~n42W?o02z?Ay%$|)As|NPFLsJ+Fx_wR-u?WbL3&-_2{
z|K@OZ=2fwzNA12cty>&6zT@A%|JCojxgzI6ZtwhPR&m!WKfC?fwwMoVUn|J3x^*yt
z?fACdis>7p=SiEUt`o{jeO+>wd6)4kfz?ZxgD*Eezq56ZvB#Ry6A8Ht)BSX2l>V#^
znW>h}J4Yh&@{Df&60e&tdY`W~zj8zT@Xvedvf}%<-cxm({&DFo?^toCXqjD6zMEey
z<50R5C3f8~>DGM1fDQe(Z*J$ai+C%Pa4KqoocNjvF%Nt^pR9Xz`kI!PN<ORP+X*L)
zZ!1pCd;Y$h>2b{--}H}BEK6ihrB`2c*M8)CDr9YK(pk4G%?pRGGQBa3eiL+bK~~MA
z?mN3ysy}B;xpmX^)tue?>e+&3l*^uD`<|3uydd!NCbysL%`NvL#HSz6*E%1~|N0BN
zu=Mpp!R__8a^F6**?&rHHhbKfdmCr)?fJhpyQ-sn(!U&T?%NFy{?>5+IbN<G|6}!?
zohL39U$>ShpFQ(-ta{q_lRNJg=9SH#zrW1y{4~v~11SqyKR=(x+w}9ZAA8fEO+R0J
zs{Nwj`0MuLc)t0^B<9JgZ#`DMyDqA~e90RA*|E$u*ER3e&N?spM)t${<a4sSJlpJd
ze%f<&&e6-7uA2QDIvm$AT(SHcRK4A@{K!g?)mv9RnP+Qn?<$baBmcbf*R{CE3->6k
zS$*~A;lrtw5l=(3zTRC_HqmvrY;@07oApPT?rqa4jVp}H(9B+XWZM_rxr>#bGWQ1j
zbl83P^VC>IkJ{dnomnr`va?!JIEp+s%{lct&C5@EW&LEuZ(%K}8PVd!QvWBleO{%d
zonY~L-L!Dg4}aU2y?FX=#@c0iAq$o?8N1x#+bFYTa`;bww&%AEGt7IpIMpxpRP<I{
z<ZS(~o-gZBy1nH?mEEUP=IE<muUNZtX<LoOCClu@#072V>=SJ-T)*D!=25Cyp+94H
zoQzhiSM8rA%yYM|TY0%PmwPq$|HI+o+oxQ~*7*2&-NxmC;eU#ye?Amhljs#*<M(oo
z=E<5HdX?9d^cGajni8`76LZ_jO}jR^uP&>UUiL3`ky^_%*)>ZKPb_?QWuBkU#fy`=
ztp9GBc0soEbcY7lls{pQb7vmtJ!=$QB6j!E+UqHS3ucwoe^bqtoOsx3q073>DZ%S*
zevR0&GJG=UPjOxE)Rjw~EHa-XbcD%m>a5w9PTe{!#<29=))gI>v)}2Si`C!8xj)EW
zFLIaf{zrc|g$g>IV?Lfa^>N5yk9jQJ8~3t5@&4qxSK)rENSfi*W%rWT=p4ITe?=p1
z|Ihx3Gt$eS)z_@Ok#)IDa?anzotho(f4K}emaE&g&hj|E&*^OP%nQZGC#P%|X0d*n
zwyt#di*Gz>9&aW7Uv-|Em6d!Vb>-En$YLo8*%Mt?L$cico`n>*&3wZ4H+SU&DGT#c
z%EqNZ%%0r$at|yC)BT|r%*7WmrIgv`KhFYP&4oJgQ(EIRSPL?E)4Yt7zkRk`cKAz?
z^`t$u{|<i+KYxGTo@%>ahktJtKVNp>*vULg^-J4VWtYr*xuxUlJC5~#Uy7W2eOY@!
z*)4gQ`c6-mj`-&rm&sgTvg~?`<FWHO&5SEtCfx14c&R}8N2t_+)Gqgxi3=AN8~0jG
z_<JW{hSN(`BZKq#>Xyfw&Rr@GJ=m!JLaonqvNi8VxsD3MlkIlq4}B#6b?iCL7n9*3
zvA5A)>9bby()WVOVJR2ZoSg?+qJ8Xg?sU%O%h$c@O3dVU`qGxby)*yDb?FJm6Zi8R
zELq<o$$a+vM)OQPo$G(i<{7sM<=jsZE%MuYQ!d}gM&*XN#QFQyZCsa^+D?0?yND_M
z*Q7tS8*GvrZ}<MT<@VK_aQfm7u9%P+`<i2`zwJ6&UA<=cvDk%r;_p5xG>J}>WECvj
z`^3A>EiL7nZqk$=w<2Zi7u0w-zdl*eq*xsF^}OWg*{k+6HShlC{OpMBijT_90seiL
z_d6KR@+;!mxBiFJ@7j_L3~zO2M9DnM+xY5jWPy*|uDuff{Uh$5{NFz1!c*P*3M>mh
zoJ!Dqu4Xjlsm{UAI&aynmc-79aM`y>CgM{2X^U%fJq_0@?kUpT)bem|!mn){+Jzds
zS(E1NW#9Sd>>h;`S&M{LN4$Nx`);YFgR1PwEYUxPzo+zmv5t0JqH|#57v_l5NkS9U
zz15FxW|^)L8!<0#oxJ$H-g)QNJc`^XQ)n~kviavbdqd7@$$xZReC*SeK(7Ois*Hh^
zO|{#Nbi9<FPYSXqjc551`F)N<=ftgU|C>F(KK&_Rd)z=^&2+v@S>-7g-<4E5<*U9;
zyV&F25?Ll_-`rmsuce!2^K=65vgPWZ4!m5n^Icq{oW<PF(m{Q;JLLHLll6b8NgOZv
zbIIv>sv&cc*YsI+VM}U$efqh3^5M<l_mwX)9sKy__w(oP+w}Kue=$9e<*!Gy^sAC@
zrN1&Ss-E5&?${#lvbQPh_WK@_!ds52JlESM9!!jWBr9`VbB=fW{%1dOLoF=sZC-ln
zt+`5Uo5eww3E_<sg7s~Wnp(NAKUl1i#58lw522T9Pc&RMYiB%f+jZ`R!S<NcH+*q<
zZ|Cn4b1OYky!BgmeMD6AfzO^1PD-b=JSXgR_pEJNJo~`5$OHdp+)gZ$6bY2x%c^fs
zVCa^A_*IwH_vqOlmS5ZNbMl&TAj9gpG3ApIU*uTE`oGw9dX1DgZ(60-wAV)^-m}c;
zJl@NCq^s;{$^y>kS2u6|yU1r>+hPUwmlDrJ&$r0O>WUseUwcY>=PAdaSD#rMSLb{(
z+`Z{g>enlq|2{C`{rmdy?s|z;3(LD4jChVZD7U@emMwWUChCQ2qzkj^N1>xv+juzI
z<{t2V{Uc3xPl~_Zi{@v}?~}74m$E)!>~V8juGx62G<dDLgyH4t#qaODn`gAk#`WnQ
z4q-uwsoziDmOpp7F>Xfe<wdH?=X9Of8zdTg{let^8he-Mz7xH=NULc5ig$MF*g7q5
zyh+x3btNeK9dFbcdpD(|(2`wmFJ|s8k9v4?;p7w>fvexRa}J6=GJD~g9ndX%!gd1_
zuZG29uAkzwi!ZJ{c4Iov$%hNIil#8_E#Ccj;WGX`JCCNMTllR%c{?Io<cBI}Nz;wu
zuMGEvTUY;@(!{v=^$f!!iCq#O3;sEN*LdXiK~k`{Iput4&U@ZHKYO+dZ%vI|U?z3J
z{A*$auba^Aqif?fe+gO69lp8q+<UW_`^qx*bAQLy&T&Y(x^+VY%gvIPvL=RWQmm8T
zzV$5Ks`hf9x%d6kbEj9uZ0Ucu>i0r(g*#iUatj2Go?%(4J8kE?NqKKiAN^mi^t8-t
zt?=zM{Yw)Le|vbgMBA#Q%=1xB>dA@sN+<eu3l_7=+*p3p#na+ynCHnPtvLY?dxAx-
ztqXR^t~>L5`_Gp5TfWN5*@WrZiYz&iADjH?-A(iI9EVAbR=q5Zw+*Lmxu>=K_bG2V
zXU8|SmoB%fyl4MAnaQxpl+!;ne$Dpl2OHlmYWO?tTf&-skB!bhnSSxWEt|Y06|*-y
z^t)Cwoq0*<s!qMA3$a;qt*rS^F7|cYdwojrXRWD!)LCxtwsn~EtiN<ua9U1oQ&ank
zB&)I;sq)E>3VeF!`<_--&Dr&-b(frXy7J4UoU#<5)Y?ORKXw|JObo7C^v(43ibp*>
z`d12!C$GrR?Oc_=kfCPt*$&>B62eaxhW!656!=pAOrQ2Cu9E2GIj=KMSsADwbWHhH
z)^-1vlHud$f^sWVji))5Xv|`Kap}^{ISr*u8&wvzw&~40c#Xa8nc?z7i)(yM7rO?m
zncDPD$+pbY%gAWazWbk2VhdaLp6#3PB1u{-^Jmo7;&p!x3tY^1^t$#_i|yrshD*OU
zZC*Fu(&Mf|tJJ;^YRydTOFzGHhzw%c_UzTC-B-+ZC7r0131HT>-P-hs=SxX~Y3k?v
zS$lhL<>st4Of<>wF8Dm5$>PkOFZ`jb|7_aNO_$TMmSCE*x^+sd;wk6Z2iHD}V$LvG
zt@k*#uRdr0CN4#{63&z_H{RAwjd<FZc*IIKccMg5VaX5gNjF}W-iq`$f4rZ=nsxGr
z%F2@R#y33Tb-UX`{jSe{Uo=gtfZx`q`I}Xr-`8uFwz0c?Bi{VJp6~v@?33A|klb)J
z_jB=|mKheio2W)yHe+%&H{Bv}p#0*g$6^gkqLv3P?#Sf~I$jYlP3sAFz*)xRwB<Vr
zLgsagt*$S9$5CRlrQzG+Hw;<L_Nl9tR=M@a{Hw06{`Gsd&Hs!o2fH>*-F)Pd@|Bam
z^TKu(6{>1qZ1{UU<XSXuzfr)wl&yDGd9y9GPyftgeD~7SQzgIiE`FH$;@G0us?IV@
zuf1a`Y9?BBy3WzP{!Y5oIiMlvo3doXMUfZY$G3(4c-in-=40E%N=C*4+v9(~&3b>_
zn!o50*Z-bQ=h>U)Tt9r$G$G;49n*qyQ)j;piZ6N`eMm)yd1ltGfa;%ut+h+vReI=H
zeB|R$U-f+IwvaoOjW;zkGqb&Q%%5_k?2>8@ws~^vmVX29#y2y5IEo1T6#w1l%DH)Q
z>qVoTt2gjmXgH_&VWFLX{hlXN7CScfiI*r}WBsY|oTYig=bMlA^km3%DNeAxwQPOy
z-}qk12ddh2afdh=t0!!}w#b}uChM(uH}(&a0s7GzCoK6UepmIch|0EdYH6KTIDsdy
z)p_=uO!oA>fieAT-`y+P+4dXmDPQ;Zu+_iT`2qgnHQuiqzTYyj*s<jJ*`nqv5qJGR
z<rMW^>CKz^G`iq|B)@b0YTiKY_7DaAX+6a|Zv+X8Z<9}w7VGW2DCX_+P+)e8(oCHR
zMdf^fuEti61QS1)#%ipa)g7!Q^DI!DPeQ3pTstC!XZf?wS)WSkJYywZKM%d1-qL-S
z<K?HNN6zn-O22QAHD8%4_2sjwvh-ph`EJ=+g6gY__(S3Zthx&$r~J=|IjVhZ?bM~r
zf-AnQ*%1|9q|f}IjotTvftliz8=4Q7?a%c*cPDG5#X+5KRkO83-^70Iel>4>o$P1d
ztQi|l%<Nz^tqXT{Jin|_FKM^N!@mcwxUFbZZaK$pvcjF|_XlPHm2RPFC2^DMc5ic4
zart;-VH)$tzUe!T9uG<QQ!7$gX}I{!SH@LrA*UTfDpu!d%N}z*@xiO$Sl+swy23Bk
z1pBBerYbCG(B=2v!>)f}n(HIWd!-9&5(MK8?7LYJsmDL@u20qSet&+xU%%#f{0q_x
zcFNi_L*lss)A7A(vwnotYU_5gJ+6tn$D@3>b79ZzQr~Y%Z|yFZCu<)y4_cTRnC>8O
zx>PoL@=TArEc5cbj6F0wdny7S%SK-b*I4*NSH1kc0^@=k(|4=?`1(%s&u@LtSB7fu
z*dGg~GjO=FsuY+_i5HrZKQX4{ut({%ql^>h%6;E&FEjCgm6WE*(tu{!%a2}oKJ?<b
zVPkqAy5f+<&z76qrw^AMZ+NP5bkF~ixXXT)MlU)yMO<or`&wmo-eOZ9zlsxf+cQ6#
z*}AQ5blf=OJm<#+>x$OiF8E_?yh!()_JNZZ%(SnlKKeOj=dsI)Oh)2y8ye<$pO#r%
zKhZrnkblL;#k2Wx;#M4=V-{pINBW=JWheIjMJ<BsY&`xf3$i@EE^9h-gsIr(GB>{%
zspU7k=ektva8$`unaaq*I7L&&e!CR!V!rd{owH6y?lQ9CwvlvO^W~nSf2wTk@<ShH
z9M0bJuxxHzkD3Ydw^zH0xB9={FM7^JHj!%z|IugR9no$=J5L$xl{30;qpbSbcahz}
zJrmm)=b!%?G-=H;fg^HXq}$lD3oAO-Ss0kQB?tRHx%jRwa9iWSt8xa*HgWe}uvB@$
zwX|)8K6hWSE!$G{D-JPAO~rk0R9RDI{BZegv$`SRaL=b&Kcn<LzbhWbR>+m?^qulx
z<)2d*e(F5js8#Qz%cE+$XIolq;E^Tl*>n7j_FUljp%NmUX;OKHOT|G<W%-+3ozHXP
zP5ezWC)gyE@qgh`v%T8(PGqKc*7WG_4yFq6JX>z4z1irXpEdt<d)!6gs`rkEX6jB?
zIr(x%(CRFwiF0f2s^ofHc8yxJ@&4wOR+}dVT{~*hA10?J!crIfVC};x_1F46TX%~8
zH@hnE(d{t1zHP$HcWvqn{9EpvY5uM*88@r+lCa|CHC3Xr8`w1^_UWfYT$+?rR{iiS
z|Ho{XU!Bh`2kN`eklYmN#Akc{WZ813&6Qh=AF7mSv3T_ePMC6a=2!N$)p|=JUnz@U
zF2A_`T*k}1s<iEk*uQ?b&?c6&?0SAn<l<>>9^NZ<Hz~NCH&OXY<x%0XIeQp|e!4Ll
zPi?<*F5qQZ!;0#&M=Ov1`1Se0>{ZXVtZTFG<gw86onR~7C%(`nzJeuEcs09S%iBOx
zoe4YFmY#oZ*3w?NM0K;D4S$XJzwM{P?Elv#>ow;+2-wn|x3Gj`ZQ4q?-1j`~9V@tG
zv-2V}pJ(K2uiCjZBlGZQn=8wk6WaHQewh)geX25YYHpv@y|ag3Mocf?JYmn_j9z=;
z<7{hYd(6x0U@PM8S|%OrTQtx2W!|$x*EZ>V%83+aZtQkzQ@u1dtSEoy$(;$ZM=Pcq
zUkZv>-OT^yX4T6zJC5vPa-Q&oDb}xE!be<f?S<S${u7-VPG<xvYP~#=WGEZyyt5%^
zE5}>)M|)?oOq1H}_;mBjm}L*{|Nk;8jFr7=Zu;drN58#}eXDotpRTUpJfi~_<fFd!
z-*^7L?r`7AIf(|6uTw9s_^^qi^_KrXrYSs@3HyTB1r_I?+1$0rKBZk*v-AeHmiZi)
z1sgv&Our*+JaeUvc%-3w-0wEMhs-mI*fSQWq#68vbh6lEEu)cB_PnzDBKz`Yh1P!g
z@lmuVrFY`{?&C|kmrncn`thQ5*DL@2IGJDfb@m6BZE2#$uTGtb%Tw35zVPSiW1P9G
zzba&YzWY3pjful$rjX@R|E?&B&emTJVTu-KD@#-UKIyr#XT|YLRvm^HTACHbdvE<J
zbjtVF)YN5v7jgNaK`&2MyJmm1dgIe)Dy^INGmn^*?2<2<ws2-uoFB_-%fKSn?cPbd
zET)G&VmF@m{FdL^$@Yutujfxz*ZIiuUT@xnFu}#Hhv$mv-<$N&{lfjPJ8$1wzdZME
z)vpb8wtMe%>L2B4IW%>d*WI&HS^2qB=1llg@NL@OEg82yue9HC;Pt%1$EzMhpG)>T
zD6{YP&FYt0$Clr^QSF+3PV9-RMxsfMNd3~og0*U_ViM=B7A)I4<-Y5p+C9Hza|L#@
z=p11?<FMxO`Nmh3tZmI^)`H^Jn|{l%IGkmDcjU%_TOa@2HnaJ^jrsgX;q{*aV%k-0
zYK;D<ZJoI_y|P*CmA0^r*L7dN<qG+;+WX(iYs95`efE5%w`F(sjED&`k<R%}$vl^%
zq8F&@P8UD2v}&hG^^e2RFVF2Z<7@m?xO)bF&eIju?Y%+#-CgUd?O%SBPqvxaB&RfK
z=cIC#y4{PS4fvJ+S-m@xID1(IPvm@k&2ovCUTe3mE-E}L_1t(%SWTDVLAI`4FFfKK
z_=NS28x~v+4v|zmUiZ=Y^T*hI5f8UsobG8id*SWh%VjD`i(dyC#TcI#$aY_UP5$K+
z;l+C-HW_HDZQ6Ta)x_nj0`f&JliyT*Y@N%q<?9jCiET>DmcO>YaddKoL6So6S6iED
zt%r_owK?(S*UzrlR=3SpZo3~ZUv+Np<Mb7I6H|`wH<;M|k@HU4O$!UY16!v~z0qG_
zrxgC8r0T`&7u)6Lub=<=<trH%{vDdi?}Sc2dY_ljWBX8H#(w=zQ(ViV^Y4|Hx7B7?
zaP?Lwd|X!Lk@t_$&{C?Yr#%1WlgfmZ`bi&GDO{cIz3<TH`uSf2iwo2`SH9AmG$Z)c
z9#4ysu2l~%H#2Xsnicu{%(`n^zwm$0=DK5N$KT_#jrH*6)0L`^4Yz;M+FN4kDeGn@
zd&yZev->pfq1=u3%O04>uU}twSv~NgiBptLK}34spScp7?k>1xTE?JfF2TY%spi=!
zzdnWXk8hZE=Pk2mj#<o~Hh)p2<+*1((`R1^`0(m8Ye9NJMh@%Zbs}8{4fo#UEjgX3
zup<4qz&$g;$6L2|ghf@{WPDM&=UH~y68_^8^CI7_G20%NaQ>)jk!t;^&!Ur>Pr6@u
zwPO1lUjC37GOb?A67mX`etNN~<U?V)-j(#7fwmX=GY)ZGn^fobhV$OuNZ)tu<pxtX
z9^s00&-<dobN(UsziW^3?})ZKt-f0HEN+5bP0aMqrpxrM%uL;t8+u#E_wO_xQR_LE
z-?40wKm3aM&*#_a>-+DhnC$27+UXL_{^?WeorS6=6jo_Ty>;kTUR)d&`$lYb>B)(q
zY{w(TO)p6bA3B>P@-!x_@7n84=WgFo*eknvw(^qB#kZevNOp8HUpHQT_V<M58*=;J
zzFKkQ#zSq1Ob=e~$Pc#`C`sPz?R)T?JJVC$@S&mIgasEq$a{p8%ssE5^JC|MLKlxl
z(}viSjW7R|O=_4QTfX7f8xOY+pACX8_4OQl_V{I!YU!MVZ)2vNP=4RD!Dh|-(?9p@
zIhb4$7bm)9V*H<9*YC^ydp0}&Nd8MT^Txa%9qYZGnOxhayKd=3p2apZIKFC3ys7x5
z{_=7LJ<i(_*OpFRt9Rn>8oS)@Perz#3GQ$6*4m_(etn534|_|Ep+sPj9Y^1#IgX|O
zUO9CtbJeZ6?4ZtF5_UIZPeG^dm+$L@mbd2}v*g|;e8k6SW%UeRr!}$_(uX>htF_C<
zRX<1zQR;Vdd4K(CWiVsasxKn$C91V51tLcrPnu7EnPb)wG^65t+2a&`gDt-@ml`U4
zo^&Mh_|&VH>lddP3q5LN)#9wacSu80P4kda=C>8v{ry*GEZ%t|Fub{F@gkR!%$CyR
zqpSz}R2i>yIH;C+o_1V)d+MTqP4A{JU85eE@MErOZFjHZeoOJ{diOHB=R%&|XAQJh
z&3c(!a8>18Z063Ds~(nl-rh0WLUr}Fsy60;#`%T*K`aO3QWo95aZGRHeLwFBf~9jL
zxQa4r&NLSFXBMqgYw!Ekevu(4{l=_1gLN)3)4n`9UcMn^Y4_YRBdyI+E8_X`tID38
zoMP)2GGDHs=aS88&wIxfygJ$8^K{MLFNc@$*~?yTpL%vv=VqyG_utP5`D0U%lv!k@
z9==lc>Ib&4%Iw9(Jhiz~gdJ*D^}Z=QvVC#Om9!}jr*VC<ThhMfnw2QqCzh=XqNnZ`
z-ghj2bC5$ztXXa@tE124z!?l{HBbL!`25%}z&LQ~;+JfFaY|1f-rX8~(E7<^U7nwj
z`?~ICcAq@>IrHL?yc1g`ZD)OtYvqe7wR<bbZ{zXoW|Ga>Nw*h2x%N%Qho7HySutxv
z*0Z<2KbJ3le*WCOxqItM`vg7w_g8+3UG+n2wR_Fc&0igk&X6ze*}3$@oY>OUYK^Vy
zHynvP{QdNbAc<Y~i!H0XjAJIU&sz0jb@m6-dwq2k9K6dF+YSeB6`ua0U8CUFzJhZL
z_N;WCu+gBNS@>1Vg1-^s`?gHpJz4Fy#X(p5qwm-4X#M)ckLLz^$c}F+OANN0x@+;y
zdb9YQ=hvnc#Gi=T#h+QeyC6OM9dm+b{;5~VdrvjAMn0Kg^h-kU*lkZo)y+%$7Vq|s
zlqgKzF?I3L#|}QO_J%V|&x^mRllk@X!$MyF^{K8(oMqiJQxay*?Yr>ty{r!NX7#PT
z+h+W)<c!`f_-283qJ>ZXtgF{^u0`kvx;9VGzxHCs0$b^>{++BDOuW-iZgH_LTASr>
zWW7OX-g<$Bfvh18_h%)A-FUc3<o2Iy=Ps<BRKDTS@%f#uZa<$^J)6k#sgnQKVJ-Fe
z*c%cr)*5>~-Y$QwcYeph%RHi~U+&~+#mdY!&5_y6xi525|BSR$&vR=m-x@wUZj|yo
zz%rS=b@6A#W1p`GU6^b-$=0z($k8wE*-w$bpSpB3#VYbQghs{-9$6>d&Et~$Sm^n?
z{Q2^x@0JV7-Bj;gtJ;2J?<|R4iO0rThP-hXCdy9k-Co>r_moabcF^VU$3H~A)r%k1
z`sMXx&l2;SZ04d~jZ2PbWb|Jw?fi1DFzk-ATfRP1Ug$N}`6q78OiTF0KVkLCiw!eG
z><q=K@BeUMf4{DW(_m9U+w)hIC%31Z&7GRHyg@+c{Z;2+)(>~sbKfmG!Yft3<Jsp^
zsrTnj`MRt;x5=TLeVxtR$Te$UtShXP{dzIT{r9f48b+_#5|23R=W?(9wa8-1O})w)
z(O1^xUS57%fPYFyeV_DSqsx{rqrYrD=)OF3#?Hy_bvIwjc2O(cdua9gsvCjZCr!M#
z<bUGCfIEeO$F}N=Sx1Z89?2Fx!^EO1x5@To(`U<X(o!d`GW(kEe*5#L-n-4Z(^+j@
zj`W*8&VRvignf-~N$sPXJD74Co}|1NSe;yPEM~I7vb;4H!nTRL_UQ>ZE1vu#=<_yP
z&2_c8zczh)QucdSVwq_{UgNX?fmbVZ6_sR7IZvO6n{&1D&iUpx@l^q9HMcF9-|@U@
z{>uw5+n42Q+<Q1h_R*B3|730*XFU33lXue{Y2GWDizj{MJrQ&$E&S~y>4)!nmN@Y~
zShvUfc+FXTPpg-;FE*{H@(x~f*+F^HjdS*O4z~_ED_!E)^0u$1=8KA8+I~O2$VrmC
z!jpKjOU}=lHp!7ybvKW$&(Dz9L|su;f5ot^F7p@6Pm|QJo+oS|$|dv6Q^-d0l(6~+
zZ^cT3jZ>Q9{8y>+Jv?i4?N84ZohQdQ+YH|PITdzyLsv}I6unPs&esb*rEXhMWw^EW
z@%D<(3BNNJTspny%YM6=j+;!FJf9lBJezmiw&v8w{v#}wO}DSzE}!DG_U!V4?oV+m
zH5YsBy0AKLcYtN!%Top#yr1PKPLKICJ;_ox|Ak)m9*vS2b97ZN$M}6ypAq(B=4~f6
zj(;Vd&WFy0no8DuI&+Fcpx5K@PkWbg?O)3tUEKHgths+(s`BpXo6c}QRd9~8nX-7L
znXdS2udJnO6IZOtd84#5i~aqk5}RKk&L=(o7A$wP)RwmUBQ@h(Rgp?;+r%&brsU5H
z59L&U>UlZjXvN(pU#t&ZPdFs}JSlnY64$3|KKZiTQa6d5cSxYFdXA0czgP1OcN}Kr
zc0FeBv*hpd#$SoC%u)t+Wvs7{`30q2JTUdD#J?!6ifvc5V!v1PX3G5(XZU4z_=?=U
zU58tGHwdot^h)}7YFDD=^qACC%hc9j4GB)JqQi3xyQ@Vu9pdWP`L-py@^$~g&qm_b
z41uo961!4VntGQpT+m*s-F2z)j@63QEsk4ez4zvSULNxQ-w(gAM|NM|HE3vFa+`Qi
zFJk$QP3<2({8;zpZrz;Q>TAR{bhZ4<FzH=(xm0hS#~bUSGmjOu`)kxruYEXYT5Iu1
zfu(Oug}5%qhg<92UCOf|IQ4gy?8;@5*FLVP+?{D3k=Fgqw_LIM;1P|y>{ot17cP`=
zs5_ob&oa}Cda_be_{n_B#*M!c*2t`$6Y;U~Q@gQuvbBR>k4fSRaUX+P9qq@{(*zeK
zEPmOy)3&5rD{c0Zd>hM?FK<sSKkvTYFV4=s?(e_5v%kMTarHsImDJf#Cuxf^{nwKY
zFIRgiW7gr)>uf*sfasdT%1*P7CCz%}>+5z$bE({v6(5i8*byb}yP|!z6_fMsNC#Q3
z%kMHw=CM6_@~(m5&g&;t!4D;)j|w^54OpB~teeHmaru$c7G1euKOF;=NaIDHF0OvL
z=b#GP>3+{?bA+y)NPIN?pik_{NyYDHJx!Q0JAX>Nc(?MNjOzB~ok~g7awbz1ysinI
zI@kXtvSQEjH7+Z{ms^<F*fO-L-<-5&+RvKDj5^a-<-Rz%W`a&oXkqEy7a|4bLapZn
zOMZofazA8WTi@SNJzLjcyWyAouxZsNc@xDB-fw0<EH$q)N-{Wi;@b2rt3E{*a-Y6j
zA+RvJx_Zj|Z_8rNFYoG)5uMz>#%tM!h|BRl1rC`rzdx90^1Sg#XJGzj+iSt~r@Ac9
z&9Yzc+2;D2CtK$5n96f<9NzQf$;Ol->mwm~?NN2Iapv7W_j&AS|7BnkQha0Xp;!G1
z{B=%ySxgs3a7C_*W8J%b2lJ1s;RpLo^{2A)T}$%sz7{f>Cxy#UK-54-X#0Et%?w|a
z(#+BqbDbaaZ9T|wSUly0Z9kjDrykBLf4O~ScHJ$sDlL50p|dyk-SWqK{_q8#5x&*^
z?8{SAi+c|z@Vw&6PtJT$a!fwTrrSGtU!hdFbJwSJUAdt=uQ$#-*<pKs4^MlBZllJW
ziZT}FDW6=r4k&%sTfi?U-K_RWFMQhF<)8%&i^7tp$Au@aI#X81ze~`dZ;3+DjR^r;
zy=_nay?t=e8INWBmlQ9TIEuyeO$&JO_sLJ))JY2tep*woX7h<7q8{s{FV#sle>*&b
z>)XWwTa&mgKd;>WJpHII-)*T)lXd)`7oXY~GyO}utL&d+E2n=9kA9bG!Q#%mP{}WB
z&9=IoJ^EMrBxZluY&|o>{LzXlE7ulHzP<6I!=wF8U*dLbx7NN~Cu6<Zee<=uOH8~y
zosNs&mup=!;aA42r+Rbt+Pz(-Gyj@~)#W(Vb2<-~*FH}>xNq()n{C#@!B)l#e5^`R
zv-tmY?_SAVX8*Ifz<<&=;kEboaBfr-kqdaaPvAd$0!JF}(v3G6?5{3p_b}VupqbaK
z!rb%q_+4KfnFD%SGnQ)#wJs^IDsX7$`QR$C!8&2r5uTu!mG>MCbbkuojc~iuwfN|k
zwwk$Dl~2kleNyi^W+(PA)5g=Y;`1W)!-^T-f;b;M?$wCe)V;*8qozZ;F>7C${NL+J
zw<b^XkDgy{s+{qt^<HrM6WgcJ!rv@&rGv6l!au(XDD?Q%rFckJNR4-Y{oyP3*-NKB
z^ePZ4Wpv({KIfFu<{kRSOa&YQPrmv5L91RXD*V}JmH>{+fx>!v4-7OX2<r>no$z_`
zA8*w_SqJ&)%d;cH&OA@bycJTkna@|HyX8*(k)ZkWw(1|<cx}nUtRsKIzeIl%Sv}Q3
zL38$`9%iXMOB?)Jw938SMisVATx9quI96Q4KJg6mI`iDTihRj+NtqW;Y;-HR6!A4U
z(x=k0y8Zw0lHU_@Y}-X2-d6P8SihC+aIx0TAJ?w8E#`gpTQ%)l{DRF#UKV&wzL62Q
z*iKQAi}Rse$9-;zFw1|1{5MitmDCR2$>RN?va)HC&a$=}s-LBuD*rq=d0G9wQ2e?m
zS5CEO{#Ufq6{<v1WK&+UEY-fE>+_S%<#m<5z`n%IaiKR4`4z0N`^Y`F_KHbSz}~op
zFJzP?&J<1vdaV|%wdc_VT|wvN*XB<C@$y!XS!&nR?34SHmg$Qt-`Tyh_7eZ+ZPm<G
z#hZm)Q{QQPJu`RT(H`Ef+l10Cly$0oJ<^%>%3v<*y4QuXZ-`C4)#IPQceRi=`qrXn
zR%TnO<XLWd$@cr+PujPbn|1N)XtS1ysY|ENGx$3xLigl8|Nbw%idtVU@@|m5oLJ<<
zE^_A4Rf9_7^MQMVo_1U_Gd@zopYX6?(m}<!la#kfsP+E5;kDIq&(WpnZK0bMW(&Q)
zy=~gn^xqpJ)pAZXW~;|@3z$Co|L~{d5r65^YPscB4oPNTtunKAuRR#|nk)9OV#bNE
zw)Pe56{`<tzhT&FAt8SJR>JmGg_|}WOy}(k-LI>td+pHMjK^Uo7;^)C63UG%WSL*&
zpZeFQIZ>rIK-z5!8|#+33l=Nda#O8uZu}+||2MbPblR<tqFkD}p|v*u?i9yVMnq{J
z-+egKBtlxcuvdH6@(+d=-&oBFnqI2l;_<UAAW@Y)jpOL1O$y@cU2La@Z$C9rbm3}d
zvy}zOCC!X8bv6pdbN}YwwQkyU#)hSW^0RXp|IfWOsqf6xcR$19ug`WZ_+V>tc6xyK
zz4_vLY_Ub#)^jk<nKqfN_(atipV(xB&hRu1^_8OjkLMk{ATz}`$DgxOEMSpG+KXgX
zhnSus`;Aldc3yt@w7h!3f$f3%^F33KOP_tP=*}yPud9nWFV5P*m2xUO{!obcOrPa*
z^r!62_pk`cTrzjAkw75N&XQffPc)iKJ*b~wxv1=nN5!#QlXK5S{$9&pvT4RDzlm;a
z9;)5JwtGVF9rt)#D8`Ur^Vil}s6yYza%;tdHco?hv)h}6Y-LsTf1Z9>8tL=Nz{^YG
zt$C#?YxPTx{MG-!Yk&eYJbsId*?c_o%l59h?8~-!+1iRH_Z(Yr^6AuqTW|L+mRWXY
z!s6ejU%sB6e=g3Ze)hI+RnzV%KKOl6Hf+!S=4EZNlP~V~x88Msk{@gJ`Z&q--PiP1
z>K##YlG~W-aH(YB<SliHU$0hmCBJ@u<KxvQzv^9|Up8M}zeV}ttJz7{R=knwc%8T+
z-u}h8=E^^Qa_%34%lx+(IQaiucsF-)_>|R&X<jGAF5N5N>2TXS#^C$eNl6oUE-&(&
zRi78Aa;x%9SMbj5H;YbZ&V06W>7?m9pPpK0u62FcImOc7$9oJey`Euyj4$@t?Ke9v
zC!TTjey-WHbk-F?LDd$)4e~J;rOe}PCC;(7mao`$=*`)(eOgiur(@UN`WNsc?D`DN
z$=1Rv7i~Jm;7}T!<kI{|VUBU_LZ!p^?2oUFKJ6p3uQUG6@x$Ba)E}S3e`Z!-LQivg
zh4I8w8=mc%aKuuEH>!Hw;iR_7c@sh#t8F9KPG~=~y6EZctdCO{7&#@E?a6d3OHz(z
zWS=+F>`i<^`0Y(UlO-&oR<)R~51#6Ox9Nbm<c59?d#<xGBG)?#E=0Mvi0a>Yx3S``
zx%1`&aWb-Yoi`shP7Io>)Rz}M{m{7siEfhi8`#U5FWfVj7bM@o9LK!)*3<d7rJe<q
z-l&V2U)}e5nSR^9XY<Zh-r804okhQW@BZK4{=J+2U1)mM_q(=g$9+>4CffIMEBMV$
z+%$Qire{#luFQJroY0$G8a3N8QeIrX>o||0c;9i47vHmw^jvEfNqghGYx$jH4KgC$
z=bRX0EJ~7gBuAe**;jb-MfR3ky<t8^GkHv2@o+G+eOvX-_VC+xjP*XrZIgYTuVfXH
zur_`E)p_xsE9{w*msZCdT2OvLU-Ia7mZOQ{N^V8Vin?lo7iRGLNd6HmJl^@#b+S!?
zu5r;{R^y_-pU<2qJ$<yw>G4{{_;yy?S^b*~l9{(X*^_cpzeUJCF#7$L(#)3D`M20t
z*ZZ&I_As8*^C)<QcUjPug-aXTIHObKKUU2!DBOJX)vZ^-C4!6}OG4^w+#dH&<-W~z
zzxsk{hE1k!!yV75!Shx{tN-&WRo}i{(RGv6CB`Mn`o`uT9_%?2J!^xpN42iY!J}K_
z_jYU!h*1~2lcTmKxY=uc)KaaK=+w69K{03N{+@L9>e?023DbPiZIoaCT{w4||AU{u
zBu&iM^F9B$yvA>Pti)mgH{NTmuJ;Z+2|7HFrK|m6w9$txQ47ke)g<k%d0#rsJ6V|P
z)E9k2+nChQx$<dScP(~XbMJ;=F>{&o_1m>hxkgUcuV1zHebC4g`+LUo8J2NVf`97X
zD+x1c+-<bz&6RnYv(o&YH!V2Hu#rjXn#NWUe~Cg5$-8S#Uv`@O=)R(M4Cm!HcDDk5
z%vyOMezJGMHs%zj;LGzPW-a|zt2+7lYL2gltBfOWCicF0>@dBUMQ_!!dsm#^b*wz}
zd-ay;(1i>}Yu>%+j`Nbqm>n&(CgRDVu-ey|Dr^gE17Z(n?N$|gKX-l6`?eeBZBHp#
zO738u_<3!Z$gMRCqxjV<b|o`+irntw>+`x)e_LpsmePuK%kGBV-FI{2miflohL-Uf
zb@taPtPh&kZJqD=b+?q@r2DtrL=v{f+5Op8xhMVn)Fr#OSTu?sxTGh%lUw~t<WGeO
z2ZbbrHeBOsGTRy-|BCC9+ZToHOV|se3(HsXKUz?0eTQwg!|PRVI=^3y*ywm$RM|4r
zs_^Hw{I+EecO2$R5{L>({A_V9!C9_zvG%nc7H#w0c2=-G+r80hMP1{(JI(W(<JG&;
z+<HHCU0lFBDKI{{c=;^7Z5C>~FHhI)yR3To>fa~&bIf%DXEr}wR3^%+sw4jN-J)u}
z4}1QH)TP*OJG1|7U3`SzGnS5A203ZlI~SBKq?6YKUzE7kU>tk;FXQi%(L3{`qm$HF
zq$jJKEVH(l)3?j#z_g6i{uN4*tIHmo%dfa~e37Tk-Q<_9b2HADtXYshLoZfkO5N*>
zn*qC%d;O+YZRqDeT>59yk2x>DMFtf0Z(Z`dhxyo4{qy2Y+%qeRw8Gt^1iTE6?^$Tp
zv8eb-Xr|adM$5%(Z%Vvy<VlfKzPZRUa7(qE%ns=VOQ)$OyL(yWF>m8g?_p)z%(b8M
z?anuD3RA0R|30w%@7lNfYyZExdGmIO!tytICpT1z@~@x7nkq9z*EVqHsdm-V_A2g~
z<uxb0I#xdMFmW(s5D%=Vmz*c``>e-;9?>1#i!c53Dp=ga<Er;7MZRzuM~9V->$LwL
zPVFmw#n|y^qriWMluT#V>K!et=YIU(Ef%}?&z%U_nML8@P43I9<wM!IcW3_-P0x;A
zv%K%mp&dKACtUA&mYhA4)jm2Qdq+}<P}#xVYd0q<K5D&Q$}YI}<qM6aKi5n%;wy@h
z>F-@paaf}2LWE;wfP>%%=IQ!xa+ZslmPbg$d%fM{*ztddiqF}vn<5K$?PE)OaVN1l
zt=g6GXQHWXO}Y7HW}8)0bhh+fsoq_qaO-WOf7%wwqL8cFoxd&|yS-`7V)w7VRc-co
z=+-|9$xXeZ{o}Xf?=`2Hr=H<>&++6mv#5aIp-<ob@IEWGxvw+(&9&X)ANzmSObzG!
z9kC*3*#&da4#O=ox@Wy#DRY&D<HE`bOLs-3hi=O`vOhnk^|S(iX3?$18=aQ&&3^Fc
zvCfxYNgJM4_qUh5=MmOSR6Kq%maFsxPnnCcSq@`W{$-DqbqiltwYmSc<^8z4v{UU-
zT65~f3EjG^!VjY7u=<?2k+VY9Flo;-LGRB+dnMKy__i-PXZE}Q=4pe->jF}%q<=U{
z&&~5)7VxNKj<4M#(Y4)grrlZ<{CtH+{TaJd%~+L-T(_Pa->vsI#qeEW<AEP%3Z~|Z
z2_9c2Ghdy5UM-u-@wdmDA5ThkzOb`NWWu#4T^Cox#BfbfJb!=g9&2may%yD9mp{*6
zt0OfnJ@(GgQ%hSXAHBl4D&Y2nZz{6J%jdj!uw>V+FPj=3x^E148Gh8LH2$sn{rP{t
zKK;D-iRv!NMGCXecJJ?wx_#<vuMo?z!%3%7O22>h4K+!0V*VM>W;5lcM)Of!?lSF7
zp#@>gCk@PwxbW@URyX~Fs;9`eC%e`E|54pK|KF+jir@ESq}ka{dVXE>V}^0*6A{*u
z_Y=MRS|XoS1{iLATlZ=EnqRZKL^nRVc*?)BHMmn!Eb*&-;)fHFix)kQ=;)5o*{JVU
zTr$(O*F^o>zLT0vSu<>!g@qmUZtiiNo^n$1_&ILZ3iT6qGi5edlsr`2{Nru;{Z{Gb
ziDDo6{O{D11V2pB`f_8=in$Z&SS==P+SaJ|VU?H*m*wjdsX5XU@=nJ|JiT&Svh(&T
zhHsDUWCY7EbKSV@>)a%{E$wwdDo68^`;9ve+wf0+YV_ep?eRLsDPs1k1^zeI?X~l-
z+K?u}+cNX(s-oJ`xgO`XJ~<i8u#zSH{w9;TUcXvOX4RZp)nsEl<-g<J$ez=chiv*z
z#u;!NlKkGgn&qio!_&s%m27ETA0_!?dRDe<4!e2M;J*i3(G8o=<$Is}n*1WCll6_t
z%EL)sUKUv<s~0IQeP43s?GA<8fo#9iKM7hEIDO^$kgquXiaFO`&6T`abCnnptxp85
znVyi~`s&e})Khl83+K!*?7z{^VK8qQ<8G&^0ef=!S8#mNsroyA(YeHR4S%2f+!PnS
zQ|@-uFOK@v&L`QJ_fG!$DB^j+Ovx)e(}d0!zR_xRPFN(T!u>ilC^=!T!^O>lhL82v
zJ~8^HX|I2}|Mk_37@dm+$3D8PQ`WxTo8sWoyQXBncKyb@-%gEO%TLdK+x=z!KTTKD
zSyyZww!US#8FOpHJQLPCUzcdzh~tX*>9i=))kYweHT28ITN}dm`|j&}67xi)b>$z`
zFy8&U3m%o3uXKJWV0bKO`R}3~b=A|ia)h2J|I%@7@6r4p#S5PKvsOhI8+q*e7j+=m
ztyjzX*t)OD(^FOm-23l2?@QtvrA^C<Lf#(Ozs<P!$==zz>+kH)Ub;@{O3%GzY86XX
z6<uRaTFDrmc;w4;CEJJZmn^IQIq&uFA8DCqMHc_KwEOo2byM4Vg>tRn4)tYI*>9hF
zE@MCYW3olC-L%BXZvGD>uDne*$o;wAg1hwf!}A<6cmJ&29T%2!`rPsJdAsH9-%k4;
zrqwWC&uc-NZj#Y^H5QxS{7NkMuCPdZ79788cfu&0wd+rZP1bamHAPL^)zj<$CM9y&
z->aH0aKBfZkGG=o^`Tayp0&+WjWRQY1nufV7N5A%_*GFU>Q~3_cD-B9E6i07em7q2
zeqz2M&#4a{H=o~Q?S83rlK<`h?Dw~K-!_|6^Z)#Ehc%Y$AwC!TXWl)T5nk;+QN-PP
z)6?veljkmeaY2E@tHYy-dBUWvcK_bp{`%tGD>r7ARMnX`t1JDIx*YbeUcLJD$JLca
zy?d*@d^TyAas5pG^E_L3VqEEtnSby1#qYPZ{I~9(^}J7EuI2W|*FVXh`}fUin*Wt2
zg*lQRdz#Car>FZR7TjRE|8qvM`+@?8CbO=|dXod*A2#H9ul;h?zP$qd(qWT+-*~Rq
zcy9ap+t<90hq9lK3z?fSSLvFsmcwBVrpP~Gmrc|5T8U>q_||szvdku_o55BU(eDpD
z3H#xHwY+y;gZs<(3Jve<zu#Xw->g6T;F8X?CgZ7Lxu3VJwhEJUeYxHw`(N6f8ZLgN
z4^1&G=hw1t{<D=$GOX?$tEl4KuHU;Z+8R5X-pwd5b@V8@w)vO3(x3gS&Sl>Z*7(%=
zWZln}6q|>-4lCE*UY2X#C0{LWBCKDgZXuXm-nXK5;*OsYQo#uqelnacsrVxH+2gcd
zR)a`QHiO}x9@mDe$qqf*{e_!<^@=%N@N;?1dY5;L&)f{wHN_%_?`!hDVbf_)&*}dk
z8^1ug_tc5c^}Bj?KQzQtO?#5+sPrWHNz;cvTE6?|C_1!O@4D72ZoI=lX6pCT>(9*X
z{8Jvrc4_A-OSxG`TB@dR2)yaK<ib>r3QqkGoHa*ph0V`4XnnPP>&YyuR;9Z~Uv%H{
z+TwBPLkO?g-mvRm)~LB34z?}%elfLR&a%z^*EfaiHeK<-x$Mx)o|`{K&+Q0pt<qqb
z-Y{Fi`AmeXh{T4spN<y(nP<BC^P4`2Vw00X9_QUV|1zwSWqZVMz9+mv#rd8>*`=%B
z8t$y}-WsqVYOaP<1mB|an`?GFbzq<2+wx*YU+!4}c_C4OZy%3+w4L+xbIrC{lA9Z}
z?4!<#r3lp<R(z}x=$;TDyNG9VmtBu@!}P~13l3j-y}^1<qb$odsaLm`o|((`tX{qH
zR=?zOZG`|i3EgY{3=6C-N;qCCUjIu*RVk}+eqx+Jb-eGCSzaEynywx!TB9}hWJ#dd
zW6>CiNf}dgr(Y3}|GMbVYNN;)@3scvD=w<@s`{RX9J7BtKjDw<2fcvs9C7WPH#fR_
zZZNZxn11yBNwaS^zq~Ly(Daq5DcUl^)#Se}<7B1=O(vNij?UkIepd-I-~74!cYd2!
zk<`Bp^&h7D-+1vnV%z0|I$qn~bw~W=KJ(;e;{(-Fw$=CJR{fk7UVPHAt;KWa8_9=U
z{{pO^xR=JMq;8xg9I<rKcCH8i4%F=YJ=L&umAKf|2dgyJEt8D0xw?Dx&CP4qPd}>U
zKmTFhEk))R=dJbc`|h*0ljYyP_37o30@L_JrlyOpUhNlst9E|X>qmJU8|q(%{;U7=
z@t*v@AMN@7UB71R-uz*iDC5V4w_G+{DomHGx7s_G_j8f++=gXBMHy1FqZWK|<yiS-
z6Zg#-x`GE>J9l<k^t60>I{ii7tfzijsqwGHKRozqt1HESZ1Uv&`}+FsZ~QGI+q*2p
z{OY^u@gLS!U08nd9gBeHi;#Af>7K2VZt2Wlw=-L=WU|a`4~+{KqKY<sKl=5^#g9Ta
zOPqfTo!Ywnl>4H@4K3%)1RhLTQ}{q&WrC>R>swWMbAKK<X1_Ww`22zMfzDq})C+m3
z#@h>&h@O)@x%S|?)A>8s9^qYc|7Dq~=grNF|2avsMg2TFBVS(6Y}HiRoTq}38x3D<
z5B&K0u`sjWT2Ben#rt&^^J+X{DR+@JU%TDxjM0ba<xi(SOS#dI;T!k5<fR8^;^T$o
zTYkS?GWELGY|Vh$$Yovvk5?Q1zr%egf#Leem;2YBuMc>C@!CBzZ${hC%~DRub<xg@
zd#^W3akcLMALT6+Bxu{S;>68`x%--Sz47aPc-FPZE7LVEy?yq~dw&BzPF-CZu~l2{
z+qLhydmdfSnQ=GEu#G|2EvjKkq6j-D$Fm1+-+31(2DQY-FNu0^+r@9jE;~Nvr7_F~
zOYcr7Ua?2!VY!#Vhfh!CWA6t%7VZz1_|n9G%R_#V&YHk;S#R=R=oXoV@*DInNxG`t
z6A_$a6**&p$(n`i$B&q;P_HZh@UNi0qNHrY|8Fk}D%SCBU0f{u+-kqC<{`l^a#rC7
z+vi^Y|K0g+;HT41&pP<;Iyv9*=ga?|55ITo7YHj#))y_;TrYO{Nt{D<U0Euh<I4Xk
zMVsq>NE8)_Up}l>wCP}GtxaZUW2oIxjfiF4t?yH=FS;`!=T!3q-W!hlPXzsZ+Ts#@
zwA6Xk<*v%tforC2y8iKvo^P_?8E(0U3y<l~i|3mVr+B?@-;Ld~4!*l)J$>Pa7ia3i
zmowkd(71hrgU{u{t^Vj|&ri?(S5$f_+E$n44X<L$|25M~{(k7zo!g)CR7KlmxAbNP
z_l}!I4}JDlu6z9WL3`mmz1o9M&fIG1SRujA%>2?Z>tV~$7uu0xp+{GDZMv&)WC_#r
z_sTnd+)S+U<E_YZjyPyCd&0M~o7R~znK57Q^Deeca=WwAvsKSkqWyK7@(Rz(eE+!@
z#~k38Y!Z7mEURqu1oczNXBTIvn#_(}=3k-m>PpEsiHQ$SrTh{o{&V_#_Tr|+h1R(*
zcK_$Lez*SXt#XNMyR^7jPNj_#)QrR5ip~0PcI#HxuxF)Nn<G{4-`P-p|66G2*O$@Z
zt;)MgHP8J~D0X3MJGa95X5O9riSh>&qy9BzZeG1~acAz4ulKt6rmzH_Igt`4_+!I4
zO`eVOPUoEC^xSBto^o2ZX3e&b?geHJo2w@2z1;OmVfmNEt2#7VrmPB97QVXo()-4<
z`wm@^KbIH$^?_cIV$*Ad;L;5Vf?B7iN=)#xWb2&~C>^fBUT9EpG}bkbTlYH8mb_Wz
zladZPO`ExE;!??F`9<P>#U>mFbUzzr)G|!$n)7(>?Z)qI%Qq=5VCS|HYyGrpXGB|E
zYwq?h0blo(Gwv5=I<CDrb7K_SsV$1HUVeW5xFLQ0_b2Dmm%qO+E5pm*fB)}KPlox0
z(R;cg{lCn<()giFEoOJnG6{au+7JKk?p|#E+<86szau&MLF(7PzWefJ&*O?Ot3N6T
z9J{ge>5t{}FI-p5d!uVTUF9K5FXJusS<l$50vB(78NJEEY|eoj`s<1uF1aW$HsAdx
z|9fHC^;aFti+^T(-=LQqv0;|iUG;;DxH^}5Nqg;iaq!H<_Ia8s^RpMRsT!<QZhFdf
zGsceng4{>7#(FEeL`D&(8lN8lvwU|>?0UKC%7sJQa_`#*S_>TXoqR8z-z4t1I9E>9
z^l6N>e%3L&CNHTwqP_NQ7kkF`s4NCw%S@iqmUi88n;5=bVyqLnt{=MUo1rf%+|vE{
zSIcg($=VAzZW|UJ=LoQHSk4-Ac<VRkvQLk8YTLFkf4}o-@(*GDf5kDcr@x)NPuRT8
z>9qE#gTFU_zI^>~^X2R7zu%X+_V`ML=-IBa7bV4CAG`|9Z~A@OHKvMjcB_<qqP*FK
zo)yX!8SA1eFV+=LnfqXGeVXgx`L1qur{A6NX}uWy<YnQXXK$-*c#fQKF<$=u{6kBH
zJ&{H$z6;p#wl`$VC}Gn%YH;<NN72h|wlm7MUk~$B3ff)pgj?r>;lg&W18YC{d3`^a
z)#2B`A>Q`>%;tH&?ukBH`>(J{d%^UTt7q-B+w;#Pvf=#udE4*a^*yD3Q(;2;_T_qO
zs%J&6dVi0rcU2<CzUtgFDFPhkC*G#+V!0cmE8le7-0Wb8$z+YfH?w9mHiwj7eBq$I
zFjMv%r&1UDs|!bB4m&dVsdFsy(^g~VwAoo_5%Q|&K$(To9m%8xSEkEGaxk={_dc+S
z_ud}!%DLlne&IPr6E@{foN1O33;|tn7k2B+5}Tsa5c^YbI?LJxQ*;)dnZP%@+Dx-M
z^2#k+mkc&Np+jkD?~FPZ%QbQ)-t$f|x~N|Dr}DP^y6p?nCoHK|nwmC$LG}F7pF8$(
zIh|wuCMvM#x=yLG;p$i0q{|q;hR=Vewr@AH*P@*!4Sm;s2pCLRVCQfx!$8I3-girO
z9Rnl%Lu%{X{#@6QTs=Q;a?PsEkt!FzznReB$g8oMP5Ylwe#zqHpK}DFFaCV_Q1ju9
z8PnH%Sv<A2_R#ECT@m78Oq-r=IJ)rg>&&QXi=dKnVWX=pOC8><|G>S{<k-uplg-%g
zXxVTu-d9_2Z9U7z)n~p0RNq?v|Le<#zb7w#c>8a$#bx&6>+j9kXKi)E-n!^rq^{_k
zz5o5LUW{sF-=%MrouU0j;Beut)Xhmb*4>Ll9j{1STfiA|e0Fro-HG$>sJJejx^J#f
zQ0tD0pf6s5f|qr|i<=I7(o(#WT>2q)tyj>|?_cJdcscF0`Ro0*rZG=Cclnu9p`};n
za&qpK%2-o2<?EqEEdgq!;!Ce_s_r{KDXwAm8@W$YLytY#RbN(6^G0g3K<%1<<0=09
ztVMG*?=70~J#J1&<~(N?mq@YHt>Vwai?=o>$IS4o?JD@aIacw5gk9H<3%q{55|b<}
zk1|%|J($KQ-%)lkHEJpMMW*!~dgcdiOupCs_TZKsr~f=L_<C%MV_@EtXWt%Np3sv0
zmdXE-IRo>~0Hy7V)~~c`7Ww(^)#eAn-=7+%?p4nD|MlfNwU3|HC3JlEFX9o8x&Ji%
zPR9II=M{5j|6}oHn#=BOqWtDS`;NZ2inI5wt+TCpAS1lgdLl#3wnY^Z%KKt1PhBn3
z`24cg<xq%VFXz_6so~dSs#`8i{$-T0wsfJyMVZOc9e!6|bU(iG=<c+aTQ48Faw@dA
zjOpt4<&9=>QBrwpZ=RWD*tff8f9<;mp93bf`7=jG?|e4-?VYwGzE`=KzO$7jX1{ZL
z_91g6Gv~c|^Q1XA?$;>4X7SfuKlA*<8G(YjS+Z+pEX}rGZKu+5tCzvx+C*c^k}Xlw
zrt=G$pEMRdQm363^tN9;$!g=gS3i<o)o1seStoUMsn4p*iN0@?rfJ^&lRNuc#J#c<
z3uP5v*+O~8;EcHef<2<&zGnQovUS4Fsml*sc@uPC4+F!GOuI>)b7f{rJ?69ew)yoE
zuW6?@EpIGIek(6I+2&}+f?wgv)3eW{Wo+PT{K+2f|6ohou4w63N0(Z=<*LZ7zWqk@
z++vBetP|1vJ0$-0%wo*^$GRijBl`2NH|yCCTwML)?Za}brJNGQmqicHNSB{nvhv2i
zJv$DsE)VU<a>$vZ@hs%dLEBK#D-!!N0_0L}-dPeTnVz|?LHc~|ybdXg$hniIue(x{
zDzG8XzhC#`qlvQu->&M)5;BQ#W_Jj3x%=x<pOf@PSJqcubD9h5EIT;1hXyKhltiBU
z_@O{}j(YGK<_|YT0@c3P1|D9b!B(KyH>G3QsiJhT$AbI%`mg5SZhld5$T;|1f#SNk
zeJKV)4<$uIPv;2wc7JI*zF6ysp~KRi#Iqlt6j?|F$LUP>dUWQJ^eKys<;xcxmbf%)
zgEQ|B15t%TU0xq_j!S>EnD1j`Ve@q_tEWq;K+-iu?LNPWPuvb^p9^@Z?6UgoBDpV&
znh*Zk{O{O4E7#?a>Qdfs7Dt;cf`V1DcIt;+oD^i=ba+?kVi|X<@8&{UY_}K7@OsGy
zHkOr!e=b~GYJXuSYs-Uv_gDWy9!x!BvHIze?Xf}o%$@et8Txd2*lyOD$t~z$cmH5n
zrf5lTnggeTMZzKp*B{^cT)#iN8Tv?J8grDT`ie7*Z^D<a2)W&TIqBS&9ULaorsr?_
z#b4Pr*LYFmtFU<MvZUizwiu`x3wO?1^I*ccfS+xby(5c$*jZ|I&(7)lBcM<v>itq$
zAYqBEEAJwy9ruM?nDUssvt|^D^tD}$kqx_CJuB|gea%+_p$*aU_bl8CJexYjrkuB^
zo5Ffn&F^Vhlk(;o{>ugaj4D-;H@sI)+`Gzg%lhS=mW?ae5-y9Dil?qj*_LE?Y|WBa
zx~2;Q&K=D;qMqz}+Bu{6MQHLj`{wA`S?9QJF?LQDIg%XM@zdvn@XIX{y$Qb`oGNr(
zb@gY3$IJuETlgfxC)w8?;SjtVev#Wj^PT5`cO{`r=L24sx@Y`(*EY*hHNe2}&&%6N
z=A2hng)WnLdjHBXcC(t+lV{giuAG(<@cGYsZQd{OYZJCM)^Qo!d=SyFSL0km_VTGJ
zS*j}e5od#!L<Q}*7<KuJ&g9uWcjv5NeKNDm`b1O&M_1KP1!))m5czpI#Z6*cw=%Ak
z_LP$548C<RJ7b;Jvh5w|elOYF64p0p>J~WPKbRMCUu0u#zqFLW(dEG>3!h$6KIPrG
z-O{$g*)B`$2}6i(^NY2M&RzA9J^B4av8;y3Rep)SSw2@cXHA<jp<7Pi{?l2jc!NaD
z8>E}9_ncY(;RH*qilLP3iCfHH-iyi>)UqqaU7Zv<L8Ps3hS$fc8Lk(88PxUM`|2Sz
zBZKt_XJjL9lhoxPhR6gh#skYts&%Eb0(;VZMA$Fzr#+fss<YvGq1SrD?Tn?xF?SaJ
zc`)z5rsW?e-F@-QsI~u<%-&X~utRf;t($N6lzWAK$-URYQX8EZbj(ujS;dC7mEI?1
zE==^C=4*P-=E(-;fcbM|HY(m{dUIt{!0Tj#I<<4tQZ1_A9yQlX5cta>@If&-i7j2r
zHGywV0_U?049^xvY^u+W^b(Cf``3kY<FN+{!t>irdY3Kx^>p{ziCeF3ULxC5`r$~<
zWj}d8d42V2g^$7CXGI1qud-xarTnA#mR4-XB&nbf!8pwvG1cmmQ#GgPUH=(5m*4MV
zq1DW)@AuDfNBGBEcOJ?P+t1V57H)pD$g(@{hJp1Xzb_e^g)i{@5i@Rf&Ym-~TR>v+
z^J8!Cb_NPFB?K;idQ<3KLJ~9g;|U95uLNw+ic^=`&ZgONaQ%fV`oY4RmhTe|NqhDA
z-M(lwg}xZa3xa1K)iNyq#FrWTJ2<*F)kGrg@<p|0jkj-a%2&uZW!iD8>;31bAlrZ^
zQ#2bq89%ZZ9J+dWp@P`;RHvyb$3^FCJgD-dR^ZE{B5l)DR%fQ~33=M<8~z`hRAIKe
z;Cj!a<EQl_KQpW=J!BK6bM{5Qk4Tb{{<F%i$~kY|O_*wN@8ATp502-;H@&Uu^*3xa
z(&(7Ifz9ccOp)Y~(`|hR`6qn8Y_*|tfA#AusdqOPUzWYX?b+yj<)TkS-pZ}>=DZG;
zzqaMU<Qerw=cK-O=a~OmlEu87`y^-Gkqe9h863X^qOV<!O%8FMFFTu^|G?){Cu&zL
z_7+^9c>k?;{Q0!Cx2l4?eVx}<2FQLp60<-3mRavZ?fQAsRwu4%oBB2F<Z-XJmR<5I
z<ON@K*<b0FZi{&5p3E2BR?FJR_GP-#zE^Q4zif_WS$E{{C0-qC`8n&S2viEnpHEYf
zJRJCIo6fXWp<N$6Sl54^ww$l$v0a?%>Z?lH>X$<|u3GeC=B+b2Uz?_^dgnXkt#rPs
z#3~KrWz1ol_?EsqYG`?OcgpH@2iFxxTXb8UZ<#gg?Ka<ptjFJ%s?|oOMNVJF^zU-W
z+7?%DCdb=z=1q20y1XF5V(0C1fzjsP?=+RI#8~&*oKv-k|M<`N!nQfad7WJGD_1F&
zm=$$0d=<zq2`ymQCU`;j@K%<}8C85-$|bE0mu=TX1>f!bR<fLD$GTl?-;+wKtIWK-
zzTU6*ex}G(zdfo*%gQRd`u2kr2e}M(eNMQqGWEt{VXmAP&sT&WS8cs`OLbAv!KW*O
zr>%RpNNnN7)hFJI+@D|>k^9Hs)$t~$L<f#M7wrr68qeY^n-)*|#!<g);mw5~v)6T|
z>ZWHW=jsTpS$RJ0^oCnsCo5O&JZMt+;mgK3D<g`wF#AQ?^>4bFRGEMLv}Le{aKX-&
zD^&^%>T29FFV?uYPRQk#SoBRM>8ruQJFDy?KBsQEd#gTb#d<l7_45<|Uyy7Q?!Tk;
zGj$2ex2Jy<c1$Q^KNIe(WxOTziBQ}932Wc?AOE)MQeASu>ore~_WTu1inw7>B<sAL
zr$R{mhW0ZnbDJ-64UaAaN33>gH>*EuB)j9xmZV~dDeT9Y11_&N)w=F?de&)g-?Z1C
zUKTy%eAm0R$YnY2&j7y5IudWTU1C@y@<Gt;6T`Yn*5wV4zU}e+=c}KrdbYOY)X5_*
z65{U@a;jgy-E3p5nkD$T<i)$WY0r)*J07=l-dw<-K2@&w*S;Ws$7;q|R;MgHEAz9v
zg64J_PF=p!&SLK6K6B|M8_!+7GtcYMUxhs#<xeNdbp~9sy?d?qwxDH?+dt<O`tplr
zTZhiRH`jEnt&aV*3jtEfo8D{+%ej+fDj~RZ*WNYjx<xN^JzJW$^i$|`^9j4AJ~(_)
zK>ORFgg~(_v(<`x7ZbMzy^Wr&v;A$=`90rd5BKYE7PqS((FqJy(|yh%!Q{Ki-|~R`
z6}6Kb$9S|ZZL3RZv3xdf!>X)x5<N;?$<wxPQhV^kQtkdysbkMVPRK}wP7ay8RZDDb
zvD#UoRO9EWEv?TxgQgp9S!D59C2Cn+*sVuzu5K>wImeN*RJu6qhc?Hr*()NoCjWNa
zV!ym(tH75tQ>&&jXhge~YB0uxIxl(n?Lg_qX3nCxS5K?*nl2}qOLsq!nd;@1vQy^>
z%g>F=luVURN7Y6xb(|hB&wh$c_ML$HCT|l>%)-4wO9UoVe^oE=b824uzH?toy6$t0
z=#FwjrW%2biaL9LeEPj3QNZNst4q5U*BY(h;!6!a{_%L-7saJNuEjbeTmJd?#bn<f
z0|&0N(^4wMzn;Ci;>_IZE+;k=%5D62Bl>bz<%6;YGq*k7Evf>Ocm)ar+BSB^s@Ii1
zJIHkU<d@p$i-{?GiW3q}o^V*A$FC4Py>M&OiPpk9HLonz7W?rm-=6$8TeNG@|5MR2
z)vm5=8F{-BtaTmUrt=3^yp!GV&NtLUcHN4*9*lm9fs#hw*ce?tRe#)U_sd0h(ajH)
z5;lo-F70zVlg`}|Z|`R^Hn%X4EMwiTX!y-`3IE!&Z)WRUyr{E(*S2ZFZ^L(pXT~OP
zS^s2?s+!?f*Do>2Q!-eSW~Mg3C^g#8e%eZB+Bs>yUp<eeH6DsjwwRV4<i^ff#blf=
z9onliNvK9)nL?fJgTBQ}Ta0Fg@8r(=n&C91bom=CTidA1ZLDR}Z|`F_Z+K}dTlL_u
z8&~BLmUHO~StGA)_XtwY-m~J|?wPxEPJ5{-zcpcc(yy*RZ`y0U*`~b_;@M2MlS|JY
zw7wMfg|B|yg@t^7Crk=D`D}B_Mu&EVJIAj5<u?gT?dp2JVmj|Swu!E#OJ*N6vpP3n
zONh^$)4VI<4hFYGyM^1$dc~r`o#5GVY+1C#hi>*`>Fy$duQzBt+~9CDbECs~-V=YP
zhp$el+7{FMnaPsZ!XxD~mzwSDKJ7haD~cYlbcp(e1+!Q>#Lw0``)om9!piH%Z_VO#
zNr~uKm=theO8bSorQxo7#15&%FW{<LrMvl&(~8xLrfd(FS&=H&eEMrslV$@$#Ye;S
zygv*q9Be;0nl4)><S;XL!t}ix@27nKYGQP)>DB&vMeRL2`DgV5=T|OTx=(kH?GHz0
z!zO!Cui7mKAGGcKQYQXO@vNgud%DhyD%0Q);a_{>mu7AWJT_DO{QUn9<KusY>F%}J
zaQpGi*fm$brpf=#nA7`*XTqL2yziy&@2RZPiCt{&x_)yiXQ8_J)XL>S(qG?e7rbo|
zy{IFY8T$6ONXavawd~RBeLgr@#5F!r3Y2-j@6ZVu{}sGv@2t1Zu70+9VX=R9MsJL%
z^`<-P-#we~b(J_r_NI3_@56<h&fW=l%{y({)>CGx?`A9b8a1!vd%W=C^R;ak`Ks?S
zNakGH9Q$&L@}*gs{=KKY`}E(<xGbcu8lq`*{#@zWXA2gl{=KREZK7=MiKvb_do2ap
zO<O`sKD>GG@^W2?)vuoqB>(XLdvHTqsD*#)GX04D2)V2NKgC<xPT1!@knvPH^eicy
z=S{`ZHBSFTS2%JN>^msGdC9_0`+e9M6c|@E$Jy-owsvYt%Ki0IJa}Ihu=su2>-p#I
z@9^EnL=I^2b=^>%+9&pM?bW?$e)Tc?=et{+s+*boCa`})-=fxtAHDv&^`G7BuRHZu
zO8w5V<+mT7z0~YyntZ+aqNvKG<ea9)J*DRRZJio|AG{QF2v^v>t9|W@Edn3%FYkTr
zUa%%k$ZYH3qtUT@<QCuczP#=Fy3A8|Y;H65#ERyb+plD|HYpTd$3OSmM$VO?=RKqk
zezZSnyW1@yxb5ns4gX#26kV-;U)I+=AaMVd<Nxx<Z{zJ9whKg?Ci8z`;b(Zs;8(y^
zVtwq+y6;bpI#%_j^7;KrwN0pA8!cJ0!*pH`qtuF*Ek>_J_@uUVAH1)};Bi8%Yo42a
znd+PU+pTxaua#Ml@;x*)yq!m1WMwd$%z3%{Q+1#4oxIm_%vJWp5!(b=^H9%O{qJQt
z7gY3=rSFhY_I`NKf9_k!cvt`GuE44nFIOa+a2{D<pff9E-|mZ>-yeUqfAh1;FB11n
zUSzK!^MT1b?qZqJ?$vAM3{EWzs5yMwRJT<6?2V|FEhirG{8<ym(Bf+Ux%En)wiokW
z3$2t#eoOzxsiwZ%*R;1vK-IF#G(*l-r!qtQyuNLY=+#dQ%-P5G*6d#R`jxEaJKsg0
z|8Cwdv%fO6^^&I%vjJC!^csUzL4xy7EM8t0KE-wx7wh!*rj3GGv-CRM1XJc+kTVEl
z-}1{#<e<YbCw4z4<GLAAbL<2xI0DoBc-CcAPpDd-&oS{_uzjfQigt+!<xLNTOE`af
zm)-An4^U#et6a6^-PO4>e<xf^cHLQ*Q-5>a+=jjLEYeE5OJc7jib$N=qN}6a+<I$P
zmajqDt-d4oGQHY<N~~D7@5a80Ld~N)xy&W3qtdUs&N(*S@vUq5{`>7JiM;O@99wp_
zKYLOm>*TF9j-^uT*00()i;X*$TWf|;OyE2Qmx|{nLP9tU_)@H&{?6Ukqv|C3r0c`S
zrBf`Lrfg!CyvKI&rtiKDE1#CemW2P8)XU9zozlU(-e{}fMZ4qA*WatHGuz?7XW{Z_
zu}Hy>uac=Z>b^btUjO5odikCP(^E1Z7+t(3B?+)Pcj%wr5)-Vg9OgN%gs-5}_Wq7m
zt4CX2JXZUlXkyrI_LEKJt+dN~gWd^`iZf-y1ivX)-gPdj-pb1?toZC#qvWZ-QkK)1
zD$lQ$yzt|4Y@^q#;G_fYSN{Zf+~3Nj^U?5jpI~;tp5Wa#j_mosv0b{M!-H-4yhmG?
zN*1m#^-h`l)!g}KgWyi%mRD+%6YXq%@@vavGweUSc>7`bZ~Xt51Z^ySv|kP9-u2Nw
z?hC8``EBR79S(Ej&g49HW!*Nn=V{rc+s<x?bu(m?WAa+FDU~JhuT!H=T3yS$D;(^1
zmMvx|U-<Om-(#O#^wXSJPBM7Cv<L{(I92;hW69LQ096KgkEtg2LS!2b?RdCX;0w=d
z?(3OXj~7VuAK+X6c-^a$2OO)7ANh-MU*<E+t%{M@zx$Tu(J61&Y!mc6l(2bI@y^S-
zwJ&qx{xaP7c)`^=PWkB{X0@ofF7@%ESr-|b9Tt~gvd=H6@-S&zQSYp-_iJ-;{K5Oo
z>e_|^T$~xU0gqWG=577dz--8xCUE`XqlBocol)m=@60JyO=)CMvASNc=8#lC-YJef
z5_M6(R%+fAl=<iqFZ{^At&mq)bwbGHCA-cYlIYykY`=K>;;1KUrn_5T?5^9={NJ?1
zx8x$<<44cERr==FWu5R+wYN$3fBE;?_1lFqUymQX`qlp27X_{dn^TRlYW6z6_h@cl
z{ug_?!qs<wbo9lr?On5WrNpn~K9zHBY4|mRwt{mHe|@{O{I6T#jIWFRo;Y0Pln9kw
zFt7D;(`ud<@6HrT*f~l+vW`5d<!4-MVZC$P;rEi-ivpzD9=kG2Hn^OL_+D7f_wj?8
z%8YN<=0v3Imifg#{jmA%hdW|B4_uAkp!#!<v#CaM=#-lQ@~>7L4&bjcEBpWG=+oAa
z#K{`RRrj}jQN4F<;@4U4O*h2On>4R>w{PsC_ur-qvPG9^GObIW{??eGUEk62S+M*4
zM>YpqtoG<-8AX-JtW}@?YFSN1f7Hq2wbw6X?vRhIIT<yF&*JNOHOW&I(=C(aRcBo|
z>B(*%epDt%VEbNUx#RcLrW9@Ce$-h0Ix*l`S#kQp2Rd^9^{3C7Te<S&`Lv?B=PsP_
z(+J$o+{3hl>7K38JD$WlFaPiE5Zk)yK&kBA7Rf-(s3zmr9S@Vjivzlq97Hk_q$;ko
zyo+&6Rtpl}ci@2HiIAlE{{$v@p1rprXmM)D#PvHa^Z0o?OnM+V@##~GSE}KjcK796
z?3>DD6qY*FOFvwHRj4*F@bqnU*Vrs39pRPgPt0z7i_eUeTYa=Q*lhI`L$~=Ge@X0G
zqw>FqfnA5;5s&&Nm-s@}HTNefb2CjBy(6|tmGM&7r3DXdg3oz!Y&~f=$=gIzmzPQL
zSzUnlG@ZaKy{;8OI@3jNyy}-!IF~B?V6oJXD_Xw`|2)|t=NlIMu%UiE^QDS)61hGb
z<2jrU_<cIlb9Bvt8I~z=zhBKuJ|`qRF*Ge@vqbu79oEp-x$_Pzp0)Apj9F*rc2qSO
zrHhI_V%Q+i8~wo4K5prY*}M*IFE54o_3h(0Fx}bblL~W)bN!Xdr|YcU=3Q8kc~-Pm
zU63KcD8lH1+%faU>7VBa{a)ZE5qfr8a>D&(ax1xK`8;~WY=64?rE{`xvw?p`>!kzR
zbQ&)t-AUE!i{mR)vl3EIa$6V1X4~gd+qHtTp;z#~Md3$|HIWRrpB)jo@;GUq*sf}e
zd-82cZ~s5qbL~`R<72<Z+kT!uv!=|N_mJbW<N|HsmTQSVM-}#lopD*MDtNnVUwGBd
z7sq$MK2#ykxi^sG9+%L8#cwA*EqkA_MQM4JyAPXn|J#G-jdJJx3Vv?HBW1pFj=}83
zwdJ2DciravE#3K)Gvc^8m(H{$Ec3(+xEob`qb0s4EmXNL_ve9B=#0bfE&n;By^A$<
zSt~s+ZrS<CaoZWQFCJ-hNlf^#wL{~O+yOZ+sW;BuF1Ka3Ztv@!aeIA~g-3AI9fi=6
z_XcM!bbD{CD|nXiI)QiD>E&JwA|?*4OZdw)tL(1uS1n7LyL}tKi|n!c7g}eX+$@-w
z!rai`E8|eHq)(aq#PY0oyVN=Q>A73|yAOUaVx9PTf}p&);`N%B1&RB5AMG}fej~Oy
z_WR4Pk6J!VY7V|#9(8H6oY#ukb}gGrOLyk>s|T0z^)%M~PI}I&d1hVmlnJleg;qsf
z<-L@y?XFYn`@UCRU`IjL`^QVV_~zNU-uc4p6VB@N`Omf;3s0nf<=H&{`@#I{36t-s
z3S><6-?J<rKxI2euHi}}w}68wk21TiG9(xr+#h5koZSEXw4-wQj*fD>q>5{oms?-?
z`s0&#e}kE6Vs5kYZN5v!0v*eqw&yqTxl|W&PX5y+diRNU-hynE89ysRjh^ff@L^xL
z`1iZ*N+0U)sIJzW)*xOSHv4#t`;6*B(FBc``Y{0?CKO-4&|kmOGa+80Ix%vCy7|kP
zsspZiIXO$8ySU8zHLqV@g!@<YigsDy*@cYH`OX>fd%QWA-gT7ii^AqtT$jD}txa`n
z_<eZ!0{$b{pQdv)Bz#Yv`CsANgP(8Ix5b_GOm$&AR^PU}YF|o5tw_*|tB$dI??2F7
z%@#Cy-yZ7-4KE?F$Cu_ur}Jl|FGwt1|Kxms&Nt?ZCJBpPw3f9fE$A}6xNk!2?%0-@
z!FS(qw&j+)+lO#{dHUqszXcx}J0!olFgy{rDhYk_G|#1%_xJ&eYsW<=6<<l_-&@Mc
z-2HsM{=uW%+mx=IKl#A(^M!`vzi;>7m@Xloeqho`twfGlWmCDd#W|vX={nssyYD*d
z!n>KXLvOzl*b`7(plNL0{>bdigk4KR%{u#K?{mi7DxIgto2TdZHG4xG^Lr~leqP&2
zCre-JubA2VRm}Qp(T1p=gG=<)H>sI*u$I5owqkg(Yu9{EhV;TG);pJdTV8&$)^(mp
z0TVCB@%4{%Y$X03ogrv^qUFGj>?Kmy_K9k2O1530vSo=oZ`Xu{`UV$f?3$ySWg4wf
zSNQ(%+kg~9pOd?;9KB<Cze=qxuc<r#+x}x~gcSe3R{6i8qQ^?^^6Nilt0Sw-nD?Js
zoyf$LR{Q_Ok<2+~bQHI+8g^<r-nhSd;nSBB;*Q&x%(2m(5D+run&-kmwtJIL{IJ=u
zaK@&n&Sk5<3YmyR2WPD<yOQzK#WL~R{`sa$ct3ob>d!9y!86a<b8ou+oWE~N?_3bw
zWc<QKB_Yo7k5TPKx8LV4o%A+hpRPPp#p9%~{j<-7h2gHYXD%<)vazu&tk&Ie>*MR~
z>c{UN{rk*E)}cb?tYAscn!t5R=eFpq>e{)m|Jj?Ry7lE%Y&sVAZXR^9p5RoSUu;n!
z|4{qHB-v-4!q*R&W&ev))VtbvjV(_5wj*1g0q5MyDs85hb7NkfSaNWs>b`9XCKC5M
z3~f4OxLb<Lru*jvWp3f^J)X64Q{=uo8+Vr8@oo>f!trmx4elphT+70jtdsG#cs%u)
zUu|>J6dkeDg?xfLc!TGPm0y3p#O7mO=-UA4WwSpoj6M@R#lUOzOWQ@Zy&i{I%{E8e
zz5Qvm<%5Z;6ZG=Vom{r;q|l*0%jT)~)=iP@o2;<U%A#Sm=E8q2EWd*%uQ;S~t#U<7
zpJn@V(YNpWZk;Rtz2U^}ZL3=v_srzV>D@kctD@hDju>w~uEhoS4_noGv`w?*nDUO*
z`oh8ePM>bPGjf`J-hIWL>^H&J1uyMe91~t;QTERHpib|{&}^-Iuen_E0=CQZUhSRp
z_Dz02|E_|5*Lh|WxLw&xXBtWWWOHY~^R??k-9mv|bLE%+m927Zs9Eh>vuNET`QI1$
zwypH5ta1KZS0(m0{CTIg2DccG<_d;SH+wAu7?=$HXZ(92vzL>dx9OhY8u6>^8D>Pc
z?tJiLdSTGLr&;P3&QIN6Bqc50&+hPtt(^Uf@IlRMiOF+!-uQp$?Z4H2SMm?Py<T9V
z{_4u*my@(l3)E<TQFT0hi&I6XY#vLi^%6Fbw3%%uUmX8^KABT@&Z?gV@7Z_nlxui!
zH;b=u3QLK={`vRMbX&*eH*ezTs4slGYxVA%j&d@3Q#^8N>lBY4Td%3uw7YlK<SbJq
zN$Jf&+d53|E-|xr`?7a(N!iKFg~=f^`VU^2aDI0Biu^6YGw!BL3lCpiqqE66Nc!88
zmoIsirMIi=Z{K*>db9PtnJwKjr<dG!n!&Pt`(^<RuiI~*XxHnXe=zCD+pixI4#i*k
zt^M_})sAGxtLF|`yg5^OY2vSz_5C~AU(Bg(R}q?TV7~6<^aD>jCw`L5_YIOOpY`=I
zV==?6WrockR$Y0fcR+VVjzd6SU;K-87VREWW!vN3^ylyYG5v+@tILa~$KBl<lRL+-
z;)sHqeZX_!SC=Mt6uo@mZKm`_NbQoy<eux-_#RDFEY_SqBjbL^+(*S(3Fof=xF7!~
z^TVH?51zjN|K-u`3yM$ANGw@ja;N!C@OG7KCdqj$mih&yN9vsGcPgLSJEzzG<=N9#
z`&ihkxF4L^H9y>8JB!(y9K#1s&N+t^21whU=S`1I?=9x62$*KP)sx|bRMzUM%kQqf
zaPaPOJErooc&;d42m7AOo*$nW<?lOVe&yDoZ!`aHi1OuP{o=4$W!om-xo0oE@=^cw
z^!e;1Lf3ld+jjK$INU9?iMysQ9qs7Gtjud*B{<7rZY}@+zKE6c5AN*fcvIV8$h74(
zm#L~islLtagU?G94!j6jyTt0kGS}mJHp>pU1y|aBDRfluypl9mZ@Owj^P8Km4zfGW
z75relUQhg;uE4{2?IFvJ=iU+XYGYp2v~0&TzknyqC5$f(6|On&bbs5)W-pde-S|NF
zhr!-N<@m}a3mwmup1M5i%fn0Cj)-4&c+vOqVZ|K9de!_K5w;VRcPuQu{-<`IcKdfq
zbDx#diX!#RtV@Irn=5?1={@&Ew3=@BKEaz86{8c4#P^Bv_AW~OtG9FcF2e%G$qDOK
zoNomE&)mamB!6#Z@dDZTAD*7h|No(Sd2vfAUtf^%R$pz!r4e(Cb|g*;@x0FVXJU}G
zp|M`dy5g_*>zfWAG>Kj$ZvIvNiL&ASWcKCr#FI_0>;1d4@Q7=u`0bF3zcgF&Qyy>5
z(QGM5dCz;EXa2+KOPcRBD?H!Uae{k?#{rM!t{WW`1&$Ok*v|>q{=xL~j$mh#+SE+Z
z$Jd@qE}OQ=UH^wtWA_%j3!D$8xfGUuk3RdkUo7cDZ_D{WJ2w8;yQ19fFGVtaS;{8o
zab#PCdd<S8cjZ=H*R2!MI{)w3hi_$H<S(8!@OLb*lKK1Q(bK%UA1=uR?ACcdTRC9o
zElZ1lr>CtpA6{j@>}Jx+l$}Y1ds5sxo=K%&ew4+~*Pbx7;?pUodjjbfUvv8;K0m^A
z<wcGDw1frO{<8wr4{bbnW=^b%(~nyMU(P%(zZ{yCb!@ZAgUw3Yq$G^0zHWaJ6c_#f
z<>Bk`xu@e3ey+TBKkaLx)vassx6eAr-I&1_z|y)kFrLZ#@g;U&+e5jmI%#+KKTgx-
zHDa;laFUPg%X)BU+Ob=#@-`PXZ!GTEUEZ|z#h))9MAr7JlunA^5VtdRmvLz^&gc)?
znlj~o&zVUo=Py-qs`D;!@3MHqns=*YX`4vc9-n0&rQUAPSjTF2{oI>xx(WevpDZrE
zuyfAb_w(iD6Ie3m>3x4t_tY|V!lPf_vwtT3zk4w;+W6eWoh=ux&HKSyBl+UE!|NG;
zSEN;P9r-%JLHgm7J|?A4Vki6xq|%=1%B6cGJvb8K^hEju*H7MzxCqblnR-`^8s2b-
zw1r2lO*32=w%|k4n~eheVi{9-u5#Q~KVoN)6|6Sf>hfW;NGpY}DW_eJ?q6h*cRx@5
zdDCOT#0LAvK7XA{uBtwHkb1~3XU5vLik39>ZEqMl887@}=X|9aJ3sU0yqR;^x1^t1
zm)Y;%J1_9$0-f5H{Yrb^>0ezZv(nXpSC{GdmDv18zv|3a+|LUC?sUv7<o~rM@1~w_
zD^D+WuDiu@_C;nXqqx|+o<(1+Ho44}yC?Ga*WZGr?=BV|y2dgu+&bprf&zmo>*~WX
zC-`E&E&lP~@6DetUq3wf^7ZxK`FzQS-`4+e^w^&AO8>u(9_ve<Ls!oVUwEX*v}!^|
z3G?5MP|I(*f!gkKI`5rYck<c1cUK==l+JPyD!+W9ZSxfiuVuUqzkGK){?A+W)zRZ~
ztk%8ae>sd9=I<+}UW~DtdO}9|p44Ln2|d=IYdUt$shkmW>E#K5sN2yZY&~;a_IBF+
zm%93G@)FKY?Yplyv#$1eIIjCN_Z_q9F@-C88kzzxM;X@JRoI8u?y)e4J35R1z~|G?
z0$$ZTYP0RgjoZu=xL89iT!OQIQ<G<M<HZ|1;zt?zjD1>Phi)!9W24~qWDfgdEARZA
zTRKzh4@@)Gdnd9!nD?BImgRb{2@WMu&u=PNwKnA672Y7a!pi+;L}4<+4aW-KEBQTt
z7>wV3VRyY~Q6E0V+%s~`vt)fHG0ElfeA?>oyZye4t>0wU{N&fW?IAf?uOgXDa^}}D
z1u{>}FXTIT{cdSYLY%ltvU|}x6Z6+14tKL6jn!v|Y>K^otgNR|d2iV~_VNu@f_I&l
z?pv9Auc|;!^taW%H{3p6r_xmR*8TmV*BHO^c|)X`WAwGA-7(XXeu|%({^<NPFCVuf
zNl%Y=*j_o@P&?zH3X6>GuJ1>6qmSw;tdA92EnuWsH)rP!e*RA{ij<vB=-<6x%FovO
zbfQAcuX)CLs>^u&`|kgF`eH6)n&|ew%)${f&WfF`&W=l)*^yW8b)`jQ;|f*ACz6j@
zo-Q@s+j^yG^{FN1StkSDKAp_+MEp#EM%Ljr-$`z!n;*~JBC&Yatf0f2zqJXmSnhoI
z^G3&#V^L`VM>jKWusf0)B7RgkWlC!C6}I%p`#$bpHnSl<m5KSKAH&%!*GV3E?^jg$
zUW%BvG+|xUGS~2^Nw?m;KRD;|^CioF>NY>(R*>JYB~j>vkD4@}KYPW_$o)NCrkpAd
zA4s0m)5(&Y`sFC+on(deJEk#(`78U*YrFe!;aeZUr*`vSo2Kme(^Zu1Wh(N_=i2c~
zmeXrE++w}DjN<Q=-|5xev*=(y)6$Il`j=+ym{nWfeBq<1NcXCx6Wcqv?rd%s&6DG+
zwmZk2^nAsOb4FW#{ySUs*uYn_ah2aeA)}<Y0uRr}M}ECE`oov8Xi<8;pTA%H+<(zq
zR-Mpaoc(*=M;SB0Htnn5g-kj{nls~%y4@)4iN9#F`|L8grDj_+PXBzD=Je^)B-bOG
zBKExf{_*C+i{<a*H-=Y==^k6`Vf|`iz2Z$4#i!kO<X=m<YVh9=5s2~J#$bIye%;sW
zdymWvU;NA~AT4h-%fpUR+qH_#>pU1g2rPS$+HhNNz46Jz({tX7G)ew?^Huq+a$0SJ
z_RK9$bTy{$eIYG<__mY&ze5!l<#nrDYE^W%`**wc#VtE(vU<|WPF?lt{|Z%SE5EzV
zeDt>9-hJ<Bz3Z0ueUn>YQDpO6Nm!c0M_#&POTSwD>aY}t*f{a2+Ui?(r<6ZAr}vO!
zy~+FxxuvP|Z8&&(&BS7!|9toI_ji-s^P;XRg#F*~G<%(++5PUHD-C@Q>^c|c+dZ-D
zPR6U%c3HhTY?d!~vd`Oby|gE8^H#-eJ<pFwcYmx2Sbin1r0B=rlmAw4cKot9sp3J=
zt|RNXe;!-y*InV3#B#<)mY1D5_24m|MB^(yZ<S^_Wt~cy`Cvk<y5!6HmrK5L#u?6$
ziOlb^mVR$8w|=^=?ab(FrOVvHCMAF3n`+Sc^1=5LY<Z!_6u6e#bk(vpeCasl$9L8A
z(eCo!@Bf+A?5_XEyvg)z>XR)l?L6E0!gB;$ceJryyTWSsJv-&Ws^v#^aUGkL@-fQd
zr_l2N<vXt3t5%%a^ETs^=at6j)(Lg8=bqh>c^iBAxvKiPe~c*t+m`O!sLzqKDeBeB
zC!C*NF<qRwfm2q*yL7r!;e15{&$T{3db3|GTGRZ(QN=nnsDgLT<~=9VV#I6rmbXs3
zS12!hadDNTS;5jNp{<UmOV*w{n$LAp{<*bHii?Tqa=AyYTxC|z_ooE+mz=6uzb>M1
zQ<T`|CtCiGJA}OJ!y8z|Zq=5qduQF8A@8tpO?H%iT%0r03axwJ{yq~o4}Vo<Gyh4r
zVAI-1X9eQb&VSX2KXgUO;blAXsh{5$TAtqZAmpA=%i^O4vTx@tJ*Dz%uG-XAo(XrZ
zy<_k=;pzP3_M<bh(RbZ%KHSmqOW@3^k`}vzZCj^GYAH4BPVBXQe3fb2NheOv$d!7t
z<jedP&3(z9Q1dl}eRk^lUyr-1*i>!zzFBSaq)hSqO_A%)QvX;t?VejvkhJdhpX2w=
z?5Ngx!T98m=lbQ>4+Qn>Ufc9<hU1Q|ZO0PL!j?=6J#c-J?TT}ujkoTd|J<K7|9&u=
z;~7Ve?GdFOVF#?EqZX9JcxV()T=`*Un(b1hcP6(2lO`n@-eG^HVf})Afyb_;Rdcrm
z+`XLhe^Zu#tjOovJtc8&n*<j(RLo9UbcEy6qRdRj%h5${g?ujAGgdy!Twr35^14+y
zFG5H`^_K&e`p+95PP#o<zJ7M&{3q>ykFH$h^?&vHFp<ZOigM~deajwM@weJddU5Dz
zv)$Zf5yqlrw@=p{Ti*MAp34&<<1<>e4mO-}K6ls8Xl&SYE=hdZE6F<MH72n-SH#^J
ztpzHWp19h~Kc&4~C|5i5kKX*pb&hYmLc9O%HjJ7SxcT9NX*cbz{^>O-=v8L1;tD@4
zx2oyy<!5igl~SFaAL^bSHD!kTuT|Vhmk+p9Zd%h}J8gE6_OD|+?6-GaE*Dc=KP}Cf
zseae*>-H^X%TBL1<-hc7!LG(Iu96j}E^$t{;QpHLSJDH=VwcG4#&?%<H-#@O_;BdZ
zmLtq9tJ9hF9yPp53vzL7|Lq)>92~vurL6OxsAM0-4fA3iPYn~dH!@3h&d>@o?*GNz
z$1z*gyr=d($JS%1XID>feK+}Y@YVdc7ut@yJ6XJE`@%GRZ}%RT$DA5PuU>@(%c`8X
z5VS%$rkmZb=kl!^J$!+Zjd$0Ycl7cG#I!kI-XT5h{DbphHdj(rqc(g#wMZvVQR?!(
zX!C|n&8^o?Jb2vp>~KzigzEMK+DUePUe$BAnQvLmq#E}6LC3LGm1VQ1I=T5i`@Uk4
z+!o!-t!EA`YL$_W*z0S@m%_dAwc3J-aslbTKd!nx*)b!eKc`Iiih1rfv1jg?hs#7Z
zRiBGzOqZVP;`Y9Ixv%$|1$>>o+tqT7tM|p%9GUs!gz^4;mKr|_88*AreQk~u%8zgQ
z{HIuW_eQtlawnMX`rf_%q)=ifU*BHOnz&~rua_Twdh6tL^S-(+Q#H*ht-m6|JN%nY
zZZ0+1w@;JN{7K5)_{)y%vlkW#ML0zNyt*ermg%}-hwQo}1((9tFTE8X?|6Ll=^qQL
zil1-Y&!_I^%7}g=mF%|r%hS)#&kNdri~o7r==<f{m3o<t55f&^2E5JwRaFrCB$Fek
z@$)frZDw7kRl?t8Z*><4UHWDi%=KaJ1()hgF*5}9P6sbcEV19M@nE)p#N#Kn24@@B
ztQRZ_+`({dC(~XYIiACA6WnJ0cF52U*?uK5TudR;;&$Nt-mkN6EM<>cpSoey$LO-x
zH_K#RF0otD9nG<Q2Vc=T*2cy8$`_eCI~6P>9(e^^7JZ;5^OMs;y+l+g!8QM>(?h#u
z8MYZao^3q3V3qWa9M{*i`?F48>$xM**5)!ZVV3sJ^X``xupDGu;c;U}#FBo7n$u5C
zUEcTN*Phe^^PMePuLRAHD_AaD)N4L1`n81k)+;hSm$VL?maF+y<#$+4bHehymX)ur
zS{P2r?bT#*e{V74_*dP1n$wP3&Gs~NGylh+Wqzc2;l=IWTee3ZG2kiClyGJcQz(_5
zBJir|>Y?Jk8#y)=LT`?~ys5m^=R419LvPuI2~T7Kbw5R$iiW>ZdhuO_r<mtSf{IQG
zherC#04~FwU*|sHvU_Rb{jAD<N@N<N>VfPXeH|~-=SRkff3BX(ZglKc*(Ft(?7|aA
z?dyIYemQ$T=k?4F&+Qt5o?ob7cRKFZ_33QI0@H0%R(%Zq!4u*#_vkCOS0>XPc^#L3
zoVG4=NqWbtT^;3RUzTc@MKSUuzImIvL-YD)n`4oTMMZfj6WwaVH)VCR?<!IFaWN&)
z`Sl8+7>-}l=We@E=8`)*Ny9*_YgW~j^s5VZ2li|<akY*7qU4{y>}JBAS-K9#V|GZ-
zmfYqodoV=%=vsvn49@$!o=<tXg<15_?z<Tmu1Lj{7vDQnbvZ6O`hB5U>rQ2JzaNPV
z{|}#w*=GK7?f->UJ+~4orf)i6s=s5UKU>4H$4h>v^iEzk`RLYvlO`{<D!zFy<#S5!
z<gb&Dey!ZGrYm%M)WT$&9SRrnmd?{{>#jb!_2AOo8q0X@UY1IIIF*~T$>{ivGw$!0
zUOrwXe|HwohlAD~uhu8=r;6=!ZJAKT?5h2E)uHm6vjrp?UoEstd^FeD<#p_|SD^*g
zZXfR5d;7p_<~k#PlV|aof<`~voE`sFMyKB_jd^gcSKBc1pf>0673-&osVYa`YZT7k
zIcxDlS^YEXPR;nNFikRX-@^4eFU{B%ZM076&X}>~l>5rl^L!43r%hQo*+&0^(DXC!
zZ?1l&Cpb+_ciEzri_Isw=N?P$<rjWXmi_(Rj?aeC&RgxR4>V~sHry9q>K(1}(zod8
zo4Lo<-ur2DBreYE+KzzRocyPf*5!%a+_hm<gM;x|@$TQtJX-?%tCY>8Jzs1sQIq&1
zyTthQYT;(yGv!mCq?{?by-j)giJb+T_gztCeUqAy*2_?GbFP_B?(AUq?G8Jil{#k&
zHvN9V>7K3hFXZAfenYJqy956hzw8o`Tx#X}Va1N;`dR;%S#MU+?VezFIM5)dSLfxf
z8~*32#g=etIDcFgx+=_4`m=A?qrD|dJS9Ht@VMPEDgLMXa<98*-Ictf@BUwY`hJ6+
zqNLv5i#{_QDvD-m-rcBiYu<dh4C#A!4^D4>ayROqVCMA_OP9T2-dEjj)!x5<_0@-$
zN|lkXU7t5^3}TKyGTrL6V*tzAnOU>8Pn+@Oeo}d<-C9xgW}72AvB7=iuD6vo2$l$>
zxOy(r2rqV8Vkh-Lac<wlL!6D93{P`6%OAP%itogV58bkJc=}74g>utl{!Ux*UGquH
z?Vl<4{=8Y{vSDiW%E-NM_vra9yu7GIyK45%gC|~JU``27NWA2F_30n=`K6Z2G(ILR
zmuB^RWypHzNTa23o0rF9#;J?<&65)RG_QTOD`yK+XUlA}ben?k{Mi#Gz0&-$Z_U(&
z_fJ{rse2{{s~uMib2xQqjm8YyC3SmGz7u7>(f6;GpU3Kg_5YNgu1f<m`qdvFe6#tS
zEOXnx(mB39U-A#$I1**5vUTPBs}nwUFaJ>VIarEYNayLZ=Ua5{_#Ix?d*0~T46omN
z_CEEUVgBJfXWG+6*FP8D7G0aG6Y-@{xpC7*TQi#l>r8pI*V+EPG%YzOr&4x>|0Sc1
z59C+b%<pLWRPI?FG~cFZ21{zN-B)+F{d@)@yV<|~TjcXra3{ZyyHD`NQ`Nif+teki
zUE1?m)5gK=V3cE@0%PFzlDWR(FWMRJb(J%e*O&T!TjDr(R>IZQ%icaq6pq-quXly1
zbEay|ofW<L3#Ki5xpAL?x$W`4g6TfuAAkN^z1i)b%ll=&Vt;LV_Ebw(Omd&^{hFAS
z>{0b$#pl8W^9$U!wf@_vaaGaq)6D!u8#&YOz6@^Qcv8QvGkfohwim6fz3<wk^c(hW
zox&4RuKeO?M%<0S@b9V)lc(OiKewjrRr(E|xvwNrKYyv3HpM(v%ZYDat>iAT4Tl2`
zeD>J=&vd2agT;p*n%0=R^N9#Mok{pDKl^pTyD#}~9?GmJT<Lu5K%mrKr&s!pt8Z!c
zJX)uocTJ7qWZ$>`|J?3}YBH_XvJ00Kbu8@ocJ0WFMf+}T+stXc>)Ej@^31OvJUda7
zQRTDwlXU8dH*;i!We@+jwZrbO!i}S^L#u!Cn|=7YWUaJvw9&h6y??Sbvm#qF@_S!?
z<gS#t*5~nj7Qe7~oYd{=?w1P>K6+PWDwq6Eu;flb?c$SjWr`kT%=hbf_*CP`o}Mjw
z<&hn?G!|@5`tfVer!^nsTY?Wg`o|po^rX|%$QRo+@@_owlx*glVz%q?qr~3}KQgy)
zH?HtypQ=^Y{OxkomF910jP0W5eg$tVShQ-|Gqb+?FND_ydI*)SpVZ6jG9k%)Wm(Ay
z^|tuVQv$0qHUv7{J3amU+mEsjPPHjl@3JipGtq8#=6T1ke6~_$Q%x+h{>4+PIk$C-
z?CcKF=84svaOuw9yAx!SiuVQXsEl3NHm!P{`c>9Boh!O>#TOsE>~eS2qwvUd-w@yX
zn>#1*6tA#YyDhPlQ+*0sf7lGxmu45AZmqoNd8mn>%ST95r`aWMgKFT>4+{7H&fpOJ
zsZy}3+<krDJ(<0??d_%NzW@92WWuG{?SH<=>**e1->Dw?e&X_gWszJDPT5WRFSX#$
zgMSj=OBvYqGKb8WVx=|tNgwEd0A;r)rG@H+krVjuHg2}@`zc{DGtH7kuyR_eqFPh2
z({|lo>vo<vJ-z<d<RuT(mhb)*_i~qpO3f>+@&%hB=Irw2wR^zx?uzUI*7gaXLT8#@
zII%1F=fadtj{1#0M`eym$HYuq*Zf1^M(blvn={Az?zt{DH%b@ZXZPjw#x?H(uBz#=
zzDPU1d&j*u4jC$+3Vjt>*SE+X59j_cMbd=l*cFKbCk-Q)DcFmZILa5kn!7%sDL~jD
z<xSnGgqFg4p)=nlty6cMn7XQu_pf;Jf>-v_Te1r5EY1XfX?x}VU}0URGE13ZSHRW0
zLz2z!g8k>&9IRhx|LV*WqY~4HGfKGS<n}hc2uRa>kU8o6WmWg$M<NNKEaE|T5-VMw
zYk#>K+RmR+e`LdUewk&T7@awdPle5xYEpmPyTgR#PhZBqS-mGTJx}JYp2@al@udcl
z4%U60b{c-)7s}Tzc(drk+Nj<i{T*AfTk=>1)2z;OEBCMD<_-PqxA9;9k6d=UWqDVl
zR<2^aAlh~I?}npy`{(&|B^ms@{8?T8!-YQq|6@xotWB8}tNPMb>~itHPd`83zZ`I6
z%L}dyhX8j!(HBAgH?p(tpXzMJ-5tN-e^&X5;8~fAzyE!?8+<~;@q9kNd-8IOZ+H~G
z^Yz8=wX7{K*-&5RvYVw^R`1upH9Kd#%ii(i=I{4$^X1sMlQTn0Jf2S%RK6M(P`~G>
zM2FE*w+rcEe@z|sN4hRx4LAbcu&A9jwb8tCt9Y=2sO4q9n7JpXI8Ro4_wD|sz>pjK
z;aYQ-8yDoX$><quWd6gQ<n%g|=j`scH?ls5Fz;M>(P7r%pGH+_T>R@!C2f7Ncg6kK
z?TgHpKX>1~X+{=@vG0Ti)3?Dv+lyu{U!B>c7<uvFYnCnZj&1N0*8E<(K=H%=<_q_C
zF8wHxX(P5p>RRB17Z&-OzS-@m*jU}E7-=<+%Ti(QWYZ<a1|<u17y8;vnSDj($_Kw^
zvy?hcu}3ZZ`&e(sE#|6&h1OeicT{dKJ$N-bNAvpo*{0V%3(xWl&e89BXb}{?*rvDq
z<-FBWdrmq`Q_ZkCdU6rhl9_B0?Z=LkEt2&+@1X9xL99q-spn<qYZFf#cy=&+a;@w{
zwhw)`114+P#W@yK2L}gE$&r3yv*O*&Pj!Jdr>A8mH(uQ4mUDUTl)aM$r?Yi#*r@l_
zGPLK}*W1r#2E?#EQ#dv0)jXlwq8E*Vr~5NKKdb%klJngIh0d-WYym#o9MAtS-f?f1
z$Avi;WY!7PTvz$Mn|txpoWgCEOhJt<)iX|U)*RDrP)`u$m|)_xUDxyPg@EuT#@Y$a
z`b*!qti0uGB9)cK70$phQCFa6^+G8DNrlOBYG<@RX>lhnF$r3J>%z29rboYwmCkc7
zyLtNHk&hM^<#QJ-ezaiUksANAjthSI-r<NBPFMTr-FwLG1NWo6kjQII+rF?b?iCO{
z{Nd3tFR64EXR*@!gVxgQZ0#zcYgHb}`Y^M2U$eWpb@_pUnSqjaXMf%nd|4ZL!@wb~
z!Rqm*nA<74G^@`{xccd(*|xvcd*{v;2yWxIy|gFtv`p_CNjrn^MIqYL+xX|Mn!3{N
z%o_HoyG-?}Kjz7V#T0u<c1(EArJ3`?)xPTI&i9FbPW$J$$v5)(oV~O6<FWJ}{u9cf
zM|(|ulJp{{?AB2_khZ*LM$67moxi_W-di`Bp=`dk#IoxPL>Trgnz1FO%EWi~3GJQ#
z92)%%IR1Ce?ew3o?7=fBlttW8*X5g{;vtnSTP%(ooZMLUe#P2H-kZB>*YB<hZ5POx
zTytdqx3~?f?5`BA+B4C0=T`GVt$CJQGeo|weH<BcPWLm%9d5f`86LaY1%^LNii}pR
zF>7Q0xMeGE?x9<ETDjN%O^fN<%Dn7C_<!aAZ)O$|1_lNW2H9qb=xMWyc0OlhV7SiA
zz@W&$z>u3-oS&CenwgWLpOl!Kotl@TpO>GP3T5jRRIUy7&AwwGu=jVk&546?9lkdn
zJ8}75p5`=LY}W;+pdOw6T){}AOBK6s$H$+{&X1{jxsWM2d*8ik<Hy=He~bRx{$HUY
z>Ho8R7SC$8iMJnqRY-CFxowB%x(~<r)R*7t+qm~;-p2PF^G`%K&*EG1_CmXjL8qOk
zRC@K4RO3%CR_HAJb<nEK;Mk^w)L#EI;rVQ-Q5^k$=Y)kg*-c*gcT#EjzVr8z48Pyn
z*1fjhX3HwE`$t~q<=mH3<rUQT6k6H(y<$V#v!<JW?!B4B@=)TUaNfjO0+Z(Xnwn;u
zoFMEoQ~hp?bC+V*t%aMy+CP*#Rqr}>F#BkTm)*M!`gZ;cob2CqSF8SX@8~`t{bc>J
z{<|Tz^DbQLdtxm0dcw(zJ1@A@-byejk?}CP%B|FrZCJ%s?l1RqX-k&g61{B|a{}i5
z%X6Jpr+h^$QN$v-;jqTytTSubZ+GYX3Ayu7GdAK*(tEcmughm=9q{^B|0F;#s#Jlw
zvH8L(K9jfxHLh&FLOWMetypp0!jlW*kJ#P*qrAA?bjO^quS+?fClxGKtMAQ9`Ejmq
zmzz3Yi<^clo9m&MA8w1RzIH@a_t4~}@6RuNwCVSTrLz|Fq%SO$GyA@UVSSLg<-9pu
zr|JVwK3P1&{_dr~gz$4yPepCen0-K%?H?OzDzWY3-WXfRz>xTskwF=IDk&>AGB7ki
zq?0#$v#W0(yQ=Zac0be9S-hJTD%{?=B{XhpXv)otpHGF!dHWS@ThiX@5#Zz_q{HA9
z7W@8x@xNm~Q`7H0>tggc>33<nb<M3AN^IF_*Uqeo{JvFkZq4^E$JZ{dnR0e@&g+6X
zXJ6M$N`LCNWxI#_^_$lwKe?zr`(oY39onB)zqYFS^x~s<^oRND7hQg>Q#CR4sEt&*
z`OPg6XC6FVaqiO0&xihh|9{BZ->$uUUX7saxz{;d{HI+5mzBnyvHzJ8B(^!jVvf%1
z)S0~Pfp*R5rBlv5clGsM<^N>4;DM0)pRKfCFPibHz4hO>GBe*}M|EaC{VeluYyG)b
zMyDq=XSO-pw!ROHa%Eq>>SWQ({;S`A<xM=l{=-jA{=$jZu3!EW)cfB0N3lRHd$QU6
zx)aYIKiYOkUSx*R<L&N8OJ?<ESaBVy+sKkLrK!>7Z_UiUdnum_RqbcrpZ>Gt&3}v8
zV&VVt7bk5yu{`o-gTdjWO`0q2U%mgT^8I8EyYmn3GU~rEKfStn`{JC&!_(%k*?&66
z(AWK@!F-<MKT{@6ZMf`M!Yq6Ev0|T+uAorP;+lDH<Ha|ew0pVwTz6}8Px7zN`!`#E
zwV8eYNvh#;Th&~?GycqO#|xO6=Puv8rnA{ddU@%ulj=WJtbG0c&wtO?_WQovoB!V*
zo_=m^;#;YxyM9?^=xo!(J8!3kPra*id}`Db$v@$ywkGzqPQLrKyXPl#E{=UuuyaOQ
zdT1<P%Hj**?4siHYmCmR1@2nYZO9;b_3-R0jT^5ozA0l6c&s{i-bMYB=0EOtJErs=
z&rIcgwMahquj~6|Po)1Hnrv=+Fr!;*XOs9d^SwWQ?}=J=d2*HIx$gHn9c?<|#6GWC
zfA943(7ArgH#}MT{oTojrzc<DyLj>P_Vsh7C$K)ysDA&+;zRJV%BhvJSBoEhIHT{S
zt()Hw=kAIe>u+%#d6$g*^_NGc@GG9uuG)L*)&05WlkdiU5Pm;3vLsw*agpWx#~YU~
zKG+@4JhRxUf1c6K=CusBQ>UFfzT?Yg*T2_isPB<v{m}8aaidG9o%~M*d3!&(hkb3!
zkLs*0ei6%Xw<n=U^nuP!A4XBvu(QdtgasUKgt$)eduV_9)ZE=pyZ4^i9oTdCNMNAb
z#{0EA(yK}vIk;N{?lo^(I%zi7x<>U+)2&4BU+&*@^Nduw!=2~vobNq87xr#D?;p?8
z2j<(<Jec3k_OJ5#0sHy`2li)3{t)Mv|1o`GWBpCj5Bl;3AM~Ty{vAJXVB_7LuWr^p
z{3G*=fA8jJDgPyAy^-Io_WL-y&$rdnPX7DJIGGnLE;H-R{M~B5pR@aX>wkFCj&tr(
z(aF5~Hs4E`-@<WxvfiPODYAziu799BC+E08Zi-zL>wiUa(F<vN{F%fL`F(j;{<QkY
z2H#yjufLPl{+BmvsllYIiM^jr%H9pQdAnpu<?$8EtQ9*adj_7nv@8AFfdkI2`~P!(
zR=k=t>-ym&i<!&9uL|5)w5t8T<GV*35-LwpXDr_EFU=+|C+EU`b&iEh$NuWwvg`Zs
zl;gddTVd<sIjR?fcO2q~Ed8a{?RG%X?WoEkzr{?)BAz855I@L#<^GeSLUr@gLxtw<
zIVt|*Rn6-ex03n2_xxYo@^k&>ir+tU3*<hWfBN``Q~8^}dAI(#*zfzHcjudW=Bj1t
zD;SqO?~!N7E9BX+mm|39V9UcsdEo=ak>T4bYwt2oD6Bsoc{Pyn(zTkIGli9H6}-D%
z*jH~VzIff=eDU5@O`6PFjgl+Y7d!DP2v#<E|1gR@Cw9}~(7TLakq`4X2~AT@pA#;&
zqh#Ggj{em-RvVuS#9z9&&~WEtu@IG)NsZ506J|K3UDo2>)@OHH^~<q~=@(ljm|uJ#
zxv)rLscru0)j9JTm(1W@?_ega<SMyH;aapnc<+DNrX|xZo@>$Fnatd@zgpvx>W}&Q
zKVP5TE6%Qd|Lt3Op7{M%O{Hp|wv-0vKHOkp@k8$Y1APvr`nTVIpA<@q{`Sj8FY#vj
z&lNhWl7jfxAIq;&;J;e&sO*Dn+I~lu(qkcMoH8damagxazg%Hq++6j&%Ok%o(-Zsu
z>*J=1*$?Xbo=g5OWMWU5b+z=rP37;a;v4is`88@)+t0_#?YFvd-`aA5W1|Vn5iM!{
z)kP+AmK9r^XxhK%P3X~0GO70(?_IQ(j63)=VC|WzeXgBs^VD1vs|tm_pWh}If5Y0<
zdrs%iY2nUorfa56_WZYvy<yMW`swKomd^U~_tbrR^Wpfzmmfc5ynp)HxI%Qv(z7q7
zDykY?;7H%;vwqWx>FSX}OE1oT)2BaALf-Rvr0DmF=N@!#W;(LhbLQXV&fE9cnKcf$
zh5z(5YnSshYY}JF<^1!7S!T=YMJqNjnDDBtT~rbHZ1a{q-48SRf>JIPiyRD=wBM_d
z(Ajd}rH<pYTX7u{oX4fARzIkkbMIhQb4_oGZ2VL)!#QuV6&57#TDi<1<jTVX=jJr@
zcrFn?_qW9ITtYm<BJCT-nnElp@}FN=?L8@=@MdOah|a`$DV3bIV%tAw@I1=4Yf2XP
zo%TWEX>XF!gw?r>(Yeh$@jK@h`+JJKRlMR^Qa!hS-Qw3dTuXlYPSef!W4?I11?wBD
z#hU+w-FWY+6+L>raDm@j1()ppi^gBJ8?MrJP>|DIEtTP1F!}S^rKu^!#TWS`7fP{p
zu6vPOm7e{^!-{{)R=qcuANLi$U7Wb!YwMlc%D>O>to_`uTjPbX!kx4g-7`gts}en|
ztFFIO*m&!UoVMUM0kiC?_Uoq>tym><G<#QBp7A}ato@&IjoCd*LX>Ye&p6P!w%})H
z>!}5Y<EF(te0gQ@)a}2SU-DVZl1`cOV3&Hs24`b|mG57$@TJH*-oI+PF?vJuaf3y=
zv$wD<uln|a>0i6H;4zlC@FlA^y!4jpExvU1pj=PY^m4&<=2<M8xvw4m@ZBz%CI6$z
z^6Ob4zaJdg&Je{fF+=ypiwzQ@J`sNB9p-!O34d_D#O7RO`m3`-okeT-1Ae%0x-aKn
zGePsfTc)jD=8-QXqFTJ&yyh@X7GdypQFXr8@N>)Br2?jk+HFmdPYiE#m##Xi$QI@+
zpW?LR@23gzZ0AJursi0zy8lk#68qgQssGCCdh(a2R-d14I(6dVlyz?}Khf-I{aXI6
z+<W8lf5nB0PgvCA1j~bXCmQiJ#y;p|u4><s-?9Bh@4da(udn+lIV~hpH*k3yyL3cp
z!%V&9TPx>o%RRr#)BPor>GMm>h3_u39(+Bs?&~9;#jlkP-Hl^R*;(^Q_~yecS5uUQ
z;-xR|dhzZ}sHyFx7*V;2uJ0a-FI{?6tajGA|JrAFSvIm9vs+zNYqOo@WBKmhtA{jY
z&OgkXlP>9L^Rs5o{U^x^P9GjGiqKhJ(b!t16PRNuakM3ctMQzM2aof)Ewv{eFPph(
zSH(U)rI<4IXNwG5J~`UO7axCPvh8ct`?-=KFKxdEa9q=4O6c1&ho{kAyYUbIb7KL6
zD<`j=cy-&QYHywW&lD5i)u*PPwv9EDVPfiKV~_~(@tWfPQT>&Ho3nzY!WF)1jaw(S
z{dQRTi(&l+#d&LGlin@7pRRdF@mk}WX)5X}yS|&%GMTnbR6TTIqUqtFGsjo#^RTP`
z^7FC1dVliwsaaO}X7zJyszfr<XQp^uX<pW&Q7)hq#dC7av_#`w;&a{l9xAXro#vb1
zywF5yMdfPFEm3iOpEnhmYuY}{u3NL9ceCq?sZoLzOZGDrTI_6At}@pa@mAc!UL;v^
z@}Vh5x$e8jBTvFY?=zm9&FFh(`vbrEPr|z{PkU`V|Gr4R(L_nn-k!?nhpu(O6FxD0
zQ@(pb-!CIM(D~7_lhan3FZY<xlzVGY$#;diGigx=3=Q5Z2#KVf{=@b(>A;+v{D&)~
zPOV+!_2Gc3z39(9>KvC7K9nBq;%sSI-yyfE&F8om&-rH+%i1@rU~;OO&R$UvcRq1h
z(YAS~yB{k*di>*f?V}L?mtQaBw|_4D_RXm`U42vE$|}y>?&2qg#|i}a{igbsCs>?O
z<S^}4mDdVaxNxay7vD@p=a>@noK}eliv`~*UAxQ@HdHmqnnto~&kN}ZKNr16=E+=^
zGTWfN&vX}<)xSQqCsd>4gK5V(y(|BD6|?fRMSgE=7g}N-vhzpu@q3L`+@){yFN<?k
zbM4x)ntP|q=|wB9O0S-9bNBJGSL_$&+|DrLj`{k_Hzj|PVtD5RuGh&+9WE?8ba9i;
zNexXWJ*7`-{x2m@^I05b`ymr}hAp%>LeM{P%Bcm64=eXGuCBeT)hqk;*}fU;H$KWc
zpRKz!%C<$%$N%`lXhYH6Yv*xkZM5Ff@Al|U>9kuX&b~|7yuGOZLvR-N{>rtVEFT4@
zWJ>4QJ?DLr<uJX}yLj)zIo}q^UQqk?pzpzBrsr%GCcbq~^}bI3wn}FjcLQt7r<6*~
zEt{TSX!#)!@$UHzy>D#HcdnWo{>=6N?aa>a7w5FtM{a&?-Y;?Kg3$cOm(o8!?K#)W
zyL{)X6Pm^A&!+dtC)7xk+BMDEl9{mhzs~-QdDEXQ<1803&o#2)O>|(^RxLg*ywr2f
zu8n&|bNcq&mswTd(7V_@oMnEYvz-6w)N3q-Gn>BX1})ls_Ne%>bhWEB(FKvbiEa<~
z_J{}gKfC+S?o`KW@w`Jp%9)eqtkaijIQ-pC>-?4K-f$Mq^nBsM)K|HG-hOymzTW@;
zHp2~J+t$k;ueYwN?K=Osaj)sD%^~u&)3cYDv+FGuICNSsv`go~<_qT}EKX#6lb?0-
z<j2?Hzu6BjZ(m<fb!G0;<f#&SRRupCxECzX{mgtlfB!tK35~paqzva;6dv3E|JT*k
z&C{1V=gU={_}k7Pny|jF-{0OW%qsEI#dyX~_da)?KYy}Ja{ZB`X<N+q`o7l+(pq*g
zw{v^uN?lQ}l9NFbYP|#wU1<Jj<*F#p+qM1rO&bQGUhWmfOp08+2d33t%a1;Mru}8=
zQ{l6rJ9e>OZk&IS=g7N-Rxz2TDkpi@e^#`a_3ZN+aThxij@3eQoxP&?lQplG7uf%K
zmm9dR@#4ExJKLi>jdH^0<_E?}JL&TFJhI|pzb5~dJ96go%YWwI)Vs&}a9YE=Sl43@
zs~7veR%Ow!xm~rVSg_V@zsdLKsirY36*KzxoM4c4t$4y&z3Mchj^Zh&qqFaRP_<aJ
z_xUF0Luv;ZlO8tqG0a)+{LHF+_c~W`AqRJjH!>36C(r6#Q795E@#FZW6)*iBIA3Be
zVM`NdsyVa0ne|6D<C?OwRR!O+JbhSjk4Zq>YzdpdzB@6yl;`C<eW4_?@$#e3QSY+e
zMmlO=IrX!AYj%4(OW?Mh8?W4)#1M5gLj6s5z4p_bvxTfn-+sv1Jw+h4ihc8zMfW24
z|Llr2zdkE`i>FnKz|O1-4%W91C2NM>TvMdT<#^vs+yAUpj@$3+H(&7TCi|znc^PXT
zb#C+a3?^pJm_WBLCl7k(u-JsFsyY2xU>bJpP0yvG*PCSTRe$8qn5MRJ>TiYX%VwYY
zwkgOXiT82knqwQh&wQ`UIT^I2+h*zf%BtRLCnbNkujW3zY~rUCUK<jPqIB9PmrV12
z|K_HpK|=rj?vv>%b-$OdZ~O3eul3ur8gqO1|6-E8u%q#FNaUvXS_0hR{2jM{2Gw8i
zJk}^9@J}Yy<jb2a<*r{B+<CTNe)033r3xPeTm2?BG~77O_vhLYCbK*8pME~~-=%O_
zXi28!u4knlrz49cQ>r#B%GTZ8pY;1{>`Nu-quC2wO=~&4D%IXy`RHCGvAJ-9Pj|FQ
z8w<xO-u(Ahxus{>w{3X*^mXOdm<8`O=G0z)e(6WzLjLKtayw6dI4pDA%DvCD>!I;;
zr=JI$(=%CjnQt)v_WR8PwI3Jk_<UX~=ce?Y;lF+IZ04PE`|S=Hx3BWKS#2v7esg};
z&bf(^yKncn*6>MbFPh7Hfsgx*v)h>qzE-hmOAcKWjNBV>xbyeD+O|He&41>n-2QdI
zFDIb4?%2(zpI$LrD@d3<*|mpTCt>QjM(uyk*&pYuV7M8Zw&jrE77LBji{8Au_b6`a
zPV*(1F~Rd5H81x$%ksilz=L7a(IpR(1A}+Rtl!iU#b<p_XyMDP=T=EYe`7j-<mH~X
zg)<M<N6UQ@Se3ME$>Buh<OS__zDY5*-BWL6y;+*DqWkHKD5;<?p>xlPX@AsO{x)B<
zZDn6tWNmDZ?z^304J<tEw=ch!a#y~dCSi2Lsy>5**_uIbV`!ekyp{J`e)U?jOV0a#
zDp6>Cw9cl=^RCIy=M*MvFQ`oU9M~B4>8?b|)wT9N^*;Jmo3|g(WSso=$+NkyMVdtu
z#7Z~<pLOrIzghpWWXJbcKR<l=srhI3e_g=>hb1~{J9kH(-DhjZxy|@WiE&kIYMg;w
z4BvLi6UyEtTh{jWbuS9|wl=~;e1&zay+E+kTvla6eIFgaCtt)eUZ1_O!}6B?^qW&+
zMB9>TdcIG~|C~8*TKV(mOa5Be_wN-@>Rja#(Bk&`VtmORiLcKhy;lX!)PJ?muz1$W
zTPK`yCt2$#1o1tJ-C$r<>g4e>`0JX!L(5e2Pq*mWAL>o8uHSL??bR#mFI{ulw^_L1
zW`!@uTep?l7C!v>`sjVmY6Y7NnK1p^$(tXrmYlhA#H9VIgwp*)ey5YRUyi?*Y1kvW
zt4d&&d8hfkNbT=+%2n-W?;roBXyeBFS$C6n>B&U@`|}e{#Amy#E7$UutN)qt|HskO
zmmfb~JXs*{#T_YG>l>^+)fWHuH95XLe@uQ~Dy#FyW6Q6)ZD~Dx`|p;nZ6>E4uDAGQ
z;voGY`LNuYJI8Z%*Yw`HV1IO@_xkSB^K<HT134b8pSN|p%KzZ&^Sjs7ZZWvD@1axX
z&qk3`Hy=0r<=_1AqpG2%qe@bGy6dB#77LlY{=PWhb3bt33P*jN?6xPrT-F_0e)8U*
zya$#}Yd@9kIxu10MIn!uzS~~!775xQSF-hSh4SqN{aF<v|7$|Z)b`A;Z9M9le%JQU
z0{=7q7r6M6t=1dZu{xi*VSlX7x{2F9dyn?w;46pXn||}?8yL;`f8+9Jt8GOI&Y#qr
z&K#L1`|ro2g!bk)MSQ!~dms4og>Ubc#H9%;n(m)Y_^4RyXT4XPllWCe^oir1qx#_o
z7Bg$N3Cw5pz3N-ibN6fhOpdxM&n%^_ch|ky<8UZXdt1Ej^Y2bytt|d=9NuKZ6wPMV
zDz|2%@8_S=H`#T+@4GF#uWml`#Tn8}1<Ty+S-$O>S#W#neyMl2BzEj|d*1p##%4`#
zN7(gK_530&ZVg`+F19v#Gd<F3-{OUbJZFk`IlL^G-{qvXsZd)$=+GhOUpH1aeXp@o
z`{!`YUAn&3%}H!s#@@$s4Gj`@-Q)Zsm344|TAtAUdHZKBKD=td#4nlG{{HIwUn~Fp
zu4LE2i+4-2Z%Ti>{GlTEX5H!w2lB1D58AV`^p*a8bL&&xamKRKl|}qJkAHp=ayhH`
z$(A_jb<eNd?5fVmuJC<uDa*%v%ejTqr~m!=IRD`Euc@m(&sJUh+GPIsGdEh(ct!Z0
zyzjfX#enbo!lZLc_Hgg+ZhLtAe#Glyz1Y2F0S*uE=3T7mo->=JJIJi%g|FT78Lpp_
z1mpO2Sbd32(p$r9^dY_PwcVOSp0RrFBKyk@Ew6N#w4_kLy=kt*C54lUStg7R#m|1J
z4r3H^yz(aZqRN~9kzYfiy(bj3Y)#oIvDh|#Yqm$x2mb?Coma-5v~}<-UUB>J1n-Zf
z3KyTW9D3k>Q*zg-_9i7U)d^p6wmH-{MtoZO)$Cqv)ZY6q4*P37<hxS;GTfS<OOCTk
zrg>UwTh#I#9lJBvV$3uHJxm%8UK2@LJ^#$+?WO+AhWQU>Dld%dleNv`@Veq;bK~ub
zrO)2E#`|BqJb8lu&zFDPcAndk!4d2|se48>S4NSU<DIA+-@u=Zg=`IH7P;JPV%iev
z8eSN)|C2{!7_Y{&iBg9DFI~GJxvRI!n7OlQ-C-%tLrdR%EZ=R_uC#Po#>J3F$6s@m
zNqo6)yjaqN{f3L=y91iiHD}ZQm~j1O+;+QOBSkQLwN<z1v-gj>H?+^aCBXbTy4a{;
zV?(iYW&izY8}zHQUff;#sQG7v-?g7Md_VIft-0o=-k!CnZ_A93lAg&7JhGXh3+`-@
z(M&%1bZ%dg*u=xT%Ku&$ooFPYxB6A)KQ-g`QEhVBFAi6=3G($Ve6v~OpZ!Kx$vCl6
zHO`p<1?tQ$U(SB)=J;HGKx>mtJ!kiCH76hbALkT$7iYJGdj9p>q`9`%#PjpYr!RI%
z{+)3B`lK-C-4ZVM=hxI9I(y=l@4iizYP<%2XMXSPJUT!5M$e|ur{M(^m%KbSZ+4yY
zw$QGA;hn-gmUB<+o4~W+yhiDic`uiX=BQg}9(-}RuDX79oIbBbT*)f#SIv4ne*_Bk
z>z!7uEidi3`A;DDy~*C@seQji1clERZF$4?M=awwo9?WdtwOgxeE3`P?T1okOwOyt
zqUqB@!_OU)-1qy%qD-F&EB-|IMJx2Ro>9t-ogQ^m=yi+gj*S=Y_C{9zEv{(OIwfz*
zr+e^tihbqeyIWtitl6j~vG%Q=<C)se+!xBZ>iLDs+_py<{ri5hdF76>vSl)x-rJna
zbf33Bf6wt#u4g~D&fWMmS=2=~MRE5V-zjqsUkYrOUA=pq(tce|YmFo+->ud@ORMs)
zp8vq)p~m`LF7tkT-D%?&FP&a5jFptrpZ}mNYO?W!$JaL1O3nXq_4V|_mzyVF7T$92
zrM*z6YVUQH%XSvC`1#h&O?a(Ye&I`BY3PzGDV{fa;$&^?D>}>Py7=`h_TF~S*U+&d
zEbngG6wN<Z5B~djI=%gT{C=y3-Indw-?MG;e0DTf=wR$@SFKjYH5G3vdQCi~s+AsW
zUg#x|SbE`Rolu3N{voTbB>~qPnoF%)mpy#9<EQ?1#lJIoq?qHx1AhOINcz6a<a6DF
zbyHfV?^k&C#H2gB+3NhK=e7PN>P%Ok><Y|S{2<Yz<d*GxvFR_j>^@t0cCDYq$69~G
z8Na8*B%fqun6lrg^-oOorOOq8X|Mjet)H?v`GlqQ9v@GM<y-2)ma_d!D*STh>#~xc
ztKGzw_gyscY;E80`Pb!F@$(=3_4zNf`p!<*s$I>EufuE&nxi(JoOAux+}E7D4@X}5
zy>@@jns(j#z^iLtuU{uI)oSB$&zN7zyO+Ou9%DMiRw!yyO8=*gZ~fQ3+t~3s;P_W@
zldfCaot|escK<TD*ZU9qsZ;LT^>#NLi!Kx5iJRG&vb0%!(ga}%tH_o$>-D~N2wnGk
zuc3UY=FH9Ar=HGv<P~YOev?ph-m;$>?oV}=-$=~1QJ=}}yDK~NM93VQsCwVJd8L&<
zZsoZBR`_sb(gOd^SLgWnIrhDIGkbBF{1IVu*5<M~yj(}RH=oxpSU6{vC}*o#du6tz
z)wJi;2ju_BJ)0+1v37#l;=Laue$HR9XRTGEu&U1yA)cn43k*ILG&Ric_YwJUIl95-
z=04YJH}bEomUD_`I&Z$%xg@98+cSLe<<ynB?yEH2mkWnay4jYzCBV}4sl}Jytt?X>
ztk<2ps+Gy^|LsR&TYocu+fd5pR9pOOt(@A`o3}1KS>eBhee&XfZLfK@t@WI8`;sQR
z*^wE$MAF^P`DA!^PwUQzc`;Kt{+-(2u1PALy^Sx;=5Ai3e=Q>Egzn!anHKj-o+)ov
zC9wE<9Npx$e2cE(X${Mq;BzHfEJd?5Pi|WpY$5rssp&xUVHZ|Ut>aneyaKk(e~`xh
zY0bOPlUA$LJu_qV-bYzYd3fPu(Km0WrHea`Ip+)O9B#2xU*CB5+>a^Cgax?sFAJTW
zGyQaw@W0tLJjH&|R!3y|r>qF8;=3=jVRconwBDzcs;fT9ZM>(QbFAU~BG>O1{)*k4
z&|_+{<fyakJ*#!$uRdSYxBF9L@%G^PTVL2KESA1k_!D{QQoU0Aa#KV8CzszJz5KW6
z@}|^_^Q+V3L(Kv=v7XTAUbE(N56dLIg_|3%<TqNZyr$o6s3kS;t?XQxHC4q=4@?cX
zl~wp|&dt+2nLAFzX&=$~Q{r{&hvK<Sw-+caj+1b9JA7fcoayZacYnRR`}_O*Ky|<P
zbI+w$t>c`maeZ3WFO|tz6@TvB+WvI=4$s@K9e5XZ_Z!tTwyCl3R($=q_rBZpwR6)J
z-l~m@nVVn1GjmdDh{Ehie^c(|6|o<ml(Y17s-4ThUFkPc^{3_VIP?1{tk{@%?pu-$
ztAkzJZTqSv^~<LS|76&~cBtFS<uO<A+3Xle{aJS3|Mh&_m7S1yy-YHsj(OqSmweXc
z<%c$<ZRfKpI~yME+Shh}!&)~r<NnLrCjJ+YQZqhNf2G*ybH?|D4VIpoM@m;@1*qn+
z2}O#ez2$LAHJh5J<8b@V_ViA@I;F|myZ$F$*=8!6v~}jWy*ht4)=4Jr$Z}mAW4LgK
z^TCE~7lSILsuTV;zPxMK-^=aVoS&!hwo6gctlI0dy(#1NON}{!KCO$LF8nS#aIO3i
z!^4wOO0gXl3+s;9*>7yi$bB=HtuC|SK<<IqyVWT+VUt`pzKGPnby!f}{OXkn#(K3&
z=M)~*UM5qyOK_^ey@it3BdyN;nd0(j;hTReyfj!Y2?a_;z1-lb^M`jzxbwTM)7e)v
z@_3}Xf1NbjFIwT#gl2(Mv+u1ZUT`^u94$E{AiC+wK6P!LpGQ2E?7Fo1_AJR_?U+2z
zt>VY3YyDRZKD3)YH#@6;ddnVezjY6-<*yawy0I(lyx*AM{m9~&aB)hmm3WW)E)T}j
zH!Z7HH#JxvV=@TT(!M*T@OF8FR`=3BAxob+=zct)a8!m*F*vU-&HCi@R_0_|PQkcO
zeINfM?U8VLb)_i9WG3IU1BP3lsf105^$Iy?9l9;!%<TGS4!<^Acs}ZW!9V4|wO1F<
zRlZZtc<i}6^`_6pI=6!}UtF6qTbNf@pJz*nP1y9`0q#j0K1Wv0J{l8L6#1`W)e%pZ
zM(s%oS5`X;oN%hU>QUT2ck7bhtmo=4`E-|?URW2t{>p*5TPnV+Z+xUG$u@(nVQLaz
zYQPZ*|8w`8D|qHaR&_NkZ_QKU-1Bsq&xRSM&+8V~-0?dgD;6~`QHW&?|D+0q`V%*l
z7HU1P$Pb$1#p&M4)x^AcSyh=)W3|9l)rPlg3(sEqxyiCY;Z)y(>B`GY{MSB=(3taJ
z)$w<7*=)<q%EKQ&xOe@lhfVpMg1Koc_zu3_eth1oMop=Z1y2soly?zQTE2XR(v{O?
z;&+!dRCBfp&Coq@+<&o<vi!T12Gxv<jITs;y;_uBX}B}I;}p~Tr8$Bpn8jJm`d>G#
ze1F*6>Z2W>gkQ6iii?lvlJAUV8G(lcBj*KhopgT{`<zeU`2_nl7d|gI&zh?LGSBVQ
z;&*B*&O7s7%=<Gdw`;YHX3Cs`g0kC_m;G8h^-<>B@Cml<f2aCyTJ`S4wpI3<x6BG$
z>#48(NU%-ez;+4g1-DP==)Qd2I$e9BcHqt9w`#Wgap>t>E^&=B(Uo&~|7iJ|-D#r5
zqVHX#ml)iOxNfLwcT_=jYH5mk*TzR*Z|U!!>-+phW=-t%?zwN@W|ho6m?AvaP~flI
z_TyT+4}V*uq?Ypg<YM>v$KUJToA+h6M*jMJ?+UKDzf3hdTIa0CDe4r~5W1spw_?-G
z^HI7}cYR#{Y&p|ebB(`O+aC2@59=;B3DH@0YR%Iae*WM?`lse^2u&9K`it*S_O@r!
zs>Qjl3%!qEX4&;yUwe6H)b{Ux&soo6^UADyTlnJi%`2Ot*gMYMT6F(ATeA1nHRp|k
zj*0%2UH4JpcKnrF<*zs{Fy0W=Uw10XYRTT4Q-bPtHLUSFBW2Tmt#P`vjhx+uwfF9<
zWB7Of=3U(n(P9tGw{tC-ZS~1mu2a>vh2MUvM0@7x4dthQeBb;2d+UpZhgQ_DTdXwc
z?@=YeO&u>UiG{v-Ve+k6PkhV#rCC@0UORBxUe|czgWuKfrU-r3WLY_TqvDjGU-y<-
znJv3L`_`Q0e-^#e=D2=L)G*c9WHqzw`9*uvm$R?G5%4db&x}P}`rIC~e@!!&WH`jT
z2dT+femKpuE7@$Xp-IKUZNH8`UHWQk@B`+Rn-<<t5b4-_q+`BOaKZL9;)^pLhlsyf
z*eMveyYkP`$t#vy_4<`A-6ApnNbQ;poh;vigql?|HusCgtc%S_<~h<dC+CMm^Z&%6
z${AK&D#beUtt0(Br_6XNdXDw@={~-Ys?Q(A^XG1Sx7RA*ZtCMF$?|-q8X^%AuLUkN
zc&up)Pt_KDG;hz_`VZUOHrE>33vz5M{wZa)GI_UI#(w)n&)zOrez#)LMT5*ojTOp$
zv#0q?z53JI_Q>}pN%6G(g$f2|)b__*le{{wnYT-F@l-Jp%a>hU8a<!6&Rvt$s$S)h
zzH^z>-D&?>ZFZgPc^wlM<#jDn?ZJ&>$xmtmE7v<djCb;mc5cY83Kw~~zqW1VL;D|h
zMSksY4p*?eY~uN4-pup}Me*+ZM}pm<w)-NuKCOH?VNy>_$*CSwvzi4bUE5??Yz6-u
zm#^=s^U$p1cfHN|@Ic(9oh$BL*nQ;E8uvH(L8&LalJ?%)Z)Nb@_ur+Xx3q7(?AVkw
zvCqiAV|Mu54&^WFqD0QB?O4Cnkhe^^lz+{N3pb{$-OcuenfbBvBDdvB7{AYpxR`(Z
zW7+PS*i`)qb6p-)&kD=esrBGZ3jcHR*7sZcR%H|=#b+5h{(rXaTvEQh?dkhT9dB|g
zyl;M+sdw(8Ec2OX6`zufvM#=wac=)*yNDc{Z-H&@N=LS{&g4ITq0D*Vop;qt{Bg2g
z*CoVOP2a|N;3+2)t1q+I!9KtK>0d9qo!NauP;}9x&&B$i@71tgIb6x0wSQ^<gclkU
zw!8dTw?tfJ4x8P4=Ki!-;^A`jlUb#u)>(DbtuL5pwuJr1;rs3zIu}RpP-~dFLikMg
zBvWC*{8i~Mcp~mi>^!8!<=c7sL{E30tks;-IU0Z2<89r7qpB~Q?7h6i&)cOkJSB%|
zr`pa*QHcVY_tp#ET@&jS+}ziEGu5n4(fQ-b=EK1*MLA!0Ty&cF@U>R^$~i|%cZGI3
z?y4%YDz5sV%T<)8oAmHkJkRN;F%yGaOLKbf^u4$1@U&hdP(S6wtxvz%euc4Hui%^#
zy2sxl;`8Ejch@a{Q)}Te=g~W<T}Si;wgvfXH@=N$KI*$Rs^+0Zbnq(wl|6@FEpsW7
z``sRVl0)-Z`$@y2?8nasP5Ab8Q_xBd&1Fp4(>Ug+SbeEoXudcnPG|j!b(v<Tvper!
z=sa{}?!4gV8R=E0>PmU1`^HvW(2Go4wSD31+zGWOI-`v%-u?8|-g0ky`uE$1cg|&-
z^6Hb)%y&9DlNvAXcx&=@-KTla8*X3B^f*2JZ2p_jt$m6%oWBn7u>aV9F~>&da`f6`
z`#qOCZ|CVhRUq4>$a<?SJH({;JD=rr&->~9<?jUdy{K(sJ-VV|#>{`sjm+Hzks%9b
z6y<Ibh`Fexx$KyNyy(-pSGVf0e7n9#Go#{G>9*<G$5R(gRM>61^m4Le&l2v}Az@`g
zg0U<&n3gu(e|dzdwB6LC-+s~&J?D?B1r_5gC!CZxw_>t`_3b_C-<!AluY4)MedqAm
zK&J4eddnW(zPTlxM__sCv2V-v?V7x2^;ui7*zL2Ue^$Qb_WK;U?fIpsgMQg==BAnF
zPZ=z`uNP~pasEfy`Htob3*-uVC;KzV<?LY&ULEmFb!Ggfj^K$ayJj90+S{4mB{<#b
z;O&|BHa>VM^swmB${yys-~2KQiak#)S|Qi2^;0s)b94Txq7Y9vv!HJRJKwLbJ^v%M
z>HYbAKLqTOaxa!<b^SZD)n(_Y=Sx$3H=g56-FxmNvjdl9w8*7B{|}mfZ_dw+X<xak
zwL_fe&4G4?xb>4>cJ;SjkA3~SIpO7^mA?c$Zicj8{F=3F-4CAzi8qfjiyI%Gm*=W{
zo3vKju1(fk?o^*<m{0yO%dlPV*x&ix`|9)T!tZ<j*2i3fJ)##(WnCg+z!GX{a%;Ab
z%fGcrn_43u#8e(!qZjryEqXia?7vRolN+*Ff_}Z&b@p)WQ}s4RF<~jWl`DTwo9wH;
z{Z+uj{?i*SX>Pg~P+D2Iy{IzIcgxBWi>j-U%Tq-wZV3N;(s%#<)+d*r@nsmt*X5im
z?RDDnswnGW`hVG<abX+Q9{o{t`TxZ^>+@W>?7FXB__cFc-4k=YNd8yhPbSIVYmd7X
z`{x^X0QVM_>)~GypS`r4cfumacSau3d)b~B%3uEU`@otnZYG9KHS$#|OZ3)!d9kTN
z+-^!j!s&Xssef;0%nF+t&ZsXFV>ByFgfV5OPIuvI8P6WZwhf1LU+=h)I6G!}w#Mod
z6Y#o}YyFOaf&5_`FFknOeN>B~+tr+7*8C<#yQSiZ5ns;CP&~9%;9Iw9N8Smh7~RdQ
zE-@<WMBR9(^`0U8y|6W-p`~2^x~F!{`OdPPO$iz=5-n!!`lupuv3cXMWt9su)J{xg
z*(IBCc;?SK<;Va@6McgwsfoF!!ae=_mrjtnotRXz_N>F41L}G2>SP$bue|ng@ckw(
z_c!~tz_EqSQL|#p`NU#EOZU|#oDa~F>OQPC)wQcx;0i~o&wSU9*XMtmrT_i$v9KwO
z>-#-yb5+w`9Ef?Hdrso@lFwnacaufuP0UGLz4*f6=U-1gJpKG)`S1IOB;x1P?3cg$
zOyTk4N*Qsj@7IcEP19;PQ5C;jvwxZE$F!XS{?lu=P1rGgidW3R!r2RJT7qt=sCQ4|
zW!-g5{es-uZJDxXH<g^zOg6jPRpdXTYg){ImO0FBiY?dq7W6LuILYcb-?w<#H*@9W
z_Nyd{ygL;6=y78-gH}+@!DFot4$5+$xz%*w^LF(P$p!;^-ZH)H9JQTmEY?ceY-#W?
zo|QOla_t+VU`NMGzc2KqYO76~lFg{~MqKl4f28J0gSNwmN*CEW?{U0zBkG-If!t!j
z+P}T!K93e||I5<zish&Hx1}%s?@ON}_bd8+!TbIG3w8$Y__*{%;KfKGb(cJmB-b9X
z$KI=!n$3!uHc9)2ov7H9!?B%#(PAc_mNwKjyzJVNtiFM1dhnN9LGudc#MK^Kw@4zC
zv+3NSRqr-Re%<s$>tTf2ROW*&4&P!$4lC>~h=`f`@=a#c^7{;q4tIXm74szJ{^`}9
zt;e`&)2xoCQ^Ul0E`}#*>|1+6fcN3?PktKGwcA(RNc*BSThx5!#buj{WvBLfY+UAY
z#8kDertpaV;j`~vrM&l0?Jj9Qmsi^zwD@X^*9L`|NA0v?Vz*7SWVPfpS!FKVbz@zD
z(B6uqS842$qVB(S_qQtU{jih&NBy}*v%^gmQm(&e-tqp~QE7ON?Z^>@y0?d{Os2d2
zF#FSWJbeFwFZPW0s{I&~8c&$-GQA#QUm?d~$j7#tF+_%=YD3Mf+n0r(o>1EHXI4VN
z8m$&)>msR^#naw~N9+vi4H7si-J#mBR&k-(Jaeh!y9Ry6Ue0c>4`lC@oXa4{_~~t0
zMRCRXxIOhMQbMaVobGPAF37V_$D!_kPnUwv0r?lR1Ew(lKK4M!?$rIxbP><S%$UNJ
zQZ7HWmtU6o+;{TbcjemWFV1!)+K3iuZ+P(8Fv;VyjG0<Pq8KmVR`qOtQ@KT9{T7uq
zvFy_d`ldF9ZP;+`xZSh!8EZDP-pMPT@zmkD!H&Ip7o>Xi0!pmCpK>2K&GWY)QRUBs
z;)-)zB`>vB?&$YqnjYBX>S(=f-3+l4#rvLb3oWzE4tdG(!CY*)(Wgh^fA^f}<qPCt
zj&9&EXF8>8(^cj@apSC`$(t?TE;<!?LTkq){rCfm4)~p17Q%UIX^z^>SYPWqRaxq4
zKAfJGv9I3<ET3?^b9E6<r9)(AM^@|t?SFGi&p!~#f6TGHRj829{!G~kO-4rZPg?I@
zu5@~xV%aL~KIO}`8!47+e7V+Yn|e>Z!{2FeciMEGmwbOu1$!OzQnTVyJTUcsS#Wn$
z#)p-E{6yyJh<7(xc(mH61ZMJWc2b;{yuiK1aGUm}K$8;zuP-}r^-9NbE*D+MEI2vF
zebI?^2FqB~e2X`mN366o@G|vJ4v3aN?v&&9bZek)nFh1!r-|DmTc-Y>uvp<A-$(wv
zr>Cu7mszX-w#(>>@Pm2k*~a((o%tu_s;}|Vc9VsLbpx}-lRvE`s}sW8#P=TI3qJFw
zVCL2Bk{c}e(kfptd=cn>qF^=U%#_e+uGcMEdHg4tDg^)VdH#H=Y_hQFO}kF_U<OTQ
z9p7cY?uKOsbo3s$AT@jEIm4;zGcG52rz%)m`As^aG`a0f;jYsq2WxCA|1D3hNSJ@g
zOyqPxf%=1!0c)P^nenvXVnUy>)tZfJrD<K-rnZyj9JzG)MZWs_`3Gl8%#-8q{}yMr
zyy*=?-hss3id&CWO|gqGKKhBd<VC;QJ&R1cZyUZ8-gR@k%IcM^!2NIQ^~-BJiY|W<
zYMGf7$tcsVWvH8afBDMJ+AlU`(uE7Zb5!OUDcic-Yxrxx=5bqd=iMp^QOUikORei3
zL>R<7z4>Kn@W!to>VN$H>xBt_KUb80x2apcaPR-?*0L^Da^{!cmTqv?=zm%LcID1%
zj~LnHK6R9Ry<xJvW%Isp^S0MQvL}O;SFL-|J>mC(b1g@sFEZ=R$qqcU!~50|mk_<p
zS%C-Ap6b4qt;yC8x)tGDt>L?lMWD5xVgId#*W>e7^8EkxTkfNjF7NNyzNg<K*16SR
zdZyxi`l9Jfak)#AqqL=K95#FizB6Mb-_6;DQzxjdT_dcw-^5k7ZoyLB%;W8r6XIH=
zHoIKe#p1h5DPZcH!}aTwWh?b>F$FQ`a($=@3OfBmH}Yln#Hk`ycS|>#1g*Ztd{yek
znYamaiso4MOTPXt@^RK~a}(w_F+FB${(M|xradw1%>57Rbp_|9eBhbv8)AL?_U0^`
z??JvPpVy{t)&045o4&sN|I5$otNuJ!Su2*WyZNSSW)Wja6HAB8!K(L<{0$c#S?<5j
z<$B-!&)@Yw{J#I<w|MrFqc=LtUu?C1lpTLLdwzZM{r{)#&wu#c-r&XFs}E$v-Ht`J
z+%#I985Nsdzh_V1$5U)(W&4iy9?P}d8+$|M{PHi`HVNg#EwuT#qW$znw(Q8xnw4LD
zS1+t@POF(Rlg;Po!$}Ma*-!kwfBt{p<)6QQ{=9$q=iasaYz1#0)IW^Zp53g`Td`VY
zOHJ^ZhbKelUcXV{Tgv|bbN%sc&RcnE>r<3NQ(njZyyUXFm6t0fJ#l-~G*!1#+MHeo
zCN%7DoK&V~`LprGeB<!`PYtYoWoG;KCVF+O_?uBOM}y}=nvD07o+nFN*6C(QA6pWX
zuG+<2I?Y90h1bj9Kxx&3nM&sy65KSSxE39*XnP-d;NFwuIWylR{*XVF#L~J-Qsn7u
zFVR;4%||b3yvnh>6?9PhQPb7g8&=w`i<t2Jre3>V)$dxN{5_Aw-kU#K7kloffhMyw
z--_p%j^<`Qhnj?QxR^RtZFl@w$M#ggdr=p=@t<Vw(<Q&#J<6<4q@P$?5wo;1XU@N>
zpyfALb^c`U^eNiS+gGw`&+@l(=KNebf7j##TUS;H3i6sU*OhEJciX-Fe$DpsUvK?1
zj&JqSVAG%bw{p2=X^xx!=CvP-1ds5&()7A=C-`KCW)@q3@0|2`*S9dTO-d~Dp2n}U
z<$$E-lq(sB-d*+GFeiCo>@i1%8O9<yQ`Vgc_Ih|s^X!g4T>W<WK~=2meu}AHPcCyE
zJ~H7%T&LAU-4Kg!Z~s{&=1jh~SY@qOxj%F1ZrLs2oQnFdFUB`6S$xN1DRZvbqM8Nw
ziVjyPyWZ*gYjggGqR+NfH_SC<^tJ94EEM*68_4;rXsNRELAl3Qj%8Y!P4aO)_`Htq
zaInc~fsebiuAB`1$+`TVpywfB<0GuWV#oe=eBbxCTI$xdtlMp39OwJIPI5h8o7(u`
zq;0O?+Y_Qy=AvgA4oy?gIV{YtDU`ITM(^~3>8d|dJPjW7ISb4vmt*C=!`3}5%4&Z3
zM~>}0zuxWPzuLFt;O$d~r@L<1zxV&m^liP&=`Ebvs%M{=9Wy(px4isPTkr4f6^Ae8
zP76F0VS21F`}}0R;AH~4rY>H8>e;F3K~-<u>pSHh{@WneX*EG^r}5{4Yx7P9EdIFW
z<?^bFar|YuU)Ta=O3F6X%=LIV!R@z2Yz({UiI%^7ZYi;0si#ubmN+Wk=D7K4zuNBg
zE_N5crWVhsW|rIgCuG(9&+>71i(9m=GWa}pV=X)&c}w>A&5T)_y1W+|uI)|Y^-i^t
zTKrV@`4-p7N@>frK0M!Z?Wb9<Ok_{OlneewdT9rk&lmrhKEo(GC+tIyUUOc*O$bA*
zsQq{C`KOO8e7r=jVoAsQeZIO(O9gi9c1+>-I@7;C<NJb{4ofXvw<RRJIm-Ok!R2G)
z;%5f^Q&nsWj^^!+7RmXlwbCHexIKY)&EmCloo?<vIq{EbWpymi>LQaAckkcgn`)($
z=Op{w2`+EXPYk{#we)YQaDU7j<p=LC9(lZTZ^Vq^ox0-12h+Kj-yJq(>sYxnQljlM
zXc=wE&%ni7-@0GAd_6;Cx1YG$DgTy;X{u8clUGNjEUrn~y&~ekmwgXrI9Nz)h)g|`
z;vS<S>$c=r$E41^N$*YsTu|67Zn^nH$%$#RyU%y;TpF@}M*NpdyH)2;Y|%;kC^R87
z(dlCO<+&M4R_cBJU8{Co``z~MdEseC1)khwJ<P%QA#TgG;=ksWOtU8$B|DoHZ}{uA
zTr==B%O$I4|E{jf5EFR&phs*^=CU1)a^n9k`CBeK;5_Lx{|C-J^7aoZdQH}AonH8a
zDb<SkqnB6Hiw;4lzz^#-zdXF4@I71CV-~BW|00U^xcAq^?}~ESx@XGikN@t5fBlhM
znj75r@y2blEvYxwW$!MY@nOxePoD+nM;|oQ;to10%=OVYLm`JJS72}T{r?%e+4kQ{
zUo|I3+alPiMB;VL<f*BBOz~lPFO|%AU+$JQT-IN`p;F%N``>4KN?ml8eRas6xoL$~
z(`Mnf_SUzm>o)EE|G57PYeZkwlm%X)Q>#m43>w<9_dL)&5&7igG)-5Y&=uxMzDcrg
zr+UO3;WS^pTx1JlwOzVJy8Vhsktwe-Hr#x+fAj8pDrxD?W!oiPn*QE>*7W7>*>z%9
zcy#AHyeqLH|D^Qgm5e8ww8RTG?rdy4&d6gkVFTN#nMW^_?F-D*4Rq7Hc*LLaw(Xbt
z9cPvu&Aorxwz>F##-$CL?<}~SVp0(MW|moRUCl$@*?qFC7b7-ae<H3qeQ)^uhH{?t
z>7N}w{+{)+pkgkI>Dh}L{zjdCZf6p*@5$%+mpoo&Y;2CMYJT`L*W$L-k&=@dH=<8%
z)Z1s=!dHFgnan@i2UdGOe}8dS_gm17b*XY5dp2--aknHn&C^ZGxA=Esp5D>>$M>Y1
z>p1$?eSW3*j?Egn%bh}18SX@OwYhw|Ghtaw<w};n6J^aNyy#nO>9u}u{hm3GojKEI
z=ASw_zdQ5`@4D_ijkX?}>^Bz*)pjrY)>x*bd9kzaM?~23XoHO>v?pBsbnKf5-#U(1
zmn9dkU%7I*a=~Xq)s;=oZM{1p)*5`;{;%Ms&oRrj7bMyYnf915UR9pC=;KTu*Qb{}
zTx<-dU7HYA5WK%lIIhd%liF#qCbnCvd_-r3&sn9nc(>f@xM=Gm{3jCUNL}Qd@Vxw|
zWZDsqkkCW^vG=xKw|;VY&74O&)+t^8zDYcS%jI+OR#|O((*=Jw*7mkOvPjPN+GNvT
zH-B5a<tv|j!3IC`<sr{r80yR}Ot~=IXtLQ2$(Q|$-hXtn$w&(;5nS$<@8>3e+H%X8
z{6npq!WG=YJ%d(c+_&HJWm2Vcs%xfh?N7(s&lm3CQ<}X!nw#IWqv3tMb;m!uq>0i;
zPFDPWx%u(qACKN2+2zU5b$I95&09p|3UVf8aaXRqv9<Kghw_=4cUyO5_7@xLtoJ(V
z=%J?b$7hZ%*Wv3wubSQp5KHANkE>mt>B02-On{hh%#m-R(MOdfSUJpJ$mi>JMRNS@
zo>Nhs`|hypt}2;y`yV=MdXAqvzqyR1D!gw#cfDxJ-V6Rl@=y6Rug`H=oSdz6L`JpH
zdHJ)lElvGKAM|o0r|PctU0)ua{v^cT`RSwr%cS{Rr^XbxUOKj=$7xHy*BzHrO(Ku_
zqPOpk{Pe)=JI~5=>qaX-MdsVrf}iZzKL1#4YX7eN{^DQr=PIUh`P4>FcDxW=v|!sD
z?zGIGY6%jihwE-^_^>$Us({yzD9%|2oYv2`<(x4!)h$tau8%`Q$I5eG*T2>%e`EUQ
z)2zpxEYp8XnD%4C#v^xwuC3pFj$cxm@!{jY53ZKotN&1>t?{i&`ue_5?!2v6TGf6o
zH#0GJvD@PR*_VmuSFYPdmNWW!Hu@i4UQTi;$#j-UEfQstER)YZcXG4%7XOpkH)aGj
z^H@unocy;^NiIjwOZ@F-1({C8dtrXXQ@TAaoD%KQ`8Fxzu;R|Oi`rjB6<sj>V)%P<
zW>u@I|G$lAy!)yPS@%h{E(y4E@%8j}dnr}sy)RxTX>s|kGWKNi+1As!;PC#a<5Qa1
zS06Z@aelV0Q{VQ!vYT8RJ*IvBqdWVMPsmb(`P=MvwcelVeVp}v)T6zx|NV3jI+O9*
zVmepkt+O{n+qRbX%Wq%1s3x~%$J4c<Po(X&J%6-M()+Wfd0D$$dG@Wf?shgG^)}^b
z8p^I0`ODN}aj&jU`f)^WuW5wWxrsAA%uSQbKK>)eRoi^+`E}E45Bzzvv$lLETii>T
zStSp8u1a1#qg8lu!lL7)I<KF8>Uw>JPf7Gv?i|St4-#FsdA>enXnVuOA#-!7xk*df
z@xKCd&f7Sc=(IV+hwod`7Pm{q{qLO^1!nh3zCF`E+;H6(;WzW#a+#^B3w832&fbyL
zfAn_Gyyr7=Z&k!qB^5L}mTNZNn`Hi=SnQys@1)PgTNLNdKU_3_{^_MYaXBAyr2n=1
zZ$FvH^*HNA%>D|iW%czHPX9x`R-}Kqncjagwc_`T`G4QfX|S=itSdCAsrr!f-SGe3
z@1K5rx!oN8MYxHrQ9w?`vq(`nxhGK}y4O{=&`RM&j^!jj(XVSJ$jyqpKQAh$>aW#>
zhu1fnY;9F76j*E`V79`bZ6BZF@kZ-|4-UPQeR_xe(`=^K{Ml=^1uSWfl9pAfQa+HI
zA|TBeCb(F(ed1Pgt5b8nyXy=1>~-GV!Z$P6W(wbmU;U;3basZTdO0ZGT^Qo>;comk
z>HRrRug0=&QqcLn%+I&jR4TE;FmlI{<e4%G4L#|C+rt~zXDw{9J9J0=;LSp-Mf110
zU0z|nI?pZ8X4a~xpgSv7PQ8iVyI8-~H0CwuekZA&mtI@Bf5_{9X3Mi=(-hqqe_ED{
z%?N(O80K^HoTB6MNQ(o3+htdW6`Ie|(PffV);YAUKG5&tl>R)8A|BVC+P}Z&RV<uu
z^Edx{XXRbqmJbQhYr-@9f5|-h`$KQmsq|U>3)cASNk#8*6Q2>kX<17|@qq+>eSvi!
z_A2NpZTUWXakKj0ee&0{ecj51pNUJnHL59DaOLgqgF8ReG<hh=Y&DAg$5c4|hVzvU
z{({Gud(Fd(SbdsLXtx?icRz9R%bxLcmbrTSvu{l)Cl)y{C7FdCEqvLYS$C4t=`EiQ
z_e_x=FBIKkIYOkL7;1{&nrHX1Xn*n1y&4zfTZ3Ot@n4j<SY&w~=gH&N1&@zeJbb(B
zhMGb|sOGl0*Ag7wdHc_qE>_-<QOA8vvg&@>LEU#U8FQSOPV4Pmct-Gmc|wA{+Vb$!
zuX|Qi&Di{}w<SIBljgeR?6Q5+WC~jX#Z9<2t(<V${+9mInl4%M_v<#M>NIS2@w^nX
z##-{yt!@4q*Q3}a3PZn57e8|D_&$T2X)|=|9_!2v3gP=TXVT)>o;`l0v3Ho}mvU~J
zl7HeaV>H*qBR%pPEq=VT;geb0(qwz=M8JZkil^a{Znm$lm~3d@BkRBZm5x-1--Y#e
z4!>OeWm(4?-;4f>UM!J_=<9yb)|eJ(QlukZWbFHX%KT-w<ZjQAaZRj0CB%}awf_6*
zHEt*4g(}k>Oi%Jo%+PqcX<Y)x@fV`Kkxy4>Z@-|NFLcPv-+xZZqSqpRlWsGGaz~$I
zi2BaWX7Bo3dPT(dZzq!%t@&_buiBs7-;%D2qTIGlyZigcq3?>qRh{>wLzWgFo0!;Q
z?_=XqrZ)LntKP@IbBk{}K0hO0^Y2Oa=jb)TPad3=cAw@SeP#E_VExti8tt~;h<U5G
zW4Q?5$)xj&R)+E=s%8P3c>Cm@`)uhsr+kI!#odO!cT?^zR)1PN_0nlI$FCOpld>PR
zJ8nDK`1ti?Z;MCGxoI0j|8G2Fd`GCFxA%p+Tlmb$%sn$^>lvT<*>r_lylTxK`xEXA
zXG?slPX4~SEh)3+W~FyrQecpbQR};f4{N!alB3e6Ftv6qdE~ghazWr3yZ<j(yE^?I
zzp#>L?#^mEA}yRfTUgHUI@^C=MaGb}=`uoV6lJ_Fg}ibQzdUPc`NT~YfmM7xuV#Ff
zD9!)o<0lw@VXv3H@vO9$GN}cpO2fsbpXL(&l(yl1hJFE`ijSku7aQ>?;jbt5GFN&_
z<;GVY>OWe~`>Vd$qu`8N$F$seZIQCE=lxB(x7Z*3;-9>94fk}Hf~z)L>p8L%KgKEq
zpELRXEUHO2<z&JCM5Q@CtC-o|-Cn+-<Fb<M>x|pl8Qb?P(YVd&^KO&Iy`2BTW-D*#
zOP9aTSaV*+?6y?8`SUH(=Q*=CruXzMI$z!r>-g9x;M&^d(|^j?x*4h_Z0+9q|B1QE
z^VB*```o~N!aDuZcSHQ;Y$wjTaH9Ovc|ZMl2mRyRow=r!^ON7p{&+6aJ~t#-LQ8MM
zlagI}E6>b6cVWq#7e^dVL`i&{{ZRY-x)0kl|L?LiPI4|$ves-3$Tx1uvUK|7pSfI!
z{l#<x^OGJsn&g;bugyz3vi454OzN?B%X=j!x=%}B61Gz;-5f1@E#glymq{|;?~Fx$
zL9qqfF3wrMF8a=gUr{PIdnPS-Hg(D3C(Q0zWe*p=+9aXxF7j`MaKyL&S-G!2yk+6I
z7*TX#$$Q@4GAG}aywYIjOIj)_dOM?X!It0%?>QVlf1KU6*kmC?&>5z;Pqdu(w$Exa
zWm4p?T-w^TWaYV>-51z-Wh!RshD?09Fe$MlVXBtN*@Z@PUp+X$UfcC1VNEr2!KY7m
zf9D2XN>aSRzE}TCLdgE9HjVt!2mYq(uH)BvX)GjfROgxQswcAK5o6&*TY*a}FQ)9=
zSRlXr)t_Ghej3WN=RVu2BX;<e)#+ES?uoL8v_2EA+FNQ9Ctg<BSiUNwdXI48%9iT|
zi<2CSe2ia<dTp2#u3GZ3P3!vl@13P;>Tk-LPkjv8%U*i_e#Hd_j>Z|29<5-wSD3%?
zfXkj;A-|Xv_Qh|MypwdRinZ{Ne$brdx$AfGr#AC`w*A1=FJF83+>MjWCfeHqK55PV
zBzwg1OHC=0tY65^>crBXc|k6Ism;^2Oq#Jczrw9;Qtq$y5wV*-noYBBTNr!f(7z9<
zi|-!Qd7thonRcS`^_u2I!bj%hPBGGWkaj~wlUXM4jZf%%rwMXmo9qOy_Naf4H=mn&
z<?_y34ncMXuPWL^UH?DT**JAg&SGQ1m_56txt;!f{kB^FQSW|<Ua@mgS=TB~zCCeb
zYnhUb`~FucmtVg)q<zvkOef3jNy~*TaZf9(3vaV8J6bHdeDA_88`nIsZx6QQzh(A2
z>T#~7LUF~}2TczyCpIK-bUR*H$Nn!T{WWJ6i%<927nNz1+L!Z#tPeli@>J%8Ret){
z7fv^VW=r?WD$iMMRb*b0v7+GM*QWG@rw=7d79T90_~G5O3;P;$3--7u<p~}1eN?W!
z?8Cit_M7Y6=Lr85f1$DBMZvG!#k<~bJ(ZGee=EXrPcM6a-{%jvlYiCri!b_rPAmKC
zzqt=Z?(d$<x<-%TxItUkuhYh-yE(k0e==G>6gfMkT4biT%I>GK$0q1%Y!+-!N^HuT
z`gwZrq(#@XGd4~u;-0isP?X)zFHG*p>#UVVO^p_!-BFCr3spZHKDEQ=IZG+KmaNt)
z<x-~fw@-Z&EG8a{(RpJPxn`33o<NC-lc#a!xgFOIKkdnQ+g39uR4-c8UvHz3R<^d!
z;nTn0e9eDe>K9OU_8Ie}Jw8=WW3IU0pT8qWUZ``&wO1nhpU*ig_S`CcPEo~ow+YuB
z&$DdeOnEuuQq%68X`<GOFIRrvxz@!)uF5IyuaUaNty@Z>(O>re3;*(Za%-*3DSgwY
zH=--|_qo5xnv<M+At1eDs>iPdD>fx26$M6#m^po17#x+E^L@hHhrJ%j$J3|GzNQdz
zWRaiqYNIoaO0ph;cPFjhFy-Wi&$_Ea1ZJ@0t(&YDF7id}{)FJKTQ$5wZl%0Eqx99`
zu=^>~swb0|Mcfg{e<OC}|IT|MzE*Y54(C)o<!qGR)GA?nG~`<9l7+XFy=oX@1l8Uw
zy<~W5nd4u%<H@Ohan)M#mjacKuY2kA_<7?8>!1&2AOCjNd!AdqV$ObEjoa^!1lZ0M
z+b*)(B)Xwz%LX6UpqC!f?S@V}PpyA8#kT9pD~H?9Gg;TKyis=Yr(U`H)BB=JehY8%
z4|}P*p0VcL<LXDv<`W;xIC5p1(8@E$DJ#_uFHg1hewZcobdrkf<TV%9N$9)(Otm}u
zKyz)csp_rBk1LG>ik|&X+Z1Bv;OVG&{lvH6!p`t-_e9nfhHE8u9<n_;r|acEtKEm+
z%s4Xhfk5cR5|N`pAC-c83u+!UpZhs!+R_TqUwpSu{K##WWnA&^$dnfomYh(lwXrOl
z%*<b`UB2R@Td~=>8fo+O3lsvlpVrO37xnaqqS2|w3g=plIpJF7KbjR~3O^m@ul?W7
z&TOH0`Wkz}rDF>gXSYwjv@oswSJtaLyG37xdEW1HW1L&kK5K7O+@{hae{aT^D!zEj
z-=wKolb-c_VcF@jI^K+RTl-h2e8^a${^j(-Td!nKUcU8GJ9pDgp_<<_7rQn8E}pbM
z^pV7=?3AsWlXetJ_KNyx3gxcWki3+tv`k>_#e1fwtzHKispqs5zt>E)U1zi|PfF_x
zPl=Ut`-?kfVb4{yGV_8GJ?_S&)bp13Yce#l$jy~2ev%()ZCX6xMC`_=S3S2qmD9=A
zK3w?g;Vy=_DQ6EJ7rV7~&#%cPS>o64^z<bxQ`nQ}H9_}i_I|6o&o|{{fA#vgIbQeq
zh4^jtb9?XIsQfek)7{+f94V9Eew(B<<&Vh+^OA(d+SYqZf7+kz(VX${!_$AOo5k7n
z{lE8>#mUV+z*Zh#ChAqj-n%gHn!_xKO>AerC)yof?EmA-`Jk&=wTw*(5zb-Rvzkq3
zJt~lTueIRAzkeau#Wr7TyeTBey!W0(bitO(>pII`dH-dycD?axf^I&KiOH4YjAz8}
z&;7u*bwf)Z>$gSk_FJj$`eo{#xL|TuhHmNN*;ygioR^lqIVUR;&$n`?X?~sT59|3q
zPMo)8u1`p9Q1V^UYs1ZVCfQ8x`0Mwxu7`dTSzf**==rv!CCp2ULY}<as<6kw_0r4I
zPQI7Pub#iWIFZpaZs)xhuWx)eRr$npNa4f$aQW0YxuZWGbgrE-VZV(1;hws_shiTD
zS~vgSopA4_@9c}6T*j+nf>y6iddDOmHpxB8T_W=O6TW9FWNupDtiI`Jnej{Ta#*>-
z|KA_vY_nqo_BcDQnSW6{n}J>7)4Q|Be+S*Vbh}?9`b%+1c4(gK!;LrJ%GXcJ>tFs@
zc*?$O_ZPfA>~`!@oY&2^iyb={$_*QrSNxg4Sym*z=it1hp}PGwOPto9?!Wi?wPoy!
zmm+H~J>mGU%WM6P*bJ8MmJY9bA1v{6&!2ZN@6;QyZ$U4fT$=NnyK>FzkdM<2-Bnus
zz06I^>8bA0HD4NoR^B=o9qzYnm$a{{tW6ceon@+#U+4e(d2zCS`IIdA`p)hA>lmfq
zeBT$rV;p$HBAWGbX8WeuyE0C%6BQTqd6%pD$)(l!FxL{bo=S<=YN}HVlb&zj$yC_1
zC)M(6RgL!P#I?`jO3mee3c4<v{_63UBBr@-4u=NZ*;a0PocV8H75AOkm{?xjnyVUa
zY=&~b4;^Ip(=St6;JdBj+E=sSqwP)$nmwg<mq=%oWQU4xJAPRy=H<<GksWWd#kb79
zeS6kY@v{3<ZPT7!2%En6v)fYb*0l_OaxB$_-wS%pch`|A`@m<<v9z!?bfLY>BHs0L
z)s%NARuzUOH+<AOdAQPg+qr%GVH?daujFBV`R7PJ+gl&L^)vVwJ?67WPo8`=^}XRA
z?n`y&D>rTpo9#BW<kSL_E*XVynGu$6d4f;;6g7|fW#_uLgC}9V)dTbB@RMP#1y%fi
zH%JuCn-IH_MWuf8FO8Jt3$4HY(2W(iRN-rBwt}y6+Z;dX@NXX{_p|<U{q-$nqG^iU
zi$@>bUn|X@pWqX`x%=bsSC2B|9=dH$J1G0)`@07Mi-n#YxUr)6p5C-V@#)`>Uw$Z~
zd@_WcJ)&e+(evhoN$g1*A6@f(5__+nf6cp!{JQc@XHF));Yd2*p66*6RFqlR$I-uh
zQ@iu@=g!|QZ2q!LW8?0}lfEx4tv|H>+k!YT(`V-r=081A9~faF+THhnaqd=@n+NZ8
zhX_o+;>+s!h>J1t*~uD~>HDs{n{j+vaNE{m)r+T&&ze)sarI5W+E%7_oNbo+;`f()
zwp`wJx303L<j<cO#ug!)OfP;>k?C$z2?;Gy2>uu!>YUlZb$DLbX?~Zx&r{w%IG~Wa
z`E>xxzDdh`OBXCJFL5l3y}GUKbH`!>6^>Z@1zQ4S7azL5W?{jnlM5y;Si7L{f7g8L
z)Y`*MGtU%9@?F$<U}U1_<R^N0gVM~UPnPITJGZ@kZ!~kfqDyl2feBLG`d-_MPtCZ-
z^}TNCp?P0L&kDM#i-_vanwM5~{@Ztrh6k>OaekW}SpKhSJ&?r_BU)#nEO9OC2b*#n
zn~#^FDd&l(Q!*MFy<7~s&6|RM2k-L}@0qKv5%5+);r89^D?z>siZ9Gv${n?eeVuva
z`tJu~tkue%_@2^p-yke&JM|FrBcIeR;TJ|MayDfeFSJ}Qgmp3;f6wSWcM(hMjSSIm
zTT2fwSibS(><FnHyJIZFf4;nHX1OQE>&d~Ni=CIAsh%_a{5`YcpV~8~uTQNqviLjO
zyn)%gdfpAq<(hxBCw^z!A697p#q@Du$L>=)6B28tZq%3(HHT^TF{=l=&uDzq7wvKB
z2#MaLS2FACi}%s)7q5MJe<HXg%am<V#>u6v-|Xw}o?D$YGxT=<{~tg6c{!$>S(nMn
zt*-r3A$xk<k!vcs_dcnG_!a7$tUa0GzT5YGNdE4ZXS%O7-H2YfRA;X1@8hpy#Qn<m
zFduuZ`>(m+Utr;S!@Dyz`lD=WbpO0=(D{AXKH%%LqfGl^x|WM<^!40wKJ5QX+1=5L
zyr;5qzsO@<fB#vr7MnMZkwaj8uw^2XhY`b<g<hYFE*My{M?5&PzVwjcf#Bd?#jVE8
zQdSFs=IK2@q2iZsq(1e~-8VwY1y92c{E-r3Jl`s{l4C{a`Khr7mN0B$ea>HHrKQLj
zzClx>`^A&MAl;ND3yo*IcpDx+!|;}5T-fJUKKCCBf&y%{KMU|In%T$kFj>g7+@yAC
z<+s)1zoXBl2)s4#atLH&-E0-a#q{$-p~6<pogeNsD^<){u!!w<h<MxTdYMDJ^P5{_
z^=gF9lq}_XnzUkv#2sGdZ&NpVe^8RlXkecARQ<s8({?TXYfZN9klPu5{?;N_fq0*q
zJz0!L-|kuYGWhG<lS&Hn)NS8vS@~dlq3`R;?scY28WY|d&!6#kX8+A8y^^<I7$kj*
z3BACxZGYNrp-P4$@Au37x2*i4QTgfTeEI*HAz!D7x0P@uf7<or(u$Z@QR4fjyxOO^
zvp6WudAq=+$?pC8d*bwuX~@`eerv4qU8&SydScn-g;x^Z+BzF9{qK4DMBL(xVEyM)
zp0rH5!0@xf@>5HzDO0j8qrfc1)2rnEud&<lbp3_1S#rLCdfCUseyzP|J8w0!Vef(!
z%g+7wp0@5_<g=+#(g$Kb+SM(&vTgrEpSen_SRGi6*)7g|liB&Ic_rJ0#8|z9N6rbk
zq_7L03cUMb^KtR?e(OuOSM~ePIl|XqaIS3Ig@~lDH<z=x?Z_%TJu8}He$s-J@1JTk
zCe3~-DYEPOswW%j1ly<iZ`kInz`o^g<3wKFu4|=Cb5^Zt=ygmuba(F7HS2m7rt%(M
zBe=N8$T$0k_c?oZmiDwe=NfX|Zrj&X*OYAdp7sCs;rIMyYOV*1x>x<UU@&8?@d-BV
zgo)`lCfk;(nz(Z{RW{x(dvd+~@b2)S>j9A(`<|RQ9=zu{^VVjwlk@EKRd({H-wR@_
zT*>EtdWvgo<$AM2e<UO}ddnncAAiMgeroT!=P@gLx%@U>*GfP4vC@ZGZ$69HBQv)i
zrmDWyshhhN^-haWSkK`nD*Wt%*O9cWc_;ejNA)E)NF==p*Ysp+E4_GmO=R)XtX7@(
zQQ;RJ`koaKm^<lPA%n=hW3sE5T~|*3xnu6x1N@B}Ov9ykAH7-0W_!Sn{m85p+8(E(
z%|HH9(!Jkt&ZT0fwNLd7zl({l{if$O>n>Szl*ysw&&o)Nxxe`<7YE$5v{ioTq%Xu#
z)5{R+>T||_-Yh*2CbPxKr=l|}?mXLBe`}fiLH=1EMC;X`G0ZoOpV>JjYUM|BPv+36
zC-qCu1{A5Q%H51nKI+Ri=SP6Q^GfTx`)>a#d8g5E@rl=4BgemO%+AhVGAs-`R?U4a
zRhT<*;p{-st=BKC%3pr+>jSgXY_@k4n?mnr?{qfF*=_N(AwX<a+2+tgrgqi+dsfX{
z^tT{u*_wF{cUTo3ycCcsdwwNh`kGnOw@#cRdGq<RdBq#!V@<hb78+jlcQVszJTJ*I
zZ|5@2s>RC78+0ds{T1fM$hR!>HFurm!#g)?-}7Fb&Ub9%NBIpsUve&Y=xh?2>RXUM
z-@D{?$izzuk;&g<r_Gm>4PB(9)~unLHRaDzq0iEW0=hQdruJ7>nwY*7scHXyRjl=;
zVnuAzB-c_=r$f7DThG78E_m|h94WuUvBG~nIKF;7$|Y!`UFayZEl_B^$%BBDWruhT
z=eAb`Yc3XPyJe=&dUy)U78XYdk4>d2f<YOJr%Xu7W(>3FNZGbS^0fAR!Pacan^xaW
z9{sWDtxLqZqxYADw#DvgdHRWinIU581La1uXA+-;H%{5|_3Wu7;&)E)24~KS4ye@d
z{l31tW{T?lJ$5!#QlCx*Z!D8=*NvZ?SvY&@wy!%5R+!vV&Dq9uq1hy#L3hvD=kx75
zof}f6rq%QR{rh<SzE3tDOaX?T!qIM7De~!B-ZwvF{aN;W+xOSvW#4!c!oSU(w)yv&
z^!Hc0w<b7U|K7aoS;YQdO44_wKOL-_-d#QOnS;3I3%}}#-yU5rUO4+eO0|)qx6h@A
zel5Sm^C#-GzWcUkhFG{;QP$4wO!w4e^NMfRF^Jwd`zCV#9M&hR-B_k})pcoVR@#&u
z4*Ar{o6j5GHrZ#+o9Ua6EwFzm$jzngwopi0)zQ1laGK847b)ULk1Xj7W$WG8r?-5I
zyc)a2(_X*qGugY>s6Lo;MuDf&Gw3`MM|Ez|*_TG!Wq&?7q0s4UxHIo8hvr7HH1SDS
zj>r_ni(XdUSs0SH$((1W{X?HCE7+F)u<!fzxa6&rYEg7FC$DPvu1(AK%?x%}^=0O&
zl=ZfK+uq-fjAx$|`5^4+A5G(fOfz4sjof%g{;S2*##1^I&O1sy6M1_{cCVhN%Y|pY
zono5TxgMriE@xVQ+NkUN71qke$`d|C`}ajLJ%~G<6!>gK(L6EbZ;YZ0pU)&rHOhaz
zCdF#`d_4m#$ro$?RoH(Iowz7?ZkZkHGA-xbJ8l-v_%X3YG$bl{@84NB9DT*b{Wpcr
z3W^a)4O>+kz93Ki>BKy3e!Y+l5*<DDjoOd5xO4wuOFwL?DZk*l#MKQZc17<O+uUTn
z!X>iI#vpyu(^Y;mE`&ebDb$hNb}Tl@!S+qbk=nG(B_|DgXDK=}@2+5RFrK`;-T0<k
zm4S8HU!9|-5Bt|YZ;*?d{^UxbWmd#&r_K<21Ihb`g+AU@W`A^ZF}HTK{PT@mPu@89
zmgxI$dLTD-O6|MEjT(RVr@r$McG(}+u=oEjcb~nIayQpcJsmKA>9LIuW8G>F=WX_@
zI-VkZckLyil^X*(zkZC?T<yM_z0~^i(;mM{|M_wKi?8gTfAF@rw)^gLQ`Q=4n2P1)
ztlQS6`ZFQram|sfFC0#(-c@)PyZ7Y8inyeGwZ2P4a_fD+vrf-Far$D>v83gzS~ks@
zT_hjj);-CrpqO=!Q~6`YYMqL${)Y8?m0oS1>F2>d=ay6YX6LWUJGXc47r$$)azZ+5
z{w~jFJ0dQ|EY%Y%T6IEA*uzU_K}MRPqo9wM<RZJMeZOvQP29RdOk`5fk=3CmIVu9C
z$y5tJt?b$y!cpeBx9uB?b{nJn^%Jl6ZJQ^tb%J;wTky{-LD#;twL2}Jzq)nyg2{(C
zpN6uuEkEOv^}{e=r*=$@*Tp3@nJraH`yIau<lI^=taAUBAHO2A@51Z1-e`S0J;B$}
zx;1e@W!t4)g%7J9nt7GYj7U-Cv|f|(tdPYjg!7HX$E2fawO7TTg&y&lJhAq8694*X
zpMy8bFxqD>k6d-{33v8;_S}G(viCY)u1QEf@F-!8wqet?MJpDXyycpdHeZHqPP<2a
zYrt`Rm972i{M+)_y{ore<|@f=bd-IQ@HTS>pSp`c0lz|atn2j?QnS7^J?c{YIj6Dm
z`@MLLz(l)ezq}S_mp}U^IjNbE=TE?Yoi#o-9TS&E6km(ISN-kC+_Kk;u3WrS%1~d$
z&hq%)g}1#g8Lx*NG~KG<6=}^fF>~SSlaplI!nT^aFYb4}9dPRDpXn0qNAlM=bU(TC
z+v9Phx2REP{P~Xw8tc{1UG92v_S&`AyE6WM_q$h_8#ry%OXiRMP5QT%-zuLyxjZDW
z@aN|HJM2DX?U?iYYwV48%a)j}<)8S2x2m;L=CQQIi${%CUh#)d)Xe#{mHB7xD$nLK
zkx`bfWdF?GbjzeT@~W5NdvBi?G9o6MZgi`qWl!GdtRG<TcIrEx6W0&l&1?|Tn=te4
z*0%ODhYu@0GQ4s0zl}`GqO#quPP3osKd+;6V4dTQ$NY{nZY)fl|7MlGe8UDF<JV_D
zdxl-zT{ZjW{#A3oeX#qo?C#P0YwL<d1tdhD-(h@Xuy9^wZ+qCmE6+N`9X^!@u4*|F
zC)1(Cw&S<1f5OMw<ksU~cRaaw@i%9t#KsK{$8TlKFc08f*VE;2y1Y%V-h=&9c)0xA
zj#syD99?(9-K+eK&CzpfkN;R6Ij4OoTgbt>vqehJHj1vg(s5ThLQVgtoJOf0YxwQn
zzBXqbBMZlAS`sqX<y{QpYBujaI(O~TpAtX0>;raQvgMd)_R8pR$miGmY^K>pQ>IGI
zTqgU)v6*?BM5seH|9a>6C2sfE8gG1OTRE%fYnAAH?$z&9S5IiyDs8P?CtOg(Jh$-h
zzO8~ws-~`bz9K9!E2Ym}{H(Oew44XYnF(`G{@b-_#~j_onE|HP11>(;q#yS$Z-!B|
z=gIS1PJB7?_%)lDW6{j8w-MXjN=;{O+Qp>&yld+*`wJbsZxic<V%bt{cfG6G!W(x=
zs!?w3Nx|&rt))c=fBlS?wv1oPo4v7T$*v{pbHA4MSgz8oyVGtmK_$M~qv*n$ZSx$n
zKd%feTpSm}tbLq4U{U^D@mVGsF-2SZj(LkcyC}x|c-^EIk$rCZej>3JPyO`YFEWpG
z`|4m&^pICl>}cmC-mYnmEcPqr9-iN};=>Y`xEIFPlb>J8eD~VBboIvN+DB8a?rr-N
zGG&1oOHg^H!lQE>vaE{|ir#)sy_aD%yCr4s2eEBYoBfUj+_?Dl0!P66d*&xv-`Fj9
zc2z*C-PNFIk&k9)c8OU3hAN9?A9iK*F*)q`=gM)}wvlgNR*mwT$Ci`c)Gicno@kM1
z@Mt>w-GZCnzG<|a&B)Ju&9MLW|7|OO1<5}-cx|tb>y1N>N_K5250<Xk(q}7w(Zr!9
zLGaVJ2!@sePCLreS6#Yv_xX0=y7D!t$LGj?=+}Q|`0E&J%JwO1tKC{v0)C!ZJe`B9
z*MK|e^4i_nH4g)}>|7y!QH^_z$Kqhy#oThMBO>k3oeJK|c$krQ_MFr6V`PGMY+2-;
zHuJr`|B=2~8g<*JymxTjn6T-YyjIw`)yFrzca3fK`=Z6bq001i`<#$(qG^H7^CAv&
z{n+s94x9LPu?LE&`}Bej{Hn3I6B?`Mp0d~BJVUPXrWpPU*IxdR;dxUKEL@+cV`9?m
z@P0;mnrG_o6PvESt8Iww@|>RInaaFNWS@IIC+FGFunw{RzuP08^>*C4z#;gpF<im$
zy<7}K-Gsi$e*?;n-m06Tc&Y5K0{<zS3hmb``j0Kk>y#>9zV<`o&n^8ey&EN@8t*lA
ze~Xotdwt&Y)V7bN{V)E1J$-EV^qO>@sa`t_d^9AsaGU>nCbXi$a-HSh`GxOnKB}!X
z-xD+WN_JMRhppbT<`<P6EsNWEc3rvAy4)#snMPj7G0#7C+)QD6=B(t}QrcaaTJcmW
zcG2u@6FhbNOpZt?Pif#@ntNN5MbdZ5y(u@`d*3Wv=@fXdbz{q^2cNfox$#zLd23SS
zB(uCH*Y_w_vh2TP+c}?qm-gC*TL(f<*1X=E@1<n0X`+3{6FZ%239*w_^OaVFcXA!S
zdgs#54T~mop4{uO)<lw>+0jyaZQ7iV4Esx2nwhV;UuL_MYRLAbY!i#%jw4apb6MhR
zcezdum1UY3+WD2~@7A-`tezqB-5zL&FIWD=s+{mvA!vgff3d*J(3t)slA@QJ3zWHk
zSZ{5(+xR2ROkr2__BJ8s3cj~O^Xm2sE{gb?!_l`WoA=5rm3FUkF{bMt&Ud&jhV5=s
zFuknvd;YVy!_yxp8}-Z<kbUa8|Ko4D=_>E?56rFES0!lmnbYLTsZeg#?7bz2SeE_j
zSJBmF{vp}n^;LVq<X7fSpX_H%P_Xa+qO`EtIdExBp3b$&Z!>o+|F0gb;^yDY;O^Ft
z@ND-@rv8PKF36crt$8uAwRb`tONW$Q^z3!EFK#6BKP=rCdVt@8(_Z~<!j?ZmOCI0<
zqhr4167SMCH=n=#IsJoDDZ?5MchxTqo7DB+O)8wG`@uWkH!JaQfyuFLQggKUZsbNC
zTzhVP2Ja2YN9+@iUHyEgr|!?k<8xnRCR)GM&W}6U=O)R0!oDx%!Y++9UOnI9lG9zo
z^P5;!UYP0F^m0N}?wJ>lq)j$PztcX-@b~v!PP5}nd>UQ%TN<2hU18epBHWWZ@#(Jq
z8IxuS^8}t^|EM`#>%g3YY)dN6XglmUvtgB0N&gqQ*mI6`TeBwSO$uxgW6V{Y8aLZ}
zu3To$)$VKWSI)Ok@BFm)km|v_jB_8>7p(c>;nVWL_MqZI+ojhZ&q<ZA3`wf%t~;S3
z6q6S?`K0ku@$94^Th4y-B{t1#b%HBrOmejPXC7vxab?ZwTPe%U6K$?td>Iz^Nq%e7
z{H-~&+dGWqvxUsM<>LyxRx#$+95?@%Cz%{s^o?`<if=!Da!-|2xEZe#BIRR#_1}hl
ztJ=d;cW-7dJ#3vVAiH$>&64R};lZI@m)SfH1O#s@QUvY8GtBgBS-~MJQuuxKx%-Ls
z@0mAWGIyT&&}-I`2;1w?!G3k@&znQj3Vo({l}8qBkhI=*J2Ti)Ui4^`)?3XY+aD~I
zu3lp7@wV4RKe2BQD*L%nNhoeDQ<ukGuZih%JnWV=1j`t+)xLMV<#p=U6%pqNudBMA
zd}90jB}lSTR-iul_>JRr(+b!W8#Nd*14BaVEWe&wl5G=xG3He3$<G!k_5l_urW-0%
z7kK}++dJ2{dRfJ{%$bEsTlR4UWK?}(7v7*49C=t?<=BK(^Dq5~6uq_VrR*IihtrY5
z6N0xcoOXfJbO+~7uF$wMEwV>4_oTmY*N^dM-f;Mv$qd=o+b&;K6RWh{)wXc*=ZSmd
z5)ZIEjWu7md(GDPY1d|Td|rAmO@Ep(>+;vJHBlm$Usdx3bd@jq(fuTF&${d~p3^4l
zKj@xWzi;#2*xq%<7WJLy?44#_J079Or96LIx@h|r`^qmbKL6NzwDdwxLhdq^Id>l$
zO*Z$e+kL)z^&v^oKIz0>siu~FtEV&{da3-_^G=B}@5HW8dUGps%rX{UUlr-{cE_q>
zDUmsa6J=fqP4yFEW{TWZFv-g5?y0aZe@o^ZDZGEMY~l_dmDMJ{T2kx8l7#Nf$WEWW
zc+I^mLqXFXpX=N_m;d`M*|YWa*_D$Q-e`NCcJj>>rm&Bv*rrVMzBi>dUWO%H$YOnA
z*5e769RpXaJ2wAqk&otEhBcE@8`C4)EI0CIi5>hA+*+nn$hs*1k$l14sTGkHslge}
zPaVH`#$})0Eg#cjT*=A0{f4H?KcT-9F1?(cu`|HaQ|00G_5iQfi!Pl=-|Sj@{N=;+
zn=_0GC+tb9-t6helkq5N0(*N#j^r9^<7U;o7e+-{-8Uy6;=eQf@*3Gttruq=6_?7)
z+9Psd)idF{ir;Q*V#@O1N?05^z5YhF&eQF(lOO!-PmPM@UZpvoNp1GiEiV<q74J`U
z`)E0#_)AZ}eeI{G(-&Lhyvpg}<crp~v+rN~_sT|vpu_@eH^<icET!XXCi|Bi;<(FV
zdHaazX%opG3cGYRfAMu)KH={Ds`|IukLLVH_hb9H`@^g)b2<J!Z3^Ytx_v#*r78Ah
zkEa#t>#q@Yv%m0m)gA3JmJ`39ImYRI{-|~1Q-#CR#{V17@HLvQF_iR{JmHnid}Za7
zdn=nJ{4hEAzvklW?^CxjeZI4AJD*?piByXQ4`C-`xibyh!x*}XmnuD<ag%kwrCg}x
zVfH)CodT<$J3f44w`In$jcm4gmuIXhpLjIBcEPQ!@pCg-KeKz@dA0Zu$L{Yk8$*Q3
z4rC|fr%T2q*uP%-($4gq!kLwk;tS51?RYe=xTL5m{pj!D#UA-B@2Yfr`==CT@@~I!
zY1gE0Yni_$c(w-xa32hQvwV`e$E2&A4l*YhH&4|6Smts3Ws~IjaQ5^3ac<i+Tm+Jn
zPj^{~UTv5(=K-&L;>-7|{L;D4<R4lpwXxx(jHS-+yzNzAgUd8m+*S+bI?=mbQti?z
z9*L>Cs<MHi-9KgjEx7tW+KON3Lzey0IKOV+>+T&tY;={izbd4MNr_(8%*s<$mW-Jm
zvX&{?rN?M~j!=xfJF8CDR))TfSGBJ$-t_n4jP2Wl>t34V^{t-elqx@sY4h6YH|?iY
zYHFq$@Vmu6GoK;Md{1k-#<a-2U0#gu63!WK+PYNxbHM#QMV#SVZcSqOUpOW3htkpo
z4zn&PM~8;RE${9sJ}&6NeCE|fpHAN=Q+CExJ<suvj&AUs`d5Q(OYi1=Dsw&;9bZ@_
z<tHFsbbaOJAiqcHv3oX5l$l^qa${+^+D!RVc2mli#2nhSrC)8+x5qQ@1&Cji6!7?C
z*eCNwYMc4y@3W>K&bnOn_~yfYeZDe-PA)N(LvtGzI;mw%-n8Q7-j@28B^47-O1MV7
zeKaYgbw=m>8;bYl++(~f`FO>bZo7~@4>w9kFJF53tj{{fRc2Z5owu%@7_1*4x<Axs
z+lJHYmDdMHsoq-?x^}Yg!RlQmJ=>XPt#e5?zZ(4`CW1RraetW0sT`x#x2J3{JA344
zyukA3X<|!m`>phyRI~W_dcJS{@pjfV|9)L<oPFH&#oF?RW>dV?zD4vrGCMLYiSh2q
z%!*y@8v;IWbX|EhFT7HAVo`mss;F9~-O^HL*?Y6sOynv&-Q44`gE=ry@6h{4>ss?x
zm|B&eXlM6TH<e1isucbxc2(cfd%^`Kp4-+<TbvztTJpW4&4=q1tQQ_GP44Llef0Hn
z*ZuouGpC6(UY*fcfBf{sCl*VD9xvRf?)fNV&;E_8?Z58(@#^A()BpPR{Co6dw!LlD
zrwsPZN-KBCvR>6|ZvUO(cE`S}>i$X_=_NLcdvZ3~u$;`8a&F?okf&!oB9a5vEIN8n
zD<Djqc`92+Pep^A#CG$U(^pJ)+f-Iv>u%ya@tg;1e_rU<yC%h)s>1aLh31)mT4;LO
zZ>9g$PZ=wP%A=2(yG~tLq#HUbdEvF%`jT7iKMeLA+!ecd&gYP4D~uXm7CHL+7}oi+
zIe%2`)2(9MGkMpvS)0|Pq~E%z2Q6j!YWwbJKw-v@t#ZoZr;lh9W)yPjh)r+fR(ieu
z*uRTDYc4HNEO4-w`pOWIeWCZdO}Mw$;XNvIzq;SJ)Ohxb^>^PhN$3A4tE6>idPM*D
zek<zPv**uGocfgDk<EVS`wdMtQ+;Q?)@w^d`d(}}b*ZStcFH7?g+1cA?<a5X;XkBZ
z)Aq@7eR*s4?iYPe|Mdw?y;|;-{ci3N@fjbAxVbN7?{bv;-}e5J=BF68dmDoJT)Y-&
z9{yakWYY3ew|<7i*3?IQ3jcFQ{l3OB;itdaL@s%j=pT^ukV@3M?vTfQrpCBA<*Ail
zld|DYEh(Y>%YR%yywt0D@y!`i7ndpTx#DBM-LoWFan`J^_SEC1x;>sM6F!+;lXOsh
zy5`A@yXRgB7WB>e9JZZt%Ek>7_xeu!U_N#Jf4P^jyThIvubJ~<-P@l1{9WeK@59c#
z{@Zrd?c2HEy~X;?3%!{SEn%8$s_^=hS-IR5!O&ELr)pA@s|xhj*Db93mKc1tdGC+1
zmb266Nk`-qF)h5Q6Q<?ice_*PXDVZjKq>Q?9>1L{gDxJf{t>!kbNiVC(hYLE>P1To
z%rqk}?BZFzY=_5*{)}n;v)`@a5jj2iz~ysHPCs@9pY;sM4Kq|(y<u|fk`*^M+~2x<
zsq#9NC2_kpCuEmDxf<{&-;?{sm&`UsyWo?alU|!L%ss?8H6>7X!mF20r8e*d&SN$_
zvx!$jAaTcG8_Bhd;t`G8%kLJ;>eYChsnEKoaA1*?S%lO?-bZJG92d@>J25cndZ$R=
zAA!mfnzC0U{&Fw&U;RS=;_2(|^K)vV7_T<}KT`O81<w?JX1N#3UOYehLQPlOI7mXW
zL}2xot6~@GHoKWrU+DMpd3DOB-n&hyaEHp870ez79yeMSP1z$p)pOl({=fx^Y8kT2
zBChh;WEaik=@Z#6<FMJO<>mUR^#x(EZ;$;xRkY?)Y=*7qReAAK8JdBz?cMXw-haEe
zVn=O<{^Z41*gg01z5F6=^a6Ig;^vd`TFp%N6P@ejC%A>5nq`p_ekDec_peryMqQ7A
z)~sp#qV69*3%UgT$=JBX)wkk)zq;VxSwb)B*G%}{I7wD~#pbWu4d*SrVbIgHFr`vG
z%tu;M%g6U&V_Enmj^d?n?l0LJ?|Do4(g~)D<t^=R7p?ufb;+)^YbzNSDZKA6o8Qh~
z*t7PP;oNyQ^jF-NaWy@nc<Qmm_c?iAII}sQ`k7f6y4F@|SJU=0)xFc*R#}LxJ!M(I
z`@3x8+JF1&)?fVt-QS!3;s5$_zq+^IpBHX!{+)G`ZQ@F|W$fEm@ja=1Qrx<T?Zofy
zZTx~+;XMD8IX3_2(_vNmx%iXtyiZ@v8~>U&?v;Mm%u@FD<OiYih9~Z9-cl3%_iE<h
zFOUBj*%lfzZ}}V<K27`l|2yBO8kg))JeTx+Uslhv=eyT9Ie*mGF1I+dFYSPIP=+Ma
zhsxJ^s)r`EdOewybgA2AzMHLgYa;*2!YBW4s=O;r-e@-~KzGu;T}59XLatD%=RX;B
z?BDEyzYz5B(AGDn?>~9{U*cz!;0aTgoTt%W1DCw{|J%ib`||&dK}%}ASN&A_IHf9n
zp3S%URhR#%m4VQoq~*)hzfae?YI;vMVx35jj)CIE6Vear7nEFa;8RzfA^te$xR;bc
z$0=3)#UXrRJtyKbCLXJLtHZYZvhnJ9)^1@zhK*&XRGz(<DsZ9ajme?qzaH|QI5F8e
zG;rQ2r}sf(Z4RkFY--j%+7fNV_TZ1^^UGFF3z9#W?^v9m_vf&0Z_;t~pj(etEwB1)
z!ZBqf^SVDf^B5NIZGFpjd$EK5&$|_o{@ebEd^bFhCB)I>o98VcUM)R4W=XKkE6p?Y
zhk3fnS$1ceZMwMf^fj-iDbH^PDsNBkc>OGnBO>UxRyM<St7F}b(Lbki{$J(6bKu*=
zmv375Zaw|>&3138#qqT}%;i6;2FN~WieSlYO3j;d;^*N`(fbqbCT!qIXSrPW{=l1_
zX{nx5+e>D#``AvoI_1ehz8$+f9RqgGS+#~wrabxS&RL>U7E~|ek_hyet8%SF@4b$P
z(&L#73{Ps-x;{SQZWVFBMLnc!!!I@WY?X_v|Gbh~J@tN(hx^<xi5a@*_9g4o@mvuq
zUiI39TVrcfL7w-Q-}=H_>sFke!o29&P2EbN$D6l=*enPxncFl=$3a2ofd9=aD~o*d
zldd>ja$0!zsMx=2I&V@Q&lM6r_gs3u$+_hdH2n7*G59NT_}hy+LgllKziVyMS{8Kv
zcu-&5CYH#9Ve4|13N3o;mhKX!vt!QG&-<o4XP$9Tf-Tr5qi2cM!IJdX3SoV{rAhmy
zoeoKRF2J_S;+ow;v-s<mIGLurew!~kHF-|z*HXi4;&IH&xwUjW#3f@zKCCbGXL#fO
zOMl`2KW+b}2K!X7*f{KY`u4}=SC<V9rFhZ>B4667ByyXTn#_o4o6=JLATl873720@
zbaI{1?`?cB6&?}GenxP~P2eeO)>@&zQD(k?=>dal8;;k{Px3#1X%!pe2j4rJKHSjV
z5*pd{Vy?5XMRqC2n$smFGo<HnebUrk{>kU~)JL@vUCHa%gj}a5&oT74smx=)<M9?N
zj}x1UUYjX*rCGjw-JrxZ=aly9)0K=<q&h5*tqyvnCwq25dV}M7$#xe7MTSRG)`7P+
z`UhK??C6nQ`sde<K-b=!wY$Qa3pV;aXPkb_p&`(IL$u~(ZM7vb%b(6DTf1hX-<GaD
zcP`hs#K>vsTRf=ZpBKZ>Zt2=sbu=zw$<!xow|e3(-duR6ccs$SECY%C%d`aCw^XYH
zPpZ^Cmp1+845Nh)^b9B7`DJ^<`%2oJUg7Lraka_TtEV4cbBRl}<m)Dzf<!@%n?h@k
z-d%hB*T1ljmwF#Qzjw7v^XNj6+gDBBT@lyYeEUIUH2do-2fwyuTm3r2m-KK_?Iy)i
z>D61-dkJmbbA{_>TJ6_=w_;;`yHA(gx_a6602_b%lvir`X{+ZibKP)p?#UEihmeWY
z_e*a`wmV$hfAi&zhP0_6jvHOxZ8>$!_U@TznVjw2|3hac)*RL_WoX*>H|hP;hnt%x
zU!FVtcw>yUpXUj+4wf?C$l|b2?kfko^ZDi-V_dwlVY2Y9BA>z|!Fey$t}s89{FI+q
zyktx5oJk_C2W~2Mo43uDi@1>*7t4G;>VBGn=hCNdR_kxNm~Q-IQrPAd?VrR9q&xoY
z4cFHQfB&Ya>bm$2k&@N-KgL!3zAFBVbzyjx%`2{!=iX-wn_HPQ3mKokV$zCK4djok
zl(=15HCfqDYwGoew|=$lT`zaNlH+`><RI^}Z3V|-UcXa@9-_fFukCvAu*zVTJD2$h
z?ti=LW1lS6S?DtR|NjfyejfT(y7<ky=1!$vN#V@ac6)=Z54SRQ-+b}-;*LKY=3Ek9
zS6>}i!kV?MF<5BM#93?Ny003PX1oef&(T-0+QEQ&JENtCnQcB31A_-E1K!&ijS#mp
z)`q;#zHK1z_uc+S3i3IZ-Bc2Jq+TTWo)){dwzc)|0+Gcxo=5pi>rvVLx_<xUH%kho
zmhm5(c7Jd6_jgM;YxeK|XS!F^QmgxNY2&HRpaqeKj<-D*^%Kt#^G#SfTU>db7JK*2
zKX<3dy-y5QtZ`i}Dsp4t6<^<j4<=j>43Ua;o;G!DHgB3_$F7UV7{k4+-?fC9b+y@k
zzr^vC<<6nBj^w#ZSvKpQ|Gz-1Y@_|5XQBHo86w|)_TG56v1#7y{g!5SoKH0p51Z|O
zpTFtq^VwIYf8FkXnj?ev;q9;!wN2Xp3x9-bv@bLCI4_&_cbBN^&L`Kt?GkHVm$Jkt
z)~(V1qtrv8M*-KB-kEdjoK#%ca(dH|MLOpdPee|7v|C~R>GlOLKg#ee>G>!BqSEL0
zr9Yc;o7FsT&a*e@&$twB@Ko*eX1-q4F#RplEtw)#ZVK|SX*ru|k)~e2ta7?kHZAG=
z4*fj}oI6j?xprw0_tWJDe;Mv?Idt7<MRlWasCrLWqj$stNh_vbrj2Lse!VL+Z(`cX
zZBHte>OS4~CRaAmGa}jZnxXaStp}T|&)GDsGM!dAEzn@)tH+kS>eG!*&eW)xcjLD9
z@|`^kudo$u+U>rn@3dI%q-Dt`9l1_UIJD~t$4`Umn&z)FZzkw%?vqZR-@1BIMV;XM
z1^2!$nRsX7qN?ZH^E>9taIW5LY<0VKrNRCL_Pcj<mvmgdBmAQ?AVbu8MMZnvt3!$(
zkMe8jW<&~XUA^N|_;J=R+dD3uf1|Se;h{$t4gHdKW%2yF_I$1374@G^Jd0~yU)9Z-
zcyGcfi}p6_U3+wRn^oc`9(`HJ?Jw=DdC%`!eeIiP#YS)CQPZo`%Kbk;>D8S;dNszC
zUN^g`yp=GyaB$W%-8I?V+`k<)-8P=zIzva&v+Vl+I`x~Lk4=2!dur>dzQ4QcDg2|Z
z{%dxXa#4ub^3_aJg_k;PZt&+luRUkprbv^<rFn5Z6{}?CoO||u`IjFIuelydN3C6O
zfNyDD)-4{sN?F&X7fn+lZ|=I5Fs*TgbgoRn(k+kuGE&)jUh7OeYi9GmdDV?abuAB4
z<z*VyeA~I?MvkN6_pkS5r2Qp$1EDF}s>_8ld)vR-`nkIMWAyj0%d^*4T3~9B7o}Kk
zssH!*zxahRvyLg)Zl7^ATcfM!<l47O=kW$jp7^0ekk#&Jb_;ih^UCx>d7TX^%`HND
zr-iyV*)%GoJ9fQya*eTL@$FaNpq~1r-v4~^t?AFE=SrJ+o+|s(Sm`o(Uz4VJsp4zU
zVkxKUnaT}QwX|E0)ZUnrmR!bS?yxE5dZJ2M&+bFqlP2swlc}q_E1-_+a(}^U(S6e#
z?{d#sVU@UrE9MYW?*+yS>p9oFU-wSzL(i4!+mjwo-8SX-qV1(Es)@a-k?n7EuCsB!
zv-r%h>RQCJNVnOZq5J1w-czJGc~0k{=bd}^7R@>>;gzePzPnoG^^Tm2YMEBkWR^_e
z(Ol!rH-Ufiar21zGkKpGz1~syEpmre=kw<u1z*MbOP!R}T(!OKciWGX6F1a+@9Qgz
z*E)0lW}NwU?#$zb?>PUsXl&_{4cX&tU;1#uk4NlN#kS~l+zO5PIs389FK?HZ>19(c
z7bJdskfLsQ*MzP1_2+96uO`<hwgv9H`iafVBi|!+j>BQuyRp;S94D<m@#xEj*5kbk
zMe@~O@3$-a9E_1(um8K=Q^>@?;6@<5n&L{Ym)%sB%Hm0{nc(!QyT2NLdfkAOUe7#R
z9$Zz^P}=%|cWqceLVJ+8DQmNHoO@tq32$WBwsod6QWajgNwddjzTF`lbyGv?+Z}J^
zE5ZfbuNC`BrwN^bB;8~GIA%}(`-~xF>v{d7Y1~{@>;6Bx@k3?G;uh2B|NHizn-;%r
zdVKiy`Qm~Xqz;*{ov@x$@9*(<hy;5(OyudL=-aQYq)Swlr@mC;s_DAUAuiCq>)fNd
z%?BpQ2zl+$@zy!@Nup^EtL8rLPdjTkX36y@x}SRSzi;00E&6BmZ<}RInzHv3`!hk`
zUu?_nq*Pv8xbeuV)^A4c4BDY#T%Ef&Sn?i!!;sgIvUA;GpNbbR{cf^yo``+6Wtv#5
zhF$AR_Z?Tc?sqM?$Lba`*C2{jEwNE8ga5^KmTTqV<=ho+vs7+Rx<7T>l%I>tOIuVU
zdsPE}BU0>DP>MacWL5ujlUXsRRMHoHs7%UVH|LpATafgLlW*isTIoe^@toDC%C4#6
z%=LPb?UTcAKFVH8Pix+K#wu@4t=KxRM?WiT8h&k6?tRiHay5E?t@WQf9uab~7f-(P
zZvAO_`{mOzMOT?;^A7m8IIX_nc+~ofv3OsHeqBJO<LRaqu}7!ww>Y<Ozw?y3G<Hi~
zak1}wg+iBIlP_$y%kN!icTzk_;%T&QenRt?wvc0nCU-7gP0f^0`Prr8_dUAehJ@G0
zx=sIHC!5==UjE03TEadu4gY+VnStRcC;k?JIU>bw4Nc6yZ6@&dUA&`;yoRD#y7=8L
zi5Cr5KUyu03|Da5uE@(0Wp&d<BS=B>_RsIuL7P->el*CLVQ;}z`u*MB<GVkbR{kjZ
ze*8t;k_9?FVv-u_MT}`)by}6X8ZSzl$;C{bsTbc9kuOteJa3Qe!|VJhI~hM|N38W=
zi=MDc$6%(#gQE!(q+=(joYW4N^bk_&3X*o;5p=6ieaoh1$KqvgAD-Mh#c3_)_LNGC
zTjG-%jTv(E4nEfZc+>sNbYH=3TTi6zdGykF#hZW^*%p5S<joq_d`MXuA=||C^QT?w
zC1WQi%g9Yn=f^)g`DXghH<urMKK`=d!E(>|P$xO=nh*a=?sGjoFoo^IZ-LDj{cO#S
zT06IzZY<~BxWe6d9v{<!N30XRx3DF?&#0Z@*jLA;8Z*g7EX7Wx@w|xUf3Y9MKP5bD
zc|F^`-`BQZ2#(4AEFV2JVbKiPkIY5<YI)5Y&8p_*9E@=J>XJQcFN1dIByP^T8#uRJ
z`Z0Bfnu=$spw)@?y89F7DmGqG^~=sY$okPx@~?+oHtX7s>`%M%d7>9q<{g&3nb95b
zK6`dwV#V==1}oMYM71^@63RI(Z1dmIZK<o>a!H-5Y)0=aJ_~AGj(B$Z>!giAC*C`k
z-G5+_(&8<-)F)-0)={~@*MVA^C$}nU-gA&Wxh*CvVX=jsyLDBh*E@r?78Xx?rxZnB
z*eo((y5<k>>HnLYx}GlCpl8)tCu6@?>b>NKXRl_K-m%y%oF{zor0(8;NBL8K-J6zD
zR@}UM)jnaPovDwDKW=3d)4R^Gc1ot}#?BvNe`;DPzqOh4=w38BEOaCD)cPaQLHX`W
z%ik!idwA&3$!nb&>jIhgv0pwVk)!vsNn`J<?whuejCPD(Qj;cG$DEn=#$nO*0~s~f
z?xwRT{;8~v|59XKX}$37Ng=Jv*1rqBzsxp1SGHI?rcK*~JvdB%pF7umZ`HiRm$u5?
zc(Zde^A_74!RW^tmyHvwcx--mMRkP#c%Rk5V$GpAdGVZW8S3*TU-xJz|9UIEtL%<J
zc0j_8W|ij9t;cj<2p&2gvN>yM!1==R>j~A5_gwLf`|cWX?Oyt<;xB@&0qLtgd_TAN
z-<h?$-DiATFlm!%<-QdDtE+xa?5?rx`F-O9*T?Q@qP;VlYj>>TyRuVezpv07-Km9>
zStEPrZJ2e@z*<GqY~m^FM;8ibO;i0kxxVMM^m_02+wS-D|6WjcpSzCdr@vh0ed)LF
z*PLGV@+@!fe82Ei=1RLMwaHoAGS1q1t^Oe;Csn#ul~?GUY#PID#nu<E0)Aw9totDN
zGWKZg!T-MRQaAo@zLN6I|A^d@MHlv?^%DfQx+d2#Gcdg5z+Wm@B9#gukWyhCtW;n>
z+5j#Ub}ayx3QDHnQXwNqLGw7MRG6fCGk4>n6?Qj_YQMkRyZiWV6@K}=|FZYHd8V{}
zjO9Dk>C`ZD;(hOVxrsGr)h?>eeEsQY$JuKWU!VMPRl+{+L=pEB{S8qQWxgqt?mV3G
zsNwyh6$VxAm$s~kNmcOeyfO8b#i6N}`m7gD?OpWD=k~X=d#5<%a%@kzDJNS7E)*0&
zg~DBTooT*;+qR!b+w|<F@QOXUUkqjTt>oVr;y5km=gY%NbN}z0v43~<|1vSbnk<%W
z>soA<?fYo|>p!Fr*xbAGb>AY5Q!3lH=~Z5y(!<U&DN=+%^gd&yZ^nWe=hug2xZX?&
zIJ7h~$5BjK=*O7}pYAVxFFL)y@k*9URSetz?;L9<Ma{0y32o{WE<3`1f_cUg?qj#k
zcuf^^a@xh7EO`6!+(qnaUu@QKdK&NLUVQvQzwfm#*XQk$d7YwH8s*Kcm*I2bhxw;C
z?H4;9^)MN&*lQ5Q>XOJQ^-Sf0eZ;0M5g$yNQ*Sw(lTEi{DwR0B?ba?wqp($<Ev4GL
zCDVPLJTbj=+;i1gi^)?&ZcX6%9pb*pcDm>d3(q!_zPB2x<uf*AyZ(whV|(MzJU%0b
zy1l#Rcl|l{N-}KHp<O>zJ{4}V>i#-4(%2+T*8H3u_x4`Rs*l_k?u$I<RX_RX6<4_P
z-3+6>iNaNFMV|i{CuO_J-uz@+;oYYFMAa-t=c182!}h0LEmwoqOD&y$^W}p*vim$<
zS+i}Pzi*eE5bwh3+vc^k&ed8ir@n5k-BEkJ>P}v1Yj$$)EP?XBkJ`6>cGfM-pR#Uo
z-sk0Vo3^b@yvdf&Y|FfCal((30%NO=o0gxSODP?lsFYH5<&Nmvr^d;11yg<O>z8?!
zdzvpeP{5wa_d2Wj_aWt$(7QUSnpc9)t4?Rx+jeZNY<R!%8q@mB%!3<mYP47dx4w_=
z|HZ!jom}FsX0KE0PIjwSuef%0QGcy%Pxb8&Tp!D2wPzWyw;P<7yRuWJo-^2F_o<yH
zo7cGc-zd6aV68Os%oeRl2lW<3Mh4Zh_7@&L_WDx!?e`0gI|tNDu-Lc#nd)xE^X``Z
zwWpikyy{Y09h`4I;kloj*|N0mwL9H2MeiSQUc4^bv$@5)LDIoGMIe4ltG?S4rud2X
zT#ZEjBp2=1`=;*U`~1Iqj<#s)KX%kg-6BVL(Ntyz1`+&~x)D-0e`{zws8X-LzFc7v
zyI05An{kbc*o+cN@91S*6YaQ|=fT`K&Cg75mWaox!hL`Hrlfe5S+9{;#vZ-!eO>*#
zzUkgY|6e{k|8edKhe(P0&lb$lV3}e0bL*3vV#kclI`vLEP1kqJ+17VP?Q;0zn<-|h
zt92*bKbYlObffvoQ@+Wa%=@|*9eN?_d3jOM)J7B4r0}fA9O2OZ{w(9%+veYcxV9?Z
znG{-Ga>JAD9K(jCEdBcrmCJ98F;&UQ54@CecC&gwrS}(0nSE>dC$3V^-uCPDWuw?X
z+hS^V{QXfUhseHP>%Y{Co@&(OeUL6)d|TEvaEfPM?t(dIrA}2SD9m(c4EQKJA=~M@
z;*@LcmLd_F3tPM|-)PctQ+Y9S@e_Nmcx^rTrWMBpUuH`FxhLEbC>^j;gzs6(+O00f
z%44EDvd;h87|N;UcVnWt0pA1bDX+h&zWfxZwmE2N>x2pK4n|CQIM=r@2A-vZn-<QW
zz2@cXIK`qR=VD$3Y-1HaHF3g6{U?jVE}T4G#+DLLow$Xo<B-stwUZtGE2L&lM9R{&
z&@63q^`}gFHzZ3-Jx#uRHEoWk7gw%F+tSs_H|L$^%9*3$EP1?W$|P%_n_Jatb;aaz
z3f<Wy751NhC#_mP!PZ$#b4|CulDt}f`o?)PO?{KE6+V8mx#0E;zxx;R9sV!2w4Xgm
zXWhDj?klZom(6pW&Ijn76j#_8c4eaO{pR_X3U2Q?>ej6q^^D`ewiv<sPLI7)r_`k_
z@BRGvgKwbyg&BXpTs`l+P_ZQcw{v{_vw7SLi~i=k&$ruRoVR_~A>Pey{vEsPKAyex
zbJ?^VNnY1IxBm?0kGx%$0L#<{A5K0<D-rly{Peu3OP8+ei7zj9D#J4M{<@`}<(`G|
z4G;M)$y~e27T)2`5xw_je9(&J_ol=M%`ug^Q}yUoSsU*QeO=u@c}~h#W@^>kueefv
zXP0%$OFk{l-Ael5Z}vr*{})a=-(L7$I#%)DwqRG`XAcB^-E6kn{#ZY;>+rgwyiW<M
zKMHS?5j)f8p=P|cD`i7>M%c6~@duOdZ1}M2%hhkzFCGfqk!L%|ulWC>vMgKqTlLqU
zD$7b;Cm+9jGf&~XdS%3nDBWq#_|}HjFn{mey-tN!NRKg%;kaV+k438cBqnm#xK@gv
zyzrrZ^Y7Zt|C_Ite9S+yE$rfp`>45k^1MyfFWndz4z@5dC^0ZF<fazq=OvY9=A`ID
zt6}|$<ouLWC`YfL@@?(gvfFN(9{jgqbvw6LA-QXkth)JP$@6a0GTMbBFHL;Xvv(68
zzekhMF@=MS4&G9-b2p#gq`&e1_rPzS+g9z8e&Jse@ac?7d4W(Q)2`JJuxj=Eisi?D
zzc=S!<hkR-p|cN7VxC;o;kqoFUoPph?$Fuif8Va3S5bZPlUc9c`l9zgzik$ueSZ6V
z`_JdrIla%Fp~{^vRmb-@#j^cWoE+Qd_4{TmJ$XmEH*Iyz)V9SF#m`RnoK<}=Y2p({
zIo0krtJnY7eKX7O<Ybj|Rrj()eXHY`_N$&Y;QgfXwlY(L>)H0x8HF!dXO<t6e!;!t
zal$9f7$4(*yK44#JzDv%sL$f~#Tym!>eC;^PKY}eIIY{i`ecpd(ZpS|<HT|~3>NWB
ze023yQGqe%^czRzszd+iYN>q*S9>LUalU=~c87^G%dgr0F0he!``6^g@5+iFY0tI!
z<>Dq*DX-dl$o?F|d4uVveJqyE?AsNi5%nZ-myh!g%`V>4;qkSmHh1J@=2hz3{!e~a
z|F!OYMtwuX-n+JK<>mj5-2eDTCvxfJf=NDy|1GiqSj`e&_lKdI_2m<-UouRNxvpw#
zE1nAd-#%^c&dflGICK3!Uot-*Dqj5g<d5~&{+;h##30Ijn=xLpVf~t;Yiu`*Zw)#V
zcO^sCJF44_yZFyq*3GXore(X{wDx}ZQrAaS=Zs{<t@+JAZu<Os)4bFzNt^e{+=KVS
zN=!nUa`K+u@{!-xy7-CBndS)X)Au5|;*ZUYn-(|I_5FS;8J=(c?$z)8&iCEx^SdX@
z<Cl3$S8A~ugX|l*eU^7>SNq+u-P|-oulhLqd%utM-hz*cG>X5xI&a1?XMJTOmj!G1
zoPVi5e&sxQ&H8S?m6ct!pAmbV;+E-!0=f%MC2r!-U2@kg<9660>-{!|_0Q+T&wD)m
z`8NIgkEZ9}U6U$%I^5lzeU14K>9XfKv8@4r4l}HHyqE70&wneMPl-F)+U?)(vy$jx
zdw-s-efi<V&SoF}vUvUa+fc`}@a6rUy(yO;&*OX<&!(QbHvN9Ca;nw8>J-uUH_K}m
zw0!?tcKwk4zs=%V55+@%?0)~Yb$=*#{b{cHbp1aux_{<~)+OrmRGes?|2010VZLnZ
z_N|9le(v1+VOvziY|*+j-9NwcpKjX!zP{V_ZOd;*#^212wI7?ezWB~{<vr)C?*E&_
z{(jpT^X2xxVx27cp8WYMUFRoWe7`I0<nQ(SX0;jXM?4KM;8*|of^Bt=UGpXeE|2A}
zbN_K(?Z0ZocYd=>h<<>u-VCNm%ePyz9(lUtdFoG-$fsZOXDmCA?<D<7zWLQQiPVES
zZ|3~I!n9KN#G2WAH2*g(6rYs#WG`D|?TjbuCtppn^0=&`JKL*SgWJ?})#LZ7+83G~
zCVz==w|P~4-@5NGLzjCuPfNiY*9H5|?zx@vG}is*)amN?xb{6;u+=E4aOuYP#yJb#
z6kTHH&6uk9;`jTws@tY3&iuLCDz0=c&S>VEOD1!wu7_Wc?~{DB`pS*I^5Y(*=c6Al
zVK~J&)q3Ck|Jg#iR+?)jD6aCEd*#2y-)G75>uQ+oYaKu5{WtOrJAJNf`+VKU9Iu?%
zck#Rs&bL_1$MvH7Y7LLoJrhpjMb|?=NNN<!WvH5*A$R1SP}Et+`)X(N4P9p?KHRr}
zBU^aOsjE#}pZvX89Vg_v<?~tZ8G$~BS%PZV*2?aBs%f-R{^>)T*CnS<G06S?Cz-HM
zWI~z9zSQQ2hIg-?<Cae_eDe6@@wwZ?<E9*JP>*Bk5lYw}@qhDGp{;i(u>D=_DU%|(
z@qVOKTQh5+<<?f=RFf{TKs%|@O$PHWJ~{Apxr;#j_sv%;q?X>~^O^HEW76iz#SVKM
z5^L69JLQ?XJc@n8X^Z8Om!_LkttqKfG_aAo|7Ka{f#nIwcRC)pN;91hxX1N@DaK%K
z-v*P$=1TtkNqft=7c2=9oN2K4MdgCBhiUoj|BvK0<sW2hH(zWR>2t`>Wov3gZ0Q>B
zDZdX2xty4?YD$sLk=9Mi+IZ$|KVjI)8T93wRjdD=)tp(~H?D8~pe8T3@XTS|4;sg0
z-|~H0zBD~#<@p0Y=Js>%KN7U=oo#DmV9mi!!G~)m9CLfgcWJdgM|Ma4PT!pq^MAy>
zU1|RL{i1)*72;aI--~5@xo`P{^yMk9*{a_8<)50nj{Q~ne}@ewVaEkaHdLQimg)GO
zGiSwFCM}-$7x6PK*Dh)M{_mQ(UEkzl4Gx|ETn#_-c|F#I&T;g<H&;Ua{cPR+eK*g#
zd2f1q@<mj~H0EaEsVYp4R|UTPyJT`S$mHbiDn%vkQvnLR(=Mq<?a|!TQorF}%}h)4
z&-Qxny3*d8{&Td9IcYclQ1m&QITK4fuL~zs#VuqvePGhS{r=%{XO^IB+guJFyQTL3
zws{p@IP*btb(l7LsM-IwA9qT4&otU)qOh&8-n%2D%F80>j^V|v54Ep2_N58r%wk`?
zKIDW`K+B%x_H}=c+vongTQ|jbF;D6CIs8-Fxdi@|?c+VI^WkJ$KI>ZEDc2SpI(zo|
zU-f%8MORp@G5aG_k$mCBy2BcCzwIfs;0$2i*Y=-j%N4bpsH)@Z?^Oq9u&>fl3Am83
zh2fQ|rpCH^99LFMjGXS%`ME%f^#i-SZie|ep(nblZkaFR%v4>jxYAqv$mh!CtEUA`
z70+zzdU<zp%RSd#r_UM2_m)^p@3Z*6vp~lxvWPc<>8t7!>ko64gI8&&&HQzNUngsE
z?<!SMTlS|HuN5D<BhVMczUIW_drh({!eUo^7Ay5PxnX+rh)U!EHqWRjmKtkLw`h6>
zZ&sSG9pN|M-oirFa9z_G&z{0bN35$#o4L5$KQ=zP!1Ye!=Y_NKLYWn|GwW9$+y0<W
zf64xPw#)u$88%$9FXmCcXZLW?qP5wp%?^m>EERqKIr5sI@b2uD%CB~Q&6j?wbtNTX
zUiF<HH%&g-OGs7T48L9U>%g+NXC+faOCBBh+b-y-#B=I~zQ2UK@Eiu;o16ODwygOx
zyTiBR#i6X3i^4>2Mn97Oed<+)_JWn?KONTbQrC`Xd!`sEXZ_FSl+l)33td-U+;_7x
zRrbsCy6@V%@8s@o-8Y@}hfnL*Aj70r47ILiGh{<fX-R+mUVWi8{7lm=!FS*7>MuS`
z+u~|)+?Lar`8VI?sQ${Ag@VcJJ}6A%O%k{DFACRQsxtp;>mJEy-NRchzZG9AV8Yt7
z?SbCqC+jl=;$4F`GINX1Uu+WjU`o@<scn}P_<t2{*dY_^wDQfJ_Bxi;7T@)MW$x%<
zp7HOWn$*s}?|z>9EH0kK+~Qcb+a+txS9M3WYL1Bh3oBmd=tMq?<g5P@xKvqB?x55i
z%|onKb&OjL7^H2PWV78GdG<t4f0!iVTbf!e#}K?Iv@%5KK%7y>W4BZe)0{oqN-lQt
zlvaG5>UPxT%%`Y|5RO*Gci~c^d41VZo4)&cnYuPk&FemF;_}oW#wYLf?-@EXbtE3j
zt-sU$;^_jj?wyjVt7~?iGVXpT6)U{R)XY8gnyb9c8;Q;TLMJgQ>xaMEw{r!*km7;+
z`|2M?oBiLzYwz(qz#(@&3un3Lhn<sq{zv@^x^qr9Gu}F;pq-J+{Ko2Kif`kZPO7k^
z*1oFkV=7tXqA9ANIBnsCQ;tgx|GwhPlV=;S($OyI<W3fux4+^xd<g4)k*|G2&j0tl
z=ov>|B+NWeC2&8fHCo4wp({!5giilY)(B1)?y}dxoMl^HEN*7EjjGwe(Cm69;GqIX
z>X(XwcyZ%KedTvzJNq8p*zI@8|BCz%y~cX;l=++~Wm97&Yj-j{3X{9_;74NU5{Wv$
z2}+Uot#?PI@)X{3P8Et-p!Q27b3c0%+jaXjCmR*l-C&!vGhdMR2k(xk$8IJiEISKc
zw{)kJR$gV^@FV}eG=p-{kLVWr2?;W~5}YT@4z{gS+3)mp)BQ{f?%)}ziV7wNZ`Hn^
zx?xew#lHRLb@V<PL?rxYTz(*#QHsT}X?Af-VZh3XuUj6^;4Jy1!k?6~O0sIJMbY8f
zcgIefd{U@!*r3w4%UMSExOs%jje1eT1Lb`lC8ya8=j;Ex6g$Pqb}|3^)0~yEPs1ga
zZ-4RO(S{$fhr7fUeHUT-xpe=j^x5`5VtZ~R{|?!nw{h#!zwch>-<!Ml-^1DK>(g^0
zLhgjVE!wR!E9GcZ%z}`z;B6Bp%+blo=sGzen(09-`(eS~KOVa-zx{UoG@rE_^uLGv
zKdv-wqx|yK7g?A!tUo_c>;5OV&qb(Q)S6ei_C>JPv5vSY&otGNW_nLp?fG}FXa;NX
zw>%E-17}-rvNvcP(|@h+m|^(dh}r)a%jf8_U3>MH_IWUg7tCOv@APGInMh5~F#!`t
z$-*ZU?hm$qVB0by@Y74xw(})lFFtx2Vtk`TLv_U&v90=EIo!3W_x`jCGfs1h;XKMC
zk@)3#2d8>3TO0GP<E=ORByTjvy<Pmpr2X%?r7JjnwWKV!KNngp-BNXE`rXwE$wFqG
zkDo|QXFkC9|760hGosmM;mMh~3NqUb<~%9lz8C*b;$Fve_bV53iYG4ltZ;AF&xgM+
ze%IetVDxP=lT`cCRr*f;YKJ-}ZQ8a@Ysu0UllGX4dqNH~EKc=by7V1OQui_Mf8O=W
z7ECb|-t<7G>kmi%r>3dL9Nm)7%zjmNe!ISk)w@Z$7jG}<%c*!=&}PNS=VWj)e8)2Z
zR@;`=ZGS5#9OkO}^6I?0yL-ASfB%20MM5w96Q}Hd%(CaXa$)#{S9P!ZI!f~87w>ku
z-rRI!_wTw#uVr+lbRwmu?iQJ$DibK9`0AkYtYFhWXPRf9nAzZ?b^15YwnFPq?$3M#
zSTB5#yxes5m{p(Hd^e>gXGy1n4_tTfzNk6*l&NKZ`|F=Zy>^RFvHf6Don+#)Rj6d*
z>j}r7ZeUo-5yB|;Qde}zgJ}jczD;G5e0M15PSBcyrSXw%Ns$HJFQl_vB5ggtillu=
z=rsIiof5!)D$phQ{O>u6?R{!LdzBO-X7ng2m+)V^7i#g-CFFg8%T=ZR{M`$9TFt!|
zu)Xlx<9cC&erLjlI>tt`r#sar1g#8Z6F8apOZLCMMT*bFC1x2(cTN~4S(vq+^6fhB
z9>0Lmx@y8P`P!=-%3uE*PLycBm-@w$MOSRE`-0E)UrtXGk%_1Xn&B4k=KVvC@?A4G
z@!oQN+Y*(i{HAcD4ZmaWyhGlP#J=e{WUJl(zQD3O>9vtUanHu<Vryf41VV33vpHe^
zx;h~B<hGEo{nlk06xUXKPFQ&=xpw;x_xHPVPk-CYaA?>3`>z)0EOqmaxO^zE*7D9n
z_vx#rlquz&UM#zOQ(w*(&8*a~XBQk?<|><)m>DDYJ$AmcVw%*HIZHR>Jy6>!wQkjY
z)8h>j&0-He+rKF+Qy}vKOLV!kLDPh7OBt6Jc^o(2aU^t7WA5sUTV~z~aekb8d79Lz
zo$3P06F18kNv#wA#kTn2qU2R^TXw4?w&&OGzO}~WZAjbcpe@bY6C)0NuoS9Yu=$?R
z<?xn^KJzml>g;+M@g}>Bq4s8N%r95#f2%(TnRGu6e_yVzfBAz@f^n_u4e6S@8?=j$
zX$VaHaiZ*rS#*+71M4zLxwlqsUJ|c%pWPKwbWgct*`~Lqy9zgDUFV%**ngEb{C0N9
zV-ayv={2TdCpT^05@J=gJFI_h#<ut0=1rI=VO-EtwCSdS*rut6Jls?g<r5udFTA|2
z`@}Q#T{}1JDp$GBE&N>h%WARqX|Y;g7#_7J$3#niTXRLB!!k3nu7}U;$ck9|`wL#L
zjXZwiW`BG6k((*jXZSrgW^GQ<Ty;aaWC>q$*<Z_NW{ccnAMQG=T(W4<&9Wc!<5~-A
ztUMQ|-YYwm5)pduoQ>0dsl}H!O<$6|U5v}e^}O8fe%}e1*X@s;{e6^gVdVFo-lNJT
z>p0bPe|@X#Ke0vqz3gl2a^sC}+vIQUUbbV)t9eYkZ##Rd%r9o!?#a(qn6x%+Yqiv`
zj4JWpyNUzvw(N|0@=&BZ^3p}68JXH0VJUejD#<&PkJ;}zd6@P4|6t3PF;9Lz+k9yP
z_pP-d-&E(dgquc73dwfr?-ToRK-^N6Ew8}Zb!*+6n8n=zfh#U93J(dtJ$d1&<-fwa
z{kxx3CC)h9{b`xuHiJq_J~k1)WDVzYN$)$q8(Y3g%{Mg>xm?w??3m8nip)t*c3rpZ
zT%M?PV8wlv-%WuGyt~e*M!TKV-sbSRVa1AR6Tj{~|Fk^zNPgJc^od$Oqe~dnlJ|*~
zXFL&pZ~Dx4;eytbmm3f4((DP~KYXZFKfB8_e2WBo=eAn)im>qS??j%}yu0?gz+`Lf
zgg+Z5ALp5~+x&`3`D2Z36Z0c{&1>Acx39M7H<;%fk@<XzxW}Be=Pt}SeA4k9?<c9x
z4N`%vJ})HZK3c|={f6VP_d4Y-8XQ8&2RNG50?m^bYQNy*3=%w4I9JVp@5x$qv83Zi
zw4+(py$~pD@ZEi?v#;s>YR&HcsDFD{DjxP+*<^e5<E}@N%M(AWtlGd@zcKz?dCI~S
z4{{?;|M>ZA-VEikmehwu^Fqsoo);f_W*mR+)wALxYa{h}M>+~M0{o;DW?xa3HcD|k
zv7FI!TU1N7%-%<aIg=9`t8UD=m1yg|^X3U20Zqe-irdpfAIemxUNZ_ezWP0A>oQH%
z!lQw*->kEOzpvY-a(M4z(<iMpy{vCMUt07m>-ii0;s4eT>iJrAbv2*rGB+Dc3-oUM
ze8(?Lw0lEO=V!HpO*`jYyxy~7N?EV&zWFy_egADMS!$oGvcqeWSIPOmLNnrfrv!dh
zd6HdoyKDKmtaTsFYzw!>w1uw8>TQ+}v6D#tx`we`s@Nm%&zzd)Jkyxjue$#_I?;eL
z=3(2KMH~0t`W1ZZ;ng*=X`AmwS?t)eB=l|cD;tL;H|HMjy&>bh{`{-3h@Q+h#k(w-
z&DnB=j+QuwPju3pYuh5AwWPG*s_eC`&L>V;eUHx(%-GoWaOd>Uf|bo82}jd4Jyv-*
zXNFGe;)*$FCVcOvsMzbyMAn1FAETM?x+sM%oFUSn)0}inI)s;H^YW;l$Db4l&W&=}
zW4`u4@&VmHD_3j1TC=Htb7zI{-9t8ib9?9KRx$0FymYb;*PXWe>Yp>WTg>=s*|Bxu
z1NU63oyn^Mn~I*US|QWDE7obT;3h`H$TLz!j~;ANzb73S6~X4pBKfjR!P(*4@u!mP
zKYiSeCGj%%8&ykMN_pAzIJ5N?iKd%gyE@1FLCKNK+Y&Jv2PS=a#O8aUAZx0HRP(1<
zO}_U#c4cUm=3Jk%X}LtO%}q&dZl8-iFY5eXPC4o3HGS&i@BVwPAO4=to>K7W`Q~5z
z^FO@xh)HeueN`x8UduGG8Gm=KlPxZ*V=5}E$h7uS`q-9~8q|`1w5jOdN!`gFcY2!&
z(~cPiGqK;36x*`T!Ecjf?Bt6xRD(lK6<=GtSbk!v0&g{s`^FBVXO0&{_@|Xu?~yEC
z(B-#A^6s3HY>ix*@)A$8e=`I3IIPxK%WXIFQP-O-ysliY+-@`;T^Y=9?Q*cj2Uf!=
zjn~8WZn`+@QmD|JuVIx}6Iv6tE)mbW8rJ<WXF=C=QyuP!oLARMT3%DIx|}kX>vDnS
zwHY-n_vV!_T5;?#^?EG)P_s34zO2B(;x(sJWu|rfOgV5&$k?YMt6AaJ(Zzq(qy*m1
z<=-~>Va>HW&tiN%q*YF@yDoJ%YUlH<S1V*#n_h{|p1W$Ybj_U<(QUtEW+Y!pS$V$P
z=@RF{M-%!Ew=+xBX#GlG+Fku)?&{^Y|71IE<D3?jnRWEqzDd#DVQbT~v(0ZDykoF_
zU1z=Z9o?{vMw515;xgMO`LRgM(A}_e&GTzcZ*_!&qWd%E8W!fHeco_nW4PccoqqyB
zGcL?h%yqdEzVOW&)2?TycO)y_GU<z7wVuykc*^NhPCO~RcjW)eEdOgI=T%%hDYQ~#
zZc~WZ^qDt%Lf707)kqD{%?kfol$+~uZReV^5>ZiWZJ%qMXtMFYIOB2g@22}#+BQ#{
zK3#V!bIF!RmiBcCR}6jp_bghF_qW5af%Vosjo`h_YQp~JZ`Rd6Z;<9Ndl-<+JY@>s
zOD?{@MgQ_<=E}NWONgzxmK>kn9I6vza=oedW1+VFwl^{FBkoLfpPkgtw7KTJ=F%pQ
zFR|D5N2N4eoG`on*6zQlaz!FP-+q{|GwIdxhcekVpIkBz=o_U@i#(p9&AP>3XR-d=
zw0#$tmQ0&|+i~Bc^=xtiGlfLI`gBPwm({ja40_o9BEx7-+O3&idt@$`Jc+n9SLx+a
z@9QaEQ~6G%btKGnkT2@HmG4@lSF11BI%}#&srru7k>A}_SNG<-+l0qf=G|JiEz|nJ
zGCvvhSzUimZqwEHloqq%%u4lZIsp@nt!B(Haa_3RZBoP2&##4+o_)_`m)($hy!h_%
zr8fWG9X$Br>h6aJ_kI4S_f+$N___DXbmzvKXuIh~Y&so#Kq%w!!R4aL_t!33>190c
z%6iF*e)nYi&ao{|pVoae$N#27^{T0*r+w=9m!zCmRMLx@;Jrj4$7B7$*#{p!Nco;~
zp(!EF?a;NmdA>$7S@MeKo3gjWPV?0=b``5F_560}y>Ek0w@q}L$<Ky<z2$Q+d#wz8
z-I1*M_?OWatK8yS0S&Jsu6Mp&>7Da<are7S<BPG~&bg1XZ_3Q7R)6XkJ|XySQP}kP
ztv;tVq}4=dule0?X7^*q-ZPIbx*KNiw0^!yDqiwbr$&E@+U#ST(bEI(G#m^4_v&PT
zrxkC~b<2a=$7XeMY|U!@q2?G=F~NJ`GL}t(C+0Odp1&M+ZP7vXdzx`~wa>^ujy@xL
zvbg%8;@XVDNUh~1Z*QJh^>9PJ>}ToNnID4g9QA1ui#zPMZ1dXF*^iRLrEiHnH!5Gg
z=&1XXFzf5*G*5U7)z;_zjN^Lt=g)1gi*x4h-?2gIn*KWekBfWq?wSZE|M;~-I`sIl
zk4_@`b^b5i&d>g-B5A7{b$RguZk08vs>hGXJ`KHnAwWXkoiX;P#-{V-vle=^hZ!H~
zW|$FF>T}P3=8k76$)(;G9;*iUTK!x7u*+zH?xs&Ke%dk~axtHO?KE55&X#%pH#J_f
z$GvWsJkE5%aIMj_O{Yy}u2cKDaCKMVfyocc_VFq?HVA)xvpZI^)@yg|JLj4;`?>!A
zc(W_&#fsFMv2lL$cWqWH=?i`4J;i8I$>+eORypYmO*e#X9VQl<@7A~Oee02~w`$i@
zv3%E6bHcu+>pX1tkck$xVaV|I7H`a6v{Coe2Dynb9|~hUSA>62p2oZ2kr*E@;~CS`
z>lIQJ%W^vGyRx-bKYb(hJk;c`%n`3$wkKt>r|3Cn>wF7&{ldeg#OHaa%<XeauCZ4|
zRz2SKYkO9kcIUgYO<U6@$E}{@JZHjQCSUJ}IiU_0K75r(Ij!>h(macAvEIwq%bepi
z(vS9C_v>D~Q(;QgI|jC>H==iMbbDQRB)n`(fAi@z?|C(!s-)(-|2VC1cJWCqzDqx@
zF=h!pPE7Dhng8MTn~Jp1wy73EJ?^(}oP1d#_vHVoIHy|wZyj}qx?aZb;yXJt_Hk5>
zy4sG%%7%X|&p9YP70@p|=#u#NXWnap_HQ!HGC$ux<5?SStfgM4Bv!edCn8_ed{rpN
zyyvq-R`v_Wt8@JSxahEY<_fv_3+C>c`Dpo#y7i)}edmSyBQJM_uxY$sVX7DP<6H0v
zvHqv4{T@B}^i7cITm9Aa+?Kgndw(WgI#Cw1Tz&hc$K~hMN?xzIIU!`r*OE=wuZldH
zCG2>2t6JpjWQqOTG~1+at(tbmckN!=(`?&$F0SXP*&bcMZIEhH?<!Hl%d_uF;tl)t
z7mv<0_@{dzU~Tpnv1`>~Qac~Kzqm<5``&A=s36OWGSR;Gf|5?&zgacwh3To22L+yW
z^X%Uu5iD5SHO+gEZ2Ga*=kGt7Jx!RC;2?gw(O>d-^@@O1nNI5;`bwQ!_~eSW*qcqV
z^A2x`Pt{6{^uB%D>js1IQBT9^9Wf$(!qa|~_7)0C?OTzzSx!{`ZnMjlOKzIn#al$u
zuNK{8oAays)auD6CM$%RC^g=&w)$sa^)K^#iGh`^wWOT#rgnF$wrSf$H%A*Ds66yp
zA}yu#$z!fd=C?n7`!VrJ?2pr>!9O^{?2UIMH7WZzh-^8fbu@PG)29y74R@Ysz5VmA
zQhaiB{)x)#5z70X8>en*xjgj<PwJmpxixnxKJ8vxxaG#Fb#`?zcN`a1|M>p+nA=ju
z2}1nqPhWYOnSYhfLw)JnoU>v(Wc`aiY2NNUl<xG8H#t#Q*GqVn!=ZZ$6DRU#SZ=xJ
z{rFF1rNW&pk;-W|R(ho_(Rey9bjGZkixh8UaqaP&{*cA-!2MdIhG`PtHCgt~zxn3b
zj|X4H_T)UY`dr8Ur$joX`2JS+{|xdklP0y!pPm_eC`V|)fz(ynyc@ReTdTd)e71{y
z$+Oqz{yj+faXO*?OI3w|#9My<UD5I7ZSBY3pSv+T+~EA~znRWa4~q)hu6usf;bb~h
zxHW*|vH4B0`!5p;_;jxw<y+{W&1m|x`=H6GW<%xU+j527v=W%_ENKd2=GB~Ivcw?U
z<x5!Br8WPK-1gsdc(L)k=e%K$QybFac(O$tuT5#pZ8D$r;ID%5MC12&FZ3{0D!r3;
zF<8L6@zj*lJw~q?UpmU3b%<R0JAThqA+fKn6_cYC9?F(%*!E>_iPRG7=;-zFw$=aM
z9PNJle&1%%Wqykc)-U@n+&?|gKdz@)=TOVsoPWI=d<sK+_H1R;o_*EK<X2a#s}B46
zc~^Sp3pB337!k&!=D3;D@6O@G_fK3mK7QvA$ZS&T`lH2MahH}Z%a*Q{)8oT@PG)>c
zwyjyvaAv7do~)_krs@BVU0+_kpleQV-@Un_!r9f%Czw|{Sbj8{;Vz`!UvhE&pB=rI
zvJ+xox@3J4*;{9@Bx;rIj#jT#_7b}!OdIYChX1tu)wC&WPG8B?kH0wA6!bSr%+)>-
zH}7}6{M^4L787^bR@H9!{p`y2H8p062SqvaCSG{jn_$;{X62nu5#5<p6Jiaw#x32@
z*1yYhhlTZ#?Z?bc*NSaWXH1PX(=WUbc6U=#Xlcy)y2d+&lMbcbm|mpY{)Vl%<=p3!
zoBhlfz4do)dTO5?#B6@M@`sw=F-My_>DQgI>K+(94Na~%d{pP7Vd$#n?k(Ed|70I8
z2+I(Dtnk2drcl=0AAT7ZedY#+J09cpsxt1|*L6IzMWp|5-cobrcJDRff(v8PE@^2g
z@ooB(ZsYlF*PVkuu4_thUMiA_ZhZ2LPxsSeQI0RK1v)NA@5wKItsu4Bv1+&K(|<AY
z7MnfiFID{dwd8;L9*dCX5BK%%9d0_bxTRX-UDWKmmYXfI<t@J`&b`ttWx2n$P{Y&f
zZT__jd299Zx0-f;+BZYGF^gI2`0i8twN9;371fz~cy_9c@1mGVY^;J(j0Y6uK15#?
z>=iFt9Z)-^mvx(QO`y#ktN!gD9xmNxFri!L$@Y8c;U~GwQX&gZw>8HHb(`Oi&NTO`
zsCmBs!R`7L$7NPt*39|%>2=1V6BqLi&O5!OE9GXIY-q?u!8H?IqaHrKw|T9zr}@7!
zyPTH)FE8$%ytnbifvA5+>YFaldw#`eZ-&y%uwHgwo8CQzVgctq2+#KKdz{kA?znvW
zyQz<t#`^7SV(Jw!oo-Vi^JIIsT^q;umzI+mu5e_#uQlm$mpPdv*jC=5%c^lzSFf+m
z#zXUR_V&s9%{Y8nHmr?X>v2K5pi*JQtu;Z(jSc>;8QgaNI|>d4KbhVT&%`u)*P;La
z`aAYazPg~!;M}B&)@bi1*VSeP_*$$=K5(t;Td}U~+u#P9Jdv2S-!i#H*Gv*-+Pn3L
zYjeSFF{dx5U7ua$)LXpDH7oLH(P4-ERv%MCR!xa@dl_{w^-6}$)_+ff*4kWa)!Hho
zS#u|M&RT8$dq*N0c0HTDRO5Z8tK*tk9f@yUc&^XyaJyResyT3Pk(}gGZF3g4m#ZvQ
zv^?GXO`|;b&RVXuE?L&wN?wbTf&WUdw)G*GBJVjJ7NWPrBQ~o{^-`SSI4AV#-9F{H
zCmyKHS#u&j|FjxY!zP(t2c@j!Tl3i`uRhE2WWtK)yCbU7avJ7(`ueSJ64@S@(zn{>
zh|&K)FSG3SzxB^|yb!r#CzJGSfz>&u6!|KJ{~fDOk>2-R{wlM|N9Wf!GuLO&oVQ2Z
zH_Q6@?7bEr#Pgerqb7STJNPiCq^4-g|Gf8aM4T<2u)a5!l=!DVnd{P|YX@@cOr<o$
zKZm8CoAZ16vWFk0PQD~|FHrbu+;*m0ug&MC=W*1i=JXiOpWS<U`sCu>nN!ucS5#=(
z9OIMTQzZ6~d*1XFDFUbUp2yE|luAA$dE`p-#jIKCImzqdSOa)J%s=jE%I<377c{M#
zeYuQ|Q`8sf4DJ)L*=l^Bj)ohht0qsopzW~znSc7%Wp7@x9M~BgusTuq+~Qp8*H2v1
zdzbax2<VymQlUC(_PGl^MhOjCJNVwLk$m`g$Na=S*WNApbnetV2CkBlXQ2||nj2l0
zhPyURz4fZ)g5KSW|IAL<F|K%iKJL%;ZuxzG{~fK*%x3RnQSB&n+c4`vy3L90D{|Jk
z@9z^3Z`^-u_ck5bw??TmOuWOp7rWN{w(|UbICajQMX^sUPJT+A)gU+9F#FcFY`d6c
zC$nx&`oFSo;;DJ-xpu5tJO5c+!@5&n^3A?kd}p$$yKQq%m%T82>T`Wj@l#=<k0L9z
zPJ0|$yXcBdhge==h+^eNCBaUaQdSA>l+_0+n?q~YetE*BY;w3Y*6RjCmsFj9>jQ?E
zYa#B=Tn<Of_4cH&r&@Xi?A*h;!}D;`i-^@<!fS0)En<`Ixha)S{j1!2bAFAg`fWRJ
z6UXnmpI2XRKEr)OMPvQK@8>>rJSr`?efY3Yg|cyX-th$-m!3^1+feBftdOEJS5}-+
z(%}A{!WX{6XR;1X+85~1>QZ$vEzCo$tR(2{*@<m7-;#D6Qt&G)n>5Ys>w&8F_~i3E
zoEd&PpG`VWzl&v@@}tt$ILUuq?&d2V^QC?HR{DJvDP*3m*2T8cGk2ZGFX{5{(slDy
zWfgCI3tm?KJNm=V$nQ0uZ?;Y>yT`Vn<IU|IhvR$C6nu;7l{N6+bN8jlw9nBIk3UVw
zi%Dn`_+jg5I6aQt*Z*>X&|<~Os@0Ol^>fQvrBeHy>VzV^Y*VgT{E<0!FSMjm^}hAV
zD5*Ov#TS&z_B=dv+helI{TG3UB!1O$AILLExRLOY@BjJr!f)%?QzBK^vkYuCn>U`^
z686+B<ZXI@>G=zhzRg!uk1qSOs^`Wx)>lrK#JqkfgdhG~m0}*6a4~jH#L{SoiE*}H
z=LHtlExvksdeHosQ&SJk-nC7CSN*+<CtH?rfAmXYo7ODV;PENW`uF;EEJ3k~k8kVs
zzq+-+p-@NEYo?pf!WDtK{4ouxnF$W7*6S{DoW1VKI;Ts&u1&gk>(mOyBHgJ`8{I;t
zzY4j0mp5kGVYMymwxlFkT?x=y5_zY7b~sa1M$q=`BDFWg{7nfDru77#Km2-^)3x%b
zX}?A0wQs*x8~OO$rk8Su;)7OK-)Qu<S?{<i$8A$>#%!H?q5ngIxJ;)s)}Q=&aOv*f
z&seq752(egt9}1>|NpQ1Z7W<ObGA;C$vdg_fhVBaJ?3Olk*{7sCs%glv^Q5w4}=Nd
z(YQBb_mWw>5o=b-c3#YJ`2Y4<uzdM974DC-e)Vs9c3AbuhgmUK6OwoDK5(RS!?{K|
zeY1PJ1edPewJ_&Fs>HXqdtw${oFX8)YIzg$8WZLc3q9?KuM0z1Tjp^%a2{VMyu4Dk
zE$PDS$*YRyTx|24C1f1ORUWeAMDXp%*drU>B%hnKNxc1U=;E}=vnRx?IsDyF>B9bb
ztG$9}?P@sPdE%Dd-QH<$zfOO1OZ3aV-~0c!PdD0_wex~$^pjU9RoRvQj!2*L`YopV
z<r9<LuAJHOPiL$W?KU_aDy5gmFS01*X_;o&tsW8fl!WPL@-8n(U6|$F^Uy1LUxfdP
zik<QA=e=L>aA}tNS<ht#@*DT&7VG|E-~CGOcHop$?`sd{uUYGK@~PD61#JaSXE_(M
z&N}GY{%@<(VdE+9?kRpez4Fz)X(4hSTh%o9<)oh#1)Na%bcXlJ%6DN3I%~?mo%4Fq
z{7&J(sfD>KMYhPCKc?kdTzYKXsR+Y$it7$~?s^wgzAELfu<Dd)9hZEQXQf-+KD|73
z=HtliU9%4zzV-6jaqnAlpEvM3e10sO>#lk*(DO>*O71oJvLW})7R06JJU_eiZ1U^<
z3d!vrhc+ZB=B}HtesNFtE*t9w0mWWVea+9^Dlt3jl5Mr{;+lPJa_cJ?xFu}!AG6dQ
zS3dYj=FW>*XKm+6r7_=h;oN+6a!Af0xzj(chGu;aQi|sO`QnR6@+bF|{vjQj&+~R$
z*BV)Ic+8O6H`zXeNBpG85teB@4ELrs_nkVa)w=(a;OvUNAF|&HkCbox!+(aqeUjUO
zXT{eO4?f<ibyk0m53@A8c0{rCg2R^jufC<sxiU*@qE6}B7h8;9MZ7-2CN)*UH>*42
zPSKWGSF%!^RzC^pROZ>UHNtP|-H@2AycVB3HD#XlxlF7$xbybaXDr3trc&h>TegV$
z8+0d%94S#uNfob+ik~TY@cphy9j1&EbquHIR0~WHWWRJi-{ILx&%)zRx-@n#d&xVk
zICsa}mpzX6W^jHAVBer~laI^&+63*$oTSSt^E7S=-{UC=P>p6?8{93a740QxyC<_Z
zC$M$;l+VHQ4CZv1i5}*QKh@p;Dr#M0!lPNI9_`w^_z_=xna=dwSwT@eW}Z){tL~YU
zc=7w}*69)-+{~XA7V5q|?xWopbh66gsMw=-7xowz@^<vBjxfoY_$h7W=QoRzN_0yK
z7&cDw^$?%<^QNTe>LpIm_VF{TO8n2RPfI`SDr_F{`EmKw<$uIh%{&|9BUXBCoAaxQ
zU$b1@W1oNRx@w+%Eq=Sk;zzl6o_;$m*8SmOkEi<fe}S#_mERZf`L}-LSQ)dW+gsxe
zw|-RD;g#PlxooUVHk`EADqj}muvhTMh7X3@-Y?TI_tHCA<UOr+)2!Fme6^A%c-`J=
zx^sf~&jl}<%hl`m+<)Z!?!?Ey+Dg6M`jbs9<33rgcAdT3cvg5xZ^J~@8IAkD=jDHG
znHV(d+o}#T%llQ4sVO^8HynIayqqm}p4>i{h-RN1-EF0h!p;hw(TegByw(*pGyd7m
zV=`OfHCOrXd$jdf#x(D}SGy!uN~SHWdau)Z@M%T7z<zm-wYM@B9eOZPY1QPkDQs&v
zKJ^H2xlU-?F7f~6^B1BY!@PGH@}BVCo~Dzxa7hWX0ke?%{D|2Rwv10+{8I{>ef!kC
z_j`>}R!c^STTf9ssN2zXSMZp?!I($C-K*c<<KsKe_FJN`=C!WV8HQ;An+)@%&c5jI
z_uFgqd5`VENs?_>3Ko`%)=bOZxc%ve3X7uBNg8=oS=+h{b;^s5UoyRJyI`(r8l(JO
zsWkU=4%uCmB6Ge-@8C53w<-4%x9Z&1nv3Nz<wv)(rt29=#hm>8)L1N1&)C1@)Yiov
zd>^?dEDcNcn59y`Iq+?vx|@=5{H21Zh{DPxk%>II50{?dT--TpNmSoe_apkIVbia^
zUL1X0yWgiP=0VhnMvf|DMthrjw*60A7H{g5|6MuhNEQ=sd0&srw1u9NWhB=fO9~S|
zypu8La+>t=XDhPHs<=Z;Z*S$iY|@bsTi4At;~?+7WsI-$kJoSi(W2RUG|4^FuR!j<
zyPK!^EhA?8*sgT83iXWs<oid8ZhM`6yL!WkHN^^EC)4$qSDnh!o4)y-QKj!nuL;jZ
z%hK2#)`;|mTWa>QvTz5i<Xah{v1rDgb2HDJYU_TiaMb#&!Q|cl6APm5&wbUqeuc`n
zeZFOTnifcxFSQD1Fxs|1G{bXxqv#c#?5+=t5*Br)v%iC9o_RAh*4({SqskUBS5H~E
zz^63v?C#qlZ+xUXj2LA#l9Ut|{I}>@{O6mv8?#|iiP5~vOT`4<2>PoZOcL~qS6_MJ
z?X;E0kIIIAjF2ui`q1|DaQoJ+KVSdVuzmK@a@O-VtJym9oaXOb<-)qJwxGC~S!sRv
zj$cMo`Ik(eb)#|S2|kv0axy&{rW<6XZOizdsN3)U@vfl6%)-_>H>CfqLgZ1{Snh)7
z@3MrVU*sLy(dD?&&fNac>%7M6TzdKot#>44<ldYvlD0H4HcCCX;g#`HMgzxF2X^(X
z%Hg@TdUe`cgM^gchAF3#gDuotW&h@T2CdqEF3b1qXO@67kx>nY7&!hs4%vThola8h
zs-<4nRJg9aI$NX>vAXLI$I=NaokjCiog{Cp5<C6o(ypk>J}grmUZ_sLWw$>#XpzS5
zshc|9JNl*gIZV9C-LEk3x5YJ%gyQ0fIm;A3hdjDpz3!;Pss3uk?Z-sZ3wfXYY~$bc
zhD~F$;K`*OckDmEbe)_xx68Xv;?6CtlV1}){+zDB%KAp3a9Lr&$+r3{dy?M%uTJ{A
zeMZFW*-x4xFD&)5<Nf<YYfjCkv>mHvBp<5Wztd;&`2$D)t<Sx7b=|7B%jQ4(ktC<x
zbjn!IV1;WM8$Vm3obDuxoqIxs75<zOHa-*=`o#MAbdfzrUgvK48(4DqozlBXWk!<|
z7Khu+73;bdyWVK5Kfhi7+MZ{8+V;02cb9EA6Q22FlM2(k^~;^R{s>2gb?{%yNfK+j
zJl*3JlhM9PgNPa1^o!^0sZwyNU9`U|)#+;mm+?FnkzR)A`x$%*@1A|xck|QS8*8>U
z?MO5^UzoZ+e(SW5gt+Ys1S&sny5c3DlzPso-g(Emy}N(c&AjHEc+u^~D(;yMryqV^
zaY{~e)wB)KddgMzT-?tcnWnu$I_RuX7ymq!bn)V=3)hDf$G+3c@D$%8KIy#5(_7|y
zgVWENmT&v`adCZlF~7YzN29dMf}E#|40m>kRy^}xCdcqpWY_-}{}1j?_I-V>OngV$
z>f*_7U)@UdTg&wJRddoI)|r;KEq7I{HB;1l)h1VIH;wbC8SkQQ+w~ca?;5?<Z`-Jz
zy;}Wk$Bhp;-`97wsC8RMJ-;}8ZNY|>i__hIyIbq@G{-M6<J)U;B;bimzN_~S+1HA<
zjVt~<J29{0F2`P$x+STbXPWzplumynlH60F@$ORE!nn8xv8ob@Lb^>~rX8KP<l+6W
zz^={%VsaW4i!7sGZCvE~K;&Naq}@lWJ>My<n4Zd87`-E^DY~pzvR`n$!k!uDw=uJx
zj>^_ylu^6S-@D}2Bd%FWwreA|Ozy6(U-JG<ZMfQ*DCs|G8?%_IPOsRS(Rho|Uqp*v
zT+?M{&qJ+pk*CtFeK)Ue4RQ8<nr5|dY0^}q4ChUL+*____Qh{sP*phFIz#HY^yHUr
z{u|yLWmOAQP&J-edF0lH>cuvVGsJX1%(x>cupo}5Iwa(3qPhiRS<C_+)<i+|>rdzW
zVd0IGTrLyqWy@G?|8~X1lDqeobI%ml5=rEq_(~)!C@j5oTUW;l?*`Yvxht=p)Ck<P
zIV$#vbC2G7jS{}*6A=<OBUH@J2(Op<x6k}ctysL@PT_oKuGrp!{&kFTx@v_IOYVIQ
z^$?nV%7J;s4K|5_`d%iJ8Besmx(Z!SCAJ+E-}7e5Bu78f9W&l#26<#od2vR_v2)Uk
zIFkjO4i`2(Hsty+v1i|xx2bDP=SkQ&1x7vzIeux=89#&jzUP(FxBdtbU{koHZ=9Ui
zFx_Iq+)cix+tORUP88N*%3@Kq3Y_e`vvkos(_}4vnfJw~r}{|b&J1EHyXd@oQuETd
zN9U8iZ}|B5!-pStZ}uyw#?+RFf2+5tDsS7WnYr)Ftk|qw_BKB+nqSx3df4~&tsjN&
z@18vQ;6u(4V^^gwyt6Zd9&^@BI&?Rnu#Ks%eA3+Y*IK+cYCPP&>)+QWN7qVLlu1bK
z{~%_uf9BT3Gmjj<^X18|uOIX^L?R>wK1<9uSn4^?u(xm5mG24CwX#d5a5S%TKa#&h
z<;HurBhnjM8u@2le*Z&!1E=V$tHIaox9I)ntYi^;xh~&mgY~lD=JkiRO6c6Yq|O$y
zE_P?jmaU2r4p$`jPwm}m)|vU+K0ZJzx^cf(_x{iuJR6pk8naZ_{>oE-eV>c#r@VdM
z9p85k(^tQ4=VlO|zHqTb%b`~v%rm*X%sT)7Ilssua_77&ewX)ebuzxpbd>c&&ivQA
zZ@aYkZ{&T}t#I&CkkP}{Tm3vtZ55Wrn;gj9oO;-`iNQ89Jo3o8%*|eY%xkt*owjCM
z)x05xS7SR*MDlv0<0~1<G7e<MN2v48u_#@UZ5wE|i>o=4!>UL7a@rF1%Bd2U%};SC
zKF!Ro7ENBJ+x|6d#<j3DX6%yJ%C%yx&gk^&TrqvJ?Otba597VA%ZE5WJKQ$6tD3T5
z?vc>M7kl_8F*apnzE*z}=zYgKck(;6jWcI2%Q#k<Yhd~{TYi?>Huo7JI*}7L+HX7e
zW0v(x%OhRRO{|68g-<xP%v74@Sp1q>XUU(GttS>&T6hHC&=F;Py2W@|#V6SS_IXLa
zWS{I|yYw&d`(lpZsKTbDPp#zFNQNAq!I}N|p@Gp&wp5>9-4Dhqx|XlBXir{wT=>Vw
zSZ;1}Qzh5X)?n+*cQ(~GJ}=Qv^;voTv+f$f&{sD5rz}=|J^kRx4`175w>3A)---KU
zAM(}Hc^<pBwR7-Kb)H&|MXdLdrro*o$!vF3(F?c6)o$urKHL3tO>SAO9LqYl(d6u}
z4@azhFDb>|{BceCo%nsDA3|b>n_gVzo);%^?YaNMx2IE1Zl8A|`hykw)U?}H7r0Dx
zH<Zua&@AI@zvq*S+uOn|UCxrZ*<!&O_VsNZbL_9*St_xv@ZVe3nXerF2QPKwy^$=V
z-Sqb@t8>0T&trkEjpxle%Zwkco>FvXQR#|HuQkrzD14xECfwVs<wN*9ots-FZ63w)
z`Yf9E(q)3t>X!-UlVhf*&C$`cI-%cnc-oWd%U#oBqhG5@-{_N(j%>YgaZ=VF+3%}7
zp9hIpi28acl=*+Fv(il|v)Y*zwsylIQ;wco=85kz7#G#v)r@)(Cg{ynP*U+Bam(&<
zvp=Z@hvH_o_pQpB|1b5&uN;=5|0NYIue<)o*6+@|`gcC-t<MRQQp|k?>%OK(mv66V
zS~6>+c(~cLI~u-QjZIEGywemqqx*0Dp*2bq7;m1eTYdSJm4|pKr_?E<AZh9N@<m5O
zJ2ZDKi@odc?9q(<Z|2GH@!#+H7AOB^-@(Y}rfYuh)}7XuVElhRS)%URqy5I4*O-3c
zf4ptlo}w8s;wwM3x~*K5n)CT^vM1BTz3W2z3~l3F*QKA0Uv9Eo`?4s9X{U143J#Y(
zHPM|%9zWWC<a+;_Xqy7X^^v{O#n!71RA|buok{+;>yz9P!Kd|#>Qeo)7d1|GoWkS6
z8RvHSwuMykscj19PAw>B%g!mhz2T0R58v+1XEW4)r|SIp_;35k64CZIapsoay%y`R
z^9H#e&pp%fA}v2lzUOz6*6V<Vggb@u-(9=dYZex6nV7e1;n^LcllTvun<aZNCz|V2
z)c&mra{?7wP2(0^QaEY&s&iV%j;8un*M%1O%2Fm~>$fqk^mbWzPQm8dMUE`rFy1qX
z-Y0_JU7dKv<DvA5xqmkXC!N0HsJt>`&9dT8@j7=m^h5;CRKND7L#(RE^)}zVZCz2H
zm7}i(?H1p((=J22DD8ge#SZ?@DT%ARHovpzT{iuK_PcjYOw!U?(J71HSj`f(^ZU5{
z#XjFX30&r%<-{&NU8yp8@llmH-;>W%H|9(>p3vpLamii*yU8o<RF^N9xa7=tbJIw#
zrCl@1a&1c{uT)M-mA%llV}sMOm_HKbhd2&71$1TcowAV-&2l^Zth3xpr_o%<{j+M6
z#?7<qa@IdQdnx7J+uWoj!p}rzw%y}O_dA#)v)X6>&96N9O{y!VFy_kyT~OA(lboF&
zw`Bk0HO5aZRZsK$N|W2=@n}bpMC^5gFpFm8g^U|49~3NU`53ynz{2|bjNl-in@XO~
zMNV9=`?|Ae!z&BkX8%*-?It-oXM9!t;?q<%sIjIRKF|NB`Ytz3@ztI!e2?x<*0hiA
zn=jEi?O=%sf1cZxilc^|cYB)Vuo#3+NII-MG4`1%=hJDg7F1j2tns>4sXlL4GRNI@
zyEjeSe{!;iqquHh%$^6Ao3>>OPWW}Qd);!rk2^IE8Ltwn&)wj1wq<|T0$#BznYSeG
zU%%;ibkU_ug?Ay3e=Sid4UjQfDs;Z#>&5<62XZe=RXcEX>JEv5O5qfjXPk|F$9<<g
zRN;EGZ+o?*OZUF-ijfOlzBztyGv6c8D!YkUO(}XcU;lH?sYUroMi)cfKFx6EoH-*t
zb=u44LK`~l_1GfqTrYi`_*6IHmC6~_`E!4V+};1;rSQpvN?|Kz?MZHRn~~<Il^)ul
z!@eujGhlJZ^uubYx04!IpE;=X@|?`qBCn4|N3|DNoOyRLbV>S^^*Jw%{EjKyp37^w
z(C>|q&pyGODYtKBPgG~J-E(1vyQpsDg2SoTR=(<A5%BGRkiOo+$7gs>z1zm`suZyB
zRd@6Y0lR-37j3)USG@XkeA`)Fujj&U7gohC4f|#MPn)YzQ0K?dx<x4oFPIu%s)PnQ
z$go&DUNC#NY`te0r(!vS-~{))sp((!cfWNDQ{}(4$Vy11y!(eocH*o0I}U|9$seyQ
z-mWEVerAT&kKMVquBbJ7*i1NG>*s#6`V@z~1yARTrjJ!?RKIU{(2$gvFfFsK+x7T+
z^}6fA4pY8A-v3MVO-Fz3k~_&Q{;q6~whCW+w7E_oCG?MsY@N`<6TVG~ti3;<ERi-(
zC@Pnj^6uv|<6Rja6Doduez&^$V8(}kIRzbjH!o++_;I7-ZV-oo&Yi{0=bJBojncSo
za^a)7qn&v3<7CdK-m82%)^5{G<)7(xpzMmJhHFT^$?~paZ4-F;c58d|ry3N!-gc|#
zs$$EmS>Bu-U-xkH%!uMhE3K3c5%!;w$n#k1;@!O)6CPYoS~=}!(j<m=j&dGeYgbmr
zMobrLIvIYk`R-x!_TBmH`Q`nx%Z#soUA!o^yUKUFNuu_(hF^=6-l)B)UUI4|QJ?AU
zM_;z8#ES_jw%$i#x41-I)ZnfAc+leHafuBH2J;Wg2R@iGZz{9=6Xj@Oo(ZdZxmNs&
zh??@bt8Lz`XrcS^*SIdHTGo_(>XxlfWwR=I)~U-@6LZnlSFE;J^ZkS=F$W|SGn22@
zW$K2NX_kM#+cdvm_cpOhHQR$)H}A+~)@9E$;oX}$Bd_bXT6dS*R`1QLQ<LBI?W&%<
zx;kthx6pFVx0}1dH6{P8JfdG?GOs9P{wA?GO%GK)thZU0$vW5crhQN8<5Xwz(PMnA
z8N2T6wzod}s-O5VFn+$AP+nhPWF@<xyRu|Y^|#BKs#6pgTiU0-P5kHYu;aN!2}eco
z4%cPkyRIc~<Vw1h$keRxhFyB5G*hqDovjOV%dfn@R=cZ$YkN!7@x6zl(pMFvU2yQL
zJ|mngI<fKdkM}D5EqgZ3V5t1+bZC)bR7KFU1;>0A330z*C@7oc7CP&RaK1;_{7)j)
z0dvgf#`xbfEInoQcIj%@YwZhPO+P%l^`Q*gS|%$VgM)`wKmNg3R&wUkTI0=cF0C!7
zeQ&bx(!oU@j_&d&EX3KS#g^XWvc4mK$0*zEE=PaarVN?S!Jj4N=C+-4xp0fczk~V7
z$<Py@{=~K$3S22-oSNz*voB}Ykzl!6#U)2QJS)F$2%fg2Dm6c%&GF2gxgwU4n+hZY
zo*A%Bc$z-{=s{KE6>kOA4UC<>Sl)U3{ojSX(VlfrGdRwdFhus9t83ys!?Y+tB4GBi
zt>y1u2J^nTyu3{5<RaE@#lr0=2ivE9u6a9+`Qrq&6$hg9W;-+om7TVzQaY)ZAiic1
zkNFC(TbC^NZ9DI<@ZwkFJ=PgwYm(I7-<)<^?eo*9=ZiGrY)_nxR_%`L^G)AgJj;%M
z^QQ9Onk#l)4B9(WaQ@drn>;lCoo$PGE4#PW)JCSKPU@XJzx(0syYtzWfBUhL{mqh?
z-uLwu68oe&W4MBJwm$t+&fBwi`vxWccwYXtba^d>o7*S9m63n_h2#80P2U$kUDKL6
zr)OGp=gqoY@S$$Q_jf(p-XB+QzJB<->!NzTQ&$7F&AKVQ=(|SFiQ>gm;@DSTE?+Mh
z#^YkVt!DFfbD?sEo^R~y@9nK@KDcJN{JnivRt{{nr6naF{`|csSkrv}-0N-jmkajn
z`m$U6Y_z<b+<`q7vTx@pB)0EYP|A?ERNQ7|b4h|*O6H*vYl*d$UGj{B`dd35-v9jK
zeT-Jji{#LTwNFm0s$&p3y#4Th&dHBo6qFeJNG)hMsc#V>o*%<{GsAM{rkx!3J{z!K
z&=jzFyi+i^Z|5V&bL$lPCTH)O-Jc{{Abe<Heyb}_;(cqjyS-smA^rC3nN!vn$#Fc~
zSiE9`QS^law_EcvgIjht+00s#bm0|4ddN<V-YFs)2Pe6Iypw11bn)?bPtWY(YYp|d
z*&q3Wx%!|9{}I{5s1FM)c;1VYESfM`?Ns5Jh5r{U^38YTKBLyaS;e<^=?k5lmlY`-
zs<(OUHg5^YIX-dW;R$zBW-Q-+uZDFl<IgUUgBt{cjT_^#f9q6SW<0w%`rQ3bx)}o7
zzArhq!%pX`_l?Ns_a9wtkz6M6tn!!3a;r1xR(xvnFEGVTkSqNzaJ^vN^@|L_YWwql
z3ID0z`KB__?k98B*+`8bCZ*^7oiCTUFrBuWJMn>xB*RyiKjP~Xk6k}-?Zf(<uKh`B
zRe#rh{VMwHZb-jG!0|Tb(A@<W4>HBR_rGVnJ<hy;@@c#6XG_xl?RMQ3rT4O7(S^R$
zt%=90PwVY%*?ZWS+uZSb_<>#0<u^XP-}IX|pg+^(<EuEcHE-CI=PB^K)LO%v+U9&b
zc73MAX5&@fa*G$e&Mdkkn3=R<mZI8>x8gfkg)fN&WTYP{I4#sub|^u^@Ys^6`89Vf
z?JR$NPI%wrXPLVts(ojM)7FHDH9aw2H?Pia6A(2pjz3!X`kca~dHLJeY#eS&&zUDT
z_rRj>RTUO4D{HeZCa*g1!FAKgRa>Jz*qA3hIwZ2nL$P(AMq-@7v{hTTJ-1@YKK3p$
z;(XGhnEi&PGMo09Hm~!K_hRhob-R?5C#0@yV8v&qTF-C!W1@`3wTrj&D&`bbR8+M+
z|GQCj|8f^DQ)Y&)_b1<-WS32zTfF~(*`kb}Zw?=1m|gSrUBUl^3rWHs%ft=rq~_LI
zEc^9YJ3-&XU1E28`;L66#ryv=ZhLmvHu==!g%T@Vv$f5Cc?(n@J+}MdO36)aGH<#+
zCvKdzYt_D2Cm+;z?eaY;+_C*{xq{BcFAu&?(OBQsUg~f~ZtjC41*W>Jp@z18yhgcp
zI&T`@UtDefzBg_z&-cv#fgW|dtFC_YWLArP|9$!Nd*5$wQWc(>k++BSXnX5SHSg)p
z+ZpE_cAoIX{rKYT8-6-mTJWmu@|Tj0MNYFLlWxg*&-+=v=h@z`0YzoA3p+z+`f{5|
zR<HOy;hG&|>T{znAB+w}=NEfOS)RVShox}tVy3ySC8ZX3_2Tr*q&zN|I~=~z!@z!E
z*6|k)WA86ud3g1~lu*;-TQ&=CnKJ3No^KMr%Kqsw`X(7Qg~`90>x{4cEvPc9ur4}L
zI@9RviGS}(4m9q)YrAdTyZzrDFRoBpTD3OWJ?MvcOw`K{oiDO1`(N!?*D-gx!^+JC
z8@IGBcei>x&01;MK4I?3?2O6!E<wq8?~ZHVZrv$u!kZFx<8R93gw8)RbelQN1K8ul
z*l$iXU~1`3DP5W8HnFea!I}F%Iy^<hPgnmbKRo@Cz7zk8V`6)ritWo^QTAk#)6*Rf
z`ZqQI;R%e~Afr+nddRVGt?#Rq3ogy_aZ7aAyuos}p1`KvQ+Awt{7oY;DT-@*@vbF1
z>RVOi<klCtFI>R=<ePDRX=hp=5Bt@pKVMfl@0)!5OVGWqqDvR1^Qvh6J<B5fZpuxG
z?qK;N><_1G^gQv&vfF9l%P&XN514FqofK8a>wf<CL+O9od54ZXmAP=9DW?Ca&MqgO
z#_H#*y;ClA)Tk-_|MXG!&+dje<%JV%^)DybsO_A2yH-`pOf!~u(l7b9H*G&^Mw&W2
z%K0JvrMfj=C`w?Xdn1SPrfJi5EcV!NJHmQSVeNB2gV(hSt21sobsm)EEL8iYdi3q(
zhdlT9%f1Qtr!?!ms<1-N_V)`CrKHPhof%(!eD9^_aJxq3ne4f&qg~bcxdq4DPP6`1
zW>pCNWNtqzf+0d#cEU@uO^WC4=5W0_{6_pnNzdZ|-#@pv{8EgLz1k-!DRt$E{?X&5
z!lzjuNy!`vI;|akJbbs(${8EtL_1%k)D@*KTAi+LZXUT{*UXm-_dGeZI%+!e@h7U>
zw{#;`Ccdrmv(mnNP$XZ|^R$(Xi)g5tR>IoDu8-`pW_EHl^q+P$+wecYY}MJG<V_QJ
zpNrXC*-~XIJU8K*+uZJoNyklZbX=|RvC~?oKHYMq%ZI|qlU(29=T2Yau{~kgv9GUp
zczQp-{Nmq_R|Y&Oyxvnx_FYq68p^+Ms<Y%4quP|cmr6bO*v_s`&WcX;zqKjZ);lWE
zJk_&iip`RD4#lM*`dJmB=louAT&nD-$&RUyowmm7&M*CQliND}m`DFxbtCAkyKka%
zP4zCB`!lSA|5cw{v}Z~Sqtr_WpTCE4?py3SzhtAyY5zwGr;muH^&DQ^WqeF`VfMDN
z-Ej$X?euPx)K4#JUX;f<dH=1T7XdqhMJ2ED?(5``x)kZN>czqv>FYF>ZoN@w?9#C3
zKia9m5-dLQZVU_zsSFGZGN=dTBqtW7=j+GEXXa&=#K-FuRCf3KpE=ptAHE^9<5>^`
zQ|b9VldddkS`?zNavihasgwRbo%;G-IvQ+UM~VuUiavd=^&(YCL@VW)*c0)o8VWD3
z20FZW#DsQwp6T3Lmd)%83@4Qt7^Jb;4?eUfwMeg^@@-@;=-91)>*5dYlFwP#cOmsY
zQ%c07ZP6P{IKz@}2(Yl_UNlUf`NhS`G2jdP+x$1v-}YVM)(q@pN|$9jbD~@4p6vU1
z)ek4u_}azp|NZqr)A^YJZywmBI(=qM|0!sB^TN+bvNCG<i?2WN$&)Lt+kWNAdi#?P
zZy!F){NuB(rTDB=gBkfLex}ovy4aczmg>E)JS7sjDd%vJtC*4cX5I5adhbr0T<$62
zJ1s`=N2IZq$;C-)UUpqIk)Jt<N%N%A^z0|;fBYr{x_!2uW;<!h*@uE@d(sP2c08Cm
z>v>JHm&TzLOwvLjYF#}YFH1IFy*<ZwdCPjoXx|kALDEY@L-u&BT&57A8MgOQzjR24
zmXW54s;6e+-i14pDn&lB&QzIvf8Blm^K~`#-!A`r%I_}N=<nFhmBn}2<>L2qBA#Dm
zX6}C?!przV`S6|xlENit`#LV|tev`vb!OJiq@*Pg+a!d~1{>R`eK)zyl({g-=x3^x
z<F1pB+g8qysR{3Y@Orkw-L+Sx>>2Jvo?DUDBINAw<W0HR^<)FL$?WT<yXZ@v+>zjt
zbKUsMrc1YP_AGVDD-{Zz)R&;PYuhZP?!fsUru1AX+vk$tSl>_)b3#&h+4I85d)b&%
zr`&(QeYNij`-HONEX^kvY%fInTC)0_NRsP}x$?)f@SH*z%aexmJ>7m^b3AJ++!Nl;
zSkOHw=&GURk7fU4Z?^CF5dCIHxb3=hBke!ji;wM}$8Im#<vnxLVm;j~A!QBCrZfu^
zrQ~$G4(k(Zs;taA{8lDuFtdNs60wc-<M}PM>X=_`jnQi1^;u_E2*``im@2{3-_F>Q
zv*U-<b_FAoeO?btCMP_&Qnf>Lc`Rd6I<ISo@*4M=D_8cVulbXhxh{FVFZca8y)EhQ
zmo9v{WxL$F-1T!!Q`Rf5Y2RzQHGln7{%=hW7avMH{$gfHF@vd2cSe)*ypPL2Fio52
z_j>Nfd(Y16_@Af?kKt#KDUxTLqx2+y*7GkHx7SXJDOj36tFrR-a-~nD4GxKhM-w-3
zw+L%I_flqZdi08Swb6sK35?AJli9=;M>9-uvhmv9x9Rn^)Sb7J9<5f0Fj#eBV{)@<
z-s03WwjFKJ8$)$uk8M;}Ub&1h^Vqy|K_OaJpR&*LUXv2Js^hfX`MR~{{MXBh?;YGd
zt@zklqgT7RXYShDy7<D(3x71HFSN6cofbB!sZRUqkM=ulo7?xc**@&Dm6C9b&JH|e
z8ofF&ra8zm!q7I>_Q2zi6PhN=K3`pt(!aYVR_c1e*XMfS^&ey2>I7Je&;Gn+^OqY7
z>lePd(ODb+!6YQ_nvZ^JR78aCr{oQFQZHC+_8&-B7EL=a_2ur&vdf_>^Aw}>mS%8A
z*qZ#Xzr<U1$K0*+Uy)6JjfvUTJwc^guB90*kG%FS<h9x5Ei+oPb-X8EYiK#V&GE<|
z=Y@RiAIxX+q;1jK_F-!D>(@)97iYgPyR5eK;)7)ZM|!PJ_D)iemrI%VO*pu1TKlne
zZr@eCOwFG?I>!Gk&TXN?vfWE%R>VHLdRTbRGAD({&(r#McJ-gwyVhy~YeZoff9lSk
zm!`UvD)b(>dbVgH&*{FaGu3aL=-Z{`_a=1C(J+bnZJRbqzSW;lp+CK<_sQ=7iHmdV
zmd-rybzsuV|2e<Tr%jfYTx<KluJZ7|8<&c9PtXm`V4vL{S6x`G_OWxd>_qK1J~7S>
zIT4kQu6C#{KET57e#2?9s;FjQLb~K}H>b(RGujt_>v^lWY?tngaIe{X8~n2$+~%D9
z=J7(uwOfCh?ase&=5Du_?cb_|;*Iuqn!}GbKVS6r^B#>G>#Yvdi89RYei`0adEjUQ
ze?#N%n+(-9`dkL$i46~H4QB29VI`3~^)CN&r$d`J=6&3&aZh0{cae3WblJ@Jve(1k
zZeGXrdP+=d|1PZteSrr|a{10row{1=r9GObsCIaiUHxrxCa8}o;p84(ksF)LgVYyQ
z%d2=8{&LX~V_+y$58By1#r*|SsNZ$wl}#orq6dV|J-xg9#=pjuIr95L{%W$VyRk8U
ze#q~#7tE}?nb&RDdsJudInUGu-<e%Ee3st!OG$=9ruV#&W&Bh@=GDtzRhCq+<@-&%
ze*8#B@vM;kH7heuty#74{5%O;hmN23x7?d><yZcuwYRJv6tA0pq2=?>z8%Xmv&uLV
z&Dj_4PkA|=DK|@>-$u52Y4dSL%L&UKF8aM}u2jdXdDm^OD=d1w>iF3?2WLNa{C|Z}
z`Bq9R+cbmcCDS6KjH@NiZ7Zu)$SwZ5Z+eyRo*9q2H!+=Ey5SvvV@}dPjX5Fzc0PKf
zvpD+nHAeGzo;xx{4J9EC9jn&+?sA&VJ$Y%&jB}3dk})S@?=~fzKf58=CZ;b?)i%#S
zrG_#3+S#_wl91vkIp+(nUW>ix@`_{3zccBy(a~97-~6pw{5I5~QvY@A&24>C*J?c9
z;nt-5?6lTupAA<`#V5Te^EtDuV!g$Wgyoe+5?rNhDwB(ZJq`rzE$-FT$ho`vj}dc<
z3afE+m5sNg@Lz?q<~E|8ldqjzZhAW8<f9iyV_YBbwoJVLYSk{Kvl-Gno2ETH=;5p#
z6qA@Y>*eX>WQOh6xv%}XZDsJJ$~SwT)}mw1?Yhe!@y!y5c;v<SK<blk&F#?8C@b@K
za$M>+e>HaXbGy!JtZh+Yd#V&Ni)Dh+)D0HDq)`v$yQ%P3B8HuTVX8O-gE+RjJ~=I2
zub^^m1gxHSTq3WN*f*)v*-+wyfq7~4;&Z2EO0yGLxRNg$3PxV?Sk);Gt?1vaDA(@1
z?#q$W{=~L?&-8Zpy$Rya^X=aHKZ!XK^`>83$*f4TRcb@xspr}o|6j5%iQDj4<*r8M
zW}`Rn_un{uc)I@ghmYCK`g%JOf|hnZa#P#*_|4n5zQ(yXKHe_ZdFsXe)S9n1B`QO$
zH!b}0)85yy8&eluyJH}^*)rU`^ZlA0&#w<2BuqS0%c}HSus{Eg%Uv0bjUrx0iVF?=
zAGNxK+T5D2{yM~M$&L7#rB5sldSz{UCcW)ZJd3e5qt_yhos&QEMyGw0nf|Kr@HfeR
zrR$63KOXznA<S$)Cvi_gP2h_TvmOEQrc_PuX>Yuy*(Dj59oZ5%J>2ehE$g?5P7)3i
zRkkwJx~u0*PRW^<a`DhD)ptLwdJjlX+#|~T{MD;dGbIZe4eWlZbwAx({#4&ZE9rvS
zbf@@f+EqIa{o~s?YyE+?y}#$jwXUzb^SR3Z<b%H5Pk-f9*POrY<ZP|Dr*Ct}$yu!r
zjf`gsC7yU9^(g<q<Ofb&ZDpSpvYOY(74k0BZ*!Tmw)=kC<fN1xX^oQ)|N0m8LZ$CX
zDPwih|NZCk+`bo2yrnYPTkOZd=br;B{?wKHNv!$Bm&D~S(eTw^v**$Ln4NnKUR0JP
z8T}GrOP6<BUgpU5ZvNM%Ct*i+?6}^3aI;O4G0)3X)iOaJ_rt=Iq@@`v=dFlr-M-a8
zW?%j~-7BF+yt$?t7hYLB(F>dPY|;Kdf;AP)?IphF+JkSgpZ#z~W!>E;Up8_Y@Wfm(
zG^{hW;yspsd~xRSCj~|?rELG+F|4W*E9sG&KX(p~^)dJTbuwj%%IPNVvgwM`bcDV;
z?d-bGyJ45jw*SR<ADVrcFhjWTyoGX6qmcL13sN%=R^>9J9J$`(z@!oUW8>B<dLc}g
ztk{@(8rLecU7vX1khz3l?2ASDys61-4hd{$?3O65bT$y2RCQq8WR<3m+ifm2J!^PB
z<Bf4|Py6g6e*|{up3iH1GTrBQP_{xm<F-Z?-TD`m6BgTw+yDAe*dkxOcl}fqyLgK%
zmLoGwedElQWeSLSe3SjX&#*b`=0!m#CrSOR+Zj5C)0J62%!pQ7k-vF$|Eaxeuc`(d
z7XHf4arcBpwqFN_&Z4^wz6UPsm3`B2=FR5IDq{D90|K`QUrG6-BT{fzFCakjypyBc
zJ0{krA4RV4afI%D{_vF_Q@MDy4zF$21lLbxj<eo1UAceK*~8*IgX~)-7oM*?7vk6h
zZ0|BpRWIGGl^eLN`CC)q=SAUH)IYrF%Qx9A7SOjQ%ktD!>y~Rl>67k!n)-lSd}q!D
zi^EOci!QBOtd$`b$SC8hdUl_1o7CLOWeZe|SLkl$;cRA2{?_SMpd$92&3v}nfsF>2
zpFF;^YL<$CZe;J4SvQt$iBw2QyRgeC)Y<;!>+4^?c)#_HYTp&>*dXOH&zW~Y<AVQz
zS~6Q=9E{y^S53HR#GzX^xjuItM^?y<R?nc<kqtMxjQ=>M9JMl)-d*~^e&!k%e{r{I
z`xXdnx+DMN#@&eUduvrHSTC==6l8H+N_^U5-rw_Y9RB=!1$XjXi?w&o=)QQ)cE#U9
zn@!GPr`n^fLVv`HzE6*O{$l$6&(AV!&PFSC+|ORe%F}RMtjX_2@*eL5?T5kZf0<lj
z6<uvTPwcFys_<6H^HPCgPt7~~|DC7^ncNdr6>xZoVQccWBhMeS6?CsWaDY|na=Fsh
znZ3)WpZ9XVSU<t8wfpik?qiqdG&=2K-4&BuX?iOqNxnz5Yv+~tuWNU(M>e}?H7I_%
z!cw{Z!Pz3epru<bX`Gv=vHJ7WZF&p;zKDCK<mC9hRcw~KXsk-~!v+2!=bS<(=?iR|
zrc@T)tMuZ)^5pd0M^>E`_rD$eaN6vsXQdjOYoo6xoql2Z+)OO;)k$Fqvs?PBPDnl8
zYQa@Iargcrt&%NkkFC8}bM;o#4kfNTvP)hlJ07g&Y7@&|(B-Aw&X^cxde~b1_GP&(
zx&g{7SOw<Q9kt(l*gHq!7Vr55r&n)@6<@oa=f$J%N&R;IAG_X#g+8mzURF}Q{d8E3
zPT>1#nOCN5y}W4eW%tX?RxjMdW4!q@b{Kf}@4C|TV6ou)vcu;VvTbHu@a)Tf--}yT
zYLtrw>Ad)2;PG>s=F`MA&9_9R8*Kl2??~)7yJOlX&Uom2N}j|cVRPYn_%{c)`nRHI
zlg*3GGo;VmD2{PGD|YaNJ)>>Yrp0XMq7Jr+J8pijeBm0e^@_Y3U%h|a+ULe1ud~9k
zWuC?51<l!e-iEJdmX?)$(7vhmfrG}Xx*a|4?;dH*Sg0c-!1ckSV?F1RL&|IW*Yk9Q
z-#fAMptx&o6{CmV!QcNDSlBF?W?1su@XjMuomGBKw_^7{aDV!|MOwHflvh_E=}vCt
zl#lr=CHbe?^$s;vp0F@j(ADT3sJL~Tq2a+-v%h~<lP<07cVcABcYgT$s#Hi{Vtm_!
zX^eYZnR2hJNWT2T=yUvny692{H8rd139Gcaf-*naWgTClacRwz?LWiz-Tt)a(BA)O
zo$rF(Y(j@b85nklGBC(vtB^DEN>Ymoic(9!9q^+zZztV$>-+y)^VczZk5HAqx3}U~
z&AMZ?t=Mzz+$E20?%sQ8)ef0WnuYC3qIG8?te3Lyy1ql*n&GdnnW>cZ?&V&`{x~eY
zm|@bucA@5=-QQ2|^t<_8PpzJ&Uw5YBs%YiG*{ao>{V(ap@9B$++mn$0`tL$bv)g@t
z-~ZomT|a(*+=2P_8{}8_P5-dz=5^moqNSyUg_V_^{<CWjKh!_{x@~D`>G|2~R+zoX
zy_Azx7X038+Q&UBxN@#+T9+nY86E!S?DE;&-LrM`ExaH6-*&Gs>}qULbWxbt?nT*>
z`+9EF7f!nxdcm;ny!JIy_9Keci_-3j{jS#7_15)J-tR?c7A=e2#5bE=w_(E^dyP34
zJ|8xFsZ!|~d5vG!_-sVQ>@BWb=lR7$V?W-UqZ-QAve7p-{f(mK1&iO;)R?MnxgJp5
z!Eh$?Qc=#)Nn2h|p7ge0hxmbQd>K04Wv3$#*T3#=OBej~;gM4QE7|VHd*1(QJ8r05
z#xghL1b@=))|x4*v6H5G-Y)vP;#zoS>@=Iw2fvr;bl=XHZ=xH1o@>UMb?dx&ugHEo
zabQWR`J`zc6CH9Mo}F{hBHF<wJ#*hg16jYdE!wYDx<4MAllJHM-F;821q>GbOTM`6
zLSxQ0?^R0AbC=JmoASNbP*wibm%MYI9u@EJ?=1dUdnx2(-|1(9wk?h?zg7JISA6Qb
ztl$s9l$|Sn+|K2lv`)(KtkMIk4+ZDSQrBv9$<0dfuNS$Y?^!iH=ZCfKc5!jnb9swq
z|Nr;2_RqKW@A?0~Jof*;aZkdB;-6Pl_^$>3t#B8<5V5{3rsDYbJx!`J<(|E{yzuRh
zb2b|dKfT(Q@rtW*^{jp7{W&KN>G%p{u3KRLb^CskulF7Oavp5C_qJQ;nMGEW^Of}l
zf5Z0e+|dwv=8;dZ=;I|V)dw|qMQ+;09O(J2bx+oB8MR4yH%z(3e5KFacoe-y{EYLV
z4XS&#3a*{jJt=%)hF!GrgS~&HW=z<+<BllHV^y9DY>ICTzU^BXA!oCyuCLpD!Mh(C
zw`7~UKdxA^rI-C#P+mc`%hgO9Yo)5YqW|xhdh$%VmzAOa>;MDbEv9XsZz(Bk`@49l
zsZwpNWBt?>^-W7pu?nfq^4@FmvM|g(WXGAxZ7JIq*d?6X=il(&si&f87x$KTzF#`a
zwHIXYGL#)p$U3FdQm9gU^Qfi9@m-cN+xN`&ywvKYvTDDKuWyusChPQ^P4`4K73W0n
zIPV;%w)?hD<gH((lMEykcsG8&sWRU=BI*Bwt6zODf1Y{zi~Yyugr6QaUaXArXoxb|
zyk>2NdywGbzOH12#b=)Lh#a{T#;KxU->53A`=Py|Pig0|uy?O>@0J<9Y7)73&n4mV
zE`tqU9S!6kc1|fXeU<Vw<ME63`Sy3$gfl+ky=Hv(G53TmdjtNbgkH$_zCH5df{CI=
z%a<Azy$tDR4_>1puKwer#fuf^4!SM=Iz1;{@#TX22@j3m2>opl6K}aaoy9zMX6790
z*BMu|jr3Xr8xKzqmloHSxFYu8rPaL;ddJumPfVVbP~%o6kz&<f{2<%A*w?sPxK<-d
z@l0CNQmKfmx)<)`F5Z8gH7oeZi#e=f^V6T4@rV<@+ORa+x!FuD=#-1_V)3Po-S@6Z
z{$Ix;{7*PWqG`+4;KwTUj<!>mNLJpspL^h<!+ev=x<&Vv-j48dT(Q*AuA_kMdCnJ!
z^pM4@#!P%uU2-~vgG)B+MzQ^GywA3X$M2ck3^qT{pr-TJ4;dHv9K4*|81uXFQq@I<
ztKaSaJ$?LJ_1D_B+uoh-$(>wXP_*>EwuwmgL0MhlNgwueW-hTz>vj#*PvPfYy8qv^
zFA5S$8bMlmD)TZgE&0JwwNLp7=gvDO4`us8H+dXhnBW=x=G57OsoP8MFR@We{KPfY
zP1CJp?Vb}atUu<j*kv@KQ&l>X+4<4OxC+grgqDM>|DVlTE3=J5T<%NC#+6QmlfR3;
zd~F~g$E&e+Y6Wu>w_c`3$i*DqynTD-R2N8@Bs_~wka|@3fM<=<pLxsFji(iM+)~<^
zIm!8j(6sKQo!b1<otIo#!yfVG_ty#beD+)WgB$)?91K}Lu^{`1PP@>(IDd~>aU~C?
z>|Whf*24R!QI{>;dE-On&sCO>_yj~6)tN)u`2sJTlR9wcRZ?1@`qTvvUg^GCA|Mb|
zRk|RkCCU2Xd9T{)%ZKl!rLO*M`O|sYzrByyC!{6I%G6H~u-fJ4xo?xcV8$PTf-`J$
z$}ClmyZ1QUKco>o%XmiK&RPDy-Y{ofsp=E;{dVZMY!Hu8#Pki)Jx^R;lsr$Eq`kv6
z)bNs)S7AiKv}YBI@{Qy-=(GRKDR^~f-?LkZhO=cOHtH?htZ(XfjK7VozI54<r+YRn
zzkK+>?rD#>>t(fnsLxtE=iIf45sA8y7A4==n9@$K-Zrl|+kp9=c4SPW%pz;%h#Y;c
zo9C=9{M?iLcHVN=xFu(<87PS~HOeL~H%d--nW3S5r0i}ci_Ya+jtTu-H@KRupPaH=
z!~S8CQXPMvT}+FZ-P_=^$GBV{Z?o?GRomvXasJJ9FTbx){qpU|((Mm3?{7J3tIt2t
z*uhfQ#3nt&?|g9bVM~?+9=U19lm(k+rOe#Aqt#DF*CpD&gLn4D1_ql8^&e6)S(QDW
z_ipbHiwlp^ncL1h;XJ4A&!lPImN98@`-6UdOb!pq)_A*a(k+>FVJCg>o=R1HwOIc{
zc^cm&&EuTwm)R))3H<ZsR?9h?yooZ73O^+lXehpjP?+^Zahu4@poR|?K{hO+9l7a~
zPcucXYEb6kIeNini{bgs<Yb<AE^An(2jpg4@e}5`{-Z5mOO3!e?#~Yb6RhJT-I{Ja
za=JV*eea|<k<7ABma{6qG%u0(DZNH6^Z&s!M%Q<o7ENurbl3Orp9m>=SsC*w4-Ib}
zo7Paaqin8{yW;|vez7fq0?J1d1s5&e6S&JaK<cjFJK6ezcb68F&7S5Y<3Ii0^FJ&{
zw)~a*n|-05{a$bSHQBG7C(UNH+nzco^EBi0BBn0}o7~&Os+lXUe3r4`n`W&n=<{dB
z>Lpx(?#G0q{npz_dpIs}c0cvHzUuKZ>uqNFs~YbyDZJA^IJ3Gy(fLo}rm3IQ=G|<K
z3}#+%(o~hvZ;d9W;hq0;V*Jb$&TiVX@$66OUdy8*zBjMUnBdtHyItq!44(H!UkgvC
z&$7Mp$BU2U_!^O;IbX{r?m5)x%zAIGQu_Vr8#d{>++N2VTU<Kzs%Gm4@zkJ$Cg!uX
zx%6U8ZJzTcJPM!XcsnnA--~TA?vi3bwZB~5_+ynF-m2s$*zb}1ZFo>La!t(|o1Fg|
z=Ms-T4cx8Iy&)nzVOd<SZckv|>Z95lbgt|C_@2;n{ZQ}1*qce5zIzs&zjU|R&QCLM
z?*u=^j<sv&KkhvEbq3?B@+w0i>%YB!-NOH-F!-FD?iJ$oT=vOk8-?vBR-eCfW{SM5
zg0`>^_hGLCF3&}tNZ#_$%(;JJnfq5B@tgl@CwgwHcUtDxb#8ygv&v2`ovcLltDQBG
z4O3X<lIxr@*Z$iO!~gMDg`Mow5}lU5f@sAY;qB#*Z<J-+QBhG6R_VV~RnMWD&wuZE
zYEo3?X5kxhkG*)iWYlgPDxBtYocZ{U$4na*SBt)KUpG}ZU}nSv<-HLT{zd5|2*}B{
zIWs?JTCTXJ;oJo$Q|ZcWM$D~y)Oo#rKTJyFSh#n?j0XFppv4{=lNOyjGi65EhyNB=
zp3a<6>m(?9r`daJZ7<`rC&qVUqkl=4z1ZvVUhM2E(WOO(Tf4U#f77j24chLQa69HA
z8?Qp_+BmM-ddmk>opc-GEWP4#t2SPr{(5J_#w7&;$@9JhpAe4YW4=-L%r(_+pLbNB
zCx5s1^y$;{SIT=yuh^H6m0~e7ab_oHgdSt?CgG4fIi+^e#w^ltg*-(;yXtN@T<Y*O
zIG~?t8qg%}{h`oHL1NF#p6zD6)3|l!gfHyVJo{8$$)I-YysTv|*Ll+~XLa4y+x>0#
z`<Ns7eFt;C`5f6)^!(?G)E~D_Wm`Wg^?QHN`BF%M;PgN9reD`*wr1#^^)yCKX-!w@
z?@dyh_Me>FZ=U<`nZ+8L#)k**HZQvLB0+v-Ki@BhFlN@%#wR9kVCFg~DBihsN$zi1
z@jg~PVbxbNJC-eyznJ`0V6RI*lS@P;2XoJpgA<-NT|OkYE#|Lb#zj9fo27g~5_e=2
zx=On5=2Y%H|GTIm<jHA^*Wb(M1izDbUsif;`kmA+9mbEF)%f?Z>SYOE37R{b$&Rns
z`JlrO6SIk0QhT;a$+us!oz)j~<^Rr2dPfpOPfR};rTW(I+?p1%OD=rJH3Lq?&3_a1
zWcz$~hOLt6bzz5}+>Kk#wBhv5H@7-He-)+vmw7xPq48|xse@b^^EdkbT(tJ&$ri<<
zMYS)T!qu&2hR?jb<VcqH*PKH;msc&D`C7kou7bl+qo{WR`BC<=7Sk=1cII-vZD=_D
z`fG31jk}5^C!{wza!D_c>b@v3eS)g?PLGe@5)a-F?-I*6H2?nJJt@%z3%%BDNsVdV
zmdSPd$9-FywYO?dz6`t8yW+%@#Xs95Upbsy<<@!gQo)SJAG8c3pSFEutY0`+XM=H%
zS)Yo<@+;@2+3|=UR~KMamVIQnI_RAHC6fU2d$lnMDT)%)nID{gYEsnU5&e7Nd%0uh
zZA;mTro7``e?H*J$15j}Y*Xa<v}^sQgmqFctUd*NGn##N?wa2_f(|{nGriXOsK59n
z_4Xp}rN1ZlKfIZv(fTca&4fJ*<anBUHw0H3=DP6xyK^gi-KWh-9RI(F=7sO9UGaK%
zUA|Ti5AzC(`7-LV_gUt@Q9P*hEbB!k_wF24^R;?)E94JcX4~s2J7bUikD^@{UQKI0
z&F*)vHt>6H<pkGqTebYoo+F2*i&`FawN6NBKR1^z?-VoBre~W~AF&(c1Yg@;5_CXe
z&)Za2tJdk7IoGyd+YsvT_M5_uK$Bee-wrPs&5x!rv!sf7wFD<GsH%F{qBhsG&VKv9
z$>y$g2b}rZ7_vCdthWeg{8?G(#rPs*N$1bvM>WOVnZ3`o<P54O-{~^uJ#o3Kv9Pgi
zlY`cxw;DZr8Z8%Y7CK>VIEn4VjpRf7HhFWUM9R#lb>v+byXW_xpPv_HPM`GW=)-~?
z?`Fxp*;sPAobwmA7e_<SnzD%LB}$UlUi~c>asB);tX$ORi^!Vvww-aSKQuXBj@S`<
zZI*jWqn*XUX*^c*Dox()zci=Et8tI#+Vv)8`?9K5&%f!Z{l)3j;yxzkVAX2PJa!Il
zkzfO7Aq9iYno3UIVl2j@(`T`tf4<YCq^?i+9%q{U-8lg_9?v+CvLW)@SIuMd3@Vv-
zudFmTz51h?M`j;i`IZAu7H@ycBFQZD?A|`x+~!6HmgPs;ze>I7*7+Fubp11(dfVfy
zJLDXi*FEOU`CmL?mg8y0B`4T|^meUibFykmb&_q{d{KJF0VR2x*7QjeG9&*k3JMhC
zVKWW9uVuv_?kKm$wr?)`X<@l}g=$AdH|XkJQOG&7^I)pI+_|5{HC~$^F1P$}?bR;b
zDLzv7&xEgeom;%j%~m+N;85<&Sx)@7{S80GcwLxyFta|c+`nV?ueHY`*L^)xyKUaw
zZ|mlsN_iMx|8&_;-g&H3^X7*JcAfK{lxk$(uWqSP;}Tlyaai=PsHt%XciQr&S64E9
zXfblR@}YL-k~=cyy03jFx|MC+XZii9TjLe!J6n0~Kl$M@Wyj%3o47OMC)~<f+@zK4
zEV!iP-sxFp_qD^rZTG6mwbt!fes_=73r?Py#n0Ym^7xDYQ=abO{7l&EqK5v~kD@kT
z-qx^AN)(^8@N#sZ`(j>B@ykYPG09uQd(s;drv5Q@o?fQ;SIC=d@%H`uc2>$i-gw=3
z`ov)I;xZ=B)fZwnT|e28xVrO9OQBPU&c||&Nqx#o{Qg|*thPJuEIqYMXzzbFX?E79
zYo}Glon&A-@aOn4J~g?ydoCPL*}HhjN{Jtm^ES-9EBHpbEwFmK*Q5WY*Q&4mnJb%G
z!Z$17)yJ19^Zk$BkaC%%r~D+YH-+=o&91BOl4UyNXWrNx`852DSoF8j->yEEin(!;
z-}rA&Hxr6?da><aV11(2m9%RbzUiVD_?jPSn7qrnymsZ1!?n+I{eoYVt(<SIXjPpy
zF?FNG|8?h{TrT8#KI2+4!yc{;Y;OO!&jswdp_&=Y?jE>lB73*{<r7_VW`ElK@!;Z>
zU%uX%Z_0AL(r&>`Ap@H{vssFNuN7P99tu2S!u4#P&*4u(*&XY?9mx09*t;x-vH9d{
zz7svWqnNF(uK3vJy<*-x=D<D8=EpZy2`^85k|CnA>X}+5-@9ouH*Gn*Z&ULdRnhSD
zl8wF>w)vHO>|y$EAHJ+=&WWTet;(^=yDgX8H+cR;B4k_Sn#s45=49|)a!mjBCHwuE
zN3H48dXH|N`m6ZT-o<DCJV;pDJKgWlyvgDxr%v3tujWku^n*FM@2z9zGz29%ibtBB
zj*n$)wm8LoQi11^XC%j4+m^2GWvU(BbA>lH9uf0W)%Y85{&t<k;+ZoI=WJRp#M{I4
zAh5yDu{Lv0*@^Z}h6i^Ke_i~Yb)jbWE4^bY8p8f>`}T3dyDecGk6+trary7ehrP@l
zhgUqXnXr6*PWc-a)8mt;)RoSi`0m-Bh{cl~zcI}1`@km0`R&a6iepda<?&Q$ol6Zm
zGLLJ+%Y7$mzb-LTKl~~C=TAwi6>jPN&c!Nz^)KCzdM7>qGw({p;`f>-WgkC%s#>jW
zzeu&O{9&BLezU;UMMtgDAI;FI)#R4G__j!D>&0c0=bLQs`@*^`e&vsYyEHQXN$$!x
zd(dWa>+WX{Ry{HH`&?*Lby@zzA^ig0Gir59wI;c?C4Q(4nxfR#ayLRInk{6Z^rPpe
zJ}vP+m2LI%rIgW1ht68J)oT2Pa|INS?Ph2H`hAC+I{RBOsZ+K_D;)3qov)R3^iT@x
z!}~uLc^sWQZ^>huQ%n2*C0T^9E1!2{<WM~DU{3WnkH0=2{I2%C%ufsWCMdPAASvtP
z!n}94Y>#~{t10h}zbKV>`?2`+H|&eT&MjrVd!a4g;n}Ri=C54Nvt6mF@1B2U=Oy;)
zbtnEd?k(J_(V#oOHuOpKyn9>!o~wz{4(fN?@WNm7gJ&JjgjqM4b7v$3KGx#@^4tA;
z#J$G}VSPF^CCBULus%L)R2v+`*`L%Z_f_=Fm#crZe?B<%_HEXc+f!G4lohXP;Ct|8
zs(N7Z6NRWAf!^Dfvw~(nnW!h^-E=8EcLi(J3cZWgng*gL{-{}8aA{J!a=orr-s3LY
z8s>x_)lxp1nhmWNv+uau)XL}nGkiE_#kJc@T=`wj{$km%VH$(@gfkTda_p<GY&M${
ztg}I7-^aO0H<dYjmi)bXm?Q6nQi)(+|JDcZx6hlbVIlD%|4+2E(7%p^W4;H!t_`yB
z^?M)QxP$*%MGfQmLno`R)GV6*@Fe@!!y*Dxd1AU58wFIQfBA`L$Tp@XE#*0WH$3Y}
zhuXB0?GyTVw_IoBkO_1OUnRU_W-t49>&~BS!Ox$2>|A{R?*o6&9ZAXzD^K4Kbg2Cu
zeLQ0K@2Hgz{{MN+erw&T)bf~33*~sOJpZ7R{I?!;J~nvk%EnM31_nuQ9BaRF6Z10D
zQj1IU3M!vk#}+>}oAmydsKt5arIs`2?Z}G{c^#r=d~RL#<daj}XTO=|cho^erO<U^
zOw*LL#Xs5K-ro^lc9*w-#oop9@yuJR=E&u6=9ozRz03PS^!JyKfA8zn^VAA@7gmaQ
zSny9@ctY(>?y0|9ckC&<&l9(?+;i9YLszZR|Nqu6`}^$IFQI>b#CLZW3m!bI<7+gp
z-P1-QCML$``^tpIh_=Fx<Vm`ddw$wPtLB`3T%eh9Zd#(s67B=d2aUY9o%uY?H7@1Q
z=ZGDwIhKzL=R9c%;bW`Pd0_cnS#RltG!4!DPk)>Ag!g!xUG<1<&Q>?-ys|Q|TsuX`
z{ox^-f1LIA?S3g8eR@pi(f`fgFX?!?PJ4e=g?Uf!BvFAaDZ%BxzV~mxx7+^yzTc<s
zw%hx%@z}Af(fD{InJ-3_@5N5}%_{zXRHQchD@F0Gl2rZHV;`~j!)coxwe{wEfB!r@
zWAE;I>%CtKGEL{V2zM=ri8`^BBj#Hzi%j~@S<LCzlFm1&lohGTU3TG;;8Z=UmbdA9
z+xqg2XDZ)xFI-r%WLvBJdF`9;8@pT@zwF^GcqrTV=g{UzfnPs;p544LZSrsCrgO{Q
z-L9~of1aKB{a@MLj?WmE8f3pX&|sX_y`-aAdbw+-u~fzPUe52LHU%fX?t30o6W<bO
z(5l-lvy5lY?ft&*?^o6D{QFz|{q^nN<sBRvQaonwoN?%#qv-dXhz6+~mo4%eTN!$j
zl}<Z^AC`!`7I4$BS>1wD@ut}np{;M75?K^olemvLb9HlgERQMMt`cX=pf8ZzbJ>{j
zl&FXu$6LiS*SAC*Dc-`}>#wcjJ&o()492<}s?psVsjVs9w#;99JRc_a&YgbwdgZ)R
zC$C=R+91w--G5v7lF!^JlYUjX7B4w%r*$Opjk~MDm175IOq6w;EOSZi##yf;OuTk+
zEAQHV=<#4&&G2>7LnWbiM;VS7FqkuJ`xmi9ZtbhL43qMY3jFtx&^X-@Ti5-6>byqh
zAB+np9_BdDVE3e<?;*?550j^)*PIq<dl_Y$RN3@eqrs;^yHkCOxCD#Y<($0?f5R0_
z-Zfb$@mal(X^OLyTXp`y?v=9-tXtf|zJ*<1;N`i~!hh_KycaeJ{m#B&XZ++G<%5x2
zx4g1TnD!mEm3&yu7{sdo=6${9#n5D_>y1Byzppp+$h@YMc*n(7{f_$K^Xg{j=gF+)
zJJ<5?(0Pq-0&5(1^T|kSU+nVWYPvY<0b|^vn-M<+*d~0KU(ux(T-l%Uk^kZI&xRK2
zmKWRXne`3jr|(<w@8&7dmzQSjt=r2O8*_0>xlLC<Y1*xyQ#vv~H>_V+^dhJCq_C;b
zRIN_dA6+WKK4OV}t2!R)+<l&H($Vts!F}!khYstf+hUfkTz_+KkS^!3E$RDX|1Ep-
z*ZjTt<7BfW{tH|`(z)y%zRp|vVrsb!6F2Jy9nG*)-a6ek!VN{AtzO&rF?$lLl5<v*
z%V!PYI>w+|oGJm_Yhqr;<v2>7Jan-nak5Ltru=yi=jh%tZWVdNX>rHNR_l@P9GeH%
zzIu61oaiom>4*L1|0_S$I3)DV5>aT>R#`d0K_J&-XSV^@XIm@l4{9gM3;Op7Fi!fg
zLCo-Ri=G(2hg#B;Mz`;LoyDJ1q%|MOxA2uzPuy&pV<6O3(lE7B!gWic6Z`3W-<l<%
z+owEmxOPzPfY6;;+Z``z<u_+F?H5R%q9R?e+ibz5$Odg?NeKtG*?byi*;*4Puv$ei
z&NJKae6pT$`n9ITK7ltsEbsDpAfg)2IsI>_*b)t+n_Nos6BUxh%ME`wEDQKC!#8$E
zX?sVB>V)I13sSR$RaZO`TB)v}x6~(V;>2And1srOOl*372!zd_m${@vaW?~V^V)j`
znx7teEH#><t#D(p_d2QVUpk_)mveGualDb%%;9L=QZ?J~wxY?eB?jWrmRlxG;(hS8
zOF!$`iWX+^t%?_!l(t@3^2|r;R_ukf*Gjym3Z3YE>~y7YT3N*L?aaHb{Kzquf2ZZs
zmTSPHV7)Y@VWrXnr<Rq=Rwus}5Mf?)S?W&D(R2}hwzb{MpL1U?Y)p@y$6t8lue;DO
zXU>(2IohuFT+Apr&|Q||qkQ{qb4uI#c<E2p$te=+9j_Mi-);Mzu&DFXM~%JxckVZQ
zlPh}ss#$SSAH&?8AA2{yizqZO$#9#+aFP3}u+6bG+HDclRw7S-M-)~4`5Rlf#(J*h
z8IAWE%X{Ls-e5Z_Xmyv9JKV74gJjCve}BFoI-M7#wo8MB=OpuEI~Dl{aU0`0CjSt6
zq@(gqu=QdqLr3F1lh6pe=?`pneY83fn;&AOQ?g9<&ZfP}UCggGE)2F~)3Gn`;Bt@f
z`CHyCKS7mut&h+pk58skR=nX`bjTx7>Bx$AZN_p=Y*Fjqw|gHyCAC42QSaUS37JnP
z**3137kVpLcgc63A5-*?XvO|^i*ylTG8bOJsQHp3Tr23$ao)`<);GoE*Q{QCZMor+
zb4<cZf2D-x@^4@46f7-wEZX>2Qi6Dxwp!n6_OA}zq0Z953X8IwR<_z|g)Ph|*tv17
z+2zx{FIybFB{zO~`&A_F%4a6$ziBL2daI6Z+?>3zszLFF-@;SxnWvV|x?o~ZdAnBE
z`*_Xl)hxFfj4Gxz?p|mjaL1@URArV2%T70m)pfE;+NaBZEj`_xr66$Wywj#_vwpWc
z-!Yv(AVl)B=OWoM>FS0G#-(9ybsvuhJbPBDT`7~*v{&`}XO-LcT^QER;9A<U$hG`p
z!mi@K&t}_ObagpBi`&^Q=hbvX|CHMKiM<~aw5uGiP1w17ishF_jZB(H?tW=<T~%Mr
z)zi+mUR)rF`G(sErMBMz*VZU>is>J^B-=duOHlCZ6W1R1zG)Tczw)<=bK|bYZ$cuO
z8yn<bb4IIpwg_5YzRGr`A|`ynyWg8mubR{}`C5SHZX@5XD%!tHCD!P59&(*6R<og@
z<H}zbo1&anxr#2`bIko>6E?1${rSbq@~>rk?y)@1w3wn4bxpcs+T<%@Z>1c<`Ck<L
zlP%;~{ai(3Vo(ah`kvAiUKN+lu8P|ubK#Vcs%ebMt_^4N1=)VcsVv%Jxz^deQ|!02
zM1{bDnP($Dul_Mr>lEA8Qjvi8C|-eN?x!<!=SE2+_)BG#HNN|o^zTj2ESq;ZFEn$G
z91ITl#=g<Nn)Bh!Rg$MNj`6h{drsD4p6Io;z;pY{o@VXod1~u*PH10ky6$`<d}`|9
z#~v3BS1d~MT=aF}mE=>dA?wsF%%ZB+z7w7O@6W&Io$qcwP31ONnRDmZ)5MK4TN{fu
zZ%bdX@3GKxi_YNQ#ZTBY149>YwVkra@usu)tZA$foq7o&x=*GtCalXfU6A->=c}~|
z<u8|=;{3RMvBp}H>vK{g3fS&SEQw&03cNKTZH<r7YMEfqBW%~4#ZHC45xaJ4b(^f|
z@r{e4xB^YBYXxkMn@ydi$LV$?g8!9R%yPClVJ$CuzMcGV?B4FJJ12d6{(RZVWO)wt
zeqQzCs>_eHtty<oCvd&-^|RKk8;V|sY0SOC;=z0D)Y9EXt*6Rf^vK>?_Sa)$rP=mv
zjXR5teWDpsEjuM{#qOQU9ek)H!vA{W)w^%b-uZC-=eK@yzuim+etJK@J$w1x&B5V0
zN?cB&Qf+tja#a4b#Yf3@1gma7$yp<m<$uKfi{siI9(N31acyLq%YV)6>qoEueHJhD
zuGic!4!`h5Otv^QXvwmP*WM=>Z)Dmid$K(|@!ou+v<Ioz+>PGHzW+Ss`CpDICC8T)
z-aAc=m7*8TpX^(w8J)c($V#VlS@83;%m>`^pLtfK@!K4W`*yp(d};AAzMh|r>NyOO
z$9AsyBd@S-uF(~p=`U8l-5h#nvE*l+=@GB^+7l+f_?nkD=i-XoZ5zbqa@~-8npb8!
zQ##xr%gkUFw?)H`kUjTH9$l3+XUJ@EQB{2I`!pcqr^gXz2Dy#1rN8+;7m2a;&2hh$
zw@2p9{D)6v1Pb&v<#N1Z{?~Fl>GrgTlh<mUUsvo^=g7_z>&f;kC4K8z$Lrg<Csv+{
z=#|&p9M`+f<l(Ur>xu8ZB28S~FXc3B5Py@;blu+jc+qsLMz=m2>*omv&)#>b+09|m
zd}a0w#?YQCF`i4h<L~&m{HR|cf2E@Q#hDeev)=Bmx+XKru*cfCBlQ2tGrOu%t~}Yq
zy=-0W-3u2tE}DA#YnZAEN9<IYN3WkR+kfw-xdGp+XO>S>r-wN?)Vd!(B~aX)H9MvE
z&aNj7Zf!dfKTG^M`0$8!@wV(Ab(?x?;uO1mR)=m<-K%)S{LI48ML)mTSQ*IXp5Moj
ztSHC3i)Sn68U^WJ%uHpk&v{%7%$lfbb$grpajQ+&RJT67@>lrYBCfwP%kAZTcX^!&
zG7a(P%}=d-W#i5M`jy^;J27lqxMIYmXHOUG56_#lcAdwY@R<=^JQg}v-k+YcV&Xfi
z`)=z$ZQXH1>c^xa?%;_|K~4)zxx|yVaVS1?m#FHBw~8{0Z{V46!@D!{#5Iio&1=(@
z8l!@aM>sk}&&v%-($rZ0$BW0(!~59At6s~U97O&a{CWB4?5y;S6J#@=Pqf?lBV8~}
z=|kMCxs&qTk81VoUSYk~&^+;8t$X)d2krwumHQ`G?DysR`L;85jZs*Q{G`b_$2#Mj
z|4&TWBp=0Qzj*hm4-WA`y1Dzd$6e}}bu=jWqc`U*A$|6@0?CJLWBChHo++0*wBGT_
zI`-hHcK+$VIxjV1f6cv+Y2}c4u;pw)r2G88jCbd;JX!f+SM-VWm2SP46`bW<xjiKJ
z{8}4)N#@!f<pe9SQ0E7tze6`ftl&<c&~~9#r*tx>xyRbocLF!^$>&%4Oy7L$myg5U
zo~;*D8x)McFWRuXdGnW6hdtBuSX<Mq>#kmsUwdV1?%b7E+}5w!ma|s1TBT>A>z1jv
z_chnfs$yQocQr5jgLtTQ!Ne71>Dg1Z?&Ukr9Q9y9s^!y_hG(*u=^C>d<x47EG6@q<
zxof%Ph+pdDX)&pcqTdQa)HF1%Ef$*HwE2h7Cnp=<#?m8u{);OuKD=f+=i2+He9}I;
z@|;!3_F8Y<^XFab@_y<4%g)|iW${gQ$?`zc)bG2ePx55lw`@k;rT5=MiUMrRA77iD
z^ULdpKWERS)Y1vlEEnDWG(}W1jYHz-YmGI#ug>~kb<JTjM<sLSb-qh|4*HAujk;NT
z9<$nb>hnL8O|g-#IuQNj%CyDrH0KIDi}?CDn<F|xfo0puWxR3w&if?tE{V{19eyWt
zn#c4{8~K}`T#IX2r4}ZB@b%p4+H0##muWqH-9Gv2yMvYG;$`=)AMiH!*vFN&%Q3Ok
zzvNb^eGkXuOEsZsrFptbYj(IbD*lRLv1*Z4@>yf?d)8E=>p~ODqMt9?c-s57&Q2ZE
z^HZBvE#;S=82!oi_mVyL_O14NVWZD#{&3;*4|`s5EV;+Mx&Kaz?$PV<2R@#C_E%l!
zYH4dw^;_q;S<}yM{{GF7f1bSgLap?!^izv(y)>G*e(inJ@+l#AbMLM$Skai?w{ZUX
zeuJsff6v6dY>dlx-%-`dx_#BjiZ2JgPkN^o%eL^#M!gmxfoh$IeVkf9N;KIgylA}o
z+wDuz#T!mPH}L&6HFNHk*fCw)&@6po|1;Zwb#V<^%UA5SzBT*WqMK`SYR|8|d)==y
zVbf~;e8G(&snHjwv)v9~@B2WsKOwa!qWkcw^POj#v@dIB#GkqFwC1aoz)YjPwUxz7
zB(|<ge*N}kSIGZeGs2I))KnL&nq}EgF-IZTZ)S${L{sUvk0!X9%sM#LCu`cLh*keH
zQ?5L|vwz~0vW!3GLd;xgYu6=bZhiB3##P@VDn075@s1MPCcO5DQH<9(B<}KcqPX1^
z_Qjie1(`p4e+ZngZeqrxFWwto&B%RxHSxD=_41C}0aKTs{mNLoldW`z-6BI4=j%lw
zEgMTWNhb9P-}qOu`ss>yr%q@#*&nVy`@)mq_^RGlTR*t%476KuRa$CE%}tm4)4~Pc
ze0g<l=e47g9(_3d?$Z80tF}~ra?1MR*kM<_Jbbfa>#3KqaXk;DCr)$p-z#aUrYRn<
zHPEo^!Hs=!S4_^?m4>X_FJ7>rC}aM#dEvH4Dz&-)^;qAJfAMR_v+vQbTg0=2<UD<9
zKhzdYQ;j(J>WHhRZcjz*8I#CZbJh$-^Iu(0Z*o4?S4@etG13m0_dWaf+U4voS8^{E
zF<m9z@l1V*e%88k33G%hcdHjp3Re*Sko+h=YW<r%TkkIo)K#3U^zu=Rs=uI5*!xYI
zzV<&uWoL@qoG7mIXX^*^O*g*nm%hBA@%;X+Wo-*)*C=~#pLtWjGv4S`#2b^!BNxSj
zb|&@T@e>Tyl-W?7aNFG1eTh{~@7uYrYj)2)cyf}}`$-kiL8XGV>vH@wnQw(UbeD&6
zO<JX+9IAOP;{)1o)Z~?gA(vSh7!C{L*d9=nSgr@!9`HKvwwcJk^~)75$@{TuXEgCj
z@QAqT=?W-BH=lcL#?t8ReOyeu>x##zPJ=g%-=wNH$p%eviG8Hv`dN8WW!{sWHO~Xq
zpU}T9zW;c*4&y?_eLjv7+Y%RuJ=wCrlkMZli?d&dT26Oedc(~4$^QD2CudKdEb+hA
zU$2$1&n48um3OjI7at$rv`|KsR$k#V>oPY@>{1EIRXw>fLHa^ljs$yc%bCC}fkx`9
zuP!rL+H|#RgUnV*r`8F_G_OvKHwry?WLkjlw74~Kkq4U({<V&t_q9thV9NQ<yFOJ1
zg^bnbKUhCW(_`_Azek^b`t<nxlib7Q#@3a^e-7vPz4?6nS7njS?%s3ubM@}8pH?5U
zpMU0cp9r~g*S<{*`{#Q5ui8KNOM2S>b*A_{nxp2m=#hq(#no9g2a^A&U7hPzemHUW
z?d#ndN<Z4=tVCHBFVbp?yD}l7Utn^e^9;349f>7NzPYkJ*>^Ey_qD8y>0&9ms_uuc
zo9tX1eSmrEGd|hZXM)p;zkkmEeqWH~Y~r>I+ls}#yXKZZk=1zpcS3UIm(>TB&c65a
z*%7X`Nn1>2hDfQ(3r5Jr8s_G;6;0T6rz+-LyTz2irDlcOui9Gkv;<w~OgdVZ%q+=j
zQu?n-&U*do_e=k5T)Qxx`>tc_%nAGMT;??0FtzL8X;<T!&WWF2{_N9UlIFJR)z6O;
zJ!dA@UJ!R(q02SJA;=+ede8F3q34dwm0N2x@q^Lb;yuSFeSi4+NmtR?ndjuDZ)TO_
zdXkXg#ak-0?cCZ^mG5gam<wl5yK`if$l}jQ8@;+yO(*eibaYnDV&XT^x3F<Cy}>7^
zxYjX&`<3wjmGT<yKX3C-$)4f9KKHt%s^dzborM)Q9Ol~U>jj5iJrI%nUeb5Fe}bN{
z-}zfbW-o3hu4ercq`&K!!^A}PJzc>E+Fg$F{kVAJh|yKU%imb#xB||k8kY02a<OiE
zCo_8jQ_SHV4NNR$FP6+|c-Lp)_MY$aua6-cj+zu7y{4WsQ&PNbkwh=2?Cy(Ej%Q~C
z?mF;*(S4y_&2>pHla)Idv)r3IRX8;qPufh?XueT5-E5t6Pj=Fq^vMUF&tH4F_Gano
zQpT%4#g819oFSZ$;UJhb^UV{bx77#I9zW+@du~OWF}I!foGAx<S}IN$@qJnHIJdDk
zwta`CZ-J}%Nqa%dxV)J&BHpXb71Ukq)i94E?fRwK_k6Pj`lbs!-ohTcV)w;0_nlrb
zs?=5HZP{>P=Z}IHpDQ)4Ftp9>V>=wU`c2o`_;p;STe$Xo5%K!z^D_0b|JjzmjLVz(
zRvwa(H)}o_CZzH&w|v&$$*+XoYIn!($~+;~o@p@k+M4N1;^kd4Cw+S7l~BHa0h@Me
ztW-qJNyT{Og4&J6dQZP^xpZXpF}HB3>V#KU61V;B485H->+#)2hqxK5HuoIqT66Hz
zy9lnAce?JU>zw?Mw&<YLd;indwC<@ETuW*T|F-W?;RUyarLJXDrgMnCy^?#HFS^C8
z?ZWwgTMifhd?!C|^}%DuCT?9&?x0^UdoWu<*k+R6tbN~IUL2N4?znwL(%Ij6R?{4|
zJ-7dSKX!Ok$=_i9V*=Ofes6Z)e)-~wPbJg7nY?|Jzx?dkmiqzmw$58m2t*|<I=q@e
zJMVbKzWFO1KmLuWGpe4nzJ2M#jq1lkg3FgPzW2zqXfF5bj%o`}`T6nD<3nNLllDsM
zDqkoNso1{%X0(S@`Fy!sZ|-?ay}a!0wGH29YIeKwo=*I5F@b6E-dp~{9@|%oZVh;%
zxZob+)0lh7XN6Ulau)Kx|J3PXYvCxYDUi!_;)raDSl5Sj{<<udwZd&DE^S&Wv}J~5
z37=88hwh1wk7nF?EYq~0gL^^Y>I|L6L(gTKIQI$9aWIa0A$5Mrk!p!WHyiglnEa?J
zxYEA-!C@!qea9BQI}mQP^K-<9E$;4*t#dD|d70z)T+n^#yVrsGePN#0t={U}e=g&W
znx@4m@gZ&EotH-M%Ws!Gj^FtBdCsQ0V#3S#Z=MY?{%~h)KI>Q4Ji}ePUH>zqPD{k6
zZl3;{iGe|kje$V|+p6@E{M;P9g38j6*!(#L0yW>)-_YW3a0$G;&(&+GmZfRn)c*GB
zm6wDKH?XMNN#A^S;_vTuxewm0`XZuvV@-N``mrr;`3rS!ALL~_Ep%kt^<#|TUe@ng
z!lrG^)c-em(Jb>Ea|^}iS65%nsw?{)w?h1Z*tMRm`&<KaCUU*_a_7;x_2KVLzwPto
z>)+)b8g)-eSa(hL*Z0RmD@!-;`c+!}|8o=LUnZf%#jy@0#vU=3#ggCf%(-{!!Xc;p
z3yYMlasAr+dP`IO(VvxkqT6mM?C85}{ao8p^b6BAMy@P9RWnA<CoGmhYj0kz%Cr1>
zf|KcLjCpRH!25Os{^|bgdD1&ts@ED!sr~9SS0pNZ8kZ7#<CkEgL^aD6_lY@+xLnlj
zT8^50e0p%6lHJt81y@qN3sWcTZxv;``_L?8UC+g53^$9jCB3=}U-Mk!zs@fnw<eH(
zlOpTO^Oh!YQw}P%vWC5n;O`4pNoZ#)maq;i4>-@h<XZj>p9<&q>?%JOnB9uXV3l3G
zvwCs)BE^rZZD$%u-4icZ?0#qA$;F9_CkR>XbH2ap5a)T}Wx*|-?_Ii8rv8>$6JT2P
zTWYP4xc|}^(*o<aJN#Cd$0u0(8=qF+5peRgRHxL|k2dqev($USqP?ydv-CUF{Sle6
zU`5HnH0P$HDV}>2TrVj3PBZsB7NOf|vL>_JX2Ofc!=<~0r*-UKvV6O8cNj~$MD_+%
z$I9TUBUe^0{~@N|P&DP>^Y<cavjeT=SId-q?b<qflJoa0zE_XFX~eMqd!_3z#XMMb
z=Kj5J7oPjiBcHj7bI}KpOJ>Vn3rt^Z7sz($xccvS6~}`=|Nl4{>cLmrq9OZ4($!~<
zNK+oad0?e;-__VfK1@7%>?Um;^7{;4UJjaf*yg*MwcG-Io=fI|S9dx7DB+B^lX`Gv
zsdD$ir%H8h3l1_k+Wb2BH_$Vo_=sWGD}GkjT(7B@UvCaxYuqvAP3Pg)kJ@kLFOZ6v
z;2j)y);{T`#Mz2jd{^%5GWn^X=F;~f<&8dS26>vqx>${sfnkaO1NJi$%2JDpGxPKG
z3M#jT$L2jY6R5kcxy*3Grfp`**0n~D7+kxUxN|nTzHVo7du3oGYCKUx*YoB_wv)A0
zz4O*M2Te+iyqR)&O`?iX`{%Rz_I*_!p1<G!$Mnw$Wi=7$x(K6%m1kzoIdI;xH!R0O
zZQ=Fi&pP+L>h@mx@ZR2l@AzZIf0m8>PMcX;jn1oFwGp0IUQ$vruhVq0)VY;=&N0Y~
zdWjS)H2%@M(#K)SQp<Pyy(ChaG@HEUiJ#VKJ*uQvqIffj(Z)4|H>ATSy5Q+l@2c6w
zg}fmL&wSpa+THkUPrTHuhD$~b4`=?g|Hxo(yF)qp)6q3|r*bPERNdUb|5eEDw(9PL
z2MJL-{X^yz-2L7uAEDXrYjf?H%^r>i?V2s;X8iPMGvv@%S~gR4#Uz8oP$rAnha{Y%
z-vzk&FFaD`@$R%P|Gw)Jek_bXCcksacjd{Sj^4Vm{?wtKnkQc8KR$15&I{?7W}0<n
zanJS8?y_s$6=La=f<1#XX3SZe^|x_lA9J{6w~xQ(@~1V&|247vZPHoin<Vf;)%EnL
zRo1s#BNoLZuM>G8>b+Xx)T+7aJzYxj2Yeed3e_Ah&Um?2^!mO;#n<UgZWZ^|zwUT@
zm1EJ|zdw)KO?uf`8Il;$EU31c^SxE-19ow}z{rK_XN@FUf>N&ZR{Jt+{k*VU^C_2b
zGH>$v8GSS7&3cj(G0EiH+AZg<KKW5G)72$Ot&LOky2|A1$Hl%!Y?|Szrd0Ok)W)OC
zCNZ1lB$m0h997hwt7aRWankU;^GQ4Lm`x&*j#t}utQB+fUm7O8F8uGl`e*zH>`m*J
z)d{?rqwlP4Vjku*nLSQ-%khP*Pwju{ewF)^xN6s;ZC|<?pPiiKczG*hPMA%UV^?lM
zSs<^>ezRz+?1eAWn&U*J_?K+*I@HCo`|{L1OMklk-1@J4`L&xjH@wnW>@MjRGw<-6
zqRew%k9*!^u9FQt>pr>LEVT5B(l<lv@9s}J?xe_QYF1>tUAsf8;iZV*x9*~bQm*gW
zOLnps<)1ubbhF=}N+FTE^mwCK`5&)4%pphTxfcmM<V)Hw`uF=j%a&@M2U<bp3a06C
zci)xAU#$x<da^m1P5INkBi}53+3{{U$mZ1g^s;S8nbTtKXOkbkSQLBjtFh+qX>667
zo!%|%`xhU0+xKGecG=6jwf!1BAI)0iYm+zgDZ?J$%!wJrwLxdsZNI;~XJX-#mr`W~
zkMHN^ZP~ibJi7AT-f64llY|AnsUFib`Vn*CNM9NAW*r{yusNO5ALLd^1}OZlPc*7-
z;!1Bzo?Rks&G9F$??gw-^yy1Gdl^%_cN|G85~}#lr{~Yu?)B&5p}#7;BCpoGm~}8U
zL)2=*A+;cnWBQI&%5ydxUL4HxR`ueZsLx-;PI{K#aSJ#uJ8AwckNhi7{5jgwF37t*
zt4J(=JKJu@`i(2iX6^}{Aa-KYv_#+ecGuR6zLRr*HSLU!A(OGS@{Y}y(-?BM7EW{B
z(8YGf=V{Ii!%a&Xr`+3d@yuB+k58Q0jj@vF#9gaW(~Ps%9l9U9?qlN2T$k4T*bK%p
z+3k0uPXu4DI(2kW@}4`lo!-y8T@<>+^4oEdx}_)PR4Z98);o1OP<GM;#nr8qr3bGI
zO0SVzA$#xPvr~_&v|?E9R$q9U#b0%2yU+d&Hu5FeR|L<b9ONr2;pf!<x~#_gM^r%W
z^1mA@WoMpeR9>7qPwXXwwDS+Ch^{F;>%-s9b}+na?sx0@;p!u`KVBWp$bZK^KjCIj
z*6*WtABrhi>^Q1x_3LlYm&<tt%>p%#W7;AXYk5AsE#|cseOFwYMyFpPBLhPgGv>00
z+{Elu<RfuvCmCiRHV|kn|KHWj6ZvLBTJ}O`Piqz_DUUWMO{a<Hw{_@pdh(s!|NiDi
zq0>{UE`0cS@8!#R=^O6vtxJ0!w4i84Zc#{_n9y6{Jra6aXTrKujheTbiEE!ebvWzi
z2aa~G#BM+B6CZoFn(_WTpqwuxB(L?-;mVzhE2lmWvi$JGqDY-pWUWwK*3s;j`U?b#
z&m7F&u$F0^p2Af3Y@JJ<o42T1q)Ga|<lPmg!kN5hon&+R53h!OKdVmr|M=Ft=<BU>
zmpSin=N34z&eHR9G5`KssqVox7kOnaC9SGtA6@YskFVWjkJ&5#H&ySztks*Is%~nV
zeZa+;IijyM<i(8ZJw4{kp-O&lv^p#Nmnh%gsLQ<dN?`3V$M?Gf&V0ADdR#t9B+Pt+
zz^=>{-Zv$3ZI4uYDss&`H2-6e#QqkS$uka$G4Y8%4!H8<m9~t@;&;k7S1fjX=`1?&
zU049u$9jR7yJ0@@p>JN#x1Hfu+n0M-ulfD_QuY0)HDOO`PE;Qc14EQC1A`P=QxP0h
z$@#gt;EM2SRDAwzH=+9L%Oj5PPYH<hz5H7A>RfJ%Npn_}zBv%Y$0^gebj8#?hOVDH
zPHjwlvHSj+H<RwDPM<W#iq((bZ0qOp^z=GomC_?>@7v`2&bOXFJVm}=+~&-YpbtyV
z`z4>>|M2+wD*b5p9D$?!oe_6a-dsH`Uzd1U`rN%wCR{h0?tfJ1x~_2C=-t}rwW&gD
zXTH`mzp3_c-RUD%eUo}B6D3mP)D{_p+U&h270Qw{@AHIH7x$h|esX%J(ywXHe5QZ-
z%KvY|<>EtD9brYf-!@76zP0{wE9m-7XPrZ$pM%VDw;q|~TYb6zz1zD7+b=%o|9EtE
zUH3tE&1VnidMujoZP^j`r<2ZU9_mpqJoNDW9q-C>zN_BvS#p(YPr=rYVRvGy4XqRV
zRo?vYn{UayeD%JghPD4cER49RV-r<nZ*%tgqMzwPyKDabc8H&RXh+nk_PAZgu3kPF
z{hjHbNLBD9tDPSwS;YT-b9ds}`ycm5MITZV(m(RlxOAn)OYx0o3TmCi?_S$>byoF1
zU4HR*UF|j>H)$A}OLu)Rj@+?;d+CdN{bDlV_7_^C_IfLxjeGQ|-euQECbN@f+=3hB
z<BXJE<gC}pu{Th9kz*fqBhC;+N8b2%uw%jIzd4D&I|Uune;+;c&0kA#?%S!k-1f#w
zCr+>l+;Uhl^Y!|@(eLzr7_}aV^A>I1zP!HY&daAye?HiL`D1IfnVtO8SE_ICUVZw0
z@xd#y@jU15^K(DCeeuaBrjEs*PhVcBxJ*Mh{1pGa_}E^(W$#{pJo@sgd%4BFTZb)n
z*3_FyL`t?V{(QNA@j`10Tl@J}R=hZwk)b!gSHJDu)u&Id)RtTQJ-ftn^W=WvCE;5b
zjWuNamzfD3wa?zFFvF)Ubcw*tpJ`Xy4z)91%)0w>!{hjyHeF1d0t_<e?(Fsct5Q6J
zLz3gmAB~6H`kw{X2c4+Xi|mZmY%|_m^exPWc@Br!oz_X&)}MPh#2P|m-pre0(B3jP
z=<X*6(^H4}cKvv<Mx1;3={cp_3brlH7yZBNWSh7N!xmp5v6QIij;r3j>EK;_;p7b`
zl{@E~*cq;ctZ|y=x-@9Vu@9TRI{!J4x5uJR<4EU0*8lvyJv}bV0~nrJFs$`(oskyz
z;&a);P2SJ1uFPAuV0%;@!=s!JVso@-`Q3iwD7*8jgaq%u>lIGvN&yQG$P~p2cAY7`
zt;s(vcAJaR)_HnuO-5_{^)7zzS)crKYS3#XuB|H;waIBUY<OTlc|taGQe9-S!`DfD
z;ksu}wjA#)nxwNl^3wWa8883*o@laD@9oXfhgx5*T{ySB_FKe`?SH4QnKRk_uwjJT
z>Ze+DxBtC55mh|BaeLF&6Rs}V>i4GGSvj8bseZnpj5j|0lI9$nL)JD){fz3L7k|CQ
zE#Ams$(5+xeovZFbn3>8m0_2s-Qhd<q-Woc*(#0seQT8G{fg^RwE3*CFg37!UC_$)
zPPYsjSzG#~R6V55I9Vk<Rz00y;goD)_Txg*LlKEHb`Kucn+G1-edIw+QGu=BqMhdL
zyCw=ZFF(e0wnrgyL;c%54WDWs?wK*utb1=Q`|RIePG;WZI25rpXWlgCP31~ozr0mq
zbI{;y5`P*i8ntD?sooXu!(@3FUj;`TUY@FXeb3KRa=dd++0PI>P}OT>ynC6F>zgQ_
z?9y7T=R#g{T7=lc64)8}Z%=r-f75hJ<*QNwU*%dV!ubN?HhIn76}UF+(@$>huMRf4
zX_*;fLAPFd99hG>dfh&6(bdLM#}Y4JOANUGeQWU_Hox1a%GYMkmb8^xx8NJ6orVRA
zyq3u2djUU0CgvGdollDu`<$Y?K>w~L!#Uyma&8tA_U+RWOko#$@JhG-g;9sLkgGq#
zgQai%bUPcnlaeK$zgpR~-FUBl98>Y<Rd0PNrX6H;>AChia6?A(F1{<>P18$+m0Lcz
z_WN3>Pl!Anz2$`eNl*LE1@(+A$CMUWZ;V;CzBFWa<*~k-zgK^@+kJAA#oPM-wkwxe
zvQEnRYioM+ap{&DEPKi)uWeQ~DqACIeS~e!@d{D57V(?BIX?G(N4osw$P01i?F#AG
z+S2;?#U`^<<}VyCPB=bEo$F_;p)>dKLuHoI>Q5Y-qSM0|MY^l99+dVvIPY-M*}13S
zg8ms^7U2jB>tenV#?mWyH$0l99u&8;KF>N>Lh)wz@wePLJzw_E(ymbMS^4nf#<r86
zl3E1(_%*WivmdK;-F_<)>>wU2Ibji7ihE9#<(@aE4@c)Y&A;@fn}f;h`2?OhuAfb~
z9=OeP6>vFq$v#yy!SesfJVn{C7tfSBAI;EDd3nF!|25s4w|*SgxU_tVQIJ?ufYhS5
z8{XfrJ^EnZO0#sU3ky}g{0y9tC-mk1WN)nv1}{?hZH0ACMAjC4IMlxFg`<?J<Q?~P
z^S8hKUNUH`R=HBAAaI|JZJ#MiP3q6<UiSKOf%$80ov`Eko3J@U?#9Q3ftDNm<$@SK
zdhK7~^Fo8s<WIQlfu$C{4?ca;b}KlXZCbi`tu9MfrkWh@Y?Jit+s9^4G56fkDQ(`z
z%rvd@noafchlkg^Jm#`BVb-mKHfO~R!XBKJ6f9`F+~;#o_rV$dGgBY#pE5P_(D?~E
zq9v;g&!)5N)970|Mf~OLIb4rE?eJm!sk~#?eM{E2e5>Xyzo_={sZaaP#A{g#oeCS<
zUPrq7a{sVQN`Ex3E8s+PNcpJ=k8RfG1Q<=}SUP_{TP)kQ48{pPFBX4UWal(}ulIqK
zhcn9=y2Q>LT(ao6#G-o<Uqa3)>xREdJZJy)rs4FJ_a?ueuwz=@*)4&=|0NU`zq)?-
z>axXJB_*f2-o43t<uq&c@rMf4bN{^9c#7f9DIxRI9S!_1`_^!OwKQ~)-MsO;rBLGT
zH4FN}M3)MMma}UF&M7lJ`mSuHV}n7~0gf|k95;vU4m~S*$Ny4G$m$|feO<$oGOO?H
zDbSUZR?Qa;Q(bMochQ<Jr_75Pe{T(8Dr8Y#9lS5m`OBUwy^BNcY%h$s6i~_K%y@nt
z@1(>@0^aA(e>)g*a60qUg{r<a;tx1WCUj}-;uS5jjrcf|jd8cd#4_*45s~a^F<Z+f
z`wHwR6I6*c=?I+4-ng{-PQ}Xzq4fz>nHdURcU*lovRgf^@(%uUV(Ft;-U@|7(c+V@
zT$<c)WODIZ<Ir;D)}uBbH%x!?YVC>2dB#zP{dax)mhmJj@50eEzTheOXIFjj2wu5t
zjhCOI=ht1kv?~q=@oU-!uz$PQe(}NIFJHd?Jh3uT=cBsU9gEI)N0Pqp5LA6H67GEM
zLGdLoe|<Njzc-s2?W63T?^(Ha^>ndQ(?T-Z>%Lqm3whM>FY^uScd31$R!$37E>wLI
zakwnvlB1`4(CmFeb>CiSOMK5<q8_=m-&NTt%2dQ)tH1NX8yBW?x|dl6<u3M0$!9k;
ze7jy|$HJ8lFK~C<5TDRg*glKt=QoR7#?!L*B$;m}W|jM-h5Fdsxa_nfc|nq^vEyUK
zg)VNZn>#w!eA~Ff@fch9ni-WZW-RYENzq>T=+Qpyg%jIno1SfdEA%Ia-{->CrNwSH
zesDax{pxbBvzn!2)|rdEAO0Ep7@arU{rA34tmN4>Q{&XwZ!$~GoRs$_sVnZA;mV)d
zvm$Or&09Rz#-ID<eY3K(om_s!^G+w&<}c!3RG=9)yG8D<ZS*dC-RDV>Ia8MetM2%}
z&_nOuj8aSInPpzz!=KEpdH?M?pVjx}KbK6cKVNo5Sa2OvXwIk7gj)sIeAT<&i=E{O
zIDboi`&adXynip^&QE{DxHptbI^u2P{>m@ME)*YnaHsOrWb1cR+&R9d{aDREb!&mE
zr-%OAQ}^Xf-n^6gx4`v*u4q+Z&w7oQwJjl0cTSeh{L9+9Qtm$IW1S`U-iJGdoWI&s
z)*HT!Bg9f+<;Uo=&y|*(`slpJ^!%cAQjb^rIb@pVZJ%wD)gIQvvF+tnla~Aqi>>FW
z7#Qz(wS8f$>qJhQ^Lz8#K3x7&wn8JgN@LX&DR!m$O)BetGpS7wcs5&j`KJ`YZ;d{`
z9tJJE5`TAQzW$e`OFvh1=QC~Zt2xPYGfU%iyvgfHPj~a%CcOGs<-E;KH?Q*EyOTHn
z98V51|9x)OqR``_+h5k0#?G%g6J}pDciGA;Hf?8Dw(0haS3>NkRa`!wx=U;R?=Q_W
z^X46^{n?XHy;l9d&hbb4n+~m3m{si<Coo}-SVDfZ`mUH`E~(u+oYK$gFG%DPJM6IS
zl$Sy78y&6AhMOAwUFN>ZN#_c9KW*OoJH-8pO1;3EC%dbP7Ot3Ly>V{9`K*A>l2wIP
zDsH01)9%V;6o>0ZH7wydf8F`iJrBvUi++iZqK~~2Sncn)E`Pe`(xv+qb*y{dcC~S?
zn-*bm;LX3g&u9H_+iN~+)tf(P6Q5hFCD&zeGcc^u#L?kQtw>ESEy)KRf_gV9I{)?w
z(Yo*JXRP6#aOZ@}tXhq*RxXxpmsxgq_HJ!{cPOmW&~nT2Wfn2#PHcMhYybB-#!D=m
zgSzG}`5mAn-Z{szSnvMMpx<xae0g!bd48&vmoDGE^hG8{(-+O#WG?ETf8^lnA6M_$
zS%+NRHSM~2+upjb&*g9a>`jnw2~$0NWUfZY)`r?M9Q$tEKApWa!E=)S*-c`ehn_47
z+M2jWXX-<@RYC9HntuQCY1OJwtu1LWn~is0y>q20ebb)2@_Cng%lae3fACzJzkPew
z#k!zfmiB$O?{+)IZvQTJqDXQ5t@P!K{xLY63i7$Ja+S->jCqHjTL)$*n0Q`Y^vLwi
z1gprCM#0*5Co%0?pS|yb?n)Us^+)$Qc0F;uWHWa||0<h(({C}HK7RIa@Nb?e6E=VT
z@n`$x$4@@o{rJ%Tz5T!1UB@3R64uJgi}8E-I_|qkpKGOhcIc#gvrUiR)h$nrf8qA%
zur#Y%x%f9%DTAKu&ihd>QWJ0R{EQE4-7#V5%mdRWbG<#?&7J$|=YwN=lqV={nH0UT
zEaSkW&i|@?$qO#ssgGV=-~GvF26sNM;Jo*5m$I^p$ksjB{^&>C67R)XtIyUlY1{Id
zcrzaNdCFjvC_Z^n^0#MxCw(?c*R?+|>dHL$`b*o>RcV(@TErB#v`n5kaY2Zhx6<OD
zi%Qud@2#9-Aa_~J%G6W5;M`Q5<$U+_WbS_XVl%%vXxCIl2M>V>E?3mMEbh8Z75SXv
zbxkSw!sm%Tfk*RCeLZ4oHmRy&i^K^RK0ZC~%t<O&7M)N()A)D_E1ytvuetA9Rma6A
z4;h(!-N<ol3aj9bpj8c@?|pLWJ~2yB-$pC$gi)r(p-Ims??3XjcjoC?`_DXNnPz$a
zPwLvAYUjdj#J)usz4#f{xuNU&>ka2!v~QgGC;szG<;F+Z2F&X<60#<D?sD6|V!Ey0
zDycs_eL>!rvzG67c=E~4(Ib1y)AItA92^_|B;5<Xw0C9YVe|Ftk6+6-b6D~zgz@8q
zgex=I)<-okEZxrSRA)b<ZJ(Gr^J+J{(4PAryRNHRq`j~`sO|7P?;%5-uO07<#j)Y5
zPB`^{{1GJ)<S*emS<!Ii_MD@_i#WO0O_Q!{(~gyN>uheTi$4{W;`qe&TdB43)pu8P
zZb>f9P<)Y~>nAF6fVV$1)x^co(dhoiBu$|M6%rAXtpf^oG*&1meDc=y&aIf)wZS&)
z5Ep~{7TNp*-n+{hr1_^iU;G`AqR&`&@ZiOV?dJBf>dW`b?63WwUG(eOpSy1!8aix`
zEf8j_=Y3SK8QIn>yeQ+|(Upbo@5pX&J1k)R<F=Z$Wun;&*Y^o3?@N{5Z=Sp<V)x0T
zYKmu+cdpsG@Cwt`pkpV>zAQMo&3D(r1#bmd6b*%TI|^KR7jfZq=f?Sy^nNuK>|328
z`T2}bjPClwHXDi}L?<Wk*Iw$EFx5Dl60tWi<HXfXZ>*b-TD>m1`fQ~}%DH*!ymFoF
zyv<jq8_Qesa67d5Z~wU9`DV{Wb*9}KYf?8a54#hj+5FV@%JNtR{o~r#6PKtK?wxbZ
zTK<soL{@gLSq6VBl@wynG2WgwpYyTn!Z6Qj;mqY*FI8RBXSuc7SJ%k@O0G1I<Bu=b
zf_U16+?kd3nz(LhbALEhYeA^qQ8OXmI}&%jkG1Si{2=C-&uH{@(uoN-@4h^>`;$V=
z2bYSTriE+Hw>-^ZG4fyD`KCwc>kpX=yPNXP@3;Q4DSuJPiOGo{KB{!IRozOzkdYwm
za3Wd4dm-ylCg!_Selb_Zo~q$hoGHCc=%B32Tc+PvzH%5!zgK*Bv#jaSZ?%70{~is$
znOS{-Z+>IbS~2Mml?q<vuW|1$76+d<mVCWw&+E@-`^$Z=D>$34ymR_uuz6*WKyK`W
z9Fe}Ib}V6XGAEBs+r%nSeIrM2p?OW9eV%{e?BC1ce!DN}<`H@C%CusExXjFtVqwB*
z(oK0yf{&g}k8qaVa`lzXt_ssy+wWyfD?)Q-dWNdq=$5QDEm2v|P%hhP+mONI{U}7Y
zd(9pmp4HPQ1p92T4r7fKJU&Z_PomH5Pk~SHBRkQliTMZL+iN-hk-1)a`(1zWU;Z^q
zt_VF3*S@$T*1s)iZNul&2c8A2*s`D~?frvgr#6XOvsBG8ux4pwt5r0W%Jku><((#b
zy-IEExqJ(j`B~1c$rYQ*I<|kf=FaGKr+3G%g#4ckt88}Y=%1cEsaEUhUq{78>Ah_i
zb~G60FZk79uhrhdsCpvEdB^UiAoI1VCQ4?0PQTsLIg1MGLOU#O<e6F&?-nxWzvOzk
zr+IJA9NyOoD*J!(|NZS;vT}d^9R|Br@#&E^^^&Yl%qG76&bxB0X>#$tSh4u)S&^;l
zt-0hr|I|CvD0rYlc$3nSX3;5!Q*2~x9Xs{kX-|~8a9`{OYwlt0iQUhZWMua~3h{nC
zZ8>vm;+iW0o);KSGS%$soOUiH@l~7Kn}%CI`k&rBu_Wnr71!o{LWU14jC<C0$;~XY
zxF1vW`0(VrE!%lx+}>LYuRnWXQ{b(HtR}XpuG3P4wiJ2!8jI|n*EH*Al=-eLCr`}o
zEYo?uLDoIk<QL2C)(^JRUgQS|Ec)@|j^H#c)%41C7U$ZpJ(6$Yo&Oj)oV@0F^2ocg
zCEYvyw3a@#wR2HZ_V;y7<h{D$L;YgC+oJw+EhgkzHC$Z6$tf6F(59i)Dw}Tj)R(8H
z!i}xw{DXVHFDL)v`jfwJ+3Fm&m=@`6%8x4AxE45mK6#OIx5eMLf9{?<{-k~XndLgG
zLtPgozQ1rzYwokV^R9pS&2pH3{<(8EMa}*O<QHA`osnt4FmdkVC9^^|3GvNc?X+~e
z2-lW4F4@axq6>6ekA2v5tas)umX}jm`Ybe7KQcAfQ~dp@^;O7`U}MeWmrM3Uwxw<R
zm+_O|Jw|r@Ro*8Vvy%CQy%LwN%V@a~)cG-Gk8RLKGfS@dec`_jFJoNqJF`uC;mspj
z>LN2zzv?tF#a&hENa|S>%CU0oea;<cmbP9x5&1mOVv%ZY>kGL<XJV#W%wrd+$lbH{
zZ&d#LzfDp33J$9puXz4fHgRAQ*xyoXBU%#uyRvh=&~F~2E%S|e*7<cXf0&UyTdh!t
zds?H-Pk*0|kKd;kPBu8Zw{y{HgFO|cAC#Y*IGxeOtrz}5aN6IM;m4h#Rg5QI$QHC(
zo_a{$_wiRt4HboEX7+%?!Vepy=QDS*mA}1~yFkKv)AG|2ue3DGK0Na{_~iD}rM877
zSHpC-DIHsM#$=aHNTJ}O5{EXm<i{oZrfmK=Pg;Nd8O47#?5`$GZ{djhGU1)nj#AC<
zJ2!^D>X2Wz<I9{CC!@Zsd7Y@{yK<9Yfr;T?`IIG_KQEr_|NOp=`c|Es&zG0Czn;6W
z>c!-E!9~XpeU?a>*Cw&wV_U+{TFs;KEYsF)i@I}Yzv4bE?cR9{H5&}hl?j!4$1m1*
zm+0_iX#RHL(CWrh7JVKoJ?EJ+-}uP+<lUsqNUs(N{YgP<G>T0R$9!XbuqOCa{IQMq
zp3QtK^dYgi<2-9w^k;Kv1DV=9XXg1<OOF*E`gNA^fveuCNBxc6|MM8m9eZ@XZ2H5)
zd=55lH+1cCA}W_e6};;3RQ8H-5z47oJa~ig_d7?sI`Ilylirl-x3@FIeY<1KUw@TY
zGA}ki>elq`$FVQB1x_knbA9m}yV^O;vMJjyyk?uW;Zw9y>gC1hL62jW{<S^+LG+o#
ztX+OZ5l3!|g}nTxTHIs5uu!=0a^x-X?T__K?l#x3**EhPt&m-HBzykerRK{`n3oyy
z?fpM1M{TFWipu^|+|~i9KR5a84PUl}eaQ{0#%+J{uHBxmw{_08;>NoQOmzj)ytlo~
zl<e>BYA`Ks|CXowCFFWw!M%pd4ALhB83Y6`|J!$Pz4fh5C--HX$7B@`+~u>{vFG+3
z-al`A9(KC?v2<}i$D1h~)W>eym}2hzedV`$nT7KU8+NZ%zP)FyN6@c{!S3gNzrAeX
z_}$#|KP&1yLw%|AmQ%b849!NEGw$GdhP2F_)Wm{Jy@JZKQrY>BcYNGk&$>}lVdwJ<
z`T4gPEET5vuG@J!S8Vo{8;43ux47KAb7ImeccJo$|L@II)C?4Qn^GLUg{@4v)A;bi
zJ(f=xcmMnG@AJc@JuYFLhr1(Ew)!m5=)d84aPd})8u2|dWj0*ib7NZ3)^#^`o9F*O
zlXtD@uhJ@;<c&LoGvjg?`mZ+St4&^V#$1PI^0GWH!8V_~u03lc&u`lEZ0niLUWZu%
z_uXXR<SqEcy<aq)f1-v!#<F|$87WfpPlvqte%Z$R$tumx3ogmmZabxEAJZ;dtjXT?
zLhWq$tLTHTOSPt_Jy6~w^+!L{eYMEslV8s+@9uwiKD~Z_+VPxsuF^AZ%r;yv;=1c-
zyJ~;l>q+j5zJE$S*=<_4Q#h6NO=b5<6|c%r&1;3C>hk)1YCLrtJsjMOCYMV5n(8rG
zGWt=_;fSUe6L+p;IwIf4{?_2b6}#__6^e&d*SEAuE!dkDw_sXRKZAGu`+HTjN=tu)
zE3dk>?BZf>3x<F^PHQh!jeiBr%M2DVAG+o4>bbe!<xgwqy(tq{^xg0+&|F=0Z+i=?
zR_en;-8qjX7JTP9?z%|hv%b<Q=e0HsAK1>^J*C6v9g)Rl@UTss;qzA3gY(6oZoF||
z{}t;Xi^PMcxhyZ=PiL+u*{G;fCw(Y)3uCDBgR%vOE9Pub+a^?cW3uMWTT^7~_B(Hz
zdvPk$AM@fBM_u>oSAJKi<$W`Ih5uUn`wqT$LqcPBW%3zV6^Sy4F5LFL??Stcu)B4w
z(v3TZ{@Z!T^X#|Urzy?h`-m}2^4az;R&%$Uc%qT4eep@a^w0M={_U&ENH<84oGcpL
z$B=M%{}WZ4z0L2XXI}g~`}pyjc2OxA`<dsS6DSv`-ravADPzgnDTi1(W(6c3R}ju`
z(%&m_S&{Yo(lxFT-R-yBXDH;Exjq#>(8G9t!HUP_!54zqgj!t+-<Xyb{ZP-pHPdNU
zaY-(R$L=={YCNB=D{NuibjW_6=<1WdcC0y~F#qShc9}Dqv<@s{UECA0-c(@mR_DAA
zI=3~8XS|!SW5by$(ML^k2@6DK*mEEF;{AU9m#+pt9@~5P)H67-sh{*#bL3IJmK|tS
z(O$Z3GmCVbdv-jV<oyoDIY$@C@alLU%vX25sraLqrSx24pyBG`3EpDXM_jyWH?*d<
zEOJ^LrQ(#VvC{Fs-8oy<1I%TdtJG#4u~mGhz%1x0mUt%n-Q@#YlK(W!z4O#aZTG=T
z%6VNOZhOLP!mNKTy2Ds6%=nP`@J7WoKbw+P-MN;n@Kb2sy21&jk-?2W1loSq9CiGf
z!F)oiM(v-@N!bnGlWwkwxOc@hc>Db1KN5>{cXD?&T&iE>HLEfETfy$>4*K`!TPc)V
z7_R-uscv>;!<A+hq4tR^pL;K<iS09GTz^Pu{gY<<w`=EJ(ztop|9ZImu{dX$Gka?~
zEth-}t7UF`<mYfvLwjbZDSPj)qGL&tSA)f8bS-kZ>Y2KZL2T{zKCM1a{`0)X`7d>9
zGLP;^)LeAhZ;P<b)O*a=iw)LG+RRV6-KxwsEA`7~V_lAwJr6cK+19puj#q2TI^M#J
zb&lf2{=Jp4i#EKz$Ed@bIQ8yIVRN<I83AUzzdR1y*Yc1|Nb1?Vbj@xCo;gi-bhx-Q
z6U0}9Z9D0$Fr(;3%9_fwM2SZ-N+QpWoKo5-_9yT30q)4Yi&reF5By{D_h5G0b)LtI
zlRI*?k=iMd<t|s3n7T@qWCjEZKfK0ubMlt>?usnIh8;IseUh%N$xO10V~SbE8qu?f
z>kP{WeU_r9Wy>w^u$T+HI3n|1-T2m0o<9q<l-Fv>ywP9_*!9zGdw>GVy)Ew*Plp}X
zb6J`p9%sI=vMFV;yrK1HRgcXp6<-)kY`UR)xjOejnL*OLh6Qycf?EzhD%zk~Z1jSo
z`CO&$j=FPKmabi7maYEwWtisGD}N%?TUHz8b4^c6UlVuLe^pHQrzM{yi}#&e6UXx=
zQFYV5Fz@b^KY_>iUp@Ay(!6#}b$@$e!j)|*YaE|<?~}QG;I8g1x19$H@&t~H^1g`L
z^u9k*D<M7ctZk~pG^T#{r9Ee=)|`Es<ilMbQFmgE;JQvW7Ln<jeg&p5DXn&>wtt?G
z#Anu<v7fnf;(nftl@c#?mvswjNv)l&u<9u*OJHG#n)vQFC2f1o30z2BVya*G^mlH-
zkDHREY14#zo1&+vdL7cLK6B&x@s|fS^C^5wFm%{y<GV6B#85sYv_ap=;#Kr4Hg3@y
zHx>v#%M|cx+;L#yhlT<rd7mrH6Dqr#jg|+lpZqW4hqIi?!Rv1hDok{@$>6Jcl6)iS
zq>uW?R_D#kk23fJOs>@BC+Hm2o~kY!8D=_V?oZtpake1|q76GzXZ9Ef21S{!)DkNf
zjs9$Hs36|$aV*QeL38SK)%#&vw2t_umT}*d2>QY$oKx4YYSOaBH08KU#}&P$qI<R4
z4~gUoUrJ|lapYlTU%WHE***7jTg8<B?|w9g%uYXGa>c1<(xnCk38`%g7Yi1|HJG~Z
z5xUwV^uu<^oTw(lhldI{3;CWpUHc#+Y^nB@tBlWd+4lwRV%J44tva^MHF;%>Rokr(
z*W0{U!k(?WxA7&{oVn9$T77TtU0CpLY9-fE32VEyB>9;i?`%B$Xj;<2JKiR>(-RxR
z+Kwces_HMjVa=%fbNhw+i)P#AbKZOS^t!t~L**g08}EHz^sGuQoVp=%-}%$G^Jjkk
zGqbqw>Y39Sy6=ztkGRZye#g$LdRNt->o;n!<ULXf__+R5_lCN&M{L&~T6L?Lk@r{b
zk21{*GnF(BZM<W4)%2%Ez=J{^!wD~6U3YcPE9mE&xZ-IlcfV=Q>kZl&$_)XT-L|jp
zJmgo2J>BBIs@A>m_rlXU5lftUZ*lK(b7bqivO%K!W=ZF#xM>H1<MK9MU2S|@V%jS|
z>5%7k>>6eH3=5vN-0SpbFSxYiB|H0}&~I^J+pRBN+p{Ym@?r2~rB4RmEelMJxO<&&
z|6B5yA$;P$N$IQG)>r-Eb&knOXt;g({QS8*%I8wWOJ=ao?$+OV=8xGWpY$uif=rvg
z%sn%kE8ENJMbxs&5^m1qZne&cl!H@d-Z7r5-7j^<DX-=7hWqJiK2F<WUdW~teEa$4
z%X)Kl`<Qt<L;2=?R~9>!a*_FP&70pPfzJZU!<G0hn%rJ=m(B5Vf0*s<>%CsKC;JRa
z4)|?|G+lhPY4&BMbS>T0Iy{VvS4wFq>}r|AB{HR1YFYdWUFojc9Vgq)8eD0Ph}v8o
zxnA*e(VeO62RSO;@0qR+{@op#pS%1#&o<eg%MYplTXglELyP^2he9(aGM+CL35uVx
zxGeERLH2|4qY6r^rkfZ=<*v_LvZdI^IPyGy>@xR`Z_}Q4Soz)hxFD^iKj6&6JuCij
zImv49zt$Di(#+hka+d6)8;f>#hE5K6`g~gE-_Y)io?jN%g4#H(dC!KquXWv97H4#0
z()x_sZ&$n!?!MFKo0=_hBlFAG*E6QDTEF*{?6=R%-YI{yL*StGyg3$X$>-iCY*G-u
z{zT?>_Y(az{~slNjCl7m`)%RZ-MZy6miw*Eo*CY94BS3*tLw&FwkejE=bc=!o-vw-
ztNE7rmF<Z?OXem&YxvahaN4wA)91bpiO?$)GoS4{zh~9zcdnLemTdSr@d<BB*xasL
zJ*>ZXFJiwl^Nhu$Z!UY1#f9xB{C?n~)U46>Vc%}%EsIz5YJTZu`R}qi&3*kd*1wY3
zof%ReuIHTEzf?c@WT8vyjlvt^R^KGv_C2}Oe`d=K*@auWw}t7*w4V!Xf6~eDAv$u|
z<)6zf-nqY7KI2-h?%|oM7cbS9`SIcVQC;0PiyE?%FSoqZ>wLBR$g(HxpIlukLc3!&
z{#_$IXI<|N%Xv31Br=GE&dTVUI@Rh)kh<WmD@^=vuGcQSdLpm-1@nZb^SHg1oGW^r
z(b$^%``oezSr5+IZuVJoQ@mK9;QPrnGW+&N@<gRJ@lBuUuaKTP^KgoNx2~<_o$U`o
zO|`1Ozv1}G#@#S)<3XwXPga~Z$+NGYI>ERmYUTMAj|}%sOIWXE_3A8>qWwjA_Ra2s
zHht_dtKJ%TRJQFsD)X$&<v@P0&_9pB#r;v?*IGmj+ulA~xjQlU!fwY~7g9PckDH{{
zzvsE4sP9mDEA7^{FLARk3O=1Vi#0>*=k31j2k$KmIs9Tz^A^>#*3An~l-;|j^yTAP
z{rf(t95<g|dV6-!ba|iCYcgI<m+|25)4l6{>GD2L59jo}XR=2MR1!SA%K77)FUZ@Z
zH|#$b?0xorcGHceOmi<;-Q0ft*PkZ7oTV!hGq$XaU(;Av`1q2@J=N-+lQ#Tp|5&|-
zZOW<_OR^Z)lUOY~cYYGTy3XeB(<je2e|Wrn_55>w`G@w;t=+Y6$FBz&@$Ys#<2>@N
z;ugpGxRs^nm+cRTnB({0!<F4~X|YU>4<zSK=ee_1Hz#%f8rAs{#Xdz0KUzQk>rd@p
z_1`9?L2uEQl}U$7MGj0{9ldd`;RI*trzyH-S3i`^h|^-2oqXZlx-WgNLhqbsyt9*O
z#=7@>RxwO{rTl)aPtOH;*!Qgt`5#_Y6#KQRb06Q0mr*X;-xgk9%^QF6MQC}g%lAu`
zZ%<q}$o67W*z%aSz2=h)&zY2H@vrwx+>&8?dGCb<nn_cRp4(k^syaHW`yuDU?K7nV
zUq?=G-j?F&KkH0KaH`P{&cmJi%KwK{_8o6t$aklC_Ph1bQQHn)yzAa9av}ENMX$N$
zio*P?C*o>zH_FFvv}hOTSLvKk%NbP7f4A)L?YgP=&vN;1+!brS%fVdMEn|D^uHtxx
zS(3WPDz*7iEK9Rq*rRp<E#?Ol#IrLnEEi{BkY!+C$W1NI&jVjhr=JY&0;Z?tr4}VZ
zW@*kw#OFV<5U7719C3Xr({_`r?{9D9sd_o{%eKm0*d47Xva_@C4clyQAMRDZ?&cr!
z>+ogT9d+09Iy=|5Gx`6jY#tjM)$REEdXGG7&+<2W#EtY8S00%pmbpH2L&|gcJKeV=
zUv_-e>lE|$w2O)P=cMNC_AXM(g7c<v_t7fW8W*EotFAulj1as(KmUnZ;y(XHSEE!W
z1)OVLVkBg9HY3LTezanUjP2BG$s12xW7-(ixFbh7;^O)<{XzCA{<B?mqo?jJJtE$+
zEG1~QYq3$G`h0nt{hwD~|GCzDNA^{YKbaOYFEp&poU}>h_?tV-&seU@U#T*VUU;(U
zWRz}7@gj*otdDgT2C3NHUMD<lSw?Vd<MVpX+RTX|YQEW_oVkL}112R;{+sikhh=(>
zcJ0myx(1m$+~hA+ypnijY5b{^hb5ggyLnFhVy;_R#|x+E<O<)M?Z6|P)%7WE$)>9L
z7g{EY>=AwMvE_kMqT<YMm%^1#H9DTG^PKjGb&`_e$_T@wlQ--)4|H1_UTPxxoNWqM
z#;G9l@Q~MqZZ@+TRDQJ_Y|JPMTq$-?e?n~+=ZQJx;d~dExWf}~SgRyXn2_bmEg;S5
z$6VMYxG(NSDUXSU&tt0{VXha;miBqRS?|i_<M8;LvfQ<~%P!w|-z;Z&Qgmm=&7BLs
z7U<3SYt$Va=3DYoL5ySOHY10QEt9OyvhGozzIJ9)z>I2X1(uckeR0>1MyV_Rye~0D
zzCwIzi-MM|V(6=BOMM^h*|&F}rQVaXU0xd&M{e75am9w%RlyI}3vW#8yfe4siR4e=
z&;8ayAxjKZVs=Ho&f3%ybRt{M;L{-wjR`59^A(r=)U%(mto}fJ<-LU#r>mas`)jDi
z(9?c(nc?0iA-~=&eq1LgxL!ISFD;4XIlGRV^XwEZzm;zV6Eyp?xza;!HM-W_3EO(|
zYMuA;6UKXIoYi`8`Q=le&J#kyFE6BVJG7@*S=-c93s1S>rkU_rBTc<&sp_-1Z7R3+
z9qB$?yO6W}_X4~BFDG7JK0{EGqk7rLHm@Ii<}-G=o-p=R+R8gM`I6k-O5y#tUstaU
zXQ<m<c4xlS)PovMErM$c9<1STGzeET_`|5Z>qms-mEH9ceQNjC-k0RtwRiXN!0JoV
ze8>7WUE|u8o7cBLRJ1HwZN6OVyoC?mz7gQNARv;IotbfecWJKi<MX{iyR5h0JNtO<
zC7H%kE9X@@Ope^G<Mwaj_3yWm-{0o2eAxNub8^M9ho28Mepq^c_s96gKW}GGv^?`$
zSkX#NsXO5ChV!RHegEWV1sz%!b}(Rv{hJjvzx?+WDLjd;J9+ZI^!Yazy|YAEoyy&Q
zStTl(<!=vESpG_D-VWIvxf|a36f$~g)g?)P&${Dl?sTN5$msqDhwbNn&MP*S`8HRq
z^W`heB`LQLaR;n?)Z{Sjiu8(qs~?*bGTZHXYo}sbBU!flNB#o4wjVclOY^wT`)B)-
zPo91IIcZ1!0~h%&PxsJ!eeP$S_WpeR-fdSi54SD#xwhj-VQo7v_dmDg?*dk@Eff^p
zzP-^*Cba3}-TsEgM^o!gP2|evniqFH$uRZ6*X4I}bYjow7-YXce1>J;hET(=d$zbr
z#iXa`2+zqe;D6~T*Q2id{`+yWXHBo7c#kB%uCG{ZIB)SjbGc}z?r9fyHkI5k)0*+l
zEw1`eZ{NpQ`NyZHu6**Vq=!4y=4@5z6!XhpOn#T1i~IJ?tHpqe{nSI&s`?-531uJJ
zHUz7*ZDjA8yYR&0!_KCeWlp*a-~MQQmvGGM@>#F#>gN4>?WR0nym2A7+~$qc!s<?^
z>knS>9-CaYKR-B-SG3S|-STy3g{N%P*J-%d^XY;^hl=O)B;oc0)3^>@ec|TlIP1a3
zOP`fW=6ud@++gcH+hWs9jt==vrdPO*F|U|(%+Tt}yNYk}64j4%N)-O8J~c93eLnWS
zwY`Sab+wxGiu(K8zR!O4@5b);rERq<o{ODzKQ6SkJ$J<i!z~jQnp(e~xJm5N@73n>
zdRCvh@y%m<PWW1$v<v&b|B2hql~*mahUs;pNlVR~8n!9TKUes4%N97c7hX5X|5;#{
zbdb$$dpeu&<$WvH)rC2*nT9amoOpb4(dzSwb|Q?uo*`QjpZrz-w6KFcuIngEfBnrB
z$!i)|su`EancPc%GR<?^8l`ppcPDd{yPUcD-RZdP&(lJ47<a`?obj>BDgM-6eH}mL
zTGbfqr*@xvDs0ZEhU{E(<Ri=Cm)DE>bF>`Kom8Ed6a2$^dBnlQ$n|ldt4tC!mwhQ;
z*=*MmFsJKz<ED1rozp7Azs_lXXRj7`J8bjcUg_y!KaZXMu256plkjWtZ#OSXwo9qa
z{L?k<-iU6l`6$Np=Vr9WYwP<?o93__6MpRB7_z4{f+bQ;x$*0@z*Dt<o*&xTd9Ceq
zcccB?_mb~Eo)NV8-fsF@!EDOZMa8xm(*<kyTe^OlStV(3<Vk<7PIahFY1Y53K6aA=
z6=mKtO#Us?)#FpPVrs|yk6rysSR4GC?$5sQbi*OVL*=U^xFs9R4=UB@F@4w3jF$*s
zrufQW@!6bnH5^m6)}!5GWAec2sjWE!!_H?67`NDfYi872Y~I%XEx&zY;)D0Uv^PB7
z%Wkwx<M!maDyOpaHmRKdaBSKa70bz-;q4AC!A-7AF$`NyWPIHpANut>yThq@ci!$6
z-zVA4vTOD3)vH&(UcEZrW%~2u^*3wh`$q(Bz8iR~OKtwMHMjct#9uz?d%I6^->phP
z*{R*7Q}5q1y*N93{eOYjyBl9HuRg7G>PEVmws`RhaZ{bS?;Rel-o2+!ZS$74`qPU%
zKQHQ&T2VOp+E0~PdflFrr@LC6o?RMZFm0nw)~OXyVu4X>7VpW3*t$aE5BG*sTynF{
zmoajMYNQ{Yn;Cj;vC2%n*{Me-shoP=y(w#fTcDYyS<w3rMpraKR;Esj-0Gud;qY%?
zh<?OJ%k`(4?BkZ4y{of-;`?(CpZEQk=N!+ms3ySh=h{g9Pmj#JUcc}%v7a;Lvt@#}
zh{dl7_cl+y+M>ImpZVW!t+jcP#vN&yg}Z(7BaQsUn=_2s!#Vdf{O1l^>KmyVu%XSo
zJf~>>hwndJwwRnv*NJ@+7X1Ff&4)idrX*;aMKZ}OH~+Ixqgi?Oor7m0Th~3g+_<j9
zQd8XL+NvOl;Hax-*y>u(pMSYCa??UV?K9yH0h`bJ@N{~qEb3TcI>q(*=1*k;XD2cx
zR^8eDw8?*Og--X$>+%V=J~zqUo$Bzl`Nf)35l1(9AF(}GKIyt=oJwfqq2{i$4SfrO
zeP=$ooDz7gw9a_)W7)20Do>1m{S=Ol_D#>6d`jr}2ibIIF@{|c2hOj$c3(vBy6J4^
z=+Gej<(F%YX8B1UJ8wNL?b`28&n8D&?KiADxS^u*=C?&!`KwFTN!dg)dLG_n^Zb0N
zIHUD3fqQdf_sGi1&!3|f-Y#xGCq{L7yS$&?)sD9>-@kSFuv6=Oq~U_~`H5fWO_O}Q
zzwg2A+mV(#ulL{M{I+1eOjzhHv-*2_6Yom+Cj{kj|GpWm5IRjNKyNme*wTNtr+VJI
z9t->Roc-FJsmESle)^{^lx@Y=Kg;HPy#IIZ+_^PUvApZ+EbTq}>TE23WtRLpY&SJK
z_LqCA;o1D@p{J(X$Nx-k$|^m(?dg~1CoFpw1t!nnxToCJ|Lk+>WG2DA=U=lu+p4Ml
z^o&mZWWR(gqo3gy4@LjGt)nHOTv+94`0FCy{0x^vGB0$y`54sYxg{>{$Xmr&^ue)&
zd9sm$o>f3g!P^j@v<sn&x79IsNX2dXAG0axP|xw}axK5vpR}_)wwQ0ShuM$&`i?-^
z=cY>PUg?`TUWqj9wDM}?J(rlK_MwFLHsiDti`w_>>@F+M^h&5d$)Ihi#IqpANbIiZ
z*+uv6-&Ve7s<S%!U+(+9vtrc;oFeYNsr6ee)A&}l*5c1g6-)bSd#hinKYxCBB%+~a
z`KzFgYyQJn<N0r8`t|tl?<+qY^X_m*->I8D7r71=#vax<Zt_opVNcc9XZIg9e*C<B
z|K_@Xx67}ce;;?#{_U>&maVw~`|Fec|7rgD`Kxw~w}x61>pkJ67k&A9q-S_esbe!c
zUU2^WjkBM=iCy5^vXNzz)}pG3;Q@U|T2t*#7Z|6OvIraPyj}Ub@XNm$YM%~2v{ZWR
zyvw2Jxv|cLk0*XRE_nP`!)}>A^JC4Tx0V0Or#*blZT4I8nV45^SEeNYB9F3N$M(Mb
z^5e<d<MI`$H+Uoh)~;}kXT4$BVZk79zve`@_YW>spNN28#ypE#9D~FYR$SgROPIOg
zs!4hzpNmoSdz-g!IJWJ2YN5ZLZ@ruQ$=?@mcOUMK-@tC#WhcDg(`>D^*EV&_pX;+{
za-I3~UC@I!C-<D0W^6j?v^>AQUmx>PnF95COUqvstu9@uJ3JbX=-!{d_iwzqd-&|#
zrdE5cc2<;Eq<r;xlf5B(ee#hLPyH7cZ@j%_ZR3x}S6}>n@oKunig#~+A6`8FUccV@
zNsBl0KVSS^UHs(k@9oml&c8dq;a=jY2i(yIjl|;{L$337aBqK99y(R@|E`8u!Ir0-
ze>c_HoH+RQ?;k1oH-G=M{r@@b|4-fj%C~O+{;B`P{kqlTt>-G%ZkGP1{<uEx=lnVU
zSN@#e_CNBYeRiO~?)$yntCjhL_xU`T9#t2)s;K_2tnF{@_J7v}<Bv+sfA7BBKDY7o
zUQ6+f-@@;I+_>ug{{QEG%?&GlZN7WvihUngZ6@6RwmkFhnNN@I)oc;bcw*nZDd5ZY
z>Ee^S9-f<W?oOc0UVE3e-*vAa{wZ)=JLgYC@snDMb3QhOZ`cf2Rqpcslw;8|`~B^#
zKv?UWpF-QJf1k{qcAH<W;jT^qqtU#p8?IVRaA5i*ci`PKlkI1WKbv=G-+XgTZ*tmv
z$E5=23+9B2w=bXmJ|R|i{+#&?-8QyTb7R!r>z%XPqU&Gm$;_bmMEvC(Rngt4+8QB-
znk?T}Rs7jMx#au%_TBZhTYtB|-m!o3#>^>KGAEiJi0Qp$`zKw#GRgkdU%CH9H@W4R
zeb&!S+`H%HQO+~ccCUjYC){6Qkz=3uP;6^}jv<R&n5pS0roA&#e(%t~-y0vx|Jmwv
z{^w=apVu1v67+xODYJLU{4abZH&a7D+_#Piw~IFGPCcAzmGDEx&D8&u(Lr9}axQky
zz5gZp1nu>I>;D%ma1rGQTyWrt@1!qTX0!QzxXntj)cC4VExGsb_ruS&ImQ;>7n|Pl
zL$rAf*V^W^1J-RU>*Zv1vnNbF(w%*4%DkK#t1>H=?|a?1EK=<k$J`tLC%I)_^G|&E
z+VSq@(%uaL&t&6ycgD;;*CEy^u`=ChtIvWGeku7Zr<d{C0S=OtyxnU(9iJUZTJYmm
ztnmcR+kJ6P(i}oJg&p_sO@H{8VI|X-?`rdx3E!I?YR`02AxhC!N#f_GcP!0m6VngB
zl$zi9d|TivL5|lf99$U<9NXf<HdrJmO`60}+x@UcG(e}U|7eHYnr#U;zH3YtOMQI7
zFC($%{lu&X?HdpL_|%#gS~|JLFTK)j@8d0ZJR4j#96PKZneqFY!sly_&z7vbP@TQB
z`mpGo6H=w?0yX25SDEnr_$BDPZRdyeW;UDSb1lA4H;zBTW`E_;%VqDX?wVLJcQ9H#
zuy~YwJ-WleLX2^jlgq_@0cPi)$g3^O-En8ylm&{LulN6ZdO&EGIkVt-9j$3R59O`f
zrEhLrwwZH6_PmALdd_dOXD$zyiIP^jfA(ow-CKR`%Ph}y`RB;px)wO``Rrc;<}dfW
zUoT*i^8DzeNPVtv6FPY3xitK}E2&*&`9Qy__HJ0wX~s^jTJD}kg_Nn6e*{jema=>1
zU&z3`>y(>Z-di~h%>x0y?!+<QZ>zDpRVE#I@3GX}Zt?0wosgp+bSJ4STw1#DR!jP)
zz9_xxylWPx{#W`E&77xQvNoM_?Y2A9a*ddpIYTnKdGj~vJzJpRezyBX^5n_8U99}G
zw#+;6&Si7aq;nZ=XJxadEwGGED7w|>Rg<=9XO?V=I!mHP&zHUbE*SKF&x!QsZ<*My
z{Hxe1dXsR-+}sn~2g1IqC2uNK)lkzl+JEz=h3AGRi*^1@QTf={JNH0N-VsqF-MbQx
zt}ifb{IGIwUay>^V1`NMk)*?0+{&Hyz52Q_|3p8B%<QXYT%Dvpw(h>&#-BCod=j_Y
z8rHx4$5~Cjx9+&HXmM`D0=HP50@gD(?|r-dMbmHc?`^mHMCX5Bd}BigvoO2b9FNOw
zZ_Bt==(bokFnP4pzdg>TP?7s*Q@19k{L|1^)9X^EuUXxB;gpNz#|5#~!cVsdrB4;9
zo~^NDOU&1}?C{v7Qw}ZRUg_R<ZdaT{>xb!o=iPXlv#h&={a{dxX_=+cm8~ios~Xuf
z5)Yl3*_igbazS4~ik72?l-oMy)a9GMTx&f$fA5yt&iM*^H#F)@GdJF}<y6(|sIxbi
zTo)|ylHaD2#ZeMtR&venw3s@po%gn_Y8^M)lvnL2etK4Gy-8gv!?PPA>q=g|Qw?rj
z<yiLKntM@9nDDaWs-6dA_dhyxd%BO>p&gD#eM@3CXs*66S9H~U@yR!hZZGowDkXa@
zT1;(`L*#eu^b1T;_iB<3^fdk}WtS;fn008v)G6Hi418WsUUYCmsHeb==>6S!;+CJf
z%QfF<%<_nHc^=vs>#jFnFWoo9Y5r=PWTQ5PSH6>Won*V1vhhKDgt4U67G-VKML`Sn
z-6k^`K6&&g<xFpj!iA-RCzsi5I9MZ@vdyu0h1P}pnab|PQ>9ZLt>&A=%G@_sbm!ee
zi?$`k2XaNM*bw^5)kMpqZd&M??Kd|1-`E(V8}9EfoOO4(V*3N}1O5Rsi>s|&9xrJz
zuG?Gx_Ul)P#}l9JP=6fr$#e3Imse|-f8nf}s#bGPb?3=TcaHbv-^gNIGMC%G-sJ2}
zozDUK&MBu_%(=8#IMOY&<s+`Xe!p1lz}fg5TZc(XzBf3urJnK5zOIndsy@|CE+f6e
ztUsnO^yWQ<F7?9w%+{axtTWVbG+oes`uWD%U9UAGf9Ys_O4Bt7vF%M-ljy}zB<SmK
zw?I(d^g`JFtuK6!UaA%s7k?ubCcQf2%z{nQD-^h8*Cj{%tbaa5<%iTKg^K=*`f_m_
z_F1lGTyw*E!K~o@&l{MT+^?-tIxwp_`D<6NV8?0iA0PNP^Bg;PxGd}4D}Vdx2VQJa
z4YHO}Un8Ydqbz^xP;b@IT>0I{`&TcInB80~;J3^nzc2Bp<qNJJ_S;b}-B#2dxUot!
zcF(-_X8FWL=`WHO^;$6*vVEI-X_8o|`IEeJ((;q^Qh0**9;^GXJuUr8wu)}eMyY3C
zpGv*RuY0>a)r&v=+B{aq+a|ZU1DYP(-SJRy>*ozY^UqwY<89b-@3v9;wPS6{0lS++
z<w{SAacpu9i**libY8@BvDlPZc31g=Ef%6?%b9;4Tc`E>&CW?4#|=*eE95Vz4E=ME
z{fBthLA9U@(wDEPeo$4kIJDk8>->?+mSMIGi{2!-p8I-d`Jq3bg`?Sf>_0iXDL7wU
zcVm&zs<L*a|L^<nT$(W9)jX9Cy>s@Qyj=HXMazQa?^`>WUAAwSztjBQ-ntswiq9;n
zeE+if|K0un$NvB6iXHdg^VVNB-@CedQ=V8Tr%MobGsAaV&uGz~L9*KK6%JKga>=;)
zTZwI5+&zi?Q;dQQr^Fly?y|W3{ZR%p8_T|@O)ZQ~q0PT_*R4~In&_?{@0L-2=91Q8
z_Q=kC*XO+6oz-SpKD#+$XT&)Tvy<Xn$3MCVE%R^qX>2B_+7g-Hkf~#pQh9T#f8w>-
z@xR}mVQgC5!y{_Rqq$+t_mlTU)$iPW?7Q}v`JE?!SIXZBe6GvA=HQ7FKR;~Kn%;eH
z_6CVSeQ}96Psb^9PEFL=5pp@DRG&ZGIda*_D?A<wZ-aQ<0{LC<B(L8pQunC;Xl<aK
z$i>I2)!#UOIs5qa^85)b?%Q2E8@C>Qu_`Kh%Jv7VuIAn0t!!iG5Q&js=KsCeVYQW(
z`s7s8p1MWH%pHUb0#ce-KmT~9DfdZYcU+%i@q*n)18x3<JahF|Tz+4^gh|)Y(tgJ(
zrd3UUws<$Kjbf{7>RMd#>WRsOX7?Y*zq~xbKbvt@2CL1n-IqUK6m*^IE3Wj1XWpC>
z>N<6=9(;+><m2nVWpGDq^4ezRC(m6=BF{xmZhobZxlk=_{a%}(KkB@~=e<4Lt}snF
za!`>|&>_+Eu$G>|B<+YmeQl9t!I!p29XKc!yRj-zO!Cs3mNu2G@Ae#H);w(f_QdBW
zeH$OJKa>@cl%D$Qis{0&3%lP&FXz`$d9fq*1FK{E#6=T%PtBgjEhp;Tp*xZL@R^Sv
zUUaOOAYt79yQd~tqewk-r|h9m&Swp+EIuf^{+%b8lJ(_T^4YDb>ohK#Ssn<}`ZnKN
zVBOYhXCy5}1^RwhX()@I*&u&fqw+S3RniU5*p6iOTU&K<l6O6t`_kgoqq1y;b~V-0
zjwzfO?EB7K`(B;r`NL&-ngZ`PFELM^vnmVpW*mFL92aQM<uf<CD{Si?^R-ib50$K*
z{XWWS_1dqy4(k=NrALT~SKHSg?eg5PDD%ntH7i$LTJ(K-%Z+`<(^|eBh*s^Jll=CH
z;o6SB9;}%cZqF{7R;j|@uyJqZP8IEzozvPLNyJAbe6X5(!MOa{jSb%g;x`^KQPpKz
zcJSTL?iaQN(Rs&qJ=Q8}e!EO`%NYl;y=T?eO_Ag;)4t-wZuoL}G+Q>u=><J$3}=n@
zHiquVi8x`g<joUD$pF`LEG~vu4o{i5xAyl1-UpLH_8*$<zI%<&*3T0r-v1P2Ip<HT
zopZK`ocn`n{kKyT%mur){HffmCZ-+gdACb(;iJr1^Xenk%I|%$evWh2tDTi$Ywx>R
zCd!7H{}0-dKl2ZR{NIFd$8A!#%#^=g`?``N@{rlTi1i8cE+^fM=6x%$$n^Q@Z0=o(
z!VS~H#0($GE>DPj!S`vU!tE8hF?Tk2?s{_j?k$Fv?9Xkk_H*XUi;;<&E90)VcwyX>
zfW=);mZgX6O*x?OWZ}~27vDdzu{PL7b!<8J^ZMRB>!z={SN-?b?(qG_ul`5aJ-FDx
zxIIn(`RA<<WUm&fJ+*vuVE*SSPOfLEo6md_YWZ-d;NZRmhxZ?enBl<whh>(_wZqpI
zELNI#gX?_rR~`|MOrt7~Y+;Fjbz*FuADHc$KBdps>5B-K>#J?3tJu3z!hUb{@n;I(
z-R+;dhS_aN=4E+&($?$4<;b57C%nJc{r>fR{r=zI&Tf}oH(kK<CM(P0B2H~NrM$=g
zwyIB>_&r!QG&KKW*g_`5DYlNX%y-3)f7B6{w!JN&&?0~JIB!mgYG{OH!3OcQWp|jg
zWkXYLS5@jvz3j0=-bKyy&HPI*c4p>Ay>Y+#YMXi24w1(#1^KFv9#6T;znw!=<>KKV
zmWCEV%F!iDuNKtx9~D2))V*xkB4)o|o|Wgb*|fQ;Z=C8n_UfI0594<0p8~f-+ZQx6
z?$~god#d1x=1s0)Msg{>%96((8s6BjIQI6c3#u(!9C=s|bp3qX_*mtENBHaren#O?
z_Bk8&rf9!<Al)&e_XC59<+kWlCf%80ZZ^|C&DnKVMfhFH>B|kQ@47qKpUL`%rp<Yt
z>@ND4y(}-(Rncsj)h?zBJ2d1LO^ToX%<9FHpF5t(IUZelTk5yyw3;2&Vv@Nx_k^aa
zhtwRuHLYutfZ6(zYp1zwb~L)(7wllj@R!&<yWhriVX|10;;P52AHTD%WM!FpEJN;V
zfpg29y*FRYyl2a9Q<CBk)=_u;+uI{;8b@z4uD#UGqq)%Sd{+17`mBo?-s-DfL@xOK
zjOnXwk!<p<b+W><u1}gY*<A5l?$I^(%w1=3?~A?l%|iEuB12D#YoMMDvsq?N;_>MZ
z_FOgmc*fy}VA9EH$1WaVnzbmH_bu}c(H}Q2H5Nn%$j#znomhB|@qN39>y^(7Ssz{U
zsBf{_cJJmxovTV_*QVHhZw=Zc{HT&E<XJlZ%U#RneqVQ+mCr*xj7{{n<MJ{CqYGPe
z6LVL)7kfD=Bsm50Og-amweYF+yXwz9)6zaDD&4HTp~}X-V@>qkuYXx@<SDRSdfjqz
zqHM!ArrFK6gzlbksCRrSIaTjr{eg{%BJ+=~sa&ME<>J>5^0F2EyPC|ybd;2vbGo<L
z<@UNOZHSqEboWx92QSKQiydwL>vY$+|KmH^<8OD*;dk1zq4#3q;_l_oELAmTIVE{r
zsCvLq8QxN`gY%!+_O!fIeGb9iqOzaUGol*%z66AQ|F)($IcCxQZ+`-kio>`0GZ%!E
zx~4vIm#ntP$QQe?O5;tbVk}SLwhOc7TNG^n@FmT(?SfDDyj^7`pD({UG5PDG*t<s<
ztRA%A+M!<c=B3HXW5=r(#O!ZY+r<ztv#vp4&W6J#r?*_K;@xpH#p0XXn%<JMFFQ;#
zDkg4uyYCT8>bti)7X@*%i{$cNX8rfJ^H5p=8~+)Po(U<EOBlKKzhEe`b)EHZ;(12N
zg2<@~zb<k0K5k1q!n@01zxmQl3vY1W@u|3dh<)3;tF^N4SCsot@>ezw@|<-kTGu5v
z&AqN@<JAL+27(z)Q3_h7e8JAAcZo!sZWXOnm=eZ$K|qgz`NqpdH4HaWk7gNf5Kd)&
zlOa1bSlB#8@ypATbCs(%KaYKI%vFk!)k(TBOKSr6KJA{Zto;WXYL%)5=N?=wbU-gb
z|LBKCt5;XK%}y>?QoOQ8=e_3cc;U6Dmu?aI^e15cYxDJCuRT;Qzv@2P5;noXnKe9P
z^V1{8xY%8<d3D8g{4>)%{V-+Y0fXQB3j-Oy21Ts-TDxz>VX>;aeDjTN-Lh}Ip>cc7
zTeoz}FH@opg$1z3Ir&Qz2<xe&s_Hz_+Lg$#P?P!W0VU0yCq;K{U+^q%`UW9am+a7s
zlO}vTw<y>ykmIfNztb_fv$i+ub!Pb*GkluGEMV+9QJZsd=nf0#YK5gPv)xLhicjh8
zxqN3!$LaoBCd&t_#BcNI9rS<q$~bn_j)tf*>D%85(#|n05Lno~X67>`r-n5Lln<Fo
z-Ayc7W>6<19wa@N%{8a{!R(&`-xNi63z=Q{k=|)<Yk5yl#zlbjNTbr#!!FW)!oSUY
z{B1+_{G;1$t!5Edn%3Vlm#_5m(tBduSMyGWF!*kDJia3@(tXF=TcMxwERMaqqFQ0G
z@yWFN=c4xd+3YQr^U0T+T{g|^@Xup+UEl84y?kVQf))GIx7%~m70+@SF^Sxn++$TC
z&YkPfps`eLi)8bXtQ^s0%hx`eo6C7<<7}4Ip1VEv*D5uC4QaeKt8+tpN%-=hTJHcE
z(Q+Q+&oehJvRPoyw9fe9InRJC*I%5SY-r)4pVG;4EG75*i5={JTAEKhNop%<;m@`C
zzrg9aVrwp!)y4mN_D8$_|L>V9`R?px(KHSl2dnqet5p@ER-SlnF=OB45=~{FQ#P?z
z7iA~@_gwUu?|99z$v@>5UCq8#vPmvCZB@&e*9zy~*d(v8YMW}z@@MT^&fC4$x#QTk
zurt3ev<gsAHJ0WL$zZjex_mqPZn<xbk903CJ;3~#f6eAw&R*6pH<a8rU_Z;dXx@e;
zJoblPpH{OLmYjF?xck#T%bw_;xY)SaI9~r+S;guDMj<kOE2K@eb|eS8yysXqo$X_G
zyz!!#Tb>Fgp2G81KdN!47PQ}<#wPJ#S+i3_wV6d`Tz1K#s9A@M1ouvyb0XxO$s$+9
zeT6S4CZ7}5h~9ogCi8{gHcnRE4Nq@fT(@)n^7h@SZ**)fM7XQj^h-+~F8kr7cRbHf
z{OZHpp3PjE3mX(T?>_&%DeC@(h3YdbD|g<QWYM>v<f@abkwV|0Zn*^JM8R8f##OH)
zBlnAJKPTY3$lRe!PNT4B-K!q~#%AXo1Uo+DN+^DmyMH{Fu|nxfp44}_xea@k?|T?~
zrD0J<d3b6zlbgT1bY5`bja5@#iWDiVoWtelQR3k_ErY$O<EFXVLG~uqTd%p9zt(N2
zyVGz>X!o=7dHgE#76qE!<CrPGh4b4PlUdozi!a<dKl@F_S<bwinPSIlwlm7u&%bYY
zdQ}L!%IknSZI#7Wmc?=Ye%}^XD4fi$QCqTydy39gM$hLqFPc&+Ja04H<P^EZa5L{h
zS%T3-m-O{h8t!u)?>PCYA(`XPY{gC&5ora^oBKuYC~d!1`~1++6Mx@|t*sPcn|R%6
z?YYL8eR-=~ROfzHaP8~s>zu>KmRxpzcD0v7M6Dqs^NWfDjYrtyt~2O;^H`?JWmz3P
zS=d)b^|n`k+qJ_zYrh%F*3Z7BD{^GQy4e?hdj8t|wbR#=>yWyvNbuwO`XkA+{V)Fb
z`0`hEX-@a;+C9SanD6=<tIPfsi*z`?>#&=~27Qa%(m5q1zn&ldzWDKrM=U9V0#1JW
z%s-`lOkBC}wqBqy^F5a*ZBrUGmdQ(g{PoxIi&yj1vd?)dmlofN3)7w~WTD~HXQnxQ
zg@DTq8#`u?Yn#oiHcv{hG!Od2b#p^YoodhopJ}3OZffS0j=MKC9_KYpxs$n~P3Txu
zQ4nYI3@xz<R<3U|&nynDIJZ;bSUcOM`8lEa$(2)H##^tx;<IAujhVH5otu5s9oJo9
zJkoG9c>5%+*Oie?4ttN-9W9yW&y>0J>0MU;yw;yKx<<<C6Q|DVShb6@wP|L@g*kJ?
zx0g-Rc$^rZJL&n(ip<Kq(^@N&uQ17Sr<MFVu6llx;qx^;&C^tc*F9a@SR8j_>pne8
z*`&xBvLV&~-+xm2%Us0U@jl7ZX6EiA>!%wrd=<Lbl=`7MZxO@1dX7Tfuy(HFO8MXR
z+kNuR>a&YGFs*#*9@)8aaepSs^y|&@`SxP1<;2e>2Q=SKm0T1%St6uH%>K55((ym*
z9!*pgjD0q@zT#s~qlR66$!6^p*{2l~AFK_&#5F~GbIqy#2+uw#&ug>&ce={DYqXp7
z@a2E}wzbS<=F;u5cBv<pF<-9Qp{+bwt?nbwM`{1M6$j!!C*CMY^)!}a3YY%AdE@nJ
z^K)13ujdh&cccBN_OVvhxpO?ubS`m{Y>k_)wlXpI+<b$g7@5>LOH8f4aBA#)o}n$e
zN!BEp!9dx0k)_VL8bj{m9!X2wCa{;xJvim5?P7IRQ==JO=GF_Qa0n`kv>t7pFE;V`
z1l9RMXZ+t@y&rL2tX9X%U}=xx7op?xZ@X35uA6Z7x=YH1oK>D@bh2`zBw`h=WvMKY
zD7-DYfA1-?nr@-5;ha_$8+Z65RG+@`M{4)#Nz2SEbX0m6Ia?gRx9J$wmHKKvckKHA
zY(ocw<XI`trbk*kQgpv(%$@pAnp?>sQ*i#BhipL|D_6+gT=?xs{rNLLma_=iyPVx&
zsxU#`Embe~blu0#vd#a(Qgts!eaJr7z#F(^KF^w+iA<@VChZh?tQYYqV4?cnuBt74
zN9Q<pHl2P{-0*F~?+<tLZx<i*XrIBUyP_dUF(K>2zQ%b!GgqBxJeImL^{fzcTy&J}
zpC2sZuPz?gTeeAg{;4@O=8777+ULAsE`0Cy)^ProbhfHjEV5yj+NYUF+stjAU#cYH
z-y*M~8tI;5X15_PV)4o@clmSY_11kT+O~P|;nf#!X0EYvG5spC&A;n_(~3(L7aVr%
zpS$7^f8^#De(Uaq%==!YUc^(Nrzphx;pq3XkJWwDSQfeIol9{2A8516&hDsRp68!E
z2X4HHEDoP~`nI*rI`8G1_aqfvyW68aN$|3_#*_4As(y6~xS|#cG~JEnOuiC%yr*$i
zLsI5OF`rb1oQ8!m6F)7!#I|CSKvTQL>Af!BQ=+oNZ$%wnF*7NvV0&3;`C5^^J&zv7
z*1UZmGwpQW@<lN^(T9y=ms(b+Rot%OiFwJ_TE0AVhT`_r*owFwLyjovbIcbt^^W^l
z9M)M;!twEd{d4g%%hRtj&WN5j<90#1lXv+VBMFVLtGxZSA{XU1ynl3P(M(yl^rJmr
z`ji5WF{;iGKVNfZv9b0sWsgkJI~R|I_!*wn=5JD4so>x)6Bnf|+aAAH_FUir?%Cz5
z^Cm8Pu>1YKTH!^WNA@jUFR=D|)3yn=I=(+0H+)|xdu{`V;Qtpbm#tp5J-_(%eX`i%
zg#M2!OE2AB(sEWjO0w2WtE`+wEVf+7uCY0&ahLStA5TLw8+UDxVeVn+UG#@Rc2D^8
z=WCLue^Pdhh*V8s%sbq-=F9mHl7D}u|2Q-4q46ZGoeS4LW}3R;VZ?V|EAcC-s<W8x
z@E+fB=+gEBznew#nEkuI>1&@co_ff+AopEd(L1}t{RWR&+*KzqUf8xzMx#RhLRg{s
z9`?0A*YDH$<F-@dh444EZll<HDVf_|HYmj!y$#6u?-d<iGLtW$Ep^k?*LhQJzA1Qq
zox5cB?U!?E!V}sX7hl`Z$7`|a?|<pN|1U*$Rh{IB{IlrLpRa54zU2meZ=18=QI3F3
z{ptNj-<7VBG19a8^=MBBpR~{%XH8eOxOMESR(^7PaMqj4%0sho(uEb3$2xW_opyWC
z?6^bOhuV^rJDNDou$Mht`^TrO<6VFH^zaIyw{L#*$bXAlQt@wN;=5iqnU|Lewd&Z`
zDLpzKylsbt+p;NE54L>ftCO48zeoBaPvHY55&4Na-B(Y~tTw&OD{f;R|I|p+*sT43
zI_J8tbLO8l)ysWyeM5q?`<J@NK(FVoKb&=&!+ni6C-+;bN79RJ(>^L$wUlR1VKcaP
zi%pg1iO|VHnYy+5re)p{*SkyZzIt?T)t0kMjSmIh54-$nN82o(-8Y@ulAU+=?5URD
zt?`8YDfa_8R{5h=QKuz3D(m}x-rZMZ{G?ueq1a#LC)eM6xFtQ;M(?Mir<Lr?b30Bq
zhxqu|q{}r<z4=0|A;IRFnc>Nc3+o;~SXXGKV^z@i$ou!Qo%7Zv|DB)xeS`Ve1#|SL
z^lZtU_HUZA&?4!G!V~;!E;X9*6e<0dy&HOeBEzQAC2L<U>wTOcvP}1aMyqz4_!$oC
z+!ty}lV*10`JZ@@!xfWZsL>L6uA<{liTy8+<6O+?N{fE2i#ccXvT^T4cH4`ORrP+&
zxSD!Ipf!WhIhXD7kEy}^%d^!vdmGlyc(QWS?o$mm9gp7g?~~p4Pd8`9!o^bSPWm{?
z1T72J=h8i!tv1_frbxi`Zu?JHj?H)#u~6+D`;5jn%MS8Z?Q%W%wCa;u;MPZHd-ief
z(OkZ+c&4h~dgB}N>8YpQ*R-_tHHH;-zdU;7kldwr^E3`eR@{-d3#oM8{!M4qALE4B
zhrZwCg82g<DPFDo=}><6%>wI4W?SRwlZy_vO_#qvFMdv9UsU~^XA(@Y6Ox1Ze=t;u
zc|VylBlKyLywS6?)j={g&YAo#`XZj)|H1G<t9ifccm5C4CshVt60W_czaiqnEpJX^
zlZLnjGcM}JUbv^x^L&Bdr}z^}d8spG*x&hg$4-2=<Ke&G7hgWT`tbMnlRuB1+<h^g
zPmbAX>P*dhZNd^QyPZB<P#4)Au_9;oH4)ifi;kVia|@y*)>?4CV$CU=`lVr!z4GzL
zr{;T~djC`MJfGMM{VQyJO!GyiEIz*>`@yHp2ZS67KR>=&FsVsPjybuTov}{N;t#8>
zxnJE;uBbO^J0?#T_^?h~@N1wPFQ>%PTWV(=?kr|aUUMLR_U2=@a!qqg>Lp)2x1AiK
z_PKSD?cEnYZ~ne`QUB!mcJbwlFUwCle)aOfo4d=8EqwR*qN>%@IZe~^l1vn@^Ep0=
z)f2M0aPrl$xXI$D58X7J!nf?Vr=4$AoWU8>D{`W`OG7FfS(eMozHXlICZYJ?<V0(M
zn6Q2G)?8LP(mb~_ELYkfF`&XA-s44yP;=CTaCZrp{gM(Hi{2TOys3GU%bCV@WNkt>
z3!_~DYqUns`L;FY94aiz59AeZulap*!_m42PR}-+J^SeA-erF!)Q>lvR$Q%l<#nd_
zhR8T&<5P=VEl;aEblOxppVee;z7~4M>RHzFwOiI~4wK?Zd3(L(<C!lTQs-)@N>yro
zIC^xKxR!C>eR<Uln~!KbIPPB7a&Ah}GM0YBn{!UCikr3O#nO%4uU9ah+x6h-j#jnU
z_iLhd9;p5BUd7RMJNqY}MgzyaLKY7ur5kyQ^SU(@e*Jpj!Q4kGRl0FITS9!<CRzm~
zWE{xabA!|8&!x*dKCsFhc+BYj+~E?JJ@;F$;>MH5SU!LGu`P+`$hp(~?(XX9$JLJ;
z%6hC;Tj8_k(ejKHGC2i%f82fe!d8qk(!R4W((0OBz|*;^qRcny88^J!*4vje&u`hZ
zl?zU+=gWSOE^zB&=8596&%gDuckK#_@$|RmIhDq^++;p?ZKdstNgG$lzi036x%&I{
za<dBVDO;=W-LZTZ^2*+A<;jHDiGQbW+Sykge^_jdzPe%D$;I`vLt8Wd=$%csnYuIR
zRL^eD60KYAOu4Kk9LC!hnXSElGFtI<x@N__k9Qo}Q&^PKdIj59rpnn`*~qi<@I~Ex
zBi0%3vV`&DoV_XcxVlA;Jl5VeV{PutN49x9S>M-RxA7GH#vQBQ*PtEj7&*c8_QaF!
zG2R)u&n76{uqy6lynd$8@BCVBQDN)EY3w&Y{8sxZA{je3S>vXd=EAuTLOHiCHZ)(^
zU8TPHNp0%2Pv4d`SGqj;U00Dc_2H(=LQiIz-&ViHcDZ=H-8bGoIho}i=L?=My>sE_
zv$9ER4!_Sc5VOn4F1X8Av9+-v`PA&h%{QFX>`V23h1uTcSgpSxck8M=lX+H+vz}d2
zcaz#Mb<5|R>msf53eCUg&q_V@$dmcD#Q!;ajA9n8+j+;BzwXh|h0|Q(fAe0Jo3#5~
z<mTs0vo_lDrOCgml;7Z!KILKeiwpal!d0Ue9B9&+Kk4<>!fO&A4R)Pg&$_B|X1fXZ
zX$kWy5r-u=F=&3jk$h!F>+ipxmS3zq^jRzBQ`pfBsf`D6*b*Nf*Z1DFjpe4?@(e+f
zu)-J?TZW6NFE(9X_ULSJ%M{I5l46IxvZkc?&kWT$du_$pD+Zj;RF%TD+~sC2by=iR
zxxbVDZ{x+8eGd0}#E(r|w=M5o)dgOrcH@t3m7>w-zjm74b^Q`0z9BD=Tl$!xm`df@
zOvdJ8?#si~#ozPw`#tJ#mOd5GnsDD`X3f2_+EjyC6DF@UN&B?2_RFecH+VRjHVOZG
z+HV-y@~t;+we@zU)}Q-ob*|=Xp5|gz4`}=rv3^gO>KZA3#;F^+r*N|07BZfH)BM~S
zt9yp~Ytz{`>`L5qu8N`hcWJ8U!g-(1y!^bq#Qs*kPYKVW`z%$@pD2H0zQlM<;Z<(=
zuTAnZdK@~krYVM`TOW?_*|WOPzH0WhpDvq%C#JiLnr>#g^)011B3kb6!{=waFRb~=
z`KkRKqicP}Hrq^rcb5+=P_>S4x;Z<+eBT;zw<AXsL^1{53Di|oEaKb#eoxz_xpNb4
zEK&})G|VdbxS;Cg(+R=r*OV5XY`B@)RCdmL*VLJk<(EBO&)r<{`uW1R_J1dD%S5a4
zPc@h|{l;ETLl%bDEbIPEk^ii>cUq}1-&L{CEftpxHf*lqT>bp~-Z^2vZ&X%YO?#By
zeANH<NySc`oLIFb*E%b8o?nfPI~gfbUUJ)V(b^Li^drn0ms~&g-EsQin`xmN<|{@9
z`s+*lIhoIGog><xJo$m=x&M)odixd~etU4s-}Q-U(GJ^xe7+)Ke785Cb76AD>F~2Y
z22-O>C`d$4leEvc7^3)VZGP*ouCSN8w|r~5m$v4`%)d)_OFT7}UR&$sn<1C9WOo0Q
zFrTWdi3>{~x2cLOQ}W-YeOe^cT3Ahq%Z}me>$hv>+?jt!+`ILj)8eXS&vZhPy>pNC
znLoAd*>TeNly&DUL;K?r!B+AwOn<$2_OolzvgCPlzHz-~Ssc7x#UxwXNauF*i>ZJ3
zdl|2ETwYvd+b;Pk@U@ZXGgaHo7gJ1D$AAA(k#z6xKJHm<*OV>qGWhx5Zd`qx$s)vF
zLBK#N%>NRr^@Hs{Z}dKm3`$U4zBTaLEus3STOS?Jo%UHe%yWZQv7l`(>)Lqf2d;Ul
zIfrtYxt?9#n&TqO_)_JHLPy@2{BwLY%U_A;U#(NRH%HiC<zr&tgCAiBqV}e~i+#sr
zbT{Jy*H7I&toN=OIYu`e@62k=JNGi|LWWe-!KI;7*Ue}2J(p_jq9yUbUi>uEdXc3S
zU*mN8jVFmj`YAiw_4^0D|G0AfoTeX9U(TILy6V*{l6ZcTT+q{fuhvZ8ligx}TYP$r
zcLLj_vqzFkqP(iqJ8J)avMT$1DDZSzPmyi=^ka(CK3Xfuw6`k-ZgKRgJHWcXCiv{+
zob{!TQX4z?<nLN#zWR95Ae3`epvZLPZIixuEBs0F_&jX~gVR-wYB8-=?+v1jmzG|A
z%<ibMU{dvpvl+3{tBoF%9bldjb^6oxO(tiLT3?KLUDC5&v$=k$?v*>2Tm9F3lCd~i
zJE`{l!S#pdSFTk#D(+`}JoWUH-@mN&?<r3?v`C^uI=Ax6-l)foixZiI6AyWEHJ3zb
zv@c#XIg3T3*LA1;z3<<@)*Vi~clcdzLS^DiI|1n*Ic5pfP7^n9Tz)p?dy2MGz?71k
zlb6gA`ITs2cK4yuQ$fdVCo9g)+HK^#_0SWK|K%CKn797*@A~(D?jqKoFJHP9U4CNa
zB2{NrdwaL!%F+#Q!#W*zCEX7DvDCKL>(ooWcN@wk&YM=h`pC<>jNkk^)Z3o@Y|i|)
z#CXq(C0%&|u1eE8XXbevjZCoUVsditQa8`|X*N}RzKyG+N#qIX_$S9ivey>B(M-I)
zK>3!~D#tG?9=-k6EO$+PF2l9Ly_cjGm%jZO%E9g}kf|QJFT-V;wABgmQwJ5Ycd+R%
z{QbOQy~FC-khwg69|a3X&!4>DNtA>kqen)bqsX46vyac4{C&Od;e^#?t?koWR~we7
zZakRx;@+jTybl_cckWW1*}FCP&$I7K*!1=9a?}XrIHvubl6sfL{8wwC!i~r?rA*#p
zQGxG|Z@Tu?qHTR)fXtNBu~(j7jAELmR6JXtqN*ij)4Ve`rUy7_9CG(r<<e*97sD(U
z^wm0Z(-c$Y>qpHhwq9`*x%^bdW>w&I{yRC+e0^4j9wzNy5-e%UT0JdrqB7g{$I7O^
zp2Tdrdo`Q;uu_)lMD`yacis8B?RC*h6SL#?@ovm(O=5q0cL{gyoWZzb`~StZyzd{F
zUjB5cal!SqyOuG$TQjH6r!vT1M3lYcrGEI+oDvW36$a~tPgbgbZdQ3ZY1L!_*Q%{9
z^Q<>*S><D)*sWRDbLU%=Y4H~JcaIf=x1NaIzjDo~9rx<ugzVj%O4WI1+W(BbDqOn!
zVcTur{g0L?&S&gBcGlxVtwqZVU6*qXo7yG_t8Gs*|H3C#GRvYwyx?_4Jztm7vqh(V
z%PJe|oBqhRHuK$cUV4trrhCtrvn6kcy;~Qier-D6y+v;Y_;kL>9cnu4rxO?<lf9ro
z;LZ`&=@&JP?ndAHu=%0V4hO+n?m6b_R@pv+JDBz6%uurmxY`!>t%mugSI1ASn#;Vr
zah1Q*%JS8x#Q&<>5Yn(cGP9sfOSX2wCW)ys0n^L<5>N9h&75F;SCLEPlOf-SzNM0H
z^pC~1|Cmy=G}7}%*1Y+r8V_wg+~wV|VNq;*(X&O1S9j(~oUu*KD|YZWq?!86-0Q1~
zxebfLIsSB~+~`M3zZ<i6newbrS$z1-j15f>rz{SSU}?2XI3jxX&zZHh7V7G<43l@N
z%1UG{N&BX|X_1M-!GtgNcc*H7x_7PRbz;HP9OLI!waXPnT0NaN?rKS1{k>D~+p=2=
zbuBnrGJH1eN$AwQ)^$qHb>gM@zy313jb1S4=;LKFHID24XU!A$nKxg9d+k+oRoR|r
z?HUmlwK{bhx+6R@T+^JEPSErc<3BMeG4pS-<Hdz(C(^&1UCcAJ^4BrnV=wr;=iN~e
zy&2b4X(;IQ#iVXZ&j(KZs~h<v6WAs?SXSgrKP+9z^z^~T;B{Qvxcldp-Bh}v7k%WO
z$cG{?)zV`pohP`&ITe1DpES9``Bt}|wTZy>*_W*O_g1ApF&5eokkmdU@aonjiyRNl
zu6cLUKku4>l^1Kj<HTLJ8&9|j-4KwQV$!~39y@#L9iRU}_7}txx0<@7+kW3VMM6XU
zU6NOi$W055g;TksxJ?y~?JPX<F4g(mfxFiaeykQ3YrUm7Q|w@W>%>~qjwDU}K)&q2
zLk8EgBtPHclq!AM9%OrM&hBo;?%b|(#V6%1Wk345^>AT{?V^mtP{Vvr?%R15KYNoG
zE6g=2(c1l2lrim@?dGl9KhL<XpIctJ=CXFgLx#tl!C$s+_EFuU5P5pp-c~KEeb%=2
zQi0pfH1xV{c*i^^erBwdKz7EW{E5b`W<TEDzOJ*O;hNg~4$*D*II5Bw%h*(mZoYc3
zw6x==!u1-p&xX@?#B69<*(TOuDI3sSwR_LZg9c|a|4)r**<Po|x!6rh+KSP0`uXG=
zi+$uAPcQQ7wsJptA*8-SPDE&n%mt}s9!s3Gi!{$&5U4n3?fJ}9`I3LV*ST|suAiT7
zn0(4?QuDmM8xKBG4a`ZnA04q~*Te42D`(&ASiEtK!d<QY)bdwB`cu!eraTZZ?vVQ-
z@=HC&)k#7!!@h39nkRB{d;ZI^ib}5%h~3tlb<d{boVY;W&x0NcX*Tn|KdDl@Se<RE
z?oq3-$nsbbXU9RwJkyIC|7~R!j$gG|S;(8&bW>y2mDAi=7nQ|d2`~AqV0f;kNzv|M
z_q~X7Gd1=0&9wMx8KHCcJo~PN4fdh@;;xl9r`_k)jbi(JD$Da?wQQUo$N7a*vL5wy
ziFll;dURJPe_M8Q;IbrEw{xc(oNoT~c4eKK(0eieiqLL3iR$BSQ%*MWgv2*ZV|JC<
z&~Lx%4%d<ezxbBv2m8-E^y{AeG_gMiw_bKmaDJvdWBN^_9alg9%lH5O|L!sAMM*c^
zo4+tmlTA5#q%n2Y<1O1*{m-Yatx6T$e5dS>g@USt!`>qMpf&n#wfXizuQlEF=Gh0$
zQ1-uHx8#~r&k7O#536NYDaam3j<(sur`5Vl``ET8H{~QxPm=z2I^*;CH8l!n0{`uO
z8FgQB$vd+HEBJ0JJy{mMUrX7?&qH!6gNUSX!sL#3H+b^71=m$1{y!*mXpV?M-psYr
zD&%4!wqDXXy;E7%Mfzg)1p}#>Pu*3fm%92_y5wa9_r0HHbU!cXj4!`p`n-yZq1SUw
z;vY@g{vfwV=h5+R6W7<wcU`?Q=c`P#QJu{5qgs1@wa&h1a+BR_TX{8i|B>q@_u`!5
zP1(#H61Ub?G)WyT&iy6pEZL^}`&fldaB4w7u1{p_scWior%(IaxV^rA>89rk#px>;
zc=yby;C=IYNkOr8+7BlA#pf*U-JR-wH^Aya&Gsm<mcAWZbytKZ{j{H3yT|H(#n<H)
zDod)SA8GZIo2_s@si#+J{Tb~iYaiFW-M-}40VBoNv%m9id*;sNA7R_0H{HC8e{u7|
zv>EJ@Ul-3V75V?MzrN&?^+MkH@k(kv8vpht=7q=p%j}VSf6=igz}av5{sS(ajY=7!
zuQMiT$F|&=klOn}&xh?(N7jXX4TqbH9z`$c`EWMxqHN%%+d9wPA8$SNa^q3uB)xUT
zhR3I!$o=$cT33a_I)Tn3{CfPI^16p6T%NgpLT8+VH~+VT`H2s<G0DC)E{~qiT(fL-
zskHg)u=IatJl4FOef7|S*}ION{+!dc@}}!vnR5Xlb)l+H^$wl%mwztYuJSo4%IbUd
z>ExKOtU~K27X>mMmaMs!G<lNHycuEICGTBbX1Yz(4LldR%P3>j`ujeMudk2$%P-(J
z`(*5uWNni=kBXL<x;?k|yiQU5qkHgmy|nrd<@u|mitPSQx%I8fR8RA3S0C$!?BoXF
z$5|)3KIYU~7`(DObMnxXs;jw8tE}t1@@CKfbctQJwfXv;Nb@Dz`+rLwE{o>8cT+LL
zJ2pi5gr}?D+uc{cPBpu?qwRZ6Y;wfs|BM0N%q$`d3=A9$vdt3Fs%;`s_jwo?95rz4
zi7&~|&q>Zm%miIUwlu0b|M3pN|Mv5n?utyPDcsU8*X7J5|7!Exy(Pld9eb<qrZGEC
zdoe?Nuiun8JKFYFr+auQsouP~jq#dx@L|R0f2A)iPpPy1_xz{n=gc!Ne}+0dp0ifs
ztlkNOuYXK!|3BDcZK=9g<!;)W!nu?A-`nj`?lx65pQ3Ka`J%1OQ|h42q+oq3%g9tu
zmzeU<C$4U>(>G}NZkkh3IOj>+xk)p$XI(jcT`_tZ%k~eU`wBjt`JDMGbxzvT+ZTJk
zyNFxVX&)0^>ioEO{t@kO83O0#M_73+n$l_#9WYNj%f3_T#^yyldw*>FAh%MwGIRb9
z!8673nSB3~W>r>B+8Oul#Oc;kk%2R8=FM55&siSO^+`Kk+>-lr{!g>ikIEk{B0bbh
z^cGDz%QEk2hF|=r=V!c6n=`s99}v>sR3H|gum0}E^^-3yU;Xm<C}*SnPWfL>f0@2z
zbl3(qOUY_=q<ZS`gshF_eK}=cki`0mRg7~roK|Ot?PgR@G?ZN{T(EGmu>BW{_2$Ok
zCr`Phk?o&X_wVQQ+q-Ytt1V`g6zCQ|ZQ@<Gye_YE`{R>uQ>^CsxW|9YbqJPf*88(I
z)gVsA^Tm2wG4E-Nv5mVo&Um^myI5-76y50#4m!^IVe&Z}8UuZq4Yn}_y9f1g2P-US
zU#aJAs3(>5_2j06#0P9VO{{ab`(NToI>>!TG~+GP8guW9_xFB~i??s^xva9xw&>sH
ziV3%m+ut#j;?j6<Sw=6lvHa;`&joMgGPdONew(VW!|Ur&l}oG)Mt@g(Ms)IpT>YFV
zRD9s%fzCs`TdSY->@msNS$Fo)+D%J5tfn%@FwG2^a5ZFB|H;<|^9A>neVV?<&@kzv
zmZmw+wt^{oKWl@p^ZTA{G}=5TaNYTJ?(wtZ+2@<x^*55L*craRb}Fw{@?+B*Q=0Fa
z&UT)*?Cx#>&7h2J&67`ZO-sIKwB~B#Oi`z++K1+t^TrEWyK-p<-k#!mW^Klsxb<<b
zr}Sj{ZRVK!ztZ=!X$VhZ0#pBz5a}loeK##N4>jm$J`9ixlDaax;l19e*pS<6b=AYB
zFXG-cX=S(1>`5M7reEhzn0T)2LhQ^r55MLgUjMm^JLT{DS!^pW&GlWs-zk>&7NcFp
z6RqXv)|6g*dGCvo_KJPdD{i@)1Vw)_-8Vh%L}sqViDxFKcR#w9c<1Z12?|{@#x7GI
z&o^FX<D3%Uvr>GnbnXUb8OBVxD~EqH)|UBq%u`6b@rhf0K~&!|ZTC0lk7ng*w~HGv
zr5srGSe>z<u`%??>d*7n+<RD3I-#Fu&*M7+a~QTC_$nFVVz0v_>fO7y>W;7Qxj2Jq
zr*=xR9uO<<47<I+%*JW)EeY=DQd_Fee}1#@n*OAQhws;Z{`ey8N9H5Fw9T(Cu0Onb
zWp!n#tz^WLHNg|VK9lR&kRhsZto7pAsHn9yYSZ`4Jd+;${aap<t#qF>_v<@W(?hKU
zEdqG{$v&R+Q!r(g%8G~Xvo=O7(a3wue(j&(=T@g*yNcvmwmo?16wNd><!UL%B(2It
zx9x6LBr-Z3b9v%W(6!>}K8v3`jUs1rr*J)!d_PfqvQEQv%kbIzH=UR*dwc&ztC`>T
z9SsXs{^0kW>*>p>_9Y$~iEDEsubC%Lz5M=Hwx43kk4nScl6vdh4riZel2^Zc@@|2l
zr0|vv3P0n+44*s9X4X@Sc`F%EqnW0#af6P*jVh6uFR}y98{BxnsK@5Yb6~r}xg{=H
zhn}98bIM8eK5J*Zf{N%Jshn$-^FDQN&u3kFz?g&Up4OJCzBfBIpIaPo!=`DHufVC4
zi79CX$=cO6JNL|L+IH*W#cWH@nI8B4R9;uRzu!=uA&LE4R4ZGv^w+9GwftUF#M_?C
zzBJ>DU!4k*l*U41F`rr02@M^;|FK?3lXAMB5q*Cj<Bje2qHH%F@)i~6|Ml;g$@&6k
z?Y~z<*Cyw7#)j0b3215vE?aNB$xk$FWkJ`GxTykF52kh<T(?y}$Z6>esco{IAA*bO
z{Pu;cSd-GqYjE@7<$XJ6nZ@c{K2wzIulY2q=+bfNRqG0qWJ6rrOt*81N~Wm$rY+xP
zViDfbHgokZ^ZY8W^+$JZJew%cQ7c*@!>EyQSYi6aRT+Ydt(_KadTYTm`%KsJN_LB=
zvkwz$gQeF7XPp*W{zQsv_Kj^#hmVzU`mgMNZo|;NeQH6wa(#PZ-kvsB*_m-~vJP9V
zxp1O?Di3ScF79@|SA4GXlJX+e+a#k!O}{C<xM419xOls%`|3BRZYfUxdo=IyliO3?
zvF|pouYUYz-i90ZER-gH`L_PL*IM37AA-$eR(uaUXUU`M@a*or7d=8D_odD+aF{%m
zot<-P-PfMbliHtHvRmTUe)!*9uUdXI;Pz$x8yy#~dd=xq6?n8V?EjBx&A(b#ept%V
z`+5E6qfd^_<;z#A&G<ND|Fs({IZhgHON{fdu*iA&VZx{R79Tx0xRg$MiO9q)smNGb
zTDSadXozW%mekjGX%*R8@>~17%pWuT+NhJ*Sn9ZDVbz=2B8uJJ;x+ZUa#H#8BV|<1
z%iRCJOio&4b<ZVLaqXBxkM%znPFDJ0l+etQ{4->~xlM{#d-R6<KC=glE>s;kFLdr{
zXQy-8jR1S&IIXWU8^s)NYib6m^dBrX3wf;ZtnlI#uk*}o(Fe|leB9c~+WEdwyJ*vn
z->>e~&bwu6^4)0hy~z_fR||8z;5b?mzJXoNWLp1*ChmPE8S~ssWHx;{QoTAg*Sn$R
z){z(Y%4$WPc+7t@`PzhQsxpy}zU7(CI`e$9_0GOyNBz0WpStSY$@;MP=+js6lW#8l
zomysEmaoeFT7C7U-X|=#e!lL1H_0)<vD<fzyzXCvw9|KW8YN!pxj)U`%rbTH`mB$6
zX3-iauZRRoC{-U--Tsn$?}3iY^vbPj-#&X>HU9ly&qa9?_k>xZny!LJ8TTm9@iE9=
zH!0~<hWHh>`+X0$aK`j}UdrVoVe0N=s!}xh>HE@`n*5)4t@dp_#deIhwZP|O;2b4$
z#l0RaPg}N?Ff1zaFc&F{KN2dpM$IH-=0(x!gGySudvEU!-Kw8%V#bhF?7B)ego&HI
zxlm?X^t1zSr%mR|->#bKk-U4(HD!DL6YLXnRynn<RN_)N8e}fG{C(NZxpiCb{Qcd|
zw|~{0XwQ1KOXu_Q79QVOyuN+@^2PD$T3w~fr}5mkHM!*ItorqoIRD)$W-*8BCwE$N
z+}<rRTU*`iYnntW>x3fqggE)NmG9cG36^Te@7Oo1E+|`KkHb~}hW~uGB*P0BGEyz;
z(*z!g`FvT(>b!cZS*k$S*~sHMtQ|h966-5%|5$``eyVx1>+{iyC%c-zS82UzQN7D<
zbvLfXu{+%BmEbH-{pvNFZwV=EV~jg(>13lIde(MH%!?24Qy7)@eO&AJh2=||*}bge
zH8Y+^bB5e?wes!{ZVA}7(dGtwz|M%z_upI;deyFKp!rsZKXqeGe9gSM59=Kzl1?}D
zD@H%6pDDgteM`cmyrT>9-|{aDdaUuYBjfqBvNP3dy4QW!H1i<ikxu6{wZOQ$K}zpF
zI2{l@IE|x5{>8J*Z;YvF&3n!$Iy*J#Ep(W>asCT2eT7{*%fvhSSM6OXZE)nJjQ*T6
zn{PGfb-PF3^PKoAX>yN)K#Tt;*QO0(3YQk2yJll@Vb9`8%-S5sQnvH3*}BZPSe+X>
zNBr%EC22gjjNK;e@oQN6_L0o(AFKRhO{GIU*%jJcU7w_V>2FFk*|6W|-Lvq`nm@Zg
z|BGE8IQ>ZK#$LgSR`F8n?ubo{+O03%zSewpadMr!<^eZW{hj<?U$6gI*KXdjPWwt+
zwfrHS>sxQFvC`w*aHiqX-6tyx(-oH5RwzeWc3d@d-Y;UX<#wrL!3loG9EYplH@#iB
znOmh`|8F6&j{dkKWd)ay8m#}+Kll6|rN<s~4`vlTIPY>|!PnV>Z=(u1z4H_#47PsX
zGW$>6)sijiGOp<8O<wul&C?-wXSTgpSB*m6js<Eh=j9p_?|UERPpFW)pd;O3YkBJU
zPN}PlH|z^LXpzGfT)9~BW`}<z>*bRVatb~?*C~s(D^?P@%KY7Qw_f)(cf0B}?0rjP
z=l!UiRC!)Qdxg8*^ks&nubj7Sew~}~O(J6&r-Xa^1a(ub9banZ{e0rj{OR18vr4D!
zsv~*cU7nb(Z!5sW|5?Fv>h}}RX6ocWz23Ff=bkpVe^_WHvwf>w`t+Z_kFi|jS19M$
z6{X4N?>y~x#iJXI#ZlcSJP*iQT1p=GlM$`2(R^wA|Et%7`RmtS(W_Cqz>#C5TVyOJ
z`>|SY_pN~Nnyu#^f2ercF8`#)aDi-m!m5Jlw~c(?&XaMm6;DwXNwEKVa+$iG#F3o2
zyWZ?JNlV?GHf3j7yjtSPhv$46Vl&pQ5WJPd7;#-xJ-T9oModn4@tx^2HqCVLc1)b6
z$e5zon*6q_c>bGjd#|1O9eVRf=INcG>BW}2rG1ZaS?=F{MsHcB<k#0dzql5af09S-
z8M(Y@4sTIlU`T3Wz<wr4Nl{{QYC&RAacYrXLFHB3zu~t%Chh+m{$)b7|F<I+iq+ez
zPq&^CGBAE4^q|q$*z)mJuGPJwDJQj0Hncyj-@ocr-pc(sc19=nJ>GlrMo@WaX=!O~
z`EOQh>zltz9~(%1T=PVl-SGUXlsO-gy5F8zbg?CW&&z#r)d$Ny-(2LOr!HFkx$5)z
zHTDnRFzbKrIr?YT@}D_ee<O}Aeko=0&VSOR-b*W5>OZgPnzSZG^vjNpQz=J|ea;C{
ztrT18xivxZxnY0g)XhorHfls~P+47JsBQ6wd&4ItxmV}S7`RGLTz+?J$BE@SJjXw0
z#eFbHIaxAIT=dI{Pg;i@Pnlj^W_@aTutT`njlTl1AMd^GIKN?HPSHu@I2X|#jp(zB
z7ClM)Yw=`zgHxnX#KonnXZc<J6J$GEDe=-1r@gzMv3}!ZWNkQc{o0eyS%%)5yv3%j
z(cg7$QP!fb){W~Qu}<Vsi&+((X~^%s!-gv?u>KcM^L6D9w_h#mNHcgc<LmCf{_1-R
zzAwM`?mk~%-JPi959)!>Zk7f;kzBjz&FyTtwQD<%s;v6jopFSJat}9yq5NScmB^sh
z#MMt;?l^qR^VH!@Okz#-Rys$w?P!vn)m|edI{m5GgOV9jt}@Kyxt;S^*7}ra%pd21
z*p_44)^6OLIJMnl-888+x!(>sE)@TFo{3%K0QaAG^RxLC7dKTYC0$_nzuhhWUyzb^
z@3K9!o@}fLn!Mk%H}CWl^L@P?+ohXs+_<<Tvu($UvpkK9pS!y8Z=IRZqWfdbgqEf6
zI94AN|G?8>u%>?3=G(WE%GbZ&{?6?E&AYRIU%M;+?slVX&`sIrM@?2mndVya9<<`^
zwBj|qb?npoM_Z~RLv^D5z6&&YT3B!AT^XHFD!a5ePe<F9&F{Gj)8xqvR_kqYLX_9)
z`y8*Fb?`-Wsc?eUa#vU7maiZ3x+5o^uLx9?nIU+=ZXV}JlNaURCkdWiu=sqM1<Rzz
zQM)G`+4j&dv4nB9Xw*CR%$J!_ow|zuwmACAg*!{$y?yr8;c0mr(iIBNo=rZ-mvHy)
z?4G_S&BuS(e`cM;9hY&$_`Y<&Z2dH4SH6rzc2SE@=tk|VHhE?|@946MhH1?UZ|0cj
zb4~Dj=sKyjFevBck|VND1unb@6<d6D@4U_2<$m>VzHUEfe9X+O<lmm%)6cVL&pK~%
zZsq)!HI?P%^X}dap8s2_FJa;C-)Zg1(>MRqOuB3%v)GLJVfOktr`2zKeQFjh?$6Y)
z$MwY;?aqlMISS1wH{x^?Ca}zHTWzJ5UvlMuY_F=xNA?uIv_#{$%?xU*_a~&^n3Tiw
zW^yA-yXNC?{^~>f7+)utIvz>k(Te-%%KmhA`;5Cw9$nsa)hzMG5hjKsN4Lk$3SaG;
zkS{3LAS+et=vK5P`O+5AKmHCsoHpNH*3Q2}b47hfTDQPvUEe3$rmxC7xXCL#@>YeN
zbMDQxyE~5Zmf6qy+HcPy`#{Wl>a)*TX6t9wuGuzy??mUD0U4**&1`QJ28vxjTk`Nt
zX5D1*@B{q(Z%S_Ov2;AVKEiA1MG>jCOKT>7J9E^=Gue>m&^rTzmD?f~L<Tx2Dm*Y@
zWd0=8p%dz|f5zw3W#>&71ZrD+&YxNL=|p9VP@Ila$hYWKiw_h|owoTPN9lv3?(B;<
z&gAEc^!;aP86Xwx>}2HFXgW_#Ibs@Te^Q*l?71J?PJ1Q%`Zh~V<p@uto!Bbg+DR*t
z5}1m_j=pHQqjHtSzHM=3<kQOmpQNnRFL6Fdxif8>+rn$6jVh|Oy8||@FrD~DO78If
zX|vYOWWAd6_o!5Kx@$&y&2}*XOY14mN))6nZO$u=W<7mtk}S7u*1xp%Z`AIsTf$PH
z@WtJ1ojLQA-P6>s7;Rt;{FL{b|L$3P*4$$U^O6px@IB$r$r5#q`;o)!EPElSaYIj~
zlx{-i)u2z&cC!}qyx6oib^V2DS{6H&FHPILXTqI>N3yv2RPzLKrX1GkQej)CRlH&K
zl*!RXEW9?V^RgctP}KTVbj&^JgiipEJ@f8`uY|Ibqup9IKRUzitKzWrgK4?0@8kyS
z%&t#yvkJbZ#DsUr<wrK9h<^zynfR&E)~|iZ90C2decTC~oAxShX?(y{krZ|ApiOb~
zMdQ`7?-Dl7=xDimu;%4UPQD63QEq?ppT{mApCUeQU0U-~ffk-fK8HQ;Ew%)^P3qnD
z@6=`QSwDJZAHICIW#fYr-*+qxjA_{A65E-R$QXUE!1PGXH;#-=6Xk;@^<Jtx6IgYy
z>@;`zqSMm96q^=Sss2pVG}wHW%R*ay#r6*$dJCpjm=#^z5FfpF`5v9c-qqD7md`a^
zZ0Hdp5W*?3zc*&_SLTNS(zk5RE}k(}c|-2%byxS=KU}IO@>nMK7H8Z3lzK&f_sTOD
zr>(l7!n8NMD^NEfST6NOanr2mGWA4FrZU&-Gc{JsiPYR~TQpB(k-{>mMQih(3Hh6d
zZRWdptVl6afBM({$wE&9WVCMW2$-YBt8-T6Q%3l82L{pKVx~FYOA{=$CHA}Qm;Nzt
zN`QAO-$TV?Ezyq^IL^)WXp1misp;|X)I={g=7n0J0gd5aHxjf8{_OgF-2CqKSoSCT
z@2G#c@BfpR{etYxpK4l>^OkbAO>u1H+#}(g^X^XNefzQ*#<^-6-UubxF6WN8Ag!js
z@r}V`$AbhdAIG1^8_suBH>Szt_(+TB2+VFOVlz09VK7m`%(8#?n}joBKV{Aw475AG
zV!OD?v6HQeN76L=z3wn@o6V0E3+#z@=3y)8eDdOylZ?7+=3Bpr8)fYq?yIFQ`MAGT
zv)%B(vCr4u^tLrG@U-YnTNfoRc1KK_MOvDLcaFl>LS~+dE7P2_^EH|SUoV}NHMe!=
zmbFs+duKBRvo7R$p|nBg{*KPBoaA|D4{p0HvDDMxN_l{+xW*6r=L?uGD6?K)v?2C4
z+dFRtn{^YJqPtCwf18`Cbf0}zrK+;(qzvZcS#q1EpXE54b;IJSchkHj!a;Rg41Odp
zSZl!<@bamUSKDQsUZ1Yg--`@>pNQ$X;-EY^+OxOnP95LIugj*zU-I?(l~k^1<&v;J
zx>IgK(ies_*Bujo?#t5`Yy7uvPyF)2;~RJ%FUUP0ZhZUOW0rN!GK+rXbjt3MRhcgN
z=F0--*;3!1ml>=-CjDR5;){Sue071`SCg!>ngLEbI|>d&?e@E{^yr89lRrw>mMwh9
zGyh{CpVDNpJ&|j7IdVm9xUq$KMZ?nL$8WFuzO%7{*Xf1v53M_ACrE97QS8hxPmeW@
zyXAP}@n?EpJ{hL0z4@3yRe!@CflWXDO8q$)5fu5T?D>M~`>A`QOI|j7VxE=O?)j!&
z?WccN3fDfC3;T66?|Hv&(8_a6n<!YdWX9qd>n%IQdt_{)>{DeQD5-|7+`0Lw%KYVq
ztF$sN-MFnS8fhpRRx-yY-|pBqT~CpyM4vy0c?u?--I*J>?t9DJt?Opi|B}i2e))y@
zxhq}QkEMt&p1tx+lxd|!Zr$TEa}QZ$FFn@v#h|=3v006G&GYKlE5lv6xCAyInqrt$
z6KmV>jOFR2j4DC*Ro}0zx?<#3vwQw$mF$z(as}n`%TGtn3i+|imqjSwb&X5$A6K!+
zg+CP9MD#u{^vI9e9yQ|^_e8m08_JTWX1K=WzHG^h<yKi|^=8+zpqy1q@3ocY_4yjz
zuHvY9)1=zhsJ5A}o0sQ`!K&`GRtb%p2fbXnU+nH$)}VYLUT9M;>;K%2eGaRQD`)JO
zd$iPiyWdQ`)RNnIe4lq^tFV1s|8~OZ2!lf>oYkGLgia5=>&O<u%H>zZ8fAClX`02a
zMqf^`^P9h=w!6r@_$?4{Yn|L~-={JmQe{^UteRQA=k%(#2c}5gX-_cI-06P6r1&JC
zJwtk?_N86#9)uUi&kT_9Q^<4Zid?LEXo=%Vy^a?uM>jT~kxX`qbat**7BJeGyJYih
z(PQRr2immey0+xH<aFPAsj1UlmQa(JAQ$Z!`?4v_Fe6~$uWy%I*Wb%~@y0|nG9}fq
z>(BO-YnQ4^IQaW#@_d=*%eKBfBX8~c-Mt^qXB$*TKf3=*KjSP%uht&MPqq>#&a~8&
z`4~)Yp2hh(L@m$yP1>X$wXBQEYH#$soK9RT{je>1`Le`I4YjwseQz(_Hcf=3%ifFU
z_Ft)$JuF)qe?^9w|Npd!NlgBrz<KfdSath#l|>TPD(UfT-x@w7+D%(0TPNssPw&8|
zUElR@tSrzvc}_*We~*&r<$&z2Fs&{t)_XIel!WdUCERxL=2`pd<Fk~~#w<gRnD(eh
z;jCX@kIarV-}$y(-K%7IPGau-YsRhon~VYt^nInB3qIJK+Zj<;xB9ZfzF0fo^sW!*
zUwJB-u9k7_t8Z(2yl*R)@Ts7g%Jxi_H;Vb{!d~+9^k^h?I6dmH=KlFEnQh0;mFfO2
z&cBXbx!5ie8u@bVWTTU(v`)G0X`O4e#pc?-gW?^sX>kvg{g&1}wdf9eyjAu5$7Jz4
zVvAP<C`Fo2-73@kz_e|1-}mny>)nt4c>nL*!^r-9kL=m)<z(l7Yf@a>tHi+D_=;!q
zMBNwH@7w>Y*s}b1fl7FWiusL0(z-%+TlPjAI_CDB%dVv1>#eF>B@S<a$zH-IF8RNl
za&i&JOWVuoksDLeSoS6^kq=!rcgbFv2A<|lu8-QB-F}{v)#g7lG*@~QCU;l*)4mz;
zTKo6&EfSd#&tUK9`+VQkv~rV~zdyg}ODoE6Z7KP-e*W4XLmQU83rptq1W(-QKB=g-
z_OE)vJdqc!r<P7j4v|_|d0Ucoci^r<qq9;<O}PhB4MPt){#bsobRD-|%NH@LeaZQr
zar>CJ7e3!oeue*hS-*eP;cs2jc3bbZ|9T^Oi_^ozIsGl13<}@+{mb9(+q-!F`xXE9
zGA)oSPRKn{DHc+y#q^xZw&lpNOUYh`)49#`6YVV9JYF&E<2axBwDZCF)X-fogr>;+
zW4v|u2~*fn*Ejq4{7YOC8B+hcUo`D6xn0<NSK~~}EI;uaC+|b20_~KWm!FYbI^)7V
zL2l+t+MSJmP1#mo=VE7$p8PW8Sl)&pi6@?$0^<@mq}a671Lxd-pkm^1L3~+rbM{tN
zX<kP4O0~$=IUEb7M5r0KJ&QOR^6Jjg+*^Ae-_<o+xhit!*H@y3Ip+F$N0)~S&pQ{l
z)MNLnsawqA8PDDIH1#!&b7nW3vafsN#3RxV61#S>9g$-!RDH*?Drnv9Cjac4@2*&O
z=7(<7-1=TE@=Sg-<Joh!PO~ZbPIqK}se1d$7uL7A*M3Rv+|>Si$6-DJtJ-Z}_}KoG
zco%G5lfrf~Cg@4HW2M$b^JOcHq<FcuHeOA5&AUilL}1y9Rd!Jiq+(7VDy#Oi?COf(
z4&9W|qvLw1RbbyEZiBYD8jB^uF5H%Vzv#imsg@GD!6we{*G}ESdyr3hi|f{xZ**_R
z<gJXb>RRRFuz6JrbGKI8&COj47p}9gnZR_dgHP_F+oGb44|bjW*?2t0<?KBLL$9;5
zW@Mi_F1kv)R(jusoM*p|@ak6PR+LG!Ntrl*QId*n>|n_C`J{2Z;p3V)i#=vFYOT<Y
zchwgO?R61Yr2ei;*y=#%=ao9mpBJ_%wg+{xPV76*xa*C}5}Bj3Ez}wA<|+GavFvOX
zxf^Mhy*JNn<^kRvjVC+0Y|<|%eDt0e5)<ll@)ko^#=_L&izCw8(stjv_;J3+4Br-k
zDG44G3nUpgJMVMdzqX`e>&!+I<1GuMcHQoEh!T=rF4oL;E?{orMW=ihHr<#j7ndb{
zvQ|<&7Zzb`bNEGIh|#L%D8ufn_d?GE-`$!uAudt4`u1U!x1K+(uNDS7NaxJSm=~t2
zxckV=DZ77vb1umJ-Qn@Uh5MysRd<`<EN^8~t|e~Y>;iQ<4{dwSp=Q!0{r5}Nj-<I~
zP0gx!Wus<=7RAqB@vK6vbm=x{`Ev>%x!rzSCK-KVD$3h-A+=+T@5G;m4E;$rEPEzR
zSy&dvs;yA+ij7^~uh0MY-o3jx?q6NIdfK&Bt}UkLUIlm9Tx*Ivv}%dV_DwpruYC`N
zXv`05zV&{QbgWNo-kq4E-BlN|7Fevd+o{f{c;Yz2p6}WD-;?W~|4r=o<MSxEJ=LOp
z8ON5jYx{OT-n!^a{^3PM8`dA1U-IGd@%blO-2dKt`LEBUDwfaW=AyhiahpvKaowxn
zsb6s`BEsHkqP1Ijq@7B!qk%!#+r}H;3_o0!Tsrfdmfgi~E0;_Nje1}f;p%k$oKQAf
zS%Q1Wyrq?Ot=5Y>I~Voen9-ygdB8J8@$x!L|Le=x54~4m*l=3r?b`KMXX{64mn-kj
z6!>c^)@hf+7p^-&L)UnE%JUBi&)*onR+Or1J*x5J$Nz&-4Kt_vJlE*wa9q^ZVRdD;
zvW<<!FX=y@|CK!dvY`AM>u=u+Qqzng*krUnKk4E>`*oZ6j~{>It9SoZ)&9e>h|^+?
z-m<u*+R{9G#9l9cSx{2*EAjaSQL8%B6tN%cFS)&%a98-%t9eUT`}FM5@}5w~Ggn)|
z{%Yl|s5QNh->(vyA2?;9cef#rLEM422M%|tx~Frkm3$LpRd@Pw_&qDXk0rq@W@n~a
z@oT-h^Xf+=r?u^&+e#%SQ@{2wauv3j{|M?~l?c<@q_xZSsNQ+m<_%RRPRw?jeo|x4
zBksU$Rev_tf7;k@P~LA}bHno1;ePotzP>|y?|Ht@SYN*7H>Z4O{*Kb-@ALiq`oG(~
z`}T0Q@|q*^uXY@6zS~^4;_L6HKSb8IaeU|VOWZFzzb<I;x4vIR9e<g(+?dAr_w~o$
zAD;Y>*zWtG`2Cl^e*YQ#+t{qtE!gUQRa~>?c3f9uVX^4$QZ><Ub+!lp%gW7RycQMb
znG><q_igan9n(!NJzOW^$TxFBKBHtPlT(cOgVx74%g)|#E1G}m&W9~)%LBIl-=7hZ
z;PJx$42Mt2GtOy|$0wVHgzD8N7w?b?juid4`-1z`xE;*1W|kRquTxxX`rD}Gz)r8v
zfm2>F-`=uS=&PQ9c;SJQ84q8H?LP0#m1lc}<)NA3oimDove&+{mAv#-*4eXFR_TS7
zYsdZ#&Bsj5dN22E*~zeU$<f0bRKnLVJv%kK{h(fSB=?p{Q~8;{h(29mUmPyj%-@#R
zyL!I-tHwD^s((JS-&h$Hx?cWc*gCbW;*3T4B@<H;^gR1QC(4D&3)H-rD=Xisp8oJ%
z``rCs58drwF7mIQKk3I8VZ8>imC{px?vePY-ehI{uYzmaB8Jq?{P>f-alXm#y|<t9
zUfWXnyuE3uZ(PWej3X5S)An#KX}fwR?!cuL8%3rqRGN}nYWaMr#e#rsHg9j4O<2~J
zn^}MJ$jepY6D(`L8X0Zg8(W`!?SSC^?(@$KB~22h&%XAfDk5HC^Qjmy-F?1qj!9fH
zX^&6%HTlnpWA!;gEV^E8T-q&Xc)2bo{9tao;Qe*K3D28(%yn_=UM=AAvgwZu<u;q!
zuXc!UT4&QQhTXc~!sH|KJnQduNLOczy!w1BzCQBnMLE&Qmv_htKL{&Z_0reUy|jMv
z)~jpIygtj)eJ1vA&!JS$Z{BCVU5~H7n{-Hz@BFXj3)m*EPkF<`%_R1wI)LducerCr
z<#9LG<%cA=r)k6=Q&HY`JVIIL=agyIzDjE<4*cd}NU9Unt=k~Vw~%YmLqFroyhoa<
z!?~}T7%4sb`ewSOxuckm{d~FkU;KXC^}hFH&1T|Mw8&K8{QL6VvcfXCXSRI_mYr7~
zx%A!2a7n6XTGq*XaL*iOtJ<#cj!S%{(ifTbul{^K^>d+6;Aw8JwMFM;wiL>HZM1v2
zVw%1DYwt%pr}e$Ejxh0R+a_NZePOHXFG+#woi>ra)$26kAH`^PXWjhkB9xJulC$^f
z9siWBjYZGiud06QvA{m8U3AawWp-=Y%=+@GZmy{;zi4_tdS&2WiC!7Uob&1jD>aMP
z^nWM`OHyvQv0A-HW6hPiguf=YYS?9d2Ir@*FPBQXp=e`g^+zP(*IqmRtSLHOi?zJ>
zrn=kA-gbZUnHcW!Bd7PppL1+~#h2Q<u=vcq>Qi$6w=lWxQFI92%(T!<bYh{7rQ~Xl
zZI$ZGvV2G1+m!VmetiG9&)jAG7eCB=^ta~pGd*t)0|kySPEMa)iXQX4%GnPDKg(;}
zx0}b&ydX?#&ed%@Z{E|=YiKX^{_$wp{*L?&qH;2QdZ%pWhTl7Um}`o}pQ%6IMeX?}
zxkgXIPd6)j6-Q>SPPd-f)#%epLY4ms{XUVy8>Q37D<#_?%IEr0?v|3zie7R4ofC!k
ze|&yN>~roKhx8ljvzqrW&wReINF(zTi?w^`UPYPZJa5}BFFhF|6FNaNFri1fW@46}
zu}kH|7`2L;pYuP@(JK&o6+b8S!hx%u%lis=vwpj1lm-T^np&rrt`aJ);yNqlWdl#+
zmA1f1zwS)4i8ywQ^|^-Wi(RH70W%iNc2w7?)VkTo#=Dd&$|by^usyb+RAoX(_Y1bu
z54L=*SXi2zv-xz{iWR;h4>QFb^j>A%4>a-CGU%>n-nE6zTKc~<-)-5}jf}k$WvhE%
zX`Fu%BvshP$zPH1bau(v2}*AJ&11hQdcC-pU9$btO{cj^3zL;R8jlxRZ1`^Db+nte
zcl&>rJAa)Fy1yOro~k@A;OGK}g-euXylCr=K9#Whx%hQYJ9YkrM=oD^qcCIB={a*a
z9vSdX+tJ>U>m@JA%$KZFIc00-8{Ur>(`rLmU$E_Bwh{BZ9%BFQ3sbT3V$X@`C-WcO
zGqyVJCL-s%=*^_;D3|#c^k@8V$@(Yy#aQ^G$jOJYg{z}%<U6}NTP_{>9c9(kyx8e^
zbfmydk#yx*r6<h{Wmg@Zqp5W6$<jw$EIN&a6IR_{`g+3Oa4kNb*WW)r+i9b;%jZD{
zbCUMDro;Ag5+go%_oZH7eSfNZbCm0c@{OEv|J)zEYC0ibGtD?7p^WkG#U-MZAuDsV
zCw|#?jbo+C{9Q32mMV*OznfIChI4M%z3EI{-ZFop<qnJP6-k?@{C2wUTkmC0l9U%J
zep(yt6?mV|ti9^}vHyoI&lg#I^Hx>x^z;YMzg_Ur<CxO2MO^#symQqztQIc#y?Bq_
zpXw8zi}aUXj@|GiQJm*L54(=!t9xBs{#kWhqI0k0`~EgN=vjM2eU{$p)xmOI=2G8}
zmwt%bwfgw=Wmi^4KHjq`%<bX5d|}h@efILMf?cr(S>5jOSlqWd^J1Cq<j~fmr}g#z
z{5rF-CTFrQ%hw~CX&-~dxpG%-idwCgC6f6=_{+xcRlnKY+5a{_R$j%Ck=5{rciNOA
zKl0Q6JbN<fah>MME3CazGyD9*CakF3Im>3=YqkB7oi@q#(|z{6Htp2g-7f#Vs<cRa
zu0nInKekl`6SzKYV?TIv`R2O*E{}WPzrA$GX<x^z@%HwsY4>OUJlnB~|5r?wRCv>&
zH7mcJJDqoJ_SHRU_uPKvY6kKDb~VXd7abassU;M<>&5$N0dDt7e|^nVWdCJ!^k0k1
zqFuMHUVW~;`q?Zei_(t0|CToWy723tU;T4~H*@F7%~$$i>?72fe~+7aPkDK8)J+f5
z1zmZsmj{Fyx)xuGxyE_6>xmSHpV;D>knrWN`KM1w=JHGyNs0Q-a*=-@$HL92f3|eD
z+g=b8+j`{QEv27)oC}WJyk(xiS!j9d^5m0STh%3<kGpI>9Cqt3|DvT&!&m&z;@)pr
zk+7q166cy6j(Z#pj!!4|zvt&Kv$gMjWG)a|I5maWJZG=Y-kBXXtLoAmJG5f0GM&61
zwa)kBue<lsTy~cEqt!KUPaZjCsn&mdQk9K(psY2&+1XDOXS4Lhv{!7Xxs`QrI$tv*
z*R4&@4oLmp;rQ{_+Luqv&pa)g_<ma9if^-Z&lWqpy>@z6RQA`9Ev6RVjZZ$BruRKd
z^TxXk(=`8@WZo$IDYN}n`rjuBbGM3=+G}r~#9ty&GfnhcS<|P&zX_@K{AQ(FH~i{*
zr>^zsSDNqr+-YGPPgdWxvSc!hIU%p-#1azO_cfUNTkP!H$7~($Ngto@!TbK~{H$xw
za=m=hO4gU}_`Gtv_`7#9a`PnTeg1U&^!$$NMsqVZZjfHQ#6(+CX01c)eJ$ZdkK|Hj
ziv8_-`(ujYvD*I|YsCI9$S!>vyZ+wlgljx5A^XHj=2qW+`D<>-`tPr&ED2qFu{ZsC
zrBe*!CY_xgFU*Z6Z#rV2HkV=1?+d%x-oBk(rg|{-)sB6#tJbZMyCF7lL-~v4RwcW)
z$KQXc^Y|*~4CjN<BF*ok@(XkCZQU+W-Tk?VeM^zF^pvv`?U_%V+g!e;cHT>S?+VFP
z@lD2yE<JzxeeJvN&tpGI8~$IFx4P{2o~u%O?)~`uA@%p3y{)|G^5ZTY{`~1r&X2$R
zx!(>~O3ypYAlvfo;p4>r3|~Cf=k}=Qm25mF{pYWZbkg}{xw9VYyYAcesqx2`wHjX*
zTes=1JAKsm!q+KJzN9qF*;OLYw!O^Z{o9G#!cXd`SO^*UK4Cl|^<~+9djoDMmDMZ@
z7!TZxDq1-2ztgMQ)dgOw!#9-HJKttg-g9}?)0O-mW*IEn?5A_{uE?!N-@+H)Or3Z>
zeXVb?!p^XHZS@<Blpbw&w&neQIY*;)+VY3>mb}4JZ%#Dh;ojrRHu2-;LM_9|QL{=X
zelXd#B+ENyWka|3wk-woG;}BYdde2N@bB*qUYUt`PnX0SFS5L}_?oEr!|S;ZJ!i_M
z%<}e>otU?zRLFd#!Ef<(S<UlyMVrgJgtACHSh7pwpZDI5CJ&vuT>sr>e7kv=mPohF
zo?~r0z4XArjm#5%70S8=|M|=O?T6rm;0^3|GoC-T+&gpfv7dWv=04~9anra^zk22o
zBh5sg;LmBD4|^uJH{Dfwf1XKy=bDc^J3Z%EO%dL_ZiQCZGS~1q>m228mg&qYe{$YQ
z_^*-8S!Ds^of@CCXWX8=?xxKrv8FB`*}pyQ0eg<+NAAje@_yQqiK>sJl6I-y(ibav
zD$wV@X!0EOK#zr2wx3w|y4)_V?SQW9(<f6_Zc@7SBX`Hue-A}9K83%1&tCt2pV8(s
zH)2HuXU`3M&%eO9K|pqvs&`)Hn@d+>!q?0Sv{!v;oqXFO&fsvsos?Bsdt;wnxPI~4
z&8#I)pPzUoX2*Wlc;CNSuXexMWNu}+=@q+v+=jW_dw%hWao6XncVF4sX*I26X_C`(
zu^At4*Xp%u`Yiud_3rEcOEVXG1{qJ-lJu(6F1;#}Z<=En=k1n;k3n+J_dnVG|5&D%
z+H_%`J;t|>|7~-fuKfEupN`0}gL8kC_3teB-tw?m?V0WTZyC=@3bM*OkIvEVJ{q&}
z{CksdX4mI3Oo=y4J{E=CiP2pv=ogdWzJ1ln%_0fEp9iUQUA8w}^k47XC(+e5^DCx(
zxLh_h*6-JWCrkP=Z>{|+kGg<CbMl+spX>|__oNvZ6tG=)2428Wl30|UT2ic6P`Nka
zb>3|^v488AOI%^~P*r=HQopvL<e^uIR>(BoXw6%qF;yOXs)zO@re%1aeHQyI@>hy&
z@k8GwI$J%w6*^39roX>){sYh5`+oJ?o=x-*a$6JW5G2<sxG=e7W^%prn(yC^KH%})
zRO7z*Yun=Q;_vS-eA>1k`_Lv4)+aNMM9yQ7f5f8RJRyy<=<bFGtg7p}7pa`raJTR^
z?yH=#G-p9Zj=i_ggaw>`SnLJOlkyz)B(3#)^C?#-{c5C=$nlBc`+j!@uoZ2+A@kYy
z@l)MDGB5UPYW{z;+s5lUhw&B}o<#z>Z=dRK@3a1SaONM2=o%S*0UIyb<u}wVm-So-
zdiF$Wf!@)dYi;raZmZPxWlZy`&nQ}Mmlf3Xvr>flo7Wn<3?Wt(bxoF|{T{C6vW9Fg
zw2L^-*ET(tV0D#q-&bOE%IQfC<8RTUoRueE2tSgXl(t|)NAd&C)#is%eJq-DKKD#y
zsI*Rfte~J+biHM_=tk*eKZ)}BQ!o1-w4N3xr}WzTh(+kR%kOVW92I=5ExVZg3*%b3
zDUFh@EJi%8D_IiOKR#p3>wCg2zh~hjm3hWf68=AvYfUh?ZRjU-z?)Mmg0b!Wgnq?J
z<r5F4xY|^yi7Fon)7Ti?kbnFp_rhlawLcno_Ad}&O1ffo<Z=3hf0==wr>EVp5N|Xv
zwb?9WCBwI6-i#$_o_eJ*TRx=sD6{VUX5;MGwm|O!o4s&LVCvq+rVgR`=_TPO7qDn)
zxgO(ZVRuO5nbkh^wq3pCR2H)x76<R7OfXSdv2pF1a{g_n+nV=%a9b%a&RFQ`@vV9H
zmi(fLF&1%-bL6K~&T+Fy6A0hzRCe!xabTU?)%ShRCx6Q{cAhfr*1}Kb8lq1!R8Gz^
zoW4HyqK^_sh4rypsa-6_;z4$|W*uH;EgtE`#%zDAXQA~AvyaA{(`GOgsCxb4jS(%p
zZYtU7{8H{<=xU+kWiQVf%?dc0T<|z%N=rdvET5>i%u@e6iN~e^Vdr1#R6caPyF2&X
z<cJdfqRn&WGn`o*5m}&RpjZ3MY<5Jy*vz(&oi{_19n50GHyQ_b3qCaylYO>F^!z^e
zPyG`&-e1}Kc+G_ajT<j+_J2@WJm(1e_o?re9paoH<nev##_MNX--gt4|L<60r6*g}
zA)V$bwL^c#G6nyP84lS;;(Wp`U4I@lML_cL5pIK9eNQ`m?(S1*?_enW-K!@oD<Qbg
zEk|L}qo<MuziwLfCR{mi+UduHh2l*&)U+Qlc!{m@5@jjLo8cuhjdSAes!xHN#IhS^
zJd}UnZmI5@^(QOpBUkkP*r@+|H~f2Rx99JC(f{htrMdQ|{#a|6vq`<;x#0C?#f#c2
zRoynM(p$HkUm<_JvRX>(vXhz5gxP{O`J87i{k(}Wv`8akm*TH=mO@7un6my}I=A`G
zo(o!2#NW?fB=ayrV*Bc?(|FG2sk?R>-fFyNf5&Q163a<7?$)I5pP6RP;be$B!yGKb
z6Ri?>gJUjl^YQB;kNti*WnF#CvX^x}=b?5n*-lfdm0@3s-Z*NB%{jnwJo7?@`?d#l
z+wMO%Rh#qfjP9CL#_CQ6bDyI{UnHC@leQiD5+(7*Ltynf4bds9kG)Wn3EHty_hhe2
zius&_Mxlp7UteXc{Jvo$=Y40%h;U^`%SSgoZlz!4p0#3K9AneLr;)aPw|#f4&Gt;)
zX_)bc<=f!^v3tp;E9>P>s&-Z%OkUsMyzf<csQ#{^?pu8PpB#?xxxU_@^syp9!+)>H
z+&i_G8L#y(j|(y>KmDm_uKgL+KQ|u<-HzAq*XWoxQO8^P&#_&<?zDY+I{TkQ`D-nc
zU1ySxT{+3R|5nHDMV@Co_J8)*dvb5xogAT6OQM}OE&k|pedeVd&TCIk><@lo`r1EZ
zrAKSx8f$m&PPta6tqO-1)*q7N6WF7%Rxij>HF1mVMx~bjv-D@KSZ=`dB*4q|(AD0^
z<P8^9lMQ%X-Gd&SdKuBwHc@d~tlDqGHM=Dp0>5uqmvMDzV9<fBhlI=7Yqx9gu6wQ<
zo~o~=b10i<yGmX;OIw!5Hl_sb(=oaMZZBhU+@D`a-1U{oaGH_HuWx#PvQBYqv!7Tr
zH*|Tr$k*cehi=ZDSabI1jJ&>MdsV(4HqHJXYthJjcm>~)=iJe`LJIjeW*s<|v$5pe
zIz9D1>u8^6^OyBm&%J9o`RUoaXLg!DNr)?!Zmagw5ZC^4ue9xJtZ|BA-s@#|#Wq?k
z`r`QQVY{=%^UX*5-<^G1RJPfIH{p3(k=34Q>x8cF`?KvqTyJ~M%sVmn&pk`nS8N)6
z=HC|2xn;Q#!OVL_U#n@`T>c?i=d{1I{`N!7XWtH53iVEUs?V~d`QMTWZ?xYWFR!gG
z-d?iIVegJvwSP*=E2VaAnic0<<WLe{wjxNxDO^0a<!RpiF#QGobKl$7PH|w3-#+oh
zr?8Z}k?D6Vi=ThGXQ{VPMdr$%-@UKbpUl1`dF@}5{j<&Q@1A$~_jHL#=J{`j6)l$}
z+bf;2uig?b>gisg-@<n9=UJC!=R4yx*Y8vRo$UWluz$*xcux2J2ltYu`iku-Ew8+E
zW@7Btz7wwnzNLH@%{)9~+Y3LbFExQxt*g_s{`$JfUHRlcqk6$D)k!OhU+XM8mlT=&
z>$cI~(%R!j{~5ktU*F=~Wi|EU&v}=2JY3-)yZ?XvD!T{W`ENXQ6{ML~?@c{8m7y%L
zQakn6ZV6@1wy&4c9|bvHGpowE^HE(=b-JrSYX2-Lp2{uHo~kp>Y82DHcKb)N>O>F6
z^!E>bUSIH&SNc-=2X@qE0|NsC0~3f~U|>+h)@(>gEJ@UlkI&4@EQycTE2v~fyUb0`
zQTMk8GXsMl2LppLP6G;xQgiYXQ}n<$ul9xp<}bDos5`%2;-VL~)ykK1^Ww|q7d5_H
z<lWd@Qm#EWW#<Ey`;2`#m-9lN?!TYVE-)$Q`zHs3&u5>{Ja3%5ujqZVPM^o5iLN%E
zneWeL@K_dobH}|FQ`Y#0|6L4gxmqlooZ~LnOWy40dLC_FdBU#xv47--mY=mn)xZCh
zcQmb+i*a1})vb1hAMZQ26I*L%Pg`@#M|;)GOTn*g?^fTNvTL2%WbF^PcinUHE!Gry
zF)2&qr7<&C*5M*Q?G=)_6`R@aEtvT*sFSTIa6@Nd(OLFQfi1P^m8&H+BV4zyQLtRA
zl`6E&!RPG}=S^N0nrwo9nyq`#Wf$tPGi!EC@x_v^MWGi>i}#<qq|sy7xcSJ7Duz9~
z>*g+<zwgewdyL^1gui$`S#<HuZnlk1s(~5-Z!f!b)kmzmdiH*A^OxoJOWc)0yS8a9
z5R{r1u!QYo=;;S5uWCFL({kg!!1VJqulwEI9y6vmt&&ck^H8+r*yhAbTK9i`SQZ>}
z`$v>!<l^5COy)gUsaE|X&ZZ&I^6dNcdbX5*6P7t{QK@gas8g#_H>0We?=R)s=YDef
zirFvu{J`jJ!e*0v@mA|=Oh-HB2dc#-tXp*KcvxnbJYVoZ?(3>ui?*!reYx-x>zbCD
zg_{hT0(XXaG#iy^EB>5i9<kf@aGXt40z+Ht1J0`+MqOVcg0^p-P|SY)+SPYKd*v3I
zvK{&IKYja;?I%7aa7@#f)^qP)%Xf*YnVYU3-Jo^x)SQW;>u0?BYhf*NHFgKbraHkx
zx&LP^DHK|A+Teu3zTM724bz1z1)BLJA8ac=Zz6PVw?^Ed2M^x<=H~6|egDh!&Rdxi
z(=tC?Kb*sOj-hOiv-!L{>91;Gn$P%lbZNgmH%X<V#^B-MjM>fM_FZo`E!$PnobSn%
z*v?=6f&0%c_I@)1rynX`_B*nFKKEz0MDNbUh6m<lAGzQ=)j3AYjOF@sD~GBuW~qR~
zfw$F;%<wt4JMM$KG~21y5t9-pdu#r`wtP?c@jW*uo4S^)kTpJ9V;z}$pN}_NZ<4sN
z_HIkwx5rGD%}xKt_0Xc}`Xsrn%X68|wBP)B(xdb9l$$@lJwE+FcmLx>^1WvE5ohF>
z=buUMc4d2B`|sl#OZz_S50_M*&AWTA@R9F7X4IT)pW1Ef$Hc&}lpV7Jke^$SnUh*n
zjGU26rvzr-HV`;||F0%X?FlyDm%of8-Y8~I7dWx&l1YGs^NDXa1C_nqCQW{N+kab5
zWYMBMcmLNfw|@EOH1Dl_Hha&Tn=r3S*mtfmJ1Stp{R@lKZpuC5FaLg$w@Tz|<fWqZ
z7Z3lPzWzln{|j-AgMobR35(YG$X;?-bwp*qiRNO-pyyhmJ`0^ZrgW}a#<Rp}mFM$k
zPnb0s=YBg7xL8B~;+hGIoXR`Gwoa%zGhbCg_?Us){fqNiX5N3Z@q5~Kv%1_L+AG>J
zl_QqwCbUfN&0N&BrRU<7;M!JsHK8!yzzg+pk+Ja^su^>HSa-+^3rEJyy8CjUv#6Sv
z<J3)?)!#Ngd7Rpl@NA09FU=lVZJ)m~6YCt7**ZG<s$9%dxi8dvrsiR@OsBZq4vUZf
z`kL?9ojSVJy!-jpyp6wh9^L)+S7ocY|LL<yTV-=n#oBk9%T9Tlw=-t{<L&o%=$5{g
zoYsAN?rv9JSIdlIQyVo-%Z*diW~JTzedx;Rn1@#ks(T`R{gURrT&Mcb@b(+UTN}SV
z^1ZF<!X9M!+#_O(mzme`JvM18gms%%?bkhMpK^K$^A1<xGy54=x!f~wn365%IBPQ3
z6i$VW4*ij~H|OvA#(cO;!hHiTbIn?lL$4n(-i<4W&z7&g5%pASi|}d1>{9pT+`8U+
zIn!S>HRh^+xv}epll84>#p1tZ`gql2qLmL^_7b#MYq==%vA~(zPm1^J{tj$ey~}U4
z?Q^cxje--TrtMf1@U4N9cmBl#oC13alAinS<U7-Fwt%NJmVXD&oQ6{ePOd+#IPq;B
zdRlZ^o5mr>$-tmuz`!7lRw=;KVq$TwUP0wsslWb@ExvvKCu;YWKhxCr^d{vktF|nE
z+_2M?+xQNTavA@^6TWk<8Fx<JEbGPpasU15zRz=wTBRSjSx*%>x%uzDKX$V1MxC9{
zTW6kA`D}COvB|_)0g6Jtrv5EbJUTjoM<>TEkI~@>eNtn<A$T}N$arc;$9ZlZ_eZl%
zyBzU(u~>Tk(vEB&F`w$RWzW?MeOv={{Liq2uBl6pt543h=Gz=BXBg>cv4O!_?z6O>
zh{3|tO-Y}ME#Gfx5z#)T5*H{MELpw5<@6c%pm|K^R>WvnpSg79y==bFl|2e2bupVv
z9w=JQpYy-4?1}83s*(@4Ki;lC!^Tn<78bU0nS1otnS$c;9bY`EH~d|on{no^F!S2;
z`T2)5zfO<Y(42ax_FB?Gf0q;DYiAx;@?m3U<oZzHp7c*XnZ@msBuD9q+FDL8$-|#H
z!=L?p)%C|IkGD*{S3~?<PfT2I@d3Vl7Vmb;E^pAWnjo+H<hanLY(;a`C(HR<t}2!{
zA3V^%BIt?khqyOKHdIJF{nfuBBBkVDLp*zG3C|SvtGgNhI82LLo@F-It;dV8`t4~K
z)rD@xbBrFQWxZPd@=AHCnuF&V)~ViF*Ms9<J-W#&={i4%O_e8SwX^aZ50=#{FCKVw
zz{AGYrfT#5k5B$Q`SE@;&xfYMGjk0y53H{}9eF=t&ARSX-!FfEG*@$e>3b&9q{n%8
zAw#ekC*y+ZrwkM1zn@sRyC_0y@0n{Sb7nD=NL{+~v`uJ(K$5z6O!d8hjT$n-_u1W(
zHvhWT$GJOEaL?8S*B@Mb5N+JFE#Oo9ze6rnh3}>sKQghAw0QDhg{Z{cYcCH@JkGmh
zHhYLvtX1!WhYRlRWlesatkA8rK4nuI(@p(pg6nL)@NIZgImv~g&RO~Bn!^wMQ#C6d
zWdvzyg$J&j8YK95*NL4i$=U~Z9Q1K52?=C;JKJF89?|RG{Jt9!md#-)ym`=)PhowS
zf#t)4YZUiO&JI3mGkdz42}fIMkd#&N`=~}o%f*4^vD3SYXKp-|#FE_jNn~00{nL^L
z$BdQU#rFzn$Eh?6C`G+CY`>J@di_+(l&svdyR<~=W+hhKu711VN1Nl7H!LALzTcW%
z>?^T?gXzt>;OoK3kGi@QB3C}_P}yYpXuY_Bg^cM{_DBciK#3wL<^y(bba`6O9sPJa
z`oY_Evly;jSR@@#$zQf*N(yt`^OFA$u9uhI>H3<?ST(yqX6~MqZ2?yqT6%<=ez%^}
zRoZdd^+5Ue4`%U|&tq~!Qr3M`Q|_p6x;&*bfg{4^{j=w`b6!|3-X=Ta*WyI>fSVo#
zvvl7aSj6y8|BTdwO^uo-OJ=>~x;*2F0EgI_mKC`H&H}4+R|lS8*>AYRc5Vfe&i`4F
zTCQO_AM=(m&#>NH=&e=j%;4Da;$B*s^TiF4WpAz(K91PAK~yn4aDl<2-7Dj~+?b!|
zUE^#G(8|;^x+byVjz~27`MG~L1xIz|T@P*D_4-3c?B)#Xt>4A7r^lA8<>kL&6MaR}
zq1`z`?xgu;R@-U8(o!qmBm{nLWV)p|zb#-^r53kyU9hD7g;yOfSp3orU(DgGf2%tq
zLsIwEoR>ChA6ZYjd8^5ve{PXr)X|srbEPiL;^}fSi>{t<^3VBc-?S#q-`n8ry({dQ
z^RjiJKl&0`E<aymALJ15(aGb|#aRy0)1q};SWPb5SZwJH3F0%{v;L`6+qr-3!9idA
zpO`Hd`r~?UqC(;+fd-M>Sq-=C#NM4ac+-87y|YKw8)q)bH;fyXr!vL-2o&4!>)X;0
z{k6Xi9J>;gDVCquuh9~Di{~T5K?}RWDzjfV6xW~WkqTb1)W=wVsnDV6ZCT3xk4x4~
z(vZJ!x+~QB<m+o?cavWIyKnP2FksfXv_QjsA0MzyX?8p4B4+GqDs5INS^7wB|D3l@
zD_CM1?%e%xEvAlB#9-aC?l{N$_KrK%l_nb6@o*nl&N8X^q?JMGPV3!LrHc}Tt1q)`
z(BHHz(wvzk{_=^aCdGx<Uv7)53Eff{@%WJ=YefTh?Z;UvpZ(8Vzu?Y2S3qk6%U4CW
z^U7^g&ptfa8LM$~zp<X=MelV7{(hb0sK_LDY^$*A18y6o28K<w3E~yvF>{<=cW3N5
zta0dh^Y`cS3OO%y=9Z)!+w{I({6<t={n~5tv#kqn>ge6N?EN{+fRl&!?SCo%#j6)x
z{kQmD*7e_c-q!hRu7@W7y&C+0zm1(kbi?8dw+%wyh2~z9VKFh7WUy$$`u!qPbD}T3
zdY)6<JoQKIn;4H-LQ{6+MYYLpFxz0Iwy;s@g4KtR=2Az_U5^q1wNIKVo2iD$M1?iv
zU39rBc_#Apj_Btdyr;f}OMJZ3WcN&Pv-XR-Vz+~@v(1j?daz-8{;Rf?Rke&tKd#$f
zKgF|ny{>hKTnf{#(|p^?&R^K97ZE7=E-&<*P2kZ-QJYu35>wdwR#0q*VfR6|rzUL8
zGmcH<zWwmn#e3P;qx!jTABs8Yq}EuS7W=>CbnvzvrKiN)*9HWz)bpI@&q`iack$pK
z-TbABM|CDIxT$*Dwe6~ah>+9e*$<yF3G<$-Tq(A9lBY`GCXZWdZz|8)^YZ9>|BDZN
z@8`VvFmKV;msS@iZ`HY6|MB<SAJu#R@4ffm>~-xLPwfL=&R=Fw=zTPUv47g<SNl6W
zKl{Hmxoz>_U4rX>SsS&@L6VQ>M?3AC6ZQT6d^@$>OjFY~{&lK6^EayUP2_ov{U3S0
zEp^`h+%F-aXT|}IssBDzv;F3h?D?N*eB*n|*H9rblRHXY84cINe7123#rw|WS|)$)
zUcJq|O53fPFaG>sF%q8od#l>|UH6UDzAssFLMJC};q#v^_kK9V)hMj5mB0V)bH(G=
zKQ7nH=$lx+ym~SGpIcmR;^aFomU6ePeqOqfJ?&7`q$(e|FW<|`%H*c}JJ;{|uKo$9
z@WbZ)`$eB-RxVs8C;MyN&DxKjt{Ss<<p1D1ySc6NUEH@e?mv=?qaCHcOgNqU<Meyh
zZKwMFC?!bmxXu1&B|k^%&X{b0n=yuac4cpR864;~_0EgPy0ymxbMIHYV)!C6_t<0Z
zyT_k3{AOY?*>d<^<FVz79wn{2yl&U->jmB4R$5+(mbuEi@$j#`<&7VUPj4_aFtf9+
zy1DNa>+F@k%YJIi+pLgqP_l21Y|ie-71w|5++Oqe@4Nq}ZQWV--kJAb9JPrrXEtTp
zPeBF-g%$<|NnFjUWKg5Z_IA+i6WiX`xXM>dn7gsncN25PvEZW?ZzQuk4)OV=mHiBm
zip;t#Rr2u~>tpASj?c}{O`p4US9H*7-P3H71e#WQrEIOzEnOe?eP2fVocViyZmxV4
zaiu@w^O0qBZ+c{;%1&IovPEsn&gI*;m3ipTIOm*h(|Iy(_1^1uvfpm?sCPOUEyZfL
z@ug^K^GfyuD$ACIGyK^9pLNFGaE{OXMUReOX>EUK!g2Nn=byD}10^bs7`S=PX}Mz1
z@%Z5888i0DA6etIWvl9`CXe~EKC0~PeI9&VUf5Wvw$bf+@P~v`j;<Sb_|D&#zJ34Y
zom|g$9<<Q?ydi&`vCsUC`{d%Ir!bnI5am_=kr>fvZtARcK<7ngej@MTp2rs?)eO(x
zyKVgM=f~Ld7O%eB&-wFdV||TYgU$0>AC>RU@r#{x&Gyi2xd&x2Qu~f_@dlR3-4@i=
zaEe}6Jk#;J-$S+5uvd`}OT&2UreEK+?biCsQT2!3tL|8EWl@0YQTFe)JM`DfT4(P4
z=UK^X{AJU>_PD6!jpoy`e?2Z*p{?%aW8Nivn{(4etN&L{Kdk1tq027++mq|->iJI`
zDw?;%MM>8^dQoj~&Di)$qa?4fj63hY1p#449vT=5M9lCxu=|N%_J>RUYm%R@Nfu@9
zntR&KK`r>!$D?rp<q~R=@p7AY7rnV$XqJ_}Ur*BPm221wpX68R5}PLp`F+ihVKbJB
zbK9A-RQ0KTM9YV?X{>jW4qUeI*>S+tM2xw?|7A(mRJ*VlmwNQ(&Z(=dTWxY!X#36A
z+0iWj3g)EqX?3nR$hGIiDXnQK&KpD7ZOxQw_x^vsIeGE-+lBAHPcGkI7O}KQ_p4dw
z*@fPYzJar|*O>Q-et#aU#eB2GtM<a}X_H^iG|#*lv(EFcw)O{iziZdGFL)?Bf8LM9
z4lAFxG@idwX*H*EV$9{zKi&#nRcGVuzx$rw=oh&%rrvSsC$=wYj1mefA2ID@6|EM|
zirvTihKaGQ^YN|Bqwyb>@h|pyyq4*&r1ZZew<#r?H|f4|+p>8}l)<0bQ4P;te7R!r
ze!pe=qQ*2?nJnH#k?q(2TzVuPcjH;>TeJOdKA&dX{pMqOwf@i4b+J!6>KV=`^X_=5
z*7eqLcX8qBiGcz_JCytUFI921Jaakt@ZiJ5<+UefE8g9oC99>{TD{>>?$f&Xo%RiE
zdAW^wol283FGa0ivGh`Wsh{iYK997oJlyWxGY?0(+zo7I2*1ErqP1r7v-1^C1Ad6N
zfBwVv--+vA!~P6I_Kqh?tG#C0swpTRPn2lk;=A0rB58ZJ^4rDrFWHUfFKM&NH@dmc
z@yqtxQFDv=v(6upQ8v$*wry(ZC5EGqj<hLSv902;y3P2|u5?iagYE7Nhs!It%e_{9
zkdly;vN+LpymdkFls2|PrNdm!8m}fK3hd~0I)7t6bJ1<ZSt>`PJazSE-{4y3>{Gr#
zlqF<$!@a%SHBn49UNP5C%+gtS;2g(>D!(tXMNB*n3v3l8zHhJp&S6ma{!LGT*{p`u
zX}c6n-&!)J`pntk_~yX%q(b*56_%#BiyDV#7|n?D`q*<qGL~B<*Fb1$iMIN}1%>8+
zFKU$R)V^=RqPhD|(D~aMr(HHK{5mJqL0Pgcp~1s?-_bV$>l+s-6ngmiC^9myeaSAv
zrE26VKJ&vg%jt%WlOqM<q_zoj-J5j9qM&ohLDO%3GQ0kyifM$V6n*gNNVlqct5xvE
zYNukv0k`$He;MWq?fyUU&cE&JSFSxe?M2%i3ucqe(cZViGQ>1w;wFb~Dd7$gFmqWX
zwV}t5v2Ec(!Lxf4A9U^WGm5>W@TYOd%(jvzF`s95HMWOoxMWTcpUQB(Fk@4qv*nK$
z%+5SBE{Gi6z5ct;b=S?d5*e$mUee>*s;|YO|9kS;YDXqkCEe{`quK%tLhTz15)W))
zzpN-!+`B<N;J4djmdjR6MFwhf?gbp`=xIK}!NdCJc<#Eb6H`szwlzO{YJFf$9+S-1
z%e?Mozl*>5Jl!zc>3Mnl0<OX&T_u74irft{w<R9WWMEag<q+)ns6l1Htw_Usk;;wH
z4qG1g)TAts-g@?B{I3Vcl_V})lAId3C@k*dH!-W&Q$G(Cc4lqlt2$x)_*S=g&y~_+
zKX^NPcl|uS>SK7s0`2=6w_JDh?~J-Qt$IS#IWC5_IRdJ|8{U`39-H!dhqu*ns~hfb
zW=yQg2)NvkZpv#iB~1UpmB}k}k8KH)Nmy~mb8+$CWEbZS--^pwQm5))J-kx9=+3p!
zDCJ*wEE5&|-YrZK^iNilm~>}qditrI8Y`_>ekLB+s*$zi{4>rka#=f!tIzmUT>KIy
zk$F<<bn^ObP6Ep7d0EpQ9n(oOZ^>gh{hM8*_)GWfdW(NkUs{zFXZdcq^EZV_@$j7t
z-3ybOyR{}>yA_c7uyv|Hb*jJ<_G>Q7+_$_k-xtGq-pX?6wwK5IwlYbxCY?`~SYh~0
zH1G+l`1W{zO-GBfYz&bu?0t;~Zu6xDFyB3QNI2WBt$k~i`&HMgUcN4$CM9{_Hfwl(
z;+w0l7!zyXp$l`kd$&2beA7F>XUQUSwx}CY4_4_5#aQ?I-Zyie{pa9sRwo0VvjUH6
zHq>iy9g&$m<Do{NSWs3{=dTzU)e^tr^CCLB-HWY@0`5MTcX{KRBd#Y4q}U|1^+S2Q
z=iUjqqB5~*MmP`GHXk|R2?tt=f|bu?>PSsBSA4H?gKgT(o(WFN@-Ip;7}<tDQK-0I
z-zfdq*?Ox|eZpe{O>VaB%S;z0g)`4=e9hz<8MU%!k%d>P%2kzFS-nB!UldbnSEM*>
zZ@8g-OmS+T>9IvMHb0^RcDj4T9*N$t?Se?0bj+HUd&1WAt`rg%R^`cY6cLMmqm`r3
ztFkD9<KQQs6M--09xGdUdZCp#-=~dfZS$mW>$t9d8WAD4zayo$roMT~{><v?-{t|L
zda55=gg(T(o3QW;emOGXn6X!FUx%~s3Qs%78?1?3`WG#y@#pM1#-G-3wDZJ$PZ8%I
ztr?4#R&0!kh+C7wWHa|;i&SUJudWk32RbruU%7VqTiTKn!bdGNr#$(%DX*C6`Ofr-
z^KVWpNSY#$s@s2gn~?p-wi$6PYQJTE_dn5p6)Bb(_t!PeL0ZVSY370Uy-&7iA5tz8
zn|(%u;Yyq59Hq>zu6jZ11v*n!zGk{<xim%S_~jLwcUzY|@-#ZKBC*_xKj-+en^((}
zv^ymd%j4hfznARuj@9AB0r43(R@Y@U@oji=%+*Sxea5GU8*csH9rion`mNn;s;rA2
zoI7Lb;v2r~@S+d_mX50{t^}IT2$ZPYuxCa<>p#ycKD*EV?oGbCq;5iwy6dM8>!kL6
z+xPM1kHbGt{w}u&urI&;>ooJ<r}kUEd~|&Jc(46w`DEv#`S%3=y>s5XbbHW+>8=;1
zS4G#iPT)A5pK{?FWAoh>mUt5thS@EOwbwpgT^Z$@wD-zC0d5tu4|gqJDA=`WNboFP
zaagUlbnUu*5i{4XO>Ja<zSenf?TVFY8@7bjT(VyB-*e7{Q&K&D?x;$tsS5mz`4~{T
z%Hcz=l>S;4p*a^sub*P@Hfo)gbZAQCt)wHp?>#@O?GHZAT6<)5y8pbn40d4wu}As8
z_in#>FkJYd(CS>Jx68#c?;HMYFI2I4^wF??>gvNrYwl|Jb6;zWJM(>}|MOYD*kqr7
z3EsclEMi7~Zt^Kvr-ym=J}=bx>dFc~Br&viR~a==UH2hVMEswQi`21`yZzmltLOJ@
zzL!5KeP{2yr`mhB{{5qKz4)}6_n(goVm`I%6s>YU)nfaaalV)CLz|<Xx*N^@)Ji+g
zO4gRRbZhR1N%CR4&fk<*&J(kG{v+Fa8rL;@`A<sseyQ>9_dINW<nM##NxD<kWllTz
zmv>>v?w1uyqqaTx8(OW`Q2ls&&BZ@|`DR*vRPjhkdSq0Ybz9-~nbu=}I>jbWH1=~k
zWxO}wZMVw*{fpo1KO>po*Q>I~C_Eu>--j;!%9G+&>mu%&GQD_avc$o>+fC5eKIt#d
zAF*n=FAF6Dmo2sUR`u@Uqg8LtES@?oLq9Ek-sI+AwoAj7IL1cAY0P+VcWScrv;1`1
zWZt+5Y5p~A=|0P5UtN1&zkkW&UrS{jv#ngOA5C(W5uJW|b>+-QOh27&Is3`3^|Gv;
zx+iF3ytc5{%QI^CLnfck5;MDLlmGUQ%VqX>r-JUBj~Sb|dDeNn*{ZVfz(@9%{Qns0
zWyGGE?Yh2higk+14VSxd-uYXvbng1|)@i%LXM>;B;dgS|X6sIj2>h$QVsH3ep@pAs
zN$!oxJiSi*+oL->m+H%Zyt_WUr(w_gl|}6nGcMKrayDb}Pd>%CJ67<<dybE4duy1i
zV+Ebmo{6fiGyTZKkzM%F!{%VCk;KG@f6T5cx-2P`;!$ySD%>8tZHbD4aTj-(&~>(0
zvr^g9os5T19ErR(!@W|BMWAY#UqQU<uK%7I&U>bog`SYse77Zb(T-rJyX!YNZT|eN
zcA_r-fjgPvp5ig_ewC`J3T_|fFOzP3ls^4U<-X{Em2<PMF$G>OH{H}LDxtA{?%Unx
z-5OO*Lca5G{BL<{aPIEpPq`<~-}L-BZ%@yri?L?T=S%ebo_5a-&-t7j{Dvzkdm3}F
z#OCSoX_p$8zf#PQJzOtXWj}X9Ra(W)B({XFH7whHy{ouBd-)FQdxv_Cc6Cl!KjTgO
z7vcAB4(&a5wd|_go!}DYdFPy%O}GE5U1K%j?5&qCmv4W)_I#Rqp-JrbQ>Uk=>&xs8
zjF=W1ZK3TD)n04IIB$EW`(w|9Zq<twYq)Q3>PVkta#K@xr?te(9Mh7eKlG;GJHNLl
zy>Qvvd7E=ypWAS^zRcGyE4j9@dQYjw{8Ia)yEbdSKEEX7%%U~(94DsxpK8$%Kl*5+
z&DEx`Z34@$=V`A##Q$|~bB^oIT@U8i|Cu!}yK{L|NvgN)^&bAy+t=E2n{Qk7PfBjx
znaHfmmZkEhv&+==JN5rgtf=)(&&)mYJ6l1|^PIhFde8i0tcnF5y2i`CP5yAfZgcRo
z#9NB)f}Czo-Y)+v$LRiNfnyotHs+ioljc22oBvky&|L=|;iJ<gdRp(=Bp76CX&`Uj
zqnfWBv-3-<(BcLsO@$K?`Mfs2qqf@5koy}}=+IDY-#w+Mdr^)VTS}*xTuja8W6lqo
zt#9<Z2MF|wEY3~t*%mvCLAGa0?6#ka4?i-oIr=8dNV<FVhRSz=XYKT?-+hqlQ(_7I
zv*zO4$@gBC%`-P|zhFH%HKV)nx?9KmJp$pME-c>N;(xeYt76Sdv03?dqkkRy6lt-u
zB}8YHmrYbed%fuuj~pR^>xo{QODp`OQrq*G40gRL?0G(Ek@z&rxI%@XR9>Um7S~wR
zxpmDuR_x<V=3g7M=k}S6QR>IH{nr1o;@ymt;L;r-8+0yS+Y;k@&o%0X!><>?{@;V|
z-e0lp-?8Mf%sukC4^O-4+fUWlHt7uijHrxtOF!KRd|4@=DLZFhV5q-i=vq-Wuf<WT
zCX}71X5f;Y?Ir7&_w4zq508(g{+xX3eZd{=9h{A28!tABS{2AXEnok*%=_fO9MO!O
z`q5YBOZ+HbyQxI3*)E3t*N1{gDStVhi>b_;C-F-JKj4-LJO5L@EbPqPCBY7t^0FPB
zCRfZllA5#Wn%@G!2Wb+!4t{w5j<<bpXuMIf_WyU+QnHy$mbJMrJ|S~i@9=_0qSk#}
zyJwxLQ0fuLxSJt&^vdJ5rA3dWnl?@hZ<{+^*f-w7s(eCjMN;se2t$9-js5*8W#Rus
zP9A$#r(YH>chy&6!JdVuIPPVhy?9KfZf?b)FUsyWSO1$Z_r(3Ci`D;Cd+r(=7phOn
z6;@1D*f(uz`&7q|zayoEzwe!4QJP|&=2v<6aPr>w5qtlBG!co4x9VK*{|CEZ&XgOI
z_W#z}Soc-#^ZE(0w^feXT|RO^P2z`|ns|%yj_X-lxmE=S&ai&MY@atnzTC!S?P*Et
zsJXhIdv0dhyL@5ga_-WWJvpK8!+{SsGNT^9amf!*a0tjU-cyrx?a=k?$mF>789fYD
zy3C&PAAGXqYb&Co|Ezny$ne37Bj0W2A4+=L+ZeHrqdIYq_TM|3)^F~*r_rCXUt4*?
zo~0Fzk)gE;Vx=y=l@}hg{Oig-ax*ID-$WhdzZX=rF0W|&z`L!t-u8L<;*N0bq;IT!
zPa|iBYVC44C|m8^CBN0;@Tbl9WT(p3&8t}a*6h~1&zZZI%I~?iV)yfv?@n0lOaFE7
z^PPv<b&Rz$`GoKL-e0jneeIzs2gANz|Bp5$yteE9)*My_hFCEM23?%vMe%8+dC4W2
z`FZh)B_&0fNu?#JkOiW-`M1pk{>_UoENF=Gi(Q_1tF~ZT?#hdM8Eyw`(Y%n)q8lg{
z*d?NIs!#mM{`Vdy&AvW6anzuGqwl@XcRp6^vHm3UPI#Je2e+iux)i<;<A_UhTo<U!
zU|BvzAnWi`E+^5AKW|#9983B6=Tp(qvpUPOwN!o6v?I?<iMx4_H#+X$oV%9}tq3^z
zL-cCmq3bzq!RBAeG_OobX)3A|zP~JA|0Q!|tKvp6fvlcqrw?t2{8iR9%Z!s>_<<#d
zoKa@4R?3l*!+M8HW-U(SV2D_ev-+o&p+Jjp#phqIr0N!XpPiZTq4I1?;D^Vnq-H$L
zdoVrJYv+tst-mLgH=YS`6Zp8tgzGM|mfPJ7|1+$!54Fu^nNoItmBEBn9mj2!gq393
zzC2-M(l6b7thlo$+9UEvcS--HEbrEvPRp*&a@R-;7k@Whaq7XN)@s>(!SQ`N_ntC&
zH$QH32HTG5Q!}rnYW2-@Gn=*l(a)0gyu1Z5(yL6Trdc0Wov(Xhef+<;3A=y)_OIXb
zzv%x%<2#2QOL`rg!R7b)qs+0#8>KhM>+$Z2XU#sknA4^yZP^8(xcdi!ebYQkRh{{w
zy*&ghE+w?cEIyf1)O_di-fdG;E>`S&E_r?G*3LCG1%Hoyd=uHi<$3OZqTNK*25#?E
z%}n;|e4;T|Z<>|N7S>~(z9w&`Z06;PN0Uz)roT1KNPgTFY}inzZ{1@ZlC;Bm?S}0|
zHhXtkGWJ~Z-J<8T_)DgY>ay9LDYLZCp54|hbVqEv2j@plj}M1;mtTLcmn|r4XyaZ{
z;Lov_Sw*7vRgAj+Z-$SREeZTHFKv}oP)S;N!dQ&$_fN;dhD$cK=fcjJ-}v^-V6A_|
z#L0OUZMF%^rd6ETmU6aupGb~HEcdIA$1L)M)^>$nn!KW{@#Bv9j3*40lL|TGuD3Hf
zt*I+8&7buk)A4TZk=d3yri<_YS*ia1d!7HcWdFEF-K<*4MH`&8D(`c9E#LBa%dQvg
z1`DP16lNdFG0XmJS<<lFdsYQkc<_q3{YA3^_I?r#nUX7O`$a7N{8|e+qeq)|%vG7`
z^w;Nl@|KfVS|z6OZ1j|zbDV$E;T^)JHld5wJZH(PmgkqYDA=W1E5#pZdXBeDdf{gM
z9S6c3I!&z~sQFfS-g;n>waQpeqVmeqne#%9al1WMzMZ<f{ilBE*X=J4b;lj{syyEt
z)aqnf{_Vsmt)EiP))r9<f|H!IG`SV6_*3r(t~B^stQ2~(?$9GIhu*`>)}Q4R@w=Dq
zu)E{!ww+r_`)?eJST`$jq4nD>FRM?!@(!Q*Fmv(L?0~l}O|MUGs6CnSV{P24)4y(S
z**L}7?}_uWRm=BooLPN5<i$h5^wzyor?x#^qVDy}c|YS9jpAqP3VV$z&Lww5oXK78
zbK>st{`xwF6ej(+ipBMJb?c5FjEdD>{qEdCUu~_}gB=sTm(O3;vLHJq&*DX@Qu_VF
z7Oxjfs@QII<@6lS=4s{fy80g`tl0hFEr-o>(M>1(GZ?%J<?DrZ^~D-rpJVo3hj)T{
zXl!Mh%kI}Rb`<y)hgY}wCfvz=!YJ7j&>?oHr)I6(rvG9YPle=c*E6;%slDdnJMft6
z!|zJgb-@SpHm!Tau(mq?&bRw}iVi)9tvlCvcw25<)wA7O$}CD3T$;OmpLg!^)$Cg5
zwirpgP?u4Q|14)4@wF|hb7}g9ZC?8dcW+$0<P0av?xn$tmhgV9{OD&mhqF~W;_Rbi
z8^2c_dmdM4bFuV(vft7ruPxa%HOsHAh&@=aNb4H^wR_7qZ$5f`{oeNh&kNG;_bBKZ
zY}J>%pd)-|-&D=-G1G!}3jGMbH05Ucwxg$~Z+))4e)~GF3mJw@$N%Z=*#0oD^jx$2
zPQD$U`H$<*?D+rQ>BIaxeDluzV?`b2x14Z#-BnWthJ$YyFxKSd!&dSn!&so<{@Uzv
zY4c4F%Kvg5*;hQPNAp<WvvV^u!phwyK6R1)S*T-qa?SDOcT<{^j;EOCmj@d?zRG`V
z|Hl1qt}#0>XPC%Onso9_+`Q!OH*8$3OaU5KxcQI%T)o`>?flf_nc+qMO{P}P^)-r=
z>sah+H1E`3^~1-j`HvQEjF@`!=@v16x%!_e|4%+v_djwpr0e-6t)hviv@Ny8idX1l
z%{()g>;L!v4s+Gx6X({8FR#>1|F9`WBsD1Ab>DV#&F-BYk56ujn`YGKYSv!9)#KBi
z6)QcqZeKpX_t>x3I~Y9VUq_lrbu5z7n^a{bu=L9M)O~YazmL>Cy-Oo)YF)s3vB)~j
zNnSApuQP+xA4dj-Zn|`KwmUQ9lNn263O1cN&f+CLd+O<mo|2%y5`150|6H>p$JRNE
z@zlT1NeBOi^p_g`-L+l)!RJ^*@5vW^_R0L!IsUa_-rOhQk&#b4eoXF9_Do>2(Kws0
z^>bCk37d73I(ry5de7uL5^1(8LidS7j7N^TX1M=mAqVlNua4`~hl(9d*>L^3ho+3F
zpZ?3|-;0*sSAY6cXLZ)!e>-OAZ<?vof67~Cf9DQ~xIcfdde;28d-CJ=<@)<<71r2T
z^>ha*J$zffIMvL%v@!p~aaI%6*NqjweAFz`wRZ1lfA%@G*M!+7^^}JF*<+?<x7VqB
z)}G-%`OT$}X2r8bm9zZ0*3VJfu9w-{5L-0useDT2g^JpLuOtH=*G#>B^0<TL{y&#P
z=bhR7QPOtn>EFT5id8nc39PqSgE=4buCAP8TKsEe-L_kc7ghC4ka;BF&av;$geiMZ
z)Cuz*SrPH<<-$s-uiw8t;@<97)95d6Q&C`eRx85D*wfqOWP(msf{4YMFFS;ex~OcH
z+>@3uHAzYS)1zItycevk($M1y)D_?J!c}j*@5@Gypc#CoC0uOF=Lok8C@0uoKfHHw
zWax$J86F1uVy^QpImKUd)ykf6E250&{=!WU)DIuc;)r<v);D$1DWi4MCVPGp++ZUz
zf05=F+gYFfceDQe`9tu3P5b}UKN)d7AJ2zwI`JXj>%YF;vOntGdEdG&p4Yp>bpK%R
zALa_DiS0L%mrR}${@5t`iqZC6Hh*>oZSnTfO!$$w@z9QU2hGI`ngkwdDjLmRY42P$
zXWf<Vu37(Q&aR!O(;<0i!I?>aie|=m1uB0O4XHS%d;Rhfv8!7m4rTeIT|c>sX_d0<
z%hq+>vIjX0rgQTAG4*Lu=}*}B<nc|R6LxdBmKC$sFVq&@GvUU2(Jx|(%qJc<TGV~X
zP-r-RFg&uqo#9Jl7*l@Y8kb|iUfU%@4W>;_v0U9={o~ApCk$#UUfsXFip}a!O{`wp
zq<WtA!{zTMWNi^!R9K==_2K^l`vCrgikE`?#(!pBzHj({(f>-b9(mhM>RqO>M(Njl
zcE(J*%#iZu!;h=lznm|3?XMS?l$n-!$U}!WiT~)6*T*+#*ZzI~;r`?GANJc{-qY}u
zVRihe+8FU4tMw+!ymI=;vCVCUUvbR8%=l)>1jQfg+ia6JMVL4=RAh2{sXPc};b%Ia
z6xvsC^xFdQ28F+se?<TPH2%BrKLgvpmBqi9O)mZQ<#bqeZDJjlcB^~(y&gWhU}lr;
za??+*TGpO=)n<=Znvd(Rq_tO1uUc4gv}D_=(Car_8b6wUe)RlF*Taj`(+;h9m3dGl
zVogEL*KV7Y&%Q|f=ev?0oV)J+xw*$TD4$qz<-Jzk^E7^o^fl^s>nhU^@!OvWz54on
zZ}NiP^QZE@?P;I7rrPi8c9ZM(zaITBrpLmtV`1C|F|Lr}8@0CUq7-@0bqZhP3J6*F
z?*5yzY2lwOKCfcXe!Q+aL*ind#k@mdmw(?;W$*bO#N?Q8Ib)%bK%F-;|NpxB^;*-O
zM%-F!<?)6)|2l(TX`9o8qrRfgW!9QZK2*Cg>YS>_j+G5(^ER%Lp2o+W#}+MFl#)=W
z;oiMC-|v5uy;jn)M?udvvFL=I(4IcE<*b0pL!n>u<Gm)7hPAOC4mw~Ys^cs2UF+oi
z$A(<ed;b;W_xxsm)G7P=rRvc=es2TLyqV>Bd(D@+@_50sg71PA_AYs3wR-sl-dknC
zLI#50MK>3S70A8n<Cyd<!QU=o%F&3h(3~YLaq~ISxEeSlmg}e;<ym(9{>s-s*;l_m
zVm{$@K>ftm-;OF@6v)Vb|L5%H^yT(P#q}R=UMzm!X{iXy$!{zvk$-dh(~mTGTvlJV
z%6xrH%-+T9Ke80oedx5#Wqcv?i+jGU$|moat*p!kkKDYRp6-5s9`pTuF^d?uq~D1=
zVS6Lxv*4ke(ywPPZcqOF<E&-JosD|_N+)g|yw?0C;7OXU(T4uFZM`cSUi2`}&=AQ_
z5S{iZsIH}Hsmv<Qi`t7HKL0Nf=K5a#@b>=i`|G~1_<#Mw_4@9Po@op8)+MZcxY6OO
zQ<H$NbA#;4w(8?8;eY<TxT<Zl@<$NMpXVoe1+RC=oK&>>_fq}4Vg9p=AElpfymfcc
z^!tC#KfcD@*0SCv;cT0<ZE@TKF)7<pxs`wQe?5Hh=0xSfvePfV&i>3T9=dm`>+$;i
zKi)m%{+{Zpf9|UDLb2G1-iFJC?Pcy{e!aROVX~3zp>3?p1uRDPn+>NJKM>ixD70Wt
zzcGvZ;zZ^8g`&UjMJ;*%@J)Qo$%psk3IeNjAKzw{nY8c5fBux#nhiaRI{wXb_Doq;
zQsDklJ~jFhqrmr%H^YtECNs~K%(DA2^%GY`zfW}=Kd<hZ8L9{GFa&le=oQ->{ZO?o
z!h&t09lMZ%LC6f9X-^k1NG;%r?r_yq7s^mrkgwXc*X!S`$~7Td`QGHaPH<!Wa3zcL
zvf0Wn_qIuKsOoduvFnN%-w9kGDYo=uy~rBRCEGfu7;<LZVMt%y?Bk=xBD1yl<I{Ox
zlkaO;o^g=+<8k=nbH`JwW|SYl$FgHfi{@hf_0Bfj`*qI07SfQtc%ZkTT`nWV$U^MF
z6G`uNRsw!!>zYOPwr%yOZ~tPyH+WCj{uK>ErTS8Cf4BdR-?w@91%uRj_3O0-E(}Mn
z&E~xR;4agPlYG_H^~R?b-Lv@_k-GoHVet(azpe<``afQF@S>L69n+7uc-OssEYQMn
zOHlWUmDT0%yMFmg=(Rqmk}|1y#rc1|;l^8wmcQhfCtsr8RQqFY$-&9rUf%e;Zl+lg
zBm2~-tjOHyax0fj_-tTxKu3Fu1f#OWA=Bh_Enn+<6~Ft7MX&$cRI<A~=6B+p9Mvfc
zwYGn+j`+B6Ui4!B=Zo)G9n9A7`X_U4a+OW!imheGx{Fq3-AOwX(PeWvQ%Kch{lC3u
zfAhtq&+YsE?c0flMOV)p54QaGLB_Aq*5n+I{{#C2O})bF{p0r5Rn`>swKsCKD3$(7
z{`lm_)6e0{)75`?6-w0AmHm2DUDM&@!Ll~?*=Y&Ca~E7~F7NIAmR_K7=INW&>J_tY
z%x^4+fAxNP=Cb`xQ?nSCJdVE_a&AT2!v0?eb|<Nos{WXzlg(T?bLk&m0iX2gzbYp!
zTE<z&xcAxBt2Z3|mCZx4BHjG|E3y1+@9*p|IkjtpQ`CPIo3-*Snc_M}Vy9od@%p}0
z{ja}#$Bln0B%5qJvpL@5v)tj#{x54X!Y+D+g>XM8kKVg$#=(yg=Xmq)uM9qt{QLOQ
zzmL8D2)^C_$LNy(ycO#HXC|+|GI{-($zHZAKb-76W;%88)1}=idXxEd=BsY@GMn*W
zlG=jl7b+P%xhM1bY&`Sv#H4R-ryjICIG_6W+Kr?4wr29qpOq87p-<O4EFt89@@H+0
zw7F4-kM5|<`RmIUU%?@za?PmC=_Yq!edZ5Fd)8SJ8mknzCztNbI+Zp{?$?`y6AvG(
z`oS{s`m@;=I7*6FoUL=d@>1j1Axn+4q_0`2?>BEez|R$yaWB^@B+2kiuKd@|6)Zuz
zk2iCa-b+s1-|$&*Zh-gv-ox@$Dkp2S7JOGvjhv!ecE0wZX5vC$DR=3g2Mo%5nBLrX
zbpFyfgTY)@^)Y{dz}jq!Nk3WxD?dCqxP4Op#w%)(SBn<5i}+3a;nn=WDCI>~@58I-
z7GKz|dF8T-RL5eevc(rSP5ZKYuWMG$jF;Qn-)A)}tGuxxWTzd^V->4(*~=z7Cq0_{
z``_kIZVuItr2G#4dBru~_0)lnHCrP(w@eV7wP2d%thoWI2i3Dx_+N^cC>gE4Fyl=A
z`WFp-Wfy-Oy7y|`l?m!gdv?Z&E{{CAXF+nz?cf8^Qw?-hO+K<t#3|*N+`@BH4jNzO
z3%E9Kw&s)-`4y++AG39HvFuhbJr~7sJ)ri0t(AkW>>ho=rmRzL3~E9;xxLGLyYBH#
zR+Bnv`IUE99Y=H-?;O#$o_y1Ha39Fo6z_H8r4|FX^P8emb00jq@bCb0!h`hrO1xzY
zzHg8YIbG(*#1y6Lu5fTd#@!lK%ewBH9~{@oJiA>YYO%HP+Iu;!7qOv-`CqL{^ssH%
zZTiu?@y5J6cPF%cS~Vl~q@36EcC)+Y!g7hd59ZnxUShky_0N`Pe5KQFH7+cc(An7F
z?%d7y%<xp+`zGs$d6&z>!~^f&RdZD8d!4B{Sw!^+@9wU9Zfx&D7&l0{vAp?Qct4Zz
z-nol>#o{kG7#!VC%@f_}t8lRGQ!+1m<zf@ntc2L~JyDN(4*kBc$T|Ai!DsxT_P?y(
zyKqOWe|u2+{Hdg!i%poWNQiG{(sp~DBGh))DJ+=hm%f}VSG$9hOmO>aOW7Q5<%jP=
zJm+1#sbBP*?`2oE^%8DgkNSJt!yPUg$Q682ntsu`yeoRe%Fq=1rSrJEb$+?NJSX#a
zN9Lb}KPJlbt<pKVmS=mxf#quI!Y1ZVS~Hhy(Fr+Yf6;}*wU~R>+xR3Gj<*w8^q(IN
z*#C3E!xD*mi!ySmOng^W@U2$s<`uJDZnbgQzuU*<9)1W`i&V9Jzwh3W0@IHtw=~(9
zuJbUz@cMoLI|uLGW&vG0%Zxi~BCq)!j6QqeXli3l`g2aMuS)61Bpo(rZcN=X?c%{Q
z9?r6$EnAN4k~_b)jye9^9<c`<`?L#IJUXz~c>S%)#gdD2Iqxp{m3xKRrh{91&U^N!
z3EpQScFZ-sWTMahum1GRWp5^?U3wn0OhaS(>W2j<u6|9tVSPrL#dAl1`^_}%CAESY
zR;OMW<~HStx94!Yas4f9DSxu${uJ&v7OAzXSqnlP&wl;Q>-^13Mmg^7tt91XYcnrT
z`4m;U>yGX73p27emtSUOz8*E%=FdBx5@|!>#LpptpNgIQPW7dDPCILwl<FbgEMMkY
zm~wXAqVEb#LX8P0r({KN*8W{19(LnSq|aT!V_RJw{dOohZt^*0m!QtNgdNL**Un3`
z<eZdY5g_aC+!frhmMc<{y)TH5A;15$*{UL`xP<M73Aq6a+7(Ok)ho9vOyqc1>QJh5
zK`SRNP<pSPNT|cn56_iOSEt$WPWhTxAD9-t<NP7!&}w^^bN8QE2>+k<Trzu7(%Clm
zJ8w0dHMYcWcYC(s>yv#gU2bxJLi>51&N6o1`SU_Rn?LVTJF^uJGv}Ezr_B3%ua777
z`%K5u<(7so-c=lL`!wx2Tc4ib{1EGME8{8A@=~Yj_Xam_ee?eJ83BgBzwHepJZ67(
z+I%IieX9}Y5sfv?JL+C^KU;P7Yg1)VVX5gYuYdbg4Z^GHHO?(RAR3f%%e&;fbZ~=`
z){DaCH8;;jUS*Wj@lXHY);D>nQKhZO?|Zj-Y*_+7_`c%V`i>=0{;kMlo#V>h^PFV0
zR-f12<^F>!I(<&NhSFxy{{p=S#pX>ccPU&x*X_j2Jd4J&4l)rudH;{!Ot5cV+q2_{
z(z1p{T6cI^D`Owma6CziNqoQ1B1$Js;<~Z7EB{Ze%I-zYn$@z#?yE|)|F%Ugym)=l
zLZ<5mYZi(8e)DpBL*1Fl{f4<gn<aP7)tH{@oBCqrEW=s<OdkEYR<wYFMe9>arC;)f
zJ`P?zJLSe}RVg94+X8K!b07TO_Aj<0`s{bfK;2jDVtd<5;*PW(`gUmh&IHx%NmZO~
z)+LU=-zOJe&J90u@%Xd0nAhjd%(YG1c~JD^mxPOkbG!eDwdcRp4iO9ex~O9B78TL(
zg22m@&3pIHG{_B=*V;Et)Wh4>JSOVurMfHZDfyc>ED-H|_t@d_`u+cA-3uv=(z%(_
zp68YyXJcDg_UqA;%q8~^S#Eu;E6=}EvSRIC)~Fv^x{l)KSh}0CR28~XFPvK+%55dK
zNXYh%fLdzXy~(wG>0hfJJYI9suzglvk)n%8TK&(Y$m7S9C(bMUF{!G;@X6*-qsviT
zU31>AEEcu2;bZU#lmAp{>7u!vYijZ99WC0nvlh;tz34-tkraRbKFc~jeiKc@6i@f4
ztF0&WiX$#$<gvV)ETw;VpX~H5cSeD;>o!ff^IlV@+c8shTG=*>u*8_v3oYWNslGAa
zl6kOR<ZjEnzvs`_TRcl<Fz@v(ds!wEQ+V5(<7(72hlk4wZxo~nnQwRbSUQL6$?rpt
zI-6J@?^&{9qnDa$P|U)G4@woCS}$CD_oVdCE7LO{=1YYu%blNae)`1|bN2ms`1HH_
zb3^9?9fgloSN40IO*wVx+3(VzyidA|i(Y+^*OWhaU69#5G*0I6md?j<s_By(B`&)Z
z@8YPw@7{Ume07(i{F9K@+-+0UPJDPSQ(pgo?E$}r#$N}Quzw8`{`qTjt`!xwRQx}2
zS<;H1svg>GN53r!KE0-im#Jdq>83S%Wmg)7{B@r!J<;9fk_zXv?!@Qeto(;rU$P{(
zdheR|IK+kjkM(x76PMk%-?&z8Q~Z8+S6A$jW2swXnfZ?8$+|jftl3v7yKzNN&dFad
zMRU@ar)AgeJeqTJ^;_)~R<BCCmv`R$dUv|T<p-h5f<sL7ubg=7{q?GDL-w-B*Rv+x
z;+{91f7ioRPo29mXT)#w7T@z^@B4%Qe|-7z%ps=s*C)3<|GzwW_P5?<Lzm`yD?QsM
zQ+RC_75daz^*xl<lz-G{Y%;g2_;07n5iPIkzO0=aFF%eezc8zy%QfU_MKpi*pB?9>
z1nj(hd{#z$U*U|?8=ofop8vY!YE<~AEo_03j^FOr{XCZ!Ao`Cd;@*cFm$gkc&);XE
z=x{9}LA~S!f3Db{zi+3rzt_lFnQdqm%)Iox&f7T>Z-o7V4NJ8zp2>do)7XHgMQdk4
z!iwz~vA!HJKkIUrihL2s^wEo5(BP)06F2kj6^CdQEfHh8c}$PBg>MvHb^I2!DLPpx
zL}hc-OQ-W%JTco7LXY0*n$!}kze<9$sqdhm)kGe?9O2Cxeug3&H|)uGtnoCsJMoq3
zDg9oLi!vI~?t-(mUKu2b-hb4vA+K&l>-wz|5+^NFIG<|#X<@iS%(jQ?#OF`neIg^G
zKj7=12mDu?J^na;iJJQB{hvs|um1wRuH2C5#5L`ieOlX!hqsar%~H`ibD+bz$--JU
zh&^c*W4lKf?-Ro<w^$|aN$%LNMm%!vnFjH1Had4@OSoh1a_J^)_^-Ka)-2(}4ToYw
zzoeXC)_=qPf1{qTGS{XjFFmrw4<`%ceB}5LwpmCx>(e<=$-{O(%T}pu)^+pUv}DC%
zDQm4GUh7JZ=%i_dZIZ0X{w#LsMEj=luZ!$Ma_?3<hc-^`b8{$6tlsyKt1XnhDSzz>
zeS4;}tKDXaZqT%FQWjxV^4)wo^LJsv|GhD%R&h1lFxmF#v%#JVKQ?hx?_YdJDy_Lb
z<H-G;51(w8G|o2ICS~&J`m_R>)kz@>kDXkhmG)=Rys#`A--SDB^KPo>{gh9>k*maW
zSo)!^^}c=1*_lpe`X!4rOOJ2uiuN_A^R&9H+wsAA*6h2_cg<bCg6XM&G+*8><?Wd(
z?l<?QUbYCl<61DGEdBfU({Gv&|FT|Ws5$NW#O+aM-H)#63Ov$n*}!Ug!B9AC^ABG}
z*6oh@wWqTuhAEkSQuqJ5Xq(3s#<wbE{Kt<nZ7otbulbhwmbjIP@T!6UpY0cK@iBYf
zU#I=OH)dtaS2oGzGbTL>;O3me|Lp4yK8|9q=B#td%u9nymG?JSn3V;upIzQ?^J2Ml
z60^2XN|?c|wTH!ue=o}|;F@q<?`HhwJHpm4+wU$}tiF4;#<Oh}CaV>_ZSU<6%_@&x
z`8Lh!Lt?SCTHc+9U$V1X0yGyKvyfEwD~!~YGRQM8*&tCjZ;^lj`<Yd0H_oX1UnFAA
zbAHohJ?*JXzJGY77|U8ZgWDZn$bN2f3~NcQSoF@PCrntZp+H#TdcNUn-sASCcduFb
zoZ(#ZHvR12*1e}L2u$eR7Lj50@!o<|r^xF^`y=OxT^ChXFV5wE<2-lvmgA=`BtDpM
z{OgSfTZ_NT&pr9sQyjWh)~<Td*~$D-;iqmY>}ZyMa;mHU?UJV|zn;ulmjB3KBDbv}
zZ%XBZe9<WHV{+DUdO=@a1bW??7kI7gxd0od^Jy&|sfdfaSN-~+5&toG&4J@xc@1?U
zWu_@hs(Q~)xf(pz?AF}?kzZ;1T<@NB)qPaEi_`J*qWp+!+`C-amu6eD8Re|M(a9fK
z5n3vB=%lBxuS6ur-&sE*_}c%oC~YmvmDfD}^l+bQZiNlkWvhJg?}@vbUGA4o_;uDl
zX#cbs{BybmlGdFlaeDf0Qi<c?W08MNc|BVT)vvQITQI*{>foZkbuOIBnzDCVK1oeZ
zm}9wnG2@ZIyH|y_8Go6gv^`kjW#Po-aiVV(8!mpx2^F`Uv{iapP*>5+<Vg>*w5ryu
zdiCH`_7Z`)%t0(i1=TncV|nKmJ9+27oUih}`qtlLli!5}zw=vlbndbhe>glsu8BOg
zo!u3ezImo0>wzhO^DfLeK3ALR;rbLmxAnJ{l-Xx2*jxX<E+<l4qs`goNA*UR!-s_~
zJFR>0`^FRQwF|#CT2xnl+izE$z?`YD?_ke%G5bT?7~NL>c1b#28d$f&;_kheO}>x!
zhd;Dkb7+PsL*vmC`b^rzz5fcQuWi!)bM1F)g3zC5yB6lQP1M}?JL8bfWhseIPhJ`1
z=3hH|cX?Evg9~^6G24QG7sWnz3$x7ST()%w?SA&dDptEz^82B*f{!UKYENGaJ+?1p
z>HWXsxplY2ynVU~w+>1>K3ud#v9gZUX17z{<co!eI%iI}dqpTh=4p$p`m3%fb7pKv
z$QRVMKXc(zlxlun+4Y3##$!y&r%Y0r{nD_Yt>A#5-@g`#MdmjcBvRIidbh6;V(HtN
z;d)4?t=CxTm#t0S@$C;nt)0ClI$iv*<8XxG_dCV6PTJ|V^@=|}%lI#^;r<_G{+7!t
zeK&s8-Wnr*ohL#1<VTy(bzv6E!U9Fz9p}xkJ!AE+%y7#et@}H*H$IJcdnhh^d+O=q
z{Fd_K8IJ9@+U!lXvwjuHk$UC4byvf}nC0zR2fx^cInI(X<}3_gmMG_uY-kA#^u5<1
z=PCHX<=&TaskwU{tS_$KwByJWk5k&$7&E4>?s|~C+sf)<S=jWo#Z}F6=ZbHbEH!;=
z^3(UtVZ)E@-jD80;c`#?b9~N?;*w}xmzkmRVG?o--5ITYYi4K(wFpeTmUVE3R>dAA
zL;Lc2hnt(GEHPQUyL`nnnY{@wpULj7JIc4=g;JO2W-eC#4^pevpVzRyV)|?2pB}m8
zUcJW^wKPgMDzjH@oM0jq+LQA5=&1;e0<V)>n*4Z=zGOM5G<m{}9c{ilH%9(R3T8O=
zBknWHq)Sf0@s`HxH}8~*^71)l@hZRfd%>n3re-c*ckYc5y0IbS=A?*R8_TyR*xqkl
zxr|BR#>|WNI3u=hNL0>v%J6i}+^`cI$Fo-FwzianRayRi!al3NPJ9ms%O3Rux*x<|
z?c7sf7_w<+k>|GiH@pAwzFZg@dB-hsm;Hx|iLp;5)UVio>R29DzEgRQZOA&s+fpmc
zxQ<!QUv+!-jW7l&wvMSkuWu6-eH|?N@cOO=^IPW`?6}j!bU5+)6w593J5IE+iAzQO
z$SF^h4B8x@Vz_heRI39_b%!sXyxXr58F&AFXA9@f-+?MKQ>S0Ku(#JSTcYMviTAJl
z-lwFv?!LRSPJc(hm!tE)uit)m>XGkGPxVx<?^H1jy>#d8#Y+W$|F8OIC~`AXi&fU|
zaq7I<C7c4+S!J|dz3GziV}HBF#Ol{kuDZzN7Mn-bEZ)X0FSb97scJIs`fx{K@}o_D
z4k9^{e3~1seE-Rzc$Rx{>({cdsS1)6*NrYpygqTll!u|^n&Z)Wv6FK+ES62p_2b*j
zo5ruXW`1srAfw!;zs$9tb=H)9&F$Ejs=og5=l6Ya^KF(+oBG%Kn8ya5_dho7X=k&l
zSr-+$VTC9YqiN-Y#N4B6)X#GL-jeo`<x`4=l#t`cN2^ynl{&Djy5vW=-@C*|zn(<B
ze$c6|Ya+W&y{Z21)37B4v$mcPdQrW*{;<dKKU+4$AD?J5Yo)Lz@0Y6W+jD!j9kl65
z<lDGxt?n6vsoR#$_|T;(*PCv9r$vKvYu^1^J3@-m^!3jKZm#}1%k1|zwPQOE?A7fo
zV`QJSb+YQKSF66|P5Y?FwqnZ6J%>2Ld`c#8e2>}jv~BBQ6)v8$chdvQ#pcGBUYOc{
z`Tt?(du6s9x@*;(CyFMn5SjlZ@=(<2hQkWl6Zxa0TDJY~_bN09?|L-t*3O-&DGG}&
z%d|eKExpKbBBeOYCSjA{zRAKTf-bgxYqc^EzMC+ucd}6NnTTWOgwJF<PF$2Sxur7d
za_YU5rjwpC-GdUpiVH4$WzO^<tW;Rkt!tfNRLs*EbIUI1a<5+y%{k+?={iRBZjp9-
z_Fr9E-}+u0;1G-`&dBF_#C!FhgZ0XXS1catD!Uj9n8<S$ubv^7o;@Qn(nZr)pw#qE
zHk-wXbJ5*b&vGx@94>M0!LOG;pPasBeuXF0qSE5;#K!DrdOW-M=U#eIawvb<qc*i!
zy9=zMGM`3n6mwjWI!8jW@<Ok>q4U#??%q=@S~dMv@%|R@NM82XvVYEzv;!t_tDhBZ
zah`f~(HVoJi+XuX@+a9Rt_{}k<!9D8zAk-X=8_Le#}%Tsq^(&0S*1O9;TP*&Q#-e8
zeOt1+A!kq1Ou<_R?A}K)FG|j|zGfW$g8PZ!l+Uc~Ki7QKUd*_*J81Q)i2NMg-R+Ma
zJ-s}gUCTAj?dMxBPfyiJHLdZDC1(#9YJ0c1|6O|{{Q0j3H+wHNxi<Vxd~TL>_C=Dd
z%B1f0ulqV@9p|6vt*=sbvWe%<ly%m6r>^!#{#&Kf<=MZ<V%0~5=5*Wm7kAHP9z3_@
z!M)jw1GX6d+#q>!=TZ0iRYhyweJ`>ozx?J}VzS_^z>9wl#q5)1xn*`<(DcHT8^IX~
zRuP}f8Kxx0%DSDd+VuZ<hlb<L_lGRKUS9pM>rB?WoZYIfB4)preKT#!SkCSIRngs1
z__4EW@gX<0rS}f*J~xFiYhEO$*q7sS`=&KA+D|F(U0-b}BAjdT!=>%TiMiR1lk<(&
zU5Phe>fo;Yykxc7%nN)ELQV_ht(kfLudQA}($v$1Z{?z=bV{v%{q@q@Pu$6}MdlOg
zHmo@}b?t-~zb*C{{gyN4j5`v#x$0t0m!{R#S7nz%9=aD#|Jsx=dmY!jS6&`2Tc`1v
zUYuvtrtr=09^b;33wq8?f9WZ?@5Pl(D?YYL=z2x1@rv)}v(8#uEWF8F{#?$}%j%2t
zPnay%UCFD`W1hsx>h`dGO_bW^&s8(iSk+!7U!4D$XM!D<!{i5Dmf8BY9y2{H8e)%~
z+7RfI@ZYeP`TE{77w!wp$~qV5T;H)aw&JaZ$x|DjeW8^$ng_d$kIt;Tc-Av+ku-P3
znmc+?7vuN*;Me@SCylja@gBLSZrwL>E34P?@n^BEF}C^_F{R?P)x0?s#~B0D5_0wC
zno5g36w}ly`SKvwc_&-u)WqF4ZohbAVP|E%c#G@B!YBNb6&(}yYBC%@?tc9K+#~+}
z=ll0rS|>Wh?`jZZj{5z@-e})3Pt~@6F-8CCjI}mcXx~WaTWcw{@qX9dhKnm(13!rM
zJ^I`p*S3wVv9TaJ+QLq@clO1FiG^~3Ih^ZU#q#cbdwOu;f_T51qRYI4mu?rYxyha+
z{xiJiqU8ez3G>F}AD=|_t@-@;&Ly8L?laPRP0FWC-hJTCb|0U}xJ6m%D<ifXNh)EO
z)jQod#mn^f_BW;x)*@fG>};_5?HlorB{xwlQs~=+!(ls{9=AT^G3w_Locf1hU%Ec;
zx@SvbKNXpCK0T3m`+Mc~E!AFWrn=iNu1R@2#c#ch0P8%nb%AR+-b}q3c<lS}X*Z^(
zbNF6%V~TvOaw+!Pyg#nn9^5{@Y{|o*BRhS=W*!aLdzj~|F5_3TI`!jxMNi-EaeQ+t
zJI3k5VVzYU&t;t6+}po0&GS^a${RH&zoj+%HrINDuJhQt>2C5hB?b94@^!}-A9>%s
z{Pw2zZ!g^unYZz4TCUErXY$KzB0o8NkyTZGpm0K~Nb&jU%IUg~7h0&7+s%FD`Q^i+
zhx-;N_wMqa6m)bUckE=fu0C5Xh7aq!HYJ4XKCzg+CO|%BQbxqby;B<4nOF{%yeOUP
znw*vX$dzMSQQP&ZZ1I+lCK+>Yor^hKvEiMZ!prW{)=m9)t)p^VI31eTipHMWSXg6r
zOU6WwZ^vf_a|Py$2NP$tZoFal<UI4OPDVDrqD2K=re%-C%KI;tFKlI6v{q@(%$nU1
zCwDJcbZaArpj6xIOvA_4n(v<|JYdPUPS9PNBHVU=>epY>3Sa11%>O6*b60uZ=|*9x
zCq9~d8YbaZJQu4)W0Dh<ZEs!ql6P5!Bj7s=L-=Er=PIHfCSJ_q+MKoRPveic`%50K
z>#lP3+@P5w`#oR4{RC^YDbuFe#m6V;T{Gc4n{m@C(y+8C_A2xIH7w^Z^!?5B4mp3*
zB->qYx8`g%6@F9u-KLcf4`kd5)|9-g_FV7yr<Xr1lGH9=Ts7_L?ysAdU-b+>-CDQs
zTB!4`^ssrq*kbD~r#{xKx*l;yCUV|vuEg0}xcL-#7v-K@6f7_Ep!8!FS4{rlq9CVr
zSCb5MAKeaH<|u#s+&5jDpT`zf7<ucxKN;)fsPe4PeM4Ehj7#im1G#sO4cVq?TT6FO
zNzJx>9_O_Bd^~4XDLcPUYt9Ut+le`X$6xO97QJiru6W1QNr4~i+>Ux?OwbSgkzO-3
z^rpt_)UA`VSmxy^-Y#3>wc}jT9);+gc{c+tPE1_9=g(O$jm^v-<LwKxRQ0$Yoo(Hi
zrzMtu(BqWR!^cU7qylD6{M}riJ=w1#>B82v-&}9{$d_{N*4m%R$*$p0%fI8xu};6G
zt2(w^Q+)5Ya0Q?BuD!o!f3!875w0t~!`1Ab8_UeaLIrDAUs$xlC@1HBQO%Oa`CEMZ
zpZi(8(zU&~Y3(HT`$AujeS94L_JHhDUuWjrZ2o1JAM#Fpx^;%I#n)Tb8w<Ht$eh<O
zYz*aPPe?JI#!#Nqw^O)e`Kh9aXCXquq8m?N<$5gRsW->m%OraLrJR!zt!AFbp2SXl
zvLrJrPi^S~v!8|sUyHK6Xl3wGUA^VyquY;@TNg1NFLz6^;^N~C4_#}!PwUD9vrE}Q
ziY*H*Z0&^i1~;UpPTilTc4>Rm;cR6SS2MF@2FtUi=KdP1emBbm{#VZ5#IoM{wn65$
zQl>Yj)`{hmB%eBX?Q7<K!D+kpZsnL(6c^(;Rg~xb3NFj*ImM6W95+xso-zG}>ubGD
zU2L_xg?<NJZsiJifBYsxXwUETxRo-ZmqH%(-19f6*H*hxaOz}L@B7eYHA+SiQE`{F
zLK+VX&$%3VJL$UsU%H3#wMnm6zP{}fQtR6`;iCTf&3A$?*d0j-YTwPU^us@c)JKP1
zR2DC_JXq_uA$|4vms8m}MejMQ%?s;eWR~+k8eL(c+4VxU(a9oTRQ6@&0(IwOO?O1r
z7(QC^=SJ|Zf7;uR=l|yWeAbN5u=jp?;+eHKrMMpFWNdHuua2}1+bAqPL;uzd{;g3P
zFMc>4eCom9Wp7K8=ktG=yXx1hWyf!2u6iUr<ILB!ySbLU3thL{Z2P(TWu@`2_b&Z5
z>*B}rR}Yw&=dit4-ts#3OH|)K(~{+{av5*WEnLr<d-CA)wcbqm%N2{?OKy3R^Zno6
zxsAWSe~+}1{hfDo?!#T?#@mX|p4}WjDdCvq_oaI#ZH`W>;WfX+_WpGx_pVb%uP0S5
z)b+DbTB$#)`{*ulk=-+2MjdU-o^?gt*UKh<<)M9dzl3qc?e5Q275jen-8F~AJjJ(9
z_ZAj@@i^6fy86=e)zZ$q2LGS2$@WM-Qv4t`YcrFX`8GCF8UL3TO19nlvb*9pTdark
zbEUqmANw@Uz5KHwVs6uyFSW5Isc$m3o1J{MU1(cOn2xxxw^aLP&YeM;*VU4}T<@Dj
zvfrI+rsA`AOa7y~^B$Ho?Rfn2g6q<wXD_y1_vQD!`R<0*j@h5Qf^RNcyNP{4RU4!B
z`a}t1>pN|E>KV8G1+t$Pd7IVCv!bbl@5n^SaKFN&g%>K;t!})VDe_awKiBnHeAc6x
zvu&-X+?pX5d$)hq%qJTTKYxCFz5XNlzH>I|?zQ$j*E9Hf-z4TT{t}s}w{Pbq5tk^t
z56ACy&u-iEk|Wk{apkOAf-1&!VyywoR(Cfi#O^VDV%59npTU<~pVDhJ=1tD=^GyFy
z7q{u}gmqK$Q;&Sqn=?b|^||nd?K4y(<ybwBmtUQ2F7okVm|Awu4x^IAtJN;fS+(kJ
z*fNje7Ylr}l>W<{tNLKEi?gY%N$f=*gP{1ukDFF??{vRlYW3y%C;RD}4xO<%F7c>E
zvyA0lLHo`nt)**q<yzPDg+5~3{$;^Zp(B|BH;T;GHO#&GU;Nvp9Qn6fPl=21elqpk
zbw*&*zqqf~N4JPBDp@^OQKGFRo7Fq~{FT@Y-(=UDmt@R44sf3MI`2l_{3zkjr=6-Y
zw-<c!FkN_j_T0)9)sn0)4o|f9KKYRCvYmj`mgoevuRFOu7SHM4eQt%uw%pryHJaW|
z?tPRxDSX4_hcD+lyix9{UA&ro$-b(l@0YsG_5JFFPMu)<n%male7PeqcdDL|K#5gX
z!Fki00w3hOre#<EoBD{q)oH!s$uqA~`wUk~%1^Y^wauz3{gQl?uTgGC6&K4~^~ckn
zFL|sGyZo20)!gil%k7i&ziZlTJ`|#G>)K<-OPVKc{PTYoP_c4bTb7QCP3ZIkrwWb>
zrJq07E~j#)#+&c^oHt=wA{TDTeLcq=<Z!ZoM!(_ebnX4WRAuBoIGs#gIxD{KC#Pn6
zgVOyu_D6XbAD^1Q*V?zRVrKVZ8{KXl*$RcXf!o#D6#O@T)jFvWIq}rZCKio||7+em
z>Z-||$bXP&W+!lYS6m2td`;oZtCv-O$)4ZuA<?P-<-}2Ct=|)#->x${^)0de^VMuA
z0oJWCVn?6)2yJO?oE|EgV;lb=x4Qo9rNj1rKl;blJ#FI5{J)@magdt4);Yy9a%~bX
zW?h}%8SLY0KFLVjU(Q}gd*+m@=?m9>&E4|fq^_*0OlW`2w>N*DDE)i(<&liRhcDIq
zNBe{Bo?Edba79_!mtVJq*Zf{?f9$#b{XKSehSz=6cg^wVlTwT0nGxuu*3i0Umi9cu
zuo+sHu3ibdx3A?{Z1zkM199Fd7oNOMve#OE_|_lpY?H)*X8r2iSef$MEx-R*sMQK4
zU%C4$h5K$(#vaq_BDeJJe#~2Pb53HW@7w5@tmU>JJ^c<U-Y}Bqy4|>Wi}KrcTZM1y
zd@ECXR1^OO<jO6V_1GPqC#86!yKnn}3$dZ)CsjAMmFd;)(tIAnykm0n@x2Pi&fb0@
z`Fmf{T(`sf-!BpPuxFR5*)r3qmshDu^evax)8CtVc*B#eD`shx7H%j!{qs%ui+|f9
zEUx(%?b^17b?3de{wn3iHoUzmWd26qW6$ro7jv(RNIM6;3VXdy?i&052YVmSeqXH|
zeY|UW_bXl9wP`JDRPHSN`j&0cZgE=+Ep^6Teb2gOzXktz%TIYI^rUq)Pw>|!g{C~d
zT~<dEf^NN0bQRxVFehYJMAA*g`}^znGi2WU6hA{<<CA<wlI^x`v*TP}E^7t7Fu2F7
zXmIDi)iS9?iQCRIJe2XWwA-Xry=D5@<H{!MgtghtTdxMmeGz#6{SE84#`mUauBvbL
zOtJpe=U~BFSXVmfp>=ernQG~?O~#w@PcWW8A)~HQ*jE}L>h*51&hzL!8nxMpc{0Z{
z1O%2mpA?&RX%VX*Z@j)!>tyk=Cr^ybE!LgRT$g1sSw-NPSLH3vhf~XLER4_)p45@;
zm-$q3&QzHlQ}4_Xnw`%fes$&9#l_hip;K1OGYH!>_3X;CGmRx%tRq4uzqdKPzKj3T
zOvh>b5^8q;*X%OfWn^kT=gY&!DL-y27ADO)D9xav#&yKFrMx`qaNv*Dv&z5CnfNAH
z<y*@-znRUv<<ilf##G<7X7{ssr&k<XxOqd_oo_$)f3qw<^X#9~mOZaTJN%@D;})gg
z_MX1gY{^BY_WQTp@Be5Q;;}mzx?$~K7wsMcy(u=PTcowqj!!I5`uTd9*w(UB_dYuY
z1kYuBmVA1%^;dQew_j>c0>ie524sBsoEI3him9M+g{SNyx7Jw!MbWqQGWPG4U)g77
zP}G)b{?J>yvXOb#)99b84$Uh~iC(zl`Q*;Ruw@g2qC~#fpSrxnXLh!jvt(b?yvv?1
z&)k(g^IJEdWb+|ilS9()H*b|?dG~1gg?)F!juta2HtKE<_};YeeRkIt>95N>wHSL2
zJD!f}_^y7Et#EVHw!+~2&SdS_ouzIY@7=o`xb)!K#ZUQexA5)Vs<A!W$)f(_#>%_f
z)*deU-IQml`mIYUV5-#3X+5c%BTC~l_HljlKXx_8KY8~jPHV34Hyzx&7Y7}R6;ru=
zOZtmlwwg`1;r;1u9y@;qeRI9MHR#`SBkh}6ozs`>s+}TlSgX9tM9o0q=Rf^TM{+DZ
z_m*7kx*mM;`qGUt{V(McTlCHEuUkDMsk(E!Wcm!=HwWx&k8>RM)9hYm%pon2{$O2K
zw1z?c)DOAGU%$G(b>HlH`MN9K8fUD~>3BW)SF89u=h6r!V;hl*<pHJZd1ZnwzFHKV
zynvhM)HQ`?(|$+sxjr_MGWW}_&B$F=qO{EQW23%q*ip`FBG>j9rWrhaA&?d}|J1*}
zve#~V%EavsKhT>v-*%oiSD*B%i15ZryGtRh%~BR^OAT`$9GEF=sNvpUY|M4DSnSq=
zBt`L<z83}y)27UQmh4+*<$dr`+Ui}dv#eLIa=w<3y1Zq!Dt~d$*$YXzh8e!A(qc}Z
z?wgX-CfQmh;MbhG;K3G;i%SnhI?hXcqG2kjJ0-uP>yPZ(IaPk9hu&XY=;17vS9Y+p
z)8Teylyr{=_u~c47xg65bl)6W*&ALgQpi7X_fosmmU(v8*1x{(@jS#NW8xwB+)nXa
z*U|5`k%!aowk$U~{^IEFT)wMjFC|WI-o5x`C4XLXw)I6RtAkUQ#2wb{o^x8K?!YdI
z2QnRx<^*keyHy}3T{k;5=dRM-$>oLfi^6x_?wxS$dH8(^^QA4j_E(pG-2D05j$pm8
z-cQH4>&(;UHN`%(z7^Ja^x&7Zo}R0V`3u7eguaTohNixIdu7Z2PcMC!t~oS^ZR@S3
zmtkhNG%_vEgfUNC*eG+lK#;jZUDVKP-Xk6nVWv6*A(;<y3m3h&JMjI(xwOr{@4gq$
z&dud(y=b`9`0g#So9&ZIE8FL|Y*G6yU^G1|X3_73o=ze=M1!8@Z;rS(>xoC+EwkeJ
z(-M<j7w*%|YU`hIagQ!L=d!Ndu9J5BPLltA)S@h1k}>98#Zz-BB_UH6o!zS*>#e?e
za{HWj-bzb1?$UF+{rbd%W=U_JBlQ<=bG)mIetST+)A@P0#?%@6a?V{lDIc_B#yQFK
z)O-cDiu%*;r}v+G()%T-bJwyr_Sq-zp03(`+3Do0FW(sTvXl1jR`-7{+A8~9lKsc3
zu=eQdZy(*@Kl$2LGW00V+eZ;g!f$apSm*EG`hDH1<p<X9%`BW-rC<}&{&wo6()F8n
z*Zp|6d4bi*1$#cGo%s6W9{0R=R^?wKPbHrVldIkF?CIw(Ge0f6e6stM(z;V0pFLP$
zF6!;;ANkw;c-`W+7xb$7^1P+Hr-^b`Rj7*G%l6}Pn>yEK_Tnm+U5%&9gN<&_<*!Ko
zo%i9_#Hq_!(o*hhI<fw=MydR}(315ZMg9dgw7Y4S$WMRCqM3Nhk)!cX)09a%>rW?L
z%L$9BcPLu3ZR24%??5$+W4v5V>wMQScX{h4Cr0YtI3D{mO1fmx_2=s+WX`$#`NYAV
zZ%JO<i#9tsB<}lf^FU)!O>$1`x0fz^!kN<Zk{)W@bm8In`s@8!-jW*e=-zgord3}n
z*hJzym#0tmG1r<A$}{u++i8gfTlSO`oeuqzGkNOei(yi+R!>y}W*TMk=3mkX)=w5)
zeMF;NZPAj*--}lGOKZ(puuNX<ZR;*K=FK;Z4Q|^!y!mkVV+F3&A0J=4w~Xn@mx9BJ
z=hp4~ymfNb%9kSIiS`>3zOeml$hP5{;Vr*pU%G(lhINWvs?G10KE1q<?a&^>9THMU
z=bJ2${vwswdUoOZgD(x76y2gNg)g^XQnBva!nXeFsdB|zk$=smTz|(oZBL5ppS+xP
zQGE$E7wYa$tw~^JkP?vftyr|>@zXBFzYQv@Wf)KIn!$2HWY_eT^}nt$U!EuW;k@N(
zZLXFh@22tf3#zVXU3cyBPiEN_Z;Q(~6c|=#{cxO+Sr*{t-(WH&{3wsUsOc5koPD=u
z#y@(>^te9Bx^Q-?FuUL*%j$;*u1wSv7A-H`^<ks-&ZgBl_g&6$%-Zs&=z;jNN$uP2
znq1d1xFBVxVJTp1`$b{nfsZZ=Ed;(LKd@fh6#wP-l#fe9K3`3G+9FuEV~JnZA=_fN
zhW@_xN4nE%)a5=ZOMiY?5tWi`r14?*e<svDVee84^4H2UFudP~=S1D)f&$QPFx$-H
z+s7u||Ej&=8vBH7A)(aBzLy61sZoU?6Z<!%9FMdWljq=bbx}BQRIxMg<^KHg^No@W
zduom^TO}lXz~}se<;(NG<U}uDKYwrjydQGh!q;r%HW_?%x9h%r?ctTL$JXq8{w6Os
z`fi3*_uuZqthaBseVg@Rzx%bDGa~gPgj%mnh~20#%WuKvsYd0SwwiV=?!5ZGf0Idf
z<o^7hlQTt@Pm^v7e6_4jL@he{(LD|By(V2vF84Zw(qAo0uAF&pSzSfq&dyS`2UdM8
z;=Yz^4!!jhh&@p)JSXu1{}ba`A20SEUy*%yS5hI9{jWHanY#=pJ3m+|f57<W`faHP
z@4L?Uy1uq$y2*=UDmy=&v5viXdB>~1ndLu~q&6K3i|xCx-2C{)yC%JV9j6(YMt%SL
z```Nf__E*a>FN1>^Y__WTjfUFeWc5n`RM+S#78?WXC6>#aNaW^xU!K~>e0Q|*O$LE
zSQwpFum3?m^#41~m=ph6%i?Ml&pP=2RoF`X+jC^Yw--F_oRw=6m~og}zu<89tGMvG
zNjn`Ur8(ONWmo-LH~ahhpyvyAS?er#^VR0eC%=k=hL;z(wtby{;8e`+LXIof%O7+9
zOt3P2H|xP)gVaWu2NL=W8~RSM?f>0(@6nWdNsP-r`iiV7opWOQlVG#zjR^wjU6cA=
ztdjco#Yy+l>*vK`oxVc)-<E4~i@KC9Z|YFf>0O*H7O(cRZF2c4c8%{dVyfi?+~wyj
zD?GN{<518>jvrHem&ZL#exRlN`i$l8&tC)g|Gpjg{rltT=WlNjWVIHMarV{ozUz3P
zF5TFy#<hRm&$ueH*+zRWPw<W8Sab37XW3sq_h!G;jjVX;`tU^f>TgUlR>*I9Tp%KP
z>t~^e(D5l5XY*g`GTZNAF;n>;dicCk`J-y}lJNZaN98q4cMDl;;_@v{{7KM=wmsTy
zd_cjQSItfP&lTSpS2Z`Vh^efx-JWamqr39uwQCPgdj9|N=BDNytL=M#f0zHCVy^RN
zW3_U<jevcW@z2NkKNqXkzd0@6f27|w{NIhK_9}DsGVh+=UoFojcXLBw{^XL1ds*M#
z<z$N-6^n_i%Q#uqD)()w)IYD@`lV_GOWBUaH*)t_i!Sc&zIW}~wF$jz1TrSOut<Mr
zeR=i94&K9u#oU^5nYYgS;aSC3URApKXZKelF4m;RDK~GtD$$WXU@-gs5&JhCZ{#>O
zq?x-XUP%dBpjtL}*2aeKZRLBm3eTETJKfoV^CgE_n6%;_HKRan@#@1IYV)H!%~Y9o
zrardz?oH~wTfiYw`7mNzQ|6zW^=>mw3)8P{?e=m^ImmbP=YjS0w;LqQxi8h<=JUyU
zvMleyPtgji)%m%Mr@e)^f6Q94D(ZU5{7>O?_wy)4cAnqYo;2-AmTuy~6^RGc5?gYe
zbpOm=tk9dDoBYm@IaPIy&|bcrZmFhK6AnJF*dHD~!J<#+frfjb%+XfG82dz4QI-q;
z&GzstetlsQm*YRTYkQ+x>dX13O;u35e*O;kon*5PrE2fQh5S4h{eRbfe0IQzQJSsN
zG@-~r+%sy2c8G%G)D70ZgwL7WQv03}QFrP4BMrt?vJJ<sY3T3euUVISQ|kI=?Wn@I
zw#^T0uJfMDZC-fOw!;1nhv;1QNP#a`r<e--Fj^FC>;8LNDUV3f!J3BKd!_!cE=es^
zl5X~T$!1vGZoJ6PK9}KYdzsd{H5%QF)5CQF52$>!oO&YcN2rGBhMNj+LiPmq**4zm
z`*TrX#j6kXVqdRbymV2&=#oj<q@P?(yZ*HsFbh@6@QNlfe*E5EXT*CaGJaD0S?)=n
zrU_Y}cz19AdO@{s{EO`hV(h<oczssfxZAB=)!=!VaZiPQ!}Zln97XH;SNvpHap7vq
ztQ`$~lIe;`k?R-#5Q?)EvvwA~<?wjco^9Mc(*JD&zGY4pTFcvTMsI50FP1AV34L`D
zySx4*-rY5I^6lEByML{>bQd4HX;E9-R6F6eqwl%%Go&_D-J2xE)X&f=dqd~k^1Md@
zM%9c#4+TneGVbWz)cahxJJ-}bSj_*A%E$E*Z&oSn@(cK38YtcMfbqq~7QqMqlOkSM
zy{T4Mut4^6#H1Y`eVW^isvfl&b7!1f^i#F(>#g44`=^=A`O<i`S$_+EE2!tOmWWfD
z>B|;);5JhTuUN$N9SsX^L|(U>P{ziT$@930r+H=E?#(PM6XaF=INwX|30eE@jPtdY
z2}SamUe&d8S9pCE=8)4qcxA&6=0d~Xn<w@^6z49pUQ^!4B7Lo1|4qT<V|npeGWpI4
zJkO6L_y!g{D@ptqplWBYuUCIQ<976cMOWvqvyk2s#jvSZ_f{AK>&&^S32Wy~o}-wV
zJRy4e`cE7;w(xRimd;MuQxvkQY_SG+yTh*&bJ`hV*QHm69*f!aS$ikfmbGGg?-iw#
zf0{4P<Z(RSegBD>Ru3BDHU~|&>^4@rU(fi>qQ6P@d6XveF(#`ueD?M1ch;)SHjWp+
z`X_E(;=!jUw!Mw+JGZ-r?ZBmGo*f6zZ*TdrJO0XI9mlZ3)8dcbdD`_d9XE-1Cd(6a
z()j2y-z?4e)BI60S-U4_$FKN0IiJCWn`vrS<BsB|Y%`a2DA~S#Qp2{lQNHO;s^Le|
zlesz(kpho3H)zGIP&@Ey&wpXw1|P|;AMCG>J9wM76)%XMqjuuc0j~q|f;vT-mH3ZT
zHeWj|bm`mXmd#f<GoIJQ_f5L;>PY|P*Bl#OH+`D*VsgG^@vkFq{u|k+oyZXUopp`(
z;IFUZS05adH<$lh*&91Wt0~uCS%J;{^@isWZ@B&ndtA77LB8u-O$Z<NQC5Z-6ZnN&
zg1EM@=qerhq0%+evQffCC_pB0tw}zg3IkiyBc5&jvnvkxw5hmmn(?%lIdwC?*&#_S
zCXa)5Mv5g3Rkbgs{NwpvxAN_^`A@ENuTH&?=X=PY<NKY6mvYl@%vCyGwrhRd9y>eB
zRg1ruWaULUT)XnHx^=adZ1(opTO29sd^Z)GwF6h_PwSSOVX`r=H}cNbi)a3PesN{p
z^amM#PNc}5>i$r;cwdcaeSnc}Yu)NOXZ-}yYm<7mR_*I{ud{f=zh!Ms-eb#YPt0~6
z3Y`7zuEVN-2i7jTQ)oN)*u>WpUs@MBdh|LRdeq$bI`)+m|E|;@c2D)#-%N-<pJT98
z_);p{#`((_i`T>_1}_pn!)xoylV9wvUr_c*@X<22dxl@!mBo}pyComV2ss>R*|I5z
z>-~{Coux&e-nH`aJnPXd+#J`heBpMRPU;<>*3?h7r}w%QCr|T#EwPMcHgk_S+b37%
zui?`c6dv`+Ff?=7aejB~6q}k=35A{E+b(i=Z)DWknZUuwensKui>QOXvgb3>I)aZZ
zzqR_A+@G%>o;-P(_`Up#^IfSDr9VEoPp25ok87D(<7a<b_ea#$sobkq{onU0KJVaM
zuiU3USH1eL@jgE5U~FLSQ_<Bg&d>imf2r7=Qng?FtA5*`_&q(Upnvv@_o3hIPyBwZ
z`>rJO%Go3pzmPY{YTx+^ervE?5{lDE**Gao>d<E2C>w#mKoKGSuP0BkTfffd$zQs)
zcy`RI6NXHiy54aA^MCjBn6~*mmX`shs>|z)Io7F_`A=Tp(A=ayp{J>lC&>8bt!*V`
zmugzILv~1eL}_yQr3asV+)#gMjhOV~eKKbAxsr|^m%MUhahs*Mre0NPaTuGrtK!nO
z58a2FZZA+ZJ>C$Yzq!b;d~u}Rd&_?YTYie%4)<y(alIt7RA9$uZnw2xHfg0d*xo<B
zerJgC6dl>ak0wtjI#_fv?FO4+qubg|oC{Os=UvU2F+r_eVA*8f_62^|ebzDe-ZrXu
zxrepN*7xX@tS48qHIA3W-qy2BX$+M~@c!lVn}J#E?-BV4%KO5KP9J_H&`|yTovpIi
zyzDuGnRSi!47*(NdM^6hVEF#t`hvyr^<VyZT<7N4rY-*^SW)$)#?_olTAr4EmoqQj
zyUDolX{?(<r<-F*@2+!wyFV`|{qSM=wR`Kb&gGgc@mAcF<J!5CGd!3-arG^e?q5Ii
z`a`&HWYh`CzL9^zHEsTvkGA=FPrSk;noC$O{8B&eUnsxVx~jP9&#R@D4NV;fr}5=x
z&Wf{Rn9t~*a?-BRjJrf=Q}gpjvXx5Tt9zNkEpxRl#=l&5Qj;N7{hb-#jEczx=a`G`
zNNkz5P+t9Ko2^Q!oM!o>|8GBWSZO}Jlg{xfTcDtNvcu)F{0Y-~%4WM7s;~4_N%;9u
z?7-9Y0SB8eess5sseW~A!K4ebW!rw8KFKjT%X5v2=7&jU<^Q_2f7bYWK&n8LZEn!4
z&@~)$FTa#O!{z9_aAmXE(XBj<LV4$yN{@ZWTQRv;^6fl>aC@Pi+KdMYXEeFg5)Gg1
znql<C<Ky-D3xuttPCmVma58eoONlRwRGRM_aNan*aKpTvdajd-*u}*^RxwUbux+Wh
zU9$P%-I(Y{2QIGkIQHj6-n=_}u4j5$G~Y@dR&2}7PKmwU@bpISL6dE-_sYyZ^q=>`
zf~m^uCKaD_Us`W-KhUY=be-Mv|94_jC#M&f&Al1jD(ms#*(QxUTX(&9ws`Tr^Xj&%
z5AHwYU2t#p>*lasVI?ki)m>P(Gdw)^PSWh#>h$%uJh&Yg^d|gwm2>`mJxP<J%wMeF
zY?JmKvCo~6;RTs7|0Q3YyA|ffZs;7eB=*&U8B-3LPPAO0l*4*5@tK&3S0{U=zh+?F
zk`Karw1e^w&hC^tYWe-yqWmwDUDunW)MuRWY?~xzy;H*^w8LzzNbsf3#TKrOtM_b8
zNSorYSf;J)GyjF!z#V4)KR63;{M%sp^;nsIve$<2uXfwbW|=(S>#Co+_-dF`L1O>j
zRdRRs|7W+1e{)pXF5=ewxS~^Sc{6_96UyM3V9WfF%gtkU^NIW~@9g$p+r8`7>0_*G
zzsuw)o4(f46F8|L<hAbOEfxt|<)k-uyIQgt7RDK<P24>-Sl~oLQCHjYh_*wy{Suy+
zET2n?@~)MQsQqE@HPyrB@P+7K{|aaQ(oT4wX`uV8O}@2xu|W9Ms^YS;m<sbRYu6fQ
zep;`Z`Jq*<uBt5Q;)Exwbk4-4)t|`LoIg?9^1#7$j(+afUj!e!BKx<~e0M|p)~2UB
zzdUt4mUb}H;{9L$%Mu)K4f^gzit=4M$b6jj*XO$x8I1ckPdV4JN-<nXKjzD;&<;J_
zza@Q!9p*mE6yoFh-!Gf;l66wh>ED~Arv@HXk#68?-SsV|(DeE_4ONSeKLYHEZ<rU&
zEtx7by_1J|<JOj_W9e)CJ*Vr;nKiv3*kwPH$C<rR96UGfF&Vh#Uh`kFdRv?R(dJoS
zS=Zi}v8B`1_sMIIgjJcP_ayx-jla)iNz79)KKv%~zh%^+_xHcgm$j|^z31{JX3rn)
z--Kp_n;py1$utX2HmJ1`-^(qMeddtF7SW`{NC|@rZmm|``*OGNRd&cdwnz{XkIlGL
zY4An3e^Rkb$tlagnvIj+dEDOg(kziz??7IT(u!vrI-Px%`&L~}TdlcGe9K{W-yUw$
zze_l0m0k8P+&kMu@ZRisMYd_rA3naexOpyntLNUHpkvM6AKWBb%qCvl@Jm0=)>`O<
zL%LW}=O@QChnFAkEA6RxIIpmzRpf78>z|Ta2l|4(zKOS5JO2&W{^&x+qm%xW{djis
z;_1iJ&u0eBeRaEL-8N74j1GmndW(e5xQJ}paAIynk>354Y~@0IN0ibpNd({A{4sLJ
zq?(?8caHv++gqdkq5o5v>hU!jmj+%qSn)sf+((_H>A&N(nL=J}h?~S(yfIhJyVlV0
z!^TfF(W>uuEP2OkIGueiL(|JAfkmI(X3pj)VB+4M;=9yo!=YVa>viQ>eOD~GAolRk
zi#-P`cc<I9<hvylnkuZkacpT}6BBFZ>OO_8DFy3Pl{wF=2=FQEZaTkkals4zn<i{-
zb2laCInRjXVtSBNSHl1E;@&3jdHjnf%Ni8SY1r^s`$Vpy=E-}Z77W%eZ+f5G&*Of^
zxNFOghw+zQbFvl5D4HnWb$ZsEl&5h*;Xr4?zr%BuRb)whJ@!##x4n(6ZB=pEpI1*;
zuKn5Pdu^4yWmV;mFHbz)U(;@V!MXcT&oZ49sfxz(RY@;P1Gw)dPs!4|bG3M4^v7Kb
z_@B7M_PtnrcE8lmv;0bP*Xy3Bv$e6^e3sX}^W*8(SBJG0Mj7^BQW7!}d+T&ZFgX7X
z`&^IvLc#BRMB)tOnofM?ea5w^>1!T?n1ZT_^DCX>4y!vF|Gaf)*m=@2=+)sxrm5E=
zlD@C`9rH`1s<2bVW<vYNCn~bj{!BP3eQEED#SUgon=Dm+Em_Nvv9$lbl&brRZ=MH_
zZ#<RzdhMBI0<UuK9iQcG8CA{`wLAPk`l5-UzPD^*U7pR_QnzW*2PvIXF6Zw^q&%{A
z5ERUiz2SA=jjjFRvt=EtCo{e7T_|}uc(tFTLFUS`_y(SHY$9tGukZ1A{LH@mkIKo2
zO_y)ozkgr%N!FUHf0wtjzxJNfT)ng0`oER$@{U91*;BLEUz|0K??8Tjc0r|+ujbri
zT$@ia?4QFJ(kAmy__ck`qsp+)uk3A%ru8h&X6#qW-=dRN-(t6<fv=g*G{%{6iKf&)
z_tqn?&rOS3re)%veo<h@?qA|>m+3f4oILk$akH)7sYNpwzjAn(TsiNnkm)}^=Fx<?
z%xozQRX2{_NXnD>VGw(h;r4IgFNr)F-_##SuAdRH);9gRBGbmG{uj$Vgr3ZlwV8Bm
zvBVwMNdfb|`#3C45tzq*>~fvKpU&N^`V$y4KT8^<`h87Y_+9RVfu7z6ec3r4+1Jm_
zm!EN7-a_~J!N>9+e$UdEejqSyX;oqHqY$=ZTjs9#V#dGtl81~#&6dUqvp5!IEMAn*
z+Sq;Os6e9wgWu~yPrk5oUG<#ngW|S&{=2kMWQo(AC*H2*B5&7xbPQ~ivwC#DHE>~X
z<9}D)KQVJZd1(baRQ{E8M=bH=nxFS)$}_m!bF}^WP~!e~v01v496om2-^>%9a+f7_
z|KSB|W_EW5amanV{(MEmnd2Kv7hAb+&P!1gbt~8)(i-BF-MWZ<)iuY^)MhzRiI*QN
z*0t=?*|B}%y49Z7Z8l3j&Gd7VmwYnY{$|jZyrUEDn7=xBT_)1$^#jr3XX+DQik9{S
zSznc#F7JB!#*=<YuP!&q*>5(UU$)}PwWjR5@dtH8>RV#IR{HVnH(TBj_V+TQzR06h
z*UevDH(yehTl8q($vGB3_8(ri=s{PY<KjNw+b^t7v_(fI-&=Ax_tL{>%MaIP%)0EJ
za!Hh<e6r@&lT&^*8ZYho^6l&8WoDW_vqhHipF4baiJq?JG54J=4of!lM6mYd1P01+
z)pbWbICsET;^hRTshZ`^i4T*`@-Dq<`0t{v@BP`UJ)&;~ee`nV(Qg#~@h*S;?!Tg$
zO%0#t%%AY<+wtIh;opDOWxB3=`+S`kQ<eIvH;48&t=gRVcfFkCDvi?IrbV}`WF+*1
zzc~DT!jLMv$Sp2t#l&#-paVR2<NBxTc5kkom@upJ!qKY%E;p-fSubd`{9nx7?kjQV
zfw)>>P2seSh1%<X{ky-ZJ<LK%=<SB)Ir{6C?6R)jeePXeV10POd+q~XQ7eK)qSk(G
z&$<{erF-|1pXV=B<xlN=>Xg0hUrm^7V(tO{Fs46@#`oemKiuD`5MSNWzPe|_^L6|`
z5>yZD-sSk?{D~bC^*06?o!zFR<PmzzTlDz~gZKx%iSNx{WOL~pI2;n{q!+Iv*pd?<
z&f4<uCBK%v{ib!2Y5$Ww<;#qDYtH*KGKuwsmgd@SD3n#r+MqMjhTo~fYtNNeZLgOe
zx~|2Mca7=#k@~nh)rGn5&xc%-Uft9cu42!3yk@I>dquwUm9kL%u%bI6Tsx&brY6@W
z?0ny^^J(vzRbPZIO*txH_=59Rl!}+<r&r%Y_>9hGzKrgx(=4g`=CY=AvEzKjwrv_I
zp*>|ehdlq^D44Xt@#PZpyDV$%1l}DtbJ=h1y(z2rdFs8@6>j$HOSrPaC&%BEQjePR
zqwKH4l7h;|&sh3{b{^0#Jez3e%OvA3E&c1AYjE3!4N=84J5{7}EAwRb9r#rcetKrK
z{JM#@+f`QPPcHk$`;*-)GkyMzm5fyy?^s{wzPK;ar~1&e(0EPjDYYpZRPD}AZ5MlE
zcfsC$`60g>s_JtxQe?|_zdFLOhb{IG7r&yIYm;$B`mbxT%q4;@%;Nqs2iEI4ssx{n
zmf~HjvnGA^g1g;EpH%8r#`$sGw)v;|{hCOv=_%p)#pk;B__lV}`Y!&hSoc0=(@ySl
zOlSY*v(@WwX}h#>|1%c8u$c#L`E|L62Atj;dprO0jZEFSYajkxAu~N{#-t7By*GXT
z>e95NO?utJ2iy*`m8xg2IrKBKwfKDc)YF@u^n@`c_m()Xy?)H*Pt`L;PEiw<a`}j(
z%&8yzPfXm_^>JFXhvcPm&D-4;?`A!%wLj(ZGRMx)N2V8aVk>9vpLzb|iM&Ib+r!p#
zESY<H(Sa#^Vdt&&?ZukkeLVCtqABH+P5qPVPdUssvlPCy_i*(+$UOPyjH73VXI<E_
z-Rst<UaBwraZ5qa(J!o5{;Ye%sgut0tk=%l9<_A&?^~DuUb^gl>$3aN<s||WDt2v;
zuF>jS7pD8}qxAPLWm#2+{%4)@_w~2Ct8Z7k#J)D9;?#2Wd9ywnFH?^ac^018R;&B#
z-m~TI9WpUqhn{}T-O}tCt{<ec|Hg^*D=U+7W^kU0Kc67?sX*SQ=3sXc+o}H5H>cNr
z>HAP;deZD-M#O{A^(`H%0=dLlW<@DHnZ@WO$Nc=k%W~6bXW0j{<rQ0I?%OHsW8D06
z;`SQR!ZqKV4oA(s8CH1c*D;0r5>H-FWB-4ke_`16llD)PHMo+d>~HwxR=j<mboVRa
z)>U?miQitHna{P@E$=_8*s*gL^AGTs1a92r+fq9_?sA+;Mwe{B>(s|v_usfx`ES|I
zm7cM_j62^hmU`+wGnmJ<FDGm3^NKkM2NxUvpUqcm>GqB9OK!7QId|>5Q>HgReH34t
zd2iLuu1M{|Z<>6&>;M0&o&7xLf#xTL+`ZnR&+IzaaLS!jb#iF9mDBRoC3ULPpGl7W
zNgoey_jW(O`ohIeJFj0o=(j$8dsO?3FSl;RU%m0rc4Fu2X~L?lg^#rzBt<r7KBx+r
zx$&w}mP)!_+&gQTM>Cz=ANbeQy%PCVT*>Is(yk`F-ni<HZQ#@olQ(Mn`<R`R`m^fx
z#PF~A&wtt_F1b{;;)P10&yxg>@5QUXvfMqN*LAeu<b9i-A6=Ip-Yc<dddK_R-Lv`J
z<Q0qaK41RPVx-{RT=cv&dw*ld5+1)kpP8JGUZ)?qTGMXHds;Tp^Gx~j>fLMG^X0E>
zW!rF7scwsuz41BT${pNk)`yxFu*~wil^5V#SSBau<sMgW=<J>zxLUPiZT6Wn=~{EN
z*Ck&2V5ui$A*%5FhN)}Bp=6fV#oB8trp~HN=W{w9-Mz-}-H&hWEAqsPt1SXUUGF@d
zue+jGUuJ@&^ux|Nf1a+OD=I591dni}IJMvYuUzqaf$}5ASCwz#e{ASa(b$<I_w=^u
z+3#svO%6@_v?9L8%X{Ym{+O`v-(~N3h39u}T-eo|?Qnv-?DB@ZAC+ItcSs#;sdhEX
zZd(0CN%G$crS@E%QVY|L_iI1=71a71|Lyc*BT*3{C#}!+BL7`KqzcSV5zv)%iU0M8
z$5N`-<Mrj4XG|Z2IN$%U>zYEJUL=ReL*Hhdga3~_mu~WA)@}Bh(sAqblcIH2MdcEe
zoy?~h-b?oeX$hP?ls4^6L+&yE^EW#suWtEv<J|qY;NEZRwdco{Pq3T4wmFvfQ}!M0
zO?<|D=ew6KzO8-klHmgvpDm4V3b`u2J>0nX^O>cE4&2O*zt7z}_%H4yb9B}lw(IY7
z0{^V2;0`t|`*%G%`^M(#(5z#(B&FSU?f)`U<6M2{nN#=0)*KSj5<8W0se47<*C-3k
z>nhWV3vcjVayonFnE1NOZ4aNny(;ee_9DCgS<U$}0rT#L{^T})xbNN7>$3Uzra2$Z
zKW~xV6TV5JB4fv!{53`YpPoCKzx2sRbz_0<#`Rb2_$%MMd1qDqyLxTVfqNH9bBu(R
z1aTi@G~7Aqp7Mm*^2>6>rwAU-`4^y?!fW(<=cHAaE5iPrle4u-S^n$cgu7=<gFp7~
z&R$!-!_NK3)&qCee~bO=!0VUKc-Q8;w-oR7<S&!!n)|OMsLXll#Um<{S9P$)HEr?c
zGgl+eRmVriYwCP)n)=k+!~bvai=Rr)|80JG{SS!p+U0-jb?=e9<apitE>~7w$+<Y~
z)|+|t*WN|$I5fXlKezb3bQJd^0UiVK314OwTv=J%<PeaYQM>->8%y0^Ti-Vn`3A}9
z8MtoT+Lxdb5L#I^zp8xtwxXNm#^q;%R9l5Mgqrvsy1FRbbl<Eg{`O1De)1P5>fhtj
z{<+nAr{mM}nLW{;KQ-@gn<PIy&_Xl$vo7EN-}mn5-?~({Rm-5#pzf*ua{KR<EL9t4
zZc?-{SNNao<|@itba=<*K+l5D$&=5j6?_O=Eg^CJSMsyxlm2Btc~$pU#jiGKzMs$3
z%`Us+YLaJcuGstV-k0xt3-fDpwQqjk_SI|2lc-qd^%wr^XG_icUL3c7iCv-u>qS?W
z`GSiI?;M;P>HDGf%HHdYaV5^_FHMZIdOlgNdUCj^LwWbf-zAF<#?QUI=YQ<h^S|96
z$jm96BN?i6-po~LfAF%xZ(m>k`)mB_iHC2&Vuo{vKfBK{y&A&qD_Rg8_VC(t&-+^H
z;!?Nny?d9}czv41n{8j+?7xZgFIskawdVGdzB?~_o#D(o*5h|>+Dgy5%ezl3c71cq
z-F>=T%K^<BSx)TQJ{~1D7p(UsWXi;D{t=|FT>0aft8euNhpvt_ec2DXKR%g1;l{>^
zI^D&VUaR*798ys4H10R{OIuOe>b@&)`Gh6nkG0;KIfhJ44&V!U*!bhz8*VGxX|?IK
z`vk48Ef=@$c<D4DGT$IxK{uhoeKMmo-^~xEc9nNyXaC&za=PA%y$|cS|Lqfg*B-Jp
zv0nOHcvAf}r?bERGosG&>zrn*zs<_P5H7^PAjQDIkegbZpO;jcnUkUqKkrpPxmd5D
z@@RN;{%tdny6@{B2#9P6jPy1Zk!Gogc)l!m!xHXk3vMJxF!^2-lkODp(CRb)vj6=A
zq0*14o$U;tn-eELuX$egkaO40y8q9AObS*rk&ajKk=Xad$Mr?5W5%gt=?`B%VDU}e
z7+5n^s-*1KvmBmy`$e~>EYx1M)PZw%`b?do1h=+{H3kt{GZ$OLO<NYC(<gYIdnJ#O
zlZP|UbSHkcuQRVCI{HW{#OiUWYF@q-FZnIuT9?S#|Go#0atZe4WeX<Gh~_og_d)60
zQQPpKh}d)T8ro|N{AU*y9-s1UN&TIe`UjG`Z*n-x*(gk{WNg>Hy2WnA`{I8GTKRUa
zJ79Bly-RV`%Rap=={q-VNq8Z2w{3fU?EK@G{hwdHuV+`^!^UB^HH=ex2E*~-b5aZ6
z|Gl})`{WVZsYxfp=e^-_I>NeJz<a0b^V$u^bz@KEzQ5XVImF40hb`o|kj;$G`(rO8
zEef+@O1@W|m3C_dLtT8)+q(15Gn)PtKKO07;{=Deh12HBf*CKqXf|C9X35uKl)Ij_
z`T7sTN1Ky7>MhzL<Q@OyGR!;IaV_K4l5-yloLGIm`W7`ZpY4d4nsQWuVMbPrtXdAI
z=m}QyLYpf((QF;I8+aCpmM#`sQ0-C1k=GLAFg@sK<y6){d)aRi2NXXlwOD6%FfZ{^
z%wgWiTVH<F-AJ8d%5NQ3X;<DJJ#K>%5wj?#guQ*eQMSEI>V;R78X^-_`5&y7pZayb
zMf<ZeON=t_Y)n$~+tKE8=g7Tu=UFcWrT*uv%?}Ock(%yM(N*FVa<OpbQH7hca<;5y
zdmefG{>PVm=XmP%Q`EwR&j0oZ6|Qu2h@7>^L|15s|AaX^AJ{RM^868WTd%#&_SC=f
zlv086vs0QR<dgqa_)bx{Wtg{n!GkXnYjoc&lg@usB~s$sc6-I;IsA*~FYqtW5M8cv
z+AQO&Ks@Klh^7bjt0qo#<rA!Of4jix^%MzjPtKITi%euUsGjF}V&THxtFIHCX}y!L
zq5ZN5A49x?ZgE@J?yEcI2_0ZnZtYmo%(8^(uu7Sd<J_ZcPea<R^Axwe6WF*Rp(G>r
z^5^3m2P2v@`#e_g2D+`^>DgXU)95bSA2sdLh8+rAkNDJH+_-c!WnpSq?2Iec+ZDUY
zcV9X9tn$HTjml{b8&|7;x-4~aGJA&3wIH<v>$@b(-n_n)8TE~M+ULj;HeFt+cRz&O
zt#5t3nXYi~+y1VXTjML8JUZ_DllaxVeo}YhVk-?(>+WZZFUmd4&wgmIdvWrU{kB2>
zqSfoIt$%%pe(HXC$CbUSHoDu1FnURP-Uu$V445l+vTTCXj;5~PwHf)!?@J1N6K*+_
zF7LT_)gpW4J1eQOZ|XDh=3eErW-RL|T{dG;*}Je63uX8JbJN>bmY1+$Yk1VOE~DiZ
z6TaMeU&^UdBwZD4=Hc{MvaEu+<@$|R-l<HpKe9|uv;4=orA0LI)~omFZPr}ZyPTVT
z-<7)NzxxZn;j!J3A$mrBfm>(au`uS#skoK*^@{Nw?|BE_F|e}cCfOg}KKJrn;eeHs
zf47zv|90b8ubqB_cfmbLh0S;GzZJA?>Xx(+-p0MlPwn2p*cS!9J0!QM2c#54sPg}q
zw(z~$i!JYcTz8~Z&zE+#vHhqUw=n#cS;=k9+UxAxVFC75M_z<3-PoJTvy$CVrmrfh
z#B9#KidpLCo^j5&c8SI8<uhKz(<as@$`oERBwSIdc(WtibS@L8O-i&Y<EF3tj-9zp
z2m8cti}q=){Q88MajILcA=fb>+3=Ua`Oa_e#CgnoJ7tsejd?e_i>~Hc#Du3$Y_2$G
z_wdBWJEhlW-K@-C&ir;yd)CCgpU>EJ%)kEdo9)K5-3gzc^%khM=EQNnZ9cf4b-||v
z&!0Ga`M-}@?)K;T8z28pKeEJV>10DM@r`ejH<rEsW)@xW-nPHo=I(Ajd%xwq-unw;
zC%ri~g>(8`^&5)MgM2@7t0t)5-L~uWzB469GxiD>?RM{US(jVB`qP$WJ#Vb%=@_-i
zXERqHd(Hjx>#Jv{OFrnMRteFslXo^~GcdTWWMGiNStXRFB<dAZUafsybbH&i7yoTo
zx7B`gUpeuK_awE_?bhmB?_Swloc+e+@3FHP!6GUf7kW$;x6V`JFNu3>b2C!BfyHCO
zl-ck8p1tUk)X5?)CMI@G_QARx6}7)k|EQEWVKMpf=bb&D3j|Mn@vyo3<Dgd`zxwa*
zWk)?X?esnTR7<@5H+y^XkM|pQ#CU#mO7qlt_9@EkWEwAjcg(Ns*Ny*w*FTtfnEk_<
zhsuR=&yAX9zf|-5Yvc2%`ny=>Cb7#e7oF%1@msDGb9isekHR@muBhxT_m7=ixbfQk
z$vK-oexCYo=F?0G{jcl)lrisbncwMs^<c^(Ms;bnsNH+|CN15!?O34eL!bN7cZ5G!
zcCSBd(pfkqU7p!9!R=A$rimX-K8qK*tUZ)dC4B7j6E*41=MUd}DpPiU6tzrp%RIJ|
zRgaf{x)<=ZW&dH0yjS!5uCz}4SGH-=!FKVJF-(GDkBW+Z-d}%ynY#VFxqm+YdAeEo
zRiL7+_Mwb*4{Q4E_5PM<7H{sA+MV}x(TTs2D*rX}pZ*cOYsK3v6KEzs%UeRxz)j%P
zr<1|8Z?ENOYID78W4qXLL$vVI?s}EFiXHU<)p{O}TzBXQGGF6Pu9VXk+8ir#OuixF
zSAOT2+&AkFKd_87y?y<8V54oM>Vfy)-`(Zz+G+1PYt3Q%j;qTYHooCF(NnU6X`a-<
z@6Qw6?%&@pe*BT}!S7}h<&WK)xTEU)=67!&^XLCLb6I>^&BLp8l}{aFEj8B5tkQ13
z=TVU?F_kCr$kVs%uf8>Z@(PRH`91QX{q)UAnaXzFlUA^Pmj9zMS@hoYOhwKolN9f9
zE7_ku@_Oq0lZ<-XPfGqVx7p>s)<14<MeV;oZ+IO(o4l?ndH(a~>H1Hl^Q70alrmXl
zt&@A9FQs5_R{QtaoA%G~A6|ac|MSPNx%W>+<PUF8Stf;k`P-uU^>&tm-6!JHl)l?P
zi0T(+G|`xFaTDj(S^qx#dAa%J>*eC&)9v?FTG#%3^>TK)xT+$L#pA*$M@|<m3M=`1
zc<m<94->Ld@7q^a{|bp=x@h0B)52ngj33_->75fabp#^6J?lMw^3C?j8GV0q=A8b@
zwy&!1olQ>L_gHhz*X=hBKe^DdXUayFPOallv-Zk9-|}xWSC4t!$6c%|SbrX1dg~ro
zWUTjS&5Z|IlRg((eizkQzdVxj*FsJy_1)YH*V^$&HQb(%{<mT8yfmpzu6zMy3bs`N
z-;aGh$0qfOnf=KE;lhSHHyxboUNqEPX5YEFvF*=^7N6Cd`Y*)!8}t6m<~Az!H!oP<
z9wqfDS@_eT^XUqEcW?YwH7oOke@@mHX0@ym)5{a~8!G01>c9P=xO{Wb(l^lyf_HjO
zc1VjnzWCmc9Bn6gnG$c+4T`S{9JF%TZ|QzWGRVj?o-n=7kD)~UjnJ3oxHZSk6ZaX-
z5OSEG$NKA`?1r+EM=zGL<gPuk<;BxI|NJ?BWzTk=bX3f{aPu4W6U@;*lRsYCpRj9o
z#tA*cyLTC-a&9|pyWw1S=3pe(!2-GaYlMEtpV;j4cPr~j>C>~#So569irHs1C2wM#
zEx_Y^ku%PD+l=Nd7bSRNJK21=<5q0>B(_2=#rw%oP63xn=e0~nn$wD|^52{$cay7T
zY32Gk@AAT$?A9di_1Y9u>?zS+`NI97yb<fGw4KxB3OCJqy!X{C;V;UwZOwjKOr7|D
zqR#>ev7g6%?_T&^HEZgE{dooVWNx|ttGc!<VDG#%)fdNk*Zh7^ZF|=1f>`?+d6~S$
zyLQc<ntdlI_Vs%CJl0*CBROv+?Q@-U@5f6So?HBdMZ*2XM-8XFeVu!`=b`<q9M-s<
z{>oSLy3?fg=>DB#Aum4jjmX^-_bc{SzqDB;x$<T1{$(FQadYj^&S@`oPF8I_^Hogf
z_rzSUx(S=S#a@@)J!_JZeKY0XR+ad5x65ATEmMqUix=>;&)Zc{dg98O<5OxvjDI-%
zXj~J0?11XgHU4Y2*Lq!uzwYq;xBH3m*mr@Px0Jrdzi6{t<*5;&ak+K=)5}}uZ_m<P
zzg)7p&SqujRhzG-p6gO4sITNQjr1rtzdRvVbXlA0!4{RyO&^b)Z?=kZ=<j*AD^JSf
zHk*MSOYhl59n8z~zJo$4*Wct!&89hjO!yuzoxORloc~lu`;Dqu(?m2^e$rFtn3g0}
zvgP6gU9aUri%&bwzPaRfsrlszx=#BSe`Vr}c%Zyo&%8DHXtnKGlPB%66P_D&)b#C$
z{<z>>n$#xMW%rjFc|N}+xyz{VUCuJa=tGb1#_0V~I(6K^{pI?Ddl;5w6_u15^WKbV
zd!Nv#nVl;0L;8%#fmM;MV!tav2CAFZ-E;Z(Hey-kq`t>Vw#7U*58qb!vg_)@$+Kp(
zotwF|`%L^c&&;IVePXH^-PU17x7-xVBHpOI*d=y8=i@V$zn{w%=>Buio-@PV<JsD%
z(~EaMUg4WQO}pkk=Pm!(q@eAGcSkp*?fepXbd{kBzsSeS(GzuKCT4Tm?e}pNI&IXX
zJ1OJ`lggi4^65p*-a+SBl`I1t;(yHcVO{4sZ^eTx=W=_G@Q9hL&}N*_TFSj^Leks=
z_2>Qk5^l&Zk<_XG_v-29!`<@ndw0&+XTAT=MnQw)0%a5PyJ~#go(A6jQ~8+BeAALE
zjk*UMxf)aW7A4)|j5L4A*Jr;Wy?h$e&)W-&c4uhM$!@&Ly6aW8y~pIR5BGK$2ZcCo
zyA~*z&v;vU|6Q(4TYE$pFUCcbKB(CznsQs}Sx4A+l|wv5yXQ&PJeqOPZqEGt*3agA
zb@SRaXU68KG1ldIUb`_NmoaZi(hhO)ocuqJ+Se8tvGYCFmpy+-!mxM}i%a4K`3$=i
zlJy#o4`s96-IWm_lE=DhqK?PhkPRE3rOiF{X~8n-50VD1yBAiwZ7xf#3@El~_+DbL
zajvIBRnBomvFOdB*H71kZZ4ZG>TtUzcga@EDKAp&GOmeb=s4PMc-r1{M{&u@yQ|kK
ztu9Mqi+#euyujH02ZNsA&xx-u%nDh*_~wa*KfTgMI;YG8ADPbD>T+&P=)aBa^Fw#P
z`{K)aE2=Bf?mhdvz|H?YOv`0lw^L-1zv?#5mr^hC=WOzvDWmK2xBGDI`sTU_|5r&@
zRtxJnZfnZOoxm^av|if8A?)q0u+z@BzcIKA+kDBJB51Vr^|VU<+}q0gmMy5$H{B7-
zZ>nQCcm08lv$iL#zFlg4#Og}Y!!wG_X04&yv}c!I_&G6Gafz$VF{K%DCsH^2o!GXC
zH+hplP>O&-kodyvlg*LF@BM$+tYR(X5nd>}&wO4!`!2B+Z;xzex%-l1+5-7)32Q@w
z->iSViG^qO>9r2_t0b?q<=;PbWoz2jJc%#Yw|%&9FLp-rI@a_1Ty;t<8{7g`^UaL8
zly~j*rzq_c?^MdgEBI%ZGF+da`_3bE3X9#;|5HoVd+ic-mWa*HI3ZTt@OxGg(?0i#
zlJ>c#Pu#bi`!!=(k)(?2oxEq2Wt*>cJiorJ^22enF0t8PgAWUNOGGhymfbxpow}KC
z<Ch&_f=&G?`@cu-3Ef;~`g=#(C7o+^`yW0m-2888(%PxzA{wtt8ACSDtC;E9U-?4+
zc<lw-&5`bZuDi{ecd*5&%hhP@=?i(!&hgu<)Mlt*YkqilbA;(@o==h9F_LU|7fO9%
zh%#<q%Qziy+^I=dqGi_C=51nU-p@Weqr1_1`NfQDroHzgChjm7T0A*u&EMX>8HsOt
z7H4$Dq*?SRCALe5Y(A8D-ThH>gv!bv213`BdTuwT3kR6J&N29NrgZf~8Sco(uN4AX
z*DN@8q@+uf?ea^7$rqDUnix*M>p%1A?!*c5s%-zW!b4Yl^$1vKq+k*n_IG0JOPgKS
z6#{1XHk+K>r0lr$&{?(_sq?b9|DIUk?VkS8qr$Cq+w+P!x&=q3zdrT%#i`Aww%F=;
z*3CSk_e9K9#P{?;Nri$NuQomm{3)}>VkTeP<Vh2J4o%8ZU8p1V(Zh}Fa`HdpO~35S
z>U+Fq$-dS<%*8rmSEs9y!{uMO=5v3}ob#$9XYJC`%{4jUJ@<2;-0A;pAaG0PgbU*X
zhZ`LUp-VQ-5Eqi1C85(CU#B9W<;r+ON~A``EYnDz>5fj|!EdZq`#9Tfa7Y#w{om)X
zQ}NT(`P`xxP9HI1h@Eu*Q0W>+A(`zA#>Uo04QoHuOqPB7Hr2A?Ip>6YK~?h|R};_Q
zuP)fIzrG;j$h}S(jT<YP?sAz4%Rf9fNjcB->}1Wru0_w8=iEBjbnPLNxZ?3E&O4O;
zwM~7Zx^vIN3r(H=0(U0XsjWNf(Agii|LN!XvcYxEw_G0Ar&eq`K5vJ<T~NFH#_4La
zeGXKZG4iy%e=E0R*ZiadH?QpfmZ*0yrMWIE+RLNL$1CpZK5ILRIW>=YBhUTGUv)J8
zbj{Q=+6O1Eb&@>0{DfZc615})jzu{wl^m*}AFMv{a&x^9FX!Po`onrp?AfYan>Ppl
z+o7=IQ2*+hw*6lYOZ>>1_C$MP?jnQphF=YLFRkG)&{j<-`79*V!*ir`iq2t%30=<}
zj>Ifm5MP-tVE6v`cBSZ(8nf<b%P*GkR!e+UV3|-DYSFIRdFlVO&00xIEUbk$p4xvx
z=R;$vz_ayAZJOLKHwvxL-w~7ar+Q+7SzEcx!BnYp6_XkAgbNw3mq<r6ZIGBOGyRTf
z!=e2zY94G`F0@L?$8&Q2QOggT<Qr~$5;urwj%s+O`!v5!Ry#%gkuJwZ6aAzKY!`D?
zy?sLjdvBaBeIGjA!&G3Bw7uK1nH}XG6J48FMI?ic=^s>_?D}bO1FPtSj*rYL$wuvY
zGuLcRsk7F+t!y6h=7aEtvwh(ok88$#DBJVt&`Itb!&Ol={Z(bpug9NF=Q#7y|GR$O
zuKHiWm9p+D!d%ooGy0!;!nSu$&SUmZ`?i1H|L^PT^;L=w*j-pkIz9^twI^-jt)IFk
z&yzcY*EW1@ztpd+@HzS&ypvg<-!?Pi2>i0{kH|AYb1g-_8@{dLXO*S84!l#IC>dj1
zSn`3(@{3x_R)#hGlj_*|&83;vd9WNPvRF8ElHqn<lc{aKZ$2(=U`l-$s8FzY;t^lx
z*nTC+@}o27AN=*HusLv!!Q&=_#`QPs&z;^|w_x{<^#-ZG3?f;IKf273^68xtx7o*_
zvwga(!c1Kw!^uB;rx@DaQIYT3u05e%czep3HkFgcM>&M0?mu{>?wm4v!loqK9lM%7
zD!<;hUat3EylgN3ftuY__A1W~c6KeP=WX&!_-k%E!8Ae3tNPv(a{<%l6+vFUPVc&w
zd!0LIq_>l&vvskev%{Sq8xDC^`)8fs$NVba?BZI9I}2QPOiYSgFj0_+b;3dR*&>VI
zes~hlc`L|escVRHYsaffv)+Jz6Ta9y<ITM0yC8SQVc7^R&5uRS)$CbZhxVMb-@wLH
zSkvPzbNn>-^y=c`0+Ysrrz-3|>{;0S(R9z{`B8HFn@);+?{|H$C%5N{%hJV*-|OFz
zefo0k@3vM~9s5ZP9G{;htdL)IRZP5cljV8U>A$u#&s}=ye*t@Dg23Wq!Kc&?<fyK2
z+TwF{mW<$ebywB;K-0rgp?~_kr_Q><kX7oNb8qXW-(jVxk7b1Q`OYrQatxAKdT;&W
zEWxrH;n_3wmTn3=xn|M&X~OQ)rhMFebkU);*H)#eJXCEz8gDYQsPEDHuobT&lYS{3
z`(eBCsI*GzJe3EZr%7eSM#^iXbZR+xPO_c)(MnKXpx$VHO2C66^LKsuK`~~Zvo5DD
zjZbzEiZQt@qw!wvz>hw5lUWOY9N%bRQ6xC?-E{L0;i|$vZhm^^zKrM0r{7(#3z!c0
z|6cKNY37W!$flcnEgKcMr>ime-VW0#@SSyY)jqpvfrZ=o)E;Oot!#TDA93#RhUKes
ztzRxYETB7iUE!4v4%3%rRlju?l~XniKJi#5Zqk-V#ix@4_FTA`AACY0Ww(>rrkABD
z>%+It$(p*D%gi%CuFY9KN7qi&<g!3p>nydS%NBk)(dz0K9G4TjmT{&>xyAGQj!U-H
zeQ6i(39Gg_Y<9OGNy0<e%6={DUh_{?Q9EwB7I&?FE?4$e%Ajg_xm^BcU;cB^ig!;Q
zkMGzxdvmb7ZOi=H7e9EExtix@l^QfJbaP5hd3bp1PmdM3s#E9lt=aMKw%^s6kCKip
zcfKCEaHgi)hFd20JaWRGC|;0cc3}8rebJq}r^V~7Z|H?gEB?!8x|pt=GhL98uv%*C
zmJF_WdPYL*7Y;eRNf1=|k^Qe-c4KE34>Mn-gviACU9wj;|5~=Trn2l!MKgPxT<et5
z$D&bRHk*9B=p5P3Amo$g>2RT=uC1(?@768<M5VNZ{|}f|PpF=lrgUa9Q-{Q|4=en?
zeYJ^Mk<4ney~=dz!hO%K%!~GxFFNr?na^)>!;PcQnS~!5Y@giB$<}#2qwa$br;WRc
za`ls?Rwq+Kn0@AbYU*g}W4l;3?|?totbjM|GFh%_t`Qr)&0E<fT-aA~I;-H|Tagpj
z4saRVK7CtI=<hPa4Yz`SINlbRVdpWe@CW<Dsa~DOPaY^Yn8#%5Bs%x$f*D^Pulg`;
zZXo-U?3ihxyDy1vzQh;1qBg&LX|nf`G`AIRZ)^E1VTzu0s-Z0BNQu^ost}ROPZK)$
zQf_8+mo^&OWHx-cIQvNAk*_w)hu8HBzqt_IGQle%!qRQSIlEsHF-pI@>?1UlO)u{?
z`Wm|+xIpy4_PYf<R=aG4o~jucI#hEt96a*cJL3_*`ys8wvIf}?4-P~uOA}#}|I~7G
z>*i4J($EK26aV{IdEQnLxil+1eD)1x9)*JoK1^fQYk!w<GQqa3&t22#(4q+!nGVl(
zJ7{ULFsY!+Gc}}4&RXI0{e#J;S9ORT<2tzhgW$0pdsb<kUHN_ugH7VnzVnTbCMw-8
zW`8kZl0<RQFB4ClJrffbe0FJhZE9gH^1`J3)Y+H`l?QI^o#QF8Ak@@W;E;@I|3#Tc
zPfs0{Yh(AmA#{J2#hq84l`AE-Wrzz($Sh!3?b;ytD134I#s;^Ze`~8_lX>-RL-khu
zQClbw+kd1|)LUr&#%~Pu`YD}J9cvn9y3Vl`x|_<X?Q5bZ`Gjd-WHZl&B6*I59!3n@
zMH~_j3*#-;@k)q07_ZG@XOKA}m-cZ3qYZ<-(}RX(7y1KrdDI_inyBo2?hyZ2I_QP{
zB<~q+FSsUuI}tkV^2r2I<?nj03b#Dmv@>v4|Fer6GS5!j^vSvTZpZrAx0)(@6zyB>
zy#vZz4xB#0e0@^VFNY3+AJhD@yj?Q?<=ET&V9TzNIjj6*effkRQ)h8!=~uaT$G>b$
zu6nSe{6_rV!y8!ncG$EnxN>F7gDn<+vO;*L_sGTZZz+it?&lOZX#J~!Gi~OXuis?b
z7<btnyrE&F^I)Ecw+pjquMz+54Q`XOYP2-gFE^X0q0A#{9UZ<R*7!w=Zn(lL3!i2s
zA70+`7TGs~t@vJZGf6$0a^vT{{(yC7E-qs_V3Bu6dCH_OtJ^QUF8Pp{ae?LJ3B^<s
z-2&aTqe+5nimlTw*3Eqx_vVRknwHF_EmHhdmI<#X_D)+OA0oq5!uGQ7`P8fB%8NUS
zek@(`M$PC&<dg_kt!bQVK2O-iuv4;i$L)&`*yOkBzFzG+>EcB><vF()`0pR)lU7<Y
z<ym0Lay?O7%UhAh^l~Tp7#!O7&HjpKlh=wTi85*hCmytIQdB9<pTyK~Zpti|z0!-#
z%~PKK3gfx5Zhf06kMnYt1ya(J96!!EuXDoVmsNUz?yQGL_?{$H#s1_H2`ZJ{cumac
zMcIKs-4??ihfLqpw;Xhxq<ry#fqKt@h?j9)roU=9Yt5BdC$rc4#hi$jmECil(>8z4
z^PR;3ik;q<EM=B5haWzi;$`$XeMS8ayQZvW^+%?1rR*(XO$%m5?-J%b(=8IKaq(D0
ziup0S7k^S2>yksHst$zf*X^?ioGM*?$|!C1@%gEo9fjLsWfNxZF}T$EgYobqh2DnL
zX&agxHZ*Jb%?Q6Cclc_Lw}i0wiQ_IS49XgoS~0Xs9x6|)R57%vdc1koBc*4j_|jzi
zie5Zj?OnpZQNwNOv(5ZsJ2o|RXzci(v65}elr5S`B8R#3+C(FGwAmh4ZfG~%aNIJ?
z)+8{r<KU8tS-aH?_G?YE{&;ZH!GPX~ipTMGfp?Of&iwqjL(=qcgVpn+f+7*Fw-nO_
z;-crQeWLkZc=6|-!cD*aaK2ylzVA$!_2!o!{sh#N>+s!N;Qa4)`Zww7tEvw?VqBgt
z&!6x9I$Zwx&Nt6|*Jdcq4FAV;d+QSAO{e6g?r7|N*N~q1tI$X#Y(ca9jUtxlkfdEq
z^Y|`n?Qj(c-Pz8p_5A6^Pmd)&#2iz|6!$ze^I50G)EJw_OR<sPbnbgbF<GC=esOr_
zWc46fIopI^H&c6eFL;^}+SpRQg!SX)nLn7zgpS`e%${|_dg<Q_OETN`Ej|{|w|3)$
zfWF=Bhi(W>V0S;e#j@4(_Jm8ZId=~)T+HtGLZh<k$GyAF(f@8)o!=TPW$`>*J?QLl
z*{Mrox!pNG6&{j4eBE_QdzD~e%B-%%Csrmta}Shxb~f@(sNFWcmFAM$rrw>kChfBB
z%Lk9&{#<{s`YFqbChiBjCR#`=viP-0@@3<9dpp;df2>xsjs_MllgK&x@ms@}HCuE%
z4f+G8N4Hz^KS{BaOk84kdbRL8$35o^m-~Dw)GPb)@9kbC@9!ZmvX4(>U*|h-=94Sd
z2V`doCNtVwR@pnU=NM;jnPw~6-&A{_zDlv!>A(tS!+xfCR#_Rf&f6Y=iV<fPCM=pO
z(V$a$_@awV@rJJ#4K>2&GS69d-^J$arlhlH0$mTY%g7ymB>R863U9H=nrD;t=x%u1
ze%9z!>^2RK`9Z9UP78HcMRiP-+WcIG`T5$G3!5hJG_uOInJhaz;ZF8Vvw&CZ8aqux
z|4J(FufCsa7A`bvW7p)5v4YW0>Sgo|!gr|#Rqf`x*;-!7X8!2T(}lbH<*GP8T7=v0
z;$}R>c(;|SJ}YaV!2bO+%5qzMVmI8%?pz^mUL^DB;S8A>dtcNhg!*<Jd?UJh$9auT
zi@NrS{pEK5wo6_;Z(?qr*DrZ^c|u5h@d0L6b~TTkEZw_Q&vPx+(t9>%5x0u)^~7m`
z7H-^&cB$8K2JzHv+tTA7|2vbTZ&_F8%g@(J)`{dkl3<;(u6=2u*(!&r3h%Exj!?}{
zdC<Pru+#t9M}udM$~AL1<prA9_txZT+FZS8{Yk^Z{9IxXUt!>i_ASQKHf`)Vay;*-
z+R2YsB_Fihu~JwrQRcf;l8x)<1G$8pFVYq_V#Btt&U&x)rB!yf4y)GtLpd79+fKDS
zka=$7z3p1czfz$^S`Ygg<xRS@cv=$~vL<=)=^WC%H|4;&ghxdyj^&>&?%1co_OwfY
zAtP&@@+2z*fluCwA@XyC0%lb_2o@3kv9;s0f~WA7Sz)q|zb=-HDEq)+WIi>(dTP>B
z<K_j{cifge=;sS$@_9Bv#k6wO&)LrogqkOIGKfk!ud>M2iFzV7Pf&H<(WAvbqH~#d
zPdt-h(AzCg%riqzS9qb7Y>Qj!OzphJ^AF=pMZ~0cWNI+oc5P><@DGY?WH(TCtG;8X
z{b!5ChTERi+t+1m+kN`URke3hjeQn5&3$%KcTZp^w_Jcs>I$c>JAwKSQ@o9qEp*<}
zzU|7E^>R5Y<MyAJaeI}muHcfT)v_9K|DHUIi{}5{SXIA+<@bK^iEk@caUSf_t$CDu
z=!b{CT_tP(jRKw(tXp>NKHV7A^R<sfZi(Uwp|$(IA9^R*KjG#&^$&Wb`O)8=EV^*l
z`%_0ns&wddH}4BNoBw5mnFk7P+nYJz`;B`$wbm~7nJu{RZh4=Q#jjNj{kOjT-?`*t
zLIw}h*%djb3g2nI4_P|V;#8feUCfV2rU!SlY_kLpRU}@X_@SrVwDNZE4ad8;e$29!
zuH|#@I`>CTA^FHm`Q~oxr7Uv}i3)RjNQGwbB*bVeUbed6==7?OVy7C*9Ti;ljE!;%
zveh1X8y{F+;rI1-8=Lcv*HfjQb6j5(VEX^dgj-QL9+jI{fA+b+_K>ULN443<BliVM
z*#h1vn$56Ud`eQ_x=odoja-BoXP4Fw|IW_jiB)b+3E{8r)?bibcuDEl-0zdGmiLKm
zxOA8$f9m&Tms6*l`IBKKn(~OT{HT!-^B+Tz`F68e&q&lUNL|paUar@(hQq;=nQ8eH
zr^>l%(mvC3_ibJKRl>Bg(ev?zea-zrcVC&ft2r-cSZ6cY^04*6cDDbn=lQY?#F=Xz
z<o`M1D)`{EPu7oz=^H&4{yxf(p%DCF;oSY_>wC-Hk{H6<85XjAGd`uqK1D^g<@oRW
zZT}Tw_VK>IU;bt3hfQq_DvZy0)+{<$ubA4vl44Mn{PuvH55u9lMQjZR)I=mM-9K#M
znSEHZ{pyaa_>J|tVu2Iaik!?6SY6!^@OGY%@b9Zvxz?TBz1biv$N!DJXQ)8&qQ#qf
zr$v;W>puQiw*OdB){|2|IPR`|<+Rsig7_ve4dr*08D&qFZ?`=^<wipcLuSGa!IZ6!
zq8ZuUo+~(f@X5AX!G7fY#_%WIAB87G+KEkQ{Tf?bl36slZKuqGF7qWU?m|;cc2AKM
z%`L9Y`?+h&Y=f=_15Gi8)Hyj{r~0TeW-vIfKOi2XX!5L_!>;;o*bH^mMwhVL(_TIl
z6nmrF#ZkOc;h}Z}+ZA~sQO>g|6CC(wE3vNUS>a%&eWJ#(dZVGrf>Y}@7zne7KT1BZ
z^4!-T>1~>)-IsRHc)s}CmPkQwD}jS<*9xwO6z#AL6VaJ=;OLII9pMpLAxk9RS~1sH
zzW1@rQPIA9l)+8p)V`&RM#n#jmUOI065hgnA#VO&?m31}=LTtdNZwM*v6zt6ZZ8ym
zZn>jF=aWzC0#D{D6r5sT!Cl+%%R^gI&Ptk7qV2)uPtTk(nWgwTS_@*=@D^ykFkEMu
z(mwm{22bA3-zDn~^3GiH^yM76?@xQrxTZb)6&BcdUQze8<V3z-D$RmVeUI*0;5(_y
z)$?=YM5SczFC2lXCdLP^8XozRx+2DP(TeocsHt5QDGn-Oa~SKB7A6UbyM!M<;jP{1
zcJR2#g_Ei$A|2SyN6mT8{fxVmN2#aDyR)XJPT{c7)ZW6r8PC7yw6&>UpO9DOu3ci&
z=xSnmBRk;q(l=Z-8Lh95dYPRqTp19Mz#Jtr?Sspo@}P`6DasXFxnIl9ki4*?HBBq0
zbB%4^!4tC|&o;e!uTqqSscw1FJ1LPF8^Xo+zYsF=v)M4=X_Jo%M}dahjSb2s<=Fx?
z5$|@bTkjPU;5hxB(8T1-4foii>TP0$yX5EB*#7<X&?QFY(e_1LnkLGVwst;G3!bA<
z>f_EnyWp<HcH@xFqpDgHk_??vAFX{JGId3QR<y85Z|t%c26;OZ)-IVCd4vDhro<zw
z^mu-k3LmgybM^Z_nLT9Rjj-)(fyKu5*R(F={@NuVn4`eJb}s$HI_Vn{_WO_J8XQ!x
z%wpBFc97y{%+GJ)l-5p(Y8KoXf7{jb_Ntit|FSwZvVy|%Gu9O>TE1s<rNN&yr)Qa-
zd*zz=fGgt62eu_mCpngAmIxHz(Bh4$wtfHA_+seKbvs(Oe?FOT;k@-Ry}xdv4M(L}
zgc^Kw?R$?Tp49fW3v^}B^SamgC|$nL+~`!+mrYC7ZAkx>&HbWyE5{t+#n};wJcgZr
zX9-+ytPt{Bc_yI!#baA7<5O4s{f!%EF!e=j@2;FT@zl3udzDAJ!aYl5-)4Wf_`pba
zQ`zOyVZ0{dA%Q99LoTm6aB}sW>?<<bA5NuOoz1(xStUsB8&~I&JK6gd))mA`{?91&
zZ#k?g-?`pO{=oHnQ`YO%Ngp;?AF(-V;mp$~IajF7S+;uhuk4NYZ@;&EXA!#Q&kR-m
zb-k@|p}!tnEtiNBTX6Tv@2MZ_mGzj6gL>JY-{o_?@px_Sh0E#jl}`)T{$W)y^B0MU
z)HH8OXVd#I{rs{p#g~n{12?WZDE_C3{pyCOTPbPNt~T{a98`bzrC8K{gKhoCliz~A
z?{nJRZsnTxd=Fpf`qg*NaXjVJ$~KXEVf0vK->uE2r8^E>mpd?PZLe?r7v9^~@3g+;
z60d#tJpJ<9n1n!U4{aOGymhLxCQ05@nE${nLO%KSY{s+a0wSxgipYh>yNmhD&bHV2
z=sVYH`-{hV3BA6@TRv%TU3tJ`e#k%9%TWQxwtHTA_wwE1wUUZ|wojN+HEZ6Uy4nu~
zzdqlb-TgUSzwpC-*?Qxf-&f7<e><C<{n_2ae{bD&-V=Sw!|2Hlk*!=?tMns2{t3Q!
z%CeicW+!)EiD^o~hMNt`W`0gAFyvq~+0*p<`*-;j`t0m&i;lXuJrB&2$=J#kZT$5#
z-$~!Yd~*MG^2z1jJ^0xEs-x@YeSCc1Z4Xaw={)hmMb+-b#W~W>x%CsaS1Bs5o@$tp
zVbxmA%s*Minfrxkj63Ig^M_4`XEn9WRJGaJye#f$uJo#6qgiYW3&U!jK781js<G_O
zo;6G4D__3YaINob$eg6ft!6h<kI%9xm(;ObUC~nYzeE3o&aX|1i`n^<FR&Lso@gAn
z;n1UBS=kE~9cVbrc-V?@Pg)(jVcFV~mz0&&yVr`_b;|HecyFjs?7812d|pD!?VSfi
z{_|eQvW?qf`gdW-R&9*~5*jPRz9#alP7IAcIcX*5?wM*uynDBL-)-Eq(=jP9qqh4V
z@9rg5cXTh`oD_9zIcMUFIr<OcuE$6QFHJi&V}<@~^*e{O?j02J$TQlybH>w&+a4EA
zoz^Y9U171f<M024{Bj+oPa`D+LKzO<3Gwb(uef;q-$#$03)eo3?yE~I`#M8emNla7
zw1uaxuD{|98PQ$qxPnxTMUI8uW6zZhbKJl9oN<`Etc;!Ao&V1g-hVvY{P*zjWpl!g
zpSWWX`ASjQA=qTGoJ!D&XPv4mlFZIl>MdJbdZ;ubaoP7*3xn+z9qw9F_U6QeiEC9D
zqtE}@`AB@xg_)~9eE%E2dzBa4-~Kf#^dr5dc>VqF{4Q7DeV6)jsiNrcwVf#~lT@Gl
zl{P6BJYG`dx~=Qb%`KnWqwjj&Vu`k!8sT2F-Ht_xecA%M$XRm&%5)^XzV9q3_u7BG
zJ%9IN50|$YVajqV9VH)2UJZPwR$&|$HS0oba+9cB#%BNKuE{GS`Af|+)_;5b;LZlO
zu(MY~<gM183(XGHKX&fdi?WcpMsr%TZM+#=Z07f^)z-SY(>_ddw%vv1Rpz`myzlH~
z+tqaL*#WEjA~mUVdWx!LEWcU*3XQ2rQG9p)#zEP`9Ft5WpSc)pTOXw4Ec}1BanR%n
z-%Y&ItLJ$MN%hB>%Gbtg|8FQ<s^{Eaa&g;ojeD6BbngbWAFe9p+Pa$i@qd=Q(D}Sa
zcFf}N=P@r}YW2VVW6Pqrnv8u~3gN##-tscy*L@$?zi08bN*}BJj~~z2oH}XIt{>~H
zk{%l_GjP|<SCe}g&Tal>)#BB^-%Y-i-F%UKpZ26&WyUivwde0&Rcz#Ry)@R1JtA<y
z6t)Y~H_xp7-0aC{Q+7h|)6>_7W}7q_gr`n5ko3FpVXswrVCbEoqen!=PQ3n|m+0rS
zVa3{`A#RsbzRm6vW?%hjPDSaoSMke_MSTd62zdT=se|^>PV?J>A>|wY>g2aCUwwJi
z?!2R%JpTL}nbuvKT6=Au6-U)Oj_^>St!gvgt$DC7z&7Nsb%~2M?}}+jvy{Zm&X}Gy
ze$p0dsvy@E^f!n9-)>p|E~}*Fx8+PuT#M56EL8lw`ev@)=I?Bh>{k;Kwq7XLdGFG-
ztZ427!CQXUmpFDVdm46WfmGeoX_CoV8BZFsgM4k)-pq8|J<CMT<7o7>?~9)KrI&9D
z@9_P&hqKvQqOLsQrqBjW%MGp*Piy9Viubm0t?zQ&z0yvrd1Vw=(bbGwHIDx7e5ZbH
zoVn}%fwi}{x!rAiE0xFEd;jLy{yq5}s#67K>n+VS7vFi2^Y1;U72n)?_P*~sdhp+q
z4f`A`!fkk&F8tN<aWcz$YjCQ*H-65))i$5?4(~lZqifOLD;%5H-uH$)&y?%b?t1Dl
zyZJk_Z2U}hM>EEQ#{9Ki>lPGlS?(uw^YF5grBzQg_m&vSDkoL%u>bxzW$OCHcRz*3
zcv^+EvmFvRcI<TJu@I%Wy&v@3p8YY)EjL>!`}^?QjrM=$AKCY4xA>m-jd9|UMpr!c
zOGa-DNqucvF0w_3qvvHp>y)+J|AVgYy6C(+FPg!1`77IJx6bgSyPdi#IwiqyUH^f%
z!nzFn{HJY%&L5UkTk5cNMgHXL`RD2^s*U&l`1o@6=HOSAr{?|N(xWM*|3h-6#?noK
zqD*|J&#lzHE3$QEdZ6>ggQwV&rYqYji67FFd0p6HQf@h+LNZ3(wQSNZpKbeZC}fqa
zw=(;+CVI_{MR~jaT9%ZDvNU`)6sdbq<!f|H^<9x6)1%jKtTeP;4dvFxMYeF(3ahkQ
zpK6X2?($snBWtn2|7(8^X0F>ieZAlLx{6=lem?#D`MtM+i-zrqm31q`G*Yv!aomtQ
zdbjP$vR@w`N7s0>y|24fUD%bF`{#7M-t&9uTq{?o`K7e=omih7GUehHjzX6IesM8=
z4NGUs<z%PaVBOU%B`R*|aq(r#hCg@p&i#2lt$X6}+>&GBRd-c#`z@xK-(l71Rhp;o
zwrQ>Xj(a`(rue>Q`Lq2|Xla{AseAhB6Sj)i(w0pV&g-a5es_QOz27I~+tsqOf2nGA
zT0c3U{>iFy-N7?DyRFMqwLZA8$Zeh59$v7(e9ay{gZk&s_sv{%z})-O;?zE-%THw8
zyrl!qR6hUEydb!RzmZ=jL*#&_aJH0C`gM<*=?DH_;}Ofu?%a8LXXDMsBDQj6frrwz
z{#QR^u)v7bbW3T)c8Pzn@ylMk%e~PgoR{>ke?f3r$nloXOQy|vAS?Ik>Y7|>*|`;L
zjsh#EyWV;g^0ZDgqx6CQ>({EU{ic6YpSIvix8zPC{dzll+xlJYvhQ-cG;Uefe0Z|q
z*nKg*dq2KBdGh4vmp4x@zn?$fcYa*VoV`13>c4(^^y7fe*Uaq_ua5*JD>6MS^IdGe
z`^wb5M~BjX^mJ_7;bMH|O8n<cDOFR;vz#&4H=LSeu|6&>JoH-U`MAwiea*&SmaVFi
zTyt-wO$l%8>$dvaKMG@yT))BV(ZjbfX`f^N>8+Y2CXo$yy0^sU?`59q{Nt@iSoG@t
z+|uvzi>=Bm_I&@(fVy(m&uY`bY!(KFa2^H*Ih-qZD@!u+^YjWT_lDigyKN@2?|SeY
zHSsMMBTfjtNn#6HP`p|9MSMf$i#7#;jF%^#IZbBrym__D?m}F$|2Ai@O?8t@-s(N$
zKCH&S|MT~`{Wfj!>*N30RVxRDh^2>1YN;1Brt#@>&&w+)6PxdLe8UCT)FV}oAI#tX
z@XePuyCrLD`NK~wT;dy?ad_?pty8`CoF+Y4s?Dp$*`b?j`M@hvTqj3FR#tXzOk{e+
zD{+PEY+_SyU+_P9b=Q;ZmXLgI#fvv)^ekTCSQx5!MQTTDYDjh0<7>@&SzppByTi0K
z!`^;ddW&=M)oGu0|Cy0wVAm*Hxj??N{5Y>!JO8=chr81nnNB83>i^%d&qr*3j9y&)
z-rtpSjI~nheFfg`+`ja&cIWzyhu+lQs8S8uzJ}|K{2{$9?2Fz;uk%veeC?V0|MZh*
zrD8=~S3bFBmYQ>T?iTxHpEV8y=+1W9Ze3dW_uj%U;s-7z967Y>#4qhc&BHPxNom5b
zt7oYNt*|ai4}2CpV{gOMYn#?}|Cc$;&hl#8rhBR!Pfc|E4rJX>PHB0?BvrViN$O?6
z6@`l)2mNEB-qZvi<D6a{ceCZv_PO^{|F}hzJ73u~x8E@DM$WY2*Dt(1%B)>(FE+eY
zBYmsAAgyPKcleZb&Q^_8t{-*JHE!6)7Pa}`#*OSsm%{#twq-t8zF)7f{S#;X@wZn}
zrPjVb)b_rBftj)G#hWbgyyk#aJiTi&_^KV=9ywr^!Lo4L>$7{0xOJvPC^W9z;&p9>
zn`&|64aMdU_Ub>>KP|i|bGEpld-hS`1bscf$D8FJeJ(b8+sEtuf11><k~?;@j!di6
zvn#7vnDNeZ^2EaYES>N}p`0(Xs;)oTb^V#%$(GEZx19%NBK+ASK791kelur@75C>T
z38_^lFS0GYA{UV69$dEJ7WekXfX*x0RntuF&ie6~xqnFwoAJ9JSF&>q*9cDC-tl@%
z)BSYu0;???mBoo49k<SXvgYCKM&0>NAxhP0cFt1kI?DLD7GH16*PYGR9Y5ht&CwZb
zXB9n!L|S;IP6b<}DT;ILzY_m`U&#!C>Woh^hUy=mdjB|;6`8-o*ZXp_Am@UmWnYyn
zcZSbUw{yJ3Z&P7o*!sIsIqSdg@re4VTtPPqGnz9vl%BQD-`kn7>h@~3xA(3~@4CFJ
zY4h>*rq?PLB~NSGoa$(P*yNq^*E#nRpZ41DYJAJ}_H|yy`PMhWc#li7-3Q*cKd(q1
z`C;DOwr<PRb%$s2eByl(UDxi*&?$bEQ_-hAHtD*lt@Lz<>mh5Ma#G6eqCCuJ-ShwU
zsBP}Vg3I6DZcn)px97ii*Zae3nYcgXuX}#}Aoon!=hN+G#lQOO-JLWc(OE|Ri}RUG
z<9FOOtKY5p-jV3o<+jNEd`ppQ)Ccuti3eUi*_pHR{nrm46F<uBH_**pJp0>^3BT{&
zER0M#en22jy2^gty8JIJ&Q&uxwMF*!gmg_leD`sCl|Z<4ljZE%tTlF<<3eq9=XJa}
zFz3I>EPLCoZk2sy)q&-eE2RIfcxgCQY||FoOJ*h?!Y=MdEvC%XXC|+dV_^8$&cGmv
ztC&gwpDX*f`1X#C`+u)@c>6M7mxs@rCzn=R?aDk?6tv%}Q0?5;TZOh-u1-SwA}f#c
zpSJ4%|9$&z29E}ouMbt;W>?Rf-R;8EeKcwR#)iHdSASoO|1G}o{NtYQ=b7c6KQwvr
zvSDvj)xSC4{qLl+yT37sTz9#^?EKA>n;%d9cXIP&;ctcKZbr{jHRS%G+dt_klhx)q
z)!og_nX`0mRM_Z#QhNH>kX!t;%GsIX$35RYO%zIJXa5vAX{WdT{MG9<!{={G+T<fV
zKYeD^r1jGiZIa`T*_~3132%&3Pz$sOJioU@tTl37+<dj}REdvYLak1ROxEbJ|7a5I
zYZtS(p4WHXwZeCISDJCH$+}{h@S$Anep{x{<CgR9YW5wG{CY!|p_xBf{@ACWd&!Ar
zajk_D)@*8C$2240anS|uU%%4#g$aLBT{P2jk$mg?9~KWLCz-XaOtr0Am6lp#J-7J(
z<=ZL`_7+`ntq?yp)4H3R^{a2pigRmoA1I$oWekq0%;Z_Jd|~3#Wp5V${+R#%{ITWr
zR@Q$%|J-fP?Bu`@bocbkjQ4ju1>G96J~G$+<S?kbm%RA;9p^m5S?o0@lM}q`pQt*z
zy}B8dfAVp(edqFrKBm>&Z={d?v6-i~wJhsph<C2(*J+b%U*#A@9lxjaMgPUhd;895
z2{m4>WV%$Eu;zO7lCS)6$8K(@DLb&Zhd*kz>g4%5=gZ5mJYKm#c<oUJu_TdSKTD@A
zw|#8<=lwIbUw4IF(x3f4*Kjib%aV@6HqRsZ`se=J^5@#>D1q&r*B>qZ=J#n=#p-<-
z?^$_|InD^0{J-$U)#i+cE*IZ2&D);1S#sur{erU>>^HYMsC2_+j_!*br?m1AJ~=+V
zMF->;*G07KpD<~Q-bdDqt*>vr(o@zy!ni*FNzc5O@oB%NC;xf$MZaJ6>k}6{%fhM#
z{{Fq5M}8|77<t*){=Te!ZhEbL*RRPc44yi>?WV`he}CU}a%}xUb%XMV=K5QAq=VH%
zIP>q#nEf_(86(r3^!T#73?Gb-&tR~bX}NpdgAj#oqqmdSW=5|2R+d#YbI$!n`O3&+
zZru-<)=XG9*NQjxsw_urc}0cC`57;4e1puYteM0W62un=hnqC{=kR^IlU%rQ#)m1Y
z!C9@>`WQvILrz8ZS3Uh~F!?~k`~xe5eB^m#8&5rp>$-Qa<+=8`<cxFTFSK;__$OE!
zeaVk$ogrcKAoxRIL-^;9J0^e3xRrdOb-}sEGCF4>xb*dw7+j8X;l3d|<r2@d3)fh6
z?5n3A*^}iVaY*2u#O=dV4o=fw?qHG7c3m#x-=@@5wk!7qUq4n^z<efI^x3~Tt%dW{
z93K{MSZc^D|MvTRqt+vS$=7P8_T`G%mi_oUAz}A<zTHh}xy$7Li_PTk%C&xPFEb@J
zgY&?j{^Cze3pU%Ub8L}|z4kxuy)A?GYKiB6?#@4N*K@z#qPq59IK!(i`fYw&*KlZS
zeoCDfexb_8hVk=R_6&LH2i{wP_{7ZIBt4cnx7%K<x;LYl<N1U6#$gh_0|g6eMZV18
zw6mOj)9UokqyuW6LR<McygTmRDBxI>P&BLJ9N%4M?yBc4vSt@QIQ`QsvSU+YYAH^T
zDX1)tIP5vi<&mr1`VCWikG+`1U-G4jP0sqyMCHz~67I@C_m+dQ7uZ!>n`b>-IsJ2A
zr}y<G%o8;B$l2_7l)89?o%hR`f7cCIK5cvP)rHkGZ_X0#KNkY|>--$jr|n=4yMCVC
z{O-EcFXBaCy8j)uJG}o!@egs`!}Y7%<lmY9+g{!GKlk(x{ii?dUHASKsMx8_q|e!C
zwSV>lU&|v29^!{M4&R@<v_{m*bZ6X06W>d`S?Af7@*VMa$gVctCol2hDi=rSZMzFu
z1=BRAKm09mXwlcYin*p6mCPRtF8E`mk;!sA(r|8Dxu^`og%|G^Tr8FPoBD@yn)bSv
zHHpWUc(uK^xFmLsp>BIr=H%yBTbB8~<l%Y$l!4#iXzpskU%MyxJ`{4g@+RzMx8L<X
zpW=uD?fdiRU-QhfIIb4YIJIZG^$8(`n{N)+8SDJblwQ|#BrJUK?wJ)IBieEVZZD79
zb*-@7{6k5(wtoc2{DWH^*FGrK7HQe#6<Gf=`SXvm1<&=WOlRL%e8lDJ*1LzamYIGs
z{G;b@o4Ajcf5)@43ukLD|GP25EvCMI-F?yX>(#S4=I6_uO_Sy5Ur>AR;@2;N)t}$F
zi?M!C>pbxJ{0rk_oPi<+{7O<CtQtK6Z>5q~hjQHEc{YD>vh90|zy~F-@0qJvh2N7>
z;?j37kM9xsk)Wa=wy-p@@=)5o{<?YrzvVVdLtfnJzRC4V%~j+|0vo4^&(8Vo*$P|P
z_4am^MZ`OZDDtOoj|(Yi@$awJdG_GT;p?318_zV97WME5O<ONCL*>?n81BUf^jUT+
zn7&+&jn5)ciZN$T_JJV1nw=9ioSU`gas2Y6<MR&iNa{*IKWXul+dwh)#bi<Md1bru
znj6=y;rO#=W5LnAwkPK=o8C|t+oc!Fy6vUPfhcR+_9)Z%OFoG%4ko3Y6|xz3nj1d$
z?c?p={msr`%4^+=93^|+`gYtrQ}C2?w#jeP$9B?Nwq#G8!29|_L2g;})VHf0&;Ivd
zw5;&@tg@mh>w-+77~^Nb1Q#{GN0Bile>j?dT2(j7vAP;u2;TM}bm2^nX5A{$CBeN%
zUDicCE}zhn`Q)t8qfgxzUk3Z=&dAJUJk0K>dtlk}1ze8~TwUnw&zS6ZTfX@HwB{Fu
z5^5X{9ctOz{+PTzeZ^Sn@tWnO?uu<6qy!l@dOr}Jk>gXO;O2TPSe?1WU`GF{K<4^x
z2Dyz_=O}wz(JL0H>gUW2(-gcE`X`T5ifw|&3d22D98%_7P+ApeG$%;y&4&6yj`teM
zA={R16}V8~Ds9PK<)1R?qWspKW)i0at9pa{zpU)v`yzYVf}@N3r}UpV?8(8jLvH%Z
z;F{niD?*Q-os#7$5yE9rCb4;$(}l>VpSZ55em|V~BKwaK>&cV8p)*pfHJp1Q%%V4O
ziF{#GEa2sIWDJyjxLWg(&7}kEaa_FHo#f3AsNakgHn9qt8C%RHS8|ZkVXbnMX{p$z
zJPGkX3#MKOQgfG@8YptdO74iE#CzS(m8bR|5c)W^*>ty*+8+DX{C~^sT;wecawc8V
z{S|k>&2Rb=iIk2jYYr4WF*ul2m7F6hu)c4Z-}Y?DuN|$MCAKz*yWV&s?XESQuTtwn
z%Ab$^^5^1ukA<&~n{VmcB;PoTNz_>?*LRlcQ;+md98E{mg{s@$yt7U2*pVx8IehD~
z+??#L`Wrq)s(*@ml^Lghw%)Qic0<$g=Gmt{n5lPPlBv`<!!_Zqombpcu}Maa3^tz<
zqB3{9DKY=B_TL1SwL6zsl*zA|74BmB<Jp#dN&lW6x3h?~VSR29HU0dg8_)mFX}0HQ
zIsN2uXYzBdh_gMHizbDAQo7vX`FZJycZVH(^Z$9gcD_>*;l8(Dvq(;6(dVDMA3mFl
zNeEn5dtq!OIgP_VxJPDz^8{o0JGW+TkQLg-dhU0nk>{r6i}_gtsuUSI-q=K3Fkm!K
zGCl6|W#JOlTXW{zxYZ@XtNi@_6XVH@QdxQHMcY$171ysT+^@j9$obQ5R>h+e=XXbF
zeA<2cLh#!ef83Y#Y8GcdwdIH^5W95vq|k?F2`7zWzF#_NsheJ_WpXX|MPx(hzJTJX
zeK&TW?oV&#vJYAPw>YW#%DUs{=lz}b@xQK9M}@|mvqFtBf4&z_yt(5{^9?Q5vlALV
zyS-wXSu`<a=O*iY(?721JjM2kFZapTwJ&!@U4DI^Kkr-NbLj?=Iq!1{zCGkGIKNjj
zL&>^5<w5epwi&ZlPDpEPE10PHjwiX|CF|~sKD|FUR>{iOD{hjt|LwCYcFPRw1t&aS
z#=P{>Ry<*`tiK~+=BGK0|HWS13O@Bm^WvuF^RhFHHWVlcYs7Y^M7X<eoD#h`;c2bh
zy`noBu`T5mUQ6HX<&a%w%Jyx_j2ykY6Fa{C7GK&k<ug|h!|X{KT?z~HZsivBOj&tM
zJ!(;2cyoe@>BcpW1e0r}StHx4n6iH8vw6t5DR8c8=bp{qQeVqf$lu2@>6|NPpIApJ
z1JeSLkG%p3F0WQJ8G60w*dr+D_$zG(tMVj^6+*1)9}aMByKi#n0I$e9nOTN2XC+E*
zELB+KwaPW*%AML7_LmI&-@kjuH@js`8)IJ8))=PL3&xJ~?$)*}54ZnU@OAs@{`7qI
z<<sA<)6+i}!EX6VU2wO@rpO0dKLkuUqwr5@laKJmrTlWz>hskfSYG6mNqs0gQ7c{6
z#6RcZ+Coh+McwJSObU}dxfpGmCYi7%9k6=D=A_9MR;YF;`%m$P$y$3dLK~CjJN`Ow
zp546qh0WsECm$T^^3t`~?rb&bj8Ar?s)Xy4SVPsl4jUQn_uN||V|z(vip!R5=@a@5
zI5#r<_Hnz@eL!kKMw!#}-BWUoC{38Tu<^w1E1h}g7rlLO?cx1xPg?$^^GB#Es%}l)
z6L>oP#>rbUzms<f?mB5Az{+T;lmG9=F(3D(-Yr+IdHk>x$yt7C;yNzIz%#+=84u_6
zovZutu{WaJtJ(R+Jdw?6Qrqrycr57tBX{)j6iy+Yn@f&fzFX7ne)ip3_D2&$B`Okc
zyqPZ5XjJ)R)}uELvig@(PF~Jf`)K2~2$xrEUskgGTBjbi^V^gr$KQJbmQ~&nT=HVm
z`<t7Mm=n{LtY@fohA1d0ZvU3G{DwGZj)(u1ugiTlON1yra(wb;oBKJNymfII>*hT1
zDSo)`(3u>sJBJp1E!mT?NpbeQSy~|{zvyay(&aoO8|+ZMtlm!f>t^p;?5;<Q3*R;G
zzbyWH`PyYaI_7rY%29om@pz5y>oXs|{CWGk`?EZo(&m!dKQbTJFQ5MAA?wtmH#gi`
zu{T8D(}AZb=EH=7=ga0DWVUl?E-3sseY<jKU*_bg6MYu{P-P4Vns7&a@nzwKr%xVS
zTGPm}LQ`V{>tq`x{TU4>jd{aTBhEcGU-Df2pVIaxWouRH%Pp;{|Gqlj-S1Ixv-Ee}
z?5(fY&hK)Wa(U~_#_JDd&rh-LbZU29SmMK+xxweK#r&|+O($m6@3g8c`?K3u*lb3^
zL`Jqs>1eYH*C#$VJ|Ew|*@k2C#<rOkI(c(9xlX@f&bDu!(!ms_9Uqc!-M@L@Us&z#
z$5Xm2_N@LUY5OHqe)su~)+OhzDfK<$>)v-%b6b+LY}xiWhb4X=S7=T0vAG?#Q!>O>
zdWn9bgvq+E2K@ao-BLXdo<+%}@7S67A^7i|i(94GSHCfN5#?$+HG8R>p-$c2uS${A
zoOYl3S+&zSaY{jv{bGeqtMJy7NvF7+9abv;zq;YowXW$dJy%xjDco{Nx**79iE{dk
zvyN8BQzHYaU-o`D60&~D8jJfkJad><^#&vr237^j{mERu@|J3dE5ldLOWXF(=(g*f
zcckRI(cL1Wy;l3&1o`u_7u<JuXa2M2fUU@#`5H!X@3OjGRNq!Kiq~ylwuIsB!fMN-
zQ>AP&M4PTgWu`J*y)*f(R8Df{gy`_ZTXn^!?N;d+C?4Gr-Pw7d$hooeX2SGOLaN+X
zE`A9!JNNx*_h0p#@9$?vY*Y2#=6~+h<opv0XM9;xp10Unc1~8hmbI43kuz5%PP-ql
z_?+;3SEOp^Ev_2}D$_cX_LiKB6D&BQm;Au!|EI3CJCu_ZzvQ~;`N}#?RlJxPDdM~+
zthuGBU17=f^}m8Vy0&IW=st+!m3Ut9O=R^0yQ4EsMK7#)=E*B{Vw;vt^o}=o4jNlU
zZe+OAGK1ao%@Y<!nfDJf-?c7q3Ah2846W~aTEQ@BQ`3B>GfB<tY}viVYs*qa@2}Dg
zoe{_z7W!BD!h$(%H=P%SZPn5KG3#paif|kAr>9SR-uWS~fc?k%efA;;r=Dp(=`^+N
zrclhXbFnYmr(6FL-}%bupru&V?8h&*I5s)Qc}$m-`IS_elzAz)FSt+fVfeSrHoMyD
z`6_H;WJFgd$-Gr*cRsH5b^9e=v)ebMS<_bUx#rQvoHpA^<>HDKmGiQSv&HW5_&ZuQ
zhTV>}<~sJi;`0<PV;vK{M-_^5PBvEFyPl-c`u=6cx#i7vtJd><s7ZdQoN{i({?Z=i
z6Md@=ZY`N7_MmdRY*O}nHm{@plXZmet?*i&#pU*sPxasiyYNY?mrQV!xhwzdWx%Yj
zW${kOYgW|1oO*-zYP*-|q_`z5FDAT*(#?H#G{W!M<C7IT_v|QKGu12m_@V4|vYG{-
z4dSPXtUQ0x@X+L&zb*=~in;jnykd(wqt)M;`%>aU;^S4*Z^%X`d2NuAxV2X1$Zdb7
zfHLRh4FX@S&n!w^z$|^7{l&!HUWa9_OniJtEs>#0h?jkLI{yck&!?_La@Px95aqh$
zc2e}%pM^z>z9#42y0dGQulHWtJ^QXLD_U&b@;un>^eyp-39%6m-|@eS<9Kv3f%B44
z)cJWgE=}~<9H9L`J9lZyRHNQiYqxc)>m_784(-x&irT)UG|5IX>~g-G*Toe(zMMQ8
zRvxkAeI{%60|k>PR_CqXV%Kio{pmoo$s0Qxk!OtO_axapjXdl6(P_imZM!wC{6fE<
zs++B7I+3R<t>KZ*SFxF|H{9>K8R*dPb8SUh$ldhH2?-s71xH0Us3be@*-@wTFzRvF
zY_Atv8YE&na&$gz|74Q-)O;aRR?GdXe5a>dUHrV>R%UVglOW65s7{ZidxV{*COtoC
z;r(}Qy000l<tsDho$*&^32Efp8az@?k(ND_Y-!-J<IW+iX^-;6*Vu+l;GgNTYO1p7
z6qb!8Ew5h(R{ghnCKcXo(q`dilJfWQt!~|xNjoQ7O+B?QzQ<+9M0qY@y#<>$>{*}A
ze$zJT{azE{t;>7gJuRHfv9(m~qPV;C)-qLtlK7Wzb}rht#Obq4uAAini8~J%?l$}i
zysh?E(c)c(f7P0>EJdzGyc<;bo=j|xVSC79`uyHuhP=58qUBGEg=NW@mcBdPS|@Rj
zoqw0&(c6q$4EN_}y(x1DwP#*pwLL#E>}wYH?p42jvK`L)yPxayv~p#eX_>kVQaP({
z<)qw+o?93im1X??-nNf<wT=_k_M|@$%zt)2y0<>x{NsB*XGQ+|c1`VDx3WLmy|#Fx
z<tH<{b&QvP&uTb5yI|YLHD&33&AGlB@z>-y+d{;xIt%O%#%{jLdqwbfh2<`p6TQa+
zIehxv=G?k?^OIkAip+tNOG~(9FD=eGV{%Y?e#(}Gj6T9X8;&~Obc$K!+V7e=dAa4m
zM@%dW{EU7^KL6d7$9rvlg=G8lig|HmBJc7h9=h&Vyj?6>F=KJ5#BYw<$4*SvI1#MZ
zZs7l{dtx=qsj%x`yOhMc9F_-86p<{RcSx!t>EI3zhLcw7Ec-9IISOCj_*9cKH)-Jv
z$AFerwp{CyKY5xP)&|^HW{vzRb~$@lN$~z&g;}?+Pi~l1V)*p@l#ce_T)&!A|Cbcs
z&)Ua7?XKINwP!!1{_o|l(#~CwyyhGCmc!?tTl#;TwfY%jhO+PV4(l^2ajbFNtp-A|
zB7t&!r;jA_^6Ls-z0+*umzezI%Hkg@p9<`nlXtDq$>z`Z_Wj4F`0fa0-(Pqlk@ui&
z-m8mOL`B6LJi|g4F)^sle>&67rmy{jlg>|_56@g|xocaVw%nZaD&KXc#>rg_i~Bxy
z26O%R^Y&`IA7h!&&*BGy-bM+<U&78y-q1-e6=n`=aH*+?Up7zfmr$Pk<r#gEZzA9B
z=+F^0_;j~i|G0j9gqG5(8HJ4R^K<6(y`MKfXa8@;$=kKwf4Dh&lk~9_r+<q}C#+GA
z*7~L+y!91h*NJ{ZkF38!O~D27o*C<3m#5sDaXt8}$DHi%QaLww-&~fRaMo1h^_geh
zSFA#%yLnf|9a<s9`s#9_zyAGw_WLce@2v>_IXkr6=Y-iiyP(U#>Gr03%yw<Giimk2
zw&K#28w<={*%rLLtQ7W!<umit<?C*ieB5;H^p`Fh&EvZ?^B?`bdgF+U`~FQ=$_m?p
z@5aBnbHg#guXkDUm%Mv#GvB{l-?S~q-ms*S;ojeXBk~n&V#}knn=fj8+s1LfO*BNB
zWk=bLEZ)PHj8|L<7JjGs$8`4O*8Lw+v?3X<x`&1)UW>WWWi%^V%S=zfXw&gePOtq=
zEtWWF@JKQCRnn~j=h-*jOPX8@IQ=J4t^Sq8RQ)x2QRfOD+j9t;C2VmPI9ji9`wq8~
zeMlx-?du2kBqGY*mAt#^WLpxuvEeS)BWG4`ceSUgr+-#_E-`TXc5=2~=P|di{M-AO
zod0$&oMXu3pdRt5BH^pn@8f%KZDe}Uxwq`ZiRn_O<vQj~N_UPB+4!WqEz--3Gg&`&
zx1aL?gEPku8p_5$5pWRt=d#tSXphF6ixKfY6%ny@X0co;um7(0nBZ~Y)EiCVe(^Sa
zCDz}Dn{GvDMNaq;nf_$GitV!oF~&t~Gj15DdK~vQs}!*c=9RZOI8E<RggUcF*-;L?
z-CjWs{eN{epFDg$wS9$p$)A?W2gc`hF8M!rW7MzsWKMPC9hcV|f2Mo?N%mP5ynW`m
zb#9x_ZRr29KxB!5bIUQ8Wl^@y*<1d!)+i=rEsT}oa?YAr9W}Sze#?n{suA0(f_FzB
z2@AcD%-vv<!>wMWrrLgN`?^)~Rl?$-oD;t>Gw;><xlpfNtetJLPXD#0=kB4&fp1<u
z&2dwo$6aU^yLbIm=2y$FzAk6V)|jz(g{hpa@b^dmqnNH7D30a~*cr2KZp!S_4F$)f
zElaOkEj%8^^>R+&>;r$Duln4x4vPKJb*}mHf6gy5SFinLQJPXD|Nj2PO$I6(tEN{!
z_Nw|VfA`friTvb#;b?xHwTwqRlr3hv*X-MBf41->v%rN5_nCT`?_U2Yll+nK^&8gd
zwl^Og&#rfg+3C)#=u|42f4YBa$?jXZkFQ7;e@G5JvTC~Vqxhf2I&)p7WT@@1Oo&T4
zHixrEL{-y*&thulih9QVv2}~1rm3Fk*>^9=G)Y%n(V?Td%ysos9YOh|ofG5SXXmvo
zO+22}y{fX?daDlWfuD6h4*lJ`_`R#-{^gq<X)c%cvAk7(X2B)VQYU8rOHYK`cPzgn
z5M5c}cx&#C!hdI9YW|*E{l|s*uHf^N;&Xg${!fmO54-xuT)nx~;`bTWW5rqOnOBS?
zBHe4Y-F`Vq?9i;d`E@~uWY)`Mo@U(?|MAoVE7`Z!O1F4&W=ye|ayWnPh4h%l+*QZ3
zU+sLk>%sY(4wIat>gPY+#rbyslepi)rR!~Dla|}wcs=jyWZU<V_BVge`+8h%&4xQ$
z_dHB!HC*z?l3hQl@^#L9XPH?YkqKMm@85`V&Y0tQaUN&3*1F=u*-xjH+>YA2L7;#C
z?B^er+}FFai?_O?Z0h2w?QdLtgXIbh)_vpEEWEP%fOX6ZrbXKqe`5D`S<xcCwIfJ=
z4;w?xmC|K;8m$g2zvf?-tJg_*kof$Ql(^tCZi59^0|Yj(b?BL1YO!(F_*y;n!=ahc
zog#8-niI8r&u7W~`m8nUJYV0b>R`sEHOwbZ-Jg5WZ_C39`;(jaZnE~|o;$6zROXN3
zix<_cb6y`>9A7TDRD(k{U&Xb22J?y~T1Ny^x3cfJbl{AF)PjdO_75)^TAS3La$B?g
zqtBZB2>CTLBPOrz=6^XeYyKz6<KEdp@4C3XtX4L^uD$)U`ooj=>wd*we|fd-#Wi;|
zk6y;!?eBPaK5bIwzw}b$<ccd6V)r-xZJVfSCwfrvug}f(7ZaKNvr8i4&s?)z@qdQK
zrDNV-XWnQj+R=ZaEPGwCZB1rpgcM_&<i-;VjtCXhC|=){<2A2!L+iJyxvxL9KVEVE
zTT$EbAM;9<@`bh>6X?7Aeu-_l+^r9hts;xqw0R|Oy_+_5x--}H+t&3f;~%eRXv*}h
zF-ofSx#H@~qrbn5vu)a^ki3?sTWVTc-YT_C`?XZ|_%_EWqHL!+UtR4pDBmBX@$qQ(
z#Scm|=RTe!b?2^ikpJtwk`IcetkcrXo$}SI*y+up*_+<_ScP6!;(vd1KYuCP-|a=~
z-j=KX?~Z-*&rLj9aa!8xjTZc__Ng&~H-EGy?{#^vzU%*_zl-nOS=I5Kf7hLrB|#sb
z`#g~ooqJKNeb4i%%1tZWrX7=dlioik@=M<H3gh)P54rqpo|f2EAKYt^{V(j)#2<TE
z->javp=Eic*DIm0&^wQ=ai*NPyHv@sFx#tCTUPADwOe~FZLik<`!umm<=?(H>+@2W
z&;S46+ZKDrne+Mn1IHI1bAEg$u)BE5Q%2bncTMkZUVP1dlD&>}{izw|p9>yO=$)}g
z%x8|`GGXS3;|Di=O=7a?T*<U2dQW(>i}~cou2Lmcq4y^83s|b|<?Pw@A?}`!#j3oR
z>_6X*?h`$zbo=us)>y`E!L1*aK2LsGVtwYh`l6+*MQc;n9&KAH(k5L0Ea$oCRQtwb
zM|umB4hWlj&#Ap$Q~oH+S?bAOomXZJQeW0KZj+VEWH7J}yQI2TxGTzQzUv>JHip3U
z%kJ&&l5ctbv(qbQZ%yOLmDBZqO*YVf{p;xg6~6QSFG8Pxdi#3azhbZTldn9l`f0ai
zYQh)k*^U_obH&peI3;R$8`Swe1#esTXQ657<kD|1vi_f6eY}3lmBhdMa=!jwcj*81
z7w@&*>#xP{xv%=`_TJ>JbDthfeeooD<1LA%7TxbU9Yxpc?{oMCw_IxR_{*_w!oLsk
z(wAzdcC0gfX8FS&b$*-UM)0F=W(*9wWf&RcaL#Y1mZT<^fF`+XbIWgUoAlxPAFi0+
zmhC}G+J3XrcJDiW`|&ByS9{AI30r6GUKhU9^F*4@#HdM|*3N$Y|KAy&IF1PmTy7T4
z`WE(FWtv9<1J5(w=7R}yWo6&}+p|%g)#l{SV{s=YD@nQ9+)lC<w%_qU`uy+N{nu_P
z%ssQ|#h*n9=gsHa-mlpA^N*$Vz6Wm_o@X9%syq6)#Hj7mng{=WTwEMDt?y=m#VoPQ
zJ^bxDQvR3LB-Bk>(i-oQIq9^~-+vO0M=s9Px?FkWfpbIrU6z`rrPXgji$qg1n|vkw
z`4@Bt9%2{Q<XLdsZfT&=m(8E|xEmC`OFww@Lsz=x)V@y-OQ*EFEWMZ9{<1~=@E!TW
z&%X`)&Y!Qmk-X_n!K9@xGiLNw_wQP@-)1M*r4*65tNH#5sMeWTe><PF?$nC#<c8(!
zQtl^JOI-I_&;K;X%0xuJ>XWC?-4p8lawix4{K8`;bRha`iqP+)8fTBaDnC|wvpZAp
z=&SI9$0rAhyxzXDE#Qn=V9~ihb7Y;ZmCNqf|9kr3YQcxcs}I_LySMMA5>MAW_Lmh*
z2B+5XKVjb7Q}?{ea^{Qc?d^R`22+$i3x~eg`s1a>4ByXAQ>*yz%esopTm8e%=@9of
z)ph0Ro%Uh&XK(FMF$ulAV6S_BgJjvy6Z4O;YJYsBt~mMZ!QXEy=ezei1=`+cn)BYx
zv2c?3g@up*)lIql{c`ZOvv&8Bynl2oRW|eFPVuqVyZz?zlBpthUv^1Gr&oI(Og39!
z$2-sFqUi#I?xq=x`~NN3@gRq*nTJVBnssu+M~mmz#cdwfa=z`T=s3s{_|%y1z6JLq
zxzmeP9&FmWm0Ql=?XtzZwT26>tk!taAi}BC@%vBP=0}Iztymi;Jb7cd|6{Y#yo15#
zit2mTH_FI&2eAiESXybNwdYQo;4+yi-@USd^$9+cd!9GQB;;$H`%^K8=^WEM(Yh%P
z%-0zLm}V{wE_<uqDlvOjo3Q=|fye4{3}33wO#aXQ<NwYd!bj?g*6q*f5E8Db)Jl|B
zzO=#mpvmb4))$H<8EG&XH=MYv;lDBX2TQ9sFKb3YRq*S}DUaS<oveOE_hWlia?R1c
zm3)dx=RJ%z3hwp(VcM}(;<>;w#ufA1*LWQD7E=vjR5yPv<0>h<Y4;`FlPgwb|Cs!1
z@w~(3cW3=moRBJF`Tu-=s=fD#mp9c-`TcUHpV;;~!)E6M#lX<D;!jrj`CYa?#@;{S
z8>=v5p(f*Pd2Z3mFTXwhGAn(q-Ujo}KR$c=Pbr-|$<=nFr_1tnQBM`t{Oo<3Sr)o>
z;o6k}y#9+4EMJH*UleB63Mgjy(|cw9?4@n#XCxRz;yaRAHgvLB6*`v+`gp3m<yd;;
z@bttPM{6d<NV@7QyLd*dH*eMq4`H()lOzlGnkny{e_HW1KX*x3I3w<(x=ef6OaFgU
z^|c>_ONSWnUiF?~^IJA6^C#c_Tl$}0XDqpQsr>iXsq)%8er&z;V$BW@QKP5)GHSKI
z+2*a^T)sF^WWll{oXU+p`mO73KTQ{$A(>^im`Oe4+Pm4cD$$O!5;s}eD~BAE&o*%t
z(>yfk{@H_1oW(UZl)X)S_=dmvMy$m?sr)Nh4BzH1ovi&Qb1Lhy0<qTT(o-*X^qG8H
z6lC@B^TsT({Y+J9UtS1GTHg93u_)8j<wEfPIpqfq-AbC57~<$!v-9W)0VX4PuZ6o)
zrGLb3`xu{~zE}D2{eJ%`AIr5^B)-<Z@n2PT^+11e%7w|3y%vjoxIE7+yOnX-QH~Rb
zbRTSNVn1pivC8pl&v%8WQ$mwFSMzvk$8ywLDk=s~T~IJdI$@@7*Zp;qjvU-2^RH;z
zEa}{5>x7O>*~Rm(Xe!rfrG>9;J6U5{>UVl+PF&7?ihbQCr)e)HeYtGuq^NZ&@KS!b
zr&3BRU;R$6-nBuG+ky@_B-lo~eqHSKGx}G2#PL}Z{6C!5{M3C^G<J*s6rrG0&xxD2
zXC7jGzp^n)%xCj%V>yZ6(=W1wo$w4f({_-RUvK-3$XSoH8m29qzd*NXQ-kY9>jTke
zn;c6{$gMLvxx$E}L?$J3lgFHg-c`?@Ti*EhWp}=V<La|NG;`)Z;kvd>lK=0a_orFQ
zIyX)^Hlf_5{liAfsJp9GbY*T_yt}w=#`=OOe~bB!NTt*X#_$~G=s6`<wk-Pn)VOzZ
zL)c5SRyZep4ipvLQT0bqEcIGf$b@48(bpT^JBn6KIL4lmTV-oA+pRDn%sHsBZ{N2@
zH`P`de|3e4PZwQ}`F%?}vC-rF=NI}_bCPzdn9UK|xuopMi$gk#uP%)UkNdsl&Z1w<
za_c&(-`u^qyzz&8y=Ol29_u8_8O#PRGi4ZmSxRv{O^W!+bmYFsi%vByzssjzrf9r5
zrl_DlyOgJg(<duR&~)K`4-+#<?q6I?Uv@I)9A189{*TCWsyR&;u5P_{v)b@E)2G(?
ziyfK2t%^S^%;7j|>z&QFL^N1L`|M-9nLHm^L|Cqn*~jqk)17%~#dq%NcAGJ@b?aq)
zQRdv?x4=s$;>-2_4-en_mv_Bs(oew-$LX6l7=N-;p0Gc4yQ<%kz5UEA=NL}7IKHSk
zA-U`94bG_@6?LbI78o=<F1`E1dZ*>m)W5t=7tDk{X6#fdJeMCD5<JuId*IaND>Yq}
zCr#D=qter8aYf^EU*77PHnxk6_Kx-QH+9;ne0X%^!xFB0m#1Fcuzg0i>)E8EIfpz$
z4y>@b>g!+h^LEIE<ukJ8r9S>6bE<a_|H;%zaq4e2w-nqyxjXtx_pH5NMNUgB)^JyQ
zVAIG}@7tFt+IFS&olmUHgN@lGCqJloEcaxLKfHF*m%?RC0=q0CQ-%Moc#!<oYqhy~
z)3<y6lUbsFy)7>IEp7dMy+!ozGx^t9-dKK7KTsmixnFM9HJ$k%6q=rT-A&KXEIch&
zek!~5yKe5`ODr?={4XzDEi-%J;oMdCG|Sbd3EY3)VRN<a{-oL+DVH|+A1dIok1%h{
za?lf6`fP_<+p5_oiZ&+fypgo?)uXppL{fJxKJ`K&zt3RzT2KAmCiNFfPt6P29d;=*
zXIqEU+4JX?TcjSYnI`hDw?wV?^XdhzpT8bW>DP^Oo@Z8~&b2c4%ZwYo>o@Z|97-zm
znDqNpf5zW0<<kn}nmSzOyqDh}eIxPsq0P3tQvSDOAHV9nQz`ep>ly}QhT51757wG|
zd&PE!*+Bimh6&Z4IdAHl#2ofMa$f7_@ZE1=`hwP415x+IFOD&(%1M69k8gVYe6od>
zRowm8^K!yw+n@Qtk;)p{ws2)({~{gzsvC_hzQTWJ)g`aLq9DEOCCk@^2ROD=?*16*
zu)}rLr1Q7^rycc8%-wZGfa9#!rVS!)>+2crIhC0u?_RoU^(=v}XZu`PD$M&{-n7w{
zYwmiQ5mdVC+n*awtFFylnqhlruSiMs<!uhlE1I@GvD&>)z>Qny_x|*1%e;9CXXpB!
z-@krA+?(?Y5+y_%iUM{930!vLo>0oiueWpOQzrg%vpSCL?mQtHI#KJ{l^b)XJI|iu
zex>l$3WKPkH@4NM9459-JYQ$SGFj%y4*530SKcYh{CC_Ix0%Y<aLn$fN(6&d#HTkO
z&d%F<bnCP9>=mUP)6TCmHfTxs!6>n0#W6u?|3r_!s_ZI%SVU9gAHO)Z;lYk)hjRDq
z|Nc$>Z@B$_rBAL`{3Z)XeZP6|;&DdfZBp`HKh8gWp!M|J(p#LllcsN*bYt-m^CeA7
z%luU)2yIA_|8y*Gvq}3?pTdjwpNl^oEIX1t!Qs-qqx@c9Qm(C>y7y%g^Zb*wUFWiA
zm_G3OwW?;xvGT8e0c(Ca`R99k$8L$AsJ>v?#aXq#_NE87T8h2uoNs&o&YdqOt{lu?
z<!fL4@$9mHL3Xm->PEGi^Y`rutap7sXYR&dL31r5(~_OFrfkxQNG}VFNL?0uK{}z&
zX=>Dq<~afjW(zZLxv-hN-nQMlP2(tcO2VCm5B7D{Bx|a?XxeLCH8r&%O2B-oT-eFy
zF2}P%qTVd>ZjLTZbmhzS-|4B4Z8AIhf&u@sE5=IQrbaI|pUI2)c{L@0;pCD2K)bJx
z7bi)%t=urd+KR84SzL7HwyeVTfE!y3{4;iz?M@5dv;4iCOn&7Jql9htu0NTAm@g#k
zX|!8uUi^F8p}e0r+0Gtoi^_R=U2x6q?Gc`8xf@uSuEw~Zco*U8`)iTkgtjG1%{)`Q
zs`PjENTlaQTSqM3DVzU2;rs083Cb%%`<$#4rQ`P1JgkUJ6n!Y)^GSm-aVE>11L-&J
zUwys2^6s6rXL`c;PRN$^e=ldxX@0Zu@85p*w#v`eU)LSqRHHOq{`N0kJLmfLxal{V
zD>hqSn6YeTs>WpJE1P$}$#yU<5;vJF>hVZi_Pwot#k=S8F5HcCt4=yC@JQiA-mI4b
zH}B-UJA0d-=lZTiTW3GGdAe7X^MCpZ<Mwy`KY2T@*gB-Ty>|a2w?tCs%HO8;caj21
z4PP$bnYY8Of2-84X8EAD6&v2M{CTSMK(Bij)02wzf8Q)<=XjaR!1D6!^nI&tC_RWY
zd0Dd7jjv*2V$BIvAz3|M=~H{pS)4!k<H^-|3U1~1<aa#3bn)sY$6zbwmfgx%c|TqK
z(bK+Rncb1_c4qV1cQT0=6n_8s>^5=Pg|LfWTV;O#R9*3I>DALrvPz0O=LYFMuvfNQ
zcWO!|U$(&v(;h>MUzK_MYLjQ!hnU+<xqIX0?EAfY=a)azxLkJj=S?w=YJsmQ+ZMi6
zxMk;+Y~TG!)VJkuf2^rQby2EgoBi6nUEMb8?zO8tz98fJ{DOhCl$@UaaXX!w<C{<N
zge{qTa?NYb=WiUW6?nF<;mMSEWx*iPwew}&{Ige&+kR?I2|QuCN4HpftB|zUHo0Hr
zq5iD)Yu2unjr}3{F0rSPVI#jtmT&i5!8K_Yz1+N08kkOT@rw4X-WSo7I5DbTg|VZ-
zo9n}p1dUtQ49%R@=`VV~l$hxu<?#HhgNaY{^<b0Y$C2XGxdL=fMd<xnH^tU1%5lD_
z%-d}bjEg>fy*fj-?(Ks1eXY~Zz13P6df5F=wCdAO+qaoAub)-EAx8RkX^MHC;H$UG
zqGTUV?EJLw#$KU)RbPX1_LRQrRbLz;7CO6H{h8cmi3A@D!3v9a^5@n5xVTqdu3K9X
z;#TJUJz!4EHLY2j_N~cwO?J+G8?IrP^rkU#_GCY9VP(M_)rE{F*PatfeRkW;yj5$%
zoW)MA?^Z3{Cpmr9zHnKgRZH`(?))-2{(yBtoNU5cn<^s<tB%H)miT-bMl(a5xl0Q*
z9^dx%IMq3~PiOmlvCD5doOZi5|8P36-sAVzF7LI+*IBwcG2|~^(#dt?yy^7a5m%xG
zSId6jT43X9*dP*r;oonLy)PbRoHX6F`DkT#W?O<_;0xQ=w+*xe%9n@>rt)<1^8}=`
z?q6v8@z;qPN0t}M@0((ws-mnjrO7eV_zxRf`!7Lp7xBx6^I{I@9@FNz<UiRi;<>1X
z@Eu2mME!Qx!li{$F`KgOwXPgkC98djOD1Qh`qG?Z|MR67odWMDHTyhywPweRXPef`
z*qTNhKPEOS$NsGh|2@xQ<M8Ejuhf*ZY`Nk)|DCiJ_SRk~v*y_E2b-+~{&+lg_~<n$
z?J>g-SL6QrX^-!pTjKrEH_Rbe^qT3yObHJ4mG9;;wXR$0XSqVyG;D(TJ^t$a`*No%
ze&t=4Jd{-Pj%(J8Uy29z*L-ZK4L^|j-anhS=TfE+(=Eo=QoAhjuc%LY(=qSrtAjPK
zRypK9{j$@O)!+B4bDf#(`wDl3fENpd@(O(eDw}%~IBoXd_*5lTx3}=m6`PJ9nV&u_
zy067y6D(mJwr%NYQ~y;AO$xg+qyMjplDy0QR(k!f>QMFtd9URx5^rb)t}=f5R_wml
zR<*r%za0Hg#_j7Ke`?dA+r9O%_uiG3?OA?%Uwrw~gEKu|-pFze;Pz+n{Uc-gw1-b&
zA=9B^*B?wd76vNI6c!amcbT+oc0X<T%zJjSj8yc&Q-5pAkJ}ztUHRJd%hk%)3ujj9
zRh`zo(8eFon)i6YsZ|vdeCFPAN#=>wOltlU&hx!KEqBuNr*9t5lU<QEBkNI)s+&qf
zr8K*v@8pxEQ?J&STsz=Z9ujl-Qp;X9L1%5P%Wq@8n%xzV4!!QTHCOGi-kNP6TqZtE
z?p?~W%Cb4;!6PjTqc;aS=5I)ri&4=OIC+NGFYnZ$ViSde<rQl)?`+xKR5s_x$3=NJ
zZ%OY8oz2SK#BuQS)n6}dW=?Y~{4_W5@$`vP-I!BV<~wgcvp6fYR9Uv7qDcR-w2_L0
zT4d9gEQQx4_YHz>ne=5JH2a~cIiroYRfM<uM}}$1&+Y3Tw#bTni9ect)8x9hv8<Zj
zBeoVt*4Ig)>xzWJYwxT(<fUGi_wL$B^OGfo{2M1+wB??`=eAmIy4dMAlN^{z#9ki0
zf9=-wr`wty&8=FW>6-6U%J}AGY584^!>VQef)}>^xxG2%&bFV6`5b%lqJN&&F{?K{
z*Q_&3#HP@AyBcroI@Zc5sk1#)cE0+Z=rQs4r20oO$5(osF;|wEW|)vL^|g5Xky~A&
zJbg;st^Qss(j<-D7oOc9wYotlqfs^d;lVEV^=As+p7z|m@Uj1#f2X)(M0^t@BTbls
zK4<IC;8<kkeZRiD{dk|{u1N`zKcwVJT|QjdcAej*D6{vKOvv@`9VR^jm0#;Be*C-o
zdhh&)4`-Q)USnvjy)wPjx`tz!LqD&saf3)P^Ky;;H~!Y{?9)~sb^I{vg6^+%rCa@$
zsV|>pxo!2T9k1^^kLEqj$v6AFY4MM>hXSl`&fuNLH_xV0tDjZpmfyK!9GM=99~)lv
zd_VfYdgk(!wCC49cz(aW@6Tu3zklcby`{KZ#(UXg<C6YMx7WFc&Fj_MIX%lfbq7av
zNk*5=O}U^?lKeGa7EH+gU065K@9_u2Hf2S>WP7g`<s14f&-g#s?%Vc8{?8Pr`>(5$
z{#FzP?^?Bn@9X)^B~}LuG#wuI-rRe6)-<ytea-$$PBhKDq3`rbj9*G*Dl3=&5mQFy
zm1#}c0@<rC=&0?{_j`8rNB_o-dASC^`+VQ;nU!UkZ?v+>?pe>qWjDm!zt1!ftrjhK
z(e~6%c9rgCBZY=J%~M_aYHd80`KCU5sKQXIvY}yp#peS*-gs8W?L4+YI<@ywNZ&>7
z^18-8x1J)wv)A|JzdP5kpe-xo@g>c5nl&HK3uMJwdwiA%X8OV6G3Q%Y#p!4+*7g4*
z`WODcarDiL;B`j3_VO>VTYEOrbo&l@-Wx|YPTHN)XZc#H*W&TRgkR^<wl}RUFDhp;
ztQTE+IYuVnl=KpB*H{VOTMgRW&Wq<<esOam&xRXME~<)qvMC32x^%Af)jbz_%I&qJ
z@PkicQzCzRb4*KPE}eHq@=frL*AMO<e0c8TJ^t$7)yManoSdJb@`Znu!cNIU$Ljvo
z2haPt@QiOuXWEy4ja3XRF^sNXqpMDQ2rgdtVEM^|msbAD&<fspVy4pu@z1a3Fr4^l
z$G3Tj^P@lS4IQ2y6?^?fzW)B*4^K1}9y!?lH+jaw?d!9IIu2MIy2UBfU_SGI<ZKV&
z*vqp|CAfS%Qf##D!ljQ%`$Ac7Yko1hJ}uzIjH?QF7Tnly`Krd(rxkvW7X0nXpW9n_
z`fbm2_BhSA6V9D#u?V_0|DpR?&kfBFm!G@ru~#nDYyHCGn*LJ*Po(QGoW7pJej@6c
zuI-e-okw$3eH!}9YYM)c{p`!7BK&O&JBvie2_xI}wuYTw*33B+C)wAUuOpcKzG_8S
z+`Wk0JtbQ{Zra#8z5CXUWb60*F3eAp8ltT3tu|rikI9vJe>VHUgBKr;nu|?)#}(eZ
zSGRWMj2+(TU$w6u5>OMKCTbbjWH|Ai@`N4d*EO2Bt?>M|c1yvg%2&_sXYEY?+L|{f
zW|xB9`ssV-JL%5kE3GNY+#z}Ub;+MIllfW}iDstHx^+$JR@tf9*-Tt><V@BJnFPI(
z-YA;C)~0FGiTLQiJL}g~DDg1nDK(t?@>`N4r%UUCc8FkP!Bh1>ncsTS3-+D&Jy>xz
zaO$nFBT3EEt|dj5Y09r!doN0ByPCO1pRZh?k@{xCDa-Bu|F~my`)~rU{^O+WuM^(C
zoju<pH{nc+MZB1Z$Y#|f?iUM`t^Jqr1ymY#TXs7?EL&_LC#5*UAY1bLW7Dbe!qFld
zWCAR7gr0Ib-g<X5*)1sk@%vr94~<@Z*nEH|W8*q^vprt=l^r*&EY$Swh@I4VRpb%T
zT=pxdeEWsnk)L}`6o>d`?^}QS=Us(0(+cX&PmL+bTmE^U_r~s5?ba7|Tuf@4^li!1
zX)n)~?|9$$_DxRB=a_?{e>(Kr_2YM(4SnS$T^uSJGc)?Gr_?VW$Cmrg)&%(WuMJ-O
zmv7s;;(d*xWqjXnyi@#@>TBGS(#`+Kg3BfB;rdpo4;%cmyC$^$U(^*A64<6Q%dF?`
z7B|M%IrsG~*36x<pYQLCM{8t-+uuIfHz7N{I`-#_Zjq4aj+BNfUJp&TVhdO8jJVvQ
zy{!@&2X6R_Z+?HXZdR+3pw7D1&#OKcH&iaV5g8S8;%TJbqJ`%#KI~vFdlz`o@Q%q|
zk#{GBU#PDABKxqS_l?3T>&M$e=I)pDu6P<%xO%(sg)h@}*DTtpSsnM=!B-?xZ?8j1
z!LC<Z?*&~hdi#98+Wd#N?{A7;ADwtUQEslfU1jce)n#jTOxjrQY`=Z})lCLF%F2KB
zTPv{rEB*ZG=>CM-j{kA{UX=O$E8nsCqy4{Q_U7jQK7Wb-&;Pyn%ryCXmyMSFvEu%q
zc5rgNY`pXNZ8z3$FiG&=|Nm;RUn9rF%y0j;y)&F=T>bbJ3&+olc?GdL3TrQwmwncG
z{wOltdgqC^jAb`U-5&0=HIoP^uwS-d+HF>mJ`Dr!+oz5G$a`P8uJ~!Kd#RyHSDlp@
z=PRCrCo`*8R+~Go4g3}LZKfwfaqa#Ym5%f0&Xn(Ca25Br75immB^b3yH0gEhhw7};
zqOQ}=%$%}a{(IT?vQw3c{`U>%U7T(2oUf^UyuZEq;iFEYQ*|?cYDxdu>=(`cW3hF8
z+mWP2PiHOmEc&<6Y<Kh;>F4Vdq7<g&d{jO2tv>jOl=@W9MGJy9^EuAmR$2Kh(r)d%
zvs&M?qjRs;DQYt7-Yu>E?(NaPJNLrA|1<ZtDIVoLc;J?+WQw`2&6J2&r+wJWzJ{JT
zws-sK*WEY65^rUt83emH+g$0AWxa4=zQE%St5Yn7^Z%u;)NjhXdSkx8?WJxLe$V#X
zo3KCHNWX2?rcIi*nLF}ttL*N1w3MZpt2A8Xt>d-glou`1-f#X`{EF~gzcHp>d+PKz
z)myi{{j@{uxxk!>YvrH2ZR^?*_RCOx&elr@rgx-Y-95SQK$!BntM4L<6S7mapUw+X
zOwkSQnjLUc_!;lx3$L%4u`|vy?r!*%!1GgJ`wOkaCjsv{tqqx$`|bY9yyNj}ix}QQ
z2k}?`+<X<owBwtcGSoUO#V&Q++<wg@=+N{=HVbAy&;0L;Le1tcm07t-++x9bkHEl;
zG`IJg56}3`kY}~f<;UidS(23(tt+?3FWvccOTbjo{T?Mrw@qBVVov{Y$x}WsZSAHN
z0&C2YxIV7>Im6*O%iN<!v_C~J+qXfUW%r5sa<1xDM>F?MWvk14bz3HB{lS0DCtQT5
ziFM``YRou(Z`*NgW}gGw8AP{Bq_o(aIHNOfrZ{`ZjwPoQ-%9K^QvGiDRcnFVwI|tA
z4|^V;sq1qu<euPya$UREw|4AIjx9E}=fB*fy;P){dsV>nfHSARw6NdU%k?noZ{!ro
zSB_OCGta!8Tsiy7Uu)I;GS&sZvciAF9n+AD`(d=oeObb!?=M$edi3F|{f{#`i<e}o
z#tJ)4n<UC@zFaBJ=<md3%UM^>KElel?ul>iC-to-lD8cCv-fJjC;dsn356WhZ&Ns*
zUHxw8FM0Si^U;4hx9*EJ?|Q`Eool#rzGI++NA<3k28XvCnQHZP>(#jnPS4BFtK0pt
z=JU;RpZ8rIBD0=N+q<G8Yx{xT-^%+X-uawwKfhnru72CrpLef4+x#%$dqqdWs@|!8
zKc;r=6uBCGtX1=C&gT6$ljT49|G#NI`&?s~*^}L$o`|M7Ew;(b;a$Dnus-C#jO!{d
zw$5W@I##UsX?OSL=wu$=`6)IIfxDMQU01MM_qF#_g<6i&wdPG6DKD7QI2hy(x{EMt
zSX}n++Mj%_l)35Du~zfDU8{4e&E}cicyRa~-&@C6H`d>Lzdk>5t(1uHJFDlb{`=X}
z`Y-V{+XW7sPVZ&-_xSd|&(ql&{$>_P9^E|ez%%y)&U3m$8fFA=x7#LLs$OtTp4q)y
zzUP<7O0H7@$K_s>FXc^D`+p{-<KS_xmV<4A?{c_`x7}UhBE_ScxMtR&?N44>N5@aE
zVRP8p^R8pJe}Im#j1+h1&9X4|WNyU;xxBF+tHpnKL>-<nO?un@-&OU`&k6=a#93C9
zJv|<@!;3?m;mSSH^~)vOyli*<SylJI>;5XXw*C9=y)`~?N9p%Qk9P6QI3D+n^?X{)
zlY<2fE~OMPZ>)}Py80|;<-A#C3TJQ5+%6jFG--QXrelCv_Kb$p*55N4R{hvknysR_
z`R%c}CwDHp)gX4IWP`z>$tssuELbx8$ck01y4${0zI~tLE2k0{eBZ%na@UrU$C=;D
z)+Rj(ecu=}m3Q$Pp3k#7*Q@6)*~fo5wazAHo4eO(js64LOSYP&UyFR;uW@0O&+hiC
zY8Q5Ptn*@%EqcbDS`l&fjO4c!?<VBTedy%P?xU{ruC}n)-Tcjl$}0>mlQjNzC50L9
z+I#uS=7S;mHD9zIR(Z>Y>{-uwgG=B0!LoxQB3Is@ntl1-oaEIafnmK%g&iKYPrASV
z?}Bw5Irmy3W<2tA%%1;jC8y5Ps#S;P&X3@<Kdl;mDd@N)kCpjpp*lH*%R+T?j$f8G
zFi?LeROfYTXYwW0SNt>MghGwh2DzqLy<Tf|vE`SJRjpb<#sA6aKXx8Y?9<}dE-h_8
z^=72qZIRw9v*wzg{IY&!<etp#`MaMST&WzR5>wf`y4SVizmR9iin;f-C-T+F=zaUG
ze)-^e=Lv5P6|d1&xN3Q+@yomVy4%yPEO?<L^n0<=OF5ky6JMRfOSheEo&U{!@vDq>
zwtr65yl<_ZZPBubmJ5rn3wu|XvDR+ovCb{7lXsso{;q93w{5<@qvEGGF4aX7mY>y<
z@oWqTo%FMc^RfP-2+ly4j*x3NtN*_HTj)Ha{xHiQ)dJZQdsZ%*w8P8pf2AeM;upWU
zPnxR8|2le9@MzY)U&pQgT+}?qoBqD{qQ;q5w?xnU<8v<U&HZ@L^wl(1oq(6+0<F6K
zt4#HHXWN%ss<h5uKPPXx?SHkvM4yt%8*kSCOpE_obD1^w*wnYKW|uYd&*bv@?>5T%
ze!W6$+v<B2*<EwG|A?kPJ$RnW_%lbr*Ecqcmu~*d;c+_c#X<k%X>!~<w@$uOtXVVf
z+T7@i%Y4$i<{$f&XMbPlXZ?rZ(~K?i#VQ*<Y@Q;zX-P}OskBa6$Mq*TT*9O|_isC6
z<d{<;z3G+G-tgV2-A_K&)tKfz4ZZSXrn2zAfKR@UuN-<lN9KI#6JCSnIFUcUAHBcZ
zqOKo5#ct-}%#aUh*4K{BTT!$B>OrBNAL%jfd+t_lzHvJ6=G~>%nbP_ULGw55iHr@~
z@_4O@UXFAA^Rw?09y+e(UYD{VeXZEHIP*u(a##Lc$g^9teaii(b_vS=G;DvD?6>%Q
z>0QaOQsJ70hWghR@BS!>tJuEyn)v&8XND?nhVtE3H*aQJui(D@%J8Dn-hX@7|E}$r
zpqsI??4lmu&j0V;On$s9u93GY^X^UU3)jt}?pi6YxPMnYPWD0F!w<SY?y80Djg1MK
zE&cePjrhEo{O?8AHQF8&&|7ld{Nxpt$kzrYoDLh46*(iO?fagq_hD^sY3s%Ch;Ijl
zm!9LDGqG6iOKNiE@xy1DlkL5%!ZSt6Zl<g5F#mrp@8gk#qE@!ccTXlid3g2hs|U9w
zWqTJ$$Aoa1Sh?(C+uY<+ebl_kwD{QvR-1)0jk#?rH$C&vc&=iQIy+*IS^C4vZ<g$g
zzLs^I<<C2x>uNi<9*j!8^h(v@%(^Wxo3a<bO`RQk<x%+L-%-CWWf_D|=-IV2Vv%Nq
z(d#YU3taWzO)lD%+AeB*-+jup+O(-x+NQCry}SR$U#{um^Z%^AI{&=Of>R>@@_*!Q
z6yE=^B4F8D$!z|{O79y>9U@kB&QdO(E4%-8ZFts%SB(vu^3@xZ>!rkhcD^{E`NAl3
zb(GJx6Bj}RG&AC**X8o~-M*m{J;$B<X{SVn`3$i+7xL${{;YZZ)xBhP#PSe<P5rTz
zci5lG^jU6@se3AXy3$DBWC@dJdtJ!e@Hgw5CQqAwC|BR-m-WHuy9-{r_G*^<gfbkp
zc`4AN_gnv4PTU>tsYdU)9H(^6c6^ZAdo1(ct2pV{<0bcAwDTT1EfBM4&aCy%yqVoH
zr8g$dFJ|Azu2d?}T06(OenWGB<Gw3i*SU+XKU`wDe9Lr8)4Lnk_FlHyJnQB&@3m&x
zlBKs|7Tn9bnE5W7t+IZ?>#uuKwdI$1TA4qNymwrw^x8pdv+F4@ZY9*_+Hq({7QbT%
zGZo2hdwW-Q&9jXs+?-uDJ_%p(uQ{@C;<`@-k8j<&B`Da}VV%0D(daP$9`lO$eW9G<
zFQ%I|wwXwnaWSo8lim938hA$Z-QgYkqjr4x!XxRoC$;tThOGrZe=J>k>iE+mCl4j(
zzkW0O-!fHe7Q-D&-K`b3p1WkR#!FQAooxOagLkSKXG+s%vh(e_RvR^OV#EAh3mX=i
zb{`3PDSs<0e&4auQ&Z*F*UfEmnEK%-$NlLs%PpSpb||yFvhBGu@yhmFPkFzV|NE5o
z@zk=drNx_es=mJ%efAgI^4ybO&nCTWEMj83zO?`7b<;_as_y#v-=g<*v_~<d1S?NH
z9Q)&gEyIlMJO|i%j+gtlJ-Bor_YCKo1JgaK6|6)gW`>JBjcruZ6z5{wn>+iad((pT
zF@9Oi_f5LKFZR~k_LG0nY>&J{%fmlydb6!gV%ATim(N#~znOL9OptZyGp@g<bFN8l
z`o4AI{PvTp^HYB<>1Da>cyzPrm;5!kb3Pu5XEwBzay8%avB+#~{G%=Bj-2%W<{7u|
zck%z}|Ng(YJ~d%#W!Z&00;2hg=j}KUb9d&Ot_%mQ7qj_&d3YXigqXilogbUN;F#sJ
zIS1Z)tP<~-=*AiwHo1az#V>8WI7LoZ*E|N{>x^G-`p;R%>Sy@kv((W@#<G@OGiJY<
zwsOf4Hr}#DFMs8K4D$*<vv-Q|;r&bUMGr&@{|(ANmnP~F)O?Bcm}Hc$q{Qq;X(<Nj
zA6P_~I4|)$wz@k#eeGshALgkaJ>Rg;ITatj#4tQu@nTu{P0>=vps&l;GkmUD>3ud?
zUO30MSWc*0=+=#tS-zL{R5=EmoX;}9sL>)q)c#y=tJdkTo6D-UzvJ3mvty@_{khoH
zsykTiy^DEFeg1Jg;y=hPHhqTbafMsI6pz2j*y0<1zkh<u9>q(iSEjm65wYPsy7h)#
zK*S+q`>^6{m5XchpH}W)68uQ%j&qdvq9>E}EggS^b(Az_ZO&X|!7}q8Yi7@G+ZpX5
z<soZJ_ME6`njls2ey-11w-~lA*GZ<id7TCsWqe#4mDlAiHU3x^(8%a<dU<k$%b8s)
zY)2USw0)lLjZE6#J4Kz_wMF{nkrh?m?{}>*c(zaE(w+0ldse@{HD6Jyr}}i%0i$&%
zcORSlv*<V11BGMCyS(~Yc243>DD~gD<6U=nf~4+aj^#)0*mYX3sbu>*MZA^spn~-3
zvX{rd%!&`R3!CIAAsG}SJZn-h&!%)v@s%?ZeWxw(<oawb;SsfZVOMtL@?V#QuWv6-
zuvl=yV2Kmw@z_)Y#R<;KGX$T72CRIs#pUcVj(_(%4&QpVVE!4aI(eQsYfc36mD%jv
z`K)wl_DKUPncJ(6q+G9SyD4;MVe32}Gu|!ED@zmKnXzSYulHHA`q`nmGRK;~Cp)<C
z8z}aKZ<x64sk3|8JvD<&HNn$2fAhN^Z+`es?^f!mb!=59m13;E^SEk6Y-Cg@oND%I
zg}7z^#VjVzu(N_|*dybr@9|$cx#sdw&CiC1ntPYG#&=v1u6U+o#U5<9Y)<*sotMv=
z%~M&x)2?#$?!<yGk9B;LjXBQ!`C<4WbDiQFXY(n^FPF#_b(^1@er$7fcND+OFSev<
zF$WA(wOC>^6jC$37d~ZJU=<rMD{lMimI%I2M}&`C+q}77`0Rvgh_3$Iyj20)wB}#C
zcyq?(Wig+o2b`L^+g6Twx$O6jg1pcFj_B+Cnz2&AMJfEX%Z2vXCEw4_+f%e5{GMIK
z?HUo)Cx+UJJJi{}?$Nl!{(8aYn-eOQpZ#<4W)ahbYZCrNB2QI{)?2#jEie$;9Nc9p
zl5m2vaHispUyg>NlNSem*(b?;bzifu*#T3HlY4kGihmc^yxt?sIC=S^s*{Tz2u<$b
znk=YOo)A0ZvdogM4bCUi6}P%M&%b_g+Fr3|Wm8;SpB%qvZ}?2*;dP#)jJ+K$B3=c{
zbCrL$<gMs=tUE16^VuV&t;%J&-LB6)XI(uRk#_20$W5)8Hg&f?Z12-heDlI=*Egf<
z4;tsq+WuDR^_Pq(#m9}lFK)W%ec;ye&p!$^*>;&8IhVUBlFOuTFHglr<v-0{4gZS{
z8&BAgt7tO+DXYBnVKM$`EceB#zddT+^FJbP#_}LnOJ|Yi?%ui=Bd?yCv)RNpjYD%o
zp8LgK3#N$aMXxU<=xO9`c$1<zL8SYqPlF=!Sw<DF38#y)E48v76wNrkxK21(N^kkn
zzrLk^zP0-0T<XYuQpuhACXFkq=g6}p7147n*``hso31hPITX1%%v^p|@Y)Iu=WkbT
zhFC4vI=|wY;hw&x>8}E$GB(Wr?5&%3)_O{y?!`4vCr`OlynLPJv}-#zU48v_;^V@T
zx7n&@%{!g4@72jU#_qFxV{g5_%ON}?)sjJc;{=WO=YuyHALU{!)qklQQ^YXIPLq8j
zZ%3GMVB)X1BdL<xPN|jZT~~0F)&A8nWzrY*^M0o%Z~S{H=q0n~snSl9qFqY&R)l@>
zYk6xD@~)gO=bftDcOJ#{M{M=Hnm?B2>bCKVU%Ha~P-r&eYo8xmJ1b<TFZ~{}tMcKk
z%THpbCA8e|kXilTlVkC|mfZVC`KC=}_0ev+p<lr4tK`00huJvP=EjeEVY73&YweF&
z?B~*|7Ta};)8TM$)_2*rRqlN@2~3kV%BPpU4trSW{~+En`6!cF$EF0S-!tdTy>lnk
zX!@<9PbGGLUKY5NPY<f(%DuU6zsa%1)oYIRPKvlP*>d9<T_Gm-lN*jzPUv%+XT7V%
z_D8Pr!tBeZ?{IPa-d#3B{8I0|?mUl^xvb1@r)@f~@kuyV#IQ;8&VAVlU5WV*PMdUE
z>P5CRaaIQHI$X}~RyuvU%kv8^9pX>)Wc?RPCtuEqOTWw+>)RII`!ajZ7e9s#i6(4;
zpK3neJiTt~(F;3R?p2iCGK~$B)#p3j5&mB0f0=gPDodrcYKiW0tv4^9<J{PE>&gEd
zle%uZLmf=amsoN+wpDNFR`KggHstKQA$URfVZleQ{SqgpYnMFw@nQ|jKS4cjmZr;7
z4zesftu17&kTI=8?$Im3HIq&DO=6ppbYb(%P5QkBOWHcTs^b?bUOB*_cHn%i*`HZa
z5jPF@J`HN`)(-se;J=>IpP;v_Ou1(p)GyvWKe?o;&e83X%5mL|h8x1wjm!lEf7|Uj
zdGyPJZ;owp?=*FE0=146R;_*EVfF3U8=e=38y1R*9<e*%S$XESSaoyI9*r)~eP6%4
zw45?`-b2BS%QY3gYA&*NIaVd*R%vjy@XgQ5`SG*%JPGvb3o?i>eEx-R;{%NcTx`6*
zBa*MboDrcOIic82?A!c+I)^(irmmeL65V$qRm1rnQ+NAunXOIp&&Dkl-fr@>dP}Rs
zGRB!RY}PnvwdDVldOl&><7H2tpZ)zt<87xbqu1B!&eIP#Gr1nc+>uz@;3d3E#r;H3
zl!}XE$eEnWa``WgrP?tZF8r$cpzr$ndp_(=Jsc}1hpq8>9wwh<ydiOovaf~ft3(6q
z_UFDQTP|((fAag@y6$s<-&43%#P7{xUwUWXn<CHtdv_<^_SX2KyYf()eKhCF{@s@o
zYWnx|8s3{J{Q2#96N!MA+ofO42yb3qkou4DqWZ(2s7<pBzO7AR`+nkV=y%5lv-W6O
zU;N}8l5sz;=zPFNxBpWU;)>K48Bgo{JSWN7^;crEro@KM1XGc;MaMJER<EyRJ;In_
z*<;D@^QGRUNm+MIc5f=tX_0tZ8uNCE^kt@)(4DW87D;b^by+cz`GktE`{5j(9T72Z
zi;6mTM@P>od^z!J&39>)+5Mk$r@xLZT@-U9E+^V5c8AFM!)?6zODEq`3Eu7%RdDR$
zyszKXWx{*>*n_6+uW?+!)jKP8+j^h3Rg0J|{n{-kAymhc{dU=&8C;upKi=SZbMeF9
z(>GmLojql*gGfY2qDhme1XsY`59x(fa;%TmHN1}tDtA4X#?3Ty&nvZ)A5V)<`EWDl
zZPKLlnV%|?|C}v;pS|5o&SmHNh$8b9snLtRf4O6^E<fYi*8g!?>jgdkvvFPEFpKw{
zW6|_$SIzF9r6#-L_v|{o-#cLH{0|)UcV4$xH~v<Zl@yenSDcn|<D0{u={8*c!dq8u
zR{G^4aktXx#|l}^=yYq#mFM$6ev5XC;J%Sun*Js^v%f>aMlMEbqok_9!!IFP`|{?M
zxJdlmc71wE%dMIxo2I{NS!Jg^@mBZQtKTN@Fy3`P+dT24=C8o{ZGT>6GAW%kK2kba
zBKFmR9&7OjulO&h)Y--DbYPm{C9}8n{VI?Cze#_s9=J}6`~1e}zNY;9J@y$DpR;O?
z9iGtM{^MD}hBY;lstxU9Ke(_tbR{ZJ4xVHC)yn*nRNw&>-DjsOJO%qz5;Z?A5&Qc{
zO7Er;<C}1ETdDIu6JEahXSUPjXv7ugqLwMm6B9S@+p0eQ)Lx4XPY)Nd`<Hg7nDE`;
z*d6umPXE0>t9EP`%Zu|gaDL<TvQ*USaNrVUvu{lf_snyoJNIAS_##7Pv(>{u)>&JE
z1%Kx1@m<;3`zI;NrSShRB`!UU9h`@SRu{fdd+0d3-TJt_)bFJ`{1rpzhWgt{U)r?B
zr0=Dd=?_Kqhexc>T>5-QesRvZz`d3E<$ZiwuMKY+hiLcleb0EgJ=e_RwEWLqmG52T
z1R?{Kx_-+p`!r)u-aE&jK%Z5b0-Pr=MH;O9$$chx_Oga8SC57lh~2h0dA&eqc9qw?
zDUzR@RxAGhlrCAca#>H~<jWkv3C}97dn>zX6yN=wrnGURnM^$Mr9U}5FS3JXe>J@=
zQ<Bx-x98P%-OoAKwbzN<W_s+)`R&ZKpD98n3s0ol>$K~&*s;g|_?5?Tc$W6T8{s>i
z$*#Y4C}!@(%{fm_&A;ZhO7boHwwZkU9ri>B?N&*U?N4TZtT8`Ra?%qHbD=ho7mo_x
zm_9MGE_liH@_y~Fz3RvB+>zQ<J(u^;=k^RCm-(x0D}0tE6?cd7NcZN&=wyk!75wht
zdiXQ@?NynR*F59so>;!Z>6=~nuBvP{F2?^&iPZ`@7p<dSO*{C~z-;SU_jgx>mCcrK
z)%{-Z(l~6X{PS6dy3Zy!`DXsx79^`4@$<{VuWUWi&z7yT>Dl(~^&E?Px0kz>Y4NPz
zsooKPuVOj3s@y!u42IB$i_2ENnSSQb#wqMi^v!;EpOss?**xFgW+~5QD@ltecdggQ
ztyWC6l&@TT^iav)Yk?7ut+*>6#(0+fh*N*Fcz^zrg`7p_mMgcNygs+{(Aub`!^bPm
zsJ~Cn$~yVthWDbi8|?*i9GDMO&$(pm(-S1`{8mH1RBGRp%X-4<b9~P`zTG=tt+OQR
zLF8-QZ#zr&2Gv|#`>;eXaH;T2U;VSM{)DJaWAIwwu{ig<vrB8>rn&y-RpfrPSGTX%
zxqf(w{)`5Vhxxa2HkVG&7ZAEQ!Dds_PX0L(_kWodzTakLr(A2uSthHjUgvAqz3~3O
zSve1$pSw^{%)CI5i8sMCQ(;!H-euX(KYFL6Nj*IGG0E{_B`1@?<>cr7^E#Y;pDR}$
z-Pyl<>62rk6ZGbZZkojRV4tbh*2IIKosRQYNw3$q>{;PZzhv9S6g}NahZ&4Im3$Jl
zH+tW+?>oX^b=a9l;Nuw;v#SxY@;|js>3i{XC~ubxU;e-Sw{`w~9{w^uUX3HEKZIsZ
znz2^D@2}ew*W>AmX$2=PW$IPwx=ie8G=JdWe5+ZmHzkZ+^sV8i#WVb@;(u@crz|a=
z>=W;DO(pfsN5^BLMyvjBozWx5cckQe_5n7PIRZVEg1W(ZlZ_U+raarOa-6enWvgrU
zmEONIzdY=#NRyj&@!+36HpzGDk^&oV2e$2YX|=L@o69np^Y#u!3pv#b9;Y_0?08Y!
zFzrH(vCWEv2A3w6W6SQinuYL-N}f~FTcH_t|A68=%L5mFAF|uI)6ejm*0jz|p$Xd-
z7Is?YDxVSEpuULR<BR#Hb;>+XR}^<HZLrq6cs2R|1LL4GciCR%7@NI)!D%%6nZ_2;
zHv44#yv}bEss&E|h*J2Ksg<^1_Y;R$<w=vCTsYrwzR0J?>7@3A>Zc1UtfF+g|8CPu
z*!ZxZ;>)`SR|~#h&0a9YQ2vr)$Ndz;DQ-m>Z_F3J$oG0Y@yj~Rxa!x+V()~ezF%b{
zdSUA~hbO6=-9eJfLh`{A>}6A)aLF`t*5|EUD^NOB{rF4W2Cd?y$`ADP8nky_dg|f-
z!Iq760pmN<u)2L4jB2Ou<_}t~@p!RGi&)H}O-{icGjhG9oRvB!T5)*P{ynX*h%+}=
zfc0#}e{=IrxkH-@KVJ^o#%p-$?po=C>GegwkBPDJr#+m}zNPOVi=wo<q|&8Lii<AY
zbDY@qSjzuT<_klOQ%2oW3g>^WI;z3saY~QruUtW*_|K9DLd)zOwpUwe_6t8=zV+&-
z-_hFfw*r2iE-46)oA`3Wi&Y1#?&V&UUe=-FKX0z=@A)3}r%ui2UGkW>J^x;v1W&t0
zr@3lk&*CK;9~``QyZrszN5YdF-#u!#KHe<<J-)VPYyR~>XFu+Te6ItZS1o!uk6|U#
zr6a7j9XB|Ibj+D@!qRzzLmTgmoAMq<Y;K4A)zf|?bb;|{inrgYrk6Tja$c9nE!&vL
zz9`#6JMsIBPKN_`{<EX*n7d@UB5|H51H;BD1_pUtJLb~zi%N<T^FUkXZ2yMe-mz)_
z=kOO(i`PxQt<th3;Ka0jZ<%gC)!lMu+TCxmr#_bESYEs)Upb98#q!Vla<@%6Kb7Sj
z5^mZRRn3Z+=C=6fr85;NVJDYA-mCxCIqh=8<!_D7%`<lPxYd3t%ekq1>s{$C?bRvf
zGX6?tGDnwOkA1)O;r{R^DJ~}kpC&rURQc^Kcyl;GDEM@IWZ~iq>dRiL6$%AjRyiZz
z9_X`1fg@QvE%88j*rjb1Mrj8pM9i79Ld~4>jRlYGIw_}lO>as>Rut$QoHDD{<wSDx
zmb-j^4L@fbx%&4QS7ZO%jrmtfUMNV;3Nv}4dvVw7GQF6$eJlRH)hNlxUOJQM>rGYe
z3U`LUf^z<cPK+Agq}e)Oebw{W<jK(}t)_Q4y`F0pM@Uz4q(HELuiXJ|hK2rDC#~IY
zJTKzja*M(U3t8dYn;R~1CGT1B-hHp*loXZQ;^ALyk2^2hCA;7H#IF;6P2$Zhm45CU
zm!4=VPT*N5y)(sii|WzL|Cg3E?VQBlo>O2X$^B`)!Sp#Le*eB#+`scTwf_6{=I`%+
zE%Mi5S?ROFvv1N3sfsV*RtwLu7iRb0G-SHWZdu~PJfV8_#hfSevSz=q%`C`kZ#-=z
zB-hxsp+Sx%FXGklMFs+|7G%sYe`#wgR>Lf{;(g99&xD_6>_pa9{Wp>fW+`)5)Yxz@
zFd+8pFHU_whaDMvHf>^ZI$-%zGS4M!fyK2Ox?EF#U465jV}pivr|FWEc8PT|StqRd
zN*ymo9!R>JQ}Al1u9N=C;}v(<<75wg*X&=sd0JB0`~#`o3<8&@-}v5rIz#Z7uQiwD
z`^k(FjGC;i{LD??I~Pv8zv888XIF&Bv*>#(0~f3*WIJ6c&$cCP!|aNAGZ(IDJaBZ$
z;aPuk<}3<d?$UL6bB~N9D_3`Z=g}()6ZFlN9_#ycQA=U_;`l9>T;HEqpVl}3+&!g9
zXXo@Qch5fbjcG**V+E(mV$Ivf1WRwGRxuXw#awW?oiVZAFOq97%S=JGbq>D1PH6_t
zkEXBAl;u#q9;w`XRpqUDhT)`*?*6R?oD;21ONvMKT%L3{Q(|SAfI7=;hG?;XXLBZ{
zTh-1Jye$>Y{A^>zrJr244CXd}FyuQRQed>8&_`LQeS>dNMq%etlR)NnTm3^Xr1QFW
z9RISPtysN6&BvKN<W5L+obu%>%M1+mB=YRJ@b4S5!8yfS=L<#nluw(_vN*rllDpGA
zjOWgl8U;-yuIz_X9t9<RV83!l!|Ud$s=M#ResVrnzOq<DL)Lk+mGDHlh&eYUUpWO#
zF<m*)NdDX7y3}^Pg53$#C5ERf^B?OdXc{nEa0!;KxgjLNlDJgxL|C8O@&%g~xz0Qi
zb8^ql4-<IJS)>9B7BY2ad;3kC+!wvzxbS5+t|d>L4jRgeJ+)f(B5cv31!7vBegbl8
z6McQJl$(4J+Qq=P;~7&1^V*O5_E`P<@$l~P?e0%rygm4PePfn&MLpBD2Ak7MqCa@;
zu$)y<K5wPq@AuzJB>ls6Gm>7dHc9mVER{8}_3PG>KhaFyzNaSei>7NYja+!wIXx^u
zf9i6dl3%G`vSfE$*4naJNowc)ndkVY#cnytoBwW0>ie%Dz4~XFk4c5xUN&d;15=+*
zlF!c-WNmr-QR3V2=Pl~V2C8Szg*2#2HD{^GwelWg`xmlo$}UZn&6i(>sOL$%Wxnvf
zYDS`vc*3Ewl%tD}MzCs63gEHyQWot>6ABiN2@sIE5Rw<Sp&})US+44no6V_oAM2T+
z;_2I-uBmI8JniMHFRBeQ70&Erv1CkVRI&S*nR0YX;1So)ZXcN0X3qUqy+OEX8B-u9
z(@AN*-a6L1N_&E52z?K<d|`PcK~}{@okLl^-X!F(ydt;M%_xS`m*f7gnYk$-*-@~@
z@BftDE4HS|%+i}t@@KA4%<kEfIrkNRNnF~NsgTK4ds6GfI|nn-X<cejuWx=l#69JM
z(btx@iF}9l8ntcXZA$Ja(D{9Fo9*LWUT#|%X0(+%B-@-`#(O}Z?Jq~zcS}PnnP>WW
zFCHjOTh?-ct9{1~)jI{V%B+0P>dZOU79y*DOu;nUV`cA}g&BOSb-1!(^jP$`WhQhx
zrnpX?^0{DX<-F3oh7v8u7eAD`I6fqG{Qaf1h-Jy;__>e!f7`#WH?jZw>D%Lf^Jd(f
zGH+dFqAO!g$R(r09g{U2=ht#XIr!Q=H2fOOa*5AA+F^aj^z6HL>Qd#O7Fy_4C4K$9
zz)yK6|1uS!D;G~HmhYbyRdl!Ol~^Db>z^atlCy5Jyj-iZ;L}6X@2gJDW|hgWO)cH*
z+3v2hrp;;V3a#(27(eRz?lib`N|uv3x87t~x{gUP@8JtAFQqp(Es?yNU(z%;$o%s8
znCur>hxW29crJ04=|XUZd-r^&*ME*>ve<o7n6kp8D@;W3x0r>}rrj6*usLLiUDfYi
zx=Dnof9-*dO6<<<Eti8{<gq-MH0@T-M2QF1%RfDfEX{ZPvb94gR;NO-aN1;skI$o+
zlHyc$dr16_X87Redcn)<<FR#5D^Hxde7R^!5SRP1$knrt?slpPNGdjrR6Stdq5rtU
z@j<H{3+qJI^&*qko@kkI^T?wEk0YdunPhlV#4<&WC*O;YmToeh!ecOX*SF){Wm3WG
zmflYYJydw&;ET0}=Y&sPk1I7UFyxq=E#ap1U+IPJnr~i34|iRV2t1wL&~408$kcs3
z;=M`q+pl4dwVppL-F)*(jp3#D!q<~B>aJV=JT^6Z-V8~Bl~<pIL{up2-3Uzi<oB<*
zuYCFDZ1?>c^U6x&g@rAaeX>aJP|sP&y3RRVV2+@4->S352GUIK6}$^>d+t|x{V6n|
z?Adas`?HtUCmh@rG^a=5&yg3c7H3K`S(G)NrRr&%sO>Q?Oc#yhl3d%gQAz2g;I5@Q
z^?V|3kqJu=911MCx2NDl&go`fiyz9q;*G6N%VoE0xX9Qc`-1KEx~B?P>i;+!XEY?5
zIPR8^jM>Crv)JRZbjcgbzHJPj+g>z!9+CPV|1NZwZV7K}r-9H8A%=ClszRco8KNHd
z*HrauiMd()GUAI7YDt(p=>X#^mnl3qEqSA~?i?za*ni~EmWk|)n-vTcelD8M_;Iaw
z218nze*Df)lkX=t?z#RhF0b^d`*Ojww<cDNcAi>^G9kO#qe`QN_Ax$r=V0T&JuN|9
zP;XPw_av6hdJW7wnK;THCJIh{p0alv`vqp}y`DdV_}w~MJXWo07nMD`DZ}zwtV!$J
zl1LYoa*ql>W%0%AcTF$aPYOElo9*8(^_Pm9)`~2ACGccT%oV1@fP0clS9vwD?)+G#
zdFR4}O#k%u7hkQew(g%Ge{Ja_cWu{Yw`?b`PfCe=vE9qAGbY|@uK{<A6ra(Au#IaL
zYH}9rUo&f&>or{l59TAaH#QmA+dI{Zeh@vobZK*7`3!@XFYbs$@_!RK7%QCl`1G_#
zTnTZ~Pem7)uJQ^sJ1eX6S?TouyPt%-4!O*T_k79m-Ei>+^}k1$III|bwKus(?!LmI
za;5&Q$NeQ9nu;<Nzb&J#w;60vICtTaO7@cQ`9(8VMq8JMt&^VFvdCAby1!uiEZ05$
z^WSZ|cW2A;B7U*6Iwz}{1y2ULEnofP$D$o74MkPU_@~}9{hG5=q$uN|!%^4slA0A7
zk=K+~zTP@R;hv$Il>3V}61>-PnXF6a&X9VSV%}BAA0FAL!I>xd(Wk%k6rY68@<ZCo
zr#-r5#_hae_a4Qd<b;r2O9Q!cQxYFp7X4DW@HNP;M3y7?nxR(zjR{vf82e=n+RqkU
zICgWsNlEbCV{2}GlJB;6F!*{s`%w&QL#&)a+p=7y)iPo{&sQIx`sldnGNy_b!5vSw
zG;+Ue+b4Rz-Y;RE)fqF-wzW?_3h_3HNdB$&R6TQ`o>z<IuarcA`$ZmW#hZG)JKc1G
zJ5{w0Gp{;$_qB(FU6x*I`}_R#pl7=hT11X6e`nXt{Zhtr?c|_@)fJ~cHfYsaCYxUg
zd3bI1!rrax`YM0h78W|`?K7Qrvc}(f$&!0#&5lny5+C3j)hfSv(cM0A)nz-T+J(3_
zGd3Tnn5pn&wm!Sgyr|p3lTWOBmTTF$SY@^4qy-c2`XvRkZ_WRlDy^0&DE_kjZ`_v+
ziEJL4Y%3KcHL7`U%N!TvnxV+69F^-cGdI<B%KN4zG47EoKIq;JIXb0(dy0@j^X}B$
z9p@LMoIN(jYH$0R9Xc1c#Z*}Ceo?f~^Gvs{Yi-)bbw!OIgS}0P&t7s_+EaU~eUH9L
zM5lOn`}Ui1Nn7j>mt{PO?wpXg_w>|@roSRute6v%Wp{-<I4^T?wKQWMOOi^?Qp4(F
z;>E|41rI+rEM23Jw&>HMw@Fd+ZtCQnPH!+)U*Pbjvw(5B!R4=i?YEv?qE@?tEiA0)
z#$sn~8NoHoH}46=@6G$(8u&rZEA-2zEe68XkI$YveeSg1b&aP^T*0=-cM5#D#_O10
zx{JFh?!FfHs+m2q+<zj!CPaM6SC|{cDlm2LiXR)ym#cicw)${V;HP`nU*Es1o4!B5
zbOukt`yb7>K89>I-fFTsC??>`TL#6ai7%$^{K4~2=5yXB&6-yQM>N|k?S7tmS{(Iv
zAuEr_w;c~69@IP#K5_hs>oSF9ve`Xyo`*A>kIVKjKG^MaFR62-PDF^_M$08fPn}c=
z3lWoMiAl~qKc{J1=%(Wqt9qP;0<86G-?jPg(kso+Fs*0Hy<O3_OxW%4R!5^hlN}{C
z9CLrz${8+Oed6D2OY7Ntzn-0Ewj<(9$Ew;b>ihqtW~`V$m9wC#O#W&6|K=}xQ{`SQ
z>Q}W|v?^%IlpXU-7c*6fW!eV|1!%3(Zn%5T<%fq+;p#<)1dkpz6FVL~r)zI-imA?#
z?P^jx7+IG%{!%&cW?|->=~c-aQy%gySDHEJRxIzdLrkwV1J6A)S12@G#OT5iF<s%D
zN@rB--K}?@pFg_!dSVv$hREir+qRj^ZaT2~YJzL8%Z)_`)-9Tnl;S+?-3cY_g4?H;
z`ObFHoSeOdfBl@-t4^=^I@P*w`81`L3!i&8CkbBeh~mrPoAh$=?&Z_-1Vg2tZn(9>
zv+8Bo#!_3AO!*Xv!02f6#Ub9`-+j+Ga?Y{hX`@MDMy~G_|MFv#>-<U@7!_H(jO;jX
zvi`RCsKKFnO}q7{b9!({-NpmoggW-=x$&q}2n4>Co*wlfuYCL3S97mzJ+Wrl6g7Jp
z_4;Q|jbE?N3ZE3ly{nCD`hK?6T$8VdJH@QKe`aOD#L&jm{uw8QC9P8*9^7^6ald@o
zcl+8b(a2rFJF?OQr`lvk@U7}n7kK?hYpI)mV(8D$6B0w^OmzhkuC|1ByZE|B&ZwI5
zcAxFnopNt7FDCof=RD*uNcrIX`Rzx)GaEMq9-RN`mEL{Hz>__1dpF(lJsB?}x95N9
z|HYlIm)YYtH0=C)Gu!j@;S2Xo+ctbUKJV3!+ZtCFp9uX^f5tw=vvKJ&siGCvzc0L@
z*Kl*C*7xNq5z~r3yV(D#m4CQ!o0LsU*qk$;^wx0hKN-1AsG-O7)r^ymp8s9O(zf0H
zby-P&`rU*de!eFpnb!X)G~IWFsmoPu$CQGem?KB3HBLE&{Xf;Exk&w~_q>f&x9s*U
zf15nD!O-&7`^nq;n){~KoaSzMByTrSU+L8UGfe7x9!SizHd$7dvq~gkTKa>9Z10=8
zW+myxSsE{TBx#~18}fcl_FR@}d)=;v&zpAemhrqDGrAAiu3_wp39ra}wBJA|ej~@D
z*oon@cKbeBTJR^sLD^eI;moZ^8k{)=O0vQ8;_6~<uRLUQP>CtMF*j6Nxu*H(_H&<3
zu>0)Re{kk>uxCn?Q(XD`%PHT3Z$&XoDw;iMt-q0z($8P2T93B+`4q0bD6;;cw!TP2
zU6f4DM6aIW1wFy3$)>h-&x^lh@PF$+J?|WA@1hN_!p^iTGx6YgddznDEPuN<wJ*AJ
zjKkSn&VLj-UAQ8+dFk<(8v8b%W~2MM>;L?d@nX2n_M+*iq>hX7-bQ!TwH55=O{c}q
zK79Cof7adEKkxb6{(P=BxzlMff8OH<?ThY5HY)7?dhgzr@QJ>qzfJn%a;9fHzGyuh
z5Pzkp_JGv<^)E!O{c3Pgzcbm{;_>DNXN%yVQ?Dns#5c`0JMJHS`1HPKOHQ`Azg_4l
zlK)`dNk;Q;XSXE!_uZVF{Ov&B%~=I!ewmk^$$RMNX}Nxvzqj|<HJ%!Ov-<Qt8!gLO
zGxb^KJhpw)-571#H0^Fqa~Jpd?-}uk)3&eb)Zv=&+wZ3QVJQ=vcv$)7&AfSg_B*%z
zt9rTfqEpnDA9o!iziu&q`j0oeWxmO}GSgrazsIF-H@}*4y)>$_#l!Vq-=AN<UoAVM
zB4@cRy?>wX!^9}Im%k>anICiJa9tGftn%s9Z<l+H{o7S`cXi+<D}}-dv924_67J16
zZjanA^M2O$jmAa$`B`|1O}5Q9`=kE(b4s0<sr^c>caQ#``6szH;OWs<zp}qQU$L;}
z`s2xLb^cNj59%fVuYSFA-_P%h+D?DGFrVw$^l*dyUi)f(UQ*xBTJdSJmF$m<LtkHX
zzg)V}XRorn#*&{d`O5zd%9h=HoVjgRM$g(4-;>;DJ`wq_u>9Tqn`gRZ&L(g9>c4Dn
zo$2?KTk^qQpTwtLSbFipAq}4-+of8!p1hv*Tt@Y9@*81;1(}h8M@@{Emb&W&ygyR^
z)<k~YxtN^X{M_8Dwr{U&jQOXyqy5kyy~@|2wX<ijY%JC6zjWhLk5J+<4`;d7lVVQ)
z=I+b=f8Teb8t)z7u<bi{?%f$XJwbTG?G3YD-Tw12-{?c9J%?kWWcnxlRWG{RuC+e#
zTF3LB$tNMjMoGxzq+{}a#Z4dexbME(duN5-mwBtr6VAINTe*B!mh|3s?uM-V!u$=h
z{x`~LcRI_*XY!bpD#@A@?7yUXVB5hDuIq&Ddo(uQ+414iwN?q%wRYXtx6M7fR($=O
z-nYHsuW#SJJAHjs?5>BqW=CI%E5E+>-m_=N4s5K>3p~BDrg4qMQ?2_#uLZI@EDqXh
zroX;@NOzBFRP?!H-D`aV#9!s?yHT<8X~er<4VR|BmX^LfTRPe{{c`2jr+bR(E<AYr
zn@{uWPNxLz$)$f@Ydv~7r>b9QW6tb{^Vvj>`0~$vsGWaRJ8V+J-OzvA&9`opXF7Uh
zO0)dOIUD?2>t~z24V?XRnmUWG-b2%XLPnh(XOB((^1tNYy<f-D@<U@3ToaeRz4z_(
zy>H!Xd-K*!|IB}6f870fiYGql)ZEry=ecXcQCG>S#wVp_oRR#?khSsWCpZ3YPKHk=
z?wsqd*(N!E`SPk@w?9k$zuwzlTdus9Tc_vL{4eizU)mk|De|AL=+C;(0eco(Og$p+
z@!LtZ^4Stb^9?OI5^lo1ETN@34^&GpXT-m`G9{aHt&aA(fIVK1yLTN+s-0f8U1ZMP
zAA3Tdz4x4H{$D@QL@#H`_u@w@g?RsH{6EI}%V1&fjExO5*QIp(sJJ!CU8!LHHM=lw
zZTap8b&soCwHa^DxM{xnyRF>~U2)~RE9-VVi;=yytMS~_e=ZLn-MRL3$<C6;v*()q
z=0_dc{ZO@}X9Ft(gEc<`gAA^r-K@m2M7@H_so~zmx6K6heGbo=%Y1aDi}kyOvfEzy
zyjrm~SpDmfc`CB5hZ{WtT6~#w7`%#%|GkfG$oD$e%pM(~BX)nE`1uFVem!l!DcY?O
zUQ#9*ye{(43Z4h9j*F(8JNMW4xnxYoBgaj?s~-M&^YbUq|34htHCwNTaPk@6z2qZe
zDaYpP`OczK#IhwZ=vB}q1D0vxPFV_bxP488V=VoAg;)K4D(<rUY|zrBX_33NuD6N^
zhU)HKR=s!fl8o#8tdFG?xbm_Y_RW{Bk&HHH5UV-8<N@2uB>9Vn99C8;PZZZ#9Avsj
z+;ri+^Ec-eJ~f_dSm&R5_^WiF&aO>Mysyes=2iqAX36_|yMCSc!=v-NyZ7te|08J8
z5YOB9DOaW9kXi4V>luZ|UaI;Z=~&NL>(X!cJmPND16QpJ2m2o1nW)Q|yi3nqaiX-S
z!k+0mmridLxG5qY?(=f#rJ}7(mNlCu)vM23#He%krrLw1;BwQgU!o(grIbIlvGSWD
zxb%T&+y#lmPg^pVtu5SpVB;gBL*}YC1NK}u)rj>@-55Fj&%AEga_w^;{&sKAzcA(D
z)kk+9y;^paG0}cu)6YA`*B7}ux_olu-2Hjat)C5bR~b)kI{55oMKRZoF4vMNzuVV8
zty@#lnb{P1$l`LMMWBiIGKcRb&Z15Gw1RIW#U!m@OW5ku!t?pm)`J(0%TD{2EaA(z
zWA6>85YL&ZiP~ST{lA^Ybn;DU#t!ornfe*6D>pgRSJicw?#!CF?E%}4W#8^Sbp8DA
z(Ce1P_x63<sbhKkNS5*f(~E7dF6=nVmYci$%oUkze*U!m-_~9|I8Ed<|9U-%*0Y!9
z#rM8j5VVNvt#163o_%%s=XWT3F1q5n@^^(cm%8O&rVJe^S^YB?rSc3uWYvqu{J&z`
zq*eCYe3nKC^C^zJgNyPnR@GQ}9S*v<Z(Ey)apduAFHfJR*DYVqC}`dxW@Do8&tBlc
zH>TrPz64#~pdfTUvu97i@e-*?TZJOGF1##Od{{(I?LlHx?Z4>hI^EISHfv4Nc*J(v
zrg1;x4v2deBIK*?taHzR!N5u9w|cpl=(Zy_9%Ywo)K>NC+<R6>e&f?)&)9y*%{#0=
z!}QPRO=r{nZrS#%SNyzb+LlkD6Af)wT5ns_`aM$f^sI}|ot`~&FTS*2xW_*#+c)uj
z<u#4!#R=L;r7ph$V=BViR|?(Z`Z%X>1y5^9;$n`lo$Uh0=fBv;*Ee^<_q`qOwx+CE
zyEpGmRQ&8uH&@RyGMZVHyfjW?VcqpdXVkBiE4SsXFG`D8{`)`<@3NIU7Zx{k76`Cb
z?J5_0ob+7k&cu#FuUWg7`lZ<`M#)TfX_{LRlFW1RzGvIU8)qWxe9l%_Sbk`Iy({$l
zd(8{kdu^9becj`l;V8qXe1j|Jy``gT-WC_1)1ouD9?9Bf{gUvrx0k<JWwSswNMO<R
z$Q1_vUa)!n-?eF4rf_NS;e@C~fg4Y|?yk5eu}lBpeL)|F_3_&#MzD(AnsKPS*g{$=
zRA||Yi-IMScBB<GrLnd8i}e)7tXNa1c2C)*tR`;;!^M1qx~cEWG;WDS@t*&uml|j#
zS$c!<MVASS)YHPrJFae9Yq;&ok7d1U-nVgPK2=V)@R$?V=OaBaR>}9^79NxGj3n;k
z-4}fLCyIETeS7BS!X;@;vN1E1w+Lr%EcbaeDdnsPi}j)%t2eexv6+`7d2GhTbxeMS
zWyultA^KwSeh(fyPM8yuK4n3B!I|q8s~H=^^Tq$U*Udc8tf8nH&9!QQpxp!|?ZAV2
zOD8q?&9u@Byj1V4wo>+PvZL;{Id>Mze7<*RUhv(FNBrv#@097V)6=}VE8yVEmu#DN
z$IQNdYUSK-xo_9h%`;l+waU-(?#)f>HMIim8qa9$5WD8^@8tDkneR$NFGVS=nPj;}
z&h_q}gg6oQwKsp2nrJM%Gv{ym{g&p!mHz+RBJ*wRO8VzU83c>!ZV=e7k^dzr%ItXf
zx&Npo{mo9ZrV>^L1~oA}C4GKURx)S?FCsAiwwXZP_w^4Zv7cO_v*hMshFraCmafqz
zncPPXn=NT{@LoQn*M(E*=@E`k_sf^KbZ(JdF1@Ri`4Ri=CGYym@5}C2F7-HPKktv7
zWh!R@<K*p{1t*QzN?qc@Od=0Gv9OVnofH|lHoI)=lqWx4{QStWzfR$^>I7o}RdvlZ
z3i_*=rgpMK^|(dGimCK%b~7_QVwmU}dTmm`Id4x@?VS?6yDWFEli05mGNE$0cw6ey
z)Sg@Hwl(ap8~$i5u$!J~o%}>t`NyX(CU*1Z&zb#m(~1bb()^5Tz9r|m%TDj$$P9gY
zVRk^Xq@LorE5YGLCpC9v^{i~%C{g0PbjQlW>#ARG4wiZI?NOJx+bh$2w%u6^*08at
zCh@G)sH}0$?ptwm%f44~Q@YQ08uv1!r^ucA|Ko?&yuFpC)!)DUeVyU*;c_ES&D1G2
z$+ZsYGYXD9)IEQS*D`E+O#1f8HKsl{Cs{te-m&ec=_U1SKkjLBUPVUl3%ELY^U*fu
z&8eMVGr0AnrY(1SC2l$+x#NM(zCh#j-X+~K8!{HGo+do)#Lrz#7c*KaMVe|NYUWAK
zsZ}?2jMsdeu|z!ZWbO;m37Q{8uEbf-b!tmJXEC|(4fl!74Jw_t%mtn5Pqpk3*tCy_
z<Bn6`;@+F0O)Y({EbWXZPg&_jv4D=QU;ngbM#tn`B1%f#o6ayFGRPGCxJIPPddsaN
z8v0Ql8FddWZ+_G>Jn&uh{??RhPb%;1&Y2l-uq5m8itEN4ZPp)OD!vRXV8~#;_3(%o
zL-1$y0+~6tnrq9VJeIvZU-99d9=mzV#|c$B2Y0OA{Y`M@o*TiH%oZzD1dJ|*L{vS#
zu+8{K0dKZybD49?vJT$43sZW|*Z7~fB5iGUc$wEqmjCBEC0doITh{7-Y?`NcoY~=f
z^IoY5dv==LcKfqA;LcnTh3ToU5+)c0J}r@*9s4L-VT0Zx-)y-&D-V_EgDGim6&(fd
zm-e(yj43ZI3chwdW5>I)_M=V_&&3!kt8_za4kvled^NY~#-xM(93tz4^x|urs-`Si
z(DQrsq@~G4=`z;8Cf=!kbZ^;yslPYM^xbCf%->Ti!`*S+E6dSUII+<{JAcihn=?<F
zJ!2JZ*ezIc#%kTZue=8p*GgL&9aRVwb@AJ0eZM-^{_~_C=QQpv_P%R2d)6bP-+9`<
zmpPSN<?8fRdmT-Cy5ZG@J#*%zoi3U3(LOn-M0`G1JNxs6w_b?fVtsl|PVcXI=MA>s
z?<Z}1c*E9Z)y9w|Z-ZXRMagxY)#~%*w_d;=IcI^d-q%QX`4WRi-1(oR&lc<C{5kxi
z>zU5nkdv2ozqwkn^tM&`y@}!zyHD2|R-O+`$v(JO>iBMx6UJ|q?wp!c^*j8}zrb4A
z6jsfni>p3$nA*&^p55uW$7%Dw_)XsPY$xTsUVPAXRX_^&%Y^&&4^CM9%R08bZ|~!e
zf7kt!QTE;zl^f|<Ti5gE@RDVpPT1XkWR@ou8oR3R>jSr7o!r8U8{S{Z;`3eUB+Iqw
z?K@_7Wmj#r?bqk<)$ecFw9&96(elBf&=`*7!@mQ1UrxPZm4D<^(CVkB`PjbX7;x=u
zaDThfxamlvS<mkEjH%blc@nD`Y^EDGPM7tpWU`aG<nq#G!J7K^*k0vr(z(8jtMsxD
z1mB;%;K7x{Ovmo8U3c|f{jF(B-lx6`+`oS%>+I<}mLL0aWyYIhPo^9X&i-{gYO<N3
zPt3jg%a4ovkH-I<k<+C0!c>AStbbR-7uU7llYa}fZd~B;qe3T^g@5PHt$Wg5{r9{5
z=aApeimF?2OXsg%@aD`5v!zVe8E0I`xxc^meOA0%p6Q0(@+k+)`i<AG<>TYK7clRc
z!xJHoQ=53Q9R9OLHtb=1@K$J^!rRrpQ&hG09C~J%o9?v5;FmCJX?;L)=Bi3o28Lcy
z2Hb}fgG%dy0&sa9oqyX*1XNz%V!zp;v*hJrhElz2mX6XUnarT_n$gj_<cymV>%^iY
zmcQ?<mw157>oV3??5CHU`};}u()o)|kA7VL*mzo?-pd~*%VRdOE-vl57ork<>0@A#
zMMdATMN!w^q^-Pg@nQF3!<yRuH1Do+D@A0Umbh{UPCd{gqWUyp!wT0<gE*5_D>aXG
zOr5$yRA~;ktB7z6A6uFKTJ2-`0uwXReok@;X*;&D*5vf}64}M`RoCi=-g{^9Yt1T|
zm$Nq;*H~KbE6I0>+}Lz&?uwOnH@x>QJHNxnBUE&Y@Ivv+-P{4n=fD1*@U6|f?~`u+
zoIN*mqLxW8^0HlB`rt?36`4PWm+af9f8<ZGSWf$=%}ov#b9Po;e4R0U?KEG#vfGsg
zw#}~3UpDAo(3$zStgvbMd%tDx{q6VovUAv(-I%i8=%DzT;3~e(^f~iBwcc2ey!C<F
z>1m&q-2bG>eJo$`*}Io3`mfKKqGN5m+pc!y>J<r}d6}1aGnT#-J|`Xar0<pb-WiSz
znG0$bmz|S#ea71QXyLZ3zQ|>1ue<ozm^-#kdGYv<@sTS>vn5>g-)W^y;p>r_+thX^
zz{GK)Uuvl9+wM7f3!X@(b3I<T<fxKc<g#jw)(`UySFT&KYJIZH`%K2wy>~@fxO%(=
zb&|ITnCjiuSdwUwv{?IxLFeWukC}^h3b^)2sOY&)oPI2WJ$$xIuB)_IP>ic%+oJ4(
zkIfHuhv>~(bYSkuc^q$hQl*#5&hJj#WNa7fu}g!6F+=uN;*l^0wRi3^5*8oDe?Qrx
zICD#XVE*2CfrZ?Q?Y<@ycFNv!5PTH9Yg^vA&Lsj7S(B`t9$&Xz^wqFQue2nCX{&0e
z+|tI4rmQAUZQmO-Jvux~&&@1Mc&)+5rt8&-J5z%ld;2HNeP+dMv)!x6yYO~!#Qsfs
zjHS1tlWLgmGvzm^RNk6>uKhUAT_c7kQNQb^RLw|H4fUQ_F2*ePV9v=^3fXUFmF~!0
zc$xpMzwyzq5*u5K4^fdq9-pP0Yty!0dubhbzv;y-vz6=}7xLu9+}virYmAFkD`J*B
zA06|HF(yqZa^Jrr(E?WS{$D?fGMDIbK0Z7(;U|Z!g*AWtLjCza%BGa;+nBG-#(MO^
zOsNP-XE~mwia7_hHN7?DbLUPkk#*``oI5kSUe5i}J@14`50;*utG|4`i^qax8>jAy
zZCw`O)_7*g%A!RtJ}7D^2DcpSJg|l3$KyW6#ry8=&)M1}c88Zy;=Xk80r?jPm+-&T
zIrI1Y1^F|r+l>yqi(DjJmFjaL?d`$;^+gpe5C3geKH}SE`yv1F%64B1u5Ue)_pR6?
zbaTr^w%yBHc`u2an!|KfP+-r#u4DTrENXbvD&Mo-<KU;lsk)0__nqC+bN;h{tefVp
zUH6`ceqr+1Ci3p7#jT@_d_A3C;;yRPTL1Cs<Uhwwc0FTRCw)`+(u1PF^`c8YvK`_3
zKOv^%L&~n*{hWFX)7{c%egD+nFZ0a3e&&a@+y^thq>78ZHoRH1HFfEko918n53#)q
z{vX4)_Rg8rQ7;s~XKc=_`2JzVd)u|T4O+1)u1kCD`|NNjd+rze{m<qwsk6V15Qv+=
zwd#QNj>}gkB)IN**|c@ZwCoi*3TF%t7G8F`r2h0}<${Dn7U%z_A*W^8ni4_+c7z&m
zPS<m-V0*4OReA@H&4o+*n={WV?vj2kCmU4zaEXn)Te89&mw-bb?#%LkmX~pS^3I>R
zaUpwdC+w*Vy(1NLf7zAonyrVlewr=+x6Lxu<%{(7|EdoEvv}&I)<lb#zTX=C&+{I`
z3O4`8O~vQ7|GV!J%Dwt+eXaF|(%1e6D#Tf=BWl0BxoLgqbCc56B^v47tZOxQC|;bi
z%G#@PwZ^0sf6MtZE^_51xjNpO%c8<lhqg{GD&|hyG$96td|NzC?4r`*61{@TtJZIe
zZd*+H|5rrf_bZQFmt$pV+n$9iT|GN=j^uR<`KcA^#Y=+?ML19Pcs6-YDBGfEe_`J-
z+nc543_^bb-lQ0Zm#^~DX?o#SzIZ>Q?8fr^dH>(VstBG}{eCWaUieA1hfjO{hO}H1
z{qFboakKI^furkuwuOsY+uB)v_3QWdzxh-&U4N&DW%o~Bf7gkO2CFM(lrsGLEzeN=
zizl%z;d$lJ;EG7GMLerrp0Kme4ocDCFe?q6Zo?5V>EQ0J)=E9CSxWqTUv4Zrx7e#A
zWEP|1U!^tc&LkhT58a*`G2{6p^ZYW`N%@f)H<!j;{C?JJQNZdK4|yWJCU32*opxVk
z>4}LuH~R}NKN);<$Jak@A~yUfJ03b}ZHtzZE|J=O@Y^i8`lr@^?SvvHF4>c#rt{^%
zm73_7k1u{L?f5yxHM8h!^NjVca|NbFi=1hT{Wbmn&u2Oje~PyK`1<GS`OVC1^FJPq
zzZSZ~&vMPVWY-g)RaWVhvu<y!s1xq2nVchS5YVFX{P|C}FV7?o_MGV2s64HEf2;Ag
zN53BnOY8Z5%1*fP$8^K_^2!;i7g>96ef}-I=wxIJ=Y^>1q%(>94$X^Ownv=3ac<tu
zb(2lZg8wz~Pgn4dla-N~vULs9l;~-H=3ePnv1K+~yk^>_rnx)6=nHw?57#zJFK@Y}
zdCB19T*>Hl%d#HasJro~`LXUC&0>bV(-)mR(=Yq^U&@!io}d4feEFOC`QObKzthiF
zTmFiB^!s;n^Nf6n5Aq7%OBw4M-rA^Li~ZNR{J^_2Y1N1J)VHTEbxGXCqPnJgivC*7
zSi`kb;^gGy{>{1bVNU1+8;9@45v{o{C!N~7-Fd{ir%Y?wwfLEFz(*Dlo-&jDg4b=*
z%soAJ2+Un1p77bZZAHQ+5uZ;=EZ+}hiW;Z?{B`!}&)4Da!z^aU?yIZa_~YsF&*ANC
z;te5Q_5xfM>jQgLSGOpgO@CA4{N9UiotC@Tp)Jomq;_b1^LkQ~HGy+RxY4K3Gp_%B
zEH_|gT*xVY^jx?11gDb^SReJdnj{9!*leo)=$bX#DUrtGMn4K74fxNsC@~rye)DQt
zc4XN0rjJv!C!JNfBP8$Q7h#c+74-4ao98WVtBcHyyBB=f;{Nse!Y4Zx%x?BC{h4xT
z-)v*|&P$n!9~K{R{A2#uUB~;A%Id%ws?T{!7<MokZz{`4;g8^RvCE$4;Quf(xFA8%
zypGqTW3zA2sa2Jg)vR{H>OVF$$xhwwS^Cs!p7BeextrCC%PvXY+AVd$$o-JJrrS)$
z1(W>#NnYGy^GfuaZMMQ*-_wzN%UbTAk?{*`-@DqSkngvrU)HtuFmJa^4b^IHCG*6i
zrtuDP>|M606&oKIm22gu9<$5TTG9LDWm;ER#<Hg}U+h!FpRcd8t(M+XS^e$NpYlV~
z+kS52+rA=qi5_3C+Q!O0nXP#r{w?3WULlTEJbnM%*ge%P%}4t`t?Ya5n)uL>VWrBi
z%?7?l*M2N9d3&U2uSvlz`3wI(*&e#zmfH8~rX%COjdwx?GPlj2S()EbQK_m@#T!z3
zV<JacPHda1%OcI_>!Q1#u4&`^$am~H&m89CDNn+tTu;=@`VjLV?U3}uBiEK0oL{{o
zM319!{=WZDzaG8mpD(_D&i}G!uRFs-Lr>hiygd5C=c?YHM}k|v7RbN2ec9#ItkcWY
z)$9LlpPbxO_4D2Kqqk2#SiaqU@}2lL)--qiPCNFgue=SruX03k{>t#2#r#lZ&E+hv
zzQ9bbf(cLLD_bh(3a#o@4ioYVJmlpxb5G|ft#>&dVZ6%@?&oORy}9kil`T8AXG(l-
zVz?6`%Cau#!^Qyf)CC+uxjhpb4$Nks>E)PqHzwuQ#@b&hMjc*?2S2VonB2_j$Y+||
zH#N{wIbgPxZ*y9x_8BGH4VrTUF4u)PU1cn=ikzC<pqsAonrY9WBl#+gyH`HFu;Jdr
zs6xX{b@N~D{Au*Iz+}6;U9;Op<M8^Z?;X}p`=4lT)<5m;AjGd?vscwniOuT6k5WPB
zx`+2nU+&RXn{s@?yykCfn?05=>FjpWjbXP`eS7ZJK3A^B!;bf4S{8_kEUyzPZ$44*
z)u8WgS*k<5^1-M%p8bzxWG?dZPjTitz>(s<(UIwNs5p}u&!jGa+O6&J9cI<L*)A8a
z`FKgz@x^=R1;_4O5I-?ZA!WKw|0T~Y6C7o#1(!|Q&XL05wToNB_=;J#ok_>!pxMhq
zr=EFJ)iTZD?)H%QE2&4APpy9D`|NX|%FgTwhn}re{TpPpwjwdUdsh{QP${?U4t}mw
zM)$~`SF8;xE^Bii?ChSK{Zw|w4udsXvE6<=j(kRvof30i+*!H0_xobwg9%Dz0&8}!
zDsItSZ5GXT=-k2|*IvG2FL^G%YzD)k@@pIAoT_5dC7;Y+dShDRGyaP!Eevx1*j`(*
zfI%_oi^BB357g|w-;_#DWV4#$Cm{LjpPrG=RnN`?Gk?r7JF_TchU5;`N9XqIDz=vT
z&gB=CH`BQjDF4XfoErPHM1Qp~iOu%ke>3QMAL3`1l?igW6mW8KQ0kOpW?jp8-b}9j
zP~<47aY@&nXTixo$^RW+o6D~?U7#l_vSpp-Q-M>=>rLP5JYS=B-=)F*zHTw&H>ve*
z=_{^lJhFX%^>xkcPaip5_oi*|WDNY*db?zc&H<yv54irAsjPg=%}_M!DVx@(f7vQt
zcC#<u$oa<hKS4n4`G>pno_?In6}Vw{p_AQm*V@I~xA80Of9t+%oAst`>ltbfaZUW^
zo^SlZWT%w5$eHaQ@BEnWw?I=V{%3H3w9MK!JHnT@a6XxyJXf#$al+3F*O<z!wxmcz
zY*<mO{yk#%B7Z|a7i<2P)_Xfdc$_CaHPB_`Ib>Uuv$O8>Y5$v-gdVTr<q+0BD;-&G
zQWc?c;e^K(izNHct9;*UE?dbXo*TIH?Sw47Sgr$C*lX;o7iCGkiLAJ~&f)tjlLJ2<
zRI;9!HHq_R*YddP6J3|D&J8Qw*ZQnx>!UAUmMvG}E#KCck|-L>xKQ=GD*tH?uJ4N5
zji3FhpY^AE@r_xJo=mUbyThhE=*t>sD?N9K-75V@=l=Y+qdC^cSHf&Y6vLeJw<4B1
z%eFKK{B{cXkaSYa@z%5c2Ul+LCiytdZhPe^YX3Mg@GaW|t_u6$B6aO~g26V;XACqC
zJhwR$Wi7rlz@}w(*L15BbAQ;^{g;TcTQ02cbfd;-nlF<#U%B|<#PGr?g}1YcjxZ!g
zH9L8|`G4n=N$T~TJI?B^UbD_gYgh8c676d?T!sD%9PUQ$F!1NRe7itBlsh2j#-o>y
zP70^}y5i#B;+HGCPVw@@@I`*fLHb6g@|J7N-t?&I^-I28cYmGUxcETI!Nn<?7q8sM
z`s>l3@6*#aAD{l&{!c+s)tv*yx&j(E7JlkIk-B6;H%m}$Xx8sHA-1g_eIry}y<EBO
zs$+?9XsPx0*yq-Z<^))(9EooF?W*-8f8j07JCi&0yG;%z^z}wh3YsMSD{QUzu}7;j
zZ@h2P4eu>`J1z0D_Nx=w`+3e!xoc*3b5$~%Df6$Od8#jT&H2_mTo`)hy-8p7a`)Cg
zxw}^rmq@e7?NwOCtGg`F<n>?o;+m(+Q)OK$_B=~_s6O-0-1957-cMi+i{T2~`c+WJ
zb~AG)r;<e^yO6okn&MTn)U4K+Omt2z*=OLyV>Ov$QTffE>tzg-g@0Js&(!JP-xt00
z_KH}6#(j$Cxz;cL@NfPTn_C%sZ?8{_KWwq!Z`+%upyJF`m-SOOtl9FpV!^fRvqf_%
zI?@k*c5b+`@!^KGlci?*{yKL=raMd9Z;4d!-tFwYJL-4rGWk$je$igq#P6`&^2=L~
zTlRlsKK@i-t}FZ8csA8C*&HDS?RQ^nmQ^LqzW?ZF*zX<tzo*SvUuxDBdvFyGbIg|e
zIj^_$cruGzU+lZ1d{5N6a?$Clr_K#czPN^uL*??ku33))RbK5`l(G1H-z1qSO1@v8
zGBh(jHDK*vC^9T;_R5Qz&79ddN9W>}pqW|w7B0yMS^Ij1n)d2t%2~R5?zTzI&6*Z{
zB|6K$tayps3VAUJuGlrN)ca@c%=G?m{p0;T$%uUUOG19DJ!hm{73KeMKqM&QL^;!%
zgr)*r*Hv)`%Ci4vsj(i``&kz&^}oclc>mOZX@d2$R)sV_FKu&=yYu#vk>ryfCyUB<
zEt0vhTjFG`;9K{rt8+ICe45>{ckSj6x7orEz4DlEYPs50S8C$ggZ{@7)>ZUz{@*Qs
zQQuyA?%Iqki5+)%FI0d3SZC+7`DaOFd{fDVH*6>7ne?8FnIc(NXg$~KG{dB&yjIb^
zZEqK+-S?7<lmAk>)_W44aLF%@#o<bMUwDNI?*0f}Cb6{WmQ2iq?oIyDa+51{XRYa;
z{@MEL_LDpNLJS+1Pn*&e*J^&_@teSlQ`jmF%sj#LInwWVo}$?on;ssiyNh&v0$P(w
z_c+O@{4DFLjfix1WL?@`I_Z{^Wsvf#$qSyi?CWjcXy0S`;PtH^JO8WsYb!BKnkK&G
zV}#$ES?_)F7<p0~6-Ab@U9Z^1;Ms8ZC)*Nl3HM&(<AU{5_rx^(<8bxdKHFo)<`1{#
z#0B&pV&$2<?sULgCOLHr&-oSK&K)axzSCIj;>p=_^nIgmS=!qDbo~D}@UN}y#rpl_
zVeyA{-n;XlQ0ND@iloh%|C*9}_CNads3S{lqR*97Rnhh>LEEynyFJ<!5n^Xy5V)i|
z|L4-m?UOkxtdsq!>rdUx@0m6=ajUP}HKqLXVzaDGE8Nu^7gbz;FQ4Gu)Yty9<4*qi
z{6ydWsa7+6eExEMIKuF6yOm}l!)^V-h}H>TBTp<y+wZx-di%1b+h1OqXL2-_Jn(iC
zvb~`#ut9g)$1@odDo$3d^|$>d`{14UbA#y&Qg4_JTnpLNykyOk7a7GfrnQ7s9#s4+
zlph?(H`V<P>jBN3QM*gqUca^Mewn5{&+Nud=7($x*gQLSEz9T@J>4i+dN}ccD?8(*
z$~P@`0&H8Jtu$s>d2Y!C{p$juyY9+wm>t2BFaPFd^%AzJPv<YcQ1WcnW7*3>JA;?+
zuV|ZmOs;mn{9fCXmyIh=3oI<{Tzodnw0GUV?1`2yi&vaqZY}fZ#^Z{tWm;h&%)OV?
z-V_Bc3JFh=cb9%srrh>3w)w?9t?*Fpjn&7+jP8AoDOKfcyZCCEPJ-E@xYUe8Iu~zz
z`d!KV=S<+vuw5>zZg_=HEf@K#{K50Zo;|F_H!TA+ZvA22?6J$eRP<II*OcP3xhpIk
zO0_vx)vpb(J9H)GNYL)%t#cPWyl1C+CwtxYJvy#GC05EBax|Z*K6gfSrDoi*<`@p;
z`6(syPwi1o{NV38%Y`#eet~q%lk2)ATRwRl`@W}Ic(uEJ&uy!}GrazE#O|y6S9R>%
z+#Zf*5%Z&N`MiwJ#iUPeun$lT^qKXltU&!nW|G_6E#((;Z?1nj@deYS9(T_jPgZuU
z`0&+8@N)^@gcTjj3a*`vnV|kb;JsW=q3a>}?HiJ;R-G0)Bz=PIi?~0(!_NSVsW<Y1
z{oaXhy?t=@%*xO%lhBRd!=9R!rG%Am?|S2P#olEVSL|FK)rm7$X73IaX_3|Ds#i<q
zRQ57{{>DJO{l$3`J*!vg?bdqy?jrdMtxvtKdaYSx@S8bUDd+o@m~inmj@Qi>T$Gy|
zcB)eESC&_-{F{ZDakJ7s8_cY**w%BmP0B<t!Krwyce=#y2I~#(66P1RHaG;mWBF`u
zm0<XMI%l56i=aD=Ci&0ze%%;)({`my+=h(A>fp@pI-g3NL#hv$y}oMx_iW&nop1V&
z`!N;;I$4Rm*e>heom|qKnX@cQcIK>wdj-?=Udyewy1##c=BAv34D3G-J46>Zc(0T$
z)!HsED$3C0Gr{lcY>DbFty|x{cc&L!3)r1{_X5K=`4op}A(P0x*Pb|jxU>4=D(e+J
z;{WBReOJkttK)Tj-}&Z~&vMxAIDJ%4H~y!&^3G$<-OJb6<W71Ores=t^{-RA<@^6D
zj>Ye(`}yq8qa34SvraPXx2@mC_WDc#^Hp!D85^GY^_=+s-L+}@uKnw-uCG6nuzm4y
znWA96y`i7=E2|yv3I)Apmh#TOyKM3Gpgp{N|IYf}Gc<i4cl>&@@{%3B`<Hy3y?X=m
z=lY(Rv$-e#a>^-=y1!d`b%Fi6rkvjw@9KNcU8c3-(uE^`1QHzW?Oy(oIZ$U{&uL*}
z6JmTdmu*j4zb&U#p#EW}zY7#D>8|qD*=d(#x28LnvymxU<Yd}m?_aqQIUBS%zD75^
z<4-)J&%7pH=ZkqV|I+uf-Da}|+21&+nB`hheJ}mZ+>Cll=dJrEYL<yaIccV>*v+TN
zYS~b<bN|<wR`*m5{RK`OP`@2B#pYY}p3JLPzJH(l|N8Z_``^vm8Ma^Y_1maq-oMe$
z=kG7vcb_e)TS{tjrcVDI+5VCsp}&mopSLXz+b^>@ao@R(cF!tmYVO|qc~!pD#dhBh
z`9i<j>$(4}@K(A1Z`z4h59%3ECm~vVkDO=cVqlPvV_=ZQwK%A_JTnb6pfy)AH~;pI
zpS$Z>uk$Uq6X7-c?Yh~9{5K|j5i`kcKE_^BU@NP8(M-Bi$U|#e`R@Pwo-3-(oHW<O
zvVMc=r1RSI%lE5nHy4jTls&OvWo5<GqRb;f1*U5MH6k}Xdl>np>cgZt;!piLuil!l
z`Fj32ryo_`%d-9K3SvDbeX5=(n#y<JNWnCIHt*0UDt*(Zt`zA{R{FFlpv^#&`*4rO
z5;>k%rblP1$Le~8s>Hk&)GP@x+MKuT%sP=G*BNS;r7A^CJwC6AV03tS;o59VqiLP4
z#TlAY%#@G6e`@yd+n0_z#Y-P5`gQF|InddB%zWa(Fy`7g{T`1=oz`;8YXa9MEelgP
z=Ad)ZWY)jm&y4K;Uw``Z_v(K8UUn8cTQl*gCxYr1KihHhe}Lq+6F;i=J$|XayHrug
z`0ms@>|T{8Rqq5TRd82cT=VwN<d}QvtubAp-VE=8J?d1ayS|?j(7I)M`20P0^na=w
zE53KoJe%)bryi*{DSP*;`S0&Lo;~n$7elc$&lfix-=3%wN9)%HM)dYM&er(pBYok!
z$u6;5cITg`IMr?akvY>)@#Ty&&y=@+xK$tdQ$PPhYuo&c%>~!ue+1V%R&(#?W%E3?
zMQ!_u++=pg&jvF5I%mFKJ^p?A{KvD;Pk+B|AH#fxe@9n#o_pKab29X3n9R2oqH}Jg
zPJHAv?e6m{ie5j3{<wK0KC-xA6Wzyg{}WG%!MD<jQSW9%nCfziKKI-Ec-_3YK6Cpo
z6fWZ8ofRkIYNo`bljO4^U0%c>EK+Q{%d&~ap3@>f9r$wGN$&95mUj#n`Wi2=RaoRL
zEDde)YY)`6xD%&brk&~Tar}$muUbj<v(Dj*I{$y-kWxQ)<S);6p2J67Oien1?YG_*
z5PZY=#E^+CXqlN4+q@$`471Gb7UVoEsS;2A!hGfT3<*aQzju!o8KtH+N#0dkHK`!b
zgy-w78!ZeXN&(5o_CF8yY}~X#XIc%jQ?c#LRj+Q?+J9trT<M`$<e!l`?O}XFY;MrH
zD@P{3F01<Z^7%^xro%$125&ArG7I?~Wsx3v?6UOtvXvnV4YWTv`zA$oSjch2?MZ&H
zM$?crve0=Sga4d6aeLHPtT(K5^yBEClhn>$AtF5MyO6tsY~PuuzD$w58(7R6Pxa02
zs9C4-(=|NPaa+YDwtAs!&+9v11RCCFoG#D(dEJVXEZ6D~t#rm|--HyEid45Ue!arf
zw53$3_+a;gtofe~3(XT3-OzI*IIkjTwXTx6WO_l&l`SomGXkV9I=n8_6q3H58zMdF
z!}~g$+uW-xrtk<oDwm)2-!J22<*MY~RCgh3_j}3*87dfh)$T9dw^6E|kJ;pof$G6e
zr6)=<4w}9_dF9!s*gcPm`enOjo|33|x{UArhkYzxZ*5<G;n_}uh4ET8PP_J5&9`~e
zw|CW}#4ZkIN3L`39b22T^3(NC=1wfOS?ZbB?V)SAn^{<?XU$Bni*Z4(dosLzCMh*5
zI4WGL-{opAJMnCkO7<j!mx{g-tYt4UZhdOBFm-=2OL~=~Y=D}|oCQ;pJhrl!+~iPU
z-kKex+3L#wWYLM|qP{<#F?({a*>GUjb*6?Jc|O;UO{uD>+Qr0km1*^n;Mu1Px9?Wx
zIB-%n<)=ZqP~DYG&dg_Dj&ILDZ^QK9VSs8jkLUs8$<_-Pw(6dDklM`la_*f8Zx8%7
zn>au8g7o|eky*|gzGiM_J0!i%AX@XD$d1NE7gw)eE<fSk^qckj=ADbLb@gS9_g@_T
z|M%ky-J&OYB^15(nCY#aqn%dKU{ZCZ(LbWK;M|mpE8aG=g_l&QOf#IE(6>6W`;B#y
z4NqXh<#%#QnP&>rHf(V45;(g%^2?EfZrY(CsUOmAluLvkH-E>N*0oP8d267~KF257
zbBaE$ecv*7(Tf9uujSM(rK<7VpS9qa!JNJGn1fBSBG<-Vx^(qwk><989}Xn`y=%t7
z_>g&*$<o+_>9=b5zb`r+{D@Pmg>Q+t`?WcZ%a5%)@SSr9?~32^<hIC65|}cjg>TNU
zimEAwdw#JPzj2)JvAUhhYm&q&-`O(r#2@F*VZCtVYu;at+2Wa3d)I9Eq%+roNAb`F
zv0oFs%<FAt7Ps#`zjcCV*izYTv2#;`1zBYGHb0oU``ts$Eo;1$y5ttB#X3yhQ7!k~
zbN=&P)9)!)?3jJ;F|$Ihch2?N9~D{e51*I4|4^|cn1i$O@YbfqhHqF!&K&2S(ow?p
zTB0{A=i>QU+Ak!;TOX^uU@`2rOfTP~CihsBy&>_2?(UVV*WPm5lxL-M%UVrw{?}`9
zLRZw(_TE`)KYNXkkkev4-jqtAU0<$lF_}{KK=`)jtCMTo{9ep|8(z|8Z~x$Wf62R-
zYd9MgbSHmLv3=)ZvMIFai~pZ_w^Uy+J^g!QzI)HBIEKfcoO543{_3^7|5#Y<zUR_E
zvfkY?4yeBRU1#-<-8rX24{tqx;U3qFHf{3<I@^4vaq=@1r0lKp=e_Ns@T1+cHuLV2
zwCvTw)?P1S`d%-zSr$J@S|(tQx$BOm+a@nnx|C+GTezs``duamNglT)Z)Y$q*1Z=W
zbY3%S-<%vlk%$NH%KRozQFUQ!KJ{X{bZt#)rs1vm;a`^>Umx9gxlB#`3cEtn=9-B{
zn`9^JUXw88eyfxB;&b@phEqJ=N_)P@d2>E^pFG2I#m~lB${yz)utrqfa5`?Lb;5a)
z%keeW-t=xR{wubF?I>qJ)2gi}`YhbHzuKU=HlRF!^VrIOhP45^7c1_FulgapY2*6E
z_i~Isw2Kwk*E@f=jk8!}$N%H#v}1-6+juTrytrfEU9)9Ou8*7?zHYXD_HLd4`@H|P
z@p)^nY-iF~9((?m4)eRKto~Q-^IweT|5CnYa@?h~D33Z<nf*Jj9lG`@^yRbD>gr3@
z8&+i)&G@<P_J(?)&ld9=zC})*S(kR^h?C*hGk>@~W%c!D^S)JfEe&aN&RnYy$f$00
zY>v?8Rz0KbjJaXiTfZ*+QPA@9&caDs1xxzghxl&`_1qq?sw8@<o_@P;_l(~22j09=
zW19FzeBH~$=NFHfGf&Fc!uMi{?myKlJU;|XxbJgi+=z;7IDPYGg`LfwH+sMJ{xhBY
z!oN%^B3ttBrqCW<Z{J-q!mm{Qv!-6_off6~)<<ghr4zILZvR~r#JSy-Gt6Y40Pjsf
zrH@()*K=+7Hmbk4>L<`9+C5#;de+kZIfwqd@Z???_i>73+F~=d(ibwD_P%tV%eg5w
z^VCYevO?W5W7YS*udI&zUfL9Xx+=*r{lCVv_uUtAednpP>wZ!2I&omPQ^22N*Yxjh
zd?S#)qV;W_b<M4%8H*Rx@@gzy+H^s9PexnK?}OZa9x-_xaXjn=Md#gSmMp(v-lzIx
z=e!S(zg)e3eB&{$<9BYfRBcOLo5%OFbh4k+?oTJ(q}6;b%)Ysr>(Y+*4tMl*)8&5s
zytkGw>f^KX`)~a%;A_tIf79`+Uh$mN4`o~5=kqtF@jYB`zxZwKga6xZD(?IF0BzA>
z#hRy|Yd9GgrYPf?5iLv10WB}z8X28`+d{1F{Q3t9{FAnAGuzA1Z1^BD<xYxP#w`}#
zG6QCFfsD>=H%}~b@bcW_`2Y7j=gvtQC$}$q-0mX&=}v{-eM>7f^Xu>bOT~SfpxVW&
zuQV;C=G;t~iI=Ced7ITdo-ZRixzpqNB>icUmBpWaofY`^$0u)kPfd!Kib@i{j@U~s
zv&lUduU@<u(<RE;R5|bIBv!_Ut3yuoTu>2|JiEi=%EiE+J{tB*Z(h2S_Iipsx0C2j
z-IG7|-Q3r8bkS!X)sCNMY|Otu`y2V`z*3KZZJU=*SbCzyL2gD!fnZD0)S#1WPbQtu
zyRK;*(h|3vXQFoP@5Z&KzwhWh?r>OVh6ul!x7fXU5kUc+`5qUF{qp|a-oO5Q(@FXC
z$^7E;>*Qqxe@tDoBIZa;s;<|k5WSFMNpCr)iD!Nu()q)2{IGD@#51nhb1!Z`&T@8Y
zuJ=?Hb#KOd7h)tfPEmazshB?X(EGESON*cCJTFX{_NUE!`vSSseSL>!Xu1AdVra^>
z>)9b`*-R-zUop#A10%I_%sM4sg5_rZzMy%{HHUBAQQ>*4jjJPU<ORMRxzMI;@J02{
z{8c{pLfdVW3ak~16`MmBK00x&biv6e`*lqLTua?j)Ld*7WY*Xy`5k`NXTECNN*mT%
zoBflrs=`l(bS8QR1jvNc9D8<Xb!Ssr-A-|zfVi9M(?d2M`0;9nO?cfaE8`DuBRnRi
z_kBNmkF}^pr=zlnzxrI}ni+rXB7#ES@HrUQPJ3K-WQXrZwj)1FYaZ?Yd$ay+#aBhu
z9#^dZi4P0Y*xe50%1QoP^)@Oxz{o?yQ<29~ZU4pz&k911Nmj&8;xzi0ed|F;)JM_(
z^UtX>{+Ow?_h6M=a^5Aq1vkxPmK?6FO26EHLnq#Z^RVK}^w#h<%bxSJSM4o!SKyp+
zw`Jj^+_Zv#%z2SnFVs0>H`X4#f4k`EZH7nnv77&}TX^`|UYN(9x$z2*zWdxcJ7?Nn
z+K?puNAOKJ>+6_c7UuGdU(?0s+d16qyfx2$Q_{XG{j=s|&zKbcI7xYx%VYOlVXZs&
z?49Ai&Mq!KX5P&`RwcXJ1B2T|Hnsly`h4^2^Wl>>&z>!-6Ld02(`i|V{`6(Pu4#UI
zcl&Z^)D#8QJt^kZ5A$q3i%-ay_qUE^&ch>_f|W}yoeI|X@a^~UQskeUZn0dlw_Sr(
zLFekUb5pvPwfvG)*c2<tF{i}&>5E=t5x4bH)=xsuKFOPXO+vNu7?XzG1VLjBn}f>d
zr!mge6cpFrv~=R`D3Ovx$L%-r|7ZFLyTrWP!1zRrLEAq-RY6&3+7oTH%wsXpV&}~`
zrnSC&A?}gEP}Fvqb^3vfH$7HPw?dX3;Fz4S@%z++7wVLraOuZ<ez5vMXLKgRCf|C=
zyOnYMJnQ{?1o%y!wtF@1<`;VW^`x5RJt@lyp<|Ut_{5&RUASn^U6oVT%3KDE1YOP_
z+_c9!WLkODv@(SoJg*i6h<tcv#j#Oo%DVp=Pimj8ZE(td!~bLJMNW%blkGVj4vTIV
z;O5ncX(+vW`)&r`t|t=&ch0I!O>~=g(tNpIp#RJz2W^%`XO|?4hAnH0xZva2cI@g@
zu4{%fFYGwyw2yW6SK-T=6?0ia9+tiCi8}Lr&7Q8@rJJHzcRzcxlzrKjN3k7u%TruR
zobQHw`zSM|NpW$Z^D(BhUh_sF{^&PbCie#IFR*;eW#4<!^ZM=ZEXH)}@(nYMH3BB3
z>zXbKb@(I1)${tV%KnJ~+yA6VGMa2;2oLjXU$sQWAvJ#cJEp^K;fBvWS(eT9)VjWG
z!ly{q$y+Bzt;_RaNnH3%lg(khM%B|0hAX=31&Zd*ujR}8XYse@TU@c*1e53fj*;Qr
z_ZZ6VoRYb{ht<V)M#@^FZCb1v;xE#cuTgh>?Dja**<$y;Yf>2&r$zl2Z1!?`b}gT6
zm($nEwfEQ=Bkx~bSh?o*rwJkw?MIyMD6dezIced+Ou2NHY^IBrUYt!2nf$y`cN}pQ
zI`DFjqpl!pa1aOg`p{EObF^IRf|b8?AKMub^gU%!vBme(k8YT!DE)bxA$n$#QA54Q
zyMyw#-1D8w0t_zwZVmpKYX3W{`)gS_(+mEZKc8g<<K<dKzdpXV;&^;y@2*Mm&Wa})
z7@vB6kuUgT+Sn)XIOO+)Z*wi(?9XpW6HDnbiMsWGt?KoRh_6Pg-f%6w`mwO{^2&Q@
z?BOSF9CeKgS7$c<SX%30k@}@{`MYy-rQbf&Q98f1XU25{w)x(cAO1~T^`txa)`6E>
z!XnaNi%ip1T^u-Z*;$s=leh4_;`Hj;_2`eornFN{#UiU`@Oms`uXfmD_^kNX<n^c0
zCww=Ib3Ypr?xsHLnZiP@179>UXBpiTS=s*GY(u;|f7jRhEK6oBGGNYTv)+*2wf$eq
zF~hk>bF6aNZ_VBMEw6g@MVVE7Ray<f{t<I!m;5@enQ-guOolUeLoTf{NnE)gT6)Fy
zWm8_R+gBJUus(Xr7pHYm37efy%zJUe`T4%H*SZRyD*ZUjFIL#Yy6BMl0TuW88N3x<
zCK<h}@0dAEVLg<m@v^jdM(KiS3ywcA>C)l|VepvK>l8L~?b_P6Cf^Qi3_BS!(S6zL
z0<NPX_UjVD)<tohxmvZSZ?)1y2O;N&r#{7>m^P8Aps}N_otahHO>ADC<I6UuE&Det
zacJ`Me^(X%=!^B-buT7!r*f_Cdj042N46!qet$apaZmVq_rJHjmrP8E)jo1$&f9NO
zn!Ofoa+=;6!>>8Zx{#}C_mf+?#i4T^HF5t5aeLv_(8zjdkzDY@^|vG5Jepe~dfR7-
z=Y#bIGW?Hgj~qW7_mH7gBE_~R{GM3uFIIyy<+~2+-GBErnM3LC#Y0^R%_e4TfhYND
z7s%?|66lCGv|!klwf}g-wVXA7KJ7^9tn2x>*l||h%zw(;&IW{^b4#xOaAU`X|9^iz
zefi$}=yNk0V~xuH8r$yL)xVn;qWJXb>7#%8?)}^m=@+*1R7XWZP?3O~R@B3zrIHus
z@;p20v3!?kqo49?p8wfhx7(j;<k^}WEqXKK{OW&}H{N*Nd$Fv7+38pK?tQZlB`Y!?
zpOSO@!Lo1L&Q3VSWSCpC*?!5*1K$k{Hg|G_Yq%_so_|m8r<uRwiAUW!|8gH3dDrgy
zX1{Jkvd^uz+s|m*Z`hD}x0qLl_xRb_j1K>g)a;X14!)ayGLKDo^ZH%fQo^TAYkDSC
z^{o9Z`f~bwX2axi?v*KAvx}s6Yiv&m@VYaT>!n!X{g>axYJbo6Im62Qn}<8Q#NypA
zw%F{I%xeR-3D)i1W#0Gdx5$4*uITc6V$ZjjZZrLBk2>zhz`(%31R@w17}Rl%`{ia<
zWabs?$H!;pWtPOp>lIWoqYWRflnS)VU}0dW<YHh@Az(~mK|xNcUP0yEu-kc$%>-(%
zhx1HgzuB=iW}B}#+a`xsXWvPkJsKh1t<&SMVClr8ZAx2JrXJDw<@mR^F0y@5%ISL|
z8eMi*+2(XSnKRR}IBkXV4Bz|r`PWxAU3yS3Y0(y&$1B_mA~&fVe;8RJBy%WYYWCUi
zovrr&8#YhgEZ_F!v$D?;SI61ALS{v-OA(Nfk@4AD^+;1n;|KS2HlwASYehIZwY>BK
zW_R?lIxY)kESwX%?UKat1Kfu;9#|5xt<BhRbINtq>Dmcw&w3+8Tv?@5S>v~rnZNt_
zO7-BS_Cv-q+&{0syt?Ag%d9`ApL~0)!SHL#x5DOIGyJ<2ZOYO7FiYCoGGeO6#^i=i
zo!P3~N-Irw-O?-V&lAc$-#fdNq193TnBtjYKXx92h$8OJ1L{|rXRS+$UH4FO;gyWQ
zWeLS@Do-*ts80Rid#A7X#(}MNYzb40;}i=uSyr5x>C|Wzu34$9owoMb=~IiCPwhCe
zr7U_T<Ato|=V2wTO&S*tioOw)4cPct`pTzpADu7riswDqy5GehnIlpw_QK~~jozX5
zpETG15Y7!(-ShvC=vHk#PvzrJCayAUNY5+Yba#guTjZnUEaR5$W4Qt>Tg}(6FZ+Eg
z@JjalUyB!*shzA{bjPzz^Ssd&4dJe&&To=|hs4!(3h*3jvRrs|PV(oJqPS@;fwDLM
zMl5~t^>x7GAJ0$U46P|Q?zNAJuba~wcm3j_h`$br`iCCcif+BqHAi~sVaArjK2tTi
zjcPtj2oe0CU8r{B)EAzv9EK(P0>krbCH5&dTI-wc3J;z9l0BV6YJX@<@RP8ud!J9<
zq5NaErpC+8?xx<ib2fcD`>ObUz&tGzqb(CQtE)^bNZiR1Jay}yxgj>s7<Sxk5S_a5
zh{4Gn^EfmmbR>PbL|${~@y=BLc_7n!5&xv6^S;MUGOO@eziQWSj|ZjR2An^V0=?C4
z%@K-Ho<4I`%B_>xE^|XNJ&So+44=(f<Z2xIXxql%tsS3MEHL!oO%hwjC8#Q8uFZdY
zgU34;r-xND-Nf%`b%tEuHu3OT$5|e(Q>KK@+1Mn^e#|JhceRIpO=Y#*x9z4S@@qNX
zFdce)>P7NGA+>D*w=F;2%?!QuI7W2Gl^=UdKm2r_dvssMLk_V>i#dOu8Pu(3%vcxn
zw120M%hX5OmqcRh{(0B_i(hefPGQW2eg4g-r<{n)T6TT!1Ph+*EVjOf?|&|}f9Sk_
zcI)X&58t{TusHkguJpQcgRrR{vB6f$A1Lzw`oHDLxzpR$ltdr7Qc@bZ()iY@ZQhea
zEtpn4KG1vb#@7ogqVF!d^|{OK_@d2rFXUcjJlHVLq^|4o+$9^oK4EiQ7rOP-YtIQe
zdZzUU3tsBBC2cbk>;9V}ez)PIHE+zy9$(pudDnh*u0C}4j9f>b+1kC<scFHVw~Kpy
zUd3EeD7}h9<CpvO_jY~@%dEZ2<7?)W+SvWo{8#j~(roAM(py#Kg;hcq&2!4{zk55c
zto;1D`1^NzYpwp~FS56)vTc6(<;~eRnfzUWm;U{{_iyL@|J<kr-tPl?*Av+p7`!DI
z7?cQ=R7JVq9T&Ozx7~#Pt&2A-unTZfy)|v(B7q6kEZd3=g^s(ua*pO;+ZeTO#oCjx
zY2}%bnxF1lZ}tva^5#h4`nL~nT^65sdhYbO)6>(wN!HX?etP_5?GvX+Lrd@0q9V=K
znFmi#`Z#rl&*SEU#unF}9y^iqG@+`%Vy+MWGWG(!HDMFFq9?xI<lt1$B-(uN(hH_Z
zDUmx*b*L~#PPt`~;FWoN&XrSqY}M7(?_D!nTsLiC+a@C8T3jG?$BV(3RVPyMGw%!4
zg4iiW;>V78SV>&5*_u1=&ax?5%xMo-T~p|L>{jA9>sisox)V!xDaL)R-~4{5W?%8L
zO_O__4*psD|CZ28BaNv1eIM56A6a(u!m1l@9_-vB=&2<ZI?Z76%_?Pe!P~Y!CKb%h
z7XHTbL}=Zk)${fICqKTv{CNJkdw;Xd82*@Mag=KJhTVH$I{EV3p#0a@GQO8suM=le
z+OEV=!4|IFDXn7=;St0en|*A<6}B$losC-=N@facxw0F&$8BQbs#L$IwQ|FpeG}fy
zid9bL2@@_<GvN9(=Z+_zUQ6^#k)?{F#ph1AK4meC@=^`b-?l0Fz|~puYiDpVZxJ}M
zF2TG>Le%!=0&#opcL_V<JokP2bm7=FrSzq~jqhjAie2SiXi=n=|FJmq(8=HPTNXwL
zHEcYeZ?NRphG}`NTh?Z5QF!dQ{8`I~MPk+x2{+V4G+Y0?V7^^l+NNha@y^+`&e<_X
z^Ot@-fBm}0&+c^5sg{$qW*z)fB_qc7LUmS*jLTUsv9L{L4>#N^y0OlOxxMe}$pvdp
z&0TtAR*cW#eT!#((vV{Qcky79+_t~pRNchZDzMG})9Ebozwh|JNe`NrOEQNqdwVMI
zdB)$vbv^4|8ZgW2$Z=-9Jp3%tM7lzVWkLAVM<rg<yti|nY)EYJ3{y~AG)bgX|NeaQ
zA6uE@j<_t#XyWh{Z!Nb`N?I0jN%iD~t{TgxllBkhhLsjo%~EY!$oxyndv?L%wRh{5
z&QF|Vw5e_Pj%M!V<uMfpq$UNNI~b<Q*vNXPOG;?H=Y`9^_50j(pWpg(a@NeX@zL>*
zET3I}8@E1Y_ryDQEVeAq`2Re%-2arg<}&`k1LpmlR=;vnSX!jFJ6ZhD`MZ4DKgm5V
zJ2b^iFKh{W=%ZSyqOvVY@9EqPhTfMIk3D#?di%YH_so(60w)I*tv_m(Wp!?5>6WU}
zZ;yX!Ui)g&TD#cW^4R{Z|D%=o1^SMESa@i{vS0E=xre;+qQyG?P7QqWR?1QTf{xoV
zroP!Sou10m*55qVR&?#^md*b<Hd#-SVq2*p_^kEOY!%_G(-}OwiumGNXEz>~s)=7@
z_wQ|?;l&i82=zwKD~TQ-BI<ji_RT$dBq?OU><v>LSnd|`#;Z;hjdjh`oVqNmST#cH
zjB?aBoAe{?UQ#;!CpIrSvTbhdd%bmj&VoFaeVcewM5|Vu&VB!T!moYv;-muEqqx@Z
zH8a>_Q)kO$wJe`4=+$M5;zjG$w`A)Y+4u9$E04%-^_(cQtb)TOr(9#n21BKp!i*Z#
zUv_+CUm3J_+Xq<<ugz>TTy8z=mSSyvwD)*Y3y(}tnsjo;`J4Ce_z2!w8k}|K)C0{)
zspoE;II^#ZEpT~?i~l+Qb%DmyI{zyieg9R!x2gR4O2f1J^|s6B9DnwG=UwMn%QDwL
zP2T%8+c+X)uDw>-_OJ8JzsOpO1l;(jrfSSnop|I<OVrsG-8JV9vv1ETTzs>|AvtzE
zLvXjw=Pj*M&uhC+)VXYJ!|Tz?=gwd#vGK6o=fM5T53F-Omma+4^NkHY=adxGZntg^
zthfIA>(4WdNxNDczVPzp8qU>ORyIej?d+lRQL7TG#jX_D&5iAURdn4jZ+`9e^v|^~
zoO`7M-2<QepRL)RHo@HK*#(mgg}c|@U-Yy8|6IGX{ayYUS2tuX+sS%OTV|brY6mCp
z&WZA`^CTzf6gl2g?|z@9vvFGFaS`!<8DA@G>MHc)Z2x+kesO=*QC*Il2h;mjMBL&0
z^m4hO$kfseAFea}V^|!U8XeeSIqlO7pF=)ttM+!Z{yN&t(Y#K3$-i&Xd>3X2XNg%j
z|Jo_EHIZ+*uf3Mp-MY=0+jmAA<Z#Y9-IB(aRrhx7p@9CHeOV=8`NwUd0wylrnLF``
zUwgaJYI&W*H>SwDR%8oU-pb7XIQdgWi10;Kp5uBO7M|LAFiicI{EIC8^L?{f7D}kc
zbGSOrJCt<!%d2~nA_9-gI`JrL{Smv?vu>Tq-o_(!{KDzYu40lGRHiSJ(|GqiR^i>L
zn4*_fVn1_YdA_|76WQ-(&Kn<oyzG7FGu^*mYrb6(Tk(=}Q=I>Y>asQV8O4V`oY1=S
zxZ=wJqp1f^?JU~1fBy6Bu4{a^^=FseU-!l8;PM&ipXM9Y7XJA2;l*t}^ZpxGR!?YO
z>h$FJ$=Q2^fA9q|mHF&U;E)tySo!Rp`wP8U$6v1N6nvDrsC$Z7Ft_ma`&pkvjf5nY
z?GQ9RC}h8^V9WH@4*414OCD8D?eg?E634juttp@3eF@RVV4miWZj0@6*I3$ryl(wG
ze7Eq~pR3;*d_G>DFn_1quX^ck;aP|4SWzqJt#WxzEUXL+S9lp1lo=Qpa#M@*^O8z4
zb5it^^K%O_b5e_n^`SkI<m93Xy@JZ6;rGFN*ssSIX2_*1o;G2Zzu<(#*2%dCZ!J2(
zw5BzY!=!Z64X-6`L7jIO{{P)KB_+CSj@k@4p3dXH-(5d${fp<{uad8pRr(fQ%@=*!
zE_KB$@Ouz@wxaQ(i5>sBgk`UK#a16W^ySZ4lST8ncW4XPEeI4c+H*YUs;FkOYZ$BJ
zx=_~4S?1d=&RC|fDk_uP$18QFsMjooim$J(>RyxLUAZ+oA?r!XyynmZ&VOR6QfUch
z-Ff!R;i0--S0-%snlgI^L(>B1ux0g|XGfh7op3Goxx38qsh>BCoW3_PyHbD4q;rp7
zn;yS4Q+<uhyGOhA=dZhbQ~vs9`+U29^H?1G`<p(^)1KKK%Ky1BNJZt|i5S_uHxK1E
zTHLtBo?4c__tctbjtwR^s*2nq#kU+}XkNPEfVbD)c@FDLLS|Pn^K(oI>NZ-;V)S}b
zhJe;au_^a>c*}*-cQ?Pz^*Nxie2>$rpvb0EwTxO@T2Gyj$~4U08et|T8{n6ielI6k
z&0)3dyy%O(6IVE~hi}Y((Xgs9H{kU86S_TeTnD-H`=_6gaGK^7{$=mW2S%oSw<m-@
zns>yPH+*}12UAEY%OmywZb#=GXx_m3GS4@dO)|gsm2%7Jb2$P9>#na{v?%=1?)11*
zUrwon{Lw!6_D+P?@z_6c694x_On9|lPTPiGct(5R^6u%+A0}P$3R73j=TphwHtA(!
z%C4z<Y$t@|?43GOc`awl#D&)j1pmBPbh_Z?nzlsUsapO=zDgJKG*_lS@-u&tTQNn<
z^n+-VWaD>9*{}MKRX$WLKi5Bf=9Fw#j_Gpyf=|3KF5zo`%Ou!+t8K!eWiL-8%<NbE
z#cHS3S?ysNdaG&jG22&uujJ0MO#HXe*zVJ@114Lo6WLa1<{VIVdHeBmNyp)jV()qG
z2^y|Wb@%*UaeB_lE!G=XW`2rUbMc7IX}5(JYy9UcCHZDvW?xora(i0Cq51l42bz2B
zA143bvgggJ?Xe|Ctc~h7r2o1hS5eFJ?b}Z2Sm#?2S>3BAOWBtlT~;^wT2uASbq}f!
zs#Q<@QDXes`+3xYWJa%TIxB^B&G+iwZ%W&I`}|~E-$y>lG1;{Vd2X8DSr7Te<lky=
zaa!Q2HUE8;)c?$uWu~8275*`7c)d#`=7z0Q!0g;DC10i84tMtn?5@z5@FYNgN$<mr
zT9(_qkFnedQp=F377{sOlw<Gr{H5UjoQ0moXT7(vE)$&Uu%q1Vkhr2%`OZZ_n?>!G
zSEws2@#;O>QX|GV@5q9O^QJk~{g!ud7hdRnHQ_Grolljb6*Xth^grbLbK~o~bBwQw
z>U0^eAD*9H&TjPns<rX{Uw-%ezQtb7T@vy8?aI)VD$m~)9`T;_*4?)I&%)n+o9cg7
zo>FyA|I|6}x!-DqBiGI?n0jHM=*EpbQd?)gUu>|8>-b^ay4kZ81FKbc@~k}A@zW&o
z56jDECPEuG=4^WI{5RH5Db_eT#;(m%+)Z1Bch6r}9a)|jtKz`5ty?BKE~^y07`goC
zKcOiLjo-&VYtCNC&QUT!L!kb#aLL58x4s5S7?+>#@RaHEe|AoL_a5Ho8`T}pyqfjF
zEvd%iM%X@Umb`VBY>n5>Ogj?%>h{WFrBv_5r@|7tbKBpTU;JqPtzqS9w<$NbHO^bM
zGCgtIye%Ovp0V-9-HR1}{FpKS^OK~D*9yI7Kfc2g_$=jwY*W~G)4!#iu{Ilb|JpS@
zaQ}x;PRm<v4*SmPPdZv5BeN`@L;eptY9YG6^G#I_9|MDi9^vtr<ebF3bkKNA)a&5e
z9zy@m#T&BAr|56%F?{&Y>bai#rki)19*E^l*6sV$w{)Ye<FqZa1RpH@aesZa+$E1q
zjWO>6OIL;{onO3rx%~cja+%#RbN2teWBZV?oAq@aN2JcrDVuXV?kzEyvH9J){hK$s
z_DwFC`SE7Vq`Pzf1(uhmmrsv5CmCrl@rX*wb{(%vtT}3vE*?F0%*0zP#b(|!qw_Z^
ze10hT8hK{Os88~mcO)q}xw!cAS(g(%Y*`IHlY2ZCR2F^uocZ2j(Z?Q^lS)qoPoJ2g
zSFz<w;^|{;3#W4YR(ZDb$;7{^(>2@IhD`8QZh!wfj6pU3h<b0Q%GIEoA3Khl>j;0V
z-~GmSmfM@RMr?&m!lqXhy{<f7Vb-;L1@GSe&)+>ouDSi+==k7#X7QshkDfn16`(jr
z@ETX?vbujKrj<2@MsIu+!7p<@vY>cY%Nd<HM|Z|DZkqc+I!!EX!BfqhU-auO>&@-{
zJ-qv|U*2w?yq4qj69u!ptvV$*4m#<ckCr=eI`x#+?ueSxn^nT*C6(>dZrAd5p0-Ki
zkKuzg4?bP%)8)LWRQO3+cGCOrWxw7XD{XH#eyH{P^_2Ucf9Qu87-@xX@YwM1R_e(o
z+}ux&xizrKvwKcSNuG7~h=57!^1V#y?+$$C6o2*emz0^UMv>gv)JME0r(U1iHs{<U
z7Z16PbxKA-ldsEeHrln=dt=?&dD~VebL`D|n`FzKEx-0k#x~afu}2?txB4reN=`}I
z`7Wa`-MUrA*w{$h?N{28_?|bjCf-d-NpNF3+F|+Q=6lhVSM9lHO;cjs!1vE^caurz
z{_We}a@_FJy=eA$`x@yT!Bu;WSC(bfIn9`0rgvf0QMc+9ww>(?eal(CeDOH3jG@Zr
zS&>a1r<kv`#gXJ?Th<(IatmK~XzH@tx1N9KKN0-k#y4)Gw?$kWzuM#qw)r>A;_tue
zD*WO4M$Q0xe`l@8)e(*La$F}eDuv&k^wis1)*hm!G_&WaO|prI_H!`?)m~1^=Z1c4
zGwc$!9s1F^^znrBxZfN12IkyQnx3A2zHNfY4h02Q5naaDlWn+8woII&l;a<I>Vk&v
zo#OHnD%1Hixt}BoRZlweQg^k^_wJ<(H8CF|JfzrtA}^{mp5yvbuCqPrw+T=5RAc`g
zJX3CY9p3bUb6&5`hp#&Mt`j_`KNPDJcD;4dk@FyL!YT#EUd~<@CaIv4-8DZ}z6#xt
zkaM6^=hMq6_l?h<=~h}F>vo{$<e{Y^M`i>BBu|)oQ(*5t-(BltcWC-gHPnzw3Ua@>
zI_dw{s~>iym@iMVIa#SvX>-jmkaO>(n<}1**u?jCeAporclGd|j$Oj{wfi4W`rer3
zZGZjCwTAS=YmMX*cYZbX$_dz;b!qoHu1Rdg$tkLhNh~r_JT?(8Ot(LK(BJpNg5}}b
zly?&>8Msc*vpgX7b4rT2$Q%v6(9DcGrt>H6obqzR_3lNtTj!^2mh0)1V>m1uk@bw-
z_@BC5->>z*nrp?q1YDL0&UIYUxKs7?fe;t9wmfc&08b^i)|Nv~P9iLp*Hm;=0v;-z
z&{1#*vP#aAaoka`LMt>?=1ijiv-4r6GY38Tk9jlAN~?>_pYXUs#-;Mat`&|OHhc)y
zdj4;E%W>Vs>-)Y*tqx&eymskS_V)F!8JADKY;i#9{8ihgFB<|G?Uq)o6$}VIu{?O%
z%2jgb-0sQCmw(t%E_31VoX19|C3ns?KES6mt=m)RpqoQP`<${b0?9p6w|_rTN@X;W
zYGf*9{UD>r@rUg|EhqQ#N|_fGkBVLf%vLGto79ly{PrH#nf6oeE}IfkKKC`&m=_j_
z=ZmE%$Y0>uV7^$=M2K&1!aNSK@(YK&C#9X#<(FjK-d@~QW0t(=)|`x=Cyh?#YE7Ey
z?I$fNHQ~~u=yN60YaT`Y^DE5i`ge@OH#Apzk-yS%ljQFSvTssP9XhAzdP42=CYDDW
zN-d3QMpp_i9>}#j8voLF?o16Sub-YgM;BdT3J{W!tBg6bv7@ho;ns#(YdRK4YD*~2
z*zaI1Tfi=NCe*IcM7F50*O4QRxo7wMM@v>mF8Z5wWsBv1k6*tZ{5&C{!}L@_c$wgp
zngg~6mS)JEylQ2~Y?J<7WSj9C{uPSR+coD&uKlIGqh2K7=W4+_3sn|Aott>EVOi8!
zpM$4lkN#qr&HMJ*1!egapBwFUgE)^LNRj;YWWD8r)4co_9sfNDaC8x7$TYqXXm?P|
zZQ<-+%eh@P_`EGtEK;j#K6vrm>ZJEcncY8>rYtmLDfzi%i_NBIucJPf%1*Alo_Dp`
zq0wulb8CG~S=GOXPhz*eyU<fxrhhOyTJ^9^*u?957f13efAeY;3&Xj{#y~#VQ%ns;
zZ=4n$-sRxEaBcbBbp?(aeNMk?F6Z(If5H9W%`P9KW`}=YGakJEZ5_APt|;ZI;5DsM
zW=B@X%cYYOH9dFp-P~pp&%T|Tb@lDG=&cSLZ<){Nu@^k+>(mm!&TeSGz_sn#k(XVL
z<@Zaa(u3+9eoN}!vRHm_MM<Ij<QZ!fADG=-?NO0>{H^E~pLaXXC>~n3Vb!Y@w@#f@
zOxPA=@<sDb*w$`i{(n_(Sq`_hoRUlQS3LGSx#YAnho4*0vWuLKj)&F%G)VB}us;ac
z+1gZf$guLkq7<eVb!Cor-+$b6^}l!MF_Y99*L@1dnmGzsPjel;>gx01l7is(*v;#>
ze_I)xx@<W|Q}AnHWwfla58J=X3;!{vto1zhuB!Mm!^VjlmG1GE@yFc|O7wVYs1mwz
zbH+`nzuk9xnKn*me~@VW$IICIp?K-8LZf}jU((jR&p7fcW3@|vue7w0R+JUr<iMXh
zjy;~w(J=A%Va+qb60u8?b>wmbmo{DLy!iF$m2jmST%yxNABT89I<PHEc7NNygWNCr
z8^VH;m9rjlC$74~H~Xcv#+A_ByhjzkG@TL_6g$XybFZKMgJm({7t;?s`m*QB?@RHT
zK1=uXE^Iw|x=qH)UqUdivU~q>hNI`V2>bu2&Hl=oxA|k<_0R=bnlaZE^Zor;rWhCa
zS!~)hCG4odA(3s2lEtA5r*GI0ytw@?i<r)@6|XW_&bM)Bl^i_d)Y>w^(KPkIHm$>^
z%UWl=-dp?q?}cWT)X=iMc8Awq+i^D|>GAnjn{p05vEk&-PJF)HboF-@!72Bu4yaf>
zo^bwK{Vv{x0Xi?|uyh@sCDiZtw%325=$`k>S*$gp>z#Vv3S_S=5|%Mg-mK8D=y989
zzPO7tr?cR@*F}8){ARpz^?7+?mca@4cd0^GQeXYj$Ps2eVpW;2aP^JmlN($cHJ7{+
z>Eq)SYjys#eU4klt$6_&%9CU!OGf)dbgXp{-g9=RyYeGO#{68B<_~u@WFAVHZ~rHD
zWrveYnvZ&q`pk#N(s!<Oy`HV1Gf6xkpnIKpjL@&Qed~K}b%n(?9#ndBV}AUKiXgoR
z&Y8=9e0XP<u<AqR+B1^D?<01yA4$r&>LT~$fB(Mgah1z5D>ZgsiIy(-x?tml6sM(S
zo+-hPW_Y~_U?{)2!>5`}tozlcpB%v}TAy0ETu@;YF;}&@r!!k<rpO$H8Lew~uDHE-
z<)o^srtO;Byt(2Yzhdh1OpjuIDmicOZKhkXySMuV-_@GE+sj@1e&YGn?>4tru(M2k
z-nUnQQLJKazLj^r?f0pF!!}QJntuFu?)rHq3`vhBpEkBQns0f2MnI(CMz*S}k~{1d
zEd8Z^=YDYi4TZZ4bPdcr?!V8!KDRzMDSJ=In&k$%7rQ2zoc_6B|8?hSwk}+H)z!b<
z-PfxfG?CcgxZnN-Kilu!){`^q>+|1-e#p8d&+_n~-CKDxi5VYic6nVi3hxrNc(p3c
zukyfT$330buQ%lK`ie{4S#xa7szm|Ew$A#qegF5^)XwGprfcQBkLzBE+m*i3qQ6l3
zt=qLqt5-ez>-JUth`8Juy-K;wQKeVz!eV*b@4c>j<&I=a)$GrUy?;zFLP-DVf>5Um
zGgMb4?PShgvD=Dgg5=5I^_opPBMN4}a|@UqAvg2??OwG-w>qR-bXTV6nVCHLwLi*7
zEYtaJfd5tBt@;~;#WG^<nlfrNYR(QeyLiARicLstUEP7!{&~BeTuRyMG*9bw_^Y$8
z_H~_)Z(ipAHK})c!{J}Mr@Y#FSjwZ#^=RtP;=V;oWma;}{(4~Ttov;x%T`1eE@u4O
zkXbY3RPKyhUZ(zE)eVF_A~U)|o61D|HA>HRpKZMxmfTXkdXlE718-0H{nyPWJO5l&
ziR%3v7AIY2kUyp4Q0u$tDN1hE4G|*Q?J;Umb?b^}8QN)?_0RqGlsm3z6_d=C1sBe3
zZ8Q|D^eqbutJKdg`~GL{)$5J^kJr>Kj=#a}+nKhdNc5zOesIp7bj6U>uMP@S=ERl1
z=vZA-SD@&8F{`FMX}{f#J9k2oUGg0bnLj&;-(NT-{@{x5N<OQkw<b5u5WS=$vQI5p
zTJHBF*S&EU|LA6?1~X@ut!du3EN*6prAECoyHSJHl)2loM8o{fX4c%Xm-zqZ-STe!
zba_GPxc+Zb8{a%hEd6w0?w!9eb8S}n@U5Es_tmxdtj%fptas0>{=Dg3%zw+^mwp>O
z7xqnFs3ZG)F|Wa*T@#Lf*L*PT;KYCH@2~%ox{c+u#J<LqL;7)fTB=`DnAX<%OYRU?
zYkcu{iFlpQf(7567YVLaIF|Ik@BW7=t#h=Zeysj3X>WhSs&ShCiNd2HYNz5P5?@Wv
zzVfS`v*J^3>6d?wZ+#D6FSMv(Y(Jd;Fksj9D!$#{?;lD0z{J;_|LDVMZVMe*K68OR
zYUxZaI$g6kYAR})<@*k}t$%dl#l0VrGC%%`uF>$E`RM%G&M&X}{;s?9-+B#$!{v=v
z+Bh5{qI51V4S)WCIYP9qvqeGs+@qS7{8`c)IyYTO`26ROJ>#6)x6eDNKbkMP@W-MH
z1zQ9v>h3wLjul^<P`BT#{)7F&)m_{V+e_WsxwdcHUe5N6QQ?fuo15*-zd!7*ys>oa
zEq~s37R~n`d|GD|Zc+R35Mw0Yo^R%cx9T+)*S25$@89tk?F6)Y+y9n3*)uTsekZ24
znwbq+J@B@+vR?Z5#25d6i6j@5vrlMPsA3)0&i8hzrdOa-XVoH+o8E;F8J9Wwnapr}
zrqF5d=Uue>eB<8cDNmm4y?^-pvIfglyH~G%{c6>#w-0`Ny*$6Y{iVy3sS^7<T;i5r
z4w<t1;N(ghOYy_UFCMPGeX!0je#*<6m9jQ<KVE$N@bU2Rc=r7Bt{;LzT;)_AIi(z}
zVbf>d+L8YKo$u)+u^zX}%ksPorC49)#7!v`cwQNJyfo^`)xFi<w{6=Nw=6tU&S%q(
zRW71eTn)q=OXa33HRgX^Dp0wBKVS9Wzh?G>OJ<zC>@y{_<o&(hTkQ0uGTzy&ZSodO
zi&S{9F-<P!&|HOmbIc+qEcv*mVRdGm-l;8ppF268r5c_)vZiar|8&<mceR)Cs4bP7
zb6i|$M&kZMSpqThmJ2h4b6r09dB-yD&J~w7%T!g#vz5-bu3z62HpxP}$gn~EsFKE~
z9Kjf|r|v%@#m?T`d3QEPVZr-(N6sxdVPu&2=7jfUwfR?EC%)uPk2DOse>rN(xwB67
z+O5CBOp_%(xr9v3OxqW5|MgLuv*(+3aNYYf=j`KOHr~gx4#gezx11d)@-kEB{H86d
ztgokg@O~)!?iM!ZWq0JP`XioG{;x`(_xx<)uRxpFCm(g@%3ShQ>US)NNhzEec5W@>
zg(o@t_$3PTUWbLmi~KlT@~6yD{8in8iHezCcQ1%v5&m71_&>(SZl8`2>qDirvn*D>
zQuE~g`Xc_tEyLKu8&8CL&v=;m!K~`{>DSE{|H<=z`~T<B)z5dU8EZoFg$>z1iT+d(
z-Su$!t6PUEOH`iw*nLeh%YG%{@k=1>NonL2)(I0oH=WSGwCO}<>8a^_XH=gDZay?^
z;le%Yo4g91Z%^d>xT&+bkZZ@82L1y_e7cQh=st7!w&RXVFZbjyUY!oFb!)k%pJ#cW
za9e0jR<b|{>%JPbhHD9_mzi3{S=anrqEshvy>w>Z>?nl=nO&y^X6GiHJQT{wzkUjD
z!Iqg01)F~?c5pCW{&s=Hf6=hm3zNNNZv}hX>YtMQ6X#Ljd9lCZMEXnCJ8Ws6zns-y
zbR?AJ4<jdwTG{~_4gHeK4F@X@)dnf^d`sE<{he)n@t1dBU)+2+`T6mJts-1s_ZsmW
z{{QmtkE<VQ&0ery{L3$xu=M-mckM5pJpAx|IsY&Fb-%vmAGBX_bg4YUUhf6<GHI{p
z{S`R+pKY&X!uPs&_jkK<aDB^_st=kMYI{;b>37onPF4=ala(z0{Vr=CxEFVUyIr3l
z&BBJ~_ZJ_fNooIX{Pu{_T@`ia$>Sg2HUHMKuRry&vh>Th1o01jC1C=qdz;i5zp-;>
z#9h(2oiyX_qBDtXYKDFvRn7%I^XYDT(!x?2cl~o#dHQpnv`vzad)^4xOPXg+`*3}3
z<>XZB`+wejkI#R+J?PI`!O+;Q?vNNh`C9g*Pq*9S>(kr5t}tEGvy1=7_I*=N)Uv-j
zuej-CWA6g@#j9pYc^q&*{=;iZ3Jd3omU_J_y*Fy5)jYo?I{C_8zR&#2+W&de{)R0=
zg^PY0iG-hEYvVMIZY_<dR`}s&dEyKA#nmomvJ+}<@*Y!|v0!TY0cBTviGK`#_${w+
zK6p_Q9y~imaVkTn&QW`v9gl)kw)8QEO;&a6t7&a{(f`XgW}ybN_5)QF@0F!zx3f*#
zwqV6Z{^p;_g`8QALONY-H@G{J1n+JB<y>ROP{+%oEPfztL3rULmcxoB!Pl%E4j(pN
zu+Fk@x@VN1lz?C3*#o*6UY#ogUe9DO?DL+G!n8xg$ncSW(xoY)3H(=DypBA5A~Vza
z-b%5}hFs;$yuX`gU0lR`K0{UEjegM2DNk~OC2B-Pma=-jium={<G!+v-{xgj?oG01
zyH~yY`Ze|dx9|GHdPRkt#<~~n<0JZ|BQMr&^JSj=i0LTrr~5jc$AT9y{P@1+#2fvN
zt=bXI3&I**&d=6fxiIp80K<l83F(60at{REZt<V{#J1o@uAHsyt<=5!ojjt>6BctX
zI;iq+ru)XnFT@!qN$c=PE1%8?$g*f&@V&BRcHRA>suLe}oDeFos(G@r(`j8Xcc->2
z3)7cs3BDI+&-zR$)U7hGT&wnkW8%uFBCRB+w~8$1xqr+QIgs<&tt9W(U$5HSn~Q%r
zf4IP3XI(LE+KC(L8>+k-yKF!Fh!Fa6=yzYY-uAa|A8>pviFxrQqSbcgM9T|{W|>CL
zJ!kwd+Q4snVT`?n?%xg1r4N@CNZeoa+rUupf`ov}`7NInDpGcAe&m%{|M&D2!@pX8
zU+vi=yGPJCVj|<|yRr#i3>6q(q)syJRIpw+>2=E&S=EK6EI*HFG<F)jaa_lfuvhtO
z1B)mBt~JNl9zGIC2{y~xTHxf{qn5EvO}U22`lk19pAR0dzDY0VJ5V^M=hBm`mRE<?
zO$yD7o3HfX^7#!lA3k;z#47Hqa$6d?y~*Z?@^iMGlbM{?2<ksrp!)UH`xWz7|2(X{
zPw!I3w{JSWr|)a0lyA_fo_Qj3&q0HVE6cb2z0scT7o>9avYpau<NSYNw~U2s8X_6y
z7%w@etu$HrgHlDlWZOg4`sIRGPQEX<cb-1|OR4MT`*+vfEcMO0q#xM6%H`7L`yUk8
zb{^d`<M5`7+Yhv4pW3svX|~N?rO=|3FZMO%EhW;;j$vM+ANNOuCqC|7pRwL;%2eLP
z3(dRNuln*n>3!%#?xpMen)&(`9F4tD=M|*+@c!L0{cf#8?8?7+y(48AS5#U`O<eMh
zDRS-K6Kcy6uYcNEw&8PVr7_34r#jj-2aejUm}U2P<?_%gvF~18yLN43N%PWD*UcTT
zBYz!=+kdSsMRX#&=cLWok2lOez2i*gwh7y9ebtw=^XJT!k-Yo0chk}c>ni1Ekv4*B
zRL?%z<M^6Wy(MyAy420t6Po6#yGq7iTkFIwJz?>$_*bqXuFIPp%1+eBR^_v$gw1(W
z>|R_l<><{$TQ*CMyPcVm=UHy?&cD~&E6ui0(Q8M)gu})qIgiTM$Nl+pI^+L~r?17^
z+4J4><M!HCe13KE;foJP{g0c~E~|{X{iT!pklBp51&bKMm{zQDf4u))bDTfR!H`n9
z#caLPq@#piD9NyRPHf-$M^q#sr{m2bqo5fDk84yq!=tAQdVG(oc&EYI{_(yz<2M1G
z%!suaMvEm|yIrd!yDvo<u-x9aJzF{8qJa{>d*+4(*90f7G0_(N8ug=|afaLV>1qi{
zavfXFF}<BJXUX^GcczRy6F0wF&s%U|iGXO*YR2ewD)D+YraI3w9yA`lx$m}F_=`_0
zm-D+B7xISp&QR~W;b2hQ>vHX3M*e9xhxPa8H_M*vaOB>Y9T?`i!Qp6#d8@E+`t*;B
zj4ERCy4n+0>`(sQ>v__kEulzJ-syMN{fO(1jaf!^bJ+F!|8IKVn(i&|Ms$WvI@8&p
zcM<pB7RNEv2?cPQzud-BE5!G?={}c#?E{9umUq?%T<pELmpxlvH0k2!nUV*$oVlKu
zbMDog9=|Q7k*!}Id6^eG@our2*zxm<&J9%|-zM(K7iw>=IVG4Ec!y8-jZW3wV_lCF
zwzI#Oy@g5am(E}7T=Bbnw=Nzw+p%cnbKl(a67h_$qt?tcV;1|H^=zw|YsV&?Q@6i<
zw%vRA-Re#4YtAiF+I)JEChIfDEZyBVrkOLpVp#cq#g*+-D)-5?1ZLRhDs1=By&C(t
z*_C1WJjT5oj*ib~+a1!ldF-)a=bt2Vj<s_+8g?HnxsmhK@`Q=ezZ3oaT$2j_cTV|n
zY5gq6cmKK;eF|6jWqg6_!E-IYQYH2Wp`p58r_7jnr6jCBx3yU|PIBUpvLmxi?6!Jv
z@3ppVnY-b1ir30rnK#yKvYc~l+nL>)S&|!E*Ig91nzoaXdk@d<jvc1r->v-kJHuOY
zs-th7pLHTOJf-z!$SNa^?0t1MM|xF%e0yvDBe%gn{@9MQF(2BvJvF%%gcwbjlJ;r@
z26LX!<(J@HA{Q6w7rb-5$oWQ%XQ^CfHrr)ckFV5yxP7U(i}SJRjz)`?88C-xF08xg
zx4uZS__=`LiA9+P8TTR;eDwoQTWDWM>~8K1ILutIU=m}6sRy@T=oyw-?V%I-FYw+w
z<HF6DrPSPCS;%SJ-(<7)FqeR@bjX%QvzZ;0cMpZn(RaAw{w-@q$L82-)m{Gt-tcQS
z#&S>Hd+x)RDf4DM3TA!xYta<FYEOCfdZ|vEiQla9Vm4?y-Ym#$b*OsvJbvMK+XG*>
z+%NCFlUuf_U^26*iTJ@M2AZF?-R6rm{t|Uv=-EMc2iXhmFY=!=?r(SFFXN05x|v}7
z`OG`kyBAC2R-SIX|7*D^@2$*x#S0GY(mmec9pQSisQjqq49+d0mcAEa{Hpf9Hd|}g
zlB9HSi_(&VQMMK}ZqwO(Vx}wUKHb(kv+*iJ@SOvk5x&#jX~+H9yrXTRMe$A%p#u*m
z&at`m_nFC$EPaXg3tI(lvKd^Qx98{CO!=Ra61Qnvd}5oNe@yVS#uQ7R1l_{KMEAA{
z8mF7w+LU8iFD7~H+P~yMxcp_y?QP#C{eQbk@0la(8|CE}`Z9IBPC8sjjx!Yw`DI|U
zY|D4UH|HhZ)x4=%w=P4gua7?<JM!6d`)6`qbyK6(@XTg@Q*nRxVTSiNbJ$y1&o{32
ztXZ|;uFth9)Bd$<*M3hu(|q|9gCCcq*L0^+>t()rcQ}<7rG1`VW@@S-@<e6I5|$+W
zaE8UXE-B_OwsP%?Vn3N>yJg?4w%ZY{6TL2Gt-0sKz0q{l^`M7bv%1Pvb2&v>{f&CQ
zE|@F!=E)P8l#&l$K5TIEvSk-r#<<Xash=9Z9MArvd-IHZEAP*{@!+&c{Xe@;Weaob
zeu>B~6>s~yZSEG$tT4^rY4>C*7*5XBxtmqx{kZ(sucLLhC(Q6a=iX3qd_sfwg-u&j
zXBg+@{P#G_vQ|NJ^RYtJfb{7$+upxqxclr_?AyAjpTiCxwXfZvc_5^5e-)G9hAmaU
zb7$Y!ymE`A(A;y+mH8?pPByepd;j2_%K^RlD_G|;D4Xu6eQ-m2@3pnh9`eQ9y;HOG
z_BTh<4>{?TqR%t;CM;#Lo_zA!$)#B@PIMXUZoMfSvg^0R+KCa$g|+h}Y$a5a?#%gm
zDEU=jz~UhOOJ^5$sjNNlBC=<bg?;uT;|E0^mb0$EVS2b~g~O$7Ja&mzEN|Pt)b{!v
z77sPh>|SNGVM)1sPTH=Ip{2r_=Nz52XB8=R{J5<(@6g?b<M~lC%Xiky%X3lfQCsV%
z-&SY;YQBw$)q9=^to>V+g%=+dU;i&BI@3=)wsEag^#<{l8vBxWt7E;5r(dj$Ik-q*
z@oAy0i#9#KX>;q?0v?{G$uAC7thBmu|KN+*iq17hEe$Fz*e!Z6eUag;#;#4p3$HT$
zuqk0(T)N~qk3`ghyG1J=Z8SP{(BzR8o6=h?x7!l>MJ0bWXUj73C7B3m?}|~h3aC7K
z>_X3HhfYVgi5IRJEQ_pho9OLnHMdFNuz>M}TPb(?`CU#%Zw<d+YyIn+^ac~|Z#Lc?
zfzPL=PS!0K`tn(L$uq|ZCqL*Z7dFgfYA=j^b!`vd3Rdm3=d1J{3-)LCFI?q%>`(I<
z9`>lTpF1k2=og%qyfV{-u_Eb^RCCF^O#MyMzRO(V%--G>y?NDUr3oH|oo!*<?@x<-
zJQI9kn~1*E@7$F9)z=r~9OAh@BjlPC+usL9E_UoWTq~;eb6&mtV7+YvS4hd-r4G{<
zdA~`_f20t8d<WZ^sGZNR<?<zMd7jXAWnuCpi!QO`yNe%m*uKjsVln1AH{Fi!K<$p^
z$)b<mIWIn3qsltTHDOWga$nDNMqf2{bv^hLF(HgEca!2=-4F+n$&HG8BAs@hpY%*c
zn{}3@qFq_m=8W6?s{{DIul<;{;WKC6F;&*TM<uW9`EBaQe`1+t!t~p0KMQBRSsD4&
zs8H2%M#z_6t@_3)b`p~#loV2=>ux?^_5Pdp>h6W#T=%{lmU{Huc^}UbjnhvRj&e;{
z_dd_AGeXnhl1uT<x2w8?doG1_Y&i0hF|r|HdxOW7iDz^;3f0^d_9d2n`DK3M`b7QJ
z=d_<%aYa`*r%tx^YCAo{Z;fhA))qc*=fZn?m*zdXXrgu|+j#@~!2ou*!oVe-_B-6{
znX1*k$<?h7(fakbw&1hk_h>1(w<kZyrq5Bd_vH6e>N%CVZejaLg@}{W4%=*>qTZ)t
z#{BNb)%W@r4_Dk>IrnP0rO(@w+NWYSmU#Zz$ludc7Uh3vn*x{rT??jE5B<zbd{gdz
z%~{^A_Eym*SMuo|&HmeRMfUrQi-Qe*ualHDZ+p6O!B+bi;cIzy5ot1BRckx4g|*nl
z`o5jHKDBDC^$FYG?WW6D_|?9X{CoEKXTQxa+oy!xP!wJ9kW+sD=QsYA8<+(3G!K?A
zykm>E{9YA3$!lBA^804FS6QR$Q|4!C%;yYksS12;(xl66)nmI=X|AE%t-Rg7)4$&l
z|DTz1%Iaa9`}3N=&mMf8z4&kQ<HwEGiPh)y^{4h*%)9ISrslBo&(+_~<Q;taqxH6a
z@3#;6$6r`U{Oh^1?%tfMk|*y^%DnEkz5LzdZNfj-O`I0$C)y@_FgoEZZ-F?Ise{RZ
z7e@Zk1@*`8c6%<j^!sCaf8R?5_q#vt)t-&j{4r7F{{@?h;>~5QSK?=6>u+5#EkEo0
ziLDpa)Y2zKt7K%HNh<6rnf~TTYW6$k`O4lxYhu^mKX8?C`$4_AoM+-zzj2Z1V_f1R
zdM4!Qj3egxqLCZq#e62MV11(@e#-1PUrdsQ@C0Eit_vl428(>NpHxMQdwg3|kaSfd
zO0AaXN{qVjvO{a5U$L%elKJUY+q-i4<wZG;*;;qjEdFMo+T#;w)G*_5@}$C;z-nH}
zU!SL#m)$k2+WtZ<)s{(FLXGJKQ^pn%&zR$ZhU-^L)lG19vHKrqAr~9+VTXFn{GxLj
zhYN%aUM2D?WS+V${cmaK&BWk#Ya4^!Zx^|l|G#5<8Ohf>_dv1po(Jy^oZ7qa-u$CY
zW$kPSg{Lm?+;6*2sr+=hb;Tr=gLX@&zj^cjk8!=_ub2M6pUvL0Dk<S-JKtZ1I}*2@
z+V*S>Y-?sKJMeMlvES@2hD>VZ^A=eo__voRTD47{`&?OiLB+*u57r#>zw$k}dckMQ
zV|)u7&;Fio`0mBWAdlixH<Gxct)?Gy%{|T=vt;9uU;`$fo~Fagzi`hu&#Je&*vn|S
z?2biqCdTF;XFsyzzEiZJXY;jLQNC07`JbH64T@T_nS00Dzs!4_G#l;C*)ws?GbueN
z?b8;Ws>Jrwa8tp-Z*r=7Cw91>xiD$7g8b{<Z}>X5^1i$$YZ*1|gVaQoiK0i3r`b(n
zQ|nn3vt}`CiCX`rC0jQw5SQ9=N2)y6>n>yZ&xiYZN|tZr_B~`#S)n!iXhH1-(O=)A
z{%~FIoKs}~QCo^-LiY8B-K#fVbb1i?CfYl2?di=;K^BcMrrpmNq9iw;+Q?|t^!$#O
zSki(IW~>(%)LZIZOxOOq^_DC1bv31+pZcE0`RPfSI`d;D&i}|Yb9XQAjP=^HR4eC(
zr%!*kYj*3DHx3d^T(5Wf1wR$qP_w};T_J7NooCrwT0^By6^UM(UjCP}>+PwyJAO-J
zIZv&ZTw72!`O*{VHTtK-wqG^AqVeP$W5H?_;Y-aYZ@cgL+vgPj(=PX2(ucK+?vzD4
z`QI-OS(|rl^{XkOd#8zPdf|~*T54JGwr}w|e{tL5?QeI*e>>Kx66N)1>Xr-5^KaaB
zXj>8JG`p?nR{4&#(Mt}s3qJ1@^Lx@aN!2B``|_$fp`(vG`QE)>@4EEF>Sa$lS=(k@
z58-5coO>q5zi^x3iG<YhxA(Ulx%YgXr0iC2y&&7~7t^eN1|HqBI{bR(JGEoy;wt4<
zF4(hH=aBEF9p>h-<x(?alZtnh{r_<IWB&^!&!8TO$KqGitY0<TcCF(|?bz^nljr`D
zdyi`T{TpQL`pzDZ&I}R1wAP0+`-QxkLQyfBGUx9j9xt_uqjv4kSuMmazVOfK$@89l
z^gB^{YWC)D9lvE~)^ndd>?7diT3+_5NoeXc|A}e>#=dT8-*b1iCZ$iV-T$p_{>3ei
zdXFglUc`CpOvTE|39RouBDq_iZVODinir<(z}c5AEV#v0IxPAgueSLCzWI6i`HiW&
zE_C{DDGm*~%76OXbC;>7w=Ak~y|g>i{p>?7x7rgOe8xe-Vee~&oX-|0yMB9h<>4&t
z`*sf(91;HdEN}L?9nSHJ&I&238ohas1#w!XBzrcqhY9N*bNnh+V{D>X6yR9c_UX~3
zLvj!Ii@46@h?%BaFyq)cn+d%c7b=bVnx*AVv0Zt$sKwDUrSxKx^Rf0dEr#7q$%-cV
zvKwvWPj(r}ef58NW1h&>Z(&<&;&O{`TTITHQx)X;-E!63XEP--w5IOTei6~S>UZ0|
zKj*iZ7Q1hKSH?A0-9MK(KPB{V)NHrs+IJ?Nn%r#uXtMj^<KOqcij_{e_r-sI`)hvx
zwXzmJzWEn(CfW4eoPRh&d{OJNI8W}#!ke5nvMkSE-mLuoscYU`(?h}stHOhR2YvbG
z`uDLxg8NH-@fTM$4tGsFeDR$39`i3p7#zP?^MtGB&Q7)E%{6i<tMz5bb87v-*T_4k
zu`)!^a|O%uxNM0P7vs)`+U&`kwPS^YKBJpNVieD8z9nB+F6EdjX2nV_`6Cgs<<KXN
z8D5?&r{1o;zVYPW!+WMroa=C8H=FI{r@VqD6Mom+EqjvTzRK}r=B{5;&t_galxFhJ
z-C*9@-#*hdABtvkCA<p_&)e62@Zj6b{MYv<>sGJ*KHXTu_P_7FZ>P7UJv=gVb8yd;
z7o`^*E8Z^RO_Py!sA{Yiec}?o;gJ2VnNhi$BDaePC>-BibE@e=N8*vhXtoX3PA{|L
zBo}PDclS?|QQNT{iQYS7LN4n+-;{XZ$WFfnCg(PnOq*oIdH2_^jci8U>nGSSG>8AU
zeA>Tr`m>t+A0J-rZvV3}Jms{=xqzcibxV|_)>doCzB{#M!><eKXShnZr!Hpm-Pb;M
z_w?r?Gq!BwKWOUkBjk}mY^8url-q_M7x;_f!Y<rkWAuAy*Y#zg(aKaSd5t5%tNfnd
zj62Am%=K(v`~7$9{X0E`%UAs7I;X>bO7%nE{}Z)4qA$J{+x)TpypeQRdfVyc&GUXW
z$8i5Y^0Q<8l^ULu^j-bgzoK3qD|Y(ap<7^hLFR1475iJ-A&VHk?pr5tBjpZDgJghd
za=qHss005lJ-v3}V2<~tS*fAbuNtG3cg%iZ|4%t%b7wX~#p7Pa_migNJr)*O;Ct+!
z_^r@`vJnsV_B<0}S;Qf`{II_a^BL2ZUrOWnI#dnjc^)jg=rW~oyZnR=ihA5zc*1`j
z^!u>m@rTI$8@}09rrzz6-@&snmnm`EOhf-V=EG0csh!-kV($Gj|Ni=@olt)xzUJJO
zf}C4@b2DGxTH>-{n}Y6~vmAxR&i9g!-`*Z`w7T@b#A|amKRMhk^CkU4<EPF0vOj&_
z|9xSStILF&8EmCL^V<G*X((hLnqcTu9JT%1xtXd<16A9P+gpCHx^w+w+loigOB^f%
zjb0w?+q}&*>qX<G718^+*X#}RQ7w0<|7Wkc=f~w5uK$0w{;8}<^b5Y8WtF$$3-i&g
zJ9)7;n*N;Lee{}c>s6jyDX$=t!|#|o4R7A4H-C~l>zuuD>;JYbe_uK-*^+;$OYv_J
zlXrf_tvRlVH7}3k`qgH8TyU>jT4MOuyK|S`!uqBI!L3H`b-tS&fBo#y`rfblDy)(d
zw+lBgzq3zVtIP9P$9A!p{bn1UTRDfLy^Ge~{`244^5@U+X+`Buf@kWR6R&Qrl(wDx
zc?XZ$eSPOh-ot`hduP6%{;s>!B`?Bf`P3DG7O%ds3oVKNR<?0h$eX%}Tfbzke(^uA
zGE3msPS>mtPnWJruYa~ZihsN4wH?bZJBL49b@k)_jy?P4o(T1e@a<HoR5m~T!}~<#
zc1Q0k*$2KH(evB5@Z>i(HQQ!&hb=lurSb3dCw{&d{3<K@+VkM$#|s>Ue$^FTJm1yT
zFL&~SypQ4qM^nvUt*z~vx^Gj&DjlZv{6B6}A1w2-`{C(X>YcsT>5Z$u2}!tF9u~;G
zto0%#%{OUfx6rKRyX0fmIj|N4t=wQCVV-_2WmSiC%k%K-YkbqE>7CSd>CR95xn|e-
z*ZF^V9$uck?9`<L(Lq{*kye-67qmp{^Y`_~_0E&uBWr70@$J!7#y`bB9zE^e&Ytgf
zJb(V4%H65y+drSKDf8x-cBX4Of1K@IBmJ-laaHk~D;C~y$Upo(?&I|3iyt?K=RZ8X
zkoADqhpX3XX6~C)<q?t)JN;$PE4FDm8-6F-zD!e$i@vdIqJDg~ip89}eb%3k{9eyj
zf5XR&J$rJ|?}?lx#@#Zn_ba|Dk+k6H^Le}`{j}oA;vJt39O(2ZU=jXam+PLx_juB3
z<7=j|*<WA2+k4@-=$92Kr}u0XKXUc^x2By*2H#@W%-9$;>EZKjZ-kb%J5P<DYW{AU
zn3(x8<Cv0#d7+8{^R?WLMzg+Udc-;HRqT>*n@7!VM=t3e(s(@2_1v@_rzd|qy!5Nd
zowBse=?fm4nXu}7G2tmbS?6=_-TEm8B~#w`pPi|CcHXOvg>%CyJ?6Ix`CVY~J~l0@
zCw%U^rER5)c7IVg@Hjgs=gld-dE12KavZ94&93>?7D&~mUVr}Ot;&9p1rBU7xA?f2
z)vQylYIXcFndr&G#q7rTaz{no&h-5k`aiteb6s@#x8UXj>VZEUX9k@rD$P21b<$_Y
z{E2JdZ+>lN@G#6_kMo&TLeFDdZP(jQ{h66^_tKxh=LaMANN`8qoMJTJP)Jcb$<COs
zd)mjJ%cnf|Q5Q)*v$@cPRa|t@8~52ab`+jkxS%rkYR>#~9tr=eSNq*oS$4`hk)L<b
z@4puoS+c8{>|#lnw$$5U(R8B)_8Dxg+9zgC|0HZRNwB~t%6P->`S)z^^WJ+J(P|aG
zc)46`@bMW>U#6L_dQhZ(J^RA#U2PBVHMo}dE@tL!;P|!dd#80z_UrsVY0n~~x1DG-
z`0QXC!@DDO=~^|b*pBc>&)Jiwo9A75-4#0Ll=Rc>XSi<5=;u#MJhUpM_pbTb(~Dg_
z7s|0b+`Z?>rMD{%x18?VvM8ou&w*F#N*g02uQGAlm45x`=bQL9_SnB5JAtR07KXJn
z+D!kn=Cj3x2bQ1B!&LWZp3Lr==&L5bIK#p0&@S&;H**sAdNv;2^^Iw%%EYQ8&%IAB
zTHvU^%}9GggN^J#ua!-HyskC#CrRw&j;Icmoy7D1pmp~GCdqk6)t0!1O?)h&bzy?0
z@7zxf1`}miWW;;wH=TbT(K~N%_15|~>$~>I+N8>Maak1E3NfsgJ#i;-9mhdS`&An_
z(`6$YRN4;~2R(HbUCK9$N7d+K_onDWKXm2$x4v+Cym>>YO1eSSzgKr({CIJ9_Fv}6
zdVkg1FY-7m4!#pRKEw6-E0wCdXIFMKu1gfWxs~zWykrh-=}0}V4)rCRtQ$A6t1~y-
zZqE9vtf_c=`;NQYE(J^!$*)-2JH<->Ye$mRquZ<B7#-bvHACmUeEBxkLoZzlSW;MO
z-7m$mod5p)t6;S5D!(Hthdttae{NC9;Pjn)IiELc(Sumk8#67$Cht)E)VGn#Z?d<3
z-<MNQDpu&oH5{`!({yZ3YgbfM_O!Ha<6!Mr#XSMaiDzR=*PC+kM{Qof72*3VGWg;D
zX{)&e1#{j;dml1Q%*-hI7vWO3pXGG^M-?8qMRKgmIA6O5oZ7~bGWEmMJ#ky_#s?o`
zcehhW(5}>(C;Z7XX4+9l)yn4q&onM6{4$A~w`SR-mxs?JM(=TOR-U)O@A>5n<CK$u
z9j`JfK5d_Q{D|m*HPZ^sd?c2JxX1Y|Fgh-ud~_DuEWw6nf&M$r&+<HJyg)m>Y^M9&
zsm75DX1L$&GS<AeDB^JYox{R8{+G)>#GN?xbA|0EK{dX<*FThvvzN)+$vM6hHw|5(
zv@=ipef=TBt8>CV*!Qb&w#`x$dD3BcGf8u&%ESdzn-q$)Rw_xhu%4G`YRg$ZYhkdj
zUC&aTAAhta*%->LcJk(tI&!#Wp<>zbTTY9OtZ%W-?{;=Spit1u;J(pY_m$!4&(8az
zG?#6>dpsp^SN(qZKkVy+!o|&A{g;rxYX95uP3Wx5%_<W2i{`FYD$GindXUrJzMkWj
z?6=$d16a)?Ui)u7e&@W{m(3+tzBcfB{uL41V94I=<v3q!zJUC<)!j*%0pDJJ=##rX
znRTmtg8vcK<-Z@z<PCYh+P_`M(p}g0vB_$U$+J!~UQ}?fJ1wj$a(m6Qq)C3kcA7!E
zHYccsy7!!$8|+!#c=@GF??SdS>PME`;m&^@vFDtJ8mo`!#$aXHAm2|W-#6d2&UqBY
z{o}_Tjn@xVbk%vYW(Rwp_dUCF&Roj{XWC5We{$<+D;J!;sjRf)c-5<!$7g-ds;rQk
zc3-KIDMFv;!-jnmv%jysk!Qww`h$R!$%~0o#Y1~F>ufpaGBa8^e){q5l#)lDoZ57$
z!@+O<oK$SPzSVrzSK-++kA?Ke?V1-P`6=77Lpql+NZn<Q`#SEhaH)q(Ut`$(qY@`8
zO<t|PRp!U-Z6ymP_w>D<<mY+tZk5jFrF}jxZ@*jaAp4JtXJxIK;XM27wYxS|x2=DA
zJt?mFp03rzu$O$ht(+8GPBq@|YRG%@aULU|`mJAqEa`JuyiV+D*n0fwonoEu_hTM1
zt$vjjvz0&jaOkOHPY<qM{5Za^@$`q8dW{|D7Aef0bH0nEvir-Vz`wSuH*oKJFA=(+
z>1fK~2YHW|gcZq1KMy^p`h02L`z+zCpPomRFLL=PJTme&Tz^bU_3))>TFgI76s+2L
zqpx}xtrgUAGx^r1w4T>?&Z{&X-{lYF|7YBn*t%A$DgED$Lk^cdMk=nYT4TKTjM4$Q
zNacrTb1MJbJCsqVw|m{JpElmH(Ko7p%vsy^$Ruo2R#LE~+pdcfuI^a5chRSrPXyJo
zi(dA}TvhbF(Yv6A?eMC&7e@@1SaJv4DQt>ZrWi2UL_*en{g;FjR=Sraug<zZ`|dlh
zUJt!)lf!=uzMZ?__UPkfd-jS|zKb?(^Nm+owp4q$uIvNX-SPSxxRfv3hPfEFu~q($
z*cl=adj7?axPbWF_ZQ4oBs_K3l)2i~mm?^sC2Bh*T5m;zCC`l&MOD>@^5?DnAXA<2
z<4(r0%9i~P1I?zq-TLi7kk-fGpg_&7TbHli5Ms;Jxb$6G;oaT!^CPnU3nwo(EB-v~
z?JnPIoaf(#@%Rf~y|mCNY{#z5-mKPKlSy4?G9oNLr*%oGzIe>SZ8IlSJR(GH?-nI#
zzfB*G-R6DyA;t6cj~f$iO657vnHI&q_Nex+4Haut?JrDrQeWVkbf>{oM$~cU;|P@_
zUA$h^f2Zy6GCE!OJWL|$#pIL=T1S3ouI$;(csoeUB=n4!X~t5A^JjkQ-fZ%_cH(m9
z1|A!!LoAm+vg?`LVSKds@KsI8uB(Nig_hn1d0LC_2t8F-4A}jsSn*U&_RW)0_ItjZ
z5y_rW^nA`1+grz`uxCnL+AziL=A6peQO5SS`J)_GL@%^airDHqFZ8$OW|zn}rFR-)
z7l+)xwNrl2@}zwp=GQhF?47>A)aD+eTXk8c{D;fs83!(Ws(t%QA$NVo6G4|*E4GL!
zn_3<B*^te7m)#~|<|2t~LGhr|3f!LaLd*5UUU5X6-SkpI>51z!F_sA$axJU$St9~x
zevu6-wc?Y0dolc<?D7MbYNP#BGMjSKo${=1?GsG;n$`PqvFY4{nf9vL7RQ`j+e40V
z<tBtE+Alorabr8<%jZwT_O@`BF<cE4+hbOu`SgUIxZl?A>({bwm>rPyDSXp&+pxx8
zC2wzCkh6KVK|gf%|Imv?KiRIg+2t=;wX~U|r|fd!yt3H!*SyMRn;mCg(Rwd;^X!~;
zRc~I-=PS99)w{8F62mr`Ee22bTw?uKTfN}b^IWgB-ip6=vb<R4o_gj;j?Ndsp0yf9
z`#Qz%ICcGN``;QgDg4*GeG^{46lS`*y}34FPK8g|L=SDvWsg%PmL^_d_Mi08^HaVM
zN6n{eCR5(*XAg;Ux&G&f?}h*WoaHXfdaAv{X>H_P1^1bIW<A~!Gdqsy?Y2k9Qq5!6
zDLu6C|IaPs(2(8uD)*k|+(ozlJ@2jfsyFxkFM*z`Qxw*hO@9Ax>9WXq(}Fg-w$5IX
z+R8XnS?*28>e!ykHD3#t<Sn$T4*C6N+8i(KjY*#mnJm$%zp%ZOF~28u{zb8woa)<c
zc5vQ)e#i9b?1}1MGTlvEXY%ZceKc<c^Y3Gd@6FA>?XVU+_~D=1@5POZP1D{eXE7RN
z_|D>U={z9zgClUq%8Zl6>jJjlT*`R#v{Ku2(TLb6_GssYy7PNGk8U}ao<3pk+ZJto
z&dey$0`1=>3ibUq5A*qbqvF@R&0Umv-^B9O>9rX~MYc`HR&NSe_j$cToxr8C=4`HS
zEN@>ei(V#gs$I&J618ykUi1DZjV&bt4|9KQlz%So5V$NsHa5O@8Y^%26#vT`!_v=4
zPWEFz;G}>2Q-EiEWQtZJ|D=n>vsav5lVzlPCdn<;_w9-mdlz+`S$o<qG>6$Y>*T8&
ze(ygn5!(5<;7XL^53{+ec1)3sdM=W;_qBoCw<jBSotw^Z_}Jr_-sd)5y}It}8_D;l
zCNauQIGmiMtgHWNp<~RU8Oq_aSG?JD<XiickNPGhZ_cap-oI-R>330V=c2-sZ5)%f
zFA<kqwI-S`UvcdmnYl~V)3f(3P<`=UW81%L9Fot{X0BO$arfh9^TmhN?PX>9;`Uos
ze0%i#qKE6F$xhyqF~>e$zPBQz+HPWx%E5gS{?{knJ7DeSVDUDLX@AP%%D9kFt(~*V
zbog&PT_Ss4Hog5DcbHM21D_LD)X&#*m=$Nm#GF04ButZKqWDe`!Ti+ce?Fd!x6prn
z_T#^c(%O5|wIk-vT5MFf=Z2a8NxP!tFzY`mB~sgExz;%5O7Ht7cTkEW`_}i=-*<Ex
zpSs>q3o7~RS+(uXl*pL)pn_R%I(e_J)s9(tA^mp=LsIRe8*5#Jyq+)gjX0G1Kjp^@
z6D{kRoIeWBMgO<oP*S-4q|9dCklfbrjT0ZopFXg9`?|SuwV`)&O0PDCEf4JFn(n4k
zp3-slldiyN#ggyq|EAu3^7x3J*|YT}CWrD*$EqKAm!c5N(?69nXldl~5JowEul|eX
z2kb6;A3PYdm9KeInO@#`-;X!jCUgIJlcV-nA|&(4<ZqJh+mat=#>723d2>(Xvcvza
z*7A2eKlf-B|HZz!QkRW;R(fy*{Z8SQSIlL9?|49L`s!PU{~lWXejjgDyuIA=2zj&f
zVsq8>C4KsX*1tHFQn+o8@a7Doe7DOL)6%$=qB9mGzuzUYV-|z`O^(uSB};ZGvra$8
z?q-;N)Z$!I?NwR*3%RleN2QN0Vc(&<Vy{&8nJtB@wkengr_Z@{de2_>-Rn;?CHR=J
z+N9-g*eIp7TU&hE-c`3&cV3^!svsBcdM&|b`>m7jg)Ye+U*#A3(?+?rDOyHSP2!;K
zgf})>+x(fWcEm{suStFN;?gS7_5N8=lcyi(@Z4~4lPb^3UY@Sgj3<<C{JU#@-!?D!
zyIZokpO{la;_;02=Q~-StoHjC((>lllIB%2tMm`obRU_0e(ijtjIguoEiE$g$^>rD
zJ}+|E>G|vx|4LdWW~n%>Rr9YZ{?Zn6-zDYMPR7(Lm3o2uCp}dvcDh_1qni7!g|UR?
zsLV6YGw(U%{=NL6DeuYgEz;((`i0sU(TnFV>gQ@aFST7?R$iv3udjSFBxFju_2nP=
z)+_wNtVO0uq?a1{tB01vo!^w3_sc+bJD16pgy0yCO$!a*Pg_`Pz{ZrqX6(k!aDuI@
z{^XwnOD0HaEVU30*R5b+H2u8COTQplz?fgp+i&OL%VFY;9_LurSKHa?Pi0>npskzW
zu=~vQHYsnRehdBQ4c(c}g*g@H=53hh?e|U0<er=R>iwHO{QYh5>wMuCjj9_9mx?ag
z)-{dc*~!BX-}}EmUB7GU?kltNrmZ>?;?yiXVQ-S?q2@UoxhDS>+ZRygV72mks9(pT
zjLumtD{pEAo)QY{jPty8_hf2PQ>EDTH%$}O@AdS)m^nQ&aM{;Gw}V2Rtsimi{OT#u
zzU|PbxRw(yBjXP~=<=RdSmaP}iA(nA4{e`2>#yvNuN13)Dw`PIbjG!@{qrVsDNW_I
ziywG~i89}tGX1;ZHbys}-(4({%if2J&PZ=$_WQGX+01xO+1_)^y{nlXf3<v{bWnZL
zstNl!-|9zBC{a$HB5bNT$HHZ4>0#?UUW0itmM+UD*iAkWAJmg+w{EtIF5kf;VeVVM
zmTTV4TJuFu^G*tjiTq5jZ*p#zEv~HfWKic+h`4;^>PKsS{ssTP?UD03bZLu-H2aKd
zn}<<$udlnTF7947sr8L>sKwoT9Q(qoZ_7yNY@E)%+p*<E3Y*f-aw}&xnSd`UbH5$#
z<THA@Ye_;|@x>;yrAh*qzpT;RDP^&mC57n$i?Qa^N9$jCWIbE3fK6rH{!OKA@1=@f
z6d14<zO(uLd{_5do$jO~+gz;vypuWcwR;BtuH{k6|1uW#u;$J=BwHRNy13$j@}b_e
z%lSrIe(Ud+J-W8fx`cPZq2LGaWjCd6p4oJMGDl?C%A_l5_w8yr+(TO?AOGY%ciZDD
z4uAG>e3P#)PyP8kgw5`wmDTn2O1BHMGI)%w#5L477OrJZj+O~KclKqJ%$953+Yd0e
zy1j2GSUc@-QA5M8!&L?DN)Jwo=^UA$?P=Jiw<JAc+4Fw?donh;hLW0wb3Zd|J>-?A
zX==)RcQK>n@>+d`(xgSjtKL<e*xIDyx~BHWx~i93-Ul7;nz*m_)3>AlmiKJAI{&<7
zh<InY>`U?4XY^W6>6FK-bDWQ7IJ=64<yD03*RuN5ed<!3%2HDdr9ZSMf797MNkdR-
zwsfsXw;a1$iMHjgS#os-H*58Gbe+nYx3pB>Mb~smbIglF_ZI&<sXX1?BKa^Ad**$a
z8m<RQteS74=lKidZdF*Fzf`onXv()K$L2Q2|8J7ymzZ?e^~!~P>vFWaj5igu$<AJR
zx7>zDS$4fde)NPSR@sX6{e3Tv$8I#&+z{e-I`h?9&WFb(8rXQOJvPVRT42?(ot^9c
zDUL?N@)MgE$+pj{DiL6K`6g58kW)#8$?gZbd7gWwyuQ3FHb!|t&mk#^M5l%*{k@#a
z)}53$3Tc-OVtwE)cl==09^dtHua0?TWx3B@wAw_1H@@|yXM>p3_U7lOdR*6ddtaDl
z`S9<Br1;!J)ums=LTqxmCfjm7iZ6AHocnmwj}Ax0Zb??YZ4DcKx!Y;`y*yy!aBKGS
zvn56@OdIA!slQ(F`Pyc!Pn$U2gtgRHU9L-S@?W-GyOQsmbXjA%ujPR<=F@9b{>-c1
zIpN#p{cY;gBqqF1jahRh%u;+tuI6X&ii@XI0%|5H-xf5FS=$_UX@Sp8rq4#<;ZyDv
zmuyKDSGs6dd+Vvr(fhMRu4d-k{B+B^cCyn0M@t(kHT|}?%dYmG;5`0B(yZ82qU-;`
zIg9}}{;sQhtgm3QZKk)i4|B<-bHDOlZke+vL(*0@UgY}I=sa=BRW+BNWb8Y)^zIwk
zeRpQ1thZg6YgBlaTUfq;FZH>ez)I0%lNh%z96VQl@8gM2G>~AwFS+yS#pzk>wtE6O
zn8Z&0)PBzwe?FfrE$2GR<2D)pDQ1OxS3Uf;ZNcA*cXoVkiJ7t^s^H7%?TY_SPvJas
zs_iuAsWS>O+l(f#E&F~u|Jch}Z#O)R7TPq2;lwJp6_(Q(4L)!3nAN#p7sLHJ;}$oz
z8L9yni{tH&acetldZcog&-vUz^~dx13vDVZx}pv5N5-Y~?7NVs=Mym@c~fii{ijDK
zMpqoDI(@w7HmBQ>Eq9U%Tr2nKKNjlde7mY8=!})Ha;2Kp;iY@-ik;rv?D+Oi*sTeQ
z;q_Lbd4Wj{8+D2nhKat=cUCX_{4<5A?8y=b|9?L3;`~E539NR}DAG7yP~j2(_IiKO
zmorhVQ&-IrS=<#aqTI#!!l%@nH{it{m94&xv!8SRQu@)7{q2D7W9}y{3oK@Oc<f7U
zoGdWmx9djD$t~4Yw_3M1ZcOKX8Q1R>@`7`^`?~dP4ZmCFwyvmYKXorKv}^*)?d4N_
zLvkuC&J-9s?0dcHNTl_Vz<EvQGA6p;c<k4-%U|QcqplfOAIvGqXD&N*`Rc{H*?yVj
z{eP#O*eoPvrtviGx?$?u^~HP*Tkoi!d->4jzdyI`sr16WrDZx@7eaeCeN$tZeB{%~
zNLkl}S@lc1Gn|UU=9#|Y-x$Rp>}qSjO?y)0gez65zP-gQXEtR@cgyA5K8)O!yn2b&
z_UXoaGb0n~gf>UNG5dVe<C*T{yp+A?_4zUic35<t43WQVsVOx_ZXJKYnhgiI7F}UV
z_%1qqvJTgh`7dS|bamZ&#9mod9{1p+;B{7p)tSui7yjL28SNBhZ@ay0)w&7;j(<90
zDWVhorB_QtJa>Dnx9QG;pnk>q4p9v6E_bqRt^RPq>B`1?o0rZAihagB(ab<6V7b!b
zCm%#q91kro(a}jdb!cwU|Ejjdya%MzuIIXQocxrRE48@t@zga|_w&!TuC4!MmUUfE
z_4L`oiXS~YEe+UoC+&4NRIYz!{`b_3>j7773#=||^<oqH@@iWC%?%ID{o*vO+<tGW
zQ()-5#jl~FA$TQBZO>c<(-1qxt`%!Pe_5w`Wc{hxcA=*0QdwS!-MNvpv2!V()*YEH
z^~oj&SA7mqcXJJ!W_mUE%_8@kO*T_@NS*E0+WYEjFUM#1Bug*JW&L%Vg0_XE^EK5^
z+xKmnSA4|n;|H2tz1&t^Yx77Fbk6;`GS>2_?MpAs*81lnBH87~;{Ly2`KY==ke@;I
z$RDE%c3rGtYm?p!mAb}o#+cUHhBLpcHd_BZbZud0j=b934eU9tv!eGbPYP~d{$OYH
znVqX2yq*`?#qoH-)%EZ0tbeCnH|@&@7PdmK)@Gw_@sg(#FMn4}$hosZDE0K?W|^-?
z^m4>}yM8W8cfDhg^YFCJj&Hx3CRUX`fBKs5-UBbb)6?R$uO*x{3X$}CyQgyUTIoAC
zOh3;#u}p9FuQyAc`kmXt^58^|`;$wN;=QjvrrlEe935Nj{&xTS6SW`brms>oD=q6=
z=|Asw+Pv8|hcnW3gc<KToi*aqFsZ!Mkf`uCCSswh_#xS423IyY)LM3*@5%bj9X{*9
z+6bdK?sZ3!T-ABzD_Y;EFZ=Q2=f?ZLmuh)moE?_C((736oq8koeOvmks=X`TqbYs*
zXOnk8$?MuBoWCAA@4CJ2;Tz4(`ST@&pIcpaKChU4x`p?Qz2b(d^QK!wzx`DTKdy9>
zaoPt~o;fKUkp^OpmtBwRP4L-ip19geub(|5B5px>N`*uH+T0-Crw8ZdT1KfYy=tqo
z=%n$+&Hq22|MT?4a{ITl^FL`#e{;}~;bhhAP5nnE#7<X}*m~<;ki5rZA%p8j(x;_m
z{JeW8U331Q%T6`|!8f0ri75Ed=rb?uE~BC7p;P7t-B~PmAKzs-*zLP9;QPeM9}4Qf
zJozvoyXuYfBpKch_Gjj9-aBRe#rbxt9<98PdwJHq<cu#)v)+fEjYt!5Ss%Y=+a}@N
zent21i9O$vcspx9JNtFR&4=bWPQLfz#cLzYe=XYU`*!O}uPvE)aM7Ht-_7fI%QpPB
zF5Q@X>ucG=@aMi#n{URSI(qWm2gAJ7t*htEezEQIs<jDHd09XIzI*j0c{|tVceh_O
z&gM{XcDxn2Ic?v`TbqBq+SMZ>(3dP}=lneAQQKZY=6Q=<t^VW}iEW5KcFMY}_uR^f
z94}66+sm7=Fpg_oskhGDgL3aoLU%T=b1ku0Ho4!?*nQ)PMQV#?Xr7iR&r<y`Gm7nD
z&f-G>|7J_fWXmnw@@+wByYsxy?;IOf$AsCgcIM}K^Dm80$8zhht-fm%o!3mW{leO_
z@WHt$e{Rnd^M1><`?aj_Awzi{tLu^i`;Nz&*7S<KPc`%2;_{#2!{%N3vZo(;&tTj2
zP~W*WcGu)x|I(hMzpm5xRC)PAhtS$GDRU`*rsJlc+C<*|y|iju_sz@E83nVwZp@Kc
zD(voSyt1_CQr6LsW67^>luezWQ~Ff?w((<CwInua!O8QyS2YK`isEqF%%se!$IN)b
zbLrZcTE2@#vz>T5CZ$FOiiez-C3NXTtDwz!X`Vkzu4r0ae{NdU^dTsH&Z;}>?}l&o
z{HTBH;xC!US?(Dp?i|(m9b<d=?4ygiL7y6YKWOhru9sUbFYT9aEFP|QYi@~5r9$NM
zp6&~W&TW!ab_;QzAK9l~8l}4D;={m*E$n$F9j}%y_`Bv*1;ccM<&w4+{0!pa?T$xZ
zOUwPr|0g-!DKJy-4D;V7AJ@Jw)YCH$G<Yb;S8wr}<#eD{bDykSf#jp-zkf4FX377R
zHHvgxK9Btpr_q#G!Q3jk+ImKsTRp!-C43NCe(X`L-_!e2`_6YOI@oK!ih6Q**A9`J
z*BV65iv>K}p3?hot!Lxx1@X}ZZ03w>x|tqsZ7e->myxrNd;YEq+t%(lJ3Ycm*xx32
zAEOh?UV-ZgyBl8Vtg_YmW>fP%=AiGJY3er)@iQDWj!s$?8gVsH;j-6?e{vf*ZPo@|
zS6|4fH02e?(i_ZEzOt81%b01&ammBQf_c>;_3Y0LOOxJ*1{^aw;dM-|;=rZFcZJkX
zf5=cg*dFvJf!}6!70*QG`;sDJ?y^Y*Cj_>ya<x2C_v`!$Q~B3-e|&pCaml{F*$r(c
zk0%BnO;6e^u4lBp*t{+zmwkQVt_wTE`YzAfHvOy3=47@P^Y^Ga$lpIb$I5HdArHq3
zq304Dyd9E%Wz39Q65%<IziHF??+2yikGdz$jc+JDQF$}`-z4)caZP9WwytGbF;+kC
z>MgTtsqQ!EU%30@llw1X`8NwU-d=h#=fUE`*Z6Lm?kQL9?|*P;&#Dz$A3b1Ry{rAZ
zaFWdo-OC<<O9PxrZ-pOloNBZ!Ro3QYj_<d1n(tRH;hJ|vrF-X@YljZI7$q%SJMp7m
zm|yzLOt$@XJJz%XA7o;BFo);pNw=jI-KSgboN;i>{+<5Y>!R-2d3iSS4IfsOc)95n
zTqtFz-4SjXK4qs`@Rvnmj@vx>_LV<g80cJJD)Dtzh-gH1M5OGR*t4JCX&ruRBE7yT
zsnm9g>Z1$Cr`DZUfBs<q!uXSgYR^t*T3IFO&E*ts(B8XLerdxNmb+8tT`OE=wB#0(
zxs2aqt8;B#D|sun#yz^ma583RKuXM+mNWZ}r<|#{&UEBspI4sry^QuM!!;dIA<-T(
zFP~OS*|ol8YXRTwDE|r4LXRJIhu41#dUW^s*K<#9WL;Wz($u<cwQ*Y5T!9$LUxydF
z=Gfb=ZL-bqlw{s(^ycr6U;Lkg{s`QCKlji1cK+qjf9wC850hVi=yreIg6`<$|9^Z?
ze0BeQe(egmoRii4(cd`)ZsgkMxPJeg*JK{la8vr=BS)jc#z&_$kGkA{cKJ%0Z1wq7
z`qtg&PA!`G{lgPsuglGSr|RV&@4wMqW^{5^SgB$6Ez^HjSB5IDW$)`bd*z$++D+@@
zcZnYVqNusVtog;l-UIu1${o2?<&wqLc&#YwGkel|OT}Q9=1sK&R%&bRChrMf(ih@m
z;dDCl1e2Nf`k>z_!pR={)h)Kk-aUFuZQTyv2*tU#maXnTZlq%{rS;Csnh?E3&gPSK
zCVL($QAwHBsr@JQ;N)fVYF$pfy(4rZC*Sw(+;`uma&_<ID-}=G)BS#7x%hgU83(fu
zT-JA<5aTWKyw#>~lh^mG)I&ypzW#fa6*YaP>$z7CzBpCudi;(&s&V%idn^0%6WjOh
zn^*AT%hk)x^Y7X6?~a>)S@b6JjQeb6*XLQD;o8k#HCf1c)9X;n#(l4HFQykfUt#l1
zc(UzJ7L9$zdRLM~qbI+TkdQ1fTl>Y%CG5w_TlZ#OJSJ^m8m#*6MeqNNwB_@rEb3tM
zzVKB!UFPW$Q^#fLu9<#wf?mGgo!hj$@8<h0myX=tZfLZ7hW-svw+G?&>%Rp|aa&Lq
z_3+`d!Vr;Vw;cEIee!viY<1(!zUKZ+*B#79*SFsAzw<jD^~AWwB$mfYtPBi-d<+CH
z0sx)EnVeb#x(ak@crNJZ&426S3k$eTxTPK}{I>L1m`=fF-5003^bUtf%yS5wa(0>$
z>!hy5yno+Yzq-0f=*rzMiVOP7&&&3g^XrR$xcxi4{@ne7Q%e#*-)`|d9enN!*Scb-
z?>YN;#P6}L360CzcRM;lPj7nhpU+J1zVX~MTCAe-W*+C%^bDS96VH4OT5Hs?Xv>Dy
zv_KY{(^I!OED4zwv2Mx7JttE>H9nmsX|g&sp~&r`E$iw7N`InKf6iL?P)b8@XM$AF
zq{6_qjJK7%YmDA{Z7xeaJ?FHn0CV|@>4#z~zJL7dyXD{0w7<W;-94|(|6%nZp2HJP
zR<BAqRi3*b|KppOP0=$~1-q`By2kI;ihExcHD*a~cp1L-<SxMqABiycqQ;j`RwOhy
zoY4(vw7kl=#LGGCnW~IL!aAMFoM~+l)8!5;Jm#1AJk7xQZr|s-2e#TV8Jv=QFR?71
zBOr6?&7PZky)H;c31*x2bDx$8=sNDFwY`;-VJYvt$uF2zD<|{mDbJtDe2Q(K<I(vN
zTMcaASl$i)w?g5V!ln?b!}n8}r>}^Nkgq)czHs-6hgaMCEB038^KAI=B7M(32EIG*
zE^aICl~mc%x6)Se&xIXdZC(Y*u9OM=c|X+G)#d#euKfR^%gd5=o;}v9IqbXjUf#uT
z^SREPXMK1n{$QH)m8RC;56{=f{#cu0J}Jg*(rLd<IVz|9imrOBv+B%LId;D){?-Cv
zG4b7rTQ&wg>MW>NT356y;eE-$TQ`_KJl`$#lWAS=?hosFr*#*6jJ<G$@0V80)uh{R
zLluQOHXgZ?s+#*-)F?4(%DVotDNPSP8854@I?s9L|BqOf`^ra7&wQRWJ(K-KR>)Bm
zF;yR9rPGorUYl3-SS??dBeIU`xrUzN^AJwC%WC|3%o9T|E)-b(c=O|n=2s){E?2KV
zdpX27O-Ib&*!LVE9<#5TJGURbvg^_7zWZWlw#1$Zi%UH!?DAdvf1U0@JBMG7Cf(MU
zC8c&r@=W|8Yt`9hYrB6)O`dwx*LU~%%(f{fR%HG>A(DAYeg>!KB%hCu($iPl$-GQ5
zSt4L&C2&{#i-PfO#di)LwWr>%D?OOsyzoNkj}w18&wVnKt*~R;Z54j8Fg|l)W4V7+
z%}af*mAXog9K3>azke?+x%cnZ1Q%}I*i&o_5pB;Sw(F{1RebSVD^T=sq=9Rk;h*2P
zzlO_Rsx5xL*ZYep*A;iy`kbz}myb&~2&>A>fBS0D_a2os{|d{L>ekF!S||QXPD7>s
zMOBc}(tDdVMSmFeoHAhOTmSUckC!#KzCYQuYrPuV_ZNY43|>v=oqZ@!(EZcNkBN?L
zPF5$m<_Ja@y%Z=)`Z(2N-!;B>H=RUXRx8V0kt~xcUb|nyW3FeOp>c-svn7qIeiv-J
zpmQe1A~-#4X`0zJYhEjro!0lRtY2~E_@c71{#jcK<M_%dqo&4ewJiHSV|8QmvtRvR
ze`#&5?o}08+EgOiw)i~PpT(KS|9_LaZ1G<6R8Qv=k*C{BR@?9Y=zk&V(VsF6t2U=Y
ziq_xke>kr?5mD21E@`5j$jYqMmpig7YQ&Ylzxv1SV`6($=B(@4vwTnT-ibUnJT83s
zT3S!Jkca(i6TyPu(_s(N<{8U=*O-0n---U<gA>h8b*gz}S=74cP3!T<nX<zC&A#OG
zVVs+D-*B!y$|~;ZzRsWhc}252e}&X>8J|Z5ODAq#=KMi8?SR^|*;lz!bmurc+x{=P
zw<c$wBY)qcti{iNtoMJxC$#J1E!|~nA54B!bgQ+`F*k0_w#_rm-~CUnc#l@h)-L#$
z|D2V9VS)eygDQd3jZ<@yib{+13M!w5Kg_#rCh+h5@&~gRw}eM$1o24lR75<h$_-f0
zyCLW8gA^v+K(pvsA|6^BqrWtMld9fSyF|si>v9US*_-1mM+8qk{<wSh`@ZGMpDzF0
zynXRbj~$z8N~RS(by3?PIr;J&)oeSf&Us(@PJ}$SRu0Q{|Mz3=92?6@t3&6nKk>2D
z+n7<5J3~0?Yt_t)(n7~0A95XjJfnm6noOcsrnpPa`tL6;F2209v`sa!Ddm>H_Gc+-
z)0Z8XklS)caPCBx{36Aj8wIz0shYZOO+e@6s9RM|@9*Ey6VGy;p(_4$ite<X7df|A
zD<0OKanVcE^uY5~GrGUmM9r<xXt*Bn+%M-ydxHC!GpE9m0=GO2)7G4}^~=t4JG*pG
z|A;%1|Lt0s(E7t4RPP^L*AwF+zJK2NM=!f?etCLx_4CJa2ZP@~c@-tG){Mh%Z}l~w
zQkUti6Ebzb?3IsUP%qybr$6z`ty9Oh&iosl#(%20|5d;hMukH{M`t=ls2n-@`DKa6
zv{vPn&mu0~JG;|<^Q}6&T0@o3-PfIyW(xV$IPe^76yZ{BTFX5>+4xY4LVPmsJcZ*I
zPZn<Jt#WMjIN1^~Q)P?HavSE=EG0(^?-$MFJ@F#?lb3d!(l>sE1B)EDOqVwCz9FbP
z^J$@ME9cK0{SNW`OzftDT{<s}&V|q7<BSvHEy+20dZO3QO%YSyU)yYX(lv-Lwejeh
zn)I;3d7q}l)!t%0prpN|JAa1eOlAgdtE$6GmW0R7$eq~#g;RF&(W?deML#YicgVch
zUw-^#to4b<4ITLtXMFi5Jl}4Ie4oVLla;3e{3o$*Dg06K{F=v|{j0wPuYYu#KRv&G
zPOoR8Wv4UO5%adE3z!RMsT3H!;?~G9{b$V1xB7d;X_e-G6Rh_AQ8=qr>LJneHt0ji
zdAl=5Jqiw=(erEF*x2g4Khq~eTeeY<yYR#|!%w?XBqwt(yd&!L%2N77wcy#-Qtm4U
zSGOI$b?gF%VeacK{X!!5#in~tWS#5(`0~#=RdY+cr1^G+B(KtRV9a>(@U!l8i%s)Y
z_HFU6OSr`3_2IpS`2q7yCqAawe)^`Eac_rb<(-7WI~T4z=ZZN|yX(heCGPN@c6&og
z4Boj&O+Cx)c0%m&o8E%gcDi#lcF5kJrZ=~LN&cy>fKHttzZWgPF26evDLT1hj#o>#
z#grLLsu$LM<u%dR*LrkcLDkI{4=frS86K<`O3P$-<mtB-yWanB$F%@ufw^;bmZn%t
z{<n1gbWxS>3f^<K8b!Rk8}Oc^Lg$I})2)|Q$F=9|*c#TB`%eA#|5=_>+y5mh{WX{Q
zsUy4Z_IB%uCay9v_wH|4dvvK4=g}pHXYHyB`)2m$r}@lD$#=d)1}2<|S2}GLGk<a9
zkG*{RW4H0x>bA_<vc-P(-%qce|Fl`7kn(ov=gprZXFNZ4XP*3)%HC3kbBjM+ZP##p
zJmHhe@;(0C(|h-QEWIO<`=&)|p7*qZTPs%Vk>>hyZ}C5`|2kX$8uCwycIrLRxa91o
ziznXY$e!OlBd)pgPw(<e`xrgDQ}18!{(bf7)9LqC|G0hrU)#$*zaDK#{v-p5JIj)4
z9k$!anj8+D`09*z%)25U_8I3tueW-7j;*?I#oGlwMfG#H3tkEC%B`@FUNG%_lK&yU
z16m&9u6jQgncC-Y%QD4o`RXiTW7fFKEBxm3&AVrDPCRqLdAjhv^>1?A<*wYwyE%1D
za&*ef8)h%LZFpxX7tPwiwD&CEcDc7D4{dnA1piw0=F&uV?`<s)dL6X4Jkhn>u=!8e
z?p#$?hAN3d7si~t>f5dSJ%zus7w=jbC4P0oD*pEskE~(?r&@e3cm21eI_RzK{lrC?
z&y9Z>ipZb5vdZE6zmv|(ayceHEA=qb@K*Sz@}}|rqpU?!-$mx8s{dRd`utGH6z}F`
zS2nJAs<wXRovY<j!x^>&o(g1>zrr4SEm1%u-Z-*g{r3BTEpC$^XZuGiJYY8U!Mw7U
z22WycGp+y2eI@t4$i;UD@9i)Bx<HxZ(WII;<}y>7K3v?b-n#ztY#YAXlHIPEtp5&f
zasQUGRIY~OFDGh)yzY4THBmMOhF(4f22DaWMQ(9&QD#9&YMx#}<=XH-P?Nmw`uYd6
z*dsgErXG!ZcJMIQ@z~AFJSXfpuuDN8<7JNFM33Gjk2qZa|9+=&YTBGFcMpF_h<Nhx
z-H(sE->*<ED=z(Y{YlIc1zw+XMiau;u)ff&4*qD;e)9DX6^o?eP}8WKqSJBn|9s(&
zes;jiz-tqa+`@p+&et<o<Jb;Ht)8TMa@V%4Z7PY2)=b&f<GoU6yOXCd%lf#zyDq&7
zOi7SPUs@qFY3<ZBwdYbs(^m1^;CdtGu*p*I?2SJ^X6SlN&I*i_@d=IWWZKesF;w7(
z#Hk~q+bh3k&GtIM`?yWFHmXpj{O5{QXP*|_$z3h5`fiK)n`ioWUsq?8vEA)D_b6t~
zG+)-YduGR6U3B76?YZ6ccPCX^8=P0H{n0S{xa``SMsan!qEtSYcmMpox!Zmj<KgAp
zT%Q6nRAt}YJDFr}V(_;v#&*N`1x%eT9;|P8{C96uYdGXE`?TOEhXtH-A9_Vh6Z2rR
zEmMy)3q8E;fEI5>oaAQ9<IE=yI#l0bo0%LmYvG1_vD44ZkaX=fZ`h;Bwd~p!k&Rn+
zp6YqbygjTtG`CS^ZL7<*fE%}ZB>SrBO%`RRlyE*-_k`b}@04TCvas(HqRehRQ#u>F
zXUl_Q3({AXbiVH`pT1HfZ~Gp>ev8=fH(!1UXDCT+n8L^Z(=07Iu{dTocdx{!EoWEW
zR-FBFgQGygzns;TQ}4`nIk9Dh;cmg}(#Eb_bGVc9d#{!Y&i-?){(FhQB=M8R$tCsG
z*QFF#ni4B5rOjRVFL^7p8#(XnJM`mT%f!Q?-6H8dPjCI&=_&E{I&bo(<Q`!^weM+7
zf3C-vKb+CId+yhHTJe#ub0;cqowoO+LV^2*)j#-MW(Bg#r#%r9D&gFu^6`vcNbc%e
zeLNzs4NtdB+tZ@y>~U<(kzKRwR-3SEpL>6K$zpX`1>RqY-*OylO84&AwQr7oUfwYs
zo5@E$crFd)IwtV`V#=Evx0X3wO`Kz)#WVTgf@Vu$wWn6iI(LrRCdmi7PFUFHy<}yO
z>#Sm(DTd8Pz8^WRhwOMF896P`_XkJckwZ$cg_{e{$A{0=la4g$FjhZ%?-_63Lzn1)
zltmi~ww~B<sQzxI_N$#6mp#`H?vsmND!*aQ20xjLC#~l(ujfAffV0je&Nz7e^&3Gx
zchu)NmwaPd^gLbseY;8F>-iIoDhhp;F1dAk<=&a;lk?d=?sa-pq4l71>w=?-*56hy
zww;>O$C2u(_{4dW-j8DyN(*oJMc%l4{ln9&k}ryRyEm<fDu1|7E~vGuVe$+9trFI<
z+voi1-uOdExL>|9@NmZUWVhEJjF$?C$K+-0Yt-*Ne{tubEbWb+i+`P+BPv$?h<(wE
z2^S72%+#5#*>fjpO-SbAe~ddHDjwJ}dq%j*zZs{G#OU6S)xS4KEqwa)=O@qJyx)B@
zefukK3E4;YuNAWE=AJ7LVqe94f&Ykn*6DE82W^Vk-|Mu3ynRdN^B!!uFmo4^ZP%lH
z_VrC)Y#f^1{<GILAK3n4y31DYAIeHqYPvZN+c&y7M@=$*WoCD@Wrw+w{Kbj{@wh8b
zxww5xuNbQcn||{Ud851L&c&&#7aeTl@N@Ee!G5&)0ayFEI=SH9dB42wJX*V4=p}Q&
z>J%x{<K;KsX}0FvG_!vB@cLE0cROYO+~q9P7TJAxN=1J)%knFop`N-&FKg%qto)aJ
z{grFgwI92f>onQ+x?G$Pvir8z<!ib(OMdZ-PJ8?B)u-N7f8)&Jds~|S_H1aKShpkY
z#pVOs<HW1<R4u-xnED4SYP-SPU;cf8{jPkU-PLNBF8yD8?MqqV+&g=!i}zZTP85FQ
zx1#XmwCv9E$(qrL@drh{V;4(w@!l&?FznqJ@QY>7!RWrE*B`Sq&voC9D=Kf^&9aqs
z|M|nwM+5wA&dIJ}-m!<dJy3p1;r6G~%S;3|_<dSw=kxr%Li0RHn}>P((ypKWb}jnO
z*JM!z_un$gSvl(L)lUx{cvr3TZtl-Vnyq1Ghl-cJxa3iO^4{~a^Uc?|wyt|1^>1bC
zG5dxUi=qmyT$>um8doRzw)tXvFzd<)^Cy|}L+%Kt?qW|<(YD>hJGCxV=y`701<P`t
zzJ1Nf&mT%Vl&O`sx0WwdVfoL5TDKhRk@6LhW?%@5Bzy^4dS0nsLFHAO+eNpJO?v;U
zOY<k=ldcArQ-wKmQ(viUnX|YnHCs9T?UXgHZ3iZ}urOIjI0(J{#Qrw_&Gg*z^E?JS
zE-ZTcW@Xe=UBTj)^IpDuY5k)kHqNI0`Mw^ei5?H<wJK>Ya#i^x{4M!d^V9<Mdl&C1
zn|W{cmD3Gpoh{Qlf9K@ICtLPLa&8kd@{Q2QbDfixJ>v}5!Rx)8|3BY1NH6Ls-j|&2
zshITQ%x074u2a;itGjJtjqk@#ah=J1KmDTAFRo*gRdh2t?%ck8|Nj0Hmv3u`Oj^76
zx5mVriO=3V58uC0AvQfwr-;+oDW~x93%4t0<<8u_ZS3&8@#hYW$qPI#N6c#5@@vY+
zBvJR`&oj6`drteT<Ik+Pdf`#E?n$bTC+)px{n6%pPGd)NgOzOIt~FAZd(1L_#a(`^
zpJbf0-*aNT*ut#9$DB|0^gOz-x;$dC!{He#+irTXm_N_dNchkF?O65a-$z&4|33cm
z&GgOT_VeEu{xIzR@YT(vVe{8rIzMd0^pztSo_3pfJU-TPZPod!1rggWysnjFJv!T0
zO=`1Ck@V9{r=CUW^RD@RyO3Lb>br|hYt$d*go7Mx2QF@|4B4Q-W_QN@h}3J}ZHeVg
zsXH}T4BR$8Du~inY)w>nu#}-%U?E$2LC*}I!cRdAr;iwVi(80x#ILy&U?`>EWixAf
ztAj(ghM?j?-KQOntJ~UjD>==xbOr9rVoqjSP|9rX{k*<wK|=HHP?0qp@dCw~j75{4
zWmnwGC`h#Wa%I}|i@GJ#C9D6vey`-N$I^HFa+|Tt#@#C-4&LE14Vb{5<(t-?v+Clz
zgR!;W-`(XDdL`Dc+VN>YkEKqGj*FhqgEIbOdn~HU>#CSmv%lGSz*Tcs`pTYnku2A(
z;y*YrL@7veUr}8%>pN4;H)lir>2~L*e`2{IX!#_IFT8+-|3pUkrW5PeCuYiLuGP1g
zXR>>j+{MSU_Z(3_9&2^sQ)Yht%qe!89$Ni!C|blRk&xT?I>oSGXnETk8B3NQUneF<
zP1}_kxwWVC^p32VFQ$23Em{-Zw_0pvbjseeMJxsh6Q?ukMt3DWU%LMKcdkcL_Ms6=
zF0B1=GHdRYv%<Uo?#SDI?beHoZym=USDi}Ezw=_&jaXB;y6kIR^VeMSyc^T+=Q8WX
zH`g$~mmBTUcSfGSd}Duaib?;Y6*u1a82+B~aM>p#J&{?iyg6A`XB?95v>d-XF|=QD
zSC>=3th<f7?(#724LndPoLHW6H*|5o<DwJn4*d~}Z(iMeM{2X0+=+K4_h%;T(Fy7`
z?)hQlnJUP7NmU{E)tWw|eUGJg)~<QAj$fkX^R<Jk!q@&3tUmpj#bqXosoZfFX;rO2
zuKzZ(8!PmR1<W)$4x4BMR!-pf5V2NBs9|x642L({be^LYUg0c7=>j@QeEU7EKj<*8
z3|pe`O?cvG374d<%c@<rjTeMo_%|NWiFIey>w2znAy`wSCFalOo&}w=SFStb!tgER
zKwf1`mmqU1Loq{`UQ(X`L+m8Abvg<9HvEMSI@4@!Y?z^bdXj$P%hWch3vY7u!eo}#
z&zp8y^hKL{Ps-ZgVwyV`8GEyA9AzizB>K5}U0^C?k$5gG!CfNpaLR9`=R33-HZf)U
zKGA!1VaGE5e#cww(rQ9i-YYgMHf`%|vh!-%!Lv~GgXUc+W@kpr;D&N#mt|XIBixHz
zpG|kEW#p0Oj<{)`kTWa)hEeO?GnEC+M-E)J{noc<vEb_O%okYBCw{e@m%~uT9?@jE
zuFb)PQAX?&Q&RgiqsBP4&8iz%terCCibM~s<Cp7a+L8E7?}t@ac9plp&#3wOa=j1P
zj6bvdlAKf^=X>_}Q=@ig?H2B9ZZp-FS@vB%F!dt)!zQO#rou+=NiY5P@3-8$rTxR&
zyWMlvZ}-1<jqi-eogGVC&YIjdcbK<zcM~(~tru<y3<euKie5~+y`$VwEK*BJYMsOE
zH+>Pz7L7R}&Pz2I&-FW*Gha?y!1sM)xyhBH%)M-XmoI#)wcy)JhwqLPE-0Js%xBi)
z{ytx||GRtdGn0!o7joi{XzIsYoV&qc^6D9Wv(|cTF}r<Du%KvDi8Eukuch%OOC}4E
zh>7Z~y_uz_MENi8PLnozx9F~jYM>w^uYJdco2Ap;4-`7c*l^ul+WPiip?vQlk4uF+
zw_Ux`!rAu7SK9xW<NOv`mgBK3*%uZj9R9RtYp8)o^VHQ-bMohVoGPt;ytHNMy2=U5
z-`=%-cYCfSzwVSf2B&s^K6bY<Rp}>_UgWGa-a}i?ck4~Pb~W=}qs>dFV~ZJOCor)y
z?Z4~0|FzGng^K5k_Z2?Z{LqxMS#d|N#_NQcZ?_66B?$GY%#btR{m`l0!2V@o{}z^a
z2Xxn6)=NK8#JNdug2eIkuA&{av*tQJI5fedCL@OJTzzqm>I|#Z|M%_w6>TM^&>K*G
zv6a7M=E3HdXX<YiN6b~#47@P&_nP)1jb9h9X7T=8*MDCmB7obwKq|3V*Dlyj{@%CD
zO&n1S^S?0icn7>;j1o@pR$Y6V`=8sJMVqdii;3oN?LOoiP~JH4$)t&w%oim+^n9<X
z>eq0yvgOlKsg$t4wf9#|eU{x6%=NkX#AUmMdrC!jNz1HKS+F^uKfp-n{r1L!JCRA}
z|8C{5KHu0MChJ#oYrAofYeCEDlvR4q4vTB@$xCfkyS3$l{cF`VGZ#N`d~R~geedQ2
z%Wu{=Or5_>k1al_@V=EyfVuYe#R1wICfjZJtkDy5g`+5nO;?d2-1MR2gR}*<2T!p-
z&b>R0;i7Jao%me7Cwk(ciM`)~*ZZ2^PTF_1t@QQ;?qkX3GwxhoSD7d^Uv}rg&FOF5
zG7elUTfFpt>^_F~0=<<RHXAGmof(nX^4I3wwg{1{a~DiFbyR5=`?laTu2_8o<t3YD
z{gZ0WJjZBr%%Sk^iA{g6@oMc6dF-8QsCwZ_*}+DJ@*Rt{JY`FlUE6l}@w=)Ad<+lG
z7Bpzg6Du_pFxwS$q`S}K-R>54_FpsPQf4$a>!;6bZeDD5SVpGDzGRl#o~t1RTQbdx
zA3idioUHD2cV@#z{ew)abqXIW;<@Wm`yuk1_{~!*G@SoTJ;>Yq*Yu^17<WWvw6^NI
z+$rJ-`j^jK^Idmt-DwYvqQ>rnO(qOcXPAnDZpzrY-K*&KbdB;&TBjsfm>$=kJ9)_?
zJAugX+213CR@BGniB8g4+TmZyUT&y*z_^5aU(QOe2QdNP%v$ZTgBNIBS5msSLv;0<
zq(q6gjMq8(yxrIS7VVL`RJ{KzgUvpfJ#S-q1daYX7B<Xbi#O1!IDU^IkI%!X>FmY8
z$8Gy}ZI(AsIWbA8!(p}A{Z+-wb+_%^tlGwXYuX>NseOK2Gu?9^&vMc@(EU0?{HaWr
zj`*>#(`L5iE6b#=JN%woV*cymhL$3|W}8#HnreDiv-cdB9Bq3g?|v@VBK0n7ZwdPi
z`Xx`Vtj|4HUR|*CX_fnIj;2%0Uw5?pP5N6Z`fGMz&WWmjT#frTb1h$T<j?v29-fQO
zy!dE#@aMa#ji>k+f91@)vRZAY%1>{jbCden_D<Tyw!pjRih@m^ICJ{HS?Q%5mIZzv
zu6x+0O4`cH%n(x%FbjPcX})3im5SBEX-b>+hg(MLpL3K?s;k=Y?7Kwb?0sIshIg26
zH_nvl?lb>krSKrxAtB*YSA|Ocfqmkyd~D9|mJ8(g(BgP_!cKdG<>uU8&!4SeN!hYM
z(@N}APSTu^l8}G;yLT-Uld{j{*?Wk8Rk+Ib88auV1-@E1L4wEk{?&h{Xa0YDdiw7Z
z=I72V{FWelNVv^z^;zDVjJu;O-u-oF`P*s4y8O%UX?50Iv+bMqHeHYJnZd8%v+LGw
zhtqeCuQ<Wba9JUM>9W=Dx3T*w|NYu-t{ih&<lk!6CRzPf|6}?N)|YaRcHP*YRQcl4
zk^|9Q?`$Xetvx*XL4hdq^V&x|*-V#aX#V{;L3wlI;d|=uKYwpEUc+`U(B#8mrYw$U
zYd8b~-c3y7+{XWW-}xmEDmOHle%LcX<e^>RtjW7?ONak`u%o1)zx=@8_YJ?>*B`RY
z{Br&0hi5zrdyX4hoGfTK(LO)+L(1<af5(bt+?xZQ7_U!n{T%aQ_WF2ng(KceZY-VE
zQYti0Yzg!8&@3T7o^?i^OLz?gJ?w7rKC}I1&vdx%R{8<&$ViKMT|5fn{@)*N_|KBe
zC*S7W`c?4vM6p8_s}Jk(yq9@5L#)}7^VIFf!rhm@EITvffss(<*#~bJW=Q4f+Es9H
z+Vi|?Kk{gXZ1`c3+u4;4y4BUyQ(mXrt3UOg5UFNszd~E^K+R*5v{TO;zd!chT%2)X
zJF|E6hy3hqr_QW?v1{tA_PGItjj@q}lTF(+#af(SZVlhB89k4o;n|h&5a)}m9KRG)
zUfmU(y>Nyi$BNAJX~z9$UE&IE>?ky}T&8g|Mx@+HMN5|@;ZTNS;mRhpS6^mc$qr<d
z?qSamO}eIjAc{}tP@qY0sknvOsmQA7SAGZXJkaIx<>AwttK<FZzv|c7))s!_JG%V0
znVjV+{;h5A7uUc1&HTl{^WS2(m6d|C_gc1lCws;B>@v0weR@tIRK5StsdaO9&S%x0
zvb)$`FX*dc^ecWwsT(z#a{`~Q`ts*MOG}r=m6SdE0w=gOvPp41|20`x=%e4owmlk=
zOX5`i?$+SEY;7sAXyfG<oMzrH-n?|kHJJV|!6GN_IiIVITwC)jt{w5GGAs@!RtLuK
zSf=lGCRK^$#~l8JaZ@XQh(1s~&Ty1Hv6(%QX*>73=2f)^ThuzlPBP8gAh2#8i+tj`
z>`E<@3ol=DzkI!--|4xB_fA`rFLKAidiIF07C1SyrJp@Bjm>VO=BKr11V8P0-l8>|
zeZ?oM#C*<mMu+up?iOtRI&s1xF2=NXt86b9ii@Wk8-zst7TW!0HRF>j3_q>80_@rs
zDg;dlzr%2ErK*yS^0kcRUn+8yzb!idV9o5;>$vBe_$-mxHrGI>p{hXr?WdL6#`VY7
zHZokY2@d9C%a1minYizWlE;3JzdX6Zdq1$Ut$g!0+O6dMrQRr(slCDMED0+ZO;=tC
z7fF3__01;n1$t`z>vQ(6+T3$qG_JCt=E5rp!>0jT`ZgY4e4|s;{`F)L4=2@Sg55jB
zPt8(iPxneKa9$w6YY@ui{8-AS;-AL8>ofgZ^=8dV*fjq}>vZeQpRRf7@Jd7(Uift2
zFT=*g?2{UAt|?Q}ym(_(;d;AC>Xxf&j`;h|3~pSLwW*3P@${$lU!Jt>@ca|~a{c8E
zJumMp*&A3B*Pv2Yv3yH~WZ)MA0cPWgdEU`kpFFs}tzLD@=Imz^d5h;Q^RF5fo-D8u
zyE3JagH7~MVUBLd$><HS8@m=ycyRAgU%@<<<TB^YA&EjWc5BW|&Uk;n;pK{6J8rp~
z^-C@}Oney?%JQ_fS?c9=u{N{oV&B9w+z<ZxRAro~!mKm(P-wXH>ns6fsi_mMD2p)4
zh4wM}H=L}nf8piIdn%Hx@p6z$WmiP4sHN7v5bc*Q*Uh|lu~@1`bH7-TrnJMw0*%C(
zGqRb38os_yp1OhGNVzwZeTVX_ovR(~PAzQv-gotEpv<B>RSjP+GV~p)7PwncZg|e!
zTGphI-?}cnq||7q+Rg{_EKfLu9X?%m{YFzctA^o`1!}Sz`hwG>PKd7g#<Y6RtT{3K
zTP?O`++tZDxk{hUbd4>ijpI|j>rzhKvBxLv@|*rpV}_4<U!u_Qqb$Bnj20|zqPl*y
zmMhN8UN?QcS<&>x@w`rl6?2ri?`-+Eqj|9)*Ox9=As45h1l~IrOhhh!t7g6T=IhU+
zH&0)db+}i!Bjc3r{3O-y6S^3ypE^8SnK9w%Y|Z8rMJ@%+u=%%3RL|+kB^`HvqpKmb
zP)pBS>&6wky&@IISViBj{^aq-D9-4k;oPReNunm9FCtty*?uc1N1U&G%WwPba$Dx!
ze8wHZFNCH<%!^k@TNx(unW<S!=i#oLQ2lk&@>>E@wER}cf73Y-@?)ifl{#OfUsEv0
z@t?DsFWt*%4-HKD^yGtq`1XlAnB)5LugA^O=bvvc*{`0=y`)O|P=J2BY2$I<sWXEz
z+0x5C)lFQc{vrKb@$qXsSBsW+?5}+A>qUb0&JPFH%Rf1H^1-Y9eE0Y7mt*38e(wIg
z{<*JO+P~?2wYFNrP}a~a@OsUS7n>Q571^}kd&m$NvEbDLp}SjjX1N@(p0<*CU6P6G
zy5<R0cb#t?-l{9EBJ*V01hs!A4^7S2d=lw8zch|TP~iUR41Qak)H;r88<uNUd+L83
zssAJqb9%|1@`DpBYpPyUe%<e9zOU>GOL^D^>rIjxb5uXp>W9{@VUE|*aDIB8_4MKk
zd%ixZ?2%~@+u<#DOuB5l5a;bBs#95*^9$LM>Nsnfy3@Hk&+vZBK9#q~V%jQ?9h?2{
zBv&)9HB4||ZE{=nKx{@~#)bz)yfaHuyxs?XSi<TQ7=4vZc!71YV<hX*S6`>rhH82T
ze{<Khcx5Vkgr%s)^O+W_{nCAca=Tl8Ypwb8RPguaDXi;6dDk0l?-70EYOt!I)x^D8
ze8sX&iP8FxH2m)@zL9y`|3~nX*?G$U81^swxb}byW8;PM%tD9crrYg3Xe{x~k8RJ@
zn%vgxfA_UMhVJkDFzaUQ2QB^6aSan{r;6zt^mwb~+oybTzSWz0>E506ZOqXdkG<b8
z^O@VLozC7O6ZQo$&t{twC_mqv!EMc3-|rcE$5%dmdA`6@FzK(EO8{$^t4rD^`2)_D
z=N*gZ|7m=7Sw2Bf?_gWw@wf>qvKwno^<_lsh32u>-}*W0Urz6`t>>;Sc;H~2+91tZ
z&0`Y8|2fNPmFbt)RjmGsbC@0;JG}a1>2r;BQDr4DOG3|_`E>7JF3Xm~-=&^#x@|Lz
zUaBKw#q~wuEVtu)V-1fxDbKcsoHIySanJV2$z^<-`#qj5p0U8d(pXef<+E;qMexy0
ztEap5v@2QvX7QF!K6$Oo*Td-jZG%uflag!AcB^MyN}nI-e>G5gHTUM0mCfq5MN=mF
z9&W#GR@2_Dct@)9ny0)H*QpoX>;;pr92L)t`D)g(?nI$gd;jKH$Jf6(>!#BmRkowl
zbfIBDy#MYz_m(Y7_c(@cX!WdI)6y}ooI~PD#`*cdtG@lQm*E!Mx~D)Z<NDs9<HyCP
z?mLsub4zXoXF#O26YElQ=5>35Ch{NEU%Myn`j^Aq&rExcO6BD@94J)2+RM`>u&#Pr
zQCPWFe(xq%-T(5k*`gl<ta*}lEMMiAA1Gd8BlF;5<76$5tv-(@d@|(zC44woJ80=6
zo6uc<W$fonvSMjz?kkD0*nf3tlhj?0y*+FeZajj0SAP3%tWsSoWxFV~Hl*0D@~(Ar
zC=<6rn{<1y@tU(-YOY^XWuAu3T<e$P{KAN-M^|5J(ksUQymLL~9`ku0!OIc6Uu&1E
zoncqJj*ssLhJ*YXAGf|*w!(Msfo`GxxvE+hB^JEdRx`(GMa;Q}Z=UwAuUjToVshqp
zj+oBm>o<jjS2xXg@xP&iUEij#YUl2*|4}Tf^oweXY(-T>4&*IhK6aT~cxSbH>+Q&E
zw*S}*ww>}=_qL>T>Z&}|`MX!X)Y9#>U<u28bbF@S`tDPL?|ef%mYO?$_+S&5|3IVY
z+?tlsmV-7o?9WL}u(MsVeu~7bh82ZxZ)<*(ub)-f+v=KOvQ4SFSLTC<`izw|N4<=$
zw8l)y+;B#6N0~$a!tln-)DI>$2eR!NPyPR~(sISb3LWE`ttlTiPOMoXp61ACaab@r
zE&8Ed=I&#Xby<qv!xLmyn>TK)*x+5aWs5Q|laPzy<UE$RUx{9(tKLpgIk@LEOPGM$
z!SF-1yIA$!v1$L`&-La<$AWE7W-OY$_VS9{?Ng45X??r*^jY-vaM5Y6S5IDdD(j^C
zn(~d)cX%KBC}@5B{cet6Md9TEetLU@c%-l7yWCxLH%|20wzKAkcb#Pwc=eCv*R;j%
zQ~G{i+cLS)U37x3`Yt&pC)p#8EAA_)m1Xpr7HaKSEhjL|DdfY=){X54xm+41+*=iK
zTvqr~*P9a@9fkHA#7&ocvfN(vZ;xW6=H+uIL(c!Jc^v-j(6*rS=QYpDI(dnfheu3|
ztM&e%v|)mkBa_9RyX*O91^n81J@)X|q>I6={}ks->||}eqOhk{^^cU%wzPZ`b?av>
z>%MeOYLm&0n>}|ybkm;V{l6#XgkP;XF!k5%o!2DH@++0=Lu(sVQ>+Zu@49g7+jZxy
z45inyQ(qp-_fn3|Tiui_-FiZL>hjf&vsYzmf4m}Y$Juj!pDy#lIls#8EehPVU|%C!
zy*Z1Pnq2CxZAOe%rmK<^t~R+Z%Q~mEW_S0a8%(O#Bv?&NpGv5Oif%oSt++3~qxY4x
zhR`w-`!?~FuVQO`8*}s2w4|e?t3C_46bZgOwNJwP$q6p8?-7Rs*}jy9vK_cKM=&TT
zy;sBY$g3^>^{d)k4opd%XB9oiKXiNU!pmEleqZ|Gm1$CDV_jqWzu4_o^Cm}!HEWYH
zR_)Ws5Z}X=ZGWzr`A}8Chtdk^N&I_K`#&`$e*UDmKKa{)_4h7)d3|Qiv%j*7gtht|
z^c0FjH7;06m@W98FQn6QWX(&V`+K(SU+$&q67+SirdfH?m96U;Uh97K$>y+~C$p=k
zSE4a*)i;AflN$5nb`~;AU;nc?)F#}lMuKPc8BL!i$60Rj&+1Gc)kk_5L`g{e{rdcN
z?(MaTfwC_y-`{=Ns7HfgW!$@oT5q4fSl`~cA&Y6TjMtWi_~>=dn{G9o`Pa8eD#A)!
zTE^Fn>42sE-kQIs>c8IJS^x3%>zgm1K7FaW_<PKxT|2hzz0n%?_V}qw9EPR)*cxBn
zU;2}mRsHl52_E~%*$b;moOj6IDtUe2nsP3On{KpQ&hr^xx2*hU{bxE``-PwJ$uS*I
z&V^a8d3ez0!{6g&Tka%r%WhTN5bb&KURS4_<l}eiHLN$Dyw~Vp$g)~b)uUMFZvThd
zd!-(>oK~8`tlg0?=WFqwZFXOKD^!*lp6|0O%6NI3^{S-k5|8vVHPa{kd*$Bp`1~>d
zzyEFie*N_3tM;DL_CE6;y$<VpH)l_FnO$~?oVoS!e(AmYw^!{C-Ya{W|IW`@b8hd~
z+qg{6C#yP*t?#Lx_`<Gz?Edo?D)7u(Y5#cR<&GWiGk$4vrV6f(mFj)L$8rBhb?b|l
z+Z9%E?w7sz<lk%qnfDD3f6O-cvyZv0xAmc0j?W=pZ`)NdigVW0H&2wA@xr7}f?w{n
zZG-Z<1Q%Ye<eJLG`vUs&YAat9xEyr<73Q;?_vT@%h`rjK3=X#%^B0~fxiww(`h^|a
z#l?5ui`g>KzPean@7McxM_r%u^}V&``0M}c{fqw}b>GAsKKApmbpQEzmvk*HEUd1{
zA4~rHaO2Mpdw+gd_*JaK`M$z}YIXOp_vRl~`<|8STl*=m<I|3xZFj|$t2SvbQWsnF
z|Nr;L^^B-<YErd6=I_}V7~V=SFsKk%uaTKol9~fr*cXwT|JY3E-@16mH+2(gw?3I(
zn|a-V>&d3fb2n7{q_^MQtss!mIq7D=60ab?OG*E$+eK7QZz}#MSH{miN6_U`$LB*2
z52v?Pb*@`~ub$^zrq2$ggF1>am!}9>x*lik3s;%ZqWoUfO7Q67B{#hmpUn8fryIud
z)P=K8Xp@?ch~*1K--36QD@8237Hzq*R3)$_BaUOG;Io*FH7g&S`W&~XqHs@0)T0|*
z0a_}T5{i$RCO**7*H9K(YO%aWNVF>M>#_++zQT(x1icVFv_hcEj%Tw4pTu5ejdh~c
zn<r1+x3#MA@lR6={|lB+pB_H2d-;OO#N_iYnV(KQZyYzTx%F1@i@yxJ_6N=Ds5Z@L
zowoX`T>SID+g$rsWqr{PnK~o(wb8<)+g4}pe~w9NS@r%)vSVf21}E<6#|(I0|G8OW
zylYMTm4BhO2O{kwC;oWnq;iD!Ohsh>3!h885w|s__HL5<8S=z8WYG$-bG`F#ALoA}
zm^O8h>y97KuV$8f>c2dhfAi_hE88E0XAA9H7F573vAlMdU}eMBetCO8!8q<&3uc_!
zkrKglhU*aH9K!{SZ9321KM#%&JMl&6!Exh`mg^NabbQZjFgmRNy!-OX*rP2=cBI@|
zyKJVb-~SCOToSZr__M8eQdWCjuiovuw$%D8+14!$f{O)sqRtyWdmy_qNNkc;#7;)7
z4OgzXosrZ1BeY4!c#DpvH-o#^g6aSb51-5K!u&H<DIZ#8w(ruefXfd9Iz#R!dpcz`
znR45y*l1ie(Cb<-FZqF)!ktvroL+_navqa}I8Q1y{y6k)lk=N{M-sC?>q|XOzx79|
zP->Twx6J*mIm};Y$ck~z<URZCiHhJxqel<-Fo|=nI=k@D)N?bRSBg!kj$D4d@?E&~
z@d>Rv^*S!8I5LE$tvK_DyMnJbzJ2kBs|>yO4}8^)xqs-ZY0UoC*AnaAHyr9^<aTSX
zoa7TYLGsA$@JR+uqKr5HOci}HMO(r&*Dd0dk@<W7|NlNmmi)PV^Q%bNuWG5+vzH3w
zFz`PQc`3c%>+R^0mVa9opMB51Kzu_<v2}(EccfIOe9AwDpR=$0+Fo{I`KhaavJ7|M
zC}X|$zgK;K!i=K&+tckotzG@|M85aty_Ysl?%TdZSbc7eXT0Uh)w(N-f<nFRZ~i}!
z=6+(kz!%%?GMZOBPp#}*G*3zA?cxX3C7Kp9&8~%TX1w`&I4x#><yRqDZIz(idmf%p
zQWSJ4j9)Ao$9y*7LW62c&Cw>#9Sm_21rj$*wn*pcY|S~hWoyvP8L?;C`&dLLW(z!5
zy(6s@YN5V@;gxWg#5=3``fLY^ccpT*c_w9uR&08bwt1>dc2mm94%YlkkINR0d)))2
z>{@RmAKWT(X4B(iV&?A>HXYllQ5u*v<&fCR-7lt1dSK1rJawnGPiXn1$JQ&veT@{4
zKNL!kyZV%S!{sUK=B=<|OY}PFyEx@~iKOVqQwpV$8--p4MBPn3%IWD5WGgyzMPAZI
zHKFt)@+E5vcC)SyJXPXc=$O3Rx3m6trgd0brPx{yzXj76D=Zuqx6bX!5Dr^%%48|O
zG|RzlHyAvGG7ekh^i;The=%(WkB)Kb)`fMA8VfJ{xtSYQxsCr?LH6yp77Ryri?E*K
zxWg?f7P0=&eU_)T>hESN^3T2UX7)x&_sTP;ScE#wHnBfGvg}b=xgDE&p5C)E;otj~
zTzM$z5#joIeg8hkx)+D*r32JY{_XW%A#9_+Xv#yi+6%XRZr?p~IkH)AW!?)XhHfSf
zw`DwzGdFF^QuO)yTiN@K@_zffr*5i!+#kNs;+=_o636$>i)SCKeR9>*pv(9Fjbko+
zd!Ljn-(6Fc^@Q=p9Vv!0W#0lP1k7P|@k)H~u-|?0#poT4yne=dOBOayx?fm$K5(n+
z{6P8r|JDVqFEeaXcJs|wsr37Pc6MKO$IdOaD^>PS50Oh)D81+7{fL7-oxhoTYN91)
zzHNE<<DJ}vDKif<R$iNO`dDGEqW;uvwpxrSjNjW{EXj%r7kP4_>6H8Hjeh2v*5*&(
z64cpf)1)n+^DwN4Md<Xij9$qQ<K>KV?rR*#UhqNf)a`d|t5@F)ZaA&GVPB@>ip__Y
z8my5|Z4ow}%j?7cNc{qz!&i^>3u08bmhTpMB$IRT(ZOwwtFteBs;xE;3_ZE*go*F@
zS=(YZyxftO^|f#IH^*gfbG^^`lvhj4j@~}|-RrdLe(DXPVFiz#7q)DjCSu^Y=&aH^
z)hFpfw+?=La`(uRZFg<#OWoeuer5Wx`CUr6o!tS+eYI!u{U$IJd>2*tW5xU7L;Mw=
zf*<!^G_-$C@n^p?wQp`oJiE=E+l>6*%MKhaW51Kz*gWHB{Az}smx={$=7^>UNHiI%
z-1{mv@4TLUPIySN3d;oHd0)1jp5uGy!*Sl0<?|z7e3P`;bLH*Te`k`m-#?Z<efQtA
ze}|j4-@oxc?4<Gj+jY~=mub&rI}}h*nj5$KT*&M0NcOAxyzaSn4M`%#4)TpHiEsaC
z%(hLxr1JUEuj#@pm)X43o_!8IEpgJD?PlTqB{j!<BBFnNYo5C`Z{Iwzw(?%hi!%SC
zuJL@mePu>@KuqLQDXv9-v&53cqRYSSon8GlqnNLk?HT_xv9kQjvhg$POpT82Dt{ba
z{4H8CuAe=_R&v39*IZTC4K2&|p3|H0rhQdH$oB<X^EG#`lsh=l|NFJ%4BKmy=U&}>
z)FA8GhRtQ~el6`|^W~NKw_|_k|N57jXEvUmcP+Yo*Sm>d79__mz4HAZ+9I62mdTq6
zSs56<3J~6Lm06sVnU|efq*qY6H~ekhZ8MR->zD5+sK22pviNn~*#m5AJh!oC?@lt@
zChDkoK`6Cwsz>9JM=K7?Wvt(*ep^xVX3&%rPpdN=0>Mh>_u72F!*9R1yL|b6+5KXg
z)7#|dr^iH1<X#v4CHL&5Ci(p_`#R=b>|7PCyRCKUbp3rlx~{P<H@~CdDY^gA(pB1X
zlut*R-unGL{>Hyg-d5A6O|Mv&y>zCims{YvP*=}M=G!jXczT3Xq<4C*TysBZQHI&<
zy@J=Bq)ts;781HuW2adPciKzK%YQ7VI@KLnoGS7+>Vayg&$i~d+?SWI8am%LVJ&mZ
zJo)5XN5M3y!^XF^g#4_IaGhyjx;ayjHGrLY$C)3^r^G6@XdHFF^XJj@$qkI@$w^Z_
z-#vKc<?P@+KDmcaZR)+Vj+gIn=DkX3nU^&xik_Zt1Sh>L<4kK^=#|Q=7o1(HYSgzi
zS+VK;u@4Syx>FubF<LXdZ@I=RjxD*mPp<vk_|79vZ~DKkr8mCl%s;8UaB7L8^=`k)
zw?F!v9oVxIC(WHO^OmBB((<oGfB)T$Ec$f#=E?r&`TOHtTm17I<puH$jc)DgKld=Y
z{>hSRgIoJEU1ol@j@x;3)=ORaX07+1<zA@o-?PE%bI0^H_VoFzWgm|p*xo9k5GPyh
zw0c`!=5veZ)0FMvk~<_L)-|ySc3jz8sAj$6-u)RpMePqo6<;kWl7H8w>@&A+#@47D
zsnfCndMaC<pD|NYvw8dBj__RtX6<(mwAeN>u8_K^w)N-S<<rD=J6Rk(7`L8hWy#Y}
z@drkwS2(k@*L~Qv^5vK3-!I6xFntuU`OC5P$QI!X%R{O!D+vDjs_>Wh<?C}fBCN8P
zw9{OE-Qxar=gaMyU3$N+Uex-eaN+sxxKjyoi(Hiojt8BekUsnC&yB&p9Tg|%R!w7k
z8Z(JI{B>x*@Q$!rhq<1n$`{NZhvwdvv@o|`H@#%u<5a6FSLLp=E_<8A>cZhv^zKlr
z*M#RW*1ErMSjSvpXMHX8Y|nPb+FqZz7a}xsxEW$};=hIS#VOxNnIRHZ^T?`D+-E`D
z=7Q+tT}i2j!#&nsKXk)8`D?qf)xWeIe5Xp~IW}LMq-QVFuyFg5Em=&zZQA;0Z9cOm
zAYP~GyHc4e>#~N<r!vbUgKt&tX`f%`u(9OD%Gb=EYFmm;QpB|P7CTgRKl-XMKUi(D
z!1I=+>#nKXx^gd{e{<lfIdkko79G9Vdz)RQj@MJNx?$&eY5Aq^Sh51{-eX)P6>VO2
zBD+E<QnaI{X3ehZ>DJd~F@Fdy47ezKWpzx9d_qB8QH`CvJpa+6MN+R%zsib8PIgL+
z=k>PqirwsZZ)enp`7ahGsI63RHT-zIR`#je^RqP%&h6Q}HE+U|>3%jFr(d}8temG-
zf$#sa95u=NCbwl=lTLM1|JqU^JzI6z0geejBYO3JSY{+TNO&5X9JspStF4akyV5Vy
z&UloyHsyX<wfj*?f2>+SX1=t&*iRc1;a`WVRX5pR++X9rc|y$F+rJL}`O}vCqAF{;
z$)?w9`IrCtEb}QXGymJN@U0L2Pgmb+bST%(ZSE7(G}h~T1D;$uw(0DY_38$tyETHZ
zi{AVu_<hbJkFWQCG|$v?om_2k`*CNv;pfdk<}DU&PyaX+u=i#9rm325mTqC<$W5Fv
z@p6=C@QQ2uW-OQ>rg#0@-6!wDa%R;OoD$4?@NU1%sTpqPeRiF-b9A1_qrvZS`S=Fm
zb??0oPLQ<UtuAH1x{K3v@iHN^Uy_G^KWDpp_|rSZr{Ct4=9+rX2{g_MY~Fn@BeZd5
z;Oa<y{T+MnY?*Px-Y0eYjw51+-#&Vgrf8Jc(b6}6UeLNJ;g5uOZ}set-z9(FU*46?
z_q^--d&|sUeHJcpf68coW}au<rs_!#1Lev)?!7$U{+AuKo0pNpcvG5_fgx3i@Ur~e
z)RLn7^3<a2V!eXOyOFQ+Z=VqSzixlh#F_~$9#%7}T#RNpbGu)c>U^wVcq@jtdBKUL
zTMT!47fj!F#rfa&b9(W=6J&n!xpu#5Ry_CTneCj|{<uZw<?q)??pIe_CeyF4?8Dm0
zdG7qh_)Q9T9&a?C`7Le{_cYn!O}Dw9_@3Wm_$PAlY+JYR8OB{oe;S0REmi1Y;ky*4
ze=f4C#$L~5V)A`=m9r6g0S=nNjS4-V;@%(a7N1`*EtxM#mG>i0dxD)ylj6cF-E(Xo
z{h9awi+7(Pe>2Ns-(5!oTa-&aUOu`yTq7mZO=!+y3lGntISses)^9pq@z+<z*r{CO
z!HZ>|@{DFKx%9gwC;PkEm&PYOr!36c1=26AWIMCz(s8cpwQ~0#Dob=<Jp1I?^?vF9
zkMd`Cmrs}fS9Q<%!%9`dS`NwHlk2AKZ8{^=rJs3*Cqb4gfB#h_anZz(`rS7kfB4ts
zx}#mV&%0TFp&E;e1=odX93pA~5(1r(eV3BUT>2#(53w#2Tw*R@bX;cf6d4W{F~>Sp
z_p0EP*=vi`TFWJ}W~g)=U1g&wRxQ?OI)SU@#K~;}5n5e}yF6y<{@`HTdP!Zgl2LbB
z(n>wvcN;^dNNp3mU3YY$L-TQ4&hMw<X0Xg@PCNBUWM2Q&T^+pYsVA&IF}zW7&bR-|
zwU*)PF^wsbO^f<3C<|6k$n|mdYu@l>WuL&_m1n+Hy-b#1t9<3`=MvYl>5Sd+L;Rm)
z?c2Tft1jHZdW~b>e)X8z{kxf2_iOh4m0f0`p7>wp?ziKS=MMc_p?a^^>%!qXPYxHK
z7BchSa;EicjD*jdg2K~rQD;&QH&w)UYpAL%Somtg=9LA3lU6kE(VLLo_$+q8PS!*5
zu{;+{PVBn;aqHV3yG}3P`t<Ux&$}GvalR_5$+g_~uAnB@@}2H(hpwy{(U16wy>l9-
z#V%ONX*IhlSUfbycgA(j&p8p(|BLQqbG!YeAg#%35}!wm!zG4&HPe#syM%0!nk37V
zztKQZ)VE#de9VbYXId&`1<tpeu~OLlFZO-3rFFry*8evj8qSYu^l&;o=jNHn!!bT<
zbv&I;$J{<sdV0&}-4`b9-Xa^7#izS`-q|lE&(5TsD^V-k5s`d8_gzf7)uzv3V$XU`
zPHk!1xnXAaw4IxhV>36dvzh(!<(ZjhbCP3knuYH=yYy^~-`9XU5hdG%&&Gtmy*V>r
z%CxsLzM0&vNW2|3W!B!q-@l)Em+HyXP!-KI@8875Vkv9I0z`5>Zl-5?USe#&;>vLL
z!o^lWwTy=fVr;*UJ-si{aCmAr!>omixr>vV&17fvvRc->VPXtz)|K_Bj<+Z%R}0^=
zd)cP?41s^=&+a(-srx9)q5rQL=G1STnY+f{@A!4@=%R~W|H9ptzrEm9{$l0MU7NV~
zUE<nTm1`WIeP-&}n5}1y&a^cWU7A?UcYC&7@{Qe7FMEIg63M{dw`HF0`)=9kOXk!}
zy0K34R44n{Q^i8>UP^us>-*wmy)5mVq3P^dZ!Q!wE=+eylbtY=b7r~2t#ToKS^H_h
zd&BwJcSklBJxbJ;mwTh(6~+5geVJOk(5;u-OOD+SnqR+u?E{ggQx@-IvZ>v?Ht+nt
zJDZn0iO*6l`II?Pl`(MP)oZI<VzbL9c1<#!l65a;d-AeV_ey7PT=nGo=Rob_+EV%N
z|J1c?KYFgD{B*=8+4_3UC+C)Z{HCVAA!w(z>9;HUoNw1%jqY;%n;M~4<H4f!`%+`w
z`dgiMR!sHVZO_Hr)f6C7l-tBnoAC4$t7^-=(?`#33&>ue%=LZJ(Tt_bpY+e}jhVw@
zZRa>&Qfbloi(<u!+e`Y~L?+6#FS>OxrtZh@ue;Bt|Nr~6y?nO+gEd`yzL*{|{PeKS
zq2)clh2JAZssBB822r`2LmCVh`6!&6EAXz}^6{Rhr~KsvI<{vQn|J))Kk<e1BUiQX
z44I^65e?DDM)s?YtNl$}e{ls*E_2`Cs=MLS*Zec7-p?q#s&?8L#w&TR(;vod`*Lmh
zD#>5v_jUI6JJuDsU!T8g;!>T3)_S@dEY?+TY@C~U_P)SgzDTP@IzGx8Vr5g#Sbe-;
z$rtoav_FY|h2O*-6O8WPvU0cRUMOGdF(dxn&5)z+MK9GPpK}}v|GIzX6iGgzsS~%|
z(7&j5LYPUGZQIUOzB}7YZrLWK9-d;lUhI^6f$wGE1sfhTE$v{_3^V1)Vt3D)u6bYb
zs!o;-E7RhC^Eu9PJ@h_ve)5X@8K*aD6ghnM6zllglFljkLxC+c=J4&8vQ@3WCfof9
z_1(~HT`-q7?uel!Ph0Lh6>|@{X65kSOZ&v4CeOKj?CApzXQ#xTS+ibk`H>}hD@$hK
z6xRvG)l>f@d*5ZNnYre<<(nV3_%57st+*@tR_3JRFXy?}ME0#cDr+p+_I+}jyL{K`
z+sUm0A39oJxqi(lPiy}=-6Pe%Y{9Re%@@|i$(K#%neeGqGJbFA=EM?@$)N`CT<-P%
zT4qq<6yy@Y?`M`SDz4Hdzw^M$exc~IajIE+{!UUlKezL<ltaYyO_x;<b#)khPqE(_
z?XXF*rY}lQspCf_m!|g8T~}38UZ1}Fru+p<V03!<jSC4@vHyZ5|5<STi(mPad%Irc
z*mEhm&$#)?VPfzHlhd1oYGcoAnlLeanxe8F>n54grxl<5DfgLrR`?c6@a5l?T=rI6
zhxf)8e7?&h6jQb8dUk&^$8+`P!ZI!5GLvq}@CD61^LD`%lQ#tp8@(T=ecW}-xz^-l
zbg$5q`nGoqRYc3>J*1w$bewXC_k>99I-9Ax&u0{WK2>u2>cs-{bBQPHRxj#*bzey{
zeEPTZueQbhn|3qKhue$KYjchaSN>IIxfafLZl}`5>@^2GmKs`LufJM*N-$34(1i9t
zuIE|26Rry?^$VsRpRwCu!pWAyimE&QxE5cK-~X21x1;IgO&%Q$y`5jry{}vF_|tDI
zJ^!m8`%_HLrB2`bGDyrwi$izA!2_Kk&G$U4KZprv9g|_N+#!E>H_QJ-TlemlXMRtv
z)#x_lG^$jW5O_XC?`Q7$ldt_0H_T_X+~dsjZuY({FWIBdO`4?m?d`<q#s?Y?551a^
z>o{q}OsV_%;#YYuCWdTdS?0Rx-D2k8pBLUvzFqu&ozJ^ecRk;a(Hj(YZxE@v>cjIh
zd-ors6`b*s3!9I94ZJDk{PzBGt^8%b?(Ih#NPl<vd1D_70|OHe;ms)p>6v;3m2<;x
z=iM<AsJ$M}^M*b1;nY_<{6!xy9lYhyv*YC=(+h0e&JVn<bZvAIQhB;n>c@TS#joS$
z+*m7Dw)EkdnYSNKSpMPpr&sSkge{4QlDn4@V>OXGFR5aEWYmWbN><<f5*L;vA6ZsV
zQ26hi_zrE0kULtOlJ!rPUJ||4_;}5yJ$F`cO;TAOn_DrdVZ|0Bz8O<a8LCg&GOxU-
z=u=(p+{8@nh8W3$j-7uBm@QYk+-x|d7&=u<)!fXf_WbL{n8mGk7&aG}cT9P^C+k^P
z&>HsX-hbXa?p!386XEOq@xbJs^{;&oojG={y7Q7>$fNmYSIQC{Ix<=py=AP+x3~Yu
z=6w30-mc%9_V|g(uNR-6XII~0dmw$olTU#Xs<*YiUb{Xy!@tz)m&PMk{SOtHmCqlD
zL@NdyWNO~JV95sgw0mM(vPzhv`EC^)Pi<pO>sytxvHX!|f|BHR&9xKW%jJDAWM6%v
z;_$}ORL{2sxtC)X8hvRCJ7cMQZR=x}DcmPFU(4;C>XO;-E)=Z1Qp>MEwE6){$lIT6
zTmPL3W<R)1AoJocZ|^i+CGS+NKY3L<e9kV?d)ixZ<Z0C5tMc(X6vGM}_ATT0=(Ege
z)xJ<x(ktq+ZmWWGTfxoUUv1WZb$cT%*8DJ4ta|O#69M<HOFt~XKf`cRjK{-CDjW8k
zNf-FXHGk?GX=nb<#ipBOmv>lB|B##F`(VBBT(N&|Zc6J4Ouf3)d)t|kJI>ux<^QRv
zT-&(o&A&gtYxx%!^{DI-S{eQD+^omH*KT<G`>(B~T<?pI=l@ECeg9nh&{{;UwO~Q<
zN4B~1?=Nt+$&G2eTjg1KrFPz_-Vh(HsaI8x?^-_7VC}PznmdhK^(tq7yuzYVpR2-B
zcjM--;u&v~PA$0|%gM)g*vGi>T&JnV)HRO`6|&x^>b#yf`Rd=gEm2F{4fiF~-a5C}
zApV|ChWdT3Nc+Y~slvTl774fFgqf8R4I{2_rhSa_ZP)lCmesDN-?H3f`c%J9lX`DH
zn$T5#{L<@}Nxoa_XKa3WYsHl4*#TVnC+nMbAA9%X;ikW#Z{PDjnCn$^XVL%jhZ)~o
zyzoAIllt<TQTuv1?^}9>9j{<-^m%^qfaC3xNfFwi`!0TL*(CL*{Lh7hP07|5&nRq_
zooB##_H@hIwOYGb!+HL>t3H`i`f*+Htj~+i2;J#gAJXc_IMFuIOhH9x?YbR_eeAy<
zu$Q=<>kh4HJj|`0U-6i^(Wfc8K7Q`J+C8GXmR!6pIrpKd;-WK3R>3b+C0OF8PB=J&
z+imBrj`!)C58ryX`2F|ZsnOSN{6BQmIcd3T(rX)W|H-yea(<n4K~V)<N?RJwEnEAc
z=%e6qH+%aRE&sev_~ho6OSLJkELXpnXkaJna{S|!Y43w3x;U?Y9#Amt<8`U~thw2~
z%Gb6D1}*8{yt$b%Jf%e8a<A@-yJwV|&Ch(A$Zq^*(!$l3{r6s8yfMOP=gOOH+s}Ax
z{kGp+VkO(ZKON>@O1hs&y0fGSCV1?9eDk!J<)%-!mwer0T)15N7XPhxT+J_K&L`BT
zbNpU^)ht*4+JQ?`ve_5DbC`Je-0|!vPkG<>o$2}$KE$K;7vB`$HG9O$z+foIz@SE8
zTCgOsI6E^hU9X@Le5{fM&%b%`jydvk7HnMayPx$2qx0;$qOY$l<SvkIIuMX!c`?nq
zO=bPru7BT^pMJO4z0I1LF~_UMV`7cRQ`4G%B|neu7ZaS`_B-5gdYDSnYs)=nBey*M
zr(+?zw~c%1`>i+L>74O9pZ4!fNg3a1*>?Ur8k~mz4+c+7U%@kNbIz2Esg4qAt-2=s
z&H|C^wy>%#-E@Xa^=!tMS65d@&&$pWSUsijWM#`W<qcdqi}df;)zyFfsQ=(*+i}DG
zhmZQZCkuCkOzWPK?Gd4NskXsmabT*`%wK2U6)SE(z@y{7)Y(xW<w?Gl*;aS%pUxSo
zCqEypJyQH>@y#`#F0IXa-}}4f{Pzr<#?%deeq{>A{n@)iLH@b&f#uiM*qXeJ?kx)B
zbh9ztbET?xp~#Md49&e81eQwp+qSx7p7{1t?wv)#0-foGZLN`Ay$>gJRyW=|ddFpp
z(>CoLw~mSQC_U9Zeq*`jiX*M2kIR-PZE1@-6Qyg``jlk~N2jCO=GK`^UfMR3UNC7Z
zKW3S}@%@~JP4jXCX6M^%GT3*!GvoOiS50HKiAyg@*1gx>5#ihP=|uEL=IPwb)3?VP
z&Yxk#7g2Jt{LCGZcP)1p<|RuhpICHh`LC7_%Z#k0BGWu{?}#Y%a%!ejWj~v-f?sEO
zP=sW+U?ki1LlIT+>jQruJXl$Is^!bG4N?Byj%Un|mMJXgI&s8bt~}ht-_m%G_9+9y
z9c#6_xROJksVqKz?Kam%!3Xu0HD2=b>Wg1pos_F;>D;;6aGj;7q}vtQWlN>6Mq9Pc
zHjcU`lP$*SSabVL?7=IpF^}ez7I>drGwF=f$x2nre3fOBB-WSLJwN&2f%MW#@pJyj
zD&I4C9`~xr`oY^u&No?n(^P9>)gJ#!4Kh0Sd5_SV34*TkmL7WNotMb+;?Iq%8#n_6
zulugZF}o17+p$Rhdbs?3{k+5e+q=ud<1a*?|F6Dw+JuN3Jgp*TJjdIXpJe%C|8Vgn
z(f=<G_BHJl%rF&D>)B$oEOx28apMyEYa5Preph(pZs6*tdyHY5MadL}KbK;|;~LE+
zO*_tAU^{KLW_OJ2gI}4q?nd~=um>optf{JwVKGb0nrd#lEn&rG_njSm`llzQ?p<2?
z`Rk3UZow4Sti#sJyr(VLzS>mG^kdCE-6{VVcmJ06>RQu2ucT(tEjfwb{=GL1c`YhW
zUHJKa<;8>>w`He&)Bh@Oow!qEqHNj3V+>}kvro^q++eY6zQ)RcsTQ}F$O!3_ItL#q
zJnZY=A>mu&y*KVg-JU|tH5@{-lsu2vnlmc(+oo;W^{0c+Vxp4{_w!Qk&c4aHZy!I<
z-lEd=JH+F)oyY#$)*7>7rWWvZd{z1K@#MxVJAR*Sx~q-aYf3j+2HdaOwo@!UR9Pls
zm9u9}UE~V3!mdg`-B`EZ1*cQ5SBFM)&%d)PVQ2oSU!R?}dl~3<yq$b%cDvX2j~!o^
ztnK_J(qY+f#B+9aZRyGllaDy<+Y-0rllNZd`gc37dF>bI&1kDMwlm&$*}Q$j()ks8
zd4d)9@4s`i>w=w9#xhoUi32~Lwc4JL^HMoIZ??ht<8gNbtv56r^y=PmeA%3vv7yot
z%hU38&d<{-l}TU1mR}%H_17}&)Ish&%KKs~Zye4z{_r6Gde5&PcNdlSR!Tl)-?3Wp
zk-^F1dn^6kysRp_!20pm4ee=~R~D(Q4&L=7$yf6B?9!<RQztI3xjOOt?%LOE_u@|-
zQc*E?oUMAOoJUq~=f(X$-45^nxM+I78B;x$8*w~$Zyb+nXxrmifB8UNL%3~-<l<LL
zwr~C$f2FpHPwuMiuEo-)&b?jk<>8<DDx$;g*OEpV&6$^66(qk2>0G=QST`}?x#Q)-
zzf+ywNM2#Tn;NYXbmV_(;yII9+bSOOXzo$GEirW(ciHu#Ew@b8Ov;jJ+jzmhpxH?G
zQS}l_)!C<&9?y!jd)MsGc2j)y&z!d_{Qjs;2rGEYTYU3)^g_>F_ojQP|KPV<Fq!qs
z@`-WBwmz6GRCH$!>)x2N&t9K2SY7+Wv8ZURQr?+-o~x`y-_dFb_xslmEo5b2a2H@;
zP$X1KfSSBZ!|&(cHWR439$%Otm$G=;gdMLB^Q1&PNSVEHi?$VWbfN^4?%bSpLMtbR
z2(5qdf1k2z<ixioe6QG@tv>Dh{q<v?RkOW)%zxRtpF~=ZWlURWVDo&1T0!W>lIDvR
zcKqiOv{tWu^t!k4<IkfOi}uSW?sKeYkK#J<fsZ?K>JlEdNJ*BRlT=ka<7P)CPGZp4
zUddyixFoU7dtvi~tE<E1HwLZnTsyIGoq_6SO$pAn2hV>TFgep=wrbl8si4TPJr1mv
z+Lar7IaN4pc3pWp`DR$mn#Pjn_oiF)dB4s+7{1on{868_rp~*w&RtVW8#ffqIR4pR
zK5x>?eDllq)8E(6WpUUq#(FeX%k|uK-80r+!r~UfJMY}TaY%mSjoY`_mhN62mimg7
zQA|qO|D49>Ic6CN8y>M;YPz)EZGt!J(`~m7*)lD?y5NLH=b0NmSuK<73%m;3thQ=j
z+t!|)+vDK9dXL+xkidpBv4UPE(laNTUP?Nqv2PV`)PgyO&ds?Q)!(p0?z~rsuZz~j
zLsQ=vM=jWtF8$<{ybmwWJ9C@67S)*tx2UBkhI+n_=AV8t@lMO0XXRUB!VCU>6b@`y
z)#D)JYahJPz2N-WwvzH?n$0@7HCf6n-uY%6JpL+E_dNM;`A*em?bjBs`m@2C754SM
z_&F{6`<|FdkHp(W!dM?G%{h={nZ@$_n`+NL3;yVnx4cv4y-yL3E894^XK%`$$$LId
zGPmyhHc9?a>W8a8=R8~$_kC`xXQa);xB6!`r9FQgbM*zob>6rKMtq+mXU}*1Z7_$$
zuQ|O%R7%cleMqs@)tG|GD$KpEb}cW|EA(5JFAF}ol7sC{)|t{tS}RMpXVrHVK6<?I
zu{p<c;}_=`WUuSK*j1!{kkR$*BJD^SzGm5V#?y@^R=jn&UU^PF;JD6dHpR=S7CA3U
zTxGPw=f$e82<nTvx>CgLBval^+nA-AlO~@LxXFI`_G(30CM({U10^+eb@wXWER#zU
zCsi-An)Wu!^<}Ki?{#0y?3|B(yT0MV^h)(DORNp{Z%?nu;ooD&QeFJY?RM|BwyH<J
zJbTy6&Rua+Mb!Upl>18egJpLtoB21t?BkEIp0_Yzb(7HkTidq9{I5K-_@XjPlKR!o
z9i`{rY?$<ocZcLnwyms<EiO)4d$Mb}{;%DsBw6{KUBE7c)qiKDi^8j|TZOju{ataX
zcX^PwIIGFc>)e^i6)U{@N<AeTMN{WI+oXJ$Ewb(G>B~Q@9!<ZgamnXX)7yqjKVOBK
z5~;)Dic#gko~r5DHcLDF9XMuYOfD=G65QA6C~T*><HsLa2lnQJ%U7vy58iIEmg#uf
z*+&97=eyTkt^Rz)cWw^Twx{!xwl+s>ImNy-yJ}wU*89_cJ@%}YTPZuGT6KkQ=<K*p
zb6qwF`7f!JbDP+HQuD}Zec40TYm2|Hm=dC2Y<*~wd2esjT)!E9G9CAhs|AUdUb8=Q
zCg+dmvRyCMnnl=!hrWsl<JHSlX#d-I>x5#@VdcDYdd{zQmUVxBoo@bhc66-y)$D`v
zbGkbxb}rDm_fSFiMO?YTrW5JAUi-<#*X*CF=d1fuTKT+LcHZ%2n=f;BD?Qt2<|CQ=
zzO30`7hn5d-Mrbnwq3J+ui&1he{Awo<A8e6#U3};#K;|9qP_3oqGR`%#Kew?Ds*Wb
zZS6EMnwqDSb;hbj(Chxp+mmZEK1ps~wW#|`1OIpKduz&BwmhG`?zQJpk&pK-Jn>$0
zwq@-Woms4#UuL{C4`jZYw*JNHS>iYISZrep!!Nu^yb>bHde(QB>ca*6b~ZX+lZrl;
zz1)0z-ppkV?K@vK>z<gmbZUErZ+z3nt37Y0x712(X{uKdZ;n-Y^7zrCw<(q~a)oJc
zYG>{}^5;kEwd3c0)CvCn@H_Zmn4Ie_-)kD*q*MyKzWq4o^nTm>xi@rWm%c2HS;p)5
zCxPST?oStk((i5!?#{1%`5(0xkkrGF)hofk@H>EkL7PDNUY1#0nwV2uQks&PuUAlc
z)aG{CZHr0o|8bT4amZ8--1K-!^4!ArDt(i`WyTjJl~2l(m*;hL5)<lrBCsSi*Uv7a
zK6!u6YAy!Odnvn@r(5xFZ1G+gpm9a^R+{+x`!#a&IOe-g;_qjcOHI<Nuu5DnbUyyW
z!*$m8Zl$#sZt^>NRw;S+<GHnEJ0IknOqJQ#aQ~Bm-!y~%)H~5($Nt^_f9S*A^fwl#
zDmdO|3N4RQdz6u#J@1&e+1zuVb^L#poH`=(%jlVF;GByBJGXv)a&mIG@yw<3{CRb{
zXSNhBoUwkUyuPsDCy^-exVFpAejXKq)_Z?ccrY_u(0LNgG|m6{yz{XvJGZ7@oAvWq
zvd-D%IdeN+v{g=u%~FZIuDiiI-$`+^oApE`k<DrD68BfQNg17XmDs`h>Z!W%zW`Gi
zy&eC*n($RH8u*EDe%Vp{>lb&tc|*I>udW4O?=uy=a5Zm#IJ@+TZfm{MT!#+J-6i_<
z)%7N}e}2CBF#Yl7^2xev|Ie(l*(I7OBN%JCVDYAvMkWt9`x~lj4tBfVpRsML=@tH?
z;c*K}nc}}J3s%|nbI(!dlcGkq59Bf>cs<)V^TZ5!rqfHA&H974#i(a*d!*x8$>yyY
zcS0<Nsk+OWk%fE5myPV=*B_jbVpdC@Q*-!X%Hat|i|241IU`ocu==2m{^=mY)5d)b
z&y*f9>drpR*c`^oAAL#Y-PuXXJC?HlW_CDz>Xy#D+J|+=s#dpt5Z^LSzAA|6iH6_w
z54CF#vKHPCjov4?{lZ-JH)q@LH`pAQHRtCEsRIj{w+Y>3dM4)0?D=q!z=Wnn>{U0{
zu8sbgQ_jV5^3t5V%ORg~xc=y<A7ILFnIG$Toxx7~+NVRSy}z?m$j)BBem&zQbEdaC
z)637b#9Aure-)qH-L3q*$|3zoFyD^Lbw+BIZ{**-?m4{jtn>S}+LNhnORQ}Fu2DGn
zOnO4syt`S~*WLYo=2i9AkDHwyJZ9zIIlaI)Z_Z(+iHDvYHcet;zRPszo*%Qz&F!}@
zKEHdf^!pXHsXyFo`WC#`>HCrJ`u8=liCued1n<e=<Jxih^x>YAIZR9ju@+m!tN*tJ
zuYS8@_wsI$we1PJ%)b7eIwk&8bbVJ-iRQod5Fc$-?@v>&csuzktk7nzT64{Yzw2mT
zh`GTd$&8gPzZbaH9{pLcq$+fWLd~@McP{*u{i`Pt(|+;&@q(#=GE459{=%WQ$kL1T
z(o~lC$!}|xM+CnAz30w{&5KeG%(=Kb)bn;y(al5-r`MsHhTV@hG>hchPC3o0sCRje
z@QeGc#k~sKJyvY&cX}3AG4W|*N3P&~?Nt4a$bL5Y2D!5My>>ROZU0ibA1r!y{Pac^
z?!_1Gsn~iH+{y}GS$pZG*Ju9JZEQ>X6LgOH-;dv@5r6K%uErJmjSUl?pH?|s9Cb+Z
zCyVRp>(TnL$~jjo7q(QgxIf!>UR8tf#|DM1t*=TeDxAC?OZ@v5Fgas$ddZJ3nVORd
zh3C779MQfR&eWN*cTx04`Objp9I?TSJe&u3q$WprZOMvp*4Sz~llAh{>00yJ9yb~P
z{K9kY$QMTTsMr%GT~6i;YJZ62h`+h`t@roqn;)OwU)KJ7`TKtVK0BZO^LqVubM{)z
zoF}t?UxGg)!+vHqb}`d{3Fj1QInEt<CKK~6D)Ghgw~JP{p1$(6wL1H*rRp)JqbHZ=
z&&evjC>LUFbhj=t+w8G^_s9F&xBQbm>AJ_N?~eh$#Y|bj=Z#^1Qj#|wy2f~v>6qrK
zWCccR;fvz_%sU?x=!->8J8?2YB=LB_&Gf=5<ESdZJACC6br0w6sPDWoInHxtv(o>s
zpWc2@y`fgg<#Q}8d$G)kXAEbh&fT>UDt9@PDdw*%AiRCg^>oenV;P1V$uk>jzxPjM
zGWjAN$93zm{0`+G+;`-5SKTOdyB5mvEMUSh&Q}35R=zU`o-T3rU%JM+9n;$$$USI@
z`NXiUq2obTlV0@EN{Nh)45o%x(<__O<PLRD$$eHGRJ=}n-JY#mDvY`sk0(zG_{JIF
zJnw9~zUgMsn12CoQrCBSoWA70TXfllPa^rfS68LJTE5pyJ8Hq}97gu_yB&3|O1%8>
z=J8K`ckzPsb9I)#7$hdX2&pYt@ZficN6O_)e*TgJMmGe{s}+P_{<kEegRh#+WVRGL
zLs^)_|Ghi>V<eR;*U!0W@=@Gl-AxmvmFw*8d+n$^_qE(&+V<n~{rhK#v*?_8#OR%u
zBov{s`hwPaz10RytXJE!mQM&aNaTw+zq5Md^9vs@t+4yVVY08raP2nn%NGx@K4Y`{
zZoA{rq3=#>`%W^1ck3Pe%96c%2FsfpEs>K}I(VOFKEkm+iGg46&}ni0`Mk;5n{Brk
z$Tc=h*PE^3@Hm;_#^ql7D~5Z@yf)1E=oOm~*7=NY=MhcyKI7g4O7^mE-t6A3fA{X+
zzjHTUp0ANy^}KcW`##2SU5>vKA`j1+aU<pxQ}<UdGgh@Jat78C4u1QeuzaZt(!DTc
zx7Q^x7xq~>p>@H3ua&*MD}Az-uiDG?z|Dmhx4q-Nb$aO%&Aj-vb3HDlAD*9MXtc57
z+owNgf3m2`S;y&pKEuq~^Z4HKLb2b4D@tT{I%KRZ*4KE}ls;?u#6#Dk1Z)1M+<l!N
zYS8rCdg{*_y?0(M44;<pojKTjZw}W!+v|^5?6ndvH9XXx(!qW|U{~jK-4`!1^!{Bh
zPZjD~^L&Tj|16_BJJ<P_>}9z+|Is3;Yu8>nX*W5$mC1hh)>$-<?ZWzecmCYGj*3&a
zt}=0SFI;)8_N4`5R`$x+^M~d%y={^c6`V6cAv*B)Jyo@N4V!JdH$N^q6*%iyrm$v0
z)1-8^jz1!Qe4JKwCTd$h+{VLgzI~O$7QszM3rp9iX=E(few;5Ni$nD5^ZcEE-{v;m
zKlAeP#TT(WXR`jjzI7~k-V#Hpy}=VSU$@815}LmFyPvs*LBg|wP<dWK^Ggk@dw<zC
zERJUvJ?b0(@!*96hAw~39lgMo-I5UXAoJtJwc?BPQyJgIakN->d73U&>N4fJa``~^
zyPjuk?alfAZ2nhnUViZJyA|Uj8}CnN+yb|TxO$7%dD$IT=;3!@+Vj8Q%fG`vA6`6q
z^e6jr(d3j!$DBx=qTIvUvttG9gytFx1U_iD`0H1(hkKr>+PeOg7Z#NCnQ|U@w{RP$
zv-;1tuoaaz!qckeURm2?mN2!f$nm}6o^8u+E6axa7KjSjUy1v1`<!=qjQZ}4j~}l8
zbUFA_=L*S$$JgcgN<J*~Q@wPC)p5!y_niqbC9_qIeW*X6tLZQ4Xm!2d!qurBLY)5%
z!+%R%IrICmvq^|pf>pcM#tDqFi#5^`j%B^S7pKmoUBk6qvE7<q_tHJVI(N>B|8oyn
z>#Imf$o+`1H7*P&mg0!NlrA5VF+(Ksyyeobp$gF&`Ao}=KWsZttX!|_EqgoYe~Y4k
zC~swPk&<Lr=&|=2CHmJ-N6NhV!d<|*t^JUAq#?^5XKpcz=_lB8A`=!)cdrjQdiuiL
zn8Hn)LKN)R>0T?^lHYgF?*o@~QcU>CzN)i}wl1B=e(UhH_$~J~^FK6V4_@#xW?D;M
zdi<6&vt3hs)a#~y6?yaTs>IH7g^5do-Q&*7J<zNBT*%M0JIFbE&I-qqnx;o@CG#x1
zVKg&o&c!zq-M0%{`+lClz3702?}3Wqf37dCAG1+^U)-R{z2TzmHmzb)R`y*-f8A7K
z%`%x@wr1;GcKv_lo4$vnEst2F+wrLV(?lb;XNlK@J{d6wh;b=%t}ZW`%{$%Oa!w~t
zggwuaQsJ5>e}e`0{x+#8uZWmGRpZfvid_>I9BA$Gzsi2Nck$8vmRFZvurf@T^FDOT
zhxzi!9#@SNc?`r;{AXo;wYIUW`}^<e)AN&e87;V&@w2~6@W9?jS@lJ+lJ0hevd^3w
z-(G8I{5!vDB9CFmzjtrKMcL907swr75S+Gh`nr?4PL~!PxTfiGw^TnaQ9AC|FY}2P
zzbvX-V83B%c5Bq^hAV73m8<pGPK6pw$#)IVnswOdrpHPbMe79<m6l$JmUPaMy;XIq
zi|^|K=Z)q!Omq2`O6Q#1Ilazl-9f{+ZGnZ+s_cR9`ujTj&t@$9|3ZVsS@HC&-*02y
zF37cP-fwJ`mwx*9_Bfx~pA3Cs4<af*_bh)~J>A32U#vPTG45%Kw^iY-QrmSK65pro
zZGT&r{=7fGKK;&)mZc?K9n6~SYTS{nj>#sI{2Cs<i}G-P=cG7GPGjb_hfNFh1D?&_
zYtR!OH7kfIT`Zm3>&I#Z%V5RS)bus4F6?1=KYMz*;j#xcKIc|*m@Q{8t8M6Q*t%TV
zPog+oYmNN6yU(^&T~%In^ojbki>d#euLjO-ubeL9yS?2<HK@<Svcbp1xGmRb;?mdO
zE{FX(8|w0UrbA7!Z{73HD#`K}r>YchmW^SG+VO0yV2x~$P_IYZtNRO%OueUf#p2bM
z`hKD9GP7RYn^K-UKlpr5=!y())0<Aev{(cFYud9e4cdRwb4SQShGzCR54lttf7fz7
zQ~oYp9O99$R&DT<@pW6(-CwhEixyaIH(L4hPS5JCk4{MRb1$j+6~phH5gNdG@L=3l
zNq)X<lNNoqeBt0Fw7SAQE6HtZ@{LPH@fVir9X)+$_t8UQ0&YjXeY~Tgm3k=oVQ0zg
z+me%Rxcs=b?851@#&)dX(k6@@xt2!{&pmYU=)zYg#GZzIU7)F!rLAKfaPy>+#Ld0s
zn>?F$H*VssoT6XJCA27<^<MslojYc|iPL7}m3CBcW!7j>n;r5n_TZ%JDLN0A82#&b
z>i=V5IH!kLwWP-DRria;87}RM+qWaB|3K3Ji4kvv#d;r<vhMj<y6R+b@{Q_+-Y3I0
zu`E5+#3=t<>oLF95rY|RliUyZym-rAvh{jlpQkaqw(enp<BQvSrgJGrtO#{9nf2$D
z+0yyyiv`bo-@j<ltY)txlMY|BFV;KxU;eGl{n~y1AHS>E(h=^=U@PLR6EEG=B(2vv
z|CrIdbm#gECBwr!-63t2Urf8gFHQ*gePOb*lM`QKx0uC>2X9;57xHaAxQ@ebcDi{(
zwxGoQ8c+GxTPKR@$4*`I;J?`X<Yf{i|3z$z_FSlbZ0mFX?95K@YmU2StWlkLe9qsG
z728D^LU^1CH>`Zr8QOJ8|E=PzEsQ_j>v`Kw@@D@r|IqIQ&lO1z-5%Siu6v}|(s*%W
z;p`=<YK!j}-l@BOeAb;+f-Bk=M7#<u<0-dh+{&Ue<xy(xTjqT)qYI*&Uy5v;bN$d&
zP5$K{-*`*f1~OfLvU7K<ztEXIBHF^HE$2!m%l#1PW`3|))J!Lv?H(InrGnMLCCk3N
z=QPmLy|iYfvEsd~>AK$0tKZB@%=hZse*Ed~S3eEbUS3_wqrrbGVC~$gb7m)q%%0z5
z`uh0`mFAry?H1wgWxjGwwX+if{cCUYimqbcyno}|bnD00bgk`oJ&qE)Gi$5)yE$7Q
zH}Jf^x;o(4`CoGn%qwR+Tv4jM;rZPIaV3nm-!pyNBz>bl_CVP&*$ZXI?p}y1bGrSq
zY1?hy-2KA0^2E3Brf;}^l+C(2_JWzrp?`ViTgv|3_*uxjCH?M&vfB&a<~MA+&igh}
zd&^zl<sbG)--_clvG)(wIqe@*r~RW#^yN&|y?ZXOMiet%-xeb>UwKCq|CeXy6kTHr
zHF~&bOk+=xlRC5S=Fa)@m)`q1%LJ}<bKSP><kYj1T3$U3s6UazV)ixWPEXHK!(B^r
zf3KUbvg(_i<7#%>sDd5BHERMJGAlNwiL+~*sp`8X^le(sTVuA}SB#9`7iPYFd;Qjw
zxfgUZzTU61z3w5n>(D_*`A2g0oZ4M|=lT5WYKxz&coWdVwzh8D#d+en8pn$cg)+X0
zy6h@_c#^tl%ElR+RXcmnZjW2BmTA+J4_6P_{_B{R8gB7o*}Q+*2eS+m&Ke$F8eY}(
zG=3qk)p_OmD4S<1uAj*9(9PMPxBaTMvdPVhD(ce<qV$aB2Kmm_;#K?n_pV~!G6j*N
z)}sH!_E<*wrDQF#Tz_IU*X+=>iM7wwcKtcac_^TDv!N72e8{acKkYWG=KHVrF?DJ@
z_kuebuN!?zKFnQwX7}q-ak+)kIiYed_uLUNw-3G7)$f=$!E0H^%E>!C&J{5p*X(84
zbbR7Y%?D{*%SC<q_=_WUif}d0HkilwTSltn&Lz*qlNK0xxqmFS5_4^3lzR3>qjg@-
z%k8EXYZ?-Cml`ZEn&nU#z2{RCv-V{r9p2Q{7Js!)zfl*vcC5s4p}CXg(`|V&!4h90
zSX&g1`Ojd_nacJ;o`vVGw^q#e4;L?V8GkvrW~Ex3z`D{3rL0GB+?6w>&F|LqJ-PYq
zfyD1^PcAB~nY1^oG1<LIWYPK$s^Kp#@=iFgj9G<4q3P>XktAam-Wxn$rca%{^2GJ(
zg0K$^4NiLwz3;3D*?Vzo<+X;GAe+<|RgV+)Chpj<sq%!*@?%T&<}rJ0U-3XZVp912
z1pd`R=PnAr-F-A6xHwyI@6uV)sgpFH^CeA5+!Z&w;3{L0vQ!NBHFbfYIG2m;vcBRo
zyVr&|<?VVQD`T*5C3ix^#})JLL~gipC?bfHD>hJaroFR*#(FK&1N`d)7?o?^tY}!l
z8Ks<kb+tjXR#tZD%U1{8Zkf&0Yh0CO`1R#~#{ZGZY3FJVJ5_Nu#jSi5(ZI9op&;8|
zkG&hd=f|y%;^8XZWB;czVgKfZ>Kbxti^Eo)cysu2j<2K+^Wjwc&nKRToNU}W<4e}`
z<xHpdgg#?&i!$I)vr}^jam&~L(%dAfR;;mu?Uqi+tN2&t6ODSpg?5Dpx(4OHelGd(
zP1up0JlC6*oVny*%+*-Bfa%DrTMc|0BB##YBsnK6vN0>5Q^Df*wAYuF=QeH)sGYv|
zS#glt7ctAjJGZ5%%}aa{GFx5IThb*@Fmdq;nf|t&GA~QMXmrf$FQ3m`;;&ZzP1fVX
zQNaygl~?UHpOS6q@NtvTDzzV{Hk@qEUaftIQGW82>-_I8rfG(3^^}X5dp9uguRPC>
zEtbMs275mrS}1$%+5)?(s}Yu>T6_4D=Buo$5>}j8{AF`mf>#}T#)|DHcV)2o_I@%g
z;yl@<w)@MIkfmx%Ho6#0e8rf)|JM)6y^BQ*ME0#=ytv-^nnc+(J=HYl%7C+ld7oN!
zEU#9vZ9O)v>xX-2<8(jYty}JfcxCG?-97tL{WB)!k2995?e;%utSf!-L~#GMsW~o%
ziEdR<*CN*IZM$mtG-GaMM!slRPt<OcSuY=iWQxA?*9|hNylQYw`q1=g$9OLG|NOr~
zHAznUnlJzSTYo>CH@Ba~@A8So_D5W6_rB1$o|Z_P&`^d;FZm<(u3yWmty8&}IadA6
z5&`osVaadqI$vZg|8@U&=;hE)PjzC#%h{$czHsoBB1^b`f=uR7?|0Hw&%dnpdmTUB
z!ccRPyj76O+FdRG9z4GAP~D4Nc81Qxo9s^yW!G9sn1<9`)ZsPT6S}nBYkj~a*QfCs
zCqJ!sUuakV&nB?6)9Gi|t8||eKh;{rE=$k<pSR<vNZ+4gmFZ$)rcb|$KiRW(yP$@I
znk(yc&%|J_8*A2XO4HSR_wADR$>qDw&Hm;hD!s}vf0c)GPLE9P><?Z79Hq+?UuvyV
z{cLh%(;kVvwfz&M8}fY$8A4dr`6}A7XNt5PoZxlbI!=P;`GzwFJbYb^bN@u&-|#CY
z=klYw_G|yhb}yRZ;C`7~PwL+?&xtwHI@!1Tzo?k}>4(PePRrQaN8H=gZ<qbh46zSk
zaAVLg*UJm_U3AmtnFJ@36tAZH++(xPKd^d{X#Yu=k%Oz?-aN6zyEBSfPsF|T?GXJ~
zyj9>`umyv`kr`i{c`_O=vBw@SzT0tNR{7oBjlM5fBcuN<JKOdu`2d^S?r&F*UPxW<
zpR;s*;MA1|WSHX^x^gv~57oQcZj4;elo|c<O|q7u_KX!*R`2^8^8Wh_tAkoIZiSrX
zJu0EC8`QqMeOvzb^J~KIACq6JDYHd-L8zVb@il)+RlgRhEIG4N#`gZ*`p7fa_AhX#
z>A5*&W!aM|z8Z!(vTN6`TlYIO(|GZ%6VpCO?tP%KXHW2-4_5mv7p-B@+EVq)ZT;n*
z{@31DmI$yNdk`Vm{>qi(^z5|z4gaNHY^w3RnRw&fjT;gUULo>U?HeCvnXp7mJ-YT0
z5Bt@;!;V%vZH_<bPnUeD(9Go-K5gbB;n--K&<7^+mm`=mF8s=l%vCMXbq|?${?Eyi
zCyxiaCz&WZZQ(TR;?bU&Z6Gb6cYl@Ahu@R44hpOOC_Q*r#)Mzy;z4tjsdFb~-;?`$
zY}bO7mI@O#MAWjxv<p2|Q>(9KJtrWls@bgWKSz!0kKW?r`=>=;e;{^Nh5c9l{)3Zz
zzsn>Fr2kValiuQ`@O6FSW&c-V3J!~uI)6Lm&At&*eQN8{UCob0qoUaTr)9JDEX&|6
zy3hAQRH`E7MQIzKi{$LtA6wfE4S#i-KAQV*dW9PQxfLGPJa1|<1>P*LvYeFapOB&R
zRB^cr$JAM??Vhz-ND2!u-VKorST<*RhKt4lu8+^A9Q=4ifBuT?DG5m#n>~W|9bS{Q
z=rTja;j0=MAAIXGPDTp<|7(vrtI=<Kzw{vs14A`01A{VwS&fQhLo?XICNlxheQ_Cf
zC){)u3mcdWCnUB`&OLU?>;;cbYa)k<Yvgs0C2m0*_b&Wj>%R9!*qbfqmhrchJh3g`
zQ~j>buG#)wzFd>_6DKJ_pCm<HHH|ME_r!aaD@n9HzbDxfy7A%;A6=gF`fZGVV-A{#
zesGjfRTT4A3U>87mB4!1R{x?_yM~unbe5oNL*+uq!lp%&j(xtjr}A^8NR&j->eK|T
zgC}j+S0AvdcoOwdgu6l_eowPu!Bp`XoV=W;4R5!!Jgns1Vf1$PT@j7x2Y7s>!w(sp
znY&t2FDgFosc@F++{@du^|+ohCaN0nE{}hgzxZSR_Q&_t<?CfD9sIkMo(P8<9Zco^
z+_<PE$R}mdy!@Pp{Sj|+a`{us^4Ff)Ay}bgyy)AL9;W^+2N{}KqaH}Q#`7x#N`3O(
z*f^D;Yn7<cG6|#COqncCcDQvF=<t+lpDSa&eoLYu(63TcBQTOpYh}>{?%AtmteGgb
zIqdPGEr%FYOWy1-ik`(dVavf{p;)2*qK6NPzG=t=+}p^T^)a-7dv9o$&Du8~dnBDt
z1ihTI&zv`A&9B7TC#rTAiy{x4eXj4qcxn^FB8~bbDf|hoW~z7BW_Bq&-s=CB^WiST
z*Ol3IAN7K!e3ALT?u5AEUK3@nf4oK3#?uZN^1i<i^8T~s%74L$KV6Rn{8FBAmVN7k
zJGDO!E-&6cRfk_iy!T0xwxrplhharGJ@mE<UH0g)|Gv-E?s!t5-tKdHQ%=Qw_$L0W
zV)NJ1Ri|H_URW8r=V7D6?H^xmP5*ad^|xdnkA0h8UuQaHHPzH>OW+k_CGTGXe^}(F
z=A4MsRGq@cooDJI9LOrYIl8nz&7;RAtYPmdi5Z&;zL-0R?r!8#T#>!_ROpNE+bhyP
z%!`<;FST#S@=a%E_RK2k@|mf!Lrg8D@Xq2D-~8|Gx_8?<Jv}vTvFK&%Z8^z)jf-}a
z6>OJ|waS`hQfcuoM8|T&r`X<yhP)NOm7S;m_dRPmt9NPH_L{)|xBJwuxGPOtd*fKh
zY3p5YTyu|ezlvBoO|MP1f$68_t@HwW$?aPT_g*v%@Yr@@g{!XF+RdT)MLg1PGKJ#3
zA6LEW+WB+o9q|RSJC<!_)Z}PvInusLHtS<}=d6?`p)Yr2JFMyEvAku=wXZ~Ko*B>W
zx$S&K0<81RezmW9azjsoxnPk*W=Qy5Em0k@ug6y}$_e(J6*y_5uEE)Lf<LOizT9t>
zA0rrkBj`{66>m{V>BTmk47zRd9--Mk-5<VS5=hmMk8h7`p7gHxLNn(jmkrA0%vRRA
zhR2UzdL!^|ru^=e7c3llw@>Ol;M;!r%{zy*wN=T_o@a$!F>kypqoKNP_1lS|6IGti
zbLmen5x2<bd%}OW-|hGGrSEs9#H=j)wQ_Z|$^@xhmlv<7F*KQWaYsRT!#w#rKmJ~H
zly){hnbEmR<Xqe0pZo@D`pG_iM}HVgv+PPR+iS<>cHN_UlgM1wiIx&O%F3FY7H?@3
z^!aSEz-jsG1K9z)&fS^&###3N1X0%5YgISu&rPkWJ#KGq_0mg1)W>)cN9m;#H+yaz
zTCpZ>!^>^yTW7D}>aBH~<k}gzCpS~ycuA7;9=R)11Sb93kQVl3*Mq;#^Uk=1f415&
zS$X4|Rp(DM&3?7@QuMEC!ClQQ@2XzKRjqxn+Ue%)U4DLN*SUSJyI(E0U2o5Kebf@t
zE9*$GCl3QdwgN^8nUY$NnwOHAmz<eetREkrnU`4-AFo$X`8M)(p3HX9f9IDgEMeNs
zz2?})$y*v2wil#m3noRnEm7iSNo=z|d~>O(vCL$dwdRihL~9%DoaA-=FTI~IXYNh!
z3v6%KFKWxp<Ue`%aPiM`ss2CT{=QysS-raGW<+IK=!s)1gFK7R#cx%LKe<`_Wcr&a
z@h{4fuM|D~(S3g2|Hk`kRrXH{Gv718f77Mh-r_r+fyT$Y7H7}XX_*>xb*)+7{%LD-
z4p`kk^E34El1vxVWqW^?cvLUHyY$_xB%j@3*H)!fE_@vpdP!zy=BbK5mp|967ITx3
zk(1c_bIR#!ns<9TuU}eQlK4EDExvSB(JION^}9FvT}wU{v}?<xMLwx}^mKoPs=n3n
zittb`zJ5Al)iR4s_C<%Ehvc3$c)sD#;s`J6=b8VrwTh}7qB_%VHXewW)wRki_}`@a
z)j!pndnSKabaLUn-&396e%Jo}{_RWlRWHT)dbibknz;MhB~3ZJG-Fm>;(2ZdzAy2Y
zv+Lgl?0!5oe!EhctwC8)k&(xd-kjbo50pJpPP+zwaJm^|@45Nm)VNhPi8?JE1p!H~
zb;@UjAJR$P`Y<VRuHXmGjbhSvC#;ed%?g?w#bVD|-}d;1Qq=9xL!R%#4z<qSQ4|)Y
zy4^}ZcG2grZ=>TfGG})_*8bS?HtO@P)8RV~9+14*QS0<EM@9TcdZ}(@U&p4Jx1D)Q
zb(Zfhh<i~Rcrx8!!<JJVf9#%%+05MV?^2J*PnDiUOJC|d-n#uxn6UO6?b7s$>=0gk
z3Hv*_QJLox`=4{>%TG_=ndi0j$a8T{@!V+7IH|zXTh02#uACRHE7X-!t^2F=@S3$&
z^83|%+a4^9`5fi^!;SIKj=UwUJoneD^c=L-=8cO8otA$1?`6-GUs;scJ&TnWCO-<*
ze7!@jaFJ$+<B<$r=IaMmZ=Jf>G@>^<_yJo)x6C9x{;<Y%iar4$c_K2toY$oOvefJR
zNO~;3ry%%}X8XDa>|);<x7WT&FlCCovyS(=U69MsViv|chPgkzPqY-4Pdp>R9q4*!
z!lMm77f*`cy(BbS^hsM%X<);|%sp{Bwgm<a-`^~Fx%3F%i`>KZB^Nji|2$p)f5v3K
zT~E7?^xLWY4%o)I|C(d%y<Vk;gL5TzJm)aoQ?vF?SN~((6{{~i*%ch9=<ue;-IX=a
zV@3L{4HIXmE@<ef=}dPNx@~Q^a{t6lA1-cJ+j@9e<cH}wPwMU13bJ%KnrAEPiy5YT
zDByp7Q!yc}*vRHxXn^9qw?5N%E1Yb*y6EMeTWd=8Wbd6TJ<~f|lSS*QO_l0%#`6mt
zCDOe_0!6fL%zXQTecnb}`|kW{^Ih%+*(hz8wrXK`UsLxT*;V_lNJ-07N;--?c;YE}
z_s5gF?YiC7oA1ZoyR+o}-8*+um+T5#eeAd32DbdIe7kpCymhuwxWh<cV%?UCv&juT
z#nVz}{(d5{QBm*B^!<Nj**~w+eq#K8VNiGamhQWmlQcZGU!1!=e9!Ux{$JOp9QD+{
zZOgJ^iQV!@w>uyB1LrUtHD2+QJ?C_3xah@qJN34$xOuwjoJUg`vwU7e9A~y?&)+@f
zwp)I@u}PWhG|k30baBiqKhD<Ydl-G@7XLU<v*tnZlLHSgr<{|&p7OG|Zu*|Eox8vP
zem^Pv?6btOeY#FL*S(DAs@~S__{n#F-o>2iwlz&&4!2eEyctek_RK$bazpUcL}RDV
zvP`Kvrv1BeLU%<>gXrax*Tgfj+r2KTDx1Xx*w_Y|>DnIH^JMy>O-1SL6W1B@-oBKe
z^XBvOqCfN8{+oB6e;m3(m`Ufo?GHKs?AB;i`3F-jKWGt_nQ=z0?4FzXpVP}@EBG@@
zR-ArurvBfS4=X;*o6<8`q4{9pvZqhpyjre&X}*iU{mj2MyY6gOWWWEAk@Neuo|N6j
zbH5lKeaBI-_w;&Er>QY=JFkDp;dspuxqDZyX5yA?#lRfHQ$GU)n({h#xlWU1=v^SM
zIW?hok*V~4i_a5h<t{z%_FSm!X;a9BC33o7wtv5N;Aq?-yTz5=e&M@%Z)?uD8Sr#M
z-7}9o6~CUE)(V~DA3WYHiht2&FjH&Co%E93LJ#|%P1HNaw=0~9i_7WeLN}o!bF?N+
zxGwczYs8Cltt!t2k6Hb<QT8-?q8q3>CqZf*$AKw2DciSl%-FR+o$G%Lv*(25K1Jia
z&hQF@Wj(Ern3H}_Uo?X!lI_d{3nr_y2f{)rpYA#29#gDmxqPAZ1H-i5bzW{9Q<q%3
zetPK(t?AotU)FqjK&0L1ie}KKsd1a%te!pl_U?PDb4--C9NYi>XyArolXdzc&9{vI
zX_&82=F%4wi)h=lYl_<2>*7~3=L7~`ZS(pXcG&uw<4JDL{>6(v){7lJzD?4n;QeB`
zyt&shE(%WJ|FIz0>htY|d+mS5yOh0RYTEm4UV~EbA|J7n8<H<f+HMh8sIfx%$=VGD
zGy8A&)lT#asC{f-uRT$t%qHDv_S-_X>u)tp7M5q2PrAK3ygXcd$?A)5h0a@V`Z_!O
z{@%*J(vz?EO{+^*n|)dKipXA`O@Hk-zfCdw<67L_=W1$Q;d7U1L73#L0Hz-;2N;c>
zvB|y(NRMVp>VF=(^g5$~=Jeho`K5iWW&3u1j1ZZS<?8F(WBXb=i^(F)`=ZOA<#y+O
z-CjA<eANr-m;1asmOI}UIu#Y#)>0<(yZFF!A^Yxg0rLbl2D&D``MB5kuS?$B;O>d(
zEgyV#{`BL{mw75vCEjaLa`9=_LanD}OSZWESR?l{fUSGZ#5*^tR97BdeEryz%@c0x
z%sqPP_NyML)BhGbOybBD$k%?D@#sK~c5$eZ0w>$so=XuP3wN}y5=m;0D9bxMJ!&%Z
z`sXIM7R=$R?YkuXdF7J%T?=P3vn9(OyW`3Ew{1!GO85Eyj%<5aQKu7p=H~g$4>I4s
zcx8H1c-z5$6OJcoXSv4~#h3d0T9vf)!KEvIKHE>8earIm$^Ey!*z!J&d-vRC!-DN4
zFTUn#Xu0*ic;;U#wp8t;`bo!Y-Vc8->iNBA`{x{{Z$>)GHGF+O?7A(QH~t<xpj-L>
z?R9bU_j>F1*%@j0=GE`mTV4EDfUmvH>TA#*n^l)@=6&GWH%au+r0KDfe}_DLe9Ssl
z!eqyV!@qtd+e}zcm~UuuWTSe|F2@gYar0Uu)(14l?)+QT@^o(LiXA5=Yo=+Md^;vz
z>1)hh|9+xl>wA~XoMRWtXMI@L68w4Rx4=i)DLZlm@>8Z>2zP(}#nyCc%B~dm`ybx#
z{_>*h;MDbA_sxC>J~)?gV87$d2i+~bQ%@b-G=o1`LuS!}HHjRoGg7;}URGKEnNxXg
z>y4b*pDyI*XIxr-o%j9T4d!1f?rB6^zRLZB@s6F?OF`B4O2Mx8U*?t>xfV<}xyHQV
z`hn2;>vqN74jaYfo@W=WHi!{eQPO`V*XfSSeQsIivu0AuPyFW!U9{vweC~ykNjaOX
zJ3j7IxN*aOmWZSFr>p0<e||W0sN*YB|0c%08hlX)IEx%VJYu`LHs-xmB+G55>bWW=
z9cgc-@Hak5TrYpkOKas@j)j4fh4!5LEhMeE)G3%bJBrC$Ncv7mW#9kvKUP0GG2L)Q
zf_R*N;%UWc1$%!u7(d<M!>n>DGI5joj?mL?7W3V_>}rkI)vt3F+Y^!5pyH4g?ebe_
z*8IN{_lI7)8}HKh{X75heL7VY3CrV@4IKVVYo71&WP`d%y*bwpA7O<bYZevS3e{@+
zY}i;XEp_y&0o&JI%jH<KK0a1k=JWdP&gDB77zm2`++33%zHpt?%&lFQmmL&ql>TFO
zMlk!-=6$O?j*0bu-nLEtbARzcfuDbWmnlA&5-;@H$!_lP^=2|s5e<h}mb|?#yY-y>
z_l(f5A@3)CxT88R?9IgbCBI6he_0s#drH#(CMQm7HMUnyuNC5csJ=V9+ezT!|DI@n
z%S}fmr+OFmiyiCey)RaGx6W~k)+znYclB;kS$0Yn`#m;(2zGp>^6Nul_1y53wK;O8
zJ69|)eLb_mq9bdK%>uJaPhEHVyGq`=^49L^+7$uT2^XI|O31#qmHl@@Z)t6T=!(;K
za-z2H-;gtX>mBu5Qyt!&{(h3{<EIjboS3ct!X67=J*X($&@YnkmQnIhRpi%+t;)9<
z&7M}d$lPAN-e~dJKjQ9(zq^&JxNj))<)DO6whh~XyuInHudb>5yZrpPm{`Z;=jY4A
zjwO|@;&=Z)EAMs7X|@EV+p&vuSBdYQ@^$%EtqcEe#eND7x9v*vmfrt7S%THaZkK+>
z-^XU#>~`sY=iGl^C_wkmtL<m1w;ro2cw6;v-SO&U|5;FbB1=@>#hsC1U<fH@V30>0
zt4Trbi6kW!r-FJRwr`6bn@#%vSES=P`%<2>DaAKe>Bi1klU%K~>*t3#Z*R_>a{lNd
zPmgD_ltd?Oa)14a`EK@|$+6{+n;AGxeM&J~d1~%zqlq31F22Y&k-A`9_U+w^!}ng>
zJWW0PeVL^G?V4$ys}Au^^Q=1ieP8FkdzHudRzKZ!?)i1y-_Ks#|Gh2u=d*ZO-PxPc
z_d--p|IpQ6^_0nK^E7qt)rbH8G5_-OS@es~XXoGCl2gg3|2j2PJvVNu^@VSLtnzQ@
z=v#QN-sJmfQ=;yHa}}q9a}IZ9&0C%mcD1KIr!rQJbx+JEp$)#p_gpOQt;$^8dT|ru
zoUDup#uc*;#^g=1%#R2vo;LkM*-QqeIc=;A)|;iOj(^O#x-LuZxK2Dno38h%O<9~5
z)7<U664PE4r`qUpHLk6j!n`UsRP>kQ?zm@9=cw{phxdoAwh>PLT(mV{vE1SG&LEMM
z?c6h>Pl$PZP}(1qe>rPoi{_QytZ9c%@9;QPxp>wJy;VnF|9Mrj_laUPGtW8ix{6rF
z-_8e5KknCze`MnHEjTpgWavTvb^jQRxg{@bZWK4<<4oxh_uLtl9CF27xzH&-{^Qqk
z#y1t%k6k}46%iG$${Wrb|AB?G?#RPXu0JQ7zP`}ifBWXi^fxwE|9{>stod>I<HOZ2
zZ%>~r%U1vH$?p`4Dg0-i?b&no^(qy^t5dG^pP4p$qwSt&FVFUWxbvoH>#1%ZQ<;m>
ze}s!F=Upl0Q<*a@bK|KWfpO*wzh-f5`ePWfCe!Kef1aiKt<Ot?);s@*S|4;o(Ry`Q
zDVOfekH@$91u4vZAZ$~4(!1}_TtOWsQ@I(jEJi0Ei>S9O(!5w-Zfw8iRHU8#BVz#p
zmd(x#kIXACJ2<<>sxaMt-*L9P&EIV68jj<0=g!^YF{@2hQ#USqr}WJv3$X`H3K#mN
z!qh7d8<&;$nk`;?y`w6+QE&RpREY)C<xU+;f8rd#w{7?C>Mo|63l^xn$qg;Cb=}5(
z_|v4RqRw~IUYg#}Zu_=6YHFm*-|T%llSC$3W!$#fAGP(*j&%ps?mm6HHUFH!f(81w
zoFt~L2{~EGHkswc3FT##TUHqLZT8JuZIdj+$b3Fgpp4yYvljD@2_A)YZf#Q*w`}10
z@_m-Nq<2)<`U7Y5TmJC9l=zog!{%nF|Jkh1omW3CdE0ke!6n(v_1+6U^j+mnv2t6y
z;lzK>XU1%X`5Z1M);wqZ)yJ8AYgWR1_w}Eb?QK{;{hNToy4AZ<#HY_I40~I2HA?xy
zWTVIr{_S^E4Bl?Nz{~k<-KzXYI_o(zPViJ4B{n8{H8C2UocN(t!ux{wvk46gJcQa`
zScs|JV}H7<nfcA3?}3-qN^dW4>20#$J9f@vg<{{2-ecC^vgdze4cgEeGdX}gS@@=Q
zMJ5+>-TPzHjB6$~D1ONJDSa<4Jkr>SUEQ$m7+;veS?+lYZm++=C9r!p+iTWGw=_TB
zno!TTV`}B*i~#eJ%d5^ki2qco@TIcy@`A9qkIO{8DnI=D!@?6V;XnqXZRPh@PamGV
zEq;0WkBUm;``#y?bxv>3=Zlkl++8y9&W8n;{e;ye5+cL5TfTaEbyf-Qji5Boxf`8k
z<a8(;Pzx2PbWm`#>Ycpj(T9C|9!ehk`|<CWuRp)&_O-<=IqPkDufCx>;q0X4Ki9DD
z+rwyV7{72&<3HxP;oO^=FRY4M^!IrF*<Fl@fe~Fhypq&T6n*=A^XErtnJAODX|seG
z6^kM^r)_oF&#;5J(EprWgJ4cY(DLgn`C-lT7G|07lrW#EX1&Z-wBT2#W1sz;`Eq+K
zY%7ZYe4l(d+(Kfe%H2TTDi=Zdj)qwr4^(C}h2@79^cEktxa-1bIr)iDfY3JX$@33;
z?4GpW;jrm0-U-nMGnqu^&!4kLtuA=6ZOvMReGHdtSs9<m3hYZ1`M2d~Xk0_3zz><d
zW*<&+dH3DhZ#=;_{PZ!Q&E@Uv?|Bq`CNKT^>+6@}`}bE~G-bGUS2rze^8b*gU)`E3
z9^47~Rq^GYd(F(X>n@0v&FZlGt2;qHZl1e9_QUUi7wY9(QaWsQ*=&039FQ*cVf~dn
z$F6%bc^@#cX!Gt6;%Z3Zvd(+wmdUuOyJfDqu)`A#|C3JbhhD`_YHfT!?I*X70^>_j
z2`0`X>G{l`o_<}sq>sh<uY+5_(jYsbzxp{3rYC)~yZy>^UWU961C#bP2UE7W{sK}b
z&6wn8-}uoUK6&?xWdd2gt^TQ@?@s2g3zl{%y6#jkaZPI<bCtyNkj-n^Zp-dgyKm2U
zxmY66#Y3c{wfP<Q-Nj0YyTdZqPFl3$-GL)_LuF6QF~4;0R4BKL&vt=*s>U334-Ji&
z#Y!xvFN{uqHeEYnancKa1`e~CDn}w4S?o=Yt8%l&`_2|;-R+k*@vOqTgr=u6EO)5z
z%B0I571;6i@-6*C_4{Od4b`^ap5kPg&iG??_0`vk8>COF-fUqkJTgmLQ{zzMJdxCh
zwS}QOnnFLMEHFJY=bw7b$A@tf?^_6bQd>5G!HPpXfA3YB*6Y7E-*s7cIq7Ju>?B8V
zjsrO*2ald?>*3vAd(3aL^|tS`Y~IFQv~=a#t|-JJsUPmS&~{Tn?14(=BPDLZ{BtKV
zvKWX)@CJIOC5Nk*Z){xX7|0xKFE6#R<nm|x{(I9ee09>jvRK?fsa%qs>qhh+*6DV;
zCg%5QZd};D!Qr=6q+4Qq*UJf4#co-?<CSh+Q<hv-^;X)TJ3Yx%cgvjflR_`fI;H2?
zY}Nm_m&JQZ=QYVKa-tW`9CTq?*0Ir9y&(L3BfsuVbGG9XirUvcU!8i8wMwj*SNeGU
zMX^31f8m{vzP6mI6?d_9IxM%V&s|sk)=MS>M@91`LHpkFoZ08VxPOL5och_Vk_Vcf
zzC8M#tK%kr*w(E#&ljEEbYJI(->p?M4mDV``Dd^``q6kdd-pekiSbixD}UI%XlrU0
zVawls%%Do~Ma~NG3A;D1PPoDzp1v*7nA0hC|A!kXy(~u_a2ptY%ne#o(cT$UAS8R{
zabt-2PeFe}&ZwE^&pCGMRU0X(2y>c#>Sp=MzT1H7-n<)yt?$;w98LIMdDgPUz+Qen
ztL^i=hvu(L*>4|Vvg|IIJ4Lzp$i|H|N3QOA$>bwc8TPy@eOuwHYg*q@6tvnD3#TTn
zH2s(8WFcM|f1NY(?UMyNx9++(`%sk}V}$?yS-Y~|*~y(}oS2|L{l=!}I{Sa56;<AR
zeRb(sv%{zKYwujnm0Lbr@X%kkEy0uTPYMfmT)O{{Scp;R?K#tQ*9rWzbxkQRFOUB;
zP097<X$}vK|F@FXWT^-m<eYq%x_Q^8a#I8C7Z1A5<t_Oxs^oQvBlUIWHH$BkPW}B|
zG{yB^W?$#WnQ429-Y198FBMSvdoMXKjU#*VZqCSbQMbG;3>Ri)T<PC+p=WWew8_)I
zdU4On^Q-4<SKlsr`|X)C`)56uZJK|eVDV?OJ7RJfo5Q!=+2!jm`R$v=&+J3--OP_R
z-nhg(Nj+?z?n$GMl9g93E%V;~#Jb^X^2r~^Sst&Na5nnhmTHHE8osW(;#DTc%}chr
zcv#tZ&35%%mdATLZ#(WZooXI>`Ou;{Ir%rQi9Tb<)D}@quPV92qnOx}uH1C+^s@)P
z$1Td-Umj!sr4_zebB}@ai|@7B>o%FL{<Lh(yHf|;oPTc8S^s+qPfxF@vGAiM-(n+P
zh;LuedGpRwJ#*jrw_4|HaCj@ude|(PVW(=vc^l0~=VClw#J^&EGV8L*!hWs&8^gB#
zy4by(X|l-6gO{{#&nq<#>TXnh*=~Bg_6JMJ*K;Nlm+apq$I#idQ!^ya=kb)a7tLOo
z<rx$kuQrHm{<W%XX>h<h?K5W%7IElgrk$1*Y<T-NagzIl&TlWbaNhrTHfF2&k)X7F
zn!JX8y<F`KDgtj9s7&Q>**PuVxovjwj(^N^=WE|ye#`1$lsYR{hhUD$-kXuSQ|pb)
z-tcYG5%1e2aGQru|6NHIcf6Ocn_a`k12$2u)j@YROmbA-z-#behDMWY_P^6yJQ`=Z
zuDSDmbMEosUty#tHDkkV&OHwj`h8En6zMFQyFAH1IH#2Lz4rv|4^zWKLMH`YbdTTM
zVR`4?!zRY$52tJYHnYFzHe5IJ&>BILAM2bO9OU)&oV`!!>)XZ&U0_REym_H-#p+3^
zx=F1qHg=cNB29h!gg11@@+7vea7wvlDB{$yw4`W<ID<{1O=eMoK$<~e#MyLS<zl0y
zo|;@~XJYj_GZVFLX-ew92wHDp)p+fm<Zf?+9iE2OCeaH+1f`wLHj7<1xgu+D{(QLX
zB#l$iO}zXE52YMir}pwWPy7pxCHvzx9Ga~WsdP&Dht0dKQ@;I_N&DgPuJKMv&~pv;
zwvBFTJnjci&)#|CxMa?w?S~c#vo#;yAbNTpM^wa`#0^I8)h<c<x2#>x-Ew@<q|WuH
zT$(<#NnU%<-}Wyo`*_fgGS{?&x4lYVnU#7nS+86+=e+n==Z>Z7FSj}^x@|qpM_oEE
zN5x1->C~bFQI?$C^4zn&ukDpADLKkeXU_G^O6*m`(agYOKZWc&E*#7Kx+UcO-n|Qr
zH-4ykq1yFC;+)f}PHC;=Nx{tiJDJ3bPP@)=5PtnERr2)rUW0!jty3S_8>y&$G+SXN
z!2exv=P};}_n8GZ)>}=r?Ww&Ix9|Gq*k$Hb8m$~Q2Mj76@z>uqxX58=yDRf;VoqMi
zZS|cSS1wp}wPx-6b=nRK?z`)Lo3qPox6it8$?})dhi<r89zL<i=jXQUllOuySvPE+
zxQKn@_1u4b&C!YnykBb0d3%;|Q~E}Y+JM&^>@=5pY%yTZ(DnN9$oJDld6%3Z3E4Y~
zobvTI*1rDE<hE~pq;93HlzY^Y-_rXQJ7fx}O@1#whgVj#@SSnF=*xFrQRi+&?ODkn
z`*=?6Qpd7j?REFIZ#j{7<LH&&YvxBy@?G*ISor77yhkfIOiJe6ID2(fVth)=lk5M~
z<_JYzy-;DYA(>tGs(br8ub_#aUTwbX;?<}3_D$U4)9+5M+sn7<JEK0+)t<6vRdaJs
zESr<xmbGO{L$CU^IL=eW^3(2I+-9s?xMt6qZ5O%st=Qt#Y;(A1LH=9jjanb}8X7b6
zwke)6pIx2#ApU5@-N${aKTN%TZQ7y+k*Yg>*SSCLJCT~i&#7V+nfQZuhVERMmYs)1
z80B?ba_;DA>ZBc9_PtRoWsO{6igm?@)@LE?D<|&bbhUBbc;@Ymz6*bMGde4jc$8@W
zFnQ;yS9EFCLFVYnzjv)S^F2+Oxc!-wWfG5ZrB-p{>)@EFD_1quC&UUYHF?$bYLT^v
zP=jFRI<HL=H#98sdK)Bif>TGi-0ZKct?kC++rmTL{BKHIc_&7id_D5@<35W!+pC&P
z|7&!c$TjbLZeJ1iCNLxH&&AU#zJ~5fW>~XasM_9LQuy=CfHj6ice1)xrM_e0%2;-J
z^WFuF%d<^bmV7ST7Gmkp#_(nCGJlcnEZ2611V8FMx2kdf?zcIy|FatmrGGiT-16vO
z!j+^0m)HJ1u*84AfV8dLUdc0R?`Fpz>YM%h*W@eQRTpjut=VuZTz<=)_p1|99WLv~
zazBhz{rY#4*+er==l(CZJFGs*?Aj#xEA=e<lECE!RYHPNXE^2-Xr;{13Hkq0A^FeG
zGMl!R7ypaH_Q#&%atnF2#<E|^GRU}e!sb_H8$Ksnu8UUg->td1G-7R6kHf(iVecXz
zx@!I^Qea%RDem5vsW<c$T?=JCCzu^APk7gJ$>{bn=6N%I9P+GjS-jXNfmx9|>Y853
zKZ#orm0A%j7vC~xFMcqAuXk0G@U)2CQKGLk)V574PM)oucre+q@dvlg6()0&cV|<+
zaJU{%n*L1L@~hgpYYF{DcVr@WKm7aNCSSOi$EDi%CDXH(&XoCDe?mWX*Pp*J`)iRe
zd+~<@cetvqm27i+W1W;SHzss@%mGK!`kh{{&WP^0C-u)#Zn=kWL>c>jqlcn7;pY+;
zFBW{6UVC=J%SF!%>@D+mYjTxtDR%a{<-}*4ouS5TSdqY^!^B~AI>zeb<E5Fl);_vQ
zs~+|oInG+QUA^0T+D5Ox_HwIvCcWF}^LhW25|bbK9#)1o{Z;3l=>0#%B)^e)`ybJ3
z)A^qrGM~e1IH_+@%C<i7M-z5`I?}QJqlH_#2zSS>HFqC933%*Y=qMJg{-)Y-)>pGb
z!42+r0~HP)pY(#UX3A?jt{-pf?B~vztIZ`>e`mvP0V@`{d$|=)3eJ7ldEJ+#a*xr4
zgn08Dla|?1r+u@gZJ%+z<lNWS*WY~<`M_fILh_7ewcoB4GZXqk>)sr)tMqj`TkoiA
zxKlHpac0J@Ww#{X-C}uQUH^=yAhE98&v?dqv$=tWw{Hq;NK;<FQt!r`&MKZ@#ku7{
zS2r+dMKABJSmAo}rQ@>eZx_DVpQLlcQNlP=cuzi)P1;%IjXjMoBt=V?yq_!aP;#5(
z`lY`7$CA?>4C;#h2fs^lO@Ge*{PJPFzp4gGt--$c=F082u<JcvXJuh)x5?=EH%C5Z
z2aPv>uc>pm&Nz_w<JY=X#<fKPjUSenFzrpxx%K6hm+Q*py;_l~pPH3U#EE%wKZ*Ra
zp!)W-16K{#CtW<MwCWJ=<rgIp;r5c5UpMi%+}M0%;aaDEml;d{e{gvabECmC^>1YY
zYtF+z?EdO}>$Y#0k)15_@kXVK=7Yma|8pGnG>ePbb=UgTmtV719<6gXy&bn*ulD-;
zC7$VD4^?Y@sCj<!BImrCy^E3_hRwSYa^wGpOpc1C*?y0@xQaP8+|cX^>0AH6gyW50
zrRC~vuRn$-7R;G^onvvUg1)pZ*8|DLiwifkc+C{q`hC}fJ-H>4@;CmiGn=HuVU>Gb
zUu@fC@n?-H^_|lWWFCKW@q0>GfBKAz6HE_FMX&jx^D?f3t>e;}YatmK3Gej&n9rYl
zX#d&7#$SuKe_S-v|A^d~pZ6bKzgpAhDfVT@-^Zq5>V;g#ZU|3lU$t(P(rX@_dE14S
zaLYBb{*k-ce)!lMOKv5TdGB*)bta#QFtiWUyDlHO!oG?7fA794$x_-m(;KytKFog*
zc_Hw*W6zU9N8$PUui8({H<9?Zj+@>7zucn}k4icgEwsDz|5(H8`bzh2cPFIIZT);<
zYkc{S9g|k<@4LP~DkrC4wrhI#5tk25d3_TrrU+Cgxa})9F*qXazvV(M<M!ENUIkzJ
zwe;P^H{X3Q&z@!Xqc#h#FPhV0`;PzH`RtQL_xugDSuFqg_!hG&Z&zL9(&DS(_2tiv
z+~rY4a?vZq4<4y@Sf<Ky`oY_+He7F+Qic9=JT9|e6Z2!c<3WQ9%vLiGE?8(M_WpO1
z|AwW1r*q%h9_l^m%aJ0>+RvAT^)qj+3gJ}SqOR}u>55kF_J42g_gwg_^Phdu)dlD8
zJup7DHcjD~ibslE*%kj8IjSMdu9IgQDc8O#eJK$5-~Dwm|5Q6im(pXmBfIa~mqgC^
zo5#9sZcCn5RSsX@nL`ZzjaLKy#+iRQR%QKEpY`vZ1MdXQSLx<1_!i`I|K*Oe8{)$^
z`vzWG-gD9N?)?v2bni`HVW)le#VYZqUGjfgcSU)pGi&%RTqhWH@orCL_1eUh+MAz5
z&gsaz5_EIYgul9)Ldi1%OJ?g77xonQOtdMwZXvkj;bvzh@l$tCPvc9OtEBa6mAKEx
z7mwo~9W#|SE<D+LglmnU_;366^Yf)SYB?G9l_;Fpn48i0hGT7(nbVrQ&r{wnJnnsL
z;`B4;Z&Z7px!uQA@r=#?Na#~J+uWySf&phMvbLJulH6cl^TR;!c+0HpTP*t)-B$Q&
zs91Q7T~W?!%gY<*Ov835EBeYxTe>kU;*>E_c=h^t{EFixsZFA4{cOK(6<9MkZ#S{>
zpW?V>>*DmM9)jN<?zgXsocUo*-(urCuZ+XDK4nd~exP`<+Om}qcI^k|o;KaTF3E%;
zQ1+mXXYc3e`Pw(Xe94*k^zGK2PfqHDO?NA|VOuN5EBa#gvx^lvA12%gjGw$Hb@QsF
zZ+ARSXn!}Ubn$7~PK{G{cK*0zXcBnKb^RM5Jww~Vi)(E&GT$AM6irxlz)L>pfYOJW
zZOeXs^DdoxrZg?qzC|lXEQ>Fcslxc?HQ5}k{<nMg-`0$Op|PO<d9SQu!13=by3(m`
zXIEsYcm_vJefw&bl5La7RJPLx8zUYpU3akT1ixQF_~*#~8}HA&l*&?idSCE@ed(UF
z!b;Whwf^}X{1qp$IP<mKgOEBAJEfwE{WsTmJo8#{q;>J#gT@OR-hU~-xn|;A2e~YR
ztyi7mCTnG>Y{_oD=IXb-+KsDL^{qf~ugIoklRNR>Ked;fa`3&fVV!x6?D??NRrh9w
z-|AYuWrc^F|GE-`gHQBcggq$An<ORul{Hq$?Q-y$jVepmUay@w)j4Czhc`~b53hUd
zIn=+HyL0Qa-%EvGO<a=vW|L5QpE+Mkc7C;Eu78N9)uh`m(psi>KUti^v*E$%6Ko0Q
zXI2WO-Ir~V>$mbq6SQH|wCP@(=<_T-V~56PHmh|OJtc=Pu$Sd%B{^?DmGzJ_Fzwsa
zJ3UMDww3M+Ij*u$b*gjTttPW?v((<ne*f2cdx6mWPpo2$Z}<N5i(SH<QFlL<SApN9
zdHT+&;n&Qj+!18`XX>AKgfFI9)!+195rbFk<kh|<>!kb-YKQAwSr;<>{whV+j@cV@
z=AX5YT^Bz0DeFSN>Pn^PhQqfHgffbGKZ__()ta;G_5v66(u{+f7!{sNR5zI1Ip4JR
z`uEfA4JG}jta;34m<wEG+wJmm)xpUhn>885TUU5HW*j?emr!x#iVD+oxy%WL7uQeX
z2vzxAvT#P7+Cqhi3Tl?(iVWUIID)h|F52GOrgpy}jsH(p3F|Gh=SzA1OY_`oY%qzL
z^`Q2akbmL9mJclo{FlB-i(h|T{UUdn|NLVmtMe*ne5@?rJmVy@R@;ZqadQL3qGKwo
zBJWN}xO?(~tMaE^A5Xi#E~$Dr@0I2ZJ+?V7*1m|dF08t&885KcfYYbEuYany=^@>V
zDsS#juzOc|llx+rg~P^HOUM7;rWUx^YrObm$5C2n(0`<|a&EcYEM?xU3p*kX?G^uj
zJjT#fXNupn;>o_>Y{mC=hbM2nSmDK7y8p|<GmnMz&#nEu<mtJRqVu|+CKeWNm+aX;
zqpqUZX5ksL*i1*)^9jYL*F0FIw<t39>-m_{A1*u8+FRu{&T9y;-q-$EZOXMU_Ho63
zy-z=0zqp;hczticv^rr&qwcT=D`ss75jAI8k$v`PNQy(7{qG4c=Q}Mty-KT8zMI9h
z^?GI2-6%hqzL+k?&%aeJhfl3e(R=ky>-$=d-*0!HK3#j^%<j|r_U!dl`$dzBGM}YS
z771U-!r$e;<u@l&hT+7pj08pH=Jvxvxm@?nHhEp&Qtzkvb#kIZ#LK)2&1LofPCuWw
zPvop|C1c$8-M*84RO~j|_u|Fnf-a8>dTn32`FB{)zoTXuyL9m{&mEU%E?@p9l;r|T
z;nFIN^)Hr%u&q5@oneu4>$@*^y=u~<Gx776gxzx!=vei}I`#6p6PIsqx?9#)apOsp
zmc$<Y-SUYA>1GS}*qxQXw<_`Cj63!$S?=rRPc<`Hy#D=^7O~jmS$~eYAD&zzW1#P`
z&->dQ#p_G=xdzPj6Fu7+UjF*To4vc2A1S(Lax0<f&&i{y6~~kPrXMeV>Bn>W?EI;V
z<|`QK{a>RQbUB=@%s$vPx+T_jab02JnfI5j>hOwGKDhSpsj;wOi0DE^8*WvJRjE1I
zTEa2UUh?YfpCGK{!P=|2>eVvFmO%Ec+cJJd?zYU5kW9<?^49f((>rC?%uQ#aJ4F7S
zbPsV^pjB8PS@QpD^E-VlJ0|~1*M_rC8Z~y_yLdf?Q+VaXtT(OS#CBg@wY)X`e@De}
zm8%DrU)(as^N8TvcgJsRJK<g7zVS74%B6>*@%+nVPMPUHm7AqyTweEc)o;UoW3C&$
zdrRM!tq}V6Zs87Ac6BX<j`$Tu;rbKfyli$^|DPiCX<wUtRPet}>lLqVB{>B?{Icb2
zaMkCRp_Q+`SBPw`6S3$0lD$LK@ekw8rFG^n%b!gD_j1{PR@8~m!|T@NxT-QRFw9|K
zP{214nx9`>0y=-E_I>nit4$xu|8d<veDApD>={gV=jr)pP8X}<JAdiY@(Xu2PoMod
zTS#?>#kT8Z4R`kadH?>*i+0t>LZ9;sXY)@uvG`(!iPYI1w@=H;zrFmh{h_B#TIR{N
z<HFOzKANN*omW1={js*$9nN{VIaTjB)kGfIy!zDb%58hC?^JI4e8zfz(mnRDw3X(G
z<~k=oS%!Sm5<6>dw#?P+`=NqeE5um2o%QEEj|{8~oRt<Dax^k3FQ;Qu)5-kFE4q$(
zhD=*C#r3kQ)w)eOfvi`J`Y+EEpL)+SU!{N5YL$IcbZeUCFZ!u4q4l%MY|~Q{idJZx
z-aO~Tq<;UG&+p#|Qrg|)r6w=8Y0lCEt3G~uk#~lp=)qjw(_Lp@yDz%e5}Ffpa@K*%
zuQS;GKIZ@Y`lf~V@{c|f>usyuS$S<f?~w6c@oH7V#U(t;1r3%n2t8g|E;r}@=gWaV
z-d$f@UT^*H$LV`*?D7}Qr`?M<D-wCGON-6PXTy#YK~ipv6(Qoe4H9#f-OHWhx9Rq!
z+h5fR53Z=y@0@mXk=EW732{45Y*d^5hVhTE&?L^;Zrw|S65`&siK=es@%<GyXIkhK
z6`5O~+wRT3H*em&x$X1){m*ZIR5C|LE$6k-=~G!1;`cu0NBcLewkbbwIOCA9Oz_R3
zSxcRFf1PyfrJ}F>f`fY!4xe`AIU9Q{GlZepviNl7giWWeUb-a~=X&(VtFIrfTFic4
zc&O|89?$pRx)^tVeE9F(xoh3e4R)%{W4Sedy7}XW-##Z)CktPwJEO%GBpiBAx939W
zHV?J9DN|;KAAAuyQ^sUTKHufnWfj~%w(Y6!*m&>r0!Jm28q@P?-7S0N&aGDXw8dZl
z<S~=Ydu!i|Zb+26zxSR}ivB#|#lNoDUO(PhGfBnK<%n|p|LOLc|HZ9rq9?StCC{mf
z*x9i_Jd?%Pis6C8vx1kgn+mryNOI5Ol>2n+2%|#<>#gSS!yg;psTWqgb=}P2+Vq*#
z@tJ~YA>Y*{SsFKVwA5DAt=km6f_=q?v<GtypZRV+lw5vMMyufD{#C1L^0Qxm`)0P_
z9&4oG?O7?wDQ-Kr%I^D7yyNWta2^$g`7xoNTew|3QoDspTq~GM+%iMie(bQ$Y85zA
zQxhwCaYk;T?govF1x^Ap1X@c!Ih^@Y%h$CnkGZ~e#ftThx$2H&Mu^^)(S20Q)b-d~
z>b`BI(T7bhP2`RTDwRGwBK&JXi@V&`RlVm-yoFM}i3-P0{Hv<tV{oflMNYkN*AC`H
z+mz`Cmf23XVKrEE`1-j|3Dy-Ko2FTGJ~s~dk{$B)Z=B8Y1qaSMu*gncE-W{r=E8K{
z_jilf=9Yc$Ry)}h`E=eag<w{`1=VI|(H(ON9zQ+P!tH1>PuY@x3Cot0_}8!RpZ~_P
zWT`;jvGopK0fsR=>60%8Xt-v4P2U{4x3#=F`iHllCJW#E#A5kHhNk6H&)!Tum>278
z61iwn?Jg(Fi_YrVD;*Ce+&pI^wYW<6|AI0HdC9j9-p8lLAIb`^eB9#78vZqK*B7H1
z7Omp3$KpiKdaXa+6#0OW{r8rz<`TaI*&LsfMhZ&|GItt$R^2RfW%Fhh-pa!}x}IF)
zIP1Nyr$VP!FENp|BBCIlkwH9e&Y=tHDlLoay-zr_POy8vm$_SM_TlrMoJSPBVlD`k
zg_kRKuAlk+vcbbMOjFOiYuo&>;=APoIX?%bviLtNKlaLLJ>B~1jq8t`?0KR&*~eCK
z-QsqPT=a3%R)$<t6O;GLA~M@HTw+k^d%yms?mB&D{dIHhxKCwI3yKsqEMWS5yi`KR
zYKKpuY1@%~@gf!h9w!?lN?$(UU1#7S_Caa)!h_mRyOh`PWX@LX&$#z*$&xPPS80Df
zn?1jL_q6zl)z34${+N7lP;{;2GnyE7a*{>>&wO|92w&SJXS*L+dhpB=+@oqY;eUem
z6%!pR(b>A4pER!=aN0QGu~g*+_NBhp3i-ZqTF5Ch?s@FWc4o>qRXt|gSGu}qx0bRL
zl|4Qv@i1V|+v@j?P6d&B4A*2E{t%kOdb_cFQtEXV=d(ApCqzV)?vXR!e}qfqiRJZf
z>&EYLFIw4zt6hbD6{z3%#-}E;C~j?n-obu#t~B-wDxzl`<}f7mtaI6>%{cK$(?hPV
zGph_2|2F){z|1t^JyXK}D2DC;hXu;2UMDM7?`d*unR$Fw;f3%Q^P3gpo7B}@E-#p=
zW|X9Rut|vJ(1B{(E$YgvHfv<cIWZfowY(O)rAkP~dQDU^vvWdC>ypoXf3g|Ncm(v^
zYLg$YpEX&0#e3Ut>;HZ?*ro6{l9Bmv{TK5Wiav{9o9y;&boTifZTofY`B>R6%->sn
ze-D3Z#wPk>wx@?jqgLYtlk<k=ANe0IQV(cY&S0lqu#f9-+{sBV9S&PfNaJE?C}gO2
z(fy-P(6C{_ypQvLI;`e6zcrpKN3NFj;~n=kd)=n$=Kq$g`(;`&N9%*=huZh{E2CmH
zk57!e%EtJ8Zi@5NmH&G+_VDiuy!>JQhP%Jt^*vg&^eUIDZoPAI@xf0{8+P^|6VT|M
zHJ^307;A>j|EZ=S)%VQzF0IbD5K%qx?e}#zVNct>Eqw1PZ$1qdh|J<=v0W+6!fvH^
zQrYMD8uts#(LP%~Udzb&P!!<pe82i>VTu}qz7ogo(+^h4E_OQ}c~(u<^=Hd^9}CAN
zI{8)er)_w*?A8^P_crNUE_i?E(8-&#;?Ui>9jjvYJ^69m>1BaD*WWb>i_I<;WvQvm
zPPo7O!`Gnt2c7p{Ce73Tdy(z^OP^~@a}sB&8=mWKVm(y-R@CnL>4&Z+fA%*&tnZ!o
zty=tiTfL<1%in)_TUn;95HOt@`n~>?`DXLe=9A5T&i-<C{-1qK?R=IG1xqceeyMlv
z4&^VI_w|HE#e#+v3C;%_&a&|yh&b{;+})$dSZ{Gb;ZwdF9{RJ+dss*mUD&=%`PPZP
zq~d9}{GWHc+!K+pB&c#@18dc}LuNrLXIf(Q(((ihKj;eR_Mg&H{9WX_SLO|C#5eUs
zo=wc#4(th;Aa&dRArpI#+~!SJ#PsDH0}6g9vox>JdMYvL!Q>6!{v6m|qN;a3>A>q*
z;^*DO{&E{^c^{GKl>5GS7PE-hMcs4Dt&L*d6$s7Ja7ez(T4>ps?hsI4>bzFsLRxIE
z>fVPNG*lbqYtBB}lD^=Dvi<%AiA}yAJeJ4&Rt;aBdTy3*v(D+-$>o!FI?vv@LiNi{
z6~PyOTF*&rV3ho%Y9((gpYc)m?OPX}`uI18CS)iTAA4mn`BGQ#hN#m*x=M39T9(=-
z3;e$Kx;Fp##T}-+`wtpbzGpw+VX)9g<ihzzO-b?Fi}(3GSeUeT^4m$4Sq_e3`+laj
z{gT|1{!zc<iTD%oI@kA?_m^MT=ft_;$Xy}DxbE&Le!Z(wu2o4N-H>3Jd$8)@)tQH;
z3v^9AR<kU5i37_v*7;I8t6Bpm%lDmpAKY<umelV(>91!lS*@_L)}bSGqn+xMme;!y
zgUi)6SjSA)>O8WPm(yjF!zA8PwcX;=Z#CWB{H(=~QDNeQjuq|ae_2_D$VR*{>iV+p
zpYx9YFZhe=HywJ&aGNzIx*%lT5`NjG4~m&SA5WR8AhO-Mr!FVRqEVTtH2zW;>yGLb
z-@V`6<#_t|uG<6CK#e#z1%~Av0T$D2f+q#eKkDMRxI07Z(uVWe*;jm9+AJQor?J0k
z-_ifIJaa>mOp={<S$V;%Jr#N9g<8YbJTDYpoy*ELt5RfwH(T$z1Gge>{JrGf^r)<0
zr_b-rW*ON#zfaFSz?F50EmWGZ?q1*7O#UA$7hlR!<C<M4E9{$^r@TFM=BlvUc^}Jv
zxTzn{Uuw^i%o}pAJHANvcJ<cX#s5$In|N%4DBq<nOQj5%7pICYJb1Q1?5`uU;41~g
zhiqT@gBL_+P29sPlVqF0l`q_@*VBAeY5O9j(z_Kd=aQIb?Cvt%{3HLQ?&a+&Wgiz^
z{UgM|dickBJ(<T7nrzcd7jKxGIjQELY3CO1+ZJn@^Iykg)Er@*_xH6s$DU_@-)4uD
ztAEzgTL0x`Kco6?vqN7(ybrzmx%z|rbS}y3+}b9b^%=h!7QN9FnfLQljzBhZmJ$D(
zV(~BSQc~0Qn|Yj%jJo!9t>{YL>uVyr*DK{tomQ%vT${Dpc;)Lg?B`0)eZ0Dg*XC-W
zwb<ISv?_mBo~|>@8>0W1=ikfFn<5>t&W2^bSXBJI4aZ_D%AcF7$*qs}Hj<c~VtM^h
z`Z>c$-PmiB*4(~Z{`Xet-Vay9++;&Pxz{c>J-g-YjU}gJuguQ9!P2{6x?5weaj~zn
z*phO&IY&}U8J(?^Hf_0YS~~mQ`UGLMHTPBs{IJ>g{K?tHo?Ly-2|t$A%wB!x_AMs$
ze_4f{3)kx2Qd)4f_Ft(sTl4Ix(dX;yeoopIp0;2?M!weN4S_WUT$BAwJggI@{0-Rd
zsim7!!kx^!?7B~*?VD2-fe+42`r;L^Fm+G=j1X7X4DRI42_~&+a!#oZZ%xj<(O9(M
zQqRP-OGN}c^XG41+pHA*WN)r86XynnGM??9y!)!X-S#hGZ<DS)uw@2&XmHu>il8db
zY3Cvqepq-%heLVmoo25usr;)aEU7sYbh^f8^OSA%qI;hOH!?Q+JkmDM_E(BHUNg()
z)|uF7#exuld-IvXJ}zE1Rr`<QYBMXxO=b71efOuv%Xn-_oVfKBW8~wNl65uvwj6f&
zaq*^n{F^tuXYNhP7ua5U$>G5Yotk~ux1Rr=6Y^Nt)%xtBw}L-sHXc5klY8lD-j&H>
zrN3QmHXYg>rQvgS@^W8B;a{7Ng=O1!DlYLn;kEGJ6#YdkyAm@ZS>9YPjd?cpVK{eS
zjQnkZscQqy$ghZfmKbtIu4C1)r1B17wnb;_8D8n#Z9KIs?eo9n`Pai#V=t@;YZhWM
zxF%p)6&xt1vi)L^TUE-2EcY)TyjD1Ge9*C0y_b0t=j4R7iS@_tZ+IFMwC;RWq-*qw
zrIyKFtJ0pV5xVC4USg%OQ{Kid7v7Y3O+MD_`zGtWmamBVCNk~y+V!H<cP|?_@&C4(
zx9f0*RMg(1i;llrw#DOTg;O>ED+&Jcx52)-Z%!2k-c)W+&9-iKxH5HHT}47>UaiHE
zQ2u|uKmHeg%zxDXrtZ_S-7hrn*}495VRrse{(jAFrD=|@ogPd6ROaGdYmpW$eDTH;
z>!|7g@8^3KeinWEC8n3-<ApnC{(Ud~98>bSCe&R1%AUn9qpqso)Y;L?<#X|+Z|$WY
z)%Tj-`(zY->)m&+dr8Wf#gAscOR>82&Dj49Q*wpWQO^gpUJ_DAk`1;$=G1N|_#*qW
zPwMEIy(gHxE~uTpWO&<MFuNl0>pfk+>5{9RW{UL9+O@`3c{z8J0^jDi$;riA`&|8k
zSA62}x#w&+X=A=~tVD*Jo2>Dx3tLhrxNS+Y$YZ>AkZsfJz*SQ=Kds!l&1|V%o%>>g
zS)R`K6(?Ax&4{>{x`(By+v=<Wld*>OW9vKTu1<D&C9G=ud&Q|&f7IW4oS0W9k@6t+
zzE_}S&vBQl4EyAloSt|%TT|RpyXvn);&Z+|`6dd5e0x;9(z`Q`efwKDFZ&$(&&@kF
zbADP9%F-^*X0%Gl=16eZ2W1DbdoCxNS|7-NxsoWC5x(fd?^%|?(|ANZWj_QbFh_;@
zL`S|0)=)Tna>4Rm-5le<viK6wmv4Tqk`a|~{8hW}u*-d2@7O2BX_2jGp2v1i;y&Yh
z@MKqyx%LKY1IyzF%5vM=_g!@3P<PpWyYJnH4GykZ0u>%Br)V{ve>3&O(=A_GZK7Cp
zg_jAq7&Sh(wcNLF#fn1DorP>k({Hcr4Laj~{9)OpxQ&lzg!N}<&pfk)Z}JhFdUK(^
zstaE#lArf|C^zpt?)~7ns>CskT4811S;^mjXiDwBUvgD|(c_!a+$}G%m@DL_uc*4E
zY}PJ0kKapj_6g;*{F1Z!ELY!~_^=4L34f>%o4%n*>uIuV+-pgxhWEDVtP&M7+_)~k
zzg=5@by>7d#f2MtLz6Gw=(W?ICO5a?V5G*)UbeIzPLU~!(r116x?;m)?{hplqO@$H
zHP^A9OjTz6la~r}%SR^mJvaIL`mgS+-EG`o?ex4Jcqs|b2t1f=C(P&aq;uQC_*;jX
ztQoV6<umwSUD>2|^_N0&#uh)ZsPJG{uiSg5T^wdcN{E-<2zwGIk-FmipNZO@?aM_!
zdTh!uKeF%JivDLVxqUx=OKeHrlw%Mmb3jJ;w%0rhNA<4~oy{kb7PW7Qy5-Fv*cvk3
z_UvYs<ta73?5n-h<UdcHvTyZE_ghsBmVXr8_q)e+C%;@$C3lN|fy2}^+oL)GW|qu9
z6&v=g^xXf5;gcBeHyaDZe_Y0oN_kR#UlL-U_TKu9?xs^S_y2#pI<5Q8Z7EaPb_E76
z7gp!g!uPMU3anypO;$Y+c}8Bd)%48e>>D9VE-imEZKY3G?$pO;EV{Z<I*)56eB8e`
z$;dWdhiysp9PJ4iw**(7Y2aQt&$?4y!XP|8webCFJ&wQ6crJXIQ{wF;WYWti6q$V2
z$Y4#tlCL5yYWvI*^c)l8uN&>Faw_s%p1Je+&##Kf_Z6?(|NS!A;?KdEewDT<o2F_#
zjtI_qvErrHj%Ocs@@h^<*tPk@>Z4zK@-1Gt&#{bI5WM7N@BO;px%@xbxgUj^Fq&5L
zwcTUMjn&z8RC&wF_>)JCt}!XRlwe~DZkot{=TP>GL(ATt%x-+4ID5nPU2~oJb%RA@
zxyr3))#Ywc&f0nVA-}8juSE(goK;UIev8>GoZ+}v?Zn&N&l*@BM*Nc2z0BQewo7Mo
zO5n!0c&k@T{XaiAhTTvP`oH-{+ehWlZ#M$;bKMqsNI9vkHTP`E|LS^qvYmwNmU$^9
z9A1;Z+wOPW`6%!MTkh|B<_G1X7p_~ex|H!1*Sov7ue?e$H{7e~=WFGdCAl<Z%c+{;
z7H{?smsDlevKgNF=_Wt_0E12Dr1R%BQ%{uK+0n)rnbv(sW~$t&Edlp+&Wdebz3*P=
zo3mY(&fnbQXa7Gw)k33xv&`9&iEp}99Bljj?t3qmH4k?6h(6{lu+a9W%Wo;ii@7Jx
z3ZBh=q{p%D`^S=-!lgaMHZ1;TEgK`(ZjfY?ZC`#kCgIk}p8VP@O%|4{e8DwxcDXkf
z1Pj#o*`_R;aA0SS+9H>Dv8SB|Te+@wE5w&xS)}8u^ZLuV6>-YG+GhlfuBq$$Exom8
z;>)Wtz0)?-7A}{xHg!*(tbEoXx;NH`Nxe*aTd=vJb)Rp>r`vTMfrk>=nok<$zCQIy
zeQNi*9~s#d?X8DzZ~m@P7%UQ<_u_4v*yFZ-KRZMD9m2PzCVapBOmE)e38IC5H?5{$
z4|3Z)dyVh$1Bykt9s9n`uGsl7#kk}4dWF}vr{piX`L?mWDh`>^lq~;1AmG}8CCRZ8
z-)>!Jo4b0)f-BEonh4%`+^<o1CFz#Q758ed%$K(^9y`yP`0H87X(mq<K_RnDSshcK
zISpGsIVXSFy7A86KIS!6QWutHHyixWTq$eD`L^QbEKc=mo~s_KcP-MDS*FX;Br(Zs
z-a~fvlnXZwwllToZe0~UC1OHP*dcEt>CTV8j?XcYsywA!EWG4c(+Y+zw{H`gQ#uTF
z52|KNcg;FJ$@Y#b=k=Wa2kx%#t{>2h%<FK!yjG>=#cbBIf9EW_<>~XGN_!#atANbv
z^=0$!2kU>^e>Zsj_fpg4>UrU={oAiTx3`#E+pZRJ=J3OZ3BH?D=WdA=nw6L-?CEXc
z!uU0p-6bi1<(h_H(~f1Z#l6gk-OImhbw;v@^r{1`&mSGVcVg{R%K&zjTbnM`+$(nx
zU30=fE&QbA71kY7GZ?QqmGx$bK4dy1*XjFk%ICVpxyo11>pr&IzmKs=e&)JmTeezr
z1j(0Q7t=FeF{2@9j^3Y#hI&_uwwi2va83Duq+;tfX^Z}~m*07<urKy05Z|kPbU)*p
z87Eni{nS40Z8mJ*7*Xjy^G4RcYZ+Hkudj7Ds{c;O=EKjlOV18nzM(vQzVDQWhVS+@
zODueGa8`VE>5j4^HSRq5K8sf$iVC05zx?^TP?zZQ(JYrzk2&Zbo{;%0FY}<KsQcRH
z^N)V)+BP|-+QU@#6_@Dg@J*8#7YGWPEUAy4r+>yh_xvU|SMAL#Pk!%T9Gbwjm3fN0
z%nL)SO_P5y@y|WE(WKo{=EgKWhsM4|eq7UeOpo@ql=z*xu=TBb?SzZ>k1?+<&X!1!
zyLC;j!}$K3Ggm_ycZ==+9=l@S;@C3wq<~j%rFOC#H8me;-7#6n>-PM7U5SZYa|NPH
zLL=^o-4(s9x~t|@Wc-%$W9BJ8zM6#uT3U!Ca_qTm5_yf&{Ay^}rxkqsj@d6N3Y=N3
zdp@jio4)f=pyXGzHA}Xe9OLs6_LInX!gyuxvE1$dw0zE8=)ZVr#oAY~3~U9{?npGs
z%cdPo*d4IeWr3J@N+^er^m3ai7021Ph`xXIbS2y7wM=(jteC&<l=Jn(FA*n?pV5@v
zAR=<<f<)62U(HEE3vE&#s4wHb6S1V$bx;3NH}j_x14K0@%`W6xBH6O3?49`Z*A7#<
zvV-%L3S(E8dTHgqGCBT~W709VRX>)MhsjH8?yXrEe|5$x>)j37hG#WO?<(A7VZU<f
zessBhe2e}(e&Idwc^2N{XZuXqgDQPKO4a_m`sPdcz05tKedRmz%BE_GD?9M~$TD!S
zZa&}IvdR76i!a)8)(WZ2e~u~`zWvp_!Nok%W@7k)%o74%ww?GgdtX!gyca(!tAEd2
z*VFSRI$cTS{meJXcP+iV58M=g_ijSuY5yh1ck9PzaEJ1KePrplx8hy@nF(fgt?psg
zLP}?yCh{)K76|o!R=@nTT$iAR^3#Ni`OT-6vsu>m@<|@&tXx#wEo%IA!{SrznVZf!
zTy-i_pJaN~eYX0Eee##Los?fGxbu6e$>rmYkDn&3>2b~r+t9Cn`E6s0T($Xm)3r@k
zuYcfAudi?aZCTQpFW0|*`lEmBf14!#3h~aX$)1zJ+I%-f^I8A>hR+LBk8e>CXu2pa
z6n1(-{xcq~J=e^1>%Qzc+LwDRvnx9)cIwI%#mTLA8(E~^Eq>MLbnE*28;M)KKK}ae
z*fe+7iK5K!E#_{p{`hynqw6t7zj9xO`V?K>nqmA-Wm2u}Zy}k9Q|{)k_4!?^boOGa
z=SvrD@gm+^l~<P>Kl3D}*<r>3HZe=#YavgwPUp>4dpyhRXClX1wW%3fpTy?Q(pspr
z=}*d}7yAl7Mf*?QUSaX7P5iyf#OpeeIyo{c1B{obp5?ptT_^ozs^v!ChA^c!&GuP3
zR%MF{``Y+Dj^BEAQPfULcJ->?ZU2(z$KNzLbWr_yYm!1jvV^$wL%I2Csw^i=x0iFe
zX{s6oADhfE>tc)e@9V6Oj|)7z*}__}_M4M=<eA?ri(RLl4dgl@a!&K(ss}F@@A&O^
znqz6yqsD``cce5HZ|Pic?(vE58&>uu&YJ6f-RE9x_j7%X`Tgl1MQ?pm+^_8UNon1W
zpFF($i+2ZkmnPb!%DGG_o#6X*_T!gEp--6XUxwYEc<V)K@pD(J^Rp6F*C#t9*eGe8
zyIelmC$KVpLFT$I9IuPEy-l4{_HWKYrSDq0;dLJ_%#n_gxKa9~^7FJP8*$MoGqbKo
zy^>Gg;ksFF_CCMq+^kmHHm{89OW60~p-!|&@;5u?&-b<0Kbmt}dp_U&Q#Qdi|9jU>
zY<>IT$&xQsv-Qi%|J~uYd0#Ott>mlTZ1%GMNw?>6e(Jp3TAZ$I_D0dN!_j2s7pd=^
z$4d7c=wjn8K2WMGEf-oer`3?p?__bXVVP)Yi;aV8r1JfD56#<BE>wo(O9gsMtzLiS
zjd}8-cbbdVEq>9j<F0pBic{#D%f(9zduoIwX9)#r=RTY9vQO)@XUajz<0ey*s}&j7
z2+Ye`*C%sJVev7RU$@LEbE<Y7{jhJ{=|X|a=MTI)@iOo1o$bXtu0J^tC(+xux=`_$
z(|(yFC$5L7uacR0P0v3tJ}Kd^K={$irxwM!`CYbu6nlJ6(VUeTQ<D^YWf;$NSMWVr
zI+ypx5m}upO4kH+wIe4K>_2@;<LSf3v-bA)Yj@r{EEwMYAW;4|ck8Re;g>E+Rot&B
zoc-g-{m0Hl_fOoI7{M&nan&hwdDSYZJDW9=YIGg^_kPK^|Gc{)dHyl6^IK=k*}0YX
zk!ogX*YaSur_Xm!vXGq`u3j9ZaDBm&iJJS_=Ffbv^5Nu@vwGi%|BRgY_N7AR1IrJ)
zR+hy4Xq5kc)8miC&ga?fk+Pjd3xf{(RI~XBC{6SWv6-6qWtZ3fhp((I$=&`NRinyq
z{5=2U4=apVxw2(BV`AqX*?A~jeCC^7ZDxl)vjv?IThg7`qvH6l!nNZ5s`odP0|b<V
zla<u38teXBcHAngx=8H(9iG`$#W4&=yw!8gGB1-*ef&xD<oZ8P?x;tf={_dff2G^J
zj*<V&7x}H-p3M*U-@dJsd&h?P#;%tcU1IFHDvB?s%*y|+ak050_0q=j%ypfW6VE#3
zIcBBQHC<AgwOI48*S~4f-5Hx*XV_jlebT|lXFd0O(MM^M?g@zAu3B<iZDT_0-A1u*
zk-wMtfAPBHpOJ9QqmChKaaiwd6PGI)+j6=m>GFA7%+1exBie1<9J_m)@6?F1pTj;k
z^K1AD-)a?{e$4uLPXgcB*`6%x%3nR=+S1Wp;&}Y4-ke{PyczZudhFB5Jl+1)A+Wi|
z^2A5o%=AK`=2^$4%gvp)RdIFv<dzK9*=#~L3!^rs@EW~tQ+wgM_T1lJUp@Az>WIx*
zlx#aEzx&v-?|O-WyH3dF9DlX!Ov1^oz14f0yk8&MJTY41p=Y~G)vs)oOP{@!r=;?P
zvFhlBim1;@%!###o+ViNR*2)R!lu;2!oB-E`j5WR__ArM^^>!IwoKjebZ2Vx2JY~A
zOLDIMuD>Na`4@93*REEDndNELQ(NDODqVk6GHY$Z%w4`Ut(J@CZ(o_XWsl+R!ub6=
z%I8i$CVNFYWX>%6tkmBxZtHwHvcHT`zCYSUZm+r4hkYNW7w$YGWb?xD_(PuM%g!v=
zu;bdh@9U1tmh=vq7RPUJ=#fr7hlt0^qunJZ+z*Q_H@|7RPgf)~lkLR1$0{EyYHx8q
z%Ks+v-sqvv0_$Uy5q|q_ui#tK5i9a&!lu@&X_se<|8VXJY!_W|LQbMl(#_-hUsqGv
zeOInUZYkjs`_O!N@1groe15+Fr1_oif8Cd#Z+?7H{_{-Vu<{oB$;0N%H{v!=wM~-v
z^FFcZQ*zIvAlA2Eb!^m})^j*-el9&RZ?~Y+1Rc#6AM=WeH}1K?_Wft1^N(xS50-PC
zy(*hr>$`WyCXw6uCO1X=z8*a3S@Gk1|HG3XkMH+f-I2uYv+rkCP(ItI6N2eB`~C>0
ztPvFX)ZT9TtbcjK4_*Gn^2bzvNtPPSPI|Q?c)wzNN4etXtxtIKZ~d+`KjUo?zAxw9
z^SSTqZqB*tGMCF?CgXg=SAF8o`L*A)A22v4?!2p$;c(=$z05B(g{uE>bjR7SFTdaa
z;J(8Yv1F}-f9oTSwtGG52=9KK_1QvyV@8~FqG0>%>jjm5FFs50cv*zRIZxfGuz1bG
z6+O<=OrP96Egn%6e)!`XAuW{+zj-B8e-t!I96DZI{pIvW_xIBm_q)&MKiAJ!sVMI7
zV@*x?+Skn&_HUT-@b<eUK99ccdbD@)pR-$jPP+F``_8wjbOHV+|Mz(3|2ZP-KJm29
zHQ$OK&-Z^&|GKTY;#*C5a`EAhVk@R?pSiMHf?aO^pA!~~3<9i|rzzfzND;jxHm`E^
z+OpgH-dA4t_sm}ZvrlPj&%K3}|0nIcyW@T2bgPf;E}V8I`hly=ML$ZY-aWnK^Hb)J
zTco4c-3+Rky`e~FpVUrX{#V)y4)3m;Q7Xyt=-3~LAL(`i(Ka=!*^bpV9Y32Gd-#ZP
zNZ~Az4__;dI)DDP*IFI5XHCW7UHPl$eR2|QSk+xvCAnzvii7Lk%wF(y?dzHc-%MMp
z>V7@^G56B7-?#sHG%uT&<1~M+{G7w~?yORG|8lSGU<;l4g}uuESh(x7w7FGE4$)Pg
z-d#Vxe1l2Jo6d%~+rqmK{aio4pO5eG;m4bsx2wCi*Il2Nrg`J#g7jUbVUF9se*g0L
z=Rw042hPQYiT>O0k=g2?$BR4aEwPsuFTQ{7`j_Y5Cw6}ePp{&v;5|5>|K3%R^-t{`
zv)|;4Tei;go-MF%^E)T@Fxd$0HOcL&CE5M<^Xn|x6|Jhb1TMNg@#DK=ej(Q{=!VEQ
z%@mj?UvE)mvS?<HVY$+-wmhM~?UPJ<^{rRQ@ZCIg`1|qvgOXJyY(c+&tUI~FdZ)~v
z`<|QkB(73E%e80fv&oA$*Uy_PU;AR!^{rC%Q<CP32G(6&87%W@;?an`{)>e@O-s0E
z_dn#<xXj<LE-Nzs&9WmbFO-W7Po~MPoVm5|-IFiV+drRKvG&Z0bJ~)}-gt%Sep)9h
za3OnFVOhz)r<eKPpON9e*7N_<bidlb1N}NOo94c3UNP&R#->T^6Q}+W*t9BXw{<AT
zpXQFL0|G){_?2EWI(uB`_YIRPSLS#iH*<=~?q2n~VO)&27G1ZS_wVtK4<C8%?wQf}
z^VG42Hr|i5UZ=&FX>GkwUsv+2LN4K4`CVth%$FW}BA-ueUD$ES^V-=3A`5iS{Hgiy
z@xvGA)z!bOHIDvWn%5%qMA>*<3hUlUwy)l_%`}ypy+=zbKG~)5;n`D1{VrYAFAw`u
zcqHyrKELX=bw89lb*<gpq^H)&Ow62Cx;go+m3^O!&-Gnzp6Qxo|IIKuTxhay(VOe<
z7leh?<t*CW&Uvk!LrzTYN3%1t=wgOz%(@L}YwM?TD(D@0?_$E9yLifbwmpA~YKkP}
z=FMT)_(Mth^ULX*l|Qb@oxu~Lemp;X(WCQq?97iUkIztO&w2gtWBa??{4ziIg%78m
za|&~*xU)Js{R>xa?XTy{7k_y1`QXjz=iU2LEOZOlC#M||;qh)eX*PG)gH_+(&vM&-
z(bs&R@B`)S>$lr)*KP05|8qCr#zfR{spW?$ZHxQc&*`wwd-mZ!BkB^YJFF7lSQQu;
zUX|ltf|Z<`n4JnfjN)(cZL>}LpRYe)Y3{sg;!Bmc)!)yBr_Rf^Ub(z;?#8*_?pnyn
zxjKp^bv^lbc-pzI|NoVVGjL8=kh8tEw%mC6nIl4;I%3^_4<&7^Id{%Z?$7ye)q<b5
zJh|;|JTELsuVUlrZ=W>cKD@nt@O1k5n|0IHa~E!1apU#$_51GC{r&V+yKLWsH_ZB*
zr=0!4>%Xanvp4eS;-{O_KPyFVGMIBcH1>l*O47`9*Q1L}&aPS^6dAQDy(u%KsP=b3
z=trgANzC&;iv)CDPrg=XA9K{^__k+9KbM~CU#uE_p-EL~O2<kz%~K!3mTZ2rO~yNg
zS3|z?BjYiRAiK2G(2g%!f~q|7RZmy1>UgBpb4p-+=8KO;yYe>N{m)>}7jCm|^%{xO
z^PgYns_*HV^jh1k{!^!p_aj%8ONHDIbj}qWU_2ok-+skiLNvUgkWoV2JSNt8%7gkH
zN40lo>K|fAuZfD!6frG3t+KmnS*JsNgBByxn(i6XKYg@WCC0YV?vVf8w7BJktUIRt
zays~R`<k6$dat}xeucA!?ABeh=jYyYjmvbjZvNbyo^<Y9^XL6_Hay?=+u!;B@Wqe2
z?~K{zJD!?%+2U+^MU`@wj;h&ZnagpnY$VfP#>BjQe#J(9>E|;weoGD%R33czpJ4;5
z(_;~ZOS6=&hyP}I(QtmDZPD$`>4id5m%0cs{(8<>^x(~&bHa9$7DuIRwtA>|Y5Sel
z#{KMSyBOqlFWFu6tV?Hg*~E`8qC$?GbKm^b$UC;d$0Vxq!*8P{0aboX-o1N-9z4sQ
zb~cjrItR-~rvu;ej10AJD(!OA3X#;dOgi=~@}SF72Hn?7gbX6WI478^1u+FP2~Kem
zc<C!Pc@BG#$c@!ck{Cs9o4UMzWMiTDvtv?s+mh+ibCPTx%cpBB{_)>q;Rj`XuZ$&6
zrd@EBnWiLqx@u)xiL(5wMFOi{UugfH_Nnwk@A8IIVc|AUU0IA`AN^RJbhc*SnboGH
zlhWS)4dmZ&vE-1RP5zlZ$rI~3Kb&43vPPoJK%7(m<Ej2dYZkZ64gKnq^5&}dm9_eN
zy_sL-hAEhDE11YCRir5GVDB+4{Yu8M=REUycZONjot*r0hVE(YM_UAM*FC<pVv_R*
z=1l?OD_=|2zuOvqQ<jM@XvU}N1)M9o*Z8IHe#2L_>$@A9m3KgCmz70<Q^y5{lB&B^
zCd?-urv|LmI^W<d70Gz&)2bXsNvDg<6@{4#C$)PS1g^}!bzy4Q4hQdr3d(y7XE(9!
z*(0-9;+ey<Ew_Hm>Fj%4)_u1)p=FLl*pkXvO&N(KSEK2=m0KP5J@Y)-8}^(#(Cci^
zn`-SzEsa~FH*2zYx3+bhzj5#O=flCQ(IHF{JsnvNhFj!3YCA8*UE&blVZyy&`mPl7
zK*dFx0&JP=Mi#+Ic?UMCcOMPx>ToffF<oe0{D&s?w~yTpzu%Olcr^5q+@GeIj!B*(
zE}CnVmc|%;uwyZ>y|{vB*XK11rE0qwf1WqHe=Oo|vD}3a>9=n^&7c3?eR#Y2^7g-+
z=F4v~v<Tmuon+MBtGQwMmmg2=%(-?y+wJzTV@qC{MfC*!kGOm*%hG$VP5N?~sdnZC
zDF+mv%s;b0+AQ|_7v@*h%uIHw?|02S?_hkSlf$`HQpvNTG5Y2%?cHaL=ZG7yU*G=X
zv*K>qjvbR~O61-w%}zM3;<f(Oi!T0^{|z5;?MsYp;`Q338Nl(9{ns{zjuX8f9^B@T
z=+0>N^?9_1`7-}5g-K^P;v89Qmi<=Ij<{y|%h^}@(!XDvi>5uDv*7FQ967e@{`Oq|
zEWYw>-p~1TnP%Or)3>h8G-uqV62owA(fg$jO70XaSSGWEcLn#E8NCYUxa_)DX=KQ8
zEZgdlCdM%3OgwAR#Dh_X<YYLy8kX<)B9Zik`;pCYdk1-gO3k{n%i@#%mT&!}rz`Mx
zXM#S%wXQ!?MOWo67G5xY&yvEd#INq=43Y6WYtlYkxR-Nm(M=zZXC^z?t8{+c&t^Pg
zV7W+AF6nW?^5Y6jPc{`;_;^R;HTAfQa$4DP$b>I{^xpLTfjth@sftUcZg}74maDG7
zvFC%kqw?dwOIN&~IQ>ztPUUr`dt9Gg>LqW^Sh$a&<wJk1^Mj<4D9KAXeE-z9Y**PC
z^fzDd|E8H5r*tD?8B8yznyWP?Z1bKdFz-!4fn@V#N&OFfHz$jfToF$74NHtuKN+>F
zp;vWV)xzk+>z}sGI>b=N7N^IPoY2S=6(QCCQe5uvoiGl$9QB&yX?t}9d%i_R=skMf
zve<Q!lIOFP4+`1b5>G6dJ6~o_!%bZe(@(QCRyI~S+`pZ{D-*itX~5~pe_hp*<Z8aZ
zeDSxjc~@|wHm`QngXo@%k%w6OmY#~ZypchBsk4~E{!G(_(w}~x5Ha|2N>}BH&JWq8
z9DLRZ=F{hyHy>Z*w5}w?{?ujjDl?gX4SR*R1g!ad;PtE2tmUrz*PC^FG}xBunlLP#
z*qb~lmR02Gi~Ez!Zah-hp)^;QYX-yp1dC(yBz7t1zu0N$WWLYW+?4&F$5|$wjjJXs
z;Z|L|lczXKqpQNxP^KZTb=n`ll#|z^4rV{LyO;5V;c_qE&sWn-UrI-Cir*8zyK~PK
zwwv?jFK?bHu_Uljlc)DfK~6%(Ci|u0#Y=P*o^z;_XU;hzYN&JM;!D@{YO^PqYenvl
znJyY{#1g5aS@y73=F*yi{C(Sv=ed70oz-KuE1^nllE&Qh3(Kl)SBfr(Ii=;5{H}c7
za*L-YOoOJ&RN8;|nj3cJ#<b0!b+@f?>|LC{zQV+yz;I4^z{P)Db1p7o`@XSIOYZbF
zUYUf~Wo%!q9)=$bbC}Z*uW{nk>sqZBK9x5YuI7J`W#r~RC0AMFhF~EpZ;e?(;~E|f
zG4)d!QNLCTTBe=7sz1}i_jBVN(Nhc7U31e;-oaJjUh*R9_~~hrqz)|NkU05$8~-=^
zH-8Hx>MSgOeEDbaXGi(JzekewXM7j;f3#ph&mA}QmezEoX(@h(b~3#7|8?4ZecBpB
ziE^Hh)iw*h#;i%Xae2G!N{7tmP3z@%En90UeebxKtm^v~{@LycmIwRZ`W}>h+ri*D
z-9&$y97p<wWo?=BKF0JeS6|kZea7L?4AWB=A~eNp^sjgo8fck)-#69Gf@f(L&qL`l
znYQm~3VGpw8SE#n*}QM%hNgZ0;_mJLxF%xZ(zQ>kLKkN4%+$K{u;a?M8&Xg1SxuSL
zu<oFVmg||2n*E{cqLoiCZONS3`BUc3#x1XoCps!NDe4!?HP28CFy`T&cWTzNi(G{p
zD{4!*>jQ)gwlN*)Ikjf4rwP}oujbQMoxd6VVY+tLuS;A?P4Ze?x4-?^aP%!}-bJs4
z1z&VSn>n)9xI68B!~giGTXmMpvgl3CJ5L|}&#k`VrNjGD(+6K!r7Lb<d;0v=?UaKD
zA09vaxcTtozx(+T9=)*Nq3d$Aw)ts>J@ZW$;ev?LIp$i2IS${yTiy61H9nxBdHFtx
zjplEbhFp(hsoR&nPDZu5QSMZsq1s#Tn}G+dcJO{NQgg3bed(oiBUfJg)l>P!pAT_c
zePm>Q)7?4k-MY>99=+!%m{Ad1ar^y&T*2uV!mAfspSf)Hwq@=|=3j5F&PX-=cfR{k
z=ws7k8*-*He~g}yyj8Yg_oNkB8SV?*FZ|u5F!!R@t=teP?#u5S1li4I?l|@{B5<C;
z#cXTVuSI`zI@-T{@`{o!v0a~XV(t49q4aIFcRQ=gv=3M_R2@8TG5cT_&+&ryyz3@D
zyLWQ==ey@$$_D-VSKRfV&)@$eSJ2#b71Ms*RgdPl(s^m?Ma#g6=ieOQ75u<&%cK>3
zHP7uK`;`@cr<}a{<+yv#t%)Aydp8IF@94WQ>#1v7@wz!}M^g7EWZt-`9@Lz5nPu1O
zWLJe#F$~;OI=GSr?yYODubY&6puKOg)MtrRY33zi9nu@*_ZS_1&nr32a%VLo<Cm%V
z;h*k&xFZzZb$8?O=Q)9)l{<HDE@t%!@;AJ;!`V_`iNMqAvVqe~^~?W#`E~w2&%&UB
zR_}*z|NRj^U#4We;>=_Yx7KJU-x(X%EH}C_P3XY2+taS=#~ODW+{QNLXy2)71*>hd
zMI<(BE)EIFe!BbM+tk<Ei5%T4B$yHooJnJ!{4r`R=YiVyhacWNS@`4IiysO$ww9La
z;n%;M&pqKdH(BLsy;8+XpZR~k^6X}Kq4!}0-$CxD#`oV9J%}_ulznGIm_UX=_};4*
z*Dn+fdahGbUs85&so;FeOCmYnxjz1F`VqGv=)136w)=&Nel<$v+h6uQyCj%uByc%f
z`oQV`hsq-44lHUg<2j`D`7=Y<o$fUT&yT%XFn4a=cE`Dk(o@Pzc@EDpeSPg%<>EIJ
z`obT~nYZ`y-}hJFNNm(l?ria?P+BHY)nFgLKP>*=XX&r0s`^v83xYN568+^ZeT^cQ
z?)JX?t#RF&tqGyFT@wXg>t_7CzwF|TXJ-`79{FQf_QTBM=SgMPfK&I6p7xd&=*@8Y
z-_L&B)UbX_zvPr{YYdWa-+t44CnqG+#LM9Uv)dk?GmSIZ_VT;^;x|e?@ke0BG_HQe
zrVfsn1J_v13l?s)UuLV;bMx>-4~Z>1&3F2*{Oy!~{(pI=W`ki~dHSWzKi;d|)bZ$&
z+T(cP{Xe6qsgLAqE~WjwFllPuxf7}GiVGdwHoshL{&4NtiV){yF_y-Ka#ekuPMZ#;
z*&XW*@Lc2OIO*=Ay8eYF4eQUIbGLo|^vN56+O51F-1jRgE?KwXWP|iR{{E}i%uJ>&
z=Q(<#L8*p~$!@Q0LGyE6Z^JaV3(Je$*Rqz+Ojr3-*|$+G>oZR}|9&&!8=uR(zv-5J
zNn7*p-2?&C{cnzP^G!IWGV#7g-XD{$Pfl$+bz(L2x6W=^H~Y$7^CAfo?GtGq8wx7c
z{W!RUd*Zb}k?+@){W%#g%DSS3=h`mA)F;bS{k<EHZQL)%(y-&ntQ!#-D+LzUaaT|O
ztvlh<ySP=lCWhtTjZR+Lvq^ULbUk^7otL@`voFP3KdAL6y7_p$UR-RM+3DNQijFX|
zgfTT5zF}u^75eL=<=?P+###2MyFTm2)qFOt`THu}XrEB6q{ZSnj@`0L*^coh_Eb&r
zPw-^lKhtmO-m8f#zuxbZH4k>>dUbBQ#pV2cw+dafulQ{<^}FabC!2@wkLn!W<{Ju3
ztKKsEE;Wq!dZTBONrN==27cGjN1yJiA2lm-KJx9lTebPAtR>5&HfyL9%5Bd6(Cfy0
z_?rCW$Fi4y9AM$|ySq60l*YyLOH|$Y#42_*{qj|RS}43J)9A?I&juFk&RNT^el>Ng
zNxWOGoVKB3dFj?3=apwHgud;&o*$9NV-m$tzSZsV#HKs77os!%?&$Vpn0}~$uc$)f
zQnSRN`(N~Tb(CCvIeFs2(!%1vNyblJo@MS%TxjF9b-(KNE=>kU>%)J41lSj`=B7`Q
z-8*-s$3bnU9mlSopZ{``b9u7L=cMxAvrqRroMv3{lsV!5;>pXdU1*us{^*kJ!Y*O<
zWg8BsU1R#y>iO+{%f*n}@n@ueRL;`-_4dn!!&WB@H!Xj$;Gkggrs6ZtSRb@({2cdg
z#jEI_Uv@-Wc6UX;xNtF0+F(|7xyhN|3mSQhF2(hJx>Ni^y<fSt@tWzb#`+l>^k?fP
zJU*Jk@O45NyP*Bm=NtD3dfrf;wPLdVJ^f7=mo1rjeC3A4Wgn;Cd(qR<m&H^hy!CMN
z;$Z9irJ2pwj>xp`yLdLLl4JLGhr3hxsy}E8Oi#M2_xVE_$Mlag1TJMv)J=>$TQ+04
z7|)N;x2LAhTk4*ov$1u<;U{wYDqAa7<*)tJu-+i@?$MR!7<qN3_Wo(S_i4vuuLRv$
z^^={slb_wY`(CY8USN_A)0El4_FIHipSz?vJo2f$ecR&UZLVVeiKhLX3hrBORz$`=
z<m8aQBCpRQe$!{~pUi`o>x2WDraufj;G^Cm#&mhI!P8Lrehp4n<`B7s+g9wbIiqTQ
zRJfC&);DtFFB#VZ=QK__H2t&sp;nREkXf$yXRZCczdOpS_M0wxX0Tb(r+6O2BHvvr
zJIiLrWWCd@_nWwfRWAInFvqc-tL#O-tIbrcnzG^9&LejZv(4N2>#f?=Edm~Ve=okc
zKT}-RrSAKg?r$~|3eULSKjK{>rn;Qh?4_xNpRr|7&%e2qAEQ&^VsgCZGuWs6eo*oL
z@I#lVL%lo2#6RfdotWdxvt%~Qu0DP5kLAXv3l@Bq=l4I~=hvrRF6;f#K<l@<yxp$A
zoe_=siMwX;vd7sq2sYSS-?z5Ewf(_7nQGq<SGJv3@66d#`#P89#%bS;`Q?+hue~yZ
z_ibBnn%t{3^&d)tC)a&DYoDFhdrkY>%RBpS{Ly}P{Y!Ah1@^#Chn76}r=5B=$797y
z&LeGWq;|`(RyoQxpNN;P{Buq7)2a`<xzD)I`>?^fKy9Oks|Np)mzVj(|61&|nW1{=
zb^E-FKi8kt)O;R%N&BF%|9bX0KhM3?^189;vP;**4?1RFol6-{IEEf?zIEAM{`<H3
z8`b3!`)q%f+_98NS#Wc<>j(40THF_tk5^1!TwEV>fGI6lJg@!L8&MDKM{i!N-W<8E
z+S<-?x^0_0-}!S7x~|Wz56Ri9$0j1{DP*IQ^zM7!qvMye_s-d*b1S%}_s+e^uQK`M
zJvoo5KZ~4{vi*g|DNoj!C03_*tiSScYW0icBgs5nOS&d?+E{<!;4`~&B;R=3#@n~k
z<@PUJ8W<L@n=<WA`udb(*H(M=W|jCP^ln!^B+Yj+!p410-<A(m-s}+}C$FyYxn{(b
z_kg{=-L>R5%eLTmy*DR6GT}XQFd=Q0^_QjdTXxFS=p0xqz4Lu;?Y9}WYx*N2b62m?
z*lgr{z;0^LibO%pybl(NQU;X{QuCTwgO)oqMP55N{iM4^_?PhcI~lWMj~+Y`p=PF@
z9CiKvny8Hz-@D%rKgT{lGX173yIbL}by*TBqAvscwyn`q3HA2U@?*cg`|`pM5|%xC
zW!G)JV;Z?<g}$R`TanA===*!;O0*}j%O9FByN~_dyH)yfkJv9Ts<N`wvt^xpSG{|;
z(Uo_6%Ob!1kJaUlj+pZ6O=JDXo5eZWw<cFMD%w~*yRtos|4dANa%8=gpP<gd+kcXd
zh^B=m?%ex#S!87T$(-G5u0=2|JZls9r8*($AfKD-sl3pdWe1w9BSdn#u8ORxxESW=
zr1K<Zb7pMf6$bVlOO`U&di`3bx3l(;+zl4(h%bFy(xMCXeovdvv?sZ2bLUg0h&H{s
z6Rnf>zK%azbs)se<6goM#e1)MrcUEG-+R<~x>DZlV(!aKN4}SG>OF|mdCHbiaW6gn
z{qM-RXO<ikTzQA(iMG$KshbybYk9_*Glv-6xp)8D(evLO=1J?+s-1T5G|r9AFqON>
z+m~+8QCq%oQu@Q$rJ3zw)4#tvHs7n8-?9B+;QOaS?FQ1TCxo>wEpbp6k8If~p}N72
zqbG*{z|kwZg&xZ^pO(DN<$aN`YuaPph83BdyEZWdJ?rdnox0}i4N1{`GprezCu+QQ
zd-iC{lVew<Ev=+EuG+m@{bNtMOOO7Qt#@O0R=+zLvty$4yg3$HMw8RFpEYA&H6?1Q
zf9BWrTRau@U+%uV_wwSynaPo>>~k4J6$+L2-<DWi$>ro1G|O~KNw9C^>Pbh7X5P9G
z{b1w2IOz#&$IJFg7X50t%KoBf{WON|#H~TMOJ7uH6@*$!e099dbk^!K<6(ONSM$Ul
z8~v_a{P^#;KYRNQ-{NPz8K*CV=@{GnU%G*x@4lR@{M_dLXKZsjR(|_g$N8gerqqMG
z4J?@|I+3Cq*H+HW+qk#iJ$Z|#L9wC!3y<$xZGQF~U43eYK=6cpd=fL`!o)X8E!B%#
z%JM<GdAamC-W!t7W2<-kox&_pU-$L7eQwr#m&*xp3+~6og-6Pz9KFgn!MN2l_;YzQ
zbM@D=ryV0)!n5=yFBP*nSuS)Yb9GsOaFf*SiF0HwHAyvy8~8{(UKFKvexuH@-Ur)z
ze)?+Iop*^cUHZ@B?Y5pO;r)tt8SOv*(F*Ch|MdEcsA<1yYJ=}wdOu%RrQr02E&(OE
z#GRjC1m<sNT-;Zvf7Jd5kKSq3s$y@p6rmlB6?b;aMw~r!?(XMfv7zj1MfI2^ldoO4
zy<A^PBX55}!D31NqU{EE=PLcOy1l6Sz2)uh<OzbI&o3H$i{x3|?Qwd-8iV%0T|uv1
z*mY*w&01r9O>VB9(X5PPCzzF!r(F%b-N-C;?B&6_Y~f$#rs4Ik+x>s@TovTn>f!pB
zwXNIp@YN{gs249<rEW|-R<$EZ*5h2`hc@Fj)9>5*--T^p$=tFa=(WTHSJ6M+Nin{D
zESz(S?{RN&p6vTH`LF)td0uAb%}HlCFS;&D>6Lsvse0#SM|lf=Lr$r$Mt4pq-Q`w)
z%ON6QurfX5Rl}vJt=fyr1+*GZeDsN0<F4fV=I*s?yZrM?x99b1>D>xD&&*RTx9PCs
zh6cHljRq<0-#m`bO`5<y`~B+5gpe82R^>f(<Vjh@etX~b%Zak8JDtmlw!UR^{`h&0
z?7bDXzozN+ny>BFl1a~XbuK%7^29kKEuNeGr*nF4<#mKy%y~1*J^SjV>ru-d%iO)o
z?%a6r-|^tC#qUoVhwjhoT(>ChiP^>zx=%mnKGafTFHiY9#jn0c=;FFLj=Yb)Ihm*3
z6xm#|uGn$)v>hk&k8U~Fz{1;o=*(<Qwp9y1n&?em7qrCU&Z_AlENsix$6S~-(W`CS
zFT3ES*Dhs0Ua<P%KB?4TmGh^RgyvTFcD)c`QTDdU(>k#=b49AYwYvxR|0ydbcP-%0
zPkeAZDj~b<@>By6vmFl(9bcxvTa<NYtJcvB746@Vyc#Cl*VhVsaB#`IAYT#T;!@@O
zX6c%{cmG~q%4Gjvf0CoDy@IUtOS`oF0Tmw>|47krGk?Gr5&FK$bG=DA|Lx3;7yaxT
ztG-m8SYt1lu)BVdO3Eac(=T<BR-e7u$t=Ho&DQ8+)2^(kTdR@#qh#BzDQ1`DS`Kq=
zyso-!QT3X~7hfHi_n771qFoI8uG)02vpVS#v42h2Q~An6(^tL73uc|X#P#aIDV+aB
zb``zIE<Gm6|9o|K+R9by*v#i`doS7RbG7e$dvEg#^X+YY7wqnN7gf7+N#Fc(&aH66
z*A4Y5`q9gyWBcmM|Cz64$#Gcr`hL~fFFwH=R{HM9TIE)|rO(8Kf5n>!<;yEpe(Bt~
zsW^1{84bm!UmICYXII*ZJkEZ~ay{Zl9Z$k4gWb#KyGb(4e1B_;se%4Rt;LrLq{{#D
zar@Y2o?myf+3>aHDygX<*RPz3n|9UaDdX+dbv3)L%4L=W9h-SD&FiXWe42UD)fHN8
ziLdO$q(j%~<gIw%wXIUNY2vHv9z47O+vZ68eZRu?VeKB}?7O#pUmTgg`DAoeeZ$V|
z<PxI^3v=uOm!C*Irq))|?H-`By6Lrw;w!t3QwHa~HXi!q_ehI%vs_Tio{-OZ0k1V!
zPls%6o!5ILdg82)t=o24_(?Bi-!$cZSzg(S#(w{p_l5^e`XW1S%k8_~c9-e$b>0n+
zR;PcGx;DAnxU0rzMtJz=xBov`H3t^Y>`CQ%9UZwQ!jS3d_SI{v>z5QaoNQ0|t;-p*
z?b8hgpWELr&0a87P&DrT@dM6}10K(dIPfj#*y5tQC1=7fPP(_FaVGPQYleSIWrJ>-
zzs`~VKC}1ZPo~baH&XWL&m|WZFWaKMsEyBV-ba>a2B}k+E`M>{af0{2l;E&tjpG_J
z5;=iKj|ARt3^ZccI(6aGdBJ`4Q&vuDkF^(*4Ez4ISs~&5_rCkJx2nr4+GdL>x1DTB
zxqItx(RJ>WS)b0H)_7kK)Vw$F#H>dJt55rFxV27TEqD6t+%>DZUgX}0-Qlv~<-AF(
z{r-LYXN9h*Z7$#bY1_7KG9RvR`#bGz`55|-<@e*eb9E{f>fO12+s=1ghmW+~^O~8`
zOZFMhYt3`_jZ@FgvY(YK**mMobxKUKiAt`YYTBO1i$Cu;BQZ_sE<>(r*`*V!^W3*t
z$DKPA(Q?Z8v+0@)u6d=soG04!USD5UAgQCAKPhKwwf%<bDTn?>96z&DK4>}XY^m;N
z-3$U-^uFbX?h=S_*!4N6;a;ov_Iw51gzE;|cYJ%Zt9Ane=abV+%XvdqU9rs6R{ZWA
zqmY|;C}FB{Lv;In7UlkrHk)r9xW#RH-(jnd^7W*{UK`4<+>Khglk19<-8#SC4MiX3
zeB`k0Nt2$IwY+aDL#D&tL}_KW>n`k)Q+I!vx+&@K`^FRN*FQOT?Sb;Ur4w>mGA|w8
z@Um5@;A`iCrz_7SZZNpUVY5QOdkug88Q$HJc^dbFHovY)o~~&wc0A*{=emwvr3cy1
z_kNjF@Uhr<!m-G>0P(p=c}9xg+4q%Q313*~x^%CZjMo2U+jAO%Kf3C6zgT9t_r<pd
z-e;M<2~Rh_)YB>1U$9<8cW3rv)mZQ2ER&VLoZfn&W%c{ps(ifh${TEB^Z&ETsGbx$
zxy#=1{6$fQ=|Rh^^scVdb`!nN^>p*|2PYP?_eUzPO22cX^uQs--d?BbEidOUec;c@
z;-Kldea^I<r`Nc+XEDaA-0h9$Tr+!d%kASzaUNO=&!m>FTpY5aK-FJeD@Hm#Fy^Yo
zzjxU=v(#gx^F3lDEDLNO>C9d3!?!%($}G1E0i)m&{ih7;yE1OwK0VE#@c3PiO&8oB
zU(|n)n!4|aL;aRh7uy~3bk?SMKHZ?Bp>XZ;+8}8i-#+h>x%Dj%D>d7s>XZ6RE(hHH
z{8wbXi{@eH{Dh=C?+;W<UtE>{z0v#=&r4<H?`Jj~?QP9JQ{dfkcKzE7UC;lzp_fh<
z?AOe=UbFk*`(Jen_-u7sGx<)Yv35Ri4W7EUQq$r4RE4heUHN)BD?5IE5m~cz?TL5Q
z!DhVAuJ4k)tE}ZF{J?D0?qv53ZCa`2ah~d0R@a!i&gb86S1>)WZk2bHT+Jb)re_ml
zKRvOUdPYw*Qd@R4!%<eI=F=Z}MfWf8Pw_2T$vFAm!3mqSPWNl+6(_!#HdiFr=1kLu
zgqwTr&O7{G?dYDX<zAl+V-8j>S+M%{nH!NxPgj*H_{ikx#eC(Ra`_e0l<Vgv+UAv*
za4%W%rfahZ%Mo5(X5YW>Hl05<!LGWfS~>Ul;VII^?VoGzuMO8(Zqt!wEHBx3E@{7+
z_ld7(YPPq=?R_CGvr0s}>)WeW3$GmcP#pf?`aiUb_2hqtA4*|iU?}3jf3aS2eqvEk
zVr8*jLFL&n-~7jB0()PF^O&*UT(M@^%cZ6h7OkAL!|~cpk&g?xl?5^~RW?uan7U+=
zl<WWM_FtP)DmOd&UsY^8^0O*GO|F*BzyJFF^LC#&T94g~?K$+JW$~=Tp$8Y~p40nN
z{G5j=@{Oqfb~e3p`+wKD)z`IL6-(@l;_CRwY8?6G2@hN3JB!XqmMw`vvw{*On9g&r
z<S|fOlGx_GP<HvxX;YMpg3@;VP58ztu4%x#T5ZDqM5)^n*CQ4zuv+|A=xo@rTZ{j&
zDGR$9=~uL!YF@tAY=*qfY=gjaWwCP-JoS|)TZLphi@b^G+GVLzmZ{=;=<>Heh11!t
zwg=8>5!Be4&pZ3N!Fq4C51ecMTz!6gw!x3DYCHB<N1Tyeu>4z_@^|MStXv^I=c=yR
zb&0QAvf@X+O&;I;U(<HJ4L@eS_U5FjGpuaUp280-&YgE}_4_Ax@vZ$m{U(3@?d9D0
zcew2%;_lv`V^#6%&z4=0|BOqMd=w`6Xl~=5og>U-z`i|v^Xt%1dHc?g#JK4`-<luo
zf3UGSRqJZ8((hUBX={0XkDuBv^!xecZ@hW0KTOQtEXP<m@6em&->%qRl=!~$Wy+D{
z9X9jMcHT}Xw^g_jCqIc@Z?ELh7VEFUCW`&)m$kx<xSUB&`w(#B<&`M~f8T`InIx8S
zPJgg0@X0yrJ?S4hW14sI@y0YS3_Z8h?8*$A<%~C-R~qJ>*r0kSH&((V?!&3GVq%UL
zSeKUM_iz<l477f5_t>(no1SNzC!O>O;#t)7V&i(<nSY-<w4LXgU3kf}Bi<m@;<TE2
zb#+p-?d&}-U2L`FQhb)E=Kg)UP&)W|?wqSv>IIc|?%3ILnrADwO2f4cGfxN3{rbH$
zJ>UA(x7()kg>@IEW<2;k-@|f}L;j4DwdVTjmMg{osc62}+_rL2eC+yJW}BUMCAjD>
zxa{?9SG0-u!-)?jTymAXEaeudc0By}7QNqx+xf5l&&!_SlyEmHX3qTo44g*QcYmI{
z5#+7ZIQdu9!?PE>WZquqPH(7}3~5SrShYsN^IyxhSF`Knmu(H&o9AioaA}oR##NWY
z@~XLSmpzHhnRzWW@Z>KQ1$X{;b&;3ky{1-vDA+pV*Wp7&w;uCe`gHozy*EZ1%k`Rd
z?|$BVChleI>Bd|S%TDWEJ5R3Tntby5v8<mJ?y@IVR5GtxbD>>P{7%b5m*i<7vN@vv
zBHrH*c;!_nuaa43?#MD_OUbM9kL{aowbd3^>`r)lPV>*^CtQ!SlJX*#6{aleEM0X?
zYE4Kdd*q6v_ZF?0vU~DxWySn$Pq*mZett&noSDgy1eJ_mic@aJ>xBF~u*U0(3TJL+
z*pIuBmo^kcTJJiayj*;i)NR*O_xkxJFF9#ldfYFjy;H~a&Y?Vh!`F=u%PzPTuw^H(
zUp*!7xcb;9gA;O`k1NDkl6pS=e*KciNUzK`&MIo#npf|`cgnC;GQZdPwckO`_we@p
zrW>9s-(Z$$TDnD8Swuxb!28M}(+fFlf9viy>lr9Dsug5rmivU4S2X{8UHYFJb)D0X
zj;@o_IT;vu<ro-1Cr;(27U$<Bm1gFo=%d`ZlboNImYH6XpP!>wP&qd;y7;!4Sl#vY
z4v*O<^&TmlQyY19#pcN4nO1L?&Fd{oGhQ{VO{2rjS4hX<*0riX_rJ?DC@@Ycn*7u!
zsgvQ{S8MYZJvIC4{=Yw}Z<D$-seAsnHEVu08t+tjuQlu5rlYPkcGk+%7g>4DyL;`)
zqd#YFA3gf>sPv|NsZZp6Iw!rkX?xl=^gv>eanzYKc1^BHD(%biRJ?@_b$gwdbzzf;
z>Drwdp}W=Z1s;9#>1y)X6wlA!*CeTSOp<%P<bTcA8JoDy@6x}1ysLH*Yxc^ctXxw*
z&sCjS%*w?$H=EI2$d&)h-#Jf|PT#2W3z_=aYN1hZanboDOlF>1U0q&gRTD+F*hIBW
z6`8rDbrTQ&o;&JmLRB)u-=^(e$*^tnx6LWvf@{}Q%oJR8V%OHbYiZX%)ZCw&^L6&w
zAB}4sf1Un%^^;GJuRc9*U;C@jQu)J{H4&BPmuhVFUsL%z{GDH1(}t-jAL@COHn7~8
zcW<G}+nuj>zX_VcK5uXO0$JzD=hHI%rYb%A8^v)v{o#$?i$%*U_f>s;6*PY`kAxPB
z^oE<aYv*Vd3Ha_*@4YllVdXOatONmRq3kO5-B}0jIX>B0aiBIK&-0|Lb(6SP(f5YD
z7F`jO^^GEjue&YzlhL!qrK{@?(~BD`qVgEuNol#rm>35!Eo*2y@c3B^E2DsVLCVUH
z{P9xE)s9*rJpUHu%wnrKCvj?lP7{x6>G9P|YCnHnQW3^=((TFzPDXBX^S%ai^Cu3K
zd=d9dZ*j2NGO2ed&UmHa^!{3gZmy^7vOxFu?{$_gFb`a0@JG~xJ^uBwN7WpUY;SfO
zZP;=m>ETLtkF1oLUAEruGVd9f><heD<0^c3dWgr#pd<V5{yY2UY+zB|##Dht{0xVG
zgwNH@*cW+x?&9q!u6CW1O09*zY}qcoedq3&<Lf;xWJ<pXy*^Wa(!!2wDd+jNoP7O6
zA!U*mV_w`uev^F1X(|P$7>{#>^ccSWFsIe%$N6V9AFu2F6VH!lpBN~vamX^x>6e$&
z(NBlxNK9?GGRGn_!IMdyndP%tK){RdHdmj`Jp8=;X`!{crS9goG<99(De{;1Fv^E-
z+4ncN*!}dmovT*P;90z5a^;*ehYuY2%Ooq}GEXe*P27>Ge=jggoE2Cs+F<+drP#R>
z;ul|JR4h=t!gAx6<EL4Y0k7VqoaKMGP;rJ+Z;)MK^Qoz8^%n|iwN>yl?`8Y;*4%Ax
zhQO)-=HI5x`}1xlPuQaMrN!)d^z@(y3C1sq@3UCSA4$7?%zEG4(&Z|@4?7u5{IbwG
z;mYO@^QF)4`ozOuv~=px+I>Ff+!o|@NA<kWH_pDyxOJXzb46w6y=CS?QERmyT${4X
zO}b;J&$D^64x6z3n&-}ZWBs0d=097vW-m?sFnx!Y&)jU*rXr5kYh715AD=MeRq#$f
z^icM@9^=<-PDg7RtC(+w+<PwOs_6H#ex~SBU!&M_%*$O<J~ppQkqtd@?0*U?i};e)
z${aCzUMun@EieANR472iYWs?31rPdtj?Or&+j>YUeS*m2rfV;AEmEf++J0EF#D<G&
zb|$OBo{cqHu{$_Scx;YqNgR<_>08xZD}HpwdZ`@g_ct1@ot^zdsZKh5Pu!lJ6~Cv?
z=A1oA>D-cxRUd4+mWo-ie7cykAv-7OZlP+x4WWj62hMfK`K*uin`^CF+<7!KTE6Pw
zvQszHmNV|}`ya~0Ir*|6<L$N2XM3l3$mK~!xqgpyZ7daK5<75D?55-AM^?*c2{Wce
zS*|TvAwBhait!oq+ZmhpyimS$A%5c4oEfk8XuZ3tbboD(s%`M$u(JoX_uS)qtncy3
zdh(T<%HFeQy(_x*nqAntbIAhETinYW8CyNK@2<0cY<HELYxkpuV}A4g*_X)NTJ>Jw
zjj><j^6&hc?prK4ICW!Vwh5c|q&fYDub&0zE3TM+kSl0TefDREy3Z!17wR58sJXHA
z$BX|bie5M_cyncYQvRmqq!1^OM}HLWu55l&;i-CEnPq3)_J17{4L3}bbax1F&N?n)
zc4w<vySAkJhDd#fp!^*vH%_m(F?E%G{<^{vOXoK~@)=KLNcA$;uT*X>Qi<w&y8Sly
zjkaayKX=>AS}tVjmuGOVsqli{WaE4br{!+)TZ(eiTXYK?FGu&q{F#?-SGz5~JZh1+
z_oo>bI?Za9a?XqBag*fG-jLoFas8oz)Nz#t&SPtj@yGM7z1qO??4Oxn`^5dRa{es8
zS8TTo^!Aaza(t2h{Fkdmh3XnCA5UIkzd$cMh)YB6x{p|lBJbZv*`hhQOHykdo>*|K
z?j75{oq7kCcx7(QIDGL;&5Wg=m8Yy(=Y2>}{L@^C3r4pKdDQs#?0b9p*PWid0xNG^
zpL}1MBmBj$*+~~PcwRWRS6y+;<Ly)3<U46kpZZq&(7Csg*M|S$$Ua|wvn0m-*R#S`
zNvrbZbvsXHm9Pn0stER0T;)o67sFGyTJ;v6_ug`GW4_hK8EO_Lfeu1y-<^}!>3DH0
zbb9Vkq1jv6Z_w~lM{fCvh2e!>!Dfl?9&c3bnYny-!tX5$&9a&w7R*;P&)+88X2-*O
z=eF68MjKo98HXR#yb$bCOJbQ{C#)8pZy@RNI3>6K<Bttl-)H~sddn}_tX4PS|K6L2
zwO{PIc|`5=(k?9z)s5E<CoE4eV4v|;!1<e%_PcjkA1?0m=9*esv*(@Yd#}gkOCP<D
z)KXd7y3$YjZ=L$5+85W^W?W=qW-ni|H8z?1(YBgjVeeQvGh4%j7N#+t;BNNc&vtR8
zK<V;3W}1HrcNxkWT1sS|46c4+{d3L1cq2A_*{BTyJdKae--$o^*8fG{!Rr?l)~~&3
zd@@3kEq<Nd<F`HncDC-ZIxGf3fB7EAzPMrCWwpZ6?&6XM@jq&hC-ppOyuM~(b;Rsd
zov+jU@+ao5-!{iD<mxY{)8|&7i(0=yGH1c^374|J-InKyS-Rk>yV^Y#tDFz#m#2%*
zzNDtb{4`*)THP0h^RZoO_p`ZE)}#n<_1I+2omU$D?aJLM+vEGE`Y$*rpug60?rXv9
zC-1KF&tX-%zvKIb|BpVTT)Vv|@qTG|?{eR)opMb_ADy)Rk)!-2pQ~Qf%lFrd8O<k!
zXLucW_4s$|v=!xn7P@8HAHNq*68rM5mHX@~J>x5Wc{6=p=f-YH{$-N;`}bk<Nn!4x
zn;)4(-d>sYpkDc{U+kOmh3xTuf6ra^O>q9rJV|!1EuUG7P<_-lW%qjN#jBTF`fZQP
zS?jj3wO^HO&fJ-0TYS~$+1@slbh+9u;Lq1pCFQ@@;Czaw)eFAGry3XEeKhOj=ZoIv
zi)J-#-|hZ8JgrrDRzjdw>r&pWk#|1ZhBWGB&k*`xkJ_?}p3*CMS%87zqy+=s+Z2;a
zQxf$GD)&ZL=ihb{`X4_(DO%oP)3gk0TalFv;?u3pneN!aDYJF2(=|bnt&<{ymz+|~
z<!;;e`|KIJ9jDtLZ)q29icl*rPfLIParVuRg1>(}{JLNL{iT-YP5$@RRm3fQJ!N|E
zw=8jW^O{deHnOrCyOXx-Uq0)5G;YqkTHD6|`%*VcpR0Sa=)}#g`ybcb$W1g_U9m^D
z_gd=4)W9w4R_}Tec;wRCbsE}Y&np9uhDJR}G6_0w7P;}teeZSqMV;zbf7@+xe?!EE
znK5PJ;pUOMu4LCW#ETv@xWd2vggDPDoAX`0Roi-4ulL7)mOY>N{^Y+;iVv+*3eMQQ
zb3MBKthQ<XQSEslRcahB&F&Q}<jg$u>+kLo%iHgNaBSP1wz=Tj?e^0z9<`tDuHXCj
z<^0Qn&Hb}ZeBQl9r)bi`S=BdfHo2=EEt{UUN2KabYn8#Gz|HZCwDn%CnRRt{&*tJK
zUH6}D{$Tr7=iIYJTH?vqDmUnK<rqq-M(VKaUJ+inxpKd5Z-Umz&Z>5w51~_z{#@o3
z$#8b(^fzVqW>j+iW%sV+E<3{VT<4t2!9}9+#}6!?sUqIIe1U1^ys*G0-1F8RKQrm{
zl*(xy2@h}o-f^cxGv`U^tdJd?cdo3i+0Sv~iS@VOiN%`9li~v1q61!<xG#M0=wVy<
z#IF`kjP6B&@&7o^d~tjA+|0i~N;Upy=pC8UccO|CpP4Utd-K)H12VcYXY*A`&vTqL
zH))<Ylcg%{S>x7?CetTZ^Q{u(t2<@E+Wo?iwf^ni%i3|({Z+pn-b!AnAeEN8?apSd
zKZlN<Umw3wa>eD`sMa@&EAPJWh$;GJapZ>Lmo>5n8RC99W|%l@O<61*C3&pv$j*P4
z<|s~Ne%!O|=&ExS?#1_(Hto|FQ}}qi*?Rqx`YSOCv$M9Xb$yoVp8voiz^QQG_tR2y
zUQe4X{Bj*f)PXgD#kVpdGo`gwdo1|vv&Z$pyt{(G>&{Q{?Y(K6zI)R8%9E>_QZwtk
z)0LK=S{&$d%x6jEp@*h2Dt~tG@6?`lU$t|~rBFs2-Lr>sCz*$C6}~)qa_Gbkfxe`v
zlSJnztp0M}<@NKF&}HQxn5Wx$I_{M_G&^gy>`7nWB7-ZPI~b=%_^M17{(0=G|G#$C
zD&^U&#vDg<{Tcd?exI`ALBZ)++f&T;EStE=xGsSEjcXr!o9Qi|I$akhLAOmC=P+Cn
z6e)eNJ)|Li)#uO)+iHw;yFQ05QTr*ITP&6tY1uwuPX8@qF2P5e3^e1q#JUfD{@arK
zU1Y`0ZDOL)O}FE_lvZm8?Bt!mZ2ssHL;9l|e*}-phaC+3)V21KP+9zx>ID1d#XBFb
zxM?x7qvc!P6!D{Pn_pe$uR9*1ci4ADn3y`h{{GH=KYzEhmGwvWDe*nj*fOC`|I(fB
zSGX3$WWNs#_AM*j(ziWxo4wB&XUC17ADBKrVtjD<d?j|FjjW5_Y<luB>wMnlM{;kc
zPFLwNl?Xll(aB-Gw#Z4_?+G(Z+ztd?n`L-=8UKUn`hI$S{r(xB*6Gx-Cr%a@44sv#
z^W1=`Bj<6npUZ*tl&@WnH!|EWoO$QS>7Lu|3bt$cq~hmj^Bg#^Kh<XYBeCCobH8#h
zX*_tOJMnu|pQ>@e<StY1D`~#2CQk1U^c}o){oa$ei(TI_u;nj%xXz(*+9clN9Baet
z%y<0J+_zSBwy5A5raLj$q~oQ;cr=m?nvTf?h1g4N*V!~R|D(W;2@cgxyqqE>ue><Z
zm>;>FShyhj$HP~j&OQzOQur<F+qa}A@4|meC@X~=QIm3;^mqz){Kn7xOw*&|?ux8t
z`&3%s%hq^Dqf>gBEpNGP=cfk?nLlwbJP=Eq=-({YIxS<*!t26n7cwuM2>dOX(B?M(
zaP+?Ry=<Q^A6>C|Z{73WqQ$*C4%EKll3L(bB7S?7#z$k_<#E6MuKFCsH}#!Fn~{Xo
z+f}_$N3Ka9RhqZl(fZrw#BTfRV((80#m>05<0h9(!mh);4V*We6cd)Ja)0pOTdaHg
zo`$7|>8ZO5e9bv-aV6xhtp4VH={=`M%1qxzP6G|botqMpjtife75+>%ia|nCDfnXK
zMfJ&@E{zO4Zvtltv<S+6Diz9X=?!8iVUc7y;8AUy-2QWcvzOa<JDCI)4Ks(rw~1!+
zucUVVT)z3N`|Nv;Nlu3(w$yTdmu9qJSl}=9=HfGnhC2Q5Q#+P4O_9l!2#Hhf>zJMz
z`0K#089!${?Vb7OKktFCyzC7&2cow0`MLXW)UPOuh~FStzHECB!=ht5wS~CV$_`g~
zKc0BD&3cPR)aC7uno5MHJ~<-6@^HgOw?~YYR;H(IE?2rf&Nv{do1-jyt;GGolOtPG
zOtf8mcW{}PeM>(X`!OZokAG97c~s7OM=#bLq5N}YU$j>5{Qfn%VE>2nI^O%|>xPIW
zoRr_7Qn0yqiC_iOf@N%h7u&-(%fI0fzMIx%aoqTwUekwi{!L68&)DDGO5_ZExKn$c
z3d1X{&b90IPL7(Q9y#%dq-x-V)b77xcO;(V%{Xn!w%GT(^RbQ7RC@!Yo^){=>|iYZ
zV#)O2*qlGv{z69Vhn5{UUj96N`NNxA#aTFR%jG7@UT7*~$kqDO#4<7d3}eK`wBL*L
zc-gaDPoMiQzRfprYrJpj&5kJ<tBR}4x9G*F&bu{p|LTjE%X;6Obf`U&XL(=qr@3Kx
z!;i2D-OXE)j$Cb8HOpWHOHT{edOjUS&IRg=E}FUd3stn_Pg$e=-A1>ZX;RGf%BGz7
zBav;pOyB3tJ5{s5GICFBQlF`6ecai29jkBBiDHd4hs3Q76jyGU)aNM}YQ+DmhM`d<
z`|N_pOlKb?PvVdN+4V}IWtV+^gsIM-MK;N-(_|GUYw*?S`QDk~!OVZ{p1W7*mMoh~
z=bN8DN;w|S>?2)ZAywCD<S6_{sQ>B3w!ro{=l_>>@bx}F;al@l=kWhc(h&?tp0AL2
zusdzqHOnx0?oCI1<yQZ?^SJS6e|v*cW!>9QBeqFtUzr=2IUmUdJ9<1xRMn|$i|e?j
zVD`Lglf>*j>@rbp@lkq~8SXr{W52naOKZ-1QWM5gc>Q<xir112-cy6-F~nrG*r|)G
z-g}m@rOj%M+mCM_^zK|P+@Lx$?8fD+d){9qub50-S6)^$Zyw9ilch1+Z*5rMb}DO5
z=d6243eP6}yuoZ}e<Z%H;{W5NKcBw(`+H{ZB^{}Z<`q6agufiy<Fr9VzR^uPI4_LB
zA<}JHeRU4o!>;aqs{GsjY~*;Pb19gk(C^T`p9b$-7Ua${m?QF2s>W4Sxz(gjb{gx<
znv6M29YRJyTi)s3ef9QKQmFcztCsZ)5{>f~Et#PxW$j*gs;cdtP(<<P3wQl41d7{o
z?qTpc;4!Oj!^XTIIqm~dTFTBlcb#1n#o%h>UA-mkT<vRzoch&<4;I}QJTIOrQNHHY
zRx$4tbqlKeHB!>u=Gpz=E6H5@EpqmjE8A}_)w0>5`jErvU3}ClVK4bEuB2T%{0~-}
zPZO;?xTv0a$IkP&4ouWk*rqhEu;)Sh_e+sk&u-M}ELpv6q4QDiGplY*EdDh0di}n)
zjq#-cE6;_M$Q+J-WOJ`*W`k)ducm|6$_AE?eAYf6>*EWTwq8B;SRpIt2lHLY7gbB*
ztNt%+Sj%vBtHrm&>znqk6jJ-?Z!2Arn$WuYpk;v#bFoLrH=EMmA63@77r14fYxGX}
zl_mDKsPgN_x4-94c>D9^liNoNAC#KxoqN_yqPFYn?mXG`vC4-Ql~+$)Q8mGHW%1vI
z6RYFvZm^x%8`6<jYA<$l_Z8oR_R~Z1UHN<jUVq4uRNww$=TGO*W0wlEr}->zexCI7
z+(Uuq%wC@~#jmbcZ;K0k7cI#7qI4z)r~R+LVwW8~ZXbO0%IwY**S(+5-?5BM$vCpI
z`SGpY8n1GeZV=s?{zYwH_NnBL+fMH5TKHN!EpMZM!Dn@)kI#jhW18z9rb%U;zL#0?
zD)QK;Elg%%&8C-+6|o(hvdjGtpJcp$wpky~GAW&Q)k^*KzBVkZIr0DR9-ft{;VTp(
z{=gw9p|0xP)vHyXHkE$gbk*zD^H`_K+9!t>?Ty&w9?kHqVd<4Sl@|j;|0pcwIC#<W
z*}b~O@w%*&xjuN$x%x+_oB#Y0&DUM(>MAEn!xmT+2R24*;3zuuE<fmund&AXonwX@
zqoeN}+b<q**?i8Stn}r}m%m$JvfOc>q-mh={zV5H=Ujc>`XWilP419;)YA){<+=|{
zU!?!G`L^Jm>_+V=P0O?GH#8hi3jLz-VO!<hoolw}Z9Sm8C~<1^o9UIS9xRlMdAv35
zzU<mvB3piPwB40fk_&soFsoebSlr}klNQh4aQy3Q`F*SpR~TPQK3So_Qc!T*z2{Wn
zyk16$uzQC#=f{<;etc|B)x_3MN5!7rvu>2zys0GVN7S<OE%RR6mx?a?I8TGcoqe6{
z#U1_v!NuVTe2+NOZ>=c$ubO<n?Zu*tBEPE^c9dORc&d1dQD^Klry!B4gEhaB1WVTc
zev_Tl+&_0|^xF)E(AjMURhMpyy1A|?zV_B4L$u9S=gxr}B0CS>UhTIz%<HJE?nk-B
zTUKq$OK)`)e&=}lZjjp>+dY4d%{F>}-Q@o-*0jz|7n$U35A-|VzI}P!m8V;xma%K{
zY@2srTIswl?cPp<O)s|Y*=yyueJV2tQ+L-J8S#i4OIN0sOwG_eIF&8k>CfUjA3Yap
zDjvN2zk5c*-tY44El)U}bOzluuwAa0aq88cK)c%c0#$Qo)y4mB*r;$uP5M*A5?^+v
zv~PKx0cP>M=6AMQH`i%rspXw;4CLxEO}*+6Zg7~p?Ptl+(4!)!FR4y9b=~Eu^QtSZ
z*|w2&tHz!{4aIZ9GlByD^W8{&!<X$lOCk4Wg89v~g&G;|p?gKt`>ra<pP#9<`9Vn~
zQ?Q~AbFG7>!Lpb4rx?%3xh?E(^nLSzWf7`d?@W}4<q5P~Bh7o+YeV?`{j7^`Y<{A4
z&isz3z}IIPdphRM`t{FV<!At}!9JUP8w+PAn{AJZKW2N^{8z7g(&wh5H!{m5S8pm)
ziQcLd^80hxO%eN)M(I~mOLljEef~09SM=|SSAOCb+?1a(YSr##yWw`9@A|y!ybrdW
z3pRbe^XDYKgYQ4oWXNZzI8RCK*5kAOVsP=@(z&PSSFCRdwz_!JAXjp?s0Z7b+ioiU
z?e6MYni2-w+yU+mcg46QtfV*#4%(X;H2BSEP5d!^`r+4_4q1g}xv_HJ?y4)f=6u)w
z*RlM~+0&ahUyN70p77<G?SfswnaV$}typ=wGnM_=;zy?Miyt!<NPM~G^1}7?m8)vA
z-X1Ps2``-0sp#VBwL+jgc=o&R|74ryz2yFWW8>CoryXal?`Hh8ZPzTWm4acPUBr~v
zp1J>4ar*L~o%{1P=&hAzn`9BcboGu!`%;P*E`8-4*z>?OWMAIY>%YI=S>)h!w;*k)
z-(i`9{0kS)nBQ|U$&S6PV%vGfxU8S)`a<)M?T}%)bm6s3z~L#{Ry-D0uCH`i{`-Q}
z_wQaWk4GGxF=_opyOM}y?l;nAJ8$YgI5*ENG<<K)#Ho$`>Hi{x7BFb-o|4MYx+Lh|
z*~xLAUVXa0di&<nFOGj-Utd@LQ*hyYW!t;A?NW>LFa6<d$eH+E?D4*XyE6CMx^La|
z{Y>OX>)CC8u1ZyG*qvyeH=pI+TwR&93+=0_<SrN;U+TP9*8M^C@}>K4hkKMS?@IBW
z73;d?<yN-xlMjz~P7D9D&u68@Z5GcNt%5=#jdg*i%MY8TGMreJcE@VD-c|dld{Ifi
zLMAP;ci;6$hcQ0#`Odpy@A#&gf6OUjUmnxq`hJDmfg9m(eT`ODPtFOyn=nnkJ~Fke
z*|hG9i1B`I=@$$CY46_oFL=}EYx9@){zIGTy4bu&dMXbC!&4Oo21PuVs-&crq$Y!I
zRaqNVnSbY)=>K~AqgUJ<jTUm8cH}DI-oByq#yZ{T6{*&ZyApOhDJWOcJNaqC9?>s%
ze^(bzIPBad6w;tu^yAsx=RNZ_`9D8yFS|$F@O*aN2eXHj%0UNLt5!$4eVit5!#_`V
z-loNi?t~|8&b{$Dz1?2MrvBTX39&hr){jdkZf=SHyhfw^#u+KOw_@E}w90gNE^o`!
zmTU8Qb81mm#FXc*!lsK(ygur*{;2D;j}hyB>g0ajq1naL|EgH+8rz1O)0OUTSdk_^
z%V9%bR$jsUn(T_H?l%qfEBP!R?LGhN`Q&^<{mzcP6~|`hPHec=zQ|Jdmd#6hNv?x^
zDlFn{K5AJR96Qc0kem2<aW3Q2pKs=bR~>z0VqF%wv2ly$ZVtUVJA2Oldvj#=R{wtZ
zwdml7#f_D9x~r6?Ynd>8^%hH!a&)|UkKwD#{8jvRzoT4JPYVC7<LbR-wEvmqdZn63
zk0s*qPBqolHIvL8elgk9om;r{^sbdP+uBqUI`$~?J{1rW+LC(g>U9N<u+@x0JL4UB
z6xdzDvX<YekUJWFu`T|McU<(5jgs2agS*%LInKE!O6QTzs%-A4$*W>d-)}l^y1vi#
zPQ@uP&nqt81&-cb#j_oc79G00;_R#{j`sgy0uR3BB{n?xYaMv~!wrLy?0HM=c0c;9
z>R9#W!F%R2T~>b&cr&n0HNGWOa>R<^*G*ARz9i-j@0@7f1-pK5UJ35V%{_Ma%0#`r
zd9KqEc3<m%P+H*K@m?n1@IY|kkqr;oxuk+tDK!ez9RIE!8XBUvuW}pLBc*($iPxQF
zMPA1zGOlDR+8Af$o9)NCW<}fUgw)0}Ejlc0Wx01Zn5wVpIMA|S*4h=3T1Mw)HMw4I
z^@!NhZ!G98`C`eQrYizffmz2J+|u_Pjc#F6=t(-Im?-viwix#l#`!x+8m5}KGrwRx
zx%Z(j$Jw?;-pljk-tI853n>r|ojvh?42%Bfzg}5K3@<*?*vp}<{{6ngg;Lo=uYUB@
zRoZ=i)6%r!X((swCoP9(PZTFr*0^$BN$H#Xc{2ZTb@{$JzWcR*RklCtGA(+t+M%!}
zmFGZ^5rbygj*sW=Np4Ynb13%fGTX#c6A~9bx$0-a>woAR|M!Krw9A#6ESJX2+s)rl
z_2wvd*^lt~e{X+_X1}?(Ys;paX1kt!;Gefy!}EcBL8n|l_g%&CK;4x;wmvWyX=CcN
z-qjR+B}6jwu-Pf$3SqmPhc<nad@GlpU$=P8(<QQtIWK;Yy|euL+vR6=J`3&L^Vpzb
z*$S<BA75*P&+1Kmd*csp-sz7`BB7egr==xVsYhgO2)ON0eC2YsUZEDBu-IDej%wvu
zy1!XZ9G<J?v;W3zt$*{wLToB^jJe8vA6?(m6W~;_ZM)#IhG^vwnUJ3?mKEB0hw21F
z0)9)DnXU0KO*_G~`bc1O@%=-t_N<F0yH1;Wz;Uh5jG&clZL2cOqYp?Z?Mumv-V$l#
z)OLnJs8gg*BYe-h9Ra#NSD!WN_I~@dVS=x-?oW654dE3D>CPfSS85Xa7jde#D}Ku9
zwRz}q?sL-~IaRI<m00ghYc$r~y5y$x$s$`=F6arL@9dyIHhcE#D{Y^9`sdumKc>B{
zJ)QIKNZP*;-hT^BW(3UcdeiT+Lpsbri(4r_ckkXaMvs0iTcMD$HFM?Ll^>62W*(Bv
zzS;4he#V5V4YPLM71q&|w~1zD+PXbYX~#tE=F8I!?oALZ;&7ZbN#S&7i4}9?juxG7
zCnS;>);#*pn!Vz6;lxk>yfYUUmhN5=@nO$A=XqC^t7c6*r?NF?r^l_83hy>pf3}%h
zU-fbKEXUGEyZ?z+|1Np@vr9I%v|1y?FmQV07XFnS3bj*0gjCiruPS}KKxFSE{!@x`
zcK9kq+5D>cb7_t0+ga24?DrdK&yHo>e(2U~<0^yIyx|h@@gL+Kn|anRIck1<x&5rI
zI=k;(y!HEg{JAr?)`@H>Df@SA&67Qylc$K;e|Yxd$CWkW9n)hyU(0_iDa*T-zwd4b
zi|X!W{_*>3uj>DM<QH08BI0?XR6lE~{O)CoYmcX`PA-4;de5tx3&)Oiq&sd6Vyc<)
zP&D;L&HclPdUI#i-Hi;K?&zm@o8_{$^<}-AGo>@aymv1VdVTAgmMFtky%>ReTaAyn
zvie89Sg=SW@8@F1;By&Ar)6=cAJe~HxxD#L=gmJ$Uf)ydY;&)CaL4^(T9Nv3^HZjM
z%NKq6Zn)sv?I)qD46hhp5)yIV&y?b}rBF8d)$A0#^zYj`R*B3qZ%^17Zqsz}%1%|K
z^0H<AT<cz~P&zVC;*P)C$<KjWTTU^*3{VxDsb0TaZ@-4iUZbg6zT5cDgnXRx@`};A
z#Gv_`QaiazlvhmFSaV=O8>hDHL50U}R8l93eVm%;^Ze#_yBnqwH=4ue-`{6HZRw>T
z_i!bD<t6F<YA-MDGncoI)p)aMb>0MthTZf3#XcAH4P)<}uy*I?^=9Gc?=3xguB-OE
zjCalP4EMg&4=zDcS53X0PsL_uxf;4jKmOKv<Vw%If@|Bwb*8L%E)?l;Bxb3diqZXR
zvptie7C*hpCXsY1(kSq(1#9Zc(^DJSrm7lWFlMghpHtw|C0Y2&V(!lfAH!r-@72i*
zn7J*V_?BE@WK4-j);xc7op}uRl^l^*2@<toPAnxyCaC8ng%)UjjET7*d9|i+`yqpE
ze!H2nx?QJKUYX$d>h8Wf*3Eyj`yMX8byb>ULex{o?{z`pR<S1(g1Qp67dp61*lVW9
zG)aBk_vNqn&T2n<lyWlf=iLcBb3+p!MQ@khzSts!o&QV64dx%htrPntdOx;T%@bU+
zCeQhCN!&ya#V@~4xG9-7Toya`N&C9vjhW>v3y#k*oYg-0tHkr~`cw9*+*@$^m&omN
zA4HyND#|b2BfX<DXSVt#mZF)<j&o*CTz)j@=F3OkKla_oSyXyVbI-4USqm=DvlTs(
zV8S+`;`5?gijGHqYn1QaJJ0-SE05D|>(>`fpD>xl{`u?n$bhg{0h4DQa}WBWY<bjv
zyZ7OJQPJX(hpwy=;Ltk#ENHX0J9EAk&y;naKc7_Bs=qIIR5EIpqo2<ty@V65*jz8l
z&o){1Fjy>R%7J^^jJ`NcK9IQlNS}w~o}v{YJKb)cVTzcUVt-)smP>Oc$j%YbRDEr#
zwVeOK)Yvw|jIvo%e*eFyHOuPy&kurHva5_rMcm(n{oD0<j-N(omTYpS&g^d&{C-CC
z70s>CJTF#wC+y1JQ*+$6dAPQEFr>fg2!HM<e}gYXT3L#F{_6CPzOH{3Z^>KS#wVEc
z%J|7n(OTW7g^Ck5S{phaa$4TOyDVVtgB0Zz^Y!PiZ3|o=@p`|W&J^>Qxv^hm8&BOe
zzAjs}<3LA@_!j<9;iSusvtvyZ`#(A#(73yJ@dCy4CujPz0(C$6hy1Nnx*KoB!c=K?
zr``U*qs@)+XLhuH<Cg8b{Bc=+JcH)(ZO6Y@^ZVq7@o$m2`_;xt?OXKnJ^XxC-gDFa
zmKv`Xc8IkriFLo;EEuPv7I8-Bin#8}!dD+J)x^$hd^(B!)r>}?ew%G`V!GDKUHw1X
zta%ofmHQdh@IF7McQf`~_hro2yiuXrzHZWSCDD&2yAI5;+9+*O`M=^xf!oiJ^QmQg
zma8nRJXfBXsTO@yKsMlDlJ3TU&D*AZ@AHY@8@c0(>g1D#3w+$o{z%Vt{aHKpMdn{E
z|B}YrGSLsad)F<mI`276@I_G9j!#bojI1s{Dmh)IvHr4wQ{t+f|E+lI><+y+Y18&C
zxNp|Z%LXlyRt;@;P9~{vF!|Qp+0(Hr?|P8ox<^OmpA5aXg@1wF)I(1-P8nro>gg-q
zyYrImEYIX~I~S|6OBiqN$qXoT{p$NvG;#TQ&v30mTltIt*=;uOJ{7vH?$#9V>ZtyI
z;A-pqcXkyko6;*vzBot)@-F1;`Z;;>id-)Ddka>$TL=B~ymu?>|5Q1F(34BHUHiLp
z=hX)m8tLpGo`>Xg@GL()V@s1>UYFNAo#Q3DAFWBN5>jE`Raa=>T&ry?*sXT^bY8=C
zURhJkzD1c+mlw@@yEn4#*vyPnA;C$JZ4CRTh1-}%&kO!5{&~yp9B=p8Q{vU;&e-+(
z(DQfG*2c>FYiH#<UH<APTeTth?nmCeyH78D9$UX?*L=R+XXd3`Tk!af(P?HT1}{cQ
z!*lD++>0Laa~W^`?>N!!*_+49=RfJ~)@T2FuKd|57yWxD&ZoJu$Yiit-FtO#qmRNX
zfw(&5qVk&H1^<36N?!bb^<*t8)78eeD%Z5VbN(Wo6=WXt<^|8ilv{1grS+Bm45bb;
z>@J2X?Y~$mk>Yq?<He=kJiDj!e+6t-NVTo`_U8PVwU+7r|BEVqIESZ~3fMpJ5IXR}
z%jhS&Y{r)FjB8(%+*FSJ!;d=0oA+Srd?^(M2Jub?206TanlinD%BQi_<+shI{kNab
z^!SYB6sgY2(%oyfzgw4Vy>_<6w`+bzb7kcDRGrL{y{=4}lG}Uye(if^21cPNOSjCO
zTO5|YY@+4^rX4$W{J6`0;P|62DgX5kZ+{ta&dbuq=gAr`^_4o?j=r;zi$C?S`@_w}
z$CLEu>vw;7v`I*Ro^8El%l{hnb9zfHCZ*a5ckY=MX*b^~HSlD`uNN1WoLH{ZrPiGl
zctS(yWyw78sU7K?_jIi`nLo8(Ze_Z7q}`?apM&bPm;5v9UwvA~)b-S9*QsgG)*sD?
zdy*VEtLtjfymNXkF<r)gGd9iWU2SvT>*{*VvZ^f}n^k<$r|LXwZTa8#D5$Md=DBOk
zQ`eQd|3n?LXshL1daO`Y*j0t6lv9b_R;D9!TKtRnr*EuuKS_Rc=?@7DoEGb^{Km(m
zd*LFzwV5v#UEie9=zY;*{<+6ae6#o$W!gmZxoAF4s*zkN|M2~)hJ)#uoRc~1Pv2hE
zaXeIHx}aTf??Z=DYXcq2W>0y2{=DNwae`BSJ)F2k@ADFw13ckE9Eq<p)wuIA<))tA
zH0iR&+}_QuN|U!}Nbf%|;m1qOzp=q`9nH}RzjV&MN&otN^V67p%zP{D`j>y4`tr*?
z!9RiGS6x5dRN3orZC25jCp`1EaDA?55#0DOv?ehvnaSpKcj|2S^*`A|b7oCTj$O7(
zCuPo*i$^pK_wRZT_cBR6T>OsaYUln-ofh2Z>ufDMzSUXXs4o8T?)Y1GCcCW)J6-w`
zVwV|LTFidZTjbkly+Zz`>Q|j<ri*_x#;(wuxa#WO(=sKlu@k08vrJ;+V!6ImuU~k^
zo8`&NQ?qxr1_Zk;NIVw4BknfOEQf55CxU_!>4lM9^Y6==vA#Ted|u|N^F4>poA`^(
z)Y;y+HQ(`zePhVH+4Az;*W2qYt!{|P>#Jtz`>wv;UUhwwNN6AP<j#s>VR3PVeOFVX
znqHk0k5syJbE(dyQ;Xadd#~OkXA;WqE4bBRqxtbICm!`we|Zt8q`pMrly}56PQ4jQ
zdeZ`T&hWW(d!Fga+e#ar8B26{#x+PSh`d?0e7Sy`{R69%vYg!9xryH&)*CGLF5KAB
zEuqHL#{PKE$!={G)lC&_`(qxw(0}Zup?FYfmEgQ~8^&Cgs6Bz|-ifvEY@hAo4lvj#
zp_|z2Sa{)AXUFE*6_H#CCLj2(#ZP;=@8bU8jmm2_wyiq(X|k!uJo^aU%LclOXO~QS
zVxD?_R`G<@u7<*lLHsXPo+<gLqPL)J{}-Vd=boP3Y{Z|C7xALbW^!sMw+wf}dd>DO
zBfoSOF2l8pR)n9*VLHQPx~=!Jp}^{8pSxUmU0GOP2v4==E>AyQJnLM!rO)P<H9KdV
zUUZ$`H~2<}bG)$349{Df$39nHSfA<ezTu*Qto5oKj;0&j9|XTVFP$@W)BhEE`*gZx
zp52|RaieyjdMH=0>z6k_xjffRPi^^{klT2GrSW!6WRLP4g@#w^cMk{)+Qd#d8vNt!
zOIOxC$MY{JzJFg?H_=lorS|BjuUYJZ4wXy4Ewb=T$n90izGz-jem*g&IDomZ{QmYO
zCwf>?awh3J>?xm7?8iAxyZpr-)~_P%fq7Si|6DbGdZf!EH^$m0nP*bA*;4_NWq}HN
zb+z^{bz?}D>hOR5m(6s}D__r`rGC2(<Sbvj<6CvxUzJ=1wzb#fAH0a%IN>eRs_BAV
zdR!MOcY91bx9-dPvi)-=T}Z!dy<J|;%D?Q^-u&&+&$^icGTqlFu)F+-G<A1-bxNp@
zgGDmT{eAgEKLZ<{gtsb7c6f5n7G3c{dhHSR88;-(Nv+u&;aGn>vhA_d7159W)7P}H
zZjs!1HKr^)W%jOmR&%js^LRJgxi{!!Tb;OeDN%b<@$QrB_V8R>#Q9YBz@$y#-*z86
z$x;yci+e?*Gb8WSL)Q)ND>hBkkegb$ZAFSnqx)Vl#y>CmYR)CbZ<#IA(V$Ypq1*Df
z@WT7w)(e)u>wnF-c4KI42A959>oTj;-I{eT*Ji2lG=4j9+xmUF^CSPz=VsYY_JoE!
z6iQ#XI-NI=m0QHZ=w!C0sfB=j)!tWIA9Brav;TEH;pn7`sVDo~So%w>9WS4ZJD>c!
z;m!ZT1uNg_ePLJNnkZsz?X`_*wz}?*%Mnv!u1@pfKE8(c=r7aqzE2;o{*U&^H2fFO
zG9z-^orf-W8cqgzY&oSRlJmx9LAcSUj7Mw{N{-B?Yg4vu(Yk-+1><Sgnz_q657bW1
zxjoaHdAb{OhvDX|b-kZ0BNnesy?rn3?W_4S&Od+0cFcBhU-#@SOw!vP=`C>V*jBMs
z<nqxULTk72$Yz$RZmMb&n$hsmM0RniM&K*4<dV+L?k`ej(k1R5SDN>JztoK$2I0t6
zZc|^H$EQfX?SJ><>zxuW#{L3d$qhFz=6gzQ{d(KArQNi5dQwZ-x~AhD+4lMkYkLBm
zRv&WTvT@>f2FZl=E1uVJwU`~eAF)sRlJHhv#l0)H2wl1@`?lfB*=zebw(PRFo%MA)
z<F~Z?*V>=haT+lEy3FM)GCQPgb?B<!nFap@LVR{Dc%-#%6T?3(@1Q8-l3xpWnx6C}
zms}3n5)gRTS3Gj+Ipg@!r~9;A*SR#_wei%ORAR))wBl<5W7DIotA23~+rthob7408
z|3Sw2S!e1=2h*=_TYtV1I`*8cX=~zDHi2DN6CWMs>e$0+^-VawwJv-;!(ppj9mVTC
zcb}T?{P5U(cUWNd<%ry>m;S|`wh0Y?PcMiP-~KmyVbmq1_?E2REq~2Iet&!0zIYaI
z>6fL?xsQD5EuQu7=&lY2hWw5qz2lj4ID4KlTsyOFxpQAb1K(~R#+5P00@mz^NHF&b
zI?lCvV|SE+hwS}(tMYdwr*gjJUs0*Nndg6Kly1qdM5p2t600+x`G_#y>vfB?*>|Wx
zYRXRTw%_l+@yG4`Z@A<Cavy6>D_7%-ORx56e47*ZJ@?M1D78w)H)|g?HRvh|ef{v%
znDIvU4*!YlAzwSbrFFmbU~QYhVI!Zof_a<$A6wnzdpsLL8K*4tRz0fLvZr_XhWR`$
zcEa25*9q5t-s;+x#3Zrj&$H}2_Q<-)ht4o8+vH~O=UKLI!)uY?Zm+1y*L!LNZ@oSs
z9id>S^k3(X#KgR3nJ+Y7+PQE2a`w6)&n@PR45dRAeL-&v<bLJebd{A`{_d83{Ep!A
z2v*fM_at7pt>}ESRP^)Tz6!~@ZngGXXO7;Rte#TAa7lRm!W*YQSSQ`N{?M5Hrn6^g
zpOeFeo(9GiD+9MJ8i5WwuDm;$_=C0TA)|I-+>`5>N|R5BuPm1B4cRy0|7H*F-Ft3^
z^>?!vcob>*rk?lTyKJggiU9wyOtvd7<-fPhUG-h#{<e=9UpY)=+!sF1>|6IZN3ohA
zqm85JfDC)B*c@htfKZ)fkuGl(>emZCexLd5x{4I@@(I}?+ph<+zE1kNr^_r)FTC(<
z#@n*BX>3mZ@BNJ5n1r=$%=Zf4P;56p<s+-{Wwr@#^LFMHNr`Ng%*wHzb|=93r@g}p
zZO2E7+}m7FKVs!bQs!@|PWxovBp)DObN$YXoxfELvefdGlBI6ORtAIzezoyl^NN@4
zMj}(Z(1|EzbC)o|=QkT-wWOYkcVBuHB;H$Z7%rULvW}6b<rt%zqTsWw|JF%gzgX*4
z#H1)t$Z9h`e9DmqY0Iq+tL`20Njn`T?f2GYf^p=LgyU^nZ@kszGWnPgec<mjv+f-W
z3Lmi<p4_anpHcLoQHn;Kc+ftpyZ7DFFYpAqPwhLH6Ct(#hJmuM#1ZEI`uU7s8IQ3W
zH=BKJJ8Lj$S$?ON(V}PVl1>u~V_vDSlti`muB&;H(wO@(aMFFYk~WEbwl$@js=r+>
zlW5}#XOcEv5Z__t&nn<<{BM(KjrOZm(aa+2q$L|T&+bmM5x)GX>dfAi#kma^H~6h)
zGn~aSW98cAtE?UL-538+)7AXR6n!}D4d?phY}bpejoLpj%u`DCm^7=8wL(IOOGl9D
zTT`Og7tvk2I1)Wq9G}7Z@T27mGt+{DUXs2X!9{CByE3;)UD@;fBD?NtaZ4TN3#|*@
zKGs@ydD^X+Z1Xu1xAX>H4n5`XRTa?njhoGGqSySzt<QTFy^G5>vE#mZc;c>EMw+FP
z(TpFaact_3W7zx6QZQroqHZ~JTc7{GFE#FN;AwaEWpQmg@yKTLbp6)lPn@{6PHdj9
znf9!qw>dOD+&RxwA$ZolO98LvXMSZfQ)%VB;hHwZG*rhUE3xR<j33OrtG76b9D5d)
zt6XVjJ|l99>6hiQAI~HuaaKiU?Y!XoOL5V+=9%%UlV18sF=b7BvS|*hs74Fd^*_98
zU5W~r(^z8-7VHm5J-GgbW%9FQSAT4B<T-tnxi|gv><Y<k+uN_nJ!{pgQah+{#L|f&
z`JjWt%N5SHv-?e}j_P_}xm9h?9lhQ1mH6KIpQKZmCR{$o+<W|n^0D9(4oAdxTvO5D
zeDjQj`;owD!9L@;{J-YUyV^b1QlBqTd%vwl*PaZM$xp=-mE60zj~@}@t5vO7@y;=A
zqQ`~&%@vC+8hI@%eop9m8hH3nu=gs}8Ny~ugKrrwSj;^q*y!rS!xvY7Z_od({A<^L
z?H8JcQ6X0Z#4;}|3d-ldzjx#5Wc3YuT;G0Kem9=4;l;z%!50^=-QbvE$bMGi@ybZ!
zR+e0wqd9iBKL6ShmbNV{>9CD=psdLX-OsHZ?h@_0QVP9_mX@?}Nww^-Go0b(-M4|;
z?W(~_fds$J<v&@bcu#8DxV6K0?Y;!bsaXaN^1pqoE?DgAJZWy&x6HB6cDiq0v`x|U
zZ;#!+8h=@FxM{+RLiSGQgU9bFKXY(hc>Vi<tCdqCJ2(GZW4VjT_Irf1tMG)olX^ss
z7B1)f6vZ@IU~y)Cgs(@p@YDO<7lUG&G<GCst_}Q?@%Z@NH35gszPZJ<&zthe%(utm
z;Jh_45&X~gZ8NO6t$Hr(nDZ*pt~HlbO}G2Ke8OO`e?r0u_3lC|ugzPcwsrXxIwyEb
zt~#-#on7jX$p6<?-*$d&oZ;|TdCHpg??j~EMO!f2do^nOs@uQkTTS-U_xi2#mHce$
zD*o84xy94l)>W*rX6J6zt+9D$8}rSkiidp`=+}L)cwQ2RPqe*`#70fKZ@f*1d+zlW
zOv(&hyp?moHS4SQ_AU=ouH5W*>2p@;vB2E5b`GiPiS=)S_H6jVX=^LCcm1)Sj~;!}
zHmO);BmU}qU9;NS|6ZwO%wBABV_F|g?Tc9xknqMqJayIyHebt`3{x4Usu&cX$$Shi
z6VKue*jja^Vb1034Z_*2%awc1)@8YLt?qmy`$Qsl6O(ykjCA`Nfl3>my;4Ox8mqFF
z%(`$ScftH?(c%A0x8AGDTBoXhauefj!(Ems>0GZ2B5W5aHnUu_H$6~uxcS!yrc$ew
zB55br&MwuS7ZF=~=%3O0=4}%{K3h{JK4Vv$s_>)i#`D2bCtP-!7a;#{OY@Z-JEQq}
zl5dE<ozJ<dk1KV}WbfdViniW`E|TXRE`DZWvYd0RI)(ebhP-~aw*Eo46ffTiOlHh2
z*;~J^>kHiRpk3+f^pB>}K`ac7b$r4;t5X9R+Sdu%YiI=j&Q-s_{%7W=$)7Gfo6GC1
zd+_58LFq2f?JFvllrdLkp6sc+VRlfy{QT)xJ01Lm9anEV7F6TjH@PEoowjjcW01(i
zfEpDZHic<ZZfD$F5H`Q?(FDl`hLh}PN?I5W&TvzIv*)6xt8Y+7kI*((LAg49r@ziO
zv_IEhkepVp68UV^p8GAGQm2af=C<7o+P#U<@UZo5)>?Ustz0WliwFJAubQm1qxi(#
z&jOoz+Asd!Ec^Qq|0b5JRV_L!HVsZKGjH4}@8{-hi7}NGih2>4>+kqyOYt2>!99DE
zAALW#t8;gU(mUoOD=sW?ta~cspqwG`uCd#H!s&TyME>*~xV0<l@Mjn63Hjci(_`4H
zOPYGW_;vlWo2b+1JuTi$F7;B%mdwp|TSCjU`wq`ziI-T<_j-f1w`JO&TeasCSd7lT
zVr%IO2vky)wOE&8sQY_bo4vBNm!(6|(}F`swJuKgI^Ea#AUJly`He4)EG|TOUt9Vo
zOXN4Fi01wIiS}<&)TUhH;cK`TxgdqLQTs-PmG1MO7ueaO3Iq2StZ!0%&HRh^Z2MQ%
zvl~`w7N$+g;J<fy@*drH3483my#2J^+}FFvf@N)!_N3`iS5IaxQl7>erG0Lm$@Vn{
zenN9Tx9$3LWct>%jhp|vl&*OH%zWh}{v{Tshpx%-PwD)V$L-T`IQNFt+y~e4D^~_O
z>^*5y@nqL^i;BH@b-(h@c&mTy@zmQN%`s=i-@L#)=iPl@-&~M*b8>U>#<T{fbxTjS
zm#be?d&FPg^5j`$WBWA)#)3_ocDKLYypC-bulya>l&XY`r*dCBcS<bmGd}uDS6SRe
zp?C9__dyLC`5azb=>^>hxWf_k`$7E;f%)G|8TK~hF>w4+2?%=?na=MKW;r$I(oNB)
zp-iSb-K4r!E>Ph8_qdEfI8JWSg_Lc_&D%mwaGAV`e_kRZ(8g7zAL)31OQKQ#F}c0o
zPZqq?SN8a6muqfw<`&Pi$m;VP1<cEJ7xJB2T)xfkw)pkTGn1_jJhA;G?DMjUYwz+Y
zax26FHW`Pg%x8Y)_Ofuo{*We<g&`^_(|^87HWP6@YGnEPqQdVN&nwp*N;aOURPo_z
zk1hZ91e?|yLH`aE7%orIVzWJwlE?6EW~Era<BRWpegP~C?l+#dF-rFIwiS4qGI8E9
z_2_b6{a3X+o+|EUPb=zDGtJ505t(<_cK3a!I^BajPK%!!%f_f>vy`@SRjVf)ef^uE
zDu8u6V@L^;+4tw)Ynglhp16_|JbCQ{z1{rVX2pDb{DGl1t?{PZ+Krq-0#i+%#PkbH
za`rj<fTeUpd$e6$|BbVul_{pDKd(M&^JSx~N&c}+-*^4*W@Rs(P^xyTRP_e0#VaXY
zFUf`9CCfB7XO!QFy&v*(PEO0L(kbU61kL!R*K=jBozC+;;$@Q2nNpKGI<H%pkNs%q
z3(?Ftad1_}`yVf!{J48?_vYYyb{+mV%$<SvyX*PquheN5Tl9g2XX`SqxQ}zRy*yk$
zq?$-@EuPn)>wTR;Q^#?+^Nm%jY<ZJ+{q*?h$jg?O{`2S0@&g4fm8(LGW`0yosF819
z>bK<LQ?Is2<Kq2H>2sK5Isa&;9(>0j<Ha&NS>NL3-RjN1A3K)($b0|x_uuA>{~x9Y
zuTFQU71sLAzMlWS>^xby{hK=rJcKN#Eq%OYkxTH4T1)n-!$O`(RsMS;n{O_Bvt8n>
zazf_3gDMJY+PRGmPkUrj?!NI`{>tJX^EWf;Cwm<t_8zLyeBJU#*Y}}rmfTspFENUY
z;%?jcmPMF$s(pEL&G6kDspr}qYyIS7jB_t+Pq=ob_V?kUdoSK_c5~0I`6zAOf3$j+
zW7-~#)itMHF)M~jhHanv(Q8Z2^j$KRx(n7AZFgk8c<6Gs#Ioj4Aq~0E$a{~NF0&@d
z)-3<bu&6yUF}3x1>nG`%UqmlDTRBA@6INoGBf3E5g6Rq`?fZ`pELo|ZY1zkJ@+0t+
z#M7MJ;T2cK6j!NlT{q?VuC!^BIWpD<$S|mHoZjup|Aj{~F_$emrug=8tA*#9xPJLF
zh0I#3=5cY-?Zq#So;oLe)pzM;w^e)8^G)SC*3Mn4uH5hMSNi6rmCC+&&qq7+4;+3T
zc7b(g&nt;%+-ItUl^eFcDfqN4etpjSncO!bZESNcEckOL{hOl+Z*+<43$JA3U&+-T
z*H3KSee+fD{e9NnkztndN`W(8r2hC59mBg|l?9K{0wIlGC5H^=I{tsWWM|sc_iK`;
zG?Y9kIv#VM-6NGRx$8mV`KeC1t@dKeSKNCoEB4(rck^snDPzA27uY{cnKu1~>so;<
zSJ&vZQ4J0YvOk)(F-M=UTR44j^X13o7xmfy|NSS>yw3gj@AvoR=DdsGd-T9QXM0bt
zTTQv^j*@==g5<lkyVYV(U;b#2ySH)wZQEB0Z-n)e#lOqvJv@9+e|ZPD+>27@pKBdw
zC@gmV`s3^C1JYW&efJ+)Z82ZA^HE@mQ%LUeZ;=(-W~5KD4SR9X&R#xZ-mB23IX6H4
z$?2Y?K3m)>$ole0{&&vnl4l6pHGVY+n$2>?<k9_`@AU2E=FD}oQ(sdSA#p4I!Nj!p
zhRPGTExUa-sgyJeEG#+~{CnNq_l3SC)m5=C)~&xK945?o|B__ir=HmD3#Q!t#<uO~
zv+wTAW(;pHT4eTKo-%293hQ#N(wc44uU*d63}5QDV2bLjh7bCeZaw$VJ~#1vpRe5O
zmmhA=I&`2&V6N=uh&zV0(Mlg0W-NPsRQOrA^;)mL$DW+2yvScz7Pw^dlCtlmGRs|s
z8h2Uo%@t-?&BgU3o2y}on8=|;hqFsg%~k$X)2=xGkBe|8uWzX@`^C#ATPv1rJg&7U
zUfr+V@3x%(_qKO$MX#@Axt?Xvc>egx^_@9tAF{+9UT1keZDup<&iDD!oBHcuERV?I
zeL`P@@9L`DoM&V_yPkEKY5s<fv6-9W&O9)en{@ZVmrarTdrt>C7w>%iPG-tixuUA`
zJ2kJyXWM<hVr^+?>U(u%?Wu#d(_h`G%5+?RIN{VbnddD9t3={%#&}Gqp3MAB@Uy^~
zl~W2QPG1_uT^6=t*Y+)EF7|pIw|%+l{Nv02w}e-(e|~4a=V=XH!E;BSrOYWlc*5a}
z4UhDXos7G!GJ2-XTB4@jI%ToZ!*1oB!mc%pw-lpy^)K{xop)$*n9HNsbyFCZuhF*N
zC1cX{w8HVch5k`pwTE`H$?8*&E}LYf_T(AQ?XMx~NAF)eU2&2l;=)F?t25M1b{y2z
zcrx|GzdTlkTeIgMGk<5Qzd~mVtJKufk)rp%ov;;p@Nmfi;j#lQnK}IJpJe`S{E@o$
zf^+QFz&SBHD%wBvoT|uLSLn_gyY{WlUH|9Lwmjg_zm@y`()7Ar(+eeIn<SY|DL#-q
zT*$`z>6kf_^Z`EI6UF&8DvOU6a7y2;Dy(?_RA<=&+m~k#=l_Yc)?D(?p=Gbir_ao-
zEqmAPeX#yTe&`LEou49pOYTqi`zx?RoQ2nAvgx*)9B*T@-4BHY+!uVf^I&Cj_4#Wz
zCH9oNtiMxXfBw=kjybK5CDt@7*n4`$v^OX8wR87r+A%$~a65CAdtU4PJsk5{Ynq;)
z{%Y6u$nN;{jh#ntic762wpsU5p!8kQ`rPeo{I~QR-nk|p`gn6kq4tNW^lu%vDyRRr
za^$OXck91|wVdBySnMli?kd`L`Dxg-ZRf9vE@dm75jtmSv#QAd_f6-o2hX|oV;R@G
z+uQ|FaRFU-e&4*Rvw!A7k1Q_R-j%kJI<He7Px$F{^RjJ5dh+WIf2Ydqy2wXHUdv}K
zV3@gh-KNXOd-lkwn_Dc-Uw=8|+;82fS-e$3GFkGIe^mbO{dluzeRZCd(u{JBZ;VWL
zR)%f6;vfCo*SY+&a-5sX;?r}^tm(}=W+qx)7r*!C-N&Wdr9<^kaQJ^n(yg;~^LRe5
z>YC6Ywx?@d%(+g4&rHAm!S;yc%+ROHpRbi^?eo6;m7UG})RQU44fIvyO!B{|RGiBC
z@iO|}@%j7o9FAZ3_;I<t^HzTMhc5P&zZ`c~{^{h{cdf+ZXn_;|vct>=Bki7*Dkg56
z@%75z+*cod20M2JPggIT<(nY>VE+a0zH`hBKe{u7{4eKJ?mIYlUFy^)-C4(99XR>$
zWaIt44(~)>EUXsWW^LYo)%U~ackOpyEPuS1`3zIIWx2AaWBZ?|pd=M_h2juR5%rlp
zCv~0kZdqxFZwsA#b*rf`+sb7A6<U8^hDGu%6<y_Bf6c%4i2vgh|L%b2T8Cdglw4|l
zOl8M3i8nV^B+NT1TBY<>yX*C9?JskkE1ok}ZLM8e9qeve!P#{3q1qYAI>YDNqb&EY
zFg0BnW-@bgo#y4oKS~&$dbl}EeRwdfF)~4jSATMX|Mx1cr@Q&L*RA$4)w!O$Wg^4*
zqnCgA*@p|?e(3+Y;QGVZ?iaPfN7lrP&id|qxb{I>cnMQyUwQbJ<Nalm^WQv66`gx^
zQIJ^0g`DHHd)l6U_`qs>|9!{vhubAYzv$m+|NVdGghn~`Kdbxm8^hLiRfHvd*pi-o
z(^uf!tUJGzz9r`VTRQiMZ^Z^-`ylS?mrZ?QTeW2+&P~+l`TJhs+}oeOZhe<tG5@Db
zWwh;!{#r9R?$<}^AM^6>HrjOk(q{fU>XGx0gj_Fn5Rcl(e(1*PNN&|@k931>wd{<I
zIr{Bdy7shx`=4olS(v%j?61(5*Yz8j=X}=ERlXBD_d~e*3B?Wf-Zx3k-Enz=;(_&@
zi;Z&)nI`>MG-1-ckk*5VRvoD)l*JtP2z5EPX@8R9_WS6>?Heubb|*jYnZp`qx%@Ln
z7Fc^+IqGuZ(GIS?bC>*V`>0^Cr`SU3!_?M;W*!er8ud+Y>|P(a(&kwk&&*jLQWYN9
z|GnxH%g^BO`x^Itrl)(#WB&5}KW`%clV`1G+nhol5zDskTMqc|+Pm;ud1$UdK>w7u
zsZ-AxES&Y|ACEHE$sY^4x+k7u`@8wzLS~)y{_g*LFV_7s=gxZY^^xw5l&{P6JmYS>
zY|<;ZU@>iRj$`JoUWr~kTdzr1q%!X^MRMF*_v5H@{*4Wb#J2xC<6&jCeaBY)skI5S
zuYY~;e7b(k*FR~~*B#sc>($im$a^=XX4Di;oVKs(*u{72SJr*II_G4TtLwk3;rtJu
zbalN-*Uz6L;K1HqGIPP!fR_<%qIaCG%UAW;_#M8Ly7T|Cr<=Y^`LABB``7&AtVgkY
zC+mNovrwr`)pWe7@Zj2R{kwPGJ}53)+T*D$x@#g+?wkehE`NWuD`-Z88RuNx5N?K9
zq1V=^hTCMnooTpv+x%n8=XFL)PFT~G>T-SZ=RK;KJii=|s?7C0U;DYg=++D6`I((v
zv$cP#ZuwZ&cI#51K9f4vH{NHfqeG7Vnma9FL;Viz2F)pw>-i3CHThR&aDl%z^W@om
z#^=6$m)>Y*$hYtC;cnMi4{qKK{O)kY_j|`)GpW`?;Wx_H>~`DlUXdJd@#a^-z3W@P
zeYhH%YIS$-T$bNy{JS3?`abuh?!R?eGu*zP+OmFX;-ZRMyh{}Rb;Z@~xVBnfM&7Z<
zTxDYY0=4Gom(wa1Rcu|fIxKodr*H1pqx@%ma;k;;uiR#P^XvzcwVa-bY|bSUO+%GU
zhgs$@zv(~9nYOo}?1ag`IpSNdOE^FHoqzum>lNEd#io4bx>G!VzeyH~{P_JR`+58G
z_}B3%rhLD@{kH47H1n#<shh5?b5cs4#olLL5G|Wg%D&4;!Q+U&Pvn$u4<8>-n!Z6~
z|G^uQ%okQ?Dn1Q9t-CI2zu)PSBkMo2>|%`#YQJ$ik3rCSV~3yo%JLl-MCZSFw2|Y|
z+oB3?^@a-Gy&LbapS=>2HfL#=zn<0HmtPr6yFcuB-6wB5_v@M0E(f^8*RJ}>xwJQ3
z`9(heOZ{o}>PNS&`<40Q&zz(O=cO1wq`la*Zli6@KCK^l`d`<6H?CdZc)`o-@{`X?
zRj!q<`u@G~d~{g3QbfTIjf|YvcJWiKc3lX%!&@CNwXEdHDUGdvA8mBkQLX+}=2`r!
zCtr9`_T{!O>lPPIe0|tvwT?p1vDGg&FWcI?{QM7Xoi!;>EtAgs@myK=xaaWQeG27=
zvQ;i<hKU^Awx-53Ms4wQzGSz{ug`A0JAH2*_x3YF4d<9Mz3ciLf9@<4t8i`ER;o6m
zzrIZVugT~5&%1Ksj(8oA?O&Sbla_kQ`+F{nnUz8;Tg}|yNtUXWvy&IR5=nl!Blk2%
zakA36{~J{_d_6KRd|qJZ^h`KGVBL!sCH%sgcV-rsrOe*csTmx1&cW1JCjH=E&P7(X
zzhxsF!=+`H&XAnuuk}&!=oinzDBVdW>(dWD>wV0)=zH9eqf_Q6v$`Mp8O!&IbC>st
z=BE1gSGynk?kv~XygdBJeMaA=Ov{$Hvn;&J&Tsj@^r^MmGUvkex7W>X6`tKbr($_z
zN8qHjyLYYpt-DW%w^;i?+NR3#Sg92&j~$ofl=tH|?A1HXptNhojO?5nH+8*#&rmKo
zl(*!Z!ts0N?P{xaf3M(oe5mHItnXmSs$F^OD+48zy_z#!F5V5_^eQev$n5oo8GcR2
z7z9o(+}xYqJk|8-J-zUy;iiYGW7l3w4-DUW=Z5l~H8E#%w`$gyJ}_Q%*K_CR)!cRo
z*CLO+z8AXu(uW7G=DEA}$jr<0n6>sp-li_&n$jz6Th10t-E~JSY>~O$foeGs&i{AS
z-zYig_WW3P?cnM@1?j~HmObG)eDBd-kvW&Pa;yoEDBU8uJ}30A+3Ja+yCxcm*z@dv
zT(soKRQp1Ojb)`80u6t@R-3#zRFT)#b%{}`be?ebtV`>!O8QH2$?gs4o9SOVQ@JTK
zbw~M@-_H*0>pA?V;Lp3S5Bo3P{P;0?D$_xA&J!OuJ>F^ICTg_lwSH!tkZHw}4Gr<v
zyABt{vF=QYiCJ8npq^j%MDYh(`LEY6ZyuZ|6|TGe&f{y*xjScAEqkqd`14g6q5U8I
zUxW*<GgMji(Vb`IPcP&96KdA4&gJQx+?vSpBej<?@Tb1C|MCPY=G2)k2lhMfT-%tQ
zu+Ny=V%>jM)Kx_-2mSPfBp4X>gcDd*RGOq$P<hoRyZEu$r2Buh1^ja-?pnB`?nzPS
zt2w7r-kdy_oA&6GPgcHnpr#1t$sWxh?+M#V?e6FAe|M~zf%D|7)mN^}-Dc$7?67$E
z#TVjIH3#it;{P50aopzV(g%;XOX|<AnfbZuP+ab$FKzwjA5C5?{-$*6&1*kjElW&S
zU;g~@=E<9bzkO`mTpkmmdisZ~{;IQ5Y@6HEUoT#q8oTyp&Ay!3+n#;4Jbiuks=SDx
zX`z!%Dnq%hs>i7`y}lmK&%6Hgk{wT^<CwHwnkC)+eAW4sxy7}-KRfPz_<nMhcE;@6
zp;1#$*DQ66yT2|j*xB5rwD)>P^+f%W>mPPC=@n1ZsXS7*{!`JsE82n^t>d_7l+Fu#
z?Hlyj@o>%DDYqxKMG1B}G5_uS_ea}&bKa}0Q1$GK%YQ~~d!6^|>#h}Hn|i0ey~We?
zT={EE@!t^6zhA5amd&62R!u)#NAS(#i-G%6<RACf@836T|G(2$U+>>n`~UEhj)VPa
z6KtQ$7-+TnvKU$JK6Clmiq|s7_v|_SdexFp^NN{jH@~v#Ts6`!PGMR-?ae>6%p3WU
zyBTH*X3o|Bk?+93!RaG*C@UwDIf#`hBBg0-Q+m$EsZM4}6`2z`4(i=Ls>-YWtc`8&
zL>0FB*-DwyLif&N*lYi6(af%8^JZ@MoO|yHuYaJ`Ut6)<xD<|xLkspY&t9_qWEZzF
zN5IZDGneJkcN!jiIQH_(#91lk(}isBc)M{fdYiPM<$SKsCAIy{ech|Hd=}r~$o2ib
z*59r8@ivbs?JTFinO8dQ_Sskb@x8|9pn&kuV%?q3ob*0@x|Vb5PSVQ)S-TI*7*Dq7
z8QlL~=IySdwL08XL;u0it%~PeuS&i;8g|OC?|viyAI9eUcGrE^Uh3QaT1DSJBzJC6
z%9_(+iMPsm&P{XObn7GEmYeI$=LL!t-+Pj(CjMzv&a1W4&6^%?d&zlk!sC6qTAjRs
zxtb03VVOZ2xWz<%2n5UyYrS#iYViYxD_S-(QCzIwS)HFQnxb=KwvWE6`x}`molioQ
zid&0=d>l2m&2I9qzGdMwDb3j7MQ!LO#*UpSoEa;*zo}`q+-+tln)lQ+NH`<+hu%$%
z**~Rv*ma7|-iu>vG8GkiVRmW4&)cVe?he1+q0{5~w<lZuBh!igG}We@xvauJ>jSUv
z@(Rw0O<j36N~AnHN6+W;<Rb=;y$x=!*zo*wz=tHsQZ0?7X~)_RPTRz<R94-8P3WV`
z#)%$vJ@Hd-&(w8#+jjk-hFLHVZ>0o7e)B}*nQd|#l{CY3S4`?w;C7pqB6eEhBTL_d
z|1-r;1ugAbt8{M5(p^{9^hKD(e`@(7GUxFLo_Xdqdli-W6HK3NaDFBgb0d*K`y6AI
z-lrfFPtHyEdi!>rtkTGKVA%iqo+86Bs}(=(Z|!*&dEisf=Nlyk4JG;vD!&!xC7M?}
zVJO`el*4Tz;4sNgnmuN#ZEWwG-7nrW)+!dxJ-pzHn6&P{xAIx<H}{vGw(pe?ca(Uv
z;Y@A!eyfuQRlok2n^^Gk^!FpvQm;;nl-cpa+kV+&lehCD9tkasV)8X%;`)}rBbBt7
z^)Sb6?bEKCG=8{7FFMcoyDlc|X#~SHgC6;}6K&FO&2!q!!Z@cYhQozjMBwKp-+d>#
z_uSm{d(X~^Ri{KFwhC;hURuYTRdudF<7H38hxOviKmN?DxpjYealz{?Wg&JC><sQJ
z&8YA5XG>Uc{EwPo@h1TWk^3?n$EL}}_}HgbvA;R=vw!j`$M8S8p4UVy-vnOz*rL?y
z@$#zHj;$e$;uj3LFE8PdYHQo}@K_Reh=u|CI$I&LuABPO0uy_(lfS%WRh}oiJL%lP
zbG#=HTd1;K4Q^V}CiL^ng;R2Y+V-W<?Yb4Sww&Ofaa`cJ`hvwN@*fSk<K^9+ef$^M
zB%4!_wpsYEWc(KG3qmsA?pV2pS@`^5%24T<X#J;gd2Vy`9slx%yUh~GGnQ~ptQXu|
zW+tgr^7!z@6F0AXpEFg)L^Yv4I_$fMzo+`W&MK>Np>2ZuF1(7oy+lHKKC@3X|6{kl
zk56s&x!CpgF552t!l7lFXM1JBY!%-o#?2WI_!qs<(~PoXU*s%o(cZ`?tgu$r?fp8t
zKVRmhvF}&jyYkbN?(R&6h4FDs?m`!eX0Y>|x&E`h$+YLf8ZjF|8TrJ8EGCbWZ!xL8
zPB4>ly=Jl_Docpzh|`BjleT3X@Laf4Y1x69?S`dq{^_h{?XtBn(EVY{EB@e8L;o%o
zx7qC<wYH|8T_v(BJ@TtS<B|KN%E!M<zcJ1ClS7nOQf~HEx%c{PG6moB>sK<hcllXW
zK5ShpSs`&@!Q_>*xF0O~$X)QaFeI(@Ta=Zu_`MU$!WutDRd4m>4U&D~!S&uIHhtn<
zyXlM)391jRn0jX?&r4@ZeL2VfZf|qRlSqqMvOC4ROBM8m6@1d)W%smywa)aO^n2%B
zi>-|JLcYsdKlA!H%izeQ#apzvZhX?w<eEGE#dA%AzKms!qAS@qb2^8{9^PM>xj9{G
zh2z0DFHbyrJxN!wWzOn9Ct}LD%(t)ZocmZ}<Hzk&mK20@+DLOTmrr>5rS_nLovUig
z=Z!31xNbCwDBrhg6mQ6NvM!4hm8`h7AT2@GJandF{j62&-jX*?_)c@tF}=w6((O)K
z%QcCQuMRQ@vT%F<aQNP1vLtf*j_W(4FRXI=<B)aT#!+i}F5~T8OnbR<PjB<lO#k+7
zI=}qEs6#v(dL$>cSA{Q2;%s7;zp4MUSki{+^YY^v7Jcdd_fPH@*?Hl?tvP8|FKlaW
z%&J^|!~Vd<gE`N>@NV3EC1%^@8O4T1znfAVos8r{U*y;^$j{7Ft}fnLCN^XB^Uv=K
zuAVI85wSX4_e0tF>}x3>9$P&JKc}PS0WTUq23E1j*DqmU)|F=T<<kDterENbMcWLQ
zJlXN!iGD-wt7A9T+-h93cGbQe6E51H+;FgVoyx<_7ZXzD%l=q(DC`zv^?&RhzF+Ig
z{HE9^>^su!xl<P?vS&9>et*Pg`BHoNvi8lk9nBK`wodMMrF+sB&keCW^|^RrTi1u+
z6Uwd6lB^C(-cgh9+*k2j;7)GnBmNl=_8a`DzPhP&)6_CvfBOST;omdXHQX`Hi#E^@
zxx1KizoWT~Ol;#dKHj-oYEC5Ze@dIi=lJ+rk4=PU{mS>Q5BRS~@~Qg&dEi>cbl5-g
zkqghZu;>4IHSfL@3_O%E!|1h6$)<w>XJ?qk&$-UrR2frZ(iIxooEPoC#(cTqZY@@q
zhz%j0$?fq8`-H43uIh1Ho>06rFZbYsXDekN&pA3}cDcLK%wEa$-<alVMSNVw`otz}
zy69KI87fB^Wqgc;-zMGR?N}?=6FINzo8y$vjs{D<GpU@~_V{1sIm3D1B-g00>->m6
z_C~bAOZ3Z%P!Y{5J9)TMyS7<ZiuRaizH!;P{Mk*riLZ^$f7>XtYrB7}m&DTCdFFnn
z;`Xh$s4e+pcNNozPWF9b+pOmaIkeidTeFK#-*vKimz~C+Mk%IGzZY@+vsQiCqw`fv
zvX$!y^W#r0+%EM+-1a@!HRiuBUbrH@oR4GgRk`_WTt>%E7}@-~n5DoTV_u<gcz$@O
zlG*}>K5NzqkM$1f_}yRM|77*akDIyb9gYTsK3G40|HdB<uN>8dvj6cf+?-eUT)4h`
z%HicJw<eo@E(_W8V6_5=W}xMa8WY=_2QSa9Vg29vDfhl@Qk1TQ?P=pbtdU1mXEI6X
zPmAu7C}j$IYHC=_Jn?kVr#%l<XZTc#IIsG%x@mu`c5-gaa~_BPZ!G7<^StW4y?1-!
zRi>9GW6nk2iDO&8dfNoeq%N1xuHZE3T;5CeY7YNvX5^jt>%Poz?&NnHRz0!Z<DKWI
zYW?k4D8Fg^(?t)rewww7A$<PCe|?>eN2guQ?L79$fjy~Hy+q`N*R0=lJ9r%V)C1)M
zc~;guoYwWg>+i8mHo<*PH&srlJQVuIe!AuNdEFIPP4@?NU(>b~%$?Qr?upy)8NLe^
za63P~_eS4~H_COXLFwQ2?;Qy%(hNJFtqPUb77_2=eLQcH^&CO}hE*p1QfJPd>TI9=
znN?6@mFfHF+e-UQzlIy7E8W;7$}3f~az<*dKv86rO_**#LDG4Z^|yB&D^mE<BQf>!
zg2&9siK-lDHU^(BTocRnRPim_ALV=|##t}>R{!DfC_0o<DY^UKO>>n$2N*+da5{->
zQ8)ed<e!boYu<{W2TLsG+~3IfWZv>%-nquk-`S?0{}x!iy5pQ~M)}H++q|1*@cZ$8
zms!3dvbxLd<EdK-%?4NIwD*7O&fT7%z|b0F(7K|4*WkqL*=s}cf4?)eSi>Cp>LmB8
zUV~3**}3Ph7M?$$%KA3#?MBT>md^Y~zuL3kn-%i)R{G@$X@7NhaX(hvWY<#IU;S91
zUsmz$-!e^EX;o!QSq|4~C&xeQpIN0{Wu0MkILZ4_#T>DUMV&LZ?`yI%(O@yZYop&X
zRXW6`{992%>hi+18}4yj&s1F2s1x~0|D=NEI%UH*wnYmcdQNXkyP6@(V<fSk_l7sq
zX7*1DcC6-?Z%(kZ4f{4j;l^5pm$K|nW*)DPzGAbpG^#UR{Cv}_Tc6MKJxTx2abdom
z+{7Ep7aV6Si4$cmIq-Dx?)ip)*0}tZ-N~#mO>V<x=ZOK^ncgQDe&Q`PJHzIEwJghT
z=D+8rq2CQncptbn-aHpI#ae=W)!RF-e1CTs-7l(KbJ6USzSR=;NZy$j3(A+VUR-7N
z#`s}tY?lY8*4x6jOZ*Kb)H@Q38nZNc7*@I(BxR-jb``29dG)X)LTcHKwTW#DV!lr5
zw#>M(W|uj8{+>PE*B4lPp49zgnUL?DubguiA76KOu7uP^5n=wfOc5I=i9b)5(B9s3
z{Zr=Dr=J*ib@_&hig?}s;PiD3S0DfGMJhG(xAZpMdRDT6S7^4V_RVQ2<tN?z70*5U
za3%Oc$j^08vmW05G<AY&X+=wbS=@3Fo~btBiz^&*99ynW>*m_XDsgV3NqF<a4_b>?
z$@)*M<8Y`lZRn4+z1?z$?}<bQ>ms*$d)~d~Gp{v77I2=N`}O#xC;rz|{8sG`ec^sd
zxXLB;f7vVUif`<@{{8G(VP}2QVa5OJ##c}NWi@)gQ*!R*7wPF=(>KqNbzava<g_)O
zFO<#Vm1=O;(+57cj5NDgD@xf{bR@*E=ritGs<vXWn9}k0wFm1SXnim{xb(|uZ^`IG
z?^Yc2)z+veJXHMYg@}OU^qEua**;gS;YpOZ+svS_>ee#xhtn_cuD`HAdZk0)F2Q9-
ztfaFRZHkMpZPodB^?2B-GuJ)0220PqU43fl-3q%TtM67EpVFt5Ii?7RKP~oZayD&U
z>Gz%e{Jd56{#vDTCq6ss^vGjw)PutnJ%6k1TI~P5YFu$Ui0MX=BdhD%B%Rlc97=mP
zebxSV<s_q1)yZYek_jxE{xIDQ3V!<N^-@{ISC(r`9`f&DnAf`a<&TnQtPUNsD$g9+
zRhzy|{Il1cNjk45vx;&@YHJ8<6dzS%4_a{FYnzSp6S+TjQ!ALaS2I=bdbqWPvtyQb
z>_Yc{YkmdAGH$U}PXBdCD|zO0hUn1iv7N>%q(U!C-#YW^s;=pbUzQ(_9?&_W9V4(r
zRdPj!p4&uc?<ECWz6i^%=;ZY`74lR3vwZ2+h2}Ft{jW`{J?-~hUHjfv*U8CgM`v5g
zr8s*WIj}|J>dm9?|C)H_&wHG$rIzebu<y>PE36sb|0XO^+pAX`eK4~|Y(D#O=Zb2s
zz5FW7C03yYd@B}+w5aRuYF?|rCbzH5`<IZ-hWBU0HXQf!Uo*G*!#<M<|Lb!DLzb|8
zy}3|2?D_Qn@83o)&$uy1D&djoLFEse&eNFs__#hD3)#3-TJb~Cb3xbl8)PfnBt5sj
zo?3rEWXlZO=(Y>?avzpV%&F3CUG>Ace8rURPZw7f9qyT3V07@)hl=3va?4!-|NExy
zJH_Mr>Q8jEx>j3o!rfiAv2X5Zzwdq=QCfeyWV`><GyhvXoYq`iogJ`{wI|{fw^7N4
zCgoB?u3ot*M;g<kMR?2`_WaV~-&4x>bKZ5UlYN4PSD6BJzm)4Gm+;NmzRIt%K*3V@
zTKVw<59iM||7G)M=Va^HDdvUx<yNLu?^GTB`&*V=3fxlTUh?ik)(v(&S=-Z>H-A6O
zzN^3S(el14Pqy+rDGlcoEHQayELt17b^45zm0g$eVpkn#{=6l__?*zR#w_;TjyoNC
zQr{+V&oVa_=VDX)dULnpvbv9lK9ouEyj#uI9AeUPza!v`yhDvk`20=Uyt(0NcHd6T
zQd<2*Cy2FZV(2M}N-t*R<qw{}oRG}j+i}OG$$a5l|FH0>d%ows+4@TSM^I5u&dybA
z6Ix#;bKJhwUJ=~+C-KjRui>B9?~@Uaw6eGU`KzSn>$BOP_4oh$_2=r(pD)ex_qF}s
zYgt`fR9f{(fBm`rR{#G^wVl5!k1y=*$(6maYai}=m1no(?X1&ztG_>Mo#hnEc*a;P
zEux!G#U*E|WvD}$``d{LY-`#A#OH|1<osW`>rb@1%G+q=A7w}Peong=vLtnmQt<51
zxegic1t0tGy5R2RcmMUtPfsUZJ{fde<KVTBZ9P}dq*dQ^b+2zO6qQ|YVAKD%SI@t{
zzwiG->#N(|&04Xt)Nm3nvq_b?H?Nh%=~JJB?jM;DaNtw$levrbyYtDseER#27W<}-
zT|b<+U7oyIqU`LPr97FL3D<Y5wCXG0G?DA=$_1Max=F}pvEI1MeQHA7iG!CFZm!Or
zFt@hWnZf4PGuG_WO{cYQ9&xW^YxOIfyJSPS^6g2JpEa8vHTJPNG(E4K{l#D2>Fo!D
zB*RTZ_20b8pV^hHswI5QTGN-qx$}67Y_tB-3@eM&lJ!UR5>@vfU;47^dB^&R6DxE=
z+~+UT{&xA_L4jwrP4ZqVx9l>xzxRbT|F@HMsm<>jO)hmG2u?a=C4On)rQaHn3#u=^
zjb~@^`_m)y$p6(FzhzJE|2@*4d$e`qqj#*q6H+Dh0=9lR_wcW8%Smzf#9lVeW9Q^w
zT>W+GuXCo}`CrU`3n!&MTp+W9KmL%}e0EETb*WzM4hNa}w>rIiaPqU~>d14sp(*d@
zUi|X;yu0y^;+JZc{kdD_&F+43;IPhXr9%tfglm;>_=K~Um+=JZZBMMazS!ApM^n*-
zHExmo>F?h-@<gwWeeg|zL+->jj{OUnK4dI^Ww>v)s6&Ty&DwpN7RX9(SAC{m^`7TS
zoy#(rt^aK0UPlY8TRZV!oB5gzpSSN_-)Z4KHAI(Z<D-p5FN#+#t2<o1cK^*?@=ehZ
zy}99~TT=f2O@H$>J@)9ur?w?QO?gL{)VF9ZestJRIp@T;#=^e2S3Z33syHvQ>x28e
zj%e{6?C-U8w00X_<Pr<<ZCcU3X#24{`|hWE3&dXj&f>&zi+Sh%V|ijP3KiU=x*w~v
zzuLJa>#$$nZ-YX~H%S7K1>fA#&HkuA*S~X^jbjq;<%j2*xBZKXkW~G?<na6JWzS{H
zRCfP<<2dha3|~yP){I3t3FVsWPus3Ia^yhjdFeU#nfUVTrphFp+<dBY(#&#}OFJu8
z<rP<c_TR?vRrX(8U~83e@sid_NqKfW><LaeQa#6)u_c?>&YW{LN5oL~+ffDGwCAn&
z1Khgj$XR)B^qM+HDe-mL?#bVZpM9UU^`>~1u}W>+XVKWly-Qo#58nNf^5?A1vijZi
zPwq1Y+8+wtS=FKb=ABNPg^^wH^g{>k&a}QhY0*sor@C1odseM3yZrl2r=-IB+;45i
zx87(7J9au!(E4c7haJxnZU)=^$#W@ax6+lEDQChVHDQJMPv)*F?`JmCOp=z^d|>Xq
za^#ER4xKsQ3cGUVq&xRMb|}p8oSryUI<Vg8#2Xu{Pw#7IuH1b!vA*Y|r~cCj`Gj31
z+@Ds;yI*{4wxRvD+w=C_@0s3B4gA@vbl^YJKjy_%^J8Ze3BA$2ygy=xC|~j7*%5Y2
zLXTyBlK3pApxx5)Z}EAby|(uJ=HH8t&j0%U^HY9>J2iG3%kP#Nz5PGodP+sA?Vk{i
zZ*_+8X0J;5t{&W|<3I7MXk2|*r_j@eT37kzGduq^CVr8T5M;i))zV|(F0Q+WF2>3B
zw_Uft&aO0l`nf|dCaXtO`Z;F))Sh7(@IQfl{?9Ai|Cm016i!yG+43WA>AR;g%Y*I2
zCTRzmw&=w2cib?o+vcj^zv5x=HRcM=6+s1eB<I}v+2Q{q``f4M5&wn%3(Fm|5VGH)
zzNnG!<AnKVCd%6^(mS<fPTjBVRefup-a4OIt;u|5+Vw@&3az;xGA@34Vx52YsEusz
zmwi)H)eojz?7g$0&vV-PJ@eUKoLZyWxj{nsZPgVSoBr?iH<w;?PWvk8#3OL&;N};z
zSMTNj_Qs-#)9LIP`_8}v|4g1VCrxpARL_7qn_zJH=LcpE28LWo1_mWOdz8}>lS}f8
zD)kB~k4D7j-!>Dd|Gr$|7W?g1rINd|8^wI@E;)V6#P#vQ+f0WStDbtMG?B^k=-0N|
z1+~4ko9<4W;_}yXdJ^+9@!MBE{=5JF-Ip0L^%Z{~pR}H5u<+(d*HbMICDXGU{k&(r
zxp{K)kC#sjBTs!=@gpz)#OCGqYpOrJdAT|NMArEes+WT%Ou4%;W*TdZTHD1%#Shop
zb543ZH~(a-flhn-swrJkdPh?xX+};stG3!_>5Vk!3dZw13!OZYJ-?(pI={(F#qCtg
zb@pcwMH`hvCQnTl$zPdf+JAjb3X_jlU;2FEFs02J7JE|C^n-1SHij4_M&)yPZ`^6y
zb79Y_io6{eH(j6nTEVM*OSoQJ^F?lPZY5_uo65{Ztkxc-(Ua%ansv>)zMT2jr?TlD
z6F<iK{(o4ueG5C|%a-&M(e-t|3bsYom2a!5{`l`~lG6iY6SgCUsu^;3@;K+Jl++}*
z*hU^a`J#13r}ere8#n{KGy0uQF$rrtzdh@X(4;=@ZFjsqPIfNMaov;H<ao=&bzXC#
z_pIk7vp3J4U22ka;8vX7@(G5oD)?qz-kUQ2(el5o^D`GbH+g0AYQ?qMEnV@SkKD;v
ztn{N+tMB!{&*d?*XFI-HE4}K$p@toXw<oTj8*Qf<HBIO5ex5(#v+UVkJec)j@0w3j
zawIqAFz;Pt*na5yRNcf`kAL3UTovlrmHI?OJL$^A8Mdvjf8-zMN%Zn;*tC>Y_>k){
zkt8-{BV|k7ZJJwSrnxRxYv0%N*y2^Vp2XxQA+HteYjwoVopJA%`^lWNBvgH^rsd^z
z3|(9XOU@i*-4w)Nxp8;a-^V+cMecqSd9jj#dB;PO=ld5*CTJKg5VTR0n$hgZ^ni&o
zxO{qMcxHfpc}QVoX3=TaRTE7@RMqBx^I>oo^YG}r^Y4_<2dNCEx`dUf$9MyICPXc`
zA+xCWjL>`axAR%`KE{~rVt9O*b)r`4Dd}AfQ^mJUeW0JxmSu8FHu-rs^ZDX4Q-scX
z34Z9^e@P|YQ&5+YHA{`>lH~&zEk>!VEesN;tWWUHJ0#4++cRm>%C^a81svS@9&Yg3
zWwv0UdevLU)?42keXDzS249?HKF69f;P#UmHl2g!aqc@RRYD$aW-@72I(Q~8_il;w
zl<b}xzH4{+n{5rxKEH4)`%&KPJ7LvAhnd_vL%LoDb&335d3N58iDi78N9-;$eKI)|
zm0iK``(-}Ey~`ar3wdJaA5OWjSHo=0GJEE=2Xj`Nc>OwhZ{sh!_VoQ0rGeYSxLBm+
z7A~7+v95PZl#|a1VV)bp1*MZa)>#Q1U9s_NqNj4SWc76GUbk8AS&m+0Zss&C^H-0_
zxP3c&p*UaRsl30}B@6yu{`%^T(BqfJ#}$JDGcTWNon$JZu&PY7DK4hDZFSF-R0GjO
z+dMPlv!8U7^j3)p&+gf?eY49GPw_)<+aE?Se&*rWI$hdDmg$|8!iT*gIW6ACwO2Z?
zxjt);`BFFMPz}?;-I9{=*Mc7y7ug-!=DTS9g`=@qUw=3rSS!8WU;g#tjdF>mZvy)`
zvyLryh<Z?=UXZdVDw^^8iu*o2@!93o8^xP{yZNm?TFdXwl5;oVPP+Y!>ALqHirA*y
z(A_&LzW&CxH^178?{|MZeEdLF<=20I9-U1qE&ZyuBD`C~!iXp7`bED$KIJbbrWwwj
z#}=OZkom(M!xp6<yuJ5}W}j1MlzS2>Gfh3>@=xv$-+s%-eu}#NeCxft$LlyEu3Qdr
z|K6zmi#gspuH60D#G7xpKbzMXNY=kEsQ20DK0P3LgS$B|$1>jTA9;l$p9BPtJzTj-
z#ac$K^3vO1eX~nM_DR2*q`KjV)u|t+!;Yuhud|ysuij>_&F_-0AKxyzYnUvdQ6M(!
zE0@}<sd8M$-&cO&pJcbE_VK1%9}j-X#d62&B2Ikz^yTf%84V2Y7BLvepSkgMi{ZJ%
zN;m%GZ?D?B%U5@QPrhUI;-f>Eqo97(hVSkX|NdqjV`N(`v%W;zdd>XAVqVsyqW+5A
z>L;Zio%*}<n7DN3>1*3=mZ$HU`8%pdM62;@)y3#11*h(d<TXZ@nD4Z-taRMAz$;tH
zM^b*~-R=C<Y1}>6jxy`*Y-Uy1+NtP!N9l^Im{_E*_*LWmfucR_LOW#z#Qqk#6`!3o
zb4OxWrum0os!9`GS4x~|mAWA8zL#ec!<AKn=gt*d2qf?DT4~Cj!c|gT>LMR>W7(Ym
zRoA*NhmBu`RpfJS4(k&BAfs8F^`KtRXP-syR*mH9gy_Gwv{F<p`xT87N=kEYx0lrE
z7Vd7ouuL?^G12H;l>0wnEyewg(JuZDN=NKo{8Bs7P<rO8+EM`y!`bJneNP{KD)ZRr
zrR+L|wue7DKbIKS)x}=x{qnKw%^P!p*^BC?%<bD_H)CD(&g`vA538Pe8+z>Pl&Vc_
z4o^35EpfkJ5Fypxn7jMMgRS><ayCyiPq=qSq;#>I$$N{5PYbUt?^$is+M5#g`Q`5a
zX)H0$3R>69xF)8XmrIJD(Pf_RJTH=ux!_|@(~q;)C!b_FJa6Z8v3Viqn_?f&>Rl^k
zS9S1!z@90yn$BH*xO<h=B7u(UIuqZmm7BG>J?4C&>6*h$?FYr)Z_N(7cTRh<?P>4d
zs}ANZVh(!EJ?YeuWvm<<&Exk}IL3YJm1F$7tiFGbb6IV<ZN3Cs-<+F=UhcW~%jss#
zLNB>Z-)y%`3UL4PfXzC_W+%fZ$zQx$c0IFF?ZwU|oU6N;_K}fe>(k5Am_FHCux(!7
zGUY#qV^f#&)wI7}E1tS2H(WU0lqgtz`_4}L&Hv{7;YDpi?ColL-NMemAS%khpn|Un
zQIwdQTAp8&tyfSvH9R{1_A#Nl>+2<s@GlAK@{0L#w1Iz?Raw>*-<pKSbHv&d)|{BS
z#dPcGcX~?&9RF3PmsP6YT~;+AwdmXJopr{=Z2aHf*GJ#!Z1FxUzFl*ASPtuT@eg|G
zC+F#(du+bhct=p>%A<Mt5C5FK{a*Ze{<-^y9?v_x{*DHxru`?Mr|dR7(>5Q@*>?36
z!|SixHncu_ZQ9|yZVRj0(oJW$RDD&2^JhH#`ue-gbD>a=Q^$>-%inBtFZg@2NH_A@
zzHY0c>+^-@3CFdH$$KpH$;t9qo}esx@c$08ckLUaPQ<G5+={-o{B>}<&)Ywn=iIDi
ze<$~UZs`8pnaWHC%>A2Z-Z+%}=g05AUw^%N{(5zMo_*bp8H{yW33~lb+AnQFWcTOE
zpH1^T)}t70y8B|rch8s4ubnD*)3USOeCftN8}408zqVxkPKQ`K%jU>$UnK4?oamqN
zK8tnwhd@ue;`HEsM+G=F-&Dy;&C6Auz)|eDu9LxZU&DgMDFO#ScfOqKT(2+0F8T0%
z`KB1x35GkhZ}feCx6FIB_45rs`hPzZUEY6LH2%Aj;4kk-vfC3MsC;;|{A$fT8DrOT
zr563tcaLWZv(1UQx#K8Hae82`)9QDre-}6Ruj@D|yh7@4X55^Ez7tdZayM{Em3Xv1
z>kQrXCi%<aPm_{o8P9Nvko}j@WVzk%ilVsWwIpRH`LirxXIwa24!X03cl+2BujrRb
zn8j>uG;yQvvF6I}X62Vl*cuI*6D}Tqwdwx?!>_DUPIG2IT07xoz@?}1p(ppWpP!rC
zthB7_akA}&1rAy}Jv0_Ea(GsXe)<`4>G-GEdFgw27d5tcI=s_JZ0-+L4Caum6Kz{w
zY{AL(Yu<i_XK(ZG$Q@p*DjsAb{k%DF!@>I=4D9o`(kjD_O|Cd6d1%dEvFQbejf`tI
zKl9j7^ySo34|~brJVSTqmmXJt*4(?~@U_T=iFdY%h*99N(0f%k=V|R#nc+9lt!}l+
z6OpZ)GK-Q;5`y0x$}L!a#rUJ1Y=-v-?##ba&()vY&-Pcxs`-EMggMJYww@1~t1)3l
zw9ZCZmhfxR^ENa|P2%n8w#hjac;ozo{omNXM8-BgxM9t7O6=09f^1LcU9Klow1eJV
zNWR4Eypk<L-K{n_ahb-%N14ke+s<`QHc)M~*~BxS-^BK<Ytwz6xmj!#VG89Fjiy|@
zC&w0jO7X;0!7!Oh`}e;LS2AyN<C1I9K2uxu<!?8qfy0ax{$DCw&$%N%h_728vAtg`
z_+AflRJHE)n$ug0x1FqXy6hd58rLBgV)e9&?^VR<DZ&MDcM>*Oa85it!7P5K+NV{A
z1wTHx!|Nvf`9*_|(81cw?_TqgA8lFa<i3FKG<*5WPkuQjm!E!GrYg&Gnc?!`8hch_
zJNbjlHf#udQGCfFG4j}Q#@l%!{ihD9>hfh}SZ_Y({r2jNL}r`wUMu)Hf5j}xa=L$e
zUwwdNX;k=?ikGW@N3S?A_o&`q-M7kb)csjXl@BgdJic+s>cbk@cUAxEh0E5cJ^8%r
z(u99Ks&1mD9+_#^Lb~Q3Rt&xv@K&-x#5>TCN6YUS)A8b$+2)5iC89gICv&&1p2e(P
z$agbIljpFjum-2_G;V`75$WUeS>2Z}F|;Xpamw+b>kOV_wjNWK-Arrn3|ORe;_^Ii
zg?@pyNpW}GB5x#J*z=qH>Sfu@zZ_+{Ll3U6{U@T6$Mhrb)Ya9~XU?A?9x?0CqixGl
zozMUN8CTBWGlwx`(Nx23n`E)qtme#X|2dpj$Q6;$DS4^>hF$($mR!dMPnQo54`#)5
z?C4`lxT7W!d)?yYw(z-8>qDwb4J|fpH!~MMow_wQQPV&w@r32+HA!sOt@>(au3EBS
z;oY}Ur{g0(y?nU+>C{OkPNF)||4Qx`o%l3S^3T4~?@0o;%|G6g`xWQ#wBSbVLg$cK
zzx^)qpI-6B<^uQS6#YB*cUEvuNsGSIr19?Ghpaj3b7#H`<k#9RHTBlj^hJArGM?~%
zoyU-srfB}XgsmcqC46ouTmGJM-c9K_*CLgZRFrN-R|)q&zG!nVHA|Rn{q2}Iw&tCp
zv0;s|POq$zdd<Hr+%9s<F2Gh|O<nD8!?hFnuetA+|8C>hX8HRf|J&TDDb{jft4-gU
z`mdfhb&lZNpBL9{+A3sr`nt3C`3a{CVs{^TSQVXUP*`Xsf9c@`-;&5Xr4~DNJh+}1
z#w6{Z_$>SJiX#Q5xV1|Uv(?<Yy~IfG@UM>D@6Vo4OU>D<T2j{6#q{lshjG;7sR>C-
z->?|{m}xvG%g3On;Po~A_~}~%d`gZM><X9qx$o-d%#UTF>vv}#xPSF?iW867t!o)E
z>xFV;SH9L>C3$X9SgD1`3&Ck~BQi4{C%u@<ymg}2KITx_%-W`%DK4jKn?E(4^?G9|
zxzBCgdL5RnvJ9rner`Ouf_Zu5%@Sp&mD?`9nt56x<LZJvxsNZg2LF;5JuuZx<-FgS
z>*A&7w(&;kZqQ8J+tM4o$d6~eO_A`4j48VfP9AO!Dw|?5U&mwpfr69A(@oZ0e6Xox
z(P5!tC6{dy6Zb1B=$je7^7$nAu3|=E^i!i;AM>j-SH9%p<znLhvUuUN=?O94wca`|
zHk$EA{}CH+n!#^w)LJ|)#%k3y4h9BBX$A&)Jhga6N}8!&LFHS?+j+MwzTJ&?G~u6Q
zwr$zV1^m(qyR8c*sb$;}F`k(#zE06VD7DZjP->#rE8S1;i}^HPC7qm?@VxYI!bz3$
zfBobq#@o%UkG%6?hUZbS>ztEkEuRy*{K@i3$0VcoaK@kSJF!V)yXgItS$isLKRssJ
z_s{R0k(-@CsK=xY?rL2|><Nn`&!#gJPA_x~(v#@qUa2{~D}%vfM%u<_3@Tl`{hm=F
zD$ljjoB~dEMG1cM-Ru>_=<co7xNwHC=($U)PI!te-MUU&%(dltYG9_*QXLc5mMpXE
zYnP&q?b2u|;&%NVX4t)AiIwo5dx<|;?9<ECd5Wj3++G>2x+dwQzR&rS`K;3g*P5-e
ztnn8uetu4N|LyL4L+y#nEAu}xUyht;;Sk_;%KXGq=J;7tts`D0%sL#F`A*@+)5g3R
zhePagbT);}Xzx9G_2JC&?(0HVW?$M7=)$pn*NSa?JAO(&<=uXE)4gdic^sin_^!;E
zwEM$5`}ul{o?bor>F?L$<;#tk=6klt3csI`BHFt5-opte-Qz?r?eJqRyr}!t|J|&o
z%sbSl=gbs+uxIm49kCG2qSCsbWloI$jzkq$8UKjiTUF|s$~3PkUX<U*i>+dZ$-Ax>
z92pfCS4hZ4wK60+3QueDFFIK&^0TY6#82hyP0hevvnJ2WS$^bo=hL$%4+~da)YSMi
z=Xh1>x%;j5C*M~2DF~UFMo5(B_sR!0s$YB3Q=_B8ed3Y)v!knI?fF>zwyYP3jC-@y
z{Xo`Ru_HWQKV-i>FIb`Tk#XS)ZLPh}`E={FP8~e1KIgXoUg`D^yPf~~D7+EeyUN={
z*!zU=^_hVwFIYE=nZDV4ivLhp?TQ_Z=jKeZYGtWS<Pi+0JP|rYY^zV%jkF0GDemt(
zRw$LLsl{GUY5k(mdt}!#r<~3QUec$RZxvAU6^Na|dNP9PQh{W*RpX1|4%O-=(=Atd
z4_H~Rz4n&Tr%-`i>&^#h@k-9TluIWjq)*@yb6%RcRCLwZ?_$^E3~W-SERW=Kv1whY
z|4rb+f^GXbg%b?@Q$;RKGiPc$Y^P=;pRxAdoOR5fnjIw;s0s7ANeaJV;mz!vmtdiM
z{KbpQC#<4-ThxxH^KLq4({#H1MC%bo*RFkP=05Ja5A<#yl6ZgSNtyh?rh{dV`S;#9
zH|a}m#IYmk57kum-@6`k-SM$}@6}%A1`W%UMQ;~{J>U;FH}iBzTb04OG|NuOndS04
zB@<5pJ9p*-#oSZ*p4_qIZQs#b!5Dda<Bft04o1hxtp`FSPOfBF`{aPT_p^D9IS0jd
z<eplZIN{V=;k)m4%?g~*Dd%9G`o)Lm>;3lJ&u3?zmA|aVEOFqPw*D!XD=CtnWge#_
ziLdr{ukX7#m*vgj__x1j#PQ#YUi@hK3XN=+02|Q-23L>#$&slqo%JbSqEV5p@v4g2
zhJdL}+49q#KT(O8D{<w)I>T?Au3SrFIwtgeSeTw(p(p(Nh_C9iGUpX6r=55HY5Y;m
zxj&9MTJqTPhbA*zxTM_ow8tE%y`@q7u)nbXz(I+x6Te<o&AMEbd9-f5<rAf%{i>`x
z>aMo<B<Gnr87i6g#h)omuKUiwR~%T)VfyMGyX=t={b&BV->N#!i%vQc(tq?sig3|+
z)g8i_hpvBF68rhX2`$!%eOE3{7Sqz6_r~-6|GP)y-{`q%W~uic*zvi;D_*btYv7Kr
z4>xU;QFGR>mX=<*X}jv4lFHOM`;SF#RQ>hzwA`xQ(#*S#AMZ2RBfH3EuBGhP)3!?S
z@6_j7O}xDD#BRYI_h;M-{pcbzZ$fUMu*PkcNesW!?<cuG+5C3n0<)quNeZmW{sDOl
zMRw(FywBybQ<kCO_%_KGy6zTcE@lEXzh4ASE@Mr2%l$?D>9+R$H{&bac;$|@&DE&>
zbI*w(d`~vlhW#rauwOmvCH_T?JC93d;Q}4!`wTNT+@EQ*_N-jPSN28j85%EauT`~|
zW;bk%;psT^<C1f`C2x`U4ZW?;&;5Ggn0Df1NbvPJp;=dhA5=Y^v&wkqx^2$g;-`EI
zR$n=+(X(&yd|T<>t%o<g=a5j|n9s92r+#^f&jP3GHT!n{`|<D5b7zjVdwze|mvUjk
zZ*|@m3pa>Mcg-~@boeq|Mz-VI^kY&Sv!{d`Y`yV7Gv~m9>KV6LC(DZ)<|W+udWS8&
zSL$iFZO#MF3OA`8i>_HOSn-N)-RBKzGj2I-IVW!$6lh$Znl1fo0;`HZ#e+irTZ=D$
z6*&CSJK%)V!@FnatxQie{~ll{#p<T7DKl@@g*c-rGjFn6dY=8hQ=DbV!G@RRfv?si
znaq3<<Gy%8cCgy5*`B-1+ZGwzpU*0A&pG)DdoRbAt%c!NbA0ahmL6Ql_OX8Hwc?!?
z%lUf}5|6&hWB+ouV@6jC^HH|lr`5SmWa(|;W%O?Kmhj7LT5GYkG;z}BI~IQ@)ZO-(
zA?Fi#LgvqYovf&B%OtChWCy*N<8z$le4o9}3ehi5dcq2yh2IPRYJT|ge%(KsANQ*r
zk9YnqTEP~%+(`QA6T>?W#*x3&51e@uZyjFz@B78ONk3lx-Tn0K@zbx%g~j_9-tBys
zm!ChcS(2;GHtWiQuZoJjzfQziHtapvJKJ1d@<+n$n+13KzAOK`=GJ?5oq1vIi?wT;
zs_$k5?@^5XF)#Yt8mVLht@c;PtR`Ldc-v#0J?CwMpP{XVX4Sjj+7*gZCor7RHM~|d
z=V<J~FpIxWw(RuV(is&l!}so<);5jXmG+y8|3$uMlM+&tI=dzLLyQKSER)X$M|mlI
zTes_b6?fT9HFS37*RfXTdf`!<HtErWKHdqu&3RWCB4kAtNmk5a2wc)~>Ea)SP3PV(
z{K+8u;42r`)hQ1OgwOHbd8AS!{EuVzLzinSJmMbgl`axaYVBWe;H`96W2S}e4ku$S
zYlGYGURW>je8k*0w<c%P>5yGBFR`0t?!S80S80{)!q7`Gw<ES%UDg-VxX9#P=CxCz
z|B&jLCCyG(H5Z@%>bL&B)&A2b-qtHsR4+J~{>Rq*X|YPet;L<cuRm~@^X1a%lqGwn
zEMIB3yRiJd|BtLoY3`Y3#r4xn3Y#z9J72Zg9&K)9`>Gu#TH*{0>vHfniE=ZGlR-@)
z+rP!Pw@uprdcDKj*~(YFdghwc_Wqu;Go&ym{*guU?(6#s|44MSs2meHsjQ(b)&Kwd
z?W63RbzXgM@9f!=bt_7#@n~K0#)t*CpM3dy+P*!Xx!-jTFMq9A>Oqx+mvWU81M-ix
z_0OGq&rI^@NiE)Gn|o~T-K;fg`ER3~ZtT`4(Xaeyv$oi=lQLG5doEV;SIs%g<frC%
zqC?zWl2^&k=*5H0J(ZCRa}QNWRip?lPmwF=Z&mD#*z=&J_FRP2MS)prI!rBl8VZ-2
zdp@=-yn9k9ddZnmPXqr)CdwvVk9w3G?!8`_KH2q2YN1TgUxn0P(c8S5GQ2d@(``8~
z6`HKDyd=c-_*U_O5L@Zsb6*}$m)d*vV0yo5$Dsoi6-PEjzWLnNw_mTxfP2xRmko2)
zRUCVERQT%Y*_Ti6x&4BpZpK_K{<uH|tFyb0T~wK&B>w5&qmz<0D|?k&7fCnW(SJE5
z^NPAq-rOA12MsI4-tBQIDzcpF@nYV4{pCXKw|@BP+&Er(I{D*g-snaT^(SX6e;@zN
zT>j<u!53#A?!I1a%OrnwqHDOLl)KaCkmt>hCSKe$wd=Z0l4fi9-njSswWi#-Zdz&e
z{{9|0+5Od}KXy6ZIQQbk(b>(j>&~YO3vE2}S$!Q-CiAlDBSsT8voY;G#s22t+~$X@
zg3ZsOROc%H%rNOb7&N;&PA}8yY4w41(;KJH{j4K<;Jf(6SBp08R1&<spSPkcPWjm)
z|F-jAqgOX3UTYO$m3UXe$mRS^l<(Y>)NM=UqiZj6vCK4QIsZYAjj4DKkHEC_tGAjv
zCo3qK?U8n9Ryk;YV5QE|iC6UxEHPm)&NlF=PTG6*z&g_#(npvbKf5-09jw{Jvq`e@
z_@;}e!}%WQGE|#<VxFJ2=0T{jIm6G--Sgb`ITue5JNr+jeDb}&f1CE~o%G?riV5yP
z+uL^e-fL-{Q(Cg2>gVnzt#-AJm2<0o)fZ-pUAT~EaD$OaMj+r>qtG`6_v-lim*1^-
zDEKUy$UJ*NNO9A&Dbu!U`e`=*R5m*H>g$&M*4Ja4Jg2P{uW1$!I(M>LXC8ap+2-3@
z)xESY3hu}gV4eB;)|}SKjGZrJe4=M8|G?SiEm0z|apAKC>vgvN_T!UqoF;KW|JI=y
z=UM^{vp*?(x^OHf`})t>o0)xXGl`#Np1+jkS=D=?=WcT*+6Or<x8{6#<*Sq1<^D@%
z4Y`lJ_nbI!+*9DEUd8e$P4$~o#8>|>Tz%hoYgEDmN8{_=&pBCGRvIt9Bf81;@|LXR
zg{Aq-s~#RofAZeub1HZGx0tS-_4|qguN4`(F*rPCRoLNw?h@<j6KkxF-nz<O@99&M
zW)RhVBCY4pj%}$PEUrsig47gv7I}+vX0u)I=tw&8^QgmN3Fke>PQ5Z=e#pJ()Zsf$
z@^Nk7v-Ur={JZ+);l9t8AN#d_P*h64Sf%^nu>OWf&OJFR>MTAk(l@;{{h_VY3v=~J
zygfmM|Lb^!1b%oOtKi|WtlA&<>h_ZkHJ0=oq2@ZZGtH^1)WzxymN)NjK5#zn98-Q<
zpzJym#V)_(BG<#LuP5uMO^Mk!#kty@;m`c$$(Ij5E??eop|o$^*NW#K-@RMMs`cec
zWzLbCKa$+{-_YHE<8S2t8!Pwx(5yG~xf$Bf>>RJ+wx;jle5Efk>rXt)a4DN_Ip5o0
zo|lBZmB03Z`EUOC?px8fOFQ0X<)fXSKc5T!x#&{z^OZFpcUZAq_~Wuq<LiyuZ*QL8
zm95!0d;gA?TP2roblKgT`smT((uo%~p3B&h%KbKPUW97Su0=;Ty_GoiyUVF#@3By(
zsJsWaYXy(HmvC*1=X|`q(PZg@1BMYdejal4NS2uJQ7QO7r^m)6>V9{(Oo>XK(Qg!=
zU%i!$>+_`Qh{yUW&aOKS<~FbVD^wzxd%rFAq{)hpTC<maOyZI=R?c`KS^58$0PoY|
zj8avno>;xR-!cE^=G>xFMk!3kT|Z6wAW^?Y=K<&5MUEcF6@}+Gv|Dr@Hi&zavc!Gr
zW#RJ&Q(vw+SUUTP#f-VlQ*Y*KytwZ8>`Vl|zsXysQ%98Mi>ws-Gim)F!>i$uLdkaL
z8Bg~&h;Cc@#YwZ}1iQ!@Y2$vq1W(>R=9<Z8f6aJvDr1NK9f$2XS!Y66IxW`(vR@Eb
z^6S>tp5CW&`|T^rzr>w=zo^{KasFffAFtVEE|%Gzx$|yuUXsYQQ<{gx*FT+p{#bYE
zohDb?S2LF#f3>}Fr|xsDG|jqKKY!mz$nL#jo>MwuS>Y|O3rD1mc3%*0N#I~P*z--K
zYLDevgYRal*N=Iai#|HAdFqkf@f<np)x0M!R1)}*aK+GouhiFt$?1OMX@Rp1Hp}LH
zKltd$<AO)*nrY|POUO5Igv+zLwAqvx9c0Oyv`MAc_L$|2KQqq02o+e~xAk26o<o`a
z4hEh{i3Q2&VJ`EO_LLY(JX1Q+s%CWR%x$R;7q2D+hp=vb9yc}e?!h%Ydrw#8y<>Y*
zu3a<tarRxax?`G)r^~L~;<jH=@ezx%M02&|289_`VMl`{BGp8@6Q-?{`ui;L<4v9k
zAKxb$me?;0|NUr%l+RXoKh=5plkdCq^)EJB^N4k!L8|VK8?!Z;Y&ZIyV$t4lQ8X<4
z(5|nqGEGkSs&Z<sxR>$pa#B*epv$!F%Zjp}S<O7Z*3?kF=y7dqe3WzJrhDGMuATie
z`-lKn(CMC;udl67<eB_W{N=U7no~^0B23+1h%Ob9W3yTFYLi;nde`{|4U4x${MZ?D
zN_@7SILCqInnyg#{{MG$Jh%3t%f+pHTTFSDYWRx<ik+ERdU5rxn`wLXpYpPB80QBV
z>_50$sNjSAs(G7JrxbZD?8!=9^0~Y2v<c_`TaUa?)!eqSu(Y(hxmkfn`|#w?=3RTO
zZa-XZ_4s4O#I7m5sZ$sKR%m*`A=A+t-*EOGgHp<@N$>Z!%ZH~PxV|-U!{opI{cR5=
zYHIKA>tdD{Gkr4uQ}3V3wdD$Bb&BTuw=D275!fA{SJW)=+`pwdCt=U8ByTJB9gF7$
zEj0UGI`#L$MUk}+-Li$t9(i2Zb0hu9?%GYo(UrYlW*zR2%)H&}Q7ZoX-^3H=a}=Bu
zj~&|+WOzQyxG6kz`t;w2zRUS`9X~3z^X`^tJ}WH&f#{$^Ou{ehrtH3RD(2(d)v{B5
z?pl5+!fMT((z5b7$6J2cwbbx5Un$yT(6KH<;>U_MZWEz<SN?OpaFCcJ*&;I8Rbrih
z%)+>B3lh)8v6#uM%46c#&m(j_;wfLdv6xy|Hrw-ef=BNvabBL7Svmdc`bp^-b1Ms5
zRi8fWI<kP*ujEDN&P%%vtW90qzg4gC76%VcVAHAD(SL98EUApY%|2bJ&)G*-`qbjq
za|bJwR&SWYBgUUC?$x1o$SHiy(!B57iRSx`&&&EBFP3~kfHkY-+U+MHD*LAMv?Ugw
z+2F<#BKdC_cZA!aB$au~LiRLt9_eP>5+U~}V%CC2#=K5$g(c^XtFX0x$UAmGc$wjI
zXH9Vf-r}o8Kb~JaIPU@DL*tEI&8Am+-0C<o7*<dJ@w)5bq`um;cSc7$jB~GO8LJc=
zY3eU5-^1Y)f1I_<G~k7K<^qBAhfCMpy8d(1-XNLPr|ReQHr{n8C|>LS{P>MYjysCn
zmuV(m&{v#g)UJQ5jBA#)S*lCPDMjzMtLwbwKNvi5oz$Y^zp4Je{Hpne`C4kRPv4bq
z@%SNoXFdB}>pSaz{?dP5CV%ei^b2fD&R)(uxR3W({TcOg0bPgqbLz5(bj^Qw@8LHs
zmlUeC^$PbaGhgUu+j3F&deQ9tF264%dPZLfXkL`A&az~GH_zs<N!L%7oO`!GA^6Sx
zg)$%h>2LjUJ-GX_<TI%~@1|U~eLiPbk#EeS%hPhSs*+N7wl_*@&41Nect>KpMDLNy
zJ%@_6-}19Fz4rP<Zpi0FKMzPeI&?+hV9w8VYpgk#uU$KlmL|QTDlXE+=!!}711kYT
z9wo*lilV8ndY(`HY|eBu>)bNK)$tC2Pq%(m^|MRL{Ti1Wn%1ge>L|7Ewz))jd++?9
zZFNa=y%@S=iegLt>+RLN<lf}{Gwg6zMDGUg`JJV6(^VO-HJo|r#n5uKL#Fl7DVdv0
zw=S%|tnpp8Yl4Kz>DhNum-FAfb?et$<DLK26a==GO!>O`!>$iojm(a@?KD0bep_Xd
z|9mU^SFP&v9v%>ux?*jos(j}Hhf-AGtyR}Qsq^yQX{h_Q<=>ixk<P1`*ymo`bAH$Q
zMNg8~?>fXfDIk&e|3SO%t5arQ$T@a3J6Tq%(wN`j+H@Tz&(Dz)3O;2VyzKr!UGD14
zt|*^{@h(Dlo-(jWKWOr~rtM<DHO*?FOX|95!kGsb9H>xglkr<@k^0l2YO|EWjA~T_
zt~}9K!4^e(ZTud4$Ha)YyX=_G=J`y*w!Zs0Pe^g6mBKNO<O?ZB9tO@y=}&uAnmK>z
zmOio9>5e&nHy%F9qG0Bgx^3?!|ESboJD0vR`Sj>@_BSp^{!<Fyz4z~1cysp~cQegZ
zSN=JFGuS)-g6*tdDW2hdIqKh52TyCc(!6a(u41N4(y^r`v0qy6^wzfRJCWIZ?Vn<<
zy65B72hxLNFCI;B>h5bcI1$D$|C7a|U3=KSvlWIL99^u?{d30B42er?ST-cgYvJjQ
zlVg$YICwO3bAk~ghu|Ztw40L*0~Z-ww|-~PyY7hKCee2{v)u0N-@h|;Zl>Yt=f_1Z
zuy|!<M0e^(GAPe~ZZCJz{@j^eFZi`&w*(&(I&vsCn_cyL!=kT$z3)m_+ussd#JOSP
z%#BN1O^avzVo9BG)O+LHww<nGn>2fkJ`^O$sqRqZxn<b5S(5Xyg{IIFEe5G4?@SEN
zH-;Qq!@DY_)Z>Z-SL@dmEXSuii$4|IV_6Xy|6cpQiOBD;4>L@!IlnmXRw}sk*s^r4
z=-FW@tVu#gO{)wQPq{qGka!ue)Zl4ahA4CSk(<GD6dETwO6WZ^tZ&&W(yrjUifKxk
z$By4BK`*q@b&Zc$rtPW<m}=yyXTA1Az=eYni!Ylz-XR+<;d!`i*-yr`h1bIxBj3C2
zpFc-#&aPEAIJ>=i-n`rD^8VS*$ThLPZ_R48w0CQ>7oY9S%{6_qr*y(B>jkA-b`}59
z^fO=d<L_y~px1JHf4qM@`S&7m0ggqtl?r~m`zNr%KxP_Gm%916txoTbty<6XC4F{J
zL3Y53lzrtUjhd4`C&)Z{W5{oGA!+NKz}fOi=1WD>PW{^+<S|$O?(PzXU8UT+Hyyuv
z*W!8aH%I1Awx=}o149B@Rw(c=EOXVq-D2<1vukF&{+^6qQ&#VGdla+NV(q-93a)L>
z8`-V+TSXTJ+uWaL>AQNjR{X5yQ*JpSoeR27U)j>Ubw#52LEgDbA0@^ATr2IcQz*~)
z&FR%QoH@eQ@0*w$W<58(ifPG}yKiFpGqn4^y-0MmZC&A_d8a4i*_nCu9d<62o?i1~
z>N{FAJ~6&syY}F<u>aHf1+TR>Ot;{FGHF8MOtypy#lzV@(oF<T&q`sfXgn*kl&_L|
z!FAbRhi=Zh-SK$(oR>mgAADtA?`q~U$vU8WzD%=q$NbH)Lapmd_PiEQ`ka55*QWN`
zN@hWyg_6JL<UU|&P<>s?U~;@|ZJYyddj8*IhYZwCTk!t9BWklDk~!{vQ>cA|OMdc|
zoh|QAt`Y2P-<Gx6^}1eb)%^5JF|U5>#rND*+L_|LJ~O6&QGr=j4%?GklOC+KZ9M3^
zKXv8BpkLWCMo<65J7#`9#=1D>=eiO<QTu6o9GLqPPo-on4O#JEj^eUKCw-GoZH|pi
zK6%*vL%wHf_P)h+`&>#@&woEDJhA89our)jSq~d$UB0}%%Jj{=d2^@uFUXd;dVlpF
zgR0D>X>y%f6Mk2Vnorj4?UvkYHgn_o?Z^M#eeb?s?v7+Fvp@6fU7aCC*Gk{?#`~?>
z#F($G?Rb~Xrq{#$R)kva_AfFM?#}=9<Y)0G<)4i#wV&pvJpa5pyf*Tdmfq*eKg!!A
zC(LJ0Sst&JIord2?c(sG6B@0K%{Z6Y)?YsN_&MRO0|(v&H<ceLndThT_q3)fQS4~Y
zwgU%_E_qY){-mpX!MC)Pvdj1726ER=n`N_8!Ff~kw^f^57})|(gncvKvOVWh%Z%gC
zA6kV+eCDW~nX-QBWAP>1dDKp2Khl?Y&&?MWYO?;Rz>(ZEtCTImTE5NgE3$Pr$GI}>
zwA_BCl5Jma+=9$yuTvc6Mg<2hxgmXyeci>W)gt%Zlu{B|vpXG_A90_HDUHdF{qy+K
z)f$=hqk9(pd!#mfPW+bRHoxCKd2saf<)l-YHrx@#-EALywj6j8UAg+!nqE({J}0Tm
zFK-vwi|Mc3u}I*0bGDb$tcB5!BR=;$zu8*-nK|UsN2UEUc=pO~s&BCKmizPN$lfN&
zg%2mKJJK20Z@7P+7rR$#>8V>5n_j=_S929@u)Yy!|4O$?M0)D+$Nua8-Pmwyp@vn*
z@%d_}`@A+@`n^6fT7~W23yJ8<vi^_w1OvY4-<V*QG;8zY>Bp;|JSY}wF5_v}OrBp@
zy>;(V71nJBr9K6{(G>sZEh96jePZ|Nw;z<doRaDl{cE4UjEdYW*Yt>O^3=KZVg-B7
zu)aQCzU|)Z?J693p}eOgBJQ)M^R~ar@K@Ez%+Nmg?X`}jo8M_`@2iqreeP*TX88wj
zUNX^QYgzbc;;e@PN3_1bGknjjWvz9(=rdD;iec6Y+sD;*O{I(<+Z?YtPtCjTra4{k
z&R-*+kH>7S?dooS`SnG9c{;oMt4%&Lga4cF(D|%=S8ZnezE_V#_q^H=6{w#ujY;D6
zuPXb0i&CCfw5s$3GDe!+sNU@tbpLWkxXR00{5lsWvR7XSm~0}~&hy;MRK1Bk_{-xM
ztM;P>aSWS+Hayv=d4T7Q<ePF%<G4L7&m!VC9kF)K%{Pr@d*m|B&hdz(0-uPZ_#US)
z$Dr8H*1i|br}K$~pBGxq_bl<zvuZ=`?93@Imc`_)m)Ci6`^3kvGfNiUV-C7na$2h8
zRd}gby7ksYNlUX%mfmT9tW~KNd$!v9dI|gelIZ6p{r5aW8b9jHyS~0sY@LHxQGbZ;
zj9;mZiU(ynw_Ere&2<sTe=;>ZGH|0te$p|8X~`4RUNNLTP+J%7=>4CiS=g<zA)PgO
zjj{K^Js%Cs&RpK<Dpbp_I8S&=_UW8XLw1LikI$}?$jF<sY0<vbYqs&f>ey~N{ZsbV
ziOi0xvW}(7nXUId_JXOxB00@f!z}P=(VYj{6@IY+TD3M@9gS6qi9T`Z>W&{Od%gy|
z;z>Kud&pu>p4#`dP8Lkki$AMIJ7#n&*H+)Lv!i!ouFcE^Jx3;<V-kI7+dFCIq8qX2
zoOXS?x8l(m?~UHNT~@yv1B3O8XNjv$PZcv<!FFh&LkOGm<(@}>A1%1LfJs8Sa{&j_
z%PZ&JOK#T<*uuHaEA@Mwslw4$zdrLW-_p02<FfS=@uxGs{7?9_`t`dGcGnXEH~H17
zSe@D~ho81u|N7GNKFyTLFBg~9J-PPTbzP~1%5>YR^LvaP?z(iJ{nEPYRPUSXvE6%?
zYVY40_GguKylc&6m(Q=?x96YdyRW%jZ}X3J5u)$S<D+z>`<{NwT$%c}Uh9H(tW`^T
z;?<IwA9y>2-bQ=w^1f65;rY#z-Qnu`eSH5c>?$u;b?-~^3S6}AM6R{bnpuzk8#<~m
zep@?HW#JJvdl8=xhj}9!W==3;(>S@+onPE{QPz&i9gbhVt}f7a=?E@r;`^A(9F)>;
z-M!gYZSC=YS{={Rtyw?)T+hp)QDr9~IF~)<b&Jk(VPDpoyFDy#K2P|uU1sMxh5q*6
ztgjwjYy8^L{f)n^>^85?rpk>krkJgLr?z6&)>C)5R%u1v;X72aUjM@#Rq@mxb2bZ|
zm=qblzGU?Th0{e78ZI5HVE?sh!t=V=km84N%$B`JV?$?cP;;EX5^uK9<BGu@V@F?6
z58p2)AzMRET(qwCnD}cSW8kjq(<3jWX+<nrvh>!$kTBD!X8-tGo?LBPzC2&CBkbqR
zzr}xZ^7B>9>kFFQ><?|L$XNVJ>8jntPm`YJuFi8`SydOUlbtj%Z22d#0`ua1im6#w
zWOg<ytvjxh&-?Ws+BIpKY@go?axpOUC^Im~;aPc*Tac+&P<dA>JO8%Dr``3e>;Ede
zOj_+3^(Kz@NrA0-ZnN*~2d`Xr7w|ex)0izDDdcghGw{j&`#heWR}TAKy2sdVdZE|l
z9MAK=3%*(Ytoi%x^@~ZaCc-5pf|q?ZwFKI!<#!oGUA(xm-loD&t#aezoSl=NeEIR@
zDaXIhvwXs*)GSdt@8PrE<ZQR8g0Sb|uL%=A)c7_j+&sa%+|l92t`j>|5~n>inxb?5
zNJ7H3NxotyZTww#DwMOHo~9y_5~cU_s@n3l9q%vaoUWL+GWcwsk7{p<faq)m&g(jN
zr*6o8Vw~D7^ubC$L#)GKAzP9lS5)4<r5iYBb(B3X7u20_cj49_6HkT8btjfa?bD0!
z`Z=NI9;fGZ(<KXKpGF><rjcBE$Yrfh;!@@{ozof;nr9byw%+t{3J|?Nb@wyVi0nR|
zfWpmJ)WZ(l)A`zXEs=TJgq8MxAOEtMQDZUxPua(pe=8gwT(1u3{V^|XO8bU%#_y4j
z_QY*cyj}K#!|s@oRpiqLjm-xi$m>qL^ImrE@9X>b&X1|BD*w3exW>MFoXf()r`O(|
z|Nn=L?f;7Ryh*bJ45Aax6+5;V7V4~<yYSKNf2x-J*JdR)<ZigfTw5&tX{ki>wELSp
z&b6?x&-|6Y>Fyrx>?N)byw#qpIsD^}^5Xr|cl-5Q&e>@eFO_zhw}QvgnCFMLR_yYa
zG8<ObW9u1aD$FmMup;S{(nA+Nb~&XP8+vNm_bM`ou>NDb>LHhQuGaUN<xVC&`?&ZC
z7R!~2Rd$~J$-6UE;R0Lm!M-O&u9dElAuHxM-8yk1$1cD-aK=#`KGn6NSJpE<kSGx8
z>hz4rbY1!SKzxEEkKGnst2IAXgtSbWmho8b*_&o2HKu8vvkrAWm0D$&u<><f?aJJc
zX;l)gD~s(l`mJ7^=!mQGIO?`+P4sNbCZ4xd%-(<FH6{uiT9BN?{=)2uPRx>!1z)nl
zQ{yKY=slUBbHHrFjL4Qr2EHemj07FDT0&1e*67dl*(9K}%kIjz$;MCZ9=EM$mS>#P
zpL1TOp!ejFnc)m3Zx=Kd+d4dWeZ5)4Yrl=p)4MEZoA}rFpI#ncU;1oo!iq%>oZS{X
zHG=1L>8Z3=&%2cIvn@=Uf7W|Nm94x2S8g#VK9LbU|I+Gy)7NXQcfQ`<u<%!(zS&YX
zjs*{;>&1;v|9oz@;LawUbNQ{Wd#!(ZTHii%abN#3_KlZ#LlwUlU9fw$fZt^6gLc-c
zeO+E+u4?wSM^*VQYRjqJc(2Ibq11Gl!{kMs(bVf5=NOjCE^uvV*J!E`l(6FFik_KZ
z_|&AX<jj}N7Xz*)UrCv`uw3Zm8Iie*mA_Qf?AmSYFEO>f<NNBI^Ne1xv+@=#=ALh`
zOGkFvzokYKi&o8wVhx$z7$g|_`h~dSbRD0&Z0<AUtEAR0bge0~F<<JiIUu}o^D3DN
z_Dx&fsjp$-E!C|nnqeEe>Ab>h-HDsU!XkH9dWfw!8@X#Wm&q^nl3wMzW_(k5e9B&L
z^ZKVNZ~n!gpK;~Gc|px0jH$f!te!V{O(!ZY5cfz<V7L@>F!J2YJ8!R-UH!RLG%x(s
zyf^HdUQVf57B$zseO~Kxg|8Dc+vTK-V{1A#s<Vf+cX6$hFP}HBFd;(rQv|<JY(VXg
zgn)BeT5m!HqIu1}d<&G~+NiH_cb}`U()oF|zYhhP`8mzYKXC6<W!n>{(vYSXw-(wc
zKIECu%5O0%Fy{+%0f$=i0Z|j*wpE#u!dEAJ-}2W#>y9?7;*Y6PqK8ESpB=ltMnhbB
z!hx@Ux@Nn-yj>PnQY^xF*`ui|!>VgrXY5QjWsVKe1+qN;!f&08j21H0sQl~>Jhe&s
zYXsZJC(S`iFX`<G`%)ks*y!tUP-4zbzse&w1dj5=uT`A$n3uERX1dmlR}st&8XFc)
zG0UGSw(s?{=NbmQ8!mBdyJc1T^4yWR4;zc;1e`g@arYJ56h?W4<{Tx-qwAI}{M2@-
zAwbP>n&K>0QyWujzS7nU<;yQ92hH=GmYXq|LEv4Jo&|3{+wVlFJf=%~xf!1<*sj47
z9l6x6sb#6qr&W8OXL;^bD_gqQENkn-Wo+yF&f2}Q@;hx1A}oJwiY?3IYF(qY>YqKL
zZ^NE*2R>UV@NAY&)I=M_(-ZU!9<Exs(y8k7=cb-@ex-l!1?`)xy{C23>VRow=QLVp
z9)E8;C3vG}s%^ugd|quGjiod4x~9C!dGy=v8GFGm?hilQI<jr;VnimbxMFA~9mpq}
zs^Pp}>$LIK^zU+;yDsf<T={I0%v{D;QRde+_f{nICLP=AyQYkH+GXA|43Z{QviA?^
zOiU;WXxi@Hd_-KRYtn(TL#(WOLU$@OF0k5U@v%dx=}|w|PNw*N*-vX{*FI!#$ZK9<
z{EO*Ih^|7tBU5}rP3bDLg}mOD=XXB-%42(LNoe5PWqcy;rAk}pR!7$Ot#g*)TM*7T
z+0nPHs`J*(go7We1EZwoeew%R@MK<5{mD_;R%3Ce^xpfu*Q^%&ms$8rSZ=Mb?2=nS
z>I;s|FIe{e+>4;2N5Yr5@2p)~c3{tcd%2`+Cu{dbvvi*da=&<gY;KMC(wxB93qN(j
z8sqOy`f6&aX1OPTx6MnecSBua<;U}{%`fx!`Kj1#YpG(-y22D@sB!p<*&WU%?I&ff
zS7VnPST8K7bksWId_>8DBT{~M%DgT=^Okn|GGStz^|sA-<Tm{G>f3xeZ_6S<3C(Wi
zGv5VVnWBV}4P@k`F50MkJ$qh4-9h-?u4M}YH@g0_Wft0XDAC(wdy`z1+nz7Bo9*`O
zc-4GDaOTywiyj`DS-tsVrtF*xoeTXZ99qBAVeQrYZSI;cmMvYi`o*zV(-b)4FHCUP
zo^E~rk@EdN#Ui`otgmdpD`BL=ymIaSmWN9U`fr>2)xM4Hy(Z!DG5wBLr=bqxY~R|>
z+)1*2Pnp<VBp$opc7Ij#TR18#{HVlJi^+#1_h|&F#XgT_>xynKfA#gvk=e56bB`?!
z2r&L@fBA8}ZNU_!y`TL5UbYIC-xhe*eR2D(Z^trMUbyA+J2G18-W84~|4s+Da(!aq
z|JgT3ZvMO<>iY62pXyI8*cG-~?}KzsTv*P$J!<>KE#^$V&h<qot$X+Wch7JC6|1i=
zeLvOX!>hjwcsf7t6?uGQ_xIJ)gWum<xist13WpVWoU_DZ@_wJz3c2wq%b~U{P4K+y
zJdY~}<`;acUnlBRv}Y@G)Q`6z8khY~NNcZs``<78+rOyu-|a1Qw*72mSrXy&-st<R
z2_<6D)AC(*z23Vk<4$i`+Z5*einl(mn&)f4XuAKHMc38`k1ijX_3h%}wfT)#|I0s+
zlUVpCRBw$G!^8FGv*Q)BZUwZy|M$&%b>zx|UzII-PoHMK_FL58+^KkNkJgs+oOP97
zpDbobJs-H?@}IWlnKShd-{6%@E#D_<f3lkGw}I5z?B{BUZD&P9*2=s$etPPE`8lKT
z%@MIR)t}YsUdtu7O*WfwAt@ob?Bc?RcMHRGiu`AsoINKzK3ndI-9kZ=^ydF)Yc|57
zExi3?7#QMn@oz>c$WBkr&r8cp2c3~=TMt^e@&9-5f{$kdc6pV&`EvK`7r(j7$|hC4
zIx_D@?cTn}j{{UxKF(AMZQ8Wx`RDTecUc{nR5VT(-mYGrDcs2-)_wHfJ=M+U_4NJz
zWmimdu@SDRkovsFXBnry+ncXOJ<n<?p6tJKJN@|2qF|NHl_&e+<n~F)?X|H=2`@f(
zuXtj*&a-lxv(vd}obi&=`}S>_>%Ig>gV?F7o7fq>#ZK?hh@6pHDLKt^9;a!V<h0Kw
zGhZ-@e+a(&QGMZqU%zIbSJmHSVEfQ}9^<5oX$M}t&$n~0=?q}^Iq-skK`AD&Z|5zY
zpX~()MGNX1XGm**zn4<(IWc`l=l)h#A-^C#hI8FB#BKIHdD;;B;gRhHm6H}V=NStW
z4z2uZ>+$(!&vE8u$7IhJFL;yCUt05To_eH!m~ljhMr7`i^%u{)Tz(;9-sSW2f4JR`
z7yG$}L;Pw(=A@&H;a9k>+;w!_&t2(w{@P}-hV8#?9{hOW^Ws^_RM*sb%dci-Zsbx*
znQU9SaK*l-PW8f{r_^7wKXumVWSWl1o2-2OnVYo#zq;OSe(+;|eqX)S-w$~%OBNk{
z;&IDc%|~jE>W1kCYu$g<EjX}BaC!I9RY#a@yj?h>^*(F(e?P;y$L>wn(O2HjPK3@}
za;X1PlR4WwadpoWUSA`JoXCP7m)Tn?7+N~>c=zb#r5~>}^G#EiIoGM|{qC)6riM%H
zYmr8u!yVp174yC`pK6rZs&{DV68Y$R=h_6%I=s+y-{ZL{q3w>AFXxA6Clc<y*8cyT
zr!7|7C~iM*@WFhx0-;Ge9|TFyoIP9G%xuAzjB5=S<7<<5YWU9E{^aA$mwep^-!*fd
zI5$cBpi^Jgnh3|d4Rylb+GUPP{(s}WsaAhN-^HfspKX?D8_qX6=&kGPSa-Zzsk72Q
z(J-s)dV_B<v%a_Fmzy7~qw+#BSp}NSj{g1iV;ygXxw7|6kwm2m=khPh?uAbLFk`Ca
z<rTBuFkP6@bnG4P1^%2(Oqm)trIr}`aLXN&o|fV{vnBHrzufQnM(cwohsvLi$lNHT
zI=i5k^+n<jQ`JB%`^u)ZEDm3Pi3YHX%CP57WabOzy;)Y}$u@m+$9IQ!?#q_sTWcDq
zd2%JY<uF<GpUd6dbH$z6=*Pt7m#4RJYBiis)6`#j;?+tvyA9@_#W!#+c(1OI;>x$i
zFj6)1&THd&O58JM{I;JLA9wW)>uRO*@6RNuC0}~t;&F3x<$6wW74etZ6GJW+d{9ll
zy?y#@qXM~%(E3^Hjc)u}akP(1eaiZECm*yN`Qkh`kDE=(S^nSq%KSpf#|-ZG9PY99
zFL+*S@%@)s*Y3#@1xK>4zHutzj=g>8_=>ps2M=#pb!B1fo}N?Jj~-RsQB{yH9=9%S
z|4!z@`12q6`zG;~oM-gAIL9+gc!S5mrI-7-C&wLQvOUMOfWdptrk=%V!9Q*+s1g2b
zAF;sg4fk7(+v)b7N={DbS@Hiy(&jsF6jm?eD(;Hduexp4Md3i-W3QRLQ-0rW-F5Qh
zt$n*i+jj1X&fIbBN3&?V)2qU#i4U#?Dg3CE3bb<hbE@Ad@Y^1}kIbUYmwz2l4`;n~
zp7lagMM`(vjK*>%k(xzW5vfPSGfySA*A*OfHa(kgI?wE))~Tpn_m?p7d}8k1+UPFt
z&y_ftXIH=r+h@zxPMalSQJ%8<HS;$WA<Kvq^+hL-*2QOS-IgZ1z}LbwX}y^Yqg9dP
z1!0@HcD)>Y?V^nd9IVw%_HR$meYMTajZ2|V?S_ZT^oxwQ9lsqiv1;nPDwM1#H`^+1
z*FpJDpF*Tr<o0WJ?O7qtDlW3v!?i&t=761Rq=~O$Oi|PUSGn~;>lPXmES#tkwf;ii
zyp8}9-@`LA9vL&7w?2El@kYla{T#mRjmbWVDFw?@lAmxHOf_0uYxVfi@ohREO{V|5
z=k~E=)dl9V*oM{p8Lg{DWOSq$*zCN*C7Kevj%6+?Ul2CSM`p_;s|Air?`r;7eu3X`
z`-<fg*>*Lysn@v11+VmYcWBZw(FXB)zNgv}3bPUg&(1GrndS2~`9gWquc+wacTR7X
zdo6BC?Mg1?En)3i7V~Z8p_zvm*&W_QdE35ylc>f0{*a1l$e9T<48*M$T|U9PaPbv0
zrN3IiDQhl&>s!6&g7Mo%*&qu(sSOL3oR}ulqZz_`c@xv}b=SXZv+V9wo;h3LnQH$j
z2fbU9>m%10@J_zIy{*o=rFL`E=QYp&{(5%l^=j|QGEQwPukSXW_VMCI$H3QL<$rxW
zQKIVV-pe&b_vQEUEj_0s4|J=^yyXwwdE=haADv0{A2#}Ag+BVN$~M8E|7VJ6v+ulw
zv|`5Rlg=_M@>{dHy5(!=#{<_qEzK+E)<2s#Me>@X+>ED@_s%&iwoG6&=(KsnvBXpU
z!&Y;dCZ3gn^X{DRJ)L~1OzNEcx(y#^?42@C(DK`Dr8jM}7QLx?&$)~Hs&jKk3*+u>
zpR{~C#I%#z@+8#+w9;?0YrUx3apdv~#@r_#7RuRuyK()DbhTZWR29eO`-?>XY*ps|
zJ9(GRCE=}3W(zj7PHAnEna>@|`eAX+&X-?jC$HPvJ^vo-@#pgQ=I!H-n?HB%f1#Lv
zRh3_#)fW8u_U7wuZ~m(@$|JOkQl?Hk$@FdI<J@mwcU+3@{~WpBRQzWAyr#6;=&Dbm
zZ5FN%r^rTTG|laOSnutw)LzGG^vFxk`c%#W?!M2VTBR?0()T#@yFPL~<E`~D@r&ke
z_82+4)VS`KDrHGCn<gz^%lvG2)~5gF`yR|cHzR$y{hyUNozFri-903zE@|b-_wml1
zp7x*TkDu<iI{(1Q|IhWl&R?=gr#L0|?P<S%<u)HS^-0KCzR$WNA^4>+>f|MXbG4Vh
zb{6Xy@h{?EpuNL;wab~CEz`3<$V<lSobD}hHU1~*mLMACEY9X|W>)g5-BFT<g>+sA
zCeHk@Hc!)G;?k^w?!5C0mlbcH&$=)pEG%99*12gLy$;q&CV%T%`ThR)Ym)YVx|d&T
z3VdI0x7*6r`tOHh6B|N>QZ;=}GuN_fONOj7yC2ct`%0TXxAW@uGBfjdA#S^KCxU)=
z7I9qPGdq1#NytW%j~!gb+h4AIeMEif)z1<#=M(?`ddgcE(iEp|XmQWiafj>r`ps9<
z&8Ea}={URL&_mwnA}3DH2r*x!-<IBX$+1uPW>5IU^VRy=gaf_*RZl*u(fxNSLv;!#
zv&@5CF;f+EB&G*!?sSoT;rjD%kzAV3_TN8D*Xg>(`5(=dNQ_iIG3C^+$i#Ia|1yP|
zH@?&@zQW+S!gBFd{|6jw9~U>xQJBg0Gxu!L3Tc5!Duvut-Zi=gxeHAmKR3*Fx@{KY
zzQf>b)MD><hSJwUf-2_T*=ieX*Hf@>*`hnK-e(zGs`OmLdUX}{Ti;$*Wp&;*W9c^b
zH?C)o>OZ*N`tfw2>5Zq0!#{_Lt+#W2d+e2T2gg*M<C{JiWXWcVXP0WlTCWb0Etl0h
z{i(QldyZ#8Veazh3*WSPaav>-g}SA^nyV7D^P%O;U&)&kXCHYdDl@g~!!JF%O>exW
z=!+e&chq3o@??S4f$TJ^fOW#6Suy83W}i+<R<?TnaudtDgHrxixnHm_z2je1JBLB*
z|E~?9R$n(f&Z{`seZ_g-l?mHRG<~9fYL(r;C9^C&q}*TWMrvfsYfgza-ZH0?PKB27
zoMxJzqUZg5Q!?$T#o6zF*)(^b=$x-Axo2+Yf?^AY_UVfki>XfA7o&bE`JF+VDDSnz
zM#+`xmlLJbH2YKAodnaY-%Xx;HZ?!-UHhITqMG5aAKa1J7=NMnbodRs-Or3pZkL`V
z8R2?UtMyF(wVvN^+;_}4{xRIzVCSK4Oqa`;I^P}&Rd{XRSyd>MKL5b(x$Wh1bhRHa
z#a>Qg<=XmX@3X?7TcOz&OI=(2b;WNqZk#4|FLatai(=mgyVUucKKJZl`7k?g=c=Lu
ztBN0F{?MP_v?)2zBUf~Rqzj8&Rp<A^LWczXEUtK-Wb3;&^Wd!h;P6=E=EkVdSC6)Z
zOgyi-_4FDCcikBNT~DPYLbkGh-ykM%qIpS-_OcDC7mxc!hcQn)yMNJ@eJpaKW&4^m
zIX4PNPWjNBBFS^6Yq9LBgNNMCsI%y=X%prxa;VF^|G?*hV@ss=zbnD(+{2DtQCV1O
za^-dIq8<*RWY)r<FH!&cWY(W@-WI*g{`a%21A#AEmPzNNs@yxI!nat|L4-@PigQ2f
z(FQ>cnT^wTxpVN$aJPGTLE`Dx+6h}z^(LL)yUl7-rh;Nnuy<PE<(IV*%o`?i@U8q_
zbb;x*c_rT?%MRWipUX#Iua@82$a!kT(HxhF&&3`$2(zwQ=(A%-UeO(1S-~@$1wrS}
zse5{?Jrcn^_jJ6z{k-|{tm@0<8CPeUp6^)9!^v=5o{#JAuBVd&avC=jmahL`@hW|}
zy~mon4BO<G-)*hRIk1M=bkEc>UzTXoo*8Si)HA0ul&(Khwzl-?;}zLcYjU61DjpLH
z^>~!^C3A(j=}~j5nP;w?I+?X`$)YS@j=N7b6{P!LxXgaHWu{3$sEW#s*X?YJGgBU@
zB&xjlut9@WY@^Cv+v&PSn+0cd?QNgQZ$2fzAywui+w50qfAnA8J9S{?VuQn8pF`Fx
z_;hN2lx}d{+=P?Y3I%d&a}0c5uM{{wGa+^FId}7StIsUIIX$Ggfg_6l<p;*K5;d8s
z-ckNn5**%neAkkiz3$P0Eyr2bo1HsbRW;Y^<yLuvrpxQkpVgZ#T^ZHPDJ}Zt_Ex)F
zQ9kSbT)+A3n4rS4M6>8tW4kOiAO96ow$CqB(sy_zuH*dKtg1Qd>BfJTG&TfRm@d=3
zZGIq=d2Xmw)WIuzPPN~;cWRgJzGd2d=fXryR-M{&dGg*D71tK-JmGwI_tVYgCuP|h
zSEt@CU0TWdKX<B#@BQW(8;o_Ye^TQ8dhuc6wnrbjCS3h)H9PQm_?wIS)_r}vGV;pm
zSC0-o{An^-m1WD+!<mJRJ?Y1cYA?&Gyx+WiPtUUlzKMwpN~~{v*FG;erB&;`uI6rZ
z0^^D+z77gfa+BEle}3Bao>MvcXZGTv-W&FO-Ac(<yvx=&x4K<UUz%~M@X`+(>GGC_
zQ$Z3p6+=8Wm~8c`*mUDT<JSlL`cZYS^m5X7OP$NhW@4@?pSfaEZ|tLuZA(4Ne&3LI
zd?a_}b~jNQkt3#Qzce&{Yzl~)Vj`7c;k+=B?V0`ic)Jb153?^gDOgka^~2nY8cRQI
z(Ky__Vah9IjuiefhWiudI2x=Fy?(%Lr?qkVCaZ*>vkjary*$NJH!ze%dY`{;bnoud
zhIcwUZZdpx<~#G@->3ZJn>0kGakg9)pItO>_Q`x6=YaULi2^51|5mB~etJUp{R2BK
zJNTAW=Cu|!b<WW|5~wDoQFvTg=K1FM9c*C^9Fq=ZeLBfwD)?97Miy)TjIRxWXKD@3
zi_0uj_%kJ$sbN8T(u@nUL~<4jH06j##5*glapl<g-@*0fD@%Wg)i*X<IIulw{q5MN
z@28}(Z{ezv#f#Qy97&%2Fwpuy!568Q9dAvhZ+m^|yVBuzzwKtd5?a4S<nqiQ2RGrg
z;A@Oap4Ri7=ZkswJm}=IIvw%uh1cB|&)&EH$j-GNm)6W;JaE^(hwq*Ip0<4jYioY}
zURU!fN^;6qt~r%liH-VO+t^n9&OEW~09U{AF5_AK3wLN|eh5+c)udbb*Y43R=I1S9
z3HLWDPl{DJ^^kYl>`G<vs^2<HGZ#(~EK3jiadMCU{2A?HEK3-C#5h|U)=zyf`+T07
zX8wDY$WosdO-;TBkG>K-!>G0;I*oOrnvvqI_DfE$yc=rdH`?bc*1N9pl-XoS-B+H7
zXA80n4tt*v`?hK7jF;;KmP7@w4{v^>5gPgXRN9TY?wdZBH+kIZ$htm_k8Oj#;r-iR
z{L)^zh3<9_Io$Na_<Vk#_=?n$i<=Ub%lDnHv#V6@PrbmvamwHvr$DHAZ!pV*9}>(O
z@dw+MuX#7yNPNQr(`}idr$X+Bp5`>!^>vD&$wHGmf7+TCcy;m}R$usSt+CTqF^Sm7
zAEpPo0=B2hH2mMhS0<5hbZ6L%oIfuN*4z*Ou-(+Bm;dbMiL#!i9NcHW?Z{HNam66E
zU0QJ`tG}?WbP-!eHDk+8=7+~Fw6`0cUViGdtMQEVFxO~l=M>>p<qwr_W;C^H-il@D
zag&L^bm6c}h@MMRulWQ2;8(lVjw(j}DxER))ZJxqoGEtmKCK8@8_f}L#`%Nc>P~l)
zja8S5qF!b>?Ebdi{7R?LvWr?rr>*RtAwT8jv{^OlYYL{ff6VF(&fYE)!}@_=_{QQo
zhbdm14_Wq13|%QNx^lssP~p`fb}!EDR+&~==fe5;LWZ2$myEu1U%l;1gW3f{o`v4{
z{>vfshQuXRH;+lj(jC&W_KD`{FEM+5DtcD%b5@6gC9IQFmhoN}?pc}7sAG0r-FSn4
z3hT8Uiq=ky0tG#G*7}no7s>Uoa;>dQEVDgQDXQQ2(t$gCuHQU;_Dz19Cvm7=*7RxX
zkd~Zq?8%QPVP+|x*14w-ua=t1lgFQ$$x$z8G|4>R;7Vn~+tZv93>-LSGVQ2+x!F6f
z;Hlm0=}&`t`1sNsK3ru9J<quG(8>PE@%%!H3{#uK|9_l*Sbz4<v!@q_pEKUEreN}|
zDciz6WPX~ta{93cqVqUyly1$b6t6seXO&3hN+!cKN0`@1x}RHf&)wK4PJQua>#w4#
zr}tdpj1bV;c_Mk*ED!dKomMAK-VdA-$n^U27Wcf%&)UjXhnw$-=MK`&zV$6?Z{63P
z*2C3O%bwWJeQ2@#vzw{V)5vXk+W+mv?f6*g<*%?_oo*%f^lrL*Xi0O6(t{sK-BJ6s
zB3E!(I-HPMQqarvwq=FD6^RL_FNc;&8SGwk>7bC^i+S^GH?2(EVivq-ns?j68!fsA
zX16?M;pMHWd;H}4<y%igZ0>3_C!Z*b%ed&)8P+9wwegE~fh_Z!h))_bC*5SQ@sJdm
zv(NlWMCuoZ1&cV`ChT*nO?)LgYem8-UsEl=^B3jr%l!SlaI)I-h_l&qST089vKkzW
z+HJOS)2DTzw)2i231Ld8zM*u+%xm!#fs=NRYJ6u}{cZapS#?P7nwj>Z-6F}=@nOG@
zK0os@)>V00!g==nd<W;w2<-c@jC=1|silV7?l0xey_&vv+v@hK_v4al>Myt~&Yvpp
zd+7a|^oyG-V?6VMCy2HjpYoXRSH67w$~OH|3~|;gg+6m+v_5BSQu%GotC@X};m>K6
z=&kqaF0EWOb=%dcPnI3cO8=e{H2L49oea)ubz--&J}wl~d?foy-+}2>Z2(tR=&YHk
z&F*v79N0JQy7Z12uj54%OIF)FyY-%>k>~v<mMyj|!k#U02dwn-&bEfG`oOs?N{{u6
zv{(J*sCQz~6<;R5*-;}?K1X3KZ$L@WRS);Ko6Em8bKcB7E2wpb!AN@sn@PG_xL}?2
z^Pt&p-k;gI<Goej3xmIh_IYs5U{gA>W!=$}k(1u9o^<nK+9mrrPs-oAYz+>(!@XSg
zr3~Y?m76>aly@C1kM&hNqjva<bVg-Xs@;!gxA*U{`t|MpKHC|t7XuW{r|5r|ek65R
z;7lQxebA21-1AQjO4hjBJ>>9J+NoD4xAv9!%LT&ola};<oAS4xC$Ml~VQJt_8>6#b
zZrP&C`ch-&XH8GIp}enc@wd-OWd@8~kF-DWF^C)5eB$44%V4b2JMqKwr%HE=bqbt1
zCm#B6p5>Zk<GBW-w(W^WZFJ_e_Sq#@dhJkj&X^lF`}2&C&EAQPfngR8uYc8UzwJ5U
zs>Ji`#3?>UKUJR1JKHJ$V5OujZ`RKVMc)p%taxj&%J+5Wrk5+!8OtgT_<ni%;M_uC
zfrVwoWk#k67O&fmd3^TRqWAjP+RrH;9<NJ#*?)EI^UU_2a@HcRPssZps|k>Nw@7<S
zqV=BReD?E7zRrkn6|m;MGDBL^dgJoV3y#f{Y+b(Z_aB{IFJd%ea{Axhvz=5CBY#rw
z)akXmtx^SYpULajT3Jdnwm2M5$&*;tp2quqZ3~~5!4AddQ}O>U`PKZoqCYWo=|#?8
zC(pA=YQ(#3e0QT_`O=>^kC#^m+=zN2@*w!XVvCT(fwTm*2|QaDva&6G@Ga$l-8z?>
zZbkED-}8s~79OaO3^bBx-riw!uP27%)y7lCS*zKbb%lN2PQGm}BM|w0GVc=`<Fu=O
zb5^l4t==B3vioMt+?~OXz3Rhq-aias2|wdmw<`G3lRmpshd9;#U)a1n=E0TF#fP?j
z?Y6Z_D6IOlW0r!1|CZnEr(BLjeq?x@w<BG}$ojxc)=P}@rn`H2a^~rL4lR|MRHbz%
zZkprnytAt=>4coDtlZqJmMIXER#5Oxe8pG4+>5qr{id&RUUmCKko~KloN2y$n}Qa7
zvfXp(Z>0Fnz<b*o1*H?F9X(a@+NZEI>WD(R`WGbzi94+~U-HYx*Z-L+Bw4!kc23Nj
z#`|m=fBa01pQrpx(5m62lx=^y#ug{_!%I1mr)qX3JQj)G`m{%(<UlR&I!mqQhcmxT
zW8^;*r849C)Nc>`H+;V(w?j_D+<x2B{ZmYPzVMeZWK6w~`;T|_=bX#&k_9`oTi><L
zZ_}3vQuj8?_&udqy;sgG-F@l1Gu$lu&fH%6J&VD&Jmf#ae38V<UmTMUo(tD8`*XP}
zto>PqmX!Vlp>FZqnmYZKZMLc1=jGdd1jDcFydeI);O#@#v)KZF-=9djdi-z~uUGNZ
z6qlv_R}HR67OW6hwbIvKa*HIdwOmQo_u_4GN00Q|ES}X6z1J!ItV8{rt_8CmPvHyp
z_dVof$#8j9S;Wq@hobh+(l2~{Dd@M+&c&}1j6SaY&ERmxdtKDGOBD;|%P*dO`PAwq
zGo?SIbm(eb=lQ++!+iAvJksy_HYx6#&CqjiRzaJ-x5sp&eKA&(ip{66XXk~K28Wol
zl?g7t7!w%!R(7xG?>D)83+omaJKE;;rg&9IasQl9=Jf7Wn~{T&ZhFH?sY_Y)!OP@A
z9`g7a3mSF(aqFDM6>U26#a@}Ue(hPpX_x0;xmkAku*A<>k2KFLPjKlodd9fWX0QDb
z_2soeo1-^>cDCGg*qB*Dc5dLx<+sWrZZ11j9L&d+8vk_le;$PgvU&z<^*`4h)X{t}
z<?7K-X6KaOOlO_8h-=N7u<&~ozUr~ptNGSSE$qCjuu5&0c5j+H$G<@HYKdCqTOoqt
zFON+$IFJza_1fjRvhg8mPX$<3FHcC=T|MQoV(;EiOWC^apLrI$zs=qjR3%<=ZBOg`
z3G>_zF#b|x`g^WrqjT@1?AQm@BFB=ME4NR*Xxn-8>%+5OA7)fkT%MBf`)0Q9x*0|_
zb3<<XseYbnYW7!qRb>(5`NAM0->>X?y5cV)Zhc6fw`<$Y{fhAyG+xazn5weVD0{6<
z)f91o4BgLb^x~Z^TzeH{5<Y<?rz+*zPR%Q8uhp35dZ+I@DEQ-Mx_aV9wqsK>8CRFH
zmGYOJT=8td{zt!WDz9^vGWv97Gh5b^b6G5or+Z>e%yu|_)smX}VoC0d8{2mk$@*Vu
zY!?(hc9!j~#nJlL?t#9)vwsEo3mp?PZ*{x<dadLZ*W}ifepky<jYQXG&xuig=yU&C
zu#fQPYZ*n;EQS9bNIQG|hTeqbtJ?HxPghFJUgr8~)lWBJ7S62DkG{d@tX6t3-+f=$
zctA_zV?5u>t+PLiMm%m@6y=f1d#h^l)%|=CTR8Hq=ch|aoc~b5TWGzrNa)fE>23ei
zS?6&??N?pLy{7Ij+tu6iId<P#SJi!O@%!nUSLn|-Ew%l8rRofu{ju4rX7RJlJif$+
z;jyW*ug+YvbwAtgzWWmWxz_vH-goVpF};q5ik_@(e&Ocqy~*;{hY4l1_A_3$25&mK
zvg&@(RIx?j9g4Y6y*>VkqaLgCJL87LA0`Hd0ColjWju@93UU%l((;RP^$IF`Lw)ma
z8}RJ?9WL<ppqZF-Y`KKMg2P>Ace`>O8=r1a<lwowOjvi*6Hl-3|GxwObtLaTy39GD
z<I3a5kKNBb{C)Us{|jyZK&hU0##5#}m-#BQ&U@NBgIzuPdy01irY`+imj3Y5qqn;|
z>h2xRYX897J88m0VXjcIFA_SN4lNd6Eo(lZxN(A3rsQ-s9orKZlCmsqg|bcupP0&4
zvu%Z{aEeZ#Q0tV%pVP!<xE<1B-TWlNW!aG_FO~}A1TIQ*3UMgUIseqGXK&1Erb#OH
zH=2*BFvd;s67HCC%1Hc5MX&##6Fg<lZtG=jUF8+Ci79<UhUV98H#_e?vOId};nob_
zAX&MW+tQ;=)*9-~aci<K`xdoXZqeSYp`M-$#v4A_%sZ?V_qQfO#eBZFdHlQS^PkCG
z$P^5;D_onhw)}U^#rVoNtr><P2ZA2VT~_l?W3Tx^ljR#6&l;#--SNcClc`y0KBMc5
z=6a@A=M(<7zg#<0cysi;TU$3)x!u3M=~jzCZNt(@Hy-Rv=2Ly8(9^#ocq;RJ%eJ2r
z7s_92-0ksDa81BX#{ln`t<x&H%|6_YPTF?w%RUuZ^DDX2PKq>NOJ_S`_U0z9<Mp@C
zpNX_YEi0DXcey9{{hkXv2XA_O+&5qQ!jInvOj{Q(6FbqvI%zep!2GXY=Kd+v=iHd>
z*|YO%pXS!kNvjquvAq1>`*OV2j!u^QyD#R<lQPdZFi%4KO<=(P<zLTS_;YHF+-+s$
zdY7rQRl?an?P{88_u%4-XS1{vk8|>RM#b{#-zgMT+mYF{aq(oCjZJ%Ur(gcGySa4L
zV$0&mt(Oy)EYqLblacb|+Ir4t*#wKPHJVSY)p+*3)7)`KJ=f~>+1GWsP5%q7dSv_h
z`IIi)d(c!h)cGP?S*VO(TKTz``?4F3-Tm6&a>iiw>2$5+jW4|O)dUu++>g0xaX4y%
z!{r<LuPb8QzFc?6Ru2Dav}!uH=u-F076z#r`+rM!@VMEEnR&?fM*qreEL*;baobgy
z%@0Z+?7MBd{`RxiC%4@a_;~S1bv+|$=E<q@lw%TSU^o=Sz@UgP^Hi2(<mc%XR6ez-
zFTQQI>HqKG2ajF`WT~F&E6zOs{^v8xjgx;pIx_FZPL;=55nU}R*F;VVrHI(}@Be)}
zmO;g%Y18F%XYZW7ykx5jL-*07`s9PLWu=v$GHc{mZ3Js-#6B(QcqVwB|7PJcc5l17
zSMT1w*)%<K+sVa8HzoLgpJ$hP-TU0VqKRrcPvR@)q-jeW=X$rktn69kuB3V9`rSs)
z=N(@ZI_(+j=gBI%f0Vq0H*Q`$@9b$6jY}qC%HO0Jq&JG}6aACD@!Ve@rc-~CB;Ad9
zp9<Bzx_DHrdlKts*4<&7cddK3-RVifosPASN)|???|ZPzdD?PD@k7xclV-Nvds}tH
zui}`ng2M*OzfvD~0!`)jEuD9$reyEQAJ+9p-QRr4KKS`a|LbjnyKi+gt$(G?)ve(B
z>>|_jwS|?Q{_7rkE-ya8Ehi#+sjlF){*Hj&V)+%*^GmXAe@xA}aJR^zaPG71yOb4X
z|6c#)^0_%T-#R^t5d2%F82F~7wDObcsmm?f;=fMQsCEpiDy|nj8XB+glSxgKP0D4n
z_s^Je@6J!5>$!jZY|C%Re)i_p-hVZfulD}=`Q_>C&E@O)%Oz?u7Cd3&pTTZ%lciy{
z$UGOvjlt#b)bD1``*5e-Z1LvYsms4AZ(jb)`tDoZ69H2`Og}B6;-e&RWS_vBBIY|&
z=BT>P>*9IADxuuh%ys+W!Z&^MH3VDbkIQj2Td*i4v`Ys*QD*x;``X`@>A9QED$Zuq
zpXtB<0M{=6=a%gA&h3={wBf3h`^mNJuTOBC4O@JJ<D>$=(wBtlH{zd7;$<H_ma4Oy
z?;bz<{G$v}QJXJ+bUx+0jsIiwDc$hC*=_N8%IPN>zg($q)OvVAX`i)?*q;p-HRt|4
zHnF?x3*Wg#DtGR0_k4fgTflpbOq+)C$0=M#A|_p)d5UlM0v&Uy=xOI78DE8I@i21t
zE*20IQ)RS?IVAjJ`w`nS#}8CVH!+-<v~KT&^M8%>Y!++~XPEzR$@R*UUv;Xg9_W9&
za`%4md_#MdxP-?WXURPKIC;g5o`XUx+Z)2TRy@g(`^_DucJaOHqoa$Q7+EYjUUmIW
za1EO?uj{tP=PyxxGmPcJf2sBqxj$l>(R8vSLF>FUhunF09mcON)}~2qKV)Y$nI~<}
zwvXSk?awV+KeNjZ7asJJJkRdDeU^ga)U&%A+P0RQkz6xXQA^LuD@rYqSJ2*){r9vh
zlM~J>#HI$Gv29_^UYgF$w=2MlJ16!eySW3?jXgVfb`~sCel}zAoW!H??@wKQ`pn-T
zJZRk}-|o%-_FuGg@Vo1kI^nIxgi||G``Oms&suuhlVkImnh2%<cPTyleLKs}D?7T(
z_G7$Vo_WZ<SM?G*&-8Y&O@>=qo8<BYWI0y2FH$;iP3>=0nX6*el7EYwIuqOb0_?Bc
z4%R-%_E(T)K~w#%UM{6A*+;%C&Wqo|pXUB2x3QxyBSS+lCUyJltmCrNy4-9FvYdCF
zwkz7k_O@mB)TYlBr_FnAu>P@{xXG0L>dtTGO{tk-O@%>PWwMO(HkSl)iT!GQFU6oA
zpuA4maaO_8`$a3)9_%p=n$^G@{VQ@C;{!jA`27Lr4N^~RYF3=Rd?zE{otHJj4gcgG
zhF@8pxidm3X}jmHw)u6A!Y<36J9scoDm;^RhoQ|zzS;WPlzAF6m$#pJ`O!gU!QI&A
z9e#)Z7VzD?`*+1v$6vA+zMNw3d%11V|BLstekt1So%PSdfBCfdq{CbGJ60-Pc*eog
zBqV2@`{PM@&g+X`gSLHLS0g6vG^;Z4&%E8~JbUxsrLhH0`*L3D+T1H5h6|=iFJ0rK
zo^j$>{qlvpwMiWo9TS)Q2tK}S>S}}4lWd<@*gtPRRbTLLwk*T1WnM35K6=3K|MC0c
zYcg3Glcg?AR@92Pw)gb96|r1zIavGZT{k);sxB1OJk}*qI7#5p{u#d)CG4LrFqQLD
z?Wq=Nzui3yPvm19__Q^PJFH&YEeY4L^$_HfiTb^!=g|dGN4eD20=HQ)a$Os_oy?DL
zRNPw<yMb$V*~BmU8nfjkZY?}mW0CuX{i6$e_zMqqld^4+JhyA}=B&Q_nt%Fraq;Kj
z_u5wnzkl-P)vv=}Z~mOxyzHc)E63>qsl!GkhYoMid7*#4_(jCqm#JL;y4C+!$}^mL
zqAhc<{_rd(*L|6KywiCV4B{UgTPfew$dX?m;rf2lar<?8_vU_3;Qg67Z~0EqkmIuw
zPBAFGkK8F?p?}$k@1*-m({)_;ZalCyv}t*{sOcfko81=@?{8!jvM4@zUUK7^sb@N5
z+YaB$oYEM+#OjY~Vb$+#(|5Cq1pHPExNvlVS%;b+tB;(Xq~_rZ(}dNxUg0d;v+~N6
zmmH6lZ!%di^*~d1(uM3oH<Ona)c&d*x_Yc^kKonr9>=GbDvRdbGC%es*CBAuw@JEw
zb0)1ym1>{yx9FFw^MUE>)2vd=WD{bHO&9t%*U$D{_NrB`SMsiyWwcjZ<nnoeQ$J?$
zuIBN%pEH#)>wJ6KrhFr#g=-m4F~5*p^tbt)!sRdD`SUC|f}PWo<vyL9;qmtf&kR)=
zbM6~1wc(8d7WGbEMG<TUsu^#Yzb~K2D0I`7rGBrD633ENB|@n#0Y8-+5?-ovOYkmB
zWXp@=vSo;`c+h-9W$oJgsY^eI-$~WCcq6#8Jz>j<wLIElSM$;}6E<JiuPpJTxB085
z!&)_N=0`p3b)9<ZQHwnK4m_B@@W3VK3to!^+7@T+T9Xj^_rW8tF0&b?Wpb)d!=ubP
z)THNph<u{%+{~AF%Jq?mOY1C+LrZQSa<`ut>Nl$>A$ZA$ev_*`$6wxZ6_=5Xxzl!K
z#vvYovYT2?wPzPO9WdCiKXBIWH(ku8T}s03lTR}Fq+1@okQ6lA^Jl3LC!^foCpZ87
z>-X);-Zjyd=lUnp<vbrYcx*0NEL|99{N5z@w%CPrd++tERN$F@Y*9$~zx>QR7H4*T
z*X*~9{%0#RZhIUon0~@N>7}yt`HGFtHk4b&I|xj<{A?jlpLU>X7WdQ-hKE;ca9-Ye
zLDKt-XrNg9spMJuZY(@53J;Eiq@+8@x_5FuD|)=w&f5L^qaR0qzU1tPnAd!;!~6iV
zh;`%1)(zeAQJLIQ$+{mI`j;EUzinA=TD0~umwf_XYR#oXM|_qroLl%rIMqq&r|@x)
z1r|>V%#w@Wvc8^^d)atq^mab8-8cE|8ydTg%d(Uh@Xg|jn69m}_*U}*%buc_!ix@-
z*LyEcxnQCtvfrv=#iNGBkIyXHwp_6>z|5;|ZeHS5sf9Z~6}<PExug6ROOc;nd`-pM
zxplkBCh*VR@m2pv`{J<c(##jO7@z#uy*d2(@%8Kfy^#@}lPTZ1Y-_}^v?T2YyLm}x
z?_Bkn{`+Uzf@j%JZ-|_6o8;?ca>t7M_vCxQ#=-U7&dY;J<^~8a=20!4cWGsvoX+bE
zZjq$v-?!d>)U@dYcjH9?7TbhZ*K*IcM}Pdf{Q14l>0jMK+S%vU2IMW2yC}roB5M2p
z<xg{`O^qK5C*E(HEcb~+@@%b-c4VI_d-3z!DSQ5{U>3Y`td&RYG|Oif&(ckY-bq#b
zRo%}XF3udz_e-1Yy&RkVnunEdi<|ly_S(KU$!L<9EXluRr!&Kb7lMvbzgG*?-TB^>
zopVd9BiTOwEAy*>UGwLiV|O*n-7k{(d*utBw`bxxCvM_&bMrXLt-))1^P#)f2`SUu
z;<F1>Cl?*PRpq|wMb2X1j_FGhqqbZz*>do3`|+;SS=*1htv<uNyzjZ~VPzkOMNx|;
z*WcWFE^$laN>}bTvJqETdr8CxRk74@8>|)HATf1!nYw1-`(OPN4X*SYV=LYKNiFl~
z^x1nemrG|o58KzerBu6lQQDC(bFRR3^K_aXbk;`k9L;{DW&C!6^<r}#Ij0YgZXAE?
z&gPMzWKeL?vAgVDf`+4Y!T)RA2b>C@Chtg;vA+BCVLQvUrfU0nYcro!&9mNl={Nhb
z&2QH@9&6vbpZ#Ozr?8Ezv)c`;j<DE%`2Dc%v)1;Gpz5`Ad+t4+_Vb10FZCO#>lMCy
zl2l!ta>CGvdD_(d2QLeEsH}QmlQmcV>VhXr=I;@Bp1ff0P9BM}@89eGeEfNVHIVVU
z#sVYNo>zbMHCetU@|%dvDeV$86umZuGs8x)zrW>_xcP^)mwVVJZ88yfafoeGqgUJ{
z-RsXkD{qT)J1BG@Y08;XtyWLpGe!S8sGFwBp=qxk&TGt@Q1YRoyLlD!o@;gU0_3cZ
z%9QgIR`Xl<XrFLt)^eJlSs0*X#NVK}D_hpPdzrJrQn7>1tv|S$ylw2fH#>=ZXr7`f
zyFan_&;qTmjVqk`%iGE<Kes-Z5i2f|>11NLqAlP{uDojblm3M+$-gh$Ox+)3EvCPA
z(f_9p*Ryd>@PDdVu4p)+a_)kb1!j#4#01##VswuG{(XM_->Z5L4lSNI@5wUdtwI9)
z&6gHrs7@-gR%_bx!GtyC)D^3%b7o3Eyl62Y=Ix`Xlh@X>XZ%q1%=6jqyU=^W6P9&{
z1nzc*I@TLpe{gk;@gZT(64gCnhyRwny|W}lnf30WC0lh<=JX!?v0E!Yqtb1<bpNAs
z+tkzRG(y)eDP8bdDfWWb0W;>~g>^S~_3$^HQkKr@kZ7H9`u6JjeJ=kPTbtsKPwCK7
za+r|$JyrY5*GZ?d<kudU)bw2P$GwD4p>sTUZLqYT8~FR9mgv#27mOU{FP2s?-`k^+
zd@FbU*;)s0)%h`HGe2AUgsn<_7Sm>WWtXUh;K2<#cSUbZo%N65X>?Y?^hBv6%?Cff
z(0&!Fb-?NI5d{N%FMGCg;=U^~+NKn~IlWq=!9e<kZ)(8yBd+~ii?>(Z=>ORM+NGEG
z?PKwDcJ=4apQr2Jli&aUkFVdEvIAuu^>^0RS4cir|KAk)<v>k?WWt4$H-C5WOSPI$
z3pVU3UR|Ognzdg;ymZHH$2&V6K3+Pgzv(8&6OXW2F)=6K{MUc*=11hQzcF*GU%Wf;
zWJ+(rT)$XxKYf2CHeElJt8D*gs;`-GJLpiwfsnrLyNMg#Dpmhxm0jy}xFEw;Cr9P>
z)y>kjM`rC<`{_t1)Ap%5wz7P<RS{LRYk|b7_v;G`Ba;mU#VceMy==SI7@}fv=weOq
z^=}FHnC7%8MSQYi-+nBt#GrWTqkz|EegB`Hv$r^BUM|Nf!6mmYmCki8@!rI8nz!P7
zn$pJG$M3v7l6d`d#?&90F4m<_n%llF=$%q9J;6t6jyuD@q9xbv94~)w;l8|4?#v|%
znGjda!-6cDD|Wvx__J4pwe#QHmdf{kPMW?8d&nkfdPJ%`&UmlU0+w_0M7KSk!;`jk
zd3|-z{`*b8n0F>s&%2>hwLL~%B4S?e8}^^keII^%Ma~wwd-c}et80~OC%C>`&Ay6h
zS3}@&7TvWMPkcPd7t1#Fsbul<F6Hf-p6TT~90J-O1pipGZ>iw&m$@?+wzH%?`jo0X
z^R^jpf2&=)>3M@0TYMM4I+a?wKY2=jMA^lyZ!R*M9=w*Df7tN5Yx9I{llrn8H>mEM
zeN@-w{j%u1^;UToUUq6JX2^NiGTKK*>uqS8bpNYb&#Fs*EOtG8aI9@p$h<pOOg<R4
zo!fFda{UpNXL^_7rt2oGi<|IHpS5B#!v%hYx+6@XMZZcuIWyZ9)MwpJy3J@2^k}2|
zrHB*XCx3Oh6~gw+@S0vVW0&xAyK|c)w#81@b!k<;F!y@+1gp&aD_^uLOWj_T-&uCy
zyyN4Q%CXNseg1l0{C(VB`?~61A0Pdlefs<I_2=wtE4;#eSJr-g=Q&rl!1(3v(|w00
zJiQbcRJvV3?D2*(k38P#1<iddYJA~&uKb=}*TaSL6*dZRh(-9=B|e<NU3dM6n8vmf
z`sdf!A6vZ9<!qvT$+K5!>rF2f*T>GD^l$T_S#0u#EK7>MnJEc|Zo0A9;B-v?;oXTY
zI@hnW)qcPA@3Kzk#*4Myzsv(x_rA@zUn;Xj{tx?m$7;?0Y+Kf+3K&0`;k&X=>!?Q?
z-?FbOv{xu~JX5-|H=;rEr(wl{rvK9!{o}qk)i)fPSUIJ;X`R~z|C>=iwkPy#l2J%H
zTJo!Pwz))I?yVW|HyzT}?-%#pGQBgnrvFyZ2Pdm*`=>TtvhFy!A(?Z{&Rz}C$J?y#
zEZzFj%5;m7ZnXKaMT#}c))g<<|F?E&>b`RM4cX^*yz1_B-MR2b?w?bVH~alUKc(Gj
zz4NWVG<ojj%-91tx>GN`pDWb6PilqS?nKV!=u(wXgF+R{_kt^@i=_xZYQEmJ=BjF!
zZt9lnF~w6@=B*1^D^@o#So4|an*+Y(UDw3s?yau;_wdP=Pn(TpO09)+O8a#6-`HN^
z-MRIZl_|^C_50rN_{z?myzs=u=^BP&Y|&luQhrm{HB2dIO}Nvvn^RxyW=m1s<FB97
zCyTO7)wVxa<)LFYSLV&%()Tw%|NYy^+85}lxieR2#r{ai<CFjH-TSv$-uGb5f(z@+
zcQWL~u2A{$(>VP{?!D)YyZ>K#ReNjIw|jAw^5^f_)|Wl;k^Wczl-<00)wF#do`^=p
zE_tUHxMl9NsOK5InTr;myK;E;-j~Tr*{?p?8!>9f+XYBEbXe|D>bHoyk}=)q<)Ue?
z`X+DQ+?*`Zc(wLhqi%ES_4=vCyt%#7FU@}MyxMeYmwE51z+0Qn?h6Z-Ots{>dca~@
z_K!ZLSL<}7ukDhZx;<)hRV#B?FuP{&!b=wfpRK$mGp8VO#oUFP7j=i0KMgYraK9TA
z_Wh^ng~jh?E3uW&o$j<_dVbvgmIV*rY<=1*`0ncS)vqsa|L(ip;lA*T?VqpkPLpv{
zbP?GiAALe4SzpGfJ+^nMtf_d`j&HNJy*PQ=TQB}nw8{;m<<;#T>8bYNnGs0>%NN%R
zFEN={QoY2|fAzDiomZyq-hOrNhQPIoBCA)Q_Hot@3BUVk(%J`1lBMT+>*jI`SlRzS
zfBAcOy7+qs+r*zcQ$0$Zo!3`#n=dd5pL6BJ?~-jRrmkV#vzqIU`@*|ke=-zios_9`
zKeX`mp)WbB-`(Aoqvf~Uhhb*nGmE*A(WQGHTPMrEd#|<UU2pf!NxbK`*h$wH**|{E
zTUnNn5_&DB?Y8Sa$A!~Qwy=qWbXE9pJqf+Wz9!%Sqb~c|jzx>r_XobcX?I^Be!;!s
zUGL{^2=Ub19ct_vZ_{T!ap#mgU;WDEk*|CmU)p`rf78CcW~!+4>)QrwcgycJbiBHv
zFs+{1(f!T4eal_A8F!cNwcL5`+PqU|E;h{d>o?)s+m<6?F1Fc(`SIUpTh&$12fL>!
zXQoy;u9RA;+o0FKzWyD1aPRJoK7C$0k8L;JQS5PfkyHJyJzSQi*S9S`{>-%QFXMih
z;`VQzFZ*<M<S|^GBBFI>MLzfU=gl9Qk4oP7|M1Pk)&>jBpdN)Ue2WA+BRC~?%I&S4
zHsSc(nN^d5CozQiWo?>2_i8SK2>VPO^PJUok4>3MjD3!7{A@ID^1jL8|0?<X_}Tyc
z*xOUIYIUw#L)p>iVSTFe48I#ry~th4+3{1cTg-FTXX*VKpEmAUBJ4MN#`S-kYMP8!
z7F4YiXK||({Q2=f-_;eHM58Ts2B&`vj4ipGH}{OknINAdk1ob*uhz?cw#2ODX5_)J
zFG8DjdWCk~>@A7CJX=9SyMNQ=Src}1U-!7>Kci-HU&-I8TV5_M>iEHWH^=LFk(Yz=
zk{W}Zi;NhR@~s_Hcvl}V7VY}8>h#mICM<3BTld}83hBSuac}ScYkOa?edwQc&urtv
zmy*V>Ri<CvJL%t+tJ|w=M0as|<<8hPd4c@e%l_Bj_pdHy)~@PgiQ4^lZS}X?c^p!H
zQ+6rb@NJCE=07lj*=(Zs+&QNYKlPmICpN3N)}}v@dET!0+e!;wE#@ovDt0$y?nI_*
z4${h3v{tV^G{tVSPrl45o4WgJe*U$Rb&sB&bK5#K=Cx#b*_Z0Cd0J_6u9Z87&bawT
zmAg39{HJqyi~C&jk0-lkSIt@S;jH<wiKpf~crCu>Y<~a!Ia={s>rO6k&-}GGH(y)&
zEzjAj7rPf{WPW)o_<EA^zb}h^6}+z%7E}6Hk2-*^C>PNmB*MTD>%+hxi)R46umrRX
z&L+3`_Ku79|7sh2Vh>2}^eftS`{NvIUzz9Uiv47+@4HtT!_Thd*x9cU^sGB)?s5AU
zKc)Ys-aX3AIcdR~EuQPI`Xo(c5!-!W-}|85Pkw#=9e-SW;`zyQ`p+}Z6A6^~_-4kQ
zSfl!5$Mf%mTkn2i61#45hL!e-+2QN=OCPSUS1>pBv-@P@>v165#&0_J3?Hs@V!fRI
zf7H+T{LJ)B<!4z-e=fPhhjV78t?9UwlCFN{66?o38+1<fRLgaWeORNQ<9W%6=VW;q
zTl2x{eNQ+SJYVlAad5hhdg82!OcQo!dCb_zTJN!WC%1EXnMqIQ`u%A!_1?uhpG*?n
zY%%M_SG&VY<$~5s4>VHMQ8(wZFF#bYuKn7IIkvxQIxYHoX3JL^dNXhBdcE9J!nfO`
z_v@G7!sl%7t`uK+&>((C|BHh~gXQcZ-j$02?d_{|jJ`SEf6EYkZh6tit|LD~*4>qq
zGTQI4xpevg{!fik&t5ThTg)wcr>K3P?a;gSC&%{wy#3tx{g>mLFV8<`|F>X|^Ml1|
zKVBwD9<6A&+IB+vnZmp^vrg2r<n;*E&1=cbj+wHwGr@MR?pNL7lm(q#6<a?Y*Es)h
zi8f1F8IzpQ`+Xml?fEb*a!V5H_eDqgPd7Y2r^Nf=5Vz8V{yit$Sl&%BT(7@J^aAT2
zg?BtBfB0_@77vWObLi>ZJFT%n&s4h~n|^q!7&*<=?}}5(v6%^PG!%b_o8SAn{PpbZ
z;^O!E)AR4o|NFEmUT@p~@E>(`KRx4Do#ZkTm(g@-7FBtsqn|K0{zr=3LLb%*)|WLp
zgFYENmK1-a{7|6Pk~3(Yy2!c7qW^eOy=?=y8v-`4OiS!m^{MLMGJJNS_V1}$--Id|
z)u+ml%T+5qPFpB!m^ka*U!(KiuBN@aFW&w;oHc`KpT7EQZP)X4|ChusVp#C(t4(ck
z_sW`2!666En6G!-c-4H>%q%T|qEML!YN{=3BSbcH2CP1>>62`sF7%Yef{{h+oKT<7
z+r>329vrzi$Nb}lKu#uM)z;(>{j>ESuP9jI-M)SOyS69QMH=OT_LA(OGbh}(?p&J|
ze4uqsLsfC$=AHkiyLF!2!23-`>x<Ka!<-p21q-|!i-Q{YG=df;a0VY)7$<PNXOGZf
zr^?By43&G+rW_V2zPK>KGT_NofqxvACRnqbJ3Px^$En7a+X5|yj9b-i?AX<y%cfy?
zCVzbp<AwQret&l_I>_IiW!-wJq4eR(I5YOxgUsv~r4PPS{`%*Mn)c4d-BDr<mRZXR
z+nkGvoc3A2dvMdn%5=SP)}%tS`-cAaW|#|2JDqul^JVBqm75=D^2JW8K5f!3C#w>e
zVR0qzJGa^Mdpc*i^MzD*7Vl4rtmFChs`d$Yt*Mi2nferonu|_<EFUX=uv@WQUVnZ5
zp7I4tI+zccD%H(W+~0Bb^JbItPaih(#uqA0wR;hDwrcVwfj90G{!e(x)4IG-j>oh;
zu-LXMUFl-(>6RVUw`FR#C(9=2xmBC7osq16^6%N%orU_X{0EYpPtUf9pR?ck_t!UH
zxIe5*D=92zbUl7#zm)ZrXWX3=md{sajf-njoU<=;mRp0@3_0Pf8KGR}#rh8>7ghPF
zJ(y?GFDJ8Fz9KP-hjaRZY>@@WVw%bt4##&Cix*s&{OFLXGe_1R&V^gTsuQ`CUfDJr
z^OP?-E}&7f>SAU`3)5!y0;Vj!^(E;CHz~Q#eR_e}>doBR3y#VOk_n%dMw~b<YVek0
zCzm{b<^0qb`2!sn?B^~xYEuw@@mdfU|BVAWy-dqj#~<OSkE~LRc1b9ASbyQTz1+oh
zd4_^V1bZ26-nBoKmEFU`$DYeRF|}L#z(J04Y8NZMvTxJ%nf7zD_(hf-?(C1R%3B8%
z-<#W^xAymeO)Mo-gfDIX#KN&bs6+VR*Aov`wx0f+ps+>Os^|gFl#@1|@*irfFG$O;
zdg5O7`$e(tji?CEFOOedm{RG<@3BqZ_`-^C*ZG&<f3Xd)Q88hjv3JD>8};Xf7D^d8
zQ_L95rKU7Kv}`t-aX8N>+UxzX+SzN~yDf2-Z<0SaDU;LjbYZk^(~WvB;mb+So=!?X
zcVX=Yry3Tms<%>iI{yXTu3B=?HCS)Wm(B&xzMcITTg<TIlZ?5W^~bokSLQ_YG!|`L
z`H6LlXMkdNyT{72&R>IEIZhQ$&k|;+PdJdg!P`|?u7SNdoVhxrK|Z0Zv3SNbPxo)U
z%a^`=deZaP6WbaFn;(mhbeio|UcwNoV`aBI<$O!k^)S;gF6%kE4DYTAY`uM@XyLZb
zm2PK^O~2>gIQXvha;@Y=aRw9dkV_o~Ie9xK`MqCNaXesWM)Oa@DwbPMo$pMjVJlM*
zI45wziD}{e7IA)=rXDRb@nfI4Vg+WNa`1Rye%4mENAz)ryPZ^pY~bU^^A&e^=VfYd
zVl7;DwcK*E_NOe}ho3qGuIn92nsM^Fb+pEey40jB78@bwIky+(*c8=n>){e}-(Q%1
zLyrAKW~)J6?e&TJrVL9yCR{Lj_32}gU8r}Xa;)~}bq`<km<!y^Ou8zhB2mq3^5ntk
zh38gWSzGcxs`=r{3mS(LxigNv_wG1evEZ*QL-bDh4aW~KO6a>jytOiqyY4%8|H5L9
z*V&<~*9d9!EZmu#G3`yZ>2{^$z;n4P4cqIyIu#3&mVbM|chTax_q*gvh6S0k5ByF#
z=+I=AC)Q_BwxYF~C5eGA@lo;d28&62@2;uv6kK9>x?g1FGFQ&P4=v6UdI~JOO`bV%
zwd~>g%K3{`#%s<RmqjlV`vdMwS>bswv?-8tCy!x4PVeeD$#PrmQhug%e7t)0>2L1|
zdnMHp4dybRP`mTI^4z9UR?gV+^C_`{|3fUQuNJ#Mj(wkR>*JsILP>lwheTb<h6TZl
zK~`}Rm91+llS~7;7ldYANcFZ+UM|<`DKz`gF@?QrH?S@?dAoaR%I!u|XC-EhsWqYj
z#z_KF&i0GWsyd#W_0DDOp={f`?={~{I;}Iyt<ytU%=m+?e1zYzhtEG73q~|cpJLi}
z&UFi$_9i2}o|73}r&JrB_^@VgU~ze~;cU&sWCOlCMr_`pzhwR$S-D>5qiIKbB#WHk
zD;9$pMK6P=-%-$dapu>WGl5nI4j=9iIC_2tPy6vlNxGM_Rc~n)9(e32d344)m4^9(
z{$|&YZdn?^7n?Vwpw;EUq|X6)ZYo7n5*WSjEvlM3P5I29-^LD7Ifj)F40CMDZ$FRR
zxUnEgDSqBm#U}!K2NcD1x}FMtD{@;Q`r5Eks^^5m&m5zrDc9E=erRkOQ|Eo}Uf{Z8
zC#GGIZ%opdF{Ad7+P>f4?!I*2VYue+r0gp@GHj0SoMa->lf=06(Ck~HKW8PjEUXi?
zT*tblEn!Am>?gB2hi`6blQ~1rcq{XI1+pJYW2pc6pjj+s*)b08j7^Vgtiq16ad0U4
ze0}7=mMFh&!b%^r`k16D?j_6>P6oFb!sQqiOCFe@EV;5TL~^HKf{61D^=sjKR8{y(
zqf)~HzVHO(v<hnUIdBSE-jJyfjgZk}ydd=?>_yqM^B)(iS~;yb=Y7uU;+xJ}Cl}u0
z*e^9J(r&t%>CIEh6U+{F%rSVk<Mx7UPd~c}m2G^RR3N<Uw#riHmxs1E&UFZ0bfwem
zs-D8n4O47gR%<Z*)n|L*vBB7D6<fB)=cEIy+g9~43yNO}n3X?w)r)ecP!DG2OmpWx
z$7^ke9QU5^_;FxI?lqI$GjFfI{QujReLoomuRYa#k}2!|WJPycLGq-J>_SUU+|8I0
z@TzEHtx3yT&h;^`cuMw^rJiNw4c{|gulw)sLmCGZ3@^QQbiT-}7q8!vbLi0C4Q_{S
zEb_RnwS-+}n&b(gZDAZcIX_J~Zg^VY)#BY{^|!+dfB)n7>dbEv`gPq4jh4`mZxb@_
z9IQOJh)=jXTCsHJ0=pl*I?TxlAC4{97dSDZ<J08Z8ul~gr|JgGl#KK-K6q;;hvO_R
zx8JR$T24$dWmEf(Hyt>Ax-&eQ>$zE4x95RA!FO{L^R{F(9V!qvil29Xm5=YUmDc6G
zCfhE&b=!0CNd5FV=XThOdy47#He7gjDRWLk{B+knC!ar>c;cD4^4V=n?fSJp>kSv5
za?E$U=&|FxuI!4~=-FAqq0e)oUgo$gx%AE~ms7gov7!k7ON+WJp`SjTE$kU=Mswva
zeUsQACtNUPyTplGQyI8DdkYT!xuR<EcV*LtuAtd`(-yC|+UH@n<ye>0QZ2V%=Dfbf
zE7;hw7se&#Tw!hv&OXa>;%DwOwt5a>cZIDo#vi;S8~1ap5$TDF3VP)%VSMtEWqy<s
z>x0(0rq^EOt>1HhbEfD|-fs2f4O^R!&oyzGD{^~7cId`{cXJv(JeR4S@uxL|b5i*Q
z<@CuhDv3S6t@O6YvfeQLutE2nZ~foE92FLZc+TFgZT0d~r;Fv?7J9ipFK6#d{wc3Z
zOV6~a&N<5{z4qpnjzb2@)uA_(45IC?pH{rV{$?YCwBF%(#<(xn1a^Lsus-%`!|I87
zrg;@kwL(^L7w_BKWq0sATAv&0;p+Q$<+*)!m)~XF{FNwab&27ae`uS;`%|;OtP_-A
zV`RK6=c#w(tc%~|JaM;@Q^l9g`psDPp!LgR2WE#2+l_+RbRxr@LuWZ2&17(EX_E+E
zl+0BxcVJ@iNp=I*Rn}Q8t6r?KFkv`U6{=wD<kBd*LBdAq{^Z4tN0hl{KRC)DKA)@p
zMuXULOYxMeFS#qlHcZxXezpAc)`<$@UqzyyUGQ0<)s@(u|GsVQ&KY)Y;@o^(7hcI+
z{{Dp1dgiO!&IKNE_QA^5>fyWAh8^70#1JdL*mu#JHP^-0hHX0~wPNeqM|wN8EPu?^
ziuO!l^>s^l#q`(m;f#~ZO}~pdX5C_0Y7(xax3k#$_;-#OP1>%4?uUcEh6FHPyIicy
z!p81srg+fH*XYP(;g9Yrzo+{h7dWMOqwu0>TSJzhs%|@bQ(Gu&@Hc(g!zcIUIZbQ5
zY?-v%sC=Wsq8V@F<CK4QU2vYRs+u2v^4o$JpQ`pp9Ms4$J92ncgH4j5!}PS!^{0<-
zx1U?NKd#=++I8Xb-sX2ZHtOBd-aLJAmLqdwnM?lC80RaGKYW_zra3JlV`J0)^0&LR
zzp-+ppOM_7z1YH`R5wW2L(L*1)9U(mtt9qs9gEjpICW@$j+WHdCFZ+wbie<QGIkI=
zq5n?RDnKb+>qYh(^TH!;t8X1Yac1kGgPU3A8ZJ;w44$|3`ibWkgL0x5J8B<v$>Yf~
z`dS%q>RDhlpY!gevGX>o*qLof&bd(*f8Eq&{i1`Z9Y%duBeG|nv;0;d!OncIg{#uM
zgwe#Wz<Gsc<JAMJUo7DM^XSi9&dTY3dfo<4Hf_0An!P1$;<UiEG1u?0?Yq{}_ITIE
zoogq?{k5Dv(<@~iL-h^;`%w1@O+7jOQ*7r}tiE&nT-C$hn!i&WE{7x@XWtgvd__|1
zG{=6eL^plo1lD546h1+l@I(fU&<AVIEEG)&*%B7CnAzJ<DKz4umef|JcP0_FjC@&*
zit9eOh&wiTr3A8kxheGW8_UeQ7P4m_UhjVJdRMIRdM)b-+kDrBZBnZ8eR{Rc?DE;n
z2h(2YY<aWA-|1n;@#;{we}C8vw#+b;Ozhe<SK~(go*kCE_iZ$pB>7<*b8CS^)b^Kh
z+2^Kc?>zAK#)B<)^IA&&$Za_?nenA$DeK$3Gi8-YG7CPHlpeX|dFAEiDH{0`XIxHr
zyK~BPzTN7o>^6OzjWyj~n{1cmKl%RD@_l5==@Wm-b^ZJeYj@-t#?I|qwsg1StImS;
zPiEW>FON2uzM=KQdC56lP9jp(cP2k>wA-#{`v2CqFU<=V9bXi?F<<9XlF_Q!E}N%+
zz51@^G|wAzpMzHuE6yn-bk;rI)#>Z1H#fXR%Cm!&fhk(~uBbZq%4D|4bNBD=XRkiI
zS8?qFlRFPvbuTD#m(N=I^irj1iLs={18>f^d)n((E}qzTai#g@@P)g=Q^kG>8|?D*
zb9c%xohQXGuax0`bz0l5b30k?-F_Z*^$YI<>0-?ej<WNSw<@Y?T@JUudi`!~-1VS+
zQ#~Seu1I%ORsDFdcY^o|w;iWNb~rON92U~ueK&BsNb`f3Bk#6P;){NG?Uhf9TefW0
z!hIRtaS{`+?)})cJVQ-5U{;q#4aW~5hWr;3`EKiah`PR7v0aa)`)Hg7^X<0}*j?%u
zE9G7}^WE=C)Lgri==yh^XU%UcxVHVr72h4|%l_YNu8uvEuaFngxXqyAf0yOU%yT9S
zO1i8|U!>;k*8Q>SK&>Z3+MAQ&Y>Dv`R!`FmSRDD{#dM9I9Be*Y<mBtWnwdvD(9zuV
zHC-n)diPx^WuG&AIhnT0Cr8L{oA7T}*8baDYC~oIi7Rf4oxdkfD~oH%L6)+vS!WDi
ziJAUu_psUU^;bmoQ<K2EN;k|`?0h@vv`Sod(7~#tYY}_YZJJg%ZgWjK=OSjafw}OM
z@VrhpKc8)`Ns}1Y@$E~|zQ?$4SG$k(B;ABX!jVf}?wA$hUwATp)=#sWmO^e1Si2?$
znQn5`l0GGHeHW{r&XZ)9Zs(`^5+;+k?p_rU`pBDiQ+CJ_<=0R6BKBGY-Cg`>>txqg
z$<tUKRsNa$^O1jy9`gg1kEV}rh#u+XnfXF%#Y2TKwHwPW>F2DkdvQ77YuwkUE{jL|
zei>D)Jf?Jh-n&NA-H$&mzPEjSll#YJiO|P8RJGi<Z*HAlvGS4q;?Mg$__pc%y7i_-
zW#zRE`&VzcC2*(Y+ZHCD>eD~&XPw?>DPE(>oNRw#TkXw~L-$t%{rwc(`ps$K$9uu?
zE<!;sC5m+J$gg~~{MMZG%{x^y+R~FI-Ya){*|YY;a@C*%(KA^^Pd75nQ`6jc#923P
zsqM!PyHE9g>HDwjv{}3FK#qpcwLsOR;>V_DKY#1Hzbmhfck$*uP_y;<{t%t7`mA>^
z{eI-&^7O;?%llsyU;67PKhsTgacW7$?Vo>@zJK<&pA%R2tKeVr)8oA{KacF*xo6Lg
z$pWvOr{?OHiTn1gtruA-my^5rrleV?b;uFfJl8u9%~j5&U8?Hb>?R@ms86KOJzB8*
z3vcJ<mEYqYtvSdh^xYqIFmk7_bbT*71H%#m_rw<`C*~v;BqoFIi9Z?<o&R`;Xx;bq
z36t49BcdnIjD6$Wpkr0ADRV+f+6CX;x_2BFq~1!?>16V}`BCie`@ejp+ozPJ{SMgg
zqICZ6r@4#gY>wX-^FQ~SLh?jO!`;!HXHIPu`8BEbOywTY&HN9KKACeiwC+mL=B;lI
zAN~D4U0%;FX2bHe3H^sw^sGG+r=sP5@XVSAFH<&M(@G88qL;JKRm5=SGq31ln|&hl
zmY(u)om{-z_sJ%;A5GUizwXi7bVF<Ej9(6>{@-St&N;jz(SPb3gOHt*qrHE<iF<!^
z<F5E3<yX72CwB9!J9d2b^$3eYna@82-dGzov&+!$=emb;>>n*%y2c~yP}hxXCLOo?
z@?Fl(e{Z(&)U~3^KX%+cbN8Ubxmkx3Yu9kDzOJ$M&CC;~)m-!c{d=l5>;KENy87=g
zzZD(&uv$rB)7~pu#hEKy?rd?7JvHUhHO}A4LAu6<_q9Zv+CLmwaP2|#M9#B?<}-c%
zRU|F{f8J5!u>SY$pU=;)+qYY`v)H2kPeuLb^$DAVveT006?7$pcz%6&RrRw~Uq$e?
zFe@+b*@f3P-<xgqyM6!N#@D?&U0Bwq=7=AAr8&<&?fCQU7FzWkPaUOpOGNyW*>KbU
z>soUm+4nnr0?urn8dInpmH7C{n=ajX>V51d|M3^57-hf7K4X3*y0FEsVa}!d1<GsQ
zPZj5oX_7qV#eL(@%4D7`T#Gut*=V}79Qft?{72lnqfswbB=I*b2%P#(=*5Q*>0$TI
zP5N_OJ}qeJPWNTyK7yQ9=L6UEN%~hW>D^=Iq<H>h_WsQO2G4JK&HJ&}#P*(jkIAJe
zJjHo_s~HYFYvaFXxJCJB-b2%=X2B2qiaS4SX)k?Nx4rg@w5b4FkCer%{OeMScm7Lj
z_FKSx?%yQ~>#PZ44DZ)0&M;cJF!v&_$g6}4TN_#}9v<5>QLX-o&JLZc^XAU&y|e4i
z-PAA@6(b$bk544IUaWD8*mE$aIweyu|7Ot3xe<Xs3>GjXv)A$5T;G(+v^>m^MbFac
zU5c*YUftmAZPV7f=Dpa(Qg@n9;P3@gDTVnmhi{#_#KyE%W75nmfls6-u366G$`?_@
zV9XYGpT&jqycw&L-;>njPc0D|ujYrSHEmN`B$9sWO7em?H7zgB&$qX)%zZwoH&JAv
z|CS&Y5tHJ-8oW-uD<`~Zl@HK$nw1?BbgAq@rFo4<)uFIg6BG|sY`wv5v^030LGTkN
zXTQj;B7b{Q<XBD^pD#PIHg#LlRNdfZ3eNH>SDL;!EXg_jy=kJ-k~WhQJQpS%ZF;+N
zTFuM_I?<U^*hKdI>E*dobo$PM<VU9NuY7JCTd+kxN620Cwduhvoqt0A3X~i!Slgob
zIVM+T$=yx9GR7~g4k(r~{NJ?ULzskB&4kF0w+fVnS`J@jFy@{<@tj9B-_lMkOAe)9
z>wThnI%SVG_|D{zJtexEiOG5G^>!_HZqDq`hR<Dp&rCeN?yZ0H7tUK!8&#hqI0fCf
z8FXY%!NTub5?UAXzAm$yAEcKQs-per`cv*FvW2<dwww-FF8@2{QrlgL1kpFQZ<Q}@
znSU*BLFWZg_FXp@h~AJFU}(yHKJn%xGxcpnYqTtPp8Cfqt!4Ard#m`pCE1?-YOGsN
zlu5q&rLy7qo5iV}4~}hmI&r7$j6Z876PYF~lW)|l)^zYQ3!FHoL-`h0xJ<^Eb>CZ7
zr$kuJJ)QJ@cJ8NBzq410|6^{hm>6RG=hSDbskb`6?pwQL*<XG3j^wX}6%n_MWeUHp
z*Ef5jc53Rx^>rWA+%rD8FfDx5WF~l~JK&MjJ}%+PgOC1xu76s`{{23CcX#2bg=G)L
z>U<_mt=M}p>SbYiama0jj^B#8p;Inh+3<wfk>R}a(Z5p3zt4R!@G$semRGZ5>LiEn
zMF9(SGZtU@rSj$SoQC2jx0lUi3O#)@uhAsnMuZ?w^<(J=uUNXfOrL4yb}6Q8e?8A5
z>*CWzKh(tEf0Fnp7VFJws=e~{y-eqCeU&?^)H7Rud~Bci@4r{cQd<{4$?|B|uq9h|
za!<FcnDJI=yCX06Q<-Fj-ECr(hmvO{H5_r7lH9(jiFt<Zsq?y4X3T;+^k2RVo;L4P
zp?~~^Q1cIoHxF7z?NxqW?$W*8eOH#?<E!@r1MJ(TKHc|RMes%5wR;ui-<vm1*s^*-
z;LY;ho%&vB{|?L#yJfky?5^XYpiJN0X=NPKnNk}nOU<e+iW$nyew!W??z<MmTrJ4>
zre)bbrZUGyNAbPuo2KWV)<`K@6_d+*aM%0l&Foy9A&<2)B|?IJF#W&(JugOh&xZLo
zzB~6V6|4Ea|BIsU<L%OGp2u)}VCv#M7;B~TdG)la<2B)4Z#TtHyIdYB&-OQqqi(tz
z*QFKLR9Bs!lG-EoH|nbL48yFBB~Mh9@74B-PrW#`!O*!`cuRlh-~UYCZ!Ed0Xyl&k
zdh1Qw@>#EYuRAJeoyoGh(`t6LHM%JC_~N<U*}n`trrZiN56xQf)b}Uj_soAEroWbM
zuT85`y0GHY>jhgj-u^4lY3Lf8bK_0lTH$?~PfJC=ESbCG=aTMgr*}MAujaBjp!I3x
z%^#`;rAv3{a>rg<lN4U}^S|KFu5<Ope>s;OJh?pFG%1GFG?_~+!F)qt*V5ktmi2!w
z%}e-{k6NAgg*$zU=VM^d)yF@#SPD9|eXCSv@olqjyX#oZ-tnz;OOjoF`E6C$U9D|%
zGHUzQ9(k!DHBCv8)6{hXLuTaVm-Y9*Gc;|_RrNLPbU*a*!-sdw)lZ(i`jPy<=cmb}
zE%tmFQ#P<Jel&q6`F#Ave~p{(-&A(DxyQ9FM)gU;|EsU<{`?f5xkkfs`6PFh1>a4c
ze3UYq+*0+L@6C)gGgP?6f*yU=_!yz$$t2A*E5JT+gXR<OXOmgQTkKRqT;ez;8}>4=
z&JT=vtIBX(c*-96@2tFgTiE>46@Sdy@lMG%$T4>MhSD>xPJ1*Sb+$L8E}z_6n7NNL
zYv0KdIqrACGtaBup5f~K$kXU$#*4n>1?w139+QZ(Oer?btD9Z9+xbE9(T7^=zKCsU
z|1Lal{*HMi&T5n8b}n~fTDI=|b;CR7W2-N2yKKskS#qAGU&PdS#;mM$^2^^Hir!q1
zZ7{cb(k$2GZB@4~Hv1<pab0gx;Wt^7KczBbQ}4^x?QA0X+l&^zPEup$UlY9{^-yI7
zpJkA;utcWLHIG@X3by6<CY{PDVq|%cbo<Cx7k`G!VkwV&>UK))bbs&WzWj0b_V%tx
z{lTdrJf&8$_FtB$<e%rd@GGe7Z(b~~`2y|<%3>Rjl;(OKcI|g@=yp~TX0*{xkQZ8A
zGU=*vxwOB|Q^f_<Xa1zDy5>J8am(CN&;RO02bEX#AL#c<)_SvUvb?Bf)AR?@4R`(a
zab`41JX|{0bcJH~iaDzUFNm8<&$RT})u?W!vuXFy##aF`T${P)xiLyk==8`;Jt$`>
zS#KjRJL$WE{b38fmz@lI%wq1GbmHCayFjt~UCa@&1%7M)9eTsGDPsDDw{K^fX4}7v
z=yq58tul2*Dc3UoTZ>B=*R-z45fj;BbE-XKhjn6u7UTUB``u=$Rh?sc&?I%fRef98
z_eiGJ4EAXcUpMccsxv7pztcm3>HNcd#@$()EarylZ)IA&by1vytM#5FxrMdcdFG0q
zauUrc-xa^t?nB_?7mVUu0#~Eo99bWBNc+arRIidN1)q5y8a^oP{<&qXaOs=d#!5j2
zJ=tDHrzTd;n$Qt$6Yr+_rSj6NXKb2Y`9f0S7v7o)a|Nxs;1s-CHC=LP!nQ~I%nr`{
z@?c9h8_TpS;U#jLv+Cz-8f#oh^>BVW@j~}BO^e3HqtEyM4BMV_|3GZ`%<3OgI#y53
zmRsTwy<@lCfyhfowrvVrt+gvEXzK*2l^4pIS_N`fDDGalm*L{oFD38y8Z0$iQ6N9@
zy}nbv=32>)GRaj}*UCmtb28nq(1&H6-PJt%#Z7E-JA5MLS$v~BG`Q;yPG8~0e5I1f
z+mPWxcKTi}8SUdNg=bQoSMIm774ARtNkef*NYeY(%bmq+6S+<u&S5imw0x0j^Rbe_
zZ&Kp{{u6d==5;gJuJrCr`KrUC8uH+2aDl~T_i5iw8C>yDl++Spd>gPNU>8%{(hWMD
zH^P=`yc3+Kw8+&WO<O`=bZ)pw&)UfHs)~RE3%q`I)-vhrd(dgbpsZ-2aZFS+TWw-Q
z)`Ht=8;@Mu60}|SboCpNC(8dNrgZK!p5e1%Vr7B)9uK>vAty}ZR3`7$$vNZpmdmc~
z?J1_kM%!4Ima*n2YG<6E@3ec<T9NBBLOZH{ubQvw_VHg7>*}3X!lrbzm8@0Koj%iN
z&8PdUS^9B%cEn!fIAhAq{AG=r&fAqaEG^1xKOb;^<>o0oG4;Rg_jd|w^lUnwGziS7
z_q_I|k?lxyaYSo%SB(<$vk8V4TdKS6HL_k&o_+P2qVs}czFbxdfm%t`c@LbAm_-`0
zUTXdjrqx!#lG_)&&wK8K;8nsJCj4DGCn8@l@VY9Q>qOoRyZ`FkJf+;5a#Hadq!U;F
zQ+MWk$9bghkEl@T%T7yy*&5Xv!4fSxtLrNlr1*W3k?5Bx(y90(p{nG?eCF>hO~uOs
zp*2?8n#?;Amvrt5u>BAb^0GLm^yG3kp9L3$zHaS4A7Ncrq$}CL{{Hw$FNZ4$w)-xu
zbKJ|i!Y$cYVSAiJ)ZJ+t+yak%OyV(m<GNkXrfOdSuW5Fpn9E0biFk(ib%CaA{uQUI
z{SETvE*-qx{r&mj%M(A%OuMkkrHO<4u&Q}NQu++@$rq<~H~1e*Up!lVLAq(j=Qjd8
z##2uz@l3dF^JJRI$?prSOE+s5y<8AnT=#fF!qmW4;daLZTe=S=h?iULSS0f3%|z`+
zKOz4!fd(B-l9Pnqb{yk4VsiAvNk#PoMPiJ{mF3T9L{B-8TiF%3;?@EKmW>Qa6XTO@
zme&_o+7;RJtUrF(JbiKe#XSe_n(Od*=6uj#3|?Ydrhoj^b*%|b4@Ekvr!wuiaQyG*
z55ZqFf6n}+?YAcXP5!>OQLTPX1}k1pcWr&J`BBlPE$(?5s+Ly|OcwmWa-fgJRhnnn
zF}Z(JE13^0yLR&F@9xJBQ)((7&g;D&u~|o88&}A|r_LckUw;OxZabiPA>mK<%=MQ0
ztJiWx)acaaD%a<?nLDhw_?1^7sDF=?yh9Dc|LPRw2q*To8MYU6K6o}CYPAS|ygJZv
z*`e9R224#y%aohWO$(VSzdG!}@8>Ts)fFDOY|x<-?6iv8-Xd{>Tt@!$7gHJpuW7$_
zHDzuI5xq8}@`1;qppb&jCsRKsD1>eknZdkc*Ih$tt7GENPxd9HD<_`Hwl+VW&VICD
zqTAaUfhQGgDwO7G`P<L({`-~d;`GqAtepR6j;z$>&)T~AUvlI*V^2Tr4LaH@Q<N<A
z^X2WVmG9Z4ym`65>|0>-Y3B7>%vW!w7Jc8<`}pXm^>eN5ryAe4yR(UbLv8-~S${45
zo%Y<kVE=NFDcS|yUo4+T+GU!1O<0vNSA0`is?L=%S)Z`;`rl@(U_RoYFOyRmxFjp0
zFDxWl^eJ14)`R}2zHRj<LuF2IUK3yaoFj1S`=>`<q;mGY`?4Uge3PEV$!V_^O|r84
z7_N1a?ZR1)RVe}7-xRyFWL=V1OuTkf(QRpRskFnZsX7L$HbtH~6%kQ1b>|c&mYxrc
zu~XwKT(Y&<1f{v^<h+9#diifMl-bnzOS)7%dGYjg9OtZ}HASs)jb}73%wV@=npoyx
zJ9EVW%SY1Bz0V#$?40JH71JR9cF_;fvuDn+hxG``U7aVkHS_r5)J@lTI9<<PSvKWS
zQ%P#UEu-g?x_%0<Zam;UW!<$|?%OsBS-xq?IAJT_ugPFCNxrqiL~+^MWPzadDH?0!
z)_3N~nayO&5c%|Bt4EAsROhrX<)<0~+SUJM7JT}jdOl&#(RPzPpBKeiS=Y~gtoP<q
z;$DYPy}a7Y&&yN3ot-{uYsjUV^&JmRJy<6dvs&v#`}g$ahq=E$`yrBdafZ!N&hJ?k
zmEn33Qo(UdIYHi&e;d3!yEHaBRKLbnPm47yg;!86N``;ar=3p{XC;WSxJT&Lu79-V
z@T}uAV&vlGvb3i~9^IPdt$gW)I)_?`#H?crr#CpQY23v9jp0~ew3p+?Qjcb-8@#4&
zhTB^s51dhS7JAbD{&(?)Rh9us!Rap>o~(agzh+idPTvd$=lH`}XI__x`&`^(#eVGe
znS<dvtD{Q)n%;e;9u@O8;!Aww+SQvrpS$trt7EY%=i)+XH_5Qxe_Q63zpT;I$k>y<
zr(?pouG33aXNmLM|9kN7!``b$_IJ(=?U(JEpqRa9!J8y`xp<z2>IBE;Z5sJskL**+
zw=I4eC4Q#lfL1l{nYeSW{><LIX;#t3%Rg^!UA^1)dS3gyd5N`q*QX22xVmV=8BGa^
z`A@mLe#sVxrao}6cdcP6U$E<WzPn8R)wRd#Z=P&jdr+!#t>@oLz07hOqrF)VHo4o?
z{i&F7U3LSXXGOzCL657qZZ~y!Ybm^$70mO4CHC|0S)vzxJ9B+{pP9->-3U9Fxq4~k
zpOD3y1-nEIzujo+IL`4n*!E@8X~{f8rH!|zUC253S~Pmr-RHI(&escf9IfLiN}8Ee
zIj2!znbB9L85iF3d=M1qzSO>J-kU2s&xyV}`EG00uX9T~eJ)tPe)RcrZw~LD-7!<8
zdEd%)Og%Dd=Ih7WD;bMc-xRsox&Ft&6TY^JT_U^Qe%mlte?^2Z`>lEMX1|hWMGMHK
zEY<lQy(GjTIY6=|Z)parp7EEOABOiIU3z$RN5s1c(OHh~8uRxwOx-nwJ!;h~?FYUS
z@9AV&PUhaSJi^~A`EP{w5k}b;qGvU)vT|66Z3wy4T%f!wuwc8$jRsGCi+ov@7pe`8
zJ%(wgS4Q3uSP?p*-cfCZ(S=uAC-7EGs7r1$X^qcdtXWphc4M_hyx@c@j_gwM%L@%o
zN$7M7P4#v@k+J=Rd|l%L4yB_<;v!V%{dxF5^YHod#ScHeu#&gkWwYN(+Se`i_0CIA
z`Q}f^XZvltiAjsEgx&w;n+G>Hz2K9dpvrN8?OI$~)yev-TVF3<-{BaReD>>SZHF_L
zPdXm{Qpft?>Gr;^XLr+1F8Fm*c?QF*=Tly^zSF)HBxZaiS|FgUUpu*=e!*U?<ho}Z
zQyssR*cWC+KR^6GHm><$_0_k6KTP)p?2lU=Kfy<4@8(T>UvsYIefKI&IDYA)Ut`MG
zeUbNV`}4gkBj3H4eeCtlmW2ysukHM-^u22tQ^v^}kFQOynAd2;p4T)>3@Q7>VGydn
z=$Y&5Lx=g6oLaf@Zj+-N!>+3rE45j+&VQiH;2z}vLp!?R)M{%7p3m$&!7r-~xBBL&
zWZwCEdEUG4|81)?|9}55dGY?T_@-aiH81G7&#->5^6i(*hclwy>ahAJ{|>c2v+VWy
z7@^f^6YeZp(d4RaxaEa~Xyfe%{kKg2xrDPEbJi;FF8k*kd&e-|c{^WbYM9!>##8Fv
zb6W#MMW-#yj$6PttKa`Cw@l1x(dt_jrmth>?z7#s$3k*{Ze`HxJAaCdCFiE+Dy-}h
zTBjAmGwXa{^<1vH8>ImfkEY8OguLF*<8AxcPf!2+t!3`=>emlXe*N(0i*KKPZ4qTC
zi`^V8rr*4Iw%xTkC#NNETgG&}u~mDml;oxiKF*1r2R<(`5PT4x7FoTP^W$H8)Sl@=
z_as|sW(I~sJPZulcviipB$g!VJNqVPr}|_TmlW%jRFupO^DSQFAh7p&c*#te6RJ~-
z^K|<3L|G3X$a~xAB>Q*`hh9R^$|?VAt0mg>14HtSKgWH4ef_M(_YGVX9D!$o<?0yY
z9Vevb>^`l~ojBj<#5J2%QGUsqPdT#hjXff#eSGov={q^G+X;vN==T38+y7PgTmE_B
zZCC09+h=WK<-dO{q+Yddqn(XX>hvS^H<d2Wn>R0EQFOAuyfD{}sy(|WKP)ReAs#QK
zswZ*zrt!Z6O8Y-b2xlALt#EC#-(;K3p<L^9GP&--`=+C673pCcQVlA8Z2O{V$@4+S
zJ7CSTTlaF@WD0}a<=7S|aWSbq)aEt3ay9nyf#6qGPtIOeHz=5Fd$>a3)%6gj`-_iE
zPpD7&w}4sVhS;KrEk_(A-WB&=%Ut(Z(9yM;HS}j7|NM5g600b!#?)zydn%W0I6UuM
zPIrW!=(R^paxC4gnwQUAlD0g5Jm?VPJIC^#`6AaGwb~NTxjg-Fka-Sg+geGcexqq?
znpjVJUyiyaX1ht&C%}AXS;MYRGO>PVgvD~UOj|Z#`AjpnpP$rO?V4qba~c*~*Vk;!
z-gTtFR=wO--7+QXztX;UT0!?zZpz*KmiN;st(-ASY?iWS^xWI&Yi=e@p1rl}u))70
zmM#4X4-eX;y!7Uiyt(a{)f20}*{@&896w{Ywop1OH<@$V+d~t2e7bo~@6;=}6mn$6
z=dzu=F`JFP+9vPz+rZ~~`G|&DkxA`t6L<C3DSdvft@_)i22WVO`qibL=O<E+B|V9j
zf6^+fYR@wHLQzDNwa{gYWk*fgYv!F={c6eKRD+eF8_zwivayl<%(E_C$R+fzkbX#c
zqd`^nexK7bDx4qj`!0WV@?%=7jgzb*%UbP_i>Y$DhyG6bTDoi9!d3ATs~_5~`{riP
z|NiB^qGv^S!!!0dy%&vg&AfiIX71_hGizR(Ja_UD*Wa4uGrQX9;G~Dqt?4#>zuGn&
zTg$cL;%^Sye=!38bQY!s{ynwcfAya4Q=hjx|Lh5Q5alu9!K?<pno4f2y_RuzJS{g&
zx%_d_!RL)NOMe7AX|iP<w`D5%>n_*$Y0IT2+rqb}z3B|n|ALmstUcCTJHXDsATPnd
zpig`r^YIDu1?RJf$l}=^0(IBd&zKY}8uE0-r#a?IiS4{%T@HRvJDm(RrS-B+bB@dR
z`d_>Id4r>q-6D4Bv|ZJ|e*BVHcfu@9@}cGGh;KeOrX4Bu{qE}fYL1Dh>es%|l+#9D
z^CI@1o;@pM%R0&WA4a>BPTJKixj3(ITmH8|&;OYbp24s0MY68juOMG{{@t7ReoOB4
z3nyrv`jbEF%C!<J)p>h&#NOWS=kOrcNXoO&b>7A&H@W6aIP-4W{D<yh=lpN9HLqQ2
z`<qYZV(<RAGbelBvhux2S+i>G)Z*v&tuNN>{c>lfY*Wbj-TS-W%{dUCA<CpscdOAf
zY)2Hcx?*@)&}QeDU<)2Ub@r$*o#zRuY*~kdFXVilbnN80q$9Bc=XnotFXH^Ot!H_l
zpnCsD=B*RB_8jO->Ygxj|Bk}^tEUgK)!i_4$$WieTH3FTWpe|#(xVlFqU-~IO9#BW
zI4OV1a);*gAC_EYn|;tPX?@y#rcK@2Ja5~QWKK376-eAt>nE{3b7!xxm6c`34{f7=
zAEH0VA6MZBKi9wY?Zl4}a<?=W^tZbUPKxeW_~+zddtpwF^M7}33g533Q|g>9wk}*r
zB2DIPfU&QeLbw~ROTM(;qolW)Q$K5*=KJlzq+a{%<2=>C8U~N!(hYCy{5c)Mj?6q$
zW>V?WVjno^$ebrK4D+A-R?=J9^ZbvvhS=FZyO-`S5KAoJ&GSk+!E}&6CzEexkg#8-
zmWA=J^*`nppHfUdH6uK-=hQ@<`h=5PPb}9Felx+%lkWx7wX?=Dd;#6wZCPIRi`TtV
za;o6XR-W7I`Qf3tM5zi#;-)R(8zfnc>tA|wO}gfLGSy~NS5rpz!}ce<>=`aM1&W_+
zJjOM5`4n4`hQ`MypZHi$oV|X<^@FU37XR6~*q75Ff%A|E7k`6Ltw&dvS?0f$rRA<k
z^CrETDB5txdCtZu4nHzgTX?g0MR}eue6nxa)1O<=IQPi}7S#nz_Y}?qxz0MZqi{v!
zmjj>Jm^uVzdDZb`%n7wj5%D+f(CS)nd16UZ!_p8-qY$~`hU1NWCo7m$nclRkpOTk2
zt~%k@%D&U=QQ=CPBUCTyUSG6o0q1R_sHS$sY3?rDBU)CR+w=9#O!tL*o2CeRtb8TZ
zwMF#T>!+6le`?nx-M_sqz5c5UUy{t^9SNot@9k%~N!||8|Dg3U@P&K)^>ya<57)_O
z9n{^ZV^S@hBI@N^!*}wpvg6^xis=?xVk>JrY~OC#esc4@8R}N18+u+hrHk1ga0@-I
z<jrCwu=&(aBcBTqPtFC->);4-XcCLLu&Hj_mFmAS7y9P3>@Qi>WH5P&_fLf_&gIKa
z|A@HGn;Gh<e|=fpulZZFzou|V7M<;M-jMf!<(BzzvAiuoAy;D^{qFqyyp_FIY<26#
z_xjEmx3(?+ezYX<P4>39dOOjoH~I5Vv0UfoEqyHbnBlMZs_52K*RR^2rc96ID$z?f
zbq+ZxwrSyw1BRz(_pG|boM~w#&Ge-y#3{r!@Q|oL!FuP|`i4uv6Pm2Pbp{7c`r5Td
z`{n%wnq7NDJ|`~XeeJk$lG--)Q@$R_w(B@EGXHR0P0z^izTWgc<*6#ONmG@Mo6t!+
z=KAV4!pS=(hd!>^6TI<CUPPdw`O0gtTf?06+!YRKuqv1Zdv|@GRurY=mpp@i-iGyz
zY6s`;`nuv~u-66C8=vb>N%e?k=ydHfe>r(e>MrHT?d@zg%pUp7`>^tUYDjQsV=zy>
zX{c|~1+FQFkFD-FYOr|LhE<kAr>vsh{@i<U!S#z<vRedOVqR(MzMTDgg3--2nx|%&
z{rvLQMO9?m`<{>P5eYMTMZGn3az3<VPW2bvz58hA`>1o0kMvY-RzKb`QCHdaJ(Jn<
zbG^F@p6UA*|ER9*yUHuSK;rJ6`G%iVR)2RtlYMfJ+026l3%T#{OiB5BWAWsR)84&o
z^^?3Zby=PHi?8=K?<%u9$rt{-Y~Eg_;@GT*-<lm3g!%^0V0dVC`ZJ$YZq(v?*IzAa
z5U!t8yyLUkmn2yuuiGbkb8bus4?TQI!7Xs3(<i2CrX?Hm*ej}MCVe*kdMQgPJ^HTa
zrzY)nwlh9IN}4}?S4H{diFSKZbut;li*#amR{d^!mn74Ey6nGL7UMmo?-8a!&XX1i
zXf*pKGj+d`QCBzIxP9wnjfgEPu5w&4>-e4cVEvc1L4SX3-Co~oV#i*Rvi8{_<<Q_q
z<$V#73uW$@Zam1(usnU=h1V{}w*2L@XP@)UYHBd^>QfTZTnY=;<Z3=ze5l~rocO;>
zS2l79X~dZ<mwmI<<!Gai>|HtQ2O^7~&WxK_wA5qGtw$^m*){6|KJJTsKHoSc(Y<?H
zCEHsOE7$ZZ)8C1$_#9HZ?4_BWuFHk}caE-=SyP~Nsq~LakoB@Jul^_m?oWDgK6%&t
zxohN)?>%*K@;|<n`O}y2)U^j3y?Dw_`tf~H#me4-L^kv3Otq84zOP=LUpP~(Qfv8z
zci;ZGxXQ0T^4)WB^W^2Sx#@2nYX1CmmV<xl<6Ydm)uK+pA8S@9o%-&4E@$lvwF6;Z
z^`Du(s~&sMFS~jlw@Y!k=$y6l)+@{{vU==!ZAr-e=hdrb1zAruJ#KJz!pW%q@RU8r
z`qTF~_S%;%vbcQoM7GPalG7hnP5bQlUxH_D9NT$?sS9V#tY0Q?$hj~>i@D$Er%#fz
z%ETkbRx*Fl)d=)-?B5~W5;gZf+Bt0r3|$soj0_AtEDQ{KL^TEi5=$~X^V0IcZGqs^
zeuo@H?ta(K)9Q9w^zJTiL8DjvOi6)o-_}62Z7XsO)t3B!_k}T4N$r}iaq&CL;`6m7
zb6wUe`8@Gc`>o=0^myE|q-5QRMz_B&D3{oo(znq2U9FT^MqzPN?t38_0lQgqAM8s^
zQQE#kdP<`tx9seX`vgzxZ1)gYV9sV+c1kK>&W+VtL4Q0A79KguKL4C`Mo7ty56Afa
zxi;V1w0V2j<&$yRub*tVxWWC{#kcnkx_zJTW_C$FZ}m&-Zw4wMxvsV~KXa}swFW!M
zuby$X@QApGb60T8SKfwnN$%`dKb$9=tk$`1#BXkNwqcR;j=e5BdY=Y=-6<Qh|IIh%
z6(RX6JFZ202Try0jhs@*F!kOWS&@Jl52l^&;yIHnyFXg%OcY<iJ-)Rj7W<-&kLE2d
znwnl}_3M?i`;8q;!u#*tzjUXiM%##SexTOk<q;|6p|@jF_LYCDdcPnw_~{m%T$Nuv
zCULQ<U;mbsJblXK?i;e$w7l1H<KDuh>o0AsU&J;&dP0XzcU;R+i-+80Cm)%kcB2>=
z7#Ns91Oo$u2BBDukI&4@EQycTE2v~fyOJ+ncgDKoj0_AvSQr?TP|eBAD@iRXC`v6!
zEz(Cap?A{#tlI`6$KHPxY5%fFTSM{dJGR{!lQ*%3X_$yN2lgb*x44z!X+3TCmx<q`
zsyCesd>r9*%~hPO{`vfpefL>y?9S}(o2nCFZZS<YOZ~dgOXfQffjI?pe3!jpN;|f1
z!WuKaO)pE$&MmuXs$<Ua{e}dus@-CvZQqVQ2)Gh>aQ^)ZOUq5)CoYuLl2^(0u*ft?
zUVKrbWTKthv<vm>aVa|ITZ1b3<R3~i*XxP5_jt>xbcc99-*Coz%Zk5$yQlv-uJ0K7
zIN0gjnJZyhOU}DZ-F-^oe(uJMxe=Ogn63YAo4P9I7vGCV2iD}yS@~Z)@`rcM;}3i9
zFS&AZhN{`R_2yN&tIgJ==*{T}mcKn!^|Neu%9}m)MQiGvdiRM>i%*$6<xcM3Pg?@`
zQ?!IiWsa;>4%{*4L%R0K_a)m;)Fqm`D9tR%?r~Z;Is4?7MRN<U9%%TW<sKBi_uG*h
zvwV0bGqNjW^LI5jew4Yl;m=m*k6AzV*|0sR=!q=do%`+O`ye9=8N-7QXS97-XMWz^
z;h})yp@q$l=aenq`EY{JVa3#^J@3>F9u){JFrGCx?R8fEF4dR5Q_oivBwjB*5F;TZ
zD87U_|DpXNT@UAL7Q2(s4|9C)Ec)h&3<JZ{b$F9Oa(-?>W=?96UP0ws+qXrJ%_jZ-
zD-v^_-z&29;~BNt(czW)anX}k97{fbbKcp!pCLTDPD14xLEb^h)_V3A_8zmnS^Bt}
zfw60e&UuUJfvR$yEK<F0^$RaD#94^H@B9DptEY*gr{6xgRu#=fnJ$}ZpBG5_JbUsw
z{NBBD+|M;)@1<VMiL+S$EpFehUsvy~o__A>9E*I<d1`(hc9Se(^%iUjo{+FG^vC`G
zg&Qoc{X8eB%G&ubb(_!T1s#`C(q}E@KK_0A>ZGZH_sbWt?$Mf~;CZQO+KKYAADca;
zj;9=&_t9M?QuoOBms&GLGNn#WU-?H&ROND<X!&W4nU;?4V%`~u*!Y{&?(KTC;g^Am
z_auf=HNlgs-(ONayz)~;<Cf0F*^evdoIA4Fb613$;mM+ppC0{veSLBLkLl_EPCk6u
z&-}b*>YT|nqT+76o8Jjm7nrC|=Fh)8p+iehz&1LK<zF1TrQp%(^y~kbivCSGrg)Og
zZ_+;R&kD1j{`h*9_wTmHYyR(1W8}N7xl>Z(er2k9&!-1c0y4h-mmihx@;c<!uvqBo
z!?!H~hxo26=XqY|dwtIYp9vd-rfPT!x^SM<dp|8@iqB<6K0D68{4(BMYkwupd}g;#
zDEGrdQHJv`&YM5!+aDg_p;@#krT>mtq=Dw2o<G&1sf*4wD$jeaazd@xzGqX+7mmOW
z>K08W=F438`C<RP{&Vfe|IMDy?l;9@@1g$^M*=%+Wi6IxI&COd&<K8hY4@M!yBF4f
zx%}b9*%x1q*LoFBj$+#46ty))Hb2$$LCC&EZ|iv&41e`rj9htKuH%xkTX(VFqQ;5>
z$IN1$C4sA=tO_Qs+r()ZEqXe1q1e}eGb&#7-~BJ$<k|UA<y80FO)|kOc0C*#4y7|D
zE_hgIqRDoSb5*}W+E%r~3D3{<FWC{HyHSCYfAdYQ(EGDz&s%fl{{4w-{M;wE{AM~g
zm7B%mPUGXEeFxUREP2&;RgCX(#<Vre+$l5Mw*U5vOZg-zR3;z6U|q?of9zB5s{JXP
zUl*3^)ZNLf_`~ZqjsM^5`KCTBFI2t;rivYyvF2~~g)N_Qr}#Vy^_Xzd(d?2>?)<E%
z{3Biu0{X9iaXGm1i2LEZfK;`qF`gR~tTyhN=yGM3V&t^6J(I2cxC6LFr_5r@d7OAq
zER0oS3)3u-+|_H(hN&!9n7NN>8}mcW-G=P9WB!}@<)4}E_1b<SLr&YJO}$?>-4AeH
zE%Rjd^(lwG6|b+|dp%HSp3C*f33q3H)sb>vy4WB|blW`ko%YK^RtWBp**m@Sl=_cK
z#<<`q)`lYGV%k57edj3j%`JH)^1$z}636du=3laI7j|}b?flH0ee%C+Bl8^>N#&BR
zDcAloh<PR*KXrXIb6kS4;Df2=Q*z>}_g;I@nxk|$o^y7W?>_$q-}M3q94wOW{hpI@
zM>R2Ljo}CD1##2-99*)dM0xRc-7_-p%0976(bG(tEo{LWg_jP}zoh@|WeMSoF!=U@
zLqae1ioLWW_x9ukm-&<@)q8$ol07N6>*hUye;g-o+`ap^(y!sIQ9wt+@i_)d|7}?i
z_-u(}LFFgLeSyE9JMxBoeeve)?u#cs+_5b9_M&<6#h22*J}=GrX|#KCpZ;fm)AX;W
zrsm%@l;1MJCs9gJHSpo@y>pISZk()WI(5+tYtR3T_cZqPujZ-U7v)r4>+i&D5p~t>
z^$Gq<$zt~Rr>r~2-**0$ZbMw=4dyJyU^U?dt8Y(VF`d6QuJ5bkW7F^*Vecv)7?^YI
zT38X8cmL<F^&MF^rP*#cX55=|Wa0TaA?tHK6z+Y<ET>f~*e`cqSmfoibsgX2u20;<
z;rL=|-Ujym_beG5&+IlFle^1Y;P*xDK(qgK<_sQ}8}>H;KQb-T`u+6EE3d$5$rDO`
zE^<G(Ym26trOC5wTa#(bM;4y<dhkA@s=Q$4+7k|6Oc@yMcS!M<{j&b|@x$E@Un(l9
zOr)+ocz8`C{Cd~is2z-_rFPskSnpUB{cG>OZr{DHZP&f5i#F=<>-W1S&;R%F#Y$dX
zpX999Q;*7+f4R_b+g#9OH-pB0Yx$%*Zth|??>32j&azOm)i8-T{Z&*XCeE<^p5XkQ
zo$TKuWL&;4-TwUTPX0AVRDA7{?r2+gG#@RMuz29P^Z(o(_x2x%_@4LM&!kj|fq9))
z!>hY|8QXvHbtW3sbBCR?xBdM8TU|+!rIo1D+S21|EeaD7X9}wo)XFkwEI9Y_;q8Ty
zl4&V=Zy!0ll$r9cvZAi8EN@D>v3|8Qvs)jt!h!h>3=O}zpXW}v!+AVvm#UBWGe5x^
zg%4~sg{xjH_@%S(+#=_^L_LA~yf>l?&Rw1@v*78)B+0`Q7SDE$Ej8`>(rw(>^s|ru
z+}YckgB|`ly^6TWoYJc8c)T$<H2A}kL*GBRY!a<8XHVYati0A@;v`w`rGL+|Utw;p
z-xSJJ->h;Z&ZTfdpvy(>-4X3t@}?QPq%Wy0>MgYYrOCc8wo+B+*~I?LKNG*Gh}W>k
z1Uz+CnEwCrhYuAM`<7k*>hOKf`)@h{?B~KyZRlUvd6+xCk;&n@;xBb>kB4mC3ua$s
z71LkJzGq6YRK4iMO2KoP>sHj9WU#RC)}C>OImpZ8?&GuV0sF!=PtA?(uGUTAn$mS7
zHCR0Qz^WfNH`!Q8tNfHm)$HwL{Pjq%eCC4Z44ZbWwpu9ZI<3l3bz1Mao=fQ)dj2WR
z|7dqu|7i89uSzO~e@r^xf7^Mi>AK<Ez*&BxTOKfbpGjhhEq=Kqo@syaJNcNkPnb++
z2l7q0;I*jk?8K#~H6M$lr7BLC@zq(_=&o3cXn0#+ve1z(@6GuqGIlaO*tqY<>NzJQ
zn=b4<w~niF`s?^xQ#-ad<t7J+sJyGzk}IkCbk(%Sh|k~pYeV81&R8d_1z*)y>oDK@
zC_Lly7haA8or67VJ=hoV<V)_d*^;u*!{n;u!LIFFQ~x|*cw|s7yZfB{+zW^AM=6?I
zQS*sA8#J$|MO<eizwMvENsI=*mzt(ta4ZsZd^YubcPfvrM_9`#Lr;w(d*1)KT6r?2
zW75j2X#xTPQ`bek(7kAWA%45oybE*K*X-u#lH0`kIX)u0b^(v;+dyOWg2@Iy*89x;
zF<E_%HRr|;6~X;;+Vq_Y4sLqjH@Cezz5jiyQGNCc-kqu&W0D?9iCl<nDE6*(>1)aG
z;(u`c)K{jIvilJaSkhM7eKMF8(!WV?m+{x+mR}PWmZ#2j>?vKhwDf^(Soa>KuZ%i+
znu?-Tp@*Lyj5%@s<s{KVZ@#j(<t}!8Vbd~o!wS(OXBT^i<@k8NN{($bUTT(PRxl$v
z(PQ_E)T_Pgzf91({`cbn!`Vp(!{T{+z6GqSTrU#6?%Rb6&;RC~ed@Yn>9PjC6Ok+W
z*7RJN`bEaEWViY80BJQd7mk>j3>zPsu&<Oe44e9JiOGU6p)&_87Q|02TGf){w072!
z<JF!D{WVVNdsR(1e>?HUuA63<$@lm|=F&sQIs|XIY_++hs&;US-oHh%*LOFC@@PG9
zwoAHXoO1rkI)f*!Ga}AwY5Y~x7x3PbBX%ded-KH?C%>)T`XoAaUWA?Tv$$hVdiT9F
zpE+&Q!Ao0Cq?cVj<i^?VV5oJfYn!TH@7-tfxSt-j&0WaM!LvjxuU_^$r`R>7GEp<@
z3$4nh{(4S(cFW^&5@X1rFUv2ie5H8v^SlEU3STw&-}Lw{y>~4+)Xv1SWz(5Py;;%+
zf;fv77@NIbc78>-rSQGdJxuHO9*_GHE2Z}6$b!7NkLF+e^r8N|t&pa62A^v0oRU{j
z7gEn2unAkJ=yvH>$rSce)d>sbq$kwXFL;o}p{9LBrSK-#XT69MzDv?8*FOxsuU2!l
zDn2uCvfIvsUZ<GOuR1m}Wz(aq7jsg@uXJ9RWAswZ@MWObwr`=`3pZ!WsB8{3P`+}n
zxxMIp+Y2ZE7xPu;rXHM9uJkX}KY^$5yU=$>bHi^x?}jJ~%l@yv%+MORujin!=#MYI
z`1^k3B?~@QPPV$bGhub)y_U-E(6d1k_B`-%|K%hxRYv;te?>j@u9ikkWtJ<O(ks5Y
z<jri%Rz0_vXLiQ%8B@7seB+NO)e4@NtrfRtorr$QsT%p?7XJkf+8EpspL_Au$Mgut
z2Txzk6Bf5V*{swgylKLYP4g-@m_P8&l-TtwJLrqHaJuB@pkHfzb_u$KMwA9g+zS<G
zJJhHaT+d~yA+ncwj<U%Cxn(Us50=h5wz_G<tZ5F67VVOqf14`LDptL06ORA&qic8Q
zs*;SzWvi=BD`+oLco&*0{aEps_h0o*ZC#s78_s22<&*lxFVWH8nfN$la%f#{>bh$Z
zD>AfH``b21#+~}L^>aIO`g)<w97+Zu+fsr8!rfnL@vXFTsV&tnZBWWSbK$Mhm%HrY
z&wY2>e3BG(_v2{R++3WPy3pG8dqv5cIrCz>=5%!R9CWG5dik#LVl3|m9c7i5JO9hX
zNj%88sKmQ)Wp&lFFYkKI<bR1qNUxB~y1De<%=OzJNV_?{_!92xn!s=8D$>67O7>Lg
zAgQ3E#}`}{oMqS?n{d&8+qA2TE~mQgegEm_a;3(c4YI1&RE+QFHuM+O%hj;hD<5>(
z?Kw+up3pKi%Qd<?-pYuCf2`Ad9XxfxI)hDRp6`D6t#?`8pINopVlQ9PbB_l)im?Kl
z-k<4aT6Xq+jkC~uHKx}-hcrH1%K66o@7FVt6wbwKjTd})b9ADp;_DS_miH&_luBPa
z<L3^A?(AK+oNZsu+L`S;_0_K#`|7Tpc+0hB68ouk-p_$z;sI^5)fV4k+cjsV!GTkE
zzRdj5wv_MK62{n{Var23%-s1LBR9N>jx4dBr}*~h=1(<V4xbg)%)LK-%@pmFJzAWm
z+s=HqK7T@9UjD|N>zC~OMI~2M<-U+%ylK57Q&)XrPQskuMGgNZ*k0JeFJbfH-4B6B
z&PNhmE5i~aU!_RSIN1DXTg2<2neV2=by`&{Pxs>OzFcy6az?irry2XUW{=?O-HF@H
zI+$E<W&e*^QNLlq6yC@XRj-<l4^pF7PsqQl^CWEd1am1iQ`f>^=856DEcr290(=2G
zTPjUU%ioLh@7C*`rDI^X_<)qQ@$vghmL5!edVk*x(bbWGZoj)jZ%zw6xYsZ+$m1q+
z-ICQ0e)G9Se!S@|;`r_BRO>pW$x~LFY5xB!sp|V{drsqu70HL(PM>TKs^czmbGppi
zTX84RbIr9K3Tt*<-H@Kd#Zd0PaP^|omha{lxFrUE+3PQ0k-Ppk>r#<dHeXjgOcwc(
zUmvHy@$L?Hmwj+<_qup%%Uhd-p1#^UmFa2f_60VYDzSx^jQO`MFuA@|z(#rL&5W@9
zKTh?i&oerFXq|ff@2vOc4-*!h%AVHr?$x<n>x>fBReuPc-CXp2PyY8)p;Mz+S6<JW
zKX>WX$?vDe`V>|*YibCto8HwN{i`-R&}Q+%+{mgshi@HPwJdMu&!uH<_wSvaUv}Zv
zt47gjU-XN(C7#S+&%Jo>yklwUc_rg7vz&Is-Mk;PQ!!iPVye|2*+mSC<dR$6TUT!1
zxkbMtetEd)Ux$~@*C$oJnz2YOq-iA=liaOolV-~-u=zFhf|%4@`N&O^S0B#SJU!)$
zqj}>(_9Zu3RMl$4ul#5BRP>k`72hy%?eXeAx64_w)+m;3HjE4sT4)zONoccT=%i_p
z>4q!w8K3xius5#^%@WaCTcUn2DC^ZqzBdn#F)dqaZj;Zb&3N(d{jHmVgPw9eT^`pq
z&;LT>q|WQ5nL%tqtXhe(zk+f+l0#oAcc0j&b~L3=>GZ25!S0_5nx}a2T=P<McRk2C
z_q&k(i%U`)k7fpIZc9?O(cN#xcOfoo>!rEr|Jtrh<2RocWy^4&@#+zVdCf1PjCG^E
zH(uI*f2B(FW|`|AKEEw9Q$*8xA4MrC@9h25wAAR8QLOS6)imFAD=qdVE}qNf^|bG{
zXo~M+h2>kbpWijtdtvlj)p-8#KP(%!&zO6jsUa)gO7+_1yRQ`;=g-aKf4k>#e3A0)
zd;LGZoKtDGl3>+N;OV-0NplgadBl3T&DZbCik|bGV0}IESEGu_2{)x(J)Ya`oVp*R
z8SgsqT{GyI@Y<{Mc|KTv6FXsadclnKw<8m7TI+o0wcj1fzSWv1i+6s)yj^eE=B~YT
zS>61`p*?G+OTYDhAfoYIW6QnnglrM}=$onwZU_CbIkoI@`s2SWtFFz-Pi$APHOy2#
zt({e7vU^QbX7S7S`fT5YC1Si@F5kSZ$oT-{=U-FmYLc{ltbZM4sdp3h`Mq)0A)8*g
zJ*>JL;;%M7OZ^cSdsjwjmz{Qi?IL#j%O;=28Qau55<RDur`5lVyuz+Fvv9J9gotCM
z_<^ZR={XEW7p|}0v|)bjmqS0r=QZ`RmstlY_HCNBNI31H`=rS1AV$`^lNgRSU#yv5
z<8f)W%L0dR3CBm0hwopu%@JLBls}g3>c>4v0>>7KPq8a|qOGx~*^eRq{_Tgh7CqS;
z`h65;_Q_vp`=mPa!Cq~}+xBY(X1!hImGAM)ziE!IYvv@y`rNlu&$e7Xs8=fV_WD%W
zaM$Pd{LeRDo^~~=ebS^_>w8NYDi!$G-9EO;*<51&IeynexrK}0ygz0+RnCq5{FQl!
z8{U5U&Guu~neVxiB)(+ze!T1TbN!UdMzasQXT_?vEU|ev>G9F`jvFjDd`_SD_~^FQ
zO;e=Zg*K;5`}tn~`s?ezJog=vZ!+3{`ouO{=Qr2irgs=dS%3d*#+fwr+x6@W@4SfD
zTQ*$#bZFBdDWOAkp?+H0`B@)7a-^@TefG(2!L+F7J2S-3DEwU%a!q?`(TVv1OKrM&
zF8ME&Ush3l|9K$)T8Vw#VG;YK?%j*N<W>G@>Xcc(vVMg9RrzYd;mlq1e5J^RYfC=f
zY!sTySHI%goe5D)4O27T#6JHlKTGB;qy3u4JLmoV5WHCTfNtfaPhPtuYQG#!xl)kn
zFa1}&$V=O$YEHUV$5mC04=Q3U+-GcmhZ`zL_+LJA`tWiS&FE9N?@T*TTAI?>HKn8O
zOyBJ1T6}e$;nU`F?|j!&^>l^DiU?c5?Lj+^CvN`BGS}i$;HJRNTZQLdu`#VuW3}zR
zus|#B<e8klO2@)x(K&9af30)5FKVA+I>pAPIBUnZ8wHaS_iquOT6^Qwvx%RYyvqOn
zbz=T&ru=oCvitsDNA3yje!1yLbe>({>iuih>ai_+m^9z^{q6m08b5Z#t*TC`l0U+#
zd*TOs@bud)zxm~^hnqP3XEdGp@UTghk(Brpzn)(^n%^(KoAs(}(qHj&Pj7ylDcrKK
zuGZt+JClF@p`Ia&a{V7Mlzyu4Tk>b>uBnfA+S<1%Wvqy~*i*Rhb<43+>p#k!Y1yze
ztV}%3?b(~8%stU-3c4yAGG$MeOl96#xR%?rovAlgZ0^R}vz{Gvm&(z*kzA%6>UTnE
zd1PzHzDIXF*pHRuB|5y@8aM4#+I|_ky)1_swilTPRW8jbRiF5-Kr&RT+p;S3HY+z9
z%WGX8QHMMF#;<Of+e?PaNqp_G7W87^|0MmYX=hb@%c|1j#}2W_zTE70{26mGgRZ!J
zNs8aox=L4-smpD1zqQM&i2phevYcB#GWOoI(}xn~6-jV!b2$0wcB71K+M;_CcF$XV
zuqgMtR1D{1!(%LwA!n-QFZ3>PUcG4o|E2z0cX#iw*&{RcxI)nTi)>S(CVmU3x3ZC!
zdmXSfZ%bQ?`lseXg9~pOdKeZyZt3=_aSQboFqnC;%xk^TKjw>nenmEATuR93tP%dE
zru})9-M7PMpELUNKXksHbk(2r!2V$Aw-=9oigR6k-9P)zZ+7;7k6Vi0eVq^<y*&7i
z|CO}1E0uZbyS47ty3W}3<71M7yk+H9>la`9w)Grl|MRWPR7ii`)2F`oo>k_&-jH0*
zeDd_FMu|_m)%9k_aXZ}betM{Sdy(fJ>t~rU(+n=Yd-sm@ar_(6yMLU|FHUdY^)Xvg
zJ?Ux0vV;W%AEh^`a=y^L$)s1V`{U?j!SCW97I|*aTeU~)Wr~ncaaFH&(hctyr>Fi2
z)LYOr{RrpB^8YGx&tBMXk$BTFeAibSp}8|2)tcPe{f_BD(R$<k^#xB&<ENOct8(<W
zT=C~nft~AmC++IW{~OjbJV}3d^7^ZLKPIvDh^GjttXfiiHFD9jB_#}Y`63heCE}))
zT)q4LYVeLF^?ya%Zz=6@H(s+w{jQ_FQYEjDeBZH+YnqiEHMo{ddeJ;1<4pdXtTh6g
zL$i9^qEkD!d@U?glMS7q_I9=PtRFvrPs{aT-dt3ya{Abt>|=X^FKt<M>-M@i8c$a*
z=h_-2IN|HpqYRmeR&&)$PGoP5@wj;QhUk1L?-}f}*Fv;p-enzMX%>8OO`P+YTe6GQ
zSjx};zWhCxZ{GIM>+Xv`mEB!%MSlOU6$e+YDGqI0R`%Q4+*4&u(6ifSyR%*^n((Ys
zEsEeiEykXFu{mJP*^|**FKgPqa&miYFe$CLGeJuH;1j*Gd<nN^Z?2TBzOcL8@Um#<
zfvf6!jW{0IaX8<~dcAM0_Ak3S?@rzy&)kDzI2<N5=3R?PTWPxcU7v?va_an+1-pb~
z7H>~Tt(efsF~^jJ*=MTJwln{4-Z~ocdH=0@+eDVNymfqPTUz#h;neon;x1v|(|(V1
z4_my`HCnJ$l;`6@;|$SR59F*J()^#seA2Dc^j&qasWxo||I!`r#r8=*^VQeXU$a1H
zs`)zBl%2iNYlHUbsl_n6_442D&QTD1t5=qLaPM5p?KUoq)xkk==e)j|wu`!-exhcV
zvqkW7cP87}m=z-aiUt)Av+k7aXnJ<OsQAP4Y3({8ueWV_chyVU(#uNVu3h$fyZ+NH
z!A;GtY8G_wTsJenL`L4ag|}wo+Mb!Y|58fVeo>l#d4JUxi&xwBUn);Fh}L?^wjfsI
zYg9m~-kHV6m(M+v_jZp>*yig!n_VB;U*d?4T$05h%~I#=d~XfQt?18IPj_#-vw7?5
zx9<Dzsa@Xd;-B&P?T6bEb&^Y`vF~Jeo#=Y~%LzBtI9`73&d0Oa`)+2sottyS``y{o
z#j8^vo9tla+a@NHC%gJ?&L#z?O=czUKE6J@&velj)tXz1HMgFf`7w#T`p4Srl*<;6
zzHe?fWn8@WsEIjOrkRX*PB_Dz9e>=t^Dl8Nxa=z$b+)(0gIncp^Oc*gJ@@{%>W%6=
zSNeh9w_~TJo3v$T*@@ZJU1k-f?-nh6Gue{)(mJE<4uxDL_6y41{K{58bHnhZ)01*f
z!8@NAe|1|qNXLJUYF#^d%cpO_ck7}uw{4%caA9`BF10sz@)XX@->=IV999v0RjA6;
z=GjNlnw>(dF586swc{NuH@sxOmHoV}p|LlO({{?^Sq#hq(_+3&OsTBg?7R0wh6l&Z
z4RdBTN9G60RJpI-;~_phphsj|`eGH8?T?Q3t0+p&3ut1#l3%!dj%v<2rHt+=%U37u
z)ar5g$^YJu&wcsw_WXAHia_5@E8Sk`s?7bh`10b(-;X>0uPEtDXVc8@Yk%Li{P^L^
ziv?|cJ)SK4<nYgX{iM*-r=z>;qQ!DU61YBkZPb$A7T{UhF0#_-n;(-%SWEc2M1I$D
z&F2v_oFbHFt;%$;v#wt}rH1$D#<v_Ib?3bOCZ7Lz=)0!vgr3(Yh0NG_4fOVUP7t@9
zzP->feokQ8>EjuvDg)2va!=YlZ_<&8$y#5NkG835J^vyjd2h)(PP4gEA(JLP-F%Lv
zg0X+){OPmjNr)^Lo~2ftVENxYOh4_PO6<c447tJqnK}o(9v%%9iJQs1eHY*2oHc@x
zj9;(6Vtpl>vGI^`T*e398*}H)`7)&?;KhN@8<wv-b^l-O&9&^|ntZC3yEoVw)Lrbi
ze&nG0(^^eexAj%kPP?r=#{K^S)+{Mp8*}peruiF_6slx>>?Wveab6eUo;_16^O!07
zl{K1+-#Tobmm0cZp=O$#_a*Hq0ynwSE4ZIck4_I0(l=SsZniX7y-CwbS<0^?_{ljQ
zHBV0Kz?Cy5w+1ia+A<~fjr+qV%zSQF)Q=vSoH{-7i{KL3PR2b`9xdCO#P@mY4jZA<
zPBp6<BrD<@8Rov`e-&|>=fo8as|KS9GcKg)E#<5@TpHJ9#lPa@Z_|4}(N<N4svP_J
zT9ARkz=wfB7xz?oN@_uBUP@|Sa%Ea#PEJx{a&|H3{N9-NlWuPl{9ota_`_~OR%+i{
zmA?x*jeOtk*x4yttu}p$<WD!}i5FyxMOF$unQIzu9}vIT|61%HMKJ}9lhd;=WvKPJ
zFm)eI`o6uM;g06-e{Z|%ZR$c(_6Ys?7<q2>wg~Y(GdHf^mRWXG-rjrOoH?7Ge=WN%
zGCf?k`rDJ6mydrqpZ?}g*XHXnS4681=2t}KS1Qk0_Wx)3{a?jpVO#gKOh3CV@6xsv
zt0zw`4bHz&wDaAqbq`OgYMXsnmzo)Rb#0DP$?PQ!=gw|>_#uDquh#Un2E9LjZ}Z$-
zcJo7hnd{-tPrv5gig}gSnYmT-^})?^@+(<CpXJi~Q@(ngM)Btl+dQ{FJL>=8Z|U6P
z&w0(C^}DB@_tTn|s(4FNI5#+C`j5R4@0Yz{OJNa?PWzfR`_K~e%&o>-Uag(8S@Eme
zzdzHyzt=px>>~GPo{Zb?<M*H6@y0gw{?)gqcdah^eQAQSQS8zt>8_12myCaZ>J|Ah
zW$zQsb(hQklvN%2R_~F2=u~9s<Y}(|LW^(aI-EW7<cUlF&3D@rRHkv2)dj7&Sy}Y&
z^X>K1&+q^F>*x0L`+sZI+NCv`5@+zZN%i^q2d!H&sbl58(#d8I6>VaF?~BfzEhS$Y
zJl&F~ylB$Yl>#oG^e=CUS$cD8fUaAMWnl2BpHf%$ujne<*~6-To$;VhUYd^5ltm7Y
zwODKCH2#Te+^6gCRgbB+;qb4ro!5GjvX^FN?u@uvT6yr<0uxdGFD!MJ*X2x)3Y@#{
z`N?jj$;n=G_Zy_Bz4<u()9E$K)vX-5Dkj}n`MqfF<d<sSJ|6kTs%hzEuw1BU_RW8J
z+Mf=+op6;wA#--s*|W*pH@0xBU)sdGTylM0*Rpj15BDB>(tDfrBijd`D^Gjv9dDh?
zeLkt+x<tkf{$o$JxUd#Y6P+Hk{z-<q!Tjp4!EPLD-zoWTUNm!k_L{sKciZ{()-K$|
zyzyx3?TlD+$?doLwD{H@@M}FD87iN_I%P@g!KMuFVjq?U?myFNjHPe*O%`i#RE+6a
zEO)*9FB9i6^V?<1+p5L)c1I|xl<w@a=~w%A;iCA&huo>6wJ-n8`EGx_viPE9-@N#x
zFHRpw-l)IqjrWJsE8aiY8X&Y<iGA9{6{+!_s)^4{g`?*+9`5F=<oevXCAlWt@a;)e
z;Wf<XZfQ?x%oNy|y>Iv0*)kS^YnX%=J<XiQvovX1_lncUb<SGtF`M*C_TO*M&y3+}
z@3*B+T>3U4@y!m;U9Mh+|2{m(nJJzWz05kZRw40r=Eo;Y>51|Nd|W3NS*(4PwSA?v
zVW(eJxKhP!<CS+fqt|z3#a27~b!NRUcEwZU2%p1O&FZ82mvh)f)+Nk~j6G;{U{l1#
zBa=Ng$Yo6NRIja1h}+l@ROIP>vA9D+>y}kZT+~<QyY3?2C%*jU@#>B8^m~ir3R^;+
z@wUwWkj1_+I;?Ebj)y6Nrr(Rr`?{|_=6t&6$<)d-&x*etN&PydODF1jsY$9>o|r=Q
z3{|aN4zeDu3wFNWex1XQu~a%?e|J*i&gwh%r8~DTj8_Was^Kh?bXU8PxZSlnv|N|j
zKVZq~N#5Ly(-y0rd_G^z|H16`zjC)f#AyAWk{Qnwqn&qvY1umQhfgQmP2ZgSQqU;L
zWww*R-SZ(?hnETK?)J)Oh|=a<|5jI{;<R~_(}YdAkKQYE={#1<7tTI-_}Zne-*(1o
zk5}J&cxZjYMJE?7H>odgkMVqGV_5Mv?TE9V{H<5{DPom-Rd&owlv<g-=tJT&*N3my
zotpNAb;1>YXW1uHI2YY~@%s?h!8N-SdAqLcpDgqA#A3(WPgN6^*UGGBy>vLxdSh;y
z^XX_N3nr^C+t?%HR2dAHh~AzzZNVmIrxKrz{X2j785X)+pS_L4n>SqJ%%@VPjq`IY
zBI@i~%|6K4viQt>Ub{kt<Dj?0HLiuZ(cMnHz7uw=jXZJv)YJ;A)*8K;DlIqsW7^oP
zTBdYLFIs+B+RGtz-U+^f2*=Btc05z#o-foi+v>enMDe|}lYw4K!v1i{@Emv;#h7w5
zf4YhH_dR=qEN&@8iihrd@}4o*L8j#3RJLE5E&=Kb#a(tzczj$qTr=_3Y2FuMfnO6@
z&#Hb|t?I?!v$yqYAeZp(<`a#-E={m!-y&PFVT-QYo8{uOPp$}<exzwb<;0xbX4_hp
zo!Ka!WSpUMPnk2PkMZO87wcDhH?7{kQ}t_r)iMt;Pj`cBo&8l=5;r5>ED|>HRa=;#
zeZxKJ-UVac@Pd#_`xiI(UU{Kbb?(Z>KhqD?7k*i_ZvDn9EgchX?U*`+OC&5ngEKU$
zYSrppXC5a?*f%~%Ke}1OA?w?^UyKV@#oc~*$7^1~q*C?ziGh9dr}drToG@$Z|LLEb
z=1K7J85yr~D?3)_@XdP7tiGckgu8CAPFuQJGJAHP|BQwi+s|yY;5Zq7(TQ#1vz?dk
zYfsnxW#t~ZX4aOQXGIToREYj$*x-;Jl(4*TN%X`uF0Z`frDty5&EIFKp|rSi@^RKL
z=FSuDX<ZfxpP=+Kup;)_#rqo`sD`U;P@5t8Bl+z6J?!!}R|}SJd(r)1qyFxUB1PGW
zpC{<u|GX<oeENf_p>d)sehQ}W9X<HnA)_gUbIIdbyKji-JG3fXmDWvDlbaCbpjNVc
zUdOX{=NZH9bHCT!_WPXbgb6=1-cCOmn=aAi@`l0d@mlWBHS<4J-PMwLKSQ#7H8Y>K
zN^kSbup7%|C4K*E7&H3|i+(xmA~W@k_ciuC)}p+(cIKL}E!O9-kaMY&433`VejxL_
z<hNs)XU`ZgC_Y$r&t>vnms5Sm1AQEAbq!`VTv0IIX49$mcwNhh-*-g6h%S-U=6mVx
zui<~=W|ZZWEcTF~JI70GITWX#wDnY2c#Ye;%jogKjN_r63_GscIQAc3weyy{(wCB>
zLUWhj$xghrTxqII0n>@4p{vvR1ap=<@a(PGp4t`c<oBlGj#}Y`_g%?5lise5;SIR5
z;+F1`GSxG?LqmD428BvCcAwt0wQ|B_1M9fi*Nz<TTJzm^`_{bvrFVWr9y}C#IrH$W
zS*;3(7lm}oXlE2nl04<+p~HA|_mt><)qqpw2E1C=1l9{L-}Q6DSB6Cw>U<pvQ&w%X
zf3aytaDj7O!pwYy+EXjrO!wS*DAS&me3i+>H=E7;RY3XK1>4>y_Z@U!f331DzxG+n
zJrRuxyHM|hE5Ugi)*rmKbnc-KCnwz75c`U+!R*STK80C<7r%+QF1MNSZ5i9wc6n`u
z&Blzu?WTTe<==#rMP|+NkNMVT$oQusuw`?#dU3|x2CFpj7o8uPo6O}?MUU%DWr;J`
z&6URUaL(5|Z`M6$`fhQdYJ$gl<#Olcink+c9bZdnIId@myYfBym&R4G<i0%_-+ruG
z5UFM7AhK!lV$o}UiRYNN6gRtR3LWazWlOfKysvOLG`8<r{Xc`CtD83nxx7FA`QSEg
z->x|mW-W7@duN$R)5Nx=v-p-Sf2O~2MgEeud0I~O42^vP!DoG6ugWva+<B%fQ*?D_
zqTKzhYaYpD$|Z4pFPaqpYEhT?Yxj$?{{?I(?NE30_v8_K_)qNfe&ILnoL@IJN*MOl
z{rmNML5#bLX1V3kTPNp4&a3(;EZ~0lw@gcmsMi0A87Yt3y~1{8>)d(GwfBN*)t9$j
zs*aC>nQmL<DO@S(S(OyWv%2Jsqcx}O`h?2;>ejA0uai}r0%uFP?24(p<9jPDTwp?Y
z)?r6JLpjdm*v3!l%Q*$DELLuLn)3bU!B_YB1Ad3ODFr@DPFVZ?e)T;|%Q}~DNz;}!
zhWooOnr6w)=*$0JqWjkSxC?X6sPRtj_~!GYI`p^EbD=9i&XdX>UMMkY*k`Q!aP`tZ
zC)Zf6T=`X)e}(oMhL&2{wwx7A5q+OEPWc=t;JotX-<5d}{HCrAvYz8EIJay5q6K`n
zE!*ZA*1cmbPRu!WeuZ~JeNn&qjPnND4f1pL-qc)tJC^PLgd0D8$*p+R_T{z2R?97g
zPqcp-M$Rhoyrp)MsjZo9(~ZZC&3`Oar!Z$N=xlj=zGjJOM#$6)z8}OkZWg$nb>Fy^
zrR}~*sd~ia(8N;9sbNfITDdHftFPq>>K4xxeI?Yy_>;H&q=>Y>pz-{GpZ99`R{hvJ
z^;f|3ixKX+hYcD1?HiMu<vgVds`&T*T~^_<qF-J(=>#LQlxuHR2*V`N>qq1SCVo2_
zq^Q}`d@;~9dbaD=snM~2W#(Mwn=`{w#AWN*b5o5@zRZzXxw-7*@gUZyk52uihN<Q9
zC)(!O_?TF%F*EB(j+WBrYCISjm1=X1_vOt00jrXXf6Mzy)h)j{SzTOvzg2}f$E2&A
z$7|Vy74uIqm8LqKbDVE-X=0<z?pF>obUNiW>RU)Tyw_f*IagtWKdY$K#D5R09lx)A
zGP&+Wb#v(K_~7^tfk!VKI@qSz^U%@kXUe|qVy`prM7oN#+*+db>88<^>E0_otPTpS
zjkj&uvtZFK>5I0jnA;2XT+!O_?_#&q_o<=vv9s4`ms?9aotd+?tnRLT(VCD~$L6@s
z&J~m`ZTa-|w(&EC{4Xj$-`xDCJlQDhb^EQfm)~}5yytW}-tvZTc--=<g@^xY-2Qip
z@pMw@?nrs_2dk65UVc6OFr)qN8I0L4_E-ij$Y1dG_4dPz|Api(Xyu%^pIp3l*1z7h
zH!m3f@_lr;{n+A%g+^yD$6uYczbIka>41vYae6@;^4D^$_dQdyeW`U@!@oT**&O;~
zlVXoHe{J~x*_7qSgP0BH`c%&!5Zx6aE^{S9SfFu#d+uxIuuD~1&reov*R}lf-|~l0
z%j}~`PiEb?qItZ5;ZWg`qZQ&p$r01;WNR;flbK}hQBZy9<{agtVp}txirDns=zYzt
z`pc`S^JClcvgJ96&NDd^KSVxy_rPNIHmlMp)h1QZXYW^++T0U-`PAZcqjKGW(vD|G
z52$?Y<VsJQKWpYp=b3(Uz2E6QTFNN;`N2VM9p8s`!4DcZeZ}r>iCX>X;Y#`4J4^1Y
z>Rb0by)$<1#>Ynct5(XTwEkLiuqXL#%-g>A_VpdBH}Ks5JZXXe(_P=Wi(9M0tCO9L
zgWTI)pByQ?p}9r%&7H45jTvOROaDvid9`$H@{FET!?ferQI{;I#;k@ZnW-0KHqD+j
zJ9tOsLg$%3PyBr`?`Popj^|yb57}=r3tne^!Tf{k?5xYK_J_;TE)=8{TuEcH{Bxo6
z%O?BV0!%CaeORh{<<UN!6B4cIdDZHhT-J1L+Zf%kYWv!ZhwbNBPxD<_otIRUw^m)k
zcTTO=s?Hnf0gtVGsytfqHoUA>P|20qHs9z<>Q>=P8_wo=uX|H@+`rLYNm@zf_K~-*
zobJu3Jj~3|r#|&x(1ooZCVXKK?BU~SVr!9OyKypc*TdJQ3k_wi{?TIJAN!T{-G-n=
z_gCz&-KtXI-F4&3EvInCA`b6!`%RX=@4mEJ_!*Dqi%k*-wB(8=b^d-Udi}SdkPeTl
zY@cA$IoS&qlgjt2wU-rJm8!-U`DT2bbK)XzhNrP>&pZFp6HWhf8`-PMZYxdx{+%tV
z;*^3}Ncrz8Gy8Oc#r3{qUW{0%RX?9e*@p91Zhh<Trivev7JX6qUi|Q2bavxnr6RT+
z&zGG4WpYnf*oeD&j^T<kjM{(2cm5W=_Do^vhi8qJrwl|y+5Y|5760JhmBSOKOR`<I
zc(o{Y#rE=+Gn}VhGH$S|EjaUYo2J39l>HB;9&o?Hv*@Jq98C$4d?}Ww#k(R}+n1NB
zhHlfS-Ks3JV3VYvZ28x(tej!3qWWR`)<3zY(|bWFUF-Q-zj+fj^DgW1to(Fgj_{O_
zrJj<HuH~gH-nnN^W~W2M(Ro&qUWQYrs|N0^VC^x#&{Ou|%<|PnMTJK!xqItn7&Ulr
zy}sUk;)BG)$d7SS8rOC>EN_z8omKdM-YTW`!^fLn>+xN0mYTD2|J%FPHmUh%{8sFj
zWhq$YXEUoQnp>uO-I4t<O8w5<59a@y$>}{gAn@U4iM*dO+zGqh9*(tq?fS(a{Cvj|
zPS?oD^>$goe;Gt%JyR2BI>=UUH@_EPvbIz@w&SVZ0f%#u*G(K`l%C4GH+gj-@n2Cz
zs*HW3cIl6at%l)W1A|lLl5`Z7EdS)sdS}@oCinb1IR(D$GH1*BJ0q%^ja7I3aqMXE
zpTc9V`z3Q?G>d=cO5rl?a+jrlH7prYYwx-K4eeaGL*?78tqbb)n;yJBA?PVT?e|^b
z|C6SO)Ni;{cWR&i)p$;i@CDJYIF5Yq;0uy#`ZCYeUg_j7{Qz%f77+#p1`Y<<W{K!<
z%ZvO|=QA+Wo@ZiE#XV|-wAn(hpz_V$>|$y6O&UL9_b>8wox^4$;I^su*};f&vnFNC
zHlDOXRr9AshTCpVlM`}G88IdfU58K0Z>dkNzxiyjTx5TqiALqSo6_AIG#BjFdOdaO
z)R|NJm!CZO`}+T{Z+tDao|S%lQxJ0|{OJ;%X}eGUQ<9GrJ-<)VuKtrrWvK4EX-}VC
z)%yADXLtU*+RuMxi=TWMI&qKgtE_oF-LsRTbkhPXBSn9nS^44rpZfvNXXkG`SFhIo
zIn=Oq`f1m#XTnoW>p!JzT9f8E&G*{subWP6S~BP0?$Al+pI`0jy5c`?MS7~K$E)2{
z6V^=oxnjo&_v@>E6|7i&R_x~{y=ng*C)EY(t+xDjq26@Ww4)aBPyc-`+^F%)Kz{M2
z70qGGt}gw*CaNHP?{V?hMOJ*b=jfiw+{okQZ0~-xCP?bV_R}>B;~#x@{AB#6HoCWa
zf&UJX%b%R=ukZi*`(ESR=Ki0X&gd^=^?7=5dD51+hy9b8<or(0QmZ}S{ky2P@<V2b
z&JpF0zn5oO9h>DY{$Iy!^})$Y9)4!-5#7xrz_9#O<;Pd6n0lmDQs*A5a%_Jv|LRqR
z#%qj!-_24KonP=WJTfjlqHIFUQ`4(wUokyv+sAmJXrAtBuDJdB(^j3_H&1-4UsY7!
zi|6)T)_?0ZuF;$R^Nfhak1bl$KG*!3H=ln}xdr=;i$9ls_iLW8V)4N}*UrClS;^_s
zqtWnr$^B^?f~R$-GS=&Vx;3RL^lZ2#PkLq5b`8Gg!Z!rlw>|OJu=My>I9p%;=UpzZ
z-p$!H0k7k`SDpLty=~gFtG`!0tNQ#(p6k$}h;yf|u9A4o{y9tj-`~VphYwqx;jpvR
zWN1I0KS4vGP2_a)f!Qy4_r{)I|00m>?b_*|d20ong)_=6_A}bZIv>t<d3MXD($%7D
z(>{smr>|e#W1;u&_^uV<(o&VY8vGu6WK@#BzAgB)F6wW<+UJjXL+dq)mPEbpy50DX
z@AM8GH%p(1m0yY?W5qu=YMkA?ozddG*1Us^x;6>_Z`aI=7xS*$&gif=>d>6Sb-x%y
zE}ogTkpF6ht*(s8{Obn$^Iux#g#HT8efvcBGRJqt9+ef#($7^Zmd}5?cEQ}wHDL@v
zF=F#ge6Q=f{_K)kH+hd=U);aD+RHn&_FcW7tEtp(e8Xy&h2ZAx9~?vtW`E0@<iEUP
zhs(Ej{J%u?yH`oQT&T9o<s^f0<EoCUOO`KhnDysvg)KXmk=CnO_1Rk6S^nrwuVUW)
z{*_XE-#ViMC800xR#|Q3?VM{|u_#mi-G3gwuNO@pwB9~CU7qj$o^yWR`|E8i&i?!O
zne%W>>6dSB|Lwm1!Qrpn*&Pr5&7S|g-m=r~jGy24`!W^l<Ni(BYxg7Z|KZuepC5g=
z`<s8c(5HviYksO#*H+}nrL+J4`s!@^<iq{!AKpH=+J5=(^nAXY|4HZn?W@nJ-(y)*
zxu^b5ckKtUT?I2_Yb~bsR@;aAZ(jU;dAs|2zb}Wsv%im%-&0*$QK00ts(le_-LvT@
z>nv&>haF-6_WdDe-yyy~rQg22_{y&F@#BLZEY*qkWcK`iQBz-C@ayu$?B^Fx9{m0H
z@!!kJ-0wcf`aFKkJm+?E_y;Doh4CMj+-`cP^dkMj;^qer`Q7vH$^4x&_s^$qXCLma
zpOIPrz5mVg!<Xm#6xMyZJW*nE#HY)D<(UtBx;guAxqaP@{}->-Zm;jMSXjT$-p<0(
zqK*Cich}j++5cZ>msme{_T>5BKB_CU#_D~2qwBkH|F!)o>hAJ=@tv)g_uC(0k^jFU
zagI}Y+|Gi92Nd;IuC1ynP}(L|AjmrJ;U8{^X}cm)OS+z}_6p>9z-DaWmEWamb1Kg}
zAusLdt5s67W!IX2Oo}|TGv=O%i}d|;kMBD;Hn}u$*YMl_bTy1W&-1bU{j8Jgvi`2!
z7q$M>%70tqrYHZcjhtb0V6nX+ONABdCFht8RV*Uxp1faPUa?`~YMZkr@zqQDlo;L_
zM`btsnf#=r;@9cl&2O&yv#<YG_~YI2*jd7_teekr)gF_m`n`;$X}bUX8;jDqW^f)_
z7js`pagFOt#Y-g$AAiL&zgPV~&2{hLvW|M2Rr($4?X)sg%zp;eK0fEMA#mH5QqJ~0
z8c#kib8nD3T@;h?@3L6$q+gS>_O=AG?WoU@-Po`GO7ly_#<rtNz8_J$)?iT@+cP<I
z>Kvz+Nk{jl3WV(O`<BpYcV^-I^r#yWO5D~73)6ojGuCJoIpueRK5y6msPAmjzv}AM
z*`JuKSpO6mzvq|N`=1rNewE~5i<aV_mlZxK-RnGifd5C0?y)^Z2V$6{OYf!53RB=W
z=6UC6H0zPIWxo6CtKWpLUwi({^R1buY(l&6rA@okS3j+4@p%{V@Rnurj28;~GiEg{
ze#%+6)=|4-?bl^#SL}XpOfq%&muM>=XuZB6+xgwsH$K}XIZCV6L`lf~sDAw?Cb8+^
z-MELJglgVM=d6m$l3UIoxbuN+&87NJDKS2id^V=t<SjoR^joebT6}k!n_s)l@(cGA
zJ{qu`@BLi&=}msXtWFm@+rxc^l`NYguRWDH@u?=nAVzHU@7-x@7oOQN<MZjdPgmnU
zC0#$rEOvI%mv5_PWdC8?G*f^2&sZboFN`aHFY_pBDcZTqYnA6GB~yVe%>(npS1*uH
zKYxDj#V^})%a2^rH|f2)(>Ij+`O}law~7wrpHKVwsc+%sE9p=7#H2>9*IOn$A?d2q
zf-@UWZ+^3u*H-lI;VS1y-fOY{dc;ExxI}(Eq8qo`S@=|^vIxs0&wcaO9V=k_^1=W9
zTGP|^sn?IjvUM|v&bK#gK70JJPh-gA(EV2eG7YninAyagdvWt+L493$pGUOsW^0Yk
z_(xY5CvtAp-EGI@WbO9n!B1zMqoo@^TdbUR(zJw8Lhfq6;+z|scRgRowBUm2w8Cf4
zeQGW5^IB~?<2|7|`Bl?BmCzRpmMiWIkKY$%r}DET^2uZCV;M8fJ^3dkx4d>a>x-{E
zqB4(re)D{;EqgcJ!|Tn4O9@}|ekH2k-5dES$NkjGO;x&5nOp9!P2A^TxwZY)$%juj
zHQ3JkS5z?R+sf1%GYnk6@V!XWuPvYQ?RVgfh=Si?!3$2hYR&R;>|57ulGCiwVl8ZY
z$SGm%FW%1=uV`I)J#}K?ky{)c`=-90J!`AhY{dh+=7`<grB}7`s;J6_53NnJHNN!-
zOfTd+*ZAe<2mAjvHS<or6`cQlnc*~N*53Kwckza=-nva@<|@&ihyM3#uSu9aj7?$a
zQkGlvt&8()ne)sK$*k%zQ})+9ThwsIR6TBCZse@8OFS7JiasIpPtIKw;LyzG)AvGJ
zwobhD(u<33ntFlS9VUxTJZG+sE=<2VqgkS8*~NETE}XwPVfljPR_uR2xk;&CO27Wx
z;MhF-dgkH=mxdkbQh#3k>}Nl+D}nz^rFq<Wu@Jun><gv;+~?+d$GCrX^7dsnU+B&M
zo|L{#Lg`YOaak$D5BK0dBF1|?8rhnE80hCMf4b*`zg4XbyLR$x^_8!_yPC?rp8A4)
zdC2n3qW0!xk_n6Qo4#`=C<PSU;lBQKW>llV&F9H3uUgJENSCs;yijAGS~ItX`^S_&
ziVx*?MgG{!t<2U@{h|IwNau=uU0>hvpPb)xDTHIAOKynak4C1e{D#M)joI&tC_G!&
zVBgEIrMT~Ew&~@U>px%VndWVkvomh;rf(AJ%d_KyCkN!6Kd>xz|BPqlH&?O9RZl%H
zR&D>_=WD-tyGjiO5}#G9-?%QF<5T3eL)LN&BqC$~aj&=~P;u#NPMr1QLQ933MGq>H
zCnaBRme!ltqgz!wgX8nPo4GBA4BX0pn6KiT6uZKxrc+pWme-3^K8;MP@9eA(^Q&&?
zO25lqvvhgHdYwg!Ulw#sIlK9SP4TalcA<H{4r;&qEmv;mayi3ay71x2uX}dQO%J}b
z?T)6Y$fQiBGfoELD+9AvaQ`{~;j30ft-a^_<@^DL$F;d@CSJ<&D>OaZ`&}UAW6rGe
z`qzJ|3S3G*S^Mk!A2ok@IU9qDpY~NOGt|?jT)Cg)8pU3};$kI7dt{B)toVP%@m0nX
zRvim4of709p&-is`eRj;jQHh0!m*pb2Yg<Y;W}&Cfr)+s2Pahp_MGyxY~o$reN7{M
zeb3pWLi+F9yrc_RzcBr8PGk7&A<cT{kQ8gioLx10SEX6ZHOMUQyrdz%=4#0ExVc~A
z_MTnOeULvhmwQ&s0n15ePWd~`{(Yf+PT=pLmuU_%&+XpMpQC1;+V?ji%!0+vxch3x
z3ilJT_m*2T?~^(-n{5}jrQMH*4}LtjySiC8VyU?QycxTnoiQ>mlYB3!)U#sO*)P4Z
zr<Ag-W*rQWD4(NV^W2k-`CT__2%F2L<@+l+U$CWA>@zBu5-?BmS&02N>wt6am%r{v
za0xhXvhCIV3dziUlcVncd9*t6Z}GgvY4`uE3cJZt>Mi-^ZPbC)Qw-)+UTyT>+ZcLk
zox_FJhcA!+DhmAnjCXnc&CUvi&$BZvwZhi~oby<BIzjQ-8KpOG-uww#`;cShwFcdS
zmd#pIA}_bR+VCwl+jIKsO15BY=TAKrmRnrj7fkKB=54~s=o30QHrX~SBtu2-+Ug}S
zs@tEItU4|DL$&zQl60?ql6K-7{J9*iX2!l%3txS8(Y?Qq<@HZrz50vEZ^upfl}rz<
z>;EQ4UO(XU_v8BecJ+MBJmy9E8+I3*O-u-H|Fv8rU+7ijjFPurZ}TEN?uJ@aNtDJn
z&N2VQpQ!5Z+N|R#rE97;UD_+7FLIj573H9nbMA*+KN=L9lzK0&h%M>8{jB4Yu4^yv
z+w@mzk>rWfnWnqy*yCrd=Dzf*!BTdf$m-2*lWOnr2y(m=a%WYkk&&Ic%~X2c1;wAQ
z-e%W@9#3==$@nUDLdhVNZLvgX+o1!!Gc5KkKCt!WSN1I1r5mh2gcVF^X|QQcwsSIC
zvh{`+r<O#G))Dn%^O~ORO@7j{UHnnh**#&GcCMar#i*#uxa9wXl@2p6>@;;+JS8Hu
za^1U~%XPe}SI?8RF__$tSvYM@g74}YpKocBfqgt{ce(rx;5=|SaxnvQ{ocqEiLviR
zmbPx+TW4`_b&*|+KEuSWd$nG<%XVLzw=`Wm$)WTYzZ_5LM+OfoCu#pV_AZqnk0$wu
znyeCJ^}mv{Y0W>^7`=~E@(!NPEM-&=SR!*OsH9J!{4&Gk<Lu7fcSOIP%}jc&y+N99
z+eK5S1Ky&x9tWF)E4S@(;SPz}yXH~1)%Mtg>^;loslER>t0{l!!;I#x($27qt1^5B
zj}CZzOldQkQn9sB!OEkVS9fmo)Ni*mSbuowN@Z1>PKvw5m2>EI?}NWfjY3Y?^SzN2
zSb6l!-xOQ<)DmZ*n`)1JZc3f|)cW7fZPmi5H<IN8r?70&?(se^Gby!oO8Bd2ul6?G
z`@8EU4s`s9Z96`F+4{P6V+;KU22GW-410E6pU%T3@VC<Oj3I~at7YD?!t>UN2ftDJ
ze|j6&b7uCfSDgztACfwFfMdt>NgEE{5vYkgFaGq!ti15xoAWnpU*@bQT02Wd{QL(U
z=i86#MLV_l172O+6r%Ou$#W)&qm@SM9Ioxq2+OegasHJOqajaSUs1%iC))%JURtq#
zUmV$;5+~wivg?TU5lNY&Dy)9pA62<7h<=#Fed~ays-ND1sL!5^JTE)0a&Gv3!GrBb
z^6trBCAK<g*-R?!e8_XdtM}yr+wM>^*Dr!vuXj)8O#i>+m1aqZOslKaD*4-d7v(0-
z3*EY=T%qjJ+c`>hv)zubck4D?#CDJI^4d4k9M-L>`nuB~f{%ZJOaG<KQ#xB$`OG=C
zo-fwA>gV@`w|3S%`eNnVVpS_Gbu_W=qM2Yq^<*#WkE+tKnu~?=uDz+BZ)KiS*VMN(
z>-6~tU$>?z-$;|ZAsuYeEt+APGErgq(?3<lG25@CJ#Z5gWiZJ%V;1BIbbj9?bhpuK
zdW+kRO#$T>q?eh*<rx16b-Z=vYL#Hami1;0GpALq6=~2D_?X1ZvB*3xwdzXTTPC%S
zTu-KDFJD%<YhlsWT|uin>$iSc&CAg8=<-^<xGl{W{upq&O3pLjTkxUOyx>fnyW_{z
zya^}Dbj^&O`&v&ZEZn%SMC<Zo->D5x8||V(m#`nK-^&@pJfrXGRo?Z{k@3H`g^7mT
zS*bfOpJ78xSl;0;DbA|N5znt}`Bt{}s-W?mUI%}(&{@J?7e?oAUsrpP&na`q-jB1E
z&(_M0JhpnReEzz+#ecpqG5m71<}mwRs`Ys>@6{=vs$%pS3&I%%yY}2?5!mtUrHP92
zCs%WUqd6OQHMcEJ_;NaL!4^9kHqX7U*)pb`U+nOp(wt$<yzWB*vv%htyi2P%aqQuT
z-MkI2bi5*ueC}mfq@g`;JM)k9ciVXOn}@78WqJ4cj@KFT+rz`f8~kFwuGzb2U-d-M
ztDC=d33gp*mD12VwQ_mr&b6Y`4>at$yF^`D>n69<_Eoj}Bpsei+17u1^>yDZ>)-kO
z&PrBVSMpG=sb#%+1NZif>1$W&9Zt?ji!Wt5xa*w+OWo#7vlnKzxA;G=I?a=kEbu_-
zvcq|ErjEpoJ0{-<n5)lpXV;fCdzHMn{nmzVJh)mZ_Pn&=h1#op&(d0)+D>P$N`EVQ
z_3o<RK-=uKKOWqPT9VK2*LN>f{+{f-v==qg7HRETwN*j>;@zr66$`i4$z5JH&n?>e
z--ma1AMTdle7OAP@5hVx%kO!#&0p@Kg_J;wU|H~<3XT#!r>D0Ulz7-KHrW;D`-x@M
zgw0W=o^{3Ri|T{-+11p>>KUdT*|b9Zs?6G}G70-V*T230O7V7D#)TCIq2WyXE3Y5l
zuUK+C;Be#V!&>U)oO^=OVi-JTDqs4_tbHf@QqUupjjv3sa%TBh2d7<{t2STleQ)@}
z&rEN7%5I)4*wKGZ^3v+a`hd5Kxfjl}3|ls5wo-e}MJespHkMsCyv?*aM47wRd2i$n
zTqCeweeJd)p+}o`_vX)981cGL*6(oZ)i3)bmEtRQ1Uxa0y&SD(wr`_d@2|%{ZoQdQ
z#J}J5`HZ`(UN|I%@3CI@z$R;@XM0C<uwB-=mlppEeV<=kcJGtu`ZqfEnd{Q$?%6Tz
z@7<W^?|)9>K0N(d(50<?-KW*>zM8l`E@Gyfx$}>}?j<po|J;dazWaSn)Snf(|6<x5
z)^Do16%%iL?dNL&yZpAoJ@Zayn%U3JezW+L|20AWS=oP&6e(N}u%G3<|LpVKUhQ(K
zfm#0oylP`tExojV*6ICh4`-Zyw0+v&14{FB_2f*hTct2w{BrzX-fCwq294m?Ue6rY
zOjC5(DBzMMrIdf`MDO$eD?R(ZTd*CBo5FZaM*M3P7l-1bRv!Q9<<ES-qzFfSTKG+~
z$YcI@12z|{?Hd0@mwoB-JMF&lms-G-ed`Za*zbPG>Nn+%$J4d0(;sZ)cQlUvQOP6h
zx-oM~@Ro;5_iPoc3GJD#)v$iXi`NkhA7>vw`RCauaZ}0Fms~%T7KW>b2N*wmU7Ij@
z($}OwotuH?j;@?<^50lQy9M28+G+iAe#5(i0^y5SFRbQBK7Zvx_SFM3qEBCBK6#^Q
zLiX#fxI51(3}<c-(%q>QTl}%}RfxqQvA#YxC5s0Z@y{QuPYn|3G~A#3<8kGMoj2CW
zZF_H-EBG+a@~=r)c$-WRhu%Dw?3RsPAxA&B3inM`*1h@Ux6o0BYohvr4R>#a?z?}j
z^{(sB&yA06-@UZy>1RHsQ~xA({Nf5Mv(dXb>B1Z1)WF}fn-v(dqz)IDOmXP`AnK(W
z<&ki?uq|2Fur8R1^$o}L8LM{$Uih?W2a6x$Hi7&5G_-|GpPd)9J;Kw?*`s%<iCI1M
z^P{lJ87o7zo?p8-Q)hoq`CiVW7X^O5v)QI0HK!=WQ9l0fiBeJJ=c1Q)c=yLV|I;Y^
zNc+*!tB<Bm-xqq?VO?X!g9U#csGhLmy_0n3TlL&S?mRWiw4dpoHtS8U-F;)X<fiR&
zpI?0RyYe2(MNXN9iC6FPY)Fhu&MP?N7a;xqhWbank1-N^tt2(C^8T})crJ3@y38{%
zO+8iHTC^ngl|6W6me8GN-OiS%5}^3dUe@fp$<K!$_TQ6xBlTY7Qzqjj(^Hxom}T-s
zRFh(!T#m?H5-psd;k!qafieDqqW;er`d+=Wp9BOrY@BoMo9kWK$!%U=tH1r(^Oz_4
z-HzI(vq!^r-btFI8R4NF6B3)pDBv-LPuYo4)@6;e`K|}o3e!Ja7I0C0pq%`K>2P($
z-u|6l+mDqd2xUx7+*!1QO)Sq=U0gS)OXa(HysmuPC7X|28}g$xigTa7T9n*;XN7^}
z<*X^j&g=ei1^Bk>v2MKF=sZut&Y``+QH}k>rt~vkvYr~Ad%w}rp2O>LNBfGWr=MM5
zl(BwUQ_>)KL+bl7&aWRDV^T~CgYVe|<Q0CNkTm67;l}0d8a)DE8Ma*QGj@G(=WT$;
z7KP|LTh3>@-F5T+##Xy#mUXU(y^8qhh!ly>Cl=pWCiEsb_}NM&xhKV(pC|k07f)bt
zdVR|vs<&|B1@8aNNmDXDMpwJp-Pry_tuLpc$;4&z9mU=2j@E8+ew^2`=(fE~@abk1
z*B_gAADw$zA!*B$+ltEn@5N2B`aJ(whxQ?lW1$DPO;j*-xG6g6iR_=`-5Z6k@G|k-
z%-b}{$jI~8;XUy=?-}PT<O*Z?-!ZrA7~h&3?eRHZ6F;6vczscbjUi}%QBpxcx75^a
z-O3SdT1EdKm@c-wT=6$?P4Xed_`+nv19?m2zAsgBntWG9N>n?`{_jG)6OF8*Uq#;a
zZ<sL4%OFkRm;49LRlH{J*h>C96E8K5UB6?}9g7!ChwbLu2%kJzy0buW)5J}T7CzsW
zmrlJB(Kqwr>8~d7R=WkWzjr-+YVh;%jvYUf_ezDo4wY|fo+xqQi?n~yEBkvbcS2MT
z#4moVxQ2;MpUuqaK(lVFMjum4wpsSc=TDed$iz(k(y#f?r{34G%BxQA`QumDKJVW!
z!zQ!em$g;>@TO%?qg>BvPUm@$&h%vEs&)&7F0;n?sy7ubbs;C@yn7Ztjt<wzKE&ow
zd{*7JEu}K<@t^NOvkqQ)oxE4(VAF!djAo(_*1i{eR>Z$$!R%GqDZJV1OSb5yvl;Q`
zTxu^&=E-;|?%KTUu&$+*<$>FK$^;bSS>CHjo;$rtd|&I$H?dC-{8~TF)?xmZxQ*HT
zb{Y>ebR4V>-ONoXew7%Z`jfw_!cwLE>EFwjA0M7B?{~5E=ih%HPda}4_u|7{O}CKh
zeUhIxCDiwa)^)nfJ|HJ286fem<p1C5o`UX;!O|M9f)B?&mpV9kvgj@|h5Gq-;-)TM
z{bbr4^-BTs5;?L`Pq03kui@LLowP-N!pe04k)_-^Ck>)zUt_=4uz1I9SHFK9{&P=c
z{JJb7+#Vrce_e79%c5kdRn~7ERQ~NzHM??ku|ail=+_--_BSp`6l6`>TKT=w*74Lq
z8Mi+cFA9VXT3(!8(Y|P#!-}QL`%7PNI!*ApE>~zKX&`2`TaKxcE$GIJZHsLK-9%2#
zS6XDb@o&4m?A$r?PJ0&I4Q-gxH!bumOQ{UYxx$6njmL8v53%pqCH^D6+I)iW4(?;Q
z%oUqmyN~njYjb8fa@UyAwC9(Z>1(N7k1R~vS2Xq=ebjl$FRDjqZt<6eM>fvi@~*S$
zyvkg$Rpz~|^OIiv>VLGZanB?6WUXnROLqi@&Nxwc)BV>MrMTUS-^9whX0Vp5xD+u>
z!8PFF_J2nnZjWg^)D>H8vs{L|VadFL8Z(KOzKI)NFLIdc60pp7LoLTWP5bAXZf^sN
zWsjLiDW_)i2(6#7%b2B9t}m%4aY>k38>?SMM4Qr!o{QIa?26N`vRcgCBi2_OTl&6a
zXP?jHkUt;Rl?i;#=}MB>azN!lwYj&8f3)CaxrO@O1?o9I%)ysz1O<1rALW(hZBSjD
z#4q?@eFH;nbXbc+zV7N>0w=E?5H|H}S-5#tmCO8qzT+2sr!SFDJMY1jB<ad0_cCwN
zstXrY1m%Lb*R*(uGH$z=dUpxOU13!YE8Eq_xPEUa)x5LnU_X1*y7v5vwxh!A5;-5u
zW-BviPq;W?4R7t+m2zFx2bU{wOjyACrnl>zt?q;cmzK3XjePp_${ocXN1Is3^`~!f
zHZMJ3C6oWGcz0Cbqi0MTvlh;+W_^};+-ujB5UpRUdrn>}4m-mV_tt;%WUgrqU-C+-
zH!bc?v;K7Mf=%7F!-qs;ZQ?E-bS+oie)Ut-?^Rqc0!*!3zqb8+v2>Z^lI6>SSFX>=
zp5Yg`P?6_agsM?uthBQAJ&TzuFLlqjelF&;=f(cU%~3wZ6E>9@&6p=UXR-L-_PHJ%
z6CNa=YyQ9yAtv+2Em!F4TONL0<9#B`t$T0S9^cufze8wEgF@zKNw?|~Hl0V@IaF4y
zeG|7v-2cfhOIMTK3!1}^e4DLPpq3piBv8OR`D=+5vy7tm>{~0$r0#r(J5*h8-bk-m
zk)b5upJIJ*Lv@{U6MtG<^T(DOye>UT4#%37Fin|Q6LGO&=d4LvJ$O7ns`MQ^m1O28
z)FE_biSpb7b;;)o<lY1baTxDC@mh1=r6uyg3k}zL=B)Spx^&x>qrWzpFU<-0x5tG4
z%Vv(bEG)~N)53OiF7bYoF}X-4;ZJIYet-2kX`?zP(dDcQn?C1R82>&i6>#uThK>6|
zO*@GrPM5!Y_;8osJ>tgvUl!@sfd_X^s+MQTU+ySVBE9&v&^C|f$JCaFY-u-peC2s*
ziH=ct?$zk&30bXE`R{2y*ncEkRq33CTzdLtxek7z&4*P#KVs{x=}OA$(@UA1cGXwW
zKX(Fqx988y8Qb()Z~M!JE2tE`o6}OgtMuigS<}9KU9#|!Law-U-}PsPt*_-+C-gb~
z=s7dDw`uXNQ<vgI+)i(l3l})L{qf>uTxq8g6YJJj&RVj5m8BbVl$vX2)fSi5?Nfu7
z^Hdz^3A~ZEt44uYzUHK${8i4xyuS-xoxA_-P~fdTvrQ4am;J3?EbEm{uzdfCcgDSs
zJo(o57OmcKc=qn7pAqNZZ10<KR^3W{lELPC4noOXQ{3mzu$gP<)Av~|S7gnihRlFe
zpNA(Oa6EZmvU`tK;e*xIa%M|oOnDeI?KC%P-4hU1_<rs173F8l59-5yUUBKTdN=2p
zW8{U9xnH+-J@Sp2dtl$4iu3M~9pBc3IWC`B!dhAV{Q2pRpQ5f!f9kqr{pZH1_gz1!
z>TU|QeEw>=W9X`Pei8iP>8rg;eL0_Jz1nA9X&fD@I<bPOZ22sfdA73NUPq01FV}xt
zW)<vne~G`U=>-S(qj#*W#iOQqC|Rt{J-GF*_i?Xcr)AnJzFf4LVPE_BWww&!E2g8p
z@t!?C$C-aB9qvkdo-MJyR&v?O&HkaQb|tvn|9f(F+q0O$dkvnJlQX~MOBJ0z{k=K(
zf)RUKV;s-kmD4z1IJM3?^{iq4RLd*(Y=4(#-hJa-bJHgwV(Mn+=Nn%i?_PZ-LzlVF
zdTNREC+>LNj1_J>_FJuDx)~BOv%_o!^HcZ9Vk;$U&h~PDwoozkExR7JI{ZQ_i?faQ
z+zGaiv{LPiu8T$8XFp%CTg!F6ZA-v)ZG}tIod5b)y%RZ^w_eNY(VeCr0aLDczRNM(
zyF+Q3lJphH=u>QyRx)Ose^b2D-C*|;ZIPWDSyVi&T$jssy*jdC|F`Zaq14kexs3zQ
z*-U=w^G-e3>#fZ5FrSEm)=4d`3w<RPdoJ0+y~FVGB#$Tih0j_q*(bZy;X@fen_!Yp
zv@DAl^R*iX#LAk^adCJ4S)|6y`B$3RVukgMhTF$hJ=*4Nf0ScQwBwQqYv1hCJ78=2
zO}T94PdV8ZnFkLqTBOdii9SEISN%j@x8Q`A);An0{;IdXUiKv5f|PNb;_b4_p`Sc8
zZ*=aBG`37hn&Zl}<<oB7@3{*Vp50h{pd{&9Yy4ss!ASpY5}Mf$FWi5vy!+I(QlpF2
z=lgAIF6TGD37z)3H#9oy*1N@Ly>!&4M~eD|Uw*f<TWtHJsLxv?XUCSDm#9*@DQ97_
zviZ~PpAuOn3X5z7mQ*j`eD84Se6I9?&*=&2DFQ;%8oiCT<vPq2Z=4$Q`R-z_{mafy
zUwyPIh3(Pn=%sAyc5J<I;A}<bTeDa$Hm6qalT%|CckwOG`#k5h>{qoaHj_7XOMOlC
zY<?|^J$$M0+m+Pc+vl3?e<LEO?By*PqrSCN++HhEm-XzkBb$GJef4*e&~vs{@jo)l
zj*4|f6eqIZ?77w=z%ny?Mt{J^d%+HevdS)n3Yr8mnHjB$>DhVn&Fac!+Ds9zpYTg9
z+i?8i$1S-P&Xc7$%C-N<hGuU$(w_h1WXSHD7Nw10a~ElT5nX;j(J#OIb`$fZD<Y4d
z#5q?PL@>?W(^B@H_YV6?_N5|9i?2%M*5-fy*~J|3XLZb%Ge4RFSNgqv<oh`2s10+@
z_Kj`QQ`;JswHJR<l3jb|#R={MF|TYy|2fWx*>XTTBd@S(x`ER|G0yz9Jj28zTXwnX
z-s$;k`SHhccLQy%d0ZYojGiWCSKhpe-01&1;;7m8m$R?3pXl(OcIV5XEn6BdyS|8)
zeA1(87*({v#bv+3hqBERe%x3xiCOntz@n5-*)CoSYk#~u-`mv^xX*zrlaEtZbJLw0
z91kDdJ-#C4&z`_#B9Ak~)n@m*#(N(9rWBu}Xmw)stH(cG>UPSR%$@dy^G!zI_0Qp4
z#xI_<+<$*FP<vgouy;exiI6}A-S4x$a-F(Z_4ohlPaUP1E5laFL{DL4GoNoZKQrd^
zMIMdU9-TM&<d>9f6uEMB-!>*~j_HqV|4f?I?q+ypd$oCJ%gNtr+2yCD3aykcdM}FY
z^EvN2EBHs|-TLS#RUZXL7EO~Em)~xlIVtqqjApgjS7%IFIbDlqp~xbU+ym1T%L0!b
zmskI|XTcxAhtZN!(iR5`EgXYC2iiTamgp-qhzowx64v1N=RrtTy_luds`Nf9y)!o-
z{>l>w`x$*SS$aa}!`r43J=xv1OByz0mEGEu_UP8RV;Q{M29IJm+opz2a|nE0{wGGK
z`_Hb!u7RsRFOH0TaWO!}`^DG7#uJJM)~t=#r>A{=i-q*BCyN%GlUl8wGJ!?*?f2W)
zE-RN5mU13i5+J$pY1Ul(x%EBI_{*(-KYs9J;%?rf_XBQm3+}zKTl=fEtWfg$c)q6O
zL*-Yk)TC6loxJ_FBX84$?{ewlTouJfYgaD(`BTfu>B^nNyY7DTT=u;)PGfKJ?e6?C
z(cWld?!L%(E}84imSzTV+55h}doQ8GI_Q<Ad7Uhq^US&Ib;W*9cb%BNSlho}@@h2O
z+p?H#jTy{S<(?h?`F`sH(PL&?q#tj-KF!75>y9VO-qfkZ(^L-CSzEhRH$8c~?)}fS
zmd@t8Ew<9LbC*Zy@;?5z%*=fI#)&5$EO*RblKmn=x6(K7^Jydb>B@?R;V1K(+W+}J
zZK(hF(@vUq#r$Zd>rOjGZsoX@{rTf3vZj!CrTf{_JDzgN+xvb_{2Zy3XTYakaN+*M
z^SaWDlz+Rs+pPP3Co=sg>$xR|9|b2E8+w^^gl%WNeMzS~y+L5rmIwR^*TuMB%VZon
zP*HdG7su!4#{@X0f9{@W{#{Q=?4inc&W)vVb377TizmCU_@eNU!~1eUk>Oo0yRDD-
zE*GXd%&_^DHsQyYBe{E86Z0neZ*gPdy?Z`rc9nUqsMXP&H=Xa9r|Ext@!o+uwfa@O
zVnX+Ur%vKQ*;AJbo%malR4DuU<))O+**w*&l^!1~STlX6Yl%~4iP`n1S=ld-o`~!$
zih3#@qumj3MfT3Dl+4c|JIp+jC&+)Z-(z{U@80}Hu09K5etpyLjnc^uznI6P{8nK}
zt4mC(>bplrv`R}_xpJg)9=QsA_-oTswsn1e?$Ya5J9{=hVf(cyvZK7$C0DMJL*_}`
zJ<(-C@1*xH<7^d-J65f#`^G?a^(oQZ?m3;e`0Z>L=vuFPBBbGMI45G`)Gg0LcSQVX
zcp@Y^>DZJxA0F;|eLuuBZP`@$$7>#hnEwuBzPaJZ1#^uT``_=4_Fw*Oq0e-l9j}c}
zK3uv_qOgAPu`}~~Z2uoT&{uN4=5x^E&LeZum*sjj?b^p7CL(v!b+wuP^!>F@{4T7U
zEt7mcvh#N8K8bxxpU)PXl5ixLx1Do}xsJxJjMt0-B9cFrPGYW5Oqp}T*D%~=E5rVF
z=SBOzU-7>4fZwUg?8pA;^E`t5`}GqZ*fwT(?&^M{drU9#f$aRIw<6)^H*9z}eZ9oQ
z-FDj+mo`5%yLb7*(!$31rduao@!Z$n?3i#z(dXKlq-8T7EVc;Uwd)j%;g`aW<YiWJ
zT@muh+Y}SbT24mp3Yw|adD`Tbu~|eo-;F<6FCDK4saZK$K8&y_;rmj4YsxX*>uc5<
zE56XUv-Fg||4PS;OR8d%&#bVD47o1yTC`>1SJnGE?h(tEmncTee&TyzfkgW1LRR6)
zmrE7nBH2pseqadLe@sBu`SP8ui6T7v-bAt-{agL`K+lsae}83{2eF;J9$$S_Zl1~e
z(){-Ah1rixmcLSCQ2mgQGWp5Q3p3gtJXyT0Eq;-q-(jz;H#U(Xr#DGezg>1XaaFOt
zap=E4VeV&UIZn1d{E&}bdlh$->-y60h>hJpQ=dt?T1f6Wnf*s=z2}8fuaYj_*j6km
zxTVasi_z2}LCkQ*9?!JKFATK{uYY!u7L5_vu>MrmUYTvN5~YD67CTmc{o-hqKi!Ps
zvSa^YiFq+HuFBPWb{~3Lvt&=|<&^jN4W>utNOTmwHNPpd=aEOvan_#2$8JPx=}T4F
zS?@gkK2)0D*IL=g$6m+Bd&Z?*g&Ehr9;<kIGpqlK2$##vo#GcF+G=lX^i|qxk~K9^
zqRTAdsB)lE{v8HgS+-vJ)Y407RocHAd*3YN-rIG1ZkA|3u!+0Ro3iWCcO;la7v%H@
zICjq5W8Pd@kYuHoXVLZ8*8EF?+V%N<rx(4tv2|K?Z*0C&|IC#czSq>WKWJW$5)|dE
z(vO@a;NLWV;+&iZ0)BViod0l~$M&7LUgMVA+?wf!ZI_=a2wk^~RnsxZkXJ8UBK(kK
z#iZ~OPu06C<`o`v)7!KrGTyPSU{-a@)>lj4_g$*nU~1_TH#vPyVuG?%z~^__FC<Lv
zB)17YW_Bx?8f~!5DehH!I_pjIz}be2G~O?It;lsM#ZIoPCUJ%8`*pPoF08XpP~W!Z
z6Z35Wnb}OcjtMOOul39-tXX&YIhKSEkB!ow6bNh#C_H;P{&~&P9-T#t&4eNx*jtM&
z*M9h+E!%TBxiamfynxyCqJ)*PDUF>++m`+l6?HkVmC2Ap=3B@=^`2GxRwp-dMhcyc
zihp`pQ|W*tJLh8iumBks)vNEeX`eeTZgT#-^V9xWQgP?c2(GlW%kcSsDPZ2cpHB^g
z(t|5&)UTSK4GDOwV7Nd1&)=9lIbUttb+@I|GYkApnHk?ai8!{5bzR@L8U9YJ`vnu_
z|6Y=Qkz;*Rv29jB-^4W&tG6^;M(Q^hT+{inl>PW|_v5=)s;$y`z{{P`wnyXFJ%$N)
z0y`6bR!rJs)$&y%z-;z?#@`hu89gS;=B2YA_jvmFA?M7zn-64|udcVPDhywsn67VX
zylu8y(~8K@L+d}Mr7~S!&6|E;e`}ca6N%8!jlEYFY<$%Cq5oU#`^2B?RFvPEMsH1e
z8(RFuU&Kmp?a^a%KMJLEXNRPg2REtJiMVlwTk)4Sw@p;Gf4WfYT}g*wCo6Nso_S)&
zmwl*ozZ>&Bx3la~sfyj(%TG*?%}dm-xV3V+)wSJSdJUTeLb{_qC2JXpt~vEYQaUI1
z(fNy04fQJ8suTp6Ubk__^SodC=8tsLcm3$SQN8yVZ>c8)I_ifsHFUgZY+rSZGiX}u
z{DW6`uB<$6s-)5|ZC8}Y=Xtl^DBRq6_h7b*g-Juzo29R>KDilh(4re~z#?}Z!|eEV
zUGrZ5y5RQEhlycoaKZm4Q&!BlJeiGQ@l6ZqsaBR1=hr_DIi$j~#-`-R?!c`(K0lLB
z<6WF^s+%P^@@2oFnUkSBcUGFZb=k=cACnH+A7GsNt!Pi9@a`J_n)@7reg{&QE%D}^
z7OJq(d|&6Km!YBJCD+~Gad9sH>#JuWnvt2_W|Z<&WBaq>b2U#LwelJ~*@PN@$7hIK
z*vZ<?ss4s%LUz!mNyna@%kt>_WHR&V<EC7W9Pxbb7om1D6;k?M_$~{H@)uaMPUMyH
zsoo8H`mDD<Z&|@{`lgEWt`)UH)4mm_OP={M@Axl&&yL*tFP~4|)|l3RH7s+g<f`xa
zT$33Z>t5D8XuP|!zA8id@rrYEs&>VkS1u8VpSeroYxXLhxGS4`_H<PVUflTEmnWxX
z)4rs?ZW>HG<+7x|xUaE3bkXFe@8vrs!J>cbvKG~McdcObzL0duQDb}4jaD_urtOKl
z<Ce31Kf-ZhQf6;RHD8yl-v=L|P09=BZV|s5A0$$pYs4dv%j&m4@1ozVJ=<A&W0KD~
z^?5n?Ogy<dDAe!8rMJ!1t7m?dJ8kzbCWEsuP9)iPqPP4d22I0bt>^R^6~rpr{<F7i
zF}>-^l4l=OY@t1E`lgC40k_{)eco1*^zMl0KHp8envDNupE8q<s5zQ-nZsoB-&eYS
z1ePRLR~~p_CcRF<a?+oY*c9P}#ld>-+V_XVUTzdUtamH$qtDLvk6(4qE!lhcm|OL+
z3vEs;M;5Yd`*7&jvF2w{&v+(nF22IDdRqIrX#TV|ri*a~SNDF`@?+%w_TKUX!#ThD
z2}dI9rptc)-S>6|!%R~tmo7V3?&k^)_pZ90kM3RG`RvkHTN|SlTC0?@v=Vc}t{qJG
zdl@>ZgYQ6Nm%_J_(<ZD3zOGsI#wqpH%a=Q!e5w1`x4B{AM%`8A9q;DzMQzEj&2^h(
zo~muVIET0P9Ir##3!4Movpl1l^MXJ9{N8K5FL0IoyZx2LUy9uhJ~R9f;&#)ikH5~s
z!mi@G7u$kK^5$P^a+2EbRNq|@sXxC+OZ>Z=Qs=Dm|NVtMeQPpQo~2GcYAse2`u%11
z!(|N|y5d*f9o@-4@5|1Vb1^#JU9W6SzXj}YZ*Hi|6WD*cbf1e`AJf;P&o5fAmA%eO
z=329(ebL5>dC!VpoJkG*e(uuKU2fHnTB3P{Yh8Ml9e(z$VsG1|Q@>n)-<B`**(tTD
zWaisNo|Qfu_p@$&weEfX0<U8#ne~w?TrNyWa{o9jWqE1g^cAd|jK9{iO*j{$JLQ_5
zpdDZM)tp)1&d+``UzfG~&HTp;LvkMKPw{26pT*H}L(`9ob*B7W&C?F7Q9Dmg54zIa
z6gP>b^XE&wn+z+R?)K)_oytF<##8oOgmvxCZQAL@y;A;DxIdkf*kZNIYW|fKmH}5B
zE>2YP-0;@=_l%VsBBgs-L(U3@3b%R%<$Yc=sX}g3YGGuJ)F%5#e_NSr3Y?7Et&C3T
zKh=M2{l2LF+Z)yoLA~Oi);?Oj@A;(S^7XTRXZ@UDWv6Yw_}+^}3(Ri32*_Mzu}O4-
zr*8E_=dG`OYSWUmr@o2KcwnmZ_Wb)Fl2KRZZ@=@+vGq06R?A&#;lJGrk8@gB^30vL
zweC#G`je}!zJKA+yOz27oTyPxdcx1rcUcKVg6F>rFG(<3n-FDv<4DzH?G+cjTTEB}
zp2er{>Yw~NIWdEsH{s-l(8tFWKe=7d)p)l*YcH4nw|Q<2^W^s01<h>p{O{p5FEuv#
zP#%wS@Ct{cbGFW@nmIWtteAJt3BeP8EN2}ExbE<t&1XySmcHE#cG6X|)i3{9x8UEs
zDOabIE_b<kI;}xFRX@wBx#iqTZubR-Kd)zm8R}a-_ECN?pZf}9%oFhqjUKTKcbTO&
z`z$-^n;0qR^Qgje;<Aa6GuNm0G92Btf}_XrB45NBe@`Eql81>=GV`1&OC6t0>Ad|h
zgJrw*`m-9{dKM}hA4Qsfd3o^k(gTr(OYP3(zCLJvvZ^Ln?qb>HwOo%B&wH?!?%5mt
za4*-U_z(Q|H+oq7-S8&hezC4os*(5wZMjE_oHDf1I4@t3vs>c2_rxoi)Q9z=E6<<3
zDpM7h(C{c&Fw*)gEBou)@p{FspPHqoas})=mV3eF<cT=N>oa=_Ty{K^{NFCOWj?o2
z=h4%mqAst(RFzcI_k65snPjz0_kN=OIoW4*N#-U;1U6{02C6eSg&VDMKXz(bC-c!Q
z3togwVZPLCs=J>1#hKL5-ozbOe@zlTd~VgOD>Ie5*xtzt@+RIta%x#|M7PPdXD=OQ
zM+TlKja#^H^_K7A2G72(Jy59Q7Uw8iKXJ9srQg+?E9Fuil!Z>cXmswk)xFh{L90So
z#AFs9_R+SMxpu!xx2%UbXWy~llz>~!Usm`R-#FOz<@KSX?N|M^9u%vrm)LpIDpg8y
zKU=2toVhH^McDW3N!I`L{@<=rm7te@9+qt|jp!B+d*^n1jb316`^T=NnJ+neA8mXp
zbv<p;yB6mAH?P))vM-t2!D4x4?(gh`rt-2L_SbwRdOzpiu>R3~_qOB(fijK8zkVIh
zc)9NtFZb9Xwdi-(C4V#3Z%2NoE$e1&jboj(rRDK|zSp1DawzS{=6&h1d5YHsv7HA`
z&py{B8{GTV`c?Yd0D;4OizTf0uWXD<o~EDcB)>aQ{Wi-cqt0Dog<NmDmiB(RY0PZ4
zbEW-3^{Y181_r7Z@|Uc-cAs<o*@ctdSxx)CVD+uG6^}C=SFTns*ZUi4FeTd0d~R)x
zl@gca-GjEqYgtZ)7<DLCE0*5<vsYLBO8U3>(EH22?{b}VMx*KcvU}SXzMA&vZTnBt
zIs1w?N0z-yeavqyC;$A+x$tVg*M|daAAZf3Sn^@_O6lV77i)k2le)@vA+zYh&xmUW
z=BTKz{<>pLNqpJe*%kXO^A$y0c|&q17eyu?_#o|iV7A`QPX4-``=%8C2s$f!e71zK
zV!?C4nG1d|$gkTaCVsPJejLw1wue`k!XNTF&s@xTs=_6TQ(;}&$=-LV=dKDz$9CjZ
z$T#n6XPUB1zSAn5arcCctC#y^WJ*c>RoNcHSe~`vf7<;O|Ezbr@kClk#JxZCQTzPE
z1;X>J(_%i#gxj4s_hsGhZ(2(-LtoF^+0a#7=~vMnv1w*o1b^ZJcKv0}CKb%myK|>Y
z9gb9z{&%qQOu?RvJ}I5!^&e!OmR4{iE`KBzu(50P)3|4`2hyKSjdpH5+%9#wrp)l%
zWdGeK)k~h0-2Cak%3dbs>EzanQ~ss07)ew`e!s;W*O9TIsvu>8ba$O#esc1;sozdW
zeXLQA3trc|(9L?YR8x2shn{rX%NJrBV?6mU=D7cAd%M@^702%Ov#T~w+V^O!zrgIv
zT9<r3=Dqw`cF%kMrRrd5Wj$8Etrw2?*?&lLmladJ;QBpDW!lbD&qAMgUzv9OSQ>kN
z%#~J)$kz)(bQbuY;GgSrJ;2D%r7qg*{cDeJhxVMgd;7WIrBj@##>*4dFSOFnl@?Ad
z+g&W0>hxiLWs&f#%QLjzYneWj57qxu6L)jVDbs~dJ>2Rzn~z4jC<tuc_A$drx9@$s
zYh93LZ2zx(kCxf)eFo=@we~72Jv?5UAsAk6{NcpKlv#=Yib8dbE-jKe)!CM|cUxxl
z7S8Cy%XfEt-n~V}^4;zh%hwkB`+A$^MJ!bO5u~iNqhsRrj7#40V)ozO^*4IL<9f!h
z5@+_{qRZEo=IlMVcczMt+oumkXMQaDbDlN+U&5TaEt#&?EBn<8ssau~Pi?q-!%X1p
z&I<<%mcN+(^x$JZ&b^-Yhi)WuG4h;ln6}vM#iImGxgE1_o#4CG^?lm{=e!wvV%ATp
zX_{txLC$i{FP9linb%s`C$D)U+S)v8YtEBLe$1V#r1s63vQFgtJd?LC->hBDRv5#3
zusSb`@5|oY^DE+<_b-v!uq>ix$^Yy(%)h6-p7&vYN%Bdd#ro~X{R<*`zBV;}VR5*h
z5v6opxnN)7ET15u`D|ZyP41qd)K=0rYmugJf8v`v6J2%B<wgeY@Lp$9YnbADe`}KA
zuC{xj&F2nX5fk0!xOi=}%0!t+wW&eR&qrr(?9H4i?h~~2fp+wjnw8t@QljSnyT$Q6
z`r;3UzK@Z`yM<?Xt|(0w{VykdqG<ka=MahX)sHT(65p{pQ+sm!-vf_Ml`&pFs&b3B
zSK`CvwC$e*^~KocWpUdz&CDzL{`-V@owIvmUCFmcdpaXUn$4EZf4`68kLw+=hQqZV
zC7l%$J-NM(E}x^*I$__VJk_hFXSUh<w13}Fedb$KN*KqFZO=}ntdU<8D7)*ztZN&V
z);KRaJR@eAD97`UZV|Jd8i|}pJbUZbg^kCVR|tES`K_IjrTE>P^`W`o2F@K!VPBIw
zf_K^dJe&F4{Eh7#hRoR>FM3sHG^%fGQfpu4F}tB;)0T^EW>2nuQBx6EFVd*B-y-vs
z*OWsKUqzhh65*Y+>HXYoJ>?327FUN^G9LVYW{!u3_vhc&k3L#kb+<e5$$`w@n|Hn{
zP<Xphuy*G)-*iEKMbTsHy!^QoG?V#upWf$uCY~qu^qwk4<Mq7qvGoC6b?Z&EOOyB<
zO%|xLyEd%)&86Bdl<{KbZ7#W9oheLO8B8q2f~(?L7Msa#pM5O&isdQp_xo;y^h;@$
zaNTudzR=<zJz<Mm*X7*0wBox=M`vD>X)AkiU)y%w$J0gkbRFiuJM!H8)zRnO?ayvE
zt^Q_Ec>bHITgahHiaa~l-wXLU<59Bbai?1z8NRppZI-p}kvVIXXnyNJ*%v|Q<qr~!
zdwe%fPk6F!`;6+qTl?~~XGk_=+Lvv=Eir@V)^Y~7<FCpqw*1&Rm+ha5t3}D>+1r%E
zJEf(6ZTIB5X>&wTGv(r%>lGo}%I=3>-z8$dOolJjxY||c>gRW{8&;}{>8x4qcld<q
zrt-LNf9rP3seOC3u)F^x8-s}W>2`;65&hHGX*!1Ql}bK!cV6}L73&0ompdCMJ}S!a
zQxC0fI{g1n-@9okF_q7k1wA?PRf_AKS*}n_df&Fak+%v~wuF8^{@8q(dQLMN^A=%^
z{K-ppeEiMQ`z%u|eebOD>#9#SKk|AUEF&^EI_K$%4exgCxV^bE@<XiIp`NpA)uhy<
zyW6^rU*@RQ-1wh#aiwMEoIA`msnTb*Bw73M-d-m^HL!91R$IQ6^-o@Xy`Awc_(`Zi
zSVx?N=t-5mE5gE8ev;_8^?KJTt}8b<Q~Blzp2`l5Kex3i<G_}VTYJ8i9=*z|U7xYp
zY|WZN-V!yQ=M`bsQY?=jzI~MYbd~LAkxQqY*q1I~JbYpDYA?$lMqBf{H+0Wmw&vWA
zmDk_IZMmN5YhLwBGvoh7wspO7#|wHBxxR-!vpRJ$*3Ij*&7_o@OSrD+B{^*DV3E2X
z_B1xlV^-{*Wfk@5%VJHmwtuRVoTQ)~k(}NVb(Hf#x`T_-XVYc5`^*nlG%VKK>E8cr
zQGU(xee=TucKu^)Sr}?~{kk~sveR1Th3wT&J=nyTUP|)cyZ`5{HEd5;p4)%+-W*ZO
zc?~{IvsT|Z8}RRL*sGAPU!Bi3-MYR<(7nQBmvWtt$k!XsCY^mDVtV=6p6xHxmK_x+
z_U^m9JtkZH{O9$qX}8*rZYpjsQxUQCSdyFnfGOwTyi>eP6&gG@ZyG+jvr_hC&f<m{
z?w6J<m5AgIOgw!lfw5V=zRaBel0or|OKiXARJ9tOa_(N)V7Ta&W0CZ$ztf(5e-ppz
zOd1pOpGN7u{qv8W%sn7Dcg4+~88-|5eUrL+Dlj)yg?-mKQD^Smb6-W2y3ACWl@cGt
zpZNAdZExY?WCs)X<lz3tm4ECOA3pVd*~-n|S3QljJwEU6f<wahj=1qJ+3-8YGV$0Z
z4{K4$(;-`9bHg;U%iLPcl*O;6g-AN)CmG%Ayump!db?xDYPlnMUCqm#V|jN!|C)8A
zuj`%39Lb;pJAqwUTd$s<?Gk16N;72P=8cQ>xD?7&epZE^HL&jOxgEQFSGdK(pyZ6J
z8b3?4eEClp=2<<B`uZWmQm^5=;~|Ad=Wo0@7!h3X|6WAT*VWq@x9pc;HM}(Od-H6L
zDoK?}uKWcY5^fXbEqV3k!G{FL*e#olg&J?m?0gcaI-7shQq>geJD2{dRj4`Lxj*Uo
z+qwJ8Pub5fNO&mAD{7LsS4qsx>eBWT4<B61{9qJn`*P!5%c(Uls^3;~6faxP74zI(
z<zwE#XSQcVjvl<-7+-yP>7l(h({`^hzFESV_+3F@Rmx<6i7NbmkI63oF0s0NdGNRF
zz-uhGvTPPq7*1|JVfJ#HvN@w1Xz5U5ozw(@6_>PiCa?Idd)7Oz;o4qyuYbAk4_Qw;
zu=|VSf#OyxmAQR3b0+?KxN3%8K&DiA-(+#w=9Jbufz9SJp52qAGg^e~e|}utx_g3d
zfPP!!a>L+=#0D+TJoV3_zCCNp)U2Ehw>hyNQLcQwOWwlXqPCjj!lXu%2&Y{x51dn8
zFZt#(^>&Qsr6T3WCtu`*bglQPo-|uiu)~I9vSyoGpGIk8WaF>TkHnT=*w?-)(&os^
zf<WB`Qk&nti+p+H<ilMDXPz{8^gQ*1%E=$~XIEyMT=`hF?S*Bye38t&gIg;WYnO>$
zztXu>CVK6XO9~CyS0_x3*tcfK+6VvFi*NtB$He9AuPA1os5@~h4`zDSt(R1NA^YsJ
z{{HthLFP-C3%U)y)<rVzH(wm^Fk7cF>+uw!#~SBOXjtu1{v~nv_-dU8_w$^JweF;P
zZkxycuB|=vPK=k}yN_C@5~j<}d!hQLD*mdVjgj$<g^z9iA2-<hbd7@b*0^16#~r??
zcz*b`$RV_J)9w5-j%OG%C2Du4D3+Z*enm6<YVLwHj_2>C+C61<wX9Rz`FM3y-G$xa
zM=zyLwEObd&TA9*?c+?@JwIFXB9AV=3f^FTdNH?o$!U&rtF0^-EX!QB(?LJ%w6&ne
zk~1eB8V3KJdv&^3S^LdRj{KzuBo=G-EuXjQ`iX$A?P3{+Wtl|Xde$vV-ebPzn#huO
z>*PN5Z`e?|^gC1APILcLStk??`1+F?clth6Jf<DJ$o(kCjgG7?qvxp`n`+nUozJaL
zSo!zR!N7Mst(y}L-v5z3!@q*J-ua#h^BKWx25a5uiOkA%%qAiIdP(e62Kr?zj)}Wm
zjc18iH&(E^{0Z^DIbW$=m{+P%-o*D}W)8zOlQ=H>C2L>!wx3QiY?ZzLIBQ4e3-3#_
zug-bOP_Sgym*ktNAB4+ieU#!{?PP!T&(YGZUzf|mK5SbQP_Fe;fOXo!BQD}I0$bN7
zcNG>aUQwm+qki*@V<&F$)?6{T+Y?r@_8`Nf$t<~Fb>_WQZA*#VZrJigG*N?9^xxJ@
zuUHF*_daDuQVm%c%a`OxXzrGB%6{>)?d05!n@?Bny`B)L-~73TGxy%-_b0vx)rj?L
zte^Q^N2Sw^dG*%33Z*Stcap@I&eci<=S?>7dil+;Yx=HNcT4rZDY-G^hWDjt9!X!b
zfn~#m$Je~C&0cXX!eDvswRaMYj4P)+-8*U1k7-qrG3%E9G+N!EvcoE{;^aP?UG|$?
zF4w9)mpu33*u2FtcT-C`*DNdFz4P&$qZ5BD+c2#_Y^}o{=|^7;+7I&G^11po+n_%v
zZ@JkNXP<Iu8_^>=89_6wm5wOQul`n^#8j}mt^ABxq~=$hDog1oqa#YeKYnbqP1$=Q
zWMATa0ipkP)$9)!-m;Jn64)<y-{kp2-_6^$tn8j@c0PEUM*5<IpC6VMhMz9+4Dr{t
zF4FhEd*0Qm?O(8u@u!(?%XfXWki5Hg-Kxr{Y_rQV^aE}<_xXk;RXnTQCG_Ca#IF9f
z@&FCzn{NtQn`XYqOP-VRZI!mq3H1^w8IFq5)_uiSx>|XEH#}Imz`Fcs){H$NZ)aS3
z!Res6o7Lp<CaEP~=SU0Ox)Zc~;ikTKZLQZnS2pgJ7v9&hAS;@a`}t?<B8TOsA&;MO
zI{&ab_h?7c&dJ>ke#{n1`(%Q@-dLa-d0l3i*pK(2mQGe_*B3o0IMf$h&GkI{Tn?`y
zkJ+5Qpju{Ee(RG*f4}kgDR|(fSfG!a-`lA|UFNL6l3aS-)?PcYp7+<n$?HCTuvwq}
za`CS}dH<iRHQDAgv23!H%B9OEem<LXNif(@)u(K;h;wP{x_f&TI-g_7U2uA*_|(AL
zshY_ZjE!d&ckD=c5p~LO%AOjQ3q=q5ZaTz&kWiX!TCbBc&o;V6wr|(8i$~bpyRX@s
z&D{`q?%->WfYmd13b$321SWW}gsUg+Hxth}={wU{(|9|Vg!j#s?Edc_zUy2$juyON
ze^yW!?E65*I{l=AOhos}CFbf^I>Qv1?0e0;mY<%~98nxp(btu_;?OzUy3)gmFZ+!q
zWKEEedb;_W%Cd=1yKhJ4?PBy+YMXINy0t0gw(V8MkX4oQ+_t;?+~{)jsrw)QlI^ek
zcPG3|>%S`RTNYp<wf1=Bs?A~%vP~Z!`Dw;vwzWsKEj)61wvyCj9{U#`gH_(2`e|P*
z`uTKL;I9I)`<eC?d~I=?_5X?*TJg;6_k9r*(<3s=!6Ju|Pt4WZdhfmFBTwRb8TQo&
zn7N<)lV<Yk@gFu%qfOj9Vq_j3U48U=;pN>WClX_2UkS%YTGk#u@x*eA$*yl7RcmJ%
zu)7DQT~%GhqiCke)cDA%K&kua7M(-g7Ss3WTSzZcb-q<Ohm+qf@3U{f43)^gdo@<~
zm%Gm1@vUIbhHKM3q^=jwZR7j*-oQW6_RtLVk4CmKs_yIcULQ5tZ>(b<r@2hoGek+{
z;F}+J)4Y^>*tQnkGl{Cv`ml(9$5%W59|1EAvcu;XxX4d+c~bf}_?BAoVF%F-=Oxl^
z2S`>O?znoo=*_>rsx#d65`FJ_Zr*FqKDR??t5~n3L~_cx0=9Ek59WN_<@u~#wqWO(
z^fiG8CdZ#>Im;wpIWg{$PSnDSodE?)k|Nu~-@kL0G?zYnwAo)__2KE?@8}*>eWaup
zqN0CwQ@?|g>4uE{84dEa3=4ZXj-QS@aA}=JO1K}-7n7G$4<~tS&b`d{eWqjA#?CzU
zZQIps7MMhoG+6ZA5d81`=Yh`wr|RNkeEH%Ib2wF<`OZAtYjdP(RdIO6BX_?)*97;h
zGk7E5`hdNw=VQXkYA?~JjZK=BZhxAN8BJQBe^Ey$ST>{Zic0*4rY?6i(E}5f{byKw
z)>(hg!sE+kHzxbm>j#wl`{B0Yy~C2ZM?;hgb&d<O_B(y4$v$`D?z!xVp9KuWCZ95E
zoAUfi@;5dPxum0&-`{>Rv0Ny(G4OCkWRjBg%c?aghg3=m>S8yZVU`F`Irr<T+ebsq
z=Z}4C-!f)L#y<Hp?R%z?w*LCCld5KBdg_y#Zaw-FXWA|tu`V=2==Z%{PTfD=UGp}2
zWxng+%1gVZ?JARV*m%=$&ey=)EiR&WeF9&^HJ=J92vB&z+bN^7sYGhhnPYor#(tmB
z^;_6m$@RUo<Xhd}FMNJafA>Uv?*5qRb6Cv6^QL=#&8T<du}gj}t$rirVzT-7wv&&h
zolTjeUOz!!-t@oS3BET;iw|gj*L|+_DCF~2zllyxlewNWggl5l>sN7+`HNN^Lnr6f
z<Qu~G1LI~owJV)sz2(HR{btB1A+NQ`v)_Dq$D6<GwQ`u2Cex2i?f?8#PIJn$tU4z4
zyqR;+x;~Dpe%D%+Z|$&FVt0HspXH_6F|7w{w*2qd9?|^7qxYyyf?tUJHk*?>kN0N&
zddXLJSn%Gq%Zs!aKYe}D#xmchA}36-O<Aq4dd;E884K>rt?Z3F^ZPMt&8^_A$B)`n
zDdtVk+|gVp*y+S~Atm+ls$FsVa?LJ+!Ts;NFBMv*G;rM7)2b*d^DW@WoonIVllIMc
zc}>jRELz>?(z=r~uD9ef&)?8+<e6f&)a(w6V=T@uY7#ZBw5a{C?3?_l#y8|$RMM^T
zcb0W_>;X%9W?FHw#<H`X+WdB6_3662i<aH@9GSj7(>;=2WFU9tpzb>T`Gt9c*N*H|
z&)cv=j%n2%smDy)6Ak4bmKr*wG+3QI_WQN>IYp<>h9}+iUUI|-pE$%|yVBaQKe73i
z!;y@)Jg09*8Y%qw(zZ)lQGi#dH`LNX+4}U}+Bu)qo(VkrDOR}Fs(sC;clldc)zUXy
zj<T7WIol;eHFz=aoqVS!e{yHY1f{L%uKC0BwLe7S?n!Re37?KGe7s}d3&Yb70>sa6
z{%Y)ZH_g^vDERNzMy^TR-NHAXN!o?)e0WP?=l1un`uvLh-W?XxcrzhCGgqKQHnu<N
zYJ4oqZN9@7Z`ns^vGZKJe}g?%GS_nMt*q%QI+`VJIDcQtI&1Pe)30VSajVT_Ju=@g
zaQVpb{976D$M)gu&iQ&p`=tNy8SdNlV|j<6hjhbE_EPiL8l_EV_8Hx1O*kxR%~n*%
zb}ohAC4X+Pce$s_>8);lA{9>GgV+}Ym>zO#E^88KD*C{v`Yr8xF!L+7zlV?AxV%EB
zFw;5u`G<Mj0jD^%mrOX$>EbdWkniE{%zdrV-ET}csO<f6S8(U;<7rW)i+&y}XsdSL
zI`7Wn(s?_VT+U94Y%nm+=QcOIJl%O>q08a;6-AD>Bp;P;eN?$=o?6%I(#Rf;@HbLl
zx2$p9UaF918qs)K^@H8sFVmYRA9Kxc&|D@o&FaX<vWnT)CC>|dm?vJ&*Zw9t?nqkD
zsd-t)^A}Fb34CZCc%sieBDwZ_&YG1s(lvd|<+6KCZ=YM(J9XC_`(B4#7yd5WHMg}=
zUX%G_9M?zQ=UvMmKKQ)!uS~}+Wi}Sa<C7}RDRyzD@3lDU?^|yxYApV)`*&0H)Q%t1
zgvFABS_~zNj{XwbaFs{@(7&kG)q!%AzqGUqpI?5-x;x)m=lFh29>rztX1cYivu1@a
zOFwpGk73_@^|G6aTf?QT_E`L>X3pNmlez7(u%Tg5n!$lRde>!+p3V#qfB#bd*29&p
zUngqZ$>g8$I-q?gSKEt^PHW$IznSLA-Y(n|>AsHpdC1!pifLj`G*)mMZTWL;dwOQT
zwONlI)iuk%<h`(H-PXm*FIIKWnwgY&C2Ri`4Xe-TlfvB3hXo#R`*AFOqo=XhmHq1d
zQaoncQqIlm_*`~(M_lCN`-gkDcwc64N!-pp)PBG4v{|9&N7K|a&-uY8)91{YE%LoT
z-RsKp?hTR$opN{hmYx0f(dS{}52KFDI~ROZIA=HYa>n!JQB^YTYpoUqMq1drJzu1<
zQjI4qW`3){x%P0@UDqd=UlN;M;wSCcY0%6)UEZT}wdLe)>-90F9tInB&KGM@VJfPw
z_@uV0b<M;#%vUeQ8?U@^!P}=$(;=(b`O&#Ft;9c_vjVd(<d#>Z?>_JO_uvuF%gZcJ
zExMdjGX1>oHNi_))|~iK)XX~l7l-q@#<11%e9JEVex!IeaW%u0{8@?fzyDTrmn+>?
z*ly7BwXOBNZT`!e2feOM2{D&5HI^HlzO+W@{?eLdpMtl(=&A`jcRS>2xzH~eP50V5
z`NZS%`t4sl7Ek^oE%e~n(ok1{<3Dz}6z<qM?PxNGxS`0C3mYF<rB2LDFOn^MTbjC9
zGttL_J#W=>^SfJ*FN!{NK5K`x%Kaqe#O>401#g)>r}D+bzO<jEiU(L(-)M)we(kzm
zI^4)=tL@jbGA(kQ(VYuJtULS^%KJJDWj#H(yREeiD|Mz<T$DR{pf!8memk3+^*^6I
zu=sua{NYDzu8Ze!GW@(7e|OF5_uu^a?d2Rie|xZ;?Q?T;D17kw^Zr*2b1tgoe7b)=
z|LJVswKEP#Bo_EhT>H&F)*wzPIe%U}&;GBEa_ZKv`7pg*c<#iLLSa1Y4_An7<34oL
zDK+|Jjzp`>uMhiXPMgtR9sO|fo-LPEcP?$(@Bio1d0xMJdb=%-h`8MSH=SGio=!}n
zwb7^jCdV#aR+;y$rt8}boh`k$_=KNa|2Xlw<0EFyto4D5ZgtOBJS(sIbM=qdGq>Kd
z?tC{#TIK)NyPszJ&Oh{WT3Pb5Q!{P6L*0CO=WMV|yu3+ZMbC`)LN+HEq|)Xy9Xn^J
zrm(y*Y2rb<nd>j?h&;VXsp^7#NE=IVV7vJ<k*f4pD`F08Y}+{PY)uLK7j@Q-*sL#-
zJ9%5)mxMP+wqLH;w`%*!zrCw?mz3<16BoIgGW*y0(AvYsuLJJ>n3vw3%XC8Mpq)!W
z^p?+e<3p`yZORW0|2|Rp*{oT-?MJ?MCs}HTH$3NB@N;hD2|i}w4GMnzE|a?X{<KAZ
ze|??(J^#JEb`{@Wi6;p7X<SlU&{-5B^2<W-fLD0^nVrv4&rIMnj*~u6qHuHmr6+%8
z96p)g^`?9Gk{P;T<wvv@%oLfqXy&Fb+(-9V-d>xzTWF88L*m7gd94S}uW-u#Vr*Hy
zaYs6bqouF1+ZRKj<YGJ4a%ZVeXD@2)x%*0{CC>HXi4>Cwm-3El-jzCa$p7B<$Jg$1
zF7{uoA-1TV_i<;>l9zuTas882d*!=e#Zf-p?5p+%cgE<nswUWa{5e=1pc-Iwhs&fx
zskzI)eh;7f%itNY-cfG9Om7vf{Fz-`73#9<$?ne{*1Hc(mq}iJV8_*|>(9q&e1FW=
zo-EgUyQ;Z%`DFD6Ix9-=@gL9r?y=xLQ(llj*Rns`EG{P(doCz*jn3cx=H=xl4R>DL
zSiUz(&+@Xu+yc%?CO0L&zi_r%a$^2v=BYQ16cxT}lngJMnR)R#=Ucf%LzQ2?+dfNg
z-*-~CN4ZPkm%wCY#g@d5s|WVo3cf0}Cgz5H<)nQ<an40%6L-D#_{Q(?;hp4_!vd<O
zq<g+L_nj6kT<F?+_HOa!jW+_5uNHpW7F?e4DdzLnZjBlq(c|+sDwiz&z9KMalU$>6
zMdeoMK5@wj$xZIQMfP%9=Q~nZw1du0N%gkc@Rp^~(&uoE$!<SS;YUHG<sDPMekc&K
z-dYpj)fW(0e<x$ctop3}-?v1vg2La6WKOF77!^M8;wQm;@fW7EHLo9<nARY%;e2C<
zHRBVzFOT1-b{$?W5_rt)%+$Ax4Iek}>G*NO=)LNU4{sjqkK6mRplQ|2=Kod|UmuEy
zTAj%MX(+k8>ig_h&e!`LcxQUsc5a@mb5NLhx}=5goD@aY+NnDlcOIX-nE&{CKEF-<
zzmNYuZa>eZ(sTK@>+fz@eVDYZ%3A-X#ue6uChR9UBjv8kSBk7i&l2P^PiS1vT^OUd
z=6l_Y5MS}xN7u-d>@hjMGD>K+q}BI>3%9QEs;#lyqqu+J)}@CVCzUK0+0&5xsX|RZ
z{D`FGJuR)*;r{RRrPIvz6^h7ZuKjT`lrQPu>`zQ;zt+iT7DNPh=A3dhDq{Qm<|2z<
z@zNEm7HvEoWy1gNt5r^K6{~FaeVJpP^VmMj;1zQC@#{&+|1TdxzdieqdfYe3@sIgU
z74<8Mdq0%Tw>ZzNwfC&kF5QyI)2q*Bzf^d<_}ZoR4_{CE|6UP!KS`Ij<G)_^%bcW*
z(?0EtJ>56uNc35Yg)jV6VwePvvmImRT`DSUkiS4HGHBX`wT6lfA50f8h}>V`%s8+8
za@T&%ye`ettLN+wKQ3zCu_(GiWLAybq#qhWO2@rl+>y5ZwXOHvxnLI8UxI8wiY(e+
zXLSGhc79rSjyiL|YGFx(3-aEqJPf`p_vH58>*FwJalh1fKJMv@pwE7_-m=^sjQ0O*
zcIiE=|L69PCrYp5$Mk!<xV|KdecL>(<nz8>!%YvhUi~wFe{GxYkMlJ*_hkeeh~IGH
z?9O8|!d1R)`XgFh#-a3E{qG}pS%>Gmv0ASkFNa1MK6ALhCf=HGy?+r$`Ip!G-^-WZ
zxgL;s+qGY3hu<|V-#?3jlij*K0_VHyx7W`3QN2&(2g825Y-{B$4Gpiog*XrIRy(*L
z_~u(t_pAO}8Qb=*%USTHCqd|4Tk*ZO2fr=f6a7E?)aluCoqjf7?$dba^CVgG?{ncQ
zd0v)x+piS8VRG_b!LeHI=?|;pS)AuP9D5!L+)y_bHFlb??E=@6M=Phlx}&*&x`(gZ
z=H>&+PXc(`e1iVE*>*nKES>jY%k5iXHD|=LqU7Jc)!l9M@wxe1ukN+E)pLF?+h%RB
zVeQ#c+2q?Ze@hxGb8K0imuuv>Tk<Ny*Pt2Pd#%p$-QWAaKx@tUo|Wu^Hql?+wwo_+
zzj?7eSWoZp#Ql#V7FsR%xq9*T{O|V__vaj{)$|t#StA_!R6|&t_5MexfNS?o&%78C
z`u)wES!d49c*yaiL3d`~0i9D@|9)-?v1H4gckB9$y)&N|3Y!;qOR2Q>O%FdAJ|#FJ
zLE!t}<KgNB^Zx$WYtm|6Q(m;||1;l=+#g9l(ywRuO|Pky*yx+1!}~TjP-@AlX5OQF
zmBSYnxIbp;t96N--eBr+UioL2ec!9#8$wO_lXg6?Fnf`FJnH6=*lkix8?viYsypM(
z32#>IY^~ZDs<-ul(Y=?m`t)z7e0ZPK-|%qZ)ID=|=-8z)h#UxAq2^V6c>Qlp0fxD}
zjb19tSlV@$&DP!8TrTX&+i*Qn)N^Z`u8W!SoSut5_a?pS&9@fpeb&zQNo3`d;zPeJ
z&6`$f=Pv9I5j0xa9m$^WW2eQK!^L}}DV(eIMoR0U+-F-oW>2tw`Rm`8vtb&`>}P0B
z3SV|`M?l}vISO%1VusvYam77mjeJkut<JV!ef&==c3I~}qv+UAy;_1*whJ5&iPx;X
z{NrudWr;G8DrMWGkQdbzw>EP~-PwBh^)>~el;&x7>>pfP_e!YjLF}aU4;ni!^D?x_
zY~<d5x6erY{oYRZ^fiLgR(jpD7lb(QZ7>iy^TM^gb<^27OF0A9EZ4fy!WA5+{^OIF
z@?O7BMXOe*>O54v@aw2-wbP>4>-+ZmcQ4IU3f4ck#G>@!k%r8M()Ps*=J<QOV@o;`
z-?F^1qxi|BqmAY@!nL^;GG3eG_Y?=eWb5`xmfbwj=g%v-sO6EX1u9w`PyU;>XG7br
z7@_|4vaLt04{eKhbDFpA#Yy=+R}#`+Zccw9Zg!lf;~mq|v_nni_l3{@`1AV%>*n@{
z(#A{QB^&O4$DP0F@ART)hEB^4sVFij_0IK^t(LA*@)P>%Vtwm#RN}m_v^mB<<*b7G
z*1fNiGx@ese46tw%bpDLRj(@#@4S7k!(`t4;stUiV>mdb?N4xju{mRAfy0KZMTP24
zuEo_ST5_`bPg#`TteV%Gx=3QbwutEs4b7T+zGW^~WzUEdN9!J6=$RC|#^Tp{z5UI#
zag5h(eU8qHP;?gFRJ<<YVZOf2o;gfS)*bsVl-Sp3GN)PRGx{cPs8C)ZvFhfkMK>5r
z9mLtzG8f#}lKifBS;$dic7b5umNxT?mz9D%e80^5W&TSjJlDUbU;NPBP3rYWx*6@>
zbiQ}WDdN;V)*a&X=~d9&?A50omc+##TemPH)Y#|P(u()?p22GFv-+0*5*66xsqDp-
zd5*2xswP}Ecz)}>Y2VIrZv84X%PLLS;<!ZC;h%@*?mqQ8hb<z2DfaTdX{%U-x}8<L
z#nlqma&DF6?BBV0^XD#|(-w>FSHx)TT=wMd+RFtCT+1Gnc$#YPod~vi7FoNXc(Gu!
znyG|acfhPW=4WP}y}r3SX=aG9BU7P+^Ud&&eSCcCp0Xe1?(eVPT>s<U-G8^6H$OlB
zuj*g>dqL%W^*if}6y`_nTJGe{wAg5E`|HZiNuqr7lf9H0)5TWIN&j*9TJy_8Dv1V$
zRnKJqEN7YXV&z-s7c1BCPcmLnA@`xRD7RDO`;i&@{6m{hT)UMx^Y~p}FLh0KhP$D6
zuXCFx+4^i!mb!cJT3JrEwdaf3_da;$hu+(+Dw(v)?Z=h_p8cP1{>>7;wXj=vb7QUj
znJ-hG@XolkZjsZL#Re5jpAx3?Uu>!6eeCt2V$zHUN{4SM%`nT}xX7Ew=|b83p!KUl
zUrX}NS^Vm;cHduf`}hBgF8xq)zIw*-$=B2IMo&E?ugX{PFa4zPtIO0?_DlDh!$m@s
z)BYCxc&1R%$Uiro{k`3>J=y;^J8G(~-lo0k!IdAyix0nAqG9lhAvmg*McdxucKd#_
zYw}OIpH7!xyclp)WpiHs*WLR~UR{^z>6(}Q;!HEke#6_9x9#|^<WI7`?Zs)XCw4-K
z@%$=|dEPe;CAs{yStT*$Rr#eS2j{U>CTvYRFUB+d?VKVhsn4SI_q>8XsJ03z{@J%I
zWX|TVT+MGDUDWjL`S{ql+o|YNeCK3?C-TizpO&uZ+!wdG=Apv^ZN~lbJ9a59k#IW^
zq;txmFF5yZmf4T|)7u_D$k?RJ_&#8=bz=03)Yd*5t@P}VnI^H<GeY0ADex|HY^&#T
ziQ0a8;?gY}9X~j$KYA9)T{7QyF4y_1y*HNJzOB%^C3&I4vdgQP9*5~qRG;Ig8B-Y>
z=%z6BSJ-Dx)=#2OZqL>;++`^hI(_xZGl|_wYVCHiYVD`^e`xL3^a+YH$=ngU=q;0F
zM!>b$E+^jq)4YY;SS_yJ*IT{2P`3Hb`H7m@jZb}bosFM{bcxJ*_q=b)dBtbR1@k{y
z2VHuZcgSVKsVO^`H2U3Ivg7E+sOh_tmP%IhtDODOaj8By%4PbUZ=lmPHa^*Rel4%C
z`-ShDg97=(U!1jd(phPsemZMu5J#|6;pO@+&L=77XH{RH!sY+t(UK=JM>i|YUw>-m
z^y{l1G8FpXwClF{+%@~F$=UPU!)~l@^=UmX)9I=<CDc5X`L6o3#Z%WGyI#ICce}})
z-u|x2g}<*R@6zD7d-KihXRF(cqhH)vI%|dJ(}k0mt}0GD(l@s}*vs-X^Ay?FZY4p=
zlRPa}n?IZVEcJ|VT;{xz>#iZIs<vKId$a1<AGw>+p|!vHR?B@&ZeRU!^6lWG1$BA;
zFE@l7I8=B2Z2GdiiFs14k0w2M)79_%XsK6&L*>D#a<gY1@z}CUf0KyU^F;9^ck|to
z*_8HmAA37jz4OiH-}idHOzbP3Y+ZQAu%;_e*j@By|KWxD3(fLwEcAOH<;-qzWUh%J
zw-Up$eLJ}NC4I}L@ja4N*;^C8eAE7Vy91{eYpkuTxT4Zswr8d5K8?!0H<!5AUY07k
z{AJ0UVAGW!HyCx<Jn-e-`ZV(BaueTwhxm4z8hKW)ad%=W(oaiq=gDMW=E}G6HHX@Z
zRnMKC-V<^#m99N`BUmm{v;0+QXT@sirFtQ|7Ob(#vV3*#)aB;#oe3hxlfJ}VT)A`e
zTVJmk9DmApS_M9A+3U^hv}^5q*E!z(A1=177Wv<JJy7j;^}&UY``h{U?0sPJmG{Jj
z(z%r;!C`hiAqSps(#bZzlk~>(Ttm$PMxO|gV3vKq*MHn_qxk%aAF4qGY9{gOt|vdF
z$LqLeF5iA@&axW+XFC7StX7YIzB}gpTgwLb^3}7#r{!J!cr0Y8?3VfS_%4`zZxwB5
z{Pw=WmOr%q*}@Y&%-pW#j)F6tcR#ld+2*2^{ptCNTZu(tl9Ah0k9*(DS$;)#u2fvy
z+0{QcJE^{$lzH`?w=C<Sr!IFC>}Lv{PIj7HaaYN-Gw2c9O2-%CA@_CKPkmkfkZ00_
z6pIx5Ct0^nRx|I?sJgs|ar^Ect&5G;%gXgM`yKnfGW^!p>_<Nfc{^p}+u9fwe*B$s
z^Gevp?MZd6(!0gVH9jq~+p{Rm<M)lw`u<Nw40>0%=BpSbH>8`N>2Hszy|pb_H1+)b
zRlIYy%`pno(hOnIG~XDqChzhRk2NQkSI9)2PPFWf^U__uJ+~xP=6FxUqQa|t{A8`d
z&Rt$u8@EQI(({M;{EJuiIX<n+x!r9VW_>2)PTB1GbJxC_FX?(6yzq0J{+Fmvo)y1$
zYBd~Pce&@^Lfb8C%S4oA7w((qEo07Q{vh|yr*n5S|NHqK&2vls<8)oyqjLU_TxI>l
zWfjKS7hU>dvaY|``0V+ne6<2b`KG@=E-ExHD0#MUwp#g4wU2epGVKQsKH0it()pD}
z*;!9YmsH%2%`7em)_K3>LeHnoVvdnE*QZHt6W3VPoz}i^8E3EOg*Lm@-LCxAn_Z6>
zZZFN0o}})eeIo8N-wK9V_YYkcyW723_N!CGLdmnwZklT=lvak`xwOZyX;#Vu69u!J
zMWH<|ogr#|nKSZ_9M+KT|NeS?Ec=@Sm$%O7UzhgtQ&h2n;GuMzLuQtGxldU|%jZt}
z`}5bA2Q7C}Yp+MdJ}a!-7|6H$Zs^v-H@2&C>YsH`PAmAP<6OOG#`Jl+%sch9uKmj2
zG;fu5nkM@v9*v1oIuCDXE<0%Hpx(3ngNgL*bwA&4z7y^1D`UPWqp<7qSB)NlpZ5z6
zT`TVSGly~Y5~iiQ55D%f$93APmgSvbI%6WQ;a)cXX^$U?6;~?<8=X>-ZA^7%uw7WN
zJMT^Kl>IVJYr9?7x0D{*<Kg@$Y?`vV*4>s%@l3uU6Xsr9kfFZztIFNRSJt~v+FqG(
zXv;f6bF)ViCT%j@tRNEgtG<}$SfBu#ySM-6S;rYu&u_S)UDI@k|6hV}>fb9<|2|sA
z{8Df3?iBwwTb3_s(reH>F?Cl;db#`U`5Eeodt&snO6AuJU*NwWAaVKpWYe}H(Tm}M
zH_t5#v74QL?&JK0O}D)b_eaj+tZ}+;V0uG*o%xY4$ycE>!ZmhA?!9tq2E&x}IUB=w
zZ+fX>T+-e2nZ5S}qmT03+|LeA1kE$2J$U<*?SbN{DqW4LU~%oz9bbB)G8u}><GEKe
z<i1|^<3)8zwX;}QD%-oCz4Q7STCCU1iAob*zi5uAXwj;Z|2IyzdB5b5Ledrg5Z_hL
zmk8V_DbBbRq2n878!cn)-v3~V_{y@7N3PP{2P_01pA&eO`?@HU<=dBala@@IV-?!b
z;VHP??TV7(#~;o?*6%r5;$$VJ++E&zYx%=-t_q6wep}Xw$HmU%cgU}Bo|{q8?jcdX
z`C->l?c?d|PuKn2wm<O0kL`kH3a{E;eHD$0OMOwab74EvLh~uR*G{`W@%8KlG7E05
zk_w$I9j9|TD{|dCGqIM%{}!!UYpFBuQ=98=p@(z+NzeH>Eq;s4L(o~=>^<@i&a?J(
z9NYamo&7_e<PQhqM;`8-i;N{7Ge<ccczm+un?rop`&*`47AjemWhcL@zr(vR*S&Uo
z!Q8~A>R-z%{MV|53P+y~+U8onaH@dz(@8eo?H`v0-dPv(%=Jj5|98vny_4SLBrTr0
zYqiKE={hIhjTx6aK1G}8gtGLmJ<gh3Ygirn<Z;ua>06g3WQTuX+i+&}_v7s9?8oK#
zH+}!T+}`x1edOW0Qhlk>>=V_FOZ@%QzSum!ukM^*UFGj*AMV=wEwT#D59#kWlzbHy
zS=6&k-P`=x{9dlp?RRd@zrw|FcU6_jiHq+aOjw%}d(tmy^54}$@lNSH$CwL$t`Sgv
z#<iAvyW}PFUscDmA1pu1fADa7Z0_RYg8SYJ@f1ImJT>v4>i3fL88r+SQp8`0biHUR
ztq|oo8UOu`p!<^P4#&K2PP{s!SklxmI+FQ9)~+~FPSZo@7N+d*-Kn*%XhopTbdP(_
zeb^@Dx1Dd#l$Pb5X5gzkG3@1yhKC0Nm@;DRLM|PU;JY+$b!S85b>lZhJChs}mu&c%
z7qV&9=YV|Qhmi}u3+W!NY_8Mv4DsJlb?GqIVa~c<m3<8t=d5gcJ}V@-b=%K{UYS*P
zM;`N?I^9=kCc0Sr#@3cw#jBpVE;Ki9&x-%fv1J`gPOI?j<FV5l8Slv-DL=l<pt<j(
z|L%#AKW2uMtPZ<>)}U<Z*49t+me(0ccMDeST7O6Akq9sMuTLEe+aG4Iw7u+>>1I(c
z`>;^JlP~AqL3La4|C@Y0*5|P&9=2q^Tk}Tp`_XgTw{3o_yX?fK=Td+E)Sln6{N#Dp
zPyR}CS+g6TSxz__%{9x|;NGVUyVLJ3Ik+u<x+bPD(T@A`&j^MmnhL9<Qv*8x1(&G(
zaX4x!nHHm)6RRe1d;VHC^92k$uBe<yYn}hI>R9EO>aPWn`pZ;L9CvoOB>s1Ey8fQM
zD?del_3*Gf;G8_6=Ex3~FSbQth990A^4{eR+5MpU$Mf}fOG_HqecrEKT5^uR<64m4
zS1uK)+`lz}Yw`jYo;;^eKh?a$*g59@qqql>*^8#=>E<}RbjV+lxN`0L+tG!uHwc?D
z&TeJN5i{I=saCO@HEo$M(_TN5Q(-wurh!~)XRU9axG{gt$8hGa7iDi;Q#;Kf-E&8z
z_iUA%!k6n$jn15V_3mHCGW~a~0?}r+EQuc<uaDKaKG|~d&p*N5-xuAC@)JE1vg}B2
z*;+^DjZ<S7b~l(!cJTgEn;G13>BKMNQ(Lcfv8rSoV7+=#U$3z6-Wk11Q+sZopIbS1
z{ikKKB^JDq|Cz_zdG@WS(EN)+(`GoY5$$Z47$V|$H_ITxHMv!8r@*w|bEQJWHdJXZ
zHBGAgA1HG-{lV_E8z%ewn|B|`)KR&RwNvil`i)#dE8nt3zj0n%TA}2sz&}N;M1|kp
zS4u|WEB|Ggxt+~1%!(z~-!8J2+7+?fTBE7i^RD84J{=ccZj~OVV0Fg{@7{LSFS&ft
zqj2)Xzzk0gf!>e*f9NpolT!$oWaYLwuK!Ym!oMlW+qQQ1@J*gvJjsIjPQ+5}K8-5P
z7pqd)i<q`|UKdunpqCzVXXo;qK8D@@6ZB$NR%v|sUE8U?@JQmjo!wSP96V=E&^X+&
z#^}JJ<d81g;=;MV{Wq<;b<I!m3h!nnYm-CXzGVsjb5Fl<Re!(hfr03b8#@XO4lOI}
zIQ_mwuX(a~du5bqRLtQ;U3t8X*7L7!)P7(lvn#V>&Mys}U*-vuU&NcQxitU2^zJY2
z$u~=7PRe-iYq*zrY>(&W+$$%gC6!~14&Ai4>vx({edAjR$+?=l%NsM+<bPZC^G(tm
zb;}DCQ~i!kjSV>zJC!{)S#r+Ny{q@MDd*h$?V?$|(Yc2Ib7w%zU3F#tH$Q(%zCBRx
zD6%%<PRXAm%4?6W?XQ%RKf9B=aK7kt!`1rDQ>NsJPUH>9ube)$bZ=PGdgrB=9$vV#
z__^%fc~kF&L|(pj@`CYP(Hp)qIfEuCnu_lbkNH#1f8l4?>J0sh&%`|Dvj#1enxKFB
zic51!>n!%;Qy8{aPVC?Q(xA#%C*0KO-NsGNB6qnydLz4T(`21#N0<C*Vex#KYAMzF
z{E%PV&a01ZiWJ+=oLKQ!G<fE(pK_04ZysDX<M6{xdk!uro7(9A?|FD@u^&Um(ywj*
z6WG?D;tsjRQ$A<i4zC{;(i<83i|*UowM)(lstUfgw|b%IoYx`F#fK)BP2Mas(LdAv
z(32f&HdhvAUrF{pwI}q%-Q9{k)fL5y`5jp9T&%iqBSf^~w9=ca<?nW?XH*`W$ae9E
z&ip0?(|yUxTcj<{6)atHiR~JvetjVCK1Ds-YT?g@N6R%OrpmmC35$KtIXlqMXx>UD
z=iH!aug?XG?p?Ex?}6m2SnGoFt6HtL*Gzw1<m}t&@=oFHk%@|*1O={jEdA~$zHgO$
z(A$=OSKf3iTJpg6>C-(;&f>Lu^giv92@IG}Q#V~^?tv?Jo<07vZkfb8Q>W;I-d`Al
zH<UcR=V^L&y6TC`JAO}BJ+{+rX~w2tru6!m{=z++E=8aFc9p#PyFsUGy88Ox&aAHs
zrrvqBB5JSR2KL8=jf(qo)&xmq>^;ml;l>)ZnamR-vo0C8L<Vh0Na@H@)y#f)H^nwp
z-ng|@%UFmtC`n?5zz;pgw*o~=xOz0^g=k$7<ykdHeV<i!hTkdQR~dG;=_OT4kH3oX
zp8g<n#a^aaNXPuhow(9Z+n-oojQ;q-UZ^BQdR|Jqy1f7Y>}J;$i<yEG6AhDCO0^j;
zb!aRIS@n2T!nWcVMZGoaG`3uhIof|;;Jjk%*9#p7IUn4=^j7J_znqClJ+CsFdo9{)
z#cuU~Qutmm;fDU3O8=h!GmZcKyV)IU&N3^>;Om)hE5!W&ZP>-y=2yEvChWEA?Y;BD
zPC7m0o$h(y*VFhXW}S>jrxb>nUYfV*`1uWwKUFm;=bUO^EYhzlS5nJ)EdRi!#r3z|
z6}`UQc6vjGnatXM_i{uYNv~{a*w@W`>sS}d^tarq>wnAqp16(MEJV}Gck=2_ciypS
z{cPU)C?KO!kJYA>>6H=Ja*Y~|d9jnOeB9l@>11wJch!I2t;O@B4Bo7%>F^8LbvR+`
zPd4Ve8}G;@73Wr13CFTm6>x45-j&91K+#zyGgxM>XVn?w#yRKqN?dI2xWGL3LUDfA
z%ZYXtYbNxxh%8At!4y2}nh(>lNzHe2-A-&t^SYz(IVIh4PTT!-cm4nCO6K)UkriTl
z_^+T+{rnWgz2UBMLBT2ki;k{YW4(M`;WjOI?k5(H$_hU0l@YI*pK&`O`e?<vS-h{x
zn@e(9o9~I8ezohtk4M{&oPP0yU*@OLMYE?Z=2u(hKdlIw749W==gGoEyN8^&uii-8
zebYxKqAQ<6?dSKozClZSjz0`p_44Xw-^F+Hn3`*UsIC=EdE{id^^Hu@yH%-09Ot9j
zJ-rXJ`d^=DrM=^NgK}(RZlXX6-_;X0UIvJo^Osodl3RK1NWihyZFZ+BH=o%t?_lhA
zr{%ZLF7gt4oYML7604Njyep2m4r>A~Kd+mUnz*?{wtw5&S>}KJPIEY$-#ww#vGd#&
zM}0Zo)knLW@9vt|sPe4My(1{ED`?rywQsl=29`%PX)|B1_^^NR-38B6ojrthv1CT?
zZ!~fZ`quJMTOeD@QT%ks;)ByJn5*PyO)=cLQT6r;r`?GQ7sk$5u69Ry?F8E#zFclW
zpED`WcS?c<x3cW=a+vkCo3|<9`)khqZaxyX4>34<b!}KGHZyQ<?&LoWhYs~kefdgF
z(O{Ea?2$wHQbn~a;TrQDCTz?~%e_7)i(f3f)mrRezg_3<N#6>&LeKxtTm09&^Y(3z
zll^-=vr;W?rNmV}JW?IYeK<%V=!Aot=+RRjvfjm6EO%M{FuK$6d97!{w8a}I$D8WO
zZjD{<cJ-r}V20kxsr$ONt~X?z7`W%{v#n1fe{TLS7Q4nHXj82j-^C}{OK0dD>(Ab)
z*jMe|CSs?#YWC`<rG|cb?<UolFjeO73!1oq(N$0X{f)_ouYb8Ey`xb*pw_eS0F&sM
zt8Sk0n<BrZ^ch6Xo91d%@N0M4{X6R<z8%b)f1yK5YGqh-iWUEE7FAQ`&Q(fIt7Epx
zKj!_Zp5)whNW(5y^7|LTJb@-rLE|Kz_XS!^Wi0Y}Q@7QHoK=6S`sQHI<ySMz&6Y$;
z-1{>7?OkEE`Gw1D)Us}Ms|lQ2HN#{1yQHsDp)aMC7YDAp#p<J~b4B~B?uO&Zv6VV^
z=9n%nv$~Qs{i2;+T%6K@+3uZ-Chs%Qc&<G!b&pO!TceOv7tck$@>kauHU6KH{Ug2I
zJ?p`ZXN$S^CYj2wX@s0h5hNeuY-M=rflR}KQ18F1yUW(Cos)imFU9QDxxI{&`#zky
zRrAxX_C@&&t#c(8&$6r(Ke*X%M$7yez7tmbF{wNnqanF4;DgVZQzy8xw>8F{4}Ur(
zSTivtUE;!wnhTBk2a`+otZ69fP3B&p9QK$`c}_=_tLbFcaD}8ls#io;-<*5*n%BSk
zY8?~z2kI#>ggq%v+I{i`>vR26@$Qq}ur_LJW^0jV{jsVpea^Sy_jZ5PA6;5^ZK_>P
zZ_f=D=EnNxmA2W34wX#npEkA3oMVnn$$U@grPgQXW_i>-mobr@S!<>kwsD)4(I2(n
zbMr2A@0`4O8%O1)EKZ&D_mj6Sv;NGv%tBG*s#X5GmaFsYt*$GopRZ`LP~FPGyLVpd
zHsy+)i|cmQ?9~x<*_v4#t#;bz?c$z$`<1^1If%_t(!3<f6!LzarO64I&9nc!^1Hr1
z^Y|M+miOVdTO)YI9)!=jAAfnFywAzmt@+#Lv>u55{crVC=8fOJJT+ExxM>{VrR&pl
zQ8r{oe)<f)nHpdAU7K;ij`zNukmQwDk8iNQ(m(3`_D=b%t@Zz7PShqox?;`Qp7Kdr
z_~5=|Ke2X;qm#I2-Z^2-wWU&YZ_nRFLHASCVq34=Onf<^cv(l&yU66ztEY%ATH=|c
zc=?~^bG4_>wcLJml%&_LubLKrW#PN3L)$_UKc$7wn7ie8aB;Mu)%S&Ab1$+wtUk1K
z_q_u(v(EDUez>%uGj%1GsIZ-|`dp`;?KxkZ<D_SH`K<L>wBF)|*WPIs+S6tQ9y`2-
zVd<Y6GF9vDo?GSf^w4I8{6AYol^$?;*ac^7Irrkwv8F`3!*jW(=D9l=&*U~OzheD3
z=sEM%G9DJKdlJ)lmaS-8^v&_fr{g&@w>=BhyuB}H(V_60linRjK4ri5{^NT)-A*pb
zTA9}z+qLwvV5M9Ajqv2(H*aZiYxZoN7vH(<gmZL2gW=7c<qz%N++&|seOS{&{qw8D
z<BcvmRZQp1tzPkC!(z?7+{G8nP8b`?&r7$OX{of+_4DK}9pN!gxwkEx<WeiD-)W<L
zg4N;EioY!tC6<f<0qGjLuQu#CWVkBLeYc@lNPA&cll06~W`EwE<45oRj0)1R-Tf`!
zW&ghR?LO<Rqod4AU4-U-KPq&6-W&Y}kLH3MIuqGGPL#KOCwp&?>I#0bl1n!&zDD&;
z`@emc_TRk67N73_4fi>~&wN86<EKZ?J_G5fB{Hg;p1PkbEX%aZ;NUs2(Sb*ddBP&e
zclY<jx|fH?GdE1>f1oPXICI~s-K$r>{vo>O=5dBCXJtF?oRqfc?Tj$HHnD!^);^i?
zK8~zrwo8J!Hfs7#Z><(xxoPFG_G`qPC$i~JGDO}wRPD}+6b*jVVYJ2H)4z*-Pw1hP
z<;izmS*@CUbN|BWul8R!>nGoSY3J@Xab>}Lo2#6EMf@^aTvz-rFaB$m+0RnFKzG5j
zY}U_ncAi!*nEA=*KyG=Gyx!*3QkQ<7GnvP+Da+!Z=BifpJL@#2@Ex|e)NzGne*00+
zh&BN>Zx&(x-O<?(k1R9p+WFy7O{l3u#E#3^2XZBpqrP387G%$``KRHoduM)HuM1r2
zFy}fKKgZ{U3bD{Vy$;J$-tMzrCU(Zfkn!M*N4LFg<&3y?MBS2|)$M8-Um_Xvv1?91
zfT7?O$%(2H)jnPE?kjC_4BoYFUDVq0UFP4dE^dlw`Y9_ID)_~2`J4M21SelDzi=>Z
z+m+CZpT6!;tOzN&R%Go{@Mc}R$YSOY_d<h%;a^S`in+|m@;)FbW+S^K*zes6zY2#5
zFW1ejc(-;%E0bs`>*?%l$=t*p>u!89mCCt!Nzy1(z&N1exVL^{@cCE1`gbPZIr~G_
z?~iO?=*MWEi*?cKH_c9JTY20(hgsCps-neKM^ldTX7@3FrPlNR`giV3$&cD!cxu^>
z1zd|fBVuoD+VbeT=IUo6XS`q7DZe?rVZqg_b7lxQc9+)fdmMN6_aa^YBW=pEk5%~t
z<Vr>D8~qlG{x5i2xW#U>-n}hH4lX_#J@HbmwIG}0)`VNK0*BfT$rnC77?k!<viOwO
zoV6Fv-dN3hdE!ImbIp8#D^^Fc1-|}JzHipVU8}Vm3vXW$`0eWX-hKMfH;24c_D{A|
zU0KEDm{jT99lG|a?KhhRb$nmX_dMwJ6Zz8>{ZM(`zU67Wb6MN}uwB3WRqy**kB^fs
zF6E1SvPdy|vEiI&^{LJu;){1Qe|RnTGj8VYf@3#V{Z?DtFQhO{c}~c5x5F2&?)Ymb
zyXN<gy>-%!d|&VHvdia>>-~MR{lcPGq9x}-Wo}7GoTxn>IzhWgygNzf*Rx5-<_5;S
zOMfCg?eWFL{Z45U{<^H{UvXFcALr6-Gnh;_Et_&-`<_{cXBn9v=->3`zmwcw2F?j@
z1d5NY+95e(w#=b~l_wg5)A<*CR{Qw4*yzA+i#sjSsvf4zX_o843ng`zuDmq=S&(d3
z@R`c4jji)SPR8=CHp`xI@MHT`m)!Lym$1xJ;&091&6U2r?yYd?A%@DYtIsiApKbAG
zmV(J%<%~0GpUhtMJ<KZ&IX8b{RS|>ZO_!G~DyJm1jti%lW=wRosk@rC)XQ>JLqugs
zoX+!)clytTsD`XqHRX)zL%I10d$TR|6Z;HS<(#&@^Ko|)i+g){`{nYe!v5L!kFCq!
z|3=nV=av7Y?<($whtI{l5wdr@?0$0vx2HVQl8N4e>zdm)D6DEYzK`3XG|qSRQ{4sw
z5s^E+MTwP>G2vgi9&HO<85FW8W!HIj`NJ>Q)_%YGGKYU+*5L;88h=jKj3(aLyBymh
z{@r>v<pq~(UJK_h?hRAE6dnpy`N(-><)3P?`g;Y!zw<NJm|f6TEqa-;tieLTijCvu
zI-8S>;tn(HEv9VLxKo(Yr7%svPWQH&*Q`6Pm##&h;3&R%Hr3MD<Cg3xu@~n%q9U@y
ze^?2fU%k<lb4Tyylr>q`6NC0ye(L2A%jVo>*4g2yyY6=C>nw?zEH4@)Ud?okVV-@|
z<;(Gx9lheBtrH`)Y`FegE|~UVwn+VVW8oWx3Ew01&PmFa-uK$QLX&khgZq?EcZ(KQ
zeBCgscf##cQwnN#v?fiEC}8>O_TZQ==dP4*kDh<IHgT1=j82!qh6KejF+S(J85b9<
zTdF;)c#X{h0b36f*<;#@Sv@(Lvld)F`)pzxqxY^l_Si%@mVe3(er|K(H|;sTrr*=g
z?waH3ySrcUcmIy-`MTDz_rm;Q)!lohGKTc-djD?ua^o$2=WlDi3#z_%zR7Cw0^19`
zlM7E?4`(SomL8xZw`bB7?jsAbIKF#!i)^kcY+d%g(m%;zZR^&|c%#nXPudbThgwcZ
z+b5YMUcGr^Sz$)lXG<-c?Uwpq*|%iRx6ix!a#q6I$_U>>d+UF5ZI4}4Tv#8zcfrnA
z`9(|19Xnc5B+Q<yv#8cG@RymCwXxdD{&nsm+wAXd3w}s)e>-xHy|0<c=^0ay#EZO^
z?M_dphQ&BkwaxrsE#YVMLr?7N(t{B~6DvA{F5TQBX|_EpGDcPDMU%$z33GFWUu|LS
zF{}|P^q<AOb9v-}#oua~)WbXa9&FguuGrmkr%!b0#n1URPyLozyXY=Hb%)_u>0CbD
z`O6mVo4>$YFaEy#o1J>8E&*i>)4VrC_Ox~HGP}9r*0!aZE?+XV)ATAAO?k9v#(pnT
zNsXU7#NQp`_nP$Yu6DNd<EdqQ`<m`-nsf70znxFkx{TPf8+N@bKd^`EXzvI9yT@-t
zPMXoQRA_dd*wGpTJw=h#v!7SqQOKC^^uo*o{w2)(Tvj<JE*w05z9_Kjm&f0q@2gTj
z9O3xHwe>6mKO0x(^NNfwKQFXjdn_fWXqD)i;2CT!Cw%Jup}o`n*BoU3`0#4OhO`|E
zB`^E19K7kbabxRwDVgs(`oevLyBvQh)<5d_8n@@g!<5bk=?yaOTNMOm___D{ZQCUM
z=tTJTf3t)3dT;-q@pf_4)U0P;dnV1z+<lQj;o*Y^5r;$r9(x~R4Vc(;O*hy%?fwM$
zL$Zh0>2+^UNQoC%!TqN}Z57*@fc(a;1rr`>w#^rsTzq5(!-ch<X6>5FU$lxrtLS;t
zFLtg8Ri%ZU(@di>FP;*A8rr#2d(GCvOVv5b+icP%9$e7%(zo#Tk=CB68!x!|MRe3X
zIn47#?}D?<@>0Dig>$344+=5a=RM#Fa5rsMsG1ujers8=^m6@;xe>Lmd~%bd_N|@1
zbeWKYq|%}VyVT8&vYzd=vdVJFRnl?l`P6eQrRa~>)}>mU+7tCx&*6#uDpRh1*7eST
zH5ESFyv0-#RI>!WUKI^Fz2(TeV>>4#l}n$DzZj$U!LjUIqx{neRXU85?#y@;;P*sE
z-|(c~y#?8a`|ip}Z%sJ=y8LEosDGfrzr)P$3O}<xS@F@o-SbmL!};vSU(L4`M*Cb0
za9*JQW7dJDEpHyLV_+{oq-3kV-1NlanywGCe6pAF*6Lo#Vf3Bv?|nwRcjs2|$AXOB
zacsvsIZsF2yRz$ar>GNiFfYUEL$e+}yKZvTQu3}P&&5WYq&&|DQ_GHAezYx3TIbD_
zl;SMen8oYu<(8OTH0*kp5plG3QQV6BG{?W4XSwG;FX=k;;rZ8Slj4L#hkr3f>lgJ(
zZaM4z)l%hO;{u;1MZaw!Glh7Uc$mI3XgYaFF8;=3x571!-&V23<h_t!nDlPBJJYS=
zi+jI#1&TK1viPoAyfW$5wV<Ngy>I6IwV3=={&U=;6@6bcn|mj-hQ<7}3|$`={@6(N
zHOt@Q99mMxW*v)NvgvF`Qpd!@=Q-C@|CpjCvE5pN=NI4Wd*}U1m!|8ABt0;A5^E)W
zox|;gx|`0GseD`Hbi7yGjn;Z-wb#+vY~7OJDT|#Q<4*iwbbl5UsCaMUhvrFvB^<Xq
z=XK8M+}Bu|H(A8_&QDS0z1uHr%ve}du%ES}Vdu%6$0t=k7npv?;EnA<#tS!BDDo7U
z-e;*huAey1Lc{QtOKbyI>PE4$tLGQ&G5zrB=#LudC35Ga>{80-aqaGi+rR6><gypi
zKKu8HeO0sMkX%2TZ%3H%N!M%cjrA|D75#Z@A3Sr(ot@S4GdcN=Kfb=|Q1}iprJtM|
z6mx$k_I8B0>6|*4Vmddj@wl(~`+0obcjxn$|9}3b<j2Q%)Bk*L|GoErm%YQ*WqAya
zZ=L(so3YB2%`V_mtmpFj^lMU>&+}IY!hV+p_C9#SCd`^3w&TQ~xqtikQnuQDWR_sz
zRQoyiy@{r<(2Mye>Q6;2DS5==<k(sv6#IPd2@UOSa~JD!g?{B*vhU8?g+J?sxjR=J
zY{<`1nzNq$ZM=E2+fK&s%OY)WtCss$Klynxf6u!#`IWzIv!>oiUa5U~1^XJO2qEQ~
zBat^J9;)Y4nv%+9kYD^Q$aI4)XC?a&mo~p0eHYJY$(uTJKEHALqo3`C_m?l#X4GYD
zeQ^Cc-}lZ_YNie+H(%t@Zxx#JqhsQt9<FO2h2|C?eBoQYCv5f2XmRNY4;*ry@<*LE
zUH<K?adD5d+f7mK3#-~6$^`3}&H1{oKw|ej88?%U9}9Q<u(0-i%G;D$X}I=$_sa`M
zjPesyJVbtf`|$O1ebT)%Z;n3P9$#Po!?dPTCb;hAi$vC0)e))LYncj{?zh^rZ?SE0
z#-@`$kBhgcyZ<)cysd6l+;6wyRh>46cWXEFOFO8~^(wU8X*m07zC-c$yZ<E)z0R|r
z_UqT0yVE{xERvpVr|~CxvhAAyhw`;`mGfQxU%g(l=iz^qSN17)e;2iTo>2{9?veSC
zY4tzD+tW7p)ANH9FGjAp>k?NQ?Z5nS=<fq3eZKq^6kg-<{$Z%$u8`?&ik`1t7O8y6
zY?LaUEg4-KFDl-sZe{V}(CTMGO&2fmY$(%`ikV*hNz<alf70XyPc8~-em}`8s?^=K
zEBNlbm&P?`t;#>Bw=K46mfC!Old87Iy~~?s@N7*yn7gIpnfT+6yq02&bB`U1>M-}O
z5zo2Q!_ynt@0GDs@!5no3%doRU(P-B?9!8IPU<^dZk_Q>59m9^veDU0;e%6;|5ME?
zqStMc+;7f_=ACA$-F{+oUhwl7V%^o=6XvPxYin)0FVpq#%mn78#)|vuz6q*NToQ8s
z<<!*X{`^y$Vz=8yDLm7>aOL4%vzMWTd_{J@(!z|ZW?D>r=Jw2^bHk*$Ip5ij+H~LC
zB&ApuW4ZR6Vd#f1(`GUX)ts576y$OKw3O0~k{wFRxtK5SWm|XqFXLT9S8LzMw5Jb}
z6zX=x=siFC@7_Jvt$SkT9#*=$`Gd%p=W?kF?)?5T*}isPbN%Gp{GGp#pPyIr>t}j=
z-M{1PVLz6iw=-02>^sA{>*qaw{|9Go{eCF?>v{06=f=O<FMR$K`<tCFB!<~C+3ecZ
z-$L(i?$)<oSZ}wqUh3EL^fjMUP2JbO*_*RxOY4(PzsWB*=hQ9RJ-;LS;;}=VEP0M?
zQ(fH{zgxwX>^wd70pD?+Nv3hTx87!z=vm?M+|RV+e&p-r+gI)stktiS@Y&(s%k--@
z^si6i1(PZ9`8)@{UaewKcKf$ur-Ji|^>&;V4c*7T*2c_RuUEHq-TM^xuR83aXNy?Q
z8N9g4vF-4iv+tH@GKf5WUL<bAwC?oL*-tL*KK=Ig4&JxhfA^Rz{POf|*LD6o-}yh?
zxVh~qSJ;&1wd-HUnC!nNRdDIrJG0Xpr2<-*e$K1fBHz8W{zgFW8Fs5jhBufjxBQ<j
zxzpB3exXX!j3kTr{ww>JXSCcp)@ougSH4E}hKBL=(Bj52X4{@O$N%tc?EP@Ad7_EL
zm+Jq?@1BdTOY_^8B5O3yeWLRx)nii^&kLWcx&7ElZr=agTh9c{{rC8dwaLp(8(Crw
zPx{(ee_Z9W+i|gzZAk~&Zax%Yt>3}qoBw;|sVh?sFFpC${YPP1QPAS`6XSYz%kZ0e
zg{Ft`{4D7?uE4f2e?d#suL<uYL@rHS;T^bBr=eYxq1UkBJ?}$N@3YG%2#b9^|J29(
zuhXBLwm%#@IBkS)xz>pUO8+QY9rva-ucNM$b4mY2$D`YVYqHl~kKO<Otm>Mq8h5kW
ze+Tj_d-j%jH~#zgu8up2U33e-mFefV#b32I+FYDpYv#QFy5yv<?mOot-_L$n!&-Gm
z?9DsRXu;1;NliK56r{A@O}%mCmL%^qjwO57P7~NL*>L^iPcJyKBiXf`CVUR)KAX1t
zezecZ(+g&l|HxS!Y>+J|%9>NvF8`qDR;&E)n=5yP)wS^Z*s;u5nSR-+w|3d#smx2~
zU*KiXG3@-uzWm7<M?L`#{&KOaA9pT282WJb<LmX+l`X4mfBbs&WB1|7hp+4VFRJ7>
zSl_h#n{cR|!{zUPeQc9>vUchh@vh=Ev)q|~q&ciE&5U)Q|NRW{BLdnf({^M@exG_k
z-P1Zp$tf^EJ$Q0N;32EsUGhAU&el`r__B#P$XZESM64{|UNG@hhh6!%&DNp6?3iAt
z6+a2Bx_YtFZui@;uvGSbcAlA+xMQUZ1n)h|Xxm`ruuOHY)Y5+A8MQaKw9jo<*ZiHe
z@*#7^q)CfK9WNSJa-5s`bq0Hu!Hf^bV_YOmmqvXy;GHNkvvAIo7EiW6&kPRSGCufa
zv-Veq{~wktmt?QfGkv#jOR0^`tktRFE5%)04DaMC?QWB)w5>l7)BDm{hf(rEwbYa)
zv;TMecvGDxFgJdd*S2Y&76olo-Ec5q!=9}wFDfsrlo3p;F*vbxLDSy;w6Og3oRdCQ
z-gu$=H<R<;_fM9Oev}r<?!Ui0&n>)2<>|(%OXu%o{7v~+@wH#HT1=bkUC+(4VXscS
z`^He=(b5u`F=Ks8z=eVdMmcWc%5J(V^wcJb$;pN+xh}kn<)GLVp%vn%O*rBt822Q0
zt~aoKe{1{A+N{5_lTy!k#V!tfY563(?s9MDp_fO~N=uhUM1_0IyC@}8ylL{@y2>v`
z(z>sfCCb)3JaA2E&IW_XpKSdHQ}0G>lg$WlPYIRSd^U~6$k*k+>r~|@3j2(7W+j=;
zS$AdI%!=mrevYPg#^qdU$JXp}&HgL@G}qkz`F7FWMZLu~L0jvkj;>nlZ6CSxVxH}$
zOL==FghVsneX$oa*x<>!ZTmeIp&M)S-$aFXYS(*|UVZjZZ@q60_Z^LQFPIWV%OY)0
z&s#L5_dvibwnFx@PhIT!6&(qIf2Ql`i||j+kf}K_O=A1;(Bzb~g_D0IY1GbhFSr!7
zC27O$w6Fige&75!*?-@Hr@JTHy2>aCZwov-WsXzh6CS3+fl(6rOg;CyPu*A;;UXJi
zesqhdSq}RIu4!LmW=}b`b)VsieIjQ+g}o}t{8awK&><~Qh^6$#+m-)gSAO^YvhBWd
zOUAsc*aO`0!T&E8Mkfb3E56|EIn0v#CW9m3>nB%B=fgKD8XEm%B9HHDRP(sh9d~OY
zqvEQ!k#2{~H5YC0DBp9)LCK)6aLPSDm58P027gj~cSPD>?)%%4uIy(qS9r6kc5~&;
z1qN<$=F{%9Y%rR*!Oqk3sP`lt_hXI?AB>*oEYP_v@XY7n%Tin3pIbEAyqTXI41fCR
zi#7AxeLWkp9|u2Z{H`+LgTr(;vp*?9uS4n?yn2(iN!$Cg`T5=t*eiZ;ion)hO>OfN
z+wZ<l`FU&!S7Hj+?RZ10na>SM7y^ndFM0|vb-5isHECM&N~wVBuj_<@WskMIwf>>G
z@xu(?S<llY-aYum#t_iGNO6*W)1NKLQ;x8NocdVKS~2g##Y0vp*Ir&RUy>X(MYuz4
z-QHU%3i7H9;XQ(f<SadAfBI?S6(O;HS;*y`2W^96j*G`$s%B*qV?B8A@$El+(s?ob
z(K|RpS^|6pHCwA6wi&BNxmnm8F=TonGnws*v4d;u?^I78gNNk~JG$p<?3z2}@*~-K
z1<lT9dj4Gfem-7?w}0Mz9>cTGPJZ0{c=F@?`EvV>qLUK4Oy+c!c{G-6G5*^3CSCf{
zRBJZ|Nx#sl$!c1+PVS2ndH%d$O>of9s;w-KXY#LLVE2%n$Xj-1C0F&kD8twrzfNCG
zQR?$w?y#iGR@Lrp;LWr@W&ZP*EpeC;wz%lp6z9?(nqq#Ii`f?UYAh<f%yaT#a(2W9
z*9ynt^}HEcuYH5A?QWF%QB-5QGN|jA;+{{7SAW+vIo3LB-<xx5ZvKA5mz;gZCM%(F
zom8B^yTS8)rzhR4KU_HDz%AKz<;$gyWjtH&`26jC?V~fUo)h2?K2~kLufgzWllE_q
zpDl6Mci%fvcQ|liMc$WX$#stxJDD%(%UhCKA{cyl+taT)*SuZdeC0`Hn|bZ&`t|G&
z&Kj)k-YCc!{PSRhT#Dt<jHR*#`=@hHI_|*gar;&SqvDyB4UdbtpQZo4nPBkaYIUk&
z*R?4}-p!0YyIFspO=W!TRjL0OhovUJ%dSmsIC1XT8=o@ED92R~^v(PJi2ifnJZl!o
z@Wn2*CacbqE7<w0y{9KnOGW+O-?}fJd~tgJ-EaA4r_NsPxjYOX^_S&HRh*sWHo<e=
z#3LTJl8*eIooVsFjlu3s^P_*KzWoa*d^UTHci<QI^>JT(p595AUOKr}d2*GNRNmoD
zD{7y7^_AJk(z~&t#&F|JJq|7Q5A_eY8qV+<>bmxx$X&So<U;SR$g6AaSuaUoK3KFZ
z<__P<qnl5MaEQ!(H1E{<4PTF4F1uvBC-vg|Z_8Y!|4*o#@siIu^(C9wZv9>6&zG^*
zYzi#@VE8*eb)}7ZiOA!g-47=V$Z|gQR1Hme#Uah<+H=vC@tDvK`D0FTTUSYl+n@8>
zEcUo)?{)Lw%MGe|6Kc~BiJVt(40mhZoadeMO-b<aOyA=-%+Gl*Y1Ld4#D4w1o8h9J
zSFfvH&@PBgo6ln>m&3V7ct7*ObnO`nSr~1N+!^X-sz<flcX@Q~O!hii|E-bp-M7@T
zx@f(rVt>m0MPh;cML%bml-dc}>L$^qr+;;wvYFp|y8Q2nW?yY<HHAk-e<meZl*W2l
zMD!leGk&&Nm+SKOHlgUI=3T#C)<)mbI<&HA_lgX&@YSV!#yh*si*H41o(Xs>cFEz>
zFG0!K&c4f%CO*Gf5p&MMG~}`?OH0c;#v1}Z-g>l$#3b#O+Mi+Z<!ACC{{_y)-Cs>5
z!y+=b)<&qyrSeR&&-1*bYA5^P--*7@#|~%<-V)r+s{0|$^u-r5iTHJAcOTm&t>kJ`
zvxFsuXTO4<=*l04EbOs`=F;n(7q#=xGqT*^`TXYT$?NCI%gWYU*VI;g`ug$p!|m<&
zW%l37xFKx$PG|Y=)V`TLNptVy^klasT{CYoO!$1O(sBK(eO9y1)!({q`1glj_isg&
z%78x!4(9iob>^?U{>g&zk;K6j%6C*v5?1-h&-lf2<zHU6s8^HMq@@1W=DT;tJaLfS
zXD^y>^F`?LN?j`z^`~CT`|Y2*h)?{*exUMM&a&DZYvls3<2e(8r-bI~G45e_s<{2>
z=|zrfPj1kB9(#TUll&KNP5oQKyw;M58z(7*&kI<h)DW!W$T@%ik{=J-<Qc!*O1iBw
zsWfAC$%X$L6<k8Ds_br9DSLn|pxgfX&c}Io%USg1i>W`(y*l&b$!AZG8*IpmF1WVG
zsi8{gjOsaM@zswE(sL$=+?;kZ?q&FkveQQei(A+I5KO&)ukql7%j$f$5{^$Wj=UDr
z^nS&z%sKi8j(Z2b+q6SZw&I%XrUjEeu8Hi`J7}_iZ$i}Cu1(EfOF}AtEPQc-M|TYe
z^Ry%xsW%21J7-n+?C%I)V6*q~)!u4`qca{H4P0QkPgi%%4CSWYQ~eDmzUI6Ry>|SA
z<7SQzOpzb<U2V|YVk#rLKwIJv!*4gP%U{ypn93!s`CXxs_lVtc<ICS~{(R~^C2^p$
zX|A=(cA2>>(Q|!Pl`r+=?tHo?F-16M+MkmTE}O1vTzO!6*&)u4me2kxGjEgDvAFOv
z`0V-Gb8FlDU1L_C{_<hvE7OE#zTU&<1cbgFmFZgWFwHXTb$tZm4oQ*ka~I4tt@Psl
z))T((MykH*HNBSH6DMPY;&g6wZI4b9Ok(ZM*)WUQ_~pD$MK-Tp%Ob9*wg)eZTeGTA
zI8*c2yafyrq2aH#GyZvQTq+uF>sY>>V+u2aH-D$UBt!f8e;EuiI(PQ`ezeV@;IGcA
z$Cvlbvf_HcYUso0`G0EGx7NJS3Uh_#)_)n(SzoDgCz$Oyv~1DCZb`8#Z*TniaO~5B
zUmFqv?#u8VzT;}ce63pV;L6LQ>!PJRwPq-tX5g!Fw@>eMwOYusDrxH)+l8-czfH@&
zv1Rt!*w%^eHeZtNp3QW9!gsy9`|^7RtsAS$)PIZr@#<Ps?69S^U_(+?3&#Z4DLixa
zH?RA}Hoak~=Z&(^<^@lxMFh(BO=JxC=MpTwTXJI$lb6dUqb!Bbsh!K)AI*PtK_b-7
zV3Uy4fqs@`Rq4*ZYei>BJuX+UIlHXj_i~S|+K29bd!^Ff{?u2sv_<=9x%la;Jm>O5
z{`tO^w%hUbhjvj+_MbEB&z~w<)fTmA_2gNl6DB<q*y1fSoyC4b%<AOAo;?#xN{rXb
zU3sfCRrKp!H?gHsme2Por0&}$I`ewK<dmN*5AK;BZWU6my&iD&;q(8$o>ka4w=2)J
zI&RUp@VV@P_p^09&c&-}HO!iQ{z08XSd`M{U&oZ(l_$!Zh;Rf}WN$rmcTT0)ukGKz
zvMpF|JE?iy#=qNZzqWTWNHvtL;QX@L`sT+qk%exb<~zJ-OI<qI<2Hxdl+ziq8TJRG
z&!yPiUdny<+hXpyJC$2?y5-KSp1Aq^;qQMB&Ykdj?@je7hbIR=f3WUItVqY(qouJw
zXHGg_DyMcQU{7wHhGJOS&eKMGq3yP2S0i2Lgg;!gXVv<JPIs+0bvR3`yq5S{eM*7k
z#_xf$y!lmI8-1TyzSdb|9VhQ-*|MkINKA$0?YBFU!X;@;J3HUjOijQ3ZsWc?`N!@l
z)fsD5^r*gGdQ0@#jLlc9!)D9x**e+ws*sxRmo?vv5+aJusT~m42%F2#wSHawl&3L|
z_q>X_$SSh<^{SiE^A~pc-4bHIdG~g0zVorTE4PIkEj;y?&F>LVWMg^%Ebf_DZ5Q9?
z3bknrx1COJI`_e1;gol0C#WqvebMig^|rP9CQl3dP+-|wP`^YxH$K@(c(14LjZaQV
z>86D)%ZjJ>uiPj<?~@~&%D=zj(_D46Kf26`_xI3}GF3S~<7Ma)!6n5JapBuPN2?#t
zxR9@{=h~cc>*@XL%@eKu>{ctfK5<2{aP1zq2gj6kZyClgy<eIfWYS-vqqkGtT1?RG
za9-v1B_HlxkUD%N?e@>QZ)I(o3VYT)w7Px%-JbjJdtb3IA1Ez(P>{6YT*h^sF6rc(
zeO5a%{KeF-oU8nNrk7`X@~aXn|CNy?z6quMQ&m6AaGv~jzoEN^bU|xBGuPq@n?ox*
zni?$ENY+Y57<jIbiMuYq>~ieAYT&X93e%E~KR(97upq|k-*?_$>@0a=9_nZG7P%$0
zCEVXs$Lp;iqOmpLK>4J53HpnlE?vzmDk-)68^_VR#`+!W%jG|}t-Sd}yZGs=DIKo^
z?`_*Cv#yl4<B1dVuV2%h4!-aDT9)c*rn}K)(uV~+Yvh?38;owf-~Rey*5VpRzut#4
z)qh_VKlpiz{#HMq*O#B%yP_V%(yX{IG<ijSlJKI?Lx<ikXox&}f!{NCSus!0#)&7-
znO(VQ*%!C>fJ=Pujbm%BANl=mw!QP$dPSZowK<P`=da(=_iOf-FP9%}i*Yz2FmLvp
z<?i>^xhyETn3Df)Mb)Yw|IQvr6%p<&Km4*Wv%dNdTU}G2Lpk@S?7%Z(d(z(Kxv(wD
z|9;+|?PG4%2MfnviQl;0_so4Kb2MgkrG9=}n%m327CYKjRfhO4SGA5UzU#n!M*N|&
z&5k6cBUKV_*T|O{KUZCmI{n7M0}CHc{*zbbf8FzZ)6(OGR#z<q^R%T-3eMWBTFbz-
zF6!!n*WSB@t<wKh3x0p}=gf4*wa2!fKYl%9Rg2-8_`L<MUbmiad3NdFu4BdDwoA=X
zX4u+$zA}*SV&#Ww*`-tLqun**OWZW&|EzQW>C5}j<u$wK`_|+o_v@EC|Eb=XAw9E7
zhkePuuEIZJf3L;eH;kKfqp8zWdVY%I^pNnRE0^wmni=vX>Po*(|BIvR@=w-HJ5g}#
zdq@1P(&|SWOK-oJG^aVsIVN{9A8X)*q6-52?hDGCzC5236XMWzJ9MgU&F)iv-@N9o
zlHgc-OM0Q*oLL54wgHQtsjOJgx03O{c7e))-ChfBNvFq&YaEDJ?7HC7`(+<WHoS}2
zzi|J&xN8e`9GPIb(8r3UHN9+W)S^ex%8bGn?t3g}Rp}8~T$q)^SLL1HUH<pFyI4tE
zUE#|f0h_+Z=^2ap?yRm3^tNkG^x&CS*;tmn{&LRG3vw?K{yg*+Iwt?^;HQ5oS(W$S
z*gbJh+UF=L7vp=sAzrn9@0#ULrRQG%x+-N!YQ?qo?Z>*S?96|qUG-G?@9Vlu{?fj1
zapMb4YgtcSk-x6Kv-Q`$ZQpHu8aLD{p8c9tVY79=w#VmtGuE8Vk7)gSY=)6fS?2sQ
z7EXq_Eww4TzB){LmlD6a`l{-S--*``$rPPW(C(})ovmN-diI7#r&*sFO?$b%JivPG
zw(~O<1YUV(v;ImhU(ApEt8M)`yDzKFSariesZr?I)2OQO<=33w`@C8tc|T#5Rd=23
zfrSQ1%riL!88YrYJXrREEjUg@*<)wy3hT7bj=QqeOhtEEI2HJ*FxOUb7FoJIPq}>{
zXS(pkXq|Oa_MdHgJ)t<>>{VKEFQdKp<b@JE%WC;-&s{khKbLRntBY$(d9|d@>g?G5
zdq&%<UZwM`v;J#FOn=4swe<8+$>ei~?i%#;e_EV%B`@np;mO(F9}52-@jS*@ZnJL^
ze|Os_t_*#y?`J=3^SIzxGTSct`uz;W^T+!iwO6D#o20KRJ|Lnu&sI6W;!ZF})UCzO
z^)w$HQJKD?LwIuQl#b%}596HH@F*3Q_fCq~9lq-Ac7I8$-HW>Cg>_#!r@mV9iJ&#x
zf8P}uj2v5ET<UlyBqti&r5%6r?ZstTi_G2QqYM{J<y`BwZT8)#_M+Ea>*TL8=dF3-
zu#!(ic0zT^3#lv2%u8dY%@b;NFy4Cau&QHC_KT~M*QYKJRPwWUZuF~KaZZ8lk6cdi
zNxZdZ&rZEydL^okLFtqKQK!$W(mER3&$3^P<5hJ3!KD0#wfoYazM!clP4_L|e}D4u
z=NhJjYzKh{w{FIBEY01xbhhI+pR=Vu*EzH+s`?o>ROx9YJF>BQ8cqJ@aVXPp7q87X
z>8(+_^Hh%c>2jDls2#b`eRKcSNyX`Z<7TX%eN;oT^7Sl3DV~*0<tG<J`Sezu>fXBP
zr*O0Tp_?VAJ<f*2gtIvC-B+~t`SE!18PPqD!dMhqI#@opD#-19o^gP;@!0;O>vl~3
zJ6ZPj$@J&TLXtRkY;sIEk#$b*thwnL8=gnJwR38hcVsb0c5M`z^5hSjzqGT)=H;I}
zW8cpe?`B-{yH2dy+150F4(plTxoQh$lnHt+_<OLOeR1N#8+y~+TAM6hzOj;<6lwiz
z>kDl;jWDe(*RODNTRYsD@#WFf-+>b+e|=`KeBnt3N7bOI%asC4e{x2Bn6W_c(?Rx_
z%w<<O3`2jOWo+{^O*!`B+Q%Y>Gb_5cEwFQCj@6hXnsPgDlS++R0@Go&C7=5veKxS=
z%KVj$VTce}qqt#5_OI)&@0Q<U&3oa^vh2FRWX{9$9&Wwy{99J?r<TMPhtPGlp)q-a
zqS7sfN=03aD;l5MByvCbC=#I*_~Ga(DXnu$cio)zDSXO~g&k>rv$rjisgbk$zf;z;
zjByjgj-s+1r)76_mCpHBvgYIl{)b5dvo<$$Y<kL-pEZMRJELu4mF|``%@PkEHTwm6
z%iegkys-8%3rD0bOP}!erMw+;Rx`G0U*)iv5&C@Nz3%C!%2nRp(PCTT!t;jfSN*Z$
zGE5JwzL)11GFPSt_Iek%huZh7N_}RwSntH-<M$swRkvRyX(?V4XXwqj%;obf*>K*Z
zdk+g8=C)S<<Eg*%Ws{!0?v48&JcE8JxSTlbtP;AQl<%v{`kA|3Op@*`{3N@!`L#vh
zf}RwslU8~2tt45W1-MMFn!ahj%LJ{aJU6!eX|CJy`#4Ht#h-~)ZN09u>&-&3O?&DU
ze(vPEQ7j<&XM(}Px9=B+taM##w<`bI8pr$P%kNK<H?fga*dbctVvs)PuG-7;`3|SA
z$K8BYVdrRHa_QXVvVTh3=KeilAlT{4vRHo}m+~~L<Ixsx4muyb>ya-x*X@`~-jTkG
zKhg{o-^`79+w71M`aMGZONN84$?}+}OLK#Yz7*!NF5k3DBPKtl^W)F3|AOxt4d>42
z){}nq>w4ULr?o{fN^LbhS93zMJe&<0b`<F5Ogd=V>h=4jZ{g{M9P^g0=2g`bNm$S=
zc4g9rbmfWncZl4oG4|b~eMCG-fu-c^saa3BDz5MFo5^{$`N)!@ul&&h_k*7Y%dtH_
z<}mNUq4#?vo03*Y@4l$^InQH8&Eog(?|8;C{5f*)sniyBZpY+1e``aRG+KOmFRhWg
z#dOme$6ayU;+v1U?sffde4*>ryyeV?qAb=-Q9f{U!O=sO%XS(IstQiYVdpt2_Gsqu
zcfsAi%TE0Z^FOZOJmG5U<~yPF789m+sz)nmy=Xmqx5PP(OZ}8(LvBmqE=x8Zj(y!P
zbndRW`|o+B(rpiAgUVvR!_KwcsuG@0G-q91?{&2Hn7%@}M!=4kIT}s=>%U5?8FuF6
zRo@qU6_K4KRBp6h@uap)jMSHVg|Q89EbhGdy!df`JimV*`{b)7Rji6-v3j?=Ps=54
zsXG^+Gt1_X?#a#lCH8xoFDtg)zFJq-nX*Q0J3GhZ=`;3mm;dUpm!0^A$4qRpa+l}!
zqf6GMU1?o-A|c_~$43i4ulO4_r*F~Y-GOdJ;nBt0mx?!>6%>tR^ZGQm>96@FA(r>X
z>!qFC7K{EcRm}X=#<EkMSMQtV^vzaFgnqhw>;ELy>vm8wrRr|g?&-a}XJ5U1b%-f5
zYq78d-y+fIgJ-(l-6?#oI5i{7S1ask(UfZ;u8-d4N;+vPcNDqp(XOdc`;b!^q{R4l
z^~~eaiW{#SS6g5&QTE~Au8F%@@4bGoIL2VoV$Fz+kBffoc)IK6qeBbxckEdtk)d;d
z-!s2;UV=+Q-kt0J3y#fO(RX=TNuhJP(c_LjzpOV$uBE?;xj#w4f^Dzl*M%N;pMIV1
z(8o9R`RhNH4}NV>KdRu;(Y<4?;633!hLQ{SwCk&XzA8<rUEO=!Yg(&^%k+pl?@nhj
zI_71^Caj*i_n@Hs-J3>7TE%uI+?RK$dUYWw@QhwXcl|%tSzN!ia;^LPEaPbYEBo}g
zBA1$Io_q3I(}bVPg$VvBnAR0%s6Fdb>l}w<l`75x{sXIDC$E$Ep&!>Xw>V$@xAhu}
zGk^cyU3)9B;aS_?cg=;|x<Qit&Y_oH&(>d-Bw)0pI`jk6);DkDeBy*fSARIkSbC>=
zL0zD~UD<2R$zLBN%<t&Sv}x1kn2=}?=A-wRZ_n$mBD4M$fBX1sk)7zq9ji8fYWm^f
z(PSU|_x6>wUN=`Q7g2~mvqElvt58(MCf~QKTGAZrEh~gR%}ZF@DtuR}^Y_93%mLoa
zEFugH3>*xy%@Wb=r{{OgRAFGy+rz-1!@$6hn_8TomsFaWlcJxQSCU#(P?TDdT7=Bb
zPs&P7E-BV4sC;W%UwmiV#{aK_7knzIxIRxp+xJpfaO$cPn_fS^aml0Tl6hC#vUdeS
z*>aVtmA?Xe_x-+olu3c1$!4Bk*__I=TRQnz#16bm+IS;YXPK*Aa-d0UNOzOFpm*Bm
zJu4#Sq*jWCd(N9Gy-DMG{nT*H{a5Y9#6K&^e-5gbd;Zz_Yx&Xq)w7l6<>&ZpTwECw
zyYyu1tEU`weK!QZ^wgiUN?c)gzG7y2z+K(*&rJ-L|45p+WHMWi$^I)1=|58@ehR9s
z)~=H)o>BEJc#hr=4>8%eKi&P>UthBbFwW=8)1Ei=g5lJ@8`gD?r>v~gd-TzLp6`|V
z()Q(h*7SAlId!~p)ho5gqurGUAKn))JQ;fRAlvJI>GtPWS)8mWtTKPTesiW>Qhwf}
zN0a{5#5!M{?3g2Wu2L|((lClG?#efZh5!F4`>XF^n9;4Z&!cklJ);l$l|4M{8Zs;Q
z#}_mhu!Z<f+qN#@)Z~nL(*=EY$eg?{pMNI4^8U=UpK>PEGmnX0FgmH{9#Ax8I*az{
z`yMO0-+1|0X|e3rVYOCmP!3~IyPPdIwPsHGWR0iSZF)JvG6i2fC_BTNp8T?Oj+(H<
zjih6nS6xy4{j-JNc8&0(C5u0b%GbAOYN%CBPnWsLJmdRa|BJKdzud3R?p}SodU^Zt
zMNeLwUH$iPxqkfqt~i-JHGkhRaEbomoX`CIQ_h?#+0R<Fb}tqUOey@8ToicZ=-fFx
zB3Gu0Xb1>SceS~k5OP^r>pFMHx{6TVpFEO2h4Hhdgc`NZ>ucB(8FDOm-$K{3cV(8#
zO@AYDYS|kTo4@xLH)s5pXaAiax4(L;GKbq=jSoi*kF^)rblVpRZ(Q~2U-XXzfzvrh
zHfJlmHMv+(FWtXBA@fm?$?L5;r6>RY_Shr8pyr65n0SN4tW7hHl*XLcFEY7XJ~DQm
z>9a>OTP*+WQd87><TdT;BQEhv-6=7FPYb1{t6HB}H(BZY1YQ3hHe%Ut&YowEE#I+u
z;dHl^T5mRN((=*p^}DHkdqG1;gh*=9+438%d`-p5Ru*<_?`o?*am^@QE>@ks{Ncg~
zhr%khzjNnrzWeL3!UNZd;({9@B;!9N9AOJcUvm9K!H$g^4Ic)xRcJgaWPSbTe)p1q
zqEv?;cM}=^3d#j+O^(!lA;Pi6Q^}Fh!T0Vvx8O(IQCF?c%$Rf9&?0b-ySl}U=sh0V
zPD&;gx?(jaw(UFKx@pGpKRl=1d;YymniR(0p^%{=Sa5Q+W5A1-+CQ8FiziLlk*6N;
zH+9amnr05qscW4qPs?uiwp0yd4=WB*i;O&aa|VBci1JeAmiOLq9wh;vANIL1nK0`f
zJGi)2>9sJQcfNNsgW~DD8_U-0;QY)pul@cX%NjWz^F0BFTu-u_?v>uUKzxS7jHAYR
zd?KeO83k2H^So`8`r)$cWxmbY+n>(dzH(q!p4P0L8m_0Lb9>7^M4D;u3{>=U==f>2
zVV3?4_qy`Q;=*F5*Y=zhQ(ci2^X1s%o~Nwcrg<E98=@|rH2&81dFQ&yUM(qaqmvD5
zPDOG~;#yX8{L?G06{h~l0WLRr|D261ojN5%G)?OvC)Y<$jrw_V`z-D(?0Ooy&qLi}
zL(}<B*#S-t?DGz6mw9H<cUhz?JCxHcI7MgQ3Gt{3d9SG=4=;T<_iAh7o;7tjC#E)7
zwJdw(Q7@+%a%0nq7P;f$2V`Aus&)9eOcf7Mp0N6t`wg9=K}wS(4U{xm4OiYZYni`+
z`NY}Mgmw9Acx~#->|}O1FdUFv^|tw>!ISO92gC~M3?(*cPAF+ADXOwr{`K9@EZs<3
zt%R4eRc1diS7mTb@;Rh*URxqJCgiCvQ!M-bKSCC7{_)&+Sv&1c-owb|&Rr|S5=y^4
zT+Q!raR*bIz$C?e3|Dgk8SkgQNq?nP(!khx%<zN$Huoz3$11KB7Q8ohZYwy~^Ehvw
z|IHmIP8V_S*wA#|ID<P{{7qf?fxoUb;ZX}5lN%a!cWAFwv&c8ya4c$?x8Lig=1hkc
zbF1C+ZC-GueU%ZEUpOUd(*Ft8Y^s54N-~P}ZFG#@di3FvAN*&64@9oku$#Wv-LG$v
ziuWoFsVO#dwLb2>tar@)%!T-do4kg}L3?7(OnmOdYnQ)GZkEP0CfS>v|3qHIh3xFk
zQkBiKIBmgUG{Nk#gv;~^y5a=^kyE_lrb^vyJC$<C>4!$0bBh5-lsd0A@5N@WREu+t
zGDkvXoZbq(I92HA=EUZ<)1jUvMVf`fdXf|Kw0{>~ML6t!^wPzw(ec4cn<MqS8&b<l
zH+nltcWQ1-?_{fQzsoBSe>d}2S0m>mu9wU`sqa*pZZoOAV><e}_u)gf%QCGEdl&BR
z>dg%*ztMHMO5&KD)&zsbv#tt<-WJ@*aB^;F`zmwi=1Tr+7FVb3Ic1PKThvW6`bzT@
z)?UL?MV`*JXF~1oUvcl)Z{GK%z>JyGLNeolvu$9c&`GH+hcYKm+C9PQ$ejKexAyg1
z?m58o?i24c!QyF`jh=74#$v+xT5`oAfBV*1^;KsMhPY3iq<LK_L**y0R`rsJb-%;c
zPAoeUV`ikL=WX|PPyO~+d#uwKj84ngaqai_GrpL)ciq%4os(9+5#hDw%*`mNnbdyf
z*urJ&c_w_?*!DW(OVX6nN18d;rYhbnc-SCw_LTPoh06|nJ$I|Wx3J&fzUb8RtH}Ar
z2|ZChsq~<$XXQ7}mo3xRw!0x<<tHw5;DWbVarp#`7g6p(AHS_tzJ2P(HKPga>YI5#
zhUXs2&0Uopp~kBfw`-Q@lq$;;LjSu~@c%qk6wuDm&EGHjVBVdqMfYQ5oKz1jzEFJk
z@yz5_%lD2-%!?LWD%){)wnyph;}=fm>=j$d<IwBN&b42p$(C`Whm=iM*shn!9;qgA
z-9e@@;roAzzEIiD=s9iqJ(e%i{)p^$2-crAciV<bpK=||?rf3Dn`eL5Y~kC~zpfK5
zn2Y4!-rc(P;1>~Zp?PONoIcu-b#033r_)?Lue4nL9z8B}t=QsSxz|Le?)e9=9-Ene
zbZxYrcemQKJ&~O%W?S}&6h@h*9DBaRy?MQD_B@S-Yy8}Qy_a@uVU^Y2q+Ilk{|{f%
z)9snFYG$qL{Ft-pu@#f;Rh?eBsTuyV^J3p$X>&g8`ZYL4rK9)K<rQbdkIq=U(R;^o
z8&ek-$MDvo!iyh6c{EP0Qqq5Z=<8+MPL*z#cBVxompJS@`OBXOM}=w6o1A~N^yh-~
zrH4DrO3D=uhcbjn?+p1IrTN|KK}5<GW|0TY58A)4FXLgm)Yo8XAU1!&%1ez|6%j1%
zr*1AtZ27mz{<4<Db78%;8L6fx#Y6uxe`C(@E)|b7IhSr6!C|6Uw2Dc(muH*ARUU&$
zOXPOC$j(fW7L0BCDrI1u70I^dyH~<rG3M$gRSC7zSYB_`y0NMCU|5{=naws)1vg_P
zr%f0BCDWO>@s_F5Ey1ZuiL2b@X8X1r4Gqjc@$bZ!G$-Q|>lWUt{qXI<lMk^aML+&k
z{8zBDv$0`)do*FuF^$w_`Fs2SeQaG7ZyXi<b@F%nJr%V*3pxd(U+t|cud1miD%sE<
zz%17C|J3B10yU>?hwAk|b@At&d{E!bR^QI^{IJ>`_F#z_E*rA?@-HOKoW8KYxWiAn
z`}l^4sJ<i9zCCj)VeDBiU>3+ARrsi2Q+9P$Yxhr;ww20f|2S+Ank4<t`ohyT2BA$X
zN89<zx%=bfWnbuqajIWRd*!9iS6B7@-*Nfub)KKSZ)EC=O>bssQDl?Rymp(@?dvR8
zo(YSR43{O|U*Bad-TGPZv}4;rh1V}6c7OFammJ>dHskTSd2cy7H*o*oK9}hn&+M+<
zmP^;J)os=OVJuM=S~iE@ciw^e3;9AUwZE^Z{Y!g3Pi%)`N!XLO3QUhPR5!XfvaE<c
z+k2Kn^#1d+m8F*Fzjvm+IsEr9`@@1KPwHLr)3$2d{Oc^y@*=Tk^}(Pv$;ic$R)?pp
zdVJ@W?Zoa^OSO(2jXR`q@9EXkH4}Z0w7o0$`L(>+uQ){chpzl$?V>emKYo95me_Fr
zd*bh{XO4Y+qmw;TE9QI)&!fxhyRXZxF|SI>OMViv;ogc`IV<PfsOlpdcDxbne*9y(
zlp#ZSy2$)(kBg(rSGhlbyK(JXcNw<hOH;G1C*Qp#{=cZ^)-ee#JN+jTH62a;BJVf;
z-2VGHzxA8C-w%KLicefMYm#<~bPtQyVvc`K&Hf_2v+hOSux!X%YN}K^<;skiA0zv=
zxLyA-^TNIrrj;&DWwRuYtxV5(Z{@GH<Kx41oqUxqnnJ_x9O<#%$X6Co^lEDH*JRln
zMu(gKipuN|G%cF<WBG+D+v97}4+LdSZ4f&3$g<70jy2%p{+^_%t||w8eHOADV3cU)
zoK!zC)brH5_WS=-YvSCOuZX?5q(zSV-)YOqXIpIFe~=RMGIIRlc>lU5-)>Gx_9BzW
z3?E0ug<W@**W4H7-@<rQ=dn3YTI%}~Z4=Yn+BWWAAll~i@Cet{j|D<2AG-!R*axaT
zn)#PaD%mFS<Z6diZw*ZT?9;A0ldwC0^|oE}M)odg=Dk-=G@s=OJQl5@KUe?AhMvPc
znZn<WpJS7Yb6nHkVIq-{Dr+NE(k{q*hHdNLIQ9p>a=)wPiAg4^-{9MyX@2u}l*0D)
z+iU|)OD%o$U1&*J4o{!yVb}hKbv4qpGkU|G3xAl+w#Df5$!TrNqeW^Md#(%AINjKi
zJfH2}eEZ!T%1@sP2P|vbVw4$jd6wCxC*~e9mY?FT-0b);&*Mwd`x1VEGOiU?FXgN4
zA3ojT5i()6`lop%+iMGZlN@J1?B3B;+ckTGc1!Q7>=ik>0`{GouC0`sXm+Kkb-}{F
z+ZJZa9#zv+zOk)$!q#sblHMn#rM-xD+4zA^W%kUeY>TaOI7`3I(J=r1*yk93SeEIN
z7yU*X6u)|NeQ$kwK+od5M43q5woWN-2bCs$-o4E;!e;QdW}nbbj&d{+Kd&BWeJ}mO
z`<b?viu<E?9kf)x5qUZ-D{!;(ECJ1PPyD)t8p`hGDla-9!m`%re*aOA8TwnltiRf4
zr?NuYzE5b?US9#N7%%bY+Db1e2D9WjHh0f(*8NNkj;c|8bhv1q+Es-cCd$pf1@feF
z?nxhz|M2Xz@P&fkJLCNNqdXV=eXOzL?;W*!-#*`a{c^JY()1_mJ-jRu4@P#H9j@`p
z-f?EFLP=t(3-i8=L-~yd9xw5F@5FrTe8CYPZaM#V4&P#npC8h>{N1IsMC5z?gL)gm
z=^05(bHv$fCTuqldHv<(4%V+u<#~b+?JwndU9WES+|awD<kT6l&D?P<Z$$jQ$-Dey
zzh=T1{h!6ftJGQj{3Yuzx=OP+m+f&0DU08ktaCQAXZJg?mokxO%^G+uYrmP#UmJc#
zKGfLZr-B93t*-7>Me}~Sd3D7F{+PJ&d5+k9P9EW}OInp@AIRZ~(+hggmCDhm>mRWw
z;aBD<t%NqN#kGuC+rG-jJ;{39QWd)K!NXwXW&INvHM$DhUU!S%c-nj|ch~!iB8^v)
zn7+Q?Q`}gy|E*}=8Ye@c{y5i&&vWkDavYG3HZpqYU!Q4z_;<9{&N=6`3)`%U1uOR{
zsp;!}eY$D-uSNX=xih~0Zo9qVF4IxFfRoK40tbZhe;jod$QOuf&YFHn$=GCJm-lq9
zfD_Wr-^3n%I#PCbhqLUwL!6rqRmY1=R%h9~nwMLP-A;PKeCb85Zo7JuR^(gtIC(qN
zaGhJ#cw1*#m%Z%zzrTFkcijvAB;!~Tx$fnJS|v4;v^V!0#ikXP@E+0^>6F;KP4dO0
zwYi~BVof4atJ6=%nEg83c2Yeq`>)W-du5vUUM$N!f4J`4@3njT|E#<6aB00+vZVae
z4(EbnLI>x+wtOgcz3c2t?snFj(iw7Xv5q1c!4BdQd)n_9M0teVD){ZONK#*~vZYh6
zDRB0}bl0EB4Qm3U#mm^Lx7}LzOL9AFP3`o{qKdg5lP~JKCI57t@wM+;pMU)OzY=>b
zESff7x%Y9k@Sa<`4N_uz3hidAOI+ltWz+I)IrDRacVd|GcHdbk@}bN>mX}LM?k}IM
zBE6hDKst4ET&~70kMB?N7wbD-uk@-BJNYa7_|$X@hPM$fi{;W|SPXKH9o1w@|6+Kj
zv#ZPZe8bOo^4EAa2)t|$I3ua;G`&`7`~H(JcCG)qOi>`&=b+P-;2481J9EF@IC^c`
zi8B`eWY2m1yV%C_sM%Dr>TLI<qC$<76O+z6_!eHCTNPa{#phqAR(6Dw<A3+!!t0jj
zE~qYYX<T9Vzru5O_>!9UL7YGMrZj~4njFw!;ZwO<x4?0etXSK_2@BU9ee5|~?tZ$9
zZdkbOK0Ak!)YFbCD(kJZH5_GF++0?vhen=QZ@6<-Kux)z$E1(D)TLeqJx(}n!OK4X
z-;LYuYu7YyJz)Q<!t?h(|3X2N$di+cb=PpN5K_~UaBDMl-eO^9IbGL%-?vyvw{Ic;
zECb%p4nL5kcKnCHT&BfxC1<&|U5b~k$|;)5ZEOGZ=7O!qCe)ta_EzvZS7}F?X+WUC
zn-oiVvtZ#|tGl^In`F-wP4wfKESg#ouc$dq@^pq~PJ2Dq{MB>h(l~l@y+7YRZ<V?@
z>ftqwFCyhj<1+Yz^fbK`H)SV8tg&8R)T?*sWS+L`t1`RSP0p-Mkq4)}@UXnRXG2Wb
zwx&quh-(JXOH#k*8olRGF7Md-<;^s=eVo@Go%r$V#f+ItHyuCF?$xN_<+t$3#7oE7
zADleO-&^g?b4R-&EIz_i>(`n!3NQAmJex5`%TGCZ&K9YC*|tA!`)x|y@b7`;9bNu{
zOedplhmIXjeHD`SI{0kw$F&*tE)DS#bCu>_+n?<=)A_ls*oGCB`wq(gQ}}r=m9b@W
zOq!+8vd4DS)y}!UL_8hBF3#VzRc+$BE5ZSf*RDyey3b~M|9kF2e*NBG3cnvr;akld
zppmk7du=7VQu(!uRn~vjZQZz)$J+f(pi1>J_6;6MGQBB*+c%%sCRe8086Lx~T^(|?
zYLV-1-J5H#Wc@LXly~uUN?x;dkyid)<Ee9twr0d9Pw-k@aFw@T>&BW-8L=CjnM<l~
z{&A5?_+VwMwBhB7?v<-uwN9}-i(OhC<n!=ugjshm&za}KMYr|7UhAr#7qVMqk=yD<
zm5Os8_4Xgm(5-rs*W70tB`v-F-HvIVr*CT)E{V?mxn+-Tr_$XZuVqi)T3yZ2oc&Ad
zw(q?6Yok0SXSD3@iCG%I{;ltZhHID3>-_UMCc4=>e;o(2XrbiG+NF){^Q`uA9^O8)
z+@<LCG&h6oTGe;z9wwb#uDn%Q|L|_L7~TUHCWlBc6;v!}-@~){(2@G$snO~N`em~7
zULTpkc=b?J>^`~qKMk%uXSwVXea}AY>OAqujNYD}2fe=5%9l*}R465WN99}q+m>m^
zJk=hX2d>uAIhm7irsdhEPL{1TiVqhnB=1tY^m)Rg&|KaCyHLO7HSfQee2uEU(!KYa
z%grpAC;k!tR~rfYKGu|2>3!){-xjqn;p5dSPb~Zt>htp9{Dwr875--ou5_O@SoCK5
zd4nXW`OS$g?z%j}vVT5*dGX`JRF94xbz_T{JWQclFSegh+nv`X`Lwfl4!>Rf8m4Ox
zdtKAlth)BH>+M9n<L@W_O{$&1>tA3mKl`}O>j_Rz-c86lu-%(?W8UMJO1{c11{pKr
zcISj%Se!X`)jGS0Y*LbsqfN{6Ux)Cf=+4c$d*T6a=(n3{y3>MUU+pi>TlRgL%(eJ{
zz2YxVUwFfC$>oS$x6i+yBFf7?XL&OmnJ&oUb#u=|9j}mlQ~s`%D^_hh5$LMR!|ZuD
zKqF2)y8qd!`Fa}v?q09e_-7gO!QV&A@_^`ys~*Xh)ioAW*86Uq_R_0Fh;8CBKmMDy
zgEyS8OZ(|7W}`Iem~@%q=YWdun*YC*KAW<tm%DiJ&JRzrqxaRGUwLWk-=)@PpYN6v
zpK#>z@;iV3NqcPhrFKv5_viTim-8>bR}pKlFs|Lb?c%%Zoehgrw|wk*yHRp)oBBIT
zR@KFqQ|27H=-d(elS4K~?$J*fGv6RR*LgMW=ha^^J?`DR!1=<-a|;V*F$>RFE2sUz
zXM(@xuVbHGO?uNkvp&_v{*delE8q6bXO3pgw2kX$Za%g3QrXOm`6Vx|T->#Olh33Z
zA)+fE828Mxipu{Y?<n|iWoaNI_q?$4xjl2NBCAAKFOBV;!N>cPw^UK?n~>fd&RN%w
zTPfdT70;jHv*4yg-<7YTYmXa!e6;A~@l|hx7YBdeY~@yZInKlOqU_q1>%3pTtSFFu
z=w12trfZLvU98Mz#j<Bp4s*%w7J66cw#;J9-y3%`UTurLY1Jr@Gr46d)2q{)JR(-M
zKDk`BRnuwDoV2ICp{-VuYwhO$Z9e{krP!MP1ee{f^5x3}&8uwI`n^kg(f2YhC*;$?
zir!}rO<0e;Ns0?S&i*j>P3_VCS%=);-z+v;|IX@nh-uB*c+d1JEw@S+#OzC5nf+_Q
zL*-X*Z$6I}o3rnwdD1V%IIpuCJ+$_j?ESNLh0}GWyEb=ycx8)cFS2!sH;$eXYG=(l
z@7dJ#Z%j3QZ{PRsg+js_@teigH{?Iu4|%e8+pH-S4hO@1E?>KI^YKlUP19Fa@?V-5
zdS$ItOZMK1T_S&#<~p}n7F@j?6>9YOC({Y_ytI2yj=E12xbtxuw^8^{iM}(smM5OO
zP7?PlRcDO-{76YZb=4oe%GW6t6Br||74I{;#V*0UZ$)_M(fs8bQ(P;5x)&~sWv}4B
z9DLvEfolH&^`F!K-c+y%F|50JRphMZ{mLcZ+jo^umAO4L##h`%;QIbIS(Cy7T>quk
zPdn0l{?mH4G8Wd0fh^hoJpS<<HFc}m84{Y2FjYg_z^ne2sLI-piOIiC?~;~bTz9s6
z)%=vJzs=2;Y%&#@8@Z)AcuITjPV=V<4vsEL=Twx#7o}%UG<n)qRS<o!lHK}eCtsv-
z%3B6kGryZcyHplkUA=PovDv3s#oKE`P8xkXIOUhTfMbe9pSrMUWkguFCYxwyhDC$N
z{|gHY()g4Q9W_5AusI;G_{-k9W05L$hqlgrJXfSf*U52HyF>rN70-(8{FYs^Qj9yg
zwx~u*(*5&6hlA|_xi6(0i-M!SMv7cHr+d`jaL!VOzFR9FPTqQVz5bm5wOK(Pb_;$L
z-xpgVcO>SM&F=EeA;-!#_lDiKj#9eiSX?N#+kCUyscozGCO&%AJLTy8=|(e_OmgAx
zQvJDHxk~oV0-mz27(u<~dMrEt+`g-;=OHBLnEi3pwwjL&%<|7FXWrQ*EOlO~J>TTm
zxBJKB&#H7(W!`2G*><#9>(l%D6RzIgRPw#_mQL@+jM(&75nE5JJL1*Pu}F1Y>64t(
zwR6(AI@h^ytFVjoxvgpZUi{kT--*n(33co5-fa`VV7I+o_1}tzo6c4@&z3iP{axZ%
z;WzJqNRLAWlb0BMZd_3jWyV^zN8#L-kV*IUIbC(HR7;eK^gZGDqwRj>JVOSPSNo!S
zC1PdWkI1a}py^QOW2R^E@OHz7<Zh1q&IM<yEvpWw@VN#YGZ8FhU4QN3vv;W?){^|Z
zd;AVECu_woD-10ZsXZN5bGnvebH&sU8~<HuK2njZg&(f;+hX}3*Dg|H>alVM)BUrj
z$<B&x5eiW+5mh}lu{d<$@>N%gXFe5Hm~#AQ$n^y)*2PAK2CWduZ0r$?yskfC<%{U!
zx_kcC9BQ<`KY4P@*W&yGBH!PK91B%H$X~|j%uuKG#K2AG#3$W3udjuCmfWDq`syb0
z#B|}v{DkVuRtu)f%=f$J<rwL+J;U?cYoCiOR=N(8z1LT|Y*1qK)_Z>`Q8C>muf$2B
ze>IE3$*&p`hu_US6u`sj=OVL_ah|nNPo=^?X3ul^b2dE`Q0qPQ>P=o<`f^s0YZlEx
zj|3a4Pb#jzzt?6-xsCJWS@+n@q918C=x6Xu()BXiQU1F|Lh5{r+Rf5`f+=@W0xu}D
zY{?I}v2cfQ?kE0TT!m+@9OwM^isNrZ+p@LRPwH31Z1U7Isi>1a|KVgSTi`OzfY4)$
zT{y2uN|+y+cXG|_DfNc!!Ua18!W(|bs!dfXSG~K&Fn9eUgT~;a@0T6>+Ox^VZ}Orw
zPimulo_D4id)|=QoPSSY)5AMTlgyIb3o?$~u@z<x^6R(waOu?Xmx*%I{pYNibA<KT
zi*o4*qgKsRVw$HW3MpUP#nH1-q=IYNzy4O6f1LRTESxhhxb2%Kniye~s^#RM_;1R=
z73bDzxwVISya-k<S8w>Ak?G%F)_);itn`_v`-j?lHiB-;E*I$Up6owwOW%R2k55`z
zycX`#_&zh}rN+^y$w5`CUz}s|dz^hlZHuy7VQ4X9UXDwf;=#_>ru$yph`YTY^U8&9
zJ`p@3)24j*6!ZR~n{WP&^_k}~wzFzyd!&^57)Kra7!=7HUNM1P*!2I~e~ot^N89k<
zzy9c&_|_HnX5Txs`@e2?JpYvcSIos$t$?2&^Gnz!&U08Lzs6<8_ALuKZ(iK<^h3|%
zY1UKzwF~o~y{mAfZ-ztZRzJQKf_H8%f6d2Y#<9q7;*^OU5ibj$s62_D!F~3*Mv8|g
zXMM<H?YK+I-4k`>e$4X!7?|_x-%|ED-di&+Gz)FDoqEZ^OruVC`ovx0(y@13pXt3b
z@I9TH(0rrhn(4hyavOi$*z)>w(CK_$J;BPI*A^Yx<FW4JAu*XbSKqq5?wok+x~b-q
zT|1>~Zm%%pV6dN|+c!@-Exk8ax_`IL;__hC?NZF&H-7w36Z`D1Xw3!hWoukAMB=C1
zv$X%Tt@Y%NcfQ<Wd)QMiCgrxa=zlai`usq`Z=1m7erK+8u6%HPX7=qvFH)a8e4-!j
zRT!|p)1*LV+abP<P3>N_7xq;jIb5L0y_4DK(Zx6Vcg^SP{@-jm`S7D9hZZXr>@ju-
zu{`}?Pon)Psi5<{Mk`*1NxF&6mfLlTY0G|VtN4m@-VZJGcbsdO+wEM`5^c&T9pcn_
zPsG8j*Em?RQ^}_*zm#EB(mYm)+gCK!moJ_qq@tXY+<&M&o%!=k{*zM{&2r`~{a(Gq
z{nDl*QF>Wg1%@YN&UXJQuJylsYyR}uTP8urYA&C7%_`;E;=jQ|{%js=@(#^MmUAl9
z76ctk6a90^;C9t9%^LYnQ#rnbGN0k{6|O4aRmi(GVFKskj!o<bEPeeJv&5K3J^sxt
zWj0GJ&F};NpZN<58gBZ0sEnDg_oVA2CGQxCyyCOV!(&RFmNjvoI~HD8#wi@QzH0OO
zv)`3i4>2F!cFEX$QU9j1uDLa}DG_yhO9LbJ#VoGQtXfg^c5}np)7gFd?#g6epZct{
zEZr&~Q04CRx#Ehg^JDh>Jh{H|;E_n)+VhiZbSk(f?>}&9-jf(R?o&T`X1d*2n)ER0
z_=C=preljHu)gVE8#}k)+`3g+aqnurUR5>t{fMdM>KpBY+DvP|JP$7pklFX^-Ouvd
zr$yN;{cpdUzoxP*V}DP^<>0wdw&t2wzH&~@&eF|&`1$Vq0yU37*;k*YTZwxfc0Vjq
z^h|ES9>I=B?^<h{*YHjXz0U1(=hHjRGizQmr_KF0ouPP*^V&AK3zDZ~=a)Vdye8MO
zb=%tXCmVm}{LT}($ogy7rR(>+njHEKe&oy+o1dHesZl<DcKp6PiDtQ-O#;h&7BXa%
z9C7{oP?K+q*!-&{3@=V8yfSU`YT-Z2_K<ahkBe^Y^rnZWg%`92O{}=E$liuC>de+X
zTv0B&uU<^z;xJPEK8Zi%s=C}ib-ig04O08sdYgTZcQ5MI*!$G%$+gRuFVC3#_PUdc
ze$iwL?{m_bEZ6S8wwrG1IxFq=x#O|rALY~S4d&Y)ou1<_tAF(0$}&F_&#32ehTePS
zI{sd^>udjeS^xh14<7#+S4=U!5b@tW;%m;lS8?kSr@BjU{!7sgJ!qVFGWg_VoA;O1
zb0p_09%)Z{bwR6SyLzph@8M;y5<e_?xk>20^_%z?6Az`Y)V%R6;2&4~{_4UH{u}M0
z`1N9Sd5a&&T$Aw$w-xN|s}$79ezSu2j)dEid4XB!Oa;nDz7C&{EZgeV*U9!K&Y{{N
zS}pCqz$TwPie5Dut^C=~E-qu=z2N4YsA(tbEp{KjvYJ<~Uf^K*+1}8n+cKtATAbYO
zEw8_+Y@wGziD>-qy(XQfQw4gw=5C)-z`DhG<EqjFC$06oUuwzDKB{`YY)0_kjpZzi
z)4q2t$oAV8BD<1-M<9GN%VNzFEB55xn0`B-b!~op-bSOUw&xoS*$mt-=&gGhwV>+f
zYFpW_=J&UyO%YR5{@QT0PVY>~9tVa;)?Lx3UfKs;uPM7I7;)S1{5jqO?C<N0;&d)@
zuKmB{d(%@sDa+i;`W}r&%P!<^W+;`qS^Fes`-bhM52L=CJeONJ@w(8JMSCWuEOxZL
zkuqiOIp-+tms^(?W=pK!zIczwx~&GxOWp5i<zCyQ+`lA0dh6ke=a;UpkaYUfqj$2y
ze7^pqt{}D8#z%sirk~VZe1N+!KdtNL@{hGURd(}87esw)eXzoEzvLRHN`CjdbC=!;
z-%*_Y)Axkmr$sw1D;_IqDlAL?^)5NW_x1Xci|IYLn!eb6`E<`bP5#aC%&u?0+6oq&
zx%;f(La)<o)d#o!Jn&w=_FjArn@waP!>+qazX$qlwF|5^*`uR(!tUmt*Y&gBm?mvq
zap~q_-j}SgpWf{HHz_vTd3%ClP=Ma$-dh0?I>$QxpXA&-`FdgE&9zncN^f_rdb45L
zwtfrosb$`47s#A4IC*c`<uvA_lmEWIWS%&q^ZvHO`|C6-@9$Dtb!+pQzw)R{oSx@P
z9Pi*^VAyENz@UJ8iBooYVo^G1S<}_%-26K`1pmE@cZ{*S5xz$JI`gm8Mls(vD$`?X
z43q9JY(Fqzr%?IyjVh~DQmgBO{=3yjrvFg$TJ%lztmunc53`z?l6=pf&RqD8b?44~
ze~$lTpSL+`<L7eL)u!=<YT{2)oj>zh|1bP^_#}6c;;gk#UiYf~|0n+QW4rwS8ov5J
zt$S9RY9|JnIR%|{tvz#Ts)*>xO`)r!Pj2e@z_rX|VX5wx$c27>`+mRMJ^$u6&l631
zro7(9^s(cfnNFN(yQ{i-p1IGbD&G}K+tsHv%bvWkxlQ>|)%h1<FGQx>TsQvIn5~v+
zseC;sV<PvDuiY2s->{F?i+sp&_Icg&O;1w|Wkh<X-sFA0D68URN<#TVwm(fxrfb-0
zpU+wObCT9G@wi`|YvZE~RbNfg|J!x_tMc?kZn=NlRF|Kgv{G_s)9**7yKivpI4fDn
zeCEyk@I?jt?M_MSI!e#mF!|=?zZw5Hx%hirFEYKYjJw#baQ~?2pU2B$&4OwYcmBI!
zZ{D*`buH7`>kG;wFMqn#w>!0>U2;bFzlQBkr^VT?(RbPV=(YE@rsfBK&z$JZNIfSq
zXY#47hYWYT7Tr1b{=d4vR=a<^{Cf2K`?|{A7K$J4>jq1mahbUP(4Y0D9bY3eUxp^;
z<<@bhNW}bfShsuf<ULEgCYtBY-LKP?U2U<XOpNF0@1va$CvWg_4RaFO%XnI+>y5wU
z+hdtWPwNV53mtnljc5JmO}YV$-*;rjcB$&_p8MU{`rVg1vlo;$p4nm2;uU8<!F>zM
zjICSZH_q9X5PU$awa8xcr0d@kOV}dA3j+4+l&nl*2}!zk^+8a7kIjzDfvFuA_vJP|
z@VYEjcOl3qD(88e_O$J)n_lE^YPwW)_mb(EyXWi+mVT^q`0V#}{Q=GoT$8!>-wY^l
zO_Djf`d9F3lZ|Fp{CBRpZAqQDRzqJrMbjnI&2;^YjIT^7*V7ozeGe$;oD{*mZ0S@s
z^|kq{6qapQ%XSh!5EgQ8!kZh~e=hUgjg;zr;#9QvZN#Qug%iKTYL|06YOIymaxz>%
zz)W;1e|ns+_1ZwoQp3MTB7EPO=Ik&}E8hQQ$~)_&3-e2tm*zb=pXmJPko(E=%iqj=
zEz@-BWzU?fTMy#1QyT15G@ftK-?j7dJ;`rYlcrwRE867Da%WMoX7ShWF{!*qS~jIT
zt^J^*bYO?4#e*IV##{FdcCc>=e_h&@6LE9REunwYauRk6MyA{TQxPywIqMu`VW8Ep
zU-Jj2`Npk9#@=d^`~1FrXgRf?|KE$I!>6mH+Y;2TzBv5uP2Kz2=PTkE{iWySbDS-{
z#!!ANac_xT&+^1AY764L!g`W!l}4Vn?7c4faD#bQf?98$L!p~6b8ls$nBp^~#WT;h
ze~uTOoUdd4I-}fq>OBLk&u3Mq?{?O`yFMgUBlW@c<kouzY0h&RJ~z7ay!*VbUQ5OB
zZBKqA?>vUUlH~^$U)k{Ow$;rf{w=G2#}sls3Ts}NZNV3q#X3`0_E6ES1*gQ9bT{r^
z93^tFCZL=7ZtU{Lf+~+m6K3^$PH<%I5H84H-r#1mVTwE3zvbqVw_<)JJX^Op?!c>O
zYRYSb_Z|)l_sMrD^j-RF%bT{z>57+c%9U8<>rB*9*rmIYr}XO0$<57v?+R3B><mu+
zxL?;N;p2o&3r@IeOt(ACdTX;KbA9AA`RN=AzrLr$n&&Sy+G(ZMBKD6jxF(Y6470z4
zcI)kzXHo(J_D|*7klO5gz~@A+ihi}3`-uxN!PlQH`x`bd>Pe*2KK4r6b*91Efzuvo
z2H!sQQg4&=l!fp2yvvv#a@m>x+10lxT?@a=y`18!{p~pSU*Q9~)4C?x?hMY`>@1Y3
zXSw(7>Lq&?ece8FgNUUs>n^$cV3!z4lL|AAcX4e^+C1z<6K<`2ag0shTG&U%u~BJC
z+SMEJ3sQbOIIwosqj!ZLBU-1OTfS}E#<DY#hum2o<cjR_tt<}sBNuA3O=p)i%ZGRV
zywy$XtrPZS*0?!aEPg6{_t-`~xpNnsf~4Mv>1`Ki58tBu^~k0P63p%S3u2tpU+w?+
zt9*jmyz=`TNiu=Ql5SZ`9l21b@k=axr*PyOz2q>Sg$YykB)#}#nr6LpudLSg=sDt>
z4lT9!KXp(%Y=Osa{e!Jb?p0O==G17(Y)-u-9i^qP#eBz4P2cN+C+FQ;Ubx`14u^e2
z>Rp4oX36K1&g)c9+LC#r<-*~#j;Gu8rak7eT76(^Mer=Sh3j(^4cL}TtJVhJkYm4g
zXJw3VT8+YrPaCFQ-+X?f`iyOn)1ssuGn7l8bxqwkVd>i*KR+KwDbZiavQs`BKXtET
zo1V|=k7vwfl()QW=Q*}zXXO>ET}QKelCr`A#D#P}sO&km@5MBZ<oDY$?gX@6l{2yl
zUK3O6f9`+Ux)Y999IqY@Te+3nX#V-;ACqSkOr5#cQSzeY`$cyJa#ESnwbQf~@s%n*
z&x!s%VdEjG^*0$=b|iMV*_=7Fxp1ds!oeF{0h`V*l)n|adA)brcLwzhllNcTl)5h1
z=<fHfoPwADr(63sNNP;{zR^``xz_wWlUC;LcmK*&xO}F|o(VxGc<#9GjEjxB8GBX4
zYWsmgAHAvl$^0y_sr`OeTvu_=dGKRe>t)p~ZEs(h?0%LwSNfH3=;oQ1k3G9Aah2`V
zmo@C|yOqu=OP!IsX|#IE-CY}m*Vg(ROnRoqx@tk*nT1-HPjbA__&aTN^sax-4$rqA
zch&Bw^6v7RxNrXd^c{v*Urb!1naMZvipq99C%?nO?W)VV*Cemru<)wk9Ld=|_KnjE
zc(y67481b<;?~K&^N!uy`0@6K$M2VK4BK?%n9TLM!r9rYR$XR(kR1?Z)WY{=GxrVI
z&euT>R^qPjos|2zPfs@Z_tp4xbniv|#K3<`FWT2gvdsL{Z<uoG@d6`(!=K7mUR<ei
ziNEF8%$?76?|$HVSm5cB6&ZT2&#cv6KDlIT;3xL^zFPMCGiRqiTK(k1DlV3Em20=<
zHoocg<rWXRW0KRW)>L)*{kFT2#x)ULkCHcu-YRv7PL=+U@F?(gAhSnx!ovM`53ind
z@RsfsR)tkc-rt>m&hx679LSLPGwbM*%18Gv+!81|KV8Wt`N$k4HNRauCJLA{v7Ke<
z)O~jDb&h*weC*zJ(K*e!j8p82j!xfW(qH{M`D5P&1A&(Cfbgd=>Fb`}&hPj(`&e-5
zzZVC8Z}?*NvnO-L(f8XPTeS7fF%?oc^|_CARqWdcgVs5@x|d}ycV!0a+*)3oRP%lE
zo`nCo1~0xxEXsGVb1y4=zWLJz{X5*Uk#D@5?|W5Eso#8eQq+~_@8j!U>Fim3;lZQn
zZ>?(I3N+O+t8cy^lCrma4U62XTl2JXw(7syS1|8}+~=(9bss01Z3?Vm>yvZY)MeHk
z$MeSFvvB;vqs~IYyidYkN1V(4wbCws*5!)H!dKKL1#Y(c__U*Qj&Q!aLrvB)-DPrf
z7^XP9S)rcR-C1bxN>j5SD@b7Rl`kSwM42Vs86Upun;`zA{7(pn&%8-`N~_zR&e_Ek
z>|3xwYyO1`Vfja<hzZQ_^$C5s@`0254<Wt$>Z9{3AGsb}m3*?=aB05bx9pZ5M{hn}
zwpr(4-<z9OXT^NFo(l^U-u={LcJ|1c&WEQ}N;c)C3rt%3{YQx6{}p?3ow<T9AL;A+
z-1k{{y`r3c`PJ17&PyM-w(WKP6Q#X2<pOhxPV@VKyE-e(!>Y=f<6k{3m?<pIxs&;_
zkBHr@CEu9MzI?f0Q6+9EZ8ZC9?+M!)GY3_n^GEJxe&o^$Of0nNS@(EbuGh7rCeL+}
z(r*`je<EM;)3N#A2~XZ{UkV%8-m-oFVy0kr<F~!_!-eU$)Aj6p_X`Sbm@v~x{n~7u
zKivCQ8RcI4P&lh~<}HJ_c8mwEYd?6(6vq@(@{KvWcLDp_)|x_=)R<a}T%THZ0rS)R
z%ie8%{*dQTUvs61dw_o5g6yIn50||Cw0MPl>Ds!(2W5Od+05A&TW3(p?EWp#UtvnK
zLYL}3_i5`@=dDhD6Dzw=n0o=A`nzlL?^cVo$SUr=U0}f8{Dg0L{&abty;glyr50a5
ziU<8V(^@J2Fn3Lvhx)GzrVk_?%=>0`|4uvNCGECs_K~{HXRCLZpHd9C_t?Yb2lv#A
z?pxlkoU=wjo9n_6o!4Fq^uJ6@+xuw?bC6o$y^NdBZp_e)nfN5o`^E>|S)9%1zP~f8
zyi@st&oEZ{fxG#1o;vSsuV3%|S6=>@DK~tk&8i8>E#);cW&Zw`OUzZT`cwFLUs%W{
z+mfCS7t`Axm*>u?y45kscfy;-_v<z7blCfP*T)63dmNLUoANk4!&Z6sTTYqmyp$=^
zru&D#TUfHl-LUie?`syhZR}rGT|WCIvc^&2Z9M~OFQ!%RfAbDO1_qM|1_ou^y%_NR
zjoie{JiUU-r!m#}w|7kYZ$H0j`%h=12U)k1s>;nA#Ae@KX6?9~|4v$3*+Wy7s71+l
zPb~_cG+D~k{z6^v-;`=Tc_q!DZIdeEA{J-lOtev{e}1s|g!9}<{_^qvk6)JW?g{0s
zu9~`emF_gw)#pzfZA;Vs_Qmznn<rEDJenOFduL75r$;wGi~GmhRDYZkvtFX|xK!N4
zId?Zr%D;AD#+IISbJ_m?wr5$LJbU_+RaudotzX-&Z_%wN-L&TCtR*jtZs%oBTec*^
zInX;J^kdkS3_rgsn|U%`z29^3{;j*qR^)Nyp7`3iWSYvXQ&R2WV%`5f&&iEoEk4V2
z?aOJg+l$WFI;rlTd59rv+U03we=~mVx@Fz4X2p%wqU;W(s`~^lUnsTfn4f>sZ+d=K
zUGU|tD+^A)+I8Zl`_CFLz5QF(tjky__o9q7Au>OU?Y}w$lXqk6&GaKqg1c(|7ytS;
zedUke?>_x%=U=~j{(L?AxIcd%{W^UAsBqZbWs>U`+@E&+W$eXumrS$6ZTL&JF5tZ^
zd!*@a__7a&AIa-vFMq<j_{6#IZ`S?(H_LHq&o-U;^CtY2pW`zxuVV70U(03+1%2fH
z@oCwT+|yb!9*E4VdD5%1_Q!4OkGV28&u=mk>|M7?b-qwG)AV>FwI7ddre2<<VPaOg
zQSa8HX{9p427k`HVw0-N%9dETN-E{_@9x*D=j*e6cwc#R-9o;OACqF#umAt~(Wv(8
z;is#&hrj>-*XNA;g^5b@j3zX%+L-$CIFp<EX-!9^pRbj&{e4!eocvK0JjFmS_W#tX
zgm9?`YbCnby#MT2>bHB}oA|oKo7<LlPpVBSbv(UjB3It52-}x#Vke58M0(C{+jBE)
zW?1v}sPOVa^V279dLDn<rKEq(D%L+n^~zPLEowI<7wCvin6{bq`O`b^zA2qwueBm#
z+WbwsZfwb~=PbWjqi2@6(Wm&@mP*ELLYk#ZTU91*`|^xu*V^4pd+sg$x-IDH+PeGQ
znmk|25}Mxqh;P<hmsh>SM0Mqr^r)P)z{9sPyp$3cl6vA_y4B2{y>k;UYw+1@%juJa
zZ%!5XS-xcjTTa6(({yixcdnsZGNsJd#P}_(wN;+@WA-23|LuLcHyez)V^Vte-^`1U
z^%rt3+|BU1^Y7f-*Dl!1i}<WDz4OK7Ioi_iMQ$Fd%;SH4#3v;(r1I8>+_@XK2nq>V
zySe*qSd^`HV3v@{Ta6<7P=!L{k1HNOk`8cbbxSHazWH16^>qvFl#a@GFLQ1B%vt$s
zy^2)8z7q-IR=RT)W#tabD9k+D>(R7TOG@#1=&__ZPp2GVKk1_r_UQN;Ax?qanvuJ5
zBlh&zH8m{Un<BfiKI&8MRN<{bLV7MeTjqG^35Z<WnjjlLY5j?Y{EG*_GT2?*{N(BB
zCz2=TPheCw4-Wd|<4~dJwJA5YxqNb%O}cRVh6AP(vy>+o99@$$!}_s6UZ2Ak0jcIo
zLbGJ~1$$4~+w+N@Twm<JRcN78SHGqXQ>xA3_|LWrxS}QthffmTDDlj&Zo5FfQ>|Xc
zH_2CO=4*U=eU|pF)hyHuw~8nc+mrbG`qybUOLRq?VrN`h$19Tanrl`R8_TPdHJMXB
z3cNeZ$h~OmH{sv!b=Nemxg66!{qQx{8#l5S9Etk-;_9}{pHa4-J${z1OJM!?DEy7)
zj_5?a+{vk{b-eQ!1eUc<2;RLY^7jqdDf<^L@VvWObv-95x9-N9i{neW7O;ezdKJqp
zS;{(Ls@zKFDy{aeBI8y2m!v&V`Vf-9>*w<3q{y1bu4lD-Rtar=;js7Q!Ny~cci0_y
zx^L>f<9DX`ovWCfld;?D-@$|S3!L6NI2KHrtocy*prf9J#;G6M?&jQ9n|DT6_qzOq
z?$C=9RGG86tXTW5_N{SPSZ={sps?7~g+X@*o2jyPoqCVnt%Io_RUKBlMoBzyn9p+e
zvCsmxF4Nts4=#6CkFCnT)weEV>hupbl2Q_XgiE*tZ%;VN_bVaA^P<%H4DGtiS!*3E
z9XyXM=536SdiArm(njvl-1Am{F1UQt`8&U4BlG!E&+Vz!M?&hK8Z9|?fnz&=2iH-F
zRNssHzGp`prT>=wP|+j)aALIEdWNVcAB1<x*a;RnELm7$>YUKYz5KVurw+Gm+nJs2
zZf<WB-Tu6=<@$ue*K48@bV5`E{y#f*o~_Gc#)g(>m8+6PZr+ee|D&K@n#AESrDN~B
z_ljQvPCqHvu9|ye^EAQNf1lmSWjzw8zlqr_agCX(*R}IUy;$~WJMf?1I^TqI(xyWW
z3d#>JeEfGr>EreEW|fcw6$v8eCqHj%VmjP?TuAcw(Ljby&*uw%v}P%5JXp$dc+zX#
zh$}Y@ndQC<bH&%iO3prC%{)nn&2iQKXaUZ4_L(+MUUHQ3?P^p!=J7rM+nrB+S2r!u
zWL3Ik+cNL$@^2NtLMG4q;;dh^$=F~2+23UfPs2*1zwKS+wQB9FsB>>)*=5(NzYDQq
z_xd-d$GkG&M%tdJzAcsfTMB;bOu4sGX7QrG7k63R(ze|-NiI^=ef5;BFMnjje){n@
zAysOD$r@j`ifUhZy}gzRf7~a=JT5%ytn6a{eE0jpNGatvWx?SW)=v7b@5E=fPUwnZ
z-MWui)dia0%Xt4eF?uMR)oq(}_D1i<_y3++<Y}Er=jZ)2y;#V#e~zZxq$3w(_I~~T
zw=k_jfAf=7C!KwR8cs<Rr<h6`xZXW@>+duj-kzJwH;CNSzp_hb`|de&UwX_pbv2lu
zIG2%k%e7W3?%Y$Y<^gLiw;VkXHZPX@sJQm8q*agCTfJ^iIroo!ivPqT69uL{ESGq&
z?#=e&+h70k=URVDd7DG1e;?1%c~>vUndbTS%<L>*wQhQn>I>87S(0@>!xNt>ZCF@z
z(rZeg_u5q-S+?t^eDpmjzU9r-MdIf&=E=lec*`hZvUd4?!9~os{!8R6ozUNS?Fx^=
zYmq+oYp?E3y7cbhdxq74zdo*ric5Cj(~aSOB$$=gz&YjL#Bf=|efO`L@qJd;__p|_
zut@a&5Bz&l{t8w;md-pnJJ2zF!PbYp@jucx-mtTq_u?M=yai9HQtO3wzh0lFed|GC
zMOApRN`Q7l+_&jldct;CPG4tngs*$iqSD5h`HQEotutpk6?gJ+<B`};29q)i#Ecjp
zHcCk>$!M$)m|?(pdNn`a&+n|BDTZ%Www1J1A8d}Q|L=Bm*|r98-&t2>4y6aO#0jna
zWcXI=SW)znW81e#J)EeQce3QHoMhCF$r~l!i2a#0$F`@SLOn=2_}Vh7=_ZprMaxP{
zpNXxzle$}O+paR_(+{Hh4@;a}Yj;L^<AsZsQ-x-Er0<LBE^XT=w&r`*_a)W)o?Phn
z*|_DLMvB<7QkRKS56qgdd%@--zQ5j{QOe}l@>TDJCC4FSL#yDKokvnWO?#{Nde-&5
zZCe<MWxbO7re8G8Nbi#rG&wA*xyW60lYv*%-JF-a%KrP(K84h1UDh<yIb6-KbH&%I
zQu`m|pM2jSDVZD5wf50T^F`f@k7u9WrgdxXYV}7KH=4HO--?csD-yOYbNafhRi244
zV@Imy1EKPte+rkdy_3E8y6-^blhBrr2|2b#w|jkCo}H5CV@S|CI{CPA&fBS02D6{<
zUuJsCc<bIYkNGTR+sz%6GD3ACFI$CWng~?Ch}^()eOJ4sRmrB*w--0{zFd&LsI5kD
zUD4BE>%Bp94@De|lDM|;*rN%`_v%kQod4Ya-N}}M_iX<Xelk8-9((F*t-Jkx_VW|W
zgMEU+cs3<FYe#cyz44b@(#>|*X#rEH@Q<UXb594=n3-u7<fN^i|5~n3`%aF|nO%=^
z#rJK}Phg!D!D~IC$SlwDQcvj3lb?2UohnJ2XgR&O!+1mT#f5z)U)&$v+pR6?J+ET&
z6}Pux_bwis9i#O6P0g~j#JLB)7;CZqx6!oc=5Y(V<ZLumwbQxzmF$fhrXP<S7p(7%
zy>oIwwk7+f1y->}+s;^N8-Jg)%e^dZ$`1SHnLbA1F9WnLTTD*ocaf6$ofVh#?w=3e
zEW36Qw#56roQIswG9No`_K)4?`~jAn!$SM+ndBrlq#QW5AgjaY<HmgnUzV*nn0i(H
zV9MUsc<#3J<&Q4SDzGyu{46BD`K#NGMA@IgpZe;Ky{ZrlE}DC1<BGH=ZOO#}uS`8^
zPWv#uUU_xKipnQC+L^h@QvP$YntOT|t3IE2;IW<VJUj7fsW@$0ndy7N)hFud{c*|n
zz5F`MQ;Wm1>Hkqb^Ieu#4AiZEF#dmUe0w3Q@w>%d@4XY}uE^9iIdmugR<T!Z`SXAq
z(sOxsY%WS@Q^}PI+rG{5O{tRYdQGL^$zSs}8(;94ow$6Wr?S!ZqY<G&j@z}*EPo=-
z_S!*o>yzT6?>AT-ihUdx)_ju3sm!(d#h%E<h^I@W!;fuGy|-BXNNsG#n|rM7S9z)%
zESuaWFfHd~^yhrYd#X5pk*yb#k$GtJyG1QMZ8v0IPKlh|v{LGi<+(f2#kOflYZMrH
zo`l(N$^O2GyY2{+#G9B0)o0GRDrN8gp783&$7SVb7=Jh0etqj%e&2!Zs<nu&>Xs&}
z6S`bl2Swvz0$vEdky$$H?gcA-!w&YBN4r_OdIVfIB`rAfBtQDgoFk7ErZctuX0@I4
z;^Bk4Y!~KlN;A3N7`MUeJ4^HYNxMTQu01hV;-=S<t^>-!?C&jhn_P`>VbB&0jFnA&
zx~~7CBe%Zhk|x$)&)!`UpJq74C3||%YtEyZYi3+}eZ;p{fS*-Bt4q|}=19~kYr93V
zGbZt_zV3QiWc%OjjQ&Ns|8M->(d@D(IwRm=&WVkdZ?5-r`n9b~znyWS`|>Zlhy&3=
zr&-@Ia`Q2&M=uolk;f79#9))&F7p@$@7L!ao$}p$*5K2L?lZf%%U78w*r-QnJo&2}
z^Wj2zlW11tod>EaimnUZ9c!Qb<3Z{)mg6Gs*E!?PT$}jHb?a<*Dc6_I5z!v(VJGHH
z-PL^H)2rL+>-BzdJX-zoqC?3$qr2>ZCuc9pa<eVs-)fxue6Os4Zr`q^-K|~Boo5wf
zHk5F`Pg<brUUx+6%dN^iZHBB(p~hyPzUqH9S5=v(%KE)!`t}QA`MXNPrZ%M1{CyUu
ze2KH|g6zH&m$)F;$#Y*#3aNTtn4WF$+u)!@WYc>)eZ~b{yUmjQeKz<p+%U}*RW6-B
zInKmtlA-Zo5s@|ji`*15C1fu}iF)6DW4X$2-P6ToHq{f$6!;yd{^?5J`S01iGyR{9
zuk?rTddV=TWTiAm*H^JEt!eeQ3A|l*P4J0wVDJ>?6)PtlUo5sqxrXP<6^`SJrY{OJ
z6>=_J`)Y=O*Qe?Rk*C!Uu4F_dL`B>Ru#)bxTd}$5TaBK7gF*E#35nAO&&w}gxvx#m
z*ZA-BFBL0(g#O{Zp;z~A+uJ@RMUGSlgAX6`rzAYue62_{_~$#8oz;D%38uNS`GWH!
z<&-U6t3KOeB{#Rmo0TVYt$6x7?#)LcQe}<rsQb^Wne>pQ>{!8LuXWQk_B_gokV$^6
z*!e@*;s%RGX-NCIxbJ!W+FlPh&+cON_pg59sry4wO7hEd1Fz4uR@pYYKHYd)Bl$Pv
zp`WL#mBSIncRLQ>HvSZP{`u_EzUsi+`uB@`R?ZK7viZoVJx%%crJb&hdNX@&{A~|A
znAh^;BX3+;{<*DN?tZq>a@aAw`+-QGMdz#T|8b#jyZ1k9zqsO`--gKtH~ah71_g)z
zpCoTrvrF!1ne|1zD+~8C+n+fa@VK@|=9DGp#hvk=I{gnm-P8a2@r?J&R{S|O=l$`N
z$&T`#%U-rx{`srO$8UOXzO%`dEF1g7BENRFe}DYk;QgH#c9rY)JKuji6QX%c->P<6
z>nFw|PYpiu?NH>)T(Z`0QS<u_pBuWzHgB|iRoz&^9`T;XDbDQZoMkKTBpJ3poSw#E
ze|gt|&6m=OCTtb^dM`EbV}ZQz+~2bow_n+R@@3td?~E_Dzi;jPv_L_D|25nDv!~5V
z)wXZZDXO_1$1`<qEbj_2t7nt-eut_`#l4W8_kh*Lu)?M>RCZSVX1;A#cH2qrTbTXf
z?tBZjWVI*8kJBFQX1?0ZsQmiF9edqZzpRdY|Io&K&f$K@8xLE9<nU$YE3R*>QoOgY
z+k98-|98Drbt(F>`%TOWnzplce0*xXA+LO|wROU;+RY39I;GYxT9H3-*ABOL>`QN2
z`4{SYeivB1fAVDX6FM{!VrQ+FXJD|XV_;CnJ@8XfS&$l^oRONGotc-eS5Udv_IBBA
zi%IW)arJ$2&|F-Qn?C8~H_Lf>N5h1CWvsJLd#2mi@u(g&yDhR(QS)TfcKeL_<o!9T
zxfnPb7U=CPnLkrSjdQ`OfbUud{O5e;ci(So&F8Lj?#AYSGmchP$ZjgR|I)AdqHguJ
z=Wk8sS+t)lnb~H(edp);|F7S?ee>3?**?zVuSL4x9-rl&Qcn_v%%#qzeb((>rgL`A
zYn9SXHoWdTC+jai)A-V@JhA5SLG#{YrL%lw?(d)Xbn}#-`-J@xCf(tDWN|Wc-5N!?
zR!i^CDxI79CLj18tQLP@jlo>ulyeSeo>vyl3pAS9CfJ}D&y${LGA%#4eY1|gTC>95
z#LDB9t?!TU^B(^;|5vTO+~(hXmv^7PoG@kc$Cn?<%}z0HGS^9SU^lblGoG<kzJJlp
z8M3XJVaBgltL(SsYtNj}#&c}`eKt+LW9;5P1Ya6x)%{7I@Muwv$?4|ABOhw5q!qs&
zdwx<!cH<h|Lf>UB4xMi`|NiJZs3I=u9lx2u{p0eY6El1zABgrd2wA@Ku!}CsSbf=|
z<5YT4N=N=O&1U;{$72c01dE&}iGAJ^&2abE$I?rTah;zPSd4fZls`<IlX_^AO5dTx
zjn3<xj|l#+ncwp;{(Ylt;)92|OlNKt<~5(0&-Qce{EeB%I~yK6G;QeoBX<9U{M(TB
z|5YDtd?r^gz4<5D(f>tfrMd6q*(NhY9vpTPekK3oGusK~^uqKr>keDE7zu5j9y8DK
zXD-8;IY!U9mlq4f@~zuv;x}oA;;Y~14jkUE|MB3|Vu$4DAI`fka;*RO_Bp@p{|~wE
zKg9lja@H=<=|kbN?~)9n>96$U7tdh{T>R%sLe;tDJF=G5CBK>fXV$g(>??n*JQ%*W
zLy@)7+Oki+Ib+%R+;>_R_VTkV<`)#;Tl2q4%=MY}f|Cb!cO>5OzMWV4K)36r>YE>-
zADch%$ju5CsxFaHvef<a@Ex1PC#yY{hkA9U>ux_IeP)@U_P=ExYh2HNUiU-C=@)}Z
z!sj(JTo{f7E@+&ywDf9npiZ0A%8s4BUp1t77G#+;7|%6edw3#|e{n(2ryEie-=v(V
ze%=$j@~zEp_CFO8E`pQ3Zc<2hWLl*9-2TGt_7ivK?ED;^Qa0z}PR{2#Wnv3D8n^fr
z`M&?*+|cm4dQO8g>y51*Uf(88VPeYN``4+!QRGE1`x+*mQWdUQDa`NB1qmE{#?tYU
zXJ*TzgKsU?eXkZeww7l{f3GU*t+&Vd&i-(iY;PugEaZfeOv=ZG1!5&%7c1<W$!hMS
zn7d{Dr(|0{hpzq_f#N47=VYVxCYA8KdX(1Y^X}tPdlt<X|06|~T%7df^j96ZLdKp$
z))#aRR=n}HzMfV8vf-o5=jHyjDXtZ2;!mIOuV3G2D$k_vC1%l*#yer%#l`LUkzBLp
zZsmIXk}+Q7MN^wdbkqEIvrTrFrGJc_qw|Q#@WGb$wBwndbPqVbb>AMSXsn(kk#4!p
zj4^k;fLQ&V?OvA!Vw(64@bT=I+&fWo|BBN!D;NKHV8)_4oiWpaFW>Q^`eQ>L_PyNP
z&-C`4aC2;7ljM{*{KF(d>9lS6vn4DOm+g=fs5qp!Glwzcocy`h3a27=Kkkrc{P#%l
z4e#INr{3#|#TZ17YcLmc-|ma%7huxcQR#5q;{1t!3bU8LvEM8p!coh5g)dF;ME)W5
zFD7!0caI9Xl&ucw=x2M`qd4gre=KX8-~{%Z142)Qa-ON2xsb)_%sWeao^RWMOc&3l
z<5Rs|be6r%xBg!+FZ}uphNJn-mc>jg;w=An9^T=2DrR5rju^I*!=8HO>q7n<>XBfa
zId|V9mFGTJ^TNe<v#IOpd%pJY71ppwWzu97-kDNrd8KC7Eaw#h$yNNjYajf{xmu)q
zebXYA_PfoI3{n4ix{MTrCuXgAv84O=7s-F?A4knyoPB+#<K76TPcOE0>j%cRSloZ=
zcf9gmVO-ox1tuwz7e;#~as576+ZJU}D*s)ZTdd3Z=n95Al^p+f{f=00t>&7`A+yWN
z0`3+qb-&JZKkxX@=;J?sAN!!YPr9bN_rdMg7W!sv@8tfU_|X6PJ)>I26Q2JT`I9b~
zz7KbZVfZ>(bcM`+i5U)&3_%Zm-fU1kZqHU0QRfs9k{~j-;K7@TcE(3$w$zH(%n-})
zfB11`&{~F<Tz@0GwyoO0q?i!oJ2UDO+ttreE54bvp9**?&AfGDDQnAfiJ<A%LJKRx
zrK0jOQv<@PT5FtwjNP9fkGaZWUeJ5g)%c66-;bpqM8an({w!U6c7N@mx27&FegaE%
zB$THf_$uPZGGp(<Ne-HOxcVn^`zY!#9ouDjdd3W|h~vwi`%Js6YQ<RD^x&}l<3Iyf
zbxFh7jjQK9y4M%@w{62xXEUx-nRz?-`yD@Mc(rZt7I~O@&W2~s?UYFm*iY&RTU0(c
z;Jia3wR3aAxnPkA%afK(bc)VvZJAoU<nXla0|Is)k<%{kIGLCEorhUvUXd`%WJX!8
z!+nnv6S9-~CVms#v0yEaQm@&>x&u$&{R@pwKA5yxZNY^3kKVjJ)afRErQOpof_>$T
zb49cHWB<e$+&1K6Q9Mw%L-f#OfpyYvqp~@!xcn20Ty6G-eV3BJ>w{v9pLvCUBuoqZ
z#&PHB$pV=KsZJ*;O_|o+Yk#^kZ9E<Dd7<Y@VLqcDlk{{xZ;s|@sGTAFHGy01{p@vF
zdw+B7W?-JcEhxQcM~I&0=XHuX^H_eq*fw?7bnEkV`+jA=zAyLR{deN>&EGk0Nw$UG
zoq28R?S4*&iN#DwLDNnOCRm+iulUOm6i_OB=eyCVU3!1J?(aE&Z+}ZT*Ci(Xpkq7!
zpZsfm{-@7^|J`zGOric3;-S5!(;N3m?N=-8dv|x=;+N{mf(0UdpNs<HePddWK7Fz*
zTWx-GM9iuB__Z?jYz$L4xqK4XehTh&(cD!3?Zb+lJjGo#s-JGPJ$bq5mB5|EW&A&%
z9hg~t(}e5uv}%Su8*X2-OZ~2Fc2?G_|H~y4&+r{$LRQZc|4k365We&C86$s-;$?-Y
zr^F8NUP$#5yLV*XIS1Bh(;1euFS5?vYWSaZ^9gxrq4&G_-1ka6X|<f~5D{HC=lz?o
zDZa~oZjyL+<e<y;+m3s3dTl-gEMt75ApTTvT}8V2>FaqKN74$p7hEt9b%;7xxr15g
z>d~F5@zcY8ME{7Y|Fzs`n}gruOm6Y@4<7JJlqR<cUJ$v@yw`tM^S|Ts{=XBhiF>jj
z`pZ^n_DYNNbszFl%D8<0Gxi^pZgQ*X=WChR@%^jImhZ0?)z`S>oLIZ)-?z6fe=_LY
zEByZCtm}7QUJawzM^Tp^uk9#m*m7_|_~cf9n_7iU943t?%H$I~?g?&r@NwU#6&Dt<
zPx~^pb4}hH#>Rgqe=ex5d9&Z%)=A}?x6HMw9<i3t{tHjDuPffW^gR3eA|3PhpH?-k
zx7{3a@a8+Ea;b)Yk?;5G|4QGxnCq2HI$zw<ElEdX^Lh{L4mIAkHaYYW=ec(;FTS+X
z$oFFWU1ay4Pn@YH?V?2QW(S5Zh88y*JJlBzU$K9`&+6S=$rlP5Rwv$BoC%l_q^Z8E
zXG`nq!;f|*Ej=msCV$$V^3<sZO+)5<TXg1Dw6>Lm_|FxyCnSF74DdO?eDYPU{Xt(T
zcBf0%YMOmaYWFw=b{b5G3;LC|{a8yw_SYLz^kVmUr0}_`@R>Su1;&3~@N$;cb|3%O
zt7a`T`1(htAuQmizsZW{tEw|wEA{S(zD`=Acq*~gT*oCuC&IH-;$vZkQ|_d-H(A$D
zS{|7?&ENBoD5K#rJ|~0yzPU<sSrTuvq_J|EsWvA{&$pPbu*WA!{E@)1R)g7Xf)>6H
z6wBw_7yMM{^lx*R^z|1U|ISBPIBamc`cv@2>p$_0aX%~*OS6xCF8do6@y+Qr|CG=v
zlegRuD5#Osu5Q}NsT}lpx5>QlZ6{UUR>URhGizGEP+ivW@Vle)M#nd7+)ScttX5w%
zQgFSZwJn$R`+o<6&d`kohfh~=irI)M?l9t3i}`aSO21r4%kGhshFM6hkg(p2ZpVAF
z9NMB>j=Pp|9tio`>B--{>C^la=T}$%2tV)nxP;-9YQ)w{-4CuRgec7T&lp@K?&gqw
z%D7?ibfvcqcheRmyFG~P(sX;^wZh`IPOAI#__LcPo%*CX>(kGFCtW-<*YzAKnW$!|
zULD%8FpA|zQT>KLi$Zoa>CE<x2%A=VbcU#;>811?2TXjI>GV#k64hk5)NoEULHAqG
zGQ|&@&AtT}By`%OMqF9e()jI6e9O<Z_K81pjoQ95997woZ1b{M+Gjb#G2!L?tELv3
zZsu?ZIuWjA)E6S4StFx*-&n}Cpg$vi|GEUf?CVaor#ml1f7m!9J-#d_W|!n*mtQ7J
zpGo~uf6(;bsk~=@tnvB}QVMOy&o&2oK1;0Tu~E0%=s7_*VoQ}k((at%Efeyir;E8g
zE&IRfZeZcNDGl4U7ie8$N{HSc>o#wf{-;ufo6Ygs9!W=TxmG-5VF@U=4)e`DvdbXu
z<3aC>kw+J0|8P9Bx9zWER<*i(_M?TNucB6Egeu>Dq!JO|=JD-iMUBO^<w}3F7#A!n
z)h?XhrrBEUzL$Uf@8ee;!rympWUx)U{MulWq3-tgsmbB21`~sK+%LbQY!|dv+g*U)
z`p1MxUOSjqoJ~J$*ix-5v9Bbs?5f?4YkOy%f8O!MukT#A`<txKk9R#&skS*^&Az#G
z;U6>ZT)7v`3;HzHv_E+HV4;!Vg|h3_58v+SpF2s(F7Lh6CK1`_)dk-Q>#r%D`@QeP
z%6lx@44*%I`TP5wr|JEG)&l88WoN>Ug>v*wI;qleT>5GHK4yWpzy3^9oxOEh!=a5V
z3;hloYTKL%a$a^Y>2k^Hy=N~@YFzvCLRxy_PpipH>n&~_WZLGMopChr4wK5}7?CsA
z^wy^*MH=jKo!s$bdgTqi))QjdUGt|uG>ZTFsqfSJRa+nEOZ8sv-@AG9zrgeMe+^#D
zpBLi#Ci+G0<DlYp)2q9cX5ZSj_vx`E8YQO^y5>yWHgRHg#hMv2y(EGSO~3xhxSYzt
zw{rbnr&`W!YFXNiEcFv|Z!~MPHAi<=pDVK5lkxtrP1w)C+doe?e$oiGFgv`U;rv2#
z&W#+EK251=IzOUi_9#7){rL9e9CopflY*zT3%s(Zv~c`=-g}ShiK7+UrC$n|efz>8
zGyPN3#~nu(ZQ3Og<>+E~^v&GYx4gZUn>5_c<T2RrlFM{j(DO%pOLY8lj3pn;3Ea^)
zS59E_^iZ|ps<Us}ORs7f+NU1b5;|eii{t}54s)clYE8ll>fg?<*&(qb<mS4W_JPm!
z&DNZBH?!uj&yw!h(Gh9;TtmkCbjmXyiDhQ>e+%xsoj<4K{`b14XM^|edo}O-i|6q<
zdv)IH_p#Uh|B}RT`F3vd-1K9LvB_ul?LD<=5mzFY?#a!fqDK;Cxj0_^3i5xM5LSBZ
z>EF=VF};ocx3?}dPcgh79sNJ_c-kv1x7X$Czb-$xW2bccmZwuUJAOag*1Gws>1LZ9
zH+Q6LTPj@p;9Z4&`GIR!uGls9>P>Hx-)wTb!((gG<|)PJGdFZGXftWaCN_o$KGOWW
z&(7A)?(dWN^>y`k>?_OTHZ!QNX<c`n^JMk5IWCDc(_f}qDlZWUx%G9P@I(=Xo?Yu$
z_HD~qW^gR<{+h!#C7hRaRdD~v5^H4m$iAV&G-v9=SJSgwUUM6<pW`}pH+1%q_ul^|
z6gid_|G%34f5rD*+*!4sYl~k7Otz2t#pII0@0VtJO|SA-{)x-4R^5H<fA@TJF;~1<
zhuA?Q?dc{FEQg#r&IJZuI90E|WM$36=HHW8%^9RxBAjo?9(U>ZH1AcBU7k*m(dkHo
zZ!vQ_WMt)UuKcd+@i8<jQ2XW2^2vX5ZT58L2rrLH{r%ww(;|);+siF1Y+rvrcb&7N
z=*A{Ls~61i%lr?0E!=JS@mSUTJtZIC96vtq)W>sE1z$+4Ua;CZNq6s$0G~IB%`160
z-{1Nzpu6gCWOC%Jnj<XSott?W5<R_rUTmxsIvctAgO=gZ(g#u^!ISQJ@q~JZO`KG7
zUwV(N?W&BFd3#D)C#!$=PPym(d3!j=n!o#lxWoLe+g@4zQT{g5j?een-$jaB>|%<a
zC~xK%BJ|U!_Nukzo9j#0pZdI0`%>7S8SAyJy;h}HSMJoF&FdaGAyuMlMS7#*mneg{
z=##>RCryrC_EMA;Ot|6ug2Q(DTCq)6+k4E#b}GN|-DUCa=Yibk*RD8+re87B=-tSf
zA!c}U>+YG$ZtSq<Jn;46?FX5qemXotv0G2uCtv((9CF?v`IGNK?$kqTOSfFUrMvFd
zh9vQmho9uiy}PTjL)Q1}=Vk2NiD%b#_w{dD|A*tV?hNI&T%liT|D1SVeK1?LVkY0w
z-X<RYU5xrIfk$4SvD8;zb=<+#<=pN2|1UYHpZ$MDeoyS=DfgbG{E4c+XJM6p|4Wkl
zwPzdaRdQt0qo1wk{plk%xmO`-f6Jz*nWBNOIa(bbU%sm*XzYC>@@d1fZ7u;@!)hOK
zJ?!qPlTgkKPGVi>ot<0RShMDY^78xg`Ue?WBmT$E`fKXC?s4Os(<|Qow2RWdUoZ0h
zhhme@`^DmaU7CL0t@0546)kR7zHyewL!qzVt^{p}(hQ2uy{I+OaoUZrw0*Pe_j#%5
z%vl}Md|*!9xAXq`=lIOmapqQc-S^wqGynO0rS%){u9A*c?)>9k;CJrcg3I5&cIVY6
zGBSL~3fRneb+_m>;Z3T}oxivm8b2IsX?p+rhE?=a;l<YXnNlv!jQbILW2InP($xv&
zHDWx!;!|@O{QoaBo7w0U=C~xy>G1=}uOD<)a7Wa5rK)|nEcAZ1xALBr&ea!0)gJoJ
zS#n0e?DRod<M}C;%z?V=7`EEa`FgH8UB3EXd*0Fb4JO*n_vdabIj3Qm=f8Kwx_`y<
zL?ynQGyGopZvLEKC%9X6wbPEJ>T%j#jo<Go_4~SG#Pp{xXE<*tn3y0nS$z7F>*vc?
z&DWds<(!nv^us%H*LC~pSW4|#mM}y0qE7mhALXg<mv<Q0y!m==i(Hdd!ex__lLLi1
zHI7E?=U9ECc1HiHcXiS&(|)X!dAg(0;OPFmqG^EvQ<=mB+-H7%DQf)DQep4oy$2TU
zmpL&%;ohT*ZNW2^B<?dYPji1bO<Y1^Td&xk3cs^^D>{VDbtdb*SBf~r=X7&Nkencs
zu?gFA%QF`bmjAF=@Jb*~FSF`i_~GeV(iSNvV$u@hrU|U9v22d0`RX~T%ssqh>7?S=
zH`ke1rmxs?T6x+Z8PWd#XIUNV+C7h5J3V{BgHX+)vOr_jOFy$ie_fDR;}Enp?*5h8
z7uFfX@IGB<k>)?gdEKg`H!Wsfcsw`GDLDC!&g?_(Piw7CtoX<Ac7?z0!yA6TTkLt;
z6hqC`H`lnOPrPaCQWI&B9{2bS(}~iGYqDQzUX{lN7Ov0TW;AWv3Rz|5h-IEUj4Xa~
zwzF9ln>;l79&}~h&N7YS#YXMx?Dc~ei#sf1DlPc^@qUHj^%KiaM(3JJ?h4z;b66sj
z(c<|M!6Ww{Fa2?R#gA~ex|Kg154H+fxV(I~`rq}*5)&ewqo?X=2P$oC+faPtPycfx
z#-c0Lv8Db~nE&10wW;iW>AaINoF8`FE8Dp6dWQ0WS$29$&MGhU-{AM=@y1<mPaP0f
zfA8mKKR4$=Vg9_6fqdU1O=htLzVyuC@VM(28PH+!vEiQb-3L#mz2*8bVg8~m_s%}C
zDfU{%pvCs%`}>173{A09t2nRrZ`=0F`BCHphS*Cvr`!?+M7Q5cwVEY&K6~3Ly*!a0
z(yyPD?N!{xG;iCw2!C_M#F~#m!EYB`T`2e2Kj?K*->NH?pYB{$S;#$=>7Kg0`p3<u
z%;y#NeK+0__~gUXkC!>WO_*@nW%>QRZU4`|JN}MsPo`_@ixVFYo)!L)v(|3q+IX{r
zpQ{fhu}zcu?PgV>$9eYjq`WPkHpI`X-uyy!S<a+0hRKSjCH_olFSJ;E=7+{~u5~Bw
zFjziyiJB~Q>Tu}d2Zg&{H(avbdQ!F`T=Q%8!ljixY`23BRUDi0ZrT}($4ecaU)<aE
zILzsT3X>H7mI*HwoQOI)b7hdwVV|CS)wkP<8a+EpHpb2L*UEPbw#!LY@7=S_+h+5<
zSD%i&^jj{tto~z-dV$LNCm%x$_sjPceb?Bv=TF_YW!n$Eew1}GX!Xj98Ph(ke)qF5
zQqSeXPyaCYseGv?{@vu=+PbL9^lYHTv%42FrlsY)S-2(mQ*XC*-ZKM<hmto7-K51o
zXldJYJiRILRLSRj%Ql@CpM5v7S06Kc$#w1_%j~O%?raxR4xjun--{(kCTIN`2E`3$
zTGwzgUb}E9;O&xos`k_DK7KzRd6Q*V%=)Ze-)^1xE9ZtUW7FP$X)d3y=9NWh4ZF=Q
z$Gk1fY5aHZ>BX15bIu6<Zo4`;b5d(etCcTf&1Rc@OYR(3lgXB=E-3Zg`7$W{u*T!M
z<z81SKWhgi7+vJ`-qc(?yK3zTvkwyr8(9}?u3BiQ6n1Ay$MNHbW=m`i)~Jk{@#Jcp
zpy!U%&97g7__uozhw+TqSyEPu&KqBNlyLs#u}6%@Io~TEvF5YfW}y4cGN|{9?Y*XM
zi^bhbA6cgesJD5pTAXv!Ip^=!jry1V7hJ2p`#;zDe_T?2acidFg)#@9v(@^Omv6Z|
z)y_?J$FDHMEVj!(pT`yPtIl{=>Hay(SuJPAp4HF3E97>pn|_w(R`B5;rALCVZhvxq
zi^!Ic=Tpr@?mm_I{U<K@%Hx?K=Z@J$%D=j-QFAsw=Tb(l(VmE9Qs2XS4odiZDJa`~
zZO^AeU#+?mR&R)&Hs@%?DZACXSih~w$c#Nvudj90o8!xJZC&4)lh#Es-JBc$;s^6Z
zw|EU7=65-Qaf>6_ZudWrR1D}pRHK=vVOZtnc1tZX>9Zi~v&))l(x;!+Z+reaBT>-n
zGOO#eqIb6}cN|%w^fuN!s$4P0x<L5+2En2kF8^eXOuOuGlUeui>NN?5yTn!noLX8S
zc{kuo)r0-{hYjECJhAf$Pp|!dl_uHqN1{!CMlbquxyyHIZkp+oNJq|960eTmdgJp$
z^j%-n&rKWFy*d(dcW$Y{^m0y7{WUL_neJ{?w|b@5xGnc^cWkNjx-;4z#C9CWnW4LR
zj_;|%f1_iYj{Bbq(|_5p{a9$ljeRqI9}Jmu)c=wFhZt9(jrIp_WS;++{!8Mun_@-N
zV-pr<xAT`%4*j2ZG-AiZ^*{Co)-UKT`_KNs)K4sO_tl@@CEnj_w!gi9OZ~%NjO*vG
zob&eR|1N=mdk2qiJS^d=d}ZHfhkUu$wu_n$JytlnaZ~)t)IT}<9jnjYz4=IGf}!ZW
zV|&7T(`T1xFR+O+O8Lojp6%^~#XG`dZYt%?-{AZEM$FC?bqo7G-a5EDVg4-t(_5HK
zHKjyWp4KlYUh)3M9Qh;JXSa42Z`;|r@!72Km%6L3tN*)JXjgv3w)5!I8y;@AS-Vox
zJ)f!_$eeKLY2MLR*LgygYj*x#pKvkJ;Mw%^{wZQP^6%S3u0Lmvw0!cz@u^!3(*oac
zw)bUo_V#`LGtq$I*QfI7*5N07_2c(c{7d5gwIJjn>lKrCU6Ypudr#LgF!LzmoU~Uw
z`oPD?LyU{JwLEgTCltf9VY@BE|63vq-H!z1s$KItUVEBf5uJM5-Ro@Qo5smAyB6)p
zn#MO%(f31Jkn<ky%4X9B_cN9O9?yUIDxJDMH|d4mvWbcXR<GvOzM5Y%|6IV_xZB@a
zXSwamdLa6Kzu(T;hT(V9X1VU3pK{x-CFW?XhO4UJ;q{w%FBY?H*LiHdW19J-lfT1W
zR4ttHZfB;=L(hVWDK8dEb8nj9xZ~Py-bE{l&xC)ido3Hsv!OmM_QtZOoRuv{qrc=V
z7ZwqTkNEp|w&cv(*AagY9P6GwW!lCiS7t{{EHVB4=9E;*<wsRX%km@EWt0`J`FQef
zW`=dg#zVg^E8afvd-KsZ-;XXmHuXTP{nOO5n{VFTyR}YRW1R`-al75quRhN&ij|K!
zdibzLlc-NFw_=&C2=~$AqqmPp?*Fp;MZHE*K3}Z7ZH(5WOBZ%VowS)z$u+Zjg)qlN
z%@rX<z1R2ye_t$~?zO!ytX@dt>WSTN!bDZ~32k`%Z*{5Cs*uCs`is6+{S(+*WcPya
zSNm*+wdLK3N49LsZ{5|F!?epy+_paQ%kG?GK~i(2to))2r`m1#6<58Hb$dqdJNq={
z`(+=eUF9{qlyrIZ%Be09PTLp9y;_hn&6j=A=K_DO4{^K8Yh8oq?Cjap<ZGKHeklK_
z;wv_jlBC?@inlJ5$^->^#GkZ$uX*yTvgC7H**~k2=jgsXb1?Tsa6RwLqZj1;pVgP0
zuj439yr(Pjn#Cq@{-<x!OYT%mZ;slU6M5@+?ys*)A6aCYOnMgd@y(CFQ^eN$o%nog
z4&#&zj;uAhh9NJ)-!r}Z`})WI`GFB@eO>dyQbn2P#j%NXiN|^6mUpS>-8DKnJ9x`J
z5uU5{{0GFJp6t(R@8aR^zMr^Uv~*oY_)-q8$r<n8ugknxRVA63I_t#Y{d=bPD*wr4
zT-SeY>3M6m+VHbqKA-y}wCe=hT`}(oR=>Jbd14i3R?K*^eP7An7ZOu8Xe{VIw<~@A
z_G`sk%Tngfja;tqcAihE|9;nIu@FVs6RisqAN`44`}%s~UaPDX%TI-$R9_rqy5fLZ
zN5bTD6IPimy1I<}%;}A?KYz1}?&LGBn-(fGqvfX3R#Dr^(DfQWKc&rBadoMV_@f8)
ztCiezA1^!BeM9g}tAB^bP31MV5AT0anpgPbVCa(G@}E0Sc`Wdpsl3Kz`L|;t$(D6n
z7OvTU!DrPqy>Hj;q?<PQ>uSzXjJdhw!V=zWvHff(AD;EPcq#P36Y<kqyC<Fh@-EF~
zf8h1y_j}j;TetD|tFI~3?(dIQ5qQ5fUbw0A&7<!P)roA3c1u;utR8)OY5O(2&82ky
z`zSkc%_B0#GuQs-T&^3_XY+kc?$5U_^7r;y+Spd!t#9^PR-a^YCpxH2&C_gWOO{ki
z<}$JSzK>U@{D0+nPFiP*b6@rxi^uQUPE8cPd9wWKk9yS29xB^>FA6d;Fg#~sV9>=q
z=U-5inVVUXS(aL?A0MBYmst`YuUAl6I^m+%VFQu2_n$@B%M4pf&ct!W`IJ9&2%N*?
zxFqFmq_oH60;!gLdt+~BBwdgDcfbBp@jli!@!RE3PCgT8KI0A76~B2ZmvnR1oY3~U
zbaj^QgM&Awr9@hKTz|>CC!FK_4GCV>y2VD@-aR|8aE0V)qlF>U4$9UTz1a7(&0|Zy
zo2ZAkoy+%Q8X{JF+l|T#H(loQUSd%ryz7X?E$d0UdN$YXWe!sAmHT1yb31#~mAM^z
zY&j-9T46A6{^O6@`qzB_$)xRntAETdB`czHv-*UsrcV?mm_2&@;EcFZYx2?;JXQbF
zi(85&ysUguw&p_QT78yz?svX)SJz#=FCu3gV|n$oe#*lma{}zV54{Y~YG0XjZrx3O
z)Uf@nx8&Ix76t}aeg+0DqQW+@s3@@#w4@^Ze*Pm1fx7eY4};}7tfVg5%_+%P$yfSP
z_m*CPZuKqURZ7lk6YeHF&snY;{<VJp#<>&bPl=sdQpu21ZP$PNzPa(7iNAmT)_=bJ
zqSTC*&z=lEu8Ay34sM*W`49hGdTpKlWR`lhVD7fAm~Z;}Cz80I2z#9KVCWb4oYG$A
z!g$wm;REYOzY|vlG4AtU6nm&uX^P>x6<rpS`zH6UtQFeGyKs_@O!o82xFaGRE(~?+
zR<zu?SIS{GIjLydFRtvXn-Bl+3pbo{yr+6Ii@Jz-*$Kb;2ZanbIjR^M&ug!i`2WM@
zsN1vrV!hMrmH*TV2QO_{_&Ie(i}(JBO6Cyv1TKHu<2*Y5X7&Gd*V=TQvwBIPh(gS&
z=Jv3=&OBwDqCzfp-zw*vnmFZR+smoJatv(-D%|HC;_4;h>*x5?%S+r4PBam_f99u5
zx@@rKNe_-)+Z_u}3r6Yfx$Utk_1*Ww&g;cqth@WE=Sku;m)w;~bB<OkJ$P>-l#t{+
z!Q*xQrM8E8pPr|bygvWz@$QRBW##^DPmZ23$vZ3k|6^rIwY@@KPu~|0pYqiWLi>K*
zQa;c8_ie7?vERn`COn*AQ(o=9VA<x@|H%dRds)qAD)q$PV5m|PT)lYj%j>rjR?L3f
zuzs2kV~a{hiqPe~=U?!}a2DQBeID+jWoVJpTjIg0EW2v`p5Pg76>Il-O_r#U{2RP!
zUJ)B_v2DcWt8A@T4;kAWd@TATb3ul6a*$<cV{|FY%R3Gojk3%?)~>r;bH(fSzR=Lu
zw^meSpA+ew@#c#MUuKwjQ2%!3txp?oTSk=dpL_0Hx6N($P35ZDjnmfleYvz~@rpGv
z?5Vl4jMrQAcRNc*=qlT@mn&Y&2%WesV%C-etc?;rv)qgvbEE8M1S)lI=-Onu<7Uzm
z<wNDOSL<e+Vw#eFSU34r?$(2`J(1Q)FU!Q0TFvA?2QRo)x@6kl_Ocbp1~-53_Nrcy
z47EN{STr@WWQD-;il&;oD{?zk%NER4z8Y=oH|f8>gml1)PLJXyb+7Y0#eDOpbZpZ-
z*PEZuc{pd|hqTUjVi_@-4#y8oSg)BRxRGJr$wrl<6*GMIDnDP_sH7pf`%%^nxl>vX
z1uncP{MhhoW$Ky3M=x+>7wmnqJMp;4{hZz6pTDjOtmq0gagkjdv_x?IPG;L>pOq>z
zzrMcuy5#nbc{{_Gd)}?f{8nFZO65ef^7g2$&$iEh@Bi$$c@DSUha>(Q_MYrGa5ZfE
zyq~#gSC_16b^NL2Td1>X+Q$5|k!QC)`|&!2V-MH-#NeyhnOmZa;xFE)<k)s_)=V#l
z(#P}eS=Ua}p5nRu{ohO9fBiU}qkK73X@~9y*}FEk<Ep$3>t`7}{4V_M;4RmzJKwGL
zE|%Q%>qt%RuUCnW9YT#}+*qJ6?b&fpvkCLp9{qkH(Wut`UsBQG{z(TT!fqsZL@aGS
zmMgwf=(nTvW9cjF=1R`HK0!l7<(;WmQ@7M9!<~L>0(fs_`!2QlQ#Wy2SYMWqUdA-_
z2N%?G&#vQsAFgu!<d)gdB8=zU{zae7yywgrWxk1*_4$A4TOn)aXT49Xy02W@ey-K#
zb^C4Z|8|EmZvS^=pT5eALFcb;bawj&zs2(wY3KD_-Em>vXMNN%ukF~rn{${L7(&?a
z-tvT0pCsky=cFcrb`eeuxt({*L7?_~xX)Dfo)n!)?n^>cHM0UTe1x}WwNBXj!0=wl
z-t4#QI9I&dU#=fhtj~X7-b`EL^k+BJ3p8JCUD6$NIP&`&kxN1kwY3f^9#=IA3_oF-
zp%PlaRQ~w9y>-vIiP~>2+;Pcp4E(kresX2!+|4_rMS?;mq`EGa?u=yHva0opgN694
z46PkpHGVS3r({pr>hjrEnQQybM22U^ci1Q2v^`h)B;k5Y&|;M+5B{GYrY2bC3G7{G
zcs^^Pk&^hS<d_(HnR&;Yem-7yYm&jN?@t$P><YcW*W_#6*7J!~fOX|TE|14wu2)Qm
zjpNl@-)<gX_3oeaq&vN;6DR)ve!EnNrPyss6Sty-&^y+a_AE7H;aS^iJHM3uNWLMT
zda|P6w*TbY))wvddY@ACKDtiosS>!y(I;pSbhd~osZ9Rhs`UEDLXq=0!&l1gJy1A#
ziGJXW*nP9pKD@22FG-)VX4>{yjh~An_FfD8R$n6jt)%|%qGBC|<*U+C<`xDeu9zU2
z`=W+rX=;A>jhqb=WumruoxcBPOX-DgTM8%G+ilE_S*YhKw{6Rb9_^^Nv6cKOvv;hO
zZ&ZCHncchM(&V+#%LFTyf8oo0Jj;~Df0ixlV?Xb56Q-17ZFkdEW$e`!3QNy^cSfb>
zakOAZ)a?^Lk0?x(y|Cpk-`3f$-J5K`?RmCkrKH~_i<NJGHyT8r^{8jrW7M<wZ05}c
zy6N-yW*fZpbM(lF+_BYLt7GP=#A_?h7yYn1duH;7(j82z<~)CUn4#6vgo8bP{)an9
zIg;0_y|XUSR=%?4>Bs2jAGr>hh4fwun54=S6uZde%e3>)Z_g`qeKu>Yqdmum?R<}R
zsYr>$7DTOicu>ygAe*m4PHgh-Er$!8=KQPJyo)*eZQHL!hs%U{|1qMba?eQb7JFs}
zhE1Fd44OpM>?xVaC3*#wQ^NxDZy5;GonOCWCBI6jRB5ftE0Zgmc&Cb9OS`PrqU7xJ
zan_BQxmFQZ|L@y8d4hn~jS7b!HQ#^ket$0A??GM7-@iF0o=wrNGV9R1o^x=;8z+6`
z&#Jb&InK=$-XV0;ZBzTww(if}+XeJAYnFKxbi5Syb(xkVli?MVuIS1YxFzD{)Fpu|
zI%iuT30-YR(VRoe%q1W5JBYOS$%(TtKAv^TC+N>SLD$n2*BSrttU7z~jr!bdd-KP$
z&Im<qkE~kEW4>j=PR;xOR3^<36H9S;?D3|eu<-Nj6YQbujyYYOZu{r2qGD8V-;>t{
zGXnzOW%fSoFSM^x+7!X}L)bH-=b^T;SXHIQ5vD^2tm0~4#oy)0voBlwS<o=&$l}zO
z7N1)*Sg)@+b7t*wOHSs^#(`14qTMd9yg%X0>3-YBAOqGaPZN%LIS!ZNwbfRh722Ts
ztY6FjL*9qn3({_j3;(YZ?|b*|q0qdyetlOb`{)O+x>=KbN7Ktdu5R!9CTV3yd7(+?
zl9-adU2ZQGpXcxYF@3`l&TH!W+H>Zui{ImP?oWsI#55Np7TW@s|EI6t`|v=qSNOpv
zp=<N%8D5o%xcz7UzKl1opxa=Z4(}9GgL^Gms#lv@%HJ8>@?MwXBQ9V(RW(Jpa8gkC
z#gvB!Z(2K?dG{?Q=g`zA7Yt{XukvWC6?qvt?SjWf`>hE%clSQ%cAHbUPU+AAGu36S
zvC>i}(r&+FloH_%@Yi?9UKMkGwV$=0?!p@W6$};eel0ayt8d0?du&kAs#-F;FW=>J
z(eb^Bq7PCdx^BFka_`=>gv3rR{=-MuoA0;I606An9DRRnKf~<HJ{>9gnwzaH=g$($
zc=jzT>vm$f4&#zlS#QpMDt+a=>`O}Yfx}<8{U<+;6XSB1>y2Ku*?Q9dooW0b&%b_h
zOu3a4<5%?J<wdSpH?-<wWLL_R6&jp6^VxlpXDy$+$dV5$uN>IEXz9GE@v%GGE-zu2
z@vd>7Ye4GpqiY|03EgmL{VKl1A4;b4P0KItTqs?k=U1g1@0Fmk_G5nY#Cs<c%pI5O
zJbY*T#*F=G>Hq5Ad$YRNtWw$3@o~nwZYj=`=K5luca8_w`k(yQ@nmgL#DX%-zN_b)
zeCF;)&4uQ7;%}X1W?;C(O>A8Qx@a&xwMeg^@+>GLdI;1#5BCuby<z)!*-rD2MVDH(
zg?TPGvT|LQQuapi8%ghfm0e$Q=jFfOz2$}pN*Z@Omp^8F^YNUy@%^6t4|(3TUEja;
zm(H@7i(wN2*4=CgyxErL_ee4~_Q&&H;~hdjgEqbNIehfzQE85Jk-QZ`GD5o+tUO`-
zh1u8h+6<40jv~HXu^v*c2R6lc@U|2$>`ZG~-Ddmvx837er(%Ns$O*fy-t5QxK{!W_
z@7Vp!HMY`46M{XrOpuHCtUggKr0UpnX4TXi--FI*eiuk`44PK*bc=>?h+IvbQjye$
z&JE9Z8nD$II2xc)y>hyxuhK@o<oC~?B^=H*35#4b^P{E!tKuy+fnN`|C+hF|b!GQ2
znLBkkvl;AHUa8RGU^5I~EzxVC>LtmvEacX&Id7BX1>RlUDtK;zl1t+}LEfh2-V?rj
zZ}QA4V$Vso34c~%!L^U=Zk>t5H@CY52D_U1{$$RJShFsrYFgmgM_V_#?W(UAzH{&X
z)`L4m=TuFYlru*_;PHF8KN-&4`hO&SC)!P3_xf$4<TqZ9Yae-%*_rAZ<*O4{rSu)l
zls&-NJp0~8i}gI`#L~l+PIsnsY-iv5{pr5j_G0@kTTXcXR-wnwsk)Hk?c){Kd8-#I
zFVy2#_*z|lJnhT3=bUrH9z9(sboz*2bM@}V->1tg7YcjKI2F99$KvFQ#TizG3rjh@
zPJgp9*mtM($%P{dXM2-Xl>>b)U8$(bj;;>B&@yl8spyqWoq>0Am=<0$IJ)Cf%ke9Q
zc5*$f9(T{qOiy~T__)c^z=bP<m+kOcbS1gsP`MoIgzcxU*k<he82IJmqBGaRk6KJW
z^dg_P_Wg3nj5GWnO^zs??h5)UE+X!bwDhIt2}|DupX8>K4Kp0PPS$W9UOMlglVWnp
z)FW!f`zuq<gdABmt<Td^Z;8v!{v94GcHfo{O?cS%`nt68E8Bux=KG<)7w(FF%TfJ1
z$ML7e9OH=!`?U^jJu&-T6;If-jM78r964L>e*5k7vVGP0ez_Z_7w+BTOcOaJXFuCK
z_~SQ*{Vm-=F6aK2aw>Vg5?%0czt)4J%NpK(eZ6Mx>?jut4T~$$#+&ZF^D91dNyPoe
zo{ux^G=uJ19-o-@<6KF>q57ko+mG&4H`>g(M=?FudZPUQSx0{{#(v~)xc~I@@x7ax
z%+jZ8UjM&X=kmq^{%z0Pw;zi(z2O%tzP@>Vn@oB9*57~c=;n3{ZCl}THY>a{@>;`w
z)1yZHXJf9pdI_~DZTRheHnVNgLXV8bQ@ay5TR#e|YLlHc_xk$WCCL^$BxC+7^Icef
z%yHYh@Bf>dr)zWlV?!+z4!+fPe#FSYAi+Xxr@JUIFFjSSpt3c{H~+Q)&)(nR0xuN5
zP2h;_W3*c1(QI~O8ry1q*{(wqlC3U2@MyB@N;~|oTJvV_<Pz7?4Vqp3?`^%(3%2js
zC0{G9Jw?p@GuKk#tq#VG-e<$5WqNN`7O@2{Eq7aE&Uftj<MR{p1?m=r3Tf3Ga(k)!
z@POidwXK2C8eO-n^EYTX<ZLzK+cD)-q5709o|m59@#EgfmZ#_+C6nyq(e5U_B>$xD
zzDJi?GS2=!eEXC6x;q<uFVCCKEB9>Cp7K|ZZ?09F5WFl~aejsJD(}tT4tC3`Nxod8
znErG9(={{homqDOS@&yCoqrCm=ju;)W8I|^X?iE>$H}Ks`60mzJ?{&aB`Iak)LN4{
z!-*?gWaZIia!sXoc5n)mcTBz4{zIy6(Omsf?L?;Lxbq6l7sVqqI&*(-ShL)5iRA0d
zZ#TN_&itwhI_P7-A};VhbIO%fnXMPzIK8}XZZ`APvUzfM8E5OSOZ$HF-lj_`%MLw1
zx2b6M2c?rSSN#9S?K9q8CoHzHQkg%+&gIABeH`<{SIFMA5IoZp_>AQ|YwXjP)gG@M
zSq|L4@m5~ry~EW2Eq!h2MJJB3&HehoX~Nq>m3I>okIMI?{VQgi`(T32K{ki}Q;{`F
zChOQ|9e6yOjd9YqZTu}Vo8^1gA2!qIUx3zCY58&Nb3F$GL!2@LgEmo(xZ;u`=$4nL
z+~V72JpbOsA2gNMxhr$_WnA88-MuMmcmJHG7WwGewxu)uroEUkSLc<7Rp<26_3{ou
z@3$#mzgv`>e30e9b48AZknbm+{+xaPyMKg-u;+JoL0^&CMp|r7EO-w|-mQQ6)w=qL
zssHq*yXQnIZ`M~j95eR17kE-w=%TgM=Mugumx~GaW^&o7@3W6x(Yj!t{|%d`P7@V8
zcW{Y3?tD|S#^=HtVf~h@nVX(WW0}-reQd__%Hl7gn?2Ls_Hl78`!nJEWrquKu@BBS
zr_9XW>=HPUi|fB1lc%w=U;BacD}H>+`82U@)$*fKcO$)A7wj-l`utVjrf<d6JxduE
z*)0A3O!AqZ^8D~ELUlTMPj6cUbg4DyO#W9T-(XX1^?Xx>Nm`KJUneuKcTF=~6S5m)
zPM>0_6Z(@sOJZUO)1D14KkZ$z$mGsjhNHno-;UMK;s1MmKTrIBE33bi3rgoHdS%~X
zU6gM3cWwH;mo0?~synaz<I(n;xhQ+a$=+<49(}j)#gB#mzp1Gxw6WX0L#6#mV12WF
z^^*t#)7imC55+`8GQ9uu<nPl4i-b+?j}q)UnGUJTS3gN?*uPh@x3T=~oElHLJ8{cX
z{%q~zWP5f^LjK>ke?OM2{dw3qw|?u=%bPdupSo4wEb{lyqzW6kxGg4MvznJqewcb&
z^6!s7E!&!ZWC^>>xl#74PUnp6%+S6UQ(SzO6>j)4Il)iX^YKdWZ}AV~B%bsst`S#K
zj1?&BeH6Hj`)qLOZA*&_+?9)%rk%*+@7<Y}pq%PZ7i27FdADZA?DIOpKg)Rh*12Ce
z%wYalsdwc)P1~ezR~PI#Y0|~{ypWk~mgeV2zL7$fD~j*#FP!+LE_*@{tJBHq8%?^2
z(?qxyw0_v%7FBVIar-f^$r;j1etuv|SNpX-Fs*Ku#A?>1x}P+~KRYnyop_>QYf?9F
z>48_GED{IRek8wd@hqKtwRbjeOvpA3kJ{k<TMTnqR<>jn)=utc`fo95LrX*!7x$0F
zM>c7#nE9>Agtchy)u}=+-_5)_q1#hyhuX=t5=;0MeM1+kC0}-$y-wTp*5n7q%l<h9
zrAI|gXRK^tZ{Ov=!RapZ`|S1ibA6a6Df5>Km#)~)DelyeZ2wTOG}_6nW?l3Z_n1H#
zO%0U`6RZrT7qq?Ef0%z+hq)M6eZ&`r*G#(2fgkf&<CmOs?A6M!EKqo|c!ru^rdQr%
z4MBqpt5<87eDh6RUHl7{&E_up!jU$=k0ajUy9MjjC)29#uFBuN*~@Re<I82i_p6$e
zj`zKgvy@+?e|K@-`ZFHuH=2g0&)(B%-0zy7F*!%dSafrX*X9Ek!prCTZ)pwEy!h<U
z)#?qqzF*7Vdx<T3VsY_uzuzgpCvILcrQnuI%-W!YqsPT&vKemiHF_<uX!Y5zOZF`>
zb11O=eQ*1HaqeAR-ANnX72PVBxKgAf;-v9X_vrgm`*h?Z+<IoeZr1f$%O`o@bnw#Y
z_n%A(Q;hHbc2==qT9OyfqvwYbemC6TxBr04<UIbU?5Wk775{7&Xm_7ow%R*Q@aEHB
zAq+}4IwmwQgr(hCBs+J$@0a?`&U>ToKWlvcwoGM*+01+IPQEvLfAZ6Znu7}#eciBT
zYsA)=y<3WAu6g=up|VAIIBV|oVDm!(ExPVYpQ`#yYSAt_CG3^Kle%?&wxjZdmog$&
z?Aj$8Qp~&W8^11Fn{LXWZ=U<=NmZ5T_r@Nf?QR>QFETT;*7y2dbUL&w%{K4$-&od<
zO?<5nw(iTw6;ICdT5x`K<Uc2yi2?WfCvqPB{76=`%Z*{W#Gl=pBtBPbt+L6wnCG)?
zmC~*Av-%RHIk;cMXA5k3QQxrO?;Ebfi4K>wob?{;2y6-ztFP0jjIaJ1zTyA*kN@WX
z{VShmVEpUuHs7~ZE?cFq`(|#l+j2?p+X<PdJw62i1($bRy1SKojofa<_cw(*_Zlj)
zugyxzjq1zJdR!x@%~pK!^`hL*`|t16Tes_0Udr;gX+L6rWQPYms;$n*I34-5@|F9W
zbAiTeBANeo&U#pDU$*46Qm3~*@0BxOPOQk<dS{RCo4Owj4f{`B4&7-|pK4*$y7832
z7C!qc-6ds>??T>l-S1gv_WkVZuU#uPeef08>aec!n|D;`HD2zyVw>gX?vwntPP#ky
z`Fc}r4v8hb?OJSGZXejNZl9^wHnX5R8=icZevmesYq{u&#oNA3kv*#}vuVx||FXXy
zg@3nCIzIL7(aGD5TH-c5am_nmlw20EKlMkCpS@<4+j7%a;m6ONvbMEld%yCPMmXb<
zU;B+cY8XFuI`n3->iE1A{vf5GZE)M%?bh3=C$pBRAF9@@mY;H{<16#q>}8*tuVxpT
zWKUaY*8bsYY2In3t!HaDJX`xk?ObrN4HuK>zONA_f6ia&;!Rz2`R3v6J2v#EdO5SP
zTWR>uDvP?e`U@kMcG)6D_S-Di#G^t3cD1**MX}pF*sJ7wNcF~I{vW#nnr>t{ho&E7
z=~~n#eD1>}Kl|H{m&ACvK37$iJJacDV0!#^uHr&PK4y*GqW(8@gy$XcHsXG_;_KFa
zZNI#gpNy9W%;eQhc*j>=`f{S6OxcInFOxLPmbdz{EjXL#<+Ph!p=55?qBk36-((4X
z!G20!%rWVZ$&+r2L)T=_aL&;G@@`)51M{Ct)~{*pW!#_lqiw_gKcNM0_WCny-RTi!
zzW5a@7mLb=w%ASSy0>@D=xt0}{kk&Nhx^#=RjXL`zxudmn*EP^XN9{gt<7h&3fu1E
zyK<t-ymjCF3)T0_4@G?QiMe5>A-_8E#kAhC?w^P3oVHBxo7Hyblg9a7?H7Nno~WfR
zf4aEo0BiOR%Y#Y({%tB;Zmyulu<+h}HJP#par>MLvLDsoV@TwRou#+e%HtvboA?M3
ztvu<=7xG!Q*xz1qD{{SBd9BQ}qB9E?UHTb+Xv>?z(-*d6Z`pYMbi~Qud!@RkGO*0#
zRNIa|<m&y<<}M>M1H%$d1_m{p?U<y*;#B0hyV@{VYnS82Lg@)2xn<HDoM&%|m{7-(
z8<Zo#=DhKROSf|6ra316>o$E&^envQ%xD{=a@5`a8Pndg>h^8@Cd^?63%nXUX9Wwy
zU(D^?%**2*e*Gk?)aOqcFRGL;zWDX*bU}&jF2`=(1?np-oLRmFd?;G3r_5O~T_v-t
zTgmsL`4?@+SMQ5XsdNN2{QAG?7xT<LG8xX&57&gw-}kwxVZ)7(%7>whfpenF9^CXu
zUZ*4fiPLz`x12aZ{iR*nI}2X4g!y_*pAn{cQJ~N+Zr|^I9xqSJ;?_;JdK!|&OoAoa
z*Gez1J@qL6Ygd5bL!P*Y`MjY4W~rq-_c;&T=DV!WD098lr?tv=V|xj=`|J7Q5ncsT
zBm23G&Ur+c{8>7C+v#;nytqzXGqKmx7N|RT>&%Zi;Sp=*+CSdxToE>X75m%>*H<65
zo4rn+9Af<Y*0jezulR^Bo~M-k@RZqI@ymZ^o@S3TPSWk#B^%o55z%Zj%^~QX;Om8|
z>x1rZe`&Ie=ZMqH<vP!=U1<BlSX(chQpK=FtMwz>rnj=|6b{XQD4-}D5Ii}NQ^n{G
z=f1ZyUcEd2>r-jqoS!LrzLt3xo;9%_-e2MWc~+{~r$^8K*tIfA?b>L;_Cc=u!I>n5
zoUU&#4_-;RrOEr={PTr?I|UbPm&wO&(tXVSt*`sm*6Nd2+!uJLypOo>tjp++-=vri
zvb&;Ix_$U|c)h^gsWBd3R_-lRlCp~0Z<0A%-$#lw^`wi1ve&I!>YmRE+l1eW8$N1W
z_4i(9tNY#Z`*lq}Y$^&a<Oc_uTd=(-{-h}>p`w&Bp=Mi+z*6S7?UENCE=f)3+uU5w
zm3nm1b63}Dmr08b20LD?P*IoSNnO0yK!BIm`s9cFD9KNT^Cw0)F@<nC6uh(h!*K19
z;Qcvs(>hxZFJ^rsXZ?Tbj?i?s{m~_i54IgU&=;`d$u7AnZNKJ!O`qM538ZOn)~;&U
z^E9W%JYYqid;g1@6Rj5Bobc<z{=X}1e{D|=Ug_tzJI!=ca(73{O^e$nH^d!0Kk*6L
z(e3VUD_`wmWMI%_!MFDvl8H+5GV*g$z{5yWgAZmsHW1kRTbr#agLkXvrD#6xn<hEV
z<+~e87gh^xvhCZt)!k{*W@)egwW`PcUYTjG<rnh!d~eTp6T9a4)vw!M>^?Dp$L+Mt
z$u6e_^A7oZTyrEtsK3d0hWFO1NwHBgdX9x(Ofivk4pRE#pv+lxCqXsz?SX`e*Bt{g
zBAJt2lcjrm8dprcB4#mh%N;IHHI7}zyF;6<9pF`w)$`lwIP>4ZGqdD&s&q$Xmb^ay
z?OD<F-zR?N?VlLh_e<!{xyxLW*E(JP_;^20=;}uf`yWm{kzRGTLcBIH=C|BbkKeoI
z<t})by*chn&$%#0&pChMbZ`7gGu$70uXZ-ugME{)-MYnl-El%P<C=w=rq(??wJg83
zU7+@+bJ>}7iw&B3o=#cV&TGt39{TU`u?4R!*7SL=DN?g`Z{Bmr_L63X$-&j1zDccC
zX6my)$F0eJ=(5V;E%8k|4StyY>3+1Q-m#*H=ez>9eLRPM-Pa|FXCyw}I{RdEHhZ4T
z!QYJ~uiJ_RqHE;lg?(GMIqc5s&R<Kmt@#_O;2QAnV$lX6iz^x4Gn=mjm`tfWJ@>@r
z#ygjlPwvmX;P<RONpZu{_p9$V8fVl9{YM+nH#zRD=g-5y;HQaiKp!0aAR<30D>b>K
z7&KEK6<vILhiKjP^$yqgCmD&nUSeE(A;kLi*1Nsw!q%lzw#fFjHF=(Ja%R-=xD{yo
z@4YR%xR8M6@w+M4`8!)qAKW>gpWRAH{@(n*#h<1v_nDGYG|@2dqiK4Ummk-xyc<tS
zYiul(mT$VDS+{%TiPw+A>*wvUtNYt^#=K`w@=_6%<Z_+qN5#x0cU^p&upz9-ds0el
z_|_y(rytuUtWpZ$h`iY49eB&M@XfPrtf8vGWix6$BNvMA`pI4BUOaE^sUFvNr#pA8
z{dnclyIULfB&@o*>0D;0p`ajZ&a-kI%}6cRX-`h%Z<<)i*8Mh&Q#w<1>h0C4yEirW
zUDxG%_UD*x6|>3<-*fBo{++#~Wi-2PUH*C5@65Y5B*m|)cI|dF-k`l>hw2uUV&^&c
zmh`<kd4Bo(2-mX~20gR)I{W9H^18Ui%GCJ%iUr#jY-fz0Txs+F`tQ$AzMTE}a=rNU
z{XXn0|4bx{<CtC_ys$6o`R=B<Pv$f^7JL*m+$6ACR!QQt2kWvn;p|z$eC?~841a82
zDtG)|LH35SrwIoCS?(zW89A#xJmVkI+g4T}F;P0QJIAcwKXcw<H}OIl_YGfM-b_or
z(VMh!&ccl=Z}~=VGd<YP<Py~orSyb<<w=?H`h@>0XL{UB+TotC<H$?nd0}bc<#n0o
z_AFlYf5Tqhz~ka=w<K*;XLKg=#}|0mJ69blVv<|`?R@*f6RduJjCF6Sy0pjs|2c0}
z^x;D9Yj2B8`1OU}t~#GH{RW4TjEP%R$+<p`2^)T=Ol0_K+r3@5_iA*c^4oV^htmCA
zO=qv3)hnIU`+v*x>L)t)pPk;M{AyaL^vtgpCBEH$p{u{z?R4L~i{TEn20sGs?+Fib
z=MCDI@?GOy#*IGytx*U1FVC5#`cfu?skE;4<I6`+a*MwH`|~TMuJmu>t22w1f7CzW
z6==-EwT^qjQb~j6Yr$K-El!*Gn@@0CjN3yo|I25O1l311<?#2bd6r1>{N#G^L;C*Q
z^Y>%sem&7zXU?(X!yD03i4!-ZR&k5(@jCU(P21GdEi=w<?Rs4+Ew<TvYckK6n^va!
zsM$~Q*1WMLbupWu+v6SHx8KTc&weR;dXm>iYroG&rt<fwK2Uylqv%4;k<8T`%9HFb
zu6gfQ>QTjIxbk;MUiYq~3C!j`AGw6ePm7648d|lU&(sQS`?`FR)%N}O54ISjZn{>w
zT9r#%@c`$}wndy9*Ihq+$ZCB@%;dF`78~wN)LfgmPR}UHP-4gPN<WpH9qx7<PdtuB
zz6@MzCi0*mX-SIc&YPL5qJFD6y{p{XXt?tH>*!1#VRMn|0Xz5pm1({BC+&sU#<b#(
zS-WKXncLfEy?k#aG3(#`z;Z!P(@lyin&(?>*4?(D>XqWnj~0_W*{+Ir%(~mt(722J
z^Qx4eyPORQmfo24bm3;6|4kQq&;S4T@rf==#(V+J5ZzhRFB+eSi90)4-Lo-aT1@+`
z#}xuS8)eoU@m@YFFnhxa@9H~Sr;F$N3F~s28`sU_+S_|J=KnRnE#D@*So2ZEy<Mz?
zyYiNc?k<x{zLR*2(kC4e2)|u)<?C}^UB<7gCf;Q8aB2>l?ceVIIz2J$=s&SDyPsV)
z_Ak0u_hOCPtq&&K*FN8~{Ois6?Q6B_wLb2fSjDojY{q)!EAK<X({xxF*BKlT;okfA
z$|)lmzVi>{5|yITmv=F>Ez;|bs%DHj62h8rqsisW>KR6v{Z`j!P1)^VnIOfNeNFNC
zOzX-m^Q`Xie1BHF;!|mYXMm1ZkFa}%BE!v}YbSK+Ug!~4IL~@|8Y64MqOhhdlE?T=
zYHXIKrT0wKS(e!J!;b6!s%5T+56Q21qjvlJgD>};Z_54hber*y@s>-3Fn6<=;Qg4F
zuhq|r+i@Me;B??}a}9&d6|aY^aST1zx0<b<x^Iz{>GFg%5_x|ER2SZH)ID6ZeCzzv
zQ{F9X`^_u7gn?=5LdFN457Yw!Ij>)>d!)OKY2l+Q22&KAgD>rT77=;KcCAptt=~-7
zGQJu}@g0A+t=pGp3*Rp8Uo9r7q17{|26;D5PiUU{>e9WMt?eH+op`BtaL1)(7gn|Q
z7~S2jD3=uGz;*nor_qhm?wneQS5D5nb!cwj?xmiIcSZSLy^Bq;dMy=jC$6B$^w{IO
zsXJyq%AU`z<9~~Z?-9GotUr(SBP(tnwqUr#QIi)bdQDtW{lwiP-%1ZOK1lj%en4Q&
z@+&vG*T!0N9sC{cXIQ(a^PRA-kNT6J?QTnUhT2~(m-?A~yteW{n5OW<zpF)`GFa}t
zb|b^~kA@w0<^3xQ<>hQ_?f*5jZSwoqFhzdr^JEsAFFRf&zi~Qx{`s*$-uS#6{ey>D
zSh{DK^%dXfzIASP>B4um78m$buHI~H?Pha%6CEYi{aBT$=8WVoqa{BN3zjq)NVeU2
zYx33M_zbfw$E)j})_r|ocPycImhHNL%~8h-C#W6kpTO%K#K5#=t!X;{*-QHzzbr_f
zn0UNf`sN&!D7!z0y!93sbzhm(dFGbfabB5~nX98bf4dYX$xqq1bN_){;V)^eI{TGm
zB_nlv+V>hV{@EX8b^UVn{F0^2dMTZ)-cipvU)oFNg#TUmWsBPbu7p_!{9l{poxUO&
z9lWP-xzK3^_dAzPWUbtKVZkkp%J~m2Ey-N`TWPCf=f40|wz*pjegws3|MmH;n!opO
z>DI?R4-Y#=?7C(*tEj$s>*ic`WlrU&jJKka@#|-{DVzx4oOfaQ(H9Mmdlnifzhqax
zn0&`pb|d$(xMK_-7}FeoFf9z?=03jQPW}s7_N9kx{=`rJ>9@Y2HpIA6=KoU*JGMKU
z7HTQ`Xc`0;^yz=KI5GFzzT5enYpZgie@}QLFO@rCs+dLJW5bzeJwB(pHZVEI8Zk~V
zJGwz#|EBn?F#VI$!d|*5-@TTar0^o}{1S<<1$+;8hjxAu_;O;?lZG>bCk`rV>rZz0
z_^9G(Q$rt*xjDnh53eisd{SJn=CjZ8oy+V)GC$n-^<kSHV?oklw)1O3c<Xk2da-y<
z-;Y!LU$%wp-1FShRpRxn&R@xgo*j9Z^GsD*-~7SHD&K@-+e$y?1lN`K#mhYU;d*#u
zX69FWryjnqz6YvLdd_36Pr786XR`D56;VUO`|9s{SKP@6ZsuJ3_RVbJDCx%sKL&+Y
z+_b)sba?UkS8vPQ&t!c#tQ$I?Iizo==%a#cj-Oj}U;J#jnQ}$HM0?TB!#k$U7ZG^!
zOY5;-Ti45NOMgw?dG(QK;K@x4QWYE59N4mg)3>*~Cs|1|cmAa(#@G3;NHID^&yC?R
zZSdROVX*FDJ2y|}yBf>;MZfJ<6-M<w<PM*^t#rjt<MbIdky5ewnY$XD8!UZK)b%p+
z-c<R{DIe}oTfbzMh}s>Y?l#S;sHUm={xR}TwmvPiZHhre#nQ`LPV!W6Fyt#_94X|_
zEsj-9OWE@O(=%JfSKrsj=s5@;+%~h;`_}RcwZYt;dhD{gH`&*ID13ck)wkNs#Z{lx
zQq1;T6uipoU$ggTD`&^LEx)%U`WJ3kx7?QD<K@fkTYoF<XEjpYCvtfG{)q<!&ze?0
z6a2L9QSy3?8{Zgz2rl8>xpn&clEatIzc?-MWkF9>_U(TWOdGzuQhE@0bNddz<v;Wo
z&K+l5{71ZTYuyvArG<BVW|g!oke(p^y;^j}#V9iYmnnNzy*)3oN2G80mwg*{+q>U!
zz8j(J-0Yr`t8|(p?7p9ENQ>mvRBLv%aIp^#wYd+^ozgflP3VN^>h=dSj)!tPm)PFi
z5HmgGvQ#7g!!7^o>|fh_GCw_INAYz1`_~N4OcjaHlS!&QZ2atbUa&UDR{OXEJc->$
zwr>xqdHC(Nw)+#VNgYmkn+_}N%9$iJX_L+DbI%?=pA&fh^2r~w1@5z_O<~h{6@NKH
zv^2i<ow;?<`7f(yIPPUrit>>7{;1EvbH92PSFEl>!1?gB-wh%fU!*r)FTZ|JQAX^=
z16OueHBK>?+4J~+eXsg)-8DZrZRO&XD)(~gIc)Tnf75&AyFZ}c-fYDKCY_6EK{-u<
zwuYPSow6=6e2dkUIuNn&$ARp`h4*z`9Tw<^{rJ`0+4-o5t)k^gkl3y!Ytsj}mK>5-
zRZ)HNCQLf+ztkn4A0h?0&GMIRbBcPSecg(eoj1xU*z;uu@3zm)zD#S_rzG5Y!sp$n
zEwOa7&bR!6c58>~J+n>T#3|@_7_IUb`n^Q@OM#Q>1E=_!T(OR3SMgaU_K!2%zVKU4
z`@Q|Ev(NuBKWFL2#CgR}@`L+6ZvG&icg^*8V0Oua^ul(-iT~ps*-!d2f5P#0OY{TT
zx~t|g%vEGyu$;ocpn-p6CnYsGzbLUJzX;SRd25@UFYP|*{#Wg^RGGFjmxOOuw=;Jv
z)%TN0@AaLNu=eabN5L0@H>aqnrO&ABxc2JD{q=EwXXOP=`QuS!q13T*=DSy~R=uh!
zE&c5H=~w&n|202y4TDn`%k7)9dXuhL>#E}?H<#M&4&k4l(%&bi5+C~d^{yQ|awe<y
z%l&`(aI(9<oVxmSt)G6Tp)=21of;MPTC~J3YU=vFKC#lRUdt}KUN74^%Wrbh)^)GU
zPM+SB^?BQhQ*O6XX4aXn&N4lJyJpH7fft)B+VfApa=LZ4Tg^UxRg`(XUj6CpuX)R^
zu|$|xL~dIZcb)6s|E+bFP0Pc7Zkl1gTHnfL`^0yb*X>y|t(g0sjew2d=9@<OQmJeP
z{X32>(oW9})jj*$ckcSx%C?_B&-@p~;CAK1i8D2|Yxi%z{(8|Kk56irmR4F~Cq2tP
z-M6o?{rgHkzW(d=>Ff7N%By}@_;JV6kiFTBrSFc^uUNfpR_JNv+t-3Bx1M{=mX;bn
z_j&KCbM;}H&D?gqe|c7;^6p&bn16Mj9*d}R#|vy-y=Pi}zIkQsMT-Tix32oU&B#SH
z^Jko#QB^QQ+u_(33ny`&`&qTN?#ydPsXcz~Co8W`{p`tdJTi1!Dc=u~%A0<Eul#t=
zN}T`q?d)R#6FXCZw>e1-96}qdD?etfQa8MC#E#cMc4p!Ewlijb&Rk`>c2p-`Z~0|M
zV=t+#F+I*&J(E`LJrcSik!NzdKkwe-2QHlPIqRrCXW{2dK36K)K0Ed3g?L+Nn!1Yd
z1(aOR@~iJ*e3Jdud-<uER<<YSO}(Dp<5PBN?eteBq7zT;V{xnsJuBK%JgGL?<Zb3E
zLBI2Ep07@Dn0T&rS(@%MpZ#R_qP&E)Cmylbm7K0DS{KuJB+zYPi<-gD_p2(mhx{p5
z6NsP2DPT0yas84gm7Ui)rX>ZLTzTMWx&1NUj*Hm=p;;X3KZh+?nDE5)WUSZHXIb+^
zo-SGyzT`^91-2azgg$(^C~4b%mFJfJ&NH+3<YuSTS-pNG#WrV}hnc$<lR&>D%eLll
z-)Ch{9Cv><4W4}Ow*5=pLk-V;YJPlLr8V_f=1Q;r`-h*rRQWmisOzqZ7dACTY4@ZT
z)Nvn_h`4f9Rnbl<K>4LXQ9zoa&T9EpZAbXST3$#@Gx>K;qt-F2bi;$Cy?;~g989lW
z$r>oDI)CPIn{|5x1l#ft`h3@ITllO+pkHAYyUD{n86gR2Y%jS@_*tb+bNO&^InCZ5
zdU975SIr##-XErsRwfFqb=>u354W`GZS^;r@V#sT*TaOZo{twU`x0-yUu|LUi8tzB
zh5N5CeXZ^I8y1_ts_LJoCU1nP{<IB`LOGvR=^vH8Iw>upAx&d-yTy&etuMQ>M0EvU
zE!^}=RbD;buIkST*R+MlYt}jhp55=d{*C^VBY${#-hX=4_t>1}=|iD|HYw>Z>|SKJ
zXPxS2=GnB~f#JebYu3eSwOyP0^;)+&3EE7!e{N4twgm%6Vdf3f<qmdR!haWiT$L5S
zp!DD0HJ*<rW*?rkcJ)_<tNn@V^gpF8w)u6p_d%<wKnq`S)CmTaXn}=owy_6nE)*VA
zcp&|!_{F8ahkkrJ@VL}=VP}uf*V8V`j`S&51g>VfcKFZwzC0uTn}u2av$xq<8}V#D
zCtp#wI7NQDb6<VIy8Hc~f4n@kJ$0+*M)?=LjT`t5Z8_?6^@a8&7Gvk$h1YjSNHEwL
zu}EpKC0z78Q@5_Gs9={zfBvqwg|iw~Pc3;+q{@3l*nxpJrNWHoz#9X;?k~~;$}c5m
zwLD>KzrXD8jDowdk$2J*6uO$vSp`VF&`-7xlVY9R%wMK@@84dQ;PO*_|4;mQ`YZo}
zLwb5`Xtfjz`-_F_=VzE7KYslDL9v3C#(M^{LuKq|#;&><-4ij<SnZy(W|omym5=b6
z*Nf(eHiR-c_Bzeqtr>RIh`nIy1O^$!g)dXLGENRwU!7Oh`SzN3XSg&2Q(Vo?J#GIr
z`z8qS#R|V-EVwSQ=)CEzw5y`2oLY=x(FX2|d_H{Hz#74CQRCfQpkm56=i1*ohU@V>
zD{gYlh`;=7N6Cu!9hNpc;wSu0x<&2Zc`@h2gWBcW@(n)hTzHk^R>|Ho>zAkQ3u=CN
zZI}B`9%GfxbIc(+GfwjUo4-*qE%=q$+`P#Ld2Mg;m9G`LmU}1vdKbsyV8vDGL7j!}
z@1ia?89C$}<J1X@Xe*E8zIc?y=i;hQzfG;5EN6GLo?M{CwKZzH;0h6GdA1t;FQI{c
zy!Tu?kA1zU5&86e)AB<9?xdfw-g7i=ML$*$yIA3>UlMcuu2it?h2mh<TM}DNay{Cw
zdNOqDyK?zJlf4Tr%wPOb`Ju<e^W8IfPjh-q`*WlI;sJBkg|-i_i9BB*t8sSWGar-B
zTeP2629>QY4w2<%XX&z8aIqoa<C=rp0>XF`yjy&Yna|Fh=$HIG;yHi8!*j(3Dhewq
zx912)Rrh@2;0^1(a?pf@{RtnRqH9C@^%>t9KKxj9pi|{}Z1>@q%RaNWMd)$zMCdKh
z-{bzi<6iRl(|^1yx2XH=vWa53IPnax$}8DVHz)1eBK&G|^_kcFo{jfS7@zC7Iiwn&
zQOFm%Xfs9MGbFZo#@dj}PsDGv%H0<2_^fdBGEb-b(^3r{pHgF%wsPNTdtzpkHmz2>
z#J21;<KvR2H=@06aLb9T&U?B+vyI6?hqYn%D-MT$?;IE+KXGJCY+h0NROn2S_P6Yu
zt;d&6`l|7yqvMPeTl_*sqkwq5oO$f_4WepEIqA!}yF|;ApY2=Mu=rJM-?8a#ZzqJF
z{JH7YhC>y<zGQxK^;cZ3@OEZ}<&tUaU+OP7IzKa9A-ieb4YwSZX3K4bk5ukh_?nn;
zO-#thUCG!a=D()+_nsMBcg>wV-(;R%pZ6+;$zQ84guhKSy?%n*T>V3Pzpc6OAH$8T
z3)e5PD}Ug}C4ab~ziVsrhZ9?QCm;WQ?0@h=zXdLL)R%|lyf}OF_au9R7wbeU*V`X3
z`QMnmX6KSUUrVnxzFc!4xcc&Z3#~J9$NQ?pWOsa1+nH7NjW^}X+4{(O=_x1KrkqpN
zh%4CeJam)hE$?l?SyQLy8XB|tuRbog)Ofmg<++;=i|%%ozP)*jt+u$qui(B8*9D>G
zhqD!5OE5)W)&6v%^8S)l*|)B4VE(ek{0xIGzh7T~@`NRadx{qr-+aTfV13|1odoj_
zx)MhhUA<y|eCMJz=F(Yj``8y9{N8x(KYQmseqXEVxpE5ArCp~iX5jR6iWYcb9McdL
zFBo~@TvPqh13l%uuPPP&JRb%v?#Nhu#+`#{#jS2P3!UgDHHp48XWwis=TXR0Xi%Q@
z%3b`$j|b=Ujh2RpH@ukYwb)_JA8Cb8FA5YExd%9%;A9AQK0L*J@ss5T=KGaOf2lO#
zIBw2#e(Bl<Z;9eZo1EOU7OU#U&lMMsy=uDhyt=`^;6#JG%|9fW?l$OJZ-3Bne*V-<
zhyTBrMYx4`vKTv^I{Bb%hW#!RzTFJRlVWx9oAnwRPyga9=q)a-dR1@M(W3DvJ>8(X
z`BZ{-p0taKH)~;X(c*=<cR85;KITri)+<*wdugJZhi>(ae~!u49SgdflI848w{#wP
z-0uH4W~(%-)}^_uJoSqk?-vG{D85xY7V+5Uw859d8xA(?)|Z#Lv};q_YKOEhaZ}D2
z#(fcZ%ebHY9{;5D&zA51O0BmO6Hwp!YpHhD$H(OxpS;Y~IVj*4rc_#yVeN9;dKS~&
z`HWdP7d0%(|9Gp_Te;mxKipw5^Wr~)o9*`#eHu8Dt~tG^RnPo*?9i4Z#)&L@p4Qwb
z@eow`a$wIysTo<b-oziR+O@{3LnGQS(rJQVm9RJ03H42%PHsN)T5QjnAG=om5)0^;
zOBXFEoE3apusG43{m%wNyW_Hdr|^jWP&U79^0=z$;71M1XMfC>?T?;aKiQ_jJCoH(
zOC<DJ`eHt*xet^T%6qEU+CH9lSLAle<l8<<{0%K7LY>D|7#~dzxb|qyl*Mkjx2LzU
zpS+%Wd7?Gf>*~cpXMUf##V4~o`_rM7WnG-}zgF3WXMbqc=nYkqe)E5uL-76$l1ywJ
zc@k!aOZm7SGuhn9y2$)&SNe<T3q<#QbJyAW@ObI-oyGfDkBj>4PH*U~68|Xp?dA{m
zA7zVYRNPvXyTgn%_J7)59gX5Ghbopc-O5;Q!PIra%;|kvEw5qNOtW1wyuz-jUAxta
zKPW|?GAo@Tb$~&EDJyUfGmD7zvNypqzqHp`6$Sk?4V*1>ERrQAxR8r?hTBw|sy3?&
z%{x6^wnT(gT7Ob@@LI|i;8@7~GEzF~x^@nGMYdj0^6fI2n<Y#uBscAv!*B3Xevf+C
ze6e&lPv>_2gv<O!bNXyMOND+5ef_j(h4icim6oo@f9d?}aqFD<Cw7+xgY>$Fis#H$
zw{mwI-QO5r{-Q0mCc5c+<NimR3__D%{Y%}sLZzjp<MN)O*GD{R+mCA8dFlE__OxAF
zwK4Ao&kn{NWeK5)8OJo!4tY%7oTZn?RQh$*6^p$dFYUSeFHc*t#!-FN@rm1db5CVP
zT(&rPsN>k%P3II#<QL!g#rrkP@o?3vIc%*fwuns4-pa6a4fmN&@fCVjZye(o-|f`>
zG*jr&nw2#(E;IbB@$-{pa(%R*K1}=t=Mxz&=@<Eajn|aVUF)Cl&i_fjdV0Q)TI92H
z>^aU`XRf-sYp-1Lw)RJkYJ05Bv(lEiot?}1P)<YD*5Gs(7w;Dh+madGavU#@hh7gj
zbJ}|L8<U5|%>GG9QZ4EytQYGgYzX*b*R|BQf5x8^B~epcvsa18C|>*>945whyTseB
z`%PkJ$(-i@Y^x(y>DUOJ*48pDdZk=weAzGclJNDq$;Y;3{9$Wh*t4|$Z#bV+hWeZM
zX<l0l)l`%g78cuf>^v$F%D8P>tIlob1I(Y67_Dw|ImdFxIFqBurTJ#snvP>Gl128>
z%)VUt5j<wC%5SY$+vZ<5J=OJruz6gnGjl}12BGB+Du1Rg{BW(<Sc0#5-NqhAsqV{V
z+a`zqm^}S@vs_(kzw`{*OUy5%1lZUY?kbS%?`HK?;Gh2|`cq2~Q~N>3H#4kvnXS|}
zXFqT;jD5$A$*VPk9^`FWdeqA%Yb(=2jjPW-?__#v@z~dL>f?z${0aqI__t12vpUN3
z1l!FoXQE%+{`2o>fSaS+9akP*<%2BeUp0Lb@0fbT=7Xp0y}wJNpGM4`cD^wG-rK`p
zzUFXC#ZIrBr9H_$y}J3S+1kmq1ux%bofUaLf0pUPn`|{lr+9web#8s|^khC$o1i1f
zaqis9PyU~=NKg9Wt%7UK&vsm2$o_)itCi$}u-U;a)yZkwZLi*+{WenSI?um|2b#*S
zmh39@Z~Zf6*^lX7zmxXFGw&$KF`6y4taf2`U*9tIzn^6!_%}D3*M9w;zklw$8LxV;
zXPat&Qmy!KTGhJHBe*nF*ZSVw%%i<bfv?|6oDsc{G;`u#d!-!)YYxcIU|e}bu=e&r
z&u_g<Mq-;UzvPt5y{KXHx;szq$41W91tt4VyWI6lWcqWx)A_^#gROa@LaSyOzP<2a
z-V71FEQfvZr>}D6uD3dvQ@PuBX~m0~7W+-PH~Pg|?A!jsTRCU4da}})8^!-(H&}7r
z_$)k;{aLKTLZ9o=7tYPSn$IL``!9*HPB5?M>WV{W`erZuxQs!N;Z)&mr-yv39L#Fr
z4z3Zd4X<S9*iZk`o#$Efcvs(A%V*#JeBJKDG{@2S^v1gNo8-dtO1Z07K3O<@%IupS
zckijCD>hi}e|pyW^`~8*MU)hR|1?RxxNX|?nA1u6vQY1<i)Zy`E}9k;bomK4YlQ><
z#G~s}*WRAAnk!q{xMR;jW!HdZUdJ{X?>J-nOs*qsO2sD6JqJG521z?>>=Ir&%WdU1
zpLGpfJIc6x0z@}^AG>297Rs-BLSc{Nv9IYe2j+Tp@=g%^^S?ZI?(0R;Z<-icIVE?q
ztiQr$8Rs=q^_uC`qeojWW#$}~eCvHjH2Ze3{i|(v=YFWq+a>8HYam-RW9Or9lBxe@
zOkH*&)P2%|sHK`&v*H4>RGC%gX`T7it#O@g*MTJ#FJ6VU7j4lg`f%FJv)QU9@C=W|
zx44L}0gY;t-dXpsAN9EKZ`qM+TO!{dVOX)4N5ywr-R&mhoqHAja|OQ=>^h;%_v>|y
za)HXUg?|=FUR-a#S)_Y{hq!RS%_$d6WYvq;N~$x>3fi$xbn>&*Po+24rdaH~9jj;@
zyNXNR{p5KMpLt=)d>>kiPV`7H&-XE7^nQD-ChYq5fGSH1%j9_?7LR8Lme2XP=t<Ba
z`J=gNyhoqrH7sgSz5im<hKnl=MITn}m!BtBS2n|Pe%_Zh#vnh(azDr24;2+e1b=3Q
zt1X=!F!4~<?CehE+K&EM*RH4^b3&D;skfv`?KNpx`-3-_^CDNmmw-DhE<f}<?#?Yd
zr1VQo=IiE($<O|pv>9H#_gJ9Cu+&dgXu-DKAHsdy))%~-_APAcy^Zt5G}rfZaV<8n
zT&^ydv{BaPb?Cdw%u228x56L3nKi3<V_#(d?~;F_&)?oq$uFs{YCe7O(4(!k4zgSK
zF>9=4w`1JEAFzPw(UrI9uTOB#zaaE2{>N3_d)kjx{SV2OW+`O*d`o{Y`+wB#KH>A9
zjn>~Zp0Qzpdt4^tCEqXiH!e$BrG9VK%j9H{|3@ZniS3<p@o>AfwWLi`dY!m(@`Wok
z{F9dJ7|yYM`rdZguT2eqzRtf9!qK)U+)Jc#2KTh2qVkI#997E}UtG|Cb<ZyORkxU}
zq^{N+uj^a2O{;<XRNmX{E!&I_?=C6bdb8FsV(v2DhwLF4?2jL<{<{0T>bi&bxzFV{
z8_c_Rz2nQ5;)r!M3I+cE-!tf)su%aM(@Ga|TsgmSo#?xLjth!CEt&eNN|`Q~NEKe$
zzv`L9%MYOres+`Zl$|sz5xINT<W5lJjGe3!t=pw#)c85vz4lEAKE=1XPtD+F*Zuno
znWN8W+%x!KFfDgl3I8P97hW^-t>g`j7V<2OI?|dqw>f}ql3!F{y0ms@uwSXMNNn{M
zMe~_=QvEKQPWqC(e;%`M`6dxXV|`1b{Uv{@ZHk-(GdTsDPChl?q&V}Wz@*m>$LD6Z
z-R|O-(KY|MmG#)?wO6ZVo;P?{GIxbjP+ZqewUc)zuKRi+eRjwCxF4!aSN%Iabt?EQ
z;<ve}c3kO>>w)8LEvm=!Wd!R>Bg~J~>!l?v+S^kgP$?|yzW?>x=nW@lNnBTBSrzZP
zaMpCW2tyy?w;x&@p8AR`t9vfYs(Z|3k~*VBl^pA_e5Zh@aQ~X?S?n2q>%I#tb4}3*
zdoFz5__nFQ{(HuKCNC~V&+hA#KIgt-UHm(RJ(YWz_biM$qJPKyPTVioS#PD{G$gHN
zRI}fAzPw?o`4+=Q;nxe?$~k_<mT>&uwm<O*TS1cSZGkP7;;gy%r7k$XFECnOo9sSW
zmixqS=OX6D`SLq%JH~qPR;rhji;Dh@-4?oG+Q~Nu5~i)4?z(w-qeXt?7M|S;KkZ$0
zS=7})Oyb(-RoRCXKW1Fbxp}sfcj=OAOIZXGKJ*zl7M-57;?v4Cr`p}jvmzJs*gt3Y
z<<j==@lw9+_TY!a(p>kK<z}JpDx(xnd9U<cDm(K=Uf+(&s`jJzJ169dH67V%nepTE
zrQ2^_iP}ze<^Hzohxoe*Yd&qCGqqTD8S}OcbC{#$W@^_ijqE!5UN`PuhmLuZ)dAbz
zU#mFdggmZYkky!Qk>$eiD$RQ?ECCPgLMN=Y{@^h+PW$YYyE4z!x4eHg&+ZF%ciGcd
zhhj^k-YXQYVAqhc`}*2y@25=Lya}&fh?cqw+z8CbY`?a3LGH72W<l%s?zS^x^LbzR
zyCCW7la>1(oo$j-^PhZt)7JUN82?<{TYL27&CjV7i=(W5>a6?Rd;Y;jj*K~x3LfYB
z^z(E-SRQuj6|y^V)-!e2YNbQ%XG$d&?^*mfJ5X-Bb>B>nw=WE*+RwRXv6Q>$XV1Rn
zCco$PKinTyb0?|5^ozIjI*%)DhaY}>V<F*v?4efoW#jqEAv|yVTe8C5nF_x7$@na>
zJL{W&N89VO$G<*}=Ds^!R<C|h;IccPYPUFldByX4=hAIl_VSU@3eS!7RG<7>d^g?f
zPS(bMyZ5c|=nVD=`_}kLYxSAg{Urk1<c|cLycLplW!dJ_d-hD|yz%+QjGmpgPn8Us
zco&-7(DkcqKT-SBD>rDTG3Vmv6B;xG6B_2u&37|e?6u?H*%ZFTvHuF5-|pv}*|wU^
zc+IEuEkFMW+uxbL?e^l_ypu2F4VHf@SULS%YFf8!{^UA#cdeI3+eN1CE4_Q{yxv!F
zkCT#n{{Cp?UbRQQ?b(IPi6>4bSg)DZykP3S!xxj-zx`NtM=m*E=80d#TLZ_yHAWv~
z%GY%;Pgrc_(z22Luu#A3eWzww=OYUrE!2wSv1WYb6}84XVpZmK4Xfqu&mZ(1KDGU^
zbWf>KWv%jq?JrNP%db|{TU+{|?x^Hh&bZ=>)?CNUU->=U|H1C=?RUZ-7;HWE9b(=q
z@vgT-w5@l-*_#$?{1&{KSNzsVRnv~A>df7=njr78KYu5?JX_{i9k^_7lJlhVD`#Fb
zuz2NnZ@#z<`<;WkMSlu)dKO*&v~F?!{_T$QZ?88p32;7M``)*W<?rD;X&v)#`^Cq}
zlx<9WaA!e^)UTG!1$X4utaCGb<{KSvc|-ixvcd@u_i;Qwntd@wk*mnsfLqlox44LD
zsbb!|rK$%X)^5KY_AzAJ^0OCC$}5&Enk4!m<spCm{aybz<~1+pmARnIE?K|u_H(oJ
z>(SqTFMFP|tag%R)c%*#R_<DPK4ITRm#4C7Yrp50E1f=6l9g69&8KI<%nbJhU%LNQ
zGcTI*mfPb=$+5)ad%mmLJ<@pad|Ro!gmiZHzkuJ*H{}0nv`pT=_qFF6JMTFqZ*#SU
z?ca3$vi)x8)OIM3{osD_t5s@JY`aTuO+4~L@x{?Yb1e1*?)Z@Bc=G<&3jLfvvO=q$
zDoJcu-Z9rF^w?e>iECHHYWnKad-t4Q@#3%2?n4XMV}8C>n>6>#x;c{qDvmQeO`Goh
zc5?!+p232`?*+97wp_2_(-XWO***1p@40$qgUO4h@0O}OZNcTEXLM_QnM)kUM@5!B
zFTH2)^KY3|cT8%1<JOkVFHP2&JvFh7J?_|C`C<FAteN-Ug(X=(lKx;+F3w?L`RUB<
z&C@Uak`;Jb!X{g}s8~7Zj=$@+b4MN@znN^t6nN@G{l7Qg*KMz}y^}Y0`x-r?Ow*3i
zUL9@Qj<xqJD)j31J6>2~ev5toL#w)kxNDuZf2Z8OAL#XLkCOiFvb#O@|Nkt?(BEA=
z<M6BEeG?vizWVjoui^my1DDVLf9(JN=ldcvPZMF;rX#x<*aa3Cobar(J3X)V=hgBL
z4nAKDw@pa?^x{v~Bjb}Y_ufz1d?8Bv+AF3#t+Tw2?K`y2{@K@+^^OaE%dW4zU&@*I
zquMh4%fgQyqRgpWT0UEj*Eehk&Gb|9x$`AviQlc#<0;ZX_LCw{1zQCtu3n)M<oSE+
zY+LqAe~s@2TrRpKe?9*lFMsde{gq|$4_Fr-?a{9_`F!++nEu*^dX^6de$6o9KWSu@
z>Gb&f-c?V^+v}dJOE25TKk2!soW`v1kT(73`5QP`za)65I_T_rATOx?{N&amK6c$Z
z4s*(;ds}a_nSY77xB9=kuS&g~4Cfx!Q!8b^=ZJsYci`)U`OJ==B5y0NnjyV#x&OV7
z3%B%mN2zSgdw*t$JZEM}=8Dtq-^~~0G#KnlHGRqS#Gv+e+{??0s#!B$oH(pqAh05K
zLiy1xe?`^iUAkh=@NVr@iEP;q>T)@Hn{PER2bGFXR~B#<aofT-uOd*j>HM12fhCN5
zwP$4B7IDWd3VeAZBvdeHitERVt?JUL=e~R_EN;5@U?azs89QFqp1$?rgIU$J`_p?&
z3y;c9w%z!%Uvr`H9V>0m4YTg>nJlP`-+hwB<cyu?&zG5NUe8=IOGbK4bi-zDefGwC
zTR**zo&2DzxS+HDRq~3dvZtnBDVh--w>2=P@wfB-+ZV)E&y#0$`t)i3{aRZy_1#at
zU)b<&!!hAY3*4-=%rmB*TXt%0e!`wrayskoIAp$hJViR?#PP+<)0;$|D$mZDukl{p
zW7_%W%<V0Qt95+sc=PfeTwp%MX&%S_J$7GpxMsLyn0PRk$`)bI18Y`nxTc=JeEGZV
z*6XwQ(oP=>-xU@6dzJC7l7;VewYRr#dSH?2&b&K5;=A~KKgSZWqq`gHwnn>0hZ%NO
z8@xUIyCEiqb4BwP=jx|CH4UK)*Ou%q)i`<o=+vC4Uv}i(Ri5oMP0zgh@t0*5wI$np
z``@aHbgvH9y?;AyDQAJ;N1mnndIh$xl0r}Tr+$ho+AOPXZf<^i?cOyP@`8+ZwZ}Yo
z>UH>U!r__);a!`zReU?q9w@$F=7!mWWe!(1&iPWe@Kob-1#!j|;<GQG+WAd6X3Cq}
zTf)mfEaodMSLzN`k31xQKz0dZ-kuqyk_%?No^n0!y!EEI_Xe9cFl5N@`uOo(U-1fl
zJFQa(3w9g)%l)S^<8I8J@7osT8$5aRHun1oyTvWy0q?W-Y?RsDsQ190#s2uwI<sRu
z=gv9p$o~*nx3xP$z<9;EIu6OJ9wP7D?^`?1jp$2vU-3`z(4xnWAHVnBs^c}AWui56
zVfuRA6>UPyoWCOVyRQCevYwHb&wXM=4*%Q41IEV#KNefAzmj&r|Md%&zL@f(FQvJB
zcO)jS+fY3rU{c$A8QbGIE9d+;nO=G|pvv&#?`dzY+D)j_Kk=l2vuI|qFt7F<N%O;R
z&1M-KI+3#5-?H}BirwK$p7pvN4gOfY?aYZwC0*%DitgxMnD|blKhZbbwVsPH?f1Kq
zstJFXWwTPU<Kl{Y89#(ymk3xiqyC3P{c)y#<%j*#)z5Cq`m2yI^}o*Xu%G5nP47wG
zZMXK=Jf%*(``;`ZxmWQSb_Lg(?@clI`R}>3RPk)vUthj$K7M7jZBNV+Cf|6oChgmQ
zZcLo+?^WlOe{1zyf6dk$*|;kUug{#LcKbr3@lG`-iPWH|mvVNmdBQuqBPCNzq}qGm
z_5AL%Wt_bB_t_ow?I)TmRE6D@Dju3~7Rc(pllwRG+_Lqbtxt=XKCd;4DhOgKk!pM)
zy>H9;%01T0);+u16LHUYvIN)Bq!+nXcJH>nF<o+Z!x={Lw7QzduN@b!64gAze>*Do
zc`NVyjq*ueax%s*A{}?Xte#=WqhIys?JXA}-Td8$<C=a}n@n|4Kg_s$@{_pZ>rUT)
z$)(ofI(ySO)|fl0%XA70YmJQm^z{4WZZW;~`;_I4)7k&o7S9NEYo5c?<&%0Z+O|X|
z@%g)q+CwLTr+oiha5rGv$MDT+`c^KF5>sreEB@}^`m^KOF-1GkLx1E=E%qJ#xoO?K
zRi6y9i~Vxz<)<y%-}vwLCR6?|ilK`OTetb%))lLL`(gE}Q~I^b{_o2AWWI!Lao4d7
z9si9V`maAoOthToqayqDi}$S0>$#_2efGaatH@^Y-d8UchjU!ie4ds+SHRmiW5L!{
zPp3<N3-!Bk%QHlZ<wD$d-SpGHq^{oV`Rc9sF7mYSGoIXK*Z*{62Yf8PaW_|f^}pkD
z*k8^SwcKLy!hD`h{rP4~dDCV;OEbN{<q?9mSG&%p94-&n{*%C&9_Yrmtm}%xjC+mE
z4m+Cm#c`)s?ri5@bmK+iW9irbCbk6JvAdb(WdHo^u1taO@J%|(PY!fBFej(;J>1)9
z9j@~qZ4>gUX?cN585tO^FcaLolag7Sn3MzFcCd7!WA<$af!6oGwb_a~Sf>@-nXS;8
zuzYRiEw)9@-JD6fXK!6zS9W#o)b9Va;X!Y_jw!akbM#m|^ZUN-#jO7Qr{8~M7R``&
z9NKwovQmlWovWK}B-;3=J>nAEW@mBhoz0na^Y@Q_=F~CY<a@}y$u!`R+}5?L4S3{I
zRa=U-HQ9vs=F2>@3<!;W?kJVK_e%;d_s5{m?X%8^sW^W#nx3Pw`0k%0hdvi>GLDk$
zUsonE@BXg)jxLVVQtaj4e?GeW_tEE9ulKKPD2Nk%RrURn@9*vL^-FHE&2aKgix4{9
z>t?<)NBrw8Rjm~l-sj8|4|>hHIP7xr(Gy(33GzHqPfZ@!3jF?h@p~oL-gGOL4u!gU
zr`NH!oU=5zw{I_4o0EL%b-nIe&W>K=4~|)Gg<&?XT`d_0iyzroJWGw&SAV#;b&qj7
zUsCegcUPM&4JE%_61lO>*FPz+DsS>mw)okX6#pkUMY6M`-1;r~d;xcbNN=@XW#6ZA
z&E``E3ESJ$|J+Szh$>HPulAT0@}qS7=70BZ`to#EZkcOdcs|fSXm91F>AM`~x%^*l
zwW|T`u#)nUB<GV13=HcS39jWytw>HSD9Oyv1FhxhonV`P$Uva2{D0Tvh(i-JT6%e%
z*i|M3yu5Jri2jkRH^%AgTmSEKn;I4RirxIqC%f}6zxch_5N|&{`u0KhDbmdI-<)(3
z+rqQ!b)Z@3TD2=h6~fi;giXKZ#F>>EFJ3OU#W}^FEu2RtW}2p>^-{k>eXCC0eRNRn
z<gNpg>^`(#=TnUQ=2hC<H_^<_u}R_m`87ZK{KUIHwe-|ShTBG5-sJf4a_jx6OXnQF
zz5Zj|djq-NsixI7kBpR-B`sC{XB2hL_SeU}I@JsM{|~)KJ*J_>%fs|2Xww=O1A{95
zrA-;BIR&ZUbxpNlx%sm_1pb{{FR`_YLDtRl7w=2IS5Gfxm+UkNy0c3Cv{Sb6joS&+
z-s$BjY5)J5R?e85+&rb_%^91|-_C4!|M2C<_3tNF?>iFo@QL2xpwDv_`#eZKIxTxn
z%<<{>s&@!pUHxSB*0$HDSMyJPefqWbjCF$lTvfeJ6m++)FiYW)x_Rt#k*3*%WtD5Q
zJ2Sazf;m?<PF;Gzr#Ntxn|fdL&0`LtHG&71B?T?a5&4kXIn^}N^u1T_rb!<A^P>}8
zmPdzuc(XX>s+z#nN8Qek*SGvRDpxu0`W#)?zz3IB9nIO8)BiR5=xI>{*5IJCiBkUm
ztM~Zk+ugtSr}+Da@<)ue=T0|iige4fT(aD>D_TwY`?o*cC#QBjSQ%&Im1ttCe^};I
zQ)X{!!V=D%Kca#pjQ4N-cG70wbFc4x&pr#N)z7gg7Ytky^D!thOwX_&ZuX>O{!u|*
z{7Q!}XwGie6ndGwc*d#7WEQW}8-kZEy1uF9W?bUEUrWyM{gn$ft2;E`bkdIJd--1;
zP+7I>!pTmShvhRY=f-#>9Pr*y`uad$QU3ykmU)}m;)Daje|(7WI_G(B&!4of)}lIW
zdT!af+j}BI6KArXxvKldQA@^@V{hEtIcEyn@40R~8uBn`N@UawL!ax5P6Vv#3pj4t
zb0E-=algCI{)JbztmB$9caznHycO5Dout}zml<ws_+5Ygo5#9yB_}T~YOd$Zy&OMl
z+4<uijP}_yZ?E?ICYUe#q?qM4o9Qztb1jbh$1dFVb<Hs=-EW@yKWBB_t>p(}7y7M?
z>ZzK(%T<tPS=X0ebM0pDT9nuG^kLN&|D#1qOYapulZ<En<!SZnpQrYjN!P#hw%J)4
z-$>c={7-Dzk@Ax}4o#M}`Y@aK?vZq-dj_(<*}tfjn9J*BrKWd1U!Rs+zIyM|vh9hX
zdso~E@~z@FYns3H!i)n>9ZhP#gco~CFEPInnf8$PTJXPf_a#5h{(nv)GQoQ1HpP1<
zuO?jVd9OHUeQNJM$4yH&IMn4m`s}`;Vr6@P$U4z><u>=vSJ@1A2NcWeHP{)|{c-+a
zG-Iyj5AXfQzIZNr(Qj$_?0<%wuW{PHcf3M3_Ws<c>{M{<>u1jE7Z1+hoo^g)TR5Ou
z^aAg>nt=6pS-<{Y5O*}<+V9nF`sL;ECo+mXmbJcF$31_-%-xrm|Gf(N?r!L~p35h@
zwJ|^8;N2{r6MEOvX8ELqe{BD8>HTu68z#!hqTwo+avblykzso%uu}HZVeaq;^~P)p
zUuH2~$-efh@XS%s+NpPJF3f)x_H2b?zE4p|iTxR!a8U^!k)1dB(3d!By;A5(l4oF$
z>R`Zg{w!$Em40SkNor9+QEEwQ5s0r>Q2Ew2v;6UniT8hpC%oaGl$M(JJ*9ZfeT&(4
zcRKHX*?Rfi%{NwcSy4?oeVRe159b{{|G)M%gF^#@>#55ppE-X?yCcLY!qvJfK!c(E
z(c|{;db_I0XHvsXE#BOEW>w0}6OSTn?jQL))#jI8)vqT3d(N2OR@xaC`e^s^^L526
z^>y0k!h`lqO`X@-x@T(UzDVcPz>^h!S+eG=pA>ZF@{X4Mm0?Fc!@9V#VveR7iJ!Kb
z9qu{rXl78ZtJ+g1J(sE7i_W>s$#tC+y6J|9&_AX%dm7rmZB}k@68&USwMpmG)){A~
zm4=EJnF*h)nk+7Q<-{kgV{WI^W7N97SkJtx<~mRDQ1HfkM_e_ze>BbYoU9!yBYkpx
z-L%iEu81D@XQ??S<#X@yZ%tdZq>{a>SO3tODx3fF_xw*Kj1>jK0ZiIAmc}v3KArw5
zch1r4zO_}Yp&NhvEK@%Ha&qUprawm0r582cZWeFt$*-I8Kl=0~rg<q_OXQ+n%**ol
zbym0M?xV`WSY=V~=Pys!DE>Tn{8!dQk@cU}G+KXjOP>4e`m38x=RPZ~`*i5R@2F!I
z>)t<^t2b%Njmu8r6-(><U4zbDIo+zYd(ulcvkhWJlGig$wG$RxiniQ6@%GAyWrd+9
zbF{u(7AiO)wpnCm)wV^3n#&ih=~CJ4H|@6n0qteCSIw1)a$HmDe1!A;Rp-#Ouyh_D
zaU=eDHi7;{8R>kJ%tTl3h+$M$3JTuXsr_f6cj#^21f@qob7s3A5G!}x!|35%C^z^2
z_x8&-PutJk_vhi8yYl^+3Raf49($xLoS&qi-gCEINnK5t<>NCwy>;GSADijv90-gF
zlX~=d(=Sa;;Ws-&4@|n}aG6*9^rPH8jxt9$zdQ*wTCev)w(i_wf60P`&kgcPFS&L1
zOcY~%clN1Ch{OcW{X3X?h3c3e%hyd*OJ(2S`e;jjt*yxV#>i7Ox`_?R4mDi61iz^A
zSZ5v7)=V<&zbx{bu`7qsep8@o-MYq8A1;N7i^nooWKMj$w5jxBWR;fNwbd7&mLw?O
zIi=cvKYQs_>o$H53tpwACIw%ZZhV$~#aHp0?L^f=%eO_V8WnjCH%y;?t-SYyu$k2~
zt*ZHdr>J*t{F+j9hNIbu;q=55Pt)1G-ZS-<E8RciaNvnylC_}we)0DXm9plwD;!rH
zpM2s<RA1brrGg)7W{PJQu2-lDw&A$O?I6hb|1OgdgXubzRec#I8w*UYxC+UXKMZ?T
zYB+tf(s}Je{PQN%<<{jyB=pNZ%$;|B)}aKZ{#<K`xn}p(!|E44Jdq{dcJ<d&G3Ui`
za@%)4_;*mZG*n$PVpejxi|xN%CE0RXcNMOET-L((gtd#~k3y)27Ml%A_?N&*Nl%+@
zoO!e8uvP`zf<D{7j~C9no*?mU73194GYJ~$r&Xpp$ShuVPdp${&(3QRLz(%9EStiE
z2Mx}pa;`hy!=OFm`9#*GU$PA+Kd}DwXy1{<Id63?Zr~RWu;0aXmPh4vWAu$AYYoo*
zcdkERI^h~~^pD=IX;*#hv&wl{><<d+e@|9lC9SQ@cX;#4uz&}d+`YRrK9tT%F*^P5
z??vNo`S?%K6C14@7j?VFPKY$yr<?h~!}8F9xeIn=e~EHDzWnE$D^0BL^HhyDG75+~
zGe*yTX#Su}=+0iYKT%<;YYrYb%pvThzG!Xearg7fnEuO8eepEiNY+<}g~R^`|8J&A
zpMQ$ok#i_K)^|SLZNi!<7ZW35nu69o{Ql@hlj|B8O^yY+&n=ad(|>hx-#+#zM{^RF
zReaO+X1R+(RdaOu9l9FJf@|1wuf6%xe7m`iMIcGLh#^wtLjH{8hzBB`5{e6FiHh>r
ze)*)=_%31oBd*&!ngVxbPTUfepB56nxUc40-Qi$y-J%Rdsp?Hk)pNbJU*j>o!c(KN
z_Qb;bE0$io>);%D#V8@0@2C>{KPQ#-iQk%~-u*mYoSwI&`_TGbC!|yktlm)4l2tnM
zX!gph^?@_uubBL~y(LEU_A~an2_YG0HyJWIel|QW-f;coignZ6_e=XuSUWv$DVrf<
z6`R4PCDYZ_nEqHcD93yLsg4q{xXe7S=wZo6;|-sTFHi0aUfMA^=$4&>i*mz+14;WG
z4sk5$i8%IQ`i#y6$*)Zxm*~8EdN{*t?feJxJ)Q5Fuz#BL>`9`T3tx}YYzCdi3@7_f
zMo#^9zbySXZCtuwd7ow3YTvS1Q#Imrj>U>{IKRr?@bcIUe^+si86gYW7iX)he!b2x
zPp16xy)#o9-sDf-<P!F50pmiJnA-dYHW9xv&Ly8yJC&LiTzBis*@L35nI=6|n|J!7
z-jfN2$IkFRh%#_GQ2W|<Yp+hsfyN1}TJuzxuTE#YU}?Eh!|JZmVY6jxbk6;C_`l*7
z?>oW0a{hl_?Jn(9_w}<*JJe^hH?Q-G6iZX&p#=~3uxmL9W*nLR!ugFB*BK@gfgdb)
z)VdVU-8w0H`pI04?UADOf(K?Q#Dzy6d^nTA#NG7p8=>XaCKp$x%nCZO!tKX}guRU7
z4n?f|6MXXy*~BDixJt)GM(>*Y%PP3eclrT&8JQWN6R}T+^m2aXtNq3D<Nf*%YQ39Z
zOTDo^`{%l}1iQkbHP0qiOr5+n_n3v=fpf7ZEu)+Y)itw@vHkSYyQtWfzUIh;j8>hK
zHIK?SNCgVmemgdWb-rT!Bte<%q(xp)b8I%7#7i=Nx_z@o^||@61*{zoo2M@^+2Ryt
z^ry4vJCn4Nsozvfjlw(69IseSyCLY7sK9vovA0#^d7+h)J|y=nJ>gMv!qG66u{1fL
zF(qqa)~dM|Ra!(B2rW#G;LG|Ed(XmG^^m&g)uuf@TuJfFzaG6@db&TyTem4-YMV;c
zv!f}lVT+ke3}-L&>MvN~_{#r?2k)5|p3$doFJAU@f$Kfqgq2M}3$j;DP4`lp$hB;%
zN>-<^#+o}-Q3@MRE@Y9nc=Vp}6jNJr=!f{D9dms)aWCe4QN8UDqu&Al#|K&%dA?_S
zagWq^e3ON{D(v9DHwJvlMox=2WL}s*H>zIzk<3fp<T({Zw;coj%=oA>t4wV7p^VMn
z!<H@OX@2(UoVJnvg-abvm&|Nh6YA5$oc82IW~y}-x8CC4ybr8hvZgC+6U}Ba{rmL5
zY1@aNK1_e3e^Wa^@%A1zX~um!qxL0KyOjyNZc1hkEq=gUSm4iLBlE}I`_thm9EnTn
zR!Z<}m_CJV;l!oO7$@qTt<mtCdZ>NpY@Ka3dpo8}%y4a)d0<7uGK1&d&$L5k_A&;u
zotU?i>0_`+lkVy>t+N7CwbCBmIAhnIx!kZRP+!Z$y{$lp@t&5mcWfi`^$E)svzC3a
z&Y6<+OX7K)goeWI7e1_pi`Fb_Vw^QOD|SNp%Y6$9pY5C-e9f?0@^?4$8#yhN;~(aT
zbDqz8B5t`}TV%4%`97cP-#6D98Eq6e;`ujAbmsHS;HEm3Ijh?0b#`Ys>gvyU;PC7i
zo0?w_TZQo7(vN!^UY^>)cv<P>o@E(RDr+b1a5G)8FgDC&>T!lOu7YU}$FK8s81=l|
z%Ayf!==Stn3G?j3Z-kz3{k0VN&$^iH-d!bk%cBPw<@_1UqjJw0#x*w_^%C0?w&7mh
zwg9O)-cJ^r>}1qxE&aT(;`_fpUn~S{y}WYOG<F@D_uYwoVTgp#zP7hPht=d#{$}kz
zzwp6~nxeT+8$DUfS4p1FpM3w#Z^<h!HgtZy5LuVMIQQj2f2Ds<U2G2Dh*UfGzeFpp
z-s=CC$C_srUX$kP=A86pQpMsmubvulX&i1l9x2K6w{LF;ccz*5%b$tYt{rmJR^qhJ
zHBI+l@p{qWUf!3d(snX-pS|#5_ae>9vJdQ+l>U_2@qJdC!i5g)ztS3V!5?jJy=a%8
zEmYl5>%H;5+^&L#iuhGEO9FBjOxQwRHT}uvyUuoXw$`R~m$e)P`L&IueVr46-OV4Y
zjy$&SbS#h4+m@>jb0Q6{aQSb#laxEpn0LveZX5rD;%_7u#$Pya^OI`pq3S4u6pv}u
z9}YyyXFm+;i7UD({dM{ljtNutHsw}k>^f$*C|u-YSq8VE*t-qyt)mZaUAC|{LGD2E
zt%~sV>r*~%f4ua0<oycsl2c;+FAx5<d*jPo`B8)GX)`-x&BEhbKD^ZZ;qdf=+bh#)
zbw1YTyO%^YKJ$BaI5PZtg-`YRgS$JPul7s56tpa+N<MUw?vv>Uy|}omPgSY^DUM7j
zG>kZ>t+&se*-BpT3X^5x+LoOk1GpPE_WCU-i@O)lA+Pac)1=f-;g%5#Wao8G(wTf%
zGd@iJpyHkLe4zo^d|PiRU)XlE?!w~-!DW-5md~7OReZrApm(SDhS*oO4{n)VW2%il
zzc6=#^l`PTfdxu;mPF2vx>B6uqhG4%xw7T$+ebQ~;eYm4+}f@4wfWAyr$?P6Hkfc<
zY0Qq{bGuSFi*25t@4OAR@$WYXimSaY_><~1@wz^bw`tMJCXf1zPkP6dO%e>EWo>)^
zz1@B>_-co9#`PntFLK_b^3SaNcxy>|-^2fXl^vTC)@Iz{niEi$zP`D8{<7_Ye%ZkR
zPY<kCJ|eZ;>Zn*+?v6L1mzmPog#Vfx<hdK-Anh|N{y&$;WuLDh2Tp&rUARGt`>Zu%
zV~f+hNzI`fjiWAXeAm^}@>AVowzg+v#@iiy6NEZ>EllrR+#(V4f5VD3S)Z$3)Mc0+
zjQ(~lx*}8V8QU3cf1zsDLNAt(n$S5GKlgW6O;#(GVbXD4cxCcM?Y{v!Qep~md+I-g
zw`Dq>Si-V>W4`Buzh^hPK8qGRG<)R^SIZ~=Tn<FPF0!ed!BR5o@d*|c-`_5_O=Y{A
znVI`kcz)-)|Jby4SIDlX90IbI3_A06&YiXA?S`*A-YP#{>$&UM%ypBCWcOCruUnL@
zD0FCvhRCPVXJKmt+K*l9D)^Dfn77~>V|v!Z40VeuA~U_Ftxa9${BiLSo;3yE1dsi`
zAR%O`-J?0J?A^@Gac3^fY8AR#Z6dsH`Sa~dF3q~LP&0AWzUKT%9LCRua}Ebft@>o}
zHg$90rZ3?My0eV$_?2z4=<xogVa$7O@*KajX_w48nd7fqSCg=b>)W#LaO2^tr>ook
zJ2=J%Nzc4LWydP*!u~>sR=#D@$u$LL)fubvG#Ho<9WC=Z(*6DYeT|7P)DKQEy3D4#
zO5Z)*`{2t;r>}g*^L_tBZsvUYT6F7?vo@zC{_Hz&s7f%(kNwo0sy&$<>xzBmGCg%Y
z%@to2uyAW1%l?Fp%=_QAOsIHZ`(m#4k=WCTo-Y4?F>Xqol(^yF>e2)1HPcfpXDRKe
z6J5C4zr&pClgRZQ)z9boo{zQ2HF`6TbH-11kB{ujO#Z&wA1=LWDZ9VoyQTXN?OGk3
z-}<fN>#_s7?z3#1RV|l2Rm|{Mvr{#Cmge;)#y5r=s(F`-O7iI6vs!q}E?mQJ{@31Q
zt?5%=^Cm8p<(rr-CN+D(_U;u^G8Qb^t<O^4^*~A9tYXU|)7dGCyJa;U7GIy<WK@>E
z|MhE~w_kF;f7`u3HGk#N#Jhj<9Lo1+PjcsD^?79x*>2wZjIsN6g>Rbr{mvcb4gHgH
zO5WtX={|RF=kI+Np7M$?r<XhvwYB_sYVN=1%b(}lZ97%_c)D}N!A<+Wcm4Z#{POeX
z%k8(Fs(nATy7<>c=4a+>7PLzLzo*|Hu=fzZ_!^0e`*&_R{!;as$fF8nXOqDGqN&$k
zGNpI2K3n}jU=e?;TK1ep55GM$RCRo`ZwAk2tzfP$hrktoEKk~9&STrl{&Vx;$g}&-
z`t<DG$jg`9{XF8|lmNr>Njof0E#1r4_5aJc{0;M7Uw9cGT>X#3*RN@^jCzWESIx>7
z_5DRY)z3QTCHeek+>&%_x$>oD^~PH{mG9oJ4GWv0$P=~j;i731Un{O#-(mg8zCK<z
z=F2Ya+B>m4s%0IU-)>#Rki6P;dHtua`VU^$fBJHN=JMOx?Tq`jO;h@RKe^hJ)rIr<
zdcnuL?@rbHvV!5k^6lyG?P~8hez@={v!M1w<n+I{yq*?r+PlBQw(nx@+V;ZPbDLfj
zb1q6MI}pwJDeLyO-Kp0l_j%v{+b7O_e*d2j&w_7r>%P`rFR{5PIxlv4+|JLNw=aKN
z)cxd|_V-tBmYZ$4<NogL@9=4tZ*Mq}7pBiF6@Bsbp@q+vzGW4ge6Q7>K~{))uYnw2
zw@LP!>Xd(9j~>n45U)CGllB&yGaU&h4jU^NK0Q!WZSpi=i_zw`6}M;DsI6Gsv}5;k
zt_YXtZ|-ijyhp2YYOX6Jh-?>K!@1@$KZ8qR0&Az1b@w?nU4hK~ecD@HB0gok&aV@V
z>-aXA(|JzrTGsCwU*_&?y|yla{j0#C{r_Sm9<Faz)1RFmbmt?N@A>c*G4~&d-&!IU
zXRyE5(sbVgt&61-uh0Hy>^=Q~y2JvuH*>EheK%<1w&_30A5gt;&Ps{LFD-+kQs$Pt
zF@6;>>-guy3u=+CHyd=u%dKopS@3hS#ttQW)8+beDlAXgotyjcXIidRfsROdUb+@T
z-IaHZ-)>bLS7XZBnw`J(-H(ksjx$c3-2UwzZ{BP6olA4SF;6c$Q(5rnfgIb{hYL8_
zFXw%Wc;VRZHm&vg>Yy9H3k`oA{*fdm|M%<9i~nQd&dihhyZhI_w@>&NuS|=6_IF$M
zuK9+SGqV&UKMCLalWSEw?R5J^jnJ5l?~UU_PISvhoDFQueEng2;_cV&=`D_ZyYFy#
zCw#71>^I>+a`%f9x?WK$EiNB&SZh$sQ?UG+;K`)0tI`4{HFjmsTaBbw7cL4GKgF51
zT-umr!m)Jc^GpFtShn4{keTwy+h+ZxwL9`1Y$fh#RbGvGd~UbY7t6FA$0hmi?@a$9
z?#cOQ%hIoxK0Z14Zh2(YcB`((SMM2jDS8}QRJ`%l)s&MV0(-4QZZxDm+I(t`@YWF7
z%78un?8gi$?yPGszO`px9B2L%lTFI;XE(@g3f?|faZg3n$t3fyPjoVGHWj?9Y3ToN
zCKB0D-=?d%)?kL-nULJxjEyBuIX+AOT{Lu4`zJYbN5|&ulasDHKHFFLe`ocbhj#_c
z6Xvtp{?Smr;x+f{!&$ng8c&sVt%<*U%j(Sxwrp|#6ILwWSl;H#F*&SBZE%wPzv%dZ
zTNCbY*${BKSI+qndx6i{zmF_D#158hG*wMgT&w!d?!n$YJ2vkMJT|3$SKQ~$WrFYg
zm)PvH*xS9`AiYWOK<_fK4XM0eKL!Z!Hh)_bTCqT6JFn9P6;(!YslKZ%1!nU!qWqdn
z%g)VbXrF1tbntN{`-ydyqOP(!_roXGC3*JfS8=_}Y<4y<_Dw&;{`s<xU+wvv1?I+Q
z8L}ce&StJ>KYa8~<@!~-CV&1@obvYUNvq8c<?-^<Z`d9V>;2}tF?1svhuMYsO{Z&*
zZp!;z_O{M(^BiOCa}V4lIo4bbt$A=}{hMjJmZ5j6&-_}nZddo^^Y`{z{rx=U;>P9`
z@6MfGu>I{E7bBap6hEztU7JcvIyEig&YD%8+_`skWW1AIW0CQv<IAd6Z&I|nrr-Q_
zhfOA*>^H|tf;!8*pQxlhs!Pe<EI9Z0^MC6$f1A8)YSI^hCndV<>-OI>S=XQZz}ZTc
z<A=xhd2#VGvZlu!oawbAtTxyB+zt1=S7p2X4K*Kec+0J9o>p1*Pb%4-asSagr_c*2
zyw7xh<$nBl*1e?Wvta*|dA`w^Pj{bdk*gMEQm=SB$w$uim8L_G)h_lIeViM)-n={$
z#C2=&;djfP|J1WNxT<pU*)xK<37LmE9Zl}M(W!o1=%E?0d;0ePPS3L0=cnpB6s;+{
zw%x?~kIg;aO{XVi{ILC<uygNB+x<r-N=t@6eQ>WKDfMfCL6$SeFXOdYyAQ2ORFPuX
zEIGH_diKnohk86tFK<ir)K)0)u3S6u@TniuGae;oRV?5uYk0d*Guk*}K}fw&MS96&
zI|D!dD1)yD?`=D3FY^3-{9gOK`7FBo{)+8+X>zyj_u5m<hmsGh_n3V?yrN6f&+Mgv
znf`zK$X$!emE1mghaPE|#x=KR&j$C|4Bs}MWb9qJXy1j(6ctw4SnCx%>F@Q^a?2;~
z+|_(%chHaB8f*Dovixq@Wqkd_F!$t#h8Y(GpWbp7)V_F6O6HBPcmMZSW!GLuT)x(I
zt-;4N;-r1lL21*Rt4X>sA3mO_DcfhKZ(HI~bbrsG=qIywiTiJ1dlz669_)1LP4p*I
zIgyvbTOKXwTVAYnHdxp#m+zKat>raoB{kXG5*wDeO3m-&J9>J@ninm#t0$Yx)&1Zj
z8xU60#rLJKuQ<eXqSLxv&JVdAj$C{9sj0gCr`r65o#&J0>Ss+TnBQMn!WgP{ztZHm
zv&h`d-z{Y>bM0?vIuLCBkxA6XnP<B71i1^b3FX^m52fs$Y2>)+!^Njn-I4J*lQ*zr
z#7^9E{9C$%gKuuz!H_T8Rw#*^Eb>~cC#>L?`0Mr;k+u~t792cbwzaYDeLy|)hyQ`c
z^FP;GF~uxDWxQywM_c~fmobHPo80-ooO}I9(AMyI$3f-;t4v-yFIg1x*e^@#M0`_O
z^`u{mxD{*WUXAP*&Az|$!zp3g<3C=zKDgHT?4EG?Yxcm+)%vBJq2F&lzZtOXG=I8p
z-ky)^UTZpaS5%3d-T8(6JKMR#jmCQOc8i((v^zQTlJ7Z@@a2;~@7eUt@6O}7*BfFk
zO-nk%$`yO(F(Y5jleboD@2-9Gp@F@O|J?1fS$-eq{xo_c*>d9Lv6{}-O_gyE1SfBn
zS>Jo3^4?a_303nhUHf{ClR3@aY%Uw;=XWic*F`p76`Y^^^xmQd_lc23O>edw;NTMY
zw<!A_qe6t$gKjYe=ItfVatpV~)*EVOx;<Ib*7j|`(8?ps5rTZ}EmKcrtzbO6rFp`x
zg|m16)tjSm^Z4CoGb|SFexcR4?NAu+#cegwX@5R5*03%5!u<Y9O9JzplNU`*KB#Q)
z-n??>`$U%07yVsc&*?L9a8BCwQ()2d#Ld&z=gPA$xWLt6fAoHiSJWCNWebs)3{N_O
zYmSM1*w&nUYv%^8*dU*i7xI^D$lhG!GTWMQhU98}=@)l=wB6E{vdy*5cS`I$am8VC
zm_pNs8?Rb)UY_&l-nPoQ+uFEC(A@me!=S5GC+0p3f95;&{0`}Nj$%5gvulj6El}T`
z_K&U0%Uf#Syu^s#4Yw@~er@p#%37N-<J_W87kT;fKeG1)XB~U^%|d(LHtWtE2V40J
z4t|akzLIMb>$ypKU-Gi9<yp2?LdWHGWOA1uRgegatnl%?-te^~#nNi&<50eL`36Tl
znCc&`Wwi8g<hlD<XR4Lk{SyE0>y}zdOzxK6EPLBe{=14x;bcM1*Dc2aOg@Y2i<j$)
zzFzxMxAeo=ljoe9rAn9TGxvxIUEY3d@x>SV`&KWye(wsC&P<0ndXLmNXZ^|wN^YBH
zKhgHQ>&}VA3sMp)mTkGvx?FYo)E;pSA$2{D11E)?_DbE`Z1wK+Dm@9S>Sd=tu~(m~
zp7k*!#d`kQgXg1+<aVf?5C5~$wP^C1ly$i$j#}+o7<~Hk*{~-wkLJog6q~y0V(G*c
z`}HRVxP3UlQPdoNOjo9P^_8v#Z&kCFOPp?wx)f&4^>X@QC*R<YZ$l(9P0STP-tzgt
zkSm-nKkcDI_PSTA*yPe<%2{`{vq>B<-?8Pz3pFJRYm=W>*H!#oXmR$`t_gG83XiK>
zu6E(vbChrEdf8Ntb<211%>NK|G~8;z5xKA{E8a4g_}f={+jDw6*fFV^cY&<1fe2Sy
zX!Blam9sYc*1ufv>xNb0(U(5Ib5>rfc-<l+tPp%%=-ZZEIbYb*6z_?0F4etotwGJb
zZF6d6)7^OnmXVjX9P_en|Cy+qe|`7UT!$595&UZlHftq(xW&3=XT^HqIrlF*CUyz%
z&Q);DIM~SPvOM$i)4XfG-S5^;ux?UQ<k!A1gU{$OTgj#WMF)%BOEawIbs64!@FwWf
z+@O+8|BiIlUt~?P+`94erw!M9PevT>ifOJo=o~fS_j6Cf^_L^=ugzXww6}5F5ytqk
zL%vPsE7tKmI?grOXw|+D_8R8P%T5&TONe!up`$yahX4N5BjP2}^4c9d!5hEC`c1SD
zUi~9%mGy!OL5J9F?)&Dl`qv#Sshd+b`<YkFt3?YlAH5Sh`pu@K_Q{v~ad$lDHdcs4
z%&sewlAUL;pdpa`^v0``-rH_Jy=z9R^VeN|oJCGODOYD~v%W5P<oNIH2i+OeWaS@B
zRj=ZBw0ciixO&#1j~1_sXI%4~w&wNLA8|I_^JcDIX)~$epmwp`qfZHs7H)W)@P6*>
z?J?7yt>)jeER)aC*Z*aN?w0*CcU@!6bQ6-=x`8YC%0|JXN0|<Od^S0K;ac^@{*FwV
z?v-0kPt7n~X}zgGY3DOPmG(@xqoL2Ax|c{FjpgA=?>uNcFI()k@6`CiJ;_tgy!_D{
zbS`_(jy*x)U7t$xDjA|Qm)d=7E==g{{GM<=e8z(}>vtAfc-&=Q{qo#*g*Ly9MZcH5
z3++D@`X^`2`n*{#+CNh##$2AcTTlH-#q*BUrJ*W^jl|ceyvdf$`SN1Zqj_f?Di^K)
zR@$a5z?RM2_alq1c7NZqRfY~B@zt};rtPntpCT}^@6E!8hc8C0GW!|2#Q$rR>5H4s
z7G<58zIENsvZk*g4exUDCm5AWmfzoevtdi$r#)KCS4FgbEy_JT_4c~UD!UuwrWtRS
zQ_FcU-OxE_l}UMR#fhB<+G1I{+_p4k<VADc6_72tD59Hj>}k~sMTxcAZhvc7S^3s)
z+InpJOr3K64aMz0b$!?y)_bQveP(mXdXe6|=~w+@o?P0QfAa3BtPgx~JAYlxi_SfD
zJ4Ynz@`u3H^Gs(nN{5MV_z<PXKc{l@<3k~=%QhG0XSd%xak12PuG^X2^ZepH#m#Q+
z&Q}U`U=}uby|7(-ZqSW8@%K7*u3x$<&oZ1jA>zETr36c8e&B^&+*U`rA6b5@Uem>X
zB`@K5&(CKUOHQb!vpu{JI6;qBXV=!$nJGX1GoUWoN#H;0Z^y{Mpv6RRv08pXY7yu-
zBE5pj&<XM0hYduI-v6z+j_2gEkfX;p@~qMgdJz?CF4?i;#@$;Ev!|$h{d{}LUHQ*b
zK3l7Qzjuf8$@+)q{3{xr7R$>ANW>L|6mvv{g}ku8XIl}sGKE=V7hA<;uT+Is@8^YI
z@yU)@I87-#&`|m66|2oV+5gUTSg>QIl*yig2c|clIW*o8QV%b*%Ba6EyF%2m*7$`%
z-S$^?KIscXuOBHcs;;_g8dFkrMA+lW`5Ss?&8~@Gnsa8)q}W=9)@8v=KCK^gQ`i3P
zXA)-%y={G_K+|E`xqqpp?FM&+nWi|M%<8SySo-SmErY-ZXF}^vZ94L8)7530gLkLj
z+~V`G&YsUD|F%M*aj;jPa^2jQS3Tmd1#alPCZ@|i$z`Xv&OcVYd3rA`D;mYWB#9+T
zh_9H_7o1&OD3`48chdup$0j{xVs$k_@6oQ5wM?{hyv4x4kk81#AcwkaDkn29JGBVq
ze%{zV$LvF}Wr7~uYDa9vssxq>bSNxqZ<>-i+vm)KwDOy=(VyQ-3nyRQxwrp&n|@Q$
z=3hQVT7lI*_q4AxW;uOl;?_RRCOj`qr)lZNxr=Ls8`6vCedsy=aIs^=Vsk02KaQz6
zxBC?r<Vdcbo2mGBnp|U4c1%O->6Z<bFPV2q=5(Kx*3_|*ee&|sI)ensW&ebm|7opx
z8pvuded%Avz3%u+PQCScE0$fJYG<t065_>C(Rw$a>w(VXTX`NI*ZSJ*>wG__s^VsE
z)b*z+CTr#9zWcd9^!)xCXookqiLR6sV`5-<$jrbXg*{ZDD@Iy_V)Jhqh}3>xzoV(W
z!Nus<J*8Z&q$vw8^6B2Z#u++II<MpEk+Q#y$M(;Ee4ruk(w~IL?~m^k_vOoP`g***
z;wZNW+vBHVtxr|m=N<~#xad&Dq#jTCv>;iN`=MfLkGD^*Fq*fgd5_Z$XJyu$!v3ux
zz4>h2YZMncD{FiY`OMTcOR|~GYvsack0iHxdaO)ko-*y6Rqqt0{3%z&W(Zs|I=$4O
zMJ8Dzrnu^M^P?p8GY;=Qt3L7kS8Tg{v;XIt&!7HPQhnfmz)wh|dfifvJ$-LK7k3C0
zT~<=}`yk$~vY}=D&0o{5&ya0N-Or|I|NXjwD&x-Uum7&72;5p4@XN_yq0pN0#S?lz
zDe@j$SvJeFrt*6E^xF9ce=kr;Ja_7#L5uk2de_gH*Rm?7D!R7??|pQB2bW!0(eDla
zCh5vMJnnvcOS*Q>eW|OTZW#slCKUeX6?xSb&3x&;;@MmWgEH@#_ayC$gpamfyqJ8v
zx?5Gm=fb<&8robT)3O$`vAr(h_{d%{Y16xkl9(BJGuq4zzV_5)KlyJ`^7F{Kt;eJb
zp1Hg|<}9nbr{MvUSJ(|fk3e~+*drw@HMg1mt-Smq-2H&=YTkJ_-(9#A=6Bj6gUiSL
z-l<xyi%0*vD?ezv)zxj1!IAVS<!J9+iPiF#uQx}{dGh4SSBIBtioO-i`I^6FWqH_t
z@rui$@e%K07rrgKcy89_o8hm2ieCsd`*_;5jv2L-JF1@M!Og?K5TMJzAcH+MrKFam
zg70&D8dY6<`<USW`STyO&EoNx?ULHNde@vp>s2bJ^H#X)-YV3}o}gTyBFJbV!XA(!
zQ~&+ly=IFE45`b5md(w&HRH(Jw{PD*-p*gp9}_>f=1srTeAT9}_t|t#9?m?miP6$)
zrG5He=JNep-TNwcojP>WMxFh)KHo3)-|XxuHtA31aL$|1pc`@IvV_^>ITv?aot0*z
zHqTu5lTz|L_d^y>BmFWaeVFr1(Z6L`p?ZkH=0ER#y(*R1_&Rjb<)v}uXOm<;&a4!B
zyfM(iFng|8<NnJjf@wC6hJMrSyg$yF7qjz`rnimb@-^wT-x?nGu-bky<`?cyGrp+Y
zbn(pmYVK*AH}1aL7WJ#6XQqFW+{UFpC#}C^FjG+LgoMZPlsA3#d#t|p-Jc^@|Nq;g
z9EJYyAos)~_MF}`>Z@ChEwrEHU;RW!Q_Fu%ub#GkT3K}YR?S+u<qHmenv(qYfZDAq
z_ber>d~ST4(=5FuigETOrBg>4^ooUk{p>yAxNoC1SL>geYVWoupQoGN?Nz?8Y~OOd
z7Y{!5IvX!{pCkFFI6F|UCET6oP{@ft9csqs`(Je~cD-}|Rv^okX;zUBu5-OT^F7=1
zVP(B@oT|rSkx5b~FJ9MtVfmrx9ji`y-MW+3$5fc3TWy=(ZTsl)gi-$!<HTQW`Z}kd
zOxJt)zttl7d(-}80sqd$d$h!iCmgAqf5G#J$GJ|c=_`s)PDwv9$G7g+pQp?HJ1rl4
z7XKOf>HnXjg^ec5c5*5Gi9UWfs^U`&*Bw(Qsh_)w{N0>69_{+@x?zHVbCB!iCeDX<
znX}hQ7QALGT$B62koVT1;}7^lJm&U>Ywj-W$+q6Uck7d>_B%b@H(k@ZbESLgZvItu
z_m$5}-4JQY?A&XTe7V3<LHL~Vg})Zs3Gp*@e#l1HaTo{GZ&{^x{d3A`o5k}!HhQnr
zmb#n6a+B46hEW}>l#Fz!k3e?GMC}C;)7cu;=a%QXFSQq!7b`iIvouVE`J0m(L)vU}
z<y%WlmP?+VSlzhna|_E`zv(;&)sr`V*gEBsz00cW4}(M}l%HR3FQYwE`QW~+<2OHU
z6e{SSqjy>3i}Ms6)<%v8mg>dR43#WSJ~vVS-t)smQ9-jN-Nl;uVem@*>AEv_YO5^E
z_0Er}`10-1@5|-)uI|2kJ>Py(fCuwbC+A&X-Y?mw>hy>4sH4D}?_YN^h`n01B3jUi
z=hBh%xyyvBjDF1iVSeiCoHhOTTsP~AN-#{3YGl7Azq5Jv&bPWX_dL_)-@0Y-@Ml2P
zy7R_j7v^~VZ*oYKY-!ul{VDZysJ6LD-`c;^4?9LmY~Y%-;L(**aT6_xKy|k{_eEEl
za|+K|YxCh*&esQ;E1dMX=Bz7JI4UrQ$#&%{3AZV$_;m9pf1kvY_l@^frfuo#9L8Bj
zHs1YBQ$)U`ZfZWD+xSI#sm9Kl#WHUEs#~sVFTV3`QQ_nT!S60C^R90B-of59?dYtz
zU0!0@Z><+!?A&8s&f4H~uh34lpm~Pg)9Vkr^)j}JFqJDfpLjjP=KbLszjJ!`q(wsK
zu!+7om-5b3<Xy&>hkKe%&DC9EE);%YtEI;F;MR+|=NYbVh?-YcvE8Km3uDOlFuPl&
zy~$smKYr0TJLHM}Ql=j+TO_85hi<U^^Gn+-ZjJktKZmc2G;r!__RB9a&fTo}`RIl}
z5o(*(-e~btxv_A?*7dwsuYElv_p{NG`-WU<51Y0TyIsK7lTRjnSh7CC@myn7ho3|6
zHs{UiB`@;LvX3q?msY*PoaXX#Td}Iz1YN(|dY?8NHGdoQ^hUy~QVxsh;mK3VjN86*
zOo<e_(V~}ha`TLJ^Coi6W?b6B;AQ7{X#VA%UlYpisJ+c{3w>+m@|$_0wkw<PbCc7o
zr!EwpbGCon<X^nJ`zw2P)Rqad@0dJvR$k{{xaj-y4;IX9pWgUA+i~7XK3?|Uua6&|
zu6KWb?&JS<{oU`3KWHah+<Gza-8v<9kH*p~0;?zW#gwN@>R&q7&Bb*yH70fT=9<zM
zTV|DXwLUQ4@mh*s<hPVgl~Q}&CiNHZH_Au|3yL|q%DF|a%&=`aaP{luOhMNPXD-~!
zI=Xj$dqUA--UD5i+^lbHU3KpE`btKNOd;iIr&(5qHQ4DayqNNh>1WQ7ACKz1Zi&Xd
z{V4NbyGmGq&(@#YPu4$Sol)T`)b`@k!RQJ$UiE{IbW)h)*H%oN_<mjAvHX3^Q_eYE
zW=r?^z+qt3E_`>}u5X9mR-R`{Y`qq{JJ<Kn)Bh2-e@W=3?Y>)gcu|PI@DjCxTc!PL
zr^*>O98xUeFbRF{=>9jb;`oWDro!vGzBsO&xm`eXpUl6Rz90CVoJ08bu!;6M2ASSc
zT48fZQ|PMcQ^m897q)&|Bigq6+RCdYH3hK(F%!e5XdXV&&{;C`>rs^rE840Ov_ES^
z3cgt9yfh%mDuJ=@`+6oNI|bQ5hG4A&`&lhko<AY7<fYV9yTb2rrgqybo{DdH)SI{G
z2p5y(HQ5RGbn<lkwy#r~cqP!Fcg3S`8oIaICY;x{?F>)Y@sR0QHj~}v1X*3j^^tMe
z1s|uJ-Fo%Vq3fT7Op|-o=g*g(`7i$KrmS_6A7@H$@HBkg5cR<SbZEHCYr(o&-Mfbc
zUtX}BSkb>@sdBYoko)gbOv2CH)ZG8B78d>6ki-9M|2Bu?4aE#=Hd$P%wOnnoaR0%;
zrN16IypE5r%ANY0|Hr#U=Q6j;eqZQZ_Pgk@VjREFFWc$=S>wJg>uJ_K+_);cN8MM1
zRl$8`oc6L^Yrp&sEckJWwJMWM)#2-*S>hh4=06utK0N(4U%>iJReV?PE`9OJ$$9hY
zsG8c>9}Z-l7R}+mYM;u!DdUyJEgh~~)7qytz4V^b=T|o6+5g5RrHd@DbNV*-oMYfl
zJ#ZrKuA^%n+l6Th{%d5gJU_<IlP(weD62i~S$cqS+1q!*uZ6xm{%m0RoAGje(_#G#
z$)+O*uXigw?bIo~zLLQzc*6QQQU7n=E&pCE<{jcQ>*InC3tuc)FiVGdPv=4}=YZwH
zZ@4$UJ1W3*OhfeLo%51A>`l5S&sW@~lNYg=qe%bwbIs2mO$#o(y~$e7<vOLuy?WX_
zk&j2-P5pkN<LQND=SK&fRk?m-{aN=`bXu!|RQIav^F~%1C3oveo9!#A*>p^vTghQU
zuSRI6*F)(o$2U!%diUe<C6DcXXMYb)k`&~7r+D?`(;pcouhv!HOPltIb)z5GQ>JCj
zLRKlqU9H?LMV3ugN?)F_OYX`E#^_h)<qg_TotJ*m|K6&sAz<ycJTJ#p`6{cvuQ=U)
z*Xl&poF+RnDTmK1H?8qm`fPUT)5xF@qXW;nzeJxlPOattzxbkUEa%Hyo6fKwGJB%F
zalU%HY#V=>t-!TlYagHE3isPiicL-a@#^IKr_ZWRu&i5qZ|bd+E37^qWUD^5k>R%7
zk15%q+OM;tw>5OnXG{!UcgxB&&%*HEs>|ofWwySYxOLONw_iQ~{@XhFWp4kwpzAh^
zA~j0N9Jg<pAF)}?q`swA(dONU=WDV<tE9PtSdTTte9o-%XLLFrama|Z=zVd+1DljC
zd!se)OdH#^pS3hz-fOv|R5>T+vR`?3-6X@R?aoh6oY$PRyXC&R8@FGvOg5{H=eaeq
z^Fw)>x^Dl!{4cTof9tQv!2SLkZW_ySxQNYHeW<Tfu}4TM;L`1>!DZ7g%A0B3iDkaf
z?sqHJ+kF0()FX?x%h%g8=cRC7vpN4ywdLIECXMJx|BdI!zMu8aPLAo#%=nW!#pf6&
zElX5mc)#$bO11vC__zNr7J0i~`ro$QVAjhGD(cZ!vXgiMw;mMup8Kfz-P!Kjvd8=`
zci8UTIlHRU^kQ4o);SGT&#&y?qgE><uGH=|?LuZB_XGvwNp2>`<z+b|KCF~sJvTG$
z%DV^O|2e7o9b1#N@wVFcM3I-~(w~+`R$O2^J@1*ZW{6qaDXZg;MD0&I1#0L;NSx-n
zwfw`{LWeh5W$P~ndg#<McW!t5sxA4!z1i;CyN0kCh72>6jXwXKXCvg*?W5PaFTW!8
z!<?1(mv0gL#p6?Kxmb3BnV?NtB}eO@UBB4aOt&OmD0^$iBE=<Ja@Om}9o5NlKUl=Q
zg%5_A-LZSlsV?qszV64|bP*#3>185iiVJVNTc@(_UhKcWUn*=a9Ol|7s+&BIT|4{f
z!=y#;LpB`wV;kc9XWMkOwD0wnNule1-(DY8*?aSsIcg^&&7mwaU7vyB{|^QRS?rw%
zXonrNkD>N;)oqJS5B}S*_SxQFct!W(^pf;lTOS+0z2SH3{zuj9-ILFJ{Bb!zNu}6l
zVpd#^_C1>m`;OV&3=?G#df+PV?RV+rlh=MZlQcvcoEE-|NPnLH?f&-uJ$C#__v}h4
zCsZ)^yUT8~F8g(T&)(d8yXf@lhZRDVhhMkk=I7;Z-)_Er`^}@K>BnvOn4f)$e%Jn3
z&?Jqs+|8}||M&WZXTKGfNvPaue}2)TXU-As=JfMyffh-3-zoTB>L}lRM*86H7E4C~
zwJ)B3-ps7J_IkDa;fTLee2&E#r1+iDyRx{$dqdgz&Yev=q-873|D52?tGJSs{yaaf
z($0Q9OJ}kE{%u#6E6YrL|Mg1o*WFe10(YtcB_2fZzx!R&ld<iHP0Ie&+x$$v?6nB=
z{eI}8#IN46#fp462lU=_*YB}>@$PTchVS>=)z@2}m-sU=xALC9>-AsLU3vNw@9t@M
zAKSiR)vxxwS3bvnz3TnvDU-nywhjA^80sngeRFg3zV}BAt&cB#*}e0P&EjqIZYLHB
zb;ifoHJE;7(tlYdZTOvC_t<;ObI$B+H7x(*4s8$jHH`YxEPwNp^tQ$O&Mjo@iaoCy
z;d||${u`})nL>qm4hKHOY!-BwwRq~A_eGzz^4Bg~$So{#I`BciMN4p0^6~w9Ht-9}
zS=!FO+_8?~`(%R$S7z_KwlweSbg2)^uI(2tsh#y`-DUSxuiQRb$b0Ma{FQli>sHja
z&vxun+&26%+`aqRNz;CbKSx<~SWdIpyfJX~>WY+ltafO9U87%w&+S9&TJ%1Ki=<Z<
zem}>3=Yw9J$=Q|1@472rNHbs#{;00#^~S(^v3GVBx1mbL!nERF&o|6}5S_~%X);;L
zRZ6()kJ93%8+!aJk5*+KVp}-l{tUC$BPZ9**mQceP^Qwwr`}PW9;`DD@yYskZI)Hf
zE8L{bb|+~=9Os8NKEVrT^13bB9eyakXD)meRQ}A{MxaAo=bq=Rp35%nYdjtsUikG;
z_sxaGi6Y`n&N-W<d*?pcWwQU)mu*kl*NF?R(@k3WbN$yNE7?{|wEJ{MrD)fU%!w~k
zBBXiP&rK@fnd4D?zp4GX&CWNzLUQp_*>CP>@lTp(GE2%*^}1lWiYaeRI+vxcN$0~E
z?28K}7qNW^{1V~Vd3DW_BKsqm`7*8lpZz^DBl*qUIk#_m{B>IXm?I+ZMOwtN#&Z7^
zrIR;EAGo*UY41My=jonxGUr~gN5_;cD^+`temC*H_DdgM^Rt^zSHCP^@DXe?esrwo
zad7Q)smqbCnAFR){#@!3dl<f8zur>egd=-TblO<3-ks2Ba&q0==yUhp>`&oPo#z_a
zSO47Sk^3iZQ!$&}(;J!F3#X?!%{gJo;9O_wrz>*up@)>Ef-3)ugr@w=6Cb#3Sf0tJ
zFP94VFX6i9M%}c77BU;^FJ=boHkkZZ6=dzS_NwIG&B1b|q1Zglb4KH<iC^9p-^seO
zRz$s_&9Y<04!g@%tbSRx9*pl73#A@mH{=VDIhuFk@q_td&Ahd*ch0fQs<|_@_>$0!
zL-l-HB%*#kv6g$m6*{Tb`MqSdLdxdChf*^SJbrEPHTHn=LCzP}`_9L%p2>Osx9|-!
zud2KQY-KNg@~trc_U`oF<cbSZoJ@VLc!wmqIE$FXT#Pv9;FH8wd&{=AxUiz;hy8Bx
z_T}n#?{2>Se8=7Id+h=vyG76SwC6mycB6dHfmaN7pFW?wHL}J)$L@xf-3>jvintnq
zY<@d0y|%?=RSnZF`zPEy=D;(#=TElkKf^Qa%d#vUZ?u2er)>A(U2&q6`h)EZVH<3i
zzs?r;u6gFX>YwVP4)&iNjMz@<z4**#lf`-OaBYOh57TT`d7(}Yk%G<2or?9R6|<vd
ztWVBs_DC-YW>DF+hNU?2&FAVCpAsjDj=pszY{_#NEzbSPT^PC2{o7x^%nA3qJGC|$
z{76@H-QZ-vl(S2D;nA|9)Wa9Dqjip_oQeu(xL&cTll?c}vT7mq8kglfJ`<+0nLAd9
zpEw@M#nv(1@JmdV;{52%S7RP;H7okz^84%`p9jqG9r9<UZ_2LFt~ZL$*50w$chS#@
zW}Y9Wew+O>a+}B1LzDg31?Al*@nu~te4WoPZ~f-mL*?Js4<E1pJ3W>A+AR;Y<dr9G
z$4;`|b$6QKHL=YzQvX|jX=<}OefC+psZv6Ar$R=CV8+eMjJ#{y>TcM)c>MdumU%(7
zQ_^3WNFUy1@hYH#iSM9f&Ph)1WQ*wc0W1nv+0Sw~l)rCrWjMEgA9MT$>mTPGPbaK!
zEY5R2&w5ULdB(~Qld`{6OR1%t<&H5cdS}ec`nl4;XPx*K$C|%~CeL9{w)ysY?_O2a
zn~%P&SCN=e{`bh*`xhqVT)+AI`+MsOon;x$g`T`DnmV(6ZR(6p>NW0V5|aI2y>!?2
zo2Gm9gZ{cKSvPlwwb$PxuhWk0ZF(7G{U+;cWun`GyZ4pk7JRq#^|LE#N_@p*xmsYx
z)3l2QA)D1MY+1|HsJlKbYFa6iZ=trZ!N!U2mGnImuD32QU<l!pKFj}p)`yQde@iT{
zifnsVX>lp1YfWLzzq0k78ik#U#Z?rw^lIL?@Y%TTkZRuP5U04M?!^x_HSwKO92#3~
zRaDx<lpihZy8d8a*Tki%2@I`*HH|#&jbF|@O#b0%EL?ps_lCN++`bp>jzX<=M!!5Z
z9E!;~V#zw^$re9TDf_jig>&~lPPymS9N+RwzK31bfstA8Xt}b@616w?HT_zDxJ2zW
z6-c%1x@%Q;>g}z=?8~o7`$#!SnU@MK*F2JS#Bq;a<9?lf;V+Xn<(ltnGrq36?RUlO
z7PbtLT`N70i-*Q!?>oGR@8ltiV{-G^f0mXN?yA2f_&n)|W8=J(<H~}zTJH}`v)E;1
zWTgH|HS_8OqZoa+?>x=>8kb#=E^3!K<K6OyDNDWaY2z=hsg{49TkG?!d9s_S_CSEl
zgSc;Vcmi{lX}&3tIVM+khwW$UV>_2Zc9yMmvlN_Mm%UJbD0I5Nt-j@g`}TGFzML==
z+rI8NpGMg|_RFqryHgE=lTUsTdz{5AtD9c)`d%z^Z%HEaHQC1C1J~BCTF7v2^AStE
zqgPo@@x9-rsq>2=WW~>8yPb}#sGe53euHt25i4`?)@nDKgUMBFf-}pc4_j}(bAvs5
z>fu)2HIc7E;?I-{u~+f$=y2L_{h3VVnYk<SD;i?-qbhFvkxSpN?OS>IZz;FnzJlxJ
ztq-dgF(0%1P*t3uRl2~T%lAak(MO9oL)(}=ez-1FnVqg^%HeolG$t&ZQ+?JSXD?B$
zj`jX^$^SxB-Q`!51gyPaF51$a>+Dcq{(0WxkAkiR=c-MT1=YXa;8gp0FX>~-74BMr
zqb&9b1<$4*vGV6AR;W67=fa=sMxD#<P2)QqtCo}zA%Fg8$r(41D&t25J>8Q<`c5@{
zTqRed*4EU*ay&_|U{X~agYx-DmErjeyU)MBXBo(FKy2;{LD~Oy9g8;Yo$;$;+Tp)a
z9BuB&>Fch>rZ1nF%ltxAJXQRNm8#5ntD1Lv7I0V1H8>MGr`LGNjXn7$+Ua~eogFV3
z4a7=gbIdj!<LG4w_s-js>G6Hf68T-+9}<kOtxOdB>DA+Pyr<<{l|zbM|5xV^=bwfz
zS5{GZ{Io}bccI;hjmNHQ_@|%QUALvs>OxfOu2?BQEp?||Q}{C<B!xVB?S3+|Kw{DE
z$jj#grA_)J536m-d$aoP;qR(jx$N|_c!R><PI{qTwM28~*3R^At&dms9=x1<=LF~W
zWSd3#JmK^HoT&K5W9z#0!>U=_qISh%`@TN9^6~uSD_;-U)NKr8QH$kScJkk)TNakK
zR<*TRnXkh>980-Yefi{)=x>aZiX3W$Ha~j2=UFjheM&;0XTE`K`l+AGpIy2!e~Z}t
z%Skft-~FwsD7vum#&@^o)#;-0^Z%7O%5$-J%b9&T%rW!p$|k?Aiwnx)IUB43-=!X0
z$jYN_ziG9=<wtV!byhs}WD9PMQ0yoUly_O`D&N~;D$}^b(R6Z#q>ekcrp32kffDV_
zM-Cb94j0_v5nrWeW&DtN^|b1cUq!Dgy83!!c~{J=jj>&lWPCGNF4~dt+3E8Fjg2>V
zeos5cU;BxDmLgB{a!td>54nXW_Mh*3#cn>mzb@=SxfNT=EX#XK8;^BLKayPXVE;jj
zLwRp_c07D>G=gPyZEmco{`R7>oqS0ulHXz^MS73j+9#l%ymGy7%dWE56?S!5uWe5+
zzVhmL;5#`7<5^XSFON5r?yOIpxK_Nt>^vhY_m16L<1<PEuY0_Ip_H%k=YQvH*)Kvr
zLVt3%1pMLg7v<b>foblv7mr)t)%}caoBY$aw!+CxjoWqI>*w3w{P$#@eLe8{G3F^M
zo)1r!o%qL)#mKLb<8(Q$=%_ba%!w1)&MyzuaF<n`yLZ@)t5*Hfg94}GhWE=C8@NTv
zY*E_c+WCdM!R%02!KubG<yGgBqnX<aX7q>UPGM<H-*fodiStcwU61VKG0I%tDE6pr
zKF9a3v)BR_ZBz_g-LO_EtYvYv(X(u;##5cD!Pe(^eD(>&K02-B8?(?j?uAsZ+VACV
z=RTYFUsmXmzG~>7dg|Q1Q>kxvnK@+z%@HuIYL<Pq{D4)nruQFDF@29N7ooHs7dMtW
zg+;y-Ci9#Xn&>>!*^2#WT}N-4PQ??QGp+7cEq}R89qR1AOSVWmtZKWz)x%Fv$?Ld?
z-Gc8y6$g{vMBhmMoT1*+Zy2YfCXvYUe}?|9yE3{z6#hS*oMIP|YjZPv_N;`hhY$AY
zUDIFw`@pj`J&lItjhFn7*epKt>2mkGZh4*0+QMfA_v|;i7d#_L@|?!I_U1;{-PX}r
z70>(byp*-MKh1ajs%>k29MXDedz!`l^&JQGwK>smzb^j$YVOt(*Q%bp+n^Lvm%TIi
z%T#8Yf~6wX43ktjtoaw+J^pA~Mai7qSNWXmW!g5Ft~Ha3w!XBv!S;k|<^B6rAAe4J
zB3G3!E%agfCXLncJuBpu4R#7U9KHKE@YBy_`}$Y?61VvHHei00WvqDn{QN~i@6S6e
zeCsj$)84md&-z-v&ieIKWZh=tf7P#Cm0mV~o%8SPT;ZKc1;VaoJf>3}%Rd-A;`96|
zW5>4eT=w_&o$s6OGdmgm3hGR{v3cslkBh|kzy9U^xOdV&zWe%XnybI}h1i#_J)gBW
ztn19@y}~biKF?4OtT?`Sb_9E*_niKP5<PLTH+N;_)VHc|L|@IC%DQ%H#1oBUWv_DH
z&yzJ@bzj2Ude>*iNU2EU1+qO=cS?8uW{cl@bGEpVeE)CBrEwO9Rr$*&y4<r8l-EzY
zF{`_E?SwaBo2H2Ge*WT1q~S}}&?VcszO@$|6J%>IdT8D&J+WB5UdQ5V&h34(9$Kw^
zS3Z}knq!8@ZvT%fm3ij8IavH|@<VIm`Mu8lNxx6}DEY`R>{oSMDbrx{txqb@Y}spG
zHk(t*e`a<xPL5=ewBY1yU^>mWxKsC$YSn>V`36n`Gj`7Yws+o^2|F&$V~Y5wQSfKo
zhRze7PS;Le6z0!~x5?_+8hJ|H<49iLMV@K?8!vbqI`LHE#SF(K>{*Vhev2;O9^)r`
zz<A?2Hi3sC`tLW+Vy#v;)=_awnJw`85v$>`Lv5K;*7LUh72-@gxJjsQgJ+;OS0C@u
zT^l#P|5Djg+_>7QO({`e^X3~<EkwR)Zhe=LbmU8PNm_D^y~2d&PrR}?ne`^hS_)V2
z1{@Y#Zjj8m?2a<q*=Dv^M{<}S<Z|SS@l90No6p}IvgYqDw-bL2oDM0jR_8s*E7|(;
zPU0f9Nnh@LzaMQVw{EVVPvP{~8ws4OX<h|y&ay0H<6X4iWs}LmMGHO^uq$QgD`v}2
zSn~d>Va;vfPi-th%{~{C%CE~k;5Rn&nad&Od#k@H#93*xgLdiEoN6h{EjM`QziHXn
z>z~t;=h`kT7%*|o)4us<8I9C!kL_FZZ(eQC6X$8Il@527OB4%MIZymD&nNk%^~MOx
zP2v&}X2;G7?bsNxD1s&LyT&b_39l8Fheb18Ia{42f09qdjrXhd)5gr|syjIwca`6)
zJHJ;Y|Im%y=660Hzh}EetMU!+_FJ}Yv(i`Y%J)0Ze}DVlA6DMiMCY%1EA%aIuR*UN
zo8)$nNj?!aPQprUd>?ffHM@_q&oe5xu=tYqQL)F4Gx*kbYaT2z4-8bBy1>OPud%=1
z)z=_g%46DsJ$65RZI+b9ISGbs5Z@pn5|qj_MMrpkLT--ft;pw3?<g)@wqu(4>i(E`
z1D1PP-DR#HKW#iX$MTNymM16O{6)lcUw$l|uxQx^71yw!t}|2F(?pgu2^a-k=A8EE
ziLBS`;|`*sU)mm-sqS#ge=te5K;oC)o9&AiZ$JJb>D%2fv1Mv}!dIJiDKnLDw}gsM
zZLas>pYkwoOTDe_{u6dFfq53E0^`dj?Y(MucT-x*t@88r)s_GHKX*4jX1ZjwK-Im>
z_lW75(i^v~Me&vR&YJ#l=dZx(+x*QIUsg{26<FP!$@l%oyY;_<BZQ;m{Zpg@`)42J
zcMv>qR_gAdUuAbW47y(&Ui+v$P%0s0?Z2~SFJ~9H=+AqtzoK19PXAiZ%V-7vZDFqS
zjQ^^p8(dg$VyoOl>A;E8Q?}mryCXKiOH<8znO_C7P`g$($CNI4AJ>T!GQ9oQUKM%D
zn<Q!*`pbr+TX)*|Z8NNzIoA6w?06d_bW~ZmY|S@@sEE}zzE7$;)IzzP@>luHWxo3T
z+~KHf-xI!H3OA=*jn?Q@md=hgy?k)3nk|#Ivd?#u*TN=7chX<%UatQ4<b*#rzQ#Qj
z3gmb*(d?GdllxicT>UmJl-cIzrtR^1Mwiivm|Vurn8}tGiaa+QPm4Jqa=z?$y!Acb
zDC3*cQ~eb-xHnGqv*~_T=rdO$L1XIgs)a0VD{TdqY-<X6B3pkV;-mVViq~&MUxl(u
zS1(^5*EvIG*1|o0N47TavUuFg$QJ0oe6dB3>t3;Ln<rUZArIvOpB&$$8D*|BEpTOg
z=!4lztFJXzeEO&uKc)X$^Nfm$j=S}Lc1>2CH;?mmrPxjFS&peQg`2l+-XLpv&>(ik
zyfvl$?Mv>39M$$@2$_HKyX)si-nlP7S*YhGJ$J2jTT&@e>3m~)N;k9T@ux2P>n&}q
zYicVd9cORyy8gUy&29B=wZ}Dct}Z*zbIr>7q1K0!zEeZBC;2AsKIk=XUUY_}$Y*CA
zZN|n3X2$4O);Am{zc(oEc6YwuD44*u?rqV0?aiTa)54k^EPW*sTE%Rp_a|~M^fU~(
zYqfJ_-!nmhK<D#HDSoYIMK!h-X5MHzb-9ae@tt4MbIz|;TB~T7$Wn2{{eY&`v9beP
zzB^9r`lWRs%|q<OVx}c;cjP7Kd}a_{DHS%0r*6}%UrKwga0IZfZfxPVH{0W4<Ehzy
z?`31wG_^gMueZcI9{b-oXXAv^3k1|kPUX%zcKxQsY57|zAz2Z!t2eBcx2zM<e^nOU
zS7KGxcth&e^t0)=M7m780{8f<`Fs;L%(Ojst-yj;yydEa#E;4Un;lP_jeE21@7;vN
zD3h>nx;3gdXMPjAeYyLQp!yo!R}Rjf`hr#k7R(jrJ9t<4W1U2x&Pss?Uth^FO-kTC
z)sUzC+MmZ=d0z3QeH}70=d!)wc>6qZ%VO!Qug6$++;b7N7dR?roA~Y6t@l|=q>Dnf
ze9Jg-{1vZ3+U&ibCuN%mEB|4-vwuc~mu{Sh;m*%B^6B>H7rVaenz{AV?f?e2X{tYx
zUOYHsXwNclVWlj`y#pU>44XHI=AD!^-Q+v#Ad3<gyV%u3UQM^#r#+AiyR5L#`Q;78
z?_8nVyDXAge7KiCd2{yN(e*tZw?0N6+TZ&4!l~$lrJ@Jsu9}iDVd+|PIp*#l<I;jJ
zUdy&7Ij6*23T8UK{h+w({+|M(=`DZNB@(u|&w6Ga`*P}S$L}%DZ<KQRx1IG}AwMDQ
z^eW{Nt_6)Zf8W<~oc%kEhleR$lI`ogr2CB5S07rI%V2hM>J$boiw?WgP4bUxE#KY9
zY5ZT;Kbf~){Py`JCWrQ`&U(b8dumgX;FrCQhF7IFHx>W=@@T=~a~=DI9@czl`)l_)
z{_{WHH?Qn$PcS83V^MpNw)<l9>GPK9*FBB;tfi%$Z#>E5pS;Fw!OHh6&VS0CLn?0H
z`1Nvq^!e8_mh${`(_862@z*-vh{&r#Q=DCItmflMo^@`CzsZsy=JM<F&OC8z3iQh@
z)w^{`wpC8}sghto$X$)6&zJRPPp(*UN+uv>qDHENTK-3oX^zZ`r)Y^5Y{||4za(9K
z#mSz-Ca;PEcz4RW9qx^@`onPM^v#B=`(7W)FROp?_il0dHuL(Le~*RUZjbx(=TEDj
z*al7}(`9S2nAdneWB0qTR(CJE(ptvlQ!9K}<)i{HG)<OJs5_(i`1$^4y1sQ?mz9@q
znkp;mS#h}8;&TpvM6_pL#iJw177usazQk};vCZ&=)dj6M`|0+!pW?Gb@~$szz8xO(
zePV{@`$ar5hht^D{olRUZ1efCa7|iA`$9I&^$m`3k5#yWCoXw1p~1W4iK<68U)syN
zvHlu7%>MfNFMh9F&Fq{Snq<J1!WPst)z8-daoVp0iR}HKqi@ZKmj3bBO(>6pBl;Hm
z(em3*gjX_gpP%^k(8iY6N?Ey#b({KH<R8iRyqhq6nNDxY@{UON<36oxlINamuvM^s
z$s5x%vw8jn-_%->qiUksL0hdfLkuQKrd76H+^=XU)_TpxOXd2iQ_m09%!%U>x>>td
zJ=&i6*|QeyRlbF9Sl8d@+@`ju@Im{X(>x`;+Za`&`VLzhTOhOc?`-B}mQfnlHMY5K
znON*T@3`WG53v$=Ir5VybRLotU~isO6TczC=8KC;cfr{M$EM$|eZulcN5=B8lc@f|
z(<{omST^3As4>BPsq2eMQU7Zdl4q3j`)zm{7R)!Vs=IN!f-mRu(X{h-t3E#F&-;JW
z-+uRPdyCuW=jZ>k_;K*(Ps^kqcPb5U+?%jlVm4c6?cTaAe-EF({dVzNdGlhw6@FYs
z5-W>#Nu@^XdR<&?@aFR3FwO>z6!p^eVsDz(#;|bxm>Zy+GBN#ZY{%8ROYYv^Fnxts
zkf28R?zVm(k*xhD20!ZBdDon4zW8NvYR!751op7qa|4TCJ2w7Uq1qRc(i+G)*(P4J
zzG5cd*Il{C^j>aYZ~7&F(OvRIbE!|q;*Pfp#?7s-)Rr3l*)To7am}u!+cLFxG@OyU
zZhYlT(MQupP2J7YTEv(g40ODH8FQOV7211O+&;qpadyeYQil1}kJni@YU)ewl7Bce
zI{n_u%CN_)15WC!-sX~~todpxA8V+iG~4^u!mS;ZmQyDz>#;n%bg4{a!MD3h9#876
zk8(YB%4$>aUY*bUXM)zLO?+xrJmrFe$cK&Vrm%0@S92w(?tSR=Pmc><o!6;}5C0~2
z+s}5}!qWMNA6czicQ~upweo6Pa1nFYcmHSZe?Q3{@3wlaaVqrb!%u=9Z*Q3`j&Mnw
z$#mA<%gFMVt?2w)zb59s$jX*zQC`l<!?K^bl5xl7f)1viv)-456mIOh)~NMyS@hCa
zzLW;3mfdNauiw+X`l&1+QqLq>*lcT^R#&CB?7=CXM>Lt%L`B_vz#YJ66YzM+CdG+O
zdyhN*b&5SunEz0tIQLt2#qma_lBvgquP;3DM@)xNW>SN2%Y`FpIp*seCwKL5ikK9z
z87Z77X8)Qt;gjPRp?i$S#Xsx5b5N9dYH)awY4;uF9d&*Nf{r_#IINFGf4`(L?O=z~
z@~}+{E-dwE+HvjX&s`s`R5qS?e(_jJQJmMw<0lelU%G9ez#X`ldDAA7DN2`Hy^i}@
z3l}*kKi{|7+ULxo4DOKR*_UQBDewFi{A0bZLwxJ+sCZGYO}|>Ftm@?nmi64sHszh;
zI>8Rp2d`o@DrTJicBQL7^TV?10V*voa|2FK{TBPT@Up`$i_ooU1!v3_f3aNuyz!qw
zpzoSXCGmM-u{#(2W0+xbsHb0(VcWWOUhS!IA6~sKnOeWs@3s35kLx$}H3Ax6ERvb^
zWaTg0uMS-f+a=~CpAzHv-5YZuRPDl%m-inWlWOSkiu(Ot`nLYI`dfcqf1bbT{Oa0Q
zRsa1TNBmFGd*!~PeChI%RgcR=?}dLA<x{Sj;%~F6oJ;%CoXdNKdZ%w%y>`)-Us96R
ztSk?=c^$eotK{z*8>gV}2hJE&|GR$f+c*AiVHZDGTF==yyWLofeYU!J!n^|)|8>jz
zc)Q>Haq*4FThVRrcTbzAlGwE3?5vEdsz0vW4m=ldrGN9QYX=%y<{uC9<iE5)=Zu!6
z+xmx*oU2zJ7AkvrHF&z~71M9Q2`X<3=4|1JkX})B{8XmS@jp*j|78_)zg#u%#GW4q
z-2E*-Y-71P&n!pfsK2MPmg_NBuduQsPO~B&bpJ|@tn1T%&3YlQuRQL=r7It_M0T1+
z2=~hgEYbPvvnX&z>HQgB^0$9I>z8D%CI9Mi*2^7QcgjMpt$LHFKKTo8^%0M|kA%IK
zYpuF4r9s{HL#Lp`l?jcLbOR1N7JOPIeyaI_tM?%*b&+W?`eAByPj@Wb@a|U+TXM**
z3DYW1amMbAyLVJE%rd!Jf;pfu^v+bdXH`C%-b|Tw&p2V1;7Yl9f~R5`W?tTR)8`Gt
zpFl1C(w2yc%vW+B*4OOYHMQ#Ivr|vRjx3C{ayrXxf9+<pXyga;Z<`CBZ*&%aofr{v
zae7<5RC5mhitn=D8e;3V90}dd$XvUuqS_&OLs(wg$+GNVsdds<8o$|mk$E<iA>mL`
z`iX9fD#jE44s2<8zT@yIjWpe9-}N-StKP~*DJU<|^IdVFVy1TiPs!D1Q7o>y;yGMV
z-M6w!w|v>goe<`6aE4*}e6Oerzhf>f?0a7KGf7VDKwFnVM6jct#O=@Aaq_Q4=RM?i
zyTA6sJ2ut!g1OVnchzq{wKKZl^|i@P7cZ~Av&Zt#>d&92?b$Oc$L#WPZPt_jKekm@
zFH?z}q}$tM9l7N8D@`l${QGa`*)Oc9Ht702(VQ(++IgCTR;G682?@1*npU&q=g#cB
z`IkLCeR=xb%ah;btN&(S&*#tgZTIv47Il?XCHpq-Y`U{SGB#)GE3Q9+XYWnDzAGfI
zW_`t!f~e;kuP*&<J$=v7x7sEj!(w<Bhsv3nr`=T(=65l%<ga++@ObYFyKW7gyd6oQ
z7u}~6==(n`U%T|m3hzcyuLIXY9cOMz$dB<WRtU)s>|Xvn{EE$--(HW+o}OB_%Hiah
zP37FzgD!S$dzR~MdAnG|VWZxg$sc+aM7gFFR@F7wJ$BnSqczH-qEq)O*RiHxFZYPp
zpt_fNm+e*V>(0Fx@v$s1%ptt$0H4(6@72-zSu+{0ZZ>W0(QlSd=~z2McFlrmtk2d@
zn9FeG)mv5WsDK2oYKc|}cC*!USoveVzI^_mFy5m2w@8m~;8XK`+q$G5|C3>w8);vi
z=(bL3)7~hxxHUb0Qws_juTDR{FFd%b!^f$6s`4T=V{f6_<fq=7KSh4%mrI!}^ugY`
zKW^>0|LKq3i??$Zf8(xu|A4i0#(Dib<8zySvR}A1U*u=aBi*XCchVF8UbVY;{``;s
zYl^CG|DU8Q9QK<z;Fv>*taC!d^`Da?H1+tlu8F>E{mb*{&!gJ=#r5_YSo${#*G|$l
z_*M6ltEX~9&{}TsB$vgi#dl2fyu-K7m%Yw)-p}Nh67M3e_4+4etfuDs+%A54`=O=f
zpZ=7a@jHLNTGDm(-QGE;H0~`BNQqdm*C;S>mtd~Ag0}XttW%3-oc0x4zBJTlnb8lq
zInVr-cx_wZ^nIUqi)X8q%fej!9nU6CKN8u}!Vz*bql0n3@YPqEpIv_hYI)_aR}%<1
zt*q^mo3$pp)Kz2S{0bwc1%(UmrIh`>^50KZKEGDK{c)&e;MF}3zG#ItT(_OielB8)
z+9C_<S^xG*?R&8M+xuFs7GVh)nW@e4;m<Te4>K1XnxPQ5vbnJGcz22EbipT88(yD$
z_gZzQn!|yrE(JUGNDsw;=WCxEY^khl^!TuRSJsth<~olKFr|0&h<&~7D6z><;c#+j
zJ=6Szx5`$97Sov2J+>#tYhSpwBVehqz`Y9xV`@V0d&OK4_;%!=%Hks#rXTmdiJsP>
zl<-N2OOU-l@x#J6(IzJ2HO*<oyIXJk%$uAQ6!21f(!DPSg%noFU%hy|>%X#1v2fSc
z#`9~|NAds4Dh{@Dc08(Y`93);a=-tCmxjj4&Tn03?lLqkch-EDRlV-Uhs_)ET+f`@
zW*p0MdZ7@%n7WQp*~zI_BSViY{KK01h&$~n>qdFEHR=T>N3XuHDE#Rw@oLfJ>+Rlh
z$_$RI?xHsyRlHcMckcOWgB@$T+O8Geoe|?Z#nSbon~$hLmi*a5%L2VAdqaZc?`c%@
zY(KDLUw%lNhQku+>8~E9ZZS*!5r02Y^ZeeMSI@n^_E<1|t=Y~Q%d5@y)`X<)UDc&^
zO7z(I$<gP(&WXSOrj$32p+oFv$GL>GyA~G9Yd>!kU$Sbo@#f>tWM>7QeDFo(dZ)DQ
zd85_3B{vhw&L-@$`lZr+^y2)K?9bN@FFNqt^Ho)1o#4x^ccMiOeaq*lboq83W)#~L
zJkjaf_U<~dJulqvq)flR&?Bn&zW0rr2el_n;Qt=?@+pUV+#8Og?A=PcDi~+`@3fRU
z()+i0`u@G!I9U!dyYd});@+_*HiJ2BF|+*C^%9%R`24?}<Ll%1(<|$@QeR$CCbIuu
zM0R%cQt{+{Pd2UGnUcC-b550RB#ZwCh96At|733DslNH<-*WNLnHfKMzsP>}3(82o
z7gz<FOucECsd#8roTJCraK4w{Y$mK+v580SZjOnh{|bdL7jv;q)`6Zy5~p^XZk87N
zcz#o7o~m*Ro5aqzeXURZpJf}iehB-Mu<y)s4!aZe7vBUO%;lKmwcY%s*2Jo|rIUU7
zE03=(D-2Q9kB~mTyL!LeJedIAgxa8t{eQ|F&u`uR-s{(?J$B4jJelYCY+Z8nS#hk}
zX2F&^3!anLRTb7<(T>0Q^x{MBH43*czPqwof9kdw@~b!P|GRkcqJ=k~?k({U=SqHm
zEV9R6d)?_PRwwtbW{$FY;Jct(Saf54($4&E@z0io8cx}>KW*Z+X{B4&Z4N#Y&}X|w
z;_tVb>SFEnZaPcX^mHowe`K57HuKa=`*mis?a%sb`1tPn<;Bf+jc=6ZA6-{`YSY^P
zzSeW?rin`Yb-W-P{-MvU&thJi%>%({D$d>OOsY=EdFagP{=(mXpW*Nekw5HGnf9OZ
zJ{($@toQm+DNm>_i^YCl<I^G+ci+3R$orCes%O*>&S~HB^fZ(+o$i>p?g~qpt+ejq
zQy)=Y?We169*U9-So-B##>O>%U58fjOb?4a=Dqi=(^Y9>7u}mV>XYTUHcc1uEI(o&
zeBk-xJ16UFwmdK_-R>syn)T3y*&%z^_!$}Qiql$OmZkL4ZQ99Of}HcqtkkAx%r|j<
zWElGC!kJ%j#_K1Yt~?)q@SeKIBeT0@tzx?0_SJmP{a@etJ3e}cy$FAVlWJ6YJ9F9b
zwH=$~me1a;q%~>PowXJICtcb?E`&0E>@`pGioA5d!sr8&S%X08#yIV;y$iJkT~?W$
z6!yB#;$m8^_b>1$#})BUv-VeJ3&!wW^9a1`eD&J8Q*r8ZcfT~AZvOkyk2|MUP0wZM
zWEN<;xKbl}8&}(}dxveeFx6E_sNC5uazHDu>V56wrKdk$lC-RkleJ#5V*5+BW%|k7
zo{Mb6%XM^Ldf3iC@^-s{TFOK%4v&`kt&OjmboMS!mOF7@`_POht^U`tw*Jxo7WCe-
zbW`cJ>em%^QU@>2TCl7*`}94rtG^u-&&s}iY^QZP&!hf)<dKy^fBCQ9k$>%~$-c-*
zTJhomy$z~gE{3E={F4+}t&`+C{TutPDJ@#N6FwJ}ivHnR-@X37Q?#UHTdv|6*}{`G
zA5X^}nL9hOtnX@!z`_k5+Z-hdALmrnoaAfjFl^KI`86@1c>~AyiR#jh+A)lOL#>bh
zKhT&mU!O&X+x>TQtk>_iQIX%?`d!E`ZwlK!qfC9pBPUV!rw*ZO>J$Xz*FK9my7K>o
ze;pQ6PPK>bie==NFMRF(@LP-J65bh3hO!3jU!FX6w!7B<t$9!Wo5o%LS4=IrZCmqy
zijZA{KKJLo@_4R=F|DrK?s7ZzXWdTT5WoI8uVeoF+cv*FR<2<amOCiNo$qDVd7L|I
zt8D03r7K)_A9v>|U*3`Wqq=kH;jD+E&5!OGKH1<VB>W+7j~$EU24(&0UpI5>KdD{t
zD*UaKufUNM*Yw6I4NjR{|EFEQa*OY>^qwZ>ClBr&?7l0)rc~a<<h1D=C*K0IFHRTu
z-}?Sue|z@qZ(_02mV8~#xXe%cw)GE*n_1tg7xV1YJg<DWMg7+VQ4wW3A5G6!a^6X+
zYkR+Qbe61?(6>FgRCuS71oNTXfUnZmme!WOj4^#Mf4{k&`EC37+WR?m>h-0!<X?oV
z<lWx*Np!1Y(qWHZZLB9wZBO04;nyt{k(UQu<W^_2{Wz9$G*~aK(dmhmqM^%A*)vn+
zCCzV6nlHQF?~|i*vAUA2aoF?yv!1SLE!vZ`X0h<aGV%K3U%u=9`#ash_eDIv^Q<-h
z|M>s0mb%E!{B@DYac#x*R<jt&rcI4qqn-cl$bFYKfyS`KZwx-^Huo$pIC)Uxqs205
z+r0@qOZvEHpAGS;KF!JGvvSAoXOG-2WZNBV*lBe4lIV#8E8a|MzQyz6&#x)lVw6_|
zg@v4Pn<}^XI+yv>EsP%8BC&0Mf~W9IzwXWbwbO~UV4}<0=q%>;0=>V_PPKAY#C<)K
z@pXxncVPU=u=3@O^NWNxm>qn-L(7}{71O<L+0M(Hk*0o6<5L<$CoNj!RQB3sUh=&Q
z+%^(RS90WEYkR3~Q&hHS-hr;<j@>CeB4yX7ehZ(nG$Y{XhVtZDfvf=sW>thfU1rJp
zI!Efwn@9dron@8<&ifq8@Fn`pSMRqXftqsN5<cN?_15;9^qGBF<ioRV5x4PjQ8_ox
z#&zGPdiFBuzD={=`#R!IB*z}jgBR|Gtdjoq_0^F_tEVQIwoYYpbhU`%DZVBVu5mOq
zNqW7}?d&c!=1&r5m=@-7`mR_}W_EgK^hwisl_7KMce*^^*s#QMT0`o(6PvfZ=e2#H
z`{stDm8sL?%)2R%+%J~MbFu6@GD|;++mmHx*<S0vdV06Trf3O0Z2aFnrSjnAsk7bf
zd3#oOB=_#u35iP!``SE}^^30fk)7*SXs=%}h4o<X-FXwdm&G~mEO|KLN~ze@C{@ek
zVAp-U55(%T#6Hi@H$C-Nby>({L5`4xvw0JEW;be2T^<;=Y7_SgH>Z%P3V}?y+FfT<
zFR09#@n(g$Bd6}QwI8o$JTN`xE2<UJI>XDmAT#_$wwGLOgVU?&`))D)<g>1<-ci5f
zv{bt9va^f6J&d!M=W_3ZRbp@5<i=-TlB=tWU#nj&(C>LrP~2nCRx0#I=o9BM$M19c
zcb_-keLH&Y+4<JDZ{OYfw_C62g7v|5M-^3c>OCcXRji!JaVjZ#_P4a|y+`ZctQFVa
zGHt`!i)@-q+D-u+iDFfXCV{ioaAa+`8F*{|M+1%<J1V~CPE>eUY<=ti?~Ml&w_M$~
z)nMM!d3CpMX2osW-j!m%yM^=Ij<}`4oU98X`x<u_Y&_U?!)DouN!Nro?e6$~IPpR4
z1Xcen!g5!Vy8QZFLt8pJV<(DRCLWu$PdJ_F<laq-m{wF|{Q7G6jkTn5rQRctf|nnj
zWz5MCVALtq|M2hp?A!JRvNugm7`RMko;uTk<B3nowZDIDS00zjd7<m)erKzRwsYba
zgHvVEUIx~yJ~Yn~{8C=VQU1J*d+J$(PKCslL$4M@Z`!=_5T}5K2WN*~-I=(<^;xU-
z%(%($tKM_-QjucQ1*_s09sO3l@n_km*`4oKw0U3E@MoSFaQl#~LXU#tt(OI-eFWNN
zq~0u@cI9MYp4pLW>3?5;ShnL>(d7qTB3$=Mv^FL*T{~fa!YXGzU&Ir)DW{clRZT3k
z{i;{ZxO_~3C(!Aw<wS!MIX7>IvHl5?s*=Ci!gJhhTHy5Bb^AB>^ZEb#{b0@SXKx-{
zefWFn--V~RyS`t%P<!P*m)SWko#&n`TqPyK{@N}-TsbHE$2)wOc%{7k(lO!5cmI6d
zVNka!CyLqkM_|$dzI4^lKNqT2JzZ^ESrzeng_VBJ$1nR=Ii=Toq-~h>YOQHc%J(-r
z0&CJjK1$#H+3@$os@4L9(~)}*w&#CKbAJ4|(0=v)(uYT0D6W5)Re9K@Cfzpn*0!s5
zcei-$y#1ks`><H5*18=(yC%*$@yPIfHM7XKAG+V8-;{JuJkH#E#ipQjXYh8OryI7L
z-1vDp_h-rNieE9+Q3oDZKIuA_s`Z0iJ+NrSgcCfrF3XCx`#<)dz3K1LxzeYNU;Omi
z@=EkiSot2EbDXD@f3)=czC6dpuJW~*priXd{h|yLkNz{NCX-$D%Fb`xbyWGNh)%wS
z_vK@eefCw`LaN;+dE2D3rRrrLpSdA+)$W~Z^xuC@{lD%0&sK-Wb8m?}_>Z=gKDqDm
z_Psm|3=WzYTj_K2Q%ZAEi}mB<GxIV_;^XxSD%VEE7vDA$s=vPcz*7Dt?^2e%yyI>9
zc=ocs%Req1ndf%)>#?f^3PO_#mT`zNynSKw@7;Fp1_g(}zRPotCwD)2SG4i>ZTpB9
z(w`o_x|*+U|GDXE*W8#XYp&ItojGUnbY9(UZ=URabNi(E6Cac6ljhOB`+k2r`aNZ1
z>J!=EMQW<MQ>SK>9dI{Uyqi-%e_PB%)AbUXE^9T{i(WjiVNsXhNvV?}0l{Y*Yjsr~
z?soH-t7aW|t>pNmmnoa3CAoj9x%(<?lTEow%eAc=da@qnO%1ucXpxs;z4v?RxO|S#
zl!q#*k?M(8KdqWGQTA2b$I$N)CT<z-rI~v7H`RW>v!T>q|J9-_?{8h+S8bnfO%oDh
zt1p}yd6G+UrP!tJHAin-Ynf-U&0p7Ys9&~txsSV6<kf(^b0?ZF(t5cnY5MB_8=TIc
zurA<OfAeNo!)~j0Ze6`gtp6|i?7zUpceQqPz0t$$O((?u@3T68{@$GVd-qoSzg*+=
z;CaB;y2gLk1Wy_2eLvLiqh)aK^)|ge18ErxwZ+$UryBo$dF+P96KTEopQd@9^uDI6
zub>-wIE$g+;7s-Ut9Ng=Phl>fAI|g9`{_Naf68m48ZIAs(6vW6HF_g|gLNA3_cu3<
zUkhGRc;~f<bz!J$S)0IyrP~*U+&m&MJE9@p>tAW1Yg}BcK*U8|odX*p#TZzxyX3lZ
zD?}R}I?%dx@r_H-I~cp~Wq<g4?8F+$!^=;7o*Z;QzJvEcMz`*flk+$@EIFkP{W@}s
zb#)<A0`pe}*1Jh-7O6%%ANe@zwT-{%>TAYAKXUvgF^Ha=GUre89`UW4IsVl+-!r=Q
zz)9+4{=tZ5*Ncl1jzu+mwSB^@dF$*p^DuR``*WTu?(uWBRWn>Dv{olVk5$KZ(dmfV
z(@R%eTz|9e<(<H3G0QGTv~|9X>5e(c)UxA+_k69KXG?9reV$>mx<Sw^z;~;*Lw94;
zo?ZVAGBTgARB4-Ss2HUqzm#v@5gk`;)fIEXCp2XlK6oW}ZBfe1r5!t)UFE-roOu*B
zBRNpwgT!Q4md9(hn@RQ-Iqy1AzU5i=vM;4SW{AzYzv<3Nhli)naB^MPXCS(EN27=8
zp=Hb*pT!=9&D+vZ9IcmKXx_YP@kv?ba+ysmZ2B&45*E>GrA_Pq)g1o1EjG3FhON2j
z!55kKcF(;W{i^;wdau7v{=oH@1`&()N>6rbW8SkeFndS3A+y-^!rKR%XOx`QSW^>Y
z)^x{Ko=x83fd;pY^rU>Pjf+D2T$ARkt)G|MYQ?l-@tZz}uS@|GOKd)+J^7btC8s38
z+Rx%Kzo2mDoo&L;=GuL{6)n)5#dq~LlS+be!QK;fYZ=?Fd!3&7Hg(ei=}5iw2{kuo
z)z1=Mz`#3cGWYD&;y2IBB=D6_xBaxh_`oc|y}GB;7F20x7wzS_v`#1IoP^ugk2=|3
zYFac;)c>sxm??8*Zu_ccmJ3Uj58e|znZVe;hEeRK=#~YuuCaQ5{K?a6JXik7+jmo+
z<bRk|T9ohmv!MUG{G?Qu^IAvyyieq?`a5g>QQUY}Z&i1T<TM%Gg)5xBLanw=n_F4z
zJN@$d8b&E`4%N55Jd8Vd*1VCq)A_b>=d;q8yYHQD6k2~lTC6el@~pjWcK?Iw47g{O
zo|CHO`XIA@>ZHFHi%y=hjN}Y#oGiX6)jcCtsco%e>;kiG$&0UkP5j+ia8T}P#}aF<
zhmqg3jSNK_cyCT-Il$z-V(ay{rmWZH1v#I!uSuQtrSi^N=H!yOdw2fXP%tqw-u}hy
z-5=ily8GFGO@^sj<IN51a-A>aKD^i}>Da(4(9dr$@5BEhj*ezM9d5>n&i7+1PtJYs
zx0`?S3D@Nhk6w;i8fZTER{dOazqk7%Gd^B^@VTTRg?C@E!Lh2mOOJWv%nypbacWwv
zp1i4jV*4WR(2l()jvlwIdhjRZ!Q&K3Gah^H!sb9dnTei_tvAD7x=23BxbwenOXmyI
zjPPACGCy||>%W^+q;I{~O!op$(0db>DD}?UbKUnyb8L9>LQVOXb^gpq$0Z9-b|imY
z#B^@k$?!dGccb{qpV-;*=)8W)oV)hQ`IpuoT+`Mh-fsy?-@77n$Fj}3+IeSY=b5#x
zxL(6tZGPuF<2s9~o%*>Oe2ct4M_;Rbb)aKa^6$#557*kK`&t*8xNx)l%h6r%-)H%T
z|JrA_-ZMY5_56g>dy+i&yo<i`uF360qw3;di?2M(^~{zXK9v>0|2lzxQ=?(<;ev?k
zG53mU?ppD&K0fc4c+cy)=l<>L-_KRmPvmDwzAHWVj`h`#o%7uoHy!-FC^V1JgY|#o
zv+uvYTUF}#uAN-x9$&QP{)IcqSC9UiGiT0(Wl4GGS{JkSMHg*q-*)2lj|;vGDbr-4
z4lztDI{K$a%eeacXMa}XpQ^22<u}RpZ~gA{F5&q5q}ewZq|Sa1Ji9$Y=HxqOmR~l~
z4mZ_qS?rDq;a~MaJmjDHlA8<yjECNOa7xC1bh@pT|2_Le&HRX?lXhMf2+ChBa_6<3
zUCYF0A)Q;c<nQ#0+36jyZ7Fxm$6t@Omp?Bqsym&f%r1Oi-B{}AtB%#PCf?n5v-xPj
z@`wvo7acZbswy*WpAgOU(pF%Hpv8-pzi+2`PMbJg;9EI|ZB%G=5Lb%3sz4K~--<(y
zUiz%7cgi;0Tsb2m`c36p5xyz!Uf4;u`rc7v@V0Ak+VZ{8=urcs=+UTLE~|uPvxN7p
zY~|VJJ}WUk=fV}s!i!CtV%LjJySib{E$jbBHYORJaPYMMV|w<bV{n!F6W%X}k54dL
z(01!e`2@$$7Tq7x-pfo+;$8M9PCf2s<mxRqbkDHujlSLg<NCcQH%Ec#rr8P2#oP55
zw*EE|OXFO_uJPdgi{Rzz0XzJYL--lDTv(g>FMQEU-orhep~Y#ZF0&=^zR&og&U8hA
zU3T8Y{+N&k*M@CuN0M)`U3PqQt?|j+i5(j+Uz1tfH&Nu0!Gz?0SC_O(Go<A9DarIL
zXM44S@qOVPf8jG~XC4^N`4qEn*PO}m8#i;Q-#aLC)xZ2q0=w8I!Ma^Pn`7$@t{$7O
z9QgR4U5EJk#r@MO>Jr*-w%^UY|L13>gVC(0{UyhZ?DXdMtF><^*H+k8SkUsg+`%M8
z=XNebIp5yuSN^dvA35E1W8>x5%v~)rM@R9t!$T(R`mM76miXFfuU_=^*~LSxTlG64
zx3#zX8y>sx=)}q6n?7~S4GDYWWqkT=-j`{u;t$u@@waQm2G*A-iJo0_=i2e$HvZpN
z?W(`M@wp;!K<d`K-Fbb@?;DqL?L2<uzEX|Iv1yjp9Ov)vnN#V!aqq@ods}|JitF|~
z;1@aNq_yJa=UczcmhS&j{(Vm9g+dmYb%g;7zkRe=HG8j(RdW}Q>7}Q$#3vi=vbQVP
zG^L$y`)4@=wHK43mtKBdB<aGhd+;~InQ3`5KCeBxvhc}A$73E7Eo*8uWWM$P5Y%3D
z^Wu@+Up{o4m0Pv+<I3k(=I{L5k-K%NdvLP-<2w&O@V_kI`o8bTpNC=FAH2wUeM9R`
z;gt7c%FT;Y7fE-&;n`yFU>~0!=U)-cmwx8L5w$`x1!|}FRd4LsKSOke&#j44`|6C6
zcU^7oG@tplROxi9__@3aCr%rCmg7%m{+EgTzbLNz=Mv-F*2`AT{C8QjY~B^Y)PFlJ
zs7DmD^4Z^;V=c~L#`VjCKmSA&k5EMTp1>IqpD&B9|4}bL@q*-Y+uet^tv?oaN6T)D
z@Ah-X{ptsJuaxl1XWQ-$++5psbILB}(+6+9Jo@|k1=TNQHbsl9+IDSAG@6?>FR#Mx
z(K+|qY<mt~`pr?_8OXWIaChzD?mI?bENTl3|2zNR%3S_)+k3Awb955QIUQ#j=TBm}
z;rGk$kHDk5VcJc<JX*WW=9aB~Kjnz|r$btT+0*2vH&?1^#5rZoiFy)!<K?c_HO~@n
z+dN{ER;z0-OWl|AsQ-)a%f`N?jq8MV2Q99+!Jm|PuuZuCyDM)IQ@7xm-#yc2?q0de
z_@l#umqEHEfm0qkOpKfM``E!#>Icsx)^dDtezQB|!&de`^P68Or+?GaYOU*CS2O9@
z|N9KGk-Pm9>XTMVyuZQytHJ+m$s28loX>Ys9$7{2_IhzXOz78}lH9GbwqcSde1xp`
zfBNi^EcM4oY`e9A^2a5Q%-?-$yLv$@Gun3L=J%ah5eKi|scU!Ny?41$yk6iFb-lOu
zCO5>3Z8*-j@|)X|rmX804=hyO{`#1TUeBDQdinKa@ogJQXC4r8dS5a>C!wE9H6VJW
zXTZm{)=wI1)?T@D_FGewVA|@#>-MIVuM0Q&`Ih<j;?xW4e~N8?&h~eY_OG3X+0`st
zW0y!SR$0d=muckm^^CaRFK_>jsZnn1mW^faY}BV&U9g*_T(k1of>4EZ#RvTN8&vPh
zj-4y#ryjHHrGMkq6Cd9O+>-u$w&DEAEt0o3e$rR!XZU3@t$)iy|3&}NPRlx0*v(X;
z&A`BRhk-#7b!#%b<5O6oS5WyDv@JPo(t~<i)~H*u4Y^#~jQ!GPNvoEf_KK3duj_w)
z&6#8D6Bo2dsAw>3S#vGpetLZJ{G8S2{su8PdX~+3pIz7K!}R>h&Z~c~tlTWTr}pa?
z`||luC+7sF?{2@GbMeV$o7HXyC#PCjo-W(pDWCI}<@eK1n@;(kpY>oiJO6&(zH^%%
zREACOPMB4DrmM)Zy~=U&(&E)`{{P+|@Mm`W?hnu7n-9BA7X7d(YFg;6Cr^{Iv%{u-
zR`5()ofewvDfFbc;yTOAq(HMZ9(%W{&YQaRPuTpmv-V8bKkIbrJ`3JURu+@`?ap>v
zWUtcc=I`RME@QdB@kpaqQ0k(O5!-(5nX|6zjW3&R<RAB_HJcI(KCEo?Y>fL*zNl$c
z;igmFD}Qf@`IKkf|J=1wYrgO1)NKuw^PWWN-ar58sL9C%d$T5rb!rt_^30RE&+pQh
z{?l`6*awE?BJwYsHchnD^P4z-#lwg1oBb#Ee9f2mGeunTKX-F;zWin`_gOxtej2TP
zaB#JdgIcLo@Z)nEH>OTK7|$tM6|;1*+R9CzL*r5}KRN6gHCIS9DPoxpW67+V16PHv
z^2hJ7t@`vP^3#_OzMoFtZ+m54S0AXiNqL0}gSF>tpQao7;=Z%=H*uYo(@Rt3(ef6Y
zo8Y%9XOh{?5{W-ecOT`8KV7}4Eq<%k52f7_N>V4^UH^1_(;DGFy1O^5IdxfU?rPWS
zM&nu6d3!w8ozaeC*-$1XbJYF+*H;QR|DQhiPrqHiPA-@A!@>#gbRSfu?b&LeVwa!t
z^7`4;{L2j<MAl^`9erK-OR@T{ghfJwlGxh-`>5ba{_T+`T(w;mOuu@2S(Bx~>7Bt(
z&-H7aIyrrzow8}@<48W!OG(|Lrta<BvTqK)*%$5b^YOmPM)zJ_)HpQH?yNemzK!Ok
zU3~Wr%m}}#a-029!^5!sF*c2nogp_5c1%BZ{@b^2`Zu4tM*1?(*d=N--)hFx&<hNQ
zr!+8eYR*VM8)@0Qa2nf2kLNcz+P+T;%!-n^?rR#BZ`mTny@z#C^TgESMOtT$N)&w)
zdB6VEvN`gO>6_ZB$~ZQE_T2ZwlG(|rtCB6k_FAuzQTmdGw~xGc2iHg}W{{gD{QcdB
zYr)_2-p^aJzRv22vBDaw)pltojdIT|xaS!u_AJI$Uw!*LoraI1=dMLg^K;x$^VfTd
zzS_~OS*pPkQYJ53^T{WCnrz#rO)s6}{$$2obvvx~`de1{i6Ul}POVR=JF}*(R{JS>
zV?)2odaVhSs%r}FwmP$kZMZkHJK;=#rRSYVwbOHRnhgyeEK4}IdQJTH@Jgd*@$K(6
zJ1O`jn}~%@p2r$qdA{k!mi<TKrQ7bc9Q>=gw*SFI2cLD3N7!TPYm~3J3wy6LlVVu#
zTgRm3v4EPc44a~l(Ld(yrvD<LVJQnV9)15@Y3LaJ%p|&F{)z{oH#Hj?7q&j$cr*B*
zQ~#=xK=C_VFO}5IuAe-qn(=mXNvO%aSyz3dM7{*aoGgp<_ia>a`IfbJ<EE9-8LbZm
zwhO##P?rwoULO}edEOaMPwqFJ?@FVdY*<sqnH|y4x%tmz+uS+JY<O9J8|x<s?%HLN
z?p1Z@tC8@E3Pm6FPqJ6V9rmXLd#-sVQk@ZG%*@8xy@t_duXM%E4O;IR?wG9p99%K|
z%4*fD8#k}0vMj6Eu8^Vm!TP0+>WjQs#gv@Va>XZHmJyxO56<m-pdHI`#Xw3?;Kez^
zhkIuAH1TGAzdrre#htD{pI>f1yJup}H@D&=;ysJ@eYw6VOL1S##cx~>ubeJ<#IQL0
zU&xs-C6%`3-IF(IIPj$hE3W2kt6^UII8E#Iu|r3<S^ndaz5o31j*G7r>{DW2e_^^1
z^Xm(&1+CW3yLLIQTjA`IJ#`;%#LKq{kvU(UEtvAmJNSOvuhMMe@<q{gp?7N5zPZ^U
zerIoBLdMd)+7VUR`=iu^lVuLhYA)6BE4fhlM>UtDcL7^?c6w8EgM(v`Lwf_mWT_q3
z+%HHh*IZCyVyRuMn*Gy+x9P6@gXeY(9{yc#e%zRG=;MW_^OD~kxqI*4J@@dk3v-t8
z7Vj-MaWM0rVKj?)rtFk%9gXxivh^IciRUC5A799x@uQ>i$i~grZgu)a`u6vH+$6|a
z%@OP@apZE18S@(kF&%fS3sciJ&0{;VVQOv#%jR6pt>*$H43@tTmGb_$K6PJ5mYe-V
z4HJnNe&#rv$JRQf6T&0|9ls?P$mZu;<}PZV|GDgAgYU^}*UsHP*HFm1zHoY4(7BuE
zgs$659BmSnSaQ%)%;z*))ove2Yv#=fmDBXXJ||8vZ`jto;G|l5cMTJFHRsapWtWbo
z7EBa9`fkmdX8{ir{{Ni3eX>@(S>wI0TyYNEAFrL8EcNP&?}W2yFU0MdGh0s`T(7W;
z+3fL|m(!Xb*!Xf+Oj;z#ZBvoG{M@DoYci*Oeev&are){(*%tcm=bP`oe^6dwQ>@*T
zD)Z^Ren%(&STj>R`sC;7{`YOIJ>qOC>n7}}`kwTkLu?mUdGqSm@9R6*j=w+t@kRaL
z`Tu`D-p}*?Z|(d2|3CcuC%^rE`@-0_XBn@|Y&~AT|I@-)`x}2R&!{v0m;B{l?VifD
z2jvg1)m1z;+rGK*m}=#dH}iQdo~fScV$a^0xJ&rU7xf7fYyK-cKGVEmDi&$<`-<Kn
znc%yw6JDK;EV}n$+k>Z9-_B*Z?(%uXFALw#;V1lr8@GJgtMr$}BKV$)C(9Ny=9;V0
z`pU({X%Yt*rkrA4%5Z5rv+urhUyi*^FqJ+KzLAYv;46P<hPp*gQ%qjhk{ugQ|CF(D
z_G6yHZoE%pqR6GAng+YLzVP2ka4kDtKgF0?#_pL(UrBmC>(zs-6DGE>7))?``%h~-
z|EuO0&WW3jF{*8y-0Xid<*I_Se1G9r-D&L)++=5$3yMh;thcIZ?tF5$;G!4f-fg>2
zt47PNpQcc{=|rB5jdymOt<1+quMS?&+YxduCNjvru*+}9aji_A=~LIZ?9E=e&ct{7
zx~hvog;RH%hE;k8syHv#u_@xpel#)lt8na>ss)~22Ue-X3z`HxKKJUxowQUJ)|lic
zZ#9h;b{lyHOPqMUoJWRh@e9EPW&#RXP0n9l@C9CVe&g_E-SnF+hMym(#5Z&`r9Qm6
zTHU>VVvxMOxPx!c^RtI+4|w039wG3cbcL_1jEGhn!`i+UJB5<(o0wFeW^C0l^5b41
z`{8fVzw#XKiX)GOTaV0{wub2k<5!0-t>yRi8|R<4(O%{ld3?qELd*QCOrN9={FlAZ
z{YQoQ)*eUhU1`zU)@MFX|G0O<iaBRLdCp@}tnW|$_psXVr2T_aE~{IA*L~j;=*n@y
zX?ijbqlmzteL6uiLe1Xx<O*(G_EagSiNE`k(vAtM9%TitU+~tyfo+9~USiJzJH|8J
zGCz)SO`X0d!BNQfP2-c##@y@u)~SA)V}9Z7>j|?27n|^`FK-pDS$fa#k7UtR?qjPb
zUW#*!NbXHI9#JK8{?yf^S7JxbFJZZwzVXzy7=bmS3wU&A{ymlOo`F%eeRtB%LmNX?
zv>Ez@&k5aZVSDtKeZo@3i^i;bM62eOmTJn}PQJy-m$28dI%HXs$X-<;*9m$K?QC0{
zlfzDNF_|}JZa7d-w!o!yi%hNpljLs(y@%heB^Q+!OQeLd{=Keff6?gJwSeD#g{;lh
z7DpIeZ~W_0Y+P8BaK4gfk3@)?%O{N*7hl^tH4EnI8=CJ;Z9luIO0;~BiV%xXTK6h-
zqIsYM!>jX`{oh=_clhAPcZUmkCT;aNn8(Gw;&&_a3*88|iwEM)sNRava7_|hui6x&
zw17{NVe9dby^1$|pDPEJY>V>w*0c3(=*-g-ZU3D=uyj$X_0yduT*^^WvoxpAi;;gh
zVPV_Hb;r-~7Vw;188*das>~rn294?~VJm978KW=EYguH|`|y8;SW#y0na`!gPhaf1
zUh~`F%I2fyiZe?Ujx+pf`@>bCz++q?@ou{4W}zP^9&-L)6uN)zgY_9Qdc_-fC$499
zJ}$5%p>F3Mo^zL;ehT_sC?&Sv#54PVn^7HSR8}`fOW?fU$=pY+j^2Ef95<EQWLA4p
z1M_KahHo03GS&yrOKw=a=)vV962co6vC6j|J)|c(|54z)b$=I#ox6T&3D>iQYtC=b
zP5T@B$M;V|l9cuRWBm54mlTX^vvOEezibjxZW3MToe-w;CcCR<(?v&<?~>PfTIzV4
z*ZF;B{VZFs-pe;wDEEEji<|ik20i&N1wWPDS`)W^<ut8BL0`Kr$4s3lqHvzcL(}Q<
z%}+lHyLlu3xJK3<uw=HDOv_?*+RLGLT6Dz;c}doWTRlx;$J!+3nq?l8e6s8`zkpon
zS-;u0AGjTMUHfm^;aU@}>l+HMJ@Jh6SsYN+?H9IOp{;=9P-aQcRPoZX|6ec8zyEj7
z?-#e-?;qsZ;<MOZZ(WL!ck=Wk3A?RDD-X!1YKU3!q)d^iUZbGFwr8QEw#}CvUz*xk
zs}DF|_tme6*uZYHbo&>kRa<3vXExUL?9rWHuyFzFt4dQ(v8N`hmA(3u?kTP7TjLOw
z_)b!7-peW1PS2TlB}2{f-iOEu*UzZ-)g|0y*eoRbN$_gmU8A?U{(VR8{P3Ug^633*
ztA)RLH@$aqx!a>7dwB7t2-7>~@2__JtjoWnar&;%79Rc`daK%$=eaCmZ!_91{HNr{
z{PX;7ceI#~3Wi*pvb*B4=jNoE{VVkXCo*h$#uxvE@xO$N!$0)}q48`7mcQz`zPA2K
zY-859A0HK%N?twCNHZ<TKjRb{xhUuWpKgO*hrRN0m$1zbl$b>?JlU{Tc*|9_bd3`S
zf}9nO^B-HX@jTa2-zup;j3MPQB8M&<>OU&A{duP1p64f2ET84^YyO!i!Spx8!$RVR
z7)zbsDxJR$FMjWuudwN&V&?0~*WN6toNL)G;}HByZuVctydVv3YhDSrLo%^n-~B3m
zQNHi4%EQ&7&9~T-R4y$p;NeP~C-K5sB-GS#<3kJQ;*vC(J<$tSudxq&FP5RHw5fQ@
zG&%ci#|}<C5IKkW?5zmTV-Fmn$|AVeHU;?QU6S2g)cwHtpl9fw6^=Z7wi~ybIX>-v
zx@seHvD4=Ih0*h#>`6#+*P562z{)p5n8Qs}zI;PaXw1~KG%NmqRleDxl8rho6?(^#
z7B_X4`nYY>b-l7&W~HlP)zz*8Q(PvAtajIUb@2YCgo%u=8C0xe7fza6JYVW_gQE9D
zi|LcEI!@vdunWJEI^&S)x&k})Xt`bUSG|3s=^P_;inCd1R#3u;MUxpfOX%JBCa>qN
zz-zQtA+AWM(Q$4=sOwhGhPt3Ds`gz>#<D)AIgOoW6wC1jlw59hJDDbOG$<-&$@H!3
zE*NdwzBIVJPi*Cinn{N0KfBKMa%%iwR#i}mKa;)S?}?}<V%N{|t>OR4v>@`Uum6M`
zHv<VL@e7ysEsg!7@x!3beYv3j8^tdn+8t>;>-tz^pO!X>&bBo%Wzd-{Tdg?D+9$E3
z`kE3`d6Q21GOYylQw6(1cJGP2ZvAfBq`RA+&bfSXTHLnny`n-cnkI*PX2v%xJFx8D
zq>by=yv~{8?`s_w={vjP>efBxvmLW*^Nkv7bkyVPQrCJKS*cCsUzcB?>?YsY<7D9U
zHBEKKL;gqkGX>9iuPUDMXL)6vQIM~N!Ik1tIpa(7%qL8KVJ~w^dCSM$R;yj=D^z$S
z_A6QW%-FBu@Nl7Y(eov11eUE{#`99DsO4VdC64mlJ71clSl|EoW|A_~#*j@*OP>oK
z3rQ7Syyd#kt|xhR{2CeyYJCp4)k@U2zdqv4Gv&}Su|<bBY9IEW`Bqc5L;3dyw%}C-
zD@_i4vShy{{@ltz+fdBu%-+P>My-NrMe{kU94l+idYXBLD<p@$Q0Lb=G-I)r|Hb(;
z6BR^PeOR8(X7F5q^S#O}Zp|RpGtzlmBa|Po*X)c<-}S9*$7=Qxi=Lu{k9;5Qvu>CW
z9Gcc8w9(=FhBA@!7SkTdu~aHpO?uuXTG=G}Q(Hq$&uR9qB{?V3xKG{8ofsBSf1=US
z$9<Fbj-v~0d>%<YD9~tZTUU58qOmVI@y3x5$7=TjCI5HtmXlf{X?3u@PN(C{Mz_mS
z8GByxZEkq^bm~s4;zM6<YHwQc`0Am%nqtb!=Ggw&o*X?XQ!B}M@&1{T`|?`aC8LuM
za7Is@lk{=IPEAj?H|=Q!Zhw|b8zeD_9pw#7Yq^v$arp;!mFHX7B!2~bynHNV@%$yx
zufCPZC6q;pJawIPcKX?+>M|cLpW7=cbbEb9;KJrF=99&vta|blw#vA@(_M1*f^+lY
z_O&{;OZvCA_w24dX|QI7L}0UfMwgyJ@S?u0tX!9N^PPE`ENyVfj{DKcqLZ&XrZ8TT
zS(&_9bF$*H?$aj>He`oL<aJxvoLOxqIo0Ly#={CGsmK0IabP;srFJRMAn~mFpF1pB
zUzQt{wVUqH<;r81pL6-n>u<akD{VXWS2M^o2x+)lCYCJ;U{zneifO}{S=W6y=O$db
z_Pwe<@M~+z*Cg(XPb1`-Ty**#Nc`*bl@FBuz*qCOb-|%*XPFfjyV=sd9XCqfJ>%FT
zR`DGxIg13YJUS^^RU!HB<&9l(pZphfDcstqx?OhS;qTfRGbe|J8m%`hQMt9Rsz8_D
zUg}`Vj&@7U@S`G+I|{rlc2rf^@@%_3A*K4{6rYEi_OVnPtStU|b}P@M^c5T5a@2dR
z=v;U7#XDcenbn*3_nYbVwcYWP+O=>g^Xa>Nt6Q^Xd^;bp#<BYR&-a1HnTnUsW{iIG
z{pH@6ukT(STs@y}zO0J>y+41heV)_4d-o!>Q&)~Jdh@to4YTNrT-RqDM!OZZ$*P1I
zFnXoENqAfSOW^j-iQ>6WHyjF+Uwn~0)A5=a(}iQp*Bst{dhx9?Qz>gZFBPfcgcF|G
zYxx>`KmR=BEVN>_cIO1PIcu{n9?%qa7IOI_dxC>mEV@_m{-ga4B4G;*{y8~ErcEs>
zJ1VyHQK4D(ol7(CJ{8+G%~Nlkd9~1_S$1s!>rT(vJh|#YF87t7k~e~%bUsBT-xH~4
z^-Xv99j$2<<uyZ4wN9}A;?BZkhjgdKPxR&&Y)|>}?bF?htIORz^1l0s9OCNdk6#h4
z#wmO@IPv5U%XzKgH}07(VoWV6{;zBQf1kQ|i%y&CH<2BhiVK!Uo;^2l!4=+}TOKKT
zv{jXqz75&p8Suf@bAc4&uClOL_5V>RAx86$Io~?jKmXtCQ=ghGcg=Yl@lzu!fB9YB
zYwU4n{>0ja1ordHxwUsvLI}@;vOT;)W;f+5o~hKCE%Ui)xAt0T@QTnyQ@u)8`gx@u
zHCu4)!^ipa_t+jNw(CD^y)5d_3SRw7ve%j$K3<;O;d=3F%Ng!_4KqGIejLjlxck=@
zjazS7BA%8f{8gS%KkL)}nVSCBHk{v^lww!h620%>!f)^F7VX(xRcl`Ueplx$vk#1W
ztW91h#V>Fc|Dso@WczP#<cHON$}@MZ|8zcav-XO$FRpajA4#e$-DcVC`{(ZMX9j=I
zn6+Qb$(tR$r#)Br5@TbL^llw#Yp#L@VeRz04^xu!bT&`ESM{<#&aRd-hGToUN$yiq
zzhtYqpEv}|3gY&rEcZL=X>DGsS!Zyk`uwpSn>MA++Wy9DYfzi^_4b^j?EAf4kGC}>
z2(L9cnx4nFP12fs<z!BUDYiwehDVv+?ramT{Nt;0WJ1Id$L(5*+cff5dK+lOZ#KFZ
zU3|f)w)a*7zwe2i_fKA^v*!|=*t2Z0|HSE&+P)V*?wb|(KlW{Dip9-67iVkN^C>9j
zKZ(-#e{HD~Q)K=+=PJ&e>zWhe{p6>F?AmF^VZ1R;QRG3rcI$`l3&Ow8I=((&<1yus
z`Hq{fC0t*1%_K5%w{qEu&*96HH-C27UoHFl=jrGdH<H4X`V|#L*DTh%XRG-r!sUkW
z&dZ{${<9d|@66y_ZsPt*MO!w2S^K}?{H~YB<{3Tr&ge@p3{0PYF<pbz<T5XBX6*Zu
z4+E6$IEZ+11<l$bljV4fA?W54r)d+)wjK3ZQS@9j)gg$b@%Y7!-)Fd;(UCHgRx@Sx
zSX}UZ!cW`zZSOXU-j?JuSXphsvEAad1nXv{YNymY${%M*UFG>zJ~h5wMvMRBd=ZCY
z&$DJ?krImcOO4h)+_2W-d#?ALuhUK{M`~T+`}a8Kyq~xI{H+`PGhXRj^W@q+&*{vx
z$!qtX+u@+wRT62o_-OS5eWsKRxm)(=9tu3{_<UNi0H<%a>&}|<j0WMq_%{~X)!%K~
zvV#3V`ORZnHj4YoGfb<#xT$gfzS^HjvL$vmkEm2j->$0oa&Fz@m+kXc)&A(Sc|5Om
z&o#To-77yl*x1Mze@8oUO4yy7$F%-g9Q>osC%HoNn5mHsL(cO<sj_^I6)f*fmACVA
zyfBRRnr)r9Qtq9=pNgQW72!26%9qrZPkAM^b^oP@j0cUM?Qu=F`KHowajS*fl~bjb
zZfsX(ZEuO>`0^^MIQd2npLuNldd{u)%$}UzbuCWa>e{WB*LbhZ++NmQ`tB*iXY-pC
z!ha0A9p^7u5tejjXYE7bZg=@lJ~lsJHnEo{JN*2kVjnwo^;SM3<#OrFRj(87eciW6
zub-)I`u3Q&n)z}!pX`)$s@Wa(lI_V^>AeSnkG**2D^)(F=3&^>$M3thy?XL{@5b4F
zmQ8X;`fvU9bWwV2ow-rgy)!$=uDJVuiEo|Y^(Dn?&z`+AdDhBrAN($TpPAs5{xY&q
z-#hC0`YChRmgr7);&-2RaMFZ};rC)&*0uZaYcaf>{JG_PV_H_v%KLX#sw(AwRG4h%
z7Mirp=`}-`%<BUlwmvf#W!-&iFpbgUe$j=ehk}Kx`#-cs%xm~I!TVw2O%=6mx7UA?
zw}`x4lXSzuApBdC=XXy2r)w|X{v<rPVb}F@2QA(jZJy)&X{q93S=SQx3jbEV!_K!}
zt@$Z9aoWzhAH{Oh%-Lt1nw~I!)s2YTc5KJ=RyOc$O1Hcip>RXvz~(bqj&3RO3mX!}
zUKveckt|mY6#jg0ms{4<Nk8Oz_FlK+`p|Iso5ayPo*$euw)zQN+xIK;fUVw@nfj&|
zjkIKb?Jp>{-qm=`)-N^VK;P`ZZOf(@viCozjK0t|U0u@t$f4{DcD|Q096C!^ZE6;C
z;dEE%jnb{z{m#_#zLCT}?I~_&!%y4H-nHQAS<}$qblwl4tE=b7u@*&X_D+};R?oTi
zoS^BG4!18Bol;Z6mSj)fm%!Au^hr;Y&Axb{!id=5!j0)I-{Ky%AG4Tr=&r3=uUre~
z>-Q!n1%5n;sF7aJ`FF#l7Gu`O7k&G_UVfnQ^!#3h{%ikuj$YiscB@)#UDrP8*tnAh
z|M#p;w5$1jce>d`tEegE-%4*XlvmWo^UprmFK-Z-^x2{5+H3LanlFm7cyhhZPFuRF
z{@L52n=g*-e)4S3+WUIb&;DsEWS_Nv^V!e|4Mp>hRW{GLFWUSi^4GPOH_RM<I)~ko
zkkd@IzO(6%nUp>6g1j7!jIIy7F&EDqa1yJ1xNP;(Rj-YseY)>C-}V>J$?tw!70*<h
zbI!!*anGxDmDUsU);Wik95DJV82Q)i&765!+a4dCQebxT%|HHgO%=;{r+RCb?ON&Z
zVX{|skNHs@W!}??hvlqKe*a?eMo>TE*5)ru?&;(%z1teG>|~PpEm!9A!gu!zZuQ-j
zC|%l9IkoV(P0{oV8S*>w+g^H1{=}TT-%srF=FrLF8}d${&R4QEb}nXdxffh~+<dN|
zuwhHivFnb^MSiMk*_)5tG=A{BYj(+#_QNUthH<Zs86P?R{PQ-MkCRM7%8u@Mbn{l_
z(g$$@$9(rj?sBU-zJopRfp75BMLR;46xdB?4~{(HU0_;h?Eb06J4?!UyV!iUE3E5$
zn5&<h(K)a6BvUS%=Y95bsRg{w)o&yt%I$8)d^;x8z2tG5--+AvR;D_uiLrgJ>Nv7M
z*RbHs4!H-R*=^Iy92@7)eNb@lGN-SB#Y?5f;Y}ZEUQN3A_@9vf)#+?m-Gb}I6c0T0
zjgU@%d0E)U;cV)9MN2Io=7{T(Y0bUO`=^NCJl<oGw&QT|mCt84MAoee+MDbW6Pr|C
z*zNQ5)xrE6=broAt_PAMOZ7KxIOKinMyOh8!*#C;S5_Zq$?U9^>g^p?H;n&_sFm=n
zzwy!dZ`tyBn^k>+gMVg7Pkz2yc$x2d;m@n0)11Rro~(Igx%~RQ`v>!XB$l`?US6oi
z*sRsS8Rc%eR_;X9?72xx`_FMj-QJs(^~ynIe&6|$4>D<!EWX~o(!!Yk_Tu3u0<JCV
zc0AYIveq^5$$Qz!S$XbD)okxJU*i8?>)2Svn|f9De3KggmhE$+O(P%PDt_S>sTnUj
zWn=#21vBGTZ+AMeZ-)4RKV_@m{9sJ@u(4+I3B5_5SUxgc-XeL|&}E{3-CEwL>+=|!
zZZJ%JsdXn&f!lS3<L;YPx4CzB&N-5$vBG7+Qq{K+TE-r?{~bT88<kbgGFv;cxa?m4
zHV)Ut_tWN`64U*!GPkBdiD%1>XekeMr`qi@JJwv2mcD&)q5jlQRu2vH_@z?MUjE$p
z(6H3>XU=9N)yWyhXLEQxTa$S>K<eckmVK_x%$Ju1yQs~2Gj->I>Q~R@wpQf_D4%19
z5Vw8w_~WdfSxFWh1#j3~6;tGH-cNq?c11|`_leCnZ>WiUz18cu@c*ll(>;7u>FZss
zKONqs)h0eu^@XiP7k`CY&AjWK-?|-EZeJ}NDUkJO>58_)Q|`O%6Tipb+Z+Aw!W_$m
zk6c~1eR#Z`t)h6wPc_}52_`>|-TawqYGBT=$DQd9`;BTBiy8dKJ!dk#Ze&|wZfCk_
z;SN5>EnAQO<MUAX6W3&W(eim%_g61pey_!^S4=Hk*I^(Q6>p`;R>8twAjlpz@yDW5
zvvrI%+*S_!cuv)?Y<h+Nuas0<p{Z{_L{FAT+%Vhc%-N#9rvj3X2A3M^MIPV3*MH9g
ziCaP5i`K8YQr5mF@Tz{&mFeXtyQAaYxIOjOcD?4GD*4}X?K}G(d4^}x6|`3W-qEU9
zpK<PB-gDoGTQ{{Px8;Yl*7r|Py34)rJ!_~%$2<3nzhCZsQOi@$ZqN5mT9Kd4{vW^b
zp1<>TE~m_V(Z}^6$z`%vgJ%pwJHy@ebDCCd7hgB)=DYpv%zHRW%w%uY8P`2E4&sg9
z<grFZZ~qRbe*1~v4`^=<y36VxUvsFht{}pOrBRmo;sTG2Hpi3WHz;t`CVf-c#IRK@
z=6GlNQ|n1nFYhxc-T&w5B2W8``<R6V?{chL^K9kru!#GTQ@xCm{&x7UF5227cS%%6
zF7aB$5uvy3`-&USz6mKh_Tf~-+Sd=d${F{0X#dz-YQkb)wRic=B?n%=EMz+uZcwu)
zDNbkS&8=Z9H*Tz3AlT~co|V`svgH4@&6O6fuho834~<kbJMnH#Y|$^<?Ou1MZRECp
z<5anMm){jty-z)JyKUqx%Ga-YSiC3n>(uEpD|@)VOgplF)7}pieE-YhOdOTJXHBe)
z`gB_JXRgAGxH;?XKJPOO3BS4cRknEQoO!Dj8jJKgw<OpG+b5hkz|j3kY4xo&6Z-O2
z-$}pzV&UOw!Sg!pD*pbNdGCGZLbux7`0B%Iike(I_67Yl=g_>cxAMJQ$%OguvW2Ql
z(#$tr4T_F=Qjz*XzHWZcr$_f*Ui_==-M?es`|U}bO%wi0XBnQ7k7(?#)2&m|oqFc-
z3cdR(dmnJ*PvUpm^Mac-_uQ>j=jN4!n^!8gN!+TM&DJKKE%b1KZo`jrRl#~qr3$GB
z?E;Dm_ZTNkXTII=#G38+*OND1%|GvJ%5`$m!KtC`2ZC*apJXq6yJ2e6Dz4}icUC=1
zmJxC@Q=Pm?<HpmqwS24pi)Ov~%oV4narxsC>pwsHXKv3Ed+8lrohSH{capVp)Zgd(
zbWd$FjEi(T<svi1bW6ju<ZWpxvp5_tr@0(ncV))%={7E3Rk9g;o4J43-rBqVx!`)%
z=yJB%;<FCi5I7R|;lQRdGcT>&m0Rq=6B_va*!s^i4$eB4^HHYDIN#*>_1fuq>u26z
z+qtQ#=I;yvwQn=ty=CR!8?d|dx6&JjjVgS8n&HP5?W+4$)*ku2?!>IU0`kh8Q|9en
zG=2A@53Ezq2Kz6++Yl3_ep9p~qIiSY@&~7%y$PK0TX=K8297O}H!dbGGf=#KIEOo+
z<)Pp0626*r7p45#cW)=%5EuQkMk?rK-uDH!mssp8j!V0f^f$F~*4+=XAI*}>n-iCw
z5q<YGOj^3nMZ0ka%Yh!ZhYjyHCG`0+@`@hX_?q2hx6<LFi2*$S)vo;Jim6%_lvo-y
zS4hlyf0|{?Av^Zw=;?JgtRk~-G*thZd#-`~m_W97o52N^`}4|^lDW3B&Z@l<aW?F9
zVzM`*=$zCC=gfjTuGTKpZMxEM<nY<+k&m)V5>k7r8%_qliPhZV=`GW7aL?__g^yal
z^ZMTSIG^vXS?+;zQzSVjoz?y_M^n#hTK|IbJBM^kR{uS==w{lQmX2?h3s3f?1ihQd
z^n_<cZ>d$mw=*ht&uLjqdAm7a_kq4jq2ANEU)DET9qm6~{+ZL1XP=G8<_)53XN@a*
zO}U!>xJ}sA>ON04<r&8V@g0YM1X_EpdLwdTm)Gz2RSS~e^{)Avx>oUpX<5|QpWUkk
z^IqTG)$(Cu(5{w`r?yPK6n}bEDffw*%&=49vQy7YcT>&T5w}cueex^Tjdw3^yu7$8
zFH4H+snu*P=8sE1d@I@2`L=k6o3@$FYnN5^AHTZk%G_QMxk~Z(#Od2TZnVz(pz@=w
zGt$QI<hjksN0KhGADsX6z><V(H#ROdd~f*w-NB4Y!BT9$ZdUq!J1Y?SdF7N>Z;w3q
zSl_*;A-;IY^qBh!jSHhEJ^Z!K<@Q2fiMmXeqRm@6zvN}ATTZUa<quzVe#(!+q6eBm
zo3=9YGN(>mwtC?@!)5*PrvxH8#pCQOq_^no)9$){j6>e8Ot!J@Ki^@I6`Mtva<?)c
zI&>|<^s;f)l~&cL^6iItc&0Bs>EN<U?7<czxn(zxui<#Rv-C%g`Fz<n_x$snt^)g8
z^PaW#2U$&s5Zs=yJ|NK8=gJR1@k1K|9{;wo?XdLr5xa3b`jH&_RVKO42Z?|3Ke4Qs
z%XLz}`{K<s&sPO2A|3Y{_!(yLrOdzj=h<y{!$0}+YVR0sJEsw_EceUPO&=|yIpVh^
z?tS{<>8-1k94)=i_3l;{%YP4=JN0lyMedW}hNo(Q-z%>jOsEy#dv^Wp<`VNmc^rl9
z?6Ees6{Q~@y*$|c_i*#}Ur&_0^LG5V`Fo)6wOM23t=PH6Decaybmqo2J^G=joPOzU
z+3xO#)eC)JpUZo{f!SWKnJLBbZ@jGAA&Z%nnK94OQ&bLYtkdZhE!n$^$HDv5O~L6_
z8(Q2poY<s!`lOPQN6<vO2~x-NCvSXheo7?umA_f%Hd)Q-$2ddx<yyUeb>;VS`|$gx
z+^7D3ym@=dYU}bFGFRuV6kaU#B1p&D-Rs+x%gcU;hn`zIP3!HSSKdoZvc2UTRcGx8
zb?UU^yu4=%XH?{?**cCgyi@L}UEr*|`Ob#3{8{p(M+$~>TxM5IO*tUg^k`A5yy#Kq
zNlw;BN}jEk*8cdZcuU^n=NVhwK5C1s+SR^DOj4lx;=1?A-~3hnJ#}2aX_Mf~$BYF^
zneS_&n_jh)a4z-Rq%GN$S!zCSZC8_fp_KlwieEGABOSQ!?X~22W$d%9-;nvyHq|e0
z*p$>P|9yFR*}$Up+u9Qv#jU%NH%B*bdV1^RgOI(`Hk#_qjNYGWr(-aiFFr}umX+<<
z&EN%j3?C+VerH>?N+4v>@;aW?(Ok3NGCq`6{&>GqxZzzGlQUOR+0|y5glJ`hcdHVw
zFNq6e-qE-B_>I-CFGSbmDX19DxccR}WQOo+1;6|oWgYvrzWn08zjxXzP9aua=Spvz
z#c4X#rSqQ(Do7dc49v}`T~JqbEPo!Gsqz1gKRlw<;lG0a#h=T2b(QnOs>l27Z~ndi
z@}0fhn}3--ZIz22-}qrS>z?l#H5=<Wl{<f^F&_T*Oy!r{g3ac9_GZQ_XWX88?AR3P
z^5=VulwRJ6>pa8wZtb19vzIS=b)b3a;YqUTo40H464|}T$7G|o#+rW-dc}udzR5|L
zp=T*}p}TBT_ZAig?o40#Nxjpzedps3J~=U&Z3g=}*5@_m{!ix{_n*JG^7)a2eSr=;
z9wpzAcyq=g{j7Lk(7el1m8+fA3!Rl@1zYY-eed5B`LNq6Mq|>nh~P);(X(Fme38?u
zJ-Ka(`%4wk4b`$wrd;y~pCPo<B`5EU?c#|iV_qDdnH62Ga{PYax#)A#HkAn+_>~$Y
zdh$zKtXS0P+6z{K3s#@_^>qDS^`!MTye>U&pI*46FzmDt_l$mb)(h8r${%RfT-m(R
zmglKMS(DkF5Zf;1CBCPG*=`+iEtq6id0-8{QP>8VO&JDXIE_AR=YE&vzv-<OpY~go
z+N<YzH)Uqk*zKGBX8Lxo^E(;O{X3Rv_Fk`ZS-tmC-#)9I&u(eotg%seKUE-PEu(eM
zz3!)PyE2zw%wiT>lf2FSSVVrG%yquZi0ZdRY=0Z-<`ztmsJi}Dri?o+K%?~DRg0AE
z#s{~gAMBof@;tjf-#r^kE02a?xxd#}Gw+$ixB0Gt>90p?rYv8PV{XLtINtEL%(O|r
zS6|^f%r^VTyym=Ik@Ih_-|xwioXKU^${c2Ky2C_&WmcF&cYN>6O?9T~Iw?;Qgae(e
z=eUOy@B|)?7VJ{qFe!JI<97F{S;3V%-CaV?t-Wa^{!lr7#rElGYzH&eUfJe(yU(S#
zQblz2vMDiK$9HGU$vM?M!J)cYCsY1=LZ{rmk6Yuq;}2L=HCWYosGl$Yd(Up_;o$ad
zp>a)TbLF2!EtlBs7r9~DhPNTCa-Bx~Jb~x0oqTEWbXwG{UvgV#J=HDUT4|SMd^=il
z?$V_vf*Yqydyx0=Ro1_YZb6$je$V!Odd%|DjaA}TQ*xiXC`aDDtz*jg!&7P3%qgyt
zZ%-5#&z4x(=>2lO#oI`+ey<4zTQrXc&OWkxcd=%I&*iA~PTwE$C+8$TVrY9<oWOCW
z;;3wuG>5sv?E44j?P`2q9g(d3XnFhGjI$@^-st>cnCqIX#Hl^;X{Yg=sY_&+3(fJe
z$=W}&CCu^KtC%#i(7Utud9l|{KPj8}X3Fb@zu6{C%Y0p$+OWaw#@{R6Wv*ZUvj=!H
zvxqP-FmN!)HcLcbzT*DXSA>CKo;L%7Gy?-eZfbFUUQ%ghPKrKkscv#^Vs@%tLFHAO
z?BK^1+wOnXHhH;r)81Sj+ug=nr|!DR&HVCZ$mIjACI0uhBd1T+=wv^B?iXW<=C|$d
zEvq6X$txPv><lsQ)SavRa!-HB5$mGT!cVpDP3By(SX_NrviEa=+@&q<eb)|_cz&<@
z!e{mVMB%1;OCBc8oGj08_ougK+LW4wkwTLt_bv|H6vrrYGIPVLl4qHll=j){e^Oey
z&;QU>E6-w~BZZULD`y;ubl>B(^3Svsy+7ZtIqoar{MUD=Gw1X)S2?#&n)lZnu5fJX
z={XWGPbTrhgu_Y+4f-e7bgc0H@m#gF^T_?C6&mq#{p*%rj<Mr?T&Ywz^@N(M#Mzil
zhg=V(Jcyp66BF@n)-i`AnI6WRlh)i^rSinG`j3zKrrKRxc`I{dSzk6i+rzIjYwJ&A
zEB@qJKPw+O7k66p6wg{0%(Y+jN2p=sa?W%Af`!gz+`4d;Stw9G!hEl*7w3V~2mjZ|
z#_{?6Ilq5rN=2Eem6h#R|F-FGe(H3-<X8|Rbga&;_`hDqp~wm9zCY9*!`2;pC-CE^
z2lJD!l6%Xo-?+|+QITACM6`eY`=7$qGRJuS2JX@b$Z=V|P%80*!O|WFCI)en&(}Sl
zY0vp{_wC-Q!^a%rJ{^Coa*laHRu}i<^>h8y=S-ex{_B2sWBs4Zf<KiN-?IC^rk#GW
z>1nX0yQ;U~(Kjk{p2=R_IYmUzC0yZlNcPj1@5@eRu|_HFWPhQY)zQG`^mw;{Z_+aF
zpk-IJ_og?eWPB;+T<*=?a?Zhx%hB~;fjGmSww~8q@jpzsHue0O)@J!v^~9l<t_FK~
z#lA@UPK=R1+;K~F<s7;8gYy;U>ispCc53qX6DppIHc57{Sjqbx(l}#oJLzfWO_5`f
zaxN3?xeqG!+W2iz*wtqDcvG;<niZU7$J39*X9cq_oYBrbA=I$=-yOS;D_@*{Bj)!Y
zn<swV%)$?SUyn^z;6Gr)@F!ySpIs+JMb5ZNitw|`?k}5rYtj_g4VLn@8=5l>&g#Fk
z?>1O!Tx)wMMABKNp3yNhq9tZk;LgrV3jT+6o(o@IcChu==lruJXCkv}Q|I>CTkZN&
zYQSXd^2@6=x7#^FZ=>YRC9Opc?fvKX$H?@y?dS1tU;OX^*MoIy7gsPpYhUIh!gy{M
zQ&uf!oqyK*LpLhSD;Sbarq8%!9dTN>cjqIW&oy(ue)}$-xKBrI#kt?}56dj`{4RO-
zn|h$p&3IPHj8k^oStRofRo)2qUNc}a=bGES`0;u7{d|8O-Yj_Xzo^8tK{aC9)ym`b
z2PUp%zA#yG{-LvH7xFRmr)<(xo%}1?Zo>KdKZ-@t+BsrW{S*Xd>NQt58c$MJiEooU
zxbBHvkCM?s6~?(c+0U}wZvRpI;e%m>(;+eEOG;{Nc0CL;YPfYCOyIw1eCn&@gr5O^
z4`Y`z&q?|0#P}`ncH`{Aywj<%F?@D>`xl!l-L<!stGE2c^X%vAr%xZ`Jekk8-tESx
zE%8AQiwd~j{AVk0U+mu=TlD4h)t@h~Up(+qL6G+m-@bm8+>_xOsyL4rD0<AlV$Nii
zCucX|x9S=zFD8|$eLj<uHmWebd?z0173MHg?|}bhmDAr?9JWRJPSTh&Nuwv<Gt6hY
z#H2UPNt5^P7j8NHKJNCZzf;&Q7EW9iEp~@>er-utcFDFymhGk!-z6HHY^w=WPpn$O
z++Li!XSJXkll$@|Eu{|L2cMf4Jr20=vT5zF4X;ZMG%(vO4?e=NSn*=q0|(wSJD5!E
zt*jr;3*V3`$`F~$W9jgy@`BR^R>5sCmRs#@AMI9G5v%@x<*3+<<2QeH@a$tgx=t&X
zg*TTiE3w|DDd4z#Ox(P~RRI=`90&ZCC%l?e;;bUVvbcDbQv$mX!z2E~tp{1GPA^R7
z)Zla3&|=r{Q`vq)po-yx$@)ho{`$DgzGsT;!-GEAxvv@59!{3*P*eQJ_t@ZjtwOFz
zxub*n>p0yCk-szB&lzz&beLh-#w?n{QutaSl;aIs+F5fYAwSJ6H&ef_VPMX%j<Ymu
z<y`(kQEmd~9|LKv9lw2*X9;M}(w`jpOf;J#apm6(-3XV{l38CX)c?+nK4ktcBK5-l
zi5Fg-E#8o5)7vHab?FhudkPaxOl;eID_k2J?BB9IPCk&sv?<)$$z9=#XhzLfnJ+e)
zk7l+c^V>Z?XWZcL=iX_=W;#QvRYIbm@|?IOcZ<xHZOZ(IdFA2~Ll!QvVx9ZeymMj<
zvoq(3DF#kW4FL*=H1^ph&&m{N;?ML7d9$;XZ{lySzS%ZR_g3BA(W(2X?)N3rSAx$r
zUl2Y&S;Om{;oQS5Og^d>2Ae#)rW~Iv$L(=(y>c*z)wTzE9Li}2f0S&x=lkc<#i@dO
zH-1^lxNi20Hxs2D*!Mqa{$4F~>|6cE3PWw)<M&G&H_9I0C?hJdPnjp5t&vB^<U#TN
zrL%d8*t+gn9!@#IwoZXJ@(R;`CXe&trok)=zA+22Nm{ULpO;$~$ZB}*bkH}(Ro(Ij
zWd6($zhF^j(s}SK(~$$uD>RD3|D~iY+IDoZ&DOBPYa)DPVtICLET7-H$4~QmRe0ty
z!_GG^C6{^&h%i47+}Nif{>e+kcG}N4fB)w#Ss$(>d#9zZ;Et}z?C-sL!^U0Ygthf0
zXXCj&Qhj{K3vWLCar@xuJS}g7l$|D9&s>_x#&$Ao4+9&E>y+=hYDq6+c^M{L+*kVG
z@0ZQx0h!w7?!T_y75ZSxCGT;E?NXCyUH9Y)e;ZrP#A1s$RiUh%`hpyD|BD8nXmPl|
z`IFx%MUnd#xxB11qoQke*hxq~6O>-p`e=e(OW~JBzwSBK*WIc!^S(E%tr4l1Kf~y_
zOQJ%?ZLis!j?DMJFbl7^cuet5XT=>mqt{IOh9wIRp4lw5tUJp7Uf$L1XFk1EYvJrr
z*_z2<QM`WZOQv}F`B`Cp+!qCA-aZ!B%n@U^&R0}&vV24J(gQ}9wwE6{X!Ccgr|TU#
z)>78pInfgTH{0smoBj5x;#>LoHg_5uU5wqs+1_a_{jZ}Tkja)S#=`MZ>%`kz9(kv?
z$Q(~mF^}h|aZH}Y<XXF~bl<TxVlkoG9T{=YnP)lKo&B+Jk$Fkw+GE#s>~7C{XdU8g
z$D`76^GE3`IsftrVI><*apz8sc=2+R#8Jol+<H}8BlFk1WiU{je&yQb9)}Nn3*wIN
zD!P91!L)!E+Y<%iIq&OLi~1`R-E35sxc}yu@QasHn{RnVz4+_yp*^QqxHj^#w4h{E
zyzA|tx+&e-;o5yBQex}ZHXhw^e%->JWAiRP$}(GgX!Em@HuoFWXMP08-n<c(>fQJ}
zb6ayE_YwR0k9Au_R)3Ls$9t{wIK$hI%QsHEu!&J=+v@UL?1|2^7!MTR7J57T{*Jdc
zX4c$#Cq5t8S9v2nJJbKNUF*Zsa@m=)M9-w{D~!?j{3^=XcIP$&pQEz(Oy-<?>hYm%
znHWowaR9r>dMSn`)2f(lk&<pxUdCEJtO~Yfx|5LGq<7!E!B1Ig$tL@118dur0x`GK
z1@=syw_{3V;iiL2mOo_iH#X6_Ak>$#rn^A(&6SqBB6D7AO)6a6HpAhbl9!sJihT4Z
z<J5ld9lIiS?)ZJuD9q+uQ4~)cZ(jOk-6<aDLzgU-$oEduo)sPJ|7qX-ntAKq{5cnr
zc}aZYx$P+%cP9tB$DLYd_NC_LJcpz5uZ(Uxn5({S+E=scb<Cu${=&ZxmzqpgJCwTY
zuWCuqgxoKJwq?t>&pqJ3?85h}NHEK&!Kr0Q-ACbv2H&1`^Y0E?BUvf@RH|xU$@Z0B
zD(gFDB`NK4+UIsEEAJui$(71?olbAM?d^Ln`eK0Z0;Or^U00qF-{*Me+Z@eje%qyd
zY~|%oO7Itc?7TU3m7d^jPwV;2;xBmuYIzp*Wcg-JN|<%T*}cZr=6403e#pt`Cjwn&
zR6mf7s4_^HH$QV@ng4yKyQ+(>BxrwGAr~_9_RI<i|G%8qZca)6vuItbY~-mQ&vw?O
zy-3d0mC;CEmOEFAW2)8E#>Ah?wyqXwvg*hQT<|MV;Q5aF=`EYL&TsuciBq}veO1*)
zkz}5LxR0(92SlFoRUH-z=1Sq;v*}>8T4da7{=1?4ci1+3kYKFLd$S>Ng8J{7jrYV{
zUYB-ena9+u-?T<CNp;36fm1@N_7x6AJ;(1He}8}V!_O_X`bAz73Qpc})0$*&J+Dqd
zS;>d<Y3Dkz_uZ$G4702gO0#kjxvpl#Ng3@cSSQWD@?3A@Ck@>dVKZ78CL0{vBUe~0
z@S*Xs$7ENjHB-{kBaA10pINwKv-g7uocWJ8+*vn8H#_Erj%Lv}&W}<)3sR1|GF`iQ
zzR7Z{_nnLnM`q4_JK_72TepPO8LM}kZjhe0h%fVf_@7#_WBb{!Nu0R-`*g(okGCEh
z&r&n)`n{2z_xJh__vb|$Xg{$1;^$m-{2Wgu<0`3j>S5(PJAU<BJyYMf=b!Tb8llrE
z=Rf>RF@3i)Yz50=pXm-Wr#SJn9<AS2D*V}K`svS~1$XXzdF%TB7k&4w?@G&sKaP;w
zal9bc+SJXkMECU8t{L--)O<LC3;u`bNW>oSyPSGgze#4fPFMe4?l6@Z`nhI1wtGxY
z%B?Su+RomxUXb<7ABivLRf8&KK8sXd@NEB#itSxBS2yO{+E-sIG?85zc~#0+@X+q3
zfs)FzR{I^R`zIKirmVMkK``6irxT<1hUK5`l$!QGgzKNo^2!jMzDdnX7ya1SZ<6z_
zE}U<_=%OI)v-ehae6Wn#uXJtGwyW2p&U9Sky1mtD9+$M^mM3LSy@#WEm!C7>J(98{
zvU62w@|5tkO$<@()}e8c7jpys7VqYNrXBa>`@U&r40jo>r{7(<HecMy{iyl=O$=-Q
zTr*m`t|7<9vSlTM!^@^EpK?WG6Mpa&`5cY2{cwuiIA{8FmYnY7jau!IUu&!G^}n|_
zd3Ry9w&|LQExNMG>+WYZO_^eNV6A)KgOjTk1{@bE+1mHvNbl9=FoBRB)daz<n;O#d
z3?rYnZgRTvU5@u;wb0csi8)v2G|RMKy`Hkouvgsk;+-T`(@T*?jS2TA$^JiPKCSXk
z^vs1TopybA`D}sP^jQy5E{n+aoxfqaU2ftjf41B`vnrBv^5*@OR(*b_$JxN<nD1+^
zX@!5@F8-feP-$vo-y9KhW~<P);`6npfA$}=EU}ZH_d{Gvd;g}=w^x%tz1mdL9m`i;
zQu*hk{Jgn5dTbwF=df6;R`c>^3Mo+hY3>~ncIfSzgXPy1cG=urb@laaj=o(-0%ipo
zEaQ~v`MSsK)wkR)f_cri7Ej8S*&<u4#;5Y%>3ody!wNA4!&NCO%8Wuc|1tBqs(SrH
z^_r!gm!~M{E^)tPBk0oj;ezl~PuF#}rq{x|&AQ6Dj+8Hvy0tA%I#zm9lBMvO&c;n!
zxhgmu8*3Auu9;?(zdE(f@3z3N#cg-j1a3c-oi2B;%Q5W6949~SN8fAxy02aPHYxpV
z*fQzMMt9o<YLdPwxE&YaK2*qY@3+{8jQ9BuzBB9G==ZfamcPJajrgsEnFn=}sy}9Z
zn<8lubj$L{<p{>hdE)((m1Y?xcQe08{oh}+%is2sNBxO;T3Rd@=T&-5yTn?1!C37t
z!|n97O6As9cx<bzVno9}8}3|f@lfKdR-FllU=icaHN_`a9^8E-zBRIKXVCo(`b>(i
zww+z}yz5`lG%x8bOIJVb=Czh?+`{Md{!dM->G?;TlMcVzzdKc4RVXTdddd6UxrZ44
z`doS-J&(6w;e+B!{falQdU1qZn=PtRzw|?<vQ_DB?T$z7#TyEX!%XL&_6$pipSLIH
z{=BS{W+uOz&D*xcoi8f$;+xSE?HhWk?61`H=>0hvn_p#Yo*gW^i*v76>!JkHnXFG3
zjhaH<y$;y3S|pd_M%c0jvDF2^hL4(8tV`S)BY5Imb8|JTJV)!D-rqCY443awJ1z0~
z;je@{ZF3Z>D{6(d*)F|RxA~>$&ye3s?Y&o@ur$=+e!RcqM#!WFqr@fbZc8sktzvL{
zu}tmN3!a%DK6Fi=@A$xSYThn6p-*9gf4UhOZKr1R{&g-pV|<WdS<d$dmYrN;LQhW5
zJ$4~lvUNkC^m0p9o!M_&&NknF@$CL{o#YEn4{~@nZn`TVaQf@akL!7Awq|+du04O`
z>QkX7Ij@W_XRNq%Fm{s5-rxVHyIhQUq<3=B#5{>=mR&z{gZba6@@(*w4()uBx@N~A
zeWR@Rk9Z}_zSM-WE0`~T_0c3^L&~XLUn?(9nZD|m;ST%B>yoBM2eaq4H^y`SX_k2w
zQNnk9=jq=$5A{|w=NE-nXPusRnCHM7u8h{;(j#p*PISKH_|h$RV=_bj&AX!WQk_?c
zFa_R-?eG4)`eC`#`wX6Yy?@v|6N=_febBqH{&LycIYC~^X|JBFS>;{4N8xbuvkwP5
zrYdeqHy19oVmy9BZA0$g!^dXNJy-wuuHWzH`wxk~-y3>7capEt+Bl!9i$XuYOJhFf
z*7D}ENA8#1vn0N3%D=j4^Rhb|N~G3pTB*x9{RC^}gVz#n2b1r-4e!rduyoURLG_ni
zh3=Lb55zUD%cj2E5PLWMdbVt<>T;Wp>8w86WF8;YteLGZAzc(xS)mu6KX23Vo(2z&
zgtD*B=B2Ma^v_>87ydKwD|=bU*<ZHdrN3u+n@3$){r}>GWeNUrkDSijjhVJG_Re)b
zzPev4-#$5TN5#mCOY2}o^pUe?7F`UUXC2dj_WKR{Ir&mbA0=7$HO_805qfUh+GhQ{
z6JK@9_Qw2Em8kpZ+`KCGYv7l<(36|j-+yMht|~PD&919mH#Zjk(Yg>D-eG$!ui0U7
z)!n%BH|i`ez2f?zH*=Fcb4z`G!_6)m#`qmeG|!jqJ|?s4mKei|xgF-N2fc3=Ro@rB
z{KZdb>xo}(%YEF|%!>;9xlT!H+A6;llNUt!Ctg^4-RlC^j0s-68?@#>UD$bZiJ8;W
zsV`S;ovC{3t#|YUKGx$$*NSv}s=VuYf0FdcSr#9>{U(3CW?cAq(zc55z0><@=d8Wv
zqiLp@+jK|&g7?+4cbS9BRr<^|GPBGQwm$kY?Nf1t*8c0l&lFQW{9m-_&GI<iC0ES~
zp9pOX`+OvE?zwsf)KN(5fK>--`571_JQ*0IaEwBhrX=bWR6dP~F221(wC?-*18V##
z*^<|e?s{hxeZ8>E_-2Z6Z2E55$i)jiZzMTS)Y9K}+2>#NdBzGxkAP)4zSeVJDK2t&
zaCoQu1BP?npKc$&UN7_ak)=+@&5O~~Sv$)gZ_IEzXSQu~l6&nf+X~NfhtEzwu{&0E
z$^EyzC!cmr{I0{t{AiQ)v-a7hJ<6P$ud}n82kuZi{nU5X62WM_&h7VF0-fF{a0pv}
zJfvV}apIQJG<(%}v$z89H#1_=IHs&CWV*lmoM4SU+pT>iCuF;m4n$f#tV(8fyCz>>
zWw&Rs->X|cR}@#+oxk_QcCSL>MYW_4`mHl>3Q3gODKp+&z@K<P@1d)o_r-JX^yP#E
zM1B6-l?2Z(?f6kAeW!(8>QA<H+Ru#74F{gv@Ce=Jj%X2nuz{~q`p(UL&*!;r*W@yK
zH=+D{S&4QWo8o`QUXN9~|E&3QtL5XQ|8^T3)|fw;6!-7%<D;McJn#Noo^Suh<Z*D(
zrk0NBI?L_PopiFgbA8@qnJII*`&i5OH$I#3CG45O`=8r#vR-JOZVIkUcTe&=zWwox
zIj-kk_2%C{)|9we;fzqugX63U>WS}oEdG`@KTG-j+4~pwjbk=`i;g-m%v<W&QSe0M
zS1s29>3wenwmv`jy8CqZ=hNNSPnXxvo@zAzx$^~{D~8+*I=^PR`So5@O!Hl@CY95E
zz+!c9gosUASxuGXQl2Sl74F8Oo6KIjvHdAtcdxGEv$jA$)SS#Y^;NZOo26r|-dxhN
zS?W0F#&x^X4_hzf9Z=qTz<ZjvaoRuMc8;xQQr3C~^<C!e_URUDUh_$mhyA)w*h1;c
zC6AjDXT*1J|53T|ThmhM$_L9%p9zgWv#D^axol}h!E=j*^XIZEo7)&3f6~;>mpblx
zrflN>np3}K7rof-V^@E!cFlyaxfgu$466?HNKA^C(9)gCf9PD1^r^LV8%sMr6v(t3
zn=kz?@<VFk#Kqwm0ZW%HQ14!3z_fXVo8aXY#g5l9=S-Mddz_<s!`vhPoemgqx(NFJ
z5MuiD@PM-A9k<kvhB-}P9(so_{C}fbS>a}-_#ohuINKkCNo#Vxu;~}fcya&r#k}Qz
zbxw9^evXkeJUD^>3-jh9ED83dh8^`k{{Fe6WRdR1Rean3F{|F~4GhAH9PR9eY@HKY
z4C-BctP4D+3i(8v?Tl}Iu=2`@94>o-{#vmaD}1|a%Dt*sL|8K?R4A}*P!V9Qw|uYX
zGG~USiQ6`IM&s)RoZT<i2E5QbDR4?)Wk$`(#f&AhwQt1pN*-m%-EZ~Qaoux6mLmoH
zMI7&wYYgA?zx3p9?s?DpvN=QQQsDG&Y{#~rd%VHc>f)h8C5yRoruQAtYST?Tz9qc<
zZSRW(PPzFW{tYdK*%7>38E#)az?boTiRv2<Z{02Y+8bi4m{hh*ee2<!+y9N-^u|Gv
z$_#evD*@F;vJ20p-kAJy!nfsbL(Q%PbZ<~N`uxDW3y!j7ciNY%IMlbh<WjzVi||~5
zV|!OwE4&d1xt7nnT9E0$w^tj~tpltt9PDc=F$zswxN>{5>X*!TX70<OI*d$*7Tmv=
z_uJ~`qVM4=?}~=0vxHRhZrk5H{cFh;KKGKKz?%geSGFCyGJ$JGvnTK7`_s;?J15w-
zSL*kMsFtvf{ke&zW(*AKp+T%U(c9l<E#>lB6KpN9b*Wf}sM`8N^R6WN@5(sx*1$0~
zR&GV=nR_jMS4G-<n=`$A&Mdeqm9~D?em?_cpIZrj7gz7_6FGCR#Ob%zT;`6Q&0(B^
zhU$}N&0-6V5S??y;P=`R6V^h%HYuMA7q>KV?%96i&83ek`Ya_cCAOYB$@wdn+b6>0
zK+}>wOS#6Gt7kk;^u8xJnR{K6<*ZAMv(~aLF7)2pZy1|hA<y?>#iH+t@@H3zs##2O
zd%wX<a%G)~g=A>S77g*$Q~w^<G`#enSl}MJ+r_7BVMq1ecx=@UFZJZne&zM`_!Q0e
z0_E#AZCbHr<yMuQU#6+5-M<wmcBe8>;(=Jly2OY4*1u+~J7lr&<8+I}Y`fNk+Qh31
z)+bK>xidxX+ttjFr`orRSACV9JURC6)1=tO{Qpn1rd?Is(0asi`Hu7n7mu9VDCn(K
z9&t2m`=z&@zwgxSubP=x6E?*^Wzo-nX$!@IXMOx6Td-8=$oBn0PAhLs;(Wud^|boG
z>U{y`m)>9ZYHDR9iFscOGu)&#)qW+%v^@_`ZQ+T38!}s5>D!W6&Ub>W&u!;NpT04D
z)_-%8ySEo*iY$EIQ4|rG^*GSMp+l*IQ)ZEw^iC%?CAY_4ZkarLqP4SYUDLVm-OfFm
z?;p0;dh6lrBUqJuD7*WZ^nLFikHdC-Dtam;apcr7BmJ4P&-tvKe99`;WHRr=2(45L
zQSWsj#w>S>+r3h*xLC(~sGe3^%Junbbn@IkvTHW>`gXniVNy9Ya&DqpXqJ(bN$9Mu
z7hL~uDjoE?t1j>SdC#Qp$#rL<dUZITZaRACi;v#i;#sPn^{Wo<UelF(u2uZ1@4amm
zN!txKiZd^r5-D<gQ@B{AYZc4u><GnfMaAjsSBUS9`_q4cTj=xZ!e_r<h$}2LO{u7G
zn$(+r>s91ljVy_ZD$)EIk3SZvFR3s&ZjxlU(xEtuWtYaBTeEpLH>%H<=lQT{{<4x^
zvS$)ATf=OcRWn!$x>TL6#N7;x@<@$iHaO(){OLz#_RCw3#muPqp-|AeY1@&;JD*A}
zpOg3M6+3(5Q-ki=vIP>g>+Z-rs1MqHb;Z(kj@(a6xePrW-yZuc9KrKR(e=E}l9j#2
zmTO8n<UgrgQq=ah{4127EUoeIXHE8^%8!p+KmKV8R`R-Oq4_;CiA|A(V>;`%Sw|1G
z$2ab7{~nWMf8b450{52J2D~vRw%$0Ms^{W){vd1V#fLtD><L9GY({r}Y-3(l@?Ldy
z6aT6SG4Dhz&SvcDT5-Y3+xT%<7f+>Q=#r~<S@x}bFL1%s`J89z_QcNx`F|27IKNnQ
zGv>i@&SsV}4xjdJAM?litXv;Vz0Q!+y<^U4kM{GsKNz<y@QkQ>({@heuTp_!<5pLX
z!xATNecjD{Gu~+Nx><EIqn|3@KeT9S%9<UWv$~3#Qg{Csd8`@uRz&@L|4%{xCUyNz
zDOW3-@@11=Y*d%C(EQ7hzU^R3{G|Px&R8aK*j8*SIh^?C!?ofE?N@~DSF7ASvib4j
z=z{()QtK^c_J0<#3AVPY&#zBAe!Z@ucF(rNaw*yFtu-}&*vj6VxNFEElM$7cQp_2g
z&U<)C<c;RTW}Nm5n^%<2y~h<E5?b_&iRlHmkLLHpFOqkz_FZ^<@~b$fW@k>}#79;v
z3>;Dd@d5KRB?4JKroL4*WR(2><>O?nh$zc@k5rqUzEz7|6*y<Xa_RhtE#C}g>}U4e
z#4-QgZT{~(N`IJ6avZ9^Wn6Ue{r8ZN_TzQ3I*Yn~S=M~ClAjl%qw+t)Ew<A8TqLh}
zK;^5upEBLP9!?8kUVX>kX=`n~_SG(yUsjG9D~kN?$4xS<JHTvuH>zy*gM?fAHlEhm
zleBd1vWwIBCZ;DkwNHOzw#j>P)BTP4-fdG$GmO?B_wDg-^Ev7E^@Y3s=V?XrudrU4
zckXci^!l9C?Q^BvCoQ$R+E8)v3+Jl88OQt1iq}5Mw6_vrU&ki*JS=3V?AD84SFQN7
zdduYWnFqd{RAZR(<|NCpYC}d|bzPqa-!J&@kp7=|zjA`6*!iHpJ0=OwTV7Ono?#zX
ztofq7I$?}?FOHb(_#AWonK$E{=QAGP-<Ui>FyF%K$gF1?O>gp#zu^#T*`RS?w=RFl
z)HQ#nX9_s`@hL}y%icAZEgZJIKATVKO7VrwKBD|b=4GsYytj4r$+(=*<6hj!dwmLz
z|H+Y-&ARmU+_II-HzODCP0uL#A%9t8i&4aRwGEGpWg;%C)i8Hzf0Dj^a@x`K?1%$K
zF@L#s{nbCx_qas&Sm*BaPm_La|8Afk|Lf7^jt$mg3_&yQtvhu){|IlSj0ES&n!qn>
zb#DAPaync8fwsw$w1sasddivDMn$f6^VMAw+VN!OHLHtydgWWL9e0d6=0C;dG{dV+
zzDEl9zxVvGG}$&Y)%xqg$zSKaNKx3n*YakDd}8onudAF!hur&b&3z)aB=O9<V^+74
zf7P?R<t#I(+$7ucEsg#0-y4p-Q^goxhM$<XW5F-gJ;@P)N1o4jUSnfZe$sy7pRiLQ
zIyaUrz5V7O$1x5~-wP4NH*PBY>V38$v^}`sknM{N@%~!<E)Uh&<C5kr4?NOzq$=pb
zdwca4!k?Lfswdt0*MF^#Ga(|<!QTIN^YYBu`l0fd&8|(}esx0j(Tc(iixRF>&+Rgv
z8JYTS<GD_iH@OoXte9IhO@-5z+i#w$p2H>3f9`~;;q6mOJUU%>cFo#X5-{hxaJ}1=
zl79hD7g)5d`nE=1)I7;#?t4-8%Bsh!onP=DxH4bY@8$N|ZNKl?9gwcgl7Ha4&CLE)
z=({;DzkZkDo~Ez5LhIt6R<CU3K<lWfN&A})WD7lOuGtW?m5+PwBgbwgZ<nWYJZvR&
zejnUa;JyD3Lt$t8g8sQmr#`>>ud?x)_3XW_`Pa{ym9bh*Va@A#ZoKSZxMG;;l$7LG
zX@Ny52hXOvS8yvHj=J*6@5l?^SHH8Z3lol2e$Uutv1iw!KL_{hGP*i#wf5;>7hg>I
zFpFdA>D9p}m|Ej|B1)df>#m9I{vP_e?dHLYYcdR;xBX~l{PAk$hYU%J|A#K^-dGi3
z@c8k^4Jj7`cWssEZ|DB`<Kw!=-fTWkuV}T;?2h+Uc-47~$FZ&C!n}?@D|DAP^}p|0
zyl9^b%m1q^lde8X^?P!tit$i=E_>h=!&|Phi>%hnVAlT_cC7oD+JrTmbc&7cwRWs|
zwY*RMRmY7*m)A%HH-&sV%d}>bVII?C>6JlR9v4%@wRO!Bj5GgiIVYH(!*sGNZ&SoF
ztGhnZC7*laU+F1%w$FHUe&@&d)2oi|wCPId<llYevCrY9i=`h=-f=<iRn;e5@lTA+
zZ?8AC<=>Z_w(LcKPi;liguvzNHCLsd{;ae<W2vU=v81*vc~wiXEeDF7=jl$~I&0y>
zsi~Q59WS>!Ul3D0`N3QH4_E7~Y2Bw)3Ja%3maI_CGfht}TBrJuZ~xO0b-jDjG}oz#
zEuQp9=ksyNCwsG2&-tlSCEfZ`&FppBwzqZ{zlE;OD__1lead^MS>?6;_v~-k)k!Ow
zdIcQ$HD&HhrL*hmXR;lAke{(laOSKZ-yh#qef&^#+Tv)j2LW&Tgy%gAPqbJr^Lv7X
zY>id#^*y4yb-x@Cef`+jq%SLO{g$*k^*oDDb~7uFtj~J*Z2$A{+q}K||L*^G^qSju
zp61p2BCj--iiOLE^_*TOInAWB#DJZ>;;O*^<wE>HpZCvL`TM-@hkXk7){2WiX}Mwa
zW0R$HrtBYS)J}U_!@?g`tPBi20yvirrQ{^$rRx<`9u3dUzilS)?_K=CMH(8Vn<lXR
z4PY_YFx|wV!BqD`ne+rUCf&I?W|K4~gaoZWQGZ|dYtpGnd*5B=P$}#yKmPpQ`SUlA
z^G~nWt)H$L!Zz)?WJuUEp)ahzmx{d<oA&(U%}18MeXm;Unn#~LcRp@!;{0s~?llIA
zo_@f{6*^txxK2k=<C*!}E^UYrI}j8asi=KehbtvPajQ@(*Vc)er>CZUINP+&rE$7x
z$d4+m#vQG$woc5yYxZ6V;NXtjb7HGj<fJFPxh5){lT+7jNnNyRis+IXI%2YKwUb`k
zYpYma+%dhPdwm!i>%En0G!>HG-hZtXF8lmIl+v|%W`}OvjsLdgu1xqG)7OogBmHNl
zwtl-VWxM$LA&2wX<)$f~Ykicy9Q$%cwQ|pd=41R^S5@7fq%hvy`*)g?Z(m1*A}?Ff
z_J}2|25qroi*9WRV`IP8F3#O{{G)0|xvuuMB=c2F?$f7kadEpfRf9)I=IgI#uWW<9
z)p1w2`G4s6xcSG|**|*Pb<^1_kDbZ%WMX!eGd%y|U7^*om5%I*HU__Qs`aik^lgZq
zI&;TL<1;-EeiwMR=PzLDEpeI~AoZy`ET>42x5?k`*1acu>kd9);$Ly5w)~j#@x(`y
zpBt!eE<B)~Gh=h#*CdvE4`rGPVh+E(dDr8e#)7Hqiv$>Xo}6s&UlILBTzyW}fxqo<
zRrlu0zK!{_Kib9c<B?;({=J>oCwA$8qb}Q@PoLNOnS}dJJzAUi$42kdx`t(*r!<+j
z{ubr4w0iid*feR0LDKjBFXeM~wjBQMI{&rtzR#}~@SZ==lxsU(`pYZFr=g3MBrOjA
z%TjAK#V0FqyT&>npZSm0dxbSlt}1QkWtrczvhni;_j|^N&2w_qKA5y7f9MyQ8l3&5
zQmM^!iBV*3*q)6)Kk@R<H1L`Dep%s`Ds$C79rc>Rg)U+iq7Pf7WB%NfUzG7+?KQ9S
z+Dm>4CC|}v5&NLsxXUO_RQc-LD<WYD$5ZA7v$?8Fzj9V;_Fu85g4cA<A6OE#>&)V`
zm@Sj%zF+K^EMDtt#s5V8r(ez#gA=!&O?sUj&&T`mM$~^FU)k9|)!jTy#Xeg8iV~G<
zwRhQ*Vsw>TPyTySvvkXfeFdkl9k7}+;isHJ^1DRwjqIO3%Vp^3PEq4fS5q{OUTbiC
zkLKCs6?3hc`QARuc)%fex={4s%bi7w3#7hW`x9OBq;J*Z%tH<pA2XS5*%{6k<p`0w
zGkeX7AdUcqPh!0Vacz8}3U)nAH{5fa{<8&7`Frr9)I<Ht+pnmIx?cQxbiw&0rltx(
zCFL=Khg@TyT;Kfo#tWN<Wk(M;-w5<u@J8;1YkK?XJ0Ft@Uw?SKdd_^2*?be_L+>n<
zK6x%%dU=O8)A|L^qs8l=*x%bPqgi()g0b;+P-O76+WkwOc9;FRnjMsp(J!Vpb(42S
zJ@=={3uX1*hBUrPbQSz?N#L^ZY00xU^OrQ5tH&+~4xM(xwrRrOCz^-mfB5$1QO*5%
z1{0-XH(KS{FF5;P%W;eUDY6wDd%q@@`QLueT_X5AqcSLa>%~Pp8OJUpxP~t@wtLCu
zwt3m%w`|`Mg=fy?Eta!L`lB1Kx4YzFIs36{fg1J=>F(OE6Y2yKoX+pFzwDpWJ0a+*
z$jsLZcO87Sak=&Z*>e|*V!5OXj@^D}lg>RaGWPsU_Z&8h!!dq_S;-BDeV)F}>JfL#
z)5=-(u3D~|<zEAL@xqCj<t_^u7aHD~`Fj4PU4|w(As#bCr61j|%m283*F%|@#6S5{
zO7n`Ht&-#&re6vukx5*3Q|_X*?sw%L=epjVu__;z_bd4w?7rCYCCMR|ky+sE@k#9Z
zJ|}K+@6S0TY~jCmjUxAtv(@i3UubQ)KYyi2X7H3n6Y8BmY|?!<UElq7y87dKUfYzI
zKg_5_HhY^w+C+W^hVAAI3~JcNSyL-YQj78ubK(n%^0QKtL8r8?mCi1{z2oEVI@YXu
zg`0~j=Vi~nm*FP+JV*U`=i`bb^__jI6E%f46)xkL#&7@XWBq$QITZ(|O>^cw)0=qW
z?$M<CyB*3-9{qVSzk0dOQdi&aenwFyIVUqrRr61)>|I!G@A`XkY|)9+$Gc+hn><<m
zcmB7NPkB}4GtY8Qx@bM?a}jIBl7%O;j3UEoTpv~3G|P2;JYz%X$<=Ktt_No?N!+tS
z)MuuNxn*=lL-7yG!26YJ_g^))tbI|prF+vO&9%F)pG`j5l|AXolc2y}lf94I*}k#7
zu6+_Y`|^Yn`|X1tto||UiLQ;+;_ul9{JK=bS**KO&xvnOxwy&Z^7^2CT9JOMcl}?s
zkpKSNeYN$1^)=OXbw%IelrKEedwO(IY<bSS+TQ*9{>sd+|Mx|%(KNx$JF3Ad$jy3^
zx~ubQrIY<%cDsw0gxrg}ojvD%oO~C1(*YyTmB*5QELfxQXQxNjD#3dfS+=r2Dr9g|
zD3NN;U9w%HI$2(RU+a?>KmPo9^MYyL`bg#q-^!^bcLYTBXSIlK*~M~7<L88$9saAb
ze~L~&{V2L7;B~y}`s6=ruSYC2lsfiAUc7wGBi36_KRSDPo9qd=wdUjRIn6g7Sw$|o
zckoVQ`(bIma{_)RW}P?9eYAT?(n+P|g|6#gI(r!L-9IJsr0aF-lk#(25u2hf%DlC?
z&{MRrX!~dXN6*=RS<Kv^y0b^`e`TGF{J*N2AB;I^S~CPXE}ctW)w@->LFjZ}#4Vqy
z2j>!&YQ{I*4t$&|qP_lN*w(16ym`;3Ts>QPRC?a0J1yd3>lfA^l%KxAl1th)=XKlq
zC;GyN19qnF{&Z2w<1$05jKdkV7XioHy7p_eUQw&Ly+P*hrbWy>{-OFCO#ENX`oj0L
zoQZeY<Z~PfA5wUdlJ176-MX#AT>01U^08jEy#j|91pO8X=?U7$<n&o?&7)G;e9jv7
zrbni8C$WY{9pZ19`m(C=fxBDBycelomNta0yY{NsZoZFN(R>MI!*?&v_8ne!@2l2M
z)@yUbRJR*W+@quDyrIdo@Xd9Tc&j^W-B!;PI=><DJmWQQUZxLPnnnwk^fu^y+$FH>
zLKk!HS~Zys)AVAu$j#E~yq<Z^IOKWj5#y=P&ptnR#o+#=usVTKBmQ6E3bh~BJZnoY
zy)sR*<7WM*T_vAh_^NvRSDAL<wepf5HtfRHyf2+n)IROe-?Dlh?+neQ6OSs$Y|%e3
z;Xw0q<yWt2+3(wLa&&Z*<$3!xg}L_(SAg63YYSgU*h@>_WjLCf)bXM&d9n6q#)7YB
z>+W9L()Bd&;rWGDt4z$kE>sattXf?ey;LOrw_`?D{sPU3;@5&+-s9_NSlShSuR%)N
zLA~;y?H8j0?&g@7MNOu9Y77RiS%UQ~JY1D$9$LuIGkwpe-6C(QC$vv{bCA0#NZ_xA
z3SSuayRIp}3MG?T80BmZsI5N!>7ulhLD0qO4)5lTf2<{&*RWgHHg5c*dQ4?%-^M@u
z2{{M5>>CU{kDiqH?RP9<;<H@0__V&gM`HX}CQsn?+3pb*@_D6<x6SL?yy-PsC(LiC
z?Qg%7>nWA7V9MMLv)(MZEI)nDdjTF3_v7Nz-PPxR{p=d_w&ltF84>?;C+tqI^qX>e
zf~tv}!?uhaZa)Kq_v}x6$$QC*i-93<qmN14M90_C>+?K=K8l6q=Lt>mzZ<lvqUBZT
z(f1odT<SJ=-3^S4@w`?owL$st7iC7vtwJq_jYBfuNUuL+I8(u3X~v|9v%SPj&);tA
zie<D@|2}2OqT4E-ou1tWFN7@*6y0z&y|Gt;W6qKFPu4!#!`WuJj{k<yLEii3O6J#Z
zg*@8QWY>M{)yDj#zYl0k<=GUWW0}3U;mzOXIUf&A*nO=_dFI)U^7%Tp(eAa^pI6_X
zq&iK0(Hmv0{-lW;<@es~|F)N5bGN<6-mZ-rxvRO1vSL2;uwCQYkT$(~`U75t(z;kx
z?f8P^!%{Kp4gNB<6qIjeuNVHpZ(Q`Ww12{T+jpGq-`}1QJ(K(Ifbf#Vv-jDUrF?M{
z_kO}25uUbvp26AIjmB>#ZGVs`U>x!I>Y?o}EDyaWO|V)U!KoJ^Fte@GqtLRM^{g!K
zi%QSiAF`udzVg1AY?djoR*-+z)~WGV)ef6(+vIm<h2?g=w_6u2IhHrq_Q%1rzqgi{
zuc%tE#BX}`)hC<GYgof_)?YIBZYX_P{d|7^{kebC&ZPVQ`uoPg&iccff`pu+0EyrC
zUY^t!IIk)?v&mY^Uhc$nS<9bw$~)uz&RG>16-qsMa=LF$&HjmZPTqX@a{A(APoc-|
z7CzO|7oIo&Q2)f;wk7cCt8^_ZmUZ7Eey&krs;ro5BD-k!4nEJcfJ+nkx>?vtH?Nr2
zn)svfZI$_+V`2xZtL_Q^ubdcjPTrIy!8S=D#Jxj!Y3gsM(~IrnW>z&Vp00W9bjs0B
z?q9wwpW8nFzQeNP`yZLt->tltXUL;>B)j`|(|z%EY&XAFc5eQ)G4I8xZ&pu*_Sfy&
z@rH-BkzMeMsa5HBi*0G;Cs}hjc4=&Bx^d>k&1l`^MRPW_J^2vOve)j_(=|JKUoxLv
zXuhGU?9TB!Y=;ByvPncLZ*k4}_N}OcrD4ytNi5pB^1TVItf})vt}9+VoG5tB{c4W6
z)xJ$>69i9H$r%Q?+L|OAtY1>`WunzVFZLHk8|4nK|5va=hHu%$gAH>o#T@RMcI%bP
zMGNnOo;kZ51em@YKhvJ{dz);p_lFQaufV`}Ml~y%S3mr=u3+ZRJ*!v$yIj=aC~!G>
z&XHeH`?}H-g%0PWT-@IJRj4$@ULuQqYSPRH9`~L_PyEND_EFaC{jBSPpJuh44f0CA
z6`gf#t?Zk7W~-Oo?%6ce!u;{4D#bTKCnDwhmp|#?E}UwSHN{$;dzM;2;wopgA7Rby
zj}7~)>f;l0<9SanaOHNj4{_psUdj74#91-JW=g>9Q%2mc-o{M+kXa%;@q2o_$2{Iu
zOJi@#?76I*zxLPJzc)V}`D>BPAtWO9jVUxU!cR!b|9r)gXWiEKS-7q(>^tAQXqH*7
z<syMHGcybMiEdkBw@KFAa@xAqWOi)W+ZCR#UhT|iO`R97cEjfilUULp<`b6BwsT!Q
z)YF)KU+eeU9FbS2F6OLdE1Lc{G${1s;;8~I<*e~l-0O~5Dt+t_=RBib7$nJAWyk$1
zL8s&FSyS^6&!WG2$0d#LpWb#x^OMpoiI2x?_LXYy;Lcp#*4iSz;G#gr=i*roFEUrT
z=k&LJ*PS$L>47hk9xJy@O}F2qz`<Lj^z&OVPmf@cM7nCC$RXWYp2GW{v(0yy%0x?8
z%dq*ecHZ5)m-TPqGtCH>s}c$Kyx%|Il(Uh)QOGrOV$r)xA1Zd)NAX1%buce#kzsz6
z&dB)eT9t9$zYob}x7@Q1JIAGL|GRyEef{=c`R``RmXaT*Zt#6v5|X7@IIlJ*f7u}g
z-Yanmd+vtJSsM}i_zP$A+?lLLH)`9+&Ohpu+%9=oLiNEtL-R*Q5gR@4>A2}DTUz)$
zk(}!B)qi{Nqx&bF!mU2%dL-T0oVxe?w56Z#*|4>-OtiVO+p*8k_g4F{eO6x27L@L6
z-H?3u+A5{R{MkOM%oI+9y_UT8{(hsYw#sbJ1p=#+SbhsgUTZjdD&CWG&6AKtSsBZw
z%Z3Do9#Y8MeeT}hiK%+!yA~UMT5`San5tFr)k7>lFXr91K4`#p*o~L@n973VDO;u-
zZ(L$6vxO((Y4ge%Z5E5v;(l~IsIPx1%b%9`WaaEXcK(jxOeF^wK0Ff2yK&8i+kfte
zu}W>4x4-fUyJ62IW3eAEAD(NJTyR!VDVt;NCV@xsuJRWWc1j%Im-R*Gm}L`tpxq(w
z(tu50c-+3vo3Jze&ZLKm3i~#>u6_K>SNq_iGd3Bs_|AGSdML|v{|UR#54q(5uBVJ|
zd_9vr`{}*&_fA+b+U{B}A+_<=JmHj?+rRcc{QG#qt(PZXM4q1T$I|U&Nx03HEeECE
zZJsHlv#HX2bJjfHP~W>LTUMq0bzSn}(We)er=MLapl~oOt;l+s{IrQCi2@?3^|L1a
zJ-E-sXtI~^wKY2P(pYvd^ovyZt4)1=!mmnyRp2`2UaJ%Tn}SSqI-cM9<Fj>F%-wwf
z&7aJdUHeuN{p-p9@+G-X1pVU$KlYR;sdx4zAO5JaQCj%@Tf@?|T;W&l2AhA9<Kz|y
zkg7VO#&eG~BwTZz-OJ5hr8-y6Uz+356wSO=zb)P&#B^(8)|}=0T6m(Sb@XvOY7##j
z{CL*n`@Ye#ABrzOxPDvlg>$-ggkxjHJ7JLv8wGq)Zne)%y!PUlg?XIzl*GBFb(UR1
zhh`j@#-|`Mr+(*=pR3CYN^1VSd-CPS0qGdwol^g{C6%y5MNf5>DUc{RJd<}8?-^mC
z^s|g!TfE97vv%D*^UE~GL(ZYW{M?@JTNZ>~N_ZwUk9Fem^yI=~5pDO+LH6pG*!m-$
z<||iTcTX{^JS5NO|GFtW&`2ifnQQbJFWwdj)_+!OL|q=woH2P{hm-t~HMQOu9jDjy
z><&7(F!wt9`P|;wvYX2}mt52pd;KTD>;t#+^HqGijbcnh+7`U4mc23E?62ObV_nk<
z_j<@(W>uTF=hsi6u=3<9-<Qm+T*Vsbd+y9-b4CN}-gm~i7EwnV8)O8^eVIl2CuuXh
z)#pETuDZs1dw<CV)zw|R6W4!xzE@zft8D*!DIVvaC)nMNn}#(i&fIfJXeR$Hq34sn
zT`q7@-Vm`(e`?O@bw`YRPV9L5bO%dXNpX_bD)(LitM7jEa@ywG9xsVMIM42@j`N?U
zM_KyyK~{zzm&`9|e!p!01Fg60`VzfY-)QGK^L!Lrop|2UqU--T{-7N}IcHQI|NMWs
z^M9SGe5uoco4dScUs~|j^t+k=xqG!uwqMKd|K0c4(A^<R<D=TG_I%w}l?y-lZg`ia
zZn*A8({_pP4SRjVMR?a7oWcM9B%|CBiQL_<_dTt-adF3bE49dFk309h&ak=lY1-p%
zM!wCBp5?VuUW>`JTXXMkHhy$3;~ewpo_E)N-$;M$?Qdna$o66JwkbbV3NDw=zmdD2
zE2OL<&BFS?M?*2UXq{Ew2LtX+dfU;-lD1$)eZz&n@BS+~xxBBabN?&V#G>-??~AkX
z1uN7Xe@{v1`2KscW4&sOTJuGFE5li$$7O@(ikkS;uPm)#kN&XjEKA*%GiDxE&-zRE
z`hIwI@w&vB)g29+_wzYMpIJR2#B`74-c0{3Msw;i)GYt{Jhfcxw{^vBart=P*hSVW
z*YA9~=6q+t8SQn?uk4#Cq<HX4j&1bR7Qw2!n=6GK?peI6kmSwbiRd^nA*S~A4zJYB
z6W{;1`y$%gfmgie33F4%g$IwM&*e{**I%|uUhr`%uldtoe;-~**>k)#Evj@Co6rV>
zgI^76H>#xnU#iv0TP(Nk-I=pRnp?}uzfBWqKKY*kwNt;ZjNjoqF9SoM6$66=_D+3T
zF=*+ObawD<k5AV7llp2V%n`Nnc(*m=r&f$p*~%2ftrok>j|TSX^ya8;dUC0UAz$nN
z-(A&mQnoy56V|S_u4l+x_WbJmcbT?{&)>)WEq<RX_Sxyf-pMWEM&8D8vYQr%is=8i
zx4EGHIcIg`x@)0k@gCoD{y(TTi!AsiES`E$sP5?JqOC23KA$pnZk`<WbdvA#Ox@RA
z{>ycu*PZg(v_iv6^5hzw7ADOnT9ddh>;C9+Ws-X6_%%6y-dUal))iM}m!8ODI~HWk
zcl~U)#{-sUTScCEt_zPeJgz9b_wEIs(i&w(!3`(ppIUOR^1zk<^DSkT{ZKuXeY+%R
z$x^u-cm2;rdAHI^r>QS{EdRr(bCu<E#_CA!NWJ!ZeqAm1S>7z!(e+8ka@8}_N1-z`
zH#>dG3N8F0eMs_$$P3~6LyKRe`uUw#chA4?cmI#njpy^v#mR1$QggSz@H;c|1Lqkd
zgWozrch3Br<?eAJxK4J1`SlIHHWdvPPfmUjHskor#xi5o_eClJyFaUb>T*7FUGkw=
zbbo%*KBsLQ6B2@#ycX$@*x=){ezTJ1`b4{|*0wb>!csXSR#)`pT3bh+QhWF${(awa
z{d$|apU<9rX+JE>w%;sL^yIn5|2r=4p6J#g_K?YH$HpCbv&<ZJMJ$ok%Gr6rxx#Yw
zxl~pc-WR-O=gMa(c9kx_vti{1ZUxr3)Quqr3gtKt);$aS^i1l9$B%9GOFlI3zkBzt
zc};C>80Y3a$1ZJ3TFId;A;ol{ul1R0jM|1Dio%<U!X58^c(!Y+Q#Pm7)|uvP53X&A
zR7{!jygesuTIKfASt$!T)gDR~dQ6EwaA~^j0@VjEHXIDw9_{w|pNzG2*5~!-Me~2i
zo-}W_u&k{;cC7Er?>MbJ4VAwi&Y$1@`<_RmstxPh>7p~|_|+c#Eb?Rf!xrc1(QY~K
z->cN{D!S}_G}WH#Ezh|dfy}IznU0@uo!PM=PW8Z<f9bco?fF?bwk{}NvEXd=1vY1;
zB@KGaY4@xX{-_BDNho~1#vJMD8pIuEny_psbJwdI3=fN!OE0mW)oHYT>D_6UuduV7
zD|ql=E&n6A!2RDEUA8<~;U(j6*@R(F+_T7!CtE{xWiK$L894m7^D@p=^u#R2fP7hj
zDfY|_=l8yo$$2R{|J0_&O}@4dLgkLuXuUGYtyp~bmZZ|A`)?RO?7Xe}^HSO2;_bV)
z29!7IuR9~bq|CbY0Y}K?_I2m@Bvwo~JgrPclgTqL)A;wE9=pO17Bgnf<>|PzK+w2j
z(XocVRYpHQzWK{Ci}4%R+Lg;zO3abs@l*5IDq{FOG2YAHI!m-()RJe%+Y9pqrhk4}
zuu$VQSHSw5nOTpHhK5aL)p{u4b74x3aAN9}6%4kynoe_c{zRl5eJ1H@>%4Kph2E4$
z+uUby=?hqNPmRlb5p>RuN%`VD#?y7H_B3Q3T)%w5^oDsUYzd!kx`(WL&wXKzc<$$`
zrYoj9FL`@;V{gI?`S#GmKU(k2z0JlKu<T>{pDVxb*k2bfo2$5f!MlL0f7KzM6(5}4
zUJ)Dm)Lo8w*=HlQ`DJT%J=*0IIZrI1-OX9rE#}ZUx3lZE-|0_cw`?~}{v>hLSm4T@
z^pm`KKNS94cK)9Iy-Q)U#=j%oEfqmRhMp4_g%$fb*(_FhG0`>BUu#XsrI~>TT$S$$
zHk&?dNZp!uBzl?-+wXoM-@0i<-<hVzE2ty}_Wdf&RhPcQ`m%rHrF7Z3ss2|L0>WOK
zUA9dOl$q{b5W+CyYO7U<$?2&=LOt!DFU%3>2wCTny(jLThf&UqJMr@WO->gTEuHyw
z#qR10B~u0VoZT_u&8*Ek)*NK^J9RG0sbr>O<?S0E4q1Kw^6Z0tg<IdGi<g}5tZ=v;
z=p-+5^iI*_#cT7Psy4n#4_aU3*B5(W%Jkl~FM8r8Oq<o>e)QL-^BJ<Wx2{cil=Q!7
z%h{Q+*HdRZZ+}>OOEGiRvoCxnt{pE=eU)dkV0Z0}r}?$7c(p=rp1xh0^}Oc3+f1oU
zmegC*7;dfSl>QqS&cHL*nDKY=^@$0aSFyZxJ9u(^mPiNNp2BZ=ylfj2&L3`m-tb4L
zmDOqOoZw~3lX>3g3OwuL=hFJO+oGl}bB@maCu&SnA4+WD-C}A{rOKLgR^8*<6kBP-
z8*$sOTYtGxp0%w(_RExV@jE#Q+HKnskC@$g!?2y@#+G{TkENkoVp0TBuetW<u&n0h
z$Y710ZmM(Gb9vyU<Ch`}jrTKsV!r)AfGzIK*|>R)?=`NyxOQvj#U~8>GJ9)J@2Rgg
zQB0bto{_T0zUr*aj(d~bXYguEiWhEidM%>ANUO_t6+?ZlaQYlq5xdjIv$kyy&I?!`
zbmQ9P<u`uqIFj*t!aSp`+-<qn7ew-#zPa|i=+XMKQNhlC^t?8Ub3Lfs7Bb=3HTzw4
zZvqsB#bl*rr&mvQe82r@{H~wnDI0ulu*&xyG+2GX{>EIsx61QRula6qe9;ka?<6aA
zmxlF160@Gqv--Wdm96~ek4H_#k;ngu<&-aO;}c%Stl6L;yl3*`Wdi&T`x*E`J}fkA
z_{MtYlh;l;!@E-(l%1wL>@4?AX}s6A?*)fqMhJ)PjyJ5VCFO-Np{ZMs>S>0vH(uPc
zhT*>Vx1BfNhfaAavAseur&Q8&cfw|+drd8z^RE`)Z(fid>TR;efIT85Y}uD7e~*3q
zpQF3;g`cQ^pGJP8OTdoS<C=X%*A(M4!uNa-wOQ79JkFH)+Kj82rzScd|E;{|xu>;<
z@yp<;(b6Y2=p16*@43mc#q-~_CO6N`yvsO$@0%ESit8uGBUhE5_QLu$pVwZxn(@p|
z-OlGwkH89snD^=jTmBm{@86^={Qc`BAFthuznK5>k@}~ddtiIfLW5T?%j9z2#=kVK
zm7Zp|L)`yyM|ydm#SI<STT_=!Z5Lj+esRnP-8TE%X+Lz6798?AuvYXm^U`(mzv`U3
z`E!E7j@P*-FV20<J-vVX4xjQ(7h?A>xBYnSPJMsQ_izjMS>hh)6S;!luf1UZg>7o$
z;>JHE;o^b@r54{J&wp-zbvn;^Ran&K$)Dt1_D&6Ox_oSf^O{dSpQKk_GB#+aP3POB
zd-bdAP39GM1)|P=y}`0iJ@@^gt+pR(3+^aLOi}%CblZ)k+^5_R>c+DCDNhcQFZ14$
zbdyciYpK}wuYW(deL2YSR_)Q3HE&g9c22(V(Z02GwPD-I2AzGTnsPbnW&(%Lyq0ab
zzkTILU!D`nmmfD;-N|~#7q%k6apQ~l{IkN@2j&U?I;5*wteCrX=KGnql&8+-6nGgp
z_w>f_(<Sfo@15BCQsBI;!MUtc%h=YdZM^Lwwn`(LaUsjy{mrkBgzi{4ai-_Nbr*D!
zMWhb$J(RK8xS2D`DkrbmKWNt3IoFRECLK-IIqk#rYT43--l{t_Ie9NKKV0<j5LcAe
zl0%*crycmnk&^G8p55&F?C_7!R>_>s?^7hj8V_B3DB;T_^GL13BQ26?Zk4S|X){Bp
z_w|^=yCw(CpWD68++EM@{jRo6FC?<1VohW&I&^BeEuW>=wo6oWmkrY{=?_)cn8Ke5
zZM%Ifp6A^4l^1S=v~2izOvig>Uw)?4&3CGqGF;Nt0Y8kD4o{l&dV{$d|C}_nG{Juy
z*{TgDhd9e+d$wzPi718MObrfqxpl*HYQcwx)ypqMyq&*%;kge{RS#^-pC{~NmOgvr
zfauO+yMw)7?cW^0c(N=1r4^UY*Mk*7SEE%GY;Lh~&hC4;`H&!g2><q{(zB*a+c)=8
zjGY<3^G%&UsuO!2d{CQzwfE=*W`FOWyVi84+!k?t^-x3B;!S*A=8f)0CojBS%M`|2
zdQLm2=(fJIm*7(C-h_iKddY8BozwDnFg%_*F|F9Z{!LY5SI4_Q1+zaYX+4V&Qu<J2
z*2l%Rz=-LMaF)V7|A42iM{mvKkICzlJlW=uR_DcRF#nX1-HSgB@@<I+)>WuRZ58$R
z*|}!d{||MR|9<{?^5%+kt;763&38AxYO{2cmy&e}ZSjjNpQ7Tn{zFJ_hVh1N+7&Aj
zt8=ogPpbWY`fYbK`;G8AA+{5Y8x*Gf>M*>U#xpZ>_xx`<y|UR_7prrZDeb+!Q2TQ3
z?#B!kUk_YsH(-6Uc%sxL3&u3(_?Z`8UEzvntKFI%!y5YAC(r4<cjL6n4GqUK8Jeay
zn;B1X^H1@XD_h0a`}FdP53@uZm$y$Su~ezL%g<ete_e8O_FR_Nc^aC=4!d6zdt7Ll
zx46tvR(k#A)Rf$Usm;n4#6!zoIB|bVeSA?{@sPjQrle5sqMT2A_JsAFRk}2F){mL)
zEKQMNOu~OA8AMzYYS&q8nxs_lOjwm`uhV8eRgcXH&4o3OPMoY#jSw>3_ETJ4w7G4a
zyxgIKhehT`T|4@>?ci}u_O)*F1=cf|XivEnXyziD`QeY=zvMexq|a}e%W}tQc762G
zg@<j`6s<12ws0&jv9=SMwvTahlkg|m-5<Vv>j-q%6X3pZ&7=R~>dW8X^N+jm_~vg;
z+j5onOab?D4}C7Zb!FD(uUA|+Gxpq8n6>b@?Mx{a=Z6yUJYF~37)wO2$~N@Q4x4as
z&weJ8Z($dn&UhSFn07(6GA4D&!DDi-WH+r%IlbRP>()cX+>k1%Gsl<waMj6`jM4v=
zz3PIdPF<Zl%Zny^h3?-M4(yxi6cD)h?#;)`8}}>S$=@gT%6-9(c-dQz=bl*h>h<pj
zsS2|l&g=|bx%;rg#kQjF4?S{LeA@eQZ*=yDngsoSe?9gWUN669nS7UL>Y4IyS9t5^
zSh8z<$#-wkytX`b76W6+Zs*tMwgzqg{9u#*<zLR0@&Z$w-t)!&6rFkIz`sAo{w{A@
z-rrSvV4hvBklzJ|m_)k?LGGsC&7ZB-l)BF&^Y#zgc|RtNTU+0SGBC_v#mIo;yr1;E
z{9Mp^KW}Sa7Txx^^q}6J)$Lxsqu=B$sk?XIz32b=X7b5A*VD(Niq4m;kmL|xaqaPF
zVs4mZ%4K_D-!Z$JY1d|!K3JeqU1dJ)V(vtT&}&ntP7P1B<LR@1_rJDcit5W%KJD$7
zOF~mO>*&U@tiM)h<lpY^)-P|v6Zib}Y9;I0;Rh!l-+iC|;e7d~$(2%jyieDN`dscV
znYey>faQuy6`3JF?*He0WmCyjI?sliFFbTt!}Oz8`j50uhx5y|Bvu%mKb0`k-@Mx-
zLj0$zneXX@d3x6}1<#nRX5pT8P)EOM`|6sRc2(6=e4CVFkAzy)DsUg^UbBnql&=y0
zBO{B`>i<0^XU$l<N=g5^rnV8sIj$EUmU%GL?U}`ve)VU;EcFYm?3<P1*#b>&hs;*$
zU8E50B(ANo^_2Ft%byN1f7EH*c=CPZRI$)``d&X9O55#DT-{z|+<4LP_AAe+bu0C{
zE7sP<uiboA^4tF>jPEaclr8zL&~X0XbS^Qjs?U9AuPIc_7F91SoEG-s>tu=B=QC}5
z?;iiexV~z~tf$OulmGvla_B(#{$t&|4z@d^mUrhUW&e>{Z~XDEWBeEI(wt2v#e#n;
z`cy})=@$97HC|URm0`!{nu+sIrt>VT`B)Vk_A}^P>p!a)-^=>UGp3l_4Efk{)_s>3
z_mS?!Yg#U~ujW3`{c`oAoaP&mr`VRgv}!%IT7}t1;O(2!>EX<6%UKspse88CGHU*O
z)t_0@=6XuVpFbbBnO$T?)rke?9;r+{aKfZF;q7IPvY4Vi4Taw&A3i?#`>*iJ>HBPt
zs=qw@@S?%qqT;{y@9H1_emuE)F>p)$kCQ)o@85sES|mI;%)a9Puk9~>9DeS<o^?Ww
z=+sQnjhS7m_k1YH6`H>C%>}LhGo~B-e9ExzU(w0^dp(oyn7+U4{Z;l@{1VRl3wjv}
zZ(M#6<B%jEnZ-0QBD9cgb?4pV?xqb1u0kqmm4UMiu2)JbhD7=+&D**79^=&Ju(<QZ
z3mTdIF7WMBc{xkCho3cPX-QSjitmQ)roE>s*q;8Ic=*UiyZ^<L!!_%!S1ZRCPg0Hg
zb)fFwBrO#tqk^y_-mwpqbh#E($^R^lT;tP~6FXJep>&DJrV_^A)=>=8a*|ZMHa|!y
z`E>hu^NX+N+1J-w*8Km*DlO4`kkf05*QSM0Hcp2`^?!ubZ$0s7QvKX_>7HL5m;-K4
z4(?1|(5hLP{qD;CNBsLtGiR#AuiNap>iYAo6%O1JL#H0);}rZjeM!fWWe=3}*#1Z#
z*N8eF_uu?NEC12L&;vXdi@rTlIO`gvAl^RJSFA9S$!&^5%PFlmovN&FziR${EM`0F
zn)D-(b9S}lbp0ky8U9@!)7<~xS#ng={{MroCpj{&XGV%9$F8#KH_N`UAae@i(M}<o
z*}5K&Z0F2<9=fmZfqT#A$NF2(Oj{Y-!sD~%g5mp3hGwjty0s=do5a#TrUgdw7CK3u
zHL}vMdY*jiL4Lul-?Jl+bi7C}HQwyAJn~Jws^70!)5E=QI6a@ZBHozs)0;haMN}?o
z#VxyGx18bQp*PI7-XZ$_Zu7$fzJ)A$&G9_vLK#<|>6I_si`HHhUBKXah9iu($@7@T
ztemjRt-Yp_?nVDEXUr1)+B~K8S&#Ncg$^@ThP%3(gg&{j`#tBY$nf1{H}7QD6HgYK
zXGZH@u^)bJ#&qq+9y!(9&#KsN=Ls^_Mjh1K@Un4^TKrL;jn4%y?2r7mblDB9$ed+4
zVU6$4a?6)(^puwUH0gIF;}iKr3x_+i0(v&gO-^6<x=_XHb(4C;hDU$WYZJGX>Tk}9
zGv4sHGDd;lLh})mg~3Mw$)7GZDze9YqYh1Cy5y|<tB`ZKk=(3j$+K6TXw%G`tgDqL
zBDh^f`bzpF{XMHa0{2_pKQC;5ZMthxj&yS6oU5w7`pGFj&rRblj(GD?{JEy}6s7kr
zSA3*H8r7TjTktZbSa2LFsyz1Z*lexi`?Vi<JKtSdxi!Y*%?zW?aNYHe_q1n!i~07H
z+o#OA^Xbo$OCO~CVjnEjdTnF8@m$Qi#)F9$dW*K5ay<6LdhasJ?k!cnnkPA_Yw5Zq
zZd>W~rtWNJ&N^4lAji8qb-kHPSv0La`S<Skx@2%P_C=U>mHE7tAzHVa0xsxU&doV>
zz2Q;%%T;N~QC}A3y_$8t!>6mO#qEcu;?1^FR~9Cn$D%S(-vsXz)d;b2%=EkZu<v<|
zx*sE7!iti(_yro$ea}*3=J<a;9a_t|#P+08Z}@Ce#efUCt`i>U&tEOHzl)PIx9mx5
z%#_a+7mxHF=|25q)tdKQx}p!S%vjxCoG!jhJ0$wb=@RKVPs}tb!r$o$M~S@t$hBmd
zW=`4bLg_`*pWn24wEOgF*KN6$`HNS4*C@>1pc-pXm2;YD(wfCmYi`ebe@eS_R`l}Y
zuX$cyJ>?wQQxxkgm~dF?p4FbUh7#e1X_t<_xcl>9)@Bx=oiWc$MLxZoa_BV2^@QHD
znKO@iTz5U+@AxKuiEXjMZQ%+#i>rE1CrmkXszyij<~^&)HC3s53at0JPR~EOSuJqt
zp(_WplcloT_WM3$vFf>XlWk{q?32sCt{cyJ+jd=d>uQVWEBp6lu+?4U`LjsULjA_O
zQv#t;;y33Xv~H|z>Hg-V{k3VYgVU0zBJZW98$>5Cd^mVG!G8AHfb8R@ou98{SPB?1
z=0sG8FIHvwXq09qUl=geaVop|QMFouzh6H;yjb_;`u#<Jo6XnT$<N($VO3mRi=+Ql
z;dL{4-xl+qOVP2K@Zh_ENtBA53wyo&&o5e4Utj8KZPm;<wW?y)h4h3Iy^4L;c5Y8-
zV_~@PTs7tK^5lQg_tQ6PUz%CI--Z3X{eJ7dxcZ9k?+#bLxVSMY{wm{}vzp8cu6|wo
zMJYaJiEYZuZ%&ha+7?xM-#kC>Wne2`YK!M<!&ADtjDPn9pIk8U9#?~aLEb5ztZv8i
z=anWoH|rhRA<y$aDW83v;oX}ze@<ogZ8m<gxt%k8OXhAzogB-6S&RRw%zGqtpr*~+
z;X=YBCVdOv=Cf8O(hmm5SY6p{@cZGxiwAc%e^+mQFunOc+ZmQ0uU9WV&#u@$<!pnw
zVNPAt)M$g>60=3V>BKr@UiqD-8oeTP(x=V`I}Sx9?=Nf?=y0*-VGvVry)gaYy|@n{
z(?6J=k=75+*EAI0)t+N>FD_}P-`yihCmp7HJ?u$TcR3$F?@WsC>a@s9e<Nq;1*N&|
z^V@fOFXxl0V{77m9FYC3YrXv0Uim+qX*LWR^Jbnp5tWwJw5$Aol+JP9_m;7q3hTX|
zN)>Q3zSj1MG|>E1?C|TQn(MF57V#r2D;n;vvC2F+;YaPZU+!miG*$}uf8q^#%+9~?
z)Sgw>o_4$UpWBqRZ{`BkXBW9n^GW7Dy)U1dy3_Nt`|jQ6=TFp{eD>!4O-GgF<}N&2
zJ4HOb|5Rn2<iXE@MbrL<o8A5W@p!s_eZ@bA*L@F7y2CQ9e3u8Mw(S0-Uwv@$#qYZp
z$KFV5TI@FA&Y~-ueQr(4wXFI7j5*}mu~%^?tc1SFdl<>M1a3REO5@ekmq}&|+@6a&
zdaQ9*Tx@CazUt+vvsSuQe<wCMW_>T!WUxv4Q?$#Bukg@+C;i^Dny(fFWlf#sv&LrO
z>sKdS?=G5Tqgt~}ZN&$*wzomSi%))PS$=uPvU%sluHFgh&0H0%dN}Cm`o@3itGSae
zO*vD&Vb_VSn%3Q)uJ1T8;lJiz<DE^s6%#*ohH&}6UhpZ5Wn%U`|I>o+3*O&S;D0E!
z<gQ1LX3fFu3+c?8cf>e7U7_^aLVrzHdQ-l;?(Q|t^RI4E4mg_UYO_r%c4_xkozDAj
z^+KM%@Ku&h-@nIIX<71|Nqw{W-+G<kacPna2z}wa`p_qt^Ngk%A1}viXw5v3K2_BJ
zuBF&4CZofTJnt4Q*z;};yWJJhJPlvwdsd$oELu>Qdemjrgc*-5OPSx8Sae%WImUc!
zNz0E!)rMn?b=5Hu4POpbm#}iX^1H3P7smYDBIid;`yPJ-<(@>oLrQ<2t7%`-v`LKq
zy)6Gg^THG7deeTUnZB(&cmLMGcP~#_tS{0#s}_^TW&fhzM96Jd+z+e!I?H<8XB^_3
z7{aq|N@K(S2IZ2@I_rW9w$iMLpQp6!e=7YTa6QwM#XHzpJL1nYri#TJeD~}^;?hs7
z8~!ccu>Wj_^PA>(jSs9|X%(EQUil(*W2CF4f&G&SvCRKtTyK^7&C<IaaLL8^pwOx|
zm)~#BbahW*l)jp5-}JWJeXH8MBTfp%3uoppT+kGJc$R=qv02mUJr?fooo&3=F_}2A
z?O!hyX5+F?_ofJ|QCrbW2cv`2+zuAbGCGzwO<(M%>Y@v2yw#Sy(-|M1j%(p<PK#x~
zn0t$Rd)n<o%Wk^xJP^{|9`=6YTFnzzPEWe&{$u0vk1h*1l}{I0*;XXH*Pd`iC34QE
zn<g684FV#Ip70d(RR=_Ltea6_(7Kh?Z)cgH)A~%#=?jup^-MB99rn-Oa`mq*Ww&gD
z{bpph-JP>NEnYPL@0XwbTZQXppPZMvI<uv2neF{=(kwq-u}+UmV0Aj_+*T#K!DUO&
z#3#`*+y-sVrzDtC)6Pr$-QM+Rr$X83fXza4yMp<aZ(|B&-oj|+mtK@o*_Fk%aNivR
z?Y5@Q^rtm)M-Shf)ir7I`>4-tSuBD7nNKT)zu01wV<WzyyreO3;yQ6dj@1tZa>E2I
zwN;*`vu|^o;q~G|gfTOx-y-R+$KTjqXimCv<Uwlb^G>ak>TMQP)_wQ?{hAgaR3+oM
z(yMRPW1i3$-irBeHu?U~QjxUhc#+&zZCzvY>z{hWJGTjKb1rkeZ%>z!i~l(Nl<D;U
zSNwL`zJJAfW3{|s*CMSg4u>Dwaquio)Uefej$rDu2x#2lR+M+3&{%!fR&HJ&?mVyf
z+Br>k*s@QHs4P^S^{8jz=>QwYLUVoh*E?qQU$EW&ykJ!i`;(}1arY0O-1MC(Vf}h@
zp$&R9G0W@z$Qi5hd}3RxwDV+D$;1aU|IG<=`X5qp?x*T&8Hp<sQYJTw_$N;JHf7>X
znSe_YEu|AKI7?O^epV!;?hvs&M=p44U7)A<hVm|Ei3xr^wFd5I?#w=0usU?l@^d~S
z;)^SKd7}ESUn~enHh1lv8)ZIwU61Tsh4_OxR~M;%-2ABYXe#@1J?{J4`o3wtae9z%
zbNWWx&w2OmB&vp*A1h7Rt&{e->5}e?r4LK1FTA$6yMZ%%O7zy<0rKk(<<F5dI^QO9
zLZFf7siv}P?8yg#6+YWo8(jXLNe{n#&~DYrj|)XwYPHJ0opQbO>|Iq=He<W^+9yoh
zhR0`G)<i!!`uAd2!4Lly>oqs_8~+F|d7(XluPL*%y_R>~Rm%t0lcV>>l}OhJcdIYp
z2{k{vv+?1!bqZ4=Q#j3M-TD6N<G1}Mn`W*F`J6RVTrq0;scUZcljaH>i525~egFQW
znysmVm)Z}1`x+q2u;s&{DHcz1bx*F@RaJ28qxa)4W!sh4R5vzl&7M|jBOBl<Q_lA3
zRDtV-^Cy?uoZswr+CK63{C^o;f_C`~e*``@#XGGmW!~Tw+#25e=IZUdf4`%-v;Hh{
zT`iGvo?Z0o8fo3~#-;05-U*evdT3g6{9KiFlh0O7ELz_+!78}*vD)1glTN+K_Kh*&
zp6l!N#bu6tZUB?<*)>{unu~X5l*-STI=Azs)|(e|SM8pxv%Js0>sni<x4uT;ui0&C
zadP|q|M>Z2=@+K7;6)c0f2;A!H>uQ>mjqqAk;Y;a?%@_=JbCRk>35<0rZW@PpR(nd
zvYdx?Y4who7IO2Z-HCZzaqU%hT2o?E*e<t?CqL}j9vOV-nv-RB-ESSM8V0W#uj|VH
zR&>8~>*)>o#-WzSZ1MSzq3FMp3Q}*yMK-eEz9Ii4y>pv1&#Dd1=|%3AHVY5!dY19(
zYjexbWq<Z@HQ&$XbhPkn_SL-l#x#xd|1_a{8oD3;7iVi9iT`8uTj|`XE4zB`Mhkg;
zyc+g6QK2*WL+VbB8S1u%0Y?rcn6GKz7M?73A#-cPRs9<(zDX-YW0o<Nam3aJ+&(j{
zb?Y2)F&*VE4j*>9s4JLUNjkvwMxEiPFPjfD)8tyW<7akka#-1wBf~p8^zwplw!b&<
zmFqEz7EJ2m-PJwq=9Jlcj+j_~tK(aJ=IWIt2J15gTPmKfJ*B*jL6Pe)2kVSSH5(fX
zjp}YPzYx`Ja0^{C^_c3JBvF+&_x4BgraSW1PMNyq;;H?G#*T}uS0wE4)?REdWgqvg
zG@Dt4YxmrpG5^ukvc<vDVxDV{H{9D+v+a23x$T<|?|!?}ta|sKD}~>39_M)S?>4)c
zI6FEl?cKNQqW^R~-o4jeA{#6H!Y^58Rnl(VABNi#KkwkkUZ}PAt;vMt{~YArvVG5-
z!;rP9S}*#5<msNr)`?%(j%mG|xO4HMy^qcaCEmVw^!bzzQ*C+#4USpNy(7w^`ZlyK
z@^J3FDz&a)(FHvY3QHrM{qAj9KlLHYr5RsdCWIcE_43-v)|mHB5@J^I%P&o{`&#y4
zx2@&hC5_>4=FMKS!ffWIM~|-xJ1meq_V2*PsT&G59A010ep`IK@~N%4rs99?Vmq!^
z2ny65SuVZqv)9WD*=q8vyXNt6F1{82^r+DOFB>H7?r-RL)^qvU#+JHNQIn0FEE03B
zTrRM9lDb1+)#-lTWgc7-POs#zGkLc;=_Xv42rlr*Ol4G@biH}X^}j0|oa4MhlC171
zPA~cJ`!xT2|CW~2tCw_FM@zA6`8NNWs_er161`Q~e2Vu&91<8#>FiNsx^dQHs(I$p
z4f~>(D*I<nw{Xxuq>`fj&Va*{FGDnZBi{_;S<jcYzg+RQ;E~YRS?8iuZ!VNqd;RtL
zYpDb8?pW?#^Z&(%%|bCp8~Z}EK1oiJQ&|7P?a-W8Vca|-+uch1Bok}Sh8$VH|2N;&
z?SKB|-`~A<$=5qu<sSL1Jh=YXzC~Nq9X_d5+@B$3m%4qq$)w_zV~=%1r(U_MP;U70
zoNBq&+j-Z&uWbvj5_}_2V12N%s&uA!u<p`R*3uq_^q;@<ntDHRPx;2gp2m4G$to$@
z(at7jn?gHVKYc!5`+ASJM9r_|mOj?IIhni*p2jw8xPNJK*{qlEr#OWdmWwR+ZeZ8h
z+w}6ug%6h7Caw!uZNGFfXZjYN4;Nl+(<_Tse|lrPz|Kep4>i?A>h)V272{dcErWzp
zoKCF{J*4wxioaV}%g%q28@`-KIP)Rjc)nVN{{s6td3Sr3B{J`*sWm-RU-e<Pe9dt`
z)2qu@D>@~!-}-mZz2}m<zX>PDfe1#)>T@@fybiNjKd)ErnD#z*?fh+WGk^XGDZV|;
z>*tj76Te>Bw`8Y!;QgI@Gebo#?^pk4r7z0AH+{oTwWY~DjR}9gFJVZSl(w(=n+(@G
z-8Pfl_gB2lkIyS^*q^vVbj~%0HIFv$y}aSZngF#$XTQllk(hZ$?Psct+pH@Gul;Ob
zXM2;&*s^ijtip$zws_XOdQ-GXy!k;$ooqFSsX5Cpb*7uQs_rSqhpTS5u33KcxS8R-
zFn?F~H?2Wi7!q8VyEkTZox0+=B5dhh)gz7i>#v0`v|U@g>v={_Nb&QVJ|}GcsQoUO
z&71K#q*%H;f3M{B8y?R(uW#r+(SL01!A0!9&D{zch1R?I>|CUx;v;J&E`H_MoAO2P
zR!MxA{p5?)-Urh%wGIa!?(X06lEL-(OMCMV+Iy=X*qfFADKj+}{`F}8iWl6?Yjy3P
zxxN!$Hlf`puGjS3#dkte7ya!z(RnztcjBAG4;www4=7|lWeMN*<Ul-2+@WxF*U7fF
zZc7_3_-KTlu=RSw%caM=%0IX9=v2;%vm#Q#7Hv20Z*g#1(|k!O+=ye+>6i23zpsg2
z_-ySI!v&7~g^z3F_Bwvw$h@b=gu`yxQ6ue%iOKxGVrN9u`gd8+TVnd_^2C#F>n97|
zKk4K4`*Pfe8@m=C-myh0^o>qhdFc$hO-3_aVzy<^n11>0$Ftq{!>`xe%JWe>zhmO2
zH`Q({mCO6%jLZHg|3CU{X?jUr!)yP(vr79?WHv}n@-%o_W9qKjQ5~xPr&jcve>_k5
zaW?0A`LJ7l&mJsW5!jWr<J$cu_Nj+;6MLo>pEA3&M77G6b7y=W=g$@D2{-3Wl=V5o
z)W6NtxI61jk>YES1#&MJ?`Ntrcow_u(~b>R*?c=TvK)FMKil|kuUYn=5|f_O=a+aq
zE`Hvd`#7=qYTBKTk;Na3g;!^K%=mKnDch5b_0>NQ#D3j#zI55nh$OeQE=%M7AG@zH
zO`e6LIaK)QYjGa7Gu-b>V-l^l?AbV_zRz{BOpCzHyWQKrY_`4iV0riE=07=azXaI3
z?Du+?Sg?a@54%M-x7CWTdM7RyiH6O&Q?=ljcAfLIwbs^C!qOYp^*v+GoR-w*m0Dog
zE~jAMu(>_^L1UHVbf2Z?r#6TNb1nQf>84xr0~Uvt8D2{BwX$p5xF%GDF0$3{43}H*
zS>mcoqh{kr0nZ8>!OdxsYaTagT5QNXR{X#>iQlKra?6*9?X}tm9xN<l`4`W$c|N1Q
z$E~eZ%W53GTtas0+Z1SrJPTd1GO^tx`1*s63$NOjMQktUV^_8}z7fopDVNxzd2*qF
zb+R@8=Bs;)f8CUP%hPnLR#if2^2U$+hfgzI{g$<C?H%jui+;|QZECQ-KFhF8ykqXE
z#rt3SRh|fw+1i>a5bg7kp<vAuJ$@%g1%rv=S(}pE8(yCXzIyA7d5(D4y5m92KGCsn
zcHiD7D_hccZl>Pi`x|*UF3)4U^)WOoKPGvT=z_+h^V9MU^ZLy$-K?M#oiDk5mzc~$
zLD|Sj%tlQoTlX2%FMR8_>UThn&>nXS+h?!s*1hl8lM?&j<GI6Drz&)}mNpb56bK2n
zO$l4M`r+h)nN!~OpRC!Rtlm}A#w4**;6*KS@?J0frE#uO6OQ`#*3Ho4^wZDjZREY8
z>u0u>Z8h78$Gx#RhUo!oKJPU+ta);;qrw!uA94$#e3<64?qodtFi@gKeb<ASAft^(
zB2(=T?AK*;4oeJRpLu5Unzp@Ld3fK?lx->$OuNv^Y4AC8n?u;6Gu!-fiqHRFem8dY
zxAQ+$KPevgHG%u-tqUw$Y;_BAmp95SWo_DVh|$r_ETux_r)+r0p~WocLwQ1&nErVA
zm|hO~(X`wrzfpA_cMI=~2by>LIASLzW@!j%*d|`Hc*w-k|Ey5*sgtjvj8X6Nf`jJ%
zFW$(-?@pU*+t{gm+5i00?!O1b{=IsnvZ$0zWc%9Uj(NK;<_ON8DkxJp?c1ce0WbDF
zwpDVHeeNE(@9m=gsxNnY-5>7%e&Exbpftws9!B@2*(a2-3AGDUCLBGW5^i3ha^|*p
z+169Xp5K;h;XJ%syzGC&Dgl4Zsv9R?Z00!~=ydqk9DUYT5=QSEH9h)gn@$dMSs<&~
z$ar_3(t#s$Z!Oq$=H|weQy6c&b9l-mbB^mqvQEzV)$uc%CbvgT$vb&Q<LHx(7Ap$w
zZB<c@owexb71`9=ldhh1`1Mqq!S=M$+)Ya#2N_JaQ|j#e?R8?o6gN%%?@1YqTbtJX
zeb=sLG4C=*nOu5I$QeDst?QRhdi%C@Pk=?hYiBu5ZgF#icdc?inS58Q+4BEF;o06j
zCCy7O$}~iAND6+K!Yr|S&jeHBypq!MJRkq6C7#Zl#3Uu`Wiv}=vzYy(jq_C6*T^w_
zZt?omaM&`z@YIfDee*lx)~>O>(x;>I*JXv&#f}w!t2z~q*_KNdsP2_KvM+9LYJRb$
z?}y#{go+lvoF%M(Yw0XwNpp$)6SQv~+Plc&-7dTPQ704YU#twXR}=O=!Qn4o-DG{j
z|L&KIzjpI}&24(I`u~!J`_fNeT;(slD(KO&Y#V87(FOgt*O=vTtvDq1Gh4s#^QBqd
zUTqI!FYQ{o<ZF$0<o1>=^YS@uz1>&;nC7Q1srxe0D0lPJ6t7<fWeP!iG)~^T=rFfN
zrQW+UOIzkat#Ro0<mfA@cBN0}+)Os~y7$U!_W5;9bMCHSn#bK7wK~+@T`9Qt^;VJE
z*2kU;c-b5p*R9B!wde4%N8eZcO&7eD*0erh<*TrWoo~`pZ8WPRcJvn|J^o|QbI(C|
z-hmZoVz=LHVOiX<desAA@ibMQ%%<=ejlmBC6Qn+Lwd$E}vG~wE^GwA4?aP)gHx@Xt
zp7qM?4V{b1h0gEZvb^=HAFuOFtH%YOXBe)qUT@75qPt4yt<+xGifxw-4yR3ibo=FH
zaXrJ8y1Hw=TRX&*{c;F?{q=vxqUwV=={t6amFAc2S;}~y@BhDd4_rSK&zZCMl={9C
zn>8;#S-fu5ndvJ3cAqkRBenR*o`l24mhk-Fb~$|Asc+HF`!5-k_KFpxwVt|ACB`20
ztErbK{b5q@nw{T#_a+!~?OwztcILn?k4EkN55(PP*0h&xj(GYtPr@py##xuS?W^;u
zqseX6E82eseLZ5`{zyw<tGJ2u>;v&)F8in6OP2mne0lAbosJv}_;=pB;9P!N=R9xW
z)QA7?>8L!vXj=0>xbU#Sr09U<zuaUD%<n|J6nrKkb#K3zz}B42Z@Obv%@exr@76xU
zCU28R^wH8~I=7tmlt1ULn&9_7G<1Q&VjlCiRYgIJd8fWJbL)3sJ}p1PB<-S0x$EZY
zP0RR_c0IU$SSR$g!i}%*&63O9K9*=%J>RI+B_q3~X{m(CcC|}cn|^)E=Dxn)By3x}
zHCOyTV|G7vHohl}speCCF0K;)_uuN_+mb_dr&IUtERvSpcs}c8M*n{St2pnIuOF#%
z?bhr2wA{|-t%mjXQ)f(_)~{Z_*7VG-sEFk&R&LgNw4~{Crs<qzkIos$F#NiAJ91+F
zwWWJD9g)#1_}Y27&ojT)_~sI;r7qVW|IRr5_7dBxg>9zdA9Fblr5<Wa=sUFi({}mR
z!?L-yT<lGzUF$u{%~zjRiZfpFM6LLtG!y@i{I_2mi$9h=eSWM?f3n&|w}6G#TV5{7
zH`w}Us)DI4f5G9!OBYuizN|mH_v^2ivxl}HP~u`&pK6jL`r<)5<MnW5mv_1mY}VJa
zSj??+&NDUgtos;mYvv=+ddXAd?uG7Y$JN*S@x^x=G|cDw_x$-`fA-%O*R#*><G0_#
z{%GUp>3i>9{C?hjw{;0qw%U2?tYhJl3#Wy!oc2(i-Ze)>YEFh(+4{-y_V0ZceEF3z
z^YQe_>MMLFH@-<_n6_QMqT{!-)FV3w;qv0}Ie%9?Yt7M_caQV1_-BX7IpLifzCL=z
zYy9m+4ZGhn!AWYT<}<X5DTo=yf73YRIXO!CrtQUzjs>TzOx1SQ8tk*0wP8`^y!qXQ
zK5+s6Rt3NRJMW0_O+m^2;P6eCxjS3Za(_mv{9iQlVB_>zEn!xHPYl<zEIRv;^S1r=
zylYDn+`P=i*^fwzdWW7~vA4~IuU1~+<?G7=`zAb_@!?QF);uu<t@|yr|26hxC6wkS
zm^%wDop-|I$V#7S*?V~>+FuL)V_@;jP+WrBQ0A0`_lxJJ(n@xD?oih0(Qx>5^6{aX
zc{yQM+ZujqUtzixa&EI}6^Fw~dAHq*AB1-PlxFssui~iw*~IdB_|fxSB2^Ir20lN}
z&VG3A&O!SRPXsO>n^Bdfb**yo4PWI$7cBpsO-WMzalXev#eA-${^T_wf6rENUh_#h
zns$5V$*WIx_#9WubKA7$@&>=B8G$(!J3ikt`WKY;-|PE?6JIplBwh*kvHfwsJL@o`
zj=Cf7qGv8Gi^P-@bJJ!ES4jLh6Z^I}j?Zl6!{l@kF}K=#(ML9ByZ=7?h3}A)NlN3E
z&5L;QYlJge9NS{2em<&J{xQMi(z`~x7+Xobgg(hH$3FeLC$}@AtY*{yho3t)*IxgU
zbmv~&hZ%-!RWg?G?marCtZV$2IyV)a71xt0SUZvHWJs~Nn7Z$#?WUHkTk1Wpn|yz^
z{A%&_AC3<sBP*m`tgNo-I?aDIO=n~O)7qmKgtcwIvE5`lb%oRHLVlTg$+1H!h5^;r
zKRi`4Q9sSQZ@S5Bg_jeW+cre#HgX7Gp7G-9Jk9^VWKG*1rY%*P@+LOAk==L3F45Er
zFTdxPMQuG5aQdkb_mkN#FX&dT;XE$>(W|Q4LgL&#$zQQY<Qlhg&AxTvqR3Q6mEiS8
z7mj62Eetl4zPEw1?Q(}%$3Etuxoa<7w`q8KUcS%2;{V;#lQ;2|^N4-jdtLo$^kun{
zkaRXB55?@N>#J%5w_J$XZsKKNP}<UW?{tK2v%|~9OZygG5&OPo^(+45h?3`0FPJC(
z^a$#&N@CoSv^F9-^ro7`zwC;7(R-5=t_gkr>T09-Q1Sl0{~z8xm^gi9?G~SfYdPj>
zU*4o8|M$m{%WThQ9nuoWn|UyY`Hy(_rml;AVy}XPn4j&GXH(bL&iy%m^};BYBQ<*O
zzy93A`M|^_jPG}9OS>*}nW5jVNm6n@&q#}~u<&oFusZrtH`OXn@JuWJ)Ti^#&p7s8
zOD9P5Lg5h`1Dgvk{yLU1GgN&FI&oayZqA;PRRvLJh2(#6w7Q<F{e7#y<!<Z;xmBmx
zD{O@<a|ECJswd516kT_r{o1aT43~qLgW^LjN3m6Q3g_-#tt~R+G|$}nQkgZMxV&`a
zKgPJ3PH4>idS~j9{yS0DhZnz|?S9?dTKUH5(>q?hw3M?rC&uLayVgE=u`QDi%hl&|
zRxe$%RdDw|{v7W!W$Q}$7d~F(z3=nn0RFQ#xi-9G$SYNC3*U2ks|4S}bK%JrGtOO4
z{;+u6i5Ev-RRyxye=mu2)0tB3pLY9lu*bAVUml+EUD9OoEw3``l8*5DrD+TQU0I{~
z?pW80k_@kPnG0%TdY)cV)G%Jaa&Kyt#Gk+K>+1#gu+99Zb)Ti_T5+iACDC_(+j?^z
zZT_-<&zcDjZm&DcqUy}!$yxtkjn9+#e<@P;wivnF7F(EpfAdrJceGN&lX*MB3!kUv
z2cG&_vGVQOgI5wa^nTr?{U!R*9EDkGjK>8+d)7alck8XF&h>Y@^_Gg{ZM$>yNZT22
znWDs8`NMY6o7bPdX4#!%+<Ix_i8-RD`(K!CPMT=?@Ztr9!!I|zO<C2QRAqg&wWD8E
zTRnH#i}fj6zX=Cb*X1<2R<!DV;@r|SNl8y>al%%<RGnAbW8aFb?)iJcb-|vs2QOFE
z{ZN_lKt=0uXjtlhr(!mq7`~a6Q@B)@>Cauh;)>3c-5Yt%vdM0Ew^k`~#`Dfq#dnS$
zTs`l!R_jZDUHRWE3ny1bEjy)lYG=vYw@<BqIti3_ZPBUJ$Y9)cO!rLL%tt-XmD;iv
z?%pU+VcMRYSH*rK)HWwYBK^SeyR3iG9<{HpDe8aV;_z)ox1EiL!G`PgdKdfW8L#`G
z6tDNuXO<DS+uE>M%-@XmY<`gO|Ln!p+mA0!n9aj~e!kuRlj^G{2Ucz9yt621Mat!u
z@8${hKB<wMUwmA4%Ke+IPWF=e-7NVp3P0<;3I4XUGi1G2qJ&_nmHe#UfW*|$2ig7E
zQMYeCJRO>`#3R$RJ5T)I#a|nexqmI#&M>#KaQgzYM~8Qv&@*_x)Wg>EhQQ-j6E>`V
z)h(*=?Z(@PBeGoj=l4GSV>|VfT>q*QE9?#!tXus_ZCBWfg5(70(nkr87-r>E-P_jS
zy@SQY=i(P8={o&8A)6l-TX;XZ^kR<o-YH5f&TmVVU$43-o3!3Bn^RkdX_?`nbhd!(
zUE7zq8}8C^m~-n|$%WSPPjym<d#02#<eXuPx*HMU+Rt_@vRQ8<ldW-^V3(MduITH1
zlRHvY*UiwJ^6L6up4?v7qW#+ER=jgKl=rH9F5BvC;iYVO@}~FR{y0$F7BbJ`+!>u*
zyUee4Y!Oy{>m$Y23agyzf31~Uc{zxA+tUS)BDUn3rz{n`y3k_ow|DdYUd!8h^6Rbl
z+ILQ#-Ld$!X;qn~r`y)|R`#bwmZ>lPtF!XS-1hL*+InBKq%}W&7wj~>lkhZsrv3bu
z`=)Ee_<B9>NXhQq7AWVxV`1WJt_0>(vC2h(&pSQ}=$u#a%R1vWQ{CfkLFa6aI=NX{
zw|qHcUjO=&bE4TuLAqz3r^`(J$N33o+_$tX2|rMsCl<_9c<8a5(cwnE1$`=Si{?4L
zRWS=*&M2q$oRQyWyQ1MCIkqbzwo&RzI~0rCF8<CEk#P#{HhRt^=wX@ho+~7UlWD!r
zYOaEPDV8fL_BU779Q-`X;s3Ndf3%w3=x+LK^5e(p+b_Phf6wQ;@8;fKf7kwxiNc4z
zdTY1Wd>@2E7v%~cO%pAg?p(Ti%F%`yM<3Pc?<o<l7WmP#|BBf8yi;cD?i|;Ca5_AZ
zv&bj1&~|@}<1`L`4o>Ec0&Dz!{M!1>+)wC??zuJby^}W0G<;#=b7-TF&$%1__t{D+
z&v+<jX3F9Bf9FYUwI|>9eUR7~KSO2xEIH<7?1{1*YW7!~1D7o4<JuhkEktknRaXnM
zq7KD>PgYM-Zak;4<m*Y-ooVNeSI5ehAKw3lb@$@u_c!-u%XfDj`&!d}-TY*jL;vAp
zn@^vLQTX-ay?6Kr(@!EB=B?5D#<FXM{*g=XJNKLHc3fT2qxYgBGAd5_1J{X70?&Wl
zdivPmsz7G_pEa(^|D7Vc+Z-nR`TYK2+8lrG#|4Mfms)>TNc(u(SiqO}zOwMaW^FGy
zrP$}GZEXLl)6|wItIn;Ryk_Q)zqv(9FL^id78+N-TCVurqg_Pqj<_MKP}-cr*vzYu
zJ!v7XYnODVu%tU5(RG~UQtq)lsavJ4%5lBYoxf49w(l#+GWqA;nS9#TVZu-ChEL4l
zOv~?x7FQ-cd{}g-oJH%g+eH0~yd4aNNqZNw&E9ykYyOm-@tIXOr#`H7O5p67bi1$e
z)8?&H!uP1XRNAjn_d|^Bo}o;Bvd!-HgW5A@-RM}#yhi22<CJ+NKKbQQ%YwP({QAEw
z-jyPkrSR~?i<VoyUKR6C-ki92t8c<~F0JzO8z)s<VCCzNm5y0?Hmo|TTIoj-NA6Fa
zZRIC#2JL>)y*-4Rsdvtv=%fdHWoFy*riTST^!)VE;KupT7j<=!$2`^N&CV2dKcv86
z)XwVVa!{mGU`9;(llrh~`KW{!=afPp+r3n@+_1p3Dv0Hy%6^aE%B%YfHpnKsx4eJh
zb)@>_IU^qb)^k;Je)wEYVNAXdeqw#qw>u0!Pe!-|PSu{5tDCv~wZQXLvzt{eA9Z{7
zEb#KR)ZZsg-EHcvRh~0_?ytv*f8`Apy^wWkTa~cn)3$ThiX+U+Wu`sOPZs~)GCl9Z
zk-%+nPs9ytlehmCd1Z3%n_g?p?V_npJCZFY=IoAJov|;lP<y`W%9jtzKF=#-`gB*<
zaNf&>lHx9|c`sP<zfC>(;lss({}(@e{{LXrnKwDDA(LYpQqJ|R*?D2ce#y&oD;NE-
z;aOxZZ#P$F-%nkue;<Bce$8Ck%o8!&ozd;A(_4j}taCC?S63SRF*q>2$7=I(i7lOi
zx!gv(gJ-VQ`}BFra>awym;RiJ?z5;bm5jf6yV~vj{4a+d+U=hGedgb4iEo~7j6N?q
zwa=92{@$spbz&LL->m#OtI2*PYsy4BKk-?u;qlgb&n_;0cqr!NL+QGU{ne``Iow>>
z+q0~o)ar7!?p!;Y;Ho2Pm&J29pItv`eT!3tSNi&Qj)@)>%Pv~!|I8ESJoeP{<QwHT
zQTF@pX7_45>=iZSn08ZZl7Y(!jf)22h1DsRHg8vNZ-3wKA15p8y8n-_y|5$CzhBW?
z>OVZY`h4-^z^aM*dJX?sqqx`)Kfbv6_zD$8Q@($7pI(N3d3E`AGV`T_zvCZn53Mc#
za%9b4?r%Q|Oix!UranxV7WaI$7F$s0f(OUF6b?x~UtqQEn;)wklkJl-#(M5bp^v)-
z81^6ElCr|*5SxM9#y5{X-_rZ^<jF-VzjKc_AB+2BT)6w)*@hH-rHM->&J;J)+s|~!
z*?=`mao_)a+vY3H|MRy@zuB{0Nm78P&iLuRhr1njN=H37{oLaJxBS~V)zPyG_qs~o
z(&#=IaAVi572hkq9L{??>sDEqDXW+P|9=*1?qyS6ev_yVe-~S9n|5JxE>rKHo{bD8
z?tvonlUQ!HR-L&blKB7FbvA}`4bM+>?{(cX$LH|_?gFpEle?xj)i@=uKC|JYz{}U-
zS5`jS^YPE4H%4`jUo1`fV3#)Wz^^J}O;gGG6*p6gwB}{{dffl%a;wUE!D??#mnlCT
z9-ZlC5x>05>eBVxZYwRz;?w8yO5$>YcjVds`IKdOQvAD%OX(Y~s#E62^e1jpa@M^q
z;I!H{KYDGWm((&R%jNloZ*4bC_A@J9wbnLb>g*;<SA+5vi;A^(e;eN7FUnlM|F@n1
zn?RA^ByQ)AB~mA6``ec7JUO+x<87pM?IMR`XK&;!**wGbTk1q#iS-(JvyB%Ydb}}l
zW7Lu-ZTUC({|UV*I{M<(D)+;UIz7>sV%}~s&|gr}mEt=6-jiL)OS;lc+U~0^+re^5
zLHWl?aht75z3O7Kf{!%6p723`-U-`z3I<WSu|kXIt1-Id>u$HuUA}Fv-txVEo{l@O
zA9tHS^YWp21v6xY+9P|!mMrCYxBj~C{gfroP1ck|wM@&KwEdi~I-^!cnN7dd^Q~$A
zriTv%Wm|l76PoDAcJ!6k)t!@_+NVsGSmT~}_w>e#%l@`4&s(>9^}d<jOaD!qTD<m@
zr&7wJinF;ctFM(yx$-imzY(z(4PJeJN0yHIp^Wm+DJzqDvn;OEdYzlL<)qHUfP+4V
z3|m)yJSoZ@sO$P$?%pYeDas6|zAiiQ$v5-Gqu)Ns=L2~4r|e-Z@lJd#ZgXZzkEX+d
z1Q~5X!v^im?j?(qcE0&>H@2$gmhLjuGYbSOHW(&l`)&!7ns@b++haQyp}!f^sy;ok
zPMmYuxB6>lt^JK_x2ksKaXaqM2<hZ&y6np2t`MG}HjlgF@xHsP{t8*u(`<g<(A>0Z
z!R|kCk4`h}PMGC6*;UN*lG5In1wHdBSNATq<#@&YJK*L%?uYY@_q<TCelE6rGP7#v
z{r6TD>gURDKbXU{@1W)C+T#Z&K6W|Uw`%c&dEO^X?rd7M)^=KqZ|li&lhzlTzAc&>
zyZu_=+Gvdv4Re)~L~}MBo;_)zu|tj5>J2;3Xvv?7(bHvBwLc!zw$5u=ap;?A6&iJ>
z&Q5=?Pq6MY6@A?2VZo_yUt{<4$ImCJ!K^)=(_XAd`8<0<;(wXI*mbJ{X7#>4sKKxF
zY*y#}+18aEho_Z09`QdZbuC=yuco#QNABd(;<hJmh0K1+e9YEU;|ozQe0as`;_p`G
zL#5w!CyUN?SsS_GlFfz5yPey1=N(^TTXM4IRI$JI%8Pe-7h5N-*?A)2`JDv~%+-sh
zo6PRtzgLyB!Rh;ct-@nXdrm5eZ9Y?V<$Ew&>;9NrgC|+ddtYxo@X&N_UGUZm4X13p
z=3jbY=3HvJKX<~%b1dQ0t~YEked)_k_<qw@8NZ+z$J%V&cg)s%knn1D!_V)Dzn`sM
z&GBTmyQ1$i!`;_CZv+`%n4gs_(9zoHcl`3oF3%37r*RSYS@&(P^>KFI{<W;Y>1trm
z1<pg$-Xyj+?s)0C;@DEXpS{AbuN<$Axbg6c<ef16hKXxhk~>8sUjMuGHG}_5+DjA7
zz>w%e$4u^&B`YbeFcFz*bw)|k_QSU9Z$9(>9Jug=wLjP4rt;#Q=9xWG-L*@5<O@~9
zS=?LCKU+05-c7kcja&PcSf6v>XVdWS?`Is_J@<jl-d$(9S7upF>7Ja^#Z>3My2i`T
zXp`AA$$}XBt17wHl44hH&9u9FLMF(1`?bY0|G8~;yl^{=Gw<`(L*1q4pV{oW9x2-S
z(EMzVv_)U?u4g<so(E!%wI96S@^8nfkCS3k+1y;hRRwPsPMe#%#9HpdRJJLT1;gI9
zzPrlRdac&z@v`}Q;=gLV_48AGpk(oXUH-C(J5zK@m2Z1LG%=d=WW~kj-5M=*zZOpY
zDHXTzH-GNCs4#ZFa-J2|2il7~lFJX({CKomIVGM;O2S+!Cgo<)--_2^W^EtdCYFHq
z1}r|j-%UP#?w^|MLpm8od%u+(^x-R+dN#0s?r)X8r%S?Pco-&pag2N_|5@nx(~mrY
zM*`ihX-=-()$?(|%QxQz-^kb4RP2}EYiVQU(9WM*zp0_j$kA}3`H`Kj{bD>)>vY_d
zs;+K)ku>|_3eQ&m!y;E!zG0l5u|nYAtS4<zyOgRbnC{4E-Ef}R>lfW`BgvECnab9@
zaL#wT+m~w=?vz)1-zIW`XR***iPPURQY)V%xUfw8;1l<5YHwE2<71{7E3Hz5R5Ih9
zZ>nxtqM<Zr1xI0H<@*<!7guM#pM9sY=$+NvTleA(()OtoW&6B;`%2J$t%c<+V_(KU
z3!@kMboCU*Rws!scop-_V8=eiKVJKLi)7{J%#qnwUo9iM|KHCCcUNcp|8V*4$>}+p
zrzv^rFx-o;lQsW+A~x|-L*to}!*g$6V0fpPw5oFPs^gdPe6lro53S9Mb~DW?GVl5L
zO^G{f%EVL4`TRX)+^1zmI+=fyxG%x(zQJmKyzJ-SS05QQ6l}R}p60S7eAkD#>rJXM
zTMAcuJKmj<_u92kdqueSvab_u&1&!N;p5wJF51GZV{x3jwo3cy{0^gB_pY8J(-p(j
z&itv`Z5pv4b!N`7)o=T@PmeFyaB$Lnq0XHL=fwuIt`g8+5z<)a-v3_b@QDx4tdm66
zF(?-nT+utZLBwU>>d>l7NA^hM&(3;u{Qd6+Z_T-l7w$XWdo}TN;@#(8^*Byn*H&2<
zw_|a5g8L4w=_Q|@YHWGV@_A*(?0rIqvjXPw>aTJ&KFpih65g;Rh_Sok#FjA2J9g8i
zJXaBTuD>DSVeF##ucdPg46kf_%IRR%uXZk3dU8#qs!J}<=8jXzE26fwepQ+rdb-y*
z$))OOr|``$b221%-&>IEBGw%mV>dbTNuKx|?Vvu%-wL0#`+4{T<!|njczuWM^y->h
zYyRAfHR^eAQfS8~MdN)TDlsowAL$-EnOb>_sp(3{g!N~oHm8Qh%f$s{e)9WR7m=j+
zh)KxQL3zD|8b62Sas>gqD_2inF#h)RK+e&BH+NX~{N;J>lT{GZ_3hH^_bU{NXJnS%
z?)-l3Sh#FeQ)0`-RnOZlPICQruq!OUewOeD>3{`hhlF)}t@$NapSqMhHRBL_w&dGC
z?5Fqfo_6iIEV)6zTlm~2YpV~AcSKb`BriOA$&Fh<c;bf|<7WyrC*SjYl#yBJ$v!u>
zY2j-(hAxx7hOd%!yG#q-&va;%u3~&UDXTRj(_?{~N}=Q3fFtJ$6Ow}Nuq_qs>p3T}
zDabeS$Tst2k<5y<&)=kV2%7~gVDDQI`91S4-&vu8yT@;C+Iqy5_sXTey046^U46Hg
zq}~^=T^$rYX|Dn2HqTW7s+JF?=)^Ksw@U4oQx=$ayTE(3?%t=iuF|`<Zz$haoIU;Q
zs=4}sho3zZ_jj|YE8kP#`8D>%`Y3_+qDRY}AGvH^d_mfT!?vJHM`G*6%6YRTC6-%h
zZBh|eU2oB~^5eHQ!|*J2DQ=~Dkqw*=*ZV%Yd3LXDvgh64qcT%(Jx<}Uy~JFbx8jKT
z>9>(jmR>&p_Jn=itK`XC>vm@PRjMD+nq2(VWcA5^kF9wu8?5Jdtg`=JWc29xqHONp
zB}dL%O+Ospk*v4n{{82HPlTindOUvk<$Qolpx?@8pF`i58%pu3<?$XY_WAVl#w&q6
zad&uj{x+P`e%Dku>Dt2!A?+7ueEU@9o^YXp>(Oyr&ZCYmW;6L4F1~X!=;5@J-iEqX
z?&cc8x29fUxxV`B$6)ij9GB+uo0gxO{cUGX;Ht;Zr*Kzf^xD*%@0mF1w$d|Cf78ai
zec?sFY~HU4Xx;GBww34YPJ^VyzvjHWyr6HT-En_qy%nt+!)Cs{w_Eq-{=}Ue-g~yJ
zWvH5cQuV<#&6K}R$NDEuy=(vH$h9cF-RX)xhP&Qv{e7sXx^k7+0y)JU$99UvMm(@=
zuKeBnK<uDmQ|txq_FMa+QVMT6<a4gQTC(c*&FoEY-YvWx+o3SGJbCx7G^Hm7>_Tqd
zJgu)}!ds=Ktt47gD(Amde7J9SE*o#|uex*ZzUGymp8Pa5fB%tqd49#la|^5HN^|~?
zD39<xJxg-u!HV$PndYYwm(M;nH>Y^(LFo@sS7eu!{$9Or^PAJtmFAWn-u~91d(O5q
zp39CLta-cf%<89)vUyq#>v}6N##eLPnIT;0|G!$UeW&W4gF3t3_S`xkR(_yXvS<6j
zbFbD57H*&NJLbJALzlz9$Q_OmQd%`P7ybEJ@<~+SYRm)Gjun^U9h*2G`?k7oSoF@n
zzJzD9)h6b1O#W+*$$werY<D8S$8Sed;iGuAZ_Dzwyb0-D^MYfQ_rlt~Ql66!SPvWv
zPCoB0zHPmOtbks?u1~8E=uHy)lh<LCoaYd4!X-4T(NOvJPrZQh*6mk++P$)hk`c4e
z;xN~{o!IzRNpXhO?`5~T!YmzJcHa<R9Ab8vwe$au$(e!MqoTR&?`)~xku>|^)Ge!L
z@43%?S4oR6^#0AM55I8h@E!YlHLTLx)aAH7W2Eu(Hu()^({t~M2KzqyyL-WL)>>hu
zb1femSTi`Cr^$1~KJ`4u`OxkD9JbgguP*-JD&oH05*fg{zp{q+4%5daA(?%r<{3q<
zvM5edU{+33xZtLprcgIU+PeK|u*qz_x3NX>ohK@lU*zt)5t4aC<n&$r8WW3)xr+}!
zy}KjWpv%!<ao*Y1;?7VZ``*iQbXV=(=Jh=GN@|)7<IS5tP0Eb)A1g0;_rp_vNuu8s
z`GxHIhx<M5$L7qNlpFf_$>n_uo^|~SpWNqmtorHVh11!5Qa8^jp8U`uylP#I+q46M
z`L2?7RnHEuuPNJoUVvf3_h9K)*WK<M{U-V8?M=SJewKFn7P@P4etb$j@o|pN3~t$%
zW_jgd?t&%TXDm8iJxgTwy<@9X_Abq_`8f5t!AZu6mri%<T(GXXbKsgq>KX3j7Z3DL
zW&e=f8T?P2RsN4!i_7n2{T~)}PKh>)E-KrRz`bu%ow*FxiA$Nxl@F`3bPkA37qr<t
zrQ^?OuF1hQ0&nI#=$%>A*SYwE+}W0&8q*}%ER$^(zY^C!ylCpv*;h-BhjbTe?<slJ
zkhyPJ?7o}3k1fkTQQ2pvSGj3#M#IxMpXvKM!XHdGITYakddmviV$YfLE^>cbv{e3R
z+v9Kv4j1*%Na<HD>Lo|#N*<AXCSAMt^QWhL?J5O@?wl{IAKT5<73X@CEGu&KM0r!w
zno41nqr0{{3IFOTIw2zU=9?93)+hc=obH@VXSZxoE{l#`zVg_zt><@4f6bt&xkZ#~
z-R%k54!7KWwx|}ZX*qAy?DDhOG4lD&h5VmozJ9s3ZKbue`MjUoy?<n>yBF+KdlPcc
zQgOw_WX`X*RT@Og``=mr&3^YmHaflXtDo0S+soCv1#`|v<j%F*CM}jbJLcQA9VPNI
znYPAP|0)aLD|;CIKQ?*qYYXq^UqTG!e{{6{QJQwLL~8NU@R_kmXV-FwZ3$cTcC+mk
z`OuhH-HO!ripg4AqWz^7UUB8S%kHzfM%SaJxadBQ@$LzI4;P(Yku&MgIkPgRRWl||
z&eL7`llk?{##?hZ1%sBp+o0$8`Ey4SpUA}8-OV5WN5>aWVU#%H5dF^P+@Wk;$-6v;
zx6iEj_2^E#$mK0Nde)!f5LEek<F@Z&+nGn(R`(uhIOjTh*X&-ysQruCCR@yW{@_Z)
zyp3x`Zl2oV+hkObz3%A84egJv?R)>LdBTl~yZe@F`FB@Ky{oT~-TQmP|DP`w1SXi;
z?YXr2@b`-!Z<o8jvD>C8)^E#e)U-o<f@Ct6N9O7<=1-+!!6_yCwp|psJjLl*{;Dl&
zs&+N&h}@kwYoVh;)IH;03%`AzxAn=Fs#UKKy05=4;OF`KqwI25Hi_^}AMV_#J>Ot&
z@S*UHv)I&Mm;4?qvJ`4JzmizKc+$58&)>Xq_-$9Vqci*KUXP{oTTd}LahRJ2sI0T{
zYFGKhzN%QH+E>#%^_esCncP2&v!p&oMb6q)@?EF%@y3boH+&8GZLa3><&|`&kA`zr
zQHX@<&sopp4zu>`Vt<g@c>T}L8Sj*NRzJ~<h!Yc3I48wvdD>guY)<5ooX%fMUr)@j
zG`+0h<#FNb!X0axco(j#nY-8d)$$7pN@3=^obvmZd#TNK;aShVUa5KRE`j4Zdw(&r
zCv8dH@H{wg$E5t<kF9zPq%CS~*3C6o{Uq=CB>!V<mlf~NI^M2$My2|HVB5iZmI{{7
zJEu=QbL4Z_4MVPE!`!xm!bX*jiSo9V+j`_Seb3{TS$H<%=Vh^oMGee8dHm*Xeafp=
z+^{(FC%@&`$7(4zpNq%#GEX_ZaNE<>*SDL$+PuR2kNEaChkuKIbMRsRC)9t${Q|Rz
zq`lBL=EN8Ih4bh5ne7l=_A+wS9G6d}N4HF09w&b2ZPAp|e=k3pnpx(&_nzHb5q{^A
z5C69Mw3NL`o81&;Z}Oxl$T4QOb<@8JZubDUZ|Q}TUiHY&y)$Elx8HIuCvm<zNj1kd
z*;mH+TUVGJT^$-{cyIGXd4K<a`(mH|7zS;5E}ZGO+y3UJH?Nour(R;QSRQ}O<}~l7
z!!C+HSU1f7-m*KiCbN5zlBlefZ`kJkJZ7PTW-Ys($A+)am~GtuH{|vOBesR=`(y5|
z+qLz;Y%PC--V14OE2>W_xba=OuCw%bXYX%Gt>>nR*9`w&PkFWT?_vM1x2H{2Yngtj
z@9pCQE25{Dt~9QBQ(BuQ{b)|>-zr^?sM+0Od0Bg`Uld;W#l+rKIkkTGJf-)NpI@jY
z3stqf=R9@izU352z6y=biu(;Zk}~lt-q@8oRxO=qpkbcf!#2n7zqjatg3O8Ej$g95
z%k|=ztJKBsMwffmXy-eedh8>T+@mmOzHO9v+vn+fADnz~(|>WS^{SVLALJJvtl55H
zxBk(R=R0)84y@8!S7N4rZB{Pl<j2dab7lTy>IYb#DGr?Jws2-^zG3c+IZgLW-+uL#
z=l!@r!*O4N<>jM1n<Py3Uv{hKXEv8#|B*8?oLwh)?~D!w{R!n>+{zVwxoQ;>e|TCX
z(h?@lJ9<(y+URDyPqS3`K@<1w4DXVc{Z9E*$@$UKDDCvTAf1~Q^*kcV_Rj(rZJcDd
z%vn;oC`0Iwh2(6*)~!~@tqvUjdafrddDW|cxqrU~9FIGzT=?+yogAYjXPVh3?bqyX
z+^}`-*3Tzi^M>x-=Y2V6*Mg?hn{I5f9{mqmrIXJqsLq<3ux~-3!O2w##oKl~`gkR2
zoBp~Z){^pE|2JLvcxUMvncgkamA&6@6_Q*fS|qgZgt6(ZtIi@mxl`BAvkz;sYB;L(
zTVi4lkKR!a`@{|UdA#eEZtXTsx4(0Xx5?atMRnOSamynQUmPkpYg<?LZ&KXKl9?Pm
z9bfZ`3SM{Zo~jrV8d6wv^<c;M<W6fHo%bTM4!6z-zq+gD<BN-tVY-h_c6f_a7Jhs2
z_Ba1~J~_p|l`Xd}t*M$~H~ZfQo1cZBOls{a_elGfJx=$Z_s%cP-siFU?#su|@AFr?
zfBbxTJx7(l0n-=ZSsX8YzoowZHtFTNH$Nx8{2ck|@#ecfPEJ1VzrX&U%FWtID*k2a
z=a&^4{WiQ?`|q*vwR`+qY`^f_d$!=vt#6J~Iiy**cb`^y=4rQ=>opVG<?7kIU+(gV
zpSy8~jjKgIu;;<NRWFWBoM6~=@vFO#&{@Ck{4m=~swqpOcNI(9JvbgaoqvLSncZfI
z+tKsR>8cydIr!`+Z*p_-ZJX&ElXq0!PCPmJwkAiy$x9nJ-)z%~$!V;AJ>B`FdVI3)
zzVg6-v)6aZEZA*uVK?6e4)3Q%bxhj|pE{jO->w?vm)M%3y84{6*GUe^*&;tvXG)d4
z*}v&!+$_6)nMOZ9e%u`SD|nL6Je%47zNA>y{yWTX|5w1?uYQKlyz_GYlkeVeYkhm-
z#=93Q^L<a=uy`u9N@2yfyTwMoT0E6M1k6*46Ka>=znxoL|Jnie5J7QcRq1zCd_U9T
zx30JP;ZZf)>|2{a-l|8(HE!MA%i|(ba=GWzR2v>8^(mVkeb9N&bZ_-Gg;U>}``$6_
za53`8>%H6{Yju9^l{#s0qwBkW+4;S+eBV?Wq%C_zEZuazbf$xKuGNvXZm%6GmbD8^
z{3$Q4eD%jZ*|1sr^y2KrC1)IZa%FF7MMc-I2O?n!U0;-9P1tzKw{;50@5&WE@AW(N
z5uZ$=u(`)+TOPj$EmM~s4LcHZ<jhlzANkiGT|N6@f9&IbJ)a^~u75w)Tz<_g%xCHH
z6<cdREM7M?vvf`|OUEg%C%gAa9{SQ(ku-Z=#(80Fo+AtHt-1gHyR6x(b4OZzb~q<(
zv+$5*+cWK7!I94w6#o41k6d2w%P?DW65~4K*h|^h1rnaWZoRMgxIF$^fX?02^WD0f
z;&oO6`q!?yO;Y;)s_bFjp4U&8>**ev>px-PdrQ}YL2_A4{rTRW8<ys~x^`U>&)v}0
z<nZu+^|pg+IVKA^&TjUrT^xI5k8M|ob^P1|ZMTc&TXes?uN<rLF74o?X-}fvrhb1T
z{qx<n+3u!))|O4k+3?$JlIcJB``&Hq9{g|myJSPr=?_`=uD%hP=JRyVTalSLm3@XC
zr{66+8N&MY(fNzJ;}<o5pMPK0eZBpj>hBM0zns3`mm4o$Qjlr>Zgr0CvBztZ+P7N%
z+wyYPkK<qXvby3@<Wfy0c+FOJ7Ycn@wD&<+{riY08KY<AtPNGhVmV6|vwLvuuD!MO
zL(aLPe<eD5L{kp5o%=XNZ`;dbN6qf;$avFM_E*6A*|&XV@6Ykyn3i39eu6qn;rR<y
zmaW=PEL0^jewYY(&(OP6V|=+`ef^fW(<Q>QFKmCM)V6GD@qLG9Z<%M7%XBc-{}W|f
zG`(fVrXBCDKi6LJucqP6EZ&=IvXoc(E;E~OM`mlvxyk&}$u<%zw@YW8e!FB_*A2F3
zd$V7d7~4%Yyzx%_{T!ZU1!~^a<{R>MOkXzRs}KX@UAH{Flif{ss}700jgb0$<l|<s
z<${af>QwM>KVU1Iz#x*jb?thA2<HDi@mF}S{Ip3~sT<!h#j7r^P5WA4CEte9SqD2d
z8q8p8++tJaa4So<RpyJp=He%3Skn_)o^99O5b-00iKFj&(f#7Ntk)hoJZ&!8+YtFb
zXyVzc<}qh}9{H;~wWorUXJwX^-c6^oMpH^JyJ~$ZxhPXq7<eRHY>N?pn=`A*$?&IX
zot_P=Ctj_Op6tSRT59Wsn6wK8F=tlrNB`xOijlSzHQiusG5JC(Z_koVe{?#HG7hFb
zZS9_&mAOEy@W66s*9GA#WpeX*%AW`OuD`Cicw+C|>ZJ#kF#l7%{UH9+@x%7l*DjR(
zKdJh_{v~YxC-MDA*L=3r>hhkIJgRTCLz5y!PnrFWobiy?q;1CDy}IAjrG5*y{=M@>
zJYtr!{WGSb<*rw&Z35<IIK@pZuX|@>)_#uV#+hSW_HuX1-kh7nC*p6hKz7C5r}6!I
zTRK*2U46CVWM*;p%<w0xYUam9eaZ`Y<g#h)kBTpEI*V@PO`BA@_H9dQ==#-X{#<?X
zc)iN0t{v%J^S3l@xYkiPJG6=C^t7uNtaDClT^5OOFZr;3?E{bOq?7M-w#a^-nlF6!
z*<~lzdkwYr-0NFe%AI+C=DaXHD)eZ2h7P;v<et<^ChUvVU9u+ebm^=2efYj1M=zt=
z@Oawtxt~fzkH@Aey}I_s!|*KM{#|>H&%D|CwA|2a>5^w`m66*Gx!G(>Pd-eTzd=F&
zXt=Q0mk^i5yLB4AGR|Dd5wLT`IXO8F?dVX;$H@|l8&=NXRGG*no}a|gxZ3A(D(995
zHoVhjr<^nXp0uRNal<L0W16X=HV*<nbSyVi64|v@dY@X!!T(Rvs-91E2;=&{_)l$X
zxsqoqd)~_SLz(6`e)bo&hcDQDbb|FmR_>0L<7&l$>?=O37dh9uxg_MHh~m<A_DwAc
z86GW?TRxW_)c$i$zr<kO7Q?U>sq;NNFQN|ZKiIf4+5Mi_;y1m^G#9NXm1tRJ_((B8
z--4y-`kR=Sv0s|w-t(v}l#lt6&9%?6>g%_NDR+K!IZ4+F+iG@sKV|;?TEXa}=JQjW
z(vvFoUsaI*8~OB1vfSqxsd_gmHFwULZhdgRyrpu+3(4^GJIm6IcW38+{9-yUMmVVQ
z^Q4XWYbL+Z68OaH_+IJ!ngZ49*W=#lc{gn~`W-GcC((7@)!!fguh8xa@)X@u+ZkJR
zvTs(y&%@J~djzguzjw1!SeRyc$a;q8xJPsEPj`I(bp851JNZ5JU*A1YUGRtR=gwyP
zNM{GLbBTs|Y>C2g1y?WXetcA({$bDJ13UKruPHh5pEqw#komhcj2B<cb^XcZ;Q~4n
z!S#~hmw&tGyson^2xqm=IeXJLciWumgONuh4owf7IPah&n|fD-V8eN3jSluEG1k3v
zr=L*YlYWBx^2zBd-+vRd-_qYLqObPSjxWUAX6oHYfi)%ly$jZFIJKtg@JE+_Ce!`9
z^p5@N5_oD_<lQ{O$x>Qzy`=d&x8kxbtcUnGX3t-7U{3PofHKK56VBYqu#sJ8(&2S9
zj-%v;9dpmG3Z;jNErlm8N~<>fH}-kddwIXZrc;mn!os`1G~RUf;@4eee820}jE?^W
zu}9KRTR5EAV6*(G<>&b?+Ew3K_CBjOJlSh#BkX_At=_hx`iI>u`-<9<J1(JfKSqAp
z_xs1Y+4qY36?dALEl>Ki_t_?E)85ebyXJR`F1}rStRjEgx7g1o-zy#5YAKX0DLL^~
zmBdUDhfiGk6PN$^@$$jhhxg;%biOfH7ybF%?yp{;vW4mW*WbAo$#Yq^AD_AX0K?nj
zC8jU0@9C{O8~tMXMIT$k#cx(#*)wa`rnOsiWleNf)vRrMGUf8KMv2D~$!BN!XQZs1
zHgU1fn{%$od$bnaC`k&rYg^Y|dvWgTzi|eM_r)%qxsY(|wtcnwKi2LI3=s#NwXdu_
z%l&!QzWON~nKskRByS5xwSLTMx@={v@@`t*sf^A{<sE!8uPy%={mAvn?yU1{3*X<~
z9<%j$viq;@3A4Wm?dno@asC$Rx#s2i{L<f-&lSX!{|(OBW`87<$#VI<*y~T_9EH{g
zhQ7MU67`)?N{`88$;vkc!V8+q*B46W?3<aeX03ZqkwMP0c=^;+PMa@_=hxL_g_!C5
zSnB^Ya-E^Zp?ONKk&>}YVb7<huJ6C$9<LIf{^4AoaLjY=Z{L_7?~^b-EE)OQi}`ny
z_&<$U-N%dOY<?mcYwR(}>XmHy(WHxJdl}p7ZhURkd=(OM%;lnMB^&qajMcr19(^}|
zCHFMrc2AL(q~~=5=Z9MQ+7EtC%6*k1ZoJaw{Ix?>TYZ&JX>6FP$e`S)_vy4o?7G$3
zoco;P40eB9`<!L*+bI&u8xx;5EjL=T-q-1c#*}@|dYekV`sH++P2FQ;?;Wr8)9H-)
zSvQqR`$^}yS_<zbPFuO}*(9IoFAQFNIupF7;#K(c`+8D*au-{|KCC&p;Z>$+)z^1(
zOYZkw+8w#p@9-Oo?LW?Tez~_Zm+!VS_wV)JBo<~nm8klgxi;Qo_+(XP$9+#Ob#lV2
z<#)E|t`Fb5tmN9Z2j4@Z4@imazCY({;D_ja56w3{=5qDEayPNK=Aiq*!dYy&oiA=G
zsQpapvh=)t{>0a`jTK*>eB3<$P#t$dhz>`U0kd7UV%hRlEzDNWC7Uz))SdKn4=u}V
z>lf?!U(uKJJbFhbYpl)Do*c*Lrvh`-omgKL96!^&sa8ew;3?0})>Rj6Ry;h$Txl~~
z#oo65&*lEj7L{hTv;KW}b6kF&{cPLXZ#sYfef(S@w0w7e{Vd<~68-!9mB~J>&QWKq
zzaHa#yzKVjDk*_#+1D!szOv5TzRqX&z2sl3Hox9{(P^25fg#7bb<&U46>Yj+x?_5e
zZ11ye1%IcmQ!f|QIMMU#=D&C4oqM_ZHmck0?BGy&bU0Tx$D`2w&sWb!cieU?&wcnS
z@wxXIiObHx+h@H#Q}y^-+o6vwdnR5AT0DQntckyGE%bLkf5)Tv_=-19)*oMK2|Ul>
zd?XfhPn9FtLb#zm^qf%a%+n6r+a{d<8n(FNskrD?X-RFbM}-HEl-~6#Q#+I|UVmu+
z+_Z<L?`5k>YeM&!y5`xg-hMc*-iLdwUgArog2X4Mf~E%a-rKZ;!SG4bE44^{;gFAO
zj0K)f{`^BHcVCPmx8<5o3m=4M{HQx-wEdotQPR`jP7nWc?G?5ze9$}f{U3!M{;L`F
zB6HIjADk+km2zOW&n1<6Q_je?Z0rqPr_JBIJ=4|c=*f%PZRsuAXQl{jEnV_nonN(F
z^u@&~VX};K?@oJiO|t%G_~n&7rScnM*7+`QzU<S?vpve$`}NTaY|fIi|E~_>@qTlq
zD5cQHDDy!`v$Bx3dNI?Msgs#9eP=2iU7|iiJS^_(hkHvu_%~D@S3P#ZPcNu?k?w>U
zwW97kIn4RG9xt!8@a)+#&qP~i_nQ?Z|6*5i^W2LK5%YZRqO;xi#8K-5js`~WPABxp
zFW9{O6xZjezmzJ1f?QKet!r)UY7PI?^&HP-y<#DuSX9ZVxn}V-_X@S*+n*eNTR&V~
zJxz4`+Ff?`lfM?^@QUhgFPI;^BQWkA`_y}Dx3cbx_tZ*G*QsM|%vMUUKD&`;%efOi
zKAgL9@3rK`?^SNzl;=4)OTx8tNBO73|A)Et)RNalheS<zvx7mz`uLQuT2Fbuvz^hh
z@Nf8>e6IfGlnWYe=~pY*j?LmdQ^$YirCda<snCxCX}QOiQvDxT&(A!pTlKC{Z}T64
zWSQ<2>(0ddE)<nsWxMaS?e!l*F9MAESDb$0v*WguNz>r~+hisczUDPrS@KOX%T|~_
zUiRRF(UC6!o_+h6s}&R8e5kzP{{56p;dNg@egErGzs|cgm%5*k-=eNvbNr9!93Jl~
zqpIa?Ry&T1+7tz>*<V}iwN~D(G(zX{|G*E&%eJYtN$5Q0`n>I-wx0fmz_{2C;W>qs
z%lkKR@{6uhcVMgv48CIPli2!&F?ETlDrfZ@ky+0IIaK$0&a+v*=GB5OrOE4NUv4&f
zkiXgKj1#km$gC|-(tOuk?2D-Wy6x<>BimJ+?wq>gvU=t9TRK~MA0C(Zx>nEjh31!A
zmOLKcOW2!&kF42|AAQwmZIVerJ@1WzP4&DRCWURCwZvvmR&{clt4H$PxjjxiJViU!
zrY&6Jaq)FawM5BDmi8-UInS>NwYO!*1o=GMo2qri=8JB{JE<854u6m?y}g0aOJHit
zYPU(|e^-g<T@(qI+kCyz<HgsB&)3VaSZO{|_`zV~JJC1z>m<%QB67x)DmNu0-H%wr
zktEUlS@5&fN7FmI#p3gh6pJ27dmpv-oNtE7vYb@oLo?(3^PTG4F79|cYgNx#PJ;vw
zsX+eYOO$*!uxx+NzL=wpmC;|hQRLg>;MMgSd>Jy*!Ora*%dRAZ?L9hie&T=2H_MW3
zA1^tVpYUbb1T{waP1Dxgzga8uYNj^phuWW4k6d5ln&p}^Ax&g4vr>HSvyKh-I*t@o
zsahx<+MpRQt>RR+v77T$;S*Qq%vgWd*{311j9<7_>dF4Tl{`I`!2uUFq>3MF$hn((
z+Iq$Jg_T{Md!OIASTme=(TD9Pgf;4prtCQ#@{Rw9ZFFtSt?%n}1$!?)YxT*_609+D
zdTq76FheMBM@e42@q|^vQ7==BT3Ph>^}d_;eB<5Kmmj<@WP1GBN%y;-XTG%Phhv#p
zm$ddDFPOag!`s83q_kQd&soWxaQ$KIVb7?rAJXCNiDEVX*-zy9Br06JsPFMrQ8_P0
z#O>*3gR|ZuMqXZj4W=DlnK0dSNkZ61_fK_;=TtB|*vw@*zt2NINyBf`mSp{vpJwJ<
zX?f`|m*;>jbN>S#>4Ve$o_m(D!{p&-9xK(1HCm@~`Zie@ckIw9=-<h<d0*z#ZB}eQ
z{6!x-?AyO@;j8>2v+DA=!iOF0b(gy%Wd)dT=IyC(v7GmR>ZdguvL7tu|C;N4&S}5v
z&I!y<e{482@uX6}>(hNT*>`R{k?no<lS#MXbj983-<nSsPg{3>i^WyhKWAR$@P12A
zo3tza!A)Cc7d7^6=l(KXb=fBE(rC!=<KTZr)H_A$8g;7GMHm=dgBTcOu-_??kzbOM
zpR89<xz{E;|F+w<`(L%wM0GrJHLl&%6^mt#S|YuB?L-qjq3zZBC9HbBeL7|$D^It}
z#vcA(dw!<)b63y2UEvN%6OD_XovA!qdFBP{&mWhM)}OsED!DewYX7OstD>))%$`5F
z9Xl)c#h>#ZZ$4qI41WL3w{ZK*6Z6l<)jH>yP5I+-dzX^s-sP!#Zy&O_bg{&G=9<}6
z-jh=9me)E@ZV|a1d$&Yo?W$egyBDpyby9_+X}0ghNx5^stE%o^wokw4)+Aot@-2$5
z_nnIH-?UD;$X)x^ffKL#o|ImD9Kyr*GP-8_O6v+<0d--+(7SF+-sUrAx!n%i_x79h
zn|a%wxG6|_-_f%#-%!KwQ~9vE(x3P2T;40{JWt2%-L>l4R*5xk_rJN$bWiF2qR}1w
zBkWrFCgJQUw)el}hUe#Bde&Dq@ncEo(=VH4CSR6qeXgb5ppx{WwPt(&iO{PTmwBCj
zI9Dbz;q<zNAO7dw3bM4ABk&_8^m}IHllx}nJ#7w4R{dL<mst1h>s#jkY$b~-KY7~J
zx(7c|_PKgN=WT|ZVMKmbf)iuS&c=HlQ#v+${G-jjarNyM=ABX(cJ2E+HSKQ7vx5=;
z<2L7IeeLvHE&s}Bc`rZ1x!DaD(&kUNob=}Ru0<V7WfXp@+}^J(as1=kr_X!d1#C%)
z7g)Gk?e4Z+3lyH#KYE|Kz3TYV&@a2v`tx7PsTBF<J(~Uh-%F#)&xfDR-X8vbzkT|b
zWagbNY9U_pnHpX^6KB1U`C`qHUhYTk7Z_J<J+@_+{;XX|T^bu@<6hdDcAcCj)$CUF
z>d}#F%B(H6cb4<Io9<NPjxp4EFntSW^AoihAE&MHxjn7seCf=%E0WW<2dphUrrA7y
z+lv=wcjq!MnXj#IX4BhQ9tN*E_|}R{V3Oa@!?HpCsKL(Vyq})WVGy{w<K;HhPwPA<
z=Q(c|S^j8_zxN#9<0{&}=cw)8a(l~-x3L$?(!^t*hVpmrTKD_Rydx+6DpiNyG0QaG
zb7u+f*{i3MS8q`-e{L&#D0X6sXY_Ypx5>-a?VcD~l+`G6;jrx#HyI_#?H|tgtl&Gy
zpJV*MgUyQlmY(kE;-cv5Pg5pcHf`iAsMku2sOVR#6PWr$Z4$%e*;ljNp4DHUw{u2Q
z(&0L{u4#?yj7~MWurOvVy0gKyMJH0*-D6KuzS`uI{o(H?%dgAVTX$b&e@xwviqgMw
zAsQCl`#a<3&ONwn8{16Z3!Aonu(OHnaeS{9^U@+v=eB6nd8Tv~-^<~g_d^d)oA$aR
z<@TKijEgxW*wbeoUMI~gU}nWuGilAeyvthr=}%Odn%_z;_<q;vb$#K_)4%86-#h!L
zOi0-CD^U#bx9tP29kidRQ8IbSiY`4*mQA5uyH32gvS^~sb=@?TJFUg`fl7;J?kT>j
z<JKZ=bJy$PD+`MUJpYr-jQ0BEedk;-^IIzWU5hCd;qMO}$m46+oO$!oOwLyRz~r-T
zF}fxX<u^C3m5qwp8n{BOmO0{u_O{)UY2NQ<e=KGGvizs}sa8gZidjyH-+ZH<xGD!;
zGS^X4o+EWZdCRr)Z%-{;c<9rQW8b#_a`^WmdD4Un$~QDEw}~y+?zkf`(crYg>eZ$n
zOlO>L-8f5mHIv>l!I|ftS6*DUU3D(=PU%x~ZWo<Po9&i0>99Nl->EIH0~@j?=spPl
zlO4<PcXCUANtes4FMC)RUO1i)yS7Sby{Vg!;XkR`(#v%#+HYh}Fw@R9JG<a>+R}%I
z+*IbT`nAw$e$Wc5@4H(z9nN0&>zWzQh6}7cI}ZA?tl4E~b?-=iLcN3CiGOE~J)G|N
zu=VV8VaYp!`iTbaTwm5}mOU)7bM4-y9ehLa0i(q{AJdnK7KT-tuIbwx8)m;O{=84X
zR8goy(y?)Ccxr;`!RWa^;!?Q{Kk#JE-f(P!zH>mX*@r`Ko<3~8<I^hj<K>ELN!uQ@
z-~Qiu@Alo)LizbKAFEs`cF$hYb?hZytG`a}0$ts`#Szw)b#W8AXHB$U-}vKqUUMOv
z%c7FqufOFuR4e)EAE<v*_V#CZ{M~OSiW^v+g3Zh0MRRXo-v9The*EMKJ0A)Z%%Avq
z!WkO_1HSz42}X94+ZWw#2xMf8+T(Ia>?)g2;nk_tlk)Prckg=_&EJxL()n(U*X&*F
zk%uyNAKqb;e6P-XmsHKiw|of)*f#1N(b3E-S2!=1A!74%Z-Sn{=0wNc5|fv|JtpaN
zTjyv*AlIriktggEnNn66dU080|5?1_bMu3RRTpMFyr?9UXuzLV$DpUDf3a$^{k9MN
z0pi+b4BuWoZ}{B6c%=1H#Y2sgsb&`Z)AxMl%Gt(vZ)$JhotzoU4KWP*7f!sr#OCst
zZ>>#UZmoB*>eEE)$1&F<<)RJ#?OZ5Y;HD!j^H0|JheEJ|wyLVrPlY8)wM$i|+bpT(
z7C5EWqkFA7Xo2!M_1GJ~p1(3Zb&OG2(Q_}KoMoSXx4YRV&4`&L-!50Qq#rU^XA*qM
zNHl4(>*OxKeH&JM_#snVHR+?1>n{5R9x{dUejiu`48`+jXHJXW^hjjOC8MZ^hOb1w
zYwC9`vz0n<!tl)F=kI&}UXZWPtcZA>e~HQE`njgo#y?)m`VYKXu9<0G8vpFcv`JNG
ziz1&t`KZa4r0~G(ty6o!9GjY7sp9IKd3QYzon5K0<4C6I?45PJO68|-ynkreB(=<O
z#;)THFDIF8nWin0(`ffhgoo{mjLk$ATfq;$J%Yzs4s10!|3Ugf=e1fkH{PdPU0sei
zaIar~?0(f5$*RYh;pV?tyXPpWgdAI3^)Kz&j{I3CIAm;gDLt(?Idj>qU1|AcZ+OLD
zi}?F3D7uh;`25O!vqkvTGI?Ufr(Jisk$ugIKO|-L3(uK+zmwDKlpHnl%Wah(y*&|n
z{mjL-*Dn_<yc3QT-y*WlK=4{r)hVB!i(Y<=$g+J}%li2;o5RNS{<G!<nAui(f1mD~
zyqQ;HIm;#0GZ$S~Y)rE3_$wv5dF9c(8SZH!TM7;sD=%ODVs%LlgPK*r+{6FbYkfc8
z>HE|2Y}Fi@^V2db6@6x(+;Sl6NY}%RDIt7E<EG`<3e@j9&En1?b9SCz%<U)af`=bD
z{du;z{?<9(X_I^Bul`spWBSzO!uF!X2t(G3YOYfgzJ#ANm})<#c)3UiQ~ljDlCO;=
zUR;-7U;ppJGozmcwY8tCq#|bu=q{`I+dqH(z1SIlQ%=0UnKj4f?Tx<RHD6i6*F0sJ
zez0br=j}#~?%hch4C<YK5*^R+v6m)aGb;GNo%T%Os7&$Z;!AQ}VUx;q);22$&tsbD
z>aK93Q<%L$YX7Gv%@quW^O<uuS-Pj46K}b<+vDG@I~PwgI8{8j`ajy$;e5$rK7N}s
z*HWvVtCa;TWOTd|F_rm9F5{d}0sb2vE2ZV_S@%}+!r|~6U*71uPE}P>T=kLlF89n0
zDSaXgA(B1`Vl0xS%ps-9s{6L=xZn78>BC6}Wdfg{f0yyPndN8ClL-;)`g~73`}|2h
zJizFl;=OpbcJ2q$ofxlrTWGJfIC1!NvyF+m>xD&L8xAM2KfbS7+_L=CKHcgcg_9>4
z*|YTP&7H9Mz!jO9+Je`foG#q|*V~n&NJGB#kkQvq?dj9RpD>@T;yKM|8rc6LB7O0i
z7wQKz)(d*_9nJaNF=6t)sb;f0?|rCBd9vezoNU$<jT`IgPV^}I_|0c27FQCr+oo`~
ztysN5eY-g0jQ6tTsY`TToXj^ret5ypJ1Y}cTrKK)G5gq^-YNTi9_=mOrFty=oM5?9
z*Y>^hpGG}7-TX7uAo)nFa^cQT6<Ul|M~~Y`+-1DNB|Po$!tLx*X*!S6@`dLIYjxdF
z|JA?8d`G&}k*UY6FRRq$gf5;p+01OiU%~ZVkstr85W79m=EIU^wq?#o=dSA1toh4#
z#LWEiZl%Q!OJ!9Ql`XG7TK4j#<NwA~4TH;1CVI|EJNQZdWp4EJ+T*-#D|Yg?YjrK3
z_VCN0*9%`gOY}|VE}WD)FSL`FGf_#fu=3b3qfN4zsS}*-HnXrxbE`MaIi0N6e@NEn
zgW`tAg?9t1TKoPQuf6(tjUrE>_{r82>*gQdp81XQ*o)h$ayJqr9VVEGPZR&Izj=*E
zNM>Zc{}$c^sphk8iH8=(`hWYF9M`$+u2^}pnr^kjZH1$3%hGRgo{#Zra}7;9&wOy6
z=z@oxXC(f$9{hedG3Z^GU|;n855`Ngb$HnS@TAv7PrtKnqti~cpB=Z^SS1XNCS6iC
zG_JNyvPi$zaC5p2S4;VJzs7LOFb9=SCLa`z7X;e~ew5f0*)r|g#^vdACJ2|!>$lE5
z@%gnVZ|>bL1?{9IPaBQccqTWU3U!M%=h^sX`h+-%k|mGcg!LW?h^gzD8nrW1gR8$|
z=}hVC3Xz_SjTS|h9!xjyZE1B`C{{7g<=s2AW1RNf$<M;?YE64lwrbYS*Mc*@F)GF|
zZ~mknnsV*n7r|<K-_$B&Ril>s#~ZyZECZdr)2xKru6DX7run(@rM%g8;-Ih9QkCXO
zC;ERH9Ano$?kzaiq&-*1{LR9ausKZ==O}U6yK*0?on5!+(6sHljLR;+_u6$O`NYFD
zRW&~)osRRJ-&?c9mvQp;Gd$~b^ly2KpDr!of7$T+G~YwNyH$N_XD&Z5iG9V9%sVeN
zlaF{ly3fgM^GVyLs_e;kj)-LLPe)c)opTNT_WNeQs?t3*%uWW@U8XMUZ^rP<%C6kt
zF!i2Tu&tIv^d$WziJ5nN4f{(>nk-hIkN9~|cz5Jox6VcE;qB*^o!oJJrr#F!UF)^{
z#C|gwT@;atv%S9L;HodFntYRXs(%U5KfKn<rQTFz*YW*LP5ocfKdwo=f7hYx$(;q(
zUpLs5F)e0OYJJxt$SLRWLSx<=*7w<hU+z}@<7N4+DPi(@fzzK04fom(KAtRmGAmM&
z#V+0K`mwIo>+L4*BbJ@GBR7vX<B06lYfOt;W>lBo4Cc#uB)jn1G@V|v8)q_@??>5)
zYpKP|<m6M{oH*~h?VOt&&rYpK_<mqbhvCtP{?@~hcLNM+G~;G7>Ti5_vO2GnVP!z<
ze9mU}F4t=cm-v3`o2)n-ZGB*K{~yMEuSNW?HPwYF)bYJ_QxeN{RPuS$+0z*K>d6Q1
zO)1iH`iT#Ia`9z#eVzBeaHFteQ>{&%q{EE^{yhEM7F~_pVmp;upMP0=;Md0ZiDq#U
zn$H8IrX_a@@Z~S`e*007{bp6p9<?y;{aa+47hEhgtoY=iAt$(dd9BTAizNB}b%(b1
z>hfJ#@6W99>1y7!PbKS4T)Z_qxw%zGpRLrAH+thvy*qz@+^DGgwl`L1>6~?adK1DA
zi=AF<+j=v`Blb{sfrYDvRNtp-`yOw+pmY4gwNi~qX4ze_>U@i(7p~lKI>o2wTZu_l
zFzcnLC4xT^?<J&#Z2QW`6qCSu+H&u4>0Q${H>)WL_<GJNJ!;!f{C*S1m$jQ+lIDDO
zF|V8Rd%2;#`m8UyQ-4l4SdqLc)h#FH#I}5En{(~O7p6pB5C6FOhmHZqg12gXQio67
zT=mAaGcA7Otm4UYpKP14_>9)XE8KTFRU6iAYv-2h?fW+0&sI>er=(8X?7@nxd#4z3
z9yKpH5|i9AZ_W}e2j3`LC*Hr-8=5!PdzWpU_BC0<SGn2a-Z}<mvDIJSWNnv!bL`Q&
z^A0@m%kOVWojm>DpAGj{7W|s`F69hgf$qB?A3ftfYs;A%gm<zP_ta_!?!P2kwXX7Z
zxK(Rs#oBf2P9NWX`00-8=W0J!c<=V*&08R*!0|CHbN<6zrK(Rox93M}YrAvgepq$I
zugM<wKZxfE@jdhiWa~X6T-SS7!>ZaVpeiY@d`i30m6xg---`>lLZ{8T`NuhB?;azq
z^S9PsWWH`N^8z3Lp;KMrQibO#f8C6I^I~g4<t+oL{n2k2%MV?B=<!|m{MXfA*2!d?
z+*HS&WYaCGyMr}E@y>%AuO6^>2pS$){It~HIOyVwrR(NyQjhmKym$BW+V|3{yq^79
zeDmU-jmvFcPA@i;?@WvJV7okP&xtLk59^=kf2r<e!00BYac`}Y`oipQ5f5*O-dsLO
z>HxcEsOVo6#|fTH2cPE2zdCeBulLjsuia5AJgrav=RZ^znEvNdLB?N`6FzsW_f`GB
zYw93XC*tx;DI?_kqxJh4pC_3~UhduKeXL!@Q~I$ehv=4@-}k5{ox96fdpO~E&)Zoa
z4@zCxV95V`%Gb@aY&=)5dALEpQ|x~eOO}?suGQwniJ8vMA7v(%e)xWLadqjxllvY#
zwJ*^Xf7r~h>BIioix*^SzUM_m+Y}cC)~pVwyyKqyC}HxpTmIE7&zl5}MPD{!-6gNh
z{^EVxJAWqe?8nCS6|O&zi)qbxlzYS1F|A>{>(mqC>)U)U$}H(K+HL-7spgYbwzHqs
zJz4s*_^-P23`Ph4JGRVk*U#0vey;Jc``53U55!rXZnogMsCWK@#p@);b876K$rI*;
z|NQb#=BXm*1NmjMuI4{zX<T8$aONSqjFM{foekCOn<kz7+#b0<^w9O9OCG=5eG)YG
z?^CU}OgC#=5!cmm=ROP9#ucYCPjT-#T6O+|MBZ<maH%)qDN7<A&b%8UvsX)ShL>qu
z=#Saw0_Hz!m;If}r=6WJ;TYEr)tPPI<I;YdC^S<2xA?^)cBgMWdI|A=USI#X`oW1H
zn{b9Y_M4X;NUQ(*C%oWo)0Owu?eEU^IGdg0u`lO}+&RhIBDH?rMaedY`M(rjYKP^e
zY>2$Pp<SYLW^lQ{yYr{#9{zb$V_Ut2{ROiewMznBt7hEbDdAUM`)%R0re8H(Ts-Q(
zEt9-2KU<@-{qfCA?Z+$3l+LdHw`S2a!xEQV`wBOm6()TaouxtyYER-11^w|ZJ^72R
z-c(`bs~B#Zyr2E=B3c<g2HPz3D`Zr^Wd8X?r{mT2FC(V1TSqepcdbl*T+wWMZm;6!
zGoSf%bRKNr2{gR8@m<HKm8qR4PZpo3JG8sdB`np0MZu?c!KDR<`&ayx=XGahy~1eg
z_i#q;>p7b<I^t#YrGH7>WazW~5#{le#b(+CmASK*JuEn~is8<a`=|qq=b5&?7Z71!
z@Qz?$kitH|m}zK{r&mz<)+W37_KAu2ziJnJV{gb7%D#E>*m0|8DyKIsUK3sx`9)Pz
zj+>RySxAsWfnmk*m0#|!ua27`?s4jx>eM@*nqAI(0fTI*ns>1^b>E*~Jg%eY>g<-T
zsd+1B;>4;qvf+iBlop3SJl*{Ko@eCUt2c|TR;`bd`}f2*{K)TClhlVxpUiray0xt^
z&im2Vg9jJsU5^vdHG8{EE$~U|>s4!__4T?o_1<2iBgGeNwrG9VZPDz*`ITjwR(8qk
z|L?6SD$<s_wOdPjTHKwA;67cEWWW6A2<|hVy=UeX8GX6&U!UcL=0ELo=9^xwiI`He
zL8f-+$xl~uVjc%I>RgNqE0JCFTe$Ym%sY{fKNV@-+O$ZuG*tM9G}BiVre|v5J2?1i
zjC$|Y+5Y~aSM_`Pi@Ps>KVC1t+&Ra_`v0F&slR`gFDx&sGqnBp!*G^d{etuJ_xYV&
zSDqffCH+rboLCB%G2h-b9a5Lvt{2W*S{Qwe@0Q-<Hjb`)lO?`?m~-a~L)#NGMJxSt
zTwQ;6#N`F3&Du9n)AN*6<^*N`Q;T{xH(l}2&O3YI_fNHT)8AwV*6B%CWVP-1uF|_M
z@5=I3IZ8ERmqSZ;u6bO#n9DWx$j|g^dIx4LIk##X=kz7HCv&wIWD6}1<g4D?=@_xO
z)tq;E{m&YyxqlvhdGdVoXa2{`{B|Pj!bdtd7EU&<JCktCLcVIpoG-D{wy@vT&{Xsh
z(0`C1u+)4>kVe9?4F;E1-Q_a2-gkPLoJVQ;%dB;eXHA^)r10{A%C^jV>6V--N1F|q
z5BP_L%r4`Z^J9kT+Z?Gn-Gr^iH+$zVTigDIp*8=bzH*Go+?-k4V!m&mE2_CuHj6`2
z;7zQox~`{v?7yihxyo$y3JN+0c8F+7&5B-=ETnF6g!SC>P3!M$DT#FW)o7MoQYpSP
zMKHhU#a^A$F^Mjhk5#_Q>%FwbP0etsz;j~<o9zv^DsJ+(B<cKI^Yy^Y-omDN?^dO3
zUY&jLvZ2@}i_iJjciMmXGsPr4H}Yq3>3{nT#t-iO%~yM6y<_U}3Wn)R@^_jtrl#?S
zPb;}*R<E=9QTW1t?cAl;%q}vmcyse~Dd*vd@x5Cm?;roQQ;om=S=GGa;$IPw>peHE
zoc(6jpSe5S7wVnzojZZe^Q+pt1a47pUxsZSFK=&(tv#dnddE4B$B#sPN(E%=e-;?N
z%X#PX@PJI(G+9Q~)9z+JeH3&r%RULIN_^4aSg>;TnP+b#e{Vi|Hzlgsy3C;A=6zZJ
z{)@GhJe)z_Z8&8;jy>03F1|eY6xWRR^L#h6i2Y7pf0_GVM$5O-DN{6O*38`}zxQK%
zR{ES}7q&0s6Zmps-Sc~^a#yGQdE9>|mo2^^a!R()w6CAs=R9+t&~|#xh4+g$A2xsf
za8>Mct#{f*<-ylps$5zwa`w6HTlI@S3?%oxlH9VjTyiO=y~X3Y2~JHs@!y$3WnNtU
z5$bf%WZJWjLNDay`?M|AEKb>?@w)WRs}mXm6Mko@U-%gpAoaA`p;=?;Y^_yUAJ&LD
zywXc3;j{d(dT+zyRZ6bAo=XH>Pn8vYlJ=*Hy{O=~=7%5Vw;8V&)~a3?pQzU9==?59
zy~T1j#{!P>hYKAXp2Zbd@7#Z5^84y0QJHg5FaA7Wyt4fAp@P*xQ*+b*Ubu5cWWCen
z!z)VU_*zyq8CYp=GV5w;d(yqITwCSpCvKag7v)zUJdmJsy~)C<kx5M`zLddq+l&<%
z)~h%^$4Ugwa&MZi6es+u`bI3Taq6WVTFY|toTJNbuo?1f;$0B=>|WmT&Ufu)H(xcH
z|Js}E92#HD=$PYuQ}_^Pe%_`s(I1K@+Scbxda&So(xZ*%_?VOBC#&3$-W4n8BeYVM
zG5ym5>GowBdO?ORZ>lwJ#Rr7VexP{S<sj2Jh7as>u58*j`_619rtF>PUTtzn7S}p*
zU_!!&2mJH6bc++p6Iqv>`8`)=<C_x`*BdCQa<uGm-Ys9k^F(%1IrAM|%^10piY4<j
z>k@(k)3RqPNHO2pw{Tmev*G7}3%7L}+7!0keqHj`B-Aim)!Szsx6onUkaI5oV_v6+
zcs3^a1ip~VxL~$gQ=qg}&E3SebjceYqqXfa)k+f_&ndAtTChxxxSg^6mv5Fell4tU
z-Hc+h3m<;$TgRc}m}@p&Ve0P2RlAOO<g+hO`sRGSs*SJjRj%<Ad*^D&GePpD4y$f0
z?tAN$*BiM~ZppL8y5h3Ok**hm<(_M-$}+c&*io9tvmhgs=fjG`1MlQ`G!s|aT6i@a
ze16d^E&8GN#V0y~Z?~$>h)!)5eaIlJf39HKp()#Toef&4f9%^bui5sKA7tDWK76Mv
zf%9^4L+Js=YTjZFMmGK#%o4{$_*gc2E$BL#*V(*FXxqXCcCAU1&l`BNTx?I9zA|xk
zoA{EerI%s~b$oVTVPj^O*A)Jl^Q-LeG_#W6?v{diQU})_Oe_vd;gDbPT4&PkiODV*
zi>Cx%x?|&|A#?bb-l<t>%DS%;%vGgcD!y```nhqfY(#qOG>J9eG$icKChTX8+Sw2*
zb0<W=xBFw4Vt&){vn!TK$=RkqFkihxZKeH-#SPxux{ggK%sefxeUDH2_Qm@vkEjd1
zuQhuiXr=LHnqQa7VxP@|MMXJtVp|@`EG}q}-D=1CT_P~h^6i4JJHPwsJU_>5D%bpd
zPt$^yjx(BVp>jeO)Ker&E3LmR$l5yhSAN2A<;a7nVHOs<c6e>SDC@iN{InTf(HnV;
zmachiwL9NJ-B<dh1z+vq<igv_TeJUUoHWR6|LL$?Aopv%c-@cdM%pb2*ICwnHSL_h
zdGJ8xBcF27!~|asg=x#8Gg429=lFea`1on2FK_dbTSwpT2((~TcKj&haXBs9=eqkz
ztFxP#3MM7pTzBE5Y7%FOTuI^VvsMSv9*En?1zA00d^yEtiS4TV`_{+nOW3?Uf_AU+
z+^khRp``X`4BN`tZ@Q8{EW2ywlO>?Wyg^ru>*wb~{EX{`I65K^&9=(+bkUzFa*W5;
z;$bS+zMDtxZ|S}$ebx1OiZzecq|4uK2K)8Rk$m|mqF-u_lgG6su~S!Gwtn@;>a9)3
z37?H}(d%S)d^mlvLgAQys%cf}vskxJC96;UwtJoXh`ri(=gGHQgAZCATVXb@Pw?gD
z&4<nR<R}}QvN*ze_U6yu{tD}28QmYG8+e@PQO;bJdaOp(blI}lS-!5X5(G|dJhdXv
zGvvaICmzqA#`TL`ujuw`JtxmyadFXV|M|-kS!C)>8a9c!tUjY0;>{G4YkVM|cgc3K
zYwXFE9VbtCYgt8e?46n~vVDfi%?r}qmU|cMEEnQGazk*|{=8}3rMGXl|GseBv+~uu
zP>TiM?cUh@|74}<AYrg$U(mdV&8iQ!-?_E$8GCHhUcY7YY^#rT^+^?8bKS?yH$6P5
zsWZ|nt3rz5ec3X<iXV4ws(4+#mLuI}%5nJ0{HOJ2L}GaCbvkbbzxw&$(~r521H*qE
zJ~v(IXoSNDqnf|FKd4^+=)TFU-FDSi%UHdmZpyo3rut_sU(+zD_pa-L^-F{sHZ^c<
zSWzLxvrEzK<CL8DT`P0~w)VzxwmsQ(X1!x(+5#)}1FiSvl*C0eD!Vfq{~copopylB
z{Ey;l(-kN0n<=Pk?wwr1@4&}hP`LPHwslJG^&>jpxZa)p)X#o!exnWh-G3cFPF4zS
zxw1!pRp+0d7m{!HF}qk!^!M)wZMi;I*uW#_iciim`|k$&y)TOvw;N^U?Jz66Cb0U$
znMt=de)n<wbmsB(NtZr;x|VQsuXhvUyz<RTtu6IzY?reW&7H2A9z5Wvbzx>edU1>E
z&(9Ac9x}xkJX~}~WLo#LBW4fNt0rFbc3f4<e9`vEVd=GxQ&{63x>$Mc-_SNWbY|np
zrS91aCas-Se|%2Z)lSFs==(S49n@mu|2yjn@97<u;l01QnrFmuu2p_>$0jPeN~?=|
z<C)1ff;ZK^mrTyxZxP=6{o$Y0$1|liSXtUO?dj|ei|qRU`{d~lAMV$N`n_aqIXknY
zy)#wGvfzjH{gP(^Vk&E8s;5kO%~i9|;px2q<pWcfW*KPjx{=;^Z*SLY#?NyVoL{o#
z2%f&yD4L|2B=KKjbv0vg#lcNE$M5a+dT{ta{gXHb!@G6iOK)%5_+yc-vVq?&RcWtN
zJC@B^U2c`JZA-Vr;hyrvyNd)>EsneOG377$ahc`k!~RMYujdQOopQ`(mTY@>V@>rO
z_bL5f)8dXSU%#j4+4if<uldj3GVob^-Z#lPYU`|T6=FH|7As~o8N0oHT6Dnql@+sL
zM%E08bsl{0wiZrgny_a2r(NNR3udr%NzTb$<@08GombCpdB!XISt_krR8DsvURbEm
z=2KG2#KN(*ZC1W2v)G&6`By9?t@K=voqc3`!<R9;?B}hm3rr_StIs{B`(mkMShm{M
z(~_4RoHyIgx9+ie?Z_1%8YKME%Kd(c`f@Gq^8Vl7&Wil8U3X_!XsEQww5a7z*mk$D
zxmje{i~9MWVS8?S<H)Vvd)(VQx5|gaTYYc-w&VNa?^bz>YToZHoE`A|{H~nC4vXJ!
z>uuMVHeKStw93s(M3+DG(Et8CEUu;IO<a1ph|<H-?{)h2|GxU~lE2T&%@p!x?Zf@A
z*Js>Vc;xiG9}Z$phncodvsm@CH!5?n@cOzX5tdsEH}n*Ey}u)r^+2{W$jj2et?bMZ
zjUYh|W0{B2Tf=pX?uOW?gf9|^yRy%i&GDwoYiG%sjY3To70Z6y?CFeCFcx-xU(2)H
zb<4(<mRl9KIaRagME|rs`t0HTozd38Z8ImF+t8rvaIC-NRz9cThtD!<CqB)2#U{1(
z&+^j?O<xwVn<ed>viY5~XiczIi?6mrHcQg=T_+Q#H;TE=u5b+Hvxzf)cUNJlz|Pdu
zi(00(|I3R%r5(tU`E%p+>71@si8j7wruTlkxz4oGtNwU-_1YEhSo}}RrG+21n7;4B
z`-v0(huN>_jz8R)zC148sL6q+`s<0WdI#iBwN|{@`a{caode^=Lt8j)3pY<cHCrOw
z`^qsB4awdIoDbE$pIX4aw97Zk_~_XeCUgG%Vt40`_}E$f)ZP7#?)1egvhO`C-61;h
z)idtx|0XIn8>dCAa6G(s&a=k0?z?OFCPl2|^;>Mvw6jj=SdHeP^m`NXe|$b&n(27U
zZi>X!x6+|MPrbRrmZ7Iof7VUd;F?-SxX9n0uP;K=ZaHPXoF3vl|J9TOje8l27e1<4
z*mE)Owu|;;&R-Tz3eE;oE`DKJt9)Q1zt_iBWv#2;#u>tO{byvftHn67I4WMW&JsI%
zDEO{lj*5?E*#tc;?Olg^L;hGVGEF#shU2JJ^^@etmjN=jcUrbbEj&5R-YHA{JD2_y
zA)h7lF6DA`GE1{EyL{Q-cv$w7WW<{Qzq|L>I;&3c+bLA;HTiDxah{e93WkTc5=BE|
z1y(<Eh$>4+-S9az_=AW0)vXFwl=nsE<eBKD6{S@7T>ic>S^lA|+l3Qr4j%|{NqRZy
zU!$nFRkJ&D+x^@f%tCvlwz}9j?&hoRUmw@(w)*DVXQonjIb`NI>}%q^XC$#@j)Gq6
z!@|oGc7+<xKegmg^|y=MG515u_h~6+r0fnCG`+WKnNMxH#f`G;%Xe=`d^fH7>C~r}
zaehyz=DN4#p|f&l*XkR-oG7hW{gYcK$o!JjC7HK^r!GJJHEX@WuJiJTN?#Ua={(h0
z(XjV-h0x!ks=~rQ55F9ezu{aiKS}l^!=E#EUKZ7dNOdaD^e>un=FE?GJ9qK;DTx2N
z?<}x!2k(bFzl9e{R_60Qw`|_gvAp_Y&8I+>qg!?vNxxC?Ij+Yf&fOHZz~*w#Mc)^*
zGDVw(yKbg4>{+}s+u`oCxF|lun>CX0&&r*7ay1+c88&69RsAv)yj7+9;6tRG(!RdU
zGWy}N!Hkz$xF%IZntbtl<=f@$yYASRd&^=4)rw-08N>2|59;MjaJnvaZ`x6|81>Ww
zUjgm7JC9rqml>Jy2DRFBbLR(_#O!Gi;0djbS~Od(V+G6l;I})sg!rnTn`N|VN#*a=
z8j~egHxxKzT1w8UGn-^oWyfa!%hT-2KARi1&+oF{Soy$ayXfJ<c}IQwA4V_Y3z%Tv
zdv~$?>own_tfpqA8m{@VSZn?{^<;^~t4b=<UX}PinfG<koo9<XXXKb`G45>delGP-
z!v4JJy@zi)MfiQ+YE;hAtKDqve0l!;7s=|p&*gpoPf#qbY-2iq@13Hw!J?wYLLW=!
zDgCXPzI%m!*8DB+eQdv7x-BF1rjfO1fn)sLt}uI7?eMy)uf9{Yt(0#5^bg<t$j|Wf
z{q!3Xlgj$v)$L0>UEqFk`|cY{z5lPW`G2oU<mq;Ye;Y+LUoHCApB?1#H`YJxChx0t
z7J`58Px60v#F_J#$jrh&J{>G6qKj8moVzkR@W3XA&>Jr}4OhLM$;O(y{?D$CZFQCr
zZCfuXCVyCSs87p(&AMQzn}6ekdD8TsGye{~UH{aGp>*>K1@-KoSsOKdM4Dx^-R-_F
zn}4rXs`_f|ZYK3Fr9X~&Us&Dd>|Fn}_wB*$p)w^+ucTMaVocAfNGp>noMXy=`0S?M
zc_);DyZ&#}j22Q^GsnnrW$=y5(fcm^)#)=6eY9ZG$&X+5b|2a-9Fk+);XkXP?^Wf;
z^n;hb-=8!`V$;QMd)q=i9d|w{{!#f}?$qY**)tFS|82zncIji!<!kG8+inE%Bv$S|
zwRCg6#J-m@vFSHkn0(&~@9_Czq*`%Hemc|Xo#(nd6726Rc38aFr#xxyz2$%AvPH1}
zoyi}`b};|(cB|vZ^waac?zBE1BCw)*X;<*872XoN>b|)Y2A+*qfBn}}&{1iY_`1ux
zx!dL90}kY^_Mc{8{d%%>&fZpzH%m*-?yv88|Kt0|qr2s=R7TmyJP?&(G?Uyd?Q>Wq
z@4(irwPxb;*}r+0U;8clY{|kObLYuN*ga^Mm)QNGR9h-mG;%g$_`miK+vlFSzBu6D
zF7r(i(LZBObw}mAdGMefZJ}aRO=jP076t}p0R{#+9OH<|sl_GvMY(zfm1o0q^KY98
z{970AxIkWoanm$0SuTka6O??77Uv3?oQg}3XwsQ0tY@@xQiz!TiTe8!Cuw+X3)VS&
z;bn8q=ZfRi^QsrePh5SPf4{HYMVT2bC)Y46d(qW2W77A~Y4;C3@vV8VSLyhkTO3uz
zt53{szW&~$i2I4L$2kwi?*X5(daGO<w|(0)^+EQeWvipEGF_T-q4a30l4NpBYFClk
z-m*?Dfv(S&^j7$~-sC;0;u&RKxV-Muf(y=9{+;RG)zV=yKc2xqaeqo`?)0>rqtU6W
z_pZr|>=C~%<={E}u2t#_e^rM2hE+_Oht9v>;=J}y;iPlt^w&@R@_4;<$+Vd*I~wM6
z`xGi#FYT{Sd*t?8B(ox5NqLoH*?uj(;J>#&zvxma{Pg>&XVst2CqEv)`Sa!#<sUO9
zOQi+9h}iH<IQJ>@*{Rp_w{b{2t(#C*uw>okyXPYJKY6!?WxwFfs9k{qI@<cPzdk#&
z=gbn79bed=oH{VIu~d7G+3YXMmAXX}f{*;{^fL8-l-(BbELP!BaMYpJ9YIVR-Fz=R
zGEQjdaa!nm>gb`U(-T=$jaVkH3-FKr`}~>B`j2(flzn5?NFQqo+*YcP_I$bclM5#|
zAF$tRQ~jSg%X{rx_apWl_y0-AKiDpH_w+PX8MQ@i8w>*uaCtWyt-53~Az+=-BbMY>
zZHg+B=bx}lH+cJVwYGqxL^O9_-i`N8n>T7|`*!vnl&S2}v0W@tc4Ur?L!5NGIQNks
zKTJ$^u$7+Xmb@O?_=dGVY?b`}tfu$=v(LUge<H7{=!5u+ymdj36Hhl@k+dqkTq<7G
zo&7F<#~qLO-<ctgMN=cZco!^~`YtKuT{_clsph@A*46|WZamJk&Ff81d9`lIr@yy$
ze2&c3y}x?xi>m$K=k8hhJL5)j&mEO4amDyz{Y8!jyPwOgbXa=$K+5?AD|XGXTzB!7
z)xq2aWoyqyF!JwSdpkX3+AhPEg|BNb>oaGkvU6w`Tb1y9-?OK^AvN3L%k68A+yBPh
zp3$7B*Z-@_{>%UP%^QV3eBfb>&(>OCFn6)I>6(^p6QX`pXJ^c=@LiI}<rzEmLTT&t
z?T?Or<MiFI>~Lm6S7mnG_o=;;`QNkUJ(jv*`ugy?#Hg0LOFBJD=P36Y<R<s3Cb6w%
zji1(cLZVc?PT6azqs~VK;aW?dKB1jlZ?>wQ%Qy68dVXewYC@iHo?u&|J>zuM*rlgZ
zn15}Ut91Bs*uTZC-=<{U4Ky;-b+~rAsmpfK+ORv`jdz0&&fK?)_vmNYwPNbGpRAsj
zKiO;l)3%kjMYKP@Wt^FD{=~(jrA<@Imn?N(#?k*Lu*pJDLe|1TN_q*m`N!W1r~WMc
zv+z~<g7fEQ&pY6>KmPvLl(LeSta)NqdhRUecE6GOuCe9al4}v!C)PbnG~elcDsIl4
zDYfiHZ#Cp5?U=sLu6o{bkHwO24N8`r_U)Q$zS?{1)!A>u->kLKKIT%l@}_y@9FtZ5
z%mrq@c7EcL&6D<VzWbrZ)$gVCnX>h?&O7J6v-&T+;t<dJx1MG$EA!VX>(9N_Ge_(h
zQ+HdX@XkGY7ufy%Yii#vkM#WC^zGIDzx|0n+?Po%S$lu+e~aGM3%{jNr$-`J1oQ^8
zGBB(Y#5p~Zl~|UjS5SF1;x4F2tN$MFxP*Ta)69ZT1|n=WTZ%88%bv})Haf?Er*Yaj
zLFvdV8mBs=pVZ$ET(VE6I&=HNqhB7qsJQ=qx3!l4iQlig@3*h7<jCYZ9LcisQ8r(Z
z&%AV<p2P}2_h$7Jtxa>Em~T{izWB4TQGer}#+W54O}Z*dw-?9+9x!V@7}dqg*;Kla
zi__8JhnjGZ;Iw5<hDTjz@v}{vW+<v&6S{X*?6J$zhl-50XPMnPw(5ar$VyGksI>QU
z%62SsU3Vny+!J1n{h!Uem3MqU>FwcY#CkD%o^re8>z6!7)gE)6*mFs`u_=I6)HZ_q
zrtqVcOfx;7Owpdk+^Zmx;bjuFOewTyG4tnGw#_BFHJ_Mf_+4jRkg($KD$nqO=aa+B
zUo3cdM8#1gMTvjHl<@c4XDPn_8I-zu)1IRd8<<iVe4704CG=jLoT($g=r$+pOvcYo
zaf*5Yk9s@0Ts}|V|DM6t+kVrM6`r>&weO!}xcZK@WATTu>Dw;p1YOvuEO0Hw?|FSp
zJlo}X{pIV^!u5|cH~C)|PJU#2h&^ig-%mce3(sCDT9!21bjd*lpNM&r@86gvshww^
zlW(J8dTw3Z9@WWV2iAS&d@3{FLiyL_jy{?525uXU@jcKCcYN?{!kXGkMag%{4j6xY
zrLJ!@VV!%n=Xy&g*$5xeZjI%xVu?z3^uMmGn<L%*LgA>|Z6^WdZUfVEH#p=izwP$o
zJ1r+%`J$zpSL8*>mAi?`=Sy!Mdn;9y@}oF*wOZYgrjzOiJsUZVCy89rovw6Mm`z)c
zu{quMrMN81<#@X@aq&9G=dR#0S$jM9?c`O{*hP|zH>t2obD!-FRXeI4ax27Rn(oK*
zv2hZgy(eEx_x&v0BfEP3(R-Dhd$*++d&-3uxViV%l<(V7+R&e|^5-_6tb?4(B7S|{
zu}pu5oP50X#JzpSX*+6nYk$2`GI!HyNB7&(`|^U;F_c{YY&s=!;);_=FNJ-dzrLHI
z_jShP59tRtPI<bz`~rvGndma+j3X@Zy*sDH`EEM+a-F5n;fv=!cAh&DasG^wcY@(^
ztLSdOY4=Zk_j<G;R&V#&+82g1ul~}jSRuCbdhsu_%h|J3f7R~P*}c{L`*GVRuRR67
zFlFxfw$}8$#F77^2K6>_|BoB|+4tgi;{xN^ud2;&*9&fN<%_d_W|FeANcMH#w6awO
zg&M2aQsXwy(@_i9b2dWpXqvnIjuzdmyIqRg%7y+#mM5$|_0Lr`g_HZBt>nBPPgE>E
zN^xzSa;)L(u5)g0?O#RdWb@rQZ*}MV{I9YHjuoAeJZx_GhyBd9rG2f}K6P!<X*Mak
zer|f)0se#2ZFlpVl<iVu$mhJjY|qja(=I<&IkG@!7k|u}Q_&&H4eZj>+%$rkFZ=P9
zU;Mc2iqAv2Q;C=N{^nIq@Bj4X*WEXdKmSZEFs%Nb^S?miec-Fzfk&S1TXgg4*Y?Wj
zqnn=E#)Vw_b5A7jdX-_+tEiXW39Y7cufJL<81i(F+re)?uDvvsl5bmfvHkDFnje;O
z2k(ElHT%K!kK6U<^mE*pWw$C^#Hgia(QGN<=fZ(2)&%@qvTN;R(Pg}e=7w@Nwuk+i
zKSA=|w&JE8Hz(c>xwF*esLw>>UsL){%=M66>TSZKs+V)XSYd`dPvi+%)%0{1<@axv
zPuu4)<!JNo8S5?Tt{q=d%W8PLNHMee(wo}8U2OBFMZNpKyy}0s^{IcC8{!_Xzs>2z
zzx6<a(g~IOuewEdNo@#yC$;JM#k0DTVsiD4>daiq_5B84;|^2rt)9JijrMNL+4?gj
z@!y4vYpY%Bw--)JNZ!5t>WTV!?`n#wZoOepnR0mF&nG4yBa_$aUku)SP%AP2gE(qY
ztm_fa6vfQIV8wxRD@=B3Wm#g5UP0y5(CF;j1|oIe*9&|(Xr`hhT_Wy$+--W^!q==)
z$J{jBHuejz?MqSFnH%=&etBPhq2B8mazc^6&RO2y`Kse?O#MH@KWf4OVr`Q}rc9p6
zBD~SR)nl4L%~|(*g4S1$-a2vg(#GqH!}Hm{{GR7K{ea$qtfN6Y+GE7Er=;;6IrZ6S
zakx(3=1WuA9?duzy0ACdN%L*X<fzE=+2^+8mgmKKY)v?{DRXh-_NK?~?L2|+oR+8Z
zF^B#44_PLi!X7KQH0Ipx;*~Np4l(>Y*V-z!?90z)18!@D%@dBbZZoV^Uf<*U^UL$E
z7IuHF>}==9)OFglWyi;_&faACO7ZsXS+971@y?t6<WN)@-|Om$*ToO^<tIJ~^-`Oj
z9{y&@^Na`gLzDhB{8X;1Ipe-#v)`Fiy?W;=r}q3025X)MpD<t!@)SSb*lHuaVOG_V
zKXQroYxXWqJ<a4J@X2qD7>7AS$l>q@)2z1c(FrQitaz1|`E#e(O8KiExA=Fxe%^M&
z-CK3Sl`OLmPMLHe<{*ykJ#+hn*Bb3~h&|Vm^Mi5or%1KDw)s!C@4PEuo^bk(Yc)sD
z{maGeMQO6R6Kf~roh)I@I{u`g(W|8EXvL%HdeZwoJFhyG6TR!y7BijcT&ulgcP(pu
z`b7RGi^79Mp0zIPS2QNgv{TAGl(cf`2Z;qGKf+g@s^FdPYAd>(U9~Es@8d+*f{4#?
zOMZEGikc~iB`sfhVk!3@VV&dQ?OzWjGqon)ca1xALn1ehi@8rB^pK;&+~<;p89#&j
zCZ3*W-FtHN>{D_}^VPq(dCXyZyXC=E73pxN8(ogi=5ww&I>qwr3Zt8s%Q|h`-*C>m
z9k+Vt!!^OYN0(i?tr%RN%Rg(|+|_yqFR+GQEvq?qp-Q6ct>c1a-79MuX74Z$5111Y
z#O!lgseR`DrO!{@NhrB;Xus@+-R)vKGpB0)Uvh2x{}+bcjcONfW&}rHI`%o}8Q=PI
zE_vpjhZju`(^|4hh~v$=_}epIWWL-s!|3$w^|~e>H^iJ-d(NBPaOqMmpL&DhfbW+w
zT<;!OtLMv9sC9Db^oA5|)tL2N7glDR-?MGbnNRUitNw4et1Z^UzprKPZfmtNQ?nxq
ztDh-b%}>&OGd)iA`s~FlA6Hal%<^_z?^5uCbHSPK_m|A_UtIQjV^(~NJ!+nmSZJ5M
zgOP!uhnayv7JIKRH$SB$wYWsDpt3aRVAdT2kv*@q<(?!+?@{CZl9b_bGf#SQ%I*oa
zTUwH)eEl4?R+rP$Z`QPb)hefNg?g-N)_J-2VozEP)Arf^_r<Q~w8uPNlr=&6no)>q
z&6JYs4<D_uP*vX`^2u{!ZTf>ZU+z}lDC00+!P?Fyzd^icgN1<yyHk`Z+ltp^CW{a4
zVl(qt$P;j`bzvLlx|202^Hd&JFOb@1yoTd$c1_G*v#`l;_Y0oAk<9lm`eWFcv#gKV
zriNrZuU=)?uyaS%lC1T`yKiy4oz}8JY}?UqztckX^}|oE&icDlCE>Vt-1)-n)})Z$
z&PSyVp~n~hUodCSA>T*;)Zg{+o$$P{KJx9B$^~5ln_jQnwrzn~T;Q);6V|8*M{fQ1
zN7T;c-I9|EQppQFpIJ-g<SO(S2VY-#Y~NYMNnyu68Ar@H998h;*^Y(oomywR4)fmJ
znDSnW&17yyiQ%bZyQclK4Y}*FWK&3Kd#(PYOU#QF|GDrd|5}ycA@1D*2^AhK^X@N-
zjY^e?<>L#wbzuEWv+{%2<t-~#pT6<ke4b6=l9Nl7KPF!KSuU?8l&({lG)KAT+Z+C6
z_by&flQaJE{r0I96*6nx)1FA8M)|hLjVq#57#JL9GBC(vkMe@-^yK`!w9ItSsv+C#
z;@fVM?tj(Z@GY)!O+d#RmFns>$$E9Ei@P5E$Wh&?>&n`EAm9iW%MJ#O&gEC@_t%}_
zNo!#AxaGGk>-7t*nJjF!wzjr^XU#j7{QmCj>HmvsrX5pSf8=AP(kH9fC5z@%oxc{i
zN94GF^W??H?{z2b)xEqr^{uUK<)^D3FHc_XzxVUf4|M{e6RSIS2u5y<J9s!wchS|0
z7Z>S-#YyOyeO)G!_+shm(!gtRQ=YrZUd@~sen&-blh2V7$E}`6ly0SzPC90~-E)yu
z*X9+gTrRuCJ`#JqA};M^%-ve%+I@}Q?w`s7SLS~$oBJ$0E~N6g&~XRbFHv{)?ONT)
z)o_~Mb<@csM;`z8|Ll4(>x}t5E{WKG#Zz)y_N<paW1cx}i@sWtZqb5*IbEx2^IKb5
z3|G89dQ0h4|Ci6z8{gVY7Y(;PZ}b1<mp6aDl>YeiCHKeU*`F`V$L|l;_4R4``ZYA>
zN%t48%kO`^VvVg>IV)HF?9t16#GWd3eVq}!XM-N=AKr!oN-Wzt*H1hrbno<scKP^!
zCEv9E{JeU*yu<CsUwz^CU%u}CoSvTEBKPm#&zrX|r=LF`_wnv^SG{wLGZs&-4B=$`
z6)mXPe(;I!m2!t&B84H{OP)tc)W%E+jGZzo#9)(^S8-s{bc_4K?|<K3vFFixixnz+
zj&V=@wN-DGK)t-|QttOQ7XM$*4u9DFK5p-ie_y`FFLRfxSy7y}BS7QaCEFzTlip80
zE-UQbd+(r^;IX@D=dK4vc3#?($`iQNDp#*i{(Rhj)0&^Jdd-<@>Q6Dw<nHD@b5iXa
z@4UzNizSw>5R8?m4xK)o<@K8{KdqSsw%dC@PqWVQSbgPpH^Z$%8T<CjzHIDYeuv54
ze38p5A4Y}ZswuHA_I;S_u6?n-d}10?`nLV9N~?DGybP;f>^sv}u(Vb&d1FTW8ne$T
zy4ozo)55m$GKmY>gnqx{wv+XAjrG@Ot`jByo;kgu#q)yy$(_62m~mcDtzusCCO@ic
zfBvOQ49n6u0|JA)_e?#O&JuF|`|i|`E|>T>5BpB%`OD6!+bnl^&#J{b+=*;#YSu9q
znYdJ=zXmW}>tU3fmLb{tQK@@fmD+o@7xHI~)pUvsnm0yjOqXctxUt^WAZ?4?j<5Uv
z%E-3n@B8n~ar&!n$Mx{{%X(vW7hFtfcgZ+={lJ-hH$qA`COv$(tBkARy`H|lV@F1h
zn@K?Y=3Vv+xn&>PoML$2X)bjnLip^@o7EP-8*XN=d2D!i(zCN~9!;u$9C7JrSy^1(
zktZ2C>Tlkz{{Qdgm$&bJ-l~tPx;`zN>&l^f*=%-F?R!0oS#<Xpta5r$9&+Zt+1CgB
zGy0R?|Hyt)9=0b#v+19=c9c@3&IZl3?H>ibbxm%62yFP_o9wk|)i1{@7rl3=Z4F)=
zHHFXPQr2A8+Y>@3?V2T8c;uFA*7FCJHeYvnL^Lzk7Ej!8gT1O=I(2Hpy`870vqkO`
zz8Q6*@j}L76aUu+GNDS*4-`DkNU<F{a=F9jK-U^&nF+d_S0?Cn`ej7=O6RgAFgI~!
zgx-2|VY`6EorC}1NUze~v2x!n-fOcfIlOlYF3T`h*c=;ECe3vCX3+Jkd{fTM6WI9F
zPC@q3y^CI}1bIKIe$I4$@cF^q2g^Se9&T)mTz%YZgU;FYhi|7czFMjF^1@X=b`R0#
zPP<EZ4_%SSl-ta?cu(Jh<3@rTYOWe&1X*u)d#rqRdLWb8hB=8RXJ5ObvHHltqU@@S
zrfbZ9o@zQgbJjUHNh2vRlxO<who9tkS8~fGXWUC)E8TBvP+J&TS=tz%=z5RiHgmDj
z!tXbG1d2a$-g}&{Yo&4QkA_o=vx!3EMYX0^+q_vzm#0U*a4cIUy#7>R#Ovq5(j~Q%
zPRwDOEzu(RFVlFT)D?Tt+{v4Ee@x@I+%qXokVlD6_~kaHT}3KO9@tIwDd@XmDp!!c
z@G(O}Yo?J@^VFQvzn7`jMNE(S*PE35^*}4<yGw7_-?If7^En=sa8I~&eEN^y!u!ni
zH?d5$$z1*M$mjgUr=l0jI-K4g$94X_`IA5Hw;t6ziS2%y8>l8Xq1gH38m1dOtS5Y<
za<uf>7_B(CcLiVOI>Ica)7`R1Oi-00o3Uv7w`;CbH$6Av@KF>z;P5xybJDZ$YZE#f
zmf0G~Z3q|K>Yl$e@jHirU}RHFAam^{t~06<>5G!pn=8&9HFBz&@*yLndb_58YMk58
zsSafmUtOw}n#1G7m=*BD;KRKXrerIH4VoV8m#2nZbyMgU$a4;uP;YQeBsk~dY;OHs
znwMM@uI|-+B$0gPxcq{iO?T5={J&=B6mESI+*8?LWi)Nm)^oXnU-&wBi=6+MC7sw1
zIqT}<-*)b*+9n(m^-hS17R}r8a^ifgjB6Q+ats~|WyLNp(g-wBh}~MK;9DYA@J*@h
z<YCUjnGY|Yi!mwO!*DCUv2e@EBPXseJn5jTRV*R%=T!Hfh`y<N8Dn(R4^FS=@_P`S
ze4p)V8eg(%{leZCD|(;4aDMXEk3Ykv%qWp1?9_rYr2;)u&+yqYIqbH*^;y;>`^oBy
z4JY`f@TVLWk`!3yYwrHyM&q6<hTTcbw$|^yFJ9TY=d+{~ixlg!qwD4?_GU?buI4#$
zb{)?-hNV;FI+8wI>yd6h(^#GG&e4!f{Mc4+mDQa>9DXqkEAA!cD8zrfE$961^QBII
z!AB47EWBmAf&Wgqrla__-$BC9&!#QdJ56=Pg;W1kY=d&{TvW~|H`(z!T#3{1R@Nd0
zrv<v~?5c9r>pyX|%=*4(#q{)5iV<QOM^-8A&YW%ggYitRJKII0V@Y@SSnMo0E%|+t
z(?i?KliChx{1D)HU%{MHtem!O_0<cTg?>A!NbV3$k{9I{WZibeD1B{w(#~UnZklU&
z*IqoKQduhAZ903FmdLe;mK`igE92Ciw{?D2K0G^m!>m_Jmy6!nDE3IC$V%ePA@)gT
z7fiP2FAbVg5#I34_RkOJpAXDSCLT1HePmnvQN8tBa%BW3+bv&FILowfX2z+E2W-pY
zTkcviiEhf5-8Nya@$>o53b%P4@!r9_y0JXns+#%0QkB2ERw!vNJJG?l%e5jQc?XC8
z@*}Z-ic>a=Iw@pNzO6B5?k2%yGS|FCA8db+?>ehrLgmDAxs&e|*t41ioigMcH##bt
zFWuLBK*6N0;?0I^O^%C<SA?I;s8E=-$t3S>{zLa$Yo5<8RkJgiQhR~#@R5|z*X@aB
zr!~BeuQ~dfcj9c<B;J4DC0cVk-{)>J=Ph@$;(a~O?fZYVPx&cI@_E1RxZD&yarQ}b
z?)-Yo)iu)%zb7_N&W%X?c0=jM%|t_%*E33Y@OVy1QuOL^J}9!xJabd0(aI?+BSn8a
zR!)zXPjNWa_$SRxrOxikgd_g@4PUmsG1DkFP-j0Z?Xcx#(@QI5^PpVIOgm}u)uuj|
zFFe-CoN#pE;|nS0CZ^sqTL1Z(|La9NR)0L`l^O73ezBHDImgY}dHe#~91o>BW)>d3
z7IZ@GlzT<9ytaMaa?PT?lM8#KHlCJIf1WNKw5#v%_Ugz9bGP10ndzz=w1j7|=dF*=
z7UY{Ln7mqg;}KIC!;!v_6758dEvsyn@I;(#JT91URKn`_v1qrc%yMmkt4$d1*Kc%)
z4A!wJY;R0wVEld{B*n>Z&+Swx{fh-Hr}-RaL{Ce0*vk2vN#}!UU+OJ|V-pzfM^xw^
zwdpOIQhK2M-l_t=EpbkhV>p;PjT^tLW^zAW?o@GlS6ukz^Y-)e*R4tje3X2(G<Hq%
zqCLO%M2T%zyu<lu^_TsZQocQTvU>f$zb_l?+}9az3F|*w`#@_}hFgkp)%sG?TlbZU
zR{X7h*HBUBXK1DGbugNJR^-jytiRv<mAp0az2S;SOG{lhzgc_0gvG6>A$ceJo?wUX
z96!vSvOYFlxAD@NEsrN~Z;-mP!Aw-mWny<ML$RE^aapX~ZOxsI8Ygpq$*y$x=5C+!
z_KQ5vp-F$)ZSN|7(mAFy@p#Jp`HA0s%8FL8i`w{T3w^h6pJY<|E2(|u(jC6X(~{1G
zIJF%)7oz{*xN_U3%?I9ZDn8HF@>RxYYqI;H6XAz@+t>fw^Zpof-M5&N>_?V;Z>y*<
z$hoL$k-_BC@$KD5{jWkTTSO(>_}6;OtP(q{`u4+=ROa%epgGKmzvU+PxnAf}E*0Bi
z+;MSDe)jQma~Wzg^&QK#{L`<$7d~R}W~Om#)3+DD&A8vDpZ(zTy6^OzEyCAiE*g7g
z%-x^7jP+sHbf>x7<Y%$X{W9hFz39{j&4Ml4n6-G9tj~0f+}JfsS@hVS$itOyG`C;a
zaLBEVD@SvU;p-_o9kxY@R#Y8eV>k0PzAwC9&oN;^S=7VKNm<NnBCnjH4?p;4%C$RW
z(W6O4{d>Q=b$?H=5}U1a@^6$b^Ohf(M*{b)ou09G;a*WohOH4i@*jQj9^I|FbS>;M
z--<l8)VmTo@@I}GpE+}&am}{Zx#s(FS0%Zozq!74LChg<!^bZc?UVU#(7iWiH{&H+
zfr>Y_rwzUMFSDNMn${a-{O*rY4BNS*SKr<}r)JInXvHe`I_(o&r;auyOQgr{%9!<r
ze~qr2scuBtwfTCQD@FCoPKbZmT%ham`%2uF9ZM`3T_q+<SDZI5S-I+_*Af*4=0#0M
z{U%tZUS21g-DuWuWQSMbr$)6aO>^XKe^d??e;POc3@1;;eeR8H3x$qeUlFu>&8tw>
zM?%ayg4T3NAKcV#q;NplSRwJvE~mQVd&C_)qn}J=>Hh7P@zZo}h0duxT*`f=yM)xz
zUbGZWPuvvQT+ZNRq@6cg%{FuGsZT4`#&Sh3E4lJ!N4@8^EtR>_&*R>1+Wv4=uG8zI
zId2Oh8$F*DDX-i$_up#sX=nDbl&j7Cn&G{051Z=YH`zNb8F;=n*~cbp;eMRe=5tiY
zYmGe3X~#7@xZh{L_xy0>czaj&C9aCE*`>T|)_)7;E?M_1P;>sw7wu}VlAbU0WBbB7
z>6y`uHNs~KH#2Xawd$@7$IShHCR@KXrLb+?8k?ST_QJj+Qa^tl`d`(i_O1TXeftad
zCI26_kH2jD|I)J0yA*D#Fck8-eb_bmXY=>{-~42z8D!so^(ciaS1<E*QSZ9KQpWwu
ze>vUGTKnTok~5dY0WGE|6PE+)d1b%sWSyt9$5Sy*;;rxpl^dRy-A(cr%Y>QV`TXJ8
z@<l?Mw7zuz^NI}DP@E99*QIfu-RGJg-z9C!CU(xb6~C>svD|vf3-4=Jt51r#dIjcg
zsycp5G<WKfo!4X2&8JMYe!a=C%{)cS*IeK2(&3Hl2VNw6n0T#m8S_E&<x>B9I4x%d
z-dV5ZWuX1iEmh^vqvgjXH~)SWAijK(`NW+|H~#Z!>|J3Q`r6v@U-T>w(_K9dYh5It
z-OO=3(Jiy?3Fj-_Cyr)5wo_APs+81byZ<~Q`|{e#LY1bD_2>Bt&hMX~#=Q5RIS>0q
zG1*IZ_A5)OG^$u-b#?Vysq;Kenj7S`m@yz*UwhuN?U4y$M`E`y6<+2r-&BzBX7TQ0
z3k<gv)K3n1{rQ2&7C|?asLI)sUh=%Hxc>ZpzG30@-M5?T86Mo-*LlaRq<Zz|b2na?
zZ0`LXaQW<6&HAI0PZiI3y+A=v^4|POKD{9fN7?<RK5{wA_wCHWd(+D6&P%#jUtK1%
zKq{**)P46EHmk!eJI~5WEoRI5YLUL|D*sZ&?YF<=uRE!(c~g07>s*yRocHHg9QFy>
zrm;%h)cW-b6-_6_Xn*NAp-EpRY}VQEq;&1h!s)?jXNz+Sukb%`ORB4=^R*UNP<MDT
zHF8VZX0~ZTIyNCv8o`(5^qqWWntxE`MW_!?!uzddmH*?OUU0eRJ7wvNTbqyR{9Kgz
z<nLkQo@=MSFWbB4UfPZZ`*2p{j-)Ba{PwG7?QXe~Ad;(crJ(wU7JFb;?jf6RE|Frr
zrT@=XIwb2Xx|S93WU+Ph<W)R#{TPm)k^bJKpzv{LZ1b5kmOj3>y?zhhzUq?-tarEF
zQ1N%yq|z5R7s{2{-ZI;Je-k_FEx{Vb4N2N2Ta0a{A7nqOF<mB&JGSP>q>fEn6Fl^z
z!#W<lv3~N#y8Yn-o0~2&&in7F?LXIjJBH0&`;*+qJ50yoGQ0V1tx(Xm%DdiI`d6Z7
z?_*caNk6t}tiLE#!T9-m&g3Pm|6bht<*1VRB)*J6P-~%82fM@dIk~ShPFeCk@Oh|^
zHcxxELzdpIKdXZ!9zNP-+<SIn{T#tl>HjKT9JICznlM}9d#*{u3?+}~)Gs*}57?Y$
zS-WWa?<&fAKSycG?HNX|tc?~(&98}Fb|B*Gw4GV29xZ<Gbgfp=yMtRUImykf4&HF0
zHeRON>bUdy2>yy4udfxI`?_+M<XZFBQU6bRt<L-(=u`XUY>iW_jK!u5^Rk1-Te+4k
zzNYHox=kXqWU<zPC%X?a+03dc4sdxDpy_VuQ=}1aN^R?g%kF`uSys+d`LkZzXxY`<
zzPiQ}<m&4eU;kT~A&ZMcGClH2*zsfuy<^o=)J(To&Te2x<*0oAsYOgeUn0)wafkM5
z4~JDOEN-1Aro=PKFH3k=^?s++nT$XC9zB>+8zrr6{?t4y#5w=po>TdkHk}A$`n$%<
zXN5~tm4!+F?EMZU3+}dleqw1?{y(8b>}>Mebu5q0Mom$^<2~tZRPa&u*IJ^jJGO@{
zUa#@ef9KX;cQyX79}Z_K-{+RqetOZ4X?-tivW_jgb5NG)EX$koyXKx23lma|H&R|Z
zg|XRetCiCozD;$ndV-#(eOk3^lHvN&o}TN%OE$<(J+sp^NAmi!-f!0o(tJ-TF>C2Z
z#Y&|<@l;UzvUzIjg{m$mzenrjRvtetuD<P`(@}=&zDJv-XVsl&l#l%O;8FL>rQSE9
z<pf$kXB01s>bB@LnjEo3*!N_gqJ%{E7d@7TkF7pxMbFf;;;`U35q2+1WXHVxrJSn|
z?@F+^Q1QctvG@4lBOPyb-?`6JTj%$=^HD07?}7dI7D=qRYUtQ0+w{fqU5o6=z4?ne
zMBR_?6LWpYelPP}5PPaoUaw%-o`)(viEL4F@(zdDL~<h^9b50YLT7?R!Zq#W10pv~
zQ^kI+;SA2yN|Tu5s?_setyjbDJnQC?6Y-ZdclU04rl#t|{&M#Lt!Uj#K3^U@aJ+uw
zjp*gsjni0rdY}FJ`-3H|LDpanlh4Z_#%Zg4Lzqr;NM^aMN!=E+vfReAI3l?FVo-OM
zho<ELPEAS1{-kDK)gK}S#t~NYb^4$7IV?G`;fBWKpZoS5%x3V7O`B-^jwR%2gmmOd
z(+MFuqEqWn{|*28U*@9A=LfI#t(?V^ed_Ovn5GK6S`i%e`KXtk?yULllWZqBO*nD=
z!i96!(yK%cOK*(6lf3ayg0N^;$4Lh1;<@GAX-XAa9%wHrnQT$BZlbYOU}XcF$t@#=
z<w<(((+nEopKj_~@kk*ogyr#$6MN$m4t3u?)x#$@qvHF~%air1e$0KgV&=4Kx0dc!
z$bR`>Vbz8$aaGrO*L?mPw8mKC_KD*!(qI06^>dk2tm}2AH|Kb+JnDTUkhZ1GRYWRA
z@wAQMlU?^y6;&5~sc@?~x*_0)O5a5%+4X_C4lcJ`8cL7#7o2wJRb11}SK;{6LhkC^
zn%0MnjseS<6;G!mosdYi3*s&oH<)F-zANYONuOhyN@h_zx|;qUuRiwVV7~v^6Fb;#
zP8l3~7Bg!a-|eJ@+uA*^@Ln;0<T531;u70W4`a6eI<t50U4b=+8dYLLrXKJN-dbQE
zkY;+&c9yi-jU~(1J&+4n^Qhp{j!7HeyUot6Zg{ye_`4y)*L6E&FU{Q2rSj@^b-<fn
zt8}`4H5{%t+!eejjdSU%&STFf&U||3fRH=4!5W8kg1W2vv?JGKuiI(xS?}Esfqp(7
zORr6A*OQ_X6Q^uDy5i&ouDFw5Sa*6Y-Nvw3(c9Ii@&1fYRa-;2D@AjkPV?pN@j2jj
zW!i(fu1_<BF6=%Tw$AWB^B&9i?1KG{C+jn!?@YP9b}`qS-{F#5_sBGgxyRc`G5<=I
z(7d5|kxhoXq{%{D{rF_FS<buxC6{LKsMKy>XnslW*xRfZdLdt3ZcVIt(Cj;}LDTdO
zPu{AV+ix<>pR{q`H{ChS*#hbzHm=J5XBJ=F8nXNiPiD#A3;UM;I=tJQKdgL`XQ$4j
z_}mKxq6!SFxF@{*{(aNM!-t#i&wHS8zwh0fxydypcM58oz0R+k$R=sJXkN~PeU=sl
z#!oih(f`pDz??kun{kGsZP1+$Cw?wj6XoK4RAF(C*S9sDoy&i2|NkUdUfinv*b#}S
z$ytYdRz6aj-y5{N<I}n-9jh-bmwWSgcTAS+5&biNk!RPx%fUWf_jC_kT|U=>*Wp~@
zeYf2@YfJT+7d-g<j4hGxz2Uuv=WHyex?OHmdarv~I4Q4R%8cvAa<#bWS-ZAO%&vI$
z!>2ZfyUF+Lvn8cjdspk8T+I7YW4FKJk!0p2_dVAySj-@_Xvg6XKRT+5Iyf@6?>d&O
zv8nayg6zKCraO<VmvvipYDex`YsQeH%X(a;ox)FKG?gA~(3HIT(a7X%(RYcEiNUG$
z3AyE5|Ae%jaJ3#VR*n^~TQcomh0QxPOV7hAoFglhx9pMJcg=Q{Lb|VQbLZJpxi4(r
zT|Y2A`A<x2aYwe-l%-)o^IomHCb%hgewc)v@+Y_Fex46}mm18_vQi8$=<v8_zvT;C
zUCkt$vq9|tdBf$_y^Z7*viYH~qFe7%!l%30n@sqwHNW=pp1$^izw&k_iw}%jTVfg;
z-tGFBqCV>bo3?J$!!RM{Gq0`6F0(irTnlJ8Y!-E5#(7;espo}_>JsVymc_~ZzbXIN
z&CM~cul08v8&_S<?S*Rv`pYAPk6o6?pYl5WL5@+9R6vZ|+HE)g9$vq5JyXn_wOWUR
zFJ-@9nQl<SC6%G&-CEP)Fd_N%iROEXckOQ+p2+YdP|Z~D_SNY#tWx?auQ-YJ740^W
zb%{{ozc5YO!YX%7dcwlF&x)5PzgQoAYiaV#_Y9ZR9+!4EnCI>}>&JJj@?rBsd*;vk
znty*dkt4BQQ>n;bEP1)6WudP~3cHp5*@lyQKQ0h9U<)o|`1A6uBtui1AA{D4P0S}|
zcI~}$n!WAi)(`bz8|PL_K7DD|@cZ@-wUtkde{4ysTK%nRH>>Umf#>SwiGRcPpL`f+
z`$;jQ#Qd?nK)=KO=ZOsR4YyrZw@p9Qt+pyvS2F(T)+~p|g{z-29}_Co5M<_@!(+5b
z>vO=j^Y4y$|5>9|vMnSra_i>e`cLhj7|&m?{_g)l`p4VG?@sULhs?V_c^T8UhOXTg
z{JgZhLz50YUjMJK?EjaC;q&{qPnCPr>pg$fm2b>@{xb<?q_VNZu72dR{A0=F@)d7p
z?LO3RSpCg!sx@b5t;J*G;(PMf3fG!f&bT?-bz*6uxxkyRp=`elbi{ugwSJp2|NP<~
zQBOEm2F@$p`?c-aTMg-e`G=K{_|Hh1G-Zvfn|mkkoGPu@9UJ*CcMEHM<WMLzJ+7!V
zv%mSON8+l)l<MO7J}dfieLnx;ds$__PUECG_m#NE4yJSU5|}^7{#kB!<m--x{?otP
z&%c+idc*cBF<(e?^7R)Y{90*^kD4BODv3SVu*UV>y$!zn*Xs8?7r1!%`G2-8zs(o_
z?|-n*-{acm{$(%UI~_OnJziJOz2XqRhyG;MX9k8ldc7Vkj6eK1@t_B9_3hM4OOu4m
zG#xf<aF8wCyXsqek+j(qU8$2?>~UKo1zxW0{g)=ZVDt6+tvB!e{-2Sl5F9VDIq#MC
z@6GYQ7@QA(X`J__aqbPdu=7l^TteBCGQWxCp5frW@~cJ5;MoJQlYEmqvsQhH@Ybt7
z(e$>9_wB8|mtXQE8rhQ;T1l3#**W(rr|PEWS@G8&F1Z);-n!6Fq&04Fm-&?se_|d#
z@GH1Hd+yoxZxby)E6*+U*2_8{d*~R~e76J3<_9KwUtxGW=brMP_GvTUPWv~DE$jL2
za`EOQxq}Wn4j*H_@Z)jq=H(ZUrAcU;dzkOsC7U>7q3il(EH_$NQxER;<37uJXTxE4
zx4I9Eg`MJ)ysK+O&xwYu`P=(<p2u}NhWyJ9?%q85@9Bb+%;x+v+k?!u`p&ugV)r`p
zLbgY2-kg0e_MG9-eqJv)=f|<xDpC5cu3Vozz3t~M|7OLndv$np`#OL2>A(IPm#iLR
zYG_x@diJqVsKetwSErkuQ|nP<dAK@!+RE+SeRun3yl49JKv42V?awXZ)}a<#x^K1k
z%Rj94N{`$!OMPOwIqPwu&-bSqowwZ>bv?SW>&SB9dZWrsD}TIuBOZG3{oUnLJm=4F
zH&d09o%o*V3Hx8Uq|-P2x9^;{TK!=C7r&`IEWAb&e+or!-7w+GW_Rm*cYmBnc_zm9
zo8fPU!|sA#lU7GP%;z%?-&|dD^yZYTxQD0B<jTHW(P>v_Ke*|B!p-u#QvRR$JilfI
z?dJ{Ho4E1$Cf;>_7X`ESx^9&0esw<ib(ZUtJHd<9wgpB!+HmE+cls&O)om+3ev0L4
zExi|eH^X+PLdadVz3rOYCtv;Q_j}>?O|#hD&ZM{9J8}Da&u85OZ;xpU=otK6>m}PR
zw1uBl^YDuqF%P2GZ+6OxpR?u6k-w9fxH{MTEYc`tx=^?DY(k)=WsO6?qsx4=v%HcH
z7U#*7JmTq#d{xlAs@`BJ6UW{KZw#hoZ3}l<BYHGzuCYm8Aa8QH$KivE-^QLXQ+T~%
zTGQpNIgHkEN#aqaF-a#DRdc*BaLd@_{KRO=dll;zPK{Y_o9tBmO#PiN%(L6C-Ft4T
zCA0dzW=+cz1^tOH&qZJU6?bc?O6H||>&-emmz`u#t=u2K_fI3wwDea?)<_y8IK=jc
ze@&KZo4?3fc;3qguUa-nUf#MX+xq?C*Si$?PA0E^Ss8ZZy06)*)}KtN=NEFS$A!;7
zxOLja)oV?68&|%W$3LARIq_4)#+6rJ3iaGrDZVFpZ*gJzoc5V7n%4ZtI@fVdcH!}U
zYh%gltPE{TyO^?4er!$W3+7ejT(4hwU&PjSGQ;D{=Qg{moqlJ>?0fKM!j6cu2VHWP
z`HP*qm9*=`-ka&SCGR;u*%92cL3>h@uH=%1<~9o~JkJX)zZSJ-k$m=-oz4kgJq&+e
z4b(mD;5@Br$=;IK?wh<9g2eCcYBpkQyu;-F*5RqGq((;jDW}7GZn+(GIv7@AyC}(_
zZHIfN$z|Kd`$=CK;(Rt=TCzClPWU?S%Wl8#xUD|Mzu&}v;r_t&hgzSua^0}8(ePhj
zF8a0LA?vRr8z)_7+p_AwjjqsF#U{%hUyso{vFcsd@jEZS_UJHe*rhHiyN<U(rILqd
z7IT@}rbb8EtCyDaPpX{m7_(-3n=0ewr8!R7GhewgC73_heetA=smW6Fu(k6n`{sX;
znwKFLk}3DAS4E6tcFeBqaOK$l8;#9$*XdU`Twb=n%4h$PyEmiun{B^avqAW$p2pXn
zrN(-`t2`YO{Q`y7o%kByv?MFjzVzli)xDh$y;fYg8DJ$LuhZStqWK~@Jc-G?cxLA}
zj!<vA#xvWZGum&RIlp&3yJ@alQ|5!3S(8(~TshpqcB1F!Gq1l4$9J!D4LzLSm1%pT
zC`Ff#XAM_R8K-E~{XO4qImhf*{&AFVYo%2D{PfqhJ1*Phc;%n<JFz0e=ys~!?zxZi
zqB(u#rfv4<s;O0y{qy*YmW$Z}Es1p@K{G3>lB-ugTYh}kGmoj~HeIuADl%QX;osy3
z-pfPxDmU(8_s=y9sEJHhH!`$WX)k@anu+J0vfrhuBb#PAS|xp~VhY(%n{r`Ks?h7t
zQ(q;V31sJb_TFlTk2K$^xthi@8&}FE$oNM%wSNEc!KW+e_k&ut*EcGr>powbWN*~G
zHFbf6+RR)dNpqitOBk&7Hct&!Tl=BHwx>lUFq&blLADhC<#XEKZySGQ&?yc~t>^PN
z;4F0HsZ!hVKXUooTl<w3w@%4_H~B4NztEmehSM5*@BImG?-#Y$l%#9;KPBXb{F>^;
zZ??<q7rAZok6(VR*ZLQXNh<qZUv1P7HIlwRQz_qOeUV}nAE&u`)767-vy`rOCMI82
zyjy$zpGT@~pxgFSss?;_{iHm1=!dlH%-+Jk;~lrR-w7Y?#jUPs$9LCyPueQ8`M@vh
z#miQm-|peQ)BdU5^Gh;8j_x69VKJ|q8HKwYZ^RU4`l$xKevx&I`|ylse?yy+;~xcQ
z&Ww9-Sn9aVjg-v!^_llf*>ty?i%OrrBEH(CE>yHo>guA`B|$Q+POfvsf3vL3(q(hV
z*thbBg8s3Dh6d5S8O*ECCFo8%R2O=oWmU(cOh?)9UY-o!tgZetZRhf&-`9Eh!=`Iu
zwa_Q|12S`#M@Ho@kJ!>&a7fB#QQj-RhtX=aI;$IJY;4YT$i5T4WJQM%k49jmv9DG{
z5aaX~f3CXt@Q~oU9%s6nzUDhHCnfA?JaaI|dn$LT={%SD4|DF_Nu9c+u<Gd9uggl-
zoT=RO_x8GPo8HH7Irv~+mlnsfZ;PbDqmI_L<>qY{+A4J7Px{<fS%KEwQnf-C(!bo<
zb7IoOozo2~uAQ&w|JtXb_fl$xX2#1q8dH8Kekr@~$Dm5y>vP`4&GWAFoMzj+EJ<!}
zZ)#)f8$sJ0H%-&j+WsFl`_i4tSfu;o-SP70v5Z$V1uoybab(jC;rC4c7Wvpa#Y?U}
zxioOvKm9y;Mz`0R`_<XPxc;a<-x2zx-(7uohB$+a{9k$0Wl4Fz65FRpGca(b;anYB
zP+5|Z4?4-{Ea)U7@R}sGPoa!of;Qx&Z|;0Ir7QPj=QaJQs?P&s#CRq-3kh;2d=xl)
z`Q`rj^7G8L3?5$F^h?)VYChoO@9)2VdAeLj_vgv?`Qwf!&lLIeAV+Dk(Y#|u_Cn`3
zW!Ow-_isA9m;I6JthJvj%=C{=K79Os_vxJ?`6(0Cl9bjzRXRKEg8vkwsCRFDKbL48
zDu|jIs&_cx$Z4Ik-h!&0QEsVo)Q;YpS7*kyqV}WuftTG|UUVnLP5rn?zbG?m%4;3J
zG$pMgOWR~58kW!ZIw1LAuc!J|r*Eyls;Bt`-@RlOtF)@S;!4#%kMw7evjp>=U2S)I
zrk~nUT;ZPYvpY~!Uv1gd&`IkiZJ42d*|TD6*C$DzN3Nk$UVakVcjD6DvS~g~mhY?R
z6FBpGeyY;v6;mc(FJz3@Keb2d@q)?STTUGpdT`L@a|Vy@z21LQ9t+KjIisAhU|IHs
zStop$ex%5FTeok|{Asjy(#g)s?eDU9<GmWPtr)`;_wXg3=BhR9o$RU6c&}1O_t43*
zf}6YMFehgeoL{UYH~;eDVBQBd{^^xl-f&+vnseyQB^e3DkhfVS3pdYAnB(wXhdrj4
zIa=#f%g#ULqRg&WgcxFG>OU6JI2N$=^yH_8dwSM4`Wy&-{&4s6|8FFk{?FIiH9PR|
zF`GJ1ap9Te2N|ACRXlOw2Uq0{JufBwhpzE+=FFSF&(^Z`_oMy~SM$Yd3;+H5^61Oo
z^~)dr+<ZFzfuPP8{qy(c&uhuQH#ecXPtnamf%(RL;SZjdK5q#y_PrFIcCJm~*}-lT
z&BYQH{DzL5FN2?Neqt4MWODk?HBOCfZ5FMbGnTrpuv+!LZ5qqEck7-$T^sZD=Kr)a
zo-r<qThE+d)~5g4V8Pt3NALE|o4Isir14(!1-%T9#XpObTxDArI_Z~J)Uh*HghXS~
zEp&c}-4s&c7hCa>Z_1UB7`Ey4bLO|{*ICwneD&t-d3O`vrnMr%oUEFP)+|9KMMC}F
zEOGm;uh|*?eakI(&JU~_t|#y9;%X~l-QX4Cw#Rq+7GuqHUF#!lg0;@4*Twl{YhK;5
za(xn?Tj7*IXZG;Qg)E=muMd-MP@2#FW3^)U7OU%mD>Q!j^RCUXjdNi=@%@*M=BbR0
z6<a^OJ@ut8MEFn2fhF!6&UKY8I+`$LS@*))*pS7ZJjXU@6#v!<6F6)%%hGn?*$MrB
zg|;k{oBKv?!G#5E?ngR~PjujU^H^1I*@4CjPAeSC6wVi9NO(FNTxx#&z?rEV-!3q;
z<^AouMb2~Sn!u<dh7Ud{Hl{V7{d7e<Zn@+KhG%iP_Keqhmm7RsaGGhVX~rCl?!D31
zbXIKQJkfjK?0_xb8-|6d7lYakxL^Ju+_Yr9tLf48+pDXicH33||IFHByF=)*iFo*i
z6TEM=9b{uzZ%B${cfQ~5d@NH^?#+yC`)?Y|GOc9D3*%YC*XFgy!DGLhrQ!S@HKn;t
z?n@&KCA}Zb+$V9eFr?A7LyTeDtg{O{+eD1*Tso4!ymgQYzaa64w_>YWzR!^b+Z!4_
zmgp|pbmnnjXj7Nws*f_QqLS;@JGz}@kueSU#Q7lHOXP$`JhwqUlgup3jJ_g1jYIWS
zCJS547yPT7+OpWxLhhwexA>8xX?+JuG?tzysGW7Apd+Sm^$Mej!GSKGG3)+1=`DL;
zvWTg4$${iqR}b&YD6W3=z`dy~MN)1<`*c^<XBXeIN@c8{_E~e=irJHU4oq-lD{(np
zvSwe~3!_wn)cFC7ZWnm>#JR^Wc<^oCD#!5qY-gLCraAPkh??TU6)@v+$%EL_GOYKc
zn*{sBTHk#9`6%n){8>|Y8m$92>#ut<>x-hG$iJd0J&q|e=Nvk|!n-E8;xOYEc|JLL
zUdy?Gi>{nFw`MELnZ-Ol(Tr<YW4w+rYBFw<y{XCaPv_$6lB!!PR~5ds{*bTb`729C
zbm@D>fAi**G)xKLYqkG6C12_e!?x`!x~ur&1ti47D^?vi;>uw(qxn5&p79Dj-b)T9
zPbQq)dcD|D;87qCQ_h_E4NYq<`zP;Y)Sq<7EQQf3PDfk!#;3~_fuavSna%JL?o``+
z-6)^q*$&@X=PC<sS^Vv96%S2)Wt#Dnhf#*xprfHDyK90Re=CceSlmXoz1zQh+t$0}
zwv4G-=1e12v&R2T_LnURRn$%;Z`pfd?!2()hxfgWJkQ6n*;Z@e%}1<{Ui7`ZQ-0L?
z1n(=6<jf1-447I@ti0iV<M$%31isdY<)Ulrd%7g=*IbS$H)0pK|ML2SS*HV6bhK}K
zn8;*U`%i$E`9sePZxe$osi?N2Mp2JHthVt@o4w*}8vlmlnMS?oeL^>~wbgXjCQLnV
zzsH_+Gj~DGgol&!SPH*R-D*5hq$923<HMgPZ~hKrf9)|r_u{EfH<+th)}OyOC$_1w
zzO3%rt7Cin!s06gm|gq!9zS^bfq>)OIs0n9J^cD~^Yiuo<w}o)P1<%nRw*dI_@2*%
zefAxVwLTsz+YN7QGPq(DyYa$BHTE_7GnVtNji@<b8e(qc_&kEoW0`D&n1lG~OP9Bl
zrFy=}+P3mB=YtCpKX{lgCCq6G=GrL0R_DqY?_oTViThyw=Uj#t(w1pe(kFBj(>k~x
zoBmwIyS9MeN587>bm_KlS<@vZZhXbKAzPDY`^ut!Io5Bv&7=(9aY@VGT0d*9XG2c4
zu3xX3f~x7%kI|3!e)4n5n=$*=#eicBfw5I@8{ctzlx8wq()0F>e|%_*V7qD5waeG}
zXYo4TPTSD8ZSKE&aUD;zSaM2^t%_s$cjI!^tL1J&N1rRQn-&zSh85oyaa@sPxj3+)
zbHm+@mpH=y@9#03zSFq#hh?R+*rD$-bFP|fOZ+pT)wA~E+K&%*t`7Mv(4liFG(uHm
znQZ*Cso&h{vsCMvmbPqE-*;VVPx{rU&!H=RYn*Kkb~yfZ(<!kaR(`9ryrp_=FOIDX
zX%B1hsat#ea7x<UgPWq;#YC;7B6(N7WL$BadGW9IjHrt_i{IUU!fGO1uy6bNUGFC^
z-hRIA-u<_a7e2pIvZ9`OwXEtB(<enU;}&P9<_I6D68JCqxUb^U3hjHWE_{0%gVrPo
zl%3CRuy1~MV9kyCroY}_?uRo>$Wd!*Iv%%Dg87hP!^erfuacQ%`2Ghz{4RL>x}JYX
zP();cLEJI#mtTU;I?gIxrr>RyU0=-<vgi07k3Tb7AHB9JVKVuq)-(O)q2&iwt#5yI
z^?_H?rl{4%iv!HPo^T0YUU78omDwR>Aq~$O4;)E}u$}iZ*?acdhpY@93l_hB{6AyQ
z2YrJjvJ88#-nw;gF|XyfIRBk0ee&zu8lGkwuaS%m>`=Wq)j><@?wxP5lp5do*EVZD
ztN&Yl-2PUx;MWN(lNXrIiE(aeXgc2M|9F@0E16P;kXemRjR($V9GtM+CrT@Dqy0H!
zxn=`{8V2iJi(hL`ZneLc_(8U6V(noqW!Y<oE+wli=bm0=u)ln{BgdB=r-}nK6DRqp
zJdSu*cqMH{H(z<%Ok>wsbNBw9wQjbN^IAnI#|rUR_Z=LbO}v%y)vjpizTlAC|EAww
znS7!^FZa8^BAJR9tM{ix=J4OU^}gZK^`eFQznS%UMYiq;Ic@Tl&+pvzJFn#K=Qw=a
zw(v`U&9Q~&cDxI7UX|J2u~OXa#4f|PrK_TOi#(#vFuZawI{mJ3S>B!26?I=DS4eFT
zi~O6gK5_j$)koVcW-igbqs7d<lwELx(W56{v#%`c+Bu(X^3g@>MU`xS$j)csvk~Yn
zSh;QQ8XvwrDu*`A`MD`dW}DZ1wqPEKGm5`XYPaT1*HY`_(bTT-Ir)&GzEm@4d#S_i
zqfZ>7KeWg^m6EtS)A`1XZc`Dd2Wr`k^Q)tK7M&{i%<(<t=dS|iOHwDIgrAz^Dmg8`
zxX|*;tTmr*$EZ1_7pXI~P2E{h{PA`7K0nrqR*U+N8quqdcpA9pNgP)$_<BI1q0ey6
zmuENa@9*WmH)n6_{fI{o`k4Mq$nx`9m%zexG0eim&wTx)mTk)>+AYp%n^~{9?y-l<
z0YA$;J-ZX1GPd;y1gEG7%npoy^WI$8>j9gmm$)e7t{JB_0`oL4Xq`8_%3>ih!~0a`
z<^DTPkFILkXihP8HTftxA?XrB|1yKQLEOjXG#3^~Wlwr`bT03tw+}hogZC^-c{_Vr
z%C4jb9$pN3-LE&g|C?Uf&$2auc~hZ6;#?)RFAF2)YW{bqzPV5Q!MaJ;RkNRnW<2D|
zeCxy&y)?0A6JP(meU~TRdcFC%`>N}_y_M2_6QcLTE>Mh`{y^cL@D8TCnzAe}&i%Tx
z?cJo45$FGK+wk94=8#oUyB>M)eVFyRl&s48I}P40yp?#X_SlQKg?vSlzXLB{i7@`X
z<XwuC^~3heeyMeNzZ`VBOFtgjyv+BE<Du{T$6mcYc=`Rbj9cF_Hy6q|9$Cq>^CQ#c
zGdyQbZ@zzjj+~<k_Z@zwEwg4D=uduJA=O{n&r*D6hqg*(61Pm@hnche=6<$4v2v==
z>f>johTeH`xre{~Q9hfLZH3L7ttSte*G<&Y;VYXpLncmGG+p}eml>*|5o@L|E)k4#
zzG2qI*lGH0tKHlEQQfbsf9joymzrs`PyW?Hjp=s&TN+dTR{SyfaWMPUlDR7qz9l#I
z9kH3m5M8lWrp{Yv<s8+J&EKOZb|`H+d2Gj3McZxOmFCBz)SF(JxvN$7i{>R5|9JfE
z-_mJ1c5G?l%6C-R)-E*NHNU#~aI<{df36qj&p!S)IeM9c+JQBvGZ@R3$ehoW+Qyt=
zuvUya>*?m{el5*rw;HeCxb^Csq;K!}=D1$Yo}{a<Jl@>ja53*YbNS~y<=++?yS~T!
zH>;n$dph>Up0s^o+}iA#4`<6<(rFjC8zOXI#@_RXzPa<K>^jLD&-mNO_o&Uhv(YbR
zZ#?2#eC4*>_7s`7CI=ZC6D3w0&{|V<>-3BBCd*?=UvB^1{4dG(aY}Ts`{vA#U-|6s
z%E;RNELmMAf9N>3$o^j@Me&YLH|<pXzqsY%lE}zfG0wQT4Xdsn>@AO)<+7h^Ba=c%
z;Dn|ZpG|Bwwylk2wRqbUwzSP@ihby>3&s^jO&fT`-49s_XRzGO;1Z3o?Kr%`YVx(Y
z|E?}+H_Pk0Am;KihsQO3Z=V|T`H%yXx|Tgzl556xSTK2QNT9ZIY~kzt;@Q7yEPv&g
z%w09hJK*)IMa!=%+*($YIQgdG&2_!XpATmJx%uc$dgP`qeQqgcu^pzF|ATjXZLR*E
z?%libhkW7VlTSIOIWKpp&k8$SrY@Q7@#4EYTYdP<gN<y<RDY{SKiXZ%oz8uy{p_a4
z=Wi@dWO#jd<}|5{H>WRz^`vW=*=}QfZ20uS%D2;_Y&V=0-)knUbJpPLl3>@!2fN;7
z72Hp}WwrlR*K)Qur&Q<haXdKw{Kl87$sc;urp+yUzhg(&L0fk3Wr9UguhMUv<GC8!
zb$Q*5{fp1!-2SrDdELI14yLg@nkRpToI4ReaaTTPYH|A2cgGu!R7aNwS%0^Dn=toM
zQiFJw^3>EDzJXlTLHTvJ($^Z*{cgM3yg}+wSzyOn152KL)=Pwh-|P+6n%!}I(anm@
zx%Wd(uUz>&H@L(?=G~p*4NYfHt?x~EJV|zE*PNM?(s~~^wCiTv39#SzcAKPkPth#C
z%*Foh3mAmUIbTcohI`ED3kfrMvT#Oa(CnPhwzSi7S#JaLdGqcYExB~_+OmSvLR(wr
zeBRac<XxHB?bW7yi4Py8ge6QcVYL!d+x2#5_wfrQ@fO*9A7{9za~?A5$m*XcCy{-=
z@8NQN8J@rkeS6Qz8aQm2U}=&2qF6RM==1V<g`V&8pZs{2yI(9+ZILzWij8?b4YRbX
z;+d~cVpf0m$4K!<*O@bwAL?Ra+?nUzEy<OT4G%b4{U(7`u!S$_<)X*jk7Ad<Xxe3U
z$HjeqpSifwPHBe-%>tc0vvXu$9oxRuDr2?}dxiVXD`^i_eay8syfkmYdl9dP6Sgf{
z@LnwNA;-77Y@CM6_m&y{RPss-HJPk-EG6b%&DW=OF^g^XJkzs1#P<81>iy3v0<@f_
zzP_7(X<M;v<mU``!Hd^kZtWAkkjOFDtw%U)V|jn)tfrb^^=WCUmFCP#W!k>a*~R)i
zYqPb_-uH8uR*2W^ex7%G;~uHLr4<!imt|ZZYo95Wc=9p$+3Rx)b}V~vz-i_7w2)oV
zdnUcUY~%kqjB}c7ZuQHlQm0JzMMu3jwx~FJfqPTbN?Ws<<RIJfXZgY5zi!&(G480z
zllwpa^Df<<z3TgS3;)-$x$nsJ@5lN_wLiY8uF2=LGHCc$U$Fn+vZH_462lp`-CAX3
znbhnOo8mfYiI`Wq%d3Kn)1S<*+)WGpesr0SyzFD;4}W{&9`h`?b^U|1>hfoM?%%vU
z{e6Swt8AW#H~hu_zgf?!ew(?o^?P*I55d~<kGzk>+|qaM>(kAOR9$p6{j=0@hp(Ep
z%eO0a*{-X6ykWX~r;}Yn`I22*<E~6R@>VT<v&8eluvJ0Avo^)WOP`!mH|g;zmuGt>
z99Yu5L*c?34?eC2AGO%Z_`hAn407UYmkNf6<@xLFtCN-KW|0yt_&VeGqX&h{#SR{>
zTf^R&wdtF+f72E|iM$mt8S|7?Ze)oTq&YD9u1)ayZLZia5XmO}C$-C0R54PhQmd;n
zN_WGt=52c>?&anZzrZz9q?}p1He!QT%0h3?E&KWMbl)vn8lvZ4weo=O3n#B79A>_s
zE5w*(Te#*O<?7${EK}_4iqoYsrfyj(AvLSC^IYr{;$lN)vt3Zq=hmtGSZki~!dz)e
zT)$Di-84Vn5Ptm=*H-n+)Hqc1D5AmX`J|gcELr!r#?E<nX*<uQRVuajA{Q?TJ9$NZ
z!?j+6R{orGwE@Xz^lmJZc#)9aV7yeZx@YCeuAP>gf3_yGO>SsUFQ4b-zTNuF$+ugD
zYftNl?0*~8?Kee3`@i_P<zm^T=bL^tdznn1^?asCcIn24Eveh3mPB<F_RYTK74hN4
z=0+ErJoW{THi)RbxXpH<!j#F7!E)}dl$mU+ZP>goHyZvC_dO)YQN?#^>KP_cb(UL2
z6}lo)mqerOuN!uS`ECoFCVKz)-*?pvQ(BI%o#KDT=Iq_VB9k=sndWkDv#(3*E>@X$
zYS9ucy}3$zFFt<z`s26u?d(;Pii95U`o0Y^WL7_NeVyTxkjwY<FP;04UA|R#*P6bf
zJ12K+w4G7LuGjze;pTN-d(L@E?o=wh^eX7{Q}K;^B?VOzShdwA7g}{rzPT}c>gDG5
z);sUiaGdnqdZvawU!h$3?nfcn*%GHCrkyCR7iL!TUuMsmu&+?3>TsFt%t>NtPYV4m
z{R&GwI9FTV?QQbh!y39Oxq7RP6dIe>PfzB#ZI^b?&|Et8xOrTz+ri~qy#0mp-mI-!
zn43R4ZbL=d->Xx$$1h=U%<J5`>!FSB`Yrx;Rzd0StZY66Uic7wRd90WeZPHD$FHqe
z%$^iCEwb>-i;G!XFI~@N&9tjFnRvb5Xr}0o*AG6t<o{o>L`l`=uzdei?RUS<t+wD4
zWmwg`VAfU>b>o2LY0~8fEGi?vs8{M=-x;`IzQ$3nt&MBDjCX&Wc|t9wR61tEtmBU@
z4`qqT*b4lrQm<9)z7|%?EIg6nIrDqZjinQ<kB5ET5&Zr^n}7C)yB8;@_Dt2_6;Myg
zn{of3#J{`OpIw?){@;I3o{nbi?}irF`K|2}E`Oglf3K}&HGj&@^;^?BoGcix{8oCB
zy6O3foI^^pyhOCaN*#}0&)m1{x73E@hTHZttEYDc1_`}?u32+?WwoQs)U?~TTJKby
zns9mRv+ZF%$G5Y6*{XalR=Ffq;>7b=e<Wg0T~E5WOTxjG{m7=?6D8WG&HA^!+<f5f
z_HPk(X}cF$tz7!`mD!;wr**b4n>6cdWiv@Lp5vUq-TLXh+6kox8|n^P2d5o373<YX
ztp3ns(sl2-`u`*6O0RbcF7}$U_kwQJvdtf6HQt=H>kvPC8uy&2Xp?f48Qqc2H}|mF
zb6W_lwt6ZeGy9TER(;dO87ph$nzu==d^3ILjHQg~z8ap>!UU3EeSYm4uaoj}<<4^-
zF7;{&*C+8lk?OC%{E|6v_6;@%JF&ZBrLsr4PaS-CDbdhO_I`us(H|GCxvo-Ny@*p^
z@BIl;zPB%(*6_8~-;UdUUbuPNv!6YocU9S@{oZvt=GFCQTv}H`Vz(N2v6dM)lyBY7
zv|T4Hr6w<A|F?5ZvozY2D*9U^j<L$cxY|Z8TB~!*&uaCfpK~4ui>?1H6TRTj^3W-d
zZ!VHzGKjHKJ6gX+PxMxS($;Nq(s`3Et1B=)ovJOK9(?m&o3-SvPWNrk8~o12o@(2*
z;D*_nYsbaXZ_Un*ntuA*EABLnEALy9pS}3{Rc_bIB)`S87cI=MKj2fS&Qm*g!SzDc
z75h83{=R=WxXR(@%c$x%X$uZc=>7El_&bedPn0HHfB8tNfA)3ZN20#>uibqmQ`<cy
z`fpR($w}4j54S}ediMSHbmOYqw(PNom%l4MDxz|KYsVCscdy-kJH<|G%{-<TcG&dS
zy>}@By!%#cnRujgzHIq~)J>`UH!m>mF`W19F!%foLcbK{HfTQ!oOkfE&B5mEirLI(
z)+}n#oOi7AV1hx!W)XGX;yDlJ@;FVEd8vJ^rsvOPQ5&}~ryJZe&m8cxITlf?WtSEF
zapJ*dy<Z<M_cz_C+qFu-M|_6X&I3&cmmH{G#oVZ#yH(jqGRE|Ugm5O$f}XAl$LWzZ
zSI+G!|8PaR?#<<ZuZthZf7mdOBjUtX+tMQkX72ibC5qAIap|0p`5$sFPkMKJ*=i%D
z#j7Uf+*)^>lliNBgp5aqK%!=*Y-ea6W4fRAM7^aunk27zK2a&oW86A@^T$7jn3~RO
zUG~(=b(=f8xH<k_Y>ZKIm&S%8zR8n|3M`)JWUV!f(!9J$Z_DQ$lB(v`%Jzxh-BOxF
zS215+C%5_GT~*0kGyjdYQw^>vw#k)-tLD#@D0bLvdBHXy!M@LjRsY27_j_yIL-*}#
z)OX9iy&&?@?b{)@cVAp!$hmc&kNZ49eu)z6^L_o>6c=1<mosxoeD&?**+%!ZGpzKM
zm0Xbdkmvk*^7UXB&WqPGt}K^kyJljTcBGVJciw^0&AqpHcR8P)R=r$rM<R#mrjr$m
z^p^Jgd*<enx<@I~dCfjmp_P*h=k~H`tu^>s68Dhp*#4)ki)-Q<9~lR|x-Zjxn0Mby
zZ|%tso7R8-_+ie}!h|c`L1$j+mQ9*`I{xtWmpN{(l3VnAq-J_QUvn*O6?2X8hW7Ha
zH<G<H4r=8dwEi3`buaXERX%(7f)dl4Yg+rxJ>bpQwmIh1k?;R3_6E#4?07NZMUmrr
z^E=aQ6Eb#popih>I;&U3m{)37m-)t$5{FN|f~&*jgIX@E?K5)=n*Df^tU702-pz}Q
z&X;|E?J18>ed8kjHS0m);ar{%t-?tc=Y%GkZ?{fo&rX@XvN7&`_Sror+hxCNyz-Xc
zUB1IAKkP`qsqdd6LD31@XS2>NJr`@7b8EKVBm4DfJ^$n<#WYQJu@t^EKZ3!b|G=f+
zd&-u}e*XHQ;Mu)-R%wFMcYOVL|I+=y-ouVsj}}d}EIZv2Womih*v*KbCaH5TmHh5}
zf1&sKMR|<gDu%2k#yflev!c%Cow*Vw@SlZ&A)FWIxe}1sJY&6r%3kPUg74xT736c+
zyJoF(HkUBCpyzp8!B_YS+pdEg98p#`=cooLth9)m@PFT8jZ;(J?0eCyJnvm^Isg1*
zzY}l%eR{w7yba^Rhi|M{6Dy86`kwebNj2Nzx2~Q1oC(~K??mF)^8S4L=j(0bKR=t#
zTzANG^mYuYXo;D|DkaRkMuNvkmD?#ZY^E3E(iZWhA#DbVOA_0>7qU0IEi1R0sPtG{
z-(dHoZqdY9XQbT=-^hxX#hshpd#8K-Jf3I$dHJbPPXz?Oe~(JJR2>m!<G=S`hQo)S
zr@Nl{tUciJWYHxzvEyOam0FjdI2NE|IN_e||JEZfR($&?$fD79>3q!MyE$h?me_UA
z3=B=uo^UQ@sn7+%n;bhuL)LT8ymVIV@9Tp%mY-;44AnYtU!t2q<n{cV9Nk%4(&yi+
z-@9wc_VVdpp51=aadT3p!f&IdenHdKL0PY^Io<Pq8=o(=R4C*iZ{9J^nueg0Q<GZx
zR<C6_{eG^D^~{NtHvgah>x!${wQI-Df1e72#FyVz37;zYO}=UU+*tPa_p~x5X+Qd&
zbJy>75Nq#-0Iuui_t}~qgO7fXw?B7cijJAe<gOeJ@x5BYckZZ(tzpoavhn`>_A*z)
zoMZFb1Pi@mQ_FsSYS=e<PNwg>@-*F}(&EKenqO2HtuQb8`}DBvvHOopO?2kY{aPcp
z|EICt@$Di8F-e7Ht`FabS(Nbwo%pbz@F4F}W!_4$iNV*;UJeeQv@yG_wxm^8uJ`e^
z1?zWRckwS|oZ-3Z@hTs~FE4if&6=<HL-yjLb9EMlVYQW4Oi%A{P`Fn8MXYhf@;SyE
zSKZ)xp{()xQuLRnwwtE~XPi89OS*Jv_2lWxro6BEAulTzR`hN1x7}R(UdwIYww!&d
zV|8wbi`>jjU6%v*e$o-Ie=yCh&daw}$ZE-4=1*MbukM(<<@O8yU^`wuf0u}Pr*+r5
z#IAiA6Kaq*@uqp6z$#r%A15~lbBWTV$|YLG5m!oQ94~Y3X6CA>a8SBy)%@-t--dnD
zZUyA*Y-Hk(kTqoccw(wZS-?@&K65>X<6(wnU26^He)avG!V|n~n+)R($6K5`TY5q*
z`!-53v}9kollZ<ZC30pPvxk=B^)G>ub!Mj5w=BI_cs%tnhjNx>&VGkF71cB9Q=@Aq
zT%N0N|BiZ6fyefVIb~1v)*jC8><Qzn&?-L08m;83mC&*KeQI-CqLq}|aZz#pwRgT|
zT(mUczjpn@4zJ>lHC@%YS0_BuR=s1$=ed90t1DM-NbHnTpBi){UMuC+f>X^)t>^t+
zn6JJt-t6#sXA6bp0()bxGrkjw6!BT&ZaCe0=Sr_#N19g4x^~{`y>+<mHACgbX%*7l
z_IJ-d6U=NsXwkBa|Df!OeI6IH-F8+tf2=OH+UC5OQ;KKiv70~G_u9VF`*QK!!Oo1w
z!rrYcYCaBJj>Z>X>u+0d{@ea5?EI4czYLw0yi9(b-ruP3sQlz^^U$nU_kv@;zt&%x
zA(~mcb;dQV?$3X3R;F0`zwW=~v~o9h{&IKOm^Xh-!>1nb+`hQ0FlCYLmp7-c1~V<)
zJG+0=!{XPkjxO%8%r6xPVz1=8v;W9Hr=<D9GM?9*9Q(HabuVy>?kioh=1!rbi$dH{
z7U7Dg-haMLea3d~LwrB)x9I;%W^Ox|yXdRH)yvNp?qzv=LjKmxo+oLCOvP_Zv^oB5
z+okCrAALP??^cfR+pQgs*Zpg5UOiDeVY0{fyz+wXUuf$fq~|QJQe<RcU}9omkYr$B
z$W1NI&r2%J%t_JD%}*)KNiEhdEHMF{#xr4K-XQ~lwsQNUo;)f-of?b0RkXHF*%rvn
zYU*qq8CJyR-6{KqTd4NeEGZYOFKqnZ?>|5PoUvw&y!~YJ&_!i4o`_}z1uZ=LV4vty
zzR8|eY0NWbf6KU9=58Q)|Bll}=ZHndQd%|%xwnoLJ7`E9TVl#vplAI`r-*M=X0NJ1
zl(f*2p0YQ07A3F#BG%IUsAp-7zj%T(|DlJMLSlQLe-Ua;TemdP$5Z3dqwKv8K2JaT
z$28tHou`IXDRkC_ZDM~b7k<v}HVnIV$WniHoA=^<X6J6akNx@TrEHpQuF0LtB@*ph
zoL+tpjS_r5@o-e%g7mY$_F3$C8&d24%igZZ_9JuDbNf8AuWn_R<}RDM;;Ok@;<xpz
zlXky$b9~u+?$y0{joml-QEQ}6brX6BhN~$gT>TD1!&P>chi`~hYG;Uw2CGtrrV_Ky
zw5xNXy*uaLn(p=VWnsbUwnk~2JN5JJ=evK{Soy;z?yA_<!%J2KOrFG*%U8bk#yi8A
zOM}gtS~LB_-hN}*{L+{0sa#^~xr`MbI<{s?pJ!Z{Au;)y$$_13R%||Dxnh~=G>42_
zj|oP%HWqjLt-WL|z<0`c+9&4NhVotFeBsMpW!WsBu3^Hh%bV=wG;><~Y}I%heR2Jx
zzckYyXbY^o)Us{si}T#EG0{C6b9Lu@-lP*F#k;leT-|%EYyJ5K@)?UiHf}1Exx}^f
zet4$q9CyBK%f?1i`CpGdY}?m1?@N6R6Z<3gE$8a**nD=o_WD<*YS!1@z!`tD8=rjJ
z6&Ubq!RD$B=?{{=F{6g7)Z{Wd4MqkAZhYz03>>b3-iHkY8t#AA=Bvrz&emX77g2jL
zC#s}4N&bsw%hz43x0ZOXYySEA?3rV)n!itI-~IdD?$e?*Yvk-Mhi`RzYoM!jWl2`6
zS^I9kb=zn3RUTWHkhZHibhhq63+eQLJVCJ+J#AdyZ_HTtRYu^{w2ilBiM6b#ex=LB
zxaw_>>VzoiNucyPWs&ppFKkPiKeZHYTx|To@B5{PheB$bm%rL6GO2YPZ}O_PNz>z3
z@0?+KK3)IlC(ZN+$^tQ&PPZe!yq~G3r+MsJZ^^mcYKdt!ThuIn%ZBR6-%qgGaO`5A
z+C`2<J@NNH=y*BBw{EqM$#iu(!Z*8$g}K&FL_P6jGEeWH`WhB%q3SK?{y!*r)ca<I
zb(!|f75P2R@8h|bY@dF+>5_QWYIbpUy+pJFy7*2fK1!8fV5kqqd46e8X>o~OLFHDP
z+hw=iCcXdF759_T!6)g>nY1+i@+rxYlVtN!POkReR4gIK!ZJ%qN#MZ)rOwBX`ET97
zp?`bTEACy=3skHn=ee*ozI*lR)voYH{Tok@KmIQ{KaEpA%WmGXJsF!)kFDmkzH{Vc
zSO0$A__uo#+@GdJr<$*B`+NWYru_KY-&s8M`;sp&dT430#w=CTJTmglTiw+~XBTDM
zG|N4@xFa>Y;@XBC8mHRYu2g>tyY^v~=INOG8ec<?UJc!RH{~dAcXpX-;`+*1v2L@|
zmkpYquJ%3p@V(Ny${C+nK5DFv(*50cyyLj!{^^^Yzdm`guu+%UPX5%Evp+jJ>-8;q
z^y|7lhuxngb~?!K+Gfs9o9Lb!R{Hr@f)9D|e!M^J>?@P#kiw}StB%}zba?fST@TN8
z$ZjnSUUzhR=EP6!f(l0_Z|fBA;8qAf>UsF`=cD;HnF-&j;|gv_`TK9)CHZ#a!hX&Y
zmh@ur=aE$rcei9)gf@JPFEmY>?t4|uWAc|xIjdO=cgGwRWpWGIZoza;b7DO6*6mAT
z@;A*1FD+ksUX0IbUADzpE3eH`+b6i4-qiJ~Y~xC=I|n<S78Wv_Pdojl@jBOv!Un}T
zCjAYMCq>&7xVqeW`SIlO$(tWf-n{tb$<!~8&nuT%+5R^CRay15`QzL6&zFUNRsB5t
z@aW0H602J7czyRbubzB5wXf^kxy6UOzfW)KdwxA!e*OB4S6|+|`10$Aiq*WhIWn<x
z;}29Zy#Mp-5r^2nmmiwcHg4YZAiUviN2+VcXEh}!<@;}0nXR3#h5WYE>Q+1VK%>yk
z=vqgLN1sil#}BsDlp}R}+LJ|?Cm3Xwbem^=%?-Xb@kiVg`O{G`c@<mFNj(spW#f_Z
zc$dhUr3Th|jrU)<`3CW<W7SlaJh+=}ntbI~#w{#49%q|B?_2q(G`A}<^vF;5!ucKL
zpBQX-+TYmRzI}Sy8?8ORejlIw;zj%9#q!J3->a86ZF|DC(nas-vEb+*%UmaI*R(&U
zwSaqr(WKpG?&WV{8n3L#6fdY%nLlH3@V<u%OI?{Jt>IkuF4w(kdQirhm25|?pL|)X
z?$+h({#N~b{qY|QcRKA^esr1ZP4WBZZnN#TW9~XE8-7CSn9lbZ=igU^rfP<}?@VrV
zl$>7mV)>3kvX4C9mVR#i*T3V^HCZ<e_T!SPrUh?NDb!1o^^$nQP|2ysu<rfJ-Ej(T
zs+Jl$-`430*%aNGtFI}ukG1fq^a4GnOS>YCf-gTm=(0La#-`D5#f06Azc!vUs=5(c
z5qm%_t^dQhJ<JoYUS#W-^xS6t2G$6#zbfauZojb04wKsS=;Kb~w9sdNCOV$@GjZ$W
zT`Qk8xp~N{umoIEx#A<pwg17s=T%#-D86gqOL70UJ#yl`4~MQF=a?d^rh7Kbe-dMg
z>CToj&77+mN>86s*|U)U45tE5Rfnej-5HZq(heo4K98HySf^7_5`T0yua(cU3HA@Z
zTuj*Zk$3Jr%a^w;=6i<Cuk18WiraLv;#g1Xf=rf89g7~xyu5eRG{QcW>8o>Y#<PMP
zV@B`$pRL^wUtaS_@}2wnc|R?Gse5!EkZ3dC{Pf#{RZQDg?VkH7_0F@i2Xpf7ta&K&
zv+=tX%lTm4r3s}Sm2CwKngLdBQulUSthYSV7<*XPU}7NeIi2;^&TpAzx;MPaVfZ*v
z<!p`IhL7K$DX1(7U`SZ`DCza%O?5{P&pIBu>67+*@dbR<987HQ_^TQCoa4-<xVgSl
z{d_H><bZNor-Fho$EGb$*Jw7zC7fv8e&&>_XJ(Yzy?KmGa|J9y6azJ~4(a^ri(h>t
ztG@pKgtaflvcn1wI~Xo8js7T8F<sYD>1bAmxt{nT7Q^DIZ|`Ix7JqK7O=5krKm1{N
z{ZZ$p$9>|F^Zrg=UQw|AL7YRe^3h30Y<Me|2~S^C?In0nOufz9(D<0;x<fKEw@SZM
zHf)Jk`)Vy$%_20*H1NrFoA^cRm%Y7k#N=Sf35%`POLws@`r)`jQKGmxPo#nOE8oNW
zj%}|j9hS|1Kg0KynCzOcKySqgxlNNYJ+1$zhF<e+-?b>!>6?D%!3~wm!XNj_F&YbJ
zpJnErv)BKzN+Rd_0}Bl9S9NHvm2OHnHM^%-;?(XS^~?i5GCsXY)tPmJ`Qm@JYmT#<
zgYx^MKBt8)E4`8D@M`D(lTjC(qo4X7@z}HNu$I2)HJ{!I@pB!8cuhU(O4%B>PjPu|
zvC_+Q-R{f0e{(+QtrI!;aLs9_P5NCKg6l1BN>19rwvIQxV#(QOp}SA+ypZB{!BXC{
zyeKI$edXgLGLy}x&J52xu*X{O0<V@_s-dib;+ZFv6CaChp8cjz{FA0Fhc$QqYU3?i
zbejK1PcWLnAMa4Sbk4iAp4yXq)4US`KO{yQ?AR`|WyTlRkBir&=x&i}XyM-HR`@XJ
z(~&O|V%HimoPO-or+X@k_gnJn#N5-<);_YnbfAD^K}1Ax{GrB$3meyV#a`i&)n^Ng
zo%Wz4rvGYz(X!u4PI)XXEDO&{{yV#V|39yfQ{T2ZZV~O|y`Ir^*kI0gwgb(x4i*1t
z;%m+?o+b6Xw@T_@%Y9qkZ@)Y|<omMIZfxY>t@-BlOS9EP*zEJMWF`aoBW&`uXLr>~
zvPNc~T5=}QH*;st*B<4U*VOzP|39dZ+{E}pe67Lt1;@6%`SIxetl0tk8P?xRin+0&
zboLqv_Hz&BYTq!NEH*{Gl5vIpA({Kx-LuXm_^jZUxgNghh>zR_gRdu97bq93Tz7qI
z=JItHa|5nl@;r55F*DD>)t{xkoH*aFaFm>C#ny7<dr1Iu_nBvo4<xo)Feg7!+uBkn
z?2^i<DyjKF(1<HrbK%#f`|V=K0{<)RF|i1FUodOOmp4-%UUPO>Rjcm2aP`9V&!1f@
zP)&BbaqYqPM>Bs~3%pOC|7U6W$%BTzH<zt3et14(Y1^Nk2M4C}*lRBSa+6<T=N9f<
z0fF|Acb63Gj-Oc;z{o!7jB)>>u1fa~@i#M`%k+A0G~M#jHa#=4f_Ha6V?XaQnc&mG
zlek>9>UZ|-&Gxz8wjpPtsQHHTk0)`6E!PyDT%PB@_~Ffaf!hNjK9*J<uWfaE@L-!u
z_2;iQI$y^3#JkOkc|0R=)6MrAHnQ(eXs_)3)wQC(?W|3i>B(74$-F-{_v}q!bLQ)P
zF>leH)Cb!IJh>v+&#t-OTWTS8B7-AWXOYi?iBpa$-dQtCYU%3RcN(8FRLDqwjSR8b
zXFBs^`Z=z?GciUbD-<(UUAWD3FmE+ihH_0qRH6D#fm<&QT)UtssMcb^vq$>Fiv$A;
z)wxqAtlW1lyZo=d|IhpfTk^NnCEW6gp0Gx^{qu!sWhomTa@-BNXA+%%uYK_b^@u|m
zQdwR1y`KtYF7fRR4!h~grlq{;f@$mQ6I=3TM;Jx!W%7=`=WMX&WWzb7)&};ok3}Bc
z_2t`WI4eA8o}p5LgRyh7T$XYF4^?sNjmj;J2h(n~rF}WZF*~7Gc{M|d9NVWGMRSi<
zr|2Hnk>ZxTJU_0L=f>pIC28xn_c0`-?D(|s=m~3&fIelPZ&lki+`qTjhM_*SGsU5$
zclsgYn3M|LWY;}wydQf@g@2#vm(Q46{mSvc`-P@!SbyEPe^1)2gDZ^rO|C|8`{u7a
zqVDhKtYj~7d3PzhI5<V#K2q|}ib{4_uDf=-COBn^X+PBTW-9hsB)Q{MWYl$w3r=1q
zmhZEC>NZuQSuvLJ_53#+8W&nDS8wk&2@cH5m?n5OFd`|Yn`gq?+pBIIZd=Jc|M14n
zrH4XpUbWiyNN@EirnL+II;aQcH0))T=CDpNS}$!C<P~w@LvQRm;d>PtQ+G-~WPc{Y
zxKw$IW$^t!Zr9zu>TbWbN`8jv^$GW<TJEq4TW3~q{8U#?{)hS-&HFbBU4B%Tkm{7e
z^`!i{P07B+;jiDDv?Lt!u)5CNV`G%F)lYV1Oz-l3x8&skFZg7S`^?Z;E5Ko_+I}$Q
zN`GDT<0YR3MN_%7e=@!2JL~W`v#qr0Zq@DSoL6RU^*;0S#LoO(c3dZ$v@F@OBIRBv
z|GCBck89f1$-iT=uYa6>cCYo1FNJ+a&IiP@d@Nb5^yX%(;I_?Xhsvh7KUln4f}MFP
zukxI7SI?kNr<Zs>-6)?eG}F3B?RCR>VN>VHS_^;6eq3{R;e%wMaJPpIc0alvtiJx1
zEm-?O#v<>ci%-?(svJBw^`d{}wO7Btz2dkK7vnhFK>y>nwO3nT8t3q-U7NgW&Fc;;
z*&4y0U)mE_2z_Lao$;l7#+d|#FDyL99BcRdGP@mcUo_DDQ|~%IK{1~QTdknRgy}18
zPi%eL@JX}PnE#B!YY}4=34wsqJ!fPOculEgy&HbX`H<^*se(4=JKNvRVcGlfkoWre
z61DMR+aGjF?BuFEUT~($|4!4<;@tL?YV2p)9amWRHa0)nrg>eXZAx2QPN?8p`<uGY
zr5A|KNjUo|hxgDP?XWlMx;?2!_8Rut9H@EmPi<Y+ym#C)qRXZqEm1n6x~lEOE8lsh
z0{RJl@>3_vx3KvrbH`74BcIzj*P%ztEn8sHte>-0_w#GSv`x@IR?{M<H)Ss8JE@TD
zt6Nwva0{H85bF}bomj!Da;S(wXNRWo#KRrJB7VmX&%W?(x^aSDh0u1>)@21>X77kh
zv`o?#VM^cbS{dIGJ8edgNzTN(4U>9{i?=ZfzY7uh^m<i(=(AaK1#dQ8FSxNIx`5%z
z!;d@eb@8yXonW)MaMpyuG%Dj2@AH~m#rNu5Aqy1wZZ=;yoE-N<dcx`Vhg!Y=^@}}<
z+{7WFVUf^u;FN=xWkpG<YDw1DRl3Jk<tKY*cxW`H@_3}FOg~@tVyor6&e-!u&kMU=
zbgZx2A*XenJz~+8PQHD6o`1ixadOY)t$*q~e(l*SyF<2g-yElmhFj*%rhmS0uZ`by
z<6WNZ{gq-23pjQknvzz{wIe&zSHfTe>$8f!&e$r?o6j^GBhnN!UX@(fQ+I3Qk90MC
zpVH-P?zEKV`qZx}&db|aeBM3F*8A(csl7Q@9Apz)F0Lp}Sm?CmY4O6TEi<2LrmAi}
z)-ah<lu>!ZZ0oC9x4-NP*e~*jPei0jj5li1UnT9j?(fw{IJYjow$LPG1;^I&1q+_r
zS#t#nmwZ`R9W%dAEX20%MCNy)oBO})D9`(KcUrj|57Xbrj<*i7maeol-u1zC_PV<|
zdFAu0V_*LD``mb~WcS9HHyu1dN3PFKTm5^jk4QPI{_ewbxz_N^Xt+{o;!`^H7t^WV
zBFk4S%W?2km-;t%*5q9UCv&fVvoEbJncw`db<VO~>+Lexb(1$XE-ThfZThiokKK<i
zHx3D_Nw2q)p0NAeH}#!48<t;uXtm_?1Ig-l4zC&7{4RA~uGU->F59{5N2uIU<455K
zzo&U<{q~*D<@x>l_j<8v_K1v@D~n!OPrA<iT(c@HOKz4db4<ya3HQ}%{4D209m@{d
z^+If#_qWxzSMGZI>bceD6{qA4>O}7gUYL|M??HBx{rxqkwA2zFzg!>tQQxF|(fV+P
zj^>^kVaF@M{5MS}3id7umo!av@indscXd=vanGLq;`!xn#uUetz*|{U-P^5wS#K5O
zz7kwK!J%=+<@VK=F1=W^%l9gixh<n%!LfxO{Wpp@NY}0D;!qQQ&M(Hbd+U_lv+Ry<
zpCoPcOv2@`_{t8Q@>I5q)w@@m+}<{UK_pAJE2*iuAv8ttY|p%N{pZ!6q!b6Ts{1il
z2ux?V+_yBIxqq*Xc<AXFjs;Wh7Ao>dg(Y1x{}svdA&?=Cx!q%K<C9pe&>Oz37yPa{
z=v+$osA3eBzN@gIlV_Uw&Q;epzCAm4am7MagLCg6>vG2FZdjht>9o%(E+~yDc^^xR
zp4q&hsn?pWEL^)veDhNCd39Ak-ju%G70Izj|A>Oq+gIQFw)<-@=@n79(J9|k*0XR=
zuY}N<w{=sN-(T?Q_tpt@8w_u5O_a@(ZN64p{r6t6AJ6P}U9zG+(ktxlPr1BoO|z`P
zV*8F)|AkKRKUOzq`y_GFBj8ij1!b390VlDkZ5aux=Tt2}b@2RzTPvII1<d>2FzeRW
zzz1q~;!1MOO!(a|{Y~_0OkfZ@8Q#3*Ig6Zdmez;YBGo(fuI>?6dH;@e+RtfrVLvJt
zHYazyxt=h^V9N1&N7sZ44V%SN3%Or^d*-J6r$2ng>tOx;t@4hXP3JjorOr^E+qKH4
z{|kr9AH_gMvm|}?#zZZ)?N-w|{lzCZwpGqojN7n(WB9}Pc>f!zJD>S(TQ)6X;=)_!
zU8-lzd~?rzu`R>WYn#8W5l<6-|L?$@_xw*TIqciS^jk%J(&JNm40u}C+?GzM7fzja
zxcj?$`2A|(ZT!sNclSi`Kb?5yULj}XvoF(AbT+PSWo%&lvMfW%MM?0t@kNh@`u1l^
zli5TnB+MHa&9~i5=K83oeS6l*xMszP-|i{TYQ42K;|<flgT3$WwMd!iEbuowXuU1)
z2Xk!VTpv427R!FcV}0TeZY1*;Ju!Q5+INQ5k<{B0XJ<=Y(Aqug<5rH7rJhp{6@Crp
z<b4y+Ts>*_opT<)S+%80pFZGw5qdL3)2-$7p`0saQ&%uOu8%x&r+R5sc>fEB)k}lg
z(pK-j=vBF-_Pdk8><<13$B+D8_m}PTJpZg<hLyTawg#a$(z4X{O<f*({cY6NEAo45
zG@mCuukPc_D++VuI(#)vIH`J0fvY#Oh<=trM}vTPw4hkvJHE;HZ#<1pRJqK!Tw>*;
z8Cwsih<&J1Kc#iU{FH&!zwJVuRSy<CWctk~aLVe)lsb=8t{tu?cP4zRva7b8x%*LL
zutVJ1>DSXA?cKdkM<U~rfO^=32Ye4+o~lmTW?imvu3}5$_gxE&S|6xys{JJz6*5)$
zTc?!!+p6>DH#vD7*OawRvv@A@yfdvVp;~}DWbvYa#4GL|PfH8iM3V%*Ys%QK)U6Mz
zw7h=&?Tx64<I6UvDOGm8Q_AAqqW}7B+U-ET_W{`}|1In^h;;1Hvwb;xPt1{>AO37$
z_EU5YJsBvzPeIPwT~O$+S?Fqc(LL`p(`Np2sXu<a#JB$V^^)4RJGq)Uu7AFld^`5F
zgxjave(&Qg@7?>+cqvvt-fH0=MV6NtE`c%=_h?=_m$Gx}0|`mCvKuBdzAb(p8gs=m
zEWLi0No)M(S)1m^e%<yU;%WA-)R@C6Z;n5H!<4+|cm?yk)irk*k^@R@w??(SpP=@)
z_(<XlgKozifjSevoj>*J_BWNrlyl1#3+gE)a1<Sxv@JzyHqY7ZDsC@Su2jjtKapW8
z<~Oga)-|0`=j&VT&3g7pr+0J~&s;6rkrf<dWAaw=RD0Q+Pp;g*k3N~MQ*lG4W&MQ>
z^Ed74EjE~xJ8Np~wTh(Gx9ldpJjfE2vvK0yc_(I8?%u{;?|IUC&Vhft@hL3D8>5?+
zusA*8ddzQkP~N-rR_5h@*00LSyk^DkS$SsWj?{f;eDAJ#=4@_mUH(}mJT+?57A^BG
z)hQMN!ZZ99<v3k@x3=iqzl`Ss4uAOU1s>1bUt_M4_oMR6@?WVlQubHy+<y{%d40->
z>#IT!dW6bnJ!R=FEc~*WtB(H)U(WexxrL9q)%{L&=Knr(X>V12jY8BTegh@vz0%JY
zRm-RM9{nBnIQ3!K+>@E-78w4rUctTOx%1V(b&FioJrfq1FDm))t5?~(?TyOokkm=#
z$9KI^{e6_lV8dDS%f=C}dT-1ZY5BKppUls2+b7jGEZz#}x1UQZZ#%+s{(^DQqw-Jf
z2mUfRSyrXal~Vhuo%BymP3xV}#s`{vcWssCZOV;`o;=T!^C6E!kHDFH-h1;m92F@$
z9nO?1-7|lmY#6h=;jtonshP67D#Y(z(Q}t-a#Wvl!E{!|H)c-HjSXvf&$F|aPD}V;
znDE)rqD20m^nXLkUx%%C71w<Fc=yYfC%sQAUS7E8bNA-VWlPoXf0NSQt0Mb7V4wKo
z>iR>hO8N!erI)6<&6KEHBy^J5|7=|O^zymiJzRf03#nXMS8}>ln#Y}QkGZ@*|MK+o
zc6q;hEi08@KT_qKxx!|`|8Eaoh`en4c{KNhf8N83jW;I#dFHfgvX=7d!Urc;S?<d9
z$mYr}X@9Z&{I%@EzlzfJo4q2>ZuxRarsgnTd}-Iw{F;XCY@51|d6+gQ+>gGik=||;
zty?p3@tSMx4o)Gm>5^vC5{-FS5)I~+E$Vu;DooorU1{69?WNNDLmcMbt$$~=dv3h=
zXZxA^Ih5lcTx@ODWw_ZPUZJ7vwEq1Kec#GQOI|)G`_-^$ZSY#h_>jlTe(A;ce)9Sm
zEoGFjV(<C>txKY%m$EfkfBYTHe(wBU-qIEP4L^?ky=r+;{$iKGofkbvoyyEVpRU^Y
zd;gSFlepE}cdl{ET~!`kZnbrl$$Sm|AajL9oieSv=WckjOoMlM!E^0635y5Qjx|Y~
zXI@|}P`;l*weEo99*t$5w(qn36(3BDJTLaHK|*ma>u%N4IcrPn7&m?|>&qz?vR7-_
z&oTMvk7)Bx;fcTO)h_>)>Q~stlKjV`e}?3nzi5*aRuy)uPq8vEOyI{kIZ>RMo1#}x
zxfQ;|<KR|#m91UVmdUb7oVal1YnZaWZrb+jL<uJ4xw(ggUQV1cR|j-o<P@D#g+d7j
zcvO}hY5!h#{-XZLAE%GMcNf=TUiTnl3iI`xa}M85-kg=@ZDHlvSFL~2VNJejw2rBz
zW!-1(nL3RzO+s^?Y-n^^<89+^a$(c;+1`PZOy-8~nlxcq%hYT|(}i=meNBa9zE*v;
zuHBth<G4a;@~@alCO<B9=-(*yIpw7Dt$e+9*psuTeWqlGHH4gfx1jDKgT!@(>p~yu
zo2(RFk8he97%Tt7!1MV0{r@Z_`YwOopJX&|j;~wum!vO@^2gbi#00Z?^39wO(jE5x
z=d@EtJI=fMTvPB~X8PpY+^*jB6P9N$4EkT0S}y%u+VZe;@5=)Lv0Zz#6x80`_BeLq
z>`9fGe|{MGu+ML6{(SMO{9n0){^2dwhQ~UZx4-^<LBaj)>KPW*K5k*r$qTEVe0XTk
z=c;NPaDRnKkQ&F!o1Y^crz$Zw+ud*5`s9ej@lD)iy)SOBc)vg_Zu$EAYMX9qou2(q
z(e&)TpbvNcoh)wHex6~T`+?o&=auG}HRsLyCj5QA*a626%?)y8pWiQjKi%2s^PD-N
zvvL&<zdQ1E`}_TSEIq3he=IOkTduO@5ED<Oz;4xBZ*~3me7#+ExAK6;5B}ZC8T+^2
z*=rW|*vd&e_H0k&%-unJ-)Ak-oN@8$`}r4dY;!)8V6*Fw#1Rz>zk7<+4_7_%y8N2S
zPkmF<iMgi}`*e<4T+Woz(s*Y0@zw74+g-2Z8;2(*w+C*remS=@N~Fu%>w@>h)k~tD
z-)MPwH}85?R<!yH>lL*f<qf}Y9r+%6j)S@NVnITQ*UPBK)$_e}E$H+6ezPz{!lbtC
z&@8v^&X)b!YKr9>tyCUf-Qql*Gsk6P<AlpXelwY5XWzKA>caByCTEvtOgq``C)aeY
zU3)We<rSrsjisD36rNr@azfpHZj$28MSOf+3tbhrWgZQW$=Uh2agU0;!s4k+n^;*i
z95bdJjC#MavvAdw$*mbYLK&{pN|;&L#doqjm^OpUr?k+U=RV`3BXS%6zfo5%{CRUW
z>%+P7Kf}#be&mX(UwaplIj3gpgzCo!W^Rmf(!3zEH{}$cgwy)7#$3ja%fqjleJ}OY
zHfH$s&!nSM@Rqsp5~uWK5pJ8?zW?TRcYpH2+$F|f>GH`>w2!ZweXal88NTxKN#a{m
z6n@On)yh2n$9>hyoNL?qSXxals{5ZfXgBZNEz5??`>MA?Tys;@Ur$QPe5=RZxpxXr
zzE9aj7I)SqTkcJcY1p*$h+5fo{yj(ctPtI!puOWR*G%@nYzIZ7s4JNcw>PvM-f%K}
z_TdxRHLv|{sqy>!PU_K;Wn(`sCwAcODu1(WU&0Ob%Ieg7oL3$?(UO?@_L%PdMb+nn
zQWjY5cFavnuCl2%@Gd+(ch<JH-x_xAN0cLZY+d<h?VR0bHEXR|^W0K}7k<r2T@qa{
z>|Z2raW{^0Tz|bbo7eyK0kb-l8!J7IN1O;v^YIH@s_e7a=2rN<iJw-mKD#vYLA(XO
zR9?<2w~5xuKlaJ**qzywBgqy%|F2WUEx|2^o)kYnFlp76BhM0!tvF?}nXA_LwVhu>
z{tS^j3`#zq{^x(KpSpK~$MnPx$rks-^R;wuURcDm=7@j#{kBYpxZ7Qa95d5bCpH=!
z$Y!pL34Bz(@@K;Fn?DO~l^n_zdZY4Qd2ipn_u+qZH}2zI?C$4t`(`rV?$YZ5OS1Na
zT|K$^Zbq9QpV0cqO5Yo489J>@-VPSiRHSsxble@5?pmc8zo18CXXgF~XTw~@8(0!+
zOlLKniwt}sc4f=yKIMmQ-m?<BHA-Y=uKcS1O|-1Jp?ItETJ683%U8>F&r`p1WWDky
zM=Ra?kM5rMe=+f=X6a_j65WZRK}pt2VxCysI<$)~X^wKBPtAG0Gqd+f6)|fqjA*kl
zpR}j;O1!7vGCtwkM#nr;kFDLwVHCBYe!)JTviE&yleTS-xV~wt$@`+$er|i~(QXai
zCiq~^HBJTwZ5;+&mkAZ;mlh?b7N>&dsE<nB&bw{#EjHe93;#5R&=Vpz+D#`MEt#}M
zc*|rlY5g?uJOu->sTtbdQ4_NsY5sa&&8M%Vd2(IxT6v+^3cmAy-S(<HpWpZY?<?nx
zNuufN{fxspmGmR5)$^rx?Mho8r_O%RyC}qb_O>0n#GZUTs9&$%o$dB7Vb3~`WBWF3
z%Dcwk&a(Km!in2ezL!kiyIkL7qIz`K%4o-o(5p>di`G>vkni*j4he55+H@hIGqScw
zyFnr1kNezG)$Yz;|37}(pQHL<o$!}UDb4Ml-fcOR-Mi*^*-g<@vzi$j+d>b#UzJev
zBd>SQ)T2u)<3gIY`ksF9UiIl29d2f({j2_k6yJ*bD4}=%{t4}$kFGe)y|XT&`ONVT
zU$k|*-}qKvU3jJ9|C1Hx8ZK_{S@huC4PP0T=x_c;+g3$uy_zN+)c4Bk!lI<NNtZn&
zkGM=)q~~}^$9uoVtuL{`pGDrEm1|3H{+K*_<FwT0J}izCC%bO?aen#aFE74NUi^J|
z`uk^-oH<urnPIee(>yg5RcpPlh6V9=x+5}Q%lI@|=EwS-^>Xit4%=llF{Ey3?wWNX
z=ert0JuTJqH~DC4zIoaGEQ|49-nvLr_B?x$7#;DG`?VfqoMe4a%&TT;W<I;STW;Hl
z;EQEBEO{=o_vjvoxm|p*=|EEIw3F6sQOuet9(?zUXV01T$MH9VRlHjMsZW2;UhaOf
z=iMz)=EYXA=1cvZFHf1Bt8yUkLyDi?>s>re3V%O;pS=0Y-}%MaPflB3EO+G7T~YK{
za+787JnK)(Hn7|=<Sb9@RbuV&?yf1`!LaY@<esNnw2wag#8hj=A#!-H#y`$J0li7a
zyV#zV_?}dH8XJG3?R!)6+^He)dny>8JUtqE{ZxV0biqPj)<jV^*ByEmnT(nq^A~(!
zRJqV%BKFwq;f&b6x!<cFJ)fld&*AWu-`YPX$T(Omj67zP*;)2mQhoKVQ(QAcIC5wD
z^RO(Lw(NU)<$v9Y!ihPdURtXa#U11p#s|clVG?|~GpOKtjxjUKmr2f29&JV`P5H%A
zzHi(QT(CO*UU{)Qm+JTHGw#GrdR)o+?$q*{McWN#&y#c5Y{bWYHH=x(^6ediztU>*
zUxTi+)UECAS<_W^b?O#X-P4SvtRm`O5B6^qeao=m9B20JT}OkOFKhGs3G(6+jJvRj
z<>%MmM*|#FFHL*lRk9`I6?1h$gzE|qhJ-Cj87iF%^L#A!@yTux-a2KPX^XDLlde?)
znNmez&kPGEy}RRkM#?E`MRtU=n<u~I&F}_gN9!2|xjao0Q>TmnD?0J5zL8UQ()J9^
zf4fbEua_R1yzZpK=7-z=t?hZ9(6D)D6vy<HQ8NA4mMCPD%ihV0<ksKv^Xu!ki{Bco
z^WE9-?z8TN8A8<pdnDKXmSf$!Zb3|Z?Zq!kE^%(Xw&9jz=lsq8OEY@<V`lsa;ja^{
z{K~H*cd@<Q@|Pc<^nZ<xcnh;15|t;+kL~@`!9S_F`hL@Cji1#{O+Vs4EPB+`WOeBF
zThpU8D$yz|y^LWk+b4dXm8c@mn33pnpu=ja*<(@3uJ*dK-k<t7)!$9nCG4y2!8$S0
z&8G9<<C)6m-B_(}u+47bRgW+!k(~5%!dXE%|Bb&Be2P*M<Uf90u<4-V1#Pt;RaQAS
zF<1ZQPlwku9MHez8&z<xQCrGJj6o^=`nO4w%nr2Q%enltzoznhQ_YvzMFCrycmKG(
zBB(a({!BBaB`^KzHXYr#Wtza;)r;c)>RHYC+A5JYG16xN`%&@sRp}piN<<3nPP}un
zwRyE;#dYq6)XC@l9OJB++@1t2-*tb(^Hh(N|A$OMzMWiP{mSq~Ti!GFzjt{re>Qv{
zZ2IoVnsvGEY4cpG4fVON%|H2fv4P~*#ADOktPT{&oIG>)=b4l`^THPkJ8Q!y+wI)A
z>E+J3k54d^g@yNdJ9iXxx!=DU9p&)%?U_4=ZZ6VYaHTD#ZR*c-9WMLx9A^vJSRJ?B
zeK1AHc)=$*2i-I?yAyoR114_`32wRg=Wt|#Ooq+*kK&rn#o;HXO$wV`&^h}ETlpR3
z9UW~GFXiZMl#56)YJJsy`H^J5p0h~LOYc0cLSMb?AIyRQY8o268=M<0DucI6DusXc
zbq}fK+3NdkVbB$gn~Lpzj}wBHynR{gvHr!?9Cu~L<0^M~)xv$hYOCr0FrIB_|50S6
zp^Dk+B^tNX8&9k|qBgPazI97^>!Xv-dsN>#7G^5x-1N(-&Y0Eb{O>?Yb@QVmLYDt)
zx&oSVY>F)=HaaOe^&gQoZmWIuq2bKGIRY2W<tDEwvUYc<u9?uj*f_gA>|uGO;Lg|z
z-aG4C%py&V&R&Y~yU_1oRI&exs9E1;^);6zwO361Uf~(oDP>rfGbLfVae9H-;UuZE
z5w|vfPO>u*>Qs|ZV#_G!Nq?T4C?fp*ocR8n@|5@K&utE$l8xZbpS<Ut!<C6^KdELk
z9W<Jx_NnrO!J){=MR6h~F%cD4uDPf;=%_B^zP4G3b%DIwWra<OAFg>beUHr%J|N)|
zrM-QMwe$Ux5l1VN-kkDMEaP=O_v{ttqmr8sW?Xr~_aI`?3YqISbaxhRx>76D^nxYb
z&-v_JJGHHbbtbmAmCvoV3YP!W$URfw-MnwUAD7qfy1n;*NXEP4eJ?jGQhT6Qka=`!
zN$t$QBJ1hd$v?|g?9R+u$g=&|&*aR1S^mAgvJ+2fB^ac!Ob>2qyOdNm;m_OBB7<(5
zS|1+O`Ei=cXLGVS=lTCQm0KUN;v}Q4N!70K;`2}YRxX%e^+BO{RmSWCNv}7~w0b{h
zC6C~D(aB401<o)Q+UMN4WKEs+$!-?^_^UQ6ufJ?v99kP>?W6bV&4E=Js)5S|OkTKj
zZgg(!s$72T;-wE>GU+T&a+a{ZYqzNEYjn2$Q>0KDmMk^%^hd!>O^f7?yPdMkKKkzM
zftdyi)|;PAGZSqvb>8*uV(0a#=Sw{91!h0pEIc!3KjXglc231QJyQ}h84gyN`ElQR
zG%<a;;+)(?AxWio9;y8Jc*duB?FZw9JJU@!tzrCI`&-Utw$ip4pZQCT!#a{Of|RTN
z+MSa2%HV9!n4Bxrf57rsR?wvPz8Sy6;<PW-N3)a}aTph$Jiwi4uFvzB_mtV^x9)Sz
zvrfBy;8YH};(Ioz-1C6_iPw?=Y?e$MWyimI78_lAeWd)|^(|UqD<kZ^m^V~CGKp$_
zQ|_lFcs}-n^_&S(Zcpp~UwtQh{@}|e=O&+A8GLfC`lS20ijSts#l<!)syH|4o#1K9
z?Q9#eB*GJS&-`!s_43`U<+^iTO-lc;vtg0BOwEMMeP^v~tA7jXT&=5mdBt?su|KZY
zX55x}Y9}vZVQ}&8U1sj&`_3OuE}8p2FJ9-v<BS_Cmw$PZwZ!PZGT+H2^&W<oPMV?<
z*#0F&1?@}N8!NIlYyLyIsLx#PB7e{pFdG;<uCZrlU=R?)x%Hzwu`(wy4>T??H6lL$
zj+s#XegA`I{F4fz6nU%K4?o)GG5bbu;BmflvzN4P6xbnDK7FgoszoW)=RcJ1mke5R
zV(Ob6RU5WG`7{4MPkWW?I=j99YwOM#hk2UWpN_oxNjLp$)1R2jIp?3{PrAN2{K?!E
z{Ji(yMt^$tb+-8v<=ngz`ipLq$4vS^<-_Z@ZvVZC%6?zY*_P|#d8y>~*4V?BrhM2W
z=Ifmi+Bt1oOi0l+ea_$4<g()4a!gIR%I(2(|70!qH^$rU6U$k<JOBNUXM40-f6I$E
zmm;@{+7@qmSus&s@V(W|t|Hgjve~?h>!Yq+;cec}nUSt(G3V|ALEFo%D{gR^B^_EF
zvdL`kQr7dC+Os$XrL`m_YZ5D?xMwywNq*m-|L)8B`ycG1q$UTu8M=tSIp?7>QzZ1D
zx!V=ZaK6W{PSzgF>baM5Y<tSoHUEB;OxpLm;M2S9o4e!1jhXs|7Aem(5;o0DnOnSJ
zvY4Uc@=xDwveTKT_ipQZBC675xx3E7|6Sy@ttG(~DweAwStU+cY__^Tduy}z%Oht6
z=J9&#rQYp`b@qOlv~Xp{N6+=Umjo}|owM#1+oFZCXSuXgcb>}l`uq6j3vP;0FLG;M
z<pqDpaWr!hDKpfz2sw6fQOa4}u&(VVR<C(c)G&$RL9=Ol-TlD&Q>$gx<h!bMWlF0Y
zt4q98D(fNoQbFy<Hs<^fTUY;jy7eh@vB7=r1ILy!aTz!-xxRVkwLeqkxT2m~9efxV
zD#?6K&rkp4rIpJKc3iGm@wN1meg@}<wo{b{{~!O9`oZ~AenhuP{kd%czxF)Joz*r;
zG<uEP>|3p~pLd+84|3fm5%WIlT1#M(s>Pm(!ip2RF9bMF(PTJZT*Yu#D#nr5eU7=c
zM)IuB$C4-K8vE)q8j5CL;{D#d+siKeLs>1$sT(W%w@!W0trNLhe5cPYDV@ZJ&3BKg
zJG8#6jb!OQ$nZz@cS>|aP}ZS@jJ-!2A8zEoAHCo5=9?(l33sAzJ-BDo(s5)}-=Y~)
zF0h<E#y?Tp+kD%FRkH*#zvq1BW{%BTz^AR^_Ta+0jOoj_OjwZL<$V2NNAlGYe}flN
zf33CLSZ!AFe&BD(>HPXZIVt{hR}QPh`QKbGv~OjuH9R;&aaLGttU<#i%js{o-rjue
z^^6x6^nA_-i5gq|ZTr+%{7_;8%ejpG$39fL{*pOc9dy^F{%1|uzj;#%zI^VQD8%Qx
zY5DdZk0_(daUVL~&Fpt^de2&s@HzaDT}<5Co;635TdP`E1vpCb^)|OY+H=16iD9pd
zv5?4v=o1$e7N{TY`}!p)Yr2iCe#JYDlBG4A%hYQF?%bQwIjgad?fwjrxyQ0MZ&Bl6
z;1J>6&&tnq`gd1Ns@0>l3X-iK@*~`=7wGbTWei)jp!LPmST>Prw%1z{1<FeUP8?*J
z=PWes$*jq18-&HI3>bKyw%-5lu(`c^t!A*!>#yGpXGZnQ`2VPS+r;<GYV8&GNN39#
zFZlHnKNNd&we4fn>b&u7xi+KoR<)wTeC3NyZgkouv|U8NoWc28QbN><11behe67>+
z78YGdXB95rGI>$9(KN5nV4;RZp3YB?zy8XwDa^Nhm0D=Wotc8We|&vl<aSl#=z}Qc
zn*Z85vsHO^divh3RmwhdrB-?t>m136Y9@b9iq*Rb-Z1^FlB(qHxz6(;$JW~q7;nly
z|K=f~96i0~jak7D+s)iU|574<i?FWFt5nwVIXC0UuN^_jTYRP-eJmsE7_irN_m3}?
zU&Hps)y1v+{<TF%c;?Ez6Zd<XsU|ybmd-Hr&aL`?TK%)NFMmtRwHvdXOe{ZLZv5%K
zC;6RvLBGG+DWO?BkJ7B<4t%q?Z#?VuG84%O6GN6y@9|&t^#<2*p~rp(^S`etPMNEH
zP5J+ai_2<-OSELv1owuYf51Qgx#5dIo6f_HuOfA<{`u$Iu^VjtKPCTU9ar{`Jq-Cj
zTozANzVnjBVrJ%*iS~B?56?3+6WV9`>SwWXpZeL;Y`c_?ot((M_nJ}r%*-8!ZfJk`
z^utfquIBNg&l0}<Ie!Itwp2uSyxnRm<(oS1r@q|T4^aj_N$<Y;_9k0w;%#l$wSD`$
zuKrNP@hL&<)yuj{ces^Xv>)2>d=AG2R<_9dx}BUd2iuZWe9qNQRyT6E(^akVEsC|`
z_v*(6@d4VKU!CHWS(&%{Lr$b!E_WYCa&;TO0;kWF-Azjk-n1MP_n-f2lh-Oqn@;Aq
z9d-XM$9Vo-=Eya1<$2#)&9vCd4%0of_b;5i@aArRzxMp5cRMYw1+fLcdZYTqGM4#b
zkyG`iV9_fDJboNUX0F&)vz>=+--7-1hreElwv(D)bt3AA-Q4)-{(U>cPS`i3<#onb
z-gjx%PL@8CFJIMnJRwJWmFI`Nmo>W^XP%PW{!e5NSN|dj{&Po~H*XYu{hV{H$)y{%
zXIhMoe1G9;y7iXvqGyNMpH!;sOt_V=dUEx`eH-Vm;uKitr+L>SutYaleeyNS*=IMj
zK1>(%`*_&<$D4G~_tE{^wqJi#&-!WKdi0uC?U?kIRon~=yHpr(UFKb$nU|7ZUaVJ8
zc{VDy__mqQzjg7Avt!yrlr9!tx_36yZLM&mpXtZjH;XPwyB@!!qOx!qhn&N$LgRn$
zw{r`q{7{-d`P*T`;F&CqNB6zooG^dl>CcDb+m7oj>0EL+(q(ebS_x6*Pink}cxCr}
ziu*QiBB%d**64hrPp_W-<4@VQ@JWl;ya^rmF3ngT9pP>yl~cWU>VxP<zgOFwX8l@w
zXq%?EB<G}-bjM>AO4WOldenYiyHlL`j>WY6X6>m-rkpA>zjGa$x6u6W9LCcQ?^@g|
zeb`<8&sEjFH)CadOuz&6p8`iLb?;3V-lpMsW*z$ztMtMvRkEMAN+x@{xoT<rsX8G0
z)zS4KuTi9r-JE&;{``Lz-~9OHQvLtJ0G=1WZ@zr;<5j^c`Ez>9CjY#7G^gsO;}5F|
zSGqG!xK1ck<bBHNzo|hr<V<3`NU=j-MuV5#(sJfc|MUd1ZF_oL|MBv9e4bMD^6}=I
z=TF3FarW>YQJ3ahXK>-z+&aF@E-~Zopo7<yZg|~hQ{sG7Y|B>`J8`G^|LZ@m%>QFE
zchCH}`=q~e#Kf}gWXWG}En5G{?I}mEOpD;ZF<HlUX6ELs72&>D_dO1Ntfm?o5?^xS
zkdHs#V+XIzS6Msec2DryKIf|Z%gPE@lck<d)+a2JX<TyLCyjft=X;K}^G8zE67Hua
z`<m9ii&Z^v&S~eY?_%}O6C`Gd-h1v_H1p$Hx#+Nx2%%$@E`K{XrJCXmZY|R^PF!*3
z%NJ+0C9W*C3u0I|Pv6F;=k(OM^yXQwdFh$+dO379MFctXs#$%#sCq}I^TqR2-{2LI
zDizD_=yjO(|L1?j{`?M`=asde+++@Hid%T;(EJ|t#c8o;s_u!@aeckFQAH?ZlHtwp
z^GYqZ!+%ZPRiAsJwq@oYzgIsBr6n&|yn6HH1&>(h%L}FNzE~|^pYBq^$~j9_=W}iN
zr3zDpu!!D{WY;OlKO4>jYu(uwzHV#S*VT~@7d|^G^gN$ssA&2m(?^`Ql-KI&mY61i
z<u(gT4@J+)tx(x()2mRsBmUI(3QJe6gLg}1td;k!`I;1<SF>S@P@_iTv)Mi&8q0lr
zG<c7-Zrhc7qjXxW(VvS|>q53YYC5tY_L0>>X758LTTNFj%2=8nvinM$c7MRu)w4Es
zXdf40oV;b?`q<+cTOt;}(wp$p|J;SkOh$?aZag{KJ!x5Zai6G#&&t)ytW?zUJ_u>|
zT6;0Zr{DKFll~;*+v$@fE_{{->;{cF3RjZ6>U<kMM&HmDw){Kw!g-T3n;%FWlHal5
zic*26=FOByE%)l`>}k25vQ2)@^WxK5_w}vZWTWLp`TyIm|GxIBvcTC<Gn3)Yt5cIa
z7>orUYENRka+5`gtI|dJ3g0igtj|&f=jY~T)UVFgV4EN7yLbM1z2~8VjMdkjm!!Qr
zbY-igZTHoFojym|?<yiPMu+4sYAMYSVN7;Ck<WDC)wDZoq096*7}I%gS43$4&7Std
zFvT={=C$UlJ|9>N?;a52`Lq2*=&?wy$_puJ+#j@GUyS}}(|M=uwD=wk#c0LrDU3Xt
z8Z6ZTj4iE4uWY*CqqbGQ+hEx~i|ESL%=&zjz8ds=l)D_(^PT_1+SSjF>+EDayqIn6
z^GQ5*k1kpCwY~bc@IK$=^d~I~BY$YEPMZ2eXpYn;3*iNmMN(XgMf+H9vBynXq5P;^
z;!G*aDdonpNxjbn#7lo>>STs9-Sj*cvBj~ty>j>4n{%7hZ2FbAN?h*LjB~jXEIe&S
zoNoNCfNJ&>>6C|Q3|*fE4}81G(>*O_-RAGYv!33+_c`e6z0XEJXVyHn{lEJ1+*TXG
zZ|v45<>c!v6vehanb!3t`UG$L1|jd#gKu_U)(-wAuNZcwLg;A!jEa43A9hQvKE2EF
zGGn71lW`>H`g4{Hn(=JfucYD`TAqmSIPrF}cnV`%cFSWi4~|!!QXK`4#mrbQ8I%>3
z+RT?d@3(v{!@X^?64eI$|BC0%%`;KD@7Z4CzU^Mr2b<F0f5oOog|VLNQJFe>>$Dhd
zsXJ2^zkTs5eqH}d-<*pU9`cX>c@}Qi%_DQ=_fDZZTNU{t<gyt2q;_*{xU!%~{NCNp
zOTRZrWVI-6zrQ{5V(+r(PyZy`pDuBm|K?(}-2I?%r`gWO&w0Q9y}w$2Ze8)e$;--0
zZeBgT$+t}QiB!pzSF2-nS~-eYI(S*_Pdv`q6T!#PxB2Sca}#Ez>_6h8n<($-{kCD9
z-sMG^8dtC8*6fy?e)?&0bhdM!mqK*eVX1pt&jqgXXwZvhIVG>S%4BBiwf91M6!w;{
zKG3x1@$KF@TMx*UO_SBWHTi92gmuWyZDLy%m`(0@%Tyq1{_0Y&d*t?(YQt;aLROwH
zd2;Ia?X8^a!}Q--Jt%zP?asJFXvfn_-px6W{~nWk(%ZZ}eDh=H|Bv3})HR4o9=>l^
zw2SYMw19W+e9gL#HV1lt{Y|wljdb=GI+(HT@e)QW8Ef;IOIGHGJTocCOMl%^9mdnB
z`fBy@-LEq5%AG%PlqIKQ0oMXO^=z(2?kSz^wY{I_Fe+3YiPY)fWVp?+VN>FAM=lvQ
ztxFAeawB#qCN|8Fo5j$%W$TBJws}mhuWT1g68Xi<;9;<gP2jpIho9XU{bkd4&1CCY
z8s08t#&C~$-$Th+>o+e}KD55RnfF!L<eynb?V7b@T~d1YIn4U8sn=8NT->3B21Q30
ztF`M2%1rI|2i<!tbH?xL+e@qB{X=USZD-wTU&Xfbxm-Wf2LoTRB#E=$ar4qjBsDW$
ztqwZEXZvA!*1;29Nz$S^)mx8txXv+8n!Eb&EB$&w{tGuepXxGBNqozC`$62*x7K=j
z4%2dixkR3dv=*LN9=61iQQ`lSyY3y|zpi-WyfsX5#fsxctN8Ez<vSa_LEZe%xpsB^
zn9cJeO#c0oUmt({=n)^bNr`%^kL0MUZCJ|uKS69y{{Ao{<vb=ap=oPkUwoT#T=_uT
zrEN{~wB%O1q@;F<9r~GkOyX0l+QFw*?V-zyW!(!LYBz4_PY7o*4riLXtE4-*UGj*u
z9QPD;pH+UV=C5BpXPH-D)UydU4r;odK6*NJx$c@vOq)#`UTiyMyI8`b?A3M4$Y<9l
zRIu%cj{m!Aewk~R^|sZV-(MUvkiC?;hL3NGQtaND+Yhy`zfmL}_2%B5Ur`Sk=b9#{
zdI;?PsGWJym6_pP>Msky+=Wh(jxq-h?0?J5Q^Rx5WPQ-nl@De#F+BJfFn3Dt*VP8%
zGd}!nahILT7<c}J%;u^VEyaVn>4MKD8%&ttx1yn?@OWeP16d)Di=VwOeB?{Al5sHb
zx|T4TWq*xl*YThkHoZIUDK9GxKPSFriPpOdQ*D2|3KR}o{7XUJ>3DF>LPcBKYxNZ|
zwc5#A`&&!@76t3D+*&Fp^Y*yxx+|qFjpA~xmyVcj@e2F>#C_BKy)5hPA4OOl&u4sO
z>>+bBop0yu%li)P|Dg5v)A<i(XPk2yY*w9`z~KKvQuf!awb~lHq`!o%+@o`wMKW_X
zUw65H^K<FD+S88)zTM~ejpON>7j{h=hc1UWZp>47bnw6hmk-v*mfddrc**b1x5Tz{
zUsn7#oWc4@+;4lr>0dJ^`Q`k0{aR|q#f*eWyF&eERXmpw+QRAhN37e+xq{(A-~GU=
zxgw6MIj)3hHy(e*zvQ+F+k}T!)ic)AERXN4`E^A~N>o|5Nc1!7!>kAAZ#Y>COkm?y
z_{#qO!Q0uVU%s3@`DNpGSLVicD~=z#-Y4yvQNHFoL#%UhGGEHCxy4tu$C$c1_WoKD
z8_z#Ge&UwcjeVUm4ca9fmB*4I5ABhPb5(DvVCA2DBj%OvEZwKuA7^&wuPw=KVAn5-
z`Yh!YVR3lj**gLzMso9H>=d0#*Z)bsYFVS)y14o9OG~*IGFNW7?$KG3u5<SoUtaco
zw>{g=f6lqE<@ef?JFL@g%(pIEx%Y1p<H^O3O;Q*7-uSr8;LDC5w=Eai{F5;6_q=u4
z^qJl{%QZh`gOxu791IER={_v`Cq67nePaA9js^GaCgsd!+BvO|Jtfh0p}0a^c>I~B
z8Grq{^^cwPKhyCj`~J4l86wu#_E%+d{k?}i<GS?1s*P6|7#Q>!85rbH&j%<@F3Kz@
zDb|mV&&<m#iI3MSsPy$a?RCUKV9)t*ktdrjp4~LFxm||kV)p`p3(X6Z3@<0UmC1c6
zaruAGGotYKrP!;np|KAa?yt;xcgI69xHwy*V{_k*!=X~gI;HmBUd?sg@b8A-Ggzwb
z$2}-ix)a>T*tYM5z+`<Z4&FG;(-)O_jb!gw&+(tg`uEHgaW75hZ5f*+j_1$6*xH+E
zo$^q(C$3%U?9)rutwHCMTpTT<9tQas6?0zG4o-X%*Vkqd?~t_Vopjx~rXv^6D9^nk
zbN$tkl`Xmd<aFNW6n^V3+3U^hU6;4}`mV73sQb@V++R+}WoBSV=U`w^#2y~WIf;4c
zY57IDiJ&>?+R)hUJ7yxa-`DRrE0i;N<II!6k_8G&cttLiWU@zbbYHx2-8d`vq{pYc
zKktjbnkJvmE0@2f{PNEF;`3AAJy`!c{-5T)4{WW+9&HzEeJJa`wY^_C`&`5x{p}}Z
zYbHHj^W$aCgTH0pjb+Yp>|Z>MDXQj3Tp#nzMn^Lh&*e`TO7Hrn1w~vx&>pD8?8A{c
z<6+PXmCou{CPqsy-tIXwr@F3(?faG<2iw;Vc7#k`(L1HK<!0$+<HDld(%b7EJ&TcF
zzRtNdS6AKGPi@9@4Y{3@4ynq-Y{}SQc+Xq?>H)n62e0io@ltT=GOkx{d{ZpkZmf9X
zxzW-6#`^obS_gks@0VX~@cG11&KYgalMHOT+nma~xoSSF5zaZVS2=<Chivt_vvPb-
z#edaZcC*cK=<7TAxAo8`?VA}{l6eb0*1dASea!i1`{7OZW<Cq3VbD8c$M`FHO3eFh
z0SD8s1zW!ne4jL7Qp$xt?z}nS^JKLY@+(e??ciM^zv`~p+4XGtZgwj;!#e^jWRJ$b
ze-IrdvUV2tA|2J^t{=^{R6~Dl*tDnk*O!~j*BuTuhnY=&Yq_mp&Wg`%dnWm3&Fr{&
zIB$2+<`jo-L5`u0r+%rMy%x#%dFWwE%Bv2ggVSzpQQ12wJMGMzyI1zF`4Ib*tGI5}
z-9-{h($<_+;Z<B7C#3DCy42~~wc|GzoGWU#QQFuwz1Y`y`qM8f*$=ay-{5pwt2*h<
zpZ7abv@dO)S-r;U-r~h`FV_oA7SH<kfO&JD%m1txC6koz!A~Dvf8^%6=**?_B2Aw@
zA6k(1w$bUQf%jh9@MUj5Mg{+t_Wjd&>&A^^S<06(YCG%Lo_Dluj*<KsG*84_!lJM3
zCzpGRU)Pt(I$~cuCmGz6^j#U}`=N^GE=%+~y~}?B=gx_Ff7df(ZTr+Ux!Gdpj8{v~
zw!U~o%G+z|E~9Mc&r|m0rGIrRo1!wiD%dr5f6|htOQdpkR`Hh1skk3!xG+2<)?s)5
z(d^^i^DJhB@!k|T6;~aZ^FcL1puC`#yZiUS>tA10)NN(gTlq1}=wsR5s}I#JzvjA_
zOm@^?cj$M6dH&bgBKMrQGJmdrqU7gYclD^Nu>QSe*BiQ5Px`dC(sEOYq}kp*Y$kOk
z8izu@T|0AH*s8j^v-Q(8^W#>>!Zi&dJxjl~*mb|O-n?_d{>pDjx}Ug0*U2rk`H8k#
zL}0P1$^~Wyh9jI9t3_aC7dWq$WTsT=6;v(_^Uc3wCb0K)_=a<iQ7K0)c3y2@lE~y|
zopjBiRwF@&B}(e8(K3&z^568j{(V0euqf=_+PMrLk1n&2&%d`v@)z&#&(EgsKXrZ+
z<J$#)*0R1$RX-TF@wKCgwTAtN({Ffxr?fRsy*)QwUhn?@GkN6)_B9yK+WLXx6p!sM
zL;gkQH=Ua`?`o-d&4z&MKHr)*&f{F$D;_8Hc9Tx+=G%@D>@VLO`kUa(e6BZ;?P0ms
zz2ySt6+X-4el47wRc4yUw~0G$)z6XwVU@h*b$bo9S{Hww{AKqqyAs)mjBMdQ0)MRT
znRva(-Lk%S-CRzwLf?rNFWfVG`$GLMMt!*O<Ko%V-!{~JbLDBaI&*`+`AW2!%<i*B
z5BYXE-p-pT`nTJ!TW(#_#ca3ugnoBbS*AVwL0i{udAVzHb-~A))BhzpQWm~@k+nJL
zsk_?N{ih`UDLm{8eUm5bziGDY%o3j8hwIFx+=74I<h-jDVeHhD*I9he-s0D837v!n
zEv2UyU+A8$+;_~atYqTn<`<&#44tP2t$p_4*he=>_M<bNS2!A2zOj9=ZO3Wv8^XD%
zJQMme%ocBC6`7g#$n(VX-;q8~6n8}Yk8U&k&nINVcKUSVhpK25zwpO~Vp|W{+`KZo
zX-?;Z^EaBTO)MXpY28%v^}PD$RvxqG6SaFHt6L?-bECUo?mOYF#aGzTRu%sAob(*o
zeC8+Xt4!S_z5h6=H+>4#yE55g$MrdGs>yTLORDOrNeipGo|?JlvHqs=iJ~f<XXfO3
zc!i3j8d`p|d?=yaYG*q8rF`<zd7<gerXM>VsUBQ*aK={Sh&LV=pU(FQ$Td0mTCF0%
z(8-hU&7=9;We4|5t(<HT_CM~4JEPyOs`*PpI8#;Tgo=9m7~A|ipZY=V_|)r{{yjXm
zeT9qO+z)aO<u{%?w8mpn>H%JxvJzvpy2>>Z#igzWSG*|bkt;uE+5WM(a80R_QKbCe
z{q1L8ghokB$!OT}c-oz1GtQs1Rj-KDUNl$rQ{PkDy+*2sDn#Upeih{;%gjoZ)np5b
zeY{@vYT*2jsSmb&7h7O)-+jR}!-W3gcYeudt~+Y4lozu(Xa1M@=`le?t5wl5k6M>)
zELij5DEqRADel#pepd?bulJYh{FxXr%SQjrZ11|9!aCo*i_$sQdcTx?UUPBtjgx}E
zKTdpBsI4~j=+;}3x4R41Th#{yT&x!CFIru=e5%m@vj<}DN!-=EIU&_)d*sJJ(ca8N
zxjjd2`it(iIs9k!)?-#|FNC%%pL%{?*^CJhmqJb(8*zG>o>h*hHhUYq>Uu=CvTgB4
z<r(MLpIZwoJ9B#bd!yg{s1^6`j+=|6m>3w|Ff%YH;HtP&6Z1-nQd2<#mbt+PyKWl@
z?ES5scJiR1irP(Q{)LemH@y>gi<q@Laky=C|5%di>GAk(+ok&V5q*=ltns^)@#Wdx
z%Eg>}YU=+O)-MwBJ@E577w=@XFWNsIg+xC7V;8R?d?TX#Q^^|1cjBl0H>?%hm$-pV
ztLE^rU19ea7iUd&slM$L_@d9c-<9!-)oaNqhSNkRn<{#qGn76SYZ1G>^!Sw?b@!*)
z&5t|%`_2f4G~`YSS#fat8^Ob0E(8XPigLa`P{(Gtt10)NOJljvt#pI>hV<-$sSP^0
zwgwX{(~m{$SNovTwdY0Fgu)%Hw+k0=9n4Ayl<W3fds_LDl4^O^>p4wUEt=`!N9rv7
z+m>71J)+n1fQj+_5z`aGw@ZXxDn2m3|I<G68^1&5QSr+URVxxA;=BHBNm-{W@bzZz
zyy@XZw$77wi8Xslewbd8%66$q(T}kzYE^oRYIOath*>fI{QtA1|D0l1e^SL(ViLB-
z{ry`0*K6M!Sns|%bLFSw{5=!D@vI11e^61odAF&~`lD@X%Vx7p6>N8Ud9u*Ns4t1H
z-|W-`ErrRIo943r&O30jx#6d;`+1Mlei7MocRB6CyROCrH}jjXluPa5)k#*Em3nvP
z{k)Cy9bfThUgKY~Pv~vqk-3Q_pO3A|TE%{(Fy?p9pJN*;`of*>S+qt4GEZFAQ(JU6
zU9sNdw7&7GxBqWc@n!~Y>GBC&!aQ-`^-rsd5`S%rUiU5XlQ?R+lJyXJ6UoBB@R*x{
zK?Ya4$}A`V)iAwbxAPvG3DjN>7dX+J;vm+vz@ITFAv^!}g5BK<t~zrc7Rbm<5nkxg
zxa1L6_uub)`jb*m=PhE7p8jy=%wj(M@+a%3f4zTNe+|pR#Gf&Z25Zt5$emn1Z5n%o
zUCQ^1vXLjZh3C{8JbC!<q535Gh8k8~)|C%<cjQRRxbs|4>&jA<4iYI%w_<g5jJWKT
z$|33`l{G`;R{NAm#Ts|J6_+*5D!UW1#w4&p^=m=;g3Rn=i8b${)xNc4O=@2<^OZ~D
zk|)gfKE!zZS)Rr3w*1}Gi8GxyzJ4Vo64Ls{=l0BoiM-9_vX4W(r1ZWYUVd!bnVWeW
zKf8Dg8CN&E{0sWTq_wA0DQvRM>Hn2KW7gFD-}CG7&)fO^f(Nw~rf$mID86)KS}xlj
z`;T>^`&<G~uDq6VH1hVh?4$PrMA#d36!-fW1dDXC#Vy}=&HexMzmK@L*M#!4UUAd?
z<57K+ai*%Py&u=TCpX2Hon=ej9{tJW=cJr%nm2RApEJ0xVo5k=6J34w+KQR7y;~Kw
zwa)06S#ax()-R8`r7?$DLskg8x9t8{tSg#XBihngyv?8YX7&={KpReldov~-`XzMI
zZR*N}>etK}%c|R&W*rUdyOAcHeBRi1bK)i&?UiPpHlccc{>|oc1y1*4+BZrZk!DMK
zarF>i=|A5`mv$yZT1p>zx#y&-N!8)3U=yG0IdZM?5;;ObmEIGco_{i1L|AR(|IQuB
zk<VE)4pizM3oonM!8k)_<@wht7LNmu_=WhLde8Xbcz}D&)sSGTqN|Q3hP9rS^1koW
zw|st(vCrnW%CEJrb<fY^)!6m;+8ync1=FGz-<}rysD7rwZO`g$9&1k}9Z&t4W&6N5
zC+UBD#?6&NB{c^-ww_%ud-FNY=A_q;FRMKZd1Jk+U81_0D{gm^{&B^!e#@1HT9%Qj
za~JXI#2JcDOWFC|<1<fs&-pc<7V^}|JxEhzYdyEmMD+Mmmg)`lo$m9Rw{YDvIM!wO
z`&gh%Z`1beOlzW6oR)kzd&kl)vxY<GQ)U%B{=A6kw5nRfu8{DS9WT@t=W;Lddh_CS
zOU$+2r+0gP@4xq!)kdUh_qy*2F>jmQuG=NG9e7Z_gh?u`AoHO094+sdj=zUH7s|h%
zR<t_tK<fX)f0Rxn<*l?XF?qS=HfI6%_Sa_(f;aG{od_)3Bed~g)P|@zReLRWFgLyE
z-?HD#RV`?tctPgG<I;LJG#9Kl&z*O0|1mMUjSqK(oarrc=b1O}(7P8gZ&s@N2rHkA
z6IyfRXu{2JywiSm^)3mY@aC70TlfXNnJb=7KDu$Te9N0}?9&xKv_wqZ(<G#{a>1VK
zXY`Eby=>^Y+_~%R=d}NhI}SR3o~O^ueuBSc-kl$LZ@yR<^1qY(@aox1ea?s%HoLDT
z%=o%++wRj921U2Is*Y8=yjo+EpeDY3C%@P3-klrv_PPt|Wll{n(R==MqnDW71u?^U
znVV(aa86iNcUDBMYw4@Wt+uzq)a`%ue!n%-Z00<{$-%6eD-CYeqZUceSht(6U}0c5
zz{9|xf}=>vP0UV>FDlK8PcBIZbyJsy`{v)a5ZL=Wd;@2|$!K@a4cl3`1XS+1Hf}Q%
z60bJkX`JR}mfRWQskL?ci~9SDuC-Qve6PEmiY(rrWtX3Mng99HNzb*9op0PfA!)sN
z(|=2^r6)W^mM+y(brDRgR9vDqrFh}Ww5HV;SInFIy2*?6YsA#mPF)gHveL|!rbQax
zT79b4@vB<$>RaD=+PC)J6Yp8i8Jc1zr8+?<vPi!1%4yM=?C~=$aW8#Z<Z~{M<MFR7
zmk;9IHp^`Sdp(aAc{**1(3yViL#Ea4+C6jaZ5}NtudRLC`{s-0PiYH}RgHIQ_qtb2
zdbYq(Yj;-ilpTxv%y&$EZN$DVz3iyJ!_i5iYL*MX_b+j6e715zi<+m%bgyokB9Xm?
z$5Ruot^EA7I=$0e@!rkILn=q2PT2Ap$_gY&2sgF7;GVj$y#KOL-IR=}Eya<CT5=S$
z1tL$ZJsG=seum?t`J8q4T0}+HXp{zKwKC^@lC7G*hws&4!z(Y>Ihc5OY@NSEhxx18
zz2?J{bIw|v<!k&e!IUh2!RYeCq{zi~B?maJh=f(Ik-vK=`a|h@lLFsR`Q`EX_Vv5x
z+gVMxvRhSs|Ey_0Yn?=9Tr=>H+$JuVdAYLVh1JP#Eq`xU9A8(c^XB-6fKcmjk=s$N
z-z08qT`;pWZnDw&?-P%iUdZ_2`+=)*sY>&!3KqTYWTCbvLjBp7B8z7B?J^U;da?3o
z?diie_4THSMxTgt{Ufli@#-OwNi&&h824S1o@{g7&}@2J!QSoLCu}fbeW{gICloN#
zV&|Hm<UUDf)eSfKq!csOOf)clXqK8Yeb*^RyV8(Fu}@}w6mnZ@?!(WmA|ly)@VlRn
zdUbN}H}?}qxfA4qdgDForZ_cA@fM1uPxtOVI<54uPr1N!sb3dm*owU7ZCj%-LA)y8
zc=0a7MHa$lJh><A&Iv2G<xcQYpYbZseP`r^A`9uuhwgDaJ0bb?OVs|hubUHX6B_os
z`J(^+n98eX$9~^6e^Ho`-=FZU(#+N%=g~{QTYV)8^17#v|L45ya^J9K)_wb$`SR%|
zJ+~SSQ(q@t>ew4w{qBt1r8lXPzn@eJtgXuBpLTW2mCu`07d_pVf5XFTLjK2m`KKID
z11vS$Wz9lVwv}1DJFe{bb#r1~%8@xc3=Y3CF8tVfH9aX$uDJN;+8Gb;usxDWnXozU
zNxPwv!`;fYDf7OY$=((IGsVYw%dN+aUkqn0P`YE(5X<BG{io2Ki#p9IVZF<OxGGIg
zc!oDms10|D7r*AvZFKJkyH#1>>jQH&zWM!JwfL|8;dYlGZcVp7;eUr#ea_3_zq?M*
zF1_XZW5eb~J!@BUx36C<6|=u{d7as2SEH`c*gx}7Oho-fpRJkYS|QckIsTgUH48Y8
zt#Y(VN~?Rf@5i~9T-^QnGp9UMy;!tmtLkT7xfL@OrCbVHc$4kKs+7ni^MGlwm5-I@
zN&C069Z%YF_tPuIobnm(@}f__xLkekn~%u8O@9sR7R79qIpI6|;=xP1Rdy{c^kzTs
ze#+@%0kfyrB-gzDemT_kBlF`sB1g>K_nlo6$olfS+%dnXTi4v#0*`#$+WSBAf$m$^
zKtIWTrS*#%{~Jmq-7=q*%y#3ne)s9ss#U+x8ujyYy)``;85sUC;%?OEro`tL#TOLo
z6%-rhPVo0X<REbL{a+FNrR-8U%~i%30X?T&eJvKKZ{8Mcb?e==yR0fL@86wR^znh(
z?wR)Q|Eg`a_3=3#vS`z?qi@ed2kAzZT-y`)aIu`;^nGUEc#NZ7xvu@N<_nXu_@)}=
zn-Qx;Zyvg#r|(m(IB)*vC1E-nJQts^yu`QoywZ`!uB&%&{?d5(`LV`JE4}lRkH0Jp
zk;+k42>G@B$!5;&!Eg6mVof~v>&ug;7iT#+oXFep(MZ`&WZ9t~-;QS9)AYVozVO`B
zc`H(PH~e8OkW^dxbFYc((NKGii5J-)Ez(U+;TNm#o*Oy2)YSB>{obvsAD8TBGT8n`
zbGPxi#q#;>yXV+>>RdfI@tte<r`PX=-ah%Zpw~Th+O8vQe+0FrWh74Blel>AiwchO
zx|SUGw9dO77Tn5r@4?gu(?XB3vX>recHDA!*R!?@{t}UoStq!~qt-Vq9P54L85tOs
zFk<Y>gpaf2gB!rU0SCPfI|%H3A8vE2yH#z;$7{_BS`jZCH?S|9vLR3HtivYhGW87m
zllMQIp5x-$o?71a{obCNk&k}9{HJ<*v+{h6+gG2oN-x`S^ld_{cjQd*w9efIF-r5J
z4?br<wdhVtRc!L}Rx8%W0*gfX?wJ^VS+Oc@ieXS_V|6RbwciTH%95KSbmUe_YbfnJ
z(d@u9M{2>tKA|-aN}sH2EAZcG*gj48%LHF5i6vX*g!JE>pS(d$QN1GD^A;zsgz(w7
z*9s0xImSAze{f{EUZ(q3^JnQBuJj$co3A=Oana3|X2WI6*b2Xdo6Wl{)?Rbov(NKU
zX6qZaH>ueR7H+Ol53c!sTK#{Km|XW|sp3tRYty9mT3_<FKhvN0#9zj9`?HOP|GN&=
zpbcNy&)WJZfs=v3O$+DHdvbnRYEfc(s$N0m)u`(J+dBmR-=E*KH&@Ye<CL6rJH)!J
zb~wMg5Ld|Cq{hm$q|M3u%dE)GD-*BWa(ln8I$a~^+Tm}fep@`?d2{&EnGeS+i<fYJ
z`gixc{Nni)r&`i3_Dc%4t+xmcf3kbhvTU)vUGaW;C!{0aiR_P){`BhU)A$qZrpo`5
zqPQk)jGlIS6N6ongs$4;sgqbeCxxbJ9i7zjVbPRR0$MF5R|+(@EY=J-u<23dv&<Pg
zo_cYKn61u#USm14g7ej`C0?5)13xS-uX0oQ^CBx!Yo-zJ|LIrOG_vX)3i?nTD><*a
zZnO5z9cm$y`6qiG3saf8-REMq*r`)frd|wx;`~SW`m@PqS&Vl!1!;OunevQ_MQi^R
z@oBTZh3;<s)*2J1E*btVdTHdO=i6PGPRCAMI^}1M)2;d0I~EFUOPzOD(0uwbl`7vI
z2I15A53H*=XEJlLKX-L&?oQ9tV-HT9?%aDQyn1Ddow{RzsiY43ll-L#TRUPlGpiVX
z*MH&J{Ip?l>LQC|w$Mb+Lv87=1h;$-Y*q-eoPA`rssHuF*(qK-wl#dS*d>&;<y+c2
zy>qYr%h))aK5|QB=VJSYtCOr(6-06GW@x_1v&V7G57U*UyP1}-`7A9|{xa>;9KB*T
zHwCts{oi<!M3ViSQW_hQ|HTxt{$UjrJ^NYqqN?}LtaRD_DL$^}8t)YG?hcjLtgKq>
z8G0+U?TT^7qMi#e-UUa6=0+*U9TqvY{lr`cCJ9e9R|dzezMr|~B){JyRm1T}V}GiE
z(FXh7GomwiA3FXm>fNB~t@*<+=pD!75AK#PrMnvUAIsQ$Y^rF>=CrngJ!iVAW**DX
zV%_Z_o4nvyyoz|D_Ng?Lj_gGX3YGl1?bh}3y}o^UTK59Sxi1wInlx7JcUjS!@JuXL
zrr?v@^F^I9?_<Jl+HoH}cf4V7gU*pd>mIYNe?CE@+0J0Xq!lKST3VM%AARm+=DN*t
z?B3p=sRbf$I5MZbn{eW!-MZVioJ2LnjOSjO)VlYNS?mvnm3u#bo%6@CZfkjwm(ji`
z!`7Yg?^_l|OPfzv&=K=fVdKp}{>_&>pO$UvyQ-&i=USfch9wiCFDo71yQL^hVC90z
z`)*rST|BYFL4IxX$$->|XU$yAoXLx(3Q8?o=soX4TDPWO`1ONZTK`T^<-1vPMDF(O
zPg?J;%<eOI?GWI)wODeG*ukw^jAq<z%6qAJ-ZSAQpVbqGdvXj{Dj#WSJ!?sbe!`gM
z7oU22*PiY6HL~@xUrKi6vm|B2T$-)Y$|Lh_%a1*)e?7k&RP%v()h)Kof-MOml4o|k
zJo}ZY;bwbs&#xJMg4+u+q;1Q0)+h^H-jt%mefWX0N8YRjKV<*d?)q1v-~IH(mD<M-
zmbdImI<%m(F2G8#CsjbpEomcbW1C>awwFs4tP?oCn%#I6px6J4^TxbY^H-}@*W|xU
z<^N-|aJ$Rzxi)ulr6RZ9b>p<TU3l+3qkQpvxxVV3{9*meKg%E9_U!w-jAKvunQzb0
zbMv%0&1tvb-#b6~vY*F&<TJJ(-(dgki~HOAnXjUbx9BD9;kvWoaoudIkRy%@3MO|?
z-80+TZIhg__??1T>TVaOEG%^B5$8B+QTDx=Z}O@mfowajD=(Y<_(;iR)oohN@$0Rf
z>iaTwO`TR&tsA(%e~;9TSBW?8iSO184VQTFA<|&(H$j<qRezp0?Fr<m?L8#eD*mEQ
zU{euu&W$&U$t};#tA9AwZ*AXSp};Pd6~uo1WLvjSUP(nlbJ^s5vk#dH-?>=0|AW9I
z)wjQ={LguC$5ll`LxziuQ@SHoO~EU{{WHTN>tERhM`cZ~DEu<Gz!$Ng%e+fkY+Y0S
z{$KICRsVcl9c5WxRmPCC-M(gn+?QV~uPnH(yk)`lULn1I9~NDDb#zj<xX+y?=D*<y
zmwotNKkL6QcTjg@l!%cvhjiYf6R!^J)x6`ub*6Uzjg?`4?0$Z1@3-G0sh2d__Sf45
z$B%cveYa2W9`BRGVlrK^JuBMg&k{VlgHMC$vvY^{*4HxG$BGVr6g}RX{Cn+*<(D>o
zDfKLLZZ))Nj<H*pu)SSqF?UV!oR{zK8_2qrci)Z>baE@(zf0?w?(a88N}g^vzs>qn
zeTmC^hi&nOKGGRIB~ztk?HhYFS5!UNkp5v_{<2^#`^RUlyiEUa<+71W{ObQ{tU3*)
z^DCx5<8fc;_PJ;4vt8Hrch<TD`ZwnEe-T;8+N<AS{<pU$$=<N6%IwpO9~^Ekj;_9Z
z^{>vsR?{Q<?jPRmzpyOz`u)SU&XLX2zM2P{>=z5#*rBO9^;lrO>VoHI-_49TF7c{k
zTXg&KjoH(={!~@3|8;T0w%9*=bhmTg_}5?_*75LImQF>p?TqcWGPXYF`C@v{t4h~A
z@EFh2opNVGszXZTwi(J9%n|%^n8&?GckUzxKbIWo+lzlBczl>)JcE7ymA?!JHx}{Q
ztX(T(afvar@bcnUsoVZ%xY@Z23RP&=<t_6+V(<D_`lnhQr>(u6+wFq0RZgp>2{2Bb
zpF02X!FwAE8|Jd#J=*k7?0mo{^SjT()x}mjvMNtH`nV@}t$A-z7Jpey*~3FF7c|5~
zE+4jS-|Ei%AhT^Nf7ij_W~(#I`Y~0<J8#7{TeEz+a8Ndl>HFQhV*WFYRot(wR2Wt=
zZ|rUDik0umOSJ5G{9=}_Tg?JVrKvZkt_k~f<*Y>Yp6WXPy!i{hI!v6xwJAkm`yuzA
zbq}P1=Z18(2Y>f#N-D?_;(hb0Ry1R?bIF8r)mnF_JF`XdZft2>yL;n<N8Gu`cies_
z&2P9?#O}=5a+XQQ`f`@+y7+YutMtR|C;X<F>}9m?iMA?A(0|MNyNgdP_5UuvKXZ4j
z`yks>{>^WO;ash_N3$J1KX`wy&OImGyE}7QVn&3aqS(`_5Z*;+Yzo$~++R3-ThQx(
zgC>j5cCOg={duGCwzNu1eyR3DnHATU_b1%El~E(3v2~4{P>qcdo5$;wmz57@dcSGR
znkUiQ7M}jm-RW7&SBIM|CT!eOZk+I!ik2`b>Et<=cy*=RsyN~966J?aqRh&_if`<S
z2(-9xzS;Wvq3v&9@$9IN=s(GC=y2frdWpgnC)5jNZoj`7Fe~%t--}yj{hXX~_u_xe
zOMg#35}Ep%SGIGDCx`p2z8n8Gnp)fuPnv%B(zDcqv$V_fY(6JFvi8^DP5j^4w!iTD
z#}k)Lb=U2`Q1`2F*41AZ=Up^*yvcZ5wQ~XMzRjKauT?!AcX|kYf3@IVX3d^tr!`JL
zSWQZPzx<TNsQUUpYLoZu=S3&l7#SF5FflMFV;^EkNzEzGEXgP?O-swH&?~4+4LX?h
z*g#<KYwfg`ie|HCs8n<NCS>ZjigBG?DA07_*y4(9-#k2uZvUxu-*|b$n!L|n?(JEA
z@y>zMpZ~soGm-CvU^>5Pk&?GW*oWJ*otrnOnuePfJpZG4VWa1UIr?=6w>efEdLfZj
zbNt#*zmf?TO1y49u)1*T+e-cwrUB1mJrZWb8g<IJFLgU}RP#vio+&S%boM7G<xE|5
z(dorbgNG8~8`jEcE{pX^j6amad?a(J17BoDVZzi8$-Ji-&mCt^6rC(}o8Qa#&Dy2s
zPtAW|W}$vhEb0I9Weg`dugV%6<GsVTrKgimI8W_qxpQaKL-nOefvb#X%sJ0{ZNl5~
z&wnLlta~0L)puGxICRQT{pu5`FVTt`e`HP{Jh+R&^_(@UEvvWgDdW!6qO0wh_q!Aw
zE8k9KH8VbUN87G#gJ_ZLXPd5r%l=F+%DcE-cQ&8ugc}u;XT4glESG%alYQfcs=Uto
zUEL)QSf+?3%s5>ieY2xR@%M&l<ym(nlhz(rd{Tez@YK$|@5NTvuH46f8jWw3dl#9p
zGce=};)%wB#N_1C+|r!H5>Pw4H~ekhV>7Y8>z6<9<2n&{<CDsb*e!0x4iirLHJ7Dt
zGJYp6b9jO3sWdmS&`Dj#Pdsb<X8P^qx0p$rmRMwFD{Rz>y?4I&{9dcX`FZ#L8U1ry
zw#X!@W^U)DQ!!k&sp6vk=1Dcv_VoGPSi0(4)H?HNf8Xza^XBW#mlFT~9b4zE&1G|C
z>ZLngp>7vfhp*SWwB_D4*6m)KW$LfKwBPs7?f=}|&@l0))I~z7JWGRSsC3zJ8m3BT
zYa7q?Dcc>p=tD(L&NPj^^X}aIQj&CO^X8LzwPjW(L$cIF*SDAnR}`3W?wZ_tS1iT4
zt7z@EoSkQ~qq8^080~B=p7wE5$hDstiwa(!JMgezt!r`WQSsfE_gMY87rrURIPZo|
zSIW7xlW(riUj6iGdHD4E@%!t|dnN47Wi*}eId%Hjljy`CUF}VlN%DeKEk5VWn*N4q
zds}gDou+x);j352q@}ASDSh6hbHpq1-bYb?d*#?OTF2f`J)=<PpT4$fQ$oh!?l~*x
z{Pk8)DhrqPew5;B5PEynwzMN<(lhgBnDiJg;V-@U$w+j~rL547+%12;_sge+pPt<<
zY3*({DI`}rvZJx@dHlwgxjQ@B14UAmzE`nNS*B?m#((n%Z|!fFIUDMWW~|?FcgL;w
zW*lom+9xFL7g=f0_Ij^%L(d|EHKy|=4wmjJWNVAltli>Z>m5G#SximzF`r-6YZqLo
z%D%?2NK@sM(+0UGg);Z$j=cChPw0%1YR~6`SEhQWYnHX@6bkP$J(VUDzBPpL?b1~1
zyk&v@=b2|#y}7?zlf|4VuUa5iz`|y6kH?a>!`4eQRRyPXt$N$NeN|wTujzHpKeF3C
z7IWV0H~m$tz0TwE0ryv~PF1@y*Mw`_3*Y`aKYo9wyPkB&!KY`B^V`Sn-}`IFo;?h0
z%MW~xo_Whs%VLp{-h`d)#{*t%-QdmeBreT~KSs;rAA9DTIUn{&Y@C$u%H16K>EOY+
z;!E-$b~ml7QD4&?xb~fk*K`@)n;#kvTe~xwIc=7_Zg8q8@Nx04%?Z&=Tg8sfQ}mP#
zwKO<Y5U?QP7}vZ&`3s*H#6&4~)wHmASLU_^U$<O0w}&w<a7jUtt{0=3v--NM$dt}(
z=j-+p-mWt9o2~UQMD0>jwoIe=2kC>U)dexGCmMf+aBG;XQ}$@CzY(!$_NkYju6QVh
zMcwfZovo17Q9s2^(u1wxkIKr*==>Ugh6Ps7D;`|hG}*QBfHmXJyf-cU*RA*&3nzqo
z6rB*^QavgCHML(V^-Mz%*Ua~`i#5s~b(^^I{hVg1(KwOGV&Rfq(JaMhCVwdozp?oE
zNg>fsNj~KsTLNAgFFoyT{b9D;ujOxM%~<T%Rklz0M$FYzF~6PjKK$BUz*$<h_4{$z
zh2M%jHy;tcrFzz}-f70J4Ry;(HAIe@nuJMNEf$!tW%=B1Q%=pZnSXg_>v`443+%r#
z{jE;Ft83DeJmNch!T#sne35Mat19oD&F;Bp_ucZnr<KV1cOBoK2WW18@NDCJ>5q>*
zK1FUX6qD*pab9wE@rTcQwOkb>SR4)~ynIwMEwQhp>EZqc#p(4y79TE|S~VwMIBU4?
zHP`*V_f|EcUj%Y>-PZhGy>z4W`?rj?zRrt#ZSrlebDrmj*1t3HZR-{LgBOo5Zu~dr
zqt^tNl8B!-cXS#pTDG$H@X9N?^;Xi=nq557vYSP!7M~5Tc(U%OxKywL<9)^m@fA1M
z&aYZ_Z<~MB*@p$Mc6{Ji_2l4}r7X;Pd@Q<tb+gNg`<{Omt2BAV?~(8GRne#arGS9E
z*z}w?vT~QTn4WB3+dTVo*!@NM?DMV!?az4LIj#B2qaBMA?rl74xw>Yv-Rm14UdZgp
z==0h?Jz!Pe*Y-WCdlt<!<Vf%P+IeVC!LJrJ?F{2>iKY{Gwufzay<*GEIW4mU8tWXR
zPh`q#`P;|6tgPSq;y``LnW*E2tu~gi=Z}9=vG&_^^|92Wh8DYry)iP%R<a(a1oyHw
z@@O1><{I+dJn@tNx0}`3f)!^TJ@GqP^x*r8nimdJg;&g}Nq_peWajbziToD7CCWWb
z`uMG*EF0dJT+>Zb&f!p-`|ZA6+!CMX#^2c9FTL&i^6%=47D*rZ4zucKceOpK?797T
z{bR+o%9ZMyQkJVWb>3aK<%{*{PjdO08~SGW=X<|-b-2uV*#tvTH}*wEKg;%teCs_I
zv7q8Yc8TxPmq$L8JekUN>{gMf)^7%<4BM5*TK9zr2g&W$onZT;=-|tT%GC{h$1^t{
zvpw)G+5AwzqU#HtcImMv<Xv98qwdj8Lni4A#XV0Z?6pi!_xLB3yW=v~YtP91@Eb)J
zS_K#sr(gSXl=)GBR@MBk;q^<sx0}tIyrVMcPME>9`bE3kE1JTBCW>?|-s*Hg{SDJ(
ztuG%Q%ARlDt(UN_VEx6FVKWwNmjB!E@%F#2U6ZpVH4dNOSA1=?b)3iQzX=r*)>A4J
zmU3?Sx{X)(`+o}y@dxkSt}hn(ZpFbOv@(VL`LELW^55-E5<iO%zd&m}$!(KAP$SI1
zVCs!?WGf}LAT6^ZwFoq_Ws_Ze+hWrFzuFsK^NXab-13vjzqa*Wl>eGHKTh=(Z+xy6
zDkt8pq{x}v^@J%U=kC3K-(MeVX8AEe^!U#9Akl7>T^IGga4#r3`Stkb^OL#7F8f?K
zS?RQS(pkx;$DeHJc%(Xa57)QyvXi^_L=<m}nD*rAzk{zi|CGDrO`8%EG%;OeVSL6c
zacu@Q)!r~`>*9IqJtWSp-t@?XhcjB#Qr~k*YNg~<o%2V|o$K4DdF@cm+1L3@ZKn4t
zMa{!cuS&_R4L!>>?|8_S2~T$=+-!1bx|3nml+c>8EGO;7jz^qNO?EDOIzuPJtuo}2
zK`N7;{WI3HPJ(A&o;&yTy!pegXP3{uJpTk|<=)~l;kp@q=a;1yls1IVx0`qGPmg&1
zldJmjU%sxke_YC|IX^DG)?)9RM-QC$?6LV@AzQc0f?MC;zHR<8@gEP~&i}Wk{>Qhg
z4`<6x_;LSojo4BZH`NK1=R9XVUwOmwe?e_=RiU8LrVr0vaWUR^U&)a5*hHvlj%#Yk
z*?*I}9?LS#Z#n14ualfA(Z}NZJUM7e%z=jFLq-p#cN(<5H$L!g^2zv<?KX?KMC^0c
zv0o|w5PV?Cz4$%9<XV4LyZzZJ*=Wpe@BUKeo%j>?N4nMX6mM$Sem}Y1(x2zb&g-?y
z7V_Oyzs@fv@wrN_>_J1gu2fNxQy*V!pUQ*GNd?Vc?(hBgT<ZPpcb8ZHtPwV_k!$;#
z)4h=Y*JjmjxgW3HqZR(Ya9rS4Vo*|gd*YFwX`V89Q(WW=lsgaKT5~;eOVURZ?VnX4
zw|CfQJb7^B!kYZ1`4M6tzy7>>{pQ{kT&LXY0+O#DkUCfXcBPrL@$u_7LWHJWWOA4~
zoqH9}pLc&x1a+pVJuvZd(+&Ok@9n=>@#o?nWcErdomwJz?bzc-(ii@!b+L2Q>Fxdd
zWY?8zY99_ndT#yqdE39=b7!yKx2{cPmV<KGlhUh~IgWnc-hOSB!Jp^_u^aQ%9!IZu
zA+YfJZPQ*upZ`2Y?X4f`GY%endNFbHr74#T68tXzyqMVWXGeFij&p(Rm!IFZ3Yw-!
z>o@%R+}s<@dN(ee(fHiu48?tqU){4gdcC04aDnm$57s`pD;9gYZ?Oo8o4R!HJ*%-3
z-}2@-@8jJoN@rB=)7o<Rf8Q*Lc@Jmnny23UTkdprQ{_MV-5M8GEt;ac>HX?H^<_Wf
z?l{JN{p*|iSS9*sqNruV-rPq=eU5U^$oAP6V0XHekI&%%@A{1Ro&%PuGCdRP@48Fz
z+FZFG)wa@U)&Yf5#;y0(3O|0w@aEgOR*#TNk<2$dGwxSJTAh2Q>=`Y*DPfEDr-^gR
zUc6X+NX9GvoR7DHUdwu;Lp^so?r~0Q{;_M8o|0b1j*!CI4?8Db{lK9soy}0&lNl&9
zIXU25@rAd`wX|<``F%X~e&ZesR@a3W?#!$>vSFF&v1FCo+vX-}GkQMy`|YiO%66f*
z?XtY49tCMjFBpFO(Qmx|@CWw;Ct4T^J=HdTzOensnw=YW3dXcQpB|omIZ&@jBtK&{
zr;FsePfM0sNr>n_+_vyY!VeQ$Tjl?u@&A6k{F9ay>u>LWe`kl)oV>GZkA4jK$Jn-e
zg;mR~HNTyWzh@t<S)wa&S}JR{;|Jc(zdU=jPJY_-^^WXfb$OYW8<r+AJ<&Vu{%?D6
zhJn|zU)Q3OPfycl&G+3I_cMq|?nmr;#W|NZJ(}r~(5z~*wXrI!Z>!wfmvXw-dBYU;
z3jI2IIcII2!`A@Qaxb}~C2S9!@Bf^2^VYug%f6}YSlKn@-l-xc=cBRBx{V#lbJRJ4
zkF8L?zl}qtu)3h8!u=n^#ly4X_I!`AeLrcoszhUlC9`z=g`f!*Ucs{_7_nbIq1G^a
zir{qrQ#SdG-E;oLbxv|9n^5d^N;Q^suUPt`*yABwd~<rA-K*{?_@A@ruKbVvJ*94v
zjE6dV4zJy+c}>Z|wD;TY9Olab>ats^N=mOkD!p8^cqRAeERJU{E;PM-BGNXkE^XQa
zrPXijPRol}8x?N&X=t+N<>F{Jv$?8YF8p2ApU1p7YN@`P#aSV-RLRnn*R#*BO_2Uw
zru1RiQj5cLTJPQFn)*HS#0LNSC$H>jR({xf*R-JE$+LQ?g9SIcdT)sJ{i-vcd*ww~
z;GUG5-bpR4O@gJtX19*snExrOM`ZIh->K>1^P{V`eGokzQ)bw{>a3pC@_RXn!unlr
zPcr?>PTek}$2)K7y`-HR?^LLrTNAZc!S17MhKRnOa>A)e$MYR;7WtIE+TWYKY3=rp
zK|5kag{C<^o2L8X#IwEYSqzNX0vTVX8x>XeSMA$)d39-*jCQ$$obv=1=RY~Iv-TSN
zahbEb^>(s#wnfH|iijkhiV)7j`M=lJFa}6=$=?mw!>L}U5MrA&VOC|FId{O#b+Kl>
zd!)~WNHyJX@Sl+8P}lgd{YmjpQRNVGmV+z@-&>w`b6Bmq)bg~@;`F(fSMG5u^Xi{^
zrsPzqs_<Wp+|bk8Y)||a3XwS0>y;l}R`vV_hqH8H_UC(7B4*Dr?Z5i|_e6usk4u;4
z?Aq6{WLtNi(v=m$?hLVWH3~OvtGT=8j&2Y8bpM==qALcUeRdx_+gxCyQh#@o%S3}M
zI*;9)a;uN+IqBM(RAhEzUR-gkZRV@9lNQK&25&Abar(AfX<lR3yQw<=pXHpq{>b&K
zg<C>6TYb2K<^HL%sv^^W{r}&*be*K{<ZTPtID0?0+?qOZibLNAv)5m_SPf?1j?rh>
z&KvZ}Xx7&EyL4u43y*GG6PQrDVBzwa3C~jf51f81X#1hf>6s35Yv_6wrZ2AwrLVc=
zGkdJ|U^-oUT;4Qq=l`qW_V#OqXGUe|&X$tQcic01c6_eu!L_?{ZJExz{&_w;#Miyw
zKR8<<FH)mpp|RL0<5LT_i1NJX+%%()p-LxG`qNZ{gw5Ms4t`Y9njU?lX!F+QoN|}E
zzDE{)!G~?m+ufS?dG(pbWWH}fH7lK6|DT?d`{4wq?!3nx`{y6MzI;p7u8Q6r+c*B|
zEi#^;Tl;;Et=T52$xXpKl9xxtPgdKZ<g_I(==UTi=QnCAHp}gO@cCP2>)NA#mUL|Q
zf5h~`XO9R!PuRRk>+VlZb!p0)BGlHcl&b1cdR}^R=obxrf4)DrPaceA-_bFNrC;n-
zR>L0$H_fwdM)M|f9(>QX|Gw#z9=jJavz6*hG}>j>xvYOs6B2BD_jArwo}hF`o}}w;
z($j6!ibMHMwCcQX=X|WB^LfJM(0{Jms@G>$YWM!g>(SBrk+}Qb)Z=c2JkyMu+-%~!
zqPvte!WS%I{2I6}?XbrB+ROySit}<Ob&en3^d(YJsX;_^dE@KPS#=xkE{%EZ@#)I>
zzM}_blq8?(USRTWk9INl!_yx7^*IZt9_$V%pIddfpRv5DzwITjUHr|5(|D4iO;4`O
z%GY14FH(JHQg6eY$C>x{F#YHH)q7%(*X6BuZYLQo>^E7b(Ei%&kh!Q^SCwwvpC_4%
zTDBcL`DW5<nXuJTZBB^}@3f*OOXQzcKDJs*H<Hn(bI&8gl)qvhLfJwNTdA8cMNhw}
zof2@iBP##V4XYVzu5zWAes}9rld9b<x7kfR#8qfz>$-O=$8O73@0%Scp}D2p#UW5t
z=lCA2lWUSPjZRLKbQjX)NSM;J@0yY20b@0ZuTFtyFI2eOt$8Wdppntzeoi%jHLrgG
zclhPZO|l#%Vqc36FoX!_Z@#|Oc8bJ|8z&myMu+DL$=+Vocu@MV&wN9!1>x)Df7G47
zQ}wSZ;D5)oZw`~hZpofrWLMPnFv2VQ(h2^A?9U-f?T$D~d}3`DGwVF?jisj3>%+EV
zMcuz$=cE^JQ`pi|-4o=tJNd3#){4z97>@-oZI!C|Brd$;3-9#1Qx6FII?nH~c2;8R
z?X(rr5l=Jc=^kKdIN>vqr(6C6U)|{wp|fNr*Z<?*$EZ>FJDFkIhOSd-S(D2vLoMg;
z`C4;YbDKPG&OFA#I_-#sg3O+mJQtP+WHZFDbcy!tWm?_+)SLIg#uSf7n*w@uY^t_Q
z*&E>&QSB<Q@!5mFQ+Fz_xAHk~-8Ay#bln8rNRKBmCY)F7o_4v-R50YoO8m0=$jawI
z5-HKFdoFcN^R~Wt!}U2U-|8g?yr&k<YFcivqHwmh*Tn0lHOH^?t6j>}jIw99jA!Ya
zqP4-ILh2#6g5}QTTNs*VsP#XZ$g#2OlE{9ModP^}%=lt9_N;yL`O@x5{4Gr<74|(h
zj<^`%ui(DZhgYQ9$&LN!Vhza!VJ%TJ(jII%Al)457?C(*9hZ{%IfrP?bN>{=4+VMp
zt}<_OJ!-(iDb2rB@)uV`?xmkD+!C5aGmkBdm=dPC+jq;OiF121?i)YYSbE3t{$jb;
zCJUtN+5PgjE{?w6VD<cRcF|#lnRl&xzw%`|`}V!R_4>`XHEuq_4;MFSOi)^VWn%2N
zA9H0~opP=!X}<Dx=6<OAdKz0*O07xVe*5p&ByMr^-;~|9aE|4JV+RfI?Yp{T_vBU6
zR_?r|TDxA<@Jr-|Z8ybtK3L)%`gF!U3x+D@qFE~zb8nFO<a41u#2|SWpG>57;FhdY
z(PcH?r_@xRc-0kk@I>7m&dS!MQ}0%(RaZaB-9E37b%QT^&4h_z&M`rk_xLkpSj!4u
zJ!_<C!y{Ged?>H9<IH7UKG$2G3IBhpzFfb&ZJX4}`^6r);s+D0q)g^o##g!2x|eUQ
znfa@!o4KAta;Nt8Wp=kVX?>c?k*cowh+pUO&sJ5RlUt@rnCosy>Y4d+MvKC{XM6Wv
zTs!^o>7sy()xv+`7wtOiT-?w+-()=xTl(eyKR%p3+M2&4lErK149y4Y=5O_1xb3OV
zjq*=97u-vietVho!BC<5hm(iURhHcocC5(Vqn3TaQM%1FBKS!7bvYN!H=CBNyrao6
zQIwZY>mQ@Zj(?30?$j{OW0`n$g&OD4j&;0DY3n~s^;x)3ewx7X4=$5WMRNs+F8elf
zrr%Nn>r+QqMNE$8uKX^lTzJ&dN9dS#&F(YR^`&1gzf}L~C$6_mq`x&`QruK4+wXO!
z-+ZwNeeU+bzhU9tf^Hf9e+wg-xnv&A(y`F?;8_#w@V$iBtWW)7l*ZXREN31bn91O9
z!L!n#KHK=(Q=g=_%r24DMRP3}K0J9eH%oELhfjwV7>D$#gl_*`F3V|h>cZ28{mDBO
zzAh<r%3`hUmY-xGuzIn{mOP7ZJDO~`g$<4r9eWh?weq4()V-6ISy9Vh+*m0S@wUsn
z_E^bdug$+b!*@8GuxYANmrTCP?7Hm~YpYS^wAz#JLzks3fAYyC{;tb~-}@PVn)9@H
z?Q=Z+^z`Y*tlEsqFV|oCUw`4-xv#tWx4-Da<PG1dV=_!VmaksIyWI0>%K0A`*L5$@
znbiHQaD~af)z?ewS@TSr-WG+g>wD(4KD~X~K{>b8T<;{reno8mxz=ko*Pp~gA6|r<
zTo`cZ6WeELkC4yX=CeFfGw9v5<zmBK(^iI}wM@Bb(vH?YCpw$7*A^ANXp4D%E&Cap
zc|-lXs^>CJ*Jc%WY`HdP8;jNDca!`>)a+A|^lLwvTh{2OZmyi?{H!JaO0&iHCwGm?
z<!-bogqJ&Pb}4;sYq{X=;*A~2o$1vJt);{F>%S`LaEQ9JaiK?*BU3`Ys+;XuscwPL
zeN2XIbDg>Pazc}PFLzBh*~fpeMM3^0%NHx{Mwa+A&SqXk?#h`B+%G)ix3S!t@_P&a
zx6^+nd@lP{yjM(NtEQRP3Y)+brStCv^V4&D6(lBcF(meVvoOEZ(0%&l*_TiL9R9uc
z^kx3%@0VXUKlrrzy`P}w<j9|GPX7&lo@#0rRje?%@UipdR|WH8^QR8;7tY%I=@i$_
zyUyFo<dogZ#T3@r&ds}09dOUu=Bmxlj=uft<uh01wroz<SG;&ECokoWeMhIys;O@R
zQsO#y#{XNeM?J0R%S6tba-Cirti~Uzl@y+cU%0kp*OYDiK7Frc1P&)Z$$qYV#n7lZ
zQ8YEjPx0T$a|(8cc3!kUS5vTziFxTswba{&Uh0J^0wMpLSQ$(-uDq7F{MK5K-yZy>
z_(jvkoh(9+SD$#Ybq8k)>#MGHX;YZLZsKOui`ikZ_}oVGCHz|dRG&(P-nE!>k@d8Z
zLavUqV+FV8x}_W}=OdJ=%@3M|MV-~(Zg5$)T>9;7twZrf5gl5)jn2=XJu^4dSMQ2`
zUrBu;%aN#t<L4GATyQH`bj+_nzb&bE;nMoG-_j23{_L?-^%r~i8f(tEq1;XDJCfdu
zMaT%3ipiO;ITew7N+V#+x8@L&%iquI>4nVB`&F4Gl;_blDaQPU!uiLqUM%VATEKnz
z+Z(n;6UALt+-5i|_)k~pYx&B5`dmNFJyUfh9k#u=dAC+uyCi7RybkdNqFd)QJT^Da
zOFX&V`SoJ+Ykf+;ZZ)3aEZ^~ZPEgemtK+vfYA*0CesGf4=d$gK$qju9zAYJBC1T_<
z7G$N|G!L<5i!3fb&nEW3#r%u?)#|2GW_7JS`p37<efD$jH;)JI8xDnrSu8GWiH%Ws
z#~6Jq!BlXY;epkhO7*+h6<0ewW_HjKTA-!Q`lLT&1C#ZWqW>;$!|ao0Hm>77mNa?p
zpHrJu>L)C<*(aEIrYuBshUVUT@tpTXG;ipqaTnwU>`7nRl_xy&_Uk>$oF}RiloqOr
zm^1aqXFV%Fxk-n+aL@Mb3=6W@HbuWZdEa8v*T!GF!b385m6w!!$Py3BjX7y9;{5NI
zfByYFwib8n4YC*QzSn5*bDod#%YE^(PVPoQ_Qym#+T3h2``+{W8K+21+q=@4<+j9*
z=pz<vdE!T-Z&W-^V&AiR|L6Ot(`8l4|B|^m85qhGF;0AfE%ZxCEhtV-%+o8Vd@B_l
zd}r6s+WJ<$l4E6?UNc^5zh-Olkijx_7B_Rsvn{8uE#8_M@Mx=yXWQn~Z|q<5zfAvn
z`DonjO`JZn?Mim>ADOoAcWhDF#iu_{>TfPLQEXM%ym^Yqq_im?IAo_<>{Q*{T#&!1
zyDxI*voFuW7B%l}wk;|3zEG_c(HK<ZUKF;Df#0(!T=qu&Kj+5%vkuO`zi6}5BpI{H
zlNQsah)(uAc9ZL9Vc5y8$rf%Utkpsf7bOHWcbq)3PF3f;XVSGdm(m}^+iy<WdgPPY
z^3%_zs>K%t?f>}9bDek89R-~Wq90CN2(9=!{qyA?Km3;;uebaCq1eRn!{twsCuaQ7
zI_T0>ulvkei}UzTk=V7~ljdD;@w>>brhnpkSJ9+A&6bBk>hT^E+gNq&l79zH-g)Rx
z+X>;ILsFWPzNRw$60QqN$yt;c(e$F=^oi@zub$tG&A+8%YvM1ZkZx{r@aLKX+K*g4
zJnY^wspN!SnzLlHsQ2nQXQr?+ZdiIsW`dZl&OxntHljPUUR>`w6JaRr9&I%3`^TbV
z`$C@PxIWSKuKsZCPjUWEvt7Ou-MdxR2N@kc>U%HpN0g!Go}-Ht_Z!Y(N`6#)?p=me
zTGH;{`!kcY(nO3Vr&}oYH<$aCF;?}orcAX@S~Kag=(E?7t5YIR=4+=taN+-;RpZ`z
z<wI@Dr5)KUhpjFje8iT=a(dtPjb^#oDwbkQa|I?AM6J?#YTm}V$g{cFeTSB!Ak$>?
z?m2fZHijB3>IgV1e@|@k$tOSl*w|Iq|NHnzYo7({=VGB-H$Lqwul;}Mnn-<LdcFOu
zzoq%#ejh#kfIn`5pntujyUPA77vcHLKPGQ)s4D!TX!pC|&%4VfGi&NfmY#U?=WW!U
z4UugA#qX=qAI9I`zlZOk|AP2(sXO20{q6R?UKFR#d;0a$traT;m?OT#yW8*KiD%KT
z+kABIpD)4-z8AP&b*e9XtIc#V+t>ASpntT`e7)U!v>lhN=iS{TY8Wv;SmUE-g81SS
zHj-Mky1&v&rp{UQcJqAunmrb_cDrnNf9>iCys^s4%W<VqTi(@@0`<}f->iCHmTI0{
zAbPp!l*KpJlbct*om<Fu#5d4+LigEd0n?3D{!ew29IoXrbolzzTR%W|+nGgvn>0Ty
zyi%+0xADluWM6?PCLxFCJiMa6IpNa6<Wweu-&gLMT@5%;Ha~ms)z<A-m3yaWPp#Ez
zejZgGn$>XX@G|avA$J?jYbojnwk?|}z|+4vW*KkM?k$WH1taX)7bFB+kNBya$9e4n
zbJ6FcOFnLA(9VvJY)@a+7#aTjg0u1!lbcI)Lha8ss2p$I&T-*Qe}D$}rms3afn1!j
za(NHg{^ZS=ReLyQ^W9ZWMUKZlIP~!O`A;>wy3dPQD1DXtsvkzi$rXJ6zb!TV>gteo
z<kPgS8^>lTT)NN1m^|fjlLM={i?d&Wl(&RbEl2vaLoAgq94pS%v4^S5G1lX=tqL}n
zai=L@isjUO<*^lx;f2BmAGuDuoV<DVUx5DauKWuJjpmhan6=Ba>&BGJ6)i5oJKQ`S
z1h%xkTeY~3RdGVB!)9Kwdj(-r|J5;A*7@&{x5(ICQ0I`}TYqs@=nJv?f)<(!yjED+
zsRrCRvytgxjKNz$&gCMD&ofxMGBX{w@@?e$U>)?1H&L!7nRiZx(5cB>9L!7B`b_D#
zu#n9wdh3G+i%#&e_GWYCehQ17@%ln^%Z`vUHO`j|^KYB#`EKTZdb;e>VZJ}x-}1;d
z9gw-8{<$NLuTyb>!19&%m0ua<Z@F#6w#+Y5&P3&Sh`<c5hkte{E!R5y=S(&K(Mi*G
z7HWS{w0;(Si{CbF_J!h9Dcv<&XIFh))O>wX)xG3pSsUGCk8SbE@i58Dx$ryCaL%rE
zE6Xk}ZCSLr)!jN@^0uS3ed4~wRbTy%MQmviH$PK;F_3%x+@gS*i<1_pHWzXApS83L
z%`e-MbCAEo^gzz(Q^$V`+BF0|y2>CiYhhKHd&PfVI}X+byv$AZm$WuEtZ!rVKBM?`
z?abuVe-^7h#a#X4C|z&8Jf>^cbDm8rs~w-Pe%{+EE#1p8?aX2$*`Cu=HYgq3v}{r(
z|2mu5FBYE8dtAH!O~%R3cg|!i<g3{GPSUsMM6^!n-sP)BJvFBt`L#%od$pH`>{-#X
zPZ^G?o(y5r6!JW3s^%lAxNFziBb$|PZ{W)k6!^7K^jw-DOT?4I4ilfhuJUw!C!%s?
z)*3;bMJx&n>=ahdeV4XMjPL8Eg;!RU*ViQ3@lIe>(quNds_S!{<#a~ohr078G%xt4
z>}xZ2Wz5nP=hS*Bd-8hT!^$O|eM<uCjdGqH`+p(iN4(SztK)x{pR1m`_}_P_EAt*N
zes6i=Pkq}D^Rx~%cdM7oQL}XfZ7Po?3NXws7F(0LlK<J(4F|T|{#JIeIyuXF#scZk
zBo*g~YL=H`Y}NS*=XFDQ&3r7AXC%sd=IU%z(4Fj9H{H^&<JFl3zogG|rr!vd7^ckQ
zy5(;ZLyE0x#`d|pj>oZ|JowNhY>$Ia%PzLsv@IXzX7^3HZ2f}AaLS#PufA+8oBd(o
z!hM-9lRK;UXHQ7$6mR;k@Vw@@_g<;hj3p`;oZRMmY5K63c4h=8ekpPg&uZQ*s(m+Z
zo!i^lVWsCU?LD=1`<l3xZ*#rlim!4-SO3*5O>6wRv-s%kjDwSxzgWoO`t|FN=Eniw
z|5ZPUd)1(8FI=k5vTWY2l&J4lKQH`yO}C=H{xW}T!o}+=tJ|MU2=_WSdv#^)`Xw9Z
zItAU<iLg1gWuHXx4~^Z-zH?XFCgjd|Xq8v`eB-0S7gH_@=)8?ym3MLLqtZ;7S4kEe
ztLqG!yrM$#WbfTt^)dXi*xef|>i_b4g@s)|{c3yVB(BGsz8{@^{+oDWsFTVhcb6+k
zW&2IG-sJ7RrO;QyFU_-%FH+e1@fCBw$h`KO85Y+SzpahivNe2i-2H;*n`3SozgQtV
zKXw1{GuMp6S06c->zH%p@vmcP4^Hi`<>a6HG4AZ{y_^yCEH7%A1LEHw-V!ynu3P)d
zaxwnf9pBW1uO?T7{s>UnEq?26U9$fAq9g_8soU8VF7wWDe`nczDmG-b>cfuIf|Ok=
zul$b^u%9vQR>p;2EsP%*ym(QYxX<Ijq|Z|q{l0ow$Y|PDt%#Jn_Z}Gh(?@MZt>K=#
z$efXZ;U?})D=C>p$r*`x>EQWK-wBS{hYfgI-~SVBlAUxw=+>b!jS_=frx!FItdf|L
zw8zDhXRD0P@-6@Cie??EG5EH5-o13&gWs>eTYl%ZROiM&850)e>b9Bg;a~P{V@xRb
zSC(k|J56tYajZW2Y3Y==qI|Z8)HkVTd}vCyw=i^ec|0YnxqLyX^)bT**AnhNaAt9S
zvbgh_u=do{n`P|N7PTK^d+~;qlgBxm**o*av6TxKvVG|KDiP?~xn^&%=kDv#O)6|6
z-TBKuA3ix%MZ?s+x{gh*zWqV=lahTOA8X!Y^N#JZ)3}<zowy`s*9R%StM`g*ig=bY
zo!aiQJ50g5<D^B4Z`b3;k4#qbZ;Omw=bv@SHoR1STFo}m$x;E!od2&_b!*P~pLdoB
zd<jdN@hY`xHg8Ilb+YH{H|G@MSA57yo>y_%)k$A-i^diC0B>d%5e5bZ4hGp~iD>hK
zd#1?=GBC)y;5-W?HLuJlH!U*<w90F1Om+TkH=+OW^OF>}E3kTJ>1$j%)WG-rhTo&^
zT*-}dy%%t?xaz826FK?#@HT-TcE8WQ>E5m4YUr1xFxBPUxija^J>I@vZo=%>m(MTm
zKCn2@&HcHz)YC@!3tu{9)YolawmAH8d^P(M6~Aqn8={^+xw?LR+{D|as?$xnl{YQn
zH|d$oyG7Zu)O_!}`NyOmS=3Dw*DRG0%9&(wwo}@*@ZB><nbfAVm(SLT?}~IY_FN*z
z%c&u#SN*7RTdTU^pVM8gla9%`cICuAaa`eXO|f>8{ij?Z7wt!BPr^8)`<L=a*;W)j
zVPE~K+gD<BdfXn*rU}cujK3~$GmN`5r)uXbrmuIE&KQg6WzIQqH{eCtgUPo)zMcNs
z`1zB+H&3>IUR~~P%T#~K<)v2P<(_W`9)uVA^`Ce=%k4<4US#^E(8jd3dFqO##$I;}
zx<Bfkyk6q`Ny2{SnF)*LHhMo>>d3T<Meyg#PjAwyN<V*mB5v|Y|K_Z=hbvUh)xB(d
zcH(ScQ_eEp9ZjmH((>Kq*WdJ-DlD#VS|#}O?}IPNb31c;-Mn`d1n1}SE-h5Mk#b^|
z$=}ATlSiE7qt(9OD9o2#(0OqFhUwZ;7q6Usc|&T8XKZC$*pIpoOHRK1{@v5ot*r8a
z=)&1T3663J9S7}NJ}Vit2)h0+zMQ+8$?$~l%ldAGrKeBkMg@c@pH>fxd16=5di5xS
z!)y^t$6vO0zh1I9y=C1#*7pn(*R?OU-nhx8E#r)1@7|*OoWF&p8!S828~LW}q6*U~
z_Fs!bAI9ttoz66Ami+R?u7WM6<riI&WtsQ6?AOK0;_|w}uA5I7UET*We+u_Azc0bC
z{0hI4S4A|_-WB}E?KU2Lv|Hu$Gku{t|H~b1`jgMx-siDqx`_T{PTqK}f+xFYE8MAT
zkGb~G^-<;)o;x1Gxvh@#lB*Q&S+(t&=bLs-DdJ%M&$N4i#^<b>Qnp8LzPCT*?7NNs
zCwVvUUifA6DLGCwWT{Qlt8%G|pE{>6E7t7iF#1+&r!E}#KKCN$@%9rvm*1vvKH2lT
zTcPN3L!G?v0Y1*wFLCL`;*RaFY<3%n{yiM{)9&pdg<b#a^zI$oyWD<7b&ukC#uJ6J
z9&FgHn9bvR@w8><8IiRiHmjmN6(qjxEw9+HWm4h!yPlV<9~@-aU#=j%f&IAO8k>kz
z#Z}=)RN1^2a0ziwjd_?HR?)(Fd~fr;gFF4V6*^8cWVG?w)Kb;BKb6-_*~N<MIWH@F
zhvtvDjGeP5Z|P8CXui;Rfi)mq(Lw4Z!%3xnM+v464f297W-jBI?PRb_I?!}y-QMQX
zIZt<`ZGWvG+%YkSt77{C4gQ0Rr4tu&U$RJYkWbKb*f{z1>+Ryl-{*0#zL09V7hw26
z`}o4W%{&JBl?8{HO4^O~xY*tBE!e<x;;YRiYX;%(d<X6eG`DSJpH?Ph9)DY4!|E%n
z+nXLHCj@_vYn)p<L!xJ5g-psjrOCc*?ph}~lg}KPZCTxzmSE-hTJ)^!FBe<A;Ov*p
z?H=#yk2<F4x4V1_cZp%X?i`Zw+rnS6zHFJiiP<h8JMsCu7#TYKGv;kJ=?&ifzxbHV
zq5kd+&xAR3yX^MW-dDGu&NQ=BE?6RKnySnR@hg27UtYMJ|1!AFPF846wm~&-=NVP&
zMf;oXEtFU6&B-xQn9TWeYnG#@Xo};Mr+H5T-E2~tgN2%-6H^w-J(=)D{m84s>OqhE
zU!PxbK3PQI#yU5#nz@nBPCF;CnD+EL&;Q6HaoA4!bi+^0S8@4f|BWA=nX&QMnHIBs
zqGm@wri&fjIagU>Zm%Qrv&*j{k0!)T`mvDv?yL_tpIdk@IK=dLBZpXt&h1HsO}C<%
zCoZuzU1MHd_3Fxp&(EVSS9}atUwGO4|GLvhkKJ`i{>=9B;U@3L-NB0$-y2CwW~^9K
ztFcD?_<~Lc4Q-1Rhq^*0xvf~TL&9a#X4RRSoSQ9Dqg}78n3{HU(rmqLGRncW2RC}{
za`x;9SeGIhduHl!tALr2^IE@72%h%Vizg^^P23dStIAhnN~-%Gs66Ch*?Mo+<chVm
zzO1HBZ><z0lNY_<WsALH5NV=y>7>k@fWlQ0ORc_Cix^2x_4>+p;+QW-^lmHL>c@NL
z-@9Y=e%-q{lV4k}xgnF4Q?W{Vy2fcaho%^dr_Ag(eNKcgYum~>>CM-CgVWZN?jQYg
zlPm83N2&RC2iq&A9O*al-E)2aK@paFDnCT;*_vyY|M~c&c5#}MDvPa;zO$nF-8Hq{
zYa?>&;@kh_{mY$uz3T49-S_XAr&k3}KYMY8fPDJ0FQpUpCjQjYiaRi?Isf3S{{}bj
z|JGdE-P1WCzTH|S`J#_zLO{P2&!JrlAMcbroAX#aso&fD;MRyfJAtwcj@GNeKc4vY
zN(k69DjG{LWL#;rJS@h&`(T+y>STru857n^u1g6Jz7Xz}^kb$S(>|fkX$)^1W~{%w
zBVw(mU}d&>)WxSaCTM+_sn`*!dZqQX&IKl^3G07a<*d8PAkvnjdV5Yw;(cv~CVum1
z*=fm)#a~ubI3>q#(049Qcz6HMcXRXQKVtg0DmHyx^I2H?N#Uv)P9_}-Dt^dLPm!|S
zd9(ZB>&+{)Z7LI|r~jRN`Z0g{xz1vvy?gBTTl~Ipd`t3@?Nh?Ju9^66->Q=F;pd-9
zdG#|nGUj%bB54}(FQzd*pQO+CMb9;V-<>=2Vy(iDPfzcuKl;g7X5GxtUZrfi`-eaL
zdi>?dn`ddKw%!vI;$3`5)@8EBrHQ83=lJBxw-naItMt|_^I=hn*kf41zqwI~GxKGI
zK&i#u<j7zjzAL{fB)gWTD=p$v^xE-xv*`haRUE->)B7W@_;uvhhHjeY9zXHN&()K@
z#T=?StbK#SDZBRDa$`A(DWU%-?0Tf3(iODB%kuQ94(E2kYtJ6`Os?*D>-xYgkzu0j
zW>$u@>yI-|=Y&MxJEU~><guj1%<BHrqMvMBdNX5lO7W~;Ew%Ryq;L8123i&AvP@p)
zbIvtK+-FPerj6T|-P?Qk{*40_9FhhHVtETLbl5#oF?#%4*gBlGcfU^jC6l=sLVoA%
zV(-Sr@O-i9nq|G~nV+2XA~8#gDzobu8rDjG_a$3DJQB;sq0GDaLGjC*J9c#j*B|rp
zaZ5<b%G?~`W}GOWEFh|~&G7N_^@($IFE8I?aZ0f;`0Ix{4>=Key$q(sKl&$0pJw^~
zVkiHbnOt%emnNtd{133;UEH&I?#$&bf?I1A8{Jv(BxK!pf0fstmPSm<7Y<$2<@d-d
z;O42TN9N^r20!oFwt9g}*jec>S<(F0|KAGDx$Ya>x8C>K@o6((ym|HI&kwG)>oJzc
zYq~iPwsmnyGE7=&dSl_1vtFt~vU1x5Hs0h8+Nl4wq)EQcbzYP&%iJvm!h)MNmxQjG
z8a63Jp+9u4#Ea~psU`8T^SmxGm^=S_yljU>mCK?XQ(WW<*G^KeI8c*h+-f|fn#<V1
zE$7}6@%jJGOD>6vX$a0T+n#!J;YQ2q%Z<!YW`5gxZI0~bi#e34++1+;!ZyYUQ+p&X
zto)qR|2yhl){%oY9Bfu0*{k+*t=ahWg$19X{P`={*`{2V0xQ!}T2yY`)2Y{I-}x;`
zvihv<lbemVx)ly>IG26in7{l04`;;WpPWJ;OXA8_vt?>+b6q-%?d5YG_LJ9`m^9g!
zZnSog{9_}~_@u3^u>HckSz_CCE1uXaGq64UPO!UizMzfF$@b>`8><zb->%xe-`;?+
zWTWzrm!;wRSSHqQ|Mu1~TxDj->Z%u0^?%=W?(WXedHE=G>x0$oQWLfQNby`qcdZg#
zf2DM?Pxbn}0Z#+8`}X|Wy5^L0z+~Ht=I$ynM~?nG<|%xe?ZP+D3S&e6!))#;jSth$
zb$;?yy8TdS_OCjRHUB?)@<w-e2x~-0=~g^Z-l5vNN8)^;?;54=?)4GOHVVhg^RJwE
zd0Y6J&o8!jaXhm!KP1fi5ZCN6f8WNZlPy{wh3hUh*mC=f9M39_Y5VhLw62bvc5y+W
zd)5kHdDUjwxe2r0zq&7Sz39rb`n8h<I(loT@Xp%ZaWXlm*Wuu*;QK7P{w(+Jtd`8<
zdagXDq2Nk#-v;S6J}Ld=%WXQ_jSsB-IyL#`*22c!)lw6qzD^ZsX1kYcGClUY#I|m=
zPOX=h!bM7ReJ<JNH7Xvy=MZC})2V#2=7QetM8`d=6Rw7M>Wg30US!>$QMn-{?sK3S
zb4b_pDUTTfH^hECD|<_MvR~E1e>pp2Qa_oMrm-wox3FOIrJgO3_s?0qzrK53TlALn
zr%oxqD%Wybt-b&J=<#2xye=BQb9$c{7-qV5Va1N^dsk&`(yiaHeXiE=O|tbDF8K8p
zSAJV&rYCwYYHRqLr<=_<AKf`8_l-;4<KCafgfr8ZZ`wG+Wj1Tj)k}>VW!eu$?9jf|
zz?4!b$U4WqY|B@lD~E;D-F`%^DEoBKhAnYU(B$8%H}9NPpH;d=XKqdZot-xO_Jtka
zA$?=Zo3i(hmaa{en<abs+vW0CrG+(L-@W^B_hxT#IrABr${!AwH`r{QusHFJU%L3L
zQcYR5t%X{1(~o+0Nk7=O=i9!-tD8IB*K#UfDnInSH{`0)qX~|#IVV4ExGmW_?chq|
zHD8?^!gpVLnz(eUq~NOXG?Ohm>udK`JwMdD^Tqj@Ue&9jg&%KT?SF3h<NmDuY=5`K
zNu8QHZ_50ImwH!hTo-XMBKhd!0IB)5+-q++8vJ6JH~nVR?Yk1?%L1p~IA3zcOZcvB
ziR9Fsv7g_y)a<(bdbQqxX-2!%jwE*5W>1P*c34$rQrGpU>k;n{r1(mlPRN=!cg6Wv
zF7H)??w5P5-YYYsI_ALT4Y!!yUp3kF`)x_p#W%0^XnI_z4EYl!sQ=-`opTcm+PWui
zTeqF#>vPfNPjt^-34C-;KGpu-%dEOR{}^1;tG<4dF?#!R_T|t0TYXk)Nf>ebSb2O>
z_RZ5lk0sabw5)MB5G{7PLH{~abKa~wH9LP=%)Mu2?<IS{$4~0`&P$8-b!+q$ndsSH
zF<<Mmo`q><d9L@}2OGY;mYKFIF7cx@e^{sA$LTx77VOk~=hPT`$HxEZzGnemtCrqn
zzx?(?)}0xfidXF`J=EvGU7X|je|5sAJL<C)PB&$krm#0Yeb{r+BS_=R_3~fNm*l^)
zpMT6%(9W0i>s)SbvyO07_t(^eJ-&Lc%Gx*9KHQd@YyWV{$D_N;|6JK#$MQ?Dz%#cz
z?0t{U=IU+J*m*5hEUtKL{)D+)@X{LJ*0c``^k2OH5T83aY;pF<<7~0n&u(s=)P6nY
zidxVE>qDER9<Q{LtXTBt(9?;0pQZV%vkNu`ZIt%6>;9_d?x>`?e9hCG?cJ%#duChJ
z#jxMIHLYc<#^Wc|1-x2E1-?v(6_|KqueHjHHt)2UnLF1l7W(V!;JDR@p(*6A^oGWq
zAXy&U7p?IYf2tB*KK|{WFaP0<!vS;m2~&&qC@S{XbH00X@41!UA=SvEEc&)Rvl~7M
zpZ%iAUfyNpcOjO~y<UISy~h%36^+(tSY&LT)$?Tk-HaWFgCf`GI!0~X8ogn`xq~du
z)oYGkuj$<}WlzrzmR)<JW3<v5D)J=4B)+h^t~jxRS*_?s>%t)Bu*!$?bMHRvFpaT&
zY92Y|Wo}_$*j-nqV=0kKQe`jZ-Q(Gk<#?1g-Jxo!!0LrInJv={7vC}Vy!tR~`HQzv
zxou0B^DiIYExv;5bJbF>?iHD9dV`eNXYx06i`N_xUKg7g(^|hqztGXfT&Ykb@2ah#
z)P}zTg?FX-cc1!w&3Rg|n4wR-E^Fq;z}Rj7w#3@)W>ZTw=a{-^#&o9J3>)SieK+x^
z>ywYYFBlAzY!>(@JZ3n^bx)L8m*MQc*7D1rW_)1YIcX-Jv%t02zfSkPG;yoDA?%kX
zuKoS+&Xt8Lt(nhArrOl`FrV)JR^2df8iUuVTffY<9BMA-H4ICP^4ESFbMx!BxS!kh
zDM!uQA^6|AsV(+`<9oE#{PHb3v#zr+Fu3zEFsNeR3z=F`l3J9Pm{U-cpOu;nI&W%j
zcy#`4Gm*OM>mOWT_gbNwQhST1!eL{HbE6rrl(@tL2`1e@KH*Lg53Rg}AN$|SbnUv?
zW$eS>=~DOnLyW!Le&zD**Z-f{-!aAe@bme`dTURxUg!R_G3h1q{Q8ddP32GgL-%HE
ztlseC@YVJECtqb&kKY+MDdo>h@l{%meG%tQDV*4<<vHoe*0rYoLQ1E+GQDR^Ic20h
z#l-Q!^(mS6XWR?*k-k?qyDB<!YEiOOt>|X{)*IVS<vrZodTYAZ3E9N9HGdu!#w^Np
z-m_|l56|hJJu_Abm^Ct=<yo^mX1dd-l=WYPuY0b_%4}B9oniRovj2^#Yj#|HHF0^F
zpg@JuyykMJral#uJtxv#LeH&reePOw_yALfe7}@pjexZG4TaNThidy6-IjZ*ePLkM
z-eBOCn;n><Zn3?rP2^HUn237B{;D>;EALo1wbNImuiJi#=kEt?^>q<pVLLV24&>$X
zoc*DBVSP`cYPFNk{DT`>ANz@vaNf#JtbA0uL&r7cAN$V0N#8kda{qSNU~p(5ud&nj
z61N>bp=_mFmux-zeE&rbZk_k7A5SKi`^~s~_{PJ>O?U3!_m=8?=q22tI_(oryur_a
zW{n4Nof9qyew-)j|8RrYqK_-jx$EzZ%TbVfz2;&s*DYD4A|_sUqb*+1&F9)omR)@2
zBYEoCIs?ajo1gs&sBu``JTGgm+vCYv2_li7JsFNM$s8!-+kIgN^CHh0=|Zm)4{sc?
zVEgQy<~*f$rl(fwk@E&!rt7&f92%U=UjDUR7+4af7<=qra&O6x>#I^^+PNZ@*k8IL
zI%%S(+|_F;l?TiIu8dyV6}OGakMXI*%)T9m_A%d^Y&!S+!sk3!?CyS9*z_jkfrWtn
zE!I!oMXX0=Pn__t_H%O$YvQX_Jr1W{&U<?Hdgs+%rcIZcm;BtiKY}s#UgZ;w<>gKu
zx3itRCvQ2kAwK%_W07?e3sUlhuYEo-=f;(+?nqX~lM9|c>u=Be#<%$Kf{!J)q$a$G
zYP&L%XJ)o&Uk~F4eSu9U3tpJKSU4}_e$n~EJ8IZ&Jha%laoP3x@4~Ln-+$S6b(X`;
zVD)W^3+moBZPraPn=+rb|9||u-NMI2q<wS0-4$hBKDFd(_{7aycY5|dy~_0OmE;Gv
zNT-*2C$#=4^~4^2#3ubtGJK!qt@NW+qVe5Vau;p5mmsjQS^bq@*^BQ{UNT~Pikucs
zchLEAU$7?V{Gx(~+J7%89=pDdndxWAt&fj#R&G|^^01d{%`<&Y7n$emU%qtgZvL|J
zR@m0Bay-J#E_Qn=k4wHfBID1iTiLr*?TGEhY4<jIdc<9MmN+3RZqBTr%#O+kKCMmD
z_WgO7)-1ko>YM~dpVvEHN$uRR&WJ6oSF3cAY%SYHE~9l{H_0m`XROb+56fehi8MQR
zCT{PBJComSeroYFpQEAGJO9h;nwopD5mO^1BY4;Ss;&Rf(;$A}lHWUnD@8poJ&w-)
zdU4L@y3WqMk7cq&)2?pY(Ee3u@5D39O52aIFqRpZ8T2JDPLtifV0L%mhBs+X`m4ep
zpKpua{`mF6#-lo?3-%TNR=iW1A+xt5W7(6_Gs>Ly^}I@de0oQk(Y~I8(GQIdrSt5X
zvh+lzcUD7rMbg7>dsS{0zE+)(p8o3Pb^g;6So+KU&vKOdZ!&8E+w|r3wYMyHJN~eG
z5PDg5!mfI>6MR&5FWJ}3!oX0=i*vn1dTL2YY6Yl7+!~gf{n$d_-@EvQi*>wi-0=MU
z(1OWwTh8sJ7hX@z78CO_h>G4;x>a?)N`6q^@Au}DRQEqw+S2^F-9qZDjg)Pb$z$#>
ze@Z^<)+BH~?P~k3`E*ul&neYi>pX)le9($w5r46H#eJ32+`a3>rrR$rb-b7#!r2$}
zt9ja@bqai$UaJ&NELjmClir)B(wlr_Rg_0B$8#s)vn=6`4|1G-*1J42o!IqjW7fXw
zK`J4oa=+H5*|@tbEER}|?+lBLDbf9WOyy%rx?1pap@}BFowH{@a0wB8sA*>?+x9j4
zoTuwY9<yl^mtE1Wxn-$3Yl+XQ&wIQNeJ+l5b@Jl6@O-EC#S<-UK^(Pd4xj(#e2Dei
zx@@;#QM$Ec=*m5djN}Dx-n`eHH0R}Bg={NH=1dQvrqubj8Q466CLL4dSgx40C`IV-
zwdo$2maY%iXUN(bER9dt5y{3ekNeA?W2QG1Co0Aov>Js4vAhpaDRZ5*sLAWqUhcKo
zTj!kLemi%{XEh<C`Pvg->P{?q=P|4KkyOw*?%1h@;+k`>E5+%o+tmL1xPJWl`O3zL
zA7kbzWG`Ga>xI&<V1sv;=PABXN+>=SdwRPWzjXE$)`|MF&uvNF<*;a3&7+3&j!!O2
z3?d%7r9afK$a)uiZSf3s;Y%q@x1aqE*7M|gJtLgu$i^xo+YgD6ui3(R53c=w&Lt~#
z(yRyEHnuMBwtu|%_`2$4<{Hn1%RXE?DfLos;a0cF))vd$7ru8nd^uXPb<RR{E$w9@
zSEREg)`WYrT{`(8{o<6|I>~02w}IAeXYc(l+w;GfUx;B+bg8M$y4G`=@|oFfe^?8h
z!$a?!n9gf%aw(Q?sfF{~*1of??~ZbL>d*C=vhC!&D<?0%f4%#6`|al)h0|^3blhC=
zeYy340O5WUh37RN7<JPZfBzz%df!?4m%T=hox=7v5lQbv^q8}Kxx$tiKDEC!<stv%
zCU?$~HJ;ml_I>7C!CieYKJWVL+xf3&zyA95>|gow70e!X3u2x3cz0UIeGz=f@#H~A
zVdS^DI!%k>{NnbQHF&)+SE*FB<n{f-#oTn*XtJrumU-U{ninoFDf{y22Yb7Dg^H5!
zKdI!;LLairH#Z*b`Esw7sVYo1aNQC!(*kG5@71%uKiw-o>rm|%wj10wm;OXNba+&+
za7Ro}d9K*L{qNt;k9(PLtm@w7qVA2$pFF%MW>VREoB5lI#IFCZJn{wG@^>Hi-LIu9
zYFp0eyjE1;ap~eh_VnCE7ZZ5SR%|Hv9-CN_(jL=t!Fs1wr<hQ_+osqO(Y&I71;^S|
zvwjD%|JlWt8^6q5Tl&_aLt&G&OxrK)a(@@RW^Km0%Ac0jWmo0vf3f7AnscJy(xg^7
z*5&K?54gRV#60C*1y`0p+Q*pBIrjZ*9%~oQ%}(9Ce%ZO=ikG)GWE!kFP<`u*wf(ob
zm)NU5g>gvl)c^kbVxs)4(w*O*9*f>3^q6<wwX<wC-!?bvZguxOUFa3-D4}w!&-D0z
zP0cTtxpb!;w>~oO;exWS9e>x#M%>CSo3Pl{)c@FrOS|rUo4UVf<JPVBPuf`h>Da;Z
zj}>*wtjZ-X{~b32L$x*ogA(?3U3y7&N`7)iYEA)orgE-SX8vu9Z@cSR)m;^(r(R{g
z@mJtL_sN{ga~U$Fw`eYF&QUlal$)*8&F1;s;o|>&?>{c%v$j6wqinygyZ`-?uT3?3
ztNz#4MNZ!$T2dEyG3?svS)YQ7wrQW@oxA_^J)gJ<^_%YsufHzsd2es!?|#capZ$yW
zE_|Xax<*xW?{ePTxs5YCqH@$Hi>60UdcJz^o#I)~m)v_NF?~r!v>JEh<}e>MHnn*!
zUNZ{fzn_*(R~41pbo2DCjrY0s-4l%o&{aCUZG~g7{@RY0EeG6Rmi~*lB+KP}QuOvk
zGx4Kc%a(}!biNz*#&N~-Pno>&SCtLgbPvey^c0oen4LAV*<+$#n%g4LkU+)Nv!2&)
z+_m-8$>p(k*Lf<Q_?oil%9E6bA?MEhsOopy6{LN6=FyW~tDH2m3TK^p-t@N8v$1-T
zmSy)5=d@&()3tX)6nmL_CN*qSR{Zr^<5!!Q=+g!z8BYc&)!SmFyH`oS>X1p8(-Qi-
zZQD^Zg-;8VQ@&5(w)o1ow6*WOU!Js0*8c4R8??Uh9^kvNN#|CF4U<jx9Nqsywqk-G
zG-jJFxE$1FxkE|x^NBZUy5Zh=Pc=@5{{3-+Q8#1_xAm!%>Tq3UKEVeXmBE%ypDU&;
z(UI+}tZADP8q8wVcEA60cjoE;?Nhc2$z9E4l`%2-eqnLXi^uCSRtwfu8UB~fF%)>#
zDiCt);6(Nfi+x^|p0+TxJo5SC0~;3k)K*UihssauWS#q}l~*r1^2uk@F40XHvkX$D
z0_qI%KkfB*`*xE%+R#rWnRjJ$(PAe#fh+Mm5jDpmF4kXs^&{nx{!ZJ_QZB7$v&3)9
zoMm8Dk37A*YwG8gJwbC!&uz%-5S}D$>l|?G<vPaOOjf7PO_mJNyTN!dspv)!-&&_i
zbKUJ%HFuuV%T~;9d9qzoQ=WmTU$ar_Ecd@9t5!R#IlszG{H(7-0r#!?B;C0af9}81
zd@p`)*U5zu?5lrtP8WajtZdP>jB5V-t9DHZRx|n$R($Q8PVjv$pLCYKgIk#|&rIj7
zIC=Hv*Y})q0tFwmZ4XM;w%k~?tf6#qW}fj?=LH3=j^&$YF6O`B;MqSZ(ciGwB3tPe
zhm>~NPrLnle!M+>bGrTK{fm>Q|Jkw2w(IdM{>a<f9Cni(MFRDf=LfxEb99V)m%1@$
z#ll+0b>A+qdz}y{a9f-5<BUMac2!mW5Als_)tUX<QiHskR=fWG5@3_scJwRToV4Sb
z9=nz|dAx{|WbbQP%b~&_xMt;r9lJv&>Nl+uw2ij>%=FLyq7e5Fds8djn#;3l_tyRY
zdHd^|XJ=pTj^6!I)<wYNP%h`pwm+K`^8dVRw7TDATJ`4D6LycEt^ZY4GZhuP%4O|j
z<ZQje{Ym*rVbounoxFD$uJrof*>JY&F5h{nYkv(tEfU*uS<!#;|81RiHqKU?<*ujx
zZ>q^wOg&i}?QzRyqWzbNtBPADD+k20G+%Psc2qbrXp{IVRkamA_<CdvCe3!5v{p*{
z6z}fEzkVo)Ts_Av5Tbl_=dCZ6&v`C&BrI8IB*-Wo>y%KWVZNjA80*0~w>GtlL>G$e
zZGC+6(YA-yJGj66+_Ca*oL7KeLh2Or?i6RsvzyK+di)c)9jPrdbGp`Sz8Civw%l5|
zc}3Rc;<?_-cbz|PnSAMq?_L=OgQu_j?lQ1!XAn%k@3G)l!t=FS`xURQE&QTt-n)tI
zTjYyF{Bxt#FDD<AYMLEnx}~Kwm*L*@o3CTup7X7@IU=)a(psBsEK`>@uXuN+saZey
zcWAHQ_HC_mL(+BgvaPz;MN3Y$yt1k^x4qKg_4yDE<|b(q`$)#QR;%uQePUjs+2d89
zdX;0v#2D7I-i1zaQvL=v#qV;n$8OoUZViWP%H}3h^)Ckvj1TU~KkXdWous*}EkmrG
zSxBk4dv#Et0MANMGid|y8YL@vqj_hZpWe~Yc8GVKd+)Y?Tn2Y??ASjrRWJ97T;wFJ
zAbq)Pg~ZdP>wB4{KNYT-%r2pRy)?bVI9BM3uT2AA=R=mgvtEgxwRF3;r0nsg#(NtZ
z1f1PpZ8Dy{k(0@+)@b{VnKe_?*UjIQ@<mWawC|Qe>s7muL(|mTmy4!OXsqDPeNik@
zc!J%uFyeT~$Bu1Z53JT-l*`83X2olh88Gvsx;U41NrOdP^QKP^AN@Z5IrtMV*Mz<6
zPuX3GNdK~>FO>IG(9v5ilcqVnWe*f>W{T`Sd~wUGBNwx-q^(}yV!BJ3``vCO^Vdd4
zYp=e&H$AUbb^6o<sXMPrruJDZXw~ChxGvA({!Cx(S?u?{{9azE*yKHDSD*g6pYyWz
zF22N_v#{*Sok=s}T*Kq8U#X~x%~`ye>+-I{&01S!zVABFWXr6Oc$_28yH;6Yn>mY^
z--~%6zb>z|F`g`{=O}W!TX$-~m&dv`tv648y-|4gBbT(|we!`?J0HyzxXf}a$4CE1
z)0|MzFU3>NAMKk~;U6Pt?cG(OKOrv0c|lm!=0&c)xsQqk+Y_7K{+zXKiu2@1!O-ua
z0+ZT#b3F_BWsUea5@HTK;lFX~>nxVT?;77KrrhLm68?R$=|N&b!^<3>5>{cMZ(W-k
zx<8z`C8A!j>cFosU*5=lcMHwlX&TI$9{bPB=<G#)&%a^nR?b)7_E>WVX<z4%UYy9b
zY>uYos}I$a+O^mI;@SBmvBaXHmAjr_`Bk3J!&k=-zgRXk_{X!K9RGtp>-B#$)!|?K
z((zy^^RpIT@rL=0-JH8yc6zK{BXjESH3QS%FH#csumo~To@t5Ul9{B?_dny3Ww?E$
zifq%o3h6(y&Yr!!eff6d^)C}zqRKg+PdFFb*L}PHsO+^3MJI2}T{q*}%8ik#-K?Hn
zds93kB>!)2Unm(JXgX)JD$7^lHjTr#XLN}vge4g@{Mfg+ME#0R_=$$*S)z&S_OF*b
zbJBa4=7Y}m(92sbC3Ei0@LjXfu<LDW)T+x74^Aqz?bEQiV0lcXU$Ax6ro87H#B%=p
zEb+Q%c&M+>%ih3~oA<u}D<9LZ4OgC+&T%VP`Tp~H?h1K<2e)rK=@ndW&TuxrTF5Ci
ztC4Ni|BX&B(slAVH@{rKrgSZ4q2|NB46!P`sQfwIM?a|K9pl^c#h>df<F?`#FCy+-
znRuakg{Q+Jh6sa#y{ZXY-%Pls;W*z`=%w&Rr}?p~=5jkI7Bv4TSh;P*-=MWl|GvNO
zpZ-xJlVycm_L<WKg&Nxr{WDm*BDPdttX4lwR8ofh_-nzc?%fA03KHVV)4%Cd+a|oQ
zQ01AhSEM)~Dn)|xV9MIF?Kf^boA5TyBggN+vlk36_;0N;mA4ks)>K``X%=IDrGLp2
zAC8RZFp;P~leD%6$<)ThU40do_M_&^+OsDZZC8J@wh5KJs?zn0|9x}Y_h+K7t>*BZ
z_%LbJ?TPt`4YT>SKV1E!UG3k@&@Xk)v+wSHV!54@ndg~(lBrYQv+aVv4^P;6-MX$j
zopZsIMn;`5Mecr~JJ(9}%6zncuUXApue)IH0^M0M^`9HrOL?y(3cY?B;-wtk*S=Hk
z{Kt)Y5=%r@-t)K>etL%Jo|Id=-vl395nb$=Ya{tBvF=k)eMx%j{~y*&k3W4YuY2z!
z*0k+~!c2LON%8f*ZAK0bmBqJ3Q|@zgME~kj;I>lISRf;oa$owzd46Ul-5-)p%zU*6
z4^}fC40+qwc!QzJCClf&cvie>M|O$(99G$hq5)El7r*Y=-?-t}=J!vR>{b2!%eVgM
zkwpG?@yj^3zIlA}dpcX#9dD!LY_;U2w*9`<>!$L}b+~058h@$L)9A|ryF?S2s053q
z$OwzQm3z*8c|O7Y!9mf0jQ4q21{$XV4`{Oea2M}Xp7ZGT^}x7~M^8&^mdKtn`*r$n
zZ|ApPXY5eCQ@HSk!1o3F8r0>_@2~qeCBEiYRc%@2%=lW%{{<goV^{u=e^F~QYx|p$
zK%><+XEjZFe|~@5{{26i@>Nv+CF!jT`*FGc!>oH(YCM_K%n$#%!=}T$`}cNRtIa#(
zIg0!kYz>_GF8}g)7steNthoLY|IK}eG6PMoIB&V=xA^wc2KVnqN<mdOPAHbXZ}4%F
z^`AEPe8fAMn_FLo9lId3QPZN9*DIm?U)27v;-2NV+yAM~+cVSWK+?`CceV3Zx6FH<
zWq0E2k#+ae8YUdt#=76(*6#fWv!~yDQjgkO@ZOxh{T(9%LpTf0-a<xx336|tG}t$P
zj)B15&)Rol7^ZG5>T_A@v2u!6=<ckYAsmYAY36>B(!FPw{roOl|KVcDo5rJOW}D~V
z>+xTqzb4mz@?3#i(@vgVanWeulx>H+*7{63l7H(={<F$WMG=0NFL&%>cD^uq@nd6e
z{$t;SZj0+)byEId!)0PH|Ltv!t1~$duTuFanDVsg(f5jZdJEoMbl+s-wByC^up<%E
z<oJRlwc8Z$vL2A{K4j}C`RcU+*Y7!EJ|*i;e{$<lUh!|4!bNpM-fe4U$7-qSZHRx7
zImy{S_r3Cob>c7HJmh+@<PCH6UDib^ijh3(Qv-ig9oPC7Ditl=?R$=I{)~`sdWl~y
zFP4vb$Yb&(S>;>(+x(^RQ?(OpeBT*o)GS!Xa<%Ppx69g!<;Tr8-8#NLX+eU+N8<_W
z9<P7(@%Q$}wO?njaiuTS4iny%_~}V;g291TX~B!{rI{^U<lj1Rx9CZx^T&5`zH`5(
zr<@&Yv&zZ9F*L^Z-o+2G;a94@-<ocG)TXCtVuR5Ojzyl!lz#?nx}6ZaU}^P&7=@XR
z#=$WgM6<uN$Zm1jw@v8RkNrQaC)Fr+hChk_z4tW#{Q5Bd___;S%U*W%vnZxk@847r
zk=^>Vv##>szgtCnB3Mp@Eo(Zt`BKSW#=ymz+H(}@=RXZQ^n7iuxU^~Irj75-esZIx
zmb!}_dUKc=7|ggB(C?0i?Ig-9DK5#+&(SNWoEsLMf7w8!?)-X-OLCLC)N*V-1g!K(
zW^OT&NSfOc5;}3Z#ahLUy0>q-cKkoLG5PtWQiB)X*}tvtfBadaXWO(||M~q(++hLh
zGJkDca%V$V;MRs<&n{Wt_|)SU1?O=7TyUc-{lV3bC$l5oYSb)>D$sbTyS6pw0w0g6
zuSlqu$%N;j*-@^aWg?VYjT|h*+a%O>^eOFEFZtnmB}`~(X2k1nZd!o>ca?c^Q;xo3
z+_?JX-wheOtE*o$r_^w}9M<ZRS=*HQUdcN2_O*N8yRALb<R(qrbf(kZ`;n6g@59tT
zM+#@%+p<RQ@}!j&eOe())}A%06FMi*>eh4mn$2m461GLA=eK&yyy(_Z#lsg}zsb=?
z^UYzMWF^(3GuWHHKI1&?_T-!C8pGqUdwb#+OxAF64$wWnpZl1wdSIWBu7k8Gd;RRh
ztA#oVQ)3NsukF}7(|N(XJa>bC2J^z_m|O{7=(YGO&n5E?1Mc+0S_jTZM^r1VoYDJa
z^8w?6^aZNAIlrbSuxy#-q$(oex?^4Jt2BvZgK!byIfp%;l)amA^Q+~owJXlLERs7n
zb5X0{E5(UjVQ=a*OVm1VrkcA1S3gv7F><~*GwR!<vpN4}xmo?JTJ9c@pvotHEc@LF
zUDjsSn^%`VJ>=jbAkB3su!k#~!O_Q2m#ZmNL}GWU+>?V&k@>%zrT5u8_AyKKvG7g2
zSY2a0x8hAsmu$)UN5&VgEj3;%q3`VT;d1mpsm#9~pPB#djcnsw^EO+h@LI<Y{(tv(
zuh?R&cJS|``+wyVw@R#%I<_)g*rhc|d8_)|0~_b`Otrjoecepobt?NTPTTL@z02zF
zhj&@$Eswo;bM5$S#RDv=*F%!#S4f`cV|k^&xy9X6e8;u!FDb@fU9x@uw`ZM7628us
zp{T5VU9=|XJo8KL7jaom7fQdJNvrl)`m?2!>;CCSYqC>LURkhRW0sKqQ#Fresb_s2
zb*C!09&G<-Qka^(sGD2+5ob?%)7FGHrq^Qsmxn1YT-NcvgX3(%zmBtYyB1#fzU#10
zwO7xgZzrvLuJKGPZQ8c@*xVawb}#o_&eK{V{ZM1RJomfPd~9!hc3b~^m>IwCaC+VG
zx!-Kpo#r`}Kl9MNT}yBD8vfU}f1bbIK5owQczykFvxMCKuH8m6&pNsDZ#mrZ^6;Du
z?+-6>xNyIKbK}`l6&u%IeymycBh+nGie2wK)<4!7dmb9UcyqsN|KVNs!gD(=TYcaB
zVb=c#kIp^q5P$LD$ZuZMY;D}}vt5~ufx%t?=PK*m)Z+ZS_|%G2P{t0=&3|mh^KV}K
zLTCFM2Za`wx4(5}%YX4}lkA19tg{aDzGiJp((Vn5zNE4<v*1R(yry@ZcN7ozgd>|Y
zK0Q?KTH<%&@7<&FpR?x~C*JrIe6Z!I^tmrhb2Mk=-~8iTWM!%NJm{@y{hg>!55N39
zZu#er!?b9(x^y?LpbhC^UZDq*k|fuvP41m0dUBI*ZuZ$tJs-S0b2&wwqOx|1q#1pD
zzl762?Y>>m-xVv&bb3V3&p%a`@@nfPqx5A{w^tuMs=TmG=kV&FXCl)~0wyilw#UR%
z&y+hsFFqnJdY9f!+skvN-LXiS?0L{ECHC{C0)Y}6)z9;zTu#ocTXXTUwfW8&0zXWe
zRBC;-^k$qi4PRm3doDYfQ8@eU<hjed8k>5r@Gj-tIe}$|(k?L;iF>D`gm(%X2Zdg}
z{-X0;ecv+M%bdDhJyo*{P3B);wD3*t$~jth7Hn@d>k*A}G8Pbz+n~tBkoLfn=l;>`
zDd!G^ug*Mn<a3kG<mltfy7JRbvYvn2ys^sdLHbrEw)`ateFb_s&U*J1LOE-U&j)|L
zcV5wZ@y`_H?7$<J{mwNmzhh98#$a`8|COj$7Qdc;Ue8_Rcl7!SMeFOAW>o5FAN3Af
zkoM{A+<)zFcHCXGcIRc^MUAf(&)0aPwXUCG^12nS^Cs;n;+frk`RW^n-^!b3E-I7u
zUw-+TM+75_>}2*GqOScX%a`OISew2yvHQ9SugYg#7Tb41K3<a#Fkctwwv_o-aqF$?
zjZ=Q<5!0`%S|HYZ@U#!Rbw!D90cY4^?GN(Xiw{5b(+o=PTT$8Z?%cHft`bg$3FS#X
zs`Z|Fk1l2@yj1K8bGUYUcEy6~Tm8E)+BxKDKiJ*BSXNx8>4WN>x#@lV`FXcA{Av$z
zWv)6@6Y%Nl6VZ%#ySp*l*0Cq1Gc=~8aeKws$XfhXTXD1Thx3=`N=)yj6nmHEZ9TFs
zVOuwAfOz?fG?lJpoq?+D+wI-lzbxJ~_liI3_2!)~kMQ>D9!Q$3@GG(L<w|7(56`2s
zYL91bSbKfq^~F1q6fRty@Z{a)yQ%SyjW1{4v^T!;w8!l7k2Rc8=VKj}|Fv>6F0~AE
z^eoaS5-PH86%6rm)^^ibA2Hq1M(B9}b8gFNOF=)46t0hRwtYG0u}}MwTzY#;*~OqH
z>zm6AUW&G+7-UCy-CZwz;?}Z`W4tr2<r(m9Ih-?tp+W1Q#7frlAD2`IHSTPy%#-nb
zaXBMcsD06P2UTColc|g*OP+jDwQoKDyZ?T<w*QI0pK^ZwwA;O7-?_ZJ={K*weLkCe
zO-K9=jVI?EM8rCdgw{8mNZ{jW5ei{^?_j4eX#-<b`^|dq(#F}r1-~>H{P-88MF<=?
z_@Zmq75=0Mfv#B(laKZ~Dl@QbI~2;?^OLpnm!rIq>+0>AR^baixZTp$k@da%(%L?I
z?fF|@{&4xeZ&-HJg4=ZJK8Z9z@%E2uw-`;HRr4PCuN!e-QOSf0d`|a&K3HAH?_qtu
zprb1Ie!;_y;j?lN$cMGutVqZx>Faygwk`RcbN_*4{tWfYKI*K_4uu9&+t@AiJyv=u
zpAGRWeo<tl>#Qwt!&!SR>x^IZVto^@`5UpHo2|Z1LA1Er^5ERdWv5>KouDFKm)rIF
zlVF-<PSfWoeZETv4={Kz7<K6~%j|7Cl@}aev`lB`-tvuBx8yzA9-n<<^51-hHNSAq
zs#|hOx%brl7T-^+m$O;DJomk1vPN=n<=NiXD&dEpZG3x%op<l-N$Yq`H`jSTiB9-F
z-Invkj=Mg0WISU^FMazlVU=iDhBJdg*+*8>XdlrF<pI1W4I?sMHJR+mtoF=UclJzn
z%yr-16@stCIu2erto4(pTr`7W#fr?xcasI|bmOkveyv)luDE3J;<Itu-|IGVbrrm~
zIi?aLF()Ye%AY2`+3M}4y~dAcgnE`=RhVE~T`qN<pVj|iXQOxh^_cC`IT;Mh>^yRH
zD=tX0I4^y>SL)h-=Q&PhKlih%EpJ*Qd)HNXG5hzWiC_8>zxmxt%aB^ny>kCrwWTee
zx6bTib=t>vaOt|66Xo_^{B$aH)pdaivrB^3#!YjU)HbypUtXTx%(=koG|LwC0{`P2
zr#5vJO-!}xdl1HFD_4?RajSq~+kC?=g`0oTnvJgSE0(QhWMEjyjI)!GTb!PjTLPbw
zs11tGp5q`;f8XD50{hlb&rcWHnYrEdr#MJCJ$8Ozk+OR6_6567zpF55srlYl71w%=
z<I%hK_xm;%v!3_gJ^hK})D^aB-$k>6wmNNZTs!rt;N;t1qGAr3C&$mt>SNh{-8^2w
zUg?iRzDY>Mp=&q#Y8^DJ6|>T<G`e;zzn2);@M=vVOHj7+q$wBUIwXsGr=EMf=lfs%
z*FK&1&Ufrw^Wv)3-G(m{xD9v7q)cxqc|EI6<56bHp%*%ysiC5u&a^gO+O|BQ)x@^;
zz^9)(jztD*Zg*4jd_H^EVufdES2yKra-Tb~YVjl$%S-yU*;#SArN5ndWGC5pPG|iw
zdrr$slNq`?*P1oC?FyF(ykWWiy5NA>gysCFF5jDM?J}W;b!nz@gM9Mw(~p<UKP_SJ
ztXQ|jZ86u^PSJk1$2&s5zVUuuKkL%JtX}`hg>x=uo(vXq^R|1d``e&~d*A)1Kks_)
zyZ!9;-M{CbCw%t*@cT*0iRR_vo2N|MlzaHE&iq}1%-by+&QG86u#SDhqi<(!RILBF
zbl!j4IZiijPV0`5IBwa^eof~><^jHL=k|TIGtTRt_|ba=ZNt{|yWg^9m>C#E*>N@{
z3M!NHa|<9Fw&sQ&%zF&FyjgqM2}hwYu_W;q2OF4l%q&?>q}@Ko%EiLw*u8j$bXSV!
zt<Hci_pPVoMwacFe${c>iJ9N;?GZd4{^85-xA!NrM=t(mu~U3SbB@X`%bIO_;vT1j
z#i@sXIC|sU$?2sHH@|){k60tPZ;`naOJ1Pl?I1apC%H}sKe<Y`ADGIdTKeIF1bd?H
zOGho81KzR9Cm6OoGLs6Ey`i_JcOK*S4{ctqQ!Yf#dB5?+)iS|sKBuaEK@pr=__E~!
ze4>=ixF)-7yS9VjzGpb&G2x48sdHCeJpTNgdatqWm1SF1lvmwWe-j=NGF|0=jtbj~
zh8sqYy{|;S?9q!iNO^gE_wxMyH~&6ne*F2c@$bj$fA1>kKCn7J*(Jfa>73HE^Upai
zh@Q^pSg(Ko{k2D>qT#jyvb{C#g0(-cm%W**ryBlWbc0bMZ}dBre!ZekC05N<XXnZ%
zvb;K~T_&h$w=Ianwek9H2Ls>zdz2+FB{{L4{aj)<SMPN1))$*<Zse9#Z~kc{d97ta
z-!%E&W65{iG*5dbv(`LKzIJiLbK}i<@8^ka|6af8i*TX-Ltzv35_>-xRUXMrHwFJW
zS@qZTr3l4{gk75bOgGK9Zc@#SY4eyiaZH_m=*Tq7WGBWoH@512>%VkwN7ddb8`$5y
zTq%63<=(1(N9BnV7nEd(uHSfEWfjx1pY3y2v<2zaIzRs-;_AlrU+u7!xA*O(;w^D6
z?jM}^-tARRc;%5_E1nkg^81!CX#Kj>rLp5!)<d(BTfaYteEqI0rB(mz?D>aZkN2f{
zTr1L*{*oBK_Ce$Kfago+)=RAEPtws(Xm}yGs4+q3Rn7q|h0@g~{mxlmu3j{ocw}L)
z)?wFe-*Zg3HJYXbl}mKb=>c6DA8~qVn$BHE*&CeQZlNddp8i(3>&<q*SKi;|hAnv`
zFyk=qnZB+bUah{Te+8r;q@AuYG3Qgho^iF&O~gdo#L0fu%l5o?PfqYG5cNq8>EG@8
zeCb7>SH}+cvff<J`g8G7!#{1u9%nA^58k=Ne#Wn<S1&Gk&e8rpBHwAw`zK$YL`(Jm
zRj9YSR=+Ic+h&pJ7XR2$+vr6WReR>LF)$bkGB7A&pVlp?EXl~vi_gqU%hxNY><xdN
zf7?vp|GWK7t_>&IM0RExnD9Q!eLHC#<0X{_>n+X#98*fR-F(41sc5n2&->->LHg02
zxA`@F@BRL``|`o=%B4?ignr6=($&u1tNH2VlZMXHIFAGy-$<>ZwKrBx@X2S9bK$ZJ
zR_br$Jo~{d%(6S{_@A!Aqx&3ZO%jQnUhpdA;rUH!k;`=iyWBN(gfvu-#5fnt5cQmT
zC`D=0rU|oFMhVsjZP?==`!l@5^t6L$Wk{z9XNZpL%Bd4Qqi#Or{T&vP*;N13_Ok24
z%`1$q9dw=(=9R;kfAf9!;|DJ?l){!MYV5psXWt%f1^+AN3(bSipZuD(T)6GOkjL+q
zwUzM~1?G#MT7G@UiSQ)bnJOESvM(rBE!Wl!5*3;~YgGlaq|Ul7na6E>>yI@5d{|;J
zQ8(N{eYGrq&;n^D*_by0Ea`i%zdX}*YU;6`*1~BPzuFWO4nI;lT`{l4^-Jk1%c%2(
z>*l127;;%kX1u*EC}Xj!H96zP+UbvVxPs2aXL!cgeAD3zQ+mGg2mhf(DwC%cdo`^~
zIk#{7q`fWK@8<GV%r>_DDXS`$8Kv5Aq}5lc&F`5^uSD`a27iZDk^T-di{^H{;LLru
z)j!^|qV3+kZ!cz7NiQ#7KkeT{sYh1n=>nYdk~6(FK9zbcwK^cb;qDE$18mHlD-Z7X
z$#sczaysiN(p<GlB;a>}Sh$yX<l_5JFS`E>>^Qns@pJ5Z=FR)1gXSk1Zmc-`*;J!y
zd0VUK`k=Q<0*-Ix+OQxZazUk1{N-lGd0RRvvz~Yy$T;?+EojPxf{0H)=1op{<&#`p
zEvj%<s3CWY-qn{i``o&;xHjy2F6(yVag0W2<E;66?CP3xPW+JkdqZMH2g72AYg>GC
z9F?0y6XlhTo_=s6pDFH%W|GYH7c*adRhk*3@L*%lb)LqSP}S(f5|6x=Z)~y#TT&Ae
z7G~CSyGHBS_;6oZ!?E;+h^YMDIi-J}DD8UDV`}@B>E4%Vxso2DHm4=~HvPLHH(&O<
zk5kZkZDIb`Nyja;Etj-q|Gm3;m44EZU$zw`8rMut7GJYDDH0Q-Yrl8z9-is-wHE&?
z_Q}jj`_w$mmibw&?`Fo&3McLLm(1n4*Js0C-*!>nYddGQ2(Pn!z!mqH6JD|H(R!WF
zcZ(Oget5Bvk?qZ|{d0{x4t@JpX!Ptcf9UTX5k0HB%o+0EbKhJ$TD*K>PJ80<yQ?Rx
zx7^#tvAN7R<JCI`=@~m$h53Z4P8Bs>scPM#!z7cpF@L*Eq5!Y^!fMBl6Q@32a`%dP
zsj*J>g)84UvN|N!^URrP$}(ScnQf{nQ**Ozg~3;!f=t$j9u2zZGfz9-IJv{|xn^FN
zC!^MPlgFZm)Z>(cgqThyX$##slcKWa$)>U-yHC{%uJ)8ZtX($MKkb;;=9t9LYpHj)
zGH?lOnfEsRnw&4w^4O`nblhAg`bEbrnqM_t{C(cPzh55y>N>TO?au0B3|Xp$Heaem
z4_@C|TYvK7&7aL}b80dp-!3zbY5i6%Ys~LdabfShMV8%%3Y6N<KALFrP-NmHA00-X
z9S%C#yfdpjr>2_jDz7$oey(OOy+<z~w9}j0Cs(^ojCI5H39Z?>%QaY%uh)Nm>y=e^
zMlNvqX@$hh48O!14TTQtl4rJ;?cWw)GqWf3SpG7DSrZqpntJzBnbEF2$0QyJeO}Ta
zJb!Oq^g784fm_|WeHXK~#@t@`=lFb^Wj(qo55n5GAL$21>h#^8v*%Z-QIJ@!$?RJa
zY^51rKjgleTmMr;?|<e0e~-Ei_pjWye2>fo|DcHvohG&H5lKAl$o(lpCboTVk>iC;
z_g0o<+ld8F_*kJ_G@<md&@0>hQE@TxmT#Y*o>qFLqxRSB#n!hI`3<LNT=>(zt<-Ev
z%*=f4U?V<u(am2Q7aUi0JCGoHXnydi0L@&tXWcwH&mR8k*gaQEQEbOS%Wi@D8i^<3
zIJYVa-h8=4yLm|mb5M2`!zasg(g9U+w@)1~+!@u#@@GTHLAUgmj+{bYFF#l8KeF&y
zcBzIy|LkYMBL5j{df86Oop^d)+F`OvUbdW*&vUKgM;K&Y^)AtGX!*N!zjyFt!9efL
z60Cb>TmAX{$jD}Q#J<|{%DT3_zvd-x6*QV6bkz6dX+wuI8ds<6%h)qbK6;<+<wNgh
zK5W}w#&^m0He=#vGqZ}b&%4bfChk4o?KeyNR;{L)<hz@li?22;yKJ|$I^)W%oC!|V
zS$W$h<m(oHX8gJ6dg*rNhTX<KCg*n>_U-ZKtB{tNoEntK=XWH}Qo?Ze^xodTf1>z*
zng4qtc=?BY0Lm_ZgD;88CNncI<Z<A<&!s3eJvA>rIU_YW8@y&|YUu60+u%Fdc{cHH
z3iK>s+QQE!v*2b<_kx`wk;=RqA~?2KY?`^$qfy-Y-)}zG*qrqfw=jj>TX^mce|p}7
zfA6=)fBwG6Db=w4c%Wq<w~6<Uy{T9EK8GJw+SwR=SFZQQJDELEd;XX%zn;J0o??x|
zYSDr_i?8H5pL#IC)H6u>u0!OtdzH<poQpEI79N;#sn2rZRNqPe&dBAm-Qr8qUZvhC
z8L>aJcin})_&Xa#v$)S3vbv?;<t6>(%*KQNbWi4c%I(XK_}bFNzrXB2?J?a|<*TkS
z2W*cGIQ-pz?hkP};ZwDHg~hbqs<NxCZR2g)eq!M@wte@q`dlX!tZ`KQbcyBk=6AX$
z{uLEXbu5pvy11ZpP3H6f@3VJgK3(5%F-lK(fqI0ff=G`US6{BK$}J8K|EIndjiRFK
zGG^Wuy}!kxFgj<?ggs9Vr6@dGo^`M~WU<7ZHRdMjD{~HQ7u0?w`0rQb6J;$Mwv{Kj
zt{roKJG)O(Sz?#R_7^$^?@OHDuAec*J*n5lz4VUE!^3}P3m6pS?-Fya(w?|dWS33X
zy*Kt8z1#VuzO@|TclI->T+d_Ft`Ng^#936yUZH^Z$W{r<SqudtQ?FiXzs9F#e{rED
zhj+_wr8Vh7@8&*tI_&7-`PObj@{7Hjnijv*soD4Y^E+h$)BTB09jbq=ZnWsQnBvX3
z<7W46+gXcmx2AO1>^nR69J9u3rbQY}S<@54m8BObK66lca<u!#4sNaYy0QCQ^?7Ul
zUXtC{**^E$P0xp0)|WkX6<>c*b=Mo~U+foUmABWsyjDBYu<4TTVUhSlyDIe8RBt$E
zlXl_wP8K2SMfF#>lxtVD2@9T|@=(0O<MSM?4mZP@Y3Vk*D=w|vYR?w8Tl7C~{#J9*
ze<6)d?>@&Yo#OQWfAVsp-i=MmGQWnfy*sb*y)r&xecG9vw~=>uc?F72V_y1gN(x6a
zm)HUR?u<FVm+duU_cPhF&#!QTfL*VyoLc(N;=hbh7gk@l<Jiu8S4g!@plQCZ760X(
z^Nt;UG0W!2!MF=29&fIi<#{Gbg^gQVWMfdM#YUak5oIsG>HK-U@A%yh_A&fcH+Og{
zRqe=IeKG5X#I=b57gDsp`&8*<mYhF!*3i3pX^C8}&G&1}o8A?vB=21&U1hYQ-74NE
ztFZR1&27`q-Sg%+9iMXU-J^=~^KOTlu9f+A$8J<x^Ytp%rA;|A0#awXiElZ_{YUSP
zj)66Y%Z<N>Pd`<j`Y;|fPk*)k5LL#?z)*pEOt~nvpeVm2wHUmNIy@KDTK%^!-f<0c
zO8T}-BEM4(Fvnbf+hm$2@Y}h4fk4K~l+BYpdzajjI{NSTyA|b;e!KXM1vJF^%g@_>
ze<hw%{QueGFMB&2q-NYZrm)t7<%MK)ijCEQFQFeURUe$DWu3XvKH}S}r>o;{eq(sU
z*E30{O@G3wHyz(+u-1Lq<FZ<r`>@LPooxmwk7j7*N=^@o%xj%=?DMJeXDMnv59gmO
zpBW}7@$3JD=!s!UlH1!u-mF^xZ3^ek^gA1LvpjE@-S}6zpKJR5_0#I_th;~KrfvSI
zMfcKUq%{;-4^9+VyvZwp->l^QArIO9m}7EPyTZiM-n?d1d0hCW=Vh(mKgDf2ta%L|
zuV`4Meq(S?6Sb9mbs)J&VCxKz?lV$qD!+f`ZT-37o{i4><h-9-Egfe0NhcP+Jvw2+
zwhd+`MLP`H>Yh4p&^Z6@Zl`_P<@*AwS`IySvdhqx{CRoh1hFrINe8zwJocaS<^sFm
z2b-;*x4)2#5qm7CIPdo{EuOVkEo~MG|2^~U-zSEP@oN~98da58g?~IgeIhpCgSJ!J
zJIn9u=WPu!Owmw~G=KMVa_~`}8#cc?bE>w#za}pi_V91g?pWJ3<~irw>J(c4oH-ow
zwtZ~~lVOT@gpPv0vF^SF-TtQ*OkF;eW9EuP#-{ylH_BI=Z|{Dq6;pd>-L=`b`KL<%
ze({0D_uRxcl@qy-MKkR_f4<X2lkGvKV#zVjjqC?*-ETT5qPc12D@C4G5i=flwo5Ft
zU7ls7wz2M?u>9kiFrVX$OF4`JxL8Ynl`QQFnK6I*-;6&NzpqTa`&8-ZtLqwZWeXn2
z%~!rJo8c6rR#4m8)%5=1OYeid8~=76njteM`+e)i{$sEFS3KO<uCd68Yq#j#Pdlq0
zT(x->W5pGF*kNIt<(qjoCT{%8#v&FN5Ib#a_>cG7E6ObV)Ee@cxJ#-9+NQoS<P_MQ
zbenNz@|{hSPnkNG+dH?!%I$ZlSTcq8*S_P2KE!e*id@_v`PEN3XS>n)U+ZOe7)KuO
zKb1S}_CLvKOSdd!YqmYNh0mMoR^SUO8y=@*^NW*~1_VUM$(k?uzGv0Xd?~Zq36&G#
zTf#nFjMo#lIDE)_`|P8yziZDII<WtvbgyU!_o@pM{cZ)#;MsZW^YPwm4)SZ;n8Iq4
zYnH7(`CR_`wL6&`16y7*6<wdX+G&Z@jRW^BPjIZV%9#32|INknPZnYywmd(eZnJ*3
z<J$YO|JnbV%-G0xp~*g$?{?;f>(SmbYX$u;2OeMi(fE*Tg>$Cgm+T3DEDn75-@dqS
z?hS9Luj@=j=2|$qrMYx-Kl59;g)?o@hF6)-U-I6}yO+>pskr=Qj?<K*TaP|X+Thpz
z>%q*rpx&dRv)42Ie&0IN@}J@3r`Fr0wsLKH;HStJb;B#K;QWyj7FB9D1ZV%>{mA(E
z?EqQvZq19bvYXq&uXy`PUEXTaxbs!~@2w4?Pd9G9X}x5{1=CAjd&<*-SLVyS3EnFG
zGd%oy_}^{uo8ng<C<}jbn4$j3f(g2x=G3MvaC!HxSUBxeNB-Krs9Bo3GPR$+c-24a
zU?@|EHP_yaF}Ia|h?d7Dhgq6cHQ%~>)N<}8j#u52C*9@TEjeFNEr}~ue3nXWl(W)<
z$hJyLuRqo`j{Egqyz8mepYrE%xvqoOua#x%_I3GBG-3SLtF=yD)#6uZYwEgvV$%N@
zj&)ny7xJH4I48%`$=+vQxEM!atjJx<-)GiHN$v1Ec%t6-?usq0d!^ns9SvoABxgV6
zR#VZhMaSG$XRKo?GRUY{%eIy+SKYe%*wK|?<*RnNZV7jvqqlc%!J}E{9{3qAS-9u&
z)yN~)KCjxle!EF|V$#Ypw^x^|#yV{Hb>-8tTfevPdgMp4eb8+>vuSGegV0~0_Z}@+
zu;p#g(r0OJ(1&Sbmwou^%Fe*>OAP1zK1HQ@@g<Py{i_kt`FG63>gLBEwBldXBdK<F
zp9r&sgLxs>V!tev$=eRRahRZ*)z<5>N+q;f;K}~?mU}XmNFIIt)p_G;_G}lqd8f<Q
zeKG#@@!8q;-PwT!nLi$_dUC1Dt6;B+{kF=DkGrS8Ir>Jja_z0XVz=k2>c`joXO4Vp
zQF**~(vm0jAEUPN&QYHB{A^BG=G6&0tF3Nl&P#PMS$k>PlOV0x(F>Q%Jo{+Y&C^aA
zX}fNRt!|PQF4wyGWZR9S{)s!cd0qYcPhP?LpIMUj=UxAANw0UBeLGe+Z}A`LA3UcF
z#l&Yv<vxyDI4kT*%<LVJ&x>ZyT(|0ot@*@Nj;q;o{=Z?_elzTb<xgkMnNO>-pEYo4
z+~GL6*?Osc@m$eWleaxj+_`ZgW7pb7o71oFvF*-py~AXaVmdqaq}N35O-ZY3PuHI{
zwLLs_bBS5;hsHHsFZ|NV553zI9WXsRE^XE3-1N+gQ??qEaUNg)aIaZde$b{0*Oo1(
zB^#f=dGp3uy_2=SNy}Hy`-bwvJ98@9R`3Q@tUIFd<J3i67m4Gnas~RC467!Ecuiim
zdM(3YkB!2mo=w#|6I=f1yt;L|IQqef0}D^29(;X^m6LhzonQ0kZc6A6_9$Xl)NUy?
z-D;Ou?w_ScH&^bp>(wcHd|x`@W1QzZzR11tZZDU#&i$h&-o8V}<orQnb~VZU&slBz
zUwm<w|0@yARcW~J?(Ea?_v?4<tCR9BI4yF1_UhTEmm5Bb@;Cgmqw4eN<)K#60jn%e
zR^5s6S+s2OB8D3)mOuW^ny*{Qz4B|^&FvG|pDw*7peS&+hQaR0jHNUB-)wtl;TyNN
zYU+~D%HPj>vexJ+9G`jJXl@e2M}J|S<6KL1C-SCO1Ux(ItYgwXN%iD+=e^2Y>uYn0
z*8g$L4|IIeYmj#{ougn@pO~`U535^TLDA3ZMOL-gTz2GM?wR|e=+%ktn>s5R`YM>F
zm8O@8Yv29Y=xwVf5O`*}-R{c)wVLZHS8>+1FV!gCdLq=;nKeYKxwDe>tHJ)YKc%v-
zKb!3s>8Vo3yYzw}`>ThQH$tVhFf(79ajf{!|E8m}&jx0G);;m%sQ#}{Yop_LD+}y?
z-MiRq&&k_!FGVCPJw3j|ZMn9UZ}9u(LQS^b4F6?QH@}=6)n9rnJ!C51os9?Nx5Ug#
zkdS%ooU8Cpz=OZ_OQ78&;|B-d_^q}+rSAMaWYJ<LlLh9=c{llfaeWDU)#G}bf6|8N
zkQ>E|cDpHQJ=@LX%YTqh@s`u{hGyQM@0wJ~o&G&eEwTvLzREXeM=Kj|+{6n<jP6K1
zk+0jdN5|OS`AgO>|8E~(Enoe8_0Nr>|Ihxs`n0`Vm?!OGQRB4VCYB118WaB9D~b$~
z;%yY<b=TVOo4nxe@|BNE-WyB_S&}KWu*mg;#I?e&60EboKPgaI`0&Sy8UKyV|6Kap
zlJ}d%|J$r5hd$igu*&48?b-#KBqZcBstyU}u8QbPTh8Jxnx2rrGx5zQ!N=>)Zha`(
z)4;I%%!WsoxmN$bbhc5Ci(PnPxJkflXHSX5$Cu6<Ca!uqsYs_*AXwZpef3d(&o0Rj
z*_%ASc5h_$wK#i2L6AjB@Jg)it;O#IWF$2gpM5CZ_vDsTNUz%YNnb*aTrilnU6(E7
zN8Jv4{#%}TXI6Y-FO$pcn7C%e(e!r#W>*&TEOWT>dXdO2=f24*KGlEA3moIG7rwp1
zFP!(q=VWn^>KksZ-@61ht=K(D{oaDywRy2;|EnlkT|apC;nO2K`h>#j9|@Uk@LIoj
zTKg-Ww<^m5ue@mJ6mDvKbT#pZZ?yad-70Ijk2c42WfmOl+_&HALTS+K)@J>iE;slR
z8Mt0-Os;<E_mYA0%V)<!2ku<Eb|@)Eau!>#U+B+ex+j1B{QOzvuFXZ|Xii-%izD?G
zjA550*c|46VY2bmspwnx+^Tcca~b{g1Gfvj-Nm<+2C2-RQYyhxlC?cIvHlFZx212{
zNzU*38MA)Qvhd}}5;EWaZR(wa_u@k$H=b@ysd#+ag`?=z1UVJW8<7j&CFGfYDnHtC
z@<7dsq7ySKGxa{RZz_BruP!<Nv@P%Tbg_FPtOvJD<csQa{<9)Mge&j=rpJFD#TD#W
z7;1NU<3kZX*DW75cG}s?y^=`&%+9Xl(OA6a{==2>PwQ;tWxxOL?)-QEevHE2AMr6!
z*S~EJySnJc_q$)r6}?N-A4JU%pYVUWM+I+*`8*xJvW%Z|kDXe%vEbdZ)7P87>GXe`
z(idz{Y!d4Jlp)({){^C?a#;Q`Sn~XIynch@xL<RlqVcNBM;~*4{lEMFo}F@A1JrFE
zt((8wZ{CjjS2_h;)qGu9TN~DK1ustgk-v;3uYdB|x`OxIUw+)@v^bbGb^4a9X10wE
z6-qw)9O|sJfAl_B#H`x4!9+55){&`gU!QGxx?8IBh~k`2J^z&3lkddDep!2Lty>N|
zqvV3xlo`t=uaop*v3I!fnMvKp>cNlwQ>QvlRS(uzi~V3>yYIoe8`6P06ieQ1PW}A$
z^v92%k3@gGKd-UgeUa_4$cH*&CIN5J4(eY2-!J19D+9wq0i4V0ib{(?t1-dj`>+v^
z4L8_NHt6Uy+2w9zy>!=vcNUA|HHT=4HV5x5XIqq5Cq-T7{q%nBLs#)=zeViP(;vp1
zn<L4Wf8uic@%_{DD~~QoJZ)||dD?r6%jHi}y;n0w@6*VeEd6Q0t;x@RH>>LB#sBdM
zV|Tk}xL9T7O=ICzxe2lxd(1pHU0$V_y7P6;^2kV`dt1DsotB17i(0qjqtaBNrqFk;
zQ&!&WD?4;;&nC}`r9OK$ugNTr+3@e@m7<;MS0;oSM7{8v7N#lq_2~1UgZ5Xe(|q5>
z$?deAayxH(@~o>%U*+7sxnOZe_jXzFQa`DM-#!L6D{}AaReH~$sCV<QBV(QA&jTeD
z!s0Tfxr;x<7yS3Ts?eT4x#j(dRS|zbKMei(;rQxy`}=$9Yo`nBICRO&RM%xSuS;r9
z$S1*f@`t9YEPSS-?Q)jYH8nQO>)nn#ugjsL#%il)MHM8!KX4`bN4)fEbIX+`Ti^5@
zINYRDuNo7TA7y-E=9&YZMgA`)7FCO`T~YZ^%t`0**6&ZQX&+gAb%DLJMEBk_pR||R
zYLZm}%e!TSVzyk7>+<h9ygVv2^F#hdiJvAx^HruUIA)>Ya7WsS=hP(cywgU;K5vTV
z@3;OR{^!}`PMK9Z%N9OAQgS<NwZDT?GlQ*RfB)epdne^|Fq(>;P!W*Xv`4OS7vqsO
z{hLw&art7wtnRB+S6{rcSpAo>K<(R@n@xEkhN~KUE~G_Yw*F)-+BSD3SL1=M0`tE%
zT|6#s{(EouWnQXCSNtEW#$WjOs<5C*rNPXaXHlMODi>%LG(}l`D3!gErxw+qs3~OW
zn!WeUl}k6IB%(z{P0hTI&v7sM(zfT2;Hl{^U(IE#ElgyrU2tUSI`b62?&o)1E4r7Y
zi>s~A*<pC0<kSWg1Kk@ETv=Xn9JN#a-CLabX5Rh3+TnUT7}lijexcMT#x?VG%G*!h
zRag9yvh_&kG(VQG)OuQv*0M!TUql~AFL|8qe<t)}(7YPYHC^UnugbJ1{NVR;Rz9F~
zAffnC{lZJ;vpt{0J-3pzn32a}t|t`3{M*S^zeVW4)MC5yhs+jky%@Svbk(n((~GnI
z$4gz!%;<S3`Rl|v5B}p99NB+ew_h9V_;lamYBoNn*`Im#q!gaHZp*m%O4MB5DQAwq
zN_v#$!DFY$Qg!E9TBqIlGxD1n#d9Pl9QWuxDSrQvBG;eOO|QIl*QT9UXnDEkO5@r+
zQ??{tSJ|PdTO1a%c=wM!&DJNrn>P7HuX0rX@KI^H@}CPEfA%XgPCx$ilI1QJ_w-Me
z&0YupZS}bp*=AMrrNFTNy^fGVUFeVKf^VnRsp-13b^JUaa3{aT<iPu?!=@Y8rhWPR
zCS0w_(&NH(%?Xyb(s{T4<C8ijv`y=~!lm`sYq>aLm{)H9A<VYJKejh%?Sb8g9F|5m
zD|@$viCtfN#O2bqqb^Bo`VU#W85dT%njca2;WOw6+J2m4!BUHfvvxOfK6}&__~von
z$q1LJ#THX8>xW;F<M)}wmwn4qEJNjRrDszf_vh^)m!iL|<(;jy;&s98q_5kxYt>FP
z&i!0CZ)06ZXRY_#<^OprGkGemT0cL>@ZzmqUn8FckEV>;0(NPR+Ic<ck<3x9N4;m5
z%%4~-lcqE|?q%8Y(^vVq9<><gS3dH&a)0)L&w_`hXGxgstGwfW`Ew`d!oJ8~UuJHv
z_;T>2WnTWeI|<Kxj92baeWcTPn)BV49p4!fKRgNSGrN4o*G84EV6vy>o9~56-`4Fs
zD%I!k=;qn<A2BsN=Of?$T~K7C!M8h~)0Sa|&Gv)>-c~lj^j(b)|J%)5#I-W3bc)l(
zsv<vwGil3g+b{L9>Xxn0zV|g*M^4c~^pCy8%QI)sK0GvYU1=)MwMQ$A7*EXo%foos
zc>VQdcSQ;sQX|-JybxFPKcJN3l2(*3Tkg_>10k{kPE(@qw{4Ps^y+xY5jEyahkaJp
zB5%xd6KFsC_xGI-+8dXDTmB*G=m!_CuP-NN3xxlgqWi%hj^C!wef#O)3NgNXWogTm
zpNpR#c={jhGy<lzU!MdsGcagy;9OAwy1F5$G&3hfub^^msCV`q1A%?N!+oT?a(9(Y
z7OCRMS-3=mOOs`mb7ExAHL3SnQ&p8u&ThH%|K7wW;Wwtq-P&7W+Mgdc-!1*a*Kd!v
zKXSXWLPu=ArIxx><1;S1k~MY-g^}~r(+k$_R#*PU&OZIQ`1=R%8a}YD4Lk6$BdA>W
zXQT5qHP7S{?$E1W)|p3yD%|puX7|y2J3~0?rix_Bw)>@S*E8O#Sbp(4@$t!qw^E9R
zNz+tUEjEa1O=#wHZ{NClO2GFV(|I{(udEZF)Ze$&?8MCE#n<IxL$~jl<dnFz=R(j~
zmCuVVe%tlbT;-R`qUbc8StqZVJ9OR6_@N+joqyY+NhQHEuSv=jSU=<AJ{)c3r)pQ~
z^tLf_NB6cfep@{sUNDG!IMG-4;uYIIULV!8A00sv<*emTd27wD&3wzXX64QWn!h5n
zZ+PyrD0Pz&cVGFvJ9y5?zfOnF+_Q5&zp#SeY3FK|7v*g8MX#JudeOGvt6x&Kqms3f
z#iLGnB>@>;x7q4Wm-jwuUVc?U#!~x+B5(fn_uo&PUhsu=lK2{Ru_<rM-~CTli3^sy
z8Q?yTz1@J%KD0=(ifO&`Cr8;?rHk$@ac%71`o?luh;`$+ug|qTxNSR<Cx6oYsiQgl
zso;}avyb*{SDdp_^W2&Do6>^Pio2eOG_`6z-JGxEYI5)YQK@su-OLJ?YJ*h%8~+J;
zB$WD>=V`gj*|rB4v-^ZA(yFHZZDrWVaq9SGRf+s_?M@x#^M0Q%5pT}R+oG?Uv?uaL
z>^X^xX&>w)%O>pK+tt-5tRk1ZztJQ@JnpE>vV(f(K9{F0*|^f)FI=bU$kmWO+u4>I
znKp)RNzgKJlit10*!J1U0|in{!Ttf#xw;w5U118bJm=HBXDZ*|%idpTX>;M>g6fkC
zw?BNfg;80oa?{35H>TfMyy5n><*T)3UtQ{WY_mh(MA^&}S__t%oJ-i|nW-TwrG8=A
z?U@$AhrMe`R#a@ueDR8<;Slqh`i$sbZqsto|C(oiny+aRQuKJ^^xZnvyjvolZ92QX
zTP6AUKh@J6AL=i~q!~ZA)SL44B=;2G@`>~IU(EBHVX-o1T3q`^ezDT`20ATD3I|Sy
ze@o?Buh6<>&vmC>>G~Vh-QLv`b=H44DQvipYxTr0mxB%Lm`;D)KWq0)_5BP1D3euM
zSxz#Sc^MdDjBuWtR9u;xl%JDYQBstcT#^sE4Eb$zZt?9Mg8$aVH_l7<dZ~1A+T87h
z{?|Xo#=W{$XtS~SW$&tqnnIHbmT`zJ&{;Y2&v!fS29cHG(L0aK^m}e1?5)xe`{rHq
z(RWNYlc$U8|GQ}=tmto&KiAFX<dJ}a(ldUS6l6YMTUZ}(JK6qp$-*NUb2c7s{uanx
zKX21&!}R<e(>S|-==P^t9ZZ<^F(K%1$Lft2eA>O1NIw4T!<x7(vQ4qdQ1V2Cv1JOQ
zbZ7KD16w|k{s<j5tpIKwF;BINRw9PqZ@%1MlqYkiXxfRM*2fBxA6H~Xt<+|AH%X{b
zTRx-u$?eFF6pgDYCs>ws9bd_&f8n~h66^UVZ7+M4zexL$@a3fc@&}7f`}}cQGUuYg
z1tp$G6^)fzdTN<xJnK%o@?ET*llt=Gzd8${nf4)b++*&i7=2wT^>*@#7{2xkzw0za
z|IYMr+4etNu(XfwwtM22Cm$c&yzKbnk3xl&O~s`;DVB$u)ek;?e)!?V2L>JU?6|X?
zRn^zrm-pMe^3h+r!zxQoMNCL|lqR<;toZ#VSFK5c%>m&*wO7u*uyR{SjlI0BVs}zi
z_WNYZQ}>_Ne%i)8^V5>`&5Gwc*|Vmwd3}yLTcdeRGw!E)mWgU;?2Ktu%I_bu2VUWi
zNxqxC)k$@0UhmR#d(;ffc$O7jvz*SkTzzh-&E<vp)>m${ou6@h<?CY$9)=vbW@pl}
zv_c`FqW7%u0e#+MoVDe9++T$4uKN9L&Hsl_?*4rF^Yy>gmp4zJ(5)6y{r%IMFMs5}
zT-&<nVD)j%*d^a*b|i}(*_`0`!*`)>TV#f1sA9Rm<$d9+9X-T+)hD~kXIw9}Jj;>i
zY4Gqk!^*4;*ZSM;Z=CpT_xpXne~UCpY%!kLsIXwh=Pfl`l3y?0ENLQqbH>EIr>@LC
zGuts_UW?J88-4A|t`)B@jL9(N-LmcTY|V)u_ep%aduc^_#J#jC-?H;9##<wT?ifwn
zYAKM>eq8kPDGQ}#7d~DHx9MnDxTjNWW9F+TdsjJ&9#8T-qix4;Ip?zW2D|AuwJm)Y
zP51KLs`MpYJ2&-^^Zkr7D^@0k&d{>hQKy!AXFjXe!3S2hFOtii&gYz4x^P$AWZy3*
zUWTR%hIh@nzl`O9f?2H0udppVq8@LTJDPp_DRZTymUo-#;b|g9img@hXG8uivD?@`
z<AD17+8E~V>iX$V)WQO0Z*XV$w_m8=wkUU+(VX`A-Buf~-Ab1C&~J&>n7YCGvCgE<
z>4vXPHU%n75`DX#^ONNP*}~PIt3>CiPQ4xY$4sH#b?+a|YZHn-H0@aCsj?(~-W@L0
z$*RiFe}1ue_F44pt?B#xk|$oBp1j*-U3%y4zSu{%Hh*4vH#PN;@25qp4SxRnJv;K>
zFO^7%g%=)8lR4%*qw7uY*P}CLZJq6B{6gsNbiTU`!pBtDyu*59#V@2SIGnX*J6~qY
z^@z}Eg)3BliO2Z1Tx<B79ytG1g1~3%6Nl%m%#UZXo%46)VZJg&InTW0=9wYpEc@Q-
z+}RxZwkz~^r^=zWSA1f7KdoQZVYus@{F8*gJlb{petJD}c-Q|#m}_@p?{Bj;Mn`tD
z?>*+{cH8N4RJQcR-M*oUI~_mzW(&M#nY8k5wBWvwZL6xy*V}%Zm9BPeiJZv3OYd#c
zmdZ_&7TF)OQ!dxvMvh4>cD?As)kn%TWik)+#d&SD<cl~uYjT*f3De_uGRFdQ@@l3m
zd_IS7=M%QVPkQ&~&EHe`GO)k$d{0~RlY*E9@!MOZ-n8>&PjBHf$UY(|vQfG3By*vi
zdi(LkYd5J2YnN$9CA?BPA}qIow`l4X0SCP|+%sHNY>M*DjuoEf{}tU(614K@pGFZc
zFBh4k=C3zC`K+t{DvH<GsnbSl=BG!hr7xwWE(qFMG<kpPu)KQ6^wzw)&5sYqUEFtE
z&p3t4OkC){A;%ftiC&I>+@@S}aTGJK{LveHD78FPT4b8W*<&3J#x4gdzuY{c?dYgt
zBb}-xDE+~}VVO&elS;jdbDQ4k2%$wX?#d?}`;6!D)f~C;Tg_6!$5rO${NFE4`o7QK
z+Ryj>fxxmkMzSYvRaO1?^Wx;i&CQ25nRy@DUj6f(ci4{?e_b*vee2^Y=1+Ly!nW}=
zBk#B5cH4Ec4!#mm^xW?9W5sptn|Id8yn1MO{y%Tkn%R!Lx6^fRs50Eh`x#Z4@@Q_?
z?}Eg6(+U@~{JZ;a*@sZx%~vy|IriGspP$6}+qih$(oBVl%*vZ$dsuG-?>3mYEm(&m
zWvUYY`$tb+<;UgMa!0;*o_Xe9$m&|3^m>I!$z5-YRvq2pTUY9;o|f3zQuM6)hv=1F
zsipJkgQx4hJYBW!N8=yw1saE9zU#DpUfHd-n>UHMcAkP_C}R)@&uT0A_ivv6d)fW3
zJN~?1y^)@5@+xhHc}6O?yHDL_+)%uEQ)xrR^>1}Y_^L%R_2$q2QWfy*=B5nB)WhPL
zo8@f`SBGsrc;!{pqyDDX4{Hv!G~IWYF+1hox!;}VZ<r?Bk=l5z`r57?YRixOw-udm
zR%AxX<u(5}EuEzt8<{28Juh!GSbX|7&+0s*HM`nl{<pR+^sI{7X5bVn@X(=yrzhts
z*Nm)#>;aP9+C~>up10+kcWHT0<s11|xBax^JI<@^`T8#>E>d7QUz%}bTKKnHZ@&fZ
zez^Iy#lE>)G7@IqXOJ?{*;4=ho|RGci|WtcA0-~{?wWjN^USuJOQgzMW#bP{4pOkb
za8Z8ZZS%f6aUwf5c~o<VzS;Oa!S9E;_LQrFc?G+#N*c31<UL!T%IO`<o>{|NGl{48
zagfI(%WsQ4gn#e)KCf2vOVG#f{9pb}EWfk%!hgYVX+1aNi8o$$dH&MfAa(Sk(G#nq
z;hpc96RrxqT<i1W^n`C)4}KMp`q8uGT5|Xg_dgfP+uvN%x^Aw{7r1xIJ-?=%KQCsQ
zcO{(@Ke*X{s*hE!aI;;3vu?J*+AF8ETDPX&?a9gDzB1*01s~7)mPMaMSPB-r|6FOQ
z?>BXisG4!y2J`9r|M;|bpIGF}68^>Q_RX96`7)N5DkPjwgh}lFaeZrz!=v1DFL`El
zebPDFe_f$0cFBFE&F$_Rr<m((2-xekrM`E|gKL6|7nK;EHJWz!Q1TS-Oyf*%pU)1h
zYDY>!v)xa86X!^C)O&VDR`sXq4;~J|uj|_5<wT;cOx+v9AGergX_0Bs+7F&b<Ywx4
z&k(j-KlMaJ-xIeV)(Ptl-9I<mZ_(XPEo{?vAM4(19K><u81sqj>7^T2os3wrb`sY#
zmEx;{dv7}&Q9CKn=|9bwv14Vy6W9MsAMuz6_c<=w<Yb&6b&Eyz%<7k3#tw|$tWI+j
zA}#7y?mVyeVk&RFhlozpiu%?$W~UWIZXQZk-&n?e>!?ChtLl$Wo?U&SLQ|D8Z;F>h
zw;x|ywtlBh%6c8iH~x1LpUJFSpE<3k`0*BjZEK_^?)ew+X=!x9#v>v73{7<Ww&n4z
zUU7myc+PVDlN&wRuJ69LbjkLN`w#MU3a)KGs{g@!5?{m0Fk^;o9)&ZP{N{|fv-bP+
z)Q$^`rgIw4ofpcmv2j?s>T&SGbD<(1SH1pQR9RN^@7A<}TkP)c_tG`*pVJE8CtP=w
zrQ}Q5?SuQ*ZriZ6aqUsQUkYzSD<eaGGtE4(=iSAPEW4wY1Q_1AyL)o^{;H=@nOknn
z-{_sw8nNlMy4|w)>jjp_PW=85aBR!z^Szm;0@T#=_2#MMIKLKp@x)|u=f|1z7Q4>l
zt1tgL>Gb5?otuw{vq?wW?LMLq?UNHaw>^CCso$~9eL_FCK4`X-+Gn`%^w}CK|NAbD
zcG-+xrL(Nrv`#y+xs|=)^ZV%6-t@p~lJVaJ#xgr^rpvYmgH$(cdHl}i|CZf$0^x7I
zmPoy-DLFr<N9_5cl+BXiHI)ewwwiy}FdgjMxuANd-fy<!u@mp|?s5NdNAVe##<Wj|
zJNNmp-xb+!(;!zk`HtX5-mM+K8E>YXjt-wKz%^CRdWUr7(zNUgms$GG$?DBK9jP|!
z(i`(#=bpUtyy>hx{}<C^p>s37Ia&5D7FyVmUUFg1jpU61T1O9`iK)6E)7{{8Ny2n-
z;Ijnn`|;j;y|1ijxt(%-U0Kt78}8X>VycXp&xE`*TiBg1GIi-no^?MAIE+_zB~-==
z%f307_qKZ3jVbpp3eNfxeK76n%G}Qq(tY7C4l7noJrLW_JgNQYT>CRi`Iq`X|H{_5
z<4=`MXy9Ixjk4#fubuF=)t`K`WZPz8$!LLf6K(}5-)o(-`oh$cx!SkhI_W*U8NTG%
zoA~w1Ufk!i>u66gz36zT&@Zo;OWk~$@n(w&muF;eoYS}PW!Ku11sRU(1%mG^^P9ux
zwP~Z})@4gN!*(zG+BxO=mW@6>JO2Nkn4=xJKRh@3Rl@)8QI{{fgl*XNR-{_F<aE>t
z?XcbVU6=SjUA3Tm=JGesn0D^HmbHBfqx+lKnB8sZ%RP)2OW(Tpjp4@W_kVu%_-(wd
zXJ!_*W#4PwqklfTnu~t+FMRz)@Ak~SF}{<3-D-8%EU#R%vBiC(42xm({vA9oFS+{s
zjZiuBbamg`+fGyFN-n*Xb5UkX0NZmt&)NFB)YiT}y*s6(v^nqit#kV_7eq((hbOJt
zm7dI>9>7_|{muF7zx_Lt{wx1pxU1sBp{W%<#g?@(8BF0}`M1jxN~AecgOizUg{7uG
zZxfLJX0RbYu$<!!N8YZ7v5JpZB>(7AnOd+hf63FIZ{4=%bc9uk<<8c&{J!Z{l}Gx!
z{IiKBfBRWyZs5N*^?Br<WsdICp0sJK=XlrEdRwPW@9~sVxmTK_c-!87=PdfWk2CSt
zUrvYn@2ih*?Rv-A^`*h{PTB3_d)*d)LtE~2KQ>xcpNWA1bfT^l_T~8{iRs0l0h-|Z
z*|!Y@>b}PpZV|by`0dg@-3yM9+}bJ18*F$sC8Yd*lVLIGf@bWY8~^uBo|<B)`TF!1
z1(mz~?{~lVyZ)i{-w)l{C%Hruzr`#r+B7j^`G*9Tt;gQz&3C!}A#nEIsc&x`y!+&v
zt<E)$`4hJ^NyTrtoOZbIK|s!;6&tIVT`%U`y_OW%a7Q9nmSgD_VZSWbz><o~B{mng
znS_OVh&<{oc<nds_yf!M{&jizOR^jVbQY~R#%86(BKq{6qUC9kNg|v0FWg@)_+b*S
z@>9FiK5NguNf!A_yDukvJFT=iG~J|Vcj!r@Z+Xcb)~75?e<i2=whc~do*8!cUc9}n
zt<AC3A2sj3?v7cz{oOyFlz%q$UY|e6eZAQGX2JuxX))eOK^a?EnS;Ix8N9bRd)sfi
zr;XHJ>7y?NCUU1vJosc%S5%ak(~7DWkKS^X>v@*dzMFeKH$vw1iR15Q^xFTQ!oH(~
zCw|MJ64ALYMe4%~|2cb4{ZeyTCUj}G&n1m5OBQ)a^Yl(Q#X8qIKK!S7N#wC`^Agd+
zye78Oj}`BHljgT<vYu!7OUu^oFxE5sEcO4!ecOFzhvA$X8$QVz^FEyScH(Mb-MwyK
zC!O5?v38zZ(Kj)bf9f7Kj{6v2+-=Rx<m#?DW`Dr{dRE8#E$_JOulO9^t*5^5af-Iw
z(#EG|5kLGxv+dK;^%~bJIQ<Xy*W9^&|2e6WNm?Qweg`ZGKfu5JMZ}z^npIPIHhE3z
zN)HL0QP81(n>Xaq@fZB4gAaK!jw%lr7#PAC85lHiB(v1wlK7nb#FW&O_}u)I(wtOK
zs<WMN(C>%=kIVa?T;4Jn{4R689}q8i!@E$!<Xzr^!bLZ3PTGHb?Y18#QhR-l#bx<D
zxN~VqXbE4E)=sX9MLKawYG%(K7CsNID_$1ttv_+y14*^yX}0I)X>v|2{?UER=3q%T
zkInT6mJrip4DqsA%GWiz6u56+ax}WL@z~PCZ30HN+-q*Ke>GO|k6j$Zm+RX0wv9!~
z-rQ2_Kv=EjEbHe>GB&6^*!17vN7YkqpKrFCYBpRsFBo@EVNwjwi$CI9)otYJR(A3H
z-e$HXq$1+$-v#X(`nkTbTk|hIcQE{lvCy7bXbXzjn3b=9a^qwcoMWb?d6{{|C5btp
zlPYq91G8^C@YH=@FYx3bpZA_E{K*nV5^vd>b9!`>n@d}|{rmcFmOoQT=Un=~_R~$@
z$7bIjZC>*Jx5`|T#`p30^=HG?+`TRSFS)o$ljj%DJ##Jn!n(P7i#YG>c=qD#x|AJp
zF?$<JJ3mOCjJ&Yp_$kw^4;lim28L9GA5IJ2a;NG}&VehvpLtG29q;PhEaKXH_TuB-
z{@#t&0W7aIR^3@=AbLpX(JtYc-Hmb5-fLE^`tAAiK%q#cj>B%>Z1!-abvzw^MV`HX
z(7kzvtHSbtWs_n&IK&S+<jzyRICE)%oK~`659{>>Z&#!>n3YF;iaMq%{(1YyEze)~
zX*$(t9h&!Y{zIcq_2-OtPtGm5ysg4WEbMA*Ec2DwYBT4}dDEY~Bg4W=`e<sFhxB}w
zA0bgI9cNWO6WO=Fx!mWXEa&I1!ZlBhcYRP=v^9Os;)Y|=r#)-BMU7tR%sbe+U^(CZ
zs6$szwzkVixA8wzUVOp!hw<Ne`#SPtqQ9oTTEOz%@tI<Cb&bd4jdxzQ`e!*$EB|)<
zafw6XnuS88Rq5<MP6zo__A}XW{SA1fU?SUHb6D!NZq<Vz!;-_^6RJZFaotvaqPtOt
z_35VvJ^`z2+fHrk5VN_KryuF*m$;}lTli`Dl!I2Wl8^2isn;KJ>5jOsE!iU=*gIS7
zzsqCO1>eujFF&z(%_3PT<r|-G9&GjqFj{lx3+vNUZ=Gy6WdsGc^K{INNzBNJ$kOck
zRkh{KUDmI4=jW}@7U*?LL?55;I5%&KA`=6{dE9BOEV;NOF&%O(;L?!WUAGMcYQKm3
z++@EkFgs<Tx8ah2TXrJbmR_(CaT18i%<0~$s(5nepW5Ra=UUues(a<Z=`$Ybedl_f
z^VQY-|6*Jn!nF1Hn{F4`kd+riKO8IyOfH+Rzu5Xm#+#EXSMe3>kJ)?n#YcwOQV+GO
z7CSzYlTMDl#lu)B?Yh)h*C4EHVetux71yN18?tkm_)lfXyDmOI{|^(--F?-Y&T)MC
z^0t7heRAk7rgw?Lu0q}dZqrvKRX>b;5W46@)&>T7nS&*XX;b%P&f8HT=bLY(KEd;;
zTf6h^f=?41HTBMM^`A*@R+^EyG$WO9_MgC?8&r?$wZ5^fF_!A)c)|6~q~?ow;fC0T
zuWxKDIW_0q6!7He5#TSXRh<%7mTl8h!*MY2-9+m^_3dlKk|)J1G7y?<a#lOtYWA8-
zd+z5<W)$dW%56CRT)Z=G&%CrtnpW-nT2~TuUIpG_U9e1NONs2{JvVn-yj>l5ugO!c
zf`6*@6C=;hfw!N8JwB@Q(IIeZ$nQI!0-jf>RMr|@GuZnmUb1)N{$Qz$g<sZecHvFG
z^5E>RLlprlKU&zIIlHd+b%Bx<|KEwRH68zZlV-}#;hN!7b1CCR;q{j-yHEYUSK`&q
zn51=1^<~J>%EkNNe4PH)m;KG<oasjozw6QRxm~2I{@>YfXZ+9S|BSyUd6}6sIZKI3
zO*0Yqnk6%9``<ee>lM@1JoPdb<7Z!9d2zd!N7clt<{9s{uTGl2>>}E&laB0>Pjwj?
z7-E<h7;v;JDie!yLF)k~8s;BX5NIv0I~ppRv)b^KjONr;>(*X57%ifhq~O}icu-OM
z|2~Q2<9A=N9=u!o{_f^aWemqcj=WG!UcjDi%Vd5`$vxLsA*J$j`0?5ar)`gPf8I7-
zQAfX`{8mgO`wI@ipvL}Xe#s9RWdB}Z^k@9Lv+<kgmV?ZVUs9K}Kkizd|4)iN^MiKy
ztF+5*I|X{CSH*5!JHhYe>^0BSUT=CVd#6$&!oH(LxA|v+{jt6@rk0%5ij{99@4bB>
zq;`LgPvDGuTr-!+TVI-YKkqBkysuksmD$TC+Q0vDAm`O;vGU++nn{d{uWKyS*|_5W
z)VWGA*DD)?uhxY<m;GYgdb30C(Z<h#dA1kpf86@=<kgCg)~*`9u|-Rc-r!sHG060C
zeJKBgMK^10Co*-VEIAS>^6iN@YOTt^z`(!+A{ZDL6i{o`lGNOSoWzpUV*U8|%)HE!
z_;|g7N@lbvfrUHP)l0E5FevjeFsR_tpIlG?H%zaf@^1L+yxV3X|IRN@m@7Z&mdlA$
zX@loXOZ=`?d2dSa-YA;sa6u@yc%eq)l1mcn<TKW9RKNYub(@H_<M#N&O$Vm&o&Wmy
z;qk}1e_nsR`QBRGCOK&H+{ANB9wwg)k)I!CGJDh9za`?i4;>@Vip=-ny?6iaZ@K$E
zlKWD2O|eMl_n8vPSa!o8s-)!qFX1cS`O6+Wj<%W7#u*V3x^l(Cr7jt3PB94^t@B+g
zp*TZ)Lz=<VO(uS>ixrGEcb(>3CUu`>^Px8Rt1(YjCc3JwNVK{tGEd@0$Fb}DF&n=3
zJoDjo>=KZFJp0SD$6qZa_t?w-G1*gf-Cg3}obx8SJDx1tXd62Dme?}ESw@OplR`x^
zn;s_1xLy>SK66EJTYtsMUM2=Vfm^3;&hTzqU;p#x@y`c&cUtYWIli}Y=_&h&w2mdL
z(O(oq8`dm{Irgn_mFKqJ&6=S<zGhccdVHvPXVl!2yt^x2_VM1OSN>&A{{A~MQo5!j
zMb_rdyL&f}%b9(dm#O2e{Z)0ze7lqP9$pGDY>0Ves~@RzVb=b8XQyQI{8!BVz;(&b
zGi>!!^B;F?T^{gn$Xxua>@{cE!9t#6f#P#AZl5}E&eq0Y=|b@W`74JuU;p42eOmo^
z#XZ3)+Z%jQ+|H*?eHF>L=Qe-kqzi#AH~!h$b!>~ZVG@u@&%gJkR`_o2VwQz-LVXS`
zJYn&mvM2v}?m?!zibv#fEkDe>+SbSN`RRe`-BWhzWl!De8k6PR+7Q#TYUcS(qO0y#
zmacTDpKT!(c-HuY7?X-z%0c&(UH4{8T{OArQBWFBt|R}?d1nlN=2nz$=-*!x>3QP8
zW9tb*Opy&*CqCZhKiq9>A(Ij}`_nwn`wG6v=1xU_AHF?Wz#vyNjWc$m&biiv{%>DY
zu1N~d`pfKH|8CFHGe0Fv`QpyJQhk3#;;8%9jc<gG^T&J^6u)z(;0|}}Mej*@tIqGr
zUjB67gu8ycCY-BIA8)l?s39EkdTY%yzc;%NtPK6?@!^b7K((eHUu?UCO=5x4tE3|#
za~|+iU6*N^_=tbQ`C5@Fdzf@|#NIKl{q;!o&@6vh-ART9PaZv4nsjUD*WY)2r0qU=
zI`q81^RfKNwXM<XkKSgxm9c8WG2Z$$UKgHazrJze#DB|GxsG>SMbc%B&R*inSua&%
z{ozmj$<ot)QnS`>XjNyMqn5VgnnUceBY7+b*w}=4t+|XGTmwy+qh~1HIn*`BbWd<{
z?p>z<U)f0lhf@XL&RP4>r{wvCwx<b?3b&?7N8BrYWUTYPprG?tL+za-+g1xl3fpSC
zEmhE6$Mj*j4SUR@^?TJ%Jd0i#`AX$&OZLqD60FXbKFzCnmiCH!L*w7SPwuk*-@!TK
z#@anClbJRg_7HSvsok*i=E}ad!l3JmFRam=)qP-|fK1m$an=WJ(^l^A<yb!VNlatl
z%9>r$OA4pBo!r0rOlfVD({1f}<w6nGQ9I^-IUTyY^YYiXK8J7inrJX9-nq=lyl&Em
zr9mQ69Tk1eN>(}S9~lfZF3H~Cz_h-b!zui`aL^P>h3D(9S}<{bcsIj8!Ez1LUJtg%
zJF*4B*Rgt}ckO<h^S7<HaB`_J&$4yyH9335?j$|q(28kpUbTy_<cjQZ;qvxI<@>d7
zE=GLXbmhsBgXseP(i?Lhh}~S<|IB->X;Mv|LaEp{g>5DC@6Gp~JK>t})t72lmy2IN
z#+|!z@3ePmP2XqStn3i@UEDe$!r1WMHl3BfSI6sm)|b{^ox0cl($dCI->}mO^U65o
z8SZ=YU%Jcj7wv2+yXbh$Xl4e6W1I{O$~eo`Vw9pa>@KKi-S<3rj;i>i2A6`MoC7jT
z9G;arw59OQV$c>~VbYbo9itJXuyRS`L-tqMZ%$TeTv{ix+k1C+T!?_q%RhBC&#jky
zfB5Uw_wViEi(FDae%Rym^oY*_$-|L{PqWI&Jy+hwFMQWV(lFk_LQeKCmpONf_m(Kf
zR(_4r;K}k9Pre@bcE3NR?$4_Ub#-mUPXi`hGPzZtz9lIqt%TRrFgrGTgNDPECB+A(
zURr0o@#3;?JD07U5c+OIo=SN}@#&YmC*9Y{s!xip_G3DBgK6m%*Uav%%yXP3sjL;v
z;=ArY?TC7h>D!PlA+Prwr{4u?#69Mk=FL_zmF3XEt;YA>zPfwc{=QFM*Zy;Q_XBq9
zO-=q{AF=DfCijnfy1(A=76_T>trsFSC;xrJ?44(?H8LLI3DQ5MA8__AQ{3Sd%fE&<
z%=G7Io;KruZp&frg$8YB{$E)3Os}?$S!TaGx7Y8MweNe*e%`BN{nFLULp8i$%e1v&
zAD<qLG3QQfd^ckfLx0%nn)e9-bIzYkS`_$WnMsN9E9do&vBmSZYP$KK)RtVQXZc~%
zrLyzvCet#Qk~ej|Kd5lz&C2-shl&(<%0$mqXvZ#`-IteAIoqaaamLZsFIVhpr{0m>
z(6f<CI>bb7>4IDH4!zx^AF<K;*oS6z|NW`2e}p74_}{O6;JrFJ_?v4J$FZeLuAJK<
z;qW!6mwmphh|+%V$(q|2`S8^o(g_LadTI7BepyBGk!ExLkndYUb8TIn|Lu42IxZ1s
z?w;kc+`l@fH<z#LZCw6@$nS4Izu0S*u>WvD?Olu7t0ugsVlQ=x+VQo#R6CbHE1<x2
zqmJMtA6w~pzJV76pX_?bmR}O}thwxui|pxr5r5@V&#hU^I`Nd=3XV`m`L@~1H?Zu#
zB750PSm?ULzvOM(+711pH&$=EzRK~G-;cGGO9Q?iU97OEZ(;O&f7xd?EIpD5b0;;t
zz07h)*<!!qaV3XrTdN0R6*dcUt$S<F-VCy;?avAgsEYDyJ>p_jVV<x{i7WKfHl>vY
zPnP&H>~Wr@RypbK{jH@kCru|F>BwS8>~6o%KG)T6^9EO+b)76{LsLFJ`*Z%-M-9H*
z1N?OhY-U=od>@g|v+bW|PR};AXWZ#w&mXM3Zd|)f^1Dx4^@DY53zPS-COp^J?2p=R
zGB;R$@&^k8LoqMLxjyjxsGkgH>J?O;g>LgZ7hmWd;K3(ks(+(>r+4GEvr+lE;yIez
z7V&aKS>2Aw@KRX0rR}x+mi-&!w<){coc4HGto>P!q?h+9zTf$%xS4-{yxs55FP5GO
zjJA;yTQOJ0+oZN4sI#Waefdqp+wG2#XM5-P$j*_Q|A!$wxFtNpo0s+8BCXYuKO3D5
zU*Gum*?i{wd9oMhzfW8ts}(eBmC2!#LB?igPkAiludg#ZVR=IGr3}YfZ*d=;ZYA^e
zOXf9fC=k7yR`)YdH*})qoKP=|Ei*;Gv^-gSE5hEhRX;!^qfI5%r|+TG?yBm_gY5cx
zZ2NiQ?cW<O@b8$JYP@o3cJ2Hbo^QD~_ZX_W*POaN^?}SJm7D8(W}IP}V&%Tge<HVx
zcQ5M)`?mGx{T^OkzO{w_o}Iep^DR;{C&|p)C%Lc2jq`)++f&k4PER;d_n2wzg!p}x
zzltmtaIii*6*gmeYtWC2={G(f42b;0KhHO}ce&n^8Cx0Ooqe_M#UV>&_pP60eJ)35
zKK0Og`E0_wiTx|4-hTac*UCDxJ84l5yFI1Wyfqbn9QC};Zikq0%(A`iJ%RSK^q$_1
zon#eW+W6sdk`!BGf2P{Be#z<zhh`n!Ef*g&hj3+lOK7>E;ImeE7lV<KVKcMFl7n|v
zT0U{oGz{WcY<Wejx3!4pT>D~`9)r(4XXM+yycF*h>)Ot})HXtgNq{Z$i>Zu#(&^MS
zrMtK3UY0%BRJ^?I^**tdt%r6wO}qJ}aPl!9kGa3t6V-kyJ_$~I@Sq_sFP!t@f#q@B
z_vaoy>GjHfs^a;=UEdEh37fw-__=V_*(rPL*MH~x`}^(g$Jt){zIL(BGnw?XX!9#s
z+4t9EUL>r3acW9^;N~E%DLRk5AJ3Pmij>=zx3YZS&sw9d^S%2xcP^}};p^_(u(8|u
z+-a=<vB-Vib{va4H|+TIrJ`<HjQl1!<vf)~TXr04nm6HvbE}}%fvEx#z0Wuf3O!Nj
zzU;EE&R{Q-eNvpYeKpJb5R3QHBC8L6o^U~GT0+Hi8Qa~Pmrl+;#<eD+ec?G(w%tdU
zC7fKxykSX)qqIQn16~I4ZEJk{&g!sEymIa0F$JDED=&H%-4nT_a;4qOeEsYfvu^*)
z3DMf;DBbcUL~M$uOS$s-y62_|Qf+e;7KU6uU~+TYD!)^X73%M+!x_Dz?tkFF<U5<`
z&mlWMsl!KqT+ow<`rD<p-<jjeatDc$j?RjzTU8>@jgq-VJ^RF#C)uP6=haO0%5c21
zcF)3vmrP#1o3PAt+LwK6HyJ#N^fb;(x#;=eoL<w}CGXc;$!thm_k7y6%%qbu@+8cY
znq16g?ejVI=*Ne)#Vb1aqAymlNQg>)%er#mwb8<*t7mi0pUSFueNI89)1*CDk}VZW
zucQfI@z~yPps+B8f5O>bp6ctzdwV&>IWuMpr!9%ReJ}D(ve=A_F0ZNI=h$br<@)bG
zeZTJS&!mE*@%ELajMcFv-~YwC+-c)dSNnS;=Aol>`sQg8Yl?T3D*P(j^)D*ypU&EP
z+t~V<O68x=nLTyc7TLXTgZg$)lT9(RdRnHoFtK!TRv0O9W+xU%ZhReAUR^8pOF;NQ
z|2gHk>W&ib7F^4FFD&18aq8R7xSMxg-hX$Dt@`{A>1lVZZ=F(FwmH?}uIQ@j-8T!L
zN8Y^WS$sWp;lUI4Yc0QDuRj;uoh4J&_ICY$?iXLft&dz2owa59TA4kW`D@j_ud!ai
z^3k(wnymU8w8?^s^5pLttPBj=d>Bi};Dx1ra%oB;oTpb%c{TiY-fcI5+WYHgoZwdx
zp8a8|Zh$4<1dY5!W}dy*9HlLeCAqF!vUa-o8$DU>F1r=`FY3R3(<&sXx$gHhsWz8$
zwQ1?+d%ium-aUQ4{2oC`eN%gh=X*?&w01}x`aCPOxUOK1+$39x(63INH}4$y`0(QQ
z0?X$groCR(GUt9#<W<&JjSttnIQj3ZdYAlsnFq(W8|d*)KM_*8bcSH4=ZTO|)&Q$q
zpT!nS6}X;ACZtA6sxR_XnCYr}O45LLy5rgn@6>xIRAyBKdZ+F1Gd--{XSHeT*X9X-
zOw%pHla~l7Ei0HASGU7r`Qq!(7tcTTK8~03!TilLm$hoNW|q!h9hoeAxn+Xo^i7K*
zCmY||)ok3cD8qls%$y=Vf7hkGhlFgDQ}mw)2Nv!4@$|X;dH3mG?tb3>+#urGs$b3N
zZPV5~Sk1`R?5aIOBl-7%D>}E^bIys_)b;3Z=hT_5XVzo6EvBM`%{_b7-^*(9e4AGp
ze)zJ|w4l1QB3GV0;Rf&ZfUs$=CVSY|>98-)4n4Z@g{n;DsVvuRZ+P{dJ2C%j-*8bY
zs9G~}W#8R|&mX2NuwCQ3KIh$meHw8aWEPiQS?{-{f6M9<S#G}tQcGoHqc7=(OGz`g
ztq_>Eca8b|M0@Mz)czMwKcqw`^RCUho}f`FTAQ@$$hSq8%s$`rEb!PUm40)wy8Hcz
z>zs;~>nl6WRfHpM8SjWH<J2zl<=DTu^I`fm3A2fJ)Z5<AU9xEDI;p9pp0<Y%-&>v9
z9VD%$TGW%ZgPV2s-6I!UGAAZ(d7<#}>$D`N=kaA3Yj3Pc2$(9VUVX!7pJnla{k`|+
z${c=vUYbj`wxTt}>!NO#l5E@_`Tdoh-&^#ggYSO0RPJ^Aq3*=EJ@p^cY@E0)&o5b5
zDfT?*lXdk(q3j;-v;SL{?Qe?PeCFtsEo|?4U)jArBcZC+yU{`T_;#o6&IyNf6y#dw
zNvL?*Us*rvb=%W@9kxEb9i59_AD_B+mC9tF*J~@L^}VS+(0TQ&OV^pE!0Dpu%hxgT
zoUypqvus9zsQQG&=d*%Cf*y&Tuk>h|AntH1>#5y|W!mpr*FC-Cs4`b6YTdlM(|yf%
zJlr6k)$L=)_2uJSW+wLH+P!a6_T({4Fymc)N6Ay2Jy&kl3BQ7W=NINJKlXQ$)3w7_
zb>3cm8yNkduJ)h1#p}e<^Xr6X<!80|%Utx*TX2!XYZ;UI^MenrE&RA-LfcKPWnwG3
zS2rc+ID|j8HV(UP*p%@~tHn;H#GPG#yMW5BI*ucYMN?Q7?^|%~17A(Kt;AcV0tWNA
z7%jUcid!y5zFU*CB2Hwo*Cjr`#I?_rjz|2fOl#qEEI+?^+Ewmbg4>m*FWR$ke#^|?
z9P$rt_^ajX-DtnI(E82x3il5Q1?xFnk4)aQ@#fRM*0n+AlP@gQj6Bsa=LP5Fjm}K3
z-LBW&RcxvDD_$6|GRSV5>=g^I#ZMTG%e6nY>`?R9ep96SDUKn!oNJfk{rOv?ZDP~)
zP2z5OEH-dD$UD2xWu?&m5HBa@!2Y}$F8t3g$cynzF4=Bc@S#+6;p<;%ZrxhPPyL)I
z<?i8lVs4k@CT8)*rB8ND-OUy`fAhI11>3LR;$?p<_NGkPC$_)he%0xnYiBkuGhlM>
zFcfF(_?2Dxh)p8u)7#_kds^47>69_O!E<G&`mJwo6YlhVt<l}a+7Tb?HMeVThwQ_(
zH+PD071k<R-%nj@zp<=;)7Bqhd*U0*;*EFn1ZLH53y{jzTmD<j<7>g^*Q%0vYT?1R
zFHT%1x+Y^&;^L}X>=kQ%1XfLwb9<7H+C)9=aQliU3j@O@ZUzQ5T;0c%oW#6z<g)fI
zQV&u?MYMC)k{d^5mN;B2acE29-WJ1Cz}qOKIh)(HN=5X%!5@d}UfY{|ny04bl%IZT
zaJb&;`Qx9D%PT6l_S@X~SM|>`Bqp-1?)Z+PMPhe+9{imY#$8u8HGV?yj|J1Sm7j65
zhl@|YfADeBVcYFdjE~R9yh?3;eW37G&xZQHogY?jfBxgE?j6nJs#<4*q+hj!wOnyC
z4-hGR9d)>y$)(wfJw)>@(-AkH$F)<}PS7de6Y2G8$64K@^)lB_)II#}^vSwLO@-@D
zmF5+h6|L@0Cz`xha)*6Ud%!kHCDSBZwY`n2^zQo2eNTS~{+cDQ?iQO|-M^RZ{ql0%
z^7rr8A4yf8z4YS#kEcYt%xbEe3>sNKm<7G&`8DTU!>pZW6E-V0=m$E#V%_;9>z&w#
zv%E2BfzRW$m1Wj1_41F4EcntH9dK)QMr~&9zn`0}EV<Q|i*J5Ywf$Vdnz>D<{Wjg5
zv~lC{)(s8sCG_^Z(&ZKIdbVg~cXm_S27`Dmu~YlQw`CX}U3zkd)XACCH-7khruS%V
z3un`#|9<yp%B;A5_duG;n}VL}Tc)nNaQXndi{E5XQ!eiqkMnzHZ$J5_C#A(;-xIE%
z(VT1U^7@!NADnikK>h!RjgQN(T19!?JKA^t@DB5^?aQRP+}hL^yRR2JWu>K>H7B!@
zgZ1XiOG}o7g`AvOKBM&Oltq7}{+iv*4^(d5?y=l_z2ckLyQ@y6^JzEQZO~uvB;(@d
zDaLO^o|TIqWr<@JW;1tOxA0I!O;f<Sg<B*1E|^;6^C=r#SySAypL5Dle)FzVi^`|G
z)3AQz%#dFd5I&drg<x|0i7V>)ce%9$3Xb10^!j%C>-?<!8a6Ag)#?6I&vjjMxF#U|
z@4{HoiOI2Cc9)g!ihk3zyk^Hxd{wOM?vyC8^M|^EJRV-No8Fr6;`{w-qq2m;J@>1x
zYOGPP>G0+H8nTAvQ!10<N%0-;s`eX8*gCuyVzzFrPPx89a-*yB=0{T&6|TCqt*3ha
z<ld5BovU*j=NZTz)AlTkdiSTzi97V<w1p-zjJHZQ%1&J7IWI-u;%eWLc@rI$#3)bh
zNmwkvw}b2OhX0oD4Iawg)5uc|Ep};h<S)zJXj*h=&z1vq$Dize=RaA&+o&lwmis7I
ziJkctN7v{@`G@QC4O81TUJr?y_jGHXsJHR_@_fDd#YaD?HC1j&z467QB!Bu7gSjTB
z=jttqE1cYR>+1p!iN#xAi^}!q^-I2F*t9!KHeu18_R?j4TaUHr**{oz-!WQJQ0j)W
zQt_dsE9QT%Y^nRY=fsDq!!CE{da=w*&E3w+|54`E`jDF~Jdd1=tn1@8s&Ler^Y(50
zTYZhMxZr{8{)8h|Q=Okwl<)~WE-Xqp@n!@2z5cm}RHkj?yS03({iop5sdEqhw5~Xl
z@A`C^Me?}~+Glb$Nwdgal5cu@>9UHv&iQWvms1S(PMR6t!uQExLs!(ArSIqbmAt%G
zwVoNZFgjw$s%yZ)z;Kg`fk6XTVU(6%R8o|fhg=+84Lb`uC3W9t&1EMYza0|W#90-=
ztT{pLrrF)Ic^7s$bh|oSxO5`Tc_Ndis$oy<f_=yABHO2=L~pzN<(7<0p@s3EXS3x$
zN!0D${VVxTVA=}VzWkyqabiMmS@g6f>K4?@nztc&hso7Tr+ywf{PN`Oa)VffJBy5^
zifUX^S510zV6jH^uKWMgzFyvJ__v1N{MO<{zR{A}drW3+JTyzlLO&}$`iV@6XSH0*
zwPWt0$D=03hXtK?w3x9iE!Cnf%zNr`xzk>p{d%QM`zGXsJb%46q{2D-SPJ9il3&m7
zn(qJe^Vg@tXP3`c<9VT9<$XCQ>!tN-ZtL~V9({(Y>3bAriq0x$KWM4qd1#-q+>+)~
zvv`WT80IYra=4M$)^Pry@G}u#z9p_nMkkgYJ+oRh#YxjJm}9f*6~491!43THUN~sK
zF-l!yQt2!8WxYWgtJah=981ikB2%9#J0^zODr@?vZP3b^%X)2xm}*_Bj`1ySPZcB2
zJLfMtEoXF0*cz~BGEdvY9$U-SszVc;DsFyh_${lk_Oq<!PCJ&x<u~Gd61SiCK5@iv
z+MN5oqJev!O`Nefsn+-wyX4+rtLM|WD$nPy*&%y;$scjm5{HkftIIC#@OE>&cI((t
z<y6ZfCW=?T?Y@{Llb`#)fN%A@4Hr*u6xjOdPRK@ckI&wpRMspz_dx5*!=I5w_DLeg
z3tt3qMV6HM#B;c<j>xgBVBT1|;*r3eCbQ4$-kmTDDY$VU{Y;kpsw)?xek4enUsIKO
zvCvp%;zw1<_`g4XpFOUfrL%9<-b#n2+Vc^8q8GcYCQEz`yWO<@jol<4>9v>JPCcmT
zJ~q{O>)8q7SI+i!oVpdvEy#ZFnuJR1tXTz85yCG7*m`%a+ZjF0c=3<LB}Hmeznnhs
z-RW7&@~0KtZ<lQEIdklhQWD39ws~yD+pjXqwN}5FdWHXw=P%dh5B4%Le|VzG*Vez_
z>*3rl%6~&zVai&Igp9PVvWVSP*RExp3R~qVxO}q43>jnBJs-dBG!zU<Uv<t?>iD#c
zyxW*BIZjeL9DdkB;KzicPX4^1yQWt1ABb~5XqM5nt7=B^t5*gdkM78+s4QF=exlOo
zP1$A3tR>RwX_>y;POs_775Q|3ldwMj3yH2yrDGai;?-r1O77B&_&jCIn3Ed4W=_}Z
z_;(~tGIZIAj7Pj8uRfa}77S6*n5dFicmMCNpVMET*8E>mSnbQ#_v@m3F5C6MJ!P|I
zt7{y%xFWqKq3>(rzkaowuP;9?Fn;$f@phB+MeWvI*73Kl$*UMYOmSN(@msIx^ors+
z&EI()%XRzj9!|DM{P-!G@xf;P8u9mjlQj4&whI;Rm~(Abb?5Kxd)!tV{NMJ4e{b5g
zs_J|3`~GgL`L2IkT>nuUtCx-Kk3+%TpBtS+dk)DyRhun-eM99`*Hf>$s#0gH<869X
zu-W%n=Ke<=H@Clx^t$s8t<;$=#eLqJnSnu>3r}w|E3pivw|O`0qTg);k=pO!cc!*4
zX>wyVSt430lx$<r%iC+`<D^kE`S!I3HzvMi2))XGEC0>uvbjrQoldtc+nW=3W!bl#
z`;LE~_qc?8o!<TWx3waiTHSj;i%b<3ZcJlPxAafDVcqd7huyE#&OFJgxZuM5dgjHF
zhghT5DjcnzVs&1FPv+B_*1!LHAF#LE{;J@8ern+o&&k<`=U(XA*m+U%$j2oGtp_dG
zCSIJwylzUF>XB<R&ODbAcUm^_u+H>53ww2zt1pq*$z?P3&aGmpgr2hjUb6Q;Rm-h+
zO5ku5FqkHutSRJSBPI4Ud`(50cZ80_1yjK;?+x>unZnO;n6{qQpKm{BZr>w+b@B8q
z0qGN^Yr8vFD_I|3)3av!I_LLWJro~1IYz8MboNTz{gUv`KdNd1zaDxlnzc)EkCfAX
z)(_XO-npcw6uU!XdFz~zRGv3Z>@xeExxIcL<-X4$UApV|?L!{}cWk&nBU<mKzEO#r
zabn}Us?}4nx5u)3-9NQem;dR4*;A+Hn=H+FIr-X^N~bRFTVHv<{h7h9GymPih)L``
z9O3ri6SA%z`*K@RC#qRg?<lAKlJ3&DQ#})|A7nP~suJ<mfB7)6VDs@^JxgaSR*F_>
z>auBh?OL30GEd^LyZ`@bv%Ady<`l(6#Lie^`Gi$4{E>9dgXouRYv<QRX-t|n#pJP1
zqpIVkChlg#?Mj^A8p2+OZJn0%$NY(Z5JPB6vWZCjm1&i%Uph2{7JG%<xUkOAXxpm8
z=2tHyWZdn}sCqE#nf-&Uf45z~c7E+D^)1P*{A&+x5d7hn-5C>Ts_QxJz`n1yZNnWG
zxujc~TU<&M+G^$e+xAu7$EUl5|MzR3?BB9_nW6O4+~{JZC#UaxKeE$byyn=PkjTv^
z7f&fVyVxan!p&K4({JSO@LKrp5xb+3yhA9r{|YOeRV}845rrzdtP32O*q@)T?J~G?
zX5oe!9l;%}ar-~#8m>zf*w|X~i|?w@vOil+igc>&J$*grSz_c27ctFVE@#JEAwAoB
z+8jkn{#O()U8LkY$w(=;@WusQlgjJtYOAyUHa@9|^sf8czQ}sTnP_uP`MvzwPp3cr
zCy>7*?ezS9)11Re=l6-67RW!#R`EC_zu{K<i*J`pdG9ayct-L-9okv}2ELb@)fgEV
z9x>wSkmQ1HTS0CC<o2KUI_w~D?EP;MX4@^cDp$JLxkbHnqpk!Qu-oe1PMNgsjlG(%
zVgHltA1Uj6odoY5K5*{OzWjZX2S5M&rdoN$a+lQP+{V7rl@rA_aB0~m8TqFtv1H3f
zUAj6k(QfySwl^IgTDF!4Jg}CM&$+_5c+>tH>(6(b*Pk4*F5$I=uT0Q~B@xx?E}r+A
zrlcO`T{vYy?i@pn=Qi^vM0M;to_k>(Q>gQ`*O#JhCTs|?tj=Q3y*@?MswdjUwOMGB
zN%h_QC%@`8*WGycPK@c%YoDOibDufxU9{?_rRqCT)@c)jwcIl6{ie3N%}#oBSo6lC
zGk%IY8|Rka_{sJuf5RW)6ahc~0G_M=FIPw&D&kE3b6`(mse#42Ic(dv^cS+J&E=jY
z_20eMZo(q7BDB*q<d?O);bLWAc*)DappL7xm7kP_wlL#t`0YGtbAj6D;XY5>V<o>G
z6aTW%E9bz(yDqtUZm$>cGBqzK)9f^xzFT2u8H=m@mHRKImsVU%RXv*dTjcPzvi4$I
zW1A)49(;d&+MfS@#~kg${OqjZVLdF@ZFj7Qw0qdDepB#fb6u$aRtbNdIWn^US<Hp`
z@^`Kj5&6@2dX?TqKArSb@9*#T2mF2VMd1Hm4(8OIM_gmWXGI2TI=SuAYP=MfEPYm!
zHSp0a)@327d%F|^Q<iTHNKRnOTNL^75Wloy_nA+drkyF8EZOESll$b*_47`juFnyT
z;SccYkT~dD_W9$lu5a=2U+ZP}R9{tYu)mi+ZK@OJ?hSh{JU%9x#-SL*^Rh)x>7b;F
z=ce#%Gd;-=t>-EHw&FD^BKi&g3@gg3nBw=XQQ7kUqo|kW(To*cMHN32KRgo>Ua<LC
z*!P&TwMx|oS;U;G{yuy<+fm+D#Af=kXO&SNC+&Ch>^>(sz3o5y>44}BA*~V<TbtE4
zSDmun9M+wf9Ls+Bi=%|0NYD+<C9+!*d$-KZ+dlVI_}#V3pW1gEIC!haQrc9j{IjE|
z_D`F)cIqs@1$Tw;zW=oAUQTGv%kG;;_?cxN#+*6NS-GwMunv!o&7s8;gbMy8oKRfQ
z^EP=ELx_`MW35KZvz=3ePt2T>qhZOj{DQ<f-Vo&t=Va9u&77CE;@_F+4fQeFYA=-n
zZnfS#)4b5KZ-3L`=P7pmU-PbQU%2b=O!Irk4&12cJQAd*m28^#<nsitlPz9%nJ+*7
z!|;jo@`nBW`uwMt6nqHY&SgL6;K!g>bv?ROd-r5rc+36#!NbcJ*H*u2Nd122;mak7
z{i(9sAL(xR{ORW<&ow_SJf3|nRVd>*#3x}Bn)4vw^((&FGlV?SK3e|p;0qApxvOlG
z5Pdi1OMszW^;`#slH8wvc+zweFLYNogl$bXx$<X<jnUc(=U0@xsVtjyM{a_iBJ28%
zCF_bBZ_GKk{N}C%zdX)K+D7XiYG3)#sr=u=zMl04myPNpfg*z&+Eb1Ox<s2_&1<ZG
zR+)VFfmBWUwVS_MpI)*0V9<76$#Tz~M=ejTG54Il$WrK1Gv}s|OO1Kx;$k_sGu<sl
zV&8d^5=sxxRoSNTL@Mc9f}q`j?QCA_zrLDweAU9VC_Zh^>oeGQ8w#?nQk9F?&%Yt-
zOnGRvN9D#Vr*3m^pY-2NEoepcFO4@UA`h6X?K4Zn{~lIKxL*2MH?LVNF+tmA;RDCx
zk2teuCCXgrIg_H|#M5`wBF_EJ3nS6{><f!-ifDW_34J-?9be|G6wmMfL!UjjSzT~p
zt40)OPOf@{|F4&;{wlt4FV8C2t;RO>qgc`TV=|o{58Kaq%u$s3!QGu<D0$5Jzy^=~
ziI2JVofGDXz2Bc1DcTW}u-nAZGj8QXiN{4TXOG1c?pgSQ@#9mg2A_4U_Ya)Q&*|Bp
zb6}BWotsn6X3;x|&oVO)EnTy(&~0tthetE^{CoRXKm4!suXm5$ik93GDBqX8EU)t2
zkIiEB$&3$Tw{{grSu1bpJDIC9U+rhC&i}uc{^YH?m9o+!K>MQkwvTE*-I9DJD;g^u
z?|mG3QrUY#cu(W^!@KKZ<K0DWhri70Z~51z^CSJWf&S?u-jCn7zf|FfWz6QiwNrFj
zSM=YSMYr#rkd?}QWxcM+d+Ut5ZQoL+@Bha7D!Y93(t}~w;`g?(e7Vy*JLvn;=1W%!
zEUgNDpZOAY-*(sDt7^Gf>n`VQGbvbg_o~sX^tXksZ~8Z1exsrIAFbj#ov~Z#I|~ED
zbY48oNKkQ#TyG&(xmkDzcyI}sioZF2XQ{*Mw6(kAnskqbZDDlu-g2~U5z8d6tQ~a=
z_8yy;(=L)4y>0fo|81<EI<oU#m-E?Q`u*Ye)6Mq%ah*Ndhx^?u!^3=7t}|BzZC>-h
zefdkno9&6A=eNud6Z7l$uWMS}bT~Uti`8=f(@m?qw=kcMym|TWZ~YK^TkAvh_J=$o
z^$G*8PfZI8>6*~F&TB!*r5kR=UXD|Cq%~@WMy^lt5V#qsdqreM<LZR4T^}C1ov_)u
zXN~ISJ4@Og3cE|+{Q1k(<6qO}Ij;r1I0c1wc&)z|A9vwlclX2fi_OoovwS%I+vjqS
zMxym?^{QJt4)G|ubQ$Vqh;yD(>{|3UYIEkv1woSPzh78B7hYJw_oe^h?9IVHKBcNI
zJpBE9pqHkbbLf=Am&+H2pEqE%%Fii1eD#p}ru(xT)R#<uKX0ED??vZx#+h03j_#cD
zXY*-;!gD)J{#fhWz7^#?wVU&$%$?a+Ywyk68r38H+DhX1_Cp;TCmcGbaL-x#n#b<x
zDt|-vzsj@K{qM-acP;JA&n1B~XY;R$I4NHEsYBq6`|YJ!e>89Bgk-!p|M^fq)7%Fk
zI&#9FJ}|gPO1$`UaP9=5f?o+|79N$DeLRG3MN1MB`vmT@#@gu<3^i{?6iJ+4U>GC4
zLM>sgwU4v0t#{zxh58KtcZB&|(hHb#pyu7e3o`BT2R|xrifG9)Uwu2^?!z<E`AP|I
z_O~QznwyD-M%m<j)|eTvu{xn@maJ2l0WUlIkD}dYIMVIPR)08bIY(#dyXDt1EIYr;
zNo;u2X8mQ({4)Ec^7gCtI)AVG{qTp>=J#uyTGiL4Y>d#acE7y6>)VnIfu(C#``_3g
zQS18o!=+svd~?r8{#qWLvv77J<Ez%^VN1X6+V<y%%ro1>)#A(MhHZVWcjb@3UBk5#
zcCIL~sjL%=m7mlyVa|1ndoig@6D`~MKbIbCiV<EC_$1<R_>70b?#m|DT`SrkTJh;{
z<Ku)4rW)MI?c4I2?lS#9v-#LA#iM2-XRM<4Z<rInE_>`lq>KCcZDsW(Zyz3gnsDjS
zi!;{@=FDDoQ8J(X6u1y&2N$A8%vYS<(reM6SHXQxN~QVU>gai^+Ga&su2YFkmU!c;
zSQOH2v!?FZ#<VkKp_Q`>wqH4Yi+g(zxDb`DQqQ?4HsQyL!UC~9&f<E7b8C8~7r67>
zVDp!$n6t5<Z&sR2nz3rJ<O@FMWX-<4f~LECj(m4m;bUg$Wh)!H%eSoEr0<f(&wsmQ
z7StWP%+(&#y=VG?Yko~%m%LwpOMYuzPCDE6tds!B_fqCLrzRGQ)V-L}@^hhXaH62?
zxkD8k5@IjSvm*{(cWqhtdbXzSYMF`ImAZWalR~qUmhF%UyQ~>5^Ioyere-If!sN_{
z=IcL8OFdpMa>4YtzlZeg9M<v~l}=hard-{tez7ZS_v8<swr|(hZwvo&cJg)c4cCvC
zzu$lK#9ZzAvPbzRMCD5Au4Qwct9pJ%&EvoPy?bZvW*-r@NLT%J?B1P}%LhseP14*H
zxE`!Lw%BWePEX_Z$Nq;;HzfS$o5RzQ?{T8BejDF=qfdtn&N@bHahm=&D!+{9dr<D`
ziSfCc%nR8M%=&cgYwk*sPq!}UmQ}uvuP(daKJ8WX&$_2t7oDEHJ3eLCdX6c_+D>=g
zH%!~`YuN;zY1YS0Os^MC(&L?zwJFN&^A`Js9X~v)rpdWKLAw)a)~xw8$C()z{5bKH
zoS=i<kW0?1p=Y6Eern$wixRRwH_N?p6^lsOo_pb)QbujYLsOP0shc?&UaBigc@FYl
zx&C5usmG~pGS(T@YZN6eeV9En-{Ss++8<9p9$vqAzDwJw2QL)eQ(YAU`XAOF-K^S|
zH%a?i`|nM+GB!p;?bx~NpO~6=i+_d}t7V;QWSI6R=I)x(mcOt4o9^G~d+}bnB0x-4
z_tmN^ce;WM!(J4zW=37vc5TKog|IDYjoP76{DwVS&33PBiDED}$ow0o_kWL=k-yG5
zt&_U5juccmf10>E;XY?4{}<nhTr*TA-<Pvr_T9c_&;O4PKYveV`||nXq!iUD8?4uV
zuL|5ftAk;3(!5u<Zj?-Cd#BK~=-*M3#ZCsHHBWu^s?~^1DY!k`@Y}OV-#jHWvZn4#
zO3+=xqQ(1+<Hws%34TYPIVczz?`Vn1IJ4%C!?C4LiaQPNJLCpPYjAJSleu^?CSRy&
ze_|_><L_0X(_iZO+caFX7T9in!DOF9@0R^s>+WrOJ8k2tdCWUat#>@%UwihY&liDZ
z_Gi0XeX8@=jkjqP7pzZv?mOk+715U&H9x0S2G_q5*u3HCsl&UcM7w`~+{U#{^IxIh
z{0%aPL<I{plpOg@7u{CU?-K7_Rr1q1H_In3@N!*C!Nm(V=Pa)O?RERjFB7$x-*O6y
zS?NFT%9^+zYdF2}!PYIAk(D2Xie4>Ve(YJf3Cs110*g$qcP*LYWo}u%{bJ4uwjN7~
zi@cw@nbnP+M=V^l@C=Jo)I77;!_&^zyxfv-XHQDz>fV4=x2O2c?A6SkyY*Mj%d)2a
ze!IJy0z{^YShKCpzO&gU=J}%)A9-^gTL)e$lDGS)ZZk<!^Wf<jY}2>9x2=4hD=u`+
zBie4^tz}c@oH}7Rc}`!Gt!R8#z|1wpn|?jiC|yu}Ov>HU<cIiF&xP|YZQbA<r95w)
z$^ElSmXu{plozzP$W!9U-^4UsBen9~lmg*hj}|R1=oH%}`1fMrlttn!ahXzfEA<}D
zvv+%u87Pvu+jn10;NFLUOAKb}|NN8h{%HQz{`2ePex1*H9U}H>;rrrU_A~zNe%Jiu
z`JIlQA3;sq-u67n;`!slYP&6Z*Y13_#|3Y;-u!s8w|t53leK-x%T?2#Y;K?X<^9!r
zY?T+Ulpj!^9?o8(bM5?6E1h{NwNG1kO@k)Clq&z8KI<4;sv*ld@wA#9ZtRc$zI?a7
zwPL~>S(%c82(|A|B4W4XUq6{!Br3bf(#k*k`OD8gPiIf65tunwYIS>w+^d_4sSdl6
zH=Vs(D8I+Scky9UxwCWnl~qogzUq;FHB0*MUjJ%uw(xJ}s1pF$p|?bMm>3uqv*IZU
ziW74Sa#GX4M+a5v6;$?yT+9Lu#a$1NdEp%H;WK?>JFA&S=I*rYZ5vXOm01?wxZc;K
z%jv1tvI#O2_w+<(^XW-87S}Al$D9oReusO8Z+`tZdDo^(N%eCUl_&{kv=uC_+;r@p
z!mc!NgP^KxmwjahJL>-OJ<D$4j8auRs;)Cd&y$_6vQp&tcm7uXdtY9D6gze)(Q(Pe
zQw8c%Qgn=0wOE|f3YY9j7EmqZ+cD+TRmEu=8+NW0Gh)w6lq*?!zdp26saIy&t_OU%
zUyl5(k1+jNCtzWk)!g~J-(+#X;Z*n9{fGV416KPkDs}%~x>Yi>Hfo+&%rn`qYu)|3
zeN$uIfA=1^e2KUI)wDOljmwvMPAyxi%yeG+TK7_`<m=*HHDRs7x38YPc4v<ATP<lp
zVaYR#f3ANSYg4sDx>m0Kr$vgxeyeDasZLziSLFG`Rj$7g*79_Ul;(mP&-Hd}O=hYp
z(C4agn77DsO?m$2sAu;jlRs7%)yiD5REw!zth2`0HmYv=lSQnu`Kt>z`tSY{!YjMn
z{#bU(&X(^VV&;D{+9~tSez&;7TH77#>zJeaw`JcJxFR#p>Wha$jlICdR}Er;`9)6_
zJN&w*y6WoMMi0*1X!Qg4)Q)WF5$s5)d(`(<F2g>oBb#@U+;87hf5YaxUyoXPE!ny3
zjP}yk7fo$qzKMRZ-|{Z|x*S{PE6)}Ad4eVr?Td~U$CyQ~yJ3%-oQ&Lm=;^XDFf_{I
zS$_#hPMNs{pq-9yBX8&3wgBxu6FABI_K?^e5$+t`ij9%qr{(24eBRKV6ShG0RGP9k
zljqS==K2f&-1g_RPgyZLHF}fq0*yuN2PdZSoqTv^rt?#g+J9djtv_h}?1ICEgRS1o
zCvDt*a?Eu<GV}7mnWk^%Eb^3CYccz*s+F`|ZJ*wAk-f{6cqVw~uatM={@^@mlIzKD
zzv~m~zU44%kH6rmu##WDQlv;JQli94j$i!5w!IO@=G-z%;;v8^<ZKGa62ACyMtbn^
zKRm5JkFNZw8ZOA4*1=K2sVBE<i{Af#UoOqtQ)&70^P|JB1KAHQZQs0xm3xLs^4!mn
zYt;CaOJ(MBG}=veeR7$5N2z#-(BA@{!_m*{eeNA@zPDoW#h6zI?}$#zEoc3@*G{QM
z&CN1JUotHA)n3sFtggwqOY5iKzZayJaPpYK-_1FX+r3Z8Dy`5xEWIkna;uBY+oGDU
z`jR!$eDmTT+Z{5yvq@2Sect-;V_l0^G=-YGBwbtk!%8J-(vLUNrRCMn+d?~9z2vRq
zP3p3E*DC5sS1Oion()&8)caVeiws5A5<?`6E7WuZfBKXa%6}I~asDO~7#~nlI`_?k
z_gUd5Lp=OsIIC^>@8+b-`gJZb`|C9~V$w?guVUXXJTU*F$dj>ev)~f<WQ+N}mJe66
zMF{dMzAM@)E}53$&2^LOho#;OIsVx>7nvKJCFJ<RPDs7+ex1C8qxDDlgR0s;7W`t;
zg2yI2n@~}tzamXxMHlPDvW-I9EQ+{Hq!oJB>ML^Zx_8pP@sP*gu-KaC>k8M`H!%q9
z>|mX3dhK*X(V};=REqbRoT(@(`oyKMg>x2@<c<^S2X)kpwSEcgmF~JXDVoXV{i2ha
z5#_h0$4V`m5@cHwe%?D<yK<s?>D*u*17;Jc7wTayPwp&=pE*HbkIYVo2d|=xEZsNs
zI$mVEQO23W{gE>^!!cRLJO6|B2fi;#>)))`J0DdvO|2(%O|16K6M8DA#9w*z+Mcu6
zv!8Lx_e;M+8g6#@E>v_-;i}=T4i^?*6MS#hu`}f#ubr5(rmxp`=ZSZ=PA8YL?NVRi
z6xGwMS)>tnOZK>HZGl0=%7=aC)gKNXaBcD^$o5>x{`1-<d96jZs}7Z#-{@X2`<UL0
z*-L{28VcDZ*Tj5S5$1fgRp7U3f0x6muO3?AzFd30`AENa2;eq<oVVlpucfQM&sZ<x
z`y<=8G~@KQ$SvEgXC!IstPz?Rds-`OU*wHzAJ4qG?P3@0D7}13UC-&hqC-oYjQOfp
z3y8lyQE~Np#N6Li{)delZ=HG>DJSFj-1TI7$Dfmvmu$$Ay4W`5a?--IPdEE==hn`f
z>h8baU_M*+kH%RqmnE&8xqo8W`iQDOYs1SvY}0!6Wy;}*MV6|1Pd?Uq?b5RSqtf*5
z__^usAHN!R>mOzFyeiIrLVt$x)rUL!PpPM9Ji8vUs62C{vS46)<rzowlC3;DSMOUl
z!$0F#`jk1Q?k{9^GOXsiSJUd`|Fh?U?#E;WUP&bZzI|31rz~C7F1r*ydG+w?I+5jO
zS!;Uv4s-V3)O&pPP4sKsH%A-$PRp5=n9A7hj=Ozoms013A`!vDS(#J2wqze%Cpt&!
z?)Ko5rY<%C5@u6c-X2Ntmb~G?ux(l$d*{BdwsSVzGP$$sbLeHA8#b}2L8_|DgSu-(
z*7YCS+E`G#cxLqJ@Wsi!6}kU-&6fUGyPt5o*3_?2y521B{@Tw;U0?s_zIv@$S&;f`
z&a;oN|H@1_zBFK8X1brk?N9wPQ;+Vly3BlHVOeLi@V0BeZX8+rrfk;EZ%r<Db;|#<
zqZYP|-lByn%nS^BIq=loWr?88g1L|_gP>i0q3^S98wmVgw|vJ^p4-t<+om{PzjW}1
zg!Y<%2+8Jc5=Zx$M5Ugb{AAt1Cyn2vsyEF|IlgtW$hO)TJBv$q|GxV__uGTdKYy?P
z4QjwY`j^>vs&l79F-yMpJl%qNtIC7l9?aF7?si8<#wUJH4X-$Ni}98y$G&on(ntY5
znNLXyzhA3&`tyH#`I*aas<Wq0a29wHZRbVSB`^0BO+9GB8Ypm{G2CmnLQ?e1L$_yz
zIz1C^ch%hKY`t-gpNGUwwmJbJ|Ci?^q8CiD+WUCY@@$ql4kE7QQBML27AkBz$5C2b
z$$RI{4VG8482_$0UHVi__2V6xM;G1KbH2LtB7ertkdI8^{_ECV(XdQgEvh_~Is4#M
z-r2flYJV>V1e$y^;pbV-R?~hg=tBX^#o59u*pIMXoV=pCr)8szcSy)lp9QLqr>oqV
zIIXZm`RJMHCSJ#8%h-O-+j?f#`t+mgBo9~1^VDuW^>OAAHHlr{nOCk|=W|V+_m8Di
zjBT{W>m5^$6fQd?z&Q2V(ThFN6J3+@4Kj<)ocJ2c`gNPmS1qTzvf;0jrd{>v>N#Vv
zAyn{py&d26$nb*y#vZyWlK9Sd7RsCmxveXDUpsHZ#ZA)xdL(3P?#kL8Uwiw*zD-w}
zYR~seX6u&Cm3sf~Y(>dZJ&(oV3F0X!S7zOtw5uqX>kUIo>++u&GC_v2haEpzJlMc%
zmhZ6d{_)p8_$SA`E<gBpeeeF~+vmFOSJB%4OlPjZmPy_#be<m1<e1GVqwBhx!%{i9
zZMJG+=494mhaW`jDt^AP@nV->jnc{YZjQHtoF6@l;$NQam;G-3vek>1>@;xM%ac;^
zBd%O{#=CjnO|uQYH2&DW&vRkkW%)z89qt#a4xfEu{wnJ42D2GIoaTIto^SH%gqi&m
z*Z0x|T3){uZf0FGyVY{_(#z<O)l+(c4J^|pZJPaUm3+{olUnZcg_trg@7Uce<vzLh
z-OtA-oYehIO4kVfJkYpyW5d47BBh&upD4_J$lZIo(mLq%c0J3iYaz4i_mtOtIh4S<
zOFt}MqkK>I+#A<e?0>Cc?U?^(-iK>d?>Kp{-+NbkqceZ!#}i$N`_YcO1#QEH?ZuTr
zowX?~$;`pK4>!`3W!oWk28JzC3=9(3^d{#QrGj#0B<SiA;o9r#6DG4~-rhRl*UB5$
zT!oJ3HZAjP*kQhdyHUHhEYf?CSI{<b$A8u79<O#yzrot{eiMJ3uB8m$`8hiS>dxHT
zU;Xj-$?S<vOCLT7Wt%FvlVNMZ`K)<)51yFR3E8AQ-*iuF<2{M8Ur%0No_tw-`SLeK
z%x}^!Y)X>6<DmFjNZgot4^NYOzZ~oHO-3;xvm`~XxOHCH5EQZ~$16=G*!O73Dwo_6
z8J7LI3pO=r&x>=Ox{*uavdZ*Ni#9Cw3HfpP{SA%4wUJt<qeSj-$edcLG*`5bJx>4d
z!sw%~Z=IgD=hT-uoQGS|7Oh!oG{<M!nh7?^F`Jzvf*DqCPixllo@vVZf<ZlN<<^LY
zBDulMhxD&ZV+uZSQNe~u*7C$uoybW~dNV~-I`6l9Ts7&~td(;;j`8|)uQT1!_QknT
ze!^Yh_@!?b-@J8rf$MZfg`zUa_<tYYDOuK67XG`u+T31`sZD<O(YDvVieYPiJyHGl
zE`9DimUlc>^WJ1VjpJtS65pF5Gu<>?Dn$F^oa_o^V~MUU#akz3AN7{KakBfBn?~f`
zQ2i6%(=*=ai@qx@mArgFv?$5%NW{61YYHDN&8*n@Mr6;bmY-9_d1LajH(34Jy4LRh
z<E<Bttv&X%@#v+CPao;E&brXQYxzuPEuO=99UZHl<Q@%+-p->wS5orHi;yMjJSTZL
zPdtBfdd%9dO((C$PnczS+Le*p<l)+@N4T@uqJF!D8Em(5o9`47aPlIPO8It%ol!FL
zzAd}#Ztih3L#+H*<mR-$Hn*fE=kA!Y@0jp8t~o{gk3F-Q&fUysKOD@R$tfWn+0HGf
zuyO)lVAKoQn2e;0hH1zA_RX(YV$Xf-yd~RY#$)P6Z^CBqwq?9xn#*+bW8e3fH&=8f
ztl9HL+Ws|*#tG9Iwo$*Pav5Z4M?Ib7lh2T5=zP)6WLtIFX$iUe2jAZ)a1)DoqaC-%
zTlQGq729g_-HN|0q&I%6-2AT7+U<!%b$+c{s6%Am;@AUI?Jus1d@N$_lb;ftlH>Zb
zn@N0Aa*F=fs)IQb{%-#uqni}J@x%F7=ewTin@_n=dRnI1@66ZgzMrl;j-UCK{MW7C
zs=U|MwCs|1WQvUUq3F|JIUXN+`rg>*`p3=BpW8onc(3tok>+V#F(ckHYnOXDZ9RLm
ztE|t{GV1>49OjgNV*Jim`9peBm_;Xx?bj*0J=t)^qP604tLFQy)cAjDs)Bc^$+nx(
z+mAmspHlesgz@E=nj>$+rk)n=-nJm7Rif_UoYsmKDQ+9vq|{~Vm!71X2K<m(sdK+T
zhTHk<S+?W3pBC_nKXzfgdY1Rva@S~v4N7LEj6Z7oUR+9C|4n30=E)asZfD};MB^tt
z3_pEt&hc%ki*%HWUq_nsPRxBHwn64T!(@-->ueLgCx6?fwQbGC36VxO9w*%N(@1ui
ztkYMOabw<R+Zkpb3bwCIX`VaBGs>s$w9;LnJNAm+8@H`Wo8Y-|_XiV+${SYZ`Kv_4
z*GznLOv8Ux<L&gtswEcFS=Ty=e3_N}#BJr`n@R1?DShJS3^(0ok-2He<)53z!^N{q
z+j`5Lix+N6{#?ucW)^R-?5DuWN6~$XQQeM3$35MTy5Fy@_*8h%uIBH@-*cbb?>f3o
z-y}>jO<TItv&lcjdD0p8DY6lcXJ@%jlw0|K8}DtoOVgvD>#XLKb=cQ!SMx?tearep
zZ;kBPpOtp295ZaGYT9~RH!o{VyTICQY?E2I&Q09C^2`QT8*b^z^J|39r5(T4`uW3)
zJy)~O?r?g0ntk<uGnwY6PDdEs`pse^HiQL<b+4@UIP%D_XGxsm!i@GRp)ZY_7r$wk
zBy?q$si)NIL$#U}{q83d^>UsaHn_-qXwt{9%<1pk3VMCIDyK!BJ71Ri=hcnWdm6uv
zY!hCepwTx$CS}&#53@OraCucS3-1nCXnj@Dw|deQewoE};TapIrk@S@+~7EcQ~inL
zwLOWm>H{2i={t0B^IqQVDfdrNI*Z}Mx{TEvvF(+OwuNo3O(ubc8+DT8GiK{wIsU<6
z>W#yVd;gVJa)rt-c3_`vnv{R#?aI@~_m~}Bsh!8~a&n=Q#ny%|0&5kX?%2Qo?RJZx
z*@YY8_yS&^do%HuOirbN&;NOT??g&Cf30yT+W+pT>V39<>zQBof4n*I>+c$&TgzwN
zGhRB`+sd_~rAs_#yKtSvm*PvuXE$ANdN_CYgMECb!hP4P{qycR^|kQVj*D`Q|0mqd
zT-=dy#WJz}!R!+gC*9n8&Ld^>E(2~s-`eY5&fa?t-(&AE3;U-(@k4QZrAON1Z9TK1
zrz?G0rXkdQ;KkOYe9yR9&g<1`yv^Cx*)Q-Ge9Km-^*Yz&-SYPr=k@9>UaVu(#APle
zap#_Rj+{abTQQ%UQT>wMstlp!n=LnYh_m}zzgYP#=-WvZj|o>ceXHAE;CHuI$x*=O
zZCs-Jhwn4b?%4b-^@!|}-i3R9$Qjr_`r5mDdwp1NR9a_szQu#w2jA!IYq{}qMYQ^E
z*76BA!v9^V=ND^xJNxC2N9P#Q9z2>W&EbAJf9bAsEmlXA_qPVxY`mJT@;pbrbJ?C{
z^(-=>)0tD;S$X2+=k90RI!VfW;p+1%uH1|+4t&r!Y0`D!<l_e~WXi<!WUoB?Ve5s3
zUeVoOb~WTIKXuEqR`-?56Hm5V3l!N~W{Li4kMq2^dO?BB%$2!L|8=s$(O0-#n9b<1
zgOP!ukePu2YnuVo9#6|J0v(f*8+5SmvVp+f-`Z|>orA7K<nC}~(tM+*5fmv9!o<1o
z#B86S=4AJ6(G&e2ng1|4mdPcZTeBg}=JPY#-#^*x>i7Jf^(M9TR$|bV6?=13Zt;AI
z3vu@e+Lvlxkp1i6sc$b7@4maFa(9`vg^b|6#l})uHj9mF-4i}&?2>$NKA+<)<7XkR
zw}F8dza8V!?@e2?aar@G9KU}l8+9DZLOv^OF{{fd>{%PO+Wnz`mg*d5_PwU*k=}Qk
z%sO8#w0x<xg-iAC0n4q%W@jC1U#;6%c>M%_tphiEyC>uG@MnHAr)}IM;x%zj_y^rx
zlf|_2-)u0ydOm~sb92p-y0SlQEbjLurA-erDe+zUVVnE9hjHzryNBETzaQBlds)A-
za6yW>TK?xGf6rYO`T?<SS8iO0_R_75JjNHgx$)PnnT?;zn7bHyLoAjiU74iId50m&
zdfQsXN?v|9f1SkEhkuyVVy7p>sThQ2%$H~X7xzQ?YR_ZENA^8eKHAUyue$E$Wbcd5
zoviO>Ir<m$UjI>%_4viKHQe8-el48NU*z_>Dd_SUeW|mWb+(n;#Sd-MYi2(Gb;E({
zlexRoj+|dJ^Np-vJz6U<#NN5ego%Nno|S<?5?f2JAip@X0({zDY`>79NbUUi!c=*-
zDKj_xNb)dfj5Tp#d6abL$PCZ7cbt-!&)wpx`1+s1|F->S%G&zhI+<O(A%5ts<@b5T
z)z6sno?YL5vL$#5+vLK&OGU>5zb6C;?K-q%cG)8C9YIgSK0iI>w7vMI@2<J;RCU5Q
z-e1(<w5)Sqc<Ru^gG!oAhu+6OcsTE~(6LL43a0N0nH8}vMZ|C|*9oI-+p>Ej+4dBa
zi*-yn6(%6;+Uu6Qj^}=Z=0vO7D~nlvHJY-BG#|<q{G+{L>ymw5EZc8iDO{X!eM(^F
z(SQASr^V<sN<_Q~SrU?YhkM1EUNe!?Ug^9VtQ&n^Ch_ljCbcrO$~y4N?FkY&?MoTg
z`ld+=9-8_3@N)}>Be@;t4Ib$Sy099m<y^O!dHt2E;Eu`4#oi^q9p<L`HaBfmsN@Y+
z-5AdJ=i}253$@2gbHzdz<;ZoZZq#1>>^S#wPSwzzxBcwnqNnZYif)$+%kSs?o7kk&
zn;rJnZ0?zL_fi+%W;hsWJ2T|kgUJ7P`Y!o5e^h!SQ?kCU-foVOY@5|8>1T6Im>0jD
zRkNkx>f%EenCBe-n6qT-rH5}8ID54k-N><hx~l%()gNz5z9p8t@?PA%o9EQ5g696D
zaBIi4{#VWiir<lF|Ed19-aMx)nD^s-u7A@#b?TgD6xmlF*sOT}J>R<~hkM^2@C7HE
zRxy6p>)?O9?_t^WZ)P^?Rhd;AJlKn>)qekeZgph-Y%a!g*Cd52Gd^D|ww<~)*}>i~
z`nmny!}I>3t$SFNoA!w%o`FF-ijhGUTT&~{%PdPRDozBCukQUF{@87s#vkkYRwi}t
zqV0nHUsNR3Qf6H!IW+fO+tmvv?>HA<-4x2k8eQ~-LFUlU+wbeH1W)Q!v`s(veeLV1
zCfh=`uFkr?E_Qd>+vBs!i~hWt|2qHD!V_K_>t=MU@p50OQMPAqrp+Fa*S8-&J2h+j
zeE)RUs=~<1+q0u@zrH>D_UwBvmwvd{WpsXzOH6m6-CT#%^+F$0Qd3h)OH0p7FK<@T
zON+Dn)MerQsk2=3Sa4v)Vk_ye%y~y2Z<*B^P?nk+a^SUw)YZ_~4vkNjPMYXz>7U!Q
zr)y)*N!MkCrJMy<e<%Ogx#*Ob_~jiMt^Z=fUadays`FReIj_H>4y)gXS{a(MJAW+=
z>R(+F^~5=FT4vcoIsfB@rl-0+?`ywqthxKWNFpZYDQiu0{L`lqcOK2(<#oJv{e=hZ
zKPz<Ft}Wn@ue8&<y5X3sEU)1I+V{&kmT!uP>O7<w#(6Mb%W!7jrHujleysmk@9g*D
z&d}6Pt9>79BiLE@QOfJ}!t=`vOb$#hUnSppn=AU-W8e1hWlb7gI^p(ptU>|zC-3NL
zf4oD-RdabslZerZ%Y}=6nMpnu|Dz}Kto5DI#7hU?2KWdX*1lg}Gv`S2MhmGwT*?uV
zp6>TDD}L?o=U?=9KHs<hg+JaMpDW65XHzHT$TFAB%59I<ihO}|!-W4kPOO#@*q@};
znyBKg$1U%tR@$1o&-1ib_=Z!~k8hmc99R`7?lO0M!h<qT8A&B)QM;90iyyT|s(LMo
zSiR)Ly30!EGd`X;#Qtm|cd=1xq_)@RvtL@}ZydeM(`Kj3^2fTvTkw&+rDAZn^-6XF
zpF`_I1NX9S+Nbfz^Q6Y&%&$r>ZW~@aG}~s`Pfn3VRn{>A_SY7a&3SlZL7mu9p#|#_
zXEZ#Jjab8KAN%>+9`1>qO0tiRaPx~TQn`@9v%o3AH}mDu$Axvw^_wK8uhM&bYB!6L
zcxEZ5kH)kEPB)v_1Cq|q?AQ9v#uUMKp;##B<BK1?+q+vh1nT>`545w_-Isn+I_=H8
zHhCk4l51{3`;)gk-#b+_rq!KQfIUd@P%49+9s34@C!eQIeX-@@la=?QJMB#5>KfX$
z16dZcz1#VEZeaOed4B)DcJ*`5tvYSf-B6}>py%r4@|{Z>=1X$#GO_Q?`0FO*y0ofV
zsjYI_9>;zCuR}y$v6kPdsh_R>>wACZ((Bu+zNyJR5V&%F`+?7weBQ)A+n~I%UF`3c
zSGPH0uJ{G{FEjX(BNE$n<JJ2>MthecC9SVdB1ATczg1s<M5FC5L;Cru%Bo0?i|dl@
z->vFc&0W?jpLBQTcO^OH>KoFxV)H+Lioe8@^;|i0kzwhET%PrdSiI6h4ZAOGTGKku
zGOGGzhS*ifH+utTUO#%FDq1{3dzaqgP4kq*H5Pl$yOJEN(%C)Rq+8EL)X=>1QBp-_
z+-DEv8;cjR%laQ(D^a$G(aqE=f42X`)-n;l%@23@xjdg8c<*YSUC;5@r-hnZ=1*(h
z^7-Q$7onniAsvj<7(2F_-HYL$tA3QFLvh#1ZtXw@%WE^$cB`a+l8NN@uw^z&u+?JW
zkauo8?Px2yJy?R>=ZI@>zxU@oT1j&j3K_(|dbD_pfqlp1V^a&f9=uuQtH$(A>*bNU
zUfHt_OEi>4>>Om8@;$9e97LX)tV)oaGW~$c8}aLf6CWit9E|CR{(Y8LiQ|;Gs8`i5
z-&GHp*!w?(hIFm0nl>#kr-Qvd)pO$V&c91!mT4wkN)q`{VX?bGY%P1I#F9cYzx6GD
zH+1MHC>`7En0Z*{AXEALm}4(PbN{d7{#_bnu~%k!WbXfSE>D}7D~+;kG~aS5ynB?j
z)sWS{{`4E8)VWWWewA*UePCaPz2@;>;uAE^bLtfSSs3?c)?wxa`my;k|LvMxyM^*i
zFY`CHG;BAibK0vk@8F#N?B0+Ul~ZrU^eqz!oZ@=m)|Z^<+q=@{bWB~*<G$!G3s+nW
zN9>pFR;-gYbv)m0#qQN!xPrZv;gs)s*N~@yR$a?14cxmu4`)m7EP9!EQbo4cC2{S+
zMdudT6kq4apVuq9ea`PBuH%aACw<oOu3_5Tct4bvS#ip=bKGkbK4$1=Oldg9rf}m5
zd!=U1pA)t7uGw9<Hs|<>sY0`C7pTqH)*0z|c9MbJ<-$hm)=8>Yf<5~urp%D^XP=fc
zZN{T{;-Zr)&ud5Yec)4BCOXYv_9k9=iGVrLjmB?ZUR=Fcb^@1UNX!3IRTZ3%?x))9
zdG+})Q`zH>Jbn3<yiWEf8iVqDjQzd8TmEf1&TxLx_J`N!-V`p|<CplVZfW$fTZ|ju
zi5groo^fWM80Sm(Vu$C?6<*%GyZ*%HYey}vvnT)YYgb!vc*m+P2D9~c8~!Q%k7anb
z_xi^jB70>und=X1UaNknTcDu8#`?^I6rS`ehol=~x*usTUVda@RlYx8;)WQdj|KM6
zgM&31Wy3lG7EH{(qV_;@zDmiHY5TcrS2;YCn#S~4s(J=r!;+7h@Af+1@K>>zbbDiL
z<m5E(9`}2xabZd?n_K1wFh4SD>*ZjrZ9IPJ(&?fXMKk$>8K!w;tkz*$zwOuCuHzbx
z%*UL9SNVI-@&5T-o9V*#%^^oWi<a+v{724L(lEX5`Ap&T-*=9mteu|jbh&uCg3ONR
zX_kxky?^a)k?C4Dxzc?43PpomJWh86PV6}(-;ro{KT2JpVX@TqrLW$(Ir@B3O0YR_
zWD!I9iub;!xUF`4-MeSqveKtLvh14e8j26tpZEo`><w^clCb?OcA$-id)24u0z2=S
zyr^_|`$_a%Uwdu)XZ|V4qCOlP5^-!QK3~E%Z2zDu;g{hi@b}8%eeI7V6IhPynR{&K
z-uDx8_A)=;Tf<Y3Dfo47`uTNv6LOX3?9I9M`P%;Diz9iDRHR*TR?H3F#CwRd?rGy=
zPGK?KZ_{3EQ(D7t^6h0K9Z~UFN5Yv5TAuJW?`gH0ZYRG|-KCO&VHdOgxtS)6?`!=J
zNN;w1)Q~7+esZ1Ua!ICSDFIJrRj!$B2QI%-l0Fo8?swAl+a|@KM>HSYT*zZnTbZTX
zleECXVf}mC;|G&2+rHp8KNJuuAD-d#rS0$Y<ws|-)+9cbX6x`^E17xFXMx(+xQ~)L
zhKHJKU%YnWGG2B|#>R)|?5Retq?smZZhY6|=F9ZY>vlDMa6rr~$-i4l?rBd%_WJ)m
zD~_`NPfOAAar<!J$>-4(^#f96m7xdu14X_ZR&|v=zq=v*Sgdyfx0>M`<HjwW+Xc-8
z#Q2%b<8FMsBemnRPrAZ;W_F)TLO=iNiO0ChZn>~(pXqyz&vtvP|2(&na|{UQ)%Sic
z?D)Io4CD9oI|X}+IAYGP`pVtyyi3RI^!-BPruzp>1D1AkRa6ArDqhYe(xsyrxQzQx
zfz@Z-ZFeO2KS+hPNA^l6f7f*uneHr;xN_r_#p_B;92GuRE?#SzZ-4I3spiGmzD5!`
zd)9b-+o06&nW4_kt&;J!^TLB|SKZ%PtUS%N)NBoR)9GDnyZB09{(PLB^ZNW=<9b;a
z|MTye9&4*;ENo~mJRqc8w(#7R6Ia|f7KZd6&wGBo(rMxU{+Cm%xwG%-?>M}C=9JYh
z8XOJ@uBx_)xDqP4s`LAOxj8a>yTA3{+jqD6yOx!$g{AGsz<I5iQ;Zt6E_j$Cdg%Yb
z6Xn*dYwzs*`)AP(_gIzp8`f@B{`sj$=tAFKn^=cUjmIw9b^Ltar)|MMVg6k6A7P<q
z%5vhSOfzvUXbTR=IQ?Sh8_#`AJc_e9YO?N{^K^+hiEF$%ER)cg!7O~_pN$0TzG_!h
zzAh#GT|4V1fA#)TqQ%VocXr=1w#elV74J<ykTR$Af&WQeF*Dx#!RFyhGJ}suIHxnn
zYD9nHR=rnaQM>ow+K?;!iMITYrDoWzYW=i}B}sPa_8Z*&zqJppbmq9AUgXPUBA{|I
zDKf&N$KC(+vKjGLdYmdlX0IqdwX)Q2M`wD(et`-V$tOE>ULH|=Fd_bdCVP7H$umE=
zW+%MUS-4WDL7724BV@l4|1L+BBg{AI8gvV9?|5%)=M<r^OO#dVg7tom*P5M&cf9@G
zVlsbMgR}XmISb7DC*19PSKT=CKwPuf-9;xJ-c^6T%jA==TY7V!OhsmOq1vL0YIP45
zaIjB^ve56itMF{YtX(}VsZHWn4m8#5XMI-x+%&h)R5te=OMzlPOPy=c#wf4XOXjQy
zIDffGX{AWtqI*6}Ee|jL<lvj^JmoQ?K<w5}Z>mk|X5?D&+*kG6t^46dzh>9_YW3gk
z?UVkgfAqOz&*6PxWoOF8Z|rV&Uawpn@%o!;fxfrn36W27W#)1`hxf{VyMKte*zC(U
zhZT+z_aquC)|~jR#~I;a{(D2G&xdz%Rn}*{n^)8vIUR6c<&vXZ_NmoH2YRa9yZQMy
z%sLV=@!iuSf1LaKrvG@PT4wC_RrJlz3qMcWTy*!k<1~eBp5o<)lWz1|zmwJHac)&9
z{k<hQY`1$?{)`JI%WAn_O7I=q;Orl096#yTQvcJ@i`czmL@I4dy*xU)L=X5y7hIIt
z{`(R)!^)#PY<^6R{vT&w4`4c-?<n6k-H<O-WL5RN_#Xzjg~$E~_&x2c+q~|cfaK$?
z%fiw%X56lrl7D#5#>9IfE5laluzp#+NchEC-YH*Y*m7=uoMgb-v(;}h?~me%YHJR!
z+|zJj|3Qsqm5lG^^`_hMzCY5`Zu^%<VfD_~HJ2V<JtMtjD%-YG!MkqpzAOoRF2{Xl
zmcW8JbIN=laGq$I^K#=0$<xgFS{t{--#KtZVdk{1$4{HHZ~1k`pFVv!WJ-PWy%(v4
zk)fB1(vu%Qd#2{{RQ=`b&A-C#Jlf=c;YtE?=~w3)@65KDoA19>v+=Leo;7O8%gxt&
z3U`SartmR3Co_gbzJIaz_RP(^%_>`_XMXoedFWd;)z5X(vBbEToCoW9V{Qp<zJDTW
zdbaxJlM3?74|{C&y5RM7O2Ogn(i?V*I?W7Z`4_pduC9#v|NUv|ub<n^TW%7aVf^u(
zKl=oE)8`dT6JCileA%FVCPd<ljjQzDxyxf;8&A(ZaiqZG#pUeSHFrIuT=}nVo?5<Q
zUb4;fikQN-ytqYP=d?Pf>w7RU{>{_+ouO7%$?;A*?(yzB-qNP6GsJ{UxA;2jmt811
zRrvl(-b1?&+s=OQ{@z_<lOK<6n+B|EvsVnRNcg@l|Lf-b(lzSa&2IHcRYw&+I9zx$
zoIiTAhqJ@g#&;8R|L-})y87v7%{37ZK5TJi{@bpx)aOIQ#n+q7_BGhfRNWZ#Nj!yD
zm{}~sV`Ja{pG)Sh|L`t;!p9iRRH>Aiw^Z1;8+GjVv?MvM-(0>@PTNSeI4WSiX@%O%
zFiTPAEw(PKeGE4l&mBK;WR;91yXWJymAko==gs@7Tg>L1ER}6iRvuAwjcL=&BiB6p
zMFZEZl1}ljv{b5IdxdA?ksOaT0dcNh9QpP>c)Z~%v&HNcX`bu;YrkUN5beO4D88Mm
z@k!hCUFU-K*7)wKd-Z7UnvRflySQa#!X8U*>6Nbe8L<B9s=HgJNXP12^7(%AndPbr
z4yy`xpPumVMyil)C*S>gi^}_<_1&-U+l2g|Zuxcl&VO&6zy8m>zWi`C^P!W@0)BQf
z`=U4&)`ZB*<t?sG-+1e9R^*-kKmP4l{jWQ<(0=*9_-RM?#@;`8Cw|(|zx|&J{!dRW
z%>VxIp_$b0!s8G2$BF%PUv6J|^?zFAlk+S8zuk0V`)lhJlLh?bUH+Y4{y&CeVHL<^
z=a(-dMZ7*~-Rl2vf4<U6Ee5fzyLP==#dN6l$@+)>Yc@HqWu5beyHs8O{DTkiOis-Q
zs-GXRs(ZiL@lM6H>D%6k-kUz{)3se+zRkD)9<cm^`c%e%V`n7&bjwdRKIr<utsN-3
zdTM#4>KR+}oJXeIXP3M?E_{TAcWGdZZ1Wqgig}jGF29+1Uq9cn=JCezpsSv<s!w&S
z?ti<8ZN_eXi^QB4_rC14l3rZa?4aJs*b#fn!uHyNJr^zZ1w2l@ay63ia{jwZFN>90
zrajib^lFpbg~UTE&i{OUY>QmK`M$r;j+&SF9lSPai_En>7bh1tSY9v}k^QVc@3PS$
zGp&6)l(cJi-Bsc&YuR;h?y)}ph^5b;)g_tUiGMqB-M*iHmR~)l_GZOus~18l1p;Pe
zf%>-v@<ZJli>`)mXZS9on)d6_z9sVxTK{^zZ&%N0?~3O7CWpqbjtLeozUHiy{IJm@
z<JeU930u#KG;vh<3+-`yac@ul$y7c!sU*ITI=-!Y8@B9=Sn%BA#g}it*;~K4J)b(E
z?~R&lRM0Q)w@rdRk8T_Njg9!;Y7wzz$HcUWDcq7L-e>GpdzmA5Q8A5!^X$jjzm1z#
z)Ghirmv^6O_i68z@{q^(ygytypw+!)jnn?xgI%%{uAj=wuIEcODHclPzHqqh$=lg{
zYmSTGp1(i1%Y^A`YF+t))GY~9);<omS$OKDlC>T065-8>!s59N#qCR~*S>R*Jftk3
zvHa?H=^ND?;RY&J8<jq{@p*@N+kdQ#<njG|?v%efzs}p8dt9d$=7+6~Iw!Sp_oeMO
z)9)uuKiwC$Sp4DXjZ87lo4ELk*?7OIK3?YKt>k<?=)!E{6>M`DgBQ=Ulz8y!uU|@5
z+VV4HUjt58nRw-kZ?0?Kb#!gY@}5A8HFI;{&S_t<ROgMX<NKLCc0X?Jn|*a!&<|yv
z!=Ino=1z8#x^2k3RqE+ib#<R}qJD;U_Z(fh63T16?>T2{&v4E4>|i^y?pKm&bj`oA
z?xj+FN*`y7)p#7;qr5)BO5o<ThJaqX!nS8_hh&*vei2ahHwhB-?C$ft@FQt@^s@N5
z0cTXVe!ZZyXx-OU(>(b7h3^E0&Zu8;>5sSg_QGb_O|C-j6Vn#UaO<7tSlhbw%BF|5
zHG1xsjtR-ei8q#gKRk7@{)^hDU!KnwPQH~{;r!8T0e9hfhdKWQt>!J<$Ca|IX35cC
zlk#*Q7;fdXcGg<Iz2}bqBTJc}9UPTcC)V^ed{mv5@;T#b{OpJinHD|9rbifl-SI7m
zXqb0?V#>XzZjl+g+E<-CEpc}0&$@4X59$M@f~Vx2U%qt0Y1fShI)AJc+mLlGCT9NW
zP~WoK%ktuNzqn=Ye6ca}h03g_?`;+t-LBDI!pv}F=c~oX)P0Y=J8a^*<#M*4h;iqc
zmy3);uXP*$sq<?)fAm5G=a%hn!sZIBy|_u`g6#$l2eFou)w{R<zx;4_^NYLpZZ`|(
z99zCuFn8kxmOJ*>Rr~JC@3H%{JXYgK(7r;>0vR6WD>?1$k);gvQ_pJ(nEadKx2j@+
zpz5uShb?d4IbC_x_ub0hSqbM@t|U(uw)*USdK2fD^UCul79Ed>*nHCJ+urrBPHEQ{
zwI0{Eud%54?4=!3Z)N3Z{A{iJylZa%WaHgAzBKH1oW6NS$fW~&vu>FO?B>$TIXH8c
zaaNDdxpT2I-rU(PqhZ>vw`J<|Y1x%4_On0Q9;<ow*^84W?W>A5^*&B3kotE*?r{3W
zmph+WnTT7*m3ZwhuzJznn*5@=YkJSEIdd1j-I3zr+~pUo{7CSG<a1rNTNd_{1EOX$
zS;nr~Yd7m_Vz{(e#1GA>+uLLJ&t~B0*&6!jZkN#(2h+BBYyJLTH-0^dD<G@W(BZJW
z(VZ9uu~#Vp6Q?$`xZBBge!0G1M03>xmiU11oh2m!22=d_ru%f6hpVo&x&I?~*^@&L
zelPrfm`A|w<od$aQ`e_WS#&Kt{$|R-YqlpYKAfn3w(E<ME5B&wnMN+=)TK?^l0H@D
zn(X~pI#2C{xXyk~R^fK7yuuZkrt@0OyuN(5N_L+y_vweOZNFomuGu`XN#n5aiQS>U
zF6uR_tmt}BKKr9N*IP4%-Dmc2ew>^8LOHxaE4hPb`-AQ?c9u$t-@m?kt&(XfRjQSx
zv1>=I)S1aYTi&jbm1v2+!}RO}@2r%1qkQ{`LLpYl)9)?U(o0xc%T#pES?-f!fS|%6
zm;EB!*pApP*`*StYJAXVL7T+3iQ4zVIa=a&<Sc%%cvahj!pyMOhb~UJx^!3Ugmwnc
zoVpoLG8}Cc4&FGO$SRtd^t#JF^3L1K$JD#O*L;e&dEw5a9ir1+&pnk~{aN<GY>|Dx
z{zn`SjyOK)M(RJq<sZ`1m3Fl(Nser*FWn>+T5!G9uKjw(2EOe--zUbFaO(f)nCUXf
zLQah5*=s|UWs>e*T0cH->a*Q1rk;JF^<fsfgo(Ol>@l}xvpwd2R5+^On-g>Pi0|nS
z!b)$0C%b#}z1x<WJmY80_v+r4$GqN7a@jENu=$e}D;akcDxWId+0?_~Tr-1zLds2U
zciE&9IdbndvTtgiB*gtHWZna>_;}Wmh$pHuU$2dBzYtWSANTT6`q`Sxm-~G<+%vv2
zy*;t9+WbVsg*z=Xsy(;YB^j+vTRWT2`_@|#o8Cihbu*6LjJ|XwGG&L#@;2US26aq}
z9AY<}y?tKX=eA?axhWrQ*S)#%A+ap(<-9{ia~W1Yd8sVRx<EFN^~Ay7-k&s1Y+iNZ
z_>U>y9HdNt^=eeuaCV#*5`A~#+EQ6QYsrfXT;{aiQ=I?vO2N`_-ssY-0)vKCD_GyN
z<n*h~oxd`5opYEkvtzo;%B{N`McJp7ORUuLkh`?==^XEZU79?#?-JseEIY-@uLwWg
zaIjO^%5+7hkXd-*`_CTXci&_l<hz#d6wx>Jrs=#h=ck<ctS&L_^5>;H#JKtPT%MR)
z8`)YvZ?f&Q?#Mm<-;Or!dKVWeJmLHawySrJh<!HLGvRUEg<D6n+C<G*Coip>7kNy!
zsk?1ao!P?@-38AU9(s0i&9B4^+s7x|7DhF-U0IM5mvZ3XgtzmW=k3Z#)K=&El%(+V
z>D$Q<3JTP@1#ULkbBeHU-?-<Ch06KK2`dZi*rZr*RSN0wT})osmHftrb6VH=<OP}S
zI^t4I6PHO9E1J!I`f0b-xz2nk&Ev(pvd>Dai>sgX=+GH=(VwNSmT@ymM{BOxCYsUL
zZo+PLY-@nQigcr@Ns{|I=b5m(96ogLzQEOj=IoaT46b!;VAi+oT_DP^da_K~OV0->
zEo#i(Z4FgI2BLOe%!fY&cspw~)`nb~IO~zuOwS`Lg8g4zbPbz*@6R;b+=t0OG&jGJ
zH&jYLx|}2BovTdluDgvdn0_>>q|J2F`CxEOukg!v)7FM5<=)Ou#l&woCfty5Zr%2_
z`XtZ3Z?+1L<L1lkweP*0`LA<n`yJ_n++sE#jF?3QuXy^qU1!!TH*nq_@ZP2EcJR67
zFWPkPzL;|1Rew^%@lTmAN^Bl+uxo8;l>YGe%yGSkt|zQ^y*MD=xv2PUy4SIAh6NAb
z^Kx%?>(5{F{_e@B@7DKZ&5Q4wNnc{OZE4%B@h9;5jemXYx%msXHgG-Jc|MO*rzuhU
zb*iZ}cc;o@Nq_$D{q`I5Qic38*L_s-DL>%9|JS$doJV5+B*Mk)_0;0`A9!vU*0}y`
zdD6MlFH3%$?LO;U!yPZ3|L>RYW7hZ+4+UoMT)k2GqDTE(eE9nFR}2Dd<zLLIWnSVg
zUh_+RQ^DniV-Mpdy(n0*B|Sk^;^tTLn#JAsOE$32ue+3YVMhLC^HS~h)Y?jkkmXFl
zUDJR3c@f)KeR*+;LrL`E>zdQt{UaiTw2EA#7Eajm_#jWy7fa85bq_xV?5lftz@hNW
zy{>%^d_S#zyKV2}82NRp_xBv~F}(OCSaPYmpxA!i_CVi*9J;<UO^>xcUFR~f^JDn!
zWdcgsHhfpR(=MBtToG}*>>$cpFEZ7{)$ZA$j9n{Ut+({@|DyF}itRe9=+A!wp71!#
zD2ZjWx#z)tm}la?LT-uhxrxWC3|Ag6Jp9VJ{MCj(s{4QbYJGFDY{BD%(}_H3trDze
zN!7jOVtTW~dX8}#oNP~Bp(<&lBzChZHqYbH?FBpUH#jO*-}X@d*c##fF)8-dl?O3S
z$MmMYHgBmpzvcY(LXmH*0Uy71Z(F=eNpq3Ub;h|p_n$M|zEic)US6VT^-{;TZ*|{@
z7w&TZl3j0Tz@~aQfW=*1q-N3kw<{xZzucZ>%C%<s3&GfM*Rr=OJ?1YhNnx#OS%1CI
zO0BqXi%`B*t=}n?*K_iBzRWxFG5r3%8~>iUe)#P9<86FZVvJwDv;o_OTE>f86jeW#
z&T26)ENi^CCO$u>ZtKRsXOE@U1wVbg$K#sn!FBwXw3_!zvqb5Y3rn@`*jE4NU&j9j
zPoBJ}-SWNe|MJ6^o8$M@G1hSO^2HpC%iF|pEa6O|w++K3(}m_vdR}`DD*lc!addQ*
znfuoJ$)PpUAzr)}IV9HEt@WF~)p}3;uZMpd>)(}JoAtfEBU1SVM<A!<vyx+rKij9M
zNwFKsu57cgDwNp&UZ&#1S(~qut|<St(J?$_Rqi6a`;vZF#?m?wrfnXn(>(n(MAq&o
zYl=I$==z()^iyg{S#@`KBm=fbug&CLJBux+{k7YvO>3Ap%DCrDE@yL|a7oaj?dGif
z70+ANDa$gk1x6<%roU|no^oJ^WWMvv7Nep!X&)qSom=RcZ=TYnemSuDT!HP&?)3|9
zpP0eDW~cw@eVY^3JF9CiF1O^IcJYN_=lb3Nr%6srx_Do?Yt>EbYVVVe)GGL;#{WEQ
zLE_hkC#q!iMYKNV-l)^<?DLuULf5U~n1DaC<Dwr{A#2lipa02j?Dl`p%_CdCg@14U
z5V`&$o51R<T4u?6$Nbr=*YDbud6v_1;S8m{|B5<hb}(sZ_8!0cV&|TSmburWr7eF5
zE&1NUui@{&xP8OKgaZBvp?{9^uUo^O7jo;^i&L+kai>?jz5eaT3tb+8{<v<o?{P89
z=e$ff=)=6BcXr|oo_PkR9RF0WX+CT2X7OY1&qI=lzqi^tRdrvSxPJ3d=NJQn?W~qd
zino?VJv-H=YErxHthCMlNf-CkDfJtM9mu)l;U?lycKzH5ruKXHvv$v%pgmP9=(u6r
z1Mk}rnVhSevd>(J<(-qh`4kt+(TgURU*!wAN$<M%VX0+jXiDArr=GbwZc~lJ);O^3
zJo7v7>-EsP3;4L1_aB)gc01>2aZ~xiy%P=p^v&>#m|*U2#V)?;iA|yKsoR$r?ysA0
z@!g*m7T>*>N-NJcDoH8bI<NjaKi<_|eoy+!o}=xv%ve_`^}n#2)s=U;x#~}L--1hP
zxHi1Fxh!z%hu!bX_pZ&4TJF2o|5cGfW`3=&^pdu%tiQ#=^4&jPxhfjAqk7t+{MWBP
ztbe#nf9r0Am0c6geF`Z`Wp%GCs`#R3W&6wh%fAD?ML|Cf9)D8#zW;$v-2dAAzxL<n
zfB#Ujzb$aRrLOSlNTZ6Wn|?fZPVKZgqT=Q0qG-&v*S>D`6JzTWW$oT+H$`<PU(*dT
zI?Aot8?)ir$tSE9;Y)5Sq#moNlH_N}df=7W85<QE68N`|PuA#LtC2#Gpn=AvlB*p4
zLb2AHnwHhh*u&ZWm1A3#Nal?{PplQbR`2$GvSXK;g>Uaq&Wp$77QbOneg9|Tw!Q!E
z?iK&Dr@H+9XW9R5lBb;h?RaN<%64*Z+x}qVmv=oUe82zOY)0W%iSo(YR(H1C*Uc`P
ze6heN^k`_<S^-;Ysio5UG{e;O|M||{Q{kh2{L%fEliQ*nG5P$PZB_YkhM(Oz)>oc$
z_qgSqo9A}%>nGdO|GvK1ZT2s`|D~kT-Ip^?syr!VVxPlqQ<*4HwCSwHVvgsvd?j`F
zmj5gN`FgD<!y#eAH)>sq!6lJ*Y-LU|tBCXMo-U@+^k<%*=>J!*6SrPzR!x1Se7IGm
zRd_;Xih`SjzT&q#&;4q1CVx)Z@Otk-t5P<(-8FNnuSYh=mtI*|@nxCNnTgD)>pq=*
zV7KAb_q(_DPF=UnNBOi<ctZ8Jd)*7&>kk_UB~Oe^5GmNQ>p<6r!o?m1lJVS`0y6^+
z1Z(9oURdTU;}_`3cWG1CU*C)0%>0a3UfH$ahlFl<`0DKv=AOCPwOxyrWID%6uC{*S
zk!r^zbbk3k)0~pqZhr#gmh)dMRZg;TEIhLDefirBSFeb1Eof_eSspT7#qUS;w!O)$
zXY-o><{94jD15MPqeRX(mkqnS4|d(3$MG#QV7r*}-@1=2q5jRk?mqfiC9&$Q=5^Ds
z-ys44jdq6vTJE3N?JTliwRVE^m3)b<+?=yww$#M1+g9n7bLXvDUal2c=XYI0b;4!)
zxxOoMD%-N_ePTMEpL>)#Ias~7@$2C=QQd*F+h(m|{>*l?{`2b?xuvhq_|9xt`XhE)
z_{BxvckCB^Wd3dGmB(AkYp#4M^OIlJ^LOpWw=bVvQPmZ@sCr9p`rXv0I!ULc67K)=
zst@~6uwwJIl@|9t*v`EoeD>1m9bVq2g~E9+{dTVZ+pH(-60~kjY10Dk?0l9#^7<|R
zC#?VfV#&O+SDMCaPd%Uax;)UPa{H-E{STjroi=5@V|qU}?b_Xz(^sS8K5}Q(eS9*D
z|HHHMhHLC^9=di|SLfNyZGx|Yqkp_({G*q0K6#;zVO-}!i?pL1T>4@bJNG&q`d3$O
zT=Q}3l?M~nS{(l{=}NrT`G=<br(0*sr5Ac62J*4EbMmj-^v7+jxnH;9!^ek(QZ{wI
zsI<HOJyhb8sbuSaw<%L69{0F@*xO=iq07rndpZJ>LibJ;T%$TiKIDnMQP6Q2d%384
zv-!%_7Cx{ojoPqx@+P~u%lT`~nB$c+o+d06SvE;&GHXS}3hvcHn_5JU-M_5dv-#Y$
zi}`*kRtIJznKn8FotJ%hyJFR<X{X-Ye6>i_dg?`=he4ui?EVQ%Zsc3;yW^0hboUdd
z>Ivs(TD<d6S6yur-Zfd&iH%M7&;QScm2!vv|9=>LJM;QKx4=ycCil4%O7T73#8vZT
zGRJ|NcT~03zP)R5;q^)$%d#~4uIu*&Mc6N&DYO%R>e8P%GrlGIA$QS|E7u+yb&4N7
zdVaIkHSa}h9z1vum?q=0ib;CTgm=4VRQ|41s%zMMPgV8bv6Qd+htBR_lmCA!``a4n
zI#++Q{kQIYY06YwBDrSKJoA?-s{3ui?q=OunW)Eo>COEoHA`I1^B>fFV{m=Ky!4)}
zvf>NBbFX_X{m_&9pZxdld)J;lyKie2TfwcJixjFhZQ6KLQ(LE@c6VRnjl3K4TZ+OT
zo5cl{N%tMreyx<bY|8N&JT-08SMCs-6JRshEmW^|eo>wCo~aLA+7ElneP^9zmgLni
zX-}NNNeQj1#<%u7)zF-kXzQEgwQu?pnO)P8g_kX!Imc_;>%$s{P8B(xO`H=bbaazY
z;UcHU|CMSaij~xiPX%=H7C&&VOqlX=wa)&4bt{)N_bs^Bx=D=t-@m)!agR4Y`@3A@
z)7RN1j2~w1NZ@WQoEOh~M3v1h(VSJ(Y0d$QqN~S`u$4{WRO4BGM*iOM3tGVw-s``S
z%FH{nvTALg;+mQh-{peR7jk?l?aPz52)?|7X`{~Lf_-zMxZ^XYy2st%ow=^w=iRnn
zx4)l##?`&$Ij_Xc?scU;2Qv9jOES2w$Z>dK`+ZJ-UN6^d$8*`mvG+o9*8Ttb$MWj`
zOfyya32wVfbQPxlU-ossdGvA1<5rdIU3<SRFV<^V6`;poZ&&gE@WqpjyYyF`xNuDI
z_=KHGh0d?Pt=PodFeOseZt8dT*|w^F32_r=#NIXN6q&fgFUjAhpwysGzj1kPe%tJ5
z#SIb*nrlScU+h`9oPYiFh82&G+WKw%^QrvDHqQH1tN-t6T*cjMb=Wp2zjNO<wvEDF
z=4-qzPrH7Q>G7(U6BcJ!{gh}nwx1anyT*E%XGZ6T+pC-9m3a0D?fv`V*%yJeOJ|ke
zzAHa7>s;Q84?hx4&YCg(+^V0i9y~9XzqhCGY8T_|D))+{`Fw>;>N6g4{3yI|$^Ou9
zH^1H6;so0LW}aAba+8nS)#4|-zZa+REK6Yyw$@^JCUa_A@-2-uhWw}e403k_B=B)Q
zWxcrXL({dI(6c)xD)|18E{$AJ`rx|$l7zQxmt~gUoEp7Cc$d+<5~&=)g=gaLdv;vX
z&UCzQz1i>RRx>*l!A6r+VO-WFOugDKWg?aeUwotXZRO2S$>Qa!XUj$|7TNIdT-*LL
z4Q38uYs_x=B`}A6xLi>on*1tvd45mvnUz=G$VGj(mFkT+nY&=m5tFODH!ih2`uHI5
z)5+!1(-mei2p2_9a=4w_`{}s(6#ncf=QZ9OW{YIo>aIH9oMXbLU|Y^Y8~#PBRlgp~
z<=*_}@6L&gE$g1W*myh4(nJ3K4Tan$`6an0HVZAecyV##;YEiJJ2Z2-r0SZil<fY%
z)39;sC#%&>uXil4Na(w|V(rW+*B0j)I0?k5NK8(1bUgGotd>=*a#@h=qQ~sZ3u?YU
z%vIs7=J(rEct-57+{yDZRxT3ADDb^))a6~`6UMeC`<9FJ%t<|EVpg&j_!MQ={ycWe
zLrlF|q?M&N?8@xf-(w}!K3=}H`SuRSV4l+pBAIOS-v_OT+L~2&ee2hYS0?FxKA$1s
zKkb~K;?Bu4x93Vs$(#JCX~H}=SN0QotZ#1rz3<A$oJ6%eo3B6K-rLnYW#T<4=Ys9;
z`5u3~Zg5)FoteevKF1mFw3}_yt++31PnsdM^`e!E|0_kcV~@`sJL~+sY~tp<FH;^p
zEQmTSdSR2|d}Vf%cAv?Lrk9^hEmPg%bA#!h-q*b|e6#N?efzbxUY_^8m&+4xtz(K`
zHSJR7syZE=9saCZU$WrE--ft~O<Y_epIT2Hw!M&bR^lwH;}@y(Ha#b}MLt-|b!%&s
z7oMDGbt6LiOQQV#2bm3$K@6Nba@hTioL#1V+<x%71fRX05R3Px&F8M^={<fea^BcY
z!70(;{EOAgFP)#{uGqS*;V}=tL*wxyrbcH9SJZGWZQnQh^z>@)eKX&2zp6T)v_ke!
ztIVr)f11=<B!mn<*w?uPRv(Vy>*<XBcRO@~*QBFyS6H;){t&Uyd&0D(tAx=?deco6
zUB%y`S$&y$ZBKH<PSxzs6MlPZ(vw?LmrnA(zx@5B(rtH_6bB~98ST1QcVU(9x9`us
z-t4P%ue8Y7QS`Y<S!L~#6(W}%tb-G_NR-t(%)Y~WpsLt)=2wyQsQ&b(jr&@D&AA$J
zEaW8jwu8=H$J1)|Mo)<4NaBjxQqK8xj@8o--IigKPL(d0{O4N3gX0x0t|BWA@TSh4
zWUhbQ|ET$rZ^4qi$1846UEOjkZb5C=D{h6_QwMx@zR)m#d(Hf|{=U2S-u*qB`EI+E
zan%x$6>74_Sqs=_-WJ~5-nf_J(lv&pFiVN=s|<Ja{FDn)XOOun8Lg&Ve1g00(X`Xg
z<i1Rl_FFD}_-o;u*eeS2@((Og*d8ap?)1fVk24;AsSflP(KU5AU%GTvUQo#y);GPZ
z^IkI4b$%165V(Ki-kn>wZq#ht`1fktskWVd5t`4p?BQD+yT5Vnt0dVzSLr=2i==I)
zOfT4>z+Lt}`K#gY2#@*cTjuq=;;EgZd?xAXD`U6T`m*$^`{QlDR|kbA_AFT8Em)$|
z@c+5{`u6F+Vs2)MuP%#DKgfOi^3pY$=iB#Z&G}NWSo*-ll`IS22JO(?W@3DBohkn}
z=c38&qPKMQZyL;BeKxfA*7YNN7q0Tn@DXC)An2<pyENT=L9tTy-;_z$ckC0`EpsbR
z$lLU%^W3|+ww2FvtItn$d7?B^;MbnjTuE$Myz(x5N-^TI%$?4a8H>%C-+r`?@8NZs
z6|7wCK30EOp0dWgXMWNgAl;HPlT+iF&t9$LS(C#OG91~hs?r+FbYJ$UM{F15llR=i
zGiCmrMG{{kD*JSq>k3rgRQ)Rw>3Lsq(YpWg8Jp6>hq5OfpZ9P3q&;!>d;{XEZhxNU
zJeN~xddp1@`EPn>KHiO#`gqNBuC#QT-E%#G&b8N8>=HQDxclk*u*`id>d__LTVM4&
zS{3)bLsi)&FsOXhZk5OFdedB#Vnc*g^)#m0Z&wpuXjQ6IJ~w)cYv0-PGD0RlUM%9a
zym9o+gySy)4jhWx(Y?f#<Mq9;{uK+)zPREbUcBr0#$D~tHzkWb+aT3^Bz1d8>fW3d
z)zyva2D;o*-9KKaXuHOq*>hmRhxv1th0eTfx%4@s;anrLIWsTbDYEE`-l;tO`Km^h
z{wI#CE3GE*9bNv=F#eL~<1L0q*<BTPXV*>TQ%j2Plijsn&tcm4lYR{T_J=)dRKHB0
zUaY6=alJL~(yb|eYGN7BqcST@lb6`m%dc84ZpyyIHQed`)?JfD{ar4fS!c))WqIf8
zHJhD3x>krJ_ins$z4<}udAI4jKUTzNE`0KD;kFeq2YO4sMjXoge&CtV+(=EGul-k+
z8Agas%lx-M-dpScvC3&5d6i|aBp%mtHvFt*{k#9z2CL(rmnvMT?2fmZCSP}L&tnN$
z#)Rz&&$5axOh2{d{&CAs_LuhmFMO^n{n`GI`0Twq%X`)01&q!t3sv3Vkk@Sz9U?gM
zp4u0`e=5a>dp2)*t(n)T^FwlT32WQ8(rh33_)~KqJ@ytBKCE%-SYEsEjFStF|Lfi)
z7wxigNAuj{ywyjR-MV@0+^=sxiydZOjVZn!{n_s*3-c=u=L0z}6`$)Bc4>#cTX%ce
zs#_QG4?XsHC32_tRw!5Yq`W{|kyq7%x19n75B03MwesiIHFYbCZk~E~=bcQ=>uJ+x
z9k}rOkz&G&X7>HJ=FZkH^zoXK>h>>lV$qcH&MISNuf;tx=Y%@kd?j@L=x0e*29tx%
z7BV(3|A!vR+EwZrtHpGD&3W!APk86C%a$F#Zo5tFI>$qgE4J0AK2E)u@%}`?CjHlq
zx723MX{}6Ke?M>a<lnP$9aimqq;+V6r_qFu|I2r-dp2dRm|R)Xx6S_-=VmYJ{qXbn
z*W#r{<!7UBow*ZLRlH>Pxv%@qMAaX$im&QDAAf&twlrsgqDagQ&HJCf&bqSSWPL@0
z|Cvbl`Sb1nWZwH=5TDVX>RET;0qZP*z*bFzGb^_?Sx+g8bo!FtS5t70Rb-*o+=|xk
zw$n3LN`81Nx%ZLEHT~URcpr)RsjoP5_|lW(vTOFmyfr@YJo@hTiJLBcUv=e<t;@T$
z%hUtHuGzg`v-r&>sn_w5X_<G<1*RnUZLbOl%M1-Z#Vgs><a2+?{o`kLH~kN;@@sl0
z6EOWJ@64V>tj~9xG1XBM@mX|nSMt`tDdE1SH=0#xG)1c0&swjpFn8aP7kzW?JQuoF
zT&E-WN9Hf<t=F@f%0KEoT<Og;Pnzv}&Fqz|Ef>n}v(LESDzx!x$@weS9yM%{JQ-AS
zy!XiOJGb+uzTTs7oIiN`?F-*OuiNu+vBur3%HzNEj&J@YU%vWtqDl3?n(d2Ee-<<h
zpYK|5T-Nr9-Cg^2-k)!0lxP0sj6JkiL-*g+{+qA<K3cc-q_^yz?qKbcAM%SYR5EmU
znd!g3c7b8eoH^RN+^4;hylfM@Af;MlQAF;IvoTQ|GnJ)R`=4Te>d_qh`cm6Qfu>{A
z4=ZgipT@SJ?9%lY&z4!G9D9Cu>#vU4_nkDOYu)y3sW-GXs-3MJx%zyO(6+xb>nB}M
zm75ixxuCFvV@~qDrul07Zrr+Wr+qK-PeJYLKb+4y*2!)@Xl}hW{A2RAGi?PIT%|7T
z&6}gQyR+<SZnVvIFCE8k1%B}x-rIV7c^!Xt{Xc!BpXw8TD|a-w|GObu-+A}my>C*#
z_ui>3e{1cY+A(p}7J03%o!<G}{tKS$QJNO|H!}TfUvctx$*H=>FTTI9(avTi`|&?F
z4DD1ZXFfR6y2wpE&h%ZGg5KfVa#8Cdz9-z(x?n0L#Xp(F{-u<QUd(~)q)$(s!zXL)
z7kcsTZ|ckH_)~2+Z^T?`h`e~gijC)Zd*6rRzZX0U^B972=lnSn?X0{(u;g&{wvUE~
z_jw51`ghLmylMZ8UvBkJ)}IW_o^Ai5?EPxThpumrpUDq-!l-kpZFSK)vs+Tldm0u#
zH1nUocC*gB1J+;Lc72bZrY97#^PAt|Y%P{;+GQmtY<advf8XaL(KqYlzVf|$*zPIX
zm!5pFwk~qrqGu+@RSMrEI(4pI`|jH;?=4H^qxOhR50tk}%uF(U<=K*udf%qh`=Gt~
z_8LC!{N>7v=9~|i$gOKT>6_uL0=6%UuiZJgY-N~utk=QH;|G@SeU|jJ_3q05!B%1{
zQZe7F!kUZPI;QIz1S|N*rx?{lhc8h7Ewt=dtWWEKE#D<~EANP$Gf{2%^LGchn>EUv
z7G66So$Yeh{npcJ-)DE{EmC7o4|eqJx@*oQqN>l+yVA?>K#AWAF%{ikDJ*}lzj6EP
zcjv{fXMr8N6>_eXYBJ4E@>Feo8F2eI<Gp7&ZS|Fcc?ZoepZ?#b`!LbyT|(IG{?uvS
zxfWYew}tK9bYVx`DYIqYSNa{ha3@aeeb%3C)!ES-)*8Bpva0OQ+5SetKr<{&^LJu6
z&%C10cQ0>etjyoOR4-Mt%4L`Ar^URFzTW?R@7}NaZ+p*v-T%#S|EVf|-fdDz#hS^}
z4dz`D(JL0;_w4P$s-D@4cUygXJ=J{vKkxWgdG`CZJZ(GbRr`mf{{Byn`S(6Qc)wfT
z{@>r!erBnFcR`t3`n!})>$RNyW?|wyr&51!k(uO^WcF9`aj%&<s_$p~+^xUh;q-&|
z`}YTH{P>r1_m1%#`}cdV>~&n9SDGVmvtZ72B}L=Jn>MpWnc_5pm{|pbk4_Z%-}bNA
zNOiTjfOzJ#mlJ;QotyUl@5k~_=f3>zmyh4|w~gI)_4Ao#zawo}?mE1VVwEquWf~F2
zVckFH`~S`x^;ZsrXFgcnFa7=a{~fdKpQP{o&E9Ua=Aw=C`KCvWf%<Y&pT%8B*9}l=
zKK#0SflgZxQ}Flpum`K$<-XeWZ@lnWB}mx#Jm-$3>l9Ou>`|Y^tf_PIGXI0Fizx<=
zPcavFW>l_LxU2HsXRfc_7J;nq&x>zxY&HCNbH%fG%h%f9vfkd<eD#_3-aLyKp3~18
zf`31Fc3bJR3}gLH?n0eT!<i@6{&GuwDtl{&(wapAIe)eosrFQvzgT{@@q$E1(B-)+
zc4;azs2%yu+u?DAiDQq5uA8gVFOxINH_!FICpu-vg@?5n&jKvuil3>k)J#11)$7cu
z0~TSEthArrvog}w^g9+Lv{^aorbOO~$JV#XayNWb7R{LJwR+jaxN6NU)0^L{-=8MS
z^5x*xTCG<xwkvioN%b)A*m5PY^3LI39r=5%T1R)5>^~)}cYUqTqCH;C5xElT9}_}$
zy*>JChF)Q0?XB&%WR%q>=tn){{#050h5y`y?3vzG$3@GzlMHuXU0TOoHv3~n-H(uC
zo97sw-9Lf<?0q@w^Q?aYa${C~eim@^4ok_~ytK67AO9bxdVeyC+OFX5KJ8hYv03}$
zh3ZRUXVfSzjXPXdx9#NjkJ)v{t*=b3(c89jM*c0f<86trKEGGCSiaZ&-}d5jyN_w@
zs8<o+dePwdhxK;<>mMwhB7Qn)Vd~c-)^pE45mPYu!~e)*=eKKDGyX=qcht&=zZ3Z_
z8!IErs(C=D^V%x*-LJgwpFYC7sOI{2&&@_f>JxU{T-R=S^byNxO|?rsnhmA$LVMgB
za!YQzA8YxLz?snC$i=KM{m|SWi}r*wWqs(F`QC8rZT7wF{z7kC`Bj8Mg?qHQ?guRY
z7BAcB&Fhz1IOD7If6f!Kt>&x(LW`#!|5Z7`J0bLso11>gRVRI?iJET<v}YzP&^#v5
z?;*Riv()9KhS#Nw9t$2@_3aGpIeTw<<h<YR@8jHmU;OyH*<3zOc0%T={U39VRzG`t
zHPr8C@nf%c^{0lXI=p3`Y8=_L-s09mkDwQ)d73Bk=|6tsv|>e{g!6_YFEr1ag@wI)
z7akT6eK2?bZR^U{X8*T8o&E3jCEem~5pMgH>X$Pl3QZO(Jb%-&q3vjHX~mVdHb?fX
zJUYvY`?F3tN92i~O*`hC`4}+k$YG`a8#Ox;RqlH59a*5f$F^v4fWd3cP$~CQwF#wd
z{IB*Ehir-}wKCOZS$g}{*BGuq&(c3zOI%KU-F^0V|IDzC{ClsrShE%7UsU^7;CxwW
z-;5)1^LTUFx%wWv9#2{PW0OJir63zgm5s+Mq#m{&kgePQ{5HelxeG)*4Ggu5f2B;$
zaQ_{zchzpf*7MVu>W!y|J)Q7=sfzOT?QAR)G$vaHDO9ICIjYT<-u!ZQ(?ZpNs7Eu4
z53kU#TPL$~;;(0C+V8G1m3ftOe&y~DL9x?z=5@>aG5?c&{4q}Of@r|y<7*UMOQTCl
znICD-H=EO!{k>sR`+~Pl`HXy4yE@!>bU&=Uz1A=EI(y}Hzuy+Dzov%$e|Es>H*-PR
zjYl0R>#DlLj5|NZuD&7HvY%~IjMXAJ?}<G#6!OlQ$!}4bXVdju_wd&T@7HV0KFck(
z)8_x>*r|&e|K)OWxTzI*nX58uew=79VfV^N>yLj|uU>Vuf69q>>&o_I+r(ac#d5Jt
zZQ3;1yI#{1yLK`^)OdKstwGVx?SPPA=^}q^>qDZxnV!-qZX0`l>zzL2fBl@A`lk1N
zOY;+>Pk)o$)OsxTzU!_<iz=Bq1wU*o32(AK^`b{DKqi*;Y^m^;%d*FkdFJ)F9SH3U
z+^Nyvb}Fx2VuP>ciR2lLJ_%FS?l`dLor=Vins3)?8!Im+7C!6lnX$N7f%VYZy5LDy
z)^Cfxle@(=slwsoe7D=5+}ll?ugYuJ*>O)@pIGqzQx}hb^!4{;E&;rUqaH5pV_CYJ
zJAT)fcL7_@Y1~^rO{9|TxTfngz6loPHZ$L*n;gr2;PX63O=`=XGnUc<&f(wv-g~|{
zazU0Oh;4;j|4G$3hxe)1tXJXI_|7?}sz_<UahrOP_UNPEAKs`wYU=uvdDk-~{Zjew
zsXn=D{K}8~VSU_w$>GKJ%b}UR3At<*zwAVFZYR!t=si{Z_QeQ8DI4|Wo~Je*Wt?fI
zJaO*Rmg!-e*P8iiXMA0x?(Xj?ZvA4#nse`7#xOH+T6J|R&D(g_N1?aff;W2pV>TDH
zM-8(N?Y4g7aQQMfgV|c<msMQztY@m7o3-xvT|xe%y+&2NjbX?3oOEH5W4rX_xZXaO
z35P7zw|m;SxoL)6Ib{8-_`ZmGO8SQ@mkQ>X$!_ggZ)F;xtD`TqRrKG&>^*anCf%K$
zojcE|QS+wT%x6u^2fqHDH&tYb?PT7ptqzy(^Bps0Ke$?G@oKfA1s~Tb&w6sh$;x7;
z%U+&C>0f=mI+mSVR{ph1Gwx|#*J%!Kwin)VhHD>psg+-SvE{w1`~x1===Xi?`<MMJ
zvAgRWIGt0jKw7oX?%ubXId7C&drxnkHRW8;4vy5OiJmVSq&Ovo56HY<bh-GIT$VGB
z%9K}EZymlj>u^WH?%LftA_lkht<1ROE7YWZBnY@jl**Uh-SdA{Ladncai^xk8*g@m
z)pSMiFnIMdZ!)_n=Fj4_cj@l;KThRJ1omZ_ob%~WwtIi+zaYnIsX6x^aw?z5czngU
z;o+HEnZ?&OO?oSJ!I|R~i~h!Nk?;nmN68a>as=2#gLw~m*eSW4pUi7-k;(He-I6~j
zEc>19+S+!nn=(T49<9^9+&?3)`N^r>6YT_bw)U6a-<hneHEG+N<f+UI=ltVEzEAnt
zweO{|?bj*RKDl43p1IuG`+4a$-KCr>p1f&1`|<qyFVd4_-psRKw13s+Ng0AYOFW)g
z`v!VUoaWQ8qI1&rzn|an1~BDcw0Pg7-6iU4czs9T$L$JC=jSAxv<_-I5*w#7ah1LL
zMJYFvNf#^UoK)PodPhOoqv>bo-pEYJ`=BZE^zxc*?`k(#Wd1p6^wsJ4>_uO1-?`gs
zvu^cS%cZ@ytYr$yE<3N4Ij*g9I&*Qcg+_|y*0XVYBOZ6pKWVX_<K-)j5BwQ!(HD)r
z^1MHA>Fb(>Kj+M0arxJ_s<|<%>wO>dM?cn;)Ar9b^pu)?XiAWq#1&apS!vGq9M5N%
zwRfIVbkMl8<Mx8^&^Qgf?Ellg?AW#I7vo%uz!ZOt&rEY~h4_1{oEW61Utx3TZixM&
zh|X6l)a2WIeD2r(-&=nBd)k|0YV1>|1<q5ceIR_Zm1CRP(_6<jG3LJCZkyI}&}Sdl
zIkVsQ%I;TR{J!s9_5DK<=N@eM9(w<`_x<0?-v13X3Y{vqylJ}Vvn6X-K3X|-A9iT!
zI{Q*n_}a86e~T{*UOB!#_dEC2yr<Tdu2V9U4^_-`%x3)l^W1`^Tob?ht+m~_rr{UQ
z^+iT*D|zqNc^F%0JT5<AcXz?|OPM8%XJ5Zs8DM?6x<If0JlCh2#=FY&pMJcm7`=by
z^_B@QzNd!77w09OuI2lopE+SB|Et26nx`UHaJIbbcG-K?j6=PnUNmOD-+ZB!YERd1
z@lE&^a78jM=Zfmnj?Zc@kEXWnJRf4UvTD`l)lZY}S$w}YSLRT&VU^T{r*4r?gT1!6
zDr$x#+zV3eXX5OCKX;An4*&4$E;={dkEq`=pTO5$oL;GRuJ#t=fo;AH3Tt0RW@<-2
zIi-=FdO}1r>q*jq<e#={60;Acut@OyI{Y#_;YaUmrU#K5G#w_VJ#<Mf6y#6eQuk!i
z&879f@9dBLwSE2M^B3mtJE!4X|7%v0*uCHiS<j*!H?6!4E&1oTJpHPa{nkof;p9Fu
zDb=TXbJeDK)PG)ntWmym%gV`u?Gv8F<jKvwAUV@yq3XIoci}Gog3YIkY~Ej*{^7yh
ziwEubzfBjo<7U_PK-}e9iePQ~U7OoB>Kk(%wBy)91NWKMtS#4WGd;S5FW3IyPWk^9
z`lm}6j!SmUcyse+x6RBa7Y;1($<q3^b;X-6%qCo0w-}1}SY6CisARmH$#~9d$AnB%
zKF`}z3wKC_cAaPWq!n~1xX(`HbMb_D?wwN#RFAW&&uTS|Jhfq07wdz$8^q%moPM!h
z<Ik%%_0C_M7QI)oao9U6<adO2L7C3Zrl{Nfd%ON!(My^9=J~xIo;T<Bs!N`jU!6T^
z{`rm0wtfE%iYr;RR~k)MoILTw!U+f02rXSSQMF8njq&M9o_s!~04ICV*H02-&fn=f
z+i3UdPUSN;-ZLNFJXL>RlG(%TGXL$dQ?c<`5C6`aI&<L<k2DYd7@=LgwoEc<EEO4h
z7}l5mGF$(}Lh88fi-|MLYj)pyF0t?S4dny2CoX*I=AKw$xWzN`%-#<!Dnk4JM~bbu
z^x;p?14&8#yCOk{O1if9?9j=+;~nsK;t|(JzQH9kPMKHK8LVVzUwQDzDl2(Cqq60q
z?gw5?>QTur5YK+T@>^MkCT}LU=aB{bIR2D=-k5e#%ka~ChPmIZ?=81BpH=YwpYWm&
ze2MqBZwsAwQ1Py(km$uzW<P&CXuTGEd6(OviH}xqxX<x9?dijF_RAh0{cumm<WBys
zc75~3{WoR*?EF7ttMt*hTbn{QTkUIk^<nwuD)qU`t=PCrWa~G`+SO%iPApjcs_Nn2
z#+l}NT@^uX?Au>_mhA8U>FE9O%Ce7_e{gxs2%6+@`KyIq0DEA<sl{_*PRGBJJ2}}_
zb7yg;=(%4`x`zUkc*0&MhQ2FUVR~iG?2bLJehDe6u2<#Tbjm75h2`rcv)yf0w&5$C
zf?syKMHrqcdLy{n!1#OboTJNb8O;@s2+Th8rd_LzukH1d4VITmm3(iv?Y_%cY}Itr
z%EW24!>k>dze`^V#k)EC1PB{;^DZgLDn91=<-+uE$zQWvjy+B>^!#VA>*TVX$7UU8
z=YG}XRWT>c>QeXOEnnj0_F4ZckeU-%bo<_Y%_$#GKQ^y!e}C`oUfT!r?cdCm`Jf-B
zdFat>_O~w%XG+W1)Rg{+yXt0Kl=pS1{^7r?8DDz_Bs=VkRr{&<GFev4fFs`Fp^=Zl
zZKD$<g=+3r4{sYVdh)())wy^nJXEH6HQ%8b*_Ee`^IKec+@P0ik#Z-n)T)3{lK<ni
zyPLjG-6vp`I`Mw0tAZ@Agk`!^=5q;?O@doDHX3BJeUwQ{yWq9XoIlz-k>~1Z*@)@{
zPg}<7TW4D&FAKE?{rTb7<jDR0+Or#r3}ySe1m~veo6f8>-%$MeWYLZpULs4yelqv)
zblcCHnrpqs=j_2}mGfu4KlXo{N$BDAU5#g>^LH5vUEcMKd3n>z8PA*E-Tk06`JO=2
z>D0%Yq$Y>%&i`w9<lbw^Z3o{x4XkPA-Dqe2I6&t^{3**Q4tB9ahc&H#9%brEJM#Cu
zYG&*C|BfbW4gOkoMqSho+`5M+_Y~iM-A9Lt7Q||ParqwdZ2qK{BiDB>jdIans>pWB
z@xxVNyQ$$nSUf^2R$eJvvM~G^|I8hUw@u!gvYJX>eY|lS!v<-+$o)ZFj{EMNO4!s>
z(%2y^@qv@$NwjQv%g?KAbCPCNm`T2rVCH(tDw$PK%*H**z3`Kd<yIeuZChoR%dWcQ
zl-Q+rj#EriEO}R2^5-_Y*=tgD@)s`?ES(oN`TPTpzdlMyO8Rg71l5hX?l|e^B=6gz
z;(e^-1Y`b^kDc#yzQ*(=X&7(htJw6wz?+@5@02gQy_LiV38(k!eH(a=n9k-}V!d^n
zLA`cisGUWyQej5LwCg2L9liCZr^}i&PRu+T@jph?(3X2|yhUWNt*VZo&KYB`NcN9%
z?Y@&=OkwtUHf#FFo=YVSce)J=ZyaE`*f>o!{G-n!?^KaJ9;;7RIasn-&V6(&#cXb&
z-O-}QN3TcU&-k=le;R9^L8V6RiLFMLw9czp{cfMSe@$wH>fv9FdwO&vsxNu1EZb`o
ze<1!7&!QQw{*6`}WAdjK_^<4n_E_N9hlM*-nX_sba^^B$-jFL4nUQ=Y@95&f$_LCR
zcQEh0`F*W!oKkm|i>vaVuK(>{UQSs1&BK1-t_N9~C%(MfRc!C9SvYUg-FxSyrSFw$
zvn+O;v+2f;eR&f4vyAy4Equ7*;GYu{dIald-B##nS#<F9ciB9tE4*8_BrI6RRG@QS
z<WC>ZO6y1a&D)bqn$wm^Ful3H_6u`t*u=Tj&sN=<s^4fY@#g^lQNiT=Qp?8r(3?h!
zDh%Ae#pj;w5L35a=JJ;J+ME}6tM4sY!PK4Rdg$#uv7etfKQEdUHjjONX`0DAyZ2Wj
z_-3sR%Q<SA-_N#U2kYxX?uE`@kNVzJ-tuamSDSs;=~YuboE~YHa6bH1HSf=i*)R9+
zD_g$z?7`2hGBWli6$%WiH&64pdMD?k%ju%H{F2B`N9V2+yW%}_mD{pqg_c3u(rs(1
z-m+X>vi$S<Jei^+o7O$H+8=MI_~ltw#u*=}aP~<P<}MGah;=(x+Is!3lfvF3(>#uA
z<aKUzc)X?iNE?&oBe_WN(@O;N=0(~{N&a%~47q0|?!r0kQeg82r<Qn+Gg7qy^LeMo
zNBKm1XYxC2oHmgyxma>({p+U3&*n}yoD`Z?F1=ye!mV0vvkhklevz(7w0U%rtC@!{
zlS`;o+1qvNy1RWR*7}_K$)*=>;I*dx)ajY3ubaJ6mZ<6<QQ6<toR=;0d0V$TZ<|`p
z=hXPR+fDh25<)JoUEcP&D>uA)8Si~HbjN~KuZ}yL%1i7rz1uHkJz4W>%l@)&hnwE%
zoH;HVck%Q4xUO~f$5MVT?8^!|==^2<Nyn9aD$N@s-s`VmJgKp+qjaCsVxicbCcj<0
z^*%>^678GvPP5_SqdKKcRZe<ey>4V><<tiTay^^a9~}2BL1lNr^kv`g@Fv_WvrKSF
zQJ*$lQSXyL^Rq`<g(^Yf3)F0xrz|+5x$eZ-DPg%284YxHHmv&Yz>@iD)AQ4Fv+w;s
zblKoi&!^-~ez(LnFEC#Hj5W5lM9<($#;$^-mK%8%*Ulb4eE5po8os%<4of$&#R>TY
z?YZIXZnY)o)dE}H`l?*RBD=4eGmFyCl^9*|tBU&E_lj#9`{`_s-!V#;Rh`Sf9LXp-
z@=o{uuZS7U5iRB3Zd;|QyMIL~`p@`vhI3Mkm0Pv9WT4m0igvTy(yh0?3BP_bTYlAs
zgGLv{rv;i<i!9xt)zWbxf-S$eS!@0wgR&U4Ql7=HcXTBCi@ONN|5A9n>aE!NjEmKB
z%ViXW>O<FhFfe8xd(^UK;l(D?{U@jRtDSRja%_~eIAitTr<z>+NxP_EKK-`olWjN`
zIQ4B)EfiIeDA7`~-fn-vZV{LNqQmj`<mbsn?7uJnX74M@5VN3@pI2OUa}l4UeWs@P
zPOIJZ%#|g9t3p&SPr8%J>Cpcn<z9e{a^2-ZwIJoiOlc)CbuR@!)!g6Una{FidjF!N
zCS&=YvOTG4zdfQ^POoMcQulgqBtMxo<jf+@s2+{f8S86S3p-ZkT+;gT&5P?zwRCcx
z^dGL-A+KVWyT(?juDa2XaH1wM%vCt4rpMPnR-qusM$CAnUh)UUOs>G3$)Wj=B=;TN
zA?4-UrliQxl=IzVRpcMFyL*mWq_Lh)+i~^#6Z_lm?CU4~&x!nhvc#xso9y}=rKGMS
zZWqq}*;W&F;f3`1c^fzqLbW7C(><K|c5C?T&6(_X{gvES=Qq)Ruibn5W8yX2<BJwt
zurH{~v);Q%F*~BKbp~5+_N8lQJ+coNIZRx1NbmZTw0JR#?dR94=uVV>Wg)YcTkOa2
zf-TFKa&n3ypO~v8haOp_nw<A_Uv=w8tJtR5>(;H?=egeHxlk&v(Q$|875}%0I6aMV
z61&R1^JMxXC5~6;^(H?JZ|O8TaQBb7u*Yg^ZEa_TsgsJVp0m!`5x;V>n!%~$Ir|s<
zUA27q?0=W$Z1?`y!+%^!?Xim0j_bke^`_eGnLJr~y0T^PhQsa|vqW4SHIFT}>x*bl
zy>Qa@MY!pPwW6`99@Q_eJ&6{~dcm-L{gYc+7oxci&vibK*A^xtD8syP;k-+`kALyI
z`rGI3LkDva855(%r>7RUM5=5`zI%n$?OKON&!lY&i<MoY0~K_x`}|(>LXLl}LF3)l
zk|!*ZKN!nw#pA6$x7cI`{h#gBYudIi-R(sM*J>^Y=B0<6tsk^bwdwqGoy%t)$Laq`
zbNHE-`!Zel{wIB(tfQxF+OBivEN2XT6Fz82`#*jdTBF!jU?I+HxpS-e#x8v&&4nAe
zt@eoiQomiosJEocuH5VC%&d%;FJn2@dbi*Fu&iTw-SUnbSBu!ozI^oETg<mA_v#Ak
z3iC2`uc~LIr-Pif&s$ab&dB7*^Ym3Oc3xU;_H5nm{8)y9*9%W+b#)2%9+8k;u*=x%
zw8mKrCuaLQ7u&A=*s!+d=mQ?>Sy3;qEIf59A~E61w(M?06P5bY8rzDFTO2xJtYj$|
zS|GJA^}8a^x6ZsxRrNO}+gTT;9$mB0*!0@5WjAF#+;|T(ORyb%xtPV$i@S2=oU|3k
z+4l)q{pNemn=xnAcedMw*OOeg@vl#Fn08;T=!C|kRiWE>rX9X)Xt04RO!nF1jS62&
zGN%_N^S{p9VIw<xqGDF>?=_|(HyeZak8|2zo)MLuWbugOTynC4S%J}nt}|>;c4==<
zn8X<>Jg;j-`eE7bGi<YOJ)99@z|-^g7Q@p64%IBu9mT%;pY2`rKsq>rXX^9llI^>0
zeU4lbGK>97WU<E{%gwPRdCfMvciX>znZUWWwCDQ$Phrx#WH|O&zCW_}P^h->{JSyd
z%P%(gc`H>OF<GhQ?IXI(ul$6T)!PX!vkK0w*s!ng`h`g%eOrzi36zE`;8QW(zTo4Y
zZ@z~sTm?caTmEdnSTVoP_N_#0x4XnGfzStYcC694;`@1J&g$KbFRt*09_m~h#mgvB
zBW>{IThr_rVyd$<inoSYG`YE%6)7idZ)A-*;bze4|8hn=-#W99xeZH2OUn){O7A*x
zX;EO8sS}GVNBQ0j$Gf%|9%QSEmF@U<^hCfCpNG*QBKr+bDIVO@te>~9Fz~Fca5mes
z7ju$Yq{ClseQ??~NPl4&$KleeA~(f%_q_k`uJ6;`mkQ-xysf8RUgEwK&~mTf`D2aq
zp68_A*2o-j)&H`Et@C`$fg1Oc=1EV2Dpi!fcvn<Tj9aqebT50Votvv2XTq0jmQz=7
zCu=UeDKY6rfy^qVEtZRwz3y|FUlUtvD6q|@tEi{%RS=g=LEFkFEHc5$KOE}CFWk<)
zDA;l8&4lcGcC*44R$9IMo_wq->eAiCCdw`gu6@<|m(xGjU+KyMXFDO`FKQ0YZRW)$
zs4+4btry#M(YwSdR5qrpHM=;)=rto}ZdaSAM~|Cjs(rynmMM>Z&waXak+57n+mjs|
z=CvuWS+nGt`AY^);{&^=e=u0h_aNW@-lV3ON`>_)8ZUI7E|6H@*W4`L8l_$M>GHkb
z&EXA;eg9SNDzDn{e&v>z$KUhE$?xeeS(y8LrPlAM)0UhJ@SpOOzmU;FKKYO>SBBNT
z6>9e+XIV47kD5L&=5^$}waT|2O>W+`C{*;P7hA9dgZTjoIhk2K?nmmR_Nxk~>N`Cw
zTVmmV>67yg$7d5S)apboJ<p)h@hx0a?u(n+<UE~9|Ez~^+WFh_{rK-^F8RA*`~Uvt
z^7SUyKFIkiXa9fk_T$6Z&EH$pkKMcY-|B{a>wW#OupZWn0%akkq2^~2g%3U0bb@iJ
zZ%@#I>C<zbcTZc#Y!P5A?Bm_Q`ZR0i171lc<wx>OKDrIoS5HX%3hLD=(KcG9=D;ej
z%da#1&_tQ6mg|$$S1ft3^3j5mLEVq|88R~$)+u_tPM^hVxMS<*lqu2njRte$of*?r
zzT3K$ZkQi%V%jt2E4{b)FD^RsN9(SikkI6`sYPKy0=1u2)-^uuvDlxz@_4u8mCY{y
zk3872V~q*h1?DS%7OXIw7*qesQ1a9w`wdkEikn^wg|f2wUfBE5VwHMf<x+R4^PhGF
z?Z2?0a?(FPZztQw8fJogy0WhtLpfh6o_Vh{ca^-UjCK0C{uMs;*Z&^aV^L8i-&|vN
zjeq6;U*UrOo~di)7!ETgrmKV-9aFt_clWLi3#GD_Gd{M@Sl0T4o$G!r^nuC#UAW5r
zNpd1Pk}|fQ{@NcNet4Bz>NJ~_4VR`JVSk`<JyYq#Wf8uclV^OcS@rL0s*2aQ$7~ND
zDV<)bxp#e^j@s7Ux84T6IDFM>!IgzqW*=aitG-Wt<Fj8Y?H<nX_i_=P$ZW-~@=#>z
zMy+QoZy3%=DyE+6{rGUD4YRi!10&<+tI?<0E`_;9oNE5*R;#l0RnnW^S2#{Awd=jj
zw950x0fV?7*K4OfnKCuwa;=wozQr^(OUc`2_fB1`oO8Bw&rVGh;Wcc+#jTG`r)R~y
zx5!D;yy7g)C{uIHA#dfIHGvAzVV_;Kf(5p0E|gQ3W!q=cbD&<;yJAP2A=g~S>%0Et
zsWTfixY<4TyYW$@rm9IYWXj2ZhHP(6W-OPvz`HRjeh)jp<|(G%RUdd`lU7<h^11tO
z)!7<L)4oD4bL01yy4L2LIFf4`{(RBlqxZrZnGf2DB&SbQdls8zV==YJ$%(uETekLr
z6B#knr%&r!>pSgyVBZTnJ8hkJ3yQMlIW=g=H&|%o_cd8|UiQosK5E=<Ak<UQ{;}`E
z5|+h#Ry^4FBvknGD(9&;SUr}WEBHEtV<q=>!_E~c_tl=a@7kZZz9;?OwPlTk#hq=u
zxm#+FFR=R2eOI_QyldWP_2<$DUM92Lj+p3j>fy5wzq>?U^1qy@dU<`KOO3;8o{3e?
z&-_eT!&9!W5@30$#eUD3@kz**l>0Xh7jN{Cp0lXXe`?>}^@s8!Pnb0AkbOI)=~)@a
zOPR>+A3uq(IaK?*w~7|;%k=ygp?~0F^lZoD=f0omI(aERY56Oz$CvH}ypT$<R6F%x
ziq!8u7kT-J2mGJ&*{`;ra#QVE7|{Iapl-OT=laV+OBTv1ynHLpA1=imk>zdPs672<
zX`)Q|V-C4H_aEBVSCmJZ%nJD~UA|@6i{0hzYSn*24_H1}Cm?KgVqd)k>-TB=taZEc
zyJuO1J&x3~ySJGA%ap(y_Gf)}sa#Dz>tKEM>Qg;_mD*Z~I(}}Mue{YI$D0H*624AT
zdUC(0utbNaEWBq)yTf5$#&4N(8=C#aeg#>-=_q}&=D-a7SyS(6%S~DG-Kc8A4AI0*
zE0&(kczE=!ayj?pX%3fndu>or*!?M=yZzHV4u6ZR2Q6|B!r6j9iPZV%|C-V-^UFpg
zY-ahZ$aFQw)VFUVD$JW~PfKrPd-U9J5#PSc592&}Pj9#&)#)%dG?b-EBq%QVj;)3E
zrKv%?ixzjE=3RDMM?W!tq0*1d5B)j=|7{S+Ou8%n`5IfB))cel#exf5bz~)8f4F<_
z<Gq*uDqV|WY}zJg9+eVHDV00gJGp$xi<#PwjE;(YX}S`}^tpY3gXe)qDuH6<r%GE6
zbEs-`9B7-)F;m-bwYBqmmklr0%H%!diEFd?cKZIIJv(kNnA~;wU?3B>q~3q>UGe&#
zW!b@&ri-IkKj$v2=sxs@W%K0)|7V7nJ~Hc-HYs&qy>DUse3fl>f^(#UuD|dSVRlF}
zD4cR>$=<MCCARf(3Qm<tF?Uy-PI~<9_WH%^<Ja6j@V_8$?~b2Y)yZ@C!ZfX4*1xOy
z!;xxN_eWji*ZS-G_x$`Jc>n8`+1q9@hs_X8^7?s%;pvN1bAcJ}P4>F3S^S;r5$EJn
zb+Y>|T-IWp`u)kNN2*^-d?x;km}lbhv`}mEfnD4t`qjT=4szvKiTsiXm4DllZc`>O
z^YgDqms-1J-sXR5yVT^~x}<V{-JQ?-ZmVi#cmCbwv0B<-p~^8ccfX<-iLB}Z&9kO4
z6HDV4&h8Cw>_1-{SH3~&;tjc~=*XL~ALIf>G`73GNR|<AIwlk(R9V+}Q0CA3@`d4b
zzn3MRTcMJ=(b&HAck9m;?Q>EuMr`zxVVd^kbPBt^l|^geZnr(2?-F+0Ul0?~KB24J
zF-1ACV&dUCE8{~B`32QWcT0x9*0a92ZQfPpfHK_*O=kYt=T`Eo_g_35G-25_!6RyQ
zu?4P+S0qo!zQ<p^JkC<*(#kDLD>cqUt!ef(u<3hJ@4Kd%Px65L5tUeXTNb&-#)ubX
zzQ(<mUWu-ey2B@&d+^7sJJ<6yUcTj+_IsT?pTo2)_xta?SHF#|3~ka;N)tb|tX0@P
zbm#M$>#x5&J^0Vx{ocjb*Utsd`KP~s$%~wW)6Z8`G+sCJ5IB7L5C4{pH)p*2_xALE
zt^Bz{@BaM!#<)AT&_g}fe2G@OdV;^eR{yH=wm$uRhDv{XYxn1~9iQfVe(lT{rD>au
zXNc8>&bb<<bLZZieVcbRFe@>s=V+FsR2&N1FY_oQz=AnI*lYV4zbgHe`+3&bY|m;B
ziT>NSDP*D9pJ}nnO+)&QR-V~kqVj6p6z)}bFCJ=pUl7?nPqwzGC4B$moo1)cUHSGb
z-*i@^#b*2b+dubhe7$4EWg|gv3sr8X!>1)Kb0nS-(B!@7@KdS%aN~}Tin@8{w=XOe
zOWb#b;qf|)o$`ka-c+mYbbkG_k7;$JsZENXZ+_e&rTr>9PVJIO{vCAU@&ViR<#Uh8
z-kvD9_42}>2kkSMR>sFp<`S3AmEXQ*m6br_+B+s`$$k1e-fW&W#qzd+v|L&8Ta!N%
zy(g9i#lMnyk#M2cui2sVntkV<w0}z3CcAFy{`n%-Q#Ffk{V@q0bH66HU;f(;b>H%z
z!qzrfTXw(W>j}ReG4W{#p15fgz2e0NDXY4}dyidH`f|EMO*JiC;%9kS@^>TKZLj!P
zix00pzi7qs4XZuxTX3CGX8bXONr1Jk=fldX1$^wsZZv+|7s|KX+wjufucfPxuU>dQ
zZPD6|8(!_xez)#qRPv{kSv3=R?Tmkj%Gz^2R!qKQsyK1IUCI~MU;1x7`TF9vukqaF
zl(M6uHZQ>BdeGC{c~^MfckkQI{``Ci!}1ABrAohlxZ0jJNl)%$Os<ksV3_WuwiPF&
z);N?kSFV|Kvg$;-*bO5#L$;suJ@UI}2pvuQV=>uuj&ML)9AD37M(<PSH39`KTUP7s
z5>d~0x!JhUa`gj$pN=Uf>o1glX8IS(b@$SfBYWCzm2|Tx>jczV3%+U6bdGNPW7jF1
zdiP4?oT>X(OxORUnU(osP1B=mhDT?7+UML`uztP2b*SD!)ftY$!72>%^gh~2iv`X+
zePZ|KmpyY`HTz0EmkAbR>^_mICuH+fNTxF<Nr`J?!5$S;_QWgGRo^)G%u<}pqWddS
z<oFh+dr#ifzPg<9#VK-H=bedRRtscOuHOxCDVr-+*|us)!0j-N3*T1y&vrQxJU>fC
zZ|hc<l=4i!t)73f<5n~+Ju~liy3ntg^Y{6BcimmC>9uhE<~)V^@6mT(EW2FUd#3$z
z{w9%B74sjV@6=O{$Za{~8+=G(uFxuFQPEg_^TmFzbMs0|zm{t82CZQA>+^lCko-zR
zR6C+W`T0zlkPOa<6<1QMD{N*}Y?>?)>BxBD;mWr~VcWk4G^nhd+?SR<|B}&E$%|b-
z7UU_3{_~AFIH}C-6z^$Cd!Jbf$xpW(PTe`*rbKIP)GOupOKzurE8D_5SLD?Uj<tVk
z@{+`D_bKEqU6|?}TfJ(n#N`zo8mBTtV#OA@On-D>Ye)O%>(!!;g8Ii?3(s<~-iW=-
z>DS#eNvU~3;69UUJZWn<Q*7l`JtnRcy~vc`wV@*0(2?Q763s7rwi{-0FLVoB;;CdL
zE7$%eSFhk5TZ(ynV1)AKXO1>HL5rHUv#YzmU-Vu5_{Eq0@A>`etg1e1U0J1f>Yjw>
zabxStpJ#nvxaQ@icdOrO@9WY2%z3Oh^}W)}2b?o)-86)@Pt&V9d--Qdz<aUHetZ`{
zzn!}A{qy$S_qIpZ-+lL>^g^S~-dOp?<&Q3MR((4CPrzUO><ft}j+6JdeeiW~jN<7t
zdha{y>h`krCn{#%-S_*JeDup4cH>z#H$;pK*^d1$dq4l;z2EYSCtv=a&v);ukA)le
zf<qkHXEnG)vICC?Y`ZX*QE1uSzv6Ec&+j>LB4)*um*$c(2~kO{ZfiHiZ*-KIBEDsL
zA*XdQf3J*~^_Bd^-&eoQ-}mp@oAZ1x*WF<K`TkhjmWRQsStl=>o@MTs8~dO<V9NdH
zzib~*w(6^&zffD*<M~yc3F*BhFRCQ=3ayb_6yjF6^ibhcqrOR98zU#qiJ!H?`OTyS
zt;*4iYi2!BaZTZ7_0Ev!Z~r=jMe}f(=RAeGZ}LsQ@Y+t-I4&5XQW270p(&JXf5Lue
z<tA$t`L$I6m;QRWmN75AD;siq>J|_E$1TZ!83Gq5PL=DqYX0(oLa*f1CC4`ZTD2@P
zO_N>o%ioDpVtcOKVD(GQ-gM(d!->x84Tr?7A`f-ST1WW5RqXxzXVtuE{8jl|`DXrF
zxAOMB_+3UHI^Q%3Ox&bnrg;ABw_d4Vatac~b1Rhp9(eI$<@uVsVf<nCx7Mxd?OQZc
z<d0$2{B8Qm@jZnPV|TB+n|vo{i{+d-sgqaKSm<5t+_E&~!pzOQZcMBTYu_)s_vLM$
z$NbrPy-XaU|HV<S&2#iS>AHxOf#Ehk1NNI5%8FC-%Jd2<_l8I3-!>DeyS`pw4*RL*
zwOfu}5M|t>TP%CVVK&Rw=Se4+8mDQ@Huc@5@|3&l-}kwTXRF>W+{QB_-e=<Tx}Oy@
zB=)K#&RC*nYQxhRv2IIYi{?_<Vkhm_l}G1odwOcw<*641w_iOczB+VgoT2&jq$t7j
z!RjeLpZ+MC%5m~^{z_%G__(Gr7RQzKnqSx4=-%@1={I-2Dz@7l>o06+QV2~t+nc&+
ziICYH4$;@WZzm)P9=r4LL@QTK)aMB^Gu~CkNf>D!d?{D?f#c7Lr+Tri*{840D%<0(
zFw;nU(b-9sd?iyZ#k2pt|Ng|?v%Sw7UrySxuQtCjZrjhdyUnF~Y!yE3;WqN=2zyeT
z$KYb3Hd*k7TgxUsiAtYkE0qP(nX){0H8DSWHm9K|aZ6OuQ!52FepVL0$(rhFp<TYJ
z{3irD9dEV0{j_01ho(wrE2IBYz9VbDHXT<`>J|>RKEXPDQ*+suQl42cA{B=I9udWN
z{I_)e5S^K&dwa?6;%z%lJyM=@=1y(R-?F*}duF8`C3BysxS(ulk$Wu0?`o>drT$mi
zFUY;r9N@NFvSZ<M)eHU27w_g)6n|f7&!N8f;9HjK59PNX{#aokb@`4$=;bZb%NhIl
z^4%Z5=9f2kCvoEJoYguVPG<{}&-UmZa#lOEEWky1`Z1^Jk*BH_s1=@B+k7UsWwyM*
zp31Mke5a*G{0S*sz&%y;ef#_u!N=zDIIP=j|NLUphqqo`9tmlR&MK338vhnr{rb#o
zy&Gp-O}=NUFz<W1<!{e6rM;E^&U<vvn_4m{|69;84<pmx{A=!d%zJvyuZQh=b-U>8
zUFKD3H$Jf`oc?vYJpcAuv&I+mm9w`RH+IN$<oV4m;PQMw^?<~k!~6SxSq0ovGP?EZ
zi0SH=MG*}xJ7c0xY<^hD_PWw4fPv-Et~76>#Gi~Azc}B%4mno2YGKid?aYq%U*2Op
zQo5mr|A%ACQHfVq)&@NfpCu=CaqGDs>`u4mva!BZS`g*Vzdf9-X6l^Cx{{P1*F`p*
zjaz+pa{3mzOA7p%au*k@e^?g4u<GCv`5wm0ISfB}w&mB?bZ$9+OJ_-1;fJ4p6S&=?
zs}G6FE}wXM$)AFfS-YOxy{NY3-XvL8*2xa5*B;N=>OV1{vrR-Xut6+xzt5e(tqPgK
za;s0Dn6qQrhZ~W4!kbcdYyN*)6MOYk7VC;ro@)y{<Mg*4(z><wqR`S#{`GS58M5^s
zr`UzPv#DMF`{&t1XM{HG`Yyt{SS=vp<vx~}ckyw{qZL_=cb~o=r1<!BX^XkjF?j~f
zwaVU-u2V`D-Hcnr!DV0*aEx(cT;9)xH^nn5?8=^8nCEoZdh_AEi}L>Si%&1SyWzR$
zU+xD^oE;I8`hC3@Sd8b#xd(^@NEDp)ce~Kody6R~$-y--(&S}zV&ak8z6pISp{Z*X
zCqE51+mU4Pw{-X2i+|f6O8m=o70i6f5SAl2u_%h?Q`$FgWozHUYF-OI=6p*@_U$<*
z9~&Nz6l>}X@A5Z)(BwPWC8yeiJB9t&5s%{!;`^DVlrVaG@Emwqp}+getVhkgf_=YB
zv-vrMW=3Vqf0m}Q_375Ld%DlxVHaJ_ByY83)*0uc=0O^H)yb1TsqLBjH`MRhdzL*p
z3p0fCc=}Hp+m~CI3+p`#X<X%cdD^Y1J!v8<Pp#!s_{!9FdB2G5#IlIOJxt%5+5F;{
zs?2$&wX%2S%0(}}&SL7n{nA66ZKY$Yr?A%3<yBix)_(2(d0|KT3Pz1tBHetE;v1d6
z85P-T?7RN9Yf`$dx0=tgnuIe8PmBLJb<kWkNhtGcl&n%3SA1oB&{hRQll11gqge`9
zTaGI|KC1C;Lj}v@Yd<Zf^H)TwY*s%ftUt$SGrRuWw&$&D9=iv<D|(nGyq0705=$5P
zo~ttxT6SisGq2}0{$cj<C9iOW_~Fg{PXmq#ZqCj>tlh#QvE|gM^^vo#zq*fFu*deB
z=JPW#F#Ko1QLvY1<{2C56;#d*x(K>)spfpR&fa#F3of~pj#Im?+zVZ?>(aahFD3|d
z^=!`6m9gG*clT-akJ2@gWtYAcNHZSdpSWq>+_{nGMQir#{y9fS(siL><P!}ZZHZNe
zKH5&@GkPvL7O-C5v`X~$JDwi4!+}OpJ#8CqD(-RDWqtCaAtr2TE?e`GFH&{?7}(2g
z*C#6S6jiU(TG^2p#NxOxg)=hj&DprbX^h%$=Q1j_nDDx=JFdUJJ6&mdzf?)<6|E(F
z$1nEgI4W>!%#}K~&vB#pl~B&~Wq!Hk0x}uie;uY;{+qcgDT&+V@G}LKr9lq^oge4@
zbJ>`+WLra*aIi<HoTIsqqG`}oZ_oYbJC5y(pLOY4`ZU3FYxi^3aN0WDXy33{`HvLK
z6ydeCyIv&4+3+!KP(Oa?-9<f?&}ptxm4eQn#KM9e>|osS_>|`MxvY;fww~Z}Ezt@)
z@@CDf<Kbb#Tw2Au=X&licm1T+<1gcO^?b{_DMsZnZ}Toc&D|Cgf4_<&Y|CWNWZpQR
zU1d}5`HM@>-#NL~G<x1e`FC?zS6h7YS@upjMdZ8mGCQ96a}z#qGq5(%yH>n($tTqx
zDO0?A1OKQOPtGguE?@n%{pV8KR<j?6w6zbJ%v-wNwACwi#eU~dqqVxv_Fws*dgJ}Y
zs-$NV*4XV)$y$AUgXi)^?@rt-RA0Wr@UDWxDm~ww>wo2_|NpgTc}q>y&6W!NyL;Q?
zQBx5!>-?!xm>C$vI2ahDQE%5NFG?)XkB`sH%PfhH*DI)O4fV}`Y$mYxcR0@m_L~j5
z3ODa|GwOfaVEbm_-Yu^Du8J2fok(+@sO1?c*!A!GzJ>edoLzQSRq$upv$M0!ecr}8
z=j?7Pxojo>lKs!#n|l_=Glz#*`+q!DV(}$zYx}WKpQYJSsjHhWPV@ZfeSJgk>~fBu
zJD&z=J2$BwY*Y5@T(f$rVS1>Y?91-WkxNc}y=D=rn&FYEm3K2N=XB!k#gg*Nen|e8
z|JbqM!rbWh|DG5rxpz*UP_gznW6R84OSj$&y#4c9>%>>ie*1TrTJBm>yxe!|q{}id
zY!sTeiJw|pmE^J2Y{$i|D@>OtU2}E1I(uCJkD^ktgwqo?*L6}4Hd;P;b)ZC{F3*;I
zVcF$ZaeX%Dzi-j%I3L@0;rR9wX-l)&7oS&L{BPCi>_wM1Y?`=evGMs-_c*3$X<Lpy
zePHE3IgH!a<MwLB1yklGRm)Di%9Xm<TQ;71zWT%WImJ=F4FzXTed;wVb-&$ySNnxk
zd?Qneq-rC(#HmN$AM1twh~j>JB{3_`YUR;OT{hBTjhb5ZZcl5O+E%|-2o!Rh%iFEw
zcr_<wna|BAE9EmgS|V==*se~SBW~q3Il%AHx?R58KK}_{Zp+8~MEha$l760=RdfH#
zU*|UY!Xy9c#UFzp-?iVp%Dh+ken}H_JioA|YsTRXJvOt&l#VV_3$JhaZChb0|Hk>G
zzWWmW39~L1r{r(E{ylnwxM5z7_<3`!X~~yoWM4RUZqtd+0^d%~U)9ZLq01*Z!J%qW
z$5Ne12UA{H>FnNoOW?&W<IKXJk)~@O2F`S|P26f_5W2bCy>a1TQJ&+ed)FIp{Xe<e
zCac3cpfH!^{e(YlZ$nFUSH6qqXY4Kxcx`k`?pEohUyCCjiTZo)Dl?1Js`QC=RL+y!
z$T362v(2EFyYSwox?7i13m#m1@<~ZuRx37;v5fWWIs0DTEa?RyuRfTc`F#9~m$c{-
z-(OnQ-RhrD?vneUIKMU`sWJO+j{&dI+8+Nkr`h;zo=fkL+a!8X)I8N{negAap#~o5
zNo7mg|F*^bzw`UEM}L0eG*RnIzuzav%@EwcpTG1_ij<Gwg#P=je>UG#Q58$v_UV6a
zxzCN2vRl4Q*!O<k3SnD6_tP?dU+iS}#!L~eozWmHI;ZB&nU^ay79<DeFwd@XZ})FG
z|JdnD@tZxWJI}1ms_6MGv*?Y-;ez0;DU+rzl4##FwN+Q;fyU3EdpUUq(U;>7Je_U$
zZ(qy5kGkEi3s2{L)<@0EnI~VX^XM`#B&=az5XX|4K{;Blpz>^OcJb|FlU|hn<#Ji4
z8^FmK+4s15-MOb~U2j!ZJ-&YHQ`&YBQ652OAwf<9293yzulDELKkH@m{F$;{Z?#bH
zg9Xdemo2|<`&r}Hhj&Nod*Vce1I?03W_54UUDmpyfAQo{vzgr&CqMakZ}E%Dt-IEC
z-`vwX&&KYTp4IH`7h5w{8J#-1H6moS>K^f}O40A$`o7MRT>7%)?z-%W%K|sXgqBLD
zrbcd!j1EavzOB;vD|hFLwCYd4muN+Q+!-q}{f^f8TREFf%yKhXwX<%?y~yj_8S}3^
z>ff3X^?v1w*Q>tGTf1qO;H$``56^5)>ytfgKl|q{U9nf|!*s$gCoPQ6PB8iP`&UtD
zxNu@XR-SaW%jG1u*esh{Nh=w*ZeP7<j%%dw+?o6Awwsr33#$Lm7rb`g`F}cLMQr+;
z-E68?EqnUuW^kb2s+bS`OEX?~{_6er;Q8t`M;%wi-#a+}@C(^BqIHkeE|*$nuFhJR
zUK6<fGUue`D66lB*Ec-LzPmK?qGu>~jM~?l&Lc@*t!{Kb_`GNZYe~rceXG>Moxh)-
z%z5dQ!LQ`l4zszUZw-F^{K8|fc6B7L@ZaPx{+Vp?b@MtzP1P2dyUq+Z_vPXa^1WPj
z^P1Cv?5kc=GAH{Uz1Qfpiot7j_|}I1kA1Z6)CoyWdM91DdFjLUuc`^3tsmS`%&@$(
zcW;u^T-EgdKi{SP`ZIm{`TvE#o;^=K6ciY9d)=gyiyGcK_jB?IyKtE>%oZ~5$@;sB
zfoIcEIn!F*Ta{DYlfQnkSr+#=QN(}R&8Z9YBW+hd>fXC|+rFoD@~+ESxHZ>hEV_T4
z_s#NEB7xDa8}?0J&0+BG!^2P&J8|FJJd2lgZ91y7>*On;dzmT|qRwoxa#t{XtoG?e
z5%2HSG3HABi#@~KrYjx#8F$C+=o*)*4ea+!xLbn5>QlZ*Y>VqUf9zu9Ua{(?Yax$*
z36+1?c>T@t9LDI1_kT~<d!P4<-(U0lBad9&Z;2gO*YBS*Z*NWMuZKE+KYTnco*zGd
z&c4R^Nq78zss=xLx+~(z$t6+8s;kx4$1UCAAiv;ZWskK?Iv)q$|C#4M{6A~ztIgA>
zA)+pl=BZm0WU^9a*TI7uBaf*>Dy~iQ-dm@i==$0yde7tMWx@5$G2K$r?O0_Ri#f8m
zL<}R>6i<94me<#~A?~2mT=U%8#vSnnKhGz!m~{4V?d8z-d3NELbArHSeuHgnaay+x
z_nGy~$vc*}o?S}g3`0Q)r}fOR*GA!o!{?ulN(ukQeQyQZr>Bx{3VvRGz@YXk{<#07
z^pk;m1m|>zPg<MM{JeRU=ZE(!VXMwe^W*<fQ&4a~xuU%2+aK{66VJWxSZ2M<gJG#_
ze!}E854R^jubn2ydFEHjx@Dge^7Hk@gJZhFbP_s)mhENqkdIiCEFk;U(d1XSyOiqt
z5C7l0ZjRe>=jgwGbs_1jTy`m&XPsR+^ZJ9t_l*pvR;Pwd`60HKcLSsCa`qq1`#fwa
zlvE5Vrkq*5?5L;lX1}|;_wq0MD7(MDpNHlC*+s8&0-szw{(b$UxCNYR{ECAQh_HWq
ze(><_E$;nm<Nv()w%)=u?3vVbHj6t!F3AtrPE^dUh~6$#5NFU+S*Dv%zNUfQVf_hJ
zPM$+@Zmyg=QYuZF+qhyo`8@hcW0Q>4cqX~}2!HU=V>bw1)T8+6_A52kiX^6@7Z$r%
z0@qmFn=rv+b?9sR=i3X?7gn(Rxy$BKFl~otouzd(`;%=<Kb6Agr1>(L?+#luQE#^7
zri=Ga-S?`g3oGnjac_!&;*vvCwwvF4D-hDNtkbU7?MlKDg&MD<rYy5Sj=D3Kc$aIg
z51Ju0M`zBW$M@cDI()&S?7%CA$&G&R-sLX4GS{O0^@;1}9#7^JI`%^KRfNGUiJ5sl
zw<2;@c>GB;n;YUj`TL*u2kv*j4tnpFP_=3H#y{T=G<hB=p5|l3AoRUgc*c(F>t|X2
zsP^DW-<o%P+8!3ajKVItG*;%X+o#NwTN_%jV;6UNo6^!>xA|2r20m_8*A{1)+<335
zYgfZtUt@tFOD(N(sqMcxBE4L!>Pp%#yqkQZk-b8k_ubhwb2=EeNmxyDWQu9NV5t!H
zaBJ(yGg2YWiFY`2emq~4_doVZf|BovX%Efs3R<KrEiYWo$t%V)-(^+UiKhu4zGpS>
zb#8W=(AS#Wa<qF>skJ+E?{B|H&3pmn`Ig?o&sN`fJa;eqd)pO>9f}zrJ~iHXFzNqy
zUq=b?C(BQ3#W(+Q(vLq}l|KE0xW`uO4a<c-N<P@~<HbLVDnB;WncX*8be8R$kfgxL
zcU<<^;*2Q8Jd2$fh6^JYzrGfeyUwtR>CKfn`**k2d#8N+m79N6u5J60*W1o5b8z|7
z78y2CeZxd;1^Y`!pYX9RmEFSWxM=BI=5?3XD62U*=PybPTleszZeha80_)i(I~*r(
z5nJubrgEOC$j3)*+N?|4e0K*H+131B^sVKLyjk45Lw!EQ3nPpRHl>x`IsMX;C+6O^
zMTt)?{9_4g(tl{i=G%8%`RDduo}a%ze^IHC%eG!(ex+;SpL0ErE+26cwccLV+_WM0
zmff_dy&o<r-rA!)CGlUwq<11040=~Db<>`cCQ^DQN~d9Ar`plu%@Y<qJg?-<?w_3a
z_2rKb1{oo;arTxWva0(x`@SkO?YVI&L2CO3-nCYp6ZXn);ZNFd#?Jic{G=YOpN{Dn
ze-~SM$B77Un!e!qlO=oh7I38A{$tUhRd}bBv-zl@dbif;nS333MULCp7w(QbnC$p@
z=Awg^2l9WoYBelrIlcao+f27>lcQq9uPweO_?Ra*;@Hb?rF)!X-d(ol?*DypZtvl}
zIg=H7DkMbgzT9+UI>ObVzVanQ@P}tcb`JB5O<QbR=Q)H+e!18+CnadzjY-aF<`?ew
z{4Jd}XKgt5!PV_)Tjs2eJM4M*g4IPUP1oHk)Gmha)oWW@{qOJU7k<wB*q`a#IFZ>B
zVRphmpH<3+#U@Bi?QBM@@~WJVO75||j}HG($PDXVv~)d}Z${<6A5A~5e+|sxcA9u*
zQU<rAjO@A_=da5A<J??SF~!ESua9rP^%33XcOL!E6Y>}5>$m-Rdb0IlvzeT~T+eag
zS9VX|x!<up+kVl*_{r<C?LR!*Pkm;vcbdFpn(>rFX|_hc`f^NqL~@;rfBNh<DvF<|
z{BDnA(uspt?R9TfOgsHrklD+*sI>b1&OZN@4T~;ppS^$Ot@#&P6XS{-SngF#_g%MX
zW`*K1*T^lmL=L^3vh0V3FMDr<kF40ybNNdBCi+=Fx9pAW6sZl#U%5GF;h&HbliOYx
zGAJMYc{gq8jWE+~SF+z&A6)lP{m=2g2c22=8ov|XZkg2arJ-ZjeuJVNKmM??zTbPB
z<v^VHPKRfk7bV_EIw1L}HM?L}zBYeizp?-R3F4PEJGm|k-Tk_7Sy$yUiL)=F8NN?l
zrI*IKWr18pYI&vaPiNP6yQJ=fwV3L+7oGbXC;C)jOUi){;XX}YrloeBh@8O46ce>M
z;Kg3)Bfs2B(zUD#?@Zm7f1&kdWZ}ZQQm;8&OH}g~t6H7!G#B>N@(*@XoOa`-l^M6h
z;@E`5_hsE)agVoJY`?!R;7;v}-R_mf+h06)y(M81q#{#t_DGVK?#1G{v1V73cpsTC
ztSy)0v13{8SZ~iKtL}V=TVlBdzo*mV<@X$yZ95x(LHlOIi(fvI{yJ>G#}+g%iKQ@s
zQ(^0@1xq@rniAz=xEt;+n7nb$olQ+lziVseUS*A}IAGizxijRV^xfHqWzU(Ks<BiT
zEZ8o*_baoTQ1{76k1S{1Pl{1^`c?kTshpR)AFk1}R_$Hhe(>^?%_^_AEVySad)h9v
zoISdI(f6AN3?!Gf=N|Afs@_^^_{Xg}oN=RtOZ)HNzxVz=clg+z+6iup%h@uWt+pL%
zYgqg<S)lpo-c&P-DR0i&zAb-0RVDSSxFA=L^?`{_XHK{{v8P;c-}AFVe#Z62Y<s_X
zwX<#5t`_q~ZIWDbTY0r<n}5CMb~~O|zjwbk`_}vWN7}rtH}3D`t32wvb)CA>z5;7@
zm*pR2&Guh^bm7pH9eeT^w4!`$_NS}d%UJetb=D+ZkL!;oMmRgCPi8H<d|+S4v$snX
zektn495;zQBJcXV<B7-Lnu8nrb$%^jsC&fdu07%DlRxa%taA$zrha6wt@t7LYlD=;
z3#IheK1Y2fz1VW~kGN04jkxPhj4a6;w@K<W?+z?s{4?wB!YxKz9BbJ3acl2y`5)ST
z%|$jY%~aE~Q@cWSx#Go@Pu8h5aEGr^a1}kA(fYTeXs?LrjnB+X2ZMCq2<a`V@0|Bw
zi#?yWt;p#uS_-O%bw3DC={=X_%Jp7WHD&+x83s<5ugyBJpJQvg&eV3}cY(8Br`gUG
zo6qT(w|(~VDrv9CDH*>$?J7I5L|J&b-t4J69&s7$TaZ7ogkysH4XYBty~-Nj*%IGs
zEy&^J50!HAFsoR^#Ue8KU8C;uT^n|#F|lPmxt^DuEW2U}U-}N6%Fe(ydT-A6yWf{A
zPXElHdpC3Uw@)7mgS=lRC*|tr-neX=pqX13lY2gU@+4oezjsW<e2P;tf9VH2pSU%E
zr*`(^b(5_dQ)ZmJQT~}-LO^LlxW)!XEp46XW74g&KlwD<a?W;MFj>rTqW1jy|79An
zvo7v(4E)e};o)|TIol#uOq*}@P*r-fYvIq|UT4aje7C(l?rSE&xG*-%I^o5Z_m3o#
zCd#fUdGPobN3z!|^@*$heP&=1GA>)3biD1v7VnUY^2-z(^A^PXe_V0b&%J)KUC<YW
za`Q!x1sJ%dMD}?apPyIry+`5n5067Xo0(a^D9r3WUuk&w#n#r)^!IJ1k0x;4`nvbl
z&50+Ae>FS(&e_Uioz}B-UFo6oJlt(JxJwSKthw4W&D%|2mqLZznK|XlqW3E=PWEe8
z3)psdsX=f3r9#7No$o@ni#+<dYG?UO=09qZK1x4*nZ@e9{9m*<)~Y(z#HH?4XjkAX
zzU1kGT5ZeJue|#B=VNQH=u_p$^%i@&T4tP|Q1$4d*@X4GG~F&Q%8P2P)&CT<x75Ju
z|GOIpXWaI<8~dE$UDM;^pH{8OdvZ@z{gEu=?^W9hFKmnCd!ilw=8oHoMagY!Ypo~q
z35%J%>3bU9|C{qZH~UG?38%d}WrgB&tTW0Y4XopK)~~y_=SH};$&xE8Z)eHsx`xeC
z6aRgGcgS8wL3#cwd)FtF72JKY<<&BA&J#0Ig)gmNFj;$&;epAnGZ#CnyY6}!oG$OG
z&QQ1WOoEQV{3E*zZPivSo5<+6Xf-3NS@u?=Ys~9J7#Lqh{ObE~cK`bqrLP!wo)u56
z=eQ`+Dfsu|(oeiv)2|o`vX}b(es!zJ_#QiBnQSa4_ol{|tFp5mu&<rC=!=L`dhe3x
zKi%RU`_4DtGmyPfCo}i;OAh}7NBM*o6xZ&Tj6NW5Q<vg#-S(tYgXV_$(@%$1XHQ<>
z95_d{z;%uAW&bI!Cm!DHDZ=h}S>0~#B-ON%)C-{vOFV-;S7irYKT+Xx-XM1N0nxQy
z%;$?{D5k!6`&(LI2kV9jO3@2~ZKqsmnV)bduz&saulwQ_ZvT2~L*SJ?Gc%pa-Q*7*
zxl?!6sVL*NCV#&4t_fKO?2oLSx@I3|xpJ4`qyqN;uOl~AEWR$NykN!ojf%^~&sm(P
zV$(SOm@S2Aee<r9+m4?2W2IEtw^!}$^RS2MPfZ{A8-+HjR~aYCt`y-&-Wj#_TGz^_
z*DMcA`850P)U-bng3e^J#pW!^H{cCZ)k^$+Y-exh4cEEXLa%yVU(b`V^Va&fo|WmJ
zS4|CYnDc#O@@@H~qg%S#?w(6goBi?4E9MU};?vslnNq5+>5B!~a37G>(+==YJ7A=K
z`c7v$-{RS;_BC~yGjeO0a;j)NW<F-uH*@=gZIPX`UInib+LgI@e)lz%!-tE_t?MSO
z-RQU0L2upZG9mUf4OPGJ;tJ)B6Q@`7zx?l4HmC0P!Lz1}PB{#<`b@@Qbr)Q7nLi$%
zq3*)=^gi<&)`X)IZe*`bw*S-f;^@!n=^2OTEt*im8Fqi8-m|8*SK1QWFX!yd@C{aw
zIpfXUT4Vlnt#MpP>Z892Z;qCPny#IjCXm3dm9^%ZyTz(C&oeUiKX9Gg>72QKr^b42
z2`THexcz@VeDnSF?#WMkzq-1acJ`J3PM`jA^kww}35D3^z?{wTp)9ix{1(ia<D_qP
z{pRe2EsU$~7cctsMMY-%{Ry)-1g9T-)53lzVgHo*5{*9#_x4`qtvD^ylB?e)_^wh?
z_{#=k1I>+p*%xlsm%7Nux2v}^-t1s}hH2IPlltt_rfi9Oq4=rqS7HW(aQvQqD%`&~
z&8DCG!KtBm<k_F;zbZuQ_L!tk-mmQ)o7$@RT=!n%E+(Ziu9%#KH>O)B&D%3i(7r3q
zarO(#YubnQ_^w;jQ@ks)zuE14wAG;`KjV{Cv)P&A{~hB=Ybu!d_`uzZVxK#Bojx|^
zw^xa-zp*KKg%`W>|19A^{_doZ-M=~#<(@bz{QclmW%0*z3$sSNx*xZDV#B*#o1X~s
z7Mk2qbe3G{^6B@TM?H5_x>vvZ-Dn}%H$Qm#FP?daMA|j~s^u_!jq*!0U3GYN_qwAW
z6nIar2{rKA^x5lU*4!tRQ`S#E9lg}=VcNvIm#=7ET|FUC?gE>Z!ITS^RAnuU69dd=
zoMhd8<kp0bJC#oQZ`$>KX_T>8<`))O?XdX&taEpIJvO+s`NG?FkLDlw9Y!z0xqtmv
zS4mXeRI<3%I+$VoKB1V5bH!PWnv!~rmzgFrJd2E78!mXYUn2fk^R!N>2ElXtD*nVf
z1bGH_yk+aVwB+WFwgX|Zb++%$1vTuRe45Yj>4KS$jhRkwZ`S|Wc;!IM+6Bh97u=6u
zUUanSTK)50)vMF@vaQ_~q1$rPsW*!6rM+QYSF-0-ncAbNyDs1Tba<V73VXZj{LP0H
zr_9@VdDb~TVe!1(m7lIy|3AaxCGlT-bNa*8X&YA8HOOsSea!XG)aF02yzy+YE4MsV
zQ1n02w&D(3=Dc{OO}nB}4F0N5wJM66G(+oD=F<&q4(2bU-e286)%g253$s4gw37_c
z%kKPI_a(8UuCPEpV!54b?ew^q^bM~L6*gu@>W0sV^;;=lc;#5|^_Gp?lM-JYJ9lQ{
z=>Wzza~c}-S@yQZp6-!hf2pE<dCxA*%(J{ZSbba;^E)w!2z;p2`JeZQ+xnT9R%ij^
zmr$LWLe&ZL8h?K|H-#xO)nQrV8rE0S!uox8@(Zq+?0flU#^oK%m%9QU@jcxlb+558
zNbyy2_Ra}eo^1So+(RX&2s2E&dB{P0;){o~Z<>F8z#1q&tx>p0Jm-Rv8Rs{@Df4P{
zyaUg-q;~Tz<~pM@qu^;uSJKn`uHPy<dG_tp_hMB!kz$q9cKgw`UE72{)CQ)-C7<;;
z$<wt{jMsh5hvnISIleFM-uTO=>)eK-GQXSmeM^kR6F%SC$T!!iNmlgguE;xXS<_Di
zMTyI)7iq}KtUb79iRH$HN>v%hcXh^Wc9<e?xRSe3^uWc;lY*{2?0hdvt!_CVoWr2G
zUBqY4nXHRjbtI&w8*$sVow#)J<BEBkb{(wonR%Ua!^P8HpQRbfx{luQUAo+V<$T_@
z2P-T@kLS;Pzl5Jh*-Bj1BxJ&zEQNP>N~+s4H<mZM8pd9A*<N~e)xC0$#7UkE)0*=p
z`{_USJSbMB9ryble~QhP?>#j}_daacU*=uVGH2V2Un^?2rm_Z13q3u%sk(qIy?W0a
z#vRd;$Cg((9GLHwkUOVc&hOj(Q_(u}f2uCvnY-r@<I;nPVR~JS*JP!Sna4N$7P8dP
zT{6vEkmtgRFDmQ#Rz=@U{k`GGng)s9?M;_WvqZOKyb#gt`Fiq*fKNcM;r}B|g=X>Q
zTk`)$bkF+CZQ<GQP5$}mOWhNHFOyZ1x?R7LW551XrjOMrC$7!zTjqRip7Cposn;WQ
zQ!lMs@FBT<dPMxx4KgypmecA)w{90+-8{wG;HjBcdds^li!WRk=Uf=~_F@Rv@5`A_
zq8wtkxZjm+fAhiN?AFp(Q@js)$$ncgV@tC7n{AT0soDy*A9t_&yZNMsN=x&~bFo^S
zYs;4}@Acjry?#%{>|K6y*X7FIUEw}y|CfR`#dA^yPJD-~A4=Hu`cGd|w(9iL_qR`^
zU49p=<^SL5=dytJY<D;&rn%p~e^=>I<{vkaCC@E>P1Zc8WB6Ne^^DT@-__>NJEysD
z^3_QJ1v)Dpmc6oLZp_?Wxc+(nz1L5g*d5AxZ1j^7zKd*HVXpXahD99jD%W}4A!5Z^
z93L{4zE!!|D6}xjVRxxrTFPCa`16vwlj}pQS08X&b@hOHj;_d(IkU43zc5U?s(SUY
z+*?1@AMHi|%on`7WTZ6p-HSJ&7p!+DI_IxQnrY`GlXh{tM`A;x>F2~OZ<Bu=Zfp^k
zzC76!^(5iA9+T+a{)Ek+YKmPBM%k6$y|L-SG!F4d)&qhJ8~DSHKH<ulv~F^Y`okF~
zZ_Y>;F1xS&I%aOgY=-0PxdJnMWd4iQFx$r!M&(<tZg}h`TWI~GY3U~B7|&}7i<~}I
zUYIP=IbWjN@@!a*$X>V3dA`p!WQKj(6EaO{2b1J_k+nQ8tB$0awK$wDGMJziyGTEd
zZExhY89TN&FSSwq7E$MU;`n3P+e-WsTFuVK9~Qr&A$98Or`Z=jZaS{zb1Uq0>(wXs
z<o*|zZqu0?fAmV{rY(+&O)u*!B(4Q1?PI%n_^aTOulGfK(~m?1FX?~qacM!$=aStI
z+V1zpTGl-<sOFs4#rbn}Qr$Hl>&p&qy(d&ncy=Uq^hQqjI;p3mVphTXhmotkTmQR$
zs`a{v$(5UjUvR8kcKqVp_U>@&g#KG{iUk(#8!HvM8m70Z{t|1*Uy#0NZGLL1hI-ax
z!&KMPYaX9_ckx*8`t^U9PPHtFboO7dI&qzapnmw3oi~%ED$UOuO1v*WvT|#}^FMzN
z-91t9W#>hAu1#07w(YpsoRYih{o?r-_aA%`6R~Lh3kCTL3M=k0#y)nu?75Pi>*2h$
z&s08(?YN%CIydax^Q$|%CSR#F{HS}?mu;QX#@$j+UiyaZa@<iXzw+pb&58XBe}4;`
z=jCg%OxxMVaEGYf%PH9_D<5)AN?KJLZ{e*_^Qvc+#G0kLnt!|uKex<npS<Qv!Y2Ek
z9?g%I(LokGw%xXzDUT1A2Fsfj-;ilPV#A+p*en=nrE~b`<gXtqRkOKgRc_2$^nJ(O
zr4k36)*h*T{pM}=_Tv}VJMFx_qo}G-+E?s^V!_+&#!cSOL;`wdX03UdQ!YN^xt__=
z+Zr3ztyWTBv19*qEuoI~o=u+@eO$Z8ecAKq`v)tV7dxJ)WL@msv`lDeDw_{q?TopR
z^FvnO7I~_WQ+=oQolQYpe3mrtUEcMR{{J#9=zlb`q4q}YN-H+!|Gf*76<E3yd!IaF
z?sAwDAY0_`uPIr3!nJDc-h#J}zBNoS<z`&+q2<d4zw{4>WNyW6G3%+Qx4V6xt=f)z
z!7cXnJN33RwU{|}@LLC(2FN~p^mtn5!{x#?*D4sxBkz0?OrQPyVpcBSvkz{Mm;WjK
z%@aG<;Dvg)EoWcHgXT@<9oy$!j_+NtX@*VLl}$mfT9v2m<gx3NeOaT#@3Aykvuz*C
z6~%dJwg-8Ry_7odHMK}TTu_)>hMPMjyMo`T`O%_Tn-Z2fHFWKN{BZ5osT__IelUq}
zN9Zm)u=-Tz(RDnjE#B(8KJN?s_j%{a|Iu=53eL3@ce-m-HXZYpoGN{;>xusZrwLE4
zPrkf)t$vj2R*~LKF?QQ_U3jgRvTVV!OS4?g7a9CImiJOhdQa9z&u;TGTY9#>xuq6Y
z>gH3RBe5mtgG0=28TA8qsxRlqPdK(9xpiASzrVZdaZkCGO{L$o71mz#e7vptfnZp=
z1n*`=>jk^I7Npxquh}KW9-qsRF4`-5F6c!?<;jf1xoZyII?|-^P2aH2?AoW$%JZBW
z!87cqACI=Y_-VoB={CI)=ND$@*>w3y2W{k<YW>01>Z+H@FKNNUCJcGg8;-8sq+uMc
zyxUdz5R>|3$B#^+l|9^VEMnP%#n#+1UDSI`yX>e@Q|I~KdOKV0DA#w1wI0kt)y65V
zYkvHGq54I9t+!V^!)}*zTceT|8C%WYvt<G2y5K7d7z)=cX>9!dGi>`U4%>?PS4uVo
zB)IM0{_~lElg#mFZVL}ut~vF!gQ@i6(F>=X0`ER%l=sUCO5(Xtc8Evg(d3q|C*u~a
zt#~=DBp`J5)@-XZZAX*CO%EGq)CS0U2;Sb5u*B=E;y-4w)yY5BMlWCXUwVGE)m5gA
z$!TuhyDWMBie#^wf6nST^Qz>jZ;O*WW`4H*w<9=q*KK?0XJ36L$R`CpP;_HIcrswS
zoF}ufc-NEvB2PMZoRoSp`P${PH_G~KHSPpi<}Z!pK9Ijy@S9-V=eUhmZBx^K-<h$A
z@0Ed#?u_Q1rIRX(wEfN+?cSRb&UgO!s;IT%Qzjp(RN>z6F>XP8@W!^3&nB+_Ox~Kf
zOP4u|w;f7p7ne8Ouf42o^G6-tPUgu;-bG8Nn$Mf?Jzeoe?CxXP_hJeX4nB)m7=LdP
zPsD?b=U%P&m-0N<AuRm)oNd9Ug%>@~JRx44T5;C#oY|JJ)v1zZM_F`c*H~Y^k@J2>
z2<wY=*WMPEu*ctcaM9_i#2V>K`Y~T!*bc>1n=k$3cOi!Tm5M$4w6(J*7Q4%GzR6r-
zwl{pi^Y!5k%?EgDzU<WK_|?H)%pbs}eePH5w8CvtU*;6gzOs<Z;HkH}!SNs43b~hf
z>#_IG^;z;jaHE3W^l(|vmouy8DxNO;du#WelU(^r8P^)FR{z{o5^rLpQz4ySeDml9
zW1jZiT`A$$LIoVmV<fm+4$n+Iv{?SmW$VfQ>!n1F@P7@jtz(&Yr>*K&z{-RuXTFy0
z>$xx4zu95-LVW3D-!p|AQ+2YohOAMWt8?*Ztz5s_iB+5a?3$4vnde=%B)%czSn!=`
zC41*T%)BCaviFA7vt^#ME$?4?B7b(y;fm)Kmxb>tU8w%C<*{#}U-Yr>g6t6s*YB!1
z`EsZ7v^VD}*C?~*2j^e2l$mp{<J_T+{1=M<oWpknte-M{hfAtWxcUq4nh%r2FFuNK
zoBm0Aeq75H_qw3!57#U-mh)|FPR|fn@LAz$+$E;Nn>H}8+m*Ym`4A%^GRY`U`DW{v
zQ<IioPH;=#uW;fR|8jHDS37EQd+pTaQ#1q^ICg2;EOmMN=EKYF?)UAitG-n<>!e(A
zs$BnScm0~pMMm<U1NlW9<zg=>Up4q9yHxz{jTKt`<;8n;-@VQ>S!CueLkaQXJ69uX
zqspu#&kJAuJNM1L>$@}rWf_>_Z!gJAb~{k+cGS}Oz^xm*_uMbFSY^fR+a1e#;d1GO
zp6X?v=SR7B^7^)&(q8hmfBK6r70p){npyjL`rl3e-_+XvW5d;7tHbp6RQ)*lDsr=N
z@bvEI6Ozo2K3sU(L8IpInXvradCLuU-6&IMy5-TskrmGMTGY%$b+OdsHt7o@5pP~J
zE{?jxwBQG~4@YuZuiLg(gQBY9>5K0F-Z9rD?6sRLi<F#}nMA2S%hdI`QVSoh>dkQf
z#PRYXM|^3;nx?IV)fu_o?F*}I+hru5&e&YqJ?rf<m7AwL`}PH;r7`}$Ui_e6r+Bkf
zt^TcD0@uU#N$oRLnYdO*_VRQq*%RV?*ETxV+KIlek^S0qe7TR&l&lXMimg5_=DQSp
zyyVvNqEnYonw{YAdXOEpCvB#)u-EGcAxe7^{M=eEx(jdmHb;bM-~8zcCymd4G|jz#
z>P=HLXOZXir?)OY<9oLHW8UjG@oUoW><r`S6?u36(XlIWx(Auc=X%$(Yh~!fn_4xf
zCA6NuP#8Hy`04HmjB<15PP*Ne6>&a!b+g3sjpi}_1-{!Sm4)P0R;X)tm0Y=g`S{@%
zH!uHAp7C*cf93Tvo0V(a>eqyC+R^5p_4S(1H%2Z-4lNdOd%LPnZ!f=}_jmsOzxOA<
zIez;2WbvQgA1|Avt(`Qh;QrkNp+lc^*8E(PfBOBp^s^sz!oIgX`Kj~nhtBiOvNl!g
zU3qyV{X1Vvr28ouUgTl>UXmlN_M*mavr2Zrs$6c((k;tQ`r5rqVZY`4y6gG25B?hW
zJJzM&%@weDws_;EGiPGMc#8gCe$C}z#ob-Lq&!Sa?%jqh^8fyx71z~rC||BAclDUa
zzxgq#w#zM+mhkvlt<)?O<p>cC`*gJ6AlIaGM~lV#wl`Tlxm+4DQ#maAgKKe_qxjZ^
z+S_JNII?Ax^atiUTN@-#s|n9|Fl~M2zLl?H)>=Am&Qo6dD(%2tD{XDY9kxORPu%|`
zKi`sZbLXqebDehOPE0?$m#6x&Y3+}lM?UDqv2ohU+xG2i`)^yB^~3-Bmh9IP9z6AW
z#UfFzn)#c}%%@K6gTwqa`;I2OV^};XSx0wSa>22<cLL!#t3LOMJb4?w{&n=!r#-jC
zmrmaDchc<3m78XVZr>GM{wiM7k}vG(O78>5)ht%O`jI2b@_|pGWlQF@0`~gZwbE;*
zJej#iwLC;8d{JJ)=?lEd&+5v18_HK#8|PZfh{=`C6y5e(j4|P|tXERbwWGDG&FB8E
zH$3Y*ueRTQyJ$vpjef!F`9)s87OOe?Hd_5pbf{8p^Y46fsPkjJpk%UtQT`X{O|gsL
z2Y#96#QSOo(^P5a<mb1mrt*ijIVV_3@A)os)iA5`xab9^@GTo0I31=d9u^Omjm?bK
zy<2W5tF++O{o}EFJm<=;4*MalIm7<QD&?;o+@Bu3i&QP)DD?D;meJ{2$klq$Uhi`-
zPhg7ho^#KR?A%=)lQen#O{-)37Eb<cU48w&yz#AsnmO{a@ht({k0k9q7W|Nte_G_M
zFf&VApUU0yl~=~Uzw%UL36rVDq%5Heo2BgYXMT8UyJO9|qX$ZCue|@7G9yyca*CX5
z+l<eB+)2$-Ro+*<6LEc@{*NQuz-s0}rK86;s6AupIlP<mR%pfK^;SO=C+rrP?=wNS
zC$4ek#&c;Qb|1gCmHnFa(!qNB2A0t7W9vS?&XU=o<rVZhr#F5(pSuF5@c#w*>x}fv
z&8Mhu`>4gha(%nDZk&(ZE4g%$H$OvqUwyh6T=|ye4f88LkNB_U@~f>i`S`w=o^qT}
zl=-#MXojN6`d5$qZ{=@UWS{11xG;P3&d<Mp?Bmu}3ELIqTD#>97e@_GzURdJyol$O
za_w!u4$qD3_-(Oa|F7V{yHB`x$%N_tSTjjgBBJ$x)lyfB6lo^m%+;Q(^&dZq&L}*q
z*yb$rlP}Hv`wjQ6oX@shd&F-XZ`7$%dH(;cQ(ZBaH~uj{BJFYaqr%G7Zy&x_RLyTH
zHK_al>Hek7m#^#Jue0G^cJy1j;a8Sq$9Yy8wl{kQY=5|=EQ;;ot?&2#$A<NNkUY9U
z$1V5AJ^ROO{yT){N6RP{g~cSvm~&?RS+p~L{S!Vtr+pKuj2AdC2;1am6cos<p8Y(&
zv*_Bnzq`*rshN9sor}WJi;Zt&8d~IUM149QXPO<VZ1<5{yT1Qen^mKasRP5p;zy1<
zo7*&A9opT}!|Kq@<~`3e*RG|KYk~HCMzg2w7P2Q8-fEqhCgQB*@Gx)6heuu~=Cx`3
z`f<#5L*|_7%0JVB5?+Z{Em5wU6}?Br?0CtXmq~Ze*k+_mX|9?Wcgc|d{ge6jX<r%U
zEtzrFu5YRed+oBd6L>#xy??Z3fxq6YlQ-ht$4d0oOx<jC-019#bApcEGlgc@@>VnF
z+H~lZE$TF|%~{+!_r-xYVOIXTU3d1>|80u8S+?kwlh3U#^I0>!PG>x~E$7eKa;jH-
zuCf0ktD05Q=bc{pWny{YySTX2NsBhtm-alhF?Rpzy`<enPDCT2Y3Am0p1pi(GcNpH
zbl=6$u}@aLSM>44a+lo?obOe9UA`~=c=?%~wsIwXl_yhW4hGM;o83QAQCocPt4#65
ze?_Kj+BMBow0K`h%R4>We`{HIy`6SlH~6SoS|Z<Qx#gUg-=bYbj7xX?a#%BYb(Ym%
zrFwygO*eHTSGXU3anhj5s^_0sPv1Pr$DQY{E-g-9`I4{cl9|Jn%~}tRKfHRYYK>W4
zRsXeXFJ1kNrtI)<__AV}+3am4AJ`J-tIRdt{&!x$U(Z>s0;?VG-BjA^Y-E?byy(D9
zovT+?X>neenbOU=F6F_b_5+>&q+ef<`tnErm)QXYztH#^d3`af)9jbho@<LSv;W<h
zblfWCpr6W<KxXYjJ|@dWmD3pCUGP7b==nIiWZ9j?<!#R{UKW2>_b2E6oga+c^3KPv
z-&%Grbmw31iiYilbL^TT4Q8!#niP4y%U$qxkk(g+x1Z#FJNNvVYV+vOTDD1lzgR@@
zESxJb>(7sWQ`eLqU1MVR+u<(vPS5X#CE{{wamCH-JttY>W&eILe!DX1d}M9Wn-f>V
znR!#+%$jn$;l-Vj)4X+SHd|DAMBd-_My_^A-Mw7RldE6K&lO(voA*wSZuOV0JG@8k
zWyLQJHdq_6K4(GayPJA@bKIvbWbctHEno2NqAZ^pcY3(Rqhs?Kq~fAlGt74|`iR?h
zUP~;wq96OdHAW@4%(>fZ>FOC7GP1Lx%bn*Oh+8~YKg2D+VoQDd`+M*6_t{(S*>YvI
zCDXCXBF%OJwds>SFDqTQEA;8_2}{x{>o*j8*9JVE!t49=@weO~={5gX8Efoe;jwwq
z%qM^G<%j8_I?wiXU$pzW@BP<(`-27VF&~#)vgTeBBh!s={f7Akp5NMde*W`e`12;H
z>Td%_fWPW*wl7b*6aP1tCpCWi`@O$&&XRbC&|kd{|87^Z&y)Vh@b$#*S4XX{`x^Ew
ze7S5fKkF%8$v5YCS`wmDd-b?2kL_Z(xikLRd*97(Zs@yw+R+qx_WtB;j$5C3ZL`u&
zxW~IB@}uQ-^&6bmH~1{ybNTz(sk?sP<B&VBf%)@4*FV2nTd(W+M9aMrwVJqg?ad!|
zLw>QY*k^57{m)x`ulvQ5kJxg(zg%x-{Pyl``{n-+Bp0rpop`Z*!3AHVFPobme%GGA
zR6w*M=-zAo|34KOK2Fgycf22>Ep=n-rw=oHbh#X#ZcZu;PBT?I#_~X?E2zh1=IYib
z$!xnEr6Qx8l#dvwF7NPr`G2+YujL&lm&jd^I=ympzs=`&PO5GfG}laA{Fvc`y3|p1
zS+%c+pR93lUm|tb!TxO5g_}1_)aMIX)xEr&(Q?`FQ0|w`2b?@jX*C)Av5QW#UU$9u
zAXg-k;of<_xgQL#HJu3RQ2bjK%;2}_-mG8CHhy@Pzna0pYUSA}Maui%$jwq0XHe@Y
zD*mdmLqpK`@J8*KGklI18XZZT=DDtWzsSND0T$E!;%rY%s+5mi_S@j?@2p-a<E*pd
zvu<3@3Jck8)AM1`+wv&|mr{ZchO7OG%<u@_x#IOk(M|sfzAX~&J{a=6<?7N-o4db0
zwk7aPpBR+&W}Vw=ONm3$^Ur_pIeeiY$M0{;RA1H4(~j}mo|+wI&$Z#@-@mng|5`R|
z(SH2VW&ew}TUVU?eEUP-`4`uwyu4!Z*Hb{~X^)oUq*dO#xU4?*=)Ksq@#~CrE)uSW
z|L3hxSo(L8wbgSq&Yek(j{{R*Gfdz9R`BYn%q2%6cRjpi;Ntr$I40I%p$`MoPd;Di
z8h`$E&-bqLU7_&x%4(LY?%7;R4!b&YZky`$*g7ycHzV|0%Wa(<lYeeHWg2m(G;(&0
zhkyOw9}jEm&z{!f@O&y{et2@@tpABAX?<LmFFh;cJoI8!VA+LwX4D1L?h|%5Oygu=
zn68L@Hw0(_bxD4Hj$T3K-N@Yh+ipVt*2Qmh<x?nCzgX7rt(ig8LpEOe%PWbk{5zY^
zD`*sD8ZO-NMo-h-;LrW{Gix7ri&$pzmtW^<RMIO?pI13Qa(}}0@b&)<|3^>!<n{6A
z?4EGniQ+MOH&$DDUa$FQWHonB!t+J<PClx;yJ7nB^!W21zw+*mEdC}Oz9>oZ{->ZT
z(lTkh{$`Us^^Ue3Exc#8_DSKHE??c0!;@AC`CbxP6g0UrHrU!U*=gtTkdVs4c=e#d
zm)qCeUZ!z3c=PJ+SMyZ6?nbzMUm9U4_T}~(H-4j)cZ)Q#;*M^av^Fa8+>9rlV(Ot{
z={BOXql#E1-hcS_DEU-&lST6PJ)Nrhm5X-F^1bnI`F_Q7lhkG!_S&qQtQLDb!NfG;
z!yY|u{!d)}V$~u$kMh10nw^%j_*SUy(dv0-OP0^M>tg<Y&#sR1^*b#7e?0s2J9qEV
zmmyNQz6r~`FMeRHj`-ZA8o6w%%KPX|+%2n3{iaRvx)6PB&CfQ|rhn;6nkG%YvS3kA
z<dxne*Q5WwTt52s_UYI2&-;7q65jeO)$+aB>dBtRiWiAhyDi*!w~3W6^2@1xyD#N8
zY0j?aULk5;G-1Q9)+F!6c9Mce^K5gvmOVNBASTDmU?x{uf#p@5<|{fZmjxGke2Ty2
z^od6#KZX15h2K*Cdu@*#{=?V2DS&r{)1E5H6<aGBW_eA^nY_p+Of~(S)U;sPudaN}
zKV@zoJ-o+3VCjbnUIYJIn<D>-{(5FSZOIb-3wbO|ix`(ZSl}+nvc5yA_=<!=-p(Z#
zR_s`|Sc%`|Agivv=%jk(7pqD<nU3;({Sx_8)IVj{JCg<SThmjtx82&Pb@Ri2`<v|!
zY!dbh#guP+{>AW{Evd5gM*3R8(9ctfQl9O3)W1MNJHg-hugVh6S7&p3T@K8hXZ6<B
zxz537+tue03gU}9zFg$kDav_<rRco;X|A0=dJ<eYbFT(iUaKqcdUDu*MV5Nh&)=t0
z+-^PJ%5>07qdrbod*y5S-1l?(w{F$0ob6&7WB1tho9@-mUyB`d8=g;`B{3^qyZ`I^
zs@A|uYR;C@U*B{@`J6rZ`h7%2Y=~z1@{8u_7hirUPj;Jau}Socv+dyp4hyX>hy3zA
ztoq1xA^X$Ebq7sj0t)v3FEUZmt$edVDq?5DQqRu3@-L0=Lo8w|CT8#O7QQAnccpMV
zOZOw`2{K$&e{u`bdoCShD7pCIEQ4v)VXIT!THKxYr_^pu`Mmk)fxb9{?FSP7KNL%v
zUbt31Ns=*LBB3#S2K%L0pDmjA@7(hhueM|2xbcgpLve;p#oNx!?sMvxTEr^38A>ky
zi?C<CCbVR;&^+e+jXQmcBMq*ekd)TSKN#jT<(A%y8PO&yw^xbpd)N2-oT75ZTYc-N
zlf$+&2y2_AN$y=K9ID1@_2!@mW8(eHi7#GEwlkg}8hJoKhKuu<%P+G6PMaOOZTDW5
ze#_NsaQo0ZS-HL?t4=pvV(2L|+d3&(Wc4?GY2DkOKFSwXtd?A;bZS=M!c9$GVb>X0
zE^j=xuKdK&+1>puKX=_eQLyQ9#F4r@?IrJ=ZgRGUtjL~qNIYnf$c-*#3#}*TQdJH}
zIu-iAcMaq%JiEo`^7)qQ8!s^~Y1|p^>G}C--^YHBVmr%8dp|F_5>?H{@|&Cc3&U>x
z)`gN*N$wZ3u3y&SSLXWuCo#+UvBR0OH#W{`O$@Jgu0PZEdHw8VVcnC3H;cVgEWaw2
zDwbGbeRH3UVWXgZl%M}+clM_z_Ze6H5cxiH-iI^WLyIr2F%?+9Sdv>#AiX4gLiwvx
zjuMilHU**rmtN#)&+?7TuW3(pzUjKk{T^$Ix|4k`<64)}Z&sx*O7yH}Z2c8)elc3N
zKIqbG>)98AUK#%?SG%~g&R}sF$BUS2i>{RGd3W7iX)8AI%3R@>SKZ!Oy?t@XH`v~A
zMLu)Yyvz3vEKyu%Ec1Kfd%YzhpDKiS^aN*del|(dxmxa+GdJh!Tjum%W-U^i9m8ZC
zK5f@(c=GTrTis8~6#X04EKNZflXN8BYA;gFku4NHuKgv}`rE$HlH8+N3qw86CPzE}
zx4Fr($~|KDmOc~Fm$MC@%f2`ly(jXeSl^Lsp`D8YCw-f>;!$*5V1xLHj8$B-<Zepw
z@riuTRTBR2e5PVv$d#Yb$Di=TXI?tQuwdE2aEql3yF@zo2@1WCQ$C->x@*Rl>HofI
z8m&Elz;o?9-&wt~A0DiGttm5UX6WME%!dw2I!(7Ze<STejl{cVFSA|t+|}lp&gL&R
z-uT?gm$d&|@6NNo*lUgW-?6=}cItO6VKou|zq#z={yQso^!#}BU`l46e$%?icXu7z
zbpLFR_4|f{zT3>A)0E6EPibq7uVUD2JAYN;>Ko>b%6s`v+1^}XeSh^752hHiGyA(P
z^lF`AeYoJ&rQ<Pni=(dY?hBDWdd2En+~UHHjf<@0tsmchs~yohtxEk5qssDKxhn*v
zOnGG+BKxz-3-%{}SmGA@C+_wH_WZA5ck69`CHp^CYuc+l;Y7)1_QS7|q-3wj2&ui#
zK7aYhgyQ%_rr29&pLLcg-VV#UVjlH<!{l$`M`zFOtv0+a|L!d7rf|)tYwezQZlC+=
z`Kcarmj&C6-~2v$MCD`2*~|PX{9ga%*jM=+`Xt7s@-HOfOYG6Q;!cjLg4{U=7wWRg
z`EI<rD(blH%RBxeKX$b!9eU7GrQUiZuH10vLYZS<W%mne-%?9Gef;oK!!V1il{|Md
z1@^deyg42a?yC`R{grctuib?1zOU(B#qrsClWrW|<q&!M0$a#YvFz24_KB`7@;r3e
zaOcIWhaUQKzeoRfFRz)RZoPWq@!bgpr{bdYw!ix_*SR@J=vHj-H(hJ#^y4-TH>b~O
zxu;;afb)yWhur&V0gv7q1g>`cb93s?+5I~=-HTj%!E(p!-bF|EYyDuiye@RCD`aw^
zrgim%%`5zG-C7Xre(wFti{}<I>u=m*_>gbzp*u%ka39d;DvJ)PV%uE4ESBLy?zDf&
z4;7Bi`EzsGf4?*SPhYjae4F&|>)iY1FG5}l-x55vRrcFQbN;9=8+F&MzuUe>=tiK>
zVg8>l9_U^4OFquyFV7?98@TmP$Ar8Ug+aTXuRGaw)?WSnJ&`Y~m%eI?mTfk%{}Z)S
zpvl?s#-;dGH&}Ot%X449{d8Ji@;T;WM&I&<g1^rN)X8kBd-e5je{!GyU#8vlleeGm
z54rsOCo^wMav%GTGX|Fw&hwUhcryR5S?sYn>8^RVzE0m8FS51l#+~1be_gyc{ofS3
zS3--<vS;ltnJm=JfBNFt1NS(~%|FV8$}azU_Ta|fOovifr{;c@R63;A)+Kx-zI*rK
zX6s#-Pwr<#H0KnXC8C$upXh$g#K54+&cGnYz`&53TAZJ!Yp7?bXP}poSzMx<nU|KY
z@9P@k=;9dSI5jjj__l#S&G+>?PHxWS*b;2Od)Z{6Nv?vVk7jL>Nc2Y5Urv*R|Gcj*
z^6^+;Y?8le%kEv#^RJ6vnK;Kn=x#vr%t@RwN93Ell`@!`qEwr|I-1+{eQ(|()HK7Y
z(Qe8b4aZ>Pa5sUOfipsTo+o6#Ucs?X+fmt<OGIn#WwV>Nvst7A=4c9j(GJ&|e4zhS
z6kG784-P6*-<G+sCfYPs@4fXu=*ROm^EAn+Vx_-lrKq-kvuxQGl9OmZL#ou@Sp4rU
zDfJ1fPNi^E=q*WDw<awvXYsPDMn61XFE!ek`<p+W;bB^RqS^^&UbZ<2AB){K_AAB)
ztlP5SlH;q6)jBGiH7y()X6!j7b8TBYyYarW)|0u@rsPz3NN8kU)jr{2rByu3dH*TN
zuW{<He{XoHo0Hw{?sG|S){@>R1=C3BX{&Zd3vDjT>#pl;l|Gc{lM?vw_2)gtkp*d|
zb?>m~tM#2^x^zsSf49O-mD<QV`}`AT28x~j$iIK)nX8xfdCy9U-d^|7RQ8{J#hH|^
zTUd{850X%7QO_x}UR%hpG+x$B%`5Kxsc!qXXDn{bEZk$fc=vwmrMs=4CX}CgDE2fe
zbK1|zUzg<7MgKc%9{*@-&>gn$FB_BEZe^&>IFNb%_x*EaUwR9Bx(=rNN-wE=mz;R8
zh-JR5rL)ikpL>(VI~6ytyKD2d^zq^!4_H>XJFRD*o3{V6oAYnBm0Q=R-bvOodwG7x
zcCK~TUYyI`x1x0K$@qm<`Rg*by%%Wzn{?!c@P%IC@@_MJduR6NtC?M%{huIxZ4$>c
z)dSJTpS_3>i1~4cIjynbzgzAS%R;+X+mqxraEE#Hh%ZlQ+t2XSOF`_}kzLR1V#23M
z&5%B`cFy%W=fyIIMS2pS90-fjeysDrehJ$>zK+}z5*MVp4b528jQei38<*Hgv>1Fi
zAh7KD;tibca%L^kY1(JjT~Q3Fth^mI`?BTaGwKFfk8N~$i(iPJN~)j6c~;Xyb@A&{
zKdk>8ontj;cZm#pJz6&LIAqTp!@$50&A@=z1CEhR!aZDFeOM0~ave6{VZ9K${K5@B
zBU4$an#N0OTP~c_tGU!Lu}O!2XYIY;{~FcgEAIPnKQCFVE)sWmPl0=n?U|_Or<1)b
zpK6~?Q(Uk2{$a-L^#wl|bW3&j$d?BOdt7aP!Gg%Uvdt3FKAUep(Pdy@FkxU|P{Wyb
zQ}arSD&q_CGxJJ{^-3yAy8X_b*FJaNvsd3w@05;)X5Z6OzPjhm2X6>vxa_%frln?8
zLRwx@+C0&Y2TTm879P8N#*deQfq|QWfk7Fkg(dj~@j0nwsW~9qPJ_($);fE}^C7Zn
zprYr*qGfYdYBMnShA}Y6;504B)!9GDW$hgI?Tb%L+xGl#v`g$B$r|QHhDH?uKLs_N
zJ>TQ@|8ve<wPdo@)xA|;AEeE*S^dsgVB^`{<t_njwXuvB;;+O%h;Ovs@&D&X_xU?w
zf6TwMcHaNyf5CSD7w=zi_gl8a;s5bdbf$&|EniUPoO}LaPQi*(mwPuI|95YW+foaw
zSOKPDqu4S5rioALr~dymWtrZm5{3o;cl?`hE%d+qe!c&{KGuIYwuR%L*Xp{0?nmq2
z?)U!t^}EE8oV)<z?<GdkeTr^6b0zMrV-jLYsf_N>F7?r64Yv*ZUar!*zhB`kyTaN<
zzwD(A*ZkV>pI<rtebbTu%j{1u=os=(TiIQo>VKi=$=m}yyivz*cG%f`sN^p?vMBcJ
zU%n=RH`k^ANqnf6QD1xMVBx>4e{#BBG7(Epo={%9vtcp!QqBY=;Xbbw&s5c7r7mu%
zRJrJO?nYz&nq#t)l)lDA@J(XnvwHaXjIVd0=;yjgJCaJ)m#*4U)h@No<WkbisP-E6
zK!IOv(%011J`$I5lWGuN!Exi|s$~fp4X59kgq1i|WL`YRz3jJd%I>@K-joY;?&m%C
z_EFO8Q{qt%mMbx-YFw$f*=SXov&rh;)%^;S`+ppel<s8P*M9ZwmB!hr3s}B&{oZ-!
z|A8AU>(}_?m);Xy7qaEqu9VKs{cAUE64I0OoT4neU=_p5Z;Lei67o&<zdN*i>RyKa
zx%xfg?J|cQH;CSPUU*4R=|Pl1dQhKWvsB=#IFX<S+}12jE6n2r%mSlY^ey&YRyW+a
zMOS#u%9Pa>l6RzAGbR_!mDZ_n=x@*RI<Q0QE1#RkkEvo|ljFk!f9(>{jl6D_Yqmh_
z&WeI#Pbba!F1pxSz3sg1+Y83M6^d2WH?^%flsUd|8@zqBif8rquMUbG#r;O^ZH=CO
zdp3&nKfUE9I7jc!M1#vOy|&7Td@|VK>^Y@MI{D=<&#2b;dsPNMCQIsv^>HPf+a?md
z)Ma6G4bR2Gc#SWSuC15$SDT)HXYgbD^S?@Y>+bG(>{Vx5CK);LV-;IVMTC)Kw4V0y
zS*zG0|K43_v}xaLPgfgpNw$gld$g(=KYG@jm_9>xgLkD4Ba2yca~s>z!zYa=$QLTT
zeaT|r-Mnu8v7SBq^91~E>+I7zkvyT+z{2ItrI_!3Y<I8at9)o`XHzt132VgSXk$Y=
z8P2<o3LoEPrG9uPrTXgCw$t6)pH2(AZno#ZO$nc%>Ed0tgm+e(34N)V(4)O;t=`Y0
zKkEMcI66!A-5EvY_c2>1EbjHQYE^BD(J>d(@tb(2VX+=(TCb+6lr={kf1rI`4ZpT3
zkNWr1mIr4C2FkWA>dj2O{Ym3Xy6fTF=WI6G&i7;a$WSif_197R?v|>9cfY#Jm-A||
z230SaA)Nkudu5aMm1={16;o3`PioY=GFR>p|MS*+4S{#3zI*+qarq3MwU4E~S;+8u
zF1l@gaK{e4daF}jEa^8ipXj*x-+Eo!-X!uTuk3uqA13bPf@k6Vcb>_oJaMtzE+BOI
zs;yweHbv_jS5COhVEUc*u3Uv_QhdbzOBe53e9wB?U3Osd)x7K6d%bigIv$<Uw6cBj
zftZ!wEtbf67rvOE%)EbwXB2PjUngfBy^j8)Rx97~UU67tQC(1+{=3fc`>e+w%inU{
zuDElsd84z#oQmxa7uEG@$b=VI9DK6$y_icW&&tpYwvzWRxk?VPr0XA65A|AYyY`E<
zgv!G5+1Yp2@$VLosbAbVA^ORo2hT3=aO?D%-Cbpv#@B!J!0zp*MGA#`5}wz!=XL)7
z>-xJuV)k`$-rd=(%wH0GGhZ$Awp<~5_Inn~qm#_B5%=sus|=V7o8KjHG~M@IC%<>u
z>dhDAe~G7=$!|D*^^)Uk{w>wdCgxu6>c9PrXUo<5JsB&vi?6%F{%n&q%fXN3#*&B3
z`?pSd<u)zobu9nZRgJ$l2!=?s6(0{5G1kjttvR)GFIRzkiTlDQ)i!#^m(Q(meNp4#
zV!>!v&@J68?8)w2w*JXHQP+9bK1{HaJIS`^qSwu+6sh0VBF8$z3-0pFKG_m`x%Kev
zS1-ga`hCk%Um!21V4C2V%9XHIs^Uzc^1o?;b7YRL72}M4*LtE{yfVoA?N_NdpDQ+B
zH)U@+Jx_D1^zq(HhWk`D=5I>3)M{{F6S;Z5QNZ5Ai9(gqPqvv9KA*OJkAe6pX&WY{
z8($>KQ)fr==sEQrFn?IGEu&ycmA1FYm7N=-{~SKCz2QP@@$`NB^X!W=3Ob&%u774{
zIc<Yw$(LoDb5_NAwsu)hJIi)ArZsr~VTYy~>G`+$=chyk#BxmYOFLY#=3@!dF|H%e
z9)?UgzH(}3$@%3|+q1P6t$xzS@L!=WPCVTFljH+ljlI{~vrm7y?q0ZC^4V5_CB-(J
zvbqm)ZXLa1^<IF-^&$U_b?;_>Xt$~B?fl7bF(ZHCtiaYUsuMnPzn&U=A&+nBMRu<P
zEn-O%omb^cwl28$^rG;cD}Ohvog)8jJ$I;>WpU=7_G1M+7r)=NQ@rGJl>d;jvkh0t
zgEc|X%tsui-%(^~`s4Vv?#yBBLj85me@|_yo}GWx;gZFRIz|gAw&^|h%Bwj8wBmc$
zP1^Ic;?e0#_7j6|EqDIg^@TmAbYX6&T3Nl{oV~A=1E)9f=G!T(G84P%I%l=*y^BfJ
z<r5Cwuen_O*JjPX{MKLj&(`mcSO2n3pv>PrrZqD`Px|}63lqu%cgSYTzewKksKS1t
zwovfTwKEtTr~I<Gp|#fN`*r)chkMj)-ni%LAA9!nKx9E*)taA2C0!O@e7c}Evt0aR
z!LF~<b&oi!IMudX5B;IO`^?6?GGEDjWxoTVOZ_gM{<&yfv(^=Hk0%@AF8^xVCDgrP
zvBwkPidWm)o9Y+Ip6GI$|8bpX?}1AJDt*iHT_11Ky&vnh;LM3TjMnFi|MP?y^flbr
zUh>1=s?H~p$8F>46DjJ9lNPMroW;6crZvf|tuyu+`ve)QJ7>)vwk3Snp7X?i8`s6_
z1?x>Z4lLncvvWqk^=I9sN1s<;Ph*fj&n$G5uV%u$qxx*Mr;q(hX?J>%VUwcX+WRp5
z#v8sim3zTkZ(qN4cbln4P(|v~Z!1LXZ_4w2V4wYCvTT3)3~t%;DN@(c922a(xbJ^I
zknDeK*L#t;zzClGQ!oBp#%l27_tho;Qj908o^V2Eg6OJzs~yvS&X`yDH<6ilb>Q#J
z7nNd>Cf5X}%JNLUe~$A{qHeRx-qces;vLd#XYfC5nIN<N(c10@8=p9PIRDB>H<|L{
zc=S}(`Y&^ju5af5rh9*Dk)`r9<*09|R;-&_SXE6+e%r1+{dr6NY;E_3uMaq8*9J@c
zG0Ur8UH95wamm!%pAD-P2zlJxYZN2D{dVF`iT1T(^Lndzzr5+t|LHk1Z}ulvdxQEv
zf5aUAK9)IfCZy1P?rE;l9b77pZZj#x1T!uu*){ENkJzo*G83)24%r+0eGw{tXiN9`
z8GOMFnVy>$^7(!}u}6CD?sIR~EqV}@QXFSkyLzLwOpX6r`^x#jvSnGkL3TpnyL}i}
zN8HYwW;E5yq~p8bubkJjx_|0r&Dk!+-lp+|c}K}=ld9{9$ESMuFIoD2`tPZ`1s>k{
zVysde`@;R8tn@Sq`3s4PYjbWUv9cb%G5^ZBx$&o6lpc3ByD!=Cx8bVqc^S9ZDJQhc
zv_0ZqojcaBa>bkCx(E4}7#IJ0!dv<?jM3tIi;;!cf~1D4XG$|l{%-X2_g&3YRB+BK
z@^x=c<@eS5L*Kn$dc*&LNZH@&GIzK6&zF8(6UljwnMaH>SL`0gmp8Nal}+fgTIpZl
zZ202erc9SFXW#w3boQ|Swn~33#w(p+i`rgZ3!cLt_jN&syv~7*r%y1rByzl|`){%N
z^SkZ^e^1`w`td1u#+|#due`U!NNtaad0W79B!ahDkj+}KxNvT73)_w5JBkG6?R60O
zKUq?5q5Zz)<>67A)B5%pSG5>Bs;j)Xm$kg_siFVd2+PR_XXR;@ZtXum<)`cM|4Zy{
zi{(w;=djR4^z!k)8d@Tv8XtBs%`W=FqVlcOz9%hf!H(B2=K1^V%4D12w7`C0VMOcP
z-*(rse>W6GcCGVC<(XHsQ)teuxF>)1+_}TOXnncf+R%l90iQNmUY@RYmH$<GdQ$Or
zQ$y*fOx7uKCsuvdntu8Ak||3(bS=Z*dOGYrUY)Rdfg#rs`-b*idVikmH4x8Kkxbwa
zS$X`{l^Y5QTPn`TZ&I&HntxqfJ&8rZV!@fsr&;Pe_w3&=_jP-HNW1&dH?A?0jT-GW
z92`3jNG089EL41z#j{-FvYY#*-tI)3Z2cC6{fzvxom=ul?*^27Q?z+HW6ramxsKeg
zENl&W`Z$8qA|9<;uU=^D@n)h(8B0rz!EO1s&;EPw{N8j|Y~6~x57x`?|Fyd@X0mbm
z_PH;f?!7Tv{b1gV6CC_2gXL3|FSHyG_No=Qdhtfe&FNcz-&A@1%U{_|CUIV*W$%SW
z(`Q;9j!@*eG0*4YZrjg^ZJ80iOZh*DU5_?6(s4dvyMFxV1;qh6ekNg;RYcZHe*5)n
z$353M-zPXE@A{_@w&tqi%b#ZXeIHei|6~3dKY=?aMf}oD`76cTX1t8g(+dh8N#0++
zE8FWz7)xrJ*^;8o_j?-uh`n@4{<`>G;hn@6LHT#GzDz$Ju;BcP>px6<(lZZzsM^)|
zTPEd(8JoB7ytiy|R>I%&%~kFvvivz~^8fGU?5>&(YPw>LD(YH~R@E-F^-<e>_*dY=
z^SUluo<4lDY_iz3zt65(c+@uM#YM|KU+^OPvt3hLxs4U4nJt5`wW0R!hUv%UcAwk(
z?Ah_vl@EJmy(S$gzi_>=ivOd8+x8jk=Ra=P<hAUxllOzlDpPltW0Es=i+y_>Rd!&H
zbK$Gqni9>|*;)@iUD=cLVcMzJ?tAn#7VeZh<a~km?Jf3W7j?h!wsD8OzhYfdoc2We
zm6b~VO{e7^oYQjei=5}pTiEZs;tV@`58KA2Zh3PH4rS;*yK?_$UAw~#^Y{N(J$#@g
zotR&?S#zJ`wM6|UH`asZ#uIX?k4?BDwWECr53Bf5YZlf0FV@yii2m?3-nBjW_OE2M
z0JUCSH`PF~E1J*J79X6syyWukyC)V$X>ONp{%XynwlaT5;N4uux20TRMP1hf?0A`q
zRhD03Efr(GquIPS=wN@TZ0EJP^WVNsdUji6!F|cFXMXFsryZzjZdl%9#dI`ud*9B3
zJJf5AZkg;S(<eJ2@^Rtiv)dRXtXr1sYrGcs?bVUW%G=++|DM9}oqM88@rB;50~6O>
zFbd4tpk~$c{_N{pK7Uf%AF}+g{c@JO!_e+xUcoK>!+W?kTFsZ&)z4F9vAC63$X^sO
zV^U7bnNRx;8@!k;aIH6A>7s~A;;yS_SS|_}6n{^-FJO7PbW-XAp27pW4ocn3cE0rb
z>CQ@~dgr&#O{$I-*<CGOw<uuCL<3pv7@qdsCr>7}-e|As`WCkJd0|x6kt}0orax*u
zzIh*aMTE*vHq!6cVObi&&$lCad1IeV!Cn6YQzjnpYMB0V(bcPaPX7G<@3Z{{qu5KY
zlKXz#Pv5$}V0-4hvh1Kc#WN&~4xHo4vaWc*U$5l5?wX5*T7ttP&jr4>PPDb3<~w#W
zf6gQGJ=MNW375ZLunQ7@ed1Sii7C&<qg!51$YEj^JTKYA*Vn%*#f!tbMqBQm=-c0S
zKfOAmWc6@OhgQR(*uK8H%NixYeB!Gjd>9*9*yL}$Ua|5_l1+5Me>?TMhx^_x__Tpr
z+is--+q0l~Tn39L%jtfa*l=u@=BZ|fmS3|%d{Q~j@6&GiZ~n!k{<i#N!Ks3N$3<)>
z91pZHXh>CDJ~M1$a>YKi$ALxbp6||Im9Xcq;FH}2A7}6Tdx(E`IQRb0-__MUt5Pl1
zHNMUW?qL_d@LXmk(}aDe!{1anA28OQ_?hqE{_gqve<VK4t^4UTf1+dirJeHf$)W2$
zS5C3IbxbtL<hm!{0c-wy-(5=Hue|&(^5~!6XWCQWmuDKctp8ZjFlVz#`H3`j+g;)<
ztye3zM|HRzk7eJ!vBtyy;~WXctw%5Cs~%Xde&p(pRa;q3uQ%*|w&3JyiG3#Tw^n}@
zKhGu+>(~(d#HWjY{=(|7i`RaPW%zTnZq=Xbi$303|Jz+%b@_@O^>Zf|>1Dq&y>P*x
zdQ<nY=~eNf8k1sWlA~|_KQ{f+K9ALZeEa8r*J`~nO{<?x+1>m|MoPlX@70-$&YP#M
zFPLF+c(L)JyI~GWFZO>vUGU<S<(p5}kFr)D?atYK=$Yh$yl0Cya4Y1fI(ywIe7o59
z2!BPgvHIdW?>&V6d|#RWXnWMz*aqXtr`MfV=&9I!hes=C&e<4-<7|EZgaR{<6`#<Y
zq-V{dvafUZ{tL~wpTA!&ccM7bcjws$xxEe7jhi1gD1K_$`C~eln4AB~bI(t5f8_aI
zuJP->#NQ8A1wV4W8APSGKi+po-t^bIwqJXv9{<BKSH8cyYvJZ9|H;8s{pA`h^^@D`
zCNAG1e|M4mF@@T@N;dLeZhcKH4~{b{*nNNJD-#*xExZqPmVLi=VbXJh`;Q-gJePNr
zweipI590EN;%&o@wls&aex4X+_VU59gKLf@zWyd){M<I+S5()XjgN2Myl?LK_1=A+
zLuzZ9HhjALAvsAX<VjujMq7q?JJw!ccwl1v#@lAfcV*ViF}2k(Uw3Xcp0wkQ$B)>h
zdp6o`ujie_d*_@^^XKQUdwCSk>74u9Su?|_aObM6Q-w~dJv-2N{pYs(2SvWc<?d;I
z{mVDZLbz*baWS8oy7rZrwyTTmvI6ZMnKQ*yPt2=sf4AbeQ2u7eK#qU9Kiw;TJo|Uk
z)^P6ZYe~UImc73PzNf7HaL`rpn(ECY{Z&V1W?we@edqbo6Yo!My<Ph5*Q=RkkJeZu
zy}MpI`QPG-eAoFGzNc-ncaM8@Zn9IlbIsC;3hw3;J^!6vQ7;oz`Ask`n&Val|Fd8-
zJ^oMcPIOA_>NPge%)D)0cYx#II%)g({;SI#an5ntw|sxNY<ZsTqYduQ1vE_Nu+9n9
zIKr>KT$Vd^-vq7dqY(xYTxsvh1-kZrSG|9r{zRo+@gyA^-W$FP7TZN+7rjrpzImtS
zhv4_mCnkigyPve{U0j(+SDo$8&t7%5ib7%u!7C5+9(g@2>3DKbp;6%zqb*BbEZ~@{
z_wJ<?OTpJ2Q+G=IINrHP{N0Z#iN|Vu+v-JKP4@(*-a6uCD4N<8^CWGnk;?0-QnoG3
zGrJl$rpkT!8*xqAyy)-3ch|zdY8IWIu*0uJvuKlz;q*^-uHO#?i@lum=+VmbuJ%Ps
zGgjX#w_vM#-xBzI+QXRgpWJ^E(knBh_EyYV8QNuj)3wS%u8(Q&JUuhPuCQQnr&~d{
z!i*HIeAk}ABKR%p#pxBRV%O=^+Q--)*?%u@TlQk-{mYIh-M-1F5tGuepj~yd^_-@C
z<~xnv#(T>g-*)P>Sj!Jj=^5R+atY;@aShix78I;dFWbPh`c<mNyOXj$6Ab>?{#bim
zBkJef;+Xrwm#foeo|~|0q0!8sn`<YDsTWtXI@e6z*t^0;_22i`*PncpXFvKa<Y?~6
zY{`VL9v&;VU3vb+=hTl!AEv)9>U~k1G3mS6V#Y*ildt-PTQu)Hti1M&b=?Qy44zw-
zVSd^N<?~iw(`8q^_gE<T3#WH@;mO$Nn>yB?udRCYn=^Bt*#8L)ejy!Za#yy>PM5!}
z%l0sFsfCGiR0I3tGrRULoSk*!l&8e6?JKVA+qG@I;Yqb(p^U<HXKr{1TQu|eMN1XQ
z`#<oIjxu=AEnoV!zfa=V-<&W1!j_w^`=51zDOG3Ad=qBd6MqyXOP?N7U;U8#NR8CZ
ziN|**?Q&BKKJYng&7%AIPkv;{%@F@J>FKhMOWOiO4utDTs?ACbSD3UmW6SQnPI1jI
zc~+bcGx7N2y`*}Z!pzgtqR(a8f2rp^{o%KwYoe9Hjl%~LUwvL^6||9CMJr0<-$}tF
z|J2!wHFjUqG}-om<?((0@6*%goZo)>b@2h!4RiT+JFmSJ;&-lh$#Yw`>u);3?A|4^
zc7z$cI4!kt`zc<ff2wT%{?1u#t>Pqlb$vf)U+1y@i}${$_J~TVTFSh8)L57BV(A6l
z@Z+1KA2?n%+<ao~xkLNUfBgUa?1Sn5{;ID_wN^D@S*d$Vn8D21;7q&UERS!D8U{xq
zw2O^nr=NY@y<hj+Zuh;5>b19D-|Ob<rTT5%C*7$Ms+AgAd$*<c%`<;2`0*aQZtg9w
zWmD&yZS53d`6T=MJ!h2ic8z(_OV<}Yy0qxPi-74lFQ?4BJ}pb`$ux~-_QTHKO*Twf
zcl3Mak_TUk+4-vToA=l~`|QV_@L*kc@Ts$NYA+XlTe&CSCp#p_R%@+K=)vcbdq0aF
znpVSYso@gzpSkXBt*y+qA0NKv#IFwgQXS;ar>7~e<m`~Jih0uRo7`7UF6EhRd-s{F
zm(!8$`4i8-n|34q_AE)Od&{$n+BPozA|Y*k{qL1&RjTTGr`k;&0=^#3QY*L<$Dnxc
z=~3;Ump#4Y)GSwM2CF@9e57Ns`fVXs#;mLiuJZRvDzYmgrmWuac-o?bo<G-2+P8Ab
z+H?NZKYHQOZ=Ist?%n$C2SuNr;IR{lxa-s6Va62{_ST`-W7TT+#BO1ZFKZjkVxyKh
zTh)sFm->0(vG(Hi{Dzy|_i6TBYu(gQTzfr?SG?`BMt@wR^dreTf-kmD`}Jvp{HE_u
zIn_m&7wtB`+qp(bJ$XIvgDQc1-)CFz*&KVp(^-}iBFNM*JA!@x)<x6ZbG|wV?)#d5
z^whb+vpStqz9#yVuJ63-AFU?Ly)M#C_5tS`iwql=_7{AI9_EKXeyZsBYgwqYtNO=D
zr;i$lUFq&&&Er$xb}y5WoA|ETW@TO0_JDr@W*^%p{h$1_;-6LB=bcM7$$0X9)!+`x
zI#$zTseiUveZAz&pAQb+Ssoem{J8K&*I<^K_1XI>J)Vbs%x+B%G;BS6NlD3bVyki8
zrCgn&k2}TFHd<(@ZCRJT@?dn&jYVu7lm0ime{uevw|j4w;PnEV>FqX+D?HakI&NZQ
zOPchv@=^K})#UY7lIeL%IarhK@BFfP-k+4s{T|jk!X2#U9ot+Hy79(=$#G#j8!UDx
z?3%aswXc=ZovX=a_nkk!k9(+Iw`S6>(+B%r%{yRPw2wLW{9|#8+1rv_iuhNRFV;Dg
zCO5JB+~(6oVV3sackb_&w*PV7{vS_O<@}fJ4EuI7%=PD~>fn=^#k9EBCyd+ktEQb%
z73<VfL3ZVrHs&|q>vv~a82|sqzq(qcm!AqmE*0_3N!W7aiHY#~oVdB!Q}Z7+KHY4j
zaQA3z+q=rR3BSyK{H<}iWzT<h-?@oWvc<oS9A$1x|7&FuHZ#nu)+29$VHN+@zFmIa
zO9aby)wtJ6|E;@l_$dE>ix*Mn#Z-U3;k>(f-JIlJ_jmHGRYncR|E4XT=6U(Y)tH;b
z_w0VB{6FP?Xi?>THx`bhH_ib|ZkMe+pteuo`>QRQAr*V31fF|3RafO>$%~6S?k%zU
zvwrjcr}x(j+U#%mq^LOeHse~=n+wxySMK_Gf;;ZIe1!Iz8D%>pm+k8eVNt#K-sxEX
z@hfNL-DSS1o&Igt$te-+Dt@77*0dY<@64OCaOsWc{)5&D4xGlB-|uX!tnQqjd$ON%
z;SDd&j75RVo*mmXA$+5Sx>fdkevRtA+@I&#*-HF>#HP0T&4llMH}hXjubffqdMVG9
zMe_HZ*Avflf76VOmYOQ&GHuR9cM&U1w}(~Y?^k@^cO?Ij{M_c!2yuJUX#T|x|1ExH
z?UieN{8)nDZ24Lzj=;3%Cs}kK91AYnH@#^8%KiW9-j+^icd<4+@=zc`?f8`i``g3?
z4<`OQBE!P=c~zuiljwz>wF_MLJvqFI@7SZ_X|5&W5ucUI_D!_ux0w)9vM5k|ZR&nI
zzGJJ@zC2z~XzF<EytVd?>gNyg-$gerEz-W17#<q#H@jroWa~LMw%eRj=zOxu<@wRs
z>`QhTPv_csxZug@yWR08*1y%i&Nijc%jKhp;nt^eE4ur$A1ZhA{JgdybwW(%9r<ET
zi@eKTwL25Pn}69`&$9gRj1S6lb@{y3|4Y?8a)6(m#plQC#xGS7Z~CXU_d43ydtWbC
z{5)H-=H@-Yn<vtfmf6qka-E*sH?bvo8-wUN@!wzN3br)6dM+?M7`AGm!KaT;52qHd
zJEc1(K3wcx7oV}yS&@Y@xs!`FbT3nz%z1I6Nmb-Eqxsi1yh=-$=_PgkxBm}!>yCSm
zK8Br2WUH*`n6A-rYQmQr%_rS%ZE>BSbw%4W*CEMLc0<By-N09;_jbh}*|F;M^`}k`
zj%wYKX5=^jnQ)Llb-}Eq_E%GMm&x(kEL)&@!^~Lc?aUP#KTd~Eiodc%uIbm-zl+jj
zp3L_yuK&D6XQ$lmz=hW~sFikEs8%jMFMeET^)1OI73}$(0>4~*6+eY8Nc`>)+*7oL
z>w^T>1~o<ZE3HZEwfEEt%@fvc>y@xQ+y3`hOW}vdJ<IBD@W1aBoaXy!_uOkU&ApSV
zgby9{TV>WNS6#Zpvj5s+Idl6mn>7LR!YA1Iy`CQXJNm%MABF}O7rv02-jpM|r?My4
zc>ek6iJZGXB(6Af^FwWlx9yGe<EIXn7RB%0+%q%SIc4tAiMtz9^~;i)8@uaQdOxdJ
z5peY2jg2oo&OSUSU;K-6*WbTSjm}K1iqS2&m~c}2NyMDi$vIP21x(&HRZPG^FE7vH
zu5&m41GO!7Rj-$aT`RPZW?Z>7o!4Tj-@3%@lJgiIWic3@{k$bicEWCT<%LQ=W~a1I
z?C<{SzP!`C_49+>QCB1uOqeC^k(hh_iD3L`*=I$!m?fW`RSa5q#f;U0rQT%q{E#PC
zH@y)S4k-zAYTBsKRj^^kiO7Dh8&5(r#kZB&8@RoQU(Im$(wlVg4E8TuW3{S0%U<|M
zUfSuNw)pj8ZKFhm$YnEF9$)eMB-haUq{jE6?6;?OSMMLVZl|f?<yxcIDV6STxc<j7
zy<<g{;oi%4u&QS-J(lD*V{35Jzv>6C%L0n8E}4|b#ml+eZCQx$bQdeJ^O`BA|E^v8
zcj`Q@jX7VRb87#1{Hexr<-#ROS{=NXdz@-#bS{zbo%(J?u=3A8g+^+VQj(fH`=(Uf
ze<Q4D=a)Qx+WO@UZJzU7Pt3NM5chJ6aCrC!d4&d!$F^DBthT39Sy*^{y3U{K|MTNs
zt!>%t>+S24OKZ<8(qEG>V_*0$D>+%;;-$|2H!QGimT!`Fp84_NrqsVbEBXKY^}3M%
z;mx{eze-s>#^Y`?@3@~V|Nd+3*SA@xR>)mfc{DMnzGy|r(?9ooruZ&Tu=sUx_OmTq
zuYQ_-xX)2~hEH>v`l7lMM>bcw-7&u8v`+7uN*DWLNzpYDPnK=psll}`b^m<n*YcvR
zE(+q|GZ!?zxgK?opGCdGMf81toJEn@k@uS?NiAQn@X^mm&ALVZEQ~%LpL_1`%FLhD
z+gQy)ySFcxyWx-A!os3RjZ-uDWE-?r$GY9A6f<+KxSv_0%%Az;8rzO}^S(NIoZ0Lp
z`(*LO2_cr-RNG5gvitPjiQM6}|0KG%aAWzwZ~Wz}f3@q?Sm#E(n7+&Qm0!a31&i<g
zej*aR<jBc?Cv9G~%$Ul%_Ef@K#U-B}E1gd-xMi|_@!RuuUj$Y)Ik2f-+z^<Rez2Q=
zRhn_TgkJt~rA1xVbzIMNS2VnM{<F4Ad%3jsarsBrHK*}7CQjs1iOiY$^>9Y1SjCG6
zCBiY`43CluJ@h6#UwGtT{k8`C{vAAXb`{UcRr|Hyo-t7Wg@Ew8qyCw{r*L)K$$3f4
zzNU8g#BmdgPpX#3B<1A<61$D(FW*r&yWMQ(%k6dd++Q$jd#>NOr23LnL#Ng0DXTrt
zJYW98=)@i~$=T<AwOQmYJsr)Tq@)=a$@|3TX!z};Czgpfo_i2J<zjMkhHk@$qOIzZ
z{k!wMzophcH#g_#wv?Sz*R$x$*NBOlK`%BvnY{ATjX3Ax_HD8qQ!ZP3g>Ojq+;DEX
z*t+!J&qYt3pDf+d`}%jXrP#X<R(Z<{*UwD(_^U2gnMJ;8;Z;c?t%H}}tbKEE;*EVQ
zcO`<p=9&fkSseQ3N7BJhVcyvZ+hRJp_p7!n^sz0ioUz!U<Awl7&$<bb70oH9r^z=~
zRmLqnu<!A=f6@MHrUhB<NlL%my==xak-cm3o+#F=IPQHw<DjOQszI>YmnKPTq3ZjY
zKW5J=tNZjuVQ;L)#ivpFZ>nYVnWJKAlRutseQ|BFh=y~cs8m*$+MC#&o;MaAIexM2
zD$DfveTf0=cE`AuADp0(rn`dg5!c>Z>M4=Wm>w*TS)?7l=fWP(`-gsoRR_u+-0$*t
z{;Ypf&Sb`LnrN3U-@KvxO-xn8S5@An?K!NkCC>1@$^Pw<Gr#ri@7{*{Uo2$W-g2&=
zd81hF!9Cq??Y;^-d;RWz>tkg2=;L&8?$tfJAN^kYf`2x<Eq_|goSupk=8XR~`+l@~
zz_sOBPucobj=TB&dAaW=Ez98dR$t+1(JI$v$QqEJ^|!KA!pW}f(fmjM_{|hH85o@S
z(yHZWa!KI2%AV36%-vg$^l%?NKIwPT@!6{@eop=?IG6A5bY+gKg+5Dv)v$PX-Ty5j
zA*H91=$>BF;@qCZ&p5+1Bz*T@wK-<3-!Fcz`*VtOdid#pymyStUD~d1m3pMo@$Gar
z_oiUm;#D;sDtcMFd5U6EQp#UUXFgS5{M$mS-Cpfc!G!OE6aA`lYgD@B?YG$4eRPhg
zE^<ldQxaC0rdU)e_*eF8-L{A3J0t)9X>c>V*8bzpx~c0;b)SDVX?9(;to&)%EYWSd
zpQ{J!DWt!M`u{Vwvp?-)@GGnH{*U&^DLu?P{i5<vkm`oNE9Nk*IP;`rHY1<XV#nuv
z$2eI(+?u0bFE{Cz@4G`5YwGf>_E>N8*it?}`$2&Gm25{99lMRJ!7sF*Yx7LLIZ-*d
z#Pqk+?=yd&q<?!>6@N-3&UAw6X+z05JFo2!Z!KSUVX=8}x-8H0d6swk?k@0TnrXYb
z^hL5t)w7HG&(b#MdV6e`CMb6)YKq$B@YNhziJlqO??2ow+Mys=k(c>@(_xQK$zqkK
z9(;dQex}e>^HtX>hmQqfU;DB+E_Uy1b6u0MOYW(6z;}_|OAkL!XV}oM_Oa)Peck6n
zQ-7v~1>FsfQJpi*XkPovJJ&e(Znt3AvcNc5&T(RN2J63%H{1Is-(J5oTs)fPRh^7N
z<-+4r+dY0W2uj<`afy98(WPsaWqD<!ltatpqE&*zWgbte*bl0FEi_{Lp38hTK-XL&
zgKMW<p3(-E^u7}@<!u~$3`Lh-eXztypptw3<A0URPZ!^|)je2w?+7RJ^XVRSyoKwI
zYOZuwH*mDOFm0~c-QFn^k8j&tU-H=3;%UbIy@v5N(M#m_rmXq*=bO8F>UZI)4P8M+
z)m#zL7hlLQ@8Z%eo0Jfev9|kZTRG#I`Liz_ahIR@r&nsf`o0G&aX(7-hd3<m7U1pd
zGWo6Nnpw&}<+!NvoJR$Z*`)W~nJ@fl;_iL-KSlO^t!q8|!fvZcy`<CqoU~Ju4U^xk
z*C-F!)4+aX69Zq>p2PQ#z808vezMYh>%RZ5b3fOwsJr~<Z@;+Fy<|V;*ptT(^Dbdt
ze?E})_}c!7<}xXTja+L~#fl6{D-usHe(!!L{=r}MZ4)kVdau}EsggZ=w~*YN&OW}D
zZ!vS%{XC(c`k3>Y>xrz#ktzr7Z?IpOXv?R=sdU8JRgcp@yeKGp+uLL7cJeQaJ}1pm
z5jUN2(ap10?&ZE^wPky!UZt+XZz%Aofkoicw0Ubkz1Wb@Be(MPqEpGC?p7jBHcsdK
z3qRJKe<=T}U+=kkjqqt>nL`_@o~P%UHLuM{E0zDCGv$oGguq88P3u=84-bmX(0nCr
z{Im4!)62}K9GKYt$k|wIWn61JF^j8uPZXbKTs5O*n`^XTS*L>KPG1|x8smTI%5Q~j
zt-b4{3t5e(B}oMxGOL^N{78*9M<_@61>3;bp3VC6w*20<=Kb@J{}%rL@l<`!!m160
zXPlL!S-hJ~cFfmbZ1AOa`ck`VMb}SGzqTr(KV;AEO~$|Z|2}V>;r~P9%+^g)VryBf
zj=v86UA04B+edllX4S%(?;lz0o1^pOU0fN*w|l&`&+8X8mp@Koy56G4vdu(VHer(X
zY5)FvO3eJRDZg#j?9q9#a!P)gXU${3^CsUq*S);Sp;vlsS7w`r#pMUFvv+;cVc%JA
zb-naN>V>eU{zo<cKhDnhf1$ekx8|SE7am1~P2hi<?ljAA<wu*<>w6fi<kKR`-o50S
zI^o$@xl@n6h3%+$9c=&d<+tOnCC@1*inbR_j@hQBXI4^pNRh?k_rp0%k>SevKC5=H
zaJ2=Nv9#4T*TsGOX`(x+()7aZnE@47%6Y6A%`45HwPnxrn6czpkk^!l#hx)MW;-5w
zzbRkl(xd-oPyVUc?f3XncCTSWYu5YEXBHM@T)%Prgu;=ln!2(pKm44R=hLuiwNdd6
zS-*Yn3;wXwS-7pZ_ee-wy>xwsnYX>kn@1bZeN8wab2_kr;h}_=j%!Hw=Kad|_09hz
zUHcoov3J_hdrRJZR-V>zDXe4L#~qPw0r3}`+*VcX*`&XE<@LQ=PV$NTF_;+ruP$zL
zefBi@@Y})XRQtDvZ(p6Q9ym?I^#Xg0@3fZ2XNFgQme$WYovY^g$-D1o=iFc4*B^5|
ztkd^UF=RsR+>V|94s1`ltDDu{&fWOUwbxN>YD(bzQ{^wFujl@waxSy=z<PC=qqa=V
z?_%X_HkK;gQ~oR(b6~0cw^J)b%g<V?9FFyy@n>b<J=yYicb-k=v|ML6;djKF4Zk^G
zH3@H@Gd=8W$O)M#lPe2mI_xld^)KYu_vf-qANZer?!W#tG9uthp1LSs#@|QNHeXe~
zzOB&O=c}0SVPE;fOz*N<&uxylQS#9Jf%wf@N9BwtuARk^U)1!n)TV!5Rover89&vJ
z`5F6>;!}?}t5e;R_HU2*_v6&_)~ny!_wM^|Ezri3_fS|tTq4ip`my6$vy8J2t-L<N
zYWXhfC5N3@T$t_bkFwXdoA&Ee|66XJ@xVlm>*8KN(ZKDh@*QE}M_)ecY47}Z<CM_9
zeIW&|&vxIR?)qP$?dpZKe!<JH{`Nd~L`_8b;OgWKhu>ZYrZ;W%);&`EC1qYt(_&K|
z)9cPV_BZdoAHVr0v)z^6;FjQsJ(K=kyBB<r)nM(%SJMPIDwxlxh8{1O{`l*mM+s#~
zlaI)!zW=%Ka{dXe(<fdfZvVahKYxHXBa;ZT2m=EH2Lou0^0Nb5j+F^AFtivmFz7HK
zz?Mc38)dgaVo9QY3WzAqNGwX#&rQq&VMBeeB0WQNlcUzk&ELz&z|g?Vz~BWk42rij
z9uP#^#{e=E$>f6kob1dJT|@oE<dV$%ykh<2{9HY-ElH)BIVpOXdBr7(IXQX-`8k=%
zmB{vjmMw4D@~ADBpMfDx2eRrKYAwT-#;3w)_QLm1<YXqN<`t(F>pS}gM0)zUBbx~d
zC6F0RAcBE`K@3WRs4b1tl%ZyVorZkZ7`hp=7w=o)#>~J_#g1;q88kBr5=%02GL!TQ
zQ2YjRhxoDQ&rdKhFu1TYFo=R20L5Dx-PBRtQBqlunU{{mh=c`6a)km642w<Bjd0XL
zF(R=jJtwoc1d9=-#=6hz8W<RyZJ8K^p)LSXTN<BQp%?)U6D$U}uCQmSRb*heU5OqP
zQ+A^mkepwX3Q8DQ%n(n!y!ts41A`wYx<6d+qL`7AT9B5RlZwTNrE(hA&4d^j=Gj8-
zngaO&gts)tKR_`eHLol=KQAp4TX;TN#4oFE#K4fVmw`bNq#KI2G@kl|Zb)WPeqL^B
z9=0%b3D(;g&Bnm6K?L0x4OK?St{-q{>gOgVXJqE3;_#B5gWm250t^h*=I9~2OB>ag
z<ow(M?7_me=b__gVFrd19t>#FTW5oAMqV10aQ)74tYi)!1H&y%^r%@BfNDTWY8m9_
zUi8eeTGCW>o)`mzusgaN3ggj?z@A3m)N!r%U}9i+#eyEU4rQnYfHqX&NMjX!(UvNV
z3=FDF=%Kl{0@D!eS$1Od9f1=<3=IC3=nfIB!Zaf{F*6TKh#r%j&mbnxz;JIqdWZ`3
zq8gHxUzD4OErIc>alW$VVqhpyKo8OAHK;~_ZcD`ChBApeZvr$J82sj-2gdPj=mtQ`
zXN>Y|+p*`>333b!7s?qJKy?r_uP|(B^uCX7MoCdV7FVQ;ANE=)%D~_s$iN^3)6T%a
zu%+?tUsMxv^08%C-8EGPkL4K{k`|(e<Tha@lzdi@SX7)^gvALDzRj*JlVD)z3_|zB
z8Dmr<ic?EU3$U0lWBa<LD-{?Rnwl9Hq)<Fj;)7;FX;MK^epYI7Nii04rY`@k?;g#-
zFsq0WEvJU&qMB2ZinS!?(NQ{5$;!a6T7ZE;0mUI_PoNr53aWFHa#G{*6v>_WOS(09
z7#NK77{D8bU<Ph!Y&nNwT7E%EW?o5ZQ9)5^3DzJ^4OyI;YQ?}%`V~Evp54MQDL)Te
z*sQ<YHF>WH1H)7g^yFG6%8VS*1x5MkMTxoC%rM!bnGm7Nz>s_l-Hd!K6f=ra%ZoCx
zdu0{RuW7D~3=D^v(Bt}dIEopG#U=Qf5BGm;UUE>HfuX32fk74)vfzYY5s6_A{?L_M
zHc#lS00V=v8v}zpicuw{*o-R5FD^(0H^s1|!9ex>2ZWdz7^d=}yK7z>hG7Ny#U%wr
z`N^rp*n<1^d_$$>+zbqBUC`^m*PWO~6@fj8#YLY@^lfIaGB8}xLO15*R19OvGK(`y
z^08%eP{6?2e4w4TAU+6hX`C?|#h9eT<m}YE6nv4FS)BUiR5SxaUk4+27ca;h5Z=;w
z4ZB%TGqHuzI>E%ilwAxA`6A2=N+3g^cuV7*?^xZHmzkH92sIE(a7~+CwDUP51H*M@
z1_ni_Ss-dlW5XsE<ctC}LO(A*FBQthVw`Os_r};l28P79j0~VXh#;dtcuV85Em(~!
zD>gDPG{9}3rH7eqJ`)3j2P<S#Bgili-qPrz#){2-U;~YC8z{AM{|}IX?idDs(ZFq>
zF>V8||GVB($i%?lhGF0mZQKT$;x_P+Y53=>%nS@qInliwria@=bKC|BZgowrV`gA@
z$$@TQjuCDHEpZ!Ykt4ilDl-Fv2!;!_&2SoMgeOua&)a1E(v5-PU<)H!s%EspYG6fj
zehQvsD8b?*@5aEukjj8w7il%3n3tSbl%9_-@0!l7W!cQmz;IF-vb7kL_CR<`<0@<>
zfm`WVE47;ne<fnr85pLDqqhX7bz*T+avHYwOTlh7p+lk!47)?o%Wn0FSPTJ|kvOZ_
z;H@hgLxmU^B)!oCNo_e6!*UbzGSjd(Bqpyc47tq8z;IX?-EUiWVlk;Gu^da$5udtw
zI_RteF*XJU2~ZG2@s`HD`>_~OlAoJ{#gwN>tc%rH85pJrpvTv}Ls(2HOD!tS%*WQ~
zZqw-WD`aF~$YMqh9orMA2IVGZr{YUOJ*hcSeLM^dQO4+PfEOpRn3SBKn~T*&TdO74
zWpFbvtkOhx(Yk9`%t@_CO)kY=xz(3SZ#l)wz|d@j9!LR?u$TnuZ6+3EVhL@F`2hv-
z><kRc#nG$(;15^~N>9y8ElR}hCX)wNPi@T^7<N8GPug$4V=)SU(pGH~iMr3jz~HEX
z?yhuwHso3(860__6VZ}0uy?*(UNncdC@?T2HKDt!(FU7QMTyC&I6DuTli&3IWM^Qw
zCyn0Xc8bMiSV>}0dMefq04RgN+9;@XcV#LT(?H!^eCbrrQTMk8GXsMlMm4bur*Q>E
zsX6(HDSF^=MDNDir*_-=F)=VKWk>g|b0(_$AfpjQ#rT}(v^I@Hj+22w#Q;6gp3lZ%
zT4Hf7mP9LOHf7pRK?Vke7W5XPS}6{LlCc=Gw(I`Z999N~STP0$&^ZsF*Z|=zjbZJ$
zjEPSx%>y^3;}c6tiZYW*OH#2l@+>EuUU$`$f#KjA^hOzPFD|2DL5Rhr?@|l$*UB?6
zyx)f&a*Bs>8CQU<=c;p>t^PJE14FnFdP&Cq7?(lV{1^Q?d1r$*1B2^I^pZ^KB`$MH
zQxdUw&ChDn!E6==hHxGRw5IhH5q6Y}4htXs<jRr^tmUh@`po2&atsU~+tJfSwImL+
zQm{CQ<3{kKZ)OY(yJgT@`_UG-j7cp?O~y8CbIEi?;yh6XhK*I|g->rj4ztqoi%N<T
zvDIiFs+RO@U}a#i=0^|pj8+_mWhItj3-z0wW=$om3=C>w=q3eq<1i^dDGOUBIv_c7
z6=(>eR}?+|7$)K|32W+%in$XvO^AUZ-xl3fTc_bLtEd#~z(|Ylk@M_a3=9%-=+#H-
zN*pE?muIG7i@}ODPe0diGB8Y0Mt9Wl%{YuIOU%I*=%BI%R@$qBI8eN$v34&GlX5dF
zGV|~jsw<@e?J`&x7%I6K7*wDJf~YNxM+g|2SWu9IZCL&H0ln*q><kRv5)5cf`Mg8;
zotapKt+d`Mm*>O+>d*6{cV75U;WsZixu^n5{@maBrYeVzfk8tL-OC~82^g4@h;>rs
z-uA!cPWB88zTeSJWV%Pl#LR4Lf!LVD@>q$LfkBXufdMtH+hjSg7i-YC1`X^drxsyL
zinR;=<v(X-U;xb!sDdIHinlbrRl;v*YEDv7DYk;V?s)h$Q8osKUOol}O{j4oYD=TI
zCIKUJi<65o3rbS4l~f0Nq<lrB85qJM(bG_|K7M1<^GdNqxm2x>`FnN-hPM*v5p>)O
zzj>f$Cbn+IUd!Z7g{%w=Uj@)3=tmF%6N_^)^Rlsa5i@caZ%T7AFr+G>hvvEn{D$VH
zmK5cerxs;ni==m#pEvfgFfcIjpogYF5`JR~(y=xA-xS|9d&J7XU?_+_#d<Fdzj-Bz
z#o5^BCEf2|KeUjQfx%q>y~V?lOTbKQPE6`y$m*3~VE7%tz@QCEkWjp(@ktSW<H|CN
zOA~X7OG;BRu}whq8{aQ|$il!-jZqry>c($yMY5q8mZa&GbtKr6hk+qm0lj#;GXcfG
zl+=RMyp+_u<jhpOCHfMTcX4NA7#Ko|(VGlub8#D(lvs?d96G#iU5+cLteAt|g3sTD
z$FThTVr&J_9af2NtO^VaugcL)`*a_-Y2dB}mXMSG9eyZ<g@K`n2R-CW890&4NR*IE
z&QB~VO02||PkwZCot)0ez`!fVzyR_yG|ez<X}raP&p^=BFsKKK#f{NZdL=IlFfg37
zK#z<qe0Yq+-qyX?yhnN}4+Fzf74$rEL>{+cDY)8}c@MVEmr`M15bs29dd<+mXIvQ;
zf3_U-(-V?lVAvCmZq~a1JZ6<*TjgMI`R4~_4hDu?N%Z2%CKI<=X^F`t`9+mj+_tx?
z>2(We#e^t&;a^{f$GoD%+|=^?qHHWC#>H5zy2io4z$lF#tFD!}P0UD1GsR-q_EkGf
zw8R-0*5#lZ7SV*;u-wezWGsehvVDFp$i=|Wql_L8`)A@Y4C~lVShR(=p9}*-d@g#p
z@hrh@RzY?;&czbHGj2%yVPaqiU`Nlfa}MA!F(<JEG_Q@tyE#>!a!le342OcybHvTV
zcnrkV0aTQW=noQMV2JfWZ}v;w#%)|7wxVvQuXKGcI|IWKj6}EmJ#M3llM{0i3lfvD
zCAz+Fr%&;G3=F#Z=#DG<j@!giY_;P;_as|sW(I~sJm|Hf02>$1k`p|9<m{W6o$8ZW
z3^}Ya0Bt#$wa1!k2iO@H<Rusw^kKy(c$Tt+lW2o|e8PM|XH%jZp1{y$(Z$HX(8I#O
zpoe03qaZPc2PBqcc;=<$V>26M9IS7p0pdXMmd0>l0%pg@gH}w$$74yJ@wzkC9cN@<
z_`!l+lFdgo71YXvPKV<g0ekN(`sRrY1H;pG=;kdGMR6svd7utKW)9Z&W~j=sudf9e
z7z}*SN3c#A;WQ6kn^vYJ=H!6ph_KbA;g%Qqr_N_!s6EewR+lok;xrn`*;qoe{q+2<
znJNqndV3hq)+*k3LX465Nw^kLJkOUn-oeAbu+bE~U9y{#8#zB9IZ!{lJh3Ppo7Y?Q
z{x|OsWMD9fKriJQ#c-MiUf+mg`Hx0I?5y?j3=9@^=zWbU4V(s+R2HPhCugK4<7jZJ
zZ1cS+$jHC|T11CBdYR{e)6jyV%-qb9%rg8f(BFDXo~>bFU~uJUV9<hQBoMWw@suYq
zMuQt@SQ0?nv3)n^FflNMu%Rb_eSXB4o0OlQlZtg@%rnxv#h#ggVG}2M$7@L-F(#*E
zVjaCRzY~A!G&2Lk9d2|7YlRYHEGW69W6ik--)cKQVq{>DU_lRJ`$%F;E=tTx$JX9&
z`El%XJqH6roHBaNkQq&kxy2<#*!y?h4{h!;GBYqN;Y9B<8m8bf7}O`hR~)*(t$ekM
zk%2*z1wCJsrQ<iVG%q7RCk1QBnjH7m^XFk;@Y6(33Z<EN4F$OtcM;QFHJ4$oA_Ifv
z6b1&=3WmE3udykq$@$<ZGi*i8s%d$FOBop$t}vsA>bvRqP0cJ$Ou}9%l$RtqpJZTQ
zSjUL&((5zvnweUWoLT^0v5h6~ws?7%9tFie7kc07*(|)KW~Am6q!wZGyw)p)t|WN|
z2B{A8+Uwmsyhehu6|}YmMH&{@Ch(v2w_{{r&|*Rl*V+5<8l7K&bAHn@(bDl20|P@o
zBYM+Z_5g~Rkl`V`ef&1jm6Bpi3=9vM(dS`|4`MY7hd+<1r+IMmFfat@q7P0t9>!`8
z&dy|-Ls@3JJ_E!5ALy;qW9PA&1ob7Bz)$YGynQbZ1A~JmdO&6TM=>flKczGWe^qp>
zu$!qwn}LDt4*HZ%A`cI8%?>vUYis`U75A^cA`A@kywNAncr36QgKNyfI$+g-T7Cuw
z2~YHho8*JtAnZc{Z4C>5RIxHJ^kA%VaF4-iP702pYxXvUw2Ax-4BO4oQ~Iw&tOli4
zl%y8rCFaCK7p7u~z<p)>4&Qkh7y_-(7jm30#A;?5w(M=vxV80NC<DX%RgB;>{Xs1V
z5Z==Gryi>*>3R9N*y^;pMxAPP5e5d=AoN78d=0BX8TlnC`Ph2b=b5&?7Z71!@Qy%_
zy_Q#4P0BR1z&5-cRg>8_n}vaaSpYqSpZSN~oaEHvl6<VwBatftdV^UR7}g1*yJ;~q
zFSZnpV@glgBc3UWnSsHI13i@VII)_OomyFzh;3+GVxe934p2Xh8NDbt#DmqO-24<A
z3zWA-Zd?(i!oc7-6MbxCD<4*)@Qps?{Yq?~BF(_SnTGB|A7ku>;Tk76b0tjRKWNgK
z7u|<a{&-9>#*$a0=Pa*MWMp7qVnQ#VLPD?_Rajzz#h6cZ6MC>4vnCXWG1$hUq$Zcy
zX)rP{aAUZJB^-w_*v7Q^PA5J}m0)0~4@OUu$q`tM!7&YMRbjXK6llVVAKe^=LagQ#
zXXav?k>4ixV9qs81_o^%^kl?Tj@_L6(xT+l;#6!SI|jy%YwXz>7zD)7BVV);t6}Ad
zl{txd*xaRdOnS>IZU%;3D(FV_cVIUvGcP5-99wC*^unr*R~Q%=^f6i&B~wt0DhAKG
z;cZ>0xWAl`%gn%#&VfFv)-n~VS;?Tv1vEs5b?b@1VpWw3%nS@iIMGAjU?y(kN-|Th
z4d(vtxVc!0iGkq_GkRCub}kOXQWNt^ic+zzvyt@>dK1aQ!0?zGy-1ikABSm~1qImL
z^^A49`3e>Wh66n4gQXfvu$u&0cott&nirp3l8!B%&Cm7L^k8IQ_{WIuQ=yeOOiYQ-
zFN!ZH)+;E+*pAu4vEE0Xk%3_eBYIYvu?o9s`B?pFKWpow1WpD9H!bw4>-}mR=9Hxt
zC1UMtp8dS&L>nUm!we?$fs*d6Sj|dF%_+|;$tW&OOUuMIv;Stfcaa%814F(bx`9F4
zaTr*Tn4DaiTbh$tg01Nww@v;)jW7d)sW-ZBPwvBIU|MDc){bSB^1ozmP6mcDMfA+x
zcnOzT#mQKQE7ow&U1ZM4z;F{IX&k?e-Kfl><P1=kAKOj`^MiY)$q6zr$h)BDPn)|~
zO-s!yGs*?63B^(o$+zsxy3WGD;LeBM&zt@ZyJ67wB<|*<%I+omnpqeaYB6ftji0d^
znVwowl3IZ+PgS|(<-g-*V5rtcA3)9jf!(N*?3DauNFNl7Z@o9CZ-2+gzz~ixz&n?P
z54rILD|I1FOPuD_UF^`C!_2^7#)Y0nPP1V(FSDc=$IPQ~$Io_UHU<WJ0rXg1#D&!;
z@CamlY6Z4@;QGE|*=j}xhLz0d;l?D0-LT^HwA>P${+xdITeb`{1A{1Nt^m}ihvF@b
zZ-ua$S5OHZ#>Nr}MHW?i=CVPSBcQH=brZv37-#`tJm~5?EXEmpNnAFWnSmh>V->8D
zELP)+QqxoOAVaNKGyYfW4^d^T3=9<*G4V|Shk*q}`8Zm{vCBSub!BH@_$7v3BCS-z
zZdhqvJdPx?{=Z+wEmj7Gg#zfQO-m1lS;aVdMoeqJJ_%-KV9?+|Pi^)lSd9XeY~Z~T
zSYkjc%Sq-kF9So25qcSN-W<DOmAOgzIjI#TMc_$bEJogsjh5ACVqgFjO{iNgpSof-
zvLq4f*nXajqsjvY28M9Zup>0lf~YNxJ|5W3Ni8mk2d$7!O^Jt&F<@~X8?*8ikn<+9
zpa);ECst!i^Wdi-VC=H(I5%&KA`=6{c?`qudt)`MEV;NOF&+Crvm<-tQ(Z;|h8T?f
zi?)7P4Xeby<{A`8un9KQt)`3oQOqex%`E`c#&}z(3wNxmmjZ3K;zMt3J;G&LazO#y
zXe=>c7agw|&CI}X3}Z)=T__IsB^To}(A;48NzlAsF)w<Nc`E{!f%wd;C{O;b!OFm(
zjZv`*#o;oqG$j$Ak*6JQU-4vNVA#ZsKK4_ajKfIqFcLm9j~KG*8n7@h+~h(ZJ?6^5
zVJ39JGCotMOL3p~W@cbe#uz<r$iZPMXqW?^kqmq<H>)u+Fo0%JK({l35-137Y2+)w
zVI;VQ#Al}bvX(botPBh<dC?~%DhhF!30fA7KV_cI*sb)Pg@Iu@FM4TsybO<__}n>b
z*8G~|%#gz~P!~Ee*5EJ_)I-N-WOnE+5gsN6hQ+MtuH<gOVPtV)Zb42e?sYpx?mzT&
zSs54_Wzlm`R1;n!Gjj{DjY~0lix#RdGcfGsKzHKtb{yt`R$}AxH7LQrN;S|OnIJw0
zZ)w!)MlrIqBr^wZi56+fvh5H%1H%?6^fA*cY$k!W;bSSqF3e{101dqrV(eK<nvBIg
zpn?|EZO39#h`n=_2@?ZDJuAkz)KqLH<rib^k*&&2`@|B@z@Qz)h_-Eg|8y+Il;&lE
zHsoO)R&?|`>AHxOf#Ehkx{LmO!(vofG4`WHV*5?=`I#6PK;w6)2ew@QgT<Kg%sgWw
zEaAh<I)CaEW(Ec^4)hrT+5afUloury;G4wEJo#FkN0)&iVGa7$$yZGL$Xy7qK_CK)
zYuqR7ZkWc&z%X4A-8I?<*bTwbBm|wFgnr*NC^3WZlEz<_P=he8)rH+Yjl5n5WET3R
zydZNxcuS+AEiSXbSM(wq1UmKz{UTkEAt1b^aT`v9Qqiu}MK|*p+FiLI^FVk@qq-d~
x$D!Pui)<jsx9Hd9f(!%UEsdo(4TM~t8{o~#22%Np;TOXcZw7{lEPe(C1^}U1h*|&u

literal 0
HcmV?d00001

diff --git a/pythondeps.toml b/pythondeps.toml
index d0f52b14f7..16fb2a989c 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -19,12 +19,12 @@
 
 [meson]
 # The install key should match the version in python/wheels/
-meson = { accepted = ">=1.5.0", installed = "1.8.1", canary = "meson" }
+meson = { accepted = ">=1.5.0", installed = "1.9.0", canary = "meson" }
 pycotap = { accepted = ">=1.1.0", installed = "1.3.1" }
 
 [meson-rust]
 # The install key should match the version in python/wheels/
-meson = { accepted = ">=1.8.1", installed = "1.8.1", canary = "meson" }
+meson = { accepted = ">=1.9.0", installed = "1.9.0", canary = "meson" }
 
 [docs]
 # Please keep the installed versions in sync with docs/requirements.txt

From e1c689c2189087bcab258f0a99019bb900986af7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:35 +0200
Subject: [PATCH 0469/2396] meson, cargo: require Rust 1.83.0

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-4-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 clippy.toml                    |  2 +-
 docs/about/build-platforms.rst | 15 ++++++++-------
 docs/devel/rust.rst            | 14 +++++---------
 meson.build                    |  6 +++---
 rust/Cargo.toml                |  2 +-
 5 files changed, 18 insertions(+), 21 deletions(-)

diff --git a/clippy.toml b/clippy.toml
index 9016172983..204f5713c0 100644
--- a/clippy.toml
+++ b/clippy.toml
@@ -1,3 +1,3 @@
 doc-valid-idents = ["IrDA", "PrimeCell", ".."]
 allow-mixed-uninlined-format-args = false
-msrv = "1.77.0"
+msrv = "1.83.0"
diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 8671c3be9c..0160d3adb8 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -118,14 +118,15 @@ Rust build dependencies
   include bindgen or have an older version, it is recommended to install
   a newer version using ``cargo install bindgen-cli``.
 
-  QEMU requires Rust 1.77.0.  This is available on all supported platforms
-  with one exception, namely the ``mips64el`` architecture on Debian bookworm.
-  For all other architectures, Debian bookworm provides a new-enough Rust
-  compiler in the ``rustc-web`` package.
+  QEMU requires Rust 1.83.0.  This is available on all supported platforms
+  with two exception: Ubuntu LTS releases 22.04 and 24.04, and the
+  ``mips64el`` architecture on Debian bookworm.  For all other
+  architectures, Debian bookworm provides a new-enough Rust compiler
+  in the ``rustc-web`` package.
 
-  Also, on Ubuntu 22.04 or 24.04 this requires the ``rustc-1.77``
-  (or newer) package.  The path to ``rustc`` and ``rustdoc`` must be
-  provided manually to the configure script.
+  It is expected that in the future Ubuntu will provide updated packages
+  like the existing ``rustc-1.82`` package.  The path to ``rustc`` and
+  ``rustdoc`` will have to be provided manually to the configure script.
 
   Some distros prefer to avoid vendored crate sources, and instead use
   local sources from e.g. ``/usr/share/cargo/registry``.  QEMU includes a
diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index b6737536c6..e0ee4a9837 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -75,21 +75,17 @@ Note that doctests require all ``.o`` files from the build to be available.
 Supported tools
 '''''''''''''''
 
-QEMU supports rustc version 1.77.0 and newer.  Notably, the following features
-are missing:
+QEMU supports rustc version 1.83.0 and newer.  The following features
+from relatively new versions of Rust are not used for historical reasons;
+patches are welcome:
 
 * inline const expression (stable in 1.79.0), currently worked around with
   associated constants in the ``FnCall`` trait.
 
-* associated constants have to be explicitly marked ``'static`` (`changed in
+* associated constants are still explicitly marked ``'static`` (`changed in
   1.81.0`__)
 
-* ``&raw`` (stable in 1.82.0).  Use ``addr_of!`` and ``addr_of_mut!`` instead,
-  though hopefully the need for raw pointers will go down over time.
-
-* ``new_uninit`` (stable in 1.82.0).  This is used internally by the ``pinned_init``
-  crate, which is planned for inclusion in QEMU, but it can be easily patched
-  out.
+* ``&raw`` (stable in 1.82.0).
 
 * referencing statics in constants (stable in 1.83.0).  For now use a const
   function; this is an important limitation for QEMU's migration stream
diff --git a/meson.build b/meson.build
index 3d73873356..a238df3f5e 100644
--- a/meson.build
+++ b/meson.build
@@ -94,12 +94,12 @@ have_rust = have_rust and add_languages('rust', native: true,
     required: get_option('rust').disable_auto_if(not have_system))
 if have_rust
   rustc = meson.get_compiler('rust')
-  if rustc.version().version_compare('<1.77.0')
+  if rustc.version().version_compare('<1.83.0')
     if get_option('rust').enabled()
-      error('rustc version ' + rustc.version() + ' is unsupported. Please upgrade to at least 1.77.0')
+      error('rustc version ' + rustc.version() + ' is unsupported. Please upgrade to at least 1.83.0')
     else
       warning('rustc version ' + rustc.version() + ' is unsupported, disabling Rust compilation.')
-      message('Please upgrade to at least 1.77.0 to use Rust.')
+      message('Please upgrade to at least 1.83.0 to use Rust.')
       have_rust = false
     endif
   endif
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 6f8884eb30..99c275f2d9 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -13,7 +13,7 @@ edition = "2021"
 homepage = "https://www.qemu.org"
 license = "GPL-2.0-or-later"
 repository = "https://gitlab.com/qemu-project/qemu/"
-rust-version = "1.77.0"
+rust-version = "1.83.0"
 
 [workspace.dependencies]
 anyhow = "~1.0"

From 71e84e5ae87b8e6adce3af7dd2a490c7b2f39772 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:36 +0200
Subject: [PATCH 0470/2396] rust: add missing const markers for MSRV==1.83.0

Rust 1.83 allows more functions to be marked const.
Fix clippy with bumped minimum supported Rust version.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-5-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/bits/src/lib.rs            | 6 +++---
 rust/qemu-api/src/assertions.rs | 4 ++--
 rust/qemu-api/src/cell.rs       | 6 ++----
 rust/qemu-api/src/qom.rs        | 6 +++---
 rust/qemu-api/src/timer.rs      | 2 +-
 rust/qemu-api/src/uninit.rs     | 6 +++---
 6 files changed, 14 insertions(+), 16 deletions(-)

diff --git a/rust/bits/src/lib.rs b/rust/bits/src/lib.rs
index d485d6bd11..e9d15ad0cb 100644
--- a/rust/bits/src/lib.rs
+++ b/rust/bits/src/lib.rs
@@ -165,19 +165,19 @@ macro_rules! bits {
 
             #[allow(dead_code)]
             #[inline(always)]
-            pub fn set(&mut self, rhs: Self) {
+            pub const fn set(&mut self, rhs: Self) {
                 self.0 |= rhs.0;
             }
 
             #[allow(dead_code)]
             #[inline(always)]
-            pub fn clear(&mut self, rhs: Self) {
+            pub const fn clear(&mut self, rhs: Self) {
                 self.0 &= !rhs.0;
             }
 
             #[allow(dead_code)]
             #[inline(always)]
-            pub fn toggle(&mut self, rhs: Self) {
+            pub const fn toggle(&mut self, rhs: Self) {
                 self.0 ^= rhs.0;
             }
 
diff --git a/rust/qemu-api/src/assertions.rs b/rust/qemu-api/src/assertions.rs
index a2d38c877d..e74fa3ef82 100644
--- a/rust/qemu-api/src/assertions.rs
+++ b/rust/qemu-api/src/assertions.rs
@@ -81,8 +81,8 @@ macro_rules! assert_field_type {
     (@internal $param_name:ident, $ti:ty, $t:ty, $($field:tt)*) => {
         const _: () = {
             #[allow(unused)]
-            fn assert_field_type($param_name: &$t) {
-                fn types_must_be_equal<T, U>(_: &T)
+            const fn assert_field_type($param_name: &$t) {
+                const fn types_must_be_equal<T, U>(_: &T)
                 where
                     T: $crate::assertions::EqType<Itself = U>,
                 {
diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index 27063b049d..148a13e3f5 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -980,8 +980,7 @@ impl<T> Opaque<T> {
     /// but the functions containing the dereference are usually safe.  The
     /// value returned from `uninit()` must be initialized and pinned before
     /// calling them.
-    #[allow(clippy::missing_const_for_fn)]
-    pub unsafe fn uninit() -> Self {
+    pub const unsafe fn uninit() -> Self {
         Self {
             value: UnsafeCell::new(MaybeUninit::uninit()),
             _pin: PhantomPinned,
@@ -997,8 +996,7 @@ impl<T> Opaque<T> {
     /// but the functions containing the dereference are usually safe.  The
     /// value returned from `uninit()` must be pinned (and possibly initialized)
     /// before calling them.
-    #[allow(clippy::missing_const_for_fn)]
-    pub unsafe fn zeroed() -> Self {
+    pub const unsafe fn zeroed() -> Self {
         Self {
             value: UnsafeCell::new(MaybeUninit::zeroed()),
             _pin: PhantomPinned,
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index e20ee014cb..014ffb1fd8 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -307,7 +307,7 @@ impl<T: ObjectType> ParentInit<'_, T> {
     /// Fields beyond `Object` could be uninitialized and it's your
     /// responsibility to avoid that they're used when the pointer is
     /// dereferenced, either directly or through a cast.
-    pub fn as_object_mut_ptr(&self) -> *mut bindings::Object {
+    pub const fn as_object_mut_ptr(&self) -> *mut bindings::Object {
         self.as_object_ptr().cast_mut()
     }
 
@@ -318,7 +318,7 @@ impl<T: ObjectType> ParentInit<'_, T> {
     /// Fields beyond `Object` could be uninitialized and it's your
     /// responsibility to avoid that they're used when the pointer is
     /// dereferenced, either directly or through a cast.
-    pub fn as_object_ptr(&self) -> *const bindings::Object {
+    pub const fn as_object_ptr(&self) -> *const bindings::Object {
         self.0.as_ptr().cast()
     }
 }
@@ -336,7 +336,7 @@ impl<'a, T: ObjectImpl> ParentInit<'a, T> {
     /// However, while the fields of the resulting reference are initialized,
     /// calls might use uninitialized fields of the subclass.  It is your
     /// responsibility to avoid this.
-    pub unsafe fn upcast<U: ObjectType>(&self) -> &'a U
+    pub const unsafe fn upcast<U: ObjectType>(&self) -> &'a U
     where
         T::ParentType: IsA<U>,
     {
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index 0a2d111d49..0daec62f92 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -39,7 +39,7 @@ impl Timer {
     ///
     /// The timer must be initialized before it is armed with
     /// [`modify`](Self::modify).
-    pub unsafe fn new() -> Self {
+    pub const unsafe fn new() -> Self {
         // SAFETY: requirements relayed to callers of Timer::new
         Self(unsafe { Opaque::zeroed() })
     }
diff --git a/rust/qemu-api/src/uninit.rs b/rust/qemu-api/src/uninit.rs
index 04123b4ae9..b0a829729d 100644
--- a/rust/qemu-api/src/uninit.rs
+++ b/rust/qemu-api/src/uninit.rs
@@ -12,7 +12,7 @@ pub struct MaybeUninitField<'a, T, U> {
 
 impl<'a, T, U> MaybeUninitField<'a, T, U> {
     #[doc(hidden)]
-    pub fn new(parent: &'a mut MaybeUninit<T>, child: *mut U) -> Self {
+    pub const fn new(parent: &'a mut MaybeUninit<T>, child: *mut U) -> Self {
         MaybeUninitField { parent, child }
     }
 
@@ -21,7 +21,7 @@ impl<'a, T, U> MaybeUninitField<'a, T, U> {
     /// Because the `MaybeUninitField` remembers the containing object,
     /// it is possible to use it in foreign APIs that initialize the
     /// child.
-    pub fn parent(f: &Self) -> *const T {
+    pub const fn parent(f: &Self) -> *const T {
         f.parent.as_ptr()
     }
 
@@ -30,7 +30,7 @@ impl<'a, T, U> MaybeUninitField<'a, T, U> {
     /// Because the `MaybeUninitField` remembers the containing object,
     /// it is possible to use it in foreign APIs that initialize the
     /// child.
-    pub fn parent_mut(f: &mut Self) -> *mut T {
+    pub const fn parent_mut(f: &mut Self) -> *mut T {
         f.parent.as_mut_ptr()
     }
 }

From aecca0676ddd9e032de4eeda371b81598d3257bb Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:37 +0200
Subject: [PATCH 0471/2396] rust: use inline const expressions

They were stabilized in Rust 1.79.0.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-6-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst            |  9 +++------
 rust/qemu-api/src/callbacks.rs | 27 +--------------------------
 rust/qemu-api/src/chardev.rs   |  2 +-
 rust/qemu-api/src/qdev.rs      |  2 +-
 rust/qemu-api/src/timer.rs     |  2 +-
 rust/qemu-api/src/vmstate.rs   |  2 +-
 6 files changed, 8 insertions(+), 36 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index e0ee4a9837..98e3a33a3c 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -79,9 +79,6 @@ QEMU supports rustc version 1.83.0 and newer.  The following features
 from relatively new versions of Rust are not used for historical reasons;
 patches are welcome:
 
-* inline const expression (stable in 1.79.0), currently worked around with
-  associated constants in the ``FnCall`` trait.
-
 * associated constants are still explicitly marked ``'static`` (`changed in
   1.81.0`__)
 
@@ -97,9 +94,9 @@ patches are welcome:
   before QEMU can use them.  For now, there is special code in
   ``util/error.c`` to support non-NUL-terminated file names.
 
-* associated const equality would be nice to have for some users of
-  ``callbacks::FnCall``, but is still experimental.  ``ASSERT_IS_SOME``
-  replaces it.
+Associated const equality would be nice to have for some users of
+``callbacks::FnCall``, but is still experimental.  Const assertions
+are used instead.
 
 __ https://github.com/rust-lang/rust/pull/125258
 
diff --git a/rust/qemu-api/src/callbacks.rs b/rust/qemu-api/src/callbacks.rs
index 9642a16eb8..dbe2305f50 100644
--- a/rust/qemu-api/src/callbacks.rs
+++ b/rust/qemu-api/src/callbacks.rs
@@ -113,31 +113,6 @@ use std::{mem, ptr::NonNull};
 /// This is always true for zero-capture closures and function pointers, as long
 /// as the code is able to name the function in the first place.
 pub unsafe trait FnCall<Args, R = ()>: 'static + Sync + Sized {
-    /// Referring to this internal constant asserts that the `Self` type is
-    /// zero-sized.  Can be replaced by an inline const expression in
-    /// Rust 1.79.0+.
-    const ASSERT_ZERO_SIZED: () = { assert!(mem::size_of::<Self>() == 0) };
-
-    /// Referring to this constant asserts that the `Self` type is an actual
-    /// function type, which can be used to catch incorrect use of `()`
-    /// at compile time.
-    ///
-    /// # Examples
-    ///
-    /// ```compile_fail
-    /// # use qemu_api::callbacks::FnCall;
-    /// fn call_it<F: for<'a> FnCall<(&'a str,), String>>(_f: &F, s: &str) -> String {
-    ///     let _: () = F::ASSERT_IS_SOME;
-    ///     F::call((s,))
-    /// }
-    ///
-    /// let s: String = call_it((), "hello world"); // does not compile
-    /// ```
-    ///
-    /// Note that this can be more simply `const { assert!(F::IS_SOME) }` in
-    /// Rust 1.79.0 or newer.
-    const ASSERT_IS_SOME: () = { assert!(Self::IS_SOME) };
-
     /// `true` if `Self` is an actual function type and not `()`.
     ///
     /// # Examples
@@ -195,7 +170,7 @@ macro_rules! impl_call {
 
             #[inline(always)]
             fn call(a: ($($args,)*)) -> R {
-                let _: () = Self::ASSERT_ZERO_SIZED;
+                const { assert!(mem::size_of::<Self>() == 0) };
 
                 // SAFETY: the safety of this method is the condition for implementing
                 // `FnCall`.  As to the `NonNull` idiom to create a zero-sized type,
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index 6e0590d758..cb27be5256 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -138,7 +138,7 @@ impl CharBackend {
             F::call((owner, event))
         }
 
-        let _: () = CanReceiveFn::ASSERT_IS_SOME;
+        const { assert!(CanReceiveFn::IS_SOME) };
         let receive_cb: Option<unsafe extern "C" fn(*mut c_void, *const u8, c_int)> =
             if ReceiveFn::is_some() {
                 Some(rust_receive_cb::<T, ReceiveFn>)
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 36f02fb57d..52d54a4494 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -373,7 +373,7 @@ where
             }
         }
 
-        let _: () = F::ASSERT_IS_SOME;
+        const { assert!(F::IS_SOME) };
         unsafe extern "C" fn rust_irq_handler<T, F: for<'a> FnCall<(&'a T, u32, u32)>>(
             opaque: *mut c_void,
             line: c_int,
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index 0daec62f92..1e639eaf22 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -56,7 +56,7 @@ impl Timer {
     ) where
         F: for<'a> FnCall<(&'a T,)>,
     {
-        let _: () = F::ASSERT_IS_SOME;
+        const { assert!(F::IS_SOME) };
 
         /// timer expiration callback
         unsafe extern "C" fn rust_timer_handler<T, F: for<'a> FnCall<(&'a T,)>>(
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 812f390d78..8515e38213 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -457,7 +457,7 @@ macro_rules! vmstate_exist_fn {
         const fn test_cb_builder__<T, F: for<'a> $crate::callbacks::FnCall<(&'a T, u8), bool>>(
             _phantom: ::core::marker::PhantomData<F>,
         ) -> $crate::vmstate::VMSFieldExistCb {
-            let _: () = F::ASSERT_IS_SOME;
+            const { assert!(F::IS_SOME) };
             $crate::vmstate::rust_vms_test_field_exists::<T, F>
         }
 

From a71df7e143b57427c1f8a917654e7b0ed1ceb919 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Mon, 8 Sep 2025 12:49:38 +0200
Subject: [PATCH 0472/2396] rust: add qdev Device derive macro

Add derive macro for declaring qdev properties directly above the field
definitions. To do this, we split DeviceImpl::properties method on a
separate trait so we can implement only that part in the derive macro
expansion (we cannot partially implement the DeviceImpl trait).

Adding a `property` attribute above the field declaration will generate
a `qemu_api::bindings::Property` array member in the device's property
list.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Link: https://lore.kernel.org/r/20250711-rust-qdev-properties-v3-1-e198624416fb@linaro.org
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs  |  31 +-----
 rust/hw/timer/hpet/src/device.rs  |   6 +-
 rust/qemu-api-macros/src/lib.rs   | 152 +++++++++++++++++++++++++++++-
 rust/qemu-api-macros/src/tests.rs | 111 ++++++++++++++++++++++
 rust/qemu-api/src/qdev.rs         |  70 ++++++++++++--
 rust/qemu-api/tests/tests.rs      |  24 +----
 6 files changed, 336 insertions(+), 58 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index ceb71dd99b..3794463520 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -9,7 +9,6 @@ use std::{
 };
 
 use qemu_api::{
-    bindings::{qdev_prop_bool, qdev_prop_chr},
     chardev::{CharBackend, Chardev, Event},
     impl_vmstate_forward,
     irq::{IRQState, InterruptSource},
@@ -17,7 +16,7 @@ use qemu_api::{
     log_mask_ln,
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
-    qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
+    qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
     qom::{ObjectImpl, Owned, ParentField, ParentInit},
     static_assert,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
@@ -105,12 +104,13 @@ pub struct PL011Registers {
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object)]
+#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
 /// PL011 Device Model in QEMU
 pub struct PL011State {
     pub parent_obj: ParentField<SysBusDevice>,
     pub iomem: MemoryRegion,
     #[doc(alias = "chr")]
+    #[property(rename = "chardev")]
     pub char_backend: CharBackend,
     pub regs: BqlRefCell<PL011Registers>,
     /// QEMU interrupts
@@ -129,6 +129,7 @@ pub struct PL011State {
     #[doc(alias = "clk")]
     pub clock: Owned<Clock>,
     #[doc(alias = "migrate_clk")]
+    #[property(rename = "migrate-clk", default = true)]
     pub migrate_clock: bool,
 }
 
@@ -176,9 +177,6 @@ impl ObjectImpl for PL011State {
 }
 
 impl DeviceImpl for PL011State {
-    fn properties() -> &'static [Property] {
-        &PL011_PROPERTIES
-    }
     fn vmsd() -> Option<&'static VMStateDescription> {
         Some(&VMSTATE_PL011)
     }
@@ -690,7 +688,7 @@ pub unsafe extern "C" fn pl011_create(
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object)]
+#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
 /// PL011 Luminary device model.
 pub struct PL011Luminary {
     parent_obj: ParentField<PL011State>,
@@ -782,22 +780,3 @@ pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
     },
     ..Zeroable::ZERO
 };
-
-qemu_api::declare_properties! {
-    PL011_PROPERTIES,
-    qemu_api::define_property!(
-        c"chardev",
-        PL011State,
-        char_backend,
-        unsafe { &qdev_prop_chr },
-        CharBackend
-    ),
-    qemu_api::define_property!(
-        c"migrate-clk",
-        PL011State,
-        migrate_clock,
-        unsafe { &qdev_prop_bool },
-        bool,
-        default = true
-    ),
-}
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index acf7251029..01d5a0dd70 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -1031,11 +1031,15 @@ static VMSTATE_HPET: VMStateDescription = VMStateDescription {
     ..Zeroable::ZERO
 };
 
-impl DeviceImpl for HPETState {
+// SAFETY: HPET_PROPERTIES is a valid Property array constructed with the
+// qemu_api::declare_properties macro.
+unsafe impl qemu_api::qdev::DevicePropertiesImpl for HPETState {
     fn properties() -> &'static [Property] {
         &HPET_PROPERTIES
     }
+}
 
+impl DeviceImpl for HPETState {
     fn vmsd() -> Option<&'static VMStateDescription> {
         Some(&VMSTATE_HPET)
     }
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 959726efe6..97b2c214b6 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -3,10 +3,11 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use proc_macro::TokenStream;
-use quote::quote;
+use quote::{quote, quote_spanned, ToTokens};
 use syn::{
-    parse_macro_input, parse_quote, punctuated::Punctuated, spanned::Spanned, token::Comma, Data,
-    DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token, Variant,
+    parse::Parse, parse_macro_input, parse_quote, punctuated::Punctuated, spanned::Spanned,
+    token::Comma, Data, DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token,
+    Variant,
 };
 mod bits;
 use bits::BitsConstInternal;
@@ -152,6 +153,151 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
     })
 }
 
+#[derive(Debug)]
+enum DevicePropertyName {
+    CStr(syn::LitCStr),
+    Str(syn::LitStr),
+}
+
+#[derive(Debug)]
+struct DeviceProperty {
+    rename: Option<DevicePropertyName>,
+    defval: Option<syn::Expr>,
+}
+
+impl Parse for DeviceProperty {
+    fn parse(input: syn::parse::ParseStream) -> syn::Result<Self> {
+        let _: syn::Token![#] = input.parse()?;
+        let bracketed;
+        _ = syn::bracketed!(bracketed in input);
+        let attribute = bracketed.parse::<syn::Ident>()?;
+        debug_assert_eq!(&attribute.to_string(), "property");
+        let mut retval = Self {
+            rename: None,
+            defval: None,
+        };
+        let content;
+        _ = syn::parenthesized!(content in bracketed);
+        while !content.is_empty() {
+            let value: syn::Ident = content.parse()?;
+            if value == "rename" {
+                let _: syn::Token![=] = content.parse()?;
+                if retval.rename.is_some() {
+                    return Err(syn::Error::new(
+                        value.span(),
+                        "`rename` can only be used at most once",
+                    ));
+                }
+                if content.peek(syn::LitStr) {
+                    retval.rename = Some(DevicePropertyName::Str(content.parse::<syn::LitStr>()?));
+                } else {
+                    retval.rename =
+                        Some(DevicePropertyName::CStr(content.parse::<syn::LitCStr>()?));
+                }
+            } else if value == "default" {
+                let _: syn::Token![=] = content.parse()?;
+                if retval.defval.is_some() {
+                    return Err(syn::Error::new(
+                        value.span(),
+                        "`default` can only be used at most once",
+                    ));
+                }
+                retval.defval = Some(content.parse()?);
+            } else {
+                return Err(syn::Error::new(
+                    value.span(),
+                    format!("unrecognized field `{value}`"),
+                ));
+            }
+
+            if !content.is_empty() {
+                let _: syn::Token![,] = content.parse()?;
+            }
+        }
+        Ok(retval)
+    }
+}
+
+#[proc_macro_derive(Device, attributes(property))]
+pub fn derive_device(input: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(input as DeriveInput);
+
+    derive_device_or_error(input)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
+}
+
+fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream, Error> {
+    is_c_repr(&input, "#[derive(Device)]")?;
+    let properties: Vec<(syn::Field, DeviceProperty)> = get_fields(&input, "#[derive(Device)]")?
+        .iter()
+        .flat_map(|f| {
+            f.attrs
+                .iter()
+                .filter(|a| a.path().is_ident("property"))
+                .map(|a| Ok((f.clone(), syn::parse2(a.to_token_stream())?)))
+        })
+        .collect::<Result<Vec<_>, Error>>()?;
+    let name = &input.ident;
+    let mut properties_expanded = vec![];
+
+    for (field, prop) in properties {
+        let DeviceProperty { rename, defval } = prop;
+        let field_name = field.ident.unwrap();
+        macro_rules! str_to_c_str {
+            ($value:expr, $span:expr) => {{
+                let (value, span) = ($value, $span);
+                let cstr = std::ffi::CString::new(value.as_str()).map_err(|err| {
+                    Error::new(
+                        span,
+                        format!(
+                            "Property name `{value}` cannot be represented as a C string: {err}"
+                        ),
+                    )
+                })?;
+                let cstr_lit = syn::LitCStr::new(&cstr, span);
+                Ok(quote! { #cstr_lit })
+            }};
+        }
+
+        let prop_name = rename.map_or_else(
+            || str_to_c_str!(field_name.to_string(), field_name.span()),
+            |rename| -> Result<proc_macro2::TokenStream, Error> {
+                match rename {
+                    DevicePropertyName::CStr(cstr_lit) => Ok(quote! { #cstr_lit }),
+                    DevicePropertyName::Str(str_lit) => {
+                        str_to_c_str!(str_lit.value(), str_lit.span())
+                    }
+                }
+            },
+        )?;
+        let field_ty = field.ty.clone();
+        let qdev_prop = quote! { <#field_ty as ::qemu_api::qdev::QDevProp>::VALUE };
+        let set_default = defval.is_some();
+        let defval = defval.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
+        properties_expanded.push(quote! {
+            ::qemu_api::bindings::Property {
+                name: ::std::ffi::CStr::as_ptr(#prop_name),
+                info: #qdev_prop ,
+                offset: ::core::mem::offset_of!(#name, #field_name) as isize,
+                set_default: #set_default,
+                defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
+                ..::qemu_api::zeroable::Zeroable::ZERO
+            }
+        });
+    }
+
+    Ok(quote_spanned! {input.span() =>
+        unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for #name {
+            fn properties() -> &'static [::qemu_api::bindings::Property] {
+                static PROPERTIES: &[::qemu_api::bindings::Property] = &[#(#properties_expanded),*];
+
+                PROPERTIES
+            }
+        }
+    })
+}
+
 #[proc_macro_derive(Wrapper)]
 pub fn derive_opaque(input: TokenStream) -> TokenStream {
     let input = parse_macro_input!(input as DeriveInput);
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index 6028cdbc4c..aafffcdce9 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -36,6 +36,117 @@ macro_rules! derive_compile {
     }};
 }
 
+#[test]
+fn test_derive_device() {
+    // Check that repr(C) is used
+    derive_compile_fail!(
+        derive_device_or_error,
+        quote! {
+            #[derive(Device)]
+            struct Foo {
+                _unused: [u8; 0],
+            }
+        },
+        "#[repr(C)] required for #[derive(Device)]"
+    );
+    // Check that invalid/misspelled attributes raise an error
+    derive_compile_fail!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            struct DummyState {
+                #[property(defalt = true)]
+                migrate_clock: bool,
+            }
+        },
+        "unrecognized field `defalt`"
+    );
+    // Check that repeated attributes are not allowed:
+    derive_compile_fail!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            struct DummyState {
+                #[property(rename = "migrate-clk", rename = "migrate-clk", default = true)]
+                migrate_clock: bool,
+            }
+        },
+        "`rename` can only be used at most once"
+    );
+    derive_compile_fail!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            struct DummyState {
+                #[property(default = true, default = true)]
+                migrate_clock: bool,
+            }
+        },
+        "`default` can only be used at most once"
+    );
+    // Check that the field name is preserved when `rename` isn't used:
+    derive_compile!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            pub struct DummyState {
+                parent: ParentField<DeviceState>,
+                #[property(default = true)]
+                migrate_clock: bool,
+            }
+        },
+        quote! {
+            unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
+                fn properties() -> &'static [::qemu_api::bindings::Property] {
+                    static PROPERTIES: &[::qemu_api::bindings::Property] =
+                        &[::qemu_api::bindings::Property {
+                            name: ::std::ffi::CStr::as_ptr(c"migrate_clock"),
+                            info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                            offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                            set_default: true,
+                            defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                            ..::qemu_api::zeroable::Zeroable::ZERO
+                        }];
+                    PROPERTIES
+                }
+            }
+        }
+    );
+    // Check that `rename` value is used for the property name when used:
+    derive_compile!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            pub struct DummyState {
+                parent: ParentField<DeviceState>,
+                #[property(rename = "migrate-clk", default = true)]
+                migrate_clock: bool,
+            }
+        },
+        quote! {
+            unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
+                fn properties() -> &'static [::qemu_api::bindings::Property] {
+                    static PROPERTIES: &[::qemu_api::bindings::Property] =
+                        &[::qemu_api::bindings::Property {
+                            name: ::std::ffi::CStr::as_ptr(c"migrate-clk"),
+                            info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                            offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                            set_default: true,
+                            defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                            ..::qemu_api::zeroable::Zeroable::ZERO
+                        }];
+                    PROPERTIES
+                }
+            }
+        }
+    );
+}
+
 #[test]
 fn test_derive_object() {
     derive_compile_fail!(
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 52d54a4494..6a58a00e3f 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -101,8 +101,67 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
     T::EXIT.unwrap()(unsafe { state.as_ref() }, typ);
 }
 
+/// Helper trait to return pointer to a [`bindings::PropertyInfo`] for a type.
+///
+/// This trait is used by [`qemu_api_macros::Device`] derive macro.
+///
+/// Base types that already have `qdev_prop_*` globals in the QEMU API should
+/// use those values as exported by the [`bindings`] module, instead of
+/// redefining them.
+///
+/// # Safety
+///
+/// This trait is marked as `unsafe` because currently having a `const` refer to
+/// an `extern static` as a reference instead of a raw pointer results in this
+/// compiler error:
+///
+/// ```text
+/// constructing invalid value: encountered reference to `extern` static in `const`
+/// ```
+///
+/// This is because the compiler generally might dereference a normal reference
+/// during const evaluation, but not in this case (if it did, it'd need to
+/// dereference the raw pointer so this would fail to compile).
+///
+/// It is the implementer's responsibility to provide a valid
+/// [`bindings::PropertyInfo`] pointer for the trait implementation to be safe.
+pub unsafe trait QDevProp {
+    const VALUE: *const bindings::PropertyInfo;
+}
+
+/// Use [`bindings::qdev_prop_bool`] for `bool`.
+unsafe impl QDevProp for bool {
+    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_bool };
+}
+
+/// Use [`bindings::qdev_prop_uint64`] for `u64`.
+unsafe impl QDevProp for u64 {
+    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_uint64 };
+}
+
+/// Use [`bindings::qdev_prop_chr`] for [`crate::chardev::CharBackend`].
+unsafe impl QDevProp for crate::chardev::CharBackend {
+    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_chr };
+}
+
+/// Trait to define device properties.
+///
+/// # Safety
+///
+/// Caller is responsible for the validity of properties array.
+pub unsafe trait DevicePropertiesImpl {
+    /// An array providing the properties that the user can set on the
+    /// device.  Not a `const` because referencing statics in constants
+    /// is unstable until Rust 1.83.0.
+    fn properties() -> &'static [Property] {
+        &[]
+    }
+}
+
 /// Trait providing the contents of [`DeviceClass`].
-pub trait DeviceImpl: ObjectImpl + ResettablePhasesImpl + IsA<DeviceState> {
+pub trait DeviceImpl:
+    ObjectImpl + ResettablePhasesImpl + DevicePropertiesImpl + IsA<DeviceState>
+{
     /// _Realization_ is the second stage of device creation. It contains
     /// all operations that depend on device properties and can fail (note:
     /// this is not yet supported for Rust devices).
@@ -111,13 +170,6 @@ pub trait DeviceImpl: ObjectImpl + ResettablePhasesImpl + IsA<DeviceState> {
     /// with the function pointed to by `REALIZE`.
     const REALIZE: Option<fn(&Self) -> Result<()>> = None;
 
-    /// An array providing the properties that the user can set on the
-    /// device.  Not a `const` because referencing statics in constants
-    /// is unstable until Rust 1.83.0.
-    fn properties() -> &'static [Property] {
-        &[]
-    }
-
     /// A `VMStateDescription` providing the migration format for the device
     /// Not a `const` because referencing statics in constants is unstable
     /// until Rust 1.83.0.
@@ -175,7 +227,7 @@ impl DeviceClass {
         if let Some(vmsd) = <T as DeviceImpl>::vmsd() {
             self.vmsd = vmsd;
         }
-        let prop = <T as DeviceImpl>::properties();
+        let prop = <T as DevicePropertiesImpl>::properties();
         if !prop.is_empty() {
             unsafe {
                 bindings::device_class_set_props_n(self, prop.as_ptr(), prop.len());
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index a658a49fcf..aff3eecd65 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -5,11 +5,10 @@
 use std::{ffi::CStr, ptr::addr_of};
 
 use qemu_api::{
-    bindings::{module_call_init, module_init_type, qdev_prop_bool},
+    bindings::{module_call_init, module_init_type},
     cell::{self, BqlCell},
-    declare_properties, define_property,
     prelude::*,
-    qdev::{DeviceImpl, DeviceState, Property, ResettablePhasesImpl},
+    qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
     qom::{ObjectImpl, ParentField},
     sysbus::SysBusDevice,
     vmstate::VMStateDescription,
@@ -26,9 +25,10 @@ pub static VMSTATE: VMStateDescription = VMStateDescription {
 };
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object)]
+#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
 pub struct DummyState {
     parent: ParentField<DeviceState>,
+    #[property(rename = "migrate-clk", default = true)]
     migrate_clock: bool,
 }
 
@@ -44,17 +44,6 @@ impl DummyClass {
     }
 }
 
-declare_properties! {
-    DUMMY_PROPERTIES,
-        define_property!(
-            c"migrate-clk",
-            DummyState,
-            migrate_clock,
-            unsafe { &qdev_prop_bool },
-            bool
-        ),
-}
-
 unsafe impl ObjectType for DummyState {
     type Class = DummyClass;
     const TYPE_NAME: &'static CStr = c"dummy";
@@ -69,16 +58,13 @@ impl ObjectImpl for DummyState {
 impl ResettablePhasesImpl for DummyState {}
 
 impl DeviceImpl for DummyState {
-    fn properties() -> &'static [Property] {
-        &DUMMY_PROPERTIES
-    }
     fn vmsd() -> Option<&'static VMStateDescription> {
         Some(&VMSTATE)
     }
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object)]
+#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
 pub struct DummyChildState {
     parent: ParentField<DummyState>,
 }

From 7da9ee9207c55a783567eb46c71fa89cb5b43461 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Mon, 8 Sep 2025 12:49:39 +0200
Subject: [PATCH 0473/2396] rust: vmstate: convert to use builder pattern

Similar to MemoryRegionOps, the builder pattern has two advantages:
1) it makes it possible to build a VMStateDescription that knows which
types it will be invoked on; 2) it provides a way to wrap the callbacks
and let devices avoid "unsafe".

Unfortunately, building a static VMStateDescription requires the
builder methods to be "const", and because the VMStateFields are
*also* static, this requires const_refs_static.  So this requires
Rust 1.83.0.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-8-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                  |   2 +-
 rust/hw/char/pl011/src/device.rs     | 131 +++++++--------
 rust/hw/timer/hpet/src/device.rs     | 162 ++++++++----------
 rust/qemu-api/src/errno.rs           |  11 +-
 rust/qemu-api/src/qdev.rs            |   6 +-
 rust/qemu-api/src/vmstate.rs         | 242 ++++++++++++++++++++++++++-
 rust/qemu-api/tests/tests.rs         |  16 +-
 rust/qemu-api/tests/vmstate_tests.rs | 124 +++++++-------
 8 files changed, 450 insertions(+), 244 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 98e3a33a3c..aca29e55c0 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -162,7 +162,7 @@ module           status
 ``qom``          stable
 ``sysbus``       stable
 ``timer``        stable
-``vmstate``      proof of concept
+``vmstate``      stable
 ``zeroable``     stable
 ================ ======================
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 3794463520..21611d9c09 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -3,9 +3,8 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
-    ffi::{c_int, c_void, CStr},
-    mem::size_of,
-    ptr::NonNull,
+    ffi::CStr,
+    mem::size_of
 };
 
 use qemu_api::{
@@ -21,9 +20,8 @@ use qemu_api::{
     static_assert,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     uninit_field_mut,
-    vmstate::VMStateDescription,
+    vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_clock, vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_unused,
-    zeroable::Zeroable,
 };
 
 use crate::registers::{self, Interrupt, RegisterOffset};
@@ -177,8 +175,8 @@ impl ObjectImpl for PL011State {
 }
 
 impl DeviceImpl for PL011State {
-    fn vmsd() -> Option<&'static VMStateDescription> {
-        Some(&VMSTATE_PL011)
+    fn vmsd() -> Option<VMStateDescription<Self>> {
+        Some(VMSTATE_PL011)
     }
     const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
@@ -467,10 +465,10 @@ impl PL011Registers {
         false
     }
 
-    pub fn post_load(&mut self) -> Result<(), ()> {
+    pub fn post_load(&mut self) -> Result<(), vmstate::InvalidError> {
         /* Sanity-check input state */
         if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() {
-            return Err(());
+            return Err(vmstate::InvalidError);
         }
 
         if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 {
@@ -529,6 +527,10 @@ impl PL011State {
         /* pl011_trace_baudrate_change(s); */
     }
 
+    pub fn clock_needed(&self) -> bool {
+        self.migrate_clock
+    }
+
     fn post_init(&self) {
         self.init_mmio(&self.iomem);
         for irq in self.interrupts.iter() {
@@ -645,7 +647,7 @@ impl PL011State {
         }
     }
 
-    pub fn post_load(&self, _version_id: u32) -> Result<(), ()> {
+    pub fn post_load(&self, _version_id: u8) -> Result<(), vmstate::InvalidError> {
         self.regs.borrow_mut().post_load()
     }
 }
@@ -715,68 +717,53 @@ impl DeviceImpl for PL011Luminary {}
 impl ResettablePhasesImpl for PL011Luminary {}
 impl SysBusDeviceImpl for PL011Luminary {}
 
-extern "C" fn pl011_clock_needed(opaque: *mut c_void) -> bool {
-    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
-    unsafe { state.as_ref().migrate_clock }
-}
-
 /// Migration subsection for [`PL011State`] clock.
-static VMSTATE_PL011_CLOCK: VMStateDescription = VMStateDescription {
-    name: c"pl011/clock".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    needed: Some(pl011_clock_needed),
-    fields: vmstate_fields! {
-        vmstate_clock!(PL011State, clock),
-    },
-    ..Zeroable::ZERO
-};
+static VMSTATE_PL011_CLOCK: VMStateDescription<PL011State> =
+    VMStateDescriptionBuilder::<PL011State>::new()
+        .name(c"pl011/clock")
+        .version_id(1)
+        .minimum_version_id(1)
+        .needed(&PL011State::clock_needed)
+        .fields(vmstate_fields! {
+             vmstate_clock!(PL011State, clock),
+        })
+        .build();
 
-extern "C" fn pl011_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
-    let state = NonNull::new(opaque).unwrap().cast::<PL011State>();
-    let result = unsafe { state.as_ref().post_load(version_id as u32) };
-    if result.is_err() {
-        -1
-    } else {
-        0
-    }
-}
+static VMSTATE_PL011_REGS: VMStateDescription<PL011Registers> =
+    VMStateDescriptionBuilder::<PL011Registers>::new()
+        .name(c"pl011/regs")
+        .version_id(2)
+        .minimum_version_id(2)
+        .fields(vmstate_fields! {
+            vmstate_of!(PL011Registers, flags),
+            vmstate_of!(PL011Registers, line_control),
+            vmstate_of!(PL011Registers, receive_status_error_clear),
+            vmstate_of!(PL011Registers, control),
+            vmstate_of!(PL011Registers, dmacr),
+            vmstate_of!(PL011Registers, int_enabled),
+            vmstate_of!(PL011Registers, int_level),
+            vmstate_of!(PL011Registers, read_fifo),
+            vmstate_of!(PL011Registers, ilpr),
+            vmstate_of!(PL011Registers, ibrd),
+            vmstate_of!(PL011Registers, fbrd),
+            vmstate_of!(PL011Registers, ifl),
+            vmstate_of!(PL011Registers, read_pos),
+            vmstate_of!(PL011Registers, read_count),
+            vmstate_of!(PL011Registers, read_trigger),
+        })
+        .build();
 
-static VMSTATE_PL011_REGS: VMStateDescription = VMStateDescription {
-    name: c"pl011/regs".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 2,
-    fields: vmstate_fields! {
-        vmstate_of!(PL011Registers, flags),
-        vmstate_of!(PL011Registers, line_control),
-        vmstate_of!(PL011Registers, receive_status_error_clear),
-        vmstate_of!(PL011Registers, control),
-        vmstate_of!(PL011Registers, dmacr),
-        vmstate_of!(PL011Registers, int_enabled),
-        vmstate_of!(PL011Registers, int_level),
-        vmstate_of!(PL011Registers, read_fifo),
-        vmstate_of!(PL011Registers, ilpr),
-        vmstate_of!(PL011Registers, ibrd),
-        vmstate_of!(PL011Registers, fbrd),
-        vmstate_of!(PL011Registers, ifl),
-        vmstate_of!(PL011Registers, read_pos),
-        vmstate_of!(PL011Registers, read_count),
-        vmstate_of!(PL011Registers, read_trigger),
-    },
-    ..Zeroable::ZERO
-};
-
-pub static VMSTATE_PL011: VMStateDescription = VMStateDescription {
-    name: c"pl011".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 2,
-    post_load: Some(pl011_post_load),
-    fields: vmstate_fields! {
-        vmstate_unused!(core::mem::size_of::<u32>()),
-        vmstate_struct!(PL011State, regs, &VMSTATE_PL011_REGS, BqlRefCell<PL011Registers>),
-    },
-    subsections: vmstate_subsections! {
-        VMSTATE_PL011_CLOCK
-    },
-    ..Zeroable::ZERO
-};
+pub const VMSTATE_PL011: VMStateDescription<PL011State> =
+    VMStateDescriptionBuilder::<PL011State>::new()
+        .name(c"pl011")
+        .version_id(2)
+        .minimum_version_id(2)
+        .post_load(&PL011State::post_load)
+        .fields(vmstate_fields! {
+            vmstate_unused!(core::mem::size_of::<u32>()),
+            vmstate_struct!(PL011State, regs, &VMSTATE_PL011_REGS, BqlRefCell<PL011Registers>),
+        })
+        .subsections(vmstate_subsections! {
+             VMSTATE_PL011_CLOCK
+        })
+        .build();
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 01d5a0dd70..955cf869ff 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -3,7 +3,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use std::{
-    ffi::{c_int, c_void, CStr},
+    ffi::CStr,
     mem::MaybeUninit,
     pin::Pin,
     ptr::{addr_of_mut, null_mut, NonNull},
@@ -27,9 +27,8 @@ use qemu_api::{
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
     uninit_field_mut,
-    vmstate::VMStateDescription,
+    vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_validate,
-    zeroable::Zeroable,
 };
 
 use crate::fw_cfg::HPETFwConfig;
@@ -213,6 +212,10 @@ pub struct HPETTimer {
     last: u64,
 }
 
+// SAFETY: Sync is not automatically derived due to the `state` field,
+// which is always dereferenced to a shared reference.
+unsafe impl Sync for HPETTimer {}
+
 impl HPETTimer {
     fn new(index: u8, state: *const HPETState) -> HPETTimer {
         HPETTimer {
@@ -841,7 +844,7 @@ impl HPETState {
         }
     }
 
-    fn pre_save(&self) -> i32 {
+    fn pre_save(&self) -> Result<(), vmstate::Infallible> {
         if self.is_hpet_enabled() {
             self.counter.set(self.get_ticks());
         }
@@ -852,10 +855,10 @@ impl HPETState {
          * that was configured.
          */
         self.num_timers_save.set(self.num_timers as u8);
-        0
+        Ok(())
     }
 
-    fn post_load(&self, _version_id: u8) -> i32 {
+    fn post_load(&self, _version_id: u8) -> Result<(), vmstate::Infallible> {
         for timer in self.timers.iter().take(self.num_timers) {
             let mut t = timer.borrow_mut();
 
@@ -869,7 +872,7 @@ impl HPETState {
                 .set(ticks_to_ns(self.counter.get()) - CLOCK_VIRTUAL.get_ns());
         }
 
-        0
+        Ok(())
     }
 
     fn is_rtc_irq_level_needed(&self) -> bool {
@@ -939,97 +942,66 @@ qemu_api::declare_properties! {
     ),
 }
 
-unsafe extern "C" fn hpet_rtc_irq_level_needed(opaque: *mut c_void) -> bool {
-    // SAFETY:
-    // the pointer is convertible to a reference
-    let state: &HPETState = unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_ref() };
-    state.is_rtc_irq_level_needed()
-}
+static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription<HPETState> =
+    VMStateDescriptionBuilder::<HPETState>::new()
+        .name(c"hpet/rtc_irq_level")
+        .version_id(1)
+        .minimum_version_id(1)
+        .needed(&HPETState::is_rtc_irq_level_needed)
+        .fields(vmstate_fields! {
+            vmstate_of!(HPETState, rtc_irq_level),
+        })
+        .build();
 
-unsafe extern "C" fn hpet_offset_needed(opaque: *mut c_void) -> bool {
-    // SAFETY:
-    // the pointer is convertible to a reference
-    let state: &HPETState = unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_ref() };
-    state.is_offset_needed()
-}
+static VMSTATE_HPET_OFFSET: VMStateDescription<HPETState> =
+    VMStateDescriptionBuilder::<HPETState>::new()
+        .name(c"hpet/offset")
+        .version_id(1)
+        .minimum_version_id(1)
+        .needed(&HPETState::is_offset_needed)
+        .fields(vmstate_fields! {
+            vmstate_of!(HPETState, hpet_offset),
+        })
+        .build();
 
-unsafe extern "C" fn hpet_pre_save(opaque: *mut c_void) -> c_int {
-    // SAFETY:
-    // the pointer is convertible to a reference
-    let state: &mut HPETState =
-        unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_mut() };
-    state.pre_save() as c_int
-}
-
-unsafe extern "C" fn hpet_post_load(opaque: *mut c_void, version_id: c_int) -> c_int {
-    // SAFETY:
-    // the pointer is convertible to a reference
-    let state: &mut HPETState =
-        unsafe { NonNull::new(opaque.cast::<HPETState>()).unwrap().as_mut() };
-    let version: u8 = version_id.try_into().unwrap();
-    state.post_load(version) as c_int
-}
-
-static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription = VMStateDescription {
-    name: c"hpet/rtc_irq_level".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    needed: Some(hpet_rtc_irq_level_needed),
-    fields: vmstate_fields! {
-        vmstate_of!(HPETState, rtc_irq_level),
-    },
-    ..Zeroable::ZERO
-};
-
-static VMSTATE_HPET_OFFSET: VMStateDescription = VMStateDescription {
-    name: c"hpet/offset".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    needed: Some(hpet_offset_needed),
-    fields: vmstate_fields! {
-        vmstate_of!(HPETState, hpet_offset),
-    },
-    ..Zeroable::ZERO
-};
-
-static VMSTATE_HPET_TIMER: VMStateDescription = VMStateDescription {
-    name: c"hpet_timer".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    fields: vmstate_fields! {
-        vmstate_of!(HPETTimer, index),
-        vmstate_of!(HPETTimer, config),
-        vmstate_of!(HPETTimer, cmp),
-        vmstate_of!(HPETTimer, fsb),
-        vmstate_of!(HPETTimer, period),
-        vmstate_of!(HPETTimer, wrap_flag),
-        vmstate_of!(HPETTimer, qemu_timer),
-    },
-    ..Zeroable::ZERO
-};
+static VMSTATE_HPET_TIMER: VMStateDescription<HPETTimer> =
+    VMStateDescriptionBuilder::<HPETTimer>::new()
+        .name(c"hpet_timer")
+        .version_id(1)
+        .minimum_version_id(1)
+        .fields(vmstate_fields! {
+            vmstate_of!(HPETTimer, index),
+            vmstate_of!(HPETTimer, config),
+            vmstate_of!(HPETTimer, cmp),
+            vmstate_of!(HPETTimer, fsb),
+            vmstate_of!(HPETTimer, period),
+            vmstate_of!(HPETTimer, wrap_flag),
+            vmstate_of!(HPETTimer, qemu_timer),
+        })
+        .build();
 
 const VALIDATE_TIMERS_NAME: &CStr = c"num_timers must match";
 
-static VMSTATE_HPET: VMStateDescription = VMStateDescription {
-    name: c"hpet".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 2,
-    pre_save: Some(hpet_pre_save),
-    post_load: Some(hpet_post_load),
-    fields: vmstate_fields! {
-        vmstate_of!(HPETState, config),
-        vmstate_of!(HPETState, int_status),
-        vmstate_of!(HPETState, counter),
-        vmstate_of!(HPETState, num_timers_save),
-        vmstate_validate!(HPETState, VALIDATE_TIMERS_NAME, HPETState::validate_num_timers),
-        vmstate_struct!(HPETState, timers[0 .. num_timers_save], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
-    },
-    subsections: vmstate_subsections! {
-        VMSTATE_HPET_RTC_IRQ_LEVEL,
-        VMSTATE_HPET_OFFSET,
-    },
-    ..Zeroable::ZERO
-};
+const VMSTATE_HPET: VMStateDescription<HPETState> =
+    VMStateDescriptionBuilder::<HPETState>::new()
+        .name(c"hpet")
+        .version_id(2)
+        .minimum_version_id(2)
+        .pre_save(&HPETState::pre_save)
+        .post_load(&HPETState::post_load)
+        .fields(vmstate_fields! {
+            vmstate_of!(HPETState, config),
+            vmstate_of!(HPETState, int_status),
+            vmstate_of!(HPETState, counter),
+            vmstate_of!(HPETState, num_timers_save),
+            vmstate_validate!(HPETState, VALIDATE_TIMERS_NAME, HPETState::validate_num_timers),
+            vmstate_struct!(HPETState, timers[0 .. num_timers_save], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
+        })
+        .subsections(vmstate_subsections!(
+            VMSTATE_HPET_RTC_IRQ_LEVEL,
+            VMSTATE_HPET_OFFSET,
+        ))
+        .build();
 
 // SAFETY: HPET_PROPERTIES is a valid Property array constructed with the
 // qemu_api::declare_properties macro.
@@ -1040,8 +1012,8 @@ unsafe impl qemu_api::qdev::DevicePropertiesImpl for HPETState {
 }
 
 impl DeviceImpl for HPETState {
-    fn vmsd() -> Option<&'static VMStateDescription> {
-        Some(&VMSTATE_HPET)
+    fn vmsd() -> Option<VMStateDescription<Self>> {
+        Some(VMSTATE_HPET)
     }
 
     const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
diff --git a/rust/qemu-api/src/errno.rs b/rust/qemu-api/src/errno.rs
index 18d101448b..507850fe33 100644
--- a/rust/qemu-api/src/errno.rs
+++ b/rust/qemu-api/src/errno.rs
@@ -7,7 +7,10 @@
 //! convention.  This module provides functions to portably convert an integer
 //! into an [`io::Result`] and back.
 
-use std::{convert::TryFrom, io, io::ErrorKind};
+use std::{
+    convert::{self, TryFrom},
+    io::{self, ErrorKind},
+};
 
 /// An `errno` value that can be converted into an [`io::Error`]
 pub struct Errno(pub u16);
@@ -99,6 +102,12 @@ impl From<io::Error> for Errno {
     }
 }
 
+impl From<convert::Infallible> for Errno {
+    fn from(_value: convert::Infallible) -> Errno {
+        panic!("unreachable")
+    }
+}
+
 /// Internal traits; used to enable [`into_io_result`] and [`into_neg_errno`]
 /// for the "right" set of types.
 mod traits {
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 6a58a00e3f..4dda8c8113 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -173,7 +173,7 @@ pub trait DeviceImpl:
     /// A `VMStateDescription` providing the migration format for the device
     /// Not a `const` because referencing statics in constants is unstable
     /// until Rust 1.83.0.
-    fn vmsd() -> Option<&'static VMStateDescription> {
+    fn vmsd() -> Option<VMStateDescription<Self>> {
         None
     }
 }
@@ -225,7 +225,9 @@ impl DeviceClass {
             self.realize = Some(rust_realize_fn::<T>);
         }
         if let Some(vmsd) = <T as DeviceImpl>::vmsd() {
-            self.vmsd = vmsd;
+            // Give a 'static lifetime to the return value of vmsd().
+            // Temporary until vmsd() can be changed into a const.
+            self.vmsd = Box::leak(Box::new(vmsd.get()));
         }
         let prop = <T as DevicePropertiesImpl>::properties();
         if !prop.is_empty() {
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 8515e38213..f5f1ea5590 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -24,12 +24,24 @@
 //!   `include/migration/vmstate.h`. These are not type-safe and only provide
 //!   functionality that is missing from `vmstate_of!`.
 
-use core::{marker::PhantomData, mem, ptr::NonNull};
-use std::ffi::{c_int, c_void};
+pub use std::convert::Infallible;
+use std::{
+    error::Error,
+    ffi::{c_int, c_void, CStr},
+    fmt, io,
+    marker::PhantomData,
+    mem,
+    ptr::NonNull,
+};
 
-pub use crate::bindings::{VMStateDescription, VMStateField};
+pub use crate::bindings::{MigrationPriority, VMStateField};
 use crate::{
-    bindings::VMStateFlags, callbacks::FnCall, prelude::*, qom::Owned, zeroable::Zeroable,
+    bindings::{self, VMStateFlags},
+    callbacks::FnCall,
+    errno::{into_neg_errno, Errno},
+    prelude::*,
+    qom::Owned,
+    zeroable::Zeroable,
 };
 
 /// This macro is used to call a function with a generic argument bound
@@ -440,7 +452,7 @@ pub extern "C" fn rust_vms_test_field_exists<T, F: for<'a> FnCall<(&'a T, u8), b
     opaque: *mut c_void,
     version_id: c_int,
 ) -> bool {
-    // SAFETY: the opaque was passed as a reference to `T`.
+    // SAFETY: assumes vmstate_struct! is used correctly
     let owner: &T = unsafe { &*(opaque.cast::<T>()) };
     let version: u8 = version_id.try_into().unwrap();
     F::call((owner, version))
@@ -490,7 +502,7 @@ macro_rules! vmstate_struct {
             },
             size: ::core::mem::size_of::<$type>(),
             flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
-            vmsd: $vmsd,
+            vmsd: $vmsd.as_ref(),
             $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             ..$crate::zeroable::Zeroable::ZERO
          } $(.with_varray_flag_unchecked(
@@ -594,11 +606,225 @@ macro_rules! vmstate_subsections {
     ($($subsection:expr),*$(,)*) => {{
         static _SUBSECTIONS: $crate::vmstate::VMStateSubsectionsWrapper = $crate::vmstate::VMStateSubsectionsWrapper(&[
             $({
-                static _SUBSECTION: $crate::bindings::VMStateDescription = $subsection;
+                static _SUBSECTION: $crate::bindings::VMStateDescription = $subsection.get();
                 ::core::ptr::addr_of!(_SUBSECTION)
             }),*,
             ::core::ptr::null()
         ]);
-        _SUBSECTIONS.0.as_ptr()
+        &_SUBSECTIONS
     }}
 }
+
+pub struct VMStateDescription<T>(bindings::VMStateDescription, PhantomData<fn(&T)>);
+
+// SAFETY: When a *const T is passed to the callbacks, the call itself
+// is done in a thread-safe manner.  The invocation is okay as long as
+// T itself is `Sync`.
+unsafe impl<T: Sync> Sync for VMStateDescription<T> {}
+
+#[derive(Clone)]
+pub struct VMStateDescriptionBuilder<T>(bindings::VMStateDescription, PhantomData<fn(&T)>);
+
+#[derive(Debug)]
+pub struct InvalidError;
+
+impl Error for InvalidError {}
+
+impl std::fmt::Display for InvalidError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(f, "invalid migration data")
+    }
+}
+
+impl From<InvalidError> for Errno {
+    fn from(_value: InvalidError) -> Errno {
+        io::ErrorKind::InvalidInput.into()
+    }
+}
+
+unsafe extern "C" fn vmstate_no_version_cb<
+    T,
+    F: for<'a> FnCall<(&'a T,), Result<(), impl Into<Errno>>>,
+>(
+    opaque: *mut c_void,
+) -> c_int {
+    // SAFETY: assumes vmstate_struct! is used correctly
+    let result = F::call((unsafe { &*(opaque.cast::<T>()) },));
+    into_neg_errno(result)
+}
+
+unsafe extern "C" fn vmstate_post_load_cb<
+    T,
+    F: for<'a> FnCall<(&'a T, u8), Result<(), impl Into<Errno>>>,
+>(
+    opaque: *mut c_void,
+    version_id: c_int,
+) -> c_int {
+    // SAFETY: assumes vmstate_struct! is used correctly
+    let owner: &T = unsafe { &*(opaque.cast::<T>()) };
+    let version: u8 = version_id.try_into().unwrap();
+    let result = F::call((owner, version));
+    into_neg_errno(result)
+}
+
+unsafe extern "C" fn vmstate_needed_cb<T, F: for<'a> FnCall<(&'a T,), bool>>(
+    opaque: *mut c_void,
+) -> bool {
+    // SAFETY: assumes vmstate_struct! is used correctly
+    F::call((unsafe { &*(opaque.cast::<T>()) },))
+}
+
+unsafe extern "C" fn vmstate_dev_unplug_pending_cb<T, F: for<'a> FnCall<(&'a T,), bool>>(
+    opaque: *mut c_void,
+) -> bool {
+    // SAFETY: assumes vmstate_struct! is used correctly
+    F::call((unsafe { &*(opaque.cast::<T>()) },))
+}
+
+impl<T> VMStateDescriptionBuilder<T> {
+    #[must_use]
+    pub const fn name(mut self, name_str: &CStr) -> Self {
+        self.0.name = ::std::ffi::CStr::as_ptr(name_str);
+        self
+    }
+
+    #[must_use]
+    pub const fn unmigratable(mut self) -> Self {
+        self.0.unmigratable = true;
+        self
+    }
+
+    #[must_use]
+    pub const fn early_setup(mut self) -> Self {
+        self.0.early_setup = true;
+        self
+    }
+
+    #[must_use]
+    pub const fn version_id(mut self, version: u8) -> Self {
+        self.0.version_id = version as c_int;
+        self
+    }
+
+    #[must_use]
+    pub const fn minimum_version_id(mut self, min_version: u8) -> Self {
+        self.0.minimum_version_id = min_version as c_int;
+        self
+    }
+
+    #[must_use]
+    pub const fn priority(mut self, priority: MigrationPriority) -> Self {
+        self.0.priority = priority;
+        self
+    }
+
+    #[must_use]
+    pub const fn pre_load<F: for<'a> FnCall<(&'a T,), Result<(), impl Into<Errno>>>>(
+        mut self,
+        _f: &F,
+    ) -> Self {
+        self.0.pre_load = if F::IS_SOME {
+            Some(vmstate_no_version_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn post_load<F: for<'a> FnCall<(&'a T, u8), Result<(), impl Into<Errno>>>>(
+        mut self,
+        _f: &F,
+    ) -> Self {
+        self.0.post_load = if F::IS_SOME {
+            Some(vmstate_post_load_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn pre_save<F: for<'a> FnCall<(&'a T,), Result<(), impl Into<Errno>>>>(
+        mut self,
+        _f: &F,
+    ) -> Self {
+        self.0.pre_save = if F::IS_SOME {
+            Some(vmstate_no_version_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn post_save<F: for<'a> FnCall<(&'a T,), Result<(), impl Into<Errno>>>>(
+        mut self,
+        _f: &F,
+    ) -> Self {
+        self.0.post_save = if F::IS_SOME {
+            Some(vmstate_no_version_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn needed<F: for<'a> FnCall<(&'a T,), bool>>(mut self, _f: &F) -> Self {
+        self.0.needed = if F::IS_SOME {
+            Some(vmstate_needed_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn unplug_pending<F: for<'a> FnCall<(&'a T,), bool>>(mut self, _f: &F) -> Self {
+        self.0.dev_unplug_pending = if F::IS_SOME {
+            Some(vmstate_dev_unplug_pending_cb::<T, F>)
+        } else {
+            None
+        };
+        self
+    }
+
+    #[must_use]
+    pub const fn fields(mut self, fields: *const VMStateField) -> Self {
+        self.0.fields = fields;
+        self
+    }
+
+    #[must_use]
+    pub const fn subsections(mut self, subs: &'static VMStateSubsectionsWrapper) -> Self {
+        self.0.subsections = subs.0.as_ptr();
+        self
+    }
+
+    #[must_use]
+    pub const fn build(self) -> VMStateDescription<T> {
+        VMStateDescription::<T>(self.0, PhantomData)
+    }
+
+    #[must_use]
+    pub const fn new() -> Self {
+        Self(bindings::VMStateDescription::ZERO, PhantomData)
+    }
+}
+
+impl<T> Default for VMStateDescriptionBuilder<T> {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+impl<T> VMStateDescription<T> {
+    pub const fn get(&self) -> bindings::VMStateDescription {
+        self.0
+    }
+
+    pub const fn as_ref(&self) -> &bindings::VMStateDescription {
+        &self.0
+    }
+}
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index aff3eecd65..4d4e4653f3 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -11,18 +11,16 @@ use qemu_api::{
     qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
     qom::{ObjectImpl, ParentField},
     sysbus::SysBusDevice,
-    vmstate::VMStateDescription,
-    zeroable::Zeroable,
+    vmstate::{VMStateDescription, VMStateDescriptionBuilder},
 };
 
 mod vmstate_tests;
 
 // Test that macros can compile.
-pub static VMSTATE: VMStateDescription = VMStateDescription {
-    name: c"name".as_ptr(),
-    unmigratable: true,
-    ..Zeroable::ZERO
-};
+pub const VMSTATE: VMStateDescription<DummyState> = VMStateDescriptionBuilder::<DummyState>::new()
+    .name(c"name")
+    .unmigratable()
+    .build();
 
 #[repr(C)]
 #[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
@@ -58,8 +56,8 @@ impl ObjectImpl for DummyState {
 impl ResettablePhasesImpl for DummyState {}
 
 impl DeviceImpl for DummyState {
-    fn vmsd() -> Option<&'static VMStateDescription> {
-        Some(&VMSTATE)
+    fn vmsd() -> Option<VMStateDescription<Self>> {
+        Some(VMSTATE)
     }
 }
 
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index bded836eb6..8ffc2779d4 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -16,9 +16,8 @@ use qemu_api::{
     },
     cell::{BqlCell, Opaque},
     impl_vmstate_forward,
-    vmstate::{VMStateDescription, VMStateField},
+    vmstate::{VMStateDescription, VMStateDescriptionBuilder, VMStateField},
     vmstate_fields, vmstate_of, vmstate_struct, vmstate_unused, vmstate_validate,
-    zeroable::Zeroable,
 };
 
 const FOO_ARRAY_MAX: usize = 3;
@@ -41,22 +40,22 @@ struct FooA {
     elem: i8,
 }
 
-static VMSTATE_FOOA: VMStateDescription = VMStateDescription {
-    name: c"foo_a".as_ptr(),
-    version_id: 1,
-    minimum_version_id: 1,
-    fields: vmstate_fields! {
+static VMSTATE_FOOA: VMStateDescription<FooA> = VMStateDescriptionBuilder::<FooA>::new()
+    .name(c"foo_a")
+    .version_id(1)
+    .minimum_version_id(1)
+    .fields(vmstate_fields! {
         vmstate_of!(FooA, elem),
         vmstate_unused!(size_of::<i64>()),
         vmstate_of!(FooA, arr[0 .. num]).with_version_id(0),
         vmstate_of!(FooA, arr_mul[0 .. num_mul * 16]),
-    },
-    ..Zeroable::ZERO
-};
+    })
+    .build();
 
 #[test]
 fn test_vmstate_uint16() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOA.fields, 5) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOA.as_ref().fields, 5) };
 
     // 1st VMStateField ("elem") in VMSTATE_FOOA (corresponding to VMSTATE_UINT16)
     assert_eq!(
@@ -76,7 +75,8 @@ fn test_vmstate_uint16() {
 
 #[test]
 fn test_vmstate_unused() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOA.fields, 5) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOA.as_ref().fields, 5) };
 
     // 2nd VMStateField ("unused") in VMSTATE_FOOA (corresponding to VMSTATE_UNUSED)
     assert_eq!(
@@ -96,7 +96,8 @@ fn test_vmstate_unused() {
 
 #[test]
 fn test_vmstate_varray_uint16_unsafe() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOA.fields, 5) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOA.as_ref().fields, 5) };
 
     // 3rd VMStateField ("arr") in VMSTATE_FOOA (corresponding to
     // VMSTATE_VARRAY_UINT16_UNSAFE)
@@ -117,7 +118,8 @@ fn test_vmstate_varray_uint16_unsafe() {
 
 #[test]
 fn test_vmstate_varray_multiply() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOA.fields, 5) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOA.as_ref().fields, 5) };
 
     // 4th VMStateField ("arr_mul") in VMSTATE_FOOA (corresponding to
     // VMSTATE_VARRAY_MULTIPLY)
@@ -171,24 +173,25 @@ fn validate_foob(_state: &FooB, _version_id: u8) -> bool {
     true
 }
 
-static VMSTATE_FOOB: VMStateDescription = VMStateDescription {
-    name: c"foo_b".as_ptr(),
-    version_id: 2,
-    minimum_version_id: 1,
-    fields: vmstate_fields! {
-        vmstate_of!(FooB, val).with_version_id(2),
-        vmstate_of!(FooB, wrap),
-        vmstate_struct!(FooB, arr_a[0 .. num_a], &VMSTATE_FOOA, FooA).with_version_id(1),
-        vmstate_struct!(FooB, arr_a_mul[0 .. num_a_mul * 32], &VMSTATE_FOOA, FooA).with_version_id(2),
-        vmstate_of!(FooB, arr_i64),
-        vmstate_struct!(FooB, arr_a_wrap[0 .. num_a_wrap], &VMSTATE_FOOA, FooA, validate_foob),
-    },
-    ..Zeroable::ZERO
-};
+static VMSTATE_FOOB: VMStateDescription<FooB> =
+    VMStateDescriptionBuilder::<FooB>::new()
+        .name(c"foo_b")
+        .version_id(2)
+        .minimum_version_id(1)
+        .fields(vmstate_fields! {
+            vmstate_of!(FooB, val).with_version_id(2),
+            vmstate_of!(FooB, wrap),
+            vmstate_struct!(FooB, arr_a[0 .. num_a], &VMSTATE_FOOA, FooA).with_version_id(1),
+            vmstate_struct!(FooB, arr_a_mul[0 .. num_a_mul * 32], &VMSTATE_FOOA, FooA).with_version_id(2),
+            vmstate_of!(FooB, arr_i64),
+            vmstate_struct!(FooB, arr_a_wrap[0 .. num_a_wrap], &VMSTATE_FOOA, FooA, validate_foob),
+        })
+        .build();
 
 #[test]
 fn test_vmstate_bool_v() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
 
     // 1st VMStateField ("val") in VMSTATE_FOOB (corresponding to VMSTATE_BOOL_V)
     assert_eq!(
@@ -208,7 +211,8 @@ fn test_vmstate_bool_v() {
 
 #[test]
 fn test_vmstate_uint64() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
 
     // 2nd VMStateField ("wrap") in VMSTATE_FOOB (corresponding to VMSTATE_U64)
     assert_eq!(
@@ -228,7 +232,8 @@ fn test_vmstate_uint64() {
 
 #[test]
 fn test_vmstate_struct_varray_uint8() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
 
     // 3rd VMStateField ("arr_a") in VMSTATE_FOOB (corresponding to
     // VMSTATE_STRUCT_VARRAY_UINT8)
@@ -246,13 +251,14 @@ fn test_vmstate_struct_varray_uint8() {
         foo_fields[2].flags.0,
         VMStateFlags::VMS_STRUCT.0 | VMStateFlags::VMS_VARRAY_UINT8.0
     );
-    assert_eq!(foo_fields[2].vmsd, &VMSTATE_FOOA);
+    assert_eq!(foo_fields[2].vmsd, VMSTATE_FOOA.as_ref());
     assert!(foo_fields[2].field_exists.is_none());
 }
 
 #[test]
 fn test_vmstate_struct_varray_uint32_multiply() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
 
     // 4th VMStateField ("arr_a_mul") in VMSTATE_FOOB (corresponding to
     // (no C version) MULTIPLY variant of VMSTATE_STRUCT_VARRAY_UINT32)
@@ -272,13 +278,14 @@ fn test_vmstate_struct_varray_uint32_multiply() {
             | VMStateFlags::VMS_VARRAY_UINT32.0
             | VMStateFlags::VMS_MULTIPLY_ELEMENTS.0
     );
-    assert_eq!(foo_fields[3].vmsd, &VMSTATE_FOOA);
+    assert_eq!(foo_fields[3].vmsd, VMSTATE_FOOA.as_ref());
     assert!(foo_fields[3].field_exists.is_none());
 }
 
 #[test]
 fn test_vmstate_macro_array() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
 
     // 5th VMStateField ("arr_i64") in VMSTATE_FOOB (corresponding to
     // VMSTATE_ARRAY)
@@ -299,7 +306,8 @@ fn test_vmstate_macro_array() {
 
 #[test]
 fn test_vmstate_struct_varray_uint8_wrapper() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOB.fields, 7) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOB.as_ref().fields, 7) };
     let mut foo_b: FooB = Default::default();
     let foo_b_p = std::ptr::addr_of_mut!(foo_b).cast::<c_void>();
 
@@ -335,26 +343,28 @@ struct FooC {
     arr_ptr_wrap: FooCWrapper,
 }
 
-static VMSTATE_FOOC: VMStateDescription = VMStateDescription {
-    name: c"foo_c".as_ptr(),
-    version_id: 3,
-    minimum_version_id: 1,
-    fields: vmstate_fields! {
+unsafe impl Sync for FooC {}
+
+static VMSTATE_FOOC: VMStateDescription<FooC> = VMStateDescriptionBuilder::<FooC>::new()
+    .name(c"foo_c")
+    .version_id(3)
+    .minimum_version_id(1)
+    .fields(vmstate_fields! {
         vmstate_of!(FooC, ptr).with_version_id(2),
         // FIXME: Currently vmstate_struct doesn't support the pointer to structure.
         // VMSTATE_STRUCT_POINTER: vmstate_struct!(FooC, ptr_a, VMSTATE_FOOA, NonNull<FooA>)
         vmstate_unused!(size_of::<NonNull<FooA>>()),
         vmstate_of!(FooC, arr_ptr),
         vmstate_of!(FooC, arr_ptr_wrap),
-    },
-    ..Zeroable::ZERO
-};
+    })
+    .build();
 
 const PTR_SIZE: usize = size_of::<*mut ()>();
 
 #[test]
 fn test_vmstate_pointer() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOC.fields, 6) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOC.as_ref().fields, 6) };
 
     // 1st VMStateField ("ptr") in VMSTATE_FOOC (corresponding to VMSTATE_POINTER)
     assert_eq!(
@@ -377,7 +387,8 @@ fn test_vmstate_pointer() {
 
 #[test]
 fn test_vmstate_macro_array_of_pointer() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOC.fields, 6) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOC.as_ref().fields, 6) };
 
     // 3rd VMStateField ("arr_ptr") in VMSTATE_FOOC (corresponding to
     // VMSTATE_ARRAY_OF_POINTER)
@@ -401,7 +412,8 @@ fn test_vmstate_macro_array_of_pointer() {
 
 #[test]
 fn test_vmstate_macro_array_of_pointer_wrapped() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOC.fields, 6) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOC.as_ref().fields, 6) };
 
     // 4th VMStateField ("arr_ptr_wrap") in VMSTATE_FOOC (corresponding to
     // VMSTATE_ARRAY_OF_POINTER)
@@ -450,21 +462,21 @@ fn validate_food_2(_state: &FooD, _version_id: u8) -> bool {
     true
 }
 
-static VMSTATE_FOOD: VMStateDescription = VMStateDescription {
-    name: c"foo_d".as_ptr(),
-    version_id: 3,
-    minimum_version_id: 1,
-    fields: vmstate_fields! {
+static VMSTATE_FOOD: VMStateDescription<FooD> = VMStateDescriptionBuilder::<FooD>::new()
+    .name(c"foo_d")
+    .version_id(3)
+    .minimum_version_id(1)
+    .fields(vmstate_fields! {
         vmstate_validate!(FooD, c"foo_d_0", FooD::validate_food_0),
         vmstate_validate!(FooD, c"foo_d_1", FooD::validate_food_1),
         vmstate_validate!(FooD, c"foo_d_2", validate_food_2),
-    },
-    ..Zeroable::ZERO
-};
+    })
+    .build();
 
 #[test]
 fn test_vmstate_validate() {
-    let foo_fields: &[VMStateField] = unsafe { slice::from_raw_parts(VMSTATE_FOOD.fields, 4) };
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOD.as_ref().fields, 4) };
     let mut foo_d = FooD;
     let foo_d_p = std::ptr::addr_of_mut!(foo_d).cast::<c_void>();
 

From dcdee1e718f9400a2bf523f2b009fb936370ae4b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:40 +0200
Subject: [PATCH 0474/2396] rust: vmstate: use const_refs_to_static

The VMStateDescriptionBuilder already needs const_refs_static, so
use it to remove the need for vmstate_clock! and vmstate_struct!,
as well as to simplify the implementation for scalars.

If the consts in the VMState trait can reference to static
VMStateDescription, scalars do not need the info_enum_to_ref!
indirection and structs can implement the VMState trait themselves.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-9-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                  |   5 -
 rust/hw/char/pl011/src/device.rs     |  19 ++-
 rust/hw/timer/hpet/src/device.rs     |   8 +-
 rust/qemu-api/src/assertions.rs      |   4 -
 rust/qemu-api/src/vmstate.rs         | 229 +++++++--------------------
 rust/qemu-api/tests/vmstate_tests.rs |  65 +++++---
 6 files changed, 113 insertions(+), 217 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index aca29e55c0..10b0590b56 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -84,11 +84,6 @@ patches are welcome:
 
 * ``&raw`` (stable in 1.82.0).
 
-* referencing statics in constants (stable in 1.83.0).  For now use a const
-  function; this is an important limitation for QEMU's migration stream
-  architecture (VMState).  Right now, VMState lacks type safety because
-  it is hard to place the ``VMStateField`` definitions in traits.
-
 * NUL-terminated file names with ``#[track_caller]`` are scheduled for
   inclusion as ``#![feature(location_file_nul)]``, but it will be a while
   before QEMU can use them.  For now, there is special code in
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 21611d9c09..87a17716fe 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -2,14 +2,11 @@
 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 // SPDX-License-Identifier: GPL-2.0-or-later
 
-use std::{
-    ffi::CStr,
-    mem::size_of
-};
+use std::{ffi::CStr, mem::size_of};
 
 use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
-    impl_vmstate_forward,
+    impl_vmstate_forward, impl_vmstate_struct,
     irq::{IRQState, InterruptSource},
     log::Log,
     log_mask_ln,
@@ -21,7 +18,7 @@ use qemu_api::{
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     uninit_field_mut,
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
-    vmstate_clock, vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_unused,
+    vmstate_fields, vmstate_of, vmstate_subsections, vmstate_unused,
 };
 
 use crate::registers::{self, Interrupt, RegisterOffset};
@@ -725,11 +722,12 @@ static VMSTATE_PL011_CLOCK: VMStateDescription<PL011State> =
         .minimum_version_id(1)
         .needed(&PL011State::clock_needed)
         .fields(vmstate_fields! {
-             vmstate_clock!(PL011State, clock),
+             vmstate_of!(PL011State, clock),
         })
         .build();
 
-static VMSTATE_PL011_REGS: VMStateDescription<PL011Registers> =
+impl_vmstate_struct!(
+    PL011Registers,
     VMStateDescriptionBuilder::<PL011Registers>::new()
         .name(c"pl011/regs")
         .version_id(2)
@@ -751,7 +749,8 @@ static VMSTATE_PL011_REGS: VMStateDescription<PL011Registers> =
             vmstate_of!(PL011Registers, read_count),
             vmstate_of!(PL011Registers, read_trigger),
         })
-        .build();
+        .build()
+);
 
 pub const VMSTATE_PL011: VMStateDescription<PL011State> =
     VMStateDescriptionBuilder::<PL011State>::new()
@@ -761,7 +760,7 @@ pub const VMSTATE_PL011: VMStateDescription<PL011State> =
         .post_load(&PL011State::post_load)
         .fields(vmstate_fields! {
             vmstate_unused!(core::mem::size_of::<u32>()),
-            vmstate_struct!(PL011State, regs, &VMSTATE_PL011_REGS, BqlRefCell<PL011Registers>),
+            vmstate_of!(PL011State, regs),
         })
         .subsections(vmstate_subsections! {
              VMSTATE_PL011_CLOCK
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 955cf869ff..eb5bd042b1 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -16,6 +16,7 @@ use qemu_api::{
         qdev_prop_uint32, qdev_prop_usize,
     },
     cell::{BqlCell, BqlRefCell},
+    impl_vmstate_struct,
     irq::InterruptSource,
     memory::{
         hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
@@ -28,7 +29,7 @@ use qemu_api::{
     timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
     uninit_field_mut,
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
-    vmstate_fields, vmstate_of, vmstate_struct, vmstate_subsections, vmstate_validate,
+    vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
 };
 
 use crate::fw_cfg::HPETFwConfig;
@@ -964,7 +965,7 @@ static VMSTATE_HPET_OFFSET: VMStateDescription<HPETState> =
         })
         .build();
 
-static VMSTATE_HPET_TIMER: VMStateDescription<HPETTimer> =
+const VMSTATE_HPET_TIMER: VMStateDescription<HPETTimer> =
     VMStateDescriptionBuilder::<HPETTimer>::new()
         .name(c"hpet_timer")
         .version_id(1)
@@ -979,6 +980,7 @@ static VMSTATE_HPET_TIMER: VMStateDescription<HPETTimer> =
             vmstate_of!(HPETTimer, qemu_timer),
         })
         .build();
+impl_vmstate_struct!(HPETTimer, VMSTATE_HPET_TIMER);
 
 const VALIDATE_TIMERS_NAME: &CStr = c"num_timers must match";
 
@@ -995,7 +997,7 @@ const VMSTATE_HPET: VMStateDescription<HPETState> =
             vmstate_of!(HPETState, counter),
             vmstate_of!(HPETState, num_timers_save),
             vmstate_validate!(HPETState, VALIDATE_TIMERS_NAME, HPETState::validate_num_timers),
-            vmstate_struct!(HPETState, timers[0 .. num_timers_save], &VMSTATE_HPET_TIMER, BqlRefCell<HPETTimer>, HPETState::validate_num_timers).with_version_id(0),
+            vmstate_of!(HPETState, timers[0 .. num_timers_save], HPETState::validate_num_timers).with_version_id(0),
         })
         .subsections(vmstate_subsections!(
             VMSTATE_HPET_RTC_IRQ_LEVEL,
diff --git a/rust/qemu-api/src/assertions.rs b/rust/qemu-api/src/assertions.rs
index e74fa3ef82..e4fe23b674 100644
--- a/rust/qemu-api/src/assertions.rs
+++ b/rust/qemu-api/src/assertions.rs
@@ -95,10 +95,6 @@ macro_rules! assert_field_type {
     ($t:ty, $i:tt, $ti:ty) => {
         $crate::assert_field_type!(@internal v, $ti, $t, v.$i);
     };
-
-    ($t:ty, $i:tt, $ti:ty, num = $num:ident) => {
-        $crate::assert_field_type!(@internal v, $ti, $t, v.$i[0]);
-    };
 }
 
 /// Assert that an expression matches a pattern.  This can also be
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index f5f1ea5590..b5c6b764fb 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -11,10 +11,11 @@
 //!   migration format for a struct.  This is based on the [`VMState`] trait,
 //!   which is defined by all migratable types.
 //!
-//! * [`impl_vmstate_forward`](crate::impl_vmstate_forward) and
-//!   [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), which help with
-//!   the definition of the [`VMState`] trait (respectively for transparent
-//!   structs and for `bilge`-defined types)
+//! * [`impl_vmstate_forward`](crate::impl_vmstate_forward),
+//!   [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), and
+//!   [`impl_vmstate_struct`](crate::impl_vmstate_struct), which help with the
+//!   definition of the [`VMState`] trait (respectively for transparent structs,
+//!   nested structs and `bilge`-defined types)
 //!
 //! * helper macros to declare a device model state struct, in particular
 //!   [`vmstate_subsections`](crate::vmstate_subsections) and
@@ -31,7 +32,7 @@ use std::{
     fmt, io,
     marker::PhantomData,
     mem,
-    ptr::NonNull,
+    ptr::{addr_of, NonNull},
 };
 
 pub use crate::bindings::{MigrationPriority, VMStateField};
@@ -40,6 +41,7 @@ use crate::{
     callbacks::FnCall,
     errno::{into_neg_errno, Errno},
     prelude::*,
+    qdev,
     qom::Owned,
     zeroable::Zeroable,
 };
@@ -81,70 +83,6 @@ macro_rules! call_func_with_field {
     };
 }
 
-/// Workaround for lack of `const_refs_static`: references to global variables
-/// can be included in a `static`, but not in a `const`; unfortunately, this
-/// is exactly what would go in the `VMStateField`'s `info` member.
-///
-/// This enum contains the contents of the `VMStateField`'s `info` member,
-/// but as an `enum` instead of a pointer.
-#[allow(non_camel_case_types)]
-pub enum VMStateFieldType {
-    null,
-    vmstate_info_bool,
-    vmstate_info_int8,
-    vmstate_info_int16,
-    vmstate_info_int32,
-    vmstate_info_int64,
-    vmstate_info_uint8,
-    vmstate_info_uint16,
-    vmstate_info_uint32,
-    vmstate_info_uint64,
-    vmstate_info_timer,
-}
-
-/// Workaround for lack of `const_refs_static`.  Converts a `VMStateFieldType`
-/// to a `*const VMStateInfo`, for inclusion in a `VMStateField`.
-#[macro_export]
-macro_rules! info_enum_to_ref {
-    ($e:expr) => {
-        unsafe {
-            match $e {
-                $crate::vmstate::VMStateFieldType::null => ::core::ptr::null(),
-                $crate::vmstate::VMStateFieldType::vmstate_info_bool => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_bool)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_int8 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_int8)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_int16 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_int16)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_int32 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_int32)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_int64 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_int64)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_uint8 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_uint8)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_uint16 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_uint16)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_uint32 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_uint32)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_uint64 => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_uint64)
-                }
-                $crate::vmstate::VMStateFieldType::vmstate_info_timer => {
-                    ::core::ptr::addr_of!($crate::bindings::vmstate_info_timer)
-                }
-            }
-        }
-    };
-}
-
 /// A trait for types that can be included in a device's migration stream.  It
 /// provides the base contents of a `VMStateField` (minus the name and offset).
 ///
@@ -155,12 +93,6 @@ macro_rules! info_enum_to_ref {
 /// to implement it except via macros that do it for you, such as
 /// `impl_vmstate_bitsized!`.
 pub unsafe trait VMState {
-    /// The `info` member of a `VMStateField` is a pointer and as such cannot
-    /// yet be included in the [`BASE`](VMState::BASE) associated constant;
-    /// this is only allowed by Rust 1.83.0 and newer.  For now, include the
-    /// member as an enum which is stored in a separate constant.
-    const SCALAR_TYPE: VMStateFieldType = VMStateFieldType::null;
-
     /// The base contents of a `VMStateField` (minus the name and offset) for
     /// the type that is implementing the trait.
     const BASE: VMStateField;
@@ -175,12 +107,6 @@ pub unsafe trait VMState {
     };
 }
 
-/// Internal utility function to retrieve a type's `VMStateFieldType`;
-/// used by [`vmstate_of!`](crate::vmstate_of).
-pub const fn vmstate_scalar_type<T: VMState>(_: PhantomData<T>) -> VMStateFieldType {
-    T::SCALAR_TYPE
-}
-
 /// Internal utility function to retrieve a type's `VMStateField`;
 /// used by [`vmstate_of!`](crate::vmstate_of).
 pub const fn vmstate_base<T: VMState>(_: PhantomData<T>) -> VMStateField {
@@ -207,9 +133,9 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// * an array of any of the above
 ///
 /// In order to support other types, the trait `VMState` must be implemented
-/// for them.  The macros
-/// [`impl_vmstate_bitsized!`](crate::impl_vmstate_bitsized)
-/// and [`impl_vmstate_forward!`](crate::impl_vmstate_forward) help with this.
+/// for them.  The macros [`impl_vmstate_forward`](crate::impl_vmstate_forward),
+/// [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), and
+/// [`impl_vmstate_struct`](crate::impl_vmstate_struct) help with this.
 #[macro_export]
 macro_rules! vmstate_of {
     ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
@@ -222,11 +148,6 @@ macro_rules! vmstate_of {
             $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             // The calls to `call_func_with_field!` are the magic that
             // computes most of the VMStateField from the type of the field.
-            info: $crate::info_enum_to_ref!($crate::call_func_with_field!(
-                $crate::vmstate::vmstate_scalar_type,
-                $struct_name,
-                $field_name
-            )),
             ..$crate::call_func_with_field!(
                 $crate::vmstate::vmstate_base,
                 $struct_name,
@@ -327,8 +248,6 @@ macro_rules! impl_vmstate_forward {
     // the first field of the tuple
     ($tuple:ty) => {
         unsafe impl $crate::vmstate::VMState for $tuple {
-            const SCALAR_TYPE: $crate::vmstate::VMStateFieldType =
-                $crate::call_func_with_field!($crate::vmstate::vmstate_scalar_type, $tuple, 0);
             const BASE: $crate::bindings::VMStateField =
                 $crate::call_func_with_field!($crate::vmstate::vmstate_base, $tuple, 0);
         }
@@ -340,7 +259,6 @@ macro_rules! impl_vmstate_forward {
 macro_rules! impl_vmstate_transparent {
     ($type:ty where $base:tt: VMState $($where:tt)*) => {
         unsafe impl<$base> VMState for $type where $base: VMState $($where)* {
-            const SCALAR_TYPE: VMStateFieldType = <$base as VMState>::SCALAR_TYPE;
             const BASE: VMStateField = VMStateField {
                 size: mem::size_of::<$type>(),
                 ..<$base as VMState>::BASE
@@ -361,10 +279,6 @@ impl_vmstate_transparent!(crate::cell::Opaque<T> where T: VMState);
 macro_rules! impl_vmstate_bitsized {
     ($type:ty) => {
         unsafe impl $crate::vmstate::VMState for $type {
-            const SCALAR_TYPE: $crate::vmstate::VMStateFieldType =
-                                        <<<$type as ::bilge::prelude::Bitsized>::ArbitraryInt
-                                          as ::bilge::prelude::Number>::UnderlyingType
-                                         as $crate::vmstate::VMState>::SCALAR_TYPE;
             const BASE: $crate::bindings::VMStateField =
                                         <<<$type as ::bilge::prelude::Bitsized>::ArbitraryInt
                                           as ::bilge::prelude::Number>::UnderlyingType
@@ -382,8 +296,8 @@ macro_rules! impl_vmstate_bitsized {
 macro_rules! impl_vmstate_scalar {
     ($info:ident, $type:ty$(, $varray_flag:ident)?) => {
         unsafe impl VMState for $type {
-            const SCALAR_TYPE: VMStateFieldType = VMStateFieldType::$info;
             const BASE: VMStateField = VMStateField {
+                info: addr_of!(bindings::$info),
                 size: mem::size_of::<$type>(),
                 flags: VMStateFlags::VMS_SINGLE,
                 ..Zeroable::ZERO
@@ -404,6 +318,21 @@ impl_vmstate_scalar!(vmstate_info_uint32, u32, VMS_VARRAY_UINT32);
 impl_vmstate_scalar!(vmstate_info_uint64, u64);
 impl_vmstate_scalar!(vmstate_info_timer, crate::timer::Timer);
 
+macro_rules! impl_vmstate_c_struct {
+    ($type:ty, $vmsd:expr) => {
+        unsafe impl VMState for $type {
+            const BASE: VMStateField = $crate::bindings::VMStateField {
+                vmsd: addr_of!($vmsd),
+                size: mem::size_of::<$type>(),
+                flags: VMStateFlags::VMS_STRUCT,
+                ..Zeroable::ZERO
+            };
+        }
+    };
+}
+
+impl_vmstate_c_struct!(qdev::Clock, bindings::vmstate_clock);
+
 // Pointer types using the underlying type's VMState plus VMS_POINTER
 // Note that references are not supported, though references to cells
 // could be allowed.
@@ -411,7 +340,6 @@ impl_vmstate_scalar!(vmstate_info_timer, crate::timer::Timer);
 macro_rules! impl_vmstate_pointer {
     ($type:ty where $base:tt: VMState $($where:tt)*) => {
         unsafe impl<$base> VMState for $type where $base: VMState $($where)* {
-            const SCALAR_TYPE: VMStateFieldType = <T as VMState>::SCALAR_TYPE;
             const BASE: VMStateField = <$base as VMState>::BASE.with_pointer_flag();
         }
     };
@@ -430,7 +358,6 @@ impl_vmstate_pointer!(Owned<T> where T: VMState + ObjectType);
 // VMS_ARRAY/VMS_ARRAY_OF_POINTER
 
 unsafe impl<T: VMState, const N: usize> VMState for [T; N] {
-    const SCALAR_TYPE: VMStateFieldType = <T as VMState>::SCALAR_TYPE;
     const BASE: VMStateField = <T as VMState>::BASE.with_array_flag(N);
 }
 
@@ -452,7 +379,7 @@ pub extern "C" fn rust_vms_test_field_exists<T, F: for<'a> FnCall<(&'a T, u8), b
     opaque: *mut c_void,
     version_id: c_int,
 ) -> bool {
-    // SAFETY: assumes vmstate_struct! is used correctly
+    // SAFETY: the function is used in T's implementation of VMState
     let owner: &T = unsafe { &*(opaque.cast::<T>()) };
     let version: u8 = version_id.try_into().unwrap();
     F::call((owner, version))
@@ -480,76 +407,6 @@ macro_rules! vmstate_exist_fn {
     }};
 }
 
-// FIXME: including the `vmsd` field in a `const` is not possible without
-// the const_refs_static feature (stabilized in Rust 1.83.0).  Without it,
-// it is not possible to use VMS_STRUCT in a transparent manner using
-// `vmstate_of!`.  While VMSTATE_CLOCK can at least try to be type-safe,
-// VMSTATE_STRUCT includes $type only for documentation purposes; it
-// is checked against $field_name and $struct_name, but not against $vmsd
-// which is what really would matter.
-#[doc(alias = "VMSTATE_STRUCT")]
-#[macro_export]
-macro_rules! vmstate_struct {
-    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])?, $vmsd:expr, $type:ty $(, $test_fn:expr)? $(,)?) => {
-        $crate::bindings::VMStateField {
-            name: ::core::concat!(::core::stringify!($field_name), "\0")
-                .as_bytes()
-                .as_ptr() as *const ::std::os::raw::c_char,
-            $(num_offset: ::std::mem::offset_of!($struct_name, $num),)?
-            offset: {
-                $crate::assert_field_type!($struct_name, $field_name, $type $(, num = $num)?);
-                ::std::mem::offset_of!($struct_name, $field_name)
-            },
-            size: ::core::mem::size_of::<$type>(),
-            flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
-            vmsd: $vmsd.as_ref(),
-            $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
-            ..$crate::zeroable::Zeroable::ZERO
-         } $(.with_varray_flag_unchecked(
-                  $crate::call_func_with_field!(
-                      $crate::vmstate::vmstate_varray_flag,
-                      $struct_name,
-                      $num
-                  )
-              )
-           $(.with_varray_multiply($factor))?)?
-    };
-}
-
-#[doc(alias = "VMSTATE_CLOCK")]
-#[macro_export]
-macro_rules! vmstate_clock {
-    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])?) => {{
-        $crate::bindings::VMStateField {
-            name: ::core::concat!(::core::stringify!($field_name), "\0")
-                .as_bytes()
-                .as_ptr() as *const ::std::os::raw::c_char,
-            offset: {
-                $crate::assert_field_type!(
-                    $struct_name,
-                    $field_name,
-                    $crate::qom::Owned<$crate::qdev::Clock> $(, num = $num)?
-                );
-                ::std::mem::offset_of!($struct_name, $field_name)
-            },
-            size: ::core::mem::size_of::<*const $crate::qdev::Clock>(),
-            flags: $crate::bindings::VMStateFlags(
-                $crate::bindings::VMStateFlags::VMS_STRUCT.0
-                    | $crate::bindings::VMStateFlags::VMS_POINTER.0,
-            ),
-            vmsd: unsafe { ::core::ptr::addr_of!($crate::bindings::vmstate_clock) },
-            ..$crate::zeroable::Zeroable::ZERO
-         } $(.with_varray_flag_unchecked(
-                  $crate::call_func_with_field!(
-                      $crate::vmstate::vmstate_varray_flag,
-                      $struct_name,
-                      $num
-                  )
-              )
-           $(.with_varray_multiply($factor))?)?
-    }};
-}
-
 /// Helper macro to declare a list of
 /// ([`VMStateField`](`crate::bindings::VMStateField`)) into a static and return
 /// a pointer to the array of values it created.
@@ -584,6 +441,30 @@ macro_rules! vmstate_validate {
     };
 }
 
+/// Helper macro to allow using a struct in [`vmstate_of!`]
+///
+/// # Safety
+///
+/// The [`VMStateDescription`] constant `$vmsd` must be an accurate
+/// description of the struct.
+#[macro_export]
+macro_rules! impl_vmstate_struct {
+    ($type:ty, $vmsd:expr) => {
+        unsafe impl $crate::vmstate::VMState for $type {
+            const BASE: $crate::bindings::VMStateField = {
+                static VMSD: &$crate::bindings::VMStateDescription = $vmsd.as_ref();
+
+                $crate::bindings::VMStateField {
+                    vmsd: ::core::ptr::addr_of!(*VMSD),
+                    size: ::core::mem::size_of::<$type>(),
+                    flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
+                    ..$crate::zeroable::Zeroable::ZERO
+                }
+            };
+        }
+    };
+}
+
 /// A transparent wrapper type for the `subsections` field of
 /// [`VMStateDescription`].
 ///
@@ -648,7 +529,7 @@ unsafe extern "C" fn vmstate_no_version_cb<
 >(
     opaque: *mut c_void,
 ) -> c_int {
-    // SAFETY: assumes vmstate_struct! is used correctly
+    // SAFETY: the function is used in T's implementation of VMState
     let result = F::call((unsafe { &*(opaque.cast::<T>()) },));
     into_neg_errno(result)
 }
@@ -660,7 +541,7 @@ unsafe extern "C" fn vmstate_post_load_cb<
     opaque: *mut c_void,
     version_id: c_int,
 ) -> c_int {
-    // SAFETY: assumes vmstate_struct! is used correctly
+    // SAFETY: the function is used in T's implementation of VMState
     let owner: &T = unsafe { &*(opaque.cast::<T>()) };
     let version: u8 = version_id.try_into().unwrap();
     let result = F::call((owner, version));
@@ -670,14 +551,14 @@ unsafe extern "C" fn vmstate_post_load_cb<
 unsafe extern "C" fn vmstate_needed_cb<T, F: for<'a> FnCall<(&'a T,), bool>>(
     opaque: *mut c_void,
 ) -> bool {
-    // SAFETY: assumes vmstate_struct! is used correctly
+    // SAFETY: the function is used in T's implementation of VMState
     F::call((unsafe { &*(opaque.cast::<T>()) },))
 }
 
 unsafe extern "C" fn vmstate_dev_unplug_pending_cb<T, F: for<'a> FnCall<(&'a T,), bool>>(
     opaque: *mut c_void,
 ) -> bool {
-    // SAFETY: assumes vmstate_struct! is used correctly
+    // SAFETY: the function is used in T's implementation of VMState
     F::call((unsafe { &*(opaque.cast::<T>()) },))
 }
 
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index 8ffc2779d4..2c0670ba0e 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -15,9 +15,9 @@ use qemu_api::{
         vmstate_info_uint64, vmstate_info_uint8, vmstate_info_unused_buffer, VMStateFlags,
     },
     cell::{BqlCell, Opaque},
-    impl_vmstate_forward,
+    impl_vmstate_forward, impl_vmstate_struct,
     vmstate::{VMStateDescription, VMStateDescriptionBuilder, VMStateField},
-    vmstate_fields, vmstate_of, vmstate_struct, vmstate_unused, vmstate_validate,
+    vmstate_fields, vmstate_of, vmstate_unused, vmstate_validate,
 };
 
 const FOO_ARRAY_MAX: usize = 3;
@@ -52,6 +52,8 @@ static VMSTATE_FOOA: VMStateDescription<FooA> = VMStateDescriptionBuilder::<FooA
     })
     .build();
 
+impl_vmstate_struct!(FooA, VMSTATE_FOOA);
+
 #[test]
 fn test_vmstate_uint16() {
     let foo_fields: &[VMStateField] =
@@ -173,20 +175,19 @@ fn validate_foob(_state: &FooB, _version_id: u8) -> bool {
     true
 }
 
-static VMSTATE_FOOB: VMStateDescription<FooB> =
-    VMStateDescriptionBuilder::<FooB>::new()
-        .name(c"foo_b")
-        .version_id(2)
-        .minimum_version_id(1)
-        .fields(vmstate_fields! {
-            vmstate_of!(FooB, val).with_version_id(2),
-            vmstate_of!(FooB, wrap),
-            vmstate_struct!(FooB, arr_a[0 .. num_a], &VMSTATE_FOOA, FooA).with_version_id(1),
-            vmstate_struct!(FooB, arr_a_mul[0 .. num_a_mul * 32], &VMSTATE_FOOA, FooA).with_version_id(2),
-            vmstate_of!(FooB, arr_i64),
-            vmstate_struct!(FooB, arr_a_wrap[0 .. num_a_wrap], &VMSTATE_FOOA, FooA, validate_foob),
-        })
-        .build();
+static VMSTATE_FOOB: VMStateDescription<FooB> = VMStateDescriptionBuilder::<FooB>::new()
+    .name(c"foo_b")
+    .version_id(2)
+    .minimum_version_id(1)
+    .fields(vmstate_fields! {
+        vmstate_of!(FooB, val).with_version_id(2),
+        vmstate_of!(FooB, wrap),
+        vmstate_of!(FooB, arr_a[0 .. num_a]).with_version_id(1),
+        vmstate_of!(FooB, arr_a_mul[0 .. num_a_mul * 32]).with_version_id(2),
+        vmstate_of!(FooB, arr_i64),
+        vmstate_of!(FooB, arr_a_wrap[0 .. num_a_wrap], validate_foob),
+    })
+    .build();
 
 #[test]
 fn test_vmstate_bool_v() {
@@ -351,9 +352,7 @@ static VMSTATE_FOOC: VMStateDescription<FooC> = VMStateDescriptionBuilder::<FooC
     .minimum_version_id(1)
     .fields(vmstate_fields! {
         vmstate_of!(FooC, ptr).with_version_id(2),
-        // FIXME: Currently vmstate_struct doesn't support the pointer to structure.
-        // VMSTATE_STRUCT_POINTER: vmstate_struct!(FooC, ptr_a, VMSTATE_FOOA, NonNull<FooA>)
-        vmstate_unused!(size_of::<NonNull<FooA>>()),
+        vmstate_of!(FooC, ptr_a),
         vmstate_of!(FooC, arr_ptr),
         vmstate_of!(FooC, arr_ptr_wrap),
     })
@@ -385,6 +384,31 @@ fn test_vmstate_pointer() {
     assert!(foo_fields[0].field_exists.is_none());
 }
 
+#[test]
+fn test_vmstate_struct_pointer() {
+    let foo_fields: &[VMStateField] =
+        unsafe { slice::from_raw_parts(VMSTATE_FOOC.as_ref().fields, 6) };
+
+    // 2st VMStateField ("ptr_a") in VMSTATE_FOOC (corresponding to
+    // VMSTATE_STRUCT_POINTER)
+    assert_eq!(
+        unsafe { CStr::from_ptr(foo_fields[1].name) }.to_bytes_with_nul(),
+        b"ptr_a\0"
+    );
+    assert_eq!(foo_fields[1].offset, PTR_SIZE);
+    assert_eq!(foo_fields[1].num_offset, 0);
+    assert_eq!(foo_fields[1].vmsd, VMSTATE_FOOA.as_ref());
+    assert_eq!(foo_fields[1].version_id, 0);
+    assert_eq!(foo_fields[1].size, size_of::<FooA>());
+    assert_eq!(foo_fields[1].num, 0);
+    assert_eq!(
+        foo_fields[1].flags.0,
+        VMStateFlags::VMS_STRUCT.0 | VMStateFlags::VMS_POINTER.0
+    );
+    assert!(foo_fields[1].info.is_null());
+    assert!(foo_fields[1].field_exists.is_none());
+}
+
 #[test]
 fn test_vmstate_macro_array_of_pointer() {
     let foo_fields: &[VMStateField] =
@@ -444,8 +468,7 @@ fn test_vmstate_macro_array_of_pointer_wrapped() {
 //   * VMSTATE_FOOD:
 //     - VMSTATE_VALIDATE
 
-// Add more member fields when vmstate_of/vmstate_struct support "test"
-// parameter.
+// Add more member fields when vmstate_of support "test" parameter.
 struct FooD;
 
 impl FooD {

From 2a8a7bb8aaf54c3c878a616884a2e4bb239b6095 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:49:41 +0200
Subject: [PATCH 0475/2396] rust: qdev: const_refs_to_static

Now that const_refs_static can be assumed, convert the members of
the DeviceImpl trait from functions to constants.  This lets the
compiler know that they have a 'static lifetime, and removes the
need for the weird "Box::leak()".

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-10-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs  |  4 +--
 rust/hw/timer/hpet/src/device.rs  |  9 ++-----
 rust/qemu-api-macros/src/lib.rs   |  8 +++---
 rust/qemu-api-macros/src/tests.rs | 44 ++++++++++++++-----------------
 rust/qemu-api/src/qdev.rs         | 19 +++++--------
 rust/qemu-api/tests/tests.rs      |  4 +--
 6 files changed, 33 insertions(+), 55 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 87a17716fe..8411db8d00 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -172,9 +172,7 @@ impl ObjectImpl for PL011State {
 }
 
 impl DeviceImpl for PL011State {
-    fn vmsd() -> Option<VMStateDescription<Self>> {
-        Some(VMSTATE_PL011)
-    }
+    const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE_PL011);
     const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
 
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index eb5bd042b1..dd5326a40d 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -1008,16 +1008,11 @@ const VMSTATE_HPET: VMStateDescription<HPETState> =
 // SAFETY: HPET_PROPERTIES is a valid Property array constructed with the
 // qemu_api::declare_properties macro.
 unsafe impl qemu_api::qdev::DevicePropertiesImpl for HPETState {
-    fn properties() -> &'static [Property] {
-        &HPET_PROPERTIES
-    }
+    const PROPERTIES: &'static [Property] = &HPET_PROPERTIES;
 }
 
 impl DeviceImpl for HPETState {
-    fn vmsd() -> Option<VMStateDescription<Self>> {
-        Some(VMSTATE_HPET)
-    }
-
+    const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE_HPET);
     const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
 }
 
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 97b2c214b6..a65a7ce2fe 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -289,11 +289,9 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
 
     Ok(quote_spanned! {input.span() =>
         unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for #name {
-            fn properties() -> &'static [::qemu_api::bindings::Property] {
-                static PROPERTIES: &[::qemu_api::bindings::Property] = &[#(#properties_expanded),*];
-
-                PROPERTIES
-            }
+            const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
+                #(#properties_expanded),*
+            ];
         }
     })
 }
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index aafffcdce9..0e5a572890 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -101,18 +101,16 @@ fn test_derive_device() {
         },
         quote! {
             unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
-                fn properties() -> &'static [::qemu_api::bindings::Property] {
-                    static PROPERTIES: &[::qemu_api::bindings::Property] =
-                        &[::qemu_api::bindings::Property {
-                            name: ::std::ffi::CStr::as_ptr(c"migrate_clock"),
-                            info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
-                            offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
-                            set_default: true,
-                            defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
-                            ..::qemu_api::zeroable::Zeroable::ZERO
-                        }];
-                    PROPERTIES
-                }
+                const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
+                    ::qemu_api::bindings::Property {
+                        name: ::std::ffi::CStr::as_ptr(c"migrate_clock"),
+                        info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                        offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                        set_default: true,
+                        defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                        ..::qemu_api::zeroable::Zeroable::ZERO
+                    }
+                ];
             }
         }
     );
@@ -130,18 +128,16 @@ fn test_derive_device() {
         },
         quote! {
             unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
-                fn properties() -> &'static [::qemu_api::bindings::Property] {
-                    static PROPERTIES: &[::qemu_api::bindings::Property] =
-                        &[::qemu_api::bindings::Property {
-                            name: ::std::ffi::CStr::as_ptr(c"migrate-clk"),
-                            info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
-                            offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
-                            set_default: true,
-                            defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
-                            ..::qemu_api::zeroable::Zeroable::ZERO
-                        }];
-                    PROPERTIES
-                }
+                const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
+                    ::qemu_api::bindings::Property {
+                        name: ::std::ffi::CStr::as_ptr(c"migrate-clk"),
+                        info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                        offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                        set_default: true,
+                        defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                        ..::qemu_api::zeroable::Zeroable::ZERO
+                    }
+                ];
             }
         }
     );
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 4dda8c8113..436142d8ae 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -151,11 +151,8 @@ unsafe impl QDevProp for crate::chardev::CharBackend {
 /// Caller is responsible for the validity of properties array.
 pub unsafe trait DevicePropertiesImpl {
     /// An array providing the properties that the user can set on the
-    /// device.  Not a `const` because referencing statics in constants
-    /// is unstable until Rust 1.83.0.
-    fn properties() -> &'static [Property] {
-        &[]
-    }
+    /// device.
+    const PROPERTIES: &'static [Property] = &[];
 }
 
 /// Trait providing the contents of [`DeviceClass`].
@@ -173,9 +170,7 @@ pub trait DeviceImpl:
     /// A `VMStateDescription` providing the migration format for the device
     /// Not a `const` because referencing statics in constants is unstable
     /// until Rust 1.83.0.
-    fn vmsd() -> Option<VMStateDescription<Self>> {
-        None
-    }
+    const VMSTATE: Option<VMStateDescription<Self>> = None;
 }
 
 /// # Safety
@@ -224,12 +219,10 @@ impl DeviceClass {
         if <T as DeviceImpl>::REALIZE.is_some() {
             self.realize = Some(rust_realize_fn::<T>);
         }
-        if let Some(vmsd) = <T as DeviceImpl>::vmsd() {
-            // Give a 'static lifetime to the return value of vmsd().
-            // Temporary until vmsd() can be changed into a const.
-            self.vmsd = Box::leak(Box::new(vmsd.get()));
+        if let Some(ref vmsd) = <T as DeviceImpl>::VMSTATE {
+            self.vmsd = vmsd.as_ref();
         }
-        let prop = <T as DevicePropertiesImpl>::properties();
+        let prop = <T as DevicePropertiesImpl>::PROPERTIES;
         if !prop.is_empty() {
             unsafe {
                 bindings::device_class_set_props_n(self, prop.as_ptr(), prop.len());
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index 4d4e4653f3..1349568741 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -56,9 +56,7 @@ impl ObjectImpl for DummyState {
 impl ResettablePhasesImpl for DummyState {}
 
 impl DeviceImpl for DummyState {
-    fn vmsd() -> Option<VMStateDescription<Self>> {
-        Some(VMSTATE)
-    }
+    const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE);
 }
 
 #[repr(C)]

From 945bf29aa82a2dfca3f69a19b7d048cddcc095bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:42 +0200
Subject: [PATCH 0476/2396] docs/rust: update msrv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-2-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst | 2 +-
 rust/Cargo.toml     | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 10b0590b56..20d15347de 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -1,4 +1,4 @@
-.. |msrv| replace:: 1.63.0
+.. |msrv| replace:: 1.83.0
 
 Rust in QEMU
 ============
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 99c275f2d9..9b26aa07ce 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -13,6 +13,7 @@ edition = "2021"
 homepage = "https://www.qemu.org"
 license = "GPL-2.0-or-later"
 repository = "https://gitlab.com/qemu-project/qemu/"
+# don't forget to update docs/devel/rust.rst msrv
 rust-version = "1.83.0"
 
 [workspace.dependencies]

From f665219b03dda114539c637c50c748a2ebd73c82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:43 +0200
Subject: [PATCH 0477/2396] rust: remove unused global qemu "allocator"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The global allocator has always been disabled. There is no clear reason
Rust and C should use the same allocator. Allocations made from Rust
must be freed by Rust, and same for C, otherwise we head into troubles.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-3-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build               |   4 --
 rust/Cargo.toml           |   2 +-
 rust/qemu-api/Cargo.toml  |   1 -
 rust/qemu-api/meson.build |   1 -
 rust/qemu-api/src/lib.rs  | 135 --------------------------------------
 5 files changed, 1 insertion(+), 142 deletions(-)

diff --git a/meson.build b/meson.build
index a238df3f5e..6ade30f36a 100644
--- a/meson.build
+++ b/meson.build
@@ -1086,9 +1086,6 @@ glib = declare_dependency(dependencies: [glib_pc, gmodule],
 # TODO: remove this check and the corresponding workaround (qtree) when
 # the minimum supported glib is >= 2.75.3
 glib_has_gslice = glib.version().version_compare('<2.75.3')
-# Check whether glib has the aligned_alloc family of functions.
-# <https://docs.gtk.org/glib/func.aligned_alloc.html>
-glib_has_aligned_alloc = glib.version().version_compare('>=2.72.0')
 
 # override glib dep to include the above refinements
 meson.override_dependency('glib-2.0', glib)
@@ -2702,7 +2699,6 @@ config_host_data.set('CONFIG_GETLOADAVG', cc.has_function('getloadavg'))
 config_host_data.set('HAVE_COPY_FILE_RANGE', cc.has_function('copy_file_range'))
 config_host_data.set('HAVE_GETIFADDRS', cc.has_function('getifaddrs'))
 config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', glib_has_gslice)
-config_host_data.set('HAVE_GLIB_WITH_ALIGNED_ALLOC', glib_has_aligned_alloc)
 config_host_data.set('HAVE_OPENPTY', cc.has_function('openpty', dependencies: util))
 config_host_data.set('HAVE_STRCHRNUL', cc.has_function('strchrnul', prefix: osdep_prefix))
 config_host_data.set('HAVE_SYSTEM_FUNCTION', cc.has_function('system', prefix: '#include <stdlib.h>'))
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 9b26aa07ce..d98d2b7702 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -23,7 +23,7 @@ libc = "0.2.162"
 
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = [
-    'cfg(MESON)', 'cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)',
+    'cfg(MESON)',
 ] }
 
 # Occasionally, we may need to silence warnings and clippy lints that
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index c07a17a28b..c5ed78035b 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -21,7 +21,6 @@ libc = { workspace = true }
 
 [features]
 default = ["debug_cell"]
-allocator = []
 debug_cell = []
 
 [lints]
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index a090297c45..062009f161 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -2,7 +2,6 @@ _qemu_api_cfg = run_command(rustc_args,
   '--config-headers', config_host_h, '--features', files('Cargo.toml'),
   capture: true, check: true).stdout().strip().splitlines()
 
-# _qemu_api_cfg += ['--cfg', 'feature="allocator"']
 if get_option('debug_mutex')
   _qemu_api_cfg += ['--cfg', 'feature="debug_cell"']
 endif
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index bcb51c7986..daa2493bb6 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -36,139 +36,4 @@ pub mod zeroable;
 // crate).
 extern crate self as qemu_api;
 
-use std::{
-    alloc::{GlobalAlloc, Layout},
-    ffi::c_void,
-};
-
 pub use error::{Error, Result};
-
-#[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)]
-extern "C" {
-    fn g_aligned_alloc0(
-        n_blocks: bindings::gsize,
-        n_block_bytes: bindings::gsize,
-        alignment: bindings::gsize,
-    ) -> bindings::gpointer;
-    fn g_aligned_free(mem: bindings::gpointer);
-}
-
-#[cfg(not(HAVE_GLIB_WITH_ALIGNED_ALLOC))]
-extern "C" {
-    fn qemu_memalign(alignment: usize, size: usize) -> *mut c_void;
-    fn qemu_vfree(ptr: *mut c_void);
-}
-
-extern "C" {
-    fn g_malloc0(n_bytes: bindings::gsize) -> bindings::gpointer;
-    fn g_free(mem: bindings::gpointer);
-}
-
-/// An allocator that uses the same allocator as QEMU in C.
-///
-/// It is enabled by default with the `allocator` feature.
-///
-/// To set it up manually as a global allocator in your crate:
-///
-/// ```ignore
-/// use qemu_api::QemuAllocator;
-///
-/// #[global_allocator]
-/// static GLOBAL: QemuAllocator = QemuAllocator::new();
-/// ```
-#[derive(Clone, Copy, Debug)]
-#[repr(C)]
-pub struct QemuAllocator {
-    _unused: [u8; 0],
-}
-
-#[cfg_attr(all(feature = "allocator", not(test)), global_allocator)]
-pub static GLOBAL: QemuAllocator = QemuAllocator::new();
-
-impl QemuAllocator {
-    // From the glibc documentation, on GNU systems, malloc guarantees 16-byte
-    // alignment on 64-bit systems and 8-byte alignment on 32-bit systems. See
-    // https://www.gnu.org/software/libc/manual/html_node/Malloc-Examples.html.
-    // This alignment guarantee also applies to Windows and Android. On Darwin
-    // and OpenBSD, the alignment is 16 bytes on both 64-bit and 32-bit systems.
-    #[cfg(all(
-        target_pointer_width = "32",
-        not(any(target_os = "macos", target_os = "openbsd"))
-    ))]
-    pub const DEFAULT_ALIGNMENT_BYTES: Option<usize> = Some(8);
-    #[cfg(all(
-        target_pointer_width = "64",
-        not(any(target_os = "macos", target_os = "openbsd"))
-    ))]
-    pub const DEFAULT_ALIGNMENT_BYTES: Option<usize> = Some(16);
-    #[cfg(all(
-        any(target_pointer_width = "32", target_pointer_width = "64"),
-        any(target_os = "macos", target_os = "openbsd")
-    ))]
-    pub const DEFAULT_ALIGNMENT_BYTES: Option<usize> = Some(16);
-    #[cfg(not(any(target_pointer_width = "32", target_pointer_width = "64")))]
-    pub const DEFAULT_ALIGNMENT_BYTES: Option<usize> = None;
-
-    pub const fn new() -> Self {
-        Self { _unused: [] }
-    }
-}
-
-impl Default for QemuAllocator {
-    fn default() -> Self {
-        Self::new()
-    }
-}
-
-// Sanity check.
-const _: [(); 8] = [(); ::core::mem::size_of::<*mut c_void>()];
-
-unsafe impl GlobalAlloc for QemuAllocator {
-    unsafe fn alloc(&self, layout: Layout) -> *mut u8 {
-        if matches!(Self::DEFAULT_ALIGNMENT_BYTES, Some(default) if default.checked_rem(layout.align()) == Some(0))
-        {
-            // SAFETY: g_malloc0() is safe to call.
-            unsafe { g_malloc0(layout.size().try_into().unwrap()).cast::<u8>() }
-        } else {
-            #[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)]
-            {
-                // SAFETY: g_aligned_alloc0() is safe to call.
-                unsafe {
-                    g_aligned_alloc0(
-                        layout.size().try_into().unwrap(),
-                        1,
-                        layout.align().try_into().unwrap(),
-                    )
-                    .cast::<u8>()
-                }
-            }
-            #[cfg(not(HAVE_GLIB_WITH_ALIGNED_ALLOC))]
-            {
-                // SAFETY: qemu_memalign() is safe to call.
-                unsafe { qemu_memalign(layout.align(), layout.size()).cast::<u8>() }
-            }
-        }
-    }
-
-    unsafe fn dealloc(&self, ptr: *mut u8, layout: Layout) {
-        if matches!(Self::DEFAULT_ALIGNMENT_BYTES, Some(default) if default.checked_rem(layout.align()) == Some(0))
-        {
-            // SAFETY: `ptr` must have been allocated by Self::alloc thus a valid
-            // glib-allocated pointer, so `g_free`ing is safe.
-            unsafe { g_free(ptr.cast::<_>()) }
-        } else {
-            #[cfg(HAVE_GLIB_WITH_ALIGNED_ALLOC)]
-            {
-                // SAFETY: `ptr` must have been allocated by Self::alloc thus a valid aligned
-                // glib-allocated pointer, so `g_aligned_free`ing is safe.
-                unsafe { g_aligned_free(ptr.cast::<_>()) }
-            }
-            #[cfg(not(HAVE_GLIB_WITH_ALIGNED_ALLOC))]
-            {
-                // SAFETY: `ptr` must have been allocated by Self::alloc thus a valid aligned
-                // glib-allocated pointer, so `qemu_vfree`ing is safe.
-                unsafe { qemu_vfree(ptr.cast::<_>()) }
-            }
-        }
-    }
-}

From d85df9a8e2436d1243a28f580e1bf155519dfdfe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:44 +0200
Subject: [PATCH 0478/2396] rust: add workspace authors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-4-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index d98d2b7702..cd4bf8ef8e 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -15,6 +15,7 @@ license = "GPL-2.0-or-later"
 repository = "https://gitlab.com/qemu-project/qemu/"
 # don't forget to update docs/devel/rust.rst msrv
 rust-version = "1.83.0"
+authors = ["The QEMU Project Developers <qemu-devel@nongnu.org>"]
 
 [workspace.dependencies]
 anyhow = "~1.0"

From 88cf78e9172850c786d24d298adfadd09ec43a80 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:45 +0200
Subject: [PATCH 0479/2396] rust: move vmstate_clock!() to qdev module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will allow to split vmstate to a standalone crate next.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-8-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/qdev.rs    |  3 +++
 rust/qemu-api/src/vmstate.rs | 14 ++++++--------
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 436142d8ae..e2b4121cac 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -17,6 +17,7 @@ use crate::{
     cell::{bql_locked, Opaque},
     chardev::Chardev,
     error::{Error, Result},
+    impl_vmstate_c_struct,
     irq::InterruptSource,
     prelude::*,
     qom::{ObjectClass, ObjectImpl, Owned, ParentInit},
@@ -455,3 +456,5 @@ unsafe impl ObjectType for Clock {
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_CLOCK) };
 }
 qom_isa!(Clock: Object);
+
+impl_vmstate_c_struct!(Clock, bindings::vmstate_clock);
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index b5c6b764fb..59c7950a5a 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -41,7 +41,6 @@ use crate::{
     callbacks::FnCall,
     errno::{into_neg_errno, Errno},
     prelude::*,
-    qdev,
     qom::Owned,
     zeroable::Zeroable,
 };
@@ -318,21 +317,20 @@ impl_vmstate_scalar!(vmstate_info_uint32, u32, VMS_VARRAY_UINT32);
 impl_vmstate_scalar!(vmstate_info_uint64, u64);
 impl_vmstate_scalar!(vmstate_info_timer, crate::timer::Timer);
 
+#[macro_export]
 macro_rules! impl_vmstate_c_struct {
     ($type:ty, $vmsd:expr) => {
         unsafe impl VMState for $type {
-            const BASE: VMStateField = $crate::bindings::VMStateField {
-                vmsd: addr_of!($vmsd),
-                size: mem::size_of::<$type>(),
-                flags: VMStateFlags::VMS_STRUCT,
-                ..Zeroable::ZERO
+            const BASE: $crate::bindings::VMStateField = $crate::bindings::VMStateField {
+                vmsd: ::std::ptr::addr_of!($vmsd),
+                size: ::std::mem::size_of::<$type>(),
+                flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
+                ..$crate::zeroable::Zeroable::ZERO
             };
         }
     };
 }
 
-impl_vmstate_c_struct!(qdev::Clock, bindings::vmstate_clock);
-
 // Pointer types using the underlying type's VMState plus VMS_POINTER
 // Note that references are not supported, though references to cells
 // could be allowed.

From 0611dd418abbf5d7c011bd465779cb955cea0f39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:46 +0200
Subject: [PATCH 0480/2396] rust: move VMState handling to QOM module
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will allow to split vmstate to a standalone crate next.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-9-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/qom.rs     |  3 +++
 rust/qemu-api/src/vmstate.rs | 11 +++++------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 014ffb1fd8..12c6fc6752 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -109,6 +109,7 @@ use crate::{
         object_get_typename, object_new, object_ref, object_unref, TypeInfo,
     },
     cell::{bql_locked, Opaque},
+    impl_vmstate_pointer,
 };
 
 /// A safe wrapper around [`bindings::Object`].
@@ -948,3 +949,5 @@ where
 
 impl<T> ObjectClassMethods for T where T: IsA<Object> {}
 impl<R: ObjectDeref> ObjectMethods for R where R::Target: IsA<Object> {}
+
+impl_vmstate_pointer!(Owned<T> where T: VMState + ObjectType);
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 59c7950a5a..4e1086779a 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -40,8 +40,6 @@ use crate::{
     bindings::{self, VMStateFlags},
     callbacks::FnCall,
     errno::{into_neg_errno, Errno},
-    prelude::*,
-    qom::Owned,
     zeroable::Zeroable,
 };
 
@@ -128,7 +126,8 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// * a transparent wrapper for any of the above (`Cell`, `UnsafeCell`,
 ///   [`BqlCell`], [`BqlRefCell`]
 /// * a raw pointer to any of the above
-/// * a `NonNull` pointer, a `Box` or an [`Owned`] for any of the above
+/// * a `NonNull` pointer, a `Box` or an [`Owned`](crate::qom::Owned) for any of
+///   the above
 /// * an array of any of the above
 ///
 /// In order to support other types, the trait `VMState` must be implemented
@@ -335,10 +334,11 @@ macro_rules! impl_vmstate_c_struct {
 // Note that references are not supported, though references to cells
 // could be allowed.
 
+#[macro_export]
 macro_rules! impl_vmstate_pointer {
     ($type:ty where $base:tt: VMState $($where:tt)*) => {
-        unsafe impl<$base> VMState for $type where $base: VMState $($where)* {
-            const BASE: VMStateField = <$base as VMState>::BASE.with_pointer_flag();
+        unsafe impl<$base> $crate::vmstate::VMState for $type where $base: $crate::vmstate::VMState $($where)* {
+            const BASE: $crate::vmstate::VMStateField = <$base as $crate::vmstate::VMState>::BASE.with_pointer_flag();
         }
     };
 }
@@ -350,7 +350,6 @@ impl_vmstate_pointer!(NonNull<T> where T: VMState);
 // Unlike C pointers, Box is always non-null therefore there is no need
 // to specify VMS_ALLOC.
 impl_vmstate_pointer!(Box<T> where T: VMState);
-impl_vmstate_pointer!(Owned<T> where T: VMState + ObjectType);
 
 // Arrays using the underlying type's VMState plus
 // VMS_ARRAY/VMS_ARRAY_OF_POINTER

From a6765c04beac0a3e20032b619df6afbc70b6ef74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:47 +0200
Subject: [PATCH 0481/2396] rust: move Cell vmstate impl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will allow to split vmstate to a standalone crate next.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-10-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/src/cell.rs    |  6 +++++-
 rust/qemu-api/src/vmstate.rs | 14 +++++++-------
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index 148a13e3f5..9943d7286b 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -221,7 +221,7 @@ use std::{
     ptr::NonNull,
 };
 
-use crate::bindings;
+use crate::{bindings, impl_vmstate_transparent};
 
 /// An internal function that is used by doctests.
 pub fn bql_start_test() {
@@ -456,6 +456,8 @@ impl<T: Default> BqlCell<T> {
     }
 }
 
+impl_vmstate_transparent!(crate::cell::BqlCell<T> where T: VMState);
+
 /// A mutable memory location with dynamically checked borrow rules,
 /// protected by the Big QEMU Lock.
 ///
@@ -764,6 +766,8 @@ impl<T> From<T> for BqlRefCell<T> {
     }
 }
 
+impl_vmstate_transparent!(crate::cell::BqlRefCell<T> where T: VMState);
+
 struct BorrowRef<'b> {
     borrow: &'b Cell<BorrowFlag>,
 }
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 4e1086779a..ce42b031bc 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -124,7 +124,8 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// * scalar types (integer and `bool`)
 /// * the C struct `QEMUTimer`
 /// * a transparent wrapper for any of the above (`Cell`, `UnsafeCell`,
-///   [`BqlCell`], [`BqlRefCell`]
+///   [`BqlCell`](crate::cell::BqlCell),
+///   [`BqlRefCell`](crate::cell::BqlRefCell)),
 /// * a raw pointer to any of the above
 /// * a `NonNull` pointer, a `Box` or an [`Owned`](crate::qom::Owned) for any of
 ///   the above
@@ -254,14 +255,15 @@ macro_rules! impl_vmstate_forward {
 
 // Transparent wrappers: just use the internal type
 
+#[macro_export]
 macro_rules! impl_vmstate_transparent {
     ($type:ty where $base:tt: VMState $($where:tt)*) => {
-        unsafe impl<$base> VMState for $type where $base: VMState $($where)* {
-            const BASE: VMStateField = VMStateField {
+        unsafe impl<$base> $crate::vmstate::VMState for $type where $base: $crate::vmstate::VMState $($where)* {
+            const BASE: $crate::vmstate::VMStateField = $crate::vmstate::VMStateField {
                 size: mem::size_of::<$type>(),
-                ..<$base as VMState>::BASE
+                ..<$base as $crate::vmstate::VMState>::BASE
             };
-            const VARRAY_FLAG: VMStateFlags = <$base as VMState>::VARRAY_FLAG;
+            const VARRAY_FLAG: $crate::bindings::VMStateFlags = <$base as $crate::vmstate::VMState>::VARRAY_FLAG;
         }
     };
 }
@@ -269,8 +271,6 @@ macro_rules! impl_vmstate_transparent {
 impl_vmstate_transparent!(std::cell::Cell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::UnsafeCell<T> where T: VMState);
 impl_vmstate_transparent!(std::pin::Pin<T> where T: VMState);
-impl_vmstate_transparent!(crate::cell::BqlCell<T> where T: VMState);
-impl_vmstate_transparent!(crate::cell::BqlRefCell<T> where T: VMState);
 impl_vmstate_transparent!(crate::cell::Opaque<T> where T: VMState);
 
 #[macro_export]

From 593c408a6a8cd8b0af9bf60c7c3625da7910a737 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:48 +0200
Subject: [PATCH 0482/2396] rust: split Rust-only "common" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-6-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                                 |   1 +
 rust/Cargo.lock                             |  10 +
 rust/Cargo.toml                             |   1 +
 rust/common/Cargo.toml                      |  19 ++
 rust/common/meson.build                     |  34 +++
 rust/{qemu-api => common}/src/assertions.rs |  16 +-
 rust/{qemu-api => common}/src/bitops.rs     |   1 -
 rust/{qemu-api => common}/src/callbacks.rs  |  10 +-
 rust/{qemu-api => common}/src/errno.rs      |   8 +-
 rust/common/src/lib.rs                      |  20 ++
 rust/common/src/opaque.rs                   | 238 ++++++++++++++++++++
 rust/{qemu-api => common}/src/uninit.rs     |   2 +-
 rust/common/src/zeroable.rs                 |  18 ++
 rust/hw/char/pl011/Cargo.toml               |   1 +
 rust/hw/char/pl011/meson.build              |   3 +-
 rust/hw/char/pl011/src/device.rs            |   3 +-
 rust/hw/timer/hpet/Cargo.toml               |   1 +
 rust/hw/timer/hpet/meson.build              |   3 +-
 rust/hw/timer/hpet/src/device.rs            |   2 +-
 rust/hw/timer/hpet/src/fw_cfg.rs            |   3 +-
 rust/meson.build                            |   1 +
 rust/qemu-api-macros/src/lib.rs             |  16 +-
 rust/qemu-api-macros/src/tests.rs           |   6 +-
 rust/qemu-api/Cargo.toml                    |   1 +
 rust/qemu-api/meson.build                   |  14 +-
 rust/qemu-api/src/bindings.rs               |  21 ++
 rust/qemu-api/src/cell.rs                   | 235 +------------------
 rust/qemu-api/src/chardev.rs                |   5 +-
 rust/qemu-api/src/error.rs                  |   3 +-
 rust/qemu-api/src/irq.rs                    |   3 +-
 rust/qemu-api/src/lib.rs                    |   6 -
 rust/qemu-api/src/log.rs                    |   4 +-
 rust/qemu-api/src/memory.rs                 |   5 +-
 rust/qemu-api/src/prelude.rs                |   6 +-
 rust/qemu-api/src/qdev.rs                   |  10 +-
 rust/qemu-api/src/qom.rs                    |   3 +-
 rust/qemu-api/src/sysbus.rs                 |   3 +-
 rust/qemu-api/src/timer.rs                  |   8 +-
 rust/qemu-api/src/vmstate.rs                |  23 +-
 rust/qemu-api/src/zeroable.rs               |  37 ---
 rust/qemu-api/tests/vmstate_tests.rs        |   3 +-
 41 files changed, 448 insertions(+), 359 deletions(-)
 create mode 100644 rust/common/Cargo.toml
 create mode 100644 rust/common/meson.build
 rename rust/{qemu-api => common}/src/assertions.rs (92%)
 rename rust/{qemu-api => common}/src/bitops.rs (98%)
 rename rust/{qemu-api => common}/src/callbacks.rs (97%)
 rename rust/{qemu-api => common}/src/errno.rs (98%)
 create mode 100644 rust/common/src/lib.rs
 create mode 100644 rust/common/src/opaque.rs
 rename rust/{qemu-api => common}/src/uninit.rs (98%)
 create mode 100644 rust/common/src/zeroable.rs
 delete mode 100644 rust/qemu-api/src/zeroable.rs

diff --git a/MAINTAINERS b/MAINTAINERS
index fb045388b9..cee5a34206 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3515,6 +3515,7 @@ F: include/hw/registerfields.h
 Rust
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 S: Maintained
+F: rust/common/
 F: rust/qemu-api
 F: rust/qemu-api-macros
 F: rust/rustfmt.toml
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 4baf6ba663..71e8c7ed62 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -44,6 +44,13 @@ dependencies = [
  "qemu_api_macros",
 ]
 
+[[package]]
+name = "common"
+version = "0.1.0"
+dependencies = [
+ "libc",
+]
+
 [[package]]
 name = "either"
 version = "1.12.0"
@@ -63,6 +70,7 @@ dependencies = [
 name = "hpet"
 version = "0.1.0"
 dependencies = [
+ "common",
  "qemu_api",
  "qemu_api_macros",
 ]
@@ -89,6 +97,7 @@ dependencies = [
  "bilge",
  "bilge-impl",
  "bits",
+ "common",
  "qemu_api",
  "qemu_api_macros",
 ]
@@ -130,6 +139,7 @@ name = "qemu_api"
 version = "0.1.0"
 dependencies = [
  "anyhow",
+ "common",
  "foreign",
  "libc",
  "qemu_api_macros",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index cd4bf8ef8e..c0426d4243 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
     "bits",
+    "common",
     "qemu-api-macros",
     "qemu-api",
     "hw/char/pl011",
diff --git a/rust/common/Cargo.toml b/rust/common/Cargo.toml
new file mode 100644
index 0000000000..5e106427e8
--- /dev/null
+++ b/rust/common/Cargo.toml
@@ -0,0 +1,19 @@
+[package]
+name = "common"
+version = "0.1.0"
+description = "Rust common code for QEMU"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+libc.workspace = true
+
+[lints]
+workspace = true
diff --git a/rust/common/meson.build b/rust/common/meson.build
new file mode 100644
index 0000000000..230a967760
--- /dev/null
+++ b/rust/common/meson.build
@@ -0,0 +1,34 @@
+_common_cfg = run_command(rustc_args,
+  '--config-headers', config_host_h, '--features', files('Cargo.toml'),
+  capture: true, check: true).stdout().strip().splitlines()
+
+_common_rs = static_library(
+  'common',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/assertions.rs',
+      'src/bitops.rs',
+      'src/callbacks.rs',
+      'src/errno.rs',
+      'src/opaque.rs',
+      'src/uninit.rs',
+      'src/zeroable.rs',
+    ],
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  rust_args: _common_cfg,
+  dependencies: [libc_rs],
+)
+
+common_rs = declare_dependency(link_with: [_common_rs])
+
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-common-doctests',
+     _common_rs,
+     protocol: 'rust',
+     dependencies: common_rs,
+     suite: ['doc', 'rust'])
diff --git a/rust/qemu-api/src/assertions.rs b/rust/common/src/assertions.rs
similarity index 92%
rename from rust/qemu-api/src/assertions.rs
rename to rust/common/src/assertions.rs
index e4fe23b674..91f83a5d3d 100644
--- a/rust/qemu-api/src/assertions.rs
+++ b/rust/common/src/assertions.rs
@@ -8,7 +8,7 @@
 //! types match the expectations of C code.
 //!
 //! Documentation is hidden because it only exposes macros, which
-//! are exported directly from `qemu_api`.
+//! are exported directly from `common`.
 
 // Based on https://stackoverflow.com/questions/64251852/x/70978292#70978292
 // (stackoverflow answers are released under MIT license).
@@ -27,7 +27,7 @@ impl<T> EqType for T {
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::assert_same_type;
+/// # use common::assert_same_type;
 /// # use std::ops::Deref;
 /// assert_same_type!(u32, u32);
 /// assert_same_type!(<Box<u32> as Deref>::Target, u32);
@@ -36,7 +36,7 @@ impl<T> EqType for T {
 /// Different types will cause a compile failure
 ///
 /// ```compile_fail
-/// # use qemu_api::assert_same_type;
+/// # use common::assert_same_type;
 /// assert_same_type!(&Box<u32>, &u32);
 /// ```
 #[macro_export]
@@ -61,7 +61,7 @@ macro_rules! assert_same_type {
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::assert_field_type;
+/// # use common::assert_field_type;
 /// pub struct A {
 ///     field1: u32,
 /// }
@@ -72,7 +72,7 @@ macro_rules! assert_same_type {
 /// Different types will cause a compile failure
 ///
 /// ```compile_fail
-/// # use qemu_api::assert_field_type;
+/// # use common::assert_field_type;
 /// # pub struct A { field1: u32 }
 /// assert_field_type!(A, field1, i32);
 /// ```
@@ -103,7 +103,7 @@ macro_rules! assert_field_type {
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::assert_match;
+/// # use common::assert_match;
 /// // JoinHandle does not implement `Eq`, therefore the result
 /// // does not either.
 /// let result: Result<std::thread::JoinHandle<()>, u32> = Err(42);
@@ -132,12 +132,12 @@ macro_rules! assert_match {
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::static_assert;
+/// # use common::static_assert;
 /// static_assert!("abc".len() == 3);
 /// ```
 ///
 /// ```compile_fail
-/// # use qemu_api::static_assert;
+/// # use common::static_assert;
 /// static_assert!("abc".len() == 2); // does not compile
 /// ```
 #[macro_export]
diff --git a/rust/qemu-api/src/bitops.rs b/rust/common/src/bitops.rs
similarity index 98%
rename from rust/qemu-api/src/bitops.rs
rename to rust/common/src/bitops.rs
index b1e3a530ab..06c78c3b8a 100644
--- a/rust/qemu-api/src/bitops.rs
+++ b/rust/common/src/bitops.rs
@@ -3,7 +3,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 //! This module provides bit operation extensions to integer types.
-//! It is usually included via the `qemu_api` prelude.
 
 use std::ops::{
     Add, AddAssign, BitAnd, BitAndAssign, BitOr, BitOrAssign, BitXor, BitXorAssign, Div, DivAssign,
diff --git a/rust/qemu-api/src/callbacks.rs b/rust/common/src/callbacks.rs
similarity index 97%
rename from rust/qemu-api/src/callbacks.rs
rename to rust/common/src/callbacks.rs
index dbe2305f50..b8898fe96f 100644
--- a/rust/qemu-api/src/callbacks.rs
+++ b/rust/common/src/callbacks.rs
@@ -55,7 +55,7 @@ use std::{mem, ptr::NonNull};
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::callbacks::FnCall;
+/// # use common::callbacks::FnCall;
 /// fn call_it<F: for<'a> FnCall<(&'a str,), String>>(_f: &F, s: &str) -> String {
 ///     F::call((s,))
 /// }
@@ -71,7 +71,7 @@ use std::{mem, ptr::NonNull};
 /// Attempting to pass a non-zero-sized closure causes a compile-time failure:
 ///
 /// ```compile_fail
-/// # use qemu_api::callbacks::FnCall;
+/// # use common::callbacks::FnCall;
 /// # fn call_it<'a, F: FnCall<(&'a str,), String>>(_f: &F, s: &'a str) -> String {
 /// #     F::call((s,))
 /// # }
@@ -82,7 +82,7 @@ use std::{mem, ptr::NonNull};
 /// `()` can be used to indicate "no function":
 ///
 /// ```
-/// # use qemu_api::callbacks::FnCall;
+/// # use common::callbacks::FnCall;
 /// fn optional<F: for<'a> FnCall<(&'a str,), String>>(_f: &F, s: &str) -> Option<String> {
 ///     if F::IS_SOME {
 ///         Some(F::call((s,)))
@@ -97,7 +97,7 @@ use std::{mem, ptr::NonNull};
 /// Invoking `F::call` will then be a run-time error.
 ///
 /// ```should_panic
-/// # use qemu_api::callbacks::FnCall;
+/// # use common::callbacks::FnCall;
 /// # fn call_it<F: for<'a> FnCall<(&'a str,), String>>(_f: &F, s: &str) -> String {
 /// #     F::call((s,))
 /// # }
@@ -120,7 +120,7 @@ pub unsafe trait FnCall<Args, R = ()>: 'static + Sync + Sized {
     /// You can use `IS_SOME` to catch this at compile time:
     ///
     /// ```compile_fail
-    /// # use qemu_api::callbacks::FnCall;
+    /// # use common::callbacks::FnCall;
     /// fn call_it<F: for<'a> FnCall<(&'a str,), String>>(_f: &F, s: &str) -> String {
     ///     const { assert!(F::IS_SOME) }
     ///     F::call((s,))
diff --git a/rust/qemu-api/src/errno.rs b/rust/common/src/errno.rs
similarity index 98%
rename from rust/qemu-api/src/errno.rs
rename to rust/common/src/errno.rs
index 507850fe33..64b2933b07 100644
--- a/rust/qemu-api/src/errno.rs
+++ b/rust/common/src/errno.rs
@@ -185,7 +185,7 @@ use traits::{GetErrno, MergeErrno};
 /// are interpreted as negated `errno` and turned into an `Err`.
 ///
 /// ```
-/// # use qemu_api::errno::into_io_result;
+/// # use common::errno::into_io_result;
 /// # use std::io::ErrorKind;
 /// let ok = into_io_result(1i32).unwrap();
 /// assert_eq!(ok, 1u32);
@@ -201,7 +201,7 @@ use traits::{GetErrno, MergeErrno};
 /// likely overflows and will panic:
 ///
 /// ```should_panic
-/// # use qemu_api::errno::into_io_result;
+/// # use common::errno::into_io_result;
 /// # #[allow(dead_code)]
 /// let err = into_io_result(-0x1234_5678i32); // panic
 /// ```
@@ -213,7 +213,7 @@ pub fn into_io_result<T: GetErrno>(value: T) -> io::Result<T::Out> {
 /// values to report errors.
 ///
 /// ```
-/// # use qemu_api::errno::into_neg_errno;
+/// # use common::errno::into_neg_errno;
 /// # use std::io::{self, ErrorKind};
 /// let ok: io::Result<()> = Ok(());
 /// assert_eq!(into_neg_errno(ok), 0);
@@ -232,7 +232,7 @@ pub fn into_io_result<T: GetErrno>(value: T) -> io::Result<T::Out> {
 /// positive:
 ///
 /// ```should_panic
-/// # use qemu_api::errno::into_neg_errno;
+/// # use common::errno::into_neg_errno;
 /// # use std::io;
 /// let err: io::Result<u32> = Ok(0x8899_AABB);
 /// into_neg_errno(err) // panic
diff --git a/rust/common/src/lib.rs b/rust/common/src/lib.rs
new file mode 100644
index 0000000000..25216503aa
--- /dev/null
+++ b/rust/common/src/lib.rs
@@ -0,0 +1,20 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod assertions;
+
+pub mod bitops;
+
+pub mod callbacks;
+pub use callbacks::FnCall;
+
+pub mod errno;
+pub use errno::Errno;
+
+pub mod opaque;
+pub use opaque::{Opaque, Wrapper};
+
+pub mod uninit;
+pub use uninit::MaybeUninitField;
+
+pub mod zeroable;
+pub use zeroable::Zeroable;
diff --git a/rust/common/src/opaque.rs b/rust/common/src/opaque.rs
new file mode 100644
index 0000000000..d25a5f3ae1
--- /dev/null
+++ b/rust/common/src/opaque.rs
@@ -0,0 +1,238 @@
+// SPDX-License-Identifier: MIT
+
+//! ## Opaque wrappers
+//!
+//! The cell types from the previous section are useful at the boundaries
+//! of code that requires interior mutability.  When writing glue code that
+//! interacts directly with C structs, however, it is useful to operate
+//! at a lower level.
+//!
+//! C functions often violate Rust's fundamental assumptions about memory
+//! safety by modifying memory even if it is shared.  Furthermore, C structs
+//! often start their life uninitialized and may be populated lazily.
+//!
+//! For this reason, this module provides the [`Opaque<T>`] type to opt out
+//! of Rust's usual guarantees about the wrapped type. Access to the wrapped
+//! value is always through raw pointers, obtained via methods like
+//! [`as_mut_ptr()`](Opaque::as_mut_ptr) and [`as_ptr()`](Opaque::as_ptr). These
+//! pointers can then be passed to C functions or dereferenced; both actions
+//! require `unsafe` blocks, making it clear where safety guarantees must be
+//! manually verified. For example
+//!
+//! ```ignore
+//! unsafe {
+//!     let state = Opaque::<MyStruct>::uninit();
+//!     qemu_struct_init(state.as_mut_ptr());
+//! }
+//! ```
+//!
+//! [`Opaque<T>`] will usually be wrapped one level further, so that
+//! bridge methods can be added to the wrapper:
+//!
+//! ```ignore
+//! pub struct MyStruct(Opaque<bindings::MyStruct>);
+//!
+//! impl MyStruct {
+//!     fn new() -> Pin<Box<MyStruct>> {
+//!         let result = Box::pin(unsafe { Opaque::uninit() });
+//!         unsafe { qemu_struct_init(result.as_mut_ptr()) };
+//!         result
+//!     }
+//! }
+//! ```
+//!
+//! This pattern of wrapping bindgen-generated types in [`Opaque<T>`] provides
+//! several advantages:
+//!
+//! * The choice of traits to be implemented is not limited by the
+//!   bindgen-generated code.  For example, [`Drop`] can be added without
+//!   disabling [`Copy`] on the underlying bindgen type
+//!
+//! * [`Send`] and [`Sync`] implementations can be controlled by the wrapper
+//!   type rather than being automatically derived from the C struct's layout
+//!
+//! * Methods can be implemented in a separate crate from the bindgen-generated
+//!   bindings
+//!
+//! * [`Debug`](std::fmt::Debug) and [`Display`](std::fmt::Display)
+//!   implementations can be customized to be more readable than the raw C
+//!   struct representation
+//!
+//! The [`Opaque<T>`] type does not include BQL validation; it is possible to
+//! assert in the code that the right lock is taken, to use it together
+//! with a custom lock guard type, or to let C code take the lock, as
+//! appropriate.  It is also possible to use it with non-thread-safe
+//! types, since by default (unlike [`BqlCell`] and [`BqlRefCell`]
+//! it is neither `Sync` nor `Send`.
+//!
+//! While [`Opaque<T>`] is necessary for C interop, it should be used sparingly
+//! and only at FFI boundaries. For QEMU-specific types that need interior
+//! mutability, prefer [`BqlCell`] or [`BqlRefCell`].
+//!
+//! [`BqlCell`]: ../../qemu_api/cell/struct.BqlCell.html
+//! [`BqlRefCell`]: ../../qemu_api/cell/struct.BqlRefCell.html
+use std::{cell::UnsafeCell, fmt, marker::PhantomPinned, mem::MaybeUninit, ptr::NonNull};
+
+/// Stores an opaque value that is shared with C code.
+///
+/// Often, C structs can changed when calling a C function even if they are
+/// behind a shared Rust reference, or they can be initialized lazily and have
+/// invalid bit patterns (e.g. `3` for a [`bool`]).  This goes against Rust's
+/// strict aliasing rules, which normally prevent mutation through shared
+/// references.
+///
+/// Wrapping the struct with `Opaque<T>` ensures that the Rust compiler does not
+/// assume the usual constraints that Rust structs require, and allows using
+/// shared references on the Rust side.
+///
+/// `Opaque<T>` is `#[repr(transparent)]`, so that it matches the memory layout
+/// of `T`.
+#[repr(transparent)]
+pub struct Opaque<T> {
+    value: UnsafeCell<MaybeUninit<T>>,
+    // PhantomPinned also allows multiple references to the `Opaque<T>`, i.e.
+    // one `&mut Opaque<T>` can coexist with a `&mut T` or any number of `&T`;
+    // see https://docs.rs/pinned-aliasable/latest/pinned_aliasable/.
+    _pin: PhantomPinned,
+}
+
+impl<T> Opaque<T> {
+    /// Creates a new shared reference from a C pointer
+    ///
+    /// # Safety
+    ///
+    /// The pointer must be valid, though it need not point to a valid value.
+    pub unsafe fn from_raw<'a>(ptr: *mut T) -> &'a Self {
+        let ptr = NonNull::new(ptr).unwrap().cast::<Self>();
+        // SAFETY: Self is a transparent wrapper over T
+        unsafe { ptr.as_ref() }
+    }
+
+    /// Creates a new opaque object with uninitialized contents.
+    ///
+    /// # Safety
+    ///
+    /// Ultimately the pointer to the returned value will be dereferenced
+    /// in another `unsafe` block, for example when passing it to a C function,
+    /// but the functions containing the dereference are usually safe.  The
+    /// value returned from `uninit()` must be initialized and pinned before
+    /// calling them.
+    pub const unsafe fn uninit() -> Self {
+        Self {
+            value: UnsafeCell::new(MaybeUninit::uninit()),
+            _pin: PhantomPinned,
+        }
+    }
+
+    /// Creates a new opaque object with zeroed contents.
+    ///
+    /// # Safety
+    ///
+    /// Ultimately the pointer to the returned value will be dereferenced
+    /// in another `unsafe` block, for example when passing it to a C function,
+    /// but the functions containing the dereference are usually safe.  The
+    /// value returned from `uninit()` must be pinned (and possibly initialized)
+    /// before calling them.
+    pub const unsafe fn zeroed() -> Self {
+        Self {
+            value: UnsafeCell::new(MaybeUninit::zeroed()),
+            _pin: PhantomPinned,
+        }
+    }
+
+    /// Returns a raw mutable pointer to the opaque data.
+    pub const fn as_mut_ptr(&self) -> *mut T {
+        UnsafeCell::get(&self.value).cast()
+    }
+
+    /// Returns a raw pointer to the opaque data.
+    pub const fn as_ptr(&self) -> *const T {
+        self.as_mut_ptr().cast_const()
+    }
+
+    /// Returns a raw pointer to the opaque data that can be passed to a
+    /// C function as `void *`.
+    pub const fn as_void_ptr(&self) -> *mut std::ffi::c_void {
+        UnsafeCell::get(&self.value).cast()
+    }
+
+    /// Converts a raw pointer to the wrapped type.
+    pub const fn raw_get(slot: *mut Self) -> *mut T {
+        // Compare with Linux's raw_get method, which goes through an UnsafeCell
+        // because it takes a *const Self instead.
+        slot.cast()
+    }
+}
+
+impl<T> fmt::Debug for Opaque<T> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        let mut name: String = "Opaque<".to_string();
+        name += std::any::type_name::<T>();
+        name += ">";
+        f.debug_tuple(&name).field(&self.as_ptr()).finish()
+    }
+}
+
+impl<T: Default> Opaque<T> {
+    /// Creates a new opaque object with default contents.
+    ///
+    /// # Safety
+    ///
+    /// Ultimately the pointer to the returned value will be dereferenced
+    /// in another `unsafe` block, for example when passing it to a C function,
+    /// but the functions containing the dereference are usually safe.  The
+    /// value returned from `uninit()` must be pinned before calling them.
+    pub unsafe fn new() -> Self {
+        Self {
+            value: UnsafeCell::new(MaybeUninit::new(T::default())),
+            _pin: PhantomPinned,
+        }
+    }
+}
+
+/// Annotates [`Self`] as a transparent wrapper for another type.
+///
+/// Usually defined via the [`qemu_api_macros::Wrapper`] derive macro.
+///
+/// # Examples
+///
+/// ```
+/// # use std::mem::ManuallyDrop;
+/// # use common::opaque::Wrapper;
+/// #[repr(transparent)]
+/// pub struct Example {
+///     inner: ManuallyDrop<String>,
+/// }
+///
+/// unsafe impl Wrapper for Example {
+///     type Wrapped = String;
+/// }
+/// ```
+///
+/// # Safety
+///
+/// `Self` must be a `#[repr(transparent)]` wrapper for the `Wrapped` type,
+/// whether directly or indirectly.
+///
+/// # Methods
+///
+/// By convention, types that implement Wrapper also implement the following
+/// methods:
+///
+/// ```ignore
+/// pub const unsafe fn from_raw<'a>(value: *mut Self::Wrapped) -> &'a Self;
+/// pub const unsafe fn as_mut_ptr(&self) -> *mut Self::Wrapped;
+/// pub const unsafe fn as_ptr(&self) -> *const Self::Wrapped;
+/// pub const unsafe fn raw_get(slot: *mut Self) -> *const Self::Wrapped;
+/// ```
+///
+/// They are not defined here to allow them to be `const`.
+///
+/// [`qemu_api_macros::Wrapper`]: ../../qemu_api_macros/derive.Wrapper.html
+pub unsafe trait Wrapper {
+    type Wrapped;
+}
+
+unsafe impl<T> Wrapper for Opaque<T> {
+    type Wrapped = T;
+}
diff --git a/rust/qemu-api/src/uninit.rs b/rust/common/src/uninit.rs
similarity index 98%
rename from rust/qemu-api/src/uninit.rs
rename to rust/common/src/uninit.rs
index b0a829729d..e7f9fcd2e3 100644
--- a/rust/qemu-api/src/uninit.rs
+++ b/rust/common/src/uninit.rs
@@ -63,7 +63,7 @@ impl<'a, T, U> DerefMut for MaybeUninitField<'a, T, U> {
 /// }
 ///
 /// # use std::mem::MaybeUninit;
-/// # use qemu_api::{assert_match, uninit_field_mut};
+/// # use common::{assert_match, uninit_field_mut};
 ///
 /// let mut s: MaybeUninit<S> = MaybeUninit::zeroed();
 /// uninit_field_mut!(s, x).write(5);
diff --git a/rust/common/src/zeroable.rs b/rust/common/src/zeroable.rs
new file mode 100644
index 0000000000..fd056deb1f
--- /dev/null
+++ b/rust/common/src/zeroable.rs
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! Defines a trait for structs that can be safely initialized with zero bytes.
+
+/// Encapsulates the requirement that
+/// `MaybeUninit::<Self>::zeroed().assume_init()` does not cause undefined
+/// behavior.
+///
+/// # Safety
+///
+/// Do not add this trait to a type unless all-zeroes is a valid value for the
+/// type.  In particular, raw pointers can be zero, but references and
+/// `NonNull<T>` cannot.
+pub unsafe trait Zeroable: Default {
+    /// Return a value of Self whose memory representation consists of all
+    /// zeroes, with the possible exclusion of padding bytes.
+    const ZERO: Self = unsafe { ::core::mem::MaybeUninit::<Self>::zeroed().assume_init() };
+}
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 88ef110507..6d15f107df 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -16,6 +16,7 @@ rust-version.workspace = true
 bilge = { version = "0.2.0" }
 bilge-impl = { version = "0.2.0" }
 bits = { path = "../../../bits" }
+common = { path = "../../../common" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 2a1be329ab..c4a9f531f7 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -7,7 +7,8 @@ _libpl011_rs = static_library(
     bilge_rs,
     bilge_impl_rs,
     bits_rs,
-    qemu_api,
+    common_rs,
+    qemu_api_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 8411db8d00..b4aa6c45f8 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -4,6 +4,7 @@
 
 use std::{ffi::CStr, mem::size_of};
 
+use common::{static_assert, uninit_field_mut};
 use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
     impl_vmstate_forward, impl_vmstate_struct,
@@ -14,9 +15,7 @@ use qemu_api::{
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
     qom::{ObjectImpl, Owned, ParentField, ParentInit},
-    static_assert,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
-    uninit_field_mut,
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_fields, vmstate_of, vmstate_subsections, vmstate_unused,
 };
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index ac5df23c1d..ba7354f07e 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -11,6 +11,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+common = { path = "../../../common" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index c2d7c0532c..c91d330439 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -4,7 +4,8 @@ _libhpet_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   dependencies: [
-    qemu_api,
+    common_rs,
+    qemu_api_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index dd5326a40d..72375d3155 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -10,6 +10,7 @@ use std::{
     slice::from_ref,
 };
 
+use common::{bitops::IntegerExt, uninit_field_mut};
 use qemu_api::{
     bindings::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
@@ -27,7 +28,6 @@ use qemu_api::{
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
     timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
-    uninit_field_mut,
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
 };
diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index 619d662ee1..0605225fbb 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -4,7 +4,8 @@
 
 use std::ptr::addr_of_mut;
 
-use qemu_api::{cell::bql_locked, zeroable::Zeroable};
+use common::Zeroable;
+use qemu_api::cell::bql_locked;
 
 /// Each `HPETState` represents a Event Timer Block. The v1 spec supports
 /// up to 8 blocks. QEMU only uses 1 block (in PC machine).
diff --git a/rust/meson.build b/rust/meson.build
index 331f11b7e7..402f8d6600 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -22,6 +22,7 @@ qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
 
 genrs = []
 
+subdir('common')
 subdir('qemu-api-macros')
 subdir('bits')
 subdir('qemu-api')
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index a65a7ce2fe..49003a4780 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -97,7 +97,7 @@ fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
         .ident;
 
     Ok(quote! {
-        ::qemu_api::assert_field_type!(#name, #parent,
+        ::common::assert_field_type!(#name, #parent,
             ::qemu_api::qom::ParentField<<#name as ::qemu_api::qom::ObjectImpl>::ParentType>);
 
         ::qemu_api::module_init! {
@@ -125,20 +125,20 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
     let typ = &field.ty;
 
     Ok(quote! {
-        unsafe impl ::qemu_api::cell::Wrapper for #name {
-            type Wrapped = <#typ as ::qemu_api::cell::Wrapper>::Wrapped;
+        unsafe impl ::common::opaque::Wrapper for #name {
+            type Wrapped = <#typ as ::common::opaque::Wrapper>::Wrapped;
         }
         impl #name {
-            pub unsafe fn from_raw<'a>(ptr: *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped) -> &'a Self {
+            pub unsafe fn from_raw<'a>(ptr: *mut <Self as ::common::opaque::Wrapper>::Wrapped) -> &'a Self {
                 let ptr = ::std::ptr::NonNull::new(ptr).unwrap().cast::<Self>();
                 unsafe { ptr.as_ref() }
             }
 
-            pub const fn as_mut_ptr(&self) -> *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped {
+            pub const fn as_mut_ptr(&self) -> *mut <Self as ::common::opaque::Wrapper>::Wrapped {
                 self.0.as_mut_ptr()
             }
 
-            pub const fn as_ptr(&self) -> *const <Self as ::qemu_api::cell::Wrapper>::Wrapped {
+            pub const fn as_ptr(&self) -> *const <Self as ::common::opaque::Wrapper>::Wrapped {
                 self.0.as_ptr()
             }
 
@@ -146,7 +146,7 @@ fn derive_opaque_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
                 self.0.as_void_ptr()
             }
 
-            pub const fn raw_get(slot: *mut Self) -> *mut <Self as ::qemu_api::cell::Wrapper>::Wrapped {
+            pub const fn raw_get(slot: *mut Self) -> *mut <Self as ::common::opaque::Wrapper>::Wrapped {
                 slot.cast()
             }
         }
@@ -282,7 +282,7 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
                 offset: ::core::mem::offset_of!(#name, #field_name) as isize,
                 set_default: #set_default,
                 defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
-                ..::qemu_api::zeroable::Zeroable::ZERO
+                ..::common::Zeroable::ZERO
             }
         });
     }
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index 0e5a572890..ef2806368d 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -108,7 +108,7 @@ fn test_derive_device() {
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
                         set_default: true,
                         defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
-                        ..::qemu_api::zeroable::Zeroable::ZERO
+                        ..::common::Zeroable::ZERO
                     }
                 ];
             }
@@ -135,7 +135,7 @@ fn test_derive_device() {
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
                         set_default: true,
                         defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
-                        ..::qemu_api::zeroable::Zeroable::ZERO
+                        ..::common::Zeroable::ZERO
                     }
                 ];
             }
@@ -165,7 +165,7 @@ fn test_derive_object() {
             }
         },
         quote! {
-            ::qemu_api::assert_field_type!(
+            ::common::assert_field_type!(
                 Foo,
                 _unused,
                 ::qemu_api::qom::ParentField<<Foo as ::qemu_api::qom::ObjectImpl>::ParentType>
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index c5ed78035b..2e0e204491 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -14,6 +14,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+common = { path = "../common" }
 qemu_api_macros = { path = "../qemu-api-macros" }
 anyhow = { workspace = true }
 foreign = { workspace = true }
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 062009f161..64af3caef5 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -52,13 +52,9 @@ _qemu_api_rs = static_library(
   structured_sources(
     [
       'src/lib.rs',
-      'src/assertions.rs',
       'src/bindings.rs',
-      'src/bitops.rs',
-      'src/callbacks.rs',
       'src/cell.rs',
       'src/chardev.rs',
-      'src/errno.rs',
       'src/error.rs',
       'src/irq.rs',
       'src/log.rs',
@@ -69,23 +65,21 @@ _qemu_api_rs = static_library(
       'src/qom.rs',
       'src/sysbus.rs',
       'src/timer.rs',
-      'src/uninit.rs',
       'src/vmstate.rs',
-      'src/zeroable.rs',
     ],
     {'.' : _qemu_api_bindings_inc_rs},
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, foreign_rs, libc_rs, qemu_api_macros, qemuutil_rs,
+  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, qemu_api_macros, qemuutil_rs,
                  qom, hwcore, chardev, migration],
 )
 
 rust.test('rust-qemu-api-tests', _qemu_api_rs,
           suite: ['unit', 'rust'])
 
-qemu_api = declare_dependency(link_with: [_qemu_api_rs],
+qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
   dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
 
 # Doctests are essentially integration tests, so they need the same dependencies.
@@ -94,7 +88,7 @@ qemu_api = declare_dependency(link_with: [_qemu_api_rs],
 rust.doctest('rust-qemu-api-doctests',
      _qemu_api_rs,
      protocol: 'rust',
-     dependencies: qemu_api,
+     dependencies: [qemu_api_rs],
      suite: ['doc', 'rust'])
 
 test('rust-qemu-api-integration',
@@ -104,7 +98,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [qemu_api]),
+        dependencies: [common_rs, qemu_api_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index b8104dea8b..3acdd903b5 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -20,6 +20,8 @@
 
 //! `bindgen`-generated declarations.
 
+use common::Zeroable;
+
 #[cfg(MESON)]
 include!("bindings.inc.rs");
 
@@ -56,3 +58,22 @@ unsafe impl Sync for VMStateField {}
 
 unsafe impl Send for VMStateInfo {}
 unsafe impl Sync for VMStateInfo {}
+
+// bindgen does not derive Default here
+#[allow(clippy::derivable_impls)]
+impl Default for crate::bindings::VMStateFlags {
+    fn default() -> Self {
+        Self(0)
+    }
+}
+
+unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
+unsafe impl Zeroable for crate::bindings::Property {}
+unsafe impl Zeroable for crate::bindings::VMStateFlags {}
+unsafe impl Zeroable for crate::bindings::VMStateField {}
+unsafe impl Zeroable for crate::bindings::VMStateDescription {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
+unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
+unsafe impl Zeroable for crate::bindings::MemTxAttrs {}
+unsafe impl Zeroable for crate::bindings::CharBackend {}
diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index 9943d7286b..d13848df20 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -141,82 +141,13 @@
 //! Multiple immutable borrows are allowed via [`borrow`](BqlRefCell::borrow),
 //! or a single mutable borrow via [`borrow_mut`](BqlRefCell::borrow_mut).  The
 //! thread will panic if these rules are violated or if the BQL is not held.
-//!
-//! ## Opaque wrappers
-//!
-//! The cell types from the previous section are useful at the boundaries
-//! of code that requires interior mutability.  When writing glue code that
-//! interacts directly with C structs, however, it is useful to operate
-//! at a lower level.
-//!
-//! C functions often violate Rust's fundamental assumptions about memory
-//! safety by modifying memory even if it is shared.  Furthermore, C structs
-//! often start their life uninitialized and may be populated lazily.
-//!
-//! For this reason, this module provides the [`Opaque<T>`] type to opt out
-//! of Rust's usual guarantees about the wrapped type. Access to the wrapped
-//! value is always through raw pointers, obtained via methods like
-//! [`as_mut_ptr()`](Opaque::as_mut_ptr) and [`as_ptr()`](Opaque::as_ptr). These
-//! pointers can then be passed to C functions or dereferenced; both actions
-//! require `unsafe` blocks, making it clear where safety guarantees must be
-//! manually verified. For example
-//!
-//! ```ignore
-//! unsafe {
-//!     let state = Opaque::<MyStruct>::uninit();
-//!     qemu_struct_init(state.as_mut_ptr());
-//! }
-//! ```
-//!
-//! [`Opaque<T>`] will usually be wrapped one level further, so that
-//! bridge methods can be added to the wrapper:
-//!
-//! ```ignore
-//! pub struct MyStruct(Opaque<bindings::MyStruct>);
-//!
-//! impl MyStruct {
-//!     fn new() -> Pin<Box<MyStruct>> {
-//!         let result = Box::pin(unsafe { Opaque::uninit() });
-//!         unsafe { qemu_struct_init(result.as_mut_ptr()) };
-//!         result
-//!     }
-//! }
-//! ```
-//!
-//! This pattern of wrapping bindgen-generated types in [`Opaque<T>`] provides
-//! several advantages:
-//!
-//! * The choice of traits to be implemented is not limited by the
-//!   bindgen-generated code.  For example, [`Drop`] can be added without
-//!   disabling [`Copy`] on the underlying bindgen type
-//!
-//! * [`Send`] and [`Sync`] implementations can be controlled by the wrapper
-//!   type rather than being automatically derived from the C struct's layout
-//!
-//! * Methods can be implemented in a separate crate from the bindgen-generated
-//!   bindings
-//!
-//! * [`Debug`](std::fmt::Debug) and [`Display`](std::fmt::Display)
-//!   implementations can be customized to be more readable than the raw C
-//!   struct representation
-//!
-//! The [`Opaque<T>`] type does not include BQL validation; it is possible to
-//! assert in the code that the right lock is taken, to use it together
-//! with a custom lock guard type, or to let C code take the lock, as
-//! appropriate.  It is also possible to use it with non-thread-safe
-//! types, since by default (unlike [`BqlCell`] and [`BqlRefCell`]
-//! it is neither `Sync` nor `Send`.
-//!
-//! While [`Opaque<T>`] is necessary for C interop, it should be used sparingly
-//! and only at FFI boundaries. For QEMU-specific types that need interior
-//! mutability, prefer [`BqlCell`] or [`BqlRefCell`].
 
 use std::{
     cell::{Cell, UnsafeCell},
     cmp::Ordering,
     fmt,
-    marker::{PhantomData, PhantomPinned},
-    mem::{self, MaybeUninit},
+    marker::PhantomData,
+    mem,
     ops::{Deref, DerefMut},
     ptr::NonNull,
 };
@@ -939,165 +870,3 @@ impl<T: fmt::Display> fmt::Display for BqlRefMut<'_, T> {
         (**self).fmt(f)
     }
 }
-
-/// Stores an opaque value that is shared with C code.
-///
-/// Often, C structs can changed when calling a C function even if they are
-/// behind a shared Rust reference, or they can be initialized lazily and have
-/// invalid bit patterns (e.g. `3` for a [`bool`]).  This goes against Rust's
-/// strict aliasing rules, which normally prevent mutation through shared
-/// references.
-///
-/// Wrapping the struct with `Opaque<T>` ensures that the Rust compiler does not
-/// assume the usual constraints that Rust structs require, and allows using
-/// shared references on the Rust side.
-///
-/// `Opaque<T>` is `#[repr(transparent)]`, so that it matches the memory layout
-/// of `T`.
-#[repr(transparent)]
-pub struct Opaque<T> {
-    value: UnsafeCell<MaybeUninit<T>>,
-    // PhantomPinned also allows multiple references to the `Opaque<T>`, i.e.
-    // one `&mut Opaque<T>` can coexist with a `&mut T` or any number of `&T`;
-    // see https://docs.rs/pinned-aliasable/latest/pinned_aliasable/.
-    _pin: PhantomPinned,
-}
-
-impl<T> Opaque<T> {
-    /// Creates a new shared reference from a C pointer
-    ///
-    /// # Safety
-    ///
-    /// The pointer must be valid, though it need not point to a valid value.
-    pub unsafe fn from_raw<'a>(ptr: *mut T) -> &'a Self {
-        let ptr = NonNull::new(ptr).unwrap().cast::<Self>();
-        // SAFETY: Self is a transparent wrapper over T
-        unsafe { ptr.as_ref() }
-    }
-
-    /// Creates a new opaque object with uninitialized contents.
-    ///
-    /// # Safety
-    ///
-    /// Ultimately the pointer to the returned value will be dereferenced
-    /// in another `unsafe` block, for example when passing it to a C function,
-    /// but the functions containing the dereference are usually safe.  The
-    /// value returned from `uninit()` must be initialized and pinned before
-    /// calling them.
-    pub const unsafe fn uninit() -> Self {
-        Self {
-            value: UnsafeCell::new(MaybeUninit::uninit()),
-            _pin: PhantomPinned,
-        }
-    }
-
-    /// Creates a new opaque object with zeroed contents.
-    ///
-    /// # Safety
-    ///
-    /// Ultimately the pointer to the returned value will be dereferenced
-    /// in another `unsafe` block, for example when passing it to a C function,
-    /// but the functions containing the dereference are usually safe.  The
-    /// value returned from `uninit()` must be pinned (and possibly initialized)
-    /// before calling them.
-    pub const unsafe fn zeroed() -> Self {
-        Self {
-            value: UnsafeCell::new(MaybeUninit::zeroed()),
-            _pin: PhantomPinned,
-        }
-    }
-
-    /// Returns a raw mutable pointer to the opaque data.
-    pub const fn as_mut_ptr(&self) -> *mut T {
-        UnsafeCell::get(&self.value).cast()
-    }
-
-    /// Returns a raw pointer to the opaque data.
-    pub const fn as_ptr(&self) -> *const T {
-        self.as_mut_ptr().cast_const()
-    }
-
-    /// Returns a raw pointer to the opaque data that can be passed to a
-    /// C function as `void *`.
-    pub const fn as_void_ptr(&self) -> *mut std::ffi::c_void {
-        UnsafeCell::get(&self.value).cast()
-    }
-
-    /// Converts a raw pointer to the wrapped type.
-    pub const fn raw_get(slot: *mut Self) -> *mut T {
-        // Compare with Linux's raw_get method, which goes through an UnsafeCell
-        // because it takes a *const Self instead.
-        slot.cast()
-    }
-}
-
-impl<T> fmt::Debug for Opaque<T> {
-    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        let mut name: String = "Opaque<".to_string();
-        name += std::any::type_name::<T>();
-        name += ">";
-        f.debug_tuple(&name).field(&self.as_ptr()).finish()
-    }
-}
-
-impl<T: Default> Opaque<T> {
-    /// Creates a new opaque object with default contents.
-    ///
-    /// # Safety
-    ///
-    /// Ultimately the pointer to the returned value will be dereferenced
-    /// in another `unsafe` block, for example when passing it to a C function,
-    /// but the functions containing the dereference are usually safe.  The
-    /// value returned from `uninit()` must be pinned before calling them.
-    pub unsafe fn new() -> Self {
-        Self {
-            value: UnsafeCell::new(MaybeUninit::new(T::default())),
-            _pin: PhantomPinned,
-        }
-    }
-}
-
-/// Annotates [`Self`] as a transparent wrapper for another type.
-///
-/// Usually defined via the [`qemu_api_macros::Wrapper`] derive macro.
-///
-/// # Examples
-///
-/// ```
-/// # use std::mem::ManuallyDrop;
-/// # use qemu_api::cell::Wrapper;
-/// #[repr(transparent)]
-/// pub struct Example {
-///     inner: ManuallyDrop<String>,
-/// }
-///
-/// unsafe impl Wrapper for Example {
-///     type Wrapped = String;
-/// }
-/// ```
-///
-/// # Safety
-///
-/// `Self` must be a `#[repr(transparent)]` wrapper for the `Wrapped` type,
-/// whether directly or indirectly.
-///
-/// # Methods
-///
-/// By convention, types that implement Wrapper also implement the following
-/// methods:
-///
-/// ```ignore
-/// pub const unsafe fn from_raw<'a>(value: *mut Self::Wrapped) -> &'a Self;
-/// pub const unsafe fn as_mut_ptr(&self) -> *mut Self::Wrapped;
-/// pub const unsafe fn as_ptr(&self) -> *const Self::Wrapped;
-/// pub const unsafe fn raw_get(slot: *mut Self) -> *const Self::Wrapped;
-/// ```
-///
-/// They are not defined here to allow them to be `const`.
-pub unsafe trait Wrapper {
-    type Wrapped;
-}
-
-unsafe impl<T> Wrapper for Opaque<T> {
-    type Wrapped = T;
-}
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index cb27be5256..5a351dcecb 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -18,10 +18,11 @@ use std::{
     slice,
 };
 
+use common::{callbacks::FnCall, errno, Opaque};
+
 use crate::{
     bindings,
-    callbacks::FnCall,
-    cell::{BqlRefMut, Opaque},
+    cell::{BqlRefCell, BqlRefMut},
     prelude::*,
 };
 
diff --git a/rust/qemu-api/src/error.rs b/rust/qemu-api/src/error.rs
index e114fc4178..8bac3cbec8 100644
--- a/rust/qemu-api/src/error.rs
+++ b/rust/qemu-api/src/error.rs
@@ -316,10 +316,11 @@ mod tests {
     use std::ffi::CStr;
 
     use anyhow::anyhow;
+    use common::assert_match;
     use foreign::OwnedPointer;
 
     use super::*;
-    use crate::{assert_match, bindings};
+    use crate::bindings;
 
     #[track_caller]
     fn error_for_test(msg: &CStr) -> OwnedPointer<Error> {
diff --git a/rust/qemu-api/src/irq.rs b/rust/qemu-api/src/irq.rs
index 1526e6f63a..ea6b32848c 100644
--- a/rust/qemu-api/src/irq.rs
+++ b/rust/qemu-api/src/irq.rs
@@ -10,9 +10,10 @@ use std::{
     ptr,
 };
 
+use common::Opaque;
+
 use crate::{
     bindings::{self, qemu_set_irq},
-    cell::Opaque,
     prelude::*,
     qom::ObjectClass,
 };
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index daa2493bb6..6232e39e71 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -13,12 +13,8 @@ pub mod bindings;
 #[rustfmt::skip]
 pub mod prelude;
 
-pub mod assertions;
-pub mod bitops;
-pub mod callbacks;
 pub mod cell;
 pub mod chardev;
-pub mod errno;
 pub mod error;
 pub mod irq;
 pub mod log;
@@ -28,9 +24,7 @@ pub mod qdev;
 pub mod qom;
 pub mod sysbus;
 pub mod timer;
-pub mod uninit;
 pub mod vmstate;
-pub mod zeroable;
 
 // Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
 // crate).
diff --git a/rust/qemu-api/src/log.rs b/rust/qemu-api/src/log.rs
index a441b8c1f2..d07f6272dc 100644
--- a/rust/qemu-api/src/log.rs
+++ b/rust/qemu-api/src/log.rs
@@ -8,7 +8,9 @@ use std::{
     ptr::NonNull,
 };
 
-use crate::{bindings, errno};
+use common::errno;
+
+use crate::bindings;
 
 #[repr(u32)]
 /// Represents specific error categories within QEMU's logging system.
diff --git a/rust/qemu-api/src/memory.rs b/rust/qemu-api/src/memory.rs
index e40fad6cf1..f790cb5fd2 100644
--- a/rust/qemu-api/src/memory.rs
+++ b/rust/qemu-api/src/memory.rs
@@ -10,14 +10,11 @@ use std::{
 };
 
 pub use bindings::{hwaddr, MemTxAttrs};
+use common::{callbacks::FnCall, uninit::MaybeUninitField, zeroable::Zeroable, Opaque};
 
 use crate::{
     bindings::{self, device_endian, memory_region_init_io},
-    callbacks::FnCall,
-    cell::Opaque,
     prelude::*,
-    uninit::MaybeUninitField,
-    zeroable::Zeroable,
 };
 
 pub struct MemoryRegionOps<T>(
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index 8f9e23ee2c..dcfe71497f 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -4,13 +4,9 @@
 
 //! Commonly used traits and types for QEMU.
 
-pub use crate::bitops::IntegerExt;
-
 pub use crate::cell::BqlCell;
 pub use crate::cell::BqlRefCell;
 
-pub use crate::errno;
-
 pub use crate::log_mask_ln;
 
 pub use crate::qdev::DeviceMethods;
@@ -19,8 +15,8 @@ pub use crate::qom::InterfaceType;
 pub use crate::qom::IsA;
 pub use crate::qom::Object;
 pub use crate::qom::ObjectCast;
-pub use crate::qom::ObjectDeref;
 pub use crate::qom::ObjectClassMethods;
+pub use crate::qom::ObjectDeref;
 pub use crate::qom::ObjectMethods;
 pub use crate::qom::ObjectType;
 
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index e2b4121cac..8be125fae4 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -10,11 +10,11 @@ use std::{
 };
 
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
+use common::{callbacks::FnCall, Opaque};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
-    callbacks::FnCall,
-    cell::{bql_locked, Opaque},
+    cell::bql_locked,
     chardev::Chardev,
     error::{Error, Result},
     impl_vmstate_c_struct,
@@ -246,7 +246,7 @@ macro_rules! define_property {
             bitnr: $bitnr,
             set_default: true,
             defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
-            ..$crate::zeroable::Zeroable::ZERO
+            ..::common::zeroable::Zeroable::ZERO
         }
     };
     ($name:expr, $state:ty, $field:ident, $prop:expr, $type:ty, default = $defval:expr$(,)*) => {
@@ -257,7 +257,7 @@ macro_rules! define_property {
             offset: ::std::mem::offset_of!($state, $field) as isize,
             set_default: true,
             defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
-            ..$crate::zeroable::Zeroable::ZERO
+            ..::common::zeroable::Zeroable::ZERO
         }
     };
     ($name:expr, $state:ty, $field:ident, $prop:expr, $type:ty$(,)*) => {
@@ -267,7 +267,7 @@ macro_rules! define_property {
             info: $prop,
             offset: ::std::mem::offset_of!($state, $field) as isize,
             set_default: false,
-            ..$crate::zeroable::Zeroable::ZERO
+            ..::common::zeroable::Zeroable::ZERO
         }
     };
 }
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 12c6fc6752..49b4f03ccf 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -102,13 +102,14 @@ use std::{
 };
 
 pub use bindings::ObjectClass;
+use common::Opaque;
 
 use crate::{
     bindings::{
         self, object_class_dynamic_cast, object_dynamic_cast, object_get_class,
         object_get_typename, object_new, object_ref, object_unref, TypeInfo,
     },
-    cell::{bql_locked, Opaque},
+    cell::bql_locked,
     impl_vmstate_pointer,
 };
 
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/qemu-api/src/sysbus.rs
index e92502a8fe..4a5b4cbbf6 100644
--- a/rust/qemu-api/src/sysbus.rs
+++ b/rust/qemu-api/src/sysbus.rs
@@ -7,10 +7,11 @@
 use std::{ffi::CStr, ptr::addr_of_mut};
 
 pub use bindings::SysBusDeviceClass;
+use common::Opaque;
 
 use crate::{
     bindings,
-    cell::{bql_locked, Opaque},
+    cell::bql_locked,
     irq::{IRQState, InterruptSource},
     memory::MemoryRegion,
     prelude::*,
diff --git a/rust/qemu-api/src/timer.rs b/rust/qemu-api/src/timer.rs
index 1e639eaf22..383e1a6e77 100644
--- a/rust/qemu-api/src/timer.rs
+++ b/rust/qemu-api/src/timer.rs
@@ -7,10 +7,10 @@ use std::{
     pin::Pin,
 };
 
-use crate::{
-    bindings::{self, qemu_clock_get_ns, timer_del, timer_init_full, timer_mod, QEMUClockType},
-    callbacks::FnCall,
-    cell::Opaque,
+use common::{callbacks::FnCall, Opaque};
+
+use crate::bindings::{
+    self, qemu_clock_get_ns, timer_del, timer_init_full, timer_mod, QEMUClockType,
 };
 
 /// A safe wrapper around [`bindings::QEMUTimer`].
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index ce42b031bc..06aac3a73f 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -35,14 +35,15 @@ use std::{
     ptr::{addr_of, NonNull},
 };
 
-pub use crate::bindings::{MigrationPriority, VMStateField};
-use crate::{
-    bindings::{self, VMStateFlags},
+use common::{
     callbacks::FnCall,
     errno::{into_neg_errno, Errno},
-    zeroable::Zeroable,
+    Zeroable,
 };
 
+use crate::bindings::{self, VMStateFlags};
+pub use crate::bindings::{MigrationPriority, VMStateField};
+
 /// This macro is used to call a function with a generic argument bound
 /// to the type of a field.  The function must take a
 /// [`PhantomData`]`<T>` argument; `T` is the type of
@@ -271,7 +272,7 @@ macro_rules! impl_vmstate_transparent {
 impl_vmstate_transparent!(std::cell::Cell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::UnsafeCell<T> where T: VMState);
 impl_vmstate_transparent!(std::pin::Pin<T> where T: VMState);
-impl_vmstate_transparent!(crate::cell::Opaque<T> where T: VMState);
+impl_vmstate_transparent!(::common::Opaque<T> where T: VMState);
 
 #[macro_export]
 macro_rules! impl_vmstate_bitsized {
@@ -324,7 +325,7 @@ macro_rules! impl_vmstate_c_struct {
                 vmsd: ::std::ptr::addr_of!($vmsd),
                 size: ::std::mem::size_of::<$type>(),
                 flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
-                ..$crate::zeroable::Zeroable::ZERO
+                ..common::zeroable::Zeroable::ZERO
             };
         }
     };
@@ -367,7 +368,7 @@ macro_rules! vmstate_unused {
             size: $size,
             info: unsafe { ::core::ptr::addr_of!($crate::bindings::vmstate_info_unused_buffer) },
             flags: $crate::bindings::VMStateFlags::VMS_BUFFER,
-            ..$crate::zeroable::Zeroable::ZERO
+            ..::common::Zeroable::ZERO
         }
     }};
 }
@@ -390,7 +391,7 @@ pub type VMSFieldExistCb = unsafe extern "C" fn(
 #[macro_export]
 macro_rules! vmstate_exist_fn {
     ($struct_name:ty, $test_fn:expr) => {{
-        const fn test_cb_builder__<T, F: for<'a> $crate::callbacks::FnCall<(&'a T, u8), bool>>(
+        const fn test_cb_builder__<T, F: for<'a> ::common::callbacks::FnCall<(&'a T, u8), bool>>(
             _phantom: ::core::marker::PhantomData<F>,
         ) -> $crate::vmstate::VMSFieldExistCb {
             const { assert!(F::IS_SOME) };
@@ -414,7 +415,7 @@ macro_rules! vmstate_fields {
             $($field),*,
             $crate::bindings::VMStateField {
                 flags: $crate::bindings::VMStateFlags::VMS_END,
-                ..$crate::zeroable::Zeroable::ZERO
+                ..::common::zeroable::Zeroable::ZERO
             }
         ];
         _FIELDS.as_ptr()
@@ -433,7 +434,7 @@ macro_rules! vmstate_validate {
                     | $crate::bindings::VMStateFlags::VMS_ARRAY.0,
             ),
             num: 0, // 0 elements: no data, only run test_fn callback
-            ..$crate::zeroable::Zeroable::ZERO
+            ..::common::zeroable::Zeroable::ZERO
         }
     };
 }
@@ -455,7 +456,7 @@ macro_rules! impl_vmstate_struct {
                     vmsd: ::core::ptr::addr_of!(*VMSD),
                     size: ::core::mem::size_of::<$type>(),
                     flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
-                    ..$crate::zeroable::Zeroable::ZERO
+                    ..common::Zeroable::ZERO
                 }
             };
         }
diff --git a/rust/qemu-api/src/zeroable.rs b/rust/qemu-api/src/zeroable.rs
deleted file mode 100644
index d8239d0856..0000000000
--- a/rust/qemu-api/src/zeroable.rs
+++ /dev/null
@@ -1,37 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-//! Defines a trait for structs that can be safely initialized with zero bytes.
-
-/// Encapsulates the requirement that
-/// `MaybeUninit::<Self>::zeroed().assume_init()` does not cause undefined
-/// behavior.
-///
-/// # Safety
-///
-/// Do not add this trait to a type unless all-zeroes is a valid value for the
-/// type.  In particular, raw pointers can be zero, but references and
-/// `NonNull<T>` cannot.
-pub unsafe trait Zeroable: Default {
-    /// Return a value of Self whose memory representation consists of all
-    /// zeroes, with the possible exclusion of padding bytes.
-    const ZERO: Self = unsafe { ::core::mem::MaybeUninit::<Self>::zeroed().assume_init() };
-}
-
-// bindgen does not derive Default here
-#[allow(clippy::derivable_impls)]
-impl Default for crate::bindings::VMStateFlags {
-    fn default() -> Self {
-        Self(0)
-    }
-}
-
-unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
-unsafe impl Zeroable for crate::bindings::Property {}
-unsafe impl Zeroable for crate::bindings::VMStateFlags {}
-unsafe impl Zeroable for crate::bindings::VMStateField {}
-unsafe impl Zeroable for crate::bindings::VMStateDescription {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
-unsafe impl Zeroable for crate::bindings::MemTxAttrs {}
-unsafe impl Zeroable for crate::bindings::CharBackend {}
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index 2c0670ba0e..d9e5bcc498 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -9,12 +9,13 @@ use std::{
     slice,
 };
 
+use common::Opaque;
 use qemu_api::{
     bindings::{
         vmstate_info_bool, vmstate_info_int32, vmstate_info_int64, vmstate_info_int8,
         vmstate_info_uint64, vmstate_info_uint8, vmstate_info_unused_buffer, VMStateFlags,
     },
-    cell::{BqlCell, Opaque},
+    cell::BqlCell,
     impl_vmstate_forward, impl_vmstate_struct,
     vmstate::{VMStateDescription, VMStateDescriptionBuilder, VMStateField},
     vmstate_fields, vmstate_of, vmstate_unused, vmstate_validate,

From 1e70d83de4d502759d6e68fbac301c1243088385 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:49 +0200
Subject: [PATCH 0483/2396] rust: make build.rs generic over various
 ./rust/projects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Guess the name of the subdir from the manifest directory, instead of
hard-coding it. In the following commits, other crates can then link to
this file, instead of maintaining their own copy.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-5-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-api/build.rs | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
index 29d0945625..5654d1d562 100644
--- a/rust/qemu-api/build.rs
+++ b/rust/qemu-api/build.rs
@@ -9,12 +9,14 @@ use std::os::windows::fs::symlink_file;
 use std::{env, fs::remove_file, io::Result, path::Path};
 
 fn main() -> Result<()> {
+    let manifest_dir = env!("CARGO_MANIFEST_DIR");
     let file = if let Ok(root) = env::var("MESON_BUILD_ROOT") {
-        format!("{root}/rust/qemu-api/bindings.inc.rs")
+        let sub = get_rust_subdir(manifest_dir).unwrap();
+        format!("{root}/{sub}/bindings.inc.rs")
     } else {
         // Placing bindings.inc.rs in the source directory is supported
         // but not documented or encouraged.
-        format!("{}/src/bindings.inc.rs", env!("CARGO_MANIFEST_DIR"))
+        format!("{manifest_dir}/src/bindings.inc.rs")
     };
 
     let file = Path::new(&file);
@@ -41,3 +43,7 @@ fn main() -> Result<()> {
     println!("cargo:rerun-if-changed=build.rs");
     Ok(())
 }
+
+fn get_rust_subdir(path: &str) -> Option<&str> {
+    path.find("/rust").map(|index| &path[index + 1..])
+}

From 59869b4d58854190f09a79c5392d60fdc0b55d45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:50 +0200
Subject: [PATCH 0484/2396] rust: split "util" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-7-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                           |  1 +
 rust/Cargo.lock                       | 17 +++++++--
 rust/Cargo.toml                       |  5 +--
 rust/hw/char/pl011/Cargo.toml         |  1 +
 rust/hw/char/pl011/meson.build        |  1 +
 rust/hw/char/pl011/src/device.rs      |  7 ++--
 rust/hw/timer/hpet/Cargo.toml         |  1 +
 rust/hw/timer/hpet/meson.build        |  1 +
 rust/hw/timer/hpet/src/device.rs      |  6 +--
 rust/meson.build                      |  1 +
 rust/qemu-api-macros/src/lib.rs       |  2 +-
 rust/qemu-api-macros/src/tests.rs     |  2 +-
 rust/qemu-api/Cargo.toml              |  4 +-
 rust/qemu-api/build.rs                | 50 +-----------------------
 rust/qemu-api/meson.build             | 14 ++-----
 rust/qemu-api/src/bindings.rs         |  1 +
 rust/qemu-api/src/lib.rs              |  6 ---
 rust/qemu-api/src/prelude.rs          |  2 -
 rust/qemu-api/src/qdev.rs             |  4 +-
 rust/qemu-api/src/sysbus.rs           |  2 +-
 rust/qemu-api/src/vmstate.rs          |  2 +-
 rust/qemu-api/tests/tests.rs          |  2 +-
 rust/qemu-api/wrapper.h               |  6 ---
 rust/util/Cargo.toml                  | 23 +++++++++++
 rust/util/build.rs                    | 49 ++++++++++++++++++++++++
 rust/util/meson.build                 | 55 +++++++++++++++++++++++++++
 rust/util/src/bindings.rs             | 25 ++++++++++++
 rust/{qemu-api => util}/src/error.rs  |  5 +--
 rust/util/src/lib.rs                  |  9 +++++
 rust/{qemu-api => util}/src/log.rs    | 12 +++---
 rust/{qemu-api => util}/src/module.rs |  2 +-
 rust/{qemu-api => util}/src/timer.rs  |  0
 rust/util/wrapper.h                   | 32 ++++++++++++++++
 33 files changed, 243 insertions(+), 107 deletions(-)
 mode change 100644 => 120000 rust/qemu-api/build.rs
 create mode 100644 rust/util/Cargo.toml
 create mode 100644 rust/util/build.rs
 create mode 100644 rust/util/meson.build
 create mode 100644 rust/util/src/bindings.rs
 rename rust/{qemu-api => util}/src/error.rs (98%)
 create mode 100644 rust/util/src/lib.rs
 rename rust/{qemu-api => util}/src/log.rs (93%)
 rename rust/{qemu-api => util}/src/module.rs (97%)
 rename rust/{qemu-api => util}/src/timer.rs (100%)
 create mode 100644 rust/util/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index cee5a34206..3d7b47873f 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3519,6 +3519,7 @@ F: rust/common/
 F: rust/qemu-api
 F: rust/qemu-api-macros
 F: rust/rustfmt.toml
+F: rust/util/
 F: scripts/get-wraps-from-cargo-registry.py
 
 Rust-related patches CC here
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 71e8c7ed62..757c03cbde 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -73,6 +73,7 @@ dependencies = [
  "common",
  "qemu_api",
  "qemu_api_macros",
+ "util",
 ]
 
 [[package]]
@@ -100,6 +101,7 @@ dependencies = [
  "common",
  "qemu_api",
  "qemu_api_macros",
+ "util",
 ]
 
 [[package]]
@@ -138,11 +140,9 @@ dependencies = [
 name = "qemu_api"
 version = "0.1.0"
 dependencies = [
- "anyhow",
  "common",
- "foreign",
- "libc",
  "qemu_api_macros",
+ "util",
 ]
 
 [[package]]
@@ -180,6 +180,17 @@ version = "1.0.12"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3354b9ac3fae1ff6755cb6db53683adb661634f67557942dea4facebec0fee4b"
 
+[[package]]
+name = "util"
+version = "0.1.0"
+dependencies = [
+ "anyhow",
+ "common",
+ "foreign",
+ "libc",
+ "qemu_api_macros",
+]
+
 [[package]]
 name = "version_check"
 version = "0.9.4"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index c0426d4243..cfdd535e3b 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -7,6 +7,7 @@ members = [
     "qemu-api",
     "hw/char/pl011",
     "hw/timer/hpet",
+    "util",
 ]
 
 [workspace.package]
@@ -24,9 +25,7 @@ foreign = "~0.3.1"
 libc = "0.2.162"
 
 [workspace.lints.rust]
-unexpected_cfgs = { level = "deny", check-cfg = [
-    'cfg(MESON)',
-] }
+unexpected_cfgs = { level = "deny", check-cfg = ['cfg(MESON)'] }
 
 # Occasionally, we may need to silence warnings and clippy lints that
 # were only introduced in newer Rust compiler versions.  Do not croak
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 6d15f107df..0cf9943fe8 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -17,6 +17,7 @@ bilge = { version = "0.2.0" }
 bilge-impl = { version = "0.2.0" }
 bits = { path = "../../../bits" }
 common = { path = "../../../common" }
+util = { path = "../../../util" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index c4a9f531f7..8a931a4d03 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -9,6 +9,7 @@ _libpl011_rs = static_library(
     bits_rs,
     common_rs,
     qemu_api_rs,
+    util_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index b4aa6c45f8..ab38d57fc4 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -9,8 +9,6 @@ use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
     impl_vmstate_forward, impl_vmstate_struct,
     irq::{IRQState, InterruptSource},
-    log::Log,
-    log_mask_ln,
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
@@ -19,6 +17,7 @@ use qemu_api::{
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_fields, vmstate_of, vmstate_subsections, vmstate_unused,
 };
+use util::{log::Log, log_mask_ln};
 
 use crate::registers::{self, Interrupt, RegisterOffset};
 
@@ -172,7 +171,7 @@ impl ObjectImpl for PL011State {
 
 impl DeviceImpl for PL011State {
     const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE_PL011);
-    const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
+    const REALIZE: Option<fn(&Self) -> util::Result<()>> = Some(Self::realize);
 }
 
 impl ResettablePhasesImpl for PL011State {
@@ -623,7 +622,7 @@ impl PL011State {
         }
     }
 
-    fn realize(&self) -> qemu_api::Result<()> {
+    fn realize(&self) -> util::Result<()> {
         self.char_backend
             .enable_handlers(self, Self::can_receive, Self::receive, Self::event);
         Ok(())
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index ba7354f07e..dd9a5ed3d4 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -12,6 +12,7 @@ rust-version.workspace = true
 
 [dependencies]
 common = { path = "../../../common" }
+util = { path = "../../../util" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index c91d330439..ca09660bf4 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -6,6 +6,7 @@ _libhpet_rs = static_library(
   dependencies: [
     common_rs,
     qemu_api_rs,
+    util_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 72375d3155..2be180fded 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -27,10 +27,10 @@ use qemu_api::{
     qom::{ObjectImpl, ObjectType, ParentField, ParentInit},
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
-    timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
     vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
     vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
 };
+use util::timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND};
 
 use crate::fw_cfg::HPETFwConfig;
 
@@ -728,7 +728,7 @@ impl HPETState {
         }
     }
 
-    fn realize(&self) -> qemu_api::Result<()> {
+    fn realize(&self) -> util::Result<()> {
         if self.num_timers < HPET_MIN_TIMERS || self.num_timers > HPET_MAX_TIMERS {
             Err(format!(
                 "hpet.num_timers must be between {HPET_MIN_TIMERS} and {HPET_MAX_TIMERS}"
@@ -1013,7 +1013,7 @@ unsafe impl qemu_api::qdev::DevicePropertiesImpl for HPETState {
 
 impl DeviceImpl for HPETState {
     const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE_HPET);
-    const REALIZE: Option<fn(&Self) -> qemu_api::Result<()>> = Some(Self::realize);
+    const REALIZE: Option<fn(&Self) -> util::Result<()>> = Some(Self::realize);
 }
 
 impl ResettablePhasesImpl for HPETState {
diff --git a/rust/meson.build b/rust/meson.build
index 402f8d6600..a9d715e6e9 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -25,6 +25,7 @@ genrs = []
 subdir('common')
 subdir('qemu-api-macros')
 subdir('bits')
+subdir('util')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 49003a4780..67650a9a26 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -100,7 +100,7 @@ fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
         ::common::assert_field_type!(#name, #parent,
             ::qemu_api::qom::ParentField<<#name as ::qemu_api::qom::ObjectImpl>::ParentType>);
 
-        ::qemu_api::module_init! {
+        ::util::module_init! {
             MODULE_INIT_QOM => unsafe {
                 ::qemu_api::bindings::type_register_static(&<#name as ::qemu_api::qom::ObjectImpl>::TYPE_INFO);
             }
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index ef2806368d..8e71ac6e67 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -170,7 +170,7 @@ fn test_derive_object() {
                 _unused,
                 ::qemu_api::qom::ParentField<<Foo as ::qemu_api::qom::ObjectImpl>::ParentType>
             );
-            ::qemu_api::module_init! {
+            ::util::module_init! {
                 MODULE_INIT_QOM => unsafe {
                     ::qemu_api::bindings::type_register_static(&<Foo as ::qemu_api::qom::ObjectImpl>::TYPE_INFO);
                 }
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 2e0e204491..fbfb894421 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -15,10 +15,8 @@ rust-version.workspace = true
 
 [dependencies]
 common = { path = "../common" }
+util = { path = "../util" }
 qemu_api_macros = { path = "../qemu-api-macros" }
-anyhow = { workspace = true }
-foreign = { workspace = true }
-libc = { workspace = true }
 
 [features]
 default = ["debug_cell"]
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
deleted file mode 100644
index 5654d1d562..0000000000
--- a/rust/qemu-api/build.rs
+++ /dev/null
@@ -1,49 +0,0 @@
-// Copyright 2024, Linaro Limited
-// Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#[cfg(unix)]
-use std::os::unix::fs::symlink as symlink_file;
-#[cfg(windows)]
-use std::os::windows::fs::symlink_file;
-use std::{env, fs::remove_file, io::Result, path::Path};
-
-fn main() -> Result<()> {
-    let manifest_dir = env!("CARGO_MANIFEST_DIR");
-    let file = if let Ok(root) = env::var("MESON_BUILD_ROOT") {
-        let sub = get_rust_subdir(manifest_dir).unwrap();
-        format!("{root}/{sub}/bindings.inc.rs")
-    } else {
-        // Placing bindings.inc.rs in the source directory is supported
-        // but not documented or encouraged.
-        format!("{manifest_dir}/src/bindings.inc.rs")
-    };
-
-    let file = Path::new(&file);
-    if !Path::new(&file).exists() {
-        panic!(concat!(
-            "\n",
-            "    No generated C bindings found! Maybe you wanted one of\n",
-            "    `make clippy`, `make rustfmt`, `make rustdoc`?\n",
-            "\n",
-            "    For other uses of `cargo`, start a subshell with\n",
-            "    `pyvenv/bin/meson devenv`, or point MESON_BUILD_ROOT to\n",
-            "    the top of the build tree."
-        ));
-    }
-
-    let out_dir = env::var("OUT_DIR").unwrap();
-    let dest_path = format!("{out_dir}/bindings.inc.rs");
-    let dest_path = Path::new(&dest_path);
-    if dest_path.symlink_metadata().is_ok() {
-        remove_file(dest_path)?;
-    }
-    symlink_file(file, dest_path)?;
-
-    println!("cargo:rerun-if-changed=build.rs");
-    Ok(())
-}
-
-fn get_rust_subdir(path: &str) -> Option<&str> {
-    path.find("/rust").map(|index| &path[index + 1..])
-}
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/qemu-api/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 64af3caef5..7734f656a2 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -14,10 +14,8 @@ c_enums = [
   'MigrationPolicy',
   'MigrationPriority',
   'QEMUChrEvent',
-  'QEMUClockType',
   'ResetType',
   'device_endian',
-  'module_init_type',
 ]
 _qemu_api_bindgen_args = []
 foreach enum : c_enums
@@ -31,6 +29,7 @@ foreach enum : c_bitfields
   _qemu_api_bindgen_args += ['--bitfield-enum', enum]
 endforeach
 
+_qemu_api_bindgen_args += ['--blocklist-type', 'Error']
 # TODO: Remove this comment when the clang/libclang mismatch issue is solved.
 #
 # Rust bindings generation with `bindgen` might fail in some cases where the
@@ -55,16 +54,12 @@ _qemu_api_rs = static_library(
       'src/bindings.rs',
       'src/cell.rs',
       'src/chardev.rs',
-      'src/error.rs',
       'src/irq.rs',
-      'src/log.rs',
       'src/memory.rs',
-      'src/module.rs',
       'src/prelude.rs',
       'src/qdev.rs',
       'src/qom.rs',
       'src/sysbus.rs',
-      'src/timer.rs',
       'src/vmstate.rs',
     ],
     {'.' : _qemu_api_bindings_inc_rs},
@@ -72,13 +67,10 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, qemu_api_macros, qemuutil_rs,
+  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, qemu_api_macros, util_rs,
                  qom, hwcore, chardev, migration],
 )
 
-rust.test('rust-qemu-api-tests', _qemu_api_rs,
-          suite: ['unit', 'rust'])
-
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
   dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
 
@@ -98,7 +90,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [common_rs, qemu_api_rs]),
+        dependencies: [common_rs, util_rs, qemu_api_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 3acdd903b5..aedf42b652 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -21,6 +21,7 @@
 //! `bindgen`-generated declarations.
 
 use common::Zeroable;
+use util::bindings::Error;
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 6232e39e71..54b252fb2c 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -15,19 +15,13 @@ pub mod prelude;
 
 pub mod cell;
 pub mod chardev;
-pub mod error;
 pub mod irq;
-pub mod log;
 pub mod memory;
-pub mod module;
 pub mod qdev;
 pub mod qom;
 pub mod sysbus;
-pub mod timer;
 pub mod vmstate;
 
 // Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
 // crate).
 extern crate self as qemu_api;
-
-pub use error::{Error, Result};
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index dcfe71497f..3d771481e4 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -7,8 +7,6 @@
 pub use crate::cell::BqlCell;
 pub use crate::cell::BqlRefCell;
 
-pub use crate::log_mask_ln;
-
 pub use crate::qdev::DeviceMethods;
 
 pub use crate::qom::InterfaceType;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 8be125fae4..d87479ce13 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -11,12 +11,12 @@ use std::{
 
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
 use common::{callbacks::FnCall, Opaque};
+use util::{Error, Result};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
     cell::bql_locked,
     chardev::Chardev,
-    error::{Error, Result},
     impl_vmstate_c_struct,
     irq::InterruptSource,
     prelude::*,
@@ -183,7 +183,7 @@ pub trait DeviceImpl:
 /// readable/writeable from one thread at any time.
 unsafe extern "C" fn rust_realize_fn<T: DeviceImpl>(
     dev: *mut bindings::DeviceState,
-    errp: *mut *mut bindings::Error,
+    errp: *mut *mut util::bindings::Error,
 ) {
     let state = NonNull::new(dev).unwrap().cast::<T>();
     let result = T::REALIZE.unwrap()(unsafe { state.as_ref() });
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/qemu-api/src/sysbus.rs
index 4a5b4cbbf6..2dbfc31dbd 100644
--- a/rust/qemu-api/src/sysbus.rs
+++ b/rust/qemu-api/src/sysbus.rs
@@ -114,7 +114,7 @@ where
         unsafe {
             bindings::sysbus_realize(
                 self.upcast().as_mut_ptr(),
-                addr_of_mut!(bindings::error_fatal),
+                addr_of_mut!(util::bindings::error_fatal),
             );
         }
     }
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/qemu-api/src/vmstate.rs
index 06aac3a73f..37e47cc4c6 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/qemu-api/src/vmstate.rs
@@ -315,7 +315,7 @@ impl_vmstate_scalar!(vmstate_info_uint8, u8, VMS_VARRAY_UINT8);
 impl_vmstate_scalar!(vmstate_info_uint16, u16, VMS_VARRAY_UINT16);
 impl_vmstate_scalar!(vmstate_info_uint32, u32, VMS_VARRAY_UINT32);
 impl_vmstate_scalar!(vmstate_info_uint64, u64);
-impl_vmstate_scalar!(vmstate_info_timer, crate::timer::Timer);
+impl_vmstate_scalar!(vmstate_info_timer, util::timer::Timer);
 
 #[macro_export]
 macro_rules! impl_vmstate_c_struct {
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index 1349568741..70ef4a80d5 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -5,7 +5,6 @@
 use std::{ffi::CStr, ptr::addr_of};
 
 use qemu_api::{
-    bindings::{module_call_init, module_init_type},
     cell::{self, BqlCell},
     prelude::*,
     qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
@@ -13,6 +12,7 @@ use qemu_api::{
     sysbus::SysBusDevice,
     vmstate::{VMStateDescription, VMStateDescriptionBuilder},
 };
+use util::bindings::{module_call_init, module_init_type};
 
 mod vmstate_tests;
 
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index 15a1b19847..cc7112406b 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -48,9 +48,6 @@ typedef enum memory_order {
 #endif /* __CLANG_STDATOMIC_H */
 
 #include "qemu/osdep.h"
-#include "qemu/log.h"
-#include "qemu/log-for-trace.h"
-#include "qemu/module.h"
 #include "qemu-io.h"
 #include "system/system.h"
 #include "hw/sysbus.h"
@@ -61,11 +58,8 @@ typedef enum memory_order {
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "hw/irq.h"
-#include "qapi/error.h"
-#include "qapi/error-internal.h"
 #include "migration/vmstate.h"
 #include "chardev/char-serial.h"
 #include "exec/memattrs.h"
-#include "qemu/timer.h"
 #include "system/address-spaces.h"
 #include "hw/char/pl011.h"
diff --git a/rust/util/Cargo.toml b/rust/util/Cargo.toml
new file mode 100644
index 0000000000..637df61060
--- /dev/null
+++ b/rust/util/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "util"
+version = "0.1.0"
+description = "Rust bindings for QEMU/util"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+anyhow = { workspace = true }
+foreign = { workspace = true }
+libc = { workspace = true }
+common = { path = "../common" }
+qemu_api_macros = { path = "../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/util/build.rs b/rust/util/build.rs
new file mode 100644
index 0000000000..5654d1d562
--- /dev/null
+++ b/rust/util/build.rs
@@ -0,0 +1,49 @@
+// Copyright 2024, Linaro Limited
+// Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+#[cfg(unix)]
+use std::os::unix::fs::symlink as symlink_file;
+#[cfg(windows)]
+use std::os::windows::fs::symlink_file;
+use std::{env, fs::remove_file, io::Result, path::Path};
+
+fn main() -> Result<()> {
+    let manifest_dir = env!("CARGO_MANIFEST_DIR");
+    let file = if let Ok(root) = env::var("MESON_BUILD_ROOT") {
+        let sub = get_rust_subdir(manifest_dir).unwrap();
+        format!("{root}/{sub}/bindings.inc.rs")
+    } else {
+        // Placing bindings.inc.rs in the source directory is supported
+        // but not documented or encouraged.
+        format!("{manifest_dir}/src/bindings.inc.rs")
+    };
+
+    let file = Path::new(&file);
+    if !Path::new(&file).exists() {
+        panic!(concat!(
+            "\n",
+            "    No generated C bindings found! Maybe you wanted one of\n",
+            "    `make clippy`, `make rustfmt`, `make rustdoc`?\n",
+            "\n",
+            "    For other uses of `cargo`, start a subshell with\n",
+            "    `pyvenv/bin/meson devenv`, or point MESON_BUILD_ROOT to\n",
+            "    the top of the build tree."
+        ));
+    }
+
+    let out_dir = env::var("OUT_DIR").unwrap();
+    let dest_path = format!("{out_dir}/bindings.inc.rs");
+    let dest_path = Path::new(&dest_path);
+    if dest_path.symlink_metadata().is_ok() {
+        remove_file(dest_path)?;
+    }
+    symlink_file(file, dest_path)?;
+
+    println!("cargo:rerun-if-changed=build.rs");
+    Ok(())
+}
+
+fn get_rust_subdir(path: &str) -> Option<&str> {
+    path.find("/rust").map(|index| &path[index + 1..])
+}
diff --git a/rust/util/meson.build b/rust/util/meson.build
new file mode 100644
index 0000000000..56e929349b
--- /dev/null
+++ b/rust/util/meson.build
@@ -0,0 +1,55 @@
+_util_bindgen_args = []
+c_enums = [
+  'module_init_type',
+  'QEMUClockType',
+]
+foreach enum : c_enums
+  _util_bindgen_args += ['--rustified-enum', enum]
+endforeach
+
+#
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_util_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _util_bindgen_args,
+)
+
+_util_rs = static_library(
+  'util',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/error.rs',
+      'src/log.rs',
+      'src/module.rs',
+      'src/timer.rs',
+    ],
+    {'.': _util_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qemu_api_macros, qom, qemuutil],
+)
+
+util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
+
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-util-rs-doctests',
+     _util_rs,
+     protocol: 'rust',
+     dependencies: util_rs,
+     suite: ['doc', 'rust']
+)
diff --git a/rust/util/src/bindings.rs b/rust/util/src/bindings.rs
new file mode 100644
index 0000000000..9ffff12cde
--- /dev/null
+++ b/rust/util/src/bindings.rs
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
diff --git a/rust/qemu-api/src/error.rs b/rust/util/src/error.rs
similarity index 98%
rename from rust/qemu-api/src/error.rs
rename to rust/util/src/error.rs
index 8bac3cbec8..bfa5a8685b 100644
--- a/rust/qemu-api/src/error.rs
+++ b/rust/util/src/error.rs
@@ -19,7 +19,7 @@
 //!
 //! This module is most commonly used at the boundary between C and Rust code;
 //! other code will usually access it through the
-//! [`qemu_api::Result`](crate::Result) type alias, and will use the
+//! [`utils::Result`](crate::Result) type alias, and will use the
 //! [`std::error::Error`] interface to let C errors participate in Rust's error
 //! handling functionality.
 //!
@@ -30,7 +30,7 @@
 //! type up to C code, or from a combination of the two.
 //!
 //! The third case, corresponding to [`Error::with_error`], is the only one that
-//! requires mentioning [`qemu_api::Error`](crate::Error) explicitly.  Similar
+//! requires mentioning [`utils::Error`](crate::Error) explicitly.  Similar
 //! to how QEMU's C code handles errno values, the string and the
 //! `anyhow::Error` object will be concatenated with `:` as the separator.
 
@@ -320,7 +320,6 @@ mod tests {
     use foreign::OwnedPointer;
 
     use super::*;
-    use crate::bindings;
 
     #[track_caller]
     fn error_for_test(msg: &CStr) -> OwnedPointer<Error> {
diff --git a/rust/util/src/lib.rs b/rust/util/src/lib.rs
new file mode 100644
index 0000000000..16c89b9517
--- /dev/null
+++ b/rust/util/src/lib.rs
@@ -0,0 +1,9 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod bindings;
+pub mod error;
+pub mod log;
+pub mod module;
+pub mod timer;
+
+pub use error::{Error, Result};
diff --git a/rust/qemu-api/src/log.rs b/rust/util/src/log.rs
similarity index 93%
rename from rust/qemu-api/src/log.rs
rename to rust/util/src/log.rs
index d07f6272dc..af9a3e9123 100644
--- a/rust/qemu-api/src/log.rs
+++ b/rust/util/src/log.rs
@@ -49,7 +49,7 @@ impl LogGuard {
     /// # Examples
     ///
     /// ```
-    /// # use qemu_api::log::LogGuard;
+    /// # use util::log::LogGuard;
     /// # use std::io::Write;
     /// if let Some(mut log) = LogGuard::new() {
     ///     writeln!(log, "test");
@@ -116,7 +116,7 @@ impl Drop for LogGuard {
 /// # Example
 ///
 /// ```
-/// use qemu_api::{log::Log, log_mask_ln};
+/// use util::{log::Log, log_mask_ln};
 ///
 /// let error_address = 0xbad;
 /// log_mask_ln!(Log::GuestError, "Address 0x{error_address:x} out of range");
@@ -126,7 +126,7 @@ impl Drop for LogGuard {
 /// trailing `,`:
 ///
 /// ```
-/// use qemu_api::{log::Log, log_mask_ln};
+/// use util::{log::Log, log_mask_ln};
 ///
 /// let error_address = 0xbad;
 /// log_mask_ln!(
@@ -139,12 +139,12 @@ impl Drop for LogGuard {
 macro_rules! log_mask_ln {
     ($mask:expr, $fmt:tt $($args:tt)*) => {{
         // Type assertion to enforce type `Log` for $mask
-        let _: Log = $mask;
+        let _: $crate::log::Log = $mask;
 
         if unsafe {
-            (::qemu_api::bindings::qemu_loglevel & ($mask as std::os::raw::c_int)) != 0
+            ($crate::bindings::qemu_loglevel & ($mask as std::os::raw::c_int)) != 0
         } {
-            _ = ::qemu_api::log::LogGuard::log_fmt(
+            _ = $crate::log::LogGuard::log_fmt(
                 format_args!("{}\n", format_args!($fmt $($args)*)));
         }
     }};
diff --git a/rust/qemu-api/src/module.rs b/rust/util/src/module.rs
similarity index 97%
rename from rust/qemu-api/src/module.rs
rename to rust/util/src/module.rs
index fa5cea3598..06c45fc142 100644
--- a/rust/qemu-api/src/module.rs
+++ b/rust/util/src/module.rs
@@ -36,7 +36,7 @@ macro_rules! module_init {
 
     // shortcut because it's quite common that $body needs unsafe {}
     ($type:ident => unsafe $body:block) => {
-        $crate::module_init! {
+        ::util::module_init! {
             $type => { unsafe { $body } }
         }
     };
diff --git a/rust/qemu-api/src/timer.rs b/rust/util/src/timer.rs
similarity index 100%
rename from rust/qemu-api/src/timer.rs
rename to rust/util/src/timer.rs
diff --git a/rust/util/wrapper.h b/rust/util/wrapper.h
new file mode 100644
index 0000000000..b9ed68a01d
--- /dev/null
+++ b/rust/util/wrapper.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "qapi/error.h"
+#include "qapi/error-internal.h"
+#include "qemu/log-for-trace.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/timer.h"

From 4dff343d2312bfec25f95ab99ed1068511ddbebb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:51 +0200
Subject: [PATCH 0485/2396] rust: split "migration" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-11-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                                 |  1 +
 rust/Cargo.lock                             | 12 +++++
 rust/Cargo.toml                             |  1 +
 rust/hw/char/pl011/Cargo.toml               |  1 +
 rust/hw/char/pl011/meson.build              |  1 +
 rust/hw/char/pl011/src/device.rs            | 13 ++---
 rust/hw/char/pl011/src/registers.rs         |  2 +-
 rust/hw/timer/hpet/Cargo.toml               |  1 +
 rust/hw/timer/hpet/meson.build              |  1 +
 rust/hw/timer/hpet/src/device.rs            | 11 +++--
 rust/meson.build                            |  1 +
 rust/migration/Cargo.toml                   | 21 ++++++++
 rust/migration/build.rs                     |  1 +
 rust/migration/meson.build                  | 53 +++++++++++++++++++++
 rust/migration/src/bindings.rs              | 48 +++++++++++++++++++
 rust/migration/src/lib.rs                   |  6 +++
 rust/{qemu-api => migration}/src/vmstate.rs | 42 +++++++++-------
 rust/migration/wrapper.h                    | 51 ++++++++++++++++++++
 rust/qemu-api/Cargo.toml                    |  1 +
 rust/qemu-api/meson.build                   | 12 ++---
 rust/qemu-api/src/bindings.rs               | 21 +-------
 rust/qemu-api/src/cell.rs                   |  4 +-
 rust/qemu-api/src/lib.rs                    |  1 -
 rust/qemu-api/src/prelude.rs                |  2 -
 rust/qemu-api/src/qdev.rs                   |  3 +-
 rust/qemu-api/src/qom.rs                    |  2 +-
 rust/qemu-api/tests/tests.rs                |  2 +-
 rust/qemu-api/tests/vmstate_tests.rs        |  4 +-
 rust/qemu-api/wrapper.h                     |  1 -
 29 files changed, 252 insertions(+), 68 deletions(-)
 create mode 100644 rust/migration/Cargo.toml
 create mode 120000 rust/migration/build.rs
 create mode 100644 rust/migration/meson.build
 create mode 100644 rust/migration/src/bindings.rs
 create mode 100644 rust/migration/src/lib.rs
 rename rust/{qemu-api => migration}/src/vmstate.rs (95%)
 create mode 100644 rust/migration/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 3d7b47873f..76dcf6ceb2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3516,6 +3516,7 @@ Rust
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 S: Maintained
 F: rust/common/
+F: rust/migration/
 F: rust/qemu-api
 F: rust/qemu-api-macros
 F: rust/rustfmt.toml
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 757c03cbde..048dd74757 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -71,6 +71,7 @@ name = "hpet"
 version = "0.1.0"
 dependencies = [
  "common",
+ "migration",
  "qemu_api",
  "qemu_api_macros",
  "util",
@@ -91,6 +92,15 @@ version = "0.2.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
 
+[[package]]
+name = "migration"
+version = "0.1.0"
+dependencies = [
+ "common",
+ "qemu_api_macros",
+ "util",
+]
+
 [[package]]
 name = "pl011"
 version = "0.1.0"
@@ -99,6 +109,7 @@ dependencies = [
  "bilge-impl",
  "bits",
  "common",
+ "migration",
  "qemu_api",
  "qemu_api_macros",
  "util",
@@ -141,6 +152,7 @@ name = "qemu_api"
 version = "0.1.0"
 dependencies = [
  "common",
+ "migration",
  "qemu_api_macros",
  "util",
 ]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index cfdd535e3b..e0958ef28a 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -3,6 +3,7 @@ resolver = "2"
 members = [
     "bits",
     "common",
+    "migration",
     "qemu-api-macros",
     "qemu-api",
     "hw/char/pl011",
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 0cf9943fe8..7fd7531823 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -18,6 +18,7 @@ bilge-impl = { version = "0.2.0" }
 bits = { path = "../../../bits" }
 common = { path = "../../../common" }
 util = { path = "../../../util" }
+migration = { path = "../../../migration" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 8a931a4d03..2198fcee9b 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -10,6 +10,7 @@ _libpl011_rs = static_library(
     common_rs,
     qemu_api_rs,
     util_rs,
+    migration_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index ab38d57fc4..225be34e08 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -5,17 +5,18 @@
 use std::{ffi::CStr, mem::size_of};
 
 use common::{static_assert, uninit_field_mut};
+use migration::{
+    self, impl_vmstate_forward, impl_vmstate_struct, vmstate_fields, vmstate_of,
+    vmstate_subsections, vmstate_unused, VMStateDescription, VMStateDescriptionBuilder,
+};
 use qemu_api::{
     chardev::{CharBackend, Chardev, Event},
-    impl_vmstate_forward, impl_vmstate_struct,
     irq::{IRQState, InterruptSource},
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
     qom::{ObjectImpl, Owned, ParentField, ParentInit},
     sysbus::{SysBusDevice, SysBusDeviceImpl},
-    vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
-    vmstate_fields, vmstate_of, vmstate_subsections, vmstate_unused,
 };
 use util::{log::Log, log_mask_ln};
 
@@ -458,10 +459,10 @@ impl PL011Registers {
         false
     }
 
-    pub fn post_load(&mut self) -> Result<(), vmstate::InvalidError> {
+    pub fn post_load(&mut self) -> Result<(), migration::InvalidError> {
         /* Sanity-check input state */
         if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() {
-            return Err(vmstate::InvalidError);
+            return Err(migration::InvalidError);
         }
 
         if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 {
@@ -640,7 +641,7 @@ impl PL011State {
         }
     }
 
-    pub fn post_load(&self, _version_id: u8) -> Result<(), vmstate::InvalidError> {
+    pub fn post_load(&self, _version_id: u8) -> Result<(), migration::InvalidError> {
         self.regs.borrow_mut().post_load()
     }
 }
diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index 7ececd39f8..2bfbd81095 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -10,7 +10,7 @@
 
 use bilge::prelude::*;
 use bits::bits;
-use qemu_api::{impl_vmstate_bitsized, impl_vmstate_forward};
+use migration::{impl_vmstate_bitsized, impl_vmstate_forward};
 
 /// Offset of each register from the base memory address of the device.
 #[doc(alias = "offset")]
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index dd9a5ed3d4..70acdf03d6 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -13,6 +13,7 @@ rust-version.workspace = true
 [dependencies]
 common = { path = "../../../common" }
 util = { path = "../../../util" }
+migration = { path = "../../../migration" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index ca09660bf4..8cd70091e6 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -7,6 +7,7 @@ _libhpet_rs = static_library(
     common_rs,
     qemu_api_rs,
     util_rs,
+    migration_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 2be180fded..1c2253466d 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -11,13 +11,16 @@ use std::{
 };
 
 use common::{bitops::IntegerExt, uninit_field_mut};
+use migration::{
+    self, impl_vmstate_struct, vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
+    VMStateDescription, VMStateDescriptionBuilder,
+};
 use qemu_api::{
     bindings::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
         qdev_prop_uint32, qdev_prop_usize,
     },
     cell::{BqlCell, BqlRefCell},
-    impl_vmstate_struct,
     irq::InterruptSource,
     memory::{
         hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
@@ -27,8 +30,6 @@ use qemu_api::{
     qom::{ObjectImpl, ObjectType, ParentField, ParentInit},
     qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
-    vmstate::{self, VMStateDescription, VMStateDescriptionBuilder},
-    vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
 };
 use util::timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND};
 
@@ -845,7 +846,7 @@ impl HPETState {
         }
     }
 
-    fn pre_save(&self) -> Result<(), vmstate::Infallible> {
+    fn pre_save(&self) -> Result<(), migration::Infallible> {
         if self.is_hpet_enabled() {
             self.counter.set(self.get_ticks());
         }
@@ -859,7 +860,7 @@ impl HPETState {
         Ok(())
     }
 
-    fn post_load(&self, _version_id: u8) -> Result<(), vmstate::Infallible> {
+    fn post_load(&self, _version_id: u8) -> Result<(), migration::Infallible> {
         for timer in self.timers.iter().take(self.num_timers) {
             let mut t = timer.borrow_mut();
 
diff --git a/rust/meson.build b/rust/meson.build
index a9d715e6e9..826949b2e6 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -26,6 +26,7 @@ subdir('common')
 subdir('qemu-api-macros')
 subdir('bits')
 subdir('util')
+subdir('migration')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
new file mode 100644
index 0000000000..98e6df2109
--- /dev/null
+++ b/rust/migration/Cargo.toml
@@ -0,0 +1,21 @@
+[package]
+name = "migration"
+version = "0.1.0"
+description = "Rust bindings for QEMU/migration"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+common = { path = "../common" }
+util = { path = "../util" }
+qemu_api_macros = { path = "../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/migration/build.rs b/rust/migration/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/migration/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
new file mode 100644
index 0000000000..5e820d43f5
--- /dev/null
+++ b/rust/migration/meson.build
@@ -0,0 +1,53 @@
+_migration_bindgen_args = []
+c_bitfields = [
+  'MigrationPolicy',
+  'MigrationPriority',
+  'VMStateFlags',
+]
+foreach enum : c_bitfields
+  _migration_bindgen_args += ['--bitfield-enum', enum]
+endforeach
+#
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_migration_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _migration_bindgen_args,
+  )
+
+_migration_rs = static_library(
+  'migration',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/vmstate.rs',
+    ],
+    {'.' : _migration_bindings_inc_rs},
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  link_with: [_util_rs],
+  dependencies: [common_rs],
+)
+
+migration_rs = declare_dependency(link_with: [_migration_rs],
+  dependencies: [migration, qemuutil])
+
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-migration-rs-doctests',
+     _migration_rs,
+     protocol: 'rust',
+     dependencies: migration_rs,
+     suite: ['doc', 'rust'])
diff --git a/rust/migration/src/bindings.rs b/rust/migration/src/bindings.rs
new file mode 100644
index 0000000000..8ce13a9000
--- /dev/null
+++ b/rust/migration/src/bindings.rs
@@ -0,0 +1,48 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+use common::Zeroable;
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
+
+unsafe impl Send for VMStateDescription {}
+unsafe impl Sync for VMStateDescription {}
+
+unsafe impl Send for VMStateField {}
+unsafe impl Sync for VMStateField {}
+
+unsafe impl Send for VMStateInfo {}
+unsafe impl Sync for VMStateInfo {}
+
+// bindgen does not derive Default here
+#[allow(clippy::derivable_impls)]
+impl Default for VMStateFlags {
+    fn default() -> Self {
+        Self(0)
+    }
+}
+
+unsafe impl Zeroable for VMStateFlags {}
+unsafe impl Zeroable for VMStateField {}
+unsafe impl Zeroable for VMStateDescription {}
diff --git a/rust/migration/src/lib.rs b/rust/migration/src/lib.rs
new file mode 100644
index 0000000000..5f51dde440
--- /dev/null
+++ b/rust/migration/src/lib.rs
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod bindings;
+
+pub mod vmstate;
+pub use vmstate::*;
diff --git a/rust/qemu-api/src/vmstate.rs b/rust/migration/src/vmstate.rs
similarity index 95%
rename from rust/qemu-api/src/vmstate.rs
rename to rust/migration/src/vmstate.rs
index 37e47cc4c6..537d54e436 100644
--- a/rust/qemu-api/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -52,7 +52,7 @@ pub use crate::bindings::{MigrationPriority, VMStateField};
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::call_func_with_field;
+/// # use migration::call_func_with_field;
 /// # use core::marker::PhantomData;
 /// const fn size_of_field<T>(_: PhantomData<T>) -> usize {
 ///     std::mem::size_of::<T>()
@@ -125,17 +125,19 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// * scalar types (integer and `bool`)
 /// * the C struct `QEMUTimer`
 /// * a transparent wrapper for any of the above (`Cell`, `UnsafeCell`,
-///   [`BqlCell`](crate::cell::BqlCell),
-///   [`BqlRefCell`](crate::cell::BqlRefCell)),
+///   [`BqlCell`], [`BqlRefCell`])
 /// * a raw pointer to any of the above
-/// * a `NonNull` pointer, a `Box` or an [`Owned`](crate::qom::Owned) for any of
-///   the above
+/// * a `NonNull` pointer, a `Box` or an [`Owned`] for any of the above
 /// * an array of any of the above
 ///
 /// In order to support other types, the trait `VMState` must be implemented
 /// for them.  The macros [`impl_vmstate_forward`](crate::impl_vmstate_forward),
 /// [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), and
 /// [`impl_vmstate_struct`](crate::impl_vmstate_struct) help with this.
+///
+/// [`BqlCell`]: ../../qemu_api/cell/struct.BqlCell.html
+/// [`BqlRefCell`]: ../../qemu_api/cell/struct.BqlRefCell.html
+/// [`Owned`]: ../../qemu_api/qom/struct.Owned.html
 #[macro_export]
 macro_rules! vmstate_of {
     ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
@@ -161,7 +163,11 @@ macro_rules! vmstate_of {
     };
 }
 
-impl VMStateFlags {
+pub trait VMStateFlagsExt {
+    const VMS_VARRAY_FLAGS: VMStateFlags;
+}
+
+impl VMStateFlagsExt for VMStateFlags {
     const VMS_VARRAY_FLAGS: VMStateFlags = VMStateFlags(
         VMStateFlags::VMS_VARRAY_INT32.0
             | VMStateFlags::VMS_VARRAY_UINT8.0
@@ -207,7 +213,7 @@ impl VMStateField {
     }
 
     #[must_use]
-    pub const fn with_varray_flag_unchecked(mut self, flag: VMStateFlags) -> VMStateField {
+    pub const fn with_varray_flag_unchecked(mut self, flag: VMStateFlags) -> Self {
         self.flags = VMStateFlags(self.flags.0 & !VMStateFlags::VMS_ARRAY.0);
         self.flags = VMStateFlags(self.flags.0 | flag.0);
         self.num = 0; // varray uses num_offset instead of num.
@@ -216,13 +222,13 @@ impl VMStateField {
 
     #[must_use]
     #[allow(unused_mut)]
-    pub const fn with_varray_flag(mut self, flag: VMStateFlags) -> VMStateField {
+    pub const fn with_varray_flag(mut self, flag: VMStateFlags) -> Self {
         assert!((self.flags.0 & VMStateFlags::VMS_ARRAY.0) != 0);
         self.with_varray_flag_unchecked(flag)
     }
 
     #[must_use]
-    pub const fn with_varray_multiply(mut self, num: u32) -> VMStateField {
+    pub const fn with_varray_multiply(mut self, num: u32) -> Self {
         assert!(num <= 0x7FFF_FFFFu32);
         self.flags = VMStateFlags(self.flags.0 | VMStateFlags::VMS_MULTIPLY_ELEMENTS.0);
         self.num = num as i32;
@@ -237,7 +243,7 @@ impl VMStateField {
 /// # Examples
 ///
 /// ```
-/// # use qemu_api::impl_vmstate_forward;
+/// # use migration::impl_vmstate_forward;
 /// pub struct Fifo([u8; 16]);
 /// impl_vmstate_forward!(Fifo);
 /// ```
@@ -272,7 +278,7 @@ macro_rules! impl_vmstate_transparent {
 impl_vmstate_transparent!(std::cell::Cell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::UnsafeCell<T> where T: VMState);
 impl_vmstate_transparent!(std::pin::Pin<T> where T: VMState);
-impl_vmstate_transparent!(::common::Opaque<T> where T: VMState);
+impl_vmstate_transparent!(common::Opaque<T> where T: VMState);
 
 #[macro_export]
 macro_rules! impl_vmstate_bitsized {
@@ -294,12 +300,12 @@ macro_rules! impl_vmstate_bitsized {
 
 macro_rules! impl_vmstate_scalar {
     ($info:ident, $type:ty$(, $varray_flag:ident)?) => {
-        unsafe impl VMState for $type {
-            const BASE: VMStateField = VMStateField {
+        unsafe impl $crate::vmstate::VMState for $type {
+            const BASE: $crate::vmstate::VMStateField = $crate::vmstate::VMStateField {
                 info: addr_of!(bindings::$info),
                 size: mem::size_of::<$type>(),
-                flags: VMStateFlags::VMS_SINGLE,
-                ..Zeroable::ZERO
+                flags: $crate::vmstate::VMStateFlags::VMS_SINGLE,
+                ..::common::zeroable::Zeroable::ZERO
             };
             $(const VARRAY_FLAG: VMStateFlags = VMStateFlags::$varray_flag;)?
         }
@@ -320,12 +326,12 @@ impl_vmstate_scalar!(vmstate_info_timer, util::timer::Timer);
 #[macro_export]
 macro_rules! impl_vmstate_c_struct {
     ($type:ty, $vmsd:expr) => {
-        unsafe impl VMState for $type {
+        unsafe impl $crate::vmstate::VMState for $type {
             const BASE: $crate::bindings::VMStateField = $crate::bindings::VMStateField {
                 vmsd: ::std::ptr::addr_of!($vmsd),
                 size: ::std::mem::size_of::<$type>(),
                 flags: $crate::bindings::VMStateFlags::VMS_STRUCT,
-                ..common::zeroable::Zeroable::ZERO
+                ..::common::zeroable::Zeroable::ZERO
             };
         }
     };
@@ -391,7 +397,7 @@ pub type VMSFieldExistCb = unsafe extern "C" fn(
 #[macro_export]
 macro_rules! vmstate_exist_fn {
     ($struct_name:ty, $test_fn:expr) => {{
-        const fn test_cb_builder__<T, F: for<'a> ::common::callbacks::FnCall<(&'a T, u8), bool>>(
+        const fn test_cb_builder__<T, F: for<'a> ::common::FnCall<(&'a T, u8), bool>>(
             _phantom: ::core::marker::PhantomData<F>,
         ) -> $crate::vmstate::VMSFieldExistCb {
             const { assert!(F::IS_SOME) };
diff --git a/rust/migration/wrapper.h b/rust/migration/wrapper.h
new file mode 100644
index 0000000000..daf316aed4
--- /dev/null
+++ b/rust/migration/wrapper.h
@@ -0,0 +1,51 @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ *
+ * Authors: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+#include "migration/vmstate.h"
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index fbfb894421..7276e67aa9 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -15,6 +15,7 @@ rust-version.workspace = true
 
 [dependencies]
 common = { path = "../common" }
+migration = { path = "../migration" }
 util = { path = "../util" }
 qemu_api_macros = { path = "../qemu-api-macros" }
 
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 7734f656a2..a6b5772d19 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -11,8 +11,6 @@ c_enums = [
   'GpioPolarity',
   'MachineInitPhase',
   'MemoryDeviceInfoKind',
-  'MigrationPolicy',
-  'MigrationPriority',
   'QEMUChrEvent',
   'ResetType',
   'device_endian',
@@ -23,12 +21,13 @@ foreach enum : c_enums
 endforeach
 c_bitfields = [
   'ClockEvent',
-  'VMStateFlags',
 ]
 foreach enum : c_bitfields
   _qemu_api_bindgen_args += ['--bitfield-enum', enum]
 endforeach
 
+_qemu_api_bindgen_args += ['--blocklist-type', 'VMStateDescription']
+
 _qemu_api_bindgen_args += ['--blocklist-type', 'Error']
 # TODO: Remove this comment when the clang/libclang mismatch issue is solved.
 #
@@ -60,15 +59,14 @@ _qemu_api_rs = static_library(
       'src/qdev.rs',
       'src/qom.rs',
       'src/sysbus.rs',
-      'src/vmstate.rs',
     ],
     {'.' : _qemu_api_bindings_inc_rs},
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, qemu_api_macros, util_rs,
-                 qom, hwcore, chardev, migration],
+  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
+                 util_rs, qom, hwcore, chardev],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
@@ -90,7 +88,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [common_rs, util_rs, qemu_api_rs]),
+        dependencies: [common_rs, util_rs, migration_rs, qemu_api_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index aedf42b652..ce00a6e0e4 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -21,6 +21,7 @@
 //! `bindgen`-generated declarations.
 
 use common::Zeroable;
+use migration::bindings::VMStateDescription;
 use util::bindings::Error;
 
 #[cfg(MESON)]
@@ -51,28 +52,8 @@ unsafe impl Sync for Property {}
 unsafe impl Send for TypeInfo {}
 unsafe impl Sync for TypeInfo {}
 
-unsafe impl Send for VMStateDescription {}
-unsafe impl Sync for VMStateDescription {}
-
-unsafe impl Send for VMStateField {}
-unsafe impl Sync for VMStateField {}
-
-unsafe impl Send for VMStateInfo {}
-unsafe impl Sync for VMStateInfo {}
-
-// bindgen does not derive Default here
-#[allow(clippy::derivable_impls)]
-impl Default for crate::bindings::VMStateFlags {
-    fn default() -> Self {
-        Self(0)
-    }
-}
-
 unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
 unsafe impl Zeroable for crate::bindings::Property {}
-unsafe impl Zeroable for crate::bindings::VMStateFlags {}
-unsafe impl Zeroable for crate::bindings::VMStateField {}
-unsafe impl Zeroable for crate::bindings::VMStateDescription {}
 unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
 unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
 unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
diff --git a/rust/qemu-api/src/cell.rs b/rust/qemu-api/src/cell.rs
index d13848df20..b80a0fd80b 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/qemu-api/src/cell.rs
@@ -152,7 +152,9 @@ use std::{
     ptr::NonNull,
 };
 
-use crate::{bindings, impl_vmstate_transparent};
+use migration::impl_vmstate_transparent;
+
+use crate::bindings;
 
 /// An internal function that is used by doctests.
 pub fn bql_start_test() {
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 54b252fb2c..55386f6697 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -20,7 +20,6 @@ pub mod memory;
 pub mod qdev;
 pub mod qom;
 pub mod sysbus;
-pub mod vmstate;
 
 // Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
 // crate).
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index 3d771481e4..c10c171158 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -21,5 +21,3 @@ pub use crate::qom::ObjectType;
 pub use crate::qom_isa;
 
 pub use crate::sysbus::SysBusDeviceMethods;
-
-pub use crate::vmstate::VMState;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index d87479ce13..c81ae7cf45 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -11,17 +11,16 @@ use std::{
 
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
 use common::{callbacks::FnCall, Opaque};
+use migration::{impl_vmstate_c_struct, VMStateDescription};
 use util::{Error, Result};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
     cell::bql_locked,
     chardev::Chardev,
-    impl_vmstate_c_struct,
     irq::InterruptSource,
     prelude::*,
     qom::{ObjectClass, ObjectImpl, Owned, ParentInit},
-    vmstate::VMStateDescription,
 };
 
 /// A safe wrapper around [`bindings::Clock`].
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 49b4f03ccf..7f2f7797e4 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -103,6 +103,7 @@ use std::{
 
 pub use bindings::ObjectClass;
 use common::Opaque;
+use migration::impl_vmstate_pointer;
 
 use crate::{
     bindings::{
@@ -110,7 +111,6 @@ use crate::{
         object_get_typename, object_new, object_ref, object_unref, TypeInfo,
     },
     cell::bql_locked,
-    impl_vmstate_pointer,
 };
 
 /// A safe wrapper around [`bindings::Object`].
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index 70ef4a80d5..92e3534d3c 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -4,13 +4,13 @@
 
 use std::{ffi::CStr, ptr::addr_of};
 
+use migration::{VMStateDescription, VMStateDescriptionBuilder};
 use qemu_api::{
     cell::{self, BqlCell},
     prelude::*,
     qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
     qom::{ObjectImpl, ParentField},
     sysbus::SysBusDevice,
-    vmstate::{VMStateDescription, VMStateDescriptionBuilder},
 };
 use util::bindings::{module_call_init, module_init_type};
 
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index d9e5bcc498..47fc15149b 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -10,16 +10,16 @@ use std::{
 };
 
 use common::Opaque;
-use qemu_api::{
+use migration::{
     bindings::{
         vmstate_info_bool, vmstate_info_int32, vmstate_info_int64, vmstate_info_int8,
         vmstate_info_uint64, vmstate_info_uint8, vmstate_info_unused_buffer, VMStateFlags,
     },
-    cell::BqlCell,
     impl_vmstate_forward, impl_vmstate_struct,
     vmstate::{VMStateDescription, VMStateDescriptionBuilder, VMStateField},
     vmstate_fields, vmstate_of, vmstate_unused, vmstate_validate,
 };
+use qemu_api::cell::BqlCell;
 
 const FOO_ARRAY_MAX: usize = 3;
 
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index cc7112406b..b99df9f568 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -58,7 +58,6 @@ typedef enum memory_order {
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "hw/irq.h"
-#include "migration/vmstate.h"
 #include "chardev/char-serial.h"
 #include "exec/memattrs.h"
 #include "system/address-spaces.h"

From f6b4f0dd9c57079b72ca9ff7569ce4d0dbdcc4d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:52 +0200
Subject: [PATCH 0486/2396] rust: split "bql" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately, an example had to be compile-time disabled, since it
relies on higher level crates (qdev, irq etc). The alternative is
probably to move that code to an example in qemu-api or elsewere and
make a link to it, or include_str.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-12-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                          |  1 +
 rust/Cargo.lock                      | 10 +++
 rust/Cargo.toml                      |  1 +
 rust/bql/Cargo.toml                  | 23 +++++++
 rust/bql/build.rs                    |  1 +
 rust/bql/meson.build                 | 52 ++++++++++++++++
 rust/bql/src/bindings.rs             | 25 ++++++++
 rust/{qemu-api => bql}/src/cell.rs   | 92 ++++++++++------------------
 rust/bql/src/lib.rs                  | 29 +++++++++
 rust/bql/wrapper.h                   | 27 ++++++++
 rust/common/src/opaque.rs            |  4 +-
 rust/hw/char/pl011/Cargo.toml        |  1 +
 rust/hw/char/pl011/meson.build       |  1 +
 rust/hw/char/pl011/src/device.rs     |  1 +
 rust/hw/timer/hpet/Cargo.toml        |  1 +
 rust/hw/timer/hpet/meson.build       |  1 +
 rust/hw/timer/hpet/src/device.rs     |  2 +-
 rust/hw/timer/hpet/src/fw_cfg.rs     |  5 +-
 rust/meson.build                     |  1 +
 rust/migration/src/vmstate.rs        |  4 +-
 rust/qemu-api/Cargo.toml             |  5 +-
 rust/qemu-api/meson.build            | 18 +-----
 rust/qemu-api/src/chardev.rs         | 17 +++--
 rust/qemu-api/src/irq.rs             |  1 +
 rust/qemu-api/src/lib.rs             |  1 -
 rust/qemu-api/src/prelude.rs         |  3 -
 rust/qemu-api/src/qdev.rs            |  5 +-
 rust/qemu-api/src/qom.rs             | 13 ++--
 rust/qemu-api/src/sysbus.rs          | 13 ++--
 rust/qemu-api/tests/tests.rs         |  4 +-
 rust/qemu-api/tests/vmstate_tests.rs |  2 +-
 31 files changed, 244 insertions(+), 120 deletions(-)
 create mode 100644 rust/bql/Cargo.toml
 create mode 120000 rust/bql/build.rs
 create mode 100644 rust/bql/meson.build
 create mode 100644 rust/bql/src/bindings.rs
 rename rust/{qemu-api => bql}/src/cell.rs (92%)
 create mode 100644 rust/bql/src/lib.rs
 create mode 100644 rust/bql/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 76dcf6ceb2..a55d5c95d7 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3515,6 +3515,7 @@ F: include/hw/registerfields.h
 Rust
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 S: Maintained
+F: rust/bql/
 F: rust/common/
 F: rust/migration/
 F: rust/qemu-api
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 048dd74757..73ca9582a5 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -44,6 +44,13 @@ dependencies = [
  "qemu_api_macros",
 ]
 
+[[package]]
+name = "bql"
+version = "0.1.0"
+dependencies = [
+ "migration",
+]
+
 [[package]]
 name = "common"
 version = "0.1.0"
@@ -70,6 +77,7 @@ dependencies = [
 name = "hpet"
 version = "0.1.0"
 dependencies = [
+ "bql",
  "common",
  "migration",
  "qemu_api",
@@ -108,6 +116,7 @@ dependencies = [
  "bilge",
  "bilge-impl",
  "bits",
+ "bql",
  "common",
  "migration",
  "qemu_api",
@@ -151,6 +160,7 @@ dependencies = [
 name = "qemu_api"
 version = "0.1.0"
 dependencies = [
+ "bql",
  "common",
  "migration",
  "qemu_api_macros",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index e0958ef28a..8be90da8ff 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -2,6 +2,7 @@
 resolver = "2"
 members = [
     "bits",
+    "bql",
     "common",
     "migration",
     "qemu-api-macros",
diff --git a/rust/bql/Cargo.toml b/rust/bql/Cargo.toml
new file mode 100644
index 0000000000..1041bd4ea9
--- /dev/null
+++ b/rust/bql/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "bql"
+version = "0.1.0"
+description = "Rust bindings for QEMU/BQL"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+migration = { path = "../migration" }
+
+[features]
+default = ["debug_cell"]
+debug_cell = []
+
+[lints]
+workspace = true
diff --git a/rust/bql/build.rs b/rust/bql/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/bql/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/bql/meson.build b/rust/bql/meson.build
new file mode 100644
index 0000000000..f369209dfd
--- /dev/null
+++ b/rust/bql/meson.build
@@ -0,0 +1,52 @@
+_bql_cfg = run_command(rustc_args,
+  '--config-headers', config_host_h, '--features', files('Cargo.toml'),
+  capture: true, check: true).stdout().strip().splitlines()
+
+if get_option('debug_mutex')
+  _bql_cfg += ['--cfg', 'feature="debug_cell"']
+endif
+
+#
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_bql_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common,
+)
+
+_bql_rs = static_library(
+  'bql',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/cell.rs',
+    ],
+    {'.': _bql_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  rust_args: _bql_cfg,
+  link_with: [_migration_rs],
+)
+
+bql_rs = declare_dependency(link_with: [_bql_rs],
+  dependencies: [qemuutil])
+
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-bql-rs-doctests',
+     _bql_rs,
+     protocol: 'rust',
+     dependencies: bql_rs,
+     suite: ['doc', 'rust'])
diff --git a/rust/bql/src/bindings.rs b/rust/bql/src/bindings.rs
new file mode 100644
index 0000000000..9ffff12cde
--- /dev/null
+++ b/rust/bql/src/bindings.rs
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
diff --git a/rust/qemu-api/src/cell.rs b/rust/bql/src/cell.rs
similarity index 92%
rename from rust/qemu-api/src/cell.rs
rename to rust/bql/src/cell.rs
index b80a0fd80b..25007427ed 100644
--- a/rust/qemu-api/src/cell.rs
+++ b/rust/bql/src/cell.rs
@@ -75,9 +75,10 @@
 //!
 //! ### Example
 //!
-//! ```
+//! ```ignore
+//! # use bql::BqlRefCell;
 //! # use qemu_api::prelude::*;
-//! # use qemu_api::{cell::BqlRefCell, irq::InterruptSource, irq::IRQState};
+//! # use qemu_api::{irq::InterruptSource, irq::IRQState};
 //! # use qemu_api::{sysbus::SysBusDevice, qom::Owned, qom::ParentField};
 //! # const N_GPIOS: usize = 8;
 //! # struct PL061Registers { /* ... */ }
@@ -141,7 +142,6 @@
 //! Multiple immutable borrows are allowed via [`borrow`](BqlRefCell::borrow),
 //! or a single mutable borrow via [`borrow_mut`](BqlRefCell::borrow_mut).  The
 //! thread will panic if these rules are violated or if the BQL is not held.
-
 use std::{
     cell::{Cell, UnsafeCell},
     cmp::Ordering,
@@ -154,30 +154,6 @@ use std::{
 
 use migration::impl_vmstate_transparent;
 
-use crate::bindings;
-
-/// An internal function that is used by doctests.
-pub fn bql_start_test() {
-    // SAFETY: integration tests are run with --test-threads=1, while
-    // unit tests and doctests are not multithreaded and do not have
-    // any BQL-protected data.  Just set bql_locked to true.
-    unsafe {
-        bindings::rust_bql_mock_lock();
-    }
-}
-
-pub fn bql_locked() -> bool {
-    // SAFETY: the function does nothing but return a thread-local bool
-    unsafe { bindings::bql_locked() }
-}
-
-fn bql_block_unlock(increase: bool) {
-    // SAFETY: this only adjusts a counter
-    unsafe {
-        bindings::bql_block_unlock(increase);
-    }
-}
-
 /// A mutable memory location that is protected by the Big QEMU Lock.
 ///
 /// # Memory layout
@@ -256,8 +232,8 @@ impl<T> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     /// ```
@@ -273,8 +249,8 @@ impl<T> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     ///
@@ -291,8 +267,8 @@ impl<T> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let cell = BqlCell::new(5);
     /// assert_eq!(cell.get(), 5);
@@ -301,7 +277,7 @@ impl<T> BqlCell<T> {
     /// ```
     #[inline]
     pub fn replace(&self, val: T) -> T {
-        assert!(bql_locked());
+        assert!(crate::is_locked());
         // SAFETY: This can cause data races if called from multiple threads,
         // but it won't happen as long as C code accesses the value
         // under BQL protection only.
@@ -313,8 +289,8 @@ impl<T> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     /// let five = c.into_inner();
@@ -322,7 +298,7 @@ impl<T> BqlCell<T> {
     /// assert_eq!(five, 5);
     /// ```
     pub fn into_inner(self) -> T {
-        assert!(bql_locked());
+        assert!(crate::is_locked());
         self.value.into_inner()
     }
 }
@@ -333,8 +309,8 @@ impl<T: Copy> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     ///
@@ -342,7 +318,7 @@ impl<T: Copy> BqlCell<T> {
     /// ```
     #[inline]
     pub fn get(&self) -> T {
-        assert!(bql_locked());
+        assert!(crate::is_locked());
         // SAFETY: This can cause data races if called from multiple threads,
         // but it won't happen as long as C code accesses the value
         // under BQL protection only.
@@ -356,8 +332,8 @@ impl<T> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     ///
@@ -375,8 +351,8 @@ impl<T: Default> BqlCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlCell::new(5);
     /// let five = c.take();
@@ -447,7 +423,7 @@ impl<T> BqlRefCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlRefCell;
+    /// use bql::BqlRefCell;
     ///
     /// let c = BqlRefCell::new(5);
     /// ```
@@ -506,8 +482,8 @@ impl<T> BqlRefCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlRefCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlRefCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlRefCell::new(5);
     ///
@@ -518,8 +494,8 @@ impl<T> BqlRefCell<T> {
     /// An example of panic:
     ///
     /// ```should_panic
-    /// use qemu_api::cell::BqlRefCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlRefCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlRefCell::new(5);
     ///
@@ -536,7 +512,7 @@ impl<T> BqlRefCell<T> {
                 self.borrowed_at.set(Some(std::panic::Location::caller()));
             }
 
-            bql_block_unlock(true);
+            crate::block_unlock(true);
 
             // SAFETY: `BorrowRef` ensures that there is only immutable access
             // to the value while borrowed.
@@ -560,8 +536,8 @@ impl<T> BqlRefCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlRefCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlRefCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlRefCell::new("hello".to_owned());
     ///
@@ -573,8 +549,8 @@ impl<T> BqlRefCell<T> {
     /// An example of panic:
     ///
     /// ```should_panic
-    /// use qemu_api::cell::BqlRefCell;
-    /// # qemu_api::cell::bql_start_test();
+    /// use bql::BqlRefCell;
+    /// # bql::start_test();
     ///
     /// let c = BqlRefCell::new(5);
     /// let m = c.borrow();
@@ -591,7 +567,7 @@ impl<T> BqlRefCell<T> {
             }
 
             // SAFETY: this only adjusts a counter
-            bql_block_unlock(true);
+            crate::block_unlock(true);
 
             // SAFETY: `BorrowRefMut` guarantees unique access.
             let value = unsafe { NonNull::new_unchecked(self.value.get()) };
@@ -610,7 +586,7 @@ impl<T> BqlRefCell<T> {
     /// # Examples
     ///
     /// ```
-    /// use qemu_api::cell::BqlRefCell;
+    /// use bql::BqlRefCell;
     ///
     /// let c = BqlRefCell::new(5);
     ///
@@ -737,7 +713,7 @@ impl Drop for BorrowRef<'_> {
         let borrow = self.borrow.get();
         debug_assert!(is_reading(borrow));
         self.borrow.set(borrow - 1);
-        bql_block_unlock(false)
+        crate::block_unlock(false)
     }
 }
 
@@ -827,7 +803,7 @@ impl Drop for BorrowRefMut<'_> {
         let borrow = self.borrow.get();
         debug_assert!(is_writing(borrow));
         self.borrow.set(borrow + 1);
-        bql_block_unlock(false)
+        crate::block_unlock(false)
     }
 }
 
diff --git a/rust/bql/src/lib.rs b/rust/bql/src/lib.rs
new file mode 100644
index 0000000000..ef08221e9c
--- /dev/null
+++ b/rust/bql/src/lib.rs
@@ -0,0 +1,29 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+mod bindings;
+use bindings::{bql_block_unlock, bql_locked, rust_bql_mock_lock};
+
+mod cell;
+pub use cell::*;
+
+/// An internal function that is used by doctests.
+pub fn start_test() {
+    // SAFETY: integration tests are run with --test-threads=1, while
+    // unit tests and doctests are not multithreaded and do not have
+    // any BQL-protected data.  Just set bql_locked to true.
+    unsafe {
+        rust_bql_mock_lock();
+    }
+}
+
+pub fn is_locked() -> bool {
+    // SAFETY: the function does nothing but return a thread-local bool
+    unsafe { bql_locked() }
+}
+
+pub fn block_unlock(increase: bool) {
+    // SAFETY: this only adjusts a counter
+    unsafe {
+        bql_block_unlock(increase);
+    }
+}
diff --git a/rust/bql/wrapper.h b/rust/bql/wrapper.h
new file mode 100644
index 0000000000..2ef9a96e1d
--- /dev/null
+++ b/rust/bql/wrapper.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "qemu/main-loop.h"
diff --git a/rust/common/src/opaque.rs b/rust/common/src/opaque.rs
index d25a5f3ae1..97ed3e8452 100644
--- a/rust/common/src/opaque.rs
+++ b/rust/common/src/opaque.rs
@@ -69,8 +69,8 @@
 //! and only at FFI boundaries. For QEMU-specific types that need interior
 //! mutability, prefer [`BqlCell`] or [`BqlRefCell`].
 //!
-//! [`BqlCell`]: ../../qemu_api/cell/struct.BqlCell.html
-//! [`BqlRefCell`]: ../../qemu_api/cell/struct.BqlRefCell.html
+//! [`BqlCell`]: ../../bql/cell/struct.BqlCell.html
+//! [`BqlRefCell`]: ../../bql/cell/struct.BqlRefCell.html
 use std::{cell::UnsafeCell, fmt, marker::PhantomPinned, mem::MaybeUninit, ptr::NonNull};
 
 /// Stores an opaque value that is shared with C code.
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 7fd7531823..1a1d4ba715 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -18,6 +18,7 @@ bilge-impl = { version = "0.2.0" }
 bits = { path = "../../../bits" }
 common = { path = "../../../common" }
 util = { path = "../../../util" }
+bql = { path = "../../../bql" }
 migration = { path = "../../../migration" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 2198fcee9b..8561c4c14a 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -11,6 +11,7 @@ _libpl011_rs = static_library(
     qemu_api_rs,
     util_rs,
     migration_rs,
+    bql_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 225be34e08..00ae432825 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -4,6 +4,7 @@
 
 use std::{ffi::CStr, mem::size_of};
 
+use bql::BqlRefCell;
 use common::{static_assert, uninit_field_mut};
 use migration::{
     self, impl_vmstate_forward, impl_vmstate_struct, vmstate_fields, vmstate_of,
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 70acdf03d6..9fcec38bfa 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -14,6 +14,7 @@ rust-version.workspace = true
 common = { path = "../../../common" }
 util = { path = "../../../util" }
 migration = { path = "../../../migration" }
+bql = { path = "../../../bql" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index 8cd70091e6..43a62db0d0 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -8,6 +8,7 @@ _libhpet_rs = static_library(
     qemu_api_rs,
     util_rs,
     migration_rs,
+    bql_rs,
     qemu_api_macros,
   ],
 )
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 1c2253466d..9658e071c2 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -10,6 +10,7 @@ use std::{
     slice::from_ref,
 };
 
+use bql::{BqlCell, BqlRefCell};
 use common::{bitops::IntegerExt, uninit_field_mut};
 use migration::{
     self, impl_vmstate_struct, vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
@@ -20,7 +21,6 @@ use qemu_api::{
         address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
         qdev_prop_uint32, qdev_prop_usize,
     },
-    cell::{BqlCell, BqlRefCell},
     irq::InterruptSource,
     memory::{
         hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index 0605225fbb..e569b57b93 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -5,7 +5,6 @@
 use std::ptr::addr_of_mut;
 
 use common::Zeroable;
-use qemu_api::cell::bql_locked;
 
 /// Each `HPETState` represents a Event Timer Block. The v1 spec supports
 /// up to 8 blocks. QEMU only uses 1 block (in PC machine).
@@ -38,7 +37,7 @@ pub static mut hpet_fw_cfg: HPETFwConfig = HPETFwConfig {
 
 impl HPETFwConfig {
     pub(crate) fn assign_hpet_id() -> Result<usize, &'static str> {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
         let mut fw_cfg = unsafe { *addr_of_mut!(hpet_fw_cfg) };
@@ -58,7 +57,7 @@ impl HPETFwConfig {
     }
 
     pub(crate) fn update_hpet_cfg(hpet_id: usize, timer_block_id: u32, address: u64) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
         let mut fw_cfg = unsafe { *addr_of_mut!(hpet_fw_cfg) };
diff --git a/rust/meson.build b/rust/meson.build
index 826949b2e6..2ba1ea2280 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -27,6 +27,7 @@ subdir('qemu-api-macros')
 subdir('bits')
 subdir('util')
 subdir('migration')
+subdir('bql')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 537d54e436..d714aacb7e 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -135,8 +135,8 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// [`impl_vmstate_bitsized`](crate::impl_vmstate_bitsized), and
 /// [`impl_vmstate_struct`](crate::impl_vmstate_struct) help with this.
 ///
-/// [`BqlCell`]: ../../qemu_api/cell/struct.BqlCell.html
-/// [`BqlRefCell`]: ../../qemu_api/cell/struct.BqlRefCell.html
+/// [`BqlCell`]: ../../bql/cell/struct.BqlCell.html
+/// [`BqlRefCell`]: ../../bql/cell/struct.BqlRefCell.html
 /// [`Owned`]: ../../qemu_api/qom/struct.Owned.html
 #[macro_export]
 macro_rules! vmstate_of {
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 7276e67aa9..6e9427f80c 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -17,11 +17,8 @@ rust-version.workspace = true
 common = { path = "../common" }
 migration = { path = "../migration" }
 util = { path = "../util" }
+bql = { path = "../bql" }
 qemu_api_macros = { path = "../qemu-api-macros" }
 
-[features]
-default = ["debug_cell"]
-debug_cell = []
-
 [lints]
 workspace = true
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index a6b5772d19..a47ee6c1a3 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -2,10 +2,6 @@ _qemu_api_cfg = run_command(rustc_args,
   '--config-headers', config_host_h, '--features', files('Cargo.toml'),
   capture: true, check: true).stdout().strip().splitlines()
 
-if get_option('debug_mutex')
-  _qemu_api_cfg += ['--cfg', 'feature="debug_cell"']
-endif
-
 c_enums = [
   'DeviceCategory',
   'GpioPolarity',
@@ -51,7 +47,6 @@ _qemu_api_rs = static_library(
     [
       'src/lib.rs',
       'src/bindings.rs',
-      'src/cell.rs',
       'src/chardev.rs',
       'src/irq.rs',
       'src/memory.rs',
@@ -65,22 +60,13 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
+  dependencies: [anyhow_rs, bql_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
                  util_rs, qom, hwcore, chardev],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
   dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
 
-# Doctests are essentially integration tests, so they need the same dependencies.
-# Note that running them requires the object files for C code, so place them
-# in a separate suite that is run by the "build" CI jobs rather than "check".
-rust.doctest('rust-qemu-api-doctests',
-     _qemu_api_rs,
-     protocol: 'rust',
-     dependencies: [qemu_api_rs],
-     suite: ['doc', 'rust'])
-
 test('rust-qemu-api-integration',
     executable(
         'rust-qemu-api-integration',
@@ -88,7 +74,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [common_rs, util_rs, migration_rs, qemu_api_rs]),
+        dependencies: [bql_rs, common_rs, util_rs, migration_rs, qemu_api_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index 5a351dcecb..2ec90cc0b2 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -18,13 +18,10 @@ use std::{
     slice,
 };
 
+use bql::{BqlRefCell, BqlRefMut};
 use common::{callbacks::FnCall, errno, Opaque};
 
-use crate::{
-    bindings,
-    cell::{BqlRefCell, BqlRefMut},
-    prelude::*,
-};
+use crate::{bindings, prelude::*};
 
 /// A safe wrapper around [`bindings::Chardev`].
 #[repr(transparent)]
@@ -44,13 +41,15 @@ pub struct CharBackend {
     _pin: PhantomPinned,
 }
 
-impl Write for BqlRefMut<'_, bindings::CharBackend> {
+pub struct CharBackendMut<'a>(BqlRefMut<'a, bindings::CharBackend>);
+
+impl Write for CharBackendMut<'_> {
     fn flush(&mut self) -> io::Result<()> {
         Ok(())
     }
 
     fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        let chr: &mut bindings::CharBackend = self;
+        let chr: &mut bindings::CharBackend = &mut self.0;
 
         let len = buf.len().try_into().unwrap();
         let r = unsafe { bindings::qemu_chr_fe_write(addr_of_mut!(*chr), buf.as_ptr(), len) };
@@ -58,7 +57,7 @@ impl Write for BqlRefMut<'_, bindings::CharBackend> {
     }
 
     fn write_all(&mut self, buf: &[u8]) -> io::Result<()> {
-        let chr: &mut bindings::CharBackend = self;
+        let chr: &mut bindings::CharBackend = &mut self.0;
 
         let len = buf.len().try_into().unwrap();
         let r = unsafe { bindings::qemu_chr_fe_write_all(addr_of_mut!(*chr), buf.as_ptr(), len) };
@@ -198,7 +197,7 @@ impl CharBackend {
     /// the big QEMU lock while the character device is borrowed, as
     /// that might cause C code to write to the character device.
     pub fn borrow_mut(&self) -> impl Write + '_ {
-        self.inner.borrow_mut()
+        CharBackendMut(self.inner.borrow_mut())
     }
 
     /// Send a continuous stream of zero bits on the line if `enabled` is
diff --git a/rust/qemu-api/src/irq.rs b/rust/qemu-api/src/irq.rs
index ea6b32848c..3063fbe97a 100644
--- a/rust/qemu-api/src/irq.rs
+++ b/rust/qemu-api/src/irq.rs
@@ -10,6 +10,7 @@ use std::{
     ptr,
 };
 
+use bql::BqlCell;
 use common::Opaque;
 
 use crate::{
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 55386f6697..6cd9e5b990 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -13,7 +13,6 @@ pub mod bindings;
 #[rustfmt::skip]
 pub mod prelude;
 
-pub mod cell;
 pub mod chardev;
 pub mod irq;
 pub mod memory;
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index c10c171158..9da7313016 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -4,9 +4,6 @@
 
 //! Commonly used traits and types for QEMU.
 
-pub use crate::cell::BqlCell;
-pub use crate::cell::BqlRefCell;
-
 pub use crate::qdev::DeviceMethods;
 
 pub use crate::qom::InterfaceType;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index c81ae7cf45..74a82b8710 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -16,7 +16,6 @@ use util::{Error, Result};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
-    cell::bql_locked,
     chardev::Chardev,
     irq::InterruptSource,
     prelude::*,
@@ -322,7 +321,7 @@ impl DeviceState {
             cb: Option<unsafe extern "C" fn(*mut c_void, ClockEvent)>,
             events: ClockEvent,
         ) -> Owned<Clock> {
-            assert!(bql_locked());
+            assert!(bql::is_locked());
 
             // SAFETY: the clock is heap allocated, but qdev_init_clock_in()
             // does not gift the reference to its caller; so use Owned::from to
@@ -393,7 +392,7 @@ where
     Self::Target: IsA<DeviceState>,
 {
     fn prop_set_chr(&self, propname: &str, chr: &Owned<Chardev>) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         let c_propname = CString::new(propname).unwrap();
         let chr: &Chardev = chr;
         unsafe {
diff --git a/rust/qemu-api/src/qom.rs b/rust/qemu-api/src/qom.rs
index 7f2f7797e4..032701af65 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qemu-api/src/qom.rs
@@ -105,12 +105,9 @@ pub use bindings::ObjectClass;
 use common::Opaque;
 use migration::impl_vmstate_pointer;
 
-use crate::{
-    bindings::{
-        self, object_class_dynamic_cast, object_dynamic_cast, object_get_class,
-        object_get_typename, object_new, object_ref, object_unref, TypeInfo,
-    },
-    cell::bql_locked,
+use crate::bindings::{
+    self, object_class_dynamic_cast, object_dynamic_cast, object_get_class, object_get_typename,
+    object_new, object_ref, object_unref, TypeInfo,
 };
 
 /// A safe wrapper around [`bindings::Object`].
@@ -873,7 +870,7 @@ impl<T: ObjectType> ObjectDeref for Owned<T> {}
 
 impl<T: ObjectType> Drop for Owned<T> {
     fn drop(&mut self) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         // SAFETY: creation method is unsafe, and whoever calls it has
         // responsibility that the pointer is valid, and remains valid
         // throughout the lifetime of the `Owned<T>` and its clones.
@@ -897,7 +894,7 @@ impl<T: IsA<Object>> fmt::Debug for Owned<T> {
 pub trait ObjectClassMethods: IsA<Object> {
     /// Return a new reference counted instance of this class
     fn new() -> Owned<Self> {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         // SAFETY: the object created by object_new is allocated on
         // the heap and has a reference count of 1
         unsafe {
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/qemu-api/src/sysbus.rs
index 2dbfc31dbd..b21883246e 100644
--- a/rust/qemu-api/src/sysbus.rs
+++ b/rust/qemu-api/src/sysbus.rs
@@ -11,7 +11,6 @@ use common::Opaque;
 
 use crate::{
     bindings,
-    cell::bql_locked,
     irq::{IRQState, InterruptSource},
     memory::MemoryRegion,
     prelude::*,
@@ -56,7 +55,7 @@ where
     /// region with a number that corresponds to the order of calls to
     /// `init_mmio`.
     fn init_mmio(&self, iomem: &MemoryRegion) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         unsafe {
             bindings::sysbus_init_mmio(self.upcast().as_mut_ptr(), iomem.as_mut_ptr());
         }
@@ -67,7 +66,7 @@ where
     /// whoever creates the sysbus device will refer to the interrupts with
     /// a number that corresponds to the order of calls to `init_irq`.
     fn init_irq(&self, irq: &InterruptSource) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         unsafe {
             bindings::sysbus_init_irq(self.upcast().as_mut_ptr(), irq.as_ptr());
         }
@@ -75,7 +74,7 @@ where
 
     // TODO: do we want a type like GuestAddress here?
     fn mmio_addr(&self, id: u32) -> Option<u64> {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         // SAFETY: the BQL ensures that no one else writes to sbd.mmio[], and
         // the SysBusDevice must be initialized to get an IsA<SysBusDevice>.
         let sbd = unsafe { *self.upcast().as_ptr() };
@@ -89,7 +88,7 @@ where
 
     // TODO: do we want a type like GuestAddress here?
     fn mmio_map(&self, id: u32, addr: u64) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         let id: i32 = id.try_into().unwrap();
         unsafe {
             bindings::sysbus_mmio_map(self.upcast().as_mut_ptr(), id, addr);
@@ -100,7 +99,7 @@ where
     // object_property_set_link) adds a reference to the IRQState,
     // which can prolong its life
     fn connect_irq(&self, id: u32, irq: &Owned<IRQState>) {
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         let id: i32 = id.try_into().unwrap();
         let irq: &IRQState = irq;
         unsafe {
@@ -110,7 +109,7 @@ where
 
     fn sysbus_realize(&self) {
         // TODO: return an Error
-        assert!(bql_locked());
+        assert!(bql::is_locked());
         unsafe {
             bindings::sysbus_realize(
                 self.upcast().as_mut_ptr(),
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index 92e3534d3c..e72ba08aef 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -4,9 +4,9 @@
 
 use std::{ffi::CStr, ptr::addr_of};
 
+use bql::BqlCell;
 use migration::{VMStateDescription, VMStateDescriptionBuilder};
 use qemu_api::{
-    cell::{self, BqlCell},
     prelude::*,
     qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
     qom::{ObjectImpl, ParentField},
@@ -94,7 +94,7 @@ impl DummyChildClass {
 fn init_qom() {
     static ONCE: BqlCell<bool> = BqlCell::new(false);
 
-    cell::bql_start_test();
+    bql::start_test();
     if !ONCE.get() {
         unsafe {
             module_call_init(module_init_type::MODULE_INIT_QOM);
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/qemu-api/tests/vmstate_tests.rs
index 47fc15149b..fa9bbd6a12 100644
--- a/rust/qemu-api/tests/vmstate_tests.rs
+++ b/rust/qemu-api/tests/vmstate_tests.rs
@@ -9,6 +9,7 @@ use std::{
     slice,
 };
 
+use bql::BqlCell;
 use common::Opaque;
 use migration::{
     bindings::{
@@ -19,7 +20,6 @@ use migration::{
     vmstate::{VMStateDescription, VMStateDescriptionBuilder, VMStateField},
     vmstate_fields, vmstate_of, vmstate_unused, vmstate_validate,
 };
-use qemu_api::cell::BqlCell;
 
 const FOO_ARRAY_MAX: usize = 3;
 

From fcf4c00b4d73185db9239b1a6f03289f6211e142 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:53 +0200
Subject: [PATCH 0487/2396] rust: split "qom" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250827104147.717203-13-marcandre.lureau@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                       |  1 +
 rust/Cargo.lock                   | 14 ++++++++++
 rust/Cargo.toml                   |  1 +
 rust/hw/char/pl011/Cargo.toml     |  1 +
 rust/hw/char/pl011/meson.build    |  1 +
 rust/hw/char/pl011/src/device.rs  |  2 +-
 rust/hw/timer/hpet/Cargo.toml     |  1 +
 rust/hw/timer/hpet/meson.build    |  1 +
 rust/hw/timer/hpet/src/device.rs  |  3 +--
 rust/meson.build                  |  1 +
 rust/migration/src/vmstate.rs     |  2 +-
 rust/qemu-api-macros/src/lib.rs   |  4 +--
 rust/qemu-api-macros/src/tests.rs |  4 +--
 rust/qemu-api/Cargo.toml          |  1 +
 rust/qemu-api/meson.build         | 15 +++++++----
 rust/qemu-api/src/bindings.rs     |  1 +
 rust/qemu-api/src/chardev.rs      |  3 ++-
 rust/qemu-api/src/irq.rs          | 10 +++----
 rust/qemu-api/src/lib.rs          |  1 -
 rust/qemu-api/src/memory.rs       |  7 +++--
 rust/qemu-api/src/prelude.rs      | 11 --------
 rust/qemu-api/src/qdev.rs         |  5 ++--
 rust/qemu-api/src/sysbus.rs       |  4 +--
 rust/qemu-api/tests/tests.rs      |  3 +--
 rust/qom/Cargo.toml               | 23 +++++++++++++++++
 rust/qom/build.rs                 |  1 +
 rust/qom/meson.build              | 43 +++++++++++++++++++++++++++++++
 rust/qom/src/bindings.rs          | 25 ++++++++++++++++++
 rust/qom/src/lib.rs               | 11 ++++++++
 rust/qom/src/prelude.rs           | 12 +++++++++
 rust/{qemu-api => qom}/src/qom.rs |  4 +--
 rust/qom/wrapper.h                | 27 +++++++++++++++++++
 32 files changed, 199 insertions(+), 44 deletions(-)
 create mode 100644 rust/qom/Cargo.toml
 create mode 120000 rust/qom/build.rs
 create mode 100644 rust/qom/meson.build
 create mode 100644 rust/qom/src/bindings.rs
 create mode 100644 rust/qom/src/lib.rs
 create mode 100644 rust/qom/src/prelude.rs
 rename rust/{qemu-api => qom}/src/qom.rs (99%)
 create mode 100644 rust/qom/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index a55d5c95d7..c7bd02aef1 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3520,6 +3520,7 @@ F: rust/common/
 F: rust/migration/
 F: rust/qemu-api
 F: rust/qemu-api-macros
+F: rust/qom/
 F: rust/rustfmt.toml
 F: rust/util/
 F: scripts/get-wraps-from-cargo-registry.py
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 73ca9582a5..442eadf08f 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -82,6 +82,7 @@ dependencies = [
  "migration",
  "qemu_api",
  "qemu_api_macros",
+ "qom",
  "util",
 ]
 
@@ -121,6 +122,7 @@ dependencies = [
  "migration",
  "qemu_api",
  "qemu_api_macros",
+ "qom",
  "util",
 ]
 
@@ -164,6 +166,7 @@ dependencies = [
  "common",
  "migration",
  "qemu_api_macros",
+ "qom",
  "util",
 ]
 
@@ -176,6 +179,17 @@ dependencies = [
  "syn",
 ]
 
+[[package]]
+name = "qom"
+version = "0.1.0"
+dependencies = [
+ "bql",
+ "common",
+ "migration",
+ "qemu_api_macros",
+ "util",
+]
+
 [[package]]
 name = "quote"
 version = "1.0.36"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 8be90da8ff..0516c16591 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -7,6 +7,7 @@ members = [
     "migration",
     "qemu-api-macros",
     "qemu-api",
+    "qom",
     "hw/char/pl011",
     "hw/timer/hpet",
     "util",
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 1a1d4ba715..da89f78727 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -20,6 +20,7 @@ common = { path = "../../../common" }
 util = { path = "../../../util" }
 bql = { path = "../../../bql" }
 migration = { path = "../../../migration" }
+qom = { path = "../../../qom" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 8561c4c14a..af9393c9da 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -13,6 +13,7 @@ _libpl011_rs = static_library(
     migration_rs,
     bql_rs,
     qemu_api_macros,
+    qom_rs,
   ],
 )
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 00ae432825..63651b9dcd 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -16,9 +16,9 @@ use qemu_api::{
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
-    qom::{ObjectImpl, Owned, ParentField, ParentInit},
     sysbus::{SysBusDevice, SysBusDeviceImpl},
 };
+use qom::{prelude::*, ObjectImpl, Owned, ParentField, ParentInit};
 use util::{log::Log, log_mask_ln};
 
 use crate::registers::{self, Interrupt, RegisterOffset};
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 9fcec38bfa..19456ec72b 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -15,6 +15,7 @@ common = { path = "../../../common" }
 util = { path = "../../../util" }
 migration = { path = "../../../migration" }
 bql = { path = "../../../bql" }
+qom = { path = "../../../qom" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index 43a62db0d0..50ccdee4a9 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -10,6 +10,7 @@ _libhpet_rs = static_library(
     migration_rs,
     bql_rs,
     qemu_api_macros,
+    qom_rs,
   ],
 )
 
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 9658e071c2..404569aa2d 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -27,10 +27,9 @@ use qemu_api::{
     },
     prelude::*,
     qdev::{DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
-    qom::{ObjectImpl, ObjectType, ParentField, ParentInit},
-    qom_isa,
     sysbus::{SysBusDevice, SysBusDeviceImpl},
 };
+use qom::{prelude::*, ObjectImpl, ParentField, ParentInit};
 use util::timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND};
 
 use crate::fw_cfg::HPETFwConfig;
diff --git a/rust/meson.build b/rust/meson.build
index 2ba1ea2280..043603d416 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -28,6 +28,7 @@ subdir('bits')
 subdir('util')
 subdir('migration')
 subdir('bql')
+subdir('qom')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index d714aacb7e..c05c4a1fd6 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -137,7 +137,7 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 ///
 /// [`BqlCell`]: ../../bql/cell/struct.BqlCell.html
 /// [`BqlRefCell`]: ../../bql/cell/struct.BqlRefCell.html
-/// [`Owned`]: ../../qemu_api/qom/struct.Owned.html
+/// [`Owned`]: ../../qom/qom/struct.Owned.html
 #[macro_export]
 macro_rules! vmstate_of {
     ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index 67650a9a26..e643e57ebd 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -98,11 +98,11 @@ fn derive_object_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
 
     Ok(quote! {
         ::common::assert_field_type!(#name, #parent,
-            ::qemu_api::qom::ParentField<<#name as ::qemu_api::qom::ObjectImpl>::ParentType>);
+            ::qom::ParentField<<#name as ::qom::ObjectImpl>::ParentType>);
 
         ::util::module_init! {
             MODULE_INIT_QOM => unsafe {
-                ::qemu_api::bindings::type_register_static(&<#name as ::qemu_api::qom::ObjectImpl>::TYPE_INFO);
+                ::qom::type_register_static(&<#name as ::qom::ObjectImpl>::TYPE_INFO);
             }
         }
     })
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index 8e71ac6e67..76e6c57479 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -168,11 +168,11 @@ fn test_derive_object() {
             ::common::assert_field_type!(
                 Foo,
                 _unused,
-                ::qemu_api::qom::ParentField<<Foo as ::qemu_api::qom::ObjectImpl>::ParentType>
+                ::qom::ParentField<<Foo as ::qom::ObjectImpl>::ParentType>
             );
             ::util::module_init! {
                 MODULE_INIT_QOM => unsafe {
-                    ::qemu_api::bindings::type_register_static(&<Foo as ::qemu_api::qom::ObjectImpl>::TYPE_INFO);
+                    ::qom::type_register_static(&<Foo as ::qom::ObjectImpl>::TYPE_INFO);
                 }
             }
         }
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 6e9427f80c..9d11becb28 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -18,6 +18,7 @@ common = { path = "../common" }
 migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
+qom = { path = "../qom" }
 qemu_api_macros = { path = "../qemu-api-macros" }
 
 [lints]
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index a47ee6c1a3..11e43bb646 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -22,9 +22,15 @@ foreach enum : c_bitfields
   _qemu_api_bindgen_args += ['--bitfield-enum', enum]
 endforeach
 
-_qemu_api_bindgen_args += ['--blocklist-type', 'VMStateDescription']
+blocked_type = [
+  'ObjectClass',
+  'VMStateDescription',
+  'Error',
+]
+foreach type: blocked_type
+  _qemu_api_bindgen_args += ['--blocklist-type', type]
+endforeach
 
-_qemu_api_bindgen_args += ['--blocklist-type', 'Error']
 # TODO: Remove this comment when the clang/libclang mismatch issue is solved.
 #
 # Rust bindings generation with `bindgen` might fail in some cases where the
@@ -52,7 +58,6 @@ _qemu_api_rs = static_library(
       'src/memory.rs',
       'src/prelude.rs',
       'src/qdev.rs',
-      'src/qom.rs',
       'src/sysbus.rs',
     ],
     {'.' : _qemu_api_bindings_inc_rs},
@@ -61,7 +66,7 @@ _qemu_api_rs = static_library(
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
   dependencies: [anyhow_rs, bql_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
-                 util_rs, qom, hwcore, chardev],
+                 qom_rs, util_rs, hwcore, chardev],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
@@ -74,7 +79,7 @@ test('rust-qemu-api-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [bql_rs, common_rs, util_rs, migration_rs, qemu_api_rs]),
+        dependencies: [bql_rs, common_rs, util_rs, migration_rs, qom_rs, qemu_api_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index ce00a6e0e4..525f136ae2 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -22,6 +22,7 @@
 
 use common::Zeroable;
 use migration::bindings::VMStateDescription;
+use qom::bindings::ObjectClass;
 use util::bindings::Error;
 
 #[cfg(MESON)]
diff --git a/rust/qemu-api/src/chardev.rs b/rust/qemu-api/src/chardev.rs
index 2ec90cc0b2..072d806e4a 100644
--- a/rust/qemu-api/src/chardev.rs
+++ b/rust/qemu-api/src/chardev.rs
@@ -20,8 +20,9 @@ use std::{
 
 use bql::{BqlRefCell, BqlRefMut};
 use common::{callbacks::FnCall, errno, Opaque};
+use qom::prelude::*;
 
-use crate::{bindings, prelude::*};
+use crate::bindings;
 
 /// A safe wrapper around [`bindings::Chardev`].
 #[repr(transparent)]
diff --git a/rust/qemu-api/src/irq.rs b/rust/qemu-api/src/irq.rs
index 3063fbe97a..fead2bbe8e 100644
--- a/rust/qemu-api/src/irq.rs
+++ b/rust/qemu-api/src/irq.rs
@@ -12,12 +12,9 @@ use std::{
 
 use bql::BqlCell;
 use common::Opaque;
+use qom::{prelude::*, ObjectClass};
 
-use crate::{
-    bindings::{self, qemu_set_irq},
-    prelude::*,
-    qom::ObjectClass,
-};
+use crate::bindings::{self, qemu_set_irq};
 
 /// An opaque wrapper around [`bindings::IRQState`].
 #[repr(transparent)]
@@ -36,7 +33,7 @@ pub struct IRQState(Opaque<bindings::IRQState>);
 ///
 /// Interrupts are implemented as a pointer to the interrupt "sink", which has
 /// type [`IRQState`].  A device exposes its source as a QOM link property using
-/// a function such as [`SysBusDeviceMethods::init_irq`], and
+/// a function such as [`crate::sysbus::SysBusDeviceMethods::init_irq`], and
 /// initially leaves the pointer to a NULL value, representing an unconnected
 /// interrupt. To connect it, whoever creates the device fills the pointer with
 /// the sink's `IRQState *`, for example using `sysbus_connect_irq`.  Because
@@ -114,4 +111,5 @@ unsafe impl ObjectType for IRQState {
     const TYPE_NAME: &'static CStr =
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_IRQ) };
 }
+
 qom_isa!(IRQState: Object);
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 6cd9e5b990..0541050e66 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -17,7 +17,6 @@ pub mod chardev;
 pub mod irq;
 pub mod memory;
 pub mod qdev;
-pub mod qom;
 pub mod sysbus;
 
 // Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
diff --git a/rust/qemu-api/src/memory.rs b/rust/qemu-api/src/memory.rs
index f790cb5fd2..ecbbd9b604 100644
--- a/rust/qemu-api/src/memory.rs
+++ b/rust/qemu-api/src/memory.rs
@@ -11,11 +11,9 @@ use std::{
 
 pub use bindings::{hwaddr, MemTxAttrs};
 use common::{callbacks::FnCall, uninit::MaybeUninitField, zeroable::Zeroable, Opaque};
+use qom::prelude::*;
 
-use crate::{
-    bindings::{self, device_endian, memory_region_init_io},
-    prelude::*,
-};
+use crate::bindings::{self, device_endian, memory_region_init_io};
 
 pub struct MemoryRegionOps<T>(
     bindings::MemoryRegionOps,
@@ -186,6 +184,7 @@ unsafe impl ObjectType for MemoryRegion {
     const TYPE_NAME: &'static CStr =
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_MEMORY_REGION) };
 }
+
 qom_isa!(MemoryRegion: Object);
 
 /// A special `MemTxAttrs` constant, used to indicate that no memory
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index 9da7313016..9e9d1c8247 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -6,15 +6,4 @@
 
 pub use crate::qdev::DeviceMethods;
 
-pub use crate::qom::InterfaceType;
-pub use crate::qom::IsA;
-pub use crate::qom::Object;
-pub use crate::qom::ObjectCast;
-pub use crate::qom::ObjectClassMethods;
-pub use crate::qom::ObjectDeref;
-pub use crate::qom::ObjectMethods;
-pub use crate::qom::ObjectType;
-
-pub use crate::qom_isa;
-
 pub use crate::sysbus::SysBusDeviceMethods;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 74a82b8710..3daf9dda2b 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -12,14 +12,13 @@ use std::{
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
 use common::{callbacks::FnCall, Opaque};
 use migration::{impl_vmstate_c_struct, VMStateDescription};
+use qom::{prelude::*, ObjectClass, ObjectImpl, Owned, ParentInit};
 use util::{Error, Result};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
     chardev::Chardev,
     irq::InterruptSource,
-    prelude::*,
-    qom::{ObjectClass, ObjectImpl, Owned, ParentInit},
 };
 
 /// A safe wrapper around [`bindings::Clock`].
@@ -291,6 +290,7 @@ unsafe impl ObjectType for DeviceState {
     const TYPE_NAME: &'static CStr =
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_DEVICE) };
 }
+
 qom_isa!(DeviceState: Object);
 
 /// Initialization methods take a [`ParentInit`] and can be called as
@@ -453,6 +453,7 @@ unsafe impl ObjectType for Clock {
     const TYPE_NAME: &'static CStr =
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_CLOCK) };
 }
+
 qom_isa!(Clock: Object);
 
 impl_vmstate_c_struct!(Clock, bindings::vmstate_clock);
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/qemu-api/src/sysbus.rs
index b21883246e..b883d7eaf1 100644
--- a/rust/qemu-api/src/sysbus.rs
+++ b/rust/qemu-api/src/sysbus.rs
@@ -8,14 +8,13 @@ use std::{ffi::CStr, ptr::addr_of_mut};
 
 pub use bindings::SysBusDeviceClass;
 use common::Opaque;
+use qom::{prelude::*, Owned};
 
 use crate::{
     bindings,
     irq::{IRQState, InterruptSource},
     memory::MemoryRegion,
-    prelude::*,
     qdev::{DeviceImpl, DeviceState},
-    qom::Owned,
 };
 
 /// A safe wrapper around [`bindings::SysBusDevice`].
@@ -31,6 +30,7 @@ unsafe impl ObjectType for SysBusDevice {
     const TYPE_NAME: &'static CStr =
         unsafe { CStr::from_bytes_with_nul_unchecked(bindings::TYPE_SYS_BUS_DEVICE) };
 }
+
 qom_isa!(SysBusDevice: DeviceState, Object);
 
 // TODO: add virtual methods
diff --git a/rust/qemu-api/tests/tests.rs b/rust/qemu-api/tests/tests.rs
index e72ba08aef..f2e5eb9f4f 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/qemu-api/tests/tests.rs
@@ -7,11 +7,10 @@ use std::{ffi::CStr, ptr::addr_of};
 use bql::BqlCell;
 use migration::{VMStateDescription, VMStateDescriptionBuilder};
 use qemu_api::{
-    prelude::*,
     qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
-    qom::{ObjectImpl, ParentField},
     sysbus::SysBusDevice,
 };
+use qom::{prelude::*, ObjectImpl, ParentField};
 use util::bindings::{module_call_init, module_init_type};
 
 mod vmstate_tests;
diff --git a/rust/qom/Cargo.toml b/rust/qom/Cargo.toml
new file mode 100644
index 0000000000..46bbf7c7fe
--- /dev/null
+++ b/rust/qom/Cargo.toml
@@ -0,0 +1,23 @@
+[package]
+name = "qom"
+version = "0.1.0"
+description = "Rust bindings for QEMU/QOM"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+common = { path = "../common" }
+bql = { path = "../bql" }
+migration = { path = "../migration" }
+qemu_api_macros = { path = "../qemu-api-macros" }
+util = { path = "../util" }
+
+[lints]
+workspace = true
diff --git a/rust/qom/build.rs b/rust/qom/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/qom/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/qom/meson.build b/rust/qom/meson.build
new file mode 100644
index 0000000000..84a65cb737
--- /dev/null
+++ b/rust/qom/meson.build
@@ -0,0 +1,43 @@
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_qom_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common,
+)
+
+_qom_rs = static_library(
+  'qom',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/prelude.rs',
+      'src/qom.rs',
+    ],
+    {'.': _qom_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  link_with: [_bql_rs, _migration_rs],
+  dependencies: [common_rs, qemu_api_macros],
+)
+
+qom_rs = declare_dependency(link_with: [_qom_rs], dependencies: [qemu_api_macros, qom])
+
+# Doctests are essentially integration tests, so they need the same dependencies.
+# Note that running them requires the object files for C code, so place them
+# in a separate suite that is run by the "build" CI jobs rather than "check".
+rust.doctest('rust-qom-rs-doctests',
+     _qom_rs,
+     protocol: 'rust',
+     dependencies: qom_rs,
+     suite: ['doc', 'rust'])
diff --git a/rust/qom/src/bindings.rs b/rust/qom/src/bindings.rs
new file mode 100644
index 0000000000..9ffff12cde
--- /dev/null
+++ b/rust/qom/src/bindings.rs
@@ -0,0 +1,25 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
diff --git a/rust/qom/src/lib.rs b/rust/qom/src/lib.rs
new file mode 100644
index 0000000000..204c6fea2f
--- /dev/null
+++ b/rust/qom/src/lib.rs
@@ -0,0 +1,11 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod bindings;
+
+// preserve one-item-per-"use" syntax, it is clearer
+// for prelude-like modules
+#[rustfmt::skip]
+pub mod prelude;
+
+mod qom;
+pub use qom::*;
diff --git a/rust/qom/src/prelude.rs b/rust/qom/src/prelude.rs
new file mode 100644
index 0000000000..00a6095977
--- /dev/null
+++ b/rust/qom/src/prelude.rs
@@ -0,0 +1,12 @@
+//! Traits and essential types intended for blanket imports.
+
+pub use crate::qom::InterfaceType;
+pub use crate::qom::IsA;
+pub use crate::qom::Object;
+pub use crate::qom::ObjectCast;
+pub use crate::qom::ObjectClassMethods;
+pub use crate::qom::ObjectDeref;
+pub use crate::qom::ObjectMethods;
+pub use crate::qom::ObjectType;
+
+pub use crate::qom_isa;
diff --git a/rust/qemu-api/src/qom.rs b/rust/qom/src/qom.rs
similarity index 99%
rename from rust/qemu-api/src/qom.rs
rename to rust/qom/src/qom.rs
index 032701af65..3ea1ad9c5b 100644
--- a/rust/qemu-api/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -101,7 +101,6 @@ use std::{
     ptr::NonNull,
 };
 
-pub use bindings::ObjectClass;
 use common::Opaque;
 use migration::impl_vmstate_pointer;
 
@@ -109,6 +108,7 @@ use crate::bindings::{
     self, object_class_dynamic_cast, object_dynamic_cast, object_get_class, object_get_typename,
     object_new, object_ref, object_unref, TypeInfo,
 };
+pub use crate::bindings::{type_register_static, ObjectClass};
 
 /// A safe wrapper around [`bindings::Object`].
 #[repr(transparent)]
@@ -146,7 +146,7 @@ macro_rules! qom_isa {
         $(
             // SAFETY: it is the caller responsibility to have $parent as the
             // first field
-            unsafe impl $crate::qom::IsA<$parent> for $struct {}
+            unsafe impl $crate::IsA<$parent> for $struct {}
 
             impl AsRef<$parent> for $struct {
                 fn as_ref(&self) -> &$parent {
diff --git a/rust/qom/wrapper.h b/rust/qom/wrapper.h
new file mode 100644
index 0000000000..3b71bcd3f5
--- /dev/null
+++ b/rust/qom/wrapper.h
@@ -0,0 +1,27 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "qom/object.h"

From fef932ef09c82c3831ff3336d1b2d566cd6ccae4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:54 +0200
Subject: [PATCH 0488/2396] rust: split "chardev" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-14-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                               |  1 +
 rust/Cargo.lock                           | 14 ++++++++
 rust/chardev/Cargo.toml                   | 24 +++++++++++++
 rust/chardev/build.rs                     |  1 +
 rust/chardev/meson.build                  | 41 +++++++++++++++++++++++
 rust/chardev/src/bindings.rs              | 36 ++++++++++++++++++++
 rust/{qemu-api => chardev}/src/chardev.rs |  0
 rust/chardev/src/lib.rs                   |  6 ++++
 rust/chardev/wrapper.h                    | 28 ++++++++++++++++
 rust/hw/char/pl011/Cargo.toml             |  1 +
 rust/hw/char/pl011/meson.build            |  1 +
 rust/hw/char/pl011/src/device.rs          |  2 +-
 rust/meson.build                          |  1 +
 rust/qemu-api/Cargo.toml                  |  1 +
 rust/qemu-api/meson.build                 |  9 +++--
 rust/qemu-api/src/bindings.rs             |  9 +----
 rust/qemu-api/src/lib.rs                  |  1 -
 rust/qemu-api/src/qdev.rs                 |  6 ++--
 rust/qemu-api/wrapper.h                   |  2 --
 19 files changed, 164 insertions(+), 20 deletions(-)
 create mode 100644 rust/chardev/Cargo.toml
 create mode 120000 rust/chardev/build.rs
 create mode 100644 rust/chardev/meson.build
 create mode 100644 rust/chardev/src/bindings.rs
 rename rust/{qemu-api => chardev}/src/chardev.rs (100%)
 create mode 100644 rust/chardev/src/lib.rs
 create mode 100644 rust/chardev/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index c7bd02aef1..cac6dcdc65 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3516,6 +3516,7 @@ Rust
 M: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
 S: Maintained
 F: rust/bql/
+F: rust/chardev/
 F: rust/common/
 F: rust/migration/
 F: rust/qemu-api
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 442eadf08f..ae852c5550 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -51,6 +51,18 @@ dependencies = [
  "migration",
 ]
 
+[[package]]
+name = "chardev"
+version = "0.1.0"
+dependencies = [
+ "bql",
+ "common",
+ "migration",
+ "qemu_api_macros",
+ "qom",
+ "util",
+]
+
 [[package]]
 name = "common"
 version = "0.1.0"
@@ -118,6 +130,7 @@ dependencies = [
  "bilge-impl",
  "bits",
  "bql",
+ "chardev",
  "common",
  "migration",
  "qemu_api",
@@ -163,6 +176,7 @@ name = "qemu_api"
 version = "0.1.0"
 dependencies = [
  "bql",
+ "chardev",
  "common",
  "migration",
  "qemu_api_macros",
diff --git a/rust/chardev/Cargo.toml b/rust/chardev/Cargo.toml
new file mode 100644
index 0000000000..7df9c677fc
--- /dev/null
+++ b/rust/chardev/Cargo.toml
@@ -0,0 +1,24 @@
+[package]
+name = "chardev"
+version = "0.1.0"
+description = "Rust bindings for QEMU/chardev"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+common = { path = "../common" }
+bql = { path = "../bql" }
+migration = { path = "../migration" }
+qom = { path = "../qom" }
+util = { path = "../util" }
+qemu_api_macros = { path = "../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/chardev/build.rs b/rust/chardev/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/chardev/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
new file mode 100644
index 0000000000..5d333e232b
--- /dev/null
+++ b/rust/chardev/meson.build
@@ -0,0 +1,41 @@
+c_enums = [
+  'QEMUChrEvent',
+]
+_chardev_bindgen_args = []
+foreach enum : c_enums
+  _chardev_bindgen_args += ['--rustified-enum', enum]
+endforeach
+
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_chardev_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _chardev_bindgen_args,
+)
+
+_chardev_rs = static_library(
+  'chardev',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/chardev.rs',
+    ],
+    {'.': _chardev_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
+  dependencies: [common_rs, qemu_api_macros],
+)
+
+chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [qemu_api_macros, chardev, qemuutil])
diff --git a/rust/chardev/src/bindings.rs b/rust/chardev/src/bindings.rs
new file mode 100644
index 0000000000..2d98026d62
--- /dev/null
+++ b/rust/chardev/src/bindings.rs
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+use common::Zeroable;
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
+
+// SAFETY: these are implemented in C; the bindings need to assert that the
+// BQL is taken, either directly or via `BqlCell` and `BqlRefCell`.
+// When bindings for character devices are introduced, this can be
+// moved to the Opaque<> wrapper in src/chardev.rs.
+unsafe impl Send for CharBackend {}
+unsafe impl Sync for CharBackend {}
+
+unsafe impl Zeroable for CharBackend {}
diff --git a/rust/qemu-api/src/chardev.rs b/rust/chardev/src/chardev.rs
similarity index 100%
rename from rust/qemu-api/src/chardev.rs
rename to rust/chardev/src/chardev.rs
diff --git a/rust/chardev/src/lib.rs b/rust/chardev/src/lib.rs
new file mode 100644
index 0000000000..2e549f99d9
--- /dev/null
+++ b/rust/chardev/src/lib.rs
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod bindings;
+
+mod chardev;
+pub use chardev::*;
diff --git a/rust/chardev/wrapper.h b/rust/chardev/wrapper.h
new file mode 100644
index 0000000000..65ede6ea6d
--- /dev/null
+++ b/rust/chardev/wrapper.h
@@ -0,0 +1,28 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "chardev/char-fe.h"
+#include "chardev/char-serial.h"
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index da89f78727..f7ad5f8e08 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -21,6 +21,7 @@ util = { path = "../../../util" }
 bql = { path = "../../../bql" }
 migration = { path = "../../../migration" }
 qom = { path = "../../../qom" }
+chardev = { path = "../../../chardev" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index af9393c9da..aaf911c5f4 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -14,6 +14,7 @@ _libpl011_rs = static_library(
     bql_rs,
     qemu_api_macros,
     qom_rs,
+    chardev_rs,
   ],
 )
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 63651b9dcd..bc64061fb3 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -5,13 +5,13 @@
 use std::{ffi::CStr, mem::size_of};
 
 use bql::BqlRefCell;
+use chardev::{CharBackend, Chardev, Event};
 use common::{static_assert, uninit_field_mut};
 use migration::{
     self, impl_vmstate_forward, impl_vmstate_struct, vmstate_fields, vmstate_of,
     vmstate_subsections, vmstate_unused, VMStateDescription, VMStateDescriptionBuilder,
 };
 use qemu_api::{
-    chardev::{CharBackend, Chardev, Event},
     irq::{IRQState, InterruptSource},
     memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
diff --git a/rust/meson.build b/rust/meson.build
index 043603d416..4d9e291223 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -29,6 +29,7 @@ subdir('util')
 subdir('migration')
 subdir('bql')
 subdir('qom')
+subdir('chardev')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 9d11becb28..3bf2dafa6d 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -15,6 +15,7 @@ rust-version.workspace = true
 
 [dependencies]
 common = { path = "../common" }
+chardev = { path = "../chardev" }
 migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 11e43bb646..a47f178b69 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -7,7 +7,6 @@ c_enums = [
   'GpioPolarity',
   'MachineInitPhase',
   'MemoryDeviceInfoKind',
-  'QEMUChrEvent',
   'ResetType',
   'device_endian',
 ]
@@ -23,9 +22,10 @@ foreach enum : c_bitfields
 endforeach
 
 blocked_type = [
+  'Chardev',
+  'Error',
   'ObjectClass',
   'VMStateDescription',
-  'Error',
 ]
 foreach type: blocked_type
   _qemu_api_bindgen_args += ['--blocklist-type', type]
@@ -53,7 +53,6 @@ _qemu_api_rs = static_library(
     [
       'src/lib.rs',
       'src/bindings.rs',
-      'src/chardev.rs',
       'src/irq.rs',
       'src/memory.rs',
       'src/prelude.rs',
@@ -65,8 +64,8 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, bql_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
-                 qom_rs, util_rs, hwcore, chardev],
+  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
+                 qom_rs, util_rs, hwcore],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 525f136ae2..526bcf8e31 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -20,6 +20,7 @@
 
 //! `bindgen`-generated declarations.
 
+use chardev::bindings::Chardev;
 use common::Zeroable;
 use migration::bindings::VMStateDescription;
 use qom::bindings::ObjectClass;
@@ -31,13 +32,6 @@ include!("bindings.inc.rs");
 #[cfg(not(MESON))]
 include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
 
-// SAFETY: these are implemented in C; the bindings need to assert that the
-// BQL is taken, either directly or via `BqlCell` and `BqlRefCell`.
-// When bindings for character devices are introduced, this can be
-// moved to the Opaque<> wrapper in src/chardev.rs.
-unsafe impl Send for CharBackend {}
-unsafe impl Sync for CharBackend {}
-
 // SAFETY: this is a pure data struct
 unsafe impl Send for CoalescedMemoryRange {}
 unsafe impl Sync for CoalescedMemoryRange {}
@@ -59,4 +53,3 @@ unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
 unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
 unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
 unsafe impl Zeroable for crate::bindings::MemTxAttrs {}
-unsafe impl Zeroable for crate::bindings::CharBackend {}
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 0541050e66..d96096899d 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -13,7 +13,6 @@ pub mod bindings;
 #[rustfmt::skip]
 pub mod prelude;
 
-pub mod chardev;
 pub mod irq;
 pub mod memory;
 pub mod qdev;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/qemu-api/src/qdev.rs
index 3daf9dda2b..7efc796f50 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/qemu-api/src/qdev.rs
@@ -10,6 +10,7 @@ use std::{
 };
 
 pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
+use chardev::Chardev;
 use common::{callbacks::FnCall, Opaque};
 use migration::{impl_vmstate_c_struct, VMStateDescription};
 use qom::{prelude::*, ObjectClass, ObjectImpl, Owned, ParentInit};
@@ -17,7 +18,6 @@ use util::{Error, Result};
 
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
-    chardev::Chardev,
     irq::InterruptSource,
 };
 
@@ -137,8 +137,8 @@ unsafe impl QDevProp for u64 {
     const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_uint64 };
 }
 
-/// Use [`bindings::qdev_prop_chr`] for [`crate::chardev::CharBackend`].
-unsafe impl QDevProp for crate::chardev::CharBackend {
+/// Use [`bindings::qdev_prop_chr`] for [`chardev::CharBackend`].
+unsafe impl QDevProp for chardev::CharBackend {
     const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_chr };
 }
 
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index b99df9f568..07dbc9987a 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -52,13 +52,11 @@ typedef enum memory_order {
 #include "system/system.h"
 #include "hw/sysbus.h"
 #include "system/memory.h"
-#include "chardev/char-fe.h"
 #include "hw/clock.h"
 #include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "hw/irq.h"
-#include "chardev/char-serial.h"
 #include "exec/memattrs.h"
 #include "system/address-spaces.h"
 #include "hw/char/pl011.h"

From ee4ffbf239cbd9de8c6b6cc33283b7a64a95a956 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:55 +0200
Subject: [PATCH 0489/2396] rust: split "system" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-15-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                             |  1 +
 rust/Cargo.lock                         | 13 ++++++++
 rust/Cargo.toml                         |  1 +
 rust/bql/src/cell.rs                    |  5 ++-
 rust/hw/char/pl011/Cargo.toml           |  1 +
 rust/hw/char/pl011/meson.build          |  1 +
 rust/hw/char/pl011/src/device.rs        |  2 +-
 rust/hw/timer/hpet/Cargo.toml           |  1 +
 rust/hw/timer/hpet/meson.build          |  1 +
 rust/hw/timer/hpet/src/device.rs        | 12 +++----
 rust/meson.build                        |  1 +
 rust/qemu-api/Cargo.toml                |  1 +
 rust/qemu-api/meson.build               |  7 +++--
 rust/qemu-api/src/bindings.rs           | 14 +--------
 rust/qemu-api/src/lib.rs                |  1 -
 rust/qemu-api/src/sysbus.rs             |  2 +-
 rust/qemu-api/wrapper.h                 |  3 --
 rust/system/Cargo.toml                  | 22 +++++++++++++
 rust/system/build.rs                    |  1 +
 rust/system/meson.build                 | 42 +++++++++++++++++++++++++
 rust/system/src/bindings.rs             | 41 ++++++++++++++++++++++++
 rust/system/src/lib.rs                  |  6 ++++
 rust/{qemu-api => system}/src/memory.rs |  2 +-
 rust/system/wrapper.h                   | 29 +++++++++++++++++
 24 files changed, 177 insertions(+), 33 deletions(-)
 create mode 100644 rust/system/Cargo.toml
 create mode 120000 rust/system/build.rs
 create mode 100644 rust/system/meson.build
 create mode 100644 rust/system/src/bindings.rs
 create mode 100644 rust/system/src/lib.rs
 rename rust/{qemu-api => system}/src/memory.rs (99%)
 create mode 100644 rust/system/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index cac6dcdc65..432ed51354 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3523,6 +3523,7 @@ F: rust/qemu-api
 F: rust/qemu-api-macros
 F: rust/qom/
 F: rust/rustfmt.toml
+F: rust/system/
 F: rust/util/
 F: scripts/get-wraps-from-cargo-registry.py
 
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index ae852c5550..e6b75f30be 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -95,6 +95,7 @@ dependencies = [
  "qemu_api",
  "qemu_api_macros",
  "qom",
+ "system",
  "util",
 ]
 
@@ -136,6 +137,7 @@ dependencies = [
  "qemu_api",
  "qemu_api_macros",
  "qom",
+ "system",
  "util",
 ]
 
@@ -181,6 +183,7 @@ dependencies = [
  "migration",
  "qemu_api_macros",
  "qom",
+ "system",
  "util",
 ]
 
@@ -224,6 +227,16 @@ dependencies = [
  "unicode-ident",
 ]
 
+[[package]]
+name = "system"
+version = "0.1.0"
+dependencies = [
+ "common",
+ "qemu_api_macros",
+ "qom",
+ "util",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 0516c16591..8e210d277a 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -8,6 +8,7 @@ members = [
     "qemu-api-macros",
     "qemu-api",
     "qom",
+    "system",
     "hw/char/pl011",
     "hw/timer/hpet",
     "util",
diff --git a/rust/bql/src/cell.rs b/rust/bql/src/cell.rs
index 25007427ed..24ab294b60 100644
--- a/rust/bql/src/cell.rs
+++ b/rust/bql/src/cell.rs
@@ -77,9 +77,8 @@
 //!
 //! ```ignore
 //! # use bql::BqlRefCell;
-//! # use qemu_api::prelude::*;
-//! # use qemu_api::{irq::InterruptSource, irq::IRQState};
-//! # use qemu_api::{sysbus::SysBusDevice, qom::Owned, qom::ParentField};
+//! # use qom::{Owned, ParentField};
+//! # use system::{InterruptSource, IRQState, SysBusDevice};
 //! # const N_GPIOS: usize = 8;
 //! # struct PL061Registers { /* ... */ }
 //! # unsafe impl ObjectType for PL061State {
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index f7ad5f8e08..e4b1c3f1eb 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -22,6 +22,7 @@ bql = { path = "../../../bql" }
 migration = { path = "../../../migration" }
 qom = { path = "../../../qom" }
 chardev = { path = "../../../chardev" }
+system = { path = "../../../system" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index aaf911c5f4..fae6e1b9c9 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -15,6 +15,7 @@ _libpl011_rs = static_library(
     qemu_api_macros,
     qom_rs,
     chardev_rs,
+    system_rs,
   ],
 )
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index bc64061fb3..c65db5a517 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -13,12 +13,12 @@ use migration::{
 };
 use qemu_api::{
     irq::{IRQState, InterruptSource},
-    memory::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder},
     prelude::*,
     qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
     sysbus::{SysBusDevice, SysBusDeviceImpl},
 };
 use qom::{prelude::*, ObjectImpl, Owned, ParentField, ParentInit};
+use system::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder};
 use util::{log::Log, log_mask_ln};
 
 use crate::registers::{self, Interrupt, RegisterOffset};
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 19456ec72b..a95b1271c6 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -16,6 +16,7 @@ util = { path = "../../../util" }
 migration = { path = "../../../migration" }
 bql = { path = "../../../bql" }
 qom = { path = "../../../qom" }
+system = { path = "../../../system" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index 50ccdee4a9..c4ffe020f6 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -11,6 +11,7 @@ _libhpet_rs = static_library(
     bql_rs,
     qemu_api_macros,
     qom_rs,
+    system_rs,
   ],
 )
 
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 404569aa2d..841c2ba337 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -17,19 +17,17 @@ use migration::{
     VMStateDescription, VMStateDescriptionBuilder,
 };
 use qemu_api::{
-    bindings::{
-        address_space_memory, address_space_stl_le, qdev_prop_bit, qdev_prop_bool,
-        qdev_prop_uint32, qdev_prop_usize,
-    },
+    bindings::{qdev_prop_bit, qdev_prop_bool, qdev_prop_uint32, qdev_prop_usize},
     irq::InterruptSource,
-    memory::{
-        hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
-    },
     prelude::*,
     qdev::{DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
     sysbus::{SysBusDevice, SysBusDeviceImpl},
 };
 use qom::{prelude::*, ObjectImpl, ParentField, ParentInit};
+use system::{
+    bindings::{address_space_memory, address_space_stl_le, hwaddr},
+    MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
+};
 use util::timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND};
 
 use crate::fw_cfg::HPETFwConfig;
diff --git a/rust/meson.build b/rust/meson.build
index 4d9e291223..d8b71f5506 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -29,6 +29,7 @@ subdir('util')
 subdir('migration')
 subdir('bql')
 subdir('qom')
+subdir('system')
 subdir('chardev')
 subdir('qemu-api')
 
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 3bf2dafa6d..2884c1d460 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -20,6 +20,7 @@ migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
 qom = { path = "../qom" }
+system = { path = "../system" }
 qemu_api_macros = { path = "../qemu-api-macros" }
 
 [lints]
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index a47f178b69..92e2581a64 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -8,7 +8,6 @@ c_enums = [
   'MachineInitPhase',
   'MemoryDeviceInfoKind',
   'ResetType',
-  'device_endian',
 ]
 _qemu_api_bindgen_args = []
 foreach enum : c_enums
@@ -24,8 +23,11 @@ endforeach
 blocked_type = [
   'Chardev',
   'Error',
+  'MemTxAttrs',
+  'MemoryRegion',
   'ObjectClass',
   'VMStateDescription',
+  'device_endian',
 ]
 foreach type: blocked_type
   _qemu_api_bindgen_args += ['--blocklist-type', type]
@@ -54,7 +56,6 @@ _qemu_api_rs = static_library(
       'src/lib.rs',
       'src/bindings.rs',
       'src/irq.rs',
-      'src/memory.rs',
       'src/prelude.rs',
       'src/qdev.rs',
       'src/sysbus.rs',
@@ -65,7 +66,7 @@ _qemu_api_rs = static_library(
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
   dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
-                 qom_rs, util_rs, hwcore],
+                 qom_rs, system_rs, util_rs, hwcore],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 526bcf8e31..63b805c76e 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -24,6 +24,7 @@ use chardev::bindings::Chardev;
 use common::Zeroable;
 use migration::bindings::VMStateDescription;
 use qom::bindings::ObjectClass;
+use system::bindings::{device_endian, MemTxAttrs, MemoryRegion};
 use util::bindings::Error;
 
 #[cfg(MESON)]
@@ -32,15 +33,6 @@ include!("bindings.inc.rs");
 #[cfg(not(MESON))]
 include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
 
-// SAFETY: this is a pure data struct
-unsafe impl Send for CoalescedMemoryRange {}
-unsafe impl Sync for CoalescedMemoryRange {}
-
-// SAFETY: these are constants and vtables; the Send and Sync requirements
-// are deferred to the unsafe callbacks that they contain
-unsafe impl Send for MemoryRegionOps {}
-unsafe impl Sync for MemoryRegionOps {}
-
 unsafe impl Send for Property {}
 unsafe impl Sync for Property {}
 
@@ -49,7 +41,3 @@ unsafe impl Sync for TypeInfo {}
 
 unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
 unsafe impl Zeroable for crate::bindings::Property {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_1 {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps__bindgen_ty_2 {}
-unsafe impl Zeroable for crate::bindings::MemoryRegionOps {}
-unsafe impl Zeroable for crate::bindings::MemTxAttrs {}
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index d96096899d..8d57440478 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -14,7 +14,6 @@ pub mod bindings;
 pub mod prelude;
 
 pub mod irq;
-pub mod memory;
 pub mod qdev;
 pub mod sysbus;
 
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/qemu-api/src/sysbus.rs
index b883d7eaf1..dda71ebda7 100644
--- a/rust/qemu-api/src/sysbus.rs
+++ b/rust/qemu-api/src/sysbus.rs
@@ -9,11 +9,11 @@ use std::{ffi::CStr, ptr::addr_of_mut};
 pub use bindings::SysBusDeviceClass;
 use common::Opaque;
 use qom::{prelude::*, Owned};
+use system::MemoryRegion;
 
 use crate::{
     bindings,
     irq::{IRQState, InterruptSource},
-    memory::MemoryRegion,
     qdev::{DeviceImpl, DeviceState},
 };
 
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index 07dbc9987a..564733b903 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -49,14 +49,11 @@ typedef enum memory_order {
 
 #include "qemu/osdep.h"
 #include "qemu-io.h"
-#include "system/system.h"
 #include "hw/sysbus.h"
-#include "system/memory.h"
 #include "hw/clock.h"
 #include "hw/qdev-clock.h"
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "hw/irq.h"
 #include "exec/memattrs.h"
-#include "system/address-spaces.h"
 #include "hw/char/pl011.h"
diff --git a/rust/system/Cargo.toml b/rust/system/Cargo.toml
new file mode 100644
index 0000000000..6803895e08
--- /dev/null
+++ b/rust/system/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+name = "system"
+version = "0.1.0"
+description = "Rust bindings for QEMU/system"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+common = { path = "../common" }
+qom = { path = "../qom" }
+util = { path = "../util" }
+qemu_api_macros = { path = "../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/system/build.rs b/rust/system/build.rs
new file mode 120000
index 0000000000..71a3167885
--- /dev/null
+++ b/rust/system/build.rs
@@ -0,0 +1 @@
+../util/build.rs
\ No newline at end of file
diff --git a/rust/system/meson.build b/rust/system/meson.build
new file mode 100644
index 0000000000..ae9b932d29
--- /dev/null
+++ b/rust/system/meson.build
@@ -0,0 +1,42 @@
+c_enums = [
+  'device_endian',
+]
+_system_bindgen_args = []
+foreach enum : c_enums
+  _system_bindgen_args += ['--rustified-enum', enum]
+endforeach
+
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_system_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _system_bindgen_args,
+)
+
+_system_rs = static_library(
+  'system',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/memory.rs',
+    ],
+    {'.': _system_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
+  dependencies: [common_rs, qemu_api_macros],
+)
+
+system_rs = declare_dependency(link_with: [_system_rs],
+  dependencies: [qemu_api_macros, hwcore])
diff --git a/rust/system/src/bindings.rs b/rust/system/src/bindings.rs
new file mode 100644
index 0000000000..43edd98807
--- /dev/null
+++ b/rust/system/src/bindings.rs
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+use common::Zeroable;
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
+
+// SAFETY: these are constants and vtables; the Send and Sync requirements
+// are deferred to the unsafe callbacks that they contain
+unsafe impl Send for MemoryRegionOps {}
+unsafe impl Sync for MemoryRegionOps {}
+
+// SAFETY: this is a pure data struct
+unsafe impl Send for CoalescedMemoryRange {}
+unsafe impl Sync for CoalescedMemoryRange {}
+
+unsafe impl Zeroable for MemoryRegionOps__bindgen_ty_1 {}
+unsafe impl Zeroable for MemoryRegionOps__bindgen_ty_2 {}
+unsafe impl Zeroable for MemoryRegionOps {}
+unsafe impl Zeroable for MemTxAttrs {}
diff --git a/rust/system/src/lib.rs b/rust/system/src/lib.rs
new file mode 100644
index 0000000000..aafe9a866c
--- /dev/null
+++ b/rust/system/src/lib.rs
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub mod bindings;
+
+mod memory;
+pub use memory::*;
diff --git a/rust/qemu-api/src/memory.rs b/rust/system/src/memory.rs
similarity index 99%
rename from rust/qemu-api/src/memory.rs
rename to rust/system/src/memory.rs
index ecbbd9b604..29568ed767 100644
--- a/rust/qemu-api/src/memory.rs
+++ b/rust/system/src/memory.rs
@@ -9,11 +9,11 @@ use std::{
     marker::PhantomData,
 };
 
-pub use bindings::{hwaddr, MemTxAttrs};
 use common::{callbacks::FnCall, uninit::MaybeUninitField, zeroable::Zeroable, Opaque};
 use qom::prelude::*;
 
 use crate::bindings::{self, device_endian, memory_region_init_io};
+pub use crate::bindings::{hwaddr, MemTxAttrs};
 
 pub struct MemoryRegionOps<T>(
     bindings::MemoryRegionOps,
diff --git a/rust/system/wrapper.h b/rust/system/wrapper.h
new file mode 100644
index 0000000000..48abde8505
--- /dev/null
+++ b/rust/system/wrapper.h
@@ -0,0 +1,29 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "system/system.h"
+#include "system/memory.h"
+#include "system/address-spaces.h"

From 5e588c9d08b0da64fab7f370e65744cb7a4174ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:56 +0200
Subject: [PATCH 0490/2396] rust: split "hwcore" crate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-16-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                               |  1 +
 rust/Cargo.lock                           | 17 +++++
 rust/Cargo.toml                           |  1 +
 rust/bindings/src/lib.rs                  | 64 ++++++++++++++++++
 rust/hw/char/pl011/Cargo.toml             |  1 +
 rust/hw/char/pl011/meson.build            |  1 +
 rust/hw/char/pl011/src/device.rs          | 10 ++-
 rust/hw/core/Cargo.toml                   | 26 ++++++++
 rust/hw/core/build.rs                     |  1 +
 rust/hw/core/meson.build                  | 80 +++++++++++++++++++++++
 rust/hw/core/src/bindings.rs              | 41 ++++++++++++
 rust/{qemu-api => hw/core}/src/irq.rs     |  0
 rust/hw/core/src/lib.rs                   | 14 ++++
 rust/{qemu-api => hw/core}/src/qdev.rs    |  2 +-
 rust/{qemu-api => hw/core}/src/sysbus.rs  |  0
 rust/{qemu-api => hw/core}/tests/tests.rs |  7 +-
 rust/hw/core/wrapper.h                    | 32 +++++++++
 rust/hw/timer/hpet/Cargo.toml             |  1 +
 rust/hw/timer/hpet/meson.build            |  1 +
 rust/hw/timer/hpet/src/device.rs          | 26 ++++----
 rust/meson.build                          |  1 +
 rust/qemu-api-macros/src/lib.rs           | 10 +--
 rust/qemu-api-macros/src/tests.rs         | 20 +++---
 rust/qemu-api/Cargo.toml                  |  1 +
 rust/qemu-api/meson.build                 | 17 +----
 rust/qemu-api/src/bindings.rs             | 10 ---
 rust/qemu-api/src/lib.rs                  |  4 --
 rust/qemu-api/src/prelude.rs              |  4 --
 rust/qemu-api/wrapper.h                   |  6 --
 29 files changed, 318 insertions(+), 81 deletions(-)
 create mode 100644 rust/bindings/src/lib.rs
 create mode 100644 rust/hw/core/Cargo.toml
 create mode 120000 rust/hw/core/build.rs
 create mode 100644 rust/hw/core/meson.build
 create mode 100644 rust/hw/core/src/bindings.rs
 rename rust/{qemu-api => hw/core}/src/irq.rs (100%)
 create mode 100644 rust/hw/core/src/lib.rs
 rename rust/{qemu-api => hw/core}/src/qdev.rs (99%)
 rename rust/{qemu-api => hw/core}/src/sysbus.rs (100%)
 rename rust/{qemu-api => hw/core}/tests/tests.rs (97%)
 create mode 100644 rust/hw/core/wrapper.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 432ed51354..92d575b535 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3518,6 +3518,7 @@ S: Maintained
 F: rust/bql/
 F: rust/chardev/
 F: rust/common/
+F: rust/hw/core/
 F: rust/migration/
 F: rust/qemu-api
 F: rust/qemu-api-macros
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index e6b75f30be..77118e882b 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -91,6 +91,7 @@ version = "0.1.0"
 dependencies = [
  "bql",
  "common",
+ "hwcore",
  "migration",
  "qemu_api",
  "qemu_api_macros",
@@ -99,6 +100,20 @@ dependencies = [
  "util",
 ]
 
+[[package]]
+name = "hwcore"
+version = "0.1.0"
+dependencies = [
+ "bql",
+ "chardev",
+ "common",
+ "migration",
+ "qemu_api_macros",
+ "qom",
+ "system",
+ "util",
+]
+
 [[package]]
 name = "itertools"
 version = "0.11.0"
@@ -133,6 +148,7 @@ dependencies = [
  "bql",
  "chardev",
  "common",
+ "hwcore",
  "migration",
  "qemu_api",
  "qemu_api_macros",
@@ -180,6 +196,7 @@ dependencies = [
  "bql",
  "chardev",
  "common",
+ "hwcore",
  "migration",
  "qemu_api_macros",
  "qom",
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 8e210d277a..8ec07d2065 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -9,6 +9,7 @@ members = [
     "qemu-api",
     "qom",
     "system",
+    "hw/core",
     "hw/char/pl011",
     "hw/timer/hpet",
     "util",
diff --git a/rust/bindings/src/lib.rs b/rust/bindings/src/lib.rs
new file mode 100644
index 0000000000..5bf03b1370
--- /dev/null
+++ b/rust/bindings/src/lib.rs
@@ -0,0 +1,64 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc
+)]
+
+//! `bindgen`-generated declarations.
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
+
+// SAFETY: these are implemented in C; the bindings need to assert that the
+// BQL is taken, either directly or via `BqlCell` and `BqlRefCell`.
+// When bindings for character devices are introduced, this can be
+// moved to the Opaque<> wrapper in src/chardev.rs.
+unsafe impl Send for CharBackend {}
+unsafe impl Sync for CharBackend {}
+
+// SAFETY: this is a pure data struct
+unsafe impl Send for CoalescedMemoryRange {}
+unsafe impl Sync for CoalescedMemoryRange {}
+
+// SAFETY: these are constants and vtables; the Send and Sync requirements
+// are deferred to the unsafe callbacks that they contain
+unsafe impl Send for MemoryRegionOps {}
+unsafe impl Sync for MemoryRegionOps {}
+
+unsafe impl Send for Property {}
+unsafe impl Sync for Property {}
+
+unsafe impl Send for TypeInfo {}
+unsafe impl Sync for TypeInfo {}
+
+unsafe impl Send for VMStateDescription {}
+unsafe impl Sync for VMStateDescription {}
+
+unsafe impl Send for VMStateField {}
+unsafe impl Sync for VMStateField {}
+
+unsafe impl Send for VMStateInfo {}
+unsafe impl Sync for VMStateInfo {}
+
+// bindgen does not derive Default here
+#[allow(clippy::derivable_impls)]
+impl Default for VMStateFlags {
+    fn default() -> Self {
+        Self(0)
+    }
+}
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index e4b1c3f1eb..830d88586b 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -23,6 +23,7 @@ migration = { path = "../../../migration" }
 qom = { path = "../../../qom" }
 chardev = { path = "../../../chardev" }
 system = { path = "../../../system" }
+hwcore = { path = "../../../hw/core" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
 
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index fae6e1b9c9..fac0432113 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -16,6 +16,7 @@ _libpl011_rs = static_library(
     qom_rs,
     chardev_rs,
     system_rs,
+    hwcore_rs,
   ],
 )
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index c65db5a517..a6a17d9f2d 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -7,16 +7,14 @@ use std::{ffi::CStr, mem::size_of};
 use bql::BqlRefCell;
 use chardev::{CharBackend, Chardev, Event};
 use common::{static_assert, uninit_field_mut};
+use hwcore::{
+    Clock, ClockEvent, DeviceImpl, DeviceMethods, DeviceState, IRQState, InterruptSource,
+    ResetType, ResettablePhasesImpl, SysBusDevice, SysBusDeviceImpl, SysBusDeviceMethods,
+};
 use migration::{
     self, impl_vmstate_forward, impl_vmstate_struct, vmstate_fields, vmstate_of,
     vmstate_subsections, vmstate_unused, VMStateDescription, VMStateDescriptionBuilder,
 };
-use qemu_api::{
-    irq::{IRQState, InterruptSource},
-    prelude::*,
-    qdev::{Clock, ClockEvent, DeviceImpl, DeviceState, ResetType, ResettablePhasesImpl},
-    sysbus::{SysBusDevice, SysBusDeviceImpl},
-};
 use qom::{prelude::*, ObjectImpl, Owned, ParentField, ParentInit};
 use system::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder};
 use util::{log::Log, log_mask_ln};
diff --git a/rust/hw/core/Cargo.toml b/rust/hw/core/Cargo.toml
new file mode 100644
index 0000000000..0b35380264
--- /dev/null
+++ b/rust/hw/core/Cargo.toml
@@ -0,0 +1,26 @@
+[package]
+name = "hwcore"
+version = "0.1.0"
+description = "Rust bindings for QEMU/hwcore"
+resolver = "2"
+publish = false
+
+authors.workspace = true
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[dependencies]
+common = { path = "../../common" }
+bql = { path = "../../bql" }
+qom = { path = "../../qom" }
+chardev = { path = "../../chardev" }
+migration = { path = "../../migration" }
+system = { path = "../../system" }
+util = { path = "../../util" }
+qemu_api_macros = { path = "../../qemu-api-macros" }
+
+[lints]
+workspace = true
diff --git a/rust/hw/core/build.rs b/rust/hw/core/build.rs
new file mode 120000
index 0000000000..2a79ee31b8
--- /dev/null
+++ b/rust/hw/core/build.rs
@@ -0,0 +1 @@
+../../util/build.rs
\ No newline at end of file
diff --git a/rust/hw/core/meson.build b/rust/hw/core/meson.build
new file mode 100644
index 0000000000..7dd1ade6f0
--- /dev/null
+++ b/rust/hw/core/meson.build
@@ -0,0 +1,80 @@
+_hwcore_bindgen_args = []
+c_enums = [
+  'DeviceCategory',
+  'GpioPolarity',
+  'MachineInitPhase',
+  'ResetType',
+]
+foreach enum : c_enums
+  _hwcore_bindgen_args += ['--rustified-enum', enum]
+endforeach
+
+blocked_type = [
+  'Chardev',
+  'Error',
+  'ObjectClass',
+  'MemoryRegion',
+  'VMStateDescription',
+]
+foreach type: blocked_type
+  _hwcore_bindgen_args += ['--blocklist-type', type]
+endforeach
+
+c_bitfields = [
+  'ClockEvent',
+]
+foreach enum : c_bitfields
+  _hwcore_bindgen_args += ['--bitfield-enum', enum]
+endforeach
+
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_hwcore_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common + _hwcore_bindgen_args,
+)
+
+_hwcore_rs = static_library(
+  'hwcore',
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/irq.rs',
+      'src/qdev.rs',
+      'src/sysbus.rs',
+    ],
+    {'.': _hwcore_bindings_inc_rs}
+  ),
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  link_with: [_bql_rs, _chardev_rs, _migration_rs, _qom_rs, _system_rs, _util_rs],
+  dependencies: [qemu_api_macros, common_rs],
+)
+
+hwcore_rs = declare_dependency(link_with: [_hwcore_rs],
+  dependencies: [qom_rs, hwcore])
+
+test('rust-hwcore-rs-integration',
+    executable(
+        'rust-hwcore-rs-integration',
+        files('tests/tests.rs'),
+        override_options: ['rust_std=2021', 'build.rust_std=2021'],
+        rust_args: ['--test'],
+        install: false,
+        dependencies: [common_rs, hwcore_rs, bql_rs, migration_rs, qemu_api_macros, util_rs]),
+    args: [
+        '--test', '--test-threads', '1',
+        '--format', 'pretty',
+    ],
+    protocol: 'rust',
+    suite: ['unit', 'rust'])
diff --git a/rust/hw/core/src/bindings.rs b/rust/hw/core/src/bindings.rs
new file mode 100644
index 0000000000..919c02b56a
--- /dev/null
+++ b/rust/hw/core/src/bindings.rs
@@ -0,0 +1,41 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+use chardev::bindings::Chardev;
+use common::Zeroable;
+use migration::bindings::VMStateDescription;
+use qom::bindings::ObjectClass;
+use system::bindings::MemoryRegion;
+use util::bindings::Error;
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
+
+unsafe impl Send for Property {}
+unsafe impl Sync for Property {}
+
+unsafe impl Send for TypeInfo {}
+unsafe impl Sync for TypeInfo {}
+
+unsafe impl Zeroable for Property__bindgen_ty_1 {}
+unsafe impl Zeroable for Property {}
diff --git a/rust/qemu-api/src/irq.rs b/rust/hw/core/src/irq.rs
similarity index 100%
rename from rust/qemu-api/src/irq.rs
rename to rust/hw/core/src/irq.rs
diff --git a/rust/hw/core/src/lib.rs b/rust/hw/core/src/lib.rs
new file mode 100644
index 0000000000..c5588d9bc2
--- /dev/null
+++ b/rust/hw/core/src/lib.rs
@@ -0,0 +1,14 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+pub use qom;
+
+pub mod bindings;
+
+mod irq;
+pub use irq::*;
+
+mod qdev;
+pub use qdev::*;
+
+mod sysbus;
+pub use sysbus::*;
diff --git a/rust/qemu-api/src/qdev.rs b/rust/hw/core/src/qdev.rs
similarity index 99%
rename from rust/qemu-api/src/qdev.rs
rename to rust/hw/core/src/qdev.rs
index 7efc796f50..8e9702ce0b 100644
--- a/rust/qemu-api/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -9,13 +9,13 @@ use std::{
     ptr::NonNull,
 };
 
-pub use bindings::{ClockEvent, DeviceClass, Property, ResetType};
 use chardev::Chardev;
 use common::{callbacks::FnCall, Opaque};
 use migration::{impl_vmstate_c_struct, VMStateDescription};
 use qom::{prelude::*, ObjectClass, ObjectImpl, Owned, ParentInit};
 use util::{Error, Result};
 
+pub use crate::bindings::{ClockEvent, DeviceClass, Property, ResetType};
 use crate::{
     bindings::{self, qdev_init_gpio_in, qdev_init_gpio_out, ResettableClass},
     irq::InterruptSource,
diff --git a/rust/qemu-api/src/sysbus.rs b/rust/hw/core/src/sysbus.rs
similarity index 100%
rename from rust/qemu-api/src/sysbus.rs
rename to rust/hw/core/src/sysbus.rs
diff --git a/rust/qemu-api/tests/tests.rs b/rust/hw/core/tests/tests.rs
similarity index 97%
rename from rust/qemu-api/tests/tests.rs
rename to rust/hw/core/tests/tests.rs
index f2e5eb9f4f..21ee301fa6 100644
--- a/rust/qemu-api/tests/tests.rs
+++ b/rust/hw/core/tests/tests.rs
@@ -5,16 +5,11 @@
 use std::{ffi::CStr, ptr::addr_of};
 
 use bql::BqlCell;
+use hwcore::{DeviceImpl, DeviceState, ResettablePhasesImpl, SysBusDevice};
 use migration::{VMStateDescription, VMStateDescriptionBuilder};
-use qemu_api::{
-    qdev::{DeviceImpl, DeviceState, ResettablePhasesImpl},
-    sysbus::SysBusDevice,
-};
 use qom::{prelude::*, ObjectImpl, ParentField};
 use util::bindings::{module_call_init, module_init_type};
 
-mod vmstate_tests;
-
 // Test that macros can compile.
 pub const VMSTATE: VMStateDescription<DummyState> = VMStateDescriptionBuilder::<DummyState>::new()
     .name(c"name")
diff --git a/rust/hw/core/wrapper.h b/rust/hw/core/wrapper.h
new file mode 100644
index 0000000000..3bdbd1249e
--- /dev/null
+++ b/rust/hw/core/wrapper.h
@@ -0,0 +1,32 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+
+#include "hw/sysbus.h"
+#include "hw/clock.h"
+#include "hw/qdev-clock.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-properties-system.h"
+#include "hw/irq.h"
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index a95b1271c6..e28d66f645 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -19,6 +19,7 @@ qom = { path = "../../../qom" }
 system = { path = "../../../system" }
 qemu_api = { path = "../../../qemu-api" }
 qemu_api_macros = { path = "../../../qemu-api-macros" }
+hwcore = { path = "../../../hw/core" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index c4ffe020f6..e6f99b6778 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -12,6 +12,7 @@ _libhpet_rs = static_library(
     qemu_api_macros,
     qom_rs,
     system_rs,
+    hwcore_rs,
   ],
 )
 
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 841c2ba337..3031539744 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -12,17 +12,15 @@ use std::{
 
 use bql::{BqlCell, BqlRefCell};
 use common::{bitops::IntegerExt, uninit_field_mut};
+use hwcore::{
+    bindings::{qdev_prop_bit, qdev_prop_bool, qdev_prop_uint32, qdev_prop_usize},
+    declare_properties, define_property, DeviceImpl, DeviceMethods, DeviceState, InterruptSource,
+    Property, ResetType, ResettablePhasesImpl, SysBusDevice, SysBusDeviceImpl, SysBusDeviceMethods,
+};
 use migration::{
     self, impl_vmstate_struct, vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
     VMStateDescription, VMStateDescriptionBuilder,
 };
-use qemu_api::{
-    bindings::{qdev_prop_bit, qdev_prop_bool, qdev_prop_uint32, qdev_prop_usize},
-    irq::InterruptSource,
-    prelude::*,
-    qdev::{DeviceImpl, DeviceState, Property, ResetType, ResettablePhasesImpl},
-    sysbus::{SysBusDevice, SysBusDeviceImpl},
-};
 use qom::{prelude::*, ObjectImpl, ParentField, ParentInit};
 use system::{
     bindings::{address_space_memory, address_space_stl_le, hwaddr},
@@ -904,9 +902,9 @@ impl ObjectImpl for HPETState {
 }
 
 // TODO: Make these properties user-configurable!
-qemu_api::declare_properties! {
+declare_properties! {
     HPET_PROPERTIES,
-    qemu_api::define_property!(
+    define_property!(
         c"timers",
         HPETState,
         num_timers,
@@ -914,7 +912,7 @@ qemu_api::declare_properties! {
         u8,
         default = HPET_MIN_TIMERS
     ),
-    qemu_api::define_property!(
+    define_property!(
         c"msi",
         HPETState,
         flags,
@@ -923,7 +921,7 @@ qemu_api::declare_properties! {
         bit = HPET_FLAG_MSI_SUPPORT_SHIFT as u8,
         default = false,
     ),
-    qemu_api::define_property!(
+    define_property!(
         c"hpet-intcap",
         HPETState,
         int_route_cap,
@@ -931,7 +929,7 @@ qemu_api::declare_properties! {
         u32,
         default = 0
     ),
-    qemu_api::define_property!(
+    define_property!(
         c"hpet-offset-saved",
         HPETState,
         hpet_offset_saved,
@@ -1004,8 +1002,8 @@ const VMSTATE_HPET: VMStateDescription<HPETState> =
         .build();
 
 // SAFETY: HPET_PROPERTIES is a valid Property array constructed with the
-// qemu_api::declare_properties macro.
-unsafe impl qemu_api::qdev::DevicePropertiesImpl for HPETState {
+// hwcore::declare_properties macro.
+unsafe impl hwcore::DevicePropertiesImpl for HPETState {
     const PROPERTIES: &'static [Property] = &HPET_PROPERTIES;
 }
 
diff --git a/rust/meson.build b/rust/meson.build
index d8b71f5506..041b0a473e 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -31,6 +31,7 @@ subdir('bql')
 subdir('qom')
 subdir('system')
 subdir('chardev')
+subdir('hw/core')
 subdir('qemu-api')
 
 subdir('hw')
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-api-macros/src/lib.rs
index e643e57ebd..830b432698 100644
--- a/rust/qemu-api-macros/src/lib.rs
+++ b/rust/qemu-api-macros/src/lib.rs
@@ -272,24 +272,24 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
             },
         )?;
         let field_ty = field.ty.clone();
-        let qdev_prop = quote! { <#field_ty as ::qemu_api::qdev::QDevProp>::VALUE };
+        let qdev_prop = quote! { <#field_ty as ::hwcore::QDevProp>::VALUE };
         let set_default = defval.is_some();
         let defval = defval.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
         properties_expanded.push(quote! {
-            ::qemu_api::bindings::Property {
+            ::hwcore::bindings::Property {
                 name: ::std::ffi::CStr::as_ptr(#prop_name),
                 info: #qdev_prop ,
                 offset: ::core::mem::offset_of!(#name, #field_name) as isize,
                 set_default: #set_default,
-                defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
+                defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
                 ..::common::Zeroable::ZERO
             }
         });
     }
 
     Ok(quote_spanned! {input.span() =>
-        unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for #name {
-            const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
+        unsafe impl ::hwcore::DevicePropertiesImpl for #name {
+            const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
                 #(#properties_expanded),*
             ];
         }
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-api-macros/src/tests.rs
index 76e6c57479..9ab7eab7f3 100644
--- a/rust/qemu-api-macros/src/tests.rs
+++ b/rust/qemu-api-macros/src/tests.rs
@@ -100,14 +100,14 @@ fn test_derive_device() {
             }
         },
         quote! {
-            unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
-                const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
-                    ::qemu_api::bindings::Property {
+            unsafe impl ::hwcore::DevicePropertiesImpl for DummyState {
+                const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
+                    ::hwcore::bindings::Property {
                         name: ::std::ffi::CStr::as_ptr(c"migrate_clock"),
-                        info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                        info: <bool as ::hwcore::QDevProp>::VALUE,
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
                         set_default: true,
-                        defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                        defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
                         ..::common::Zeroable::ZERO
                     }
                 ];
@@ -127,14 +127,14 @@ fn test_derive_device() {
             }
         },
         quote! {
-            unsafe impl ::qemu_api::qdev::DevicePropertiesImpl for DummyState {
-                const PROPERTIES: &'static [::qemu_api::bindings::Property] = &[
-                    ::qemu_api::bindings::Property {
+            unsafe impl ::hwcore::DevicePropertiesImpl for DummyState {
+                const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
+                    ::hwcore::bindings::Property {
                         name: ::std::ffi::CStr::as_ptr(c"migrate-clk"),
-                        info: <bool as ::qemu_api::qdev::QDevProp>::VALUE,
+                        info: <bool as ::hwcore::QDevProp>::VALUE,
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
                         set_default: true,
-                        defval: ::qemu_api::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                        defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
                         ..::common::Zeroable::ZERO
                     }
                 ];
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 2884c1d460..9e7afc7e3a 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -16,6 +16,7 @@ rust-version.workspace = true
 [dependencies]
 common = { path = "../common" }
 chardev = { path = "../chardev" }
+hwcore = { path = "../hw/core" }
 migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 92e2581a64..2dc638782c 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -3,22 +3,12 @@ _qemu_api_cfg = run_command(rustc_args,
   capture: true, check: true).stdout().strip().splitlines()
 
 c_enums = [
-  'DeviceCategory',
-  'GpioPolarity',
-  'MachineInitPhase',
   'MemoryDeviceInfoKind',
-  'ResetType',
 ]
 _qemu_api_bindgen_args = []
 foreach enum : c_enums
   _qemu_api_bindgen_args += ['--rustified-enum', enum]
 endforeach
-c_bitfields = [
-  'ClockEvent',
-]
-foreach enum : c_bitfields
-  _qemu_api_bindgen_args += ['--bitfield-enum', enum]
-endforeach
 
 blocked_type = [
   'Chardev',
@@ -55,17 +45,14 @@ _qemu_api_rs = static_library(
     [
       'src/lib.rs',
       'src/bindings.rs',
-      'src/irq.rs',
       'src/prelude.rs',
-      'src/qdev.rs',
-      'src/sysbus.rs',
     ],
     {'.' : _qemu_api_bindings_inc_rs},
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, libc_rs, migration_rs, qemu_api_macros,
+  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, hwcore_rs, libc_rs, migration_rs, qemu_api_macros,
                  qom_rs, system_rs, util_rs, hwcore],
 )
 
@@ -75,7 +62,7 @@ qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
 test('rust-qemu-api-integration',
     executable(
         'rust-qemu-api-integration',
-        files('tests/tests.rs', 'tests/vmstate_tests.rs'),
+        files('tests/vmstate_tests.rs'),
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
index 63b805c76e..9c863e9b5b 100644
--- a/rust/qemu-api/src/bindings.rs
+++ b/rust/qemu-api/src/bindings.rs
@@ -21,7 +21,6 @@
 //! `bindgen`-generated declarations.
 
 use chardev::bindings::Chardev;
-use common::Zeroable;
 use migration::bindings::VMStateDescription;
 use qom::bindings::ObjectClass;
 use system::bindings::{device_endian, MemTxAttrs, MemoryRegion};
@@ -32,12 +31,3 @@ include!("bindings.inc.rs");
 
 #[cfg(not(MESON))]
 include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
-
-unsafe impl Send for Property {}
-unsafe impl Sync for Property {}
-
-unsafe impl Send for TypeInfo {}
-unsafe impl Sync for TypeInfo {}
-
-unsafe impl Zeroable for crate::bindings::Property__bindgen_ty_1 {}
-unsafe impl Zeroable for crate::bindings::Property {}
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
index 8d57440478..21b886035f 100644
--- a/rust/qemu-api/src/lib.rs
+++ b/rust/qemu-api/src/lib.rs
@@ -13,10 +13,6 @@ pub mod bindings;
 #[rustfmt::skip]
 pub mod prelude;
 
-pub mod irq;
-pub mod qdev;
-pub mod sysbus;
-
 // Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
 // crate).
 extern crate self as qemu_api;
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
index 9e9d1c8247..8db56f9f81 100644
--- a/rust/qemu-api/src/prelude.rs
+++ b/rust/qemu-api/src/prelude.rs
@@ -3,7 +3,3 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 //! Commonly used traits and types for QEMU.
-
-pub use crate::qdev::DeviceMethods;
-
-pub use crate::sysbus::SysBusDeviceMethods;
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
index 564733b903..7c9c20b14f 100644
--- a/rust/qemu-api/wrapper.h
+++ b/rust/qemu-api/wrapper.h
@@ -49,11 +49,5 @@ typedef enum memory_order {
 
 #include "qemu/osdep.h"
 #include "qemu-io.h"
-#include "hw/sysbus.h"
-#include "hw/clock.h"
-#include "hw/qdev-clock.h"
-#include "hw/qdev-properties.h"
-#include "hw/qdev-properties-system.h"
-#include "hw/irq.h"
 #include "exec/memattrs.h"
 #include "hw/char/pl011.h"

From 0d93f8177310515ae2d8aea8e1320e53818d70bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:57 +0200
Subject: [PATCH 0491/2396] rust: rename qemu_api_macros -> qemu_macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since "qemu_api" is no longer the unique crate to provide APIs.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-17-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                                   |  2 +-
 rust/Cargo.lock                               | 22 +++++++++----------
 rust/Cargo.toml                               |  2 +-
 rust/bits/Cargo.toml                          |  2 +-
 rust/bits/meson.build                         |  2 +-
 rust/bits/src/lib.rs                          |  4 ++--
 rust/chardev/Cargo.toml                       |  2 +-
 rust/chardev/meson.build                      |  4 ++--
 rust/chardev/src/chardev.rs                   |  2 +-
 rust/common/src/opaque.rs                     |  4 ++--
 rust/hw/char/pl011/Cargo.toml                 |  2 +-
 rust/hw/char/pl011/meson.build                |  4 ++--
 rust/hw/char/pl011/src/device.rs              |  4 ++--
 rust/hw/char/pl011/src/registers.rs           |  2 +-
 rust/hw/core/Cargo.toml                       |  2 +-
 rust/hw/core/meson.build                      |  4 ++--
 rust/hw/core/src/irq.rs                       |  2 +-
 rust/hw/core/src/qdev.rs                      |  6 ++---
 rust/hw/core/src/sysbus.rs                    |  2 +-
 rust/hw/core/tests/tests.rs                   |  4 ++--
 rust/hw/timer/hpet/Cargo.toml                 |  2 +-
 rust/hw/timer/hpet/meson.build                |  4 ++--
 rust/hw/timer/hpet/src/device.rs              |  6 ++---
 rust/meson.build                              |  2 +-
 rust/migration/Cargo.toml                     |  2 +-
 rust/qemu-api/Cargo.toml                      |  2 +-
 rust/qemu-api/meson.build                     |  4 ++--
 .../Cargo.toml                                |  2 +-
 .../meson.build                               | 10 ++++-----
 .../src/bits.rs                               |  0
 .../src/lib.rs                                |  0
 .../src/tests.rs                              |  0
 rust/qom/Cargo.toml                           |  2 +-
 rust/qom/meson.build                          |  4 ++--
 rust/qom/src/qom.rs                           |  4 ++--
 rust/system/Cargo.toml                        |  2 +-
 rust/system/meson.build                       |  4 ++--
 rust/system/src/memory.rs                     |  2 +-
 rust/util/Cargo.toml                          |  2 +-
 rust/util/meson.build                         |  2 +-
 rust/util/src/timer.rs                        |  4 ++--
 41 files changed, 69 insertions(+), 69 deletions(-)
 rename rust/{qemu-api-macros => qemu-macros}/Cargo.toml (94%)
 rename rust/{qemu-api-macros => qemu-macros}/meson.build (63%)
 rename rust/{qemu-api-macros => qemu-macros}/src/bits.rs (100%)
 rename rust/{qemu-api-macros => qemu-macros}/src/lib.rs (100%)
 rename rust/{qemu-api-macros => qemu-macros}/src/tests.rs (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 92d575b535..23bda7d332 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3521,7 +3521,7 @@ F: rust/common/
 F: rust/hw/core/
 F: rust/migration/
 F: rust/qemu-api
-F: rust/qemu-api-macros
+F: rust/qemu-macros/
 F: rust/qom/
 F: rust/rustfmt.toml
 F: rust/system/
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 77118e882b..021ce6dd48 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -41,7 +41,7 @@ dependencies = [
 name = "bits"
 version = "0.1.0"
 dependencies = [
- "qemu_api_macros",
+ "qemu_macros",
 ]
 
 [[package]]
@@ -58,7 +58,7 @@ dependencies = [
  "bql",
  "common",
  "migration",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "util",
 ]
@@ -94,7 +94,7 @@ dependencies = [
  "hwcore",
  "migration",
  "qemu_api",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "system",
  "util",
@@ -108,7 +108,7 @@ dependencies = [
  "chardev",
  "common",
  "migration",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "system",
  "util",
@@ -134,7 +134,7 @@ name = "migration"
 version = "0.1.0"
 dependencies = [
  "common",
- "qemu_api_macros",
+ "qemu_macros",
  "util",
 ]
 
@@ -151,7 +151,7 @@ dependencies = [
  "hwcore",
  "migration",
  "qemu_api",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "system",
  "util",
@@ -198,14 +198,14 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "system",
  "util",
 ]
 
 [[package]]
-name = "qemu_api_macros"
+name = "qemu_macros"
 version = "0.1.0"
 dependencies = [
  "proc-macro2",
@@ -220,7 +220,7 @@ dependencies = [
  "bql",
  "common",
  "migration",
- "qemu_api_macros",
+ "qemu_macros",
  "util",
 ]
 
@@ -249,7 +249,7 @@ name = "system"
 version = "0.1.0"
 dependencies = [
  "common",
- "qemu_api_macros",
+ "qemu_macros",
  "qom",
  "util",
 ]
@@ -268,7 +268,7 @@ dependencies = [
  "common",
  "foreign",
  "libc",
- "qemu_api_macros",
+ "qemu_macros",
 ]
 
 [[package]]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 8ec07d2065..b2a5c230fa 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -5,7 +5,7 @@ members = [
     "bql",
     "common",
     "migration",
-    "qemu-api-macros",
+    "qemu-macros",
     "qemu-api",
     "qom",
     "system",
diff --git a/rust/bits/Cargo.toml b/rust/bits/Cargo.toml
index 1ff38a4117..7fce972b27 100644
--- a/rust/bits/Cargo.toml
+++ b/rust/bits/Cargo.toml
@@ -13,7 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/bits/meson.build b/rust/bits/meson.build
index 2a41e138c5..359ca86f15 100644
--- a/rust/bits/meson.build
+++ b/rust/bits/meson.build
@@ -3,7 +3,7 @@ _bits_rs = static_library(
   'src/lib.rs',
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
-  dependencies: [qemu_api_macros],
+  dependencies: [qemu_macros],
 )
 
 bits_rs = declare_dependency(link_with: _bits_rs)
diff --git a/rust/bits/src/lib.rs b/rust/bits/src/lib.rs
index e9d15ad0cb..1bc882fde1 100644
--- a/rust/bits/src/lib.rs
+++ b/rust/bits/src/lib.rs
@@ -380,11 +380,11 @@ macro_rules! bits {
     };
 
     { $type:ty: $expr:expr } => {
-        ::qemu_api_macros::bits_const_internal! { $type @ ($expr) }
+        ::qemu_macros::bits_const_internal! { $type @ ($expr) }
     };
 
     { $type:ty as $int_type:ty: $expr:expr } => {
-        (::qemu_api_macros::bits_const_internal! { $type @ ($expr) }.into_bits()) as $int_type
+        (::qemu_macros::bits_const_internal! { $type @ ($expr) }.into_bits()) as $int_type
     };
 }
 
diff --git a/rust/chardev/Cargo.toml b/rust/chardev/Cargo.toml
index 7df9c677fc..c139177307 100644
--- a/rust/chardev/Cargo.toml
+++ b/rust/chardev/Cargo.toml
@@ -18,7 +18,7 @@ bql = { path = "../bql" }
 migration = { path = "../migration" }
 qom = { path = "../qom" }
 util = { path = "../util" }
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
index 5d333e232b..a2fa3268d2 100644
--- a/rust/chardev/meson.build
+++ b/rust/chardev/meson.build
@@ -35,7 +35,7 @@ _chardev_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
-  dependencies: [common_rs, qemu_api_macros],
+  dependencies: [common_rs, qemu_macros],
 )
 
-chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [qemu_api_macros, chardev, qemuutil])
+chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [qemu_macros, chardev, qemuutil])
diff --git a/rust/chardev/src/chardev.rs b/rust/chardev/src/chardev.rs
index 072d806e4a..cb6f99398e 100644
--- a/rust/chardev/src/chardev.rs
+++ b/rust/chardev/src/chardev.rs
@@ -26,7 +26,7 @@ use crate::bindings;
 
 /// A safe wrapper around [`bindings::Chardev`].
 #[repr(transparent)]
-#[derive(qemu_api_macros::Wrapper)]
+#[derive(qemu_macros::Wrapper)]
 pub struct Chardev(Opaque<bindings::Chardev>);
 
 pub type ChardevClass = bindings::ChardevClass;
diff --git a/rust/common/src/opaque.rs b/rust/common/src/opaque.rs
index 97ed3e8452..3b3263acaa 100644
--- a/rust/common/src/opaque.rs
+++ b/rust/common/src/opaque.rs
@@ -192,7 +192,7 @@ impl<T: Default> Opaque<T> {
 
 /// Annotates [`Self`] as a transparent wrapper for another type.
 ///
-/// Usually defined via the [`qemu_api_macros::Wrapper`] derive macro.
+/// Usually defined via the [`qemu_macros::Wrapper`] derive macro.
 ///
 /// # Examples
 ///
@@ -228,7 +228,7 @@ impl<T: Default> Opaque<T> {
 ///
 /// They are not defined here to allow them to be `const`.
 ///
-/// [`qemu_api_macros::Wrapper`]: ../../qemu_api_macros/derive.Wrapper.html
+/// [`qemu_macros::Wrapper`]: ../../qemu_macros/derive.Wrapper.html
 pub unsafe trait Wrapper {
     type Wrapped;
 }
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 830d88586b..9e451fc0aa 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -25,7 +25,7 @@ chardev = { path = "../../../chardev" }
 system = { path = "../../../system" }
 hwcore = { path = "../../../hw/core" }
 qemu_api = { path = "../../../qemu-api" }
-qemu_api_macros = { path = "../../../qemu-api-macros" }
+qemu_macros = { path = "../../../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index fac0432113..bad6a839c3 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -12,7 +12,7 @@ _libpl011_rs = static_library(
     util_rs,
     migration_rs,
     bql_rs,
-    qemu_api_macros,
+    qemu_macros,
     qom_rs,
     chardev_rs,
     system_rs,
@@ -24,6 +24,6 @@ rust_devices_ss.add(when: 'CONFIG_X_PL011_RUST', if_true: [declare_dependency(
   link_whole: [_libpl011_rs],
   # Putting proc macro crates in `dependencies` is necessary for Meson to find
   # them when compiling the root per-target static rust lib.
-  dependencies: [bilge_impl_rs, qemu_api_macros],
+  dependencies: [bilge_impl_rs, qemu_macros],
   variables: {'crate': 'pl011'},
 )])
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index a6a17d9f2d..3010b6d983 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -97,7 +97,7 @@ pub struct PL011Registers {
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
+#[derive(qemu_macros::Object, qemu_macros::Device)]
 /// PL011 Device Model in QEMU
 pub struct PL011State {
     pub parent_obj: ParentField<SysBusDevice>,
@@ -683,7 +683,7 @@ pub unsafe extern "C" fn pl011_create(
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
+#[derive(qemu_macros::Object, qemu_macros::Device)]
 /// PL011 Luminary device model.
 pub struct PL011Luminary {
     parent_obj: ParentField<PL011State>,
diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index 2bfbd81095..a1c41347ed 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -16,7 +16,7 @@ use migration::{impl_vmstate_bitsized, impl_vmstate_forward};
 #[doc(alias = "offset")]
 #[allow(non_camel_case_types)]
 #[repr(u64)]
-#[derive(Debug, Eq, PartialEq, qemu_api_macros::TryInto)]
+#[derive(Debug, Eq, PartialEq, qemu_macros::TryInto)]
 pub enum RegisterOffset {
     /// Data Register
     ///
diff --git a/rust/hw/core/Cargo.toml b/rust/hw/core/Cargo.toml
index 0b35380264..0eb9ffee26 100644
--- a/rust/hw/core/Cargo.toml
+++ b/rust/hw/core/Cargo.toml
@@ -20,7 +20,7 @@ chardev = { path = "../../chardev" }
 migration = { path = "../../migration" }
 system = { path = "../../system" }
 util = { path = "../../util" }
-qemu_api_macros = { path = "../../qemu-api-macros" }
+qemu_macros = { path = "../../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/core/meson.build b/rust/hw/core/meson.build
index 7dd1ade6f0..67eacf854f 100644
--- a/rust/hw/core/meson.build
+++ b/rust/hw/core/meson.build
@@ -58,7 +58,7 @@ _hwcore_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _chardev_rs, _migration_rs, _qom_rs, _system_rs, _util_rs],
-  dependencies: [qemu_api_macros, common_rs],
+  dependencies: [qemu_macros, common_rs],
 )
 
 hwcore_rs = declare_dependency(link_with: [_hwcore_rs],
@@ -71,7 +71,7 @@ test('rust-hwcore-rs-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [common_rs, hwcore_rs, bql_rs, migration_rs, qemu_api_macros, util_rs]),
+        dependencies: [common_rs, hwcore_rs, bql_rs, migration_rs, qemu_macros, util_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/hw/core/src/irq.rs b/rust/hw/core/src/irq.rs
index fead2bbe8e..d8d964cad2 100644
--- a/rust/hw/core/src/irq.rs
+++ b/rust/hw/core/src/irq.rs
@@ -18,7 +18,7 @@ use crate::bindings::{self, qemu_set_irq};
 
 /// An opaque wrapper around [`bindings::IRQState`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct IRQState(Opaque<bindings::IRQState>);
 
 /// Interrupt sources are used by devices to pass changes to a value (typically
diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 8e9702ce0b..c9faf44a71 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -23,7 +23,7 @@ use crate::{
 
 /// A safe wrapper around [`bindings::Clock`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct Clock(Opaque<bindings::Clock>);
 
 unsafe impl Send for Clock {}
@@ -31,7 +31,7 @@ unsafe impl Sync for Clock {}
 
 /// A safe wrapper around [`bindings::DeviceState`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct DeviceState(Opaque<bindings::DeviceState>);
 
 unsafe impl Send for DeviceState {}
@@ -101,7 +101,7 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
 
 /// Helper trait to return pointer to a [`bindings::PropertyInfo`] for a type.
 ///
-/// This trait is used by [`qemu_api_macros::Device`] derive macro.
+/// This trait is used by [`qemu_macros::Device`] derive macro.
 ///
 /// Base types that already have `qdev_prop_*` globals in the QEMU API should
 /// use those values as exported by the [`bindings`] module, instead of
diff --git a/rust/hw/core/src/sysbus.rs b/rust/hw/core/src/sysbus.rs
index dda71ebda7..92c7449b80 100644
--- a/rust/hw/core/src/sysbus.rs
+++ b/rust/hw/core/src/sysbus.rs
@@ -19,7 +19,7 @@ use crate::{
 
 /// A safe wrapper around [`bindings::SysBusDevice`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct SysBusDevice(Opaque<bindings::SysBusDevice>);
 
 unsafe impl Send for SysBusDevice {}
diff --git a/rust/hw/core/tests/tests.rs b/rust/hw/core/tests/tests.rs
index 21ee301fa6..2f08b8f3bf 100644
--- a/rust/hw/core/tests/tests.rs
+++ b/rust/hw/core/tests/tests.rs
@@ -17,7 +17,7 @@ pub const VMSTATE: VMStateDescription<DummyState> = VMStateDescriptionBuilder::<
     .build();
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
+#[derive(qemu_macros::Object, qemu_macros::Device)]
 pub struct DummyState {
     parent: ParentField<DeviceState>,
     #[property(rename = "migrate-clk", default = true)]
@@ -54,7 +54,7 @@ impl DeviceImpl for DummyState {
 }
 
 #[repr(C)]
-#[derive(qemu_api_macros::Object, qemu_api_macros::Device)]
+#[derive(qemu_macros::Object, qemu_macros::Device)]
 pub struct DummyChildState {
     parent: ParentField<DummyState>,
 }
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index e28d66f645..68e8187bb8 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -18,7 +18,7 @@ bql = { path = "../../../bql" }
 qom = { path = "../../../qom" }
 system = { path = "../../../system" }
 qemu_api = { path = "../../../qemu-api" }
-qemu_api_macros = { path = "../../../qemu-api-macros" }
+qemu_macros = { path = "../../../qemu-macros" }
 hwcore = { path = "../../../hw/core" }
 
 [lints]
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index e6f99b6778..3b94d5ec0a 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -9,7 +9,7 @@ _libhpet_rs = static_library(
     util_rs,
     migration_rs,
     bql_rs,
-    qemu_api_macros,
+    qemu_macros,
     qom_rs,
     system_rs,
     hwcore_rs,
@@ -20,6 +20,6 @@ rust_devices_ss.add(when: 'CONFIG_X_HPET_RUST', if_true: [declare_dependency(
   link_whole: [_libhpet_rs],
   # Putting proc macro crates in `dependencies` is necessary for Meson to find
   # them when compiling the root per-target static rust lib.
-  dependencies: [qemu_api_macros],
+  dependencies: [qemu_macros],
   variables: {'crate': 'hpet'},
 )])
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 3031539744..07e0f639fc 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -97,7 +97,7 @@ const HPET_TN_CFG_FSB_CAP_SHIFT: usize = 15;
 /// Timer N Interrupt Routing Capability (bits 32:63)
 const HPET_TN_CFG_INT_ROUTE_CAP_SHIFT: usize = 32;
 
-#[derive(qemu_api_macros::TryInto)]
+#[derive(qemu_macros::TryInto)]
 #[repr(u64)]
 #[allow(non_camel_case_types)]
 /// Timer registers, masked by 0x18
@@ -110,7 +110,7 @@ enum TimerRegister {
     ROUTE = 16,
 }
 
-#[derive(qemu_api_macros::TryInto)]
+#[derive(qemu_macros::TryInto)]
 #[repr(u64)]
 #[allow(non_camel_case_types)]
 /// Global registers
@@ -520,7 +520,7 @@ impl HPETTimer {
 
 /// HPET Event Timer Block Abstraction
 #[repr(C)]
-#[derive(qemu_api_macros::Object)]
+#[derive(qemu_macros::Object)]
 pub struct HPETState {
     parent_obj: ParentField<SysBusDevice>,
     iomem: MemoryRegion,
diff --git a/rust/meson.build b/rust/meson.build
index 041b0a473e..9f6a0b161d 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -23,7 +23,7 @@ qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
 genrs = []
 
 subdir('common')
-subdir('qemu-api-macros')
+subdir('qemu-macros')
 subdir('bits')
 subdir('util')
 subdir('migration')
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
index 98e6df2109..66af81e0a3 100644
--- a/rust/migration/Cargo.toml
+++ b/rust/migration/Cargo.toml
@@ -15,7 +15,7 @@ rust-version.workspace = true
 [dependencies]
 common = { path = "../common" }
 util = { path = "../util" }
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/qemu-api/Cargo.toml b/rust/qemu-api/Cargo.toml
index 9e7afc7e3a..9abb88aa1f 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/qemu-api/Cargo.toml
@@ -20,9 +20,9 @@ hwcore = { path = "../hw/core" }
 migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
+qemu_macros = { path = "../qemu-macros" }
 qom = { path = "../qom" }
 system = { path = "../system" }
-qemu_api_macros = { path = "../qemu-api-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
index 2dc638782c..fe81f16d99 100644
--- a/rust/qemu-api/meson.build
+++ b/rust/qemu-api/meson.build
@@ -52,12 +52,12 @@ _qemu_api_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, hwcore_rs, libc_rs, migration_rs, qemu_api_macros,
+  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, hwcore_rs, libc_rs, migration_rs, qemu_macros,
                  qom_rs, system_rs, util_rs, hwcore],
 )
 
 qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
-  dependencies: [qemu_api_macros, qom, hwcore, chardev, migration])
+  dependencies: [qemu_macros, qom, hwcore, chardev, migration])
 
 test('rust-qemu-api-integration',
     executable(
diff --git a/rust/qemu-api-macros/Cargo.toml b/rust/qemu-macros/Cargo.toml
similarity index 94%
rename from rust/qemu-api-macros/Cargo.toml
rename to rust/qemu-macros/Cargo.toml
index 0cd40c8e16..3b6f1d337f 100644
--- a/rust/qemu-api-macros/Cargo.toml
+++ b/rust/qemu-macros/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "qemu_api_macros"
+name = "qemu_macros"
 version = "0.1.0"
 authors = ["Manos Pitsidianakis <manos.pitsidianakis@linaro.org>"]
 description = "Rust bindings for QEMU - Utility macros"
diff --git a/rust/qemu-api-macros/meson.build b/rust/qemu-macros/meson.build
similarity index 63%
rename from rust/qemu-api-macros/meson.build
rename to rust/qemu-macros/meson.build
index 2152bcb99b..d0b2992e20 100644
--- a/rust/qemu-api-macros/meson.build
+++ b/rust/qemu-macros/meson.build
@@ -1,5 +1,5 @@
-_qemu_api_macros_rs = rust.proc_macro(
-  'qemu_api_macros',
+_qemu_macros_rs = rust.proc_macro(
+  'qemu_macros',
   files('src/lib.rs'),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_args: [
@@ -14,9 +14,9 @@ _qemu_api_macros_rs = rust.proc_macro(
   ],
 )
 
-qemu_api_macros = declare_dependency(
-  link_with: _qemu_api_macros_rs,
+qemu_macros = declare_dependency(
+  link_with: _qemu_macros_rs,
 )
 
-rust.test('rust-qemu-api-macros-tests', _qemu_api_macros_rs,
+rust.test('rust-qemu-macros-tests', _qemu_macros_rs,
           suite: ['unit', 'rust'])
diff --git a/rust/qemu-api-macros/src/bits.rs b/rust/qemu-macros/src/bits.rs
similarity index 100%
rename from rust/qemu-api-macros/src/bits.rs
rename to rust/qemu-macros/src/bits.rs
diff --git a/rust/qemu-api-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
similarity index 100%
rename from rust/qemu-api-macros/src/lib.rs
rename to rust/qemu-macros/src/lib.rs
diff --git a/rust/qemu-api-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
similarity index 100%
rename from rust/qemu-api-macros/src/tests.rs
rename to rust/qemu-macros/src/tests.rs
diff --git a/rust/qom/Cargo.toml b/rust/qom/Cargo.toml
index 46bbf7c7fe..060ad2ec34 100644
--- a/rust/qom/Cargo.toml
+++ b/rust/qom/Cargo.toml
@@ -16,7 +16,7 @@ rust-version.workspace = true
 common = { path = "../common" }
 bql = { path = "../bql" }
 migration = { path = "../migration" }
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 util = { path = "../util" }
 
 [lints]
diff --git a/rust/qom/meson.build b/rust/qom/meson.build
index 84a65cb737..40c51b71b2 100644
--- a/rust/qom/meson.build
+++ b/rust/qom/meson.build
@@ -28,10 +28,10 @@ _qom_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs],
-  dependencies: [common_rs, qemu_api_macros],
+  dependencies: [common_rs, qemu_macros],
 )
 
-qom_rs = declare_dependency(link_with: [_qom_rs], dependencies: [qemu_api_macros, qom])
+qom_rs = declare_dependency(link_with: [_qom_rs], dependencies: [qemu_macros, qom])
 
 # Doctests are essentially integration tests, so they need the same dependencies.
 # Note that running them requires the object files for C code, so place them
diff --git a/rust/qom/src/qom.rs b/rust/qom/src/qom.rs
index 3ea1ad9c5b..2cd1d85011 100644
--- a/rust/qom/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -112,7 +112,7 @@ pub use crate::bindings::{type_register_static, ObjectClass};
 
 /// A safe wrapper around [`bindings::Object`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct Object(Opaque<bindings::Object>);
 
 unsafe impl Send for Object {}
@@ -173,7 +173,7 @@ macro_rules! qom_isa {
 ///
 /// ```ignore
 /// #[repr(C)]
-/// #[derive(qemu_api_macros::Object)]
+/// #[derive(qemu_macros::Object)]
 /// pub struct MyDevice {
 ///     parent: ParentField<DeviceState>,
 ///     ...
diff --git a/rust/system/Cargo.toml b/rust/system/Cargo.toml
index 6803895e08..d8338c8348 100644
--- a/rust/system/Cargo.toml
+++ b/rust/system/Cargo.toml
@@ -16,7 +16,7 @@ rust-version.workspace = true
 common = { path = "../common" }
 qom = { path = "../qom" }
 util = { path = "../util" }
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/system/meson.build b/rust/system/meson.build
index ae9b932d29..9f88166f3d 100644
--- a/rust/system/meson.build
+++ b/rust/system/meson.build
@@ -35,8 +35,8 @@ _system_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
-  dependencies: [common_rs, qemu_api_macros],
+  dependencies: [common_rs, qemu_macros],
 )
 
 system_rs = declare_dependency(link_with: [_system_rs],
-  dependencies: [qemu_api_macros, hwcore])
+  dependencies: [qemu_macros, hwcore])
diff --git a/rust/system/src/memory.rs b/rust/system/src/memory.rs
index 29568ed767..7312f809f5 100644
--- a/rust/system/src/memory.rs
+++ b/rust/system/src/memory.rs
@@ -129,7 +129,7 @@ impl<T> Default for MemoryRegionOpsBuilder<T> {
 
 /// A safe wrapper around [`bindings::MemoryRegion`].
 #[repr(transparent)]
-#[derive(qemu_api_macros::Wrapper)]
+#[derive(qemu_macros::Wrapper)]
 pub struct MemoryRegion(Opaque<bindings::MemoryRegion>);
 
 unsafe impl Send for MemoryRegion {}
diff --git a/rust/util/Cargo.toml b/rust/util/Cargo.toml
index 637df61060..18e6619ca0 100644
--- a/rust/util/Cargo.toml
+++ b/rust/util/Cargo.toml
@@ -17,7 +17,7 @@ anyhow = { workspace = true }
 foreign = { workspace = true }
 libc = { workspace = true }
 common = { path = "../common" }
-qemu_api_macros = { path = "../qemu-api-macros" }
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 56e929349b..197872c9b2 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -39,7 +39,7 @@ _util_rs = static_library(
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
-  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qemu_api_macros, qom, qemuutil],
+  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qemu_macros, qom, qemuutil],
 )
 
 util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
diff --git a/rust/util/src/timer.rs b/rust/util/src/timer.rs
index 383e1a6e77..622b6ee309 100644
--- a/rust/util/src/timer.rs
+++ b/rust/util/src/timer.rs
@@ -15,14 +15,14 @@ use crate::bindings::{
 
 /// A safe wrapper around [`bindings::QEMUTimer`].
 #[repr(transparent)]
-#[derive(Debug, qemu_api_macros::Wrapper)]
+#[derive(Debug, qemu_macros::Wrapper)]
 pub struct Timer(Opaque<bindings::QEMUTimer>);
 
 unsafe impl Send for Timer {}
 unsafe impl Sync for Timer {}
 
 #[repr(transparent)]
-#[derive(qemu_api_macros::Wrapper)]
+#[derive(qemu_macros::Wrapper)]
 pub struct TimerListGroup(Opaque<bindings::QEMUTimerListGroup>);
 
 unsafe impl Send for TimerListGroup {}

From 960aaeb0238612cf7d7a8f17937e860da3d23cb3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:58 +0200
Subject: [PATCH 0492/2396] rust/hpet: drop now unneeded qemu_api dep
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-18-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                | 1 -
 rust/hw/timer/hpet/Cargo.toml  | 1 -
 rust/hw/timer/hpet/meson.build | 1 -
 3 files changed, 3 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 021ce6dd48..c407029afe 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -93,7 +93,6 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_api",
  "qemu_macros",
  "qom",
  "system",
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 68e8187bb8..08bf97af55 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -17,7 +17,6 @@ migration = { path = "../../../migration" }
 bql = { path = "../../../bql" }
 qom = { path = "../../../qom" }
 system = { path = "../../../system" }
-qemu_api = { path = "../../../qemu-api" }
 qemu_macros = { path = "../../../qemu-macros" }
 hwcore = { path = "../../../hw/core" }
 
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index 3b94d5ec0a..8ab26630d9 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -5,7 +5,6 @@ _libhpet_rs = static_library(
   rust_abi: 'rust',
   dependencies: [
     common_rs,
-    qemu_api_rs,
     util_rs,
     migration_rs,
     bql_rs,

From 966b1c302e1bab3b20a356f1a6678dd1bee5575c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:49:59 +0200
Subject: [PATCH 0493/2396] rust/pl011: drop dependency on qemu_api
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-19-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                    |  1 -
 rust/hw/char/pl011/Cargo.toml      |  1 -
 rust/hw/char/pl011/build.rs        |  1 +
 rust/hw/char/pl011/meson.build     | 27 ++++++++++++++--
 rust/hw/char/pl011/src/bindings.rs | 27 ++++++++++++++++
 rust/hw/char/pl011/src/device.rs   |  2 +-
 rust/hw/char/pl011/src/lib.rs      |  1 +
 rust/hw/char/pl011/wrapper.h       | 51 ++++++++++++++++++++++++++++++
 8 files changed, 106 insertions(+), 5 deletions(-)
 create mode 120000 rust/hw/char/pl011/build.rs
 create mode 100644 rust/hw/char/pl011/src/bindings.rs
 create mode 100644 rust/hw/char/pl011/wrapper.h

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index c407029afe..2018d13fbf 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -149,7 +149,6 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_api",
  "qemu_macros",
  "qom",
  "system",
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 9e451fc0aa..285d25c217 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -24,7 +24,6 @@ qom = { path = "../../../qom" }
 chardev = { path = "../../../chardev" }
 system = { path = "../../../system" }
 hwcore = { path = "../../../hw/core" }
-qemu_api = { path = "../../../qemu-api" }
 qemu_macros = { path = "../../../qemu-macros" }
 
 [lints]
diff --git a/rust/hw/char/pl011/build.rs b/rust/hw/char/pl011/build.rs
new file mode 120000
index 0000000000..5f5060db35
--- /dev/null
+++ b/rust/hw/char/pl011/build.rs
@@ -0,0 +1 @@
+../../../util/build.rs
\ No newline at end of file
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index bad6a839c3..a14993f692 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -1,6 +1,30 @@
+# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
+#
+# Rust bindings generation with `bindgen` might fail in some cases where the
+# detected `libclang` does not match the expected `clang` version/target. In
+# this case you must pass the path to `clang` and `libclang` to your build
+# command invocation using the environment variables CLANG_PATH and
+# LIBCLANG_PATH
+_libpl011_bindings_inc_rs = rust.bindgen(
+  input: 'wrapper.h',
+  dependencies: common_ss.all_dependencies(),
+  output: 'bindings.inc.rs',
+  include_directories: bindings_incdir,
+  bindgen_version: ['>=0.60.0'],
+  args: bindgen_args_common,
+)
+
 _libpl011_rs = static_library(
   'pl011',
-  files('src/lib.rs'),
+  structured_sources(
+    [
+      'src/lib.rs',
+      'src/bindings.rs',
+      'src/device.rs',
+      'src/registers.rs',
+    ],
+    {'.' : _libpl011_bindings_inc_rs},
+  ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   dependencies: [
@@ -8,7 +32,6 @@ _libpl011_rs = static_library(
     bilge_impl_rs,
     bits_rs,
     common_rs,
-    qemu_api_rs,
     util_rs,
     migration_rs,
     bql_rs,
diff --git a/rust/hw/char/pl011/src/bindings.rs b/rust/hw/char/pl011/src/bindings.rs
new file mode 100644
index 0000000000..bd5ea840cb
--- /dev/null
+++ b/rust/hw/char/pl011/src/bindings.rs
@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+#![allow(
+    dead_code,
+    improper_ctypes_definitions,
+    improper_ctypes,
+    non_camel_case_types,
+    non_snake_case,
+    non_upper_case_globals,
+    unnecessary_transmutes,
+    unsafe_op_in_unsafe_fn,
+    clippy::pedantic,
+    clippy::restriction,
+    clippy::style,
+    clippy::missing_const_for_fn,
+    clippy::ptr_offset_with_cast,
+    clippy::useless_transmute,
+    clippy::missing_safety_doc,
+    clippy::too_many_arguments
+)]
+
+//! `bindgen`-generated declarations.
+
+#[cfg(MESON)]
+include!("bindings.inc.rs");
+
+#[cfg(not(MESON))]
+include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 3010b6d983..85626a969d 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -130,7 +130,7 @@ pub struct PL011State {
 // structs, so the size of the Rust version must not be any larger
 // than the size of the C one. If this assert triggers you need to
 // expand the padding_for_rust[] array in the C PL011State struct.
-static_assert!(size_of::<PL011State>() <= size_of::<qemu_api::bindings::PL011State>());
+static_assert!(size_of::<PL011State>() <= size_of::<crate::bindings::PL011State>());
 
 qom_isa!(PL011State : SysBusDevice, DeviceState, Object);
 
diff --git a/rust/hw/char/pl011/src/lib.rs b/rust/hw/char/pl011/src/lib.rs
index 2b70d2ff56..0c19b708c0 100644
--- a/rust/hw/char/pl011/src/lib.rs
+++ b/rust/hw/char/pl011/src/lib.rs
@@ -12,6 +12,7 @@
 //! See [`PL011State`](crate::device::PL011State) for the device model type and
 //! the [`registers`] module for register types.
 
+mod bindings;
 mod device;
 mod registers;
 
diff --git a/rust/hw/char/pl011/wrapper.h b/rust/hw/char/pl011/wrapper.h
new file mode 100644
index 0000000000..87a5a589c8
--- /dev/null
+++ b/rust/hw/char/pl011/wrapper.h
@@ -0,0 +1,51 @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2024 Linaro Ltd.
+ *
+ * Authors: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+
+/*
+ * This header file is meant to be used as input to the `bindgen` application
+ * in order to generate C FFI compatible Rust bindings.
+ */
+
+#ifndef __CLANG_STDATOMIC_H
+#define __CLANG_STDATOMIC_H
+/*
+ * Fix potential missing stdatomic.h error in case bindgen does not insert the
+ * correct libclang header paths on its own. We do not use stdatomic.h symbols
+ * in QEMU code, so it's fine to declare dummy types instead.
+ */
+typedef enum memory_order {
+  memory_order_relaxed,
+  memory_order_consume,
+  memory_order_acquire,
+  memory_order_release,
+  memory_order_acq_rel,
+  memory_order_seq_cst,
+} memory_order;
+#endif /* __CLANG_STDATOMIC_H */
+
+#include "qemu/osdep.h"
+#include "hw/char/pl011.h"

From d58fcd05ffc682fbad02cd8d0bee840cb7997e3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:50:00 +0200
Subject: [PATCH 0494/2396] rust: repurpose qemu_api -> tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The crate purpose is only to provide integration tests at this point,
that can't easily be moved to a specific crate.

It's also often a good practice to have a single integration test crate
(see for ex https://github.com/rust-lang/cargo/issues/4867)

Drop README.md, use docs/devel/rust.rst instead.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-20-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS                                   |  2 +-
 rust/Cargo.lock                               | 30 ++++----
 rust/Cargo.toml                               |  2 +-
 rust/meson.build                              |  4 +-
 rust/qemu-api/.gitignore                      |  2 -
 rust/qemu-api/README.md                       | 19 -----
 rust/qemu-api/build.rs                        |  1 -
 rust/qemu-api/meson.build                     | 75 -------------------
 rust/qemu-api/src/bindings.rs                 | 33 --------
 rust/qemu-api/src/lib.rs                      | 18 -----
 rust/qemu-api/src/prelude.rs                  |  5 --
 rust/qemu-api/wrapper.h                       | 53 -------------
 rust/{qemu-api => tests}/Cargo.toml           |  7 +-
 rust/tests/meson.build                        | 14 ++++
 .../tests/vmstate_tests.rs                    |  0
 15 files changed, 35 insertions(+), 230 deletions(-)
 delete mode 100644 rust/qemu-api/.gitignore
 delete mode 100644 rust/qemu-api/README.md
 delete mode 120000 rust/qemu-api/build.rs
 delete mode 100644 rust/qemu-api/meson.build
 delete mode 100644 rust/qemu-api/src/bindings.rs
 delete mode 100644 rust/qemu-api/src/lib.rs
 delete mode 100644 rust/qemu-api/src/prelude.rs
 delete mode 100644 rust/qemu-api/wrapper.h
 rename rust/{qemu-api => tests}/Cargo.toml (78%)
 create mode 100644 rust/tests/meson.build
 rename rust/{qemu-api => tests}/tests/vmstate_tests.rs (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 23bda7d332..05e0597d53 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3520,11 +3520,11 @@ F: rust/chardev/
 F: rust/common/
 F: rust/hw/core/
 F: rust/migration/
-F: rust/qemu-api
 F: rust/qemu-macros/
 F: rust/qom/
 F: rust/rustfmt.toml
 F: rust/system/
+F: rust/tests/
 F: rust/util/
 F: scripts/get-wraps-from-cargo-registry.py
 
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 2018d13fbf..ac79c6a34a 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -187,21 +187,6 @@ dependencies = [
  "unicode-ident",
 ]
 
-[[package]]
-name = "qemu_api"
-version = "0.1.0"
-dependencies = [
- "bql",
- "chardev",
- "common",
- "hwcore",
- "migration",
- "qemu_macros",
- "qom",
- "system",
- "util",
-]
-
 [[package]]
 name = "qemu_macros"
 version = "0.1.0"
@@ -252,6 +237,21 @@ dependencies = [
  "util",
 ]
 
+[[package]]
+name = "tests"
+version = "0.1.0"
+dependencies = [
+ "bql",
+ "chardev",
+ "common",
+ "hwcore",
+ "migration",
+ "qemu_macros",
+ "qom",
+ "system",
+ "util",
+]
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index b2a5c230fa..d8183c614d 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -6,13 +6,13 @@ members = [
     "common",
     "migration",
     "qemu-macros",
-    "qemu-api",
     "qom",
     "system",
     "hw/core",
     "hw/char/pl011",
     "hw/timer/hpet",
     "util",
+    "tests",
 ]
 
 [workspace.package]
diff --git a/rust/meson.build b/rust/meson.build
index 9f6a0b161d..bd9b9cb83e 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -18,8 +18,6 @@ quote_rs_native = dependency('quote-1-rs', native: true)
 syn_rs_native = dependency('syn-2-rs', native: true)
 proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
 
-qemuutil_rs = qemuutil.partial_dependency(link_args: true, links: true)
-
 genrs = []
 
 subdir('common')
@@ -32,7 +30,7 @@ subdir('qom')
 subdir('system')
 subdir('chardev')
 subdir('hw/core')
-subdir('qemu-api')
+subdir('tests')
 
 subdir('hw')
 
diff --git a/rust/qemu-api/.gitignore b/rust/qemu-api/.gitignore
deleted file mode 100644
index df6c2163e0..0000000000
--- a/rust/qemu-api/.gitignore
+++ /dev/null
@@ -1,2 +0,0 @@
-# Ignore generated bindings file overrides.
-/src/bindings.inc.rs
diff --git a/rust/qemu-api/README.md b/rust/qemu-api/README.md
deleted file mode 100644
index ed1b7ab263..0000000000
--- a/rust/qemu-api/README.md
+++ /dev/null
@@ -1,19 +0,0 @@
-# QEMU bindings and API wrappers
-
-This library exports helper Rust types, Rust macros and C FFI bindings for internal QEMU APIs.
-
-The C bindings can be generated with `bindgen`, using this build target:
-
-```console
-$ make bindings.inc.rs
-```
-
-## Generate Rust documentation
-
-Common Cargo tasks can be performed from the QEMU build directory
-
-```console
-$ make clippy
-$ make rustfmt
-$ make rustdoc
-```
diff --git a/rust/qemu-api/build.rs b/rust/qemu-api/build.rs
deleted file mode 120000
index 71a3167885..0000000000
--- a/rust/qemu-api/build.rs
+++ /dev/null
@@ -1 +0,0 @@
-../util/build.rs
\ No newline at end of file
diff --git a/rust/qemu-api/meson.build b/rust/qemu-api/meson.build
deleted file mode 100644
index fe81f16d99..0000000000
--- a/rust/qemu-api/meson.build
+++ /dev/null
@@ -1,75 +0,0 @@
-_qemu_api_cfg = run_command(rustc_args,
-  '--config-headers', config_host_h, '--features', files('Cargo.toml'),
-  capture: true, check: true).stdout().strip().splitlines()
-
-c_enums = [
-  'MemoryDeviceInfoKind',
-]
-_qemu_api_bindgen_args = []
-foreach enum : c_enums
-  _qemu_api_bindgen_args += ['--rustified-enum', enum]
-endforeach
-
-blocked_type = [
-  'Chardev',
-  'Error',
-  'MemTxAttrs',
-  'MemoryRegion',
-  'ObjectClass',
-  'VMStateDescription',
-  'device_endian',
-]
-foreach type: blocked_type
-  _qemu_api_bindgen_args += ['--blocklist-type', type]
-endforeach
-
-# TODO: Remove this comment when the clang/libclang mismatch issue is solved.
-#
-# Rust bindings generation with `bindgen` might fail in some cases where the
-# detected `libclang` does not match the expected `clang` version/target. In
-# this case you must pass the path to `clang` and `libclang` to your build
-# command invocation using the environment variables CLANG_PATH and
-# LIBCLANG_PATH
-_qemu_api_bindings_inc_rs = rust.bindgen(
-  input: 'wrapper.h',
-  dependencies: common_ss.all_dependencies(),
-  output: 'bindings.inc.rs',
-  include_directories: bindings_incdir,
-  bindgen_version: ['>=0.60.0'],
-  args: bindgen_args_common + _qemu_api_bindgen_args,
-  )
-
-_qemu_api_rs = static_library(
-  'qemu_api',
-  structured_sources(
-    [
-      'src/lib.rs',
-      'src/bindings.rs',
-      'src/prelude.rs',
-    ],
-    {'.' : _qemu_api_bindings_inc_rs},
-  ),
-  override_options: ['rust_std=2021', 'build.rust_std=2021'],
-  rust_abi: 'rust',
-  rust_args: _qemu_api_cfg,
-  dependencies: [anyhow_rs, bql_rs, chardev_rs, common_rs, foreign_rs, hwcore_rs, libc_rs, migration_rs, qemu_macros,
-                 qom_rs, system_rs, util_rs, hwcore],
-)
-
-qemu_api_rs = declare_dependency(link_with: [_qemu_api_rs],
-  dependencies: [qemu_macros, qom, hwcore, chardev, migration])
-
-test('rust-qemu-api-integration',
-    executable(
-        'rust-qemu-api-integration',
-        files('tests/vmstate_tests.rs'),
-        override_options: ['rust_std=2021', 'build.rust_std=2021'],
-        rust_args: ['--test'],
-        install: false,
-        dependencies: [bql_rs, common_rs, util_rs, migration_rs, qom_rs, qemu_api_rs]),
-    args: [
-        '--test', '--test-threads', '1',
-        '--format', 'pretty',
-    ],
-    protocol: 'rust',
-    suite: ['unit', 'rust'])
diff --git a/rust/qemu-api/src/bindings.rs b/rust/qemu-api/src/bindings.rs
deleted file mode 100644
index 9c863e9b5b..0000000000
--- a/rust/qemu-api/src/bindings.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-or-later
-#![allow(
-    dead_code,
-    improper_ctypes_definitions,
-    improper_ctypes,
-    non_camel_case_types,
-    non_snake_case,
-    non_upper_case_globals,
-    unnecessary_transmutes,
-    unsafe_op_in_unsafe_fn,
-    clippy::pedantic,
-    clippy::restriction,
-    clippy::style,
-    clippy::missing_const_for_fn,
-    clippy::ptr_offset_with_cast,
-    clippy::useless_transmute,
-    clippy::missing_safety_doc,
-    clippy::too_many_arguments
-)]
-
-//! `bindgen`-generated declarations.
-
-use chardev::bindings::Chardev;
-use migration::bindings::VMStateDescription;
-use qom::bindings::ObjectClass;
-use system::bindings::{device_endian, MemTxAttrs, MemoryRegion};
-use util::bindings::Error;
-
-#[cfg(MESON)]
-include!("bindings.inc.rs");
-
-#[cfg(not(MESON))]
-include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
diff --git a/rust/qemu-api/src/lib.rs b/rust/qemu-api/src/lib.rs
deleted file mode 100644
index 21b886035f..0000000000
--- a/rust/qemu-api/src/lib.rs
+++ /dev/null
@@ -1,18 +0,0 @@
-// Copyright 2024, Linaro Limited
-// Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-#![cfg_attr(not(MESON), doc = include_str!("../README.md"))]
-#![deny(clippy::missing_const_for_fn)]
-
-#[rustfmt::skip]
-pub mod bindings;
-
-// preserve one-item-per-"use" syntax, it is clearer
-// for prelude-like modules
-#[rustfmt::skip]
-pub mod prelude;
-
-// Allow proc-macros to refer to `::qemu_api` inside the `qemu_api` crate (this
-// crate).
-extern crate self as qemu_api;
diff --git a/rust/qemu-api/src/prelude.rs b/rust/qemu-api/src/prelude.rs
deleted file mode 100644
index 8db56f9f81..0000000000
--- a/rust/qemu-api/src/prelude.rs
+++ /dev/null
@@ -1,5 +0,0 @@
-// Copyright 2024 Red Hat, Inc.
-// Author(s): Paolo Bonzini <pbonzini@redhat.com>
-// SPDX-License-Identifier: GPL-2.0-or-later
-
-//! Commonly used traits and types for QEMU.
diff --git a/rust/qemu-api/wrapper.h b/rust/qemu-api/wrapper.h
deleted file mode 100644
index 7c9c20b14f..0000000000
--- a/rust/qemu-api/wrapper.h
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * QEMU System Emulator
- *
- * Copyright (c) 2024 Linaro Ltd.
- *
- * Authors: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-
-/*
- * This header file is meant to be used as input to the `bindgen` application
- * in order to generate C FFI compatible Rust bindings.
- */
-
-#ifndef __CLANG_STDATOMIC_H
-#define __CLANG_STDATOMIC_H
-/*
- * Fix potential missing stdatomic.h error in case bindgen does not insert the
- * correct libclang header paths on its own. We do not use stdatomic.h symbols
- * in QEMU code, so it's fine to declare dummy types instead.
- */
-typedef enum memory_order {
-  memory_order_relaxed,
-  memory_order_consume,
-  memory_order_acquire,
-  memory_order_release,
-  memory_order_acq_rel,
-  memory_order_seq_cst,
-} memory_order;
-#endif /* __CLANG_STDATOMIC_H */
-
-#include "qemu/osdep.h"
-#include "qemu-io.h"
-#include "exec/memattrs.h"
-#include "hw/char/pl011.h"
diff --git a/rust/qemu-api/Cargo.toml b/rust/tests/Cargo.toml
similarity index 78%
rename from rust/qemu-api/Cargo.toml
rename to rust/tests/Cargo.toml
index 9abb88aa1f..8d106d896d 100644
--- a/rust/qemu-api/Cargo.toml
+++ b/rust/tests/Cargo.toml
@@ -1,12 +1,11 @@
 [package]
-name = "qemu_api"
+name = "tests"
 version = "0.1.0"
-authors = ["Manos Pitsidianakis <manos.pitsidianakis@linaro.org>"]
-description = "Rust bindings for QEMU"
-readme = "README.md"
+description = "Rust integration tests for QEMU"
 resolver = "2"
 publish = false
 
+authors.workspace = true
 edition.workspace = true
 homepage.workspace = true
 license.workspace = true
diff --git a/rust/tests/meson.build b/rust/tests/meson.build
new file mode 100644
index 0000000000..00688c66fb
--- /dev/null
+++ b/rust/tests/meson.build
@@ -0,0 +1,14 @@
+test('rust-integration',
+    executable(
+        'rust-integration',
+        files('tests/vmstate_tests.rs'),
+        override_options: ['rust_std=2021', 'build.rust_std=2021'],
+        rust_args: ['--test'],
+        install: false,
+        dependencies: [bql_rs, common_rs, util_rs, migration_rs, qom_rs]),
+    args: [
+        '--test', '--test-threads', '1',
+        '--format', 'pretty',
+    ],
+    protocol: 'rust',
+    suite: ['unit', 'rust'])
diff --git a/rust/qemu-api/tests/vmstate_tests.rs b/rust/tests/tests/vmstate_tests.rs
similarity index 100%
rename from rust/qemu-api/tests/vmstate_tests.rs
rename to rust/tests/tests/vmstate_tests.rs

From b0f6bf8a5b3b3a9dd4a11f792084d39a76b4b007 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:50:01 +0200
Subject: [PATCH 0495/2396] rust: re-export qemu_macros internal helper in
 "bits"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid the need to import "qemu_macros".

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-21-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/bits/src/lib.rs | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/rust/bits/src/lib.rs b/rust/bits/src/lib.rs
index 1bc882fde1..d1141f7c88 100644
--- a/rust/bits/src/lib.rs
+++ b/rust/bits/src/lib.rs
@@ -380,14 +380,17 @@ macro_rules! bits {
     };
 
     { $type:ty: $expr:expr } => {
-        ::qemu_macros::bits_const_internal! { $type @ ($expr) }
+        $crate::bits_const_internal! { $type @ ($expr) }
     };
 
     { $type:ty as $int_type:ty: $expr:expr } => {
-        (::qemu_macros::bits_const_internal! { $type @ ($expr) }.into_bits()) as $int_type
+        ($crate::bits_const_internal! { $type @ ($expr) }.into_bits()) as $int_type
     };
 }
 
+#[doc(hidden)]
+pub use qemu_macros::bits_const_internal;
+
 #[cfg(test)]
 mod test {
     bits! {

From e4444d71e85b5f5ea8311eb59fea3e52f5fc5a14 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:50:02 +0200
Subject: [PATCH 0496/2396] rust: re-export qemu macros from common/qom/hwcore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is just a bit nicer.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-22-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst                 | 2 +-
 rust/Cargo.lock                     | 8 +-------
 rust/chardev/Cargo.toml             | 1 -
 rust/chardev/meson.build            | 2 +-
 rust/chardev/src/chardev.rs         | 2 +-
 rust/common/Cargo.toml              | 1 +
 rust/common/meson.build             | 2 +-
 rust/common/src/lib.rs              | 2 ++
 rust/common/src/opaque.rs           | 4 +---
 rust/hw/char/pl011/Cargo.toml       | 1 -
 rust/hw/char/pl011/meson.build      | 1 -
 rust/hw/char/pl011/src/device.rs    | 4 ++--
 rust/hw/char/pl011/src/registers.rs | 2 +-
 rust/hw/core/Cargo.toml             | 2 +-
 rust/hw/core/meson.build            | 2 +-
 rust/hw/core/src/irq.rs             | 2 +-
 rust/hw/core/src/lib.rs             | 1 +
 rust/hw/core/src/qdev.rs            | 4 ++--
 rust/hw/core/src/sysbus.rs          | 2 +-
 rust/hw/core/tests/tests.rs         | 4 ++--
 rust/hw/timer/hpet/Cargo.toml       | 1 -
 rust/hw/timer/hpet/meson.build      | 1 -
 rust/hw/timer/hpet/src/device.rs    | 6 +++---
 rust/meson.build                    | 3 ++-
 rust/migration/Cargo.toml           | 1 -
 rust/qom/src/lib.rs                 | 2 ++
 rust/qom/src/qom.rs                 | 4 ++--
 rust/system/Cargo.toml              | 1 -
 rust/system/meson.build             | 2 +-
 rust/system/src/memory.rs           | 2 +-
 rust/tests/Cargo.toml               | 1 -
 rust/util/Cargo.toml                | 1 -
 rust/util/meson.build               | 2 +-
 rust/util/src/timer.rs              | 4 ++--
 34 files changed, 35 insertions(+), 45 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 20d15347de..29eb48af35 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -278,7 +278,7 @@ a raw pointer, for use in calls to C functions.  It can be used for
 example as follows::
 
     #[repr(transparent)]
-    #[derive(Debug, qemu_api_macros::Wrapper)]
+    #[derive(Debug, common::Wrapper)]
     pub struct Object(Opaque<bindings::Object>);
 
 where the special ``derive`` macro provides useful methods such as
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index ac79c6a34a..eea928621a 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -58,7 +58,6 @@ dependencies = [
  "bql",
  "common",
  "migration",
- "qemu_macros",
  "qom",
  "util",
 ]
@@ -68,6 +67,7 @@ name = "common"
 version = "0.1.0"
 dependencies = [
  "libc",
+ "qemu_macros",
 ]
 
 [[package]]
@@ -93,7 +93,6 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_macros",
  "qom",
  "system",
  "util",
@@ -133,7 +132,6 @@ name = "migration"
 version = "0.1.0"
 dependencies = [
  "common",
- "qemu_macros",
  "util",
 ]
 
@@ -149,7 +147,6 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_macros",
  "qom",
  "system",
  "util",
@@ -232,7 +229,6 @@ name = "system"
 version = "0.1.0"
 dependencies = [
  "common",
- "qemu_macros",
  "qom",
  "util",
 ]
@@ -246,7 +242,6 @@ dependencies = [
  "common",
  "hwcore",
  "migration",
- "qemu_macros",
  "qom",
  "system",
  "util",
@@ -266,7 +261,6 @@ dependencies = [
  "common",
  "foreign",
  "libc",
- "qemu_macros",
 ]
 
 [[package]]
diff --git a/rust/chardev/Cargo.toml b/rust/chardev/Cargo.toml
index c139177307..3e77972546 100644
--- a/rust/chardev/Cargo.toml
+++ b/rust/chardev/Cargo.toml
@@ -18,7 +18,6 @@ bql = { path = "../bql" }
 migration = { path = "../migration" }
 qom = { path = "../qom" }
 util = { path = "../util" }
-qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
index a2fa3268d2..370895c111 100644
--- a/rust/chardev/meson.build
+++ b/rust/chardev/meson.build
@@ -38,4 +38,4 @@ _chardev_rs = static_library(
   dependencies: [common_rs, qemu_macros],
 )
 
-chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [qemu_macros, chardev, qemuutil])
+chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [chardev, qemuutil])
diff --git a/rust/chardev/src/chardev.rs b/rust/chardev/src/chardev.rs
index cb6f99398e..2014479674 100644
--- a/rust/chardev/src/chardev.rs
+++ b/rust/chardev/src/chardev.rs
@@ -26,7 +26,7 @@ use crate::bindings;
 
 /// A safe wrapper around [`bindings::Chardev`].
 #[repr(transparent)]
-#[derive(qemu_macros::Wrapper)]
+#[derive(common::Wrapper)]
 pub struct Chardev(Opaque<bindings::Chardev>);
 
 pub type ChardevClass = bindings::ChardevClass;
diff --git a/rust/common/Cargo.toml b/rust/common/Cargo.toml
index 5e106427e8..0e1b4fc505 100644
--- a/rust/common/Cargo.toml
+++ b/rust/common/Cargo.toml
@@ -14,6 +14,7 @@ rust-version.workspace = true
 
 [dependencies]
 libc.workspace = true
+qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/common/meson.build b/rust/common/meson.build
index 230a967760..b805e0faf5 100644
--- a/rust/common/meson.build
+++ b/rust/common/meson.build
@@ -19,7 +19,7 @@ _common_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _common_cfg,
-  dependencies: [libc_rs],
+  dependencies: [libc_rs, qemu_macros],
 )
 
 common_rs = declare_dependency(link_with: [_common_rs])
diff --git a/rust/common/src/lib.rs b/rust/common/src/lib.rs
index 25216503aa..8311bf945d 100644
--- a/rust/common/src/lib.rs
+++ b/rust/common/src/lib.rs
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+pub use qemu_macros::{TryInto, Wrapper};
+
 pub mod assertions;
 
 pub mod bitops;
diff --git a/rust/common/src/opaque.rs b/rust/common/src/opaque.rs
index 3b3263acaa..c941fb4546 100644
--- a/rust/common/src/opaque.rs
+++ b/rust/common/src/opaque.rs
@@ -192,7 +192,7 @@ impl<T: Default> Opaque<T> {
 
 /// Annotates [`Self`] as a transparent wrapper for another type.
 ///
-/// Usually defined via the [`qemu_macros::Wrapper`] derive macro.
+/// Usually defined via the [`crate::Wrapper`] derive macro.
 ///
 /// # Examples
 ///
@@ -227,8 +227,6 @@ impl<T: Default> Opaque<T> {
 /// ```
 ///
 /// They are not defined here to allow them to be `const`.
-///
-/// [`qemu_macros::Wrapper`]: ../../qemu_macros/derive.Wrapper.html
 pub unsafe trait Wrapper {
     type Wrapped;
 }
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index 285d25c217..b2418abc4b 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -24,7 +24,6 @@ qom = { path = "../../../qom" }
 chardev = { path = "../../../chardev" }
 system = { path = "../../../system" }
 hwcore = { path = "../../../hw/core" }
-qemu_macros = { path = "../../../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index a14993f692..628a523870 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -35,7 +35,6 @@ _libpl011_rs = static_library(
     util_rs,
     migration_rs,
     bql_rs,
-    qemu_macros,
     qom_rs,
     chardev_rs,
     system_rs,
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 85626a969d..1b4587d5f6 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -97,7 +97,7 @@ pub struct PL011Registers {
 }
 
 #[repr(C)]
-#[derive(qemu_macros::Object, qemu_macros::Device)]
+#[derive(qom::Object, hwcore::Device)]
 /// PL011 Device Model in QEMU
 pub struct PL011State {
     pub parent_obj: ParentField<SysBusDevice>,
@@ -683,7 +683,7 @@ pub unsafe extern "C" fn pl011_create(
 }
 
 #[repr(C)]
-#[derive(qemu_macros::Object, qemu_macros::Device)]
+#[derive(qom::Object, hwcore::Device)]
 /// PL011 Luminary device model.
 pub struct PL011Luminary {
     parent_obj: ParentField<PL011State>,
diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index a1c41347ed..0c3a4d7d21 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -16,7 +16,7 @@ use migration::{impl_vmstate_bitsized, impl_vmstate_forward};
 #[doc(alias = "offset")]
 #[allow(non_camel_case_types)]
 #[repr(u64)]
-#[derive(Debug, Eq, PartialEq, qemu_macros::TryInto)]
+#[derive(Debug, Eq, PartialEq, common::TryInto)]
 pub enum RegisterOffset {
     /// Data Register
     ///
diff --git a/rust/hw/core/Cargo.toml b/rust/hw/core/Cargo.toml
index 0eb9ffee26..9a9aa51708 100644
--- a/rust/hw/core/Cargo.toml
+++ b/rust/hw/core/Cargo.toml
@@ -13,6 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+qemu_macros = { path = "../../qemu-macros" }
 common = { path = "../../common" }
 bql = { path = "../../bql" }
 qom = { path = "../../qom" }
@@ -20,7 +21,6 @@ chardev = { path = "../../chardev" }
 migration = { path = "../../migration" }
 system = { path = "../../system" }
 util = { path = "../../util" }
-qemu_macros = { path = "../../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/core/meson.build b/rust/hw/core/meson.build
index 67eacf854f..81d8c77f9a 100644
--- a/rust/hw/core/meson.build
+++ b/rust/hw/core/meson.build
@@ -71,7 +71,7 @@ test('rust-hwcore-rs-integration',
         override_options: ['rust_std=2021', 'build.rust_std=2021'],
         rust_args: ['--test'],
         install: false,
-        dependencies: [common_rs, hwcore_rs, bql_rs, migration_rs, qemu_macros, util_rs]),
+        dependencies: [common_rs, hwcore_rs, bql_rs, migration_rs, util_rs]),
     args: [
         '--test', '--test-threads', '1',
         '--format', 'pretty',
diff --git a/rust/hw/core/src/irq.rs b/rust/hw/core/src/irq.rs
index d8d964cad2..e0d7784d97 100644
--- a/rust/hw/core/src/irq.rs
+++ b/rust/hw/core/src/irq.rs
@@ -18,7 +18,7 @@ use crate::bindings::{self, qemu_set_irq};
 
 /// An opaque wrapper around [`bindings::IRQState`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct IRQState(Opaque<bindings::IRQState>);
 
 /// Interrupt sources are used by devices to pass changes to a value (typically
diff --git a/rust/hw/core/src/lib.rs b/rust/hw/core/src/lib.rs
index c5588d9bc2..b40801eb84 100644
--- a/rust/hw/core/src/lib.rs
+++ b/rust/hw/core/src/lib.rs
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+pub use qemu_macros::Device;
 pub use qom;
 
 pub mod bindings;
diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index c9faf44a71..71b9ef141c 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -23,7 +23,7 @@ use crate::{
 
 /// A safe wrapper around [`bindings::Clock`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct Clock(Opaque<bindings::Clock>);
 
 unsafe impl Send for Clock {}
@@ -31,7 +31,7 @@ unsafe impl Sync for Clock {}
 
 /// A safe wrapper around [`bindings::DeviceState`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct DeviceState(Opaque<bindings::DeviceState>);
 
 unsafe impl Send for DeviceState {}
diff --git a/rust/hw/core/src/sysbus.rs b/rust/hw/core/src/sysbus.rs
index 92c7449b80..282315fce9 100644
--- a/rust/hw/core/src/sysbus.rs
+++ b/rust/hw/core/src/sysbus.rs
@@ -19,7 +19,7 @@ use crate::{
 
 /// A safe wrapper around [`bindings::SysBusDevice`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct SysBusDevice(Opaque<bindings::SysBusDevice>);
 
 unsafe impl Send for SysBusDevice {}
diff --git a/rust/hw/core/tests/tests.rs b/rust/hw/core/tests/tests.rs
index 2f08b8f3bf..247d812866 100644
--- a/rust/hw/core/tests/tests.rs
+++ b/rust/hw/core/tests/tests.rs
@@ -17,7 +17,7 @@ pub const VMSTATE: VMStateDescription<DummyState> = VMStateDescriptionBuilder::<
     .build();
 
 #[repr(C)]
-#[derive(qemu_macros::Object, qemu_macros::Device)]
+#[derive(qom::Object, hwcore::Device)]
 pub struct DummyState {
     parent: ParentField<DeviceState>,
     #[property(rename = "migrate-clk", default = true)]
@@ -54,7 +54,7 @@ impl DeviceImpl for DummyState {
 }
 
 #[repr(C)]
-#[derive(qemu_macros::Object, qemu_macros::Device)]
+#[derive(qom::Object, hwcore::Device)]
 pub struct DummyChildState {
     parent: ParentField<DummyState>,
 }
diff --git a/rust/hw/timer/hpet/Cargo.toml b/rust/hw/timer/hpet/Cargo.toml
index 08bf97af55..f781b28d8b 100644
--- a/rust/hw/timer/hpet/Cargo.toml
+++ b/rust/hw/timer/hpet/Cargo.toml
@@ -17,7 +17,6 @@ migration = { path = "../../../migration" }
 bql = { path = "../../../bql" }
 qom = { path = "../../../qom" }
 system = { path = "../../../system" }
-qemu_macros = { path = "../../../qemu-macros" }
 hwcore = { path = "../../../hw/core" }
 
 [lints]
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index 8ab26630d9..b6bb9477f0 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -8,7 +8,6 @@ _libhpet_rs = static_library(
     util_rs,
     migration_rs,
     bql_rs,
-    qemu_macros,
     qom_rs,
     system_rs,
     hwcore_rs,
diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 07e0f639fc..3cfbe9c32b 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -97,7 +97,7 @@ const HPET_TN_CFG_FSB_CAP_SHIFT: usize = 15;
 /// Timer N Interrupt Routing Capability (bits 32:63)
 const HPET_TN_CFG_INT_ROUTE_CAP_SHIFT: usize = 32;
 
-#[derive(qemu_macros::TryInto)]
+#[derive(common::TryInto)]
 #[repr(u64)]
 #[allow(non_camel_case_types)]
 /// Timer registers, masked by 0x18
@@ -110,7 +110,7 @@ enum TimerRegister {
     ROUTE = 16,
 }
 
-#[derive(qemu_macros::TryInto)]
+#[derive(common::TryInto)]
 #[repr(u64)]
 #[allow(non_camel_case_types)]
 /// Global registers
@@ -520,7 +520,7 @@ impl HPETTimer {
 
 /// HPET Event Timer Block Abstraction
 #[repr(C)]
-#[derive(qemu_macros::Object)]
+#[derive(qom::Object)]
 pub struct HPETState {
     parent_obj: ParentField<SysBusDevice>,
     iomem: MemoryRegion,
diff --git a/rust/meson.build b/rust/meson.build
index bd9b9cb83e..c7bd6aba45 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -20,8 +20,9 @@ proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
 
 genrs = []
 
-subdir('common')
 subdir('qemu-macros')
+
+subdir('common')
 subdir('bits')
 subdir('util')
 subdir('migration')
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
index 66af81e0a3..708bfaaa68 100644
--- a/rust/migration/Cargo.toml
+++ b/rust/migration/Cargo.toml
@@ -15,7 +15,6 @@ rust-version.workspace = true
 [dependencies]
 common = { path = "../common" }
 util = { path = "../util" }
-qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/qom/src/lib.rs b/rust/qom/src/lib.rs
index 204c6fea2f..24c44fc2af 100644
--- a/rust/qom/src/lib.rs
+++ b/rust/qom/src/lib.rs
@@ -1,5 +1,7 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
+pub use qemu_macros::Object;
+
 pub mod bindings;
 
 // preserve one-item-per-"use" syntax, it is clearer
diff --git a/rust/qom/src/qom.rs b/rust/qom/src/qom.rs
index 2cd1d85011..5808051cd7 100644
--- a/rust/qom/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -112,7 +112,7 @@ pub use crate::bindings::{type_register_static, ObjectClass};
 
 /// A safe wrapper around [`bindings::Object`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct Object(Opaque<bindings::Object>);
 
 unsafe impl Send for Object {}
@@ -173,7 +173,7 @@ macro_rules! qom_isa {
 ///
 /// ```ignore
 /// #[repr(C)]
-/// #[derive(qemu_macros::Object)]
+/// #[derive(qom::Object)]
 /// pub struct MyDevice {
 ///     parent: ParentField<DeviceState>,
 ///     ...
diff --git a/rust/system/Cargo.toml b/rust/system/Cargo.toml
index d8338c8348..7fd369b9e3 100644
--- a/rust/system/Cargo.toml
+++ b/rust/system/Cargo.toml
@@ -16,7 +16,6 @@ rust-version.workspace = true
 common = { path = "../common" }
 qom = { path = "../qom" }
 util = { path = "../util" }
-qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/system/meson.build b/rust/system/meson.build
index 9f88166f3d..3ec140de01 100644
--- a/rust/system/meson.build
+++ b/rust/system/meson.build
@@ -39,4 +39,4 @@ _system_rs = static_library(
 )
 
 system_rs = declare_dependency(link_with: [_system_rs],
-  dependencies: [qemu_macros, hwcore])
+  dependencies: [hwcore])
diff --git a/rust/system/src/memory.rs b/rust/system/src/memory.rs
index 7312f809f5..02aa3af7b1 100644
--- a/rust/system/src/memory.rs
+++ b/rust/system/src/memory.rs
@@ -129,7 +129,7 @@ impl<T> Default for MemoryRegionOpsBuilder<T> {
 
 /// A safe wrapper around [`bindings::MemoryRegion`].
 #[repr(transparent)]
-#[derive(qemu_macros::Wrapper)]
+#[derive(common::Wrapper)]
 pub struct MemoryRegion(Opaque<bindings::MemoryRegion>);
 
 unsafe impl Send for MemoryRegion {}
diff --git a/rust/tests/Cargo.toml b/rust/tests/Cargo.toml
index 8d106d896d..d47dc3314d 100644
--- a/rust/tests/Cargo.toml
+++ b/rust/tests/Cargo.toml
@@ -19,7 +19,6 @@ hwcore = { path = "../hw/core" }
 migration = { path = "../migration" }
 util = { path = "../util" }
 bql = { path = "../bql" }
-qemu_macros = { path = "../qemu-macros" }
 qom = { path = "../qom" }
 system = { path = "../system" }
 
diff --git a/rust/util/Cargo.toml b/rust/util/Cargo.toml
index 18e6619ca0..1f6767ed9d 100644
--- a/rust/util/Cargo.toml
+++ b/rust/util/Cargo.toml
@@ -17,7 +17,6 @@ anyhow = { workspace = true }
 foreign = { workspace = true }
 libc = { workspace = true }
 common = { path = "../common" }
-qemu_macros = { path = "../qemu-macros" }
 
 [lints]
 workspace = true
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 197872c9b2..87a893673d 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -39,7 +39,7 @@ _util_rs = static_library(
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
-  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qemu_macros, qom, qemuutil],
+  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qom, qemuutil],
 )
 
 util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
diff --git a/rust/util/src/timer.rs b/rust/util/src/timer.rs
index 622b6ee309..c6b3e4088e 100644
--- a/rust/util/src/timer.rs
+++ b/rust/util/src/timer.rs
@@ -15,14 +15,14 @@ use crate::bindings::{
 
 /// A safe wrapper around [`bindings::QEMUTimer`].
 #[repr(transparent)]
-#[derive(Debug, qemu_macros::Wrapper)]
+#[derive(Debug, common::Wrapper)]
 pub struct Timer(Opaque<bindings::QEMUTimer>);
 
 unsafe impl Send for Timer {}
 unsafe impl Sync for Timer {}
 
 #[repr(transparent)]
-#[derive(qemu_macros::Wrapper)]
+#[derive(common::Wrapper)]
 pub struct TimerListGroup(Opaque<bindings::QEMUTimerListGroup>);
 
 unsafe impl Send for TimerListGroup {}

From 31b35e78be99ae0c9b7a50fa4f29c0041538ceea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 8 Sep 2025 12:50:03 +0200
Subject: [PATCH 0497/2396] docs: update rust.rst
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20250827104147.717203-23-marcandre.lureau@redhat.com
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst | 61 ++++++++++++++++++++++++---------------------
 1 file changed, 32 insertions(+), 29 deletions(-)

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 29eb48af35..13a20e86a1 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -103,15 +103,18 @@ anymore.
 Writing Rust code in QEMU
 -------------------------
 
-QEMU includes four crates:
+QEMU includes several crates:
 
-* ``qemu_api`` for bindings to C code and useful functionality
+* ``common`` provides Rust-only utilities
 
-* ``qemu_api_macros`` defines several procedural macros that are useful when
+* ``bql``, ``chardev``, ``hw/core``, ``migration``, ``qom``, ``system``,
+  ``util`` for bindings to respective QEMU C library APIs
+
+* ``qemu_macros`` defines several procedural macros that are useful when
   writing C code
 
 * ``pl011`` (under ``rust/hw/char/pl011``) and ``hpet`` (under ``rust/hw/timer/hpet``)
-  are sample devices that demonstrate ``qemu_api`` and ``qemu_api_macros``, and are
+  are sample devices that demonstrate Rust binding usage and ``qemu_macros``, and are
   used to further develop them.  These two crates are functional\ [#issues]_ replacements
   for the ``hw/char/pl011.c`` and ``hw/timer/hpet.c`` files.
 
@@ -124,7 +127,7 @@ This section explains how to work with them.
 Status
 ''''''
 
-Modules of ``qemu_api`` can be defined as:
+The stability of the modules can be defined as:
 
 - *complete*: ready for use in new devices; if applicable, the API supports the
   full functionality available in C
@@ -140,26 +143,26 @@ Modules of ``qemu_api`` can be defined as:
 
 The status of the modules is as follows:
 
-================ ======================
-module           status
-================ ======================
-``assertions``   stable
-``bitops``       complete
-``callbacks``    complete
-``cell``         stable
-``errno``        complete
-``error``        stable
-``irq``          complete
-``log``          proof of concept
-``memory``       stable
-``module``       complete
-``qdev``         stable
-``qom``          stable
-``sysbus``       stable
-``timer``        stable
-``vmstate``      stable
-``zeroable``     stable
-================ ======================
+========================== ======================
+module                     status
+========================== ======================
+``bql::cell``              stable
+``common::assertions``     stable
+``common::bitops``         complete
+``common::callbacks``      complete
+``common::errno``          complete
+``common::zeroable``       stable
+``hwcore::irq``            complete
+``hwcore::qdev``           stable
+``hwcore::sysbus``         stable
+``migration::vmstate``     stable
+``qom``                    stable
+``system::memory``         stable
+``util::error``            stable
+``util::log``              proof of concept
+``util::module``           complete
+``util::timer``            stable
+========================== ======================
 
 .. note::
   API stability is not a promise, if anything because the C APIs are not a stable
@@ -260,7 +263,7 @@ to go from a shared reference to a ``&mut``.
 
 Whenever C code provides you with an opaque ``void *``, avoid converting it
 to a Rust mutable reference, and use a shared reference instead.  The
-``qemu_api::cell`` module provides wrappers that can be used to tell the
+``bql::cell`` module provides wrappers that can be used to tell the
 Rust compiler about interior mutability, and optionally to enforce locking
 rules for the "Big QEMU Lock".  In the future, similar cell types might
 also be provided for ``AioContext``-based locking as well.
@@ -292,7 +295,7 @@ the wrapper to be declared thread-safe::
 Writing bindings to C code
 ''''''''''''''''''''''''''
 
-Here are some things to keep in mind when working on the ``qemu_api`` crate.
+Here are some things to keep in mind when working on the QEMU Rust crate.
 
 **Look at existing code**
   Very often, similar idioms in C code correspond to similar tricks in
@@ -355,7 +358,7 @@ from the type after ``as`` in the invocation of ``parse_macro_input!``::
             .into()
     }
 
-The ``qemu_api_macros`` crate has utility functions to examine a
+The ``qemu_macros`` crate has utility functions to examine a
 ``DeriveInput`` and perform common checks (e.g. looking for a struct
 with named fields).  These functions return ``Result<..., syn::Error>``
 and can be used easily in the procedural macro function::
@@ -396,7 +399,7 @@ Right now, only the nightly version of ``rustfmt`` is supported.  This
 might change in the future.  While CI checks for correct formatting via
 ``cargo fmt --check``, maintainers can fix this for you when applying patches.
 
-It is expected that ``qemu_api`` provides full ``rustdoc`` documentation for
+It is expected that QEMU Rust crates provides full ``rustdoc`` documentation for
 bindings that are in their final shape or close.
 
 Adding dependencies

From efe8d07383e22e39e4dafbc08855956a459b395f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:50:04 +0200
Subject: [PATCH 0498/2396] rust: meson: remove unnecessary complication in
 device crates

It is not necessary anymore to explicitly list procedural macro crates
when doing the final link using rustc.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-33-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/meson.build | 3 ---
 rust/hw/timer/hpet/meson.build | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 628a523870..ffdc8af53f 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -44,8 +44,5 @@ _libpl011_rs = static_library(
 
 rust_devices_ss.add(when: 'CONFIG_X_PL011_RUST', if_true: [declare_dependency(
   link_whole: [_libpl011_rs],
-  # Putting proc macro crates in `dependencies` is necessary for Meson to find
-  # them when compiling the root per-target static rust lib.
-  dependencies: [bilge_impl_rs, qemu_macros],
   variables: {'crate': 'pl011'},
 )])
diff --git a/rust/hw/timer/hpet/meson.build b/rust/hw/timer/hpet/meson.build
index b6bb9477f0..bb64b96672 100644
--- a/rust/hw/timer/hpet/meson.build
+++ b/rust/hw/timer/hpet/meson.build
@@ -16,8 +16,5 @@ _libhpet_rs = static_library(
 
 rust_devices_ss.add(when: 'CONFIG_X_HPET_RUST', if_true: [declare_dependency(
   link_whole: [_libhpet_rs],
-  # Putting proc macro crates in `dependencies` is necessary for Meson to find
-  # them when compiling the root per-target static rust lib.
-  dependencies: [qemu_macros],
   variables: {'crate': 'hpet'},
 )])

From 7c83e501565a57560aa1d87109819f46effeb7fc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 8 Sep 2025 12:50:05 +0200
Subject: [PATCH 0499/2396] rust: do not inline do_init_io

This is now possible since the hwcore integration tests do not
link the system crate anymore.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20250908105005.2119297-34-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/system/src/memory.rs | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/rust/system/src/memory.rs b/rust/system/src/memory.rs
index 02aa3af7b1..4b3316bf76 100644
--- a/rust/system/src/memory.rs
+++ b/rust/system/src/memory.rs
@@ -136,11 +136,6 @@ unsafe impl Send for MemoryRegion {}
 unsafe impl Sync for MemoryRegion {}
 
 impl MemoryRegion {
-    // inline to ensure that it is not included in tests, which only
-    // link to hwcore and qom.  FIXME: inlining is actually the opposite
-    // of what we want, since this is the type-erased version of the
-    // init_io function below.  Look into splitting the qemu_api crate.
-    #[inline(always)]
     unsafe fn do_init_io(
         slot: *mut bindings::MemoryRegion,
         owner: *mut bindings::Object,

From d99041a20328423bc6819ddd69b60cf98d8d84f1 Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Wed, 10 Sep 2025 16:25:06 +0200
Subject: [PATCH 0500/2396] hpet: guard IRQ handling with BQL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit [1] made qemu fail with abort:
  xen_evtchn_set_gsi: Assertion `bql_locked()' failed.
when running ./tests/functional/x86_64/test_kvm_xen.py tests.

To fix it make sure that BQL is held when manipulating IRQs.

Fixes: 7defb58baf (hpet: switch to fine-grained device locking)
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Link: https://lore.kernel.org/r/20250910142506.86274-1-imammedo@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/timer/hpet.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/timer/hpet.c b/hw/timer/hpet.c
index 789a31d0a0..1acba4fa9d 100644
--- a/hw/timer/hpet.c
+++ b/hw/timer/hpet.c
@@ -40,6 +40,7 @@
 #include "qom/object.h"
 #include "qemu/lockable.h"
 #include "qemu/seqlock.h"
+#include "qemu/main-loop.h"
 #include "trace.h"
 
 struct hpet_fw_config hpet_fw_cfg = {.count = UINT8_MAX};
@@ -222,12 +223,15 @@ static void update_irq(struct HPETTimer *timer, int set)
                                  timer->fsb & 0xffffffff, MEMTXATTRS_UNSPECIFIED,
                                  NULL);
         } else if (timer->config & HPET_TN_TYPE_LEVEL) {
+            BQL_LOCK_GUARD();
             qemu_irq_raise(s->irqs[route]);
         } else {
+            BQL_LOCK_GUARD();
             qemu_irq_pulse(s->irqs[route]);
         }
     } else {
         if (!timer_fsb_route(timer)) {
+            BQL_LOCK_GUARD();
             qemu_irq_lower(s->irqs[route]);
         }
     }
@@ -534,10 +538,12 @@ static void hpet_ram_write(void *opaque, hwaddr addr,
             /* i8254 and RTC output pins are disabled
              * when HPET is in legacy mode */
             if (activating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
+                BQL_LOCK_GUARD();
                 qemu_set_irq(s->pit_enabled, 0);
                 qemu_irq_lower(s->irqs[0]);
                 qemu_irq_lower(s->irqs[RTC_ISA_IRQ]);
             } else if (deactivating_bit(old_val, new_val, HPET_CFG_LEGACY)) {
+                BQL_LOCK_GUARD();
                 qemu_irq_lower(s->irqs[0]);
                 qemu_set_irq(s->pit_enabled, 1);
                 qemu_set_irq(s->irqs[RTC_ISA_IRQ], s->rtc_irq_level);
@@ -683,11 +689,13 @@ static void hpet_handle_legacy_irq(void *opaque, int n, int level)
 
     if (n == HPET_LEGACY_PIT_INT) {
         if (!hpet_in_legacy_mode(s)) {
+            BQL_LOCK_GUARD();
             qemu_set_irq(s->irqs[0], level);
         }
     } else {
         s->rtc_irq_level = level;
         if (!hpet_in_legacy_mode(s)) {
+            BQL_LOCK_GUARD();
             qemu_set_irq(s->irqs[RTC_ISA_IRQ], level);
         }
     }

From 0516f4b70264b9710a25718d21bd35ef463c875e Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 30 Jul 2025 17:52:52 +0800
Subject: [PATCH 0501/2396] i386/cpu: Enable SMM cpu address space under KVM

Kirill Martynov reported assertation in cpu_asidx_from_attrs() being hit
when x86_cpu_dump_state() is called to dump the CPU state[*]. It happens
when the CPU is in SMM and KVM emulation failure due to misbehaving
guest.

The root cause is that QEMU i386 never enables the SMM address space for
cpu since KVM SMM support has been added.

Enable the SMM cpu address space under KVM when the SMM is enabled for
the x86machine.

[*] https://lore.kernel.org/qemu-devel/20250523154431.506993-1-stdcalllevi@yandex-team.ru/

Reported-by: Kirill Martynov <stdcalllevi@yandex-team.ru>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-by: Kirill Martynov <stdcalllevi@yandex-team.ru>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250730095253.1833411-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 system/physmem.c          |  5 -----
 target/i386/kvm/kvm-cpu.c | 10 ++++++++++
 target/i386/kvm/kvm.c     |  5 +++++
 3 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/system/physmem.c b/system/physmem.c
index ddd58e9eb8..ae8ecd50ea 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -793,9 +793,6 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
         cpu->as = as;
     }
 
-    /* KVM cannot currently support multiple address spaces. */
-    assert(asidx == 0 || !kvm_enabled());
-
     if (!cpu->cpu_ases) {
         cpu->cpu_ases = g_new0(CPUAddressSpace, cpu->num_ases);
         cpu->cpu_ases_count = cpu->num_ases;
@@ -818,8 +815,6 @@ void cpu_address_space_destroy(CPUState *cpu, int asidx)
 
     assert(cpu->cpu_ases);
     assert(asidx >= 0 && asidx < cpu->num_ases);
-    /* KVM cannot currently support multiple address spaces. */
-    assert(asidx == 0 || !kvm_enabled());
 
     cpuas = &cpu->cpu_ases[asidx];
     if (tcg_enabled()) {
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 89a7953659..1dc1ba9b48 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -13,6 +13,7 @@
 #include "qapi/error.h"
 #include "system/system.h"
 #include "hw/boards.h"
+#include "hw/i386/x86.h"
 
 #include "kvm_i386.h"
 #include "accel/accel-cpu-target.h"
@@ -91,6 +92,15 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
         kvm_set_guest_phys_bits(cs);
     }
 
+    /*
+     * When SMM is enabled, there is 2 address spaces. Otherwise only 1.
+     *
+     * Only initialize address space 0 here, the second one for SMM is
+     * initialized at register_smram_listener() after machine init done.
+     */
+    cs->num_ases = x86_machine_is_smm_enabled(X86_MACHINE(current_machine)) ? 2 : 1;
+    cpu_address_space_init(cs, 0, "cpu-memory", cs->memory);
+
     return true;
 }
 
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 34e74f2447..d191d7177f 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2704,6 +2704,7 @@ static MemoryRegion smram_as_mem;
 
 static void register_smram_listener(Notifier *n, void *unused)
 {
+    CPUState *cpu;
     MemoryRegion *smram =
         (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
 
@@ -2728,6 +2729,10 @@ static void register_smram_listener(Notifier *n, void *unused)
     address_space_init(&smram_address_space, &smram_as_root, "KVM-SMRAM");
     kvm_memory_listener_register(kvm_state, &smram_listener,
                                  &smram_address_space, 1, "kvm-smram");
+
+    CPU_FOREACH(cpu) {
+        cpu_address_space_init(cpu, 1, "cpu-smm", &smram_as_root);
+    }
 }
 
 static void *kvm_msr_energy_thread(void *data)

From 591f817d819f5511fd9001dc863a326d23088811 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Wed, 30 Jul 2025 17:52:53 +0800
Subject: [PATCH 0502/2396] target/i386: Define enum X86ASIdx for x86's address
 spaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define X86ASIdx as enum, like ARM's ARMASIdx, so that it's clear index 0
is for memory and index 1 is for SMM.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-By: Kirill Martynov <stdcalllevi@yandex-team.ru>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250730095253.1833411-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.h                | 5 +++++
 target/i386/kvm/kvm-cpu.c        | 2 +-
 target/i386/kvm/kvm.c            | 4 ++--
 target/i386/tcg/system/tcg-cpu.c | 4 ++--
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index f977fc49a7..e0be7a7406 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2574,6 +2574,11 @@ static inline bool x86_has_cpuid_0x1f(X86CPU *cpu)
 void x86_cpu_set_a20(X86CPU *cpu, int a20_state);
 void cpu_sync_avx_hflag(CPUX86State *env);
 
+typedef enum X86ASIdx {
+    X86ASIdx_MEM = 0,
+    X86ASIdx_SMM = 1,
+} X86ASIdx;
+
 #ifndef CONFIG_USER_ONLY
 static inline int x86_asidx_from_attrs(CPUState *cs, MemTxAttrs attrs)
 {
diff --git a/target/i386/kvm/kvm-cpu.c b/target/i386/kvm/kvm-cpu.c
index 1dc1ba9b48..9c25b55839 100644
--- a/target/i386/kvm/kvm-cpu.c
+++ b/target/i386/kvm/kvm-cpu.c
@@ -99,7 +99,7 @@ static bool kvm_cpu_realizefn(CPUState *cs, Error **errp)
      * initialized at register_smram_listener() after machine init done.
      */
     cs->num_ases = x86_machine_is_smm_enabled(X86_MACHINE(current_machine)) ? 2 : 1;
-    cpu_address_space_init(cs, 0, "cpu-memory", cs->memory);
+    cpu_address_space_init(cs, X86ASIdx_MEM, "cpu-memory", cs->memory);
 
     return true;
 }
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index d191d7177f..28012d2b57 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2728,10 +2728,10 @@ static void register_smram_listener(Notifier *n, void *unused)
 
     address_space_init(&smram_address_space, &smram_as_root, "KVM-SMRAM");
     kvm_memory_listener_register(kvm_state, &smram_listener,
-                                 &smram_address_space, 1, "kvm-smram");
+                                 &smram_address_space, X86ASIdx_SMM, "kvm-smram");
 
     CPU_FOREACH(cpu) {
-        cpu_address_space_init(cpu, 1, "cpu-smm", &smram_as_root);
+        cpu_address_space_init(cpu, X86ASIdx_SMM, "cpu-smm", &smram_as_root);
     }
 }
 
diff --git a/target/i386/tcg/system/tcg-cpu.c b/target/i386/tcg/system/tcg-cpu.c
index 0538a4fd51..7255862c24 100644
--- a/target/i386/tcg/system/tcg-cpu.c
+++ b/target/i386/tcg/system/tcg-cpu.c
@@ -74,8 +74,8 @@ bool tcg_cpu_realizefn(CPUState *cs, Error **errp)
     memory_region_set_enabled(cpu->cpu_as_mem, true);
 
     cs->num_ases = 2;
-    cpu_address_space_init(cs, 0, "cpu-memory", cs->memory);
-    cpu_address_space_init(cs, 1, "cpu-smm", cpu->cpu_as_root);
+    cpu_address_space_init(cs, X86ASIdx_MEM, "cpu-memory", cs->memory);
+    cpu_address_space_init(cs, X86ASIdx_SMM, "cpu-smm", cpu->cpu_as_root);
 
     /* ... SMRAM with higher priority, linked from /machine/smram.  */
     cpu->machine_done.notify = tcg_cpu_machine_done;

From 4c8f69b94839f72314c69902312068d0b9b05a34 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Fri, 8 Aug 2025 11:50:27 +0800
Subject: [PATCH 0503/2396] multiboot: Fix the split lock
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While running the kvm-unit-tests on Intel platforms with "split lock
disable" feature, every test triggers a kernel warning of

  x86/split lock detection: #AC: qemu-system-x86_64/373232 took a split_lock trap at address: 0x1e3

Hack KVM by exiting to QEMU on split lock #AC, we get

KVM: exception 17 exit (error code 0x0)
EAX=00000001 EBX=00000000 ECX=00000014 EDX=0001fb80
ESI=00000000 EDI=000000a8 EBP=00000000 ESP=00006f10
EIP=000001e3 EFL=00010002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0900 00009000 0000ffff 00009300 DPL=0 DS16 [-WA]
CS =c000 000c0000 0000ffff 00009b00 DPL=0 CS16 [-RA]
SS =0000 00000000 0000ffff 00009300 DPL=0 DS16 [-WA]
DS =c000 000c0000 0000ffff 00009300 DPL=0 DS16 [-WA]
FS =0950 00009500 0000ffff 00009300 DPL=0 DS16 [-WA]
GS =06f2 00006f20 0000ffff 00009300 DPL=0 DS16 [-WA]
LDT=0000 00000000 0000ffff 00008200 DPL=0 LDT
TR =0000 00000000 0000ffff 00008b00 DPL=0 TSS32-busy
GDT=     000c02b4 00000027
IDT=     00000000 000003ff
CR0=00000011 CR2=00000000 CR3=00000000 CR4=00000000
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000000
Code=89 16 08 00 65 66 0f 01 16 06 00 66 b8 01 00 00 00 0f 22 c0 <65> 66 ff 2e 00 00 b8 10 00 00 00 8e d0 8e d8 8e c0 8e e0 8e e8 66 b8 08 00 66 ba 10 05 66

And it matches with what disassembled from multiboo_dma.bin:

 #objdump -b binary -m i386 -D pc-bios/multiboot_dma.bin

  1d1:   08 00                   or     %al,(%eax)
  1d3:   65 66 0f 01 16          lgdtw  %gs:(%esi)
  1d8:   06                      push   %es
  1d9:   00 66 b8                add    %ah,-0x48(%esi)
  1dc:   01 00                   add    %eax,(%eax)
  1de:   00 00                   add    %al,(%eax)
  1e0:   0f 22 c0                mov    %eax,%cr0
> 1e3:   65 66 ff 2e             ljmpw  *%gs:(%esi)
  1e7:   00 00                   add    %al,(%eax)
  1e9:   b8 10 00 00 00          mov    $0x10,%eax
  1ee:   8e d0                   mov    %eax,%ss
  1f0:   8e d8                   mov    %eax,%ds
  1f2:   8e c0                   mov    %eax,%es
  1f4:   8e e0                   mov    %eax,%fs
  1f6:   8e e8                   mov    %eax,%gs
  1f8:   66 b8 08 00             mov    $0x8,%ax
  1fc:   66 ba 10 05             mov    $0x510,%dx

We can see that the instruction at 0x1e3 is a far jmp through the GDT.
However, the GDT is not 8 byte aligned, the base is 0xc02b4.

Intel processors follow the LOCK semantics to set the accessed flag of the
segment descriptor when loading a segment descriptor. If the the segment
descriptor crosses two cache line, it causes split lock.

Fix it by aligning the GDT on 8 bytes, so that segment descriptor cannot
span two cache lines.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250808035027.2194673-1-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 pc-bios/multiboot_dma.bin     | Bin 1024 -> 1024 bytes
 pc-bios/optionrom/multiboot.S |   2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/multiboot_dma.bin b/pc-bios/multiboot_dma.bin
index c0e2c3102a3358207c61d3ae113524fb6007abc3..e6d0c97093b4fc11bc87fd58cbe6e577c2841cd0 100644
GIT binary patch
delta 42
ycmZqRXyBNj#r%xv^+a8N?gvb%opNjpY29*<Hny8GP2Rzz#<*kieI^-3#%KUKiVj8q

delta 46
zcmZqRXyBNj#r%lr`9xiR?mJAWopNjpY29-7Hny8GO+LV+#JFYiV<s8K$pXwQjQId`
CSPu9A

diff --git a/pc-bios/optionrom/multiboot.S b/pc-bios/optionrom/multiboot.S
index 181a4b03a3..c95e35c9cb 100644
--- a/pc-bios/optionrom/multiboot.S
+++ b/pc-bios/optionrom/multiboot.S
@@ -208,7 +208,7 @@ ljmp2:
 prot_jump:	.long prot_mode
 		.short 8
 
-.align 4, 0
+.align 8, 0
 gdt:
 	/* 0x00 */
 .byte	0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00

From b5ff08e64e73207d435ca720ce1e917dd2faee3c Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 29 Jul 2025 14:20:14 +0800
Subject: [PATCH 0504/2396] i386/kvm: Drop KVM_CAP_X86_SMM check in
 kvm_arch_init()

x86_machine_is_smm_enabled() checks the KVM_CAP_X86_SMM for KVM
case. No need to check KVM_CAP_X86_SMM in kvm_arch_init().

So just drop the check of KVM_CAP_X86_SMM to simplify the code.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250729062014.1669578-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 28012d2b57..6a3a1c1ed8 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3315,8 +3315,7 @@ int kvm_arch_init(MachineState *ms, KVMState *s)
         return ret;
     }
 
-    if (kvm_check_extension(s, KVM_CAP_X86_SMM) &&
-        object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) &&
+    if (object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) &&
         x86_machine_is_smm_enabled(X86_MACHINE(ms))) {
         smram_machine_done.notify = register_smram_listener;
         qemu_add_machine_init_done_notifier(&smram_machine_done);

From 706cc708656c91552b355faa9b72dfa7ad64571e Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 28 Jul 2025 19:57:05 +0800
Subject: [PATCH 0505/2396] accel/kvm: Switch to check KVM_CAP_GUEST_MEMFD and
 KVM_CAP_USER_MEMORY2 on VM

It returns more accruate result on checking KVM_CAP_GUEST_MEMFD and
KVM_CAP_USER_MEMORY2 on VM instance instead of on KVM platform.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250728115707.1374614-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index d13156bee8..633b72bde2 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2776,8 +2776,8 @@ static int kvm_init(AccelState *as, MachineState *ms)
 
     kvm_supported_memory_attributes = kvm_vm_check_extension(s, KVM_CAP_MEMORY_ATTRIBUTES);
     kvm_guest_memfd_supported =
-        kvm_check_extension(s, KVM_CAP_GUEST_MEMFD) &&
-        kvm_check_extension(s, KVM_CAP_USER_MEMORY2) &&
+        kvm_vm_check_extension(s, KVM_CAP_GUEST_MEMFD) &&
+        kvm_vm_check_extension(s, KVM_CAP_USER_MEMORY2) &&
         (kvm_supported_memory_attributes & KVM_MEMORY_ATTRIBUTE_PRIVATE);
     kvm_pre_fault_memory_supported = kvm_vm_check_extension(s, KVM_CAP_PRE_FAULT_MEMORY);
 

From 80030f66ad15c1534f5e3700b0acefd6d0d92e37 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 28 Jul 2025 19:57:06 +0800
Subject: [PATCH 0506/2396] accel/kvm: Zero out mem explicitly in
 kvm_set_user_memory_region()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Zero out the entire mem explicitly before it's used, to ensure the unused
feilds (pad1, pad2) are all zeros. Otherwise, it might cause problem when
the pad fields are extended by future KVM.

Fixes: ce5a983233b4 ("kvm: Enable KVM_SET_USER_MEMORY_REGION2 for memslot")
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250728115707.1374614-3-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 633b72bde2..72b571a697 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -358,7 +358,7 @@ int kvm_physical_memory_addr_from_host(KVMState *s, void *ram,
 static int kvm_set_user_memory_region(KVMMemoryListener *kml, KVMSlot *slot, bool new)
 {
     KVMState *s = kvm_state;
-    struct kvm_userspace_memory_region2 mem;
+    struct kvm_userspace_memory_region2 mem = {};
     int ret;
 
     mem.slot = slot->slot | (kml->as_id << 16);

From 00c0911c68e5bd664de1a261b74c390f4c0be83d Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 28 Jul 2025 19:57:07 +0800
Subject: [PATCH 0507/2396] accel/kvm: Set guest_memfd_offset to non-zero value
 only when guest_memfd is valid

Current QEMU unconditionally sets the guest_memfd_offset of KVMSlot in
kvm_set_phys_mem(), which leads to the trace of kvm_set_user_memory looks:

kvm_set_user_memory AddrSpace#0 Slot#4 flags=0x2 gpa=0xe0000 size=0x20000 ua=0x7f5840de0000 guest_memfd=-1 guest_memfd_offset=0x3e0000 ret=0

It's confusing that the guest_memfd_offset has a non-zero value while
the guest_memfd is invalid (-1).

Change to only set guest_memfd_offset when guest_memfd is valid and
leave it as 0 when no valid guest_memfd.

Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20250728115707.1374614-4-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 72b571a697..9060599cd7 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -1595,7 +1595,8 @@ static void kvm_set_phys_mem(KVMMemoryListener *kml,
         mem->ram = ram;
         mem->flags = kvm_mem_flags(mr);
         mem->guest_memfd = mr->ram_block->guest_memfd;
-        mem->guest_memfd_offset = (uint8_t*)ram - mr->ram_block->host;
+        mem->guest_memfd_offset = mem->guest_memfd >= 0 ?
+                                  (uint8_t*)ram - mr->ram_block->host : 0;
 
         kvm_slot_init_dirty_bitmap(mem);
         err = kvm_set_user_memory_region(kml, mem, true);

From 0c042601a638c37a95690c6429af5a1b5a35d1dd Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Sat, 6 Sep 2025 15:01:58 +0800
Subject: [PATCH 0508/2396] hw/loongarch/virt: Add BSP support with aux boot
 code

If system boots directly from Linux kernel, BSP core jumps to kernel
entry of Linux kernel image and other APs jump to aux boot code. Instead
BSP and APs can all jump to aux boot code like UEFI bios.

With aux boot code, BSP core is judged from physical cpu id, whose
cpu id is 0. With BSP core, load data to register A0-A2 and PC.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250906070200.3749326-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c | 36 ++++++++++++++++++++++++++++++++++--
 1 file changed, 34 insertions(+), 2 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 14d6c52d4e..4962668e5a 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -35,13 +35,19 @@ struct loongarch_linux_hdr {
     uint32_t pe_header_offset;
 } QEMU_PACKED;
 
-static const unsigned int slave_boot_code[] = {
+static const unsigned int aux_boot_code[] = {
                   /* Configure reset ebase.                    */
     0x0400302c,   /* csrwr      $t0, LOONGARCH_CSR_EENTRY      */
 
                   /* Disable interrupt.                        */
     0x0380100c,   /* ori        $t0, $zero,0x4                 */
     0x04000180,   /* csrxchg    $zero, $t0, LOONGARCH_CSR_CRMD */
+    0x03400000,   /* nop                                       */
+
+    0x0400800c,   /* csrrd      $t0, LOONGARCH_CSR_CPUNUM      */
+    0x034ffd8c,   /* andi       $t0, $t0, 0x3ff                */
+    0x0015000d,   /* move       $t1, $zero                     */
+    0x5800718d,   /* beq        $t0, $t1, 112                  */
 
                   /* Clear mailbox.                            */
     0x1400002d,   /* lu12i.w    $t1, 1(0x1)                    */
@@ -81,6 +87,26 @@ static const unsigned int slave_boot_code[] = {
     0x06480dac,   /* iocsrrd.d  $t0, $t1                       */
     0x00150181,   /* move       $ra, $t0                       */
     0x4c000020,   /* jirl       $zero, $ra,0                   */
+                  /* BSP Core                                  */
+    0x03400000,   /* nop                                       */
+    0x1800000d,   /* pcaddi     $t1, 0                         */
+    0x28c0a1a4,   /* ld.d       $a0, $t1, 40                   */
+    0x1800000d,   /* pcaddi     $t1, 0                         */
+    0x28c0a1a5,   /* ld.d       $a1, $t1, 40                   */
+    0x1800000d,   /* pcaddi     $t1, 0                         */
+    0x28c0a1a6,   /* ld.d       $a2, $t1, 40                   */
+    0x1800000d,   /* pcaddi     $t1, 0                         */
+    0x28c0a1ac,   /* ld.d       $t0, $t1, 40                   */
+    0x00150181,   /* move       $ra, $t0                       */
+    0x4c000020,   /* jirl       $zero, $ra,0                   */
+    0x00000000,   /* .dword 0   A0                             */
+    0x00000000,
+    0x00000000,   /* .dword 0   A1                             */
+    0x00000000,
+    0x00000000,   /* .dword 0   A2                             */
+    0x00000000,
+    0x00000000,   /* .dword 0   PC                             */
+    0x00000000,
 };
 
 static inline void *guidcpy(void *dst, const void *src)
@@ -391,6 +417,7 @@ static void loongarch_direct_kernel_boot(MachineState *ms,
     int64_t kernel_addr = VIRT_FLASH0_BASE;
     LoongArchCPU *lacpu;
     CPUState *cs;
+    uint64_t *data;
 
     if (info->kernel_filename) {
         kernel_addr = load_kernel_info(info);
@@ -408,7 +435,12 @@ static void loongarch_direct_kernel_boot(MachineState *ms,
 
     /* Load slave boot code at pflash0 . */
     void *boot_code = g_malloc0(VIRT_FLASH0_SIZE);
-    memcpy(boot_code, &slave_boot_code, sizeof(slave_boot_code));
+    memcpy(boot_code, &aux_boot_code, sizeof(aux_boot_code));
+    data = (uint64_t *)(boot_code + sizeof(aux_boot_code));
+    *(data - 4) = cpu_to_le64(info->a0);
+    *(data - 3) = cpu_to_le64(info->a1);
+    *(data - 2) = cpu_to_le64(info->a2);
+    *(data - 1) = cpu_to_le64(kernel_addr);
     rom_add_blob_fixed("boot_code", boot_code, VIRT_FLASH0_SIZE, VIRT_FLASH0_BASE);
 
     CPU_FOREACH(cs) {

From 6ca2df47c9b85f630faacaba8a042cb095075599 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Sat, 6 Sep 2025 15:01:59 +0800
Subject: [PATCH 0509/2396] hw/loongarch/virt: Remove unnecessay pre-boot
 setting with BSP

With BSP core, it boots from aux boot code and loads data into register
A0-A2 and PC. Pre-boot setting is not unnecessary and can be removed.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250906070200.3749326-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c    | 22 ----------------------
 target/loongarch/cpu.h |  4 ----
 2 files changed, 26 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 4962668e5a..5799b4c75c 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -353,17 +353,8 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
 static void reset_load_elf(void *opaque)
 {
     LoongArchCPU *cpu = opaque;
-    CPULoongArchState *env = &cpu->env;
 
     cpu_reset(CPU(cpu));
-    if (env->load_elf) {
-        if (cpu == LOONGARCH_CPU(first_cpu)) {
-            env->gpr[4] = env->boot_info->a0;
-            env->gpr[5] = env->boot_info->a1;
-            env->gpr[6] = env->boot_info->a2;
-        }
-        cpu_set_pc(CPU(cpu), env->elf_address);
-    }
 }
 
 static void fw_cfg_add_kernel_info(struct loongarch_boot_info *info,
@@ -415,8 +406,6 @@ static void loongarch_direct_kernel_boot(MachineState *ms,
 {
     void *p, *bp;
     int64_t kernel_addr = VIRT_FLASH0_BASE;
-    LoongArchCPU *lacpu;
-    CPUState *cs;
     uint64_t *data;
 
     if (info->kernel_filename) {
@@ -443,17 +432,6 @@ static void loongarch_direct_kernel_boot(MachineState *ms,
     *(data - 1) = cpu_to_le64(kernel_addr);
     rom_add_blob_fixed("boot_code", boot_code, VIRT_FLASH0_SIZE, VIRT_FLASH0_BASE);
 
-    CPU_FOREACH(cs) {
-        lacpu = LOONGARCH_CPU(cs);
-        lacpu->env.load_elf = true;
-        if (cs == first_cpu) {
-            lacpu->env.elf_address = kernel_addr;
-        } else {
-            lacpu->env.elf_address = VIRT_FLASH0_BASE;
-        }
-        lacpu->env.boot_info = info;
-    }
-
     g_free(boot_code);
     g_free(bp);
 }
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 7731f6acdc..c8b96f74dc 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -387,11 +387,7 @@ typedef struct CPUArchState {
 #endif
 
     AddressSpace *address_space_iocsr;
-    bool load_elf;
-    uint64_t elf_address;
     uint32_t mp_state;
-
-    struct loongarch_boot_info *boot_info;
 #endif
 } CPULoongArchState;
 

From cb5ee0017fc9909916383634a3f13eae05e6fe5c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Sat, 6 Sep 2025 15:02:00 +0800
Subject: [PATCH 0510/2396] hw/loongarch/virt: Register reset interface with
 cpu plug callback

With cpu hotplug is implemented on LoongArch virt machine, reset
interface with hot-added CPU should be registered. Otherwise there
will be problem if system reboots after cpu is hot-added.

Now register reset interface with CPU plug callback, so that all
cold/hot added CPUs let their reset interface registered. And remove
reset interface with CPU unplug callback.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Tested-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250906070200.3749326-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/boot.c | 13 -------------
 hw/loongarch/virt.c |  2 ++
 2 files changed, 2 insertions(+), 13 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 5799b4c75c..a516415822 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -350,13 +350,6 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
     return kernel_entry;
 }
 
-static void reset_load_elf(void *opaque)
-{
-    LoongArchCPU *cpu = opaque;
-
-    cpu_reset(CPU(cpu));
-}
-
 static void fw_cfg_add_kernel_info(struct loongarch_boot_info *info,
                                    FWCfgState *fw_cfg)
 {
@@ -439,12 +432,6 @@ static void loongarch_direct_kernel_boot(MachineState *ms,
 void loongarch_load_kernel(MachineState *ms, struct loongarch_boot_info *info)
 {
     LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(ms);
-    int i;
-
-    /* register reset function */
-    for (i = 0; i < ms->smp.cpus; i++) {
-        qemu_register_reset(reset_load_elf, LOONGARCH_CPU(qemu_get_cpu(i)));
-    }
 
     info->kernel_filename = ms->kernel_filename;
     info->kernel_cmdline = ms->kernel_cmdline;
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 31215b7785..bd5cff1f1e 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -1014,6 +1014,7 @@ static void virt_cpu_unplug(HotplugHandler *hotplug_dev,
     /* Notify acpi ged CPU removed */
     hotplug_handler_unplug(HOTPLUG_HANDLER(lvms->acpi_ged), dev, &error_abort);
 
+    qemu_unregister_resettable(OBJECT(dev));
     cpu_slot = virt_find_cpu_slot(MACHINE(lvms), cpu->phy_id);
     cpu_slot->cpu = NULL;
 }
@@ -1038,6 +1039,7 @@ static void virt_cpu_plug(HotplugHandler *hotplug_dev,
                              &error_abort);
     }
 
+    qemu_register_resettable(OBJECT(dev));
     cpu_slot = virt_find_cpu_slot(MACHINE(lvms), cpu->phy_id);
     cpu_slot->cpu = CPU(dev);
 }

From 6657f3bb55edba8f068cbc9ac40bb230ea1d7a09 Mon Sep 17 00:00:00 2001
From: Mark Johnston <markj@freebsd.org>
Date: Wed, 6 Aug 2025 13:53:08 -0400
Subject: [PATCH 0511/2396] 9pfs: Add FreeBSD support

This is largely derived from existing Darwin support.  FreeBSD
apparently has better support for *at() system calls so doesn't require
workarounds for a missing mknodat().  The implementation has a couple of
warts however:
- The extattr(2) system calls don't support anything akin to
  XATTR_CREATE or XATTR_REPLACE, so a racy workaround is implemented.
- Attribute names cannot begin with "user." or "system." on ZFS.
  However FreeBSD's extattr(2) system calls support two dedicated
  namespaces for these two.  So "user." or "system." prefixes are
  trimmed off from attribute names and instead EXTATTR_NAMESPACE_USER or
  EXTATTR_NAMESPACE_SYSTEM are picked and passed to extattr system calls
  accordingly.

The 9pfs tests were verified to pass on the UFS, ZFS and tmpfs
filesystems.

Signed-off-by: Mark Johnston <markj@FreeBSD.org>
Link: https://lore.kernel.org/qemu-devel/aJOWhHB2p-fbueAm@nuc
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 fsdev/file-op-9p.h        |   6 +-
 fsdev/meson.build         |   2 +-
 hw/9pfs/9p-synth.c        |   2 +-
 hw/9pfs/9p-util-freebsd.c | 132 ++++++++++++++++++++++++++++++++++++++
 hw/9pfs/9p-util.h         |  20 ++++--
 hw/9pfs/9p.c              |  16 ++++-
 hw/9pfs/meson.build       |   2 +
 include/qemu/xattr.h      |   6 +-
 meson.build               |   8 +--
 9 files changed, 179 insertions(+), 15 deletions(-)
 create mode 100644 hw/9pfs/9p-util-freebsd.c

diff --git a/fsdev/file-op-9p.h b/fsdev/file-op-9p.h
index b9dae8c84c..b85c9934de 100644
--- a/fsdev/file-op-9p.h
+++ b/fsdev/file-op-9p.h
@@ -21,9 +21,11 @@
 
 #ifdef CONFIG_LINUX
 # include <sys/vfs.h>
-#endif
-#ifdef CONFIG_DARWIN
+#elif defined(CONFIG_DARWIN) || defined(CONFIG_FREEBSD)
 # include <sys/param.h>
+# ifdef CONFIG_FREEBSD
+#  undef MACHINE /* work around some unfortunate namespace pollution */
+# endif
 # include <sys/mount.h>
 #endif
 
diff --git a/fsdev/meson.build b/fsdev/meson.build
index c751d8cb62..95fe816604 100644
--- a/fsdev/meson.build
+++ b/fsdev/meson.build
@@ -5,6 +5,6 @@ fsdev_ss.add(when: ['CONFIG_FSDEV_9P'], if_true: files(
   '9p-marshal.c',
   'qemu-fsdev.c',
 ), if_false: files('qemu-fsdev-dummy.c'))
-if host_os in ['linux', 'darwin']
+if host_os in ['linux', 'darwin', 'freebsd']
   system_ss.add_all(fsdev_ss)
 endif
diff --git a/hw/9pfs/9p-synth.c b/hw/9pfs/9p-synth.c
index 9cd1884224..b3743f6169 100644
--- a/hw/9pfs/9p-synth.c
+++ b/hw/9pfs/9p-synth.c
@@ -451,7 +451,7 @@ static int synth_statfs(FsContext *s, V9fsPath *fs_path,
     stbuf->f_bsize = 512;
     stbuf->f_blocks = 0;
     stbuf->f_files = synth_node_count;
-#ifndef CONFIG_DARWIN
+#if !defined(CONFIG_DARWIN) && !defined(CONFIG_FREEBSD)
     stbuf->f_namelen = NAME_MAX;
 #endif
     return 0;
diff --git a/hw/9pfs/9p-util-freebsd.c b/hw/9pfs/9p-util-freebsd.c
new file mode 100644
index 0000000000..9dd1d069f6
--- /dev/null
+++ b/hw/9pfs/9p-util-freebsd.c
@@ -0,0 +1,132 @@
+/*
+ * 9p utilities (FreeBSD Implementation)
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+/*
+ * Not so fast! You might want to read the 9p developer docs first:
+ * https://wiki.qemu.org/Documentation/9p
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/xattr.h"
+#include "9p-util.h"
+
+static int mangle_xattr_name(const char **namep)
+{
+    const char *name = *namep;
+
+    /*
+     * ZFS forbids attributes in starting with "user." or "system.".
+     */
+    if (strncmp(name, "system.", 7) == 0) {
+        *namep = name + 7;
+        return EXTATTR_NAMESPACE_SYSTEM;
+    }
+    if (strncmp(name, "user.", 5) == 0) {
+        *namep = name + 5;
+    }
+    return EXTATTR_NAMESPACE_USER;
+}
+
+ssize_t fgetxattr(int fd, const char *name, void *value, size_t size)
+{
+    int namespace;
+
+    namespace = mangle_xattr_name(&name);
+    return extattr_get_fd(fd, namespace, name, value, size);
+}
+
+ssize_t fgetxattrat_nofollow(int dirfd, const char *filename, const char *name,
+                             void *value, size_t size)
+{
+    ssize_t ret;
+    int fd, namespace;
+
+    fd = openat_file(dirfd, filename,
+                     O_RDONLY | O_PATH_9P_UTIL | O_NOFOLLOW, 0);
+    if (fd == -1) {
+        return -1;
+    }
+    namespace = mangle_xattr_name(&name);
+    ret = extattr_get_fd(fd, namespace, name, value, size);
+    close_preserve_errno(fd);
+    return ret;
+}
+
+ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
+                              char *list, size_t size)
+{
+    ssize_t ret;
+    int fd;
+
+    fd = openat_file(dirfd, filename,
+                     O_RDONLY | O_PATH_9P_UTIL | O_NOFOLLOW, 0);
+    if (fd == -1) {
+        return -1;
+    }
+    ret = extattr_list_fd(fd, EXTATTR_NAMESPACE_USER, list, size);
+    close_preserve_errno(fd);
+    return ret;
+}
+
+ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
+                                const char *name)
+{
+    int fd, namespace, ret;
+
+    fd = openat_file(dirfd, filename,
+                     O_RDONLY | O_PATH_9P_UTIL | O_NOFOLLOW, 0);
+    if (fd == -1) {
+        return -1;
+    }
+    namespace = mangle_xattr_name(&name);
+    ret = extattr_delete_fd(fd, namespace, name);
+    close_preserve_errno(fd);
+    return ret;
+}
+
+int fsetxattrat_nofollow(int dirfd, const char *filename, const char *name,
+                         void *value, size_t size, int flags)
+{
+    ssize_t ret;
+    int fd, namespace;
+
+    namespace = mangle_xattr_name(&name);
+    if (flags == (XATTR_CREATE | XATTR_REPLACE)) {
+        errno = EINVAL;
+        return -1;
+    }
+    fd = openat_file(dirfd, filename,
+                     O_RDONLY | O_PATH_9P_UTIL | O_NOFOLLOW, 0);
+    if (fd == -1) {
+        return -1;
+    }
+    if (flags & (XATTR_CREATE | XATTR_REPLACE)) {
+        ret = extattr_get_fd(fd, namespace, name, NULL, 0);
+        if (ret == -1 && errno != ENOATTR) {
+            close_preserve_errno(fd);
+            return -1;
+        }
+        if (ret >= 0 && (flags & XATTR_CREATE)) {
+            errno = EEXIST;
+            close_preserve_errno(fd);
+            return -1;
+        }
+        if (ret == -1 && (flags & XATTR_REPLACE)) {
+            errno = ENOATTR;
+            close_preserve_errno(fd);
+            return -1;
+        }
+    }
+    ret = extattr_set_fd(fd, namespace, name, value, size);
+    close_preserve_errno(fd);
+    return ret;
+}
+
+int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev)
+{
+    return mknodat(dirfd, filename, mode, dev);
+}
diff --git a/hw/9pfs/9p-util.h b/hw/9pfs/9p-util.h
index a1924fe3f0..8dfa803dc2 100644
--- a/hw/9pfs/9p-util.h
+++ b/hw/9pfs/9p-util.h
@@ -21,6 +21,15 @@
 #define O_PATH_9P_UTIL 0
 #endif
 
+#ifdef CONFIG_FREEBSD
+/*
+ * FreeBSD does not have these flags, so we can only emulate their intended
+ * behaviour (racily).
+ */
+#define XATTR_CREATE    0x1
+#define XATTR_REPLACE   0x2
+#endif
+
 #if !defined(CONFIG_LINUX)
 
 /*
@@ -64,9 +73,9 @@ static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
 static inline int errno_to_dotl(int err) {
 #if defined(CONFIG_LINUX)
     /* nothing to translate (Linux -> Linux) */
-#elif defined(CONFIG_DARWIN)
+#elif defined(CONFIG_DARWIN) || defined(CONFIG_FREEBSD)
     /*
-     * translation mandatory for macOS hosts
+     * translation mandatory for non-Linux hosts
      *
      * FIXME: Only most important errnos translated here yet, this should be
      * extended to as many errnos being translated as possible in future.
@@ -155,13 +164,13 @@ static inline int openat_file(int dirfd, const char *name, int flags,
 {
     int fd, serrno, ret;
 
-#ifndef CONFIG_DARWIN
+#if !defined(CONFIG_DARWIN) && !defined(CONFIG_FREEBSD)
 again:
 #endif
     fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
                      mode);
     if (fd == -1) {
-#ifndef CONFIG_DARWIN
+#if !defined(CONFIG_DARWIN) && !defined(CONFIG_FREEBSD)
         if (errno == EPERM && (flags & O_NOATIME)) {
             /*
              * The client passed O_NOATIME but we lack permissions to honor it.
@@ -202,6 +211,9 @@ again:
     return fd;
 }
 
+#ifdef CONFIG_FREEBSD
+ssize_t fgetxattr(int dirfd, const char *name, void *value, size_t size);
+#endif
 ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
                              void *value, size_t size);
 int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
diff --git a/hw/9pfs/9p.c b/hw/9pfs/9p.c
index acfa7db4e1..bc4a016ee3 100644
--- a/hw/9pfs/9p.c
+++ b/hw/9pfs/9p.c
@@ -136,8 +136,10 @@ static int dotl_to_open_flags(int flags)
         { P9_DOTL_NONBLOCK, O_NONBLOCK } ,
         { P9_DOTL_DSYNC, O_DSYNC },
         { P9_DOTL_FASYNC, FASYNC },
-#ifndef CONFIG_DARWIN
+#if !defined(CONFIG_DARWIN) && !defined(CONFIG_FREEBSD)
         { P9_DOTL_NOATIME, O_NOATIME },
+#endif
+#ifndef CONFIG_DARWIN
         /*
          *  On Darwin, we could map to F_NOCACHE, which is
          *  similar, but doesn't quite have the same
@@ -3658,7 +3660,7 @@ static int v9fs_fill_statfs(V9fsState *s, V9fsPDU *pdu, struct statfs *stbuf)
     f_bavail = stbuf->f_bavail / bsize_factor;
     f_files  = stbuf->f_files;
     f_ffree  = stbuf->f_ffree;
-#ifdef CONFIG_DARWIN
+#if defined(CONFIG_DARWIN) || defined(CONFIG_FREEBSD)
     fsid_val = (unsigned int)stbuf->f_fsid.val[0] |
                (unsigned long long)stbuf->f_fsid.val[1] << 32;
     f_namelen = NAME_MAX;
@@ -4050,6 +4052,16 @@ out_nofid:
  * Linux guests.
  */
 #define P9_XATTR_SIZE_MAX 65536
+#elif defined(CONFIG_FREEBSD)
+/*
+ * FreeBSD similarly doesn't define a maximum xattr size, the limit is
+ * filesystem dependent.  On UFS filesystems it's 2 times the filesystem block
+ * size, typically 32KB.  On ZFS it depends on the value of the xattr property;
+ * with the default value there is no limit, and with xattr=sa it is 64KB.
+ *
+ * So, a limit of 64k seems reasonable here too.
+ */
+#define P9_XATTR_SIZE_MAX 65536
 #else
 #error Missing definition for P9_XATTR_SIZE_MAX for this host system
 #endif
diff --git a/hw/9pfs/meson.build b/hw/9pfs/meson.build
index d35d4f44ff..7f4d6e3a45 100644
--- a/hw/9pfs/meson.build
+++ b/hw/9pfs/meson.build
@@ -15,6 +15,8 @@ fs_ss.add(files(
 ))
 if host_os == 'darwin'
   fs_ss.add(files('9p-util-darwin.c'))
+elif host_os == 'freebsd'
+  fs_ss.add(files('9p-util-freebsd.c'))
 elif host_os == 'linux'
   fs_ss.add(files('9p-util-linux.c'))
 endif
diff --git a/include/qemu/xattr.h b/include/qemu/xattr.h
index b08a934acc..224ba1276e 100644
--- a/include/qemu/xattr.h
+++ b/include/qemu/xattr.h
@@ -26,7 +26,11 @@
 #    define ENOATTR ENODATA
 #  endif
 #  ifndef CONFIG_WIN32
-#    include <sys/xattr.h>
+#    ifdef CONFIG_FREEBSD
+#      include <sys/extattr.h>
+#    else
+#      include <sys/xattr.h>
+#    endif
 #  endif
 #endif
 
diff --git a/meson.build b/meson.build
index 6ade30f36a..72da97829a 100644
--- a/meson.build
+++ b/meson.build
@@ -2384,11 +2384,11 @@ dbus_display = get_option('dbus_display') \
   .allowed()
 
 have_virtfs = get_option('virtfs') \
-    .require(host_os == 'linux' or host_os == 'darwin',
-             error_message: 'virtio-9p (virtfs) requires Linux or macOS') \
-    .require(host_os == 'linux' or cc.has_function('pthread_fchdir_np'),
+    .require(host_os == 'linux' or host_os == 'darwin' or host_os == 'freebsd',
+             error_message: 'virtio-9p (virtfs) requires Linux or macOS or FreeBSD') \
+    .require(host_os != 'darwin' or cc.has_function('pthread_fchdir_np'),
              error_message: 'virtio-9p (virtfs) on macOS requires the presence of pthread_fchdir_np') \
-    .require(host_os == 'darwin' or libattr.found(),
+    .require(host_os != 'linux' or libattr.found(),
              error_message: 'virtio-9p (virtfs) on Linux requires libattr-devel') \
     .disable_auto_if(not have_tools and not have_system) \
     .allowed()

From c921e5496f23221335bea0c9104364409cd0b2b8 Mon Sep 17 00:00:00 2001
From: Peter Foley <pefoley@google.com>
Date: Fri, 5 Sep 2025 11:17:11 -0400
Subject: [PATCH 0512/2396] 9pfs: Stop including gstrfuncs.h

gstrfuncs.h is not intended to be included directly.
In fact this only works because glib.h is already included by osdep.h.
Just remove the include.

Signed-off-by: Peter Foley <pefoley@google.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250905-9p-v2-1-2ad31999684d@google.com
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
---
 hw/9pfs/9p-util-generic.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/9pfs/9p-util-generic.c b/hw/9pfs/9p-util-generic.c
index 4c1e9c887d..b71fa2cb37 100644
--- a/hw/9pfs/9p-util-generic.c
+++ b/hw/9pfs/9p-util-generic.c
@@ -2,7 +2,6 @@
 
 #include "qemu/osdep.h"
 #include "9p-util.h"
-#include <glib/gstrfuncs.h>
 
 char *qemu_open_flags_tostr(int flags)
 {

From e5eacba4a3e6efdae8cda323f9a2ab5cfb1d0492 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 20 Aug 2025 13:40:48 +0100
Subject: [PATCH 0513/2396] MAINTAINERS: list qemu-security@nongnu.org as
 security contact
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The qemu-security@nongnu.org list is considered the authoritative
contact for reporting QEMU security issues. Remove the Red Hat
security team address in favour of QEMU's list, to ensure that
upstream gets first contact. There is a representative of the
Red Hat security team as a member of qemu-security@nongnu.org
whom requests CVE assignments on behalf of QEMU when needed.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Mauro Matteo Cascella <mcascell@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index bd417e96f7..70eb0241d3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -85,7 +85,7 @@ Responsible Disclosure, Reporting Security Issues
 -------------------------------------------------
 W: https://wiki.qemu.org/SecurityProcess
 M: Michael S. Tsirkin <mst@redhat.com>
-L: secalert@redhat.com
+L: qemu-security@nongnu.org
 
 Trivial patches
 ---------------

From 7bc2cbe3306899559c4da1b05e410235d994e22d Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 10 Sep 2025 22:31:11 +0300
Subject: [PATCH 0514/2396] migration/qemu-file: don't make incoming fds
 blocking again
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In migration we want to pass fd "as is", not changing its
blocking status.

The only current user of these fds is CPR state (through VMSTATE_FD),
which of-course doesn't want to modify fds on target when source is
still running and use these fds.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel.h  |  1 +
 io/channel-socket.c   | 13 +++++++++----
 migration/qemu-file.c |  3 ++-
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/include/io/channel.h b/include/io/channel.h
index 234e5db70d..12266256a8 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -36,6 +36,7 @@ OBJECT_DECLARE_TYPE(QIOChannel, QIOChannelClass,
 
 #define QIO_CHANNEL_READ_FLAG_MSG_PEEK 0x1
 #define QIO_CHANNEL_READ_FLAG_RELAXED_EOF 0x2
+#define QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING 0x4
 
 typedef enum QIOChannelFeature QIOChannelFeature;
 
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 3b7ca924ff..21f8f2e0c5 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -464,7 +464,8 @@ static void qio_channel_socket_finalize(Object *obj)
 
 #ifndef WIN32
 static void qio_channel_socket_copy_fds(struct msghdr *msg,
-                                        int **fds, size_t *nfds)
+                                        int **fds, size_t *nfds,
+                                        bool preserve_blocking)
 {
     struct cmsghdr *cmsg;
 
@@ -497,8 +498,10 @@ static void qio_channel_socket_copy_fds(struct msghdr *msg,
                 continue;
             }
 
-            /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
-            qemu_socket_set_block(fd);
+            if (!preserve_blocking) {
+                /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
+                qemu_socket_set_block(fd);
+            }
 
 #ifndef MSG_CMSG_CLOEXEC
             qemu_set_cloexec(fd);
@@ -556,7 +559,9 @@ static ssize_t qio_channel_socket_readv(QIOChannel *ioc,
     }
 
     if (fds && nfds) {
-        qio_channel_socket_copy_fds(&msg, fds, nfds);
+        qio_channel_socket_copy_fds(
+            &msg, fds, nfds,
+            flags & QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING);
     }
 
     return ret;
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index b6ac190034..d5c6e7ec61 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -340,7 +340,8 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
 
     do {
         struct iovec iov = { f->buf + pending, IO_BUF_SIZE - pending };
-        len = qio_channel_readv_full(f->ioc, &iov, 1, pfds, pnfd, 0,
+        len = qio_channel_readv_full(f->ioc, &iov, 1, pfds, pnfd,
+                                     QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING,
                                      &local_error);
         if (len == QIO_CHANNEL_ERR_BLOCK) {
             if (qemu_in_coroutine()) {

From d343f395e371aa1b859eb42be331918931a6637e Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 10 Sep 2025 22:31:12 +0300
Subject: [PATCH 0515/2396] io/channel: document how qio_channel_readv_full()
 handles fds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only realization, which may have incoming fds is
qio_channel_socket_readv() (in io/channel-socket.c).
qio_channel_socket_readv() do call (through
qio_channel_socket_copy_fds()) qemu_socket_set_block() and
qemu_set_cloexec() for each fd.

Also, qio_channel_socket_copy_fds() is called at the end of
qio_channel_socket_readv(), on success path.

Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel.h | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/include/io/channel.h b/include/io/channel.h
index 12266256a8..c7f64506f7 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -118,6 +118,15 @@ struct QIOChannelClass {
                          size_t nfds,
                          int flags,
                          Error **errp);
+
+    /*
+     * The io_readv handler must guarantee that all
+     * incoming fds are set BLOCKING (unless
+     * QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING flag is set) and
+     * CLOEXEC (if available).
+     * @fds and @nfds are set only on success path, and untouched
+     * in case of errors.
+     */
     ssize_t (*io_readv)(QIOChannel *ioc,
                         const struct iovec *iov,
                         size_t niov,
@@ -125,6 +134,7 @@ struct QIOChannelClass {
                         size_t *nfds,
                         int flags,
                         Error **errp);
+
     int (*io_close)(QIOChannel *ioc,
                     Error **errp);
     GSource * (*io_create_watch)(QIOChannel *ioc,
@@ -235,6 +245,13 @@ void qio_channel_set_name(QIOChannel *ioc,
  * was allocated. It is the callers responsibility
  * to call close() on each file descriptor and to
  * call g_free() on the array pointer in @fds.
+ * @fds allocated and set (and @nfds is set too)
+ * _only_ on success path. These parameters are
+ * untouched in case of errors.
+ * qio_channel_readv_full() guarantees that all
+ * incoming fds are set BLOCKING (unless
+ * QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING flag
+ * is set) and CLOEXEC (if available).
  *
  * It is an error to pass a non-NULL @fds parameter
  * unless qio_channel_has_feature() returns a true

From 6e9a6d57bf8de9e1edc207c24ed4e9e9508838c1 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:50 +0300
Subject: [PATCH 0516/2396] char-socket: tcp_chr_recv(): drop extra
 _set_(block,cloexec)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qio_channel_readv_full() guarantees BLOCKING and CLOEXEC states for
incoming descriptors, no reason to call extra ioctls.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-socket.c | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 1e8313915b..b1ce5d01c7 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -307,20 +307,6 @@ static ssize_t tcp_chr_recv(Chardev *chr, char *buf, size_t len)
         s->read_msgfds_num = msgfds_num;
     }
 
-    for (i = 0; i < s->read_msgfds_num; i++) {
-        int fd = s->read_msgfds[i];
-        if (fd < 0) {
-            continue;
-        }
-
-        /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
-        qemu_socket_set_block(fd);
-
-#ifndef MSG_CMSG_CLOEXEC
-        qemu_set_cloexec(fd);
-#endif
-    }
-
     if (ret == QIO_CHANNEL_ERR_BLOCK) {
         errno = EAGAIN;
         ret = -1;

From 9adc8d052d1c6b3015ca07a6a0f0833fb725e06f Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:51 +0300
Subject: [PATCH 0517/2396] char-socket: tcp_chr_recv(): add comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add comment, to stress that the order of operation (first drop old fds,
second check read status) is intended.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-socket.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index b1ce5d01c7..1be078dfc0 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -294,7 +294,12 @@ static ssize_t tcp_chr_recv(Chardev *chr, char *buf, size_t len)
     }
 
     if (msgfds_num) {
-        /* close and clean read_msgfds */
+        /*
+         * Close and clean previous read_msgfds, they are obsolete at
+         * this point, regardless result of new call to
+         * qio_channel_readv_full().
+         */
+
         for (i = 0; i < s->read_msgfds_num; i++) {
             close(s->read_msgfds[i]);
         }

From 4149afca711cc735a84ad61314bdcf41f69a7607 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:52 +0300
Subject: [PATCH 0518/2396] util: add qemu_set_blocking() function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In generic code we have qio_channel_set_blocking(), which takes
bool parameter, and qemu_file_set_blocking(), which as well takes
bool parameter.

At lower fd-layer we have a mess of functions:

- enough direct calls to Unix-specific g_unix_set_fd_nonblocking()
(of course, all calls are out of Windows-compatible code), which
is glib specific with GError, which we can't use, and have to
handle error-reporting by hand after the call.

and several platform-agnostic qemu_* helpers:

- qemu_socket_set_nonblock(), which asserts success for posix (still,
  in most cases we can handle the error in better way) and ignores
  error for win32 realization

- qemu_socket_try_set_nonblock(), providing and error, but not errp,
so we have to handle it after the call

- qemu_socket_set_block(), which simply ignores an error

Note, that *_socket_* word in original API, which we are going
to substitute was intended, because Windows support these operations
only for sockets. What leads to solution of dropping it again?

1. Having a QEMU-native wrapper with errp parameter
for g_unix_set_fd_nonblocking() for non-socket fds worth doing,
at least to unify error handling.

2. So, if try to keep _socket_ vs _file_ words, we'll have two
actually duplicated functions for Linux, which actually will
be executed successfully on any (good enough) fds, and nothing
prevent using them improperly except for the name. That doesn't
look good.

3. Naming helped us in the world where we crash on errors or
ignore them. Now, with errp parameter, callers are intended to
proper error checking. And for places where we really OK with
crash-on-error semantics (like tests), we have an explicit
&error_abort.

So, this commit starts a series, which will effectively revert
commit ff5927baa7ffb9 "util: rename qemu_*block() socket functions"
(which in turn was reverting f9e8cacc5557e43
"oslib-posix: rename socket_set_nonblock() to qemu_set_nonblock()",
so that's a long story).
Now we don't simply rename, instead we provide the new API and
update all the callers.

This commit only introduces a new fd-layer wrapper. Next commits
will replace old API calls with it, and finally remove old API.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/qemu/osdep.h |  1 +
 util/oslib-posix.c   | 15 +++++++++++++++
 util/oslib-win32.c   | 18 ++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index be3460b32f..1b38cb7e45 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -687,6 +687,7 @@ ssize_t qemu_write_full(int fd, const void *buf, size_t count)
     G_GNUC_WARN_UNUSED_RESULT;
 
 void qemu_set_cloexec(int fd);
+bool qemu_set_blocking(int fd, bool block, Error **errp);
 
 /* Return a dynamically allocated directory path that is appropriate for storing
  * local state.
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 4ff577e5de..c737701075 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -250,6 +250,21 @@ void qemu_anon_ram_free(void *ptr, size_t size)
 #endif
 }
 
+bool qemu_set_blocking(int fd, bool block, Error **errp)
+{
+    g_autoptr(GError) err = NULL;
+
+    if (!g_unix_set_fd_nonblocking(fd, !block, &err)) {
+        error_setg_errno(errp, errno,
+                         "Can't set file descriptor %d %s: %s", fd,
+                         block ? "blocking" : "non-blocking",
+                         err->message);
+        return false;
+    }
+
+    return true;
+}
+
 void qemu_socket_set_block(int fd)
 {
     g_unix_set_fd_nonblocking(fd, false, NULL);
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index b7351634ec..03044f5b59 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -177,6 +177,24 @@ static int socket_error(void)
     }
 }
 
+bool qemu_set_blocking(int fd, bool block, Error **errp)
+{
+    unsigned long opt = block ? 0 : 1;
+
+    if (block) {
+        qemu_socket_unselect(fd, NULL);
+    }
+
+    if (ioctlsocket(fd, FIONBIO, &opt) != NO_ERROR) {
+        error_setg_errno(errp, socket_error(),
+                         "Can't set file descriptor %d %s", fd,
+                         block ? "blocking" : "non-blocking");
+        return false;
+    }
+
+    return true;
+}
+
 void qemu_socket_set_block(int fd)
 {
     unsigned long opt = 0;

From 1ed8903916394fca2347c700da974ca3856274b2 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:53 +0300
Subject: [PATCH 0519/2396] treewide: handle result of
 qio_channel_set_blocking()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, we just always pass NULL as errp argument. That doesn't
look good.

Some realizations of interface may actually report errors.
Channel-socket realization actually either ignore or crash on
errors, but we are going to straighten it out to always reporting
an errp in further commits.

So, convert all callers to either handle the error (where environment
allows) or explicitly use &error_abort.

Take also a chance to change the return value to more convenient
bool (keeping also in mind, that underlying realizations may
return -1 on failure, not -errno).

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
[DB: fix return type mismatch in TLS/websocket channel
     impls for qio_channel_set_blocking]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 block/nbd.c                      |  4 +++-
 chardev/char-socket.c            | 20 ++++++++++++++++----
 hw/remote/proxy.c                |  6 +++++-
 hw/remote/remote-obj.c           |  6 +++++-
 hw/vfio-user/proxy.c             | 11 ++++++++---
 include/io/channel.h             |  6 +++---
 io/channel-tls.c                 |  2 +-
 io/channel-websock.c             |  3 +--
 io/channel.c                     |  4 ++--
 nbd/server.c                     |  4 +++-
 scsi/qemu-pr-helper.c            |  9 ++++++---
 tests/unit/io-channel-helpers.c  |  5 +++--
 tests/unit/test-io-channel-tls.c |  4 ++--
 tools/i386/qemu-vmsr-helper.c    |  6 ++++--
 ui/vnc.c                         |  2 +-
 util/vhost-user-server.c         |  7 ++++++-
 16 files changed, 69 insertions(+), 30 deletions(-)

diff --git a/block/nbd.c b/block/nbd.c
index d5a2b21c6d..5d231d5c4e 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -351,7 +351,9 @@ int coroutine_fn nbd_co_do_establish_connection(BlockDriverState *bs,
         return ret;
     }
 
-    qio_channel_set_blocking(s->ioc, false, NULL);
+    if (!qio_channel_set_blocking(s->ioc, false, errp)) {
+        return -EINVAL;
+    }
     qio_channel_set_follow_coroutine_ctx(s->ioc, true);
 
     /* successfully connected */
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 1be078dfc0..cb4ec78ebe 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -530,16 +530,24 @@ static int tcp_chr_sync_read(Chardev *chr, const uint8_t *buf, int len)
     SocketChardev *s = SOCKET_CHARDEV(chr);
     int size;
     int saved_errno;
+    Error *local_err = NULL;
 
     if (s->state != TCP_CHARDEV_STATE_CONNECTED) {
         return 0;
     }
 
-    qio_channel_set_blocking(s->ioc, true, NULL);
+    if (!qio_channel_set_blocking(s->ioc, true, &local_err)) {
+        error_report_err(local_err);
+        return -1;
+    }
     size = tcp_chr_recv(chr, (void *) buf, len);
     saved_errno = errno;
     if (s->state != TCP_CHARDEV_STATE_DISCONNECTED) {
-        qio_channel_set_blocking(s->ioc, false, NULL);
+        if (!qio_channel_set_blocking(s->ioc, false, &local_err)) {
+            error_report_err(local_err);
+            /* failed to recover non-blocking state */
+            tcp_chr_disconnect(chr);
+        }
     }
     if (size == 0) {
         /* connection closed */
@@ -884,18 +892,22 @@ static void tcp_chr_set_client_ioc_name(Chardev *chr,
 static int tcp_chr_new_client(Chardev *chr, QIOChannelSocket *sioc)
 {
     SocketChardev *s = SOCKET_CHARDEV(chr);
+    Error *local_err = NULL;
 
     if (s->state != TCP_CHARDEV_STATE_CONNECTING) {
         return -1;
     }
 
+    if (!qio_channel_set_blocking(QIO_CHANNEL(sioc), false, &local_err)) {
+        error_report_err(local_err);
+        return -1;
+    }
+
     s->ioc = QIO_CHANNEL(sioc);
     object_ref(OBJECT(sioc));
     s->sioc = sioc;
     object_ref(OBJECT(sioc));
 
-    qio_channel_set_blocking(s->ioc, false, NULL);
-
     if (s->do_nodelay) {
         qio_channel_set_delay(s->ioc, false);
     }
diff --git a/hw/remote/proxy.c b/hw/remote/proxy.c
index b0165aa2a1..18e0f7a064 100644
--- a/hw/remote/proxy.c
+++ b/hw/remote/proxy.c
@@ -112,8 +112,12 @@ static void pci_proxy_dev_realize(PCIDevice *device, Error **errp)
         return;
     }
 
+    if (!qio_channel_set_blocking(dev->ioc, true, errp)) {
+        object_unref(dev->ioc);
+        return;
+    }
+
     qemu_mutex_init(&dev->io_mutex);
-    qio_channel_set_blocking(dev->ioc, true, NULL);
 
     pci_conf[PCI_LATENCY_TIMER] = 0xff;
     pci_conf[PCI_INTERRUPT_PIN] = 0x01;
diff --git a/hw/remote/remote-obj.c b/hw/remote/remote-obj.c
index 85882902d7..3402068ab9 100644
--- a/hw/remote/remote-obj.c
+++ b/hw/remote/remote-obj.c
@@ -107,7 +107,11 @@ static void remote_object_machine_done(Notifier *notifier, void *data)
         error_report_err(err);
         return;
     }
-    qio_channel_set_blocking(ioc, false, NULL);
+    if (!qio_channel_set_blocking(ioc, false, &err)) {
+        error_report_err(err);
+        object_unref(OBJECT(ioc));
+        return;
+    }
 
     o->dev = dev;
 
diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 2c03d49f97..bbd7ec243d 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -886,10 +886,11 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
     sioc = qio_channel_socket_new();
     ioc = QIO_CHANNEL(sioc);
     if (qio_channel_socket_connect_sync(sioc, addr, errp) < 0) {
-        object_unref(OBJECT(ioc));
-        return NULL;
+        goto fail;
+    }
+    if (!qio_channel_set_blocking(ioc, false, errp)) {
+        goto fail;
     }
-    qio_channel_set_blocking(ioc, false, NULL);
 
     proxy = g_malloc0(sizeof(VFIOUserProxy));
     proxy->sockname = g_strdup_printf("unix:%s", sockname);
@@ -923,6 +924,10 @@ VFIOUserProxy *vfio_user_connect_dev(SocketAddress *addr, Error **errp)
     QLIST_INSERT_HEAD(&vfio_user_sockets, proxy, next);
 
     return proxy;
+
+fail:
+    object_unref(OBJECT(ioc));
+    return NULL;
 }
 
 void vfio_user_set_handler(VFIODevice *vbasedev,
diff --git a/include/io/channel.h b/include/io/channel.h
index c7f64506f7..999a8f5f23 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -531,9 +531,9 @@ int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
  * return QIO_CHANNEL_ERR_BLOCK if they would otherwise
  * block on I/O
  */
-int qio_channel_set_blocking(QIOChannel *ioc,
-                             bool enabled,
-                             Error **errp);
+bool qio_channel_set_blocking(QIOChannel *ioc,
+                              bool enabled,
+                              Error **errp);
 
 /**
  * qio_channel_set_follow_coroutine_ctx:
diff --git a/io/channel-tls.c b/io/channel-tls.c
index a8248a9216..7135896f79 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -425,7 +425,7 @@ static int qio_channel_tls_set_blocking(QIOChannel *ioc,
 {
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
 
-    return qio_channel_set_blocking(tioc->master, enabled, errp);
+    return qio_channel_set_blocking(tioc->master, enabled, errp) ? 0 : -1;
 }
 
 static void qio_channel_tls_set_delay(QIOChannel *ioc,
diff --git a/io/channel-websock.c b/io/channel-websock.c
index 08ddb274f0..0a8c5c4712 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -1184,8 +1184,7 @@ static int qio_channel_websock_set_blocking(QIOChannel *ioc,
 {
     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
 
-    qio_channel_set_blocking(wioc->master, enabled, errp);
-    return 0;
+    return qio_channel_set_blocking(wioc->master, enabled, errp) ? 0 : -1;
 }
 
 static void qio_channel_websock_set_delay(QIOChannel *ioc,
diff --git a/io/channel.c b/io/channel.c
index ebd9322765..852e684938 100644
--- a/io/channel.c
+++ b/io/channel.c
@@ -359,12 +359,12 @@ int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
 }
 
 
-int qio_channel_set_blocking(QIOChannel *ioc,
+bool qio_channel_set_blocking(QIOChannel *ioc,
                               bool enabled,
                               Error **errp)
 {
     QIOChannelClass *klass = QIO_CHANNEL_GET_CLASS(ioc);
-    return klass->io_set_blocking(ioc, enabled, errp);
+    return klass->io_set_blocking(ioc, enabled, errp) == 0;
 }
 
 
diff --git a/nbd/server.c b/nbd/server.c
index d242be9811..acec0487a8 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -1411,7 +1411,9 @@ static coroutine_fn int nbd_negotiate(NBDClient *client, Error **errp)
         ....options sent, ending in NBD_OPT_EXPORT_NAME or NBD_OPT_GO....
      */
 
-    qio_channel_set_blocking(client->ioc, false, NULL);
+    if (!qio_channel_set_blocking(client->ioc, false, errp)) {
+        return -EINVAL;
+    }
     qio_channel_set_follow_coroutine_ctx(client->ioc, true);
 
     trace_nbd_negotiate_begin();
diff --git a/scsi/qemu-pr-helper.c b/scsi/qemu-pr-helper.c
index b69dd982d6..074b4db472 100644
--- a/scsi/qemu-pr-helper.c
+++ b/scsi/qemu-pr-helper.c
@@ -733,8 +733,11 @@ static void coroutine_fn prh_co_entry(void *opaque)
     uint32_t flags;
     int r;
 
-    qio_channel_set_blocking(QIO_CHANNEL(client->ioc),
-                             false, NULL);
+    if (!qio_channel_set_blocking(QIO_CHANNEL(client->ioc),
+                                  false, &local_err)) {
+        goto out;
+    }
+
     qio_channel_set_follow_coroutine_ctx(QIO_CHANNEL(client->ioc), true);
 
     /* A very simple negotiation for future extensibility.  No features
@@ -786,6 +789,7 @@ static void coroutine_fn prh_co_entry(void *opaque)
         }
     }
 
+out:
     if (local_err) {
         if (verbose == 0) {
             error_free(local_err);
@@ -794,7 +798,6 @@ static void coroutine_fn prh_co_entry(void *opaque)
         }
     }
 
-out:
     object_unref(OBJECT(client->ioc));
     g_free(client);
 }
diff --git a/tests/unit/io-channel-helpers.c b/tests/unit/io-channel-helpers.c
index c0799c21c2..22b42d14cd 100644
--- a/tests/unit/io-channel-helpers.c
+++ b/tests/unit/io-channel-helpers.c
@@ -20,6 +20,7 @@
 
 #include "qemu/osdep.h"
 #include "io-channel-helpers.h"
+#include "qapi/error.h"
 #include "qemu/iov.h"
 
 struct QIOChannelTest {
@@ -109,8 +110,8 @@ void qio_channel_test_run_threads(QIOChannelTest *test,
     test->src = src;
     test->dst = dst;
 
-    qio_channel_set_blocking(test->dst, blocking, NULL);
-    qio_channel_set_blocking(test->src, blocking, NULL);
+    qio_channel_set_blocking(test->dst, blocking, &error_abort);
+    qio_channel_set_blocking(test->src, blocking, &error_abort);
 
     reader = g_thread_new("reader",
                           test_io_thread_reader,
diff --git a/tests/unit/test-io-channel-tls.c b/tests/unit/test-io-channel-tls.c
index e036ac5df4..6f282ad45d 100644
--- a/tests/unit/test-io-channel-tls.c
+++ b/tests/unit/test-io-channel-tls.c
@@ -184,8 +184,8 @@ static void test_io_channel_tls(const void *opaque)
      * thread, so we need these non-blocking to avoid deadlock
      * of ourselves
      */
-    qio_channel_set_blocking(QIO_CHANNEL(clientChanSock), false, NULL);
-    qio_channel_set_blocking(QIO_CHANNEL(serverChanSock), false, NULL);
+    qio_channel_set_blocking(QIO_CHANNEL(clientChanSock), false, &error_abort);
+    qio_channel_set_blocking(QIO_CHANNEL(serverChanSock), false, &error_abort);
 
     /* Now the real part of the test, setup the sessions */
     clientChanTLS = qio_channel_tls_new_client(
diff --git a/tools/i386/qemu-vmsr-helper.c b/tools/i386/qemu-vmsr-helper.c
index 5f19a48cbd..6c0f4fe870 100644
--- a/tools/i386/qemu-vmsr-helper.c
+++ b/tools/i386/qemu-vmsr-helper.c
@@ -213,8 +213,10 @@ static void coroutine_fn vh_co_entry(void *opaque)
     uint64_t vmsr;
     int r;
 
-    qio_channel_set_blocking(QIO_CHANNEL(client->ioc),
-                             false, NULL);
+    if (!qio_channel_set_blocking(QIO_CHANNEL(client->ioc),
+                                  false, &local_err)) {
+        goto out;
+    }
 
     qio_channel_set_follow_coroutine_ctx(QIO_CHANNEL(client->ioc), true);
 
diff --git a/ui/vnc.c b/ui/vnc.c
index 9054fc8125..77c823bf2e 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -3337,7 +3337,7 @@ static void vnc_connect(VncDisplay *vd, QIOChannelSocket *sioc,
 
     VNC_DEBUG("New client on socket %p\n", vs->sioc);
     update_displaychangelistener(&vd->dcl, VNC_REFRESH_INTERVAL_BASE);
-    qio_channel_set_blocking(vs->ioc, false, NULL);
+    qio_channel_set_blocking(vs->ioc, false, &error_abort);
     if (vs->ioc_tag) {
         g_source_remove(vs->ioc_tag);
     }
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index b19229074a..d805a92394 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -336,6 +336,7 @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
                       gpointer opaque)
 {
     VuServer *server = opaque;
+    Error *local_err = NULL;
 
     if (server->sioc) {
         warn_report("Only one vhost-user client is allowed to "
@@ -368,7 +369,11 @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
     object_ref(OBJECT(server->ioc));
 
     /* TODO vu_message_write() spins if non-blocking! */
-    qio_channel_set_blocking(server->ioc, false, NULL);
+    if (!qio_channel_set_blocking(server->ioc, false, &local_err)) {
+        error_report_err(local_err);
+        vu_deinit(&server->vu_dev);
+        return;
+    }
 
     qio_channel_set_follow_coroutine_ctx(server->ioc, true);
 

From fe6a74f365743ae3ce2cbbc4d44617d51a446a02 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:54 +0300
Subject: [PATCH 0520/2396] migration: qemu_file_set_blocking(): add errp
 parameter
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_file_set_blocking() is a wrapper on qio_channel_set_blocking(),
so let's passthrough the errp.

Note the migration should not be using &error_abort in these calls,
however, this is done to expedite the API conversion.

The original code would have eventually ended up calling either
qemu_socket_set_nonblock which would asset on Linux, or
g_unix_set_fd_nonblocking which would propagate errors. We never
saw asserts in practice, and conceptually they should not happen,
but ideally this code will be later adapted to remove use of
&error_abort.

Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 migration/colo.c         | 5 ++++-
 migration/migration.c    | 8 +++++---
 migration/postcopy-ram.c | 2 +-
 migration/qemu-file.c    | 4 ++--
 migration/qemu-file.h    | 2 +-
 migration/savevm.c       | 4 ++--
 6 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/migration/colo.c b/migration/colo.c
index e0f713c837..cf4d71d9ed 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -859,7 +859,10 @@ static void *colo_process_incoming_thread(void *opaque)
      * coroutine, and here we are in the COLO incoming thread, so it is ok to
      * set the fd back to blocked.
      */
-    qemu_file_set_blocking(mis->from_src_file, true);
+    if (!qemu_file_set_blocking(mis->from_src_file, true, &local_err)) {
+        error_report_err(local_err);
+        goto out;
+    }
 
     colo_incoming_start_dirty_log();
 
diff --git a/migration/migration.c b/migration/migration.c
index 10c216d25d..e1ac4d73c2 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -951,7 +951,7 @@ static void migration_incoming_setup(QEMUFile *f)
 
     assert(!mis->from_src_file);
     mis->from_src_file = f;
-    qemu_file_set_blocking(f, false);
+    qemu_file_set_blocking(f, false, &error_abort);
 }
 
 void migration_incoming_process(void)
@@ -971,7 +971,7 @@ static bool postcopy_try_recover(void)
         /* This should be set already in migration_incoming_setup() */
         assert(mis->from_src_file);
         /* Postcopy has standalone thread to do vm load */
-        qemu_file_set_blocking(mis->from_src_file, true);
+        qemu_file_set_blocking(mis->from_src_file, true, &error_abort);
 
         /* Re-configure the return path */
         mis->to_src_file = qemu_file_get_return_path(mis->from_src_file);
@@ -4002,7 +4002,9 @@ void migration_connect(MigrationState *s, Error *error_in)
     }
 
     migration_rate_set(rate_limit);
-    qemu_file_set_blocking(s->to_dst_file, true);
+    if (!qemu_file_set_blocking(s->to_dst_file, true, &local_err)) {
+        goto fail;
+    }
 
     /*
      * Open the return path. For postcopy, it is used exclusively. For
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 45af9a361e..0172172343 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -1909,7 +1909,7 @@ void postcopy_preempt_new_channel(MigrationIncomingState *mis, QEMUFile *file)
      * The new loading channel has its own threads, so it needs to be
      * blocked too.  It's by default true, just be explicit.
      */
-    qemu_file_set_blocking(file, true);
+    qemu_file_set_blocking(file, true, &error_abort);
     mis->postcopy_qemufile_dst = file;
     qemu_sem_post(&mis->postcopy_qemufile_dst_done);
     trace_postcopy_preempt_new_channel();
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index d5c6e7ec61..0f4280df21 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -888,9 +888,9 @@ void qemu_put_counted_string(QEMUFile *f, const char *str)
  *       both directions, and thus changing the blocking on the main
  *       QEMUFile can also affect the return path.
  */
-void qemu_file_set_blocking(QEMUFile *f, bool block)
+bool qemu_file_set_blocking(QEMUFile *f, bool block, Error **errp)
 {
-    qio_channel_set_blocking(f->ioc, block, NULL);
+    return qio_channel_set_blocking(f->ioc, block, errp);
 }
 
 /*
diff --git a/migration/qemu-file.h b/migration/qemu-file.h
index f5b9f430e0..c13c967167 100644
--- a/migration/qemu-file.h
+++ b/migration/qemu-file.h
@@ -71,7 +71,7 @@ void qemu_file_set_error(QEMUFile *f, int ret);
 int qemu_file_shutdown(QEMUFile *f);
 QEMUFile *qemu_file_get_return_path(QEMUFile *f);
 int qemu_fflush(QEMUFile *f);
-void qemu_file_set_blocking(QEMUFile *f, bool block);
+bool qemu_file_set_blocking(QEMUFile *f, bool block, Error **errp);
 int qemu_file_get_to_fd(QEMUFile *f, int fd, size_t size);
 void qemu_set_offset(QEMUFile *f, off_t off, int whence);
 off_t qemu_get_offset(QEMUFile *f);
diff --git a/migration/savevm.c b/migration/savevm.c
index fabbeb296a..abe0547f9b 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2095,7 +2095,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
      * Because we're a thread and not a coroutine we can't yield
      * in qemu_file, and thus we must be blocking now.
      */
-    qemu_file_set_blocking(f, true);
+    qemu_file_set_blocking(f, true, &error_fatal);
 
     /* TODO: sanity check that only postcopiable data will be loaded here */
     load_res = qemu_loadvm_state_main(f, mis);
@@ -2108,7 +2108,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
     f = mis->from_src_file;
 
     /* And non-blocking again so we don't block in any cleanup */
-    qemu_file_set_blocking(f, false);
+    qemu_file_set_blocking(f, false, &error_fatal);
 
     trace_postcopy_ram_listen_thread_exit();
     if (load_res < 0) {

From 8cb17f9c36f3f92a4f653a0b369ec7ab82ccf5f0 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:55 +0300
Subject: [PATCH 0521/2396] util: drop qemu_socket_set_nonblock()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use common qemu_set_blocking() instead.

Note that pre-patch the behavior of Win32 and Linux realizations
are inconsistent: we ignore failure for Win32, and assert success
for Linux.

How do we convert the callers?

1. Most of callers call qemu_socket_set_nonblock() on a
freshly created socket fd, in conditions when we may simply
report an error. Seems correct switching to error handling
both for Windows (pre-patch error is ignored) and Linux
(pre-patch we assert success). Anyway, we normally don't
expect errors in these cases.

Still in tests let's use &error_abort for simplicity.

What are exclusions?

2. hw/virtio/vhost-user.c - we are inside #ifdef CONFIG_LINUX,
so no damage in switching to error handling from assertion.

3. io/channel-socket.c: here we convert both old calls to
qemu_socket_set_nonblock() and qemu_socket_set_block() to
one new call. Pre-patch we assert success for Linux in
qemu_socket_set_nonblock(), and ignore all other errors here.
So, for Windows switch is a bit dangerous: we may get
new errors or crashes(when error_abort is passed) in
cases where we have silently ignored the error before
(was it correct in all such cases, if they were?) Still,
there is no other way to stricter API than take
this risk.

4. util/vhost-user-server - compiled only for Linux (see
util/meson.build), so we are safe, switching from assertion to
&error_abort.

Note: In qga/channel-posix.c we use g_warning(), where g_printerr()
would actually be a better choice. Still let's for now follow
common style of qga, where g_warning() is commonly used to print
such messages, and no call to g_printerr(). Converting everything
to use g_printerr() should better be another series.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 contrib/ivshmem-server/ivshmem-server.c |  9 ++++++++-
 hw/hyperv/syndbg.c                      |  4 +++-
 hw/virtio/vhost-user.c                  |  5 ++++-
 include/qemu/sockets.h                  |  1 -
 io/channel-socket.c                     |  7 +++----
 net/dgram.c                             | 16 +++++++++++++---
 net/l2tpv3.c                            |  5 +++--
 net/socket.c                            | 20 ++++++++++++++++----
 qga/channel-posix.c                     |  7 ++++++-
 tests/unit/socket-helpers.c             |  4 +++-
 tests/unit/test-crypto-tlssession.c     |  8 ++++----
 util/oslib-posix.c                      |  7 -------
 util/oslib-win32.c                      |  5 -----
 util/vhost-user-server.c                |  6 ++++--
 14 files changed, 67 insertions(+), 37 deletions(-)

diff --git a/contrib/ivshmem-server/ivshmem-server.c b/contrib/ivshmem-server/ivshmem-server.c
index 2f3c7320a6..13cb828174 100644
--- a/contrib/ivshmem-server/ivshmem-server.c
+++ b/contrib/ivshmem-server/ivshmem-server.c
@@ -6,6 +6,7 @@
  * top-level directory.
  */
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/host-utils.h"
 #include "qemu/sockets.h"
 
@@ -135,6 +136,7 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
     socklen_t unaddr_len;
     int newfd;
     unsigned i;
+    Error *local_err = NULL;
 
     /* accept the incoming connection */
     unaddr_len = sizeof(unaddr);
@@ -146,9 +148,14 @@ ivshmem_server_handle_new_conn(IvshmemServer *server)
         return -1;
     }
 
-    qemu_socket_set_nonblock(newfd);
     IVSHMEM_SERVER_DEBUG(server, "accept()=%d\n", newfd);
 
+    if (!qemu_set_blocking(newfd, false, &local_err)) {
+        error_report_err(local_err);
+        close(newfd);
+        return -1;
+    }
+
     /* allocate new structure for this peer */
     peer = g_malloc0(sizeof(*peer));
     peer->sock_fd = newfd;
diff --git a/hw/hyperv/syndbg.c b/hw/hyperv/syndbg.c
index ac7e15f6f1..bcdfdf6af7 100644
--- a/hw/hyperv/syndbg.c
+++ b/hw/hyperv/syndbg.c
@@ -338,7 +338,9 @@ static void hv_syndbg_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    qemu_socket_set_nonblock(syndbg->socket);
+    if (!qemu_set_blocking(syndbg->socket, false, errp)) {
+        return;
+    }
 
     syndbg->servaddr.sin_port = htons(syndbg->host_port);
     syndbg->servaddr.sin_family = AF_INET;
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 1e1d6b0d6e..36c9c2e04d 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -2039,7 +2039,10 @@ static int vhost_user_postcopy_advise(struct vhost_dev *dev, Error **errp)
         error_setg(errp, "%s: Failed to get ufd", __func__);
         return -EIO;
     }
-    qemu_socket_set_nonblock(ufd);
+    if (!qemu_set_blocking(ufd, false, errp)) {
+        close(ufd);
+        return -EINVAL;
+    }
 
     /* register ufd with userfault thread */
     u->postcopy_fd.fd = ufd;
diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index c562690d89..6477f90b9e 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -48,7 +48,6 @@ int socket_set_cork(int fd, int v);
 int socket_set_nodelay(int fd);
 void qemu_socket_set_block(int fd);
 int qemu_socket_try_set_nonblock(int fd);
-void qemu_socket_set_nonblock(int fd);
 int socket_set_fast_reuse(int fd);
 
 #ifdef WIN32
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 21f8f2e0c5..f7e3cb9742 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -825,11 +825,10 @@ qio_channel_socket_set_blocking(QIOChannel *ioc,
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
 
-    if (enabled) {
-        qemu_socket_set_block(sioc->fd);
-    } else {
-        qemu_socket_set_nonblock(sioc->fd);
+    if (!qemu_set_blocking(sioc->fd, enabled, errp)) {
+        return -1;
     }
+
     return 0;
 }
 
diff --git a/net/dgram.c b/net/dgram.c
index 48f653bceb..fb9ded30df 100644
--- a/net/dgram.c
+++ b/net/dgram.c
@@ -226,7 +226,10 @@ static int net_dgram_mcast_create(struct sockaddr_in *mcastaddr,
         }
     }
 
-    qemu_socket_set_nonblock(fd);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        goto fail;
+    }
+
     return fd;
 fail:
     if (fd >= 0) {
@@ -504,7 +507,11 @@ int net_init_dgram(const Netdev *netdev, const char *name,
             close(fd);
             return -1;
         }
-        qemu_socket_set_nonblock(fd);
+
+        if (!qemu_set_blocking(fd, false, errp)) {
+            close(fd);
+            return -1;
+        }
 
         dest_len = sizeof(raddr_in);
         dest_addr = g_malloc(dest_len);
@@ -551,7 +558,10 @@ int net_init_dgram(const Netdev *netdev, const char *name,
             close(fd);
             return -1;
         }
-        qemu_socket_set_nonblock(fd);
+        if (!qemu_set_blocking(fd, false, errp)) {
+            close(fd);
+            return -1;
+        }
 
         dest_len = sizeof(raddr_un);
         dest_addr = g_malloc(dest_len);
diff --git a/net/l2tpv3.c b/net/l2tpv3.c
index b5547cb917..cdfc641aa6 100644
--- a/net/l2tpv3.c
+++ b/net/l2tpv3.c
@@ -648,6 +648,9 @@ int net_init_l2tpv3(const Netdev *netdev,
         error_setg(errp, "could not bind socket err=%i", errno);
         goto outerr;
     }
+    if (!qemu_set_blocking(fd, false, errp)) {
+        goto outerr;
+    }
 
     freeaddrinfo(result);
 
@@ -709,8 +712,6 @@ int net_init_l2tpv3(const Netdev *netdev,
     s->vec = g_new(struct iovec, MAX_L2TPV3_IOVCNT);
     s->header_buf = g_malloc(s->header_size);
 
-    qemu_socket_set_nonblock(fd);
-
     s->fd = fd;
     s->counter = 0;
 
diff --git a/net/socket.c b/net/socket.c
index 784dda686f..db25e3d9ae 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -295,7 +295,10 @@ static int net_socket_mcast_create(struct sockaddr_in *mcastaddr,
         }
     }
 
-    qemu_socket_set_nonblock(fd);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        goto fail;
+    }
+
     return fd;
 fail:
     if (fd >= 0)
@@ -508,7 +511,10 @@ static int net_socket_listen_init(NetClientState *peer,
         error_setg_errno(errp, errno, "can't create stream socket");
         return -1;
     }
-    qemu_socket_set_nonblock(fd);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
 
     socket_set_fast_reuse(fd);
 
@@ -556,7 +562,10 @@ static int net_socket_connect_init(NetClientState *peer,
         error_setg_errno(errp, errno, "can't create stream socket");
         return -1;
     }
-    qemu_socket_set_nonblock(fd);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
 
     connected = 0;
     for(;;) {
@@ -671,7 +680,10 @@ static int net_socket_udp_init(NetClientState *peer,
         close(fd);
         return -1;
     }
-    qemu_socket_set_nonblock(fd);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
 
     s = net_socket_fd_init_dgram(peer, model, name, fd, 0, NULL, errp);
     if (!s) {
diff --git a/qga/channel-posix.c b/qga/channel-posix.c
index 465d688ecb..9ccc8b7bd1 100644
--- a/qga/channel-posix.c
+++ b/qga/channel-posix.c
@@ -28,6 +28,7 @@ static gboolean ga_channel_listen_accept(GIOChannel *channel,
     GAChannel *c = data;
     int ret, client_fd;
     bool accepted = false;
+    Error *err = NULL;
 
     g_assert(channel != NULL);
 
@@ -36,7 +37,11 @@ static gboolean ga_channel_listen_accept(GIOChannel *channel,
         g_warning("error converting fd to gsocket: %s", strerror(errno));
         goto out;
     }
-    qemu_socket_set_nonblock(client_fd);
+    if (!qemu_set_blocking(client_fd, false, &err)) {
+        g_warning("%s", error_get_pretty(err));
+        error_free(err);
+        goto out;
+    }
     ret = ga_channel_client_add(c, client_fd);
     if (ret) {
         g_warning("error setting up connection");
diff --git a/tests/unit/socket-helpers.c b/tests/unit/socket-helpers.c
index 37db24f72a..46d2ff101c 100644
--- a/tests/unit/socket-helpers.c
+++ b/tests/unit/socket-helpers.c
@@ -19,6 +19,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/sockets.h"
 #include "socket-helpers.h"
 
@@ -88,7 +89,8 @@ static int socket_can_bind_connect(const char *hostname, int family)
         goto cleanup;
     }
 
-    qemu_socket_set_nonblock(cfd);
+    qemu_set_blocking(cfd, false, &error_abort);
+
     if (connect(cfd, (struct sockaddr *)&ss, sslen) < 0) {
         if (errno == EINPROGRESS) {
             check_soerr = true;
diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-tlssession.c
index 554054e934..61311cbe6e 100644
--- a/tests/unit/test-crypto-tlssession.c
+++ b/tests/unit/test-crypto-tlssession.c
@@ -112,8 +112,8 @@ static void test_crypto_tls_session_psk(void)
      * thread, so we need these non-blocking to avoid deadlock
      * of ourselves
      */
-    qemu_socket_set_nonblock(channel[0]);
-    qemu_socket_set_nonblock(channel[1]);
+    qemu_set_blocking(channel[0], false, &error_abort);
+    qemu_set_blocking(channel[1], false, &error_abort);
 
     clientCreds = test_tls_creds_psk_create(
         QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT,
@@ -264,8 +264,8 @@ static void test_crypto_tls_session_x509(const void *opaque)
      * thread, so we need these non-blocking to avoid deadlock
      * of ourselves
      */
-    qemu_socket_set_nonblock(channel[0]);
-    qemu_socket_set_nonblock(channel[1]);
+    qemu_set_blocking(channel[0], false, &error_abort);
+    qemu_set_blocking(channel[1], false, &error_abort);
 
 #define CLIENT_CERT_DIR "tests/test-crypto-tlssession-client/"
 #define SERVER_CERT_DIR "tests/test-crypto-tlssession-server/"
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index c737701075..599993d40d 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -275,13 +275,6 @@ int qemu_socket_try_set_nonblock(int fd)
     return g_unix_set_fd_nonblocking(fd, true, NULL) ? 0 : -errno;
 }
 
-void qemu_socket_set_nonblock(int fd)
-{
-    int f;
-    f = qemu_socket_try_set_nonblock(fd);
-    assert(f == 0);
-}
-
 int socket_set_fast_reuse(int fd)
 {
     int val = 1, ret;
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 03044f5b59..1566eb57e7 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -211,11 +211,6 @@ int qemu_socket_try_set_nonblock(int fd)
     return 0;
 }
 
-void qemu_socket_set_nonblock(int fd)
-{
-    (void)qemu_socket_try_set_nonblock(fd);
-}
-
 int socket_set_fast_reuse(int fd)
 {
     /* Enabling the reuse of an endpoint that was used by a socket still in
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index d805a92394..04c72a92aa 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -78,7 +78,8 @@ static void vmsg_unblock_fds(VhostUserMsg *vmsg)
     }
 
     for (i = 0; i < vmsg->fd_num; i++) {
-        qemu_socket_set_nonblock(vmsg->fds[i]);
+        /* TODO: handle error more gracefully than aborting */
+        qemu_set_blocking(vmsg->fds[i], false, &error_abort);
     }
 }
 
@@ -303,7 +304,8 @@ set_watch(VuDev *vu_dev, int fd, int vu_evt,
 
         vu_fd_watch->fd = fd;
         vu_fd_watch->cb = cb;
-        qemu_socket_set_nonblock(fd);
+        /* TODO: handle error more gracefully than aborting */
+        qemu_set_blocking(fd, false, &error_abort);
         aio_set_fd_handler(server->ctx, fd, kick_handler,
                            NULL, NULL, NULL, vu_fd_watch);
         vu_fd_watch->vu_dev = vu_dev;

From 09759245cf762d2fed4259494ec31198ac1ec0f4 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:56 +0300
Subject: [PATCH 0522/2396] util: drop qemu_socket_try_set_nonblock()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now we can use qemu_set_blocking() in these cases.

Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/qemu/sockets.h |  1 -
 net/dgram.c            | 12 +++---------
 net/socket.c           |  7 ++-----
 net/stream.c           |  9 +++------
 net/stream_data.c      | 10 ++++------
 util/oslib-posix.c     |  4 ----
 util/oslib-win32.c     |  9 ---------
 7 files changed, 12 insertions(+), 40 deletions(-)

diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index 6477f90b9e..9512fec514 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -47,7 +47,6 @@ ssize_t qemu_send_full(int s, const void *buf, size_t count)
 int socket_set_cork(int fd, int v);
 int socket_set_nodelay(int fd);
 void qemu_socket_set_block(int fd);
-int qemu_socket_try_set_nonblock(int fd);
 int socket_set_fast_reuse(int fd);
 
 #ifdef WIN32
diff --git a/net/dgram.c b/net/dgram.c
index fb9ded30df..baa126d514 100644
--- a/net/dgram.c
+++ b/net/dgram.c
@@ -287,7 +287,7 @@ static int net_dgram_mcast_init(NetClientState *peer,
                                 Error **errp)
 {
     NetDgramState *s;
-    int fd, ret;
+    int fd;
     struct sockaddr_in *saddr;
 
     if (remote->type != SOCKET_ADDRESS_TYPE_INET) {
@@ -335,11 +335,8 @@ static int net_dgram_mcast_init(NetClientState *peer,
                 g_free(saddr);
                 return -1;
             }
-            ret = qemu_socket_try_set_nonblock(fd);
-            if (ret < 0) {
+            if (!qemu_set_blocking(fd, false, errp)) {
                 g_free(saddr);
-                error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
-                                 name, fd);
                 return -1;
             }
 
@@ -572,10 +569,7 @@ int net_init_dgram(const Netdev *netdev, const char *name,
         if (fd == -1) {
             return -1;
         }
-        ret = qemu_socket_try_set_nonblock(fd);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
-                             name, fd);
+        if (!qemu_set_blocking(fd, false, errp)) {
             return -1;
         }
         dest_addr = NULL;
diff --git a/net/socket.c b/net/socket.c
index db25e3d9ae..1ad03fc9d4 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -718,7 +718,7 @@ int net_init_socket(const Netdev *netdev, const char *name,
     }
 
     if (sock->fd) {
-        int fd, ret, so_type;
+        int fd, so_type;
 
         fd = monitor_fd_param(monitor_cur(), sock->fd, errp);
         if (fd == -1) {
@@ -728,10 +728,7 @@ int net_init_socket(const Netdev *netdev, const char *name,
         if (so_type < 0) {
             return -1;
         }
-        ret = qemu_socket_try_set_nonblock(fd);
-        if (ret < 0) {
-            error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
-                             name, fd);
+        if (!qemu_set_blocking(fd, false, errp)) {
             return -1;
         }
         switch (so_type) {
diff --git a/net/stream.c b/net/stream.c
index d893f02cab..94f823a2a7 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -138,7 +138,6 @@ static void net_stream_server_listening(QIOTask *task, gpointer opaque)
     NetStreamData *d = opaque;
     QIOChannelSocket *listen_sioc = QIO_CHANNEL_SOCKET(d->listen_ioc);
     SocketAddress *addr;
-    int ret;
     Error *err = NULL;
 
     if (qio_task_propagate_error(task, &err)) {
@@ -149,13 +148,11 @@ static void net_stream_server_listening(QIOTask *task, gpointer opaque)
 
     addr = qio_channel_socket_get_local_address(listen_sioc, NULL);
     g_assert(addr != NULL);
-    ret = qemu_socket_try_set_nonblock(listen_sioc->fd);
-    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
-        qemu_set_info_str(&d->nc, "can't use file descriptor %s (errno %d)",
-                          addr->u.fd.str, -ret);
+    if (!qemu_set_blocking(listen_sioc->fd, false, &err)) {
+        qemu_set_info_str(&d->nc, "error: %s", error_get_pretty(err));
+        error_free(err);
         return;
     }
-    g_assert(ret == 0);
     qapi_free_SocketAddress(addr);
 
     d->nc.link_down = true;
diff --git a/net/stream_data.c b/net/stream_data.c
index 5af27e0d1d..03740e9f73 100644
--- a/net/stream_data.c
+++ b/net/stream_data.c
@@ -12,6 +12,7 @@
 #include "net/net.h"
 #include "io/channel.h"
 #include "io/net-listener.h"
+#include "qemu/sockets.h"
 
 #include "stream_data.h"
 
@@ -154,7 +155,6 @@ int net_stream_data_client_connected(QIOTask *task, NetStreamData *d)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(d->ioc);
     SocketAddress *addr;
-    int ret;
     Error *err = NULL;
 
     if (qio_task_propagate_error(task, &err)) {
@@ -166,14 +166,12 @@ int net_stream_data_client_connected(QIOTask *task, NetStreamData *d)
     addr = qio_channel_socket_get_remote_address(sioc, NULL);
     g_assert(addr != NULL);
 
-    ret = qemu_socket_try_set_nonblock(sioc->fd);
-    if (addr->type == SOCKET_ADDRESS_TYPE_FD && ret < 0) {
-        qemu_set_info_str(&d->nc, "can't use file descriptor %s (errno %d)",
-                          addr->u.fd.str, -ret);
+    if (!qemu_set_blocking(sioc->fd, false, &err)) {
+        qemu_set_info_str(&d->nc, "error: %s", error_get_pretty(err));
+        error_free(err);
         qapi_free_SocketAddress(addr);
         goto error;
     }
-    g_assert(ret == 0);
     qapi_free_SocketAddress(addr);
 
     net_socket_rs_init(&d->rs, net_stream_data_rs_finalize, false);
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 599993d40d..7654febfa5 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -270,10 +270,6 @@ void qemu_socket_set_block(int fd)
     g_unix_set_fd_nonblocking(fd, false, NULL);
 }
 
-int qemu_socket_try_set_nonblock(int fd)
-{
-    return g_unix_set_fd_nonblocking(fd, true, NULL) ? 0 : -errno;
-}
 
 int socket_set_fast_reuse(int fd)
 {
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 1566eb57e7..bf5d478c5c 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -202,15 +202,6 @@ void qemu_socket_set_block(int fd)
     ioctlsocket(fd, FIONBIO, &opt);
 }
 
-int qemu_socket_try_set_nonblock(int fd)
-{
-    unsigned long opt = 1;
-    if (ioctlsocket(fd, FIONBIO, &opt) != NO_ERROR) {
-        return -socket_error();
-    }
-    return 0;
-}
-
 int socket_set_fast_reuse(int fd)
 {
     /* Enabling the reuse of an endpoint that was used by a socket still in

From d14c8cc69dcd64031019da857f93ee5f6d64bb75 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:57 +0300
Subject: [PATCH 0523/2396] io/channel-socket: rework
 qio_channel_socket_copy_fds()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to switch from qemu_socket_set_block() to newer
qemu_set_blocking(), which provides return status of operation,
to handle errors.

Still, we want to keep qio_channel_socket_readv() interface clean,
as currently it allocate @fds only on success.

So, in case of error, we should close all incoming fds and keep
user's @fds untouched or zero.

Let's make separate functions qio_channel_handle_fds() and
qio_channel_cleanup_fds(), to achieve what we want.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel.h |  8 ++---
 io/channel-socket.c  | 79 ++++++++++++++++++++++++++++++++------------
 2 files changed, 61 insertions(+), 26 deletions(-)

diff --git a/include/io/channel.h b/include/io/channel.h
index 999a8f5f23..0f25ae0069 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -124,8 +124,8 @@ struct QIOChannelClass {
      * incoming fds are set BLOCKING (unless
      * QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING flag is set) and
      * CLOEXEC (if available).
-     * @fds and @nfds are set only on success path, and untouched
-     * in case of errors.
+     * @fds and @nfds are set only on success path. Still, setting
+     * @fds and @nfds to zero is acceptable on failure path.
      */
     ssize_t (*io_readv)(QIOChannel *ioc,
                         const struct iovec *iov,
@@ -246,8 +246,8 @@ void qio_channel_set_name(QIOChannel *ioc,
  * to call close() on each file descriptor and to
  * call g_free() on the array pointer in @fds.
  * @fds allocated and set (and @nfds is set too)
- * _only_ on success path. These parameters are
- * untouched in case of errors.
+ * _only_ on success path. Still, @fds and @nfds
+ * may be set to zero on failure path.
  * qio_channel_readv_full() guarantees that all
  * incoming fds are set BLOCKING (unless
  * QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING flag
diff --git a/io/channel-socket.c b/io/channel-socket.c
index f7e3cb9742..e53d9ac76f 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -464,8 +464,7 @@ static void qio_channel_socket_finalize(Object *obj)
 
 #ifndef WIN32
 static void qio_channel_socket_copy_fds(struct msghdr *msg,
-                                        int **fds, size_t *nfds,
-                                        bool preserve_blocking)
+                                        int **fds, size_t *nfds)
 {
     struct cmsghdr *cmsg;
 
@@ -473,7 +472,7 @@ static void qio_channel_socket_copy_fds(struct msghdr *msg,
     *fds = NULL;
 
     for (cmsg = CMSG_FIRSTHDR(msg); cmsg; cmsg = CMSG_NXTHDR(msg, cmsg)) {
-        int fd_size, i;
+        int fd_size;
         int gotfds;
 
         if (cmsg->cmsg_len < CMSG_LEN(sizeof(int)) ||
@@ -491,26 +490,55 @@ static void qio_channel_socket_copy_fds(struct msghdr *msg,
         gotfds = fd_size / sizeof(int);
         *fds = g_renew(int, *fds, *nfds + gotfds);
         memcpy(*fds + *nfds, CMSG_DATA(cmsg), fd_size);
-
-        for (i = 0; i < gotfds; i++) {
-            int fd = (*fds)[*nfds + i];
-            if (fd < 0) {
-                continue;
-            }
-
-            if (!preserve_blocking) {
-                /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
-                qemu_socket_set_block(fd);
-            }
-
-#ifndef MSG_CMSG_CLOEXEC
-            qemu_set_cloexec(fd);
-#endif
-        }
         *nfds += gotfds;
     }
 }
 
+static bool qio_channel_handle_fds(int *fds, size_t nfds,
+                                   bool preserve_blocking, Error **errp)
+{
+    int *end = fds + nfds, *fd;
+
+#ifdef MSG_CMSG_CLOEXEC
+    if (preserve_blocking) {
+        /* Nothing to do */
+        return true;
+    }
+#endif
+
+    for (fd = fds; fd != end; fd++) {
+        if (*fd < 0) {
+            continue;
+        }
+
+        if (!preserve_blocking) {
+            /* O_NONBLOCK is preserved across SCM_RIGHTS so reset it */
+            if (!qemu_set_blocking(*fd, true, errp)) {
+                return false;
+            }
+        }
+
+#ifndef MSG_CMSG_CLOEXEC
+        qemu_set_cloexec(*fd);
+#endif
+    }
+
+    return true;
+}
+
+static void qio_channel_cleanup_fds(int **fds, size_t *nfds)
+{
+    for (size_t i = 0; i < *nfds; i++) {
+        if ((*fds)[i] < 0) {
+            continue;
+        }
+        close((*fds)[i]);
+    }
+
+    g_clear_pointer(fds, g_free);
+    *nfds = 0;
+}
+
 
 static ssize_t qio_channel_socket_readv(QIOChannel *ioc,
                                         const struct iovec *iov,
@@ -559,9 +587,16 @@ static ssize_t qio_channel_socket_readv(QIOChannel *ioc,
     }
 
     if (fds && nfds) {
-        qio_channel_socket_copy_fds(
-            &msg, fds, nfds,
-            flags & QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING);
+        bool preserve_blocking =
+            flags & QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING;
+
+        qio_channel_socket_copy_fds(&msg, fds, nfds);
+
+        if (!qio_channel_handle_fds(*fds, *nfds,
+                                    preserve_blocking, errp)) {
+            qio_channel_cleanup_fds(fds, nfds);
+            return -1;
+        }
     }
 
     return ret;

From 5d1d32ce9d26a7cdc1c60dceb1b0c55ff9ad9b3e Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:58 +0300
Subject: [PATCH 0524/2396] util: drop qemu_socket_set_block()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now it's unused.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/qemu/sockets.h | 1 -
 util/oslib-posix.c     | 6 ------
 util/oslib-win32.c     | 7 -------
 3 files changed, 14 deletions(-)

diff --git a/include/qemu/sockets.h b/include/qemu/sockets.h
index 9512fec514..be351d85f7 100644
--- a/include/qemu/sockets.h
+++ b/include/qemu/sockets.h
@@ -46,7 +46,6 @@ ssize_t qemu_send_full(int s, const void *buf, size_t count)
     G_GNUC_WARN_UNUSED_RESULT;
 int socket_set_cork(int fd, int v);
 int socket_set_nodelay(int fd);
-void qemu_socket_set_block(int fd);
 int socket_set_fast_reuse(int fd);
 
 #ifdef WIN32
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 7654febfa5..14cf94ac03 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -265,12 +265,6 @@ bool qemu_set_blocking(int fd, bool block, Error **errp)
     return true;
 }
 
-void qemu_socket_set_block(int fd)
-{
-    g_unix_set_fd_nonblocking(fd, false, NULL);
-}
-
-
 int socket_set_fast_reuse(int fd)
 {
     int val = 1, ret;
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index bf5d478c5c..b9ce2f96ee 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -195,13 +195,6 @@ bool qemu_set_blocking(int fd, bool block, Error **errp)
     return true;
 }
 
-void qemu_socket_set_block(int fd)
-{
-    unsigned long opt = 0;
-    qemu_socket_unselect(fd, NULL);
-    ioctlsocket(fd, FIONBIO, &opt);
-}
-
 int socket_set_fast_reuse(int fd)
 {
     /* Enabling the reuse of an endpoint that was used by a socket still in

From 6f607941b1c01679d6d3dca036ddd23bbe95a44c Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:13:59 +0300
Subject: [PATCH 0525/2396] treewide: use qemu_set_blocking instead of
 g_unix_set_fd_nonblocking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of open-coded g_unix_set_fd_nonblocking() calls, use
QEMU wrapper qemu_set_blocking().

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
[DB: fix missing closing ) in tap-bsd.c, remove now unused GError var]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-fd.c                  |  4 ++--
 chardev/char-pty.c                 |  3 +--
 chardev/char-serial.c              |  3 +--
 chardev/char-stdio.c               |  3 +--
 hw/input/virtio-input-host.c       |  3 +--
 hw/misc/ivshmem-flat.c             |  3 ++-
 hw/misc/ivshmem-pci.c              |  7 ++++++-
 hw/virtio/vhost-vsock.c            |  8 ++------
 io/channel-command.c               |  9 ++++++---
 io/channel-file.c                  |  3 +--
 net/tap-bsd.c                      | 12 ++++++++++--
 net/tap-linux.c                    |  7 ++++++-
 net/tap-solaris.c                  |  7 ++++++-
 net/tap.c                          | 21 ++++++---------------
 qga/commands-posix.c               |  3 +--
 tests/qtest/fuzz/virtio_net_fuzz.c |  2 +-
 tests/qtest/vhost-user-test.c      |  4 +---
 tests/unit/test-iov.c              |  5 +++--
 ui/input-linux.c                   |  3 +--
 util/event_notifier-posix.c        |  7 +++++--
 util/main-loop.c                   |  5 ++++-
 21 files changed, 67 insertions(+), 55 deletions(-)

diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 6f03adf872..739dc68c36 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -212,8 +212,8 @@ void qemu_chr_open_fd(Chardev *chr,
     FDChardev *s = FD_CHARDEV(chr);
     g_autofree char *name = NULL;
 
-    if (fd_out >= 0 && !g_unix_set_fd_nonblocking(fd_out, true, NULL)) {
-        assert(!"Failed to set FD nonblocking");
+    if (fd_out >= 0) {
+        qemu_set_blocking(fd_out, false, &error_abort);
     }
 
     if (fd_out == fd_in && fd_in >= 0) {
diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index 674e9b3f14..fe6bfb043d 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -349,8 +349,7 @@ static void char_pty_open(Chardev *chr,
     }
 
     close(slave_fd);
-    if (!g_unix_set_fd_nonblocking(master_fd, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(master_fd, false, errp)) {
         return;
     }
 
diff --git a/chardev/char-serial.c b/chardev/char-serial.c
index 0a68b4b4e0..1ff31dcde3 100644
--- a/chardev/char-serial.c
+++ b/chardev/char-serial.c
@@ -271,8 +271,7 @@ static void qmp_chardev_open_serial(Chardev *chr,
     if (fd < 0) {
         return;
     }
-    if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(fd, false, errp)) {
         return;
     }
     tty_serial_init(fd, 115200, 'N', 8, 1);
diff --git a/chardev/char-stdio.c b/chardev/char-stdio.c
index 48db8d2f30..193727e807 100644
--- a/chardev/char-stdio.c
+++ b/chardev/char-stdio.c
@@ -107,8 +107,7 @@ static void qemu_chr_open_stdio(Chardev *chr,
     old_fd0_flags = fcntl(0, F_GETFL);
     old_fd1_flags = fcntl(1, F_GETFL);
     tcgetattr(0, &oldtty);
-    if (!g_unix_set_fd_nonblocking(0, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(0, false, errp)) {
         return;
     }
     atexit(term_exit);
diff --git a/hw/input/virtio-input-host.c b/hw/input/virtio-input-host.c
index bbfee9d3b9..9f62532559 100644
--- a/hw/input/virtio-input-host.c
+++ b/hw/input/virtio-input-host.c
@@ -114,8 +114,7 @@ static void virtio_input_host_realize(DeviceState *dev, Error **errp)
         error_setg_file_open(errp, errno, vih->evdev);
         return;
     }
-    if (!g_unix_set_fd_nonblocking(vih->fd, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(vih->fd, false, errp)) {
         goto err_close;
     }
 
diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index fe4be6be17..e83e6c6ee9 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -154,7 +154,8 @@ static void ivshmem_flat_add_vector(IvshmemFTState *s, IvshmemPeer *peer,
      * peer.
      */
     peer->vector[peer->vector_counter].id = peer->vector_counter;
-    g_unix_set_fd_nonblocking(vector_fd, true, NULL);
+    /* WARNING: qemu_socket_set_nonblock() return code ignored */
+    qemu_set_blocking(vector_fd, false, &error_warn);
     event_notifier_init_fd(&peer->vector[peer->vector_counter].event_notifier,
                            vector_fd);
 
diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index d47ae739d6..2748db9286 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -540,7 +540,12 @@ static void process_msg_connect(IVShmemState *s, uint16_t posn, int fd,
 
     IVSHMEM_DPRINTF("eventfds[%d][%d] = %d\n", posn, vector, fd);
     event_notifier_init_fd(&peer->eventfds[vector], fd);
-    g_unix_set_fd_nonblocking(fd, true, NULL); /* msix/irqfd poll non block */
+
+    /* msix/irqfd poll non block */
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return;
+    }
 
     if (posn == s->vm_id) {
         setup_interrupt(s, vector, errp);
diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index 6e4088831f..107d88babe 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -147,9 +147,7 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
             return;
         }
 
-        if (!g_unix_set_fd_nonblocking(vhostfd, true, NULL)) {
-            error_setg_errno(errp, errno,
-                             "vhost-vsock: unable to set non-blocking mode");
+        if (!qemu_set_blocking(vhostfd, false, errp)) {
             return;
         }
     } else {
@@ -160,9 +158,7 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
             return;
         }
 
-        if (!g_unix_set_fd_nonblocking(vhostfd, true, NULL)) {
-            error_setg_errno(errp, errno,
-                             "Failed to set FD nonblocking");
+        if (!qemu_set_blocking(vhostfd, false, errp)) {
             return;
         }
     }
diff --git a/io/channel-command.c b/io/channel-command.c
index 8966dd3a2b..8ae9a026b3 100644
--- a/io/channel-command.c
+++ b/io/channel-command.c
@@ -277,9 +277,12 @@ static int qio_channel_command_set_blocking(QIOChannel *ioc,
     cioc->blocking = enabled;
 #else
 
-    if ((cioc->writefd >= 0 && !g_unix_set_fd_nonblocking(cioc->writefd, !enabled, NULL)) ||
-        (cioc->readfd >= 0 && !g_unix_set_fd_nonblocking(cioc->readfd, !enabled, NULL))) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (cioc->writefd >= 0 &&
+        !qemu_set_blocking(cioc->writefd, enabled, errp)) {
+        return -1;
+    }
+    if (cioc->readfd >= 0 &&
+        !qemu_set_blocking(cioc->readfd, enabled, errp)) {
         return -1;
     }
 #endif
diff --git a/io/channel-file.c b/io/channel-file.c
index ca3f180cc2..5cef75a67c 100644
--- a/io/channel-file.c
+++ b/io/channel-file.c
@@ -223,8 +223,7 @@ static int qio_channel_file_set_blocking(QIOChannel *ioc,
 #else
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(ioc);
 
-    if (!g_unix_set_fd_nonblocking(fioc->fd, !enabled, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(fioc->fd, enabled, errp)) {
         return -1;
     }
     return 0;
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index b4c84441ba..3f98d0ea82 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -98,7 +98,12 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
             return -1;
         }
     }
-    g_unix_set_fd_nonblocking(fd, true, NULL);
+
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
+
     return fd;
 }
 
@@ -189,7 +194,10 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
         goto error;
     }
 
-    g_unix_set_fd_nonblocking(fd, true, NULL);
+    if (!qemu_set_blocking(fd, false, errp)) {
+        goto error;
+    }
+
     return fd;
 
 error:
diff --git a/net/tap-linux.c b/net/tap-linux.c
index 22ec2f45d2..e832810665 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -124,7 +124,12 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
         return -1;
     }
     pstrcpy(ifname, ifname_size, ifr.ifr_name);
-    g_unix_set_fd_nonblocking(fd, true, NULL);
+
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
+
     return fd;
 }
 
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index 51b7830bef..af2ebb16f5 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -198,7 +198,12 @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
             return -1;
         }
     }
-    g_unix_set_fd_nonblocking(fd, true, NULL);
+
+    if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
+        return -1;
+    }
+
     return fd;
 }
 
diff --git a/net/tap.c b/net/tap.c
index f7df702f97..f37133e301 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -627,8 +627,7 @@ int net_init_bridge(const Netdev *netdev, const char *name,
         return -1;
     }
 
-    if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(fd, false, errp)) {
         return -1;
     }
     vnet_hdr = tap_probe_vnet_hdr(fd, errp);
@@ -729,9 +728,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
                 error_propagate(errp, err);
                 goto failed;
             }
-            if (!g_unix_set_fd_nonblocking(vhostfd, true, NULL)) {
-                error_setg_errno(errp, errno, "%s: Can't use file descriptor %d",
-                                 name, fd);
+            if (!qemu_set_blocking(vhostfd, false, errp)) {
                 goto failed;
             }
         } else {
@@ -741,8 +738,7 @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
                                  "tap: open vhost char device failed");
                 goto failed;
             }
-            if (!g_unix_set_fd_nonblocking(vhostfd, true, NULL)) {
-                error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+            if (!qemu_set_blocking(vhostfd, false, errp)) {
                 goto failed;
             }
         }
@@ -839,9 +835,7 @@ int net_init_tap(const Netdev *netdev, const char *name,
             return -1;
         }
 
-        if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
-            error_setg_errno(errp, errno, "%s: Can't use file descriptor %d",
-                             name, fd);
+        if (!qemu_set_blocking(fd, false, errp)) {
             close(fd);
             return -1;
         }
@@ -895,10 +889,8 @@ int net_init_tap(const Netdev *netdev, const char *name,
                 goto free_fail;
             }
 
-            if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
+            if (!qemu_set_blocking(fd, false, errp)) {
                 ret = -1;
-                error_setg_errno(errp, errno, "%s: Can't use file descriptor %d",
-                                 name, fd);
                 goto free_fail;
             }
 
@@ -951,8 +943,7 @@ free_fail:
             return -1;
         }
 
-        if (!g_unix_set_fd_nonblocking(fd, true, NULL)) {
-            error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+        if (!qemu_set_blocking(fd, false, errp)) {
             return -1;
         }
         vnet_hdr = tap_probe_vnet_hdr(fd, errp);
diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 12bc086d79..5070f27d75 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -503,9 +503,8 @@ int64_t qmp_guest_file_open(const char *path, const char *mode,
     /* set fd non-blocking to avoid common use cases (like reading from a
      * named pipe) from hanging the agent
      */
-    if (!g_unix_set_fd_nonblocking(fileno(fh), true, NULL)) {
+    if (!qemu_set_blocking(fileno(fh), false, errp)) {
         fclose(fh);
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
         return -1;
     }
 
diff --git a/tests/qtest/fuzz/virtio_net_fuzz.c b/tests/qtest/fuzz/virtio_net_fuzz.c
index e239875e3b..e9b13d3e4f 100644
--- a/tests/qtest/fuzz/virtio_net_fuzz.c
+++ b/tests/qtest/fuzz/virtio_net_fuzz.c
@@ -132,7 +132,7 @@ static void *virtio_net_test_setup_socket(GString *cmd_line, void *arg)
 {
     int ret = socketpair(PF_UNIX, SOCK_STREAM, 0, sockfds);
     g_assert_cmpint(ret, !=, -1);
-    g_unix_set_fd_nonblocking(sockfds[0], true, NULL);
+    qemu_set_blocking(sockfds[0], false, &error_abort);
     sockfds_initialized = true;
     g_string_append_printf(cmd_line, " -netdev socket,fd=%d,id=hs0 ",
                            sockfds[1]);
diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index 56472ca709..6ec4ec2d5a 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -330,7 +330,6 @@ static int chr_can_read(void *opaque)
 
 static void chr_read(void *opaque, const uint8_t *buf, int size)
 {
-    g_autoptr(GError) err = NULL;
     TestServer *s = opaque;
     CharBackend *chr = &s->chr;
     VhostUserMsg msg;
@@ -471,8 +470,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * The receive function forces it to be blocking,
          * so revert it back to non-blocking.
          */
-        g_unix_set_fd_nonblocking(fd, true, &err);
-        g_assert_no_error(err);
+        qemu_set_blocking(fd, false, &error_abort);
         break;
 
     case VHOST_USER_SET_LOG_BASE:
diff --git a/tests/unit/test-iov.c b/tests/unit/test-iov.c
index 75bc3be005..63e2b1583c 100644
--- a/tests/unit/test-iov.c
+++ b/tests/unit/test-iov.c
@@ -1,4 +1,5 @@
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/iov.h"
 #include "qemu/sockets.h"
 
@@ -186,7 +187,7 @@ static void test_io(void)
 
        close(sv[0]);
        FD_SET(sv[1], &fds);
-       g_unix_set_fd_nonblocking(sv[1], true, NULL);
+       qemu_set_blocking(sv[1], false, &error_abort);
        r = g_test_rand_int_range(sz / 2, sz);
        setsockopt(sv[1], SOL_SOCKET, SO_SNDBUF, &r, sizeof(r));
 
@@ -222,7 +223,7 @@ static void test_io(void)
 
        close(sv[1]);
        FD_SET(sv[0], &fds);
-       g_unix_set_fd_nonblocking(sv[0], true, NULL);
+       qemu_set_blocking(sv[0], false, &error_abort);
        r = g_test_rand_int_range(sz / 2, sz);
        setsockopt(sv[0], SOL_SOCKET, SO_RCVBUF, &r, sizeof(r));
        usleep(500000);
diff --git a/ui/input-linux.c b/ui/input-linux.c
index 92e1a1aa64..44d0c15a9b 100644
--- a/ui/input-linux.c
+++ b/ui/input-linux.c
@@ -316,8 +316,7 @@ static void input_linux_complete(UserCreatable *uc, Error **errp)
         error_setg_file_open(errp, errno, il->evdev);
         return;
     }
-    if (!g_unix_set_fd_nonblocking(il->fd, true, NULL)) {
-        error_setg_errno(errp, errno, "Failed to set FD nonblocking");
+    if (!qemu_set_blocking(il->fd, false, errp)) {
         return;
     }
 
diff --git a/util/event_notifier-posix.c b/util/event_notifier-posix.c
index 76420c5b56..83fdbb96bb 100644
--- a/util/event_notifier-posix.c
+++ b/util/event_notifier-posix.c
@@ -11,6 +11,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/event_notifier.h"
 #include "qemu/main-loop.h"
@@ -36,6 +37,7 @@ int event_notifier_init(EventNotifier *e, int active)
 {
     int fds[2];
     int ret;
+    Error *local_err = NULL;
 
 #ifdef CONFIG_EVENTFD
     ret = eventfd(0, EFD_NONBLOCK | EFD_CLOEXEC);
@@ -52,11 +54,11 @@ int event_notifier_init(EventNotifier *e, int active)
         if (!g_unix_open_pipe(fds, FD_CLOEXEC, NULL)) {
             return -errno;
         }
-        if (!g_unix_set_fd_nonblocking(fds[0], true, NULL)) {
+        if (!qemu_set_blocking(fds[0], false, &local_err)) {
             ret = -errno;
             goto fail;
         }
-        if (!g_unix_set_fd_nonblocking(fds[1], true, NULL)) {
+        if (!qemu_set_blocking(fds[1], false, &local_err)) {
             ret = -errno;
             goto fail;
         }
@@ -70,6 +72,7 @@ int event_notifier_init(EventNotifier *e, int active)
     return 0;
 
 fail:
+    error_report_err(local_err);
     close(fds[0]);
     close(fds[1]);
     return ret;
diff --git a/util/main-loop.c b/util/main-loop.c
index 51aeb2432e..b8ddda8f5e 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -114,7 +114,10 @@ static int qemu_signal_init(Error **errp)
         return -errno;
     }
 
-    g_unix_set_fd_nonblocking(sigfd, true, NULL);
+    if (!qemu_set_blocking(sigfd, false, errp)) {
+        close(sigfd);
+        return -EINVAL;
+    }
 
     qemu_set_fd_handler(sigfd, sigfd_handler, NULL, (void *)(intptr_t)sigfd);
 

From 69620c091d62f3a7016469c83b9064258524891d Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:14:00 +0300
Subject: [PATCH 0526/2396] chardev: qemu_chr_open_fd(): add errp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Every caller already support errp, let's go further.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-fd.c         | 12 ++++++++----
 chardev/char-file.c       |  6 +++++-
 chardev/char-pipe.c       |  9 ++++++++-
 chardev/char-serial.c     |  5 ++++-
 chardev/char-stdio.c      |  7 +++++--
 include/chardev/char-fd.h |  2 +-
 6 files changed, 31 insertions(+), 10 deletions(-)

diff --git a/chardev/char-fd.c b/chardev/char-fd.c
index 739dc68c36..4ee286f323 100644
--- a/chardev/char-fd.c
+++ b/chardev/char-fd.c
@@ -206,14 +206,16 @@ int qmp_chardev_open_file_source(char *src, int flags, Error **errp)
 }
 
 /* open a character device to a unix fd */
-void qemu_chr_open_fd(Chardev *chr,
-                      int fd_in, int fd_out)
+bool qemu_chr_open_fd(Chardev *chr,
+                      int fd_in, int fd_out, Error **errp)
 {
     FDChardev *s = FD_CHARDEV(chr);
     g_autofree char *name = NULL;
 
     if (fd_out >= 0) {
-        qemu_set_blocking(fd_out, false, &error_abort);
+        if (!qemu_set_blocking(fd_out, false, errp)) {
+            return false;
+        }
     }
 
     if (fd_out == fd_in && fd_in >= 0) {
@@ -221,7 +223,7 @@ void qemu_chr_open_fd(Chardev *chr,
         name = g_strdup_printf("chardev-file-%s", chr->label);
         qio_channel_set_name(QIO_CHANNEL(s->ioc_in), name);
         s->ioc_out = QIO_CHANNEL(object_ref(s->ioc_in));
-        return;
+        return true;
     }
 
     if (fd_in >= 0) {
@@ -236,6 +238,8 @@ void qemu_chr_open_fd(Chardev *chr,
         name = g_strdup_printf("chardev-file-out-%s", chr->label);
         qio_channel_set_name(QIO_CHANNEL(s->ioc_out), name);
     }
+
+    return true;
 }
 
 static void char_fd_class_init(ObjectClass *oc, const void *data)
diff --git a/chardev/char-file.c b/chardev/char-file.c
index a9e8c5e0d7..89e9cb849c 100644
--- a/chardev/char-file.c
+++ b/chardev/char-file.c
@@ -92,7 +92,11 @@ static void qmp_chardev_open_file(Chardev *chr,
         }
     }
 
-    qemu_chr_open_fd(chr, in, out);
+    if (!qemu_chr_open_fd(chr, in, out, errp)) {
+        qemu_close(out);
+        qemu_close(in);
+        return;
+    }
 #endif
 }
 
diff --git a/chardev/char-pipe.c b/chardev/char-pipe.c
index 3d1b0ce2d2..e9f3bb8290 100644
--- a/chardev/char-pipe.c
+++ b/chardev/char-pipe.c
@@ -150,7 +150,14 @@ static void qemu_chr_open_pipe(Chardev *chr,
             return;
         }
     }
-    qemu_chr_open_fd(chr, fd_in, fd_out);
+
+    if (!qemu_chr_open_fd(chr, fd_in, fd_out, errp)) {
+        close(fd_in);
+        if (fd_out != fd_in) {
+            close(fd_out);
+        }
+        return;
+    }
 }
 
 #endif /* !_WIN32 */
diff --git a/chardev/char-serial.c b/chardev/char-serial.c
index 1ff31dcde3..c622d758db 100644
--- a/chardev/char-serial.c
+++ b/chardev/char-serial.c
@@ -276,7 +276,10 @@ static void qmp_chardev_open_serial(Chardev *chr,
     }
     tty_serial_init(fd, 115200, 'N', 8, 1);
 
-    qemu_chr_open_fd(chr, fd, fd);
+    if (!qemu_chr_open_fd(chr, fd, fd, errp)) {
+        close(fd);
+        return;
+    }
 }
 #endif /* __linux__ || __sun__ */
 
diff --git a/chardev/char-stdio.c b/chardev/char-stdio.c
index 193727e807..2568164a10 100644
--- a/chardev/char-stdio.c
+++ b/chardev/char-stdio.c
@@ -110,14 +110,17 @@ static void qemu_chr_open_stdio(Chardev *chr,
     if (!qemu_set_blocking(0, false, errp)) {
         return;
     }
+
+    if (!qemu_chr_open_fd(chr, 0, 1, errp)) {
+        return;
+    }
+
     atexit(term_exit);
 
     memset(&act, 0, sizeof(act));
     act.sa_handler = term_stdio_handler;
     sigaction(SIGCONT, &act, NULL);
 
-    qemu_chr_open_fd(chr, 0, 1);
-
     stdio_allow_signal = !opts->has_signal || opts->signal;
     qemu_chr_set_echo_stdio(chr, false);
 }
diff --git a/include/chardev/char-fd.h b/include/chardev/char-fd.h
index 9de0e440de..6fe43062ca 100644
--- a/include/chardev/char-fd.h
+++ b/include/chardev/char-fd.h
@@ -41,7 +41,7 @@ typedef struct FDChardev FDChardev;
 DECLARE_INSTANCE_CHECKER(FDChardev, FD_CHARDEV,
                          TYPE_CHARDEV_FD)
 
-void qemu_chr_open_fd(Chardev *chr, int fd_in, int fd_out);
+bool qemu_chr_open_fd(Chardev *chr, int fd_in, int fd_out, Error **errp);
 int qmp_chardev_open_file_source(char *src, int flags, Error **errp);
 
 #endif /* CHAR_FD_H */

From 30b123acbb89bff8ce7e46f9eef8ad01c2f173c6 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:14:01 +0300
Subject: [PATCH 0527/2396] chardev: close an fd on failure path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are at least two failure paths, where we forget
to close an fd.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-pty.c    | 1 +
 chardev/char-serial.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index fe6bfb043d..b066f01412 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -350,6 +350,7 @@ static void char_pty_open(Chardev *chr,
 
     close(slave_fd);
     if (!qemu_set_blocking(master_fd, false, errp)) {
+        close(master_fd);
         return;
     }
 
diff --git a/chardev/char-serial.c b/chardev/char-serial.c
index c622d758db..4c6ca713eb 100644
--- a/chardev/char-serial.c
+++ b/chardev/char-serial.c
@@ -272,6 +272,7 @@ static void qmp_chardev_open_serial(Chardev *chr,
         return;
     }
     if (!qemu_set_blocking(fd, false, errp)) {
+        close(fd);
         return;
     }
     tty_serial_init(fd, 115200, 'N', 8, 1);

From 34523df31962401871ff091a9d0993ac87a9848a Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 16 Sep 2025 16:14:02 +0300
Subject: [PATCH 0528/2396] util/vhost-user-server: vu_message_read(): improve
 error handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. Drop extra error_report_err(NULL), it will just crash, if we get
here.

2. Get and report error of qemu_set_blocking(), instead of aborting.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 util/vhost-user-server.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index 04c72a92aa..1dbe409f82 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -62,7 +62,7 @@ static void vmsg_close_fds(VhostUserMsg *vmsg)
     }
 }
 
-static void vmsg_unblock_fds(VhostUserMsg *vmsg)
+static bool vmsg_unblock_fds(VhostUserMsg *vmsg, Error **errp)
 {
     int i;
 
@@ -74,13 +74,16 @@ static void vmsg_unblock_fds(VhostUserMsg *vmsg)
      */
     if (vmsg->request == VHOST_USER_ADD_MEM_REG ||
         vmsg->request == VHOST_USER_SET_MEM_TABLE) {
-        return;
+        return true;
     }
 
     for (i = 0; i < vmsg->fd_num; i++) {
-        /* TODO: handle error more gracefully than aborting */
-        qemu_set_blocking(vmsg->fds[i], false, &error_abort);
+        if (!qemu_set_blocking(vmsg->fds[i], false, errp)) {
+            return false;
+        }
     }
+
+    return true;
 }
 
 static void panic_cb(VuDev *vu_dev, const char *buf)
@@ -123,7 +126,6 @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
 
     vmsg->fd_num = 0;
     if (!ioc) {
-        error_report_err(local_err);
         goto fail;
     }
 
@@ -177,7 +179,10 @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
     } while (read_bytes != VHOST_USER_HDR_SIZE);
 
     /* qio_channel_readv_full will make socket fds blocking, unblock them */
-    vmsg_unblock_fds(vmsg);
+    if (!vmsg_unblock_fds(vmsg, &local_err)) {
+        error_report_err(local_err);
+        goto fail;
+    }
     if (vmsg->size > sizeof(vmsg->payload)) {
         error_report("Error: too big message request: %d, "
                      "size: vmsg->size: %u, "

From fcbe1080a4cb16767cdda788504f9793cbbe0532 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 09:35:44 +0200
Subject: [PATCH 0529/2396] docs: use the pyvenv version of Meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The version in the system might be too old for QEMU; this will be
especially true if Rust is going to be enabled by default.

Adjust the docs to suggest using pyvenv/bin/meson, which is in fact
what the "make" wrappers will be running internally.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/build-system.rst | 2 +-
 docs/devel/rust.rst         | 2 +-
 docs/system/devices/igb.rst | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/docs/devel/build-system.rst b/docs/devel/build-system.rst
index 2c884197a2..6204aa6a72 100644
--- a/docs/devel/build-system.rst
+++ b/docs/devel/build-system.rst
@@ -450,7 +450,7 @@ are run with ``make bench``.  Meson test suites such as ``unit`` can be ran
 with ``make check-unit``, and ``make check-tcg`` builds and runs "non-Meson"
 tests for all targets.
 
-If desired, it is also possible to use ``ninja`` and ``meson test``,
+If desired, it is also possible to use ``ninja`` and ``pyvenv/bin/meson test``,
 respectively to build emulators and run tests defined in meson.build.
 The main difference is that ``make`` needs the ``-jN`` flag in order to
 enable parallel builds or tests.
diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 13a20e86a1..2f0ab2e282 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -66,7 +66,7 @@ __ https://mesonbuild.com/Commands.html#devenv
 As shown above, you can use the ``--tests`` option as usual to operate on test
 code.  Note however that you cannot *build* or run tests via ``cargo``, because
 they need support C code from QEMU that Cargo does not know about.  Tests can
-be run via ``meson test`` or ``make``::
+be run via Meson (``pyvenv/bin/meson test``) or ``make``::
 
    make check-rust
 
diff --git a/docs/system/devices/igb.rst b/docs/system/devices/igb.rst
index 71f31cb116..50f625fd77 100644
--- a/docs/system/devices/igb.rst
+++ b/docs/system/devices/igb.rst
@@ -54,7 +54,7 @@ directory:
 
 .. code-block:: shell
 
-  meson test qtest-x86_64/qos-test
+  pyvenv/bin/meson test qtest-x86_64/qos-test
 
 ethtool can test register accesses, interrupts, etc. It is automated as an
 functional test and can be run from the build directory with the following

From b9e8bb6637d5f2926121d68e4f227ba0e0a44186 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 10:23:58 +0200
Subject: [PATCH 0530/2396] rust: build: add back common and util tests

These were dropped by mistake when extracting the crates.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/common/meson.build | 3 +++
 rust/util/meson.build   | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/rust/common/meson.build b/rust/common/meson.build
index b805e0faf5..07d073182e 100644
--- a/rust/common/meson.build
+++ b/rust/common/meson.build
@@ -24,6 +24,9 @@ _common_rs = static_library(
 
 common_rs = declare_dependency(link_with: [_common_rs])
 
+rust.test('rust-common-tests', _common_rs,
+          suite: ['unit', 'rust'])
+
 # Doctests are essentially integration tests, so they need the same dependencies.
 # Note that running them requires the object files for C code, so place them
 # in a separate suite that is run by the "build" CI jobs rather than "check".
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 87a893673d..9633050445 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -44,6 +44,10 @@ _util_rs = static_library(
 
 util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
 
+rust.test('rust-util-tests', _util_rs,
+          dependencies: [qemuutil, qom],
+          suite: ['unit', 'rust'])
+
 # Doctests are essentially integration tests, so they need the same dependencies.
 # Note that running them requires the object files for C code, so place them
 # in a separate suite that is run by the "build" CI jobs rather than "check".

From 75dbe618ac3895b2889a590de3bc589bf32dc999 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 17 Sep 2025 12:40:29 +0200
Subject: [PATCH 0531/2396] rust: vmstate: use "cast()" instead of "as"

Reported by clippy, fix it.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index c05c4a1fd6..e04b19b3c9 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -144,7 +144,7 @@ macro_rules! vmstate_of {
         $crate::bindings::VMStateField {
             name: ::core::concat!(::core::stringify!($field_name), "\0")
                 .as_bytes()
-                .as_ptr() as *const ::std::os::raw::c_char,
+                .as_ptr().cast::<::std::os::raw::c_char>(),
             offset: ::std::mem::offset_of!($struct_name, $field_name),
             $(num_offset: ::std::mem::offset_of!($struct_name, $num),)?
             $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?

From f87a2e5c596620a606aaa7df4257c45c4988e160 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 12:16:25 +0200
Subject: [PATCH 0532/2396] rust: build: remove "protocol: rust: from doctests

It is added already by rust.doctest.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/bql/meson.build       | 1 -
 rust/common/meson.build    | 1 -
 rust/migration/meson.build | 1 -
 rust/qom/meson.build       | 1 -
 rust/util/meson.build      | 1 -
 5 files changed, 5 deletions(-)

diff --git a/rust/bql/meson.build b/rust/bql/meson.build
index f369209dfd..7214d94408 100644
--- a/rust/bql/meson.build
+++ b/rust/bql/meson.build
@@ -47,6 +47,5 @@ bql_rs = declare_dependency(link_with: [_bql_rs],
 # in a separate suite that is run by the "build" CI jobs rather than "check".
 rust.doctest('rust-bql-rs-doctests',
      _bql_rs,
-     protocol: 'rust',
      dependencies: bql_rs,
      suite: ['doc', 'rust'])
diff --git a/rust/common/meson.build b/rust/common/meson.build
index 07d073182e..aff601d1df 100644
--- a/rust/common/meson.build
+++ b/rust/common/meson.build
@@ -32,6 +32,5 @@ rust.test('rust-common-tests', _common_rs,
 # in a separate suite that is run by the "build" CI jobs rather than "check".
 rust.doctest('rust-common-doctests',
      _common_rs,
-     protocol: 'rust',
      dependencies: common_rs,
      suite: ['doc', 'rust'])
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index 5e820d43f5..2a49bd1633 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -48,6 +48,5 @@ migration_rs = declare_dependency(link_with: [_migration_rs],
 # in a separate suite that is run by the "build" CI jobs rather than "check".
 rust.doctest('rust-migration-rs-doctests',
      _migration_rs,
-     protocol: 'rust',
      dependencies: migration_rs,
      suite: ['doc', 'rust'])
diff --git a/rust/qom/meson.build b/rust/qom/meson.build
index 40c51b71b2..21e12148da 100644
--- a/rust/qom/meson.build
+++ b/rust/qom/meson.build
@@ -38,6 +38,5 @@ qom_rs = declare_dependency(link_with: [_qom_rs], dependencies: [qemu_macros, qo
 # in a separate suite that is run by the "build" CI jobs rather than "check".
 rust.doctest('rust-qom-rs-doctests',
      _qom_rs,
-     protocol: 'rust',
      dependencies: qom_rs,
      suite: ['doc', 'rust'])
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 9633050445..7ca69939ce 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -53,7 +53,6 @@ rust.test('rust-util-tests', _util_rs,
 # in a separate suite that is run by the "build" CI jobs rather than "check".
 rust.doctest('rust-util-rs-doctests',
      _util_rs,
-     protocol: 'rust',
      dependencies: util_rs,
      suite: ['doc', 'rust']
 )

From 193f2ab6e076f0f3d07081802bee2d36eb86086f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 17 Jul 2025 08:02:15 +0200
Subject: [PATCH 0533/2396] subprojects: add attrs crate

The attrs crate is a simple combinator-based for Rust attributes.  It
will be used instead of a handwritten parser.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/meson.build                              |  2 ++
 rust/qemu-macros/Cargo.toml                   |  1 +
 rust/qemu-macros/meson.build                  |  1 +
 scripts/archive-source.sh                     |  2 +-
 scripts/make-release                          |  2 +-
 subprojects/.gitignore                        |  1 +
 subprojects/attrs-0.2-rs.wrap                 |  7 ++++
 .../packagefiles/attrs-0.2-rs/meson.build     | 33 +++++++++++++++++++
 8 files changed, 47 insertions(+), 2 deletions(-)
 create mode 100644 subprojects/attrs-0.2-rs.wrap
 create mode 100644 subprojects/packagefiles/attrs-0.2-rs/meson.build

diff --git a/rust/meson.build b/rust/meson.build
index c7bd6aba45..b3ac3a7197 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -13,10 +13,12 @@ libc_rs = dependency('libc-0.2-rs')
 subproject('proc-macro2-1-rs', required: true)
 subproject('quote-1-rs', required: true)
 subproject('syn-2-rs', required: true)
+subproject('attrs-0.2-rs', required: true)
 
 quote_rs_native = dependency('quote-1-rs', native: true)
 syn_rs_native = dependency('syn-2-rs', native: true)
 proc_macro2_rs_native = dependency('proc-macro2-1-rs', native: true)
+attrs_rs_native = dependency('attrs-0.2-rs', native: true)
 
 genrs = []
 
diff --git a/rust/qemu-macros/Cargo.toml b/rust/qemu-macros/Cargo.toml
index 3b6f1d337f..c25b6c0b0d 100644
--- a/rust/qemu-macros/Cargo.toml
+++ b/rust/qemu-macros/Cargo.toml
@@ -16,6 +16,7 @@ rust-version.workspace = true
 proc-macro = true
 
 [dependencies]
+attrs = "0.2.9"
 proc-macro2 = "1"
 quote = "1"
 syn = { version = "2", features = ["extra-traits"] }
diff --git a/rust/qemu-macros/meson.build b/rust/qemu-macros/meson.build
index d0b2992e20..0f27e0df92 100644
--- a/rust/qemu-macros/meson.build
+++ b/rust/qemu-macros/meson.build
@@ -8,6 +8,7 @@ _qemu_macros_rs = rust.proc_macro(
     '--cfg', 'feature="proc-macro"',
   ],
   dependencies: [
+    attrs_rs_native,
     proc_macro2_rs_native,
     quote_rs_native,
     syn_rs_native,
diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index 035828c532..476a996a70 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -27,7 +27,7 @@ sub_file="${sub_tdir}/submodule.tar"
 # in their checkout, because the build environment is completely
 # different to the host OS.
 subprojects="keycodemapdb libvfio-user berkeley-softfloat-3
-  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
+  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs attrs-0.2-rs bilge-0.2-rs
   bilge-impl-0.2-rs either-1-rs foreign-0.3-rs itertools-0.11-rs
   libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
diff --git a/scripts/make-release b/scripts/make-release
index 87f563ef5f..bc1b43caa2 100755
--- a/scripts/make-release
+++ b/scripts/make-release
@@ -40,7 +40,7 @@ fi
 
 # Only include wraps that are invoked with subproject()
 SUBPROJECTS="libvfio-user keycodemapdb berkeley-softfloat-3
-  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs bilge-0.2-rs
+  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs attrs-0.2-rs bilge-0.2-rs
   bilge-impl-0.2-rs either-1-rs foreign-0.3-rs itertools-0.11-rs
   libc-0.2-rs proc-macro2-1-rs
   proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index f4281934ce..983c4c1549 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -8,6 +8,7 @@
 /slirp
 /anyhow-1.0.98
 /arbitrary-int-1.2.7
+/attrs-0.2.9
 /bilge-0.2.0
 /bilge-impl-0.2.0
 /either-1.12.0
diff --git a/subprojects/attrs-0.2-rs.wrap b/subprojects/attrs-0.2-rs.wrap
new file mode 100644
index 0000000000..cd43c91d63
--- /dev/null
+++ b/subprojects/attrs-0.2-rs.wrap
@@ -0,0 +1,7 @@
+[wrap-file]
+directory = attrs-0.2.9
+source_url = https://crates.io/api/v1/crates/attrs/0.2.9/download
+source_filename = attrs-0.2.9.tar.gz
+source_hash = 2a207d40f43de65285f3de0509bb6cb16bc46098864fce957122bbacce327e5f
+#method = cargo
+patch_directory = attrs-0.2-rs
diff --git a/subprojects/packagefiles/attrs-0.2-rs/meson.build b/subprojects/packagefiles/attrs-0.2-rs/meson.build
new file mode 100644
index 0000000000..ee575476cb
--- /dev/null
+++ b/subprojects/packagefiles/attrs-0.2-rs/meson.build
@@ -0,0 +1,33 @@
+project('attrs-0.2-rs', 'rust',
+  meson_version: '>=1.5.0',
+  version: '0.2.9',
+  license: 'MIT OR Apache-2.0',
+  default_options: [])
+
+subproject('proc-macro2-1-rs', required: true)
+subproject('syn-2-rs', required: true)
+
+proc_macro2_dep = dependency('proc-macro2-1-rs', native: true)
+syn_dep = dependency('syn-2-rs', native: true)
+
+_attrs_rs = static_library(
+  'attrs',
+  files('src/lib.rs'),
+  gnu_symbol_visibility: 'hidden',
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  rust_args: [
+    '--cap-lints', 'allow',
+  ],
+  dependencies: [
+    proc_macro2_dep,
+    syn_dep,
+  ],
+  native: true,
+)
+
+attrs_dep = declare_dependency(
+  link_with: _attrs_rs,
+)
+
+meson.override_dependency('attrs-0.2-rs', attrs_dep, native: true)

From 60c96a8775c163383043d4ece6065dcb8f940856 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 16 Jul 2025 10:50:58 +0200
Subject: [PATCH 0534/2396] rust: qemu-macros: switch #[property] parsing to
 use combinators

Since we are going to add more attribute parsing for high-level migration
state macros, use the attrs crate instead of a handwritten parser for
device properties as well.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock               | 11 +++++
 rust/qemu-macros/src/lib.rs   | 86 ++++++++++++++---------------------
 rust/qemu-macros/src/tests.rs |  8 ++--
 3 files changed, 49 insertions(+), 56 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index eea928621a..8315f98c46 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -14,6 +14,16 @@ version = "1.2.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "c84fc003e338a6f69fbd4f7fe9f92b535ff13e9af8997f3b14b6ddff8b1df46d"
 
+[[package]]
+name = "attrs"
+version = "0.2.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a207d40f43de65285f3de0509bb6cb16bc46098864fce957122bbacce327e5f"
+dependencies = [
+ "proc-macro2",
+ "syn",
+]
+
 [[package]]
 name = "bilge"
 version = "0.2.0"
@@ -188,6 +198,7 @@ dependencies = [
 name = "qemu_macros"
 version = "0.1.0"
 dependencies = [
+ "attrs",
  "proc-macro2",
  "quote",
  "syn",
diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 830b432698..7ab1806177 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -3,10 +3,14 @@
 // SPDX-License-Identifier: GPL-2.0-or-later
 
 use proc_macro::TokenStream;
-use quote::{quote, quote_spanned, ToTokens};
+use quote::{quote, quote_spanned};
 use syn::{
-    parse::Parse, parse_macro_input, parse_quote, punctuated::Punctuated, spanned::Spanned,
-    token::Comma, Data, DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token,
+    parse::{Parse, ParseStream},
+    parse_macro_input, parse_quote,
+    punctuated::Punctuated,
+    spanned::Spanned,
+    token::Comma,
+    Attribute, Data, DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token,
     Variant,
 };
 mod bits;
@@ -159,61 +163,37 @@ enum DevicePropertyName {
     Str(syn::LitStr),
 }
 
-#[derive(Debug)]
+impl Parse for DevicePropertyName {
+    fn parse(input: ParseStream<'_>) -> syn::Result<Self> {
+        let lo = input.lookahead1();
+        if lo.peek(syn::LitStr) {
+            Ok(Self::Str(input.parse()?))
+        } else if lo.peek(syn::LitCStr) {
+            Ok(Self::CStr(input.parse()?))
+        } else {
+            Err(lo.error())
+        }
+    }
+}
+
+#[derive(Default, Debug)]
 struct DeviceProperty {
     rename: Option<DevicePropertyName>,
     defval: Option<syn::Expr>,
 }
 
-impl Parse for DeviceProperty {
-    fn parse(input: syn::parse::ParseStream) -> syn::Result<Self> {
-        let _: syn::Token![#] = input.parse()?;
-        let bracketed;
-        _ = syn::bracketed!(bracketed in input);
-        let attribute = bracketed.parse::<syn::Ident>()?;
-        debug_assert_eq!(&attribute.to_string(), "property");
-        let mut retval = Self {
-            rename: None,
-            defval: None,
-        };
-        let content;
-        _ = syn::parenthesized!(content in bracketed);
-        while !content.is_empty() {
-            let value: syn::Ident = content.parse()?;
-            if value == "rename" {
-                let _: syn::Token![=] = content.parse()?;
-                if retval.rename.is_some() {
-                    return Err(syn::Error::new(
-                        value.span(),
-                        "`rename` can only be used at most once",
-                    ));
-                }
-                if content.peek(syn::LitStr) {
-                    retval.rename = Some(DevicePropertyName::Str(content.parse::<syn::LitStr>()?));
-                } else {
-                    retval.rename =
-                        Some(DevicePropertyName::CStr(content.parse::<syn::LitCStr>()?));
-                }
-            } else if value == "default" {
-                let _: syn::Token![=] = content.parse()?;
-                if retval.defval.is_some() {
-                    return Err(syn::Error::new(
-                        value.span(),
-                        "`default` can only be used at most once",
-                    ));
-                }
-                retval.defval = Some(content.parse()?);
-            } else {
-                return Err(syn::Error::new(
-                    value.span(),
-                    format!("unrecognized field `{value}`"),
-                ));
-            }
+impl DeviceProperty {
+    fn parse_from(&mut self, a: &Attribute) -> syn::Result<()> {
+        use attrs::{set, with, Attrs};
+        let mut parser = Attrs::new();
+        parser.once("rename", with::eq(set::parse(&mut self.rename)));
+        parser.once("default", with::eq(set::parse(&mut self.defval)));
+        a.parse_args_with(&mut parser)
+    }
 
-            if !content.is_empty() {
-                let _: syn::Token![,] = content.parse()?;
-            }
-        }
+    fn parse(a: &Attribute) -> syn::Result<Self> {
+        let mut retval = Self::default();
+        retval.parse_from(a)?;
         Ok(retval)
     }
 }
@@ -235,7 +215,7 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
             f.attrs
                 .iter()
                 .filter(|a| a.path().is_ident("property"))
-                .map(|a| Ok((f.clone(), syn::parse2(a.to_token_stream())?)))
+                .map(|a| Ok((f.clone(), DeviceProperty::parse(a)?)))
         })
         .collect::<Result<Vec<_>, Error>>()?;
     let name = &input.ident;
diff --git a/rust/qemu-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
index 9ab7eab7f3..00a106612f 100644
--- a/rust/qemu-macros/src/tests.rs
+++ b/rust/qemu-macros/src/tests.rs
@@ -60,7 +60,7 @@ fn test_derive_device() {
                 migrate_clock: bool,
             }
         },
-        "unrecognized field `defalt`"
+        "Expected one of `default` or `rename`"
     );
     // Check that repeated attributes are not allowed:
     derive_compile_fail!(
@@ -73,7 +73,8 @@ fn test_derive_device() {
                 migrate_clock: bool,
             }
         },
-        "`rename` can only be used at most once"
+        "Duplicate argument",
+        "Already used here",
     );
     derive_compile_fail!(
         derive_device_or_error,
@@ -85,7 +86,8 @@ fn test_derive_device() {
                 migrate_clock: bool,
             }
         },
-        "`default` can only be used at most once"
+        "Duplicate argument",
+        "Already used here",
     );
     // Check that the field name is preserved when `rename` isn't used:
     derive_compile!(

From a530a8d4ac39d04dc0095b1cdb88867146445706 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:09 +0800
Subject: [PATCH 0535/2396] subprojects: Update .gitignore for proc-macro2 and
 syn

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-2-zhao1.liu@intel.com
---
 subprojects/.gitignore | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index 983c4c1549..38e949640f 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -17,7 +17,7 @@
 /libc-0.2.162
 /proc-macro-error-1.0.4
 /proc-macro-error-attr-1.0.4
-/proc-macro2-1.0.84
+/proc-macro2-1.0.95
 /quote-1.0.36
 /syn-2.0.66
 /unicode-ident-1.0.12

From d935f0b8e17153e1dcfe93e7660bfd07693b513e Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:10 +0800
Subject: [PATCH 0536/2396] subprojects: Ignore .wraplock file generated by
 meson v1.9.0

The .wraplock file is automatically generated by meson v1.9.0 (the
related issue: https://github.com/mesonbuild/meson/issues/14948).

Ignore it for now.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-3-zhao1.liu@intel.com
---
 subprojects/.gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index 38e949640f..58a29f0120 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -21,3 +21,6 @@
 /quote-1.0.36
 /syn-2.0.66
 /unicode-ident-1.0.12
+
+# Workaround for Meson v1.9.0 https://github.com/mesonbuild/meson/issues/14948
+/.wraplock

From 1bbac0ca88cdfd6ac019685a855c92831e3862e3 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:11 +0800
Subject: [PATCH 0537/2396] rust/qemu-macros: Fix Clippy's complaints about
 lambda parameter naming

error: `rename` shadows a previous, unrelated binding
   --> qemu-macros/src/lib.rs:265:14
    |
265 |             |rename| -> Result<proc_macro2::TokenStream, Error> {
    |              ^^^^^^
    |
note: previous binding is here
   --> qemu-macros/src/lib.rs:245:30
    |
245 |         let DeviceProperty { rename, defval } = prop;
    |                              ^^^^^^
    = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#shadow_unrelated
    = note: requested on the command line with `-D clippy::shadow-unrelated`

Rename the lambda parameter to "prop_rename" to fix the above clippy
error.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-4-zhao1.liu@intel.com
---
 rust/qemu-macros/src/lib.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 7ab1806177..37e1b723bd 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -242,8 +242,8 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
 
         let prop_name = rename.map_or_else(
             || str_to_c_str!(field_name.to_string(), field_name.span()),
-            |rename| -> Result<proc_macro2::TokenStream, Error> {
-                match rename {
+            |prop_rename| -> Result<proc_macro2::TokenStream, Error> {
+                match prop_rename {
                     DevicePropertyName::CStr(cstr_lit) => Ok(quote! { #cstr_lit }),
                     DevicePropertyName::Str(str_lit) => {
                         str_to_c_str!(str_lit.value(), str_lit.span())

From 35d7735f765adc4cf759b8ad221e8858ca5be9c5 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:12 +0800
Subject: [PATCH 0538/2396] rust/common/uninit: Fix Clippy's complaints about
 lifetime

Clippy complains about the following cases and following its suggestion
to fix these warnings.

warning: the following explicit lifetimes could be elided: 'a
  --> common/src/uninit.rs:38:6
   |
38 | impl<'a, T, U> Deref for MaybeUninitField<'a, T, U> {
   |      ^^                                   ^^
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_lifetimes
   = note: `#[warn(clippy::needless_lifetimes)]` on by default
help: elide the lifetimes
   |
38 - impl<'a, T, U> Deref for MaybeUninitField<'a, T, U> {
38 + impl<T, U> Deref for MaybeUninitField<'_, T, U> {
   |

warning: the following explicit lifetimes could be elided: 'a
  --> common/src/uninit.rs:49:6
   |
49 | impl<'a, T, U> DerefMut for MaybeUninitField<'a, T, U> {
   |      ^^                                      ^^
   |
   = help: for further information visit https://rust-lang.github.io/rust-clippy/master/index.html#needless_lifetimes
help: elide the lifetimes
   |
49 - impl<'a, T, U> DerefMut for MaybeUninitField<'a, T, U> {
49 + impl<T, U> DerefMut for MaybeUninitField<'_, T, U> {
   |

warning: `common` (lib) generated 2 warnings (run `cargo clippy --fix --lib -p common` to apply 2 suggestions)

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-5-zhao1.liu@intel.com
---
 rust/common/src/uninit.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/common/src/uninit.rs b/rust/common/src/uninit.rs
index e7f9fcd2e3..8d021b1dfc 100644
--- a/rust/common/src/uninit.rs
+++ b/rust/common/src/uninit.rs
@@ -35,7 +35,7 @@ impl<'a, T, U> MaybeUninitField<'a, T, U> {
     }
 }
 
-impl<'a, T, U> Deref for MaybeUninitField<'a, T, U> {
+impl<T, U> Deref for MaybeUninitField<'_, T, U> {
     type Target = MaybeUninit<U>;
 
     fn deref(&self) -> &MaybeUninit<U> {
@@ -46,7 +46,7 @@ impl<'a, T, U> Deref for MaybeUninitField<'a, T, U> {
     }
 }
 
-impl<'a, T, U> DerefMut for MaybeUninitField<'a, T, U> {
+impl<T, U> DerefMut for MaybeUninitField<'_, T, U> {
     fn deref_mut(&mut self) -> &mut MaybeUninit<U> {
         // SAFETY: self.child was obtained by dereferencing a valid mutable
         // reference; the content of the memory may be invalid or uninitialized

From 51d736cd71a6515808b705010ec7e38695cb7a01 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Sun, 21 Sep 2025 00:05:13 +0800
Subject: [PATCH 0539/2396] rust/qdev: use addr_of! in QDevProp

We want a &raw pointer, so unsafe { &_ } is not needed.

Suggested-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-6-zhao1.liu@intel.com
---
 rust/hw/core/src/qdev.rs | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 71b9ef141c..3ee5b24262 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -6,7 +6,7 @@
 
 use std::{
     ffi::{c_int, c_void, CStr, CString},
-    ptr::NonNull,
+    ptr::{addr_of, NonNull},
 };
 
 use chardev::Chardev;
@@ -129,17 +129,17 @@ pub unsafe trait QDevProp {
 
 /// Use [`bindings::qdev_prop_bool`] for `bool`.
 unsafe impl QDevProp for bool {
-    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_bool };
+    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_bool);
 }
 
 /// Use [`bindings::qdev_prop_uint64`] for `u64`.
 unsafe impl QDevProp for u64 {
-    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_uint64 };
+    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_uint64);
 }
 
 /// Use [`bindings::qdev_prop_chr`] for [`chardev::CharBackend`].
 unsafe impl QDevProp for chardev::CharBackend {
-    const VALUE: *const bindings::PropertyInfo = unsafe { &bindings::qdev_prop_chr };
+    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_chr);
 }
 
 /// Trait to define device properties.

From bed2a37b2096e1d002f3b8e881c0f6eff863ff14 Mon Sep 17 00:00:00 2001
From: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Date: Sun, 21 Sep 2025 00:05:14 +0800
Subject: [PATCH 0540/2396] rust/qdev: Refine the documentation for QDevProp
 trait

Refine the documentation to clarify:
 * `unsfae` requires that `VALUE` must be valid.
 * using `*const` instead of `&` because the latter will cause compiler
   error.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-7-zhao1.liu@intel.com
---
 rust/hw/core/src/qdev.rs | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 3ee5b24262..2735e2b2c1 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -109,9 +109,16 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
 ///
 /// # Safety
 ///
-/// This trait is marked as `unsafe` because currently having a `const` refer to
-/// an `extern static` as a reference instead of a raw pointer results in this
-/// compiler error:
+/// This trait is marked as `unsafe` because `VALUE` must be a valid raw
+/// reference to a [`bindings::PropertyInfo`].
+///
+/// Note we could not use a regular reference:
+///
+/// ```text
+/// const VALUE: &bindings::PropertyInfo = ...
+/// ```
+///
+/// because this results in the following compiler error:
 ///
 /// ```text
 /// constructing invalid value: encountered reference to `extern` static in `const`
@@ -119,7 +126,7 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
 ///
 /// This is because the compiler generally might dereference a normal reference
 /// during const evaluation, but not in this case (if it did, it'd need to
-/// dereference the raw pointer so this would fail to compile).
+/// dereference the raw pointer so using a `*const` would also fail to compile).
 ///
 /// It is the implementer's responsibility to provide a valid
 /// [`bindings::PropertyInfo`] pointer for the trait implementation to be safe.

From b4221e88a9a497c3d72c4dfad1bcc12468f3fd01 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:15 +0800
Subject: [PATCH 0541/2396] rust/qdev: Support property info for more common
 types

Add a helper macro to implement QDevProp trait for u8/u16/u32/usize/i32
/i64.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-8-zhao1.liu@intel.com
---
 rust/hw/core/src/qdev.rs | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 2735e2b2c1..85422e0379 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -134,20 +134,24 @@ pub unsafe trait QDevProp {
     const VALUE: *const bindings::PropertyInfo;
 }
 
-/// Use [`bindings::qdev_prop_bool`] for `bool`.
-unsafe impl QDevProp for bool {
-    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_bool);
+macro_rules! impl_qdev_prop {
+    ($type:ty,$info:ident) => {
+        unsafe impl $crate::qdev::QDevProp for $type {
+            const VALUE: *const $crate::bindings::PropertyInfo =
+                addr_of!($crate::bindings::$info);
+        }
+    };
 }
 
-/// Use [`bindings::qdev_prop_uint64`] for `u64`.
-unsafe impl QDevProp for u64 {
-    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_uint64);
-}
-
-/// Use [`bindings::qdev_prop_chr`] for [`chardev::CharBackend`].
-unsafe impl QDevProp for chardev::CharBackend {
-    const VALUE: *const bindings::PropertyInfo = addr_of!(bindings::qdev_prop_chr);
-}
+impl_qdev_prop!(bool, qdev_prop_bool);
+impl_qdev_prop!(u8, qdev_prop_uint8);
+impl_qdev_prop!(u16, qdev_prop_uint16);
+impl_qdev_prop!(u32, qdev_prop_uint32);
+impl_qdev_prop!(u64, qdev_prop_uint64);
+impl_qdev_prop!(usize, qdev_prop_usize);
+impl_qdev_prop!(i32, qdev_prop_int32);
+impl_qdev_prop!(i64, qdev_prop_int64);
+impl_qdev_prop!(chardev::CharBackend, qdev_prop_chr);
 
 /// Trait to define device properties.
 ///

From 9686aa9a05d9ef25c13ddc0af0123e2fc569b0ac Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:16 +0800
Subject: [PATCH 0542/2396] rust/qdev: Support bit property in #property macro

Add BIT_INFO to QDevProp trait, so that bit related property info could
be bound to u32 & u64.

Then add "bit=*" field in #property attributes macro to allow device to
configure bit property.

In addtion, convert the #property field parsing from `if-else` pattern
to `match` pattern, to help readability. And note, the `bitnr` member of
`Property` struct is generated by manual TokenStream construction,
instead of conditional repetition (like #(bitnr: #bitnr,)?) since
`quote` doesn't support this.

In addtion, rename VALUE member of QDevProp trait to BASE_INFO.

And update the test cases about qdev property.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-9-zhao1.liu@intel.com
---
 rust/hw/core/src/qdev.rs      | 19 ++++++++++++-------
 rust/qemu-macros/src/lib.rs   | 18 +++++++++++++++---
 rust/qemu-macros/src/tests.rs |  8 +++++---
 3 files changed, 32 insertions(+), 13 deletions(-)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 85422e0379..9c82e1716c 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -109,8 +109,8 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
 ///
 /// # Safety
 ///
-/// This trait is marked as `unsafe` because `VALUE` must be a valid raw
-/// reference to a [`bindings::PropertyInfo`].
+/// This trait is marked as `unsafe` because `BASE_INFO` and `BIT_INFO` must be
+/// valid raw references to [`bindings::PropertyInfo`].
 ///
 /// Note we could not use a regular reference:
 ///
@@ -131,14 +131,19 @@ unsafe extern "C" fn rust_resettable_exit_fn<T: ResettablePhasesImpl>(
 /// It is the implementer's responsibility to provide a valid
 /// [`bindings::PropertyInfo`] pointer for the trait implementation to be safe.
 pub unsafe trait QDevProp {
-    const VALUE: *const bindings::PropertyInfo;
+    const BASE_INFO: *const bindings::PropertyInfo;
+    const BIT_INFO: *const bindings::PropertyInfo = {
+        panic!("invalid type for bit property");
+    };
 }
 
 macro_rules! impl_qdev_prop {
-    ($type:ty,$info:ident) => {
+    ($type:ty,$info:ident$(, $bit_info:ident)?) => {
         unsafe impl $crate::qdev::QDevProp for $type {
-            const VALUE: *const $crate::bindings::PropertyInfo =
+            const BASE_INFO: *const $crate::bindings::PropertyInfo =
                 addr_of!($crate::bindings::$info);
+            $(const BIT_INFO: *const $crate::bindings::PropertyInfo =
+                addr_of!($crate::bindings::$bit_info);)?
         }
     };
 }
@@ -146,8 +151,8 @@ macro_rules! impl_qdev_prop {
 impl_qdev_prop!(bool, qdev_prop_bool);
 impl_qdev_prop!(u8, qdev_prop_uint8);
 impl_qdev_prop!(u16, qdev_prop_uint16);
-impl_qdev_prop!(u32, qdev_prop_uint32);
-impl_qdev_prop!(u64, qdev_prop_uint64);
+impl_qdev_prop!(u32, qdev_prop_uint32, qdev_prop_bit);
+impl_qdev_prop!(u64, qdev_prop_uint64, qdev_prop_bit64);
 impl_qdev_prop!(usize, qdev_prop_usize);
 impl_qdev_prop!(i32, qdev_prop_int32);
 impl_qdev_prop!(i64, qdev_prop_int64);
diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 37e1b723bd..3e21b67b47 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -179,6 +179,7 @@ impl Parse for DevicePropertyName {
 #[derive(Default, Debug)]
 struct DeviceProperty {
     rename: Option<DevicePropertyName>,
+    bitnr: Option<syn::Expr>,
     defval: Option<syn::Expr>,
 }
 
@@ -187,6 +188,7 @@ impl DeviceProperty {
         use attrs::{set, with, Attrs};
         let mut parser = Attrs::new();
         parser.once("rename", with::eq(set::parse(&mut self.rename)));
+        parser.once("bit", with::eq(set::parse(&mut self.bitnr)));
         parser.once("default", with::eq(set::parse(&mut self.defval)));
         a.parse_args_with(&mut parser)
     }
@@ -222,7 +224,11 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
     let mut properties_expanded = vec![];
 
     for (field, prop) in properties {
-        let DeviceProperty { rename, defval } = prop;
+        let DeviceProperty {
+            rename,
+            bitnr,
+            defval,
+        } = prop;
         let field_name = field.ident.unwrap();
         macro_rules! str_to_c_str {
             ($value:expr, $span:expr) => {{
@@ -252,14 +258,20 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
             },
         )?;
         let field_ty = field.ty.clone();
-        let qdev_prop = quote! { <#field_ty as ::hwcore::QDevProp>::VALUE };
+        let qdev_prop = if bitnr.is_none() {
+            quote! { <#field_ty as ::hwcore::QDevProp>::BASE_INFO }
+        } else {
+            quote! { <#field_ty as ::hwcore::QDevProp>::BIT_INFO }
+        };
+        let bitnr = bitnr.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
         let set_default = defval.is_some();
         let defval = defval.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
         properties_expanded.push(quote! {
             ::hwcore::bindings::Property {
                 name: ::std::ffi::CStr::as_ptr(#prop_name),
-                info: #qdev_prop ,
+                info: #qdev_prop,
                 offset: ::core::mem::offset_of!(#name, #field_name) as isize,
+                bitnr: #bitnr,
                 set_default: #set_default,
                 defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
                 ..::common::Zeroable::ZERO
diff --git a/rust/qemu-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
index 00a106612f..ec137132ae 100644
--- a/rust/qemu-macros/src/tests.rs
+++ b/rust/qemu-macros/src/tests.rs
@@ -60,7 +60,7 @@ fn test_derive_device() {
                 migrate_clock: bool,
             }
         },
-        "Expected one of `default` or `rename`"
+        "Expected one of `bit`, `default` or `rename`"
     );
     // Check that repeated attributes are not allowed:
     derive_compile_fail!(
@@ -106,8 +106,9 @@ fn test_derive_device() {
                 const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
                     ::hwcore::bindings::Property {
                         name: ::std::ffi::CStr::as_ptr(c"migrate_clock"),
-                        info: <bool as ::hwcore::QDevProp>::VALUE,
+                        info: <bool as ::hwcore::QDevProp>::BASE_INFO,
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                        bitnr: 0,
                         set_default: true,
                         defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
                         ..::common::Zeroable::ZERO
@@ -133,8 +134,9 @@ fn test_derive_device() {
                 const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
                     ::hwcore::bindings::Property {
                         name: ::std::ffi::CStr::as_ptr(c"migrate-clk"),
-                        info: <bool as ::hwcore::QDevProp>::VALUE,
+                        info: <bool as ::hwcore::QDevProp>::BASE_INFO,
                         offset: ::core::mem::offset_of!(DummyState, migrate_clock) as isize,
+                        bitnr: 0,
                         set_default: true,
                         defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
                         ..::common::Zeroable::ZERO

From a8f080215f79d211c4be0f896ad5f32dbc3b7c03 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:17 +0800
Subject: [PATCH 0543/2396] rust/qdev: Test bit property for #property

There's a diference between Rust and C:

Though C macro (e.g., DEFINE_PROP_BIT or DEFINE_PROP_BIT64) always
requires default value, Rust side allows to omit this "default" field
in #property, and provides a default value ("0" - false) for this
field.

This minor difference does not break user habits and should be
acceptable. Therefore, the test cases also cover this scenario.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-10-zhao1.liu@intel.com
---
 rust/qemu-macros/src/tests.rs | 99 +++++++++++++++++++++++++++++++++++
 1 file changed, 99 insertions(+)

diff --git a/rust/qemu-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
index ec137132ae..ac998d20e3 100644
--- a/rust/qemu-macros/src/tests.rs
+++ b/rust/qemu-macros/src/tests.rs
@@ -89,6 +89,19 @@ fn test_derive_device() {
         "Duplicate argument",
         "Already used here",
     );
+    derive_compile_fail!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            struct DummyState {
+                #[property(bit = 0, bit = 1)]
+                flags: u32,
+            }
+        },
+        "Duplicate argument",
+        "Already used here",
+    );
     // Check that the field name is preserved when `rename` isn't used:
     derive_compile!(
         derive_device_or_error,
@@ -145,6 +158,92 @@ fn test_derive_device() {
             }
         }
     );
+    // Check that `bit` value is used for the bit property without default
+    // value (note: though C macro (e.g., DEFINE_PROP_BIT) always requires
+    // default value, Rust side allows to default this field to "0"):
+    derive_compile!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            pub struct DummyState {
+                parent: ParentField<DeviceState>,
+                #[property(bit = 3)]
+                flags: u32,
+            }
+        },
+        quote! {
+            unsafe impl ::hwcore::DevicePropertiesImpl for DummyState {
+                const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
+                    ::hwcore::bindings::Property {
+                        name: ::std::ffi::CStr::as_ptr(c"flags"),
+                        info: <u32 as ::hwcore::QDevProp>::BIT_INFO,
+                        offset: ::core::mem::offset_of!(DummyState, flags) as isize,
+                        bitnr: 3,
+                        set_default: false,
+                        defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: 0 as u64 },
+                        ..::common::Zeroable::ZERO
+                    }
+                ];
+            }
+        }
+    );
+    // Check that `bit` value is used for the bit property when used:
+    derive_compile!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            pub struct DummyState {
+                parent: ParentField<DeviceState>,
+                #[property(bit = 3, default = true)]
+                flags: u32,
+            }
+        },
+        quote! {
+            unsafe impl ::hwcore::DevicePropertiesImpl for DummyState {
+                const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
+                    ::hwcore::bindings::Property {
+                        name: ::std::ffi::CStr::as_ptr(c"flags"),
+                        info: <u32 as ::hwcore::QDevProp>::BIT_INFO,
+                        offset: ::core::mem::offset_of!(DummyState, flags) as isize,
+                        bitnr: 3,
+                        set_default: true,
+                        defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
+                        ..::common::Zeroable::ZERO
+                    }
+                ];
+            }
+        }
+    );
+    // Check that `bit` value is used for the bit property with rename when used:
+    derive_compile!(
+        derive_device_or_error,
+        quote! {
+            #[repr(C)]
+            #[derive(Device)]
+            pub struct DummyState {
+                parent: ParentField<DeviceState>,
+                #[property(rename = "msi", bit = 3, default = false)]
+                flags: u64,
+            }
+        },
+        quote! {
+            unsafe impl ::hwcore::DevicePropertiesImpl for DummyState {
+                const PROPERTIES: &'static [::hwcore::bindings::Property] = &[
+                    ::hwcore::bindings::Property {
+                        name: ::std::ffi::CStr::as_ptr(c"msi"),
+                        info: <u64 as ::hwcore::QDevProp>::BIT_INFO,
+                        offset: ::core::mem::offset_of!(DummyState, flags) as isize,
+                        bitnr: 3,
+                        set_default: true,
+                        defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: false as u64 },
+                        ..::common::Zeroable::ZERO
+                    }
+                ];
+            }
+        }
+    );
 }
 
 #[test]

From 4f09cf54faad32d41dfb5ccdd4c0e7871b636274 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:18 +0800
Subject: [PATCH 0544/2396] rust/hpet: Clean up type mismatch for num_timers
 property

Now `num_timers` is `usize` other than `u8`. Although the type field in
`declare_properties` macro hasn't been used, it's better to explicitly
point this out and clean up this before doing other property work.

Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-11-zhao1.liu@intel.com
---
 rust/hw/timer/hpet/src/device.rs | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 3cfbe9c32b..fce7541557 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -909,7 +909,7 @@ declare_properties! {
         HPETState,
         num_timers,
         unsafe { &qdev_prop_usize },
-        u8,
+        usize,
         default = HPET_MIN_TIMERS
     ),
     define_property!(

From b160ebadc196091ca7abe00471f49fdc6bb8faf6 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:19 +0800
Subject: [PATCH 0545/2396] rust/hpet: Convert qdev properties to #property
 macro

Convert HPET's properties to #property macro:
 * num_timers: usize property.
 * flags: u32 bit property.
 * int_route_cap: u32 property.
 * hpet_offset_saved: bool property.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-12-zhao1.liu@intel.com
---
 rust/hw/timer/hpet/src/device.rs | 55 ++++----------------------------
 1 file changed, 7 insertions(+), 48 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index fce7541557..86638c0766 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -13,9 +13,8 @@ use std::{
 use bql::{BqlCell, BqlRefCell};
 use common::{bitops::IntegerExt, uninit_field_mut};
 use hwcore::{
-    bindings::{qdev_prop_bit, qdev_prop_bool, qdev_prop_uint32, qdev_prop_usize},
-    declare_properties, define_property, DeviceImpl, DeviceMethods, DeviceState, InterruptSource,
-    Property, ResetType, ResettablePhasesImpl, SysBusDevice, SysBusDeviceImpl, SysBusDeviceMethods,
+    DeviceImpl, DeviceMethods, DeviceState, InterruptSource, ResetType, ResettablePhasesImpl,
+    SysBusDevice, SysBusDeviceImpl, SysBusDeviceMethods,
 };
 use migration::{
     self, impl_vmstate_struct, vmstate_fields, vmstate_of, vmstate_subsections, vmstate_validate,
@@ -520,7 +519,7 @@ impl HPETTimer {
 
 /// HPET Event Timer Block Abstraction
 #[repr(C)]
-#[derive(qom::Object)]
+#[derive(qom::Object, hwcore::Device)]
 pub struct HPETState {
     parent_obj: ParentField<SysBusDevice>,
     iomem: MemoryRegion,
@@ -540,10 +539,12 @@ pub struct HPETState {
     // Internal state
     /// Capabilities that QEMU HPET supports.
     /// bit 0: MSI (or FSB) support.
+    #[property(rename = "msi", bit = HPET_FLAG_MSI_SUPPORT_SHIFT as u8, default = false)]
     flags: u32,
 
     /// Offset of main counter relative to qemu clock.
     hpet_offset: BqlCell<u64>,
+    #[property(rename = "hpet-offset-saved", default = true)]
     hpet_offset_saved: bool,
 
     irqs: [InterruptSource; HPET_NUM_IRQ_ROUTES],
@@ -555,11 +556,13 @@ pub struct HPETState {
     /// the timers' interrupt can be routed, and is encoded in the
     /// bits 32:64 of timer N's config register:
     #[doc(alias = "intcap")]
+    #[property(rename = "hpet-intcap", default = 0)]
     int_route_cap: u32,
 
     /// HPET timer array managed by this timer block.
     #[doc(alias = "timer")]
     timers: [BqlRefCell<HPETTimer>; HPET_MAX_TIMERS],
+    #[property(rename = "timers", default = HPET_MIN_TIMERS)]
     num_timers: usize,
     num_timers_save: BqlCell<u8>,
 
@@ -901,44 +904,6 @@ impl ObjectImpl for HPETState {
     const CLASS_INIT: fn(&mut Self::Class) = Self::Class::class_init::<Self>;
 }
 
-// TODO: Make these properties user-configurable!
-declare_properties! {
-    HPET_PROPERTIES,
-    define_property!(
-        c"timers",
-        HPETState,
-        num_timers,
-        unsafe { &qdev_prop_usize },
-        usize,
-        default = HPET_MIN_TIMERS
-    ),
-    define_property!(
-        c"msi",
-        HPETState,
-        flags,
-        unsafe { &qdev_prop_bit },
-        u32,
-        bit = HPET_FLAG_MSI_SUPPORT_SHIFT as u8,
-        default = false,
-    ),
-    define_property!(
-        c"hpet-intcap",
-        HPETState,
-        int_route_cap,
-        unsafe { &qdev_prop_uint32 },
-        u32,
-        default = 0
-    ),
-    define_property!(
-        c"hpet-offset-saved",
-        HPETState,
-        hpet_offset_saved,
-        unsafe { &qdev_prop_bool },
-        bool,
-        default = true
-    ),
-}
-
 static VMSTATE_HPET_RTC_IRQ_LEVEL: VMStateDescription<HPETState> =
     VMStateDescriptionBuilder::<HPETState>::new()
         .name(c"hpet/rtc_irq_level")
@@ -1001,12 +966,6 @@ const VMSTATE_HPET: VMStateDescription<HPETState> =
         ))
         .build();
 
-// SAFETY: HPET_PROPERTIES is a valid Property array constructed with the
-// hwcore::declare_properties macro.
-unsafe impl hwcore::DevicePropertiesImpl for HPETState {
-    const PROPERTIES: &'static [Property] = &HPET_PROPERTIES;
-}
-
 impl DeviceImpl for HPETState {
     const VMSTATE: Option<VMStateDescription<Self>> = Some(VMSTATE_HPET);
     const REALIZE: Option<fn(&Self) -> util::Result<()>> = Some(Self::realize);

From 0a7fe8d407009840bee0e6d95005714ede51d0b8 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Sun, 21 Sep 2025 00:05:20 +0800
Subject: [PATCH 0546/2396] rust/qdev: Drop declare_properties &
 define_property macros

After HPET's #property conversion, there's no use case for
declare_properties & define_property. So get rid of them for now.

In future, if there's something that #property really cannot resolve,
they can be brought back.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20250920160520.3699591-13-zhao1.liu@intel.com
---
 rust/hw/core/src/qdev.rs | 53 ----------------------------------------
 1 file changed, 53 deletions(-)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index 9c82e1716c..a4493dbf01 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -248,59 +248,6 @@ impl DeviceClass {
     }
 }
 
-#[macro_export]
-macro_rules! define_property {
-    ($name:expr, $state:ty, $field:ident, $prop:expr, $type:ty, bit = $bitnr:expr, default = $defval:expr$(,)*) => {
-        $crate::bindings::Property {
-            // use associated function syntax for type checking
-            name: ::std::ffi::CStr::as_ptr($name),
-            info: $prop,
-            offset: ::std::mem::offset_of!($state, $field) as isize,
-            bitnr: $bitnr,
-            set_default: true,
-            defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
-            ..::common::zeroable::Zeroable::ZERO
-        }
-    };
-    ($name:expr, $state:ty, $field:ident, $prop:expr, $type:ty, default = $defval:expr$(,)*) => {
-        $crate::bindings::Property {
-            // use associated function syntax for type checking
-            name: ::std::ffi::CStr::as_ptr($name),
-            info: $prop,
-            offset: ::std::mem::offset_of!($state, $field) as isize,
-            set_default: true,
-            defval: $crate::bindings::Property__bindgen_ty_1 { u: $defval as u64 },
-            ..::common::zeroable::Zeroable::ZERO
-        }
-    };
-    ($name:expr, $state:ty, $field:ident, $prop:expr, $type:ty$(,)*) => {
-        $crate::bindings::Property {
-            // use associated function syntax for type checking
-            name: ::std::ffi::CStr::as_ptr($name),
-            info: $prop,
-            offset: ::std::mem::offset_of!($state, $field) as isize,
-            set_default: false,
-            ..::common::zeroable::Zeroable::ZERO
-        }
-    };
-}
-
-#[macro_export]
-macro_rules! declare_properties {
-    ($ident:ident, $($prop:expr),*$(,)*) => {
-        pub static $ident: [$crate::bindings::Property; {
-            let mut len = 0;
-            $({
-                _ = stringify!($prop);
-                len += 1;
-            })*
-            len
-        }] = [
-            $($prop),*,
-        ];
-    };
-}
-
 unsafe impl ObjectType for DeviceState {
     type Class = DeviceClass;
     const TYPE_NAME: &'static CStr =

From 6096dfa6c5cedf1e4e9ae04b27fb238ef390047f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 9 Sep 2025 09:48:17 +0200
Subject: [PATCH 0547/2396] tests/functional/m68k: Use proper polling in the
 next-cube test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The next-cube tests currently sleep for 2 seconds to wait for the
guest's display to come up with the expected results. That's bad
since there is still a theoretical race left here, and since there
are two subtests, the whole test takes more than 4 seconds this way.

Looking at what the firmware does, there is a better way instead of
blindly waiting for two seconds: The firmware is writing some values
to the FPU registers during a test (and never touches them again
afterwards, so we can be sure about the final values), so we can
poll for the right values in those registers to know when we reached
a state when the display is initialized for sure. We just have to
also make sure to not look for text anymore that is only printed
after the FPU test has been done by the guest firmware.

This way the whole tests finishes in less than 1 second here, and
there should be no race condition here anymore.

Message-ID: <20250909074817.84661-1-thuth@redhat.com>
Acked-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/m68k/test_nextcube.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tests/functional/m68k/test_nextcube.py b/tests/functional/m68k/test_nextcube.py
index c1610e5845..e5e1c69dcb 100755
--- a/tests/functional/m68k/test_nextcube.py
+++ b/tests/functional/m68k/test_nextcube.py
@@ -29,8 +29,15 @@ class NextCubeMachine(QemuSystemTest):
         self.vm.launch()
 
         self.log.info('VM launched, waiting for display')
-        # TODO: wait for the 'displaysurface_create 1120x832' trace-event.
-        time.sleep(2)
+        # Wait for the FPU test to finish, then the display is available, too:
+        while True:
+            res = self.vm.cmd('human-monitor-command',
+                              command_line='info registers')
+            if ("F0 = 400e 8400000000000000" in res and
+                "F1 = 400e 83ff000000000000" in res and
+                "F2 = 400e 83ff000000000000" in res):
+                break
+            time.sleep(0.1)
 
         res = self.vm.cmd('human-monitor-command',
                           command_line='screendump %s' % screenshot_path)
@@ -56,10 +63,10 @@ class NextCubeMachine(QemuSystemTest):
         self.check_bootrom_framebuffer(screenshot_path)
         lines = tesseract_ocr(screenshot_path)
         text = '\n'.join(lines)
+        self.assertIn('Backplane slot', text)
+        self.assertIn('Ethernet address', text)
         self.assertIn('Testing the FPU', text)
-        self.assertIn('System test failed. Error code', text)
-        self.assertIn('Boot command', text)
-        self.assertIn('Next>', text)
+
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From db05b0d21ec1e0532cf5f5103ae6520a838d96f9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 10:20:54 +0200
Subject: [PATCH 0548/2396] linux-user: avoid -Werror=int-in-bool-context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

linux-user is failing to compile on Fedora 43:

../linux-user/strace.c:57:66: error: enum constant in boolean context [-Werror=int-in-bool-context]
   57 | #define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO(!(M)), N }

The warning does not seem to be too useful and we could even disable it,
but the workaround is simple in this case.

Cc: qemu-stable@nongnu.org
Cc: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-user/strace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/strace.c b/linux-user/strace.c
index 1233ebceb0..758c5d32b6 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -54,7 +54,7 @@ struct flags {
 };
 
 /* No 'struct flags' element should have a zero mask. */
-#define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO(!(M)), N }
+#define FLAG_BASIC(V, M, N)      { V, M | QEMU_BUILD_BUG_ON_ZERO((M) == 0), N }
 
 /* common flags for all architectures */
 #define FLAG_GENERIC_MASK(V, M)  FLAG_BASIC(V, M, #V)

From ee3b39c92454b0360a614bd017eb5e545ea61f4e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 4 Sep 2025 11:30:53 +0200
Subject: [PATCH 0549/2396] linux-user: Create
 vdso_sigreturn_region_{start,end}

These variables will be populated from the vdso, and used
for detecting whether we are executing the sigreturn.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c           | 5 +++++
 linux-user/gen-vdso-elfn.c.inc | 7 +++++--
 linux-user/gen-vdso.c          | 6 ++++++
 linux-user/loader.h            | 2 ++
 linux-user/signal-common.h     | 2 ++
 linux-user/signal.c            | 2 ++
 6 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 26c090c95d..28f0909d1a 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1659,6 +1659,11 @@ static void load_elf_vdso(struct image_info *info, const VdsoImageInfo *vdso)
     if (vdso->rt_sigreturn_ofs) {
         default_rt_sigreturn = load_addr + vdso->rt_sigreturn_ofs;
     }
+    if (vdso->sigreturn_region_start_ofs) {
+        vdso_sigreturn_region_start =
+            load_addr + vdso->sigreturn_region_start_ofs;
+        vdso_sigreturn_region_end = load_addr + vdso->sigreturn_region_end_ofs;
+    }
 
     /* Remove write from VDSO segment. */
     target_mprotect(info->start_data, info->end_data - info->start_data,
diff --git a/linux-user/gen-vdso-elfn.c.inc b/linux-user/gen-vdso-elfn.c.inc
index b47019e136..c2677a146c 100644
--- a/linux-user/gen-vdso-elfn.c.inc
+++ b/linux-user/gen-vdso-elfn.c.inc
@@ -84,9 +84,12 @@ static void elfN(search_symtab)(ElfN(Shdr) *shdr, unsigned sym_idx,
 
         if (sigreturn_sym && strcmp(sigreturn_sym, name) == 0) {
             sigreturn_addr = sym.st_value;
-        }
-        if (rt_sigreturn_sym && strcmp(rt_sigreturn_sym, name) == 0) {
+        } else if (rt_sigreturn_sym && strcmp(rt_sigreturn_sym, name) == 0) {
             rt_sigreturn_addr = sym.st_value;
+        } else if (strcmp("sigreturn_region_start", name) == 0) {
+            sigreturn_region_start_addr = sym.st_value;
+        } else if (strcmp("sigreturn_region_end", name) == 0) {
+            sigreturn_region_end_addr = sym.st_value;
         }
     }
 }
diff --git a/linux-user/gen-vdso.c b/linux-user/gen-vdso.c
index aeaa927db8..d6a2cdaa83 100644
--- a/linux-user/gen-vdso.c
+++ b/linux-user/gen-vdso.c
@@ -36,6 +36,8 @@ static const char *rt_sigreturn_sym;
 
 static unsigned sigreturn_addr;
 static unsigned rt_sigreturn_addr;
+static unsigned sigreturn_region_start_addr;
+static unsigned sigreturn_region_end_addr;
 
 #define N 32
 #define elfN(x)  elf32_##x
@@ -215,6 +217,10 @@ int main(int argc, char **argv)
     fprintf(outf, "    .reloc_count = ARRAY_SIZE(%s_relocs),\n", prefix);
     fprintf(outf, "    .sigreturn_ofs = 0x%x,\n", sigreturn_addr);
     fprintf(outf, "    .rt_sigreturn_ofs = 0x%x,\n", rt_sigreturn_addr);
+    fprintf(outf, "    .sigreturn_region_start_ofs = 0x%x,\n",
+            sigreturn_region_start_addr);
+    fprintf(outf, "    .sigreturn_region_end_ofs = 0x%x,\n",
+            sigreturn_region_end_addr);
     fprintf(outf, "};\n");
 
     ret = EXIT_SUCCESS;
diff --git a/linux-user/loader.h b/linux-user/loader.h
index e42b8fa1e3..da9ad28db5 100644
--- a/linux-user/loader.h
+++ b/linux-user/loader.h
@@ -117,6 +117,8 @@ typedef struct {
     unsigned reloc_count;
     unsigned sigreturn_ofs;
     unsigned rt_sigreturn_ofs;
+    unsigned sigreturn_region_start_ofs;
+    unsigned sigreturn_region_end_ofs;
 } VdsoImageInfo;
 
 /* Note that both Elf32_Word and Elf64_Word are uint32_t. */
diff --git a/linux-user/signal-common.h b/linux-user/signal-common.h
index 196d2406f8..0b04868727 100644
--- a/linux-user/signal-common.h
+++ b/linux-user/signal-common.h
@@ -25,6 +25,8 @@
 /* Fallback addresses into sigtramp page. */
 extern abi_ulong default_sigreturn;
 extern abi_ulong default_rt_sigreturn;
+extern abi_ulong vdso_sigreturn_region_start;
+extern abi_ulong vdso_sigreturn_region_end;
 
 void setup_sigtramp(abi_ulong tramp_page);
 
diff --git a/linux-user/signal.c b/linux-user/signal.c
index cd0e7398aa..804096bd44 100644
--- a/linux-user/signal.c
+++ b/linux-user/signal.c
@@ -50,6 +50,8 @@ static void host_signal_handler(int host_signum, siginfo_t *info,
 /* Fallback addresses into sigtramp page. */
 abi_ulong default_sigreturn;
 abi_ulong default_rt_sigreturn;
+abi_ulong vdso_sigreturn_region_start;
+abi_ulong vdso_sigreturn_region_end;
 
 /*
  * System includes define _NSIG as SIGRTMAX + 1, but qemu (like the kernel)

From b9baf09512756943ced419aa5ec71bf435681e09 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 4 Sep 2025 11:49:04 +0200
Subject: [PATCH 0550/2396] linux-user: Populate sigreturn_region_{start,end}
 in all vdso.S

Mark the regions which contain sigreturn syscalls within
each vdso.  Rebuild the shared objects.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/vdso-be.so  | Bin 3224 -> 3320 bytes
 linux-user/aarch64/vdso-le.so  | Bin 3224 -> 3320 bytes
 linux-user/aarch64/vdso.S      |   2 ++
 linux-user/arm/vdso-be32.so    | Bin 2648 -> 2724 bytes
 linux-user/arm/vdso-be8.so     | Bin 2648 -> 2724 bytes
 linux-user/arm/vdso-le.so      | Bin 2648 -> 2724 bytes
 linux-user/arm/vdso.S          |   2 ++
 linux-user/hppa/vdso.S         |   2 ++
 linux-user/hppa/vdso.so        | Bin 2104 -> 2224 bytes
 linux-user/i386/vdso.S         |   2 ++
 linux-user/i386/vdso.so        | Bin 2672 -> 2792 bytes
 linux-user/loongarch64/vdso.S  |   2 ++
 linux-user/loongarch64/vdso.so | Bin 3560 -> 3712 bytes
 linux-user/ppc/vdso-32.so      | Bin 3020 -> 3140 bytes
 linux-user/ppc/vdso-64.so      | Bin 3896 -> 4048 bytes
 linux-user/ppc/vdso-64le.so    | Bin 3896 -> 4048 bytes
 linux-user/ppc/vdso.S          |   2 ++
 linux-user/riscv/vdso-32.so    | Bin 2980 -> 3124 bytes
 linux-user/riscv/vdso-64.so    | Bin 3944 -> 4104 bytes
 linux-user/riscv/vdso.S        |   2 ++
 linux-user/s390x/vdso.S        |   2 ++
 linux-user/s390x/vdso.so       | Bin 3464 -> 3616 bytes
 22 files changed, 16 insertions(+)

diff --git a/linux-user/aarch64/vdso-be.so b/linux-user/aarch64/vdso-be.so
index d43c3b19cdf6588757f2039f2308a8bce21aed9c..4089838b30535738e89252a146a039af54ed8be1 100755
GIT binary patch
delta 372
zcmbOs`9pGoKI4y#1`&)RyJD|o>HWC-e5%<G*&9N6e2+fgx7<93@ji>H5Ca1P4+9vm
zd;n7rLK8{+%j5z!YhOD?hW{TSl8g%=G?;W}U|`?^vlv(^AT*eaLa1l<0E<9~0zroV
zA15{n*VhUmtiAz}V-R3qV3>>~{st<}!N9<<5=ndqR2-y!Ka%(fxOj51flqQ;MWJ3k
zgGvg6N(Do4W_nR-Noi4Dd{Jt8W`3S@d~r!)Q3-~4d}?0G=1TS?#)%VHHs9t@Vdez+
gmXCpfL3}a?k3Q!Ns1?^HJMfru=0SNalN-1s0NrRve*gdg

delta 303
zcmew%IYV-SKI4py1`&)RPZQU!U8Q??61%0t;jr&#CkKX#p4vQz@jlDs)ocd7LW~Um
zKQe#;;{q@RA*2}?7`PxzmI??BCiM{NnLWTF5W+=};s3{pjl%VTLJSN%5HXe;5Sl@N
zfq@|%N&F2|oP&XZp%zJe2UHxSeln8y3AlK2a=D9vS3#IwK7&dMgGvQMyi25?qpznk
zLwvluUueAR=4b4IjGL`FRhT&o7#JA%7#J8tCui{Jb7nxzST%V8k2$9hl-Dx(0ha^-
D3%)el

diff --git a/linux-user/aarch64/vdso-le.so b/linux-user/aarch64/vdso-le.so
index aaedc9d85e568d5dadc9c394e9c4459f1f0c8c88..240802821c32943170f7de64f8a0b3ab2a21cd13 100755
GIT binary patch
delta 284
zcmbOs`9pGo2IG&7n(>SxE{t}Xmv61yy2m1;okeN+zms!1<2TP?yu+d>!~g<33?EoP
zGy-danLG?%CTFtQOWH9oFfcNF{J($^EDR^yCm&=JmyCkSdN9K!z>I>)AKAn?YZ(|A
zgcx`jZcKJ$7oU8CNq}+XWJYFj#{H86*`=)VQ!GM?o%He<R8kmJDj140(~D9|N{jO1
zi&E1w^Yh}1OA?DpFojd|QZ`qz$1_fxz_R%UhXOP20w%DP415d>4C0end9*oautP+y
XP5#IvJh_0GWpV(I0%P9fLLPMhUIj-_

delta 217
zcmew%IYV-S2IGv4n(>SxrfSl257}AgzHD2Uk@GeFM#i?fJDcY)-eH-%g3Uluh=GBD
zk>TV21&j<RKzi~=HgQQksH_JwiX?-}WJPvy$v_4M1|bF>h8rvpSpf*ekUse$lQ?7T
zWJYH3$pP#flRMaj`5YsQio#s<@)=Z87*r}YUuBPH+-$+Az|32~1kuIEz`!6nIh9A7
dGlLx>vTE{2CgI5i%q){P@F*|}O}@yZ4gelKFsuLo

diff --git a/linux-user/aarch64/vdso.S b/linux-user/aarch64/vdso.S
index a0ac1487b0..59dd94dc8f 100644
--- a/linux-user/aarch64/vdso.S
+++ b/linux-user/aarch64/vdso.S
@@ -71,5 +71,7 @@ vdso_syscall __kernel_clock_getres, __NR_clock_getres
 __kernel_rt_sigreturn:
 	/* No BTI C insn here -- we arrive via RET. */
 	mov	x8, #__NR_rt_sigreturn
+sigreturn_region_start:
 	svc	#0
+sigreturn_region_end:
 endf	__kernel_rt_sigreturn
diff --git a/linux-user/arm/vdso-be32.so b/linux-user/arm/vdso-be32.so
index b896d3d545ebf91942038831a9535b023137a86b..6d71cd9c36d185e48810140d6b1b12a1c8f95900 100755
GIT binary patch
delta 322
zcmca1vP5)(GUK0#DhEXNi816dstG5g=$qZlvG_W5!PJ@GH~u)rBFECe00BG<3=C=v
z3@i&ETm}%|dh#At`FcAB28JIXQAURU9~l@J+!+{H8W|WE6qp#ms=^r<n85N33=CWh
z3=CNe42(CB)Wd9G5QOOOVqjp&XJBC95Q6BR$H2gn3epSZZ(?9ziAL}}7)~-Uumr*d
zl9Q_{vjRdb^zs>0N*IbW(~D9|N{jO1i&E1w^Yh}1OA?E)2&d+yY%XJKWahlUz`(%I
iz`!6eiA$QbgMoqJ-ed(XWzjSS28JmhM?*0qhz0=i2tZ~4

delta 232
zcmZ1?dP8J_GUJAcDhEV9iF@2Qn5bfLZGwFE!TAAV%KxoCZv1hKW%4~%*?J)c28JID
z3=9m64F5keFfd3nFt9W-Ffb@EF);8jFfeE{Fff7T85kJ27#JAr7#J9DAgK=lu|Zf6
zqCbv-fhC`Tfq_E^qQ8iNfh85B7s_vAU|@+x@MRe0GBB_N!Ud9(10wR1Epzqq8B|I(
nA7X1{=G?%*z`)PIz#ul+hfA6@gMooz)8rg3Wk#vV6SzbG9N{eY

diff --git a/linux-user/arm/vdso-be8.so b/linux-user/arm/vdso-be8.so
index 784b7bdb2a9308671bbc4c1e38ab4eac568ea6f7..6446a96fcf63747f1c171a1bc99210d2268d971a 100755
GIT binary patch
delta 322
zcmca1vP5)(GUK0#DhEX5v@5rDpV-zdaE;R<z_ZbM!hvTqH~u)rBFECe00BG<3=C=v
z3@i&ETm}%|dh#At`FcAB28JIXQAURU9~l@J+!+{H8W|WE6qp#ms=^r<n85N33=CWh
z3=CNe42(CB)Wd9G5QOOOVqjp&XJBC95Q6BR$H2gn3epSZZ(?9ziAL}}7)~-Uumr*d
zl9N+iLUPRv_3{~1N*IbW(~D9|N{jO1i&E1w^Yh}1OA?E)2&d+yY%XJKWahlUz`(%I
iz`!6eiA$QbgMoqJ-ed(XWzjSS28JmhM?*0qhz0=UYCz-w

delta 232
zcmZ1?dP8J_GUJAcDhEW2jvP6cAn`ta_SEXT7Yg+lW8zuPZ2WPIW%4~%*?J)c28JID
z3=9m64F5keFfd3nFt9W-Ffb@EF);8jFfeE{Fff7T85kJ27#JAr7#J9DAgK=lu|Zf6
zqCbv-fhC`Tfq_E^qQ8iNfh85B7s_vAU|@+x@MRe0GBB_N!Ud9(&2t<BJc9J{8B|I(
nA7X1{=G?%*z`)PIz#ul+hfA6@gMooz)8rg3Wk#vV6SzbGH;pXJ

diff --git a/linux-user/arm/vdso-le.so b/linux-user/arm/vdso-le.so
index 38d3d51047372391b3125c3f9f6ea5401f04bba1..d34e577b69e6cb22a90982570d5e66a1fa22e195 100755
GIT binary patch
delta 309
zcmca1vP5)(0^^^Fiibto-btLS^tfAl`qJz2U8lY?Z_Q&mz46Bp7TE?C1}NZRP-9?V
zSb)U0p1hM)zTS?3f#C;K4I{(H|LzP742>)d3<?Yk3``6>4B;SoCa3}iE`}@y28J7q
z5I#tK1B3}C1sOj6?_ywJ$Y)_-;9y{25MtnAn8(1tkjlcqzy;-RVqjp1M)18EPBJhs
z1R?|&7?P6>jG`hcy!7%JR7x0%Gt-MwOG=CK;)_z#GxPJ}i%SxVun4E-rED%^t7GQ8
hz{tSB&%nSSG5Ig2G;0SN1H-+^vRulHX_Fnf!~sb#M6&<@

delta 239
zcmZ1?dP8J_0^^2>iibs{A2M=DJTKY)!fEEqs*sO2HQxVB+W6xL%j7$(GW9|X3=BUQ
zAb^qK<9}%e28Ko!1_lKN1_mYu9tLfYJQGBofq{#`j)8&U1|x(IQXc|gf=NM!kN@Ks
z7#Q+d7#KJh7#M^Yco>Qp7#LDnKsq7(HU<WUXarxLVJ-s$Lm)zcfgw3L(<?YPEmJR_
vL8WB#A+|bZ&JBzV4EziX3}TZ#xujV$*ccc#O`galJh_HTfKh64FPAs~Chsqh

diff --git a/linux-user/arm/vdso.S b/linux-user/arm/vdso.S
index b3bb6491dc..d84d964730 100644
--- a/linux-user/arm/vdso.S
+++ b/linux-user/arm/vdso.S
@@ -140,6 +140,7 @@ SYSCALL __vdso_gettimeofday, __NR_gettimeofday
 
 	.balign	16
 sigreturn_codes:
+sigreturn_region_start:
 	/* [EO]ABI sigreturn */
 	slot	0
 	raw_syscall __NR_sigreturn
@@ -172,3 +173,4 @@ sigreturn_codes:
 
 	.balign	16
 endf sigreturn_codes
+sigreturn_region_end:
diff --git a/linux-user/hppa/vdso.S b/linux-user/hppa/vdso.S
index 5be14d2f70..a6f8da2981 100644
--- a/linux-user/hppa/vdso.S
+++ b/linux-user/hppa/vdso.S
@@ -156,8 +156,10 @@
 __kernel_sigtramp_rt:
 	ldi	0, %r25
 	ldi	__NR_rt_sigreturn, %r20
+sigreturn_region_start:
 	be,l	0x100(%sr2, %r0), %sr0, %r31
 	nop
+sigreturn_region_end:
 
 	.cfi_endproc
 	.size	__kernel_sigtramp_rt, . - __kernel_sigtramp_rt
diff --git a/linux-user/hppa/vdso.so b/linux-user/hppa/vdso.so
index e1ddd70c37e9eb6871c21d538dcce0a1e736a918..68baf80fd3943cc2d847744f13637810788fafc1 100755
GIT binary patch
delta 287
zcmdlXut9Kw5)+%jM3n;~wM-GFSH2~uzvW>xy0IuFLc1|}=f)rNnd=!qfQ8}zM+OE4
z9tH;H2_Qa%&7jP{z&rzq4`nhiK-F6?FfjZ82{J<TJ2EgZfy6*UTnr2hAq))69SjT%
z0!(1D88R6d7#Dyfq3Y`y7#u-d1_nWp0m;eU&K61DDSG(~#hK|vsU@XFdGST5>6!U?
z@x>*HMJ1TRsd*`zAFwbpZhpl2m60=nfq{XKfq_AE@&k4$HdX}&28OOl9Ll1r7#J8@
LAQpj1Mi2=A-<v%*

delta 189
zcmdlWxI<uq5)<o=i7E#~rvH6#AjIVmuSc*(c0!xlbp5Snr5k_DXZHNTz`(%3$ngIo
z0|NsW0|S!<h!0^i$TBc6cQ7z82rw})@Gvki7%?y~E&$0x)q8;0AS}r6|KsLxR%XV{
z(QIEBH5C{b82A_%7z7y@7+66185kHi85kItL24nG<pBc&L-6DZ4rNhe1_p)}h$xt3
G1d#yy5g+>i

diff --git a/linux-user/i386/vdso.S b/linux-user/i386/vdso.S
index e7a1f333a1..8df77b5a94 100644
--- a/linux-user/i386/vdso.S
+++ b/linux-user/i386/vdso.S
@@ -114,6 +114,7 @@ vdso_syscall3 __vdso_getcpu, __NR_gettimeofday
  */
 	nop
 
+sigreturn_region_start:
 __kernel_sigreturn:
 	popl	%eax	/* pop sig */
 	.cfi_adjust_cfa_offset -4
@@ -128,6 +129,7 @@ __kernel_rt_sigreturn:
 	movl	$__NR_rt_sigreturn, %eax
 	int	$0x80
 endf	__kernel_rt_sigreturn
+sigreturn_region_end:
 
 	.cfi_endproc
 
diff --git a/linux-user/i386/vdso.so b/linux-user/i386/vdso.so
index bdece5dfcf8da036d013262d4e37208350283cfa..e01c3818d0d2e4871cf39b2ddd21043d0695d07e 100755
GIT binary patch
delta 444
zcmew$@<Mci0^@{<iibs3xp}^6>=kzJ5{@jp{@LTJl;I7NjX(ad)H6T<3&Y3%JPZsB
z=UAZv4BQOL3=9nSkoYhe5Dijq!N9=q1H@rqU|?imVsK<&VBlbZ3NUaogus{#3=Dz{
zAOFWOFffF$GB7YRFfa%)a5EGzFw`?lW@TUyfeN%RFfeRqWnd74@+YAgFo%JG;W{e=
z13OfH69WT7J(B)o3=9m}Nc_7D3=H8&{7+C1azOR7GP*J_EN5k45P%9WBqxWZriFPM
z>g6*OXQmgWmXsFd#TTWfXXfX{7ndX!m0${|=A~>tz}CRH*`DJpqm}|A0|PGu#EGDw
i0GZ6m0P!>2H|z`yf{c^RxRfLWIT#q~;NqZQgm3`nj75h4

delta 302
zcmaDM`axuZ0;9x4#ls?<CqE_{P2YA{=Ej`0AMPhV{I5Od%*G#oSn7W;Kma2H69X3m
z0|N&OgwMdh$sh}3GB7X*GJO26&cMJB!pgwF%)r1P#K6s9$-uxcnU#S-1j_eiU|`tJ
z%D^B7<wv9GPi0_WxX#MJzz&tKW?=ATs7ErOpMilP8;QS+fq@|$iNBkHf#Do00|N)t
zfO8BC49i&=7zCjF&F1V4jGK3GoMGgAz`(%3%fP_EJh_)kn(Y7^1H&zb$?Le3BxbQQ
MFw`MAj1kHP0BIC2kN^Mx

diff --git a/linux-user/loongarch64/vdso.S b/linux-user/loongarch64/vdso.S
index 780a5fda12..2409d95476 100644
--- a/linux-user/loongarch64/vdso.S
+++ b/linux-user/loongarch64/vdso.S
@@ -125,6 +125,8 @@ vdso_syscall __vdso_getcpu, __NR_getcpu
 
 __vdso_rt_sigreturn:
 	li.w	$a7, __NR_rt_sigreturn
+sigreturn_region_start:
 	syscall	0
+sigreturn_region_end:
 	.cfi_endproc
 endf __vdso_rt_sigreturn
diff --git a/linux-user/loongarch64/vdso.so b/linux-user/loongarch64/vdso.so
index 7c2de6c50e706164225e82f652d4becc04c71ff0..3704834f0d5d4439a5f1020e06d9a52c0a740555 100755
GIT binary patch
delta 358
zcmaDM-5@(bgQ<aQqm~_`i0-YcC$ne2ny5DIdBUo>Yp!s=SQWathS7noo`vD#e+D$b
z1LpHE)UbgWa6%c(;$dh&69)-nGsl8~fq{|X<NpRmkO~BLgo(2;Ouo&|D;W)z;$rx~
z0%pL8yvd9l;*2em1)0SeXG|_+7H3>G*^ybCao6NT4spqI3=9lH3_J`0P}e|Q&A{+@
z@<a{^v*cuxvLx3`KfQd0;>`4-)RNMoy!fKj^vwLc_~Mepq7qEu)V!3<D>xb$H>-0g
kGV^vYLEOQ|z`!6nIh0qMlY<i?@@{e`uQ}tl$p?AW0oIF2fB*mh

delta 205
zcmZpWeIY$TgXsn5MlCx=5mA9%)#h=o$th|*U-GxV_f~Om__Vo((Sc2rk>TV221W)H
zz%|*BLtIh?EXKv~fd$Nf6Xuf>Im8)#Ckrx*GbT<hWEN-4pX|si&e%NpAcwf*bOr_n
zAqF0X05*sQ9tg#-X7Wc4iOmk2^^BVja49hJYA``0_!t-%1Sh}c)#hBm0TJ0gS&`42
OGoBN|YnhzLBM$&32PcRC

diff --git a/linux-user/ppc/vdso-32.so b/linux-user/ppc/vdso-32.so
index 0dc55e0dddff618b954dbb939335e99956daf64a..03476052fbeb13b7d54651ff9d2447a07ceca251 100755
GIT binary patch
delta 438
zcmX>jenet|GUJhnDhEWA#S8BnzBO%iakv;8rJgEnt>YiE@dr0sJp%}^F#P|>z`(%6
zz`!N};zQUB$_xx_I!JsdlYs%M-hzRF;Ri^Nk%57Ufq}u1fr0rAh|j>lz{SA85W>K~
zqygeHg0wI&WP#WqEC{i$oPnX96{LYj2y8h+I|Bpj1CZrV{#*tIHWda21`a5HBLf2)
z3zGaP1_ss>Nc;y33~T}n3=Aw#_1~Z#g6e1FWnf?hIT&gmqcnpP1M3yI0m;cGX}SJs
zg?jl6#hK|vsU@XFdGST5>6!U?@x>*HMJ1TRsd*`z&#<p%++4=_l~EJqc0L9M1`&`O
q7#J8pZsBBLU|<G$8iF}^7#J9hCQsp3663UEU|?v02!lyR5D5U!KS6c?

delta 281
zcmX>iaYlTCGNaE#l>;J~u3G}Hz1nkb!uCykg)t8^X6|Be-uQ!?t^NlC0|Nsi0|OHS
z0|OTW1M?dYAHrskWnf^^0Pz_a7+4q>7>q$|5Ef+k|B-=#!GVE+6{Ma=h=GBJfq@}_
zfr0e_0|Nt$pT@wzrozC$zyX!7VqjncnFEub%)sEqdICwqN(Kft0R{#J7N~~(3=C`%
zNCsSEU|<C~7-ql|1_stEF#VgIIaV`ne$V-Zk#hk90|Ore1B1ZiH{4Qe>}MDl7=BOY
O;Zb7ZI6m2cM+5+8I4pDk

diff --git a/linux-user/ppc/vdso-64.so b/linux-user/ppc/vdso-64.so
index ac1ab2582e4675979ffca3ce90dce17df579ab2a..b89f2a0e018a7bb6923db267a746006d341f6bb1 100755
GIT binary patch
delta 436
zcmdlXcR_xFKI4Ur1{RDWTs14(R3|H4uzIPrn<4t+7Q5Ac<(q35C$O`yF#P{Gu~FER
zhk=0sgc%qZ*iSGZfHIQ!1%xmI15Bd@BLf2yM1rvaLW4<11_lN$FpGiZ1%w8ZA%YMa
z>k|bKHm(3mLHLD8;&YJ1+mXauki_RAi64N9voJ6)Y(^4?`G|vof#DQHJQk#seG7<$
zdhrHC0wlsd0YrkulasScO$t-f_3{~tGt-MwOG=CK;)_z#GxPJ}i%SxVN-%{}^HMhd
v;B02xT*a-*%-O-fz`)1Az#u$%1)m-lR|M4L_mdy+nQ?KuL%A)J6?i28zlume

delta 307
zcmca0ze8?<KBL7(0}Dox#cn4o*9x#KHrQ%*NT0FR@ARH07dO{1PGC1-WME)o00YJb
zFa;sF7#J8pn1O+T<po3tOv(x}{Qo$yQMg`9fPsMrEX2UR0z!lNR!HJ=ki-L!#9NTW
z(~!guK*d=Y7#M1h#7{uQIT#oiCPT#4Ktk+WKqLdiAqycAAQAQnAQB|Lxu2_<akDUw
m3Nxn$0|Nse0|Nv9WCwmdF3ulNB|9cp@S8DlZJ4})UjYErdM3C4

diff --git a/linux-user/ppc/vdso-64le.so b/linux-user/ppc/vdso-64le.so
index 424abb4290b7d3100e9dede2f3059483608ba703..22499d2701530ee2aa003ae5fecce695441a5f77 100755
GIT binary patch
delta 383
zcmdlXcR_xF2IGZ|n)Zw$d#8TmX85vf$%g!(v+1T^wTi0NT-{v5IDx&Mh2i6W1~k9}
z=JPO|U<Whcgff`L!*Bsj93+g*918{p21W)Zh6YBE3IuipGr1UEurN&4=H!(OVPIeo
z#Nv*`$sd`-B?}oC7z7x280J82g}9D^p?$I<v$*73sO$l#EDP9d28PX(H*$(Io|=4+
zNu2S<<UnQ#v*ct0A1_0bT)ljT;>`4-)RNMoy!fKj^vwLc_~Mepq7qEu)V!3<KR6p0
sH<xoOGV^vYLCof3U|<lQyp&IyGlB~u@_zD7K66fYZV0bsvLvrO0GX9Yi2wiq

delta 220
zcmca0ze8?<2BXDBO?yU>es=TCa!<lv%$)wF@KG}h)9a^|6F1i|PGA>hWME=wU}Qi6
zT$39)#U*7K7#IW@KK@6MVqjp<n*5PTT+)hxfkA+QhhYvoM4ksiF$7FjWEPi9gUTL&
z%CbOZYbFbFi8D@~e2__catO2N<_TQ&jGF~`6qtE6m>^2{7#JA%C)@ICbN=9ji0qhL
R$ZyWMfeXTGnY@u#9ssSSC))r3

diff --git a/linux-user/ppc/vdso.S b/linux-user/ppc/vdso.S
index 2e79ea9808..e9256a2dea 100644
--- a/linux-user/ppc/vdso.S
+++ b/linux-user/ppc/vdso.S
@@ -220,6 +220,7 @@ endf	__kernel_sync_dicache
 
 	nop
 
+sigreturn_region_start:
 __kernel_sigtramp_rt:
 	raw_syscall __NR_rt_sigreturn
 endf	__kernel_sigtramp_rt
@@ -235,5 +236,6 @@ __kernel_sigtramp32:
 	raw_syscall __NR_sigreturn
 endf	__kernel_sigtramp32
 #endif
+sigreturn_region_end:
 
 	.cfi_endproc
diff --git a/linux-user/riscv/vdso-32.so b/linux-user/riscv/vdso-32.so
index c2ce2a4757900a16b891bb98f7a027ac30c47a5f..4818a994f0394d83ca5e8213f6e2d2d3ee2f504c 100755
GIT binary patch
delta 447
zcmZ1?zC~h!0#gs?L?tIipNXmSMas5*X}YtK&*i=K5rz{7_FXjfZHe71!C1(`<ITXp
zP?TAmT*koYIC(0oDQA3DZf<FgVS&NqMn=)e4_M#SdonOEG_W#20S`k00|P?`5+5o7
zrdSw0{x4-<V31%0a~T*JKK`#`U|^U4RS)9NU|?XF!3>dSVBlg{&A`Cmzy#rg<PSoa
zU{a9bWBva#3=9k<tPBhs3=9lH3_J`E7#J9SurM%0K>1%77#K2G85nq=d?rSSgJJ5$
z7#SF1kmR)(85jbP_zcO(F8;+KSw?#K3@Q~xWyVICMg@lPxkd#B@rg#0SF$Ra!b63j
zI5WK{wWPEtFTN->Ju^QqzPKc@s033uH7{lJEcPzO%}Si#7#V#gPvjP!tivt9dxe#O
k;Q=E913v=;gZN}mZfUkH><kR{jFYptl^8!y?&TH-0AIRdjsO4v

delta 322
zcmdlYu|#}=0@ELkiAqk4&J$DTi!jW8dws_KY9IfGb=Q{hIhCuqgj#KuU@T<eabjR#
zD9S8OE@NP{m^_u$bn<0Z(aFzQ-%kF*CQ#4Mz`!8E$N&b63?KhXFfcGoU<Gp-Kzt(x
z28J2T5IzF~7lSJU1A_w-gb$LBhA_dTAj8N1X$%YuC9Dh#91IK$LJT|%RSXOaKUf$T
zBB1;}1_p)<Rt5$h2;ZJz4g&*21CoXf3=9l02n7sB7#J7=koXMA$%#2;0ok5<`3x!*
zn>9GP7&mX>{KClSJXw)Pc=8@@0p2sL3=9Vt85lr*6P<jMTbi|poq^#dSe}PRfH8Hl
HERQ$<{!~8}

diff --git a/linux-user/riscv/vdso-64.so b/linux-user/riscv/vdso-64.so
index ae49f5b043b5941b9d304a056c2b50c185f413b0..cc6f7e974be67bd08ed412eccb9af22138385e56 100755
GIT binary patch
delta 453
zcmaDM*P$>$gYm>f&3s0mjWgL9MZUOZ%%7)STEdup@5PH(j}Av>WiW2u!l=l~<ITXp
zP?TAmT*koYIQb!)DQA3DZf<FgVS&NqiA=JaP1sWy<vkfdfQR7>8;C~W1Td3lV!i0(
zIUFL4rIR;uh)dQnFfcGOeEk0aP4SG$4>`moS3_kFFoX5NiGz~`ImH>zOrFRr&iG)m
zBd2)%7X}6fAqF0XEl_iKplX>IA>uH{a6rYypyDgg)N4V-=b(u*Bqt}CBqth1=;br0
zR1}q&nPeIj7{=!s6&S=P8Wl|b#-?Bj4-1Ck%=DtvlG38Q_@dPG%>2Cg;*!Lo5=`OL
zyp+wyI2SQ)PUBW$X7rid$!9LAzz%WZ1ttj1&%nSSKKUx2HrEGEh=@JoWG;R)PJM0&
KciLo5UU>jXo?@H;

delta 329
zcmeBBcp*1IgHdCmW<I0y<U|hPiEF-ytaVNHbN5=kU~#zA*KgM@2P~MlaogrCjEby0
zP7DkTMVZCPWekiKlOM8~PM*jlx7mh0g>mu)4hczq1_lO3hL8VuFfyP3iOGzd;*v&S
zF)juLRxkrjxK1|Y6qk%<U|<kr`1l_#3}vKEp2#dNS;fG>AjH7KFo6vs%mbkq`X*20
z6la_>IgweMal>RoW^uJ6P?dAgR5BzdXPUaXSOn?iGpJN-PT^X_xS4}Tff?fK$u|5d
rq7v*7Qx`BnXpnbACztYTbMD}Th};B)(BwV*Dx4F!AR^NsBD_2R082oz

diff --git a/linux-user/riscv/vdso.S b/linux-user/riscv/vdso.S
index c37275233a..1d780db771 100644
--- a/linux-user/riscv/vdso.S
+++ b/linux-user/riscv/vdso.S
@@ -181,7 +181,9 @@ endf __vdso_flush_icache
 	nop
 
 __vdso_rt_sigreturn:
+sigreturn_region_start:
 	raw_syscall __NR_rt_sigreturn
+sigreturn_region_end:
 endf __vdso_rt_sigreturn
 
 	.cfi_endproc
diff --git a/linux-user/s390x/vdso.S b/linux-user/s390x/vdso.S
index 3332492477..c60e9ed086 100644
--- a/linux-user/s390x/vdso.S
+++ b/linux-user/s390x/vdso.S
@@ -52,6 +52,7 @@ vdso_syscall __kernel_getcpu, __NR_getcpu
  * by all users.  Without it we get the fallback signal frame handling.
  */
 
+sigreturn_region_start:
 __kernel_sigreturn:
 	raw_syscall __NR_sigreturn
 endf	__kernel_sigreturn
@@ -59,3 +60,4 @@ endf	__kernel_sigreturn
 __kernel_rt_sigreturn:
 	raw_syscall __NR_rt_sigreturn
 endf	__kernel_rt_sigreturn
+sigreturn_region_end:
diff --git a/linux-user/s390x/vdso.so b/linux-user/s390x/vdso.so
index 64130f6f335269b03291653d006225b365be9cd9..a669a6b7dda7b60bb8aa125bd70c8ed3384da841 100755
GIT binary patch
delta 435
zcmeB>ULZ3;kBLiRqk#pZh})fO-I~!HOHa>f*qfa!daD0cMEm9%#s{n{EDZlYPHYr5
z<zZl80AU6O1~wT61W-m2S3n3eFhDidTQD;G{|J#_Y=F>U(vg9IfeXxHV0i(d!DI+R
zJ+lK?1VUs9Ashe^VPF6`qzWO<`UENg5}yDO*8>T$$$>})1_mYu28Lx236Kcu1`x@>
zz#zfEz_3RU;?<Os2nBGjf;8Sih_jx6YLsC}P7ZTQ3k)>X%V#LgOfO0;DJ{y2FG@|%
z%+HH2E=epZ!4yu-OWEwf(agB{6sIaPX9oiV10MqegUI9`Jo=m~pay@QY`|;IIUCAr
JnOwjv0RVWSNmu{?

delta 305
zcmZ1=(;+=UkBPHmqk#pZ$eP<0^W+mAZmVidw^)#U>fWD6>!)n4VSK<^&&crqBLf&P
zHh?Jz!NtJ90KyCm3@k4oLSRxBp`O_RECL~ng%}ukAWSw0#lRrLz`)>)5NCY?l>muH
zLdA6%7#P^(pb|_B3=H{D2?hoR)(uc`2?hp+RzZgUA15{n>rO%_U;~*1QUlVs6d}%f
y0wl=5z#y~vK1Va-=437vW=;(T1_nL`1_pu26L|GGJ)kP~Og_PD&d4%}PXPe494hnx


From 2c75137623cb60f2ac3cedfff077d00dc977b842 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 4 Sep 2025 12:11:45 +0200
Subject: [PATCH 0551/2396] linux-user: Populate
 vdso_sigreturn_region_{start,end} from sigtramp page

When a target does not support a vdso, we generate a sigtramp page.
The only thing on this page is a (set of) signal return syscalls.
We do not need to narrowly restrict the vdso_sigreturn_region;
simply record the entire page for all such targets.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/elfload.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 28f0909d1a..1370ec59be 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -1974,6 +1974,8 @@ int load_elf_binary(struct linux_binprm *bprm, struct image_info *info)
 
         setup_sigtramp(tramp_page);
         target_mprotect(tramp_page, TARGET_PAGE_SIZE, PROT_READ | PROT_EXEC);
+        vdso_sigreturn_region_start = tramp_page;
+        vdso_sigreturn_region_end = tramp_page + TARGET_PAGE_SIZE;
     }
 
     bprm->p = create_elf_tables(bprm->p, bprm->argc, bprm->envc, &ehdr, info,

From c8e5aed246914ff6438839350e414a3bea5a8041 Mon Sep 17 00:00:00 2001
From: Arusekk <floss@arusekk.pl>
Date: Fri, 11 Jul 2025 18:48:29 +0200
Subject: [PATCH 0552/2396] linux-user: Add syscall dispatch support

This commit adds support for the `prctl(PR_SET_SYSCALL_USER_DISPATCH)`
function in the Linux userspace emulator.

It is implemented as a fully host-independent function, by forcing
a SIGSYS early during syscall handling, if the PC is outside the
allowed range.

Since disabled SUD is indistinguishable from enabled SUD with
always-allowed region length == ~0, this encoding is used
instead of introducing a new flag.

Tested on [uglendix][1], will probably also apply to software like
tiny-wine, rpcsx, limbo, lazypoline, vicar, sysfail and endokernel,
to name a few.

[1]: https://sr.ht/~arusekk/uglendix

Signed-off-by: Arusekk <floss@arusekk.pl>
Message-ID: <20250711225226.14652-1-floss@arusekk.pl>
[rth: Split out is_vdso_sigreturn region matching and other minor tweaks.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/main.c          |  2 +
 linux-user/qemu.h          |  5 +++
 linux-user/signal-common.h |  5 +++
 linux-user/syscall.c       | 76 +++++++++++++++++++++++++++++++++++++-
 linux-user/syscall_defs.h  |  6 +++
 5 files changed, 93 insertions(+), 1 deletion(-)

diff --git a/linux-user/main.c b/linux-user/main.c
index 4ddfc9a619..db751c0757 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -228,6 +228,8 @@ void init_task_state(TaskState *ts)
         ts->start_boottime += bt.tv_nsec * (uint64_t) ticks_per_sec /
                               NANOSECONDS_PER_SECOND;
     }
+
+    ts->sys_dispatch_len = -1;
 }
 
 CPUArchState *cpu_copy(CPUArchState *env)
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index e4dca0c20f..cabb7bd6a8 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -155,6 +155,11 @@ struct TaskState {
     /* This thread's sigaltstack, if it has one */
     struct target_sigaltstack sigaltstack_used;
 
+    /* This thread's SYSCALL_USER_DISPATCH state, len=~0 means disabled */
+    vaddr sys_dispatch;
+    vaddr sys_dispatch_selector;
+    abi_ulong sys_dispatch_len;
+
     /* Start time of task after system boot in clock ticks */
     uint64_t start_boottime;
 };
diff --git a/linux-user/signal-common.h b/linux-user/signal-common.h
index 0b04868727..8a44714251 100644
--- a/linux-user/signal-common.h
+++ b/linux-user/signal-common.h
@@ -28,6 +28,11 @@ extern abi_ulong default_rt_sigreturn;
 extern abi_ulong vdso_sigreturn_region_start;
 extern abi_ulong vdso_sigreturn_region_end;
 
+static inline bool is_vdso_sigreturn(abi_ulong pc)
+{
+    return pc >= vdso_sigreturn_region_start && pc < vdso_sigreturn_region_end;
+}
+
 void setup_sigtramp(abi_ulong tramp_page);
 
 int on_sig_stack(unsigned long sp);
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 91360a072c..9098cdb9fa 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6344,6 +6344,10 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
 #endif
 #ifndef PR_SET_SYSCALL_USER_DISPATCH
 # define PR_SET_SYSCALL_USER_DISPATCH 59
+# define PR_SYS_DISPATCH_OFF 0
+# define PR_SYS_DISPATCH_ON 1
+# define SYSCALL_DISPATCH_FILTER_ALLOW 0
+# define SYSCALL_DISPATCH_FILTER_BLOCK 1
 #endif
 #ifndef PR_SME_SET_VL
 # define PR_SME_SET_VL  63
@@ -6398,6 +6402,36 @@ static abi_long do_prctl_inval1(CPUArchState *env, abi_long arg2)
 #define do_prctl_sme_set_vl do_prctl_inval1
 #endif
 
+static abi_long do_prctl_syscall_user_dispatch(CPUArchState *env,
+                                               abi_ulong arg2, abi_ulong arg3,
+                                               abi_ulong arg4, abi_ulong arg5)
+{
+    CPUState *cpu = env_cpu(env);
+    TaskState *ts = get_task_state(cpu);
+
+    switch (arg2) {
+    case PR_SYS_DISPATCH_OFF:
+        if (arg3 || arg4 || arg5) {
+            return -TARGET_EINVAL;
+        }
+        ts->sys_dispatch_len = -1;
+        return 0;
+    case PR_SYS_DISPATCH_ON:
+        if (arg3 && arg3 + arg4 <= arg3) {
+            return -TARGET_EINVAL;
+        }
+        if (arg5 && !access_ok(cpu, VERIFY_READ, arg5, 1)) {
+            return -TARGET_EFAULT;
+        }
+        ts->sys_dispatch = arg3;
+        ts->sys_dispatch_len = arg4;
+        ts->sys_dispatch_selector = arg5;
+        return 0;
+    default:
+        return -TARGET_EINVAL;
+    }
+}
+
 static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
                          abi_long arg3, abi_long arg4, abi_long arg5)
 {
@@ -6473,6 +6507,9 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
     case PR_SET_UNALIGN:
         return do_prctl_set_unalign(env, arg2);
 
+    case PR_SET_SYSCALL_USER_DISPATCH:
+        return do_prctl_syscall_user_dispatch(env, arg2, arg3, arg4, arg5);
+
     case PR_CAP_AMBIENT:
     case PR_CAPBSET_READ:
     case PR_CAPBSET_DROP:
@@ -6527,7 +6564,6 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
     case PR_SET_MM:
     case PR_GET_SECCOMP:
     case PR_SET_SECCOMP:
-    case PR_SET_SYSCALL_USER_DISPATCH:
     case PR_GET_THP_DISABLE:
     case PR_SET_THP_DISABLE:
     case PR_GET_TSC:
@@ -13897,12 +13933,46 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
     return ret;
 }
 
+static bool sys_dispatch(CPUState *cpu, TaskState *ts)
+{
+    abi_ptr pc;
+
+    if (likely(ts->sys_dispatch_len == -1)) {
+        return false;
+    }
+
+    pc = cpu->cc->get_pc(cpu);
+    if (likely(pc - ts->sys_dispatch < ts->sys_dispatch_len)) {
+        return false;
+    }
+    if (unlikely(is_vdso_sigreturn(pc))) {
+        return false;
+    }
+    if (likely(ts->sys_dispatch_selector)) {
+        uint8_t sb;
+        if (get_user_u8(sb, ts->sys_dispatch_selector)) {
+            force_sig(TARGET_SIGSEGV);
+            return true;
+        }
+        if (likely(sb == SYSCALL_DISPATCH_FILTER_ALLOW)) {
+            return false;
+        }
+        if (unlikely(sb != SYSCALL_DISPATCH_FILTER_BLOCK)) {
+            force_sig(TARGET_SIGSYS);
+            return true;
+        }
+    }
+    force_sig_fault(TARGET_SIGSYS, TARGET_SYS_USER_DISPATCH, pc);
+    return true;
+}
+
 abi_long do_syscall(CPUArchState *cpu_env, int num, abi_long arg1,
                     abi_long arg2, abi_long arg3, abi_long arg4,
                     abi_long arg5, abi_long arg6, abi_long arg7,
                     abi_long arg8)
 {
     CPUState *cpu = env_cpu(cpu_env);
+    TaskState *ts = get_task_state(cpu);
     abi_long ret;
 
 #ifdef DEBUG_ERESTARTSYS
@@ -13919,6 +13989,10 @@ abi_long do_syscall(CPUArchState *cpu_env, int num, abi_long arg1,
     }
 #endif
 
+    if (sys_dispatch(cpu, ts)) {
+        return -QEMU_ESIGRETURN;
+    }
+
     record_syscall_start(cpu, num, arg1,
                          arg2, arg3, arg4, arg5, arg6, arg7, arg8);
 
diff --git a/linux-user/syscall_defs.h b/linux-user/syscall_defs.h
index df26a2d28f..cd9ff709b8 100644
--- a/linux-user/syscall_defs.h
+++ b/linux-user/syscall_defs.h
@@ -689,6 +689,12 @@ typedef struct target_siginfo {
 #define TARGET_TRAP_HWBKPT      (4)     /* hardware breakpoint/watchpoint */
 #define TARGET_TRAP_UNK         (5)     /* undiagnosed trap */
 
+/*
+ * SIGSYS si_codes
+ */
+#define TARGET_SYS_SECCOMP       (1)  /* seccomp triggered */
+#define TARGET_SYS_USER_DISPATCH (2)  /* syscall user dispatch triggered */
+
 /*
  * SIGEMT si_codes
  */

From b7cd0a1821adf9906c5edb248394bb2a95482656 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 11:30:19 +0200
Subject: [PATCH 0553/2396] target/sparc: Allow TRANS macro with no extra
 arguments

Use ## to drop the preceding comma if __VA_ARGS__ is empty.

Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index b922e53bf1..336583beab 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -2487,7 +2487,7 @@ static int extract_qfpreg(DisasContext *dc, int x)
 
 #define TRANS(NAME, AVAIL, FUNC, ...) \
     static bool trans_##NAME(DisasContext *dc, arg_##NAME *a) \
-    { return avail_##AVAIL(dc) && FUNC(dc, __VA_ARGS__); }
+    { return avail_##AVAIL(dc) && FUNC(dc, ## __VA_ARGS__); }
 
 #define avail_ALL(C)      true
 #ifdef TARGET_SPARC64

From b6cdd6c6050567c02a3b3cd428f85bb79d7455aa Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 06:59:43 +0200
Subject: [PATCH 0554/2396] target/sparc: Loosen decode of STBAR for v8

Solaris 8 appears to have a bug whereby it executes v9 MEMBAR
instructions when booting a freshly installed image. According
to the SPARC v8 architecture manual, whilst bits 13 and bits 12-0
of the "Read State Register Instructions" are notionally zero,
they are marked as unused (i.e. ignored).

Fixes: af25071c1d ("target/sparc: Move RDASR, STBAR, MEMBAR to decodetree")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3097
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/insns.decode | 13 ++++++++++++-
 target/sparc/translate.c  |  5 ++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode
index 9e39d23273..1b1b85e9c2 100644
--- a/target/sparc/insns.decode
+++ b/target/sparc/insns.decode
@@ -88,7 +88,7 @@ CALL    01 i:s30
 
 {
   [
-    STBAR           10 00000 101000 01111 0 0000000000000
+    STBAR_v9        10 00000 101000 01111 0 0000000000000
     MEMBAR          10 00000 101000 01111 1 000000 cmask:3 mmask:4
 
     RDCCR           10 rd:5  101000 00010 0 0000000000000
@@ -107,6 +107,17 @@ CALL    01 i:s30
     RDSTICK_CMPR    10 rd:5  101000 11001 0 0000000000000
     RDSTRAND_STATUS 10 rd:5  101000 11010 0 0000000000000
   ]
+
+  # The v8 manual, section B.30 STBAR instruction, says
+  # bits [12:0] are ignored, but bit 13 must be 0.
+  # However, section B.28 Read State Register Instruction has a
+  # comment that RDASR with rs1 = 15, rd = 0 is STBAR.  Here,
+  # bit 13 is also ignored and rd != 0 is merely reserved.
+  #
+  # Solaris 8 executes v9 MEMBAR instruction 0x8143e008 during boot.
+  # This confirms that bit 13 is ignored, as 0x8143c000 is STBAR.
+  STBAR_v8          10 ----- 101000 01111 - -------------
+
   # Before v8, all rs1 accepted; otherwise rs1==0.
   RDY               10 rd:5  101000 rs1:5 0 0000000000000
 }
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 336583beab..ece393fffc 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -2823,12 +2823,15 @@ static bool trans_Tcc_i_v9(DisasContext *dc, arg_Tcc_i_v9 *a)
     return do_tcc(dc, a->cond, a->cc, a->rs1, true, a->i);
 }
 
-static bool trans_STBAR(DisasContext *dc, arg_STBAR *a)
+static bool do_stbar(DisasContext *dc)
 {
     tcg_gen_mb(TCG_MO_ST_ST | TCG_BAR_SC);
     return advance_pc(dc);
 }
 
+TRANS(STBAR_v8, 32, do_stbar)
+TRANS(STBAR_v9, 64, do_stbar)
+
 static bool trans_MEMBAR(DisasContext *dc, arg_MEMBAR *a)
 {
     if (avail_32(dc)) {

From 49d669ccf33a772e3baf3fe4ebb996dc015f46c1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 07:15:57 +0200
Subject: [PATCH 0555/2396] target/sparc: Loosen decode of RDY for v7

Bits [18:0] are not decoded with v7, and for v8 unused values
of rs1 simply produce undefined results.

Fixes: af25071c1d ("target/sparc: Move RDASR, STBAR, MEMBAR to decodetree")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Tested-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
---
 target/sparc/insns.decode | 12 ++++++++++--
 target/sparc/translate.c  | 14 ++------------
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode
index 1b1b85e9c2..74848996ae 100644
--- a/target/sparc/insns.decode
+++ b/target/sparc/insns.decode
@@ -91,6 +91,7 @@ CALL    01 i:s30
     STBAR_v9        10 00000 101000 01111 0 0000000000000
     MEMBAR          10 00000 101000 01111 1 000000 cmask:3 mmask:4
 
+    RDY_v9          10 rd:5  101000 00000 0 0000000000000
     RDCCR           10 rd:5  101000 00010 0 0000000000000
     RDASI           10 rd:5  101000 00011 0 0000000000000
     RDTICK          10 rd:5  101000 00100 0 0000000000000
@@ -118,8 +119,15 @@ CALL    01 i:s30
   # This confirms that bit 13 is ignored, as 0x8143c000 is STBAR.
   STBAR_v8          10 ----- 101000 01111 - -------------
 
-  # Before v8, all rs1 accepted; otherwise rs1==0.
-  RDY               10 rd:5  101000 rs1:5 0 0000000000000
+  # For v7, bits [18:0] are ignored.
+  # For v8, bits [18:14], aka rs1, are repurposed and rs1 = 0 is RDY,
+  # and other values are RDASR.  However, the v8 manual explicitly
+  # says that rs1 in 1..14 yield undefined results and do not cause
+  # an illegal instruction trap, and rs1 in 16..31 are available for
+  # implementation specific usage.
+  # Implement not causing an illegal instruction trap for v8 by
+  # continuing to interpret unused values per v7, i.e. as RDY.
+  RDY_v7            10 rd:5  101000 ----- - -------------
 }
 
 {
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index ece393fffc..cfdd9c1ce4 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -2863,18 +2863,8 @@ static TCGv do_rdy(DisasContext *dc, TCGv dst)
     return cpu_y;
 }
 
-static bool trans_RDY(DisasContext *dc, arg_RDY *a)
-{
-    /*
-     * TODO: Need a feature bit for sparcv8.  In the meantime, treat all
-     * 32-bit cpus like sparcv7, which ignores the rs1 field.
-     * This matches after all other ASR, so Leon3 Asr17 is handled first.
-     */
-    if (avail_64(dc) && a->rs1 != 0) {
-        return false;
-    }
-    return do_rd_special(dc, true, a->rd, do_rdy);
-}
+TRANS(RDY_v7, 32, do_rd_special, true, a->rd, do_rdy)
+TRANS(RDY_v9, 64, do_rd_special, true, a->rd, do_rdy)
 
 static TCGv do_rd_leon3_config(DisasContext *dc, TCGv dst)
 {

From a0345f628394fbd001276c80fd02c8ad0d1b7ee2 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 11:34:52 +0200
Subject: [PATCH 0556/2396] target/sparc: Loosen decode of RDPSR for v7

For v7, bits [18:0] are ignored.
For v8, bits [18:14] are reserved and bits [13:0] are ignored.

Fixes: 668bb9b755e ("target/sparc: Move RDPSR, RDHPR to decodetree")
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/insns.decode | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode
index 74848996ae..1c6403ad8a 100644
--- a/target/sparc/insns.decode
+++ b/target/sparc/insns.decode
@@ -158,14 +158,16 @@ CALL    01 i:s30
 }
 
 {
-  RDPSR             10 rd:5  101001 00000 0 0000000000000
-  RDHPR_hpstate     10 rd:5  101001 00000 0 0000000000000
+  [
+    RDHPR_hpstate       10 rd:5  101001 00000 0 0000000000000
+    RDHPR_htstate       10 rd:5  101001 00001 0 0000000000000
+    RDHPR_hintp         10 rd:5  101001 00011 0 0000000000000
+    RDHPR_htba          10 rd:5  101001 00101 0 0000000000000
+    RDHPR_hver          10 rd:5  101001 00110 0 0000000000000
+    RDHPR_hstick_cmpr   10 rd:5  101001 11111 0 0000000000000
+  ]
+  RDPSR                 10 rd:5  101001 ----- - -------------
 }
-RDHPR_htstate       10 rd:5  101001 00001 0 0000000000000
-RDHPR_hintp         10 rd:5  101001 00011 0 0000000000000
-RDHPR_htba          10 rd:5  101001 00101 0 0000000000000
-RDHPR_hver          10 rd:5  101001 00110 0 0000000000000
-RDHPR_hstick_cmpr   10 rd:5  101001 11111 0 0000000000000
 
 {
   WRPSR             10 00000 110001 ..... . .............  @n_r_ri

From dc9678cc9725d6c3053c6f110f162d956eb9d48f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 11:39:41 +0200
Subject: [PATCH 0557/2396] target/sparc: Loosen decode of RDWIM for v7

For v7, bits [18:0] are ignored.
For v8, bits [18:14] are reserved and bits [13:0] are ignored.

Fixes: 5d617bfba07 ("target/sparc: Move RDWIM, RDPR to decodetree")
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/insns.decode | 40 ++++++++++++++++++++-------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode
index 1c6403ad8a..77b2f54fdf 100644
--- a/target/sparc/insns.decode
+++ b/target/sparc/insns.decode
@@ -180,26 +180,28 @@ RESTORED            10 00001 110001 00000 0 0000000000000
 # UA2005 INVALW
 
 {
-  RDWIM             10 rd:5  101010 00000 0 0000000000000
-  RDPR_tpc          10 rd:5  101010 00000 0 0000000000000
+  [
+    RDPR_tpc            10 rd:5  101010 00000 0 0000000000000
+    RDPR_tnpc           10 rd:5  101010 00001 0 0000000000000
+    RDPR_tstate         10 rd:5  101010 00010 0 0000000000000
+    RDPR_tt             10 rd:5  101010 00011 0 0000000000000
+    RDPR_tick           10 rd:5  101010 00100 0 0000000000000
+    RDPR_tba            10 rd:5  101010 00101 0 0000000000000
+    RDPR_pstate         10 rd:5  101010 00110 0 0000000000000
+    RDPR_tl             10 rd:5  101010 00111 0 0000000000000
+    RDPR_pil            10 rd:5  101010 01000 0 0000000000000
+    RDPR_cwp            10 rd:5  101010 01001 0 0000000000000
+    RDPR_cansave        10 rd:5  101010 01010 0 0000000000000
+    RDPR_canrestore     10 rd:5  101010 01011 0 0000000000000
+    RDPR_cleanwin       10 rd:5  101010 01100 0 0000000000000
+    RDPR_otherwin       10 rd:5  101010 01101 0 0000000000000
+    RDPR_wstate         10 rd:5  101010 01110 0 0000000000000
+    RDPR_gl             10 rd:5  101010 10000 0 0000000000000
+    RDPR_strand_status  10 rd:5  101010 11010 0 0000000000000
+    RDPR_ver            10 rd:5  101010 11111 0 0000000000000
+  ]
+  RDWIM                 10 rd:5  101010 ----- - -------------
 }
-RDPR_tnpc           10 rd:5  101010 00001 0 0000000000000
-RDPR_tstate         10 rd:5  101010 00010 0 0000000000000
-RDPR_tt             10 rd:5  101010 00011 0 0000000000000
-RDPR_tick           10 rd:5  101010 00100 0 0000000000000
-RDPR_tba            10 rd:5  101010 00101 0 0000000000000
-RDPR_pstate         10 rd:5  101010 00110 0 0000000000000
-RDPR_tl             10 rd:5  101010 00111 0 0000000000000
-RDPR_pil            10 rd:5  101010 01000 0 0000000000000
-RDPR_cwp            10 rd:5  101010 01001 0 0000000000000
-RDPR_cansave        10 rd:5  101010 01010 0 0000000000000
-RDPR_canrestore     10 rd:5  101010 01011 0 0000000000000
-RDPR_cleanwin       10 rd:5  101010 01100 0 0000000000000
-RDPR_otherwin       10 rd:5  101010 01101 0 0000000000000
-RDPR_wstate         10 rd:5  101010 01110 0 0000000000000
-RDPR_gl             10 rd:5  101010 10000 0 0000000000000
-RDPR_strand_status  10 rd:5  101010 11010 0 0000000000000
-RDPR_ver            10 rd:5  101010 11111 0 0000000000000
 
 {
   WRWIM             10 00000 110010 ..... . .............  @n_r_ri

From 6ff52f9dee064d3c2138426834320f5877863d9b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 11:41:46 +0200
Subject: [PATCH 0558/2396] target/sparc: Loosen decode of RDTBR for v7

For v7, bits [18:0] are ignored.
For v8, bits [18:14] are reserved and bits [13:0] are ignored.

Fixes: e8325dc02d0 ("target/sparc: Move RDTBR, FLUSHW to decodetree")
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/insns.decode | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/sparc/insns.decode b/target/sparc/insns.decode
index 77b2f54fdf..242ec42016 100644
--- a/target/sparc/insns.decode
+++ b/target/sparc/insns.decode
@@ -226,7 +226,7 @@ WRPR_strand_status  10 11010 110010 ..... . .............  @n_r_ri
 
 {
   FLUSHW    10 00000 101011 00000 0 0000000000000
-  RDTBR     10 rd:5  101011 00000 0 0000000000000
+  RDTBR     10 rd:5  101011 ----- - -------------
 }
 
 {

From df663ac0a4e5d916b6b3e77552a925fec02bced4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 13:46:27 +0200
Subject: [PATCH 0559/2396] target/sparc: Relax decode of rs2_or_imm for v7

For v7, bits [12:5] are ignored for !imm.
For v8, those same bits are reserved, but are not trapped.

Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/sparc/translate.c | 56 ++++++++++++++++++++++++++--------------
 1 file changed, 37 insertions(+), 19 deletions(-)

diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index cfdd9c1ce4..810e2491a6 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -2526,6 +2526,32 @@ static int extract_qfpreg(DisasContext *dc, int x)
 # define avail_VIS4(C)    false
 #endif
 
+/*
+ * We decoded bit 13 as imm, and bits [12:0] as rs2_or_imm.
+ * For v9, if !imm, then the unused bits [12:5] must be zero.
+ * For v7 and v8, the unused bits are ignored; clear them here.
+ */
+static bool check_rs2(DisasContext *dc, int *rs2)
+{
+    if (unlikely(*rs2 & ~0x1f)) {
+        if (avail_64(dc)) {
+            return false;
+        }
+        *rs2 &= 0x1f;
+    }
+    return true;
+}
+
+static bool check_r_r_ri(DisasContext *dc, arg_r_r_ri *a)
+{
+    return a->imm || check_rs2(dc, &a->rs2_or_imm);
+}
+
+static bool check_r_r_ri_cc(DisasContext *dc, arg_r_r_ri_cc *a)
+{
+    return a->imm || check_rs2(dc, &a->rs2_or_imm);
+}
+
 /* Default case for non jump instructions. */
 static bool advance_pc(DisasContext *dc)
 {
@@ -3249,8 +3275,7 @@ static bool do_wr_special(DisasContext *dc, arg_r_r_ri *a, bool priv,
 {
     TCGv src;
 
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && (a->rs2_or_imm & ~0x1f)) {
+    if (!check_r_r_ri(dc, a)) {
         return false;
     }
     if (!priv) {
@@ -3693,8 +3718,7 @@ static bool do_arith_int(DisasContext *dc, arg_r_r_ri_cc *a,
 {
     TCGv dst, src1;
 
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && a->rs2_or_imm & ~0x1f) {
+    if (!check_r_r_ri_cc(dc, a)) {
         return false;
     }
 
@@ -3778,11 +3802,11 @@ static bool trans_OR(DisasContext *dc, arg_r_r_ri_cc *a)
 {
     /* OR with %g0 is the canonical alias for MOV. */
     if (!a->cc && a->rs1 == 0) {
+        if (!check_r_r_ri_cc(dc, a)) {
+            return false;
+        }
         if (a->imm || a->rs2_or_imm == 0) {
             gen_store_gpr(dc, a->rd, tcg_constant_tl(a->rs2_or_imm));
-        } else if (a->rs2_or_imm & ~0x1f) {
-            /* For simplicity, we under-decoded the rs2 form. */
-            return false;
         } else {
             gen_store_gpr(dc, a->rd, cpu_regs[a->rs2_or_imm]);
         }
@@ -3799,8 +3823,7 @@ static bool trans_UDIV(DisasContext *dc, arg_r_r_ri *a)
     if (!avail_DIV(dc)) {
         return false;
     }
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && a->rs2_or_imm & ~0x1f) {
+    if (!check_r_r_ri(dc, a)) {
         return false;
     }
 
@@ -3851,8 +3874,7 @@ static bool trans_UDIVX(DisasContext *dc, arg_r_r_ri *a)
     if (!avail_64(dc)) {
         return false;
     }
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && a->rs2_or_imm & ~0x1f) {
+    if (!check_r_r_ri(dc, a)) {
         return false;
     }
 
@@ -3889,8 +3911,7 @@ static bool trans_SDIVX(DisasContext *dc, arg_r_r_ri *a)
     if (!avail_64(dc)) {
         return false;
     }
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && a->rs2_or_imm & ~0x1f) {
+    if (!check_r_r_ri(dc, a)) {
         return false;
     }
 
@@ -4186,8 +4207,7 @@ TRANS(SRA_i, ALL, do_shift_i, a, false, false)
 
 static TCGv gen_rs2_or_imm(DisasContext *dc, bool imm, int rs2_or_imm)
 {
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!imm && rs2_or_imm & ~0x1f) {
+    if (!imm && !check_rs2(dc, &rs2_or_imm)) {
         return NULL;
     }
     if (imm || rs2_or_imm == 0) {
@@ -4250,8 +4270,7 @@ static bool do_add_special(DisasContext *dc, arg_r_r_ri *a,
 {
     TCGv src1, sum;
 
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!a->imm && a->rs2_or_imm & ~0x1f) {
+    if (!check_r_r_ri(dc, a)) {
         return false;
     }
 
@@ -4369,8 +4388,7 @@ static TCGv gen_ldst_addr(DisasContext *dc, int rs1, bool imm, int rs2_or_imm)
 {
     TCGv addr, tmp = NULL;
 
-    /* For simplicity, we under-decoded the rs2 form. */
-    if (!imm && rs2_or_imm & ~0x1f) {
+    if (!imm && !check_rs2(dc, &rs2_or_imm)) {
         return NULL;
     }
 

From e4a1b308b27cd77338b8f05d3a31e6b38eb717c7 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 18 Sep 2025 12:42:58 +0100
Subject: [PATCH 0560/2396] hw/pci-host/dino: Don't call
 pci_register_root_bus() in init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the dino PCI host bridge device, we call pci_register_root_bus()
in the device's instance_init. This is a problem for two reasons
 * the PCI bridge is then available to the rest of the simulation
   (e.g. via pci_qdev_find_device()), even though it hasn't
   yet been realized
 * we do not attempt to unregister in an instance_deinit,
   which means that if you go through an instance_init -> deinit
   lifecycle the freed memory for the host-bridge device is
   left on the pci_host_bridges list

ASAN reports the resulting use-after-free:

==1771223==ERROR: AddressSanitizer: heap-use-after-free on address 0x527000018f80 at pc 0x5b4b9d3369b5 bp 0x7ffd01929980 sp 0x7ffd01929978
WRITE of size 8 at 0x527000018f80 thread T0
    #0 0x5b4b9d3369b4 in pci_host_bus_register /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:608:5
    #1 0x5b4b9d321566 in pci_root_bus_internal_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:677:5
    #2 0x5b4b9d3215e0 in pci_root_bus_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:706:5
    #3 0x5b4b9d321fe5 in pci_register_root_bus /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:751:11
    #4 0x5b4b9d390521 in dino_pcihost_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci-host/dino.c:473:16

0x527000018f80 is located 1664 bytes inside of 12384-byte region [0x527000018900,0x52700001b960)
freed by thread T0 here:
    #0 0x5b4b9cab185a in free (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17ad85a) (BuildId: ca496bb2e4fc750ebd289b448bad8d99c0ecd140)
    #1 0x5b4b9e3ee723 in object_finalize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:734:9
    #2 0x5b4b9e3e69db in object_unref /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:1232:9
    #3 0x5b4b9ea6173c in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:237:5
    #4 0x5b4b9ec4e0f3 in qmp_marshal_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qapi/qapi-commands-qdev.c:65:14

previously allocated by thread T0 here:
    #0 0x5b4b9cab1af3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17adaf3) (BuildId: ca496bb2e4fc750ebd289b448bad8d99c0ecd140)
    #1 0x799d8270eb09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5b4b9e3e75fc in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:767:15
    #3 0x5b4b9e3e7409 in object_new_with_class /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:782:12
    #4 0x5b4b9ea609a5 in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:206:11

where we allocated one instance of the dino device, put it on the
list, freed it, and then trying to allocate a second instance touches
the freed memory on the pci_host_bridges list.

Fix this by deferring all the setup of memory regions and registering
the PCI bridge to the device's realize method.  This brings it into
line with almost all other PCI host bridges, which call
pci_register_root_bus() in realize.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3118
Fixes: 63901b6cc4d8b4 ("dino: move PCI bus initialisation to dino_pcihost_init()")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250918114259.1802337-2-peter.maydell@linaro.org>
---
 hw/pci-host/dino.c | 90 +++++++++++++++++++++-------------------------
 1 file changed, 41 insertions(+), 49 deletions(-)

diff --git a/hw/pci-host/dino.c b/hw/pci-host/dino.c
index 11b353be2e..924053499c 100644
--- a/hw/pci-host/dino.c
+++ b/hw/pci-host/dino.c
@@ -413,6 +413,47 @@ static void dino_pcihost_reset(DeviceState *dev)
 static void dino_pcihost_realize(DeviceState *dev, Error **errp)
 {
     DinoState *s = DINO_PCI_HOST_BRIDGE(dev);
+    PCIHostState *phb = PCI_HOST_BRIDGE(dev);
+
+    /* Dino PCI access from main memory.  */
+    memory_region_init_io(&s->this_mem, OBJECT(s), &dino_chip_ops,
+                          s, "dino", 4096);
+
+    /* Dino PCI config. */
+    memory_region_init_io(&phb->conf_mem, OBJECT(phb),
+                          &dino_config_addr_ops, DEVICE(s),
+                          "pci-conf-idx", 4);
+    memory_region_init_io(&phb->data_mem, OBJECT(phb),
+                          &dino_config_data_ops, DEVICE(s),
+                          "pci-conf-data", 4);
+    memory_region_add_subregion(&s->this_mem, DINO_PCI_CONFIG_ADDR,
+                                &phb->conf_mem);
+    memory_region_add_subregion(&s->this_mem, DINO_CONFIG_DATA,
+                                &phb->data_mem);
+
+    /* Dino PCI bus memory.  */
+    memory_region_init(&s->pci_mem, OBJECT(s), "pci-memory", 4 * GiB);
+
+    phb->bus = pci_register_root_bus(DEVICE(s), "pci",
+                                     dino_set_irq, dino_pci_map_irq, s,
+                                     &s->pci_mem, get_system_io(),
+                                     PCI_DEVFN(0, 0), 32, TYPE_PCI_BUS);
+
+    /* Set up windows into PCI bus memory.  */
+    for (int i = 1; i < 31; i++) {
+        uint32_t addr = 0xf0000000 + i * DINO_MEM_CHUNK_SIZE;
+        char *name = g_strdup_printf("PCI Outbound Window %d", i);
+        memory_region_init_alias(&s->pci_mem_alias[i], OBJECT(s),
+                                 name, &s->pci_mem, addr,
+                                 DINO_MEM_CHUNK_SIZE);
+        g_free(name);
+    }
+
+    pci_setup_iommu(phb->bus, &dino_iommu_ops, s);
+
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->this_mem);
+
+    qdev_init_gpio_in(dev, dino_set_irq, DINO_IRQS);
 
     /* Set up PCI view of memory: Bus master address space.  */
     memory_region_init(&s->bm, OBJECT(s), "bm-dino", 4 * GiB);
@@ -444,54 +485,6 @@ static void dino_pcihost_unrealize(DeviceState *dev)
     address_space_destroy(&s->bm_as);
 }
 
-static void dino_pcihost_init(Object *obj)
-{
-    DinoState *s = DINO_PCI_HOST_BRIDGE(obj);
-    PCIHostState *phb = PCI_HOST_BRIDGE(obj);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
-    int i;
-
-    /* Dino PCI access from main memory.  */
-    memory_region_init_io(&s->this_mem, OBJECT(s), &dino_chip_ops,
-                          s, "dino", 4096);
-
-    /* Dino PCI config. */
-    memory_region_init_io(&phb->conf_mem, OBJECT(phb),
-                          &dino_config_addr_ops, DEVICE(s),
-                          "pci-conf-idx", 4);
-    memory_region_init_io(&phb->data_mem, OBJECT(phb),
-                          &dino_config_data_ops, DEVICE(s),
-                          "pci-conf-data", 4);
-    memory_region_add_subregion(&s->this_mem, DINO_PCI_CONFIG_ADDR,
-                                &phb->conf_mem);
-    memory_region_add_subregion(&s->this_mem, DINO_CONFIG_DATA,
-                                &phb->data_mem);
-
-    /* Dino PCI bus memory.  */
-    memory_region_init(&s->pci_mem, OBJECT(s), "pci-memory", 4 * GiB);
-
-    phb->bus = pci_register_root_bus(DEVICE(s), "pci",
-                                     dino_set_irq, dino_pci_map_irq, s,
-                                     &s->pci_mem, get_system_io(),
-                                     PCI_DEVFN(0, 0), 32, TYPE_PCI_BUS);
-
-    /* Set up windows into PCI bus memory.  */
-    for (i = 1; i < 31; i++) {
-        uint32_t addr = 0xf0000000 + i * DINO_MEM_CHUNK_SIZE;
-        char *name = g_strdup_printf("PCI Outbound Window %d", i);
-        memory_region_init_alias(&s->pci_mem_alias[i], OBJECT(s),
-                                 name, &s->pci_mem, addr,
-                                 DINO_MEM_CHUNK_SIZE);
-        g_free(name);
-    }
-
-    pci_setup_iommu(phb->bus, &dino_iommu_ops, s);
-
-    sysbus_init_mmio(sbd, &s->this_mem);
-
-    qdev_init_gpio_in(DEVICE(obj), dino_set_irq, DINO_IRQS);
-}
-
 static const Property dino_pcihost_properties[] = {
     DEFINE_PROP_LINK("memory-as", DinoState, memory_as, TYPE_MEMORY_REGION,
                      MemoryRegion *),
@@ -511,7 +504,6 @@ static void dino_pcihost_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo dino_pcihost_info = {
     .name          = TYPE_DINO_PCI_HOST_BRIDGE,
     .parent        = TYPE_PCI_HOST_BRIDGE,
-    .instance_init = dino_pcihost_init,
     .instance_size = sizeof(DinoState),
     .class_init    = dino_pcihost_class_init,
 };

From 76d2b8d42adb0db2d1ccd08a626f25ddd30208a8 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 18 Sep 2025 12:42:59 +0100
Subject: [PATCH 0561/2396] hw/pci-host/astro: Don't call
 pci_regsiter_root_bus() in init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the astro PCI host bridge device, we call pci_register_root_bus()
in the device's instance_init. This is a problem for two reasons
 * the PCI bridge is then available to the rest of the simulation
   (e.g. via pci_qdev_find_device()), even though it hasn't
   yet been realized
 * we do not attempt to unregister in an instance_deinit,
   which means that if you go through an instance_init -> deinit
   lifecycle the freed memory for the host-bridge device is
   left on the pci_host_bridges list

ASAN reports the resulting use-after-free:

==1776584==ERROR: AddressSanitizer: heap-use-after-free on address 0x51f00000cb00 at pc 0x5b2d460a89b5 bp 0x7ffef7617f50 sp 0x7ffef7617f48
WRITE of size 8 at 0x51f00000cb00 thread T0
    #0 0x5b2d460a89b4 in pci_host_bus_register /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:608:5
    #1 0x5b2d46093566 in pci_root_bus_internal_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:677:5
    #2 0x5b2d460935e0 in pci_root_bus_new /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:706:5
    #3 0x5b2d46093fe5 in pci_register_root_bus /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci/pci.c:751:11
    #4 0x5b2d46fe2335 in elroy_pcihost_init /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../hw/pci-host/astro.c:455:16

0x51f00000cb00 is located 1664 bytes inside of 3456-byte region [0x51f00000c480,0x51f00000d200)
freed by thread T0 here:
    #0 0x5b2d4582385a in free (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17ad85a) (BuildId: 692b49eedc6fb0ef618bbb6784a09311b3b7f1e8)
    #1 0x5b2d47160723 in object_finalize /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:734:9
    #2 0x5b2d471589db in object_unref /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:1232:9
    #3 0x5b2d477d373c in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:237:5

previously allocated by thread T0 here:
    #0 0x5b2d45823af3 in malloc (/mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/qemu-system-hppa+0x17adaf3) (BuildId: 692b49eedc6fb0ef618bbb6784a09311b3b7f1e8)
    #1 0x79728fa08b09 in g_malloc (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x62b09) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5b2d471595fc in object_new_with_type /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:767:15
    #3 0x5b2d47159409 in object_new_with_class /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/object.c:782:12
    #4 0x5b2d477d29a5 in qmp_device_list_properties /mnt/nvmedisk/linaro/qemu-from-laptop/qemu/build/hppa-asan/../../qom/qom-qmp-cmds.c:206:11

Cc: qemu-stable@nongnu.org
Fixes: e029bb00a79be ("hw/pci-host: Add Astro system bus adapter found on PA-RISC machines")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3118
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250918114259.1802337-3-peter.maydell@linaro.org>
---
 hw/pci-host/astro.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/hw/pci-host/astro.c b/hw/pci-host/astro.c
index 859e308c57..1024ede7b6 100644
--- a/hw/pci-host/astro.c
+++ b/hw/pci-host/astro.c
@@ -424,22 +424,23 @@ static void elroy_reset(DeviceState *dev)
     }
 }
 
-static void elroy_pcihost_init(Object *obj)
+static void elroy_pcihost_realize(DeviceState *dev, Error **errp)
 {
-    ElroyState *s = ELROY_PCI_HOST_BRIDGE(obj);
-    PCIHostState *phb = PCI_HOST_BRIDGE(obj);
-    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    ElroyState *s = ELROY_PCI_HOST_BRIDGE(dev);
+    PCIHostState *phb = PCI_HOST_BRIDGE(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    Object *obj = OBJECT(s);
 
     /* Elroy config access from CPU.  */
-    memory_region_init_io(&s->this_mem, OBJECT(s), &elroy_chip_ops,
+    memory_region_init_io(&s->this_mem, obj, &elroy_chip_ops,
                           s, "elroy", 0x2000);
 
     /* Elroy PCI config. */
-    memory_region_init_io(&phb->conf_mem, OBJECT(phb),
-                          &elroy_config_addr_ops, DEVICE(s),
+    memory_region_init_io(&phb->conf_mem, obj,
+                          &elroy_config_addr_ops, dev,
                           "pci-conf-idx", 8);
-    memory_region_init_io(&phb->data_mem, OBJECT(phb),
-                          &elroy_config_data_ops, DEVICE(s),
+    memory_region_init_io(&phb->data_mem, obj,
+                          &elroy_config_data_ops, dev,
                           "pci-conf-data", 8);
     memory_region_add_subregion(&s->this_mem, 0x40,
                                 &phb->conf_mem);
@@ -447,8 +448,8 @@ static void elroy_pcihost_init(Object *obj)
                                 &phb->data_mem);
 
     /* Elroy PCI bus memory.  */
-    memory_region_init(&s->pci_mmio, OBJECT(s), "pci-mmio", UINT64_MAX);
-    memory_region_init_io(&s->pci_io, OBJECT(s), &unassigned_io_ops, obj,
+    memory_region_init(&s->pci_mmio, obj, "pci-mmio", UINT64_MAX);
+    memory_region_init_io(&s->pci_io, obj, &unassigned_io_ops, obj,
                             "pci-isa-mmio",
                             ((uint32_t) IOS_DIST_BASE_SIZE) / ROPES_PER_IOC);
 
@@ -459,7 +460,7 @@ static void elroy_pcihost_init(Object *obj)
 
     sysbus_init_mmio(sbd, &s->this_mem);
 
-    qdev_init_gpio_in(DEVICE(obj), elroy_set_irq, ELROY_IRQS);
+    qdev_init_gpio_in(dev, elroy_set_irq, ELROY_IRQS);
 }
 
 static const VMStateDescription vmstate_elroy = {
@@ -487,6 +488,7 @@ static void elroy_pcihost_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
 
     device_class_set_legacy_reset(dc, elroy_reset);
+    dc->realize = elroy_pcihost_realize;
     dc->vmsd = &vmstate_elroy;
     dc->user_creatable = false;
 }
@@ -494,7 +496,6 @@ static void elroy_pcihost_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo elroy_pcihost_info = {
     .name          = TYPE_ELROY_PCI_HOST_BRIDGE,
     .parent        = TYPE_PCI_HOST_BRIDGE,
-    .instance_init = elroy_pcihost_init,
     .instance_size = sizeof(ElroyState),
     .class_init    = elroy_pcihost_class_init,
 };

From a50347a4145faf6d409afd4b9b682c8b3e60854a Mon Sep 17 00:00:00 2001
From: WANG Rui <wangrui@loongson.cn>
Date: Fri, 19 Sep 2025 20:49:01 +0800
Subject: [PATCH 0562/2396] tcg/optimize: Fix folding of vector bitsel

It looks like a typo. When the false value (C) is the constant -1, the
correct fold should be: R = B | ~A

Reproducer (LoongArch64 assembly):

     .text
     .globl  _start
 _start:
     vldi    $vr1, 3073
     vldi    $vr2, 1023
     vbitsel.v       $vr0, $vr2, $vr1, $vr2
     vpickve2gr.d    $a1, $vr0, 1
     xori    $a0, $a1, 1
     li.w    $a7, 93
     syscall 0

Fixes: e58b977238e3 ("tcg/optimize: Optimize bitsel_vec")
Link: https://github.com/llvm/llvm-project/issues/159610
Signed-off-by: WANG Rui <wangrui@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250919124901.2756538-1-wangrui@loongson.cn>
---
 tcg/optimize.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 3638ab9fea..f69702b26e 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1568,9 +1568,10 @@ static bool fold_bitsel_vec(OptContext *ctx, TCGOp *op)
             return fold_and(ctx, op);
         }
         if (fv == -1 && TCG_TARGET_HAS_orc_vec) {
+            TCGArg ta = op->args[2];
             op->opc = INDEX_op_orc_vec;
             op->args[2] = op->args[1];
-            op->args[1] = op->args[3];
+            op->args[1] = ta;
             return fold_orc(ctx, op);
         }
     }

From 3014059e8faa7e4d25482710ca2c0f095441396b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 11 Jul 2025 16:56:22 -0600
Subject: [PATCH 0563/2396] include/hw/core/cpu: Introduce MMUIdxMap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use a typedef instead of uint16_t directly when
describing sets of mmu indexes.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c    | 30 +++++++++++++++---------------
 include/exec/cputlb.h | 32 ++++++++++++++++----------------
 include/hw/core/cpu.h |  6 +++---
 3 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 87e14bde4f..d324f33339 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -370,8 +370,8 @@ static void flush_all_helper(CPUState *src, run_on_cpu_func fn,
 
 static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
 {
-    uint16_t asked = data.host_int;
-    uint16_t all_dirty, work, to_clean;
+    MMUIdxMap asked = data.host_int;
+    MMUIdxMap all_dirty, work, to_clean;
     int64_t now = get_clock_realtime();
 
     assert_cpu_is_self(cpu);
@@ -408,7 +408,7 @@ static void tlb_flush_by_mmuidx_async_work(CPUState *cpu, run_on_cpu_data data)
     }
 }
 
-void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
+void tlb_flush_by_mmuidx(CPUState *cpu, MMUIdxMap idxmap)
 {
     tlb_debug("mmu_idx: 0x%" PRIx16 "\n", idxmap);
 
@@ -422,7 +422,7 @@ void tlb_flush(CPUState *cpu)
     tlb_flush_by_mmuidx(cpu, ALL_MMUIDX_BITS);
 }
 
-void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *src_cpu, uint16_t idxmap)
+void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *src_cpu, MMUIdxMap idxmap)
 {
     const run_on_cpu_func fn = tlb_flush_by_mmuidx_async_work;
 
@@ -531,7 +531,7 @@ static void tlb_flush_page_locked(CPUState *cpu, int midx, vaddr page)
  */
 static void tlb_flush_page_by_mmuidx_async_0(CPUState *cpu,
                                              vaddr addr,
-                                             uint16_t idxmap)
+                                             MMUIdxMap idxmap)
 {
     int mmu_idx;
 
@@ -570,14 +570,14 @@ static void tlb_flush_page_by_mmuidx_async_1(CPUState *cpu,
 {
     vaddr addr_and_idxmap = data.target_ptr;
     vaddr addr = addr_and_idxmap & TARGET_PAGE_MASK;
-    uint16_t idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
+    MMUIdxMap idxmap = addr_and_idxmap & ~TARGET_PAGE_MASK;
 
     tlb_flush_page_by_mmuidx_async_0(cpu, addr, idxmap);
 }
 
 typedef struct {
     vaddr addr;
-    uint16_t idxmap;
+    MMUIdxMap idxmap;
 } TLBFlushPageByMMUIdxData;
 
 /**
@@ -599,7 +599,7 @@ static void tlb_flush_page_by_mmuidx_async_2(CPUState *cpu,
     g_free(d);
 }
 
-void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr, uint16_t idxmap)
+void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr, MMUIdxMap idxmap)
 {
     tlb_debug("addr: %016" VADDR_PRIx " mmu_idx:%" PRIx16 "\n", addr, idxmap);
 
@@ -618,7 +618,7 @@ void tlb_flush_page(CPUState *cpu, vaddr addr)
 
 void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                               vaddr addr,
-                                              uint16_t idxmap)
+                                              MMUIdxMap idxmap)
 {
     tlb_debug("addr: %016" VADDR_PRIx " mmu_idx:%"PRIx16"\n", addr, idxmap);
 
@@ -715,8 +715,8 @@ static void tlb_flush_range_locked(CPUState *cpu, int midx,
 typedef struct {
     vaddr addr;
     vaddr len;
-    uint16_t idxmap;
-    uint16_t bits;
+    MMUIdxMap idxmap;
+    unsigned bits;
 } TLBFlushRangeData;
 
 static void tlb_flush_range_by_mmuidx_async_0(CPUState *cpu,
@@ -766,7 +766,7 @@ static void tlb_flush_range_by_mmuidx_async_1(CPUState *cpu,
 }
 
 void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
-                               vaddr len, uint16_t idxmap,
+                               vaddr len, MMUIdxMap idxmap,
                                unsigned bits)
 {
     TLBFlushRangeData d;
@@ -797,7 +797,7 @@ void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
 }
 
 void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
-                                   uint16_t idxmap, unsigned bits)
+                                   MMUIdxMap idxmap, unsigned bits)
 {
     tlb_flush_range_by_mmuidx(cpu, addr, TARGET_PAGE_SIZE, idxmap, bits);
 }
@@ -805,7 +805,7 @@ void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
 void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                                vaddr addr,
                                                vaddr len,
-                                               uint16_t idxmap,
+                                               MMUIdxMap idxmap,
                                                unsigned bits)
 {
     TLBFlushRangeData d, *p;
@@ -847,7 +847,7 @@ void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
 
 void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
                                                    vaddr addr,
-                                                   uint16_t idxmap,
+                                                   MMUIdxMap idxmap,
                                                    unsigned bits)
 {
     tlb_flush_range_by_mmuidx_all_cpus_synced(src_cpu, addr, TARGET_PAGE_SIZE,
diff --git a/include/exec/cputlb.h b/include/exec/cputlb.h
index 03ed7e2165..9bec0e7890 100644
--- a/include/exec/cputlb.h
+++ b/include/exec/cputlb.h
@@ -150,7 +150,7 @@ void tlb_flush_all_cpus_synced(CPUState *src_cpu);
  * MMU indexes.
  */
 void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
-                              uint16_t idxmap);
+                              MMUIdxMap idxmap);
 
 /**
  * tlb_flush_page_by_mmuidx_all_cpus_synced:
@@ -165,7 +165,7 @@ void tlb_flush_page_by_mmuidx(CPUState *cpu, vaddr addr,
  * translations using the flushed TLBs.
  */
 void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
-                                              uint16_t idxmap);
+                                              MMUIdxMap idxmap);
 
 /**
  * tlb_flush_by_mmuidx:
@@ -176,7 +176,7 @@ void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
  * Flush all entries from the TLB of the specified CPU, for the specified
  * MMU indexes.
  */
-void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
+void tlb_flush_by_mmuidx(CPUState *cpu, MMUIdxMap idxmap);
 
 /**
  * tlb_flush_by_mmuidx_all_cpus_synced:
@@ -189,7 +189,7 @@ void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap);
  * When this function returns, no CPUs will subsequently perform
  * translations using the flushed TLBs.
  */
-void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
+void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, MMUIdxMap idxmap);
 
 /**
  * tlb_flush_page_bits_by_mmuidx
@@ -201,11 +201,11 @@ void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu, uint16_t idxmap);
  * Similar to tlb_flush_page_mask, but with a bitmap of indexes.
  */
 void tlb_flush_page_bits_by_mmuidx(CPUState *cpu, vaddr addr,
-                                   uint16_t idxmap, unsigned bits);
+                                   MMUIdxMap idxmap, unsigned bits);
 
 /* Similarly, with broadcast and syncing. */
 void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
-                                                   uint16_t idxmap,
+                                                   MMUIdxMap idxmap,
                                                    unsigned bits);
 
 /**
@@ -220,14 +220,14 @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
  * comparing only the low @bits worth of each virtual page.
  */
 void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
-                               vaddr len, uint16_t idxmap,
+                               vaddr len, MMUIdxMap idxmap,
                                unsigned bits);
 
 /* Similarly, with broadcast and syncing. */
 void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                vaddr addr,
                                                vaddr len,
-                                               uint16_t idxmap,
+                                               MMUIdxMap idxmap,
                                                unsigned bits);
 #else
 static inline void tlb_flush_page(CPUState *cpu, vaddr addr)
@@ -243,42 +243,42 @@ static inline void tlb_flush_all_cpus_synced(CPUState *src_cpu)
 {
 }
 static inline void tlb_flush_page_by_mmuidx(CPUState *cpu,
-                                            vaddr addr, uint16_t idxmap)
+                                            vaddr addr, MMUIdxMap idxmap)
 {
 }
 
-static inline void tlb_flush_by_mmuidx(CPUState *cpu, uint16_t idxmap)
+static inline void tlb_flush_by_mmuidx(CPUState *cpu, MMUIdxMap idxmap)
 {
 }
 static inline void tlb_flush_page_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                             vaddr addr,
-                                                            uint16_t idxmap)
+                                                            MMUIdxMap idxmap)
 {
 }
 static inline void tlb_flush_by_mmuidx_all_cpus_synced(CPUState *cpu,
-                                                       uint16_t idxmap)
+                                                       MMUIdxMap idxmap)
 {
 }
 static inline void tlb_flush_page_bits_by_mmuidx(CPUState *cpu,
                                                  vaddr addr,
-                                                 uint16_t idxmap,
+                                                 MMUIdxMap idxmap,
                                                  unsigned bits)
 {
 }
 static inline void
 tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *cpu, vaddr addr,
-                                              uint16_t idxmap, unsigned bits)
+                                              MMUIdxMap idxmap, unsigned bits)
 {
 }
 static inline void tlb_flush_range_by_mmuidx(CPUState *cpu, vaddr addr,
-                                             vaddr len, uint16_t idxmap,
+                                             vaddr len, MMUIdxMap idxmap,
                                              unsigned bits)
 {
 }
 static inline void tlb_flush_range_by_mmuidx_all_cpus_synced(CPUState *cpu,
                                                              vaddr addr,
                                                              vaddr len,
-                                                             uint16_t idxmap,
+                                                             MMUIdxMap idxmap,
                                                              unsigned bits)
 {
 }
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index fb788ca110..8dd83f7457 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -198,10 +198,10 @@ struct CPUClass {
 };
 
 /*
- * Fix the number of mmu modes to 16, which is also the maximum
- * supported by the softmmu tlb api.
+ * Fix the number of mmu modes to 16.
  */
 #define NB_MMU_MODES 16
+typedef uint16_t MMUIdxMap;
 
 /* Use a fully associative victim tlb of 8 entries. */
 #define CPU_VTLB_SIZE 8
@@ -306,7 +306,7 @@ typedef struct CPUTLBCommon {
      * mmu_idx N since the last time that mmu_idx was flushed.
      * Protected by tlb_c.lock.
      */
-    uint16_t dirty;
+    MMUIdxMap dirty;
     /*
      * Statistics.  These are not lock protected, but are read and
      * written atomically.  This allows the monitor to print a snapshot

From 3c58ddc9d784cd65af3d5810d9d66e57900e280a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 11 Jul 2025 17:32:37 -0600
Subject: [PATCH 0564/2396] include/hw/core/cpu: Introduce cpu_tlb_fast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Encapsulate access to cpu->neg.tlb.f[] in a function.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/cputlb.c           | 16 ++++++++--------
 include/hw/core/cpu.h        |  7 +++++++
 tcg/aarch64/tcg-target.c.inc |  2 +-
 tcg/arm/tcg-target.c.inc     |  2 +-
 4 files changed, 17 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index d324f33339..2a6aa01c57 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -129,7 +129,7 @@ static inline uint64_t tlb_addr_write(const CPUTLBEntry *entry)
 static inline uintptr_t tlb_index(CPUState *cpu, uintptr_t mmu_idx,
                                   vaddr addr)
 {
-    uintptr_t size_mask = cpu->neg.tlb.f[mmu_idx].mask >> CPU_TLB_ENTRY_BITS;
+    uintptr_t size_mask = cpu_tlb_fast(cpu, mmu_idx)->mask >> CPU_TLB_ENTRY_BITS;
 
     return (addr >> TARGET_PAGE_BITS) & size_mask;
 }
@@ -138,7 +138,7 @@ static inline uintptr_t tlb_index(CPUState *cpu, uintptr_t mmu_idx,
 static inline CPUTLBEntry *tlb_entry(CPUState *cpu, uintptr_t mmu_idx,
                                      vaddr addr)
 {
-    return &cpu->neg.tlb.f[mmu_idx].table[tlb_index(cpu, mmu_idx, addr)];
+    return &cpu_tlb_fast(cpu, mmu_idx)->table[tlb_index(cpu, mmu_idx, addr)];
 }
 
 static void tlb_window_reset(CPUTLBDesc *desc, int64_t ns,
@@ -292,7 +292,7 @@ static void tlb_flush_one_mmuidx_locked(CPUState *cpu, int mmu_idx,
                                         int64_t now)
 {
     CPUTLBDesc *desc = &cpu->neg.tlb.d[mmu_idx];
-    CPUTLBDescFast *fast = &cpu->neg.tlb.f[mmu_idx];
+    CPUTLBDescFast *fast = cpu_tlb_fast(cpu, mmu_idx);
 
     tlb_mmu_resize_locked(desc, fast, now);
     tlb_mmu_flush_locked(desc, fast);
@@ -331,7 +331,7 @@ void tlb_init(CPUState *cpu)
     cpu->neg.tlb.c.dirty = 0;
 
     for (i = 0; i < NB_MMU_MODES; i++) {
-        tlb_mmu_init(&cpu->neg.tlb.d[i], &cpu->neg.tlb.f[i], now);
+        tlb_mmu_init(&cpu->neg.tlb.d[i], cpu_tlb_fast(cpu, i), now);
     }
 }
 
@@ -342,7 +342,7 @@ void tlb_destroy(CPUState *cpu)
     qemu_spin_destroy(&cpu->neg.tlb.c.lock);
     for (i = 0; i < NB_MMU_MODES; i++) {
         CPUTLBDesc *desc = &cpu->neg.tlb.d[i];
-        CPUTLBDescFast *fast = &cpu->neg.tlb.f[i];
+        CPUTLBDescFast *fast = cpu_tlb_fast(cpu, i);
 
         g_free(fast->table);
         g_free(desc->fulltlb);
@@ -667,7 +667,7 @@ static void tlb_flush_range_locked(CPUState *cpu, int midx,
                                    unsigned bits)
 {
     CPUTLBDesc *d = &cpu->neg.tlb.d[midx];
-    CPUTLBDescFast *f = &cpu->neg.tlb.f[midx];
+    CPUTLBDescFast *f = cpu_tlb_fast(cpu, midx);
     vaddr mask = MAKE_64BIT_MASK(0, bits);
 
     /*
@@ -923,7 +923,7 @@ void tlb_reset_dirty(CPUState *cpu, uintptr_t start, uintptr_t length)
     qemu_spin_lock(&cpu->neg.tlb.c.lock);
     for (mmu_idx = 0; mmu_idx < NB_MMU_MODES; mmu_idx++) {
         CPUTLBDesc *desc = &cpu->neg.tlb.d[mmu_idx];
-        CPUTLBDescFast *fast = &cpu->neg.tlb.f[mmu_idx];
+        CPUTLBDescFast *fast = cpu_tlb_fast(cpu, mmu_idx);
         unsigned int n = tlb_n_entries(fast);
         unsigned int i;
 
@@ -1316,7 +1316,7 @@ static bool victim_tlb_hit(CPUState *cpu, size_t mmu_idx, size_t index,
 
         if (cmp == page) {
             /* Found entry in victim tlb, swap tlb and iotlb.  */
-            CPUTLBEntry tmptlb, *tlb = &cpu->neg.tlb.f[mmu_idx].table[index];
+            CPUTLBEntry tmptlb, *tlb = &cpu_tlb_fast(cpu, mmu_idx)->table[index];
 
             qemu_spin_lock(&cpu->neg.tlb.c.lock);
             copy_tlb_helper_locked(&tmptlb, tlb);
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 8dd83f7457..22a78c9ee1 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -602,6 +602,13 @@ static inline CPUArchState *cpu_env(CPUState *cpu)
     return (CPUArchState *)(cpu + 1);
 }
 
+#ifdef CONFIG_TCG
+static inline CPUTLBDescFast *cpu_tlb_fast(CPUState *cpu, int mmu_idx)
+{
+    return &cpu->neg.tlb.f[mmu_idx];
+}
+#endif
+
 typedef QTAILQ_HEAD(CPUTailQ, CPUState) CPUTailQ;
 extern CPUTailQ cpus_queue;
 
diff --git a/tcg/aarch64/tcg-target.c.inc b/tcg/aarch64/tcg-target.c.inc
index 3b088b7bd9..caf79c742d 100644
--- a/tcg/aarch64/tcg-target.c.inc
+++ b/tcg/aarch64/tcg-target.c.inc
@@ -1668,7 +1668,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         ldst->oi = oi;
         ldst->addr_reg = addr_reg;
 
-        /* Load cpu->neg.tlb.f[mmu_idx].{mask,table} into {tmp0,tmp1}. */
+        /* Load CPUTLBDescFast.{mask,table} into {tmp0,tmp1}. */
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, mask) != 0);
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 8);
         tcg_out_insn(s, 3314, LDP, TCG_REG_TMP0, TCG_REG_TMP1, TCG_AREG0,
diff --git a/tcg/arm/tcg-target.c.inc b/tcg/arm/tcg-target.c.inc
index 338c57b061..87ca66bb02 100644
--- a/tcg/arm/tcg-target.c.inc
+++ b/tcg/arm/tcg-target.c.inc
@@ -1421,7 +1421,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         ldst->oi = oi;
         ldst->addr_reg = addr;
 
-        /* Load cpu->neg.tlb.f[mmu_idx].{mask,table} into {r0,r1}.  */
+        /* Load CPUTLBDescFast.{mask,table} into {r0,r1}.  */
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, mask) != 0);
         QEMU_BUILD_BUG_ON(offsetof(CPUTLBDescFast, table) != 4);
         tcg_out_ldrd_8(s, COND_AL, TCG_REG_R0, TCG_AREG0, fast_off);

From 33ea495cd3bfb21db920b6928af7eda39ced5c20 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 11 Jul 2025 18:20:26 -0600
Subject: [PATCH 0565/2396] include/hw/core/cpu: Invert the indexing into
 CPUTLBDescFast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This array is within CPUNegativeOffsetState, which means the
last element of the array has an offset from env with the
smallest magnitude.  This can be encoded into fewer bits
when generating TCG fast path memory references.

When we changed the NB_MMU_MODES to be a global constant,
rather than a per-target value, we pessimized the code
generated for targets which use only a few mmu indexes.
By inverting the array index, we counteract that.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/hw/core/cpu.h | 11 ++++++++++-
 tcg/tcg.c             |  3 ++-
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 22a78c9ee1..c9f40c2539 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -603,9 +603,18 @@ static inline CPUArchState *cpu_env(CPUState *cpu)
 }
 
 #ifdef CONFIG_TCG
+/*
+ * Invert the index order of the CPUTLBDescFast array so that lower
+ * mmu_idx have offsets from env with smaller magnitude.
+ */
+static inline int mmuidx_to_fast_index(int mmu_idx)
+{
+    return NB_MMU_MODES - 1 - mmu_idx;
+}
+
 static inline CPUTLBDescFast *cpu_tlb_fast(CPUState *cpu, int mmu_idx)
 {
-    return &cpu->neg.tlb.f[mmu_idx];
+    return &cpu->neg.tlb.f[mmuidx_to_fast_index(mmu_idx)];
 }
 #endif
 
diff --git a/tcg/tcg.c b/tcg/tcg.c
index afac55a203..294762c283 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -425,7 +425,8 @@ static uintptr_t G_GNUC_UNUSED get_jmp_target_addr(TCGContext *s, int which)
 static int __attribute__((unused))
 tlb_mask_table_ofs(TCGContext *s, int which)
 {
-    return (offsetof(CPUNegativeOffsetState, tlb.f[which]) -
+    int fi = mmuidx_to_fast_index(which);
+    return (offsetof(CPUNegativeOffsetState, tlb.f[fi]) -
             sizeof(CPUNegativeOffsetState));
 }
 

From 9ea28805814bedf511baf1635bb2fd0ceefcd638 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 11 Jul 2025 18:35:59 -0600
Subject: [PATCH 0566/2396] target/hppa: Adjust mmu indexes to begin with 0

This is a logical reversion of 2ad04500543, though
there have been additions to the set of mmu indexes
since then.  The impetus to that original patch,
"9-15 will use shorter assembler instructions when
run on a x86-64 host" is now handled generically.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/hppa/cpu.h | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 11d59d11ca..672ab3750c 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -29,21 +29,21 @@
 #include "qemu/interval-tree.h"
 #include "hw/registerfields.h"
 
-#define MMU_ABS_W_IDX     6
-#define MMU_ABS_IDX       7
-#define MMU_KERNEL_IDX    8
-#define MMU_KERNEL_P_IDX  9
-#define MMU_PL1_IDX       10
-#define MMU_PL1_P_IDX     11
-#define MMU_PL2_IDX       12
-#define MMU_PL2_P_IDX     13
-#define MMU_USER_IDX      14
-#define MMU_USER_P_IDX    15
+#define MMU_KERNEL_IDX    0
+#define MMU_KERNEL_P_IDX  1
+#define MMU_PL1_IDX       2
+#define MMU_PL1_P_IDX     3
+#define MMU_PL2_IDX       4
+#define MMU_PL2_P_IDX     5
+#define MMU_USER_IDX      6
+#define MMU_USER_P_IDX    7
+#define MMU_ABS_IDX       8
+#define MMU_ABS_W_IDX     9
 
-#define MMU_IDX_MMU_DISABLED(MIDX)  ((MIDX) < MMU_KERNEL_IDX)
-#define MMU_IDX_TO_PRIV(MIDX)       (((MIDX) - MMU_KERNEL_IDX) / 2)
-#define MMU_IDX_TO_P(MIDX)          (((MIDX) - MMU_KERNEL_IDX) & 1)
-#define PRIV_P_TO_MMU_IDX(PRIV, P)  ((PRIV) * 2 + !!(P) + MMU_KERNEL_IDX)
+#define MMU_IDX_MMU_DISABLED(MIDX)  ((MIDX) >= MMU_ABS_IDX)
+#define MMU_IDX_TO_PRIV(MIDX)       ((MIDX) / 2)
+#define MMU_IDX_TO_P(MIDX)          ((MIDX) & 1)
+#define PRIV_P_TO_MMU_IDX(PRIV, P)  ((PRIV) * 2 + !!(P))
 
 #define PRIV_KERNEL       0
 #define PRIV_USER         3

From fa1bc5c8c3302b2fefd99e13227165bfac1f59dd Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 12 Sep 2025 10:52:51 +0200
Subject: [PATCH 0567/2396] tests/functional/s390x/test_pxelinux: Fix warnings
 from pylint

pylint complains about wrong indentation in one of the lines and
that the pxelinux_cfg_contents is a constant that should be written
with capital letters. While we're at it, also add the missing doc
strings.

Reviewed-by: Jared Rossi <jrossi@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250912085251.274294-1-thuth@redhat.com>
---
 tests/functional/s390x/test_pxelinux.py | 25 ++++++++++++++++++-------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/tests/functional/s390x/test_pxelinux.py b/tests/functional/s390x/test_pxelinux.py
index 4fc33b8c46..c00cce6a5a 100755
--- a/tests/functional/s390x/test_pxelinux.py
+++ b/tests/functional/s390x/test_pxelinux.py
@@ -1,10 +1,11 @@
 #!/usr/bin/env python3
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
-#
-# Functional test that checks the pxelinux.cfg network booting of a s390x VM
-# (TFTP booting without config file is already tested by the pxe qtest, so
-#  we don't repeat that here).
+'''
+Functional test that checks the pxelinux.cfg network booting of a s390x VM
+(TFTP booting without config file is already tested by the pxe qtest, so
+we don't repeat that here).
+'''
 
 import os
 import shutil
@@ -12,7 +13,7 @@ import shutil
 from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
 
 
-pxelinux_cfg_contents='''# pxelinux.cfg style config file
+PXELINUX_CFG_CONTENTS='''# pxelinux.cfg style config file
 default Debian
 label Nonexisting
 kernel kernel.notavailable
@@ -26,6 +27,10 @@ kernel kernel.fedora
 '''
 
 class S390PxeLinux(QemuSystemTest):
+    '''
+    Test various ways of booting via a pxelinux.cfg file, for details see:
+    https://wiki.syslinux.org/wiki/index.php?title=PXELINUX#Configuration
+    '''
 
     ASSET_DEBIAN_KERNEL = Asset(
         ('https://snapshot.debian.org/archive/debian/'
@@ -46,6 +51,7 @@ class S390PxeLinux(QemuSystemTest):
         '480859574f3f44caa6cd35c62d70e1ac0609134e22ce2a954bbed9b110c06e0b')
 
     def pxelinux_launch(self, pl_name='default', extra_opts=None):
+        '''Create a pxelinux.cfg file in the right location and launch QEMU'''
         self.require_netdev('user')
         self.set_machine('s390-ccw-virtio')
 
@@ -66,11 +72,11 @@ class S390PxeLinux(QemuSystemTest):
 
         cfg_fname = self.scratch_file('tftp', 'pxelinux.cfg', pl_name)
         with open(cfg_fname, 'w', encoding='utf-8') as f:
-            f.write(pxelinux_cfg_contents)
+            f.write(PXELINUX_CFG_CONTENTS)
 
         virtio_net_dev = 'virtio-net-ccw,netdev=n1,bootindex=1'
         if extra_opts:
-                virtio_net_dev += ',' + extra_opts
+            virtio_net_dev += ',' + extra_opts
 
         self.vm.add_args('-m', '384',
                          '-netdev', f'user,id=n1,tftp={tftpdir}',
@@ -80,6 +86,7 @@ class S390PxeLinux(QemuSystemTest):
 
 
     def test_default(self):
+        '''Check whether the guest uses the "default" file name'''
         self.pxelinux_launch()
         # The kernel prints its arguments to the console, so we can use
         # this to check whether the kernel parameters are correctly handled:
@@ -89,11 +96,13 @@ class S390PxeLinux(QemuSystemTest):
         wait_for_console_pattern(self, 'Run /init as init process')
 
     def test_mac(self):
+        '''Check whether the guest uses file name based on its MAC address'''
         self.pxelinux_launch(pl_name='01-02-ca-fe-ba-be-42',
                              extra_opts='mac=02:ca:fe:ba:be:42,loadparm=3')
         wait_for_console_pattern(self, 'Linux version 5.3.7-301.fc31.s390x')
 
     def test_uuid(self):
+        '''Check whether the guest uses file name based on its UUID'''
         # Also add a non-bootable disk to check the fallback to network boot:
         self.vm.add_args('-blockdev', 'null-co,size=65536,node-name=d1',
                          '-device', 'virtio-blk,drive=d1,bootindex=0,loadparm=1',
@@ -102,11 +111,13 @@ class S390PxeLinux(QemuSystemTest):
         wait_for_console_pattern(self, 'Debian 4.19.146-1 (2020-09-17)')
 
     def test_ip(self):
+        '''Check whether the guest uses file name based on its IP address'''
         self.vm.add_args('-M', 'loadparm=3')
         self.pxelinux_launch(pl_name='0A00020F')
         wait_for_console_pattern(self, 'Linux version 5.3.7-301.fc31.s390x')
 
     def test_menu(self):
+        '''Check whether the boot menu works for pxelinux.cfg booting'''
         self.vm.add_args('-boot', 'menu=on,splash-time=10')
         self.pxelinux_launch(pl_name='0A00')
         wait_for_console_pattern(self, '[1] Nonexisting')

From 2bfe71aa7e6bce5c0254e679f66a44cadcb3a367 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 12 Sep 2025 12:07:52 +0200
Subject: [PATCH 0568/2396] tests: Move the old vmstate-static-checker files to
 tests/data/

All other test data resides in tests/data/, so let's move the dump
files here, too.

Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250912100755.316518-2-thuth@redhat.com>
---
 MAINTAINERS                                                     | 2 +-
 .../vmstate-static-checker}/dump1.json                          | 0
 .../vmstate-static-checker}/dump2.json                          | 0
 3 files changed, 1 insertion(+), 1 deletion(-)
 rename tests/{vmstate-static-checker-data => data/vmstate-static-checker}/dump1.json (100%)
 rename tests/{vmstate-static-checker-data => data/vmstate-static-checker}/dump2.json (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 70eb0241d3..79abe5f6c9 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3613,7 +3613,7 @@ F: migration/
 F: scripts/vmstate-static-checker.py
 F: tests/functional/migration.py
 F: tests/functional/*/*migration.py
-F: tests/vmstate-static-checker-data/
+F: tests/data/vmstate-static-checker/
 F: tests/qtest/migration/
 F: tests/qtest/migration-*
 F: docs/devel/migration/
diff --git a/tests/vmstate-static-checker-data/dump1.json b/tests/data/vmstate-static-checker/dump1.json
similarity index 100%
rename from tests/vmstate-static-checker-data/dump1.json
rename to tests/data/vmstate-static-checker/dump1.json
diff --git a/tests/vmstate-static-checker-data/dump2.json b/tests/data/vmstate-static-checker/dump2.json
similarity index 100%
rename from tests/vmstate-static-checker-data/dump2.json
rename to tests/data/vmstate-static-checker/dump2.json

From 5fe2b6255fa2794e9d0fa29f94b85766af3a4286 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 12 Sep 2025 12:07:53 +0200
Subject: [PATCH 0569/2396] tests/functional: Test whether the
 vmstate-static-checker script works fine

We've got two vmstate dump files in the repository which are meant
for verifying whether the vmstate-static-checker.py works as expected.
Since running this manually is a cumbersome job, let's add an automated
test for this instead that runs the script with the two dump files
and checks for the expected output.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250912100755.316518-3-thuth@redhat.com>
---
 MAINTAINERS                                 |  1 +
 tests/functional/x86_64/meson.build         |  1 +
 tests/functional/x86_64/test_bad_vmstate.py | 58 +++++++++++++++++++++
 3 files changed, 60 insertions(+)
 create mode 100755 tests/functional/x86_64/test_bad_vmstate.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 79abe5f6c9..24c061aff3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3613,6 +3613,7 @@ F: migration/
 F: scripts/vmstate-static-checker.py
 F: tests/functional/migration.py
 F: tests/functional/*/*migration.py
+F: tests/functional/x86_64/test_bad_vmstate.py
 F: tests/data/vmstate-static-checker/
 F: tests/qtest/migration/
 F: tests/qtest/migration-*
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
index d0b4667bb8..ef12ac43b3 100644
--- a/tests/functional/x86_64/meson.build
+++ b/tests/functional/x86_64/meson.build
@@ -10,6 +10,7 @@ test_x86_64_timeouts = {
 }
 
 tests_x86_64_system_quick = [
+  'bad_vmstate',
   'cpu_model_versions',
   'cpu_queries',
   'mem_addr_space',
diff --git a/tests/functional/x86_64/test_bad_vmstate.py b/tests/functional/x86_64/test_bad_vmstate.py
new file mode 100755
index 0000000000..40098a8490
--- /dev/null
+++ b/tests/functional/x86_64/test_bad_vmstate.py
@@ -0,0 +1,58 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+'''Test whether the vmstate-static-checker script detects problems correctly'''
+
+import subprocess
+
+from qemu_test import QemuBaseTest
+
+
+EXPECTED_OUTPUT='''Warning: checking incompatible machine types: "pc-i440fx-2.1", "pc-i440fx-2.2"
+Section "fw_cfg" does not exist in dest
+Section "fusbh200-ehci-usb" version error: 2 > 1
+Section "fusbh200-ehci-usb", Description "ehci-core": expected field "usbsts", got "usbsts_pending"; skipping rest
+Section "pci-serial-4x" Description "pci-serial-multi": Entry "Fields" missing
+Section "intel-hda-generic", Description "intel-hda", Field "pci": missing description
+Section "cfi.pflash01": Entry "Description" missing
+Section "megasas", Description "PCIDevice": expected field "irq_state", while dest has no further fields
+Section "PIIX3-xen" Description "PIIX3": minimum version error: 1 < 2
+Section "PIIX3-xen" Description "PIIX3": Entry "Subsections" missing
+Section "tpci200": Description "tpci200" missing, got "tpci2002" instead; skipping
+Section "sun-fdtwo" Description "fdc": version error: 2 > 1
+Section "sun-fdtwo", Description "fdrive": Subsection "fdrive/media_rate" not found
+Section "usb-kbd" Description "usb-kbd" Field "kbd.keycodes" size mismatch: 4 , 2
+'''
+
+class BadVmStateTest(QemuBaseTest):
+    '''Test class for testing vmstat-static-checker script with bad input'''
+
+    def test_checker(self):
+        """
+        Test whether the checker script correctly detects the changes
+        between dump1.json and dump2.json.
+        """
+        src_json = self.data_file('..', 'data', 'vmstate-static-checker',
+                                  'dump1.json')
+        dst_json = self.data_file('..', 'data', 'vmstate-static-checker',
+                                  'dump2.json')
+        checkerscript = self.data_file('..', '..', 'scripts',
+                                       'vmstate-static-checker.py')
+
+        self.log.info('Comparing %s with %s', src_json, dst_json)
+        cp = subprocess.run([checkerscript, '-s', src_json, '-d', dst_json],
+                            stdout=subprocess.PIPE,
+                            stderr=subprocess.STDOUT,
+                            text=True, check=False)
+        if cp.returncode != 13:
+            self.fail('Unexpected return code of vmstate-static-checker: ' +
+                      cp.returncode)
+        if cp.stdout != EXPECTED_OUTPUT:
+            self.log.info('vmstate-static-checker output:\n%s', cp.stdout)
+            self.log.info('expected output:\n%s', EXPECTED_OUTPUT)
+            self.fail('Unexpected vmstate-static-checker output!')
+
+
+if __name__ == '__main__':
+    QemuBaseTest.main()

From d0fdd2a20b4596258ace2a93650390ac4db653ab Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 12 Sep 2025 12:07:54 +0200
Subject: [PATCH 0570/2396] tests/data/vmstate-static-checker: Add dump files
 from QEMU 7.2.17

For automatic tests, we need reference files from older QEMU versions.
QEMU 7.2 is a long term stable release, so it's a good candidate for
checking whether the migration could still work correctly. Let's add the
files from that version that have been taken with the "-dump-vmstate"
parameter of QEMU (compiled with single machines and the configure switch
"--without-default-devices" to keep the json files reasonable small).

Some devices also have been removed manually from the json files, e.g.
the "pci-bridge" (which can be disabled in later QEMU versions via Kconfig),
and some Linux-related devices like "scsi-block" and "scsi-generic" and
KVM-related devices. Without removing them, we might get errors otherwise
if these devices have not been compiled into the destination QEMU build.

Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250912100755.316518-4-thuth@redhat.com>
---
 .../aarch64/virt-7.2.json                     | 2571 +++++++++++++
 .../vmstate-static-checker/m68k/virt-7.2.json | 2936 +++++++++++++++
 .../ppc64/pseries-7.2.json                    | 1068 ++++++
 .../s390x/s390-ccw-virtio-7.2.json            |  475 +++
 .../x86_64/pc-q35-7.2.json                    | 3297 +++++++++++++++++
 5 files changed, 10347 insertions(+)
 create mode 100644 tests/data/vmstate-static-checker/aarch64/virt-7.2.json
 create mode 100644 tests/data/vmstate-static-checker/m68k/virt-7.2.json
 create mode 100644 tests/data/vmstate-static-checker/ppc64/pseries-7.2.json
 create mode 100644 tests/data/vmstate-static-checker/s390x/s390-ccw-virtio-7.2.json
 create mode 100644 tests/data/vmstate-static-checker/x86_64/pc-q35-7.2.json

diff --git a/tests/data/vmstate-static-checker/aarch64/virt-7.2.json b/tests/data/vmstate-static-checker/aarch64/virt-7.2.json
new file mode 100644
index 0000000000..d7491be99c
--- /dev/null
+++ b/tests/data/vmstate-static-checker/aarch64/virt-7.2.json
@@ -0,0 +1,2571 @@
+{
+  "vmschkmachine": {
+    "Name": "virt-7.2"
+  },
+  "gpex-pcihost": {
+    "Name": "gpex-pcihost",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "arm_gic": {
+    "Name": "arm_gic",
+    "version_id": 12,
+    "minimum_version_id": 12,
+    "Description": {
+      "name": "arm_gic",
+      "version_id": 12,
+      "minimum_version_id": 12,
+      "Fields": [
+        {
+          "field": "ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cpu_ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irq_state",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 7,
+          "Description": {
+            "name": "arm_gic_irq_state",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "enabled",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pending",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "active",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "level",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "model",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "edge_trigger",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "group",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "irq_target",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority1",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority2",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "sgi_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority_mask",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "running_priority",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "current_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "bpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "abpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "apr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "nsapr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "arm_gic_virt_state",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "h_hcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_misr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_lr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_apr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "cpu_ctlr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "priority_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "running_priority",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "current_pending",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "bpr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "abpr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "arm-gicv3-its-common": {
+    "Name": "arm-gicv3-its-common",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "arm_gicv3_its",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iidr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cbaser",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "cwriter",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "creadr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "baser",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "arm-gicv3-common": {
+    "Name": "arm-gicv3-common",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "arm_gicv3",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "gicd_ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gicd_statusr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "group",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "grpmod",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "active",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "edge_trigger",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gicd_ipriority",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "gicd_irouter",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "gicd_nsacr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cpu",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 664,
+          "Description": {
+            "name": "arm_gicv3_cpu",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "level",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_ctlr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_statusr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_waker",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_propbaser",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "gicr_pendbaser",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "gicr_igroupr0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_ienabler0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_ipendr0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_iactiver0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "edge_trigger",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_igrpmodr0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_nsacr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "gicr_ipriorityr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "icc_ctlr_el1",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "icc_pmr_el1",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "icc_bpr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "icc_apr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "icc_igrpen",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "icc_ctlr_el3",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "arm_gicv3_cpu/virt",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "ich_apr",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  },
+                  {
+                    "field": "ich_hcr_el2",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  },
+                  {
+                    "field": "ich_lr_el2",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  },
+                  {
+                    "field": "ich_vmcr_el2",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              },
+              {
+                "name": "arm_gicv3_cpu/sre_el1",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "icc_sre_el1",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              },
+              {
+                "name": "arm_gicv3_cpu/gicv4",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "gicr_vpropbaser",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  },
+                  {
+                    "field": "gicr_vpendbaser",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "arm_gicv3/gicd_no_migration_shift_bug",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "gicd_no_migration_shift_bug",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg": {
+    "Name": "fw_cfg",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "cfi.pflash01": {
+    "Name": "cfi.pflash01",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "pflash_cfi01",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "wcycle",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "cmd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "status",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "counter",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "pflash_cfi01_blk_write",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "blk_bytes",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 0
+            },
+            {
+              "field": "blk_offset",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pl061_luminary": {
+    "Name": "pl061_luminary",
+    "version_id": 4,
+    "minimum_version_id": 4,
+    "Description": {
+      "name": "pl061",
+      "version_id": 4,
+      "minimum_version_id": 4,
+      "Fields": [
+        {
+          "field": "locked",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "old_out_data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "old_in_data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dir",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "isense",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ibe",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "im",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "istate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "afsel",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr2r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr4r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr8r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "odr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "pur",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "pdr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "slr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "den",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "amsel",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "pl011_luminary": {
+    "Name": "pl011_luminary",
+    "version_id": 2,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "pl011",
+      "version_id": 2,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "readbuff",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "flags",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "lcr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rsr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dmacr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "int_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "int_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_fifo",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ilpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ibrd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "fbrd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ifl",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_pos",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_count",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_trigger",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "pl011/clock",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "clk",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8,
+              "Description": {
+                "name": "clock",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "period",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ],
+                "Subsections": [
+                  {
+                    "name": "clock/muldiv",
+                    "version_id": 1,
+                    "minimum_version_id": 1,
+                    "Fields": [
+                      {
+                        "field": "multiplier",
+                        "version_id": 0,
+                        "field_exists": false,
+                        "size": 4
+                      },
+                      {
+                        "field": "divider",
+                        "version_id": 0,
+                        "field_exists": false,
+                        "size": 4
+                      }
+                    ]
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pl061": {
+    "Name": "pl061",
+    "version_id": 4,
+    "minimum_version_id": 4,
+    "Description": {
+      "name": "pl061",
+      "version_id": 4,
+      "minimum_version_id": 4,
+      "Fields": [
+        {
+          "field": "locked",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "old_out_data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "old_in_data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dir",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "isense",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ibe",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "im",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "istate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "afsel",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr2r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr4r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dr8r",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "odr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "pur",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "pdr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "slr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "den",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "amsel",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "vmcoreinfo": {
+    "Name": "vmcoreinfo",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "vmcoreinfo",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "has_vmcoreinfo",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "vmcoreinfo.host_format",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "vmcoreinfo.guest_format",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "vmcoreinfo.size",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "vmcoreinfo.paddr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "arm_gic_common": {
+    "Name": "arm_gic_common",
+    "version_id": 12,
+    "minimum_version_id": 12,
+    "Description": {
+      "name": "arm_gic",
+      "version_id": 12,
+      "minimum_version_id": 12,
+      "Fields": [
+        {
+          "field": "ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cpu_ctlr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irq_state",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 7,
+          "Description": {
+            "name": "arm_gic_irq_state",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "enabled",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pending",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "active",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "level",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "model",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "edge_trigger",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "group",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "irq_target",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority1",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority2",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "sgi_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority_mask",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "running_priority",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "current_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "bpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "abpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "apr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "nsapr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "arm_gic_virt_state",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "h_hcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_misr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_lr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "h_apr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "cpu_ctlr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "priority_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "running_priority",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "current_pending",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "bpr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "abpr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "arm-smmuv3": {
+    "Name": "arm-smmuv3",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "smmuv3",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "features",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "sid_size",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "sid_split",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr0ack",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "statusr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irq_ctrl",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gerror",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gerrorn",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gerror_irq_cfg0",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "gerror_irq_cfg1",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "gerror_irq_cfg2",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "strtab_base",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "strtab_base_cfg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "eventq_irq_cfg0",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "eventq_irq_cfg1",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "eventq_irq_cfg2",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cmdq",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 24,
+          "Description": {
+            "name": "smmuv3_queue",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "base",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "prod",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "cons",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "log2size",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "eventq",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 24,
+          "Description": {
+            "name": "smmuv3_queue",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "base",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "prod",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "cons",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "log2size",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "pl011": {
+    "Name": "pl011",
+    "version_id": 2,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "pl011",
+      "version_id": 2,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "readbuff",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "flags",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "lcr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rsr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "dmacr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "int_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "int_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_fifo",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ilpr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ibrd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "fbrd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ifl",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_pos",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_count",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "read_trigger",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "pl011/clock",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "clk",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8,
+              "Description": {
+                "name": "clock",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "period",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ],
+                "Subsections": [
+                  {
+                    "name": "clock/muldiv",
+                    "version_id": 1,
+                    "minimum_version_id": 1,
+                    "Fields": [
+                      {
+                        "field": "multiplier",
+                        "version_id": 0,
+                        "field_exists": false,
+                        "size": 4
+                      },
+                      {
+                        "field": "divider",
+                        "version_id": 0,
+                        "field_exists": false,
+                        "size": 4
+                      }
+                    ]
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "armv7m": {
+    "Name": "armv7m",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "armv7m",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "refclk",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "clock",
+            "version_id": 0,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "period",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "clock/muldiv",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "multiplier",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "divider",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "cpuclk",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "clock",
+            "version_id": 0,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "period",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "clock/muldiv",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "multiplier",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "divider",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "fw_cfg_mem": {
+    "Name": "fw_cfg_mem",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pl031": {
+    "Name": "pl031",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "pl031",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "tick_offset_vmstate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "mr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "lr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "cr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "im",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "is",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "pl031/tick-offset",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "tick_offset",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg_io": {
+    "Name": "fw_cfg_io",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "virtio-serial-device": {
+    "Name": "virtio-serial-device",
+    "version_id": 3,
+    "minimum_version_id": 3,
+    "Description": {
+      "name": "virtio-console",
+      "version_id": 3,
+      "minimum_version_id": 3,
+      "Fields": [
+        {
+          "field": "virtio",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 0
+        }
+      ]
+    }
+  },
+  "acpi-ged": {
+    "Name": "acpi-ged",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "acpi-ged",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "ged_state",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 560,
+          "Description": {
+            "name": "acpi-ged-state",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "sel",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "acpi-ged/memhp",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "memhp_state",
+              "version_id": 1,
+              "field_exists": false,
+              "size": 304,
+              "Description": {
+                "name": "memory hotplug state",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "selector",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "devs",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "memory hotplug device state",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "is_enabled",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "is_inserting",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "ost_event",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "ost_status",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "acpi-ged/ghes",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "ghes_state",
+              "version_id": 1,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "acpi-ghes",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "ghes_addr_le",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pcie-host-bridge": {
+    "Name": "pcie-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "gpio-key": {
+    "Name": "gpio-key",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "gpio-key",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "timer",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "armv7m_nvic": {
+    "Name": "armv7m_nvic",
+    "version_id": 4,
+    "minimum_version_id": 4,
+    "Description": {
+      "name": "armv7m_nvic",
+      "version_id": 4,
+      "minimum_version_id": 4,
+      "Fields": [
+        {
+          "field": "vectors",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 6,
+          "Description": {
+            "name": "armv7m_nvic_info",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "prio",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "enabled",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pending",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "active",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "level",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "prigroup[M_REG_NS]",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "armv7m_nvic/m-security",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "sec_vectors",
+              "version_id": 1,
+              "field_exists": false,
+              "size": 6,
+              "Description": {
+                "name": "armv7m_nvic_info",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "prio",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 2
+                  },
+                  {
+                    "field": "enabled",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "pending",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "active",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "level",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            },
+            {
+              "field": "prigroup[M_REG_S]",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "itns",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pci-host-bridge": {
+    "Name": "pci-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "gpex-root": {
+    "Name": "gpex-root",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "gpex_root",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "parent_obj",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2608,
+          "Description": {
+            "name": "PCIDevice",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "version_id",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 256
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 4096
+              },
+              {
+                "field": "irq_state",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 16
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "armv7m_systick": {
+    "Name": "armv7m_systick",
+    "version_id": 3,
+    "minimum_version_id": 3,
+    "Description": {
+      "name": "armv7m_systick",
+      "version_id": 3,
+      "minimum_version_id": 3,
+      "Fields": [
+        {
+          "field": "refclk",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "clock",
+            "version_id": 0,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "period",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "clock/muldiv",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "multiplier",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "divider",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "cpuclk",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "clock",
+            "version_id": 0,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "period",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "clock/muldiv",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "multiplier",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "divider",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "control",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "tick",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "ptimer",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "ptimer",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "enabled",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "limit",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "delta",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "period_frac",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "period",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "last_event",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "next_event",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "timer",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ]
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/tests/data/vmstate-static-checker/m68k/virt-7.2.json b/tests/data/vmstate-static-checker/m68k/virt-7.2.json
new file mode 100644
index 0000000000..16bee8cdad
--- /dev/null
+++ b/tests/data/vmstate-static-checker/m68k/virt-7.2.json
@@ -0,0 +1,2936 @@
+{
+  "vmschkmachine": {
+    "Name": "virt-7.2"
+  },
+  "m68020-m68k-cpu": {
+    "Name": "m68020-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "m68030-m68k-cpu": {
+    "Name": "m68030-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg": {
+    "Name": "fw_cfg",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "m68k-irq-controller": {
+    "Name": "m68k-irq-controller",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "m68k-irqc",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "ipr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "virt-ctrl": {
+    "Name": "virt-ctrl",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "virt-ctrl",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "irq_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "m68040-m68k-cpu": {
+    "Name": "m68040-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "goldfish_pic": {
+    "Name": "goldfish_pic",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "goldfish_pic",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "goldfish_tty": {
+    "Name": "goldfish_tty",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "goldfish_tty",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "data_len",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "data_ptr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "int_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "rx_fifo",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 24,
+          "Description": {
+            "name": "Fifo8",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "data",
+                "version_id": 1,
+                "field_exists": false,
+                "size": 0
+              },
+              {
+                "field": "head",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "num",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "m68000-m68k-cpu": {
+    "Name": "m68000-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "m68010-m68k-cpu": {
+    "Name": "m68010-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "m68060-m68k-cpu": {
+    "Name": "m68060-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg_mem": {
+    "Name": "fw_cfg_mem",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "any-m68k-cpu": {
+    "Name": "any-m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg_io": {
+    "Name": "fw_cfg_io",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "virtio-serial-device": {
+    "Name": "virtio-serial-device",
+    "version_id": 3,
+    "minimum_version_id": 3,
+    "Description": {
+      "name": "virtio-console",
+      "version_id": 3,
+      "minimum_version_id": 3,
+      "Fields": [
+        {
+          "field": "virtio",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 0
+        }
+      ]
+    }
+  },
+  "goldfish_rtc": {
+    "Name": "goldfish_rtc",
+    "version_id": 3,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "goldfish_rtc",
+      "version_id": 3,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "tick_offset_vmstate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "alarm_next",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "alarm_running",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irq_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irq_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "time_high",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "tick_offset",
+          "version_id": 3,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "m68k-cpu": {
+    "Name": "m68k-cpu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "cpu",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "env.dregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.aregs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pc",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.current_sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.sp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_op",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_x",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_n",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_v",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_c",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.cc_z",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_vector",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "env.pending_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "cpu/fpu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.fpcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fpsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.fregs",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            },
+            {
+              "field": "env.fp_result",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 16,
+              "Description": {
+                "name": "freg",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "tmp",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "freg_tmp",
+                      "version_id": 0,
+                      "minimum_version_id": 0,
+                      "Fields": [
+                        {
+                          "field": "tmp_mant",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "tmp_exp",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        }
+                      ]
+                    }
+                  }
+                ]
+              }
+            }
+          ]
+        },
+        {
+          "name": "cpu/cf_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.macc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "env.macsr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mac_mask",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.rambar0",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mbar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_mmu",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.mmu.ar",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.ssw",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.tcr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            },
+            {
+              "field": "env.mmu.urp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.srp",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.fault",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "env.mmu.ttr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.mmu.mmusr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "cpu/68040_spregs",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "env.vbr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.cacr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.sfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            },
+            {
+              "field": "env.dfc",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/tests/data/vmstate-static-checker/ppc64/pseries-7.2.json b/tests/data/vmstate-static-checker/ppc64/pseries-7.2.json
new file mode 100644
index 0000000000..330bbbefed
--- /dev/null
+++ b/tests/data/vmstate-static-checker/ppc64/pseries-7.2.json
@@ -0,0 +1,1068 @@
+{
+  "vmschkmachine": {
+    "Name": "pseries-7.2"
+  },
+  "spapr-nvram": {
+    "Name": "spapr-nvram",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr_nvram",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "size",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "buf",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 0
+        }
+      ]
+    }
+  },
+  "xive-source": {
+    "Name": "xive-source",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "xive-source",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "nr_irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "status",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 0
+        }
+      ]
+    }
+  },
+  "xive-tctx": {
+    "Name": "xive-tctx",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "xive-tctx",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "regs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 64
+        }
+      ]
+    }
+  },
+  "pci-host-bridge": {
+    "Name": "pci-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "ics-spapr": {
+    "Name": "ics-spapr",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ics",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "nr_irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "ics/irq",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "server",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "priority",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "saved_priority",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "flags",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "scsi-cd": {
+    "Name": "scsi-cd",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "scsi-disk",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "qdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 608,
+          "Description": {
+            "name": "SCSIDevice",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "unit_attention.key",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "unit_attention.asc",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "unit_attention.ascq",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense_is_ua",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense_len",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "requests",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 0
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "SCSIDevice/sense",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "sense",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "media_changed",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "media_event",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "eject_request",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "tray_open",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "tray_locked",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "spapr-xive": {
+    "Name": "spapr-xive",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr-xive",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "nr_irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "eat",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "spapr-xive/eas",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "w",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ]
+          }
+        },
+        {
+          "field": "endt",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 32,
+          "Description": {
+            "name": "spapr-xive/end",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "w0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w1",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w2",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w3",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w4",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w5",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w6",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "w7",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "scsi-hd": {
+    "Name": "scsi-hd",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "scsi-disk",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "qdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 608,
+          "Description": {
+            "name": "SCSIDevice",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "unit_attention.key",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "unit_attention.asc",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "unit_attention.ascq",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense_is_ua",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "sense_len",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "requests",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 0
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "SCSIDevice/sense",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "sense",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "media_changed",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "media_event",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "eject_request",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "tray_open",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "tray_locked",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "fw_cfg_mem": {
+    "Name": "fw_cfg_mem",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "spapr-vty": {
+    "Name": "spapr-vty",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr_vty",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "sdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 848,
+          "Description": {
+            "name": "spapr_vio",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "reg",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "irq",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "signal_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qladdr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qsize",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "crq.qnext",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        },
+        {
+          "field": "in",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "out",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "buf",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 16
+        }
+      ]
+    }
+  },
+  "spapr-wdt": {
+    "Name": "spapr-wdt",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr_watchdog",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "timer",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 48
+        },
+        {
+          "field": "action",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "leave_others",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "fw_cfg_io": {
+    "Name": "fw_cfg_io",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "spapr-vscsi": {
+    "Name": "spapr-vscsi",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr_vscsi",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "vdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 848,
+          "Description": {
+            "name": "spapr_vio",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "reg",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "irq",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "signal_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qladdr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qsize",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "crq.qnext",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "spapr-rtc": {
+    "Name": "spapr-rtc",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr/rtc",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "ns_offset",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "spapr-vlan": {
+    "Name": "spapr-vlan",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "spapr_llan",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "sdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 848,
+          "Description": {
+            "name": "spapr_vio",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "reg",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "irq",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "signal_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qladdr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "crq.qsize",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "crq.qnext",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        },
+        {
+          "field": "isopen",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "buf_list",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "add_buf_ptr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "use_buf_ptr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rx_bufs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rxq_ptr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "spapr_llan/rx_pools",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "rx_pool",
+              "version_id": 1,
+              "field_exists": false,
+              "size": 8,
+              "Description": {
+                "name": "spapr_llan/rx_buffer_pool",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "bufsize",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "count",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "bds",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              }
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "fw_cfg": {
+    "Name": "fw_cfg",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "ics": {
+    "Name": "ics",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ics",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "nr_irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "irqs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8,
+          "Description": {
+            "name": "ics/irq",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "server",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "priority",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "saved_priority",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "flags",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/tests/data/vmstate-static-checker/s390x/s390-ccw-virtio-7.2.json b/tests/data/vmstate-static-checker/s390x/s390-ccw-virtio-7.2.json
new file mode 100644
index 0000000000..9698852bd3
--- /dev/null
+++ b/tests/data/vmstate-static-checker/s390x/s390-ccw-virtio-7.2.json
@@ -0,0 +1,475 @@
+{
+  "vmschkmachine": {
+    "Name": "s390-ccw-virtio-7.2"
+  },
+  "sclpquiesce": {
+    "Name": "sclpquiesce",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "sclpquiesce",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "event_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "s390-sclp-event-facility": {
+    "Name": "s390-sclp-event-facility",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "vmstate-event-facility",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "receive_mask_pieces[1]",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "vmstate-event-facility/mask64",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "receive_mask_pieces[0]",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "vmstate-event-facility/mask_length",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "mask_length",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 2
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "zpci": {
+    "Name": "zpci",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "zpci",
+      "version_id": 0,
+      "minimum_version_id": 0
+    }
+  },
+  "sclpconsole": {
+    "Name": "sclpconsole",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "sclpconsole",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "event.event_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "iov",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "iov_sclp",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iov_bs",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iov_data_len",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "iov_sclp_rest",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "virtio-serial-device": {
+    "Name": "virtio-serial-device",
+    "version_id": 3,
+    "minimum_version_id": 3,
+    "Description": {
+      "name": "virtio-console",
+      "version_id": 3,
+      "minimum_version_id": 3,
+      "Fields": [
+        {
+          "field": "virtio",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 0
+        }
+      ]
+    }
+  },
+  "sclplmconsole": {
+    "Name": "sclplmconsole",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "sclplmconsole",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "event.event_pending",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "write_errors",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "length",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "buf",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "s390-pcihost": {
+    "Name": "s390-pcihost",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "s390-flic-qemu": {
+    "Name": "s390-flic-qemu",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "qemu-s390-flic",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "simm",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "nimm",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "fw_cfg_io": {
+    "Name": "fw_cfg_io",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "s390-ipl": {
+    "Name": "s390-ipl",
+    "version_id": 0,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "ipl",
+      "version_id": 0,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "compat_start_addr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "compat_bios_start_addr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "iplb",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4096,
+          "Description": {
+            "name": "ipl/iplb",
+            "version_id": 0,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "reserved1",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "devno",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "reserved2",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "ipl/iplb_extended",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "reserved_ext",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "iplb_valid",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "cssid",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "ssid",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "devno",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        }
+      ]
+    }
+  },
+  "pci-host-bridge": {
+    "Name": "pci-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "fw_cfg_mem": {
+    "Name": "fw_cfg_mem",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  }
+}
diff --git a/tests/data/vmstate-static-checker/x86_64/pc-q35-7.2.json b/tests/data/vmstate-static-checker/x86_64/pc-q35-7.2.json
new file mode 100644
index 0000000000..e527dffacc
--- /dev/null
+++ b/tests/data/vmstate-static-checker/x86_64/pc-q35-7.2.json
@@ -0,0 +1,3297 @@
+{
+  "vmschkmachine": {
+    "Name": "pc-q35-7.2"
+  },
+  "fw_cfg": {
+    "Name": "fw_cfg",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pcie-host-bridge": {
+    "Name": "pcie-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "isa-pit": {
+    "Name": "isa-pit",
+    "version_id": 3,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "i8254",
+      "version_id": 3,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "channels[0].irq_disabled",
+          "version_id": 3,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "channels",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 56,
+          "Description": {
+            "name": "pit channel",
+            "version_id": 2,
+            "minimum_version_id": 2,
+            "Fields": [
+              {
+                "field": "count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "latched_count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "count_latched",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status_latched",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "read_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "write_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "write_latch",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "rw_mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "bcd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "gate",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "count_load_time",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "next_transition_time",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ]
+          }
+        },
+        {
+          "field": "channels[0].next_transition_time",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "mch": {
+    "Name": "mch",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "mch",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "parent_obj",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2608,
+          "Description": {
+            "name": "PCIDevice",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "version_id",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 256
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 4096
+              },
+              {
+                "field": "irq_state",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 16
+              }
+            ]
+          }
+        },
+        {
+          "field": "unused",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "pic-common": {
+    "Name": "pic-common",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "i8259",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "last_irr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "irr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "imr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "isr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority_add",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "irq_base",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "read_reg_select",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "poll",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "special_mask",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "init_state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "auto_eoi",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "rotate_on_auto_eoi",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "special_fully_nested_mode",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "init4",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "single_mode",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "elcr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "ICH9-LPC": {
+    "Name": "ICH9-LPC",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ICH9LPC",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "d",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2608,
+          "Description": {
+            "name": "PCIDevice",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "version_id",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 256
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 4096
+              },
+              {
+                "field": "irq_state",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 16
+              }
+            ]
+          }
+        },
+        {
+          "field": "apm",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 304,
+          "Description": {
+            "name": "APM State",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "apmc",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "apms",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "pm",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 6480,
+          "Description": {
+            "name": "ich9_pm",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "acpi_regs.pm1.evt.sts",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "acpi_regs.pm1.evt.en",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "acpi_regs.pm1.cnt.cnt",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "acpi_regs.tmr.timer",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "acpi_regs.tmr.overflow_time",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "acpi_regs.gpe.sts",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "acpi_regs.gpe.en",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smi_en",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "smi_sts",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "ich9_pm/memhp",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "acpi_memory_hotplug",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 304,
+                    "Description": {
+                      "name": "memory hotplug state",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "selector",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "devs",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 24,
+                          "Description": {
+                            "name": "memory hotplug device state",
+                            "version_id": 1,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "is_enabled",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "is_inserting",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "ost_event",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "ost_status",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              }
+                            ]
+                          }
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "ich9_pm/tco",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "tco_regs",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 320,
+                    "Description": {
+                      "name": "tco io device status",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "tco.rld",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "tco.din",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco.dout",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco.sts1",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "tco.sts2",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "tco.cnt1",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "tco.cnt2",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "tco.msg1",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco.msg2",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco.wdcnt",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco.tmr",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 2
+                        },
+                        {
+                          "field": "sw_irq_gen",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "tco_timer",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "expire_time",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 8
+                        },
+                        {
+                          "field": "timeouts_no",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "ich9_pm/cpuhp",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "cpuhp_state",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 304,
+                    "Description": {
+                      "name": "CPU hotplug state",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "selector",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "command",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 1
+                        },
+                        {
+                          "field": "devs",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 32,
+                          "Description": {
+                            "name": "CPU hotplug device state",
+                            "version_id": 1,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "is_inserting",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "is_removing",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "ost_event",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "ost_status",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              }
+                            ]
+                          }
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "ich9_pm/pcihp",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "acpi_pci_hotplug.hotplug_select",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "acpi_pci_hotplug.acpi_pcihp_pci_status",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 12,
+                    "Description": {
+                      "name": "acpi_pcihp_pci_status",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "up",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "down",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        }
+                      ]
+                    }
+                  },
+                  {
+                    "field": "acpi_pci_hotplug.acpi_index",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              }
+            ]
+          }
+        },
+        {
+          "field": "chip_config",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "sci_level",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "ICH9LPC/rst_cnt",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "rst_cnt",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        },
+        {
+          "name": "ICH9LPC/smi_feat",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "smi_guest_features_le",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "smi_features_ok",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            },
+            {
+              "field": "smi_negotiated_features",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "pit-common": {
+    "Name": "pit-common",
+    "version_id": 3,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "i8254",
+      "version_id": 3,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "channels[0].irq_disabled",
+          "version_id": 3,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "channels",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 56,
+          "Description": {
+            "name": "pit channel",
+            "version_id": 2,
+            "minimum_version_id": 2,
+            "Fields": [
+              {
+                "field": "count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "latched_count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "count_latched",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status_latched",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "read_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "write_state",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "write_latch",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "rw_mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "bcd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "gate",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "count_load_time",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "next_transition_time",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              }
+            ]
+          }
+        },
+        {
+          "field": "channels[0].next_transition_time",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "vmgenid": {
+    "Name": "vmgenid",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "vmgenid",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "vmgenid_addr_le",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "ioapic-common": {
+    "Name": "ioapic-common",
+    "version_id": 3,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ioapic",
+      "version_id": 3,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "id",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "ioregsel",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "unused",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "irr",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ioredtbl",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "isa-i8259": {
+    "Name": "isa-i8259",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "i8259",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "last_irr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "irr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "imr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "isr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "priority_add",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "irq_base",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "read_reg_select",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "poll",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "special_mask",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "init_state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "auto_eoi",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "rotate_on_auto_eoi",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "special_fully_nested_mode",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "init4",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "single_mode",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "elcr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "cfi.pflash01": {
+    "Name": "cfi.pflash01",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "pflash_cfi01",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "wcycle",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "cmd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "status",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "counter",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "pflash_cfi01_blk_write",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "blk_bytes",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 0
+            },
+            {
+              "field": "blk_offset",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "i8042-mmio": {
+    "Name": "i8042-mmio",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "pckbd-mmio",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "kbd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2328,
+          "Description": {
+            "name": "pckbd",
+            "version_id": 3,
+            "minimum_version_id": 3,
+            "Fields": [
+              {
+                "field": "write_cmd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pending_tmp",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "pckbd_outport",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "outport",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              },
+              {
+                "name": "pckbd/extended_state",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "migration_flags",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "obsrc",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "obdata",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "cbdata",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "isa-serial": {
+    "Name": "isa-serial",
+    "version_id": 3,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "serial",
+      "version_id": 3,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 656,
+          "Description": {
+            "name": "serial",
+            "version_id": 3,
+            "minimum_version_id": 2,
+            "Fields": [
+              {
+                "field": "divider",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "rbr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "ier",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "iir",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "lcr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "mcr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "lsr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "msr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "scr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "fcr_vmstate",
+                "version_id": 3,
+                "field_exists": false,
+                "size": 1
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "serial/thr_ipending",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "thr_ipending",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              },
+              {
+                "name": "serial/tsr",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "tsr_retry",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "thr",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "tsr",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              },
+              {
+                "name": "serial/recv_fifo",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "recv_fifo",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "Fifo8",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "data",
+                          "version_id": 1,
+                          "field_exists": false,
+                          "size": 0
+                        },
+                        {
+                          "field": "head",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "num",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "serial/xmit_fifo",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "xmit_fifo",
+                    "version_id": 1,
+                    "field_exists": false,
+                    "size": 24,
+                    "Description": {
+                      "name": "Fifo8",
+                      "version_id": 1,
+                      "minimum_version_id": 1,
+                      "Fields": [
+                        {
+                          "field": "data",
+                          "version_id": 1,
+                          "field_exists": false,
+                          "size": 0
+                        },
+                        {
+                          "field": "head",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        },
+                        {
+                          "field": "num",
+                          "version_id": 0,
+                          "field_exists": false,
+                          "size": 4
+                        }
+                      ]
+                    }
+                  }
+                ]
+              },
+              {
+                "name": "serial/fifo_timeout_timer",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "fifo_timeout_timer",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              },
+              {
+                "name": "serial/timeout_ipending",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "timeout_ipending",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  }
+                ]
+              },
+              {
+                "name": "serial/poll",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "poll_msl",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "modem_status_poll",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 8
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "ps2-mouse": {
+    "Name": "ps2-mouse",
+    "version_id": 2,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "ps2mouse",
+      "version_id": 2,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "parent_obj",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1104,
+          "Description": {
+            "name": "PS2 Common State",
+            "version_id": 3,
+            "minimum_version_id": 2,
+            "Fields": [
+              {
+                "field": "write_cmd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.rptr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.wptr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.data",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 256
+              }
+            ]
+          }
+        },
+        {
+          "field": "mouse_status",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_resolution",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_sample_rate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_wrap",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_type",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_detect_state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mouse_dx",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "mouse_dy",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "mouse_dz",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "mouse_buttons",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "kvmvapic": {
+    "Name": "kvmvapic",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "kvm-tpr-opt",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "rom_state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 124,
+          "Description": {
+            "name": "kvmvapic-guest-rom",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "unused",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 8
+              },
+              {
+                "field": "vaddr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "fixup_start",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "fixup_end",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "vapic_vaddr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "vapic_size",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "vcpu_shift",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "real_tpr_addr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "up",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 44,
+                "Description": {
+                  "name": "kvmvapic-handlers",
+                  "version_id": 1,
+                  "minimum_version_id": 1,
+                  "Fields": [
+                    {
+                      "field": "set_tpr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "set_tpr_eax",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "get_tpr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "get_tpr_stack",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    }
+                  ]
+                }
+              },
+              {
+                "field": "mp",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 44,
+                "Description": {
+                  "name": "kvmvapic-handlers",
+                  "version_id": 1,
+                  "minimum_version_id": 1,
+                  "Fields": [
+                    {
+                      "field": "set_tpr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "set_tpr_eax",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "get_tpr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "get_tpr_stack",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    }
+                  ]
+                }
+              }
+            ]
+          }
+        },
+        {
+          "field": "state",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "real_tpr_addr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rom_state_vaddr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "vapic_paddr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "rom_state_paddr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "ich9-ahci": {
+    "Name": "ich9-ahci",
+    "version_id": 1,
+    "minimum_version_id": 0,
+    "Description": {
+      "name": "ich9_ahci",
+      "version_id": 1,
+      "minimum_version_id": 0,
+      "Fields": [
+        {
+          "field": "parent_obj",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2608,
+          "Description": {
+            "name": "PCIDevice",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "version_id",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 256
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 4096
+              },
+              {
+                "field": "irq_state",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 16
+              }
+            ]
+          }
+        },
+        {
+          "field": "ahci",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 624,
+          "Description": {
+            "name": "ahci",
+            "version_id": 1,
+            "minimum_version_id": 0,
+            "Fields": [
+              {
+                "field": "dev",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 6088,
+                "Description": {
+                  "name": "ahci port",
+                  "version_id": 1,
+                  "minimum_version_id": 0,
+                  "Fields": [
+                    {
+                      "field": "port",
+                      "version_id": 1,
+                      "field_exists": false,
+                      "size": 2304,
+                      "Description": {
+                        "name": "ide_bus",
+                        "version_id": 1,
+                        "minimum_version_id": 1,
+                        "Fields": [
+                          {
+                            "field": "cmd",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "unit",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          }
+                        ],
+                        "Subsections": [
+                          {
+                            "name": "ide_bus/error",
+                            "version_id": 2,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "error_status",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "retry_sector_num",
+                                "version_id": 2,
+                                "field_exists": false,
+                                "size": 8
+                              },
+                              {
+                                "field": "retry_nsector",
+                                "version_id": 2,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "retry_unit",
+                                "version_id": 2,
+                                "field_exists": false,
+                                "size": 1
+                              }
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "field": "port.ifs[0]",
+                      "version_id": 1,
+                      "field_exists": false,
+                      "size": 984,
+                      "Description": {
+                        "name": "ide_drive",
+                        "version_id": 3,
+                        "minimum_version_id": 0,
+                        "Fields": [
+                          {
+                            "field": "mult_sectors",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 4
+                          },
+                          {
+                            "field": "identify_set",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 4
+                          },
+                          {
+                            "field": "identify_data",
+                            "version_id": 0,
+                            "field_exists": true,
+                            "size": 512
+                          },
+                          {
+                            "field": "feature",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "error",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "nsector",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 4
+                          },
+                          {
+                            "field": "sector",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "lcyl",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hcyl",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hob_feature",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hob_sector",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hob_nsector",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hob_lcyl",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "hob_hcyl",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "select",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "status",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "lba48",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "sense_key",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "asc",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "cdrom_changed",
+                            "version_id": 3,
+                            "field_exists": false,
+                            "size": 1
+                          }
+                        ],
+                        "Subsections": [
+                          {
+                            "name": "ide_drive/pio_state",
+                            "version_id": 1,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "req_nb_sectors",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "io_buffer",
+                                "version_id": 1,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "cur_io_buffer_offset",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "cur_io_buffer_len",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "end_transfer_fn_idx",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "elementary_transfer_size",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              },
+                              {
+                                "field": "packet_transfer_size",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 4
+                              }
+                            ]
+                          },
+                          {
+                            "name": "ide_drive/tray_state",
+                            "version_id": 1,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "tray_open",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "tray_locked",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              }
+                            ]
+                          },
+                          {
+                            "name": "ide_drive/atapi/gesn_state",
+                            "version_id": 1,
+                            "minimum_version_id": 1,
+                            "Fields": [
+                              {
+                                "field": "events.new_media",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              },
+                              {
+                                "field": "events.eject_request",
+                                "version_id": 0,
+                                "field_exists": false,
+                                "size": 1
+                              }
+                            ]
+                          }
+                        ]
+                      }
+                    },
+                    {
+                      "field": "port_state",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "finished",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.lst_addr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.lst_addr_hi",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.fis_addr",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.fis_addr_hi",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.irq_stat",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.irq_mask",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.cmd",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.tfdata",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.sig",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.scr_stat",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.scr_ctl",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.scr_err",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.scr_act",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "port_regs.cmd_issue",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "done_first_drq",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 1
+                    },
+                    {
+                      "field": "busy_slot",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 4
+                    },
+                    {
+                      "field": "init_d2h_sent",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 1
+                    },
+                    {
+                      "field": "ncq_tfs",
+                      "version_id": 1,
+                      "field_exists": false,
+                      "size": 112,
+                      "Description": {
+                        "name": "ncq state",
+                        "version_id": 1,
+                        "minimum_version_id": 0,
+                        "Fields": [
+                          {
+                            "field": "sector_count",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 4
+                          },
+                          {
+                            "field": "lba",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 8
+                          },
+                          {
+                            "field": "tag",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "cmd",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "slot",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "used",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          },
+                          {
+                            "field": "halt",
+                            "version_id": 0,
+                            "field_exists": false,
+                            "size": 1
+                          }
+                        ]
+                      }
+                    }
+                  ]
+                }
+              },
+              {
+                "field": "control_regs.cap",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "control_regs.ghc",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "control_regs.irqstatus",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "control_regs.impl",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "control_regs.version",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "idp_index",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "ports",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "i8042": {
+    "Name": "i8042",
+    "version_id": 3,
+    "minimum_version_id": 3,
+    "Description": {
+      "name": "pckbd",
+      "version_id": 3,
+      "minimum_version_id": 3,
+      "Fields": [
+        {
+          "field": "kbd",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2328,
+          "Description": {
+            "name": "pckbd",
+            "version_id": 3,
+            "minimum_version_id": 3,
+            "Fields": [
+              {
+                "field": "write_cmd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "status",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pending_tmp",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ],
+            "Subsections": [
+              {
+                "name": "pckbd_outport",
+                "version_id": 1,
+                "minimum_version_id": 1,
+                "Fields": [
+                  {
+                    "field": "outport",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              },
+              {
+                "name": "pckbd/extended_state",
+                "version_id": 0,
+                "minimum_version_id": 0,
+                "Fields": [
+                  {
+                    "field": "migration_flags",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "obsrc",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 4
+                  },
+                  {
+                    "field": "obdata",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  },
+                  {
+                    "field": "cbdata",
+                    "version_id": 0,
+                    "field_exists": false,
+                    "size": 1
+                  }
+                ]
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "fw_cfg_io": {
+    "Name": "fw_cfg_io",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "vmcoreinfo": {
+    "Name": "vmcoreinfo",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "vmcoreinfo",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "has_vmcoreinfo",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "vmcoreinfo.host_format",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "vmcoreinfo.guest_format",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "vmcoreinfo.size",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "vmcoreinfo.paddr",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "ps2-kbd": {
+    "Name": "ps2-kbd",
+    "version_id": 3,
+    "minimum_version_id": 2,
+    "Description": {
+      "name": "ps2kbd",
+      "version_id": 3,
+      "minimum_version_id": 2,
+      "Fields": [
+        {
+          "field": "parent_obj",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1104,
+          "Description": {
+            "name": "PS2 Common State",
+            "version_id": 3,
+            "minimum_version_id": 2,
+            "Fields": [
+              {
+                "field": "write_cmd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.rptr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.wptr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.count",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "queue.data",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 256
+              }
+            ]
+          }
+        },
+        {
+          "field": "scan_enabled",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "translate",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "scancode_set",
+          "version_id": 3,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "ps2kbd/ledstate",
+          "version_id": 3,
+          "minimum_version_id": 2,
+          "Fields": [
+            {
+              "field": "ledstate",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        },
+        {
+          "name": "ps2kbd/need_high_bit",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "need_high_bit",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 1
+            }
+          ]
+        },
+        {
+          "name": "ps2kbd/command_reply_queue",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "parent_obj.queue.cwptr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 4
+            }
+          ]
+        }
+      ]
+    }
+  },
+  "ICH9-SMB": {
+    "Name": "ICH9-SMB",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ich9_smb",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "dev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2608,
+          "Description": {
+            "name": "PCIDevice",
+            "version_id": 2,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "version_id",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 256
+              },
+              {
+                "field": "config",
+                "version_id": 0,
+                "field_exists": true,
+                "size": 4096
+              },
+              {
+                "field": "irq_state",
+                "version_id": 2,
+                "field_exists": false,
+                "size": 16
+              }
+            ]
+          }
+        },
+        {
+          "field": "irq_enabled",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 1
+        },
+        {
+          "field": "smb",
+          "version_id": 1,
+          "field_exists": true,
+          "size": 384,
+          "Description": {
+            "name": "pmsmb",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "smb_stat",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_ctl",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_cmd",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_addr",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_data0",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_data1",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_index",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "smb_data",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_auxctl",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "smb_blkdata",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "i2c_enable",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "op_done",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "in_i2c_block_read",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "start_transaction_on_status_read",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "isa-pcspk": {
+    "Name": "isa-pcspk",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "pcspk",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "data_on",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "dummy_refresh_clock",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "acpi-erst": {
+    "Name": "acpi-erst",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "acpi-erst",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "operation",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "busy_status",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "command_status",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "record_offset",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "reg_action",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "reg_value",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "record_identifier",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "next_record_index",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "i8257": {
+    "Name": "i8257",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "dma",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "command",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "mask",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "flip_flop",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "dshift",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "regs",
+          "version_id": 1,
+          "field_exists": false,
+          "size": 40,
+          "Description": {
+            "name": "dma_regs",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "now",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "base",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 2
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "page",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "pageh",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "dack",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              },
+              {
+                "field": "eop",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "port92": {
+    "Name": "port92",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "port92",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "outport",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "q35-pcihost": {
+    "Name": "q35-pcihost",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "ioapic": {
+    "Name": "ioapic",
+    "version_id": 3,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "ioapic",
+      "version_id": 3,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "id",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "ioregsel",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "unused",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 8
+        },
+        {
+          "field": "irr",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        },
+        {
+          "field": "ioredtbl",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 8
+        }
+      ]
+    }
+  },
+  "smbus-eeprom": {
+    "Name": "smbus-eeprom",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "smbus-eeprom",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "smbusdev",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 216,
+          "Description": {
+            "name": "smbus-device",
+            "version_id": 1,
+            "minimum_version_id": 1,
+            "Fields": [
+              {
+                "field": "i2c",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 168,
+                "Description": {
+                  "name": "I2CSlave",
+                  "version_id": 1,
+                  "minimum_version_id": 1,
+                  "Fields": [
+                    {
+                      "field": "address",
+                      "version_id": 0,
+                      "field_exists": false,
+                      "size": 1
+                    }
+                  ]
+                }
+              },
+              {
+                "field": "mode",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "data_len",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 4
+              },
+              {
+                "field": "data_buf",
+                "version_id": 0,
+                "field_exists": false,
+                "size": 1
+              }
+            ]
+          }
+        },
+        {
+          "field": "data",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "offset",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        },
+        {
+          "field": "accessed",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 1
+        }
+      ]
+    }
+  },
+  "pci-host-bridge": {
+    "Name": "pci-host-bridge",
+    "version_id": 1,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "PCIHost",
+      "version_id": 1,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "config_reg",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 4
+        }
+      ]
+    }
+  },
+  "fw_cfg_mem": {
+    "Name": "fw_cfg_mem",
+    "version_id": 2,
+    "minimum_version_id": 1,
+    "Description": {
+      "name": "fw_cfg",
+      "version_id": 2,
+      "minimum_version_id": 1,
+      "Fields": [
+        {
+          "field": "cur_entry",
+          "version_id": 0,
+          "field_exists": false,
+          "size": 2
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 0,
+          "field_exists": true,
+          "size": 4
+        },
+        {
+          "field": "cur_offset",
+          "version_id": 2,
+          "field_exists": false,
+          "size": 4
+        }
+      ],
+      "Subsections": [
+        {
+          "name": "fw_cfg/dma",
+          "version_id": 0,
+          "minimum_version_id": 0,
+          "Fields": [
+            {
+              "field": "dma_addr",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        },
+        {
+          "name": "fw_cfg/acpi_mr",
+          "version_id": 1,
+          "minimum_version_id": 1,
+          "Fields": [
+            {
+              "field": "table_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "linker_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            },
+            {
+              "field": "rsdp_mr_size",
+              "version_id": 0,
+              "field_exists": false,
+              "size": 8
+            }
+          ]
+        }
+      ]
+    }
+  }
+}

From 5383ccf2512f4dc48e6321545f0f946d6bc78aa1 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 12 Sep 2025 12:07:55 +0200
Subject: [PATCH 0571/2396] tests/functional: Use vmstate-static-checker.py to
 test data from v7.2

We've got this nice vmstate-static-checker.py script that can help to
detect screw-ups in the migration states. Unfortunately, it's currently
only run manually, which can be cumbersome. Let's run it from a functional
test automatically with the reference data from QEMU 7.2, so that we get
at least a basic coverage here. Since the test can fail when the checker
script detects a false positive, mark the test with a skipFlakyTest
decorator for now, so that it is only run when the user also set the
QEMU_TEST_FLAKY_TESTS environment variable.

Acked-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250912100755.316518-5-thuth@redhat.com>
---
 MAINTAINERS                              |  1 +
 tests/functional/aarch64/meson.build     |  1 +
 tests/functional/generic/test_vmstate.py | 67 ++++++++++++++++++++++++
 tests/functional/m68k/meson.build        |  4 ++
 tests/functional/ppc64/meson.build       |  1 +
 tests/functional/s390x/meson.build       |  4 ++
 tests/functional/x86_64/meson.build      |  3 +-
 7 files changed, 80 insertions(+), 1 deletion(-)
 create mode 100755 tests/functional/generic/test_vmstate.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 24c061aff3..3d1f88a4bb 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3613,6 +3613,7 @@ F: migration/
 F: scripts/vmstate-static-checker.py
 F: tests/functional/migration.py
 F: tests/functional/*/*migration.py
+F: tests/functional/generic/test_vmstate.py
 F: tests/functional/x86_64/test_bad_vmstate.py
 F: tests/data/vmstate-static-checker/
 F: tests/qtest/migration/
diff --git a/tests/functional/aarch64/meson.build b/tests/functional/aarch64/meson.build
index 04846c6eb1..5ad52f93e1 100644
--- a/tests/functional/aarch64/meson.build
+++ b/tests/functional/aarch64/meson.build
@@ -19,6 +19,7 @@ test_aarch64_timeouts = {
 
 tests_aarch64_system_quick = [
   'migration',
+  'vmstate',
 ]
 
 tests_aarch64_system_thorough = [
diff --git a/tests/functional/generic/test_vmstate.py b/tests/functional/generic/test_vmstate.py
new file mode 100755
index 0000000000..387ff54242
--- /dev/null
+++ b/tests/functional/generic/test_vmstate.py
@@ -0,0 +1,67 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+'''This test runs the vmstate-static-checker script with the current QEMU'''
+
+import subprocess
+
+from qemu_test import QemuSystemTest, skipFlakyTest
+
+
+@skipFlakyTest("vmstate-static-checker can produce false positives")
+class VmStateTest(QemuSystemTest):
+    '''
+    This test helps to check whether there are problems between old
+    reference data and the current QEMU
+    '''
+
+    def test_vmstate_7_2(self):
+        '''Check reference data from QEMU v7.2'''
+
+        target_machine = {
+            'aarch64': 'virt-7.2',
+            'm68k': 'virt-7.2',
+            'ppc64': 'pseries-7.2',
+            's390x': 's390-ccw-virtio-7.2',
+            'x86_64': 'pc-q35-7.2',
+        }
+        self.set_machine(target_machine[self.arch])
+
+        # Run QEMU to get the current vmstate json file:
+        dst_json = self.scratch_file('dest.json')
+        self.log.info('Dumping vmstate from %s', self.qemu_bin)
+        cp = subprocess.run([self.qemu_bin, '-nodefaults',
+                             '-M', target_machine[self.arch],
+                             '-dump-vmstate', dst_json],
+                            stdout=subprocess.PIPE,
+                            stderr=subprocess.STDOUT,
+                            text=True, check=True)
+        if cp.stdout:
+            self.log.info('QEMU output: %s', cp.stdout)
+
+        # Check whether the old vmstate json file is still compatible:
+        src_json = self.data_file('..', 'data', 'vmstate-static-checker',
+                                  self.arch,
+                                  target_machine[self.arch] + '.json')
+        self.log.info('Comparing vmstate with %s', src_json)
+        checkerscript = self.data_file('..', '..', 'scripts',
+                                       'vmstate-static-checker.py')
+        cp = subprocess.run([checkerscript, '-s', src_json, '-d', dst_json],
+                            stdout=subprocess.PIPE,
+                            stderr=subprocess.STDOUT,
+                            text=True, check=False)
+        if cp.returncode != 0:
+            self.fail('Running vmstate-static-checker failed:\n' + cp.stdout +
+                      '\nThis either means that there is a migration bug '
+                      'that needs to be fixed, or\nvmstate-static-checker.py '
+                      'needs to be improved (e.g. extend the changed_names\n'
+                      'in case a field has been renamed), or drop the '
+                      'problematic field from\n' + src_json +
+                      '\nin case the script cannot be fixed easily.')
+        if cp.stdout:
+            self.log.warning('vmstate-static-checker output: %s', cp.stdout)
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
diff --git a/tests/functional/m68k/meson.build b/tests/functional/m68k/meson.build
index e29044a6d7..679faaf86d 100644
--- a/tests/functional/m68k/meson.build
+++ b/tests/functional/m68k/meson.build
@@ -1,5 +1,9 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
+tests_m68k_system_quick = [
+  'vmstate',
+]
+
 tests_m68k_system_thorough = [
   'mcf5208evb',
   'nextcube',
diff --git a/tests/functional/ppc64/meson.build b/tests/functional/ppc64/meson.build
index 842fe0fc71..1fa0a70f7e 100644
--- a/tests/functional/ppc64/meson.build
+++ b/tests/functional/ppc64/meson.build
@@ -11,6 +11,7 @@ test_ppc64_timeouts = {
 
 tests_ppc64_system_quick = [
   'migration',
+  'vmstate',
 ]
 
 tests_ppc64_system_thorough = [
diff --git a/tests/functional/s390x/meson.build b/tests/functional/s390x/meson.build
index 030b116039..70cd36e291 100644
--- a/tests/functional/s390x/meson.build
+++ b/tests/functional/s390x/meson.build
@@ -4,6 +4,10 @@ test_s390x_timeouts = {
   'ccw_virtio' : 420,
 }
 
+tests_s390x_system_quick = [
+  'vmstate',
+]
+
 tests_s390x_system_thorough = [
   'ccw_virtio',
   'pxelinux',
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
index ef12ac43b3..967426c30c 100644
--- a/tests/functional/x86_64/meson.build
+++ b/tests/functional/x86_64/meson.build
@@ -14,10 +14,11 @@ tests_x86_64_system_quick = [
   'cpu_model_versions',
   'cpu_queries',
   'mem_addr_space',
+  'memlock',
   'migration',
   'pc_cpu_hotplug_props',
   'virtio_version',
-  'memlock',
+  'vmstate',
 ]
 
 tests_x86_64_system_thorough = [

From 8a44d8c2ac0921c8064fbfd00ef28e3a2588918e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 12 Sep 2025 19:22:00 +0100
Subject: [PATCH 0572/2396] tests/functional: use self.log for all logging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some tests are creating their on logger category which means any
output they log is not captured in base.log.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
[thuth: drop changes to reverse_debugging.py (it's WIP in other patches)]
Message-ID: <20250912182200.643909-7-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/aarch64/test_virt.py     |  4 +--
 tests/functional/arm/test_integratorcp.py |  3 +--
 tests/functional/mips64el/test_malta.py   |  3 +--
 tests/functional/replay_kernel.py         | 16 +++++-------
 tests/functional/x86_64/test_acpi_bits.py | 31 +++++++++++------------
 5 files changed, 25 insertions(+), 32 deletions(-)

diff --git a/tests/functional/aarch64/test_virt.py b/tests/functional/aarch64/test_virt.py
index 4d0ad90ff8..63071f9b51 100755
--- a/tests/functional/aarch64/test_virt.py
+++ b/tests/functional/aarch64/test_virt.py
@@ -72,8 +72,6 @@ class Aarch64VirtMachine(QemuSystemTest):
         self.set_machine('virt')
         self.require_accelerator("tcg")
 
-        logger = logging.getLogger('aarch64_virt')
-
         kernel_path = self.ASSET_KERNEL.fetch()
 
         self.vm.set_console()
@@ -91,7 +89,7 @@ class Aarch64VirtMachine(QemuSystemTest):
                          'rng-random,id=rng0,filename=/dev/urandom')
 
         # Also add a scratch block device
-        logger.info('creating scratch qcow2 image')
+        self.log.info('creating scratch qcow2 image')
         image_path = self.scratch_file('scratch.qcow2')
         qemu_img = get_qemu_img(self)
         check_call([qemu_img, 'create', '-f', 'qcow2', image_path, '8M'],
diff --git a/tests/functional/arm/test_integratorcp.py b/tests/functional/arm/test_integratorcp.py
index 4f00924aa0..23ae919359 100755
--- a/tests/functional/arm/test_integratorcp.py
+++ b/tests/functional/arm/test_integratorcp.py
@@ -77,7 +77,6 @@ class IntegratorMachine(QemuSystemTest):
                           command_line='screendump %s' % screendump_path)
         if 'unknown command' in res:
             self.skipTest('screendump not available')
-        logger = logging.getLogger('framebuffer')
 
         cpu_count = 1
         match_threshold = 0.92
@@ -88,7 +87,7 @@ class IntegratorMachine(QemuSystemTest):
         loc = np.where(result >= match_threshold)
         tux_count = 0
         for tux_count, pt in enumerate(zip(*loc[::-1]), start=1):
-            logger.debug('found Tux at position [x, y] = %s', pt)
+            self.log.debug('found Tux at position [x, y] = %s', pt)
         self.assertGreaterEqual(tux_count, cpu_count)
 
 if __name__ == '__main__':
diff --git a/tests/functional/mips64el/test_malta.py b/tests/functional/mips64el/test_malta.py
index 8fdc49b300..170147bfcc 100755
--- a/tests/functional/mips64el/test_malta.py
+++ b/tests/functional/mips64el/test_malta.py
@@ -159,7 +159,6 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
                           command_line='screendump %s' % screendump_path)
         if 'unknown command' in res:
             self.skipTest('screendump not available')
-        logger = logging.getLogger('framebuffer')
 
         match_threshold = 0.95
         screendump_bgr = cv2.imread(screendump_path, cv2.IMREAD_COLOR)
@@ -171,7 +170,7 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         h, w = tuxlogo_bgr.shape[:2]
         debug_png = os.getenv('QEMU_TEST_CV2_SCREENDUMP_PNG_PATH')
         for tuxlogo_count, pt in enumerate(zip(*loc[::-1]), start=1):
-            logger.debug('found Tux at position (x, y) = %s', pt)
+            self.log.debug('found Tux at position (x, y) = %s', pt)
             cv2.rectangle(screendump_bgr, pt,
                           (pt[0] + w, pt[1] + h), (0, 0, 255), 2)
         if debug_png:
diff --git a/tests/functional/replay_kernel.py b/tests/functional/replay_kernel.py
index 80795eb052..acb1d29a1b 100644
--- a/tests/functional/replay_kernel.py
+++ b/tests/functional/replay_kernel.py
@@ -32,15 +32,14 @@ class ReplayKernelBase(LinuxKernelTest):
         # icount requires TCG to be available
         self.require_accelerator('tcg')
 
-        logger = logging.getLogger('replay')
         start_time = time.time()
         vm = self.get_vm(name='recording' if record else 'replay')
         vm.set_console()
         if record:
-            logger.info('recording the execution...')
+            self.log.info('recording the execution...')
             mode = 'record'
         else:
-            logger.info('replaying the execution...')
+            self.log.info('replaying the execution...')
             mode = 'replay'
         vm.add_args('-icount', 'shift=%s,rr=%s,rrfile=%s' %
                     (shift, mode, replay_path),
@@ -54,15 +53,15 @@ class ReplayKernelBase(LinuxKernelTest):
         self.wait_for_console_pattern(console_pattern, vm)
         if record:
             vm.shutdown()
-            logger.info('finished the recording with log size %s bytes'
+            self.log.info('finished the recording with log size %s bytes'
                         % os.path.getsize(replay_path))
             self.run_replay_dump(replay_path)
-            logger.info('successfully tested replay-dump.py')
+            self.log.info('successfully tested replay-dump.py')
         else:
             vm.wait()
-            logger.info('successfully finished the replay')
+            self.log.info('successfully finished the replay')
         elapsed = time.time() - start_time
-        logger.info('elapsed time %.2f sec' % elapsed)
+        self.log.info('elapsed time %.2f sec' % elapsed)
         return elapsed
 
     def run_replay_dump(self, replay_path):
@@ -80,5 +79,4 @@ class ReplayKernelBase(LinuxKernelTest):
                          True, shift, args, replay_path)
         t2 = self.run_vm(kernel_path, kernel_command_line, console_pattern,
                          False, shift, args, replay_path)
-        logger = logging.getLogger('replay')
-        logger.info('replay overhead {:.2%}'.format(t2 / t1 - 1))
+        self.log.info('replay overhead {:.2%}'.format(t2 / t1 - 1))
diff --git a/tests/functional/x86_64/test_acpi_bits.py b/tests/functional/x86_64/test_acpi_bits.py
index 8e0563a97b..9a2816533d 100755
--- a/tests/functional/x86_64/test_acpi_bits.py
+++ b/tests/functional/x86_64/test_acpi_bits.py
@@ -121,10 +121,10 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
         self._debugcon_log = 'debugcon-log.txt'
 
     def _print_log(self, log):
-        self.logger.info('\nlogs from biosbits follows:')
-        self.logger.info('==========================================\n')
-        self.logger.info(log)
-        self.logger.info('==========================================\n')
+        self.log.info('\nlogs from biosbits follows:')
+        self.log.info('==========================================\n')
+        self.log.info(log)
+        self.log.info('==========================================\n')
 
     def copy_bits_config(self):
         """ copies the bios bits config file into bits.
@@ -138,8 +138,8 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
         self.assertTrue(os.path.exists(bits_config_file))
         self.assertTrue(os.path.exists(target_config_dir))
         shutil.copy2(bits_config_file, target_config_dir)
-        self.logger.info('copied config file %s to %s',
-                         bits_config_file, target_config_dir)
+        self.log.info('copied config file %s to %s',
+                      bits_config_file, target_config_dir)
 
     def copy_test_scripts(self):
         """copies the python test scripts into bits. """
@@ -163,8 +163,8 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
                 newfilename = os.path.splitext(filename)[0] + '.py'
                 shutil.copy2(os.path.join(bits_test_dir, filename),
                              os.path.join(target_test_dir, newfilename))
-                self.logger.info('copied test file %s to %s',
-                                 filename, target_test_dir)
+                self.log.info('copied test file %s to %s',
+                              filename, target_test_dir)
 
                 # now remove the pyc test file if it exists, otherwise the
                 # changes in the python test script won't be executed.
@@ -172,9 +172,9 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
                 if os.access(os.path.join(target_test_dir, testfile_pyc),
                              os.F_OK):
                     os.remove(os.path.join(target_test_dir, testfile_pyc))
-                    self.logger.info('removed compiled file %s',
-                                     os.path.join(target_test_dir,
-                                     testfile_pyc))
+                    self.log.info('removed compiled file %s',
+                                  os.path.join(target_test_dir,
+                                               testfile_pyc))
 
     def fix_mkrescue(self, mkrescue):
         """ grub-mkrescue is a bash script with two variables, 'prefix' and
@@ -216,7 +216,7 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
 
         self.fix_mkrescue(mkrescue_script)
 
-        self.logger.info('using grub-mkrescue for generating biosbits iso ...')
+        self.log.info('using grub-mkrescue for generating biosbits iso ...')
 
         try:
             if os.getenv('V') or os.getenv('BITS_DEBUG'):
@@ -225,7 +225,7 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
                                       stdout=subprocess.PIPE,
                                       stderr=subprocess.STDOUT,
                                       check=True)
-                self.logger.info("grub-mkrescue output %s" % proc.stdout)
+                self.log.info("grub-mkrescue output %s" % proc.stdout)
             else:
                 subprocess.check_call([mkrescue_script, '-o',
                                       iso_file, bits_dir],
@@ -238,11 +238,10 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
 
         self.assertTrue(os.access(iso_file, os.R_OK))
 
-        self.logger.info('iso file %s successfully generated.', iso_file)
+        self.log.info('iso file %s successfully generated.', iso_file)
 
     def setUp(self): # pylint: disable=arguments-differ
         super().setUp()
-        self.logger = self.log
 
         prebuiltDir = self.scratch_file('prebuilt')
         if not os.path.isdir(prebuiltDir):
@@ -333,7 +332,7 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
         # in batch mode and then automatically initiate a vm shutdown.
         self._vm.event_wait('SHUTDOWN', timeout=BITS_TIMEOUT)
         self._vm.wait(timeout=None)
-        self.logger.debug("Checking console output ...")
+        self.log.debug("Checking console output ...")
         self.parse_log()
 
 if __name__ == '__main__':

From fd34f56fe886250bdd64f9c222c1cb4c07a594ad Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 16 Sep 2025 17:30:30 +0100
Subject: [PATCH 0573/2396] .gitlab-ci.d/buildtest.yml: Unset
 CI_COMMIT_DESCRIPTION for htags
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 52a21689cd829 we added a workaround for a bug in older
versions of htags where they fail with a weird error message if the
environment is too large.  However, we missed one variable which
gitlab CI can set to the body of the commit message:
CI_COMMIT_DESCRIPTION.

Add this to the variables we unset when running htags, so that
the 'pages' job doesn't fail if the most recent commit happens
to have a very large commit message.

Cc: qemu-stable@nongnu.org
Fixes: 52a21689cd8 (".gitlab-ci.d/buildtest.yml: Work around htags bug when environment is large")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250916163030.1467893-1-peter.maydell@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index f01978fb40..e296fc3c14 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -736,7 +736,7 @@ pages:
     - make gtags
     # We unset variables to work around a bug in some htags versions
     # which causes it to fail when the environment is large
-    - CI_COMMIT_MESSAGE= CI_COMMIT_TAG_MESSAGE= htags
+    - CI_COMMIT_MESSAGE= CI_COMMIT_TAG_MESSAGE= CI_COMMIT_DESCRIPTION= htags
         -anT --tree-view=filetree -m qemu_init
         -t "Welcome to the QEMU sourcecode"
     - mv HTML public/src

From 464a0a584c8cf8183b0d61167a0234a3a7c9aa6f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 18 Sep 2025 14:24:47 +0200
Subject: [PATCH 0574/2396] tests/functional/hppa: Add a CD-ROM boot test for
 qemu-system-hppa
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a test which boots a HP-UX firmware upgrade CD-ROM. It exercise
the PCI LSI53C895A SCSI controller. The ISO image comes from:
https://web.archive.org/web/20101204061612/http://ftp.parisc-linux.org/kernels/712/PF_C7120023
The test is very quick, less than 3s.

Based on an old patch from Philippe that has been posted here:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg651012.html

Suggested-by: Sven Schnelle <svens@stackframe.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
[thuth: Adjusted the patch to the functional framework,
        and adjusted the commit message]
Message-ID: <20250918122447.105861-1-thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS                          |  2 +-
 tests/functional/hppa/meson.build    |  4 +++
 tests/functional/hppa/test_cdboot.py | 38 ++++++++++++++++++++++++++++
 3 files changed, 43 insertions(+), 1 deletion(-)
 create mode 100755 tests/functional/hppa/test_cdboot.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 3d1f88a4bb..24b71a4fc5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1276,7 +1276,7 @@ F: include/hw/pci-host/astro.h
 F: include/hw/pci-host/dino.h
 F: pc-bios/hppa-firmware.img
 F: roms/seabios-hppa/
-F: tests/functional/hppa/test_seabios.py
+F: tests/functional/hppa/
 
 LoongArch Machines
 ------------------
diff --git a/tests/functional/hppa/meson.build b/tests/functional/hppa/meson.build
index a334837088..df2f7ccc9c 100644
--- a/tests/functional/hppa/meson.build
+++ b/tests/functional/hppa/meson.build
@@ -3,3 +3,7 @@
 tests_hppa_system_quick = [
   'seabios',
 ]
+
+tests_hppa_system_thorough = [
+  'cdboot',
+]
diff --git a/tests/functional/hppa/test_cdboot.py b/tests/functional/hppa/test_cdboot.py
new file mode 100755
index 0000000000..84421e8d63
--- /dev/null
+++ b/tests/functional/hppa/test_cdboot.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+#
+# CD boot test for HPPA machines
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class HppaCdBoot(QemuSystemTest):
+
+    ASSET_CD = Asset(
+        ('https://github.com/philmd/qemu-testing-blob/raw/ec1b741/'
+         'hppa/hp9000/712/C7120023.frm'),
+        '32c612ad2074516986bdc27768903c561fa92af2ca48e5ac3f3359ade1c42f70')
+
+    def test_cdboot(self):
+        self.set_machine('B160L')
+        cdrom_path = self.ASSET_CD.fetch()
+
+        self.vm.set_console()
+        self.vm.add_args('-cdrom', cdrom_path,
+                         '-boot', 'd',
+                         '-no-reboot')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Unrecognized MODEL TYPE = 502')
+        wait_for_console_pattern(self, 'UPDATE PAUSED>')
+
+        exec_command_and_wait_for_pattern(self, 'exit\r', 'UPDATE>')
+        exec_command_and_wait_for_pattern(self, 'ls\r', 'IMAGE1B')
+        wait_for_console_pattern(self, 'UPDATE>')
+        exec_command_and_wait_for_pattern(self, 'exit\r',
+                        'THIS UTILITY WILL NOW RESET THE SYSTEM.....')
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From 4f1ebc7712a7db61155080164f2169320d033559 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 18 Sep 2025 14:51:54 +0200
Subject: [PATCH 0575/2396] tests: Fix "make check-functional" for targets
 without thorough tests

If QEMU gets configured for a single target that does not have
any thorough functional tests, "make check-functional" currently
fails with the error message "No rule to make target 'check-func'".
This happens because "check-func" only gets defined for thorough
tests (quick ones get added to "check-func-quick" instead).
The same problem can happen with the quick tests for targets that
do not have any functional test at all. To fix it, simply make sure
that the targets are always available in the Makefile.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/3119
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250918125154.126072-1-thuth@redhat.com>
---
 tests/Makefile.include | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/Makefile.include b/tests/Makefile.include
index 3538c0c740..62a4fc8ed3 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -113,6 +113,9 @@ check-functional:
 	@$(NINJA) precache-functional
 	@QEMU_TEST_NO_DOWNLOAD=1 $(MAKE) SPEED=thorough check-func check-func-quick
 
+.PHONY: check-func check-func-quick
+check-func check-func-quick:
+
 # Consolidated targets
 
 .PHONY: check check-clean

From bcc251800b9e60c541de860dc8a1ced70622ee43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 18 Sep 2025 13:57:45 +0100
Subject: [PATCH 0576/2396] tests/functional: retry when seeing ConnectionError
 exception
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This base class is used for many different socket connection
errors, corresponding to ECONNRESET, ECONNREFUSED, ECONNABORTED
and more. Most of these are things you might expect to see every
now and then as transient flaws. We should thus retry the asset
download when seeing them.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250918125746.1165658-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index 2dd32bf28d..f8b87d2153 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -179,6 +179,13 @@ class Asset:
                                self.url, e.reason)
                 raise AssetError(self, "Unable to download: URL error %s" %
                                  e.reason, transient=True)
+            except ConnectionError as e:
+                # A socket connection failure, such as dropped conn
+                # or refused conn
+                tmp_cache_file.unlink()
+                self.log.error("Unable to download %s: Connection error %s",
+                               self.url, e)
+                continue
             except Exception as e:
                 tmp_cache_file.unlink()
                 raise AssetError(self, "Unable to download: %s" % e)

From 097bbfc5e0ba889ce17106ef941a56111c3de270 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 18 Sep 2025 13:57:46 +0100
Subject: [PATCH 0577/2396] tests/functional: treat unknown exceptions as
 transient faults
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To maximise the robustness of the functional tests we want to treat most
asset download failures as non-fatal to the test suite. Instead it
should just skip the tests which need that particular asset. The only
time aim to make it fatal is for 404 errors which are highly likely to
reflect genuine problems to be fixed.

We catch certain exception classes and handle them as transient errors,
but unfortunately it is proving difficult to predict what exception
classes urlopen() is capable of raising, with new possibilities being
discovered.

To provide a fail-safe, treat the generic Exception class as being a
transient error too. This may well mask certain genuine bugs, but it is
preferrable to prioritize running the test suite to the greatest extent
practical.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250918125746.1165658-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index f8b87d2153..2971a989d1 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -188,7 +188,8 @@ class Asset:
                 continue
             except Exception as e:
                 tmp_cache_file.unlink()
-                raise AssetError(self, "Unable to download: %s" % e)
+                raise AssetError(self, "Unable to download: %s" % e,
+                                 transient=True)
 
         if not os.path.exists(tmp_cache_file):
             raise AssetError(self, "Download retries exceeded", transient=True)

From 62e82053fc676e9493dc2c2072352634b8cd655d Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:20 +0900
Subject: [PATCH 0578/2396] docs/devel: Do not unparent in instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Remove the instruction to call object_unparent(), and the exception
of the "do not call object_unparent()" rule for instance_finalize().

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-1-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/memory.rst | 17 ++++++-----------
 1 file changed, 6 insertions(+), 11 deletions(-)

diff --git a/docs/devel/memory.rst b/docs/devel/memory.rst
index 42d3ca29c4..f22146e56c 100644
--- a/docs/devel/memory.rst
+++ b/docs/devel/memory.rst
@@ -165,17 +165,14 @@ and finalized one by one.  The order in which memory regions will be
 finalized is not guaranteed.
 
 If however the memory region is part of a dynamically allocated data
-structure, you should call object_unparent() to destroy the memory region
-before the data structure is freed.  For an example see VFIOMSIXInfo
-and VFIOQuirk in hw/vfio/pci.c.
+structure, you should free the memory region in the instance_finalize
+callback.  For an example see VFIOMSIXInfo and VFIOQuirk in
+hw/vfio/pci.c.
 
 You must not destroy a memory region as long as it may be in use by a
 device or CPU.  In order to do this, as a general rule do not create or
-destroy memory regions dynamically during a device's lifetime, and only
-call object_unparent() in the memory region owner's instance_finalize
-callback.  The dynamically allocated data structure that contains the
-memory region then should obviously be freed in the instance_finalize
-callback as well.
+destroy memory regions dynamically during a device's lifetime, and never
+call object_unparent().
 
 If you break this rule, the following situation can happen:
 
@@ -201,9 +198,7 @@ this exception is rarely necessary, and therefore it is discouraged,
 but nevertheless it is used in a few places.
 
 For regions that "have no owner" (NULL is passed at creation time), the
-machine object is actually used as the owner.  Since instance_finalize is
-never called for the machine object, you must never call object_unparent
-on regions that have no owner, unless they are aliases or containers.
+machine object is actually used as the owner.
 
 
 Overlapping regions and priority

From e3ed862cabce6d8a12300b941243cb44e9cd40d1 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:21 +0900
Subject: [PATCH 0579/2396] vfio/pci: Do not unparent in instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the insntance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-2-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/vfio/pci.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index d14e96b2f8..bc0b4c4d56 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2025,7 +2025,6 @@ static void vfio_bars_finalize(VFIOPCIDevice *vdev)
         vfio_region_finalize(&bar->region);
         if (bar->mr) {
             assert(bar->size);
-            object_unparent(OBJECT(bar->mr));
             g_free(bar->mr);
             bar->mr = NULL;
         }
@@ -2033,9 +2032,6 @@ static void vfio_bars_finalize(VFIOPCIDevice *vdev)
 
     if (vdev->vga) {
         vfio_vga_quirk_finalize(vdev);
-        for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
-            object_unparent(OBJECT(&vdev->vga->region[i].mem));
-        }
         g_free(vdev->vga);
     }
 }

From f9ce08489424905ae4a70218fa35013fe88d54ed Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:22 +0900
Subject: [PATCH 0580/2396] hw/core/register: Do not unparent in
 instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-3-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/register.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/core/register.c b/hw/core/register.c
index 8f63d9f227..3340df70b0 100644
--- a/hw/core/register.c
+++ b/hw/core/register.c
@@ -314,7 +314,6 @@ RegisterInfoArray *register_init_block64(DeviceState *owner,
 
 void register_finalize_block(RegisterInfoArray *r_array)
 {
-    object_unparent(OBJECT(&r_array->mem));
     g_free(r_array->r);
     g_free(r_array);
 }

From 15d91385422eb42321f49144554439c52b18953a Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:23 +0900
Subject: [PATCH 0581/2396] hv-balloon: hw/core/register: Do not unparent in
 instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-4-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/hyperv/hv-balloon.c | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/hw/hyperv/hv-balloon.c b/hw/hyperv/hv-balloon.c
index 6dbcb2d9a2..2d6d7db4ee 100644
--- a/hw/hyperv/hv-balloon.c
+++ b/hw/hyperv/hv-balloon.c
@@ -1475,16 +1475,6 @@ static void hv_balloon_ensure_mr(HvBalloon *balloon)
     balloon->mr->align = memory_region_get_alignment(hostmem_mr);
 }
 
-static void hv_balloon_free_mr(HvBalloon *balloon)
-{
-    if (!balloon->mr) {
-        return;
-    }
-
-    object_unparent(OBJECT(balloon->mr));
-    g_clear_pointer(&balloon->mr, g_free);
-}
-
 static void hv_balloon_vmdev_realize(VMBusDevice *vdev, Error **errp)
 {
     ERRP_GUARD();
@@ -1580,7 +1570,7 @@ static void hv_balloon_vmdev_reset(VMBusDevice *vdev)
  */
 static void hv_balloon_unrealize_finalize_common(HvBalloon *balloon)
 {
-    hv_balloon_free_mr(balloon);
+    g_clear_pointer(&balloon->mr, g_free);
     balloon->addr = 0;
 
     balloon->memslot_count = 0;

From 0c6d897e38f5a6a864d6ae6dc42f521b84011107 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:24 +0900
Subject: [PATCH 0582/2396] hw/sd/sdhci: Do not unparent in instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-5-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/sd/sdhci.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 3c897e54b7..89b595ce4a 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1578,10 +1578,6 @@ static void sdhci_sysbus_finalize(Object *obj)
 {
     SDHCIState *s = SYSBUS_SDHCI(obj);
 
-    if (s->dma_mr) {
-        object_unparent(OBJECT(s->dma_mr));
-    }
-
     sdhci_uninitfn(s);
 }
 

From 9b80f8a8e758b427501e6bcbcb114ae45ff68387 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:25 +0900
Subject: [PATCH 0583/2396] vfio: Do not unparent in instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-6-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/vfio/pci-quirks.c | 9 +--------
 hw/vfio/region.c     | 3 ---
 2 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/hw/vfio/pci-quirks.c b/hw/vfio/pci-quirks.c
index c97606dbf1..b5da6afbf5 100644
--- a/hw/vfio/pci-quirks.c
+++ b/hw/vfio/pci-quirks.c
@@ -1159,15 +1159,12 @@ void vfio_vga_quirk_exit(VFIOPCIDevice *vdev)
 
 void vfio_vga_quirk_finalize(VFIOPCIDevice *vdev)
 {
-    int i, j;
+    int i;
 
     for (i = 0; i < ARRAY_SIZE(vdev->vga->region); i++) {
         while (!QLIST_EMPTY(&vdev->vga->region[i].quirks)) {
             VFIOQuirk *quirk = QLIST_FIRST(&vdev->vga->region[i].quirks);
             QLIST_REMOVE(quirk, next);
-            for (j = 0; j < quirk->nr_mem; j++) {
-                object_unparent(OBJECT(&quirk->mem[j]));
-            }
             g_free(quirk->mem);
             g_free(quirk->data);
             g_free(quirk);
@@ -1207,14 +1204,10 @@ void vfio_bar_quirk_exit(VFIOPCIDevice *vdev, int nr)
 void vfio_bar_quirk_finalize(VFIOPCIDevice *vdev, int nr)
 {
     VFIOBAR *bar = &vdev->bars[nr];
-    int i;
 
     while (!QLIST_EMPTY(&bar->quirks)) {
         VFIOQuirk *quirk = QLIST_FIRST(&bar->quirks);
         QLIST_REMOVE(quirk, next);
-        for (i = 0; i < quirk->nr_mem; i++) {
-            object_unparent(OBJECT(&quirk->mem[i]));
-        }
         g_free(quirk->mem);
         g_free(quirk->data);
         g_free(quirk);
diff --git a/hw/vfio/region.c b/hw/vfio/region.c
index d04c57db63..b165ab0b93 100644
--- a/hw/vfio/region.c
+++ b/hw/vfio/region.c
@@ -365,12 +365,9 @@ void vfio_region_finalize(VFIORegion *region)
     for (i = 0; i < region->nr_mmaps; i++) {
         if (region->mmaps[i].mmap) {
             munmap(region->mmaps[i].mmap, region->mmaps[i].size);
-            object_unparent(OBJECT(&region->mmaps[i].mem));
         }
     }
 
-    object_unparent(OBJECT(region->mem));
-
     g_free(region->mem);
     g_free(region->mmaps);
 

From 46a8624fa7d116989389867f534b07ee562ebb1e Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Wed, 24 Sep 2025 13:37:26 +0900
Subject: [PATCH 0584/2396] hw/xen: Do not unparent in instance_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Children are automatically unparented so manually unparenting is
unnecessary.

Worse, automatic unparenting happens before the instance_finalize()
callback of the parent gets called, so object_unparent() calls in
the callback will refer to objects that are already unparented, which
is semantically incorrect.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250924-use-v4-7-07c6c598f53d@rsg.ci.i.u-tokyo.ac.jp
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/xen/xen_pt_msi.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
index 09cca4eecb..e9ba17317a 100644
--- a/hw/xen/xen_pt_msi.c
+++ b/hw/xen/xen_pt_msi.c
@@ -637,14 +637,5 @@ void xen_pt_msix_unmap(XenPCIPassthroughState *s)
 
 void xen_pt_msix_delete(XenPCIPassthroughState *s)
 {
-    XenPTMSIX *msix = s->msix;
-
-    if (!msix) {
-        return;
-    }
-
-    object_unparent(OBJECT(&msix->mmio));
-
-    g_free(s->msix);
-    s->msix = NULL;
+    g_clear_pointer(&s->msix, g_free);
 }

From 1f64df25477eff72779b000588cb821c654f26b7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 22 Sep 2025 12:45:21 +0200
Subject: [PATCH 0585/2396] docs/code-provenance: clarify scope very early
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The AI policy in QEMU is not about content generators, it is about generated
content.  Other uses are explicitly not covered.  Rename the policy and clarify
its scope in the TL;DR section, as a matter of convenience to the reader.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/code-provenance.rst | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
index b5aae2e253..dc3524ac17 100644
--- a/docs/devel/code-provenance.rst
+++ b/docs/devel/code-provenance.rst
@@ -285,8 +285,8 @@ Such tools are acceptable to use, provided there is clearly defined copyright
 and licensing for their output. Note in particular the caveats applying to AI
 content generators below.
 
-Use of AI content generators
-~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+Use of AI-generated content
+~~~~~~~~~~~~~~~~~~~~~~~~~~~
 
 TL;DR:
 
@@ -294,6 +294,10 @@ TL;DR:
   believed to include or derive from AI generated content. This includes
   ChatGPT, Claude, Copilot, Llama and similar tools.**
 
+  **This policy does not apply to other uses of AI, such as researching APIs
+  or algorithms, static analysis, or debugging, provided their output is not
+  included in contributions.**
+
 The increasing prevalence of AI-assisted software development results in a
 number of difficult legal questions and risks for software projects, including
 QEMU.  Of particular concern is content generated by `Large Language Models
@@ -322,10 +326,6 @@ The QEMU project thus requires that contributors refrain from using AI content
 generators on patches intended to be submitted to the project, and will
 decline any contribution if use of AI is either known or suspected.
 
-This policy does not apply to other uses of AI, such as researching APIs or
-algorithms, static analysis, or debugging, provided their output is not to be
-included in contributions.
-
 Examples of tools impacted by this policy includes GitHub's CoPilot, OpenAI's
 ChatGPT, Anthropic's Claude, and Meta's Code Llama, and code/content
 generation agents which are built on top of such tools.

From 9ceb9b42c8f0f7ea6a4975e67405cfebee249ba8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 22 Sep 2025 12:51:37 +0200
Subject: [PATCH 0586/2396] docs/code-provenance: make the exception process
 more prominent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU's AI generated content policy does not flesh out the exception
process yet.  Do it, while at the same time keeping things informal: ask
contributors to explain what they would like to use AI for, and let them
reach a consensus with the project on why it is credible to claim DCO
compliance in that specific scenario.

In other words, exceptions do not "solve the AI copyright problem".  They
take a position that a reasonable contributor could have, and assert that
we're comfortable with the argument.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/code-provenance.rst | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
index dc3524ac17..6968d54be8 100644
--- a/docs/devel/code-provenance.rst
+++ b/docs/devel/code-provenance.rst
@@ -331,8 +331,13 @@ ChatGPT, Anthropic's Claude, and Meta's Code Llama, and code/content
 generation agents which are built on top of such tools.
 
 This policy may evolve as AI tools mature and the legal situation is
-clarifed. In the meanwhile, requests for exceptions to this policy will be
-evaluated by the QEMU project on a case by case basis. To be granted an
-exception, a contributor will need to demonstrate clarity of the license and
-copyright status for the tool's output in relation to its training model and
-code, to the satisfaction of the project maintainers.
+clarified.
+
+Exceptions
+^^^^^^^^^^
+
+The QEMU project welcomes discussion on any exceptions to this policy,
+or more general revisions. This can be done by contacting the qemu-devel
+mailing list with details of a proposed tool, model, usage scenario, etc.
+that is beneficial to QEMU, while still mitigating issues around compliance
+with the DCO.  After discussion, any exception will be listed below.

From cd64320e1e27168d3796a847bbfde66c8b1116f9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 22 Sep 2025 13:14:01 +0200
Subject: [PATCH 0587/2396] docs/code-provenance: AI exceptions are in addition
 to DCO

Using phrasing from https://openinfra.org/legal/ai-policy (with just
"commit" replaced by "submission", because we do not submit changes
as commits but rather emails), clarify that the contributor remains
responsible for its copyright or license status.

[This is not my preferred phrasing.  I would prefer something lighter
like "the "Signed-off-by" label in the contribution gives the author
responsibility".  But for the sake of not reinventing the wheel I am
keeping the exact words from the OpenInfra policy.]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/code-provenance.rst | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/docs/devel/code-provenance.rst b/docs/devel/code-provenance.rst
index 6968d54be8..8cdc56f664 100644
--- a/docs/devel/code-provenance.rst
+++ b/docs/devel/code-provenance.rst
@@ -341,3 +341,9 @@ or more general revisions. This can be done by contacting the qemu-devel
 mailing list with details of a proposed tool, model, usage scenario, etc.
 that is beneficial to QEMU, while still mitigating issues around compliance
 with the DCO.  After discussion, any exception will be listed below.
+
+Exceptions do not remove the need for authors to comply with all other
+requirements for contribution.  In particular, the "Signed-off-by"
+label in a patch submission is a statement that the author takes
+responsibility for the entire contents of the patch, including any parts
+that were generated or assisted by AI tools or other tools.

From 03fe6659803f83690b8587d01f8ee56bb4be4b90 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 16:02:03 -0700
Subject: [PATCH 0588/2396] accel/tcg: Properly unlink a TB linked to itself
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we remove dest from orig's links, we lose the link
that we rely on later to reset links.  This can lead to
failure to release from spinlock with self-modifying code.

Cc: qemu-stable@nongnu.org
Reported-by: 李威威 <liweiwei@kubuds.cn>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Tested-by: Anton Johansson <anjo@rev.ng>
---
 accel/tcg/tb-maint.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 0048316f99..e6d45c9c12 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -836,6 +836,14 @@ static inline void tb_remove_from_jmp_list(TranslationBlock *orig, int n_orig)
      * We first acquired the lock, and since the destination pointer matches,
      * we know for sure that @orig is in the jmp list.
      */
+    if (dest == orig) {
+        /*
+         * In the case of a TB that links to itself, removing the entry
+         * from the list means that it won't be present later during
+         * tb_jmp_unlink -- unlink now.
+         */
+        tb_reset_jump(orig, n_orig);
+    }
     pprev = &dest->jmp_list_head;
     TB_FOR_EACH_JMP(dest, tb, n) {
         if (tb == orig && n == n_orig) {

From e13e1195db8af18e149065a59351ea85215645bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 24 Sep 2025 08:42:37 -0700
Subject: [PATCH 0589/2396] tests/tcg/multiarch: Add tb-link test

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tests/tcg/multiarch/Makefile.target |  2 +
 tests/tcg/multiarch/tb-link.c       | 67 +++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+)
 create mode 100644 tests/tcg/multiarch/tb-link.c

diff --git a/tests/tcg/multiarch/Makefile.target b/tests/tcg/multiarch/Makefile.target
index 8dc65d7a06..f5b4d2b813 100644
--- a/tests/tcg/multiarch/Makefile.target
+++ b/tests/tcg/multiarch/Makefile.target
@@ -46,6 +46,8 @@ vma-pthread: LDFLAGS+=-pthread
 sigreturn-sigmask: CFLAGS+=-pthread
 sigreturn-sigmask: LDFLAGS+=-pthread
 
+tb-link: LDFLAGS+=-lpthread
+
 # GCC versions 12/13/14/15 at least incorrectly complain about
 # "'SHA1Transform' reading 64 bytes from a region of size 0"; see the gcc bug
 # https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106709
diff --git a/tests/tcg/multiarch/tb-link.c b/tests/tcg/multiarch/tb-link.c
new file mode 100644
index 0000000000..4e40306fa1
--- /dev/null
+++ b/tests/tcg/multiarch/tb-link.c
@@ -0,0 +1,67 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * Verify that a single TB spin-loop is properly invalidated,
+ * releasing the thread from the spin-loop.
+ */
+
+#include <assert.h>
+#include <sys/mman.h>
+#include <pthread.h>
+#include <stdint.h>
+#include <stdbool.h>
+#include <unistd.h>
+#include <sched.h>
+
+
+#ifdef __x86_64__
+#define READY   0x000047c6      /* movb $0,0(%rdi) */
+#define LOOP    0xfceb9090      /* 1: nop*2; jmp 1b */
+#define RETURN  0x909090c3      /* ret; nop*3 */
+#define NOP     0x90909090      /* nop*4 */
+#elif defined(__aarch64__)
+#define READY   0x3900001f      /* strb wzr,[x0] */
+#define LOOP    0x14000000      /* b . */
+#define RETURN  0xd65f03c0      /* ret */
+#define NOP     0xd503201f      /* nop */
+#elif defined(__riscv)
+#define READY   0x00050023      /* sb zero, (a0) */
+#define LOOP    0x0000006f      /* jal zero, #0 */
+#define RETURN  0x00008067      /* jalr zero, ra, 0 */
+#define NOP     0x00000013      /* nop */
+#endif
+
+
+int main()
+{
+#ifdef READY
+    int tmp;
+    pthread_t thread_id;
+    bool hold = true;
+    uint32_t *buf;
+
+    buf = mmap(NULL, 3 * sizeof(uint32_t),
+               PROT_READ | PROT_WRITE | PROT_EXEC,
+               MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    assert(buf != MAP_FAILED);
+
+    buf[0] = READY;
+    buf[1] = LOOP;
+    buf[2] = RETURN;
+
+    alarm(2);
+
+    tmp = pthread_create(&thread_id, NULL, (void *(*)(void *))buf, &hold);
+    assert(tmp == 0);
+
+    while (hold) {
+        sched_yield();
+    }
+
+    buf[1] = NOP;
+    __builtin___clear_cache(&buf[1], &buf[2]);
+
+    tmp = pthread_join(thread_id, NULL);
+    assert(tmp == 0);
+#endif
+    return 0;
+}

From dae1e0df49d429e76efcc0505e2519c988cf14b4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 17:42:54 +0200
Subject: [PATCH 0590/2396] gdbstub: Remove tb_flush uses

This hasn't been needed since d828b92b8a6
("accel/tcg: Introduce CF_BP_PAGE").

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 gdbstub/system.c | 5 -----
 gdbstub/user.c   | 3 ---
 2 files changed, 8 deletions(-)

diff --git a/gdbstub/system.c b/gdbstub/system.c
index 5be0d3c58c..5221c579d9 100644
--- a/gdbstub/system.c
+++ b/gdbstub/system.c
@@ -18,13 +18,11 @@
 #include "gdbstub/syscalls.h"
 #include "gdbstub/commands.h"
 #include "exec/hwaddr.h"
-#include "exec/tb-flush.h"
 #include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
 #include "system/cpus.h"
 #include "system/runstate.h"
 #include "system/replay.h"
-#include "system/tcg.h"
 #include "hw/core/cpu.h"
 #include "hw/cpu/cluster.h"
 #include "hw/boards.h"
@@ -174,9 +172,6 @@ static void gdb_vm_state_change(void *opaque, bool running, RunState state)
         } else {
             trace_gdbstub_hit_break();
         }
-        if (tcg_enabled()) {
-            tb_flush(cpu);
-        }
         ret = GDB_SIGNAL_TRAP;
         break;
     case RUN_STATE_PAUSED:
diff --git a/gdbstub/user.c b/gdbstub/user.c
index 67403e5a25..2e14ded3f0 100644
--- a/gdbstub/user.c
+++ b/gdbstub/user.c
@@ -15,7 +15,6 @@
 #include "qemu/sockets.h"
 #include "qapi/error.h"
 #include "exec/hwaddr.h"
-#include "exec/tb-flush.h"
 #include "exec/gdbstub.h"
 #include "gdbstub/commands.h"
 #include "gdbstub/syscalls.h"
@@ -220,7 +219,6 @@ int gdb_handlesig(CPUState *cpu, int sig, const char *reason, void *siginfo,
 
     /* disable single step if it was enabled */
     cpu_single_step(cpu, 0);
-    tb_flush(cpu);
 
     if (sig != 0) {
         gdb_set_stop_cpu(cpu);
@@ -539,7 +537,6 @@ static void disable_gdbstub(CPUState *thread_cpu)
         /* no cpu_watchpoint_remove_all for user-mode */
         cpu_single_step(cpu, 0);
     }
-    tb_flush(thread_cpu);
 }
 
 void gdbserver_fork_end(CPUState *cpu, pid_t pid)

From 521c9e1b1adcbca90d1d84e1dc00ec63f17256ee Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 18:43:30 +0200
Subject: [PATCH 0591/2396] target/alpha: Simplify call_pal implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since 288a5fe980f, we don't link translation blocks
directly to palcode entry points.  If we load palbr
from env instead of encoding the constant, we avoid
all need for tb_flush().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/alpha/cpu_loop.c |  5 -----
 target/alpha/helper.h       |  1 -
 target/alpha/sys_helper.c   |  6 ------
 target/alpha/translate.c    | 21 ++++++---------------
 4 files changed, 6 insertions(+), 27 deletions(-)

diff --git a/linux-user/alpha/cpu_loop.c b/linux-user/alpha/cpu_loop.c
index bb8346b509..f93597c400 100644
--- a/linux-user/alpha/cpu_loop.c
+++ b/linux-user/alpha/cpu_loop.c
@@ -94,11 +94,6 @@ void cpu_loop(CPUAlphaState *env)
                 break;
             case 0x86:
                 /* IMB */
-                /* ??? We can probably elide the code using page_unprotect
-                   that is checking for self-modifying code.  Instead we
-                   could simply call tb_flush here.  Until we work out the
-                   changes required to turn off the extra write protection,
-                   this can be a no-op.  */
                 break;
             case 0x9E:
                 /* RDUNIQUE */
diff --git a/target/alpha/helper.h b/target/alpha/helper.h
index d60f208703..788d2fbf28 100644
--- a/target/alpha/helper.h
+++ b/target/alpha/helper.h
@@ -90,7 +90,6 @@ DEF_HELPER_FLAGS_2(ieee_input_s, TCG_CALL_NO_WG, void, env, i64)
 #if !defined (CONFIG_USER_ONLY)
 DEF_HELPER_FLAGS_1(tbia, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_2(tbis, TCG_CALL_NO_RWG, void, env, i64)
-DEF_HELPER_FLAGS_1(tb_flush, TCG_CALL_NO_RWG, void, env)
 
 DEF_HELPER_1(halt, void, i64)
 
diff --git a/target/alpha/sys_helper.c b/target/alpha/sys_helper.c
index 51e3254428..87e37605c1 100644
--- a/target/alpha/sys_helper.c
+++ b/target/alpha/sys_helper.c
@@ -20,7 +20,6 @@
 #include "qemu/osdep.h"
 #include "cpu.h"
 #include "exec/cputlb.h"
-#include "exec/tb-flush.h"
 #include "exec/helper-proto.h"
 #include "system/runstate.h"
 #include "system/system.h"
@@ -38,11 +37,6 @@ void helper_tbis(CPUAlphaState *env, uint64_t p)
     tlb_flush_page(env_cpu(env), p);
 }
 
-void helper_tb_flush(CPUAlphaState *env)
-{
-    tb_flush(env_cpu(env));
-}
-
 void helper_halt(uint64_t restart)
 {
     if (restart) {
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index cebab0318c..f11b382438 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -48,8 +48,6 @@ struct DisasContext {
 
 #ifdef CONFIG_USER_ONLY
     MemOp unalign;
-#else
-    uint64_t palbr;
 #endif
     uint32_t tbflags;
     int mem_idx;
@@ -1155,7 +1153,6 @@ static DisasJumpType gen_call_pal(DisasContext *ctx, int palcode)
 #else
     {
         TCGv tmp = tcg_temp_new();
-        uint64_t entry;
 
         gen_pc_disp(ctx, tmp, 0);
         if (ctx->tbflags & ENV_FLAG_PAL_MODE) {
@@ -1165,12 +1162,11 @@ static DisasJumpType gen_call_pal(DisasContext *ctx, int palcode)
         }
         tcg_gen_st_i64(tmp, tcg_env, offsetof(CPUAlphaState, exc_addr));
 
-        entry = ctx->palbr;
-        entry += (palcode & 0x80
-                  ? 0x2000 + (palcode - 0x80) * 64
-                  : 0x1000 + palcode * 64);
-
-        tcg_gen_movi_i64(cpu_pc, entry);
+        tcg_gen_ld_i64(cpu_pc, tcg_env, offsetof(CPUAlphaState, palbr));
+        tcg_gen_addi_i64(cpu_pc, cpu_pc,
+                         palcode & 0x80
+                         ? 0x2000 + (palcode - 0x80) * 64
+                         : 0x1000 + palcode * 64);
         return DISAS_PC_UPDATED;
     }
 #endif
@@ -1292,11 +1288,7 @@ static DisasJumpType gen_mtpr(DisasContext *ctx, TCGv vb, int regno)
     case 7:
         /* PALBR */
         tcg_gen_st_i64(vb, tcg_env, offsetof(CPUAlphaState, palbr));
-        /* Changing the PAL base register implies un-chaining all of the TBs
-           that ended with a CALL_PAL.  Since the base register usually only
-           changes during boot, flushing everything works well.  */
-        gen_helper_tb_flush(tcg_env);
-        return DISAS_PC_STALE;
+        break;
 
     case 32 ... 39:
         /* Accessing the "non-shadow" general registers.  */
@@ -2874,7 +2866,6 @@ static void alpha_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cpu)
     ctx->ir = cpu_std_ir;
     ctx->unalign = (ctx->tbflags & TB_FLAG_UNALIGN ? MO_UNALN : MO_ALIGN);
 #else
-    ctx->palbr = env->palbr;
     ctx->ir = (ctx->tbflags & ENV_FLAG_PAL_MODE ? cpu_pal_ir : cpu_std_ir);
 #endif
 

From 55b490b58fbfb4079186f05a1a63da1633239cbf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 18:53:50 +0200
Subject: [PATCH 0592/2396] target/riscv: Record misa_ext in
 TCGTBCPUState.cs_base

The tb_flush within write_misa was incorrect.  It assumed
that we could adjust the ISA of the current processor and
discard all TB and all would be well.  But MISA is per vcpu,
so globally flushing TB does not mean that the TB matches
the MISA of any given vcpu.

By recording misa in the tb state, we ensure that the code
generated matches the vcpu.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/riscv/csr.c         | 3 ---
 target/riscv/tcg/tcg-cpu.c | 3 ++-
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 8842e07a73..3c8989f522 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -25,7 +25,6 @@
 #include "pmu.h"
 #include "time_helper.h"
 #include "exec/cputlb.h"
-#include "exec/tb-flush.h"
 #include "exec/icount.h"
 #include "accel/tcg/getpc.h"
 #include "qemu/guest-random.h"
@@ -2173,8 +2172,6 @@ static RISCVException write_misa(CPURISCVState *env, int csrno,
         env->mstatus &= ~MSTATUS_FS;
     }
 
-    /* flush translation cache */
-    tb_flush(env_cpu(env));
     env->xl = riscv_cpu_mxl(env);
     return RISCV_EXCP_NONE;
 }
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 78fb279184..143ab079d4 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -191,7 +191,8 @@ static TCGTBCPUState riscv_get_tb_cpu_state(CPUState *cs)
 
     return (TCGTBCPUState){
         .pc = env->xl == MXL_RV32 ? env->pc & UINT32_MAX : env->pc,
-        .flags = flags
+        .flags = flags,
+        .cs_base = env->misa_ext,
     };
 }
 

From 9d61f61b4fa4dc4cd65fca8b24a9cb70c0c61a88 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 6 Sep 2025 06:35:36 +0200
Subject: [PATCH 0593/2396] hw/ppc/spapr: Use tb_invalidate_phys_range in
 h_page_init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only need invalidate tbs from a single page, not flush
all translations.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/ppc/spapr_hcall.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index c594d4b916..8c1e0a4817 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -8,7 +8,7 @@
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
-#include "exec/tb-flush.h"
+#include "exec/translation-block.h"
 #include "exec/target_page.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
@@ -301,7 +301,7 @@ static target_ulong h_page_init(PowerPCCPU *cpu, SpaprMachineState *spapr,
         if (kvm_enabled()) {
             kvmppc_icbi_range(cpu, pdst, len);
         } else if (tcg_enabled()) {
-            tb_flush(CPU(cpu));
+            tb_invalidate_phys_range(CPU(cpu), dst, dst + len - 1);
         } else {
             g_assert_not_reached();
         }

From b773c149a80b11449899b6a4ad3672250d4fcb0f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Fri, 5 Sep 2025 17:57:14 +0200
Subject: [PATCH 0594/2396] accel/tcg: Split out tb_flush__exclusive_or_serial

Expose a routine to be called when no cpus are running.
Simplify the do_tb_flush run_on_cpu callback, because
that is explicitly called with start_exclusive; there
is no need for the mmap_lock as well.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c    | 39 +++++++++++++++++++++++++--------------
 include/exec/tb-flush.h | 15 +++++++++++++++
 2 files changed, 40 insertions(+), 14 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index e6d45c9c12..b4566a81d7 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -36,6 +36,9 @@
 #include "internal-common.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
+#define runstate_is_running()  true
+#else
+#include "system/runstate.h"
 #endif
 
 
@@ -88,7 +91,10 @@ static IntervalTreeRoot tb_root;
 
 static void tb_remove_all(void)
 {
-    assert_memory_lock();
+    /*
+     * Only called from tb_flush__exclusive_or_serial, where we have already
+     * asserted that we're in an exclusive state.
+     */
     memset(&tb_root, 0, sizeof(tb_root));
 }
 
@@ -756,17 +762,19 @@ static void tb_remove(TranslationBlock *tb)
 }
 #endif /* CONFIG_USER_ONLY */
 
-/* flush all the translation blocks */
-static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
+/*
+ * Flush all the translation blocks.
+ * Must be called from a context in which no cpus are running,
+ * e.g. start_exclusive() or vm_stop().
+ */
+void tb_flush__exclusive_or_serial(void)
 {
-    bool did_flush = false;
+    CPUState *cpu;
 
-    mmap_lock();
-    /* If it is already been done on request of another CPU, just retry. */
-    if (tb_ctx.tb_flush_count != tb_flush_count.host_int) {
-        goto done;
-    }
-    did_flush = true;
+    assert(tcg_enabled());
+    /* Note that cpu_in_serial_context checks cpu_in_exclusive_context. */
+    assert(!runstate_is_running() ||
+           (current_cpu && cpu_in_serial_context(current_cpu)));
 
     CPU_FOREACH(cpu) {
         tcg_flush_jmp_cache(cpu);
@@ -778,11 +786,14 @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
     tcg_region_reset_all();
     /* XXX: flush processor icache at this point if cache flush is expensive */
     qatomic_inc(&tb_ctx.tb_flush_count);
+    qemu_plugin_flush_cb();
+}
 
-done:
-    mmap_unlock();
-    if (did_flush) {
-        qemu_plugin_flush_cb();
+static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
+{
+    /* If it is already been done on request of another CPU, just retry. */
+    if (tb_ctx.tb_flush_count == tb_flush_count.host_int) {
+        tb_flush__exclusive_or_serial();
     }
 }
 
diff --git a/include/exec/tb-flush.h b/include/exec/tb-flush.h
index 142c240d94..090ffc8818 100644
--- a/include/exec/tb-flush.h
+++ b/include/exec/tb-flush.h
@@ -8,6 +8,21 @@
 #ifndef _TB_FLUSH_H_
 #define _TB_FLUSH_H_
 
+/**
+ * tb_flush__exclusive_or_serial()
+ *
+ * Used to flush all the translation blocks in the system.  Mostly this is
+ * used to empty the code generation buffer after it is full.  Sometimes it
+ * is used when it is simpler to flush everything than work out which
+ * individual translations are now invalid.
+ *
+ * Must be called from an exclusive or serial context, e.g. start_exclusive,
+ * vm_stop, or when there is only one vcpu.  Note that start_exclusive cannot
+ * be called from within the cpu run loop, so this cannot be called from
+ * within target code.
+ */
+void tb_flush__exclusive_or_serial(void);
+
 /**
  * tb_flush() - flush all translation blocks
  * @cs: CPUState (must be valid, but treated as anonymous pointer)

From 84142184899322c2dca931e36abca7a35a2827cd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 6 Sep 2025 06:09:44 +0200
Subject: [PATCH 0595/2396] accel/tcg: Move post-load tb_flush to
 vm_change_state hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need not call tb_flush once per cpu, only once per vmload.

By moving the call from cpu_common_post_load to a tcg-specific
vm_change_state_handler, we do even better than that: we only
flush when called from HMP triggered loadvm, when we had old
state to flush.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tcg-all.c  | 21 +++++++++++++++++++++
 hw/core/cpu-system.c |  9 ---------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/accel/tcg/tcg-all.c b/accel/tcg/tcg-all.c
index 5125e1a4e2..18ea0c58b0 100644
--- a/accel/tcg/tcg-all.c
+++ b/accel/tcg/tcg-all.c
@@ -38,6 +38,8 @@
 #include "qemu/target-info.h"
 #ifndef CONFIG_USER_ONLY
 #include "hw/boards.h"
+#include "exec/tb-flush.h"
+#include "system/runstate.h"
 #endif
 #include "accel/accel-ops.h"
 #include "accel/accel-cpu-ops.h"
@@ -82,6 +84,23 @@ static void tcg_accel_instance_init(Object *obj)
 
 bool one_insn_per_tb;
 
+#ifndef CONFIG_USER_ONLY
+static void tcg_vm_change_state(void *opaque, bool running, RunState state)
+{
+    if (state == RUN_STATE_RESTORE_VM) {
+        /*
+         * loadvm will update the content of RAM, bypassing the usual
+         * mechanisms that ensure we flush TBs for writes to memory
+         * we've translated code from, so we must flush all TBs.
+         *
+         * vm_stop() has just stopped all cpus, so we are exclusive.
+         */
+        assert(!running);
+        tb_flush__exclusive_or_serial();
+    }
+}
+#endif
+
 static int tcg_init_machine(AccelState *as, MachineState *ms)
 {
     TCGState *s = TCG_STATE(as);
@@ -124,6 +143,8 @@ static int tcg_init_machine(AccelState *as, MachineState *ms)
     default:
         g_assert_not_reached();
     }
+
+    qemu_add_vm_change_state_handler(tcg_vm_change_state, NULL);
 #endif
 
     tcg_allowed = true;
diff --git a/hw/core/cpu-system.c b/hw/core/cpu-system.c
index 09c928c1f9..f601a083d1 100644
--- a/hw/core/cpu-system.c
+++ b/hw/core/cpu-system.c
@@ -23,7 +23,6 @@
 #include "system/address-spaces.h"
 #include "exec/cputlb.h"
 #include "system/memory.h"
-#include "exec/tb-flush.h"
 #include "qemu/target-info.h"
 #include "hw/qdev-core.h"
 #include "hw/qdev-properties.h"
@@ -207,14 +206,6 @@ static int cpu_common_post_load(void *opaque, int version_id)
         cpu_reset_interrupt(cpu, 0x01);
 
         tlb_flush(cpu);
-
-        /*
-         * loadvm has just updated the content of RAM, bypassing the
-         * usual mechanisms that ensure we flush TBs for writes to
-         * memory we've translated code from. So we must flush all TBs,
-         * which will now be stale.
-         */
-        tb_flush(cpu);
     }
 
     return 0;

From 7330741b3e4bc4b1b32e85b9c1372f44c896c4da Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 6 Sep 2025 06:46:03 +0200
Subject: [PATCH 0596/2396] plugins: Use tb_flush__exclusive_or_serial
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In all cases, we are already within start_exclusive.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/plugin-gen.c | 4 ++--
 plugins/core.c         | 6 ++----
 plugins/loader.c       | 3 +--
 3 files changed, 5 insertions(+), 8 deletions(-)

diff --git a/accel/tcg/plugin-gen.c b/accel/tcg/plugin-gen.c
index 9920381a84..1ffcb4b2d2 100644
--- a/accel/tcg/plugin-gen.c
+++ b/accel/tcg/plugin-gen.c
@@ -102,8 +102,8 @@ static TCGv_i32 gen_cpu_index(void)
     /*
      * Optimize when we run with a single vcpu. All values using cpu_index,
      * including scoreboard index, will be optimized out.
-     * User-mode calls tb_flush when setting this flag. In system-mode, all
-     * vcpus are created before generating code.
+     * User-mode flushes all TBs when setting this flag.
+     * In system-mode, all vcpus are created before generating code.
      */
     if (!tcg_cflags_has(current_cpu, CF_PARALLEL)) {
         return tcg_constant_i32(current_cpu->cpu_index);
diff --git a/plugins/core.c b/plugins/core.c
index c6e9ef1478..ead09fd2f1 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -248,7 +248,7 @@ static void plugin_grow_scoreboards__locked(CPUState *cpu)
         }
         plugin.scoreboard_alloc_size = scoreboard_size;
         /* force all tb to be flushed, as scoreboard pointers were changed. */
-        tb_flush(cpu);
+        tb_flush__exclusive_or_serial();
     }
     end_exclusive();
 }
@@ -684,8 +684,6 @@ void qemu_plugin_user_exit(void)
      * with the one in fork_start(). That is:
      * - start_exclusive(), which acquires qemu_cpu_list_lock,
      *   must be called before acquiring plugin.lock.
-     * - tb_flush(), which acquires mmap_lock(), must be called
-     *   while plugin.lock is not held.
      */
     start_exclusive();
 
@@ -705,7 +703,7 @@ void qemu_plugin_user_exit(void)
     }
     qemu_rec_mutex_unlock(&plugin.lock);
 
-    tb_flush(current_cpu);
+    tb_flush__exclusive_or_serial();
     end_exclusive();
 
     /* now it's safe to handle the exit case */
diff --git a/plugins/loader.c b/plugins/loader.c
index 8f0d75c904..ba10ebac99 100644
--- a/plugins/loader.c
+++ b/plugins/loader.c
@@ -377,8 +377,7 @@ static void plugin_flush_destroy(CPUState *cpu, run_on_cpu_data arg)
 {
     struct qemu_plugin_reset_data *data = arg.host_ptr;
 
-    g_assert(cpu_in_exclusive_context(cpu));
-    tb_flush(cpu);
+    tb_flush__exclusive_or_serial();
     plugin_reset_destroy(data);
 }
 

From 430014bee7a6c26a70e9f3854428843d5918cdf5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 13:14:09 -0700
Subject: [PATCH 0597/2396] linux-user: Split out begin_parallel_context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the test/flush/set block to a new function.
Use tb_flush__exclusive_or_serial while we're at it.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/mmap.c           | 13 ++-----------
 linux-user/syscall.c        |  7 +------
 linux-user/user-internals.h | 16 ++++++++++++++++
 3 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 002e1e668e..847092a28a 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -22,8 +22,6 @@
 #include "exec/log.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
-#include "exec/tb-flush.h"
-#include "exec/translation-block.h"
 #include "qemu.h"
 #include "user/page-protection.h"
 #include "user-internals.h"
@@ -1007,11 +1005,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int target_prot,
      * be atomic with respect to an external process.
      */
     if (ret != -1 && (flags & MAP_TYPE) != MAP_PRIVATE) {
-        CPUState *cpu = thread_cpu;
-        if (!tcg_cflags_has(cpu, CF_PARALLEL)) {
-            tcg_cflags_set(cpu, CF_PARALLEL);
-            tb_flush(cpu);
-        }
+        begin_parallel_context(thread_cpu);
     }
 
     return ret;
@@ -1448,10 +1442,7 @@ abi_ulong target_shmat(CPUArchState *cpu_env, int shmid,
      * supported by the host -- anything that requires EXCP_ATOMIC will not
      * be atomic with respect to an external process.
      */
-    if (!tcg_cflags_has(cpu, CF_PARALLEL)) {
-        tcg_cflags_set(cpu, CF_PARALLEL);
-        tb_flush(cpu);
-    }
+    begin_parallel_context(cpu);
 
     if (qemu_loglevel_mask(CPU_LOG_PAGE)) {
         FILE *f = qemu_log_trylock();
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 9098cdb9fa..1a5f2a03f9 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -27,8 +27,6 @@
 #include "target_mman.h"
 #include "exec/page-protection.h"
 #include "exec/mmap-lock.h"
-#include "exec/tb-flush.h"
-#include "exec/translation-block.h"
 #include <elf.h>
 #include <endian.h>
 #include <grp.h>
@@ -6667,10 +6665,7 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
          * generate code for parallel execution and flush old translations.
          * Do this now so that the copy gets CF_PARALLEL too.
          */
-        if (!tcg_cflags_has(cpu, CF_PARALLEL)) {
-            tcg_cflags_set(cpu, CF_PARALLEL);
-            tb_flush(cpu);
-        }
+        begin_parallel_context(cpu);
 
         /* we create a new CPU instance. */
         new_env = cpu_copy(env);
diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index 691b9a1775..7099349ec8 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -20,6 +20,8 @@
 
 #include "user/thunk.h"
 #include "qemu/log.h"
+#include "exec/tb-flush.h"
+#include "exec/translation-block.h"
 
 extern char *exec_path;
 void init_task_state(TaskState *ts);
@@ -172,6 +174,20 @@ static inline int regpairs_aligned(CPUArchState *cpu_env, int num) { return 0; }
  */
 void preexit_cleanup(CPUArchState *env, int code);
 
+/**
+ * begin_parallel_context
+ * @cs: the CPU context
+ *
+ * Called when starting the second vcpu, or joining shared memory.
+ */
+static inline void begin_parallel_context(CPUState *cs)
+{
+    if (!tcg_cflags_has(cs, CF_PARALLEL)) {
+        tb_flush__exclusive_or_serial();
+        tcg_cflags_set(cs, CF_PARALLEL);
+    }
+}
+
 /*
  * Include target-specific struct and function definitions;
  * they may need access to the target-independent structures

From a9519a46154105713c3f2d3039b40b205ac35e56 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 10:59:07 -0700
Subject: [PATCH 0598/2396] accel/tcg: Create queue_tb_flush from tb_flush
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the function and remove the path which
performs the flush immediately.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c      | 11 +++--------
 accel/tcg/translate-all.c |  2 +-
 include/exec/tb-flush.h   | 17 ++++++-----------
 3 files changed, 10 insertions(+), 20 deletions(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index b4566a81d7..c45fd42366 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -797,17 +797,12 @@ static void do_tb_flush(CPUState *cpu, run_on_cpu_data tb_flush_count)
     }
 }
 
-void tb_flush(CPUState *cpu)
+void queue_tb_flush(CPUState *cs)
 {
     if (tcg_enabled()) {
         unsigned tb_flush_count = qatomic_read(&tb_ctx.tb_flush_count);
-
-        if (cpu_in_serial_context(cpu)) {
-            do_tb_flush(cpu, RUN_ON_CPU_HOST_INT(tb_flush_count));
-        } else {
-            async_safe_run_on_cpu(cpu, do_tb_flush,
-                                  RUN_ON_CPU_HOST_INT(tb_flush_count));
-        }
+        async_safe_run_on_cpu(cs, do_tb_flush,
+                              RUN_ON_CPU_HOST_INT(tb_flush_count));
     }
 }
 
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index d468667b0d..31bc0f8bc5 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -289,7 +289,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     tb = tcg_tb_alloc(tcg_ctx);
     if (unlikely(!tb)) {
         /* flush must be done */
-        tb_flush(cpu);
+        queue_tb_flush(cpu);
         mmap_unlock();
         /* Make the execution loop process the flush as soon as possible.  */
         cpu->exception_index = EXCP_INTERRUPT;
diff --git a/include/exec/tb-flush.h b/include/exec/tb-flush.h
index 090ffc8818..e971d4ba6d 100644
--- a/include/exec/tb-flush.h
+++ b/include/exec/tb-flush.h
@@ -24,19 +24,14 @@
 void tb_flush__exclusive_or_serial(void);
 
 /**
- * tb_flush() - flush all translation blocks
- * @cs: CPUState (must be valid, but treated as anonymous pointer)
+ * queue_tb_flush() - add flush to the cpu work queue
+ * @cs: CPUState
  *
- * Used to flush all the translation blocks in the system. Sometimes
- * it is simpler to flush everything than work out which individual
- * translations are now invalid and ensure they are not called
- * anymore.
- *
- * tb_flush() takes care of running the flush in an exclusive context
- * if it is not already running in one. This means no guest code will
- * run until this complete.
+ * Flush all translation blocks the next time @cs processes the work queue.
+ * This should generally be followed by cpu_loop_exit(), so that the work
+ * queue is processed promptly.
  */
-void tb_flush(CPUState *cs);
+void queue_tb_flush(CPUState *cs);
 
 void tcg_flush_jmp_cache(CPUState *cs);
 

From ebf7a5d294a336c7701018884587646d89030073 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 13:26:53 -0700
Subject: [PATCH 0599/2396] accel/tcg: Improve buffer overflow in tb_gen_code

If we only have one vcpu, or within cpu_exec_step_atomic,
we needn't jump all the way back out to the cpu loop to
empty the code gen buffer.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/translate-all.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index 31bc0f8bc5..da9d7f1675 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -289,6 +289,10 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     tb = tcg_tb_alloc(tcg_ctx);
     if (unlikely(!tb)) {
         /* flush must be done */
+        if (cpu_in_serial_context(cpu)) {
+            tb_flush__exclusive_or_serial();
+            goto buffer_overflow;
+        }
         queue_tb_flush(cpu);
         mmap_unlock();
         /* Make the execution loop process the flush as soon as possible.  */

From b94cca31a7dbd204c7c3b6ede419be9a53b76bd6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:48:24 +0200
Subject: [PATCH 0600/2396] accel/tcg: Remove dead mmap_unlock() call in
 invalidate_phys_page_range
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit a97d5d2c8be ("accel/tcg: Use interval tree for TBs in
user-only mode") this code is guarded with #ifdef'ry and only build
for system emulation where mmap_unlock() is meaningless. Remove the
call.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250924164824.51971-1-philmd@linaro.org>
---
 accel/tcg/tb-maint.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index c45fd42366..5a8d0784e7 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -1168,7 +1168,6 @@ tb_invalidate_phys_page_range__locked(CPUState *cpu,
         page_collection_unlock(pages);
         /* Force execution of one insn next time.  */
         cpu->cflags_next_tb = 1 | CF_NOIRQ | curr_cflags(cpu);
-        mmap_unlock();
         cpu_loop_exit_noexc(cpu);
     }
 }

From f6f7fdd68e6fbfafae828e504de544b5659bc4bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:50:39 +0200
Subject: [PATCH 0601/2396] accel/tcg: Remove cpu_loop_exit_restore() stub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Not needed since commit 63e7af20352 ("hw/mips: Restrict ITU to TCG").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250924165039.52250-1-philmd@linaro.org>
---
 accel/stubs/tcg-stub.c    | 5 -----
 include/exec/cpu-common.h | 2 +-
 2 files changed, 1 insertion(+), 6 deletions(-)

diff --git a/accel/stubs/tcg-stub.c b/accel/stubs/tcg-stub.c
index 3b76b8b17c..77055e3964 100644
--- a/accel/stubs/tcg-stub.c
+++ b/accel/stubs/tcg-stub.c
@@ -17,8 +17,3 @@ G_NORETURN void cpu_loop_exit(CPUState *cpu)
 {
     g_assert_not_reached();
 }
-
-G_NORETURN void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc)
-{
-    g_assert_not_reached();
-}
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 9b658a3f48..f373781ae0 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -221,9 +221,9 @@ static inline bool cpu_loop_exit_requested(CPUState *cpu)
 
 G_NORETURN void cpu_loop_exit_noexc(CPUState *cpu);
 G_NORETURN void cpu_loop_exit_atomic(CPUState *cpu, uintptr_t pc);
+G_NORETURN void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
 #endif /* CONFIG_TCG */
 G_NORETURN void cpu_loop_exit(CPUState *cpu);
-G_NORETURN void cpu_loop_exit_restore(CPUState *cpu, uintptr_t pc);
 
 /* accel/tcg/cpu-exec.c */
 int cpu_exec(CPUState *cpu);

From d0af3cd0274e265435170a583c72b9f0a4100dff Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 15 Sep 2025 14:29:10 +0100
Subject: [PATCH 0602/2396] hw/usb/hcd-uhci: don't assert for SETUP to non-0
 endpoint

If the guest feeds invalid data to the UHCI controller, we
can assert:
qemu-system-x86_64: ../../hw/usb/core.c:744: usb_ep_get: Assertion `pid == USB_TOKEN_IN || pid == USB_TOKEN_OUT' failed.

(see issue 2548 for the repro case).  This happens because the guest
attempts USB_TOKEN_SETUP to an endpoint other than 0, which is not
valid.  The controller code doesn't catch this guest error, so
instead we hit the assertion in the USB core code.

Catch the case of SETUP to non-zero endpoint, and treat it as a fatal
error in the TD, in the same way we do for an invalid PID value in
the TD.

This is the UHCI equivalent of the same bug in OHCI that we fixed in
commit 3c3c233677 ("hw/usb/hcd-ohci: Fix #1510, #303: pid not IN or
OUT").

This bug has been tracked as CVE-2024-8354.

Cc: qemu-stable@nongnu.org
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/2548
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/usb/hcd-uhci.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/usb/hcd-uhci.c b/hw/usb/hcd-uhci.c
index 4822c704f6..e207d0587a 100644
--- a/hw/usb/hcd-uhci.c
+++ b/hw/usb/hcd-uhci.c
@@ -735,6 +735,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
     bool spd;
     bool queuing = (q != NULL);
     uint8_t pid = td->token & 0xff;
+    uint8_t ep_id = (td->token >> 15) & 0xf;
     UHCIAsync *async;
 
     async = uhci_async_find_td(s, td_addr);
@@ -778,9 +779,14 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
 
     switch (pid) {
     case USB_TOKEN_OUT:
-    case USB_TOKEN_SETUP:
     case USB_TOKEN_IN:
         break;
+    case USB_TOKEN_SETUP:
+        /* SETUP is only valid to endpoint 0 */
+        if (ep_id == 0) {
+            break;
+        }
+        /* fallthrough */
     default:
         /* invalid pid : frame interrupted */
         s->status |= UHCI_STS_HCPERR;
@@ -829,7 +835,7 @@ static int uhci_handle_td(UHCIState *s, UHCIQueue *q, uint32_t qh_addr,
             return uhci_handle_td_error(s, td, td_addr, USB_RET_NODEV,
                                         int_mask);
         }
-        ep = usb_ep_get(dev, pid, (td->token >> 15) & 0xf);
+        ep = usb_ep_get(dev, pid, ep_id);
         q = uhci_queue_new(s, qh_addr, td, ep);
     }
     async = uhci_async_alloc(q, td_addr);

From 4ccca2cc05a2d904d1e25365accf3bcbe553c8b0 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <lvivier@redhat.com>
Date: Fri, 18 Jul 2025 15:31:10 +0200
Subject: [PATCH 0603/2396] net/passt: Fix build failure due to missing GIO
 dependency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The passt networking backend uses functions from the GIO library,
such as g_subprocess_launcher_new(), to manage its daemon process.
So, building with passt enabled requires GIO to be available.

If we enable passt and disable gio the build fails during linkage with
undefined reference errors:

  /usr/bin/ld: libsystem.a.p/net_passt.c.o: in function `net_passt_start_daemon':
  net/passt.c:250: undefined reference to `g_subprocess_launcher_new'
  /usr/bin/ld: net/passt.c:251: undefined reference to `g_subprocess_launcher_take_fd'
  /usr/bin/ld: net/passt.c:253: undefined reference to `g_subprocess_launcher_spawnv'
  /usr/bin/ld: net/passt.c:256: undefined reference to `g_object_unref'
  /usr/bin/ld: net/passt.c:263: undefined reference to `g_subprocess_wait'
  /usr/bin/ld: net/passt.c:268: undefined reference to `g_subprocess_get_if_exited'
  /usr/bin/ld: libsystem.a.p/net_passt.c.o: in function `glib_autoptr_clear_GSubprocess':
  /usr/include/glib-2.0/gio/gio-autocleanups.h:132: undefined reference to `g_object_unref'
  /usr/bin/ld: libsystem.a.p/net_passt.c.o: in function `net_passt_start_daemon':
  net/passt.c:269: undefined reference to `g_subprocess_get_exit_status'

Fix this by adding an explicit weson dependency on GIO for the passt
option.
The existing dependency on linux is kept because passt is only available
on this OS.

Cc: qemu-stable@nongnu.org
Fixes: 854ee02b222 ("net: Add passt network backend")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3121
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 meson.build | 1 +
 1 file changed, 1 insertion(+)

diff --git a/meson.build b/meson.build
index 72da97829a..bdfb6214e6 100644
--- a/meson.build
+++ b/meson.build
@@ -1280,6 +1280,7 @@ endif
 
 enable_passt = get_option('passt') \
   .require(host_os == 'linux', error_message: 'passt is supported only on Linux') \
+  .require(gio.found(), error_message: 'passt requires gio') \
   .allowed()
 
 vde = not_found

From 363e612c2efc4543b9283f8a1ce6ab7d6620d9f5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:02 -0700
Subject: [PATCH 0604/2396] target/arm: Introduce KVMID_AA64_SYS_REG64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allow us to create kvm ids directly, rather than going
through ENCODE_AA64_CP_REG + cpreg_to_kvm_id.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-consts.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
index c44d23dbe7..fdb305eea1 100644
--- a/target/arm/kvm-consts.h
+++ b/target/arm/kvm-consts.h
@@ -180,4 +180,15 @@ MISMATCH_CHECK(CP_REG_ARM64_SYSREG_OP2_SHIFT, KVM_REG_ARM64_SYSREG_OP2_SHIFT);
 
 #undef MISMATCH_CHECK
 
+#define KVMID_AA64_SYS_REG_(op0, op1, crn, crm, op2)    \
+    (CP_REG_AA64_MASK | CP_REG_ARM64_SYSREG |           \
+     ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
+     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
+     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
+     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
+     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
+
+#define KVMID_AA64_SYS_REG64(op0, op1, crn, crm, op2)   \
+    (KVMID_AA64_SYS_REG_(op0, op1, crn, crm, op2) | CP_REG_SIZE_U64)
+
 #endif

From 5a8af95cb31122d2fcd2e6d3427b8e8427cd8bdc Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:03 -0700
Subject: [PATCH 0605/2396] target/arm: Move compare_u64 to helper.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We will use this function beyond kvm.c.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 11 +++++++++++
 target/arm/internals.h |  3 +++
 target/arm/kvm.c       | 11 -----------
 3 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index c44294711f..009f8d6fa1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -40,6 +40,17 @@
 
 static void switch_mode(CPUARMState *env, int mode);
 
+int compare_u64(const void *a, const void *b)
+{
+    if (*(uint64_t *)a > *(uint64_t *)b) {
+        return 1;
+    }
+    if (*(uint64_t *)a < *(uint64_t *)b) {
+        return -1;
+    }
+    return 0;
+}
+
 uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     assert(ri->fieldoffset);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 0f7df97b99..1d958dbf68 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -2004,4 +2004,7 @@ void vfp_clear_float_status_exc_flags(CPUARMState *env);
 void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask);
 bool arm_pan_enabled(CPUARMState *env);
 
+/* Compare uint64_t for qsort and bsearch. */
+int compare_u64(const void *a, const void *b);
+
 #endif
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index c1ec6654ca..5a75ff5927 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -718,17 +718,6 @@ void kvm_arm_register_device(MemoryRegion *mr, uint64_t devid, uint64_t group,
     memory_region_ref(kd->mr);
 }
 
-static int compare_u64(const void *a, const void *b)
-{
-    if (*(uint64_t *)a > *(uint64_t *)b) {
-        return 1;
-    }
-    if (*(uint64_t *)a < *(uint64_t *)b) {
-        return -1;
-    }
-    return 0;
-}
-
 /*
  * cpreg_values are sorted in ascending order by KVM register ID
  * (see kvm_arm_init_cpreg_list). This allows us to cheaply find

From a648af4885b1a344394a98cf298a9485f5232b4b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:04 -0700
Subject: [PATCH 0606/2396] target/arm/hvf: Split out sysreg.c.inc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the list of supported sysregs to a reuseable file.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 147 ++----------------------------------
 target/arm/hvf/sysreg.c.inc | 146 +++++++++++++++++++++++++++++++++++
 2 files changed, 152 insertions(+), 141 deletions(-)
 create mode 100644 target/arm/hvf/sysreg.c.inc

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index b77db99079..9f8e3083b4 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -403,150 +403,15 @@ struct hvf_sreg_match {
     uint32_t cp_idx;
 };
 
+#define DEF_SYSREG(HVF_ID, crn, crm, op0, op1, op2) \
+    { HVF_ID, HVF_SYSREG(crn, crm, op0, op1, op2) },
+
 static struct hvf_sreg_match hvf_sreg_match[] = {
-    { HV_SYS_REG_DBGBVR0_EL1, HVF_SYSREG(0, 0, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR0_EL1, HVF_SYSREG(0, 0, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR0_EL1, HVF_SYSREG(0, 0, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR0_EL1, HVF_SYSREG(0, 0, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR1_EL1, HVF_SYSREG(0, 1, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR1_EL1, HVF_SYSREG(0, 1, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR1_EL1, HVF_SYSREG(0, 1, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR1_EL1, HVF_SYSREG(0, 1, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR2_EL1, HVF_SYSREG(0, 2, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR2_EL1, HVF_SYSREG(0, 2, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR2_EL1, HVF_SYSREG(0, 2, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR2_EL1, HVF_SYSREG(0, 2, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR3_EL1, HVF_SYSREG(0, 3, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR3_EL1, HVF_SYSREG(0, 3, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR3_EL1, HVF_SYSREG(0, 3, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR3_EL1, HVF_SYSREG(0, 3, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR4_EL1, HVF_SYSREG(0, 4, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR4_EL1, HVF_SYSREG(0, 4, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR4_EL1, HVF_SYSREG(0, 4, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR4_EL1, HVF_SYSREG(0, 4, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR5_EL1, HVF_SYSREG(0, 5, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR5_EL1, HVF_SYSREG(0, 5, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR5_EL1, HVF_SYSREG(0, 5, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR5_EL1, HVF_SYSREG(0, 5, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR6_EL1, HVF_SYSREG(0, 6, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR6_EL1, HVF_SYSREG(0, 6, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR6_EL1, HVF_SYSREG(0, 6, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR6_EL1, HVF_SYSREG(0, 6, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR7_EL1, HVF_SYSREG(0, 7, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR7_EL1, HVF_SYSREG(0, 7, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR7_EL1, HVF_SYSREG(0, 7, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR7_EL1, HVF_SYSREG(0, 7, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR8_EL1, HVF_SYSREG(0, 8, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR8_EL1, HVF_SYSREG(0, 8, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR8_EL1, HVF_SYSREG(0, 8, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR8_EL1, HVF_SYSREG(0, 8, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR9_EL1, HVF_SYSREG(0, 9, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR9_EL1, HVF_SYSREG(0, 9, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR9_EL1, HVF_SYSREG(0, 9, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR9_EL1, HVF_SYSREG(0, 9, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR10_EL1, HVF_SYSREG(0, 10, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR10_EL1, HVF_SYSREG(0, 10, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR10_EL1, HVF_SYSREG(0, 10, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR10_EL1, HVF_SYSREG(0, 10, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR11_EL1, HVF_SYSREG(0, 11, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR11_EL1, HVF_SYSREG(0, 11, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR11_EL1, HVF_SYSREG(0, 11, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR11_EL1, HVF_SYSREG(0, 11, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR12_EL1, HVF_SYSREG(0, 12, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR12_EL1, HVF_SYSREG(0, 12, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR12_EL1, HVF_SYSREG(0, 12, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR12_EL1, HVF_SYSREG(0, 12, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR13_EL1, HVF_SYSREG(0, 13, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR13_EL1, HVF_SYSREG(0, 13, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR13_EL1, HVF_SYSREG(0, 13, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR13_EL1, HVF_SYSREG(0, 13, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR14_EL1, HVF_SYSREG(0, 14, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR14_EL1, HVF_SYSREG(0, 14, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR14_EL1, HVF_SYSREG(0, 14, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR14_EL1, HVF_SYSREG(0, 14, 2, 0, 7) },
-
-    { HV_SYS_REG_DBGBVR15_EL1, HVF_SYSREG(0, 15, 2, 0, 4) },
-    { HV_SYS_REG_DBGBCR15_EL1, HVF_SYSREG(0, 15, 2, 0, 5) },
-    { HV_SYS_REG_DBGWVR15_EL1, HVF_SYSREG(0, 15, 2, 0, 6) },
-    { HV_SYS_REG_DBGWCR15_EL1, HVF_SYSREG(0, 15, 2, 0, 7) },
-
-#ifdef SYNC_NO_RAW_REGS
-    /*
-     * The registers below are manually synced on init because they are
-     * marked as NO_RAW. We still list them to make number space sync easier.
-     */
-    { HV_SYS_REG_MDCCINT_EL1, HVF_SYSREG(0, 2, 2, 0, 0) },
-    { HV_SYS_REG_MIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 0) },
-    { HV_SYS_REG_MPIDR_EL1, HVF_SYSREG(0, 0, 3, 0, 5) },
-    { HV_SYS_REG_ID_AA64PFR0_EL1, HVF_SYSREG(0, 4, 3, 0, 0) },
-#endif
-    { HV_SYS_REG_ID_AA64PFR1_EL1, HVF_SYSREG(0, 4, 3, 0, 1) },
-    { HV_SYS_REG_ID_AA64DFR0_EL1, HVF_SYSREG(0, 5, 3, 0, 0) },
-    { HV_SYS_REG_ID_AA64DFR1_EL1, HVF_SYSREG(0, 5, 3, 0, 1) },
-    { HV_SYS_REG_ID_AA64ISAR0_EL1, HVF_SYSREG(0, 6, 3, 0, 0) },
-    { HV_SYS_REG_ID_AA64ISAR1_EL1, HVF_SYSREG(0, 6, 3, 0, 1) },
-#ifdef SYNC_NO_MMFR0
-    /* We keep the hardware MMFR0 around. HW limits are there anyway */
-    { HV_SYS_REG_ID_AA64MMFR0_EL1, HVF_SYSREG(0, 7, 3, 0, 0) },
-#endif
-    { HV_SYS_REG_ID_AA64MMFR1_EL1, HVF_SYSREG(0, 7, 3, 0, 1) },
-    { HV_SYS_REG_ID_AA64MMFR2_EL1, HVF_SYSREG(0, 7, 3, 0, 2) },
-    /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
-
-    { HV_SYS_REG_MDSCR_EL1, HVF_SYSREG(0, 2, 2, 0, 2) },
-    { HV_SYS_REG_SCTLR_EL1, HVF_SYSREG(1, 0, 3, 0, 0) },
-    { HV_SYS_REG_CPACR_EL1, HVF_SYSREG(1, 0, 3, 0, 2) },
-    { HV_SYS_REG_TTBR0_EL1, HVF_SYSREG(2, 0, 3, 0, 0) },
-    { HV_SYS_REG_TTBR1_EL1, HVF_SYSREG(2, 0, 3, 0, 1) },
-    { HV_SYS_REG_TCR_EL1, HVF_SYSREG(2, 0, 3, 0, 2) },
-
-    { HV_SYS_REG_APIAKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 0) },
-    { HV_SYS_REG_APIAKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 1) },
-    { HV_SYS_REG_APIBKEYLO_EL1, HVF_SYSREG(2, 1, 3, 0, 2) },
-    { HV_SYS_REG_APIBKEYHI_EL1, HVF_SYSREG(2, 1, 3, 0, 3) },
-    { HV_SYS_REG_APDAKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 0) },
-    { HV_SYS_REG_APDAKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 1) },
-    { HV_SYS_REG_APDBKEYLO_EL1, HVF_SYSREG(2, 2, 3, 0, 2) },
-    { HV_SYS_REG_APDBKEYHI_EL1, HVF_SYSREG(2, 2, 3, 0, 3) },
-    { HV_SYS_REG_APGAKEYLO_EL1, HVF_SYSREG(2, 3, 3, 0, 0) },
-    { HV_SYS_REG_APGAKEYHI_EL1, HVF_SYSREG(2, 3, 3, 0, 1) },
-
-    { HV_SYS_REG_SPSR_EL1, HVF_SYSREG(4, 0, 3, 0, 0) },
-    { HV_SYS_REG_ELR_EL1, HVF_SYSREG(4, 0, 3, 0, 1) },
-    { HV_SYS_REG_SP_EL0, HVF_SYSREG(4, 1, 3, 0, 0) },
-    { HV_SYS_REG_AFSR0_EL1, HVF_SYSREG(5, 1, 3, 0, 0) },
-    { HV_SYS_REG_AFSR1_EL1, HVF_SYSREG(5, 1, 3, 0, 1) },
-    { HV_SYS_REG_ESR_EL1, HVF_SYSREG(5, 2, 3, 0, 0) },
-    { HV_SYS_REG_FAR_EL1, HVF_SYSREG(6, 0, 3, 0, 0) },
-    { HV_SYS_REG_PAR_EL1, HVF_SYSREG(7, 4, 3, 0, 0) },
-    { HV_SYS_REG_MAIR_EL1, HVF_SYSREG(10, 2, 3, 0, 0) },
-    { HV_SYS_REG_AMAIR_EL1, HVF_SYSREG(10, 3, 3, 0, 0) },
-    { HV_SYS_REG_VBAR_EL1, HVF_SYSREG(12, 0, 3, 0, 0) },
-    { HV_SYS_REG_CONTEXTIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 1) },
-    { HV_SYS_REG_TPIDR_EL1, HVF_SYSREG(13, 0, 3, 0, 4) },
-    { HV_SYS_REG_CNTKCTL_EL1, HVF_SYSREG(14, 1, 3, 0, 0) },
-    { HV_SYS_REG_CSSELR_EL1, HVF_SYSREG(0, 0, 3, 2, 0) },
-    { HV_SYS_REG_TPIDR_EL0, HVF_SYSREG(13, 0, 3, 3, 2) },
-    { HV_SYS_REG_TPIDRRO_EL0, HVF_SYSREG(13, 0, 3, 3, 3) },
-    { HV_SYS_REG_CNTV_CTL_EL0, HVF_SYSREG(14, 3, 3, 3, 1) },
-    { HV_SYS_REG_CNTV_CVAL_EL0, HVF_SYSREG(14, 3, 3, 3, 2) },
-    { HV_SYS_REG_SP_EL1, HVF_SYSREG(4, 1, 3, 4, 0) },
+#include "sysreg.c.inc"
 };
 
+#undef DEF_SYSREG
+
 int hvf_get_registers(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
diff --git a/target/arm/hvf/sysreg.c.inc b/target/arm/hvf/sysreg.c.inc
new file mode 100644
index 0000000000..222698f1d1
--- /dev/null
+++ b/target/arm/hvf/sysreg.c.inc
@@ -0,0 +1,146 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR0_EL1, 0, 0, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR0_EL1, 0, 0, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR0_EL1, 0, 0, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR0_EL1, 0, 0, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR1_EL1, 0, 1, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR1_EL1, 0, 1, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR1_EL1, 0, 1, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR1_EL1, 0, 1, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR2_EL1, 0, 2, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR2_EL1, 0, 2, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR2_EL1, 0, 2, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR2_EL1, 0, 2, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR3_EL1, 0, 3, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR3_EL1, 0, 3, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR3_EL1, 0, 3, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR3_EL1, 0, 3, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR4_EL1, 0, 4, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR4_EL1, 0, 4, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR4_EL1, 0, 4, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR4_EL1, 0, 4, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR5_EL1, 0, 5, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR5_EL1, 0, 5, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR5_EL1, 0, 5, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR5_EL1, 0, 5, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR6_EL1, 0, 6, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR6_EL1, 0, 6, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR6_EL1, 0, 6, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR6_EL1, 0, 6, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR7_EL1, 0, 7, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR7_EL1, 0, 7, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR7_EL1, 0, 7, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR7_EL1, 0, 7, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR8_EL1, 0, 8, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR8_EL1, 0, 8, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR8_EL1, 0, 8, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR8_EL1, 0, 8, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR9_EL1, 0, 9, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR9_EL1, 0, 9, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR9_EL1, 0, 9, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR9_EL1, 0, 9, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR10_EL1, 0, 10, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR10_EL1, 0, 10, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR10_EL1, 0, 10, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR10_EL1, 0, 10, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR11_EL1, 0, 11, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR11_EL1, 0, 11, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR11_EL1, 0, 11, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR11_EL1, 0, 11, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR12_EL1, 0, 12, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR12_EL1, 0, 12, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR12_EL1, 0, 12, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR12_EL1, 0, 12, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR13_EL1, 0, 13, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR13_EL1, 0, 13, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR13_EL1, 0, 13, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR13_EL1, 0, 13, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR14_EL1, 0, 14, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR14_EL1, 0, 14, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR14_EL1, 0, 14, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR14_EL1, 0, 14, 2, 0, 7)
+
+DEF_SYSREG(HV_SYS_REG_DBGBVR15_EL1, 0, 15, 2, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR15_EL1, 0, 15, 2, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR15_EL1, 0, 15, 2, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR15_EL1, 0, 15, 2, 0, 7)
+
+#ifdef SYNC_NO_RAW_REGS
+/*
+ * The registers below are manually synced on init because they are
+ * marked as NO_RAW. We still list them to make number space sync easier.
+ */
+DEF_SYSREG(HV_SYS_REG_MDCCINT_EL1, 0, 2, 2, 0, 0)
+DEF_SYSREG(HV_SYS_REG_MIDR_EL1, 0, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_MPIDR_EL1, 0, 0, 3, 0, 5)
+DEF_SYSREG(HV_SYS_REG_ID_AA64PFR0_EL1, 0, 4, 3, 0, 0)
+#endif
+
+DEF_SYSREG(HV_SYS_REG_ID_AA64PFR1_EL1, 0, 4, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64DFR0_EL1, 0, 5, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_ID_AA64DFR1_EL1, 0, 5, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR0_EL1, 0, 6, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR1_EL1, 0, 6, 3, 0, 1)
+
+#ifdef SYNC_NO_MMFR0
+/* We keep the hardware MMFR0 around. HW limits are there anyway */
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR0_EL1, 0, 7, 3, 0, 0)
+#endif
+
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR1_EL1, 0, 7, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR2_EL1, 0, 7, 3, 0, 2)
+/* Add ID_AA64MMFR3_EL1 here when HVF supports it */
+
+DEF_SYSREG(HV_SYS_REG_MDSCR_EL1, 0, 2, 2, 0, 2)
+DEF_SYSREG(HV_SYS_REG_SCTLR_EL1, 1, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_CPACR_EL1, 1, 0, 3, 0, 2)
+DEF_SYSREG(HV_SYS_REG_TTBR0_EL1, 2, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_TTBR1_EL1, 2, 0, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_TCR_EL1, 2, 0, 3, 0, 2)
+
+DEF_SYSREG(HV_SYS_REG_APIAKEYLO_EL1, 2, 1, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_APIAKEYHI_EL1, 2, 1, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_APIBKEYLO_EL1, 2, 1, 3, 0, 2)
+DEF_SYSREG(HV_SYS_REG_APIBKEYHI_EL1, 2, 1, 3, 0, 3)
+DEF_SYSREG(HV_SYS_REG_APDAKEYLO_EL1, 2, 2, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_APDAKEYHI_EL1, 2, 2, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_APDBKEYLO_EL1, 2, 2, 3, 0, 2)
+DEF_SYSREG(HV_SYS_REG_APDBKEYHI_EL1, 2, 2, 3, 0, 3)
+DEF_SYSREG(HV_SYS_REG_APGAKEYLO_EL1, 2, 3, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_APGAKEYHI_EL1, 2, 3, 3, 0, 1)
+
+DEF_SYSREG(HV_SYS_REG_SPSR_EL1, 4, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_ELR_EL1, 4, 0, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_SP_EL0, 4, 1, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_AFSR0_EL1, 5, 1, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_AFSR1_EL1, 5, 1, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_ESR_EL1, 5, 2, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_FAR_EL1, 6, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_PAR_EL1, 7, 4, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_MAIR_EL1, 10, 2, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_AMAIR_EL1, 10, 3, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_VBAR_EL1, 12, 0, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_CONTEXTIDR_EL1, 13, 0, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_TPIDR_EL1, 13, 0, 3, 0, 4)
+DEF_SYSREG(HV_SYS_REG_CNTKCTL_EL1, 14, 1, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_CSSELR_EL1, 0, 0, 3, 2, 0)
+DEF_SYSREG(HV_SYS_REG_TPIDR_EL0, 13, 0, 3, 3, 2)
+DEF_SYSREG(HV_SYS_REG_TPIDRRO_EL0, 13, 0, 3, 3, 3)
+DEF_SYSREG(HV_SYS_REG_CNTV_CTL_EL0, 14, 3, 3, 3, 1)
+DEF_SYSREG(HV_SYS_REG_CNTV_CVAL_EL0, 14, 3, 3, 3, 2)
+DEF_SYSREG(HV_SYS_REG_SP_EL1, 4, 1, 3, 4, 0)

From 8da60618b6d2ee7cdd73d58e9f0b670c021a6bd0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:05 -0700
Subject: [PATCH 0607/2396] target/arm/hvf: Reorder DEF_SYSREG arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The order of the parameters in the Arm ARM is

  op0, op1, crn, crm, op2

Reorder the arguments of DEF_SYSREG to match.
Mechanical change to sysreg.c.inc using

  sed 's/\([^,]*\),\([^,]*\),\([^,]*\),\([^,]*\),\([^,]*\)/\1,\4,\5,\2,\3/'

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        |   2 +-
 target/arm/hvf/sysreg.c.inc | 224 ++++++++++++++++++------------------
 2 files changed, 113 insertions(+), 113 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 9f8e3083b4..f68924ba1f 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -403,7 +403,7 @@ struct hvf_sreg_match {
     uint32_t cp_idx;
 };
 
-#define DEF_SYSREG(HVF_ID, crn, crm, op0, op1, op2) \
+#define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2) \
     { HVF_ID, HVF_SYSREG(crn, crm, op0, op1, op2) },
 
 static struct hvf_sreg_match hvf_sreg_match[] = {
diff --git a/target/arm/hvf/sysreg.c.inc b/target/arm/hvf/sysreg.c.inc
index 222698f1d1..f2276d534e 100644
--- a/target/arm/hvf/sysreg.c.inc
+++ b/target/arm/hvf/sysreg.c.inc
@@ -1,146 +1,146 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR0_EL1, 0, 0, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR0_EL1, 0, 0, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR0_EL1, 0, 0, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR0_EL1, 0, 0, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR0_EL1, 2, 0, 0, 0, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR0_EL1, 2, 0, 0, 0, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR0_EL1, 2, 0, 0, 0, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR0_EL1, 2, 0, 0, 0, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR1_EL1, 0, 1, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR1_EL1, 0, 1, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR1_EL1, 0, 1, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR1_EL1, 0, 1, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR1_EL1, 2, 0, 0, 1, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR1_EL1, 2, 0, 0, 1, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR1_EL1, 2, 0, 0, 1, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR1_EL1, 2, 0, 0, 1, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR2_EL1, 0, 2, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR2_EL1, 0, 2, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR2_EL1, 0, 2, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR2_EL1, 0, 2, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR2_EL1, 2, 0, 0, 2, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR2_EL1, 2, 0, 0, 2, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR2_EL1, 2, 0, 0, 2, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR2_EL1, 2, 0, 0, 2, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR3_EL1, 0, 3, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR3_EL1, 0, 3, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR3_EL1, 0, 3, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR3_EL1, 0, 3, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR3_EL1, 2, 0, 0, 3, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR3_EL1, 2, 0, 0, 3, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR3_EL1, 2, 0, 0, 3, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR3_EL1, 2, 0, 0, 3, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR4_EL1, 0, 4, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR4_EL1, 0, 4, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR4_EL1, 0, 4, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR4_EL1, 0, 4, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR4_EL1, 2, 0, 0, 4, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR4_EL1, 2, 0, 0, 4, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR4_EL1, 2, 0, 0, 4, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR4_EL1, 2, 0, 0, 4, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR5_EL1, 0, 5, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR5_EL1, 0, 5, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR5_EL1, 0, 5, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR5_EL1, 0, 5, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR5_EL1, 2, 0, 0, 5, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR5_EL1, 2, 0, 0, 5, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR5_EL1, 2, 0, 0, 5, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR5_EL1, 2, 0, 0, 5, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR6_EL1, 0, 6, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR6_EL1, 0, 6, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR6_EL1, 0, 6, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR6_EL1, 0, 6, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR6_EL1, 2, 0, 0, 6, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR6_EL1, 2, 0, 0, 6, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR6_EL1, 2, 0, 0, 6, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR6_EL1, 2, 0, 0, 6, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR7_EL1, 0, 7, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR7_EL1, 0, 7, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR7_EL1, 0, 7, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR7_EL1, 0, 7, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR7_EL1, 2, 0, 0, 7, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR7_EL1, 2, 0, 0, 7, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR7_EL1, 2, 0, 0, 7, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR7_EL1, 2, 0, 0, 7, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR8_EL1, 0, 8, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR8_EL1, 0, 8, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR8_EL1, 0, 8, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR8_EL1, 0, 8, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR8_EL1, 2, 0, 0, 8, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR8_EL1, 2, 0, 0, 8, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR8_EL1, 2, 0, 0, 8, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR8_EL1, 2, 0, 0, 8, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR9_EL1, 0, 9, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR9_EL1, 0, 9, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR9_EL1, 0, 9, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR9_EL1, 0, 9, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR9_EL1, 2, 0, 0, 9, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR9_EL1, 2, 0, 0, 9, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR9_EL1, 2, 0, 0, 9, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR9_EL1, 2, 0, 0, 9, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR10_EL1, 0, 10, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR10_EL1, 0, 10, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR10_EL1, 0, 10, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR10_EL1, 0, 10, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR10_EL1, 2, 0, 0, 10, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR10_EL1, 2, 0, 0, 10, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR10_EL1, 2, 0, 0, 10, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR10_EL1, 2, 0, 0, 10, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR11_EL1, 0, 11, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR11_EL1, 0, 11, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR11_EL1, 0, 11, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR11_EL1, 0, 11, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR11_EL1, 2, 0, 0, 11, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR11_EL1, 2, 0, 0, 11, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR11_EL1, 2, 0, 0, 11, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR11_EL1, 2, 0, 0, 11, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR12_EL1, 0, 12, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR12_EL1, 0, 12, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR12_EL1, 0, 12, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR12_EL1, 0, 12, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR12_EL1, 2, 0, 0, 12, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR12_EL1, 2, 0, 0, 12, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR12_EL1, 2, 0, 0, 12, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR12_EL1, 2, 0, 0, 12, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR13_EL1, 0, 13, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR13_EL1, 0, 13, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR13_EL1, 0, 13, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR13_EL1, 0, 13, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR13_EL1, 2, 0, 0, 13, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR13_EL1, 2, 0, 0, 13, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR13_EL1, 2, 0, 0, 13, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR13_EL1, 2, 0, 0, 13, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR14_EL1, 0, 14, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR14_EL1, 0, 14, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR14_EL1, 0, 14, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR14_EL1, 0, 14, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR14_EL1, 2, 0, 0, 14, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR14_EL1, 2, 0, 0, 14, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR14_EL1, 2, 0, 0, 14, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR14_EL1, 2, 0, 0, 14, 7)
 
-DEF_SYSREG(HV_SYS_REG_DBGBVR15_EL1, 0, 15, 2, 0, 4)
-DEF_SYSREG(HV_SYS_REG_DBGBCR15_EL1, 0, 15, 2, 0, 5)
-DEF_SYSREG(HV_SYS_REG_DBGWVR15_EL1, 0, 15, 2, 0, 6)
-DEF_SYSREG(HV_SYS_REG_DBGWCR15_EL1, 0, 15, 2, 0, 7)
+DEF_SYSREG(HV_SYS_REG_DBGBVR15_EL1, 2, 0, 0, 15, 4)
+DEF_SYSREG(HV_SYS_REG_DBGBCR15_EL1, 2, 0, 0, 15, 5)
+DEF_SYSREG(HV_SYS_REG_DBGWVR15_EL1, 2, 0, 0, 15, 6)
+DEF_SYSREG(HV_SYS_REG_DBGWCR15_EL1, 2, 0, 0, 15, 7)
 
 #ifdef SYNC_NO_RAW_REGS
 /*
  * The registers below are manually synced on init because they are
  * marked as NO_RAW. We still list them to make number space sync easier.
  */
-DEF_SYSREG(HV_SYS_REG_MDCCINT_EL1, 0, 2, 2, 0, 0)
-DEF_SYSREG(HV_SYS_REG_MIDR_EL1, 0, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_MPIDR_EL1, 0, 0, 3, 0, 5)
-DEF_SYSREG(HV_SYS_REG_ID_AA64PFR0_EL1, 0, 4, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_MDCCINT_EL1, 2, 0, 0, 2, 0)
+DEF_SYSREG(HV_SYS_REG_MIDR_EL1, 3, 0, 0, 0, 0)
+DEF_SYSREG(HV_SYS_REG_MPIDR_EL1, 3, 0, 0, 0, 5)
+DEF_SYSREG(HV_SYS_REG_ID_AA64PFR0_EL1, 3, 0, 0, 4, 0)
 #endif
 
-DEF_SYSREG(HV_SYS_REG_ID_AA64PFR1_EL1, 0, 4, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_ID_AA64DFR0_EL1, 0, 5, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_ID_AA64DFR1_EL1, 0, 5, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR0_EL1, 0, 6, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR1_EL1, 0, 6, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64PFR1_EL1, 3, 0, 0, 4, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64DFR0_EL1, 3, 0, 0, 5, 0)
+DEF_SYSREG(HV_SYS_REG_ID_AA64DFR1_EL1, 3, 0, 0, 5, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR0_EL1, 3, 0, 0, 6, 0)
+DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR1_EL1, 3, 0, 0, 6, 1)
 
 #ifdef SYNC_NO_MMFR0
 /* We keep the hardware MMFR0 around. HW limits are there anyway */
-DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR0_EL1, 0, 7, 3, 0, 0)
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR0_EL1, 3, 0, 0, 7, 0)
 #endif
 
-DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR1_EL1, 0, 7, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR2_EL1, 0, 7, 3, 0, 2)
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR1_EL1, 3, 0, 0, 7, 1)
+DEF_SYSREG(HV_SYS_REG_ID_AA64MMFR2_EL1, 3, 0, 0, 7, 2)
 /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
 
-DEF_SYSREG(HV_SYS_REG_MDSCR_EL1, 0, 2, 2, 0, 2)
-DEF_SYSREG(HV_SYS_REG_SCTLR_EL1, 1, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_CPACR_EL1, 1, 0, 3, 0, 2)
-DEF_SYSREG(HV_SYS_REG_TTBR0_EL1, 2, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_TTBR1_EL1, 2, 0, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_TCR_EL1, 2, 0, 3, 0, 2)
+DEF_SYSREG(HV_SYS_REG_MDSCR_EL1, 2, 0, 0, 2, 2)
+DEF_SYSREG(HV_SYS_REG_SCTLR_EL1, 3, 0, 1, 0, 0)
+DEF_SYSREG(HV_SYS_REG_CPACR_EL1, 3, 0, 1, 0, 2)
+DEF_SYSREG(HV_SYS_REG_TTBR0_EL1, 3, 0, 2, 0, 0)
+DEF_SYSREG(HV_SYS_REG_TTBR1_EL1, 3, 0, 2, 0, 1)
+DEF_SYSREG(HV_SYS_REG_TCR_EL1, 3, 0, 2, 0, 2)
 
-DEF_SYSREG(HV_SYS_REG_APIAKEYLO_EL1, 2, 1, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_APIAKEYHI_EL1, 2, 1, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_APIBKEYLO_EL1, 2, 1, 3, 0, 2)
-DEF_SYSREG(HV_SYS_REG_APIBKEYHI_EL1, 2, 1, 3, 0, 3)
-DEF_SYSREG(HV_SYS_REG_APDAKEYLO_EL1, 2, 2, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_APDAKEYHI_EL1, 2, 2, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_APDBKEYLO_EL1, 2, 2, 3, 0, 2)
-DEF_SYSREG(HV_SYS_REG_APDBKEYHI_EL1, 2, 2, 3, 0, 3)
-DEF_SYSREG(HV_SYS_REG_APGAKEYLO_EL1, 2, 3, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_APGAKEYHI_EL1, 2, 3, 3, 0, 1)
+DEF_SYSREG(HV_SYS_REG_APIAKEYLO_EL1, 3, 0, 2, 1, 0)
+DEF_SYSREG(HV_SYS_REG_APIAKEYHI_EL1, 3, 0, 2, 1, 1)
+DEF_SYSREG(HV_SYS_REG_APIBKEYLO_EL1, 3, 0, 2, 1, 2)
+DEF_SYSREG(HV_SYS_REG_APIBKEYHI_EL1, 3, 0, 2, 1, 3)
+DEF_SYSREG(HV_SYS_REG_APDAKEYLO_EL1, 3, 0, 2, 2, 0)
+DEF_SYSREG(HV_SYS_REG_APDAKEYHI_EL1, 3, 0, 2, 2, 1)
+DEF_SYSREG(HV_SYS_REG_APDBKEYLO_EL1, 3, 0, 2, 2, 2)
+DEF_SYSREG(HV_SYS_REG_APDBKEYHI_EL1, 3, 0, 2, 2, 3)
+DEF_SYSREG(HV_SYS_REG_APGAKEYLO_EL1, 3, 0, 2, 3, 0)
+DEF_SYSREG(HV_SYS_REG_APGAKEYHI_EL1, 3, 0, 2, 3, 1)
 
-DEF_SYSREG(HV_SYS_REG_SPSR_EL1, 4, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_ELR_EL1, 4, 0, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_SP_EL0, 4, 1, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_AFSR0_EL1, 5, 1, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_AFSR1_EL1, 5, 1, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_ESR_EL1, 5, 2, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_FAR_EL1, 6, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_PAR_EL1, 7, 4, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_MAIR_EL1, 10, 2, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_AMAIR_EL1, 10, 3, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_VBAR_EL1, 12, 0, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_CONTEXTIDR_EL1, 13, 0, 3, 0, 1)
-DEF_SYSREG(HV_SYS_REG_TPIDR_EL1, 13, 0, 3, 0, 4)
-DEF_SYSREG(HV_SYS_REG_CNTKCTL_EL1, 14, 1, 3, 0, 0)
-DEF_SYSREG(HV_SYS_REG_CSSELR_EL1, 0, 0, 3, 2, 0)
-DEF_SYSREG(HV_SYS_REG_TPIDR_EL0, 13, 0, 3, 3, 2)
-DEF_SYSREG(HV_SYS_REG_TPIDRRO_EL0, 13, 0, 3, 3, 3)
-DEF_SYSREG(HV_SYS_REG_CNTV_CTL_EL0, 14, 3, 3, 3, 1)
-DEF_SYSREG(HV_SYS_REG_CNTV_CVAL_EL0, 14, 3, 3, 3, 2)
-DEF_SYSREG(HV_SYS_REG_SP_EL1, 4, 1, 3, 4, 0)
+DEF_SYSREG(HV_SYS_REG_SPSR_EL1, 3, 0, 4, 0, 0)
+DEF_SYSREG(HV_SYS_REG_ELR_EL1, 3, 0, 4, 0, 1)
+DEF_SYSREG(HV_SYS_REG_SP_EL0, 3, 0, 4, 1, 0)
+DEF_SYSREG(HV_SYS_REG_AFSR0_EL1, 3, 0, 5, 1, 0)
+DEF_SYSREG(HV_SYS_REG_AFSR1_EL1, 3, 0, 5, 1, 1)
+DEF_SYSREG(HV_SYS_REG_ESR_EL1, 3, 0, 5, 2, 0)
+DEF_SYSREG(HV_SYS_REG_FAR_EL1, 3, 0, 6, 0, 0)
+DEF_SYSREG(HV_SYS_REG_PAR_EL1, 3, 0, 7, 4, 0)
+DEF_SYSREG(HV_SYS_REG_MAIR_EL1, 3, 0, 10, 2, 0)
+DEF_SYSREG(HV_SYS_REG_AMAIR_EL1, 3, 0, 10, 3, 0)
+DEF_SYSREG(HV_SYS_REG_VBAR_EL1, 3, 0, 12, 0, 0)
+DEF_SYSREG(HV_SYS_REG_CONTEXTIDR_EL1, 3, 0, 13, 0, 1)
+DEF_SYSREG(HV_SYS_REG_TPIDR_EL1, 3, 0, 13, 0, 4)
+DEF_SYSREG(HV_SYS_REG_CNTKCTL_EL1, 3, 0, 14, 1, 0)
+DEF_SYSREG(HV_SYS_REG_CSSELR_EL1, 3, 2, 0, 0, 0)
+DEF_SYSREG(HV_SYS_REG_TPIDR_EL0, 3, 3, 13, 0, 2)
+DEF_SYSREG(HV_SYS_REG_TPIDRRO_EL0, 3, 3, 13, 0, 3)
+DEF_SYSREG(HV_SYS_REG_CNTV_CTL_EL0, 3, 3, 14, 3, 1)
+DEF_SYSREG(HV_SYS_REG_CNTV_CVAL_EL0, 3, 3, 14, 3, 2)
+DEF_SYSREG(HV_SYS_REG_SP_EL1, 3, 4, 4, 1, 0)

From 7d4d89a437790952c43ccd1ed7970d4d5ac6e37c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:06 -0700
Subject: [PATCH 0608/2396] target/arm/hvf: Add KVMID_TO_HVF, HVF_TO_KVMID
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Conversion between KVM system registers ids and the HVF system
register ids is trivial.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index f68924ba1f..7515e59c56 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -403,6 +403,26 @@ struct hvf_sreg_match {
     uint32_t cp_idx;
 };
 
+/*
+ * QEMU uses KVM system register ids in the migration format.
+ * Conveniently, HVF uses the same encoding of the op* and cr* parameters
+ * within the low 16 bits of the ids.  Thus conversion between the
+ * formats is trivial.
+ */
+
+#define KVMID_TO_HVF(KVM)  ((KVM) & 0xffff)
+#define HVF_TO_KVMID(HVF)  \
+    (CP_REG_ARM64 | CP_REG_SIZE_U64 | CP_REG_ARM64_SYSREG | (HVF))
+
+/* Verify this at compile-time. */
+
+#define DEF_SYSREG(HVF_ID, ...) \
+  QEMU_BUILD_BUG_ON(HVF_ID != KVMID_TO_HVF(KVMID_AA64_SYS_REG64(__VA_ARGS__)));
+
+#include "sysreg.c.inc"
+
+#undef DEF_SYSREG
+
 #define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2) \
     { HVF_ID, HVF_SYSREG(crn, crm, op0, op1, op2) },
 

From e6728fb3492fcfcd16d3a0f27e4bbf162c9a9291 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:07 -0700
Subject: [PATCH 0609/2396] target/arm/hvf: Remove hvf_sreg_match.key
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use conversion functions instead of table lookup.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 35 +++++++++++++++++++----------------
 1 file changed, 19 insertions(+), 16 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 7515e59c56..98f49ce33a 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -152,9 +152,6 @@ void hvf_arm_init_debug(void)
         g_array_sized_new(true, true, sizeof(HWWatchpoint), max_hw_wps);
 }
 
-#define HVF_SYSREG(crn, crm, op0, op1, op2) \
-        ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
-
 #define SYSREG_OP0_SHIFT      20
 #define SYSREG_OP0_MASK       0x3
 #define SYSREG_OP0(sysreg)    ((sysreg >> SYSREG_OP0_SHIFT) & SYSREG_OP0_MASK)
@@ -399,7 +396,6 @@ static const struct hvf_reg_match hvf_fpreg_match[] = {
 
 struct hvf_sreg_match {
     int reg;
-    uint32_t key;
     uint32_t cp_idx;
 };
 
@@ -423,8 +419,7 @@ struct hvf_sreg_match {
 
 #undef DEF_SYSREG
 
-#define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2) \
-    { HVF_ID, HVF_SYSREG(crn, crm, op0, op1, op2) },
+#define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2)  { HVF_ID },
 
 static struct hvf_sreg_match hvf_sreg_match[] = {
 #include "sysreg.c.inc"
@@ -469,13 +464,16 @@ int hvf_get_registers(CPUState *cpu)
     pstate_write(env, val);
 
     for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
+        int hvf_id = hvf_sreg_match[i].reg;
+        uint64_t kvm_id = HVF_TO_KVMID(hvf_id);
+
         if (hvf_sreg_match[i].cp_idx == -1) {
             continue;
         }
 
         if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
-            switch (hvf_sreg_match[i].reg) {
+            switch (hvf_id) {
             case HV_SYS_REG_DBGBVR0_EL1:
             case HV_SYS_REG_DBGBCR0_EL1:
             case HV_SYS_REG_DBGWVR0_EL1:
@@ -549,8 +547,10 @@ int hvf_get_registers(CPUState *cpu)
                  * vCPU but simply keep the values from the previous
                  * environment.
                  */
-                const ARMCPRegInfo *ri;
-                ri = get_arm_cp_reginfo(arm_cpu->cp_regs, hvf_sreg_match[i].key);
+                uint32_t key = kvm_to_cpreg_id(kvm_id);
+                const ARMCPRegInfo *ri =
+                    get_arm_cp_reginfo(arm_cpu->cp_regs, key);
+
                 val = read_raw_cp_reg(env, ri);
 
                 arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
@@ -559,7 +559,7 @@ int hvf_get_registers(CPUState *cpu)
             }
         }
 
-        ret = hv_vcpu_get_sys_reg(cpu->accel->fd, hvf_sreg_match[i].reg, &val);
+        ret = hv_vcpu_get_sys_reg(cpu->accel->fd, hvf_id, &val);
         assert_hvf_ok(ret);
 
         arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
@@ -606,13 +606,15 @@ int hvf_put_registers(CPUState *cpu)
 
     assert(write_cpustate_to_list(arm_cpu, false));
     for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
+        int hvf_id = hvf_sreg_match[i].reg;
+
         if (hvf_sreg_match[i].cp_idx == -1) {
             continue;
         }
 
         if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
-            switch (hvf_sreg_match[i].reg) {
+            switch (hvf_id) {
             case HV_SYS_REG_DBGBVR0_EL1:
             case HV_SYS_REG_DBGBCR0_EL1:
             case HV_SYS_REG_DBGWVR0_EL1:
@@ -687,7 +689,7 @@ int hvf_put_registers(CPUState *cpu)
         }
 
         val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx];
-        ret = hv_vcpu_set_sys_reg(cpu->accel->fd, hvf_sreg_match[i].reg, val);
+        ret = hv_vcpu_set_sys_reg(cpu->accel->fd, hvf_id, val);
         assert_hvf_ok(ret);
     }
 
@@ -922,14 +924,15 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
     /* Populate cp list for all known sysregs */
     for (i = 0; i < sregs_match_len; i++) {
-        const ARMCPRegInfo *ri;
-        uint32_t key = hvf_sreg_match[i].key;
+        int hvf_id = hvf_sreg_match[i].reg;
+        uint64_t kvm_id = HVF_TO_KVMID(hvf_id);
+        uint32_t key = kvm_to_cpreg_id(kvm_id);
+        const ARMCPRegInfo *ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key);
 
-        ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key);
         if (ri) {
             assert(!(ri->type & ARM_CP_NO_RAW));
             hvf_sreg_match[i].cp_idx = sregs_cnt;
-            arm_cpu->cpreg_indexes[sregs_cnt++] = cpreg_to_kvm_id(key);
+            arm_cpu->cpreg_indexes[sregs_cnt++] = kvm_id;
         } else {
             hvf_sreg_match[i].cp_idx = -1;
         }

From 98c2af435e653c34fb5f91eb1676ac458fd5cc78 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:08 -0700
Subject: [PATCH 0610/2396] target/arm/hvf: Replace hvf_sreg_match with
 hvf_sreg_list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change hvf_get_registers and hvf_put_registers to iterate over
cpregs_indexes instead of hvf_sreg_match.

This lets us drop the cp_idx member of hvf_sreg_match, which leaves
only one member in the struct.  Replace the struct with a const array.
Instead of int, use the proper enum type: hv_sys_reg_t.
Rename from hvf_sreg_match to hvf_sreg_list because there is no
longer any matching going on.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 45 +++++++++++++++-----------------------------
 1 file changed, 15 insertions(+), 30 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 98f49ce33a..b043eac8c6 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -394,11 +394,6 @@ static const struct hvf_reg_match hvf_fpreg_match[] = {
     { HV_SIMD_FP_REG_Q31, offsetof(CPUARMState, vfp.zregs[31]) },
 };
 
-struct hvf_sreg_match {
-    int reg;
-    uint32_t cp_idx;
-};
-
 /*
  * QEMU uses KVM system register ids in the migration format.
  * Conveniently, HVF uses the same encoding of the op* and cr* parameters
@@ -419,9 +414,9 @@ struct hvf_sreg_match {
 
 #undef DEF_SYSREG
 
-#define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2)  { HVF_ID },
+#define DEF_SYSREG(HVF_ID, op0, op1, crn, crm, op2)  HVF_ID,
 
-static struct hvf_sreg_match hvf_sreg_match[] = {
+static const hv_sys_reg_t hvf_sreg_list[] = {
 #include "sysreg.c.inc"
 };
 
@@ -434,7 +429,7 @@ int hvf_get_registers(CPUState *cpu)
     hv_return_t ret;
     uint64_t val;
     hv_simd_fp_uchar16_t fpval;
-    int i;
+    int i, n;
 
     for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
         ret = hv_vcpu_get_reg(cpu->accel->fd, hvf_reg_match[i].reg, &val);
@@ -463,13 +458,9 @@ int hvf_get_registers(CPUState *cpu)
     assert_hvf_ok(ret);
     pstate_write(env, val);
 
-    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
-        int hvf_id = hvf_sreg_match[i].reg;
-        uint64_t kvm_id = HVF_TO_KVMID(hvf_id);
-
-        if (hvf_sreg_match[i].cp_idx == -1) {
-            continue;
-        }
+    for (i = 0, n = arm_cpu->cpreg_array_len; i < n; i++) {
+        uint64_t kvm_id = arm_cpu->cpreg_indexes[i];
+        int hvf_id = KVMID_TO_HVF(kvm_id);
 
         if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
@@ -553,7 +544,7 @@ int hvf_get_registers(CPUState *cpu)
 
                 val = read_raw_cp_reg(env, ri);
 
-                arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
+                arm_cpu->cpreg_values[i] = val;
                 continue;
             }
             }
@@ -562,7 +553,7 @@ int hvf_get_registers(CPUState *cpu)
         ret = hv_vcpu_get_sys_reg(cpu->accel->fd, hvf_id, &val);
         assert_hvf_ok(ret);
 
-        arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx] = val;
+        arm_cpu->cpreg_values[i] = val;
     }
     assert(write_list_to_cpustate(arm_cpu));
 
@@ -578,7 +569,7 @@ int hvf_put_registers(CPUState *cpu)
     hv_return_t ret;
     uint64_t val;
     hv_simd_fp_uchar16_t fpval;
-    int i;
+    int i, n;
 
     for (i = 0; i < ARRAY_SIZE(hvf_reg_match); i++) {
         val = *(uint64_t *)((void *)env + hvf_reg_match[i].offset);
@@ -605,12 +596,9 @@ int hvf_put_registers(CPUState *cpu)
     aarch64_save_sp(env, arm_current_el(env));
 
     assert(write_cpustate_to_list(arm_cpu, false));
-    for (i = 0; i < ARRAY_SIZE(hvf_sreg_match); i++) {
-        int hvf_id = hvf_sreg_match[i].reg;
-
-        if (hvf_sreg_match[i].cp_idx == -1) {
-            continue;
-        }
+    for (i = 0, n = arm_cpu->cpreg_array_len; i < n; i++) {
+        uint64_t kvm_id = arm_cpu->cpreg_indexes[i];
+        int hvf_id = KVMID_TO_HVF(kvm_id);
 
         if (cpu->accel->guest_debug_enabled) {
             /* Handle debug registers */
@@ -688,7 +676,7 @@ int hvf_put_registers(CPUState *cpu)
             }
         }
 
-        val = arm_cpu->cpreg_values[hvf_sreg_match[i].cp_idx];
+        val = arm_cpu->cpreg_values[i];
         ret = hv_vcpu_set_sys_reg(cpu->accel->fd, hvf_id, val);
         assert_hvf_ok(ret);
     }
@@ -899,7 +887,7 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
-    uint32_t sregs_match_len = ARRAY_SIZE(hvf_sreg_match);
+    uint32_t sregs_match_len = ARRAY_SIZE(hvf_sreg_list);
     uint32_t sregs_cnt = 0;
     uint64_t pfr;
     hv_return_t ret;
@@ -924,17 +912,14 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
     /* Populate cp list for all known sysregs */
     for (i = 0; i < sregs_match_len; i++) {
-        int hvf_id = hvf_sreg_match[i].reg;
+        hv_sys_reg_t hvf_id = hvf_sreg_list[i];
         uint64_t kvm_id = HVF_TO_KVMID(hvf_id);
         uint32_t key = kvm_to_cpreg_id(kvm_id);
         const ARMCPRegInfo *ri = get_arm_cp_reginfo(arm_cpu->cp_regs, key);
 
         if (ri) {
             assert(!(ri->type & ARM_CP_NO_RAW));
-            hvf_sreg_match[i].cp_idx = sregs_cnt;
             arm_cpu->cpreg_indexes[sregs_cnt++] = kvm_id;
-        } else {
-            hvf_sreg_match[i].cp_idx = -1;
         }
     }
     arm_cpu->cpreg_array_len = sregs_cnt;

From bffe756ea10dfc5795637911f52f964d897b3283 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:09 -0700
Subject: [PATCH 0611/2396] target/arm/hvf: Sort the cpreg_indexes array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index b043eac8c6..99d8672b9b 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -925,6 +925,9 @@ int hvf_arch_init_vcpu(CPUState *cpu)
     arm_cpu->cpreg_array_len = sregs_cnt;
     arm_cpu->cpreg_vmstate_array_len = sregs_cnt;
 
+    /* cpreg tuples must be in strictly ascending order */
+    qsort(arm_cpu->cpreg_indexes, sregs_cnt, sizeof(uint64_t), compare_u64);
+
     assert(write_cpustate_to_list(arm_cpu, false));
 
     /* Set CP_NO_RAW system registers on init */

From acf2b6e6b96890cf0becd9fd17288d8e8b37394c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:10 -0700
Subject: [PATCH 0612/2396] target/arm/hvf: Use raw_read, raw_write to access
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce the places that know about field types by 2.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 99d8672b9b..694584cc13 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1153,7 +1153,7 @@ static bool hvf_sysreg_read_cp(CPUState *cpu, uint32_t reg, uint64_t *val)
         } else if (ri->readfn) {
             *val = ri->readfn(env, ri);
         } else {
-            *val = CPREG_FIELD64(env, ri);
+            *val = raw_read(env, ri);
         }
         trace_hvf_vgic_read(ri->name, *val);
         return true;
@@ -1435,7 +1435,7 @@ static bool hvf_sysreg_write_cp(CPUState *cpu, uint32_t reg, uint64_t val)
         if (ri->writefn) {
             ri->writefn(env, ri, val);
         } else {
-            CPREG_FIELD64(env, ri) = val;
+            raw_write(env, ri, val);
         }
 
         trace_hvf_vgic_write(ri->name, val);

From 45fc665f8be54c7defc16016eb02d0aff8ac832e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:11 -0700
Subject: [PATCH 0613/2396] target/arm: Use raw_write in cp_reg_reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce the places that know about field types by 1.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index c65af7e761..91ae56dddb 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -192,14 +192,8 @@ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
      * This is basically only used for fields in non-core coprocessors
      * (like the pxa2xx ones).
      */
-    if (!ri->fieldoffset) {
-        return;
-    }
-
-    if (cpreg_field_is_64bit(ri)) {
-        CPREG_FIELD64(&cpu->env, ri) = ri->resetvalue;
-    } else {
-        CPREG_FIELD32(&cpu->env, ri) = ri->resetvalue;
+    if (ri->fieldoffset) {
+        raw_write(&cpu->env, ri, ri->resetvalue);
     }
 }
 

From 5470f91ad19d051202d4d6931185f6a56b627c81 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:12 -0700
Subject: [PATCH 0614/2396] target/arm: Rename all ARMCPRegInfo from opaque to
 ri
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These pointers are no opaque, they have a specific type.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 10 +++++-----
 target/arm/helper.c |  6 +++---
 2 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 2a4826f5c4..8f3e728d8e 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -866,15 +866,15 @@ typedef struct ARMCPRegInfo ARMCPRegInfo;
  * Access functions for coprocessor registers. These cannot fail and
  * may not raise exceptions.
  */
-typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *opaque);
-typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *opaque,
+typedef uint64_t CPReadFn(CPUARMState *env, const ARMCPRegInfo *ri);
+typedef void CPWriteFn(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value);
 /* Access permission check functions for coprocessor registers. */
 typedef CPAccessResult CPAccessFn(CPUARMState *env,
-                                  const ARMCPRegInfo *opaque,
+                                  const ARMCPRegInfo *ri,
                                   bool isread);
 /* Hook function for register reset */
-typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *opaque);
+typedef void CPResetFn(CPUARMState *env, const ARMCPRegInfo *ri);
 
 #define CP_ANY 0xff
 
@@ -1100,7 +1100,7 @@ void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
  * CPResetFn that does nothing, for use if no reset is required even
  * if fieldoffset is non zero.
  */
-void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque);
+void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *ri);
 
 /*
  * Return true if this reginfo struct's field in the cpu state struct
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 009f8d6fa1..7b23e7e588 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -1073,7 +1073,7 @@ static const ARMCPRegInfo v6k_cp_reginfo[] = {
       .resetvalue = 0 },
 };
 
-static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *opaque)
+static void arm_gt_cntfrq_reset(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
 
@@ -5382,7 +5382,7 @@ static const ARMCPRegInfo rndr_reginfo[] = {
       .access = PL0_R, .readfn = rndr_readfn },
 };
 
-static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *opaque,
+static void dccvap_writefn(CPUARMState *env, const ARMCPRegInfo *ri,
                           uint64_t value)
 {
 #ifdef CONFIG_TCG
@@ -7829,7 +7829,7 @@ uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri)
     return 0;
 }
 
-void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *opaque)
+void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     /* Helper coprocessor reset function for do-nothing-on-reset registers */
 }

From 166e7990566bcfe49e2a68443ea314a1ef7066a9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:13 -0700
Subject: [PATCH 0615/2396] target/arm: Drop define_one_arm_cp_reg_with_opaque
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The last use of this interface was removed in 603bc048a27f
("hw/arm: Remove pxa2xx_pic").  As the comment in gicv3
stated, keeping pointer references to cpregs has SMP issues,
so avoid future temptation by removing the interface.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c | 10 +---------
 target/arm/cpregs.h       | 32 ++++++++------------------------
 target/arm/helper.c       | 29 +++++++++++------------------
 3 files changed, 20 insertions(+), 51 deletions(-)

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index 4b4cf09157..72e91f971a 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -3037,15 +3037,7 @@ void gicv3_init_cpuif(GICv3State *s)
          *  cpu->gic_pribits
          */
 
-        /* Note that we can't just use the GICv3CPUState as an opaque pointer
-         * in define_arm_cp_regs_with_opaque(), because when we're called back
-         * it might be with code translated by CPU 0 but run by CPU 1, in
-         * which case we'd get the wrong value.
-         * So instead we define the regs with no ri->opaque info, and
-         * get back to the GICv3CPUState from the CPUARMState.
-         *
-         * These CP regs callbacks can be called from either TCG or HVF code.
-         */
+        /* These CP regs callbacks can be called from either TCG or HVF. */
         define_arm_cp_regs(cpu, gicv3_cpuif_reginfo);
 
         /*
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 8f3e728d8e..d02d74f1f5 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -931,11 +931,7 @@ struct ARMCPRegInfo {
      */
     uint32_t nv2_redirect_offset;
 
-    /*
-     * The opaque pointer passed to define_arm_cp_regs_with_opaque() when
-     * this register was defined: can be used to hand data through to the
-     * register read/write functions, since they are passed the ARMCPRegInfo*.
-     */
+    /* This is used only by VHE. */
     void *opaque;
     /*
      * Value of this register, if it is ARM_CP_CONST. Otherwise, if
@@ -1029,27 +1025,15 @@ struct ARMCPRegInfo {
 #define CPREG_FIELD64(env, ri) \
     (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
 
-void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu, const ARMCPRegInfo *reg,
-                                       void *opaque);
+void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs);
+void define_arm_cp_regs_len(ARMCPU *cpu, const ARMCPRegInfo *regs, size_t len);
 
-static inline void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs)
-{
-    define_one_arm_cp_reg_with_opaque(cpu, regs, NULL);
-}
-
-void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
-                                        void *opaque, size_t len);
-
-#define define_arm_cp_regs_with_opaque(CPU, REGS, OPAQUE)               \
-    do {                                                                \
-        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);                       \
-        define_arm_cp_regs_with_opaque_len(CPU, REGS, OPAQUE,           \
-                                           ARRAY_SIZE(REGS));           \
+#define define_arm_cp_regs(CPU, REGS)                           \
+    do {                                                        \
+        QEMU_BUILD_BUG_ON(ARRAY_SIZE(REGS) == 0);               \
+        define_arm_cp_regs_len(CPU, REGS, ARRAY_SIZE(REGS));    \
     } while (0)
 
-#define define_arm_cp_regs(CPU, REGS) \
-    define_arm_cp_regs_with_opaque(CPU, REGS, NULL)
-
 const ARMCPRegInfo *get_arm_cp_reginfo(GHashTable *cpregs, uint32_t encoded_cp);
 
 /*
@@ -1168,7 +1152,7 @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
      * means that the right set of registers is exactly those where
      * the opc1 field is 4 or 5. (You can see this also in the assert
      * we do that the opc1 field and the permissions mask line up in
-     * define_one_arm_cp_reg_with_opaque().)
+     * define_one_arm_cp_reg().)
      * Checking the opc1 field is easier for us and avoids the problem
      * that we do not consistently use the right architectural names
      * for all sysregs, since we treat the name field as largely for debug.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 7b23e7e588..b76a0edb0f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7355,12 +7355,11 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 }
 
 /*
- * Private utility function for define_one_arm_cp_reg_with_opaque():
+ * Private utility function for define_one_arm_cp_reg():
  * add a single reginfo struct to the hash table.
  */
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
-                                   void *opaque, CPState state,
-                                   CPSecureState secstate,
+                                   CPState state, CPSecureState secstate,
                                    int crm, int opc1, int opc2,
                                    const char *name)
 {
@@ -7448,9 +7447,6 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     r2->opc2 = opc2;
     r2->state = state;
     r2->secure = secstate;
-    if (opaque) {
-        r2->opaque = opaque;
-    }
 
     if (make_const) {
         /* This should not have been a very special register to begin. */
@@ -7555,8 +7551,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 }
 
 
-void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
-                                       const ARMCPRegInfo *r, void *opaque)
+void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
 {
     /*
      * Define implementations of coprocessor registers.
@@ -7715,7 +7710,7 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                         if (nxs_ri.fgt) {
                             nxs_ri.fgt |= R_FGT_NXS_MASK;
                         }
-                        add_cpreg_to_hashtable(cpu, &nxs_ri, opaque, state,
+                        add_cpreg_to_hashtable(cpu, &nxs_ri, state,
                                                ARM_CP_SECSTATE_NS,
                                                crm, opc1, opc2, name);
                     }
@@ -7729,17 +7724,17 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                         switch (r->secure) {
                         case ARM_CP_SECSTATE_S:
                         case ARM_CP_SECSTATE_NS:
-                            add_cpreg_to_hashtable(cpu, r, opaque, state,
+                            add_cpreg_to_hashtable(cpu, r, state,
                                                    r->secure, crm, opc1, opc2,
                                                    r->name);
                             break;
                         case ARM_CP_SECSTATE_BOTH:
                             name = g_strdup_printf("%s_S", r->name);
-                            add_cpreg_to_hashtable(cpu, r, opaque, state,
+                            add_cpreg_to_hashtable(cpu, r, state,
                                                    ARM_CP_SECSTATE_S,
                                                    crm, opc1, opc2, name);
                             g_free(name);
-                            add_cpreg_to_hashtable(cpu, r, opaque, state,
+                            add_cpreg_to_hashtable(cpu, r, state,
                                                    ARM_CP_SECSTATE_NS,
                                                    crm, opc1, opc2, r->name);
                             break;
@@ -7751,7 +7746,7 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
                          * AArch64 registers get mapped to non-secure instance
                          * of AArch32
                          */
-                        add_cpreg_to_hashtable(cpu, r, opaque, state,
+                        add_cpreg_to_hashtable(cpu, r, state,
                                                ARM_CP_SECSTATE_NS,
                                                crm, opc1, opc2, r->name);
                     }
@@ -7762,12 +7757,10 @@ void define_one_arm_cp_reg_with_opaque(ARMCPU *cpu,
 }
 
 /* Define a whole list of registers */
-void define_arm_cp_regs_with_opaque_len(ARMCPU *cpu, const ARMCPRegInfo *regs,
-                                        void *opaque, size_t len)
+void define_arm_cp_regs_len(ARMCPU *cpu, const ARMCPRegInfo *regs, size_t len)
 {
-    size_t i;
-    for (i = 0; i < len; ++i) {
-        define_one_arm_cp_reg_with_opaque(cpu, regs + i, opaque);
+    for (size_t i = 0; i < len; ++i) {
+        define_one_arm_cp_reg(cpu, regs + i);
     }
 }
 

From f570b394d2cc4d1c8128dd6c2b0493b9d58bc296 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:14 -0700
Subject: [PATCH 0616/2396] target/arm: Restrict the scope of CPREG_FIELD32,
 CPREG_FIELD64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h |  9 ---------
 target/arm/helper.c | 12 ++++++++++++
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index d02d74f1f5..6fb1994afa 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -1016,15 +1016,6 @@ struct ARMCPRegInfo {
     CPAccessFn *orig_accessfn;
 };
 
-/*
- * Macros which are lvalues for the field in CPUARMState for the
- * ARMCPRegInfo *ri.
- */
-#define CPREG_FIELD32(env, ri) \
-    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
-#define CPREG_FIELD64(env, ri) \
-    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
-
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs);
 void define_arm_cp_regs_len(ARMCPU *cpu, const ARMCPRegInfo *regs, size_t len);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index b76a0edb0f..fe298670f1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -51,6 +51,15 @@ int compare_u64(const void *a, const void *b)
     return 0;
 }
 
+/*
+ * Macros which are lvalues for the field in CPUARMState for the
+ * ARMCPRegInfo *ri.
+ */
+#define CPREG_FIELD32(env, ri) \
+    (*(uint32_t *)((char *)(env) + (ri)->fieldoffset))
+#define CPREG_FIELD64(env, ri) \
+    (*(uint64_t *)((char *)(env) + (ri)->fieldoffset))
+
 uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     assert(ri->fieldoffset);
@@ -71,6 +80,9 @@ void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     }
 }
 
+#undef CPREG_FIELD32
+#undef CPREG_FIELD64
+
 static void *raw_ptr(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     return (char *)env + ri->fieldoffset;

From 1e3c93b161d721da5528041c8388b6d5931c0f48 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:15 -0700
Subject: [PATCH 0617/2396] target/arm: Replace cpreg_field_is_64bit with
 cpreg_field_type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prepare for 128-bit fields by using a better query api.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h  | 10 ++++++----
 target/arm/gdbstub.c |  7 +++++--
 target/arm/helper.c  | 18 +++++++++++++-----
 3 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 6fb1994afa..74bae7309a 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -22,6 +22,7 @@
 #define TARGET_ARM_CPREGS_H
 
 #include "hw/registerfields.h"
+#include "exec/memop.h"
 #include "target/arm/kvm-consts.h"
 #include "cpu.h"
 
@@ -1078,12 +1079,13 @@ void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
 void arm_cp_reset_ignore(CPUARMState *env, const ARMCPRegInfo *ri);
 
 /*
- * Return true if this reginfo struct's field in the cpu state struct
- * is 64 bits wide.
+ * Return MO_32 if the field in CPUARMState is uint32_t or
+ * MO_64 if the field in CPUARMState is uint64_t.
  */
-static inline bool cpreg_field_is_64bit(const ARMCPRegInfo *ri)
+static inline MemOp cpreg_field_type(const ARMCPRegInfo *ri)
 {
-    return (ri->state == ARM_CP_STATE_AA64) || (ri->type & ARM_CP_64BIT);
+    return (ri->state == ARM_CP_STATE_AA64 || (ri->type & ARM_CP_64BIT)
+            ? MO_64 : MO_32);
 }
 
 static inline bool cp_access_ok(int current_el,
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 2d331fff44..4e2ac49b6a 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -247,10 +247,13 @@ static int arm_gdb_get_sysreg(CPUState *cs, GByteArray *buf, int reg)
     key = cpu->dyn_sysreg_feature.data.cpregs.keys[reg];
     ri = get_arm_cp_reginfo(cpu->cp_regs, key);
     if (ri) {
-        if (cpreg_field_is_64bit(ri)) {
+        switch (cpreg_field_type(ri)) {
+        case MO_64:
             return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
-        } else {
+        case MO_32:
             return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
+        default:
+            g_assert_not_reached();
         }
     }
     return 0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index fe298670f1..26941ecd4f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -63,20 +63,28 @@ int compare_u64(const void *a, const void *b)
 uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     assert(ri->fieldoffset);
-    if (cpreg_field_is_64bit(ri)) {
+    switch (cpreg_field_type(ri)) {
+    case MO_64:
         return CPREG_FIELD64(env, ri);
-    } else {
+    case MO_32:
         return CPREG_FIELD32(env, ri);
+    default:
+        g_assert_not_reached();
     }
 }
 
 void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     assert(ri->fieldoffset);
-    if (cpreg_field_is_64bit(ri)) {
+    switch (cpreg_field_type(ri)) {
+    case MO_64:
         CPREG_FIELD64(env, ri) = value;
-    } else {
+        break;
+    case MO_32:
         CPREG_FIELD32(env, ri) = value;
+        break;
+    default:
+        g_assert_not_reached();
     }
 }
 
@@ -2754,7 +2762,7 @@ static void vmsa_ttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                             uint64_t value)
 {
     /* If the ASID changes (with a 64-bit write), we must flush the TLB.  */
-    if (cpreg_field_is_64bit(ri) &&
+    if (cpreg_field_type(ri) == MO_64 &&
         extract64(raw_read(env, ri) ^ value, 48, 16) != 0) {
         ARMCPU *cpu = env_archcpu(env);
         tlb_flush(CPU(cpu));

From 8434f54f3eec1e19eafac2d883a1e945b12f52f9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:16 -0700
Subject: [PATCH 0618/2396] target/arm: Add CP_REG_AA32_64BIT_{SHIFT,MASK}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Give a name to the bit we're already using.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 74bae7309a..f7dd6d2f75 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -178,9 +178,14 @@ enum {
 #define CP_REG_NS_SHIFT 29
 #define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
 
+/* Distinguish 32-bit and 64-bit views of AArch32 system registers. */
+#define CP_REG_AA32_64BIT_SHIFT  15
+#define CP_REG_AA32_64BIT_MASK   (1 << CP_REG_AA32_64BIT_SHIFT)
+
 #define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
-    ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
-     ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
+    (((ns) << CP_REG_NS_SHIFT) |                            \
+     ((is64) << CP_REG_AA32_64BIT_SHIFT) |                  \
+     ((cp) << 16) | ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 
 #define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
     (CP_REG_AA64_MASK |                                 \
@@ -202,7 +207,7 @@ static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
         cpregid |= CP_REG_AA64_MASK;
     } else {
         if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
-            cpregid |= (1 << 15);
+            cpregid |= CP_REG_AA32_64BIT_MASK;
         }
 
         /*
@@ -226,8 +231,8 @@ static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
         kvmid = cpregid & ~CP_REG_AA64_MASK;
         kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
     } else {
-        kvmid = cpregid & ~(1 << 15);
-        if (cpregid & (1 << 15)) {
+        kvmid = cpregid & ~CP_REG_AA32_64BIT_MASK;
+        if (cpregid & CP_REG_AA32_64BIT_MASK) {
             kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
         } else {
             kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;

From 7015fbabde447abe7947a7112dff6b592ae664b1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:17 -0700
Subject: [PATCH 0619/2396] target/arm: Rename CP_REG_AA32_NS_{SHIFT,MASK}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename from CP_REG_NS_* to emphasize this is specific to AArch32.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index f7dd6d2f75..417d79f7ba 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -175,15 +175,15 @@ enum {
  * add a bit to distinguish between secure and non-secure cpregs in the
  * hashtable.
  */
-#define CP_REG_NS_SHIFT 29
-#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
+#define CP_REG_AA32_NS_SHIFT     29
+#define CP_REG_AA32_NS_MASK      (1 << CP_REG_AA32_NS_SHIFT)
 
 /* Distinguish 32-bit and 64-bit views of AArch32 system registers. */
 #define CP_REG_AA32_64BIT_SHIFT  15
 #define CP_REG_AA32_64BIT_MASK   (1 << CP_REG_AA32_64BIT_SHIFT)
 
 #define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
-    (((ns) << CP_REG_NS_SHIFT) |                            \
+    (((ns) << CP_REG_AA32_NS_SHIFT) |                       \
      ((is64) << CP_REG_AA32_64BIT_SHIFT) |                  \
      ((cp) << 16) | ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 
@@ -214,7 +214,7 @@ static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
          * KVM is always non-secure so add the NS flag on AArch32 register
          * entries.
          */
-         cpregid |= 1 << CP_REG_NS_SHIFT;
+         cpregid |= CP_REG_AA32_NS_MASK;
     }
     return cpregid;
 }

From dee3c0c2cf9848cd849744474cdac108ce68a1ef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:18 -0700
Subject: [PATCH 0620/2396] target/arm: Convert init_cpreg_list to
 g_hash_table_foreach
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adjust count_cpreg and add_cpreg_to_list to be used with
g_hash_table_foreach instead of g_list_foreach.  In this way we have
the ARMCPRegInfo pointer directly rather than having to look it up
from the key.

Delay the sorting of the cpreg_indexes until after add_cpreg_to_list.
This allows us to sort the data that we actually care about,
the kvm id, as computed within add_cpreg_to_list, instead of
having to repeatedly compute the kvm id within cpreg_key_compare.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 54 ++++++++++++++++++---------------------------
 1 file changed, 21 insertions(+), 33 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 26941ecd4f..27d5ab8292 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -229,11 +229,11 @@ bool write_list_to_cpustate(ARMCPU *cpu)
     return ok;
 }
 
-static void add_cpreg_to_list(gpointer key, gpointer opaque)
+static void add_cpreg_to_list(gpointer key, gpointer value, gpointer opaque)
 {
     ARMCPU *cpu = opaque;
     uint32_t regidx = (uintptr_t)key;
-    const ARMCPRegInfo *ri = get_arm_cp_reginfo(cpu->cp_regs, regidx);
+    const ARMCPRegInfo *ri = value;
 
     if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
         cpu->cpreg_indexes[cpu->cpreg_array_len] = cpreg_to_kvm_id(regidx);
@@ -242,61 +242,49 @@ static void add_cpreg_to_list(gpointer key, gpointer opaque)
     }
 }
 
-static void count_cpreg(gpointer key, gpointer opaque)
+static void count_cpreg(gpointer key, gpointer value, gpointer opaque)
 {
     ARMCPU *cpu = opaque;
-    const ARMCPRegInfo *ri;
-
-    ri = g_hash_table_lookup(cpu->cp_regs, key);
+    const ARMCPRegInfo *ri = value;
 
     if (!(ri->type & (ARM_CP_NO_RAW | ARM_CP_ALIAS))) {
         cpu->cpreg_array_len++;
     }
 }
 
-static gint cpreg_key_compare(gconstpointer a, gconstpointer b, gpointer d)
-{
-    uint64_t aidx = cpreg_to_kvm_id((uintptr_t)a);
-    uint64_t bidx = cpreg_to_kvm_id((uintptr_t)b);
-
-    if (aidx > bidx) {
-        return 1;
-    }
-    if (aidx < bidx) {
-        return -1;
-    }
-    return 0;
-}
-
 void init_cpreg_list(ARMCPU *cpu)
 {
     /*
      * Initialise the cpreg_tuples[] array based on the cp_regs hash.
      * Note that we require cpreg_tuples[] to be sorted by key ID.
      */
-    GList *keys;
     int arraylen;
 
-    keys = g_hash_table_get_keys(cpu->cp_regs);
-    keys = g_list_sort_with_data(keys, cpreg_key_compare, NULL);
-
     cpu->cpreg_array_len = 0;
-
-    g_list_foreach(keys, count_cpreg, cpu);
+    g_hash_table_foreach(cpu->cp_regs, count_cpreg, cpu);
 
     arraylen = cpu->cpreg_array_len;
-    cpu->cpreg_indexes = g_new(uint64_t, arraylen);
-    cpu->cpreg_values = g_new(uint64_t, arraylen);
-    cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
-    cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
-    cpu->cpreg_vmstate_array_len = cpu->cpreg_array_len;
+    if (arraylen) {
+        cpu->cpreg_indexes = g_new(uint64_t, arraylen);
+        cpu->cpreg_values = g_new(uint64_t, arraylen);
+        cpu->cpreg_vmstate_indexes = g_new(uint64_t, arraylen);
+        cpu->cpreg_vmstate_values = g_new(uint64_t, arraylen);
+    } else {
+        cpu->cpreg_indexes = NULL;
+        cpu->cpreg_values = NULL;
+        cpu->cpreg_vmstate_indexes = NULL;
+        cpu->cpreg_vmstate_values = NULL;
+    }
+    cpu->cpreg_vmstate_array_len = arraylen;
     cpu->cpreg_array_len = 0;
 
-    g_list_foreach(keys, add_cpreg_to_list, cpu);
+    g_hash_table_foreach(cpu->cp_regs, add_cpreg_to_list, cpu);
 
     assert(cpu->cpreg_array_len == arraylen);
 
-    g_list_free(keys);
+    if (arraylen) {
+        qsort(cpu->cpreg_indexes, arraylen, sizeof(uint64_t), compare_u64);
+    }
 }
 
 bool arm_pan_enabled(CPUARMState *env)

From 304ca4b827d91ab2fb7c76bb3d6315a2dc5ee8f1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:19 -0700
Subject: [PATCH 0621/2396] target/arm: Remove cp argument to
 ENCODE_AA64_CP_REG
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All invocations were required to pass the same value,
CP_REG_ARM64_SYSREG_CP.  Bake that in to the result directly.
Remove CP_REG_ARM64_SYSREG_CP as unused.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h            |  5 ++---
 target/arm/helper.c            | 11 +++++------
 target/arm/hvf/hvf.c           |  3 +--
 target/arm/kvm-consts.h        |  3 ---
 target/arm/tcg/translate-a64.c |  6 ++----
 5 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 417d79f7ba..a10abadb93 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -187,9 +187,8 @@ enum {
      ((is64) << CP_REG_AA32_64BIT_SHIFT) |                  \
      ((cp) << 16) | ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 
-#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
-    (CP_REG_AA64_MASK |                                 \
-     ((cp) << CP_REG_ARM_COPROC_SHIFT) |                \
+#define ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2) \
+    (CP_REG_AA64_MASK | CP_REG_ARM64_SYSREG |           \
      ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
      ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
      ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 27d5ab8292..2732112ff2 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4503,7 +4503,7 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
     };
 
 #define K(op0, op1, crn, crm, op2) \
-    ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP, crn, crm, op0, op1, op2)
+    ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2)
 
     static const struct E2HAlias aliases[] = {
         { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
@@ -7396,10 +7396,9 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          * in their AArch64 view (the .cp value may be non-zero for the
          * benefit of the AArch32 view).
          */
-        if (cp == 0 || r->state == ARM_CP_STATE_BOTH) {
-            cp = CP_REG_ARM64_SYSREG_CP;
-        }
-        key = ENCODE_AA64_CP_REG(cp, r->crn, crm, r->opc0, opc1, opc2);
+        assert(cp == 0 || r->state == ARM_CP_STATE_BOTH);
+        cp = 0;
+        key = ENCODE_AA64_CP_REG(r->crn, crm, r->opc0, opc1, opc2);
         break;
     default:
         g_assert_not_reached();
@@ -7624,7 +7623,7 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
         }
         break;
     case ARM_CP_STATE_AA64:
-        assert(r->cp == 0 || r->cp == CP_REG_ARM64_SYSREG_CP);
+        assert(r->cp == 0);
         break;
     default:
         g_assert_not_reached();
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 694584cc13..6e67d89163 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1124,8 +1124,7 @@ static bool is_id_sysreg(uint32_t reg)
 
 static uint32_t hvf_reg2cp_reg(uint32_t reg)
 {
-    return ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP,
-                              (reg >> SYSREG_CRN_SHIFT) & SYSREG_CRN_MASK,
+    return ENCODE_AA64_CP_REG((reg >> SYSREG_CRN_SHIFT) & SYSREG_CRN_MASK,
                               (reg >> SYSREG_CRM_SHIFT) & SYSREG_CRM_MASK,
                               (reg >> SYSREG_OP0_SHIFT) & SYSREG_OP0_MASK,
                               (reg >> SYSREG_OP1_SHIFT) & SYSREG_OP1_MASK,
diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
index fdb305eea1..54ae5da7ce 100644
--- a/target/arm/kvm-consts.h
+++ b/target/arm/kvm-consts.h
@@ -160,9 +160,6 @@ MISMATCH_CHECK(QEMU_KVM_ARM_TARGET_CORTEX_A53, KVM_ARM_TARGET_CORTEX_A53);
 #define CP_REG_ARM64_SYSREG_OP2_MASK   0x0000000000000007
 #define CP_REG_ARM64_SYSREG_OP2_SHIFT  0
 
-/* No kernel define but it's useful to QEMU */
-#define CP_REG_ARM64_SYSREG_CP (CP_REG_ARM64_SYSREG >> CP_REG_ARM_COPROC_SHIFT)
-
 MISMATCH_CHECK(CP_REG_ARM64, KVM_REG_ARM64);
 MISMATCH_CHECK(CP_REG_ARM_COPROC_MASK, KVM_REG_ARM_COPROC_MASK);
 MISMATCH_CHECK(CP_REG_ARM_COPROC_SHIFT, KVM_REG_ARM_COPROC_SHIFT);
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 37bedc3780..a560ef0f42 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2466,8 +2466,7 @@ static void handle_sys(DisasContext *s, bool isread,
                        unsigned int op0, unsigned int op1, unsigned int op2,
                        unsigned int crn, unsigned int crm, unsigned int rt)
 {
-    uint32_t key = ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP,
-                                      crn, crm, op0, op1, op2);
+    uint32_t key = ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2);
     const ARMCPRegInfo *ri = get_arm_cp_reginfo(s->cp_regs, key);
     bool need_exit_tb = false;
     bool nv_trap_to_el2 = false;
@@ -2603,8 +2602,7 @@ static void handle_sys(DisasContext *s, bool isread,
          * We don't use the EL1 register's access function, and
          * fine-grained-traps on EL1 also do not apply here.
          */
-        key = ENCODE_AA64_CP_REG(CP_REG_ARM64_SYSREG_CP,
-                                 crn, crm, op0, 0, op2);
+        key = ENCODE_AA64_CP_REG(crn, crm, op0, 0, op2);
         ri = get_arm_cp_reginfo(s->cp_regs, key);
         assert(ri);
         assert(cp_access_ok(s->current_el, ri, isread));

From 398a33aeda5e01eb385f026d54192cfb73160b50 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:20 -0700
Subject: [PATCH 0622/2396] target/arm: Reorder ENCODE_AA64_CP_REG arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The order of the parameters in the Arm ARM is

  op0, op1, crn, crm, op2

Reorder the arguments of ENCODE_AA64_CP_REG to match.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h            | 2 +-
 target/arm/helper.c            | 4 ++--
 target/arm/hvf/hvf.c           | 6 +++---
 target/arm/tcg/translate-a64.c | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index a10abadb93..08fc42ea57 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -187,7 +187,7 @@ enum {
      ((is64) << CP_REG_AA32_64BIT_SHIFT) |                  \
      ((cp) << 16) | ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 
-#define ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2) \
+#define ENCODE_AA64_CP_REG(op0, op1, crn, crm, op2) \
     (CP_REG_AA64_MASK | CP_REG_ARM64_SYSREG |           \
      ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
      ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2732112ff2..965941f04e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4503,7 +4503,7 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
     };
 
 #define K(op0, op1, crn, crm, op2) \
-    ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2)
+    ENCODE_AA64_CP_REG(op0, op1, crn, crm, op2)
 
     static const struct E2HAlias aliases[] = {
         { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
@@ -7398,7 +7398,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          */
         assert(cp == 0 || r->state == ARM_CP_STATE_BOTH);
         cp = 0;
-        key = ENCODE_AA64_CP_REG(r->crn, crm, r->opc0, opc1, opc2);
+        key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
         break;
     default:
         g_assert_not_reached();
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 6e67d89163..8b467b3663 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1124,10 +1124,10 @@ static bool is_id_sysreg(uint32_t reg)
 
 static uint32_t hvf_reg2cp_reg(uint32_t reg)
 {
-    return ENCODE_AA64_CP_REG((reg >> SYSREG_CRN_SHIFT) & SYSREG_CRN_MASK,
-                              (reg >> SYSREG_CRM_SHIFT) & SYSREG_CRM_MASK,
-                              (reg >> SYSREG_OP0_SHIFT) & SYSREG_OP0_MASK,
+    return ENCODE_AA64_CP_REG((reg >> SYSREG_OP0_SHIFT) & SYSREG_OP0_MASK,
                               (reg >> SYSREG_OP1_SHIFT) & SYSREG_OP1_MASK,
+                              (reg >> SYSREG_CRN_SHIFT) & SYSREG_CRN_MASK,
+                              (reg >> SYSREG_CRM_SHIFT) & SYSREG_CRM_MASK,
                               (reg >> SYSREG_OP2_SHIFT) & SYSREG_OP2_MASK);
 }
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index a560ef0f42..0ec309f1ea 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2466,7 +2466,7 @@ static void handle_sys(DisasContext *s, bool isread,
                        unsigned int op0, unsigned int op1, unsigned int op2,
                        unsigned int crn, unsigned int crm, unsigned int rt)
 {
-    uint32_t key = ENCODE_AA64_CP_REG(crn, crm, op0, op1, op2);
+    uint32_t key = ENCODE_AA64_CP_REG(op0, op1, crn, crm, op2);
     const ARMCPRegInfo *ri = get_arm_cp_reginfo(s->cp_regs, key);
     bool need_exit_tb = false;
     bool nv_trap_to_el2 = false;
@@ -2602,7 +2602,7 @@ static void handle_sys(DisasContext *s, bool isread,
          * We don't use the EL1 register's access function, and
          * fine-grained-traps on EL1 also do not apply here.
          */
-        key = ENCODE_AA64_CP_REG(crn, crm, op0, 0, op2);
+        key = ENCODE_AA64_CP_REG(op0, 0, crn, crm, op2);
         ri = get_arm_cp_reginfo(s->cp_regs, key);
         assert(ri);
         assert(cp_access_ok(s->current_el, ri, isread));

From 3b230602e2103ae1eafb5f5355b74fd8160b6093 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:21 -0700
Subject: [PATCH 0623/2396] target/arm: Split out add_cpreg_to_hashtable_aa{32,
 64}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The nesting level for the inner loop of define_one_arm_cp_reg
was overly deep.  Split out that code into two functions, for
the AArch32 and AArch64 paths separately.  Simplify the innermost
loop to a switch statement over r->state.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 147 +++++++++++++++++++++++---------------------
 1 file changed, 76 insertions(+), 71 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 965941f04e..39f5297a1a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7557,6 +7557,66 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
 }
 
+static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
+                                        int crm, int opc1, int opc2)
+{
+    /*
+     * Under AArch32 CP registers can be common
+     * (same for secure and non-secure world) or banked.
+     */
+    char *name;
+
+    assert(!(r->type & ARM_CP_ADD_TLBI_NXS)); /* aa64 only */
+
+    switch (r->secure) {
+    case ARM_CP_SECSTATE_S:
+    case ARM_CP_SECSTATE_NS:
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
+                               r->secure, crm, opc1, opc2, r->name);
+        break;
+    case ARM_CP_SECSTATE_BOTH:
+        name = g_strdup_printf("%s_S", r->name);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
+                               ARM_CP_SECSTATE_S, crm, opc1, opc2, name);
+        g_free(name);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
+                               ARM_CP_SECSTATE_NS, crm, opc1, opc2, r->name);
+        break;
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
+                                        int crm, int opc1, int opc2)
+{
+    if ((r->type & ARM_CP_ADD_TLBI_NXS) &&
+        cpu_isar_feature(aa64_xs, cpu)) {
+        /*
+         * This is a TLBI insn which has an NXS variant. The
+         * NXS variant is at the same encoding except that
+         * crn is +1, and has the same behaviour except for
+         * fine-grained trapping. Add the NXS insn here and
+         * then fall through to add the normal register.
+         * add_cpreg_to_hashtable() copies the cpreg struct
+         * and name that it is passed, so it's OK to use
+         * a local struct here.
+         */
+        ARMCPRegInfo nxs_ri = *r;
+        g_autofree char *name = g_strdup_printf("%sNXS", r->name);
+
+        assert(nxs_ri.crn < 0xf);
+        nxs_ri.crn++;
+        if (nxs_ri.fgt) {
+            nxs_ri.fgt |= R_FGT_NXS_MASK;
+        }
+        add_cpreg_to_hashtable(cpu, &nxs_ri, ARM_CP_STATE_AA64,
+                               ARM_CP_SECSTATE_NS, crm, opc1, opc2, name);
+    }
+
+    add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64, ARM_CP_SECSTATE_NS,
+                           crm, opc1, opc2, r->name);
+}
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
 {
@@ -7584,14 +7644,12 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
      * bits; the ARM_CP_64BIT* flag applies only to the AArch32 view of
      * the register, if any.
      */
-    int crm, opc1, opc2;
     int crmmin = (r->crm == CP_ANY) ? 0 : r->crm;
     int crmmax = (r->crm == CP_ANY) ? 15 : r->crm;
     int opc1min = (r->opc1 == CP_ANY) ? 0 : r->opc1;
     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
-    CPState state;
 
     /* 64 bit registers have only CRm and Opc1 fields */
     assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
@@ -7688,75 +7746,22 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
         }
     }
 
-    for (crm = crmmin; crm <= crmmax; crm++) {
-        for (opc1 = opc1min; opc1 <= opc1max; opc1++) {
-            for (opc2 = opc2min; opc2 <= opc2max; opc2++) {
-                for (state = ARM_CP_STATE_AA32;
-                     state <= ARM_CP_STATE_AA64; state++) {
-                    if (r->state != state && r->state != ARM_CP_STATE_BOTH) {
-                        continue;
-                    }
-                    if ((r->type & ARM_CP_ADD_TLBI_NXS) &&
-                        cpu_isar_feature(aa64_xs, cpu)) {
-                        /*
-                         * This is a TLBI insn which has an NXS variant. The
-                         * NXS variant is at the same encoding except that
-                         * crn is +1, and has the same behaviour except for
-                         * fine-grained trapping. Add the NXS insn here and
-                         * then fall through to add the normal register.
-                         * add_cpreg_to_hashtable() copies the cpreg struct
-                         * and name that it is passed, so it's OK to use
-                         * a local struct here.
-                         */
-                        ARMCPRegInfo nxs_ri = *r;
-                        g_autofree char *name = g_strdup_printf("%sNXS", r->name);
-
-                        assert(state == ARM_CP_STATE_AA64);
-                        assert(nxs_ri.crn < 0xf);
-                        nxs_ri.crn++;
-                        if (nxs_ri.fgt) {
-                            nxs_ri.fgt |= R_FGT_NXS_MASK;
-                        }
-                        add_cpreg_to_hashtable(cpu, &nxs_ri, state,
-                                               ARM_CP_SECSTATE_NS,
-                                               crm, opc1, opc2, name);
-                    }
-                    if (state == ARM_CP_STATE_AA32) {
-                        /*
-                         * Under AArch32 CP registers can be common
-                         * (same for secure and non-secure world) or banked.
-                         */
-                        char *name;
-
-                        switch (r->secure) {
-                        case ARM_CP_SECSTATE_S:
-                        case ARM_CP_SECSTATE_NS:
-                            add_cpreg_to_hashtable(cpu, r, state,
-                                                   r->secure, crm, opc1, opc2,
-                                                   r->name);
-                            break;
-                        case ARM_CP_SECSTATE_BOTH:
-                            name = g_strdup_printf("%s_S", r->name);
-                            add_cpreg_to_hashtable(cpu, r, state,
-                                                   ARM_CP_SECSTATE_S,
-                                                   crm, opc1, opc2, name);
-                            g_free(name);
-                            add_cpreg_to_hashtable(cpu, r, state,
-                                                   ARM_CP_SECSTATE_NS,
-                                                   crm, opc1, opc2, r->name);
-                            break;
-                        default:
-                            g_assert_not_reached();
-                        }
-                    } else {
-                        /*
-                         * AArch64 registers get mapped to non-secure instance
-                         * of AArch32
-                         */
-                        add_cpreg_to_hashtable(cpu, r, state,
-                                               ARM_CP_SECSTATE_NS,
-                                               crm, opc1, opc2, r->name);
-                    }
+    for (int crm = crmmin; crm <= crmmax; crm++) {
+        for (int opc1 = opc1min; opc1 <= opc1max; opc1++) {
+            for (int opc2 = opc2min; opc2 <= opc2max; opc2++) {
+                switch (r->state) {
+                case ARM_CP_STATE_AA32:
+                    add_cpreg_to_hashtable_aa32(cpu, r, crm, opc1, opc2);
+                    break;
+                case ARM_CP_STATE_AA64:
+                    add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
+                    break;
+                case ARM_CP_STATE_BOTH:
+                    add_cpreg_to_hashtable_aa32(cpu, r, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
+                    break;
+                default:
+                    g_assert_not_reached();
                 }
             }
         }

From ca332905256af29c23132167dd8d2a88510a8761 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:22 -0700
Subject: [PATCH 0624/2396] target/arm: Improve asserts in
 define_one_arm_cp_reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reject ARM_CP_64BIT with ARM_CP_STATE_BOTH, because encoding
constrains prevent it from working.  Remove some extra parens;
distribute ! across && to simplify.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 39f5297a1a..8c2b7e037e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7651,12 +7651,17 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
 
-    /* 64 bit registers have only CRm and Opc1 fields */
-    assert(!((r->type & ARM_CP_64BIT) && (r->opc2 || r->crn)));
+    /*
+     * AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless.
+     * Moreover, the encoding test just following in general prevents
+     * shared encoding so ARM_CP_STATE_BOTH won't work either.
+     */
+    assert(r->state == ARM_CP_STATE_AA32 || !(r->type & ARM_CP_64BIT));
+    /* AArch32 64-bit registers have only CRm and Opc1 fields. */
+    assert(!(r->type & ARM_CP_64BIT) || !(r->opc2 || r->crn));
     /* op0 only exists in the AArch64 encodings */
-    assert((r->state != ARM_CP_STATE_AA32) || (r->opc0 == 0));
-    /* AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless */
-    assert((r->state != ARM_CP_STATE_AA64) || !(r->type & ARM_CP_64BIT));
+    assert(r->state != ARM_CP_STATE_AA32 || r->opc0 == 0);
+
     /*
      * This API is only for Arm's system coprocessors (14 and 15) or
      * (M-profile or v7A-and-earlier only) for implementation defined

From 5a3af95cb990662ad0431f918135ae905e2d0cf3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:23 -0700
Subject: [PATCH 0625/2396] target/arm: Move cp processing to
 define_one_arm_cp_reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Processing of cp was split between add_cpreg_to_hashtable and
define_one_arm_cp_reg.  Unify it all to the top-level function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 53 +++++++++++++++++++--------------------------
 1 file changed, 22 insertions(+), 31 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8c2b7e037e..f0e423e623 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7368,7 +7368,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
  */
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                    CPState state, CPSecureState secstate,
-                                   int crm, int opc1, int opc2,
+                                   int cp, int crm, int opc1, int opc2,
                                    const char *name)
 {
     CPUARMState *env = &cpu->env;
@@ -7376,28 +7376,14 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     ARMCPRegInfo *r2;
     bool is64 = r->type & ARM_CP_64BIT;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
-    int cp = r->cp;
     size_t name_len;
     bool make_const;
 
     switch (state) {
     case ARM_CP_STATE_AA32:
-        /* We assume it is a cp15 register if the .cp field is left unset. */
-        if (cp == 0 && r->state == ARM_CP_STATE_BOTH) {
-            cp = 15;
-        }
         key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
         break;
     case ARM_CP_STATE_AA64:
-        /*
-         * To allow abbreviation of ARMCPRegInfo definitions, we treat
-         * cp == 0 as equivalent to the value for "standard guest-visible
-         * sysreg".  STATE_BOTH definitions are also always "standard sysreg"
-         * in their AArch64 view (the .cp value may be non-zero for the
-         * benefit of the AArch32 view).
-         */
-        assert(cp == 0 || r->state == ARM_CP_STATE_BOTH);
-        cp = 0;
         key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
         break;
     default:
@@ -7558,7 +7544,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
 }
 
 static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
-                                        int crm, int opc1, int opc2)
+                                        int cp, int crm, int opc1, int opc2)
 {
     /*
      * Under AArch32 CP registers can be common
@@ -7571,16 +7557,16 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
     switch (r->secure) {
     case ARM_CP_SECSTATE_S:
     case ARM_CP_SECSTATE_NS:
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
-                               r->secure, crm, opc1, opc2, r->name);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, r->secure,
+                               cp, crm, opc1, opc2, r->name);
         break;
     case ARM_CP_SECSTATE_BOTH:
         name = g_strdup_printf("%s_S", r->name);
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
-                               ARM_CP_SECSTATE_S, crm, opc1, opc2, name);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
+                               cp, crm, opc1, opc2, name);
         g_free(name);
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
-                               ARM_CP_SECSTATE_NS, crm, opc1, opc2, r->name);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_NS,
+                               cp, crm, opc1, opc2, r->name);
         break;
     default:
         g_assert_not_reached();
@@ -7611,11 +7597,11 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
             nxs_ri.fgt |= R_FGT_NXS_MASK;
         }
         add_cpreg_to_hashtable(cpu, &nxs_ri, ARM_CP_STATE_AA64,
-                               ARM_CP_SECSTATE_NS, crm, opc1, opc2, name);
+                               ARM_CP_SECSTATE_NS, 0, crm, opc1, opc2, name);
     }
 
     add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64, ARM_CP_SECSTATE_NS,
-                           crm, opc1, opc2, r->name);
+                           0, crm, opc1, opc2, r->name);
 }
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
@@ -7650,6 +7636,7 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
     int opc1max = (r->opc1 == CP_ANY) ? 7 : r->opc1;
     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
+    int cp = r->cp;
 
     /*
      * AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless.
@@ -7672,21 +7659,25 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
      */
     switch (r->state) {
     case ARM_CP_STATE_BOTH:
-        /* 0 has a special meaning, but otherwise the same rules as AA32. */
-        if (r->cp == 0) {
+        /*
+         * If the cp field is left unset, assume cp15.
+         * Otherwise apply the same rules as AA32.
+         */
+        if (cp == 0) {
+            cp = 15;
             break;
         }
         /* fall through */
     case ARM_CP_STATE_AA32:
         if (arm_feature(&cpu->env, ARM_FEATURE_V8) &&
             !arm_feature(&cpu->env, ARM_FEATURE_M)) {
-            assert(r->cp >= 14 && r->cp <= 15);
+            assert(cp >= 14 && cp <= 15);
         } else {
-            assert(r->cp < 8 || (r->cp >= 14 && r->cp <= 15));
+            assert(cp < 8 || (cp >= 14 && cp <= 15));
         }
         break;
     case ARM_CP_STATE_AA64:
-        assert(r->cp == 0);
+        assert(cp == 0);
         break;
     default:
         g_assert_not_reached();
@@ -7756,13 +7747,13 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
             for (int opc2 = opc2min; opc2 <= opc2max; opc2++) {
                 switch (r->state) {
                 case ARM_CP_STATE_AA32:
-                    add_cpreg_to_hashtable_aa32(cpu, r, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa32(cpu, r, cp, crm, opc1, opc2);
                     break;
                 case ARM_CP_STATE_AA64:
                     add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
                     break;
                 case ARM_CP_STATE_BOTH:
-                    add_cpreg_to_hashtable_aa32(cpu, r, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa32(cpu, r, cp, crm, opc1, opc2);
                     add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
                     break;
                 default:

From 89f942f29dfa0da08928c8097da2433257a14813 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:24 -0700
Subject: [PATCH 0626/2396] target/arm: Move cpreg elimination to
 define_one_arm_cp_reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Eliminate unused registers earlier, so that by the time we
arrive in add_cpreg_to_hashtable we never skip.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 123 +++++++++++++++++++++++---------------------
 1 file changed, 64 insertions(+), 59 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index f0e423e623..ade16138e7 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7377,7 +7377,6 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     bool is64 = r->type & ARM_CP_64BIT;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
     size_t name_len;
-    bool make_const;
 
     switch (state) {
     case ARM_CP_STATE_AA32:
@@ -7398,32 +7397,6 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
     }
 
-    /*
-     * Eliminate registers that are not present because the EL is missing.
-     * Doing this here makes it easier to put all registers for a given
-     * feature into the same ARMCPRegInfo array and define them all at once.
-     */
-    make_const = false;
-    if (arm_feature(env, ARM_FEATURE_EL3)) {
-        /*
-         * An EL2 register without EL2 but with EL3 is (usually) RES0.
-         * See rule RJFFP in section D1.1.3 of DDI0487H.a.
-         */
-        int min_el = ctz32(r->access) / 2;
-        if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
-            if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
-                return;
-            }
-            make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP);
-        }
-    } else {
-        CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
-                                 ? PL2_RW : PL1_RW);
-        if ((r->access & max_el) == 0) {
-            return;
-        }
-    }
-
     /* Combine cpreg and name into one allocation. */
     name_len = strlen(name) + 1;
     r2 = g_malloc(sizeof(*r2) + name_len);
@@ -7441,38 +7414,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     r2->state = state;
     r2->secure = secstate;
 
-    if (make_const) {
-        /* This should not have been a very special register to begin. */
-        int old_special = r2->type & ARM_CP_SPECIAL_MASK;
-        assert(old_special == 0 || old_special == ARM_CP_NOP);
-        /*
-         * Set the special function to CONST, retaining the other flags.
-         * This is important for e.g. ARM_CP_SVE so that we still
-         * take the SVE trap if CPTR_EL3.EZ == 0.
-         */
-        r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST;
-        /*
-         * Usually, these registers become RES0, but there are a few
-         * special cases like VPIDR_EL2 which have a constant non-zero
-         * value with writes ignored.
-         */
-        if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) {
-            r2->resetvalue = 0;
-        }
-        /*
-         * ARM_CP_CONST has precedence, so removing the callbacks and
-         * offsets are not strictly necessary, but it is potentially
-         * less confusing to debug later.
-         */
-        r2->readfn = NULL;
-        r2->writefn = NULL;
-        r2->raw_readfn = NULL;
-        r2->raw_writefn = NULL;
-        r2->resetfn = NULL;
-        r2->fieldoffset = 0;
-        r2->bank_fieldoffsets[0] = 0;
-        r2->bank_fieldoffsets[1] = 0;
-    } else {
+    {
         bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
 
         if (isbanked) {
@@ -7637,6 +7579,8 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
     int opc2min = (r->opc2 == CP_ANY) ? 0 : r->opc2;
     int opc2max = (r->opc2 == CP_ANY) ? 7 : r->opc2;
     int cp = r->cp;
+    ARMCPRegInfo r_const;
+    CPUARMState *env = &cpu->env;
 
     /*
      * AArch64 regs are all 64 bit so ARM_CP_64BIT is meaningless.
@@ -7742,6 +7686,67 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
         }
     }
 
+    /*
+     * Eliminate registers that are not present because the EL is missing.
+     * Doing this here makes it easier to put all registers for a given
+     * feature into the same ARMCPRegInfo array and define them all at once.
+     */
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        /*
+         * An EL2 register without EL2 but with EL3 is (usually) RES0.
+         * See rule RJFFP in section D1.1.3 of DDI0487H.a.
+         */
+        int min_el = ctz32(r->access) / 2;
+        if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
+            if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
+                return;
+            }
+            if (!(r->type & ARM_CP_EL3_NO_EL2_KEEP)) {
+                /* This should not have been a very special register. */
+                int old_special = r->type & ARM_CP_SPECIAL_MASK;
+                assert(old_special == 0 || old_special == ARM_CP_NOP);
+
+                r_const = *r;
+
+                /*
+                 * Set the special function to CONST, retaining the other flags.
+                 * This is important for e.g. ARM_CP_SVE so that we still
+                 * take the SVE trap if CPTR_EL3.EZ == 0.
+                 */
+                r_const.type = (r->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST;
+                /*
+                 * Usually, these registers become RES0, but there are a few
+                 * special cases like VPIDR_EL2 which have a constant non-zero
+                 * value with writes ignored.
+                 */
+                if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) {
+                    r_const.resetvalue = 0;
+                }
+                /*
+                 * ARM_CP_CONST has precedence, so removing the callbacks and
+                 * offsets are not strictly necessary, but it is potentially
+                 * less confusing to debug later.
+                 */
+                r_const.readfn = NULL;
+                r_const.writefn = NULL;
+                r_const.raw_readfn = NULL;
+                r_const.raw_writefn = NULL;
+                r_const.resetfn = NULL;
+                r_const.fieldoffset = 0;
+                r_const.bank_fieldoffsets[0] = 0;
+                r_const.bank_fieldoffsets[1] = 0;
+
+                r = &r_const;
+            }
+        }
+    } else {
+        CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
+                                 ? PL2_RW : PL1_RW);
+        if ((r->access & max_el) == 0) {
+            return;
+        }
+    }
+
     for (int crm = crmmin; crm <= crmmax; crm++) {
         for (int opc1 = opc1min; opc1 <= opc1max; opc1++) {
             for (int opc2 = opc2min; opc2 <= opc2max; opc2++) {

From 2696aa34ec592eb06578f49ad70e70b878483070 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:25 -0700
Subject: [PATCH 0627/2396] target/arm: Add key parameter to
 add_cpreg_to_hashtable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hoist the computation of key into the caller, where
state is a known constant.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMM: added comment about CRN key field increment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 40 ++++++++++++++++++++--------------------
 1 file changed, 20 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index ade16138e7..8a8fa8c40e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7369,26 +7369,13 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                    CPState state, CPSecureState secstate,
                                    int cp, int crm, int opc1, int opc2,
-                                   const char *name)
+                                   const char *name, uint32_t key)
 {
     CPUARMState *env = &cpu->env;
-    uint32_t key;
     ARMCPRegInfo *r2;
-    bool is64 = r->type & ARM_CP_64BIT;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
     size_t name_len;
 
-    switch (state) {
-    case ARM_CP_STATE_AA32:
-        key = ENCODE_CP_REG(cp, is64, ns, r->crn, crm, opc1, opc2);
-        break;
-    case ARM_CP_STATE_AA64:
-        key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
     /* Overriding of an existing definition must be explicitly requested. */
     if (!(r->type & ARM_CP_OVERRIDE)) {
         const ARMCPRegInfo *oldreg = get_arm_cp_reginfo(cpu->cp_regs, key);
@@ -7493,22 +7480,28 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
      * (same for secure and non-secure world) or banked.
      */
     char *name;
+    bool is64 = r->type & ARM_CP_64BIT;
+    uint32_t key = ENCODE_CP_REG(cp, is64, 0, r->crn, crm, opc1, opc2);
 
     assert(!(r->type & ARM_CP_ADD_TLBI_NXS)); /* aa64 only */
 
     switch (r->secure) {
-    case ARM_CP_SECSTATE_S:
     case ARM_CP_SECSTATE_NS:
+        key |= CP_REG_AA32_NS_MASK;
+        /* fall through */
+    case ARM_CP_SECSTATE_S:
         add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, r->secure,
-                               cp, crm, opc1, opc2, r->name);
+                               cp, crm, opc1, opc2, r->name, key);
         break;
     case ARM_CP_SECSTATE_BOTH:
         name = g_strdup_printf("%s_S", r->name);
         add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
-                               cp, crm, opc1, opc2, name);
+                               cp, crm, opc1, opc2, name, key);
         g_free(name);
+
+        key |= CP_REG_AA32_NS_MASK;
         add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_NS,
-                               cp, crm, opc1, opc2, r->name);
+                               cp, crm, opc1, opc2, r->name, key);
         break;
     default:
         g_assert_not_reached();
@@ -7518,6 +7511,8 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
 static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
                                         int crm, int opc1, int opc2)
 {
+    uint32_t key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
+
     if ((r->type & ARM_CP_ADD_TLBI_NXS) &&
         cpu_isar_feature(aa64_xs, cpu)) {
         /*
@@ -7532,18 +7527,23 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
          */
         ARMCPRegInfo nxs_ri = *r;
         g_autofree char *name = g_strdup_printf("%sNXS", r->name);
+        uint32_t nxs_key;
 
         assert(nxs_ri.crn < 0xf);
         nxs_ri.crn++;
+        /* Also increment the CRN field inside the key value */
+        nxs_key = key + (1 << CP_REG_ARM64_SYSREG_CRN_SHIFT);
         if (nxs_ri.fgt) {
             nxs_ri.fgt |= R_FGT_NXS_MASK;
         }
+
         add_cpreg_to_hashtable(cpu, &nxs_ri, ARM_CP_STATE_AA64,
-                               ARM_CP_SECSTATE_NS, 0, crm, opc1, opc2, name);
+                               ARM_CP_SECSTATE_NS, 0, crm, opc1, opc2,
+                               name, nxs_key);
     }
 
     add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64, ARM_CP_SECSTATE_NS,
-                           0, crm, opc1, opc2, r->name);
+                           0, crm, opc1, opc2, r->name, key);
 }
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)

From 9044ba55426437de89e05ef9c192a0a1b529b968 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:26 -0700
Subject: [PATCH 0628/2396] target/arm: Split out alloc_cpreg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Include provision for a name suffix.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 29 +++++++++++++++++++++++------
 1 file changed, 23 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8a8fa8c40e..e36598e273 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7362,6 +7362,28 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 #endif
 }
 
+/*
+ * Copy a ARMCPRegInfo structure, allocating it along with the name
+ * and an optional suffix to the name.
+ */
+static ARMCPRegInfo *alloc_cpreg(const ARMCPRegInfo *in,
+                                 const char *name, const char *suffix)
+{
+    size_t name_len = strlen(name);
+    size_t suff_len = suffix ? strlen(suffix) : 0;
+    ARMCPRegInfo *out = g_malloc(sizeof(*in) + name_len + suff_len + 1);
+    char *p = (char *)(out + 1);
+
+    *out = *in;
+    out->name = p;
+
+    memcpy(p, name, name_len + 1);
+    if (suffix) {
+        memcpy(p + name_len, suffix, suff_len + 1);
+    }
+    return out;
+}
+
 /*
  * Private utility function for define_one_arm_cp_reg():
  * add a single reginfo struct to the hash table.
@@ -7374,7 +7396,6 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
     CPUARMState *env = &cpu->env;
     ARMCPRegInfo *r2;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
-    size_t name_len;
 
     /* Overriding of an existing definition must be explicitly requested. */
     if (!(r->type & ARM_CP_OVERRIDE)) {
@@ -7384,11 +7405,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
     }
 
-    /* Combine cpreg and name into one allocation. */
-    name_len = strlen(name) + 1;
-    r2 = g_malloc(sizeof(*r2) + name_len);
-    *r2 = *r;
-    r2->name = memcpy(r2 + 1, name, name_len);
+    r2 = alloc_cpreg(r, name, NULL);
 
     /*
      * Update fields to match the instantiation, overwiting wildcards

From 349127a9be7f19becd6b01b7d9ccc50624d48d01 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:27 -0700
Subject: [PATCH 0629/2396] target/arm: Hoist the allocation of ARMCPRegInfo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass in a newly allocated structure, rather than having to
dance around allocation of the name and the structure.

Since we no longer have two copies of the structure handy
within add_cpreg_to_hashtable, delay the writeback of concrete
values over wildcards until we're done querying the wildcards.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 97 ++++++++++++++++++++++-----------------------
 1 file changed, 48 insertions(+), 49 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index e36598e273..88b5ec1a5a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7388,13 +7388,12 @@ static ARMCPRegInfo *alloc_cpreg(const ARMCPRegInfo *in,
  * Private utility function for define_one_arm_cp_reg():
  * add a single reginfo struct to the hash table.
  */
-static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
+static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
                                    CPState state, CPSecureState secstate,
                                    int cp, int crm, int opc1, int opc2,
-                                   const char *name, uint32_t key)
+                                   uint32_t key)
 {
     CPUARMState *env = &cpu->env;
-    ARMCPRegInfo *r2;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
 
     /* Overriding of an existing definition must be explicitly requested. */
@@ -7405,19 +7404,6 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
     }
 
-    r2 = alloc_cpreg(r, name, NULL);
-
-    /*
-     * Update fields to match the instantiation, overwiting wildcards
-     * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
-     */
-    r2->cp = cp;
-    r2->crm = crm;
-    r2->opc1 = opc1;
-    r2->opc2 = opc2;
-    r2->state = state;
-    r2->secure = secstate;
-
     {
         bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
 
@@ -7427,7 +7413,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
              * Overwriting fieldoffset as the array is only used to define
              * banked registers but later only fieldoffset is used.
              */
-            r2->fieldoffset = r->bank_fieldoffsets[ns];
+            r->fieldoffset = r->bank_fieldoffsets[ns];
         }
         if (state == ARM_CP_STATE_AA32) {
             if (isbanked) {
@@ -7444,19 +7430,19 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                  */
                 if ((r->state == ARM_CP_STATE_BOTH && ns) ||
                     (arm_feature(env, ARM_FEATURE_V8) && !ns)) {
-                    r2->type |= ARM_CP_ALIAS;
+                    r->type |= ARM_CP_ALIAS;
                 }
             } else if ((secstate != r->secure) && !ns) {
                 /*
                  * The register is not banked so we only want to allow
                  * migration of the non-secure instance.
                  */
-                r2->type |= ARM_CP_ALIAS;
+                r->type |= ARM_CP_ALIAS;
             }
 
             if (HOST_BIG_ENDIAN &&
-                r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
-                r2->fieldoffset += sizeof(uint32_t);
+                r->state == ARM_CP_STATE_BOTH && r->fieldoffset) {
+                r->fieldoffset += sizeof(uint32_t);
             }
         }
     }
@@ -7468,35 +7454,46 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      * multiple times. Special registers (ie NOP/WFI) are
      * never migratable and not even raw-accessible.
      */
-    if (r2->type & ARM_CP_SPECIAL_MASK) {
-        r2->type |= ARM_CP_NO_RAW;
+    if (r->type & ARM_CP_SPECIAL_MASK) {
+        r->type |= ARM_CP_NO_RAW;
     }
     if (((r->crm == CP_ANY) && crm != 0) ||
         ((r->opc1 == CP_ANY) && opc1 != 0) ||
         ((r->opc2 == CP_ANY) && opc2 != 0)) {
-        r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
+        r->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
     }
 
+    /*
+     * Update fields to match the instantiation, overwiting wildcards
+     * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
+     */
+    r->cp = cp;
+    r->crm = crm;
+    r->opc1 = opc1;
+    r->opc2 = opc2;
+    r->state = state;
+    r->secure = secstate;
+
     /*
      * Check that raw accesses are either forbidden or handled. Note that
      * we can't assert this earlier because the setup of fieldoffset for
      * banked registers has to be done first.
      */
-    if (!(r2->type & ARM_CP_NO_RAW)) {
-        assert(!raw_accessors_invalid(r2));
+    if (!(r->type & ARM_CP_NO_RAW)) {
+        assert(!raw_accessors_invalid(r));
     }
 
-    g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r2);
+    g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r);
 }
 
-static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
+static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r,
                                         int cp, int crm, int opc1, int opc2)
 {
     /*
      * Under AArch32 CP registers can be common
      * (same for secure and non-secure world) or banked.
      */
-    char *name;
+    ARMCPRegInfo *r_s;
     bool is64 = r->type & ARM_CP_64BIT;
     uint32_t key = ENCODE_CP_REG(cp, is64, 0, r->crn, crm, opc1, opc2);
 
@@ -7508,24 +7505,23 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, const ARMCPRegInfo *r,
         /* fall through */
     case ARM_CP_SECSTATE_S:
         add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, r->secure,
-                               cp, crm, opc1, opc2, r->name, key);
+                               cp, crm, opc1, opc2, key);
         break;
     case ARM_CP_SECSTATE_BOTH:
-        name = g_strdup_printf("%s_S", r->name);
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
-                               cp, crm, opc1, opc2, name, key);
-        g_free(name);
+        r_s = alloc_cpreg(r, r->name, "_S");
+        add_cpreg_to_hashtable(cpu, r_s, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
+                               cp, crm, opc1, opc2, key);
 
         key |= CP_REG_AA32_NS_MASK;
         add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_NS,
-                               cp, crm, opc1, opc2, r->name, key);
+                               cp, crm, opc1, opc2, key);
         break;
     default:
         g_assert_not_reached();
     }
 }
 
-static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
+static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r,
                                         int crm, int opc1, int opc2)
 {
     uint32_t key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
@@ -7542,25 +7538,24 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, const ARMCPRegInfo *r,
          * and name that it is passed, so it's OK to use
          * a local struct here.
          */
-        ARMCPRegInfo nxs_ri = *r;
-        g_autofree char *name = g_strdup_printf("%sNXS", r->name);
+        ARMCPRegInfo *nxs_ri = alloc_cpreg(r, r->name, "NXS");
         uint32_t nxs_key;
 
-        assert(nxs_ri.crn < 0xf);
-        nxs_ri.crn++;
+        assert(nxs_ri->crn < 0xf);
+        nxs_ri->crn++;
         /* Also increment the CRN field inside the key value */
         nxs_key = key + (1 << CP_REG_ARM64_SYSREG_CRN_SHIFT);
-        if (nxs_ri.fgt) {
-            nxs_ri.fgt |= R_FGT_NXS_MASK;
+        if (nxs_ri->fgt) {
+            nxs_ri->fgt |= R_FGT_NXS_MASK;
         }
 
-        add_cpreg_to_hashtable(cpu, &nxs_ri, ARM_CP_STATE_AA64,
+        add_cpreg_to_hashtable(cpu, nxs_ri, ARM_CP_STATE_AA64,
                                ARM_CP_SECSTATE_NS, 0, crm, opc1, opc2,
-                               name, nxs_key);
+                               nxs_key);
     }
 
     add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64, ARM_CP_SECSTATE_NS,
-                           0, crm, opc1, opc2, r->name, key);
+                           0, crm, opc1, opc2, key);
 }
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
@@ -7767,16 +7762,20 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
     for (int crm = crmmin; crm <= crmmax; crm++) {
         for (int opc1 = opc1min; opc1 <= opc1max; opc1++) {
             for (int opc2 = opc2min; opc2 <= opc2max; opc2++) {
+                ARMCPRegInfo *r2 = alloc_cpreg(r, r->name, NULL);
+                ARMCPRegInfo *r3;
+
                 switch (r->state) {
                 case ARM_CP_STATE_AA32:
-                    add_cpreg_to_hashtable_aa32(cpu, r, cp, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);
                     break;
                 case ARM_CP_STATE_AA64:
-                    add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa64(cpu, r2, crm, opc1, opc2);
                     break;
                 case ARM_CP_STATE_BOTH:
-                    add_cpreg_to_hashtable_aa32(cpu, r, cp, crm, opc1, opc2);
-                    add_cpreg_to_hashtable_aa64(cpu, r, crm, opc1, opc2);
+                    r3 = alloc_cpreg(r2, r2->name, NULL);
+                    add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa64(cpu, r3, crm, opc1, opc2);
                     break;
                 default:
                     g_assert_not_reached();

From dde8637d283e71c6e9bef776e60df099013237e7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:28 -0700
Subject: [PATCH 0630/2396] target/arm: Remove name argument to alloc_cpreg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers now pass in->name, so take the value from there.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 88b5ec1a5a..a199320f14 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7366,9 +7366,9 @@ void register_cp_regs_for_features(ARMCPU *cpu)
  * Copy a ARMCPRegInfo structure, allocating it along with the name
  * and an optional suffix to the name.
  */
-static ARMCPRegInfo *alloc_cpreg(const ARMCPRegInfo *in,
-                                 const char *name, const char *suffix)
+static ARMCPRegInfo *alloc_cpreg(const ARMCPRegInfo *in, const char *suffix)
 {
+    const char *name = in->name;
     size_t name_len = strlen(name);
     size_t suff_len = suffix ? strlen(suffix) : 0;
     ARMCPRegInfo *out = g_malloc(sizeof(*in) + name_len + suff_len + 1);
@@ -7508,7 +7508,7 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r,
                                cp, crm, opc1, opc2, key);
         break;
     case ARM_CP_SECSTATE_BOTH:
-        r_s = alloc_cpreg(r, r->name, "_S");
+        r_s = alloc_cpreg(r, "_S");
         add_cpreg_to_hashtable(cpu, r_s, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
                                cp, crm, opc1, opc2, key);
 
@@ -7538,7 +7538,7 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r,
          * and name that it is passed, so it's OK to use
          * a local struct here.
          */
-        ARMCPRegInfo *nxs_ri = alloc_cpreg(r, r->name, "NXS");
+        ARMCPRegInfo *nxs_ri = alloc_cpreg(r, "NXS");
         uint32_t nxs_key;
 
         assert(nxs_ri->crn < 0xf);
@@ -7762,7 +7762,7 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
     for (int crm = crmmin; crm <= crmmax; crm++) {
         for (int opc1 = opc1min; opc1 <= opc1max; opc1++) {
             for (int opc2 = opc2min; opc2 <= opc2max; opc2++) {
-                ARMCPRegInfo *r2 = alloc_cpreg(r, r->name, NULL);
+                ARMCPRegInfo *r2 = alloc_cpreg(r, NULL);
                 ARMCPRegInfo *r3;
 
                 switch (r->state) {
@@ -7773,7 +7773,7 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
                     add_cpreg_to_hashtable_aa64(cpu, r2, crm, opc1, opc2);
                     break;
                 case ARM_CP_STATE_BOTH:
-                    r3 = alloc_cpreg(r2, r2->name, NULL);
+                    r3 = alloc_cpreg(r2, NULL);
                     add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);
                     add_cpreg_to_hashtable_aa64(cpu, r3, crm, opc1, opc2);
                     break;

From afe6ed3cfb4f19bf93632ad0c763610cef07637e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:29 -0700
Subject: [PATCH 0631/2396] target/arm: Move alias setting for wildcards
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move this test from add_cpreg_to_hashtable to
define_one_arm_cp_reg_with_opaque, where we can also
simplify it based on the loop variables.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMM: adjusted placement of comma in a comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index a199320f14..274b7b5808 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7448,20 +7448,12 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
     }
 
     /*
-     * By convention, for wildcarded registers only the first
-     * entry is used for migration; the others are marked as
-     * ALIAS so we don't try to transfer the register
-     * multiple times. Special registers (ie NOP/WFI) are
-     * never migratable and not even raw-accessible.
+     * Special registers (ie NOP/WFI) are never migratable and
+     * are not even raw-accessible.
      */
     if (r->type & ARM_CP_SPECIAL_MASK) {
         r->type |= ARM_CP_NO_RAW;
     }
-    if (((r->crm == CP_ANY) && crm != 0) ||
-        ((r->opc1 == CP_ANY) && opc1 != 0) ||
-        ((r->opc2 == CP_ANY) && opc2 != 0)) {
-        r->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
-    }
 
     /*
      * Update fields to match the instantiation, overwiting wildcards
@@ -7765,6 +7757,16 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
                 ARMCPRegInfo *r2 = alloc_cpreg(r, NULL);
                 ARMCPRegInfo *r3;
 
+                /*
+                 * By convention, for wildcarded registers only the first
+                 * entry is used for migration; the others are marked as
+                 * ALIAS so we don't try to transfer the register
+                 * multiple times.
+                 */
+                if (crm != crmmin || opc1 != opc1min || opc2 != opc2min) {
+                    r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
+                }
+
                 switch (r->state) {
                 case ARM_CP_STATE_AA32:
                     add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);

From 415e21ac85d5209768f77cda2eef24d3da3deaa9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:30 -0700
Subject: [PATCH 0632/2396] target/arm: Move writeback of CP_ANY fields
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the writeback of cp, crm, opc1, opc2 to define_one_arm_cp_reg,
which means we don't have to pass all those parameters down
to subroutines.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 52 ++++++++++++++++++++++-----------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 274b7b5808..4063c8a0b6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7390,7 +7390,6 @@ static ARMCPRegInfo *alloc_cpreg(const ARMCPRegInfo *in, const char *suffix)
  */
 static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
                                    CPState state, CPSecureState secstate,
-                                   int cp, int crm, int opc1, int opc2,
                                    uint32_t key)
 {
     CPUARMState *env = &cpu->env;
@@ -7457,12 +7456,8 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
 
     /*
      * Update fields to match the instantiation, overwiting wildcards
-     * such as CP_ANY, ARM_CP_STATE_BOTH, or ARM_CP_SECSTATE_BOTH.
+     * such as ARM_CP_STATE_BOTH or ARM_CP_SECSTATE_BOTH.
      */
-    r->cp = cp;
-    r->crm = crm;
-    r->opc1 = opc1;
-    r->opc2 = opc2;
     r->state = state;
     r->secure = secstate;
 
@@ -7478,8 +7473,7 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
     g_hash_table_insert(cpu->cp_regs, (gpointer)(uintptr_t)key, r);
 }
 
-static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r,
-                                        int cp, int crm, int opc1, int opc2)
+static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r)
 {
     /*
      * Under AArch32 CP registers can be common
@@ -7487,7 +7481,8 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r,
      */
     ARMCPRegInfo *r_s;
     bool is64 = r->type & ARM_CP_64BIT;
-    uint32_t key = ENCODE_CP_REG(cp, is64, 0, r->crn, crm, opc1, opc2);
+    uint32_t key = ENCODE_CP_REG(r->cp, is64, 0, r->crn,
+                                 r->crm, r->opc1, r->opc2);
 
     assert(!(r->type & ARM_CP_ADD_TLBI_NXS)); /* aa64 only */
 
@@ -7496,27 +7491,26 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r,
         key |= CP_REG_AA32_NS_MASK;
         /* fall through */
     case ARM_CP_SECSTATE_S:
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, r->secure,
-                               cp, crm, opc1, opc2, key);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, r->secure, key);
         break;
     case ARM_CP_SECSTATE_BOTH:
         r_s = alloc_cpreg(r, "_S");
-        add_cpreg_to_hashtable(cpu, r_s, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_S,
-                               cp, crm, opc1, opc2, key);
+        add_cpreg_to_hashtable(cpu, r_s, ARM_CP_STATE_AA32,
+                               ARM_CP_SECSTATE_S, key);
 
         key |= CP_REG_AA32_NS_MASK;
-        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32, ARM_CP_SECSTATE_NS,
-                               cp, crm, opc1, opc2, key);
+        add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA32,
+                               ARM_CP_SECSTATE_NS, key);
         break;
     default:
         g_assert_not_reached();
     }
 }
 
-static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r,
-                                        int crm, int opc1, int opc2)
+static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r)
 {
-    uint32_t key = ENCODE_AA64_CP_REG(r->opc0, opc1, r->crn, crm, opc2);
+    uint32_t key = ENCODE_AA64_CP_REG(r->opc0, r->opc1,
+                                      r->crn, r->crm, r->opc2);
 
     if ((r->type & ARM_CP_ADD_TLBI_NXS) &&
         cpu_isar_feature(aa64_xs, cpu)) {
@@ -7542,12 +7536,11 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r,
         }
 
         add_cpreg_to_hashtable(cpu, nxs_ri, ARM_CP_STATE_AA64,
-                               ARM_CP_SECSTATE_NS, 0, crm, opc1, opc2,
-                               nxs_key);
+                               ARM_CP_SECSTATE_NS, nxs_key);
     }
 
-    add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64, ARM_CP_SECSTATE_NS,
-                           0, crm, opc1, opc2, key);
+    add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64,
+                           ARM_CP_SECSTATE_NS, key);
 }
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
@@ -7767,17 +7760,24 @@ void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *r)
                     r2->type |= ARM_CP_ALIAS | ARM_CP_NO_GDB;
                 }
 
+                /* Overwrite CP_ANY with the instantiation. */
+                r2->crm = crm;
+                r2->opc1 = opc1;
+                r2->opc2 = opc2;
+
                 switch (r->state) {
                 case ARM_CP_STATE_AA32:
-                    add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa32(cpu, r2);
                     break;
                 case ARM_CP_STATE_AA64:
-                    add_cpreg_to_hashtable_aa64(cpu, r2, crm, opc1, opc2);
+                    add_cpreg_to_hashtable_aa64(cpu, r2);
                     break;
                 case ARM_CP_STATE_BOTH:
                     r3 = alloc_cpreg(r2, NULL);
-                    add_cpreg_to_hashtable_aa32(cpu, r2, cp, crm, opc1, opc2);
-                    add_cpreg_to_hashtable_aa64(cpu, r3, crm, opc1, opc2);
+                    r2->cp = cp;
+                    add_cpreg_to_hashtable_aa32(cpu, r2);
+                    r3->cp = 0;
+                    add_cpreg_to_hashtable_aa64(cpu, r3);
                     break;
                 default:
                     g_assert_not_reached();

From 5bd746e212b0fac12cfe7332a0bb95e4b7276f53 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:31 -0700
Subject: [PATCH 0633/2396] target/arm: Move endianness fixup for 32-bit
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the test outside of the banked register block,
and repeat the AA32 test.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 4063c8a0b6..18066b0c5d 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -7438,14 +7438,21 @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, ARMCPRegInfo *r,
                  */
                 r->type |= ARM_CP_ALIAS;
             }
-
-            if (HOST_BIG_ENDIAN &&
-                r->state == ARM_CP_STATE_BOTH && r->fieldoffset) {
-                r->fieldoffset += sizeof(uint32_t);
-            }
         }
     }
 
+    /*
+     * For 32-bit AArch32 regs shared with 64-bit AArch64 regs,
+     * adjust the field offset for endianness.  This had to be
+     * delayed until banked registers were resolved.
+     */
+    if (HOST_BIG_ENDIAN &&
+        state == ARM_CP_STATE_AA32 &&
+        r->state == ARM_CP_STATE_BOTH &&
+        r->fieldoffset) {
+        r->fieldoffset += sizeof(uint32_t);
+    }
+
     /*
      * Special registers (ie NOP/WFI) are never migratable and
      * are not even raw-accessible.

From 10bca9650c46633f484099dd3ab8167a9820084f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:32 -0700
Subject: [PATCH 0634/2396] target/arm: Rename TBFLAG_A64_NV2_MEM_E20 with
 *_E2H
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Install e2h in tbflags and compute nv2_mem_e20 from
that in aarch64_tr_init_disas_context.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               | 3 +--
 target/arm/tcg/hflags.c        | 8 +++++---
 target/arm/tcg/translate-a64.c | 3 ++-
 target/arm/tcg/translate.h     | 2 ++
 4 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 1c0deb723d..d5534e3580 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -3065,8 +3065,7 @@ FIELD(TBFLAG_A64, ATA0, 31, 1)
 FIELD(TBFLAG_A64, NV, 32, 1)
 FIELD(TBFLAG_A64, NV1, 33, 1)
 FIELD(TBFLAG_A64, NV2, 34, 1)
-/* Set if FEAT_NV2 RAM accesses use the EL2&0 translation regime */
-FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
+FIELD(TBFLAG_A64, E2H, 35, 1)
 /* Set if FEAT_NV2 RAM accesses are big-endian */
 FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
 FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 01894226cc..17f83f13a4 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -258,6 +258,11 @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
     DP_TBFLAG_A64(flags, TBII, tbii);
     DP_TBFLAG_A64(flags, TBID, tbid);
 
+    /* E2H is used by both VHE and NV2. */
+    if (hcr & HCR_E2H) {
+        DP_TBFLAG_A64(flags, E2H, 1);
+    }
+
     if (cpu_isar_feature(aa64_sve, env_archcpu(env))) {
         int sve_el = sve_exception_el(env, el);
 
@@ -390,9 +395,6 @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
         if (hcr & HCR_NV2) {
             DP_TBFLAG_A64(flags, NV2, 1);
-            if (hcr & HCR_E2H) {
-                DP_TBFLAG_A64(flags, NV2_MEM_E20, 1);
-            }
             if (env->cp15.sctlr_el[2] & SCTLR_EE) {
                 DP_TBFLAG_A64(flags, NV2_MEM_BE, 1);
             }
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 0ec309f1ea..599e7a36ee 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10304,10 +10304,11 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->pstate_za = EX_TBFLAG_A64(tb_flags, PSTATE_ZA);
     dc->sme_trap_nonstreaming = EX_TBFLAG_A64(tb_flags, SME_TRAP_NONSTREAMING);
     dc->naa = EX_TBFLAG_A64(tb_flags, NAA);
+    dc->e2h = EX_TBFLAG_A64(tb_flags, E2H);
     dc->nv = EX_TBFLAG_A64(tb_flags, NV);
     dc->nv1 = EX_TBFLAG_A64(tb_flags, NV1);
     dc->nv2 = EX_TBFLAG_A64(tb_flags, NV2);
-    dc->nv2_mem_e20 = EX_TBFLAG_A64(tb_flags, NV2_MEM_E20);
+    dc->nv2_mem_e20 = dc->nv2 && dc->e2h;
     dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
     dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
     dc->fpcr_nep = EX_TBFLAG_A64(tb_flags, NEP);
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index ec4755ae3f..f1a6e5e2b6 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -150,6 +150,8 @@ typedef struct DisasContext {
     bool trap_eret;
     /* True if FEAT_LSE2 SCTLR_ELx.nAA is set */
     bool naa;
+    /* True if HCR_EL2.E2H is set */
+    bool e2h;
     /* True if FEAT_NV HCR_EL2.NV is enabled */
     bool nv;
     /* True if NV enabled and HCR_EL2.NV1 is set */

From e87878d4963714e9ff4b9e0ae71567dbef0af09c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:33 -0700
Subject: [PATCH 0635/2396] target/arm: Split out redirect_cpreg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 599e7a36ee..c0fa2137b6 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2455,6 +2455,19 @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     gen_exception_insn(s, 0, EXCP_UDEF, syndrome);
 }
 
+/*
+ * Look up @key, returning the cpreg, which must exist.
+ * Additionally, the new cpreg must also be accessible.
+ */
+static const ARMCPRegInfo *
+redirect_cpreg(DisasContext *s, uint32_t key, bool isread)
+{
+    const ARMCPRegInfo *ri = get_arm_cp_reginfo(s->cp_regs, key);
+    assert(ri);
+    assert(cp_access_ok(s->current_el, ri, isread));
+    return ri;
+}
+
 /* MRS - move from system register
  * MSR (register) - move to system register
  * SYS
@@ -2603,9 +2616,7 @@ static void handle_sys(DisasContext *s, bool isread,
          * fine-grained-traps on EL1 also do not apply here.
          */
         key = ENCODE_AA64_CP_REG(op0, 0, crn, crm, op2);
-        ri = get_arm_cp_reginfo(s->cp_regs, key);
-        assert(ri);
-        assert(cp_access_ok(s->current_el, ri, isread));
+        ri = redirect_cpreg(s, key, isread);
         /*
          * We might not have done an update_pc earlier, so check we don't
          * need it. We could support this in future if necessary.

From 34577fc2f9c8048e96f66b3425df62d0662e9a1e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:34 -0700
Subject: [PATCH 0636/2396] target/arm: Redirect VHE FOO_EL1 -> FOO_EL2 during
 translation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h            |  6 ++++
 target/arm/gdbstub.c           |  5 ++++
 target/arm/helper.c            | 53 +---------------------------------
 target/arm/tcg/translate-a64.c |  9 ++++++
 4 files changed, 21 insertions(+), 52 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 08fc42ea57..eac0cb9ebf 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -936,6 +936,12 @@ struct ARMCPRegInfo {
      */
     uint32_t nv2_redirect_offset;
 
+    /*
+     * With VHE, with E2H, at EL2, access to this EL0/EL1 reg redirects
+     * to the EL2 reg with the specified key.
+     */
+    uint32_t vhe_redir_to_el2;
+
     /* This is used only by VHE. */
     void *opaque;
     /*
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 4e2ac49b6a..87d40d4366 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -249,6 +249,11 @@ static int arm_gdb_get_sysreg(CPUState *cs, GByteArray *buf, int reg)
     if (ri) {
         switch (cpreg_field_type(ri)) {
         case MO_64:
+            if (ri->vhe_redir_to_el2 &&
+                (arm_hcr_el2_eff(env) & HCR_E2H) &&
+                arm_current_el(env) == 2) {
+                ri = get_arm_cp_reginfo(cpu->cp_regs, ri->vhe_redir_to_el2);
+            }
             return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
         case MO_32:
             return gdb_get_reg32(buf, (uint32_t)read_raw_cp_reg(env, ri));
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 18066b0c5d..87a32e363e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4417,47 +4417,6 @@ static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
     return e2h_access(env, ri, isread);
 }
 
-/* Test if system register redirection is to occur in the current state.  */
-static bool redirect_for_e2h(CPUARMState *env)
-{
-    return arm_current_el(env) == 2 && (arm_hcr_el2_eff(env) & HCR_E2H);
-}
-
-static uint64_t el2_e2h_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    CPReadFn *readfn;
-
-    if (redirect_for_e2h(env)) {
-        /* Switch to the saved EL2 version of the register.  */
-        ri = ri->opaque;
-        readfn = ri->readfn;
-    } else {
-        readfn = ri->orig_readfn;
-    }
-    if (readfn == NULL) {
-        readfn = raw_read;
-    }
-    return readfn(env, ri);
-}
-
-static void el2_e2h_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                          uint64_t value)
-{
-    CPWriteFn *writefn;
-
-    if (redirect_for_e2h(env)) {
-        /* Switch to the saved EL2 version of the register.  */
-        ri = ri->opaque;
-        writefn = ri->writefn;
-    } else {
-        writefn = ri->orig_writefn;
-    }
-    if (writefn == NULL) {
-        writefn = raw_write;
-    }
-    writefn(env, ri, value);
-}
-
 static uint64_t el2_e2h_e12_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     /* Pass the EL1 register accessor its ri, not the EL12 alias ri */
@@ -4632,17 +4591,7 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
                                  (gpointer)(uintptr_t)a->new_key, new_reg);
         g_assert(ok);
 
-        src_reg->opaque = dst_reg;
-        src_reg->orig_readfn = src_reg->readfn ?: raw_read;
-        src_reg->orig_writefn = src_reg->writefn ?: raw_write;
-        if (!src_reg->raw_readfn) {
-            src_reg->raw_readfn = raw_read;
-        }
-        if (!src_reg->raw_writefn) {
-            src_reg->raw_writefn = raw_write;
-        }
-        src_reg->readfn = el2_e2h_read;
-        src_reg->writefn = el2_e2h_write;
+        src_reg->vhe_redir_to_el2 = a->dst_key;
     }
 }
 #endif
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index c0fa2137b6..3ef24fb0c3 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2573,6 +2573,15 @@ static void handle_sys(DisasContext *s, bool isread,
         }
     }
 
+    if (ri->vhe_redir_to_el2 && s->current_el == 2 && s->e2h) {
+        /*
+         * This one of the FOO_EL1 registers which redirect to FOO_EL2
+         * from EL2 when HCR_EL2.E2H is set.
+         */
+        key = ri->vhe_redir_to_el2;
+        ri = redirect_cpreg(s, key, isread);
+    }
+
     if (ri->accessfn || (ri->fgt && s->fgt_active)) {
         /* Emit code to perform further access permissions checks at
          * runtime; this may result in an exception.

From 5850e03554331dea7dde57c3f73de9b9fc482033 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:35 -0700
Subject: [PATCH 0637/2396] target/arm: Redirect VHE FOO_EL12 to FOO_EL1 during
 translation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMM: expanded a comment slightly]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h            | 22 ++++---------
 target/arm/gdbstub.c           |  2 ++
 target/arm/helper.c            | 57 +++-------------------------------
 target/arm/tcg/translate-a64.c | 12 +++++++
 4 files changed, 25 insertions(+), 68 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index eac0cb9ebf..8ab5892acc 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -942,8 +942,12 @@ struct ARMCPRegInfo {
      */
     uint32_t vhe_redir_to_el2;
 
-    /* This is used only by VHE. */
-    void *opaque;
+    /*
+     * With VHE, with E2H, at EL2+, access to this EL02/EL12 reg
+     * redirects to the EL0/EL1 reg with the specified key.
+     */
+    uint32_t vhe_redir_to_el01;
+
     /*
      * Value of this register, if it is ARM_CP_CONST. Otherwise, if
      * fieldoffset is non-zero, the reset value of the register.
@@ -1011,20 +1015,6 @@ struct ARMCPRegInfo {
      * fieldoffset is 0 then no reset will be done.
      */
     CPResetFn *resetfn;
-
-    /*
-     * "Original" readfn, writefn, accessfn.
-     * For ARMv8.1-VHE register aliases, we overwrite the read/write
-     * accessor functions of various EL1/EL0 to perform the runtime
-     * check for which sysreg should actually be modified, and then
-     * forwards the operation.  Before overwriting the accessors,
-     * the original function is copied here, so that accesses that
-     * really do go to the EL1/EL0 version proceed normally.
-     * (The corresponding EL2 register is linked via opaque.)
-     */
-    CPReadFn *orig_readfn;
-    CPWriteFn *orig_writefn;
-    CPAccessFn *orig_accessfn;
 };
 
 void define_one_arm_cp_reg(ARMCPU *cpu, const ARMCPRegInfo *regs);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 87d40d4366..8d2229f519 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -253,6 +253,8 @@ static int arm_gdb_get_sysreg(CPUState *cs, GByteArray *buf, int reg)
                 (arm_hcr_el2_eff(env) & HCR_E2H) &&
                 arm_current_el(env) == 2) {
                 ri = get_arm_cp_reginfo(cpu->cp_regs, ri->vhe_redir_to_el2);
+            } else if (ri->vhe_redir_to_el01) {
+                ri = get_arm_cp_reginfo(cpu->cp_regs, ri->vhe_redir_to_el01);
             }
             return gdb_get_reg64(buf, (uint64_t)read_raw_cp_reg(env, ri));
         case MO_32:
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 87a32e363e..3840ca62a6 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4417,42 +4417,6 @@ static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
     return e2h_access(env, ri, isread);
 }
 
-static uint64_t el2_e2h_e12_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    /* Pass the EL1 register accessor its ri, not the EL12 alias ri */
-    return ri->orig_readfn(env, ri->opaque);
-}
-
-static void el2_e2h_e12_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                              uint64_t value)
-{
-    /* Pass the EL1 register accessor its ri, not the EL12 alias ri */
-    return ri->orig_writefn(env, ri->opaque, value);
-}
-
-static CPAccessResult el2_e2h_e12_access(CPUARMState *env,
-                                         const ARMCPRegInfo *ri,
-                                         bool isread)
-{
-    if (arm_current_el(env) == 1) {
-        /*
-         * This must be a FEAT_NV access (will either trap or redirect
-         * to memory). None of the registers with _EL12 aliases want to
-         * apply their trap controls for this kind of access, so don't
-         * call the orig_accessfn or do the "UNDEF when E2H is 0" check.
-         */
-        return CP_ACCESS_OK;
-    }
-    /* FOO_EL12 aliases only exist when E2H is 1; otherwise they UNDEF */
-    if (!(arm_hcr_el2_eff(env) & HCR_E2H)) {
-        return CP_ACCESS_UNDEFINED;
-    }
-    if (ri->orig_accessfn) {
-        return ri->orig_accessfn(env, ri->opaque, isread);
-    }
-    return CP_ACCESS_OK;
-}
-
 static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
 {
     struct E2HAlias {
@@ -4541,9 +4505,6 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
         g_assert(strcmp(src_reg->name, a->src_name) == 0);
         g_assert(strcmp(dst_reg->name, a->dst_name) == 0);
 
-        /* None of the core system registers use opaque; we will.  */
-        g_assert(src_reg->opaque == NULL);
-
         /* Create alias before redirection so we dup the right data. */
         new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
 
@@ -4562,19 +4523,11 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
             >> CP_REG_ARM64_SYSREG_OP1_SHIFT;
         new_reg->opc2 = (a->new_key & CP_REG_ARM64_SYSREG_OP2_MASK)
             >> CP_REG_ARM64_SYSREG_OP2_SHIFT;
-        new_reg->opaque = src_reg;
-        new_reg->orig_readfn = src_reg->readfn ?: raw_read;
-        new_reg->orig_writefn = src_reg->writefn ?: raw_write;
-        new_reg->orig_accessfn = src_reg->accessfn;
-        if (!new_reg->raw_readfn) {
-            new_reg->raw_readfn = raw_read;
-        }
-        if (!new_reg->raw_writefn) {
-            new_reg->raw_writefn = raw_write;
-        }
-        new_reg->readfn = el2_e2h_e12_read;
-        new_reg->writefn = el2_e2h_e12_write;
-        new_reg->accessfn = el2_e2h_e12_access;
+        new_reg->vhe_redir_to_el01 = a->src_key;
+        new_reg->readfn = NULL;
+        new_reg->writefn = NULL;
+        new_reg->accessfn = NULL;
+        new_reg->fieldoffset = 0;
 
         /*
          * If the _EL1 register is redirected to memory by FEAT_NV2,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 3ef24fb0c3..a0e3300231 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2580,6 +2580,18 @@ static void handle_sys(DisasContext *s, bool isread,
          */
         key = ri->vhe_redir_to_el2;
         ri = redirect_cpreg(s, key, isread);
+    } else if (ri->vhe_redir_to_el01 && s->current_el >= 2) {
+        /*
+         * This is one of the FOO_EL12 or FOO_EL02 registers.
+         * With !E2H, they all UNDEF.
+         * With E2H, from EL2 or EL3, they redirect to FOO_EL1/FOO_EL0.
+         */
+        if (!s->e2h) {
+            gen_sysreg_undef(s, isread, op0, op1, op2, crn, crm, rt);
+            return;
+        }
+        key = ri->vhe_redir_to_el01;
+        ri = redirect_cpreg(s, key, isread);
     }
 
     if (ri->accessfn || (ri->fgt && s->fgt_active)) {

From 2afdc4ce6098fc4316299d8af37f89ce75b65f1d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:36 -0700
Subject: [PATCH 0638/2396] target/arm: Rename some cpreg to their aarch64
 names
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename those registers which will have FOO_EL12 aliases.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3840ca62a6..12835977bd 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -671,7 +671,7 @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
      */
     { .name = "WFAR", .cp = 15, .crn = 6, .crm = 0, .opc1 = 0, .opc2 = 1,
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0, },
-    { .name = "CPACR", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
+    { .name = "CPACR_EL1", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
       .fgt = FGT_CPACR_EL1,
       .nv2_redirect_offset = 0x100 | NV2_REDIR_NV1,
@@ -2018,7 +2018,7 @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
       .resetfn = arm_gt_cntfrq_reset,
     },
     /* overall control: mostly access permissions */
-    { .name = "CNTKCTL", .state = ARM_CP_STATE_BOTH,
+    { .name = "CNTKCTL_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
       .access = PL1_RW,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
@@ -3048,8 +3048,8 @@ static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 }
 
 static const ARMCPRegInfo lpae_cp_reginfo[] = {
-    /* NOP AMAIR0/1 */
-    { .name = "AMAIR0", .state = ARM_CP_STATE_BOTH,
+    /* AMAIR0 is mapped to AMAIR_EL1[31:0] */
+    { .name = "AMAIR_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_AMAIR_EL1,
@@ -4430,11 +4430,11 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
 
     static const struct E2HAlias aliases[] = {
         { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
-          "SCTLR", "SCTLR_EL2", "SCTLR_EL12" },
+          "SCTLR_EL1", "SCTLR_EL2", "SCTLR_EL12" },
         { K(3, 0,  1, 0, 3), K(3, 4,  1, 0, 3), K(3, 5, 1, 0, 3),
           "SCTLR2_EL1", "SCTLR2_EL2", "SCTLR2_EL12", isar_feature_aa64_sctlr2 },
         { K(3, 0,  1, 0, 2), K(3, 4,  1, 1, 2), K(3, 5, 1, 0, 2),
-          "CPACR", "CPTR_EL2", "CPACR_EL12" },
+          "CPACR_EL1", "CPTR_EL2", "CPACR_EL12" },
         { K(3, 0,  2, 0, 0), K(3, 4,  2, 0, 0), K(3, 5, 2, 0, 0),
           "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" },
         { K(3, 0,  2, 0, 1), K(3, 4,  2, 0, 1), K(3, 5, 2, 0, 1),
@@ -4458,13 +4458,13 @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
         { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0),
           "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" },
         { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0),
-          "AMAIR0", "AMAIR_EL2", "AMAIR_EL12" },
+          "AMAIR_EL1", "AMAIR_EL2", "AMAIR_EL12" },
         { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0),
-          "VBAR", "VBAR_EL2", "VBAR_EL12" },
+          "VBAR_EL1", "VBAR_EL2", "VBAR_EL12" },
         { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1),
           "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" },
         { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0),
-          "CNTKCTL", "CNTHCTL_EL2", "CNTKCTL_EL12" },
+          "CNTKCTL_EL1", "CNTHCTL_EL2", "CNTKCTL_EL12" },
 
         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
@@ -7098,7 +7098,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
 
     if (arm_feature(env, ARM_FEATURE_VBAR)) {
         static const ARMCPRegInfo vbar_cp_reginfo[] = {
-            { .name = "VBAR", .state = ARM_CP_STATE_BOTH,
+            { .name = "VBAR_EL1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .crn = 12, .crm = 0, .opc1 = 0, .opc2 = 0,
               .access = PL1_RW, .writefn = vbar_write,
               .accessfn = access_nv1,
@@ -7114,7 +7114,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     /* Generic registers whose values depend on the implementation */
     {
         ARMCPRegInfo sctlr = {
-            .name = "SCTLR", .state = ARM_CP_STATE_BOTH,
+            .name = "SCTLR_EL1", .state = ARM_CP_STATE_BOTH,
             .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
             .access = PL1_RW, .accessfn = access_tvm_trvm,
             .fgt = FGT_SCTLR_EL1,

From d3a2ee5fe2540c8193561ce8bc1f979c2cf0877f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 16 Sep 2025 07:22:37 -0700
Subject: [PATCH 0639/2396] target/arm: Remove
 define_arm_vh_e2h_redirects_aliases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Populate vhe_redir_to_{el2,el01} on each ARMCPRegInfo.
Clear the fields within add_cpreg_to_hashtable_aa32.
Create the FOO_EL12 cpreg within add_cpreg_to_hashtable_aa64;
add ARM_CP_NO_RAW.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h |   6 +-
 target/arm/helper.c | 243 +++++++++++++++++++-------------------------
 2 files changed, 107 insertions(+), 142 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 8ab5892acc..57fde5f57a 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -943,8 +943,10 @@ struct ARMCPRegInfo {
     uint32_t vhe_redir_to_el2;
 
     /*
-     * With VHE, with E2H, at EL2+, access to this EL02/EL12 reg
-     * redirects to the EL0/EL1 reg with the specified key.
+     * For VHE.  Before registration, this field holds the key for an
+     * EL02/EL12 reg to be created to point back to this EL0/EL1 reg.
+     * After registration, this field is set only on the EL02/EL12 reg
+     * and points back to the EL02/EL12 reg for redirection with E2H.
      */
     uint32_t vhe_redir_to_el01;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 12835977bd..c5a8ef5049 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -454,6 +454,8 @@ static const ARMCPRegInfo cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_CONTEXTIDR_EL1,
       .nv2_redirect_offset = 0x108 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 13, 0, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 13, 0, 1),
       .secure = ARM_CP_SECSTATE_NS,
       .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[1]),
       .resetvalue = 0, .writefn = contextidr_write, .raw_writefn = raw_write, },
@@ -674,6 +676,8 @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
     { .name = "CPACR_EL1", .state = ARM_CP_STATE_BOTH, .opc0 = 3,
       .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 2, .accessfn = cpacr_access,
       .fgt = FGT_CPACR_EL1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 1, 2),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 0, 2),
       .nv2_redirect_offset = 0x100 | NV2_REDIR_NV1,
       .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.cpacr_el1),
       .resetfn = cpacr_reset, .writefn = cpacr_write, .readfn = cpacr_read },
@@ -956,12 +960,16 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_AFSR0_EL1,
       .nv2_redirect_offset = 0x128 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 1, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 1, 0),
       .type = ARM_CP_CONST, .resetvalue = 0 },
     { .name = "AFSR1_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 1, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_AFSR1_EL1,
       .nv2_redirect_offset = 0x130 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 1, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 1, 1),
       .type = ARM_CP_CONST, .resetvalue = 0 },
     /*
      * MAIR can just read-as-written because we don't implement caches
@@ -972,6 +980,8 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_MAIR_EL1,
       .nv2_redirect_offset = 0x140 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 2, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 0),
       .fieldoffset = offsetof(CPUARMState, cp15.mair_el[1]),
       .resetvalue = 0 },
     { .name = "MAIR_EL3", .state = ARM_CP_STATE_AA64,
@@ -2021,6 +2031,8 @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     { .name = "CNTKCTL_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 0, .crn = 14, .crm = 1, .opc2 = 0,
       .access = PL1_RW,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 14, 1, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 14, 1, 0),
       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntkctl),
       .resetvalue = 0,
     },
@@ -2811,6 +2823,8 @@ static const ARMCPRegInfo vmsa_pmsa_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_FAR_EL1,
       .nv2_redirect_offset = 0x220 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 6, 0, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 6, 0, 0),
       .fieldoffset = offsetof(CPUARMState, cp15.far_el[1]),
       .resetvalue = 0, },
 };
@@ -2821,12 +2835,16 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_ESR_EL1,
       .nv2_redirect_offset = 0x138 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 2, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 2, 0),
       .fieldoffset = offsetof(CPUARMState, cp15.esr_el[1]), .resetvalue = 0, },
     { .name = "TTBR0_EL1", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 0, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_TTBR0_EL1,
       .nv2_redirect_offset = 0x200 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 0),
       .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr0_s),
                              offsetof(CPUARMState, cp15.ttbr0_ns) } },
@@ -2835,6 +2853,8 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_TTBR1_EL1,
       .nv2_redirect_offset = 0x210 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 1),
       .writefn = vmsa_ttbr_write, .resetvalue = 0, .raw_writefn = raw_write,
       .bank_fieldoffsets = { offsetof(CPUARMState, cp15.ttbr1_s),
                              offsetof(CPUARMState, cp15.ttbr1_ns) } },
@@ -2843,6 +2863,8 @@ static const ARMCPRegInfo vmsa_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_TCR_EL1,
       .nv2_redirect_offset = 0x120 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 2),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 2),
       .writefn = vmsa_tcr_el12_write,
       .raw_writefn = raw_write,
       .resetvalue = 0,
@@ -3054,6 +3076,8 @@ static const ARMCPRegInfo lpae_cp_reginfo[] = {
       .access = PL1_RW, .accessfn = access_tvm_trvm,
       .fgt = FGT_AMAIR_EL1,
       .nv2_redirect_offset = 0x148 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 3, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 3, 0),
       .type = ARM_CP_CONST, .resetvalue = 0 },
     /* AMAIR1 is mapped to AMAIR_EL1[63:32] */
     { .name = "AMAIR1", .cp = 15, .crn = 10, .crm = 3, .opc1 = 0, .opc2 = 1,
@@ -3569,12 +3593,16 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
       .access = PL1_RW, .accessfn = access_nv1,
       .nv2_redirect_offset = 0x230 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 1),
       .fieldoffset = offsetof(CPUARMState, elr_el[1]) },
     { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_nv1,
       .nv2_redirect_offset = 0x160 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 0),
       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_SVC]) },
     /*
      * We rely on the access checks not allowing the guest to write to the
@@ -4417,136 +4445,6 @@ static CPAccessResult access_el1nvvct(CPUARMState *env, const ARMCPRegInfo *ri,
     return e2h_access(env, ri, isread);
 }
 
-static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
-{
-    struct E2HAlias {
-        uint32_t src_key, dst_key, new_key;
-        const char *src_name, *dst_name, *new_name;
-        bool (*feature)(const ARMISARegisters *id);
-    };
-
-#define K(op0, op1, crn, crm, op2) \
-    ENCODE_AA64_CP_REG(op0, op1, crn, crm, op2)
-
-    static const struct E2HAlias aliases[] = {
-        { K(3, 0,  1, 0, 0), K(3, 4,  1, 0, 0), K(3, 5, 1, 0, 0),
-          "SCTLR_EL1", "SCTLR_EL2", "SCTLR_EL12" },
-        { K(3, 0,  1, 0, 3), K(3, 4,  1, 0, 3), K(3, 5, 1, 0, 3),
-          "SCTLR2_EL1", "SCTLR2_EL2", "SCTLR2_EL12", isar_feature_aa64_sctlr2 },
-        { K(3, 0,  1, 0, 2), K(3, 4,  1, 1, 2), K(3, 5, 1, 0, 2),
-          "CPACR_EL1", "CPTR_EL2", "CPACR_EL12" },
-        { K(3, 0,  2, 0, 0), K(3, 4,  2, 0, 0), K(3, 5, 2, 0, 0),
-          "TTBR0_EL1", "TTBR0_EL2", "TTBR0_EL12" },
-        { K(3, 0,  2, 0, 1), K(3, 4,  2, 0, 1), K(3, 5, 2, 0, 1),
-          "TTBR1_EL1", "TTBR1_EL2", "TTBR1_EL12" },
-        { K(3, 0,  2, 0, 2), K(3, 4,  2, 0, 2), K(3, 5, 2, 0, 2),
-          "TCR_EL1", "TCR_EL2", "TCR_EL12" },
-        { K(3, 0,  2, 0, 3), K(3, 4,  2, 0, 3), K(3, 5, 2, 0, 3),
-          "TCR2_EL1", "TCR2_EL2", "TCR2_EL12", isar_feature_aa64_tcr2 },
-        { K(3, 0,  4, 0, 0), K(3, 4,  4, 0, 0), K(3, 5, 4, 0, 0),
-          "SPSR_EL1", "SPSR_EL2", "SPSR_EL12" },
-        { K(3, 0,  4, 0, 1), K(3, 4,  4, 0, 1), K(3, 5, 4, 0, 1),
-          "ELR_EL1", "ELR_EL2", "ELR_EL12" },
-        { K(3, 0,  5, 1, 0), K(3, 4,  5, 1, 0), K(3, 5, 5, 1, 0),
-          "AFSR0_EL1", "AFSR0_EL2", "AFSR0_EL12" },
-        { K(3, 0,  5, 1, 1), K(3, 4,  5, 1, 1), K(3, 5, 5, 1, 1),
-          "AFSR1_EL1", "AFSR1_EL2", "AFSR1_EL12" },
-        { K(3, 0,  5, 2, 0), K(3, 4,  5, 2, 0), K(3, 5, 5, 2, 0),
-          "ESR_EL1", "ESR_EL2", "ESR_EL12" },
-        { K(3, 0,  6, 0, 0), K(3, 4,  6, 0, 0), K(3, 5, 6, 0, 0),
-          "FAR_EL1", "FAR_EL2", "FAR_EL12" },
-        { K(3, 0, 10, 2, 0), K(3, 4, 10, 2, 0), K(3, 5, 10, 2, 0),
-          "MAIR_EL1", "MAIR_EL2", "MAIR_EL12" },
-        { K(3, 0, 10, 3, 0), K(3, 4, 10, 3, 0), K(3, 5, 10, 3, 0),
-          "AMAIR_EL1", "AMAIR_EL2", "AMAIR_EL12" },
-        { K(3, 0, 12, 0, 0), K(3, 4, 12, 0, 0), K(3, 5, 12, 0, 0),
-          "VBAR_EL1", "VBAR_EL2", "VBAR_EL12" },
-        { K(3, 0, 13, 0, 1), K(3, 4, 13, 0, 1), K(3, 5, 13, 0, 1),
-          "CONTEXTIDR_EL1", "CONTEXTIDR_EL2", "CONTEXTIDR_EL12" },
-        { K(3, 0, 14, 1, 0), K(3, 4, 14, 1, 0), K(3, 5, 14, 1, 0),
-          "CNTKCTL_EL1", "CNTHCTL_EL2", "CNTKCTL_EL12" },
-
-        { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
-          "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
-        { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
-          "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
-
-        { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
-          "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
-
-        { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7),
-          "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12",
-          isar_feature_aa64_scxtnum },
-
-        /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */
-        /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */
-    };
-#undef K
-
-    size_t i;
-
-    for (i = 0; i < ARRAY_SIZE(aliases); i++) {
-        const struct E2HAlias *a = &aliases[i];
-        ARMCPRegInfo *src_reg, *dst_reg, *new_reg;
-        bool ok;
-
-        if (a->feature && !a->feature(&cpu->isar)) {
-            continue;
-        }
-
-        src_reg = g_hash_table_lookup(cpu->cp_regs,
-                                      (gpointer)(uintptr_t)a->src_key);
-        dst_reg = g_hash_table_lookup(cpu->cp_regs,
-                                      (gpointer)(uintptr_t)a->dst_key);
-        g_assert(src_reg != NULL);
-        g_assert(dst_reg != NULL);
-
-        /* Cross-compare names to detect typos in the keys.  */
-        g_assert(strcmp(src_reg->name, a->src_name) == 0);
-        g_assert(strcmp(dst_reg->name, a->dst_name) == 0);
-
-        /* Create alias before redirection so we dup the right data. */
-        new_reg = g_memdup(src_reg, sizeof(ARMCPRegInfo));
-
-        new_reg->name = a->new_name;
-        new_reg->type |= ARM_CP_ALIAS;
-        /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
-        new_reg->access &= PL2_RW | PL3_RW;
-        /* The new_reg op fields are as per new_key, not the target reg */
-        new_reg->crn = (a->new_key & CP_REG_ARM64_SYSREG_CRN_MASK)
-            >> CP_REG_ARM64_SYSREG_CRN_SHIFT;
-        new_reg->crm = (a->new_key & CP_REG_ARM64_SYSREG_CRM_MASK)
-            >> CP_REG_ARM64_SYSREG_CRM_SHIFT;
-        new_reg->opc0 = (a->new_key & CP_REG_ARM64_SYSREG_OP0_MASK)
-            >> CP_REG_ARM64_SYSREG_OP0_SHIFT;
-        new_reg->opc1 = (a->new_key & CP_REG_ARM64_SYSREG_OP1_MASK)
-            >> CP_REG_ARM64_SYSREG_OP1_SHIFT;
-        new_reg->opc2 = (a->new_key & CP_REG_ARM64_SYSREG_OP2_MASK)
-            >> CP_REG_ARM64_SYSREG_OP2_SHIFT;
-        new_reg->vhe_redir_to_el01 = a->src_key;
-        new_reg->readfn = NULL;
-        new_reg->writefn = NULL;
-        new_reg->accessfn = NULL;
-        new_reg->fieldoffset = 0;
-
-        /*
-         * If the _EL1 register is redirected to memory by FEAT_NV2,
-         * then it shares the offset with the _EL12 register,
-         * and which one is redirected depends on HCR_EL2.NV1.
-         */
-        if (new_reg->nv2_redirect_offset) {
-            assert(new_reg->nv2_redirect_offset & NV2_REDIR_NV1);
-            new_reg->nv2_redirect_offset &= ~NV2_REDIR_NV1;
-            new_reg->nv2_redirect_offset |= NV2_REDIR_NO_NV1;
-        }
-
-        ok = g_hash_table_insert(cpu->cp_regs,
-                                 (gpointer)(uintptr_t)a->new_key, new_reg);
-        g_assert(ok);
-
-        src_reg->vhe_redir_to_el2 = a->dst_key;
-    }
-}
 #endif
 
 static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -4839,6 +4737,8 @@ static const ARMCPRegInfo zcr_reginfo[] = {
     { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
       .nv2_redirect_offset = 0x1e0 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 2, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 2, 0),
       .access = PL1_RW, .type = ARM_CP_SVE,
       .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
       .writefn = zcr_write, .raw_writefn = raw_write },
@@ -4984,6 +4884,8 @@ static const ARMCPRegInfo sme_reginfo[] = {
     { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
       .nv2_redirect_offset = 0x1f0 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 2, 6),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 2, 6),
       .access = PL1_RW, .type = ARM_CP_SME,
       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
       .writefn = smcr_write, .raw_writefn = raw_write },
@@ -5429,6 +5331,8 @@ static const ARMCPRegInfo mte_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 6, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tfsr_el1,
       .nv2_redirect_offset = 0x190 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 5, 6, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 5, 6, 0),
       .fieldoffset = offsetof(CPUARMState, cp15.tfsr_el[1]) },
     { .name = "TFSR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_NV2_REDIRECT,
@@ -5604,6 +5508,8 @@ static const ARMCPRegInfo scxtnum_reginfo[] = {
       .access = PL1_RW, .accessfn = access_scxtnum_el1,
       .fgt = FGT_SCXTNUM_EL1,
       .nv2_redirect_offset = 0x188 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 13, 0, 7),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 13, 0, 7),
       .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) },
     { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7,
@@ -5948,6 +5854,8 @@ static const ARMCPRegInfo sctlr2_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .opc2 = 3, .crn = 1, .crm = 0,
       .access = PL1_RW, .accessfn = sctlr2_el1_access,
       .writefn = sctlr2_el1_write, .fgt = FGT_SCTLR_EL1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 0, 3),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 0, 3),
       .nv2_redirect_offset = 0x278 | NV2_REDIR_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.sctlr2_el[1]) },
     { .name = "SCTLR2_EL2", .state = ARM_CP_STATE_AA64,
@@ -6008,6 +5916,8 @@ static const ARMCPRegInfo tcr2_reginfo[] = {
       .opc0 = 3, .opc1 = 0, .opc2 = 3, .crn = 2, .crm = 0,
       .access = PL1_RW, .accessfn = tcr2_el1_access,
       .writefn = tcr2_el1_write, .fgt = FGT_TCR_EL1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 0, 3),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 0, 3),
       .nv2_redirect_offset = 0x270 | NV2_REDIR_NV1,
       .fieldoffset = offsetof(CPUARMState, cp15.tcr2_el[1]) },
     { .name = "TCR2_EL2", .state = ARM_CP_STATE_AA64,
@@ -7104,6 +7014,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .accessfn = access_nv1,
               .fgt = FGT_VBAR_EL1,
               .nv2_redirect_offset = 0x250 | NV2_REDIR_NV1,
+              .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 12, 0, 0),
+              .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 12, 0, 0),
               .bank_fieldoffsets = { offsetof(CPUARMState, cp15.vbar_s),
                                      offsetof(CPUARMState, cp15.vbar_ns) },
               .resetvalue = 0 },
@@ -7118,6 +7030,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
             .access = PL1_RW, .accessfn = access_tvm_trvm,
             .fgt = FGT_SCTLR_EL1,
+            .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 1, 0, 0),
+            .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 1, 0, 0),
             .nv2_redirect_offset = 0x110 | NV2_REDIR_NV1,
             .bank_fieldoffsets = { offsetof(CPUARMState, cp15.sctlr_s),
                                    offsetof(CPUARMState, cp15.sctlr_ns) },
@@ -7252,16 +7166,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     define_pm_cpregs(cpu);
-
-#ifndef CONFIG_USER_ONLY
-    /*
-     * Register redirections and aliases must be done last,
-     * after the registers from the other extensions have been defined.
-     */
-    if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {
-        define_arm_vh_e2h_redirects_aliases(cpu);
-    }
-#endif
 }
 
 /*
@@ -7394,6 +7298,8 @@ static void add_cpreg_to_hashtable_aa32(ARMCPU *cpu, ARMCPRegInfo *r)
                                  r->crm, r->opc1, r->opc2);
 
     assert(!(r->type & ARM_CP_ADD_TLBI_NXS)); /* aa64 only */
+    r->vhe_redir_to_el2 = 0;
+    r->vhe_redir_to_el01 = 0;
 
     switch (r->secure) {
     case ARM_CP_SECSTATE_NS:
@@ -7448,6 +7354,63 @@ static void add_cpreg_to_hashtable_aa64(ARMCPU *cpu, ARMCPRegInfo *r)
                                ARM_CP_SECSTATE_NS, nxs_key);
     }
 
+    if (!r->vhe_redir_to_el01) {
+        assert(!r->vhe_redir_to_el2);
+    } else if (!arm_feature(&cpu->env, ARM_FEATURE_EL2) ||
+               !cpu_isar_feature(aa64_vh, cpu)) {
+        r->vhe_redir_to_el2 = 0;
+        r->vhe_redir_to_el01 = 0;
+    } else {
+        /* Create the FOO_EL12 alias. */
+        ARMCPRegInfo *r2 = alloc_cpreg(r, "2");
+        uint32_t key2 = r->vhe_redir_to_el01;
+
+        /*
+         * Clear EL1 redirection on the FOO_EL1 reg;
+         * Clear EL2 redirection on the FOO_EL12 reg;
+         * Install redirection from FOO_EL12 back to FOO_EL1.
+         */
+        r->vhe_redir_to_el01 = 0;
+        r2->vhe_redir_to_el2 = 0;
+        r2->vhe_redir_to_el01 = key;
+
+        r2->type |= ARM_CP_ALIAS | ARM_CP_NO_RAW;
+        /* Remove PL1/PL0 access, leaving PL2/PL3 R/W in place.  */
+        r2->access &= PL2_RW | PL3_RW;
+        /* The new_reg op fields are as per new_key, not the target reg */
+        r2->crn = (key2 & CP_REG_ARM64_SYSREG_CRN_MASK)
+            >> CP_REG_ARM64_SYSREG_CRN_SHIFT;
+        r2->crm = (key2 & CP_REG_ARM64_SYSREG_CRM_MASK)
+            >> CP_REG_ARM64_SYSREG_CRM_SHIFT;
+        r2->opc0 = (key2 & CP_REG_ARM64_SYSREG_OP0_MASK)
+            >> CP_REG_ARM64_SYSREG_OP0_SHIFT;
+        r2->opc1 = (key2 & CP_REG_ARM64_SYSREG_OP1_MASK)
+            >> CP_REG_ARM64_SYSREG_OP1_SHIFT;
+        r2->opc2 = (key2 & CP_REG_ARM64_SYSREG_OP2_MASK)
+            >> CP_REG_ARM64_SYSREG_OP2_SHIFT;
+
+        /* Non-redirected access to this register will abort. */
+        r2->readfn = NULL;
+        r2->writefn = NULL;
+        r2->raw_readfn = NULL;
+        r2->raw_writefn = NULL;
+        r2->accessfn = NULL;
+        r2->fieldoffset = 0;
+
+        /*
+         * If the _EL1 register is redirected to memory by FEAT_NV2,
+         * then it shares the offset with the _EL12 register,
+         * and which one is redirected depends on HCR_EL2.NV1.
+         */
+        if (r2->nv2_redirect_offset) {
+            assert(r2->nv2_redirect_offset & NV2_REDIR_NV1);
+            r2->nv2_redirect_offset &= ~NV2_REDIR_NV1;
+            r2->nv2_redirect_offset |= NV2_REDIR_NO_NV1;
+        }
+        add_cpreg_to_hashtable(cpu, r2, ARM_CP_STATE_AA64,
+                               ARM_CP_SECSTATE_NS, key2);
+    }
+
     add_cpreg_to_hashtable(cpu, r, ARM_CP_STATE_AA64,
                            ARM_CP_SECSTATE_NS, key);
 }

From ad9c861945f9e82073d86a7542acf6f928b839d8 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 11 Sep 2025 23:09:05 +0200
Subject: [PATCH 0640/2396] tests/functional: add a vfio-user smoke test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a basic test of the vfio-user PCI client implementation.

Co-authored-by: John Levon <john.levon@nutanix.com>
Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250911210905.2070474-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 MAINTAINERS                                   |   1 +
 tests/functional/x86_64/meson.build           |   1 +
 .../x86_64/test_vfio_user_client.py           | 201 ++++++++++++++++++
 3 files changed, 203 insertions(+)
 create mode 100755 tests/functional/x86_64/test_vfio_user_client.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 24b71a4fc5..7d134a85e6 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4318,6 +4318,7 @@ F: docs/system/devices/vfio-user.rst
 F: hw/vfio-user/*
 F: include/hw/vfio-user/*
 F: subprojects/libvfio-user
+F: tests/functional/x86_64/test_vfio_user_client.py
 
 EBPF:
 M: Jason Wang <jasowang@redhat.com>
diff --git a/tests/functional/x86_64/meson.build b/tests/functional/x86_64/meson.build
index 967426c30c..f78eec5e6c 100644
--- a/tests/functional/x86_64/meson.build
+++ b/tests/functional/x86_64/meson.build
@@ -33,6 +33,7 @@ tests_x86_64_system_thorough = [
   'replay',
   'reverse_debug',
   'tuxrun',
+  'vfio_user_client',
   'virtio_balloon',
   'virtio_gpu',
 ]
diff --git a/tests/functional/x86_64/test_vfio_user_client.py b/tests/functional/x86_64/test_vfio_user_client.py
new file mode 100755
index 0000000000..8bc16e5e31
--- /dev/null
+++ b/tests/functional/x86_64/test_vfio_user_client.py
@@ -0,0 +1,201 @@
+#!/usr/bin/env python3
+#
+# Copyright (c) 2025 Nutanix, Inc.
+#
+# Author:
+#  Mark Cave-Ayland <mark.caveayland@nutanix.com>
+#  John Levon <john.levon@nutanix.com>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+"""
+Check basic vfio-user-pci client functionality. The test starts two VMs:
+
+    - the server VM runs the libvfio-user "gpio" example server inside it,
+      piping vfio-user traffic between a local UNIX socket and a virtio-serial
+      port. On the host, the virtio-serial port is backed by a local socket.
+
+    - the client VM loads the gpio-pci-idio-16 kernel module, with the
+      vfio-user client connecting to the above local UNIX socket.
+
+This way, we don't depend on trying to run a vfio-user server on the host
+itself.
+
+Once both VMs are running, we run some basic configuration on the gpio device
+and verify that the server is logging the expected out. As this is consistent
+given the same VM images, we just do a simple direct comparison.
+"""
+
+import os
+
+from qemu_test import Asset
+from qemu_test import QemuSystemTest
+from qemu_test import exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+# Exact output can vary, so we just sample for some expected lines.
+EXPECTED_SERVER_LINES = [
+    "gpio: adding DMA region [0, 0xc0000) offset=0 flags=0x3",
+    "gpio: devinfo flags 0x3, num_regions 9, num_irqs 5",
+    "gpio: region_info[0] offset 0 flags 0 size 0 argsz 32",
+    "gpio: region_info[1] offset 0 flags 0 size 0 argsz 32",
+    "gpio: region_info[2] offset 0 flags 0x3 size 256 argsz 32",
+    "gpio: region_info[3] offset 0 flags 0 size 0 argsz 32",
+    "gpio: region_info[4] offset 0 flags 0 size 0 argsz 32",
+    "gpio: region_info[5] offset 0 flags 0 size 0 argsz 32",
+    "gpio: region_info[7] offset 0 flags 0x3 size 256 argsz 32",
+    "gpio: region7: read 256 bytes at 0",
+    "gpio: region7: read 0 from (0x30:4)",
+    "gpio: cleared EROM",
+    "gpio: I/O space enabled",
+    "gpio: memory space enabled",
+    "gpio: SERR# enabled",
+    "gpio: region7: wrote 0x103 to (0x4:2)",
+    "gpio: I/O space enabled",
+    "gpio: memory space enabled",
+]
+
+class VfioUserClient(QemuSystemTest):
+    """vfio-user testing class."""
+
+    ASSET_REPO = 'https://github.com/mcayland-ntx/libvfio-user-test'
+
+    ASSET_KERNEL = Asset(
+        f'{ASSET_REPO}/raw/refs/heads/main/images/bzImage',
+        '40292fa6ce95d516e26bccf5974e138d0db65a6de0bc540cabae060fe9dea605'
+    )
+
+    ASSET_ROOTFS = Asset(
+        f'{ASSET_REPO}/raw/refs/heads/main/images/rootfs.ext2',
+        'e1e3abae8aebb8e6e77f08b1c531caeacf46250c94c815655c6bbea59fc3d1c1'
+    )
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        self.kernel_path = None
+        self.rootfs_path = None
+
+    def configure_server_vm_args(self, server_vm, sock_path):
+        """
+        Configuration for the server VM. Set up virtio-serial device backed by
+        the given socket path.
+        """
+        server_vm.add_args('-kernel', self.kernel_path)
+        server_vm.add_args('-append', 'console=ttyS0 root=/dev/sda')
+        server_vm.add_args('-drive',
+            f"file={self.rootfs_path},if=ide,format=raw,id=drv0")
+        server_vm.add_args('-snapshot')
+        server_vm.add_args('-chardev',
+            f"socket,id=sock0,path={sock_path},telnet=off,server=on,wait=off")
+        server_vm.add_args('-device', 'virtio-serial')
+        server_vm.add_args('-device',
+            'virtserialport,chardev=sock0,name=org.fedoraproject.port.0')
+
+    def configure_client_vm_args(self, client_vm, sock_path):
+        """
+        Configuration for the client VM. Point the vfio-user-pci device to the
+        socket path configured above.
+        """
+
+        client_vm.add_args('-kernel', self.kernel_path)
+        client_vm.add_args('-append', 'console=ttyS0 root=/dev/sda')
+        client_vm.add_args('-drive',
+            f'file={self.rootfs_path},if=ide,format=raw,id=drv0')
+        client_vm.add_args('-snapshot')
+        client_vm.add_args('-device',
+            '{"driver":"vfio-user-pci",' +
+            '"socket":{"path": "%s", "type": "unix"}}' % sock_path)
+
+    def setup_vfio_user_pci_server(self, server_vm):
+        """
+        Start the libvfio-user server within the server VM, and arrange
+        for data to shuttle between its socket and the virtio serial port.
+        """
+        wait_for_console_pattern(self, 'login:', None, server_vm)
+        exec_command_and_wait_for_pattern(self, 'root', '#', None, server_vm)
+
+        exec_command_and_wait_for_pattern(self,
+            'gpio-pci-idio-16 -v /tmp/vfio-user.sock >/var/tmp/gpio.out 2>&1 &',
+            '#', None, server_vm)
+
+        # wait for libvfio-user socket to appear
+        while True:
+            out = exec_command_and_wait_for_pattern(self,
+                 'ls --color=no /tmp/vfio-user.sock', '#', None, server_vm)
+            ls_out = out.decode().splitlines()[1].strip()
+            if ls_out == "/tmp/vfio-user.sock":
+                break
+
+        exec_command_and_wait_for_pattern(self,
+            'socat UNIX-CONNECT:/tmp/vfio-user.sock /dev/vport0p1,ignoreeof ' +
+            ' &', '#', None, server_vm)
+
+    def test_vfio_user_pci(self):
+        """Run basic sanity test."""
+
+        self.set_machine('pc')
+        self.require_device('virtio-serial')
+        self.require_device('vfio-user-pci')
+
+        self.kernel_path = self.ASSET_KERNEL.fetch()
+        self.rootfs_path = self.ASSET_ROOTFS.fetch()
+
+        sock_dir = self.socket_dir()
+        socket_path = os.path.join(sock_dir.name, 'vfio-user.sock')
+
+        server_vm = self.get_vm(name='server')
+        server_vm.set_console()
+        self.configure_server_vm_args(server_vm, socket_path)
+
+        server_vm.launch()
+
+        self.log.debug('starting libvfio-user server')
+
+        self.setup_vfio_user_pci_server(server_vm)
+
+        client_vm = self.get_vm(name="client")
+        client_vm.set_console()
+        self.configure_client_vm_args(client_vm, socket_path)
+
+        try:
+            client_vm.launch()
+        except:
+            self.log.error('client VM failed to start, dumping server logs')
+            exec_command_and_wait_for_pattern(self, 'cat /var/tmp/gpio.out',
+                '#', None, server_vm)
+            raise
+
+        self.log.debug('waiting for client VM boot')
+
+        wait_for_console_pattern(self, 'login:', None, client_vm)
+        exec_command_and_wait_for_pattern(self, 'root', '#', None, client_vm)
+
+        #
+        # Here, we'd like to actually interact with the gpio device a little
+        # more as described at:
+        #
+        # https://github.com/nutanix/libvfio-user/blob/master/docs/qemu.md
+        #
+        # Unfortunately, the buildroot Linux kernel has some undiagnosed issue
+        # so we don't get /sys/class/gpio. Nonetheless just the basic
+        # initialization and setup is enough for basic testing of vfio-user.
+        #
+
+        self.log.debug('collecting libvfio-user server output')
+
+        out = exec_command_and_wait_for_pattern(self,
+            'cat /var/tmp/gpio.out',
+            'gpio: region2: wrote 0 to (0x1:1)',
+            None, server_vm)
+
+        gpio_server_out = [s for s in out.decode().splitlines()
+                                   if s.startswith("gpio:")]
+
+        for line in EXPECTED_SERVER_LINES:
+            if line not in gpio_server_out:
+                self.log.error(f'Missing server debug line: {line}')
+                self.fail(False)
+
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From da9211f28e280bc9809b116fc186727a01b0f267 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:09 +0100
Subject: [PATCH 0641/2396] include/hw/vfio/vfio-container.h: rename
 VFIOContainer to VFIOLegacyContainer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VFIOContainer struct represents the legacy VFIO container even though the
name suggests it may be the common superclass of all VFIO containers. Rename it
to VFIOLegacyContainer to make this clearer, which is also a better match for
its VFIO_IOMMU_LEGACY QOM type name.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-2-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c          | 10 ++++----
 hw/vfio/container.c              | 42 +++++++++++++++++---------------
 hw/vfio/cpr-legacy.c             | 27 +++++++++++---------
 hw/vfio/spapr.c                  | 18 +++++++-------
 include/hw/vfio/vfio-container.h |  8 +++---
 include/hw/vfio/vfio-cpr.h       |  9 ++++---
 6 files changed, 60 insertions(+), 54 deletions(-)

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index 7e1c71ef59..faa3ab3fe1 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -32,7 +32,7 @@
  * Interfaces for IBM EEH (Enhanced Error Handling)
  */
 #ifdef CONFIG_VFIO_PCI
-static bool vfio_eeh_container_ok(VFIOContainer *container)
+static bool vfio_eeh_container_ok(VFIOLegacyContainer *container)
 {
     /*
      * As of 2016-03-04 (linux-4.5) the host kernel EEH/VFIO
@@ -60,7 +60,7 @@ static bool vfio_eeh_container_ok(VFIOContainer *container)
     return true;
 }
 
-static int vfio_eeh_container_op(VFIOContainer *container, uint32_t op)
+static int vfio_eeh_container_op(VFIOLegacyContainer *container, uint32_t op)
 {
     struct vfio_eeh_pe_op pe_op = {
         .argsz = sizeof(pe_op),
@@ -83,7 +83,7 @@ static int vfio_eeh_container_op(VFIOContainer *container, uint32_t op)
     return ret;
 }
 
-static VFIOContainer *vfio_eeh_as_container(AddressSpace *as)
+static VFIOLegacyContainer *vfio_eeh_as_container(AddressSpace *as)
 {
     VFIOAddressSpace *space = vfio_address_space_get(as);
     VFIOContainerBase *bcontainer = NULL;
@@ -111,14 +111,14 @@ out:
 
 static bool vfio_eeh_as_ok(AddressSpace *as)
 {
-    VFIOContainer *container = vfio_eeh_as_container(as);
+    VFIOLegacyContainer *container = vfio_eeh_as_container(as);
 
     return (container != NULL) && vfio_eeh_container_ok(container);
 }
 
 static int vfio_eeh_as_op(AddressSpace *as, uint32_t op)
 {
-    VFIOContainer *container = vfio_eeh_as_container(as);
+    VFIOLegacyContainer *container = vfio_eeh_as_container(as);
 
     if (!container) {
         return -ENODEV;
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 030c6d3f89..bdf415b3d6 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -44,7 +44,8 @@ typedef QLIST_HEAD(VFIOGroupList, VFIOGroup) VFIOGroupList;
 static VFIOGroupList vfio_group_list =
     QLIST_HEAD_INITIALIZER(vfio_group_list);
 
-static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
+static int vfio_ram_block_discard_disable(VFIOLegacyContainer *container,
+                                          bool state)
 {
     switch (container->iommu_type) {
     case VFIO_TYPE1v2_IOMMU:
@@ -67,7 +68,7 @@ static int vfio_ram_block_discard_disable(VFIOContainer *container, bool state)
     }
 }
 
-static int vfio_dma_unmap_bitmap(const VFIOContainer *container,
+static int vfio_dma_unmap_bitmap(const VFIOLegacyContainer *container,
                                  hwaddr iova, ram_addr_t size,
                                  IOMMUTLBEntry *iotlb)
 {
@@ -124,7 +125,7 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
                                      hwaddr iova, ram_addr_t size,
                                      IOMMUTLBEntry *iotlb)
 {
-    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dma_unmap unmap = {
         .argsz = sizeof(unmap),
         .flags = 0,
@@ -212,7 +213,7 @@ static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                ram_addr_t size, void *vaddr, bool readonly,
                                MemoryRegion *mr)
 {
-    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dma_map map = {
         .argsz = sizeof(map),
         .flags = VFIO_DMA_MAP_FLAG_READ,
@@ -244,7 +245,7 @@ static int
 vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
                                     bool start, Error **errp)
 {
-    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     int ret;
     struct vfio_iommu_type1_dirty_bitmap dirty = {
         .argsz = sizeof(dirty),
@@ -269,7 +270,7 @@ vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
 static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
                       VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
 {
-    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     struct vfio_iommu_type1_dirty_bitmap *dbitmap;
     struct vfio_iommu_type1_dirty_bitmap_get *range;
     int ret;
@@ -413,12 +414,12 @@ static bool vfio_set_iommu(int container_fd, int group_fd,
     return true;
 }
 
-static VFIOContainer *vfio_create_container(int fd, VFIOGroup *group,
+static VFIOLegacyContainer *vfio_create_container(int fd, VFIOGroup *group,
                                             Error **errp)
 {
     int iommu_type;
     const char *vioc_name;
-    VFIOContainer *container;
+    VFIOLegacyContainer *container;
 
     iommu_type = vfio_get_iommu_type(fd, errp);
     if (iommu_type < 0) {
@@ -442,7 +443,7 @@ static VFIOContainer *vfio_create_container(int fd, VFIOGroup *group,
     return container;
 }
 
-static int vfio_get_iommu_info(VFIOContainer *container,
+static int vfio_get_iommu_info(VFIOLegacyContainer *container,
                                struct vfio_iommu_type1_info **info)
 {
 
@@ -486,7 +487,7 @@ vfio_get_iommu_info_cap(struct vfio_iommu_type1_info *info, uint16_t id)
     return NULL;
 }
 
-static void vfio_get_iommu_info_migration(VFIOContainer *container,
+static void vfio_get_iommu_info_migration(VFIOLegacyContainer *container,
                                           struct vfio_iommu_type1_info *info)
 {
     struct vfio_info_cap_header *hdr;
@@ -514,7 +515,7 @@ static void vfio_get_iommu_info_migration(VFIOContainer *container,
 
 static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     g_autofree struct vfio_iommu_type1_info *info = NULL;
     int ret;
 
@@ -540,8 +541,8 @@ static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
     return true;
 }
 
-static bool vfio_container_attach_discard_disable(VFIOContainer *container,
-                                            VFIOGroup *group, Error **errp)
+static bool vfio_container_attach_discard_disable(
+    VFIOLegacyContainer *container, VFIOGroup *group, Error **errp)
 {
     int ret;
 
@@ -587,8 +588,8 @@ static bool vfio_container_attach_discard_disable(VFIOContainer *container,
     return !ret;
 }
 
-static bool vfio_container_group_add(VFIOContainer *container, VFIOGroup *group,
-                                     Error **errp)
+static bool vfio_container_group_add(VFIOLegacyContainer *container,
+                                     VFIOGroup *group, Error **errp)
 {
     if (!vfio_container_attach_discard_disable(container, group, errp)) {
         return false;
@@ -604,7 +605,8 @@ static bool vfio_container_group_add(VFIOContainer *container, VFIOGroup *group,
     return true;
 }
 
-static void vfio_container_group_del(VFIOContainer *container, VFIOGroup *group)
+static void vfio_container_group_del(VFIOLegacyContainer *container,
+                                     VFIOGroup *group)
 {
     QLIST_REMOVE(group, container_next);
     group->container = NULL;
@@ -616,7 +618,7 @@ static void vfio_container_group_del(VFIOContainer *container, VFIOGroup *group)
 static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
                                    Error **errp)
 {
-    VFIOContainer *container;
+    VFIOLegacyContainer *container;
     VFIOContainerBase *bcontainer;
     int ret, fd = -1;
     VFIOAddressSpace *space;
@@ -729,7 +731,7 @@ fail:
 
 static void vfio_container_disconnect(VFIOGroup *group)
 {
-    VFIOContainer *container = group->container;
+    VFIOLegacyContainer *container = group->container;
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
@@ -1243,7 +1245,7 @@ hiod_legacy_vfio_get_page_size_mask(HostIOMMUDevice *hiod)
 
 static void vfio_iommu_legacy_instance_init(Object *obj)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(obj);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(obj);
 
     QLIST_INIT(&container->group_list);
 }
@@ -1263,7 +1265,7 @@ static const TypeInfo types[] = {
         .name = TYPE_VFIO_IOMMU_LEGACY,
         .parent = TYPE_VFIO_IOMMU,
         .instance_init = vfio_iommu_legacy_instance_init,
-        .instance_size = sizeof(VFIOContainer),
+        .instance_size = sizeof(VFIOLegacyContainer),
         .class_init = vfio_iommu_legacy_class_init,
     }, {
         .name = TYPE_HOST_IOMMU_DEVICE_LEGACY_VFIO,
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 8f437194fa..12bf920a7d 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -17,7 +17,8 @@
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 
-static bool vfio_dma_unmap_vaddr_all(VFIOContainer *container, Error **errp)
+static bool vfio_dma_unmap_vaddr_all(VFIOLegacyContainer *container,
+                                     Error **errp)
 {
     struct vfio_iommu_type1_dma_unmap unmap = {
         .argsz = sizeof(unmap),
@@ -41,7 +42,7 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
                                    hwaddr iova, ram_addr_t size, void *vaddr,
                                    bool readonly, MemoryRegion *mr)
 {
-    const VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
 
     struct vfio_iommu_type1_dma_map map = {
         .argsz = sizeof(map),
@@ -63,12 +64,13 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
 static void vfio_region_remap(MemoryListener *listener,
                               MemoryRegionSection *section)
 {
-    VFIOContainer *container = container_of(listener, VFIOContainer,
-                                            cpr.remap_listener);
+    VFIOLegacyContainer *container = container_of(listener,
+                                                  VFIOLegacyContainer,
+                                                  cpr.remap_listener);
     vfio_container_region_add(VFIO_IOMMU(container), section, true);
 }
 
-static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
+static bool vfio_cpr_supported(VFIOLegacyContainer *container, Error **errp)
 {
     if (!ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UPDATE_VADDR)) {
         error_setg(errp, "VFIO container does not support VFIO_UPDATE_VADDR");
@@ -85,7 +87,7 @@ static bool vfio_cpr_supported(VFIOContainer *container, Error **errp)
 
 static int vfio_container_pre_save(void *opaque)
 {
-    VFIOContainer *container = opaque;
+    VFIOLegacyContainer *container = opaque;
     Error *local_err = NULL;
 
     if (!vfio_dma_unmap_vaddr_all(container, &local_err)) {
@@ -97,7 +99,7 @@ static int vfio_container_pre_save(void *opaque)
 
 static int vfio_container_post_load(void *opaque, int version_id)
 {
-    VFIOContainer *container = opaque;
+    VFIOLegacyContainer *container = opaque;
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     dma_map_fn saved_dma_map = vioc->dma_map;
@@ -133,8 +135,8 @@ static const VMStateDescription vfio_container_vmstate = {
 static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
                                   MigrationEvent *e, Error **errp)
 {
-    VFIOContainer *container =
-        container_of(notifier, VFIOContainer, cpr.transfer_notifier);
+    VFIOLegacyContainer *container =
+        container_of(notifier, VFIOLegacyContainer, cpr.transfer_notifier);
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
 
     if (e->type != MIG_EVENT_PRECOPY_FAILED) {
@@ -165,7 +167,8 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
     return 0;
 }
 
-bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
+bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
+                                        Error **errp)
 {
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     Error **cpr_blocker = &container->cpr.blocker;
@@ -189,7 +192,7 @@ bool vfio_legacy_cpr_register_container(VFIOContainer *container, Error **errp)
     return true;
 }
 
-void vfio_legacy_cpr_unregister_container(VFIOContainer *container)
+void vfio_legacy_cpr_unregister_container(VFIOLegacyContainer *container)
 {
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
 
@@ -263,7 +266,7 @@ static bool same_device(int fd1, int fd2)
     return !fstat(fd1, &st1) && !fstat(fd2, &st2) && st1.st_dev == st2.st_dev;
 }
 
-bool vfio_cpr_container_match(VFIOContainer *container, VFIOGroup *group,
+bool vfio_cpr_container_match(VFIOLegacyContainer *container, VFIOGroup *group,
                               int fd)
 {
     if (container->fd == fd) {
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index c41e4588d6..b8bade90d7 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -31,7 +31,7 @@ typedef struct VFIOHostDMAWindow {
 } VFIOHostDMAWindow;
 
 typedef struct VFIOSpaprContainer {
-    VFIOContainer container;
+    VFIOLegacyContainer container;
     MemoryListener prereg_listener;
     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
     unsigned int levels;
@@ -61,7 +61,7 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
 {
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
-    VFIOContainer *container = &scontainer->container;
+    VFIOLegacyContainer *container = &scontainer->container;
     VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
@@ -121,7 +121,7 @@ static void vfio_prereg_listener_region_del(MemoryListener *listener,
 {
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
-    VFIOContainer *container = &scontainer->container;
+    VFIOLegacyContainer *container = &scontainer->container;
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
     int ret;
@@ -218,7 +218,7 @@ static VFIOHostDMAWindow *vfio_find_hostwin(VFIOSpaprContainer *container,
     return hostwin_found ? hostwin : NULL;
 }
 
-static int vfio_spapr_remove_window(VFIOContainer *container,
+static int vfio_spapr_remove_window(VFIOLegacyContainer *container,
                                     hwaddr offset_within_address_space)
 {
     struct vfio_iommu_spapr_tce_remove remove = {
@@ -239,7 +239,7 @@ static int vfio_spapr_remove_window(VFIOContainer *container,
     return 0;
 }
 
-static bool vfio_spapr_create_window(VFIOContainer *container,
+static bool vfio_spapr_create_window(VFIOLegacyContainer *container,
                                     MemoryRegionSection *section,
                                     hwaddr *pgsize, Error **errp)
 {
@@ -352,7 +352,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
                                         MemoryRegionSection *section,
                                         Error **errp)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     VFIOHostDMAWindow *hostwin;
@@ -442,7 +442,7 @@ static void
 vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
                                         MemoryRegionSection *section)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
 
@@ -463,7 +463,7 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
 
 static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     VFIOHostDMAWindow *hostwin, *next;
@@ -481,7 +481,7 @@ static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
 static bool vfio_spapr_container_setup(VFIOContainerBase *bcontainer,
                                        Error **errp)
 {
-    VFIOContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     struct vfio_iommu_spapr_tce_info info;
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index 240f566993..712a691400 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -12,20 +12,20 @@
 #include "hw/vfio/vfio-container-base.h"
 #include "hw/vfio/vfio-cpr.h"
 
-typedef struct VFIOContainer VFIOContainer;
+typedef struct VFIOLegacyContainer VFIOLegacyContainer;
 typedef struct VFIODevice VFIODevice;
 
 typedef struct VFIOGroup {
     int fd;
     int groupid;
-    VFIOContainer *container;
+    VFIOLegacyContainer *container;
     QLIST_HEAD(, VFIODevice) device_list;
     QLIST_ENTRY(VFIOGroup) next;
     QLIST_ENTRY(VFIOGroup) container_next;
     bool ram_block_discard_allowed;
 } VFIOGroup;
 
-struct VFIOContainer {
+struct VFIOLegacyContainer {
     VFIOContainerBase parent_obj;
 
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
@@ -34,6 +34,6 @@ struct VFIOContainer {
     VFIOContainerCPR cpr;
 };
 
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOContainer, VFIO_IOMMU_LEGACY);
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOLegacyContainer, VFIO_IOMMU_LEGACY);
 
 #endif /* HW_VFIO_CONTAINER_H */
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index d37daffbc5..04e9872587 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -12,7 +12,7 @@
 #include "migration/misc.h"
 #include "system/memory.h"
 
-struct VFIOContainer;
+struct VFIOLegacyContainer;
 struct VFIOContainerBase;
 struct VFIOGroup;
 struct VFIODevice;
@@ -42,9 +42,10 @@ typedef struct VFIOPCICPR {
     NotifierWithReturn transfer_notifier;
 } VFIOPCICPR;
 
-bool vfio_legacy_cpr_register_container(struct VFIOContainer *container,
+bool vfio_legacy_cpr_register_container(struct VFIOLegacyContainer *container,
                                         Error **errp);
-void vfio_legacy_cpr_unregister_container(struct VFIOContainer *container);
+void vfio_legacy_cpr_unregister_container(
+    struct VFIOLegacyContainer *container);
 
 int vfio_cpr_reboot_notifier(NotifierWithReturn *notifier, MigrationEvent *e,
                              Error **errp);
@@ -61,7 +62,7 @@ void vfio_cpr_load_device(struct VFIODevice *vbasedev);
 
 int vfio_cpr_group_get_device_fd(int d, const char *name);
 
-bool vfio_cpr_container_match(struct VFIOContainer *container,
+bool vfio_cpr_container_match(struct VFIOLegacyContainer *container,
                               struct VFIOGroup *group, int fd);
 
 void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,

From e2e269d580947fe9b1b5735c8cb659277ac67996 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:10 +0100
Subject: [PATCH 0642/2396] include/hw/vfio/vfio-container-base.h: rename
 VFIOContainerBase to VFIOContainer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the VFIOContainer struct name is available, rename VFIOContainerBase
to VFIOContainer to better indicate that it is the superclass of other
VFIOFooContainer structs.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-3-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c               |  2 +-
 hw/vfio-user/container.c              | 18 +++----
 hw/vfio-user/container.h              |  2 +-
 hw/vfio/container-base.c              | 41 ++++++++-------
 hw/vfio/container.c                   | 22 ++++----
 hw/vfio/cpr-iommufd.c                 |  4 +-
 hw/vfio/cpr-legacy.c                  | 14 ++---
 hw/vfio/device.c                      |  2 +-
 hw/vfio/iommufd.c                     | 18 +++----
 hw/vfio/listener.c                    | 74 +++++++++++++-------------
 hw/vfio/spapr.c                       | 12 ++---
 hw/vfio/vfio-iommufd.h                |  2 +-
 hw/vfio/vfio-listener.h               |  4 +-
 include/hw/vfio/vfio-container-base.h | 76 +++++++++++++--------------
 include/hw/vfio/vfio-container.h      |  2 +-
 include/hw/vfio/vfio-cpr.h            |  8 +--
 include/hw/vfio/vfio-device.h         |  4 +-
 17 files changed, 154 insertions(+), 151 deletions(-)

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index faa3ab3fe1..c8175dd8a8 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -86,7 +86,7 @@ static int vfio_eeh_container_op(VFIOLegacyContainer *container, uint32_t op)
 static VFIOLegacyContainer *vfio_eeh_as_container(AddressSpace *as)
 {
     VFIOAddressSpace *space = vfio_address_space_get(as);
-    VFIOContainerBase *bcontainer = NULL;
+    VFIOContainer *bcontainer = NULL;
 
     if (QLIST_EMPTY(&space->containers)) {
         /* No containers to act on */
diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index 3cdbd44c1a..411eb7b28b 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -22,14 +22,14 @@
  * will fire during memory update transactions.  These depend on BQL being held,
  * so do any resulting map/demap ops async while keeping BQL.
  */
-static void vfio_user_listener_begin(VFIOContainerBase *bcontainer)
+static void vfio_user_listener_begin(VFIOContainer *bcontainer)
 {
     VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
     container->proxy->async_ops = true;
 }
 
-static void vfio_user_listener_commit(VFIOContainerBase *bcontainer)
+static void vfio_user_listener_commit(VFIOContainer *bcontainer)
 {
     VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
@@ -38,7 +38,7 @@ static void vfio_user_listener_commit(VFIOContainerBase *bcontainer)
     vfio_user_wait_reqs(container->proxy);
 }
 
-static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
+static int vfio_user_dma_unmap(const VFIOContainer *bcontainer,
                                hwaddr iova, ram_addr_t size,
                                IOMMUTLBEntry *iotlb, bool unmap_all)
 {
@@ -80,7 +80,7 @@ static int vfio_user_dma_unmap(const VFIOContainerBase *bcontainer,
     return ret;
 }
 
-static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
+static int vfio_user_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
                              ram_addr_t size, void *vaddr, bool readonly,
                              MemoryRegion *mrp)
 {
@@ -154,14 +154,14 @@ static int vfio_user_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
 }
 
 static int
-vfio_user_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
+vfio_user_set_dirty_page_tracking(const VFIOContainer *bcontainer,
                                     bool start, Error **errp)
 {
     error_setg_errno(errp, ENOTSUP, "Not supported");
     return -ENOTSUP;
 }
 
-static int vfio_user_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+static int vfio_user_query_dirty_bitmap(const VFIOContainer *bcontainer,
                                          VFIOBitmap *vbmap, hwaddr iova,
                                          hwaddr size, Error **errp)
 {
@@ -169,7 +169,7 @@ static int vfio_user_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
     return -ENOTSUP;
 }
 
-static bool vfio_user_setup(VFIOContainerBase *bcontainer, Error **errp)
+static bool vfio_user_setup(VFIOContainer *bcontainer, Error **errp)
 {
     VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
 
@@ -202,7 +202,7 @@ static VFIOUserContainer *
 vfio_user_container_connect(AddressSpace *as, VFIODevice *vbasedev,
                             Error **errp)
 {
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     VFIOUserContainer *container;
     VFIOAddressSpace *space;
     VFIOIOMMUClass *vioc;
@@ -260,7 +260,7 @@ put_space_exit:
 
 static void vfio_user_container_disconnect(VFIOUserContainer *container)
 {
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     VFIOAddressSpace *space = bcontainer->space;
 
diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index 96aa6785d9..241863ef97 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -14,7 +14,7 @@
 
 /* MMU container sub-class for vfio-user. */
 struct VFIOUserContainer {
-    VFIOContainerBase parent_obj;
+    VFIOContainer parent_obj;
 
     VFIOUserProxy *proxy;
 };
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 56304978e1..98c5198e50 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -67,13 +67,13 @@ void vfio_address_space_put(VFIOAddressSpace *space)
 }
 
 void vfio_address_space_insert(VFIOAddressSpace *space,
-                               VFIOContainerBase *bcontainer)
+                               VFIOContainer *bcontainer)
 {
     QLIST_INSERT_HEAD(&space->containers, bcontainer, next);
     bcontainer->space = space;
 }
 
-int vfio_container_dma_map(VFIOContainerBase *bcontainer,
+int vfio_container_dma_map(VFIOContainer *bcontainer,
                            hwaddr iova, ram_addr_t size,
                            void *vaddr, bool readonly, MemoryRegion *mr)
 {
@@ -92,7 +92,7 @@ int vfio_container_dma_map(VFIOContainerBase *bcontainer,
     return vioc->dma_map(bcontainer, iova, size, vaddr, readonly, mr);
 }
 
-int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
+int vfio_container_dma_unmap(VFIOContainer *bcontainer,
                              hwaddr iova, ram_addr_t size,
                              IOMMUTLBEntry *iotlb, bool unmap_all)
 {
@@ -102,7 +102,7 @@ int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
     return vioc->dma_unmap(bcontainer, iova, size, iotlb, unmap_all);
 }
 
-bool vfio_container_add_section_window(VFIOContainerBase *bcontainer,
+bool vfio_container_add_section_window(VFIOContainer *bcontainer,
                                        MemoryRegionSection *section,
                                        Error **errp)
 {
@@ -115,7 +115,7 @@ bool vfio_container_add_section_window(VFIOContainerBase *bcontainer,
     return vioc->add_window(bcontainer, section, errp);
 }
 
-void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
+void vfio_container_del_section_window(VFIOContainer *bcontainer,
                                        MemoryRegionSection *section)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
@@ -127,7 +127,7 @@ void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
     return vioc->del_window(bcontainer, section);
 }
 
-int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
+int vfio_container_set_dirty_page_tracking(VFIOContainer *bcontainer,
                                            bool start, Error **errp)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
@@ -151,7 +151,7 @@ int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
 }
 
 static bool vfio_container_devices_dirty_tracking_is_started(
-    const VFIOContainerBase *bcontainer)
+    const VFIOContainer *bcontainer)
 {
     VFIODevice *vbasedev;
 
@@ -165,14 +165,14 @@ static bool vfio_container_devices_dirty_tracking_is_started(
 }
 
 bool vfio_container_dirty_tracking_is_started(
-    const VFIOContainerBase *bcontainer)
+    const VFIOContainer *bcontainer)
 {
     return vfio_container_devices_dirty_tracking_is_started(bcontainer) ||
            bcontainer->dirty_pages_started;
 }
 
 bool vfio_container_devices_dirty_tracking_is_supported(
-    const VFIOContainerBase *bcontainer)
+    const VFIOContainer *bcontainer)
 {
     VFIODevice *vbasedev;
 
@@ -210,8 +210,9 @@ static int vfio_device_dma_logging_report(VFIODevice *vbasedev, hwaddr iova,
     return vbasedev->io_ops->device_feature(vbasedev, feature);
 }
 
-static int vfio_container_iommu_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                   VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
+static int vfio_container_iommu_query_dirty_bitmap(
+    const VFIOContainer *bcontainer, VFIOBitmap *vbmap, hwaddr iova,
+    hwaddr size, Error **errp)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
@@ -220,8 +221,9 @@ static int vfio_container_iommu_query_dirty_bitmap(const VFIOContainerBase *bcon
                                                errp);
 }
 
-static int vfio_container_devices_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
-                 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
+static int vfio_container_devices_query_dirty_bitmap(
+    const VFIOContainer *bcontainer, VFIOBitmap *vbmap, hwaddr iova,
+    hwaddr size, Error **errp)
 {
     VFIODevice *vbasedev;
     int ret;
@@ -242,8 +244,9 @@ static int vfio_container_devices_query_dirty_bitmap(const VFIOContainerBase *bc
     return 0;
 }
 
-int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer, uint64_t iova,
-                          uint64_t size, ram_addr_t ram_addr, Error **errp)
+int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
+                                      uint64_t iova, uint64_t size,
+                                      ram_addr_t ram_addr, Error **errp)
 {
     bool all_device_dirty_tracking =
         vfio_container_devices_dirty_tracking_is_supported(bcontainer);
@@ -297,7 +300,7 @@ static gpointer copy_iova_range(gconstpointer src, gpointer data)
      return dest;
 }
 
-GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer)
+GList *vfio_container_get_iova_ranges(const VFIOContainer *bcontainer)
 {
     assert(bcontainer);
     return g_list_copy_deep(bcontainer->iova_ranges, copy_iova_range, NULL);
@@ -305,7 +308,7 @@ GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer)
 
 static void vfio_container_instance_finalize(Object *obj)
 {
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(obj);
+    VFIOContainer *bcontainer = VFIO_IOMMU(obj);
     VFIOGuestIOMMU *giommu, *tmp;
 
     QLIST_SAFE_REMOVE(bcontainer, next);
@@ -322,7 +325,7 @@ static void vfio_container_instance_finalize(Object *obj)
 
 static void vfio_container_instance_init(Object *obj)
 {
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(obj);
+    VFIOContainer *bcontainer = VFIO_IOMMU(obj);
 
     bcontainer->error = NULL;
     bcontainer->dirty_pages_supported = false;
@@ -338,7 +341,7 @@ static const TypeInfo types[] = {
         .parent = TYPE_OBJECT,
         .instance_init = vfio_container_instance_init,
         .instance_finalize = vfio_container_instance_finalize,
-        .instance_size = sizeof(VFIOContainerBase),
+        .instance_size = sizeof(VFIOContainer),
         .class_size = sizeof(VFIOIOMMUClass),
         .abstract = true,
     },
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index bdf415b3d6..dc8425efb1 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -72,7 +72,7 @@ static int vfio_dma_unmap_bitmap(const VFIOLegacyContainer *container,
                                  hwaddr iova, ram_addr_t size,
                                  IOMMUTLBEntry *iotlb)
 {
-    const VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    const VFIOContainer *bcontainer = VFIO_IOMMU(container);
     struct vfio_iommu_type1_dma_unmap *unmap;
     struct vfio_bitmap *bitmap;
     VFIOBitmap vbmap;
@@ -121,7 +121,7 @@ unmap_exit:
     return ret;
 }
 
-static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
+static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
                                      hwaddr iova, ram_addr_t size,
                                      IOMMUTLBEntry *iotlb)
 {
@@ -184,7 +184,7 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainerBase *bcontainer,
 /*
  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
  */
-static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
+static int vfio_legacy_dma_unmap(const VFIOContainer *bcontainer,
                                  hwaddr iova, ram_addr_t size,
                                  IOMMUTLBEntry *iotlb, bool unmap_all)
 {
@@ -209,7 +209,7 @@ static int vfio_legacy_dma_unmap(const VFIOContainerBase *bcontainer,
     return ret;
 }
 
-static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
+static int vfio_legacy_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
                                ram_addr_t size, void *vaddr, bool readonly,
                                MemoryRegion *mr)
 {
@@ -242,7 +242,7 @@ static int vfio_legacy_dma_map(const VFIOContainerBase *bcontainer, hwaddr iova,
 }
 
 static int
-vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
+vfio_legacy_set_dirty_page_tracking(const VFIOContainer *bcontainer,
                                     bool start, Error **errp)
 {
     const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
@@ -267,7 +267,7 @@ vfio_legacy_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
     return ret;
 }
 
-static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+static int vfio_legacy_query_dirty_bitmap(const VFIOContainer *bcontainer,
                       VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp)
 {
     const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
@@ -307,7 +307,7 @@ static int vfio_legacy_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
 }
 
 static bool vfio_get_info_iova_range(struct vfio_iommu_type1_info *info,
-                                     VFIOContainerBase *bcontainer)
+                                     VFIOContainer *bcontainer)
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_iommu_type1_info_cap_iova_range *cap;
@@ -492,7 +492,7 @@ static void vfio_get_iommu_info_migration(VFIOLegacyContainer *container,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_iommu_type1_info_cap_migration *cap_mig;
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     hdr = vfio_get_iommu_info_cap(info, VFIO_IOMMU_TYPE1_INFO_CAP_MIGRATION);
     if (!hdr) {
@@ -513,7 +513,7 @@ static void vfio_get_iommu_info_migration(VFIOLegacyContainer *container,
     }
 }
 
-static bool vfio_legacy_setup(VFIOContainerBase *bcontainer, Error **errp)
+static bool vfio_legacy_setup(VFIOContainer *bcontainer, Error **errp)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     g_autofree struct vfio_iommu_type1_info *info = NULL;
@@ -619,7 +619,7 @@ static bool vfio_container_connect(VFIOGroup *group, AddressSpace *as,
                                    Error **errp)
 {
     VFIOLegacyContainer *container;
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     int ret, fd = -1;
     VFIOAddressSpace *space;
     VFIOIOMMUClass *vioc = NULL;
@@ -732,7 +732,7 @@ fail:
 static void vfio_container_disconnect(VFIOGroup *group)
 {
     VFIOLegacyContainer *container = group->container;
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
 
     QLIST_REMOVE(group, container_next);
diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 148a06d552..6aaf6f77a2 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -176,7 +176,7 @@ void vfio_iommufd_cpr_unregister_iommufd(IOMMUFDBackend *be)
 bool vfio_iommufd_cpr_register_container(VFIOIOMMUFDContainer *container,
                                          Error **errp)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = &container->bcontainer;
 
     migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
                                 vfio_cpr_reboot_notifier,
@@ -189,7 +189,7 @@ bool vfio_iommufd_cpr_register_container(VFIOIOMMUFDContainer *container,
 
 void vfio_iommufd_cpr_unregister_container(VFIOIOMMUFDContainer *container)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = &container->bcontainer;
 
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
 }
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 12bf920a7d..bd3f6fc3d3 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -38,7 +38,7 @@ static bool vfio_dma_unmap_vaddr_all(VFIOLegacyContainer *container,
  * Set the new @vaddr for any mappings registered during cpr load.
  * The incoming state is cleared thereafter.
  */
-static int vfio_legacy_cpr_dma_map(const VFIOContainerBase *bcontainer,
+static int vfio_legacy_cpr_dma_map(const VFIOContainer *bcontainer,
                                    hwaddr iova, ram_addr_t size, void *vaddr,
                                    bool readonly, MemoryRegion *mr)
 {
@@ -100,7 +100,7 @@ static int vfio_container_pre_save(void *opaque)
 static int vfio_container_post_load(void *opaque, int version_id)
 {
     VFIOLegacyContainer *container = opaque;
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
     dma_map_fn saved_dma_map = vioc->dma_map;
     Error *local_err = NULL;
@@ -137,7 +137,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
 {
     VFIOLegacyContainer *container =
         container_of(notifier, VFIOLegacyContainer, cpr.transfer_notifier);
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     if (e->type != MIG_EVENT_PRECOPY_FAILED) {
         return 0;
@@ -170,7 +170,7 @@ static int vfio_cpr_fail_notifier(NotifierWithReturn *notifier,
 bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
                                         Error **errp)
 {
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     Error **cpr_blocker = &container->cpr.blocker;
 
     migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
@@ -194,7 +194,7 @@ bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
 
 void vfio_legacy_cpr_unregister_container(VFIOLegacyContainer *container)
 {
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
     migrate_del_blocker(&container->cpr.blocker);
@@ -210,7 +210,7 @@ void vfio_legacy_cpr_unregister_container(VFIOLegacyContainer *container)
  * The giommu already exists.  Find it and replay it, which calls
  * vfio_legacy_cpr_dma_map further down the stack.
  */
-void vfio_cpr_giommu_remap(VFIOContainerBase *bcontainer,
+void vfio_cpr_giommu_remap(VFIOContainer *bcontainer,
                            MemoryRegionSection *section)
 {
     VFIOGuestIOMMU *giommu = NULL;
@@ -235,7 +235,7 @@ void vfio_cpr_giommu_remap(VFIOContainerBase *bcontainer,
  * The ram discard listener already exists.  Call its populate function
  * directly, which calls vfio_legacy_cpr_dma_map.
  */
-bool vfio_cpr_ram_discard_register_listener(VFIOContainerBase *bcontainer,
+bool vfio_cpr_ram_discard_register_listener(VFIOContainer *bcontainer,
                                             MemoryRegionSection *section)
 {
     VFIORamDiscardListener *vrdl =
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 08f12ac31f..963cefc053 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -460,7 +460,7 @@ void vfio_device_detach(VFIODevice *vbasedev)
     VFIO_IOMMU_GET_CLASS(vbasedev->bcontainer)->detach_device(vbasedev);
 }
 
-void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
+void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
                          struct vfio_device_info *info)
 {
     int i;
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 8c27222f75..7f2243d9d1 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -34,7 +34,7 @@
 #define TYPE_HOST_IOMMU_DEVICE_IOMMUFD_VFIO             \
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
-static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
+static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly,
                             MemoryRegion *mr)
 {
@@ -46,7 +46,7 @@ static int iommufd_cdev_map(const VFIOContainerBase *bcontainer, hwaddr iova,
                                    iova, size, vaddr, readonly);
 }
 
-static int iommufd_cdev_map_file(const VFIOContainerBase *bcontainer,
+static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
                                  hwaddr iova, ram_addr_t size,
                                  int fd, unsigned long start, bool readonly)
 {
@@ -58,7 +58,7 @@ static int iommufd_cdev_map_file(const VFIOContainerBase *bcontainer,
                                         iova, size, fd, start, readonly);
 }
 
-static int iommufd_cdev_unmap(const VFIOContainerBase *bcontainer,
+static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
                               hwaddr iova, ram_addr_t size,
                               IOMMUTLBEntry *iotlb, bool unmap_all)
 {
@@ -159,7 +159,7 @@ static bool iommufd_hwpt_dirty_tracking(VFIOIOASHwpt *hwpt)
     return hwpt && hwpt->hwpt_flags & IOMMU_HWPT_ALLOC_DIRTY_TRACKING;
 }
 
-static int iommufd_set_dirty_page_tracking(const VFIOContainerBase *bcontainer,
+static int iommufd_set_dirty_page_tracking(const VFIOContainer *bcontainer,
                                            bool start, Error **errp)
 {
     const VFIOIOMMUFDContainer *container =
@@ -190,7 +190,7 @@ err:
     return -EINVAL;
 }
 
-static int iommufd_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+static int iommufd_query_dirty_bitmap(const VFIOContainer *bcontainer,
                                       VFIOBitmap *vbmap, hwaddr iova,
                                       hwaddr size, Error **errp)
 {
@@ -464,7 +464,7 @@ static void iommufd_cdev_detach_container(VFIODevice *vbasedev,
 
 static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = &container->bcontainer;
 
     if (!QLIST_EMPTY(&bcontainer->device_list)) {
         return;
@@ -486,7 +486,7 @@ static int iommufd_cdev_ram_block_discard_disable(bool state)
 static bool iommufd_cdev_get_info_iova_range(VFIOIOMMUFDContainer *container,
                                              uint32_t ioas_id, Error **errp)
 {
-    VFIOContainerBase *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = &container->bcontainer;
     g_autofree struct iommu_ioas_iova_ranges *info = NULL;
     struct iommu_iova_range *iova_ranges;
     int sz, fd = container->be->fd;
@@ -528,7 +528,7 @@ error:
 static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
                                 AddressSpace *as, Error **errp)
 {
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     VFIOIOMMUFDContainer *container;
     VFIOAddressSpace *space;
     struct vfio_device_info dev_info = { .argsz = sizeof(dev_info) };
@@ -687,7 +687,7 @@ err_connect_bind:
 
 static void iommufd_cdev_detach(VFIODevice *vbasedev)
 {
-    VFIOContainerBase *bcontainer = vbasedev->bcontainer;
+    VFIOContainer *bcontainer = vbasedev->bcontainer;
     VFIOAddressSpace *space = bcontainer->space;
     VFIOIOMMUFDContainer *container = container_of(bcontainer,
                                                    VFIOIOMMUFDContainer,
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index e093833165..3b6f17f0c3 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -52,7 +52,7 @@
  */
 
 
-static bool vfio_log_sync_needed(const VFIOContainerBase *bcontainer)
+static bool vfio_log_sync_needed(const VFIOContainer *bcontainer)
 {
     VFIODevice *vbasedev;
 
@@ -125,7 +125,7 @@ static MemoryRegion *vfio_translate_iotlb(IOMMUTLBEntry *iotlb, hwaddr *xlat_p,
 static void vfio_iommu_map_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
 {
     VFIOGuestIOMMU *giommu = container_of(n, VFIOGuestIOMMU, n);
-    VFIOContainerBase *bcontainer = giommu->bcontainer;
+    VFIOContainer *bcontainer = giommu->bcontainer;
     hwaddr iova = iotlb->iova + giommu->iommu_offset;
     MemoryRegion *mr;
     hwaddr xlat;
@@ -202,7 +202,7 @@ static void vfio_ram_discard_notify_discard(RamDiscardListener *rdl,
 {
     VFIORamDiscardListener *vrdl = container_of(rdl, VFIORamDiscardListener,
                                                 listener);
-    VFIOContainerBase *bcontainer = vrdl->bcontainer;
+    VFIOContainer *bcontainer = vrdl->bcontainer;
     const hwaddr size = int128_get64(section->size);
     const hwaddr iova = section->offset_within_address_space;
     int ret;
@@ -220,7 +220,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
 {
     VFIORamDiscardListener *vrdl = container_of(rdl, VFIORamDiscardListener,
                                                 listener);
-    VFIOContainerBase *bcontainer = vrdl->bcontainer;
+    VFIOContainer *bcontainer = vrdl->bcontainer;
     const hwaddr end = section->offset_within_region +
                        int128_get64(section->size);
     hwaddr start, next, iova;
@@ -250,7 +250,7 @@ static int vfio_ram_discard_notify_populate(RamDiscardListener *rdl,
     return 0;
 }
 
-static bool vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
+static bool vfio_ram_discard_register_listener(VFIOContainer *bcontainer,
                                                MemoryRegionSection *section,
                                                Error **errp)
 {
@@ -328,7 +328,7 @@ static bool vfio_ram_discard_register_listener(VFIOContainerBase *bcontainer,
     return true;
 }
 
-static void vfio_ram_discard_unregister_listener(VFIOContainerBase *bcontainer,
+static void vfio_ram_discard_unregister_listener(VFIOContainer *bcontainer,
                                                  MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
@@ -396,7 +396,7 @@ static bool vfio_listener_valid_section(MemoryRegionSection *section,
     return true;
 }
 
-static bool vfio_get_section_iova_range(VFIOContainerBase *bcontainer,
+static bool vfio_get_section_iova_range(VFIOContainer *bcontainer,
                                         MemoryRegionSection *section,
                                         hwaddr *out_iova, hwaddr *out_end,
                                         Int128 *out_llend)
@@ -423,9 +423,9 @@ static bool vfio_get_section_iova_range(VFIOContainerBase *bcontainer,
 
 static void vfio_listener_begin(MemoryListener *listener)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
-    void (*listener_begin)(VFIOContainerBase *bcontainer);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
+    void (*listener_begin)(VFIOContainer *bcontainer);
 
     listener_begin = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_begin;
 
@@ -436,9 +436,9 @@ static void vfio_listener_begin(MemoryListener *listener)
 
 static void vfio_listener_commit(MemoryListener *listener)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
-    void (*listener_commit)(VFIOContainerBase *bcontainer);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
+    void (*listener_commit)(VFIOContainer *bcontainer);
 
     listener_commit = VFIO_IOMMU_GET_CLASS(bcontainer)->listener_commit;
 
@@ -460,7 +460,7 @@ static void vfio_device_error_append(VFIODevice *vbasedev, Error **errp)
 }
 
 VFIORamDiscardListener *vfio_find_ram_discard_listener(
-    VFIOContainerBase *bcontainer, MemoryRegionSection *section)
+    VFIOContainer *bcontainer, MemoryRegionSection *section)
 {
     VFIORamDiscardListener *vrdl = NULL;
 
@@ -482,12 +482,12 @@ VFIORamDiscardListener *vfio_find_ram_discard_listener(
 static void vfio_listener_region_add(MemoryListener *listener,
                                      MemoryRegionSection *section)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
     vfio_container_region_add(bcontainer, section, false);
 }
 
-void vfio_container_region_add(VFIOContainerBase *bcontainer,
+void vfio_container_region_add(VFIOContainer *bcontainer,
                                MemoryRegionSection *section,
                                bool cpr_remap)
 {
@@ -656,8 +656,8 @@ fail:
 static void vfio_listener_region_del(MemoryListener *listener,
                                      MemoryRegionSection *section)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
     hwaddr iova, end;
     Int128 llend, llsize;
     int ret;
@@ -744,13 +744,13 @@ typedef struct VFIODirtyRanges {
 } VFIODirtyRanges;
 
 typedef struct VFIODirtyRangesListener {
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     VFIODirtyRanges ranges;
     MemoryListener listener;
 } VFIODirtyRangesListener;
 
 static bool vfio_section_is_vfio_pci(MemoryRegionSection *section,
-                                     VFIOContainerBase *bcontainer)
+                                     VFIOContainer *bcontainer)
 {
     VFIOPCIDevice *pcidev;
     VFIODevice *vbasedev;
@@ -835,7 +835,7 @@ static const MemoryListener vfio_dirty_tracking_listener = {
     .region_add = vfio_dirty_tracking_update,
 };
 
-static void vfio_dirty_tracking_init(VFIOContainerBase *bcontainer,
+static void vfio_dirty_tracking_init(VFIOContainer *bcontainer,
                                      VFIODirtyRanges *ranges)
 {
     VFIODirtyRangesListener dirty;
@@ -860,7 +860,7 @@ static void vfio_dirty_tracking_init(VFIOContainerBase *bcontainer,
     memory_listener_unregister(&dirty.listener);
 }
 
-static void vfio_devices_dma_logging_stop(VFIOContainerBase *bcontainer)
+static void vfio_devices_dma_logging_stop(VFIOContainer *bcontainer)
 {
     uint64_t buf[DIV_ROUND_UP(sizeof(struct vfio_device_feature),
                               sizeof(uint64_t))] = {};
@@ -889,7 +889,7 @@ static void vfio_devices_dma_logging_stop(VFIOContainerBase *bcontainer)
 }
 
 static struct vfio_device_feature *
-vfio_device_feature_dma_logging_start_create(VFIOContainerBase *bcontainer,
+vfio_device_feature_dma_logging_start_create(VFIOContainer *bcontainer,
                                              VFIODirtyRanges *tracking)
 {
     struct vfio_device_feature *feature;
@@ -962,7 +962,7 @@ static void vfio_device_feature_dma_logging_start_destroy(
     g_free(feature);
 }
 
-static bool vfio_devices_dma_logging_start(VFIOContainerBase *bcontainer,
+static bool vfio_devices_dma_logging_start(VFIOContainer *bcontainer,
                                           Error **errp)
 {
     struct vfio_device_feature *feature;
@@ -1006,8 +1006,8 @@ static bool vfio_listener_log_global_start(MemoryListener *listener,
                                            Error **errp)
 {
     ERRP_GUARD();
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
     bool ret;
 
     if (vfio_container_devices_dirty_tracking_is_supported(bcontainer)) {
@@ -1024,8 +1024,8 @@ static bool vfio_listener_log_global_start(MemoryListener *listener,
 
 static void vfio_listener_log_global_stop(MemoryListener *listener)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
     Error *local_err = NULL;
     int ret = 0;
 
@@ -1057,7 +1057,7 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     vfio_giommu_dirty_notifier *gdn = container_of(n,
                                                 vfio_giommu_dirty_notifier, n);
     VFIOGuestIOMMU *giommu = gdn->giommu;
-    VFIOContainerBase *bcontainer = giommu->bcontainer;
+    VFIOContainer *bcontainer = giommu->bcontainer;
     hwaddr iova = iotlb->iova + giommu->iommu_offset;
     ram_addr_t translated_addr;
     Error *local_err = NULL;
@@ -1127,7 +1127,7 @@ static int vfio_ram_discard_query_dirty_bitmap(MemoryRegionSection *section,
 }
 
 static int
-vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
+vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainer *bcontainer,
                                             MemoryRegionSection *section)
 {
     RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
@@ -1143,7 +1143,7 @@ vfio_sync_ram_discard_listener_dirty_bitmap(VFIOContainerBase *bcontainer,
                                                 &vrdl);
 }
 
-static int vfio_sync_iommu_dirty_bitmap(VFIOContainerBase *bcontainer,
+static int vfio_sync_iommu_dirty_bitmap(VFIOContainer *bcontainer,
                                         MemoryRegionSection *section)
 {
     VFIOGuestIOMMU *giommu;
@@ -1180,7 +1180,7 @@ static int vfio_sync_iommu_dirty_bitmap(VFIOContainerBase *bcontainer,
     return 0;
 }
 
-static int vfio_sync_dirty_bitmap(VFIOContainerBase *bcontainer,
+static int vfio_sync_dirty_bitmap(VFIOContainer *bcontainer,
                                   MemoryRegionSection *section, Error **errp)
 {
     ram_addr_t ram_addr;
@@ -1209,8 +1209,8 @@ static int vfio_sync_dirty_bitmap(VFIOContainerBase *bcontainer,
 static void vfio_listener_log_sync(MemoryListener *listener,
         MemoryRegionSection *section)
 {
-    VFIOContainerBase *bcontainer = container_of(listener, VFIOContainerBase,
-                                                 listener);
+    VFIOContainer *bcontainer = container_of(listener, VFIOContainer,
+                                             listener);
     int ret;
     Error *local_err = NULL;
 
@@ -1241,7 +1241,7 @@ static const MemoryListener vfio_memory_listener = {
     .log_sync = vfio_listener_log_sync,
 };
 
-bool vfio_listener_register(VFIOContainerBase *bcontainer, Error **errp)
+bool vfio_listener_register(VFIOContainer *bcontainer, Error **errp)
 {
     bcontainer->listener = vfio_memory_listener;
     memory_listener_register(&bcontainer->listener, bcontainer->space->as);
@@ -1255,7 +1255,7 @@ bool vfio_listener_register(VFIOContainerBase *bcontainer, Error **errp)
     return true;
 }
 
-void vfio_listener_unregister(VFIOContainerBase *bcontainer)
+void vfio_listener_unregister(VFIOContainer *bcontainer)
 {
     memory_listener_unregister(&bcontainer->listener);
 }
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index b8bade90d7..6d462aa13c 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -62,7 +62,7 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
     VFIOLegacyContainer *container = &scontainer->container;
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
     int ret;
@@ -244,7 +244,7 @@ static bool vfio_spapr_create_window(VFIOLegacyContainer *container,
                                     hwaddr *pgsize, Error **errp)
 {
     int ret = 0;
-    VFIOContainerBase *bcontainer = VFIO_IOMMU(container);
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
                                                   container);
     IOMMUMemoryRegion *iommu_mr = IOMMU_MEMORY_REGION(section->mr);
@@ -348,7 +348,7 @@ static bool vfio_spapr_create_window(VFIOLegacyContainer *container,
 }
 
 static bool
-vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
+vfio_spapr_container_add_section_window(VFIOContainer *bcontainer,
                                         MemoryRegionSection *section,
                                         Error **errp)
 {
@@ -439,7 +439,7 @@ vfio_spapr_container_add_section_window(VFIOContainerBase *bcontainer,
 }
 
 static void
-vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
+vfio_spapr_container_del_section_window(VFIOContainer *bcontainer,
                                         MemoryRegionSection *section)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
@@ -461,7 +461,7 @@ vfio_spapr_container_del_section_window(VFIOContainerBase *bcontainer,
     }
 }
 
-static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
+static void vfio_spapr_container_release(VFIOContainer *bcontainer)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
     VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
@@ -478,7 +478,7 @@ static void vfio_spapr_container_release(VFIOContainerBase *bcontainer)
     }
 }
 
-static bool vfio_spapr_container_setup(VFIOContainerBase *bcontainer,
+static bool vfio_spapr_container_setup(VFIOContainer *bcontainer,
                                        Error **errp)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
diff --git a/hw/vfio/vfio-iommufd.h b/hw/vfio/vfio-iommufd.h
index 07ea0f4304..6c049d9257 100644
--- a/hw/vfio/vfio-iommufd.h
+++ b/hw/vfio/vfio-iommufd.h
@@ -23,7 +23,7 @@ typedef struct VFIOIOASHwpt {
 typedef struct IOMMUFDBackend IOMMUFDBackend;
 
 typedef struct VFIOIOMMUFDContainer {
-    VFIOContainerBase bcontainer;
+    VFIOContainer bcontainer;
     IOMMUFDBackend *be;
     uint32_t ioas_id;
     QLIST_HEAD(, VFIOIOASHwpt) hwpt_list;
diff --git a/hw/vfio/vfio-listener.h b/hw/vfio/vfio-listener.h
index eb69ddd374..a90674ca96 100644
--- a/hw/vfio/vfio-listener.h
+++ b/hw/vfio/vfio-listener.h
@@ -9,7 +9,7 @@
 #ifndef HW_VFIO_VFIO_LISTENER_H
 #define HW_VFIO_VFIO_LISTENER_H
 
-bool vfio_listener_register(VFIOContainerBase *bcontainer, Error **errp);
-void vfio_listener_unregister(VFIOContainerBase *bcontainer);
+bool vfio_listener_register(VFIOContainer *bcontainer, Error **errp);
+void vfio_listener_unregister(VFIOContainer *bcontainer);
 
 #endif /* HW_VFIO_VFIO_LISTENER_H */
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container-base.h
index acbd48a18a..b580f4a02d 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container-base.h
@@ -26,14 +26,14 @@ typedef struct {
 
 typedef struct VFIOAddressSpace {
     AddressSpace *as;
-    QLIST_HEAD(, VFIOContainerBase) containers;
+    QLIST_HEAD(, VFIOContainer) containers;
     QLIST_ENTRY(VFIOAddressSpace) list;
 } VFIOAddressSpace;
 
 /*
  * This is the base object for vfio container backends
  */
-struct VFIOContainerBase {
+struct VFIOContainer {
     Object parent_obj;
 
     VFIOAddressSpace *space;
@@ -48,17 +48,17 @@ struct VFIOContainerBase {
     bool dirty_pages_started; /* Protected by BQL */
     QLIST_HEAD(, VFIOGuestIOMMU) giommu_list;
     QLIST_HEAD(, VFIORamDiscardListener) vrdl_list;
-    QLIST_ENTRY(VFIOContainerBase) next;
+    QLIST_ENTRY(VFIOContainer) next;
     QLIST_HEAD(, VFIODevice) device_list;
     GList *iova_ranges;
     NotifierWithReturn cpr_reboot_notifier;
 };
 
 #define TYPE_VFIO_IOMMU "vfio-iommu"
-OBJECT_DECLARE_TYPE(VFIOContainerBase, VFIOIOMMUClass, VFIO_IOMMU)
+OBJECT_DECLARE_TYPE(VFIOContainer, VFIOIOMMUClass, VFIO_IOMMU)
 
 typedef struct VFIOGuestIOMMU {
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     IOMMUMemoryRegion *iommu_mr;
     hwaddr iommu_offset;
     IOMMUNotifier n;
@@ -66,7 +66,7 @@ typedef struct VFIOGuestIOMMU {
 } VFIOGuestIOMMU;
 
 typedef struct VFIORamDiscardListener {
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     MemoryRegion *mr;
     hwaddr offset_within_address_space;
     hwaddr size;
@@ -78,32 +78,32 @@ typedef struct VFIORamDiscardListener {
 VFIOAddressSpace *vfio_address_space_get(AddressSpace *as);
 void vfio_address_space_put(VFIOAddressSpace *space);
 void vfio_address_space_insert(VFIOAddressSpace *space,
-                               VFIOContainerBase *bcontainer);
+                               VFIOContainer *bcontainer);
 
-int vfio_container_dma_map(VFIOContainerBase *bcontainer,
+int vfio_container_dma_map(VFIOContainer *bcontainer,
                            hwaddr iova, ram_addr_t size,
                            void *vaddr, bool readonly, MemoryRegion *mr);
-int vfio_container_dma_unmap(VFIOContainerBase *bcontainer,
+int vfio_container_dma_unmap(VFIOContainer *bcontainer,
                              hwaddr iova, ram_addr_t size,
                              IOMMUTLBEntry *iotlb, bool unmap_all);
-bool vfio_container_add_section_window(VFIOContainerBase *bcontainer,
+bool vfio_container_add_section_window(VFIOContainer *bcontainer,
                                        MemoryRegionSection *section,
                                        Error **errp);
-void vfio_container_del_section_window(VFIOContainerBase *bcontainer,
+void vfio_container_del_section_window(VFIOContainer *bcontainer,
                                        MemoryRegionSection *section);
-int vfio_container_set_dirty_page_tracking(VFIOContainerBase *bcontainer,
+int vfio_container_set_dirty_page_tracking(VFIOContainer *bcontainer,
                                            bool start, Error **errp);
 bool vfio_container_dirty_tracking_is_started(
-    const VFIOContainerBase *bcontainer);
+    const VFIOContainer *bcontainer);
 bool vfio_container_devices_dirty_tracking_is_supported(
-    const VFIOContainerBase *bcontainer);
-int vfio_container_query_dirty_bitmap(const VFIOContainerBase *bcontainer,
+    const VFIOContainer *bcontainer);
+int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
     uint64_t iova, uint64_t size, ram_addr_t ram_addr, Error **errp);
 
-GList *vfio_container_get_iova_ranges(const VFIOContainerBase *bcontainer);
+GList *vfio_container_get_iova_ranges(const VFIOContainer *bcontainer);
 
 static inline uint64_t
-vfio_container_get_page_size_mask(const VFIOContainerBase *bcontainer)
+vfio_container_get_page_size_mask(const VFIOContainer *bcontainer)
 {
     assert(bcontainer);
     return bcontainer->pgsizes;
@@ -123,12 +123,12 @@ struct VFIOIOMMUClass {
      * Perform basic setup of the container, including configuring IOMMU
      * capabilities, IOVA ranges, supported page sizes, etc.
      *
-     * @bcontainer: #VFIOContainerBase
+     * @bcontainer: #VFIOContainer
      * @errp: pointer to Error*, to store an error if it happens.
      *
      * Returns true to indicate success and false for error.
      */
-    bool (*setup)(VFIOContainerBase *bcontainer, Error **errp);
+    bool (*setup)(VFIOContainer *bcontainer, Error **errp);
 
     /**
      * @listener_begin
@@ -136,9 +136,9 @@ struct VFIOIOMMUClass {
      * Called at the beginning of an address space update transaction.
      * See #MemoryListener.
      *
-     * @bcontainer: #VFIOContainerBase
+     * @bcontainer: #VFIOContainer
      */
-    void (*listener_begin)(VFIOContainerBase *bcontainer);
+    void (*listener_begin)(VFIOContainer *bcontainer);
 
     /**
      * @listener_commit
@@ -146,9 +146,9 @@ struct VFIOIOMMUClass {
      * Called at the end of an address space update transaction,
      * See #MemoryListener.
      *
-     * @bcontainer: #VFIOContainerBase
+     * @bcontainer: #VFIOContainer
      */
-    void (*listener_commit)(VFIOContainerBase *bcontainer);
+    void (*listener_commit)(VFIOContainer *bcontainer);
 
     /**
      * @dma_map
@@ -156,7 +156,7 @@ struct VFIOIOMMUClass {
      * Map an address range into the container. Note that the memory region is
      * referenced within an RCU read lock region across this call.
      *
-     * @bcontainer: #VFIOContainerBase to use
+     * @bcontainer: #VFIOContainer to use
      * @iova: start address to map
      * @size: size of the range to map
      * @vaddr: process virtual address of mapping
@@ -165,7 +165,7 @@ struct VFIOIOMMUClass {
      *
      * Returns 0 to indicate success and -errno otherwise.
      */
-    int (*dma_map)(const VFIOContainerBase *bcontainer,
+    int (*dma_map)(const VFIOContainer *bcontainer,
                    hwaddr iova, ram_addr_t size,
                    void *vaddr, bool readonly, MemoryRegion *mr);
     /**
@@ -173,14 +173,14 @@ struct VFIOIOMMUClass {
      *
      * Map a file range for the container.
      *
-     * @bcontainer: #VFIOContainerBase to use for map
+     * @bcontainer: #VFIOContainer to use for map
      * @iova: start address to map
      * @size: size of the range to map
      * @fd: descriptor of the file to map
      * @start: starting file offset of the range to map
      * @readonly: map read only if true
      */
-    int (*dma_map_file)(const VFIOContainerBase *bcontainer,
+    int (*dma_map_file)(const VFIOContainer *bcontainer,
                         hwaddr iova, ram_addr_t size,
                         int fd, unsigned long start, bool readonly);
     /**
@@ -188,7 +188,7 @@ struct VFIOIOMMUClass {
      *
      * Unmap an address range from the container.
      *
-     * @bcontainer: #VFIOContainerBase to use for unmap
+     * @bcontainer: #VFIOContainer to use for unmap
      * @iova: start address to unmap
      * @size: size of the range to unmap
      * @iotlb: The IOMMU TLB mapping entry (or NULL)
@@ -196,7 +196,7 @@ struct VFIOIOMMUClass {
      *
      * Returns 0 to indicate success and -errno otherwise.
      */
-    int (*dma_unmap)(const VFIOContainerBase *bcontainer,
+    int (*dma_unmap)(const VFIOContainer *bcontainer,
                      hwaddr iova, ram_addr_t size,
                      IOMMUTLBEntry *iotlb, bool unmap_all);
 
@@ -234,21 +234,21 @@ struct VFIOIOMMUClass {
      *
      * Start or stop dirty pages tracking on VFIO container
      *
-     * @bcontainer: #VFIOContainerBase on which to de/activate dirty
+     * @bcontainer: #VFIOContainer on which to de/activate dirty
      *              page tracking
      * @start: indicates whether to start or stop dirty pages tracking
      * @errp: pointer to Error*, to store an error if it happens.
      *
      * Returns zero to indicate success and negative for error.
      */
-    int (*set_dirty_page_tracking)(const VFIOContainerBase *bcontainer,
+    int (*set_dirty_page_tracking)(const VFIOContainer *bcontainer,
                                    bool start, Error **errp);
     /**
      * @query_dirty_bitmap
      *
      * Get bitmap of dirty pages from container
      *
-     * @bcontainer: #VFIOContainerBase from which to get dirty pages
+     * @bcontainer: #VFIOContainer from which to get dirty pages
      * @vbmap: #VFIOBitmap internal bitmap structure
      * @iova: iova base address
      * @size: size of iova range
@@ -256,24 +256,24 @@ struct VFIOIOMMUClass {
      *
      * Returns zero to indicate success and negative for error.
      */
-    int (*query_dirty_bitmap)(const VFIOContainerBase *bcontainer,
+    int (*query_dirty_bitmap)(const VFIOContainer *bcontainer,
                 VFIOBitmap *vbmap, hwaddr iova, hwaddr size, Error **errp);
     /* PCI specific */
     int (*pci_hot_reset)(VFIODevice *vbasedev, bool single);
 
     /* SPAPR specific */
-    bool (*add_window)(VFIOContainerBase *bcontainer,
+    bool (*add_window)(VFIOContainer *bcontainer,
                        MemoryRegionSection *section,
                        Error **errp);
-    void (*del_window)(VFIOContainerBase *bcontainer,
+    void (*del_window)(VFIOContainer *bcontainer,
                        MemoryRegionSection *section);
-    void (*release)(VFIOContainerBase *bcontainer);
+    void (*release)(VFIOContainer *bcontainer);
 };
 
 VFIORamDiscardListener *vfio_find_ram_discard_listener(
-    VFIOContainerBase *bcontainer, MemoryRegionSection *section);
+    VFIOContainer *bcontainer, MemoryRegionSection *section);
 
-void vfio_container_region_add(VFIOContainerBase *bcontainer,
+void vfio_container_region_add(VFIOContainer *bcontainer,
                                MemoryRegionSection *section, bool cpr_remap);
 
 #endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index 712a691400..a84dfb0dee 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -26,7 +26,7 @@ typedef struct VFIOGroup {
 } VFIOGroup;
 
 struct VFIOLegacyContainer {
-    VFIOContainerBase parent_obj;
+    VFIOContainer parent_obj;
 
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 04e9872587..26ee0c4fe1 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -13,14 +13,14 @@
 #include "system/memory.h"
 
 struct VFIOLegacyContainer;
-struct VFIOContainerBase;
+struct VFIOContainer;
 struct VFIOGroup;
 struct VFIODevice;
 struct VFIOPCIDevice;
 struct VFIOIOMMUFDContainer;
 struct IOMMUFDBackend;
 
-typedef int (*dma_map_fn)(const struct VFIOContainerBase *bcontainer,
+typedef int (*dma_map_fn)(const struct VFIOContainer *bcontainer,
                           hwaddr iova, ram_addr_t size, void *vaddr,
                           bool readonly, MemoryRegion *mr);
 
@@ -65,11 +65,11 @@ int vfio_cpr_group_get_device_fd(int d, const char *name);
 bool vfio_cpr_container_match(struct VFIOLegacyContainer *container,
                               struct VFIOGroup *group, int fd);
 
-void vfio_cpr_giommu_remap(struct VFIOContainerBase *bcontainer,
+void vfio_cpr_giommu_remap(struct VFIOContainer *bcontainer,
                            MemoryRegionSection *section);
 
 bool vfio_cpr_ram_discard_register_listener(
-    struct VFIOContainerBase *bcontainer, MemoryRegionSection *section);
+    struct VFIOContainer *bcontainer, MemoryRegionSection *section);
 
 void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,
                              int nr, int fd);
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index e7e6243e2d..67b9fcdd2c 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -54,7 +54,7 @@ typedef struct VFIODevice {
     QLIST_ENTRY(VFIODevice) container_next;
     QLIST_ENTRY(VFIODevice) global_next;
     struct VFIOGroup *group;
-    VFIOContainerBase *bcontainer;
+    VFIOContainer *bcontainer;
     char *sysfsdev;
     char *name;
     DeviceState *dev;
@@ -252,7 +252,7 @@ struct VFIODeviceIOOps {
                         void *data, bool post);
 };
 
-void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainerBase *bcontainer,
+void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
                          struct vfio_device_info *info);
 
 void vfio_device_unprepare(VFIODevice *vbasedev);

From 07cbbfb108586a03059975aa0e093b833cb9bf56 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:11 +0100
Subject: [PATCH 0643/2396] include/hw/vfio/vfio-container.h: rename file to
 vfio-container-legacy.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the rename of VFIOContainer to VFIOLegacyContainer, the vfio-container.h
header file containing the struct definition is misleading. Rename it from
vfio-container.h to vfio-container-legacy.h accordingly, fixing up the name
of the include guard at the same time.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-4-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/ppc/spapr_pci_vfio.c                                     | 2 +-
 hw/s390x/s390-pci-vfio.c                                    | 2 +-
 hw/vfio/container.c                                         | 2 +-
 hw/vfio/cpr-legacy.c                                        | 2 +-
 hw/vfio/spapr.c                                             | 2 +-
 .../hw/vfio/{vfio-container.h => vfio-container-legacy.h}   | 6 +++---
 6 files changed, 8 insertions(+), 8 deletions(-)
 rename include/hw/vfio/{vfio-container.h => vfio-container-legacy.h} (88%)

diff --git a/hw/ppc/spapr_pci_vfio.c b/hw/ppc/spapr_pci_vfio.c
index c8175dd8a8..a748a0bf4c 100644
--- a/hw/ppc/spapr_pci_vfio.c
+++ b/hw/ppc/spapr_pci_vfio.c
@@ -24,7 +24,7 @@
 #include "hw/pci-host/spapr.h"
 #include "hw/pci/msix.h"
 #include "hw/pci/pci_device.h"
-#include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-container-legacy.h"
 #include "qemu/error-report.h"
 #include CONFIG_DEVICES /* CONFIG_VFIO_PCI */
 
diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index 938a551171..7760780aff 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -20,7 +20,7 @@
 #include "hw/s390x/s390-pci-clp.h"
 #include "hw/s390x/s390-pci-vfio.h"
 #include "hw/vfio/pci.h"
-#include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-container-legacy.h"
 #include "hw/vfio/vfio-helpers.h"
 
 /*
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index dc8425efb1..c0f87f774a 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -34,7 +34,7 @@
 #include "migration/cpr.h"
 #include "migration/blocker.h"
 #include "pci.h"
-#include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-container-legacy.h"
 #include "vfio-helpers.h"
 #include "vfio-listener.h"
 
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index bd3f6fc3d3..bbf7a0d35f 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -7,7 +7,7 @@
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
 #include "qemu/osdep.h"
-#include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-container-legacy.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
 #include "migration/blocker.h"
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 6d462aa13c..acaa9c1419 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -15,7 +15,7 @@
 #include "system/hostmem.h"
 #include "system/address-spaces.h"
 
-#include "hw/vfio/vfio-container.h"
+#include "hw/vfio/vfio-container-legacy.h"
 #include "hw/hw.h"
 #include "system/ram_addr.h"
 #include "qemu/error-report.h"
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container-legacy.h
similarity index 88%
rename from include/hw/vfio/vfio-container.h
rename to include/hw/vfio/vfio-container-legacy.h
index a84dfb0dee..ab5130d26e 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container-legacy.h
@@ -6,8 +6,8 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#ifndef HW_VFIO_CONTAINER_H
-#define HW_VFIO_CONTAINER_H
+#ifndef HW_VFIO_CONTAINER_LEGACY_H
+#define HW_VFIO_CONTAINER_LEGACY_H
 
 #include "hw/vfio/vfio-container-base.h"
 #include "hw/vfio/vfio-cpr.h"
@@ -36,4 +36,4 @@ struct VFIOLegacyContainer {
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOLegacyContainer, VFIO_IOMMU_LEGACY);
 
-#endif /* HW_VFIO_CONTAINER_H */
+#endif /* HW_VFIO_CONTAINER_LEGACY_H */

From ef70eb32b8a15abea6af8180ba03e771ae041169 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:12 +0100
Subject: [PATCH 0644/2396] include/hw/vfio/vfio-container-base.h: rename file
 to vfio-container.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With the rename of VFIOContainerBase to VFIOContainer, the vfio-container-base.h
header file containing the struct definition is misleading. Rename it from
vfio-container-base.h to vfio-container.h accordingly, fixing up the name
of the include guard at the same time.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-5-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.h                                    | 2 +-
 hw/vfio/container-base.c                                    | 2 +-
 hw/vfio/vfio-iommufd.h                                      | 2 +-
 include/hw/vfio/vfio-container-legacy.h                     | 2 +-
 include/hw/vfio/{vfio-container-base.h => vfio-container.h} | 6 +++---
 include/hw/vfio/vfio-device.h                               | 2 +-
 6 files changed, 8 insertions(+), 8 deletions(-)
 rename include/hw/vfio/{vfio-container-base.h => vfio-container.h} (98%)

diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index 241863ef97..a2b42e3169 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -9,7 +9,7 @@
 
 #include "qemu/osdep.h"
 
-#include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-container.h"
 #include "hw/vfio-user/proxy.h"
 
 /* MMU container sub-class for vfio-user. */
diff --git a/hw/vfio/container-base.c b/hw/vfio/container-base.c
index 98c5198e50..250b20f424 100644
--- a/hw/vfio/container-base.c
+++ b/hw/vfio/container-base.c
@@ -18,7 +18,7 @@
 #include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
-#include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-device.h" /* vfio_device_reset_handler */
 #include "system/reset.h"
 #include "vfio-helpers.h"
diff --git a/hw/vfio/vfio-iommufd.h b/hw/vfio/vfio-iommufd.h
index 6c049d9257..13f412aad7 100644
--- a/hw/vfio/vfio-iommufd.h
+++ b/hw/vfio/vfio-iommufd.h
@@ -9,7 +9,7 @@
 #ifndef HW_VFIO_VFIO_IOMMUFD_H
 #define HW_VFIO_VFIO_IOMMUFD_H
 
-#include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-container.h"
 
 typedef struct VFIODevice VFIODevice;
 
diff --git a/include/hw/vfio/vfio-container-legacy.h b/include/hw/vfio/vfio-container-legacy.h
index ab5130d26e..74a72df018 100644
--- a/include/hw/vfio/vfio-container-legacy.h
+++ b/include/hw/vfio/vfio-container-legacy.h
@@ -9,7 +9,7 @@
 #ifndef HW_VFIO_CONTAINER_LEGACY_H
 #define HW_VFIO_CONTAINER_LEGACY_H
 
-#include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-cpr.h"
 
 typedef struct VFIOLegacyContainer VFIOLegacyContainer;
diff --git a/include/hw/vfio/vfio-container-base.h b/include/hw/vfio/vfio-container.h
similarity index 98%
rename from include/hw/vfio/vfio-container-base.h
rename to include/hw/vfio/vfio-container.h
index b580f4a02d..b8fb2b8b5d 100644
--- a/include/hw/vfio/vfio-container-base.h
+++ b/include/hw/vfio/vfio-container.h
@@ -10,8 +10,8 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#ifndef HW_VFIO_VFIO_CONTAINER_BASE_H
-#define HW_VFIO_VFIO_CONTAINER_BASE_H
+#ifndef HW_VFIO_VFIO_CONTAINER_H
+#define HW_VFIO_VFIO_CONTAINER_H
 
 #include "system/memory.h"
 
@@ -276,4 +276,4 @@ VFIORamDiscardListener *vfio_find_ram_discard_listener(
 void vfio_container_region_add(VFIOContainer *bcontainer,
                                MemoryRegionSection *section, bool cpr_remap);
 
-#endif /* HW_VFIO_VFIO_CONTAINER_BASE_H */
+#endif /* HW_VFIO_VFIO_CONTAINER_H */
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 67b9fcdd2c..ed19e2e1e5 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -27,7 +27,7 @@
 #include <linux/vfio.h>
 #endif
 #include "system/system.h"
-#include "hw/vfio/vfio-container-base.h"
+#include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-cpr.h"
 #include "system/host_iommu_device.h"
 #include "system/iommufd.h"

From a3bcae62b6a161dea4521f254f19c5a8551c28af Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:13 +0100
Subject: [PATCH 0645/2396] hw/vfio/container.c: rename file to
 container-legacy.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This file is mostly concerned with the VFIOLegacyContainer implementation so
rename it to reflect the previous rename of VFIOContainer to
VFIOLegacyContainer.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-6-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/{container.c => container-legacy.c} | 0
 hw/vfio/meson.build                         | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename hw/vfio/{container.c => container-legacy.c} (100%)

diff --git a/hw/vfio/container.c b/hw/vfio/container-legacy.c
similarity index 100%
rename from hw/vfio/container.c
rename to hw/vfio/container-legacy.c
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index d3ed3cb7ac..62b7a7eaac 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -4,7 +4,7 @@ vfio_ss = ss.source_set()
 vfio_ss.add(files(
   'listener.c',
   'container-base.c',
-  'container.c',
+  'container-legacy.c',
   'helpers.c',
 ))
 vfio_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr.c'))

From dcce51b19385ea65ac6db295204716a9eb311fbf Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:14 +0100
Subject: [PATCH 0646/2396] hw/vfio/container-base.c: rename file to
 container.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the file to reflect the previous rename of VFIOContainerBase to
VFIOContainer.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-7-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/{container-base.c => container.c} | 0
 hw/vfio/meson.build                       | 2 +-
 2 files changed, 1 insertion(+), 1 deletion(-)
 rename hw/vfio/{container-base.c => container.c} (100%)

diff --git a/hw/vfio/container-base.c b/hw/vfio/container.c
similarity index 100%
rename from hw/vfio/container-base.c
rename to hw/vfio/container.c
diff --git a/hw/vfio/meson.build b/hw/vfio/meson.build
index 62b7a7eaac..82f68698fb 100644
--- a/hw/vfio/meson.build
+++ b/hw/vfio/meson.build
@@ -3,7 +3,7 @@
 vfio_ss = ss.source_set()
 vfio_ss.add(files(
   'listener.c',
-  'container-base.c',
+  'container.c',
   'container-legacy.c',
   'helpers.c',
 ))

From cc5b394291f428a04ff7a622573c02560b183797 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:15 +0100
Subject: [PATCH 0647/2396] vfio/iommufd.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOIOMMUFDContainer and VFIOContainer instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-8-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 34 ++++++++++++++--------------------
 1 file changed, 14 insertions(+), 20 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 7f2243d9d1..f0ffe23591 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -38,8 +38,7 @@ static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
                             ram_addr_t size, void *vaddr, bool readonly,
                             MemoryRegion *mr)
 {
-    const VFIOIOMMUFDContainer *container =
-        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+    const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
 
     return iommufd_backend_map_dma(container->be,
                                    container->ioas_id,
@@ -50,8 +49,7 @@ static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
                                  hwaddr iova, ram_addr_t size,
                                  int fd, unsigned long start, bool readonly)
 {
-    const VFIOIOMMUFDContainer *container =
-        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+    const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
 
     return iommufd_backend_map_file_dma(container->be,
                                         container->ioas_id,
@@ -62,8 +60,7 @@ static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
                               hwaddr iova, ram_addr_t size,
                               IOMMUTLBEntry *iotlb, bool unmap_all)
 {
-    const VFIOIOMMUFDContainer *container =
-        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+    const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
 
     /* unmap in halves */
     if (unmap_all) {
@@ -162,8 +159,7 @@ static bool iommufd_hwpt_dirty_tracking(VFIOIOASHwpt *hwpt)
 static int iommufd_set_dirty_page_tracking(const VFIOContainer *bcontainer,
                                            bool start, Error **errp)
 {
-    const VFIOIOMMUFDContainer *container =
-        container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+    const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
     VFIOIOASHwpt *hwpt;
 
     QLIST_FOREACH(hwpt, &container->hwpt_list, next) {
@@ -194,9 +190,7 @@ static int iommufd_query_dirty_bitmap(const VFIOContainer *bcontainer,
                                       VFIOBitmap *vbmap, hwaddr iova,
                                       hwaddr size, Error **errp)
 {
-    VFIOIOMMUFDContainer *container = container_of(bcontainer,
-                                                   VFIOIOMMUFDContainer,
-                                                   bcontainer);
+    VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
     unsigned long page_size = qemu_real_host_page_size();
     VFIOIOASHwpt *hwpt;
 
@@ -324,6 +318,7 @@ static bool iommufd_cdev_autodomains_get(VFIODevice *vbasedev,
 {
     ERRP_GUARD();
     IOMMUFDBackend *iommufd = vbasedev->iommufd;
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     uint32_t type, flags = 0;
     uint64_t hw_caps;
     VFIOIOASHwpt *hwpt;
@@ -408,9 +403,9 @@ skip_alloc:
     vbasedev->iommu_dirty_tracking = iommufd_hwpt_dirty_tracking(hwpt);
     QLIST_INSERT_HEAD(&hwpt->device_list, vbasedev, hwpt_next);
     QLIST_INSERT_HEAD(&container->hwpt_list, hwpt, next);
-    container->bcontainer.dirty_pages_supported |=
+    bcontainer->dirty_pages_supported |=
                                 vbasedev->iommu_dirty_tracking;
-    if (container->bcontainer.dirty_pages_supported &&
+    if (bcontainer->dirty_pages_supported &&
         !vbasedev->iommu_dirty_tracking) {
         warn_report("IOMMU instance for device %s doesn't support dirty tracking",
                     vbasedev->name);
@@ -464,7 +459,7 @@ static void iommufd_cdev_detach_container(VFIODevice *vbasedev,
 
 static void iommufd_cdev_container_destroy(VFIOIOMMUFDContainer *container)
 {
-    VFIOContainer *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     if (!QLIST_EMPTY(&bcontainer->device_list)) {
         return;
@@ -486,7 +481,7 @@ static int iommufd_cdev_ram_block_discard_disable(bool state)
 static bool iommufd_cdev_get_info_iova_range(VFIOIOMMUFDContainer *container,
                                              uint32_t ioas_id, Error **errp)
 {
-    VFIOContainer *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
     g_autofree struct iommu_ioas_iova_ranges *info = NULL;
     struct iommu_iova_range *iova_ranges;
     int sz, fd = container->be->fd;
@@ -559,7 +554,7 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
 
     /* try to attach to an existing container in this space */
     QLIST_FOREACH(bcontainer, &space->containers, next) {
-        container = container_of(bcontainer, VFIOIOMMUFDContainer, bcontainer);
+        container = VFIO_IOMMU_IOMMUFD(bcontainer);
         if (VFIO_IOMMU_GET_CLASS(bcontainer) != iommufd_vioc ||
             vbasedev->iommufd != container->be) {
             continue;
@@ -609,7 +604,7 @@ skip_ioas_alloc:
     QLIST_INIT(&container->hwpt_list);
     vbasedev->cpr.ioas_id = ioas_id;
 
-    bcontainer = &container->bcontainer;
+    bcontainer = VFIO_IOMMU(container);
     vfio_address_space_insert(space, bcontainer);
 
     if (!iommufd_cdev_attach_container(vbasedev, container, errp)) {
@@ -689,9 +684,8 @@ static void iommufd_cdev_detach(VFIODevice *vbasedev)
 {
     VFIOContainer *bcontainer = vbasedev->bcontainer;
     VFIOAddressSpace *space = bcontainer->space;
-    VFIOIOMMUFDContainer *container = container_of(bcontainer,
-                                                   VFIOIOMMUFDContainer,
-                                                   bcontainer);
+    VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
+
     vfio_device_unprepare(vbasedev);
 
     if (!vbasedev->ram_block_discard_allowed) {

From 91bdb2f32902c83490cbafe524c82005a64e1f68 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:16 +0100
Subject: [PATCH 0648/2396] vfio/cpr-iommufd.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOIOMMUFDContainer and VFIOContainer instead
of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-9-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-iommufd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 6aaf6f77a2..1d70c87996 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -176,7 +176,7 @@ void vfio_iommufd_cpr_unregister_iommufd(IOMMUFDBackend *be)
 bool vfio_iommufd_cpr_register_container(VFIOIOMMUFDContainer *container,
                                          Error **errp)
 {
-    VFIOContainer *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     migration_add_notifier_mode(&bcontainer->cpr_reboot_notifier,
                                 vfio_cpr_reboot_notifier,
@@ -189,7 +189,7 @@ bool vfio_iommufd_cpr_register_container(VFIOIOMMUFDContainer *container,
 
 void vfio_iommufd_cpr_unregister_container(VFIOIOMMUFDContainer *container)
 {
-    VFIOContainer *bcontainer = &container->bcontainer;
+    VFIOContainer *bcontainer = VFIO_IOMMU(container);
 
     migration_remove_notifier(&bcontainer->cpr_reboot_notifier);
 }

From a7f185cbeca75555a7fa7272afbd3a06bc4f7f66 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:17 +0100
Subject: [PATCH 0649/2396] vfio/vfio-iommufd.h: rename VFIOContainer
 bcontainer field to parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the bcontainer field directly, rename bcontainer to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-10-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/vfio-iommufd.h | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/vfio-iommufd.h b/hw/vfio/vfio-iommufd.h
index 13f412aad7..6b28e1ff7b 100644
--- a/hw/vfio/vfio-iommufd.h
+++ b/hw/vfio/vfio-iommufd.h
@@ -22,12 +22,13 @@ typedef struct VFIOIOASHwpt {
 
 typedef struct IOMMUFDBackend IOMMUFDBackend;
 
-typedef struct VFIOIOMMUFDContainer {
-    VFIOContainer bcontainer;
+struct VFIOIOMMUFDContainer {
+    VFIOContainer parent_obj;
+
     IOMMUFDBackend *be;
     uint32_t ioas_id;
     QLIST_HEAD(, VFIOIOASHwpt) hwpt_list;
-} VFIOIOMMUFDContainer;
+};
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOIOMMUFDContainer, VFIO_IOMMU_IOMMUFD);
 

From 6c671235636cfb5e825040b4621ff06c77925731 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:18 +0100
Subject: [PATCH 0650/2396] vfio/spapr.c: use QOM casts where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use QOM casts to convert between VFIOSpaprContainer and VFIOLegacyContainer
instead of accessing bcontainer directly.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-11-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 19 +++++++------------
 1 file changed, 7 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index acaa9c1419..c883ba6da9 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -61,7 +61,7 @@ static void vfio_prereg_listener_region_add(MemoryListener *listener,
 {
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
-    VFIOLegacyContainer *container = &scontainer->container;
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(scontainer);
     VFIOContainer *bcontainer = VFIO_IOMMU(container);
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
@@ -121,7 +121,7 @@ static void vfio_prereg_listener_region_del(MemoryListener *listener,
 {
     VFIOSpaprContainer *scontainer = container_of(listener, VFIOSpaprContainer,
                                                   prereg_listener);
-    VFIOLegacyContainer *container = &scontainer->container;
+    VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(scontainer);
     const hwaddr gpa = section->offset_within_address_space;
     hwaddr end;
     int ret;
@@ -245,8 +245,7 @@ static bool vfio_spapr_create_window(VFIOLegacyContainer *container,
 {
     int ret = 0;
     VFIOContainer *bcontainer = VFIO_IOMMU(container);
-    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                  container);
+    VFIOSpaprContainer *scontainer = VFIO_IOMMU_SPAPR(bcontainer);
     IOMMUMemoryRegion *iommu_mr = IOMMU_MEMORY_REGION(section->mr);
     uint64_t pagesize = memory_region_iommu_get_min_page_size(iommu_mr), pgmask;
     unsigned entries, bits_total, bits_per_level, max_levels, ddw_levels;
@@ -353,8 +352,7 @@ vfio_spapr_container_add_section_window(VFIOContainer *bcontainer,
                                         Error **errp)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
-    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                  container);
+    VFIOSpaprContainer *scontainer = VFIO_IOMMU_SPAPR(container);
     VFIOHostDMAWindow *hostwin;
     hwaddr pgsize = 0;
     int ret;
@@ -443,8 +441,7 @@ vfio_spapr_container_del_section_window(VFIOContainer *bcontainer,
                                         MemoryRegionSection *section)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
-    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                  container);
+    VFIOSpaprContainer *scontainer = VFIO_IOMMU_SPAPR(container);
 
     if (container->iommu_type != VFIO_SPAPR_TCE_v2_IOMMU) {
         return;
@@ -464,8 +461,7 @@ vfio_spapr_container_del_section_window(VFIOContainer *bcontainer,
 static void vfio_spapr_container_release(VFIOContainer *bcontainer)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
-    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                  container);
+    VFIOSpaprContainer *scontainer = VFIO_IOMMU_SPAPR(container);
     VFIOHostDMAWindow *hostwin, *next;
 
     if (container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU) {
@@ -482,8 +478,7 @@ static bool vfio_spapr_container_setup(VFIOContainer *bcontainer,
                                        Error **errp)
 {
     VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
-    VFIOSpaprContainer *scontainer = container_of(container, VFIOSpaprContainer,
-                                                  container);
+    VFIOSpaprContainer *scontainer = VFIO_IOMMU_SPAPR(container);
     struct vfio_iommu_spapr_tce_info info;
     bool v2 = container->iommu_type == VFIO_SPAPR_TCE_v2_IOMMU;
     int ret, fd = container->fd;

From 1bd06d0385eb72bb54aa14af34e8361ec3ae8cee Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:19 +0100
Subject: [PATCH 0651/2396] vfio/spapr.c: rename VFIOContainer bcontainer field
 to parent_obj
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that nothing accesses the bcontainer field directly, rename bcontainer to
parent_obj as per our current coding guidelines.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-12-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/spapr.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index c883ba6da9..8d9d68da4e 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -30,12 +30,13 @@ typedef struct VFIOHostDMAWindow {
     QLIST_ENTRY(VFIOHostDMAWindow) hostwin_next;
 } VFIOHostDMAWindow;
 
-typedef struct VFIOSpaprContainer {
-    VFIOLegacyContainer container;
+struct VFIOSpaprContainer {
+    VFIOLegacyContainer parent_obj;
+
     MemoryListener prereg_listener;
     QLIST_HEAD(, VFIOHostDMAWindow) hostwin_list;
     unsigned int levels;
-} VFIOSpaprContainer;
+};
 
 OBJECT_DECLARE_SIMPLE_TYPE(VFIOSpaprContainer, VFIO_IOMMU_SPAPR);
 

From d5db50dd819142748e10e488a2288052ec0235fd Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:20 +0100
Subject: [PATCH 0652/2396] vfio/pci.c: rename vfio_instance_init() to
 vfio_pci_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the more typical naming convention for QOM init() functions, in
particular it changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-13-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index bc0b4c4d56..493f9da45d 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3625,7 +3625,7 @@ post_reset:
     vfio_pci_post_reset(vdev);
 }
 
-static void vfio_instance_init(Object *obj)
+static void vfio_pci_init(Object *obj)
 {
     PCIDevice *pci_dev = PCI_DEVICE(obj);
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
@@ -3916,7 +3916,7 @@ static const TypeInfo vfio_pci_dev_info = {
     .name = TYPE_VFIO_PCI,
     .parent = TYPE_VFIO_PCI_BASE,
     .class_init = vfio_pci_dev_class_init,
-    .instance_init = vfio_instance_init,
+    .instance_init = vfio_pci_init,
     .instance_finalize = vfio_instance_finalize,
 };
 

From e6fd80873a24883dc204d09f11c16e30c8cd1c37 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:21 +0100
Subject: [PATCH 0653/2396] vfio/pci.c: rename vfio_instance_finalize() to
 vfio_pci_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the more typical naming convention for QOM finalize() functions, in
particular it changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-14-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 493f9da45d..90458bc3cc 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3550,7 +3550,7 @@ error:
     error_prepend(errp, VFIO_MSG_PREFIX, vbasedev->name);
 }
 
-static void vfio_instance_finalize(Object *obj)
+static void vfio_pci_finalize(Object *obj)
 {
     VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
 
@@ -3917,7 +3917,7 @@ static const TypeInfo vfio_pci_dev_info = {
     .parent = TYPE_VFIO_PCI_BASE,
     .class_init = vfio_pci_dev_class_init,
     .instance_init = vfio_pci_init,
-    .instance_finalize = vfio_instance_finalize,
+    .instance_finalize = vfio_pci_finalize,
 };
 
 static const Property vfio_pci_dev_nohotplug_properties[] = {

From 784fa15f02fc0adbf8897f5c3012652174cc7274 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:22 +0100
Subject: [PATCH 0654/2396] vfio/pci.c: rename vfio_pci_dev_class_init() to
 vfio_pci_class_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the function prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-15-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 90458bc3cc..1fd087de3c 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3763,7 +3763,7 @@ static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
 }
 #endif
 
-static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
+static void vfio_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
@@ -3915,7 +3915,7 @@ static void vfio_pci_dev_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo vfio_pci_dev_info = {
     .name = TYPE_VFIO_PCI,
     .parent = TYPE_VFIO_PCI_BASE,
-    .class_init = vfio_pci_dev_class_init,
+    .class_init = vfio_pci_class_init,
     .instance_init = vfio_pci_init,
     .instance_finalize = vfio_pci_finalize,
 };

From 25c8376b37948d7608b1a13f43e985fc801295e5 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:23 +0100
Subject: [PATCH 0655/2396] vfio/pci.c: rename vfio_pci_dev_info to
 vfio_pci_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-16-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 1fd087de3c..479def72c5 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3912,7 +3912,7 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
                                           "multifd channels");
 }
 
-static const TypeInfo vfio_pci_dev_info = {
+static const TypeInfo vfio_pci_info = {
     .name = TYPE_VFIO_PCI,
     .parent = TYPE_VFIO_PCI_BASE,
     .class_init = vfio_pci_class_init,
@@ -3970,7 +3970,7 @@ static void register_vfio_pci_dev_type(void)
     vfio_pci_migration_multifd_transfer_prop.realized_set_allowed = true;
 
     type_register_static(&vfio_pci_base_dev_info);
-    type_register_static(&vfio_pci_dev_info);
+    type_register_static(&vfio_pci_info);
     type_register_static(&vfio_pci_nohotplug_dev_info);
 }
 

From af2a8bfb3cd38cceb39a152ff33c7daa4c81c506 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:24 +0100
Subject: [PATCH 0656/2396] hw/vfio/types.h: rename TYPE_VFIO_PCI_BASE to
 TYPE_VFIO_PCI_DEVICE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This brings the QOM type name in line with the underlying VFIOPCIDevice structure.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-17-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/s390x/s390-pci-vfio.c | 14 +++++++-------
 hw/vfio-user/pci.c       | 13 +++++++------
 hw/vfio/device.c         |  2 +-
 hw/vfio/pci.c            | 28 ++++++++++++++--------------
 hw/vfio/pci.h            |  2 +-
 hw/vfio/types.h          |  4 ++--
 6 files changed, 32 insertions(+), 31 deletions(-)

diff --git a/hw/s390x/s390-pci-vfio.c b/hw/s390x/s390-pci-vfio.c
index 7760780aff..9e31029d7a 100644
--- a/hw/s390x/s390-pci-vfio.c
+++ b/hw/s390x/s390-pci-vfio.c
@@ -62,7 +62,7 @@ S390PCIDMACount *s390_pci_start_dma_count(S390pciState *s,
 {
     S390PCIDMACount *cnt;
     uint32_t avail;
-    VFIOPCIDevice *vpdev = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpdev = VFIO_PCI_DEVICE(pbdev->pdev);
     int id;
 
     assert(vpdev);
@@ -108,7 +108,7 @@ static void s390_pci_read_base(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_base *cap;
-    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_DEVICE(pbdev->pdev);
     uint64_t vfio_size;
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_BASE);
@@ -162,7 +162,7 @@ static bool get_host_fh(S390PCIBusDevice *pbdev, struct vfio_device_info *info,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_base *cap;
-    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_DEVICE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_BASE);
 
@@ -185,7 +185,7 @@ static void s390_pci_read_group(S390PCIBusDevice *pbdev,
     struct vfio_device_info_cap_zpci_group *cap;
     S390pciState *s = s390_get_phb();
     ClpRspQueryPciGrp *resgrp;
-    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_DEVICE(pbdev->pdev);
     uint8_t start_gid = pbdev->zpci_fn.pfgid;
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_GROUP);
@@ -264,7 +264,7 @@ static void s390_pci_read_util(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_util *cap;
-    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_DEVICE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_UTIL);
 
@@ -291,7 +291,7 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
 {
     struct vfio_info_cap_header *hdr;
     struct vfio_device_info_cap_zpci_pfip *cap;
-    VFIOPCIDevice *vpci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vpci = VFIO_PCI_DEVICE(pbdev->pdev);
 
     hdr = vfio_get_device_info_cap(info, VFIO_DEVICE_INFO_CAP_ZPCI_PFIP);
 
@@ -314,7 +314,7 @@ static void s390_pci_read_pfip(S390PCIBusDevice *pbdev,
 
 static struct vfio_device_info *get_device_info(S390PCIBusDevice *pbdev)
 {
-    VFIOPCIDevice *vfio_pci = VFIO_PCI_BASE(pbdev->pdev);
+    VFIOPCIDevice *vfio_pci = VFIO_PCI_DEVICE(pbdev->pdev);
 
     return vfio_get_device_info(vfio_pci->vbasedev.fd);
 }
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index e2c309784f..efceae69de 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -234,9 +234,10 @@ static void vfio_user_pci_realize(PCIDevice *pdev, Error **errp)
 {
     ERRP_GUARD();
     VFIOUserPCIDevice *udev = VFIO_USER_PCI(pdev);
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     const char *sock_name;
+
     AddressSpace *as;
     SocketAddress addr;
     VFIOUserProxy *proxy;
@@ -346,7 +347,7 @@ error:
 static void vfio_user_instance_init(Object *obj)
 {
     PCIDevice *pci_dev = PCI_DEVICE(obj);
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     device_add_bootindex_property(obj, &vdev->bootindex,
@@ -371,7 +372,7 @@ static void vfio_user_instance_init(Object *obj)
 
 static void vfio_user_instance_finalize(Object *obj)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     if (vdev->msix != NULL) {
@@ -387,7 +388,7 @@ static void vfio_user_instance_finalize(Object *obj)
 
 static void vfio_user_pci_reset(DeviceState *dev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(dev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(dev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     vfio_pci_pre_reset(vdev);
@@ -421,7 +422,7 @@ static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
     VFIOUserPCIDevice *udev = VFIO_USER_PCI(obj);
     bool success;
 
-    if (VFIO_PCI_BASE(udev)->vbasedev.proxy) {
+    if (VFIO_PCI_DEVICE(udev)->vbasedev.proxy) {
         error_setg(errp, "Proxy is connected");
         return;
     }
@@ -464,7 +465,7 @@ static void vfio_user_pci_dev_class_init(ObjectClass *klass, const void *data)
 
 static const TypeInfo vfio_user_pci_dev_info = {
     .name = TYPE_VFIO_USER_PCI,
-    .parent = TYPE_VFIO_PCI_BASE,
+    .parent = TYPE_VFIO_PCI_DEVICE,
     .instance_size = sizeof(VFIOUserPCIDevice),
     .class_init = vfio_user_pci_dev_class_init,
     .instance_init = vfio_user_instance_init,
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 963cefc053..64f8750389 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -423,7 +423,7 @@ bool vfio_device_hiod_create_and_realize(VFIODevice *vbasedev,
 VFIODevice *vfio_get_vfio_device(Object *obj)
 {
     if (object_dynamic_cast(obj, TYPE_VFIO_PCI)) {
-        return &VFIO_PCI_BASE(obj)->vbasedev;
+        return &VFIO_PCI_DEVICE(obj)->vbasedev;
     } else {
         return NULL;
     }
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 479def72c5..aa9d3e0354 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -305,7 +305,7 @@ static void vfio_intx_update(VFIOPCIDevice *vdev, PCIINTxRoute *route)
 
 static void vfio_intx_routing_notifier(PCIDevice *pdev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     PCIINTxRoute route;
 
     if (vdev->interrupt != VFIO_INT_INTx) {
@@ -660,7 +660,7 @@ void vfio_pci_vector_init(VFIOPCIDevice *vdev, int nr)
 static int vfio_msix_vector_do_use(PCIDevice *pdev, unsigned int nr,
                                    MSIMessage *msg, IOHandler *handler)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIOMSIVector *vector;
     int ret;
     bool resizing = !!(vdev->nr_vectors < nr + 1);
@@ -755,7 +755,7 @@ static int vfio_msix_vector_use(PCIDevice *pdev,
 
 static void vfio_msix_vector_release(PCIDevice *pdev, unsigned int nr)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIOMSIVector *vector = &vdev->msi_vectors[nr];
 
     trace_vfio_msix_vector_release(vdev->vbasedev.name, nr);
@@ -1346,7 +1346,7 @@ static const MemoryRegionOps vfio_vga_ops = {
  */
 static void vfio_sub_page_bar_update_mapping(PCIDevice *pdev, int bar)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIORegion *region = &vdev->bars[bar].region;
     MemoryRegion *mmap_mr, *region_mr, *base_mr;
     PCIIORegion *r;
@@ -1392,7 +1392,7 @@ static void vfio_sub_page_bar_update_mapping(PCIDevice *pdev, int bar)
  */
 uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t emu_bits = 0, emu_val = 0, phys_val = 0, val;
 
@@ -1426,7 +1426,7 @@ uint32_t vfio_pci_read_config(PCIDevice *pdev, uint32_t addr, int len)
 void vfio_pci_write_config(PCIDevice *pdev,
                            uint32_t addr, uint32_t val, int len)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     uint32_t val_le = cpu_to_le32(val);
     int ret;
@@ -3392,7 +3392,7 @@ bool vfio_pci_interrupt_setup(VFIOPCIDevice *vdev, Error **errp)
 static void vfio_pci_realize(PCIDevice *pdev, Error **errp)
 {
     ERRP_GUARD();
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
     int i;
     char uuid[UUID_STR_LEN];
@@ -3552,14 +3552,14 @@ error:
 
 static void vfio_pci_finalize(Object *obj)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
 
     vfio_pci_put_device(vdev);
 }
 
 static void vfio_exitfn(PCIDevice *pdev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(pdev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(pdev);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     vfio_unregister_req_notifier(vdev);
@@ -3583,7 +3583,7 @@ static void vfio_exitfn(PCIDevice *pdev)
 
 static void vfio_pci_reset(DeviceState *dev)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(dev);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(dev);
 
     /* Do not reset the device during qemu_system_reset prior to cpr load */
     if (cpr_is_incoming()) {
@@ -3628,7 +3628,7 @@ post_reset:
 static void vfio_pci_init(Object *obj)
 {
     PCIDevice *pci_dev = PCI_DEVICE(obj);
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
 
     device_add_bootindex_property(obj, &vdev->bootindex,
@@ -3669,7 +3669,7 @@ static void vfio_pci_base_dev_class_init(ObjectClass *klass, const void *data)
 }
 
 static const TypeInfo vfio_pci_base_dev_info = {
-    .name = TYPE_VFIO_PCI_BASE,
+    .name = TYPE_VFIO_PCI_DEVICE,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(VFIOPCIDevice),
     .abstract = true,
@@ -3758,7 +3758,7 @@ static const Property vfio_pci_dev_properties[] = {
 #ifdef CONFIG_IOMMUFD
 static void vfio_pci_set_fd(Object *obj, const char *str, Error **errp)
 {
-    VFIOPCIDevice *vdev = VFIO_PCI_BASE(obj);
+    VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
     vfio_device_set_fd(&vdev->vbasedev, str, errp);
 }
 #endif
@@ -3914,7 +3914,7 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
 
 static const TypeInfo vfio_pci_info = {
     .name = TYPE_VFIO_PCI,
-    .parent = TYPE_VFIO_PCI_BASE,
+    .parent = TYPE_VFIO_PCI_DEVICE,
     .class_init = vfio_pci_class_init,
     .instance_init = vfio_pci_init,
     .instance_finalize = vfio_pci_finalize,
diff --git a/hw/vfio/pci.h b/hw/vfio/pci.h
index e0aef82a89..0f78cf9cdb 100644
--- a/hw/vfio/pci.h
+++ b/hw/vfio/pci.h
@@ -120,7 +120,7 @@ typedef struct VFIOMSIXInfo {
     MemoryRegion *pba_region;
 } VFIOMSIXInfo;
 
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_BASE)
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOPCIDevice, VFIO_PCI_DEVICE)
 
 struct VFIOPCIDevice {
     PCIDevice parent_obj;
diff --git a/hw/vfio/types.h b/hw/vfio/types.h
index c19334ff25..5482d90808 100644
--- a/hw/vfio/types.h
+++ b/hw/vfio/types.h
@@ -9,11 +9,11 @@
 #define HW_VFIO_VFIO_TYPES_H
 
 /*
- * TYPE_VFIO_PCI_BASE is an abstract type used to share code
+ * TYPE_VFIO_PCI_DEVICE is an abstract type used to share code
  * between VFIO implementations that use a kernel driver
  * with those that use user sockets.
  */
-#define TYPE_VFIO_PCI_BASE "vfio-pci-base"
+#define TYPE_VFIO_PCI_DEVICE "vfio-pci-device"
 
 #define TYPE_VFIO_PCI "vfio-pci"
 /* TYPE_VFIO_PCI shares struct VFIOPCIDevice. */

From 153273f2796a664b08120799f326c6319f640011 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:25 +0100
Subject: [PATCH 0657/2396] vfio/pci.c: rename vfio_pci_base_dev_class_init()
 to vfio_pci_device_class_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the function prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-18-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index aa9d3e0354..9278b46711 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3656,7 +3656,7 @@ static void vfio_pci_init(Object *obj)
     pci_dev->cap_present |= QEMU_PCI_SKIP_RESET_ON_CPR;
 }
 
-static void vfio_pci_base_dev_class_init(ObjectClass *klass, const void *data)
+static void vfio_pci_device_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
@@ -3673,7 +3673,7 @@ static const TypeInfo vfio_pci_base_dev_info = {
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(VFIOPCIDevice),
     .abstract = true,
-    .class_init = vfio_pci_base_dev_class_init,
+    .class_init = vfio_pci_device_class_init,
     .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_PCIE_DEVICE },
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },

From 596b158ffd727465fbeb9fff9a22b7ea7a341bc3 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:26 +0100
Subject: [PATCH 0658/2396] vfio/pci.c: rename vfio_pci_base_dev_info to
 vfio_pci_device_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-19-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9278b46711..6c4c47825b 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3668,7 +3668,7 @@ static void vfio_pci_device_class_init(ObjectClass *klass, const void *data)
     pdc->config_write = vfio_pci_write_config;
 }
 
-static const TypeInfo vfio_pci_base_dev_info = {
+static const TypeInfo vfio_pci_device_info = {
     .name = TYPE_VFIO_PCI_DEVICE,
     .parent = TYPE_PCI_DEVICE,
     .instance_size = sizeof(VFIOPCIDevice),
@@ -3969,7 +3969,7 @@ static void register_vfio_pci_dev_type(void)
     vfio_pci_migration_multifd_transfer_prop = qdev_prop_on_off_auto;
     vfio_pci_migration_multifd_transfer_prop.realized_set_allowed = true;
 
-    type_register_static(&vfio_pci_base_dev_info);
+    type_register_static(&vfio_pci_device_info);
     type_register_static(&vfio_pci_info);
     type_register_static(&vfio_pci_nohotplug_dev_info);
 }

From 7c53e1f43ee365ee5061dd30d60c21a55eefbfce Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:27 +0100
Subject: [PATCH 0659/2396] vfio/pci.c: rename vfio_pci_dev_properties[] to
 vfio_pci_properties[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-20-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6c4c47825b..9c3bb3725c 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3683,7 +3683,7 @@ static const TypeInfo vfio_pci_device_info = {
 
 static PropertyInfo vfio_pci_migration_multifd_transfer_prop;
 
-static const Property vfio_pci_dev_properties[] = {
+static const Property vfio_pci_properties[] = {
     DEFINE_PROP_PCI_HOST_DEVADDR("host", VFIOPCIDevice, host),
     DEFINE_PROP_UUID_NODEFAULT("vf-token", VFIOPCIDevice, vf_token),
     DEFINE_PROP_STRING("sysfsdev", VFIOPCIDevice, vbasedev.sysfsdev),
@@ -3769,7 +3769,7 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
 
     device_class_set_legacy_reset(dc, vfio_pci_reset);
-    device_class_set_props(dc, vfio_pci_dev_properties);
+    device_class_set_props(dc, vfio_pci_properties);
 #ifdef CONFIG_IOMMUFD
     object_class_property_add_str(klass, "fd", NULL, vfio_pci_set_fd);
 #endif

From 05530ba2462f37fd55d72bdab31a7a5c29ab7519 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:28 +0100
Subject: [PATCH 0660/2396] vfio/pci.c: rename
 vfio_pci_dev_nohotplug_properties[] to vfio_pci_nohotplug_properties[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-21-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 9c3bb3725c..6b3c97c56c 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3920,7 +3920,7 @@ static const TypeInfo vfio_pci_info = {
     .instance_finalize = vfio_pci_finalize,
 };
 
-static const Property vfio_pci_dev_nohotplug_properties[] = {
+static const Property vfio_pci_nohotplug_properties[] = {
     DEFINE_PROP_BOOL("ramfb", VFIOPCIDevice, enable_ramfb, false),
     DEFINE_PROP_BOOL("use-legacy-x86-rom", VFIOPCIDevice,
                      use_legacy_x86_rom, false),
@@ -3933,7 +3933,7 @@ static void vfio_pci_nohotplug_dev_class_init(ObjectClass *klass,
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    device_class_set_props(dc, vfio_pci_dev_nohotplug_properties);
+    device_class_set_props(dc, vfio_pci_nohotplug_properties);
     dc->hotpluggable = false;
 
     object_class_property_set_description(klass, /* 3.1 */

From cc44b39c274b35f1510725f60dd95af59d0bd3fb Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:29 +0100
Subject: [PATCH 0661/2396] vfio/pci.c: rename
 vfio_pci_nohotplug_dev_class_init() to vfio_pci_nohotplug_class_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the function prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-22-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 6b3c97c56c..10313edc7e 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3928,7 +3928,7 @@ static const Property vfio_pci_nohotplug_properties[] = {
                             ON_OFF_AUTO_AUTO),
 };
 
-static void vfio_pci_nohotplug_dev_class_init(ObjectClass *klass,
+static void vfio_pci_nohotplug_class_init(ObjectClass *klass,
                                               const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -3953,7 +3953,7 @@ static const TypeInfo vfio_pci_nohotplug_dev_info = {
     .name = TYPE_VFIO_PCI_NOHOTPLUG,
     .parent = TYPE_VFIO_PCI,
     .instance_size = sizeof(VFIOPCIDevice),
-    .class_init = vfio_pci_nohotplug_dev_class_init,
+    .class_init = vfio_pci_nohotplug_class_init,
 };
 
 static void register_vfio_pci_dev_type(void)

From 5bdf0db823869a210434b5048d20dce5e686b7aa Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:30 +0100
Subject: [PATCH 0662/2396] vfio/pci.c: rename vfio_pci_nohotplug_dev_info to
 vfio_pci_nohotplug_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-23-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 10313edc7e..5b022da19e 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3949,7 +3949,7 @@ static void vfio_pci_nohotplug_class_init(ObjectClass *klass,
                                           "Controls loading of a legacy VGA BIOS ROM");
 }
 
-static const TypeInfo vfio_pci_nohotplug_dev_info = {
+static const TypeInfo vfio_pci_nohotplug_info = {
     .name = TYPE_VFIO_PCI_NOHOTPLUG,
     .parent = TYPE_VFIO_PCI,
     .instance_size = sizeof(VFIOPCIDevice),
@@ -3971,7 +3971,7 @@ static void register_vfio_pci_dev_type(void)
 
     type_register_static(&vfio_pci_device_info);
     type_register_static(&vfio_pci_info);
-    type_register_static(&vfio_pci_nohotplug_dev_info);
+    type_register_static(&vfio_pci_nohotplug_info);
 }
 
 type_init(register_vfio_pci_dev_type)

From c833f7a5c66e1264bfaaa389467c5af8d9c49082 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:31 +0100
Subject: [PATCH 0663/2396] vfio-user/pci.c: rename
 vfio_user_pci_dev_class_init() to vfio_user_pci_class_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the function prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-24-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index efceae69de..e2c5b5744c 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -446,7 +446,7 @@ static void vfio_user_pci_set_socket(Object *obj, Visitor *v, const char *name,
     }
 }
 
-static void vfio_user_pci_dev_class_init(ObjectClass *klass, const void *data)
+static void vfio_user_pci_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
@@ -467,7 +467,7 @@ static const TypeInfo vfio_user_pci_dev_info = {
     .name = TYPE_VFIO_USER_PCI,
     .parent = TYPE_VFIO_PCI_DEVICE,
     .instance_size = sizeof(VFIOUserPCIDevice),
-    .class_init = vfio_user_pci_dev_class_init,
+    .class_init = vfio_user_pci_class_init,
     .instance_init = vfio_user_instance_init,
     .instance_finalize = vfio_user_instance_finalize,
 };

From 78f4b77607b41909c294f15ae4e51d87e36aab4f Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:32 +0100
Subject: [PATCH 0664/2396] vfio-user/pci.c: rename
 vfio_user_pci_dev_properties[] to vfio_user_pci_properties[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-25-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index e2c5b5744c..30f485fdbb 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -400,7 +400,7 @@ static void vfio_user_pci_reset(DeviceState *dev)
     vfio_pci_post_reset(vdev);
 }
 
-static const Property vfio_user_pci_dev_properties[] = {
+static const Property vfio_user_pci_properties[] = {
     DEFINE_PROP_UINT32("x-pci-vendor-id", VFIOPCIDevice,
                        vendor_id, PCI_ANY_ID),
     DEFINE_PROP_UINT32("x-pci-device-id", VFIOPCIDevice,
@@ -452,7 +452,7 @@ static void vfio_user_pci_class_init(ObjectClass *klass, const void *data)
     PCIDeviceClass *pdc = PCI_DEVICE_CLASS(klass);
 
     device_class_set_legacy_reset(dc, vfio_user_pci_reset);
-    device_class_set_props(dc, vfio_user_pci_dev_properties);
+    device_class_set_props(dc, vfio_user_pci_properties);
 
     object_class_property_add(klass, "socket", "SocketAddress", NULL,
                               vfio_user_pci_set_socket, NULL, NULL);

From de837b5cbd489410aab1eda00b4b50e45a85d5d6 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:33 +0100
Subject: [PATCH 0665/2396] vfio-user/pci.c: rename vfio_user_instance_init()
 to vfio_user_pci_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the more typical naming convention for QOM init() functions, in
particular it changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-26-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 30f485fdbb..52561900fd 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -344,7 +344,7 @@ error:
     vfio_pci_put_device(vdev);
 }
 
-static void vfio_user_instance_init(Object *obj)
+static void vfio_user_pci_init(Object *obj)
 {
     PCIDevice *pci_dev = PCI_DEVICE(obj);
     VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
@@ -468,7 +468,7 @@ static const TypeInfo vfio_user_pci_dev_info = {
     .parent = TYPE_VFIO_PCI_DEVICE,
     .instance_size = sizeof(VFIOUserPCIDevice),
     .class_init = vfio_user_pci_class_init,
-    .instance_init = vfio_user_instance_init,
+    .instance_init = vfio_user_pci_init,
     .instance_finalize = vfio_user_instance_finalize,
 };
 

From d5447437aef2d326728e0ad1590a5fa50c0b33a3 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:34 +0100
Subject: [PATCH 0666/2396] vfio-user/pci.c: rename
 vfio_user_instance_finalize() to vfio_user_pci_finalize()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is the more typical naming convention for QOM finalize() functions, in
particular it changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-27-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index 52561900fd..d4f5c7b9d7 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -370,7 +370,7 @@ static void vfio_user_pci_init(Object *obj)
     pci_dev->cap_present |= QEMU_PCI_CAP_EXPRESS;
 }
 
-static void vfio_user_instance_finalize(Object *obj)
+static void vfio_user_pci_finalize(Object *obj)
 {
     VFIOPCIDevice *vdev = VFIO_PCI_DEVICE(obj);
     VFIODevice *vbasedev = &vdev->vbasedev;
@@ -469,7 +469,7 @@ static const TypeInfo vfio_user_pci_dev_info = {
     .instance_size = sizeof(VFIOUserPCIDevice),
     .class_init = vfio_user_pci_class_init,
     .instance_init = vfio_user_pci_init,
-    .instance_finalize = vfio_user_instance_finalize,
+    .instance_finalize = vfio_user_pci_finalize,
 };
 
 static void register_vfio_user_dev_type(void)

From d0776b8c60fcc5833fba1d2ce8e0780c429108bc Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:35 +0100
Subject: [PATCH 0667/2396] vfio-user/pci.c: rename vfio_user_pci_dev_info to
 vfio_user_pci_info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This changes the prefix to match the name of the QOM type.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-28-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/pci.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index d4f5c7b9d7..b53ed3b456 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -463,7 +463,7 @@ static void vfio_user_pci_class_init(ObjectClass *klass, const void *data)
     pdc->realize = vfio_user_pci_realize;
 }
 
-static const TypeInfo vfio_user_pci_dev_info = {
+static const TypeInfo vfio_user_pci_info = {
     .name = TYPE_VFIO_USER_PCI,
     .parent = TYPE_VFIO_PCI_DEVICE,
     .instance_size = sizeof(VFIOUserPCIDevice),
@@ -474,7 +474,7 @@ static const TypeInfo vfio_user_pci_dev_info = {
 
 static void register_vfio_user_dev_type(void)
 {
-    type_register_static(&vfio_user_pci_dev_info);
+    type_register_static(&vfio_user_pci_info);
 }
 
- type_init(register_vfio_user_dev_type)
+type_init(register_vfio_user_dev_type)

From 7c773b4267ae10820ed5e3ec6b15219b39dbcebd Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 25 Sep 2025 12:31:36 +0100
Subject: [PATCH 0668/2396] include/hw/vfio/vfio-device.h: fix include header
 guard name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The header guard was incorrectly called HW_VFIO_VFIO_COMMON_H instead of
HW_VFIO_VFIO_DEVICE_H.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20250925113159.1760317-29-mark.caveayland@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/vfio/vfio-device.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index ed19e2e1e5..7e9aed6d3c 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -18,8 +18,8 @@
  *  Copyright (C) 2008, IBM, Muli Ben-Yehuda (muli@il.ibm.com)
  */
 
-#ifndef HW_VFIO_VFIO_COMMON_H
-#define HW_VFIO_VFIO_COMMON_H
+#ifndef HW_VFIO_VFIO_DEVICE_H
+#define HW_VFIO_VFIO_DEVICE_H
 
 #include "system/memory.h"
 #include "qemu/queue.h"
@@ -288,4 +288,4 @@ void vfio_device_init(VFIODevice *vbasedev, int type, VFIODeviceOps *ops,
 int vfio_device_get_aw_bits(VFIODevice *vdev);
 
 void vfio_kvm_device_close(void);
-#endif /* HW_VFIO_VFIO_COMMON_H */
+#endif /* HW_VFIO_VFIO_DEVICE_H */

From 5a449678d6594b70d3ead9ad78b47d76eb95a91e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 22 Sep 2025 10:36:47 +0100
Subject: [PATCH 0669/2396] scripts/ci: add gitlab-failure-analysis script
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a script designed to collect data from multiple pipelines and
analyse the failure modes they have. By default it will probe the last
3 failed jobs on the staging branch. However this can all be
controlled by the CLI:

  ./scripts/ci/gitlab-failure-analysis --count 2 --branch=testing/next --id 39915562 --status=
  running pipeline 2028486060, total jobs 125, skipped 5, failed 0,  39742 tests, 0 failed tests
  success pipeline 2015018135, total jobs 125, skipped 5, failed 0,  49219 tests, 0 failed tests

You can also skip failing jobs and just dump the tests:

  ./scripts/ci/gitlab-failure-analysis --branch= --id 39915562 --status= --skip-jobs --pipeline 1946202491 1919542960
  failed pipeline 1946202491, total jobs 127, skipped 5, failed 26,  38742 tests, 278 skipped tests, 2 failed tests
    Failed test qemu.qemu:qtest+qtest-s390x / qtest-s390x/boot-serial-test, check-system-opensuse, 1 /s390x/boot-serial/s390-ccw-virtio - FATAL-ERROR: Failed to find expected string. Please check '/tmp/qtest-boot-serial-sW77EA3'
    Failed test qemu.qemu:qtest+qtest-aarch64 / qtest-aarch64/arm-cpu-features, check-system-opensuse, 1 /aarch64/arm/query-cpu-model-expansion - ERROR:../tests/qtest/arm-cpu-features.c:459:test_query_cpu_model_expansion: assertion failed (_error == "The CPU type 'host' requires KVM"): ("The CPU type 'host' requires hardware accelerator" == "The CPU type 'host' requires KVM")
  failed pipeline 1919542960, total jobs 127, skipped 5, failed 2,  48753 tests, 441 skipped tests, 1 failed tests
    Failed test qemu.qemu:unit / test-aio, msys2-64bit, 12 /aio/timer/schedule - ERROR:../tests/unit/test-aio.c:413:test_timer_schedule: assertion failed: (aio_poll(ctx, true))

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-3-alex.bennee@linaro.org>
---
 scripts/ci/gitlab-failure-analysis | 117 +++++++++++++++++++++++++++++
 1 file changed, 117 insertions(+)
 create mode 100755 scripts/ci/gitlab-failure-analysis

diff --git a/scripts/ci/gitlab-failure-analysis b/scripts/ci/gitlab-failure-analysis
new file mode 100755
index 0000000000..906725be97
--- /dev/null
+++ b/scripts/ci/gitlab-failure-analysis
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+#
+# A script to analyse failures in the gitlab pipelines. It requires an
+# API key from gitlab with the following permissions:
+#  - api
+#  - read_repository
+#  - read_user
+#
+
+import argparse
+import gitlab
+import os
+
+#
+# Arguments
+#
+class NoneForEmptyStringAction(argparse.Action):
+    def __call__(self, parser, namespace, value, option_string=None):
+        if value == '':
+            setattr(namespace, self.dest, None)
+        else:
+            setattr(namespace, self.dest, value)
+
+
+parser = argparse.ArgumentParser(description="Analyse failed GitLab CI runs.")
+
+parser.add_argument("--gitlab",
+                    default="https://gitlab.com",
+                    help="GitLab instance URL (default: https://gitlab.com).")
+parser.add_argument("--id", default=11167699,
+                    type=int,
+                    help="GitLab project id (default: 11167699 for qemu-project/qemu)")
+parser.add_argument("--token",
+                    default=os.getenv("GITLAB_TOKEN"),
+                    help="Your personal access token with 'api' scope.")
+parser.add_argument("--branch",
+                    type=str,
+                    default="staging",
+                    action=NoneForEmptyStringAction,
+                    help="The name of the branch (default: 'staging')")
+parser.add_argument("--status",
+                    type=str,
+                    action=NoneForEmptyStringAction,
+                    default="failed",
+                    help="Filter by branch status (default: 'failed')")
+parser.add_argument("--count", type=int,
+                    default=3,
+                    help="The number of failed runs to fetch.")
+parser.add_argument("--skip-jobs",
+                    default=False,
+                    action='store_true',
+                    help="Skip dumping the job info")
+parser.add_argument("--pipeline", type=int,
+                    nargs="+",
+                    default=None,
+                    help="Explicit pipeline ID(s) to fetch.")
+
+
+if __name__ == "__main__":
+    args = parser.parse_args()
+
+    gl = gitlab.Gitlab(url=args.gitlab, private_token=args.token)
+    project = gl.projects.get(args.id)
+
+
+    pipelines_to_process = []
+
+    # Use explicit pipeline IDs if provided, otherwise fetch a list
+    if args.pipeline:
+        args.count = len(args.pipeline)
+        for p_id in args.pipeline:
+            pipelines_to_process.append(project.pipelines.get(p_id))
+    else:
+        # Use an iterator to fetch the pipelines
+        pipe_iter = project.pipelines.list(iterator=True,
+                                           status=args.status,
+                                           ref=args.branch)
+        # Check each failed pipeline
+        pipelines_to_process = [next(pipe_iter) for _ in range(args.count)]
+
+    # Check each pipeline
+    for p in pipelines_to_process:
+
+        jobs = p.jobs.list(get_all=True)
+        failed_jobs = [j for j in jobs if j.status == "failed"]
+        skipped_jobs = [j for j in jobs if j.status == "skipped"]
+        manual_jobs = [j for j in jobs if j.status == "manual"]
+
+        trs = p.test_report_summary.get()
+        total = trs.total["count"]
+        skipped = trs.total["skipped"]
+        failed = trs.total["failed"]
+
+        print(f"{p.status} pipeline {p.id}, total jobs {len(jobs)}, "
+              f"skipped {len(skipped_jobs)}, "
+              f"failed {len(failed_jobs)}, ",
+              f"{total} tests, "
+              f"{skipped} skipped tests, "
+              f"{failed} failed tests")
+
+        if not args.skip_jobs:
+            for j in failed_jobs:
+                print(f"  Failed job {j.id}, {j.name}, {j.web_url}")
+
+        # It seems we can only extract failing tests from the full
+        # test report, maybe there is some way to filter it.
+
+        if failed > 0:
+            ftr = p.test_report.get()
+            failed_suites = [s for s in ftr.test_suites if
+                             s["failed_count"] > 0]
+            for fs in failed_suites:
+                name = fs["name"]
+                tests = fs["test_cases"]
+                failed_tests = [t for t in tests if t["status"] == 'failed']
+                for t in failed_tests:
+                    print(f"  Failed test {t["classname"]}, {name}, {t["name"]}")

From 24e51fc773b63bd222e61226431f3b32ac9915c2 Mon Sep 17 00:00:00 2001
From: Nabih Estefan <nabihestefan@google.com>
Date: Mon, 22 Sep 2025 10:36:48 +0100
Subject: [PATCH 0670/2396] checkpatch: Ignore removed lines in license check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When running the license check, if we are updating a license it is
possible for the checkpatch script to test against old license lines
instead of newer ones, since the removal lines appear before the
addition lines in a .patch file.

Fix this by skipping over lines that start with "-" in the checkpatch
script.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250916165928.10048-1-nabihestefan@google.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-4-alex.bennee@linaro.org>
---
 scripts/checkpatch.pl | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 91616c974f..40b6955c69 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1816,7 +1816,8 @@ sub process {
 		}
 
 # Check SPDX-License-Identifier references a permitted license
-		if ($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) {
+		if (($rawline =~ m,SPDX-License-Identifier: (.*?)(\*/)?\s*$,) &&
+			$rawline !~ /^-/) {
 			$fileinfo->{facts}->{sawspdx} = 1;
 			&checkspdx($realfile, $1);
 		}

From abc4522d01e79a31494a35decf726ab347ad4db4 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:49 +0100
Subject: [PATCH 0671/2396] semihosting/syscalls: compile once in system and
 per target for user mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We replace target_ulong mechanically by uint64_t.
We can't compile (easily) this code once for user, as it relies on
various target/function types, so leave it in specific_ss for user mode.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-2-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-5-alex.bennee@linaro.org>
---
 include/semihosting/syscalls.h | 30 ++++++------
 semihosting/arm-compat-semi.c  |  1 +
 semihosting/meson.build        |  4 +-
 semihosting/syscalls.c         | 89 +++++++++++++++++-----------------
 4 files changed, 63 insertions(+), 61 deletions(-)

diff --git a/include/semihosting/syscalls.h b/include/semihosting/syscalls.h
index 6627c45fb2..03aa45b7bb 100644
--- a/include/semihosting/syscalls.h
+++ b/include/semihosting/syscalls.h
@@ -9,7 +9,7 @@
 #ifndef SEMIHOSTING_SYSCALLS_H
 #define SEMIHOSTING_SYSCALLS_H
 
-#include "exec/cpu-defs.h"
+#include "exec/vaddr.h"
 #include "gdbstub/syscalls.h"
 
 /*
@@ -24,23 +24,23 @@
 typedef struct GuestFD GuestFD;
 
 void semihost_sys_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong fname, target_ulong fname_len,
+                       vaddr fname, uint64_t fname_len,
                        int gdb_flags, int mode);
 
 void semihost_sys_close(CPUState *cs, gdb_syscall_complete_cb complete,
                         int fd);
 
 void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                       int fd, target_ulong buf, target_ulong len);
+                       int fd, vaddr buf, uint64_t len);
 
 void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, target_ulong buf, target_ulong len);
+                          GuestFD *gf, vaddr buf, uint64_t len);
 
 void semihost_sys_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                        int fd, target_ulong buf, target_ulong len);
+                        int fd, vaddr buf, uint64_t len);
 
 void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete,
-                           GuestFD *gf, target_ulong buf, target_ulong len);
+                           GuestFD *gf, vaddr buf, uint64_t len);
 
 void semihost_sys_lseek(CPUState *cs, gdb_syscall_complete_cb complete,
                         int fd, int64_t off, int gdb_whence);
@@ -50,27 +50,27 @@ void semihost_sys_isatty(CPUState *cs, gdb_syscall_complete_cb complete,
 
 void semihost_sys_flen(CPUState *cs, gdb_syscall_complete_cb fstat_cb,
                        gdb_syscall_complete_cb flen_cb,
-                       int fd, target_ulong fstat_addr);
+                       int fd, vaddr fstat_addr);
 
 void semihost_sys_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                        int fd, target_ulong addr);
+                        int fd, vaddr addr);
 
 void semihost_sys_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong fname, target_ulong fname_len,
-                       target_ulong addr);
+                       vaddr fname, uint64_t fname_len,
+                       vaddr addr);
 
 void semihost_sys_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong fname, target_ulong fname_len);
+                         vaddr fname, uint64_t fname_len);
 
 void semihost_sys_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong oname, target_ulong oname_len,
-                         target_ulong nname, target_ulong nname_len);
+                         vaddr oname, uint64_t oname_len,
+                         vaddr nname, uint64_t nname_len);
 
 void semihost_sys_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong cmd, target_ulong cmd_len);
+                         vaddr cmd, uint64_t cmd_len);
 
 void semihost_sys_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                               target_ulong tv_addr, target_ulong tz_addr);
+                               vaddr tv_addr, vaddr tz_addr);
 
 void semihost_sys_poll_one(CPUState *cs, gdb_syscall_complete_cb complete,
                            int fd, GIOCondition cond, int timeout);
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index bcd13cd6df..64ddc749bf 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -34,6 +34,7 @@
 #include "qemu/osdep.h"
 #include "qemu/timer.h"
 #include "exec/gdbstub.h"
+#include "cpu.h"
 #include "gdbstub/syscalls.h"
 #include "semihosting/semihost.h"
 #include "semihosting/console.h"
diff --git a/semihosting/meson.build b/semihosting/meson.build
index b1ab2506c6..77200a7f27 100644
--- a/semihosting/meson.build
+++ b/semihosting/meson.build
@@ -1,6 +1,5 @@
 specific_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'guestfd.c',
-  'syscalls.c',
 ))
 
 common_ss.add(when: 'CONFIG_SEMIHOSTING', if_false: files('stubs-all.c'))
@@ -9,9 +8,12 @@ system_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'config.c',
   'console.c',
   'uaccess.c',
+  'syscalls.c',
 ), if_false: files(
   'stubs-system.c',
 ))
 
+specific_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_USER_ONLY'],
+                if_true: files('syscalls.c'))
 specific_ss.add(when: ['CONFIG_ARM_COMPATIBLE_SEMIHOSTING'],
 		if_true: files('arm-compat-semi.c'))
diff --git a/semihosting/syscalls.c b/semihosting/syscalls.c
index f6451d9bb0..f072d91919 100644
--- a/semihosting/syscalls.c
+++ b/semihosting/syscalls.c
@@ -8,7 +8,6 @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
-#include "cpu.h"
 #include "gdbstub/syscalls.h"
 #include "semihosting/guestfd.h"
 #include "semihosting/syscalls.h"
@@ -23,7 +22,7 @@
 /*
  * Validate or compute the length of the string (including terminator).
  */
-static int validate_strlen(CPUState *cs, target_ulong str, target_ulong tlen)
+static int validate_strlen(CPUState *cs, uint64_t str, uint64_t tlen)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char c;
@@ -52,7 +51,7 @@ static int validate_strlen(CPUState *cs, target_ulong str, target_ulong tlen)
 }
 
 static int validate_lock_user_string(char **pstr, CPUState *cs,
-                                     target_ulong tstr, target_ulong tlen)
+                                     uint64_t tstr, uint64_t tlen)
 {
     int ret = validate_strlen(cs, tstr, tlen);
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -72,7 +71,7 @@ static int validate_lock_user_string(char **pstr, CPUState *cs,
  * big-endian.  Until we do something with gdb, also produce the
  * same big-endian result from the host.
  */
-static int copy_stat_to_user(CPUState *cs, target_ulong addr,
+static int copy_stat_to_user(CPUState *cs, uint64_t addr,
                              const struct stat *s)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -129,7 +128,7 @@ static void gdb_open_cb(CPUState *cs, uint64_t ret, int err)
 }
 
 static void gdb_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                     target_ulong fname, target_ulong fname_len,
+                     uint64_t fname, uint64_t fname_len,
                      int gdb_flags, int mode)
 {
     int len = validate_strlen(cs, fname, fname_len);
@@ -151,14 +150,14 @@ static void gdb_close(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                     GuestFD *gf, target_ulong buf, target_ulong len)
+                     GuestFD *gf, uint64_t buf, uint64_t len)
 {
     gdb_do_syscall(complete, "read,%x,%lx,%lx",
                    (uint32_t)gf->hostfd, (uint64_t)buf, (uint64_t)len);
 }
 
 static void gdb_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, target_ulong buf, target_ulong len)
+                      GuestFD *gf, uint64_t buf, uint64_t len)
 {
     gdb_do_syscall(complete, "write,%x,%lx,%lx",
                    (uint32_t)gf->hostfd, (uint64_t)buf, (uint64_t)len);
@@ -178,15 +177,15 @@ static void gdb_isatty(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, target_ulong addr)
+                      GuestFD *gf, uint64_t addr)
 {
     gdb_do_syscall(complete, "fstat,%x,%lx",
                    (uint32_t)gf->hostfd, (uint64_t)addr);
 }
 
 static void gdb_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                     target_ulong fname, target_ulong fname_len,
-                     target_ulong addr)
+                     uint64_t fname, uint64_t fname_len,
+                     uint64_t addr)
 {
     int len = validate_strlen(cs, fname, fname_len);
     if (len < 0) {
@@ -199,7 +198,7 @@ static void gdb_stat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong fname, target_ulong fname_len)
+                       uint64_t fname, uint64_t fname_len)
 {
     int len = validate_strlen(cs, fname, fname_len);
     if (len < 0) {
@@ -211,8 +210,8 @@ static void gdb_remove(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong oname, target_ulong oname_len,
-                       target_ulong nname, target_ulong nname_len)
+                       uint64_t oname, uint64_t oname_len,
+                       uint64_t nname, uint64_t nname_len)
 {
     int olen, nlen;
 
@@ -233,7 +232,7 @@ static void gdb_rename(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong cmd, target_ulong cmd_len)
+                       uint64_t cmd, uint64_t cmd_len)
 {
     int len = validate_strlen(cs, cmd, cmd_len);
     if (len < 0) {
@@ -245,7 +244,7 @@ static void gdb_system(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                             target_ulong tv_addr, target_ulong tz_addr)
+                             uint64_t tv_addr, uint64_t tz_addr)
 {
     gdb_do_syscall(complete, "gettimeofday,%lx,%lx",
                    (uint64_t)tv_addr, (uint64_t)tz_addr);
@@ -256,7 +255,7 @@ static void gdb_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void host_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                      target_ulong fname, target_ulong fname_len,
+                      uint64_t fname, uint64_t fname_len,
                       int gdb_flags, int mode)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -316,7 +315,7 @@ static void host_close(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, target_ulong buf, target_ulong len)
+                      GuestFD *gf, uint64_t buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     void *ptr = lock_user(VERIFY_WRITE, buf, len, 0);
@@ -337,7 +336,7 @@ static void host_read(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                       GuestFD *gf, target_ulong buf, target_ulong len)
+                       GuestFD *gf, uint64_t buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     void *ptr = lock_user(VERIFY_READ, buf, len, 1);
@@ -395,7 +394,7 @@ static void host_flen(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                       GuestFD *gf, target_ulong addr)
+                       GuestFD *gf, uint64_t addr)
 {
     struct stat buf;
     int ret;
@@ -410,8 +409,8 @@ static void host_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                      target_ulong fname, target_ulong fname_len,
-                      target_ulong addr)
+                      uint64_t fname, uint64_t fname_len,
+                      uint64_t addr)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     struct stat buf;
@@ -440,7 +439,7 @@ static void host_stat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                        target_ulong fname, target_ulong fname_len)
+                        uint64_t fname, uint64_t fname_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *p;
@@ -458,8 +457,8 @@ static void host_remove(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                        target_ulong oname, target_ulong oname_len,
-                        target_ulong nname, target_ulong nname_len)
+                        uint64_t oname, uint64_t oname_len,
+                        uint64_t nname, uint64_t nname_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ostr, *nstr;
@@ -484,7 +483,7 @@ static void host_rename(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                        target_ulong cmd, target_ulong cmd_len)
+                        uint64_t cmd, uint64_t cmd_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *p;
@@ -502,7 +501,7 @@ static void host_system(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                              target_ulong tv_addr, target_ulong tz_addr)
+                              uint64_t tv_addr, uint64_t tz_addr)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     struct gdb_timeval *p;
@@ -547,10 +546,10 @@ static void host_poll_one(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void staticfile_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                            GuestFD *gf, target_ulong buf, target_ulong len)
+                            GuestFD *gf, uint64_t buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
-    target_ulong rest = gf->staticfile.len - gf->staticfile.off;
+    uint64_t rest = gf->staticfile.len - gf->staticfile.off;
     void *ptr;
 
     if (len > rest) {
@@ -605,7 +604,7 @@ static void staticfile_flen(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void console_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                         GuestFD *gf, target_ulong buf, target_ulong len)
+                         GuestFD *gf, uint64_t buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ptr;
@@ -622,7 +621,7 @@ static void console_read(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void console_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, target_ulong buf, target_ulong len)
+                          GuestFD *gf, uint64_t buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ptr = lock_user(VERIFY_READ, buf, len, 1);
@@ -638,7 +637,7 @@ static void console_write(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void console_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, target_ulong addr)
+                          GuestFD *gf, uint64_t addr)
 {
     static const struct stat tty_buf = {
         .st_mode = 020666,  /* S_IFCHR, ugo+rw */
@@ -683,7 +682,7 @@ static void console_poll_one(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 void semihost_sys_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong fname, target_ulong fname_len,
+                       vaddr fname, uint64_t fname_len,
                        int gdb_flags, int mode)
 {
     if (use_gdb_syscalls()) {
@@ -719,7 +718,7 @@ void semihost_sys_close(CPUState *cs, gdb_syscall_complete_cb complete, int fd)
 }
 
 void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, target_ulong buf, target_ulong len)
+                          GuestFD *gf, vaddr buf, uint64_t len)
 {
     /*
      * Bound length for 64-bit guests on 32-bit hosts, not overflowing ssize_t.
@@ -748,7 +747,7 @@ void semihost_sys_read_gf(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                       int fd, target_ulong buf, target_ulong len)
+                       int fd, vaddr buf, uint64_t len)
 {
     GuestFD *gf = get_guestfd(fd);
 
@@ -760,7 +759,7 @@ void semihost_sys_read(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete,
-                           GuestFD *gf, target_ulong buf, target_ulong len)
+                           GuestFD *gf, vaddr buf, uint64_t len)
 {
     /*
      * Bound length for 64-bit guests on 32-bit hosts, not overflowing ssize_t.
@@ -790,7 +789,7 @@ void semihost_sys_write_gf(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                        int fd, target_ulong buf, target_ulong len)
+                        int fd, vaddr buf, uint64_t len)
 {
     GuestFD *gf = get_guestfd(fd);
 
@@ -856,7 +855,7 @@ void semihost_sys_isatty(CPUState *cs, gdb_syscall_complete_cb complete, int fd)
 
 void semihost_sys_flen(CPUState *cs, gdb_syscall_complete_cb fstat_cb,
                        gdb_syscall_complete_cb flen_cb, int fd,
-                       target_ulong fstat_addr)
+                       vaddr fstat_addr)
 {
     GuestFD *gf = get_guestfd(fd);
 
@@ -881,7 +880,7 @@ void semihost_sys_flen(CPUState *cs, gdb_syscall_complete_cb fstat_cb,
 }
 
 void semihost_sys_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                        int fd, target_ulong addr)
+                        int fd, vaddr addr)
 {
     GuestFD *gf = get_guestfd(fd);
 
@@ -906,8 +905,8 @@ void semihost_sys_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                       target_ulong fname, target_ulong fname_len,
-                       target_ulong addr)
+                       vaddr fname, uint64_t fname_len,
+                       vaddr addr)
 {
     if (use_gdb_syscalls()) {
         gdb_stat(cs, complete, fname, fname_len, addr);
@@ -917,7 +916,7 @@ void semihost_sys_stat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong fname, target_ulong fname_len)
+                         vaddr fname, uint64_t fname_len)
 {
     if (use_gdb_syscalls()) {
         gdb_remove(cs, complete, fname, fname_len);
@@ -927,8 +926,8 @@ void semihost_sys_remove(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong oname, target_ulong oname_len,
-                         target_ulong nname, target_ulong nname_len)
+                         vaddr oname, uint64_t oname_len,
+                         vaddr nname, uint64_t nname_len)
 {
     if (use_gdb_syscalls()) {
         gdb_rename(cs, complete, oname, oname_len, nname, nname_len);
@@ -938,7 +937,7 @@ void semihost_sys_rename(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                         target_ulong cmd, target_ulong cmd_len)
+                         vaddr cmd, uint64_t cmd_len)
 {
     if (use_gdb_syscalls()) {
         gdb_system(cs, complete, cmd, cmd_len);
@@ -948,7 +947,7 @@ void semihost_sys_system(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 void semihost_sys_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                               target_ulong tv_addr, target_ulong tz_addr)
+                               vaddr tv_addr, vaddr tz_addr)
 {
     if (use_gdb_syscalls()) {
         gdb_gettimeofday(cs, complete, tv_addr, tz_addr);

From 664172404aff3ba11f8ab1fc348d3c860c45f5d3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:50 +0100
Subject: [PATCH 0672/2396] semihosting/syscalls: replace uint64_t with vaddr
 where appropriate
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-3-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-6-alex.bennee@linaro.org>
---
 semihosting/syscalls.c | 78 +++++++++++++++++++++---------------------
 1 file changed, 39 insertions(+), 39 deletions(-)

diff --git a/semihosting/syscalls.c b/semihosting/syscalls.c
index f072d91919..20f155f869 100644
--- a/semihosting/syscalls.c
+++ b/semihosting/syscalls.c
@@ -22,7 +22,7 @@
 /*
  * Validate or compute the length of the string (including terminator).
  */
-static int validate_strlen(CPUState *cs, uint64_t str, uint64_t tlen)
+static int validate_strlen(CPUState *cs, vaddr str, uint64_t tlen)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char c;
@@ -51,7 +51,7 @@ static int validate_strlen(CPUState *cs, uint64_t str, uint64_t tlen)
 }
 
 static int validate_lock_user_string(char **pstr, CPUState *cs,
-                                     uint64_t tstr, uint64_t tlen)
+                                     vaddr tstr, uint64_t tlen)
 {
     int ret = validate_strlen(cs, tstr, tlen);
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -71,7 +71,7 @@ static int validate_lock_user_string(char **pstr, CPUState *cs,
  * big-endian.  Until we do something with gdb, also produce the
  * same big-endian result from the host.
  */
-static int copy_stat_to_user(CPUState *cs, uint64_t addr,
+static int copy_stat_to_user(CPUState *cs, vaddr addr,
                              const struct stat *s)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -128,7 +128,7 @@ static void gdb_open_cb(CPUState *cs, uint64_t ret, int err)
 }
 
 static void gdb_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                     uint64_t fname, uint64_t fname_len,
+                     vaddr fname, uint64_t fname_len,
                      int gdb_flags, int mode)
 {
     int len = validate_strlen(cs, fname, fname_len);
@@ -139,7 +139,7 @@ static void gdb_open(CPUState *cs, gdb_syscall_complete_cb complete,
 
     gdb_open_complete = complete;
     gdb_do_syscall(gdb_open_cb, "open,%s,%x,%x",
-                   (uint64_t)fname, (uint32_t)len,
+                   (vaddr)fname, (uint32_t)len,
                    (uint32_t)gdb_flags, (uint32_t)mode);
 }
 
@@ -150,17 +150,17 @@ static void gdb_close(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                     GuestFD *gf, uint64_t buf, uint64_t len)
+                     GuestFD *gf, vaddr buf, uint64_t len)
 {
     gdb_do_syscall(complete, "read,%x,%lx,%lx",
-                   (uint32_t)gf->hostfd, (uint64_t)buf, (uint64_t)len);
+                   (uint32_t)gf->hostfd, (vaddr)buf, (uint64_t)len);
 }
 
 static void gdb_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, uint64_t buf, uint64_t len)
+                      GuestFD *gf, vaddr buf, uint64_t len)
 {
     gdb_do_syscall(complete, "write,%x,%lx,%lx",
-                   (uint32_t)gf->hostfd, (uint64_t)buf, (uint64_t)len);
+                   (uint32_t)gf->hostfd, (vaddr)buf, (uint64_t)len);
 }
 
 static void gdb_lseek(CPUState *cs, gdb_syscall_complete_cb complete,
@@ -177,15 +177,15 @@ static void gdb_isatty(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void gdb_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, uint64_t addr)
+                      GuestFD *gf, vaddr addr)
 {
     gdb_do_syscall(complete, "fstat,%x,%lx",
-                   (uint32_t)gf->hostfd, (uint64_t)addr);
+                   (uint32_t)gf->hostfd, (vaddr)addr);
 }
 
 static void gdb_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                     uint64_t fname, uint64_t fname_len,
-                     uint64_t addr)
+                     vaddr fname, uint64_t fname_len,
+                     vaddr addr)
 {
     int len = validate_strlen(cs, fname, fname_len);
     if (len < 0) {
@@ -194,11 +194,11 @@ static void gdb_stat(CPUState *cs, gdb_syscall_complete_cb complete,
     }
 
     gdb_do_syscall(complete, "stat,%s,%lx",
-                   (uint64_t)fname, (uint32_t)len, (uint64_t)addr);
+                   (vaddr)fname, (uint32_t)len, (vaddr)addr);
 }
 
 static void gdb_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                       uint64_t fname, uint64_t fname_len)
+                       vaddr fname, uint64_t fname_len)
 {
     int len = validate_strlen(cs, fname, fname_len);
     if (len < 0) {
@@ -206,12 +206,12 @@ static void gdb_remove(CPUState *cs, gdb_syscall_complete_cb complete,
         return;
     }
 
-    gdb_do_syscall(complete, "unlink,%s", (uint64_t)fname, (uint32_t)len);
+    gdb_do_syscall(complete, "unlink,%s", (vaddr)fname, (uint32_t)len);
 }
 
 static void gdb_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                       uint64_t oname, uint64_t oname_len,
-                       uint64_t nname, uint64_t nname_len)
+                       vaddr oname, uint64_t oname_len,
+                       vaddr nname, uint64_t nname_len)
 {
     int olen, nlen;
 
@@ -227,12 +227,12 @@ static void gdb_rename(CPUState *cs, gdb_syscall_complete_cb complete,
     }
 
     gdb_do_syscall(complete, "rename,%s,%s",
-                   (uint64_t)oname, (uint32_t)olen,
-                   (uint64_t)nname, (uint32_t)nlen);
+                   (vaddr)oname, (uint32_t)olen,
+                   (vaddr)nname, (uint32_t)nlen);
 }
 
 static void gdb_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                       uint64_t cmd, uint64_t cmd_len)
+                       vaddr cmd, uint64_t cmd_len)
 {
     int len = validate_strlen(cs, cmd, cmd_len);
     if (len < 0) {
@@ -240,14 +240,14 @@ static void gdb_system(CPUState *cs, gdb_syscall_complete_cb complete,
         return;
     }
 
-    gdb_do_syscall(complete, "system,%s", (uint64_t)cmd, (uint32_t)len);
+    gdb_do_syscall(complete, "system,%s", (vaddr)cmd, (uint32_t)len);
 }
 
 static void gdb_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                             uint64_t tv_addr, uint64_t tz_addr)
+                             vaddr tv_addr, vaddr tz_addr)
 {
     gdb_do_syscall(complete, "gettimeofday,%lx,%lx",
-                   (uint64_t)tv_addr, (uint64_t)tz_addr);
+                   (vaddr)tv_addr, (vaddr)tz_addr);
 }
 
 /*
@@ -255,7 +255,7 @@ static void gdb_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void host_open(CPUState *cs, gdb_syscall_complete_cb complete,
-                      uint64_t fname, uint64_t fname_len,
+                      vaddr fname, uint64_t fname_len,
                       int gdb_flags, int mode)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
@@ -315,7 +315,7 @@ static void host_close(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                      GuestFD *gf, uint64_t buf, uint64_t len)
+                      GuestFD *gf, vaddr buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     void *ptr = lock_user(VERIFY_WRITE, buf, len, 0);
@@ -336,7 +336,7 @@ static void host_read(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                       GuestFD *gf, uint64_t buf, uint64_t len)
+                       GuestFD *gf, vaddr buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     void *ptr = lock_user(VERIFY_READ, buf, len, 1);
@@ -394,7 +394,7 @@ static void host_flen(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                       GuestFD *gf, uint64_t addr)
+                       GuestFD *gf, vaddr addr)
 {
     struct stat buf;
     int ret;
@@ -409,8 +409,8 @@ static void host_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_stat(CPUState *cs, gdb_syscall_complete_cb complete,
-                      uint64_t fname, uint64_t fname_len,
-                      uint64_t addr)
+                      vaddr fname, uint64_t fname_len,
+                      vaddr addr)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     struct stat buf;
@@ -439,7 +439,7 @@ static void host_stat(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_remove(CPUState *cs, gdb_syscall_complete_cb complete,
-                        uint64_t fname, uint64_t fname_len)
+                        vaddr fname, uint64_t fname_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *p;
@@ -457,8 +457,8 @@ static void host_remove(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_rename(CPUState *cs, gdb_syscall_complete_cb complete,
-                        uint64_t oname, uint64_t oname_len,
-                        uint64_t nname, uint64_t nname_len)
+                        vaddr oname, uint64_t oname_len,
+                        vaddr nname, uint64_t nname_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ostr, *nstr;
@@ -483,7 +483,7 @@ static void host_rename(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_system(CPUState *cs, gdb_syscall_complete_cb complete,
-                        uint64_t cmd, uint64_t cmd_len)
+                        vaddr cmd, uint64_t cmd_len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *p;
@@ -501,7 +501,7 @@ static void host_system(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void host_gettimeofday(CPUState *cs, gdb_syscall_complete_cb complete,
-                              uint64_t tv_addr, uint64_t tz_addr)
+                              vaddr tv_addr, vaddr tz_addr)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     struct gdb_timeval *p;
@@ -546,7 +546,7 @@ static void host_poll_one(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void staticfile_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                            GuestFD *gf, uint64_t buf, uint64_t len)
+                            GuestFD *gf, vaddr buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     uint64_t rest = gf->staticfile.len - gf->staticfile.off;
@@ -604,7 +604,7 @@ static void staticfile_flen(CPUState *cs, gdb_syscall_complete_cb complete,
  */
 
 static void console_read(CPUState *cs, gdb_syscall_complete_cb complete,
-                         GuestFD *gf, uint64_t buf, uint64_t len)
+                         GuestFD *gf, vaddr buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ptr;
@@ -621,7 +621,7 @@ static void console_read(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void console_write(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, uint64_t buf, uint64_t len)
+                          GuestFD *gf, vaddr buf, uint64_t len)
 {
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
     char *ptr = lock_user(VERIFY_READ, buf, len, 1);
@@ -637,7 +637,7 @@ static void console_write(CPUState *cs, gdb_syscall_complete_cb complete,
 }
 
 static void console_fstat(CPUState *cs, gdb_syscall_complete_cb complete,
-                          GuestFD *gf, uint64_t addr)
+                          GuestFD *gf, vaddr addr)
 {
     static const struct stat tty_buf = {
         .st_mode = 020666,  /* S_IFCHR, ugo+rw */

From d8028d4ede536bbea82eab8bdebd753378d58b68 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:51 +0100
Subject: [PATCH 0673/2396] semihosting/guestfd: compile once for system/user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We move relevant code to semihosting/arm-compat-semi.c, and add
functions to query CONFIG_ARM_COMPATIBLE_SEMIHOSTING at runtime.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-4-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-7-alex.bennee@linaro.org>
---
 include/semihosting/guestfd.h      |  7 -------
 include/semihosting/semihost.h     |  2 ++
 semihosting/arm-compat-semi-stub.c | 19 +++++++++++++++++++
 semihosting/arm-compat-semi.c      | 26 ++++++++++++++++++++++++++
 semihosting/guestfd.c              | 26 +++++---------------------
 semihosting/meson.build            | 11 ++++++-----
 6 files changed, 58 insertions(+), 33 deletions(-)
 create mode 100644 semihosting/arm-compat-semi-stub.c

diff --git a/include/semihosting/guestfd.h b/include/semihosting/guestfd.h
index 3d426fedab..a7ea1041ea 100644
--- a/include/semihosting/guestfd.h
+++ b/include/semihosting/guestfd.h
@@ -35,13 +35,6 @@ typedef struct GuestFD {
     };
 } GuestFD;
 
-/*
- * For ARM semihosting, we have a separate structure for routing
- * data for the console which is outside the guest fd address space.
- */
-extern GuestFD console_in_gf;
-extern GuestFD console_out_gf;
-
 /**
  * alloc_guestfd:
  *
diff --git a/include/semihosting/semihost.h b/include/semihosting/semihost.h
index b03e637578..231dc89039 100644
--- a/include/semihosting/semihost.h
+++ b/include/semihosting/semihost.h
@@ -33,6 +33,8 @@ typedef enum SemihostingTarget {
  * Return true if guest code is allowed to make semihosting calls.
  */
 bool semihosting_enabled(bool is_user);
+bool semihosting_arm_compatible(void);
+void semihosting_arm_compatible_init(void);
 
 SemihostingTarget semihosting_get_target(void);
 const char *semihosting_get_arg(int i);
diff --git a/semihosting/arm-compat-semi-stub.c b/semihosting/arm-compat-semi-stub.c
new file mode 100644
index 0000000000..bfa3681e26
--- /dev/null
+++ b/semihosting/arm-compat-semi-stub.c
@@ -0,0 +1,19 @@
+/*
+ * Stubs for platforms different from ARM
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "semihosting/semihost.h"
+#include <glib.h>
+
+bool semihosting_arm_compatible(void)
+{
+    return false;
+}
+
+void semihosting_arm_compatible_init(void)
+{
+    g_assert_not_reached();
+}
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 64ddc749bf..a239cfc5a9 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -101,6 +101,13 @@ static int gdb_open_modeflags[12] = {
     GDB_O_RDWR | GDB_O_CREAT | GDB_O_APPEND,
 };
 
+/*
+ * For ARM semihosting, we have a separate structure for routing
+ * data for the console which is outside the guest fd address space.
+ */
+static GuestFD console_in_gf;
+static GuestFD console_out_gf;
+
 #ifndef CONFIG_USER_ONLY
 
 /**
@@ -353,6 +360,25 @@ static const uint8_t featurefile_data[] = {
     SH_EXT_EXIT_EXTENDED | SH_EXT_STDOUT_STDERR, /* Feature byte 0 */
 };
 
+bool semihosting_arm_compatible(void)
+{
+    return true;
+}
+
+void semihosting_arm_compatible_init(void)
+{
+    /* For ARM-compat, the console is in a separate namespace. */
+    if (use_gdb_syscalls()) {
+        console_in_gf.type = GuestFDGDB;
+        console_in_gf.hostfd = 0;
+        console_out_gf.type = GuestFDGDB;
+        console_out_gf.hostfd = 2;
+    } else {
+        console_in_gf.type = GuestFDConsole;
+        console_out_gf.type = GuestFDConsole;
+    }
+}
+
 /*
  * Do a semihosting call.
  *
diff --git a/semihosting/guestfd.c b/semihosting/guestfd.c
index d3241434c5..e8f236c690 100644
--- a/semihosting/guestfd.c
+++ b/semihosting/guestfd.c
@@ -12,35 +12,20 @@
 #include "gdbstub/syscalls.h"
 #include "semihosting/semihost.h"
 #include "semihosting/guestfd.h"
-#ifndef CONFIG_USER_ONLY
-#include CONFIG_DEVICES
-#endif
 
 static GArray *guestfd_array;
 
-#ifdef CONFIG_ARM_COMPATIBLE_SEMIHOSTING
-GuestFD console_in_gf;
-GuestFD console_out_gf;
-#endif
-
 void qemu_semihosting_guestfd_init(void)
 {
     /* New entries zero-initialized, i.e. type GuestFDUnused */
     guestfd_array = g_array_new(FALSE, TRUE, sizeof(GuestFD));
 
-#ifdef CONFIG_ARM_COMPATIBLE_SEMIHOSTING
-    /* For ARM-compat, the console is in a separate namespace. */
-    if (use_gdb_syscalls()) {
-        console_in_gf.type = GuestFDGDB;
-        console_in_gf.hostfd = 0;
-        console_out_gf.type = GuestFDGDB;
-        console_out_gf.hostfd = 2;
-    } else {
-        console_in_gf.type = GuestFDConsole;
-        console_out_gf.type = GuestFDConsole;
+    if (semihosting_arm_compatible()) {
+        semihosting_arm_compatible_init();
+        return;
     }
-#else
-    /* Otherwise, the stdio file descriptors apply. */
+
+    /* Out of ARM, the stdio file descriptors apply. */
     guestfd_array = g_array_set_size(guestfd_array, 3);
 #ifndef CONFIG_USER_ONLY
     if (!use_gdb_syscalls()) {
@@ -54,7 +39,6 @@ void qemu_semihosting_guestfd_init(void)
     associate_guestfd(0, 0);
     associate_guestfd(1, 1);
     associate_guestfd(2, 2);
-#endif
 }
 
 /*
diff --git a/semihosting/meson.build b/semihosting/meson.build
index 77200a7f27..bb0db32393 100644
--- a/semihosting/meson.build
+++ b/semihosting/meson.build
@@ -1,17 +1,18 @@
-specific_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
-  'guestfd.c',
-))
-
 common_ss.add(when: 'CONFIG_SEMIHOSTING', if_false: files('stubs-all.c'))
-user_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files('user.c'))
+user_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
+  'user.c',
+  'guestfd.c'))
 system_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'config.c',
   'console.c',
+  'guestfd.c',
   'uaccess.c',
   'syscalls.c',
 ), if_false: files(
   'stubs-system.c',
 ))
+system_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
+  if_false: files('arm-compat-semi-stub.c'))
 
 specific_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_USER_ONLY'],
                 if_true: files('syscalls.c'))

From a92e151bd0d8c0dedbfb2d301eb31aaac94a1fb8 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:52 +0100
Subject: [PATCH 0674/2396] semihosting/arm-compat-semi: change
 common_semi_sys_exit_extended
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We now check only is sys_exit is extended.
This allows to break dependency to TARGET_SYS_EXIT_EXTENDED which will
not be available anymore from this code.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-5-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-8-alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c     | 3 ++-
 target/arm/common-semi-target.h   | 4 ++--
 target/riscv/common-semi-target.h | 4 ++--
 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index a239cfc5a9..26263a06b7 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -755,7 +755,8 @@ void do_common_semihosting(CPUState *cs)
     {
         uint32_t ret;
 
-        if (common_semi_sys_exit_extended(cs, nr)) {
+        if (nr == TARGET_SYS_EXIT_EXTENDED ||
+            common_semi_sys_exit_is_extended(cs)) {
             /*
              * The A64 version of SYS_EXIT takes a parameter block,
              * so the application-exit type can return a subcode which
diff --git a/target/arm/common-semi-target.h b/target/arm/common-semi-target.h
index da51f2d7f5..7bb442f24c 100644
--- a/target/arm/common-semi-target.h
+++ b/target/arm/common-semi-target.h
@@ -34,9 +34,9 @@ static inline void common_semi_set_ret(CPUState *cs, target_ulong ret)
     }
 }
 
-static inline bool common_semi_sys_exit_extended(CPUState *cs, int nr)
+static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
 {
-    return nr == TARGET_SYS_EXIT_EXTENDED || is_a64(cpu_env(cs));
+    return is_a64(cpu_env(cs));
 }
 
 static inline bool is_64bit_semihosting(CPUArchState *env)
diff --git a/target/riscv/common-semi-target.h b/target/riscv/common-semi-target.h
index 7c8a59e0cc..ba40e794dc 100644
--- a/target/riscv/common-semi-target.h
+++ b/target/riscv/common-semi-target.h
@@ -25,9 +25,9 @@ static inline void common_semi_set_ret(CPUState *cs, target_ulong ret)
     env->gpr[xA0] = ret;
 }
 
-static inline bool common_semi_sys_exit_extended(CPUState *cs, int nr)
+static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
 {
-    return (nr == TARGET_SYS_EXIT_EXTENDED || sizeof(target_ulong) == 8);
+    return sizeof(target_ulong) == 8;
 }
 
 static inline bool is_64bit_semihosting(CPUArchState *env)

From 2131f0dcdf97935b1c412e61da51f2de323bfa9c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:53 +0100
Subject: [PATCH 0675/2396] target/riscv/common-semi-target: remove
 sizeof(target_ulong)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only riscv64 extends SYS_EXIT, similar to aarch64.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-6-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-9-alex.bennee@linaro.org>
---
 target/riscv/common-semi-target.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/riscv/common-semi-target.h b/target/riscv/common-semi-target.h
index ba40e794dc..7e6ea8da02 100644
--- a/target/riscv/common-semi-target.h
+++ b/target/riscv/common-semi-target.h
@@ -25,16 +25,16 @@ static inline void common_semi_set_ret(CPUState *cs, target_ulong ret)
     env->gpr[xA0] = ret;
 }
 
-static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
-{
-    return sizeof(target_ulong) == 8;
-}
-
 static inline bool is_64bit_semihosting(CPUArchState *env)
 {
     return riscv_cpu_mxl(env) != MXL_RV32;
 }
 
+static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
+{
+    return is_64bit_semihosting(cpu_env(cs));
+}
+
 static inline target_ulong common_semi_stack_bottom(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);

From 632308c5912aab0dfad8bc1a1cbe7b37a5e1aeec Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:54 +0100
Subject: [PATCH 0676/2396] target/{arm, riscv}/common-semi-target: eradicate
 target_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We replace mechanically with uint64_t.
There is no semantic change, and allows us to extract a proper API from
this set of functions.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-7-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-10-alex.bennee@linaro.org>
---
 target/arm/common-semi-target.h   | 6 +++---
 target/riscv/common-semi-target.h | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/common-semi-target.h b/target/arm/common-semi-target.h
index 7bb442f24c..6775a270aa 100644
--- a/target/arm/common-semi-target.h
+++ b/target/arm/common-semi-target.h
@@ -12,7 +12,7 @@
 
 #include "target/arm/cpu-qom.h"
 
-static inline target_ulong common_semi_arg(CPUState *cs, int argno)
+static inline uint64_t common_semi_arg(CPUState *cs, int argno)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -23,7 +23,7 @@ static inline target_ulong common_semi_arg(CPUState *cs, int argno)
     }
 }
 
-static inline void common_semi_set_ret(CPUState *cs, target_ulong ret)
+static inline void common_semi_set_ret(CPUState *cs, uint64_t ret)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -44,7 +44,7 @@ static inline bool is_64bit_semihosting(CPUArchState *env)
     return is_a64(env);
 }
 
-static inline target_ulong common_semi_stack_bottom(CPUState *cs)
+static inline uint64_t common_semi_stack_bottom(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
diff --git a/target/riscv/common-semi-target.h b/target/riscv/common-semi-target.h
index 7e6ea8da02..663dedfdad 100644
--- a/target/riscv/common-semi-target.h
+++ b/target/riscv/common-semi-target.h
@@ -11,14 +11,14 @@
 #ifndef TARGET_RISCV_COMMON_SEMI_TARGET_H
 #define TARGET_RISCV_COMMON_SEMI_TARGET_H
 
-static inline target_ulong common_semi_arg(CPUState *cs, int argno)
+static inline uint64_t common_semi_arg(CPUState *cs, int argno)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     return env->gpr[xA0 + argno];
 }
 
-static inline void common_semi_set_ret(CPUState *cs, target_ulong ret)
+static inline void common_semi_set_ret(CPUState *cs, uint64_t ret)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
@@ -35,7 +35,7 @@ static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
     return is_64bit_semihosting(cpu_env(cs));
 }
 
-static inline target_ulong common_semi_stack_bottom(CPUState *cs)
+static inline uint64_t common_semi_stack_bottom(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;

From 9e65902904cdad6d4b131b1791205ae4138c99eb Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:55 +0100
Subject: [PATCH 0677/2396] include/semihosting/common-semi: extract
 common_semi API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We transform target/{arm,riscv}/common-semi-target.h headers to proper
compilation units, and use them in arm-compat-semi.c.

This way, we can include only the declaration header (which is target
agnostic), and selectively link the appropriate implementation based on
current target.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-8-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-11-alex.bennee@linaro.org>
---
 include/semihosting/common-semi.h             |  6 ++++++
 semihosting/arm-compat-semi.c                 |  3 +--
 ...mon-semi-target.h => common-semi-target.c} | 20 +++++++++----------
 target/arm/meson.build                        |  4 ++++
 ...mon-semi-target.h => common-semi-target.c} | 19 +++++++++---------
 target/riscv/meson.build                      |  4 ++++
 6 files changed, 33 insertions(+), 23 deletions(-)
 rename target/arm/{common-semi-target.h => common-semi-target.c} (64%)
 rename target/riscv/{common-semi-target.h => common-semi-target.c} (59%)

diff --git a/include/semihosting/common-semi.h b/include/semihosting/common-semi.h
index 0a91db7c41..aa511a46f4 100644
--- a/include/semihosting/common-semi.h
+++ b/include/semihosting/common-semi.h
@@ -35,5 +35,11 @@
 #define COMMON_SEMI_H
 
 void do_common_semihosting(CPUState *cs);
+uint64_t common_semi_arg(CPUState *cs, int argno);
+void common_semi_set_ret(CPUState *cs, uint64_t ret);
+bool is_64bit_semihosting(CPUArchState *env);
+bool common_semi_sys_exit_is_extended(CPUState *cs);
+uint64_t common_semi_stack_bottom(CPUState *cs);
+bool common_semi_has_synccache(CPUArchState *env);
 
 #endif /* COMMON_SEMI_H */
diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 26263a06b7..604a69e364 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -174,8 +174,7 @@ static LayoutInfo common_semi_find_bases(CPUState *cs)
 
 #endif
 
-#include "cpu.h"
-#include "common-semi-target.h"
+#include "semihosting/common-semi.h"
 
 /*
  * Read the input value from the argument block; fail the semihosting
diff --git a/target/arm/common-semi-target.h b/target/arm/common-semi-target.c
similarity index 64%
rename from target/arm/common-semi-target.h
rename to target/arm/common-semi-target.c
index 6775a270aa..2b77ce9c17 100644
--- a/target/arm/common-semi-target.h
+++ b/target/arm/common-semi-target.c
@@ -7,12 +7,12 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#ifndef TARGET_ARM_COMMON_SEMI_TARGET_H
-#define TARGET_ARM_COMMON_SEMI_TARGET_H
-
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "semihosting/common-semi.h"
 #include "target/arm/cpu-qom.h"
 
-static inline uint64_t common_semi_arg(CPUState *cs, int argno)
+uint64_t common_semi_arg(CPUState *cs, int argno)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -23,7 +23,7 @@ static inline uint64_t common_semi_arg(CPUState *cs, int argno)
     }
 }
 
-static inline void common_semi_set_ret(CPUState *cs, uint64_t ret)
+void common_semi_set_ret(CPUState *cs, uint64_t ret)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -34,27 +34,25 @@ static inline void common_semi_set_ret(CPUState *cs, uint64_t ret)
     }
 }
 
-static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
+bool common_semi_sys_exit_is_extended(CPUState *cs)
 {
     return is_a64(cpu_env(cs));
 }
 
-static inline bool is_64bit_semihosting(CPUArchState *env)
+bool is_64bit_semihosting(CPUArchState *env)
 {
     return is_a64(env);
 }
 
-static inline uint64_t common_semi_stack_bottom(CPUState *cs)
+uint64_t common_semi_stack_bottom(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     return is_a64(env) ? env->xregs[31] : env->regs[13];
 }
 
-static inline bool common_semi_has_synccache(CPUArchState *env)
+bool common_semi_has_synccache(CPUArchState *env)
 {
     /* Ok for A64, invalid for A32/T32 */
     return is_a64(env);
 }
-
-#endif
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 914f1498fc..638ee62525 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -28,12 +28,16 @@ arm_user_ss.add(files(
   'vfp_fpscr.c',
   'el2-stubs.c',
 ))
+arm_user_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
+		        if_true: files('common-semi-target.c'))
 
 arm_common_system_ss.add(files('cpu.c'))
 arm_common_system_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c'))
 arm_common_system_ss.add(when: 'CONFIG_KVM', if_false: files('kvm-stub.c'))
 arm_common_system_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
+arm_common_system_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
+		                 if_true: files('common-semi-target.c'))
 arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',
diff --git a/target/riscv/common-semi-target.h b/target/riscv/common-semi-target.c
similarity index 59%
rename from target/riscv/common-semi-target.h
rename to target/riscv/common-semi-target.c
index 663dedfdad..aeaeb88d53 100644
--- a/target/riscv/common-semi-target.h
+++ b/target/riscv/common-semi-target.c
@@ -8,43 +8,42 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#ifndef TARGET_RISCV_COMMON_SEMI_TARGET_H
-#define TARGET_RISCV_COMMON_SEMI_TARGET_H
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "semihosting/common-semi.h"
 
-static inline uint64_t common_semi_arg(CPUState *cs, int argno)
+uint64_t common_semi_arg(CPUState *cs, int argno)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     return env->gpr[xA0 + argno];
 }
 
-static inline void common_semi_set_ret(CPUState *cs, uint64_t ret)
+void common_semi_set_ret(CPUState *cs, uint64_t ret)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     env->gpr[xA0] = ret;
 }
 
-static inline bool is_64bit_semihosting(CPUArchState *env)
+bool is_64bit_semihosting(CPUArchState *env)
 {
     return riscv_cpu_mxl(env) != MXL_RV32;
 }
 
-static inline bool common_semi_sys_exit_is_extended(CPUState *cs)
+bool common_semi_sys_exit_is_extended(CPUState *cs)
 {
     return is_64bit_semihosting(cpu_env(cs));
 }
 
-static inline uint64_t common_semi_stack_bottom(CPUState *cs)
+uint64_t common_semi_stack_bottom(CPUState *cs)
 {
     RISCVCPU *cpu = RISCV_CPU(cs);
     CPURISCVState *env = &cpu->env;
     return env->gpr[xSP];
 }
 
-static inline bool common_semi_has_synccache(CPUArchState *env)
+bool common_semi_has_synccache(CPUArchState *env)
 {
     return true;
 }
-
-#endif
diff --git a/target/riscv/meson.build b/target/riscv/meson.build
index a4bd61e52a..fdefe88ccd 100644
--- a/target/riscv/meson.build
+++ b/target/riscv/meson.build
@@ -8,6 +8,10 @@ gen = [
 
 riscv_ss = ss.source_set()
 riscv_ss.add(gen)
+
+riscv_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
+		     if_true: files('common-semi-target.c'))
+
 riscv_ss.add(files(
   'cpu.c',
   'cpu_helper.c',

From feb49fa79bdbd96d9f3aa604c9217f70d2c36b8c Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:56 +0100
Subject: [PATCH 0678/2396] semihosting/arm-compat-semi: eradicate
 sizeof(target_ulong)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

No semantic change.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-9-pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-12-alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 604a69e364..6725dcf4ba 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -786,7 +786,7 @@ void do_common_semihosting(CPUState *cs)
 
     case TARGET_SYS_ELAPSED:
         elapsed = get_clock() - clock_start;
-        if (sizeof(target_ulong) == 8) {
+        if (is_64bit_semihosting(env)) {
             if (SET_ARG(0, elapsed)) {
                 goto do_fault;
             }

From 6dfbf9b6cfe461ac60c8c9ee7326fb423faa7987 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:57 +0100
Subject: [PATCH 0679/2396] semihosting/arm-compat-semi: replace target_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace with vaddr or uint64_t where appropriate.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-10-pierrick.bouvier@linaro.org>
[AJB: tweak commit message]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-13-alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 6725dcf4ba..29cdab66f7 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -123,7 +123,7 @@ static GuestFD console_out_gf;
  */
 
 typedef struct LayoutInfo {
-    target_ulong rambase;
+    vaddr rambase;
     size_t ramsize;
     hwaddr heapbase;
     hwaddr heaplimit;
@@ -214,7 +214,7 @@ static LayoutInfo common_semi_find_bases(CPUState *cs)
  * global, and we assume that the guest takes care of avoiding any races.
  */
 #ifndef CONFIG_USER_ONLY
-static target_ulong syscall_err;
+static uint64_t syscall_err;
 
 #include "semihosting/uaccess.h"
 #endif
@@ -260,8 +260,8 @@ static void common_semi_rw_cb(CPUState *cs, uint64_t ret, int err)
 {
     /* Recover the original length from the third argument. */
     CPUArchState *env G_GNUC_UNUSED = cpu_env(cs);
-    target_ulong args = common_semi_arg(cs, 1);
-    target_ulong arg2;
+    uint64_t args = common_semi_arg(cs, 1);
+    uint64_t arg2;
     GET_ARG(2);
 
     if (err) {
@@ -300,9 +300,9 @@ static void common_semi_seek_cb(CPUState *cs, uint64_t ret, int err)
  * is defined by GDB's remote protocol and is not target-specific.)
  * We put this on the guest's stack just below SP.
  */
-static target_ulong common_semi_flen_buf(CPUState *cs)
+static uint64_t common_semi_flen_buf(CPUState *cs)
 {
-    target_ulong sp = common_semi_stack_bottom(cs);
+    vaddr sp = common_semi_stack_bottom(cs);
     return sp - 64;
 }
 
@@ -389,9 +389,9 @@ void semihosting_arm_compatible_init(void)
 void do_common_semihosting(CPUState *cs)
 {
     CPUArchState *env = cpu_env(cs);
-    target_ulong args;
-    target_ulong arg0, arg1, arg2, arg3;
-    target_ulong ul_ret;
+    uint64_t args;
+    uint64_t arg0, arg1, arg2, arg3;
+    uint64_t ul_ret;
     char * s;
     int nr;
     int64_t elapsed;
@@ -462,7 +462,7 @@ void do_common_semihosting(CPUState *cs)
 
     case TARGET_SYS_WRITEC:
         /*
-         * FIXME: the byte to be written is in a target_ulong slot,
+         * FIXME: the byte to be written is in a uint64_t slot,
          * which means this is wrong for a big-endian guest.
          */
         semihost_sys_write_gf(cs, common_semi_dead_cb,
@@ -688,7 +688,7 @@ void do_common_semihosting(CPUState *cs)
 
     case TARGET_SYS_HEAPINFO:
         {
-            target_ulong retvals[4];
+            uint64_t retvals[4];
             int i;
 #ifdef CONFIG_USER_ONLY
             TaskState *ts = get_task_state(cs);

From ab385d594c5189dd3182e902053276863dda6032 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:58 +0100
Subject: [PATCH 0680/2396] semihosting/arm-compat-semi: eradicate target_long
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We use int64_t or int32_t depending on ret size.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-11-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-14-alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 29cdab66f7..3c9192d868 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -501,10 +501,13 @@ void do_common_semihosting(CPUState *cs)
         break;
 
     case TARGET_SYS_ISERROR:
+    {
         GET_ARG(0);
-        common_semi_set_ret(cs, (target_long)arg0 < 0);
+        bool ret = is_64bit_semihosting(env) ?
+                   (int64_t)arg0 < 0 : (int32_t)arg0 < 0;
+        common_semi_set_ret(cs, ret);
         break;
-
+    }
     case TARGET_SYS_ISTTY:
         GET_ARG(0);
         semihost_sys_isatty(cs, common_semi_istty_cb, arg0);

From d3fe75400746dfd102cf317ca9c2da744f580536 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:36:59 +0100
Subject: [PATCH 0681/2396] semihosting/arm-compat-semi: remove dependency on
 cpu.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-12-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-15-alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 3c9192d868..6100126796 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -34,7 +34,6 @@
 #include "qemu/osdep.h"
 #include "qemu/timer.h"
 #include "exec/gdbstub.h"
-#include "cpu.h"
 #include "gdbstub/syscalls.h"
 #include "semihosting/semihost.h"
 #include "semihosting/console.h"

From c9e79557e465dc5ec92803aca4f330b9dc3c2d41 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:00 +0100
Subject: [PATCH 0682/2396] semihosting/arm-compat-semi: compile once in system
 and per target for user mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't have any target dependency left in system mode, so we can
compile once.

User mode depends on qemu.h, which is duplicated between linux and bsd,
so we can't easily compile it once.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250822150058.18692-13-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-16-alex.bennee@linaro.org>
---
 semihosting/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/semihosting/meson.build b/semihosting/meson.build
index bb0db32393..99f10e2e2b 100644
--- a/semihosting/meson.build
+++ b/semihosting/meson.build
@@ -12,9 +12,10 @@ system_ss.add(when: 'CONFIG_SEMIHOSTING', if_true: files(
   'stubs-system.c',
 ))
 system_ss.add(when: 'CONFIG_ARM_COMPATIBLE_SEMIHOSTING',
+  if_true: files('arm-compat-semi.c'),
   if_false: files('arm-compat-semi-stub.c'))
 
 specific_ss.add(when: ['CONFIG_SEMIHOSTING', 'CONFIG_USER_ONLY'],
                 if_true: files('syscalls.c'))
-specific_ss.add(when: ['CONFIG_ARM_COMPATIBLE_SEMIHOSTING'],
+specific_ss.add(when: ['CONFIG_ARM_COMPATIBLE_SEMIHOSTING', 'CONFIG_USER_ONLY'],
 		if_true: files('arm-compat-semi.c'))

From 04387b4a056771bf4a95b310507c8302f12c4b65 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 22 Sep 2025 10:37:01 +0100
Subject: [PATCH 0683/2396] contrib/plugins/execlog: Explicitly check for
 qemu_plugin_read_register() failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In insn_check_regs() we don't explicitly check whether
qemu_plugin_read_register() failed, which confuses Coverity into
thinking that sz can be -1 in the memcmp().  In fact the assertion
that sz == reg->last->len means this can't happen, but it's clearer
to both humans and Coverity if we explicitly assert that sz > 0, as
we already do in init_vcpu_register().

Coverity: CID 1611901, 1611902
Fixes: af6e4e0a22c1 ("contrib/plugins: extend execlog to track register changes")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250710144543.1187715-1-peter.maydell@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-17-alex.bennee@linaro.org>
---
 contrib/plugins/execlog.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/plugins/execlog.c b/contrib/plugins/execlog.c
index 06ec76d6e9..811f320319 100644
--- a/contrib/plugins/execlog.c
+++ b/contrib/plugins/execlog.c
@@ -95,6 +95,7 @@ static void insn_check_regs(CPU *cpu)
 
         g_byte_array_set_size(reg->new, 0);
         sz = qemu_plugin_read_register(reg->handle, reg->new);
+        g_assert(sz > 0);
         g_assert(sz == reg->last->len);
 
         if (memcmp(reg->last->data, reg->new->data, sz)) {

From 293028ca25fdf0c9b91e5e9eeea16fe4cc4b9217 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:02 +0100
Subject: [PATCH 0684/2396] contrib/plugins/uftrace: skeleton file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We define a scoreboard that will hold our data per cpu. As well, we
define a buffer per cpu that will be used to read registers and memories
in a thread-safe way.

For now, we just instrument all instructions with an empty callback.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-2-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-18-alex.bennee@linaro.org>
---
 contrib/plugins/meson.build |  3 +-
 contrib/plugins/uftrace.c   | 73 +++++++++++++++++++++++++++++++++++++
 2 files changed, 75 insertions(+), 1 deletion(-)
 create mode 100644 contrib/plugins/uftrace.c

diff --git a/contrib/plugins/meson.build b/contrib/plugins/meson.build
index 1876bc7843..7eb3629c95 100644
--- a/contrib/plugins/meson.build
+++ b/contrib/plugins/meson.build
@@ -1,5 +1,6 @@
 contrib_plugins = ['bbv', 'cache', 'cflow', 'drcov', 'execlog', 'hotblocks',
-                   'hotpages', 'howvec', 'hwprofile', 'ips', 'stoptrigger']
+                   'hotpages', 'howvec', 'hwprofile', 'ips', 'stoptrigger',
+                   'uftrace']
 if host_os != 'windows'
   # lockstep uses socket.h
   contrib_plugins += 'lockstep'
diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
new file mode 100644
index 0000000000..4af0130b15
--- /dev/null
+++ b/contrib/plugins/uftrace.c
@@ -0,0 +1,73 @@
+/*
+ * Copyright (C) 2025, Pierrick Bouvier <pierrick.bouvier@linaro.org>
+ *
+ * Generates a trace compatible with uftrace (similar to uftrace record).
+ * https://github.com/namhyung/uftrace
+ *
+ * See docs/about/emulation.rst|Uftrace for details and examples.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <qemu-plugin.h>
+#include <glib.h>
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
+
+typedef struct Cpu {
+    GByteArray *buf;
+} Cpu;
+
+static struct qemu_plugin_scoreboard *score;
+
+static void track_callstack(unsigned int cpu_index, void *udata)
+{
+}
+
+static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
+{
+    size_t n_insns = qemu_plugin_tb_n_insns(tb);
+
+    for (size_t i = 0; i < n_insns; i++) {
+        struct qemu_plugin_insn *insn = qemu_plugin_tb_get_insn(tb, i);
+
+        uintptr_t pc = qemu_plugin_insn_vaddr(insn);
+        qemu_plugin_register_vcpu_insn_exec_cb(insn, track_callstack,
+                                               QEMU_PLUGIN_CB_R_REGS,
+                                               (void *) pc);
+    }
+}
+
+static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
+{
+    Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
+    cpu->buf = g_byte_array_new();
+}
+
+static void vcpu_end(unsigned int vcpu_index)
+{
+    Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
+    g_byte_array_free(cpu->buf, true);
+    memset(cpu, 0, sizeof(Cpu));
+}
+
+static void at_exit(qemu_plugin_id_t id, void *data)
+{
+    for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
+        vcpu_end(i);
+    }
+
+    qemu_plugin_scoreboard_free(score);
+}
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
+                                           const qemu_info_t *info,
+                                           int argc, char **argv)
+{
+    score = qemu_plugin_scoreboard_new(sizeof(Cpu));
+    qemu_plugin_register_vcpu_init_cb(id, vcpu_init);
+    qemu_plugin_register_atexit_cb(id, at_exit, NULL);
+    qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
+
+    return 0;
+}

From 490aa81855e1c85466368a707ddf6da61097ff13 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:03 +0100
Subject: [PATCH 0685/2396] contrib/plugins/uftrace: define cpu operations and
 implement aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We define a new CpuOps structure that will be used to implement tracking
independently of guest architecture.

As well, we now instrument only instructions following ones that might
have touched the frame pointer.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-3-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-19-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 114 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 110 insertions(+), 4 deletions(-)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index 4af0130b15..d060513446 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -11,14 +11,94 @@
 
 #include <qemu-plugin.h>
 #include <glib.h>
+#include <stdio.h>
 
 QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
 
+typedef struct Cpu Cpu;
+
+typedef struct {
+    void (*init)(Cpu *cpu);
+    void (*end)(Cpu *cpu);
+    uint64_t (*get_frame_pointer)(Cpu *cpu);
+    bool (*does_insn_modify_frame_pointer)(const char *disas);
+} CpuOps;
+
 typedef struct Cpu {
     GByteArray *buf;
+    CpuOps ops;
+    void *arch;
 } Cpu;
 
+typedef struct {
+    struct qemu_plugin_register *reg_fp;
+} Aarch64Cpu;
+
 static struct qemu_plugin_scoreboard *score;
+static CpuOps arch_ops;
+
+static uint64_t cpu_read_register64(Cpu *cpu, struct qemu_plugin_register *reg)
+{
+    GByteArray *buf = cpu->buf;
+    g_byte_array_set_size(buf, 0);
+    size_t sz = qemu_plugin_read_register(reg, buf);
+    g_assert(sz == 8);
+    g_assert(buf->len == 8);
+    return *((uint64_t *) buf->data);
+}
+
+static struct qemu_plugin_register *plugin_find_register(const char *name)
+{
+    g_autoptr(GArray) regs = qemu_plugin_get_registers();
+    for (int i = 0; i < regs->len; ++i) {
+        qemu_plugin_reg_descriptor *reg;
+        reg = &g_array_index(regs, qemu_plugin_reg_descriptor, i);
+        if (!strcmp(reg->name, name)) {
+            return reg->handle;
+        }
+    }
+    return NULL;
+}
+
+static uint64_t aarch64_get_frame_pointer(Cpu *cpu_)
+{
+    Aarch64Cpu *cpu = cpu_->arch;
+    return cpu_read_register64(cpu_, cpu->reg_fp);
+}
+
+static void aarch64_init(Cpu *cpu_)
+{
+    Aarch64Cpu *cpu = g_new0(Aarch64Cpu, 1);
+    cpu_->arch = cpu;
+    cpu->reg_fp = plugin_find_register("x29");
+    if (!cpu->reg_fp) {
+        fprintf(stderr, "uftrace plugin: frame pointer register (x29) is not "
+                        "available. Please use an AArch64 cpu (or -cpu max).\n");
+        g_abort();
+    }
+}
+
+static void aarch64_end(Cpu *cpu)
+{
+    g_free(cpu->arch);
+}
+
+static bool aarch64_does_insn_modify_frame_pointer(const char *disas)
+{
+    /*
+     * Check if current instruction concerns fp register "x29".
+     * We add a prefix space to make sure we don't match addresses dump
+     * in disassembly.
+     */
+    return strstr(disas, " x29");
+}
+
+static CpuOps aarch64_ops = {
+    .init = aarch64_init,
+    .end = aarch64_end,
+    .get_frame_pointer = aarch64_get_frame_pointer,
+    .does_insn_modify_frame_pointer = aarch64_does_insn_modify_frame_pointer,
+};
 
 static void track_callstack(unsigned int cpu_index, void *udata)
 {
@@ -28,19 +108,37 @@ static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
 {
     size_t n_insns = qemu_plugin_tb_n_insns(tb);
 
+    /*
+     * Callbacks and inline instrumentation are inserted before an instruction.
+     * Thus, to see instruction effect, we need to wait for next one.
+     * Potentially, the last instruction of a block could modify the frame
+     * pointer. Thus, we need to always instrument first instruction in a tb.
+     */
+    bool instrument_insn = true;
     for (size_t i = 0; i < n_insns; i++) {
         struct qemu_plugin_insn *insn = qemu_plugin_tb_get_insn(tb, i);
 
-        uintptr_t pc = qemu_plugin_insn_vaddr(insn);
-        qemu_plugin_register_vcpu_insn_exec_cb(insn, track_callstack,
-                                               QEMU_PLUGIN_CB_R_REGS,
-                                               (void *) pc);
+        if (instrument_insn) {
+            uintptr_t pc = qemu_plugin_insn_vaddr(insn);
+            qemu_plugin_register_vcpu_insn_exec_cb(insn, track_callstack,
+                                                   QEMU_PLUGIN_CB_R_REGS,
+                                                   (void *) pc);
+            instrument_insn = false;
+        }
+
+        char *disas = qemu_plugin_insn_disas(insn);
+        if (arch_ops.does_insn_modify_frame_pointer(disas)) {
+            instrument_insn = true;
+        }
     }
 }
 
 static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
 {
     Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
+    cpu->ops = arch_ops;
+
+    cpu->ops.init(cpu);
     cpu->buf = g_byte_array_new();
 }
 
@@ -64,6 +162,14 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                                            const qemu_info_t *info,
                                            int argc, char **argv)
 {
+    if (!strcmp(info->target_name, "aarch64")) {
+        arch_ops = aarch64_ops;
+    } else {
+        fprintf(stderr, "plugin uftrace: %s target is not supported\n",
+                info->target_name);
+        return 1;
+    }
+
     score = qemu_plugin_scoreboard_new(sizeof(Cpu));
     qemu_plugin_register_vcpu_init_cb(id, vcpu_init);
     qemu_plugin_register_atexit_cb(id, at_exit, NULL);

From 992fe17bd7e9648e9e79eb72826eff26a660bb1b Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:04 +0100
Subject: [PATCH 0686/2396] contrib/plugins/uftrace: track callstack
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We now track callstack, based on frame pointer analysis. We can detect
function calls, returns, and discontinuities.
We implement a frame pointer based unwinding that is used for
discontinuities.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-4-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-20-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 160 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 160 insertions(+)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index d060513446..bb77591627 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -15,6 +15,15 @@
 
 QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
 
+typedef struct {
+    GArray *s;
+} Callstack;
+
+typedef struct {
+    uint64_t pc;
+    uint64_t frame_pointer;
+} CallstackEntry;
+
 typedef struct Cpu Cpu;
 
 typedef struct {
@@ -25,6 +34,7 @@ typedef struct {
 } CpuOps;
 
 typedef struct Cpu {
+    Callstack *cs;
     GByteArray *buf;
     CpuOps ops;
     void *arch;
@@ -37,6 +47,71 @@ typedef struct {
 static struct qemu_plugin_scoreboard *score;
 static CpuOps arch_ops;
 
+static Callstack *callstack_new(void)
+{
+    Callstack *cs = g_new0(Callstack, 1);
+    cs->s = g_array_new(false, false, sizeof(CallstackEntry));
+    return cs;
+}
+
+static void callstack_free(Callstack *cs)
+{
+    g_array_free(cs->s, true);
+    cs->s = NULL;
+    g_free(cs);
+}
+
+static size_t callstack_depth(const Callstack *cs)
+{
+    return cs->s->len;
+}
+
+static size_t callstack_empty(const Callstack *cs)
+{
+    return callstack_depth(cs) == 0;
+}
+
+static void callstack_clear(Callstack *cs)
+{
+    g_array_set_size(cs->s, 0);
+}
+
+static const CallstackEntry *callstack_at(const Callstack *cs, size_t depth)
+{
+    g_assert(depth > 0);
+    g_assert(depth <= callstack_depth(cs));
+    return &g_array_index(cs->s, CallstackEntry, depth - 1);
+}
+
+static CallstackEntry callstack_top(const Callstack *cs)
+{
+    if (callstack_depth(cs) >= 1) {
+        return *callstack_at(cs, callstack_depth(cs));
+    }
+    return (CallstackEntry){};
+}
+
+static CallstackEntry callstack_caller(const Callstack *cs)
+{
+    if (callstack_depth(cs) >= 2) {
+        return *callstack_at(cs, callstack_depth(cs) - 1);
+    }
+    return (CallstackEntry){};
+}
+
+static void callstack_push(Callstack *cs, CallstackEntry e)
+{
+    g_array_append_val(cs->s, e);
+}
+
+static CallstackEntry callstack_pop(Callstack *cs)
+{
+    g_assert(!callstack_empty(cs));
+    CallstackEntry e = callstack_top(cs);
+    g_array_set_size(cs->s, callstack_depth(cs) - 1);
+    return e;
+}
+
 static uint64_t cpu_read_register64(Cpu *cpu, struct qemu_plugin_register *reg)
 {
     GByteArray *buf = cpu->buf;
@@ -47,6 +122,50 @@ static uint64_t cpu_read_register64(Cpu *cpu, struct qemu_plugin_register *reg)
     return *((uint64_t *) buf->data);
 }
 
+static uint64_t cpu_read_memory64(Cpu *cpu, uint64_t addr)
+{
+    g_assert(addr);
+    GByteArray *buf = cpu->buf;
+    g_byte_array_set_size(buf, 0);
+    bool read = qemu_plugin_read_memory_vaddr(addr, buf, 8);
+    if (!read) {
+        return 0;
+    }
+    g_assert(buf->len == 8);
+    return *((uint64_t *) buf->data);
+}
+
+static void cpu_unwind_stack(Cpu *cpu, uint64_t frame_pointer, uint64_t pc)
+{
+    g_assert(callstack_empty(cpu->cs));
+
+    #define UNWIND_STACK_MAX_DEPTH 1024
+    CallstackEntry unwind[UNWIND_STACK_MAX_DEPTH];
+    size_t depth = 0;
+    do {
+        /* check we don't have an infinite stack */
+        for (size_t i = 0; i < depth; ++i) {
+            if (frame_pointer == unwind[i].frame_pointer) {
+                break;
+            }
+        }
+        CallstackEntry e = {.frame_pointer = frame_pointer, .pc = pc};
+        unwind[depth] = e;
+        depth++;
+        if (frame_pointer) {
+            frame_pointer = cpu_read_memory64(cpu, frame_pointer);
+        }
+        pc = cpu_read_memory64(cpu, frame_pointer + 8); /* read previous lr */
+    } while (frame_pointer && pc && depth < UNWIND_STACK_MAX_DEPTH);
+    #undef UNWIND_STACK_MAX_DEPTH
+
+    /* push it from bottom to top */
+    while (depth) {
+        callstack_push(cpu->cs, unwind[depth - 1]);
+        --depth;
+    }
+}
+
 static struct qemu_plugin_register *plugin_find_register(const char *name)
 {
     g_autoptr(GArray) regs = qemu_plugin_get_registers();
@@ -102,6 +221,43 @@ static CpuOps aarch64_ops = {
 
 static void track_callstack(unsigned int cpu_index, void *udata)
 {
+    uint64_t pc = (uintptr_t) udata;
+    Cpu *cpu = qemu_plugin_scoreboard_find(score, cpu_index);
+    Callstack *cs = cpu->cs;
+
+    uint64_t fp = cpu->ops.get_frame_pointer(cpu);
+    if (!fp && callstack_empty(cs)) {
+        /*
+         * We simply push current pc. Note that we won't detect symbol change as
+         * long as a proper call does not happen.
+         */
+        callstack_push(cs, (CallstackEntry){.frame_pointer = fp, .pc = pc});
+        return;
+    }
+
+    CallstackEntry top = callstack_top(cs);
+    if (fp == top.frame_pointer) {
+        /* same function */
+        return;
+    }
+
+    CallstackEntry caller = callstack_caller(cs);
+    if (fp == caller.frame_pointer) {
+        /* return */
+        callstack_pop(cs);
+        return;
+    }
+
+    uint64_t caller_fp = fp ? cpu_read_memory64(cpu, fp) : 0;
+    if (caller_fp == top.frame_pointer) {
+        /* call */
+        callstack_push(cs, (CallstackEntry){.frame_pointer = fp, .pc = pc});
+        return;
+    }
+
+    /* discontinuity, exit current stack and unwind new one */
+    callstack_clear(cs);
+    cpu_unwind_stack(cpu, fp, pc);
 }
 
 static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
@@ -140,12 +296,16 @@ static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
 
     cpu->ops.init(cpu);
     cpu->buf = g_byte_array_new();
+
+    cpu->cs = callstack_new();
 }
 
 static void vcpu_end(unsigned int vcpu_index)
 {
     Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
     g_byte_array_free(cpu->buf, true);
+
+    callstack_free(cpu->cs);
     memset(cpu, 0, sizeof(Cpu));
 }
 

From bba94f7876436b798a87894d2e9886429ccda446 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:05 +0100
Subject: [PATCH 0687/2396] contrib/plugins/uftrace: implement tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We implement tracing, following uftrace format.
Trace is flushed every 32 MB, so file operations don't impact
performance at runtime.

A different trace is generated per cpu, and we ensure they have a unique
name, based on vcpu_index, while keeping room for privilege level coming
in next commit.

Uftrace format is not officially documented, but it can be found here:
https://github.com/namhyung/uftrace/blob/v0.18/libmcount/record.c#L909

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-5-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-21-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 152 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 151 insertions(+), 1 deletion(-)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index bb77591627..b9dcd53198 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -12,6 +12,15 @@
 #include <qemu-plugin.h>
 #include <glib.h>
 #include <stdio.h>
+#include <sys/stat.h>
+#include <sys/time.h>
+#include <time.h>
+#include <unistd.h>
+
+#define MiB     (INT64_C(1) << 20)
+#define NANOSECONDS_PER_SECOND 1000000000LL
+#define TRACE_FLUSH_SIZE (32 * MiB)
+#define TRACE_ID_SCALE 100
 
 QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
 
@@ -24,6 +33,13 @@ typedef struct {
     uint64_t frame_pointer;
 } CallstackEntry;
 
+typedef struct {
+    GArray *t;
+    GString *path;
+    GString *name;
+    uint32_t id;
+} Trace;
+
 typedef struct Cpu Cpu;
 
 typedef struct {
@@ -34,6 +50,7 @@ typedef struct {
 } CpuOps;
 
 typedef struct Cpu {
+    Trace *trace;
     Callstack *cs;
     GByteArray *buf;
     CpuOps ops;
@@ -44,9 +61,41 @@ typedef struct {
     struct qemu_plugin_register *reg_fp;
 } Aarch64Cpu;
 
+typedef struct {
+    uint64_t timestamp;
+    uint64_t data;
+} UftraceEntry;
+
+typedef enum {
+    UFTRACE_ENTRY,
+    UFTRACE_EXIT,
+    UFTRACE_LOST,
+    UFTRACE_EVENT,
+} UftraceRecordType;
+
 static struct qemu_plugin_scoreboard *score;
 static CpuOps arch_ops;
 
+static uint64_t gettime_ns(void)
+{
+#ifdef _WIN32
+    /*
+     * On Windows, timespec_get is available only with UCRT, but not with
+     * MinGW64 environment. Simplify by using only gettimeofday on this
+     * platform. This may result in a precision loss.
+     */
+    struct timeval tv;
+    gettimeofday(&tv, NULL);
+    uint64_t now_ns = tv.tv_sec * NANOSECONDS_PER_SECOND + tv.tv_usec * 1000;
+#else
+    /* We need nanosecond precision for short lived functions. */
+    struct timespec ts;
+    timespec_get(&ts, TIME_UTC);
+    uint64_t now_ns = ts.tv_sec * NANOSECONDS_PER_SECOND + ts.tv_nsec;
+#endif
+    return now_ns;
+}
+
 static Callstack *callstack_new(void)
 {
     Callstack *cs = g_new0(Callstack, 1);
@@ -112,6 +161,86 @@ static CallstackEntry callstack_pop(Callstack *cs)
     return e;
 }
 
+static Trace *trace_new(uint32_t id, GString *name)
+{
+    Trace *t = g_new0(Trace, 1);
+    t->t = g_array_new(false, false, sizeof(UftraceEntry));
+    t->path = g_string_new(NULL);
+    g_string_append_printf(t->path, "./uftrace.data/%"PRIu32".dat", id);
+    t->name = g_string_new(name->str);
+    t->id = id;
+    return t;
+}
+
+static void trace_free(Trace *t)
+{
+    g_assert(t->t->len == 0);
+    g_array_free(t->t, true);
+    t->t = NULL;
+    g_string_free(t->path, true);
+    t->path = NULL;
+    g_string_free(t->name, true);
+    t->name = NULL;
+    g_free(t);
+}
+
+static void trace_flush(Trace *t, bool append)
+{
+    int create_dir = g_mkdir_with_parents("./uftrace.data",
+                                          S_IRWXU | S_IRWXG | S_IRWXO);
+    g_assert(create_dir == 0);
+    FILE *dat = fopen(t->path->str, append ? "a" : "w");
+    g_assert(dat);
+    GArray *data = t->t;
+    if (data->len) {
+        size_t wrote = fwrite(data->data, sizeof(UftraceEntry), data->len, dat);
+        g_assert(wrote == data->len);
+    }
+    fclose(dat);
+    g_array_set_size(data, 0);
+}
+
+static void trace_add_entry(Trace *t, uint64_t timestamp, uint64_t pc,
+                            size_t depth, UftraceRecordType type)
+{
+    /* https://github.com/namhyung/uftrace/blob/v0.18/libmcount/record.c#L909 */
+    const uint64_t record_magic = 0x5;
+    uint64_t data = type | (record_magic << 3);
+    data += depth << 6;
+    data += pc << 16;
+    UftraceEntry e = {.timestamp = timestamp, .data = data};
+    g_array_append_val(t->t, e);
+    if (t->t->len * sizeof(UftraceEntry) > TRACE_FLUSH_SIZE) {
+        trace_flush(t, true);
+    }
+}
+
+static void trace_enter_function(Trace *t, uint64_t timestamp,
+                                 uint64_t pc, size_t depth)
+{
+    trace_add_entry(t, timestamp, pc, depth, UFTRACE_ENTRY);
+}
+
+static void trace_exit_function(Trace *t, uint64_t timestamp,
+                                uint64_t pc, size_t depth)
+{
+    trace_add_entry(t, timestamp, pc, depth, UFTRACE_EXIT);
+}
+
+static void trace_enter_stack(Trace *t, Callstack *cs, uint64_t timestamp)
+{
+    for (size_t depth = 1; depth <= callstack_depth(cs); ++depth) {
+        trace_enter_function(t, timestamp, callstack_at(cs, depth)->pc, depth);
+    }
+}
+
+static void trace_exit_stack(Trace *t, Callstack *cs, uint64_t timestamp)
+{
+    for (size_t depth = callstack_depth(cs); depth > 0; --depth) {
+        trace_exit_function(t, timestamp, callstack_at(cs, depth)->pc, depth);
+    }
+}
+
 static uint64_t cpu_read_register64(Cpu *cpu, struct qemu_plugin_register *reg)
 {
     GByteArray *buf = cpu->buf;
@@ -223,7 +352,9 @@ static void track_callstack(unsigned int cpu_index, void *udata)
 {
     uint64_t pc = (uintptr_t) udata;
     Cpu *cpu = qemu_plugin_scoreboard_find(score, cpu_index);
+    uint64_t timestamp = gettime_ns();
     Callstack *cs = cpu->cs;
+    Trace *t = cpu->trace;
 
     uint64_t fp = cpu->ops.get_frame_pointer(cpu);
     if (!fp && callstack_empty(cs)) {
@@ -232,6 +363,7 @@ static void track_callstack(unsigned int cpu_index, void *udata)
          * long as a proper call does not happen.
          */
         callstack_push(cs, (CallstackEntry){.frame_pointer = fp, .pc = pc});
+        trace_enter_function(t, timestamp, pc, callstack_depth(cs));
         return;
     }
 
@@ -244,7 +376,8 @@ static void track_callstack(unsigned int cpu_index, void *udata)
     CallstackEntry caller = callstack_caller(cs);
     if (fp == caller.frame_pointer) {
         /* return */
-        callstack_pop(cs);
+        CallstackEntry e = callstack_pop(cs);
+        trace_exit_function(t, timestamp, e.pc, callstack_depth(cs));
         return;
     }
 
@@ -252,12 +385,16 @@ static void track_callstack(unsigned int cpu_index, void *udata)
     if (caller_fp == top.frame_pointer) {
         /* call */
         callstack_push(cs, (CallstackEntry){.frame_pointer = fp, .pc = pc});
+        trace_enter_function(t, timestamp, pc, callstack_depth(cs));
         return;
     }
 
     /* discontinuity, exit current stack and unwind new one */
+    trace_exit_stack(t, cs, timestamp);
     callstack_clear(cs);
+
     cpu_unwind_stack(cpu, fp, pc);
+    trace_enter_stack(t, cs, timestamp);
 }
 
 static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
@@ -297,6 +434,16 @@ static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
     cpu->ops.init(cpu);
     cpu->buf = g_byte_array_new();
 
+    g_assert(vcpu_index < UINT32_MAX / TRACE_ID_SCALE);
+    /* trace_id is: cpu_number * TRACE_ID_SCALE */
+    uint32_t trace_id = (vcpu_index + 1) * TRACE_ID_SCALE;
+
+    g_autoptr(GString) trace_name = g_string_new(NULL);
+    g_string_append_printf(trace_name, "cpu%u", vcpu_index);
+    cpu->trace = trace_new(trace_id, trace_name);
+    /* create/truncate trace file */
+    trace_flush(cpu->trace, false);
+
     cpu->cs = callstack_new();
 }
 
@@ -305,6 +452,7 @@ static void vcpu_end(unsigned int vcpu_index)
     Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
     g_byte_array_free(cpu->buf, true);
 
+    trace_free(cpu->trace);
     callstack_free(cpu->cs);
     memset(cpu, 0, sizeof(Cpu));
 }
@@ -312,6 +460,8 @@ static void vcpu_end(unsigned int vcpu_index)
 static void at_exit(qemu_plugin_id_t id, void *data)
 {
     for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
+        Cpu *cpu = qemu_plugin_scoreboard_find(score, i);
+        trace_flush(cpu->trace, true);
         vcpu_end(i);
     }
 

From 308c20108a476722d49d9e463d81662b0722bc40 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:06 +0100
Subject: [PATCH 0688/2396] contrib/plugins/uftrace: implement privilege level
 tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We add new option trace-privilege-level=bool, which will create a
separate trace for each privilege level.
This allows to follow changes of privilege during execution.

We implement aarch64 operations to track current privilege level
accordingly.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-6-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-22-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 190 ++++++++++++++++++++++++++++++++++++--
 1 file changed, 182 insertions(+), 8 deletions(-)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index b9dcd53198..10abad0673 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -46,19 +46,40 @@ typedef struct {
     void (*init)(Cpu *cpu);
     void (*end)(Cpu *cpu);
     uint64_t (*get_frame_pointer)(Cpu *cpu);
+    uint8_t (*get_privilege_level)(Cpu *cpu);
+    uint8_t (*num_privilege_levels)(void);
+    const char *(*get_privilege_level_name)(uint8_t pl);
     bool (*does_insn_modify_frame_pointer)(const char *disas);
 } CpuOps;
 
 typedef struct Cpu {
     Trace *trace;
     Callstack *cs;
+    uint8_t privilege_level;
+    GArray *traces; /* Trace *traces [] */
     GByteArray *buf;
     CpuOps ops;
     void *arch;
 } Cpu;
 
+typedef enum {
+    AARCH64_EL0_SECURE,
+    AARCH64_EL0_NONSECURE,
+    AARCH64_EL0_REALM,
+    AARCH64_EL1_SECURE,
+    AARCH64_EL1_NONSECURE,
+    AARCH64_EL1_REALM,
+    AARCH64_EL2_SECURE,
+    AARCH64_EL2_NONSECURE,
+    AARCH64_EL2_REALM,
+    AARCH64_EL3,
+    AARCH64_PRIVILEGE_LEVEL_MAX,
+} Aarch64PrivilegeLevel;
+
 typedef struct {
     struct qemu_plugin_register *reg_fp;
+    struct qemu_plugin_register *reg_cpsr;
+    struct qemu_plugin_register *reg_scr_el3;
 } Aarch64Cpu;
 
 typedef struct {
@@ -74,6 +95,7 @@ typedef enum {
 } UftraceRecordType;
 
 static struct qemu_plugin_scoreboard *score;
+static bool trace_privilege_level;
 static CpuOps arch_ops;
 
 static uint64_t gettime_ns(void)
@@ -251,6 +273,16 @@ static uint64_t cpu_read_register64(Cpu *cpu, struct qemu_plugin_register *reg)
     return *((uint64_t *) buf->data);
 }
 
+static uint32_t cpu_read_register32(Cpu *cpu, struct qemu_plugin_register *reg)
+{
+    GByteArray *buf = cpu->buf;
+    g_byte_array_set_size(buf, 0);
+    size_t sz = qemu_plugin_read_register(reg, buf);
+    g_assert(sz == 4);
+    g_assert(buf->len == 4);
+    return *((uint32_t *) buf->data);
+}
+
 static uint64_t cpu_read_memory64(Cpu *cpu, uint64_t addr)
 {
     g_assert(addr);
@@ -308,6 +340,68 @@ static struct qemu_plugin_register *plugin_find_register(const char *name)
     return NULL;
 }
 
+static uint8_t aarch64_num_privilege_levels(void)
+{
+    return AARCH64_PRIVILEGE_LEVEL_MAX;
+}
+
+static const char *aarch64_get_privilege_level_name(uint8_t pl)
+{
+    switch (pl) {
+    case AARCH64_EL0_SECURE: return "S-EL0";
+    case AARCH64_EL0_NONSECURE: return "NS-EL0";
+    case AARCH64_EL0_REALM: return "R-EL0";
+    case AARCH64_EL1_SECURE: return "S-EL1";
+    case AARCH64_EL1_NONSECURE: return "NS-EL1";
+    case AARCH64_EL1_REALM: return "R-EL1";
+    case AARCH64_EL2_SECURE: return "S-EL2";
+    case AARCH64_EL2_NONSECURE: return "NS-EL2";
+    case AARCH64_EL2_REALM: return "R-EL2";
+    case AARCH64_EL3: return "EL3";
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static uint8_t aarch64_get_privilege_level(Cpu *cpu_)
+{
+    Aarch64Cpu *cpu = cpu_->arch;
+    /*
+     * QEMU gdbstub does not provide access to CurrentEL,
+     * so we use CPSR instead.
+     */
+    uint8_t el = cpu_read_register32(cpu_, cpu->reg_cpsr) >> 2 & 0b11;
+
+    if (el == 3) {
+        return AARCH64_EL3;
+    }
+
+    uint8_t ss = AARCH64_EL0_SECURE;
+    if (!cpu->reg_scr_el3) {
+        ss = AARCH64_EL0_NONSECURE;
+    }
+    uint64_t scr_el3 = cpu_read_register64(cpu_, cpu->reg_scr_el3);
+    uint64_t ns = (scr_el3 >> 0) & 0b1;
+    uint64_t nse = (scr_el3 >> 62) & 0b1;
+    switch (nse << 1 | ns) {
+    case 0b00:
+        ss = AARCH64_EL0_SECURE;
+        break;
+    case 0b01:
+        ss = AARCH64_EL0_NONSECURE;
+        break;
+    case 0b11:
+        ss = AARCH64_EL0_REALM;
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    const uint8_t num_ss = 3;
+    Aarch64PrivilegeLevel pl = el * num_ss + ss;
+    return pl;
+}
+
 static uint64_t aarch64_get_frame_pointer(Cpu *cpu_)
 {
     Aarch64Cpu *cpu = cpu_->arch;
@@ -324,6 +418,10 @@ static void aarch64_init(Cpu *cpu_)
                         "available. Please use an AArch64 cpu (or -cpu max).\n");
         g_abort();
     }
+    cpu->reg_cpsr = plugin_find_register("cpsr");
+    g_assert(cpu->reg_cpsr);
+    cpu->reg_scr_el3 = plugin_find_register("SCR_EL3");
+    /* scr_el3 is optional */
 }
 
 static void aarch64_end(Cpu *cpu)
@@ -345,9 +443,34 @@ static CpuOps aarch64_ops = {
     .init = aarch64_init,
     .end = aarch64_end,
     .get_frame_pointer = aarch64_get_frame_pointer,
+    .get_privilege_level = aarch64_get_privilege_level,
+    .num_privilege_levels = aarch64_num_privilege_levels,
+    .get_privilege_level_name = aarch64_get_privilege_level_name,
     .does_insn_modify_frame_pointer = aarch64_does_insn_modify_frame_pointer,
 };
 
+static void track_privilege_change(unsigned int cpu_index, void *udata)
+{
+    Cpu *cpu = qemu_plugin_scoreboard_find(score, cpu_index);
+    uint8_t new_pl = cpu->ops.get_privilege_level(cpu);
+
+    if (new_pl == cpu->privilege_level) {
+        return;
+    }
+
+    uint64_t pc = (uintptr_t) udata;
+    uint64_t timestamp = gettime_ns();
+
+    trace_exit_stack(cpu->trace, cpu->cs, timestamp);
+    callstack_clear(cpu->cs);
+
+    cpu->privilege_level = new_pl;
+    cpu->trace = g_array_index(cpu->traces, Trace*, new_pl);
+
+    cpu_unwind_stack(cpu, cpu->ops.get_frame_pointer(cpu), pc);
+    trace_enter_stack(cpu->trace, cpu->cs, timestamp);
+}
+
 static void track_callstack(unsigned int cpu_index, void *udata)
 {
     uint64_t pc = (uintptr_t) udata;
@@ -400,6 +523,13 @@ static void track_callstack(unsigned int cpu_index, void *udata)
 static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
 {
     size_t n_insns = qemu_plugin_tb_n_insns(tb);
+    uintptr_t tb_pc = qemu_plugin_tb_vaddr(tb);
+
+    if (trace_privilege_level) {
+        qemu_plugin_register_vcpu_tb_exec_cb(tb, track_privilege_change,
+                                             QEMU_PLUGIN_CB_R_REGS,
+                                             (void *) tb_pc);
+    }
 
     /*
      * Callbacks and inline instrumentation are inserted before an instruction.
@@ -433,18 +563,36 @@ static void vcpu_init(qemu_plugin_id_t id, unsigned int vcpu_index)
 
     cpu->ops.init(cpu);
     cpu->buf = g_byte_array_new();
+    cpu->traces = g_array_new(0, 0, sizeof(Trace *));
 
     g_assert(vcpu_index < UINT32_MAX / TRACE_ID_SCALE);
-    /* trace_id is: cpu_number * TRACE_ID_SCALE */
+    g_assert(cpu->ops.num_privilege_levels() < TRACE_ID_SCALE);
+    /* trace_id is: cpu_number * TRACE_ID_SCALE + privilege_level */
     uint32_t trace_id = (vcpu_index + 1) * TRACE_ID_SCALE;
 
-    g_autoptr(GString) trace_name = g_string_new(NULL);
-    g_string_append_printf(trace_name, "cpu%u", vcpu_index);
-    cpu->trace = trace_new(trace_id, trace_name);
-    /* create/truncate trace file */
-    trace_flush(cpu->trace, false);
+    if (trace_privilege_level) {
+        for (uint8_t pl = 0; pl < cpu->ops.num_privilege_levels(); ++pl) {
+            g_autoptr(GString) trace_name = g_string_new(NULL);
+            g_string_append_printf(trace_name, "cpu%u %s", vcpu_index,
+                                   cpu->ops.get_privilege_level_name(pl));
+            Trace *t = trace_new(trace_id + pl, trace_name);
+            g_array_append_val(cpu->traces, t);
+        }
+    } else {
+        g_autoptr(GString) trace_name = g_string_new(NULL);
+        g_string_append_printf(trace_name, "cpu%u", vcpu_index);
+        Trace *t = trace_new(trace_id, trace_name);
+        g_array_append_val(cpu->traces, t);
+    }
+
+    for (size_t i = 0; i < cpu->traces->len; ++i) {
+        /* create/truncate trace files */
+        Trace *t = g_array_index(cpu->traces, Trace*, i);
+        trace_flush(t, false);
+    }
 
     cpu->cs = callstack_new();
+    cpu->trace = g_array_index(cpu->traces, Trace*, cpu->privilege_level);
 }
 
 static void vcpu_end(unsigned int vcpu_index)
@@ -452,7 +600,12 @@ static void vcpu_end(unsigned int vcpu_index)
     Cpu *cpu = qemu_plugin_scoreboard_find(score, vcpu_index);
     g_byte_array_free(cpu->buf, true);
 
-    trace_free(cpu->trace);
+    for (size_t i = 0; i < cpu->traces->len; ++i) {
+        Trace *t = g_array_index(cpu->traces, Trace*, i);
+        trace_free(t);
+    }
+
+    g_array_free(cpu->traces, true);
     callstack_free(cpu->cs);
     memset(cpu, 0, sizeof(Cpu));
 }
@@ -461,7 +614,13 @@ static void at_exit(qemu_plugin_id_t id, void *data)
 {
     for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
         Cpu *cpu = qemu_plugin_scoreboard_find(score, i);
-        trace_flush(cpu->trace, true);
+        for (size_t j = 0; j < cpu->traces->len; ++j) {
+            Trace *t = g_array_index(cpu->traces, Trace*, j);
+            trace_flush(t, true);
+        }
+    }
+
+    for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
         vcpu_end(i);
     }
 
@@ -472,6 +631,21 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
                                            const qemu_info_t *info,
                                            int argc, char **argv)
 {
+    for (int i = 0; i < argc; i++) {
+        char *opt = argv[i];
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
+        if (g_strcmp0(tokens[0], "trace-privilege-level") == 0) {
+            if (!qemu_plugin_bool_parse(tokens[0], tokens[1],
+                                        &trace_privilege_level)) {
+                fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
+                return -1;
+            }
+        } else {
+            fprintf(stderr, "option parsing failed: %s\n", opt);
+            return -1;
+        }
+    }
+
     if (!strcmp(info->target_name, "aarch64")) {
         arch_ops = aarch64_ops;
     } else {

From 727874759566fcec4c52d103f1abc4f4d409e583 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:07 +0100
Subject: [PATCH 0689/2396] contrib/plugins/uftrace: generate additional files
 for uftrace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Beyond traces per cpu, uftrace expect to find some specific files.
- info: contains information about machine/program run
  those values are not impacting uftrace behaviour (only reported by
  uftrace info), and we simply added empty strings.
- memory mapping: how every binary is mapped in memory. For system mode,
  we generate an empty mapping (uftrace_symbols.py, coming in future
  commit, will take care of that). For user mode, we copy current
  /proc/self/maps. We don't need to do any special filtering, as
  reported addresses will necessarily concern guest program, and not
  QEMU and its libraries.
- task: list of tasks. We present every vcpu/privilege level as a
  separate process, as it's the best view we can have when generating a
  (visual) chrome trace. Using threads is less convenient in terms of
  UI.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-7-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-23-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 131 +++++++++++++++++++++++++++++++++++++-
 1 file changed, 130 insertions(+), 1 deletion(-)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index 10abad0673..2386cc723b 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -118,6 +118,127 @@ static uint64_t gettime_ns(void)
     return now_ns;
 }
 
+static void uftrace_write_map(bool system_emulation)
+{
+    const char *path = "./uftrace.data/sid-0.map";
+
+    if (system_emulation && access(path, F_OK) == 0) {
+        /* do not erase existing map in system emulation, as a custom one might
+         * already have been generated by uftrace_symbols.py */
+        return;
+    }
+
+    FILE *sid_map = fopen(path, "w");
+    g_assert(sid_map);
+
+    if (system_emulation) {
+        fprintf(sid_map,
+                "# map stack on highest address possible, to prevent uftrace\n"
+                "# from considering any kernel address\n");
+        fprintf(sid_map,
+          "ffffffffffff-ffffffffffff rw-p 00000000 00:00 0 [stack]\n");
+    } else {
+        /* in user mode, copy /proc/self/maps instead */
+        FILE *self_map = fopen("/proc/self/maps", "r");
+        g_assert(self_map);
+        for (;;) {
+            int c = fgetc(self_map);
+            if (c == EOF) {
+                break;
+            }
+            fputc(c, sid_map);
+        }
+        fclose(self_map);
+    }
+    fclose(sid_map);
+}
+
+static void uftrace_write_task(const GArray *traces)
+{
+    FILE *task = fopen("./uftrace.data/task.txt", "w");
+    g_assert(task);
+    for (int i = 0; i < traces->len; ++i) {
+        Trace *t = g_array_index(traces, Trace*, i);
+        fprintf(task, "SESS timestamp=0.0 pid=%"PRIu32" sid=0 exename=\"%s\"\n",
+                t->id, t->name->str);
+        fprintf(task, "TASK timestamp=0.0 tid=%"PRIu32" pid=%"PRIu32"\n",
+                t->id, t->id);
+    }
+    fclose(task);
+}
+
+static void uftrace_write_info(const GArray *traces)
+{
+    g_autoptr(GString) taskinfo_tids = g_string_new("taskinfo:tids=");
+    for (int i = 0; i < traces->len; ++i) {
+        Trace *t = g_array_index(traces, Trace*, i);
+        const char *delim = i > 0 ? "," : "";
+        g_string_append_printf(taskinfo_tids, "%s%"PRIu32, delim, t->id);
+    }
+
+    g_autoptr(GString) taskinfo_nr_tid = g_string_new("taskinfo:nr_tid=");
+    g_string_append_printf(taskinfo_nr_tid, "%d", traces->len);
+
+    FILE *info = fopen("./uftrace.data/info", "w");
+    g_assert(info);
+    /*
+     * $ uftrace dump --debug
+     * uftrace file header: magic         = 4674726163652100
+     * uftrace file header: version       = 4
+     * uftrace file header: header size   = 40
+     * uftrace file header: endian        = 1 (little)
+     * uftrace file header: class          = 2 (64 bit)
+     * uftrace file header: features      = 0x1263 (PLTHOOK | ...
+     * uftrace file header: info          = 0x7bff (EXE_NAME | ...
+     *  <0000000000000000>: 46 74 72 61 63 65 21 00  04 00 00 00 28 00 01 02
+     *  <0000000000000010>: 63 12 00 00 00 00 00 00  ff 7b 00 00 00 00 00 00
+     *  <0000000000000020>: 00 04 00 00 00 00 00 00
+     */
+    const uint8_t header[] = {0x46, 0x74, 0x72, 0x61, 0x63, 0x65, 0x21, 0x00,
+                              0x04, 0x00, 0x00, 0x00, 0x28, 0x00, 0x01, 0x02,
+                              0x63, 0x12, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                              0xff, 0x7b, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+                              0x00, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00};
+    size_t wrote = fwrite(header, sizeof(header), 1, info);
+    g_assert(wrote == 1);
+    const char *info_data[] = {
+        "exename:",
+        "build_id:0000000000000000000000000000000000000000",
+        "exit_status:",
+        "cmdline:",
+        "cpuinfo:lines=2",
+        "cpuinfo:nr_cpus=",
+        "cpuinfo:desc=",
+        "meminfo:",
+        "osinfo:lines=3",
+        "osinfo:kernel=",
+        "osinfo:hostname=",
+        "osinfo:distro=",
+        "taskinfo:lines=2",
+        taskinfo_nr_tid->str,
+        taskinfo_tids->str,
+        "usageinfo:lines=6",
+        "usageinfo:systime=",
+        "usageinfo:usrtime=",
+        "usageinfo:ctxsw=",
+        "usageinfo:maxrss=",
+        "usageinfo:pagefault=",
+        "usageinfo:iops=",
+        "loadinfo:",
+        "record_date:",
+        "elapsed_time:",
+        "pattern_type:regex",
+        "uftrace_version:",
+        "utc_offset:",
+        0};
+    const char **info_data_it = info_data;
+    while (*(info_data_it)) {
+        fprintf(info, "%s\n", *info_data_it);
+        ++info_data_it;
+    }
+    fclose(info);
+}
+
 static Callstack *callstack_new(void)
 {
     Callstack *cs = g_new0(Callstack, 1);
@@ -612,14 +733,22 @@ static void vcpu_end(unsigned int vcpu_index)
 
 static void at_exit(qemu_plugin_id_t id, void *data)
 {
+    bool system_emulation = (bool) data;
+    g_autoptr(GArray) traces = g_array_new(0, 0, sizeof(Trace *));
+
     for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
         Cpu *cpu = qemu_plugin_scoreboard_find(score, i);
         for (size_t j = 0; j < cpu->traces->len; ++j) {
             Trace *t = g_array_index(cpu->traces, Trace*, j);
             trace_flush(t, true);
+            g_array_append_val(traces, t);
         }
     }
 
+    uftrace_write_map(system_emulation);
+    uftrace_write_info(traces);
+    uftrace_write_task(traces);
+
     for (size_t i = 0; i < qemu_plugin_num_vcpus(); ++i) {
         vcpu_end(i);
     }
@@ -656,7 +785,7 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     score = qemu_plugin_scoreboard_new(sizeof(Cpu));
     qemu_plugin_register_vcpu_init_cb(id, vcpu_init);
-    qemu_plugin_register_atexit_cb(id, at_exit, NULL);
+    qemu_plugin_register_atexit_cb(id, at_exit, (void *) info->system_emulation);
     qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
 
     return 0;

From b860d96f003de204a34e360437af824734bf5112 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:08 +0100
Subject: [PATCH 0690/2396] contrib/plugins/uftrace: implement x64 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's trivial to implement x64 support, as it's the same stack layout
as aarch64.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-8-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-24-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace.c | 86 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 86 insertions(+)

diff --git a/contrib/plugins/uftrace.c b/contrib/plugins/uftrace.c
index 2386cc723b..b7d6124d2f 100644
--- a/contrib/plugins/uftrace.c
+++ b/contrib/plugins/uftrace.c
@@ -82,6 +82,21 @@ typedef struct {
     struct qemu_plugin_register *reg_scr_el3;
 } Aarch64Cpu;
 
+typedef enum {
+    X64_RING0,
+    X64_RING1,
+    X64_RING2,
+    X64_RING3,
+    X64_REAL_MODE,
+    X64_PRIVILEGE_LEVEL_MAX,
+} X64PrivilegeLevel;
+
+typedef struct {
+    struct qemu_plugin_register *reg_rbp;
+    struct qemu_plugin_register *reg_cs;
+    struct qemu_plugin_register *reg_cr0;
+} X64Cpu;
+
 typedef struct {
     uint64_t timestamp;
     uint64_t data;
@@ -570,6 +585,75 @@ static CpuOps aarch64_ops = {
     .does_insn_modify_frame_pointer = aarch64_does_insn_modify_frame_pointer,
 };
 
+static uint8_t x64_num_privilege_levels(void)
+{
+    return X64_PRIVILEGE_LEVEL_MAX;
+}
+
+static const char *x64_get_privilege_level_name(uint8_t pl)
+{
+    switch (pl) {
+    case X64_RING0: return "Ring0";
+    case X64_RING1: return "Ring1";
+    case X64_RING2: return "Ring2";
+    case X64_RING3: return "Ring3";
+    case X64_REAL_MODE: return "RealMode";
+    default:
+        g_assert_not_reached();
+    }
+}
+
+static uint8_t x64_get_privilege_level(Cpu *cpu_)
+{
+    X64Cpu *cpu = cpu_->arch;
+    uint64_t cr0 = cpu_read_register64(cpu_, cpu->reg_cr0);
+    uint64_t protected_mode = (cr0 >> 0) & 0b1;
+    if (!protected_mode) {
+        return X64_REAL_MODE;
+    }
+    uint32_t cs = cpu_read_register32(cpu_, cpu->reg_cs);
+    uint32_t ring_level = (cs >> 0) & 0b11;
+    return ring_level;
+}
+
+static uint64_t x64_get_frame_pointer(Cpu *cpu_)
+{
+    X64Cpu *cpu = cpu_->arch;
+    return cpu_read_register64(cpu_, cpu->reg_rbp);
+}
+
+static void x64_init(Cpu *cpu_)
+{
+    X64Cpu *cpu = g_new0(X64Cpu, 1);
+    cpu_->arch = cpu;
+    cpu->reg_rbp = plugin_find_register("rbp");
+    g_assert(cpu->reg_rbp);
+    cpu->reg_cs = plugin_find_register("cs");
+    g_assert(cpu->reg_cs);
+    cpu->reg_cr0 = plugin_find_register("cr0");
+    g_assert(cpu->reg_cr0);
+}
+
+static void x64_end(Cpu *cpu)
+{
+    g_free(cpu->arch);
+}
+
+static bool x64_does_insn_modify_frame_pointer(const char *disas)
+{
+    return strstr(disas, "rbp");
+}
+
+static CpuOps x64_ops = {
+    .init = x64_init,
+    .end = x64_end,
+    .get_frame_pointer = x64_get_frame_pointer,
+    .get_privilege_level = x64_get_privilege_level,
+    .num_privilege_levels = x64_num_privilege_levels,
+    .get_privilege_level_name = x64_get_privilege_level_name,
+    .does_insn_modify_frame_pointer = x64_does_insn_modify_frame_pointer,
+};
+
 static void track_privilege_change(unsigned int cpu_index, void *udata)
 {
     Cpu *cpu = qemu_plugin_scoreboard_find(score, cpu_index);
@@ -777,6 +861,8 @@ QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
 
     if (!strcmp(info->target_name, "aarch64")) {
         arch_ops = aarch64_ops;
+    } else if (!strcmp(info->target_name, "x86_64")) {
+        arch_ops = x64_ops;
     } else {
         fprintf(stderr, "plugin uftrace: %s target is not supported\n",
                 info->target_name);

From a073d1149efa923ab492414f9fcb209f7242f3a3 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:09 +0100
Subject: [PATCH 0691/2396] contrib/plugins/uftrace_symbols.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

usage:  contrib/plugins/uftrace_symbols.py \
        --prefix-symbols \
        arm-trusted-firmware/build/qemu/debug/bl1/bl1.elf \
        arm-trusted-firmware/build/qemu/debug/bl2/bl2.elf \
        arm-trusted-firmware/build/qemu/debug/bl31/bl31.elf \
        u-boot/u-boot:0x60000000 \
        u-boot/u-boot.relocated:0x000000023f6b6000 \
        linux/vmlinux

Will generate symbols and memory mapping files for uftrace, allowing to
have an enhanced trace, instead of raw addresses.

It takes a collection of elf files, and automatically find all their
symbols, and generate an ordered memory map based on that.

This script uses the python (native) pyelftools module.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250902075042.223990-9-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-25-alex.bennee@linaro.org>
---
 contrib/plugins/uftrace_symbols.py | 152 +++++++++++++++++++++++++++++
 1 file changed, 152 insertions(+)
 create mode 100755 contrib/plugins/uftrace_symbols.py

diff --git a/contrib/plugins/uftrace_symbols.py b/contrib/plugins/uftrace_symbols.py
new file mode 100755
index 0000000000..b49e03203c
--- /dev/null
+++ b/contrib/plugins/uftrace_symbols.py
@@ -0,0 +1,152 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+#
+# Create symbols and mapping files for uftrace.
+#
+# Copyright 2025 Linaro Ltd
+# Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import argparse
+import elftools # pip install pyelftools
+import os
+
+from elftools.elf.elffile import ELFFile
+from elftools.elf.sections import SymbolTableSection
+
+def elf_func_symbols(elf):
+    symbol_tables = [(idx, s) for idx, s in enumerate(elf.iter_sections())
+                  if isinstance(s, SymbolTableSection)]
+    symbols = []
+    for _, section in symbol_tables:
+        for _, symbol in enumerate(section.iter_symbols()):
+            if symbol_size(symbol) == 0:
+                continue
+            type = symbol['st_info']['type']
+            if type == 'STT_FUNC' or type == 'STT_NOTYPE':
+                symbols.append(symbol)
+    symbols.sort(key = lambda x: symbol_addr(x))
+    return symbols
+
+def symbol_size(symbol):
+    return symbol['st_size']
+
+def symbol_addr(symbol):
+    addr = symbol['st_value']
+    # clamp addr to 48 bits, like uftrace entries
+    return addr & 0xffffffffffff
+
+def symbol_name(symbol):
+    return symbol.name
+
+class BinaryFile:
+    def __init__(self, path, map_offset):
+        self.fullpath = os.path.realpath(path)
+        self.map_offset = map_offset
+        with open(path, 'rb') as f:
+            self.elf = ELFFile(f)
+            self.symbols = elf_func_symbols(self.elf)
+
+    def path(self):
+        return self.fullpath
+
+    def addr_start(self):
+        return self.map_offset
+
+    def addr_end(self):
+        last_sym = self.symbols[-1]
+        return symbol_addr(last_sym) + symbol_size(last_sym) + self.map_offset
+
+    def generate_symbol_file(self, prefix_symbols):
+        binary_name = os.path.basename(self.fullpath)
+        sym_file_path = f'./uftrace.data/{binary_name}.sym'
+        print(f'{sym_file_path} ({len(self.symbols)} symbols)')
+        with open(sym_file_path, 'w') as sym_file:
+            # print hexadecimal addresses on 48 bits
+            addrx = "0>12x"
+            for s in self.symbols:
+                addr = symbol_addr(s)
+                addr = f'{addr:{addrx}}'
+                size = f'{symbol_size(s):{addrx}}'
+                name = symbol_name(s)
+                if prefix_symbols:
+                    name = f'{binary_name}:{name}'
+                print(addr, size, 'T', name, file=sym_file)
+
+def parse_parameter(p):
+    s = p.split(":")
+    path = s[0]
+    if len(s) == 1:
+        return path, 0
+    if len(s) > 2:
+        raise ValueError('only one offset can be set')
+    offset = s[1]
+    if not offset.startswith('0x'):
+        err = f'offset "{offset}" is not an hexadecimal constant. '
+        err += 'It should starts with "0x".'
+        raise ValueError(err)
+    offset = int(offset, 16)
+    return path, offset
+
+def is_from_user_mode(map_file_path):
+    if os.path.exists(map_file_path):
+        with open(map_file_path, 'r') as map_file:
+            if not map_file.readline().startswith('# map stack on'):
+                return True
+    return False
+
+def generate_map(binaries):
+    map_file_path = './uftrace.data/sid-0.map'
+
+    if is_from_user_mode(map_file_path):
+        print(f'do not overwrite {map_file_path} generated from qemu-user')
+        return
+
+    mappings = []
+
+    # print hexadecimal addresses on 48 bits
+    addrx = "0>12x"
+
+    mappings += ['# map stack on highest address possible, to prevent uftrace']
+    mappings += ['# from considering any kernel address']
+    mappings += ['ffffffffffff-ffffffffffff rw-p 00000000 00:00 0 [stack]']
+
+    for b in binaries:
+        m = f'{b.addr_start():{addrx}}-{b.addr_end():{addrx}}'
+        m += f' r--p 00000000 00:00 0 {b.path()}'
+        mappings.append(m)
+
+    with open(map_file_path, 'w') as map_file:
+        print('\n'.join(mappings), file=map_file)
+    print(f'{map_file_path}')
+    print('\n'.join(mappings))
+
+def main():
+    parser = argparse.ArgumentParser(description=
+                                     'generate symbol files for uftrace')
+    parser.add_argument('elf_file', nargs='+',
+                        help='path to an ELF file. '
+                        'Use /path/to/file:0xdeadbeef to add a mapping offset.')
+    parser.add_argument('--prefix-symbols',
+                        help='prepend binary name to symbols',
+                        action=argparse.BooleanOptionalAction)
+    args = parser.parse_args()
+
+    if not os.path.exists('./uftrace.data'):
+        os.mkdir('./uftrace.data')
+
+    binaries = []
+    for file in args.elf_file:
+        path, offset = parse_parameter(file)
+        b = BinaryFile(path, offset)
+        binaries.append(b)
+    binaries.sort(key = lambda b: b.addr_end());
+
+    for b in binaries:
+        b.generate_symbol_file(args.prefix_symbols)
+
+    generate_map(binaries)
+
+if __name__ == '__main__':
+    main()

From 16b10fbf8bdb71ae20c7f74ab19c78d07c013ac7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 22 Sep 2025 10:37:10 +0100
Subject: [PATCH 0692/2396] contrib/plugins/uftrace: add documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This documentation summarizes how to use the plugin, and present two
examples of the possibilities offered by it, in system and user mode.

As well, it explains how to rebuild and reproduce those examples.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20250902075042.223990-10-pierrick.bouvier@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250922093711.2768983-26-alex.bennee@linaro.org>
---
 docs/about/emulation.rst | 199 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 199 insertions(+)

diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
index 456d01d5b0..8a5e128f67 100644
--- a/docs/about/emulation.rst
+++ b/docs/about/emulation.rst
@@ -816,6 +816,205 @@ This plugin can limit the number of Instructions Per Second that are executed::
       The lower the number the more accurate time will be, but the less efficient the plugin.
       Defaults to ips/10
 
+Uftrace
+.......
+
+``contrib/plugins/uftrace.c``
+
+This plugin generates a binary trace compatible with
+`uftrace <https://github.com/namhyung/uftrace>`_.
+
+Plugin supports aarch64 and x64, and works in user and system mode, allowing to
+trace a system boot, which is not something possible usually.
+
+In user mode, the memory mapping is directly copied from ``/proc/self/maps`` at
+the end of execution. Uftrace should be able to retrieve symbols by itself,
+without any additional step.
+In system mode, the default memory mapping is empty, and you can generate
+one (and associated symbols) using ``contrib/plugins/uftrace_symbols.py``.
+Symbols must be present in ELF binaries.
+
+It tracks the call stack (based on frame pointer analysis). Thus, your program
+and its dependencies must be compiled using ``-fno-omit-frame-pointer
+-mno-omit-leaf-frame-pointer``. In 2024, `Ubuntu and Fedora enabled it by
+default again on x64
+<https://www.brendangregg.com/blog/2024-03-17/the-return-of-the-frame-pointers.html>`_.
+On aarch64, this is less of a problem, as they are usually part of the ABI,
+except for leaf functions. That's true for user space applications, but not
+necessarily for bare metal code. You can read this `section
+<uftrace_build_system_example>` to easily build a system with frame pointers.
+
+When tracing long scenarios (> 1 min), the generated trace can become very long,
+making it hard to extract data from it. In this case, a simple solution is to
+trace execution while generating a timestamped output log using
+``qemu-system-aarch64 ... | ts "%s"``. Then, ``uftrace --time-range=start~end``
+can be used to reduce trace for only this part of execution.
+
+Performance wise, overhead compared to normal tcg execution is around x5-x15.
+
+.. list-table:: Uftrace plugin arguments
+  :widths: 20 80
+  :header-rows: 1
+
+  * - Option
+    - Description
+  * - trace-privilege-level=[on|off]
+    - Generate separate traces for each privilege level (Exception Level +
+      Security State on aarch64, Rings on x64).
+
+.. list-table:: uftrace_symbols.py arguments
+  :widths: 20 80
+  :header-rows: 1
+
+  * - Option
+    - Description
+  * - elf_file [elf_file ...]
+    - path to an ELF file. Use /path/to/file:0xdeadbeef to add a mapping offset.
+  * - --prefix-symbols
+    - prepend binary name to symbols
+
+Example user trace
+++++++++++++++++++
+
+As an example, we can trace qemu itself running git::
+
+    $ ./build/qemu-aarch64 -plugin \
+      build/contrib/plugins/libuftrace.so \
+      ./build/qemu-aarch64 /usr/bin/git --help
+
+    # and generate a chrome trace directly
+    $ uftrace dump --chrome | gzip > ~/qemu_aarch64_git_help.json.gz
+
+For convenience, you can download this trace `qemu_aarch64_git_help.json.gz
+<https://fileserver.linaro.org/s/N8X8fnZ5yGRZLsT/download/qemu_aarch64_git_help.json.gz>`_.
+Download it and open this trace on https://ui.perfetto.dev/. You can zoom in/out
+using :kbd:`W`, :kbd:`A`, :kbd:`S`, :kbd:`D` keys.
+Some sequences taken from this trace:
+
+- Loading program and its interpreter
+
+.. image:: https://fileserver.linaro.org/s/fie8JgX76yyL5cq/preview
+   :height: 200px
+
+- open syscall
+
+.. image:: https://fileserver.linaro.org/s/rsXPTeZZPza4PcE/preview
+   :height: 200px
+
+- TB creation
+
+.. image:: https://fileserver.linaro.org/s/GXY6NKMw5EeRCew/preview
+   :height: 200px
+
+It's usually better to use ``uftrace record`` directly. However, tracing
+binaries through qemu-user can be convenient when you don't want to recompile
+them (``uftrace record`` requires instrumentation), as long as symbols are
+present.
+
+Example system trace
+++++++++++++++++++++
+
+A full trace example (chrome trace, from instructions below) generated from a
+system boot can be found `here
+<https://fileserver.linaro.org/s/WsemLboPEzo24nw/download/aarch64_boot.json.gz>`_.
+Download it and open this trace on https://ui.perfetto.dev/. You can see code
+executed for all privilege levels, and zoom in/out using
+:kbd:`W`, :kbd:`A`, :kbd:`S`, :kbd:`D` keys. You can find below some sequences
+taken from this trace:
+
+- Two first stages of boot sequence in Arm Trusted Firmware (EL3 and S-EL1)
+
+.. image:: https://fileserver.linaro.org/s/kkxBS552W7nYESX/preview
+   :height: 200px
+
+- U-boot initialization (until code relocation, after which we can't track it)
+
+.. image:: https://fileserver.linaro.org/s/LKTgsXNZFi5GFNC/preview
+   :height: 200px
+
+- Stat and open syscalls in kernel
+
+.. image:: https://fileserver.linaro.org/s/dXe4MfraKg2F476/preview
+   :height: 200px
+
+- Timer interrupt
+
+.. image:: https://fileserver.linaro.org/s/TM5yobYzJtP7P3C/preview
+   :height: 200px
+
+- Poweroff sequence (from kernel back to firmware, NS-EL2 to EL3)
+
+.. image:: https://fileserver.linaro.org/s/oR2PtyGKJrqnfRf/preview
+   :height: 200px
+
+Build and run system example
+++++++++++++++++++++++++++++
+
+.. _uftrace_build_system_example:
+
+Building a full system image with frame pointers is not trivial.
+
+We provide a `simple way <https://github.com/pbo-linaro/qemu-linux-stack>`_ to
+build an aarch64 system, combining Arm Trusted firmware, U-boot, Linux kernel
+and debian userland. It's based on containers (``podman`` only) and
+``qemu-user-static (binfmt)`` to make sure it's easily reproducible and does not depend
+on machine where you build it.
+
+You can follow the exact same instructions for a x64 system, combining edk2,
+Linux, and Ubuntu, simply by switching to
+`x86_64 <https://github.com/pbo-linaro/qemu-linux-stack/tree/x86_64>`_ branch.
+
+To build the system::
+
+    # Install dependencies
+    $ sudo apt install -y podman qemu-user-static
+
+    $ git clone https://github.com/pbo-linaro/qemu-linux-stack
+    $ cd qemu-linux-stack
+    $ ./build.sh
+
+    # system can be started using:
+    $ ./run.sh /path/to/qemu-system-aarch64
+
+To generate a uftrace for a system boot from that::
+
+    # run true and poweroff the system
+    $ env INIT=true ./run.sh path/to/qemu-system-aarch64 \
+      -plugin path/to/contrib/plugins/libuftrace.so,trace-privilege-level=on
+
+    # generate symbols and memory mapping
+    $ path/to/contrib/plugins/uftrace_symbols.py \
+      --prefix-symbols \
+      arm-trusted-firmware/build/qemu/debug/bl1/bl1.elf \
+      arm-trusted-firmware/build/qemu/debug/bl2/bl2.elf \
+      arm-trusted-firmware/build/qemu/debug/bl31/bl31.elf \
+      u-boot/u-boot:0x60000000 \
+      linux/vmlinux
+
+    # inspect trace with
+    $ uftrace replay
+
+Uftrace allows to filter the trace, and dump flamegraphs, or a chrome trace.
+This last one is very interesting to see visually the boot process::
+
+    $ uftrace dump --chrome > boot.json
+    # Open your browser, and load boot.json on https://ui.perfetto.dev/.
+
+Long visual chrome traces can't be easily opened, thus, it might be
+interesting to generate them around a particular point of execution::
+
+    # execute qemu and timestamp output log
+    $ env INIT=true ./run.sh path/to/qemu-system-aarch64 \
+      -plugin path/to/contrib/plugins/libuftrace.so,trace-privilege-level=on |&
+      ts "%s" | tee exec.log
+
+    $ cat exec.log  | grep 'Run /init'
+      1753122320 [   11.834391] Run /init as init process
+      # init was launched at 1753122320
+
+    # generate trace around init execution (2 seconds):
+    $ uftrace dump --chrome --time-range=1753122320~1753122322 > init.json
+
 Other emulation features
 ------------------------
 

From 674fe9066760e7744f2429840181ea39697b9af9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 05:21:51 +0200
Subject: [PATCH 0693/2396] target/arm: Replace magic GIC values by proper
 definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer the FIELD_DP64() macro and self-describing GIC
definitions over magic values.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index c5a8ef5049..a18d920ac1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5007,7 +5007,7 @@ static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
     uint64_t pfr1 = GET_IDREG(&cpu->isar, ID_PFR1);
 
     if (env->gicv3state) {
-        pfr1 |= 1 << 28;
+        pfr1 = FIELD_DP64(pfr1, ID_PFR1, GIC, 1);
     }
     return pfr1;
 }
@@ -5018,7 +5018,7 @@ static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
     uint64_t pfr0 = GET_IDREG(&cpu->isar, ID_AA64PFR0);
 
     if (env->gicv3state) {
-        pfr0 |= 1 << 24;
+        pfr0 = FIELD_DP64(pfr0, ID_AA64PFR0, GIC, 1);
     }
     return pfr0;
 }

From 436f4085a24f754683216d5b2e9fa98f69512b75 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:32:52 +0200
Subject: [PATCH 0694/2396] target/arm: Convert power control DPRINTF() uses to
 trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arm-powerctl.c | 26 ++++++++------------------
 target/arm/trace-events   |  6 ++++++
 2 files changed, 14 insertions(+), 18 deletions(-)

diff --git a/target/arm/arm-powerctl.c b/target/arm/arm-powerctl.c
index 20c70c7d6b..a788376d1d 100644
--- a/target/arm/arm-powerctl.c
+++ b/target/arm/arm-powerctl.c
@@ -17,24 +17,12 @@
 #include "qemu/main-loop.h"
 #include "system/tcg.h"
 #include "target/arm/multiprocessing.h"
-
-#ifndef DEBUG_ARM_POWERCTL
-#define DEBUG_ARM_POWERCTL 0
-#endif
-
-#define DPRINTF(fmt, args...) \
-    do { \
-        if (DEBUG_ARM_POWERCTL) { \
-            fprintf(stderr, "[ARM]%s: " fmt , __func__, ##args); \
-        } \
-    } while (0)
+#include "trace.h"
 
 CPUState *arm_get_cpu_by_id(uint64_t id)
 {
     CPUState *cpu;
 
-    DPRINTF("cpu %" PRId64 "\n", id);
-
     CPU_FOREACH(cpu) {
         ARMCPU *armcpu = ARM_CPU(cpu);
 
@@ -102,9 +90,9 @@ int arm_set_cpu_on(uint64_t cpuid, uint64_t entry, uint64_t context_id,
 
     assert(bql_locked());
 
-    DPRINTF("cpu %" PRId64 " (EL %d, %s) @ 0x%" PRIx64 " with R0 = 0x%" PRIx64
-            "\n", cpuid, target_el, target_aa64 ? "aarch64" : "aarch32", entry,
-            context_id);
+    trace_arm_powerctl_set_cpu_on(cpuid, target_el,
+                                  target_aa64 ? "aarch64" : "aarch32",
+                                  entry, context_id);
 
     /* requested EL level need to be in the 1 to 3 range */
     assert((target_el > 0) && (target_el < 4));
@@ -208,6 +196,8 @@ int arm_set_cpu_on_and_reset(uint64_t cpuid)
 
     assert(bql_locked());
 
+    trace_arm_powerctl_set_cpu_on_and_reset(cpuid);
+
     /* Retrieve the cpu we are powering up */
     target_cpu_state = arm_get_cpu_by_id(cpuid);
     if (!target_cpu_state) {
@@ -261,7 +251,7 @@ int arm_set_cpu_off(uint64_t cpuid)
 
     assert(bql_locked());
 
-    DPRINTF("cpu %" PRId64 "\n", cpuid);
+    trace_arm_powerctl_set_cpu_off(cpuid);
 
     /* change to the cpu we are powering up */
     target_cpu_state = arm_get_cpu_by_id(cpuid);
@@ -297,7 +287,7 @@ int arm_reset_cpu(uint64_t cpuid)
 
     assert(bql_locked());
 
-    DPRINTF("cpu %" PRId64 "\n", cpuid);
+    trace_arm_powerctl_set_cpu_off(cpuid);
 
     /* change to the cpu we are resetting */
     target_cpu_state = arm_get_cpu_by_id(cpuid);
diff --git a/target/arm/trace-events b/target/arm/trace-events
index 4438dce7be..252c05a9eb 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -13,3 +13,9 @@ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 
 # kvm.c
 kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
+
+# arm-powerctl.c
+arm_powerctl_set_cpu_on(uint64_t mp_aff, unsigned target_el, const char *mode, uint64_t entry, uint64_t context_id) "cpu %" PRIu64 " (EL %u, %s) @ 0x%" PRIx64 " with R0 = 0x%" PRIx64
+arm_powerctl_set_cpu_on_and_reset(uint64_t mp_aff) "cpu %" PRIu64
+arm_powerctl_set_cpu_off(uint64_t mp_aff) "cpu %" PRIu64
+arm_powerctl_reset_cpu(uint64_t mp_aff) "cpu %" PRIu64

From e733dfcf907267ede51452f0e6f28846d5a6abb5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:32:53 +0200
Subject: [PATCH 0695/2396] target/arm: Trace emulated firmware reset call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c        | 4 ++++
 target/arm/trace-events | 3 +++
 2 files changed, 7 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 91ae56dddb..f8e6749ff9 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -52,6 +52,8 @@
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
 
+#include "trace.h"
+
 static void arm_cpu_set_pc(CPUState *cs, vaddr value)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -574,6 +576,8 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
     bool have_el3 = arm_feature(env, ARM_FEATURE_EL3);
     bool have_el2 = arm_feature(env, ARM_FEATURE_EL2);
 
+    trace_arm_emulate_firmware_reset(arm_cpu_mp_affinity(cpu), target_el);
+
     /*
      * Check we have the EL we're aiming for. If that is the
      * highest implemented EL, then cpu_reset has already done
diff --git a/target/arm/trace-events b/target/arm/trace-events
index 252c05a9eb..badff2b2e4 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -14,6 +14,9 @@ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 # kvm.c
 kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
 
+# cpu.c
+arm_emulate_firmware_reset(uint64_t mp_aff, unsigned target_el) "cpu %" PRIu64 " @EL%u"
+
 # arm-powerctl.c
 arm_powerctl_set_cpu_on(uint64_t mp_aff, unsigned target_el, const char *mode, uint64_t entry, uint64_t context_id) "cpu %" PRIu64 " (EL %u, %s) @ 0x%" PRIx64 " with R0 = 0x%" PRIx64
 arm_powerctl_set_cpu_on_and_reset(uint64_t mp_aff) "cpu %" PRIu64

From ded97005b2baf6669c102d92f87b5d622136ad18 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:32:54 +0200
Subject: [PATCH 0696/2396] target/arm: Trace vCPU reset call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c        | 2 ++
 target/arm/trace-events | 1 +
 2 files changed, 3 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index f8e6749ff9..30e29fd315 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -227,6 +227,8 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     ARMCPUClass *acc = ARM_CPU_GET_CLASS(obj);
     CPUARMState *env = &cpu->env;
 
+    trace_arm_cpu_reset(arm_cpu_mp_affinity(cpu));
+
     if (acc->parent_phases.hold) {
         acc->parent_phases.hold(obj, type);
     }
diff --git a/target/arm/trace-events b/target/arm/trace-events
index badff2b2e4..72a2c7d096 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -15,6 +15,7 @@ arm_gt_update_irq(int timer, int irqstate) "gt_update_irq: timer %d irqstate %d"
 kvm_arm_fixup_msi_route(uint64_t iova, uint64_t gpa) "MSI iova = 0x%"PRIx64" is translated into 0x%"PRIx64
 
 # cpu.c
+arm_cpu_reset(uint64_t mp_aff) "cpu %" PRIu64
 arm_emulate_firmware_reset(uint64_t mp_aff, unsigned target_el) "cpu %" PRIu64 " @EL%u"
 
 # arm-powerctl.c

From ff197ae9a44741e92df47c78ce2a3d30a4e46455 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 23 Sep 2025 18:57:50 +0100
Subject: [PATCH 0697/2396] target/arm: Move ID register field defs to
 cpu-features.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we define constants for the ID register fields in cpu.h.
This means they're defined for a lot more code in QEMU than actually
needs them.  Move them to cpu-features.h, which is where we define
the feature functions that test fields in these registers.

There's only one place where we need to use some of these macro
definitions that we weren't already including cpu-features.h:
linux-user/arm/target_proc.h.  Otherwise this patch is a pure
movement of code from one file to the other.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/target_proc.h |   2 +
 target/arm/cpu-features.h    | 410 +++++++++++++++++++++++++++++++++++
 target/arm/cpu.h             | 410 -----------------------------------
 3 files changed, 412 insertions(+), 410 deletions(-)

diff --git a/linux-user/arm/target_proc.h b/linux-user/arm/target_proc.h
index a4cd6948c6..a28d7231cd 100644
--- a/linux-user/arm/target_proc.h
+++ b/linux-user/arm/target_proc.h
@@ -6,6 +6,8 @@
 #ifndef ARM_TARGET_PROC_H
 #define ARM_TARGET_PROC_H
 
+#include "target/arm/cpu-features.h" /* for MIDR_EL1 field definitions */
+
 static int open_cpuinfo(CPUArchState *cpu_env, int fd)
 {
     ARMCPU *cpu = env_archcpu(cpu_env);
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 512eeaf551..ad571e2ffe 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -25,6 +25,416 @@
 #include "cpu.h"
 #include "cpu-sysregs.h"
 
+/*
+ * System register ID fields.
+ */
+FIELD(CLIDR_EL1, CTYPE1, 0, 3)
+FIELD(CLIDR_EL1, CTYPE2, 3, 3)
+FIELD(CLIDR_EL1, CTYPE3, 6, 3)
+FIELD(CLIDR_EL1, CTYPE4, 9, 3)
+FIELD(CLIDR_EL1, CTYPE5, 12, 3)
+FIELD(CLIDR_EL1, CTYPE6, 15, 3)
+FIELD(CLIDR_EL1, CTYPE7, 18, 3)
+FIELD(CLIDR_EL1, LOUIS, 21, 3)
+FIELD(CLIDR_EL1, LOC, 24, 3)
+FIELD(CLIDR_EL1, LOUU, 27, 3)
+FIELD(CLIDR_EL1, ICB, 30, 3)
+
+/* When FEAT_CCIDX is implemented */
+FIELD(CCSIDR_EL1, CCIDX_LINESIZE, 0, 3)
+FIELD(CCSIDR_EL1, CCIDX_ASSOCIATIVITY, 3, 21)
+FIELD(CCSIDR_EL1, CCIDX_NUMSETS, 32, 24)
+
+/* When FEAT_CCIDX is not implemented */
+FIELD(CCSIDR_EL1, LINESIZE, 0, 3)
+FIELD(CCSIDR_EL1, ASSOCIATIVITY, 3, 10)
+FIELD(CCSIDR_EL1, NUMSETS, 13, 15)
+
+FIELD(CTR_EL0,  IMINLINE, 0, 4)
+FIELD(CTR_EL0,  L1IP, 14, 2)
+FIELD(CTR_EL0,  DMINLINE, 16, 4)
+FIELD(CTR_EL0,  ERG, 20, 4)
+FIELD(CTR_EL0,  CWG, 24, 4)
+FIELD(CTR_EL0,  IDC, 28, 1)
+FIELD(CTR_EL0,  DIC, 29, 1)
+FIELD(CTR_EL0,  TMINLINE, 32, 6)
+
+FIELD(MIDR_EL1, REVISION, 0, 4)
+FIELD(MIDR_EL1, PARTNUM, 4, 12)
+FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
+FIELD(MIDR_EL1, VARIANT, 20, 4)
+FIELD(MIDR_EL1, IMPLEMENTER, 24, 8)
+
+FIELD(ID_ISAR0, SWAP, 0, 4)
+FIELD(ID_ISAR0, BITCOUNT, 4, 4)
+FIELD(ID_ISAR0, BITFIELD, 8, 4)
+FIELD(ID_ISAR0, CMPBRANCH, 12, 4)
+FIELD(ID_ISAR0, COPROC, 16, 4)
+FIELD(ID_ISAR0, DEBUG, 20, 4)
+FIELD(ID_ISAR0, DIVIDE, 24, 4)
+
+FIELD(ID_ISAR1, ENDIAN, 0, 4)
+FIELD(ID_ISAR1, EXCEPT, 4, 4)
+FIELD(ID_ISAR1, EXCEPT_AR, 8, 4)
+FIELD(ID_ISAR1, EXTEND, 12, 4)
+FIELD(ID_ISAR1, IFTHEN, 16, 4)
+FIELD(ID_ISAR1, IMMEDIATE, 20, 4)
+FIELD(ID_ISAR1, INTERWORK, 24, 4)
+FIELD(ID_ISAR1, JAZELLE, 28, 4)
+
+FIELD(ID_ISAR2, LOADSTORE, 0, 4)
+FIELD(ID_ISAR2, MEMHINT, 4, 4)
+FIELD(ID_ISAR2, MULTIACCESSINT, 8, 4)
+FIELD(ID_ISAR2, MULT, 12, 4)
+FIELD(ID_ISAR2, MULTS, 16, 4)
+FIELD(ID_ISAR2, MULTU, 20, 4)
+FIELD(ID_ISAR2, PSR_AR, 24, 4)
+FIELD(ID_ISAR2, REVERSAL, 28, 4)
+
+FIELD(ID_ISAR3, SATURATE, 0, 4)
+FIELD(ID_ISAR3, SIMD, 4, 4)
+FIELD(ID_ISAR3, SVC, 8, 4)
+FIELD(ID_ISAR3, SYNCHPRIM, 12, 4)
+FIELD(ID_ISAR3, TABBRANCH, 16, 4)
+FIELD(ID_ISAR3, T32COPY, 20, 4)
+FIELD(ID_ISAR3, TRUENOP, 24, 4)
+FIELD(ID_ISAR3, T32EE, 28, 4)
+
+FIELD(ID_ISAR4, UNPRIV, 0, 4)
+FIELD(ID_ISAR4, WITHSHIFTS, 4, 4)
+FIELD(ID_ISAR4, WRITEBACK, 8, 4)
+FIELD(ID_ISAR4, SMC, 12, 4)
+FIELD(ID_ISAR4, BARRIER, 16, 4)
+FIELD(ID_ISAR4, SYNCHPRIM_FRAC, 20, 4)
+FIELD(ID_ISAR4, PSR_M, 24, 4)
+FIELD(ID_ISAR4, SWP_FRAC, 28, 4)
+
+FIELD(ID_ISAR5, SEVL, 0, 4)
+FIELD(ID_ISAR5, AES, 4, 4)
+FIELD(ID_ISAR5, SHA1, 8, 4)
+FIELD(ID_ISAR5, SHA2, 12, 4)
+FIELD(ID_ISAR5, CRC32, 16, 4)
+FIELD(ID_ISAR5, RDM, 24, 4)
+FIELD(ID_ISAR5, VCMA, 28, 4)
+
+FIELD(ID_ISAR6, JSCVT, 0, 4)
+FIELD(ID_ISAR6, DP, 4, 4)
+FIELD(ID_ISAR6, FHM, 8, 4)
+FIELD(ID_ISAR6, SB, 12, 4)
+FIELD(ID_ISAR6, SPECRES, 16, 4)
+FIELD(ID_ISAR6, BF16, 20, 4)
+FIELD(ID_ISAR6, I8MM, 24, 4)
+
+FIELD(ID_MMFR0, VMSA, 0, 4)
+FIELD(ID_MMFR0, PMSA, 4, 4)
+FIELD(ID_MMFR0, OUTERSHR, 8, 4)
+FIELD(ID_MMFR0, SHARELVL, 12, 4)
+FIELD(ID_MMFR0, TCM, 16, 4)
+FIELD(ID_MMFR0, AUXREG, 20, 4)
+FIELD(ID_MMFR0, FCSE, 24, 4)
+FIELD(ID_MMFR0, INNERSHR, 28, 4)
+
+FIELD(ID_MMFR1, L1HVDVA, 0, 4)
+FIELD(ID_MMFR1, L1UNIVA, 4, 4)
+FIELD(ID_MMFR1, L1HVDSW, 8, 4)
+FIELD(ID_MMFR1, L1UNISW, 12, 4)
+FIELD(ID_MMFR1, L1HVD, 16, 4)
+FIELD(ID_MMFR1, L1UNI, 20, 4)
+FIELD(ID_MMFR1, L1TSTCLN, 24, 4)
+FIELD(ID_MMFR1, BPRED, 28, 4)
+
+FIELD(ID_MMFR2, L1HVDFG, 0, 4)
+FIELD(ID_MMFR2, L1HVDBG, 4, 4)
+FIELD(ID_MMFR2, L1HVDRNG, 8, 4)
+FIELD(ID_MMFR2, HVDTLB, 12, 4)
+FIELD(ID_MMFR2, UNITLB, 16, 4)
+FIELD(ID_MMFR2, MEMBARR, 20, 4)
+FIELD(ID_MMFR2, WFISTALL, 24, 4)
+FIELD(ID_MMFR2, HWACCFLG, 28, 4)
+
+FIELD(ID_MMFR3, CMAINTVA, 0, 4)
+FIELD(ID_MMFR3, CMAINTSW, 4, 4)
+FIELD(ID_MMFR3, BPMAINT, 8, 4)
+FIELD(ID_MMFR3, MAINTBCST, 12, 4)
+FIELD(ID_MMFR3, PAN, 16, 4)
+FIELD(ID_MMFR3, COHWALK, 20, 4)
+FIELD(ID_MMFR3, CMEMSZ, 24, 4)
+FIELD(ID_MMFR3, SUPERSEC, 28, 4)
+
+FIELD(ID_MMFR4, SPECSEI, 0, 4)
+FIELD(ID_MMFR4, AC2, 4, 4)
+FIELD(ID_MMFR4, XNX, 8, 4)
+FIELD(ID_MMFR4, CNP, 12, 4)
+FIELD(ID_MMFR4, HPDS, 16, 4)
+FIELD(ID_MMFR4, LSM, 20, 4)
+FIELD(ID_MMFR4, CCIDX, 24, 4)
+FIELD(ID_MMFR4, EVT, 28, 4)
+
+FIELD(ID_MMFR5, ETS, 0, 4)
+FIELD(ID_MMFR5, NTLBPA, 4, 4)
+
+FIELD(ID_PFR0, STATE0, 0, 4)
+FIELD(ID_PFR0, STATE1, 4, 4)
+FIELD(ID_PFR0, STATE2, 8, 4)
+FIELD(ID_PFR0, STATE3, 12, 4)
+FIELD(ID_PFR0, CSV2, 16, 4)
+FIELD(ID_PFR0, AMU, 20, 4)
+FIELD(ID_PFR0, DIT, 24, 4)
+FIELD(ID_PFR0, RAS, 28, 4)
+
+FIELD(ID_PFR1, PROGMOD, 0, 4)
+FIELD(ID_PFR1, SECURITY, 4, 4)
+FIELD(ID_PFR1, MPROGMOD, 8, 4)
+FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
+FIELD(ID_PFR1, GENTIMER, 16, 4)
+FIELD(ID_PFR1, SEC_FRAC, 20, 4)
+FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
+FIELD(ID_PFR1, GIC, 28, 4)
+
+FIELD(ID_PFR2, CSV3, 0, 4)
+FIELD(ID_PFR2, SSBS, 4, 4)
+FIELD(ID_PFR2, RAS_FRAC, 8, 4)
+
+FIELD(ID_AA64ISAR0, AES, 4, 4)
+FIELD(ID_AA64ISAR0, SHA1, 8, 4)
+FIELD(ID_AA64ISAR0, SHA2, 12, 4)
+FIELD(ID_AA64ISAR0, CRC32, 16, 4)
+FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)
+FIELD(ID_AA64ISAR0, TME, 24, 4)
+FIELD(ID_AA64ISAR0, RDM, 28, 4)
+FIELD(ID_AA64ISAR0, SHA3, 32, 4)
+FIELD(ID_AA64ISAR0, SM3, 36, 4)
+FIELD(ID_AA64ISAR0, SM4, 40, 4)
+FIELD(ID_AA64ISAR0, DP, 44, 4)
+FIELD(ID_AA64ISAR0, FHM, 48, 4)
+FIELD(ID_AA64ISAR0, TS, 52, 4)
+FIELD(ID_AA64ISAR0, TLB, 56, 4)
+FIELD(ID_AA64ISAR0, RNDR, 60, 4)
+
+FIELD(ID_AA64ISAR1, DPB, 0, 4)
+FIELD(ID_AA64ISAR1, APA, 4, 4)
+FIELD(ID_AA64ISAR1, API, 8, 4)
+FIELD(ID_AA64ISAR1, JSCVT, 12, 4)
+FIELD(ID_AA64ISAR1, FCMA, 16, 4)
+FIELD(ID_AA64ISAR1, LRCPC, 20, 4)
+FIELD(ID_AA64ISAR1, GPA, 24, 4)
+FIELD(ID_AA64ISAR1, GPI, 28, 4)
+FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
+FIELD(ID_AA64ISAR1, SB, 36, 4)
+FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
+FIELD(ID_AA64ISAR1, BF16, 44, 4)
+FIELD(ID_AA64ISAR1, DGH, 48, 4)
+FIELD(ID_AA64ISAR1, I8MM, 52, 4)
+FIELD(ID_AA64ISAR1, XS, 56, 4)
+FIELD(ID_AA64ISAR1, LS64, 60, 4)
+
+FIELD(ID_AA64ISAR2, WFXT, 0, 4)
+FIELD(ID_AA64ISAR2, RPRES, 4, 4)
+FIELD(ID_AA64ISAR2, GPA3, 8, 4)
+FIELD(ID_AA64ISAR2, APA3, 12, 4)
+FIELD(ID_AA64ISAR2, MOPS, 16, 4)
+FIELD(ID_AA64ISAR2, BC, 20, 4)
+FIELD(ID_AA64ISAR2, PAC_FRAC, 24, 4)
+FIELD(ID_AA64ISAR2, CLRBHB, 28, 4)
+FIELD(ID_AA64ISAR2, SYSREG_128, 32, 4)
+FIELD(ID_AA64ISAR2, SYSINSTR_128, 36, 4)
+FIELD(ID_AA64ISAR2, PRFMSLC, 40, 4)
+FIELD(ID_AA64ISAR2, RPRFM, 48, 4)
+FIELD(ID_AA64ISAR2, CSSC, 52, 4)
+FIELD(ID_AA64ISAR2, LUT, 56, 4)
+FIELD(ID_AA64ISAR2, ATS1A, 60, 4)
+
+FIELD(ID_AA64PFR0, EL0, 0, 4)
+FIELD(ID_AA64PFR0, EL1, 4, 4)
+FIELD(ID_AA64PFR0, EL2, 8, 4)
+FIELD(ID_AA64PFR0, EL3, 12, 4)
+FIELD(ID_AA64PFR0, FP, 16, 4)
+FIELD(ID_AA64PFR0, ADVSIMD, 20, 4)
+FIELD(ID_AA64PFR0, GIC, 24, 4)
+FIELD(ID_AA64PFR0, RAS, 28, 4)
+FIELD(ID_AA64PFR0, SVE, 32, 4)
+FIELD(ID_AA64PFR0, SEL2, 36, 4)
+FIELD(ID_AA64PFR0, MPAM, 40, 4)
+FIELD(ID_AA64PFR0, AMU, 44, 4)
+FIELD(ID_AA64PFR0, DIT, 48, 4)
+FIELD(ID_AA64PFR0, RME, 52, 4)
+FIELD(ID_AA64PFR0, CSV2, 56, 4)
+FIELD(ID_AA64PFR0, CSV3, 60, 4)
+
+FIELD(ID_AA64PFR1, BT, 0, 4)
+FIELD(ID_AA64PFR1, SSBS, 4, 4)
+FIELD(ID_AA64PFR1, MTE, 8, 4)
+FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
+FIELD(ID_AA64PFR1, MPAM_FRAC, 16, 4)
+FIELD(ID_AA64PFR1, SME, 24, 4)
+FIELD(ID_AA64PFR1, RNDR_TRAP, 28, 4)
+FIELD(ID_AA64PFR1, CSV2_FRAC, 32, 4)
+FIELD(ID_AA64PFR1, NMI, 36, 4)
+FIELD(ID_AA64PFR1, MTE_FRAC, 40, 4)
+FIELD(ID_AA64PFR1, GCS, 44, 4)
+FIELD(ID_AA64PFR1, THE, 48, 4)
+FIELD(ID_AA64PFR1, MTEX, 52, 4)
+FIELD(ID_AA64PFR1, DF2, 56, 4)
+FIELD(ID_AA64PFR1, PFAR, 60, 4)
+
+FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
+FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
+FIELD(ID_AA64MMFR0, BIGEND, 8, 4)
+FIELD(ID_AA64MMFR0, SNSMEM, 12, 4)
+FIELD(ID_AA64MMFR0, BIGENDEL0, 16, 4)
+FIELD(ID_AA64MMFR0, TGRAN16, 20, 4)
+FIELD(ID_AA64MMFR0, TGRAN64, 24, 4)
+FIELD(ID_AA64MMFR0, TGRAN4, 28, 4)
+FIELD(ID_AA64MMFR0, TGRAN16_2, 32, 4)
+FIELD(ID_AA64MMFR0, TGRAN64_2, 36, 4)
+FIELD(ID_AA64MMFR0, TGRAN4_2, 40, 4)
+FIELD(ID_AA64MMFR0, EXS, 44, 4)
+FIELD(ID_AA64MMFR0, FGT, 56, 4)
+FIELD(ID_AA64MMFR0, ECV, 60, 4)
+
+FIELD(ID_AA64MMFR1, HAFDBS, 0, 4)
+FIELD(ID_AA64MMFR1, VMIDBITS, 4, 4)
+FIELD(ID_AA64MMFR1, VH, 8, 4)
+FIELD(ID_AA64MMFR1, HPDS, 12, 4)
+FIELD(ID_AA64MMFR1, LO, 16, 4)
+FIELD(ID_AA64MMFR1, PAN, 20, 4)
+FIELD(ID_AA64MMFR1, SPECSEI, 24, 4)
+FIELD(ID_AA64MMFR1, XNX, 28, 4)
+FIELD(ID_AA64MMFR1, TWED, 32, 4)
+FIELD(ID_AA64MMFR1, ETS, 36, 4)
+FIELD(ID_AA64MMFR1, HCX, 40, 4)
+FIELD(ID_AA64MMFR1, AFP, 44, 4)
+FIELD(ID_AA64MMFR1, NTLBPA, 48, 4)
+FIELD(ID_AA64MMFR1, TIDCP1, 52, 4)
+FIELD(ID_AA64MMFR1, CMOW, 56, 4)
+FIELD(ID_AA64MMFR1, ECBHB, 60, 4)
+
+FIELD(ID_AA64MMFR2, CNP, 0, 4)
+FIELD(ID_AA64MMFR2, UAO, 4, 4)
+FIELD(ID_AA64MMFR2, LSM, 8, 4)
+FIELD(ID_AA64MMFR2, IESB, 12, 4)
+FIELD(ID_AA64MMFR2, VARANGE, 16, 4)
+FIELD(ID_AA64MMFR2, CCIDX, 20, 4)
+FIELD(ID_AA64MMFR2, NV, 24, 4)
+FIELD(ID_AA64MMFR2, ST, 28, 4)
+FIELD(ID_AA64MMFR2, AT, 32, 4)
+FIELD(ID_AA64MMFR2, IDS, 36, 4)
+FIELD(ID_AA64MMFR2, FWB, 40, 4)
+FIELD(ID_AA64MMFR2, TTL, 48, 4)
+FIELD(ID_AA64MMFR2, BBM, 52, 4)
+FIELD(ID_AA64MMFR2, EVT, 56, 4)
+FIELD(ID_AA64MMFR2, E0PD, 60, 4)
+
+FIELD(ID_AA64MMFR3, TCRX, 0, 4)
+FIELD(ID_AA64MMFR3, SCTLRX, 4, 4)
+FIELD(ID_AA64MMFR3, S1PIE, 8, 4)
+FIELD(ID_AA64MMFR3, S2PIE, 12, 4)
+FIELD(ID_AA64MMFR3, S1POE, 16, 4)
+FIELD(ID_AA64MMFR3, S2POE, 20, 4)
+FIELD(ID_AA64MMFR3, AIE, 24, 4)
+FIELD(ID_AA64MMFR3, MEC, 28, 4)
+FIELD(ID_AA64MMFR3, D128, 32, 4)
+FIELD(ID_AA64MMFR3, D128_2, 36, 4)
+FIELD(ID_AA64MMFR3, SNERR, 40, 4)
+FIELD(ID_AA64MMFR3, ANERR, 44, 4)
+FIELD(ID_AA64MMFR3, SDERR, 52, 4)
+FIELD(ID_AA64MMFR3, ADERR, 56, 4)
+FIELD(ID_AA64MMFR3, SPEC_FPACC, 60, 4)
+
+FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)
+FIELD(ID_AA64DFR0, TRACEVER, 4, 4)
+FIELD(ID_AA64DFR0, PMUVER, 8, 4)
+FIELD(ID_AA64DFR0, BRPS, 12, 4)
+FIELD(ID_AA64DFR0, PMSS, 16, 4)
+FIELD(ID_AA64DFR0, WRPS, 20, 4)
+FIELD(ID_AA64DFR0, SEBEP, 24, 4)
+FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)
+FIELD(ID_AA64DFR0, PMSVER, 32, 4)
+FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)
+FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)
+FIELD(ID_AA64DFR0, TRACEBUFFER, 44, 4)
+FIELD(ID_AA64DFR0, MTPMU, 48, 4)
+FIELD(ID_AA64DFR0, BRBE, 52, 4)
+FIELD(ID_AA64DFR0, EXTTRCBUFF, 56, 4)
+FIELD(ID_AA64DFR0, HPMN0, 60, 4)
+
+FIELD(ID_AA64ZFR0, SVEVER, 0, 4)
+FIELD(ID_AA64ZFR0, AES, 4, 4)
+FIELD(ID_AA64ZFR0, BITPERM, 16, 4)
+FIELD(ID_AA64ZFR0, BFLOAT16, 20, 4)
+FIELD(ID_AA64ZFR0, B16B16, 24, 4)
+FIELD(ID_AA64ZFR0, SHA3, 32, 4)
+FIELD(ID_AA64ZFR0, SM4, 40, 4)
+FIELD(ID_AA64ZFR0, I8MM, 44, 4)
+FIELD(ID_AA64ZFR0, F32MM, 52, 4)
+FIELD(ID_AA64ZFR0, F64MM, 56, 4)
+
+FIELD(ID_AA64SMFR0, F32F32, 32, 1)
+FIELD(ID_AA64SMFR0, BI32I32, 33, 1)
+FIELD(ID_AA64SMFR0, B16F32, 34, 1)
+FIELD(ID_AA64SMFR0, F16F32, 35, 1)
+FIELD(ID_AA64SMFR0, I8I32, 36, 4)
+FIELD(ID_AA64SMFR0, F16F16, 42, 1)
+FIELD(ID_AA64SMFR0, B16B16, 43, 1)
+FIELD(ID_AA64SMFR0, I16I32, 44, 4)
+FIELD(ID_AA64SMFR0, F64F64, 48, 1)
+FIELD(ID_AA64SMFR0, I16I64, 52, 4)
+FIELD(ID_AA64SMFR0, SMEVER, 56, 4)
+FIELD(ID_AA64SMFR0, FA64, 63, 1)
+
+FIELD(ID_DFR0, COPDBG, 0, 4)
+FIELD(ID_DFR0, COPSDBG, 4, 4)
+FIELD(ID_DFR0, MMAPDBG, 8, 4)
+FIELD(ID_DFR0, COPTRC, 12, 4)
+FIELD(ID_DFR0, MMAPTRC, 16, 4)
+FIELD(ID_DFR0, MPROFDBG, 20, 4)
+FIELD(ID_DFR0, PERFMON, 24, 4)
+FIELD(ID_DFR0, TRACEFILT, 28, 4)
+
+FIELD(ID_DFR1, MTPMU, 0, 4)
+FIELD(ID_DFR1, HPMN0, 4, 4)
+
+FIELD(DBGDIDR, SE_IMP, 12, 1)
+FIELD(DBGDIDR, NSUHD_IMP, 14, 1)
+FIELD(DBGDIDR, VERSION, 16, 4)
+FIELD(DBGDIDR, CTX_CMPS, 20, 4)
+FIELD(DBGDIDR, BRPS, 24, 4)
+FIELD(DBGDIDR, WRPS, 28, 4)
+
+FIELD(DBGDEVID, PCSAMPLE, 0, 4)
+FIELD(DBGDEVID, WPADDRMASK, 4, 4)
+FIELD(DBGDEVID, BPADDRMASK, 8, 4)
+FIELD(DBGDEVID, VECTORCATCH, 12, 4)
+FIELD(DBGDEVID, VIRTEXTNS, 16, 4)
+FIELD(DBGDEVID, DOUBLELOCK, 20, 4)
+FIELD(DBGDEVID, AUXREGS, 24, 4)
+FIELD(DBGDEVID, CIDMASK, 28, 4)
+
+FIELD(DBGDEVID1, PCSROFFSET, 0, 4)
+
+FIELD(MVFR0, SIMDREG, 0, 4)
+FIELD(MVFR0, FPSP, 4, 4)
+FIELD(MVFR0, FPDP, 8, 4)
+FIELD(MVFR0, FPTRAP, 12, 4)
+FIELD(MVFR0, FPDIVIDE, 16, 4)
+FIELD(MVFR0, FPSQRT, 20, 4)
+FIELD(MVFR0, FPSHVEC, 24, 4)
+FIELD(MVFR0, FPROUND, 28, 4)
+
+FIELD(MVFR1, FPFTZ, 0, 4)
+FIELD(MVFR1, FPDNAN, 4, 4)
+FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
+FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
+FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
+FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
+FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
+FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
+FIELD(MVFR1, FPHP, 24, 4)
+FIELD(MVFR1, SIMDFMAC, 28, 4)
+
+FIELD(MVFR2, SIMDMISC, 0, 4)
+FIELD(MVFR2, FPMISC, 4, 4)
+
 /*
  * Naming convention for isar_feature functions:
  * Functions which test 32-bit ID registers should have _aa32_ in
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index d5534e3580..2b9585dc80 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1994,416 +1994,6 @@ FIELD(V7M_VPR, P0, 0, 16)
 FIELD(V7M_VPR, MASK01, 16, 4)
 FIELD(V7M_VPR, MASK23, 20, 4)
 
-/*
- * System register ID fields.
- */
-FIELD(CLIDR_EL1, CTYPE1, 0, 3)
-FIELD(CLIDR_EL1, CTYPE2, 3, 3)
-FIELD(CLIDR_EL1, CTYPE3, 6, 3)
-FIELD(CLIDR_EL1, CTYPE4, 9, 3)
-FIELD(CLIDR_EL1, CTYPE5, 12, 3)
-FIELD(CLIDR_EL1, CTYPE6, 15, 3)
-FIELD(CLIDR_EL1, CTYPE7, 18, 3)
-FIELD(CLIDR_EL1, LOUIS, 21, 3)
-FIELD(CLIDR_EL1, LOC, 24, 3)
-FIELD(CLIDR_EL1, LOUU, 27, 3)
-FIELD(CLIDR_EL1, ICB, 30, 3)
-
-/* When FEAT_CCIDX is implemented */
-FIELD(CCSIDR_EL1, CCIDX_LINESIZE, 0, 3)
-FIELD(CCSIDR_EL1, CCIDX_ASSOCIATIVITY, 3, 21)
-FIELD(CCSIDR_EL1, CCIDX_NUMSETS, 32, 24)
-
-/* When FEAT_CCIDX is not implemented */
-FIELD(CCSIDR_EL1, LINESIZE, 0, 3)
-FIELD(CCSIDR_EL1, ASSOCIATIVITY, 3, 10)
-FIELD(CCSIDR_EL1, NUMSETS, 13, 15)
-
-FIELD(CTR_EL0,  IMINLINE, 0, 4)
-FIELD(CTR_EL0,  L1IP, 14, 2)
-FIELD(CTR_EL0,  DMINLINE, 16, 4)
-FIELD(CTR_EL0,  ERG, 20, 4)
-FIELD(CTR_EL0,  CWG, 24, 4)
-FIELD(CTR_EL0,  IDC, 28, 1)
-FIELD(CTR_EL0,  DIC, 29, 1)
-FIELD(CTR_EL0,  TMINLINE, 32, 6)
-
-FIELD(MIDR_EL1, REVISION, 0, 4)
-FIELD(MIDR_EL1, PARTNUM, 4, 12)
-FIELD(MIDR_EL1, ARCHITECTURE, 16, 4)
-FIELD(MIDR_EL1, VARIANT, 20, 4)
-FIELD(MIDR_EL1, IMPLEMENTER, 24, 8)
-
-FIELD(ID_ISAR0, SWAP, 0, 4)
-FIELD(ID_ISAR0, BITCOUNT, 4, 4)
-FIELD(ID_ISAR0, BITFIELD, 8, 4)
-FIELD(ID_ISAR0, CMPBRANCH, 12, 4)
-FIELD(ID_ISAR0, COPROC, 16, 4)
-FIELD(ID_ISAR0, DEBUG, 20, 4)
-FIELD(ID_ISAR0, DIVIDE, 24, 4)
-
-FIELD(ID_ISAR1, ENDIAN, 0, 4)
-FIELD(ID_ISAR1, EXCEPT, 4, 4)
-FIELD(ID_ISAR1, EXCEPT_AR, 8, 4)
-FIELD(ID_ISAR1, EXTEND, 12, 4)
-FIELD(ID_ISAR1, IFTHEN, 16, 4)
-FIELD(ID_ISAR1, IMMEDIATE, 20, 4)
-FIELD(ID_ISAR1, INTERWORK, 24, 4)
-FIELD(ID_ISAR1, JAZELLE, 28, 4)
-
-FIELD(ID_ISAR2, LOADSTORE, 0, 4)
-FIELD(ID_ISAR2, MEMHINT, 4, 4)
-FIELD(ID_ISAR2, MULTIACCESSINT, 8, 4)
-FIELD(ID_ISAR2, MULT, 12, 4)
-FIELD(ID_ISAR2, MULTS, 16, 4)
-FIELD(ID_ISAR2, MULTU, 20, 4)
-FIELD(ID_ISAR2, PSR_AR, 24, 4)
-FIELD(ID_ISAR2, REVERSAL, 28, 4)
-
-FIELD(ID_ISAR3, SATURATE, 0, 4)
-FIELD(ID_ISAR3, SIMD, 4, 4)
-FIELD(ID_ISAR3, SVC, 8, 4)
-FIELD(ID_ISAR3, SYNCHPRIM, 12, 4)
-FIELD(ID_ISAR3, TABBRANCH, 16, 4)
-FIELD(ID_ISAR3, T32COPY, 20, 4)
-FIELD(ID_ISAR3, TRUENOP, 24, 4)
-FIELD(ID_ISAR3, T32EE, 28, 4)
-
-FIELD(ID_ISAR4, UNPRIV, 0, 4)
-FIELD(ID_ISAR4, WITHSHIFTS, 4, 4)
-FIELD(ID_ISAR4, WRITEBACK, 8, 4)
-FIELD(ID_ISAR4, SMC, 12, 4)
-FIELD(ID_ISAR4, BARRIER, 16, 4)
-FIELD(ID_ISAR4, SYNCHPRIM_FRAC, 20, 4)
-FIELD(ID_ISAR4, PSR_M, 24, 4)
-FIELD(ID_ISAR4, SWP_FRAC, 28, 4)
-
-FIELD(ID_ISAR5, SEVL, 0, 4)
-FIELD(ID_ISAR5, AES, 4, 4)
-FIELD(ID_ISAR5, SHA1, 8, 4)
-FIELD(ID_ISAR5, SHA2, 12, 4)
-FIELD(ID_ISAR5, CRC32, 16, 4)
-FIELD(ID_ISAR5, RDM, 24, 4)
-FIELD(ID_ISAR5, VCMA, 28, 4)
-
-FIELD(ID_ISAR6, JSCVT, 0, 4)
-FIELD(ID_ISAR6, DP, 4, 4)
-FIELD(ID_ISAR6, FHM, 8, 4)
-FIELD(ID_ISAR6, SB, 12, 4)
-FIELD(ID_ISAR6, SPECRES, 16, 4)
-FIELD(ID_ISAR6, BF16, 20, 4)
-FIELD(ID_ISAR6, I8MM, 24, 4)
-
-FIELD(ID_MMFR0, VMSA, 0, 4)
-FIELD(ID_MMFR0, PMSA, 4, 4)
-FIELD(ID_MMFR0, OUTERSHR, 8, 4)
-FIELD(ID_MMFR0, SHARELVL, 12, 4)
-FIELD(ID_MMFR0, TCM, 16, 4)
-FIELD(ID_MMFR0, AUXREG, 20, 4)
-FIELD(ID_MMFR0, FCSE, 24, 4)
-FIELD(ID_MMFR0, INNERSHR, 28, 4)
-
-FIELD(ID_MMFR1, L1HVDVA, 0, 4)
-FIELD(ID_MMFR1, L1UNIVA, 4, 4)
-FIELD(ID_MMFR1, L1HVDSW, 8, 4)
-FIELD(ID_MMFR1, L1UNISW, 12, 4)
-FIELD(ID_MMFR1, L1HVD, 16, 4)
-FIELD(ID_MMFR1, L1UNI, 20, 4)
-FIELD(ID_MMFR1, L1TSTCLN, 24, 4)
-FIELD(ID_MMFR1, BPRED, 28, 4)
-
-FIELD(ID_MMFR2, L1HVDFG, 0, 4)
-FIELD(ID_MMFR2, L1HVDBG, 4, 4)
-FIELD(ID_MMFR2, L1HVDRNG, 8, 4)
-FIELD(ID_MMFR2, HVDTLB, 12, 4)
-FIELD(ID_MMFR2, UNITLB, 16, 4)
-FIELD(ID_MMFR2, MEMBARR, 20, 4)
-FIELD(ID_MMFR2, WFISTALL, 24, 4)
-FIELD(ID_MMFR2, HWACCFLG, 28, 4)
-
-FIELD(ID_MMFR3, CMAINTVA, 0, 4)
-FIELD(ID_MMFR3, CMAINTSW, 4, 4)
-FIELD(ID_MMFR3, BPMAINT, 8, 4)
-FIELD(ID_MMFR3, MAINTBCST, 12, 4)
-FIELD(ID_MMFR3, PAN, 16, 4)
-FIELD(ID_MMFR3, COHWALK, 20, 4)
-FIELD(ID_MMFR3, CMEMSZ, 24, 4)
-FIELD(ID_MMFR3, SUPERSEC, 28, 4)
-
-FIELD(ID_MMFR4, SPECSEI, 0, 4)
-FIELD(ID_MMFR4, AC2, 4, 4)
-FIELD(ID_MMFR4, XNX, 8, 4)
-FIELD(ID_MMFR4, CNP, 12, 4)
-FIELD(ID_MMFR4, HPDS, 16, 4)
-FIELD(ID_MMFR4, LSM, 20, 4)
-FIELD(ID_MMFR4, CCIDX, 24, 4)
-FIELD(ID_MMFR4, EVT, 28, 4)
-
-FIELD(ID_MMFR5, ETS, 0, 4)
-FIELD(ID_MMFR5, NTLBPA, 4, 4)
-
-FIELD(ID_PFR0, STATE0, 0, 4)
-FIELD(ID_PFR0, STATE1, 4, 4)
-FIELD(ID_PFR0, STATE2, 8, 4)
-FIELD(ID_PFR0, STATE3, 12, 4)
-FIELD(ID_PFR0, CSV2, 16, 4)
-FIELD(ID_PFR0, AMU, 20, 4)
-FIELD(ID_PFR0, DIT, 24, 4)
-FIELD(ID_PFR0, RAS, 28, 4)
-
-FIELD(ID_PFR1, PROGMOD, 0, 4)
-FIELD(ID_PFR1, SECURITY, 4, 4)
-FIELD(ID_PFR1, MPROGMOD, 8, 4)
-FIELD(ID_PFR1, VIRTUALIZATION, 12, 4)
-FIELD(ID_PFR1, GENTIMER, 16, 4)
-FIELD(ID_PFR1, SEC_FRAC, 20, 4)
-FIELD(ID_PFR1, VIRT_FRAC, 24, 4)
-FIELD(ID_PFR1, GIC, 28, 4)
-
-FIELD(ID_PFR2, CSV3, 0, 4)
-FIELD(ID_PFR2, SSBS, 4, 4)
-FIELD(ID_PFR2, RAS_FRAC, 8, 4)
-
-FIELD(ID_AA64ISAR0, AES, 4, 4)
-FIELD(ID_AA64ISAR0, SHA1, 8, 4)
-FIELD(ID_AA64ISAR0, SHA2, 12, 4)
-FIELD(ID_AA64ISAR0, CRC32, 16, 4)
-FIELD(ID_AA64ISAR0, ATOMIC, 20, 4)
-FIELD(ID_AA64ISAR0, TME, 24, 4)
-FIELD(ID_AA64ISAR0, RDM, 28, 4)
-FIELD(ID_AA64ISAR0, SHA3, 32, 4)
-FIELD(ID_AA64ISAR0, SM3, 36, 4)
-FIELD(ID_AA64ISAR0, SM4, 40, 4)
-FIELD(ID_AA64ISAR0, DP, 44, 4)
-FIELD(ID_AA64ISAR0, FHM, 48, 4)
-FIELD(ID_AA64ISAR0, TS, 52, 4)
-FIELD(ID_AA64ISAR0, TLB, 56, 4)
-FIELD(ID_AA64ISAR0, RNDR, 60, 4)
-
-FIELD(ID_AA64ISAR1, DPB, 0, 4)
-FIELD(ID_AA64ISAR1, APA, 4, 4)
-FIELD(ID_AA64ISAR1, API, 8, 4)
-FIELD(ID_AA64ISAR1, JSCVT, 12, 4)
-FIELD(ID_AA64ISAR1, FCMA, 16, 4)
-FIELD(ID_AA64ISAR1, LRCPC, 20, 4)
-FIELD(ID_AA64ISAR1, GPA, 24, 4)
-FIELD(ID_AA64ISAR1, GPI, 28, 4)
-FIELD(ID_AA64ISAR1, FRINTTS, 32, 4)
-FIELD(ID_AA64ISAR1, SB, 36, 4)
-FIELD(ID_AA64ISAR1, SPECRES, 40, 4)
-FIELD(ID_AA64ISAR1, BF16, 44, 4)
-FIELD(ID_AA64ISAR1, DGH, 48, 4)
-FIELD(ID_AA64ISAR1, I8MM, 52, 4)
-FIELD(ID_AA64ISAR1, XS, 56, 4)
-FIELD(ID_AA64ISAR1, LS64, 60, 4)
-
-FIELD(ID_AA64ISAR2, WFXT, 0, 4)
-FIELD(ID_AA64ISAR2, RPRES, 4, 4)
-FIELD(ID_AA64ISAR2, GPA3, 8, 4)
-FIELD(ID_AA64ISAR2, APA3, 12, 4)
-FIELD(ID_AA64ISAR2, MOPS, 16, 4)
-FIELD(ID_AA64ISAR2, BC, 20, 4)
-FIELD(ID_AA64ISAR2, PAC_FRAC, 24, 4)
-FIELD(ID_AA64ISAR2, CLRBHB, 28, 4)
-FIELD(ID_AA64ISAR2, SYSREG_128, 32, 4)
-FIELD(ID_AA64ISAR2, SYSINSTR_128, 36, 4)
-FIELD(ID_AA64ISAR2, PRFMSLC, 40, 4)
-FIELD(ID_AA64ISAR2, RPRFM, 48, 4)
-FIELD(ID_AA64ISAR2, CSSC, 52, 4)
-FIELD(ID_AA64ISAR2, LUT, 56, 4)
-FIELD(ID_AA64ISAR2, ATS1A, 60, 4)
-
-FIELD(ID_AA64PFR0, EL0, 0, 4)
-FIELD(ID_AA64PFR0, EL1, 4, 4)
-FIELD(ID_AA64PFR0, EL2, 8, 4)
-FIELD(ID_AA64PFR0, EL3, 12, 4)
-FIELD(ID_AA64PFR0, FP, 16, 4)
-FIELD(ID_AA64PFR0, ADVSIMD, 20, 4)
-FIELD(ID_AA64PFR0, GIC, 24, 4)
-FIELD(ID_AA64PFR0, RAS, 28, 4)
-FIELD(ID_AA64PFR0, SVE, 32, 4)
-FIELD(ID_AA64PFR0, SEL2, 36, 4)
-FIELD(ID_AA64PFR0, MPAM, 40, 4)
-FIELD(ID_AA64PFR0, AMU, 44, 4)
-FIELD(ID_AA64PFR0, DIT, 48, 4)
-FIELD(ID_AA64PFR0, RME, 52, 4)
-FIELD(ID_AA64PFR0, CSV2, 56, 4)
-FIELD(ID_AA64PFR0, CSV3, 60, 4)
-
-FIELD(ID_AA64PFR1, BT, 0, 4)
-FIELD(ID_AA64PFR1, SSBS, 4, 4)
-FIELD(ID_AA64PFR1, MTE, 8, 4)
-FIELD(ID_AA64PFR1, RAS_FRAC, 12, 4)
-FIELD(ID_AA64PFR1, MPAM_FRAC, 16, 4)
-FIELD(ID_AA64PFR1, SME, 24, 4)
-FIELD(ID_AA64PFR1, RNDR_TRAP, 28, 4)
-FIELD(ID_AA64PFR1, CSV2_FRAC, 32, 4)
-FIELD(ID_AA64PFR1, NMI, 36, 4)
-FIELD(ID_AA64PFR1, MTE_FRAC, 40, 4)
-FIELD(ID_AA64PFR1, GCS, 44, 4)
-FIELD(ID_AA64PFR1, THE, 48, 4)
-FIELD(ID_AA64PFR1, MTEX, 52, 4)
-FIELD(ID_AA64PFR1, DF2, 56, 4)
-FIELD(ID_AA64PFR1, PFAR, 60, 4)
-
-FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
-FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
-FIELD(ID_AA64MMFR0, BIGEND, 8, 4)
-FIELD(ID_AA64MMFR0, SNSMEM, 12, 4)
-FIELD(ID_AA64MMFR0, BIGENDEL0, 16, 4)
-FIELD(ID_AA64MMFR0, TGRAN16, 20, 4)
-FIELD(ID_AA64MMFR0, TGRAN64, 24, 4)
-FIELD(ID_AA64MMFR0, TGRAN4, 28, 4)
-FIELD(ID_AA64MMFR0, TGRAN16_2, 32, 4)
-FIELD(ID_AA64MMFR0, TGRAN64_2, 36, 4)
-FIELD(ID_AA64MMFR0, TGRAN4_2, 40, 4)
-FIELD(ID_AA64MMFR0, EXS, 44, 4)
-FIELD(ID_AA64MMFR0, FGT, 56, 4)
-FIELD(ID_AA64MMFR0, ECV, 60, 4)
-
-FIELD(ID_AA64MMFR1, HAFDBS, 0, 4)
-FIELD(ID_AA64MMFR1, VMIDBITS, 4, 4)
-FIELD(ID_AA64MMFR1, VH, 8, 4)
-FIELD(ID_AA64MMFR1, HPDS, 12, 4)
-FIELD(ID_AA64MMFR1, LO, 16, 4)
-FIELD(ID_AA64MMFR1, PAN, 20, 4)
-FIELD(ID_AA64MMFR1, SPECSEI, 24, 4)
-FIELD(ID_AA64MMFR1, XNX, 28, 4)
-FIELD(ID_AA64MMFR1, TWED, 32, 4)
-FIELD(ID_AA64MMFR1, ETS, 36, 4)
-FIELD(ID_AA64MMFR1, HCX, 40, 4)
-FIELD(ID_AA64MMFR1, AFP, 44, 4)
-FIELD(ID_AA64MMFR1, NTLBPA, 48, 4)
-FIELD(ID_AA64MMFR1, TIDCP1, 52, 4)
-FIELD(ID_AA64MMFR1, CMOW, 56, 4)
-FIELD(ID_AA64MMFR1, ECBHB, 60, 4)
-
-FIELD(ID_AA64MMFR2, CNP, 0, 4)
-FIELD(ID_AA64MMFR2, UAO, 4, 4)
-FIELD(ID_AA64MMFR2, LSM, 8, 4)
-FIELD(ID_AA64MMFR2, IESB, 12, 4)
-FIELD(ID_AA64MMFR2, VARANGE, 16, 4)
-FIELD(ID_AA64MMFR2, CCIDX, 20, 4)
-FIELD(ID_AA64MMFR2, NV, 24, 4)
-FIELD(ID_AA64MMFR2, ST, 28, 4)
-FIELD(ID_AA64MMFR2, AT, 32, 4)
-FIELD(ID_AA64MMFR2, IDS, 36, 4)
-FIELD(ID_AA64MMFR2, FWB, 40, 4)
-FIELD(ID_AA64MMFR2, TTL, 48, 4)
-FIELD(ID_AA64MMFR2, BBM, 52, 4)
-FIELD(ID_AA64MMFR2, EVT, 56, 4)
-FIELD(ID_AA64MMFR2, E0PD, 60, 4)
-
-FIELD(ID_AA64MMFR3, TCRX, 0, 4)
-FIELD(ID_AA64MMFR3, SCTLRX, 4, 4)
-FIELD(ID_AA64MMFR3, S1PIE, 8, 4)
-FIELD(ID_AA64MMFR3, S2PIE, 12, 4)
-FIELD(ID_AA64MMFR3, S1POE, 16, 4)
-FIELD(ID_AA64MMFR3, S2POE, 20, 4)
-FIELD(ID_AA64MMFR3, AIE, 24, 4)
-FIELD(ID_AA64MMFR3, MEC, 28, 4)
-FIELD(ID_AA64MMFR3, D128, 32, 4)
-FIELD(ID_AA64MMFR3, D128_2, 36, 4)
-FIELD(ID_AA64MMFR3, SNERR, 40, 4)
-FIELD(ID_AA64MMFR3, ANERR, 44, 4)
-FIELD(ID_AA64MMFR3, SDERR, 52, 4)
-FIELD(ID_AA64MMFR3, ADERR, 56, 4)
-FIELD(ID_AA64MMFR3, SPEC_FPACC, 60, 4)
-
-FIELD(ID_AA64DFR0, DEBUGVER, 0, 4)
-FIELD(ID_AA64DFR0, TRACEVER, 4, 4)
-FIELD(ID_AA64DFR0, PMUVER, 8, 4)
-FIELD(ID_AA64DFR0, BRPS, 12, 4)
-FIELD(ID_AA64DFR0, PMSS, 16, 4)
-FIELD(ID_AA64DFR0, WRPS, 20, 4)
-FIELD(ID_AA64DFR0, SEBEP, 24, 4)
-FIELD(ID_AA64DFR0, CTX_CMPS, 28, 4)
-FIELD(ID_AA64DFR0, PMSVER, 32, 4)
-FIELD(ID_AA64DFR0, DOUBLELOCK, 36, 4)
-FIELD(ID_AA64DFR0, TRACEFILT, 40, 4)
-FIELD(ID_AA64DFR0, TRACEBUFFER, 44, 4)
-FIELD(ID_AA64DFR0, MTPMU, 48, 4)
-FIELD(ID_AA64DFR0, BRBE, 52, 4)
-FIELD(ID_AA64DFR0, EXTTRCBUFF, 56, 4)
-FIELD(ID_AA64DFR0, HPMN0, 60, 4)
-
-FIELD(ID_AA64ZFR0, SVEVER, 0, 4)
-FIELD(ID_AA64ZFR0, AES, 4, 4)
-FIELD(ID_AA64ZFR0, BITPERM, 16, 4)
-FIELD(ID_AA64ZFR0, BFLOAT16, 20, 4)
-FIELD(ID_AA64ZFR0, B16B16, 24, 4)
-FIELD(ID_AA64ZFR0, SHA3, 32, 4)
-FIELD(ID_AA64ZFR0, SM4, 40, 4)
-FIELD(ID_AA64ZFR0, I8MM, 44, 4)
-FIELD(ID_AA64ZFR0, F32MM, 52, 4)
-FIELD(ID_AA64ZFR0, F64MM, 56, 4)
-
-FIELD(ID_AA64SMFR0, F32F32, 32, 1)
-FIELD(ID_AA64SMFR0, BI32I32, 33, 1)
-FIELD(ID_AA64SMFR0, B16F32, 34, 1)
-FIELD(ID_AA64SMFR0, F16F32, 35, 1)
-FIELD(ID_AA64SMFR0, I8I32, 36, 4)
-FIELD(ID_AA64SMFR0, F16F16, 42, 1)
-FIELD(ID_AA64SMFR0, B16B16, 43, 1)
-FIELD(ID_AA64SMFR0, I16I32, 44, 4)
-FIELD(ID_AA64SMFR0, F64F64, 48, 1)
-FIELD(ID_AA64SMFR0, I16I64, 52, 4)
-FIELD(ID_AA64SMFR0, SMEVER, 56, 4)
-FIELD(ID_AA64SMFR0, FA64, 63, 1)
-
-FIELD(ID_DFR0, COPDBG, 0, 4)
-FIELD(ID_DFR0, COPSDBG, 4, 4)
-FIELD(ID_DFR0, MMAPDBG, 8, 4)
-FIELD(ID_DFR0, COPTRC, 12, 4)
-FIELD(ID_DFR0, MMAPTRC, 16, 4)
-FIELD(ID_DFR0, MPROFDBG, 20, 4)
-FIELD(ID_DFR0, PERFMON, 24, 4)
-FIELD(ID_DFR0, TRACEFILT, 28, 4)
-
-FIELD(ID_DFR1, MTPMU, 0, 4)
-FIELD(ID_DFR1, HPMN0, 4, 4)
-
-FIELD(DBGDIDR, SE_IMP, 12, 1)
-FIELD(DBGDIDR, NSUHD_IMP, 14, 1)
-FIELD(DBGDIDR, VERSION, 16, 4)
-FIELD(DBGDIDR, CTX_CMPS, 20, 4)
-FIELD(DBGDIDR, BRPS, 24, 4)
-FIELD(DBGDIDR, WRPS, 28, 4)
-
-FIELD(DBGDEVID, PCSAMPLE, 0, 4)
-FIELD(DBGDEVID, WPADDRMASK, 4, 4)
-FIELD(DBGDEVID, BPADDRMASK, 8, 4)
-FIELD(DBGDEVID, VECTORCATCH, 12, 4)
-FIELD(DBGDEVID, VIRTEXTNS, 16, 4)
-FIELD(DBGDEVID, DOUBLELOCK, 20, 4)
-FIELD(DBGDEVID, AUXREGS, 24, 4)
-FIELD(DBGDEVID, CIDMASK, 28, 4)
-
-FIELD(DBGDEVID1, PCSROFFSET, 0, 4)
-
-FIELD(MVFR0, SIMDREG, 0, 4)
-FIELD(MVFR0, FPSP, 4, 4)
-FIELD(MVFR0, FPDP, 8, 4)
-FIELD(MVFR0, FPTRAP, 12, 4)
-FIELD(MVFR0, FPDIVIDE, 16, 4)
-FIELD(MVFR0, FPSQRT, 20, 4)
-FIELD(MVFR0, FPSHVEC, 24, 4)
-FIELD(MVFR0, FPROUND, 28, 4)
-
-FIELD(MVFR1, FPFTZ, 0, 4)
-FIELD(MVFR1, FPDNAN, 4, 4)
-FIELD(MVFR1, SIMDLS, 8, 4) /* A-profile only */
-FIELD(MVFR1, SIMDINT, 12, 4) /* A-profile only */
-FIELD(MVFR1, SIMDSP, 16, 4) /* A-profile only */
-FIELD(MVFR1, SIMDHP, 20, 4) /* A-profile only */
-FIELD(MVFR1, MVE, 8, 4) /* M-profile only */
-FIELD(MVFR1, FP16, 20, 4) /* M-profile only */
-FIELD(MVFR1, FPHP, 24, 4)
-FIELD(MVFR1, SIMDFMAC, 28, 4)
-
-FIELD(MVFR2, SIMDMISC, 0, 4)
-FIELD(MVFR2, FPMISC, 4, 4)
-
 FIELD(GPCCR, PPS, 0, 3)
 FIELD(GPCCR, IRGN, 8, 2)
 FIELD(GPCCR, ORGN, 10, 2)

From b71e2b281a23aca474e128a8487efb07e29f4019 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 23 Sep 2025 18:57:51 +0100
Subject: [PATCH 0698/2396] target/arm: Implement ID_AA64PFR2_EL1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently we define the ID_AA64PFR2_EL1 encoding as reserved (with
the required RAZ behaviour for unassigned system registers in the ID
register encoding space).  Newer architecture versions start to
define fields in this ID register, so define the appropriate
constants and implement it as an ID register backed by a field in
cpu->isar.  Since none of our CPUs set that isar field to non-zero,
there is no behavioural change here (other than the name exposed to
the user via the gdbstub), but this paves the way for implementing
the new features that use fields in this register.

The fields here are the ones documented in rev L.b of the Arm ARM.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu-features.h    | 5 +++++
 target/arm/cpu-sysregs.h.inc | 1 +
 target/arm/helper.c          | 6 ++++--
 target/arm/hvf/hvf.c         | 1 +
 target/arm/hvf/sysreg.c.inc  | 1 +
 target/arm/kvm.c             | 1 +
 6 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index ad571e2ffe..602f6a88e5 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -277,6 +277,11 @@ FIELD(ID_AA64PFR1, MTEX, 52, 4)
 FIELD(ID_AA64PFR1, DF2, 56, 4)
 FIELD(ID_AA64PFR1, PFAR, 60, 4)
 
+FIELD(ID_AA64PFR2, MTEPERM, 0, 4)
+FIELD(ID_AA64PFR2, MTESTOREONLY, 4, 4)
+FIELD(ID_AA64PFR2, MTEFAR, 8, 4)
+FIELD(ID_AA64PFR2, FPMR, 32, 4)
+
 FIELD(ID_AA64MMFR0, PARANGE, 0, 4)
 FIELD(ID_AA64MMFR0, ASIDBITS, 4, 4)
 FIELD(ID_AA64MMFR0, BIGEND, 8, 4)
diff --git a/target/arm/cpu-sysregs.h.inc b/target/arm/cpu-sysregs.h.inc
index f48a9daa7c..2bb2861c62 100644
--- a/target/arm/cpu-sysregs.h.inc
+++ b/target/arm/cpu-sysregs.h.inc
@@ -1,6 +1,7 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 DEF(ID_AA64PFR0_EL1, 3, 0, 0, 4, 0)
 DEF(ID_AA64PFR1_EL1, 3, 0, 0, 4, 1)
+DEF(ID_AA64PFR2_EL1, 3, 0, 0, 4, 2)
 DEF(ID_AA64SMFR0_EL1, 3, 0, 0, 4, 5)
 DEF(ID_AA64DFR0_EL1, 3, 0, 0, 5, 0)
 DEF(ID_AA64DFR1_EL1, 3, 0, 0, 5, 1)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index a18d920ac1..aa730addf2 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6109,11 +6109,11 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64PFR1)},
-            { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
+            { .name = "ID_AA64PFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
               .accessfn = access_aa64_tid3,
-              .resetvalue = 0 },
+              .resetvalue = GET_IDREG(isar, ID_AA64PFR2)},
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
@@ -6341,6 +6341,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
                                R_ID_AA64PFR1_SSBS_MASK |
                                R_ID_AA64PFR1_MTE_MASK |
                                R_ID_AA64PFR1_SME_MASK },
+            { .name = "ID_AA64PFR2_EL1",
+              .exported_bits = 0 },
             { .name = "ID_AA64PFR*_EL1_RESERVED",
               .is_glob = true },
             { .name = "ID_AA64ZFR0_EL1",
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8b467b3663..0658a99a2d 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -744,6 +744,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     } regs[] = {
         { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.idregs[ID_AA64PFR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.idregs[ID_AA64PFR1_EL1_IDX] },
+        /* Add ID_AA64PFR2_EL1 here when HVF supports it */
         { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.idregs[ID_AA64DFR0_EL1_IDX] },
         { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.idregs[ID_AA64DFR1_EL1_IDX] },
         { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
diff --git a/target/arm/hvf/sysreg.c.inc b/target/arm/hvf/sysreg.c.inc
index f2276d534e..067a8603fa 100644
--- a/target/arm/hvf/sysreg.c.inc
+++ b/target/arm/hvf/sysreg.c.inc
@@ -92,6 +92,7 @@ DEF_SYSREG(HV_SYS_REG_ID_AA64PFR0_EL1, 3, 0, 0, 4, 0)
 #endif
 
 DEF_SYSREG(HV_SYS_REG_ID_AA64PFR1_EL1, 3, 0, 0, 4, 1)
+/* Add ID_AA64PFR2_EL1 here when HVF supports it */
 DEF_SYSREG(HV_SYS_REG_ID_AA64DFR0_EL1, 3, 0, 0, 5, 0)
 DEF_SYSREG(HV_SYS_REG_ID_AA64DFR1_EL1, 3, 0, 0, 5, 1)
 DEF_SYSREG(HV_SYS_REG_ID_AA64ISAR0_EL1, 3, 0, 0, 6, 0)
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 5a75ff5927..b8a1c071f5 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -324,6 +324,7 @@ static bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         err = 0;
     } else {
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR1_EL1_IDX);
+        err |= get_host_cpu_reg(fd, ahcf, ID_AA64PFR2_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64SMFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR0_EL1_IDX);
         err |= get_host_cpu_reg(fd, ahcf, ID_AA64DFR1_EL1_IDX);

From 2dad56b50d895925cd5b687bce444e90b7c132ae Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 3 Sep 2025 10:46:01 +0800
Subject: [PATCH 0699/2396] target/loongarch: Use mmu idx bitmap method when
 flush TLB

With API tlb_flush_range_by_mmuidx(), bitmap of mmu idx should be used
rather than itself. Also bitmap of MMU_KERNEL_IDX and MMU_USER_IDX are
used rather than that of current running mmu idx when flush TLB.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 9365860c8c..0c31a346fe 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -101,8 +101,7 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     target_ulong addr, mask, pagesize;
     uint8_t tlb_ps;
     LoongArchTLB *tlb = &env->tlb[index];
-
-    int mmu_idx = cpu_mmu_index(env_cpu(env), false);
+    int idxmap = BIT(MMU_KERNEL_IDX) | BIT(MMU_USER_IDX);
     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
@@ -120,12 +119,12 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
 
     if (tlb_v0) {
         tlb_flush_range_by_mmuidx(env_cpu(env), addr, pagesize,
-                                  mmu_idx, TARGET_LONG_BITS);
+                                  idxmap, TARGET_LONG_BITS);
     }
 
     if (tlb_v1) {
         tlb_flush_range_by_mmuidx(env_cpu(env), addr + pagesize, pagesize,
-                                  mmu_idx, TARGET_LONG_BITS);
+                                  idxmap, TARGET_LONG_BITS);
     }
 }
 

From 5a1d5dbccc6af262419bce69068b3cb1a1ffdb4a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 24 Jul 2025 19:57:34 +0800
Subject: [PATCH 0700/2396] target/loongarch: Add parameter tlb pointer with
 fill_tlb_entry

With function fill_tlb_entry(), it will update LoongArch emulated
TLB information. Here parameter tlb pointer is added so that TLB
entry will be updated based on relative TLB CSR registers.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 0c31a346fe..25dbbd0d77 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -143,9 +143,8 @@ static void invalidate_tlb(CPULoongArchState *env, int index)
     invalidate_tlb_entry(env, index);
 }
 
-static void fill_tlb_entry(CPULoongArchState *env, int index)
+static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb)
 {
-    LoongArchTLB *tlb = &env->tlb[index];
     uint64_t lo0, lo1, csr_vppn;
     uint16_t csr_asid;
     uint8_t csr_ps;
@@ -312,7 +311,7 @@ void helper_tlbwr(CPULoongArchState *env)
         return;
     }
 
-    fill_tlb_entry(env, index);
+    fill_tlb_entry(env, env->tlb + index);
 }
 
 void helper_tlbfill(CPULoongArchState *env)
@@ -350,7 +349,7 @@ void helper_tlbfill(CPULoongArchState *env)
     }
 
     invalidate_tlb(env, index);
-    fill_tlb_entry(env, index);
+    fill_tlb_entry(env, env->tlb + index);
 }
 
 void helper_tlbclr(CPULoongArchState *env)

From 8fa3df98336ca2872dc51a8859142e8892844fb6 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 24 Jul 2025 20:34:35 +0800
Subject: [PATCH 0701/2396] target/loongarch: Reduce TLB flush with
 helper_tlbwr

With function helper_tlbwr(), specified LoongArch TLB entry will be
updated. There are two PTE pages in one TLB entry called even/odd
pages. Supposing even/odd page is normal/none state, when odd page
is added, TLB entry is changed as normal/normal state and even page
keeps unchanged.

In this situation, it is not necessary to flush QEMU TLB since even
page keep unchanged and odd page is newly changed. Here check whether
PTE page is the same or not, TLB flush can be skipped if both are the
same or newly added.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 25dbbd0d77..88dba9eb3e 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -302,16 +302,35 @@ void helper_tlbrd(CPULoongArchState *env)
 void helper_tlbwr(CPULoongArchState *env)
 {
     int index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
+    LoongArchTLB *old, new = {};
+    bool skip_inv = false;
+    uint8_t tlb_v0, tlb_v1;
 
-    invalidate_tlb(env, index);
-
+    old = env->tlb + index;
     if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
-        env->tlb[index].tlb_misc = FIELD_DP64(env->tlb[index].tlb_misc,
-                                              TLB_MISC, E, 0);
+        invalidate_tlb(env, index);
+        old->tlb_misc = FIELD_DP64(old->tlb_misc, TLB_MISC, E, 0);
         return;
     }
 
-    fill_tlb_entry(env, env->tlb + index);
+    fill_tlb_entry(env, &new);
+    /* Check whether ASID/VPPN is the same */
+    if (old->tlb_misc == new.tlb_misc) {
+        /* Check whether both even/odd pages is the same or invalid */
+        tlb_v0 = FIELD_EX64(old->tlb_entry0, TLBENTRY, V);
+        tlb_v1 = FIELD_EX64(old->tlb_entry1, TLBENTRY, V);
+        if ((!tlb_v0 || new.tlb_entry0 == old->tlb_entry0) &&
+            (!tlb_v1 || new.tlb_entry1 == old->tlb_entry1)) {
+            skip_inv = true;
+        }
+    }
+
+    /* flush tlb before updating the entry */
+    if (!skip_inv) {
+        invalidate_tlb(env, index);
+    }
+
+    *old = new;
 }
 
 void helper_tlbfill(CPULoongArchState *env)

From 349f3ec027cffc14ca6d7f83e2618714c7054a07 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 30 Jul 2025 10:32:54 +0800
Subject: [PATCH 0702/2396] target/loongarch: Update TLB index selection method

With function helper_tlbfill(), since there is no suitable TLB entry,
new TLB will be added and flush one old TLB entry. The old TLB entry
index is selected randomly now, instead it can be optimized as
following:
  1. invalid TLB entry can be selected at first.
  2. TLB entry with other ASID can be selected secondly
  3. random method is used by last.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 49 ++++++++++++++++++++++++++-----
 1 file changed, 42 insertions(+), 7 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 88dba9eb3e..b46621f203 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -336,8 +336,11 @@ void helper_tlbwr(CPULoongArchState *env)
 void helper_tlbfill(CPULoongArchState *env)
 {
     uint64_t address, entryhi;
-    int index, set, stlb_idx;
+    int index, set, i, stlb_idx;
     uint16_t pagesize, stlb_ps;
+    uint16_t asid, tlb_asid;
+    LoongArchTLB *tlb;
+    uint8_t tlb_e;
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
         entryhi = env->CSR_TLBREHI;
@@ -351,20 +354,52 @@ void helper_tlbfill(CPULoongArchState *env)
 
     /* Validity of stlb_ps is checked in helper_csrwr_stlbps() */
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
         address = entryhi & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_64_VPPN_SHIFT);
-
-        /* Choose one set ramdomly */
-        set = get_random_tlb(0, 7);
-
-        /* Index in one set */
+        set = -1;
         stlb_idx = (address >> (stlb_ps + 1)) & 0xff; /* [0,255] */
+        for (i = 0; i < 8; ++i) {
+            tlb = &env->tlb[i * 256 + stlb_idx];
+            tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+            if (!tlb_e) {
+                set = i;
+                break;
+            }
 
+            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
+            if (asid != tlb_asid) {
+                set = i;
+            }
+        }
+
+        /* Choose one set randomly */
+        if (set < 0) {
+            set = get_random_tlb(0, 7);
+        }
         index = set * 256 + stlb_idx;
     } else {
         /* Only write into MTLB */
-        index = get_random_tlb(LOONGARCH_STLB, LOONGARCH_TLB_MAX - 1);
+        index = -1;
+        for (i = LOONGARCH_STLB; i < LOONGARCH_TLB_MAX; i++) {
+            tlb = &env->tlb[i];
+            tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+
+            if (!tlb_e) {
+                index = i;
+                break;
+            }
+
+            tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
+            if (asid != tlb_asid) {
+                index = i;
+            }
+        }
+
+        if (index < 0) {
+            index = get_random_tlb(LOONGARCH_STLB, LOONGARCH_TLB_MAX - 1);
+        }
     }
 
     invalidate_tlb(env, index);

From 27a26b48bfb71af85a9cf67d8702ecef31650653 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 3 Sep 2025 11:17:56 +0800
Subject: [PATCH 0703/2396] target/loongarch: Fix page size set issue with
 CSR_STLBPS

When modify register CSR_STLBPS, the page size should come from
input parameter rather than old value.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-csr.h        | 1 +
 target/loongarch/tcg/csr_helper.c | 5 +++--
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 0834e91f30..1a311bf06a 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -106,6 +106,7 @@ FIELD(CSR_PWCH, DIR4_WIDTH, 18, 6)
 
 #define LOONGARCH_CSR_STLBPS         0x1e /* Stlb page size */
 FIELD(CSR_STLBPS, PS, 0, 5)
+FIELD(CSR_STLBPS, RESERVE, 5, 27)
 
 #define LOONGARCH_CSR_RVACFG         0x1f /* Reduced virtual address config */
 FIELD(CSR_RVACFG, RBITS, 0, 4)
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 0d99e2c92b..eb60fefa82 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -26,13 +26,14 @@ target_ulong helper_csrwr_stlbps(CPULoongArchState *env, target_ulong val)
      * The real hardware only supports the min tlb_ps is 12
      * tlb_ps=0 may cause undefined-behavior.
      */
-    uint8_t tlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    uint8_t tlb_ps = FIELD_EX64(val, CSR_STLBPS, PS);
     if (!check_ps(env, tlb_ps)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "Attempted set ps %d\n", tlb_ps);
     } else {
         /* Only update PS field, reserved bit keeps zero */
-        env->CSR_STLBPS = FIELD_DP64(old_v, CSR_STLBPS, PS, tlb_ps);
+        val = FIELD_DP64(val, CSR_STLBPS, RESERVE, 0);
+        env->CSR_STLBPS = val;
     }
 
     return old_v;

From e49d914ceec98a52e67438a8259768482ace639c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Sat, 2 Aug 2025 10:58:40 +0800
Subject: [PATCH 0704/2396] target/loongarch: Add tlb search callback in
 loongarch_tlb_search()

With function loongarch_tlb_search(), it is to search TLB entry with
speficied virtual address, the difference is selection with asid and
global bit. Here add selection callback with asid and global bit.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index b46621f203..fda81f190a 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -21,6 +21,13 @@
 #include "cpu-csr.h"
 #include "tcg/tcg_loongarch.h"
 
+typedef bool (*tlb_match)(bool global, int asid, int tlb_asid);
+
+static bool tlb_match_any(bool global, int asid, int tlb_asid)
+{
+    return global || tlb_asid == asid;
+}
+
 bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
 {
     if (tlb_ps >= 64) {
@@ -201,12 +208,15 @@ static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
 {
     LoongArchTLB *tlb;
     uint16_t csr_asid, tlb_asid, stlb_idx;
-    uint8_t tlb_e, tlb_ps, tlb_g, stlb_ps;
+    uint8_t tlb_e, tlb_ps, stlb_ps;
+    bool tlb_g;
     int i, compare_shift;
     uint64_t vpn, tlb_vppn;
+    tlb_match func;
 
+    func = tlb_match_any;
     csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
-   stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
+    stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
     vpn = (vaddr & TARGET_VIRT_MASK) >> (stlb_ps + 1);
     stlb_idx = vpn & 0xff; /* VA[25:15] <==> TLBIDX.index for 16KiB Page */
     compare_shift = stlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
@@ -218,9 +228,9 @@ static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
         if (tlb_e) {
             tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
             tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+            tlb_g = !!FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
 
-            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
+            if (func(tlb_g, csr_asid, tlb_asid) &&
                 (vpn == (tlb_vppn >> compare_shift))) {
                 *index = i * 256 + stlb_idx;
                 return true;
@@ -239,7 +249,7 @@ static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
             tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
             compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
             vpn = (vaddr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-            if ((tlb_g == 1 || tlb_asid == csr_asid) &&
+            if (func(tlb_g, csr_asid, tlb_asid) &&
                 (vpn == (tlb_vppn >> compare_shift))) {
                 *index = i;
                 return true;

From 58c5522f1736404e6e6d396c1601ad3a1b15d7ed Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 16:06:03 +0800
Subject: [PATCH 0705/2396] target/loongarch: Add common API
 loongarch_tlb_search_cb()

Common API loongarch_tlb_search_cb() is added here to search TLB entry
with specified address.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index fda81f190a..5b78146769 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -203,19 +203,16 @@ static uint32_t get_random_tlb(uint32_t low, uint32_t high)
  * field in tlb entry contains bit[47:13], so need adjust.
  * virt_vpn = vaddr[47:13]
  */
-static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
-                                 int *index)
+static bool loongarch_tlb_search_cb(CPULoongArchState *env, vaddr vaddr,
+                                    int *index, int csr_asid, tlb_match func)
 {
     LoongArchTLB *tlb;
-    uint16_t csr_asid, tlb_asid, stlb_idx;
+    uint16_t tlb_asid, stlb_idx;
     uint8_t tlb_e, tlb_ps, stlb_ps;
     bool tlb_g;
     int i, compare_shift;
     uint64_t vpn, tlb_vppn;
-    tlb_match func;
 
-    func = tlb_match_any;
-    csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
     vpn = (vaddr & TARGET_VIRT_MASK) >> (stlb_ps + 1);
     stlb_idx = vpn & 0xff; /* VA[25:15] <==> TLBIDX.index for 16KiB Page */
@@ -259,6 +256,17 @@ static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
     return false;
 }
 
+static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
+                                 int *index)
+{
+    int csr_asid;
+    tlb_match func;
+
+    func = tlb_match_any;
+    csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
+    return loongarch_tlb_search_cb(env, vaddr, index, csr_asid, func);
+}
+
 void helper_tlbsrch(CPULoongArchState *env)
 {
     int index, match;

From 5e3ccedcf925ad4913baa953d05933df1f78e9ed Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 17:32:05 +0800
Subject: [PATCH 0706/2396] target/loongarch: Change return value type with
 loongarch_tlb_search_cb()

With function loongarch_tlb_search_cb(), change return value type from
bool type to pointer LoongArchTLB *, the pointer type can be use directly
in future.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 5b78146769..c7f30eaf15 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -203,8 +203,9 @@ static uint32_t get_random_tlb(uint32_t low, uint32_t high)
  * field in tlb entry contains bit[47:13], so need adjust.
  * virt_vpn = vaddr[47:13]
  */
-static bool loongarch_tlb_search_cb(CPULoongArchState *env, vaddr vaddr,
-                                    int *index, int csr_asid, tlb_match func)
+static LoongArchTLB *loongarch_tlb_search_cb(CPULoongArchState *env,
+                                             vaddr vaddr, int csr_asid,
+                                             tlb_match func)
 {
     LoongArchTLB *tlb;
     uint16_t tlb_asid, stlb_idx;
@@ -229,8 +230,7 @@ static bool loongarch_tlb_search_cb(CPULoongArchState *env, vaddr vaddr,
 
             if (func(tlb_g, csr_asid, tlb_asid) &&
                 (vpn == (tlb_vppn >> compare_shift))) {
-                *index = i * 256 + stlb_idx;
-                return true;
+                return tlb;
             }
         }
     }
@@ -248,12 +248,11 @@ static bool loongarch_tlb_search_cb(CPULoongArchState *env, vaddr vaddr,
             vpn = (vaddr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
             if (func(tlb_g, csr_asid, tlb_asid) &&
                 (vpn == (tlb_vppn >> compare_shift))) {
-                *index = i;
-                return true;
+                return tlb;
             }
         }
     }
-    return false;
+    return NULL;
 }
 
 static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
@@ -261,10 +260,17 @@ static bool loongarch_tlb_search(CPULoongArchState *env, vaddr vaddr,
 {
     int csr_asid;
     tlb_match func;
+    LoongArchTLB *tlb;
 
     func = tlb_match_any;
     csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
-    return loongarch_tlb_search_cb(env, vaddr, index, csr_asid, func);
+    tlb = loongarch_tlb_search_cb(env, vaddr, csr_asid, func);
+    if (tlb) {
+        *index = tlb - env->tlb;
+        return true;
+    }
+
+    return false;
 }
 
 void helper_tlbsrch(CPULoongArchState *env)

From 96e654cf3e6e03d61de447ad7117f53ed2bff998 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 17:46:12 +0800
Subject: [PATCH 0707/2396] target/loongarch: Use loongarch_tlb_search_cb in
 helper_invtlb_page_asid_or_g

With function helper_invtlb_page_asid_or_g(), currently it is to
search TLB entry one by one. Instead STLB can be searched at first
with hash method, and then search MTLB with one by one method.

Here common API loongarch_tlb_search_cb() is used in function
helper_invtlb_page_asid_or_g().

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 31 ++++++++-----------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index c7f30eaf15..0a87354ba9 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -559,31 +559,16 @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
 void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
                                   target_ulong info, target_ulong addr)
 {
-    uint16_t asid = info & 0x3ff;
+    int asid = info & 0x3ff;
+    LoongArchTLB *tlb;
+    tlb_match func;
 
-    for (int i = 0; i < LOONGARCH_TLB_MAX; i++) {
-        LoongArchTLB *tlb = &env->tlb[i];
-        uint8_t tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
-        uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-        uint64_t vpn, tlb_vppn;
-        uint8_t tlb_ps, compare_shift;
-        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-
-        if (!tlb_e) {
-            continue;
-        }
-
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-        tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-        vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-        compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-
-        if ((tlb_g || (tlb_asid == asid)) &&
-            (vpn == (tlb_vppn >> compare_shift))) {
-            tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
-        }
+    func = tlb_match_any;
+    tlb = loongarch_tlb_search_cb(env, addr, asid, func);
+    if (tlb) {
+        tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
+        tlb_flush(env_cpu(env));
     }
-    tlb_flush(env_cpu(env));
 }
 
 bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,

From eae570bdcd2d22c0e4bc058faff7f5ff874cb801 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 17:52:03 +0800
Subject: [PATCH 0708/2396] target/loongarch: Use loongarch_tlb_search_cb in
 helper_invtlb_page_asid

With function helper_invtlb_page_asid(), currently it is to search
TLB entry one by one. Instead STLB can be searched at first with hash
method, and then search MTLB with one by one method

Here common API loongarch_tlb_search_cb() is used in function
helper_invtlb_page_asid()

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 36 +++++++++++--------------------
 1 file changed, 13 insertions(+), 23 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 0a87354ba9..7a85d9ca55 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -28,6 +28,11 @@ static bool tlb_match_any(bool global, int asid, int tlb_asid)
     return global || tlb_asid == asid;
 }
 
+static bool tlb_match_asid(bool global, int asid, int tlb_asid)
+{
+    return !global && tlb_asid == asid;
+}
+
 bool check_ps(CPULoongArchState *env, uint8_t tlb_ps)
 {
     if (tlb_ps >= 64) {
@@ -529,31 +534,16 @@ void helper_invtlb_all_asid(CPULoongArchState *env, target_ulong info)
 void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
                              target_ulong addr)
 {
-    uint16_t asid = info & 0x3ff;
+    int asid = info & 0x3ff;
+    LoongArchTLB *tlb;
+    tlb_match func;
 
-    for (int i = 0; i < LOONGARCH_TLB_MAX; i++) {
-        LoongArchTLB *tlb = &env->tlb[i];
-        uint8_t tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
-        uint16_t tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-        uint64_t vpn, tlb_vppn;
-        uint8_t tlb_ps, compare_shift;
-        uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
-
-        if (!tlb_e) {
-            continue;
-        }
-
-        tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
-        tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-        vpn = (addr & TARGET_VIRT_MASK) >> (tlb_ps + 1);
-        compare_shift = tlb_ps + 1 - R_TLB_MISC_VPPN_SHIFT;
-
-        if (!tlb_g && (tlb_asid == asid) &&
-           (vpn == (tlb_vppn >> compare_shift))) {
-            tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
-        }
+    func = tlb_match_asid;
+    tlb = loongarch_tlb_search_cb(env, addr, asid, func);
+    if (tlb) {
+        tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
+        tlb_flush(env_cpu(env));
     }
-    tlb_flush(env_cpu(env));
 }
 
 void helper_invtlb_page_asid_or_g(CPULoongArchState *env,

From 56db997db04b14c15fbfbdaaa5eb924c53b730fa Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 18:07:18 +0800
Subject: [PATCH 0709/2396] target/loongarch: Invalid tlb entry in
 invalidate_tlb()

Invalid tlb entry in function invalidate_tlb(), and its usage is
simple and easy to use.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 7a85d9ca55..b777f68f71 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -123,6 +123,7 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
         return;
     }
 
+    tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
@@ -338,7 +339,6 @@ void helper_tlbwr(CPULoongArchState *env)
     old = env->tlb + index;
     if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
         invalidate_tlb(env, index);
-        old->tlb_misc = FIELD_DP64(old->tlb_misc, TLB_MISC, E, 0);
         return;
     }
 

From 66746876fed5eb3c04c2f958bef927df3389d42c Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 19:11:25 +0800
Subject: [PATCH 0710/2396] target/loongarch: Only flush one TLB entry in
 helper_invtlb_page_asid_or_g()

With function helper_invtlb_page_asid_or_g(), only one TLB entry in
LoongArch emulated TLB is invalidated. so with QEMU TLB, it is not
necessary to flush all QEMU TLB, only flush address range specified
LoongArch emulated TLB is ok. Here invalidate_tlb_entry() is called
so that only QEMU TLB entry with specified address range is flushed.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index b777f68f71..243f945612 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -556,8 +556,7 @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
     func = tlb_match_any;
     tlb = loongarch_tlb_search_cb(env, addr, asid, func);
     if (tlb) {
-        tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
-        tlb_flush(env_cpu(env));
+        invalidate_tlb(env, tlb - env->tlb);
     }
 }
 

From 8d26856fabf8faac60de03a2e0fc35e5338e248e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 4 Sep 2025 19:16:57 +0800
Subject: [PATCH 0711/2396] target/loongarch: Only flush one TLB entry in
 helper_invtlb_page_asid()

With function helper_invtlb_page_asid(), only one TLB entry in
LoongArch emulated TLB is invalidated. so with QEMU TLB, it is not
necessary to flush all QEMU TLB, only flush address range specified
LoongArch emulated TLB is ok. Here invalidate_tlb_entry() is called
so that only QEMU TLB entry with specified address range is flushed.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/loongarch/tcg/tlb_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 243f945612..8cfce48a29 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -541,8 +541,7 @@ void helper_invtlb_page_asid(CPULoongArchState *env, target_ulong info,
     func = tlb_match_asid;
     tlb = loongarch_tlb_search_cb(env, addr, asid, func);
     if (tlb) {
-        tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
-        tlb_flush(env_cpu(env));
+        invalidate_tlb(env, tlb - env->tlb);
     }
 }
 

From caf1704c56a38dbd032fd0174c07eded3a624072 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:20:59 +0800
Subject: [PATCH 0712/2396] target/loongarch: move some machine define to
 virt.h

move some machine define to virt.h

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-2-gaosong@loongson.cn>
---
 include/hw/loongarch/virt.h | 19 +++++++++++++++++++
 target/loongarch/cpu.h      | 21 ---------------------
 2 files changed, 19 insertions(+), 21 deletions(-)

diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 602feab0f0..7120b46714 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -13,6 +13,25 @@
 #include "hw/block/flash.h"
 #include "hw/loongarch/boot.h"
 
+#define IOCSRF_TEMP             0
+#define IOCSRF_NODECNT          1
+#define IOCSRF_MSI              2
+#define IOCSRF_EXTIOI           3
+#define IOCSRF_CSRIPI           4
+#define IOCSRF_FREQCSR          5
+#define IOCSRF_FREQSCALE        6
+#define IOCSRF_DVFSV1           7
+#define IOCSRF_GMOD             9
+#define IOCSRF_VM               11
+
+#define VERSION_REG             0x0
+#define FEATURE_REG             0x8
+#define VENDOR_REG              0x10
+#define CPUNAME_REG             0x20
+#define MISC_FUNC_REG           0x420
+#define IOCSRM_EXTIOI_EN        48
+#define IOCSRM_EXTIOI_INT_ENCODE 49
+
 #define LOONGARCH_MAX_CPUS      256
 
 #define VIRT_FWCFG_BASE         0x1e020000UL
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index c8b96f74dc..8c35bf120a 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -21,27 +21,6 @@
 #include "cpu-csr.h"
 #include "cpu-qom.h"
 
-#define IOCSRF_TEMP             0
-#define IOCSRF_NODECNT          1
-#define IOCSRF_MSI              2
-#define IOCSRF_EXTIOI           3
-#define IOCSRF_CSRIPI           4
-#define IOCSRF_FREQCSR          5
-#define IOCSRF_FREQSCALE        6
-#define IOCSRF_DVFSV1           7
-#define IOCSRF_GMOD             9
-#define IOCSRF_VM               11
-
-#define VERSION_REG             0x0
-#define FEATURE_REG             0x8
-#define VENDOR_REG              0x10
-#define CPUNAME_REG             0x20
-#define MISC_FUNC_REG           0x420
-#define IOCSRM_EXTIOI_EN        48
-#define IOCSRM_EXTIOI_INT_ENCODE 49
-
-#define IOCSR_MEM_SIZE          0x428
-
 #define FCSR0_M1    0x1f         /* FCSR1 mask, Enables */
 #define FCSR0_M2    0x1f1f0000   /* FCSR2 mask, Cause and Flags */
 #define FCSR0_M3    0x300        /* FCSR3 mask, Round Mode */

From 2002711e3dec0f0bb3eb86ee1e108ec9e95ed46f Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:00 +0800
Subject: [PATCH 0713/2396] hw/loongarch: add virt feature dmsi support

dmsi feature is added in LoongArchVirtMachinState, and it is used
to check whether virt machine supports the directy Message-Interrupts.
and by default set dmsi with ON_OFF_AUTO_AUTO.
LoongArchVirtMachineState adds misc_feature and misc_status for misc
features and status. and set the default dintc feature bit.
Msgint feature is added in LoongArchCPU, and it is used to check
whether th cpu supports the Message-Interrupts and by default set
mesgint with ON_OFF_AUTO_AUTO.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-3-gaosong@loongson.cn>
---
 hw/loongarch/virt.c         | 50 +++++++++++++++++++++++++++++++++++++
 include/hw/loongarch/virt.h | 14 +++++++++++
 target/loongarch/cpu.c      | 29 +++++++++++++++++++++
 target/loongarch/cpu.h      |  1 +
 4 files changed, 94 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index bd5cff1f1e..256af63d73 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -48,6 +48,30 @@
 #include "qemu/error-report.h"
 #include "kvm/kvm_loongarch.h"
 
+static void virt_get_dmsi(Object *obj, Visitor *v, const char *name,
+                             void *opaque, Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+    OnOffAuto dmsi = lvms->dmsi;
+
+    visit_type_OnOffAuto(v, name, &dmsi, errp);
+
+}
+static void virt_set_dmsi(Object *obj, Visitor *v, const char *name,
+                              void *opaque, Error **errp)
+{
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(obj);
+
+    visit_type_OnOffAuto(v, name, &lvms->dmsi, errp);
+
+    if (lvms->dmsi == ON_OFF_AUTO_OFF) {
+        lvms->misc_feature &= ~BIT(IOCSRF_DMSI);
+        lvms->misc_status &= ~BIT_ULL(IOCSRM_DMSI_EN);
+    } else if (lvms->dmsi == ON_OFF_AUTO_ON) {
+        lvms->misc_feature = BIT(IOCSRF_DMSI);
+    }
+}
+
 static void virt_get_veiointc(Object *obj, Visitor *v, const char *name,
                               void *opaque, Error **errp)
 {
@@ -683,6 +707,25 @@ static void fw_cfg_add_memory(MachineState *ms)
     }
 }
 
+static void virt_check_dmsi(MachineState *machine)
+{
+    LoongArchCPU *cpu;
+    LoongArchVirtMachineState *lvms = LOONGARCH_VIRT_MACHINE(machine);
+
+    cpu = LOONGARCH_CPU(first_cpu);
+    if (lvms->dmsi == ON_OFF_AUTO_AUTO) {
+        if (cpu->msgint != ON_OFF_AUTO_OFF) {
+            lvms->misc_feature = BIT(IOCSRF_DMSI);
+        }
+    }
+
+    if (lvms->dmsi == ON_OFF_AUTO_ON && cpu->msgint == ON_OFF_AUTO_OFF) {
+        error_report("Fail to enable dmsi , cpu msgint is off "
+                     "pleass add cpu feature mesgint=on.");
+        exit(EXIT_FAILURE);
+    }
+}
+
 static void virt_init(MachineState *machine)
 {
     const char *cpu_model = machine->cpu_type;
@@ -717,6 +760,7 @@ static void virt_init(MachineState *machine)
         }
         qdev_realize_and_unref(DEVICE(cpuobj), NULL, &error_fatal);
     }
+    virt_check_dmsi(machine);
     fw_cfg_add_memory(machine);
 
     /* Node0 memory */
@@ -847,6 +891,8 @@ static void virt_initfn(Object *obj)
     if (tcg_enabled()) {
         lvms->veiointc = ON_OFF_AUTO_OFF;
     }
+
+    lvms->dmsi = ON_OFF_AUTO_AUTO;
     lvms->acpi = ON_OFF_AUTO_AUTO;
     lvms->oem_id = g_strndup(ACPI_BUILD_APPNAME6, 6);
     lvms->oem_table_id = g_strndup(ACPI_BUILD_APPNAME8, 8);
@@ -1241,6 +1287,10 @@ static void virt_class_init(ObjectClass *oc, const void *data)
         NULL, NULL);
     object_class_property_set_description(oc, "v-eiointc",
                             "Enable Virt Extend I/O Interrupt Controller.");
+    object_class_property_add(oc, "dmsi", "OnOffAuto",
+        virt_get_dmsi, virt_set_dmsi, NULL, NULL);
+    object_class_property_set_description(oc, "dmsi",
+                            "Enable direct Message-interrupts Controller.");
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_RAMFB_DEVICE);
     machine_class_allow_dynamic_sysbus_dev(mc, TYPE_UEFI_VARS_SYSBUS);
 #ifdef CONFIG_TPM
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 7120b46714..98e9bf0737 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -23,6 +23,7 @@
 #define IOCSRF_DVFSV1           7
 #define IOCSRF_GMOD             9
 #define IOCSRF_VM               11
+#define IOCSRF_DMSI             15
 
 #define VERSION_REG             0x0
 #define FEATURE_REG             0x8
@@ -31,6 +32,7 @@
 #define MISC_FUNC_REG           0x420
 #define IOCSRM_EXTIOI_EN        48
 #define IOCSRM_EXTIOI_INT_ENCODE 49
+#define IOCSRM_DMSI_EN          51
 
 #define LOONGARCH_MAX_CPUS      256
 
@@ -69,6 +71,7 @@ struct LoongArchVirtMachineState {
     Notifier     powerdown_notifier;
     OnOffAuto    acpi;
     OnOffAuto    veiointc;
+    OnOffAuto    dmsi;
     char         *oem_id;
     char         *oem_table_id;
     DeviceState  *acpi_ged;
@@ -84,6 +87,8 @@ struct LoongArchVirtMachineState {
     DeviceState *extioi;
     struct memmap_entry *memmap_table;
     unsigned int memmap_entries;
+    uint64_t misc_feature;
+    uint64_t misc_status;
 };
 
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
@@ -91,6 +96,15 @@ OBJECT_DECLARE_SIMPLE_TYPE(LoongArchVirtMachineState, LOONGARCH_VIRT_MACHINE)
 void virt_acpi_setup(LoongArchVirtMachineState *lvms);
 void virt_fdt_setup(LoongArchVirtMachineState *lvms);
 
+static inline bool virt_has_dmsi(LoongArchVirtMachineState *lvms)
+{
+    if (!(lvms->misc_feature & BIT(IOCSRF_DMSI))) {
+        return false;
+    }
+
+    return true;
+}
+
 static inline bool virt_is_veiointc_enabled(LoongArchVirtMachineState *lvms)
 {
     if (lvms->veiointc == ON_OFF_AUTO_OFF) {
diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 55ee317bf2..993602fb8c 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -495,6 +495,25 @@ static void loongarch_set_lasx(Object *obj, bool value, Error **errp)
     cpu->env.cpucfg[2] = FIELD_DP32(val, CPUCFG2, LASX, value);
 }
 
+static bool loongarch_get_msgint(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->msgint != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_msgint(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
+    cpu->msgint = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+
+    if (kvm_enabled()) {
+        /* kvm feature detection in function kvm_arch_init_vcpu */
+        return;
+    }
+
+     cpu->env.cpucfg[1] = FIELD_DP32(cpu->env.cpucfg[1], CPUCFG1, MSG_INT, value);
+}
+
 static void loongarch_cpu_post_init(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
@@ -507,6 +526,8 @@ static void loongarch_cpu_post_init(Object *obj)
                              loongarch_set_lsx);
     object_property_add_bool(obj, "lasx", loongarch_get_lasx,
                              loongarch_set_lasx);
+    object_property_add_bool(obj, "msgint", loongarch_get_msgint,
+                             loongarch_set_msgint);
     /* lbt is enabled only in kvm mode, not supported in tcg mode */
     if (kvm_enabled()) {
         kvm_loongarch_cpu_post_init(cpu);
@@ -614,6 +635,7 @@ static void loongarch_la464_initfn(Object *obj)
     env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_WAYS, 7);
     env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_SETS, 8);
 
+    cpu->msgint = ON_OFF_AUTO_OFF;
     loongarch_la464_init_csr(obj);
     loongarch_cpu_post_init(obj);
 }
@@ -644,12 +666,19 @@ static void loongarch_la132_initfn(Object *obj)
     data = FIELD_DP32(data, CPUCFG1, HP, 1);
     data = FIELD_DP32(data, CPUCFG1, CRC, 1);
     env->cpucfg[1] = data;
+    cpu->msgint = ON_OFF_AUTO_OFF;
 }
 
 static void loongarch_max_initfn(Object *obj)
 {
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
     /* '-cpu max' for TCG: we use cpu la464. */
     loongarch_la464_initfn(obj);
+
+    if (tcg_enabled()) {
+        cpu->env.cpucfg[1] = FIELD_DP32(cpu->env.cpucfg[1], CPUCFG1, MSG_INT, 1);
+        cpu->msgint = ON_OFF_AUTO_AUTO;
+    }
 }
 
 static void loongarch_cpu_reset_hold(Object *obj, ResetType type)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 8c35bf120a..19e00325ca 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -392,6 +392,7 @@ struct ArchCPU {
     OnOffAuto pmu;
     OnOffAuto lsx;
     OnOffAuto lasx;
+    OnOffAuto msgint;
     OnOffAuto kvm_pv_ipi;
     OnOffAuto kvm_steal_time;
     int32_t socket_id;  /* socket-id of this CPU */

From 86f4c80ab4a0d7a76d000515425d025004d6cd8b Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:01 +0800
Subject: [PATCH 0714/2396] hw/loongarch: add misc register support dmsi

Add feature register and misc register for dmsi feature checking and
setting

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-4-gaosong@loongson.cn>
---
 hw/loongarch/virt.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 256af63d73..a89d1a1ca1 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -564,6 +564,10 @@ static MemTxResult virt_iocsr_misc_write(void *opaque, hwaddr addr,
             return MEMTX_OK;
         }
 
+        if (virt_has_dmsi(lvms) && val & BIT_ULL(IOCSRM_DMSI_EN)) {
+            lvms->misc_status |= BIT_ULL(IOCSRM_DMSI_EN);
+        }
+
         features = address_space_ldl(&lvms->as_iocsr,
                                      EXTIOI_VIRT_BASE + EXTIOI_VIRT_CONFIG,
                                      attrs, NULL);
@@ -599,6 +603,9 @@ static MemTxResult virt_iocsr_misc_read(void *opaque, hwaddr addr,
         break;
     case FEATURE_REG:
         ret = BIT(IOCSRF_MSI) | BIT(IOCSRF_EXTIOI) | BIT(IOCSRF_CSRIPI);
+        if (virt_has_dmsi(lvms)) {
+            ret |= BIT(IOCSRF_DMSI);
+        }
         if (kvm_enabled()) {
             ret |= BIT(IOCSRF_VM);
         }
@@ -628,6 +635,10 @@ static MemTxResult virt_iocsr_misc_read(void *opaque, hwaddr addr,
         if (features & BIT(EXTIOI_ENABLE_INT_ENCODE)) {
             ret |= BIT_ULL(IOCSRM_EXTIOI_INT_ENCODE);
         }
+        if (virt_has_dmsi(lvms) &&
+            (lvms->misc_status & BIT_ULL(IOCSRM_DMSI_EN))) {
+            ret |= BIT_ULL(IOCSRM_DMSI_EN);
+        }
         break;
     default:
         g_assert_not_reached();

From 4d4baab24179b51072f5e182aa41d44306ed593c Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:02 +0800
Subject: [PATCH 0715/2396] loongarch: add a direct interrupt controller device

Add Loongarch direct interrupt controller device base Definition.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-5-gaosong@loongson.cn>
---
 hw/intc/Kconfig                   |  3 ++
 hw/intc/loongarch_dintc.c         | 68 +++++++++++++++++++++++++++++++
 hw/intc/meson.build               |  1 +
 hw/loongarch/Kconfig              |  1 +
 include/hw/intc/loongarch_dintc.h | 35 ++++++++++++++++
 5 files changed, 108 insertions(+)
 create mode 100644 hw/intc/loongarch_dintc.c
 create mode 100644 include/hw/intc/loongarch_dintc.h

diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index 7547528f2c..9f456d7e43 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -109,3 +109,6 @@ config LOONGARCH_PCH_MSI
 
 config LOONGARCH_EXTIOI
     bool
+
+config LOONGARCH_DINTC
+    bool
diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
new file mode 100644
index 0000000000..b2465cb022
--- /dev/null
+++ b/hw/intc/loongarch_dintc.c
@@ -0,0 +1,68 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * QEMU LoongArch direct interrupt controller.
+ *
+ * Copyright (C) 2025 Loongson Technology Corporation Limited
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/irq.h"
+#include "hw/intc/loongarch_pch_msi.h"
+#include "hw/intc/loongarch_pch_pic.h"
+#include "hw/intc/loongarch_dintc.h"
+#include "hw/pci/msi.h"
+#include "hw/misc/unimp.h"
+#include "migration/vmstate.h"
+#include "trace.h"
+#include "hw/qdev-properties.h"
+
+
+static void loongarch_dintc_realize(DeviceState *dev, Error **errp)
+{
+    LoongArchDINTCClass *lac = LOONGARCH_DINTC_GET_CLASS(dev);
+
+    Error *local_err = NULL;
+    lac->parent_realize(dev, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    return;
+}
+
+static void loongarch_dintc_unrealize(DeviceState *dev)
+{
+    return;
+}
+
+static void loongarch_dintc_init(Object *obj)
+{
+    return;
+}
+
+static void loongarch_dintc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    LoongArchDINTCClass *lac = LOONGARCH_DINTC_CLASS(klass);
+
+    dc->unrealize = loongarch_dintc_unrealize;
+    device_class_set_parent_realize(dc, loongarch_dintc_realize,
+                                    &lac->parent_realize);
+}
+
+static const TypeInfo loongarch_dintc_info = {
+    .name          = TYPE_LOONGARCH_DINTC,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(LoongArchDINTCState),
+    .instance_init = loongarch_dintc_init,
+    .class_init    = loongarch_dintc_class_init,
+};
+
+static void loongarch_dintc_register_types(void)
+{
+    type_register_static(&loongarch_dintc_info);
+}
+
+type_init(loongarch_dintc_register_types)
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index 3efb276b6e..faae20b93d 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -80,3 +80,4 @@ specific_ss.add(when: 'CONFIG_LOONGARCH_PCH_MSI', if_true: files('loongarch_pch_
 specific_ss.add(when: 'CONFIG_LOONGARCH_EXTIOI', if_true: files('loongarch_extioi.c', 'loongarch_extioi_common.c'))
 specific_ss.add(when: ['CONFIG_KVM', 'CONFIG_LOONGARCH_EXTIOI'],
                if_true: files('loongarch_extioi_kvm.c'))
+specific_ss.add(when: 'CONFIG_LOONGARCH_DINTC', if_true: files('loongarch_dintc.c'))
diff --git a/hw/loongarch/Kconfig b/hw/loongarch/Kconfig
index bb2838b7b5..8024ddf1f3 100644
--- a/hw/loongarch/Kconfig
+++ b/hw/loongarch/Kconfig
@@ -15,6 +15,7 @@ config LOONGARCH_VIRT
     select LOONGARCH_PCH_PIC
     select LOONGARCH_PCH_MSI
     select LOONGARCH_EXTIOI
+    select LOONGARCH_DINTC
     select LS7A_RTC
     select SMBIOS
     select ACPI_CPU_HOTPLUG
diff --git a/include/hw/intc/loongarch_dintc.h b/include/hw/intc/loongarch_dintc.h
new file mode 100644
index 0000000000..aa94cd1003
--- /dev/null
+++ b/include/hw/intc/loongarch_dintc.h
@@ -0,0 +1,35 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch  direct interrupt controller definitions
+ *
+ * Copyright (C) 2025 Loongson Technology Corporation Limited
+ */
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+#include "hw/loongarch/virt.h"
+
+
+#define NR_VECTORS     256
+
+#define TYPE_LOONGARCH_DINTC "loongarch_dintc"
+OBJECT_DECLARE_TYPE(LoongArchDINTCState, LoongArchDINTCClass, LOONGARCH_DINTC)
+
+typedef struct DINTCCore {
+    CPUState *cpu;
+    qemu_irq parent_irq;
+    uint64_t arch_id;
+} DINTCCore;
+
+struct LoongArchDINTCState {
+    SysBusDevice parent_obj;
+    DINTCCore *cpu;
+    uint32_t num_cpu;
+};
+
+struct LoongArchDINTCClass {
+    SysBusDeviceClass parent_class;
+
+    DeviceRealize parent_realize;
+    DeviceUnrealize parent_unrealize;
+};

From 3ff989d566ec880a5d06de7bb65d3dc35fc3b63b Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:03 +0800
Subject: [PATCH 0716/2396] target/loongarch: add msg interrupt CSR registers

include CSR_MSGIS0-3, CSR_MSGIR and CSR_MSGIE.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250916122109.749813-6-gaosong@loongson.cn>
---
 target/loongarch/cpu-csr.h |  3 +++
 target/loongarch/cpu.h     | 11 +++++++++++
 target/loongarch/machine.c | 25 +++++++++++++++++++++++--
 3 files changed, 37 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 0834e91f30..4792677086 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -186,6 +186,9 @@ FIELD(CSR_MERRCTL, ISMERR, 0, 1)
 
 #define LOONGARCH_CSR_CTAG           0x98 /* TagLo + TagHi */
 
+#define LOONGARCH_CSR_MSGIS(N)       (0xa0 + N)
+#define LOONGARCH_CSR_MSGIR               0xa4
+
 /* Direct map windows CSRs*/
 #define LOONGARCH_CSR_DMW(N)         (0x180 + N)
 FIELD(CSR_DMW, PLV0, 0, 1)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 19e00325ca..78210a46d8 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -233,6 +233,13 @@ FIELD(TLB_MISC, ASID, 1, 10)
 FIELD(TLB_MISC, VPPN, 13, 35)
 FIELD(TLB_MISC, PS, 48, 6)
 
+/*Msg interrupt registers */
+#define N_MSGIS                4
+FIELD(CSR_MSGIS, IS, 0, 63)
+FIELD(CSR_MSGIR, INTNUM, 0, 8)
+FIELD(CSR_MSGIR, ACTIVE, 31, 1)
+FIELD(CSR_MSGIE, PT, 0, 8)
+
 #define LSX_LEN    (128)
 #define LASX_LEN   (256)
 
@@ -350,6 +357,10 @@ typedef struct CPUArchState {
     uint64_t CSR_DBG;
     uint64_t CSR_DERA;
     uint64_t CSR_DSAVE;
+    /* Msg interrupt registers */
+    uint64_t CSR_MSGIS[N_MSGIS];
+    uint64_t CSR_MSGIR;
+    uint64_t CSR_MSGIE;
     struct {
         uint64_t guest_addr;
     } stealtime;
diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
index 4e70f5c879..73190fb367 100644
--- a/target/loongarch/machine.c
+++ b/target/loongarch/machine.c
@@ -45,6 +45,26 @@ static const VMStateDescription vmstate_fpu = {
     },
 };
 
+static bool msgint_needed(void *opaque)
+{
+    LoongArchCPU *cpu = opaque;
+
+    return FIELD_EX64(cpu->env.cpucfg[1], CPUCFG1, MSG_INT);
+}
+
+static const VMStateDescription vmstate_msgint = {
+    .name = "cpu/msgint",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = msgint_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(env.CSR_MSGIS, LoongArchCPU, N_MSGIS),
+        VMSTATE_UINT64(env.CSR_MSGIR, LoongArchCPU),
+        VMSTATE_UINT64(env.CSR_MSGIE, LoongArchCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const VMStateDescription vmstate_lsxh_reg = {
     .name = "lsxh_reg",
     .version_id = 1,
@@ -168,8 +188,8 @@ static const VMStateDescription vmstate_tlb = {
 /* LoongArch CPU state */
 const VMStateDescription vmstate_loongarch_cpu = {
     .name = "cpu",
-    .version_id = 3,
-    .minimum_version_id = 3,
+    .version_id = 4,
+    .minimum_version_id = 4,
     .fields = (const VMStateField[]) {
         VMSTATE_UINTTL_ARRAY(env.gpr, LoongArchCPU, 32),
         VMSTATE_UINTTL(env.pc, LoongArchCPU),
@@ -245,6 +265,7 @@ const VMStateDescription vmstate_loongarch_cpu = {
         &vmstate_tlb,
 #endif
         &vmstate_lbt,
+        &vmstate_msgint,
         NULL
     }
 };

From 07f3e5203ade3fd2e3d8d0593bcdb0aa39e022d4 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:04 +0800
Subject: [PATCH 0717/2396] hw/loongarch: DINTC add a MemoryRegion

the DINTC use [2fe00000-2ff00000) Memory.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-7-gaosong@loongson.cn>
---
 hw/intc/loongarch_dintc.c         | 24 +++++++++++++++++++
 hw/loongarch/virt.c               | 38 ++++++++++++++++++++++++++++++-
 include/hw/intc/loongarch_dintc.h |  1 +
 include/hw/loongarch/virt.h       |  1 +
 include/hw/pci-host/ls7a.h        |  2 ++
 5 files changed, 65 insertions(+), 1 deletion(-)

diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
index b2465cb022..7173a6aa29 100644
--- a/hw/intc/loongarch_dintc.c
+++ b/hw/intc/loongarch_dintc.c
@@ -17,6 +17,24 @@
 #include "trace.h"
 #include "hw/qdev-properties.h"
 
+static uint64_t loongarch_dintc_mem_read(void *opaque,
+                                        hwaddr addr, unsigned size)
+{
+    return 0;
+}
+
+static void loongarch_dintc_mem_write(void *opaque, hwaddr addr,
+                                     uint64_t val, unsigned size)
+{
+    return;
+}
+
+
+static const MemoryRegionOps loongarch_dintc_ops = {
+    .read = loongarch_dintc_mem_read,
+    .write = loongarch_dintc_mem_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
 
 static void loongarch_dintc_realize(DeviceState *dev, Error **errp)
 {
@@ -39,6 +57,12 @@ static void loongarch_dintc_unrealize(DeviceState *dev)
 
 static void loongarch_dintc_init(Object *obj)
 {
+    LoongArchDINTCState *s = LOONGARCH_DINTC(obj);
+    SysBusDevice *shd = SYS_BUS_DEVICE(obj);
+    memory_region_init_io(&s->dintc_mmio, OBJECT(s), &loongarch_dintc_ops,
+                          s, TYPE_LOONGARCH_DINTC, VIRT_DINTC_SIZE);
+    sysbus_init_mmio(shd, &s->dintc_mmio);
+    msi_nonbroken = true;
     return;
 }
 
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index a89d1a1ca1..a7171a5ecc 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -28,6 +28,7 @@
 #include "hw/intc/loongarch_extioi.h"
 #include "hw/intc/loongarch_pch_pic.h"
 #include "hw/intc/loongarch_pch_msi.h"
+#include "hw/intc/loongarch_dintc.h"
 #include "hw/pci-host/ls7a.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/misc/unimp.h"
@@ -386,7 +387,7 @@ static void virt_cpu_irq_init(LoongArchVirtMachineState *lvms)
 static void virt_irq_init(LoongArchVirtMachineState *lvms)
 {
     DeviceState *pch_pic, *pch_msi;
-    DeviceState *ipi, *extioi;
+    DeviceState *ipi, *extioi, *dintc;
     SysBusDevice *d;
     int i, start, num;
 
@@ -432,6 +433,33 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
      *    +--------+ +---------+ +---------+
      *    | UARTs  | | Devices | | Devices |
      *    +--------+ +---------+ +---------+
+     *
+     *
+     *  Advanced Extended IRQ model
+     *
+     *  +-----+     +---------------------------------+     +-------+
+     *  | IPI | --> |        CPUINTC                  | <-- | Timer |
+     *  +-----+     +---------------------------------+     +-------+
+     *                      ^            ^          ^
+     *                      |            |          |
+     *             +-------------+ +----------+ +---------+     +-------+
+     *             |   EIOINTC   | |   DINTC  | | LIOINTC | <-- | UARTs |
+     *             +-------------+ +----------+ +---------+     +-------+
+     *             ^            ^       ^
+     *             |            |       |
+     *        +---------+  +---------+  |
+     *        | PCH-PIC |  | PCH-MSI |  |
+     *        +---------+  +---------+  |
+     *          ^     ^           ^     |
+     *          |     |           |     |
+     *  +---------+ +---------+ +---------+
+     *  | Devices | | PCH-LPC | | Devices |
+     *  +---------+ +---------+ +---------+
+     *                  ^
+     *                  |
+     *             +---------+
+     *             | Devices |
+     *             +---------+
      */
 
     /* Create IPI device */
@@ -439,6 +467,14 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
     lvms->ipi = ipi;
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ipi), &error_fatal);
 
+    /* Create DINTC device*/
+    if (virt_has_dmsi(lvms)) {
+        dintc = qdev_new(TYPE_LOONGARCH_DINTC);
+        lvms->dintc = dintc;
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(dintc), &error_fatal);
+        sysbus_mmio_map(SYS_BUS_DEVICE(dintc), 0, VIRT_DINTC_BASE);
+    }
+
     /* Create EXTIOI device */
     extioi = qdev_new(TYPE_LOONGARCH_EXTIOI);
     lvms->extioi = extioi;
diff --git a/include/hw/intc/loongarch_dintc.h b/include/hw/intc/loongarch_dintc.h
index aa94cd1003..0b0b5347b2 100644
--- a/include/hw/intc/loongarch_dintc.h
+++ b/include/hw/intc/loongarch_dintc.h
@@ -23,6 +23,7 @@ typedef struct DINTCCore {
 
 struct LoongArchDINTCState {
     SysBusDevice parent_obj;
+    MemoryRegion dintc_mmio;
     DINTCCore *cpu;
     uint32_t num_cpu;
 };
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 98e9bf0737..cd97bdfb8d 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -89,6 +89,7 @@ struct LoongArchVirtMachineState {
     unsigned int memmap_entries;
     uint64_t misc_feature;
     uint64_t misc_status;
+    DeviceState *dintc;
 };
 
 #define TYPE_LOONGARCH_VIRT_MACHINE  MACHINE_TYPE_NAME("virt")
diff --git a/include/hw/pci-host/ls7a.h b/include/hw/pci-host/ls7a.h
index 79d4ea8501..bfdbfe3614 100644
--- a/include/hw/pci-host/ls7a.h
+++ b/include/hw/pci-host/ls7a.h
@@ -24,6 +24,8 @@
 #define VIRT_PCH_REG_BASE        0x10000000UL
 #define VIRT_IOAPIC_REG_BASE     (VIRT_PCH_REG_BASE)
 #define VIRT_PCH_MSI_ADDR_LOW    0x2FF00000UL
+#define VIRT_DINTC_SIZE          0x100000UL
+#define VIRT_DINTC_BASE          0x2FE00000UL
 #define VIRT_PCH_REG_SIZE        0x400
 #define VIRT_PCH_MSI_SIZE        0x8
 

From 386aef3e4a7fbfb8c051f8c24832492288fe6185 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:05 +0800
Subject: [PATCH 0718/2396] hw/loongarch: Implement dintc realize and unrealize

Implement th DINTC realize and unrealize.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250916122109.749813-8-gaosong@loongson.cn>
---
 hw/intc/loongarch_dintc.c | 23 ++++++++++++++++++++++-
 target/loongarch/cpu.h    |  3 ++-
 2 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
index 7173a6aa29..598c666ec6 100644
--- a/hw/intc/loongarch_dintc.c
+++ b/hw/intc/loongarch_dintc.c
@@ -38,7 +38,12 @@ static const MemoryRegionOps loongarch_dintc_ops = {
 
 static void loongarch_dintc_realize(DeviceState *dev, Error **errp)
 {
+    LoongArchDINTCState *s = LOONGARCH_DINTC(dev);
     LoongArchDINTCClass *lac = LOONGARCH_DINTC_GET_CLASS(dev);
+    MachineState *machine = MACHINE(qdev_get_machine());
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+    const CPUArchIdList  *id_list;
+    int i;
 
     Error *local_err = NULL;
     lac->parent_realize(dev, &local_err);
@@ -47,12 +52,28 @@ static void loongarch_dintc_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    assert(mc->possible_cpu_arch_ids);
+    id_list = mc->possible_cpu_arch_ids(machine);
+    s->num_cpu = id_list->len;
+    s->cpu = g_new(DINTCCore, s->num_cpu);
+    if (s->cpu == NULL) {
+        error_setg(errp, "Memory allocation for DINTCCore fail");
+        return;
+    }
+
+    for (i = 0; i < s->num_cpu; i++) {
+        s->cpu[i].arch_id = id_list->cpus[i].arch_id;
+        s->cpu[i].cpu = CPU(id_list->cpus[i].cpu);
+        qdev_init_gpio_out(dev, &s->cpu[i].parent_irq, 1);
+    }
+
     return;
 }
 
 static void loongarch_dintc_unrealize(DeviceState *dev)
 {
-    return;
+    LoongArchDINTCState *s = LOONGARCH_DINTC(dev);
+    g_free(s->cpu);
 }
 
 static void loongarch_dintc_init(Object *obj)
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index 78210a46d8..b8e3b46c3a 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -217,9 +217,10 @@ FIELD(CSR_CRMD, WE, 9, 1)
 extern const char * const regnames[32];
 extern const char * const fregnames[32];
 
-#define N_IRQS      13
+#define N_IRQS      15
 #define IRQ_TIMER   11
 #define IRQ_IPI     12
+#define INT_DMSI    14
 
 #define LOONGARCH_STLB         2048 /* 2048 STLB */
 #define LOONGARCH_MTLB         64   /* 64 MTLB */

From 0d148eaf5a3eb14469b536e37bb1936fd0085f03 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:06 +0800
Subject: [PATCH 0719/2396] hw/loongarch: Implement dintc set irq

Implement dintc set irq and update CSR_MSGIS.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250916122109.749813-9-gaosong@loongson.cn>
---
 hw/intc/loongarch_dintc.c | 32 ++++++++++++++++++++++++++++++--
 1 file changed, 30 insertions(+), 2 deletions(-)

diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
index 598c666ec6..962fe10bf8 100644
--- a/hw/intc/loongarch_dintc.c
+++ b/hw/intc/loongarch_dintc.c
@@ -16,6 +16,14 @@
 #include "migration/vmstate.h"
 #include "trace.h"
 #include "hw/qdev-properties.h"
+#include "target/loongarch/cpu.h"
+#include "qemu/error-report.h"
+#include "system/hw_accel.h"
+
+/* msg addr field */
+FIELD(MSG_ADDR, IRQ_NUM, 4, 8)
+FIELD(MSG_ADDR, CPU_NUM, 12, 8)
+FIELD(MSG_ADDR, FIX, 28, 12)
 
 static uint64_t loongarch_dintc_mem_read(void *opaque,
                                         hwaddr addr, unsigned size)
@@ -23,12 +31,32 @@ static uint64_t loongarch_dintc_mem_read(void *opaque,
     return 0;
 }
 
+static void do_set_vcpu_dintc_irq(CPUState *cs, run_on_cpu_data data)
+{
+    int irq = data.host_int;
+    CPULoongArchState *env;
+
+    env = &LOONGARCH_CPU(cs)->env;
+    cpu_synchronize_state(cs);
+    set_bit(irq, (unsigned long *)&env->CSR_MSGIS);
+}
+
 static void loongarch_dintc_mem_write(void *opaque, hwaddr addr,
                                      uint64_t val, unsigned size)
 {
-    return;
-}
+    int irq_num, cpu_num = 0;
+    LoongArchDINTCState *s = LOONGARCH_DINTC(opaque);
+    uint64_t msg_addr = addr + VIRT_DINTC_BASE;
+    CPUState *cs;
 
+    cpu_num = FIELD_EX64(msg_addr, MSG_ADDR, CPU_NUM);
+    cs = cpu_by_arch_id(cpu_num);
+    irq_num = FIELD_EX64(msg_addr, MSG_ADDR, IRQ_NUM);
+
+    async_run_on_cpu(cs, do_set_vcpu_dintc_irq,
+                         RUN_ON_CPU_HOST_INT(irq_num));
+    qemu_set_irq(s->cpu[cpu_num].parent_irq, 1);
+}
 
 static const MemoryRegionOps loongarch_dintc_ops = {
     .read = loongarch_dintc_mem_read,

From c2396bfd4892091032a482118895a02ac87ab3e0 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:07 +0800
Subject: [PATCH 0720/2396] target/loongarch: Add CSR_ESTAT.bit15 and
 CSR_ECFG.bit15 for msg interrupts.

Add CSR_ESTAT.bit15 and CSR_ECFG.bit15 for DINTC irq.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250916122109.749813-10-gaosong@loongson.cn>
---
 target/loongarch/cpu-csr.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 4792677086..f296eb8d06 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -34,11 +34,13 @@ FIELD(CSR_MISC, ALCL, 12, 4)
 FIELD(CSR_MISC, DWPL, 16, 3)
 
 #define LOONGARCH_CSR_ECFG           0x4 /* Exception config */
-FIELD(CSR_ECFG, LIE, 0, 13)
+FIELD(CSR_ECFG, LIE, 0, 15)        /* bit 15 is msg interrupt enabled */
+FIELD(CSR_ECFG, MSGINT, 14, 1)
 FIELD(CSR_ECFG, VS, 16, 3)
 
 #define LOONGARCH_CSR_ESTAT          0x5 /* Exception status */
-FIELD(CSR_ESTAT, IS, 0, 13)
+FIELD(CSR_ESTAT, IS, 0, 15)        /* bit 15 is msg interrupt enabled */
+FIELD(CSR_ESTAT, MSGINT, 14, 1)
 FIELD(CSR_ESTAT, ECODE, 16, 6)
 FIELD(CSR_ESTAT, ESUBCODE, 22, 9)
 

From ce47eaadbd6acb466095465049f8433459b022a8 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:08 +0800
Subject: [PATCH 0721/2396] target/loongarch:Implement csrrd CSR_MSGIR register

implement the read-clear feature for CSR_MSGIR register.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250916122109.749813-11-gaosong@loongson.cn>
---
 target/loongarch/csr.c                        |  5 +++++
 target/loongarch/tcg/csr_helper.c             | 21 +++++++++++++++++++
 target/loongarch/tcg/helper.h                 |  1 +
 .../tcg/insn_trans/trans_privileged.c.inc     |  1 +
 4 files changed, 28 insertions(+)

diff --git a/target/loongarch/csr.c b/target/loongarch/csr.c
index 7ea0a30450..f973780bba 100644
--- a/target/loongarch/csr.c
+++ b/target/loongarch/csr.c
@@ -97,6 +97,11 @@ static CSRInfo csr_info[] = {
     CSR_OFF(DBG),
     CSR_OFF(DERA),
     CSR_OFF(DSAVE),
+    CSR_OFF_ARRAY(MSGIS, 0),
+    CSR_OFF_ARRAY(MSGIS, 1),
+    CSR_OFF_ARRAY(MSGIS, 2),
+    CSR_OFF_ARRAY(MSGIS, 3),
+    CSR_OFF(MSGIR),
 };
 
 CSRInfo *get_csr(unsigned int csr_num)
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 0d99e2c92b..7bfe6c6c0c 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -73,6 +73,27 @@ target_ulong helper_csrrd_tval(CPULoongArchState *env)
     return cpu_loongarch_get_constant_timer_ticks(cpu);
 }
 
+target_ulong helper_csrrd_msgir(CPULoongArchState *env)
+{
+    int irq, new;
+
+    irq = find_first_bit((unsigned long *)env->CSR_MSGIS, 256);
+    if (irq < 256) {
+        clear_bit(irq, (unsigned long *)env->CSR_MSGIS);
+        new = find_first_bit((unsigned long *)env->CSR_MSGIS, 256);
+        if (new < 256) {
+            return irq;
+        }
+
+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, MSGINT, 0);
+    } else {
+        /* bit 31 set 1 for no invalid irq */
+        irq = BIT(31);
+    }
+
+    return irq;
+}
+
 target_ulong helper_csrwr_estat(CPULoongArchState *env, target_ulong val)
 {
     int64_t old_v = env->CSR_ESTAT;
diff --git a/target/loongarch/tcg/helper.h b/target/loongarch/tcg/helper.h
index 1d5cb0198c..db57dbfc16 100644
--- a/target/loongarch/tcg/helper.h
+++ b/target/loongarch/tcg/helper.h
@@ -100,6 +100,7 @@ DEF_HELPER_1(rdtime_d, i64, env)
 DEF_HELPER_1(csrrd_pgd, i64, env)
 DEF_HELPER_1(csrrd_cpuid, i64, env)
 DEF_HELPER_1(csrrd_tval, i64, env)
+DEF_HELPER_1(csrrd_msgir, i64, env)
 DEF_HELPER_2(csrwr_stlbps, i64, env, tl)
 DEF_HELPER_2(csrwr_estat, i64, env, tl)
 DEF_HELPER_2(csrwr_asid, i64, env, tl)
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index 34cfab8879..a407ab51b7 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -83,6 +83,7 @@ void loongarch_csr_translate_init(void)
     SET_CSR_FUNC(TCFG,  NULL, gen_helper_csrwr_tcfg);
     SET_CSR_FUNC(TVAL,  gen_helper_csrrd_tval, NULL);
     SET_CSR_FUNC(TICLR, NULL, gen_helper_csrwr_ticlr);
+    SET_CSR_FUNC(MSGIR, gen_helper_csrrd_msgir, NULL);
 }
 #undef SET_CSR_FUNC
 

From 7470657ec157d4526752147165b2d368e2c7002e Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 16 Sep 2025 20:21:09 +0800
Subject: [PATCH 0722/2396] hw/loongarch: Implement DINTC plug/unplug
 interfaces

when cpu added, connect dintc irq to cpu INT_DMSI irq pin.

Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20250916122109.749813-12-gaosong@loongson.cn>
---
 hw/intc/loongarch_dintc.c | 71 +++++++++++++++++++++++++++++++++++++++
 hw/loongarch/virt.c       | 11 ++++++
 2 files changed, 82 insertions(+)

diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
index 962fe10bf8..dc8f7ffdf6 100644
--- a/hw/intc/loongarch_dintc.c
+++ b/hw/intc/loongarch_dintc.c
@@ -115,14 +115,81 @@ static void loongarch_dintc_init(Object *obj)
     return;
 }
 
+static DINTCCore *loongarch_dintc_get_cpu(LoongArchDINTCState *s,
+                                        DeviceState *dev)
+{
+    CPUClass *k = CPU_GET_CLASS(dev);
+    uint64_t arch_id = k->get_arch_id(CPU(dev));
+    int i;
+
+    for (i = 0; i < s->num_cpu; i++) {
+        if (s->cpu[i].arch_id == arch_id) {
+            return &s->cpu[i];
+        }
+    }
+
+    return NULL;
+}
+
+static void loongarch_dintc_cpu_plug(HotplugHandler *hotplug_dev,
+                                   DeviceState *dev, Error **errp)
+{
+    LoongArchDINTCState *s = LOONGARCH_DINTC(hotplug_dev);
+    Object *obj = OBJECT(dev);
+    DINTCCore *core;
+    int index;
+
+    if (!object_dynamic_cast(obj, TYPE_LOONGARCH_CPU)) {
+        warn_report("LoongArch DINTC: Invalid %s device type",
+                                       object_get_typename(obj));
+        return;
+    }
+    core = loongarch_dintc_get_cpu(s, dev);
+    if (!core) {
+        return;
+    }
+
+    core->cpu = CPU(dev);
+    index = core - s->cpu;
+
+    /* connect dintc msg irq to cpu irq */
+    qdev_connect_gpio_out(DEVICE(s), index, qdev_get_gpio_in(dev, INT_DMSI));
+    return;
+}
+
+static void loongarch_dintc_cpu_unplug(HotplugHandler *hotplug_dev,
+                                     DeviceState *dev, Error **errp)
+{
+    LoongArchDINTCState *s = LOONGARCH_DINTC(hotplug_dev);
+    Object *obj = OBJECT(dev);
+    DINTCCore *core;
+
+    if (!object_dynamic_cast(obj, TYPE_LOONGARCH_CPU)) {
+        warn_report("LoongArch DINTC: Invalid %s device type",
+                                       object_get_typename(obj));
+        return;
+    }
+
+    core = loongarch_dintc_get_cpu(s, dev);
+
+    if (!core) {
+        return;
+    }
+
+    core->cpu = NULL;
+}
+
 static void loongarch_dintc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(klass);
     LoongArchDINTCClass *lac = LOONGARCH_DINTC_CLASS(klass);
 
     dc->unrealize = loongarch_dintc_unrealize;
     device_class_set_parent_realize(dc, loongarch_dintc_realize,
                                     &lac->parent_realize);
+    hc->plug = loongarch_dintc_cpu_plug;
+    hc->unplug = loongarch_dintc_cpu_unplug;
 }
 
 static const TypeInfo loongarch_dintc_info = {
@@ -131,6 +198,10 @@ static const TypeInfo loongarch_dintc_info = {
     .instance_size = sizeof(LoongArchDINTCState),
     .instance_init = loongarch_dintc_init,
     .class_init    = loongarch_dintc_class_init,
+    .interfaces    = (const InterfaceInfo[]) {
+        { TYPE_HOTPLUG_HANDLER },
+        { }
+    },
 };
 
 static void loongarch_dintc_register_types(void)
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index a7171a5ecc..c1760423ee 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -381,6 +381,10 @@ static void virt_cpu_irq_init(LoongArchVirtMachineState *lvms)
                              &error_abort);
         hotplug_handler_plug(HOTPLUG_HANDLER(lvms->extioi), DEVICE(cs),
                              &error_abort);
+	if (lvms->dintc) {
+            hotplug_handler_plug(HOTPLUG_HANDLER(lvms->dintc), DEVICE(cs),
+                                 &error_abort);
+        }
     }
 }
 
@@ -1103,6 +1107,9 @@ static void virt_cpu_unplug(HotplugHandler *hotplug_dev,
     /* Notify ipi and extioi irqchip to remove interrupt routing to CPU */
     hotplug_handler_unplug(HOTPLUG_HANDLER(lvms->ipi), dev, &error_abort);
     hotplug_handler_unplug(HOTPLUG_HANDLER(lvms->extioi), dev, &error_abort);
+    if (lvms->dintc) {
+        hotplug_handler_unplug(HOTPLUG_HANDLER(lvms->dintc), dev, &error_abort);
+    }
 
     /* Notify acpi ged CPU removed */
     hotplug_handler_unplug(HOTPLUG_HANDLER(lvms->acpi_ged), dev, &error_abort);
@@ -1127,6 +1134,10 @@ static void virt_cpu_plug(HotplugHandler *hotplug_dev,
         hotplug_handler_plug(HOTPLUG_HANDLER(lvms->extioi), dev, &error_abort);
     }
 
+    if (lvms->dintc) {
+        hotplug_handler_plug(HOTPLUG_HANDLER(lvms->dintc), dev, &error_abort);
+    }
+
     if (lvms->acpi_ged) {
         hotplug_handler_plug(HOTPLUG_HANDLER(lvms->acpi_ged), dev,
                              &error_abort);

From 98ee172538abdc1ac42d094bc8859765e5f8a79b Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:42 +0530
Subject: [PATCH 0723/2396] ppc/pnv: Introduce Pnv11Chip
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement Pnv11Chip, currently without chiptod, xive and phb.

Chiptod, XIVE, PHB are implemented in later patches.

Since Power11 core is same as Power10, the implementation of Pnv11Chip
is a duplicate of corresponding Pnv10Chip.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-2-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-2-adityag@linux.ibm.com>
---
 hw/ppc/pnv.c               | 325 +++++++++++++++++++++++++++++++++++++
 hw/ppc/pnv_core.c          |  17 ++
 include/hw/ppc/pnv.h       |  20 +++
 include/hw/ppc/pnv_chip.h  |   7 +
 include/hw/ppc/pnv_xscom.h |  49 ++++++
 5 files changed, 418 insertions(+)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 9c74f46091..77136091bb 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -491,6 +491,37 @@ static void pnv_chip_power10_dt_populate(PnvChip *chip, void *fdt)
     pnv_dt_lpc(chip, fdt, 0, PNV10_LPCM_BASE(chip), PNV10_LPCM_SIZE);
 }
 
+static void pnv_chip_power11_dt_populate(PnvChip *chip, void *fdt)
+{
+    static const char compat[] = "ibm,power11-xscom\0ibm,xscom";
+    int i;
+
+    pnv_dt_xscom(chip, fdt, 0,
+                 cpu_to_be64(PNV11_XSCOM_BASE(chip)),
+                 cpu_to_be64(PNV11_XSCOM_SIZE),
+                 compat, sizeof(compat));
+
+    for (i = 0; i < chip->nr_cores; i++) {
+        PnvCore *pnv_core = chip->cores[i];
+        int offset;
+
+        offset = pnv_dt_core(chip, pnv_core, fdt);
+
+        _FDT((fdt_setprop(fdt, offset, "ibm,pa-features",
+                           pa_features_31, sizeof(pa_features_31))));
+
+        if (pnv_core->big_core) {
+            i++; /* Big-core groups two QEMU cores */
+        }
+    }
+
+    if (chip->ram_size) {
+        pnv_dt_memory(fdt, chip->chip_id, chip->ram_start, chip->ram_size);
+    }
+
+    pnv_dt_lpc(chip, fdt, 0, PNV11_LPCM_BASE(chip), PNV11_LPCM_SIZE);
+}
+
 static void pnv_dt_rtc(ISADevice *d, void *fdt, int lpc_off)
 {
     uint32_t io_base = d->ioport_id;
@@ -823,6 +854,26 @@ static ISABus *pnv_chip_power10_isa_create(PnvChip *chip, Error **errp)
     return pnv_lpc_isa_create(&chip10->lpc, false, errp);
 }
 
+static ISABus *pnv_chip_power11_isa_create(PnvChip *chip, Error **errp)
+{
+    Pnv11Chip *chip11 = PNV11_CHIP(chip);
+    qemu_irq irq;
+
+    irq = qdev_get_gpio_in(DEVICE(&chip11->psi), PSIHB9_IRQ_LPCHC);
+    qdev_connect_gpio_out_named(DEVICE(&chip11->lpc), "LPCHC", 0, irq);
+
+    irq = qdev_get_gpio_in(DEVICE(&chip11->psi), PSIHB9_IRQ_LPC_SIRQ0);
+    qdev_connect_gpio_out_named(DEVICE(&chip11->lpc), "SERIRQ", 0, irq);
+    irq = qdev_get_gpio_in(DEVICE(&chip11->psi), PSIHB9_IRQ_LPC_SIRQ1);
+    qdev_connect_gpio_out_named(DEVICE(&chip11->lpc), "SERIRQ", 1, irq);
+    irq = qdev_get_gpio_in(DEVICE(&chip11->psi), PSIHB9_IRQ_LPC_SIRQ2);
+    qdev_connect_gpio_out_named(DEVICE(&chip11->lpc), "SERIRQ", 2, irq);
+    irq = qdev_get_gpio_in(DEVICE(&chip11->psi), PSIHB9_IRQ_LPC_SIRQ3);
+    qdev_connect_gpio_out_named(DEVICE(&chip11->lpc), "SERIRQ", 3, irq);
+
+    return pnv_lpc_isa_create(&chip11->lpc, false, errp);
+}
+
 static ISABus *pnv_isa_create(PnvChip *chip, Error **errp)
 {
     return PNV_CHIP_GET_CLASS(chip)->isa_create(chip, errp);
@@ -886,6 +937,12 @@ static uint64_t pnv_chip_power10_xscom_core_base(PnvChip *chip,
     return PNV10_XSCOM_EC_BASE(core_id);
 }
 
+static uint64_t pnv_chip_power11_xscom_core_base(PnvChip *chip,
+                                                 uint32_t core_id)
+{
+    return PNV11_XSCOM_EC_BASE(core_id);
+}
+
 static bool pnv_match_cpu(const char *default_type, const char *cpu_type)
 {
     PowerPCCPUClass *ppc_default =
@@ -915,6 +972,13 @@ static void pnv_chip_power10_pic_print_info(PnvChip *chip, GString *buf)
                          pnv_chip_power9_pic_print_info_child, buf);
 }
 
+static void pnv_chip_power11_pic_print_info(PnvChip *chip, GString *buf)
+{
+    Pnv11Chip *chip11 = PNV11_CHIP(chip);
+
+    pnv_psi_pic_print_info(&chip11->psi, buf);
+}
+
 /* Always give the first 1GB to chip 0 else we won't boot */
 static uint64_t pnv_chip_get_ram_size(PnvMachineState *pnv, int chip_id)
 {
@@ -1452,6 +1516,8 @@ static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
 
 #define POWER10_CORE_MASK  (0xffffffffffffffull)
 
+#define POWER11_CORE_MASK  (0xffffffffffffffull)
+
 static void pnv_chip_power8_instance_init(Object *obj)
 {
     Pnv8Chip *chip8 = PNV8_CHIP(obj);
@@ -2350,6 +2416,219 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
     }
 }
 
+static void pnv_chip_power11_instance_init(Object *obj)
+{
+    Pnv11Chip *chip11 = PNV11_CHIP(obj);
+    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
+    int i;
+
+    object_initialize_child(obj, "adu",  &chip11->adu, TYPE_PNV_ADU);
+
+    /*
+     * Use Power10 device models for PSI/LPC/OCC/SBE/HOMER as corresponding
+     * device models for Power11 are same
+     */
+    object_initialize_child(obj, "psi", &chip11->psi, TYPE_PNV10_PSI);
+    object_initialize_child(obj, "lpc", &chip11->lpc, TYPE_PNV10_LPC);
+    object_initialize_child(obj, "occ",  &chip11->occ, TYPE_PNV10_OCC);
+    object_initialize_child(obj, "sbe",  &chip11->sbe, TYPE_PNV10_SBE);
+    object_initialize_child(obj, "homer", &chip11->homer, TYPE_PNV10_HOMER);
+    object_initialize_child(obj, "n1-chiplet", &chip11->n1_chiplet,
+                            TYPE_PNV_N1_CHIPLET);
+
+    for (i = 0; i < pcc->i2c_num_engines; i++) {
+        object_initialize_child(obj, "i2c[*]", &chip11->i2c[i], TYPE_PNV_I2C);
+    }
+
+    for (i = 0; i < PNV10_CHIP_MAX_PIB_SPIC; i++) {
+        object_initialize_child(obj, "pib_spic[*]", &chip11->pib_spic[i],
+                                TYPE_PNV_SPI);
+    }
+}
+
+static void pnv_chip_power11_quad_realize(Pnv11Chip *chip11, Error **errp)
+{
+    PnvChip *chip = PNV_CHIP(chip11);
+    int i;
+
+    chip11->nr_quads = DIV_ROUND_UP(chip->nr_cores, 4);
+    chip11->quads = g_new0(PnvQuad, chip11->nr_quads);
+
+    for (i = 0; i < chip11->nr_quads; i++) {
+        PnvQuad *eq = &chip11->quads[i];
+
+        pnv_chip_quad_realize_one(chip, eq, chip->cores[i * 4],
+                                  PNV_QUAD_TYPE_NAME("power11"));
+
+        pnv_xscom_add_subregion(chip, PNV11_XSCOM_EQ_BASE(eq->quad_id),
+                                &eq->xscom_regs);
+
+        pnv_xscom_add_subregion(chip, PNV11_XSCOM_QME_BASE(eq->quad_id),
+                                &eq->xscom_qme_regs);
+    }
+}
+
+static void pnv_chip_power11_realize(DeviceState *dev, Error **errp)
+{
+    PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
+    PnvChip *chip = PNV_CHIP(dev);
+    Pnv11Chip *chip11 = PNV11_CHIP(dev);
+    PowerPCCPU *cpu;
+    PowerPCCPUClass *cpu_class;
+    Error *local_err = NULL;
+    int i;
+
+    /* XSCOM bridge is first */
+    pnv_xscom_init(chip, PNV11_XSCOM_SIZE, PNV11_XSCOM_BASE(chip));
+
+    pcc->parent_realize(dev, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    /* Set handlers for Special registers, such as SPRD */
+    cpu = chip->cores[0]->threads[0];
+    cpu_class = POWERPC_CPU_GET_CLASS(cpu);
+    cpu_class->load_sprd = pnv_handle_sprd_load;
+    cpu_class->store_sprd = pnv_handle_sprd_store;
+
+    /* ADU */
+    object_property_set_link(OBJECT(&chip11->adu), "lpc", OBJECT(&chip11->lpc),
+                             &error_abort);
+    if (!qdev_realize(DEVICE(&chip11->adu), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_ADU_BASE,
+                            &chip11->adu.xscom_regs);
+
+    pnv_chip_power11_quad_realize(chip11, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    /* WIP: XIVE added in future patch */
+
+    /* Processor Service Interface (PSI) Host Bridge */
+    object_property_set_int(OBJECT(&chip11->psi), "bar",
+                            PNV11_PSIHB_BASE(chip), &error_fatal);
+    /* PSI can be configured to use 64k ESB pages on Power11 */
+    object_property_set_int(OBJECT(&chip11->psi), "shift", XIVE_ESB_64K,
+                            &error_fatal);
+    if (!qdev_realize(DEVICE(&chip11->psi), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_PSIHB_BASE,
+                            &PNV_PSI(&chip11->psi)->xscom_regs);
+
+    /* LPC */
+    if (!qdev_realize(DEVICE(&chip11->lpc), NULL, errp)) {
+        return;
+    }
+    memory_region_add_subregion(get_system_memory(), PNV11_LPCM_BASE(chip),
+                                &chip11->lpc.xscom_regs);
+
+    chip->fw_mr = &chip11->lpc.isa_fw;
+    chip->dt_isa_nodename = g_strdup_printf("/lpcm-opb@%" PRIx64 "/lpc@0",
+                                            (uint64_t) PNV11_LPCM_BASE(chip));
+
+    /* HOMER (must be created before OCC) */
+    object_property_set_link(OBJECT(&chip11->homer), "chip", OBJECT(chip),
+                             &error_abort);
+    if (!qdev_realize(DEVICE(&chip11->homer), NULL, errp)) {
+        return;
+    }
+    /* Homer Xscom region */
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_PBA_BASE,
+                            &chip11->homer.pba_regs);
+    /* Homer RAM region */
+    memory_region_add_subregion(get_system_memory(), chip11->homer.base,
+                                &chip11->homer.mem);
+
+    /* Create the simplified OCC model */
+    object_property_set_link(OBJECT(&chip11->occ), "homer",
+                             OBJECT(&chip11->homer), &error_abort);
+    if (!qdev_realize(DEVICE(&chip11->occ), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_OCC_BASE,
+                            &chip11->occ.xscom_regs);
+    qdev_connect_gpio_out(DEVICE(&chip11->occ), 0, qdev_get_gpio_in(
+                              DEVICE(&chip11->psi), PSIHB9_IRQ_OCC));
+
+    /* OCC SRAM model */
+    memory_region_add_subregion(get_system_memory(),
+                                PNV11_OCC_SENSOR_BASE(chip),
+                                &chip11->occ.sram_regs);
+
+    /* SBE */
+    if (!qdev_realize(DEVICE(&chip11->sbe), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_SBE_CTRL_BASE,
+                            &chip11->sbe.xscom_ctrl_regs);
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_SBE_MBOX_BASE,
+                            &chip11->sbe.xscom_mbox_regs);
+    qdev_connect_gpio_out(DEVICE(&chip11->sbe), 0, qdev_get_gpio_in(
+                              DEVICE(&chip11->psi), PSIHB9_IRQ_PSU));
+
+    /* N1 chiplet */
+    if (!qdev_realize(DEVICE(&chip11->n1_chiplet), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_N1_CHIPLET_CTRL_REGS_BASE,
+             &chip11->n1_chiplet.nest_pervasive.xscom_ctrl_regs_mr);
+
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_N1_PB_SCOM_EQ_BASE,
+                           &chip11->n1_chiplet.xscom_pb_eq_mr);
+
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_N1_PB_SCOM_ES_BASE,
+                           &chip11->n1_chiplet.xscom_pb_es_mr);
+
+    /* WIP: PHB added in future patch */
+
+    /*
+     * I2C
+     */
+    for (i = 0; i < pcc->i2c_num_engines; i++) {
+        Object *obj =  OBJECT(&chip11->i2c[i]);
+
+        object_property_set_int(obj, "engine", i + 1, &error_fatal);
+        object_property_set_int(obj, "num-busses",
+                                pcc->i2c_ports_per_engine[i],
+                                &error_fatal);
+        object_property_set_link(obj, "chip", OBJECT(chip), &error_abort);
+        if (!qdev_realize(DEVICE(obj), NULL, errp)) {
+            return;
+        }
+        pnv_xscom_add_subregion(chip, PNV11_XSCOM_I2CM_BASE +
+                                (chip11->i2c[i].engine - 1) *
+                                        PNV11_XSCOM_I2CM_SIZE,
+                                &chip11->i2c[i].xscom_regs);
+        qdev_connect_gpio_out(DEVICE(&chip11->i2c[i]), 0,
+                              qdev_get_gpio_in(DEVICE(&chip11->psi),
+                                               PSIHB9_IRQ_SBE_I2C));
+    }
+    /* PIB SPI Controller */
+    for (i = 0; i < PNV10_CHIP_MAX_PIB_SPIC; i++) {
+        object_property_set_int(OBJECT(&chip11->pib_spic[i]), "spic_num",
+                                i, &error_fatal);
+        /* pib_spic[2] connected to 25csm04 which implements 1 byte transfer */
+        object_property_set_int(OBJECT(&chip11->pib_spic[i]), "transfer_len",
+                                (i == 2) ? 1 : 4, &error_fatal);
+        object_property_set_int(OBJECT(&chip11->pib_spic[i]), "chip-id",
+                                chip->chip_id, &error_fatal);
+        if (!sysbus_realize(SYS_BUS_DEVICE(OBJECT
+                                        (&chip11->pib_spic[i])), errp)) {
+            return;
+        }
+        pnv_xscom_add_subregion(chip, PNV11_XSCOM_PIB_SPIC_BASE +
+                                i * PNV11_XSCOM_PIB_SPIC_SIZE,
+                                &chip11->pib_spic[i].xscom_spic_regs);
+    }
+}
+
 static void pnv_rainier_i2c_init(PnvMachineState *pnv)
 {
     int i;
@@ -2415,6 +2694,34 @@ static void pnv_chip_power10_class_init(ObjectClass *klass, const void *data)
                                     &k->parent_realize);
 }
 
+static uint32_t pnv_chip_power11_xscom_pcba(PnvChip *chip, uint64_t addr)
+{
+    addr &= (PNV11_XSCOM_SIZE - 1);
+    return addr >> 3;
+}
+
+static void pnv_chip_power11_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PnvChipClass *k = PNV_CHIP_CLASS(klass);
+    static const int i2c_ports_per_engine[PNV10_CHIP_MAX_I2C] = {14, 14, 2, 16};
+
+    k->chip_cfam_id = 0x220da04980000000ull; /* P11 DD2.0 (with NX) */
+    k->cores_mask = POWER11_CORE_MASK;
+    k->get_pir_tir = pnv_get_pir_tir_p10;
+    k->isa_create = pnv_chip_power11_isa_create;
+    k->dt_populate = pnv_chip_power11_dt_populate;
+    k->pic_print_info = pnv_chip_power11_pic_print_info;
+    k->xscom_core_base = pnv_chip_power11_xscom_core_base;
+    k->xscom_pcba = pnv_chip_power11_xscom_pcba;
+    dc->desc = "PowerNV Chip Power11";
+    k->i2c_num_engines = PNV10_CHIP_MAX_I2C;
+    k->i2c_ports_per_engine = i2c_ports_per_engine;
+
+    device_class_set_parent_realize(dc, pnv_chip_power11_realize,
+                                    &k->parent_realize);
+}
+
 static void pnv_chip_core_sanitize(PnvMachineState *pnv, PnvChip *chip,
                                    Error **errp)
 {
@@ -3033,6 +3340,13 @@ static void pnv_machine_class_init(ObjectClass *oc, const void *data)
         .parent        = TYPE_PNV10_CHIP,          \
     }
 
+#define DEFINE_PNV11_CHIP_TYPE(type, class_initfn) \
+    {                                              \
+        .name          = type,                     \
+        .class_init    = class_initfn,             \
+        .parent        = TYPE_PNV11_CHIP,          \
+    }
+
 static const TypeInfo types[] = {
     {
         .name          = MACHINE_TYPE_NAME("powernv10-rainier"),
@@ -3088,6 +3402,17 @@ static const TypeInfo types[] = {
         .abstract      = true,
     },
 
+    /*
+     * P11 chip and variants
+     */
+    {
+        .name          = TYPE_PNV11_CHIP,
+        .parent        = TYPE_PNV_CHIP,
+        .instance_init = pnv_chip_power11_instance_init,
+        .instance_size = sizeof(Pnv11Chip),
+    },
+    DEFINE_PNV11_CHIP_TYPE(TYPE_PNV_CHIP_POWER11, pnv_chip_power11_class_init),
+
     /*
      * P10 chip and variants
      */
diff --git a/hw/ppc/pnv_core.c b/hw/ppc/pnv_core.c
index 08c20224b9..fb2dfc7ba2 100644
--- a/hw/ppc/pnv_core.c
+++ b/hw/ppc/pnv_core.c
@@ -473,6 +473,11 @@ static void pnv_core_power10_class_init(ObjectClass *oc, const void *data)
     pcc->xscom_size = PNV10_XSCOM_EC_SIZE;
 }
 
+static void pnv_core_power11_class_init(ObjectClass *oc, const void *data)
+{
+    pnv_core_power10_class_init(oc, data);
+}
+
 static void pnv_core_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -504,6 +509,7 @@ static const TypeInfo pnv_core_infos[] = {
     DEFINE_PNV_CORE_TYPE(power8, "power8nvl_v1.0"),
     DEFINE_PNV_CORE_TYPE(power9, "power9_v2.2"),
     DEFINE_PNV_CORE_TYPE(power10, "power10_v2.0"),
+    DEFINE_PNV_CORE_TYPE(power11, "power11_v2.0"),
 };
 
 DEFINE_TYPES(pnv_core_infos)
@@ -725,6 +731,12 @@ static void pnv_quad_power10_class_init(ObjectClass *oc, const void *data)
     pqc->xscom_qme_size = PNV10_XSCOM_QME_SIZE;
 }
 
+static void pnv_quad_power11_class_init(ObjectClass *oc, const void *data)
+{
+    /* Power11 quad is similar to Power10 quad */
+    pnv_quad_power10_class_init(oc, data);
+}
+
 static void pnv_quad_class_init(ObjectClass *oc, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
@@ -752,6 +764,11 @@ static const TypeInfo pnv_quad_infos[] = {
         .name = PNV_QUAD_TYPE_NAME("power10"),
         .class_init = pnv_quad_power10_class_init,
     },
+    {
+        .parent = TYPE_PNV_QUAD,
+        .name = PNV_QUAD_TYPE_NAME("power11"),
+        .class_init = pnv_quad_power11_class_init,
+    },
 };
 
 DEFINE_TYPES(pnv_quad_infos);
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index d8fca079f2..f0002627bc 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -33,6 +33,7 @@ typedef struct PnvChip PnvChip;
 typedef struct Pnv8Chip Pnv8Chip;
 typedef struct Pnv9Chip Pnv9Chip;
 typedef struct Pnv10Chip Pnv10Chip;
+typedef struct Pnv10Chip Pnv11Chip;
 
 #define PNV_CHIP_TYPE_SUFFIX "-" TYPE_PNV_CHIP
 #define PNV_CHIP_TYPE_NAME(cpu_model) cpu_model PNV_CHIP_TYPE_SUFFIX
@@ -57,6 +58,10 @@ DECLARE_INSTANCE_CHECKER(PnvChip, PNV_CHIP_POWER9,
 DECLARE_INSTANCE_CHECKER(PnvChip, PNV_CHIP_POWER10,
                          TYPE_PNV_CHIP_POWER10)
 
+#define TYPE_PNV_CHIP_POWER11 PNV_CHIP_TYPE_NAME("power11_v2.0")
+DECLARE_INSTANCE_CHECKER(PnvChip, PNV_CHIP_POWER11,
+                         TYPE_PNV_CHIP_POWER11)
+
 PnvCore *pnv_chip_find_core(PnvChip *chip, uint32_t core_id);
 PowerPCCPU *pnv_chip_find_cpu(PnvChip *chip, uint32_t pir);
 
@@ -252,4 +257,19 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor);
 #define PNV10_HOMER_BASE(chip)                                           \
     (0x300ffd800000ll + ((uint64_t)(chip)->chip_id) * PNV_HOMER_SIZE)
 
+/* Power11 */
+#define PNV11_XSCOM_SIZE            PNV10_XSCOM_SIZE
+#define PNV11_XSCOM_BASE(chip)      PNV10_XSCOM_BASE(chip)
+
+#define PNV11_LPCM_SIZE             PNV10_LPCM_SIZE
+#define PNV11_LPCM_BASE(chip)       PNV10_LPCM_BASE(chip)
+
+#define PNV11_PSIHB_ESB_SIZE        PNV10_PSIHB_ESB_SIZE
+#define PNV11_PSIHB_ESB_BASE(chip)  PNV10_PSIHB_ESB_BASE(chip)
+
+#define PNV11_PSIHB_SIZE            PNV10_PSIHB_SIZE
+#define PNV11_PSIHB_BASE(chip)      PNV10_PSIHB_BASE(chip)
+
+#define PNV11_OCC_SENSOR_BASE(chip) PNV10_OCC_SENSOR_BASE(chip)
+
 #endif /* PPC_PNV_H */
diff --git a/include/hw/ppc/pnv_chip.h b/include/hw/ppc/pnv_chip.h
index 24ce37a9c8..6bd930f8b4 100644
--- a/include/hw/ppc/pnv_chip.h
+++ b/include/hw/ppc/pnv_chip.h
@@ -141,6 +141,13 @@ struct Pnv10Chip {
 #define PNV10_PIR2CHIP(pir)      (((pir) >> 8) & 0x7f)
 #define PNV10_PIR2THREAD(pir)    (((pir) & 0x7f))
 
+#define TYPE_PNV11_CHIP "pnv11-chip"
+DECLARE_INSTANCE_CHECKER(Pnv11Chip, PNV11_CHIP,
+                         TYPE_PNV11_CHIP)
+
+/* Power11 core is same as Power10 */
+typedef struct Pnv10Chip Pnv11Chip;
+
 struct PnvChipClass {
     /*< private >*/
     SysBusDeviceClass parent_class;
diff --git a/include/hw/ppc/pnv_xscom.h b/include/hw/ppc/pnv_xscom.h
index b14549db70..610b075a27 100644
--- a/include/hw/ppc/pnv_xscom.h
+++ b/include/hw/ppc/pnv_xscom.h
@@ -207,6 +207,55 @@ struct PnvXScomInterfaceClass {
 #define PNV10_XSCOM_PIB_SPIC_BASE 0xc0000
 #define PNV10_XSCOM_PIB_SPIC_SIZE 0x20
 
+/*
+ * Power11 core is same as Power10
+ */
+#define PNV11_XSCOM_EC_BASE(core)  PNV10_XSCOM_EC_BASE(core)
+
+#define PNV11_XSCOM_ADU_BASE       PNV10_XSCOM_ADU_BASE
+#define PNV11_XSCOM_ADU_SIZE       PNV10_XSCOM_ADU_SIZE
+
+#define PNV11_XSCOM_QME_BASE(core) PNV10_XSCOM_QME_BASE(core)
+
+#define PNV11_XSCOM_EQ_BASE(core)  PNV10_XSCOM_EQ_BASE(core)
+
+#define PNV11_XSCOM_PSIHB_BASE     PNV10_XSCOM_PSIHB_BASE
+#define PNV11_XSCOM_PSIHB_SIZE     PNV10_XSCOM_PSIHB_SIZE
+
+#define PNV11_XSCOM_I2CM_BASE      PNV10_XSCOM_I2CM_BASE
+#define PNV11_XSCOM_I2CM_SIZE      PNV10_XSCOM_I2CM_SIZE
+
+#define PNV11_XSCOM_CHIPTOD_BASE   PNV10_XSCOM_CHIPTOD_BASE
+#define PNV11_XSCOM_CHIPTOD_SIZE   PNV10_XSCOM_CHIPTOD_SIZE
+
+#define PNV11_XSCOM_OCC_BASE       PNV10_XSCOM_OCC_BASE
+#define PNV11_XSCOM_OCC_SIZE       PNV10_XSCOM_OCC_SIZE
+
+#define PNV11_XSCOM_SBE_CTRL_BASE  PNV10_XSCOM_SBE_CTRL_BASE
+#define PNV11_XSCOM_SBE_CTRL_SIZE  PNV10_XSCOM_SBE_CTRL_SIZE
+
+#define PNV11_XSCOM_SBE_MBOX_BASE  PNV10_XSCOM_SBE_MBOX_BASE
+#define PNV11_XSCOM_SBE_MBOX_SIZE  PNV10_XSCOM_SBE_MBOX_SIZE
+
+#define PNV11_XSCOM_PBA_BASE       PNV10_XSCOM_PBA_BASE
+#define PNV11_XSCOM_PBA_SIZE       PNV10_XSCOM_PBA_SIZE
+
+#define PNV11_XSCOM_XIVE2_BASE     PNV10_XSCOM_XIVE2_BASE
+#define PNV11_XSCOM_XIVE2_SIZE     PNV10_XSCOM_XIVE2_SIZE
+
+#define PNV11_XSCOM_N1_CHIPLET_CTRL_REGS_BASE  \
+    PNV10_XSCOM_N1_CHIPLET_CTRL_REGS_BASE
+#define PNV11_XSCOM_CHIPLET_CTRL_REGS_SIZE   PNV10_XSCOM_CHIPLET_CTRL_REGS_SIZE
+
+#define PNV11_XSCOM_N1_PB_SCOM_EQ_BASE  PNV10_XSCOM_N1_PB_SCOM_EQ_BASE
+#define PNV11_XSCOM_N1_PB_SCOM_EQ_SIZE  PNV10_XSCOM_N1_PB_SCOM_EQ_SIZE
+
+#define PNV11_XSCOM_N1_PB_SCOM_ES_BASE  PNV10_XSCOM_N1_PB_SCOM_ES_BASE
+#define PNV11_XSCOM_N1_PB_SCOM_ES_SIZE  PNV10_XSCOM_N1_PB_SCOM_ES_SIZE
+
+#define PNV11_XSCOM_PIB_SPIC_BASE  PNV10_XSCOM_PIB_SPIC_BASE
+#define PNV11_XSCOM_PIB_SPIC_SIZE  PNV10_XSCOM_PIB_SPIC_SIZE
+
 void pnv_xscom_init(PnvChip *chip, uint64_t size, hwaddr addr);
 int pnv_dt_xscom(PnvChip *chip, void *fdt, int root_offset,
                  uint64_t xscom_base, uint64_t xscom_size,

From 73a911e966acd8314e39a4ce4bc58e2254e68324 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:43 +0530
Subject: [PATCH 0724/2396] ppc/pnv: Introduce Power11 PowerNV machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Powernv11 machine doesn't have XIVE & PHBs as of now

XIVE2 interface and PHB5 added in later patches to Powernv11 machine

Also add mention of Power11 to powernv documentation

Note: A difference from P10's and P11's machine_class_init is, in P11
different number of PHBs cannot be used on the command line, ie. the
following line does NOT exist in pnv_machine_power11_class_init, which
existed in case of Power10:

    machine_class_allow_dynamic_sysbus_dev(mc, TYPE_PNV_PHB);

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-3-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-3-adityag@linux.ibm.com>
---
 docs/system/ppc/powernv.rst |  9 +++++----
 hw/ppc/pnv.c                | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 39 insertions(+), 4 deletions(-)

diff --git a/docs/system/ppc/powernv.rst b/docs/system/ppc/powernv.rst
index f3ec2cc69c..5154794cc8 100644
--- a/docs/system/ppc/powernv.rst
+++ b/docs/system/ppc/powernv.rst
@@ -1,5 +1,5 @@
-PowerNV family boards (``powernv8``, ``powernv9``, ``powernv10``)
-==================================================================
+PowerNV family boards (``powernv8``, ``powernv9``, ``powernv10``, ``powernv11``)
+================================================================================
 
 PowerNV (as Non-Virtualized) is the "bare metal" platform using the
 OPAL firmware. It runs Linux on IBM and OpenPOWER systems and it can
@@ -15,11 +15,12 @@ beyond the scope of what QEMU addresses today.
 Supported devices
 -----------------
 
- * Multi processor support for POWER8, POWER8NVL and POWER9.
+ * Multi processor support for POWER8, POWER8NVL, POWER9, Power10 and Power11.
  * XSCOM, serial communication sideband bus to configure chiplets.
  * Simple LPC Controller.
  * Processor Service Interface (PSI) Controller.
- * Interrupt Controller, XICS (POWER8) and XIVE (POWER9) and XIVE2 (Power10).
+ * Interrupt Controller, XICS (POWER8) and XIVE (POWER9) and XIVE2 (Power10 &
+   Power11).
  * POWER8 PHB3 PCIe Host bridge and POWER9 PHB4 PCIe Host bridge.
  * Simple OCC is an on-chip micro-controller used for power management tasks.
  * iBT device to handle BMC communication, with the internal BMC simulator
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 77136091bb..423954ba7e 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -3235,6 +3235,35 @@ static void pnv_machine_p10_rainier_class_init(ObjectClass *oc,
     pmc->i2c_init = pnv_rainier_i2c_init;
 }
 
+static void pnv_machine_power11_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
+    static const char compat[] = "qemu,powernv11\0ibm,powernv";
+
+    pmc->compat = compat;
+    pmc->compat_size = sizeof(compat);
+    pmc->max_smt_threads = 4;
+    pmc->has_lpar_per_thread = true;
+    pmc->quirk_tb_big_core = true;
+    pmc->dt_power_mgt = pnv_dt_power_mgt;
+
+    mc->desc = "IBM PowerNV (Non-Virtualized) Power11";
+    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power11_v2.0");
+
+    object_class_property_add_bool(oc, "big-core",
+                                   pnv_machine_get_big_core,
+                                   pnv_machine_set_big_core);
+    object_class_property_set_description(oc, "big-core",
+                              "Use big-core (aka fused-core) mode");
+
+    object_class_property_add_bool(oc, "lpar-per-core",
+                                   pnv_machine_get_lpar_per_core,
+                                   pnv_machine_set_lpar_per_core);
+    object_class_property_set_description(oc, "lpar-per-core",
+                              "Use 1 LPAR per core mode");
+}
+
 static void pnv_cpu_do_nmi_on_cpu(CPUState *cs, run_on_cpu_data arg)
 {
     CPUPPCState *env = cpu_env(cs);
@@ -3348,6 +3377,11 @@ static void pnv_machine_class_init(ObjectClass *oc, const void *data)
     }
 
 static const TypeInfo types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("powernv11"),
+        .parent        = TYPE_PNV_MACHINE,
+        .class_init    = pnv_machine_power11_class_init,
+    },
     {
         .name          = MACHINE_TYPE_NAME("powernv10-rainier"),
         .parent        = MACHINE_TYPE_NAME("powernv10"),

From 849a6bb854b48d757fab5e408f6a17dff568ec13 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:44 +0530
Subject: [PATCH 0725/2396] ppc/pnv: Add PnvChipClass handler to get reference
 to interrupt controller
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Existing code in XIVE2 assumes the chip to be a Power10 Chip.
Instead add a handler to get reference to the interrupt controller (XIVE)
for a given Power Chip.

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-4-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-4-adityag@linux.ibm.com>
---
 hw/intc/pnv_xive2.c       |  4 ++--
 hw/ppc/pnv.c              | 12 ++++++++++++
 include/hw/ppc/pnv_chip.h |  1 +
 3 files changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/intc/pnv_xive2.c b/hw/intc/pnv_xive2.c
index e019cad5c1..0663baab54 100644
--- a/hw/intc/pnv_xive2.c
+++ b/hw/intc/pnv_xive2.c
@@ -110,8 +110,8 @@ static PnvXive2 *pnv_xive2_get_remote(uint32_t vsd_type, hwaddr fwd_addr)
     int i;
 
     for (i = 0; i < pnv->num_chips; i++) {
-        Pnv10Chip *chip10 = PNV10_CHIP(pnv->chips[i]);
-        PnvXive2 *xive = &chip10->xive;
+        PnvChipClass *k = PNV_CHIP_GET_CLASS(pnv->chips[i]);
+        PnvXive2 *xive = PNV_XIVE2(k->intc_get(pnv->chips[i]));
 
         /*
          * Is this the XIVE matching the forwarded VSD address is for this
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 423954ba7e..a4fdf59207 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1486,6 +1486,16 @@ static void pnv_chip_power10_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
     xive_tctx_pic_print_info(XIVE_TCTX(pnv_cpu_state(cpu)->intc), buf);
 }
 
+static void *pnv_chip_power10_intc_get(PnvChip *chip)
+{
+    return &PNV10_CHIP(chip)->xive;
+}
+
+static void *pnv_chip_power11_intc_get(PnvChip *chip)
+{
+    return &PNV11_CHIP(chip)->xive;
+}
+
 /*
  * Allowed core identifiers on a POWER8 Processor Chip :
  *
@@ -2680,6 +2690,7 @@ static void pnv_chip_power10_class_init(ObjectClass *klass, const void *data)
     k->intc_reset = pnv_chip_power10_intc_reset;
     k->intc_destroy = pnv_chip_power10_intc_destroy;
     k->intc_print_info = pnv_chip_power10_intc_print_info;
+    k->intc_get = pnv_chip_power10_intc_get;
     k->isa_create = pnv_chip_power10_isa_create;
     k->dt_populate = pnv_chip_power10_dt_populate;
     k->pic_print_info = pnv_chip_power10_pic_print_info;
@@ -2709,6 +2720,7 @@ static void pnv_chip_power11_class_init(ObjectClass *klass, const void *data)
     k->chip_cfam_id = 0x220da04980000000ull; /* P11 DD2.0 (with NX) */
     k->cores_mask = POWER11_CORE_MASK;
     k->get_pir_tir = pnv_get_pir_tir_p10;
+    k->intc_get = pnv_chip_power11_intc_get;
     k->isa_create = pnv_chip_power11_isa_create;
     k->dt_populate = pnv_chip_power11_dt_populate;
     k->pic_print_info = pnv_chip_power11_pic_print_info;
diff --git a/include/hw/ppc/pnv_chip.h b/include/hw/ppc/pnv_chip.h
index 6bd930f8b4..a5b8c49680 100644
--- a/include/hw/ppc/pnv_chip.h
+++ b/include/hw/ppc/pnv_chip.h
@@ -170,6 +170,7 @@ struct PnvChipClass {
     void (*intc_reset)(PnvChip *chip, PowerPCCPU *cpu);
     void (*intc_destroy)(PnvChip *chip, PowerPCCPU *cpu);
     void (*intc_print_info)(PnvChip *chip, PowerPCCPU *cpu, GString *buf);
+    void* (*intc_get)(PnvChip *chip);
     ISABus *(*isa_create)(PnvChip *chip, Error **errp);
     void (*dt_populate)(PnvChip *chip, void *fdt);
     void (*pic_print_info)(PnvChip *chip, GString *buf);

From 0dcbc88865432504dc452d9ded8218dff3bdf0d2 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:45 +0530
Subject: [PATCH 0726/2396] ppc/pnv: Add XIVE2 controller to Power11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a XIVE2 controller to Power11 chip and machine.
The controller has the same logic as Power10.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-5-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-5-adityag@linux.ibm.com>
---
 hw/ppc/pnv.c         | 121 ++++++++++++++++++++++++++++++++++++++++++-
 include/hw/ppc/pnv.h |  18 +++++++
 2 files changed, 138 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index a4fdf59207..8097d3c09a 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -976,6 +976,7 @@ static void pnv_chip_power11_pic_print_info(PnvChip *chip, GString *buf)
 {
     Pnv11Chip *chip11 = PNV11_CHIP(chip);
 
+    pnv_xive2_pic_print_info(&chip11->xive, buf);
     pnv_psi_pic_print_info(&chip11->psi, buf);
 }
 
@@ -1491,6 +1492,50 @@ static void *pnv_chip_power10_intc_get(PnvChip *chip)
     return &PNV10_CHIP(chip)->xive;
 }
 
+static void pnv_chip_power11_intc_create(PnvChip *chip, PowerPCCPU *cpu,
+                                        Error **errp)
+{
+    Pnv11Chip *chip11 = PNV11_CHIP(chip);
+    Error *local_err = NULL;
+    Object *obj;
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    /*
+     * The core creates its interrupt presenter but the XIVE2 interrupt
+     * controller object is initialized afterwards. Hopefully, it's
+     * only used at runtime.
+     */
+    obj = xive_tctx_create(OBJECT(cpu), XIVE_PRESENTER(&chip11->xive),
+                           &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
+    pnv_cpu->intc = obj;
+}
+
+static void pnv_chip_power11_intc_reset(PnvChip *chip, PowerPCCPU *cpu)
+{
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    xive_tctx_reset(XIVE_TCTX(pnv_cpu->intc));
+}
+
+static void pnv_chip_power11_intc_destroy(PnvChip *chip, PowerPCCPU *cpu)
+{
+    PnvCPUState *pnv_cpu = pnv_cpu_state(cpu);
+
+    xive_tctx_destroy(XIVE_TCTX(pnv_cpu->intc));
+    pnv_cpu->intc = NULL;
+}
+
+static void pnv_chip_power11_intc_print_info(PnvChip *chip, PowerPCCPU *cpu,
+                                             GString *buf)
+{
+    xive_tctx_pic_print_info(XIVE_TCTX(pnv_cpu_state(cpu)->intc), buf);
+}
+
 static void *pnv_chip_power11_intc_get(PnvChip *chip)
 {
     return &PNV11_CHIP(chip)->xive;
@@ -2443,6 +2488,10 @@ static void pnv_chip_power11_instance_init(Object *obj)
     object_initialize_child(obj, "occ",  &chip11->occ, TYPE_PNV10_OCC);
     object_initialize_child(obj, "sbe",  &chip11->sbe, TYPE_PNV10_SBE);
     object_initialize_child(obj, "homer", &chip11->homer, TYPE_PNV10_HOMER);
+
+    object_initialize_child(obj, "xive", &chip11->xive, TYPE_PNV_XIVE2);
+    object_property_add_alias(obj, "xive-fabric", OBJECT(&chip11->xive),
+                              "xive-fabric");
     object_initialize_child(obj, "n1-chiplet", &chip11->n1_chiplet,
                             TYPE_PNV_N1_CHIPLET);
 
@@ -2518,7 +2567,26 @@ static void pnv_chip_power11_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    /* WIP: XIVE added in future patch */
+    /* XIVE2 interrupt controller */
+    object_property_set_int(OBJECT(&chip11->xive), "ic-bar",
+                            PNV11_XIVE2_IC_BASE(chip), &error_fatal);
+    object_property_set_int(OBJECT(&chip11->xive), "esb-bar",
+                            PNV11_XIVE2_ESB_BASE(chip), &error_fatal);
+    object_property_set_int(OBJECT(&chip11->xive), "end-bar",
+                            PNV11_XIVE2_END_BASE(chip), &error_fatal);
+    object_property_set_int(OBJECT(&chip11->xive), "nvpg-bar",
+                            PNV11_XIVE2_NVPG_BASE(chip), &error_fatal);
+    object_property_set_int(OBJECT(&chip11->xive), "nvc-bar",
+                            PNV11_XIVE2_NVC_BASE(chip), &error_fatal);
+    object_property_set_int(OBJECT(&chip11->xive), "tm-bar",
+                            PNV11_XIVE2_TM_BASE(chip), &error_fatal);
+    object_property_set_link(OBJECT(&chip11->xive), "chip", OBJECT(chip),
+                             &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&chip11->xive), errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_XIVE2_BASE,
+                            &chip11->xive.xscom_regs);
 
     /* Processor Service Interface (PSI) Host Bridge */
     object_property_set_int(OBJECT(&chip11->psi), "bar",
@@ -2720,6 +2788,10 @@ static void pnv_chip_power11_class_init(ObjectClass *klass, const void *data)
     k->chip_cfam_id = 0x220da04980000000ull; /* P11 DD2.0 (with NX) */
     k->cores_mask = POWER11_CORE_MASK;
     k->get_pir_tir = pnv_get_pir_tir_p10;
+    k->intc_create = pnv_chip_power11_intc_create;
+    k->intc_reset = pnv_chip_power11_intc_reset;
+    k->intc_destroy = pnv_chip_power11_intc_destroy;
+    k->intc_print_info = pnv_chip_power11_intc_print_info;
     k->intc_get = pnv_chip_power11_intc_get;
     k->isa_create = pnv_chip_power11_isa_create;
     k->dt_populate = pnv_chip_power11_dt_populate;
@@ -3073,6 +3145,45 @@ static int pnv10_xive_broadcast(XiveFabric *xfb,
     return 0;
 }
 
+static bool pnv11_xive_match_nvt(XiveFabric *xfb, uint8_t format,
+                                 uint8_t nvt_blk, uint32_t nvt_idx,
+                                 bool crowd, bool cam_ignore, uint8_t priority,
+                                 uint32_t logic_serv,
+                                 XiveTCTXMatch *match)
+{
+    PnvMachineState *pnv = PNV_MACHINE(xfb);
+    int i;
+
+    for (i = 0; i < pnv->num_chips; i++) {
+        Pnv11Chip *chip11 = PNV11_CHIP(pnv->chips[i]);
+        XivePresenter *xptr = XIVE_PRESENTER(&chip11->xive);
+        XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
+
+        xpc->match_nvt(xptr, format, nvt_blk, nvt_idx, crowd,
+                       cam_ignore, priority, logic_serv, match);
+    }
+
+    return !!match->count;
+}
+
+static int pnv11_xive_broadcast(XiveFabric *xfb,
+                                uint8_t nvt_blk, uint32_t nvt_idx,
+                                bool crowd, bool cam_ignore,
+                                uint8_t priority)
+{
+    PnvMachineState *pnv = PNV_MACHINE(xfb);
+    int i;
+
+    for (i = 0; i < pnv->num_chips; i++) {
+        Pnv11Chip *chip11 = PNV11_CHIP(pnv->chips[i]);
+        XivePresenter *xptr = XIVE_PRESENTER(&chip11->xive);
+        XivePresenterClass *xpc = XIVE_PRESENTER_GET_CLASS(xptr);
+
+        xpc->broadcast(xptr, nvt_blk, nvt_idx, crowd, cam_ignore, priority);
+    }
+    return 0;
+}
+
 static bool pnv_machine_get_big_core(Object *obj, Error **errp)
 {
     PnvMachineState *pnv = PNV_MACHINE(obj);
@@ -3251,6 +3362,7 @@ static void pnv_machine_power11_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     PnvMachineClass *pmc = PNV_MACHINE_CLASS(oc);
+    XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
     static const char compat[] = "qemu,powernv11\0ibm,powernv";
 
     pmc->compat = compat;
@@ -3260,6 +3372,9 @@ static void pnv_machine_power11_class_init(ObjectClass *oc, const void *data)
     pmc->quirk_tb_big_core = true;
     pmc->dt_power_mgt = pnv_dt_power_mgt;
 
+    xfc->match_nvt = pnv11_xive_match_nvt;
+    xfc->broadcast = pnv11_xive_broadcast;
+
     mc->desc = "IBM PowerNV (Non-Virtualized) Power11";
     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power11_v2.0");
 
@@ -3393,6 +3508,10 @@ static const TypeInfo types[] = {
         .name          = MACHINE_TYPE_NAME("powernv11"),
         .parent        = TYPE_PNV_MACHINE,
         .class_init    = pnv_machine_power11_class_init,
+        .interfaces = (InterfaceInfo[]) {
+            { TYPE_XIVE_FABRIC },
+            { },
+        },
     },
     {
         .name          = MACHINE_TYPE_NAME("powernv10-rainier"),
diff --git a/include/hw/ppc/pnv.h b/include/hw/ppc/pnv.h
index f0002627bc..cbdddfc73c 100644
--- a/include/hw/ppc/pnv.h
+++ b/include/hw/ppc/pnv.h
@@ -270,6 +270,24 @@ void pnv_bmc_set_pnor(IPMIBmc *bmc, PnvPnor *pnor);
 #define PNV11_PSIHB_SIZE            PNV10_PSIHB_SIZE
 #define PNV11_PSIHB_BASE(chip)      PNV10_PSIHB_BASE(chip)
 
+#define PNV11_XIVE2_IC_SIZE         PNV10_XIVE2_IC_SIZE
+#define PNV11_XIVE2_IC_BASE(chip)   PNV10_XIVE2_IC_BASE(chip)
+
+#define PNV11_XIVE2_TM_SIZE         PNV10_XIVE2_TM_SIZE
+#define PNV11_XIVE2_TM_BASE(chip)   PNV10_XIVE2_TM_BASE(chip)
+
+#define PNV11_XIVE2_NVC_SIZE        PNV10_XIVE2_NVC_SIZE
+#define PNV11_XIVE2_NVC_BASE(chip)  PNV10_XIVE2_NVC_BASE(chip)
+
+#define PNV11_XIVE2_NVPG_SIZE       PNV10_XIVE2_NVPG_SIZE
+#define PNV11_XIVE2_NVPG_BASE(chip) PNV10_XIVE2_NVPG_BASE(chip)
+
+#define PNV11_XIVE2_ESB_SIZE        PNV10_XIVE2_ESB_SIZE
+#define PNV11_XIVE2_ESB_BASE(chip)  PNV10_XIVE2_ESB_BASE(chip)
+
+#define PNV11_XIVE2_END_SIZE        PNV10_XIVE2_END_SIZE
+#define PNV11_XIVE2_END_BASE(chip)  PNV10_XIVE2_END_BASE(chip)
+
 #define PNV11_OCC_SENSOR_BASE(chip) PNV10_OCC_SENSOR_BASE(chip)
 
 #endif /* PPC_PNV_H */

From 91a1cc6a2ce72aefbc9084ce245b562c1d21e082 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:46 +0530
Subject: [PATCH 0727/2396] ppc/pnv: Add PHB5 PCIe Host bridge to Power11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Power11 also uses PHB5, same as Power10.

Add Power11 PHBs with similar code as the corresponding Power10 implementation.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-6-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-6-adityag@linux.ibm.com>
---
 hw/ppc/pnv.c | 57 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 56 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 8097d3c09a..2b4df6076c 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -978,6 +978,8 @@ static void pnv_chip_power11_pic_print_info(PnvChip *chip, GString *buf)
 
     pnv_xive2_pic_print_info(&chip11->xive, buf);
     pnv_psi_pic_print_info(&chip11->psi, buf);
+    object_child_foreach_recursive(OBJECT(chip),
+                         pnv_chip_power9_pic_print_info_child, buf);
 }
 
 /* Always give the first 1GB to chip 0 else we won't boot */
@@ -2473,6 +2475,7 @@ static void pnv_chip_power10_realize(DeviceState *dev, Error **errp)
 
 static void pnv_chip_power11_instance_init(Object *obj)
 {
+    PnvChip *chip = PNV_CHIP(obj);
     Pnv11Chip *chip11 = PNV11_CHIP(obj);
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(obj);
     int i;
@@ -2495,6 +2498,13 @@ static void pnv_chip_power11_instance_init(Object *obj)
     object_initialize_child(obj, "n1-chiplet", &chip11->n1_chiplet,
                             TYPE_PNV_N1_CHIPLET);
 
+    chip->num_pecs = pcc->num_pecs;
+
+    for (i = 0; i < chip->num_pecs; i++) {
+        object_initialize_child(obj, "pec[*]", &chip11->pecs[i],
+                                TYPE_PNV_PHB5_PEC);
+    }
+
     for (i = 0; i < pcc->i2c_num_engines; i++) {
         object_initialize_child(obj, "i2c[*]", &chip11->i2c[i], TYPE_PNV_I2C);
     }
@@ -2527,6 +2537,38 @@ static void pnv_chip_power11_quad_realize(Pnv11Chip *chip11, Error **errp)
     }
 }
 
+static void pnv_chip_power11_phb_realize(PnvChip *chip, Error **errp)
+{
+    Pnv11Chip *chip11 = PNV11_CHIP(chip);
+    int i;
+
+    for (i = 0; i < chip->num_pecs; i++) {
+        PnvPhb4PecState *pec = &chip11->pecs[i];
+        PnvPhb4PecClass *pecc = PNV_PHB4_PEC_GET_CLASS(pec);
+        uint32_t pec_cplt_base;
+        uint32_t pec_nest_base;
+        uint32_t pec_pci_base;
+
+        object_property_set_int(OBJECT(pec), "index", i, &error_fatal);
+        object_property_set_int(OBJECT(pec), "chip-id", chip->chip_id,
+                                &error_fatal);
+        object_property_set_link(OBJECT(pec), "chip", OBJECT(chip),
+                                 &error_fatal);
+        if (!qdev_realize(DEVICE(pec), NULL, errp)) {
+            return;
+        }
+
+        pec_cplt_base = pecc->xscom_cplt_base(pec);
+        pec_nest_base = pecc->xscom_nest_base(pec);
+        pec_pci_base = pecc->xscom_pci_base(pec);
+
+        pnv_xscom_add_subregion(chip, pec_cplt_base,
+                 &pec->nest_pervasive.xscom_ctrl_regs_mr);
+        pnv_xscom_add_subregion(chip, pec_nest_base, &pec->nest_regs_mr);
+        pnv_xscom_add_subregion(chip, pec_pci_base, &pec->pci_regs_mr);
+    }
+}
+
 static void pnv_chip_power11_realize(DeviceState *dev, Error **errp)
 {
     PnvChipClass *pcc = PNV_CHIP_GET_CLASS(dev);
@@ -2664,7 +2706,12 @@ static void pnv_chip_power11_realize(DeviceState *dev, Error **errp)
     pnv_xscom_add_subregion(chip, PNV11_XSCOM_N1_PB_SCOM_ES_BASE,
                            &chip11->n1_chiplet.xscom_pb_es_mr);
 
-    /* WIP: PHB added in future patch */
+    /* PHBs */
+    pnv_chip_power11_phb_realize(chip, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
 
     /*
      * I2C
@@ -2799,6 +2846,7 @@ static void pnv_chip_power11_class_init(ObjectClass *klass, const void *data)
     k->xscom_core_base = pnv_chip_power11_xscom_core_base;
     k->xscom_pcba = pnv_chip_power11_xscom_pcba;
     dc->desc = "PowerNV Chip Power11";
+    k->num_pecs = PNV10_CHIP_MAX_PEC;
     k->i2c_num_engines = PNV10_CHIP_MAX_I2C;
     k->i2c_ports_per_engine = i2c_ports_per_engine;
 
@@ -3365,6 +3413,13 @@ static void pnv_machine_power11_class_init(ObjectClass *oc, const void *data)
     XiveFabricClass *xfc = XIVE_FABRIC_CLASS(oc);
     static const char compat[] = "qemu,powernv11\0ibm,powernv";
 
+    static GlobalProperty phb_compat[] = {
+        { TYPE_PNV_PHB, "version", "5" },
+        { TYPE_PNV_PHB_ROOT_PORT, "version", "5" },
+    };
+
+    compat_props_add(mc->compat_props, phb_compat, G_N_ELEMENTS(phb_compat));
+
     pmc->compat = compat;
     pmc->compat_size = sizeof(compat);
     pmc->max_smt_threads = 4;

From 46835d806aaacc6c89d7eaf961e21e550d0222f5 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:47 +0530
Subject: [PATCH 0728/2396] ppc/pnv: Add ChipTOD model for Power11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce Power11 ChipTod. The code has been copied from Power10 ChipTod
code as the Power11 core is same as Power10 core.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-7-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-7-adityag@linux.ibm.com>
---
 hw/ppc/pnv.c                 | 15 +++++++++
 hw/ppc/pnv_chiptod.c         | 59 ++++++++++++++++++++++++++++++++++++
 include/hw/ppc/pnv_chiptod.h |  2 ++
 3 files changed, 76 insertions(+)

diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 2b4df6076c..f0469cdb8b 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -2495,6 +2495,8 @@ static void pnv_chip_power11_instance_init(Object *obj)
     object_initialize_child(obj, "xive", &chip11->xive, TYPE_PNV_XIVE2);
     object_property_add_alias(obj, "xive-fabric", OBJECT(&chip11->xive),
                               "xive-fabric");
+    object_initialize_child(obj, "chiptod", &chip11->chiptod,
+                            TYPE_PNV11_CHIPTOD);
     object_initialize_child(obj, "n1-chiplet", &chip11->n1_chiplet,
                             TYPE_PNV_N1_CHIPLET);
 
@@ -2653,6 +2655,19 @@ static void pnv_chip_power11_realize(DeviceState *dev, Error **errp)
     chip->dt_isa_nodename = g_strdup_printf("/lpcm-opb@%" PRIx64 "/lpc@0",
                                             (uint64_t) PNV11_LPCM_BASE(chip));
 
+    /* ChipTOD */
+    object_property_set_bool(OBJECT(&chip11->chiptod), "primary",
+                             chip->chip_id == 0, &error_abort);
+    object_property_set_bool(OBJECT(&chip11->chiptod), "secondary",
+                             chip->chip_id == 1, &error_abort);
+    object_property_set_link(OBJECT(&chip11->chiptod), "chip", OBJECT(chip),
+                             &error_abort);
+    if (!qdev_realize(DEVICE(&chip11->chiptod), NULL, errp)) {
+        return;
+    }
+    pnv_xscom_add_subregion(chip, PNV11_XSCOM_CHIPTOD_BASE,
+                            &chip11->chiptod.xscom_regs);
+
     /* HOMER (must be created before OCC) */
     object_property_set_link(OBJECT(&chip11->homer), "chip", OBJECT(chip),
                              &error_abort);
diff --git a/hw/ppc/pnv_chiptod.c b/hw/ppc/pnv_chiptod.c
index b9e9c7ba3d..f887a18cde 100644
--- a/hw/ppc/pnv_chiptod.c
+++ b/hw/ppc/pnv_chiptod.c
@@ -210,6 +210,22 @@ static void chiptod_power10_broadcast_ttype(PnvChipTOD *sender,
     }
 }
 
+static void chiptod_power11_broadcast_ttype(PnvChipTOD *sender,
+                                            uint32_t trigger)
+{
+    PnvMachineState *pnv = PNV_MACHINE(qdev_get_machine());
+    int i;
+
+    for (i = 0; i < pnv->num_chips; i++) {
+        Pnv11Chip *chip11 = PNV11_CHIP(pnv->chips[i]);
+        PnvChipTOD *chiptod = &chip11->chiptod;
+
+        if (chiptod != sender) {
+            chiptod_receive_ttype(chiptod, trigger);
+        }
+    }
+}
+
 static PnvCore *pnv_chip_get_core_by_xscom_base(PnvChip *chip,
                                                 uint32_t xscom_base)
 {
@@ -283,6 +299,12 @@ static PnvCore *chiptod_power10_tx_ttype_target(PnvChipTOD *chiptod,
     }
 }
 
+static PnvCore *chiptod_power11_tx_ttype_target(PnvChipTOD *chiptod,
+                                               uint64_t val)
+{
+    return chiptod_power10_tx_ttype_target(chiptod, val);
+}
+
 static void pnv_chiptod_xscom_write(void *opaque, hwaddr addr,
                                     uint64_t val, unsigned size)
 {
@@ -520,6 +542,42 @@ static const TypeInfo pnv_chiptod_power10_type_info = {
     }
 };
 
+static int pnv_chiptod_power11_dt_xscom(PnvXScomInterface *dev, void *fdt,
+                             int xscom_offset)
+{
+    const char compat[] = "ibm,power-chiptod\0ibm,power11-chiptod";
+
+    return pnv_chiptod_dt_xscom(dev, fdt, xscom_offset, compat, sizeof(compat));
+}
+
+static void pnv_chiptod_power11_class_init(ObjectClass *klass, const void *data)
+{
+    PnvChipTODClass *pctc = PNV_CHIPTOD_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PnvXScomInterfaceClass *xdc = PNV_XSCOM_INTERFACE_CLASS(klass);
+
+    dc->desc = "PowerNV ChipTOD Controller (Power11)";
+    device_class_set_props(dc, pnv_chiptod_properties);
+
+    xdc->dt_xscom = pnv_chiptod_power11_dt_xscom;
+
+    pctc->broadcast_ttype = chiptod_power11_broadcast_ttype;
+    pctc->tx_ttype_target = chiptod_power11_tx_ttype_target;
+
+    pctc->xscom_size = PNV_XSCOM_CHIPTOD_SIZE;
+}
+
+static const TypeInfo pnv_chiptod_power11_type_info = {
+    .name          = TYPE_PNV11_CHIPTOD,
+    .parent        = TYPE_PNV_CHIPTOD,
+    .instance_size = sizeof(PnvChipTOD),
+    .class_init    = pnv_chiptod_power11_class_init,
+    .interfaces    = (const InterfaceInfo[]) {
+        { TYPE_PNV_XSCOM_INTERFACE },
+        { }
+    }
+};
+
 static void pnv_chiptod_reset(void *dev)
 {
     PnvChipTOD *chiptod = PNV_CHIPTOD(dev);
@@ -579,6 +637,7 @@ static void pnv_chiptod_register_types(void)
     type_register_static(&pnv_chiptod_type_info);
     type_register_static(&pnv_chiptod_power9_type_info);
     type_register_static(&pnv_chiptod_power10_type_info);
+    type_register_static(&pnv_chiptod_power11_type_info);
 }
 
 type_init(pnv_chiptod_register_types);
diff --git a/include/hw/ppc/pnv_chiptod.h b/include/hw/ppc/pnv_chiptod.h
index fde569bcbf..466b06560a 100644
--- a/include/hw/ppc/pnv_chiptod.h
+++ b/include/hw/ppc/pnv_chiptod.h
@@ -17,6 +17,8 @@ OBJECT_DECLARE_TYPE(PnvChipTOD, PnvChipTODClass, PNV_CHIPTOD)
 DECLARE_INSTANCE_CHECKER(PnvChipTOD, PNV9_CHIPTOD, TYPE_PNV9_CHIPTOD)
 #define TYPE_PNV10_CHIPTOD TYPE_PNV_CHIPTOD "-POWER10"
 DECLARE_INSTANCE_CHECKER(PnvChipTOD, PNV10_CHIPTOD, TYPE_PNV10_CHIPTOD)
+#define TYPE_PNV11_CHIPTOD TYPE_PNV_CHIPTOD "-POWER11"
+DECLARE_INSTANCE_CHECKER(PnvChipTOD, PNV11_CHIPTOD, TYPE_PNV11_CHIPTOD)
 
 enum tod_state {
     tod_error = 0,

From 968f1af16aa8da8927eb167e57b224dc58f67637 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:48 +0530
Subject: [PATCH 0729/2396] tests/powernv: Switch to buildroot images instead
 of op-build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As op-build images haven't been updated from long time (and may not get
updated in future), use buildroot images provided by cedric [1].

Use existing nvme device being used in the test to mount the initrd.

Also replace the check for "zImage loaded message" to skiboot's message
when it starts the kernel: "Starting kernel at", since we are no longer
using zImage from op-build

This is required for newer processor tests such as Power11, as the
op-build kernel image is old and doesn't support Power11.

Power11 test has been added in a later patch.

[1]: https://github.com/legoater/qemu-ppc-boot/tree/main/buildroot/qemu_ppc64le_powernv8-2025.02

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-8-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-8-adityag@linux.ibm.com>
---
 tests/functional/ppc64/test_powernv.py | 30 ++++++++++++++------------
 1 file changed, 16 insertions(+), 14 deletions(-)

diff --git a/tests/functional/ppc64/test_powernv.py b/tests/functional/ppc64/test_powernv.py
index 685e2178ed..2b4db1cf99 100755
--- a/tests/functional/ppc64/test_powernv.py
+++ b/tests/functional/ppc64/test_powernv.py
@@ -18,9 +18,14 @@ class powernvMachine(LinuxKernelTest):
     good_message = 'VFS: Cannot open root device'
 
     ASSET_KERNEL = Asset(
-        ('https://archives.fedoraproject.org/pub/archive/fedora-secondary/'
-         'releases/29/Everything/ppc64le/os/ppc/ppc64/vmlinuz'),
-        '383c2f5c23bc0d9d32680c3924d3fd7ee25cc5ef97091ac1aa5e1d853422fc5f')
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/'
+         'buildroot/qemu_ppc64le_powernv8-2025.02/vmlinux'),
+        '6fd29aff9ad4362511ea5d0acbb510667c7031928e97d64ec15bbc5daf4b8151')
+
+    ASSET_INITRD = Asset(
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/'
+         'buildroot/qemu_ppc64le_powernv8-2025.02/rootfs.ext2'),
+        'aee2192b692077c4bde31cb56ce474424b358f17cec323d5c94af3970c9aada2')
 
     def do_test_linux_boot(self, command_line = KERNEL_COMMON_COMMAND_LINE):
         self.require_accelerator("tcg")
@@ -78,27 +83,24 @@ class powernvMachine(LinuxKernelTest):
         wait_for_console_pattern(self, console_pattern, self.panic_message)
         wait_for_console_pattern(self, self.good_message, self.panic_message)
 
-
-    ASSET_EPAPR_KERNEL = Asset(
-        ('https://github.com/open-power/op-build/releases/download/v2.7/'
-         'zImage.epapr'),
-        '0ab237df661727e5392cee97460e8674057a883c5f74381a128fa772588d45cd')
-
     def do_test_ppc64_powernv(self, proc):
         self.require_accelerator("tcg")
-        kernel_path = self.ASSET_EPAPR_KERNEL.fetch()
+        kernel_path = self.ASSET_KERNEL.fetch()
+        initrd_path = self.ASSET_INITRD.fetch()
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_path,
-                         '-append', 'console=tty0 console=hvc0',
+                         '-drive',
+                         f'file={initrd_path},format=raw,if=none,id=drive0,readonly=on',
+                         '-append', 'root=/dev/nvme0n1 console=tty0 console=hvc0',
                          '-device', 'pcie-pci-bridge,id=bridge1,bus=pcie.1,addr=0x0',
-                         '-device', 'nvme,bus=pcie.2,addr=0x0,serial=1234',
+                         '-device', 'nvme,drive=drive0,bus=pcie.2,addr=0x0,serial=1234',
                          '-device', 'e1000e,bus=bridge1,addr=0x3',
                          '-device', 'nec-usb-xhci,bus=bridge1,addr=0x2')
         self.vm.launch()
 
         self.wait_for_console_pattern("CPU: " + proc + " generation processor")
-        self.wait_for_console_pattern("zImage starting: loaded")
-        self.wait_for_console_pattern("Run /init as init process")
+        self.wait_for_console_pattern("INIT: Starting kernel at ")
+        self.wait_for_console_pattern("Run /sbin/init as init process")
         # Device detection output driven by udev probing is sometimes cut off
         # from console output, suspect S14silence-console init script.
 

From 5f810b912eea7d91c55927a1bde94f61d7c9e8a0 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Thu, 25 Sep 2025 23:00:49 +0530
Subject: [PATCH 0730/2396] tests/powernv: Add PowerNV test for Power11
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With all Power11 support in place, add Power11 PowerNV test.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925173049.891406-9-adityag@linux.ibm.com
Message-ID: <20250925173049.891406-9-adityag@linux.ibm.com>
---
 tests/functional/ppc64/test_powernv.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/ppc64/test_powernv.py b/tests/functional/ppc64/test_powernv.py
index 2b4db1cf99..9ada832b78 100755
--- a/tests/functional/ppc64/test_powernv.py
+++ b/tests/functional/ppc64/test_powernv.py
@@ -116,5 +116,9 @@ class powernvMachine(LinuxKernelTest):
         self.set_machine('powernv10')
         self.do_test_ppc64_powernv('P10')
 
+    def test_powernv11(self):
+        self.set_machine('powernv11')
+        self.do_test_ppc64_powernv('Power11')
+
 if __name__ == '__main__':
     LinuxKernelTest.main()

From 556d19fdcb1a07afc05bde7b38cfd2a1f4a89552 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:39 -0500
Subject: [PATCH 0731/2396] target/ppc: IBM PPE42 general regs and flags

Introduces general IBM PPE42 processor register definitions
and flags.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-2-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-2-milesg@linux.ibm.com>
---
 target/ppc/cpu-models.h |  4 ++++
 target/ppc/cpu.h        | 49 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 52 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu-models.h b/target/ppc/cpu-models.h
index 72ad31ba50..c6cd27f390 100644
--- a/target/ppc/cpu-models.h
+++ b/target/ppc/cpu-models.h
@@ -69,6 +69,10 @@ enum {
     /* Xilinx cores */
     CPU_POWERPC_X2VP4              = 0x20010820,
     CPU_POWERPC_X2VP20             = 0x20010860,
+    /* IBM PPE42 Family */
+    CPU_POWERPC_PPE42              = 0x42000000,
+    CPU_POWERPC_PPE42X             = 0x42100000,
+    CPU_POWERPC_PPE42XM            = 0x42200000,
     /* PowerPC 440 family */
     /* Generic PowerPC 440 */
 #define CPU_POWERPC_440              CPU_POWERPC_440GXf
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 0e26e4343d..8e13ce41a9 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -282,6 +282,8 @@ typedef enum powerpc_input_t {
     PPC_FLAGS_INPUT_POWER9,
     /* Freescale RCPU bus               */
     PPC_FLAGS_INPUT_RCPU,
+    /* PPE42 bus                        */
+    PPC_FLAGS_INPUT_PPE42,
 } powerpc_input_t;
 
 #define PPC_INPUT(env) ((env)->bus_model)
@@ -433,39 +435,64 @@ typedef enum {
 #define MSR_TM   PPC_BIT_NR(31) /* Transactional Memory Available (Book3s)   */
 #define MSR_CM   PPC_BIT_NR(32) /* Computation mode for BookE         hflags */
 #define MSR_ICM  PPC_BIT_NR(33) /* Interrupt computation mode for BookE      */
+#define MSR_SEM0 PPC_BIT_NR(33) /* SIB Error Mask Bit 0 (PPE42)              */
+#define MSR_SEM1 PPC_BIT_NR(34) /* SIB Error Mask Bit 1 (PPE42)              */
+#define MSR_SEM2 PPC_BIT_NR(35) /* SIB Error Mask Bit 2 (PPE42)              */
 #define MSR_GS   PPC_BIT_NR(35) /* guest state for BookE                     */
+#define MSR_SEM3 PPC_BIT_NR(36) /* SIB Error Mask Bit 3 (PPE42)              */
+#define MSR_SEM4 PPC_BIT_NR(37) /* SIB Error Mask Bit 4 (PPE42)              */
 #define MSR_UCLE PPC_BIT_NR(37) /* User-mode cache lock enable for BookE     */
 #define MSR_VR   PPC_BIT_NR(38) /* altivec available                x hflags */
 #define MSR_SPE  PPC_BIT_NR(38) /* SPE enable for BookE             x hflags */
+#define MSR_SEM5 PPC_BIT_NR(38) /* SIB Error Mask Bit 5 (PPE42)              */
+#define MSR_SEM6 PPC_BIT_NR(39) /* SIB Error Mask Bit 6 (PPE42)              */
 #define MSR_VSX  PPC_BIT_NR(40) /* Vector Scalar Extension (>= 2.06)x hflags */
+#define MSR_IS0  PPC_BIT_NR(40) /* Instance Specific Bit 0 (PPE42)           */
 #define MSR_S    PPC_BIT_NR(41) /* Secure state                              */
+#define MSR_SIBRC0 PPC_BIT_NR(41) /* Last SIB return code Bit 0 (PPE42)      */
+#define MSR_SIBRC1 PPC_BIT_NR(42) /* Last SIB return code Bit 1 (PPE42)      */
+#define MSR_SIBRC2 PPC_BIT_NR(43) /* Last SIB return code Bit 2 (PPE42)      */
+#define MSR_LP   PPC_BIT_NR(44) /* Low Priority (PPE42)                      */
 #define MSR_KEY  PPC_BIT_NR(44) /* key bit on 603e                           */
 #define MSR_POW  PPC_BIT_NR(45) /* Power management                          */
 #define MSR_WE   PPC_BIT_NR(45) /* Wait State Enable on 405                  */
+#define MSR_IS1  PPC_BIT_NR(46) /* Instance Specific Bit 1 (PPE42)           */
 #define MSR_TGPR PPC_BIT_NR(46) /* TGPR usage on 602/603            x        */
 #define MSR_CE   PPC_BIT_NR(46) /* Critical int. enable on embedded PPC x    */
 #define MSR_ILE  PPC_BIT_NR(47) /* Interrupt little-endian mode              */
+#define MSR_UIE  PPC_BIT_NR(47) /* Unmaskable Interrupt Enable (PPE42)       */
 #define MSR_EE   PPC_BIT_NR(48) /* External interrupt enable                 */
 #define MSR_PR   PPC_BIT_NR(49) /* Problem state                      hflags */
 #define MSR_FP   PPC_BIT_NR(50) /* Floating point available           hflags */
 #define MSR_ME   PPC_BIT_NR(51) /* Machine check interrupt enable            */
 #define MSR_FE0  PPC_BIT_NR(52) /* Floating point exception mode 0           */
+#define MSR_IS2  PPC_BIT_NR(52) /* Instance Specific Bit 2 (PPE42)           */
+#define MSR_IS3  PPC_BIT_NR(53) /* Instance Specific Bit 3 (PPE42)           */
 #define MSR_SE   PPC_BIT_NR(53) /* Single-step trace enable         x hflags */
 #define MSR_DWE  PPC_BIT_NR(53) /* Debug wait enable on 405         x        */
 #define MSR_UBLE PPC_BIT_NR(53) /* User BTB lock enable on e500     x        */
 #define MSR_BE   PPC_BIT_NR(54) /* Branch trace enable              x hflags */
 #define MSR_DE   PPC_BIT_NR(54) /* Debug int. enable on embedded PPC   x     */
 #define MSR_FE1  PPC_BIT_NR(55) /* Floating point exception mode 1           */
+#define MSR_IPE  PPC_BIT_NR(55) /* Imprecise Mode Enable (PPE42)             */
 #define MSR_AL   PPC_BIT_NR(56) /* AL bit on POWER                           */
+#define MSR_SIBRCA0 PPC_BIT_NR(56) /* SIB Return Code Accumulator 0 (PPE42)  */
+#define MSR_SIBRCA1 PPC_BIT_NR(57) /* SIB Return Code Accumulator 1 (PPE42)  */
 #define MSR_EP   PPC_BIT_NR(57) /* Exception prefix on 601                   */
 #define MSR_IR   PPC_BIT_NR(58) /* Instruction relocate                      */
 #define MSR_IS   PPC_BIT_NR(58) /* Instruction address space (BookE)         */
+#define MSR_SIBRCA2 PPC_BIT_NR(58) /* SIB Return Code Accumulator 2 (PPE42)  */
+#define MSR_SIBRCA3 PPC_BIT_NR(59) /* SIB Return Code Accumulator 3 (PPE42)  */
 #define MSR_DR   PPC_BIT_NR(59) /* Data relocate                             */
 #define MSR_DS   PPC_BIT_NR(59) /* Data address space (BookE)                */
 #define MSR_PE   PPC_BIT_NR(60) /* Protection enable on 403                  */
+#define MSR_SIBRCA4 PPC_BIT_NR(60) /* SIB Return Code Accumulator 4 (PPE42)  */
+#define MSR_SIBRCA5 PPC_BIT_NR(61) /* SIB Return Code Accumulator 5 (PPE42)  */
 #define MSR_PX   PPC_BIT_NR(61) /* Protection exclusive on 403        x      */
 #define MSR_PMM  PPC_BIT_NR(61) /* Performance monitor mark on POWER  x      */
 #define MSR_RI   PPC_BIT_NR(62) /* Recoverable interrupt            1        */
+#define MSR_SIBRCA6 PPC_BIT_NR(62) /* SIB Return Code Accumulator 6 (PPE42)  */
+#define MSR_SIBRCA7 PPC_BIT_NR(63) /* SIB Return Code Accumulator 7 (PPE42)  */
 #define MSR_LE   PPC_BIT_NR(63) /* Little-endian mode               1 hflags */
 
 FIELD(MSR, SF, MSR_SF, 1)
@@ -517,6 +544,9 @@ FIELD(MSR, PX, MSR_PX, 1)
 FIELD(MSR, PMM, MSR_PMM, 1)
 FIELD(MSR, RI, MSR_RI, 1)
 FIELD(MSR, LE, MSR_LE, 1)
+FIELD(MSR, SEM, MSR_SEM6, 7)
+FIELD(MSR, SIBRC, MSR_SIBRC2, 3)
+FIELD(MSR, SIBRCA, MSR_SIBRCA7, 8)
 
 /*
  * FE0 and FE1 bits are not side-by-side
@@ -785,6 +815,8 @@ enum {
     POWERPC_FLAG_SMT_1LPAR = 0x00800000,
     /* Has BHRB */
     POWERPC_FLAG_BHRB      = 0x01000000,
+    /* Use PPE42-specific behavior                                           */
+    POWERPC_FLAG_PPE42     = 0x02000000,
 };
 
 /*
@@ -1754,9 +1786,12 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_BOOKE_CSRR0       (0x03A)
 #define SPR_BOOKE_CSRR1       (0x03B)
 #define SPR_BOOKE_DEAR        (0x03D)
+#define SPR_PPE42_EDR         (0x03D)
 #define SPR_IAMR              (0x03D)
 #define SPR_BOOKE_ESR         (0x03E)
+#define SPR_PPE42_ISR         (0x03E)
 #define SPR_BOOKE_IVPR        (0x03F)
+#define SPR_PPE42_IVPR        (0x03F)
 #define SPR_MPC_EIE           (0x050)
 #define SPR_MPC_EID           (0x051)
 #define SPR_MPC_NRI           (0x052)
@@ -1822,6 +1857,7 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_TBU40             (0x11E)
 #define SPR_SVR               (0x11E)
 #define SPR_BOOKE_PIR         (0x11E)
+#define SPR_PPE42_PIR         (0x11E)
 #define SPR_PVR               (0x11F)
 #define SPR_HSPRG0            (0x130)
 #define SPR_BOOKE_DBSR        (0x130)
@@ -1831,6 +1867,7 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_BOOKE_EPCR        (0x133)
 #define SPR_SPURR             (0x134)
 #define SPR_BOOKE_DBCR0       (0x134)
+#define SPR_PPE42_DBCR        (0x134)
 #define SPR_IBCR              (0x135)
 #define SPR_PURR              (0x135)
 #define SPR_BOOKE_DBCR1       (0x135)
@@ -1848,6 +1885,7 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_HSRR1             (0x13B)
 #define SPR_BOOKE_IAC4        (0x13B)
 #define SPR_BOOKE_DAC1        (0x13C)
+#define SPR_PPE42_DACR        (0x13C)
 #define SPR_MMCRH             (0x13C)
 #define SPR_DABR2             (0x13D)
 #define SPR_BOOKE_DAC2        (0x13D)
@@ -1857,12 +1895,14 @@ void ppc_compat_add_property(Object *obj, const char *name,
 #define SPR_BOOKE_DVC2        (0x13F)
 #define SPR_LPIDR             (0x13F)
 #define SPR_BOOKE_TSR         (0x150)
+#define SPR_PPE42_TSR         (0x150)
 #define SPR_HMER              (0x150)
 #define SPR_HMEER             (0x151)
 #define SPR_PCR               (0x152)
 #define SPR_HEIR              (0x153)
 #define SPR_BOOKE_LPIDR       (0x152)
 #define SPR_BOOKE_TCR         (0x154)
+#define SPR_PPE42_TCR         (0x154)
 #define SPR_BOOKE_TLB0PS      (0x158)
 #define SPR_BOOKE_TLB1PS      (0x159)
 #define SPR_BOOKE_TLB2PS      (0x15A)
@@ -2532,6 +2572,12 @@ enum {
     PPC2_MEM_LWSYNC    = 0x0000000000200000ULL,
     /* ISA 2.06 BCD assist instructions                                      */
     PPC2_BCDA_ISA206   = 0x0000000000400000ULL,
+    /* PPE42 instructions                                                    */
+    PPC2_PPE42         = 0x0000000000800000ULL,
+    /* PPE42X instructions                                                   */
+    PPC2_PPE42X        = 0x0000000001000000ULL,
+    /* PPE42XM instructions                                                  */
+    PPC2_PPE42XM       = 0x0000000002000000ULL,
 
 #define PPC_TCG_INSNS2 (PPC2_BOOKE206 | PPC2_VSX | PPC2_PRCNTL | PPC2_DBRX | \
                         PPC2_ISA205 | PPC2_VSX207 | PPC2_PERM_ISA206 | \
@@ -2541,7 +2587,8 @@ enum {
                         PPC2_ALTIVEC_207 | PPC2_ISA207S | PPC2_DFP | \
                         PPC2_FP_CVT_S64 | PPC2_TM | PPC2_PM_ISA206 | \
                         PPC2_ISA300 | PPC2_ISA310 | PPC2_MEM_LWSYNC | \
-                        PPC2_BCDA_ISA206)
+                        PPC2_BCDA_ISA206 | PPC2_PPE42 | PPC2_PPE42X | \
+                        PPC2_PPE42XM)
 };
 
 /*****************************************************************************/

From 0af45e550b50f1c41164e5c0440654319942707e Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:40 -0500
Subject: [PATCH 0732/2396] target/ppc: Add IBM PPE42 family of processors

Adds the IBM PPE42 family of 32-bit processors supporting
the PPE42, PPE42X and PPE42XM processor versions.  These
processors are used as embedded processors in the IBM
Power9, Power10 and Power12 processors for various
tasks.  It is basically a stripped down version of the
IBM PowerPC 405 processor, with some added instructions
for handling 64-bit loads and stores.

For more information on the PPE 42 processor please visit:

https://wiki.raptorcs.com/w/images/a/a3/PPE_42X_Core_Users_Manual.pdf

Supports PPE42 SPR's (Including the MSR).

Does not yet support exceptions, new PPE42 instructions and
does not prevent access to some invalid instructions and
registers (currently allows access to invalid GPR's and CR
fields).

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-3-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-3-milesg@linux.ibm.com>
---
 target/ppc/cpu-models.c  |   7 ++
 target/ppc/cpu_init.c    | 207 ++++++++++++++++++++++++++++++++-------
 target/ppc/helper_regs.c |  41 +++++---
 target/ppc/translate.c   |   6 +-
 4 files changed, 205 insertions(+), 56 deletions(-)

diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
index ea86ea202a..09f73e23a8 100644
--- a/target/ppc/cpu-models.c
+++ b/target/ppc/cpu-models.c
@@ -116,6 +116,13 @@
                 NULL)
     POWERPC_DEF("x2vp20",        CPU_POWERPC_X2VP20,                 405,
                 NULL)
+    /* PPE42 Embedded Controllers                                            */
+    POWERPC_DEF("PPE42",         CPU_POWERPC_PPE42,                  ppe42,
+                "Generic PPE 42")
+    POWERPC_DEF("PPE42X",        CPU_POWERPC_PPE42X,                 ppe42x,
+                "Generic PPE 42X")
+    POWERPC_DEF("PPE42XM",       CPU_POWERPC_PPE42XM,                ppe42xm,
+                "Generic PPE 42XM")
     /* PowerPC 440 family                                                    */
 #if defined(TODO_USER_ONLY)
     POWERPC_DEF("440",           CPU_POWERPC_440,                    440GP,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index db841f1260..c78b255085 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1653,6 +1653,47 @@ static void register_8xx_sprs(CPUPPCState *env)
  * ... and more (thermal management, performance counters, ...)
  */
 
+static void register_ppe42_sprs(CPUPPCState *env)
+{
+    spr_register(env, SPR_PPE42_EDR, "EDR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_PPE42_ISR, "ISR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    spr_register(env, SPR_PPE42_IVPR, "IVPR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 0xfff80000);
+    spr_register(env, SPR_PPE42_PIR, "PIR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_pir,
+                 0x00000000);
+    spr_register(env, SPR_PPE42_DBCR, "DBCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_40x_dbcr0,
+                 0x00000000);
+    spr_register(env, SPR_PPE42_DACR, "DACR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_generic,
+                 0x00000000);
+    /* Timer */
+    spr_register(env, SPR_DECR, "DECR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_decr, &spr_write_decr,
+                 0x00000000);
+    spr_register(env, SPR_PPE42_TSR, "TSR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_booke_tsr,
+                 0x00000000);
+    spr_register(env, SPR_BOOKE_TCR, "TCR",
+                 SPR_NOACCESS, SPR_NOACCESS,
+                 &spr_read_generic, &spr_write_booke_tcr,
+                 0x00000000);
+}
+
 /*****************************************************************************/
 /* Exception vectors models                                                  */
 static void init_excp_4xx(CPUPPCState *env)
@@ -2200,6 +2241,79 @@ POWERPC_FAMILY(405)(ObjectClass *oc, const void *data)
                  POWERPC_FLAG_DE | POWERPC_FLAG_BUS_CLK;
 }
 
+static void init_proc_ppe42(CPUPPCState *env)
+{
+    register_ppe42_sprs(env);
+
+    env->dcache_line_size = 32;
+    env->icache_line_size = 32;
+    /* Allocate hardware IRQ controller */
+    ppc40x_irq_init(env_archcpu(env));
+
+    SET_FIT_PERIOD(8, 12, 16, 20);
+    SET_WDT_PERIOD(16, 20, 24, 28);
+}
+
+static void ppe42_class_common_init(PowerPCCPUClass *pcc)
+{
+    pcc->init_proc = init_proc_ppe42;
+    pcc->check_pow = check_pow_nocheck;
+    pcc->check_attn = check_attn_none;
+    pcc->insns_flags = PPC_INSNS_BASE |
+                       PPC_WRTEE |
+                       PPC_CACHE |
+                       PPC_CACHE_DCBZ |
+                       PPC_MEM_SYNC;
+    pcc->msr_mask = R_MSR_SEM_MASK |
+                    (1ull << MSR_IS0) |
+                    R_MSR_SIBRC_MASK |
+                    (1ull << MSR_LP) |
+                    (1ull << MSR_WE) |
+                    (1ull << MSR_IS1) |
+                    (1ull << MSR_UIE) |
+                    (1ull << MSR_EE) |
+                    (1ull << MSR_ME) |
+                    (1ull << MSR_IS2) |
+                    (1ull << MSR_IS3) |
+                    (1ull << MSR_IPE) |
+                    R_MSR_SIBRCA_MASK;
+    pcc->mmu_model = POWERPC_MMU_REAL;
+    pcc->excp_model = POWERPC_EXCP_40x;
+    pcc->bus_model = PPC_FLAGS_INPUT_PPE42;
+    pcc->bfd_mach = bfd_mach_ppc_403;
+    pcc->flags = POWERPC_FLAG_PPE42 | POWERPC_FLAG_BUS_CLK;
+}
+
+POWERPC_FAMILY(ppe42)(ObjectClass *oc, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+    dc->desc = "PPE 42";
+    pcc->insns_flags2 = PPC2_PPE42;
+    ppe42_class_common_init(pcc);
+}
+
+POWERPC_FAMILY(ppe42x)(ObjectClass *oc, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+    dc->desc = "PPE 42X";
+    pcc->insns_flags2 = PPC2_PPE42 | PPC2_PPE42X;
+    ppe42_class_common_init(pcc);
+}
+
+POWERPC_FAMILY(ppe42xm)(ObjectClass *oc, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+
+    dc->desc = "PPE 42XM";
+    pcc->insns_flags2 = PPC2_PPE42 | PPC2_PPE42X | PPC2_PPE42XM;
+    ppe42_class_common_init(pcc);
+}
+
 static void init_proc_440EP(CPUPPCState *env)
 {
     register_BookE_sprs(env, 0x000000000000FFFFULL);
@@ -6802,53 +6916,64 @@ static void init_ppc_proc(PowerPCCPU *cpu)
 
     /* MSR bits & flags consistency checks */
     if (env->msr_mask & (1 << 25)) {
-        switch (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE)) {
+        switch (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE |
+                              POWERPC_FLAG_PPE42)) {
         case POWERPC_FLAG_SPE:
         case POWERPC_FLAG_VRE:
+        case POWERPC_FLAG_PPE42:
             break;
         default:
             fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                    "Should define POWERPC_FLAG_SPE or POWERPC_FLAG_VRE\n");
+                    "Should define POWERPC_FLAG_SPE or POWERPC_FLAG_VRE\n"
+                    "or POWERPC_FLAG_PPE42\n");
             exit(1);
         }
-    } else if (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE)) {
+    } else if (env->flags & (POWERPC_FLAG_SPE | POWERPC_FLAG_VRE |
+                             POWERPC_FLAG_PPE42)) {
         fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                "Should not define POWERPC_FLAG_SPE nor POWERPC_FLAG_VRE\n");
+                "Should not define POWERPC_FLAG_SPE nor POWERPC_FLAG_VRE\n"
+                "nor POWERPC_FLAG_PPE42\n");
         exit(1);
     }
     if (env->msr_mask & (1 << 17)) {
-        switch (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE)) {
+        switch (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE |
+                              POWERPC_FLAG_PPE42)) {
         case POWERPC_FLAG_TGPR:
         case POWERPC_FLAG_CE:
+        case POWERPC_FLAG_PPE42:
             break;
         default:
             fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                    "Should define POWERPC_FLAG_TGPR or POWERPC_FLAG_CE\n");
+                    "Should define POWERPC_FLAG_TGPR or POWERPC_FLAG_CE\n"
+                    "or POWERPC_FLAG_PPE42\n");
             exit(1);
         }
-    } else if (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE)) {
+    } else if (env->flags & (POWERPC_FLAG_TGPR | POWERPC_FLAG_CE |
+                             POWERPC_FLAG_PPE42)) {
         fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                "Should not define POWERPC_FLAG_TGPR nor POWERPC_FLAG_CE\n");
+                "Should not define POWERPC_FLAG_TGPR nor POWERPC_FLAG_CE\n"
+                "nor POWERPC_FLAG_PPE42\n");
         exit(1);
     }
     if (env->msr_mask & (1 << 10)) {
         switch (env->flags & (POWERPC_FLAG_SE | POWERPC_FLAG_DWE |
-                              POWERPC_FLAG_UBLE)) {
+                              POWERPC_FLAG_UBLE | POWERPC_FLAG_PPE42)) {
         case POWERPC_FLAG_SE:
         case POWERPC_FLAG_DWE:
         case POWERPC_FLAG_UBLE:
+        case POWERPC_FLAG_PPE42:
             break;
         default:
             fprintf(stderr, "PowerPC MSR definition inconsistency\n"
                     "Should define POWERPC_FLAG_SE or POWERPC_FLAG_DWE or "
-                    "POWERPC_FLAG_UBLE\n");
+                    "POWERPC_FLAG_UBLE or POWERPC_FLAG_PPE42\n");
             exit(1);
         }
     } else if (env->flags & (POWERPC_FLAG_SE | POWERPC_FLAG_DWE |
-                             POWERPC_FLAG_UBLE)) {
+                             POWERPC_FLAG_UBLE | POWERPC_FLAG_PPE42)) {
         fprintf(stderr, "PowerPC MSR definition inconsistency\n"
                 "Should not define POWERPC_FLAG_SE nor POWERPC_FLAG_DWE nor "
-                "POWERPC_FLAG_UBLE\n");
+                "POWERPC_FLAG_UBLE nor POWERPC_FLAG_PPE42\n");
             exit(1);
     }
     if (env->msr_mask & (1 << 9)) {
@@ -6867,18 +6992,23 @@ static void init_ppc_proc(PowerPCCPU *cpu)
         exit(1);
     }
     if (env->msr_mask & (1 << 2)) {
-        switch (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM)) {
+        switch (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM |
+                              POWERPC_FLAG_PPE42)) {
         case POWERPC_FLAG_PX:
         case POWERPC_FLAG_PMM:
+        case POWERPC_FLAG_PPE42:
             break;
         default:
             fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                    "Should define POWERPC_FLAG_PX or POWERPC_FLAG_PMM\n");
+                    "Should define POWERPC_FLAG_PX or POWERPC_FLAG_PMM\n"
+                    "or POWERPC_FLAG_PPE42\n");
             exit(1);
         }
-    } else if (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM)) {
+    } else if (env->flags & (POWERPC_FLAG_PX | POWERPC_FLAG_PMM |
+                             POWERPC_FLAG_PPE42)) {
         fprintf(stderr, "PowerPC MSR definition inconsistency\n"
-                "Should not define POWERPC_FLAG_PX nor POWERPC_FLAG_PMM\n");
+                "Should not define POWERPC_FLAG_PX nor POWERPC_FLAG_PMM\n"
+                "nor POWERPC_FLAG_PPE42\n");
         exit(1);
     }
     if ((env->flags & POWERPC_FLAG_BUS_CLK) == 0) {
@@ -7243,39 +7373,40 @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
     }
 
     msr = (target_ulong)0;
-    msr |= (target_ulong)MSR_HVB;
-    msr |= (target_ulong)1 << MSR_EP;
+    if (!(env->flags & POWERPC_FLAG_PPE42)) {
+        msr |= (target_ulong)MSR_HVB;
+        msr |= (target_ulong)1 << MSR_EP;
 #if defined(DO_SINGLE_STEP) && 0
-    /* Single step trace mode */
-    msr |= (target_ulong)1 << MSR_SE;
-    msr |= (target_ulong)1 << MSR_BE;
+        /* Single step trace mode */
+        msr |= (target_ulong)1 << MSR_SE;
+        msr |= (target_ulong)1 << MSR_BE;
 #endif
 #if defined(CONFIG_USER_ONLY)
-    msr |= (target_ulong)1 << MSR_FP; /* Allow floating point usage */
-    msr |= (target_ulong)1 << MSR_FE0; /* Allow floating point exceptions */
-    msr |= (target_ulong)1 << MSR_FE1;
-    msr |= (target_ulong)1 << MSR_VR; /* Allow altivec usage */
-    msr |= (target_ulong)1 << MSR_VSX; /* Allow VSX usage */
-    msr |= (target_ulong)1 << MSR_SPE; /* Allow SPE usage */
-    msr |= (target_ulong)1 << MSR_PR;
+        msr |= (target_ulong)1 << MSR_FP; /* Allow floating point usage */
+        msr |= (target_ulong)1 << MSR_FE0; /* Allow floating point exceptions */
+        msr |= (target_ulong)1 << MSR_FE1;
+        msr |= (target_ulong)1 << MSR_VR; /* Allow altivec usage */
+        msr |= (target_ulong)1 << MSR_VSX; /* Allow VSX usage */
+        msr |= (target_ulong)1 << MSR_SPE; /* Allow SPE usage */
+        msr |= (target_ulong)1 << MSR_PR;
 #if defined(TARGET_PPC64)
-    msr |= (target_ulong)1 << MSR_TM; /* Transactional memory */
+        msr |= (target_ulong)1 << MSR_TM; /* Transactional memory */
 #endif
 #if !TARGET_BIG_ENDIAN
-    msr |= (target_ulong)1 << MSR_LE; /* Little-endian user mode */
-    if (!((env->msr_mask >> MSR_LE) & 1)) {
-        fprintf(stderr, "Selected CPU does not support little-endian.\n");
-        exit(1);
-    }
+        msr |= (target_ulong)1 << MSR_LE; /* Little-endian user mode */
+        if (!((env->msr_mask >> MSR_LE) & 1)) {
+            fprintf(stderr, "Selected CPU does not support little-endian.\n");
+            exit(1);
+        }
 #endif
 #endif
 
 #if defined(TARGET_PPC64)
-    if (mmu_is_64bit(env->mmu_model)) {
-        msr |= (1ULL << MSR_SF);
-    }
+        if (mmu_is_64bit(env->mmu_model)) {
+            msr |= (1ULL << MSR_SF);
+        }
 #endif
-
+    }
     hreg_store_msr(env, msr, 1);
 
 #if !defined(CONFIG_USER_ONLY)
diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 5f21739749..41b7b939ec 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -308,9 +308,6 @@ int hreg_store_msr(CPUPPCState *env, target_ulong value, int alter_hv)
         value &= ~(1 << MSR_ME);
         value |= env->msr & (1 << MSR_ME);
     }
-    if ((value ^ env->msr) & (R_MSR_IR_MASK | R_MSR_DR_MASK)) {
-        cpu_interrupt_exittb(cs);
-    }
     if ((env->mmu_model == POWERPC_MMU_BOOKE ||
          env->mmu_model == POWERPC_MMU_BOOKE206) &&
         ((value ^ env->msr) & R_MSR_GS_MASK)) {
@@ -321,8 +318,14 @@ int hreg_store_msr(CPUPPCState *env, target_ulong value, int alter_hv)
         /* Swap temporary saved registers with GPRs */
         hreg_swap_gpr_tgpr(env);
     }
-    if (unlikely((value ^ env->msr) & R_MSR_EP_MASK)) {
-        env->excp_prefix = FIELD_EX64(value, MSR, EP) * 0xFFF00000;
+    /* PPE42 uses IR, DR and EP MSR bits for other purposes */
+    if (likely(!(env->flags & POWERPC_FLAG_PPE42))) {
+        if ((value ^ env->msr) & (R_MSR_IR_MASK | R_MSR_DR_MASK)) {
+            cpu_interrupt_exittb(cs);
+        }
+        if (unlikely((value ^ env->msr) & R_MSR_EP_MASK)) {
+            env->excp_prefix = FIELD_EX64(value, MSR, EP) * 0xFFF00000;
+        }
     }
     /*
      * If PR=1 then EE, IR and DR must be 1
@@ -464,6 +467,23 @@ void register_generic_sprs(PowerPCCPU *cpu)
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
+
+    spr_register(env, SPR_PVR, "PVR",
+                 /* Linux permits userspace to read PVR */
+#if defined(CONFIG_LINUX_USER)
+                 &spr_read_generic,
+#else
+                 SPR_NOACCESS,
+#endif
+                 SPR_NOACCESS,
+                 &spr_read_generic, SPR_NOACCESS,
+                 pcc->pvr);
+
+    /* PPE42 doesn't support SPRG1-3, SVR or TB regs */
+    if (env->insns_flags2 & PPC2_PPE42) {
+        return;
+    }
+
     spr_register(env, SPR_SPRG1, "SPRG1",
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, &spr_write_generic,
@@ -477,17 +497,6 @@ void register_generic_sprs(PowerPCCPU *cpu)
                  &spr_read_generic, &spr_write_generic,
                  0x00000000);
 
-    spr_register(env, SPR_PVR, "PVR",
-                 /* Linux permits userspace to read PVR */
-#if defined(CONFIG_LINUX_USER)
-                 &spr_read_generic,
-#else
-                 SPR_NOACCESS,
-#endif
-                 SPR_NOACCESS,
-                 &spr_read_generic, SPR_NOACCESS,
-                 pcc->pvr);
-
     /* Register SVR if it's defined to anything else than POWERPC_SVR_NONE */
     if (pcc->svr != POWERPC_SVR_NONE) {
         if (pcc->svr & POWERPC_SVR_E500) {
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index 27f90c3cc5..fc817dab54 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -4264,8 +4264,10 @@ static void gen_mtmsr(DisasContext *ctx)
         /* L=1 form only updates EE and RI */
         mask &= (1ULL << MSR_RI) | (1ULL << MSR_EE);
     } else {
-        /* mtmsr does not alter S, ME, or LE */
-        mask &= ~((1ULL << MSR_LE) | (1ULL << MSR_ME) | (1ULL << MSR_S));
+        if (likely(!(ctx->insns_flags2 & PPC2_PPE42))) {
+            /* mtmsr does not alter S, ME, or LE */
+            mask &= ~((1ULL << MSR_LE) | (1ULL << MSR_ME) | (1ULL << MSR_S));
+        }
 
         /*
          * XXX: we need to update nip before the store if we enter

From 27eee49e6e3cecf69ab02f84fc2d9e19ef8bd3e2 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:41 -0500
Subject: [PATCH 0733/2396] target/ppc: IBM PPE42 exception flags and regs

Introduces flags and register definitions needed
for the IBM PPE42 exception model.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-4-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-4-milesg@linux.ibm.com>
---
 target/ppc/cpu.h | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 8e13ce41a9..787020f6f9 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -220,6 +220,8 @@ typedef enum powerpc_excp_t {
     POWERPC_EXCP_POWER10,
     /* POWER11 exception model           */
     POWERPC_EXCP_POWER11,
+    /* PPE42 exception model            */
+    POWERPC_EXCP_PPE42,
 } powerpc_excp_t;
 
 /*****************************************************************************/
@@ -760,6 +762,31 @@ FIELD(MSR, SIBRCA, MSR_SIBRCA7, 8)
 #define ESR_VLEMI PPC_BIT(58) /* VLE operation                          */
 #define ESR_MIF   PPC_BIT(62) /* Misaligned instruction (VLE)           */
 
+/* PPE42 Interrupt Status Register bits */
+#define PPE42_ISR_SRSMS0  PPC_BIT_NR(48) /* Sys Reset State Machine State 0   */
+#define PPE42_ISR_SRSMS1  PPC_BIT_NR(49) /* Sys Reset State Machine State 1   */
+#define PPE42_ISR_SRSMS2  PPC_BIT_NR(50) /* Sys Reset State Machine State 2   */
+#define PPE42_ISR_SRSMS3  PPC_BIT_NR(51) /* Sys Reset State Machine State 3   */
+#define PPE42_ISR_EP      PPC_BIT_NR(53) /* MSR[EE] Maskable Event Pending    */
+#define PPE42_ISR_PTR     PPC_BIT_NR(56) /* Program Interrupt from trap       */
+#define PPE42_ISR_ST      PPC_BIT_NR(57) /* Data Interrupt caused by store    */
+#define PPE42_ISR_MFE     PPC_BIT_NR(60) /* Multiple Fault Error              */
+#define PPE42_ISR_MCS0    PPC_BIT_NR(61) /* Machine Check Status bit0         */
+#define PPE42_ISR_MCS1    PPC_BIT_NR(62) /* Machine Check Status bit1         */
+#define PPE42_ISR_MCS2    PPC_BIT_NR(63) /* Machine Check Status bit2         */
+FIELD(PPE42_ISR, SRSMS, PPE42_ISR_SRSMS3, 4)
+FIELD(PPE42_ISR, MCS, PPE42_ISR_MCS2, 3)
+
+/* PPE42 Machine Check Status field values */
+#define PPE42_ISR_MCS_INSTRUCTION             0
+#define PPE42_ISR_MCS_DATA_LOAD               1
+#define PPE42_ISR_MCS_DATA_PRECISE_STORE      2
+#define PPE42_ISR_MCS_DATA_IMPRECISE_STORE    3
+#define PPE42_ISR_MCS_PROGRAM                 4
+#define PPE42_ISR_MCS_ISI                     5
+#define PPE42_ISR_MCS_ALIGNMENT               6
+#define PPE42_ISR_MCS_DSI                     7
+
 /* Transaction EXception And Summary Register bits                           */
 #define TEXASR_FAILURE_PERSISTENT                (63 - 7)
 #define TEXASR_DISALLOWED                        (63 - 8)

From 7928680e0aaf0c755ce97800791bf73185749a88 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:42 -0500
Subject: [PATCH 0734/2396] target/ppc: Add IBM PPE42 exception model

Add support for the IBM PPE42 exception model including
new exception vectors, exception priorities and setting
of PPE42 SPRs for determining the cause of an exception.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-5-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-5-milesg@linux.ibm.com>
---
 target/ppc/cpu_init.c        |  39 ++++++++-
 target/ppc/excp_helper.c     | 163 +++++++++++++++++++++++++++++++++++
 target/ppc/tcg-excp_helper.c |  12 +++
 3 files changed, 213 insertions(+), 1 deletion(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index c78b255085..9e4ea8fd13 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1720,6 +1720,30 @@ static void init_excp_4xx(CPUPPCState *env)
 #endif
 }
 
+static void init_excp_ppe42(CPUPPCState *env)
+{
+#if !defined(CONFIG_USER_ONLY)
+    /* Machine Check vector changed after version 0 */
+    if (((env->spr[SPR_PVR] & 0xf00000ul) >> 20) == 0) {
+        env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000000;
+    } else {
+        env->excp_vectors[POWERPC_EXCP_MCHECK]   = 0x00000020;
+    }
+    env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000040;
+    env->excp_vectors[POWERPC_EXCP_DSI]      = 0x00000060;
+    env->excp_vectors[POWERPC_EXCP_ISI]      = 0x00000080;
+    env->excp_vectors[POWERPC_EXCP_EXTERNAL] = 0x000000A0;
+    env->excp_vectors[POWERPC_EXCP_ALIGN]    = 0x000000C0;
+    env->excp_vectors[POWERPC_EXCP_PROGRAM]  = 0x000000E0;
+    env->excp_vectors[POWERPC_EXCP_DECR]     = 0x00000100;
+    env->excp_vectors[POWERPC_EXCP_FIT]      = 0x00000120;
+    env->excp_vectors[POWERPC_EXCP_WDT]      = 0x00000140;
+    env->ivpr_mask = 0xFFFFFE00UL;
+    /* Hardware reset vector */
+    env->hreset_vector = 0x00000040UL;
+#endif
+}
+
 static void init_excp_MPC5xx(CPUPPCState *env)
 {
 #if !defined(CONFIG_USER_ONLY)
@@ -2245,6 +2269,7 @@ static void init_proc_ppe42(CPUPPCState *env)
 {
     register_ppe42_sprs(env);
 
+    init_excp_ppe42(env);
     env->dcache_line_size = 32;
     env->icache_line_size = 32;
     /* Allocate hardware IRQ controller */
@@ -2278,7 +2303,7 @@ static void ppe42_class_common_init(PowerPCCPUClass *pcc)
                     (1ull << MSR_IPE) |
                     R_MSR_SIBRCA_MASK;
     pcc->mmu_model = POWERPC_MMU_REAL;
-    pcc->excp_model = POWERPC_EXCP_40x;
+    pcc->excp_model = POWERPC_EXCP_PPE42;
     pcc->bus_model = PPC_FLAGS_INPUT_PPE42;
     pcc->bfd_mach = bfd_mach_ppc_403;
     pcc->flags = POWERPC_FLAG_PPE42 | POWERPC_FLAG_BUS_CLK;
@@ -7856,6 +7881,18 @@ void ppc_cpu_dump_state(CPUState *cs, FILE *f, int flags)
          * they can be read with "p $ivor0", "p $ivor1", etc.
          */
         break;
+    case POWERPC_EXCP_PPE42:
+        qemu_fprintf(f, "SRR0 " TARGET_FMT_lx " SRR1 " TARGET_FMT_lx "\n",
+                     env->spr[SPR_SRR0], env->spr[SPR_SRR1]);
+
+        qemu_fprintf(f, "  TCR " TARGET_FMT_lx "   TSR " TARGET_FMT_lx
+                     "    ISR " TARGET_FMT_lx "   EDR " TARGET_FMT_lx "\n",
+                     env->spr[SPR_PPE42_TCR], env->spr[SPR_PPE42_TSR],
+                     env->spr[SPR_PPE42_ISR], env->spr[SPR_PPE42_EDR]);
+
+        qemu_fprintf(f, "  PIR " TARGET_FMT_lx "   IVPR " TARGET_FMT_lx "\n",
+                     env->spr[SPR_PPE42_PIR], env->spr[SPR_PPE42_IVPR]);
+        break;
     case POWERPC_EXCP_40x:
         qemu_fprintf(f, "  TCR " TARGET_FMT_lx "   TSR " TARGET_FMT_lx
                      "    ESR " TARGET_FMT_lx "   DEAR " TARGET_FMT_lx "\n",
diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index 1efdc4066e..d8bca19fff 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -949,6 +949,125 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
     powerpc_set_excp_state(cpu, vector, new_msr);
 }
 
+static void powerpc_excp_ppe42(PowerPCCPU *cpu, int excp)
+{
+    CPUPPCState *env = &cpu->env;
+    target_ulong msr, new_msr, vector;
+    target_ulong mcs = PPE42_ISR_MCS_INSTRUCTION;
+    bool promote_unmaskable;
+
+    msr = env->msr;
+
+    /*
+     * New interrupt handler msr preserves SIBRC and ME unless explicitly
+     * overridden by the exception.  All other MSR bits are zeroed out.
+     */
+    new_msr = env->msr & (((target_ulong)1 << MSR_ME) | R_MSR_SIBRC_MASK);
+
+    /* HV emu assistance interrupt only exists on server arch 2.05 or later */
+    if (excp == POWERPC_EXCP_HV_EMU) {
+        excp = POWERPC_EXCP_PROGRAM;
+    }
+
+    /*
+     * Unmaskable interrupts (Program, ISI, Alignment and DSI) are promoted to
+     * machine check if MSR_UIE is 0.
+     */
+    promote_unmaskable = !(msr & ((target_ulong)1 << MSR_UIE));
+
+
+    switch (excp) {
+    case POWERPC_EXCP_MCHECK:    /* Machine check exception                  */
+        break;
+    case POWERPC_EXCP_DSI:       /* Data storage exception                   */
+        trace_ppc_excp_dsi(env->spr[SPR_PPE42_ISR], env->spr[SPR_PPE42_EDR]);
+        if (promote_unmaskable) {
+            excp = POWERPC_EXCP_MCHECK;
+            mcs = PPE42_ISR_MCS_DSI;
+        }
+        break;
+    case POWERPC_EXCP_ISI:       /* Instruction storage exception            */
+        trace_ppc_excp_isi(msr, env->nip);
+        if (promote_unmaskable) {
+            excp = POWERPC_EXCP_MCHECK;
+            mcs = PPE42_ISR_MCS_ISI;
+        }
+        break;
+    case POWERPC_EXCP_EXTERNAL:  /* External input                           */
+        break;
+    case POWERPC_EXCP_ALIGN:     /* Alignment exception                      */
+        if (promote_unmaskable) {
+            excp = POWERPC_EXCP_MCHECK;
+            mcs = PPE42_ISR_MCS_ALIGNMENT;
+        }
+        break;
+    case POWERPC_EXCP_PROGRAM:   /* Program exception                        */
+        if (promote_unmaskable) {
+            excp = POWERPC_EXCP_MCHECK;
+            mcs = PPE42_ISR_MCS_PROGRAM;
+        }
+        switch (env->error_code & ~0xF) {
+        case POWERPC_EXCP_INVAL:
+            trace_ppc_excp_inval(env->nip);
+            env->spr[SPR_PPE42_ISR] &= ~((target_ulong)1 << PPE42_ISR_PTR);
+            break;
+        case POWERPC_EXCP_TRAP:
+            env->spr[SPR_PPE42_ISR] |= ((target_ulong)1 << PPE42_ISR_PTR);
+            break;
+        default:
+            /* Should never occur */
+            cpu_abort(env_cpu(env), "Invalid program exception %d. Aborting\n",
+                      env->error_code);
+            break;
+        }
+#ifdef CONFIG_TCG
+        env->spr[SPR_PPE42_EDR] = ppc_ldl_code(env, env->nip);
+#endif
+        break;
+    case POWERPC_EXCP_DECR:      /* Decrementer exception                    */
+        break;
+    case POWERPC_EXCP_FIT:       /* Fixed-interval timer interrupt           */
+        trace_ppc_excp_print("FIT");
+        break;
+    case POWERPC_EXCP_WDT:       /* Watchdog timer interrupt                 */
+        trace_ppc_excp_print("WDT");
+        break;
+    case POWERPC_EXCP_RESET:     /* System reset exception                   */
+        /* reset exceptions don't have ME set */
+        new_msr &= ~((target_ulong)1 << MSR_ME);
+        break;
+    default:
+        cpu_abort(env_cpu(env), "Invalid PPE42 exception %d. Aborting\n",
+                  excp);
+        break;
+    }
+
+    env->spr[SPR_SRR0] = env->nip;
+    env->spr[SPR_SRR1] = msr;
+
+    vector = env->excp_vectors[excp];
+    if (vector == (target_ulong)-1ULL) {
+        cpu_abort(env_cpu(env),
+                  "Raised an exception without defined vector %d\n", excp);
+    }
+    vector |= env->spr[SPR_PPE42_IVPR];
+
+    if (excp == POWERPC_EXCP_MCHECK) {
+        /* Also set the Machine Check Status (MCS) */
+        env->spr[SPR_PPE42_ISR] &= ~R_PPE42_ISR_MCS_MASK;
+        env->spr[SPR_PPE42_ISR] |= (mcs & R_PPE42_ISR_MCS_MASK);
+        env->spr[SPR_PPE42_ISR] &= ~((target_ulong)1 << PPE42_ISR_MFE);
+
+        /* Machine checks halt execution if MSR_ME is 0 */
+        powerpc_mcheck_checkstop(env);
+
+        /* machine check exceptions don't have ME set */
+        new_msr &= ~((target_ulong)1 << MSR_ME);
+    }
+
+    powerpc_set_excp_state(cpu, vector, new_msr);
+}
+
 static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
@@ -1589,6 +1708,9 @@ void powerpc_excp(PowerPCCPU *cpu, int excp)
     case POWERPC_EXCP_POWER11:
         powerpc_excp_books(cpu, excp);
         break;
+    case POWERPC_EXCP_PPE42:
+        powerpc_excp_ppe42(cpu, excp);
+        break;
     default:
         g_assert_not_reached();
     }
@@ -1945,6 +2067,43 @@ static int p9_next_unmasked_interrupt(CPUPPCState *env,
 }
 #endif /* TARGET_PPC64 */
 
+static int ppe42_next_unmasked_interrupt(CPUPPCState *env)
+{
+    bool async_deliver;
+
+    /* External reset */
+    if (env->pending_interrupts & PPC_INTERRUPT_RESET) {
+        return PPC_INTERRUPT_RESET;
+    }
+    /* Machine check exception */
+    if (env->pending_interrupts & PPC_INTERRUPT_MCK) {
+        return PPC_INTERRUPT_MCK;
+    }
+
+    async_deliver = FIELD_EX64(env->msr, MSR, EE);
+
+    if (async_deliver != 0) {
+        /* Watchdog timer */
+        if (env->pending_interrupts & PPC_INTERRUPT_WDT) {
+            return PPC_INTERRUPT_WDT;
+        }
+        /* External Interrupt */
+        if (env->pending_interrupts & PPC_INTERRUPT_EXT) {
+            return PPC_INTERRUPT_EXT;
+        }
+        /* Fixed interval timer */
+        if (env->pending_interrupts & PPC_INTERRUPT_FIT) {
+            return PPC_INTERRUPT_FIT;
+        }
+        /* Decrementer exception */
+        if (env->pending_interrupts & PPC_INTERRUPT_DECR) {
+            return PPC_INTERRUPT_DECR;
+        }
+    }
+
+    return 0;
+}
+
 static int ppc_next_unmasked_interrupt(CPUPPCState *env)
 {
     uint32_t pending_interrupts = env->pending_interrupts;
@@ -1970,6 +2129,10 @@ static int ppc_next_unmasked_interrupt(CPUPPCState *env)
     }
 #endif
 
+    if (env->excp_model == POWERPC_EXCP_PPE42) {
+        return ppe42_next_unmasked_interrupt(env);
+    }
+
     /* External reset */
     if (pending_interrupts & PPC_INTERRUPT_RESET) {
         return PPC_INTERRUPT_RESET;
diff --git a/target/ppc/tcg-excp_helper.c b/target/ppc/tcg-excp_helper.c
index f835be5156..edecfb8572 100644
--- a/target/ppc/tcg-excp_helper.c
+++ b/target/ppc/tcg-excp_helper.c
@@ -229,6 +229,18 @@ void ppc_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     case POWERPC_MMU_BOOKE206:
         env->spr[SPR_BOOKE_DEAR] = vaddr;
         break;
+    case POWERPC_MMU_REAL:
+        if (env->flags & POWERPC_FLAG_PPE42) {
+            env->spr[SPR_PPE42_EDR] = vaddr;
+            if (access_type == MMU_DATA_STORE) {
+                env->spr[SPR_PPE42_ISR] |= PPE42_ISR_ST;
+            } else {
+                env->spr[SPR_PPE42_ISR] &= ~PPE42_ISR_ST;
+            }
+        } else {
+            env->spr[SPR_DAR] = vaddr;
+        }
+        break;
     default:
         env->spr[SPR_DAR] = vaddr;
         break;

From 880aa4cb06ff5e86b6feab3030e14a16fea1dced Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:43 -0500
Subject: [PATCH 0735/2396] target/ppc: Support for IBM PPE42 MMU

The IBM PPE42 processor only supports real mode
addressing and does not distinguish between
problem and supervisor states. It also uses
the IR and DR MSR bits for other purposes.
Therefore, add a check for PPE42 when we update
hflags and cause it to ignore the IR and DR bits
when calculating MMU indexes.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-6-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-6-milesg@linux.ibm.com>
---
 target/ppc/helper_regs.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/ppc/helper_regs.c b/target/ppc/helper_regs.c
index 41b7b939ec..a07e6a7b7b 100644
--- a/target/ppc/helper_regs.c
+++ b/target/ppc/helper_regs.c
@@ -186,6 +186,10 @@ static uint32_t hreg_compute_hflags_value(CPUPPCState *env)
     if (env->spr[SPR_LPCR] & LPCR_HR) {
         hflags |= 1 << HFLAGS_HR;
     }
+    if (unlikely(ppc_flags & POWERPC_FLAG_PPE42)) {
+        /* PPE42 has a single address space and no problem state */
+        msr = 0;
+    }
 
 #ifndef CONFIG_USER_ONLY
     if (!env->has_hv_mode || (msr & (1ull << MSR_HV))) {

From f7ec91c23906ca364650e95f2a28e0ef6c411386 Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:44 -0500
Subject: [PATCH 0736/2396] target/ppc: Add IBM PPE42 special instructions

Adds the following instructions exclusively for
IBM PPE42 processors:

  LSKU
  LCXU
  STSKU
  STCXU
  LVD
  LVDU
  LVDX
  STVD
  STVDU
  STVDX
  SLVD
  SRVD
  CMPWBC
  CMPLWBC
  CMPWIBC
  BNBWI
  BNBW
  CLRBWIBC
  CLRWBC
  DCBQ
  RLDICL
  RLDICR
  RLDIMI

A PPE42 GCC compiler is available here:
https://github.com/open-power/ppe42-gcc

For more information on the PPE42 processors please visit:
https://wiki.raptorcs.com/w/images/a/a3/PPE_42X_Core_Users_Manual.pdf

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-7-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-7-milesg@linux.ibm.com>
---
 target/ppc/insn32.decode            |  66 ++-
 target/ppc/translate.c              |  29 +-
 target/ppc/translate/ppe-impl.c.inc | 609 ++++++++++++++++++++++++++++
 3 files changed, 694 insertions(+), 10 deletions(-)
 create mode 100644 target/ppc/translate/ppe-impl.c.inc

diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
index e53fd2840d..16652b5c13 100644
--- a/target/ppc/insn32.decode
+++ b/target/ppc/insn32.decode
@@ -58,6 +58,10 @@
 %ds_rtp         22:4   !function=times_2
 @DS_rtp         ...... ....0 ra:5 .............. ..             &D rt=%ds_rtp si=%ds_si
 
+%dd_si          3:s13
+&DD             rt ra si:int64_t
+@DD             ...... rt:5 ra:5 ............. . ..             &DD si=%dd_si
+
 &DX_b           vrt b
 %dx_b           6:10 16:5 0:1
 @DX_b           ...... vrt:5  ..... .......... ..... .          &DX_b b=%dx_b
@@ -66,6 +70,11 @@
 %dx_d           6:s10 16:5 0:1
 @DX             ...... rt:5  ..... .......... ..... .           &DX d=%dx_d
 
+%md_sh          1:1 11:5
+%md_mb          5:1 6:5
+&MD             rs ra sh mb rc
+@MD             ...... rs:5 ra:5 ..... ...... ... . rc:1        &MD sh=%md_sh mb=%md_mb
+
 &VA             vrt vra vrb rc
 @VA             ...... vrt:5 vra:5 vrb:5 rc:5 ......            &VA
 
@@ -322,6 +331,13 @@ LDUX            011111 ..... ..... ..... 0000110101 -   @X
 
 LQ              111000 ..... ..... ............ ----    @DQ_rtp
 
+LVD             000101 ..... ..... ................     @D
+LVDU            001001 ..... ..... ................     @D
+LVDX            011111 ..... ..... ..... 0000010001 -   @X
+LSKU            111010 ..... ..... ............. 0 11   @DD
+LCXU            111010 ..... ..... ............. 1 11   @DD
+
+
 ### Fixed-Point Store Instructions
 
 STB             100110 ..... ..... ................     @D
@@ -346,6 +362,11 @@ STDUX           011111 ..... ..... ..... 0010110101 -   @X
 
 STQ             111110 ..... ..... ..............10     @DS_rtp
 
+STVDU           010110 ..... ..... ................     @D
+STVDX           011111 ..... ..... ..... 0010010001 -   @X
+STSKU           111110 ..... ..... ............. 0 11   @DD
+STCXU           111110 ..... ..... ............. 1 11   @DD
+
 ### Fixed-Point Compare Instructions
 
 CMP             011111 ... - . ..... ..... 0000000000 - @X_bfl
@@ -461,8 +482,14 @@ PRTYD           011111 ..... ..... ----- 0010111010 -   @X_sa
 
 BPERMD          011111 ..... ..... ..... 0011111100 -   @X
 CFUGED          011111 ..... ..... ..... 0011011100 -   @X
-CNTLZDM         011111 ..... ..... ..... 0000111011 -   @X
-CNTTZDM         011111 ..... ..... ..... 1000111011 -   @X
+{
+  SLVD            011111 ..... ..... ..... 0000111011 .   @X_rc
+  CNTLZDM         011111 ..... ..... ..... 0000111011 -   @X
+}
+{
+  SRVD            011111 ..... ..... ..... 1000111011 .   @X_rc
+  CNTTZDM         011111 ..... ..... ..... 1000111011 -   @X
+}
 PDEPD           011111 ..... ..... ..... 0010011100 -   @X
 PEXTD           011111 ..... ..... ..... 0010111100 -   @X
 
@@ -981,8 +1008,16 @@ LXSSP           111001 ..... ..... .............. 11    @DS
 STXSSP          111101 ..... ..... .............. 11    @DS
 LXV             111101 ..... ..... ............ . 001   @DQ_TSX
 STXV            111101 ..... ..... ............ . 101   @DQ_TSX
-LXVP            000110 ..... ..... ............ 0000    @DQ_TSXP
-STXVP           000110 ..... ..... ............ 0001    @DQ_TSXP
+
+# STVD PPE instruction overlaps with the LXVP and STXVP instructions
+{
+  STVD          000110 ..... ..... ................     @D
+  [
+    LXVP        000110 ..... ..... ............ 0000    @DQ_TSXP
+    STXVP       000110 ..... ..... ............ 0001    @DQ_TSXP
+  ]
+}
+
 LXVX            011111 ..... ..... ..... 0100 - 01100 . @X_TSX
 STXVX           011111 ..... ..... ..... 0110001100 .   @X_TSX
 LXVPX           011111 ..... ..... ..... 0101001101 -   @X_TSXP
@@ -1300,3 +1335,26 @@ CLRBHRB         011111 ----- ----- ----- 0110101110 -
 ## Misc POWER instructions
 
 ATTN            000000 00000 00000 00000 0100000000 0
+
+# Fused compare-branch instructions for PPE only
+%fcb_bdx        1:s10  !function=times_4
+&FCB            px:bool ra rb:uint64_t bdx lk:bool
+@FCB            ...... .. px:1 .. ra:5 rb:5 .......... lk:1       &FCB bdx=%fcb_bdx
+&FCB_bix        px:bool bix ra rb:uint64_t bdx lk:bool
+@FCB_bix        ...... .. px:1 bix:2 ra:5 rb:5 .......... lk:1    &FCB_bix bdx=%fcb_bdx
+
+CMPWBC          000001 00 . .. ..... ..... .......... .     @FCB_bix
+CMPLWBC         000001 01 . .. ..... ..... .......... .     @FCB_bix
+CMPWIBC         000001 10 . .. ..... ..... .......... .     @FCB_bix
+BNBWI           000001 11 . 00 ..... ..... .......... .     @FCB
+BNBW            000001 11 . 01 ..... ..... .......... .     @FCB
+CLRBWIBC        000001 11 . 10 ..... ..... .......... .     @FCB
+CLRBWBC         000001 11 . 11 ..... ..... .......... .     @FCB
+
+# Data Cache Block Query for PPE only
+DCBQ            011111 ..... ..... ..... 0110010110 -       @X
+
+# Rotate Doubleword Instructions for PPE only
+RLDICL          011110 ..... ..... ..... ...... 000 . .     @MD
+RLDICR          011110 ..... ..... ..... ...... 001 . .     @MD
+RLDIMI          011110 ..... ..... ..... ...... 011 . .     @MD
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index fc817dab54..d422789a1d 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -209,6 +209,11 @@ struct DisasContext {
 #define DISAS_CHAIN        DISAS_TARGET_2  /* lookup next tb, pc updated */
 #define DISAS_CHAIN_UPDATE DISAS_TARGET_3  /* lookup next tb, pc stale */
 
+static inline bool is_ppe(const DisasContext *ctx)
+{
+    return !!(ctx->flags & POWERPC_FLAG_PPE42);
+}
+
 /* Return true iff byteswap is needed in a scalar memop */
 static inline bool need_byteswap(const DisasContext *ctx)
 {
@@ -556,11 +561,8 @@ void spr_access_nop(DisasContext *ctx, int sprn, int gprn)
 
 #endif
 
-/* SPR common to all PowerPC */
-/* XER */
-void spr_read_xer(DisasContext *ctx, int gprn, int sprn)
+static void gen_get_xer(DisasContext *ctx, TCGv dst)
 {
-    TCGv dst = cpu_gpr[gprn];
     TCGv t0 = tcg_temp_new();
     TCGv t1 = tcg_temp_new();
     TCGv t2 = tcg_temp_new();
@@ -579,9 +581,16 @@ void spr_read_xer(DisasContext *ctx, int gprn, int sprn)
     }
 }
 
-void spr_write_xer(DisasContext *ctx, int sprn, int gprn)
+/* SPR common to all PowerPC */
+/* XER */
+void spr_read_xer(DisasContext *ctx, int gprn, int sprn)
+{
+    TCGv dst = cpu_gpr[gprn];
+    gen_get_xer(ctx, dst);
+}
+
+static void gen_set_xer(DisasContext *ctx, TCGv src)
 {
-    TCGv src = cpu_gpr[gprn];
     /* Write all flags, while reading back check for isa300 */
     tcg_gen_andi_tl(cpu_xer, src,
                     ~((1u << XER_SO) |
@@ -594,6 +603,12 @@ void spr_write_xer(DisasContext *ctx, int sprn, int gprn)
     tcg_gen_extract_tl(cpu_ca, src, XER_CA, 1);
 }
 
+void spr_write_xer(DisasContext *ctx, int sprn, int gprn)
+{
+    TCGv src = cpu_gpr[gprn];
+    gen_set_xer(ctx, src);
+}
+
 /* LR */
 void spr_read_lr(DisasContext *ctx, int gprn, int sprn)
 {
@@ -5755,6 +5770,8 @@ static bool resolve_PLS_D(DisasContext *ctx, arg_D *d, arg_PLS_D *a)
 
 #include "translate/bhrb-impl.c.inc"
 
+#include "translate/ppe-impl.c.inc"
+
 /* Handles lfdp */
 static void gen_dform39(DisasContext *ctx)
 {
diff --git a/target/ppc/translate/ppe-impl.c.inc b/target/ppc/translate/ppe-impl.c.inc
new file mode 100644
index 0000000000..0a0590344e
--- /dev/null
+++ b/target/ppc/translate/ppe-impl.c.inc
@@ -0,0 +1,609 @@
+/*
+ * IBM PPE Instructions
+ *
+ * Copyright (c) 2025, IBM Corporation.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+
+static bool vdr_is_valid(uint32_t vdr)
+{
+    const uint32_t valid_bitmap = 0xf00003ff;
+    return !!((1ul << (vdr & 0x1f)) & valid_bitmap);
+}
+
+static bool ppe_gpr_is_valid(uint32_t reg)
+{
+    const uint32_t valid_bitmap = 0xf00027ff;
+    return !!((1ul << (reg & 0x1f)) & valid_bitmap);
+}
+
+#define CHECK_VDR(CTX, VDR)                             \
+    do {                                                \
+        if (unlikely(!vdr_is_valid(VDR))) {             \
+            gen_invalid(CTX);                           \
+            return true;                                \
+        }                                               \
+    } while (0)
+
+#define CHECK_PPE_GPR(CTX, REG)                         \
+    do {                                                \
+        if (unlikely(!ppe_gpr_is_valid(REG))) {         \
+            gen_invalid(CTX);                           \
+            return true;                                \
+        }                                               \
+    } while (0)
+
+#define VDR_PAIR_REG(VDR) (((VDR) + 1) & 0x1f)
+
+#define CHECK_PPE_LEVEL(CTX, LVL)                       \
+    do {                                                \
+        if (unlikely(!((CTX)->insns_flags2 & (LVL)))) { \
+            gen_invalid(CTX);                           \
+            return true;                                \
+        }                                               \
+    } while (0)
+
+static bool trans_LCXU(DisasContext *ctx, arg_LCXU *a)
+{
+    int i;
+    TCGv base, EA;
+    TCGv lo, hi;
+    TCGv_i64 t8;
+    const uint8_t vd_list[] = {9, 7, 5, 3, 0};
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_PPE_GPR(ctx, a->rt);
+
+    if (unlikely((a->rt != a->ra) || (a->ra == 0) || (a->si < 0xB))) {
+        gen_invalid(ctx);
+        return true;
+    }
+
+    EA = tcg_temp_new();
+    base = tcg_temp_new();
+
+    tcg_gen_addi_tl(base, cpu_gpr[a->ra], a->si * 8);
+    gen_store_spr(SPR_PPE42_EDR, base);
+
+    t8 = tcg_temp_new_i64();
+
+    tcg_gen_addi_tl(EA, base, -8);
+    tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    tcg_gen_extr_i64_tl(cpu_gpr[31], cpu_gpr[30], t8);
+
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    tcg_gen_extr_i64_tl(cpu_gpr[29], cpu_gpr[28], t8);
+
+    lo = tcg_temp_new();
+    hi = tcg_temp_new();
+
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    tcg_gen_extr_i64_tl(lo, hi, t8);
+    gen_store_spr(SPR_SRR0, hi);
+    gen_store_spr(SPR_SRR1, lo);
+
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    tcg_gen_extr_i64_tl(lo, hi, t8);
+    gen_set_xer(ctx, hi);
+    tcg_gen_mov_tl(cpu_ctr, lo);
+
+    for (i = 0; i < sizeof(vd_list); i++) {
+        int vd = vd_list[i];
+        tcg_gen_addi_tl(EA, EA, -8);
+        tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+        tcg_gen_extr_i64_tl(cpu_gpr[VDR_PAIR_REG(vd)], cpu_gpr[vd], t8);
+    }
+
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    tcg_gen_extr_i64_tl(lo, hi, t8);
+    tcg_gen_shri_tl(hi, hi, 28);
+    tcg_gen_trunc_tl_i32(cpu_crf[0], hi);
+    gen_store_spr(SPR_SPRG0, lo);
+
+    tcg_gen_addi_tl(EA, base, 4);
+    tcg_gen_qemu_ld_tl(cpu_lr, EA, ctx->mem_idx, DEF_MEMOP(MO_32) | MO_ALIGN);
+    tcg_gen_mov_tl(cpu_gpr[a->ra], base);
+    return true;
+}
+
+static bool trans_LSKU(DisasContext *ctx, arg_LSKU *a)
+{
+    int64_t n;
+    TCGv base, EA;
+    TCGv lo, hi;
+    TCGv_i64 t8;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_PPE_GPR(ctx, a->rt);
+
+    if (unlikely((a->rt != a->ra) || (a->ra == 0) ||
+                 (a->si & PPC_BIT(0)) || (a->si == 0))) {
+        gen_invalid(ctx);
+        return true;
+    }
+
+    EA = tcg_temp_new();
+    base = tcg_temp_new();
+    gen_addr_register(ctx, base);
+
+
+    tcg_gen_addi_tl(base, base, a->si * 8);
+    gen_store_spr(SPR_PPE42_EDR, base);
+
+    n = a->si - 1;
+    t8 = tcg_temp_new_i64();
+    if (n > 0) {
+        tcg_gen_addi_tl(EA, base, -8);
+        tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+        hi = cpu_gpr[30];
+        lo = cpu_gpr[31];
+        tcg_gen_extr_i64_tl(lo, hi, t8);
+    }
+    if (n > 1) {
+        tcg_gen_addi_tl(EA, base, -16);
+        tcg_gen_qemu_ld_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+        hi = cpu_gpr[28];
+        lo = cpu_gpr[29];
+        tcg_gen_extr_i64_tl(lo, hi, t8);
+    }
+    tcg_gen_addi_tl(EA, base, 4);
+    tcg_gen_qemu_ld_tl(cpu_lr, EA, ctx->mem_idx, DEF_MEMOP(MO_32) | MO_ALIGN);
+    tcg_gen_mov_tl(cpu_gpr[a->ra], base);
+    return true;
+}
+
+static bool trans_STCXU(DisasContext *ctx, arg_STCXU *a)
+{
+    TCGv EA;
+    TCGv lo, hi;
+    TCGv_i64 t8;
+    int i;
+    const uint8_t vd_list[] = {9, 7, 5, 3, 0};
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_PPE_GPR(ctx, a->rt);
+
+    if (unlikely((a->rt != a->ra) || (a->ra == 0) || !(a->si & PPC_BIT(0)))) {
+        gen_invalid(ctx);
+        return true;
+    }
+
+    EA = tcg_temp_new();
+    tcg_gen_addi_tl(EA, cpu_gpr[a->ra], 4);
+    tcg_gen_qemu_st_tl(cpu_lr, EA, ctx->mem_idx, DEF_MEMOP(MO_32) | MO_ALIGN);
+
+    gen_store_spr(SPR_PPE42_EDR, cpu_gpr[a->ra]);
+
+    t8 = tcg_temp_new_i64();
+
+    tcg_gen_concat_tl_i64(t8, cpu_gpr[31], cpu_gpr[30]);
+    tcg_gen_addi_tl(EA, cpu_gpr[a->ra], -8);
+    tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+
+    tcg_gen_concat_tl_i64(t8, cpu_gpr[29], cpu_gpr[28]);
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+
+    lo = tcg_temp_new();
+    hi = tcg_temp_new();
+
+    gen_load_spr(hi, SPR_SRR0);
+    gen_load_spr(lo, SPR_SRR1);
+    tcg_gen_concat_tl_i64(t8, lo, hi);
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+
+    gen_get_xer(ctx, hi);
+    tcg_gen_mov_tl(lo, cpu_ctr);
+    tcg_gen_concat_tl_i64(t8, lo, hi);
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+
+    for (i = 0; i < sizeof(vd_list); i++) {
+        int vd = vd_list[i];
+        tcg_gen_concat_tl_i64(t8, cpu_gpr[VDR_PAIR_REG(vd)], cpu_gpr[vd]);
+        tcg_gen_addi_tl(EA, EA, -8);
+        tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    }
+
+    gen_load_spr(lo, SPR_SPRG0);
+    tcg_gen_extu_i32_tl(hi, cpu_crf[0]);
+    tcg_gen_shli_tl(hi, hi, 28);
+    tcg_gen_concat_tl_i64(t8, lo, hi);
+    tcg_gen_addi_tl(EA, EA, -8);
+    tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+
+    tcg_gen_addi_tl(EA, cpu_gpr[a->ra], a->si * 8);
+    tcg_gen_qemu_st_tl(cpu_gpr[a->rt], EA, ctx->mem_idx, DEF_MEMOP(MO_32) |
+                                                          MO_ALIGN);
+    tcg_gen_mov_tl(cpu_gpr[a->ra], EA);
+    return true;
+}
+
+static bool trans_STSKU(DisasContext *ctx, arg_STSKU *a)
+{
+    int64_t n;
+    TCGv base, EA;
+    TCGv lo, hi;
+    TCGv_i64 t8;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_PPE_GPR(ctx, a->rt);
+
+    if (unlikely((a->rt != a->ra) || (a->ra == 0) || !(a->si & PPC_BIT(0)))) {
+        gen_invalid(ctx);
+        return true;
+    }
+
+    EA = tcg_temp_new();
+    base = tcg_temp_new();
+    gen_addr_register(ctx, base);
+    tcg_gen_addi_tl(EA, base, 4);
+    tcg_gen_qemu_st_tl(cpu_lr, EA, ctx->mem_idx, DEF_MEMOP(MO_32) | MO_ALIGN);
+
+    gen_store_spr(SPR_PPE42_EDR, base);
+
+    n = ~(a->si);
+
+    t8 = tcg_temp_new_i64();
+    if (n > 0) {
+        hi = cpu_gpr[30];
+        lo = cpu_gpr[31];
+        tcg_gen_concat_tl_i64(t8, lo, hi);
+        tcg_gen_addi_tl(EA, base, -8);
+        tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    }
+    if (n > 1) {
+        hi = cpu_gpr[28];
+        lo = cpu_gpr[29];
+        tcg_gen_concat_tl_i64(t8, lo, hi);
+        tcg_gen_addi_tl(EA, base, -16);
+        tcg_gen_qemu_st_i64(t8, EA, ctx->mem_idx, DEF_MEMOP(MO_64) | MO_ALIGN);
+    }
+
+    tcg_gen_addi_tl(EA, base, a->si * 8);
+    tcg_gen_qemu_st_tl(cpu_gpr[a->rt], EA, ctx->mem_idx, DEF_MEMOP(MO_32) |
+                                                          MO_ALIGN);
+    tcg_gen_mov_tl(cpu_gpr[a->ra], EA);
+    return true;
+}
+
+static bool do_ppe_ldst(DisasContext *ctx, int rt, int ra, TCGv disp,
+                        bool update, bool store)
+{
+    TCGv ea;
+    int rt_lo;
+    TCGv_i64 t8;
+
+    CHECK_VDR(ctx, rt);
+    CHECK_PPE_GPR(ctx, ra);
+    rt_lo = VDR_PAIR_REG(rt);
+    if (update && (ra == 0 || (!store && ((ra == rt) || (ra == rt_lo))))) {
+        gen_invalid(ctx);
+        return true;
+    }
+    gen_set_access_type(ctx, ACCESS_INT);
+
+    ea = do_ea_calc(ctx, ra, disp);
+    t8 = tcg_temp_new_i64();
+    if (store) {
+        tcg_gen_concat_tl_i64(t8, cpu_gpr[rt_lo], cpu_gpr[rt]);
+        tcg_gen_qemu_st_i64(t8, ea, ctx->mem_idx, DEF_MEMOP(MO_64));
+    } else {
+        tcg_gen_qemu_ld_i64(t8, ea, ctx->mem_idx, DEF_MEMOP(MO_64));
+        tcg_gen_extr_i64_tl(cpu_gpr[rt_lo], cpu_gpr[rt], t8);
+    }
+    if (update) {
+        tcg_gen_mov_tl(cpu_gpr[ra], ea);
+    }
+    return true;
+}
+
+static bool do_ppe_ldst_D(DisasContext *ctx, arg_D *a, bool update, bool store)
+{
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    return do_ppe_ldst(ctx, a->rt, a->ra, tcg_constant_tl(a->si), update,
+                       store);
+}
+
+static bool do_ppe_ldst_X(DisasContext *ctx, arg_X *a, bool store)
+{
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_GPR(ctx, a->rb);
+    return do_ppe_ldst(ctx, a->rt, a->ra, cpu_gpr[a->rb], false, store);
+}
+
+TRANS(LVD,   do_ppe_ldst_D, false, false)
+TRANS(LVDU,  do_ppe_ldst_D, true,  false)
+TRANS(STVD,  do_ppe_ldst_D, false, true)
+TRANS(STVDU, do_ppe_ldst_D, true,  true)
+TRANS(LVDX,  do_ppe_ldst_X, false)
+TRANS(STVDX, do_ppe_ldst_X, true)
+
+
+static bool do_fcb(DisasContext *ctx, TCGv ra_val, TCGv rb_val, int bix,
+                          int32_t bdx, bool s, bool px, bool lk)
+{
+    TCGCond cond;
+    uint32_t mask;
+    TCGLabel *no_branch;
+    target_ulong dest;
+
+    /* Update CR0 */
+    gen_op_cmp32(ra_val, rb_val, s, 0);
+
+    if (lk) {
+        gen_setlr(ctx, ctx->base.pc_next);
+    }
+
+
+    mask = PPC_BIT32(28 + bix);
+    cond = (px) ? TCG_COND_TSTEQ : TCG_COND_TSTNE;
+    no_branch = gen_new_label();
+    dest = ctx->cia + bdx;
+
+    /* Do the branch if CR0[bix] == PX */
+    tcg_gen_brcondi_i32(cond, cpu_crf[0], mask, no_branch);
+    gen_goto_tb(ctx, 0, dest);
+    gen_set_label(no_branch);
+    gen_goto_tb(ctx, 1, ctx->base.pc_next);
+    ctx->base.is_jmp = DISAS_NORETURN;
+    return true;
+}
+
+static bool do_cmp_branch(DisasContext *ctx, arg_FCB_bix *a, bool s,
+                          bool rb_is_gpr)
+{
+    TCGv old_ra;
+    TCGv rb_val;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_GPR(ctx, a->ra);
+    if (rb_is_gpr) {
+        CHECK_PPE_GPR(ctx, a->rb);
+        rb_val = cpu_gpr[a->rb];
+    } else {
+        rb_val = tcg_constant_tl(a->rb);
+    }
+    if (a->bix == 3) {
+        old_ra = tcg_temp_new();
+        tcg_gen_mov_tl(old_ra, cpu_gpr[a->ra]);
+        tcg_gen_sub_tl(cpu_gpr[a->ra], cpu_gpr[a->ra], rb_val);
+        return do_fcb(ctx, old_ra, rb_val, 2,
+                      a->bdx, s, a->px, a->lk);
+    } else {
+        return do_fcb(ctx, cpu_gpr[a->ra], rb_val, a->bix,
+                      a->bdx, s, a->px, a->lk);
+    }
+}
+
+TRANS(CMPWBC, do_cmp_branch, true, true)
+TRANS(CMPLWBC, do_cmp_branch, false, true)
+TRANS(CMPWIBC, do_cmp_branch, true, false)
+
+static bool do_mask_branch(DisasContext *ctx, arg_FCB * a, bool invert,
+                           bool update, bool rb_is_gpr)
+{
+    TCGv r;
+    TCGv mask, shift;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_GPR(ctx, a->ra);
+    if (rb_is_gpr) {
+        CHECK_PPE_GPR(ctx, a->rb);
+        mask = tcg_temp_new();
+        shift = tcg_temp_new();
+        tcg_gen_andi_tl(shift, cpu_gpr[a->rb], 0x1f);
+        tcg_gen_shr_tl(mask, tcg_constant_tl(0x80000000), shift);
+    } else {
+        mask = tcg_constant_tl(PPC_BIT32(a->rb));
+    }
+    if (invert) {
+        tcg_gen_not_tl(mask, mask);
+    }
+
+    /* apply mask to ra */
+    r = tcg_temp_new();
+    tcg_gen_and_tl(r, cpu_gpr[a->ra], mask);
+    if (update) {
+        tcg_gen_mov_tl(cpu_gpr[a->ra], r);
+    }
+    return do_fcb(ctx, r, tcg_constant_tl(0), 2,
+                  a->bdx, false, a->px, a->lk);
+}
+
+TRANS(BNBWI,    do_mask_branch, false, false, false)
+TRANS(BNBW,     do_mask_branch, false, false, true)
+TRANS(CLRBWIBC, do_mask_branch, true,  true,  false)
+TRANS(CLRBWBC,  do_mask_branch, true,  true,  true)
+
+static void gen_set_Rc0_i64(DisasContext *ctx, TCGv_i64 reg)
+{
+    TCGv_i64 t0 = tcg_temp_new_i64();
+    TCGv_i64 t1 = tcg_temp_new_i64();
+    TCGv_i32 t = tcg_temp_new_i32();
+
+    tcg_gen_movi_i64(t0, CRF_EQ);
+    tcg_gen_movi_i64(t1, CRF_LT);
+    tcg_gen_movcond_i64(TCG_COND_LT, t0, reg, tcg_constant_i64(0), t1, t0);
+    tcg_gen_movi_i64(t1, CRF_GT);
+    tcg_gen_movcond_i64(TCG_COND_GT, t0, reg, tcg_constant_i64(0), t1, t0);
+    tcg_gen_extrl_i64_i32(t, t0);
+    tcg_gen_trunc_tl_i32(cpu_crf[0], cpu_so);
+    tcg_gen_or_i32(cpu_crf[0], cpu_crf[0], t);
+}
+
+static bool do_shift64(DisasContext *ctx, arg_X_rc *a, bool left)
+{
+    int rt_lo, ra_lo;
+    TCGv_i64 t0, t8;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_VDR(ctx, a->rt);
+    CHECK_VDR(ctx, a->ra);
+    CHECK_PPE_GPR(ctx, a->rb);
+    rt_lo = VDR_PAIR_REG(a->rt);
+    ra_lo = VDR_PAIR_REG(a->ra);
+    t8 = tcg_temp_new_i64();
+
+    /* AND rt with a mask that is 0 when rb >= 0x40 */
+    t0 = tcg_temp_new_i64();
+    tcg_gen_extu_tl_i64(t0, cpu_gpr[a->rb]);
+    tcg_gen_shli_i64(t0, t0, 0x39);
+    tcg_gen_sari_i64(t0, t0, 0x3f);
+
+    /* form 64bit value from two 32bit regs */
+    tcg_gen_concat_tl_i64(t8, cpu_gpr[rt_lo], cpu_gpr[a->rt]);
+
+    /* apply mask */
+    tcg_gen_andc_i64(t8, t8, t0);
+
+    /* do the shift */
+    tcg_gen_extu_tl_i64(t0, cpu_gpr[a->rb]);
+    tcg_gen_andi_i64(t0, t0, 0x3f);
+    if (left) {
+        tcg_gen_shl_i64(t8, t8, t0);
+    } else {
+        tcg_gen_shr_i64(t8, t8, t0);
+    }
+
+    /* split the 64bit word back into two 32bit regs */
+    tcg_gen_extr_i64_tl(cpu_gpr[ra_lo], cpu_gpr[a->ra], t8);
+
+    /* update CR0 if requested */
+    if (unlikely(a->rc != 0)) {
+        gen_set_Rc0_i64(ctx, t8);
+    }
+    return true;
+}
+
+TRANS(SRVD, do_shift64, false)
+TRANS(SLVD, do_shift64, true)
+
+static bool trans_DCBQ(DisasContext *ctx, arg_DCBQ * a)
+{
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+
+    CHECK_PPE_GPR(ctx, a->rt);
+    CHECK_PPE_GPR(ctx, a->ra);
+    CHECK_PPE_GPR(ctx, a->rb);
+
+    /* No cache exists, so just set RT to 0 */
+    tcg_gen_movi_tl(cpu_gpr[a->rt], 0);
+    return true;
+}
+
+static bool trans_RLDIMI(DisasContext *ctx, arg_RLDIMI *a)
+{
+    TCGv_i64 t_rs, t_ra;
+    int ra_lo, rs_lo;
+    uint32_t sh = a->sh;
+    uint32_t mb = a->mb;
+    uint32_t me = 63 - sh;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_VDR(ctx, a->rs);
+    CHECK_VDR(ctx, a->ra);
+
+    rs_lo = VDR_PAIR_REG(a->rs);
+    ra_lo = VDR_PAIR_REG(a->ra);
+
+    t_rs = tcg_temp_new_i64();
+    t_ra = tcg_temp_new_i64();
+
+    tcg_gen_concat_tl_i64(t_rs, cpu_gpr[rs_lo], cpu_gpr[a->rs]);
+    tcg_gen_concat_tl_i64(t_ra, cpu_gpr[ra_lo], cpu_gpr[a->ra]);
+
+    if (mb <= me) {
+        tcg_gen_deposit_i64(t_ra, t_ra, t_rs, sh, me - mb + 1);
+    } else {
+        uint64_t mask = mask_u64(mb, me);
+        TCGv_i64 t1 = tcg_temp_new_i64();
+
+        tcg_gen_rotli_i64(t1, t_rs, sh);
+        tcg_gen_andi_i64(t1, t1, mask);
+        tcg_gen_andi_i64(t_ra, t_ra, ~mask);
+        tcg_gen_or_i64(t_ra, t_ra, t1);
+    }
+
+    tcg_gen_extr_i64_tl(cpu_gpr[ra_lo], cpu_gpr[a->ra], t_ra);
+
+    if (unlikely(a->rc != 0)) {
+        gen_set_Rc0_i64(ctx, t_ra);
+    }
+    return true;
+}
+
+
+static bool gen_rldinm_i64(DisasContext *ctx, arg_MD *a, int mb, int me, int sh)
+{
+    int len = me - mb + 1;
+    int rsh = (64 - sh) & 63;
+    int ra_lo, rs_lo;
+    TCGv_i64 t8;
+
+    if (unlikely(!is_ppe(ctx))) {
+        return false;
+    }
+    CHECK_PPE_LEVEL(ctx, PPC2_PPE42X);
+    CHECK_VDR(ctx, a->rs);
+    CHECK_VDR(ctx, a->ra);
+
+    rs_lo = VDR_PAIR_REG(a->rs);
+    ra_lo = VDR_PAIR_REG(a->ra);
+    t8 = tcg_temp_new_i64();
+    tcg_gen_concat_tl_i64(t8, cpu_gpr[rs_lo], cpu_gpr[a->rs]);
+    if (sh != 0 && len > 0 && me == (63 - sh)) {
+        tcg_gen_deposit_z_i64(t8, t8, sh, len);
+    } else if (me == 63 && rsh + len <= 64) {
+        tcg_gen_extract_i64(t8, t8, rsh, len);
+    } else {
+        tcg_gen_rotli_i64(t8, t8, sh);
+        tcg_gen_andi_i64(t8, t8, mask_u64(mb, me));
+    }
+    tcg_gen_extr_i64_tl(cpu_gpr[ra_lo], cpu_gpr[a->ra], t8);
+    if (unlikely(a->rc != 0)) {
+        gen_set_Rc0_i64(ctx, t8);
+    }
+    return true;
+}
+
+TRANS(RLDICL, gen_rldinm_i64, a->mb, 63, a->sh)
+TRANS(RLDICR, gen_rldinm_i64, 0, a->mb, a->sh)

From 7197f6f7baf29fd76486920e5603e43b25880d3b Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:45 -0500
Subject: [PATCH 0737/2396] hw/ppc: Support for an IBM PPE42 CPU decrementer

The IBM PPE42 processors support a 32-bit decrementer
that can raise an external interrupt when DEC[0]
transitions from a 0 to a -1 (a non-negative value to a
negative value).  It also continues decrementing
even after this condition is met.

The BookE timer is slightly different in that it
raises an interrupt when the DEC value reaches 0
and stops decrementing at that point.

Support a PPE42 version of the BookE timer by
adding a new PPC_TIMER_PPE flag that has the timer
code look for the transition from a non-negative value
to a negative value and allows the value to
continue decrementing.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-8-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-8-milesg@linux.ibm.com>
---
 hw/ppc/ppc_booke.c   | 7 ++++++-
 include/hw/ppc/ppc.h | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/ppc_booke.c b/hw/ppc/ppc_booke.c
index 3872ae2822..13403a56b1 100644
--- a/hw/ppc/ppc_booke.c
+++ b/hw/ppc/ppc_booke.c
@@ -352,7 +352,12 @@ void ppc_booke_timers_init(PowerPCCPU *cpu, uint32_t freq, uint32_t flags)
     booke_timer = g_new0(booke_timer_t, 1);
 
     cpu->env.tb_env = tb_env;
-    tb_env->flags = flags | PPC_TIMER_BOOKE | PPC_DECR_ZERO_TRIGGERED;
+    if (flags & PPC_TIMER_PPE) {
+        /* PPE's use a modified version of the booke behavior */
+        tb_env->flags = flags | PPC_DECR_UNDERFLOW_TRIGGERED;
+    } else {
+        tb_env->flags = flags | PPC_TIMER_BOOKE | PPC_DECR_ZERO_TRIGGERED;
+    }
 
     tb_env->tb_freq    = freq;
     tb_env->decr_freq  = freq;
diff --git a/include/hw/ppc/ppc.h b/include/hw/ppc/ppc.h
index 8a14d623f8..cb51d704c6 100644
--- a/include/hw/ppc/ppc.h
+++ b/include/hw/ppc/ppc.h
@@ -52,6 +52,7 @@ struct ppc_tb_t {
 #define PPC_DECR_UNDERFLOW_LEVEL     (1 << 4) /* Decr interrupt active when
                                                * the most significant bit is 1.
                                                */
+#define PPC_TIMER_PPE                (1 << 5) /* Enable PPE support */
 
 uint64_t cpu_ppc_get_tb(ppc_tb_t *tb_env, uint64_t vmclk, int64_t tb_offset);
 void cpu_ppc_tb_init(CPUPPCState *env, uint32_t freq);

From 0ad5b8d9c8fdaa21c8384404d53fc2d86842beba Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:46 -0500
Subject: [PATCH 0738/2396] hw/ppc: Add a test machine for the IBM PPE42 CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a test machine for the IBM PPE42 processor, including a
DEC, FIT, WDT and 512 KiB of ram.

The purpose of this machine is only to provide a generic platform
for testing instructions of the recently  added PPE42 processor
model which is used extensively in the IBM Power9, Power10 and
future Power server processors.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-9-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-9-milesg@linux.ibm.com>
---
 MAINTAINERS            |   6 +++
 hw/ppc/Kconfig         |   5 ++
 hw/ppc/meson.build     |   2 +
 hw/ppc/ppe42_machine.c | 101 +++++++++++++++++++++++++++++++++++++++++
 4 files changed, 114 insertions(+)
 create mode 100644 hw/ppc/ppe42_machine.c

diff --git a/MAINTAINERS b/MAINTAINERS
index 7d134a85e6..2ed9eb9353 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1530,6 +1530,12 @@ F: include/hw/pci-host/grackle.h
 F: pc-bios/qemu_vga.ndrv
 F: tests/functional/ppc/test_mac.py
 
+PPE42
+M: Glenn Miles <milesg@linux.ibm.com>
+L: qemu-ppc@nongnu.org
+S: Odd Fixes
+F: hw/ppc/ppe42_machine.c
+
 PReP
 M: Hervé Poussineau <hpoussin@reactos.org>
 L: qemu-ppc@nongnu.org
diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
index ced6bbc740..7091d72fd8 100644
--- a/hw/ppc/Kconfig
+++ b/hw/ppc/Kconfig
@@ -44,6 +44,11 @@ config POWERNV
     select SSI_M25P80
     select PNV_SPI
 
+config PPC405
+    bool
+    default y
+    depends on PPC
+
 config PPC440
     bool
     default y
diff --git a/hw/ppc/meson.build b/hw/ppc/meson.build
index 9893f8adeb..170b90ae7d 100644
--- a/hw/ppc/meson.build
+++ b/hw/ppc/meson.build
@@ -57,6 +57,8 @@ ppc_ss.add(when: 'CONFIG_POWERNV', if_true: files(
   'pnv_n1_chiplet.c',
 ))
 # PowerPC 4xx boards
+ppc_ss.add(when: 'CONFIG_PPC405', if_true: files(
+  'ppe42_machine.c'))
 ppc_ss.add(when: 'CONFIG_PPC440', if_true: files(
   'ppc440_bamboo.c',
   'ppc440_uc.c'))
diff --git a/hw/ppc/ppe42_machine.c b/hw/ppc/ppe42_machine.c
new file mode 100644
index 0000000000..f14a91b4e4
--- /dev/null
+++ b/hw/ppc/ppe42_machine.c
@@ -0,0 +1,101 @@
+/*
+ * Test Machine for the IBM PPE42 processor
+ *
+ * Copyright (c) 2025, IBM Corporation.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qemu/error-report.h"
+#include "system/address-spaces.h"
+#include "hw/boards.h"
+#include "hw/ppc/ppc.h"
+#include "system/system.h"
+#include "system/reset.h"
+#include "system/kvm.h"
+#include "qapi/error.h"
+
+#define TYPE_PPE42_MACHINE MACHINE_TYPE_NAME("ppe42_machine")
+typedef MachineClass Ppe42MachineClass;
+typedef struct Ppe42MachineState Ppe42MachineState;
+DECLARE_OBJ_CHECKERS(Ppe42MachineState, Ppe42MachineClass,
+                     PPE42_MACHINE, TYPE_PPE42_MACHINE)
+
+struct Ppe42MachineState {
+    MachineState parent_obj;
+
+    PowerPCCPU cpu;
+};
+
+static void main_cpu_reset(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    cpu_reset(CPU(cpu));
+}
+
+static void ppe42_machine_init(MachineState *machine)
+{
+    Ppe42MachineState *pms = PPE42_MACHINE(machine);
+    PowerPCCPU *cpu = &pms->cpu;
+
+    if (kvm_enabled()) {
+        error_report("machine %s does not support the KVM accelerator",
+                     MACHINE_GET_CLASS(machine)->name);
+        exit(EXIT_FAILURE);
+    }
+    if (machine->ram_size > 512 * KiB) {
+        error_report("RAM size more than 512 KiB is not supported");
+        exit(1);
+    }
+
+    /* init CPU */
+    object_initialize_child(OBJECT(pms), "cpu", cpu, machine->cpu_type);
+    if (!qdev_realize(DEVICE(cpu), NULL, &error_fatal)) {
+        return;
+    }
+
+    qemu_register_reset(main_cpu_reset, cpu);
+
+    /* This sets the decrementer timebase */
+    ppc_booke_timers_init(cpu, 37500000, PPC_TIMER_PPE);
+
+    /* RAM */
+    memory_region_add_subregion(get_system_memory(), 0xfff80000, machine->ram);
+}
+
+
+static void ppe42_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    static const char * const valid_cpu_types[] = {
+        POWERPC_CPU_TYPE_NAME("PPE42"),
+        POWERPC_CPU_TYPE_NAME("PPE42X"),
+        POWERPC_CPU_TYPE_NAME("PPE42XM"),
+        NULL,
+    };
+
+    mc->desc = "PPE42 Test Machine";
+    mc->init = ppe42_machine_init;
+    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("PPE42XM");
+    mc->valid_cpu_types = valid_cpu_types;
+    mc->default_ram_id = "ram";
+    mc->default_ram_size = 512 * KiB;
+}
+
+static const TypeInfo ppe42_machine_info = {
+        .name          = TYPE_PPE42_MACHINE,
+        .parent        = TYPE_MACHINE,
+        .instance_size = sizeof(Ppe42MachineState),
+        .class_init    = ppe42_machine_class_init,
+        .class_size    = sizeof(Ppe42MachineClass),
+};
+
+static void ppe42_machine_register_types(void)
+{
+    type_register_static(&ppe42_machine_info);
+}
+
+type_init(ppe42_machine_register_types);

From fd93e521b01a5416bb7f106ac29d755bc3059aaa Mon Sep 17 00:00:00 2001
From: Glenn Miles <milesg@linux.ibm.com>
Date: Thu, 25 Sep 2025 15:17:47 -0500
Subject: [PATCH 0739/2396] tests/functional: Add test for IBM PPE42
 instructions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Adds a functional test for the IBM PPE42 instructions which
downloads a test image from a public github repo and then
loads and executes the image.
(see https://github.com/milesg-github/ppe42-tests for details)

Test status is checked by periodically issuing 'info register'
commands and checking the NIP value.  If the NIP is 0xFFF80200
then the test successfully executed to completion.  If the
machine stops before the test completes or if a 90 second
timeout is reached, then the test is marked as having failed.

This test does not test any PowerPC instructions as it is
expected that these instructions are well covered in other
tests.  Only instructions that are unique to the IBM PPE42
processor are tested.

Signed-off-by: Glenn Miles <milesg@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250925201758.652077-10-milesg@linux.ibm.com
Message-ID: <20250925201758.652077-10-milesg@linux.ibm.com>
---
 MAINTAINERS                        |  1 +
 tests/functional/ppc/meson.build   |  1 +
 tests/functional/ppc/test_ppe42.py | 79 ++++++++++++++++++++++++++++++
 3 files changed, 81 insertions(+)
 create mode 100644 tests/functional/ppc/test_ppe42.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 2ed9eb9353..406cef88f0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1535,6 +1535,7 @@ M: Glenn Miles <milesg@linux.ibm.com>
 L: qemu-ppc@nongnu.org
 S: Odd Fixes
 F: hw/ppc/ppe42_machine.c
+F: tests/functional/ppc/test_ppe42.py
 
 PReP
 M: Hervé Poussineau <hpoussin@reactos.org>
diff --git a/tests/functional/ppc/meson.build b/tests/functional/ppc/meson.build
index 3d562010d8..ae061fe5a6 100644
--- a/tests/functional/ppc/meson.build
+++ b/tests/functional/ppc/meson.build
@@ -15,6 +15,7 @@ tests_ppc_system_thorough = [
   'bamboo',
   'mac',
   'mpc8544ds',
+  'ppe42',
   'replay',
   'sam460ex',
   'tuxrun',
diff --git a/tests/functional/ppc/test_ppe42.py b/tests/functional/ppc/test_ppe42.py
new file mode 100644
index 0000000000..26bbe11b2d
--- /dev/null
+++ b/tests/functional/ppc/test_ppe42.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+#
+# Functional tests for the IBM PPE42 processor
+#
+# Copyright (c) 2025, IBM Corporation
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from qemu_test import QemuSystemTest, Asset
+import asyncio
+
+class Ppe42Machine(QemuSystemTest):
+
+    timeout = 90
+    poll_period = 1.0
+
+    ASSET_PPE42_TEST_IMAGE = Asset(
+        ('https://github.com/milesg-github/ppe42-tests/raw/refs/heads/main/'
+         'images/ppe42-test.out'),
+        '03c1ac0fb7f6c025102a02776a93b35101dae7c14b75e4eab36a337e39042ea8')
+
+    def _test_completed(self):
+        self.log.info("Checking for test completion...")
+        try:
+            output = self.vm.cmd('human-monitor-command',
+                                 command_line='info registers')
+        except Exception as err:
+            self.log.debug(f"'info registers' cmd failed due to {err=},"
+                            " {type(err)=}")
+            raise
+
+        self.log.info(output)
+        if "NIP fff80200" in output:
+            self.log.info("<test completed>")
+            return True
+        else:
+            self.log.info("<test not completed>")
+            return False
+
+    def _wait_pass_fail(self, timeout):
+        while not self._test_completed():
+            if timeout >= self.poll_period:
+                timeout = timeout - self.poll_period
+                self.log.info(f"Waiting {self.poll_period} seconds for test"
+                               " to complete...")
+                e = None
+                try:
+                    e = self.vm.event_wait('STOP', self.poll_period)
+
+                except asyncio.TimeoutError:
+                    self.log.info("Poll period ended.")
+                    pass
+
+                except Exception as err:
+                    self.log.debug(f"event_wait() failed due to {err=},"
+                                    " {type(err)=}")
+                    raise
+
+                if e != None:
+                    self.log.debug(f"Execution stopped: {e}")
+                    self.log.debug("Exiting due to test failure")
+                    self.fail("Failure detected!")
+                    break
+            else:
+                self.fail("Timed out waiting for test completion.")
+
+    def test_ppe42_instructions(self):
+        self.set_machine('ppe42_machine')
+        self.require_accelerator("tcg")
+        image_path = self.ASSET_PPE42_TEST_IMAGE.fetch()
+        self.vm.add_args('-nographic')
+        self.vm.add_args('-device', f'loader,file={image_path}')
+        self.vm.add_args('-device', 'loader,addr=0xfff80040,cpu-num=0')
+        self.vm.add_args('-action', 'panic=pause')
+        self.vm.launch()
+        self._wait_pass_fail(self.timeout)
+
+if __name__ == '__main__':
+    QemuSystemTest.main()

From f5738aedc21790bd07dbead6b6272a605d5c1138 Mon Sep 17 00:00:00 2001
From: Fabian Vogt <fvogt@suse.de>
Date: Tue, 19 Aug 2025 19:39:02 -0300
Subject: [PATCH 0740/2396] hw/intc/xics: Add missing call to register
 vmstate_icp_server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An obsolete wrapper function with a workaround was removed entirely,
without restoring the call it wrapped.

Without this, the guest is stuck after savevm/loadvm.

Fixes: 24ee9229fe31 ("ppc/spapr: remove deprecated machine pseries-2.9")
Signed-off-by: Fabian Vogt <fvogt@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/6187781.lOV4Wx5bFT@fvogt-thinkpad
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Gautam Menghani <gautam@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250819223905.2247-2-farosas@suse.de
Message-ID: <20250819223905.2247-2-farosas@suse.de>
---
 hw/intc/xics.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/intc/xics.c b/hw/intc/xics.c
index d9a199e883..200710eb6c 100644
--- a/hw/intc/xics.c
+++ b/hw/intc/xics.c
@@ -335,6 +335,8 @@ static void icp_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+
+    vmstate_register(NULL, icp->cs->cpu_index, &vmstate_icp_server, icp);
 }
 
 static void icp_unrealize(DeviceState *dev)

From 6285eebd3a5fea018eb51d696b51079f44dd1eb3 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 6 May 2025 00:29:03 -0400
Subject: [PATCH 0741/2396] ppc/spapr: init lrdr-capapcity phys with ram size
 if maxmem not provided

lrdr-capacity contains phys field which communicates the maximum address
in bytes and therefore, the most memory that can be allocated to this
partition. This is usually populated when maxmem is provided alongwith
memory size on qemu command line. However since maxmem is an optional
param, this leads to bits being set to 0 in absence of maxmem param.
Fix this by initializing the respective bits as per total mem size in
such case.

Reported-by: Gaurav Batra <gbatra@us.ibm.com>
Tested-by: David Christensen <drc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Shivaprasad G Bhat <sbhat@linux.ibm.com>
Link: https://lore.kernel.org/r/20250506042903.76250-1-harshpb@linux.ibm.com
Message-ID: <20250506042903.76250-1-harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index eb22333404..82fb23beaa 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -907,6 +907,7 @@ static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
     int rtas;
     GString *hypertas = g_string_sized_new(256);
     GString *qemu_hypertas = g_string_sized_new(256);
+    uint64_t max_device_addr = 0;
     uint32_t lrdr_capacity[] = {
         0,
         0,
@@ -917,13 +918,15 @@ static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
 
     /* Do we have device memory? */
     if (MACHINE(spapr)->device_memory) {
-        uint64_t max_device_addr = MACHINE(spapr)->device_memory->base +
+        max_device_addr = MACHINE(spapr)->device_memory->base +
             memory_region_size(&MACHINE(spapr)->device_memory->mr);
-
-        lrdr_capacity[0] = cpu_to_be32(max_device_addr >> 32);
-        lrdr_capacity[1] = cpu_to_be32(max_device_addr & 0xffffffff);
+    } else if (ms->ram_size == ms->maxram_size) {
+        max_device_addr = ms->ram_size;
     }
 
+    lrdr_capacity[0] = cpu_to_be32(max_device_addr >> 32);
+    lrdr_capacity[1] = cpu_to_be32(max_device_addr & 0xffffffff);
+
     _FDT(rtas = fdt_add_subnode(fdt, 0, "rtas"));
 
     /* hypertas */

From 936a0f208833083fc4f4f8aebfe0f63751d2b7d6 Mon Sep 17 00:00:00 2001
From: Gautam Menghani <gautam@linux.ibm.com>
Date: Mon, 11 Aug 2025 13:19:11 +0530
Subject: [PATCH 0742/2396] ppc/xive2: Fix integer overflow warning in
 xive2_redistribute()

Coverity reported an integer overflow warning in xive2_redistribute()
where the code does a left shift operation "0xffffffff << crowd". Fix the
warning by using a 64 byte integer type. Also refactor the calculation
into dedicated routines.

Resolves: Coverity CID 1612608
Fixes: 555e446019f5 ("ppc/xive2: Support redistribution of group interrupts")
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Gautam Menghani <gautam@linux.ibm.com>
Reviewed-by: Amit Machhiwal <amachhiw@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250811074912.162774-1-gautam@linux.ibm.com
Message-ID: <20250811074912.162774-1-gautam@linux.ibm.com>
---
 hw/intc/xive2.c | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/hw/intc/xive2.c b/hw/intc/xive2.c
index ee5fa26178..fbb3b7975e 100644
--- a/hw/intc/xive2.c
+++ b/hw/intc/xive2.c
@@ -95,6 +95,35 @@ static void xive2_nvgc_set_backlog(Xive2Nvgc *nvgc, uint8_t priority,
     }
 }
 
+static uint32_t xive2_nvgc_get_idx(uint32_t nvp_idx, uint8_t group)
+{
+    uint32_t nvgc_idx;
+
+    if (group > 0) {
+        nvgc_idx = (nvp_idx & (0xffffffffULL << group)) |
+                   ((1 << (group - 1)) - 1);
+    } else {
+        nvgc_idx = nvp_idx;
+    }
+
+    return nvgc_idx;
+}
+
+static uint8_t xive2_nvgc_get_blk(uint8_t nvp_blk, uint8_t crowd)
+{
+    uint8_t nvgc_blk;
+
+    if (crowd > 0) {
+        crowd = (crowd == 3) ? 4 : crowd;
+        nvgc_blk = (nvp_blk & (0xffffffffULL << crowd)) |
+                   ((1 << (crowd - 1)) - 1);
+    } else {
+        nvgc_blk = nvp_blk;
+    }
+
+    return nvgc_blk;
+}
+
 uint64_t xive2_presenter_nvgc_backlog_op(XivePresenter *xptr,
                                          bool crowd,
                                          uint8_t blk, uint32_t idx,
@@ -638,20 +667,8 @@ static void xive2_redistribute(Xive2Router *xrtr, XiveTCTX *tctx, uint8_t ring)
 
     trace_xive_redistribute(tctx->cs->cpu_index, ring, nvp_blk, nvp_idx);
     /* convert crowd/group to blk/idx */
-    if (group > 0) {
-        nvgc_idx = (nvp_idx & (0xffffffff << group)) |
-                   ((1 << (group - 1)) - 1);
-    } else {
-        nvgc_idx = nvp_idx;
-    }
-
-    if (crowd > 0) {
-        crowd = (crowd == 3) ? 4 : crowd;
-        nvgc_blk = (nvp_blk & (0xffffffff << crowd)) |
-                   ((1 << (crowd - 1)) - 1);
-    } else {
-        nvgc_blk = nvp_blk;
-    }
+    nvgc_idx = xive2_nvgc_get_idx(nvp_idx, group);
+    nvgc_blk = xive2_nvgc_get_blk(nvp_blk, crowd);
 
     /* Use blk/idx to retrieve the NVGC */
     if (xive2_router_get_nvgc(xrtr, crowd, nvgc_blk, nvgc_idx, &nvgc)) {

From f291e329e20e1ab4aafdde38533cadc11f2cf5a4 Mon Sep 17 00:00:00 2001
From: Chinmay Rath <rathc@linux.ibm.com>
Date: Thu, 19 Jun 2025 15:28:36 +0530
Subject: [PATCH 0743/2396] target/ppc: Move floating-point rounding and
 conversion instructions to decodetree.

Move below instructions to decodetree specification :

	fr{sp, in, iz, im}[s][.],
	fcti{w, d}[u, z, uz][s][.],
	fcfid[s, u, us][s][.]           : X-form

The changes were verified by validating that the tcg ops generated by
those instructions remain the same, which were captured with the '-d
in_asm,op' flag.

Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250619095840.369351-2-rathc@linux.ibm.com
Message-ID: <20250619095840.369351-2-rathc@linux.ibm.com>
---
 target/ppc/fpu_helper.c            | 34 +++++------
 target/ppc/helper.h                | 34 +++++------
 target/ppc/insn32.decode           | 24 ++++++++
 target/ppc/translate/fp-impl.c.inc | 97 ++++++++++++------------------
 target/ppc/translate/fp-ops.c.inc  | 21 -------
 5 files changed, 97 insertions(+), 113 deletions(-)

diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
index 07b782f971..503cbd98ad 100644
--- a/target/ppc/fpu_helper.c
+++ b/target/ppc/fpu_helper.c
@@ -562,14 +562,14 @@ uint64_t helper_##op(CPUPPCState *env, float64 arg)                    \
     return ret;                                                        \
 }
 
-FPU_FCTI(fctiw, int32, 0x80000000U)
-FPU_FCTI(fctiwz, int32_round_to_zero, 0x80000000U)
-FPU_FCTI(fctiwu, uint32, 0x00000000U)
-FPU_FCTI(fctiwuz, uint32_round_to_zero, 0x00000000U)
-FPU_FCTI(fctid, int64, 0x8000000000000000ULL)
-FPU_FCTI(fctidz, int64_round_to_zero, 0x8000000000000000ULL)
-FPU_FCTI(fctidu, uint64, 0x0000000000000000ULL)
-FPU_FCTI(fctiduz, uint64_round_to_zero, 0x0000000000000000ULL)
+FPU_FCTI(FCTIW, int32, 0x80000000U)
+FPU_FCTI(FCTIWZ, int32_round_to_zero, 0x80000000U)
+FPU_FCTI(FCTIWU, uint32, 0x00000000U)
+FPU_FCTI(FCTIWUZ, uint32_round_to_zero, 0x00000000U)
+FPU_FCTI(FCTID, int64, 0x8000000000000000ULL)
+FPU_FCTI(FCTIDZ, int64_round_to_zero, 0x8000000000000000ULL)
+FPU_FCTI(FCTIDU, uint64, 0x0000000000000000ULL)
+FPU_FCTI(FCTIDUZ, uint64_round_to_zero, 0x0000000000000000ULL)
 
 #define FPU_FCFI(op, cvtr, is_single)                      \
 uint64_t helper_##op(CPUPPCState *env, uint64_t arg)       \
@@ -586,10 +586,10 @@ uint64_t helper_##op(CPUPPCState *env, uint64_t arg)       \
     return farg.ll;                                        \
 }
 
-FPU_FCFI(fcfid, int64_to_float64, 0)
-FPU_FCFI(fcfids, int64_to_float32, 1)
-FPU_FCFI(fcfidu, uint64_to_float64, 0)
-FPU_FCFI(fcfidus, uint64_to_float32, 1)
+FPU_FCFI(FCFID, int64_to_float64, 0)
+FPU_FCFI(FCFIDS, int64_to_float32, 1)
+FPU_FCFI(FCFIDU, uint64_to_float64, 0)
+FPU_FCFI(FCFIDUS, uint64_to_float32, 1)
 
 static uint64_t do_fri(CPUPPCState *env, uint64_t arg,
                        FloatRoundMode rounding_mode)
@@ -613,22 +613,22 @@ static uint64_t do_fri(CPUPPCState *env, uint64_t arg,
     return arg;
 }
 
-uint64_t helper_frin(CPUPPCState *env, uint64_t arg)
+uint64_t helper_FRIN(CPUPPCState *env, uint64_t arg)
 {
     return do_fri(env, arg, float_round_ties_away);
 }
 
-uint64_t helper_friz(CPUPPCState *env, uint64_t arg)
+uint64_t helper_FRIZ(CPUPPCState *env, uint64_t arg)
 {
     return do_fri(env, arg, float_round_to_zero);
 }
 
-uint64_t helper_frip(CPUPPCState *env, uint64_t arg)
+uint64_t helper_FRIP(CPUPPCState *env, uint64_t arg)
 {
     return do_fri(env, arg, float_round_up);
 }
 
-uint64_t helper_frim(CPUPPCState *env, uint64_t arg)
+uint64_t helper_FRIM(CPUPPCState *env, uint64_t arg)
 {
     return do_fri(env, arg, float_round_down);
 }
@@ -697,7 +697,7 @@ static uint64_t do_frsp(CPUPPCState *env, uint64_t arg, uintptr_t retaddr)
     return helper_todouble(f32);
 }
 
-uint64_t helper_frsp(CPUPPCState *env, uint64_t arg)
+uint64_t helper_FRSP(CPUPPCState *env, uint64_t arg)
 {
     return do_frsp(env, arg, GETPC());
 }
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index ca414f2f43..96000f4f0d 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -97,23 +97,23 @@ DEF_HELPER_FLAGS_1(tosingle, TCG_CALL_NO_RWG_SE, i32, i64)
 DEF_HELPER_4(fcmpo, void, env, i64, i64, i32)
 DEF_HELPER_4(fcmpu, void, env, i64, i64, i32)
 
-DEF_HELPER_2(fctiw, i64, env, i64)
-DEF_HELPER_2(fctiwu, i64, env, i64)
-DEF_HELPER_2(fctiwz, i64, env, i64)
-DEF_HELPER_2(fctiwuz, i64, env, i64)
-DEF_HELPER_2(fcfid, i64, env, i64)
-DEF_HELPER_2(fcfidu, i64, env, i64)
-DEF_HELPER_2(fcfids, i64, env, i64)
-DEF_HELPER_2(fcfidus, i64, env, i64)
-DEF_HELPER_2(fctid, i64, env, i64)
-DEF_HELPER_2(fctidu, i64, env, i64)
-DEF_HELPER_2(fctidz, i64, env, i64)
-DEF_HELPER_2(fctiduz, i64, env, i64)
-DEF_HELPER_2(frsp, i64, env, i64)
-DEF_HELPER_2(frin, i64, env, i64)
-DEF_HELPER_2(friz, i64, env, i64)
-DEF_HELPER_2(frip, i64, env, i64)
-DEF_HELPER_2(frim, i64, env, i64)
+DEF_HELPER_2(FCTIW, i64, env, i64)
+DEF_HELPER_2(FCTIWU, i64, env, i64)
+DEF_HELPER_2(FCTIWZ, i64, env, i64)
+DEF_HELPER_2(FCTIWUZ, i64, env, i64)
+DEF_HELPER_2(FCFID, i64, env, i64)
+DEF_HELPER_2(FCFIDU, i64, env, i64)
+DEF_HELPER_2(FCFIDS, i64, env, i64)
+DEF_HELPER_2(FCFIDUS, i64, env, i64)
+DEF_HELPER_2(FCTID, i64, env, i64)
+DEF_HELPER_2(FCTIDU, i64, env, i64)
+DEF_HELPER_2(FCTIDZ, i64, env, i64)
+DEF_HELPER_2(FCTIDUZ, i64, env, i64)
+DEF_HELPER_2(FRSP, i64, env, i64)
+DEF_HELPER_2(FRIN, i64, env, i64)
+DEF_HELPER_2(FRIZ, i64, env, i64)
+DEF_HELPER_2(FRIP, i64, env, i64)
+DEF_HELPER_2(FRIM, i64, env, i64)
 
 DEF_HELPER_3(FADD, f64, env, f64, f64)
 DEF_HELPER_3(FADDS, f64, env, f64, f64)
diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
index 16652b5c13..0c7472d929 100644
--- a/target/ppc/insn32.decode
+++ b/target/ppc/insn32.decode
@@ -568,6 +568,30 @@ FNMADDS         111011 ..... ..... ..... ..... 11111 .  @A
 FNMSUB          111111 ..... ..... ..... ..... 11110 .  @A
 FNMSUBS         111011 ..... ..... ..... ..... 11110 .  @A
 
+### Floating-Point Rounding and Conversion Instructions
+
+FRSP            111111 ..... ----- ..... 0000001100 .   @X_tb_rc
+
+FRIN            111111 ..... ----- ..... 0110001000 .   @X_tb_rc
+FRIZ            111111 ..... ----- ..... 0110101000 .   @X_tb_rc
+FRIP            111111 ..... ----- ..... 0111001000 .   @X_tb_rc
+FRIM            111111 ..... ----- ..... 0111101000 .   @X_tb_rc
+
+FCTIW           111111 ..... ----- ..... 0000001110 .   @X_tb_rc
+FCTIWU          111111 ..... ----- ..... 0010001110 .   @X_tb_rc
+FCTIWZ          111111 ..... ----- ..... 0000001111 .   @X_tb_rc
+FCTIWUZ         111111 ..... ----- ..... 0010001111 .   @X_tb_rc
+
+FCTID           111111 ..... ----- ..... 1100101110 .   @X_tb_rc
+FCTIDU          111111 ..... ----- ..... 1110101110 .   @X_tb_rc
+FCTIDZ          111111 ..... ----- ..... 1100101111 .   @X_tb_rc
+FCTIDUZ         111111 ..... ----- ..... 1110101111 .   @X_tb_rc
+
+FCFID           111111 ..... ----- ..... 1101001110 .   @X_tb_rc
+FCFIDS          111011 ..... ----- ..... 1101001110 .   @X_tb_rc
+FCFIDU          111111 ..... ----- ..... 1111001110 .   @X_tb_rc
+FCFIDUS         111011 ..... ----- ..... 1111001110 .   @X_tb_rc
+
 ### Floating-Point Select Instruction
 
 FSEL            111111 ..... ..... ..... ..... 10111 .  @A
diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index a66b83398b..f296cfcdb0 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -98,28 +98,26 @@ static bool do_helper_ac(DisasContext *ctx, arg_A_tac *a,
     return true;
 }
 
-#define GEN_FLOAT_B(name, op2, op3, set_fprf, type)                           \
-static void gen_f##name(DisasContext *ctx)                                    \
-{                                                                             \
-    TCGv_i64 t0;                                                              \
-    TCGv_i64 t1;                                                              \
-    if (unlikely(!ctx->fpu_enabled)) {                                        \
-        gen_exception(ctx, POWERPC_EXCP_FPU);                                 \
-        return;                                                               \
-    }                                                                         \
-    t0 = tcg_temp_new_i64();                                                  \
-    t1 = tcg_temp_new_i64();                                                  \
-    gen_reset_fpstatus();                                                     \
-    get_fpr(t0, rB(ctx->opcode));                                             \
-    gen_helper_f##name(t1, tcg_env, t0);                                      \
-    set_fpr(rD(ctx->opcode), t1);                                             \
-    if (set_fprf) {                                                           \
-        gen_helper_compute_fprf_float64(tcg_env, t1);                         \
-    }                                                                         \
-    gen_helper_float_check_status(tcg_env);                                   \
-    if (unlikely(Rc(ctx->opcode) != 0)) {                                     \
-        gen_set_cr1_from_fpscr(ctx);                                          \
-    }                                                                         \
+static bool do_round_convert(DisasContext *ctx, arg_X_tb_rc *a,
+                             void (*helper)(TCGv_i64, TCGv_env, TCGv_i64),
+                             bool set_fprf)
+{
+    TCGv_i64 t0, t1;
+    REQUIRE_FPU(ctx);
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
+    gen_reset_fpstatus();
+    get_fpr(t0, a->rb);
+    helper(t1, tcg_env, t0);
+    set_fpr(a->rt, t1);
+    if (set_fprf) {
+        gen_helper_compute_fprf_float64(tcg_env, t1);
+    }
+    gen_helper_float_check_status(tcg_env);
+    if (unlikely(a->rc)) {
+        gen_set_cr1_from_fpscr(ctx);
+    }
+    return true;
 }
 
 static bool do_helper_bs(DisasContext *ctx, arg_A_tb *a,
@@ -213,41 +211,26 @@ TRANS(FSQRT, do_helper_fsqrt, gen_helper_FSQRT);
 TRANS(FSQRTS, do_helper_fsqrt, gen_helper_FSQRTS);
 
 /***                     Floating-Point round & convert                    ***/
-/* fctiw */
-GEN_FLOAT_B(ctiw, 0x0E, 0x00, 0, PPC_FLOAT);
-/* fctiwu */
-GEN_FLOAT_B(ctiwu, 0x0E, 0x04, 0, PPC2_FP_CVT_ISA206);
-/* fctiwz */
-GEN_FLOAT_B(ctiwz, 0x0F, 0x00, 0, PPC_FLOAT);
-/* fctiwuz */
-GEN_FLOAT_B(ctiwuz, 0x0F, 0x04, 0, PPC2_FP_CVT_ISA206);
-/* frsp */
-GEN_FLOAT_B(rsp, 0x0C, 0x00, 1, PPC_FLOAT);
-/* fcfid */
-GEN_FLOAT_B(cfid, 0x0E, 0x1A, 1, PPC2_FP_CVT_S64);
-/* fcfids */
-GEN_FLOAT_B(cfids, 0x0E, 0x1A, 0, PPC2_FP_CVT_ISA206);
-/* fcfidu */
-GEN_FLOAT_B(cfidu, 0x0E, 0x1E, 0, PPC2_FP_CVT_ISA206);
-/* fcfidus */
-GEN_FLOAT_B(cfidus, 0x0E, 0x1E, 0, PPC2_FP_CVT_ISA206);
-/* fctid */
-GEN_FLOAT_B(ctid, 0x0E, 0x19, 0, PPC2_FP_CVT_S64);
-/* fctidu */
-GEN_FLOAT_B(ctidu, 0x0E, 0x1D, 0, PPC2_FP_CVT_ISA206);
-/* fctidz */
-GEN_FLOAT_B(ctidz, 0x0F, 0x19, 0, PPC2_FP_CVT_S64);
-/* fctidu */
-GEN_FLOAT_B(ctiduz, 0x0F, 0x1D, 0, PPC2_FP_CVT_ISA206);
+TRANS_FLAGS(FLOAT, FRSP, do_round_convert, gen_helper_FRSP, true);
+TRANS_FLAGS(FLOAT_EXT, FRIN, do_round_convert, gen_helper_FRIN, true);
+TRANS_FLAGS(FLOAT_EXT, FRIZ, do_round_convert, gen_helper_FRIZ, true);
+TRANS_FLAGS(FLOAT_EXT, FRIP, do_round_convert, gen_helper_FRIP, true);
+TRANS_FLAGS(FLOAT_EXT, FRIM, do_round_convert, gen_helper_FRIM, true);
 
-/* frin */
-GEN_FLOAT_B(rin, 0x08, 0x0C, 1, PPC_FLOAT_EXT);
-/* friz */
-GEN_FLOAT_B(riz, 0x08, 0x0D, 1, PPC_FLOAT_EXT);
-/* frip */
-GEN_FLOAT_B(rip, 0x08, 0x0E, 1, PPC_FLOAT_EXT);
-/* frim */
-GEN_FLOAT_B(rim, 0x08, 0x0F, 1, PPC_FLOAT_EXT);
+TRANS_FLAGS(FLOAT, FCTIW, do_round_convert, gen_helper_FCTIW, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCTIWU, do_round_convert, gen_helper_FCTIWU, false);
+TRANS_FLAGS(FLOAT, FCTIWZ, do_round_convert, gen_helper_FCTIWZ, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCTIWUZ, do_round_convert, gen_helper_FCTIWUZ, false);
+
+TRANS_FLAGS2(FP_CVT_S64, FCTID, do_round_convert, gen_helper_FCTID, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCTIDU, do_round_convert, gen_helper_FCTIDU, false);
+TRANS_FLAGS2(FP_CVT_S64, FCTIDZ, do_round_convert, gen_helper_FCTIDZ, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCTIDUZ, do_round_convert, gen_helper_FCTIDUZ, false);
+
+TRANS_FLAGS2(FP_CVT_S64, FCFID, do_round_convert, gen_helper_FCFID, true);
+TRANS_FLAGS2(FP_CVT_ISA206, FCFIDS, do_round_convert, gen_helper_FCFIDS, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCFIDU, do_round_convert, gen_helper_FCFIDU, false);
+TRANS_FLAGS2(FP_CVT_ISA206, FCFIDUS, do_round_convert, gen_helper_FCFIDUS, false);
 
 static bool trans_FTDIV(DisasContext *ctx, arg_X_bf *a)
 {
@@ -1051,8 +1034,6 @@ TRANS(STFDX, do_lsfp_X, false, true, false)
 TRANS(STFDUX, do_lsfp_X, true, true, false)
 TRANS(PSTFD, do_lsfp_PLS_D, false, true, false)
 
-#undef GEN_FLOAT_B
-
 #undef GEN_LDF
 #undef GEN_LDUF
 #undef GEN_LDUXF
diff --git a/target/ppc/translate/fp-ops.c.inc b/target/ppc/translate/fp-ops.c.inc
index cef4b5dfcb..acb8ac32da 100644
--- a/target/ppc/translate/fp-ops.c.inc
+++ b/target/ppc/translate/fp-ops.c.inc
@@ -1,24 +1,3 @@
-#define GEN_FLOAT_B(name, op2, op3, set_fprf, type)                           \
-GEN_HANDLER(f##name, 0x3F, op2, op3, 0x001F0000, type)
-
-GEN_FLOAT_B(ctiw, 0x0E, 0x00, 0, PPC_FLOAT),
-GEN_HANDLER_E(fctiwu, 0x3F, 0x0E, 0x04, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_FLOAT_B(ctiwz, 0x0F, 0x00, 0, PPC_FLOAT),
-GEN_HANDLER_E(fctiwuz, 0x3F, 0x0F, 0x04, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_FLOAT_B(rsp, 0x0C, 0x00, 1, PPC_FLOAT),
-GEN_HANDLER_E(fcfid, 0x3F, 0x0E, 0x1A, 0x001F0000, PPC_NONE, PPC2_FP_CVT_S64),
-GEN_HANDLER_E(fcfids, 0x3B, 0x0E, 0x1A, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_HANDLER_E(fcfidu, 0x3F, 0x0E, 0x1E, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_HANDLER_E(fcfidus, 0x3B, 0x0E, 0x1E, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_HANDLER_E(fctid, 0x3F, 0x0E, 0x19, 0x001F0000, PPC_NONE, PPC2_FP_CVT_S64),
-GEN_HANDLER_E(fctidu, 0x3F, 0x0E, 0x1D, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_HANDLER_E(fctidz, 0x3F, 0x0F, 0x19, 0x001F0000, PPC_NONE, PPC2_FP_CVT_S64),
-GEN_HANDLER_E(fctiduz, 0x3F, 0x0F, 0x1D, 0, PPC_NONE, PPC2_FP_CVT_ISA206),
-GEN_FLOAT_B(rin, 0x08, 0x0C, 1, PPC_FLOAT_EXT),
-GEN_FLOAT_B(riz, 0x08, 0x0D, 1, PPC_FLOAT_EXT),
-GEN_FLOAT_B(rip, 0x08, 0x0E, 1, PPC_FLOAT_EXT),
-GEN_FLOAT_B(rim, 0x08, 0x0F, 1, PPC_FLOAT_EXT),
-
 GEN_HANDLER_E(lfdepx, 0x1F, 0x1F, 0x12, 0x00000001, PPC_NONE, PPC2_BOOKE206),
 GEN_HANDLER_E(lfiwax, 0x1f, 0x17, 0x1a, 0x00000001, PPC_NONE, PPC2_ISA205),
 GEN_HANDLER_E(lfiwzx, 0x1f, 0x17, 0x1b, 0x1, PPC_NONE, PPC2_FP_CVT_ISA206),

From f22aae5d8a2d8de807d6fa77a1901f815207c627 Mon Sep 17 00:00:00 2001
From: Chinmay Rath <rathc@linux.ibm.com>
Date: Thu, 19 Jun 2025 15:28:37 +0530
Subject: [PATCH 0744/2396] target/ppc: Move floating-point compare
 instructions to decodetree.

Move below instructions to decodetree specification :

	fcmp{u, o}		: X-form

The changes were verified by validating that the tcg ops generated by
those instructions remain the same, which were captured with the '-d
in_asm,op' flag.

Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250619095840.369351-3-rathc@linux.ibm.com
Message-ID: <20250619095840.369351-3-rathc@linux.ibm.com>
---
 target/ppc/fpu_helper.c            |  4 +--
 target/ppc/helper.h                |  4 +--
 target/ppc/insn32.decode           |  5 ++++
 target/ppc/translate/fp-impl.c.inc | 45 +++++++++---------------------
 target/ppc/translate/fp-ops.c.inc  |  2 --
 5 files changed, 22 insertions(+), 38 deletions(-)

diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
index 503cbd98ad..850aca6ed1 100644
--- a/target/ppc/fpu_helper.c
+++ b/target/ppc/fpu_helper.c
@@ -871,7 +871,7 @@ uint32_t helper_FTSQRT(uint64_t frb)
     return 0x8 | (fg_flag ? 4 : 0) | (fe_flag ? 2 : 0);
 }
 
-void helper_fcmpu(CPUPPCState *env, uint64_t arg1, uint64_t arg2,
+void helper_FCMPU(CPUPPCState *env, uint64_t arg1, uint64_t arg2,
                   uint32_t crfD)
 {
     CPU_DoubleU farg1, farg2;
@@ -902,7 +902,7 @@ void helper_fcmpu(CPUPPCState *env, uint64_t arg1, uint64_t arg2,
     }
 }
 
-void helper_fcmpo(CPUPPCState *env, uint64_t arg1, uint64_t arg2,
+void helper_FCMPO(CPUPPCState *env, uint64_t arg1, uint64_t arg2,
                   uint32_t crfD)
 {
     CPU_DoubleU farg1, farg2;
diff --git a/target/ppc/helper.h b/target/ppc/helper.h
index 96000f4f0d..e99c8c824b 100644
--- a/target/ppc/helper.h
+++ b/target/ppc/helper.h
@@ -94,8 +94,8 @@ DEF_HELPER_2(fpscr_setbit, void, env, i32)
 DEF_HELPER_FLAGS_1(todouble, TCG_CALL_NO_RWG_SE, i64, i32)
 DEF_HELPER_FLAGS_1(tosingle, TCG_CALL_NO_RWG_SE, i32, i64)
 
-DEF_HELPER_4(fcmpo, void, env, i64, i64, i32)
-DEF_HELPER_4(fcmpu, void, env, i64, i64, i32)
+DEF_HELPER_4(FCMPO, void, env, i64, i64, i32)
+DEF_HELPER_4(FCMPU, void, env, i64, i64, i32)
 
 DEF_HELPER_2(FCTIW, i64, env, i64)
 DEF_HELPER_2(FCTIWU, i64, env, i64)
diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
index 0c7472d929..d446ec534d 100644
--- a/target/ppc/insn32.decode
+++ b/target/ppc/insn32.decode
@@ -592,6 +592,11 @@ FCFIDS          111011 ..... ----- ..... 1101001110 .   @X_tb_rc
 FCFIDU          111111 ..... ----- ..... 1111001110 .   @X_tb_rc
 FCFIDUS         111011 ..... ----- ..... 1111001110 .   @X_tb_rc
 
+### Floating-Point Compare Instructions
+
+FCMPU           111111 ... -- ..... ..... 0000000000 -  @X_bf
+FCMPO           111111 ... -- ..... ..... 0000100000 -  @X_bf
+
 ### Floating-Point Select Instruction
 
 FSEL            111111 ..... ..... ..... ..... 10111 .  @A
diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index f296cfcdb0..4e18d350c0 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -257,46 +257,27 @@ static bool trans_FTSQRT(DisasContext *ctx, arg_X_bf_b *a)
 }
 
 /***                         Floating-Point compare                        ***/
-
-/* fcmpo */
-static void gen_fcmpo(DisasContext *ctx)
+static bool do_helper_cmp(DisasContext *ctx, arg_X_bf *a,
+                          void (*helper)(TCGv_env, TCGv_i64, TCGv_i64,
+                                         TCGv_i32))
 {
     TCGv_i32 crf;
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
+    TCGv_i64 t0, t1;
+    REQUIRE_INSNS_FLAGS(ctx, FLOAT);
+    REQUIRE_FPU(ctx);
     t0 = tcg_temp_new_i64();
     t1 = tcg_temp_new_i64();
     gen_reset_fpstatus();
-    crf = tcg_constant_i32(crfD(ctx->opcode));
-    get_fpr(t0, rA(ctx->opcode));
-    get_fpr(t1, rB(ctx->opcode));
-    gen_helper_fcmpo(tcg_env, t0, t1, crf);
+    crf = tcg_constant_i32(a->bf);
+    get_fpr(t0, a->ra);
+    get_fpr(t1, a->rb);
+    helper(tcg_env, t0, t1, crf);
     gen_helper_float_check_status(tcg_env);
+    return true;
 }
 
-/* fcmpu */
-static void gen_fcmpu(DisasContext *ctx)
-{
-    TCGv_i32 crf;
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
-    t0 = tcg_temp_new_i64();
-    t1 = tcg_temp_new_i64();
-    gen_reset_fpstatus();
-    crf = tcg_constant_i32(crfD(ctx->opcode));
-    get_fpr(t0, rA(ctx->opcode));
-    get_fpr(t1, rB(ctx->opcode));
-    gen_helper_fcmpu(tcg_env, t0, t1, crf);
-    gen_helper_float_check_status(tcg_env);
-}
+TRANS(FCMPU, do_helper_cmp, gen_helper_FCMPU);
+TRANS(FCMPO, do_helper_cmp, gen_helper_FCMPO);
 
 /***                         Floating-point move                           ***/
 /* fabs */
diff --git a/target/ppc/translate/fp-ops.c.inc b/target/ppc/translate/fp-ops.c.inc
index acb8ac32da..502453da35 100644
--- a/target/ppc/translate/fp-ops.c.inc
+++ b/target/ppc/translate/fp-ops.c.inc
@@ -10,8 +10,6 @@ GEN_STXF(stfiw, st32fiw, 0x17, 0x1E, PPC_FLOAT_STFIWX)
 GEN_HANDLER_E(stfdepx, 0x1F, 0x1F, 0x16, 0x00000001, PPC_NONE, PPC2_BOOKE206),
 GEN_HANDLER_E(stfdpx, 0x1F, 0x17, 0x1C, 0x00200001, PPC_NONE, PPC2_ISA205),
 
-GEN_HANDLER(fcmpo, 0x3F, 0x00, 0x01, 0x00600001, PPC_FLOAT),
-GEN_HANDLER(fcmpu, 0x3F, 0x00, 0x00, 0x00600001, PPC_FLOAT),
 GEN_HANDLER(fabs, 0x3F, 0x08, 0x08, 0x001F0000, PPC_FLOAT),
 GEN_HANDLER(fmr, 0x3F, 0x08, 0x02, 0x001F0000, PPC_FLOAT),
 GEN_HANDLER(fnabs, 0x3F, 0x08, 0x04, 0x001F0000, PPC_FLOAT),

From 5c89a201a92f49c8946727f451014ec05587645b Mon Sep 17 00:00:00 2001
From: Chinmay Rath <rathc@linux.ibm.com>
Date: Thu, 19 Jun 2025 15:28:38 +0530
Subject: [PATCH 0745/2396] target/ppc: Move floating-point move instructions
 to decodetree.

Move below instructions to decodetree specification:

	f{mr, neg, abs, nabs}		: X-form

The changes were verified by validating that the tcg ops generated by
those instructions remain the same, which were captured with the '-d
in_asm,op' flag.

Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250619095840.369351-4-rathc@linux.ibm.com
Message-ID: <20250619095840.369351-4-rathc@linux.ibm.com>
---
 target/ppc/insn32.decode           |  7 +++
 target/ppc/translate/fp-impl.c.inc | 80 ++++++++----------------------
 target/ppc/translate/fp-ops.c.inc  |  4 --
 3 files changed, 28 insertions(+), 63 deletions(-)

diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
index d446ec534d..063d5726cb 100644
--- a/target/ppc/insn32.decode
+++ b/target/ppc/insn32.decode
@@ -530,6 +530,13 @@ STFDU           110111 ..... ...... ...............     @D
 STFDX           011111 ..... ...... .... 1011010111 -   @X
 STFDUX          011111 ..... ...... .... 1011110111 -   @X
 
+### Floating-Point Move Instructions
+
+FMR             111111 ..... ----- ..... 0001001000 .   @X_tb_rc
+FNEG            111111 ..... ----- ..... 0000101000 .   @X_tb_rc
+FABS            111111 ..... ----- ..... 0100001000 .   @X_tb_rc
+FNABS           111111 ..... ----- ..... 0010001000 .   @X_tb_rc
+
 ### Floating-Point Arithmetic Instructions
 
 FADD            111111 ..... ..... ..... ----- 10101 .  @A_tab
diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index 4e18d350c0..2843f71122 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -280,82 +280,44 @@ TRANS(FCMPU, do_helper_cmp, gen_helper_FCMPU);
 TRANS(FCMPO, do_helper_cmp, gen_helper_FCMPO);
 
 /***                         Floating-point move                           ***/
-/* fabs */
-/* XXX: beware that fabs never checks for NaNs nor update FPSCR */
-static void gen_fabs(DisasContext *ctx)
-{
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
-    t0 = tcg_temp_new_i64();
-    t1 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    tcg_gen_andi_i64(t1, t0, ~(1ULL << 63));
-    set_fpr(rD(ctx->opcode), t1);
-    if (unlikely(Rc(ctx->opcode))) {
-        gen_set_cr1_from_fpscr(ctx);
-    }
-}
 
 /* fmr  - fmr. */
 /* XXX: beware that fmr never checks for NaNs nor update FPSCR */
-static void gen_fmr(DisasContext *ctx)
+static bool trans_FMR(DisasContext *ctx, arg_FMR *a)
 {
     TCGv_i64 t0;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
+    REQUIRE_INSNS_FLAGS(ctx, FLOAT);
+    REQUIRE_FPU(ctx);
     t0 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    set_fpr(rD(ctx->opcode), t0);
-    if (unlikely(Rc(ctx->opcode))) {
+    get_fpr(t0, a->rb);
+    set_fpr(a->rt, t0);
+    if (unlikely(a->rc)) {
         gen_set_cr1_from_fpscr(ctx);
     }
+    return true;
 }
 
-/* fnabs */
-/* XXX: beware that fnabs never checks for NaNs nor update FPSCR */
-static void gen_fnabs(DisasContext *ctx)
+/* XXX: beware that f{neg, abs, nabs} never checks for NaNs nor update FPSCR */
+static bool do_move_b(DisasContext *ctx, arg_X_tb_rc *a, int64_t val,
+                      void (*tcg_op)(TCGv_i64, TCGv_i64, int64_t))
 {
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
+    TCGv_i64 t0, t1;
+    REQUIRE_INSNS_FLAGS(ctx, FLOAT);
+    REQUIRE_FPU(ctx);
     t0 = tcg_temp_new_i64();
     t1 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    tcg_gen_ori_i64(t1, t0, 1ULL << 63);
-    set_fpr(rD(ctx->opcode), t1);
-    if (unlikely(Rc(ctx->opcode))) {
+    get_fpr(t0, a->rb);
+    tcg_op(t1, t0, val);
+    set_fpr(a->rt, t1);
+    if (unlikely(a->rc)) {
         gen_set_cr1_from_fpscr(ctx);
     }
+    return true;
 }
 
-/* fneg */
-/* XXX: beware that fneg never checks for NaNs nor update FPSCR */
-static void gen_fneg(DisasContext *ctx)
-{
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
-    t0 = tcg_temp_new_i64();
-    t1 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    tcg_gen_xori_i64(t1, t0, 1ULL << 63);
-    set_fpr(rD(ctx->opcode), t1);
-    if (unlikely(Rc(ctx->opcode))) {
-        gen_set_cr1_from_fpscr(ctx);
-    }
-}
+TRANS(FNEG, do_move_b, 1ULL << 63, tcg_gen_xori_i64);
+TRANS(FABS, do_move_b, ~(1ULL << 63), tcg_gen_andi_i64);
+TRANS(FNABS, do_move_b, 1ULL << 63, tcg_gen_ori_i64);
 
 /* fcpsgn: PowerPC 2.05 specification */
 /* XXX: beware that fcpsgn never checks for NaNs nor update FPSCR */
diff --git a/target/ppc/translate/fp-ops.c.inc b/target/ppc/translate/fp-ops.c.inc
index 502453da35..5053cb135c 100644
--- a/target/ppc/translate/fp-ops.c.inc
+++ b/target/ppc/translate/fp-ops.c.inc
@@ -10,10 +10,6 @@ GEN_STXF(stfiw, st32fiw, 0x17, 0x1E, PPC_FLOAT_STFIWX)
 GEN_HANDLER_E(stfdepx, 0x1F, 0x1F, 0x16, 0x00000001, PPC_NONE, PPC2_BOOKE206),
 GEN_HANDLER_E(stfdpx, 0x1F, 0x17, 0x1C, 0x00200001, PPC_NONE, PPC2_ISA205),
 
-GEN_HANDLER(fabs, 0x3F, 0x08, 0x08, 0x001F0000, PPC_FLOAT),
-GEN_HANDLER(fmr, 0x3F, 0x08, 0x02, 0x001F0000, PPC_FLOAT),
-GEN_HANDLER(fnabs, 0x3F, 0x08, 0x04, 0x001F0000, PPC_FLOAT),
-GEN_HANDLER(fneg, 0x3F, 0x08, 0x01, 0x001F0000, PPC_FLOAT),
 GEN_HANDLER_E(fcpsgn, 0x3F, 0x08, 0x00, 0x00000000, PPC_NONE, PPC2_ISA205),
 GEN_HANDLER_E(fmrgew, 0x3F, 0x06, 0x1E, 0x00000001, PPC_NONE, PPC2_VSX207),
 GEN_HANDLER_E(fmrgow, 0x3F, 0x06, 0x1A, 0x00000001, PPC_NONE, PPC2_VSX207),

From 241f6f7994a3b448d9471e43d8e31ed6245b47c7 Mon Sep 17 00:00:00 2001
From: Chinmay Rath <rathc@linux.ibm.com>
Date: Thu, 19 Jun 2025 15:28:39 +0530
Subject: [PATCH 0746/2396] target/ppc: Move remaining floating-point move
 instructions to decodetree.

Move below instructions to decodetree specification:

	fcpsgn, fmrg{e, o}w	: X-form

The changes were verified by validating that the tcg ops generated by
those instructions remain the same, which were captured with the '-d
in_asm,op' flag.

Signed-off-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250619095840.369351-5-rathc@linux.ibm.com
Message-ID: <20250619095840.369351-5-rathc@linux.ibm.com>
---
 target/ppc/insn32.decode           |  4 ++
 target/ppc/translate/fp-impl.c.inc | 75 +++++++++++++-----------------
 target/ppc/translate/fp-ops.c.inc  |  3 --
 3 files changed, 37 insertions(+), 45 deletions(-)

diff --git a/target/ppc/insn32.decode b/target/ppc/insn32.decode
index 063d5726cb..0e9c68f2fb 100644
--- a/target/ppc/insn32.decode
+++ b/target/ppc/insn32.decode
@@ -537,6 +537,10 @@ FNEG            111111 ..... ----- ..... 0000101000 .   @X_tb_rc
 FABS            111111 ..... ----- ..... 0100001000 .   @X_tb_rc
 FNABS           111111 ..... ----- ..... 0010001000 .   @X_tb_rc
 
+FCPSGN          111111 ..... ..... ..... 0000001000 .   @X_rc
+FMRGEW          111111 ..... ..... ..... 1111000110 -   @X
+FMRGOW          111111 ..... ..... ..... 1101000110 -   @X
+
 ### Floating-Point Arithmetic Instructions
 
 FADD            111111 ..... ..... ..... ----- 10101 .  @A_tab
diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index 2843f71122..28dda15040 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -321,62 +321,53 @@ TRANS(FNABS, do_move_b, 1ULL << 63, tcg_gen_ori_i64);
 
 /* fcpsgn: PowerPC 2.05 specification */
 /* XXX: beware that fcpsgn never checks for NaNs nor update FPSCR */
-static void gen_fcpsgn(DisasContext *ctx)
+static bool trans_FCPSGN(DisasContext *ctx, arg_FCPSGN *a)
 {
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    TCGv_i64 t2;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
+    TCGv_i64 t0, t1, t2;
+    REQUIRE_INSNS_FLAGS2(ctx, ISA205);
+    REQUIRE_FPU(ctx);
     t0 = tcg_temp_new_i64();
     t1 = tcg_temp_new_i64();
     t2 = tcg_temp_new_i64();
-    get_fpr(t0, rA(ctx->opcode));
-    get_fpr(t1, rB(ctx->opcode));
+    get_fpr(t0, a->ra);
+    get_fpr(t1, a->rb);
     tcg_gen_deposit_i64(t2, t0, t1, 0, 63);
-    set_fpr(rD(ctx->opcode), t2);
-    if (unlikely(Rc(ctx->opcode))) {
+    set_fpr(a->rt, t2);
+    if (unlikely(a->rc)) {
         gen_set_cr1_from_fpscr(ctx);
     }
+    return true;
 }
 
-static void gen_fmrgew(DisasContext *ctx)
+static bool trans_FMRGEW(DisasContext *ctx, arg_FMRGEW *a)
 {
-    TCGv_i64 b0;
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
-    b0 = tcg_temp_new_i64();
-    t0 = tcg_temp_new_i64();
-    t1 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    tcg_gen_shri_i64(b0, t0, 32);
-    get_fpr(t0, rA(ctx->opcode));
-    tcg_gen_deposit_i64(t1, t0, b0, 0, 32);
-    set_fpr(rD(ctx->opcode), t1);
-}
-
-static void gen_fmrgow(DisasContext *ctx)
-{
-    TCGv_i64 t0;
-    TCGv_i64 t1;
-    TCGv_i64 t2;
-    if (unlikely(!ctx->fpu_enabled)) {
-        gen_exception(ctx, POWERPC_EXCP_FPU);
-        return;
-    }
+    TCGv_i64 t0, t1, t2;
+    REQUIRE_INSNS_FLAGS2(ctx, VSX207);
+    REQUIRE_FPU(ctx);
     t0 = tcg_temp_new_i64();
     t1 = tcg_temp_new_i64();
     t2 = tcg_temp_new_i64();
-    get_fpr(t0, rB(ctx->opcode));
-    get_fpr(t1, rA(ctx->opcode));
+    get_fpr(t1, a->rb);
+    tcg_gen_shri_i64(t0, t1, 32);
+    get_fpr(t1, a->ra);
+    tcg_gen_deposit_i64(t2, t1, t0, 0, 32);
+    set_fpr(a->rt, t2);
+    return true;
+}
+
+static bool trans_FMRGOW(DisasContext *ctx, arg_FMRGOW *a)
+{
+    TCGv_i64 t0, t1, t2;
+    REQUIRE_INSNS_FLAGS2(ctx, VSX207);
+    REQUIRE_FPU(ctx);
+    t0 = tcg_temp_new_i64();
+    t1 = tcg_temp_new_i64();
+    t2 = tcg_temp_new_i64();
+    get_fpr(t0, a->rb);
+    get_fpr(t1, a->ra);
     tcg_gen_deposit_i64(t2, t0, t1, 32, 32);
-    set_fpr(rD(ctx->opcode), t2);
+    set_fpr(a->rt, t2);
+    return true;
 }
 
 /***                  Floating-Point status & ctrl register                ***/
diff --git a/target/ppc/translate/fp-ops.c.inc b/target/ppc/translate/fp-ops.c.inc
index 5053cb135c..9bc9c3a3c3 100644
--- a/target/ppc/translate/fp-ops.c.inc
+++ b/target/ppc/translate/fp-ops.c.inc
@@ -10,9 +10,6 @@ GEN_STXF(stfiw, st32fiw, 0x17, 0x1E, PPC_FLOAT_STFIWX)
 GEN_HANDLER_E(stfdepx, 0x1F, 0x1F, 0x16, 0x00000001, PPC_NONE, PPC2_BOOKE206),
 GEN_HANDLER_E(stfdpx, 0x1F, 0x17, 0x1C, 0x00200001, PPC_NONE, PPC2_ISA205),
 
-GEN_HANDLER_E(fcpsgn, 0x3F, 0x08, 0x00, 0x00000000, PPC_NONE, PPC2_ISA205),
-GEN_HANDLER_E(fmrgew, 0x3F, 0x06, 0x1E, 0x00000001, PPC_NONE, PPC2_VSX207),
-GEN_HANDLER_E(fmrgow, 0x3F, 0x06, 0x1A, 0x00000001, PPC_NONE, PPC2_VSX207),
 GEN_HANDLER(mcrfs, 0x3F, 0x00, 0x02, 0x0063F801, PPC_FLOAT),
 GEN_HANDLER(mtfsb0, 0x3F, 0x06, 0x02, 0x001FF800, PPC_FLOAT),
 GEN_HANDLER(mtfsb1, 0x3F, 0x06, 0x01, 0x001FF800, PPC_FLOAT),

From f19052110e32afd94f897ef069735bbd7172a800 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Sat, 7 Jun 2025 16:34:11 +0530
Subject: [PATCH 0747/2396] target/ppc: Introduce macro for deprecating PowerPC
 CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU has a way to deprecate CPUs by setting the 'deprecation_note' in
CPUClass.

Currently PowerPC CPUs don't use this deprecation process.

Introduce 'POWERPC_DEPRECATED_CPU' macro to deprecate particular PowerPC
CPUs in future.

With the change, QEMU will print a warning like below when the
deprecated CPU/Chips are used (example output if power8nvl is deprecated):

    $ ./build/qemu-system-ppc64 -M powernv8 --cpu power8nvl -nographic
    qemu-system-ppc64: warning: CPU model power8nvl_v1.0-powerpc64-cpu is deprecated -- CPU is unmaintained.
    ...

Also, print '(deprecated)' for deprecated CPUs in 'qemu-system-ppc64
--cpu ?' (example output if power8nvl is deprecated):

    $ ./build/qemu-system-ppc64 --cpu help
      ...
      power8e          (alias for power8e_v2.1)
      power8nvl_v1.0   PVR 004c0100 (deprecated)
      power8nvl        (alias for power8nvl_v1.0)
      power8_v2.0      PVR 004d0200
      ...

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250607110412.2342511-2-adityag@linux.ibm.com
Message-ID: <20250607110412.2342511-2-adityag@linux.ibm.com>
---
 target/ppc/cpu-models.c | 12 +++++++++++-
 target/ppc/cpu_init.c   |  7 ++++++-
 2 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
index 09f73e23a8..334b1d2ff3 100644
--- a/target/ppc/cpu-models.c
+++ b/target/ppc/cpu-models.c
@@ -32,17 +32,20 @@
 /* PowerPC CPU definitions                                                 */
 #define POWERPC_DEF_PREFIX(pvr, svr, type)                                  \
     glue(glue(glue(glue(pvr, _), svr), _), type)
-#define POWERPC_DEF_SVR(_name, _desc, _pvr, _svr, _type)                    \
+#define POWERPC_DEF_SVR_DEPR(_name, _desc, _pvr, _svr, _type, _deprecation_note) \
     static void                                                             \
     glue(POWERPC_DEF_PREFIX(_pvr, _svr, _type), _cpu_class_init)            \
     (ObjectClass *oc, const void *data)                                     \
     {                                                                       \
         DeviceClass *dc = DEVICE_CLASS(oc);                                 \
+        CPUClass *cc    = CPU_CLASS(oc);                                    \
         PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);                       \
                                                                             \
         pcc->pvr          = _pvr;                                           \
         pcc->svr          = _svr;                                           \
         dc->desc          = _desc;                                          \
+                                                                            \
+        cc->deprecation_note = _deprecation_note;                           \
     }                                                                       \
                                                                             \
     static const TypeInfo                                                   \
@@ -63,6 +66,13 @@
     type_init(                                                              \
         glue(POWERPC_DEF_PREFIX(_pvr, _svr, _type), _cpu_register_types))
 
+#define POWERPC_DEF_SVR(_name, _desc, _pvr, _svr, _type)                    \
+    POWERPC_DEF_SVR_DEPR(_name, _desc, _pvr, _svr, _type, NULL)
+
+#define POWERPC_DEPRECATED_CPU(_name, _pvr, _type, _desc, _deprecation_note)\
+    POWERPC_DEF_SVR_DEPR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type,       \
+            _deprecation_note)
+
 #define POWERPC_DEF(_name, _pvr, _type, _desc)                              \
     POWERPC_DEF_SVR(_name, _desc, _pvr, POWERPC_SVR_NONE, _type)
 
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 9e4ea8fd13..3aa3aefc13 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -7298,6 +7298,7 @@ static void ppc_cpu_list_entry(gpointer data, gpointer user_data)
 {
     ObjectClass *oc = data;
     PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
+    CPUClass *cc = CPU_CLASS(oc);
     DeviceClass *family = DEVICE_CLASS(ppc_cpu_get_family_class(pcc));
     const char *typename = object_class_get_name(oc);
     char *name;
@@ -7308,7 +7309,11 @@ static void ppc_cpu_list_entry(gpointer data, gpointer user_data)
     }
 
     name = cpu_model_from_type(typename);
-    qemu_printf("  %-16s PVR %08x\n", name, pcc->pvr);
+    if (cc->deprecation_note) {
+        qemu_printf("  %-16s PVR %08x (deprecated)\n", name, pcc->pvr);
+    } else {
+        qemu_printf("  %-16s PVR %08x\n", name, pcc->pvr);
+    }
     for (i = 0; ppc_cpu_aliases[i].alias != NULL; i++) {
         PowerPCCPUAlias *alias = &ppc_cpu_aliases[i];
         ObjectClass *alias_oc = ppc_cpu_class_by_name(alias->model);

From 264a604e71636bd04bfbbe3cf887259f246dccb3 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Sat, 7 Jun 2025 16:34:12 +0530
Subject: [PATCH 0748/2396] target/ppc: Deprecate Power8E and Power8NVL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Power8E and Power8NVL variants are not of much use in QEMU now, and not
being maintained either.

Power8NVL CPU doesn't boot since skiboot v7.0, or following skiboot commit
to be exact:

    commit c5424f683ee3 ("Remove support for POWER8 DD1")

Deprecate the 8E and 8NVL variants.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Anushree Mathur <anushree.mathur@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250607110412.2342511-3-adityag@linux.ibm.com
Message-ID: <20250607110412.2342511-3-adityag@linux.ibm.com>
---
 docs/about/deprecated.rst | 9 +++++++++
 target/ppc/cpu-models.c   | 8 ++++----
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index aa300bbd50..b8d60c1a90 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -253,6 +253,15 @@ embedded 405 for power management (OCC) and other internal tasks, it
 is theoretically possible to use QEMU to model them. Let's keep the
 CPU implementation for a while before removing all support.
 
+Power8E and Power8NVL CPUs and corresponding Pnv chips (since 10.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The Power8E and Power8NVL variants of Power8 are not really useful anymore
+in qemu, and are old and unmaintained now.
+
+The CPUs as well as corresponding Power8NVL and Power8E PnvChips will also
+be considered deprecated.
+
 System emulator machines
 ------------------------
 
diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
index 334b1d2ff3..89ae763c7f 100644
--- a/target/ppc/cpu-models.c
+++ b/target/ppc/cpu-models.c
@@ -739,12 +739,12 @@
                 "POWER7 v2.3")
     POWERPC_DEF("power7p_v2.1",  CPU_POWERPC_POWER7P_v21,            POWER7,
                 "POWER7+ v2.1")
-    POWERPC_DEF("power8e_v2.1",  CPU_POWERPC_POWER8E_v21,            POWER8,
-                "POWER8E v2.1")
+    POWERPC_DEPRECATED_CPU("power8e_v2.1",  CPU_POWERPC_POWER8E_v21, POWER8,
+                "POWER8E v2.1", "CPU is unmaintained.")
     POWERPC_DEF("power8_v2.0",   CPU_POWERPC_POWER8_v20,             POWER8,
                 "POWER8 v2.0")
-    POWERPC_DEF("power8nvl_v1.0", CPU_POWERPC_POWER8NVL_v10,         POWER8,
-                "POWER8NVL v1.0")
+    POWERPC_DEPRECATED_CPU("power8nvl_v1.0", CPU_POWERPC_POWER8NVL_v10, POWER8,
+                "POWER8NVL v1.0", "CPU is unmaintained.")
     POWERPC_DEF("power9_v2.0",   CPU_POWERPC_POWER9_DD20,            POWER9,
                 "POWER9 v2.0")
     POWERPC_DEF("power9_v2.2",   CPU_POWERPC_POWER9_DD22,            POWER9,

From 6c51df580d2a64b4e1ef7bdbffeb3615ffe25d43 Mon Sep 17 00:00:00 2001
From: Denis Sergeev <zeff@altlinux.org>
Date: Mon, 15 Sep 2025 11:01:18 +0300
Subject: [PATCH 0749/2396] target/ppc: use MAKE_64BIT_MASK for mcrfs exception
 clear mask

In gen_mcrfs() the FPSCR nibble mask is computed as:
      `~((0xF << shift) & FP_EX_CLEAR_BITS)`

Here, 0xF is of type int, so the left shift is performed in
32-bit signed arithmetic. For bfa=0 we get shift=28,
and (0xF << 28) = 0xF0000000, which is not representable as a 32-bit
signed int. Static analyzers flag this as a potential integer
overflow.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Signed-off-by: Denis Sergeev <zeff@altlinux.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20250915080118.29898-1-zeff@altlinux.org
Message-ID: <20250915080118.29898-1-zeff@altlinux.org>
---
 target/ppc/translate/fp-impl.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/ppc/translate/fp-impl.c.inc b/target/ppc/translate/fp-impl.c.inc
index 28dda15040..464fb1d90f 100644
--- a/target/ppc/translate/fp-impl.c.inc
+++ b/target/ppc/translate/fp-impl.c.inc
@@ -396,7 +396,7 @@ static void gen_mcrfs(DisasContext *ctx)
     tcg_gen_extu_tl_i64(tnew_fpscr, cpu_fpscr);
     /* Only the exception bits (including FX) should be cleared if read */
     tcg_gen_andi_i64(tnew_fpscr, tnew_fpscr,
-                     ~((0xF << shift) & FP_EX_CLEAR_BITS));
+                     ~(MAKE_64BIT_MASK(shift, 4) & FP_EX_CLEAR_BITS));
     /* FEX and VX need to be updated, so don't set fpscr directly */
     tmask = tcg_constant_i32(1 << nibble);
     gen_helper_store_fpscr(tcg_env, tnew_fpscr, tmask);

From 688a3dae7828ca5ee6f45d510eed083420d72d8a Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:39:58 +0800
Subject: [PATCH 0750/2396] hw/nvram/aspeed_otp: Add ASPEED OTP memory device
 model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a QEMU device model for ASPEED's One-Time Programmable (OTP)
memory.

This model simulates a word-addressable OTP region used for secure
fuse storage. The OTP memory can operate with an internal memory
buffer.

The OTP model provides a memory-like interface through a dedicated
AddressSpace, allowing other device models (e.g., SBC) to issue
transactions as if accessing a memory-mapped region.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/nvram/aspeed_otp.c         | 99 +++++++++++++++++++++++++++++++++++
 hw/nvram/meson.build          |  4 ++
 include/hw/nvram/aspeed_otp.h | 33 ++++++++++++
 3 files changed, 136 insertions(+)
 create mode 100644 hw/nvram/aspeed_otp.c
 create mode 100644 include/hw/nvram/aspeed_otp.h

diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c
new file mode 100644
index 0000000000..e5b7ca9676
--- /dev/null
+++ b/hw/nvram/aspeed_otp.c
@@ -0,0 +1,99 @@
+/*
+ *  ASPEED OTP (One-Time Programmable) memory
+ *
+ *  Copyright (C) 2025 Aspeed
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "system/block-backend.h"
+#include "hw/qdev-properties.h"
+#include "hw/nvram/aspeed_otp.h"
+
+static uint64_t aspeed_otp_read(void *opaque, hwaddr offset, unsigned size)
+{
+    AspeedOTPState *s = opaque;
+    uint64_t val = 0;
+
+    memcpy(&val, s->storage + offset, size);
+
+    return val;
+}
+
+static void aspeed_otp_write(void *opaque, hwaddr otp_addr,
+                                uint64_t val, unsigned size)
+{
+    AspeedOTPState *s = opaque;
+
+    memcpy(s->storage + otp_addr, &val, size);
+}
+
+static bool aspeed_otp_init_storage(AspeedOTPState *s, Error **errp)
+{
+    uint32_t *p;
+    int i, num;
+
+        num = s->size / sizeof(uint32_t);
+        p = (uint32_t *)s->storage;
+        for (i = 0; i < num; i++) {
+            p[i] = (i % 2 == 0) ? 0x00000000 : 0xFFFFFFFF;
+        }
+
+    return true;
+}
+
+static const MemoryRegionOps aspeed_otp_ops = {
+    .read = aspeed_otp_read,
+    .write = aspeed_otp_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 1,
+    .valid.max_access_size = 4,
+};
+
+static void aspeed_otp_realize(DeviceState *dev, Error **errp)
+{
+    AspeedOTPState *s = ASPEED_OTP(dev);
+
+    if (s->size == 0) {
+        error_setg(errp, "aspeed.otp: 'size' property must be set");
+        return;
+    }
+
+    s->storage = blk_blockalign(s->blk, s->size);
+
+    if (!aspeed_otp_init_storage(s, errp)) {
+        return;
+    }
+
+    memory_region_init_io(&s->mmio, OBJECT(dev), &aspeed_otp_ops,
+                          s, "aspeed.otp", s->size);
+    address_space_init(&s->as, &s->mmio, NULL);
+}
+
+static const Property aspeed_otp_properties[] = {
+    DEFINE_PROP_UINT64("size", AspeedOTPState, size, 0),
+};
+
+static void aspeed_otp_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    dc->realize = aspeed_otp_realize;
+    device_class_set_props(dc, aspeed_otp_properties);
+}
+
+static const TypeInfo aspeed_otp_info = {
+    .name          = TYPE_ASPEED_OTP,
+    .parent        = TYPE_DEVICE,
+    .instance_size = sizeof(AspeedOTPState),
+    .class_init    = aspeed_otp_class_init,
+};
+
+static void aspeed_otp_register_types(void)
+{
+    type_register_static(&aspeed_otp_info);
+}
+
+type_init(aspeed_otp_register_types)
diff --git a/hw/nvram/meson.build b/hw/nvram/meson.build
index 10f3639db6..b66f23605b 100644
--- a/hw/nvram/meson.build
+++ b/hw/nvram/meson.build
@@ -19,3 +19,7 @@ system_ss.add(when: 'CONFIG_XLNX_BBRAM', if_true: files('xlnx-bbram.c'))
 
 specific_ss.add(when: 'CONFIG_PSERIES', if_true: files('spapr_nvram.c'))
 specific_ss.add(when: 'CONFIG_ACPI', if_true: files('fw_cfg-acpi.c'))
+
+system_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
+  'aspeed_otp.c',
+  ))
\ No newline at end of file
diff --git a/include/hw/nvram/aspeed_otp.h b/include/hw/nvram/aspeed_otp.h
new file mode 100644
index 0000000000..3752353860
--- /dev/null
+++ b/include/hw/nvram/aspeed_otp.h
@@ -0,0 +1,33 @@
+/*
+ *  ASPEED OTP (One-Time Programmable) memory
+ *
+ *  Copyright (C) 2025 Aspeed
+ *
+ *  SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_OTP_H
+#define ASPEED_OTP_H
+
+#include "system/memory.h"
+#include "hw/block/block.h"
+#include "system/address-spaces.h"
+
+#define TYPE_ASPEED_OTP "aspeed-otp"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedOTPState, ASPEED_OTP)
+
+typedef struct AspeedOTPState {
+    DeviceState parent_obj;
+
+    BlockBackend *blk;
+
+    uint64_t size;
+
+    AddressSpace as;
+
+    MemoryRegion mmio;
+
+    uint8_t *storage;
+} AspeedOTPState;
+
+#endif /* ASPEED_OTP_H */

From 9f58dd0a8c30a6b84016db30949fe2f86f8bc38b Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:39:59 +0800
Subject: [PATCH 0751/2396] hw/misc/aspeed_sbc: Connect ASPEED OTP memory
 device to SBC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch connects the aspeed.otp device to the ASPEED Secure Boot
Controller (SBC) model. It implements OTP memory access via the SBC's
command interface and enables emulation of secure fuse programming
flows.

The following OTP commands are supported:
  - READ: reads a 32-bit word from OTP memory into internal registers
  - PROG: programs a 32-bit word value to the specified OTP address

Trace events are added to observe read/program operations and command
handling flow.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-3-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_sbc.c         | 111 +++++++++++++++++++++++++++++++++++
 hw/misc/trace-events         |   5 ++
 include/hw/misc/aspeed_sbc.h |   5 ++
 3 files changed, 121 insertions(+)

diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index a7d101ba71..46a038337c 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -15,9 +15,13 @@
 #include "hw/misc/aspeed_sbc.h"
 #include "qapi/error.h"
 #include "migration/vmstate.h"
+#include "trace.h"
 
 #define R_PROT          (0x000 / 4)
+#define R_CMD           (0x004 / 4)
+#define R_ADDR          (0x010 / 4)
 #define R_STATUS        (0x014 / 4)
+#define R_CAMP1         (0x020 / 4)
 #define R_QSR           (0x040 / 4)
 
 /* R_STATUS */
@@ -41,6 +45,11 @@
 #define QSR_RSA_MASK           (0x3 << 12)
 #define QSR_HASH_MASK          (0x3 << 10)
 
+#define OTP_MEMORY_SIZE 0x4000
+/* OTP command */
+#define SBC_OTP_CMD_READ 0x23b1e361
+#define SBC_OTP_CMD_PROG 0x23b1e364
+
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -57,6 +66,84 @@ static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
     return s->regs[addr];
 }
 
+static bool aspeed_sbc_otp_read(AspeedSBCState *s,
+                                   uint32_t otp_addr)
+{
+    MemTxResult ret;
+    AspeedOTPState *otp = &s->otp;
+    uint32_t value, otp_offset;
+
+    otp_offset = otp_addr << 2;
+    ret = address_space_read(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFIED,
+                             &value, sizeof(value));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Failed to read OTP memory, addr = %x\n",
+                      otp_addr);
+        return false;
+    }
+    s->regs[R_CAMP1] = value;
+    trace_aspeed_sbc_otp_read(otp_addr, value);
+
+    return true;
+}
+
+static bool aspeed_sbc_otp_prog(AspeedSBCState *s,
+                                   uint32_t otp_addr)
+{
+    MemTxResult ret;
+    AspeedOTPState *otp = &s->otp;
+    uint32_t value = s->regs[R_CAMP1];
+
+    ret = address_space_write(&otp->as, otp_addr, MEMTXATTRS_UNSPECIFIED,
+                        &value, sizeof(value));
+    if (ret != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Failed to write OTP memory, addr = %x\n",
+                      otp_addr);
+        return false;
+    }
+
+    trace_aspeed_sbc_otp_prog(otp_addr, value);
+
+    return true;
+}
+
+static void aspeed_sbc_handle_command(void *opaque, uint32_t cmd)
+{
+    AspeedSBCState *s = ASPEED_SBC(opaque);
+    AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(opaque);
+    bool ret = false;
+    uint32_t otp_addr;
+
+    if (!sc->has_otp) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: OTP memory is not supported\n",
+                      __func__);
+        return;
+    }
+
+    s->regs[R_STATUS] &= ~(OTP_MEM_IDLE | OTP_IDLE);
+    otp_addr = s->regs[R_ADDR];
+
+    switch (cmd) {
+    case SBC_OTP_CMD_READ:
+        ret = aspeed_sbc_otp_read(s, otp_addr);
+        break;
+    case SBC_OTP_CMD_PROG:
+        ret = aspeed_sbc_otp_prog(s, otp_addr);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Unknown command 0x%x\n",
+                      __func__, cmd);
+        break;
+    }
+
+    trace_aspeed_sbc_handle_cmd(cmd, otp_addr, ret);
+    s->regs[R_STATUS] |= (OTP_MEM_IDLE | OTP_IDLE);
+}
+
 static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
                               unsigned int size)
 {
@@ -78,6 +165,9 @@ static void aspeed_sbc_write(void *opaque, hwaddr addr, uint64_t data,
                       "%s: write to read only register 0x%" HWADDR_PRIx "\n",
                       __func__, addr << 2);
         return;
+    case R_CMD:
+        aspeed_sbc_handle_command(opaque, data);
+        return;
     default:
         break;
     }
@@ -115,10 +205,30 @@ static void aspeed_sbc_reset(DeviceState *dev)
     s->regs[R_QSR] = s->signing_settings;
 }
 
+static void aspeed_sbc_instance_init(Object *obj)
+{
+    AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(obj);
+    AspeedSBCState *s = ASPEED_SBC(obj);
+
+    if (sc->has_otp) {
+        object_initialize_child(OBJECT(s), "otp", &s->otp,
+                                TYPE_ASPEED_OTP);
+    }
+}
+
 static void aspeed_sbc_realize(DeviceState *dev, Error **errp)
 {
     AspeedSBCState *s = ASPEED_SBC(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedSBCClass *sc = ASPEED_SBC_GET_CLASS(dev);
+
+    if (sc->has_otp) {
+        object_property_set_int(OBJECT(&s->otp), "size",
+                                OTP_MEMORY_SIZE, &error_abort);
+        if (!qdev_realize(DEVICE(&s->otp), NULL, errp)) {
+            return;
+        }
+    }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_sbc_ops, s,
             TYPE_ASPEED_SBC, 0x1000);
@@ -155,6 +265,7 @@ static const TypeInfo aspeed_sbc_info = {
     .name = TYPE_ASPEED_SBC,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedSBCState),
+    .instance_init = aspeed_sbc_instance_init,
     .class_init = aspeed_sbc_class_init,
     .class_size = sizeof(AspeedSBCClass)
 };
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index e3f64c0ff6..9e05b82f37 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -90,6 +90,11 @@ slavio_sysctrl_mem_readl(uint32_t ret) "Read system control 0x%08x"
 slavio_led_mem_writew(uint32_t val) "Write diagnostic LED 0x%04x"
 slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
 
+# aspeed_sbc.c
+aspeed_sbc_handle_cmd(uint32_t cmd, uint32_t addr, bool ret) "Handling command 0x%" PRIx32 " for OTP addr 0x%" PRIx32 " Result: %d"
+aspeed_sbc_otp_read(uint32_t addr, uint32_t value) "OTP Memory read: addr 0x%" PRIx32 " value 0x%" PRIx32
+aspeed_sbc_otp_prog(uint32_t addr, uint32_t value) "OTP Memory write: addr 0x%" PRIx32 " value 0x%" PRIx32
+
 # aspeed_scu.c
 aspeed_scu_write(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
 aspeed_scu_read(uint64_t offset, unsigned size, uint32_t data) "To 0x%" PRIx64 " of size %u: 0x%" PRIx32
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 405e6782b9..0c2746d392 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -10,6 +10,7 @@
 #define ASPEED_SBC_H
 
 #include "hw/sysbus.h"
+#include "hw/nvram/aspeed_otp.h"
 
 #define TYPE_ASPEED_SBC "aspeed.sbc"
 #define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
@@ -36,10 +37,14 @@ struct AspeedSBCState {
     MemoryRegion iomem;
 
     uint32_t regs[ASPEED_SBC_NR_REGS];
+
+    AspeedOTPState otp;
 };
 
 struct AspeedSBCClass {
     SysBusDeviceClass parent_class;
+
+    bool has_otp;
 };
 
 #endif /* ASPEED_SBC_H */

From fe4159cb34f36a63a1759b907f51f8d458f5c940 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:00 +0800
Subject: [PATCH 0752/2396] hw/arm: Integrate ASPEED OTP memory support into
 AST2600 SoCs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The has_otp attribute is enabled in the SBC subclasses for AST2600 to
control the presence of OTP support per SoC type.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-4-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast2600.c | 2 +-
 hw/misc/aspeed_sbc.c    | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index d12707f0ab..59ffd41a4a 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -261,7 +261,7 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
     object_initialize_child(obj, "i3c", &s->i3c, TYPE_ASPEED_I3C);
 
-    object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
+    object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST2600_SBC);
 
     object_initialize_child(obj, "iomem", &s->iomem, TYPE_UNIMPLEMENTED_DEVICE);
     object_initialize_child(obj, "video", &s->video, TYPE_UNIMPLEMENTED_DEVICE);
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 46a038337c..b56a8b7678 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -273,8 +273,10 @@ static const TypeInfo aspeed_sbc_info = {
 static void aspeed_ast2600_sbc_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSBCClass *sc = ASPEED_SBC_CLASS(klass);
 
     dc->desc = "AST2600 Secure Boot Controller";
+    sc->has_otp = true;
 }
 
 static const TypeInfo aspeed_ast2600_sbc_info = {

From c6b4279a9240a838632e2d689a138da96545c540 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:01 +0800
Subject: [PATCH 0753/2396] hw/nvram/aspeed_otp: Add 'drive' property to
 support block backend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces a 'drive' property to the Aspeed OTP device,
allowing it to be backed by a block device. Users can now preload
OTP data via QEMU CLI using a block backend.

Example usage:
  ./qemu-system-arm \
    -blockdev driver=file,filename=otpmem.img,node-name=otp \
    -global aspeed-otp.drive=otp \
    ...

If the drive is provided, its content will be loaded as the initial OTP
state. Otherwise, an internal memory buffer will be used.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-5-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/nvram/aspeed_otp.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c
index e5b7ca9676..abb3731823 100644
--- a/hw/nvram/aspeed_otp.c
+++ b/hw/nvram/aspeed_otp.c
@@ -35,13 +35,25 @@ static bool aspeed_otp_init_storage(AspeedOTPState *s, Error **errp)
 {
     uint32_t *p;
     int i, num;
+    uint64_t perm;
 
+    if (s->blk) {
+        perm = BLK_PERM_CONSISTENT_READ |
+               (blk_supports_write_perm(s->blk) ? BLK_PERM_WRITE : 0);
+        if (blk_set_perm(s->blk, perm, BLK_PERM_ALL, errp) < 0) {
+            return false;
+        }
+        if (blk_pread(s->blk, 0, s->size, s->storage, 0) < 0) {
+            error_setg(errp, "Failed to read the initial flash content");
+            return false;
+        }
+    } else {
         num = s->size / sizeof(uint32_t);
         p = (uint32_t *)s->storage;
         for (i = 0; i < num; i++) {
             p[i] = (i % 2 == 0) ? 0x00000000 : 0xFFFFFFFF;
         }
-
+    }
     return true;
 }
 
@@ -75,6 +87,7 @@ static void aspeed_otp_realize(DeviceState *dev, Error **errp)
 
 static const Property aspeed_otp_properties[] = {
     DEFINE_PROP_UINT64("size", AspeedOTPState, size, 0),
+    DEFINE_PROP_DRIVE("drive", AspeedOTPState, blk),
 };
 
 static void aspeed_otp_class_init(ObjectClass *klass, const void *data)

From 8970c95c4db99dd44ff463acc14c69510776cdee Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:02 +0800
Subject: [PATCH 0754/2396] hw/nvram/aspeed_otp: Add OTP programming semantics
 and tracing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement correct OTP programming behavior for Aspeed OTP:
- Support read-modify-write flow with one-way bit programming:
  * prog_bit uses 0s as the "to-be-programmed" mask.
  * Even-indexed words: 0->1, odd-indexed words: 1->0.
  * Reject non-programmable requests and log conflicts.
- Enable unaligned accesses in MemoryRegionOps.
  Since each OTP address maps to a 1DW (4B) or 2DW (8B) block in the
  backing store, upper-layer accesses may be unaligned to block
  boundaries.

This matches the irreversible, word-parity-dependent programming rules
of Aspeed SoCs and exposes changes via QEMU trace events.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-6-kane_chen@aspeedtech.com
[ clg: Fixed PRIx64 format in aspeed_otp_write() ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/nvram/aspeed_otp.c | 80 ++++++++++++++++++++++++++++++++++++++++++-
 hw/nvram/trace-events |  5 +++
 2 files changed, 84 insertions(+), 1 deletion(-)

diff --git a/hw/nvram/aspeed_otp.c b/hw/nvram/aspeed_otp.c
index abb3731823..dcf8ed3917 100644
--- a/hw/nvram/aspeed_otp.c
+++ b/hw/nvram/aspeed_otp.c
@@ -12,6 +12,7 @@
 #include "system/block-backend.h"
 #include "hw/qdev-properties.h"
 #include "hw/nvram/aspeed_otp.h"
+#include "hw/nvram/trace.h"
 
 static uint64_t aspeed_otp_read(void *opaque, hwaddr offset, unsigned size)
 {
@@ -23,12 +24,87 @@ static uint64_t aspeed_otp_read(void *opaque, hwaddr offset, unsigned size)
     return val;
 }
 
+static bool valid_program_data(uint32_t otp_addr,
+                                 uint32_t value, uint32_t prog_bit)
+{
+    uint32_t programmed_bits, has_programmable_bits;
+    bool is_odd = otp_addr & 1;
+
+    /*
+     * prog_bit uses 0s to indicate target bits to program:
+     *   - if OTP word is even-indexed, programmed bits flip 0->1
+     *   - if odd, bits flip 1->0
+     * Bit programming is one-way only and irreversible.
+     */
+    if (is_odd) {
+        programmed_bits = ~value & prog_bit;
+    } else {
+        programmed_bits = value & (~prog_bit);
+    }
+
+    /* If any bit can be programmed, accept the request */
+    has_programmable_bits = value ^ (~prog_bit);
+
+    if (programmed_bits) {
+        trace_aspeed_otp_prog_conflict(otp_addr, programmed_bits);
+        for (int i = 0; i < 32; ++i) {
+            if (programmed_bits & (1U << i)) {
+                trace_aspeed_otp_prog_bit(i);
+            }
+        }
+    }
+
+    return has_programmable_bits != 0;
+}
+
+static bool program_otpmem_data(void *opaque, uint32_t otp_addr,
+                             uint32_t prog_bit, uint32_t *value)
+{
+    AspeedOTPState *s = opaque;
+    bool is_odd = otp_addr & 1;
+    uint32_t otp_offset = otp_addr << 2;
+
+    memcpy(value, s->storage + otp_offset, sizeof(uint32_t));
+
+    if (!valid_program_data(otp_addr, *value, prog_bit)) {
+        return false;
+    }
+
+    if (is_odd) {
+        *value &= ~prog_bit;
+    } else {
+        *value |= ~prog_bit;
+    }
+
+    return true;
+}
+
 static void aspeed_otp_write(void *opaque, hwaddr otp_addr,
                                 uint64_t val, unsigned size)
 {
     AspeedOTPState *s = opaque;
+    uint32_t otp_offset, value;
 
-    memcpy(s->storage + otp_addr, &val, size);
+    if (!program_otpmem_data(s, otp_addr, val, &value)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Failed to program data, value = %x, bit = %"PRIx64"\n",
+                      __func__, value, val);
+        return;
+    }
+
+    otp_offset = otp_addr << 2;
+    memcpy(s->storage + otp_offset, &value, size);
+
+    if (s->blk) {
+        if (blk_pwrite(s->blk, otp_offset, size, &value, 0) < 0) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Failed to write %x to %x\n",
+                          __func__, value, otp_offset);
+
+            return;
+        }
+    }
+    trace_aspeed_otp_prog(otp_offset, val, value);
 }
 
 static bool aspeed_otp_init_storage(AspeedOTPState *s, Error **errp)
@@ -63,6 +139,8 @@ static const MemoryRegionOps aspeed_otp_ops = {
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid.min_access_size = 1,
     .valid.max_access_size = 4,
+    .valid.unaligned = true,
+    .impl.unaligned = true
 };
 
 static void aspeed_otp_realize(DeviceState *dev, Error **errp)
diff --git a/hw/nvram/trace-events b/hw/nvram/trace-events
index 5e33b24d47..7084bf70d3 100644
--- a/hw/nvram/trace-events
+++ b/hw/nvram/trace-events
@@ -1,5 +1,10 @@
 # See docs/devel/tracing.rst for syntax documentation.
 
+# aspeed_otp.c
+aspeed_otp_prog(uint32_t addr, uint32_t prog_value, uint32_t value) "OTP Memory program: addr 0x%" PRIx32 " prog_value 0x%" PRIx32 " value 0x%" PRIx32
+aspeed_otp_prog_conflict(uint32_t addr, uint32_t bits) "Conflict at addr=0x%x, bits=0x%08x"
+aspeed_otp_prog_bit(int bit) "Programmed bit %d"
+
 # ds1225y.c
 nvram_read(uint32_t addr, uint32_t ret) "read addr %d: 0x%02x"
 nvram_write(uint32_t addr, uint32_t old, uint32_t val) "write addr %d: 0x%02x -> 0x%02x"

From fdad6ec30dfb87df0980887a4c22e55ccf65f9c3 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:03 +0800
Subject: [PATCH 0755/2396] hw/arm: Integrate ASPEED OTP memory support into
 AST1030 SoCs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The has_otp attribute is enabled in the SBC subclasses for AST1030 to
control the presence of OTP support per SoC type.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-7-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c      |  2 +-
 hw/misc/aspeed_sbc.c         | 16 ++++++++++++++++
 include/hw/misc/aspeed_sbc.h |  1 +
 3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index e6e1ee63c1..c446e70b24 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -154,7 +154,7 @@ static void aspeed_soc_ast1030_init(Object *obj)
 
     object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 
-    object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_SBC);
+    object_initialize_child(obj, "sbc", &s->sbc, TYPE_ASPEED_AST10X0_SBC);
 
     for (i = 0; i < sc->wdts_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.wdt-%s", socname);
diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index b56a8b7678..052c70fd42 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -285,9 +285,25 @@ static const TypeInfo aspeed_ast2600_sbc_info = {
     .class_init = aspeed_ast2600_sbc_class_init,
 };
 
+static void aspeed_ast10x0_sbc_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSBCClass *sc = ASPEED_SBC_CLASS(klass);
+
+    dc->desc = "AST10X0 Secure Boot Controller";
+    sc->has_otp = true;
+}
+
+static const TypeInfo aspeed_ast10x0_sbc_info = {
+    .name = TYPE_ASPEED_AST10X0_SBC,
+    .parent = TYPE_ASPEED_SBC,
+    .class_init = aspeed_ast10x0_sbc_class_init,
+};
+
 static void aspeed_sbc_register_types(void)
 {
     type_register_static(&aspeed_ast2600_sbc_info);
+    type_register_static(&aspeed_ast10x0_sbc_info);
     type_register_static(&aspeed_sbc_info);
 }
 
diff --git a/include/hw/misc/aspeed_sbc.h b/include/hw/misc/aspeed_sbc.h
index 0c2746d392..7d640a022e 100644
--- a/include/hw/misc/aspeed_sbc.h
+++ b/include/hw/misc/aspeed_sbc.h
@@ -14,6 +14,7 @@
 
 #define TYPE_ASPEED_SBC "aspeed.sbc"
 #define TYPE_ASPEED_AST2600_SBC TYPE_ASPEED_SBC "-ast2600"
+#define TYPE_ASPEED_AST10X0_SBC TYPE_ASPEED_SBC "-ast10x0"
 OBJECT_DECLARE_TYPE(AspeedSBCState, AspeedSBCClass, ASPEED_SBC)
 
 #define ASPEED_SBC_NR_REGS (0x93c >> 2)

From 02cebef5a140a0008a8bb0d3db6e33a4e7e4a9d2 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:04 +0800
Subject: [PATCH 0756/2396] hw/misc/aspeed_sbc: Add CAMP2 support for OTP data
 reads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OTP space contains three types of entries: data, conf, and strap.
Data entries consist of two DWORDs, while the other types contain
only one DWORD. This change adds the R_CAMP2 register (0x024 / 4) to
store the second DWORD when reading from the OTP data region.

With this enhancement, OTP reads now correctly return both DWORDs for
data entries via the CAMP registers, along with improved address
validation and error handling.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-8-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_sbc.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 052c70fd42..787e2d0489 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -22,6 +22,7 @@
 #define R_ADDR          (0x010 / 4)
 #define R_STATUS        (0x014 / 4)
 #define R_CAMP1         (0x020 / 4)
+#define R_CAMP2         (0x024 / 4)
 #define R_QSR           (0x040 / 4)
 
 /* R_STATUS */
@@ -50,6 +51,8 @@
 #define SBC_OTP_CMD_READ 0x23b1e361
 #define SBC_OTP_CMD_PROG 0x23b1e364
 
+#define OTP_DATA_DWORD_COUNT        (0x800)
+#define OTP_TOTAL_DWORD_COUNT       (0x1000)
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -72,6 +75,16 @@ static bool aspeed_sbc_otp_read(AspeedSBCState *s,
     MemTxResult ret;
     AspeedOTPState *otp = &s->otp;
     uint32_t value, otp_offset;
+    bool is_data = false;
+
+    if (otp_addr < OTP_DATA_DWORD_COUNT) {
+        is_data = true;
+    } else if (otp_addr >= OTP_TOTAL_DWORD_COUNT) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Invalid OTP addr 0x%x\n",
+                      otp_addr);
+        return false;
+    }
 
     otp_offset = otp_addr << 2;
     ret = address_space_read(&otp->as, otp_offset, MEMTXATTRS_UNSPECIFIED,
@@ -85,6 +98,20 @@ static bool aspeed_sbc_otp_read(AspeedSBCState *s,
     s->regs[R_CAMP1] = value;
     trace_aspeed_sbc_otp_read(otp_addr, value);
 
+    if (is_data) {
+        ret = address_space_read(&otp->as, otp_offset + 4,
+                                 MEMTXATTRS_UNSPECIFIED,
+                                 &value, sizeof(value));
+        if (ret != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "Failed to read OTP memory, addr = %x\n",
+                          otp_addr);
+            return false;
+        }
+        s->regs[R_CAMP2] = value;
+        trace_aspeed_sbc_otp_read(otp_addr + 1, value);
+    }
+
     return true;
 }
 

From 61dcc2c2db0236fde878d053028c39fe27dc8f36 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:05 +0800
Subject: [PATCH 0757/2396] hw/misc/aspeed_sbc: Handle OTP write command for
 voltage mode registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend OTP command handling to recognize specific voltage mode register
addresses and emulate the expected hardware behavior. Without this
change, legitimate voltage mode change requests would be incorrectly
reported as "Unknown command" and logged as an error.

This implementation does not perform actual mode changes, but ensures
that valid requests are accepted and ignored as per hardware behavior.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-9-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/misc/aspeed_sbc.c | 41 +++++++++++++++++++++++++++++++++++++++++
 hw/misc/trace-events |  1 +
 2 files changed, 42 insertions(+)

diff --git a/hw/misc/aspeed_sbc.c b/hw/misc/aspeed_sbc.c
index 787e2d0489..2fc5db749d 100644
--- a/hw/misc/aspeed_sbc.c
+++ b/hw/misc/aspeed_sbc.c
@@ -49,10 +49,17 @@
 #define OTP_MEMORY_SIZE 0x4000
 /* OTP command */
 #define SBC_OTP_CMD_READ 0x23b1e361
+#define SBC_OTP_CMD_WRITE 0x23b1e362
 #define SBC_OTP_CMD_PROG 0x23b1e364
 
 #define OTP_DATA_DWORD_COUNT        (0x800)
 #define OTP_TOTAL_DWORD_COUNT       (0x1000)
+
+/* Voltage mode */
+#define MODE_REGISTER               (0x1000)
+#define MODE_REGISTER_A             (0x3000)
+#define MODE_REGISTER_B             (0x5000)
+
 static uint64_t aspeed_sbc_read(void *opaque, hwaddr addr, unsigned int size)
 {
     AspeedSBCState *s = ASPEED_SBC(opaque);
@@ -115,6 +122,37 @@ static bool aspeed_sbc_otp_read(AspeedSBCState *s,
     return true;
 }
 
+static bool mode_handler(uint32_t otp_addr)
+{
+    switch (otp_addr) {
+    case MODE_REGISTER:
+    case MODE_REGISTER_A:
+    case MODE_REGISTER_B:
+        /* HW behavior, do nothing here */
+        return true;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "Unsupported address 0x%x\n",
+                      otp_addr);
+        return false;
+    }
+}
+
+static bool aspeed_sbc_otp_write(AspeedSBCState *s,
+                                    uint32_t otp_addr)
+{
+    if (otp_addr == 0) {
+        trace_aspeed_sbc_ignore_cmd(otp_addr);
+        return true;
+    } else {
+        if (mode_handler(otp_addr) == false) {
+            return false;
+        }
+    }
+
+    return true;
+}
+
 static bool aspeed_sbc_otp_prog(AspeedSBCState *s,
                                    uint32_t otp_addr)
 {
@@ -157,6 +195,9 @@ static void aspeed_sbc_handle_command(void *opaque, uint32_t cmd)
     case SBC_OTP_CMD_READ:
         ret = aspeed_sbc_otp_read(s, otp_addr);
         break;
+    case SBC_OTP_CMD_WRITE:
+        ret = aspeed_sbc_otp_write(s, otp_addr);
+        break;
     case SBC_OTP_CMD_PROG:
         ret = aspeed_sbc_otp_prog(s, otp_addr);
         break;
diff --git a/hw/misc/trace-events b/hw/misc/trace-events
index 9e05b82f37..eeb9243898 100644
--- a/hw/misc/trace-events
+++ b/hw/misc/trace-events
@@ -91,6 +91,7 @@ slavio_led_mem_writew(uint32_t val) "Write diagnostic LED 0x%04x"
 slavio_led_mem_readw(uint32_t ret) "Read diagnostic LED 0x%04x"
 
 # aspeed_sbc.c
+aspeed_sbc_ignore_cmd(uint32_t cmd) "Ignoring command 0x%" PRIx32
 aspeed_sbc_handle_cmd(uint32_t cmd, uint32_t addr, bool ret) "Handling command 0x%" PRIx32 " for OTP addr 0x%" PRIx32 " Result: %d"
 aspeed_sbc_otp_read(uint32_t addr, uint32_t value) "OTP Memory read: addr 0x%" PRIx32 " value 0x%" PRIx32
 aspeed_sbc_otp_prog(uint32_t addr, uint32_t value) "OTP Memory write: addr 0x%" PRIx32 " value 0x%" PRIx32

From ea82822b7962df7846fc71a387e0c44867a66e39 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Tue, 12 Aug 2025 17:40:07 +0800
Subject: [PATCH 0758/2396] docs/system/arm/aspeed: Document OTP memory options
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add documentation for the OTP memory module used by AST2600 and AST1030
SoCs, and describe options for using a pre-generated image or an
internal buffer. Include example commands for configuration and image
generation.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250812094011.2617526-11-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/arm/aspeed.rst | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index bf18c56347..6317c0e910 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -243,6 +243,37 @@ under Linux), use :
 
   -M ast2500-evb,bmc-console=uart3
 
+OTP Option
+^^^^^^^^^^
+
+Both the AST2600 and AST1030 chips use the same One Time Programmable
+(OTP) memory module, which is utilized for configuration, key storage,
+and storing user-programmable data. This OTP memory module is managed
+by the Secure Boot Controller (SBC). The following options can be
+specified or omitted based on your needs.
+
+  * When the options are specified, the pre-generated configuration
+    file will be used as the OTP memory storage.
+
+  * When the options are omitted, an internal memory buffer will be
+    used to store the OTP memory data.
+
+.. code-block:: bash
+
+  -blockdev driver=file,filename=otpmem.img,node-name=otp \
+  -global aspeed-otp.drive=otp \
+
+The following bash command can be used to generate a default
+configuration file for OTP memory:
+
+.. code-block:: bash
+
+  if [ ! -f otpmem.img ]; then
+    for i in $(seq 1 2048); do
+      printf '\x00\x00\x00\x00\xff\xff\xff\xff'
+    done > otpmem.img
+  fi
+
 Aspeed 2700 family boards (``ast2700-evb``)
 ==================================================================
 

From b28103bb52161e2d240be3e03bf0e8680cb873c9 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 2 Sep 2025 14:25:50 +0800
Subject: [PATCH 0759/2396] hw/arm/aspeed Move ast2700-evb alias to
 ast2700a1-evb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch moves the "ast2700-evb" alias from the A0 to A1.
The A0 machine remains available via its explicit name
("ast2700a0-evb"), while functional tests are updated to
target A0 by name instead of relying on the generic alias.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250902062550.3797040-1-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                                 | 2 +-
 tests/functional/aarch64/test_aspeed_ast2700.py | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index c31bbe7701..d21b21965a 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1995,7 +1995,6 @@ static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
-    mc->alias = "ast2700-evb";
     mc->desc = "Aspeed AST2700 A0 EVB (Cortex-A35)";
     amc->soc_name  = "ast2700-a0";
     amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
@@ -2018,6 +2017,7 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
     MachineClass *mc = MACHINE_CLASS(oc);
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
+    mc->alias = "ast2700-evb";
     mc->desc = "Aspeed AST2700 A1 EVB (Cortex-A35)";
     amc->soc_name  = "ast2700-a1";
     amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index 8a08bc4688..a3db267294 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -115,8 +115,8 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
                 self.scratch_file(name, 'image-bmc'))
 
-    def test_aarch64_ast2700_evb_sdk_v09_06(self):
-        self.set_machine('ast2700-evb')
+    def test_aarch64_ast2700a0_evb_sdk_v09_06(self):
+        self.set_machine('ast2700a0-evb')
 
         self.archive_extract(self.ASSET_SDK_V906_AST2700)
         self.start_ast2700_test('ast2700-a0-default')

From 54623e94623cd75aec87ebd1e49b538033676c3f Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Wed, 17 Sep 2025 11:59:15 +0800
Subject: [PATCH 0760/2396] tests/functional/arm: Add helper to generate OTP
 images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a small helper that generates OTP images at test time. This lets
multiple test cases create default OTP contents without shipping prebuilt
fixtures and keeps the tests self-contained.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250917035917.4141723-2-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aspeed.py | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tests/functional/aspeed.py b/tests/functional/aspeed.py
index b131703c52..47e84e035b 100644
--- a/tests/functional/aspeed.py
+++ b/tests/functional/aspeed.py
@@ -61,3 +61,11 @@ class AspeedTest(LinuxKernelTest):
         self.wait_for_console_pattern('U-Boot 2019.04')
         self.wait_for_console_pattern('## Loading kernel from FIT Image')
         self.wait_for_console_pattern('Starting kernel ...')
+
+    def generate_otpmem_image(self):
+        path = self.scratch_file("otpmem.img")
+        pattern = b'\x00\x00\x00\x00\xff\xff\xff\xff' * (16 * 1024 // 8)
+        with open(path, "wb") as f:
+            f.write(pattern)
+        return path
+

From fb89ceac92012d154f1113190e24e45a42f396fc Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Wed, 17 Sep 2025 11:59:16 +0800
Subject: [PATCH 0761/2396] tests/functional/arm: Add AST1030 boot test with
 generated OTP image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a functional test that boots an AST1030 machine with a generated
OTP image. The test verifies that OTP contents are read during early
boot and that the system reaches the expected console prompt.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250917035917.4141723-3-kane_chen@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast1030.py | 24 +++++++++++++++++----
 1 file changed, 20 insertions(+), 4 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1030.py b/tests/functional/arm/test_aspeed_ast1030.py
index 42126b514f..e47b597d0b 100755
--- a/tests/functional/arm/test_aspeed_ast1030.py
+++ b/tests/functional/arm/test_aspeed_ast1030.py
@@ -7,17 +7,18 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import LinuxKernelTest, Asset
+from aspeed import AspeedTest
 from qemu_test import exec_command_and_wait_for_pattern
 
 
-class AST1030Machine(LinuxKernelTest):
+class AST1030Machine(AspeedTest):
 
     ASSET_ZEPHYR_3_02 = Asset(
         ('https://github.com/AspeedTech-BMC'
          '/zephyr/releases/download/v00.03.02/ast1030-evb-demo.zip'),
         '1ec83caab3ddd5d09481772801be7210e222cb015ce22ec6fffb8a76956dcd4f')
 
-    def test_ast1030_zephyros_3_02(self):
+    def test_arm_ast1030_zephyros_3_02(self):
         self.set_machine('ast1030-evb')
 
         kernel_name = "ast1030-evb-demo-3/zephyr.elf"
@@ -36,7 +37,7 @@ class AST1030Machine(LinuxKernelTest):
          '/zephyr/releases/download/v00.01.07/ast1030-evb-demo.zip'),
         'ad52e27959746988afaed8429bf4e12ab988c05c4d07c9d90e13ec6f7be4574c')
 
-    def test_ast1030_zephyros_1_07(self):
+    def test_arm_ast1030_zephyros_1_07(self):
         self.set_machine('ast1030-evb')
 
         kernel_name = "ast1030-evb-demo/zephyr.bin"
@@ -68,6 +69,21 @@ class AST1030Machine(LinuxKernelTest):
                 'kernel uptime',
         ]: exec_command_and_wait_for_pattern(self, shell_cmd, "uart:~$")
 
+    def test_arm_ast1030_otp_blockdev_device(self):
+        self.vm.set_machine("ast1030-evb")
+
+        kernel_name = "ast1030-evb-demo-3/zephyr.elf"
+        kernel_file = self.archive_extract(self.ASSET_ZEPHYR_3_02, member=kernel_name)
+        otp_img = self.generate_otpmem_image()
+
+        self.vm.set_console()
+        self.vm.add_args(
+            "-kernel", kernel_file,
+            "-blockdev", f"driver=file,filename={otp_img},node-name=otp",
+            "-global", "aspeed-otp.drive=otp",
+        )
+        self.vm.launch()
+        self.wait_for_console_pattern("Booting Zephyr OS")
 
 if __name__ == '__main__':
-    LinuxKernelTest.main()
+    AspeedTest.main()

From 2057685f0b02f06ae2aec0627489421f06bc7796 Mon Sep 17 00:00:00 2001
From: Kane-Chen-AS <kane_chen@aspeedtech.com>
Date: Wed, 17 Sep 2025 11:59:17 +0800
Subject: [PATCH 0762/2396] tests/functional/arm: Add AST2600 boot test with
 generated OTP image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a functional test that boots an AST2600 machine with a generated
OTP image. The test verifies that OTP contents are read during early
boot and that the system reaches the expected console prompt.

Signed-off-by: Kane-Chen-AS <kane_chen@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250917035917.4141723-4-kane_chen@aspeedtech.com
[ clg: checkpath fixes ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2600.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tests/functional/arm/test_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600.py
index 129695ca4e..62949b0b4f 100755
--- a/tests/functional/arm/test_aspeed_ast2600.py
+++ b/tests/functional/arm/test_aspeed_ast2600.py
@@ -136,5 +136,20 @@ class AST2600Machine(AspeedTest):
         exec_command_and_wait_for_pattern(self,
              '/sbin/hwclock -f /dev/rtc1', year)
 
+    def test_arm_ast2600_otp_blockdev_device(self):
+        self.vm.set_machine("ast2600-evb")
+
+        image_path = self.archive_extract(self.ASSET_SDK_V907_AST2600)
+        otp_img = self.generate_otpmem_image()
+
+        self.vm.set_console()
+        self.vm.add_args(
+            "-blockdev", f"driver=file,filename={otp_img},node-name=otp",
+            "-global", "aspeed-otp.drive=otp",
+        )
+        self.do_test_arm_aspeed_sdk_start(
+            self.scratch_file("ast2600-default", "image-bmc"))
+        self.wait_for_console_pattern("ast2600-default login:")
+
 if __name__ == '__main__':
     AspeedTest.main()

From 42dd3c4f7dbceb6ea374b3fbe104781f68008e1f Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:00 +0800
Subject: [PATCH 0763/2396] hw/pci/pci_ids: Add PCI vendor ID for ASPEED
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/pci/pci_ids.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index 33e2898be9..16034aaa2c 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -291,4 +291,6 @@
 
 #define PCI_VENDOR_ID_NVIDIA             0x10de
 
+#define PCI_VENDOR_ID_ASPEED             0x1A03
+
 #endif

From 303e8dc29ffe6dc2417a0240cea604f18371ea12 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:01 +0800
Subject: [PATCH 0764/2396] hw/pci-host/aspeed: Add AST2600 PCIe PHY model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces an initial ASPEED PCIe PHY/host controller model to
support the AST2600 SoC. It provides a simple register block with MMIO
read/write callbacks, integration into the build system, and trace events
for debugging.

Key changes:

1. PCIe PHY MMIO read/write callbacks
   Implemented aspeed_pcie_phy_read() and aspeed_pcie_phy_write() to
   handle 32-bit register accesses.

2. Build system and Kconfig integration
   Added CONFIG_PCI_EXPRESS_ASPEED in hw/pci-host/Kconfig and meson
   rules.
   Updated ASPEED_SOC in hw/arm/Kconfig to imply PCI_DEVICES and select
   PCI_EXPRESS_ASPEED.

3. Trace events for debug
   New tracepoints aspeed_pcie_phy_read and aspeed_pcie_phy_write allow
   monitoring MMIO accesses.

4. Register space and defaults (AST2600 reference)
   Expose a 0x100 register space, as documented in the AST2600 datasheet.
   On reset, set default values:
   PEHR_ID: Vendor ID = ASPEED, Device ID = 0x1150
   PEHR_CLASS_CODE = 0x06040006
   PEHR_DATALINK = 0xD7040022
   PEHR_LINK: bit[5] set to 1 to indicate link up.

This provides a skeleton device for the AST2600 platform. It enables
firmware to detect the PCIe link as up by default and allows future
extension.

This commit is the starting point of the series to introduce ASPEED PCIe
Root Complex (RC) support. Based on previous work from Cédric Le Goater,
the following commits in this series extend and refine the implementation:

- Add a PCIe Root Port so that devices can be attached without requiring an
extra bridge.
- Restrict the Root Port device instantiation to the AST2600 platform.
- Integrate aspeed_cfg_translate_write() to support both AST2600 and AST2700.
- Add MSI support and a preliminary RC IOMMU address space.
- Fix issues with MSI interrupt clearing.
- Extend support to the AST2700 SoC.
- Drop the AST2600 RC_L support.
- Introduce PCIe RC functional tests covering both AST2600 and AST2700.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/Kconfig                    |   3 +
 hw/pci-host/Kconfig               |   4 +
 hw/pci-host/aspeed_pcie.c         | 157 ++++++++++++++++++++++++++++++
 hw/pci-host/meson.build           |   1 +
 hw/pci-host/trace-events          |   4 +
 include/hw/pci-host/aspeed_pcie.h |  42 ++++++++
 6 files changed, 211 insertions(+)
 create mode 100644 hw/pci-host/aspeed_pcie.c
 create mode 100644 include/hw/pci-host/aspeed_pcie.h

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 3baa6c6c74..b44b85f436 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -541,6 +541,7 @@ config ASPEED_SOC
     bool
     default y
     depends on TCG && ARM
+    imply PCI_DEVICES
     select DS1338
     select FTGMAC100
     select I2C
@@ -561,6 +562,8 @@ config ASPEED_SOC
     select MAX31785
     select FSI_APB2OPB_ASPEED
     select AT24C
+    select PCI_EXPRESS
+    select PCI_EXPRESS_ASPEED
 
 config MPS2
     bool
diff --git a/hw/pci-host/Kconfig b/hw/pci-host/Kconfig
index 9824fa188d..8cbb8304a3 100644
--- a/hw/pci-host/Kconfig
+++ b/hw/pci-host/Kconfig
@@ -46,6 +46,10 @@ config PCI_I440FX
     select PCI
     select PAM
 
+config PCI_EXPRESS_ASPEED
+    bool
+    select PCI_EXPRESS
+
 config PCI_EXPRESS_Q35
     bool
     select PCI_EXPRESS
diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
new file mode 100644
index 0000000000..4c74520052
--- /dev/null
+++ b/hw/pci-host/aspeed_pcie.c
@@ -0,0 +1,157 @@
+/*
+ * ASPEED PCIe Host Controller
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ * Copyright (c) 2022 Cédric Le Goater <clg@kaod.org>
+ *
+ * Authors:
+ *   Cédric Le Goater <clg@kaod.org>
+ *   Jamin Lin <jamin_lin@aspeedtech.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Based on previous work from Cédric Le Goater.
+ * Modifications extend support for the ASPEED AST2600 and AST2700 platforms.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qapi/error.h"
+#include "hw/qdev-properties.h"
+#include "hw/registerfields.h"
+#include "hw/irq.h"
+#include "hw/pci/pci_host.h"
+#include "hw/pci-host/aspeed_pcie.h"
+#include "hw/pci/msi.h"
+#include "trace.h"
+
+/*
+ * PCIe PHY
+ *
+ * PCIe Host Controller (PCIEH)
+ */
+
+/* AST2600 */
+REG32(PEHR_ID,     0x00)
+    FIELD(PEHR_ID, DEV, 16, 16)
+REG32(PEHR_CLASS_CODE,  0x04)
+REG32(PEHR_DATALINK,    0x10)
+REG32(PEHR_PROTECT,     0x7C)
+    FIELD(PEHR_PROTECT, LOCK, 0, 8)
+REG32(PEHR_LINK,        0xC0)
+    FIELD(PEHR_LINK, STS, 5, 1)
+
+#define ASPEED_PCIE_PHY_UNLOCK  0xA8
+
+static uint64_t aspeed_pcie_phy_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(opaque);
+    uint32_t reg = addr >> 2;
+    uint32_t value = 0;
+
+    value = s->regs[reg];
+
+    trace_aspeed_pcie_phy_read(s->id, addr, value);
+
+    return value;
+}
+
+static void aspeed_pcie_phy_write(void *opaque, hwaddr addr, uint64_t data,
+                                  unsigned int size)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(opaque);
+    uint32_t reg = addr >> 2;
+
+    trace_aspeed_pcie_phy_write(s->id, addr, data);
+
+    switch (reg) {
+    case R_PEHR_PROTECT:
+        data &= R_PEHR_PROTECT_LOCK_MASK;
+        s->regs[reg] = !!(data == ASPEED_PCIE_PHY_UNLOCK);
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
+}
+
+static const MemoryRegionOps aspeed_pcie_phy_ops = {
+    .read = aspeed_pcie_phy_read,
+    .write = aspeed_pcie_phy_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static void aspeed_pcie_phy_reset(DeviceState *dev)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(dev);
+    AspeedPCIEPhyClass *apc = ASPEED_PCIE_PHY_GET_CLASS(s);
+
+    memset(s->regs, 0, apc->nr_regs << 2);
+
+    s->regs[R_PEHR_ID] =
+        (0x1150 << R_PEHR_ID_DEV_SHIFT) | PCI_VENDOR_ID_ASPEED;
+    s->regs[R_PEHR_CLASS_CODE] = 0x06040006;
+    s->regs[R_PEHR_DATALINK] = 0xD7040022;
+    s->regs[R_PEHR_LINK] = R_PEHR_LINK_STS_MASK;
+}
+
+static void aspeed_pcie_phy_realize(DeviceState *dev, Error **errp)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(dev);
+    AspeedPCIEPhyClass *apc = ASPEED_PCIE_PHY_GET_CLASS(s);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    g_autofree char *name = NULL;
+
+    s->regs = g_new(uint32_t, apc->nr_regs);
+    name = g_strdup_printf(TYPE_ASPEED_PCIE_PHY ".regs.%d", s->id);
+    memory_region_init_io(&s->mmio, OBJECT(s), &aspeed_pcie_phy_ops, s, name,
+                          apc->nr_regs << 2);
+    sysbus_init_mmio(sbd, &s->mmio);
+}
+
+static void aspeed_pcie_phy_unrealize(DeviceState *dev)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(dev);
+
+    g_free(s->regs);
+    s->regs = NULL;
+}
+
+static const Property aspeed_pcie_phy_props[] = {
+    DEFINE_PROP_UINT32("id", AspeedPCIEPhyState, id, 0),
+};
+
+static void aspeed_pcie_phy_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedPCIEPhyClass *apc = ASPEED_PCIE_PHY_CLASS(klass);
+
+    dc->desc = "ASPEED PCIe Phy";
+    dc->realize = aspeed_pcie_phy_realize;
+    dc->unrealize = aspeed_pcie_phy_unrealize;
+    device_class_set_legacy_reset(dc, aspeed_pcie_phy_reset);
+    device_class_set_props(dc, aspeed_pcie_phy_props);
+
+    apc->nr_regs = 0x100 >> 2;
+}
+
+static const TypeInfo aspeed_pcie_phy_info = {
+    .name       = TYPE_ASPEED_PCIE_PHY,
+    .parent     = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(AspeedPCIEPhyState),
+    .class_init = aspeed_pcie_phy_class_init,
+    .class_size = sizeof(AspeedPCIEPhyClass),
+};
+
+static void aspeed_pcie_register_types(void)
+{
+    type_register_static(&aspeed_pcie_phy_info);
+}
+
+type_init(aspeed_pcie_register_types);
+
diff --git a/hw/pci-host/meson.build b/hw/pci-host/meson.build
index 937a0f72ac..86b754d0b0 100644
--- a/hw/pci-host/meson.build
+++ b/hw/pci-host/meson.build
@@ -2,6 +2,7 @@ pci_ss = ss.source_set()
 pci_ss.add(when: 'CONFIG_PAM', if_true: files('pam.c'))
 pci_ss.add(when: 'CONFIG_PCI_BONITO', if_true: files('bonito.c'))
 pci_ss.add(when: 'CONFIG_GT64120', if_true: files('gt64120.c'))
+pci_ss.add(when: 'CONFIG_PCI_EXPRESS_ASPEED', if_true: files('aspeed_pcie.c'))
 pci_ss.add(when: 'CONFIG_PCI_EXPRESS_DESIGNWARE', if_true: files('designware.c'))
 pci_ss.add(when: 'CONFIG_PCI_EXPRESS_GENERIC_BRIDGE', if_true: files('gpex.c'))
 pci_ss.add(when: ['CONFIG_PCI_EXPRESS_GENERIC_BRIDGE', 'CONFIG_ACPI'], if_true: files('gpex-acpi.c'))
diff --git a/hw/pci-host/trace-events b/hw/pci-host/trace-events
index 0a816b9aa1..3438516756 100644
--- a/hw/pci-host/trace-events
+++ b/hw/pci-host/trace-events
@@ -1,5 +1,9 @@
 # See docs/devel/tracing.rst for syntax documentation.
 
+# aspeed_pcie.c
+aspeed_pcie_phy_read(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
+aspeed_pcie_phy_write(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
+
 # bonito.c
 bonito_spciconf_small_access(uint64_t addr, unsigned size) "PCI config address is smaller then 32-bit, addr: 0x%"PRIx64", size: %u"
 
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
new file mode 100644
index 0000000000..d9fb829048
--- /dev/null
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -0,0 +1,42 @@
+/*
+ * ASPEED PCIe Host Controller
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ * Copyright (c) 2022 Cédric Le Goater <clg@kaod.org>
+ *
+ * Authors:
+ *   Cédric Le Goater <clg@kaod.org>
+ *   Jamin Lin <jamin_lin@aspeedtech.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Based on previous work from Cédric Le Goater.
+ * Modifications extend support for the ASPEED AST2600 and AST2700 platforms.
+ */
+
+#ifndef ASPEED_PCIE_H
+#define ASPEED_PCIE_H
+
+#include "hw/sysbus.h"
+#include "hw/pci/pci_bridge.h"
+#include "hw/pci/pcie_host.h"
+#include "qom/object.h"
+
+#define TYPE_ASPEED_PCIE_PHY "aspeed.pcie-phy"
+OBJECT_DECLARE_TYPE(AspeedPCIEPhyState, AspeedPCIEPhyClass, ASPEED_PCIE_PHY);
+
+struct AspeedPCIEPhyState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+    uint32_t *regs;
+    uint32_t id;
+};
+
+struct AspeedPCIEPhyClass {
+    SysBusDeviceClass parent_class;
+
+    uint64_t nr_regs;
+};
+
+#endif /* ASPEED_PCIE_H */

From f002aa35f3205d55bbe4a68670ba19a6dcf1d6a8 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:02 +0800
Subject: [PATCH 0765/2396] hw/pci-host/aspeed: Add AST2600 PCIe config space
 and host bridge
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce PCIe config and host bridge model for the AST2600 platform.

This patch adds support for the H2X (AHB to PCIe Bus Bridge) controller
with a 0x100 byte register space. The register layout is shared between
two root complexes: 0x00–0x7f is common, 0x80–0xbf for RC_L, and 0xc0–0xff
for RC_H. Only RC_H is modeled in this implementation.

The RC_H bus uses bus numbers in the 0x80–0xff range instead of the
standard root bus 0x00. To allow the PCI subsystem to discover devices,
the host bridge logic remaps the root bus number back to 0x00 whenever the
configured bus number matches the "bus-nr" property.

New MMIO callbacks are added for the H2X config space:
- aspeed_pcie_cfg_read() and aspeed_pcie_cfg_write() handle register
  accesses.
- aspeed_pcie_cfg_readwrite() provides configuration read/write support.
- aspeed_pcie_cfg_translate_write() handles PCIe byte-enable semantics for
  write operations.

The reset handler initializes the H2X register block with default values
as defined in the AST2600 datasheet.

Additional changes:
- Implement ASPEED PCIe root complex (TYPE_ASPEED_PCIE_RC).
- Wire up interrupt propagation via aspeed_pcie_rc_set_irq().
- Add tracepoints for config read/write and INTx handling.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 421 ++++++++++++++++++++++++++++++
 hw/pci-host/trace-events          |   4 +
 include/hw/pci-host/aspeed_pcie.h |  59 +++++
 3 files changed, 484 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index 4c74520052..c3e92ee449 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -25,6 +25,425 @@
 #include "hw/pci/msi.h"
 #include "trace.h"
 
+/*
+ * PCIe Root Complex (RC)
+ */
+
+static void aspeed_pcie_rc_set_irq(void *opaque, int irq, int level)
+{
+    AspeedPCIERcState *rc = (AspeedPCIERcState *) opaque;
+    AspeedPCIECfgState *cfg =
+        container_of(rc, AspeedPCIECfgState, rc);
+    bool intx;
+
+    assert(irq < PCI_NUM_PINS);
+
+    if (level) {
+        cfg->regs[cfg->rc_regs->int_sts_reg] |= BIT(irq);
+    } else {
+        cfg->regs[cfg->rc_regs->int_sts_reg] &= ~BIT(irq);
+    }
+
+    intx = !!(cfg->regs[cfg->rc_regs->int_sts_reg] &
+              cfg->regs[cfg->rc_regs->int_en_reg]);
+    trace_aspeed_pcie_rc_intx_set_irq(cfg->id, irq, intx);
+    qemu_set_irq(rc->irq, intx);
+}
+
+static int aspeed_pcie_rc_map_irq(PCIDevice *pci_dev, int irq_num)
+{
+    return irq_num % PCI_NUM_PINS;
+}
+
+static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
+{
+    PCIExpressHost *pex = PCIE_HOST_BRIDGE(dev);
+    AspeedPCIERcState *rc = ASPEED_PCIE_RC(dev);
+    AspeedPCIECfgState *cfg =
+           container_of(rc, AspeedPCIECfgState, rc);
+    PCIHostState *pci = PCI_HOST_BRIDGE(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    g_autofree char *ioport_window_name = NULL;
+    g_autofree char *mmio_window_name = NULL;
+    g_autofree char *root_bus_name = NULL;
+
+    /* PCI configuration space */
+    pcie_host_mmcfg_init(pex, PCIE_MMCFG_SIZE_MAX);
+    sysbus_init_mmio(sbd, &pex->mmio);
+
+    /* MMIO and IO region */
+    memory_region_init(&rc->mmio, OBJECT(rc), "mmio", UINT64_MAX);
+    memory_region_init(&rc->io, OBJECT(rc), "io", 0x10000);
+
+    mmio_window_name = g_strdup_printf("pcie.%d.mmio_window", cfg->id);
+    memory_region_init_io(&rc->mmio_window, OBJECT(rc), &unassigned_io_ops,
+                          OBJECT(rc), mmio_window_name, UINT64_MAX);
+    ioport_window_name = g_strdup_printf("pcie.%d.ioport_window", cfg->id);
+    memory_region_init_io(&rc->io_window, OBJECT(rc), &unassigned_io_ops,
+                          OBJECT(rc), ioport_window_name, 0x10000);
+
+    memory_region_add_subregion(&rc->mmio_window, 0, &rc->mmio);
+    memory_region_add_subregion(&rc->io_window, 0, &rc->io);
+    sysbus_init_mmio(sbd, &rc->mmio_window);
+    sysbus_init_mmio(sbd, &rc->io_window);
+
+    sysbus_init_irq(sbd, &rc->irq);
+    root_bus_name = g_strdup_printf("pcie.rc%d", cfg->id);
+    pci->bus = pci_register_root_bus(dev, root_bus_name,
+                                     aspeed_pcie_rc_set_irq,
+                                     aspeed_pcie_rc_map_irq, rc, &rc->mmio,
+                                     &rc->io, 0, 4, TYPE_PCIE_BUS);
+    pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
+}
+
+static const char *aspeed_pcie_rc_root_bus_path(PCIHostState *host_bridge,
+                                                PCIBus *rootbus)
+{
+    AspeedPCIERcState *rc = ASPEED_PCIE_RC(host_bridge);
+    AspeedPCIECfgState *cfg =
+           container_of(rc, AspeedPCIECfgState, rc);
+
+    snprintf(rc->name, sizeof(rc->name), "%04x:%02x", cfg->id, rc->bus_nr);
+
+    return rc->name;
+}
+
+static const Property aspeed_pcie_rc_props[] = {
+    DEFINE_PROP_UINT32("bus-nr", AspeedPCIERcState, bus_nr, 0),
+};
+
+static void aspeed_pcie_rc_class_init(ObjectClass *klass, const void *data)
+{
+    PCIHostBridgeClass *hc = PCI_HOST_BRIDGE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "ASPEED PCIe RC";
+    dc->realize = aspeed_pcie_rc_realize;
+    dc->fw_name = "pci";
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+
+    hc->root_bus_path = aspeed_pcie_rc_root_bus_path;
+    device_class_set_props(dc, aspeed_pcie_rc_props);
+
+    msi_nonbroken = true;
+}
+
+static const TypeInfo aspeed_pcie_rc_info = {
+    .name = TYPE_ASPEED_PCIE_RC,
+    .parent = TYPE_PCIE_HOST_BRIDGE,
+    .instance_size = sizeof(AspeedPCIERcState),
+    .class_init = aspeed_pcie_rc_class_init,
+};
+
+/*
+ * PCIe Config
+ *
+ * AHB to PCIe Bus Bridge (H2X)
+ *
+ * On the AST2600:
+ * NOTE: rc_l is not supported by this model.
+ * - Registers 0x00 - 0x7F are shared by both PCIe0 (rc_l) and PCIe1 (rc_h).
+ * - Registers 0x80 - 0xBF are specific to PCIe0.
+ * - Registers 0xC0 - 0xFF are specific to PCIe1.
+ */
+
+/* AST2600 */
+REG32(H2X_CTRL,             0x00)
+    FIELD(H2X_CTRL, CLEAR_RX, 4, 1)
+REG32(H2X_TX_CLEAR,         0x08)
+    FIELD(H2X_TX_CLEAR, IDLE, 0, 1)
+REG32(H2X_RDATA,            0x0C)
+REG32(H2X_TX_DESC0,         0x10)
+REG32(H2X_TX_DESC1,         0x14)
+REG32(H2X_TX_DESC2,         0x18)
+REG32(H2X_TX_DESC3,         0x1C)
+REG32(H2X_TX_DATA,          0x20)
+REG32(H2X_TX_STS,           0x24)
+    FIELD(H2X_TX_STS, IDLE, 31, 1)
+    FIELD(H2X_TX_STS, RC_L_TX_COMP, 24, 1)
+    FIELD(H2X_TX_STS, RC_H_TX_COMP, 25, 1)
+    FIELD(H2X_TX_STS, TRIG, 0, 1)
+REG32(H2X_RC_H_CTRL,        0xC0)
+REG32(H2X_RC_H_INT_EN,      0xC4)
+REG32(H2X_RC_H_INT_STS,     0xC8)
+    SHARED_FIELD(H2X_RC_INT_INTDONE, 4, 1)
+    SHARED_FIELD(H2X_RC_INT_INTX, 0, 4)
+REG32(H2X_RC_H_RDATA,       0xCC)
+
+#define TLP_FMTTYPE_CFGRD0  0x04 /* Configuration Read  Type 0 */
+#define TLP_FMTTYPE_CFGWR0  0x44 /* Configuration Write Type 0 */
+#define TLP_FMTTYPE_CFGRD1  0x05 /* Configuration Read  Type 1 */
+#define TLP_FMTTYPE_CFGWR1  0x45 /* Configuration Write Type 1 */
+
+#define PCIE_CFG_FMTTYPE_MASK(x) (((x) >> 24) & 0xff)
+#define PCIE_CFG_BYTE_EN(x) ((x) & 0xf)
+
+static const AspeedPCIERegMap aspeed_regmap = {
+    .rc = {
+        .int_en_reg     = R_H2X_RC_H_INT_EN,
+        .int_sts_reg    = R_H2X_RC_H_INT_STS,
+    },
+};
+
+static uint64_t aspeed_pcie_cfg_read(void *opaque, hwaddr addr,
+                                     unsigned int size)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(opaque);
+    uint32_t reg = addr >> 2;
+    uint32_t value = 0;
+
+    value = s->regs[reg];
+
+    trace_aspeed_pcie_cfg_read(s->id, addr, value);
+
+    return value;
+}
+
+static void aspeed_pcie_cfg_translate_write(uint8_t byte_en, uint32_t *addr,
+                                            uint64_t *val, int *len)
+{
+    uint64_t packed_val = 0;
+    int first_bit = -1;
+    int index = 0;
+    int i;
+
+    *len = ctpop8(byte_en);
+
+    if (*len == 0 || *len > 4) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid byte enable: 0x%x\n",
+                      __func__, byte_en);
+        return;
+    }
+
+    /* Special case: full 4-byte write must be 4-byte aligned */
+    if (byte_en == 0x0f) {
+        if ((*addr & 0x3) != 0) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: 4-byte write not 4-byte aligned: addr=0x%x\n",
+                          __func__, *addr);
+            return;
+        }
+        *val &= 0xffffffffULL;
+        return;
+    }
+
+    for (i = 0; i < 4; i++) {
+        if (byte_en & (1 << i)) {
+            if (first_bit < 0) {
+                first_bit = i;
+            }
+            packed_val |= ((*val >> (i * 8)) & 0xff) << (index * 8);
+            index++;
+        }
+    }
+
+    *addr += first_bit;
+    *val = packed_val;
+}
+
+static void aspeed_pcie_cfg_readwrite(AspeedPCIECfgState *s,
+                                      const AspeedPCIECfgTxDesc *desc)
+{
+    AspeedPCIERcState *rc = &s->rc;
+    PCIHostState *pci = NULL;
+    PCIDevice *pdev = NULL;
+    uint32_t cfg_addr;
+    uint32_t offset;
+    uint8_t byte_en;
+    bool is_write;
+    uint8_t devfn;
+    uint64_t val;
+    uint8_t bus;
+    int len;
+
+    val = ~0;
+    is_write = !!(desc->desc0 & BIT(30));
+    cfg_addr = desc->desc2;
+
+    bus = (cfg_addr >> 24) & 0xff;
+    devfn  = (cfg_addr >> 16) & 0xff;
+    offset = cfg_addr & 0xffc;
+
+    pci = PCI_HOST_BRIDGE(rc);
+
+    /*
+     * On the AST2600, the RC_H bus number range from 0x80 to 0xFF, with the
+     * root device and root port assigned to bus 0x80 instead of the standard
+     * 0x00. To allow the PCI subsystem to correctly discover devices on the
+     * root bus, bus 0x80 is remapped to 0x00.
+     */
+    if (bus == rc->bus_nr) {
+        bus = 0;
+    }
+
+    pdev = pci_find_device(pci->bus, bus, devfn);
+    if (!pdev) {
+        s->regs[desc->rdata_reg] = ~0;
+        goto out;
+    }
+
+    switch (PCIE_CFG_FMTTYPE_MASK(desc->desc0)) {
+    case TLP_FMTTYPE_CFGWR0:
+    case TLP_FMTTYPE_CFGWR1:
+        byte_en = PCIE_CFG_BYTE_EN(desc->desc1);
+        val = desc->wdata;
+        aspeed_pcie_cfg_translate_write(byte_en, &offset, &val, &len);
+        pci_host_config_write_common(pdev, offset, pci_config_size(pdev),
+                                     val, len);
+        break;
+    case TLP_FMTTYPE_CFGRD0:
+    case TLP_FMTTYPE_CFGRD1:
+        val = pci_host_config_read_common(pdev, offset,
+                                          pci_config_size(pdev), 4);
+        s->regs[desc->rdata_reg] = val;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid CFG type. DESC0=0x%x\n",
+                      __func__, desc->desc0);
+    }
+
+out:
+    trace_aspeed_pcie_cfg_rw(s->id, is_write ?  "write" : "read", bus, devfn,
+                             cfg_addr, val);
+}
+
+static void aspeed_pcie_cfg_write(void *opaque, hwaddr addr, uint64_t data,
+                                  unsigned int size)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(opaque);
+    AspeedPCIECfgTxDesc desc;
+    uint32_t reg = addr >> 2;
+    uint32_t rc_reg;
+
+    trace_aspeed_pcie_cfg_write(s->id, addr, data);
+
+    switch (reg) {
+    case R_H2X_CTRL:
+        if (data & R_H2X_CTRL_CLEAR_RX_MASK) {
+            s->regs[R_H2X_RDATA] = ~0;
+        }
+        break;
+    case R_H2X_TX_CLEAR:
+        if (data & R_H2X_TX_CLEAR_IDLE_MASK) {
+            s->regs[R_H2X_TX_STS] &= ~R_H2X_TX_STS_IDLE_MASK;
+        }
+        break;
+    case R_H2X_TX_STS:
+        if (data & R_H2X_TX_STS_TRIG_MASK) {
+            desc.desc0 = s->regs[R_H2X_TX_DESC0];
+            desc.desc1 = s->regs[R_H2X_TX_DESC1];
+            desc.desc2 = s->regs[R_H2X_TX_DESC2];
+            desc.desc3 = s->regs[R_H2X_TX_DESC3];
+            desc.wdata = s->regs[R_H2X_TX_DATA];
+            desc.rdata_reg = R_H2X_RC_H_RDATA;
+            aspeed_pcie_cfg_readwrite(s, &desc);
+            rc_reg = s->rc_regs->int_sts_reg;
+            s->regs[rc_reg] |= H2X_RC_INT_INTDONE_MASK;
+            s->regs[R_H2X_TX_STS] |=
+                BIT(R_H2X_TX_STS_RC_H_TX_COMP_SHIFT);
+            s->regs[R_H2X_TX_STS] |= R_H2X_TX_STS_IDLE_MASK;
+        }
+        break;
+    /* preserve INTx status */
+    case R_H2X_RC_H_INT_STS:
+        if (data & H2X_RC_INT_INTDONE_MASK) {
+            s->regs[R_H2X_TX_STS] &= ~R_H2X_TX_STS_RC_H_TX_COMP_MASK;
+        }
+        s->regs[reg] &= ~data | H2X_RC_INT_INTX_MASK;
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
+}
+
+static const MemoryRegionOps aspeed_pcie_cfg_ops = {
+    .read = aspeed_pcie_cfg_read,
+    .write = aspeed_pcie_cfg_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static void aspeed_pcie_cfg_instance_init(Object *obj)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(obj);
+
+    object_initialize_child(obj, "rc", &s->rc, TYPE_ASPEED_PCIE_RC);
+
+    return;
+}
+
+static void aspeed_pcie_cfg_reset(DeviceState *dev)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(dev);
+    AspeedPCIECfgClass *apc = ASPEED_PCIE_CFG_GET_CLASS(s);
+
+    memset(s->regs, 0, apc->nr_regs << 2);
+}
+
+static void aspeed_pcie_cfg_realize(DeviceState *dev, Error **errp)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(dev);
+    AspeedPCIECfgClass *apc = ASPEED_PCIE_CFG_GET_CLASS(s);
+    g_autofree char *name = NULL;
+
+    s->rc_regs = &apc->reg_map->rc;
+    s->regs = g_new(uint32_t, apc->nr_regs);
+    name = g_strdup_printf(TYPE_ASPEED_PCIE_CFG ".regs.%d", s->id);
+    memory_region_init_io(&s->mmio, OBJECT(s), apc->reg_ops, s, name,
+                          apc->nr_regs << 2);
+    sysbus_init_mmio(sbd, &s->mmio);
+
+    object_property_set_int(OBJECT(&s->rc), "bus-nr",
+                            apc->rc_bus_nr,
+                            &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->rc), errp)) {
+        return;
+    }
+}
+
+static void aspeed_pcie_cfg_unrealize(DeviceState *dev)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(dev);
+
+    g_free(s->regs);
+    s->regs = NULL;
+}
+
+static const Property aspeed_pcie_cfg_props[] = {
+    DEFINE_PROP_UINT32("id", AspeedPCIECfgState, id, 0),
+};
+
+static void aspeed_pcie_cfg_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedPCIECfgClass *apc = ASPEED_PCIE_CFG_CLASS(klass);
+
+    dc->desc = "ASPEED PCIe Config";
+    dc->realize = aspeed_pcie_cfg_realize;
+    dc->unrealize = aspeed_pcie_cfg_unrealize;
+    device_class_set_legacy_reset(dc, aspeed_pcie_cfg_reset);
+    device_class_set_props(dc, aspeed_pcie_cfg_props);
+
+    apc->reg_ops = &aspeed_pcie_cfg_ops;
+    apc->reg_map = &aspeed_regmap;
+    apc->nr_regs = 0x100 >> 2;
+    apc->rc_bus_nr = 0x80;
+}
+
+static const TypeInfo aspeed_pcie_cfg_info = {
+    .name       = TYPE_ASPEED_PCIE_CFG,
+    .parent     = TYPE_SYS_BUS_DEVICE,
+    .instance_init = aspeed_pcie_cfg_instance_init,
+    .instance_size = sizeof(AspeedPCIECfgState),
+    .class_init = aspeed_pcie_cfg_class_init,
+    .class_size = sizeof(AspeedPCIECfgClass),
+};
+
 /*
  * PCIe PHY
  *
@@ -150,6 +569,8 @@ static const TypeInfo aspeed_pcie_phy_info = {
 
 static void aspeed_pcie_register_types(void)
 {
+    type_register_static(&aspeed_pcie_rc_info);
+    type_register_static(&aspeed_pcie_cfg_info);
     type_register_static(&aspeed_pcie_phy_info);
 }
 
diff --git a/hw/pci-host/trace-events b/hw/pci-host/trace-events
index 3438516756..2584ea56e2 100644
--- a/hw/pci-host/trace-events
+++ b/hw/pci-host/trace-events
@@ -1,6 +1,10 @@
 # See docs/devel/tracing.rst for syntax documentation.
 
 # aspeed_pcie.c
+aspeed_pcie_rc_intx_set_irq(uint32_t id, int num, int level) "%d: num %d set IRQ leve %d"
+aspeed_pcie_cfg_read(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
+aspeed_pcie_cfg_write(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
+aspeed_pcie_cfg_rw(uint32_t id, const char *dir, uint8_t bus, uint8_t devfn, uint64_t addr, uint64_t data) "%d: %s bus:0x%x devfn:0x%x addr 0x%" PRIx64 " data 0x%" PRIx64
 aspeed_pcie_phy_read(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
 aspeed_pcie_phy_write(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
 
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index d9fb829048..850d579189 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -22,6 +22,65 @@
 #include "hw/pci/pcie_host.h"
 #include "qom/object.h"
 
+typedef struct AspeedPCIECfgTxDesc {
+    uint32_t desc0;
+    uint32_t desc1;
+    uint32_t desc2;
+    uint32_t desc3;
+    uint32_t wdata;
+    uint32_t rdata_reg;
+} AspeedPCIECfgTxDesc;
+
+typedef struct AspeedPCIERcRegs {
+    uint32_t int_en_reg;
+    uint32_t int_sts_reg;
+} AspeedPCIERcRegs;
+
+typedef struct AspeedPCIERegMap {
+    AspeedPCIERcRegs rc;
+} AspeedPCIERegMap;
+
+#define TYPE_ASPEED_PCIE_RC "aspeed.pcie-rc"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERcState, ASPEED_PCIE_RC);
+
+struct AspeedPCIERcState {
+    PCIExpressHost parent_obj;
+
+    MemoryRegion mmio_window;
+    MemoryRegion io_window;
+    MemoryRegion mmio;
+    MemoryRegion io;
+
+    uint32_t bus_nr;
+    char name[16];
+    qemu_irq irq;
+};
+
+/* Bridge between AHB bus and PCIe RC. */
+#define TYPE_ASPEED_PCIE_CFG "aspeed.pcie-cfg"
+OBJECT_DECLARE_TYPE(AspeedPCIECfgState, AspeedPCIECfgClass, ASPEED_PCIE_CFG);
+
+struct AspeedPCIECfgState {
+    SysBusDevice parent_obj;
+
+    MemoryRegion mmio;
+    uint32_t *regs;
+    uint32_t id;
+
+    const AspeedPCIERcRegs *rc_regs;
+    AspeedPCIERcState rc;
+};
+
+struct AspeedPCIECfgClass {
+    SysBusDeviceClass parent_class;
+
+    const AspeedPCIERegMap *reg_map;
+    const MemoryRegionOps *reg_ops;
+
+    uint64_t rc_bus_nr;
+    uint64_t nr_regs;
+};
+
 #define TYPE_ASPEED_PCIE_PHY "aspeed.pcie-phy"
 OBJECT_DECLARE_TYPE(AspeedPCIEPhyState, AspeedPCIEPhyClass, ASPEED_PCIE_PHY);
 

From cac2f082936de3c35c7b9c04fef4dc99b7af9898 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:03 +0800
Subject: [PATCH 0766/2396] hw/pci-host/aspeed: Add AST2600 PCIe Root Device
 support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a PCIe Root Device for AST2600 platform.

The AST2600 root complex exposes a PCIe root device at bus 80, devfn 0.
This root device is implemented as a child of the PCIe RC and modeled
as a host bridge PCI function (class_id = PCI_CLASS_BRIDGE_HOST).

Key changes:
- Add a new device type "aspeed.pcie-root-device".
- Instantiate the root device as part of AspeedPCIERcState.
- Initialize it during RC realize() and attach it to the root bus.
- Mark the root device as non-user-creatable.
- Add RC boolean property "has-rd" to control whether the Root Device is
  created (platforms can enable/disable it as needed).

Note: Only AST2600 implements this PCIe root device. AST2700 does not
provide one.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 56 +++++++++++++++++++++++++++++++
 include/hw/pci-host/aspeed_pcie.h | 11 ++++++
 2 files changed, 67 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index c3e92ee449..6e563a07a3 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -25,6 +25,44 @@
 #include "hw/pci/msi.h"
 #include "trace.h"
 
+/*
+ * PCIe Root Device
+ * This device exists only on AST2600.
+ */
+
+static void aspeed_pcie_root_device_class_init(ObjectClass *klass,
+                                               const void *data)
+{
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+    dc->desc = "ASPEED PCIe Root Device";
+    k->vendor_id = PCI_VENDOR_ID_ASPEED;
+    k->device_id = 0x2600;
+    k->class_id = PCI_CLASS_BRIDGE_HOST;
+    k->subsystem_vendor_id = k->vendor_id;
+    k->subsystem_id = k->device_id;
+    k->revision = 0;
+
+    /*
+     * PCI-facing part of the host bridge,
+     * not usable without the host-facing part
+     */
+    dc->user_creatable = false;
+}
+
+static const TypeInfo aspeed_pcie_root_device_info = {
+    .name = TYPE_ASPEED_PCIE_ROOT_DEVICE,
+    .parent = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(AspeedPCIERootDeviceState),
+    .class_init = aspeed_pcie_root_device_class_init,
+    .interfaces = (const InterfaceInfo[]) {
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { },
+    },
+};
+
 /*
  * PCIe Root Complex (RC)
  */
@@ -94,6 +132,18 @@ static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
                                      aspeed_pcie_rc_map_irq, rc, &rc->mmio,
                                      &rc->io, 0, 4, TYPE_PCIE_BUS);
     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
+
+    /* setup root device */
+    if (rc->has_rd) {
+        object_initialize_child(OBJECT(rc), "root_device", &rc->root_device,
+                                TYPE_ASPEED_PCIE_ROOT_DEVICE);
+        qdev_prop_set_int32(DEVICE(&rc->root_device), "addr",
+                            PCI_DEVFN(0, 0));
+        qdev_prop_set_bit(DEVICE(&rc->root_device), "multifunction", false);
+        if (!qdev_realize(DEVICE(&rc->root_device), BUS(pci->bus), errp)) {
+            return;
+        }
+    }
 }
 
 static const char *aspeed_pcie_rc_root_bus_path(PCIHostState *host_bridge,
@@ -110,6 +160,7 @@ static const char *aspeed_pcie_rc_root_bus_path(PCIHostState *host_bridge,
 
 static const Property aspeed_pcie_rc_props[] = {
     DEFINE_PROP_UINT32("bus-nr", AspeedPCIERcState, bus_nr, 0),
+    DEFINE_PROP_BOOL("has-rd", AspeedPCIERcState, has_rd, 0),
 };
 
 static void aspeed_pcie_rc_class_init(ObjectClass *klass, const void *data)
@@ -401,6 +452,9 @@ static void aspeed_pcie_cfg_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(&s->rc), "bus-nr",
                             apc->rc_bus_nr,
                             &error_abort);
+    object_property_set_bool(OBJECT(&s->rc), "has-rd",
+                            apc->rc_has_rd,
+                            &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rc), errp)) {
         return;
     }
@@ -433,6 +487,7 @@ static void aspeed_pcie_cfg_class_init(ObjectClass *klass, const void *data)
     apc->reg_map = &aspeed_regmap;
     apc->nr_regs = 0x100 >> 2;
     apc->rc_bus_nr = 0x80;
+    apc->rc_has_rd = true;
 }
 
 static const TypeInfo aspeed_pcie_cfg_info = {
@@ -570,6 +625,7 @@ static const TypeInfo aspeed_pcie_phy_info = {
 static void aspeed_pcie_register_types(void)
 {
     type_register_static(&aspeed_pcie_rc_info);
+    type_register_static(&aspeed_pcie_root_device_info);
     type_register_static(&aspeed_pcie_cfg_info);
     type_register_static(&aspeed_pcie_phy_info);
 }
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index 850d579189..fe30ac02ae 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -40,6 +40,13 @@ typedef struct AspeedPCIERegMap {
     AspeedPCIERcRegs rc;
 } AspeedPCIERegMap;
 
+#define TYPE_ASPEED_PCIE_ROOT_DEVICE "aspeed.pcie-root-device"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERootDeviceState, ASPEED_PCIE_ROOT_DEVICE);
+
+struct AspeedPCIERootDeviceState {
+    PCIBridge parent_obj;
+};
+
 #define TYPE_ASPEED_PCIE_RC "aspeed.pcie-rc"
 OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERcState, ASPEED_PCIE_RC);
 
@@ -53,7 +60,10 @@ struct AspeedPCIERcState {
 
     uint32_t bus_nr;
     char name[16];
+    bool has_rd;
     qemu_irq irq;
+
+    AspeedPCIERootDeviceState root_device;
 };
 
 /* Bridge between AHB bus and PCIe RC. */
@@ -79,6 +89,7 @@ struct AspeedPCIECfgClass {
 
     uint64_t rc_bus_nr;
     uint64_t nr_regs;
+    bool rc_has_rd;
 };
 
 #define TYPE_ASPEED_PCIE_PHY "aspeed.pcie-phy"

From 2af56518fa911b8370adaaabc8823bfbab303613 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:04 +0800
Subject: [PATCH 0767/2396] hw/pci-host/aspeed: Add AST2600 PCIe Root Port and
 make address configurable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce an ASPEED PCIe Root Port and wire it under the RC. The root port
is modeled as TYPE_ASPEED_PCIE_ROOT_PORT (subclass of TYPE_PCIE_ROOT_PORT).

Key changes:
- Add TYPE_ASPEED_PCIE_ROOT_PORT (PCIESlot-based) with vendor/device IDs
  and AER capability offset.
- Extend AspeedPCIERcState to embed a root_port instance and a
  configurable rp_addr.
- Add "rp-addr" property to the RC to place the root port at a specific
  devfn on the root bus.
- Set the root port's "chassis" property to ensure a unique chassis per RC.
- Extend AspeedPCIECfgClass with rc_rp_addr defaulting to PCI_DEVFN(8,0).

Rationale:
- AST2600 places the root port at 80:08.0 (bus 0x80, dev 8, fn 0).
- AST2700 must place the root port at 00:00.0, and it supports three RCs.
  Each root port must therefore be uniquely identifiable; uses the
  PCIe "chassis" ID for that.
- Providing a configurable "rp-addr" lets platforms select the correct
  devfn per SoC family, while the "chassis" property ensures uniqueness
  across multiple RC instances on AST2700.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 50 +++++++++++++++++++++++++++++++
 include/hw/pci-host/aspeed_pcie.h | 11 +++++++
 2 files changed, 61 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index 6e563a07a3..dafffbde61 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -21,6 +21,7 @@
 #include "hw/registerfields.h"
 #include "hw/irq.h"
 #include "hw/pci/pci_host.h"
+#include "hw/pci/pcie_port.h"
 #include "hw/pci-host/aspeed_pcie.h"
 #include "hw/pci/msi.h"
 #include "trace.h"
@@ -63,6 +64,32 @@ static const TypeInfo aspeed_pcie_root_device_info = {
     },
 };
 
+/*
+ * PCIe Root Port
+ */
+
+static void aspeed_pcie_root_port_class_init(ObjectClass *klass,
+                                             const void *data)
+{
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIERootPortClass *rpc = PCIE_ROOT_PORT_CLASS(klass);
+
+    dc->desc = "ASPEED PCIe Root Port";
+    k->vendor_id = PCI_VENDOR_ID_ASPEED;
+    k->device_id = 0x1150;
+    dc->user_creatable = true;
+
+    rpc->aer_offset = 0x100;
+}
+
+static const TypeInfo aspeed_pcie_root_port_info = {
+    .name = TYPE_ASPEED_PCIE_ROOT_PORT,
+    .parent = TYPE_PCIE_ROOT_PORT,
+    .instance_size = sizeof(AspeedPCIERootPortState),
+    .class_init = aspeed_pcie_root_port_class_init,
+};
+
 /*
  * PCIe Root Complex (RC)
  */
@@ -144,6 +171,13 @@ static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
             return;
         }
     }
+
+    /* setup root port */
+    qdev_prop_set_int32(DEVICE(&rc->root_port), "addr", rc->rp_addr);
+    qdev_prop_set_uint16(DEVICE(&rc->root_port), "chassis", cfg->id);
+    if (!qdev_realize(DEVICE(&rc->root_port), BUS(pci->bus), errp)) {
+        return;
+    }
 }
 
 static const char *aspeed_pcie_rc_root_bus_path(PCIHostState *host_bridge,
@@ -158,9 +192,19 @@ static const char *aspeed_pcie_rc_root_bus_path(PCIHostState *host_bridge,
     return rc->name;
 }
 
+static void aspeed_pcie_rc_instance_init(Object *obj)
+{
+    AspeedPCIERcState *rc = ASPEED_PCIE_RC(obj);
+    AspeedPCIERootPortState *root_port = &rc->root_port;
+
+    object_initialize_child(obj, "root_port", root_port,
+                            TYPE_ASPEED_PCIE_ROOT_PORT);
+}
+
 static const Property aspeed_pcie_rc_props[] = {
     DEFINE_PROP_UINT32("bus-nr", AspeedPCIERcState, bus_nr, 0),
     DEFINE_PROP_BOOL("has-rd", AspeedPCIERcState, has_rd, 0),
+    DEFINE_PROP_UINT32("rp-addr", AspeedPCIERcState, rp_addr, 0),
 };
 
 static void aspeed_pcie_rc_class_init(ObjectClass *klass, const void *data)
@@ -183,6 +227,7 @@ static const TypeInfo aspeed_pcie_rc_info = {
     .name = TYPE_ASPEED_PCIE_RC,
     .parent = TYPE_PCIE_HOST_BRIDGE,
     .instance_size = sizeof(AspeedPCIERcState),
+    .instance_init = aspeed_pcie_rc_instance_init,
     .class_init = aspeed_pcie_rc_class_init,
 };
 
@@ -455,6 +500,9 @@ static void aspeed_pcie_cfg_realize(DeviceState *dev, Error **errp)
     object_property_set_bool(OBJECT(&s->rc), "has-rd",
                             apc->rc_has_rd,
                             &error_abort);
+    object_property_set_int(OBJECT(&s->rc), "rp-addr",
+                            apc->rc_rp_addr,
+                            &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rc), errp)) {
         return;
     }
@@ -488,6 +536,7 @@ static void aspeed_pcie_cfg_class_init(ObjectClass *klass, const void *data)
     apc->nr_regs = 0x100 >> 2;
     apc->rc_bus_nr = 0x80;
     apc->rc_has_rd = true;
+    apc->rc_rp_addr = PCI_DEVFN(8, 0);
 }
 
 static const TypeInfo aspeed_pcie_cfg_info = {
@@ -626,6 +675,7 @@ static void aspeed_pcie_register_types(void)
 {
     type_register_static(&aspeed_pcie_rc_info);
     type_register_static(&aspeed_pcie_root_device_info);
+    type_register_static(&aspeed_pcie_root_port_info);
     type_register_static(&aspeed_pcie_cfg_info);
     type_register_static(&aspeed_pcie_phy_info);
 }
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index fe30ac02ae..5346c15c81 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -20,6 +20,7 @@
 #include "hw/sysbus.h"
 #include "hw/pci/pci_bridge.h"
 #include "hw/pci/pcie_host.h"
+#include "hw/pci/pcie_port.h"
 #include "qom/object.h"
 
 typedef struct AspeedPCIECfgTxDesc {
@@ -40,6 +41,13 @@ typedef struct AspeedPCIERegMap {
     AspeedPCIERcRegs rc;
 } AspeedPCIERegMap;
 
+#define TYPE_ASPEED_PCIE_ROOT_PORT "aspeed.pcie-root-port"
+OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERootPortState, ASPEED_PCIE_ROOT_PORT)
+
+typedef struct AspeedPCIERootPortState {
+    PCIESlot parent_obj;
+} AspeedPCIERootPortState;
+
 #define TYPE_ASPEED_PCIE_ROOT_DEVICE "aspeed.pcie-root-device"
 OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERootDeviceState, ASPEED_PCIE_ROOT_DEVICE);
 
@@ -58,12 +66,14 @@ struct AspeedPCIERcState {
     MemoryRegion mmio;
     MemoryRegion io;
 
+    uint32_t rp_addr;
     uint32_t bus_nr;
     char name[16];
     bool has_rd;
     qemu_irq irq;
 
     AspeedPCIERootDeviceState root_device;
+    AspeedPCIERootPortState root_port;
 };
 
 /* Bridge between AHB bus and PCIe RC. */
@@ -87,6 +97,7 @@ struct AspeedPCIECfgClass {
     const AspeedPCIERegMap *reg_map;
     const MemoryRegionOps *reg_ops;
 
+    uint32_t rc_rp_addr;
     uint64_t rc_bus_nr;
     uint64_t nr_regs;
     bool rc_has_rd;

From 89f949e515f1bcc4858993f9a47ac7d2656e361a Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:05 +0800
Subject: [PATCH 0768/2396] hw/pci-host/aspeed: Add MSI support and per-RC
 IOMMU address space
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MSI support to the ASPEED PCIe RC/Config model and introduce a per-RC
"IOMMU root" address space to correctly route MSI writes.

On AST2700 all RCs use the same MSI address, and the MSI target is PCI
system memory (not normal DRAM). If the MSI window were mapped into real
system RAM, an endpoint's write could be observed by other RCs and
spuriously trigger their interrupts. To avoid this, each RC now owns an
isolated IOMMU root AddressSpace that contains a small MSI window and a
DRAM alias region for normal DMA.

The MSI window captures writes and asserts the RC IRQ. MSI status bits
are tracked in new H2X RC_H registers (R_H2X_RC_H_MSI_EN{0,1} and
R_H2X_RC_H_MSI_STS{0,1}). Clearing all status bits drops the IRQ. The
default MSI address is set to 0x1e77005c and can be overridden via the
msi-addr property.

This keeps MSI traffic contained within each RC while preserving normal
DMA to system DRAM. It enables correct MSI/MSI-X interrupt delivery when
multiple RCs use the same MSI target address.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 132 ++++++++++++++++++++++++++++++
 hw/pci-host/trace-events          |   3 +
 include/hw/pci-host/aspeed_pcie.h |  10 +++
 3 files changed, 145 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index dafffbde61..8be55b962f 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -94,6 +94,8 @@ static const TypeInfo aspeed_pcie_root_port_info = {
  * PCIe Root Complex (RC)
  */
 
+#define ASPEED_PCIE_CFG_RC_MAX_MSI 64
+
 static void aspeed_pcie_rc_set_irq(void *opaque, int irq, int level)
 {
     AspeedPCIERcState *rc = (AspeedPCIERcState *) opaque;
@@ -120,6 +122,58 @@ static int aspeed_pcie_rc_map_irq(PCIDevice *pci_dev, int irq_num)
     return irq_num % PCI_NUM_PINS;
 }
 
+static void aspeed_pcie_rc_msi_notify(AspeedPCIERcState *rc, uint64_t data)
+{
+    AspeedPCIECfgState *cfg =
+           container_of(rc, AspeedPCIECfgState, rc);
+    uint32_t reg;
+
+    /* Written data is the HW IRQ number */
+    assert(data < ASPEED_PCIE_CFG_RC_MAX_MSI);
+
+    reg = (data < 32) ?
+            cfg->rc_regs->msi_sts0_reg : cfg->rc_regs->msi_sts1_reg;
+    cfg->regs[reg] |= BIT(data % 32);
+
+    trace_aspeed_pcie_rc_msi_set_irq(cfg->id, data, 1);
+    qemu_set_irq(rc->irq, 1);
+}
+
+static void aspeed_pcie_rc_msi_write(void *opaque, hwaddr addr, uint64_t data,
+                                     unsigned int size)
+{
+    AspeedPCIERcState *rc = ASPEED_PCIE_RC(opaque);
+    AspeedPCIECfgState *cfg =
+           container_of(rc, AspeedPCIECfgState, rc);
+
+    trace_aspeed_pcie_rc_msi_notify(cfg->id, addr + rc->msi_addr, data);
+    aspeed_pcie_rc_msi_notify(rc, data);
+}
+
+static const MemoryRegionOps aspeed_pcie_rc_msi_ops = {
+    .write = aspeed_pcie_rc_msi_write,
+    .read = NULL,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static AddressSpace *aspeed_pcie_rc_get_as(PCIBus *bus, void *opaque, int devfn)
+{
+    AspeedPCIERcState *rc = ASPEED_PCIE_RC(opaque);
+    return &rc->iommu_as;
+}
+
+static const PCIIOMMUOps aspeed_pcie_rc_iommu_ops = {
+    .get_address_space = aspeed_pcie_rc_get_as,
+};
+
 static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
 {
     PCIExpressHost *pex = PCIE_HOST_BRIDGE(dev);
@@ -130,6 +184,8 @@ static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     g_autofree char *ioport_window_name = NULL;
     g_autofree char *mmio_window_name = NULL;
+    g_autofree char *iommu_root_name = NULL;
+    g_autofree char *dram_alias_name = NULL;
     g_autofree char *root_bus_name = NULL;
 
     /* PCI configuration space */
@@ -160,6 +216,43 @@ static void aspeed_pcie_rc_realize(DeviceState *dev, Error **errp)
                                      &rc->io, 0, 4, TYPE_PCIE_BUS);
     pci->bus->flags |= PCI_BUS_EXTENDED_CONFIG_SPACE;
 
+   /*
+    * PCIe memory view setup
+    *
+    * Background:
+    * - On AST2700, all Root Complexes use the same MSI address. This MSI
+    *   address is not normal system RAM - it is a PCI system memory address.
+    *   If we map the MSI/MSI-X window into real system memory, a write from
+    *   one EP can be seen by all RCs and wrongly trigger interrupts on them.
+    *
+    * Design:
+    * - MSI/MSI-X here is just a placeholder address so RC and EP can talk.
+    *   We make a separate MMIO space (iommu_root) for the MSI window so the
+    *   writes stay local to each RC.
+    *
+    * DMA:
+    * - EPs still need access to real system memory for DMA. We add a DRAM
+    *   alias in the PCI space so DMA works as expected.
+    */
+    iommu_root_name = g_strdup_printf("pcie.%d.iommu_root", cfg->id);
+    memory_region_init(&rc->iommu_root, OBJECT(rc), iommu_root_name,
+                       UINT64_MAX);
+    address_space_init(&rc->iommu_as, &rc->iommu_root, iommu_root_name);
+    /* setup MSI */
+    memory_region_init_io(&rc->msi_window, OBJECT(rc),
+                          &aspeed_pcie_rc_msi_ops, rc,
+                          "msi_window", 4);
+    memory_region_add_subregion(&rc->iommu_root, rc->msi_addr,
+                                &rc->msi_window);
+    /* setup DRAM for DMA */
+    assert(rc->dram_mr != NULL);
+    dram_alias_name = g_strdup_printf("pcie.%d.dram_alias", cfg->id);
+    memory_region_init_alias(&rc->dram_alias, OBJECT(rc), dram_alias_name,
+                             rc->dram_mr, 0, memory_region_size(rc->dram_mr));
+    memory_region_add_subregion(&rc->iommu_root, rc->dram_base,
+                                &rc->dram_alias);
+    pci_setup_iommu(pci->bus, &aspeed_pcie_rc_iommu_ops, rc);
+
     /* setup root device */
     if (rc->has_rd) {
         object_initialize_child(OBJECT(rc), "root_device", &rc->root_device,
@@ -205,6 +298,10 @@ static const Property aspeed_pcie_rc_props[] = {
     DEFINE_PROP_UINT32("bus-nr", AspeedPCIERcState, bus_nr, 0),
     DEFINE_PROP_BOOL("has-rd", AspeedPCIERcState, has_rd, 0),
     DEFINE_PROP_UINT32("rp-addr", AspeedPCIERcState, rp_addr, 0),
+    DEFINE_PROP_UINT32("msi-addr", AspeedPCIERcState, msi_addr, 0),
+    DEFINE_PROP_UINT64("dram-base", AspeedPCIERcState, dram_base, 0),
+    DEFINE_PROP_LINK("dram", AspeedPCIERcState, dram_mr, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
 };
 
 static void aspeed_pcie_rc_class_init(ObjectClass *klass, const void *data)
@@ -265,6 +362,10 @@ REG32(H2X_RC_H_INT_STS,     0xC8)
     SHARED_FIELD(H2X_RC_INT_INTDONE, 4, 1)
     SHARED_FIELD(H2X_RC_INT_INTX, 0, 4)
 REG32(H2X_RC_H_RDATA,       0xCC)
+REG32(H2X_RC_H_MSI_EN0,     0xE0)
+REG32(H2X_RC_H_MSI_EN1,     0xE4)
+REG32(H2X_RC_H_MSI_STS0,    0xE8)
+REG32(H2X_RC_H_MSI_STS1,    0xEC)
 
 #define TLP_FMTTYPE_CFGRD0  0x04 /* Configuration Read  Type 0 */
 #define TLP_FMTTYPE_CFGWR0  0x44 /* Configuration Write Type 0 */
@@ -278,6 +379,8 @@ static const AspeedPCIERegMap aspeed_regmap = {
     .rc = {
         .int_en_reg     = R_H2X_RC_H_INT_EN,
         .int_sts_reg    = R_H2X_RC_H_INT_STS,
+        .msi_sts0_reg   = R_H2X_RC_H_MSI_STS0,
+        .msi_sts1_reg   = R_H2X_RC_H_MSI_STS1,
     },
 };
 
@@ -447,6 +550,29 @@ static void aspeed_pcie_cfg_write(void *opaque, hwaddr addr, uint64_t data,
         }
         s->regs[reg] &= ~data | H2X_RC_INT_INTX_MASK;
         break;
+    /*
+     * These status registers are used for notify sources ISR are executed.
+     * If one source ISR is executed, it will clear one bit.
+     * If it clear all bits, it means to initialize this register status
+     * rather than sources ISR are executed.
+     */
+    case R_H2X_RC_H_MSI_STS0:
+    case R_H2X_RC_H_MSI_STS1:
+        if (data == 0) {
+            return ;
+        }
+
+        s->regs[reg] &= ~data;
+        if (data == 0xffffffff) {
+            return;
+        }
+
+        if (!s->regs[R_H2X_RC_H_MSI_STS0] &&
+            !s->regs[R_H2X_RC_H_MSI_STS1]) {
+            trace_aspeed_pcie_rc_msi_clear_irq(s->id, 0);
+            qemu_set_irq(s->rc.irq, 0);
+        }
+        break;
     default:
         s->regs[reg] = data;
         break;
@@ -468,6 +594,8 @@ static void aspeed_pcie_cfg_instance_init(Object *obj)
     AspeedPCIECfgState *s = ASPEED_PCIE_CFG(obj);
 
     object_initialize_child(obj, "rc", &s->rc, TYPE_ASPEED_PCIE_RC);
+    object_property_add_alias(obj, "dram", OBJECT(&s->rc), "dram");
+    object_property_add_alias(obj, "dram-base", OBJECT(&s->rc), "dram-base");
 
     return;
 }
@@ -503,6 +631,9 @@ static void aspeed_pcie_cfg_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(&s->rc), "rp-addr",
                             apc->rc_rp_addr,
                             &error_abort);
+    object_property_set_int(OBJECT(&s->rc), "msi-addr",
+                            apc->rc_msi_addr,
+                            &error_abort);
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rc), errp)) {
         return;
     }
@@ -534,6 +665,7 @@ static void aspeed_pcie_cfg_class_init(ObjectClass *klass, const void *data)
     apc->reg_ops = &aspeed_pcie_cfg_ops;
     apc->reg_map = &aspeed_regmap;
     apc->nr_regs = 0x100 >> 2;
+    apc->rc_msi_addr = 0x1e77005C;
     apc->rc_bus_nr = 0x80;
     apc->rc_has_rd = true;
     apc->rc_rp_addr = PCI_DEVFN(8, 0);
diff --git a/hw/pci-host/trace-events b/hw/pci-host/trace-events
index 2584ea56e2..a6fd88c2c4 100644
--- a/hw/pci-host/trace-events
+++ b/hw/pci-host/trace-events
@@ -2,6 +2,9 @@
 
 # aspeed_pcie.c
 aspeed_pcie_rc_intx_set_irq(uint32_t id, int num, int level) "%d: num %d set IRQ leve %d"
+aspeed_pcie_rc_msi_notify(uint32_t id, uint64_t addr, uint64_t data) "%d: 0x%" PRIx64 " data 0x%" PRIx64
+aspeed_pcie_rc_msi_set_irq(uint32_t id, uint64_t unm, int level) "%d: num 0x%" PRIx64 " set IRQ level %d"
+aspeed_pcie_rc_msi_clear_irq(uint32_t id, int level) "%d: clear IRQ level %d"
 aspeed_pcie_cfg_read(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
 aspeed_pcie_cfg_write(uint32_t id, uint64_t addr, uint32_t value) "%d: addr 0x%" PRIx64 " value 0x%" PRIx32
 aspeed_pcie_cfg_rw(uint32_t id, const char *dir, uint8_t bus, uint8_t devfn, uint64_t addr, uint64_t data) "%d: %s bus:0x%x devfn:0x%x addr 0x%" PRIx64 " data 0x%" PRIx64
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index 5346c15c81..5e60cba07b 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -35,6 +35,8 @@ typedef struct AspeedPCIECfgTxDesc {
 typedef struct AspeedPCIERcRegs {
     uint32_t int_en_reg;
     uint32_t int_sts_reg;
+    uint32_t msi_sts0_reg;
+    uint32_t msi_sts1_reg;
 } AspeedPCIERcRegs;
 
 typedef struct AspeedPCIERegMap {
@@ -61,11 +63,18 @@ OBJECT_DECLARE_SIMPLE_TYPE(AspeedPCIERcState, ASPEED_PCIE_RC);
 struct AspeedPCIERcState {
     PCIExpressHost parent_obj;
 
+    MemoryRegion iommu_root;
+    AddressSpace iommu_as;
+    MemoryRegion dram_alias;
+    MemoryRegion *dram_mr;
     MemoryRegion mmio_window;
+    MemoryRegion msi_window;
     MemoryRegion io_window;
     MemoryRegion mmio;
     MemoryRegion io;
 
+    uint64_t dram_base;
+    uint32_t msi_addr;
     uint32_t rp_addr;
     uint32_t bus_nr;
     char name[16];
@@ -97,6 +106,7 @@ struct AspeedPCIECfgClass {
     const AspeedPCIERegMap *reg_map;
     const MemoryRegionOps *reg_ops;
 
+    uint32_t rc_msi_addr;
     uint32_t rc_rp_addr;
     uint64_t rc_bus_nr;
     uint64_t nr_regs;

From 575846c056a320b3008436fc8c11d10616677722 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:06 +0800
Subject: [PATCH 0769/2396] hw/arm/aspeed: Wire up PCIe devices in SoC model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add PCIe controller and PHY instances to the Aspeed SoC state and device
enum. This prepares the SoC model to host PCIe Root Complexes and their
associated PHYs.

Although the AST2600 supports only a single Root Complex, the AST2700
provides three Root Complexes. For this reason, the model defines arrays
of three PCIe config/PHY objects and enumerates three PCIe device IDs so
that both SoCs can be represented consistently.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/hw/arm/aspeed_soc.h | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 217ef0eafd..79fe353f83 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -37,6 +37,7 @@
 #include "qom/object.h"
 #include "hw/misc/aspeed_lpc.h"
 #include "hw/misc/unimp.h"
+#include "hw/pci-host/aspeed_pcie.h"
 #include "hw/misc/aspeed_peci.h"
 #include "hw/fsi/aspeed_apb2opb.h"
 #include "hw/char/serial-mm.h"
@@ -49,6 +50,7 @@
 #define ASPEED_MACS_NUM  4
 #define ASPEED_UARTS_NUM 13
 #define ASPEED_JTAG_NUM  2
+#define ASPEED_PCIE_NUM  3
 
 struct AspeedSoCState {
     DeviceState parent;
@@ -87,6 +89,8 @@ struct AspeedSoCState {
     AspeedSDHCIState sdhci;
     AspeedSDHCIState emmc;
     AspeedLPCState lpc;
+    AspeedPCIECfgState pcie[ASPEED_PCIE_NUM];
+    AspeedPCIEPhyState pcie_phy[ASPEED_PCIE_NUM];
     AspeedPECIState peci;
     SerialMM uart[ASPEED_UARTS_NUM];
     Clock *sysclk;
@@ -254,6 +258,15 @@ enum {
     ASPEED_DEV_LPC,
     ASPEED_DEV_IBT,
     ASPEED_DEV_I2C,
+    ASPEED_DEV_PCIE0,
+    ASPEED_DEV_PCIE1,
+    ASPEED_DEV_PCIE2,
+    ASPEED_DEV_PCIE_PHY0,
+    ASPEED_DEV_PCIE_PHY1,
+    ASPEED_DEV_PCIE_PHY2,
+    ASPEED_DEV_PCIE_MMIO0,
+    ASPEED_DEV_PCIE_MMIO1,
+    ASPEED_DEV_PCIE_MMIO2,
     ASPEED_DEV_PECI,
     ASPEED_DEV_ETH1,
     ASPEED_DEV_ETH2,

From a498916ba292ada19cc47df80e0e9507c63356fc Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:07 +0800
Subject: [PATCH 0770/2396] hw/arm/aspeed_ast2600: Add PCIe RC support (RC_H
 only)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Wire up the PCIe Root Complex in the AST2600 SoC model.

According to the AST2600 firmware driver, only the RC_H controller is
supported. RC_H uses PCIe PHY1 at 0x1e6ed200 and the PCIe config (H2X)
register block at 0x1e770000. The RC_H MMIO window is mapped at
0x70000000–0x80000000. RC_L is not modeled. The RC_H interrupt is
wired to IRQ 168. Only RC_H is realized and connected to the SoC
interrupt controller.

The SoC integration initializes PCIe PHY1, instantiates a single RC
instance, wires its MMIO regions, and connects its interrupt. An alias
region is added to map the RC MMIO space into the guest physical address
space.

This provides enough functionality for firmware and guest drivers to
discover and use the AST2600 RC_H Root Complex while leaving RC_L
unimplemented.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast2600.c     | 74 +++++++++++++++++++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  1 +
 2 files changed, 75 insertions(+)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 59ffd41a4a..03e5df96bb 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -48,11 +48,13 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_DEV_XDMA]      = 0x1E6E7000,
     [ASPEED_DEV_ADC]       = 0x1E6E9000,
     [ASPEED_DEV_DP]        = 0x1E6EB000,
+    [ASPEED_DEV_PCIE_PHY1] = 0x1E6ED200,
     [ASPEED_DEV_SBC]       = 0x1E6F2000,
     [ASPEED_DEV_EMMC_BC]   = 0x1E6f5000,
     [ASPEED_DEV_VIDEO]     = 0x1E700000,
     [ASPEED_DEV_SDHCI]     = 0x1E740000,
     [ASPEED_DEV_EMMC]      = 0x1E750000,
+    [ASPEED_DEV_PCIE0]     = 0x1E770000,
     [ASPEED_DEV_GPIO]      = 0x1E780000,
     [ASPEED_DEV_GPIO_1_8V] = 0x1E780800,
     [ASPEED_DEV_RTC]       = 0x1E781000,
@@ -79,6 +81,7 @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_DEV_FSI1]      = 0x1E79B000,
     [ASPEED_DEV_FSI2]      = 0x1E79B100,
     [ASPEED_DEV_I3C]       = 0x1E7A0000,
+    [ASPEED_DEV_PCIE_MMIO1] = 0x70000000,
     [ASPEED_DEV_SDRAM]     = 0x80000000,
 };
 
@@ -127,6 +130,7 @@ static const int aspeed_soc_ast2600_irqmap[] = {
     [ASPEED_DEV_LPC]       = 35,
     [ASPEED_DEV_IBT]       = 143,
     [ASPEED_DEV_I2C]       = 110,   /* 110 -> 125 */
+    [ASPEED_DEV_PCIE0]     = 168,
     [ASPEED_DEV_PECI]      = 38,
     [ASPEED_DEV_ETH1]      = 2,
     [ASPEED_DEV_ETH2]      = 3,
@@ -191,6 +195,10 @@ static void aspeed_soc_ast2600_init(Object *obj)
     snprintf(typename, sizeof(typename), "aspeed.i2c-%s", socname);
     object_initialize_child(obj, "i2c", &s->i2c, typename);
 
+    object_initialize_child(obj, "pcie-cfg", &s->pcie[0], TYPE_ASPEED_PCIE_CFG);
+    object_initialize_child(obj, "pcie-phy[*]", &s->pcie_phy[0],
+                            TYPE_ASPEED_PCIE_PHY);
+
     object_initialize_child(obj, "peci", &s->peci, TYPE_ASPEED_PECI);
 
     snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
@@ -285,6 +293,67 @@ static uint64_t aspeed_calc_affinity(int cpu)
     return (0xf << ARM_AFF1_SHIFT) | cpu;
 }
 
+/*
+ * PCIe Root Complex (RC)
+ *
+ * H2X register space (single block 0x00-0xFF):
+ *   0x00-0x7F : shared by RC_L (PCIe0) and RC_H (PCIe1)
+ *   0x80-0xBF : RC_L only
+ *   0xC0-0xFF : RC_H only
+ *
+ * Model scope / limitations:
+ *   - Firmware supports RC_H only; this QEMU model does not support RC_L.
+ *   - RC_H uses PHY1 and the MMIO window [0x70000000, 0x80000000]
+ *     (aka MMIO1).
+ *
+ * Indexing convention (this model):
+ *   - Expose a single logical instance at index 0.
+ *   - pcie[0] -> hardware RC_H (PCIe1)
+ *   - phy[0]  -> hardware PHY1
+ *   - mmio.0 -> guest address range MMIO1: 0x70000000-0x80000000
+ *   - RC_L / PCIe0 is not created and mapped.
+ */
+static bool aspeed_soc_ast2600_pcie_realize(DeviceState *dev, Error **errp)
+{
+    Aspeed2600SoCState *a = ASPEED2600_SOC(dev);
+    AspeedSoCState *s = ASPEED_SOC(dev);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    MemoryRegion *mmio_mr = NULL;
+    qemu_irq irq;
+
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie_phy[0]), errp)) {
+        return false;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie_phy[0]), 0,
+                    sc->memmap[ASPEED_DEV_PCIE_PHY1]);
+
+    object_property_set_int(OBJECT(&s->pcie[0]), "dram-base",
+                            sc->memmap[ASPEED_DEV_SDRAM],
+                            &error_abort);
+    object_property_set_link(OBJECT(&s->pcie[0]), "dram", OBJECT(s->dram_mr),
+                             &error_abort);
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie[0]), errp)) {
+        return false;
+    }
+    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie[0]), 0,
+                    sc->memmap[ASPEED_DEV_PCIE0]);
+
+    irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
+                           sc->irqmap[ASPEED_DEV_PCIE0]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie[0].rc), 0, irq);
+
+    mmio_mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pcie[0].rc), 1);
+    memory_region_init_alias(&s->pcie_mmio_alias[0], OBJECT(&s->pcie[0].rc),
+                             "aspeed.pcie-mmio", mmio_mr,
+                             sc->memmap[ASPEED_DEV_PCIE_MMIO1],
+                             0x10000000);
+    memory_region_add_subregion(s->memory,
+                                sc->memmap[ASPEED_DEV_PCIE_MMIO1],
+                                &s->pcie_mmio_alias[0]);
+
+    return true;
+}
+
 static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 {
     int i;
@@ -438,6 +507,11 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
 
+    /* PCIe Root Complex (RC) */
+    if (!aspeed_soc_ast2600_pcie_realize(dev, errp)) {
+        return;
+    }
+
     /* FMC, The number of CS is set at the board level */
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
                              &error_abort);
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 79fe353f83..a0cf433775 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -62,6 +62,7 @@ struct AspeedSoCState {
     MemoryRegion spi_boot_container;
     MemoryRegion spi_boot;
     MemoryRegion vbootrom;
+    MemoryRegion pcie_mmio_alias[ASPEED_PCIE_NUM];
     AddressSpace dram_as;
     AspeedRtcState rtc;
     AspeedTimerCtrlState timerctrl;

From ed2df979ab229feaa81327ad4941383c024116e6 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:08 +0800
Subject: [PATCH 0771/2396] hw/pci-host/aspeed: Add AST2700 PCIe PHY
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a PCIe Host Controller PHY model for AST2700. This adds an
AST2700 specific PHY type (TYPE_ASPEED_2700_PCIE_PHY) with a 0x800 byte
register space and link-status bits compatible with the firmware’s
expectations.

AST2700 provides three PCIe RCs; PCIe0 and PCIe1 are GEN4, PCIe2 is
GEN2. The PHY exposes:
PEHR_2700_LINK_GEN2 at 0x344, bit 18 indicates GEN2 link up
PEHR_2700_LINK_GEN4 at 0x358, bit 8 indicates GEN4 link up

In real hardware these GEN2/GEN4 link bits are mutually exclusive.
QEMU does not model GEN2 vs GEN4 signaling differences, so the reset
handler sets both bits to 1. This keeps the model simple and lets
firmware see the link as up; firmware will read the appropriate
register per RC port to infer the intended mode.

The header gains TYPE_ASPEED_2700_PCIE_PHY; the new class derives from
TYPE_ASPEED_PCIE_PHY, sets nr_regs to 0x800 >> 2, and installs an
AST2700 reset routine that programs the class code (0x06040011) and the
GEN2/GEN4 status bits.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 39 +++++++++++++++++++++++++++++++
 include/hw/pci-host/aspeed_pcie.h |  1 +
 2 files changed, 40 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index 8be55b962f..788160d532 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -696,6 +696,12 @@ REG32(PEHR_PROTECT,     0x7C)
 REG32(PEHR_LINK,        0xC0)
     FIELD(PEHR_LINK, STS, 5, 1)
 
+/* AST2700 */
+REG32(PEHR_2700_LINK_GEN2,  0x344)
+    FIELD(PEHR_2700_LINK_GEN2, STS, 18, 1)
+REG32(PEHR_2700_LINK_GEN4,  0x358)
+    FIELD(PEHR_2700_LINK_GEN4, STS, 8, 1)
+
 #define ASPEED_PCIE_PHY_UNLOCK  0xA8
 
 static uint64_t aspeed_pcie_phy_read(void *opaque, hwaddr addr,
@@ -803,6 +809,38 @@ static const TypeInfo aspeed_pcie_phy_info = {
     .class_size = sizeof(AspeedPCIEPhyClass),
 };
 
+static void aspeed_2700_pcie_phy_reset(DeviceState *dev)
+{
+    AspeedPCIEPhyState *s = ASPEED_PCIE_PHY(dev);
+    AspeedPCIEPhyClass *apc = ASPEED_PCIE_PHY_GET_CLASS(s);
+
+    memset(s->regs, 0, apc->nr_regs << 2);
+
+    s->regs[R_PEHR_ID] =
+        (0x1150 << R_PEHR_ID_DEV_SHIFT) | PCI_VENDOR_ID_ASPEED;
+    s->regs[R_PEHR_CLASS_CODE] = 0x06040011;
+    s->regs[R_PEHR_2700_LINK_GEN2] = R_PEHR_2700_LINK_GEN2_STS_MASK;
+    s->regs[R_PEHR_2700_LINK_GEN4] = R_PEHR_2700_LINK_GEN4_STS_MASK;
+}
+
+static void aspeed_2700_pcie_phy_class_init(ObjectClass *klass,
+                                            const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedPCIEPhyClass *apc = ASPEED_PCIE_PHY_CLASS(klass);
+
+    dc->desc = "ASPEED AST2700 PCIe Phy";
+    device_class_set_legacy_reset(dc, aspeed_2700_pcie_phy_reset);
+
+    apc->nr_regs = 0x800 >> 2;
+}
+
+static const TypeInfo aspeed_2700_pcie_phy_info = {
+    .name       = TYPE_ASPEED_2700_PCIE_PHY,
+    .parent     = TYPE_ASPEED_PCIE_PHY,
+    .class_init = aspeed_2700_pcie_phy_class_init,
+};
+
 static void aspeed_pcie_register_types(void)
 {
     type_register_static(&aspeed_pcie_rc_info);
@@ -810,6 +848,7 @@ static void aspeed_pcie_register_types(void)
     type_register_static(&aspeed_pcie_root_port_info);
     type_register_static(&aspeed_pcie_cfg_info);
     type_register_static(&aspeed_pcie_phy_info);
+    type_register_static(&aspeed_2700_pcie_phy_info);
 }
 
 type_init(aspeed_pcie_register_types);
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index 5e60cba07b..5806505f30 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -114,6 +114,7 @@ struct AspeedPCIECfgClass {
 };
 
 #define TYPE_ASPEED_PCIE_PHY "aspeed.pcie-phy"
+#define TYPE_ASPEED_2700_PCIE_PHY TYPE_ASPEED_PCIE_PHY "-ast2700"
 OBJECT_DECLARE_TYPE(AspeedPCIEPhyState, AspeedPCIEPhyClass, ASPEED_PCIE_PHY);
 
 struct AspeedPCIEPhyState {

From ba6fb09048198a2952d731cd063f4307b137e7ec Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:09 +0800
Subject: [PATCH 0772/2396] hw/pci-host/aspeed: Add AST2700 PCIe config with
 dedicated H2X blocks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce PCIe config (H2X) support for the AST2700 SoC.

Unlike the AST2600, the AST2700 provides three independent Root Complexes,
each with its own H2X (AHB to PCIe bridge) register block of size 0x100.
All RCs use the same MSI address (0x000000F0). The H2X block includes
two different access paths:

1. CFGI (internal bridge): used to access the host bridge itself, always
   with BDF=0. The AST2700 controller simplifies the design by exposing
   only one register (H2X_CFGI_TLP) with fields for ADDR[15:0], BEN[19:16],
   and WR[20]. This is not a full TLP descriptor as in the external case.
   For QEMU readability and code reuse, the model converts H2X_CFGI_TLP
   into a standard TLP TX descriptor with BDF forced to 0 and then calls
   the existing helpers aspeed_pcie_cfg_readwrite() and
   aspeed_pcie_cfg_translate_write().

2. CFGE (external EP access): used to access external endpoints. The
   AST2700 design provides H2X_CFGE_TLP1 and a small FIFO at H2X_CFGE_TLPN.
   For reads, TX DESC0 is stored in TLP1 and DESC1/DESC2 in TLPN FIFO
   slots. For writes, TX DESC0 is stored in TLP1, DESC1/DESC2 in TLPN
   FIFO[0..1], and TX write data in TLPN FIFO[2].

The implementation extends AspeedPCIECfgState with a small FIFO and index,
wires up new register definitions for AST2700, and adds a specific ops
table and class (TYPE_ASPEED_2700_PCIE_CFG). The reset handler clears the
FIFO state. Interrupt and MSI status registers are also supported.

This provides enough modeling for firmware and drivers to use any of the
three PCIe RCs on AST2700 with their own dedicated H2X config window,
while reusing existing TLP decode helpers in QEMU.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c         | 158 ++++++++++++++++++++++++++++++
 include/hw/pci-host/aspeed_pcie.h |   3 +
 2 files changed, 161 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index 788160d532..a757fd7ec8 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -338,6 +338,11 @@ static const TypeInfo aspeed_pcie_rc_info = {
  * - Registers 0x00 - 0x7F are shared by both PCIe0 (rc_l) and PCIe1 (rc_h).
  * - Registers 0x80 - 0xBF are specific to PCIe0.
  * - Registers 0xC0 - 0xFF are specific to PCIe1.
+ *
+ * On the AST2700:
+ * - The register range 0x00 - 0xFF is assigned to a single PCIe configuration.
+ * - There are three PCIe Root Complexes (RCs), each with its own dedicated H2X
+ *   register set of size 0x100 (covering offsets 0x00 to 0xFF).
  */
 
 /* AST2600 */
@@ -367,6 +372,31 @@ REG32(H2X_RC_H_MSI_EN1,     0xE4)
 REG32(H2X_RC_H_MSI_STS0,    0xE8)
 REG32(H2X_RC_H_MSI_STS1,    0xEC)
 
+/* AST2700 */
+REG32(H2X_CFGE_INT_STS,         0x08)
+    FIELD(H2X_CFGE_INT_STS, TX_IDEL, 0, 1)
+    FIELD(H2X_CFGE_INT_STS, RX_BUSY, 1, 1)
+REG32(H2X_CFGI_TLP,         0x20)
+    FIELD(H2X_CFGI_TLP, ADDR, 0, 16)
+    FIELD(H2X_CFGI_TLP, BEN, 16, 4)
+    FIELD(H2X_CFGI_TLP, WR, 20, 1)
+REG32(H2X_CFGI_WDATA,       0x24)
+REG32(H2X_CFGI_CTRL,        0x28)
+    FIELD(H2X_CFGI_CTRL, FIRE, 0, 1)
+REG32(H2X_CFGI_RDATA,       0x2C)
+REG32(H2X_CFGE_TLP1,        0x30)
+REG32(H2X_CFGE_TLPN,        0x34)
+REG32(H2X_CFGE_CTRL,        0x38)
+    FIELD(H2X_CFGE_CTRL, FIRE, 0, 1)
+REG32(H2X_CFGE_RDATA,       0x3C)
+REG32(H2X_INT_EN,          0x40)
+REG32(H2X_INT_STS,         0x48)
+    FIELD(H2X_INT_STS, INTX, 0, 4)
+REG32(H2X_MSI_EN0,          0x50)
+REG32(H2X_MSI_EN1,          0x54)
+REG32(H2X_MSI_STS0,         0x58)
+REG32(H2X_MSI_STS1,         0x5C)
+
 #define TLP_FMTTYPE_CFGRD0  0x04 /* Configuration Read  Type 0 */
 #define TLP_FMTTYPE_CFGWR0  0x44 /* Configuration Write Type 0 */
 #define TLP_FMTTYPE_CFGRD1  0x05 /* Configuration Read  Type 1 */
@@ -384,6 +414,15 @@ static const AspeedPCIERegMap aspeed_regmap = {
     },
 };
 
+static const AspeedPCIERegMap aspeed_2700_regmap = {
+    .rc = {
+        .int_en_reg     = R_H2X_INT_EN,
+        .int_sts_reg    = R_H2X_INT_STS,
+        .msi_sts0_reg   = R_H2X_MSI_STS0,
+        .msi_sts1_reg   = R_H2X_MSI_STS1,
+    },
+};
+
 static uint64_t aspeed_pcie_cfg_read(void *opaque, hwaddr addr,
                                      unsigned int size)
 {
@@ -606,6 +645,8 @@ static void aspeed_pcie_cfg_reset(DeviceState *dev)
     AspeedPCIECfgClass *apc = ASPEED_PCIE_CFG_GET_CLASS(s);
 
     memset(s->regs, 0, apc->nr_regs << 2);
+    memset(s->tlpn_fifo, 0, sizeof(s->tlpn_fifo));
+    s->tlpn_idx = 0;
 }
 
 static void aspeed_pcie_cfg_realize(DeviceState *dev, Error **errp)
@@ -680,6 +721,122 @@ static const TypeInfo aspeed_pcie_cfg_info = {
     .class_size = sizeof(AspeedPCIECfgClass),
 };
 
+static void aspeed_2700_pcie_cfg_write(void *opaque, hwaddr addr,
+                                       uint64_t data, unsigned int size)
+{
+    AspeedPCIECfgState *s = ASPEED_PCIE_CFG(opaque);
+    AspeedPCIECfgTxDesc desc;
+    uint32_t reg = addr >> 2;
+
+    trace_aspeed_pcie_cfg_write(s->id, addr, data);
+
+    switch (reg) {
+    case R_H2X_CFGE_INT_STS:
+        if (data & R_H2X_CFGE_INT_STS_TX_IDEL_MASK) {
+            s->regs[R_H2X_CFGE_INT_STS] &= ~R_H2X_CFGE_INT_STS_TX_IDEL_MASK;
+        }
+
+        if (data & R_H2X_CFGE_INT_STS_RX_BUSY_MASK) {
+            s->regs[R_H2X_CFGE_INT_STS] &= ~R_H2X_CFGE_INT_STS_RX_BUSY_MASK;
+        }
+        break;
+    case R_H2X_CFGI_CTRL:
+        if (data & R_H2X_CFGI_CTRL_FIRE_MASK) {
+            /*
+             * Internal access to bridge
+             * Type and BDF are 0
+             */
+            desc.desc0 = 0x04000001 |
+                (ARRAY_FIELD_EX32(s->regs, H2X_CFGI_TLP, WR) << 30);
+            desc.desc1 = 0x00401000 |
+                ARRAY_FIELD_EX32(s->regs, H2X_CFGI_TLP, BEN);
+            desc.desc2 = 0x00000000 |
+                ARRAY_FIELD_EX32(s->regs, H2X_CFGI_TLP, ADDR);
+            desc.wdata = s->regs[R_H2X_CFGI_WDATA];
+            desc.rdata_reg = R_H2X_CFGI_RDATA;
+            aspeed_pcie_cfg_readwrite(s, &desc);
+        }
+        break;
+    case R_H2X_CFGE_TLPN:
+        s->tlpn_fifo[s->tlpn_idx] = data;
+        s->tlpn_idx = (s->tlpn_idx + 1) % ARRAY_SIZE(s->tlpn_fifo);
+        break;
+    case R_H2X_CFGE_CTRL:
+        if (data & R_H2X_CFGE_CTRL_FIRE_MASK) {
+            desc.desc0 = s->regs[R_H2X_CFGE_TLP1];
+            desc.desc1 = s->tlpn_fifo[0];
+            desc.desc2 = s->tlpn_fifo[1];
+            desc.wdata = s->tlpn_fifo[2];
+            desc.rdata_reg = R_H2X_CFGE_RDATA;
+            aspeed_pcie_cfg_readwrite(s, &desc);
+            s->regs[R_H2X_CFGE_INT_STS] |= R_H2X_CFGE_INT_STS_TX_IDEL_MASK;
+            s->regs[R_H2X_CFGE_INT_STS] |= R_H2X_CFGE_INT_STS_RX_BUSY_MASK;
+            s->tlpn_idx = 0;
+        }
+        break;
+
+    case R_H2X_INT_STS:
+        s->regs[reg] &= ~data | R_H2X_INT_STS_INTX_MASK;
+        break;
+    /*
+     * These status registers are used for notify sources ISR are executed.
+     * If one source ISR is executed, it will clear one bit.
+     * If it clear all bits, it means to initialize this register status
+     * rather than sources ISR are executed.
+     */
+    case R_H2X_MSI_STS0:
+    case R_H2X_MSI_STS1:
+        if (data == 0) {
+            return ;
+        }
+
+        s->regs[reg] &= ~data;
+        if (data == 0xffffffff) {
+            return;
+        }
+
+        if (!s->regs[R_H2X_MSI_STS0] &&
+            !s->regs[R_H2X_MSI_STS1]) {
+            trace_aspeed_pcie_rc_msi_clear_irq(s->id, 0);
+            qemu_set_irq(s->rc.irq, 0);
+        }
+        break;
+    default:
+        s->regs[reg] = data;
+        break;
+    }
+}
+
+static const MemoryRegionOps aspeed_2700_pcie_cfg_ops = {
+    .read = aspeed_pcie_cfg_read,
+    .write = aspeed_2700_pcie_cfg_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static void aspeed_2700_pcie_cfg_class_init(ObjectClass *klass,
+                                            const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedPCIECfgClass *apc = ASPEED_PCIE_CFG_CLASS(klass);
+
+    dc->desc = "ASPEED 2700 PCIe Config";
+    apc->reg_ops = &aspeed_2700_pcie_cfg_ops;
+    apc->reg_map = &aspeed_2700_regmap;
+    apc->nr_regs = 0x100 >> 2;
+    apc->rc_msi_addr = 0x000000F0;
+    apc->rc_bus_nr = 0;
+}
+
+static const TypeInfo aspeed_2700_pcie_cfg_info = {
+    .name = TYPE_ASPEED_2700_PCIE_CFG,
+    .parent = TYPE_ASPEED_PCIE_CFG,
+    .class_init = aspeed_2700_pcie_cfg_class_init,
+};
+
 /*
  * PCIe PHY
  *
@@ -847,6 +1004,7 @@ static void aspeed_pcie_register_types(void)
     type_register_static(&aspeed_pcie_root_device_info);
     type_register_static(&aspeed_pcie_root_port_info);
     type_register_static(&aspeed_pcie_cfg_info);
+    type_register_static(&aspeed_2700_pcie_cfg_info);
     type_register_static(&aspeed_pcie_phy_info);
     type_register_static(&aspeed_2700_pcie_phy_info);
 }
diff --git a/include/hw/pci-host/aspeed_pcie.h b/include/hw/pci-host/aspeed_pcie.h
index 5806505f30..be53ea96b9 100644
--- a/include/hw/pci-host/aspeed_pcie.h
+++ b/include/hw/pci-host/aspeed_pcie.h
@@ -87,6 +87,7 @@ struct AspeedPCIERcState {
 
 /* Bridge between AHB bus and PCIe RC. */
 #define TYPE_ASPEED_PCIE_CFG "aspeed.pcie-cfg"
+#define TYPE_ASPEED_2700_PCIE_CFG TYPE_ASPEED_PCIE_CFG "-ast2700"
 OBJECT_DECLARE_TYPE(AspeedPCIECfgState, AspeedPCIECfgClass, ASPEED_PCIE_CFG);
 
 struct AspeedPCIECfgState {
@@ -98,6 +99,8 @@ struct AspeedPCIECfgState {
 
     const AspeedPCIERcRegs *rc_regs;
     AspeedPCIERcState rc;
+    uint32_t tlpn_fifo[3];
+    uint32_t tlpn_idx;
 };
 
 struct AspeedPCIECfgClass {

From ac30597ee859ecaa4a87688fbd722bb5bfe80bd7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:10 +0800
Subject: [PATCH 0773/2396] hw/pci-host/aspeed: Disable Root Device and place
 Root Port at 00:00.0 to AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST2700 does not implement a PCIe Root Device; each RC exposes a single
PCIe Root Port at devfn 0:0.0.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index a757fd7ec8..f7593444fc 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -829,6 +829,8 @@ static void aspeed_2700_pcie_cfg_class_init(ObjectClass *klass,
     apc->nr_regs = 0x100 >> 2;
     apc->rc_msi_addr = 0x000000F0;
     apc->rc_bus_nr = 0;
+    apc->rc_has_rd = false;
+    apc->rc_rp_addr = PCI_DEVFN(0, 0);
 }
 
 static const TypeInfo aspeed_2700_pcie_cfg_info = {

From 65996e84089459a4b52514a928988816e5c0bae0 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:11 +0800
Subject: [PATCH 0774/2396] hw/arm/aspeed_ast27x0: Introduce 3 PCIe RCs for
 AST2700
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add PCIe Root Complex support to the AST2700 SoC model.

The AST2700 A1 silicon revision provides three PCIe Root Complexes:

PCIe0 with its PHY at 0x12C15000, config (H2X) block at 0x120E0000,
MMIO window at 0x60000000, and GIC IRQ 56.

PCIe1 with its PHY at 0x12C15800, config (H2X) block at 0x120F0000,
MMIO window at 0x80000000, and GIC IRQ 57.

PCIe2 with its PHY at 0x14C1C000, config (H2X) block at 0x140D0000,
MMIO window at 0xA0000000, and IRQ routed through INTC4 bit 31
mapped to GIC IRQ 196.

Each RC instantiates a PHY device, a PCIe config (H2X) bridge, and an MMIO
alias region. The per-RC MMIO alias size is 0x20000000. The AST2700 A0
silicon revision does not support PCIe Root Complexes, so pcie_num is set
to 0 in that variant.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c     | 74 +++++++++++++++++++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  1 +
 2 files changed, 75 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 6aa3841b69..853339119f 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -38,6 +38,8 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_EHCI2]     =  0x12063000,
     [ASPEED_DEV_HACE]      =  0x12070000,
     [ASPEED_DEV_EMMC]      =  0x12090000,
+    [ASPEED_DEV_PCIE0]     =  0x120E0000,
+    [ASPEED_DEV_PCIE1]     =  0x120F0000,
     [ASPEED_DEV_INTC]      =  0x12100000,
     [ASPEED_GIC_DIST]      =  0x12200000,
     [ASPEED_GIC_REDIST]    =  0x12280000,
@@ -45,6 +47,8 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_SCU]       =  0x12C02000,
     [ASPEED_DEV_RTC]       =  0x12C0F000,
     [ASPEED_DEV_TIMER1]    =  0x12C10000,
+    [ASPEED_DEV_PCIE_PHY0] =  0x12C15000,
+    [ASPEED_DEV_PCIE_PHY1] =  0x12C15800,
     [ASPEED_DEV_SLI]       =  0x12C17000,
     [ASPEED_DEV_UART4]     =  0x12C1A000,
     [ASPEED_DEV_IOMEM1]    =  0x14000000,
@@ -59,6 +63,7 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_ETH2]      =  0x14060000,
     [ASPEED_DEV_ETH3]      =  0x14070000,
     [ASPEED_DEV_SDHCI]     =  0x14080000,
+    [ASPEED_DEV_PCIE2]     =  0x140D0000,
     [ASPEED_DEV_EHCI3]     =  0x14121000,
     [ASPEED_DEV_EHCI4]     =  0x14123000,
     [ASPEED_DEV_ADC]       =  0x14C00000,
@@ -66,6 +71,7 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_GPIO]      =  0x14C0B000,
     [ASPEED_DEV_I2C]       =  0x14C0F000,
     [ASPEED_DEV_INTCIO]    =  0x14C18000,
+    [ASPEED_DEV_PCIE_PHY2] =  0x14C1C000,
     [ASPEED_DEV_SLIIO]     =  0x14C1E000,
     [ASPEED_DEV_VUART]     =  0x14C30000,
     [ASPEED_DEV_UART0]     =  0x14C33000,
@@ -81,6 +87,9 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_UART11]    =  0x14C33A00,
     [ASPEED_DEV_UART12]    =  0x14C33B00,
     [ASPEED_DEV_WDT]       =  0x14C37000,
+    [ASPEED_DEV_PCIE_MMIO0] = 0x60000000,
+    [ASPEED_DEV_PCIE_MMIO1] = 0x80000000,
+    [ASPEED_DEV_PCIE_MMIO2] = 0xA0000000,
     [ASPEED_DEV_SPI_BOOT]  =  0x100000000,
     [ASPEED_DEV_LTPI]      =  0x300000000,
     [ASPEED_DEV_SDRAM]     =  0x400000000,
@@ -156,6 +165,8 @@ static const int aspeed_soc_ast2700a1_irqmap[] = {
     [ASPEED_DEV_DP]        = 28,
     [ASPEED_DEV_EHCI1]     = 33,
     [ASPEED_DEV_EHCI2]     = 37,
+    [ASPEED_DEV_PCIE0]     = 56,
+    [ASPEED_DEV_PCIE1]     = 57,
     [ASPEED_DEV_LPC]       = 192,
     [ASPEED_DEV_IBT]       = 192,
     [ASPEED_DEV_KCS]       = 192,
@@ -166,6 +177,7 @@ static const int aspeed_soc_ast2700a1_irqmap[] = {
     [ASPEED_DEV_WDT]       = 195,
     [ASPEED_DEV_PWM]       = 195,
     [ASPEED_DEV_I3C]       = 195,
+    [ASPEED_DEV_PCIE2]     = 196,
     [ASPEED_DEV_UART0]     = 196,
     [ASPEED_DEV_UART1]     = 196,
     [ASPEED_DEV_UART2]     = 196,
@@ -233,6 +245,7 @@ static const int ast2700_gic132_gic196_intcmap[] = {
     [ASPEED_DEV_UART12]    = 18,
     [ASPEED_DEV_EHCI3]     = 28,
     [ASPEED_DEV_EHCI4]     = 29,
+    [ASPEED_DEV_PCIE2]     = 31,
 };
 
 /* GICINT 133 */
@@ -519,6 +532,17 @@ static void aspeed_soc_ast2700_init(Object *obj)
 
     snprintf(typename, sizeof(typename), "aspeed.hace-%s", socname);
     object_initialize_child(obj, "hace", &s->hace, typename);
+
+    for (i = 0; i < sc->pcie_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.pcie-phy-%s", socname);
+        object_initialize_child(obj, "pcie-phy[*]", &s->pcie_phy[i], typename);
+        object_property_set_int(OBJECT(&s->pcie_phy[i]), "id", i, &error_abort);
+
+        snprintf(typename, sizeof(typename), "aspeed.pcie-cfg-%s", socname);
+        object_initialize_child(obj, "pcie-cfg[*]", &s->pcie[i], typename);
+        object_property_set_int(OBJECT(&s->pcie[i]), "id", i, &error_abort);
+    }
+
     object_initialize_child(obj, "dpmcu", &s->dpmcu,
                             TYPE_UNIMPLEMENTED_DEVICE);
     object_initialize_child(obj, "ltpi", &s->ltpi,
@@ -610,6 +634,49 @@ static bool aspeed_soc_ast2700_gic_realize(DeviceState *dev, Error **errp)
     return true;
 }
 
+static bool aspeed_soc_ast2700_pcie_realize(DeviceState *dev, Error **errp)
+{
+    AspeedSoCState *s = ASPEED_SOC(dev);
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    MemoryRegion *mmio_mr = NULL;
+    char name[64];
+    qemu_irq irq;
+    int i;
+
+    for (i = 0; i < sc->pcie_num; i++) {
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie_phy[i]), errp)) {
+            return false;
+        }
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie_phy[i]), 0,
+                        sc->memmap[ASPEED_DEV_PCIE_PHY0 + i]);
+
+        object_property_set_int(OBJECT(&s->pcie[i]), "dram-base",
+                                sc->memmap[ASPEED_DEV_SDRAM],
+                                &error_abort);
+        object_property_set_link(OBJECT(&s->pcie[i]), "dram",
+                                 OBJECT(s->dram_mr), &error_abort);
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie[i]), errp)) {
+            return false;
+        }
+        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie[i]), 0,
+                        sc->memmap[ASPEED_DEV_PCIE0 + i]);
+        irq = aspeed_soc_get_irq(s, ASPEED_DEV_PCIE0 + i);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie[i].rc), 0, irq);
+
+        mmio_mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pcie[i].rc), 1);
+        snprintf(name, sizeof(name), "aspeed.pcie-mmio.%d", i);
+        memory_region_init_alias(&s->pcie_mmio_alias[i], OBJECT(&s->pcie[i].rc),
+                                 name, mmio_mr,
+                                 sc->memmap[ASPEED_DEV_PCIE_MMIO0 + i],
+                                 0x20000000);
+        memory_region_add_subregion(s->memory,
+                                    sc->memmap[ASPEED_DEV_PCIE_MMIO0 + i],
+                                    &s->pcie_mmio_alias[i]);
+    }
+
+    return true;
+}
+
 static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
 {
     int i;
@@ -936,6 +1003,11 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
 
+    /* PCIe Root Complex (RC) */
+    if (!aspeed_soc_ast2700_pcie_realize(dev, errp)) {
+        return;
+    }
+
     aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu),
                                   "aspeed.dpmcu",
                                   sc->memmap[ASPEED_DEV_DPMCU],
@@ -974,6 +1046,7 @@ static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, const void *data)
     sc->valid_cpu_types = valid_cpu_types;
     sc->silicon_rev  = AST2700_A0_SILICON_REV;
     sc->sram_size    = 0x20000;
+    sc->pcie_num     = 0;
     sc->spis_num     = 3;
     sc->ehcis_num    = 2;
     sc->wdts_num     = 8;
@@ -1002,6 +1075,7 @@ static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
     sc->valid_cpu_types = valid_cpu_types;
     sc->silicon_rev  = AST2700_A1_SILICON_REV;
     sc->sram_size    = 0x20000;
+    sc->pcie_num     = 3;
     sc->spis_num     = 3;
     sc->ehcis_num    = 4;
     sc->wdts_num     = 8;
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index a0cf433775..aaf518d179 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -186,6 +186,7 @@ struct AspeedSoCClass {
     uint32_t silicon_rev;
     uint64_t sram_size;
     uint64_t secsram_size;
+    int pcie_num;
     int spis_num;
     int ehcis_num;
     int wdts_num;

From d43f6db6548c997263949d8908b62dbab5fbd0ff Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:12 +0800
Subject: [PATCH 0775/2396] tests/functional/arm/test_aspeed_ast2600: Add PCIe
 and network test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend the AST2600 functional tests with PCIe and network checks.

This patch introduces a new helper "do_ast2600_pcie_test()" that runs "lspci"
on the emulated system and verifies the presence of the expected PCIe devices:

- 80:00.0 Host bridge: ASPEED Technology, Inc. Device 2600
- 80:08.0 PCI bridge: ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge
- 81:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection

To exercise the PCIe network device, the test adds:

  -device e1000e,netdev=net1,bus=pcie.0
  -netdev user,id=net1

and assigns an IP address to the interface, verifying it with `ip addr`.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-14-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2600.py | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/tests/functional/arm/test_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600.py
index 62949b0b4f..f655c0ba0c 100755
--- a/tests/functional/arm/test_aspeed_ast2600.py
+++ b/tests/functional/arm/test_aspeed_ast2600.py
@@ -101,8 +101,26 @@ class AST2600Machine(AspeedTest):
         'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2600-default-obmc.tar.gz',
         'cb6c08595bcbba1672ce716b068ba4e48eda1ed9abe78a07b30392ba2278feba')
 
+    def do_ast2600_pcie_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 80:00.0',
+            '80:00.0 Host bridge: '
+            'ASPEED Technology, Inc. Device 2600')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 80:08.0',
+            '80:08.0 PCI bridge: '
+            'ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 81:00.0',
+            '81:00.0 Ethernet controller: '
+            'Intel Corporation 82574L Gigabit Network Connection')
+        exec_command_and_wait_for_pattern(self,
+            'ip addr show dev eth4',
+            'inet 10.0.2.15/24')
+
     def test_arm_ast2600_evb_sdk(self):
         self.set_machine('ast2600-evb')
+        self.require_netdev('user')
 
         self.archive_extract(self.ASSET_SDK_V907_AST2600)
 
@@ -110,6 +128,8 @@ class AST2600Machine(AspeedTest):
             'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
         self.vm.add_args('-device',
             'ds1338,bus=aspeed.i2c.bus.5,address=0x32')
+        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.0')
+        self.vm.add_args('-netdev', 'user,id=net1')
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2600-default", "image-bmc"))
 
@@ -135,6 +155,7 @@ class AST2600Machine(AspeedTest):
         year = time.strftime("%Y")
         exec_command_and_wait_for_pattern(self,
              '/sbin/hwclock -f /dev/rtc1', year)
+        self.do_ast2600_pcie_test()
 
     def test_arm_ast2600_otp_blockdev_device(self):
         self.vm.set_machine("ast2600-evb")

From f821557f4f7fc8ff7ed5c1950e6a12cfe47cdac5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:27 +0800
Subject: [PATCH 0776/2396] hw/arm/aspeed: Move aspeed_board_init_flashes() to
 common SoC code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Relocate aspeed_board_init_flashes() from hw/arm/aspeed.c into
hw/arm/aspeed_soc_common.c so the helper can be reused by all
ASPEED machines. The API was already declared in
include/hw/arm/aspeed_soc.h; this change moves its
implementation out of the machine file to keep aspeed.c cleaner.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c            | 22 ----------------------
 hw/arm/aspeed_soc_common.c | 23 +++++++++++++++++++++++
 2 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index d21b21965a..55f0afe0a4 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -337,28 +337,6 @@ static void aspeed_load_vbootrom(AspeedMachineState *bmc, const char *bios_name,
     }
 }
 
-void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
-                                      unsigned int count, int unit0)
-{
-    int i;
-
-    if (!flashtype) {
-        return;
-    }
-
-    for (i = 0; i < count; ++i) {
-        DriveInfo *dinfo = drive_get(IF_MTD, 0, unit0 + i);
-        DeviceState *dev;
-
-        dev = qdev_new(flashtype);
-        if (dinfo) {
-            qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo));
-        }
-        qdev_prop_set_uint8(dev, "cs", i);
-        qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
-    }
-}
-
 static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo, bool emmc,
                                bool boot_emmc)
 {
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index 1c4ac93a0f..31b1e683c3 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -16,6 +16,7 @@
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/char/serial-mm.h"
+#include "system/blockdev.h"
 
 
 const char *aspeed_soc_cpu_type(AspeedSoCClass *sc)
@@ -124,6 +125,28 @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
                                         sysbus_mmio_get_region(dev, 0), -1000);
 }
 
+void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
+                               unsigned int count, int unit0)
+{
+    int i;
+
+    if (!flashtype) {
+        return;
+    }
+
+    for (i = 0; i < count; ++i) {
+        DriveInfo *dinfo = drive_get(IF_MTD, 0, unit0 + i);
+        DeviceState *dev;
+
+        dev = qdev_new(flashtype);
+        if (dinfo) {
+            qdev_prop_set_drive(dev, "drive", blk_by_legacy_dinfo(dinfo));
+        }
+        qdev_prop_set_uint8(dev, "cs", i);
+        qdev_realize_and_unref(dev, BUS(s->spi), &error_fatal);
+    }
+}
+
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(dev);

From 597165ec2fb018be8aa7cefa5e3424c39fcec226 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:28 +0800
Subject: [PATCH 0777/2396] hw/arm/aspeed: Move write_boot_rom to common SoC
 code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the write_boot_rom helper from hw/arm/aspeed.c into
hw/arm/aspeed_soc_common.c so it can be reused by all ASPEED
machines. Export the API as aspeed_write_boot_rom() in
include/hw/arm/aspeed_soc.h and update the existing call site
to use the new helper.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 33 ++-------------------------------
 hw/arm/aspeed_soc_common.c  | 31 +++++++++++++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  2 ++
 3 files changed, 35 insertions(+), 31 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 55f0afe0a4..4d0d935836 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -263,35 +263,6 @@ static void aspeed_reset_secondary(ARMCPU *cpu,
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-static void write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
-                           Error **errp)
-{
-    g_autofree void *storage = NULL;
-    int64_t size;
-
-    /*
-     * The block backend size should have already been 'validated' by
-     * the creation of the m25p80 object.
-     */
-    size = blk_getlength(blk);
-    if (size <= 0) {
-        error_setg(errp, "failed to get flash size");
-        return;
-    }
-
-    if (rom_size > size) {
-        rom_size = size;
-    }
-
-    storage = g_malloc0(rom_size);
-    if (blk_pread(blk, 0, rom_size, storage, 0) < 0) {
-        error_setg(errp, "failed to read the initial flash content");
-        return;
-    }
-
-    rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
-}
-
 /*
  * Create a ROM and copy the flash contents at the expected address
  * (0x0). Boots faster than execute-in-place.
@@ -306,8 +277,8 @@ static void aspeed_install_boot_rom(AspeedMachineState *bmc, BlockBackend *blk,
                            &error_abort);
     memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
                                         &bmc->boot_rom, 1);
-    write_boot_rom(blk, sc->memmap[ASPEED_DEV_SPI_BOOT],
-                   rom_size, &error_abort);
+    aspeed_write_boot_rom(blk, sc->memmap[ASPEED_DEV_SPI_BOOT], rom_size,
+                          &error_abort);
 }
 
 #define VBOOTROM_FILE_NAME  "ast27x0_bootrom.bin"
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index 31b1e683c3..d0a400725f 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -17,6 +17,8 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/char/serial-mm.h"
 #include "system/blockdev.h"
+#include "system/block-backend.h"
+#include "hw/loader.h"
 
 
 const char *aspeed_soc_cpu_type(AspeedSoCClass *sc)
@@ -147,6 +149,35 @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
     }
 }
 
+void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
+                           Error **errp)
+{
+    g_autofree void *storage = NULL;
+    int64_t size;
+
+    /*
+     * The block backend size should have already been 'validated' by
+     * the creation of the m25p80 object.
+     */
+    size = blk_getlength(blk);
+    if (size <= 0) {
+        error_setg(errp, "failed to get flash size");
+        return;
+    }
+
+    if (rom_size > size) {
+        rom_size = size;
+    }
+
+    storage = g_malloc0(rom_size);
+    if (blk_pread(blk, 0, rom_size, storage, 0) < 0) {
+        error_setg(errp, "failed to read the initial flash content");
+        return;
+    }
+
+    rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
+}
+
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(dev);
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index aaf518d179..5567bdcb69 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -312,6 +312,8 @@ void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
                                    uint64_t size);
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                unsigned int count, int unit0);
+void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
+                           Error **errp);
 
 static inline int aspeed_uart_index(int uart_dev)
 {

From a705e9997fd571427fc72d88c1235b1e2bd0c6fb Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:29 +0800
Subject: [PATCH 0778/2396] hw/arm/aspeed: Move aspeed_install_boot_rom to
 common SoC code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the boot ROM install helper into common SoC code so it can be reused
by all ASPEED boards, and decouple the API from AspeedMachineState.

Specifically:
 - Move aspeed_install_boot_rom() to hw/arm/aspeed_soc_common.c and
   declare it in include/hw/arm/aspeed_soc.h.
 - Change the helper’s signature to take AspeedSoCState * and a
   MemoryRegion * provided by the caller, instead of AspeedMachineState *.
 - Update aspeed_machine_init() call sites accordingly.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 23 +++--------------------
 hw/arm/aspeed_soc_common.c  | 17 +++++++++++++++++
 include/hw/arm/aspeed_soc.h |  2 ++
 3 files changed, 22 insertions(+), 20 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 4d0d935836..429f4c6d77 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -263,24 +263,6 @@ static void aspeed_reset_secondary(ARMCPU *cpu,
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-/*
- * Create a ROM and copy the flash contents at the expected address
- * (0x0). Boots faster than execute-in-place.
- */
-static void aspeed_install_boot_rom(AspeedMachineState *bmc, BlockBackend *blk,
-                                    uint64_t rom_size)
-{
-    AspeedSoCState *soc = bmc->soc;
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(soc);
-
-    memory_region_init_rom(&bmc->boot_rom, NULL, "aspeed.boot_rom", rom_size,
-                           &error_abort);
-    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
-                                        &bmc->boot_rom, 1);
-    aspeed_write_boot_rom(blk, sc->memmap[ASPEED_DEV_SPI_BOOT], rom_size,
-                          &error_abort);
-}
-
 #define VBOOTROM_FILE_NAME  "ast27x0_bootrom.bin"
 
 /*
@@ -460,9 +442,10 @@ static void aspeed_machine_init(MachineState *machine)
 
         if (fmc0 && !boot_emmc) {
             uint64_t rom_size = memory_region_size(&bmc->soc->spi_boot);
-            aspeed_install_boot_rom(bmc, fmc0, rom_size);
+            aspeed_install_boot_rom(bmc->soc, fmc0, &bmc->boot_rom, rom_size);
         } else if (emmc0) {
-            aspeed_install_boot_rom(bmc, blk_by_legacy_dinfo(emmc0), 64 * KiB);
+            aspeed_install_boot_rom(bmc->soc, blk_by_legacy_dinfo(emmc0),
+                                    &bmc->boot_rom, 64 * KiB);
         }
     }
 
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index d0a400725f..7f104f8de5 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -178,6 +178,23 @@ void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
     rom_add_blob_fixed("aspeed.boot_rom", storage, rom_size, addr);
 }
 
+/*
+ * Create a ROM and copy the flash contents at the expected address
+ * (0x0). Boots faster than execute-in-place.
+ */
+void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
+                             MemoryRegion *boot_rom, uint64_t rom_size)
+{
+    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(soc);
+
+    memory_region_init_rom(boot_rom, NULL, "aspeed.boot_rom", rom_size,
+                           &error_abort);
+    memory_region_add_subregion_overlap(&soc->spi_boot_container, 0,
+                                        boot_rom, 1);
+    aspeed_write_boot_rom(blk, sc->memmap[ASPEED_DEV_SPI_BOOT], rom_size,
+                          &error_abort);
+}
+
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(dev);
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 5567bdcb69..aea210a8e2 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -314,6 +314,8 @@ void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,
                                unsigned int count, int unit0);
 void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
                            Error **errp);
+void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
+                             MemoryRegion *boot_rom, uint64_t rom_size);
 
 static inline int aspeed_uart_index(int uart_dev)
 {

From ecabf8ba94961a23f473e7060f8589e93967cfd2 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:30 +0800
Subject: [PATCH 0779/2396] hw/arm/aspeed: Move aspeed_load_vbootrom to common
 SoC code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the vbootrom loader helper into common SoC code so it can be reused
by all ASPEED boards, and decouple the API from AspeedMachineState.

Specifically:
- Move aspeed_load_vbootrom() to hw/arm/aspeed_soc_common.c and
declare it in include/hw/arm/aspeed_soc.h.
- Change the helper’s signature to take AspeedSoCState * instead of
AspeedMachineState *.
- Update aspeed_machine_init() call sites accordingly.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 31 +------------------------------
 hw/arm/aspeed_soc_common.c  | 25 +++++++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  4 ++++
 3 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 429f4c6d77..6046ec0bb2 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -26,9 +26,7 @@
 #include "hw/qdev-properties.h"
 #include "system/block-backend.h"
 #include "system/reset.h"
-#include "hw/loader.h"
 #include "qemu/error-report.h"
-#include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "hw/qdev-clock.h"
 #include "system/system.h"
@@ -263,33 +261,6 @@ static void aspeed_reset_secondary(ARMCPU *cpu,
     cpu_set_pc(cs, info->smp_loader_start);
 }
 
-#define VBOOTROM_FILE_NAME  "ast27x0_bootrom.bin"
-
-/*
- * This function locates the vbootrom image file specified via the command line
- * using the -bios option. It loads the specified image into the vbootrom
- * memory region and handles errors if the file cannot be found or loaded.
- */
-static void aspeed_load_vbootrom(AspeedMachineState *bmc, const char *bios_name,
-                                 Error **errp)
-{
-    g_autofree char *filename = NULL;
-    AspeedSoCState *soc = bmc->soc;
-    int ret;
-
-    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
-    if (!filename) {
-        error_setg(errp, "Could not find vbootrom image '%s'", bios_name);
-        return;
-    }
-
-    ret = load_image_mr(filename, &soc->vbootrom);
-    if (ret < 0) {
-        error_setg(errp, "Failed to load vbootrom image '%s'", bios_name);
-        return;
-    }
-}
-
 static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo, bool emmc,
                                bool boot_emmc)
 {
@@ -451,7 +422,7 @@ static void aspeed_machine_init(MachineState *machine)
 
     if (amc->vbootrom) {
         bios_name = machine->firmware ?: VBOOTROM_FILE_NAME;
-        aspeed_load_vbootrom(bmc, bios_name, &error_abort);
+        aspeed_load_vbootrom(bmc->soc, bios_name, &error_abort);
     }
 
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index 7f104f8de5..bc70e864fb 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -19,6 +19,7 @@
 #include "system/blockdev.h"
 #include "system/block-backend.h"
 #include "hw/loader.h"
+#include "qemu/datadir.h"
 
 
 const char *aspeed_soc_cpu_type(AspeedSoCClass *sc)
@@ -195,6 +196,30 @@ void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
                           &error_abort);
 }
 
+/*
+ * This function locates the vbootrom image file specified via the command line
+ * using the -bios option. It loads the specified image into the vbootrom
+ * memory region and handles errors if the file cannot be found or loaded.
+ */
+void aspeed_load_vbootrom(AspeedSoCState *soc, const char *bios_name,
+                          Error **errp)
+{
+    g_autofree char *filename = NULL;
+    int ret;
+
+    filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
+    if (!filename) {
+        error_setg(errp, "Could not find vbootrom image '%s'", bios_name);
+        return;
+    }
+
+    ret = load_image_mr(filename, &soc->vbootrom);
+    if (ret < 0) {
+        error_setg(errp, "Failed to load vbootrom image '%s'", bios_name);
+        return;
+    }
+}
+
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 {
     AspeedSoCState *s = ASPEED_SOC(dev);
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index aea210a8e2..ed32efb543 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -43,6 +43,8 @@
 #include "hw/char/serial-mm.h"
 #include "hw/intc/arm_gicv3.h"
 
+#define VBOOTROM_FILE_NAME  "ast27x0_bootrom.bin"
+
 #define ASPEED_SPIS_NUM  3
 #define ASPEED_EHCIS_NUM 4
 #define ASPEED_WDTS_NUM  8
@@ -316,6 +318,8 @@ void aspeed_write_boot_rom(BlockBackend *blk, hwaddr addr, size_t rom_size,
                            Error **errp);
 void aspeed_install_boot_rom(AspeedSoCState *soc, BlockBackend *blk,
                              MemoryRegion *boot_rom, uint64_t rom_size);
+void aspeed_load_vbootrom(AspeedSoCState *soc, const char *bios_name,
+                          Error **errp);
 
 static inline int aspeed_uart_index(int uart_dev)
 {

From 8d3aaefdb3bb13df7c57091a4319f3afe3c351ac Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:31 +0800
Subject: [PATCH 0780/2396] hw/arm/aspeed_ast27x0-fc: Drop dead return checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1. object_property_set_link() can return false only when it fails, and it
sets an error when it fails. Since passing &error_abort causes an abort,
the function never returns false, and the return statement is effectively
dead code.
2. object_property_set_int() is considered as a routine which shouldn't fail.
So the common practice in models is to pass &error_abort and ignore the returned value.
https://patchwork.kernel.org/project/qemu-devel/patch/20250717034054.1903991-3-jamin_lin@aspeedtech.com/#26540626

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 43 +++++++++++++-------------------------
 1 file changed, 14 insertions(+), 29 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 7087be4288..ebf3784df5 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -74,19 +74,12 @@ static void ast2700fc_ca35_init(MachineState *machine)
                                 AST2700FC_BMC_RAM_SIZE, &error_abort)) {
         return;
     }
-    if (!object_property_set_link(OBJECT(&s->ca35), "memory",
-                                  OBJECT(&s->ca35_memory),
-                                  &error_abort)) {
-        return;
-    };
-    if (!object_property_set_link(OBJECT(&s->ca35), "dram",
-                                  OBJECT(&s->ca35_dram), &error_abort)) {
-        return;
-    }
-    if (!object_property_set_int(OBJECT(&s->ca35), "ram-size",
-                                 AST2700FC_BMC_RAM_SIZE, &error_abort)) {
-        return;
-    }
+    object_property_set_link(OBJECT(&s->ca35), "memory",
+                             OBJECT(&s->ca35_memory), &error_abort);
+    object_property_set_link(OBJECT(&s->ca35), "dram", OBJECT(&s->ca35_dram),
+                             &error_abort);
+    object_property_set_int(OBJECT(&s->ca35), "ram-size",
+                            AST2700FC_BMC_RAM_SIZE, &error_abort);
 
     for (int i = 0; i < sc->macs_num; i++) {
         if (!qemu_configure_nic_device(DEVICE(&soc->ftgmac100[i]),
@@ -94,14 +87,10 @@ static void ast2700fc_ca35_init(MachineState *machine)
             break;
         }
     }
-    if (!object_property_set_int(OBJECT(&s->ca35), "hw-strap1",
-                                 AST2700FC_HW_STRAP1, &error_abort)) {
-        return;
-    }
-    if (!object_property_set_int(OBJECT(&s->ca35), "hw-strap2",
-                                 AST2700FC_HW_STRAP2, &error_abort)) {
-        return;
-    }
+    object_property_set_int(OBJECT(&s->ca35), "hw-strap1",
+                            AST2700FC_HW_STRAP1, &error_abort);
+    object_property_set_int(OBJECT(&s->ca35), "hw-strap2",
+                            AST2700FC_HW_STRAP2, &error_abort);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART12, serial_hd(0));
     if (!qdev_realize(DEVICE(&s->ca35), NULL, &error_abort)) {
         return;
@@ -133,10 +122,8 @@ static void ast2700fc_ssp_init(MachineState *machine)
                        UINT64_MAX);
 
     qdev_connect_clock_in(DEVICE(&s->ssp), "sysclk", s->ssp_sysclk);
-    if (!object_property_set_link(OBJECT(&s->ssp), "memory",
-                                  OBJECT(&s->ssp_memory), &error_abort)) {
-        return;
-    }
+    object_property_set_link(OBJECT(&s->ssp), "memory",
+                             OBJECT(&s->ssp_memory), &error_abort);
 
     soc = ASPEED_SOC(&s->ssp);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART4, serial_hd(1));
@@ -157,10 +144,8 @@ static void ast2700fc_tsp_init(MachineState *machine)
                        UINT64_MAX);
 
     qdev_connect_clock_in(DEVICE(&s->tsp), "sysclk", s->tsp_sysclk);
-    if (!object_property_set_link(OBJECT(&s->tsp), "memory",
-                                  OBJECT(&s->tsp_memory), &error_abort)) {
-        return;
-    }
+    object_property_set_link(OBJECT(&s->tsp), "memory",
+                             OBJECT(&s->tsp_memory), &error_abort);
 
     soc = ASPEED_SOC(&s->tsp);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART7, serial_hd(2));

From 9ec30a07483640ecb8417fce3dfa9273f7a036c9 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 25 Sep 2025 13:05:32 +0800
Subject: [PATCH 0781/2396] hw/arm/aspeed_ast27x0-fc: Make sub-init functions
 return bool with errp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor ast2700fc_ca35_init(), ast2700fc_ssp_init(), and ast2700fc_tsp_init()
to take an Error **errp parameter and return a bool.
Each function now reports failure through the error object and returns false.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250925050535.2657256-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 34 ++++++++++++++++++++--------------
 1 file changed, 20 insertions(+), 14 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index ebf3784df5..2e16a0340a 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -56,7 +56,7 @@ struct Ast2700FCState {
 #define AST2700FC_FMC_MODEL "w25q01jvq"
 #define AST2700FC_SPI_MODEL "w25q512jv"
 
-static void ast2700fc_ca35_init(MachineState *machine)
+static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
 {
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *soc;
@@ -71,8 +71,8 @@ static void ast2700fc_ca35_init(MachineState *machine)
     memory_region_add_subregion(get_system_memory(), 0, &s->ca35_memory);
 
     if (!memory_region_init_ram(&s->ca35_dram, OBJECT(&s->ca35), "ca35-dram",
-                                AST2700FC_BMC_RAM_SIZE, &error_abort)) {
-        return;
+                                AST2700FC_BMC_RAM_SIZE, errp)) {
+        return false;
     }
     object_property_set_link(OBJECT(&s->ca35), "memory",
                              OBJECT(&s->ca35_memory), &error_abort);
@@ -92,8 +92,8 @@ static void ast2700fc_ca35_init(MachineState *machine)
     object_property_set_int(OBJECT(&s->ca35), "hw-strap2",
                             AST2700FC_HW_STRAP2, &error_abort);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART12, serial_hd(0));
-    if (!qdev_realize(DEVICE(&s->ca35), NULL, &error_abort)) {
-        return;
+    if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
+        return false;
     }
 
     /*
@@ -108,9 +108,11 @@ static void ast2700fc_ca35_init(MachineState *machine)
     ast2700fc_board_info.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
 
     arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
+
+    return true;
 }
 
-static void ast2700fc_ssp_init(MachineState *machine)
+static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 {
     AspeedSoCState *soc;
     Ast2700FCState *s = AST2700A1FC(machine);
@@ -127,12 +129,14 @@ static void ast2700fc_ssp_init(MachineState *machine)
 
     soc = ASPEED_SOC(&s->ssp);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART4, serial_hd(1));
-    if (!qdev_realize(DEVICE(&s->ssp), NULL, &error_abort)) {
-        return;
+    if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
+        return false;
     }
+
+    return true;
 }
 
-static void ast2700fc_tsp_init(MachineState *machine)
+static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
 {
     AspeedSoCState *soc;
     Ast2700FCState *s = AST2700A1FC(machine);
@@ -149,16 +153,18 @@ static void ast2700fc_tsp_init(MachineState *machine)
 
     soc = ASPEED_SOC(&s->tsp);
     aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART7, serial_hd(2));
-    if (!qdev_realize(DEVICE(&s->tsp), NULL, &error_abort)) {
-        return;
+    if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
+        return false;
     }
+
+    return true;
 }
 
 static void ast2700fc_init(MachineState *machine)
 {
-    ast2700fc_ca35_init(machine);
-    ast2700fc_ssp_init(machine);
-    ast2700fc_tsp_init(machine);
+    ast2700fc_ca35_init(machine, &error_abort);
+    ast2700fc_ssp_init(machine, &error_abort);
+    ast2700fc_tsp_init(machine, &error_abort);
 }
 
 static void ast2700fc_class_init(ObjectClass *oc, const void *data)

From e01b61963faf810ceee1f15c97ec3a2210112c47 Mon Sep 17 00:00:00 2001
From: Weifeng Liu <weifeng.liu.z@gmail.com>
Date: Mon, 14 Jul 2025 22:17:54 +0800
Subject: [PATCH 0782/2396] gtk: Skip drawing if console surface is NULL
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In gtk draw/render callbacks, add an early NULL check for the console
surface and skip drawing if it's NULL. Otherwise, attempting to fetch
its width and height crash. This change fixes Coverity CID 1610328.

In practice, this case wouldn't happen at all because we always install
a placeholder surface to the console when there is nothing to display.

Resolves: Coverity CID 1610328
Signed-off-by: Weifeng Liu <weifeng.liu.z@gmail.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250714141758.10062-1-weifeng.liu.z@gmail.com>
---
 ui/gtk-egl.c     | 5 +----
 ui/gtk-gl-area.c | 5 +----
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/ui/gtk-egl.c b/ui/gtk-egl.c
index 0b787bea25..ae9239999c 100644
--- a/ui/gtk-egl.c
+++ b/ui/gtk-egl.c
@@ -72,7 +72,7 @@ void gd_egl_draw(VirtualConsole *vc)
 #endif
     int ww, wh, pw, ph, gs;
 
-    if (!vc->gfx.gls) {
+    if (!vc->gfx.gls || !vc->gfx.ds) {
         return;
     }
 
@@ -112,9 +112,6 @@ void gd_egl_draw(VirtualConsole *vc)
         }
 #endif
     } else {
-        if (!vc->gfx.ds) {
-            return;
-        }
         eglMakeCurrent(qemu_egl_display, vc->gfx.esurface,
                        vc->gfx.esurface, vc->gfx.ectx);
 
diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 8151cc413c..05fc38096e 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -48,7 +48,7 @@ void gd_gl_area_draw(VirtualConsole *vc)
     int fbw, fbh;
     int wx_offset, wy_offset;
 
-    if (!vc->gfx.gls) {
+    if (!vc->gfx.gls || !vc->gfx.ds) {
         return;
     }
 
@@ -135,9 +135,6 @@ void gd_gl_area_draw(VirtualConsole *vc)
         }
 #endif
     } else {
-        if (!vc->gfx.ds) {
-            return;
-        }
         gtk_gl_area_make_current(GTK_GL_AREA(vc->gfx.drawing_area));
 
         surface_gl_setup_viewport(vc->gfx.gls, vc->gfx.ds, pw, ph);

From e7ecb533ee0dbfbe30c90abb213247f4943a9a12 Mon Sep 17 00:00:00 2001
From: Mohamed Akram <mohd.akram@outlook.com>
Date: Mon, 29 Sep 2025 15:42:24 +0000
Subject: [PATCH 0783/2396] ui/spice: Fix abort on macOS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The check is faulty because the thread variable was assigned in the main
thread while the main loop runs in a different thread on macOS.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3070
Signed-off-by: Mohamed Akram <mohd.akram@outlook.com>
Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <C87205B9-DD8F-4E53-AB5B-C8BF82EF1D16@outlook.com>
---
 ui/spice-core.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/ui/spice-core.c b/ui/spice-core.c
index 5992f9daec..2645e96ef6 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -50,8 +50,6 @@ static int spice_migration_completed;
 static int spice_display_is_running;
 static int spice_have_target_host;
 
-static QemuThread me;
-
 struct SpiceTimer {
     QEMUTimer *timer;
 };
@@ -222,7 +220,7 @@ static void channel_event(int event, SpiceChannelEventInfo *info)
      * thread and grab the BQL if so before calling qemu
      * functions.
      */
-    bool need_lock = !qemu_thread_is_self(&me);
+    bool need_lock = !bql_locked();
     if (need_lock) {
         bql_lock();
     }
@@ -675,8 +673,6 @@ static void qemu_spice_init(void)
     spice_wan_compression_t wan_compr;
     bool seamless_migration;
 
-    qemu_thread_get_self(&me);
-
     if (!opts) {
         return;
     }

From 62fd247a24290dba2b2de4ee8575624a7993973c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 3 Sep 2025 23:38:18 +0400
Subject: [PATCH 0784/2396] ui/spice: fix crash when disabling GL scanout on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When spice_qxl_gl_scanout2() isn't available, the fallback code
incorrectly handles NULL arguments to disable the scanout, leading to:

Program terminated with signal SIGSEGV, Segmentation fault.
#0  spice_server_gl_scanout (qxl=0x55a25ce57ae8, fd=0x0, width=0, height=0, offset=0x0, stride=0x0, num_planes=0, format=0, modifier=72057594037927935, y_0_top=0)
    at ../ui/spice-display.c:983
983         if (num_planes <= 1) {

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2391334
Fixes: 98a050ca93afd8 ("ui/spice: support multi plane dmabuf scanout")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Message-Id: <20250903193818.2460914-1-marcandre.lureau@redhat.com>
---
 ui/spice-display.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/spice-display.c b/ui/spice-display.c
index 669832c561..db71e866f8 100644
--- a/ui/spice-display.c
+++ b/ui/spice-display.c
@@ -980,7 +980,9 @@ static void spice_server_gl_scanout(QXLInstance *qxl,
     spice_qxl_gl_scanout2(qxl, fd, width, height, offset, stride,
                           num_planes, format, modifier, y_0_top);
 #else
-    if (num_planes <= 1) {
+    if (fd == NULL) {
+        spice_qxl_gl_scanout(qxl, -1, 0, 0, 0, 0, false);
+    } else if (num_planes <= 1) {
         spice_qxl_gl_scanout(qxl, fd[0], width, height, stride[0], format, y_0_top);
     } else {
         error_report("SPICE server does not support multi plane GL scanout");

From 15421f71137b4a1b6bab8c12257b013dae1aebb8 Mon Sep 17 00:00:00 2001
From: Nir Lichtman <nir@lichtman.org>
Date: Wed, 10 Sep 2025 11:49:29 +0000
Subject: [PATCH 0785/2396] ui/sdl2: fix reset scaling binding to be consistent
 with gtk

Problem: Currently the reset scaling hotkey is inconsistent between SDL
and GTK graphics modes.

Solution: Fix SDL to use MOD+0 instead of MOD+u which is in line with
GTK and generally more consistent with other apps.

This is also related to my previously sent patch fixing the docs.

Suggested-by: Gerd Hoffmann <kraxel@redhat.com>
Signed-off-by: Nir Lichtman <nir@lichtman.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250910114929.GA1783677@lichtman.org>
---
 ui/sdl2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ui/sdl2.c b/ui/sdl2.c
index b00e421f7f..032dc14bc3 100644
--- a/ui/sdl2.c
+++ b/ui/sdl2.c
@@ -421,7 +421,7 @@ static void handle_keydown(SDL_Event *ev)
                 sdl_grab_end(scon);
             }
             break;
-        case SDL_SCANCODE_U:
+        case SDL_SCANCODE_0:
             sdl2_window_resize(scon);
             if (!scon->opengl) {
                 /* re-create scon->texture */

From 9163424c50981dbc4ded9990228ac01a3b193656 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 30 Sep 2025 09:14:18 +0200
Subject: [PATCH 0786/2396] ui/icons/qemu.svg: Add metadata information
 (author, license) to the logo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We've got two versions of the QEMU logo in the repository, one with
the whole word "QEMU" (pc-bios/qemu_logo.svg) and one that only contains
the letter "Q" (ui/icons/qemu.svg). While qemu_logo.svg contains the
proper metadata with license and author information, this is missing
from the ui/icons/qemu.svg file. Copy the meta data there so that
people have a chance to know the license of the file if they only
look at the qemu.svg file.

Closes: https://gitlab.com/qemu-project/qemu/-/issues/3139
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250930071419.117592-1-thuth@redhat.com>
---
 ui/icons/qemu.svg | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/ui/icons/qemu.svg b/ui/icons/qemu.svg
index 24ca23a1e9..f2500de339 100644
--- a/ui/icons/qemu.svg
+++ b/ui/icons/qemu.svg
@@ -918,7 +918,26 @@
         <dc:format>image/svg+xml</dc:format>
         <dc:type
            rdf:resource="http://purl.org/dc/dcmitype/StillImage" />
-        <dc:title />
+        <dc:title>Kew the Angry Emu</dc:title>
+        <dc:creator>
+          <cc:Agent>
+            <dc:title>Benoît Canet</dc:title>
+          </cc:Agent>
+        </dc:creator>
+        <dc:rights>
+          <cc:Agent>
+            <dc:title>CC BY 3.0</dc:title>
+          </cc:Agent>
+        </dc:rights>
+        <dc:publisher>
+          <cc:Agent>
+            <dc:title>QEMU Community</dc:title>
+          </cc:Agent>
+        </dc:publisher>
+        <dc:date>2012-02-15</dc:date>
+        <cc:license
+           rdf:resource="http://creativecommons.org/licenses/by/3.0/" />
+        <dc:source>https://lists.gnu.org/archive/html/qemu-devel/2012-02/msg02865.html</dc:source>
       </cc:Work>
     </rdf:RDF>
   </metadata>

From 548f1abacbcd53947060a8b05b74d5d1539f87b3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:48 +0200
Subject: [PATCH 0787/2396] monitor: Clean up HMP gdbserver error reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HMP command gdbserver used to emit two error messages for certain
errors.  For instance, with -M none:

    (qemu) gdbserver
    gdbstub: meaningless to attach gdb to a machine without any CPU.
    Could not open gdbserver on device 'tcp::1234'

The first message is the specific error, and the second one a generic
additional message that feels superfluous to me.

Commit c0e6b8b798b (system: propagate Error to gdbserver_start (and
other device setups)) turned the first message into a warning:

    warning: gdbstub: meaningless to attach gdb to a machine without any CPU.
    Could not open gdbserver on device 'tcp::1234'

This is arguably worse.

hmp_gdbserver() passes &error_warn to gdbserver_start(), so that
failure gets reported as warning, and then additionally emits the
generic error on failure.  This is a misuse of &error_warn.

Instead, receive the error in &err and report it, as usual.  With
this, gdbserver reports just the error:

    gdbstub: meaningless to attach gdb to a machine without any CPU.

Cc: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250923091000.3180122-2-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 include/exec/gdbstub.h | 3 ---
 monitor/hmp-cmds.c     | 7 ++++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/exec/gdbstub.h b/include/exec/gdbstub.h
index a16c0051ce..bd7182c4d3 100644
--- a/include/exec/gdbstub.h
+++ b/include/exec/gdbstub.h
@@ -55,9 +55,6 @@ void gdb_unregister_coprocessor_all(CPUState *cpu);
  * system emulation you can use a full chardev spec for your gdbserver
  * port.
  *
- * The error handle should be either &error_fatal (for start-up) or
- * &error_warn (for QMP/HMP initiated sessions).
- *
  * Returns true when server successfully started.
  */
 bool gdbserver_start(const char *port_or_device, Error **errp);
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index 74a0f56566..33a88ce205 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -280,14 +280,15 @@ void hmp_log(Monitor *mon, const QDict *qdict)
 
 void hmp_gdbserver(Monitor *mon, const QDict *qdict)
 {
+    Error *err = NULL;
     const char *device = qdict_get_try_str(qdict, "device");
+
     if (!device) {
         device = "tcp::" DEFAULT_GDBSTUB_PORT;
     }
 
-    if (!gdbserver_start(device, &error_warn)) {
-        monitor_printf(mon, "Could not open gdbserver on device '%s'\n",
-                       device);
+    if (!gdbserver_start(device, &err)) {
+        error_report_err(err);
     } else if (strcmp(device, "none") == 0) {
         monitor_printf(mon, "Disabled gdbserver\n");
     } else {

From 82b5e6cc309292b3490be87bb020cbe74fe618fc Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:49 +0200
Subject: [PATCH 0788/2396] tcg: Fix error reporting on mprotect() failure in
 tcg_region_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tcg_region_init() calls one of qemu_mprotect_rwx(),
qemu_mprotect_rw(), and mprotect(), then reports failure with
error_setg_errno(&error_fatal, errno, ...).

The use of &error_fatal is undesirable.  qapi/error.h advises:

 * Please don't error_setg(&error_fatal, ...), use error_report() and
 * exit(), because that's more obvious.

The use of errno is wrong.  qemu_mprotect_rwx() and qemu_mprotect_rw()
wrap around qemu_mprotect__osdep().  qemu_mprotect__osdep() calls
mprotect() on POSIX, VirtualProtect() on Windows, and reports failure
with error_report().  VirtualProtect() doesn't set errno.  mprotect()
does, but error_report() may clobber it.

Fix tcg_region_init() to report errors only when it calls mprotect(),
and rely on qemu_mprotect_rwx()'s and qemu_mprotect_rw()'s error
reporting otherwise.  Use error_report(), not error_setg().

Fixes: 22c6a9938f75 (tcg: Merge buffer protection and guard page protection)
Fixes: 6bc144237a85 (tcg: Use Error with alloc_code_gen_buffer)
Cc: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250923091000.3180122-3-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 tcg/region.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tcg/region.c b/tcg/region.c
index 7ea0b37a84..2181267e48 100644
--- a/tcg/region.c
+++ b/tcg/region.c
@@ -832,13 +832,16 @@ void tcg_region_init(size_t tb_size, int splitwx, unsigned max_threads)
             } else {
 #ifdef CONFIG_POSIX
                 rc = mprotect(start, end - start, need_prot);
+                if (rc) {
+                    error_report("mprotect of jit buffer: %s",
+                                 strerror(errno));
+                }
 #else
                 g_assert_not_reached();
 #endif
             }
             if (rc) {
-                error_setg_errno(&error_fatal, errno,
-                                 "mprotect of jit buffer");
+                exit(1);
             }
         }
         if (have_prot != 0) {

From b8df7dfc04a88228a6bf35530c10b1326f5cb6d6 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:50 +0200
Subject: [PATCH 0789/2396] hw/cxl: Convert cxl_fmws_link() to Error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Functions that use an Error **errp parameter to return errors should
not also report them to the user, because reporting is the caller's
job.  When the caller does, the error is reported twice.  When it
doesn't (because it recovered from the error), there is no error to
report, i.e. the report is bogus.

cxl_fmws_link_targets() violates this principle: it calls
error_setg(&error_fatal, ...) via cxl_fmws_link().  Goes back to
commit 584f722eb3ab (hw/cxl: Make the CXL fixed memory windows
devices.)  Currently harmless, because cxl_fmws_link_targets()'s
callers always pass &error_fatal.  Clean this up by converting
cxl_fmws_link() to Error.

Also change its return value on error from 1 to -1 to conform to the
rules laid in qapi/error.h.  It's call chain cxl_fmws_link_targets()
via object_child_foreach_recursive() is fine with that.

Cc: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250923091000.3180122-4-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 hw/cxl/cxl-host.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/cxl/cxl-host.c b/hw/cxl/cxl-host.c
index 5c2ce25a19..0d891c651d 100644
--- a/hw/cxl/cxl-host.c
+++ b/hw/cxl/cxl-host.c
@@ -72,6 +72,7 @@ static void cxl_fixed_memory_window_config(CXLFixedMemoryWindowOptions *object,
 
 static int cxl_fmws_link(Object *obj, void *opaque)
 {
+    Error **errp = opaque;
     struct CXLFixedWindow *fw;
     int i;
 
@@ -87,9 +88,9 @@ static int cxl_fmws_link(Object *obj, void *opaque)
         o = object_resolve_path_type(fw->targets[i], TYPE_PXB_CXL_DEV,
                                      &ambig);
         if (!o) {
-            error_setg(&error_fatal, "Could not resolve CXLFM target %s",
+            error_setg(errp, "Could not resolve CXLFM target %s",
                        fw->targets[i]);
-            return 1;
+            return -1;
         }
         fw->target_hbs[i] = PXB_CXL_DEV(o);
     }
@@ -99,7 +100,7 @@ static int cxl_fmws_link(Object *obj, void *opaque)
 void cxl_fmws_link_targets(Error **errp)
 {
     /* Order doesn't matter for this, so no need to build list */
-    object_child_foreach_recursive(object_get_root(), cxl_fmws_link, NULL);
+    object_child_foreach_recursive(object_get_root(), cxl_fmws_link, errp);
 }
 
 static bool cxl_hdm_find_target(uint32_t *cache_mem, hwaddr addr,

From 897071bb27bfba578af15300973b7a4a1fb65ad2 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:51 +0200
Subject: [PATCH 0790/2396] migration/cpr: Clean up error reporting in
 cpr_resave_fd()

qapi/error.h advises:

 * Please don't error_setg(&error_fatal, ...), use error_report() and
 * exit(), because that's more obvious.

Do that, and replace exit() by g_assert_not_reached(), since this is
actually a programming error.

Cc: Steve Sistare <steven.sistare@oracle.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Message-ID: <20250923091000.3180122-5-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 migration/cpr.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/migration/cpr.c b/migration/cpr.c
index 42ad0b0d50..9848a21ea6 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -7,6 +7,7 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include "hw/vfio/vfio-device.h"
 #include "migration/cpr.h"
 #include "migration/misc.h"
@@ -100,10 +101,10 @@ void cpr_resave_fd(const char *name, int id, int fd)
     if (old_fd < 0) {
         cpr_save_fd(name, id, fd);
     } else if (old_fd != fd) {
-        error_setg(&error_fatal,
-                   "internal error: cpr fd '%s' id %d value %d "
-                   "already saved with a different value %d",
-                   name, id, fd, old_fd);
+        error_report("internal error: cpr fd '%s' id %d value %d "
+                     "already saved with a different value %d",
+                     name, id, fd, old_fd);
+        g_assert_not_reached();
     }
 }
 

From 789f1adefba726d2b0bf4d4254c829b5912e32ee Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:52 +0200
Subject: [PATCH 0791/2396] hw/remote/vfio-user: Clean up error reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFU_OBJECT_ERROR() reports the error with error_setg(&error_abort,
...) when auto-shutdown is enabled, else with error_report().

Issues:

1. The error is serious enough to warrant aborting the process when
auto-shutdown is enabled, yet harmless enough to permit carrying on
when it's disabled.  This makes no sense to me.

2. Like assert(), &error_abort is strictly for programming errors.  Is
this one?  Vladimir Sementsov-Ogievskiy tells me it's not.  Should we
exit(1) instead?

3. qapi/error.h advises "don't error_setg(&error_abort, ...), use
assert()."

This patch addresses just 3.  It adds a FIXME comment for the other
two.

Cc: Jagannathan Raman <jag.raman@oracle.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250923091000.3180122-6-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
[FIXME comment added, commit message adjusted accordingly]
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 hw/remote/vfio-user-obj.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/hw/remote/vfio-user-obj.c b/hw/remote/vfio-user-obj.c
index ea6165ebdc..216b4876e2 100644
--- a/hw/remote/vfio-user-obj.c
+++ b/hw/remote/vfio-user-obj.c
@@ -75,12 +75,17 @@ OBJECT_DECLARE_TYPE(VfuObject, VfuObjectClass, VFU_OBJECT)
  */
 #define VFU_OBJECT_ERROR(o, fmt, ...)                                     \
     {                                                                     \
+        error_report((fmt), ## __VA_ARGS__);                              \
         if (vfu_object_auto_shutdown()) {                                 \
-            error_setg(&error_abort, (fmt), ## __VA_ARGS__);              \
-        } else {                                                          \
-            error_report((fmt), ## __VA_ARGS__);                          \
+            /*                                                            \
+             * FIXME This looks inappropriate.  The error is serious      \
+             * enough programming error to warrant aborting the process   \
+             * when auto-shutdown is enabled, yet harmless enough to      \
+             * permit carrying on when it's disabled.  Makes no sense.    \
+             */                                                           \
+            abort();                                                      \
         }                                                                 \
-    }                                                                     \
+    }
 
 struct VfuObjectClass {
     ObjectClass parent_class;

From 3cacecb9f83754a61f4a524f686deae790e2df15 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:53 +0200
Subject: [PATCH 0792/2396] net/slirp: Clean up error reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

net_slirp_register_poll_sock() and net_slirp_unregister_poll_sock()
report WSAEventSelect() failure with error_setg(&error_warn, ...).
error_setg_win32(&error_warn, ...) is undesirable just like
error_setg(&error_fatal, ...) and error_setg(&error_abort, ...)  are.
Replace by warn_report().

The failures should probably be errors, but these functions implement
callbacks that cannot fail, exit(1) would be too harsh, and silent
failure we don't want.  Thus, warnings.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250923091000.3180122-7-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 net/slirp.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/net/slirp.c b/net/slirp.c
index 9657e86a84..0a1c2a5eac 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -258,11 +258,13 @@ static void net_slirp_register_poll_sock(slirp_os_socket fd, void *opaque)
 {
 #ifdef WIN32
     AioContext *ctxt = qemu_get_aio_context();
+    g_autofree char *msg = NULL;
 
     if (WSAEventSelect(fd, event_notifier_get_handle(&ctxt->notifier),
                        FD_READ | FD_ACCEPT | FD_CLOSE |
                        FD_CONNECT | FD_WRITE | FD_OOB) != 0) {
-        error_setg_win32(&error_warn, WSAGetLastError(), "failed to WSAEventSelect()");
+        msg = g_win32_error_message(WSAGetLastError());
+        warn_report("failed to WSAEventSelect(): %s", msg);
     }
 #endif
 }
@@ -270,8 +272,11 @@ static void net_slirp_register_poll_sock(slirp_os_socket fd, void *opaque)
 static void net_slirp_unregister_poll_sock(slirp_os_socket fd, void *opaque)
 {
 #ifdef WIN32
+    g_autofree char *msg = NULL;
+
     if (WSAEventSelect(fd, NULL, 0) != 0) {
-        error_setg_win32(&error_warn, WSAGetLastError(), "failed to WSAEventSelect()");
+        msg = g_win32_error_message(WSAGetLastError());
+        warn_report("failed to WSAEventSelect(): %s", msg);
     }
 #endif
 }

From b46b8cf29c56e423b227021f1a5b7aa9b11181b4 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:54 +0200
Subject: [PATCH 0793/2396] ui/spice-core: Clean up error reporting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

watch_add() reports _open_osfhandle() failure with
error_setg(&error_warn, ...).  error_setg_win32(&error_warn, ...) is
undesirable just like error_setg(&error_fatal, ...) and
error_setg(&error_abort, ...) are.  Replace by warn_report().

The failure should probably be an error, but this function implements
a callback that doesn't take Error **.  I believe the failure will
make spice_server_init() fail in qemu_spice_init(), which is treated
as a fatal error.  The warning here provides more detail than the
error message there.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250923091000.3180122-8-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/spice-core.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/ui/spice-core.c b/ui/spice-core.c
index 5992f9daec..7836202664 100644
--- a/ui/spice-core.c
+++ b/ui/spice-core.c
@@ -128,11 +128,13 @@ static void watch_update_mask(SpiceWatch *watch, int event_mask)
 static SpiceWatch *watch_add(int fd, int event_mask, SpiceWatchFunc func, void *opaque)
 {
     SpiceWatch *watch;
-
 #ifdef WIN32
+    g_autofree char *msg = NULL;
+
     fd = _open_osfhandle(fd, _O_BINARY);
     if (fd < 0) {
-        error_setg_win32(&error_warn, WSAGetLastError(), "Couldn't associate a FD with the SOCKET");
+        msg = g_win32_error_message(WSAGetLastError());
+        warn_report("Couldn't associate a FD with the SOCKET: %s", msg);
         return NULL;
     }
 #endif

From 5bd58f04b831f7086f21ae70c90d1a86b6565762 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:55 +0200
Subject: [PATCH 0794/2396] util/oslib-win32: Do not treat null @errp as
 &error_warn
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_socket_select() and its wrapper qemu_socket_unselect() treat a
null @errp as &error_warn.  This is wildly inappropriate.  A caller
passing null @errp specifies that errors are to be ignored.  If
warnings are wanted, the caller must pass &error_warn.

Change callers to do that, and drop the inappropriate treatment of
null @errp.

This assumes that warnings are wanted.  I'm not familiar with the
calling code, so I can't say whether it will work when the socket is
invalid, or WSAEventSelect() fails.  If it doesn't, then this should
be an error instead of a warning.  Invalid socket might even be a
programming error.

These warnings were introduced in commit f5fd677ae7cf (win32/socket:
introduce qemu_socket_select() helper).  I considered reverting to
silence, but Daniel Berrangé asked for the warnings to be preserved.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250923091000.3180122-9-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 io/channel-socket.c | 4 ++--
 io/channel-watch.c  | 2 +-
 util/aio-win32.c    | 2 +-
 util/oslib-win32.c  | 6 +-----
 4 files changed, 5 insertions(+), 9 deletions(-)

diff --git a/io/channel-socket.c b/io/channel-socket.c
index e53d9ac76f..fdc7670867 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -454,7 +454,7 @@ static void qio_channel_socket_finalize(Object *obj)
             }
         }
 #ifdef WIN32
-        qemu_socket_unselect(ioc->fd, NULL);
+        qemu_socket_unselect(ioc->fd, &error_warn);
 #endif
         close(ioc->fd);
         ioc->fd = -1;
@@ -929,7 +929,7 @@ qio_channel_socket_close(QIOChannel *ioc,
 
     if (sioc->fd != -1) {
 #ifdef WIN32
-        qemu_socket_unselect(sioc->fd, NULL);
+        qemu_socket_unselect(sioc->fd, &error_warn);
 #endif
         if (qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_LISTEN)) {
             socket_listen_cleanup(sioc->fd, errp);
diff --git a/io/channel-watch.c b/io/channel-watch.c
index 64b486e378..ec76bd1ec6 100644
--- a/io/channel-watch.c
+++ b/io/channel-watch.c
@@ -283,7 +283,7 @@ GSource *qio_channel_create_socket_watch(QIOChannel *ioc,
 
     qemu_socket_select(sockfd, ioc->event,
                        FD_READ | FD_ACCEPT | FD_CLOSE |
-                       FD_CONNECT | FD_WRITE | FD_OOB, NULL);
+                       FD_CONNECT | FD_WRITE | FD_OOB, &error_warn);
 
     source = g_source_new(&qio_channel_socket_source_funcs,
                           sizeof(QIOChannelSocketSource));
diff --git a/util/aio-win32.c b/util/aio-win32.c
index 6583d5c5f3..b125924433 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -121,7 +121,7 @@ void aio_set_fd_handler(AioContext *ctx,
 
         QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node);
         event = event_notifier_get_handle(&ctx->notifier);
-        qemu_socket_select(fd, event, bitmask, NULL);
+        qemu_socket_select(fd, event, bitmask, &error_warn);
     }
     if (old_node) {
         aio_remove_fd_handler(ctx, old_node);
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index b9ce2f96ee..6a2367c89d 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -182,7 +182,7 @@ bool qemu_set_blocking(int fd, bool block, Error **errp)
     unsigned long opt = block ? 0 : 1;
 
     if (block) {
-        qemu_socket_unselect(fd, NULL);
+        qemu_socket_unselect(fd, &error_warn);
     }
 
     if (ioctlsocket(fd, FIONBIO, &opt) != NO_ERROR) {
@@ -293,10 +293,6 @@ bool qemu_socket_select(int sockfd, WSAEVENT hEventObject,
 {
     SOCKET s = _get_osfhandle(sockfd);
 
-    if (errp == NULL) {
-        errp = &error_warn;
-    }
-
     if (s == INVALID_SOCKET) {
         error_setg(errp, "invalid socket fd=%d", sockfd);
         return false;

From b296b29d341429b82d9a76885f8e7fc3abd85ce2 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:56 +0200
Subject: [PATCH 0795/2396] ui/pixman: Consistent error handling in
 qemu_pixman_shareable_free()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_pixman_shareable_free() wraps around either qemu_memfd_free() or
qemu_win32_map_free().  The former reports trouble as error, with
error_report(), then succeeds.  The latter reports it as warning (we
pass it &error_warn), then succeeds.

Change the latter to report as error, too.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250923091000.3180122-10-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/qemu-pixman.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/ui/qemu-pixman.c b/ui/qemu-pixman.c
index ef4e71da11..e46c6232cf 100644
--- a/ui/qemu-pixman.c
+++ b/ui/qemu-pixman.c
@@ -288,7 +288,10 @@ qemu_pixman_shareable_free(qemu_pixman_shareable handle,
                            void *ptr, size_t size)
 {
 #ifdef WIN32
-    qemu_win32_map_free(ptr, handle, &error_warn);
+    Error *err = NULL;
+
+    qemu_win32_map_free(ptr, handle, &err);
+    error_report_err(err);
 #else
     qemu_memfd_free(ptr, size, handle);
 #endif

From 96ae3f67a222197ae633225ba4543551126dbd95 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:57 +0200
Subject: [PATCH 0796/2396] ui/dbus: Clean up dbus_update_gl_cb() error
 checking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From GLib "Rules for use of GError":

    A GError* must be initialized to NULL before passing its address
    to a function that can report errors.

dbus_update_gl_cb() seemingly violates this rule: it passes &err to
qemu_dbus_display1_listener_call_update_dmabuf_finish() and to
qemu_dbus_display1_listener_win32_d3d11_call_update_texture2d_finish()
without clearing it in between.  Harmless, because the first call is
guarded by #ifdef CONFIG_GBM, the second by #ifdef WIN32, and the two
are mutually exclusive.  I think.

Clean this up to be obviously correct.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250923091000.3180122-11-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/dbus-listener.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 42875b8eed..09d7a319b1 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -221,18 +221,21 @@ static void dbus_update_gl_cb(GObject *source_object,
 #ifdef CONFIG_GBM
     success = qemu_dbus_display1_listener_call_update_dmabuf_finish(
         ddl->proxy, res, &err);
+    if (!success) {
+        error_report("Failed to call update: %s", err->message);
+    }
 #endif
 
 #ifdef WIN32
     success = qemu_dbus_display1_listener_win32_d3d11_call_update_texture2d_finish(
         ddl->d3d11_proxy, res, &err);
-    d3d_texture2d_acquire0(ddl->d3d_texture, &error_warn);
-#endif
-
     if (!success) {
         error_report("Failed to call update: %s", err->message);
     }
 
+    d3d_texture2d_acquire0(ddl->d3d_texture, &error_warn);
+#endif
+
     graphic_hw_gl_block(ddl->dcl.con, false);
     g_object_unref(ddl);
 }

From 59a4c0973aa1709d764d9479a5abd421a9408982 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:03:58 +0400
Subject: [PATCH 0797/2396] build-sys: require -lrt when no shm_open() in std
 libs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fail during configure time if the shm functions are missing, as required
by oslib-posix.c. Note, we could further check the presence of the
function in librt.

This is a minor cleanup/improvement.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250924120426.2158655-2-marcandre.lureau@redhat.com>
---
 meson.build | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/meson.build b/meson.build
index bdfb6214e6..c08e2df6bb 100644
--- a/meson.build
+++ b/meson.build
@@ -1350,7 +1350,13 @@ if get_option('spice') \
 endif
 spice_headers = spice.partial_dependency(compile_args: true, includes: true)
 
-rt = cc.find_library('rt', required: false)
+rt = not_found
+if host_os != 'windows'
+  have_shm_open = cc.has_function('shm_open')
+  if not have_shm_open
+    rt = cc.find_library('rt', required: true)
+  endif
+endif
 
 libiscsi = not_found
 if not get_option('libiscsi').auto() or have_block
@@ -3812,14 +3818,10 @@ util_ss = util_ss.apply({})
 libqemuutil = static_library('qemuutil',
                              build_by_default: false,
                              sources: util_ss.sources() + stub_ss.sources() + genh,
-                             dependencies: [util_ss.dependencies(), libm, threads, glib, socket, malloc])
-qemuutil_deps = [event_loop_base]
-if host_os != 'windows'
-  qemuutil_deps += [rt]
-endif
+                             dependencies: [util_ss.dependencies(), libm, threads, glib, socket, malloc, rt])
 qemuutil = declare_dependency(link_with: libqemuutil,
                               sources: genh + version_res,
-                              dependencies: qemuutil_deps)
+                              dependencies: [event_loop_base])
 
 if have_system or have_user
   decodetree = generator(find_program('scripts/decodetree.py'),

From 932ac9f8eb75c9db58dbf85f7de25c9eabf2261c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:03:59 +0400
Subject: [PATCH 0798/2396] gitlab-ci: fix 'needs' property type must be array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gitlab "Pipeline editor" has some warnings, and gitlab-ci-local
fails.

Read also from the docs

   https://docs.gitlab.com/ci/yaml/#needs

"Supported values:

    An array of jobs (maximum of 50 jobs).
    An empty array ([]), to set the job to start as soon as the pipeline
    is created."

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-3-marcandre.lureau@redhat.com>
---
 .gitlab-ci.d/buildtest.yml     | 56 +++++++++++++++++-----------------
 .gitlab-ci.d/crossbuilds.yml   | 46 ++++++++++++++--------------
 .gitlab-ci.d/static_checks.yml |  6 ++--
 3 files changed, 54 insertions(+), 54 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index e296fc3c14..3be36e5499 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -36,7 +36,7 @@ build-system-ubuntu:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-ubuntu2204-container
+    - job: amd64-ubuntu2204-container
   variables:
     IMAGE: ubuntu2204
     CONFIGURE_ARGS: --enable-docs
@@ -66,7 +66,7 @@ build-system-debian:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-debian-container
+    - job: amd64-debian-container
   variables:
     IMAGE: debian
     CONFIGURE_ARGS: --with-coroutine=sigaltstack --enable-rust
@@ -109,7 +109,7 @@ build-system-fedora:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-fedora-container
+    - job: amd64-fedora-container
   variables:
     IMAGE: fedora
     CONFIGURE_ARGS: --disable-gcrypt --enable-nettle --enable-docs --enable-crypto-afalg --enable-rust
@@ -122,7 +122,7 @@ build-system-fedora-rust-nightly:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-fedora-rust-nightly-container
+    - job: amd64-fedora-rust-nightly-container
   variables:
     IMAGE: fedora-rust-nightly
     CONFIGURE_ARGS: --disable-docs --enable-rust --enable-strict-rust-lints
@@ -167,7 +167,7 @@ build-system-centos:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-centos9-container
+    - job: amd64-centos9-container
   variables:
     IMAGE: centos9
     CONFIGURE_ARGS: --disable-nettle --enable-gcrypt --enable-vfio-user-server
@@ -189,7 +189,7 @@ build-previous-qemu:
       - build-previous/tests/qtest/migration-test
       - build-previous/scripts
   needs:
-    job: amd64-opensuse-leap-container
+    - job: amd64-opensuse-leap-container
   variables:
     IMAGE: opensuse-leap
     TARGETS: x86_64-softmmu aarch64-softmmu
@@ -274,7 +274,7 @@ build-system-opensuse:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-opensuse-leap-container
+    - job: amd64-opensuse-leap-container
   variables:
     IMAGE: opensuse-leap
     TARGETS: s390x-softmmu x86_64-softmmu aarch64-softmmu
@@ -308,7 +308,7 @@ build-system-flaky:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-debian-container
+    - job: amd64-debian-container
   variables:
     IMAGE: debian
     QEMU_JOB_OPTIONAL: 1
@@ -338,7 +338,7 @@ functional-system-flaky:
 build-tcg-disabled:
   extends: .native_build_job_template
   needs:
-    job: amd64-centos9-container
+    - job: amd64-centos9-container
   variables:
     IMAGE: centos9
   script:
@@ -364,7 +364,7 @@ build-tcg-disabled:
 build-user:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-user-cross-container
+    - job: amd64-debian-user-cross-container
   variables:
     IMAGE: debian-all-test-cross
     CONFIGURE_ARGS: --disable-tools --disable-system
@@ -374,7 +374,7 @@ build-user:
 build-user-static:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-user-cross-container
+    - job: amd64-debian-user-cross-container
   variables:
     IMAGE: debian-all-test-cross
     CONFIGURE_ARGS: --disable-tools --disable-system --static
@@ -385,7 +385,7 @@ build-user-static:
 build-legacy:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-legacy-cross-container
+    - job: amd64-debian-legacy-cross-container
   variables:
     IMAGE: debian-legacy-test-cross
     TARGETS: alpha-linux-user alpha-softmmu sh4-linux-user
@@ -395,7 +395,7 @@ build-legacy:
 build-user-hexagon:
   extends: .native_build_job_template
   needs:
-    job: hexagon-cross-container
+    - job: hexagon-cross-container
   variables:
     IMAGE: debian-hexagon-cross
     TARGETS: hexagon-linux-user
@@ -408,7 +408,7 @@ build-user-hexagon:
 build-some-softmmu:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-user-cross-container
+    - job: amd64-debian-user-cross-container
   variables:
     IMAGE: debian-all-test-cross
     CONFIGURE_ARGS: --disable-tools --enable-debug
@@ -419,7 +419,7 @@ build-some-softmmu:
 build-loongarch64:
   extends: .native_build_job_template
   needs:
-    job: loongarch-debian-cross-container
+    - job: loongarch-debian-cross-container
   variables:
     IMAGE: debian-loongarch-cross
     CONFIGURE_ARGS: --disable-tools --enable-debug
@@ -430,7 +430,7 @@ build-loongarch64:
 build-tricore-softmmu:
   extends: .native_build_job_template
   needs:
-    job: tricore-debian-cross-container
+    - job: tricore-debian-cross-container
   variables:
     IMAGE: debian-tricore-cross
     CONFIGURE_ARGS: --disable-tools --disable-fdt --enable-debug
@@ -440,7 +440,7 @@ build-tricore-softmmu:
 clang-system:
   extends: .native_build_job_template
   needs:
-    job: amd64-fedora-container
+    - job: amd64-fedora-container
   variables:
     IMAGE: fedora
     CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-ubsan
@@ -451,7 +451,7 @@ clang-system:
 clang-user:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-user-cross-container
+    - job: amd64-debian-user-cross-container
   timeout: 70m
   variables:
     IMAGE: debian-all-test-cross
@@ -582,7 +582,7 @@ functional-cfi-x86_64:
 tsan-build:
   extends: .native_build_job_template
   needs:
-    job: amd64-ubuntu2204-container
+    - job: amd64-ubuntu2204-container
   variables:
     IMAGE: ubuntu2204
     CONFIGURE_ARGS: --enable-tsan --cc=clang --cxx=clang++
@@ -596,7 +596,7 @@ tsan-build:
 gcov:
   extends: .native_build_job_template
   needs:
-    job: amd64-ubuntu2204-container
+    - job: amd64-ubuntu2204-container
   timeout: 80m
   variables:
     IMAGE: ubuntu2204
@@ -623,7 +623,7 @@ gcov:
 build-oss-fuzz:
   extends: .native_build_job_template
   needs:
-    job: amd64-fedora-container
+    - job: amd64-fedora-container
   variables:
     IMAGE: fedora
   script:
@@ -645,7 +645,7 @@ build-oss-fuzz:
 build-tci:
   extends: .native_build_job_template
   needs:
-    job: amd64-debian-user-cross-container
+    - job: amd64-debian-user-cross-container
   variables:
     IMAGE: debian-all-test-cross
   script:
@@ -670,7 +670,7 @@ build-tci:
 build-without-defaults:
   extends: .native_build_job_template
   needs:
-    job: amd64-centos9-container
+    - job: amd64-centos9-container
   variables:
     IMAGE: centos9
     CONFIGURE_ARGS:
@@ -688,7 +688,7 @@ build-libvhost-user:
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/fedora:$QEMU_CI_CONTAINER_TAG
   needs:
-    job: amd64-fedora-container
+    - job: amd64-fedora-container
   script:
     - mkdir subprojects/libvhost-user/build
     - cd subprojects/libvhost-user/build
@@ -702,9 +702,9 @@ build-tools-and-docs-debian:
     - .native_build_job_template
     - .native_build_artifact_template
   needs:
-    job: amd64-debian-container
-    # when running on 'master' we use pre-existing container
-    optional: true
+    - job: amd64-debian-container
+      # when running on 'master' we use pre-existing container
+      optional: true
   variables:
     IMAGE: debian
     MAKE_CHECK_ARGS: check-unit ctags TAGS cscope
@@ -791,7 +791,7 @@ build-wasm:
   extends: .wasm_build_job_template
   timeout: 2h
   needs:
-    job: wasm-emsdk-cross-container
+    - job: wasm-emsdk-cross-container
   variables:
     IMAGE: emsdk-wasm32-cross
     CONFIGURE_ARGS: --static --disable-tools --enable-debug --enable-tcg-interpreter
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index 3f76c901ba..8ff0c27f74 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -4,28 +4,28 @@ include:
 cross-armhf-user:
   extends: .cross_user_build_job
   needs:
-    job: armhf-debian-cross-container
+    - job: armhf-debian-cross-container
   variables:
     IMAGE: debian-armhf-cross
 
 cross-arm64-system:
   extends: .cross_system_build_job
   needs:
-    job: arm64-debian-cross-container
+    - job: arm64-debian-cross-container
   variables:
     IMAGE: debian-arm64-cross
 
 cross-arm64-user:
   extends: .cross_user_build_job
   needs:
-    job: arm64-debian-cross-container
+    - job: arm64-debian-cross-container
   variables:
     IMAGE: debian-arm64-cross
 
 cross-arm64-kvm-only:
   extends: .cross_accel_build_job
   needs:
-    job: arm64-debian-cross-container
+    - job: arm64-debian-cross-container
   variables:
     IMAGE: debian-arm64-cross
     EXTRA_CONFIGURE_OPTS: --disable-tcg --without-default-features
@@ -35,7 +35,7 @@ cross-i686-system:
     - .cross_system_build_job
     - .cross_test_artifacts
   needs:
-    job: i686-debian-cross-container
+    - job: i686-debian-cross-container
   variables:
     IMAGE: debian-i686-cross
     EXTRA_CONFIGURE_OPTS: --disable-kvm
@@ -46,7 +46,7 @@ cross-i686-user:
     - .cross_user_build_job
     - .cross_test_artifacts
   needs:
-    job: i686-debian-cross-container
+    - job: i686-debian-cross-container
   variables:
     IMAGE: debian-i686-cross
     MAKE_CHECK_ARGS: check
@@ -57,7 +57,7 @@ cross-i686-tci:
     - .cross_test_artifacts
   timeout: 60m
   needs:
-    job: i686-debian-cross-container
+    - job: i686-debian-cross-container
   variables:
     IMAGE: debian-i686-cross
     ACCEL: tcg-interpreter
@@ -71,49 +71,49 @@ cross-i686-tci:
 cross-mipsel-system:
   extends: .cross_system_build_job
   needs:
-    job: mipsel-debian-cross-container
+    - job: mipsel-debian-cross-container
   variables:
     IMAGE: debian-mipsel-cross
 
 cross-mipsel-user:
   extends: .cross_user_build_job
   needs:
-    job: mipsel-debian-cross-container
+    - job: mipsel-debian-cross-container
   variables:
     IMAGE: debian-mipsel-cross
 
 cross-mips64el-system:
   extends: .cross_system_build_job
   needs:
-    job: mips64el-debian-cross-container
+    - job: mips64el-debian-cross-container
   variables:
     IMAGE: debian-mips64el-cross
 
 cross-mips64el-user:
   extends: .cross_user_build_job
   needs:
-    job: mips64el-debian-cross-container
+    - job: mips64el-debian-cross-container
   variables:
     IMAGE: debian-mips64el-cross
 
 cross-ppc64el-system:
   extends: .cross_system_build_job
   needs:
-    job: ppc64el-debian-cross-container
+    - job: ppc64el-debian-cross-container
   variables:
     IMAGE: debian-ppc64el-cross
 
 cross-ppc64el-user:
   extends: .cross_user_build_job
   needs:
-    job: ppc64el-debian-cross-container
+    - job: ppc64el-debian-cross-container
   variables:
     IMAGE: debian-ppc64el-cross
 
 cross-ppc64el-kvm-only:
   extends: .cross_accel_build_job
   needs:
-    job: ppc64el-debian-cross-container
+    - job: ppc64el-debian-cross-container
   variables:
     IMAGE: debian-ppc64el-cross
     EXTRA_CONFIGURE_OPTS: --disable-tcg --without-default-devices
@@ -121,35 +121,35 @@ cross-ppc64el-kvm-only:
 cross-riscv64-system:
   extends: .cross_system_build_job
   needs:
-    job: riscv64-debian-cross-container
+    - job: riscv64-debian-cross-container
   variables:
     IMAGE: debian-riscv64-cross
 
 cross-riscv64-user:
   extends: .cross_user_build_job
   needs:
-    job: riscv64-debian-cross-container
+    - job: riscv64-debian-cross-container
   variables:
     IMAGE: debian-riscv64-cross
 
 cross-s390x-system:
   extends: .cross_system_build_job
   needs:
-    job: s390x-debian-cross-container
+    - job: s390x-debian-cross-container
   variables:
     IMAGE: debian-s390x-cross
 
 cross-s390x-user:
   extends: .cross_user_build_job
   needs:
-    job: s390x-debian-cross-container
+    - job: s390x-debian-cross-container
   variables:
     IMAGE: debian-s390x-cross
 
 cross-s390x-kvm-only:
   extends: .cross_accel_build_job
   needs:
-    job: s390x-debian-cross-container
+    - job: s390x-debian-cross-container
   variables:
     IMAGE: debian-s390x-cross
     EXTRA_CONFIGURE_OPTS: --disable-tcg --enable-trace-backends=ftrace
@@ -157,7 +157,7 @@ cross-s390x-kvm-only:
 cross-mips64el-kvm-only:
   extends: .cross_accel_build_job
   needs:
-    job: mips64el-debian-cross-container
+    - job: mips64el-debian-cross-container
   variables:
     IMAGE: debian-mips64el-cross
     EXTRA_CONFIGURE_OPTS: --disable-tcg --target-list=mips64el-softmmu
@@ -165,7 +165,7 @@ cross-mips64el-kvm-only:
 cross-win64-system:
   extends: .cross_system_build_job
   needs:
-    job: win64-fedora-cross-container
+    - job: win64-fedora-cross-container
   variables:
     IMAGE: fedora-win64-cross
     EXTRA_CONFIGURE_OPTS: --enable-fdt=internal --disable-plugins
@@ -181,7 +181,7 @@ cross-win64-system:
 cross-amd64-xen-only:
   extends: .cross_accel_build_job
   needs:
-    job: amd64-debian-cross-container
+    - job: amd64-debian-cross-container
   variables:
     IMAGE: debian-amd64-cross
     ACCEL: xen
@@ -190,7 +190,7 @@ cross-amd64-xen-only:
 cross-arm64-xen-only:
   extends: .cross_accel_build_job
   needs:
-    job: arm64-debian-cross-container
+    - job: arm64-debian-cross-container
   variables:
     IMAGE: debian-arm64-cross
     ACCEL: xen
diff --git a/.gitlab-ci.d/static_checks.yml b/.gitlab-ci.d/static_checks.yml
index c3ed6de453..61fe2fa39a 100644
--- a/.gitlab-ci.d/static_checks.yml
+++ b/.gitlab-ci.d/static_checks.yml
@@ -32,7 +32,7 @@ check-python-minreqs:
   variables:
     GIT_DEPTH: 1
   needs:
-    job: python-container
+    - job: python-container
 
 check-python-tox:
   extends: .base_job_template
@@ -45,7 +45,7 @@ check-python-tox:
     QEMU_TOX_EXTRA_ARGS: --skip-missing-interpreters=false
     QEMU_JOB_OPTIONAL: 1
   needs:
-    job: python-container
+    - job: python-container
 
 check-rust-tools-nightly:
   extends: .base_job_template
@@ -76,7 +76,7 @@ check-build-units:
   stage: build
   image: $CI_REGISTRY_IMAGE/qemu/debian:$QEMU_CI_CONTAINER_TAG
   needs:
-    job: amd64-debian-container
+    - job: amd64-debian-container
   before_script:
     - source scripts/ci/gitlab-ci-section
     - section_start setup "Install Tools"

From bf3706d2c3433bc14431d260a66210c58201d8ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:00 +0400
Subject: [PATCH 0799/2396] scripts/archive-source: speed up downloading
 subprojects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running meson on each subproject is quite slow.

According to Paolo, meson will run download tasks in parallel.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250924120426.2158655-4-marcandre.lureau@redhat.com>
---
 scripts/archive-source.sh | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index 476a996a70..34ea86b6d3 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -77,9 +77,10 @@ function subproject_dir() {
 git archive --format tar "$(tree_ish)" > "$tar_file"
 test $? -ne 0 && error "failed to archive qemu"
 
+meson subprojects download $subprojects
+test $? -ne 0 && error "failed to download subprojects $subprojects"
+
 for sp in $subprojects; do
-    meson subprojects download $sp
-    test $? -ne 0 && error "failed to download subproject $sp"
     tar --append --file "$tar_file" --exclude=.git subprojects/"$(subproject_dir $sp)"
     test $? -ne 0 && error "failed to append subproject $sp to $tar_file"
 done

From 027d05c5c41dd5ac822e60e245aff30bc4f2fa69 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:01 +0400
Subject: [PATCH 0800/2396] scripts/archive-source: silence subprojects
 downloads
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's too verbose.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250924120426.2158655-5-marcandre.lureau@redhat.com>
---
 scripts/archive-source.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index 34ea86b6d3..b86e632161 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -77,7 +77,7 @@ function subproject_dir() {
 git archive --format tar "$(tree_ish)" > "$tar_file"
 test $? -ne 0 && error "failed to archive qemu"
 
-meson subprojects download $subprojects
+meson subprojects download $subprojects >/dev/null
 test $? -ne 0 && error "failed to download subprojects $subprojects"
 
 for sp in $subprojects; do

From 51a6211908c898a9994d9323b5937fec70605e60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:02 +0400
Subject: [PATCH 0801/2396] scripts/archive-source: use a bash array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250924120426.2158655-6-marcandre.lureau@redhat.com>
---
 scripts/archive-source.sh | 31 +++++++++++++++++++++++--------
 1 file changed, 23 insertions(+), 8 deletions(-)

diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index b86e632161..a725dd923d 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -26,12 +26,27 @@ sub_file="${sub_tdir}/submodule.tar"
 # independent of what the developer currently has initialized
 # in their checkout, because the build environment is completely
 # different to the host OS.
-subprojects="keycodemapdb libvfio-user berkeley-softfloat-3
-  berkeley-testfloat-3 anyhow-1-rs arbitrary-int-1-rs attrs-0.2-rs bilge-0.2-rs
-  bilge-impl-0.2-rs either-1-rs foreign-0.3-rs itertools-0.11-rs
-  libc-0.2-rs proc-macro2-1-rs
-  proc-macro-error-1-rs proc-macro-error-attr-1-rs quote-1-rs
-  syn-2-rs unicode-ident-1-rs"
+subprojects=(
+  anyhow-1-rs
+  arbitrary-int-1-rs
+  attrs-0.2-rs
+  berkeley-softfloat-3
+  berkeley-testfloat-3
+  bilge-0.2-rs
+  bilge-impl-0.2-rs
+  either-1-rs
+  foreign-0.3-rs
+  itertools-0.11-rs
+  keycodemapdb
+  libc-0.2-rs
+  libvfio-user
+  proc-macro-error-1-rs
+  proc-macro-error-attr-1-rs
+  proc-macro2-1-rs
+  quote-1-rs
+  syn-2-rs
+  unicode-ident-1-rs
+)
 sub_deinit=""
 
 function cleanup() {
@@ -77,10 +92,10 @@ function subproject_dir() {
 git archive --format tar "$(tree_ish)" > "$tar_file"
 test $? -ne 0 && error "failed to archive qemu"
 
-meson subprojects download $subprojects >/dev/null
+meson subprojects download ${subprojects[@]} >/dev/null
 test $? -ne 0 && error "failed to download subprojects $subprojects"
 
-for sp in $subprojects; do
+for sp in "${subprojects[@]}"; do
     tar --append --file "$tar_file" --exclude=.git subprojects/"$(subproject_dir $sp)"
     test $? -ne 0 && error "failed to append subproject $sp to $tar_file"
 done

From c102f036bf601434de7d83f861bb74b5d2efc6da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:03 +0400
Subject: [PATCH 0802/2396] configure: fix rust meson configuration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was incorrectly set on the [host_machine] and caused error:
File "/tmp/qemu-test/build/pyvenv/lib/python3.11/site-packages/mesonbuild/envconfig.py", line 281, in from_literal
    assert all(isinstance(v, str) for v in raw.values()), 'for mypy'
AssertionError: for mypy

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-7-marcandre.lureau@redhat.com>
---
 configure | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/configure b/configure
index 0f7eb95586..66613f3f4c 100755
--- a/configure
+++ b/configure
@@ -1958,7 +1958,7 @@ if test "$skip_meson" = no; then
     echo "[binaries]" >> $native
     echo "c = [$(meson_quote $host_cc)]" >> $native
     if test "$rust" != disabled; then
-      echo "rust = [$(meson_quote $rustc)]" >> $cross
+      echo "rust = [$(meson_quote $rustc)]" >> $native
     fi
     mv $native config-meson.native
     meson_option_add --native-file

From 0d4fb8f746d7ff215146dbd96efbe9cc87cb98ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:04 +0400
Subject: [PATCH 0803/2396] configure: set the bindgen cross target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement a bash version of rust-bindgen rust_to_clang_target() to
convert from rust target to clang target.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250924120426.2158655-8-marcandre.lureau@redhat.com>
---
 configure                            |  7 ++++
 scripts/rust-to-clang-target-test.sh | 43 ++++++++++++++++++++
 scripts/rust-to-clang-target.sh      | 60 ++++++++++++++++++++++++++++
 tests/lcitool/libvirt-ci             |  2 +-
 4 files changed, 111 insertions(+), 1 deletion(-)
 create mode 100755 scripts/rust-to-clang-target-test.sh
 create mode 100644 scripts/rust-to-clang-target.sh

diff --git a/configure b/configure
index 66613f3f4c..bf964947b8 100755
--- a/configure
+++ b/configure
@@ -1878,6 +1878,13 @@ if test "$skip_meson" = no; then
       eval "c=\$devices_${a}"
       echo "${a}-softmmu = '$c'" >> $cross
   done
+  if test "$rust" != disabled; then
+      if test "$cross_compile" = "yes"; then
+          . "$source_path/scripts/rust-to-clang-target.sh"
+          clang_target=$(rust_to_clang_target "$rust_target_triple")
+          echo "bindgen_clang_arguments = [$(meson_quote --target="$clang_target")]" >> $cross
+      fi
+  fi
 
   echo "[built-in options]" >> $cross
   echo "c_args = [$(meson_quote $CFLAGS $EXTRA_CFLAGS)]" >> $cross
diff --git a/scripts/rust-to-clang-target-test.sh b/scripts/rust-to-clang-target-test.sh
new file mode 100755
index 0000000000..ff6f8fcdc5
--- /dev/null
+++ b/scripts/rust-to-clang-target-test.sh
@@ -0,0 +1,43 @@
+#!/usr/bin/env sh
+#
+# Copyright (C) 2025 Red Hat, Inc.
+#
+# Based on rust_to_clang_target() tests from rust-bindgen.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+scripts_dir=$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)
+. "$scripts_dir/rust-to-clang-target.sh"
+
+test_case() {
+    input="$1"
+    expected="$2"
+    result=$(rust_to_clang_target "$input")
+
+    if [ "$result" = "$expected" ]; then
+        echo " OK: '$input' -> '$result'"
+    else
+        echo " FAILED: '$input'"
+        echo "  Expected: '$expected'"
+        echo "  Got:      '$result'"
+        exit 1
+    fi
+}
+
+echo "Running tests..."
+
+test_case "aarch64-apple-ios" "arm64-apple-ios"
+test_case "riscv64gc-unknown-linux-gnu" "riscv64-unknown-linux-gnu"
+test_case "riscv64imac-unknown-none-elf" "riscv64-unknown-none-elf"
+test_case "riscv32imc-unknown-none-elf" "riscv32-unknown-none-elf"
+test_case "riscv32imac-unknown-none-elf" "riscv32-unknown-none-elf"
+test_case "riscv32imafc-unknown-none-elf" "riscv32-unknown-none-elf"
+test_case "riscv32i-unknown-none-elf" "riscv32-unknown-none-elf"
+test_case "riscv32imc-esp-espidf" "riscv32-esp-elf"
+test_case "xtensa-esp32-espidf" "xtensa-esp32-elf"
+test_case "aarch64-apple-ios-sim" "arm64-apple-ios-simulator"
+test_case "aarch64-apple-tvos-sim" "arm64-apple-tvos-simulator"
+test_case "aarch64-apple-watchos-sim" "arm64-apple-watchos-simulator"
+
+echo ""
+echo "All tests passed!"
diff --git a/scripts/rust-to-clang-target.sh b/scripts/rust-to-clang-target.sh
new file mode 100644
index 0000000000..72db7e1300
--- /dev/null
+++ b/scripts/rust-to-clang-target.sh
@@ -0,0 +1,60 @@
+# Copyright (C) 2025 Red Hat, Inc.
+#
+# Based on rust_to_clang_target() from rust-bindgen.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+rust_to_clang_target() {
+    rust_target="$1"
+
+    # Split the string by hyphens
+    triple_parts=""
+    old_IFS="$IFS"
+    IFS='-'
+    for part in $rust_target; do
+        triple_parts="$triple_parts $part"
+    done
+    IFS="$old_IFS"
+    set -- $triple_parts
+
+    # RISC-V
+    case "$1" in
+        riscv32*)
+            set -- "riscv32" "${2}" "${3}" "${4}"
+            ;;
+        riscv64*)
+            set -- "riscv64" "${2}" "${3}" "${4}"
+            ;;
+    esac
+
+    # Apple
+    if [ "$2" = "apple" ]; then
+        if [ "$1" = "aarch64" ]; then
+            set -- "arm64" "${2}" "${3}" "${4}"
+        fi
+        if [ "$4" = "sim" ]; then
+            set -- "${1}" "${2}" "${3}" "simulator"
+        fi
+    fi
+
+    # ESP-IDF
+    if [ "$3" = "espidf" ]; then
+        set -- "${1}" "${2}" "elf" "${4}"
+    fi
+
+    # Reassemble the string
+    new_triple=""
+    first=1
+    for part in "$@"; do
+        if [ -n "$part" ]; then
+            if [ "$first" -eq 1 ]; then
+                new_triple="$part"
+                first=0
+            else
+                new_triple="$new_triple-$part"
+            fi
+        fi
+    done
+
+    echo "$new_triple"
+}
diff --git a/tests/lcitool/libvirt-ci b/tests/lcitool/libvirt-ci
index 18c4bfe02c..9da20ff7c3 160000
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@@ -1 +1 @@
-Subproject commit 18c4bfe02c467e5639bf9a687139735ccd7a3fff
+Subproject commit 9da20ff7c3bc9067804a7561c2ff87583b434853

From cb29fda6c9a5bf7bf945e53b05f53c2c90542f9d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:05 +0400
Subject: [PATCH 0804/2396] tests/docker/common: print errors to stderr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-9-marcandre.lureau@redhat.com>
---
 tests/docker/common.rc | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index a611e6adf9..2ed2365a61 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -50,7 +50,7 @@ configure_qemu()
     echo "Configure options:"
     echo $config_opts
     $QEMU_SRC/configure $config_opts || \
-        { cat config.log && test_fail "Failed to run 'configure'"; }
+        { cat config.log >&2 && test_fail "Failed to run 'configure'"; }
 }
 
 build_qemu()
@@ -73,7 +73,7 @@ check_qemu()
 
 test_fail()
 {
-    echo "$@"
+    echo "$@" >&2
     exit 1
 }
 

From 1e752fcc979c1a2ced73967956ddbac178540cf6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:06 +0400
Subject: [PATCH 0805/2396] tests/docker: use fully qualified image name for
 emsdk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without it, at least it fails with podman on fc42:

[1/6] STEP 1/15: FROM emscripten/emsdk:3.1.50 AS build-base
Error: creating build container: short-name resolution enforced but cannot prompt without a TTY

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Message-ID: <20250924120426.2158655-10-marcandre.lureau@redhat.com>
---
 tests/docker/dockerfiles/emsdk-wasm32-cross.docker | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/docker/dockerfiles/emsdk-wasm32-cross.docker b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
index 60a7d02f56..6b1642a207 100644
--- a/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
+++ b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
@@ -8,7 +8,7 @@ ARG PIXMAN_VERSION=0.44.2
 ARG FFI_VERSION=v3.4.7
 ARG MESON_VERSION=1.5.0
 
-FROM emscripten/emsdk:$EMSDK_VERSION_QEMU AS build-base
+FROM docker.io/emscripten/emsdk:$EMSDK_VERSION_QEMU AS build-base
 ARG MESON_VERSION
 ENV TARGET=/builddeps/target
 ENV CPATH="$TARGET/include"

From 59352b789a48cd8f2f946a2e86c50230b66099b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:07 +0400
Subject: [PATCH 0806/2396] tests/docker/common: print meson log on configure
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-11-marcandre.lureau@redhat.com>
---
 tests/docker/common.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index 2ed2365a61..d202c0c666 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -50,7 +50,7 @@ configure_qemu()
     echo "Configure options:"
     echo $config_opts
     $QEMU_SRC/configure $config_opts || \
-        { cat config.log >&2 && test_fail "Failed to run 'configure'"; }
+        { cat config.log >&2 ; cat meson-logs/meson-log.txt >&2 ; test_fail "Failed to run 'configure'"; }
 }
 
 build_qemu()

From c3ff31fa2b441272f85c8c4a190ec2c31d282d10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:08 +0400
Subject: [PATCH 0807/2396] build-sys: cfi_debug and safe_stack are not
 compatible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It fails to link on fedora >= 41:
/usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memcpy':
(.text.__sanitizer_internal_memcpy+0x0): multiple definition of `__sanitizer_internal_memcpy'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memcpy+0x0): first defined here
/usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memmove':
(.text.__sanitizer_internal_memmove+0x0): multiple definition of `__sanitizer_internal_memmove'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memmove+0x0): first defined here
/usr/bin/ld: /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.safestack.a(safestack.cpp.o): in function `__sanitizer_internal_memset':
(.text.__sanitizer_internal_memset+0x0): multiple definition of `__sanitizer_internal_memset'; /usr/bin/../lib/clang/20/lib/x86_64-redhat-linux-gnu/libclang_rt.ubsan_standalone.a(sanitizer_libc.cpp.o):(.text.__sanitizer_internal_memset+0x0): first defined here

cfi_debug seems to pull ubsan which has conflicting symbols with safe_stack.

See also: https://bugzilla.redhat.com/show_bug.cgi?id=2397265

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-12-marcandre.lureau@redhat.com>
---
 .gitlab-ci.d/buildtest.yml | 6 +++---
 meson.build                | 3 +++
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 3be36e5499..0502094b9a 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -479,7 +479,7 @@ build-cfi-aarch64:
     LD_JOBS: 1
     AR: llvm-ar
     IMAGE: fedora
-    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
+    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
       --enable-safe-stack --disable-slirp
     TARGETS: aarch64-softmmu
     MAKE_CHECK_ARGS: check-build
@@ -517,7 +517,7 @@ build-cfi-ppc64-s390x:
     LD_JOBS: 1
     AR: llvm-ar
     IMAGE: fedora
-    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
+    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
       --enable-safe-stack --disable-slirp
     TARGETS: ppc64-softmmu s390x-softmmu
     MAKE_CHECK_ARGS: check-build
@@ -555,7 +555,7 @@ build-cfi-x86_64:
     LD_JOBS: 1
     AR: llvm-ar
     IMAGE: fedora
-    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi --enable-cfi-debug
+    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-cfi
       --enable-safe-stack --disable-slirp
     TARGETS: x86_64-softmmu
     MAKE_CHECK_ARGS: check-build
diff --git a/meson.build b/meson.build
index c08e2df6bb..14e626aa1e 100644
--- a/meson.build
+++ b/meson.build
@@ -681,6 +681,9 @@ if get_option('cfi')
     error('-fsanitize-cfi-icall-generalize-pointers is not supported by the compiler')
   endif
   if get_option('cfi_debug')
+    if get_option('safe_stack')
+      error('cfi_debug is not compatible with safe_stack')
+    endif
     if cc.compiles('int main () { return 0; }',
                    name: '-fno-sanitize-trap=cfi-icall',
                    args: ['-flto', '-fsanitize=cfi-icall',

From a679aa8e434cafceea95de11cb893ed598d0de03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:09 +0400
Subject: [PATCH 0808/2396] lcitool: update, switch to f41
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Newer lcitool version has various fixes helping QEMU CI and this series.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-13-marcandre.lureau@redhat.com>
---
 scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml   |  3 ++-
 scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml     |  3 ++-
 tests/docker/dockerfiles/alpine.docker             |  2 +-
 tests/docker/dockerfiles/debian-amd64-cross.docker |  5 ++++-
 tests/docker/dockerfiles/debian-arm64-cross.docker |  5 ++++-
 tests/docker/dockerfiles/debian-armhf-cross.docker |  5 ++++-
 tests/docker/dockerfiles/debian-i686-cross.docker  |  5 ++++-
 .../dockerfiles/debian-mips64el-cross.docker       |  5 ++++-
 .../docker/dockerfiles/debian-mipsel-cross.docker  |  5 ++++-
 .../docker/dockerfiles/debian-ppc64el-cross.docker |  5 ++++-
 .../docker/dockerfiles/debian-riscv64-cross.docker |  8 ++++++--
 tests/docker/dockerfiles/debian-s390x-cross.docker |  5 ++++-
 tests/docker/dockerfiles/debian.docker             |  5 ++++-
 .../docker/dockerfiles/fedora-rust-nightly.docker  | 14 ++++++++------
 tests/docker/dockerfiles/fedora-win64-cross.docker | 11 +++++++----
 tests/docker/dockerfiles/fedora.docker             | 14 ++++++++------
 tests/docker/dockerfiles/opensuse-leap.docker      |  4 ++--
 tests/docker/dockerfiles/ubuntu2204.docker         |  5 ++++-
 tests/lcitool/projects/qemu.yml                    |  1 -
 tests/lcitool/refresh                              |  6 +++---
 20 files changed, 79 insertions(+), 37 deletions(-)

diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
index f11e980826..bbcb5dd4ac 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
@@ -95,7 +95,6 @@ packages:
   - llvm
   - locales
   - make
-  - meson
   - mtools
   - multipath-tools
   - ncat
@@ -108,10 +107,12 @@ packages:
   - python3-opencv
   - python3-pillow
   - python3-pip
+  - python3-setuptools
   - python3-sphinx
   - python3-sphinx-rtd-theme
   - python3-tomli
   - python3-venv
+  - python3-wheel
   - python3-yaml
   - rpm2cpio
   - rustc-1.77
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
index 6559cb2934..00eb1b0f91 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
@@ -93,7 +93,6 @@ packages:
   - llvm
   - locales
   - make
-  - meson
   - mtools
   - multipath-tools
   - ncat
@@ -106,10 +105,12 @@ packages:
   - python3-opencv
   - python3-pillow
   - python3-pip
+  - python3-setuptools
   - python3-sphinx
   - python3-sphinx-rtd-theme
   - python3-tomli
   - python3-venv
+  - python3-wheel
   - python3-yaml
   - rpm2cpio
   - rustc-1.77
diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index bf3bd5a30d..bd1ef5505d 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -78,7 +78,7 @@ RUN apk update && \
         nmap-ncat \
         numactl-dev \
         openssh-client \
-        pcre-dev \
+        pcre2-dev \
         pipewire-dev \
         pixman-dev \
         pkgconf \
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 081f3e00f7..bba6de4e2d 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 91c555a36e..8bbcd75157 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index f0e2efcda0..455b84424c 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 025beb1ce2..8b8993ffe4 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 4a941dd870..c89cb6c680 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 4d3e5d711b..4e10d9501f 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 22b4457ba9..cf61cb7f4a 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index b0386cd3a1..79ec37616d 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -4,7 +4,7 @@
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:trixie-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -23,11 +23,13 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libglib2.0-dev \
                       locales \
                       make \
-                      meson \
                       ninja-build \
                       pkgconf \
                       python3 \
+                      python3-pip \
+                      python3-setuptools \
                       python3-venv \
+                      python3-wheel \
                       sed \
                       tar && \
     eatmydata apt-get autoremove -y && \
@@ -36,6 +38,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 13ec52c8ad..1782e0e90f 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -34,7 +34,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       ncat \
                       ninja-build \
@@ -45,9 +44,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -67,6 +68,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg-reconfigure locales && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index 0a57c1a1d3..62f89e4d8c 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -104,7 +104,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       multipath-tools \
                       ncat \
@@ -117,9 +116,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-web \
@@ -146,6 +147,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index 4a033309b3..fd71dd8790 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all fedora-40 qemu
+#  $ lcitool dockerfile --layers all fedora-41 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:40
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -91,7 +91,6 @@ exec "$@"\n' > /usr/bin/nosync && \
                lzo-devel \
                make \
                mesa-libgbm-devel \
-               meson \
                mtools \
                ncurses-devel \
                nettle-devel \
@@ -100,7 +99,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                numactl-devel \
                openssh-clients \
                pam-devel \
-               pcre-static \
+               pcre2-static \
                pipewire-devel \
                pixman-devel \
                pkgconfig \
@@ -111,9 +110,10 @@ exec "$@"\n' > /usr/bin/nosync && \
                python3-opencv \
                python3-pillow \
                python3-pip \
+               python3-setuptools \
                python3-sphinx \
                python3-sphinx_rtd_theme \
-               python3-zombie-imp \
+               python3-wheel \
                rdma-core-devel \
                rust \
                sed \
@@ -124,7 +124,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                spice-server-devel \
                swtpm \
                systemd-devel \
-               systemtap-sdt-devel \
+               systemtap-sdt-dtrace \
                tar \
                tesseract \
                tesseract-langpack-eng \
@@ -148,6 +148,8 @@ exec "$@"\n' > /usr/bin/nosync && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index a950344402..ed7d270984 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch mingw64 fedora-40 qemu,qemu-win-installer
+#  $ lcitool dockerfile --layers all --cross-arch mingw64 fedora-41 qemu,qemu-win-installer
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:40
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -38,7 +38,6 @@ exec "$@"\n' > /usr/bin/nosync && \
                hostname \
                llvm \
                make \
-               meson \
                mtools \
                ninja-build \
                nmap-ncat \
@@ -49,9 +48,10 @@ exec "$@"\n' > /usr/bin/nosync && \
                python3-opencv \
                python3-pillow \
                python3-pip \
+               python3-setuptools \
                python3-sphinx \
                python3-sphinx_rtd_theme \
-               python3-zombie-imp \
+               python3-wheel \
                rust \
                sed \
                socat \
@@ -69,6 +69,8 @@ exec "$@"\n' > /usr/bin/nosync && \
     nosync dnf clean all -y && \
     rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
@@ -90,6 +92,7 @@ RUN nosync dnf install -y \
                mingw64-gtk-vnc2 \
                mingw64-gtk3 \
                mingw64-libepoxy \
+               mingw64-libfdt \
                mingw64-libgcrypt \
                mingw64-libjpeg-turbo \
                mingw64-libpng \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 014e3ccf17..e367c53c09 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all fedora-40 qemu
+#  $ lcitool dockerfile --layers all fedora-41 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM registry.fedoraproject.org/fedora:40
+FROM registry.fedoraproject.org/fedora:41
 
 RUN dnf install -y nosync && \
     printf '#!/bin/sh\n\
@@ -91,7 +91,6 @@ exec "$@"\n' > /usr/bin/nosync && \
                lzo-devel \
                make \
                mesa-libgbm-devel \
-               meson \
                mtools \
                ncurses-devel \
                nettle-devel \
@@ -100,7 +99,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                numactl-devel \
                openssh-clients \
                pam-devel \
-               pcre-static \
+               pcre2-static \
                pipewire-devel \
                pixman-devel \
                pkgconfig \
@@ -111,9 +110,10 @@ exec "$@"\n' > /usr/bin/nosync && \
                python3-opencv \
                python3-pillow \
                python3-pip \
+               python3-setuptools \
                python3-sphinx \
                python3-sphinx_rtd_theme \
-               python3-zombie-imp \
+               python3-wheel \
                rdma-core-devel \
                rust \
                sed \
@@ -124,7 +124,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                spice-server-devel \
                swtpm \
                systemd-devel \
-               systemtap-sdt-devel \
+               systemtap-sdt-dtrace \
                tar \
                tesseract \
                tesseract-langpack-eng \
@@ -148,6 +148,8 @@ exec "$@"\n' > /usr/bin/nosync && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index e90225dc23..60763857bb 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -89,7 +89,7 @@ RUN zypper update -y && \
            ninja \
            openssh \
            pam-devel \
-           pcre-devel-static \
+           pcre2-devel-static \
            pipewire-devel \
            pkgconfig \
            python311 \
@@ -132,7 +132,7 @@ RUN zypper update -y && \
 
 RUN /usr/bin/pip3.11 install \
                      PyYAML \
-                     meson==1.5.0 \
+                     meson==1.8.1 \
                      pillow \
                      sphinx \
                      sphinx-rtd-theme
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 28a6f93243..ea67c7602a 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -102,7 +102,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       llvm \
                       locales \
                       make \
-                      meson \
                       mtools \
                       multipath-tools \
                       ncat \
@@ -115,10 +114,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-opencv \
                       python3-pillow \
                       python3-pip \
+                      python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
                       python3-tomli \
                       python3-venv \
+                      python3-wheel \
                       python3-yaml \
                       rpm2cpio \
                       rustc-1.77 \
@@ -145,6 +146,8 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
+RUN /usr/bin/pip3 install meson==1.8.1
+
 ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
 ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index c07242f272..f22fc46fdc 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -91,7 +91,6 @@ packages:
  - pkg-config
  - pulseaudio
  - python3
- - python3-imp
  - python3-numpy
  - python3-opencv
  - python3-pillow
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index d3488b2679..f49eb638f8 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -171,7 +171,7 @@ try:
     generate_dockerfile("centos9", "centos-stream-9")
     generate_dockerfile("debian", "debian-12",
                         trailer="".join(debian12_extras))
-    generate_dockerfile("fedora", "fedora-40")
+    generate_dockerfile("fedora", "fedora-41")
     generate_dockerfile("opensuse-leap", "opensuse-leap-15")
     generate_dockerfile("ubuntu2204", "ubuntu-2204",
                         trailer="".join(ubuntu2204_rust_extras))
@@ -179,7 +179,7 @@ try:
     #
     # Non-fatal Rust-enabled build
     #
-    generate_dockerfile("fedora-rust-nightly", "fedora-40",
+    generate_dockerfile("fedora-rust-nightly", "fedora-41",
                         trailer="".join(fedora_rustup_nightly_extras))
 
     #
@@ -237,7 +237,7 @@ try:
                         trailer=cross_build("s390x-linux-gnu-",
                                             "s390x-softmmu,s390x-linux-user"))
 
-    generate_dockerfile("fedora-win64-cross", "fedora-40",
+    generate_dockerfile("fedora-win64-cross", "fedora-41",
                         project='qemu,qemu-win-installer',
                         cross="mingw64",
                         trailer=cross_build("x86_64-w64-mingw32-",

From 4ef07afe8e02664a0596b22ad17fbca58c01519c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:10 +0400
Subject: [PATCH 0809/2396] lcitool/qemu: include libclang-rt for TSAN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-14-marcandre.lureau@redhat.com>
---
 scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml      | 1 +
 scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml        | 1 +
 tests/docker/dockerfiles/centos9.docker               | 1 +
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-i686-cross.docker     | 1 +
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 1 +
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 1 +
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 1 +
 tests/docker/dockerfiles/debian.docker                | 1 +
 tests/docker/dockerfiles/fedora-rust-nightly.docker   | 1 +
 tests/docker/dockerfiles/fedora-win64-cross.docker    | 1 +
 tests/docker/dockerfiles/fedora.docker                | 1 +
 tests/docker/dockerfiles/opensuse-leap.docker         | 1 +
 tests/docker/dockerfiles/ubuntu2204.docker            | 1 +
 tests/lcitool/projects/qemu.yml                       | 1 +
 18 files changed, 18 insertions(+)

diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
index bbcb5dd4ac..f446217f2c 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
@@ -36,6 +36,7 @@ packages:
   - libcap-ng-dev
   - libcapstone-dev
   - libcbor-dev
+  - libclang-dev
   - libcmocka-dev
   - libcurl4-gnutls-dev
   - libdaxctl-dev
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
index 00eb1b0f91..25c3368c54 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
@@ -36,6 +36,7 @@ packages:
   - libcap-ng-dev
   - libcapstone-dev
   - libcbor-dev
+  - libclang-dev
   - libcmocka-dev
   - libcurl4-gnutls-dev
   - libdaxctl-dev
diff --git a/tests/docker/dockerfiles/centos9.docker b/tests/docker/dockerfiles/centos9.docker
index a942835a1d..33c62033ce 100644
--- a/tests/docker/dockerfiles/centos9.docker
+++ b/tests/docker/dockerfiles/centos9.docker
@@ -25,6 +25,7 @@ RUN dnf distro-sync -y && \
         capstone-devel \
         ccache \
         clang \
+        compiler-rt \
         ctags \
         cyrus-sasl-devel \
         daxctl-devel \
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index bba6de4e2d..d4d3cebfdc 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 8bbcd75157..cd9c9a0def 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 455b84424c..21a5bbc81d 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 8b8993ffe4..c41a4805fe 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index c89cb6c680..77d5d43f4b 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 4e10d9501f..9e60fe0eb4 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index cf61cb7f4a..dc683bd498 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 1782e0e90f..ef6e961460 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -30,6 +30,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       gettext \
                       git \
                       hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
                       llvm \
                       locales \
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index 62f89e4d8c..ef9ba62f2a 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -43,6 +43,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libcap-ng-dev \
                       libcapstone-dev \
                       libcbor-dev \
+                      libclang-rt-dev \
                       libcmocka-dev \
                       libcurl4-gnutls-dev \
                       libdaxctl-dev \
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index fd71dd8790..bdbcebda8d 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -32,6 +32,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                capstone-devel \
                ccache \
                clang \
+               compiler-rt \
                ctags \
                cyrus-sasl-devel \
                daxctl-devel \
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index ed7d270984..3c54486d2f 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -25,6 +25,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                bzip2 \
                ca-certificates \
                ccache \
+               compiler-rt \
                ctags \
                dbus-daemon \
                diffutils \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index e367c53c09..f758efd2b7 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -32,6 +32,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                capstone-devel \
                ccache \
                clang \
+               compiler-rt \
                ctags \
                cyrus-sasl-devel \
                daxctl-devel \
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index 60763857bb..d71dbc30c7 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -19,6 +19,7 @@ RUN zypper update -y && \
            ca-certificates \
            ccache \
            clang \
+           clang-devel \
            ctags \
            cyrus-sasl-devel \
            dbus-1 \
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index ea67c7602a..146ad7fce2 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -42,6 +42,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libcap-ng-dev \
                       libcapstone-dev \
                       libcbor-dev \
+                      libclang-dev \
                       libcmocka-dev \
                       libcurl4-gnutls-dev \
                       libdaxctl-dev \
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index f22fc46fdc..301d0e1ea0 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -44,6 +44,7 @@ packages:
  - libcacard
  - libcap-ng
  - libcbor
+ - libclang-rt
  - libcurl
  - libdrm
  - libepoxy

From 2e6d3417aaa4d34dca72b25d86c07098f03ca0b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:11 +0400
Subject: [PATCH 0810/2396] lcitool/alpine: workaround bindgen issue
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-15-marcandre.lureau@redhat.com>
---
 tests/docker/dockerfiles/alpine.docker | 2 ++
 tests/lcitool/refresh                  | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index bd1ef5505d..b50fbc3dba 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -131,6 +131,8 @@ ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
+# https://gitlab.alpinelinux.org/alpine/aports/-/issues/17463
+RUN apk add clang19-libclang
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index f49eb638f8..6f98a91277 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -97,6 +97,11 @@ def generate_yaml(os, target, arch, trailer=None):
     generate(filename, cmd, trailer)
 
 
+alpine_extras = [
+    "# https://gitlab.alpinelinux.org/alpine/aports/-/issues/17463\n",
+    "RUN apk add clang19-libclang\n",
+]
+
 # Netmap still needs to be manually built as it is yet to be packaged
 # into a distro. We also add cscope and gtags which are used in the CI
 # test
@@ -167,7 +172,8 @@ try:
     #
     # Standard native builds
     #
-    generate_dockerfile("alpine", "alpine-321")
+    generate_dockerfile("alpine", "alpine-321",
+                        trailer="".join(alpine_extras))
     generate_dockerfile("centos9", "centos-stream-9")
     generate_dockerfile("debian", "debian-12",
                         trailer="".join(debian12_extras))

From bc3830f920810df862d93ed4737fa841d94917fb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:12 +0400
Subject: [PATCH 0811/2396] tests/lcitool: add missing rust-std dep
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some distros/targets may pull it by default, but some don't.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-16-marcandre.lureau@redhat.com>
---
 scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml      | 1 +
 scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml        | 1 +
 tests/docker/dockerfiles/centos9.docker               | 1 +
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-i686-cross.docker     | 1 +
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 1 +
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 1 +
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 1 +
 tests/docker/dockerfiles/debian.docker                | 1 +
 tests/docker/dockerfiles/fedora-rust-nightly.docker   | 1 +
 tests/docker/dockerfiles/fedora-win64-cross.docker    | 3 ++-
 tests/docker/dockerfiles/fedora.docker                | 1 +
 tests/docker/dockerfiles/ubuntu2204.docker            | 1 +
 tests/lcitool/projects/qemu.yml                       | 1 +
 17 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
index f446217f2c..2ca4a5392f 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
@@ -81,6 +81,7 @@ packages:
   - libspice-protocol-dev
   - libspice-server-dev
   - libssh-dev
+  - libstd-rust-dev
   - libsystemd-dev
   - libtasn1-6-dev
   - libubsan1
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
index 25c3368c54..7198fbbcbb 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
@@ -80,6 +80,7 @@ packages:
   - libsndio-dev
   - libspice-protocol-dev
   - libssh-dev
+  - libstd-rust-dev
   - libsystemd-dev
   - libtasn1-6-dev
   - libubsan1
diff --git a/tests/docker/dockerfiles/centos9.docker b/tests/docker/dockerfiles/centos9.docker
index 33c62033ce..e7fc688ee9 100644
--- a/tests/docker/dockerfiles/centos9.docker
+++ b/tests/docker/dockerfiles/centos9.docker
@@ -105,6 +105,7 @@ RUN dnf distro-sync -y && \
         python3-tomli \
         rdma-core-devel \
         rust \
+        rust-std-static \
         sed \
         snappy-devel \
         socat \
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index d4d3cebfdc..f3ad2205a7 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -141,6 +141,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:amd64 \
                       libspice-server-dev:amd64 \
                       libssh-dev:amd64 \
+                      libstd-rust-dev:amd64 \
                       libsystemd-dev:amd64 \
                       libtasn1-6-dev:amd64 \
                       libubsan1:amd64 \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index cd9c9a0def..7d42227fa1 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -140,6 +140,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:arm64 \
                       libspice-server-dev:arm64 \
                       libssh-dev:arm64 \
+                      libstd-rust-dev:arm64 \
                       libsystemd-dev:arm64 \
                       libtasn1-6-dev:arm64 \
                       libubsan1:arm64 \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 21a5bbc81d..8ad4d2bebf 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -140,6 +140,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:armhf \
                       libspice-server-dev:armhf \
                       libssh-dev:armhf \
+                      libstd-rust-dev:armhf \
                       libsystemd-dev:armhf \
                       libtasn1-6-dev:armhf \
                       libubsan1:armhf \
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index c41a4805fe..e7e8d8e0f1 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -140,6 +140,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:i386 \
                       libspice-server-dev:i386 \
                       libssh-dev:i386 \
+                      libstd-rust-dev:i386 \
                       libsystemd-dev:i386 \
                       libtasn1-6-dev:i386 \
                       libubsan1:i386 \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 77d5d43f4b..cca04a4594 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -139,6 +139,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:mips64el \
                       libspice-server-dev:mips64el \
                       libssh-dev:mips64el \
+                      libstd-rust-dev:mips64el \
                       libsystemd-dev:mips64el \
                       libtasn1-6-dev:mips64el \
                       libudev-dev:mips64el \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 9e60fe0eb4..59c6f92248 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -139,6 +139,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:mipsel \
                       libspice-server-dev:mipsel \
                       libssh-dev:mipsel \
+                      libstd-rust-dev:mipsel \
                       libsystemd-dev:mipsel \
                       libtasn1-6-dev:mipsel \
                       libudev-dev:mipsel \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index dc683bd498..97ef64d934 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -140,6 +140,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev:ppc64el \
                       libspice-server-dev:ppc64el \
                       libssh-dev:ppc64el \
+                      libstd-rust-dev:ppc64el \
                       libsystemd-dev:ppc64el \
                       libtasn1-6-dev:ppc64el \
                       libubsan1:ppc64el \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index ef6e961460..3afe91494d 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -139,6 +139,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libsndio-dev:s390x \
                       libspice-protocol-dev:s390x \
                       libssh-dev:s390x \
+                      libstd-rust-dev:s390x \
                       libsystemd-dev:s390x \
                       libtasn1-6-dev:s390x \
                       libubsan1:s390x \
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index ef9ba62f2a..f68fcc83a9 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -89,6 +89,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev \
                       libspice-server-dev \
                       libssh-dev \
+                      libstd-rust-dev \
                       libsystemd-dev \
                       libtasn1-6-dev \
                       libubsan1 \
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index bdbcebda8d..167246f0f5 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -117,6 +117,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                python3-wheel \
                rdma-core-devel \
                rust \
+               rust-std-static \
                sed \
                snappy-devel \
                socat \
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index 3c54486d2f..c76a70c368 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -100,7 +100,8 @@ RUN nosync dnf install -y \
                mingw64-libtasn1 \
                mingw64-nettle \
                mingw64-pixman \
-               mingw64-pkg-config && \
+               mingw64-pkg-config \
+               rust-std-static-x86_64-pc-windows-gnu && \
     nosync dnf clean all -y && \
     rpm -qa | sort > /packages.txt && \
     mkdir -p /usr/libexec/ccache-wrappers && \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index f758efd2b7..56a1ad8a18 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -117,6 +117,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                python3-wheel \
                rdma-core-devel \
                rust \
+               rust-std-static \
                sed \
                snappy-devel \
                socat \
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 146ad7fce2..b393db55a8 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -88,6 +88,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libspice-protocol-dev \
                       libspice-server-dev \
                       libssh-dev \
+                      libstd-rust-dev \
                       libsystemd-dev \
                       libtasn1-6-dev \
                       libubsan1 \
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index 301d0e1ea0..82812e7736 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -104,6 +104,7 @@ packages:
  - python3-venv
  - rpm2cpio
  - rust
+ - rust-std
  - sdl2
  - sdl2-image
  - sed

From 8234e77f06d76eb40a60edaa66652dd3b41daad6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:13 +0400
Subject: [PATCH 0812/2396] tests/lcitool: update to debian13
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

riscv64 is now a supported architecture.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250924120426.2158655-17-marcandre.lureau@redhat.com>
---
 .../dockerfiles/debian-amd64-cross.docker     |   9 +-
 .../dockerfiles/debian-arm64-cross.docker     |   9 +-
 .../dockerfiles/debian-armhf-cross.docker     |  12 +-
 .../dockerfiles/debian-i686-cross.docker      |  11 +-
 .../dockerfiles/debian-ppc64el-cross.docker   |   9 +-
 .../dockerfiles/debian-riscv64-cross.docker   | 106 +++++++++++++++++-
 .../dockerfiles/debian-s390x-cross.docker     |   9 +-
 tests/docker/dockerfiles/debian.docker        |   9 +-
 tests/lcitool/refresh                         |  21 ++--
 9 files changed, 149 insertions(+), 46 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index f3ad2205a7..08621879dd 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch x86_64 debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch x86_64 debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-x86-64-linux-gnu \
                       libaio-dev:amd64 \
-                      libasan6:amd64 \
+                      libasan8:amd64 \
                       libasound2-dev:amd64 \
                       libattr1-dev:amd64 \
                       libbpf-dev:amd64 \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 7d42227fa1..725cccbee1 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch aarch64 debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch aarch64 debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-aarch64-linux-gnu \
                       libaio-dev:arm64 \
-                      libasan6:arm64 \
+                      libasan8:arm64 \
                       libasound2-dev:arm64 \
                       libattr1-dev:arm64 \
                       libbpf-dev:arm64 \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 8ad4d2bebf..50f7e0e986 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch armv7l debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch armv7l debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-arm-linux-gnueabihf \
                       libaio-dev:armhf \
-                      libasan6:armhf \
+                      libasan8:armhf \
                       libasound2-dev:armhf \
                       libattr1-dev:armhf \
                       libbpf-dev:armhf \
@@ -107,7 +108,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libgbm-dev:armhf \
                       libgcrypt20-dev:armhf \
                       libglib2.0-dev:armhf \
-                      libglusterfs-dev:armhf \
                       libgnutls28-dev:armhf \
                       libgtk-3-dev:armhf \
                       libgtk-vnc-2.0-dev:armhf \
@@ -127,7 +127,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libpixman-1-dev:armhf \
                       libpng-dev:armhf \
                       libpulse-dev:armhf \
-                      librbd-dev:armhf \
                       librdmacm-dev:armhf \
                       libsasl2-dev:armhf \
                       libsdl2-dev:armhf \
@@ -152,7 +151,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libvirglrenderer-dev:armhf \
                       libvte-2.91-dev:armhf \
                       libxdp-dev:armhf \
-                      libxen-dev:armhf \
                       libzstd-dev:armhf \
                       nettle-dev:armhf \
                       systemtap-sdt-dev:armhf \
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index e7e8d8e0f1..f53b77cb62 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch i686 debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch i686 debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-i686-linux-gnu \
                       libaio-dev:i386 \
-                      libasan6:i386 \
+                      libasan8:i386 \
                       libasound2-dev:i386 \
                       libattr1-dev:i386 \
                       libbpf-dev:i386 \
@@ -107,7 +108,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libgbm-dev:i386 \
                       libgcrypt20-dev:i386 \
                       libglib2.0-dev:i386 \
-                      libglusterfs-dev:i386 \
                       libgnutls28-dev:i386 \
                       libgtk-3-dev:i386 \
                       libgtk-vnc-2.0-dev:i386 \
@@ -127,7 +127,6 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       libpixman-1-dev:i386 \
                       libpng-dev:i386 \
                       libpulse-dev:i386 \
-                      librbd-dev:i386 \
                       librdmacm-dev:i386 \
                       libsasl2-dev:i386 \
                       libsdl2-dev:i386 \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 97ef64d934..09de265c26 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch ppc64le debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch ppc64le debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-powerpc64le-linux-gnu \
                       libaio-dev:ppc64el \
-                      libasan6:ppc64el \
+                      libasan8:ppc64el \
                       libasound2-dev:ppc64el \
                       libattr1-dev:ppc64el \
                       libbpf-dev:ppc64el \
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index 79ec37616d..e6c463eff7 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -1,6 +1,6 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch riscv64 debian-13 qemu-minimal
+#  $ lcitool dockerfile --layers all --cross-arch riscv64 debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
@@ -13,25 +13,57 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       bash \
                       bc \
+                      bindgen \
                       bison \
+                      bsdextrautils \
+                      bzip2 \
                       ca-certificates \
                       ccache \
+                      dbus \
+                      debianutils \
+                      diffutils \
+                      exuberant-ctags \
                       findutils \
                       flex \
                       gcc \
+                      gcovr \
+                      gettext \
                       git \
+                      hostname \
+                      libclang-rt-dev \
                       libglib2.0-dev \
+                      llvm \
                       locales \
                       make \
+                      mtools \
+                      ncat \
                       ninja-build \
+                      openssh-client \
                       pkgconf \
                       python3 \
+                      python3-numpy \
+                      python3-opencv \
+                      python3-pillow \
                       python3-pip \
                       python3-setuptools \
+                      python3-sphinx \
+                      python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
+                      python3-yaml \
+                      rpm2cpio \
+                      rustc \
                       sed \
-                      tar && \
+                      socat \
+                      sparse \
+                      swtpm \
+                      tar \
+                      tesseract-ocr \
+                      tesseract-ocr-eng \
+                      vulkan-tools \
+                      xorriso \
+                      zstd && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
@@ -56,11 +88,78 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-riscv64-linux-gnu \
+                      libaio-dev:riscv64 \
+                      libasan8:riscv64 \
+                      libasound2-dev:riscv64 \
+                      libattr1-dev:riscv64 \
+                      libbpf-dev:riscv64 \
+                      libbrlapi-dev:riscv64 \
+                      libbz2-dev:riscv64 \
                       libc6-dev:riscv64 \
+                      libcacard-dev:riscv64 \
+                      libcap-ng-dev:riscv64 \
+                      libcapstone-dev:riscv64 \
+                      libcbor-dev:riscv64 \
+                      libcmocka-dev:riscv64 \
+                      libcurl4-gnutls-dev:riscv64 \
+                      libdaxctl-dev:riscv64 \
+                      libdrm-dev:riscv64 \
+                      libepoxy-dev:riscv64 \
                       libfdt-dev:riscv64 \
                       libffi-dev:riscv64 \
+                      libfuse3-dev:riscv64 \
+                      libgbm-dev:riscv64 \
+                      libgcrypt20-dev:riscv64 \
                       libglib2.0-dev:riscv64 \
-                      libpixman-1-dev:riscv64 && \
+                      libglusterfs-dev:riscv64 \
+                      libgnutls28-dev:riscv64 \
+                      libgtk-3-dev:riscv64 \
+                      libgtk-vnc-2.0-dev:riscv64 \
+                      libibverbs-dev:riscv64 \
+                      libiscsi-dev:riscv64 \
+                      libjemalloc-dev:riscv64 \
+                      libjpeg62-turbo-dev:riscv64 \
+                      libjson-c-dev:riscv64 \
+                      liblttng-ust-dev:riscv64 \
+                      liblzo2-dev:riscv64 \
+                      libncursesw5-dev:riscv64 \
+                      libnfs-dev:riscv64 \
+                      libnuma-dev:riscv64 \
+                      libpam0g-dev:riscv64 \
+                      libpcre2-dev:riscv64 \
+                      libpipewire-0.3-dev:riscv64 \
+                      libpixman-1-dev:riscv64 \
+                      libpng-dev:riscv64 \
+                      libpulse-dev:riscv64 \
+                      librbd-dev:riscv64 \
+                      librdmacm-dev:riscv64 \
+                      libsasl2-dev:riscv64 \
+                      libsdl2-dev:riscv64 \
+                      libsdl2-image-dev:riscv64 \
+                      libseccomp-dev:riscv64 \
+                      libselinux1-dev:riscv64 \
+                      libslirp-dev:riscv64 \
+                      libsnappy-dev:riscv64 \
+                      libsndio-dev:riscv64 \
+                      libspice-protocol-dev:riscv64 \
+                      libspice-server-dev:riscv64 \
+                      libssh-dev:riscv64 \
+                      libstd-rust-dev:riscv64 \
+                      libsystemd-dev:riscv64 \
+                      libtasn1-6-dev:riscv64 \
+                      libubsan1:riscv64 \
+                      libudev-dev:riscv64 \
+                      liburing-dev:riscv64 \
+                      libusb-1.0-0-dev:riscv64 \
+                      libusbredirhost-dev:riscv64 \
+                      libvdeplug-dev:riscv64 \
+                      libvirglrenderer-dev:riscv64 \
+                      libvte-2.91-dev:riscv64 \
+                      libxdp-dev:riscv64 \
+                      libzstd-dev:riscv64 \
+                      nettle-dev:riscv64 \
+                      systemtap-sdt-dev:riscv64 \
+                      zlib1g-dev:riscv64 && \
     eatmydata apt-get autoremove -y && \
     eatmydata apt-get autoclean -y && \
     mkdir -p /usr/local/share/meson/cross && \
@@ -82,6 +181,7 @@ endian = 'little'\n" > /usr/local/share/meson/cross/riscv64-linux-gnu && \
 
 ENV ABI "riscv64-linux-gnu"
 ENV MESON_OPTS "--cross-file=riscv64-linux-gnu"
+ENV RUST_TARGET "riscv64gc-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=riscv64-linux-gnu-
 ENV DEF_TARGET_LIST riscv64-softmmu,riscv64-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 3afe91494d..d7b2ca99ce 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all --cross-arch s390x debian-12 qemu
+#  $ lcitool dockerfile --layers all --cross-arch s390x debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -48,11 +48,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
@@ -85,7 +86,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
     eatmydata apt-get install --no-install-recommends -y \
                       gcc-s390x-linux-gnu \
                       libaio-dev:s390x \
-                      libasan6:s390x \
+                      libasan8:s390x \
                       libasound2-dev:s390x \
                       libattr1-dev:s390x \
                       libbpf-dev:s390x \
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index f68fcc83a9..2696cf2167 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -1,10 +1,10 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool dockerfile --layers all debian-12 qemu
+#  $ lcitool dockerfile --layers all debian-13 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
-FROM docker.io/library/debian:12-slim
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
@@ -32,7 +32,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       git \
                       hostname \
                       libaio-dev \
-                      libasan6 \
+                      libasan8 \
                       libasound2-dev \
                       libattr1-dev \
                       libbpf-dev \
@@ -121,11 +121,12 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-setuptools \
                       python3-sphinx \
                       python3-sphinx-rtd-theme \
+                      python3-tomli \
                       python3-venv \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-web \
+                      rustc \
                       sed \
                       socat \
                       sparse \
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 6f98a91277..5c62cdde4a 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -105,7 +105,7 @@ alpine_extras = [
 # Netmap still needs to be manually built as it is yet to be packaged
 # into a distro. We also add cscope and gtags which are used in the CI
 # test
-debian12_extras = [
+debian13_extras = [
     "# netmap/cscope/global\n",
     "RUN DEBIAN_FRONTEND=noninteractive eatmydata \\\n",
     "  apt install -y --no-install-recommends \\\n",
@@ -175,8 +175,8 @@ try:
     generate_dockerfile("alpine", "alpine-321",
                         trailer="".join(alpine_extras))
     generate_dockerfile("centos9", "centos-stream-9")
-    generate_dockerfile("debian", "debian-12",
-                        trailer="".join(debian12_extras))
+    generate_dockerfile("debian", "debian-13",
+                        trailer="".join(debian13_extras))
     generate_dockerfile("fedora", "fedora-41")
     generate_dockerfile("opensuse-leap", "opensuse-leap-15")
     generate_dockerfile("ubuntu2204", "ubuntu-2204",
@@ -191,30 +191,32 @@ try:
     #
     # Cross compiling builds
     #
-    generate_dockerfile("debian-amd64-cross", "debian-12",
+    generate_dockerfile("debian-amd64-cross", "debian-13",
                         cross="x86_64",
                         trailer=cross_build("x86_64-linux-gnu-",
                                             "x86_64-softmmu,"
                                             "x86_64-linux-user,"
                                             "i386-softmmu,i386-linux-user"))
 
-    generate_dockerfile("debian-arm64-cross", "debian-12",
+    generate_dockerfile("debian-arm64-cross", "debian-13",
                         cross="aarch64",
                         trailer=cross_build("aarch64-linux-gnu-",
                                             "aarch64-softmmu,aarch64-linux-user"))
 
-    generate_dockerfile("debian-armhf-cross", "debian-12",
+    generate_dockerfile("debian-armhf-cross", "debian-13",
                         cross="armv7l",
                         trailer=cross_build("arm-linux-gnueabihf-",
                                             "arm-softmmu,arm-linux-user"))
 
-    generate_dockerfile("debian-i686-cross", "debian-12",
+    generate_dockerfile("debian-i686-cross", "debian-13",
                         cross="i686",
                         trailer=cross_build("i686-linux-gnu-",
                                             "x86_64-softmmu,"
                                             "x86_64-linux-user,"
                                             "i386-softmmu,i386-linux-user"))
 
+    # mips no longer supported in debian-13
+    # https://www.debian.org/releases/trixie/release-notes/issues.html#mips-architectures-removed
     generate_dockerfile("debian-mips64el-cross", "debian-12",
                         cross="mips64el",
                         trailer=cross_build("mips64el-linux-gnuabi64-",
@@ -225,7 +227,7 @@ try:
                         trailer=cross_build("mipsel-linux-gnu-",
                                             "mipsel-softmmu,mipsel-linux-user"))
 
-    generate_dockerfile("debian-ppc64el-cross", "debian-12",
+    generate_dockerfile("debian-ppc64el-cross", "debian-13",
                         cross="ppc64le",
                         trailer=cross_build("powerpc64le-linux-gnu-",
                                             "ppc64-softmmu,ppc64-linux-user"))
@@ -233,12 +235,11 @@ try:
     # while not yet a release architecture the packages are still
     # build while part of testing
     generate_dockerfile("debian-riscv64-cross", "debian-13",
-                        project="qemu-minimal",
                         cross="riscv64",
                         trailer=cross_build("riscv64-linux-gnu-",
                                             "riscv64-softmmu,riscv64-linux-user"))
 
-    generate_dockerfile("debian-s390x-cross", "debian-12",
+    generate_dockerfile("debian-s390x-cross", "debian-13",
                         cross="s390x",
                         trailer=cross_build("s390x-linux-gnu-",
                                             "s390x-softmmu,s390x-linux-user"))

From 2086d47992e199c250fcc1dcbc1177590c83ccd4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:14 +0400
Subject: [PATCH 0813/2396] tests/docker: add ENABLE_RUST environment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-18-marcandre.lureau@redhat.com>
---
 tests/docker/common.rc | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index d202c0c666..752f4f3aed 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -21,6 +21,14 @@ else
     DEF_TARGET_LIST=${DEF_TARGET_LIST:-"x86_64-softmmu,aarch64-softmmu"}
 fi
 
+enable_rust=""
+if [ "$ENABLE_RUST" = "1" ]; then
+  enable_rust="--enable-rust"
+  if [ -n "$RUST_TARGET" ]; then
+    enable_rust="$enable_rust --rust-target-triple=$RUST_TARGET"
+  fi
+fi
+
 requires_binary()
 {
     found=0
@@ -46,6 +54,7 @@ configure_qemu()
                  ${TARGET_LIST:+--target-list=${TARGET_LIST}} \
                  --prefix=$INSTALL_DIR \
                  $QEMU_CONFIGURE_OPTS $EXTRA_CONFIGURE_OPTS \
+                 $enable_rust \
                  $@"
     echo "Configure options:"
     echo $config_opts

From e05b9e3d9b70842e10f49977fc3bbdc91587677e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:15 +0400
Subject: [PATCH 0814/2396] tests/lcitool: enable rust & refresh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enable Rust on various distro images: alpine, centos, debian, fedora,
opensuse.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250924120426.2158655-19-marcandre.lureau@redhat.com>
---
 tests/docker/dockerfiles/alpine.docker             |  2 ++
 tests/docker/dockerfiles/centos9.docker            |  2 ++
 tests/docker/dockerfiles/debian-amd64-cross.docker |  2 ++
 tests/docker/dockerfiles/debian-arm64-cross.docker |  2 ++
 tests/docker/dockerfiles/debian-armhf-cross.docker |  2 ++
 tests/docker/dockerfiles/debian-i686-cross.docker  |  2 ++
 .../dockerfiles/debian-mips64el-cross.docker       |  2 ++
 .../docker/dockerfiles/debian-mipsel-cross.docker  |  2 ++
 .../docker/dockerfiles/debian-ppc64el-cross.docker |  2 ++
 .../docker/dockerfiles/debian-riscv64-cross.docker |  2 ++
 tests/docker/dockerfiles/debian-s390x-cross.docker |  2 ++
 tests/docker/dockerfiles/debian.docker             |  2 ++
 .../docker/dockerfiles/fedora-rust-nightly.docker  |  2 ++
 tests/docker/dockerfiles/fedora.docker             |  2 ++
 tests/docker/dockerfiles/opensuse-leap.docker      |  2 ++
 tests/lcitool/refresh                              | 14 +++++++++++---
 16 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index b50fbc3dba..52adf9ccbb 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -138,3 +138,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/centos9.docker b/tests/docker/dockerfiles/centos9.docker
index e7fc688ee9..0674d77826 100644
--- a/tests/docker/dockerfiles/centos9.docker
+++ b/tests/docker/dockerfiles/centos9.docker
@@ -142,3 +142,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 08621879dd..7f4674400d 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -188,3 +188,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 725cccbee1..c7cd54ee5c 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -187,3 +187,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 50f7e0e986..627d41c6de 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -184,3 +184,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index f53b77cb62..4e8b3a8293 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -184,3 +184,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index cca04a4594..6e88777f76 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -183,3 +183,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 59c6f92248..5f4e3fa963 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -183,3 +183,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 09de265c26..dfa690616d 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -186,3 +186,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index e6c463eff7..09b2953f32 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -189,3 +189,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index d7b2ca99ce..09a78c15ba 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -185,3 +185,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index 2696cf2167..8dd893be4b 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -175,3 +175,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index 167246f0f5..7d31c9f406 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -185,3 +185,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 56a1ad8a18..891a740fcb 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -162,3 +162,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index d71dbc30c7..75e1747780 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -148,3 +148,5 @@ ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
   id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi
+
+ENV ENABLE_RUST 1
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 5c62cdde4a..645959318a 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -63,7 +63,8 @@ add_user_mapping = [
     "  id ${USER} 2>/dev/null || useradd -u ${UID} -U ${USER}; fi\n"
 ]
 
-def generate_dockerfile(host, target, project="qemu", cross=None, trailer=None):
+def generate_dockerfile(host, target, project="qemu", cross=None, trailer=None,
+                        enable_rust=True):
     filename = Path(src_dir, "tests", "docker", "dockerfiles", host + ".docker")
     cmd = lcitool_cmd + ["dockerfile"]
     if cross is not None:
@@ -75,6 +76,8 @@ def generate_dockerfile(host, target, project="qemu", cross=None, trailer=None):
     else:
         trailer = "\n".join(add_user_mapping)
 
+    if enable_rust:
+        trailer += "\nENV ENABLE_RUST 1\n"
     generate(filename, cmd, trailer)
 
 
@@ -180,7 +183,9 @@ try:
     generate_dockerfile("fedora", "fedora-41")
     generate_dockerfile("opensuse-leap", "opensuse-leap-15")
     generate_dockerfile("ubuntu2204", "ubuntu-2204",
-                        trailer="".join(ubuntu2204_rust_extras))
+                        trailer="".join(ubuntu2204_rust_extras),
+                        # https://bugs.launchpad.net/ubuntu/+source/rustc-1.83/+bug/2120318
+                        enable_rust=False)
 
     #
     # Non-fatal Rust-enabled build
@@ -248,7 +253,10 @@ try:
                         project='qemu,qemu-win-installer',
                         cross="mingw64",
                         trailer=cross_build("x86_64-w64-mingw32-",
-                                            "x86_64-softmmu"))
+                                            "x86_64-softmmu"),
+                        # linking with rust is buggy:
+                        # https://github.com/mesonbuild/meson/pull/14991
+                        enable_rust=False)
 
     #
     # Cirrus packages lists for GitLab

From 6890bec797e51efdccc7e082303d225e70c343f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:16 +0400
Subject: [PATCH 0815/2396] configure: set the meson executable suffix/ext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'rustfmt' target runs meson: it needs the correct path with
extension on Windows.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-20-marcandre.lureau@redhat.com>
---
 configure | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/configure b/configure
index bf964947b8..78445cbb4b 100755
--- a/configure
+++ b/configure
@@ -1000,7 +1000,19 @@ $mkvenv ensuregroup --dir "${source_path}/python/wheels" \
 # We ignore PATH completely here: we want to use the venv's Meson
 # *exclusively*.
 
-meson="$(cd pyvenv/bin; pwd)/meson"
+# for msys2
+get_pwd() {
+    if pwd -W >/dev/null 2>&1; then
+        pwd -W
+    else
+        pwd
+    fi
+}
+
+meson="$(cd pyvenv/bin; get_pwd)/meson"
+if [ -f "$meson$EXESUF" ]; then
+  meson="$meson$EXESUF"
+fi
 
 # Conditionally ensure Sphinx is installed.
 

From 5314a5ba2b53709eeb16f23c80cb28e096c9589b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:17 +0400
Subject: [PATCH 0816/2396] tests/freebsd: enable Rust
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250924120426.2158655-21-marcandre.lureau@redhat.com>
---
 .gitlab-ci.d/cirrus.yml | 2 +-
 tests/vm/freebsd        | 4 +++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/cirrus.yml b/.gitlab-ci.d/cirrus.yml
index 75b611418e..13a0bf5bb9 100644
--- a/.gitlab-ci.d/cirrus.yml
+++ b/.gitlab-ci.d/cirrus.yml
@@ -42,7 +42,7 @@ x64-freebsd-14-build:
     CIRRUS_VM_RAM: 8G
     UPDATE_COMMAND: pkg update; pkg upgrade -y
     INSTALL_COMMAND: pkg install -y
-    CONFIGURE_ARGS: --target-list-exclude=arm-softmmu,i386-softmmu,microblaze-softmmu,mips64el-softmmu,mipsel-softmmu,mips-softmmu,ppc-softmmu,sh4eb-softmmu,xtensa-softmmu
+    CONFIGURE_ARGS: --target-list-exclude=arm-softmmu,i386-softmmu,microblaze-softmmu,mips64el-softmmu,mipsel-softmmu,mips-softmmu,ppc-softmmu,sh4eb-softmmu,xtensa-softmmu --enable-rust
     TEST_TARGETS: check
 
 aarch64-macos-build:
diff --git a/tests/vm/freebsd b/tests/vm/freebsd
index 2e96c9eba5..ea09b21fbc 100755
--- a/tests/vm/freebsd
+++ b/tests/vm/freebsd
@@ -40,7 +40,9 @@ class FreeBSDVM(basevm.BaseVM):
         tar -xf /dev/vtbd1;
         cd ../build;
         ../src/configure --extra-ldflags=-L/usr/local/lib \
-                         --extra-cflags=-I/usr/local/include {configure_opts};
+                         --extra-cflags=-I/usr/local/include \
+                         --enable-rust \
+                         {configure_opts};
         gmake --output-sync -j{jobs} {target} {verbose};
     """
 

From d9703225f5bbec3f1dec08623106b10255c0474a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:18 +0400
Subject: [PATCH 0817/2396] meson: rust-bindgen limit allowlist-file to
 srcdir/include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

gitlab CI restricts usage of directories for the build environment and
cache. Msys64 is installed under project root ($srcdir/msys64). This
confuses rust-bindgen allowlist-file which will generate bindings for
all the system include headers under msys64/.

blocklist-file is also too strict, as it prevents generating all the
recursively dependent types coming from system includes.

Instead, let's not use allowlist-file from the project root,

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250924120426.2158655-22-marcandre.lureau@redhat.com>
---
 meson.build | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/meson.build b/meson.build
index 14e626aa1e..0d0bf9ee46 100644
--- a/meson.build
+++ b/meson.build
@@ -4238,8 +4238,7 @@ if have_rust
     '--no-layout-tests',
     '--no-prepend-enum-name',
     '--allowlist-file', meson.project_source_root() + '/include/.*',
-    '--allowlist-file', meson.project_source_root() + '/.*',
-    '--allowlist-file', meson.project_build_root() + '/.*'
+    '--allowlist-file', meson.project_build_root() + '/.*',
     ]
   if not rustfmt.found()
     if bindgen.version().version_compare('<0.65.0')

From 7a3fe60cb0ec2742371fd96a396de118800b213d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:22 +0400
Subject: [PATCH 0818/2396] build-sys: deprecate mips host
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250924120426.2158655-26-marcandre.lureau@redhat.com>
---
 docs/about/build-platforms.rst | 2 --
 docs/about/deprecated.rst      | 9 +++------
 meson.build                    | 8 ++++++++
 3 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 0160d3adb8..798cb4631d 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -44,8 +44,6 @@ Those hosts are officially supported, with various accelerators:
      - Accelerators
    * - Arm
      - hvf (64 bit only), kvm (64 bit only), tcg, xen
-   * - MIPS (64 bit little endian only)
-     - kvm, tcg
    * - PPC
      - kvm, tcg
    * - RISC-V
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index b8d60c1a90..67e527740c 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -172,8 +172,8 @@ This argument has always been ignored.
 Host Architectures
 ------------------
 
-Big endian MIPS since 7.2; 32-bit little endian MIPS since 9.2
-''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+Big endian MIPS since 7.2; 32-bit little endian MIPS since 9.2, MIPS since 11.0
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
 
 As Debian 10 ("Buster") moved into LTS the big endian 32 bit version of
 MIPS moved out of support making it hard to maintain our
@@ -181,10 +181,7 @@ cross-compilation CI tests of the architecture. As we no longer have
 CI coverage support may bitrot away before the deprecation process
 completes.
 
-Likewise, the little endian variant of 32 bit MIPS is not supported by
-Debian 13 ("Trixie") and newer.
-
-64 bit little endian MIPS is still a supported host architecture.
+Likewise, MIPS is not supported by Debian 13 ("Trixie") and newer.
 
 System emulation on 32-bit x86 hosts (since 8.0)
 ''''''''''''''''''''''''''''''''''''''''''''''''
diff --git a/meson.build b/meson.build
index 0d0bf9ee46..762c533a31 100644
--- a/meson.build
+++ b/meson.build
@@ -5040,6 +5040,14 @@ elif host_long_bits < 64
   message()
   message('Support for 32-bit CPU host architecture ' + cpu + ' is going')
   message('to be dropped in a future QEMU release.')
+elif host_arch == 'mips'
+  message()
+  warning('DEPRECATED HOST CPU')
+  message()
+  message('Support for CPU host architecture ' + cpu + ' is going to be')
+  message('dropped as soon as the QEMU project stops supporting Debian 12')
+  message('("Bookworm"). Going forward, the QEMU project will not guarantee')
+  message('that QEMU will compile or work on this host CPU.')
 endif
 
 if not supported_oses.contains(host_os)

From 582a39beea414c092dbd8c178f3eff3a718eee77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 16:04:23 +0400
Subject: [PATCH 0819/2396] build-sys: pass -fvisibility=default for wasm
 bindgen
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise, no functions are generated:
https://github.com/rust-lang/rust-bindgen/issues/2989

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Message-ID: <20250924120426.2158655-27-marcandre.lureau@redhat.com>
---
 meson.build                    | 4 ++++
 rust/bql/meson.build           | 1 +
 rust/chardev/meson.build       | 1 +
 rust/hw/char/pl011/meson.build | 1 +
 rust/hw/core/meson.build       | 1 +
 rust/migration/meson.build     | 3 ++-
 rust/qom/meson.build           | 1 +
 rust/system/meson.build        | 1 +
 rust/util/meson.build          | 1 +
 9 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index 762c533a31..55c8202a4d 100644
--- a/meson.build
+++ b/meson.build
@@ -4256,6 +4256,10 @@ if have_rust
   else
     bindgen_args_common += ['--merge-extern-blocks']
   endif
+  bindgen_c_args = []
+  if host_arch == 'wasm32'
+    bindgen_c_args += ['-fvisibility=default']
+  endif
   subdir('rust')
 endif
 
diff --git a/rust/bql/meson.build b/rust/bql/meson.build
index 7214d94408..bc51c7f160 100644
--- a/rust/bql/meson.build
+++ b/rust/bql/meson.build
@@ -21,6 +21,7 @@ _bql_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common,
+  c_args: bindgen_c_args,
 )
 
 _bql_rs = static_library(
diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
index 370895c111..e7ce02b3bc 100644
--- a/rust/chardev/meson.build
+++ b/rust/chardev/meson.build
@@ -20,6 +20,7 @@ _chardev_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common + _chardev_bindgen_args,
+  c_args: bindgen_c_args,
 )
 
 _chardev_rs = static_library(
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index ffdc8af53f..a33f32906e 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -12,6 +12,7 @@ _libpl011_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common,
+  c_args: bindgen_c_args,
 )
 
 _libpl011_rs = static_library(
diff --git a/rust/hw/core/meson.build b/rust/hw/core/meson.build
index 81d8c77f9a..e1ae95ed61 100644
--- a/rust/hw/core/meson.build
+++ b/rust/hw/core/meson.build
@@ -41,6 +41,7 @@ _hwcore_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common + _hwcore_bindgen_args,
+  c_args: bindgen_c_args,
 )
 
 _hwcore_rs = static_library(
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index 2a49bd1633..ddf5c2f51d 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -22,7 +22,8 @@ _migration_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common + _migration_bindgen_args,
-  )
+  c_args: bindgen_c_args,
+)
 
 _migration_rs = static_library(
   'migration',
diff --git a/rust/qom/meson.build b/rust/qom/meson.build
index 21e12148da..71fdac696c 100644
--- a/rust/qom/meson.build
+++ b/rust/qom/meson.build
@@ -12,6 +12,7 @@ _qom_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common,
+  c_args: bindgen_c_args,
 )
 
 _qom_rs = static_library(
diff --git a/rust/system/meson.build b/rust/system/meson.build
index 3ec140de01..0859f39745 100644
--- a/rust/system/meson.build
+++ b/rust/system/meson.build
@@ -20,6 +20,7 @@ _system_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common + _system_bindgen_args,
+  c_args: bindgen_c_args,
 )
 
 _system_rs = static_library(
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 7ca69939ce..094b43355a 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -22,6 +22,7 @@ _util_bindings_inc_rs = rust.bindgen(
   include_directories: bindings_incdir,
   bindgen_version: ['>=0.60.0'],
   args: bindgen_args_common + _util_bindgen_args,
+  c_args: bindgen_c_args,
 )
 
 _util_rs = static_library(

From f3da25a5571573dfd8b5459b3b4458cd4de38db7 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:58 +0200
Subject: [PATCH 0820/2396] ui/dbus: Consistent handling of texture mutex
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We report d3d_texture2d_acquire0() and d3d_texture2d_release0()
failure as error, except in dbus_update_gl_cb(), where we report it as
warning.  Report it as error there as well.

Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20250923091000.3180122-12-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 ui/dbus-listener.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/ui/dbus-listener.c b/ui/dbus-listener.c
index 09d7a319b1..52e041edb0 100644
--- a/ui/dbus-listener.c
+++ b/ui/dbus-listener.c
@@ -214,26 +214,31 @@ static void dbus_update_gl_cb(GObject *source_object,
                               GAsyncResult *res,
                               gpointer user_data)
 {
-    g_autoptr(GError) err = NULL;
+    g_autoptr(GError) gerr = NULL;
+#ifdef WIN32
+    Error *err = NULL;
+#endif
     DBusDisplayListener *ddl = user_data;
     bool success;
 
 #ifdef CONFIG_GBM
     success = qemu_dbus_display1_listener_call_update_dmabuf_finish(
-        ddl->proxy, res, &err);
+        ddl->proxy, res, &gerr);
     if (!success) {
-        error_report("Failed to call update: %s", err->message);
+        error_report("Failed to call update: %s", gerr->message);
     }
 #endif
 
 #ifdef WIN32
     success = qemu_dbus_display1_listener_win32_d3d11_call_update_texture2d_finish(
-        ddl->d3d11_proxy, res, &err);
+        ddl->d3d11_proxy, res, &gerr);
     if (!success) {
-        error_report("Failed to call update: %s", err->message);
+        error_report("Failed to call update: %s", gerr->message);
     }
 
-    d3d_texture2d_acquire0(ddl->d3d_texture, &error_warn);
+    if (!d3d_texture2d_acquire0(ddl->d3d_texture, &err)) {
+        error_report_err(err);
+    }
 #endif
 
     graphic_hw_gl_block(ddl->dcl.con, false);

From e0c6c38738501ff4f79864ab2b10622433317711 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:09:59 +0200
Subject: [PATCH 0821/2396] ivshmem-flat: Mark an instance of missing error
 handling FIXME

ivshmem-flat's ivshmem_flat_add_vector() neglects to handle
qemu_set_blocking() failure.  It used to silently ignore errors there.
Recent commit 6f607941b1c (treewide: use qemu_set_blocking instead of
g_unix_set_fd_nonblocking) changed it to warn (without mentioning it
the commit message, tsk, tsk, tsk).

Note that ivshmem-pci's process_msg_connect() handles this error.

Add a FIXME comment to mark the missing error handling.

Cc: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250923091000.3180122-13-armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 hw/misc/ivshmem-flat.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/misc/ivshmem-flat.c b/hw/misc/ivshmem-flat.c
index e83e6c6ee9..27ee8c9218 100644
--- a/hw/misc/ivshmem-flat.c
+++ b/hw/misc/ivshmem-flat.c
@@ -138,6 +138,8 @@ static void ivshmem_flat_remove_peer(IvshmemFTState *s, uint16_t peer_id)
 static void ivshmem_flat_add_vector(IvshmemFTState *s, IvshmemPeer *peer,
                                     int vector_fd)
 {
+    Error *err = NULL;
+
     if (peer->vector_counter >= IVSHMEM_MAX_VECTOR_NUM) {
         trace_ivshmem_flat_add_vector_failure(peer->vector_counter,
                                               vector_fd, peer->id);
@@ -154,8 +156,10 @@ static void ivshmem_flat_add_vector(IvshmemFTState *s, IvshmemPeer *peer,
      * peer.
      */
     peer->vector[peer->vector_counter].id = peer->vector_counter;
-    /* WARNING: qemu_socket_set_nonblock() return code ignored */
-    qemu_set_blocking(vector_fd, false, &error_warn);
+    if (!qemu_set_blocking(vector_fd, false, &err)) {
+        /* FIXME handle the error */
+        warn_report_err(err);
+    }
     event_notifier_init_fd(&peer->vector[peer->vector_counter].event_notifier,
                            vector_fd);
 

From bcb536cabe108e71e2900cdd605f5b4e59ac3e1f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 23 Sep 2025 11:10:00 +0200
Subject: [PATCH 0822/2396] error: Kill @error_warn

We added @error_warn some two years ago in commit 3ffef1a55ca (error:
add global &error_warn destination).  It has multiple issues:

* error.h's big comment was not updated for it.

* Function contracts were not updated for it.

* ERRP_GUARD() is unaware of @error_warn, and fails to mask it from
  error_prepend() and such.  These crash on @error_warn, as pointed
  out by Akihiko Odaki.

All fixable.  However, after more than two years, we had just of 15
uses, of which the last few patches removed seven as unclean or
otherwise undesirable, adding back five elsewhere.  I didn't look
closely enough at the remaining seven to decide whether they are
desirable or not.

I don't think this feature earns its keep.  Drop it.

Thanks-to: Akihiko  Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20250923091000.3180122-14-armbru@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 hw/display/virtio-gpu.c        |  8 ++++++--
 hw/net/virtio-net.c            |  8 +++++++-
 include/qapi/error.h           |  6 ------
 include/system/os-win32.h      |  5 ++++-
 io/channel-socket.c            |  4 ++--
 io/channel-watch.c             |  6 +++---
 tests/unit/test-error-report.c | 17 -----------------
 ui/gtk.c                       |  6 +++++-
 util/aio-win32.c               |  2 +-
 util/error.c                   |  5 +----
 util/oslib-win32.c             | 21 ++++++++++++++++++++-
 11 files changed, 49 insertions(+), 39 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 0a1a625b0e..de35902213 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -242,6 +242,7 @@ static uint32_t calc_image_hostmem(pixman_format_code_t pformat,
 static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
                                           struct virtio_gpu_ctrl_command *cmd)
 {
+    Error *err = NULL;
     pixman_format_code_t pformat;
     struct virtio_gpu_simple_resource *res;
     struct virtio_gpu_resource_create_2d c2d;
@@ -293,7 +294,8 @@ static void virtio_gpu_resource_create_2d(VirtIOGPU *g,
                 c2d.width,
                 c2d.height,
                 c2d.height ? res->hostmem / c2d.height : 0,
-                &error_warn)) {
+                &err)) {
+            warn_report_err(err);
             goto end;
         }
     }
@@ -1282,6 +1284,7 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
                            const VMStateField *field)
 {
     VirtIOGPU *g = opaque;
+    Error *err = NULL;
     struct virtio_gpu_simple_resource *res;
     uint32_t resource_id, pformat;
     int i;
@@ -1317,7 +1320,8 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
                                              res->width,
                                              res->height,
                                              res->height ? res->hostmem / res->height : 0,
-                                             &error_warn)) {
+                                             &err)) {
+            warn_report_err(err);
             g_free(res);
             return -EINVAL;
         }
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 6b5b5dace3..7848e26278 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1289,6 +1289,8 @@ exit:
 
 static bool virtio_net_load_ebpf(VirtIONet *n, Error **errp)
 {
+    Error *err = NULL;
+
     if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
         return true;
     }
@@ -1306,7 +1308,11 @@ static bool virtio_net_load_ebpf(VirtIONet *n, Error **errp)
         return virtio_net_load_ebpf_fds(n, errp);
     }
 
-    ebpf_rss_load(&n->ebpf_rss, &error_warn);
+    ebpf_rss_load(&n->ebpf_rss, &err);
+    /* Beware, ebpf_rss_load() can return false with @err unset */
+    if (err) {
+        warn_report_err(err);
+    }
     return true;
 }
 
diff --git a/include/qapi/error.h b/include/qapi/error.h
index 41e3816380..b16c6303f8 100644
--- a/include/qapi/error.h
+++ b/include/qapi/error.h
@@ -533,12 +533,6 @@ static inline void error_propagator_cleanup(ErrorPropagator *prop)
 
 G_DEFINE_AUTO_CLEANUP_CLEAR_FUNC(ErrorPropagator, error_propagator_cleanup);
 
-/*
- * Special error destination to warn on error.
- * See error_setg() and error_propagate() for details.
- */
-extern Error *error_warn;
-
 /*
  * Special error destination to abort on error.
  * See error_setg() and error_propagate() for details.
diff --git a/include/system/os-win32.h b/include/system/os-win32.h
index 3aa6cee4c2..22d72babdf 100644
--- a/include/system/os-win32.h
+++ b/include/system/os-win32.h
@@ -168,11 +168,14 @@ static inline void qemu_funlockfile(FILE *f)
 #endif
 }
 
-/* Helper for WSAEventSelect, to report errors */
+/* Helpers for WSAEventSelect() */
 bool qemu_socket_select(int sockfd, WSAEVENT hEventObject,
                         long lNetworkEvents, Error **errp);
+void qemu_socket_select_nofail(int sockfd, WSAEVENT hEventObject,
+                               long lNetworkEvents);
 
 bool qemu_socket_unselect(int sockfd, Error **errp);
+void qemu_socket_unselect_nofail(int sockfd);
 
 /* We wrap all the sockets functions so that we can set errno based on
  * WSAGetLastError(), and use file-descriptors instead of SOCKET.
diff --git a/io/channel-socket.c b/io/channel-socket.c
index fdc7670867..712b793eaf 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -454,7 +454,7 @@ static void qio_channel_socket_finalize(Object *obj)
             }
         }
 #ifdef WIN32
-        qemu_socket_unselect(ioc->fd, &error_warn);
+        qemu_socket_unselect_nofail(ioc->fd);
 #endif
         close(ioc->fd);
         ioc->fd = -1;
@@ -929,7 +929,7 @@ qio_channel_socket_close(QIOChannel *ioc,
 
     if (sioc->fd != -1) {
 #ifdef WIN32
-        qemu_socket_unselect(sioc->fd, &error_warn);
+        qemu_socket_unselect_nofail(sioc->fd);
 #endif
         if (qio_channel_has_feature(ioc, QIO_CHANNEL_FEATURE_LISTEN)) {
             socket_listen_cleanup(sioc->fd, errp);
diff --git a/io/channel-watch.c b/io/channel-watch.c
index ec76bd1ec6..018648b36b 100644
--- a/io/channel-watch.c
+++ b/io/channel-watch.c
@@ -281,9 +281,9 @@ GSource *qio_channel_create_socket_watch(QIOChannel *ioc,
     GSource *source;
     QIOChannelSocketSource *ssource;
 
-    qemu_socket_select(sockfd, ioc->event,
-                       FD_READ | FD_ACCEPT | FD_CLOSE |
-                       FD_CONNECT | FD_WRITE | FD_OOB, &error_warn);
+    qemu_socket_select_nofail(sockfd, ioc->event,
+                              FD_READ | FD_ACCEPT | FD_CLOSE |
+                              FD_CONNECT | FD_WRITE | FD_OOB);
 
     source = g_source_new(&qio_channel_socket_source_funcs,
                           sizeof(QIOChannelSocketSource));
diff --git a/tests/unit/test-error-report.c b/tests/unit/test-error-report.c
index 54319c86c9..0cbde3c4cf 100644
--- a/tests/unit/test-error-report.c
+++ b/tests/unit/test-error-report.c
@@ -104,22 +104,6 @@ test_error_report_timestamp(void)
 ");
 }
 
-static void
-test_error_warn(void)
-{
-    if (g_test_subprocess()) {
-        error_setg(&error_warn, "Testing &error_warn");
-        return;
-    }
-
-    g_test_trap_subprocess(NULL, 0, 0);
-    g_test_trap_assert_passed();
-    g_test_trap_assert_stderr("\
-test-error-report: warning: Testing &error_warn*\
-");
-}
-
-
 int
 main(int argc, char *argv[])
 {
@@ -133,7 +117,6 @@ main(int argc, char *argv[])
     g_test_add_func("/error-report/glog", test_error_report_glog);
     g_test_add_func("/error-report/once", test_error_report_once);
     g_test_add_func("/error-report/timestamp", test_error_report_timestamp);
-    g_test_add_func("/error-report/warn", test_error_warn);
 
     return g_test_run();
 }
diff --git a/ui/gtk.c b/ui/gtk.c
index e91d093a49..9a08cadc88 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -1181,6 +1181,7 @@ static gboolean gd_touch_event(GtkWidget *widget, GdkEventTouch *touch,
                                void *opaque)
 {
     VirtualConsole *vc = opaque;
+    Error *err = NULL;
     uint64_t num_slot = GPOINTER_TO_UINT(touch->sequence);
     int type = -1;
 
@@ -1203,7 +1204,10 @@ static gboolean gd_touch_event(GtkWidget *widget, GdkEventTouch *touch,
     console_handle_touch_event(vc->gfx.dcl.con, touch_slots,
                                num_slot, surface_width(vc->gfx.ds),
                                surface_height(vc->gfx.ds), touch->x,
-                               touch->y, type, &error_warn);
+                               touch->y, type, &err);
+    if (err) {
+        warn_report_err(err);
+    }
     return TRUE;
 }
 
diff --git a/util/aio-win32.c b/util/aio-win32.c
index b125924433..c6fbce64c2 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -121,7 +121,7 @@ void aio_set_fd_handler(AioContext *ctx,
 
         QLIST_INSERT_HEAD_RCU(&ctx->aio_handlers, node, node);
         event = event_notifier_get_handle(&ctx->notifier);
-        qemu_socket_select(fd, event, bitmask, &error_warn);
+        qemu_socket_select_nofail(fd, event, bitmask);
     }
     if (old_node) {
         aio_remove_fd_handler(ctx, old_node);
diff --git a/util/error.c b/util/error.c
index daea2142f3..0ae08225c0 100644
--- a/util/error.c
+++ b/util/error.c
@@ -19,7 +19,6 @@
 
 Error *error_abort;
 Error *error_fatal;
-Error *error_warn;
 
 static void error_handle(Error **errp, Error *err)
 {
@@ -41,9 +40,7 @@ static void error_handle(Error **errp, Error *err)
         error_report_err(err);
         exit(1);
     }
-    if (errp == &error_warn) {
-        warn_report_err(err);
-    } else if (errp && !*errp) {
+    if (errp && !*errp) {
         *errp = err;
     } else {
         error_free(err);
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 6a2367c89d..84bc65a765 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -182,7 +182,7 @@ bool qemu_set_blocking(int fd, bool block, Error **errp)
     unsigned long opt = block ? 0 : 1;
 
     if (block) {
-        qemu_socket_unselect(fd, &error_warn);
+        qemu_socket_unselect_nofail(fd);
     }
 
     if (ioctlsocket(fd, FIONBIO, &opt) != NO_ERROR) {
@@ -311,6 +311,25 @@ bool qemu_socket_unselect(int sockfd, Error **errp)
     return qemu_socket_select(sockfd, NULL, 0, errp);
 }
 
+void qemu_socket_select_nofail(int sockfd, WSAEVENT hEventObject,
+                               long lNetworkEvents)
+{
+    Error *err = NULL;
+
+    if (!qemu_socket_select(sockfd, hEventObject, lNetworkEvents, &err)) {
+        warn_report_err(err);
+    }
+}
+
+void qemu_socket_unselect_nofail(int sockfd)
+{
+    Error *err = NULL;
+
+    if (!qemu_socket_unselect(sockfd, &err)) {
+        warn_report_err(err);
+    }
+}
+
 int qemu_socketpair(int domain, int type, int protocol, int sv[2])
 {
     struct sockaddr_un addr = {

From 50873504dc3cc67ca06b4ebf307d084316e407a6 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:23 +0200
Subject: [PATCH 0823/2396] tracetool: fix usage of try_import()

try_import returns a tuple of a boolean and the requested module or attribute.
exists() functions return tracetool.try_import("tracetool.format." + name)[1]
but they should return the boolean value instead.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-2-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/__init__.py | 2 +-
 scripts/tracetool/format/__init__.py  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/scripts/tracetool/backend/__init__.py b/scripts/tracetool/backend/__init__.py
index 7bfcc86cc5..6c6344dedd 100644
--- a/scripts/tracetool/backend/__init__.py
+++ b/scripts/tracetool/backend/__init__.py
@@ -94,7 +94,7 @@ def exists(name):
     if name == "nop":
         return True
     name = name.replace("-", "_")
-    return tracetool.try_import("tracetool.backend." + name)[1]
+    return tracetool.try_import("tracetool.backend." + name)[0]
 
 
 class Wrapper:
diff --git a/scripts/tracetool/format/__init__.py b/scripts/tracetool/format/__init__.py
index 2dc46f3dd9..042fe7d103 100644
--- a/scripts/tracetool/format/__init__.py
+++ b/scripts/tracetool/format/__init__.py
@@ -70,7 +70,7 @@ def exists(name):
     if len(name) == 0:
         return False
     name = name.replace("-", "_")
-    return tracetool.try_import("tracetool.format." + name)[1]
+    return tracetool.try_import("tracetool.format." + name)[0]
 
 
 def generate(events, format, backend, group):

From 4c2f770f67e0b0d8b512defca4d81bd09936ab85 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:24 +0200
Subject: [PATCH 0824/2396] tracetool: remove dead code

Remove a bunch of dead code from tracetool.

In particular, there are no tcg-exec events anymore and the sub-event
functionality was only used for it.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-3-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py                | 45 +++-----------------
 scripts/tracetool/format/h.py                |  5 ---
 scripts/tracetool/format/log_stap.py         |  2 -
 scripts/tracetool/format/simpletrace_stap.py |  2 -
 4 files changed, 6 insertions(+), 48 deletions(-)

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 1d5238a084..4ef1dc1fca 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -15,7 +15,6 @@ __email__      = "stefanha@redhat.com"
 import os
 import re
 import sys
-import weakref
 from pathlib import PurePath
 
 import tracetool.backend
@@ -122,10 +121,6 @@ class Arguments:
             else:
                 self._args.append(arg)
 
-    def copy(self):
-        """Create a new copy."""
-        return Arguments(list(self._args))
-
     @staticmethod
     def build(arg_str):
         """Build and Arguments instance from an argument string.
@@ -222,13 +217,12 @@ class Event(object):
                       r"(?P<name>\w+)"
                       r"\((?P<args>[^)]*)\)"
                       r"\s*"
-                      r"(?:(?:(?P<fmt_trans>\".+),)?\s*(?P<fmt>\".+))?"
+                      r"(?P<fmt>\".+)?"
                       r"\s*")
 
     _VALID_PROPS = set(["disable"])
 
-    def __init__(self, name, props, fmt, args, lineno, filename, orig=None,
-                 event_trans=None, event_exec=None):
+    def __init__(self, name, props, fmt, args, lineno, filename):
         """
         Parameters
         ----------
@@ -236,20 +230,14 @@ class Event(object):
             Event name.
         props : list of str
             Property names.
-        fmt : str, list of str
-            Event printing format string(s).
+        fmt : str
+            Event printing format string.
         args : Arguments
             Event arguments.
         lineno : int
             The line number in the input file.
         filename : str
             The path to the input file.
-        orig : Event or None
-            Original Event before transformation/generation.
-        event_trans : Event or None
-            Generated translation-time event ("tcg" property).
-        event_exec : Event or None
-            Generated execution-time event ("tcg" property).
 
         """
         self.name = name
@@ -258,29 +246,16 @@ class Event(object):
         self.args = args
         self.lineno = int(lineno)
         self.filename = str(filename)
-        self.event_trans = event_trans
-        self.event_exec = event_exec
 
         if len(args) > 10:
             raise ValueError("Event '%s' has more than maximum permitted "
                              "argument count" % name)
 
-        if orig is None:
-            self.original = weakref.ref(self)
-        else:
-            self.original = orig
-
         unknown_props = set(self.properties) - self._VALID_PROPS
         if len(unknown_props) > 0:
             raise ValueError("Unknown properties: %s"
                              % ", ".join(unknown_props))
-        assert isinstance(self.fmt, str) or len(self.fmt) == 2
 
-    def copy(self):
-        """Create a new copy."""
-        return Event(self.name, list(self.properties), self.fmt,
-                     self.args.copy(), self.lineno, self.filename,
-                     self, self.event_trans, self.event_exec)
 
     @staticmethod
     def build(line_str, lineno, filename):
@@ -302,8 +277,7 @@ class Event(object):
         name = groups["name"]
         props = groups["props"].split()
         fmt = groups["fmt"]
-        fmt_trans = groups["fmt_trans"]
-        if fmt.find("%m") != -1 or fmt_trans.find("%m") != -1:
+        if fmt.find("%m") != -1:
             raise ValueError("Event format '%m' is forbidden, pass the error "
                              "as an explicit trace argument")
         if fmt.endswith(r'\n"'):
@@ -312,29 +286,22 @@ class Event(object):
         if '\\n' in fmt:
             raise ValueError("Event format must not use new line character")
 
-        if len(fmt_trans) > 0:
-            fmt = [fmt_trans, fmt]
         args = Arguments.build(groups["args"])
 
         return Event(name, props, fmt, args, lineno, posix_relpath(filename))
 
     def __repr__(self):
         """Evaluable string representation for this object."""
-        if isinstance(self.fmt, str):
-            fmt = self.fmt
-        else:
-            fmt = "%s, %s" % (self.fmt[0], self.fmt[1])
         return "Event('%s %s(%s) %s')" % (" ".join(self.properties),
                                           self.name,
                                           self.args,
-                                          fmt)
+                                          self.fmt)
     # Star matching on PRI is dangerous as one might have multiple
     # arguments with that format, hence the non-greedy version of it.
     _FMT = re.compile(r"(%[\d\.]*\w+|%.*?PRI\S+)")
 
     def formats(self):
         """List conversion specifiers in the argument print format string."""
-        assert not isinstance(self.fmt, list)
         return self._FMT.findall(self.fmt)
 
     QEMU_TRACE               = "trace_%(name)s"
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index b42a8268a8..bd9e0ca7f2 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -40,11 +40,6 @@ def generate(events, backend, group):
             enabled = 0
         else:
             enabled = 1
-        if "tcg-exec" in e.properties:
-            # a single define for the two "sub-events"
-            out('#define TRACE_%(name)s_ENABLED %(enabled)d',
-                name=e.original.name.upper(),
-                enabled=enabled)
         out('#define TRACE_%s_ENABLED %d' % (e.name.upper(), enabled))
 
     backend.generate_begin(events, group)
diff --git a/scripts/tracetool/format/log_stap.py b/scripts/tracetool/format/log_stap.py
index 710d62bffe..5b1bbe907f 100644
--- a/scripts/tracetool/format/log_stap.py
+++ b/scripts/tracetool/format/log_stap.py
@@ -18,8 +18,6 @@ from tracetool.backend.dtrace import binary, probeprefix
 from tracetool.backend.simple import is_string
 from tracetool.format.stap import stap_escape
 
-def global_var_name(name):
-    return probeprefix().replace(".", "_") + "_" + name
 
 STATE_SKIP = 0
 STATE_LITERAL = 1
diff --git a/scripts/tracetool/format/simpletrace_stap.py b/scripts/tracetool/format/simpletrace_stap.py
index 72971133bf..ac39a492d9 100644
--- a/scripts/tracetool/format/simpletrace_stap.py
+++ b/scripts/tracetool/format/simpletrace_stap.py
@@ -17,8 +17,6 @@ from tracetool.backend.dtrace import probeprefix
 from tracetool.backend.simple import is_string
 from tracetool.format.stap import stap_escape
 
-def global_var_name(name):
-    return probeprefix().replace(".", "_") + "_" + name
 
 def generate(events, backend, group):
     out('/* This file is autogenerated by tracetool, do not edit. */',

From 20b92da6db74490a6ffdf01f3ec8d99fcb7c2c18 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:25 +0200
Subject: [PATCH 0825/2396] treewide: remove unnessary "coding" header

The "-*- coding: utf-8 -*-" header was needed in Python 2,
but in Python 3 UTF-8 is already the default encoding of
source files.

It is even less necessary in .css files that do not have UTF-8
sequences at all.

Suggested-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-4-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/conf.py                                   | 2 --
 docs/sphinx-static/theme_overrides.css         | 3 +--
 scripts/analyse-locks-simpletrace.py           | 1 -
 scripts/modinfo-collect.py                     | 1 -
 scripts/modinfo-generate.py                    | 1 -
 scripts/oss-fuzz/minimize_qtest_trace.py       | 1 -
 scripts/oss-fuzz/output_reproducer.py          | 1 -
 scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py | 1 -
 scripts/probe-gdb-support.py                   | 1 -
 scripts/qapi/error.py                          | 2 --
 scripts/qapi/expr.py                           | 2 --
 scripts/qapi/gen.py                            | 2 --
 scripts/qapi/parser.py                         | 2 --
 scripts/qapi/schema.py                         | 2 --
 scripts/qemu-plugin-symbols.py                 | 1 -
 scripts/qemugdb/tcg.py                         | 2 --
 scripts/qemugdb/timers.py                      | 1 -
 scripts/replay-dump.py                         | 1 -
 scripts/tracetool.py                           | 1 -
 scripts/tracetool/__init__.py                  | 2 --
 scripts/tracetool/backend/__init__.py          | 2 --
 scripts/tracetool/backend/dtrace.py            | 2 --
 scripts/tracetool/backend/ftrace.py            | 2 --
 scripts/tracetool/backend/log.py               | 2 --
 scripts/tracetool/backend/simple.py            | 2 --
 scripts/tracetool/backend/syslog.py            | 2 --
 scripts/tracetool/backend/ust.py               | 2 --
 scripts/tracetool/format/__init__.py           | 2 --
 scripts/tracetool/format/c.py                  | 2 --
 scripts/tracetool/format/d.py                  | 2 --
 scripts/tracetool/format/h.py                  | 2 --
 scripts/tracetool/format/log_stap.py           | 2 --
 scripts/tracetool/format/simpletrace_stap.py   | 2 --
 scripts/tracetool/format/stap.py               | 2 --
 scripts/tracetool/format/ust_events_c.py       | 2 --
 scripts/tracetool/format/ust_events_h.py       | 2 --
 36 files changed, 1 insertion(+), 61 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index e09769e5f8..0c9ec74097 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # QEMU documentation build configuration file, created by
 # sphinx-quickstart on Thu Jan 31 16:40:14 2019.
 #
diff --git a/docs/sphinx-static/theme_overrides.css b/docs/sphinx-static/theme_overrides.css
index b225bf706f..f312e9b57e 100644
--- a/docs/sphinx-static/theme_overrides.css
+++ b/docs/sphinx-static/theme_overrides.css
@@ -1,5 +1,4 @@
-/* -*- coding: utf-8; mode: css -*-
- *
+/*
  * Sphinx HTML theme customization: read the doc
  * Based on Linux Documentation/sphinx-static/theme_overrides.css
  */
diff --git a/scripts/analyse-locks-simpletrace.py b/scripts/analyse-locks-simpletrace.py
index d650dd7140..bd04cd43c9 100755
--- a/scripts/analyse-locks-simpletrace.py
+++ b/scripts/analyse-locks-simpletrace.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 #
 # Analyse lock events and compute statistics
 #
diff --git a/scripts/modinfo-collect.py b/scripts/modinfo-collect.py
index 48bd92bd61..6ebaea989d 100644
--- a/scripts/modinfo-collect.py
+++ b/scripts/modinfo-collect.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 import os
 import sys
diff --git a/scripts/modinfo-generate.py b/scripts/modinfo-generate.py
index b1538fcced..aaf23544c4 100644
--- a/scripts/modinfo-generate.py
+++ b/scripts/modinfo-generate.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 import os
 import sys
diff --git a/scripts/oss-fuzz/minimize_qtest_trace.py b/scripts/oss-fuzz/minimize_qtest_trace.py
index d1f3990c16..414a6d91dd 100755
--- a/scripts/oss-fuzz/minimize_qtest_trace.py
+++ b/scripts/oss-fuzz/minimize_qtest_trace.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 """
 This takes a crashing qtest trace and tries to remove superfluous operations
diff --git a/scripts/oss-fuzz/output_reproducer.py b/scripts/oss-fuzz/output_reproducer.py
index e8ef76b341..0df96cf958 100755
--- a/scripts/oss-fuzz/output_reproducer.py
+++ b/scripts/oss-fuzz/output_reproducer.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 """
 Convert plain qtest traces to C or Bash reproducers
diff --git a/scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py b/scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py
index b154a25508..8af0d5d9c4 100755
--- a/scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py
+++ b/scripts/oss-fuzz/reorder_fuzzer_qtest_trace.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 """
 Use this to convert qtest log info from a generic fuzzer input into a qtest
diff --git a/scripts/probe-gdb-support.py b/scripts/probe-gdb-support.py
index 6bcadce150..43c7030287 100644
--- a/scripts/probe-gdb-support.py
+++ b/scripts/probe-gdb-support.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# coding: utf-8
 #
 # Probe gdb for supported architectures.
 #
diff --git a/scripts/qapi/error.py b/scripts/qapi/error.py
index e35e4ddb26..f73bc553db 100644
--- a/scripts/qapi/error.py
+++ b/scripts/qapi/error.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # Copyright (c) 2017-2019 Red Hat Inc.
 #
 # Authors:
diff --git a/scripts/qapi/expr.py b/scripts/qapi/expr.py
index cae0a08359..f40b247f8b 100644
--- a/scripts/qapi/expr.py
+++ b/scripts/qapi/expr.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # Copyright IBM, Corp. 2011
 # Copyright (c) 2013-2021 Red Hat Inc.
 #
diff --git a/scripts/qapi/gen.py b/scripts/qapi/gen.py
index d3c56d45c8..0c9b8db3b0 100644
--- a/scripts/qapi/gen.py
+++ b/scripts/qapi/gen.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # QAPI code generation
 #
 # Copyright (c) 2015-2019 Red Hat Inc.
diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index 2529edf81a..9fbf80a541 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # QAPI schema parser
 #
 # Copyright IBM, Corp. 2011
diff --git a/scripts/qapi/schema.py b/scripts/qapi/schema.py
index 3abddea352..8d88b40de2 100644
--- a/scripts/qapi/schema.py
+++ b/scripts/qapi/schema.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # QAPI schema internal representation
 #
 # Copyright (c) 2015-2019 Red Hat Inc.
diff --git a/scripts/qemu-plugin-symbols.py b/scripts/qemu-plugin-symbols.py
index e285ebb8f9..69644979c1 100755
--- a/scripts/qemu-plugin-symbols.py
+++ b/scripts/qemu-plugin-symbols.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 #
 # Extract QEMU Plugin API symbols from a header file
 #
diff --git a/scripts/qemugdb/tcg.py b/scripts/qemugdb/tcg.py
index 16c03c06a9..22529c7277 100644
--- a/scripts/qemugdb/tcg.py
+++ b/scripts/qemugdb/tcg.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-#
 # GDB debugging support, TCG status
 #
 # Copyright 2016 Linaro Ltd
diff --git a/scripts/qemugdb/timers.py b/scripts/qemugdb/timers.py
index 46537b27cf..5714f92cc2 100644
--- a/scripts/qemugdb/timers.py
+++ b/scripts/qemugdb/timers.py
@@ -1,4 +1,3 @@
-# -*- coding: utf-8 -*-
 # GDB debugging support
 #
 # Copyright 2017 Linaro Ltd
diff --git a/scripts/replay-dump.py b/scripts/replay-dump.py
index 4ce7ff51cc..097636570d 100755
--- a/scripts/replay-dump.py
+++ b/scripts/replay-dump.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 #
 # Dump the contents of a recorded execution stream
 #
diff --git a/scripts/tracetool.py b/scripts/tracetool.py
index 5de9ce96d3..0fdc9cb947 100755
--- a/scripts/tracetool.py
+++ b/scripts/tracetool.py
@@ -1,5 +1,4 @@
 #!/usr/bin/env python3
-# -*- coding: utf-8 -*-
 
 """
 Command-line wrapper for the tracetool machinery.
diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 4ef1dc1fca..9dd8ec27e1 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Machinery for generating tracing-related intermediate files.
 """
diff --git a/scripts/tracetool/backend/__init__.py b/scripts/tracetool/backend/__init__.py
index 6c6344dedd..7040130919 100644
--- a/scripts/tracetool/backend/__init__.py
+++ b/scripts/tracetool/backend/__init__.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Backend management.
 
diff --git a/scripts/tracetool/backend/dtrace.py b/scripts/tracetool/backend/dtrace.py
index e17edc9b9d..4835454193 100644
--- a/scripts/tracetool/backend/dtrace.py
+++ b/scripts/tracetool/backend/dtrace.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 DTrace/SystemTAP backend.
 """
diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index 5fa30ccc08..e6317ca4bf 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Ftrace built-in backend.
 """
diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index eb50ceea34..9842522b18 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Stderr built-in backend.
 """
diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index 7c84c06b20..066e5e9f11 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Simple built-in backend.
 """
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 3f82e54aab..74af038089 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Syslog built-in backend.
 """
diff --git a/scripts/tracetool/backend/ust.py b/scripts/tracetool/backend/ust.py
index c857516f21..6cc651646d 100644
--- a/scripts/tracetool/backend/ust.py
+++ b/scripts/tracetool/backend/ust.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 LTTng User Space Tracing backend.
 """
diff --git a/scripts/tracetool/format/__init__.py b/scripts/tracetool/format/__init__.py
index 042fe7d103..94a37bfce9 100644
--- a/scripts/tracetool/format/__init__.py
+++ b/scripts/tracetool/format/__init__.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Format management.
 
diff --git a/scripts/tracetool/format/c.py b/scripts/tracetool/format/c.py
index e473fb6c6e..3c4398c237 100644
--- a/scripts/tracetool/format/c.py
+++ b/scripts/tracetool/format/c.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 trace/generated-tracers.c
 """
diff --git a/scripts/tracetool/format/d.py b/scripts/tracetool/format/d.py
index a5e096e214..684598c183 100644
--- a/scripts/tracetool/format/d.py
+++ b/scripts/tracetool/format/d.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 trace/generated-tracers.dtrace (DTrace only).
 """
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index bd9e0ca7f2..2119753be1 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 trace/generated-tracers.h
 """
diff --git a/scripts/tracetool/format/log_stap.py b/scripts/tracetool/format/log_stap.py
index 5b1bbe907f..02f23bfb8d 100644
--- a/scripts/tracetool/format/log_stap.py
+++ b/scripts/tracetool/format/log_stap.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Generate .stp file that printfs log messages (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/simpletrace_stap.py b/scripts/tracetool/format/simpletrace_stap.py
index ac39a492d9..3c3584a931 100644
--- a/scripts/tracetool/format/simpletrace_stap.py
+++ b/scripts/tracetool/format/simpletrace_stap.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Generate .stp file that outputs simpletrace binary traces (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/stap.py b/scripts/tracetool/format/stap.py
index 4d77fbc11a..04c7a35a25 100644
--- a/scripts/tracetool/format/stap.py
+++ b/scripts/tracetool/format/stap.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 Generate .stp file (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/ust_events_c.py b/scripts/tracetool/format/ust_events_c.py
index 569754a304..ea5f0ae99f 100644
--- a/scripts/tracetool/format/ust_events_c.py
+++ b/scripts/tracetool/format/ust_events_c.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 trace/generated-ust.c
 """
diff --git a/scripts/tracetool/format/ust_events_h.py b/scripts/tracetool/format/ust_events_h.py
index 2a31fefeca..242c9814fd 100644
--- a/scripts/tracetool/format/ust_events_h.py
+++ b/scripts/tracetool/format/ust_events_h.py
@@ -1,5 +1,3 @@
-# -*- coding: utf-8 -*-
-
 """
 trace/generated-ust-provider.h
 """

From 6f94ad27f0014c04a2aa403988acc22740a21196 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:26 +0200
Subject: [PATCH 0826/2396] tracetool: add SPDX headers

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-5-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py                | 2 ++
 scripts/tracetool/backend/__init__.py        | 2 ++
 scripts/tracetool/backend/dtrace.py          | 2 ++
 scripts/tracetool/backend/ftrace.py          | 2 ++
 scripts/tracetool/backend/log.py             | 2 ++
 scripts/tracetool/backend/simple.py          | 2 ++
 scripts/tracetool/backend/syslog.py          | 2 ++
 scripts/tracetool/backend/ust.py             | 2 ++
 scripts/tracetool/format/__init__.py         | 2 ++
 scripts/tracetool/format/c.py                | 2 ++
 scripts/tracetool/format/d.py                | 2 ++
 scripts/tracetool/format/h.py                | 2 ++
 scripts/tracetool/format/log_stap.py         | 2 ++
 scripts/tracetool/format/simpletrace_stap.py | 2 ++
 scripts/tracetool/format/stap.py             | 2 ++
 scripts/tracetool/format/ust_events_c.py     | 2 ++
 scripts/tracetool/format/ust_events_h.py     | 2 ++
 17 files changed, 34 insertions(+)

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index 9dd8ec27e1..c4fa0f74e6 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Machinery for generating tracing-related intermediate files.
 """
diff --git a/scripts/tracetool/backend/__init__.py b/scripts/tracetool/backend/__init__.py
index 7040130919..bf91e443e9 100644
--- a/scripts/tracetool/backend/__init__.py
+++ b/scripts/tracetool/backend/__init__.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Backend management.
 
diff --git a/scripts/tracetool/backend/dtrace.py b/scripts/tracetool/backend/dtrace.py
index 4835454193..b4af403025 100644
--- a/scripts/tracetool/backend/dtrace.py
+++ b/scripts/tracetool/backend/dtrace.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 DTrace/SystemTAP backend.
 """
diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index e6317ca4bf..a14aafcee6 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Ftrace built-in backend.
 """
diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index 9842522b18..faacec4610 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Stderr built-in backend.
 """
diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index 066e5e9f11..97e40495ee 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Simple built-in backend.
 """
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 74af038089..78ee67136b 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Syslog built-in backend.
 """
diff --git a/scripts/tracetool/backend/ust.py b/scripts/tracetool/backend/ust.py
index 6cc651646d..3aa9bb1da2 100644
--- a/scripts/tracetool/backend/ust.py
+++ b/scripts/tracetool/backend/ust.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 LTTng User Space Tracing backend.
 """
diff --git a/scripts/tracetool/format/__init__.py b/scripts/tracetool/format/__init__.py
index 94a37bfce9..7b9d1b5782 100644
--- a/scripts/tracetool/format/__init__.py
+++ b/scripts/tracetool/format/__init__.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Format management.
 
diff --git a/scripts/tracetool/format/c.py b/scripts/tracetool/format/c.py
index 3c4398c237..50e03313cb 100644
--- a/scripts/tracetool/format/c.py
+++ b/scripts/tracetool/format/c.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 trace/generated-tracers.c
 """
diff --git a/scripts/tracetool/format/d.py b/scripts/tracetool/format/d.py
index 684598c183..e9e33dfe30 100644
--- a/scripts/tracetool/format/d.py
+++ b/scripts/tracetool/format/d.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 trace/generated-tracers.dtrace (DTrace only).
 """
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index 2119753be1..be7f32e67b 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 trace/generated-tracers.h
 """
diff --git a/scripts/tracetool/format/log_stap.py b/scripts/tracetool/format/log_stap.py
index 02f23bfb8d..259303a189 100644
--- a/scripts/tracetool/format/log_stap.py
+++ b/scripts/tracetool/format/log_stap.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Generate .stp file that printfs log messages (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/simpletrace_stap.py b/scripts/tracetool/format/simpletrace_stap.py
index 3c3584a931..c7bde97a85 100644
--- a/scripts/tracetool/format/simpletrace_stap.py
+++ b/scripts/tracetool/format/simpletrace_stap.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Generate .stp file that outputs simpletrace binary traces (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/stap.py b/scripts/tracetool/format/stap.py
index 04c7a35a25..285c9203ba 100644
--- a/scripts/tracetool/format/stap.py
+++ b/scripts/tracetool/format/stap.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 Generate .stp file (DTrace with SystemTAP only).
 """
diff --git a/scripts/tracetool/format/ust_events_c.py b/scripts/tracetool/format/ust_events_c.py
index ea5f0ae99f..074226bfd3 100644
--- a/scripts/tracetool/format/ust_events_c.py
+++ b/scripts/tracetool/format/ust_events_c.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 trace/generated-ust.c
 """
diff --git a/scripts/tracetool/format/ust_events_h.py b/scripts/tracetool/format/ust_events_h.py
index 242c9814fd..cee7970a40 100644
--- a/scripts/tracetool/format/ust_events_h.py
+++ b/scripts/tracetool/format/ust_events_h.py
@@ -1,3 +1,5 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
 """
 trace/generated-ust-provider.h
 """

From 02d4a4a674d45d41c9afd1fd161c14eca81f7a86 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:27 +0200
Subject: [PATCH 0827/2396] trace/ftrace: move snprintf+write from tracepoints
 to ftrace.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This simplifies the Python code and reduces the size of the tracepoints.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250929154938.594389-6-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/ftrace.py | 12 ++----------
 tests/tracetool/ftrace.h            | 28 ++++++----------------------
 trace/ftrace.c                      | 15 +++++++++++++++
 trace/ftrace.h                      |  1 +
 4 files changed, 24 insertions(+), 32 deletions(-)

diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index a14aafcee6..8c0ce3f23a 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -28,18 +28,10 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    out('    {',
-        '        char ftrace_buf[MAX_TRACE_STRLEN];',
-        '        int unused __attribute__ ((unused));',
-        '        int trlen;',
-        '        if (trace_event_get_state(%(event_id)s)) {',
+    out('    if (trace_event_get_state(%(event_id)s)) {',
         '#line %(event_lineno)d "%(event_filename)s"',
-        '            trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,',
-        '                             "%(name)s " %(fmt)s "\\n" %(argnames)s);',
+        '        ftrace_write("%(name)s " %(fmt)s "\\n" %(argnames)s);',
         '#line %(out_next_lineno)d "%(out_filename)s"',
-        '            trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);',
-        '            unused = write(trace_marker_fd, ftrace_buf, trlen);',
-        '        }',
         '    }',
         name=event.name,
         args=event.args,
diff --git a/tests/tracetool/ftrace.h b/tests/tracetool/ftrace.h
index fe22ea0f09..1dfe423941 100644
--- a/tests/tracetool/ftrace.h
+++ b/tests/tracetool/ftrace.h
@@ -21,18 +21,10 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
 
 static inline void trace_test_blah(void *context, const char *filename)
 {
-    {
-        char ftrace_buf[MAX_TRACE_STRLEN];
-        int unused __attribute__ ((unused));
-        int trlen;
-        if (trace_event_get_state(TRACE_TEST_BLAH)) {
+    if (trace_event_get_state(TRACE_TEST_BLAH)) {
 #line 4 "trace-events"
-            trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,
-                             "test_blah " "Blah context=%p filename=%s" "\n" , context, filename);
-#line 33 "ftrace.h"
-            trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
-            unused = write(trace_marker_fd, ftrace_buf, trlen);
-        }
+        ftrace_write("test_blah " "Blah context=%p filename=%s" "\n" , context, filename);
+#line 28 "ftrace.h"
     }
 }
 
@@ -42,18 +34,10 @@ static inline void trace_test_blah(void *context, const char *filename)
 
 static inline void trace_test_wibble(void *context, int value)
 {
-    {
-        char ftrace_buf[MAX_TRACE_STRLEN];
-        int unused __attribute__ ((unused));
-        int trlen;
-        if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
+    if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
 #line 5 "trace-events"
-            trlen = snprintf(ftrace_buf, MAX_TRACE_STRLEN,
-                             "test_wibble " "Wibble context=%p value=%d" "\n" , context, value);
-#line 54 "ftrace.h"
-            trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
-            unused = write(trace_marker_fd, ftrace_buf, trlen);
-        }
+        ftrace_write("test_wibble " "Wibble context=%p value=%d" "\n" , context, value);
+#line 41 "ftrace.h"
     }
 }
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */
diff --git a/trace/ftrace.c b/trace/ftrace.c
index 9749543d9b..6875faedb9 100644
--- a/trace/ftrace.c
+++ b/trace/ftrace.c
@@ -38,6 +38,21 @@ static int find_mount(char *mount_point, const char *fstype)
     return ret;
 }
 
+void ftrace_write(const char *fmt, ...)
+{
+    char ftrace_buf[MAX_TRACE_STRLEN];
+    int unused __attribute__ ((unused));
+    int trlen;
+    va_list ap;
+
+    va_start(ap, fmt);
+    trlen = vsnprintf(ftrace_buf, MAX_TRACE_STRLEN, fmt, ap);
+    va_end(ap);
+
+    trlen = MIN(trlen, MAX_TRACE_STRLEN - 1);
+    unused = write(trace_marker_fd, ftrace_buf, trlen);
+}
+
 bool ftrace_init(void)
 {
     char mount_point[PATH_MAX];
diff --git a/trace/ftrace.h b/trace/ftrace.h
index cb5e35d217..16c122816d 100644
--- a/trace/ftrace.h
+++ b/trace/ftrace.h
@@ -8,5 +8,6 @@
 extern int trace_marker_fd;
 
 bool ftrace_init(void);
+G_GNUC_PRINTF(1, 2) void ftrace_write(const char *fmt, ...);
 
 #endif /* TRACE_FTRACE_H */

From 809caa0d40a853144c02456737ed1e47859b0308 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:28 +0200
Subject: [PATCH 0828/2396] tracetool: add CHECK_TRACE_EVENT_GET_STATE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a new attribute CHECK_TRACE_EVENT_GET_STATE to the backends.
When present and True, the code generated by the generate function
is wrapped in a conditional that checks whether the event is enabled;
this removes the need for repeating the same conditional in multiple
backends.

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250929154938.594389-7-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/__init__.py | 39 ++++++++++++++++++---------
 scripts/tracetool/format/h.py         | 11 +++++---
 2 files changed, 35 insertions(+), 15 deletions(-)

diff --git a/scripts/tracetool/backend/__init__.py b/scripts/tracetool/backend/__init__.py
index bf91e443e9..9109a783c7 100644
--- a/scripts/tracetool/backend/__init__.py
+++ b/scripts/tracetool/backend/__init__.py
@@ -19,11 +19,15 @@ All backends must generate their contents through the 'tracetool.out' routine.
 Backend attributes
 ------------------
 
-========= ====================================================================
-Attribute Description
-========= ====================================================================
-PUBLIC    If exists and is set to 'True', the backend is considered "public".
-========= ====================================================================
+=========================== ====================================================
+Attribute                   Description
+=========================== ====================================================
+PUBLIC                      If exists and is set to 'True', the backend is
+                            considered "public".
+CHECK_TRACE_EVENT_GET_STATE If exists and is set to 'True', the backend-specific
+                            code inside the tracepoint is emitted within an
+                            ``if trace_event_get_state()`` conditional.
+=========================== ====================================================
 
 
 Backend functions
@@ -101,22 +105,33 @@ class Wrapper:
     def __init__(self, backends, format):
         self._backends = [backend.replace("-", "_") for backend in backends]
         self._format = format.replace("-", "_")
+        self.check_trace_event_get_state = False
         for backend in self._backends:
             assert exists(backend)
         assert tracetool.format.exists(self._format)
+        for backend in self.backend_modules():
+            check_trace_event_get_state = getattr(backend, "CHECK_TRACE_EVENT_GET_STATE", False)
+            self.check_trace_event_get_state = self.check_trace_event_get_state or check_trace_event_get_state
 
-    def _run_function(self, name, *args, **kwargs):
+    def backend_modules(self):
         for backend in self._backends:
-            func = tracetool.try_import("tracetool.backend." + backend,
-                                        name % self._format, None)[1]
-            if func is not None:
-                func(*args, **kwargs)
+             module = tracetool.try_import("tracetool.backend." + backend)[1]
+             if module is not None:
+                 yield module
+
+    def _run_function(self, name, *args, check_trace_event_get_state=None, **kwargs):
+        for backend in self.backend_modules():
+            func = getattr(backend, name % self._format, None)
+            if func is not None and \
+                (check_trace_event_get_state is None or
+                 check_trace_event_get_state == getattr(backend, 'CHECK_TRACE_EVENT_GET_STATE', False)):
+                    func(*args, **kwargs)
 
     def generate_begin(self, events, group):
         self._run_function("generate_%s_begin", events, group)
 
-    def generate(self, event, group):
-        self._run_function("generate_%s", event, group)
+    def generate(self, event, group, check_trace_event_get_state=None):
+        self._run_function("generate_%s", event, group, check_trace_event_get_state=check_trace_event_get_state)
 
     def generate_backend_dstate(self, event, group):
         self._run_function("generate_%s_backend_dstate", event, group)
diff --git a/scripts/tracetool/format/h.py b/scripts/tracetool/format/h.py
index be7f32e67b..dd58713a15 100644
--- a/scripts/tracetool/format/h.py
+++ b/scripts/tracetool/format/h.py
@@ -55,7 +55,6 @@ def generate(events, backend, group):
 
         out('    false)')
 
-        # tracer without checks
         out('',
             'static inline void %(api)s(%(args)s)',
             '{',
@@ -63,11 +62,17 @@ def generate(events, backend, group):
             args=e.args)
 
         if "disable" not in e.properties:
-            backend.generate(e, group)
+            backend.generate(e, group, check_trace_event_get_state=False)
 
+            if backend.check_trace_event_get_state:
+                event_id = 'TRACE_' + e.name.upper()
+                cond = "trace_event_get_state(%s)" % event_id
+                out('    if (%(cond)s) {',
+                        cond=cond)
+                backend.generate(e, group, check_trace_event_get_state=True)
+                out('    }')
         out('}')
 
-
     backend.generate_end(events, group)
 
     out('#endif /* TRACE_%s_GENERATED_TRACERS_H */' % group.upper())

From 494492c5c5a145e04f3ebc9eb40fd34ffbcc2061 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:29 +0200
Subject: [PATCH 0829/2396] tracetool/backend: remove redundant trace event
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use CHECK_TRACE_EVENT_GET_STATE in log, syslog, dtrace and simple
backend, so that the "if (trace_event_get_state)" is created from common
code and unified when multiple backends are active.

When a single backend is active there is no code change (except
for the log backend, as shown in tests/tracetool/log.h), but the
code in the backends is simpler.

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250929154938.594389-8-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/ftrace.py |  6 ++----
 scripts/tracetool/backend/log.py    | 10 ++++------
 scripts/tracetool/backend/simple.py |  8 ++------
 scripts/tracetool/backend/syslog.py |  8 ++------
 tests/tracetool/log.h               | 16 ++++++++++------
 5 files changed, 20 insertions(+), 28 deletions(-)

diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index 8c0ce3f23a..7ddd5d11a6 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -16,6 +16,7 @@ from tracetool import out
 
 
 PUBLIC = True
+CHECK_TRACE_EVENT_GET_STATE = True
 
 
 def generate_h_begin(events, group):
@@ -28,14 +29,11 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    out('    if (trace_event_get_state(%(event_id)s)) {',
-        '#line %(event_lineno)d "%(event_filename)s"',
+    out('#line %(event_lineno)d "%(event_filename)s"',
         '        ftrace_write("%(name)s " %(fmt)s "\\n" %(argnames)s);',
         '#line %(out_next_lineno)d "%(out_filename)s"',
-        '    }',
         name=event.name,
         args=event.args,
-        event_id="TRACE_" + event.name.upper(),
         event_lineno=event.lineno,
         event_filename=event.filename,
         fmt=event.fmt.rstrip("\n"),
diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index faacec4610..d01d234289 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -16,6 +16,7 @@ from tracetool import out
 
 
 PUBLIC = True
+CHECK_TRACE_EVENT_GET_STATE = True
 
 
 def generate_h_begin(events, group):
@@ -28,14 +29,11 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
-
-    out('    if (%(cond)s && qemu_loglevel_mask(LOG_TRACE)) {',
+    out('        if (qemu_loglevel_mask(LOG_TRACE)) {',
         '#line %(event_lineno)d "%(event_filename)s"',
-        '        qemu_log("%(name)s " %(fmt)s "\\n"%(argnames)s);',
+        '            qemu_log("%(name)s " %(fmt)s "\\n"%(argnames)s);',
         '#line %(out_next_lineno)d "%(out_filename)s"',
-        '    }',
-        cond=cond,
+        '        }',
         event_lineno=event.lineno,
         event_filename=event.filename,
         name=event.name,
diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index 97e40495ee..b5a6b7205a 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -16,6 +16,7 @@ from tracetool import out
 
 
 PUBLIC = True
+CHECK_TRACE_EVENT_GET_STATE = True
 
 
 def is_string(arg):
@@ -36,13 +37,8 @@ def generate_h_begin(events, group):
 
 
 def generate_h(event, group):
-    event_id = 'TRACE_' + event.name.upper()
-    cond = "trace_event_get_state(%s)" % event_id
-    out('    if (%(cond)s) {',
-        '        _simple_%(api)s(%(args)s);',
-        '    }',
+    out('        _simple_%(api)s(%(args)s);',
         api=event.api(),
-        cond=cond,
         args=", ".join(event.args.names()))
 
 
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 78ee67136b..177414d56a 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -16,6 +16,7 @@ from tracetool import out
 
 
 PUBLIC = True
+CHECK_TRACE_EVENT_GET_STATE = True
 
 
 def generate_h_begin(events, group):
@@ -28,14 +29,9 @@ def generate_h(event, group):
     if len(event.args) > 0:
         argnames = ", " + argnames
 
-    cond = "trace_event_get_state(%s)" % ("TRACE_" + event.name.upper())
-
-    out('    if (%(cond)s) {',
-        '#line %(event_lineno)d "%(event_filename)s"',
+    out('#line %(event_lineno)d "%(event_filename)s"',
         '        syslog(LOG_INFO, "%(name)s " %(fmt)s %(argnames)s);',
         '#line %(out_next_lineno)d "%(out_filename)s"',
-        '    }',
-        cond=cond,
         event_lineno=event.lineno,
         event_filename=event.filename,
         name=event.name,
diff --git a/tests/tracetool/log.h b/tests/tracetool/log.h
index edcc7f9d47..c7795871f8 100644
--- a/tests/tracetool/log.h
+++ b/tests/tracetool/log.h
@@ -21,10 +21,12 @@ extern uint16_t _TRACE_TEST_WIBBLE_DSTATE;
 
 static inline void trace_test_blah(void *context, const char *filename)
 {
-    if (trace_event_get_state(TRACE_TEST_BLAH) && qemu_loglevel_mask(LOG_TRACE)) {
+    if (trace_event_get_state(TRACE_TEST_BLAH)) {
+        if (qemu_loglevel_mask(LOG_TRACE)) {
 #line 4 "trace-events"
-        qemu_log("test_blah " "Blah context=%p filename=%s" "\n", context, filename);
-#line 28 "log.h"
+            qemu_log("test_blah " "Blah context=%p filename=%s" "\n", context, filename);
+#line 29 "log.h"
+        }
     }
 }
 
@@ -34,10 +36,12 @@ static inline void trace_test_blah(void *context, const char *filename)
 
 static inline void trace_test_wibble(void *context, int value)
 {
-    if (trace_event_get_state(TRACE_TEST_WIBBLE) && qemu_loglevel_mask(LOG_TRACE)) {
+    if (trace_event_get_state(TRACE_TEST_WIBBLE)) {
+        if (qemu_loglevel_mask(LOG_TRACE)) {
 #line 5 "trace-events"
-        qemu_log("test_wibble " "Wibble context=%p value=%d" "\n", context, value);
-#line 41 "log.h"
+            qemu_log("test_wibble " "Wibble context=%p value=%d" "\n", context, value);
+#line 44 "log.h"
+        }
     }
 }
 #endif /* TRACE_TESTSUITE_GENERATED_TRACERS_H */

From e2e182bef73f24d885f7f2ca589d8ec004c24877 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:30 +0200
Subject: [PATCH 0830/2396] tracetool: Add Rust format support

Generating .rs files makes it possible to support tracing in rust.
This support comprises a new format, and common code that converts
the C expressions in trace-events to Rust.  In particular, types
need to be converted, and PRI macros expanded.

As of this commit no backend generates Rust code, but it is already
possible to use tracetool to generate Rust sources; they are not
functional but they compile and contain tracepoint functions.

[Move Rust argument conversion from Event to Arguments; string
 support. - Paolo]

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-9-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/__init__.py  | 155 +++++++++++++++++++++++++++++++++
 scripts/tracetool/format/rs.py |  64 ++++++++++++++
 2 files changed, 219 insertions(+)
 create mode 100644 scripts/tracetool/format/rs.py

diff --git a/scripts/tracetool/__init__.py b/scripts/tracetool/__init__.py
index c4fa0f74e6..74062d21a7 100644
--- a/scripts/tracetool/__init__.py
+++ b/scripts/tracetool/__init__.py
@@ -30,6 +30,49 @@ def error(*lines):
     error_write(*lines)
     sys.exit(1)
 
+FMT_TOKEN = re.compile(r'''(?:
+                       " ( (?: [^"\\] | \\[\\"abfnrt] |            # a string literal
+                               \\x[0-9a-fA-F][0-9a-fA-F]) *? ) "
+                       | ( PRI [duixX] (?:8|16|32|64|PTR|MAX) )    # a PRIxxx macro
+                       | \s+                                       # spaces (ignored)
+                       )''', re.X)
+
+PRI_SIZE_MAP = {
+    '8':  'hh',
+    '16': 'h',
+    '32': '',
+    '64': 'll',
+    'PTR': 't',
+    'MAX': 'j',
+}
+
+def expand_format_string(c_fmt, prefix=""):
+    def pri_macro_to_fmt(pri_macro):
+        assert pri_macro.startswith("PRI")
+        fmt_type = pri_macro[3]  # 'd', 'i', 'u', or 'x'
+        fmt_size = pri_macro[4:]  # '8', '16', '32', '64', 'PTR', 'MAX'
+
+        size = PRI_SIZE_MAP.get(fmt_size, None)
+        if size is None:
+            raise Exception(f"unknown macro {pri_macro}")
+        return size + fmt_type
+
+    result = prefix
+    pos = 0
+    while pos < len(c_fmt):
+        m = FMT_TOKEN.match(c_fmt, pos)
+        if not m:
+            print("No match at position", pos, ":", repr(c_fmt[pos:]), file=sys.stderr)
+            raise Exception("syntax error in trace file")
+        if m[1]:
+            substr = m[1]
+        elif m[2]:
+            substr = pri_macro_to_fmt(m[2])
+        else:
+            substr = ""
+        result += substr
+        pos = m.end()
+    return result
 
 out_lineno = 1
 out_filename = '<none>'
@@ -89,6 +132,49 @@ ALLOWED_TYPES = [
     "ptrdiff_t",
 ]
 
+C_TYPE_KEYWORDS = {"char", "int", "void", "short", "long", "signed", "unsigned"}
+
+C_TO_RUST_TYPE_MAP = {
+    "int": "std::ffi::c_int",
+    "long": "std::ffi::c_long",
+    "long long": "std::ffi::c_longlong",
+    "short": "std::ffi::c_short",
+    "char": "std::ffi::c_char",
+    "bool": "bool",
+    "unsigned": "std::ffi::c_uint",
+    # multiple keywords, keep them sorted
+    "long unsigned": "std::ffi::c_long",
+    "long long unsigned": "std::ffi::c_ulonglong",
+    "short unsigned": "std::ffi::c_ushort",
+    "char unsigned": "u8",
+    "int8_t": "i8",
+    "uint8_t": "u8",
+    "int16_t": "i16",
+    "uint16_t": "u16",
+    "int32_t": "i32",
+    "uint32_t": "u32",
+    "int64_t": "i64",
+    "uint64_t": "u64",
+    "void": "()",
+    "size_t": "usize",
+    "ssize_t": "isize",
+    "uintptr_t": "usize",
+    "ptrdiff_t": "isize",
+}
+
+# Rust requires manual casting of <32-bit types when passing them to
+# variable-argument functions.
+RUST_VARARGS_SMALL_TYPES = {
+    "std::ffi::c_short",
+    "std::ffi::c_ushort",
+    "std::ffi::c_char",
+    "i8",
+    "u8",
+    "i16",
+    "u16",
+    "bool",
+}
+
 def validate_type(name):
     bits = name.split(" ")
     for bit in bits:
@@ -104,6 +190,38 @@ def validate_type(name):
                              "other complex pointer types should be "
                              "declared as 'void *'" % name)
 
+def c_type_to_rust(name):
+    ptr = False
+    const = False
+    name = name.rstrip()
+    if name[-1] == '*':
+        name = name[:-1].rstrip()
+        ptr = True
+        if name[-1] == '*':
+            # pointers to pointers are the same as void*
+            name = "void"
+
+    bits = name.split()
+    if "const" in bits:
+        const = True
+        bits.remove("const")
+    if bits[0] in C_TYPE_KEYWORDS:
+        if "signed" in bits:
+            bits.remove("signed")
+        if len(bits) > 1 and "int" in bits:
+            bits.remove("int")
+        bits.sort()
+        name = ' '.join(bits)
+    else:
+        if len(bits) > 1:
+            raise ValueError("Invalid type '%s'." % name)
+        name = bits[0]
+
+    ty = C_TO_RUST_TYPE_MAP[name.strip()]
+    if ptr:
+        ty = f'*{"const" if const else "mut"} {ty}'
+    return ty
+
 class Arguments:
     """Event arguments description."""
 
@@ -192,6 +310,43 @@ class Arguments:
         """List of argument names casted to their type."""
         return ["(%s)%s" % (type_, name) for type_, name in self._args]
 
+    def rust_decl_extern(self):
+        """Return a Rust argument list for an extern "C" function"""
+        return ", ".join((f"_{name}: {c_type_to_rust(type_)}"
+                          for type_, name in self._args))
+
+    def rust_decl(self):
+        """Return a Rust argument list for a tracepoint function"""
+        def decl_type(type_):
+            if type_ == "const char *":
+                return "&std::ffi::CStr"
+            return c_type_to_rust(type_)
+
+        return ", ".join((f"_{name}: {decl_type(type_)}"
+                          for type_, name in self._args))
+
+    def rust_call_extern(self):
+        """Return a Rust argument list for a call to an extern "C" function"""
+        def rust_cast(name, type_):
+            if type_ == "const char *":
+                return f"_{name}.as_ptr()"
+            return f"_{name}"
+
+        return ", ".join((rust_cast(name, type_) for type_, name in self._args))
+
+    def rust_call_varargs(self):
+        """Return a Rust argument list for a call to a C varargs function"""
+        def rust_cast(name, type_):
+            if type_ == "const char *":
+                return f"_{name}.as_ptr()"
+
+            type_ = c_type_to_rust(type_)
+            if type_ in RUST_VARARGS_SMALL_TYPES:
+                return f"_{name} as std::ffi::c_int"
+            return f"_{name} /* as {type_} */"
+
+        return ", ".join((rust_cast(name, type_) for type_, name in self._args))
+
 
 class Event(object):
     """Event description.
diff --git a/scripts/tracetool/format/rs.py b/scripts/tracetool/format/rs.py
new file mode 100644
index 0000000000..32ac4e5977
--- /dev/null
+++ b/scripts/tracetool/format/rs.py
@@ -0,0 +1,64 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+"""
+trace-DIR.rs
+"""
+
+__author__     = "Tanish Desai <tanishdesai37@gmail.com>"
+__copyright__  = "Copyright 2025, Tanish Desai <tanishdesai37@gmail.com>"
+__license__    = "GPL version 2 or (at your option) any later version"
+
+__maintainer__ = "Stefan Hajnoczi"
+__email__      = "stefanha@redhat.com"
+
+
+from tracetool import out
+
+
+def generate(events, backend, group):
+    out('// SPDX-License-Identifier: GPL-2.0-or-later',
+        '// This file is @generated by tracetool, do not edit.',
+        '',
+        '#[allow(unused_imports)]',
+        'use std::ffi::c_char;',
+        '#[allow(unused_imports)]',
+        'use util::bindings;',
+        '',
+        '#[inline(always)]',
+        'fn trace_event_state_is_enabled(dstate: u16) -> bool {',
+        '    (unsafe { trace_events_enabled_count }) != 0 && dstate != 0',
+        '}',
+        '',
+        'extern "C" {',
+        '    static mut trace_events_enabled_count: u32;',
+        '}',)
+
+    out('extern "C" {')
+
+    for e in events:
+        out('    static mut %s: u16;' % e.api(e.QEMU_DSTATE))
+    out('}')
+
+    backend.generate_begin(events, group)
+
+    for e in events:
+        out('',
+            '#[inline(always)]',
+            '#[allow(dead_code)]',
+            'pub fn %(api)s(%(args)s)',
+            '{',
+            api=e.api(e.QEMU_TRACE),
+            args=e.args.rust_decl())
+
+        if "disable" not in e.properties:
+            backend.generate(e, group, check_trace_event_get_state=False)
+            if backend.check_trace_event_get_state:
+                event_id = 'TRACE_' + e.name.upper()
+                out('    if trace_event_state_is_enabled(unsafe { _%(event_id)s_DSTATE}) {',
+                    event_id = event_id,
+                    api=e.api())
+                backend.generate(e, group, check_trace_event_get_state=True)
+                out('    }')
+        out('}')
+
+    backend.generate_end(events, group)

From 54140102d2e57bd2e34823e4537d2191cdcd5f08 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:31 +0200
Subject: [PATCH 0831/2396] rust: add trace crate

The trace crate is a minimal container for dependencies of tracepoints
(so that they do not have to be imported in all the crates that use
tracepoints); it also contains a macro called "include_trace!" that is
able to find the right include file from the trace/ directory.

[Write commit message, add #[allow()]. - Paolo]

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-10-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 rust/Cargo.lock        |  4 ++++
 rust/Cargo.toml        |  1 +
 rust/meson.build       |  2 +-
 rust/trace/Cargo.toml  | 16 ++++++++++++++++
 rust/trace/meson.build | 19 +++++++++++++++++++
 rust/trace/src/lib.rs  | 35 +++++++++++++++++++++++++++++++++++
 trace/meson.build      |  8 +++++++-
 7 files changed, 83 insertions(+), 2 deletions(-)
 create mode 100644 rust/trace/Cargo.toml
 create mode 100644 rust/trace/meson.build
 create mode 100644 rust/trace/src/lib.rs

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 8315f98c46..3428dbaf0b 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -258,6 +258,10 @@ dependencies = [
  "util",
 ]
 
+[[package]]
+name = "trace"
+version = "0.1.0"
+
 [[package]]
 name = "unicode-ident"
 version = "1.0.12"
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index d8183c614d..f372d7dbf7 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -11,6 +11,7 @@ members = [
     "hw/core",
     "hw/char/pl011",
     "hw/timer/hpet",
+    "trace",
     "util",
     "tests",
 ]
diff --git a/rust/meson.build b/rust/meson.build
index b3ac3a7197..695d5a62de 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -34,7 +34,7 @@ subdir('system')
 subdir('chardev')
 subdir('hw/core')
 subdir('tests')
-
+subdir('trace')
 subdir('hw')
 
 cargo = find_program('cargo', required: false)
diff --git a/rust/trace/Cargo.toml b/rust/trace/Cargo.toml
new file mode 100644
index 0000000000..13ac0b33d6
--- /dev/null
+++ b/rust/trace/Cargo.toml
@@ -0,0 +1,16 @@
+[package]
+name = "trace"
+version = "0.1.0"
+authors = ["Tanish Desai <tanishdesai37@gmail.com>"]
+description = "QEMU tracing infrastructure support"
+resolver = "2"
+publish = false
+
+edition.workspace = true
+homepage.workspace = true
+license.workspace = true
+repository.workspace = true
+rust-version.workspace = true
+
+[lints]
+workspace = true
diff --git a/rust/trace/meson.build b/rust/trace/meson.build
new file mode 100644
index 0000000000..adca57e550
--- /dev/null
+++ b/rust/trace/meson.build
@@ -0,0 +1,19 @@
+rust = import('rust')
+
+lib_rs = configure_file(
+  input: 'src/lib.rs',
+  output: 'lib.rs',
+  configuration: {
+    'MESON_BUILD_ROOT': meson.project_build_root(),
+  })
+
+_trace_rs = static_library(
+  'trace',             # Library name,
+  lib_rs,
+  trace_rs_targets,         # List of generated `.rs` custom targets
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  dependencies: [libc_rs],
+  rust_abi: 'rust',
+)
+
+trace_rs = declare_dependency(link_with: _trace_rs)
diff --git a/rust/trace/src/lib.rs b/rust/trace/src/lib.rs
new file mode 100644
index 0000000000..0955461573
--- /dev/null
+++ b/rust/trace/src/lib.rs
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+//! This crate provides macros that aid in using QEMU's tracepoint
+//! functionality.
+
+#[macro_export]
+/// Define the trace-points from the named directory (which should have slashes
+/// replaced by underscore characters) as functions in a module called `trace`.
+///
+/// ```ignore
+/// ::trace::include_trace!("hw_char");
+/// // ...
+/// trace::trace_pl011_read_fifo_rx_full();
+/// ```
+macro_rules! include_trace {
+    ($name:literal) => {
+        #[allow(
+            clippy::ptr_as_ptr,
+            clippy::cast_lossless,
+            clippy::used_underscore_binding
+        )]
+        mod trace {
+            #[cfg(not(MESON))]
+            include!(concat!(
+                env!("MESON_BUILD_ROOT"),
+                "/trace/trace-",
+                $name,
+                ".rs"
+            ));
+
+            #[cfg(MESON)]
+            include!(concat!("@MESON_BUILD_ROOT@/trace/trace-", $name, ".rs"));
+        }
+    };
+}
diff --git a/trace/meson.build b/trace/meson.build
index 9c42a57a05..d89a0db82a 100644
--- a/trace/meson.build
+++ b/trace/meson.build
@@ -1,5 +1,5 @@
 system_ss.add(files('control-target.c', 'trace-hmp-cmds.c'))
-
+trace_rs_targets = []
 trace_events_files = []
 foreach item : [ '.' ] + trace_events_subdirs + qapi_trace_events
   if item in qapi_trace_events
@@ -24,6 +24,11 @@ foreach item : [ '.' ] + trace_events_subdirs + qapi_trace_events
                           input: trace_events_file,
                           command: [ tracetool, group, '--format=c', '@INPUT@', '@OUTPUT@' ],
                           depend_files: tracetool_depends)
+  trace_rs = custom_target(fmt.format('trace', 'rs'),
+                          output: fmt.format('trace', 'rs'),
+                          input: trace_events_file,
+                          command: [ tracetool, group, '--format=rs', '@INPUT@', '@OUTPUT@' ],
+                          depend_files: tracetool_depends)
   if 'ust' in get_option('trace_backends')
     trace_ust_h = custom_target(fmt.format('trace-ust', 'h'),
                                 output: fmt.format('trace-ust', 'h'),
@@ -34,6 +39,7 @@ foreach item : [ '.' ] + trace_events_subdirs + qapi_trace_events
     genh += trace_ust_h
   endif
   trace_ss.add(trace_h, trace_c)
+  trace_rs_targets += trace_rs
   if 'dtrace' in get_option('trace_backends')
     trace_dtrace = custom_target(fmt.format('trace-dtrace', 'dtrace'),
                                  output: fmt.format('trace-dtrace', 'dtrace'),

From fe791b4004cbdc64bee6cb69ba4a98513879945d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:32 +0200
Subject: [PATCH 0832/2396] rust: qdev: add minimal clock bindings

Add the minimal support that is needed by pl011's event and tracepoint.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-11-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 rust/hw/core/src/qdev.rs | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index a4493dbf01..c3097a284d 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -411,6 +411,39 @@ where
 
 impl<R: ObjectDeref> DeviceMethods for R where R::Target: IsA<DeviceState> {}
 
+impl Clock {
+    pub const PERIOD_1SEC: u64 = bindings::CLOCK_PERIOD_1SEC;
+
+    pub const fn period_from_ns(ns: u64) -> u64 {
+        ns * Self::PERIOD_1SEC / 1_000_000_000
+    }
+
+    pub const fn period_from_hz(hz: u64) -> u64 {
+        if hz == 0 {
+            0
+        } else {
+            Self::PERIOD_1SEC / hz
+        }
+    }
+
+    pub const fn period_to_hz(period: u64) -> u64 {
+        if period == 0 {
+            0
+        } else {
+            Self::PERIOD_1SEC / period
+        }
+    }
+
+    pub const fn period(&self) -> u64 {
+        // SAFETY: Clock is returned by init_clock_in with zero value for period
+        unsafe { &*self.0.as_ptr() }.period
+    }
+
+    pub const fn hz(&self) -> u64 {
+        Self::period_to_hz(self.period())
+    }
+}
+
 unsafe impl ObjectType for Clock {
     type Class = ObjectClass;
     const TYPE_NAME: &'static CStr =

From 357f92697971b5a52bb38248405c40afcc355a1d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:33 +0200
Subject: [PATCH 0833/2396] rust: pl011: add tracepoints

Finally bring parity between C and Rust versions of the PL011 device model.
Changing some types of the arguments makes for nicer Rust code; C does not
care. :)

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-12-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/char/trace-events             | 14 ++++----
 rust/Cargo.lock                  |  1 +
 rust/hw/char/pl011/Cargo.toml    |  1 +
 rust/hw/char/pl011/meson.build   |  1 +
 rust/hw/char/pl011/src/device.rs | 57 ++++++++++++++++++++++----------
 5 files changed, 50 insertions(+), 24 deletions(-)

diff --git a/hw/char/trace-events b/hw/char/trace-events
index 05a33036c1..9e74be2c14 100644
--- a/hw/char/trace-events
+++ b/hw/char/trace-events
@@ -58,15 +58,15 @@ imx_serial_write(const char *chrname, uint64_t addr, uint64_t value) "%s:[0x%03"
 imx_serial_put_data(const char *chrname, uint32_t value) "%s: 0x%" PRIx32
 
 # pl011.c
-pl011_irq_state(int level) "irq state %d"
-pl011_read(uint32_t addr, uint32_t value, const char *regname) "addr 0x%03x value 0x%08x reg %s"
-pl011_read_fifo(unsigned rx_fifo_used, size_t rx_fifo_depth) "RX FIFO read, used %u/%zu"
-pl011_write(uint32_t addr, uint32_t value, const char *regname) "addr 0x%03x value 0x%08x reg %s"
-pl011_can_receive(uint32_t lcr, unsigned rx_fifo_used, size_t rx_fifo_depth, unsigned rx_fifo_available) "LCR 0x%02x, RX FIFO used %u/%zu, can_receive %u chars"
-pl011_fifo_rx_put(uint32_t c, unsigned read_count, size_t rx_fifo_depth) "RX FIFO push char [0x%02x] %d/%zu depth used"
+pl011_irq_state(bool level) "irq state %d"
+pl011_read(uint64_t addr, uint32_t value, const char *regname) "addr 0x%03" PRIx64 " value 0x%08x reg %s"
+pl011_read_fifo(unsigned rx_fifo_used, unsigned rx_fifo_depth) "RX FIFO read, used %u/%u"
+pl011_write(uint64_t addr, uint32_t value, const char *regname) "addr 0x%03" PRIx64 " value 0x%08x reg %s"
+pl011_can_receive(uint32_t lcr, unsigned rx_fifo_used, unsigned rx_fifo_depth, unsigned rx_fifo_available) "LCR 0x%02x, RX FIFO used %u/%u, can_receive %u chars"
+pl011_fifo_rx_put(uint32_t c, unsigned read_count, unsigned rx_fifo_depth) "RX FIFO push char [0x%02x] %d/%u depth used"
 pl011_fifo_rx_full(void) "RX FIFO now full, RXFF set"
 pl011_baudrate_change(unsigned int baudrate, uint64_t clock, uint32_t ibrd, uint32_t fbrd) "new baudrate %u (clk: %" PRIu64 "hz, ibrd: %" PRIu32 ", fbrd: %" PRIu32 ")"
-pl011_receive(int size) "recv %d chars"
+pl011_receive(size_t size) "recv %zd chars"
 
 # cmsdk-apb-uart.c
 cmsdk_apb_uart_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB UART read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 3428dbaf0b..f84a3dd076 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -159,6 +159,7 @@ dependencies = [
  "migration",
  "qom",
  "system",
+ "trace",
  "util",
 ]
 
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index b2418abc4b..dc41d0e499 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -24,6 +24,7 @@ qom = { path = "../../../qom" }
 chardev = { path = "../../../chardev" }
 system = { path = "../../../system" }
 hwcore = { path = "../../../hw/core" }
+trace = { path = "../../../trace" }
 
 [lints]
 workspace = true
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index a33f32906e..07b3da17e8 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -40,6 +40,7 @@ _libpl011_rs = static_library(
     chardev_rs,
     system_rs,
     hwcore_rs,
+    trace_rs
   ],
 )
 
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 1b4587d5f6..8889d6e54f 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -21,6 +21,8 @@ use util::{log::Log, log_mask_ln};
 
 use crate::registers::{self, Interrupt, RegisterOffset};
 
+::trace::include_trace!("hw_char");
+
 // TODO: You must disable the UART before any of the control registers are
 // reprogrammed. When the UART is disabled in the middle of transmission or
 // reception, it completes the current character before stopping
@@ -208,13 +210,7 @@ impl PL011Registers {
         (update, result)
     }
 
-    pub(self) fn write(
-        &mut self,
-        offset: RegisterOffset,
-        value: u32,
-        char_backend: &CharBackend,
-    ) -> bool {
-        // eprintln!("write offset {offset} value {value}");
+    pub(self) fn write(&mut self, offset: RegisterOffset, value: u32, device: &PL011State) -> bool {
         use RegisterOffset::*;
         match offset {
             DR => return self.write_data_register(value),
@@ -229,9 +225,11 @@ impl PL011Registers {
             }
             IBRD => {
                 self.ibrd = value;
+                device.trace_baudrate_change(self.ibrd, self.fbrd);
             }
             FBRD => {
                 self.fbrd = value;
+                device.trace_baudrate_change(self.ibrd, self.fbrd);
             }
             LCR_H => {
                 let new_val: registers::LineControl = value.into();
@@ -242,7 +240,7 @@ impl PL011Registers {
                 }
                 let update = (self.line_control.send_break() != new_val.send_break()) && {
                     let break_enable = new_val.send_break();
-                    let _ = char_backend.send_break(break_enable);
+                    let _ = device.char_backend.send_break(break_enable);
                     self.loopback_break(break_enable)
                 };
                 self.line_control = new_val;
@@ -279,12 +277,13 @@ impl PL011Registers {
     }
 
     fn read_data_register(&mut self, update: &mut bool) -> u32 {
+        let depth = self.fifo_depth();
         self.flags.set_receive_fifo_full(false);
         let c = self.read_fifo[self.read_pos];
 
         if self.read_count > 0 {
             self.read_count -= 1;
-            self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1);
+            self.read_pos = (self.read_pos + 1) & (depth - 1);
         }
         if self.read_count == 0 {
             self.flags.set_receive_fifo_empty(true);
@@ -292,6 +291,7 @@ impl PL011Registers {
         if self.read_count + 1 == self.read_trigger {
             self.int_level &= !Interrupt::RX;
         }
+        trace::trace_pl011_read_fifo(self.read_count, depth);
         self.receive_status_error_clear.set_from_data(c);
         *update = true;
         u32::from(c)
@@ -447,7 +447,9 @@ impl PL011Registers {
         self.read_fifo[slot] = value;
         self.read_count += 1;
         self.flags.set_receive_fifo_empty(false);
+        trace::trace_pl011_fifo_rx_put(value.into(), self.read_count, depth);
         if self.read_count == depth {
+            trace::trace_pl011_fifo_rx_full();
             self.flags.set_receive_fifo_full(true);
         }
 
@@ -516,8 +518,21 @@ impl PL011State {
         uninit_field_mut!(*this, clock).write(clock);
     }
 
-    const fn clock_update(&self, _event: ClockEvent) {
-        /* pl011_trace_baudrate_change(s); */
+    pub fn trace_baudrate_change(&self, ibrd: u32, fbrd: u32) {
+        let divider = 4.0 / f64::from(ibrd * (FBRD_MASK + 1) + fbrd);
+        let hz = self.clock.hz();
+        let rate = if ibrd == 0 {
+            0
+        } else {
+            ((hz as f64) * divider) as u32
+        };
+        trace::trace_pl011_baudrate_change(rate, hz, ibrd, fbrd);
+    }
+
+    fn clock_update(&self, _event: ClockEvent) {
+        let regs = self.regs.borrow();
+        let (ibrd, fbrd) = (regs.ibrd, regs.fbrd);
+        self.trace_baudrate_change(ibrd, fbrd)
     }
 
     pub fn clock_needed(&self) -> bool {
@@ -543,6 +558,7 @@ impl PL011State {
             }
             Ok(field) => {
                 let (update_irq, result) = self.regs.borrow_mut().read(field);
+                trace::trace_pl011_read(offset, result, c"");
                 if update_irq {
                     self.update();
                     self.char_backend.accept_input();
@@ -557,6 +573,7 @@ impl PL011State {
         if let Ok(field) = RegisterOffset::try_from(offset) {
             // qemu_chr_fe_write_all() calls into the can_receive
             // callback, so handle writes before entering PL011Registers.
+            trace::trace_pl011_write(offset, value as u32, c"");
             if field == RegisterOffset::DR {
                 // ??? Check if transmitter is enabled.
                 let ch: [u8; 1] = [value as u8];
@@ -565,10 +582,7 @@ impl PL011State {
                 let _ = self.char_backend.write_all(&ch);
             }
 
-            update_irq = self
-                .regs
-                .borrow_mut()
-                .write(field, value as u32, &self.char_backend);
+            update_irq = self.regs.borrow_mut().write(field, value as u32, self);
         } else {
             log_mask_ln!(
                 Log::GuestError,
@@ -582,11 +596,19 @@ impl PL011State {
 
     fn can_receive(&self) -> u32 {
         let regs = self.regs.borrow();
-        // trace_pl011_can_receive(s->lcr, s->read_count, r);
-        regs.fifo_depth() - regs.read_count
+        let fifo_available = regs.fifo_depth() - regs.read_count;
+        trace::trace_pl011_can_receive(
+            regs.line_control.into(),
+            regs.read_count,
+            regs.fifo_depth(),
+            fifo_available,
+        );
+        fifo_available
     }
 
     fn receive(&self, buf: &[u8]) {
+        trace::trace_pl011_receive(buf.len());
+
         let mut regs = self.regs.borrow_mut();
         if regs.loopback_enabled() {
             // In loopback mode, the RX input signal is internally disconnected
@@ -635,6 +657,7 @@ impl PL011State {
     fn update(&self) {
         let regs = self.regs.borrow();
         let flags = regs.int_level & regs.int_enabled;
+        trace::trace_pl011_irq_state(flags != 0);
         for (irq, i) in self.interrupts.iter().zip(IRQMASK) {
             irq.set(flags.any_set(i));
         }

From 42f73f264a9fc0b1d38d84e8e716e69e929d6697 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:34 +0200
Subject: [PATCH 0834/2396] tracetool/simple: add Rust support

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-13-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/simple.py |  7 +++++
 tests/tracetool/simple.rs           | 40 +++++++++++++++++++++++++++++
 tests/tracetool/tracetool-test.py   |  2 ++
 3 files changed, 49 insertions(+)
 create mode 100644 tests/tracetool/simple.rs

diff --git a/scripts/tracetool/backend/simple.py b/scripts/tracetool/backend/simple.py
index b5a6b7205a..b131e4fc19 100644
--- a/scripts/tracetool/backend/simple.py
+++ b/scripts/tracetool/backend/simple.py
@@ -98,3 +98,10 @@ def generate_c(event, group):
     out('    trace_record_finish(&rec);',
         '}',
         '')
+
+def generate_rs(event, group):
+    out('        extern "C" { fn _simple_%(api)s(%(rust_args)s); }',
+        '        unsafe { _simple_%(api)s(%(args)s); }',
+        api=event.api(),
+        rust_args=event.args.rust_decl_extern(),
+        args=event.args.rust_call_extern())
diff --git a/tests/tracetool/simple.rs b/tests/tracetool/simple.rs
new file mode 100644
index 0000000000..9ee39495e3
--- /dev/null
+++ b/tests/tracetool/simple.rs
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// This file is @generated by tracetool, do not edit.
+
+#[allow(unused_imports)]
+use std::ffi::c_char;
+#[allow(unused_imports)]
+use util::bindings;
+
+#[inline(always)]
+fn trace_event_state_is_enabled(dstate: u16) -> bool {
+    (unsafe { trace_events_enabled_count }) != 0 && dstate != 0
+}
+
+extern "C" {
+    static mut trace_events_enabled_count: u32;
+}
+extern "C" {
+    static mut _TRACE_TEST_BLAH_DSTATE: u16;
+    static mut _TRACE_TEST_WIBBLE_DSTATE: u16;
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_blah(_context: *mut (), _filename: &std::ffi::CStr)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_BLAH_DSTATE}) {
+        extern "C" { fn _simple_trace_test_blah(_context: *mut (), _filename: *const std::ffi::c_char); }
+        unsafe { _simple_trace_test_blah(_context, _filename.as_ptr()); }
+    }
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_wibble(_context: *mut (), _value: std::ffi::c_int)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_WIBBLE_DSTATE}) {
+        extern "C" { fn _simple_trace_test_wibble(_context: *mut (), _value: std::ffi::c_int); }
+        unsafe { _simple_trace_test_wibble(_context, _value); }
+    }
+}
diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
index 65430fdedc..3e37890476 100755
--- a/tests/tracetool/tracetool-test.py
+++ b/tests/tracetool/tracetool-test.py
@@ -14,6 +14,8 @@ def get_formats(backend):
         "c",
         "h",
     ]
+    if backend in {"simple"}:
+        formats += ["rs"]
     if backend == "dtrace":
         formats += [
             "d",

From 75871d88d3ddf310dd5ffb1d36c8476959692726 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 29 Sep 2025 17:49:35 +0200
Subject: [PATCH 0835/2396] log: change qemu_loglevel to unsigned
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bindgen makes the LOG_* constants unsigned, even if they are defined as
(1 << 15):

   pub const LOG_TRACE: u32 = 32768;

Make them unsigned in C as well through the BIT() macro, and also change
the type of the variable that they are used with.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-14-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/log-for-trace.h |  4 ++--
 include/qemu/log.h           | 44 ++++++++++++++++++------------------
 rust/util/src/log.rs         |  2 +-
 util/log.c                   |  2 +-
 4 files changed, 26 insertions(+), 26 deletions(-)

diff --git a/include/qemu/log-for-trace.h b/include/qemu/log-for-trace.h
index d47c9cd446..f3a8791f1d 100644
--- a/include/qemu/log-for-trace.h
+++ b/include/qemu/log-for-trace.h
@@ -19,9 +19,9 @@
 #define QEMU_LOG_FOR_TRACE_H
 
 /* Private global variable, don't use */
-extern int qemu_loglevel;
+extern unsigned qemu_loglevel;
 
-#define LOG_TRACE          (1 << 15)
+#define LOG_TRACE          (1u << 15)
 
 /* Returns true if a bit is set in the current loglevel mask */
 static inline bool qemu_loglevel_mask(int mask)
diff --git a/include/qemu/log.h b/include/qemu/log.h
index aae72985f0..7effba4da4 100644
--- a/include/qemu/log.h
+++ b/include/qemu/log.h
@@ -14,30 +14,30 @@ bool qemu_log_enabled(void);
 /* Returns true if qemu_log() will write somewhere other than stderr. */
 bool qemu_log_separate(void);
 
-#define CPU_LOG_TB_OUT_ASM (1 << 0)
-#define CPU_LOG_TB_IN_ASM  (1 << 1)
-#define CPU_LOG_TB_OP      (1 << 2)
-#define CPU_LOG_TB_OP_OPT  (1 << 3)
-#define CPU_LOG_INT        (1 << 4)
-#define CPU_LOG_EXEC       (1 << 5)
-#define CPU_LOG_PCALL      (1 << 6)
-#define CPU_LOG_TB_CPU     (1 << 8)
-#define CPU_LOG_RESET      (1 << 9)
-#define LOG_UNIMP          (1 << 10)
-#define LOG_GUEST_ERROR    (1 << 11)
-#define CPU_LOG_MMU        (1 << 12)
-#define CPU_LOG_TB_NOCHAIN (1 << 13)
-#define CPU_LOG_PAGE       (1 << 14)
+#define CPU_LOG_TB_OUT_ASM (1u << 0)
+#define CPU_LOG_TB_IN_ASM  (1u << 1)
+#define CPU_LOG_TB_OP      (1u << 2)
+#define CPU_LOG_TB_OP_OPT  (1u << 3)
+#define CPU_LOG_INT        (1u << 4)
+#define CPU_LOG_EXEC       (1u << 5)
+#define CPU_LOG_PCALL      (1u << 6)
+#define CPU_LOG_TB_CPU     (1u << 8)
+#define CPU_LOG_RESET      (1u << 9)
+#define LOG_UNIMP          (1u << 10)
+#define LOG_GUEST_ERROR    (1u << 11)
+#define CPU_LOG_MMU        (1u << 12)
+#define CPU_LOG_TB_NOCHAIN (1u << 13)
+#define CPU_LOG_PAGE       (1u << 14)
 /* LOG_TRACE (1 << 15) is defined in log-for-trace.h */
-#define CPU_LOG_TB_OP_IND  (1 << 16)
-#define CPU_LOG_TB_FPU     (1 << 17)
-#define CPU_LOG_PLUGIN     (1 << 18)
+#define CPU_LOG_TB_OP_IND  (1u << 16)
+#define CPU_LOG_TB_FPU     (1u << 17)
+#define CPU_LOG_PLUGIN     (1u << 18)
 /* LOG_STRACE is used for user-mode strace logging. */
-#define LOG_STRACE         (1 << 19)
-#define LOG_PER_THREAD     (1 << 20)
-#define CPU_LOG_TB_VPU     (1 << 21)
-#define LOG_TB_OP_PLUGIN   (1 << 22)
-#define LOG_INVALID_MEM    (1 << 23)
+#define LOG_STRACE         (1u << 19)
+#define LOG_PER_THREAD     (1u << 20)
+#define CPU_LOG_TB_VPU     (1u << 21)
+#define LOG_TB_OP_PLUGIN   (1u << 22)
+#define LOG_INVALID_MEM    (1u << 23)
 
 /* Lock/unlock output. */
 
diff --git a/rust/util/src/log.rs b/rust/util/src/log.rs
index af9a3e9123..0a4bc4249a 100644
--- a/rust/util/src/log.rs
+++ b/rust/util/src/log.rs
@@ -142,7 +142,7 @@ macro_rules! log_mask_ln {
         let _: $crate::log::Log = $mask;
 
         if unsafe {
-            ($crate::bindings::qemu_loglevel & ($mask as std::os::raw::c_int)) != 0
+            ($crate::bindings::qemu_loglevel & ($mask as std::os::raw::c_uint)) != 0
         } {
             _ = $crate::log::LogGuard::log_fmt(
                 format_args!("{}\n", format_args!($fmt $($args)*)));
diff --git a/util/log.c b/util/log.c
index abdcb6b311..41f78ce86b 100644
--- a/util/log.c
+++ b/util/log.c
@@ -44,7 +44,7 @@ static FILE *global_file;
 static __thread FILE *thread_file;
 static __thread Notifier qemu_log_thread_cleanup_notifier;
 
-int qemu_loglevel;
+unsigned qemu_loglevel;
 static bool log_per_thread;
 static GArray *debug_regions;
 

From c4e8d44bac5cecebba9bb7293b4256bd57e9f52e Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:36 +0200
Subject: [PATCH 0836/2396] tracetool/log: add Rust support

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-15-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/log.py  | 10 ++++++-
 tests/tracetool/log.rs            | 44 +++++++++++++++++++++++++++++++
 tests/tracetool/tracetool-test.py |  2 +-
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 tests/tracetool/log.rs

diff --git a/scripts/tracetool/backend/log.py b/scripts/tracetool/backend/log.py
index d01d234289..9e3e5046f5 100644
--- a/scripts/tracetool/backend/log.py
+++ b/scripts/tracetool/backend/log.py
@@ -12,7 +12,7 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-from tracetool import out
+from tracetool import out, expand_format_string
 
 
 PUBLIC = True
@@ -44,3 +44,11 @@ def generate_h(event, group):
 def generate_h_backend_dstate(event, group):
     out('    trace_event_get_state_dynamic_by_id(%(event_id)s) || \\',
         event_id="TRACE_" + event.name.upper())
+
+def generate_rs(event, group):
+    out('        let format_string = c"%(fmt)s\\n";',
+        '        if (unsafe { bindings::qemu_loglevel } & bindings::LOG_TRACE) != 0 {',
+        '            unsafe { bindings::qemu_log(format_string.as_ptr() as *const c_char, %(args)s);}',
+        '        }',
+        fmt=expand_format_string(event.fmt, event.name + " "),
+        args=event.args.rust_call_varargs())
diff --git a/tests/tracetool/log.rs b/tests/tracetool/log.rs
new file mode 100644
index 0000000000..c191895c8f
--- /dev/null
+++ b/tests/tracetool/log.rs
@@ -0,0 +1,44 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// This file is @generated by tracetool, do not edit.
+
+#[allow(unused_imports)]
+use std::ffi::c_char;
+#[allow(unused_imports)]
+use util::bindings;
+
+#[inline(always)]
+fn trace_event_state_is_enabled(dstate: u16) -> bool {
+    (unsafe { trace_events_enabled_count }) != 0 && dstate != 0
+}
+
+extern "C" {
+    static mut trace_events_enabled_count: u32;
+}
+extern "C" {
+    static mut _TRACE_TEST_BLAH_DSTATE: u16;
+    static mut _TRACE_TEST_WIBBLE_DSTATE: u16;
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_blah(_context: *mut (), _filename: &std::ffi::CStr)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_BLAH_DSTATE}) {
+        let format_string = c"test_blah Blah context=%p filename=%s\n";
+        if (unsafe { bindings::qemu_loglevel } & bindings::LOG_TRACE) != 0 {
+            unsafe { bindings::qemu_log(format_string.as_ptr() as *const c_char, _context /* as *mut () */, _filename.as_ptr());}
+        }
+    }
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_wibble(_context: *mut (), _value: std::ffi::c_int)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_WIBBLE_DSTATE}) {
+        let format_string = c"test_wibble Wibble context=%p value=%d\n";
+        if (unsafe { bindings::qemu_loglevel } & bindings::LOG_TRACE) != 0 {
+            unsafe { bindings::qemu_log(format_string.as_ptr() as *const c_char, _context /* as *mut () */, _value /* as std::ffi::c_int */);}
+        }
+    }
+}
diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
index 3e37890476..f58f3b795e 100755
--- a/tests/tracetool/tracetool-test.py
+++ b/tests/tracetool/tracetool-test.py
@@ -14,7 +14,7 @@ def get_formats(backend):
         "c",
         "h",
     ]
-    if backend in {"simple"}:
+    if backend in {"log", "simple"}:
         formats += ["rs"]
     if backend == "dtrace":
         formats += [

From 7dbee1274266b802456c7f07dc10184af2dc1ec0 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:37 +0200
Subject: [PATCH 0837/2396] tracetool/ftrace: add Rust support

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-16-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/tracetool/backend/ftrace.py |  8 +++++-
 tests/tracetool/ftrace.rs           | 40 +++++++++++++++++++++++++++++
 tests/tracetool/tracetool-test.py   |  2 +-
 3 files changed, 48 insertions(+), 2 deletions(-)
 create mode 100644 tests/tracetool/ftrace.rs

diff --git a/scripts/tracetool/backend/ftrace.py b/scripts/tracetool/backend/ftrace.py
index 7ddd5d11a6..e03698a2ed 100644
--- a/scripts/tracetool/backend/ftrace.py
+++ b/scripts/tracetool/backend/ftrace.py
@@ -12,7 +12,7 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-from tracetool import out
+from tracetool import out, expand_format_string
 
 
 PUBLIC = True
@@ -43,3 +43,9 @@ def generate_h(event, group):
 def generate_h_backend_dstate(event, group):
     out('    trace_event_get_state_dynamic_by_id(%(event_id)s) || \\',
         event_id="TRACE_" + event.name.upper())
+
+def generate_rs(event, group):
+    out('        let format_string = c"%(fmt)s";',
+        '        unsafe {bindings::ftrace_write(format_string.as_ptr() as *const c_char, %(args)s);}',
+        fmt=expand_format_string(event.fmt),
+        args=event.args.rust_call_varargs())
diff --git a/tests/tracetool/ftrace.rs b/tests/tracetool/ftrace.rs
new file mode 100644
index 0000000000..07b9259cf2
--- /dev/null
+++ b/tests/tracetool/ftrace.rs
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// This file is @generated by tracetool, do not edit.
+
+#[allow(unused_imports)]
+use std::ffi::c_char;
+#[allow(unused_imports)]
+use util::bindings;
+
+#[inline(always)]
+fn trace_event_state_is_enabled(dstate: u16) -> bool {
+    (unsafe { trace_events_enabled_count }) != 0 && dstate != 0
+}
+
+extern "C" {
+    static mut trace_events_enabled_count: u32;
+}
+extern "C" {
+    static mut _TRACE_TEST_BLAH_DSTATE: u16;
+    static mut _TRACE_TEST_WIBBLE_DSTATE: u16;
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_blah(_context: *mut (), _filename: &std::ffi::CStr)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_BLAH_DSTATE}) {
+        let format_string = c"Blah context=%p filename=%s";
+        unsafe {bindings::ftrace_write(format_string.as_ptr() as *const c_char, _context /* as *mut () */, _filename.as_ptr());}
+    }
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_wibble(_context: *mut (), _value: std::ffi::c_int)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_WIBBLE_DSTATE}) {
+        let format_string = c"Wibble context=%p value=%d";
+        unsafe {bindings::ftrace_write(format_string.as_ptr() as *const c_char, _context /* as *mut () */, _value /* as std::ffi::c_int */);}
+    }
+}
diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
index f58f3b795e..3341fb18f9 100755
--- a/tests/tracetool/tracetool-test.py
+++ b/tests/tracetool/tracetool-test.py
@@ -14,7 +14,7 @@ def get_formats(backend):
         "c",
         "h",
     ]
-    if backend in {"log", "simple"}:
+    if backend in {"ftrace", "log", "simple"}:
         formats += ["rs"]
     if backend == "dtrace":
         formats += [

From 1461752f0fa4bcd7e60d51fe47e3430f8a81cdd8 Mon Sep 17 00:00:00 2001
From: Tanish Desai <tanishdesai37@gmail.com>
Date: Mon, 29 Sep 2025 17:49:38 +0200
Subject: [PATCH 0838/2396] tracetool/syslog: add Rust support

The syslog backend needs the syslog function from libc and the LOG_INFO enum
value; they are re-exported as "::trace::syslog" and "::trace::LOG_INFO"
so that device crates do not all have to add the libc dependency, but
otherwise there is nothing special.

Signed-off-by: Tanish Desai <tanishdesai37@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-ID: <20250929154938.594389-17-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 rust/Cargo.lock                     |  3 +++
 rust/trace/Cargo.toml               |  3 +++
 rust/trace/src/lib.rs               |  4 +++
 scripts/tracetool/backend/syslog.py |  7 ++++-
 tests/tracetool/syslog.rs           | 40 +++++++++++++++++++++++++++++
 tests/tracetool/tracetool-test.py   |  2 +-
 6 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 tests/tracetool/syslog.rs

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index f84a3dd076..444ef516a7 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -262,6 +262,9 @@ dependencies = [
 [[package]]
 name = "trace"
 version = "0.1.0"
+dependencies = [
+ "libc",
+]
 
 [[package]]
 name = "unicode-ident"
diff --git a/rust/trace/Cargo.toml b/rust/trace/Cargo.toml
index 13ac0b33d6..fc81bce580 100644
--- a/rust/trace/Cargo.toml
+++ b/rust/trace/Cargo.toml
@@ -12,5 +12,8 @@ license.workspace = true
 repository.workspace = true
 rust-version.workspace = true
 
+[dependencies]
+libc = { workspace = true }
+
 [lints]
 workspace = true
diff --git a/rust/trace/src/lib.rs b/rust/trace/src/lib.rs
index 0955461573..e03bce43c4 100644
--- a/rust/trace/src/lib.rs
+++ b/rust/trace/src/lib.rs
@@ -3,6 +3,10 @@
 //! This crate provides macros that aid in using QEMU's tracepoint
 //! functionality.
 
+#[doc(hidden)]
+/// Re-exported item to avoid adding libc as a dependency everywhere.
+pub use libc::{syslog, LOG_INFO};
+
 #[macro_export]
 /// Define the trace-points from the named directory (which should have slashes
 /// replaced by underscore characters) as functions in a module called `trace`.
diff --git a/scripts/tracetool/backend/syslog.py b/scripts/tracetool/backend/syslog.py
index 177414d56a..12b826593d 100644
--- a/scripts/tracetool/backend/syslog.py
+++ b/scripts/tracetool/backend/syslog.py
@@ -12,7 +12,7 @@ __maintainer__ = "Stefan Hajnoczi"
 __email__      = "stefanha@redhat.com"
 
 
-from tracetool import out
+from tracetool import out, expand_format_string
 
 
 PUBLIC = True
@@ -38,6 +38,11 @@ def generate_h(event, group):
         fmt=event.fmt.rstrip("\n"),
         argnames=argnames)
 
+def generate_rs(event, group):
+    out('        let format_string = c"%(fmt)s";',
+        '        unsafe {::trace::syslog(::trace::LOG_INFO, format_string.as_ptr() as *const c_char, %(args)s);}',
+        fmt=expand_format_string(event.fmt),
+        args=event.args.rust_call_varargs())
 
 def generate_h_backend_dstate(event, group):
     out('    trace_event_get_state_dynamic_by_id(%(event_id)s) || \\',
diff --git a/tests/tracetool/syslog.rs b/tests/tracetool/syslog.rs
new file mode 100644
index 0000000000..9d3675a0b5
--- /dev/null
+++ b/tests/tracetool/syslog.rs
@@ -0,0 +1,40 @@
+// SPDX-License-Identifier: GPL-2.0-or-later
+// This file is @generated by tracetool, do not edit.
+
+#[allow(unused_imports)]
+use std::ffi::c_char;
+#[allow(unused_imports)]
+use util::bindings;
+
+#[inline(always)]
+fn trace_event_state_is_enabled(dstate: u16) -> bool {
+    (unsafe { trace_events_enabled_count }) != 0 && dstate != 0
+}
+
+extern "C" {
+    static mut trace_events_enabled_count: u32;
+}
+extern "C" {
+    static mut _TRACE_TEST_BLAH_DSTATE: u16;
+    static mut _TRACE_TEST_WIBBLE_DSTATE: u16;
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_blah(_context: *mut (), _filename: &std::ffi::CStr)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_BLAH_DSTATE}) {
+        let format_string = c"Blah context=%p filename=%s";
+        unsafe {::trace::syslog(::trace::LOG_INFO, format_string.as_ptr() as *const c_char, _context /* as *mut () */, _filename.as_ptr());}
+    }
+}
+
+#[inline(always)]
+#[allow(dead_code)]
+pub fn trace_test_wibble(_context: *mut (), _value: std::ffi::c_int)
+{
+    if trace_event_state_is_enabled(unsafe { _TRACE_TEST_WIBBLE_DSTATE}) {
+        let format_string = c"Wibble context=%p value=%d";
+        unsafe {::trace::syslog(::trace::LOG_INFO, format_string.as_ptr() as *const c_char, _context /* as *mut () */, _value /* as std::ffi::c_int */);}
+    }
+}
diff --git a/tests/tracetool/tracetool-test.py b/tests/tracetool/tracetool-test.py
index 3341fb18f9..786083ad7f 100755
--- a/tests/tracetool/tracetool-test.py
+++ b/tests/tracetool/tracetool-test.py
@@ -14,7 +14,7 @@ def get_formats(backend):
         "c",
         "h",
     ]
-    if backend in {"ftrace", "log", "simple"}:
+    if backend in {"ftrace", "log", "simple", "syslog"}:
         formats += ["rs"]
     if backend == "dtrace":
         formats += [

From 030cd885563e9ca843a46ec7e65b657c93df5af7 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 30 Sep 2025 11:04:44 +0200
Subject: [PATCH 0839/2396] tests/qtest: Add missing checks for the
 availability of machines

When QEMU has been compiled with "--without-default-devices", the
machines might not be available in the binary. Let's properly check
for the machines before running the tests to avoid that they are
failing in this case.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930090444.234431-1-thuth@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/bios-tables-test.c | 2 +-
 tests/qtest/cpu-plug-test.c    | 2 +-
 tests/qtest/riscv-csr-test.c   | 4 +++-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index 4fa8ac5096..6b892ef23e 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -2864,7 +2864,7 @@ int main(int argc, char *argv[])
                            test_acpi_riscv64_virt_tcg_acpi_spcr);
         }
     } else if (strcmp(arch, "loongarch64") == 0) {
-        if (has_tcg) {
+        if (has_tcg && qtest_has_machine("virt")) {
             qtest_add_func("acpi/virt", test_acpi_loongarch64_virt);
             qtest_add_func("acpi/virt/topology",
                            test_acpi_loongarch64_virt_topology);
diff --git a/tests/qtest/cpu-plug-test.c b/tests/qtest/cpu-plug-test.c
index 44d704680b..0aa4ccc5b6 100644
--- a/tests/qtest/cpu-plug-test.c
+++ b/tests/qtest/cpu-plug-test.c
@@ -190,7 +190,7 @@ int main(int argc, char **argv)
         qtest_cb_for_every_machine(add_pseries_test_case, g_test_quick());
     } else if (g_str_equal(arch, "s390x")) {
         qtest_cb_for_every_machine(add_s390x_test_case, g_test_quick());
-    } else if (g_str_equal(arch, "loongarch64")) {
+    } else if (g_str_equal(arch, "loongarch64") && qtest_has_machine("virt")) {
         add_loongarch_test_case("virt");
     }
 
diff --git a/tests/qtest/riscv-csr-test.c b/tests/qtest/riscv-csr-test.c
index ff5c29e6c6..bb1b0ffed3 100644
--- a/tests/qtest/riscv-csr-test.c
+++ b/tests/qtest/riscv-csr-test.c
@@ -50,7 +50,9 @@ int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
 
-    qtest_add_func("/cpu/csr", run_test_csr);
+    if (qtest_has_machine("virt")) {
+        qtest_add_func("/cpu/csr", run_test_csr);
+    }
 
     return g_test_run();
 }

From bfa07595eb6652a3b2599bb2eb3a82f14f75497b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 30 Sep 2025 11:09:32 +0200
Subject: [PATCH 0840/2396] tests/qtest/migration: Fix cpr-tests in case the
 machine is not available

When QEMU has been compiled with "--without-default-devices", the
migration cpr-tests are currently failing since the first test leaves
a socket file behind that avoids that the second test can be initialized
correctly. Make sure that we delete the socket file in case that the
migrate_start() failed due to the missing machine.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930090932.235151-1-thuth@redhat.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/cpr-tests.c | 5 ++++-
 tests/qtest/migration/framework.c | 6 ++++--
 tests/qtest/migration/framework.h | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 5e764a6787..c4ce60ff66 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -97,7 +97,10 @@ static void test_mode_transfer_common(bool incoming_defer)
         .start_hook = test_mode_transfer_start,
     };
 
-    test_precopy_common(&args);
+    if (test_precopy_common(&args) < 0) {
+        close(cpr_sockfd);
+        unlink(cpr_path);
+    }
 }
 
 static void test_mode_transfer(void)
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 407c9023c0..a044b35465 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -736,7 +736,7 @@ void test_postcopy_recovery_common(MigrateCommon *args)
     migrate_postcopy_complete(from, to, args);
 }
 
-void test_precopy_common(MigrateCommon *args)
+int test_precopy_common(MigrateCommon *args)
 {
     QTestState *from, *to;
     void *data_hook = NULL;
@@ -746,7 +746,7 @@ void test_precopy_common(MigrateCommon *args)
     g_assert(!args->cpr_channel || args->connect_channels);
 
     if (migrate_start(&from, &to, args->listen_uri, &args->start)) {
-        return;
+        return -1;
     }
 
     if (args->start_hook) {
@@ -869,6 +869,8 @@ finish:
     }
 
     migrate_end(from, to, args->result == MIG_TEST_SUCCEED);
+
+    return 0;
 }
 
 static void file_dirty_offset_region(void)
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 01e425e64e..744040d53a 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -227,7 +227,7 @@ void migrate_end(QTestState *from, QTestState *to, bool test_dest);
 
 void test_postcopy_common(MigrateCommon *args);
 void test_postcopy_recovery_common(MigrateCommon *args);
-void test_precopy_common(MigrateCommon *args);
+int test_precopy_common(MigrateCommon *args);
 void test_file_common(MigrateCommon *args, bool stop_src);
 void *migrate_hook_start_precopy_tcp_multifd_common(QTestState *from,
                                                     QTestState *to,

From e16d7a732124ccaf9960920a9b64f4cf95f8fdab Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 19 Sep 2025 06:58:30 -0700
Subject: [PATCH 0841/2396] tests/qtest: optimize qtest_get_machines

qtest_get_machines returns the machines supported by the QEMU binary
described by an environment variable and caches the result.  If the
next call to qtest_get_machines passes the same variable name, the cached
result is returned, but if the name changes, the caching is defeated.
To make caching more effective, remember the path of the QEMU binary
instead.  Different env vars, eg QTEST_QEMU_BINARY_SRC and
QTEST_QEMU_BINARY_DST, usually resolve to the same path.

Before the optimization, the test /x86_64/migration/precopy/unix/plain
exec's QEMU and calls query-machines 3 times.  After optimization, that
only happens once.  This does not significantly speed up the tests, but
it reduces QTEST_LOG output, and launches fewer QEMU instances, making
it easier to debug problems.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <87h5ymdzrf.fsf@pond.sub.org>
Link: https://lore.kernel.org/qemu-devel/1758290310-349623-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 94526b7f9c..f3d4e0829a 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -1630,7 +1630,8 @@ static void qtest_free_machine_list(struct MachInfo *machines)
 static struct MachInfo *qtest_get_machines(const char *var)
 {
     static struct MachInfo *machines;
-    static char *qemu_var;
+    static char *qemu_bin;
+    const char *new_qemu_bin;
     QDict *response, *minfo;
     QList *list;
     const QListEntry *p;
@@ -1639,9 +1640,10 @@ static struct MachInfo *qtest_get_machines(const char *var)
     QTestState *qts;
     int idx;
 
-    if (g_strcmp0(qemu_var, var)) {
-        g_free(qemu_var);
-        qemu_var = g_strdup(var);
+    new_qemu_bin = qtest_qemu_binary(var);
+    if (g_strcmp0(qemu_bin, new_qemu_bin)) {
+        g_free(qemu_bin);
+        qemu_bin = g_strdup(new_qemu_bin);
 
         /* new qemu, clear the cache */
         qtest_free_machine_list(machines);
@@ -1654,7 +1656,7 @@ static struct MachInfo *qtest_get_machines(const char *var)
 
     silence_spawn_log = !g_test_verbose();
 
-    qts = qtest_init_ext(qemu_var, "-machine none", NULL, true);
+    qts = qtest_init_ext(var, "-machine none", NULL, true);
     response = qtest_qmp(qts, "{ 'execute': 'query-machines' }");
     g_assert(response);
     list = qdict_get_qlist(response, "return");

From 8e9f9981d6846515b2540439a80a0e16f93d4bd3 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:01 -0700
Subject: [PATCH 0842/2396] tests/qtest: export qtest_qemu_binary

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-10-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 2 +-
 tests/qtest/libqtest.h | 9 +++++++++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index f3d4e0829a..6f76be12a4 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -357,7 +357,7 @@ void qtest_remove_abrt_handler(void *data)
     }
 }
 
-static const char *qtest_qemu_binary(const char *var)
+const char *qtest_qemu_binary(const char *var)
 {
     const char *qemu_bin;
 
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index fd27521a9c..dc2cdd0b60 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -47,6 +47,15 @@ QTestState *qtest_initf(const char *fmt, ...) G_GNUC_PRINTF(1, 2);
  */
 QTestState *qtest_vinitf(const char *fmt, va_list ap) G_GNUC_PRINTF(1, 0);
 
+/**
+ * qtest_qemu_binary:
+ * @var: environment variable name
+ *
+ * Look up @var and return its value as the qemu binary path.
+ * If @var is NULL, look up  the default var name.
+ */
+const char *qtest_qemu_binary(const char *var);
+
 /**
  * qtest_init:
  * @extra_args: other arguments to pass to QEMU.  CAUTION: these

From b4a21e457409f972abca2818d78cdf22d59544f5 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:02 -0700
Subject: [PATCH 0843/2396] tests/qtest: qtest_qemu_args

Define an accessor that returns all the arguments used to exec QEMU.
Collect the arguments that were passed to qtest_spawn_qemu, plus the trace
arguments that were composed inside qtest_spawn_qemu, and move them to a
new function qtest_qemu_args.

This will be needed to test the cpr-exec migration mode.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-11-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 54 ++++++++++++++++++++++++------------------
 tests/qtest/libqtest.h |  8 +++++++
 2 files changed, 39 insertions(+), 23 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 6f76be12a4..551bc8c1b8 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -409,20 +409,12 @@ static pid_t qtest_create_process(char *cmd)
 }
 #endif /* _WIN32 */
 
-static QTestState *G_GNUC_PRINTF(2, 3) qtest_spawn_qemu(const char *qemu_bin,
-                                                        const char *fmt, ...)
+static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args)
 {
-    va_list ap;
     QTestState *s = g_new0(QTestState, 1);
-    const char *trace = g_getenv("QTEST_TRACE");
-    g_autofree char *tracearg = trace ?
-        g_strdup_printf("-trace %s ", trace) : g_strdup("");
     g_autoptr(GString) command = g_string_new("");
 
-    va_start(ap, fmt);
-    g_string_append_printf(command, CMD_EXEC "%s %s", qemu_bin, tracearg);
-    g_string_append_vprintf(command, fmt, ap);
-    va_end(ap);
+    g_string_printf(command, CMD_EXEC "%s %s", qemu_bin, args);
 
     qtest_add_abrt_handler(kill_qemu_hook_func, s);
 
@@ -466,6 +458,33 @@ static char *qtest_socket_path(const char *suffix)
     return g_strdup_printf("%s/qtest-%d.%s", g_get_tmp_dir(), getpid(), suffix);
 }
 
+gchar *qtest_qemu_args(const char *extra_args)
+{
+    g_autofree gchar *socket_path = qtest_socket_path("sock");
+    g_autofree gchar *qmp_socket_path = qtest_socket_path("qmp");
+    const char *trace = g_getenv("QTEST_TRACE");
+    g_autofree char *tracearg = trace ? g_strdup_printf("-trace %s ", trace) :
+                                        g_strdup("");
+    gchar *args = g_strdup_printf(
+                      "%s"
+                      "-qtest unix:%s "
+                      "-qtest-log %s "
+                      "-chardev socket,path=%s,id=char0 "
+                      "-mon chardev=char0,mode=control "
+                      "-display none "
+                      "-audio none "
+                      "%s"
+                      " -accel qtest",
+
+                      tracearg,
+                      socket_path,
+                      getenv("QTEST_LOG") ? DEV_STDERR : DEV_NULL,
+                      qmp_socket_path,
+                      extra_args ?: "");
+
+    return args;
+}
+
 static QTestState *qtest_init_internal(const char *qemu_bin,
                                        const char *extra_args,
                                        bool do_connect)
@@ -474,6 +493,7 @@ static QTestState *qtest_init_internal(const char *qemu_bin,
     int sock, qmpsock, i;
     g_autofree gchar *socket_path = qtest_socket_path("sock");
     g_autofree gchar *qmp_socket_path = qtest_socket_path("qmp");
+    g_autofree gchar *args = qtest_qemu_args(extra_args);
 
     /*
      * It's possible that if an earlier test run crashed it might
@@ -488,19 +508,7 @@ static QTestState *qtest_init_internal(const char *qemu_bin,
     sock = init_socket(socket_path);
     qmpsock = init_socket(qmp_socket_path);
 
-    s = qtest_spawn_qemu(qemu_bin,
-                         "-qtest unix:%s "
-                         "-qtest-log %s "
-                         "-chardev socket,path=%s,id=char0 "
-                         "-mon chardev=char0,mode=control "
-                         "-display none "
-                         "-audio none "
-                         "%s"
-                         " -accel qtest",
-                         socket_path,
-                         getenv("QTEST_LOG") ? DEV_STDERR : DEV_NULL,
-                         qmp_socket_path,
-                         extra_args ?: "");
+    s = qtest_spawn_qemu(qemu_bin, args);
 
     qtest_client_set_rx_handler(s, qtest_client_socket_recv_line);
     qtest_client_set_tx_handler(s, qtest_client_socket_send);
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index dc2cdd0b60..7f8dd0a912 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -56,6 +56,14 @@ QTestState *qtest_vinitf(const char *fmt, va_list ap) G_GNUC_PRINTF(1, 0);
  */
 const char *qtest_qemu_binary(const char *var);
 
+/**
+ * qtest_qemu_args:
+ * @extra_args: Other arguments to pass to QEMU.
+ *
+ * Return the command line used to start QEMU, sans binary.
+ */
+gchar *qtest_qemu_args(const char *extra_args);
+
 /**
  * qtest_init:
  * @extra_args: other arguments to pass to QEMU.  CAUTION: these

From bf64633510b2a13268425a3eb78500bc88898bb8 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:03 -0700
Subject: [PATCH 0844/2396] tests/qtest: qtest_create_test_state

Refactor qtest_spawn_qemu and create a subroutine to create a QTestState
object, to be used in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-12-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 21 ++++++++++++++-------
 1 file changed, 14 insertions(+), 7 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 551bc8c1b8..3fa93172c1 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -409,22 +409,29 @@ static pid_t qtest_create_process(char *cmd)
 }
 #endif /* _WIN32 */
 
-static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args)
+static QTestState *qtest_create_test_state(int pid)
 {
     QTestState *s = g_new0(QTestState, 1);
+
+    s->qemu_pid = pid;
+    qtest_add_abrt_handler(kill_qemu_hook_func, s);
+    return s;
+}
+
+static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args)
+{
+    int pid;
     g_autoptr(GString) command = g_string_new("");
 
     g_string_printf(command, CMD_EXEC "%s %s", qemu_bin, args);
 
-    qtest_add_abrt_handler(kill_qemu_hook_func, s);
-
     if (!silence_spawn_log) {
         g_test_message("starting QEMU: %s", command->str);
     }
 
 #ifndef _WIN32
-    s->qemu_pid = fork();
-    if (s->qemu_pid == 0) {
+    pid = fork();
+    if (pid == 0) {
 #ifdef __linux__
         /*
          * Although we register a ABRT handler to kill off QEMU
@@ -447,10 +454,10 @@ static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args)
         exit(1);
     }
 #else
-    s->qemu_pid = qtest_create_process(command->str);
+    pid = qtest_create_process(command->str);
 #endif /* _WIN32 */
 
-    return s;
+    return qtest_create_test_state(pid);
 }
 
 static char *qtest_socket_path(const char *suffix)

From e9fbd9e6b15a054f2b7eee757f6c9b11d4132044 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:04 -0700
Subject: [PATCH 0845/2396] tests/qtest: qtest_qemu_spawn_func

Allow the qtest_qemu_spawn caller to pass the function to be called
to perform the spawn.  The opaque argument is needed by a new spawn
function in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-13-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 18 +++++++++++++-----
 1 file changed, 13 insertions(+), 5 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 3fa93172c1..d97144e1d5 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -418,7 +418,8 @@ static QTestState *qtest_create_test_state(int pid)
     return s;
 }
 
-static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args)
+static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args,
+                                    void *opaque)
 {
     int pid;
     g_autoptr(GString) command = g_string_new("");
@@ -492,9 +493,15 @@ gchar *qtest_qemu_args(const char *extra_args)
     return args;
 }
 
+typedef QTestState *(*qtest_qemu_spawn_func)(const char *qemu_bin,
+                                             const char *extra_args,
+                                             void *opaque);
+
 static QTestState *qtest_init_internal(const char *qemu_bin,
                                        const char *extra_args,
-                                       bool do_connect)
+                                       bool do_connect,
+                                       qtest_qemu_spawn_func spawn,
+                                       void *opaque)
 {
     QTestState *s;
     int sock, qmpsock, i;
@@ -515,7 +522,7 @@ static QTestState *qtest_init_internal(const char *qemu_bin,
     sock = init_socket(socket_path);
     qmpsock = init_socket(qmp_socket_path);
 
-    s = qtest_spawn_qemu(qemu_bin, args);
+    s = spawn(qemu_bin, args, opaque);
 
     qtest_client_set_rx_handler(s, qtest_client_socket_recv_line);
     qtest_client_set_tx_handler(s, qtest_client_socket_send);
@@ -570,7 +577,8 @@ void qtest_connect(QTestState *s)
 
 QTestState *qtest_init_without_qmp_handshake(const char *extra_args)
 {
-    return qtest_init_internal(qtest_qemu_binary(NULL), extra_args, true);
+    return qtest_init_internal(qtest_qemu_binary(NULL), extra_args, true,
+                               qtest_spawn_qemu, NULL);
 }
 
 void qtest_qmp_handshake(QTestState *s, QList *capabilities)
@@ -593,7 +601,7 @@ QTestState *qtest_init_ext(const char *var, const char *extra_args,
                            QList *capabilities, bool do_connect)
 {
     QTestState *s = qtest_init_internal(qtest_qemu_binary(var), extra_args,
-                                        do_connect);
+                                        do_connect, qtest_spawn_qemu, NULL);
 
     if (do_connect) {
         qtest_qmp_handshake(s, capabilities);

From 5419f36e9eb3ec155cd3762a691c92fcfca48958 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:05 -0700
Subject: [PATCH 0846/2396] tests/qtest: qtest_init_after_exec

Define a function to create a QTestState object representing the state
of QEMU after old QEMU exec's new QEMU.  This is needed for testing
the cpr-exec migration mode.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-14-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/libqtest.c | 19 +++++++++++++++++++
 tests/qtest/libqtest.h |  8 ++++++++
 2 files changed, 27 insertions(+)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index d97144e1d5..933d085869 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -615,6 +615,25 @@ QTestState *qtest_init_ext(const char *var, const char *extra_args,
     return s;
 }
 
+static QTestState *qtest_attach_qemu(const char *qemu_bin,
+                                     const char *extra_args,
+                                     void *opaque)
+{
+    int pid = *(int *)opaque;
+    return qtest_create_test_state(pid);
+}
+
+QTestState *qtest_init_after_exec(QTestState *qts)
+{
+    void *opaque = (void *)&qts->qemu_pid;
+    QTestState *s;
+
+    s = qtest_init_internal(NULL, NULL, true, qtest_attach_qemu, opaque);
+    qts->qemu_pid = -1;
+    qtest_qmp_handshake(s, NULL);
+    return s;
+}
+
 QTestState *qtest_init(const char *extra_args)
 {
     return qtest_init_ext(NULL, extra_args, NULL, true);
diff --git a/tests/qtest/libqtest.h b/tests/qtest/libqtest.h
index 7f8dd0a912..9c118c89ca 100644
--- a/tests/qtest/libqtest.h
+++ b/tests/qtest/libqtest.h
@@ -56,6 +56,14 @@ QTestState *qtest_vinitf(const char *fmt, va_list ap) G_GNUC_PRINTF(1, 0);
  */
 const char *qtest_qemu_binary(const char *var);
 
+/**
+ * qtest_init_after_exec:
+ * @qts: the previous QEMU state
+ *
+ * Return a test state representing new QEMU after @qts exec's it.
+ */
+QTestState *qtest_init_after_exec(QTestState *qts);
+
 /**
  * qtest_qemu_args:
  * @extra_args: Other arguments to pass to QEMU.

From 0a3aeedb39aee0d20a954650b2956cfbc0a7c566 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:06 -0700
Subject: [PATCH 0847/2396] migration-test: only_source option

Add the only_source option, analogous to only_target.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-15-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/framework.c | 24 +++++++++++++++---------
 tests/qtest/migration/framework.h |  2 ++
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index a044b35465..2c13fd1688 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -234,7 +234,7 @@ static void migrate_start_set_capabilities(QTestState *from, QTestState *to,
      * to mimic as closer as that.
      */
     migrate_set_capability(from, "events", true);
-    if (!args->defer_target_connect) {
+    if (!args->defer_target_connect && to) {
         migrate_set_capability(to, "events", true);
     }
 
@@ -246,8 +246,10 @@ static void migrate_start_set_capabilities(QTestState *from, QTestState *to,
     if (args->caps[MIGRATION_CAPABILITY_MULTIFD]) {
         migrate_set_parameter_int(from, "multifd-channels",
                                   MULTIFD_TEST_CHANNELS);
-        migrate_set_parameter_int(to, "multifd-channels",
-                                  MULTIFD_TEST_CHANNELS);
+        if (to) {
+            migrate_set_parameter_int(to, "multifd-channels",
+                                      MULTIFD_TEST_CHANNELS);
+        }
     }
 
     return;
@@ -410,11 +412,13 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                  shmem_opts ? shmem_opts : "",
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
-    *to = qtest_init_ext(QEMU_ENV_DST, cmd_target, capabilities,
-                         !args->defer_target_connect);
-    qtest_qmp_set_event_callback(*to,
-                                 migrate_watch_for_events,
-                                 &dst_state);
+    if (!args->only_source) {
+        *to = qtest_init_ext(QEMU_ENV_DST, cmd_target, capabilities,
+                             !args->defer_target_connect);
+        qtest_qmp_set_event_callback(*to,
+                                     migrate_watch_for_events,
+                                     &dst_state);
+    }
 
     /*
      * Remove shmem file immediately to avoid memory leak in test failed case.
@@ -424,7 +428,9 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
         unlink(shmem_path);
     }
 
-    migrate_start_set_capabilities(*from, *to, args);
+    migrate_start_set_capabilities(*from,
+                                   args->only_source ? NULL : *to,
+                                   args);
 
     return 0;
 }
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 744040d53a..19d552f78a 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -103,6 +103,8 @@ typedef struct {
      */
     bool hide_stderr;
     bool use_shmem;
+    /* only launch the source process */
+    bool only_source;
     /* only launch the target process */
     bool only_target;
     /* Use dirty ring if true; dirty logging otherwise */

From c454a8d254570eba3c38e2e0b4e9f3f6d9daff4f Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:07 -0700
Subject: [PATCH 0848/2396] migration-test: shm path accessor

Define an accessor for the shm path.  It will be referenced from
multiple sites in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-16-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/framework.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 2c13fd1688..d20938ccec 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -255,6 +255,11 @@ static void migrate_start_set_capabilities(QTestState *from, QTestState *to,
     return;
 }
 
+static char *test_shmem_path(void)
+{
+    return g_strdup_printf("/dev/shm/qemu-%d", getpid());
+}
+
 int migrate_start(QTestState **from, QTestState **to, const char *uri,
                   MigrateStart *args)
 {
@@ -342,7 +347,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
     }
 
     if (args->use_shmem) {
-        shmem_path = g_strdup_printf("/dev/shm/qemu-%d", getpid());
+        shmem_path = test_shmem_path();
         shmem_opts = g_strdup_printf(
             "-object memory-backend-file,id=mem0,size=%s"
             ",mem-path=%s,share=on -numa node,memdev=mem0",

From bdd739a42c121aefa35bcfd6583c03d95a44c18f Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:08 -0700
Subject: [PATCH 0849/2396] migration-test: misc exports

Export misc definitions needed by the cpr-exec test.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-17-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/bootfile.c  | 5 +++++
 tests/qtest/migration/bootfile.h  | 1 +
 tests/qtest/migration/framework.c | 5 +++++
 tests/qtest/migration/framework.h | 1 +
 4 files changed, 12 insertions(+)

diff --git a/tests/qtest/migration/bootfile.c b/tests/qtest/migration/bootfile.c
index fac059d11d..479c43231d 100644
--- a/tests/qtest/migration/bootfile.c
+++ b/tests/qtest/migration/bootfile.c
@@ -68,3 +68,8 @@ char *bootfile_create(const char *arch, const char *dir, bool suspend_me)
 
     return bootpath;
 }
+
+char *bootfile_get(void)
+{
+    return bootpath;
+}
diff --git a/tests/qtest/migration/bootfile.h b/tests/qtest/migration/bootfile.h
index 6d6a67386e..96e784b163 100644
--- a/tests/qtest/migration/bootfile.h
+++ b/tests/qtest/migration/bootfile.h
@@ -35,5 +35,6 @@
 
 void bootfile_delete(void);
 char *bootfile_create(const char *arch, const char *dir, bool suspend_me);
+char *bootfile_get(void);
 
 #endif /* BOOTFILE_H */
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index d20938ccec..89c85cd314 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -1007,6 +1007,11 @@ QTestMigrationState *get_src(void)
     return &src_state;
 }
 
+QTestMigrationState *get_dst(void)
+{
+    return &dst_state;
+}
+
 MigrationTestEnv *migration_get_env(void)
 {
     static MigrationTestEnv *env;
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 19d552f78a..cc0d09b6da 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -237,6 +237,7 @@ void *migrate_hook_start_precopy_tcp_multifd_common(QTestState *from,
 
 typedef struct QTestMigrationState QTestMigrationState;
 QTestMigrationState *get_src(void);
+QTestMigrationState *get_dst(void);
 
 #ifdef CONFIG_GNUTLS
 void migration_test_add_tls(MigrationTestEnv *env);

From aca1533cd84edbbb084d5e201463ae480eb3877c Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:09 -0700
Subject: [PATCH 0850/2396] migration-test: migrate_args

Define the subroutine migrate_args to return the arguments that are
used to exec the source or target qemu process.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-18-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/framework.c | 65 +++++++++++++++++++------------
 tests/qtest/migration/framework.h |  2 +
 2 files changed, 43 insertions(+), 24 deletions(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 89c85cd314..a9be9c2dbf 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -260,13 +260,12 @@ static char *test_shmem_path(void)
     return g_strdup_printf("/dev/shm/qemu-%d", getpid());
 }
 
-int migrate_start(QTestState **from, QTestState **to, const char *uri,
-                  MigrateStart *args)
+int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
 {
     /* options for source and target */
     g_autofree gchar *arch_opts = NULL;
-    g_autofree gchar *cmd_source = NULL;
-    g_autofree gchar *cmd_target = NULL;
+    gchar *cmd_source = NULL;
+    gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
     g_autofree char *shmem_opts = NULL;
     g_autofree char *shmem_path = NULL;
@@ -275,23 +274,10 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
     const char *memory_size;
     const char *machine_alias, *machine_opts = "";
     g_autofree char *machine = NULL;
-    const char *bootpath;
-    g_autoptr(QList) capabilities = migrate_start_get_qmp_capabilities(args);
+    const char *bootpath = bootfile_get();
     g_autofree char *memory_backend = NULL;
     const char *events;
 
-    if (args->use_shmem) {
-        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
-            g_test_skip("/dev/shm is not supported");
-            return -1;
-        }
-    }
-
-    dst_state = (QTestMigrationState) { };
-    src_state = (QTestMigrationState) { };
-    bootpath = bootfile_create(arch, tmpfs, args->suspend_me);
-    src_state.suspend_me = args->suspend_me;
-
     if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
         memory_size = "150M";
 
@@ -388,12 +374,6 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                  shmem_opts ? shmem_opts : "",
                                  args->opts_source ? args->opts_source : "",
                                  ignore_stderr);
-    if (!args->only_target) {
-        *from = qtest_init_ext(QEMU_ENV_SRC, cmd_source, capabilities, true);
-        qtest_qmp_set_event_callback(*from,
-                                     migrate_watch_for_events,
-                                     &src_state);
-    }
 
     /*
      * If the monitor connection is deferred, enable events on the command line
@@ -417,6 +397,42 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                  shmem_opts ? shmem_opts : "",
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
+
+    *from = cmd_source;
+    *to = cmd_target;
+    return 0;
+}
+
+int migrate_start(QTestState **from, QTestState **to, const char *uri,
+                  MigrateStart *args)
+{
+    g_autofree gchar *cmd_source = NULL;
+    g_autofree gchar *cmd_target = NULL;
+    g_autoptr(QList) capabilities = migrate_start_get_qmp_capabilities(args);
+
+    if (args->use_shmem) {
+        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
+            g_test_skip("/dev/shm is not supported");
+            return -1;
+        }
+    }
+
+    dst_state = (QTestMigrationState) { };
+    src_state = (QTestMigrationState) { };
+    bootfile_create(qtest_get_arch(), tmpfs, args->suspend_me);
+    src_state.suspend_me = args->suspend_me;
+
+    if (migrate_args(&cmd_source, &cmd_target, uri, args)) {
+        return -1;
+    }
+
+    if (!args->only_target) {
+        *from = qtest_init_ext(QEMU_ENV_SRC, cmd_source, capabilities, true);
+        qtest_qmp_set_event_callback(*from,
+                                     migrate_watch_for_events,
+                                     &src_state);
+    }
+
     if (!args->only_source) {
         *to = qtest_init_ext(QEMU_ENV_DST, cmd_target, capabilities,
                              !args->defer_target_connect);
@@ -430,6 +446,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
      * It's valid because QEMU has already opened this file
      */
     if (args->use_shmem) {
+        g_autofree char *shmem_path = test_shmem_path();
         unlink(shmem_path);
     }
 
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index cc0d09b6da..9bb584a6bb 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -223,6 +223,8 @@ typedef struct {
 void wait_for_serial(const char *side);
 void migrate_prepare_for_dirty_mem(QTestState *from);
 void migrate_wait_for_dirty_mem(QTestState *from, QTestState *to);
+
+int migrate_args(char **from, char **to, const char *uri, MigrateStart *args);
 int migrate_start(QTestState **from, QTestState **to, const char *uri,
                   MigrateStart *args);
 void migrate_end(QTestState *from, QTestState *to, bool test_dest);

From ca5be51a51fc6b6402838310ae8d0162fc03ecef Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:10 -0700
Subject: [PATCH 0851/2396] migration-test: strv parameter

Define migrate_set_parameter_strv.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/1759332851-370353-19-git-send-email-steven.sistare@oracle.com
Signed-off-by: Fabiano Rosas <farosas@suse.de>
---
 tests/qtest/migration/migration-qmp.c | 16 ++++++++++++++++
 tests/qtest/migration/migration-qmp.h |  2 ++
 2 files changed, 18 insertions(+)

diff --git a/tests/qtest/migration/migration-qmp.c b/tests/qtest/migration/migration-qmp.c
index 66dd369ba7..c803fcee9d 100644
--- a/tests/qtest/migration/migration-qmp.c
+++ b/tests/qtest/migration/migration-qmp.c
@@ -442,6 +442,22 @@ void migrate_set_parameter_str(QTestState *who, const char *parameter,
     migrate_check_parameter_str(who, parameter, value);
 }
 
+void migrate_set_parameter_strv(QTestState *who, const char *parameter,
+                                char **strv)
+{
+    g_autofree char *args = g_strjoinv("\",\"", strv);
+    g_autoptr(GString) value = g_string_new("");
+    g_autofree char *command = NULL;
+
+    g_string_printf(value, "\"%s\"", args);
+
+    command = g_strdup_printf("{ 'execute': 'migrate-set-parameters',"
+                              "'arguments': { %%s: [ %s ]}}",
+                              value->str);
+
+    qtest_qmp_assert_success(who, command, parameter);
+}
+
 static long long migrate_get_parameter_bool(QTestState *who,
                                             const char *parameter)
 {
diff --git a/tests/qtest/migration/migration-qmp.h b/tests/qtest/migration/migration-qmp.h
index faa8181d91..44482d250f 100644
--- a/tests/qtest/migration/migration-qmp.h
+++ b/tests/qtest/migration/migration-qmp.h
@@ -34,6 +34,8 @@ void read_blocktime(QTestState *who);
 void wait_for_migration_pass(QTestState *who, QTestMigrationState *src_state);
 void migrate_set_parameter_str(QTestState *who, const char *parameter,
                                const char *value);
+void migrate_set_parameter_strv(QTestState *who, const char *parameter,
+                                char **strv);
 void migrate_set_parameter_bool(QTestState *who, const char *parameter,
                                 int value);
 void migrate_ensure_non_converge(QTestState *who);

From 4f7528295b3e6dfe1189f660fa7865ad972d82e7 Mon Sep 17 00:00:00 2001
From: Andrew Jones <ajones@ventanamicro.com>
Date: Thu, 4 Sep 2025 08:27:24 -0500
Subject: [PATCH 0852/2396] hw/riscv/riscv-iommu: Fix MSI table size limit

The MSI table is not limited to 4k. The only constraint the table has
is that its base address must be aligned to its size, ensuring no
offsets of the table size will overrun when added to the base address
(see "8.5. MSI page tables" of the AIA spec).

Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Signed-off-by: Andrew Jones <ajones@ventanamicro.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250904132723.614507-2-ajones@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 96a7fbdefc..155190d032 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -558,6 +558,7 @@ static MemTxResult riscv_iommu_msi_write(RISCVIOMMUState *s,
     MemTxResult res;
     dma_addr_t addr;
     uint64_t intn;
+    size_t offset;
     uint32_t n190;
     uint64_t pte[2];
     int fault_type = RISCV_IOMMU_FQ_TTYPE_UADDR_WR;
@@ -565,16 +566,18 @@ static MemTxResult riscv_iommu_msi_write(RISCVIOMMUState *s,
 
     /* Interrupt File Number */
     intn = riscv_iommu_pext_u64(PPN_DOWN(gpa), ctx->msi_addr_mask);
-    if (intn >= 256) {
+    offset = intn * sizeof(pte);
+
+    /* fetch MSI PTE */
+    addr = PPN_PHYS(get_field(ctx->msiptp, RISCV_IOMMU_DC_MSIPTP_PPN));
+    if (addr & offset) {
         /* Interrupt file number out of range */
         res = MEMTX_ACCESS_ERROR;
         cause = RISCV_IOMMU_FQ_CAUSE_MSI_LOAD_FAULT;
         goto err;
     }
 
-    /* fetch MSI PTE */
-    addr = PPN_PHYS(get_field(ctx->msiptp, RISCV_IOMMU_DC_MSIPTP_PPN));
-    addr = addr | (intn * sizeof(pte));
+    addr |= offset;
     res = dma_memory_read(s->target_as, addr, &pte, sizeof(pte),
             MEMTXATTRS_UNSPECIFIED);
     if (res != MEMTX_OK) {

From da14767b356c2342197708a997eeb0da053262a0 Mon Sep 17 00:00:00 2001
From: Andrea Bolognani <abologna@redhat.com>
Date: Wed, 10 Sep 2025 14:15:01 +0200
Subject: [PATCH 0853/2396] docs/interop/firmware: Add riscv64 to
 FirmwareArchitecture

Descriptors using this value have been shipped for years
by distros, so we just need to update the spec to match
reality.

Signed-off-by: Andrea Bolognani <abologna@redhat.com>
Reviewed-by: Kashyap Chamarthy <kchamart@redhat.com>
Message-ID: <20250910121501.676219-1-abologna@redhat.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/interop/firmware.json | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index 6bbe2cce0a..ccbfaf828d 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -85,12 +85,14 @@
 #
 # @loongarch64: 64-bit LoongArch. (since: 7.1)
 #
+# @riscv64: 64-bit RISC-V.
+#
 # @x86_64: 64-bit x86.
 #
 # Since: 3.0
 ##
 { 'enum' : 'FirmwareArchitecture',
-  'data' : [ 'aarch64', 'arm', 'i386', 'loongarch64', 'x86_64' ] }
+  'data' : [ 'aarch64', 'arm', 'i386', 'loongarch64', 'riscv64', 'x86_64' ] }
 
 ##
 # @FirmwareTarget:

From 696086ad9fb500573c7f710483215e079ee3cf33 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 3 Sep 2025 13:40:43 -0300
Subject: [PATCH 0854/2396] linux-user/syscall.c: sync RISC-V hwprobe with
 Linux

It has been awhile since the last sync. Let's bring QEMU hwprobe support
on par with Linux 6.17-rc4.

A lot of new RISCV_HWPROBE_KEY_* entities are added but this patch is
only adding support for ZICBOM_BLOCK_SIZE.

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250903164043.2828336-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 linux-user/syscall.c | 89 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 89 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 1a5f2a03f9..d78b2029fa 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -9023,6 +9023,29 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define     RISCV_HWPROBE_EXT_ZTSO          (1ULL << 33)
 #define     RISCV_HWPROBE_EXT_ZACAS         (1ULL << 34)
 #define     RISCV_HWPROBE_EXT_ZICOND        (1ULL << 35)
+#define     RISCV_HWPROBE_EXT_ZIHINTPAUSE   (1ULL << 36)
+#define     RISCV_HWPROBE_EXT_ZVE32X        (1ULL << 37)
+#define     RISCV_HWPROBE_EXT_ZVE32F        (1ULL << 38)
+#define     RISCV_HWPROBE_EXT_ZVE64X        (1ULL << 39)
+#define     RISCV_HWPROBE_EXT_ZVE64F        (1ULL << 40)
+#define     RISCV_HWPROBE_EXT_ZVE64D        (1ULL << 41)
+#define     RISCV_HWPROBE_EXT_ZIMOP         (1ULL << 42)
+#define     RISCV_HWPROBE_EXT_ZCA           (1ULL << 43)
+#define     RISCV_HWPROBE_EXT_ZCB           (1ULL << 44)
+#define     RISCV_HWPROBE_EXT_ZCD           (1ULL << 45)
+#define     RISCV_HWPROBE_EXT_ZCF           (1ULL << 46)
+#define     RISCV_HWPROBE_EXT_ZCMOP         (1ULL << 47)
+#define     RISCV_HWPROBE_EXT_ZAWRS         (1ULL << 48)
+#define     RISCV_HWPROBE_EXT_SUPM          (1ULL << 49)
+#define     RISCV_HWPROBE_EXT_ZICNTR        (1ULL << 50)
+#define     RISCV_HWPROBE_EXT_ZIHPM         (1ULL << 51)
+#define     RISCV_HWPROBE_EXT_ZFBFMIN       (1ULL << 52)
+#define     RISCV_HWPROBE_EXT_ZVFBFMIN      (1ULL << 53)
+#define     RISCV_HWPROBE_EXT_ZVFBFWMA      (1ULL << 54)
+#define     RISCV_HWPROBE_EXT_ZICBOM        (1ULL << 55)
+#define     RISCV_HWPROBE_EXT_ZAAMO         (1ULL << 56)
+#define     RISCV_HWPROBE_EXT_ZALRSC        (1ULL << 57)
+#define     RISCV_HWPROBE_EXT_ZABHA         (1ULL << 58)
 
 #define RISCV_HWPROBE_KEY_CPUPERF_0     5
 #define     RISCV_HWPROBE_MISALIGNED_UNKNOWN     (0 << 0)
@@ -9033,6 +9056,22 @@ static int do_getdents64(abi_long dirfd, abi_long arg2, abi_long count)
 #define     RISCV_HWPROBE_MISALIGNED_MASK        (7 << 0)
 
 #define RISCV_HWPROBE_KEY_ZICBOZ_BLOCK_SIZE 6
+#define RISCV_HWPROBE_KEY_HIGHEST_VIRT_ADDRESS 7
+#define RISCV_HWPROBE_KEY_TIME_CSR_FREQ 8
+#define RISCV_HWPROBE_KEY_MISALIGNED_SCALAR_PERF        9
+#define     RISCV_HWPROBE_MISALIGNED_SCALAR_UNKNOWN     0
+#define     RISCV_HWPROBE_MISALIGNED_SCALAR_EMULATED    1
+#define     RISCV_HWPROBE_MISALIGNED_SCALAR_SLOW        2
+#define     RISCV_HWPROBE_MISALIGNED_SCALAR_FAST        3
+#define     RISCV_HWPROBE_MISALIGNED_SCALAR_UNSUPPORTED 4
+#define RISCV_HWPROBE_KEY_MISALIGNED_VECTOR_PERF 10
+#define     RISCV_HWPROBE_MISALIGNED_VECTOR_UNKNOWN     0
+#define     RISCV_HWPROBE_MISALIGNED_VECTOR_SLOW        2
+#define     RISCV_HWPROBE_MISALIGNED_VECTOR_FAST        3
+#define     RISCV_HWPROBE_MISALIGNED_VECTOR_UNSUPPORTED 4
+#define RISCV_HWPROBE_KEY_VENDOR_EXT_THEAD_0     11
+#define RISCV_HWPROBE_KEY_ZICBOM_BLOCK_SIZE      12
+#define RISCV_HWPROBE_KEY_VENDOR_EXT_SIFIVE_0    13
 
 struct riscv_hwprobe {
     abi_llong  key;
@@ -9141,6 +9180,52 @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
                      RISCV_HWPROBE_EXT_ZACAS : 0;
             value |= cfg->ext_zicond ?
                      RISCV_HWPROBE_EXT_ZICOND : 0;
+            value |= cfg->ext_zihintpause ?
+                     RISCV_HWPROBE_EXT_ZIHINTPAUSE : 0;
+            value |= cfg->ext_zve32x ?
+                     RISCV_HWPROBE_EXT_ZVE32X : 0;
+            value |= cfg->ext_zve32f ?
+                     RISCV_HWPROBE_EXT_ZVE32F : 0;
+            value |= cfg->ext_zve64x ?
+                     RISCV_HWPROBE_EXT_ZVE64X : 0;
+            value |= cfg->ext_zve64f ?
+                     RISCV_HWPROBE_EXT_ZVE64F : 0;
+            value |= cfg->ext_zve64d ?
+                     RISCV_HWPROBE_EXT_ZVE64D : 0;
+            value |= cfg->ext_zimop ?
+                     RISCV_HWPROBE_EXT_ZIMOP : 0;
+            value |= cfg->ext_zca ?
+                     RISCV_HWPROBE_EXT_ZCA : 0;
+            value |= cfg->ext_zcb ?
+                     RISCV_HWPROBE_EXT_ZCB : 0;
+            value |= cfg->ext_zcd ?
+                     RISCV_HWPROBE_EXT_ZCD : 0;
+            value |= cfg->ext_zcf ?
+                     RISCV_HWPROBE_EXT_ZCF : 0;
+            value |= cfg->ext_zcmop ?
+                     RISCV_HWPROBE_EXT_ZCMOP : 0;
+            value |= cfg->ext_zawrs ?
+                     RISCV_HWPROBE_EXT_ZAWRS : 0;
+            value |= cfg->ext_supm ?
+                     RISCV_HWPROBE_EXT_SUPM : 0;
+            value |= cfg->ext_zicntr ?
+                     RISCV_HWPROBE_EXT_ZICNTR : 0;
+            value |= cfg->ext_zihpm ?
+                     RISCV_HWPROBE_EXT_ZIHPM : 0;
+            value |= cfg->ext_zfbfmin ?
+                     RISCV_HWPROBE_EXT_ZFBFMIN : 0;
+            value |= cfg->ext_zvfbfmin ?
+                     RISCV_HWPROBE_EXT_ZVFBFMIN : 0;
+            value |= cfg->ext_zvfbfwma ?
+                     RISCV_HWPROBE_EXT_ZVFBFWMA : 0;
+            value |= cfg->ext_zicbom ?
+                     RISCV_HWPROBE_EXT_ZICBOM : 0;
+            value |= cfg->ext_zaamo ?
+                     RISCV_HWPROBE_EXT_ZAAMO : 0;
+            value |= cfg->ext_zalrsc ?
+                     RISCV_HWPROBE_EXT_ZALRSC : 0;
+            value |= cfg->ext_zabha ?
+                     RISCV_HWPROBE_EXT_ZABHA : 0;
             __put_user(value, &pair->value);
             break;
         case RISCV_HWPROBE_KEY_CPUPERF_0:
@@ -9150,6 +9235,10 @@ static void risc_hwprobe_fill_pairs(CPURISCVState *env,
             value = cfg->ext_zicboz ? cfg->cboz_blocksize : 0;
             __put_user(value, &pair->value);
             break;
+        case RISCV_HWPROBE_KEY_ZICBOM_BLOCK_SIZE:
+            value = cfg->ext_zicbom ? cfg->cbom_blocksize : 0;
+            __put_user(value, &pair->value);
+            break;
         default:
             __put_user(-1, &pair->key);
             break;

From e06d209aa69d8ece901ada9620b37af4d87b713e Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Thu, 3 Jul 2025 10:08:15 -0300
Subject: [PATCH 0855/2396] target/riscv: implement MonitorDef HMP API

The MonitorDef API is related to two HMP monitor commands: 'p' and 'x':

(qemu) help p
print|p /fmt expr -- print expression value (use $reg for CPU register access)
(qemu) help x
x /fmt addr -- virtual memory dump starting at 'addr'

For x86, one of the few targets that implements it, it is possible to
print the PC register value with $pc and use the PC value in the 'x'
command as well.

Those 2 commands are hooked into get_monitor_def(), called by
exp_unary() in hmp.c. The function tries to fetch a reg value in two
ways: by reading them directly via a target_monitor_defs array or using
a target_get_monitor_def() helper. In RISC-V we have *A LOT* of
registers and this number will keep getting bigger, so we're opting out
of an array declaration.

We're able to retrieve all regs but vregs because the API only fits an
uint64_t and vregs have 'vlen' size that are bigger than that.

With this patch we can do things such as:

- print CSRs and use their val in expressions:
(qemu) p $mstatus
0xa000000a0
(qemu) p $mstatus & 0xFF
0xa0

- dump the next 10 insn from virtual memory starting at x1 (ra):

(qemu) x/10i $ra
0xffffffff80958aea:  a9bff0ef          jal                     ra,-1382                # 0xffffffff80958584
0xffffffff80958aee:  10016073          csrrsi                  zero,sstatus,2
0xffffffff80958af2:  60a2              ld                      ra,8(sp)
0xffffffff80958af4:  6402              ld                      s0,0(sp)
0xffffffff80958af6:  0141              addi                    sp,sp,16
0xffffffff80958af8:  8082              ret
0xffffffff80958afa:  10016073          csrrsi                  zero,sstatus,2
0xffffffff80958afe:  8082              ret
0xffffffff80958b00:  1141              addi                    sp,sp,-16
0xffffffff80958b02:  e422              sd                      s0,8(sp)
(qemu)

Suggested-by: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250703130815.1592493-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h            |   1 +
 target/riscv/riscv-qmp-cmds.c | 148 ++++++++++++++++++++++++++++++++++
 2 files changed, 149 insertions(+)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 4a862da615..738e68fa6e 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -592,6 +592,7 @@ static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
 extern const char * const riscv_int_regnames[];
 extern const char * const riscv_int_regnamesh[];
 extern const char * const riscv_fpr_regnames[];
+extern const char * const riscv_rvv_regnames[];
 
 const char *riscv_cpu_get_trap_name(target_ulong cause, bool async);
 int riscv_cpu_write_elf64_note(WriteCoreDumpFunction f, CPUState *cs,
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index 8a1856c50e..b63de8dd45 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -31,6 +31,10 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/visitor.h"
 #include "qom/qom-qobject.h"
+#include "qemu/ctype.h"
+#include "qemu/qemu-print.h"
+#include "monitor/hmp.h"
+#include "monitor/hmp-target.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "cpu-qom.h"
@@ -240,3 +244,147 @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 
     return expansion_info;
 }
+
+/*
+ * We have way too many potential CSRs and regs being added
+ * regularly to register them in a static array.
+ *
+ * Declare an empty array instead, making get_monitor_def() use
+ * the target_get_monitor_def() API directly.
+ */
+const MonitorDef monitor_defs[] = { { } };
+const MonitorDef *target_monitor_defs(void)
+{
+    return monitor_defs;
+}
+
+static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
+                                 target_ulong *val, bool is_gprh)
+{
+    const char * const *reg_names;
+    target_ulong *vals;
+
+    if (is_gprh) {
+        reg_names = riscv_int_regnamesh;
+        vals = env->gprh;
+    } else {
+        reg_names = riscv_int_regnames;
+        vals = env->gpr;
+    }
+
+    for (int i = 0; i < 32; i++) {
+        g_autofree char *reg_name = g_strdup(reg_names[i]);
+        char *reg1 = strtok(reg_name, "/");
+        char *reg2 = strtok(NULL, "/");
+
+        if (strcasecmp(reg1, name) == 0 ||
+            (reg2 && strcasecmp(reg2, name) == 0)) {
+            *val = vals[i];
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static bool reg_is_u64_fpu(CPURISCVState *env, const char *name, uint64_t *val)
+{
+    if (qemu_tolower(name[0]) != 'f') {
+        return false;
+    }
+
+    for (int i = 0; i < 32; i++) {
+        g_autofree char *reg_name = g_strdup(riscv_fpr_regnames[i]);
+        char *reg1 = strtok(reg_name, "/");
+        char *reg2 = strtok(NULL, "/");
+
+        if (strcasecmp(reg1, name) == 0 ||
+            (reg2 && strcasecmp(reg2, name) == 0)) {
+            *val = env->fpr[i];
+            return true;
+        }
+    }
+
+    return false;
+}
+
+static bool reg_is_vreg(const char *name)
+{
+    if (qemu_tolower(name[0]) != 'v' || strlen(name) > 3) {
+        return false;
+    }
+
+    for (int i = 0; i < 32; i++) {
+        if (strcasecmp(name, riscv_rvv_regnames[i]) == 0) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
+{
+    CPURISCVState *env = &RISCV_CPU(cs)->env;
+    target_ulong val = 0;
+    uint64_t val64 = 0;
+    int i;
+
+    if (reg_is_ulong_integer(env, name, &val, false) ||
+        reg_is_ulong_integer(env, name, &val, true)) {
+        *pval = val;
+        return 0;
+    }
+
+    if (reg_is_u64_fpu(env, name, &val64)) {
+        *pval = val64;
+        return 0;
+    }
+
+    if (reg_is_vreg(name)) {
+        if (!riscv_has_ext(env, RVV)) {
+            return -EINVAL;
+        }
+
+        qemu_printf("Unable to print the value of vector "
+                    "vreg '%s' from this API\n", name);
+
+        /*
+         * We're returning 0 because returning -EINVAL triggers
+         * an 'unknown register' message in exp_unary() later,
+         * which feels ankward after our own error message.
+         */
+        *pval = 0;
+        return 0;
+    }
+
+    for (i = 0; i < ARRAY_SIZE(csr_ops); i++) {
+        RISCVException res;
+        int csrno = i;
+
+        /*
+         * Early skip when possible since we're going
+         * through a lot of NULL entries.
+         */
+        if (csr_ops[csrno].predicate == NULL) {
+            continue;
+        }
+
+        if (strcasecmp(csr_ops[csrno].name, name) != 0) {
+            continue;
+        }
+
+        res = riscv_csrrw_debug(env, csrno, &val, 0, 0);
+
+        /*
+         * Rely on the smode, hmode, etc, predicates within csr.c
+         * to do the filtering of the registers that are present.
+         */
+        if (res == RISCV_EXCP_NONE) {
+            *pval = val;
+            return 0;
+        }
+    }
+
+    return -EINVAL;
+}

From 7a9202eaeb2797fd122f9034c3739b48a4152636 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Tue, 22 Jul 2025 14:29:06 -0300
Subject: [PATCH 0856/2396] roms/opensbi: Update to v1.7

Update OpenSBI and the pre-built opensbi32 and opensbi64 images to
version 1.7.

It has been almost an year since we last updated OpenSBI (at the time,
up to v1.5.1) and we're missing a lot of good stuff from both v1.6 and
v1.7, including SBI 3.0 and RPMI 1.0.

The changelog is too large and tedious to post in the commit msg so I
encourage refering to [1] and [2] to see the new features we're adding
into the QEMU roms.

[1] https://github.com/riscv-software-src/opensbi/releases/tag/v1.6
[2] https://github.com/riscv-software-src/opensbi/releases/tag/v1.7

Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 .../opensbi-riscv32-generic-fw_dynamic.bin    | Bin 268312 -> 268752 bytes
 .../opensbi-riscv64-generic-fw_dynamic.bin    | Bin 272504 -> 273048 bytes
 roms/opensbi                                  |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv32-generic-fw_dynamic.bin
index b2e740010b26835d28ba49a8041e7b28881b37d4..02be3a72a880b58afbc264177c6c145b0779e73f 100644
GIT binary patch
literal 268752
zcmXqJVP)9d!pdOG$;Plz*O-Hq!I+hWVRI`BgE1Q?!{3Nx774~=8CFek4i*Msj*h>r
z9{L&*oXNr*8jVik%nS^|%+7x{GY30NFJfYt+|=}2yqSqXn7O$)xhaW>dA$<@uV1p%
zc}C`SObpEHn;7Kg%gs|(c*nSr>G7eYe~k{g%Hmoq48mMoKc-u;Fih_1YEV|-Vi4qd
z>>Kr8oQr`$m@CVmSRl$^G82PC@dhSCaVwB&t*@O~#*9&n$Zp@<$;M#J#m;b08QJ}t
z+c+7F*|`|7seIosp=vV|s()eXH@7k|h_kaW2(v#|ZPsRIW!7<LZPsaL6*ppG5N1+(
zyScra*=~|JF9U-xukRaU-bIdSlZ^S87+RefosF6J7>t=FIc{dpVKQd=<j|T9BE{Jm
z7=+o|Uv6f9=b)_ch(THD6T@_N7KX{~?k{HcE315BP*z*SsH`yw#aFu8%36z1Vg%VI
zrpn4XxMeN1mGw|%A#Qlir>yXZ3F13;31uY^8|1d*V#+Fyn3UC+n3Oe`n2_zcs;I2B
zhzU7dm35Ms<R(A%F8;Xms4)8neq_~=ipI>Sp_<IZ%#zHonPqbmD?{_)A_nGjNes>B
zf*6?3J25En9pX#k-~9M6<L1Yg88<(E%s6Xua#S$`D8(o%9A=!zB*^^OtN355lQ=UA
zgD~^rtNaWG%*qPE46F-aV#!ySm6;hfA7*BP;m4CfscWNJv4DdC#HZ<;Nb$&4tnKhI
zxtE85(Y<*&4?}WWI^#qhR`$nU<^PSj*%^|<syQJs-E<BT)0^3Im_e}!iOXUECKF>u
zPznKsn>+hwbpeC9&8^*?#~~rCE?F!P4o|bisthLY83g!bR|qpOFidA=VVK<9%+S2Z
znYDQ_GwbH&%?_KJgPFvQLB4A~E;qR~*_gH1p{aq90i?c|Awb~kentl4R#pa(Sg{b3
ziLyoz(`O|HgUOdRF--ns#4vf05yM|0V@F4Z&7YJQz_e2kgYp`sFT#yXUz?Sfn8i+k
z^nF$mFcCWl(kXVB=_u0ywnKc!gic7Ekvpe!LG6;(6}@XlH_UEX-LboO=)kc<r;eOE
zcIm{mQ@76CJNM|qvrDh8yu0@4#<yF)?)<y=SxLb}?D%IT0~4{6OsAR7Hadx&hviXY
zRz`;R2_Foa6<isZ6<Zma6^}A7E3q;%E4MN>D<5TK2y_Yb2^EM8iIj+qiDlMcWog!M
zWntEAWogzt%EGM0%G#{u%F3+W%G#`bl$BYBm91IFm5o`qm91I#C>ygLD|@q^D?77(
zD|@s4QTApfSB~NdOa{$LtQ^G?giM;1Tp2k+iy0IQpy5ZQ@cOL8U?@hlF#D{u!9?uz
zXQc%uVrM}nPrj7IF!_@Z19~V<kfB#7wt_;@5O-+u3otM+IyO2oIyE{mIyX8qx-_~p
zx-)t-dN6u6dNO)7dNF!8dNcYo`Y`%7`ZD@8`Z4-9`WFW<m^3wj(((3CC(p^PUrjii
z9*b|i)amNs^!V`7OP#LCE?XHqyqX$nLm}!QxwU;d&tV8leY%L72$a2iS_qu2K25|+
z<S?guh*R>3XV9`*eQJo8$YH2CtSk(|tgMqc9Fh61lTi7s6H)m`C&2i{3;{y<AL36k
zGC)9nz=AB0Kk@?@GN5!0gkDepQc)amxTg5S!WwgC4u)cb#Wlss3u=Ueof(CTg&7`8
zG5-VQU66XPyaG(#7%ZR6#ms=Bo{RZk@q>jmAUy}|^FPer%*YVT%J3k)fr%lw6-u)*
zLitddl?lp+(yYu-K9pu<f%2g=D=U-_rCHgad??Mz4&_5>Rt_j1O0#l8`B0jb3(AMm
ztlUsOlxF3D@}V><FO(0ZS^1!RD9y?b<wI!()(;^6Uxw1bj8Hz54rYS#p>!}aln<qY
zS)hC<9n1>lL+M~PC?84(vqSk%I+z2>htk2EP(G9n=7RE}bTBuR52b^7pnNDD%nRj1
z>0mx6A4&)FL-|lz-GG$=<bQPoQ7EknrA?u<E0hj}(y36o6iT;3>8Vh9DU{v{rH?}C
zt5EtWl>Q2(Ss9`BLupkgZ3?Abp>!yePKDB?P`VXLPleJ;q4ZWLeH2Pxh0;%<^j9#=
z4)uRKlx8=CghxA+W;cTJp)|WOln<rZO`v=z&29?iLuqz1C?86*n?w0fn%x4*htlkp
zP(GAqw}SGaG`lsF52e{{pnNFJZVTl@X?8m(A4;>^L-|m;m|<%Ys5~fUSOBG2p)>=O
z-l_zZhtjN2nn9_lfq|h|UBP6=p<;CdlN*PWm#{G?FJog+UctsttS(?8$X+ZUZUU(@
zk<}HeZ!np0tXO@4$&F*h>I{aG&8*!sPNC}nm1>!V$|{XQ%1RT3l=Tb+mDL1=lob?(
zm315im9+u|8Kh!-S>2g6U71$3eAaaMnB4eWh}S*2={d{P_rk0JtnV8xcqQ|53T!rC
zz`(4|$tK~P%*n3g*Q%`d<qgyHX7wX)lLc9on$<bk?l>p+vhy`fPv&Cfd(ZIDAen<x
z0VF=hx$(GPYt!_?yREL`qM(xhsnPoh7pw}uf@JSFC(mcsP-|sg>B98h;6iBSN43`X
z3=?@{|DJ1AYkhy9z(4e-pzC`Bf!OKdpceUZ{f@)F7eOK)q9G#gdL4)Dx+1Sac*}L?
zIJdg0wJw`J!&z_ojKl943{7=^@-ql9v$}#*D6d<tmCV7(0J3|I`^>{l(+z)u)W5%Q
zp<eSVn5E#5tJRjw!YVOcm5E_;>(MlERwf2v)}!k0H$143-7d^(!1}(Sz!DT9kHtCP
zC5x~MiHn2!BkF20&io7pOf#QvKF-brVgJ4TS)IY8BmVt{0*`YbpYcC-VtqH!J(>Bd
zz<UORFp!%jx4SFNaemy!{swA}qE(lK^J6~tS0G=2LZ;D`m3_uxP{;&oJQiYomCOnA
zLF4hJ>5nB@Uo^U^wZ6YFq4=>dl&$a};jt|1GqAYA2Z6`pP&R`=-eW;HJM^(M>l3h=
zfD3_-MPcj%xsT;pAA!X$DA+!hWPJp)@s2y#Mggd-gMi*+Db@!dyB}0N7G-_Vtj@)7
zt`!pgAUD5fm?-$Tk^P?FR#@z_3csK5LF%zM>l@9jU>^m7bbl~=EXH~V#7Zc8EXaBX
zWX5}jjUkX2`M~m6ob}e7h}Q1j$J1FsvGP;^5-U#y-fw6~hOkuy-)}gO1Wq;KYOSrV
z?->H(wc0q(LgLZY3!;iu@%@H`g!c>w*}!HqTyW89<2?vb!|H)hqY(F=p^>F&`eP~9
zORby1Y6B+NBbnz4QR}MkenUd^dxnFI5H$=@2sNzE5H+j{?>8t!zW*?x9<1iV19gO&
zqYel)55nGm2&h$SeQ%(kicqoC4x&O;;r)gKA@4sJRD=AuK@6dy)dr#h<dy|N?>`7s
zCbMxefztRL_uj*-u1(VsYL8k%)Pmgf!2kV+fHJU~90~*xYFf=9YFZWEZ&={_{)0ft
z`w0blNb;sg^4{-12o!<hW?xtG6n2$60m;qmZj)Qv8DMHaWySjq3ZBfWN8So^vb;Oh
zD$K^f@tz^T|5PhX&HD`s?x50SkM};9nBw~l4_x0fOi)W^V|7>s6-`xozoEh9eL#X;
zG8?O%OyH{4eO+N~5L2Eiz29)a>HUU=h-79~8<-APmG>JG9N#k}79=yXTERqBRo`!5
zaCooapqR|eY5@~vReQf-fnB33tLuA*58=s-tY$EorE2dtFxWP_GP=HZ2nb8&XElP!
zxT?S3kYN4Z;X+n2KdS*uR8`~s1_rD51p)@i{H%H~QC7|O8x~mfKw~^r>-~lU=4YTh
zR-KiN?>8JU>v4hjrd9X-h6ko|T;THhb9+H57MPrYsz^0>zu|y!j|ZewJsP;OQCVxt
zoA(TkTFN?0-atfC1Ku+{R94o5^Znm5D9Sgh9eK;F*7CMl)#a^l_)><IO`1&*TbJs-
z-_W4<-atSUr02cC1QBMnBX3(%H@7W?y3^J0{e}dc_Y)X0!73&!$ZS?U@>UBL2gdI=
zG-xrpd9_YvW#D)}VL>h|j*ptW-|#@gtCiIaBEygalSwswzrjHrV*k@;?>984fl|}V
z=Ma&jrtc3NV272W3?+9Wv^rb6lc%$byl*&=mK?f34CIb;u=HX2enW%OWL8cti0-9k
z?>96k3bQc?OlD<y2P$6}0zfQ?EUWqZ4GZMK=@P2qeZzuOguE+AUKUw*LnK0Wsrma2
z2c$t}CJ4Y{c&Wwv4GmHtu?Gk-%l8``Btc>cf-rSYt=?~7kN}B2;4%*n4V@e=${@@h
z9{RI?Gy7Kub8};3VRm!l$=B2we)j$B-!@(NraOb(%<ba*{FB?ie=x56$uK#*lR>T3
zZsz+72iPWuax$Kps?|36>sNk=&s5FdZ(tC5uh8HNv+=0K`wb5S)LO;am>7iFmRUi|
zQLFa{KGcFs+XD^OT5Y07AthnzcZfMlE#Gfw;C=t$gE7pUR@wI(5_sN!xL^cweS@@C
z+haD?1rS}VUm&_bb}4YZ|1iM-V$0FZjGG}W)y+pYLRhVv4nkQ^Hx}-Mh`DZD3S}+b
zun@{(-Jl9(rLLERvW~7hyAPscsR_hJ)mxxa22{Gd-_XDWDPb60-!lks!cv**t@j%q
zFo4RK%6*`EmRbGzD#_EJ`nP#G`>Kh@S52SeY&BKpU{iympwbbxV+<VcKTJ@8v4zc9
zIUs7=m$M$8d7g_EWQH*N@{L;4C7dOXZ*ov_v764}?8w;E0Ae$`f>@Zk(-$M_KE9Ta
zZnZ;f$Gi?OaI9)6R(1FYY74wKaIlBC<oU_ul&=i$KNv_Q^FT`bIo=ZwH%(V-eea+U
zsn+^lU_&^FT~MvoI#*Y%b)r7FMu4eda0JDmLqixyr9dc1<%J5h){Uxat-9(*x5M0C
zoZx5z@)5FsKz!a_VN+2CWKmF!yU-IP2NI1eTy*8sg-d5%9cYkfyQbAutjS=)tlG(}
z*Q=~?<cG4}l^^dnD3}Yg%Q6_7KVX<_F2(S(zwx-T7R!&VYnEM_%);_(S?ha-hm6Wv
zOMWCvvud0>ckR@z6OWEOJM=d^nf<T8c2KTq4-XZNmSWgk{+nSl`!8(y=DIt>uIc9D
z{QSb~-#`597rx%kuxt9{o9vAHW-4p2{8H9p`K7GG@=IBd<=5n&KlvwfvHYIQ^MRe!
zCz+XxMYu|eAz6xxA*zd&S2$Xl0mOgI#q}?%^}WFZwaMY34qfcmrf(Ko!;t)R4Z{rQ
z(Eb^Rqq>sWxEUbo5AL7L#=sHQwhYvkU2s6mJR&sI+|1b6T$G=GS(`9NM5r*EnXxeI
z*AI=ZbDSo!311gyFfM0joY^mYU7ew@|6~8I>B3+iyo9=3_&Ph|uIZD%f9Kyf_3`vu
zf08HelmeBfYOQ(q-Y<9{Hkthc`>NjL$IAtn)meW2bx(fqT%y(O-ZA4j&lsk2vM@~U
z<g5{vQfCmCW?>NK?rs*BWnmEJJ=?Uo-IH;Kb21CNh_VjLkLgmN5&u`s3s*F&9r>Bp
z_N>*bwQ0KP)6K0ljO&-TI(|Ja>H1#a1H<I&u?}7A%cjq8Zgtx{Z5!j{W8eOl_Rlyh
z+$PHaan<_;3t(<~y_^MNOYY&x({&lHO>bVq&XC;A!y^;itj*1E^Y`P4I=^MYK{lms
zPxfc!>2!ZA@by=#JHj+&oi9J$FK7^i`10}3<-eHKTYmbUhuQUj4KDL(n>RcJxIjLJ
z_+B&T(#+=NoD7}E?*z|046<ul$T!bxUT)rMKGS?Y#WJh9{M;6x7Qz;p=Edfln%LCP
ztj^2Odwfpt+{63~0jwZiUhACTrs;q8!qiSfQVj~1g#54J+q{*vzWfN>|0(usII;~O
z(Zc;8*(E>b?%(F!yB}HhQ!F_B?}z0*!-F!R3lC3cWnq}y+M1x(-smpO#=xYwpp`wj
z?>K{qvmpE5U&7PX8Fo$WI0(vjcCDbC2VzZT4>$<neGR`0&&%S^m>HPWmc=)^^%{ay
zfmFlnDlWjx=TP;Ljc&Y_F!hXrN@vtg`5j|B#~>i<I-P}up?L{Q{Cfe01kjvG^K$mM
z&zcM-=cY6szY`29jX<FW?nyKR#I0)KJ?V8~@^=viaZVNnVNTEB&hyRcoD6=gGY`)R
zZ<^lP(0D?S6D0rkduxLr=iU8Io}V0&TrRn6@?=eHYJiM8J`b01?mavwc;<PS+d+27
zID=vZ<Vr}{TN>Kb0CCatkcsE-1UJG}H%$kr2dM=4AH+tK`5;koRu%?k)z(0eEX)SM
zqY$&y13JNFJxC6u79^^?Y`GtZ4+<GjsAx5Bd<r$gxAy4t=gbVv%hNrkKVxQSUiQqT
z*8OUKa{hN7kk01i>fTaQl@(YSkVC6D!Nq{l736P_pOw{?{1bG2ukaxUq(gbpat~(Z
zBmW{#PJhA7Fu6m+xp{d9)5X)%*;p7Rx4GGwb!=;Abf3%$N+qo9$=uu7COA)Iul+Us
zDKo?5R#)4};_3_&LJv(Bf5*(AtntoHd4V{i<te0e)pVR?hSNm0+TWmbWi>-tVFv@V
zx-%2V^~x*0S!iCj3BD7(@v^d7%D<-RAeSiqh4}TTo$YpER)>QNw+pid9PHd)8fptq
z$HfIM1`mxv;ROmOSeSzN!mJGkk;NdP)o#%=9VCm80f|p;cQ<F?xZx~wFybJ`;Rx3g
zhdGaf#Ff`P$EcxV0w*3``O@ov+9C0m%nZVuD~+2~I2n?=R2b*DsI`Ln{j5)093Ib7
z`7i#QnSoh7-EcZP1H<I@<=>LozcaL^Pi|*#C|=-hz~~Bc$0QdfPmo*o1kZ`SdcA47
z>s62_NCf5=h$-y45L4VgA(^tl-2kR~@^(=MVRJEtoBb0X3qEXWs4P^vqIQWvg6*2J
z%94M|YFqy4wKlqLYI$!^P|d8~@~>I_$iHTdc9!G@4i;ATU45L+j2@fI#2JP8p8ubD
zZaNzi!{j!$rH~dK+tSUgERM#l?2O55d`xWY$t;%{S)EVrPnO|eQERhng|wHRE_!cZ
zkhLj5DP&TJYhqJ_vdWi#%4#hCmGwmaDl4S?Q&xKN@BM-U^~@Sa{xz$&{Cn)k`bTR9
zv%1SaW@VOt%^FAkw)#DGn(<4mV{<Dz<KlkSe+aXTI)tyOGETnE$|yXYm65k=TZd!w
z<Zs^@7~k#eUip6Qp_!d8MVB5FHg9KUbyYmy)UelGtGP7v@tkk}4yG>@7iL@j?_lcV
zugCxW6-}1h&IC&B&C8cdJ-k0B_~UI@I5Vp<GaPDlYeS@uR`=wx?+j+GO$}?^@9qcX
zdPt~xUGO`{c8x(|Rm-|gP}^gnt5@s$0~4eSj|QCyI|VX*a{F<SjVHWX7rH9zefjhL
zzy*nB^&@{Lb14)Fb14`ZzMSKH_3$3|qlf)km$f!cPx89t1@bFX<R?$HR!HbUOi34*
z;aq#!!aesg$mF9x5GHOAhL|W&B+MmX<a$&1dnbcACxeURV{=Xh2jTCWjGV{K*%>&D
zGhZ?Yf9GTZ^8}zg7BEi%#0zR|gt)Qc0sE=eu-5kt3G5(~=QuC@40035ZA?h+vMf}(
zqjsx-!S7nwCANEBH-fHA=K|H}U96B=@Fa_}%9cOMYDfMkYh3xGto7uNvd))3%6cq+
znOAW!Ft6lf0JS$6Ox_=0aP0J8);RLFS-s^iv%1UQW;K?-%xXveG^@7!N&Ys2VRA(o
zL-Je>p5{fI43jw?@F%~F;F&BR$#7}D@}l_+%1ib$BsVf~G_T-da4fDBo;)vz!T56u
zgE=1)!?AhEJcn7;nv*|IWzcJ8Uf;o>)|Z@@&zAgo3xi%C^I{K%<n%l?<wg7q%1ihe
zN<%*dB!yfGaf;j&sT4ISN)c2uFZEzdp7xZXd1(h@a@$vy$sHU_$z5`c%}Y5LA2(h7
z2jV}TCHG%AwUnW-SGY}xL3zP?2IU1O8I;%jXHZ_p&#1iOK7;bA_Y91#zT3g7XUcs)
zxxabo3C72>Sbqm@FAUAxKADw4K>RBsgD~sT{PznE*wlv3-4BZQ=H==i&z>$;XE50{
zeTK8^afsORcggi%IVOv%GVGdu$N6tqa>sR!?QHxE#^0_pBnw^RIK+Oi`C!^YG2xEo
z{~Xhjf3mUHiX}H5ho*M+*Rs8QtXk8X)!liS)!BI&UGE&6aS&dQy_|abN_gujSUm$O
zFF<XB=B2IAH?wYa;Bao5#;kVaAIBk|L!jD&(G^sGfMx>c98_M!%E;*2)BwsK=Il%i
zli9!jPyYOrVO@Lj<K;}-*_jxU|9@qG<uZ_-MmI+HRBKqt1=0tT-PCT@Vb!*(O|RXY
zm5E_HD>H*5TpdhJuPb<N{Xj$Vs&-S?&exF8IexeC^dIMm#}T==HuNsMmbhr%=$`D#
z%Fyb*dHQmO;tlQwj;Zer4oJh?05iML9$j7W26v1aU@oev1&C4@;uiO-t*2ooLSk`_
zvvLbNk1d)$b9m{k%)-FKGy$SJ{bDbMZdP~YmghWwZ6U5>b>A!w@&&qnP~Hr>!gj9#
zyvC$?`SH`mS_~%1)n7#>vw!`c+|Dkdc578jP^;GsziUw!;?9|MZtB+SZuNYBV1ZNe
zm6d#-)ftSG)xP|heEo~#-|l78r?z*oPi8yvXWz6LPLscXVKff^&cNE8%*rk>!)f#M
zpA3_afB*lpKd5!ip<dVb2O7LgpC(IjLetyvBb~?Z#Lqme*4hLb%l}h6f!&DF6_U%C
zqCa_q@|+SluL-w)sTXDyHE48wU$DU*#JklB;=eDrU<cye1Mw{07ksdVgpd0Equ*<{
zPj0{RztH`0#`hn>tt>@JXTmPMFJQ>f>iMkYU~<zs*_D-L^UReDn}0?!CiinPO^QnL
zdCbE3EpY#1KF)6-Q$aR>Y@A>L;=yd(U=HHJY`kE$bNggb8HUzIkR9&}E|`MNVc`6<
z5!?nz4P}L=uwG+G+(1(pQksCJghmt<pp*w`Mavd0I@5NpL0}oU=4f7?zEN3k%ddln
zPn{^%U@$o}op~iYLox#=$JVpwj$Jx(?NHpkq&sQ1vTo#EbIkbbp8SQC@eu1?cXJK~
zMiBd<_##$w4h8`b`=j_I5ZeL7{wdzYI{E0=|I@iy7$$eWUir6?c?CB^Z~v<4$xqms
z-8{E>s(DTG`V^fMb1B9tc2n#(hcuV3A!@DHTvQXA8r(dO?w?$)#*jRjU1C)is0}F0
zdgQmV){|e#8drW9b-kbPz@*lFRqtb;<-ZQ*Om6S_2kOuMl~LCD^6P6zZOnE~eg<(~
zP=By@QR@OHcE{#qhUvV`>Mg%D#go537h+cDWiV!c;gHPB#n7zI@|#)1<@aPUbB0sX
zlvjM?QC`Ky+pOlv!|G-%{){2CUs>rTPooR8@5Tgj$@>WpOhNW1yDev7Ue3*6+!4$8
zxZuS<VQ~!xujvuakGb0aZZ0!teB5mIvssnpH?x|{Z>QEvZ9fe`rmSj#`RM(G1VfNH
zkK>mA0)+r(xWGaL)H|8nk}_?EgY9u<J$B|~7CyFS4R_|`1`f7nRbGb8tUDZpr<*c(
zO=nhS=WSMY=S}9}Vq#Y1WMEcf`Q5DM@>^LY<(INr$uDIkmfuYCW;lR!F>AQ|0-3_B
z-14hg`N%JjDIh&kZS&fiW~^#4-2OF0ar@nnsoOzgAZ^zgB<>x9<O=paWwkB8l3Uo-
zmR*9BIW5j#qm%nt#FBei#ZFx~cka>|$QZ|~19|rx(?KccDFZm=u!B<0QwDI#VF#t0
zrwrhf!_MH4{N*VFEaiyvurLVo__Y0PWLD<^r<||R$se8zfYODs!k1skQ`qHJbwWe(
zmr?io2@8b(y07X@KE0f0a=A2vW3IBwmtT|F|Nd82`tqwb%AAv*q0<LsmT|8wV{*+~
z4q<6s2IKY=#t7$RR(H<LrRt2yZK}M*pp{e`CRDI`B!{eE`>e`fB>o-Lu6|w%$|uRC
zZ^eY!|Nc*AWET?-|La)Woi$ywor`@k>yh8Prp|B_F8#}B9KIY>ZV9oA%y2Z8SixYN
z&dxaFAhY_B-^Bv#P}7cAavryEmOPx*$~3*vJNfDw#%A@FUsvCQ(g(~>?<X|ygM9S(
z+VU^W$6I(_z6SN@L4EXZo@vm2KAZ2S*tphh-k|>dv=ERyj0Z~f2U8b{3bQW%m;7rf
zSF^gyuVmKmOd#I~v$Gd+I5#hK;bC<*W?k!GEWVsU*!}ze+<xUnPk0)=Tla%hF{`KN
zXWnMkXlH)R#_<OvBFx^N%j4YPpse@g$7a^O4oowc)sOsK)g5}%cK_zK6h`GmZj8e0
zcmIEMfBfe8r$$#{R$im`1rC|eI&?!oKI=tcR^B2|N%$aLaR2)c_dAo_Ss7Y=H&0*7
z0E*RSb(UYCI#6=|*XXxfA4cEZdN*2g``2h$XbN0*sX=1;4`znu6)#eg8#p*X>1<u+
zXH^E1bu*Y(aWEwFa<L_MbFw`;a_RzTl<n1lgQ;3Q$)9)XOrFZgXzRKiTyBXnCW<a%
z-Od3@eWHwoqLV;uhvYA!jFqC$a_bi}!{n~4xWA2{79VeK($wT+QD(MCP{>2ZSlE2O
zg2P*_by^50^g%Lzx0`h;D;)W?sbycARoki7pjJ>CR91WP>-~rKyOi~o{CMoo`b$`v
zlMysBARNujxb^(x>70xQn;TskpHIHY$#~FZ^7o(ojn5adOupI4F!}pWhQ{X;Stj4~
zWSIQjlA-Z=C(GoUnhcYFN-|8|Damkd%A+Zhr>ihrntsFiZ}?-z@86o$kNiw-V3z{L
z%U<_n=I<`3ZU&_gn2Vum*uSey{|@TeANL34WYGAbveJ`Z$(4UpTHTZRf7*4rCyV~{
zP}WlU$*k(~tJn4Yh6_Q-9IOg?_dxvj8!ouEx+h;-&H%2@^}hTP|I5rE%&Y4S8e#ew
z(&#n)FEhjB-dwMr=MR?u72jO`li}X6XNN!|V3WC9ev7V{;hvoQk_j~awVjQLAzAb~
zOS9^cUo-r#_)qZ8?Qd3X`SrFhneQ1N$h=mr<nO;YnwRr32v3h<*fsrz^W(&qe;ya9
z|DECfI6?hC%#_Fc*MH4$-aNgNF{$lm|HIj!JQddpsvl~--!}+EY4tqLT>a~BjN}So
zHW|<eA5&cG`-TY-T0M_*SO1tSuETI?`W@%TlcxWN_;G@Ht9$Z|<)Bgb-<z+uGq!d=
zy#A==;`X26$uqvNZS$Vy)2#0DGx-?13TP~?S(WA2`w#w0KE<wTfy9sUB6UVk+&rGi
z{tT4HJG+x7vnzpE6T2Vxvp;EcYjkCFQ)_+y;ruJq7~8q^hWBIP>mPXcpKGmkZQT4>
zi@~IMxfj#b<9mYdgx@_33M*!{mS3O|z|HAf8MM0BbsjuDdASM0$>+VUVXf~sd@yG`
zxrh^#p0=|y9N7HwCj%sgdJRD#+If7BGo;-FQ7vGaEWoM)l9_pYk9+5FW>wJmb<^})
zt-`G=M(+y}bi!IeX<&j;vM{Rx$mgG84flgWX{qb`4F-mfMOi`V0#xt)djElc%Bq&X
zdm*ZRhD_ZJsy#t*aqpP2p2_dO-tQX%ELOE7pINPRF#WH1-aTc#FF&ULWM-J$`BLp~
zZ1Yl12I1){44d0q7>!w9F(g0R&eOb%iy`^bb)IGoR|aOaBfpx}T7D(Z+QH4NapY&R
zJU74iS7rug)uYM~Kl&<5o^94}WlHYhU|?3|V%Xfe-2s%kn`SVpyZkae3mQRfRy*=*
zbNd&EKK4t~l~-Kn0hy@0>N-#IITp5{>B>s#jLhmRzb2QfGaP+Ax!j#0xrJS9oA;+!
zP#Coyz7sw1Jjk6O(_!w}+`7e~X?n6et4Q-Q(E0{19#;3wZC4zO#ji8m>{nL$#j|#!
zaGMA?-GM^neZvQXRV|NiuKoZDg=GHUA|UgBhD_WDY9GSdjt4}Lc@Ko4JPS~1${-xN
z`|&ZBKOmPXE2%PqT)Xl-$P|zdK|LU3A1beU&I3(*jqLkCc0$5@B|jw8-ts?Y`u%C*
zcF-8E;YN^3s620H_tD=sw}V1q?O~AVtlQ6l(nZnxf(KlXSZ3S}Qopdf^Z0gl1{P3i
z1Mv?+_#80)<nQcEU=;#LA}o(v*>7xTXHWo%?cI&Y2iv^Wd_Xmw<DReKdG|mg&ym|!
zwa9J*xjdQmH^VmXpCO9-Ks6MzdOCBX`_GV>{mkk|et~0j!E+vF^_E}Ci=Ojr^FF(W
zc{wM;LlhM=4uj-xfc<lF53KzRDHGfOcS3u{Q=A)*F)wrD5qt(2Ndt|UU3E`>znlf4
z^7(J^AIuEQ8XCVJe_;PFJYAi^nB#|o+4M$t#RaYGkJ*0wX%2N~5M+NmYw5quq2Cx<
zJKtXIW8XKec{v*|^D;MH;dXI`&F0@3HceMv@r*}#)i<8R{iUIi@D@KLUAKM(wd5UH
zLAF~Kg65Jz<0GIRRs#duy;UuCt@}FlI^S<lFoL+s{gZHND1)-zl0V6Rzi>dsJ|=(p
z!h+oES~R_R`SHJ-uTN)a?OuC&a{HJ1$?f6}m)O6~xY)e&f%$i4P^wk<$-w9e>PJC(
zRf?cdY;enn{q1%Zh6cv-65)cUnWi(ItQ8e5{mN{_y7~DMhL_v7e`jvExZST6)YE&v
zVS#?L`jJ1v>|g&2mw#tAV!zp+y1g_scY9@_(iN`@Nk>5ATo6}2f3DTT=sEE?s7~4i
z>6Ngt2~95l!*I1fc_O<|@?2H{wM(E7=!oCc@_qtCz3?;_hDWWu?yYX`Clt6P^RV*y
zotr$>g(0c+U?pfgE9ykrp}1pzCEssg&}{S(|HaH8%ysI4_-|&={LzE$Tucm>3zU`a
zFtqYG@+7y<VQbdrVQ5x6!@#W8!{F6=ul4<d{rei-9{aQYX;$N6_<5^Yotwe<yEWrP
z_GE!@_GXP924;;j42*7?3nsU-GbMK&W4qzq<A1{4`1=b6R<_NhI~X2|JpDJr`?28m
zf30pXn;y@d^W*&n27^f<pFBaMUryeeyeIiEx`IZ-m?D*YKx3PX?h~Aof1PGvWl!#Z
z#xNlmWd7q<r~h4WW@QJnE6aXAp8xDmqg&(lNg=tR7q^#&9^CE-o&5!+7)a_#y#z`(
zFmb`7kdS7-h&B`OotZ&-?ecRlwQ7gF4uEEnA*$2QX>~Tb%sjkmdW*AHD`;g)t9$a*
z<qQwQL49tJ$N`t+&;<;C!;2@R8*DrP(RKVJuX}RscLq=@=VDizKDnKR@o(6a!xPyb
z&wKuFaytvJa65}Aqg$ifgu_=3FJyl#{r#WvA{HLy78V|m`(fkOpb;arQ(h-PvlDuq
zt6JV~XkZ5SE=ry<IDz`5px#9ZsCS{nY7XjMlz@5{LLjz7a>-MMpW<As!meNc*EV+c
zCrfj3i2nqQscRkt&E0H0yli@hv*lTci<j?1cCps<$?UAiE@o%t6=r8ecJb`z|61K@
z!#mxTl~{R{Sy*{O4oV!2ISQHoxa8slp7)u|${-4g3t`q&<@Xm1;xfTD7ppsblsLF=
zO2>h~?VYJmc|~QlFaO?O_z(>$*M!;Aw{aW}JSph<Uf@9l#MLLaDl4o6wMhP{9=#DD
zd)y*eBAoR&NEdiL<3GW(T5XWAa@7~&PeJ2;PmSJBSil4ti*G#*iixA_)4wq@C@*}r
z0c3}=_V;z~AMC&I*o*bu^sAs*mejS5sqY0Y6rSCB)}7b=;{NGhnHidw9$gD@p{w}&
z3k9LVtPTe)_a~kN#SAD`t~km#nzJ)BgdCmXD$LIQVG+B?$qTMO`zJpWX9zfX!I9Hl
z<fyXRk$;oJjxi>8J!6w}Pi}a|1a;>Fh&xra-!~XkfJXjU6Pp^C)sOsB>}EVZ`MEiR
z%u$f*LA8mD>*VL|P`>c=c826Ib_S4GJ6x=s;c-0sFOV2Jqs&o!rro>^QUx*%rm6|P
zc0%`{jH~c>aR$xv5w4tWlf#ZPCN~~ql5|U+b&P59w|0iThqkjdFogC`{>IL@_0V=U
z2FB2S;cw~;lgrBgOCFk>*3K}od+y=M&)674j><R|PhhVq4iKo4@hqO8UKQh7JVCq)
zl)gcEZSO1@$B?7gRQ%k(ovq>jU$N5u%>CQh7{IK;{h;wT(Ac=w4YqshTDH0>>#_V%
zR$%$3ti<w9S%n2O8}d)9^ZkYg;>irGV#zaEgg`x~$sHY&n3r-ecunPSOy*`4X;yPJ
z{2Q*U@YO(B>8nBVbT*+zckvs{pnZ6Htj@xG3`}bmFspGefJ`@TXJaT93p4nvCs0)^
z5N0rWnm7Zq{*k}?rU_3oW0-vH9OGuW%M73O8BCG|`1wAbYhK2|@Ne1_r%lt87hPkV
zgR&-Ac@-N&vs$Y`D|;)OvdUG1<o4s-FncDm9r+8h3mhH-VFt`<NB)AuBOifO!DK({
zF@RkHlU03|Joz6RNCmQci}fAAs+#qV`~|rg;$DzDK_)()$oDCkBcBP`wa*wk_k;49
zf)ZqQ(xYB^!3u`QVytgK>78>$tGlw+SA%BtRs&_Vub??j=$JmJR-DY*U<k<}s!x^G
zME<_Nut7faYO}_XKcCecJ}PTmHE3SW!EkDN$Kk-Opt2aWGKPU;tLtYK1{1Z`_X|GM
zFuDt#1kDFFFF#(sZ2BDMnTMH|w;O=c$s`vm@XR<Pc<vgM-&S?3YccAOJqW4^d*YRq
zuKZJ0Ir0xQ*ZO|K0l{XCBmbB+TK+Ywx%>+}3Nf?22vVocao&5{xa<Z)ZFn;OGZyA$
z>;{>k$?VS<KzZPj3pnR3cQ<$}dHkPnxdnsm<BgA!8#$N`wW_tbwf4Hf=G)#+Xpo1^
zvGE>MUchdsyoenXBH-C>kSWRwjvFX1I&Q$|`gMD5sPFdL(8~Rg{JwNCB)>m>_rAfv
zvM@AqdugcWcJar|49v>P86Y1Ot2unMo7}9<%&_$|C=B%aY!8C`4)Xcru%nE!hpk!}
zJs905i%T#xYcMk$n%>8LZ2BE%R*ucruQRlE+f9Eg%=#Z<TkC9yZLF`ARgU~uR(taA
zeZvJqX1$hwpc01BRaxO3*zX`W&o~I0V*u?Jf`plSJS5C!IQt%NR&O_0*OvVME61j(
z$$!3bG^?{4{0&WR+|B`anW!6sT`Q=RQ&zb0Pg!ZpKTv4BUob%tG^?R`46+)5Es9yS
z<zKU^%fDtdmVY4Mu9|8$O~y%hx)_7mbUyZ7(`UFlvbM4*YdrmT!(CYm)OJwTdHU~;
zx3b>Xe~)Fh{&~M(f(|IQAoC;4>h1=yp^xRhe}l}9fLsr0SAkkp;^5iilR==G4&oQ)
z73>Vj92_jo>Kq2O;mPgK1=KFtwXSQK#OilWS%>BCrcUr|;sOJ)X4NBqnKfGeHoEDx
za=JY{6XPg+{W#;~itYcCyG}4DFSyC@e!&N2Pz$Cu^x%qQ*5eE_JsyjS{|C(o3bV7b
z{Oteuzm?6A_3@Nxf11@#7%(~~Kf2BX^6|b-kb8{Ve=;y@urnm{b8t0loG?i4=HO!1
z>o7=W=i>sowb9ME?KuMnIAk`nUuWoJUp0M>du#XJ=YJ)X)g%nJwI?(E;{b)3)l?Z*
zWt}a5l(ka+OnxrTAafMd_I>}sej2mtk-zUh++PHun^jx>GAq0Mm2o`C%F3*~;_JW1
zvXj5PU$8-((G}zi!v)Oh9tMvkzrTwOg|x#!t+2`MVhqVG#~Jsv&E5a0y>h$qf}afU
z7ZixphJy4w+|TIx{=@!$5LrK`(S43H(*#iHt6d5@!*<Q@9D{`TD^QDbl@(}Z`R1uh
z8I<+5`~l_pWz(BMWA6Q&9L-BR4Yb;XS&#gEUvR;{d3mQna>iGdsVinU7Yjh@jp6`>
zDrR*q24OZ)29P?n=@QO@=arYRGbk@(XHZ_j&Y--CouOI%xIrtsvf6h8kcsaL1iZm!
zm3?Ib*)1$C%AhqJRIWhM7;CpHc<vSCizKhoP>^3C?N5jZh+i9ebU(;9L1&^)Kz;KX
z)NVel3u*<!d;^;QxdihKo7yFi?Qs7%f!wgFCAsn|i`NBab#8{q(?uATO%IyRtjW&M
z$F9~k{VOBG<kr+UNG@Hv*>2|hh6CkZt?xh7w}VUq^_W3^eqSJ92Qlk$?$=*Tk&{9o
zt_8K9oxEYL1?9!CLu}{#jxh*Ke+3%N<5F&3&cy&qPrD#)Y~tkcI>Ee>)8KD-GXGCD
zkeSK9zH$W}i8`Ry#pr$UpxP<j1t2}!rnfk+ngUvH(b|3T@cR$`AKx!{P@>k#%KiSs
z`oE5x$voby2SKy)3lfq+>6v+Xr@^UK;i=*bc2oISKdUjAJbwH9*ZTzv3PJ5aB`+rL
z(oj&o-Q+pR3sl-PFZTrH+zIMGL84BcF!4(+5I#r;NDPwC-!D+eg_%<un!4Y~Gc?o}
z+#2w@5qFO59;i(){WUXa-bJ{1IX441cGR}~0j(W4HND08;F+K+VV9yVG%sy|q_#ir
z3qELoc;;LU|74{)y(GPpv$is=Twz@9&X_zojq%2DND92;4r;G}R6^6=pZ5g;svv%H
z`Bo;7U68bOYWf^!P}+KVe}+42cj4_D?x1$l<C$T<WoO?w9=abi@68mA=uLj|2GyIO
zGzN+_uM>X9f{uVn_*I?Es;qpISs6Htx`a7Du)i-T5KYcn$)t7)Hm=s=EdG?4L725Q
z@BM`ZI?PKs`9P@zq~m?T2I*BTk84-{fra8GPbF|@gX{p=07@MU0$N=#J2rJq2HRo4
zpZsto8>pADs--s4a)q)0D+6duMOj6avEwkaDi`1Tf)AprT9V(aWZLKowLk6s1qVgY
zSl_kjFc&0#1;rjHra(4N@&dISK(P%H0m(o_A#n<72Y~xn$C()>w?F^U;S8$nWqXZH
z7l2o$CNr}NK->)qm+2=#BV?W5Kw~?}4d%=uu8IrhI45_TGtO{-Jm=Xzi0PT3Alo4R
z0L49M&FcGx2|Uw}g4*_~ADJ~fncp`!M8Vn`?Sjd5KRLKKK`p~S4m(_wm#{ExHvhn&
zyo!ZMc^M0n@(LCv<pnHE%4=Ad`q(88PkzqM_`^l;G_yM^gW~DQ&&8Q`cz{IR8RlFN
zKhDg+tp5DX9gpOs?@Z0hJsFf2m@qQB-Z{{6Sb5P*a6JnOhfUyK5o>y__^#<2n?bsi
zb-uqixS!cwlmXP@S7$2SKKVI2Q|xv|*R9)ObN7%I6QpKVXIs@GeiW1jSf6yU#~gj%
z&`>0J6cl=sTtKbrI{{yB?+O0n{P#L!t{x%^3vZA*kZxvG)kh%JjDl?EK&t{FX)x>%
zg8-<6*6Qqt(d*jO^}b<21tj!b?>4V&VSe9`;I^to653X4|C{{%CtDZiW)@S%7KhE{
zo{Y8O$=%OcT0N8BMzT*9_helAI$4a14OH)S#EYK-)dr_-y>Cb;W>({3IM;TnmDl}!
z!v!nFqsgsS%*u;Y7?qc>fW}<FEh$i`pyUN9FYX+ebL8pvMwi0<&8l1sUajvJJdnQQ
zpsetdVUCNk5~x;U&_1|5H}vNA($JIJLFopR3P33blnz$4KvKekY=~c4FF;bl0?Slr
z3-S4f<ocgHpp+ovSR2l~!kr<R`vsTyF=hr~HnsCIPK|EKZO0krIJdGro_G9T^7Cn2
z;wM4<=$B`kRXG`)TEXkERIdDczaT*fG@sb4*76V3M&xX4?W+`pn6vCu@{46G5>AaC
zjqb+HOBj-wjx!~{na+^>E1iK^ubpA?R1JnhQ(HNdmmFo3aBgLPEOh*zar-g{WrY_E
z%1SF3-Y+;HgW9*2a58I!nf6%v_^*@u=eWm)KAy@B&xfG=P#XGid!zduc<l^YT?MM4
z86-fpmsTgUY8UgmmQ9`S8y-YL!)G6}Ru}X8h6U=m2O(+h`Mu<tUp!n~K~s^#2clYa
z?;OYEY1<iGK{>K-JI4(7$1*SffqKM&;*;B4{wKeE#*y63$pKQ`y!7ZU;p?gl$;sxN
zPOYF-OQ6+D?<WX=R;__oDkYy{VG?ft`Co1NTDQ=s<k!!bx>$@kW;lSx78%`_O~2s2
zxs9EXm3_jYiR_QF%>Ofbajv)#&wKh@n_AnUR=ZZF=~`Xy7btLnS}~JCKr5?)T9dp$
zb!27K*X?uMW1~Rfb9Q@Z)XV*)Q7`wyLWb=cXgwb!Y#1a!d0-VN4|E!Jy>CeH0J(i~
zE9=^pnD-41Vo67m*;(bp-!OybYtJ^T^Drd;|02`H5_T%;gc>A-R=YDKbG#M<<!@nj
z_SG!T$<v-NtX$RNklg)5WRA<@IY0kxXJ=@*C@#$I`9C@5yF@Y<mjuX`=A}zlOa_I}
zBX`ND*7p+%a+4i6xoV}-4y|?H%%jD4H7fbdbkVqDSqDHZie%28Omp3n->Hix3;q;p
zbx(fuTx4I{srF>P>jF{j!fi4PYu#Ge1=*83jx#)-bN!!$b1P_Fxlpf{_+LiQoYfuB
zieKiXoy^Qy+zjs<4p@TRFu65#Uh`^DS=qqOcoOWt55IZ3xZ|dBI8J8o{Ga^b7grbi
ztLbx`Urldn-{bJ|_@y?lwp*>BwJ58)-cJZ90)@Vlx025!a111Qg|%J+$3e3@E5ppg
z$}3!$Svdu{AAiyLX}SU=_V%{&GN{-uo$sm(Kw>}dE3blzebD(XxMGh-<7r`YEe6ix
z%4=MhgIb%WgT@V+d>g$gxBrZ)+&;(sZq(x$=`RDfPd3+LIC>dm#>xB2OI(-(_cOXK
z+zwIQyZuJU->}C**WXQvcs&2v8;Iz~sFm9%`OMsYHL4S;?rW6leh@y@p1KzluW`rH
z4rLvHr52?tYL_5sCF~TauK`LgpfYn^mr>WY&i4%ts*rGe+SwBGzQCXuRGUF^lKZOU
zzhC&eSU~CIZ`cjzWcKS^(~mJTOm17&(c+Xm?FvKUiWZ0Dt}7gKTpr8({FmI!$??bG
z;$d+}dD8|eZ<1fQa^LYte(KI`)vB!b<j?yF0^ZE(NB$<aak7D0W6djEST40$wOwoV
z>riWLngQ++O!yE1T6f6mKDq5WLvr19hP}^0wJEbYCqr`5ceWcIpt1PP>>nIJaR-aH
zOI~)ZpuDrk<>2R^;di%Balae>c;>S&ANTKZf!F|wbEx@22=gD;UH=8DNkQhh?*AHI
zy8Ul>Dn=;;3OPjiysq<o!vVqRTS0YoY8kkME|?JSdlnLI$EPJ%{N#d{&@0^;l38AI
zOy33yIkwU{PRY}*GfV}QKn>T~Ky892|9-d|o}RvinPGBEOL32b7iiz}pZ60AEI_WD
z;Bcz-hr3<txi+Th5Z4QU_AvhKd_BVf6e^D5n4tj)2~g<#42OgdL}UgiOk~u*gJh7!
zA!!9x??QUOX<f31#J4ju2(us0g3Oa7cSCjqJf6MmAE<7ItXTrF{)R)?pxP|z0NXiG
z-Q29@$^_b%A`b40bhkDy=VCQ$Pk#K3!LD6d;Wfj?)1Z0})YhB66VzhLOwsBRzX__T
zP9`<FFfZ?71GU&dds=o)7d+hIth@j;p4!FK$}*7?w2q9M0W`uY$ocs7mp_o!ijo(o
zZ8gb@$s5vc1G$FnT+k5)f!LE?CqOm(o#3<Q|AZT}e{eW^TA1_ef4iCDS3#|l)M(?%
zmkjR%0%FB?F*7i0Wks{5Lu8IdZf4hFOwRbu1_}#hz3&n413tupRx*Sgntlt^b9q$`
z>V@n*4%)2{bzu5UkY84YHM$6Me_;1&YjjP{oXr4=C*xLk#+irT3n-|7)PsES_~Dm-
z5SN48403x=E2I_tK43$*lP4qCKQOVv@QLmlw}V9AZg=vW<aH1}`vi&sQ2WSHknNb#
z5w$}M91yp&`n?Y@2!OC%eL?A~dC3vq_W>UQK|0i0A+0SLM^5+N?&Mj|Ss>xXARrOB
zsy)J)^K^u_<Z+Hr#F+Js=$?4<WA}b-KeqPXjDtRhXE+P9JzG7w?c2M;*~01K3^NX2
zxIN`Q$RCjKj|^>USeW**Z|f=XYoHw=ZE2dvre6oGW>}ue=nkHVVM*pW&NL;QmHqLo
zW&dFI3%4F;R#w^a4`lQE009@!sB*Jv%RfffIR`<egIWsHzcYf`;tkWkF)~bUOKY0p
zJdr(_@hJ;voj0f@3K}J4)>r`^8G6jc@dsjWdhD+0bDVFuYc3FGKhFHPkL|ZWcq`ju
zsb&8lV@j2wu+{RARtH2^dlakJW|prElUa}aRcn1eAwgs^Ys+8FhoI34R`cAipjFE=
zoI$RhTxQPjQ%pGBogq2-7Q>9gbHatEvok&pVgK_!V1gA~zW_*o=0!*@gx2_lN>>;p
zKqWQXwRJ6%SzG>TbzU@G)h_!MG!7*ZI$4aJG5G=;i;F90J|cO-6E+D)RyT-!$tl-(
zKz2$T6lOij3?3H>*kBAQJ0LbNMM82vSm*R7Oh`JjuW>+hqN)U$^FE+JU#(SHP38al
z5A*kdc047&S<V7l1+jlG7b_@aCbz3=fc7&kJPb->%&M#&jBb-zkNmTn`o5u{ME0rp
zHc+gmc`s{ibYpdWf1th<WDDp-15jBDDt{pE`Wn7)|KIS5`ysXpXxt26xE*AE^YU~j
z$cVrc=jP*Vj1v#TVuwKjRHLz7)9Ms%ZDUZ@yYgppXB#O0DmJSf`P<@@+%rvRa?6oF
zylyjH4Hw*rnA~#wPjb^Yp*ar1-_053b|>>37kE5%`@b75pVb{cJ{I`??``;;1I_B3
zEORb2t9!ECxxlRM$uT+HondkryFh36%tN5@s>x#Q49Qp67(jii$ztU&Hj^-G0}D9R
z9SY<?p)Pr{Se+qZav3`ZNS`}{a5=j`<>NbNKC26e%sB%#Icz&aZ`b7V?{7gW*ad{Y
zt22OlXY5SMN<TS3=Dl~=ASrwFvpPcpvwA1T<Zs{K3zxHVn4X^eoSkFxGd2#8DIjwt
z4^Mu^E>JvyEumSRlcRWoxCqEc$_hVOZg@1SdvcgRtN*X8^pXW+N{@#y+qL@bVhoHQ
z`zN=tHC*i%F8}^rSz#v!$W~>QmmGer?*jw`K(Pdholl;i`c(KkJBR0QkPVglCqHjz
zPz8@Qfx;h@M?m{ZAaS)^9TZoqI(JQPan|b+?rZ_|eF6+P<~StxeG!`6e*6!wo8f{R
z(UaMa|4D9rA~eGplzJb}IQH*?`)4(WkI8b^M5efdN)mO38Ha_xi!mh2vJ1_KjsTTJ
z&XUJF!a-pSo;~|ptS%s;yx=7V^Kws)pJkKVzSRqtu?v*;a~^9=1NkhpUwP3>a5#eW
zym$D(0*V(_aJ(=t>*SbR%FZ!4jg8~wLFFYkIj;B%mw$gQ{LPI)@{n*kJIBJVtB;BW
z*b_jePcCC;5>8WRnE6P!?D~J<@^61ZCSURI?3#H<IGv4Ya@qIy%8PDtT<~Y@0?jC~
z3z)Mv{I3-+1-syazhf8UF>`j%928`3=w}~D^%eig-`JQY9)rwCflRy+ti0$Y%Zy;<
z1ut3V_=DoH)m@q47ek|qSL^$L17)B%0re1)ykNURgwxptR_>o%_U${WA2ctS?ze-q
zAU@PD0{Odi@7Ivr{h-p7K>##63(BMKKg?gI)hP*{dGl(8%zvt#YF0V&Z!+5l_D1&`
zA;~YFF>tYi;&yWT@|U1;Q~Ww;+(4ak*Ypl&Mb`HL30ZR-SfTS#C)g){GiOMi_)OsA
z>>DAIpQ|&>IRG&U*&Ow!Aaj`2IT&_L?{S{vxUUVAE|QzCGF@=6TyQ5E%J06)aKkw{
z;~B$a@n`=!LS}?NE`IuNLcDOh3-gs56YfYHnsI+l#2x3(({sFM9`6Wgnhq-Mg*iI@
z&j|sQx5=UG409YNb}xK?BLve8&+j1I0P)9z1gO4Pb_U_rBh2pu4#b1%nM*FPkU`}^
z%C%>I&$vL!wfEbh_J4QW9~oH)UM~UKZ3PKu`3bAq1&@N_4^rBxU4n%&Y8a<q2Du9o
z#?L>&!dM{$RO0?`y%I8+^#l8=c1HK)msc6O*g)!p+0`$YO_y+<ehsweZ`pfLS~r`{
z0gjsm!81ZYaSyIH?y*7r<p6H?g4{AG1mYTGHmv;ziu2~>%U^-=GssO7&oduqXXJd%
z>aN`JoPiO%R}IwONDRHZzc%zNyd473r~VwKuM@0~@w9RWJCd$cs4nEu90mbU>ugnL
zNBp{$_XP?uTAd(Y>tA2h>ec$bKp~#-?6OwB*7qOo_d;R<G~NPg1(b#!h1>pF)#2m&
z5Bs}8Z5xp5K<OQ_e-zTb)O-kPg*84`TrtOe;^`UAk7b{tjK$47I>)i|_+)Wb#^ihK
zOrW;ususOYP|YUHnyR$X_5B8cSlNRhGeF~wEC*$df?A}Y_8VlR12S4x8hUj<NDMTd
z_;&lwv+LUbit0^G&fUtg)HV6lQkKc3W(-$*cRmHV4m9Qi8h`GH1MP={%nW|{_r5^E
z2h`#L?S=!jdW5H`Gqk$BFAxwGgsxWr`8+oivI{LVw5cICw5h?eQ0*3IrO~FAb)9CN
zN_QZ8KX$cgb$PXc!j98@s{N{V!IOwJLP}9~t)P+JpjJ@3<o$>Kr>oj?KPsy&`7?Q{
z3aIREC@6sJ$vX0<_rSR+lc#Djbg>w-b2{?&ADVJ#>IBElZBH2{vQ9Ykc=lA#9NHgc
zHI~2c8w_fhHIDpgR&V*ktlq%{N`H^9vHcKcJ;AK3_T|s}00u44Dx;<QV+;N6Mcvre
zY1F;w$g)GH4g}q4JJ!Ils|~br#IH@SmDT-L>p@ekF3FSI9MoK<xv+VDigbz&YE6nt
zOl)dU1G)Oo`w#lJw7OD1P8QW>@N4y&9e1r+`^ca74Hr_93o?1bZY5nwyOed|T-T|V
zr9R?s7#W0l&fH*L&c%@Yc#a6DckyWY9Op;Vo7yL{e_&32^qd1UO3n*v4Nrg0)x7*P
z1GvQ`_MNSjWg^#Ok=cJ#eWt%+WSHFb>RR&>PKM+>9nQ((nhe*b&vCvsy{R3fyR&=k
zYfxJ5h*#Eo^6Py;f`0SzZYHhX$<x>wlW(x`FsmN<{r*G$%2lmdt?vsO3?+{?s~-8C
z)%t!zK#AwwOHoQOlVX@+OQYU5Y{&rV1ea${>`a@Y-|mH&-}$=L{qc|I-!ATl@V8!$
zjM7{o+<Kb%eSm|=rs$J<m6yzBVC9_1`B+Z-E6l|A4I7eS<~@#L|8;P`@}k*HFZU}i
zn9X!?zw)}-3_rIkubIv8aJ%xd*$klE=Rd!BIXAQNveis?oX_5#<9zoz^U`jnWvxxq
zL$@n0n$1wTA7*x8ROkN5-$fbjK8LJ&0Hs6F&LdDbXmxhPZ|Vf)>H~6u?#o)O+CXX9
zA<glq7bph*zW>0#Z&f=dQo4ksN@n#Ve?^>yznL-UJ`#xjIBW7VF$R&tET@&V%o#(R
zIKn&6O>vufN?GO0A7!;Cf10K-t3%QpNBCqhR>sFS*?tML9*3s52cT6oe-J4jV#C*P
zyVj<Lx8af7Il^y-zeFpw*Ka{BwL!DctZpLClfRlVBu_iaA`l(mBzP{sjq#ka&XPYI
z;mUeX{xE@D0Uj9?asD_<<giG%@H95Y$8k`%fOda67*v5uWl*ULDSvN<zXaFJpz;P(
z9;|8+zs$@a%*;Fm(iirebn-1|oMhSb4(DVZR;lURKxKW}6pn))2bEP=85rH>p6hX%
zEbhiIu^+Uqaq@Il#?KlICdC>KACnKTGsU>FvVnFE_FSKGyLo8`vv7JlgYq(V#xvJv
z9G>F#^Al+H9@0Bo)&p8s)Vwsc8&u{otEzU}O><&%Y+5!|ZR$j~_YDl%jqb40*RB;*
z28r(k_10H*gWM;6kC}m4FRvrHon3@kjhW$7TcZb~hvtGg?yYQk9iZ}7Sd^Xdu_x=l
zIqs}%>pGtPPHy2~P*yn1kj%#+0IE4Ax3{-UIXro48Ux6FVOG`C?>Bq^_cN52E^kU^
zU=;$5|1i4oo)>YRES|=&YWn0EY>c3NQJ|7P`2q*il<PBYPjP0}=wN1LoBXT|<WJ@^
z$CcNyGfg=x;hy<j(DnU;|NkJPQzvUcqX(Hs9bMl)*#CDrcxH#arsJ^dN%6zr@ULN3
zXJ&xRKCo7U_Mux%<zjvR;QuesIH|J6@(SIv;!8ne2Tv>BZ<zm@S^3DnWN%g$a9Av7
zW>D5&UImJ?#}cehz+ns?XL!07WYXlR?hJE#yI3!>zTa@5+!DOXY%-fGBdhze=^;mz
zIi50rOzSu-xc5`r(Y>J6BA{{l_aF2dLG{Acy%1Na7QX+$-vE|*F#rE#c87z#TS2vo
z+9^;vn!bdYp?S%Z!ntQU93btG{&v}?ApM{+?TS07x0*cT83U*luFg<6d*UHjZ#6lD
zo#DO12LBe9pC2Ic4T@`6+W<6D$$XrZA-VH8gCKZ36wI6YoPm|KmG$XwQ0;5n`rH9j
z1H<$PKGR(=^E61F_Yh2ft=MDs@Bf%xSs9v-voe5m$@YTufLM@|6=1qSIvP(my0@|$
zvwvk^c4ud(1=|7{aY9zrd${#rqr2pS<R9A^5UO*LRD(=!bVt?6c}{DZRy)WQtn7>V
zzyAY`1@4>rSmGIYj0@x@WIH-fgHAt6ZvV>A>@Lc{%KG;=qCJGH4y0=1aYlDm_RZ{1
z8Jdr=GyMIPoc5K$bVV}XQ-)pbAQ9pA@Bbgq+y=G>;-==~-~adagIqazyEp@=m;AFI
zBBRy*bh}-9qx)I-%28wXqYRSAR<*aXFYe#|@3HK6usO)?l{}?2ZB;ucep=aESr_*|
z|Mytx8-}W6{;dqjg<F~Mt4_UFE4FDWXl=08G*DR8iv1N`%<zrjvD9%46B(cJE@)+y
zJlE{b$^f#xR*aSPamRD8I#}8O`4KgqSr382Olz9r0#?>!uA>Yf-H&H)2kQd)3R4G2
z1T+V0%(}p#bS6j*?^8!X)>O#3O2VwI7L4wVZj)IX>=@l{>J>8t2!M1zYz2)GfpQC|
zKcsdl>Hvd)_)1V|=IIPR!J%1&6*Mv#c1W*lRVV0V<L2cp|1Y)rwKkq^nx1@Z6$9hZ
zRb9f}Eq_}a9#2;J56UNy8Dmh}FRGQv8<b~2qKw|iBCr%9cvdE`@%;4Vp!sBVn<>u1
z?5#{OS4FPgI5guh$c-SsAY2D?Tc;)1ZLKi3fmTAS>SXk8^diM|#-<632={?p2N|tH
zZjXb;OhNMm;CZF4_Xz^ZTAhDG8C~CR_`gK0wbAwch6#qv?w$ON&(&JrZ{WWJ3YqsG
z>|f{Jj0ps>o2Ea7r&ExBASD*7I>=w}FgOY-b(@zjS4CUle4Lp<dC_teWVH~L?8=?5
zAz_xT1}=s5zbk-D2dRXpc&^ZTct&ueJ16`U7AEisACt{R86f!xROiPQf?AwGcR+2!
zymO#d=c*R1UeF99cz&^GQ}6qP55mdJtRhi2n%$@JYjr30vkS#tn|>O!Zez6+sNI#^
z#4dCrIGLYaU`}vy54(WhJ!W+-CbiaP%`RqTttY>lrmt#AmS^Sptj=Hn+SzoDJ^2JX
z-(>dFoOZ3J4kTSs*8B47y@NxUFzacK$*c?<?*k?<f>u#z^(3dSWD2|0>XqEy$(Ypo
zeuIL4vV15fbSD%CNd5bO3+!4wj|*1*yA%c5Hw$W0PQJ38p||6`gF;DEt6JN$)`@QK
z6E4UH9u;(JbPZ|+tppD|sH``OA*fYZXBMNf)-J~P8v>+3K516vV#;d06AW^(?a`oC
zMz@Ks?>9Vf(me`kac_!NiUGC2lcGQ^(@(x?t<zjUEpSk4d{gw@?I7DfhP-!Z$N{Op
z6y+2R((!XUME-Bc#qCbfe?w~bzYTHS4^jb<{~J=ey;<Gmci63_>0!6tF9-;MrHjw1
z0w;=91rB^x7dY{F)>nA`hskd~&dvmjbx?Z~w8FN50aB}LGJ@*gi>LjrK~`a8f=Av@
z9#*>rSydBvZd;30m$K54KgtTAlPQ+`0nH?EGJtw4tGYUZ^}3nWSpIA_Wo2$wbNOS;
z%F6s+p}=TWw_fMW2OC#3O#$`(nx-4GhdLUYK4sY4p6b}yAJqEziTeL!k)I5Y6UzTX
zTA7g3BS3rGogzVftWA;AuY%T3Jrx(<3R>%}n)p7UK@OxAB0rslfnjos%O}_E&~*G|
zB7EOJWMu>>jWfD7x;8a{X5gBav3-W9bpHhEZJSM>dK^?<fNFlw+R3Krp!Vvj_D>ER
z&JoT@E_PEln}224HFe)qP`LyWYjj13A=Xnv&3p?AUy!+=QHV3()8=5I4^g518Y&Af
zt<dCOLgY`N$iwz3tZET;)$4qJApY<~$oUNo4epX>izi$WDHgaXI+>k;qj&-29EC~H
z6LBE6x<CGUc~1D#%WAEsTAQX%W@lgm?MB6>9_AXb+y-|8m^}=RoKL~}7Pw=a<N)$B
zq?|f>2Nc>cGX$aKRQhd1IR$Y~`z>%Oq__OW)9*2XUoV4sn%{3gTJ)f}Sk>P85+us3
z&VD2EI3(ttUE4Jsw4bo&@P)&Su8qg$M1jt)0@W3uxKTTGBUsTDH1n~m<^2QxD<Iv<
zip#H99%WWN@~_qPeZvCK?B74pr!&v&2(WNwJP%R}9u@s32p-LYtPTe0V^&{&;gU<{
zc5(2{Bk89=_A9S^cJAi(OD>@Ci9%><JAStH_?_^nhhaWO3)>BlxB!I-IP5mKo4~@g
zsUew<RVBi8rhD?M=PH$j)31SMW7uAEu`68x&6t8lr&hI_O=oKNI|rKE2s*=jy`2Gc
ziop@*=IhHDLS1)3*0CO#4<4zU{QW!oE%wjT*)#0AHmA>INbX^mncObIklev8)960&
zj4|s^hI5dy%?0`wK|Lwf^j*^*Kb`)sSb!@7)T@GwTSMklKsNfFL)hjEIo;;K{n;R$
z2)p)mg6(QymjK(<z%J3~-U+q~G@|x?LH}uxdazB;rvEFRz=>oNXoOtV_5FeQ(?Itl
zfLs6)nc#fIS=Uur=g1$>+{F6>`=@~BC79J({%%gc#*o~{&Iewv+QrV-=-!(8@|rRG
zH-=&ccA<6CAHTl-FLyskfAiIL22)pMts{Swb*}sYtw()-z<xrrTFYN%HJ87jRlgv!
z&K?JuboFqfJ8SC6OAvFm3#|g1)4LxM>WC0<b=}wb{=ofikbh4e2l@8m;YRn~8=!FI
zY=nhu|4z7npG^NJxE~ab5HoCD-yitj4${5zFi7{p!?0N4Y=nf>`E78$Pp3mqZDNW9
zg-J2P2BD){iy0V%Uheg4eZOG+){R@=FYw>;aX*N6eiJ0-YWKchz`qp~#)W%9qgqOL
zKqCpz{I+B=E6X3dsqYIMVg!$ZN>4^tQ0Xen%JK&?`W1BL{RjE$!mKQRA$6()52#LE
z)dCp-^sE&Juj}$!kesoS2{it5ZaU~3?}^7j`$O%fzBdpkfvpb&nejfrL2y;e<C>L7
zV+Tr6tYAAqc?Gi4ZB+|sv}FF*+`pg_1Tv=zk@bS?%sK+<iLuPo>RdHNa>4r#|386F
zUN*>F)$Y~$*z*IpeuI^BpjEt}(1x5TwW&pz?F0L&&UNjz;l-d+)3c^Ah))O2$S*Gx
zo~FWJG+n|unNgh^n%5_ZvoSCTvpwV5)@t1PoFV88DD4?{J!g1d;9$h*p3L%;2~xhf
zPH1)YoBG~hLvoT=qdO?gLc$(0A^}QSjBcQn20^Xw3m%w14rBcT8hfpOF3kP`d>&M7
zSaRlchAtL}Tb^gAO&4%J)e5QEj(!EFg8%_DP&!ER^4)F*8n@jGvZd7>*&fBSJ5Peb
z3AC~@##O70(>1wgIRmSE^3>-HH(ZnXzr$<!8?KL~m;Yl9Z)0e_-pcS;^!q;%rwAwJ
z6|4+*9L=U5nx340gDLsJbC$<5*#5FE;B;+jz>sH1e(;>>@eH=#2U+!69oazZ65cxm
zq%*n}?tlFD`H#2TryPuMI>_qCro8IuKai|m>wAZQR94rm`(xZB-IEi(vq9=twNnfN
zAx@yR0L<#_)yZYo8EV6o71$Ue4vAl9WDsU&pWDU0Yx=5|4rj;=_K|<@51hZ!tajud
zXe?KJ8fZqe4RrSQg85rOWj>^|hV@23eRr=D3<9fKKxgG&d^mkOXtvzFG`W>s3Nq{9
zR+7xmCIK1+n%w4AJi{rOgIz*=Dri@=YQ<mI<R?od)TZ+||2(^Fy7B^chD}qFc|d!d
zIoa;S&pZw~$*F02v+9w5nhV6Yg7xGGi?K2~HmS8vW@BJ_UvPj2eT+xY_5FqYuR-pZ
z+<rW#<1lC(#?kfth5A<zG52h+m;gwf{Y!|uj%9WnN@ije0J%$;^=Y268fdj){7q0O
zB)hP3fzpk#=JK3mCQhDabxt<c)H(4JkAqY-O$Vu&;RG^UdByS+5Z%1oJr(39sQ**u
zeoW@&WMNk4WQ&MbJdM~>^W`6;7Gzd~?5LS68VVl25oT>&hOFxSf(LP{S{2WNcHMy0
zsvr3`!%1yA$Kj7#A)#_K>f(0Ls7r^_`wRbHLd9a<U$BR=U1Q!~sDA+(OS!n0HMMg;
zM8(sn_ZQ@!gT`TM_kzyFOx+6+SB-psVg6GHduhb`3-_OZ)MV~$R(ItPo^H;V?7%Ju
zN?V{2KuDhx)N)`}Z{=9qtk)^qeARVTi|{XVhRIdp48@@HPYO1etm>3J*}S}kWAe@E
z43ocqzd!k>B!lvjFW?!^_X+}Lo@bMLxHv%LWq;k1pFig)R#!-9R^wy<=`jw!&cNE8
z`+V~E@81!6E*KR)Y*zPVD4t+0(!87nJd+G+OBYX27x}CfAke(rh2!I_%5q`$@A=9L
zu5h%v{p@E=Pv*NNAk5C*aI=5%H+2T#=j=>tPnFJ2p3KRnyyyuBBz=SCYCvmaA-znH
z3qbSRFx%fN7-&0Q1<iBYwS&ZxCvt(}mT~g;@4rDO_DZqe>@S|cp3tn`336LXv-(Mf
z;t9)BChp(P-oOyspSWN6`}e=4vmejo{8zXgH1954{{8)A@h*m&{h+z>(ET71;m-gS
zs4rEZzEpwwQl(fuKmp{-$}(ZLZ}qKdkU8?g*;o6O7d+umUi5|IvpR#qJx<X6_f~h|
z=bQq`EWa3pzyEwcxlEm5aymQH%tw>UzyJL@yLbY-g5Y*xcJ>K3`=4$_tSRxj0BRF~
zTE@-lM>$rtSak{>jtEy?@PtcQZ6;IlX?8wG_vGyF4C2Q@C5d_zs3e)=ybClx(Rzdf
zRLlIov#MQuJ4lv&L-HJU5$5GC9G&1(By0PVS-*qE?JvxK)4ZI83$$|MCljdD1(ms=
z`WIB|T+o8)cVBvNJFn~e1N_~f+YvU{!Nl2@r)~$W)#wM!z%gvFgo(Q^aNMuf`aa=<
zGfYH%*<O&yf(i97k>fMBZfA6Tf8adm9AX9o6PS4Wtcm+MUEd$@2i24e24-;ad8Ydt
z!EG`~x;6mUF1#<>*jt-r-IE)hyXm?ow?22_bx-bn?gFk?HuNt5)ho%fm%F^*z`vMr
z`}+_1pxt%9A9u6AJJ>Ai4jO0Dbx&@4&cq8cfeE5Ze=b<p+~p4MH>{ukS)Jkc$KMyX
zzF%;E=Ed#r7u?^ssy*~BBwUYo`<(-=Mo?>G^xW3Ttj5N5s*RO1^`H1sP`@peSy}7K
zA7z~<f57GjI5>gKWma$b+pOmD*RO5*QBW`Ms1u|vbe;Y_K*7OqS@Q}P4p3?n-@(Wr
z%<*Cl#HQzSPPM^wEVYN|NS*#ZfWfwTMGM0n2aqg8$B9`G9qqHA=G#D2w@!H<pkUR!
zf`##p3qp0q42Wv=84%S^Eg`CxPJAEWVBWmKg=tQ}sW!hhh}j&|AgYf~g{WpVhp0Z<
z_dX!Oq<O^=ra2)9)hi}LRHsjds8%(BsD9f0KA^#{d4&t}oCt(!kBJb~>=PlXT@4|s
zSv%hcEYNFSafEqJ3_|sbK8Wh&eGt{DdJxsBZSMmPXoJ>??m-HZjvk0=_a2DqR&9uC
z*XH*D4>X!r9AVjm6eb#75Y^8+A*z>ZKvbtTyboYdYhK~Py2k_Ik`vH8*4_?LeN+_^
z`>nO_0~C~-R~%v8<AYG0(F!qJy%nPRsS-r>(yI3X4hqdHT-f#?hj%kX_3<W%YE}h^
z>Z9fF0}^DLR~%v6gB;!s5Y_1o5Y?)(5Y<mh-Ul>DHLqx4yaRFf3Q)@Os1sifE*t6~
zs$HcZs#%NP2P_b8UcthC2jXt9>KD}z)yu0Ps#C=ws#Wvf2OJP-UeUt-2NIWH)g6@(
z)$WxL)vY2B)vh`310D$efy5)&_VjXyic}$pilt@m0}k*vFJa-jdjulFdj5UD0>0)I
zES$~Dk8spVg2NJQOGX;Rmh?1;8LE5`9Zyr=2Q+Yl>W%jb3LcL+SWh*tXyI&L?!qY!
z*0%zxZ+RNXEQsDzE{I;$r1t>_*thO{zaYM0RXfyt-;-P3Ke+$*;Fk9b`fuj$nar+m
zkZ~hKZn-yz_jcd=2?E-ndYSDUsLj``=ElL94yx;Z_9eGHV*!=o5y6|<_1a_)TLf3Q
zvmS0<%Fd~*_T}HI7Dzip@+qkPQ)`8^@Fuq&=dc5{gd0Gjpgsdc{A<Wd=n4j}0}LF@
z%iR#=IoEd<wL{xlKC3a9TnW-^-_+i`l!bHZp)EnoE7(|*`8XJ?+V-_+bu!Ihd^yPl
z)c5deg`6Ke8CqNL{{o3>bxv}D$&^MugziNH^{TWwlfxFUsonCs7ItY<=en*&7sUmw
zEXkZRS(uk{a!zJF@<(mzdx3^f(0sjd`z!`!hUE-TFN0P)a;8uI_Wf^i>obPt<(-_p
zul+!Cx!}`X-+x&D=~Bq1$VpM4{uyL+3&Hnlg^289Iogk`C;vS}&ByJa6A;fGYY=EV
zx9rrZ6QDh2t(=YSj2@sdRAoJu-;>Kl8P>IZJU_Wyl>s(KBK-6D|4T;%IVY!>GR#e%
z-2R>YX+N)fa_4hC!E|1B!L;P|=Nz2ryzHH+$^Fkoc++LslbfFl3AdLrfNr2-P3L7#
zZhbB$3Zh${i|tJBWq;bA+<aU_FrAY<x$n71a@%%3P7u4}IiF;D^0en-!dF!oWIGjE
zCySIa__a-DZTT(e+B7XWdI8hK24>Zk-;=+z@K2xq|NpY-&zsmqo0ofXNT%QHS6=j!
zBX9w$E29@gPt&wy{{<{+Uf&$jT&}r*&KCrougJWVlLK^qA1M6a3n+MkLLYPr(yErb
zk1rjWTyDz1>n`Z|xaau?gkL#5AJ2aNfz=gaZlYJyw8x<feu2h@g|CJ%2$vpZ-#p!&
z(QoSJ>+X&+pfxNUjIO7qD=+xT0kT`o3t>B^&lFvorag{Z@MU5H$XB4gHq2+~>c~FJ
z-7e_L=q0-y<Ze)ZQU8+ac4X5Sy#!qqw{yBWdU0;&bY=AVx_9#R5{AFsFTV?a{lYre
zJz4H63&j15u2c0M`z`o#cdKMNC;Q`u=dTW?Pi{9qqL}`)UznZUA-Ul>lOiZDx;&oz
z{137nj$WLup<9tf7`-@MJ@-y-JqcRd_~HEtH80P-uu)^sUQDe{X4O_sy$(>i`g#~S
zRZaf#{QpE2;Z#$G$>FMuvgwn*A7>Y4|IU7DdS?G*HUp*}=Va#Ve4XjrrYEz0=jctJ
z++NO<%>JDZ)E)z~ctGcSn=>Ude-{9ysh9nR={wVsd!Dlxg3?mMa{<lt<o4%$njl{P
zbH3!J>jIV_cIR^eh<{bnUxNI5Ai3+gfN=R&*17JCuHq65pf<#+WS;K~lUYx4fOg>a
z@3ve~*y%NuCs5G!R2$Qb<cI~Jo5wg9U6)N)R`|&Q%88(Jfk0y=%&Oqj^#`=(M_J{_
zpZ5X`%HTGP#*shFYAt^@K8K{Ri7t;@pMU6d5!}w|TDsk}QMj}foT67vf8O-``l?nz
z*U0^@jg!k;`9UKk;*<aXx10Q&$@!b2YqKio>}Hq0bN7Sn0K0GF-u;}ebGJ_pS7n&n
zy^y_+{o{5}n)I5=<0$C5bNgg*QHIIi+xcVnb2fr<6(1`og@J5xzqqQ^bUPa>vhC~_
zR<$bbpIm;F@znI5U`|)d?V$M_zk3ZFZO4>#w)|4oJMwE4xMYK@DiY>w`E3R(+d5{l
zFspKLHoI~%2(v-Tw*+ob4rAqfi(ay+cX9T<2Ct5SmTde>L939GqCm4DpCUnXAPBx+
zD?|iTvLWj^zYwD4BYZwg`1{wto$1Le-x(TR1)qXSXg%<$5g?Ww+ve0|3=lqSY-Bns
z1H<H2)}`-1)UN}n0gc0=%B6mI|Ka~7>~gMC-hcSN3cK9X8Sg*TpNGi>7PehqbamO~
zQy0&jzjXH6>02l79e;H6+2L0Q^X@lD{wxxk__Lf@m5pO^`|)p^S-&uB>U_@-P_NZq
ztj2JtSWDngv8uwM&*}{f!okNGgo}+CCKp#ROpdT(Fy=32nEb<nK{(<%gE7Cnqj1Fu
z_EuNF8I!}VGn(@;Fio!aXK2>rU@)GU%3$2Hjlr(hxb8S(@-%)1;re=p%~PK;nn!&2
zv%ToU9bt|i?30^5vA?a)tT(P;XWU#A&hS(|RsPU?vH6qt%QFbu%QG0~|7YC3|Ns4`
z@`u1;o8P}@G~fS!f2zFGd?fk#X!7-F^6_Z$_Gt3*Pvz@o2wO-nY+wI>zj4M3#;5Y;
z>;KnJo1ZEVa*5dd&F}dcg)QV6j5B^PCQEQIn6LP6pDJ-^Qu0)$kj)Y~44fIsSt|mB
zCCnL;-8cf0Ir#i0N4qml{$0(mxotI*c|60H?Ntm{g!%uoPwx7~zJ2rm-{vd+|2D3F
z&bYZMobjn}s>H9!VKcVx|9^Y(W?_b>@?f`Y`oG&aqk`er{HH?OH~*jgv-;O0kZYa_
zZ{PC2dUE&a&mdR*n!ITC<V`{hPesgk|Bv4M=o90wDas3OGl0xVmEOMlzxC$F!3<Ti
zCvOp9cq+a5NeRQR*^`Z>88$zj%rJS2Gy_Ov`{w`BPldO~f4IB7=)+vO`IGzqgJZ^g
z_y2#}7ytjax&Avic2cFE3fIk^Hd)wO8f^aN$H|Q5yZ`S4#YC#KasGUUy4l;8{NMdl
z1f;?^yPDzJl<kZESA*>qHh%wv@!I6=TmIKQ6#=>K-xSd8;O6`P+kxa$<u^Y`VXT{P
zzWTrQ_VxekQl+2DZ*Kd<cx%?rdXV{(H%T!}?(hE$vSrcy%}<ILlo!lr_*pV}n;2-H
z)z{6>o-r<(GUY&J{m+ugEiK=K`TajHnxZrxw4R*pkFo+ttugl%hRH1~pF#J|q%nY0
zgVY}RI615w!YiBHcI=aJhd6U=^P*`p4uQr;+CM2xS5`RA2x7Z~+1J5r_D@RFkF_Z)
zq%&;lFlN8OSXrjm@w0StYwJg0Hn)$9rYcQSUf{~Oxm}$(t4mqIjM1xiS8G(KSsTb4
zkeL$B$xQ4*VBTk?=@QP#JnR-A9{Z=CWlGa0w;lT|;k;<t6enZxR}9K3oWIPbgM8xl
z87$WK%mKt>1M_xG3;$roQ7q8T0MdW_6UekqH{R}K{_85eZpob2Ra)JWd9JIdGw?Bi
zRDgWZtl#-d!g(|2cgA9YE>I}89QnFvit+*xMo@^jd|fnU!U5383ENktY03(0j3D;0
zFG|yR4uM#0UzDa*mdhOaSuV`Z{$p~x`xm9@i>A*w{ImRL+2nTiFO%DjeOomBRLicO
ztj^8cR~Q<7I}S7YZthyi$mo5q)wnf_@jZip?&kI!M&*X(49&}r{Mz}PmHV-<_W#N4
zvJ75xPt8eY{=>Gf_vd!ua4XO`%kJz9lgp|YjKi-xuy#KdV}HZS^=kU2sgDz-{{JkW
z+}{3i(RAij><r-_JR03vZC8QCzAl<R$NA~uWPUCl5dZksMbniRxHH0Rcr5tm7fif)
z1v>+X?f!Mq^a;)&7W>yl(?Msp{44|Uj)Q#kanbZe(|VkzIQ=ZIEUzq`+}{30nBD!0
zFe~eqMbnk0D^2z4o#QOw%;BikDg5snW21kkbFUZYiiPLcTlkoq=4DM!?)%H!%0IcR
zj$w1#GNyggHuGI~FlN5X5ME%+Q9PlIVRD!qLvm9Y)8p@#|2&=%_Lsc}qVMsvzki|r
zO_I9HxSzd)kI8jEdjlU+?siao9{;K|UBDUSDq;5akCWToKZ0U|S&N+kbk<3Dfm<WU
z5A1)8IlnM8t9JfoUfRhS)%N~_{1mY6Z^}9=e{E)c!r<5X{=xmtok?O7_XX&M%nRX*
z{O6hHb<fMsd!M(S&paPK-(Ru0iA@daJbX;4yVW`Pn0$Auv+yyMZVoRn<tPqlVCYPl
z%*OJ^xMP}wIs*sO-#rj}LA6V#yI-sF5>^J~WvmR!D_9wB9Gr7ddBxLT%FDj~djFt)
zP3Cs<_z(BZD?Z!@m66*w)&G4e1gaml^Ednjm6D+PL2Uk0`R$A9{~ntERA@6x1Ouon
z1eFZii$2tY>IqO?vYo$SE~FlrHXl@~m`8l5-~8kWBgib_{qhXk_t(z_nFT8EK_v;O
zoCTHl$^0A)oN13UmVGg1Yh`YAW%W7LVH}pmpu1;X=g*zyE9&QhO8dwCOn=NH7`~X-
zGh6|i$p4>x`~LsGw=eqt8)PcTrBCIb3LTpNYZ9nT2Dxza`*?=!oBrQ^Ds%`e1}dSq
z@BhCWQ6qunXQRniqsd33$y=kzOFtD7gVbP)K()pX#-~Et*Z;5nHR-85$R)q#Z+^tY
zD7*tygGDevYcT6n38(qVa{LUfuEG^w48}7>8Iwgg7&cEWW!Nks!)UrmI6|EfRKNSp
zXx89hFx*8{n_?-VO|h-ZRee=ku`0u%VoiZVpY;?D6>Bsw2;V=(AY5<HFuAyrVRF1B
zgE4zO!{q<=43n>4V=!j_?g(m`vpQd!E`0AA<8~$nCgC!72Ie*F44XwBGfK@n)Vldo
z7z5)o*=}Ru#|+!UKiu73@nJ5gmpHlO2YYULX4%(%VfN{NH~$c06lR<D*KWGoG+{F_
z24Qn?hQNOFZU6U!MZsc`edgQ$*Mn5sO^3_dgXA|&2lYm8_BX!XzWjgv<o4-*_svM2
z$>FnE{vBgydh)C5_LHZZF(e;jw@dD1vM~>5_+nnha0S$#5N7+vzJ2@u-`f}e|6ST&
z+6U4*xq0&6?K}S8-Zg#G<jEZ~{+jRpzZ+!!t{I?uP?&r6-_4IdGg!@@yhDP)eAoZk
zn_pBg2y@N)3#vu8@BCkFoGs00HEVL`OpqzjyJiYoNil%TG0w_j+%*GqIyJbSf9c6M
zxqJ3suqnI$OK*N*!D!4?&ImGp`^x{jqo#xPb<X^2oF&D$X(q_W+gJRrHcoeE1epdh
zXY<RK494tYjN4cIw+4y1O#`ViPB&)+g<)VnsPsSfRcV^Up`Vo?cH6hfot|HnrY)KY
zx*?^qys}J~o&681w=f&1=Ge^nguz(+HKW9#&CEZT!Ro&XUoT?-=?C$SeG$H1#t7m~
zzV60YS@yF`n9c3W<Tkc1O4AliOKP9nt-K(NQCUHa@zLbX?bn(0dVY1R>e|)1nP&!5
zau<^nxcvGGs_&9H*^NLoqT5$+{U|QOXgA%s4O&Zr#gvzD{z9uMzkqatYf5f#P04y)
zC7Cl_Rh@y2iFsA$FXL8MNKOA^Gxrm4-P#VeE3U24cXHWxMoxcT55*P9oa|!iEL=>&
z?XnEBrm0O!W_ZW4t5^7Y8G|wVb>_6`#$3-Fj60t&gcn$X>uBNYW(>(Z&xIeCy#Mo9
zjQy`V4?^!_k#~QJ1$r1jJ~{Sz(KO`+ZHypx8<_nK%m%dplozCd)qv`M<pp72_OVZk
zru7{9Syov-xvlM!F#GXuApK&D##~PrAfj#{(T|I!f!Z_E8I>0tW2^+#*KKT{K=p>w
z^hMK@70Mar9I7k_)$8qFU^U6P9<9!MoyrQ^85w<)7hGp-^fu<LWNh@^+`f~s`6xR>
zP@6I9UPe>B=H+L8t$p6g`*_OSf1r}T{R^lDUN(E#%;d&)K~|oZ;M$7)&t|qK48q|y
z3}(|otAB;dY8Z^ekAv!UN%lvqJj>?%oBTL223)VZe_1pgv{E6gHT;8C<IDx>99&F^
zd(|1Zm^}A_Y=Fsw*z8{xO%H2r2DJhTR2!R@_WWjE+QpgI_WncvQsp&keq93Hfb`(}
zQNs0G_y;?1ZN`~CnVsd&%zpI-b|%Z6U_1Um>asADy6g(LF1re?%hvC&+^^2V##Fmo
zor4WjPqMHv`R;~<>G98#+u1*ZYiAvHhUP`=3=r}5&y(9h?Y2eJoAucldYmDm?w=>O
zgIbD<K=({AfZHf#pjv)%yZfifZEYWg*^h(UBudkp7qc-iuVZHbwN{>WHtVo6Om1iY
zG`Y<UEYHd_$GLeO8v{6GOJiO?p2~D)?q0c8(aqb-KimhEoaXEee<7vjuIY{Ex0ipY
zhl<XHi@xtnfBgRXd*jw~%&dMz&CB|YL!UA#Zrctj`N|otfYgIZzwJBz|2ALt|M%Da
z(tc3+0V+%P&9IsVDw9AZh;f=2Bd8<<$?cl~65agb1cUju|GPmd?ZBlnRLyJ*HPsku
zqA}E1W2lh^sW}EN&$qAmzxyKCUFOUFSMQnuQVVi})wInoelScn7h~A`T%2*{^X<$3
zTZ77NyXlPYS)C`BdopYm`OG-;v9WM5!)Ez^jDL4czOKdys;90^Z(h&N@OKle2jA!}
z-p0(ptk(9?oP&u$c>ycK<~CNyIiBhq2F)I<48;@J4M694g8J#gUw`l;_y0Gw!S%m|
z=x1Zt*0H&b18#yc!&Vd%kaffK9(xJVi)Ob5s@-njQ3`Z-vpv)50J(ZQ2N%NS%Q*~~
zLpd0P%S{<d#W|ldhifo6v0F`r`DBixse5wYbEZ(xydHz7d-AmB46W{<mfjrj{gNOz
z-f<0dpK);V_wRo>(;v4%){cWzfaE|Su@R~s#D}>FBo110z^s~@ge)$2bozAAItung
z#0ox;T9Byn+U0Q|wIFu$^5=0=PfrPMJ++;kp<%7KFx%FD$qC<>K)hD=<Z8stRZY`C
z`a$|YD>p!AIf7;iK&v+x1g1{`o#WvWHN(O3cu4TdV<N#T4}ne?(uJ6p{fr63V`Wb+
zd&=Z>0<<PWtFviZa@+!jIS!z;8D8MExK7X;DM4!jojfZ;&+e}c{R`fsq;?53iwv>l
zN$?B@$HOAwThECEZ#@MvS65t^W9z@<loxCu9xHot{ZkguUTx5N9=*;@Ae%xKfOkU&
zx)+8fXMJZdSC?TBX8(TB7<{7><7v<?W5~QQXx4a!gI(*XR+(@=&|P=|O5ihcAh*(i
z)K!Mw++Q1d5;}vyz`^MLe!&M@SlGbgMZ64@!qdV;&w)aDa{F;lMt8*ptnA5b$C;)$
zPh<z3Co(xa+@Xto`ZUlPDaYKlO^2MZW*qvIfwdD9&LA@(EB9fhf<#zT8&PgR28lsZ
zK&u@{7s$Tm<HwU`J_el_3e)-izz24aN{D%kPeD6Eni`N|um!YYD`m<11qp_tN8c}C
zuv*pL_+G7bdMoI>m!%4zS)TVFHl%=7fPiLmF1bMVLxIkQco4R#{o;PfhamePE9w~p
z#9KjYZBplh)|9+wIH<v_dgR}GhKpQa`oaZ4kQtEG5il1Dv$Zlnbg|9>?QVMiz<>?p
zVvwIeY9K4mri0!2WG3i_><?<mKCBGWr-J66TMvR(<riosN3cTo-9lESt!fpY#>gPd
z#&!TCA5iqziS^&A)<!oqsCe7{_Zud#RbG96VSNXq>qGd6CB!AEliy#sV9j`PGW%0I
z)O-X9N07TfYq=n*TPM6<aKIGiX3*UtFZ)5Ij9&Yu*5oPdj8?6XRmTvYtZI3GVS@(v
zhK%-^kJZ{6!F!Bh=jnpRcTXJvjqmDp>a{}r$hu8giRI7x4Fb~1&a7(74y|fk)dEUq
z!feaTL1WGz^p~}Q`j%c$zqxG&sTDlAs#Tcn1G9K3Xy?{ZjrRxc?}wOobR+0=bOW(u
zZ&n4+u4B;N)UaDgSKe=EU|-e3=-ud<?8M48nd<|)_#Dt#T0OGMT7}t;{Pt>n|KNb<
zs`h2AUaeDKCqJ-aeg9yAqgMOm>6#3WrVF#V`~k^uo(J79)XF*I@cRb|A%ahv)m{E1
z7yo9k>jufb-=M&<s^xJ6>o15~T9<mYPA_L>P+n=S{C>j+o@5_ZCRp6LEdjZ6LRhjB
zNDOo%8zfHMmVv}S@PNj$lS4i*BuleO7`Iz8Pj2sI*u*ZzzH9pA_V4zSzq23kY83~W
zt^Zx-{euGCRqYTvUFUhVice=|Q0D)x2bR}Nmj&e><@M}5V0tZ-UJa#Jvh%#(V8ER0
z&B_OJTiYy<8!q@HJA%X}v$gzzx@|5<+<-arC}>yk$HSe?pnaP^&mYVJ?ZH^pIk}7L
z1EZHY_kRXfAIk+GHLP3{Ig<l_34qqyd$mr!*3LM2YCEIw^mc};y~gF~j0>A@_HO<j
z&Um-?{RRW2RXxdWtZbl|J@N+}9|o&hG~a@5lYal;frjhN>1E(OlYDnCf$o$9`DSu^
zJ0obW^KsXeAE1+C9!nqpCwx7`Vfs{14nO*ji(PLzkF&Ap9EOv<Jcl3dpXLJEJp{r}
z_k;F9{0#?(mE!k5U|RqCFEFhOrM18R0?iRjbNLhr+7F==<JHRM37RjEaNN%NpW$HI
zWbt-J;m~$QVX=0Gll_X#xqXw{*gjnBFYUkC4~wUTdqFm(!pl}rUV^OfOk<hO#=tPS
z?U*iPWw*NNbnvaR=@QdRnHiLq9Ay$OV`fm+y2b?Zx$>%KOyC$*`_2N%si2aM?Hq%^
zs&>YgpgHOIt)LPJRMUV;C{W&DR&5P|#9dnxG)(y3e>hMED)B16f>a2zs<OUsU~mSB
zfXtBJ2r~n8Ds-{B!pF&F-}xstO`fjCux+|+cN_bz>2t*=J{CO&v%S?7R8kAGs&azP
zVtx<WZLW6YALC1qIhEkkF+nS*8lkF=vb}G(kPSMac`a0ADeL<NgHn*l^wR(TC$~P;
zg__6mzQLf3^XdBn{^g(;dtWd?4^%cGb|1Xo(0@^@^L@km9?`S7UD|p;t!*LHuBZRr
zHx%T7VgR&K7ZQqIt?wK9@501DB{R%tz3zJL$*f;ll8-EBYIRTM`pVMjo-FZ|3G7b+
zL(t7Q|2z&sP7MHs`b76+$*&9@q3;C>MM1s?iGgTHC@>#mW#$M!6Z&3&u?{2(lKrgC
z@MrROcA3`0pVbxq2v7gckQ~m=@L7F9&E)Uw0*&t*-D3_hy1H)vtS$gn_ws+E``_)t
ztO2YbH`wZdLap#FNN=lq%%Pj`G}h`4xfAny4ai?0KY>CHRI0bS3zxGpZJxTFf$@Ct
z0@GUIQdSnmv&9QkYhfyjH$X&7zZP#mh{E*$bx(e~oS|6V!KBsQc<OS7$>P@;l5emx
z6f1m%+f{7fT6+|_8yb{8-+!?0U)2uUhbH;7SY6={=q!Qc6Kv4)Ng;JED8&l18nCWa
z0j0#+i@mODt?vUGltf=H1hXC}@;+5-Wp!KX`aWQROlf$rfOxGrI}1axKzJ=k2Pi~g
z_4n8CSa_Yc6tXiV;DM~<)At|dgZE^D!UK}_Q*XSVF#qWL5AuC5-^2U~;zM%fb5=;M
ze9j2Yg)5((0Ovye?<XMX2b5YMEyh(X??23MkbDdB%X@}{`P)HvMXMh9H@UstUYMPM
z<<6NI7a;Bg#XU$LD0Eh}E1q>sH&<g|Qac6GIlTnbYGILNWfx{Ub^)|%MB<P+J0sha
zAVGGK!yuL-d!w7kVTcc0uf1<jU{`Ael^By-pI&_b;Xwu{JTAE~J_Y4x{x2XKLH5CX
zww;}w;VgUc1oawF3EI3o{ao<`b{P9?@dR-g`%LkK@S5%HjBKFWPZ-^29NsR@z&^SC
zIMa;7?+-8-fkFrrlF3o5Tp+U{Er9n26jTqUY-eX=Z)KU>eq5>ru8Y+jq|ZTdyE+5Y
z<o4qiS`PF0PHpTxDiLVT%E;EmD$MH2w5xsBRLR~e&dk@<8I0M!G8|$H?Uw+Zx;g#p
zKbT8E=6qIXr~#MMD&G%%Ru_P<b-o`cRu8C|%&x!$YJVy(dUgQh%i;im8c_KGa_=M;
zNSuL6q+)de1KHEUY+rv*F8{{=)Ghh{HwIzWuRn#$zVbJ^CqFv|y;&BtbGNAhl%tL_
zK-i%35N-rFx~E>Z2$t~Ay$td_C~q-=_b7tG<g>bfLFf6;N&*JLi<ubMnA?~pFJfXa
zZcSnkJ=oL$(tjto^ZcIRJO0@Ahk^Pbv4zvy89}{yy+ubrI~zg0eCEaO49zRr8JJfb
zXPDxB!yBZc`FOgnveuEm$~q~3Ah&X}{D-WPe)3P5?aRNb2Pe8G|2@t$nLUABm|cN=
zal=;z<%XvWo$krJU-^37lX<@Kw7Mq?eiaaAH(;L3uE4C^_>^IB<5z}>Zi)*U-I6~Y
zV-sd~`P=Ge-1p8Q)w$W7ouOD&z`*dNaL4!GlPiAkCsznF3U_?}31;UAGaAp}V>B*Z
z!610lxb-T7GQ(GfR<_OT?-=HagLY&aZ#~BFvY(ax=>O!e#~8LvRc>Hq0M)UeS{1Z<
z)FZI)rbZyMMk^!eK191#Wt}6xKzBkaD;)W&tn}oMvdWb|pz}wVW-zO@{05!5!K??m
zk;~;zvs%j^P^+ocFV#74`(!o&W?^;(=E>|0%*u^d85TD_Wl(PV$}rW<cDpcp0`p{c
z2PB_b?$?5@`D|qqZw0LobrpH9FhO@R`-kG>qsy5lvwtv5zO<ZWGCS)zVfGJ>$vNMd
zAgj#U7b30hWoK=e+|GVMnEeAMc>OPUg>U+DgbG+nf!Vh7AH=p)!S@Oq)QVLZHZ(O9
zt15s=12E|TCIi4^0+=iSlMP^U0+?I?CO3e|17Pw3n0x>xKY&SwjUbZ+z@!40Gyszh
zU@`zqCV<HTFxdbmCxFQXU~&VPJOCyyfXN47@&lM;*a0$M0ZbZzNe3_)045W_WC56L
z0Fx8I<N`3c0ZbkMlNZ3`12FjkOfu{QnJfS%6~Lqcm~;S>0bnu#OcsF21~54ROfCSE
z8^GiNFnIw?J^+&+z@&l^*nBYgp%}zA0J9yyWB`~<0Fwn^vH?s^0Fw*A<OVQ#08Cy0
zlMle;2QbNC3^G#yOe%m$12E|TCIi4^0+=iSlMP^U0+?I?CO3e|17Pw3n0x>xKY&RF
zE3o-sQUOdFfJp~182}~|z+?fKYyguJz~lljxdBWb0FxKM<O4AI0ZcMjgUtt%3SiOz
zOgezc05F*VCJVr11DKouCKrIo4Pf#Bn7jZcAArdZV3NTGY(AJ&0Fwq_(g92cfXM_f
zSpX&*z~lrlxd2RV0Fwv6<OMMK08D-WlMJ?C^TDJ7m^1*B4q!3>OeTQI0x;PCCMST&
z1z>Umm^=U`FM!DhVDbZ)WUvF94<;4Bqyd<80Fwb=G675$fXN0hIRQ*A0FxWQ<N+{w
z0ZcvslOMpOKoQ7%1u$s<CLO?J0GLbwlLcV10ZdK+lMBG)1~7R5OkMz!55VLHFv$Q;
z?E+v@0ZbZzNe3_)045W_WC56L0Fx8I<N`3c0ZbkMlNZ3`12D;8)YL$@>^xqJC>bZC
zm!06f6U&<sD$vW$rz;_4=hD6J6&?f?PhbU=a}!j-q$!wm1(Ts*G8Iggg2`4eITcJU
z1(RFB<WVqr6-+(_lV8CkE2xB<APOc`!K5jebOn>4U@{d<mV(JvFgX=WE(McY!Q@de
zc@<1P1(RRFBrB+#o1h9NO~Irqm<$DzsbI1cOtyl_sbF#`nA{2`kAlgoVDc%L{0b&n
zK_%P-Q81|rCQZSlE0_!glc`{`6il{)$*Ev+DVW>}CXa&2t6=genEVPRRY4`(1W_>g
z6%_LmOu=kdFc}IaQ^8~@m}~`;Q^Dj?Fu4^>9tD$E!Q@jg`4vpEf=ajvqF_=LOqzm8
zS1=h0CR4#=DVS^plT*RuQZTs{OdbW3SHa{{F!>csvVuyu38G+96-=6fNmno#3MNy*
zWGR?z1(Q?3<WexX6-*ullUKpyQ!x1zOtM-xH55+}1(T{^(iBX(g2_-YnF=OL!DK6#
zoC+qFg2}C5@+g?R3MQX|$**9N6;#4a5CxN}VA2#!x`N42FqsM_OTlC-n4AhGmx9Ty
zVDc!Kyb30tg2}I7k`+|KO%Mf>s$kL-OuB-}P%xPaCQHF&E0~-LCYOTAtzhyfn7j%m
zpMuG+V3HM7!c7nbld53S6im8;$xtwv3MNazWGk4Q3MQ9=$*o}WD44toCZB@IuV7LX
zRL)IM1(T*=(iKdGg2_}cSqdgw!Q@mhxfD!p1(Qd?<W(^F6ij{vldRy>E(#`9!K5je
zbOn>4U@{d<mV(JvFgX=WE(McY!Q@dec@<1P1(U3hvXeRa>2elFL9YYCk*W-^^PpF?
z2(xlpz5lTO+NxIJsU{4Gos-!=@PqpLlaGJ@50d-a`~JiH6_CCTlP9FN1De|qHfLoi
zJU_Yp*?-~f-x)JcBX%f*ZtVokL<mcoG6+|8GEV0Fz&|-em4VZJQ`hF1nv9cMSgeG(
zSgn)0pRuX6Dr;?l?qmP*=luu$bIqzQe?fcMh1nUHCO>Uu+&op4ab@r3ucnN~CzmpS
zRwVxoP40ch(CWH*>Q@G1_6-h`uWK><75&-Y+IY7&sP+Aa{c}O*K)nB8KNm7v0h*5h
z-O<VD3Yxc=J5#L{yl4JH{&CQb=E+Z4(d?LfRf{2YKgf@h%~@G~9{zYR^U%XXpx!lN
zCno4DbI>@M@&Y!7$+OHEKs$Xo8z=wjVg${33A3_VO=kJPFWk*;ZPvA^Q?GOLln}=E
zAN&uz?Ad%Jgi-i=3*$rgsMcim?@aGMyx+&g+UcgOFp~jvZltopE$BD~Y=0!|)bjTq
z{P+9~PiFbbB<%k6|KxIUhN+KPn}y578TPfcve(|K4c{#OouRgOA{!U0?|#s}T}Id3
z?Y(YXtfAXMz5)4wL4fVtWVR#!gxOmDO=flZ_x{8GkAg3mRb9X*UM6;ePE7*!?LmEf
z)R_kkM}CF{T%dFS>W{+ePM(AO3<0d@qU+VSf@dX+Tfc(u!GWpX%)Y^4z4}+E+;)_+
zz*e>EFJ%`?7TwCAzx=pVDfnzIkWC<0gGM!!mA3qAR(JUax|6M0z2)C}^{;%O`4-Sz
z3COh|SCgU^=B9(`!tLMxuUGrZCVY*Jv9fRT*JljLY}*(_9Qhdxn9lA;_ZvTh0CRIV
zEBIuxR(53pR3Cy=^J2_AL2?buMvxluRM5;1>tT=&VdB%%KyzGf2j@5?cVB0i;hmiN
zl;MVVa@lf*InIw~UjNtV4$=uZttjwla_9yQNS^aM2g-4v8@?DMHg)QC>$OeK0-Zm<
zYEPr9R@eIt>-RM;;bKVc4`KDX!06e0yoE7&iaGOUR&B@0Z7mGqWuTcKwU@@MT8!@n
z3_OHeTNvJNc)yaBQ)_06!{eDDf0G$GnLuaVFYagm#}o<4Q=dFRISO)bS5pI1WK>&F
z>-1949MjP!?>F$Tf$d#l;4nNG;K}2eoWG4JCb0E9#E)#75q^9I@?*hvCWs$zIEfr=
zbdNa5arnd`gl|DC(5Z}|&;t1xRJw?#f$p_QTPNeB481jzS;LjZ!f{mx=r)2W-pQ#q
z7_N9He`R9^nSA_T^KuT3%5dc+FPJ8>D=+xL(de$c><4%sETmkx6a4f3WVV)nZf(0-
zom!Q(ME*i{bF%zxn%?Z*^6%&Gli{FKPr-XSHC+BChkRwxYCF_6eJjY<PdUU(LA`uc
zX=NRezo0u|-U|pQHEXo|1?i~`1=+5=WCfF=JH+<KCG0;zqiS3CPiBAd|Lx_+-V1(x
z+&?`XG#mYV;X?3<E0FQ8=_#OD<0lI&7c@<u$in!tdHIq56HnjqfBRdQwE;XU4w=IP
zg%NBt3N*(!@hvP}afJDVz2C6E6Qlx?5<#O?Fj-Ja6lQ%o@BIgP@SX!u7^BK9o&Wwr
z{9}-Akep>9<m3(E_N)JUA?I`dd(JS^J^9UcCg`5TpIxlGrp|E$?N0{n%mbgQqyjos
z>B^t?5AL6BRy*>iS+(U4vzp7F#IKd1TUUHmXUJ&QU}I+1aAW3)yV(pnfko6^S?$Ol
zvsPu<FMpIZME)vkvHVq*+42W;p62@r^4CG<&MTwcn+lr6Nj|uoX>#~i$G_dHrcZ4b
zW@q^aYVpr-2CdXy#t_;+<FHQ{N0=}h%is4K<ez|cz<_qYfLy?=!N%+p1+iTc*>)M0
zKgt>`f5A1C-jhF`+o3MgVELo0#qvj4hvg6G-qN+(WukndSl!J)cS!zG*7yRE0o8Bd
z`%Uhj#^vV6$CrOYxOp-g$j#fPPjO~-Hx^&caI<g9;f>qDVG|`0*9mtS*!I858e9G-
z%RB+^JAS$qrm7dF3gmWB$bnSJLR6jH>JudqH4&x)<a&@BH6XH~TRY(?2NY886XK7+
z;vO^Iq&B?&Fdv)>L1|;Ad-BumT#SN{bg=x^<msvmN@qZ&H|VrzP<r^RuJDo3_0Az!
ziTzpK0L(wSe>*z^^PNMCu6MVC&U<+OA$~3B#D^1y7+o*!KbSt39VGX1yG$5pO#8||
zyViZ6vGFw^HKIpl0%x9AYn|Nc#?Uk!WHMw2<!5yPu-Sq8Tix#*y5z#>nz>zh5gP-D
z<+vTiFQK4WU)8erAMS5~`4v=`Kt|y=b!=-XR%S3MR%bBibWd*j%A(sWTw%_T{9rrN
z!jn?1t*-AA44jf(SQ$<nfXv-M?C*8241GNF>pzL8=A|7>0bz&Qq*~u6T!^^2pINn;
z88qMWUO+$}bk{3L{(ZuM(o%?w(h<;2!2dxfg1#5{pwq13@^4iuvw91t3}bFyc7lm{
zSqBrS-g}?$K_wABGa(N4g=^0H5B1>o8Yo6UIT<#;)#$?O2|lB5f&8CV7S5NCXQ})L
z`4%*D1yT#qe>Cg;hx#SR;xi9|!ipp8Z+J52SBA;vrVKt|jmIZ%S7n&_7}TzS*Z~@^
z-qiAbLHsvKa5*x`r7{#`>Y0#^koODz|DO63rfyR^1BXD=nedMAZ7uINyzhX89K=qL
z9*}(?)gUuLXA8b>Ue(U%I`cThg{sN#Kg7=hsRpTC=$`y=yFg_jB+aRB?P7(TFa;`s
zj9NiyE+on)R3M5Y^nHW=R8Z{&Y6XH$z<J+rzV)#OE9j21zo5Ix7+ue9=LiF(B9IJB
zWk{4n97Mme%9VehGt}M}_#cPKLS)_-^uL6OaD;*G=m48vu)Y=4QUTQf%1S>Nu&L;8
z2Gs)SDkS1!;(S6uW^jatL<vMGt2}|+c~W5C{n(%N6GZ(A21Zxb{gt7nSkiK8@cR$)
z9k4Khq-D^FmJ9-$TFg2>t1%d`x+fQIXX13P3{9T?l!4i`jp@C>0&Q6Og`E2@5v2$|
z&y6D<lqW&w*1Q+^zzoWB6GF~}tZnM;;&p#7AmA-~v?t_5$a{kadLaLv2<ZvwJpEqa
zfR3`#N{06a3v5B{(Dwod)Q|434RzgK8d?aSS9~w9z!f=eQ@!4Q=>G$AH>|GjbWd*o
z%98weJJa5SNa1^-eig_*&<R?14#7efoa<(N{U;LzD!uI5K&}S06W?F>zZRwj*$n$-
zpcp_kgCh(S_U|v$FL><A`U@m?0&G5{r2tEr?=RTTLUy~V<NFWiKfv4$Qw2%0PaWTX
z;D3)Ux2b*NSypHaKvSMVK{iYkB#*pT5J-iIpqi;_|Ng`ImoPcd{^+)I4Fbw~EWeZ$
zSpI-k!6>V+{83h8`Loa+eCqS-<!X>z!rscoYBf~`Ttmx*B{#FHOlCdu+pbkv>Bui-
z6_($iUB=1^SAM;}!2iEl;|OS0<QKC>%P(d%mtW0lEWcK@C(q-MV^(Hk_6ZA#;&gXv
zRaW`(OIc0iH>h@2mIc*JDSsd})0IE(C+Ob+oe+gyTQ_SQ0qsQomF&2jNjUtgV{NzA
zbkTND?Z?G#HeJM-)y-IJ8N<ask;9<c`dF)7>-!DwUx4-{gLXrMTQv*f|1i43M8Ij7
zp`iZn_V)}IYG9)86Zmg^+|Ln~%*HAP@+H`BDo1`PD}nv@u~{AJKed)$&1x>ck|(kY
z?Q4CX@cv5bcA2o`PIe)XF1uEExPZb495()MafHnT4n9zbi2PPo`|?W}t(EY8g8yl(
zp`m`{SF=XTug6}?Kb+kw6L$49)LxK%C~<QBDGqz5aIi&$@kF({fozAy2dGwu)$n?t
zxX3?@)plrHJoaAx0udL&Y%Kq{*o~$Oz*<jz0*9yWHELB>yYlP(hV@@TyU$zQl^eb>
ztlj%J;^^+b5suscMhI^I8(zD&(UsBl{et>Am7%R$A@h^1hxY{Uaqonmz^d1}snra$
zdeA}11yquQN_|kB4LL!9(UteKMX-gt=y6BEMeLB1d(GJyI2ShWnhwcRO9f?4#+-cr
zp?@bV4}iwC84P6IlT)_yFbW#Acd?2u1NCm)B9zYPHiFtAo2G(xF?To`O=W8J3FioZ
z-=O~v)M5bj9wB`Bb{L-{98wqbZ-R+{=FU6f;H9yEf-$&ORz31BBwPSw)*_h7fN-90
zyVmy&>$k&1c*2F-+!#P&{_xfhM9q8fY1#-E=-+_p0fh)G&%bXtKSS~;#OJLn??33n
z_wFtQwYoSQ1)=kY-d(Ja&_dLJ?<dSZ4hy6A6XFkF-7gUbuN5cA-@CdUnQ#B%;(lno
zw!pvT;dYL&_Y2<l9|X}8>gT5J=Lma0Vg6><{o7jKPmpg+-3}^e&D!2i*ngyOKeCG<
zZgu_h{zLwJnC)}jliz|`h@0SX!{!WWA#R#F!_jCuQ~QMI=A*}%I>H;>-Z%XJ3JZx2
zNL)-<-vJW=)kyCf<mZEGqZ8l|g^X8Bhz7MR-Z%W82UFP*{=Ol8HH-(7-@hAO#QqFI
z1mcE?Z0{TPzlDh+`|W*0eFJjY587$XKN03jSezvXUSRsmHnok>eU2lu1{(t_`$X2w
z-`N>u4hpgfvOadZ4nE@#l=kuJc#cm;t^2C><bv%SliOJTHO^vm)m)Iwew9U-m6Zv!
zey#L2Xl=~FrbhRfj~ts1x`WnU&3v?wU9ov`*>{GSk0!DUHiK?kns|z}8?--X*L1t7
zFkf`Cb2h)-4l=2;_v_Uu&Y&|sd;4p{LF<7_`(3|-)agwHxt`JWD7+P#T)vHCa(Ea+
z7x+|m;ZnALwOyUPitqlqB|qQBuyzH=yyRco*kqg=MFrX4-Ui)&aj=QeedeQs&5rJq
zzkTPQ`ACs{Ve{l~AomHfPizL=A2jn3CwpgeYd2`GlihSHxEn$D&;JeIJpDMsUpG+5
zCjZ~YaQC|)d!s1Gp2F>5H-guv|GX;W3>p*b?F0GXI>XQYo1gWjrh@ORQUl+E2^v+H
zUJ1ITkMl5Sec`GWz0ReFZv=CmW||IaIe^Z~g4}#HC%E<e){~%77fr9tTw56w7l72y
z31&XZ!jLTK%4q7^G#w-Y;?D_gWoerJc*3lIpb--<@J(k3lY-6|b8TgqdbIgC3j?d$
zWY#Z#A-U%1*;bat{9pdOS4dENJjvyMl9yNO&Fze?OZO*vF}n8dZ#_A~vDH2K%X20f
z$B9j?UBd0+3=#*G8;&!`I4U==Gt6-WjcUy}IP=g?@y7E_4Kj}CDq!oHA+18K&UG!q
zppjqJ?+&2VNW$#L7a6mDX8^aHKKy?RY9k4=Kj2?A{c-L0KM)nm7bq*dWSGp(ATZ|u
zD35?n3<s5BpjEk`6BhjL1>Fg|m35)*Sk#RMj$K`=T8vt^bsBZ*^$P!zVtBt`ee>qd
zl@7^bTztua2BMR%OEI)|3v)9t%{(m3&A{x}b*(L`?NzH<YpvA#5B47)OLF~VcIRXO
zova;qZSrj|hRNTh8T`6H=Vdo~p6X`xPG;a`X;$ZDNG|)$G{-@>O`KuE0p*70409Yn
zAp(*Cg^9AlTZW(Fjn6^#{>A6a$E6uq54UnZ7UBJasRtxm`q`LM%aN7SxJ#RHQ*?5$
z0rR<bVKxS)WLaL084iENC$ot&OgW&;aGYU=gE9j<!`JVAvq0-lK&LxER(UeT!tSO4
zxu4N1^ghD<AlHN3K5;wfMw+~HjXvTvpjE_gx+e2};NRRj*U^}D4&(a|_ph#+GnxGX
z|Ksn||0^$OVFZP`vcg{mrI<-EpL})qgG~1Qp19qwD{y<<HHcZlH@z6ZzAl$!0Npur
zuD8|8sC#-f=&bVBEt7dZ@C)-i;7|Vc3lv)I;tVqmC^w`tB8S%V|9{0nwlF>ity1QE
z{a5z!Ox{1BQ@la8D(+|W+}x_;XxysJ`2NHG(^@khSL*y%UQhye-NF5)g-U0`4l@Ww
z9ei|$?Y!D)uam;eAJ~+2o_tf*TJlX<W6QUFT}ItzJ;~e|T$9Ty{wK#WGYhjbuqU@X
z7n;m2z_!wb(NkIN%eTe+EWa-HB~N0Ln#|6?tjz!A*W~Y73>!~ByT#}^ndiyxql<*u
z8CXFl`%Gr9_}O_}nB&CH#{wLGCSSK=XziYPdh+#ej>hfB9gMd>XPDYQvp@MXyFl_u
zHYt#~p?%5XY(g+|h1s6`X7p@UYx&-+%JQ9A)#ZCwJLnXRUk+I=w_Ij<ae1f3cun>4
z<V|d90O<yuwfpfh$gO_IgO1+2_w3fI8}F_ygt}W<h2>kb`jKzKTwi`qZchh|(tJ~E
zYjlfheboBCz#w5&uU;>R4HA2QApY&G&PUzvdbGOrdXhzX8J4;yf7{O3tbXMC=AP}0
zlY4lW7xT~hKbhy(|76}u#<Z^3{lXO-Oq0_kSU_QP(1p?S;oiqzXZ{oZsl|{i%E=-8
z-HSo;xTAY=^An+k?#caMgqqb`zNNKw9v5!=^M7&wpMSeNwY<JXUyE^z-4<)O9pnp;
zNt4+(Fd_Q}<WF!+sC@axyC0+qSr#m#_T?MMuY&uLWk4dF+d+0Rdd@r#3s1YYYoI;j
zTbk8dzO#D%6<5~z@@?{WFNV(3liOSV8*iV^P%D0S_Rao<$04o*xh<{jTFln1Ae%R{
zU2rhAIRGk|zD;JofZ|T$o;F92TaCF7IDlQH^5vW7R+zol+JxB{nBRY>Uvtnsx%&$f
z*nZBmHi!%E?ghtFdpYCc{x|<7v%mT;%+A0Jx*KD1&-eciw?1n>x*wzhW}0wYIU~p)
z^Ou9n;p9wf`w8|*?N(4v?AjsNNmb{LT{?2>fU??>Uz^&ubtQAKDy{2GZebOf;g~GQ
zF2d~2#=xw7<X18)y9lT?9d|G3j_@uqhO}FG*RpO1aW%RKa|SRu`b=NT$S}Frchgdz
z>8lwTCU?Kynk=Bs&3sIpA@-DTuQ<b{_GE4~&SqC$2H`f=f5K(o_><GmFmSQuO_OlS
zo6giO{9T+u@bK5!!tJboL2Up=*W`zHm?n#<GBmr&GOU``#%9cVodG7x%KP~9oqv;C
zS$~6W-VkPQU=rq&Wk^oi&eFwtZ|V%kxamyopnES_c`LV1e(uh|${V?T^7D2ER^Gk)
zCqGwbVC9{=pZOR&gI({XwsWmft?xhBPi<uZnZfKX%kZh)@N={JkzdKp>=K`%lVUE#
zIK^&?1@+fJCtay|P4i;&R%^ZH0_x>4d+;(aFXLj+YHxIdm?Xb@BG;-ZAhSaEgF+5;
zgE*+%Wj@Z%@K~PxRijJnevl53PObLIVc#4dZU^yKwb`{R^Bnngu2q<=<#$x;Vjh-X
z??2Q}g_$-NtZE`xG8>x+NG-&+`pFQx7H)5LlVuR*Z(s%4oZRqCd~)BhpOe4-<G<*i
z{Aj-rtGl_F5QDM!b_QWKv8KZQ#OI3c$<v++Fnj1SB=fvr6lOp1Q@H#)fAZt^e8%C=
z7+AXt&vWw5<(mAf>p#eK&C9$PwAvwd{$H~Y>cf+Jh1nSdAaf>dnllcGr!zAsbFyoI
zQjK^PGlMW!mWHyP%kOQS!rVuGH@ZBQXTLSa2~>|i&iwvrGADz;=FXoEjGhp+t5i3)
zYC3}Fc|M%~pf&Sxrse<4tq{|fDMR!j;^T3~_h+^Hh5Nl2s(Q^jlDqiWgxkx0njQza
z)~o{-AId7ATg&b*WY%l>^{Q*tl%if%KEu65y}}$5*m$>#r-6E3&w5<<g7_e_K)ONx
z1jS1fXuRRKvdWX+??3FH%dF?}t68h%*QzNWcMJD=F(mE>nRO60C!*PSeoi>9wXLA>
zEl}@nG5eB#t**kXU;e%Su>Mi)O;D=@)FOfGw*sBkx2gp)-;pW;+F$qn!TJ55opoxh
z??0@+50hIe^!|ZA_&#CS8GRu0A?+l+&epS_`<#Q0tm<rZfrP7;LbEy-!_?z*!ds6w
zP2b!;lOfrGl?iknNh`}^;hFy~xqxnf0l5WsYouD|*X@>tZ0D5DAiGJGTjE5_31uA?
zMrAz_MxO%$M?#Lgf3SY*WHuKDwKh<H8r<jkV809IQdW-l57uu3nGA9%XdWZB5Hk7+
zG6`Y=%sg-(JX)CDg#k2%+1WkuIjBu**9uxE3)%w+374l#?;rH91NEtx)sFlH+4=s1
z{bnS2hW8Kp*Eg#l`HRqv>66xfAp2o9L)`KH0sl&LpUhtiv9<O0`v>}~-aAYXg}EPO
zqq5GHKOskuO%i-K^X+7|BMhKhl7(51{Dp?cN|0MX{tyoZ&B3Lnz5nq48>~kK>H&ak
zVOCwr3hJv!o`lS@9cP(&9K=#yxSXY_p$WXp50r+$V#}8^O=f-aPuvweFCh9};6NGc
z(`NT4{}!`<fv2$kJ+(Ixs*Vc17f2{6ybFpAP?~cTg!IBC&rUo$!}YJ*s&+=#<fovU
zQ+G}80MF!tTmy0)WKPcXC@7VI&UuEMD=F>;&fk2^DqIY!I+Gh*SiMfnaRJ@f*u{Qs
zI`hhQ2Cp{I%<LVHiHDn}pK1m9QJ6LL=X-|<=5t&?YLu6-GqgB7p62q`3A$$#lny~|
zYigL|+Qq(V`W*MYuR*qg)-{0qzOLnrt5zq(q@!QnJ512mYSTPB$7AAY&^`jtj<lxf
zpdBKs+Bx6OaN%ONnyIXE624jivF~CN)HSUi-aBm21N9w1p#th3K-9bp2i>*<+KqSr
z1L(}_+Wn>nL1Vq3{itl$z&8hbg8E^d|C*O@GH7)sPcva;UD4u@+-AZIa>e@(_Fr;u
zg3<`cjQMY1=@HVef}B<lN)wGJ=gNa-kRkExbt32pawvOofI?ZTGr8G?)$bVSMCntl
zYOP)D%ceK4Y-jLmOK#?5YF76I-7`J?9Mo?|AH8?@pa4<}QU?v|$u564c`~bcf==0E
z*naHZFZ1JT@5vmxaF|)GlVNh(v(>`v-``CR|K|9&d(-r(?bB01yUJ4Ubg?Tdy<|{U
zxXG{%I_r0wLD>EK|I+>$hhZTHx&PhwY>eyO(~RzrQv28qP)`KBW0v<g#~i24*Pk=A
zcEA0N8kQ5Brn@sUOm1KPvei|qbMw@v3@4m@`z9PxR`|&P8lhKK0okp}I2{t^-$7xn
zyhxo9In+Vn@&3d8JBU!<|C+c^2c38hitVrAZ{ef<pn1^br^}hRSf_`BT;`s-YI=t=
zBQ$3&KRxrf-Bb=oP~JezBdP~MsTGt`SG5bX9_0kB2?4DK0j19O7vvu|tGa-1DF)4r
zfo296-IM=r1DAL2FW5g}RzCt><zfZCqfq#Ir~?=KuIbFnk8>D@Z)afbez>2}9klz@
z5S$Zn*|Pr*$YhXBAX_H4ALjs#vrJ@FUib9hW9hH|-d~sxE(0K=QJ~d8%8OVTU?&!V
zX68YD0G0b}=T^1owL)%pz48y_m-h|@TEZL*Opx-o<zI6C3MP<EliR=iZ}r$Wb@TKU
z494sq98&vtO;2WIWlsL~g(3ONSBB(2PZ?NQk!2qXv;JpvZ#;J6P{*MO#~^74l=ESw
zlI_9C-_;l<e-dMud3f?8C5Fl0-56HBZ&r8Z>u@$a*y~^G-|E-AqMgBb`Z@+yKj9k|
z48j!^49Ozj7=?dSFo5=rY-CT)SkE9ey;j`Vd^>}%pEyJElT?OeIX;FC=gN<zV#20k
z;59O!7@Yjbi6L}*Z&Pd6<QqR28C@Swxd9&eGXBBDXv`7eAZ#iDUMB=vTM%}M?Op@J
zsxD?#R=#8=R)xu|3>=_4JSMYzV1NJM{sr+!&~0p*Ny$H#Fic#*yp)UY{e$`&$xoMn
zZ&(y&6J-GDc%1U}9~bL%b5QC^cUU!jinDMV7Z+qltEwQRo_Naj{=@xt(D|33RREKs
zN<%?4DDz4$zGQw*sjL&sx||GNZKbZD82KBTEXd1}cB=XKD*nGQCto8>bLD}U=F0c}
z!~Z6bX_tJQd~3HSv+%Nh?VtIcS@#%&AzLytFU#iXOBsdP@BR;Q0<EokT=4Xtj9XSa
z!lb3_5R;y=zW?C=4`h;)@7(Pl|3OT6EXeyO?bNCE8}1v~U-hu^rv3-HW$FD^_hi<;
z9C7E8&iGvmx?<?l=-tYl{ChR)WKN&|r)DN~-D}}ok<9s>rIjW5!xC1I?+m$uW-_aT
z&iv<OFmyZDD$MHg=W+e_Kkpmt|D9?zbn|O{-!T6#=oVI&KZb6tEbklk|9Sjm$=~F^
zvl+qqc`Elat9vpuFZX14T>Aaj!|kA3tv-1t`7kf@;%{|NetMj#c?lQ)M7OZkWv%Z&
z{J#OJ`&OO?g)+!jpzxU#1q$m;ZIBpY{Q(LEi0{GU#qVJ1=57VaKvXUL3Q?i@_WcL{
zHygJuYeUFA{S1*y{e5yfLbUZ0MAY^D`w#jrL1s$sO=e{k0;My*YjNj5DQ$D-QHFKh
z$$w1+gRW$q$UDZY>&j==)#%o&%gc~FhnGPq%E@<=FUakiB0qVXfp13kx)F9M=}g)w
zwOdgac6DiW{`Fz?$!mYrqPXCO%SIN*<IJmF7&eQ)VQ6(re*T8x*7U#Po41!U?(N&W
zJ)03Ug88@a;k|2ZL2dV1LG{=FW2@Q>Prhq?)z0WKndA5W<nHNA7o3xSoMxKgU@ZQI
z!EJhS(K9Av(LD@CQ)@+&YgRKPXDw$)X60aER`*~?PJG6a%>9h%jQd9RpC6NXIGCEX
zJs2LpwEhlqGsw?MQIn#WqLX|;;l9Zi;S11h>yN)a{bSd0aeMP>7KX<!YW{APu3@}2
z`|&I5&nLGxx|y{$HMF`3g4(M0l<xRlYhVbw6n74k8-uPyU0B!EtlG-4s&g_MD_2+>
zB&1Vcy#LUDsd-r^U-QyV4wxwG%l9AjFCvRPefj<a{{`lyoP40%I++`kx8)}%KU~cP
z3Rh4(tZHHOnr_3)Fu5m(MY#JUr*O|n4$#d!&!#i4WoL+Lo$d?j5$Dz<vvDy@j|H)H
z@4vrrziIOI5Qi@IN8r<bqFUcy*xzCtIg>%SQj#I7?OiLxl}8^>cLUu=)mD+r#>p@}
z49vd${=@rYAQ!=I`g#B0|D;tdtXz-3uKocFJ#kl13llv5a-?~QCm*9{t=AL>R`29a
zHohAUf5Vg0ZZT{YyUnm`+P3K+|6XhJf`*Li<M$ulAAs2J`t<z={R4Ack`J-VfO_W1
z9PCn)SsR!jvQHns|KPuGj*IYjb%x2T2bdU7L&TRpdjH}4o;fZPyFsF$)evB}JbeEl
zfA{oI&?>an^AMG-58i*!-vwc_K6w8je<#Sac7|jLb^+n<?2I70k_Fg>CVyvVg6LE|
z(|H~w3en?w=luu$Z4epPQxGxMJMTZd-*UxeBMU3%<JoK<nwN3%gM0{&<MZ!7yx-Kk
z>?BIeKRy5cL;pq;br;`%$luVs+>@Wx9dv#%_%;TC<mv2u5PObZd;cMSUGwoyu<4Mv
zId-V?IE3}=Ak4njtM5O&U)_9sCXzb012A=I`(f%>ufG3~zY>-gKqVC@H+=F2l|Kj{
zFFo`A1OIYRD6umNo(6?4#5Jj>L8m^=aRG(Y;|}(BAeoPQK{3O69He{hRuBnMt9s)7
zhx3c(xPa7vV)d~k`y<o66T2bd$hz%u6Z<oe>V;b&>X(Al&zIZ};kh1r|Ka^S#qAK@
z)1&V{@Xvd@7t~e&^*llC1#wGI&DR+VzU#9|h1u`es!p}mbD+_cV~}*odi(u{^|M+W
z9#2*IzX{srhpglPm3W~05J4wfgKvytW>rXTWK{sQznYJ;n<md@m-D+e-4fL5&I||5
zT_m@gGbZzY6`AAwc&_>Xv{UO^R`tC9Am5fO&MFmjg?YIr16c3!c0=U_HjK)P-Y_UD
zOlMSH@`pot9S=t<yYey~4&@a*9LlSBIF#4$aDei;TC4J+nT+D$%nZs3-}NSQf^z-(
z%d6UjyUuVVKU>Kab}8xts3w~p4IZOD%<4Ve3bc~d>xg&^XjGg>t9cm@pYZi?P|I!F
z6er<t-x)VwJI2u3wepnkRCR{U9jh6dmvJy`7Cp@{_ZYJV55u8p$&4IK6PyIk39}vJ
zu$m^~Bz*Ym|IOdh7(@<%R5l(vG);NIG{&Im0?wP;Rx$YY2^^l`l+6E<2{eBIar65J
z`IlC;KmNS(2PEYr`J}bJ|G>X>Rg2<FP<p!L14>;^k!r1%LO`jCd3g`tV@CDA%}aYY
zV7WhaBWRE5`w!<EKs!p6m+0`jZU^al8L}x7p>tK6a2pS_m2$Klk`h=qynj&tmwA~F
zL-R5o2J_?her-R#_MXV03x|Z+pRb<W{{5Zuf;SAxi~cZx%!9ZGVIs)9uVK*ovk7A2
z)1~hp#Q)e7dCBK%$V}+D`k<8~n>n{KBo~+po;m><v5dQybSLdr){VSt%TBH8oy_y?
z|F&+U9#&s*D{#M571|CHtc~9MeJ&&DcJIm4c^MBjC(mFPnS7m>@t}+F_wW3Yj~B8m
zY!?3hok8;PM3#xo!r#pqBp-LOz~=JyP1!6mmtiuS%kQ|hWvzLw??3pT1E;Iw$GJbg
zXIA#&OXg<gVb<eh`0Jkh>^Lvz#_XlXn^jwWGi$i~2Cah-ZvXn<Sb~?)YKBz1;({1=
zL-vKoL!38@|78$v`}Tj+^vBPy{(JoO>%YgJ+5SI%$o^l({qejXf0oUC{M7a<=yZEE
zFE($)s26Aya+@ckD`@OdSX7RoXet-0)Ko*a$*eBF-#6&L0o@7Itmehn$}T)zoWX87
zXr&6cAEm&~AZ`j8EjTLt{=@pqiYLE@iJO5|C?AuV-U=?8Ga#YQ+V}oJ{R5Can6_{8
zEDZ(Oyt!qk<Kwb9?;f?>-TJP*(Is|ov$_}G6z7%KF1T-Gmp#Y4qW%BmRxt)+@!jBl
zqH#GpBkSYl748hi;&&OGrf+7u=3vY&?g%>37&NO}+AsNhBm1Vd3C@+DH2(^2XI^pq
z{}lJf;y3;&uiE}^U#niLq1#4QWu+&-AnSOx{CeMzf45l`vOb4d-R0L5$B+M*)i@cZ
zI9s&}vw!;!n)%!MOY&>#UPx>`|B&3tE&?fKK<!XiPG-9YDsdns*GoZA$)(q`s%v^A
zsGNDZR2Xz>PBb%vFt>IqG|#_Io~FX+3hwKxa5FD$;d@`;KLb=AJud(H?{Vs?f6dET
z_=LkDeYZKzlgqv`ZoYn<p|$(x^~vI@47aAwasGIjc^NlD?7dCX=Qux}GyRuv>k&?6
zr7M4wRi6A&R$KDt{e}DnX7!do%&JHJY;J$T(7gOO2RL_Lc;5)houC_DA!e?<&%CUK
zuXz~@f3j>Fv+|l-49&}3_?6fF0-ZF>r@ZPHXnbX!%2!5rP~HQzwLtj~R!Ufb+ltJ~
zUHF@qAK`0s4QqYx@PJdRUGyTzRFF$1x3O?RQb(#Qqy$$jdH-PkK4$eJe`>dvhJ$*e
z(D1#r_i;?%RL~Cp;JK$kwF0Pr+B99OjrA<3_X{!Qs6E6K*5daM?011iYCt_dBXEDW
z)g4^!GJU_s=w{T~1iozqD#r2s3P=ppKP(Nqx*ZgYZ1=owG%yIbLV8f{-{u^?b2yoq
zO-b$6WR`FLH<wRiNS@8E;CD^NaaHHvp5#d^N`kIISK`izM}bO*uJh}<-xr+kR90BU
zkj%g;_x?gcxK^j+S<r2Y?+g5=f$sEBiu&XY3N_fxACp-RNI>SkRnLZ9dT(%neN|U7
z3#-UMSBU7*(;&AfF9?78-avpYnVnT6>Vh~p?YutGtj^6KZqCf0tiSw4^U_X+$<xFc
zK;gS@8uL<4hAy^N_G{Bb-INu6Gra%c-vLt1yu6d4d8sD@NFJnm-?T2anY~t1K`MEn
zDnY9^xfxhJh1nXIVQNlIzcvkY-!;fAuzQ--pT7UV-wc|C5O)LR_qGaVjU#_1i;FYt
zn%>2J4Sd@kSmo04hs?`88D*TNn=vyeFL?HVd3h%zn7!uNJ?7;nA?y{;?oB;Bne_uZ
zq#b)``ew1249QQYGR$xWtzDOKYGrx+_{+aTt&q~@=^14;mcQ>m*f(i)>OKU8CnRhk
zX%H5+kks*129i3SM!tU#KSP+);o$oV2@aE@)^3H$OCiZm1Ib@&g@irpmiGn<MJGXH
z<$oX|PdB|cU?^mY{<$Aw-zRU7de*&{LLg?Tib2du^?m<f{>0Kq$-NNqr6LgVr+)7r
z$WJJZ1nGXe8+7ActDErk?GC)%$x_#uV51bx>a84en_IgZU$eTtFR*Xk1YIdMne`~g
z`w8oNVSLysWYBuyyRPpU3|u(DYmh->4~?!Mz5g3vYK_{B*{;ED;5n!)`jkOg<SK)*
z5-WqU8Y_cdYoqJ?hWu`rde4Ig!DEwZ;58zkH6NgLBCA>iS&h2Zb-q8ae|PisBMgk5
ztzHwKZ(PBA{Rl&H*h{A7>rWV%uP<TnYdtkR`S5dwnf=VyTNrvASUESde`ne^m1)+h
z_Q$VQ{Sj_;VF2G4cEElY>UbJxwFqP+v(p_keg;zc{=oh1o$ep^C!YOz5;VpK8Yu<c
z2nuoyXiwWFkb5>UUp)f08??JES^OzmavvuL$UU{9POPo$j*W-d4>l`LTf&h1=Q)e=
z^e+r{Q<IaQGD!9^Uu$9Dbf4pp%>Rr<&^?*`84Ig>vfMK!=HsjktEMYAJZAv;6y%Op
zcI9bb7~UWFzmCxrG|oCH1hOs$WQ*^9<>@R8jqbVIjaiQ}f$n6z|Ks8I8ID}6tESI5
zT)Ut7Ix7Pk>#FI>6P`1;?gyFn{y_aIVb*|yvEV&-zDJLO$KOD+ETA$D<Tp?_+b;##
ze(*HJl|2q1yOKGcu?f0^+{@~oEc%RP-_+*gtPIKxKN&!>pzv?Lc7&mo9pq!s%)c@F
z1Bbt2Kl?$pf_$z#?Fz&D1M?TbRy}X>1eJlC*}pOQweFkxzQF!%>i#bFeN*Q+DlhoS
zP`bU1ec#mP>#PjQ6MiyOf?W$T>HUHFdBUs;2TS4Oo2~B2Jzp7SzMag@z*@XP-GC8%
zY8@ywf<+dn8~oi~8u}H!X6m!Lf&nPKP5#c#3Odtd&OykW04yKC%-asS0ei!8Lxg!?
zkp;^Q(al?62r}<&b89yqvlNQa%~B}FY1UWlW_5jKnEA4}U=flZixU<ZoZVj<dK4ZW
zpVb$D{Re9GVQ~-Cj3p>$EWu$$FBW&4g`CO6uz>~SYhhDS24mI*4wW-OAr1?}yHGU+
zOt{tDgsL$Bk6dCm=PFdq1MvA)*wui}oqE4PAH2H)RRw5mYqC2l8)!tnc{zLBuIZrD
zc$rslFeGzwun4z%Ff_U=E@)*>ZenK@aaLrX;PhDP=)W6Iee4t2_sw8E53BjzS|RJ&
zMgB8Q2k#(JZTZLeRC$3YBP1<@((zRH<R8l!3PYP3AmU98pcRajg-TZ#BtWGZ+cmw;
z$*f2IZEAV{VgEPQr>*YEFQzkrW@~OZvv#vSpW%F})vi^-9aKIsO=o-xDxZ!VhU9n1
z&CR8uXZL%C{@o686@vh1x6Ha0kcsa<?EfhF6f{1*tX0PGjyv+M9FYB>lS;iVFi5Ow
zS@}}j6V$8C^kr7%WKf$b<GAv?-?`~3pgnIX`O`JQ?Zn~^hsmr*{vKp`|H1x^;8SMx
zBY$I@f6k6M{CLXDf1f;IWe~(og0Alq?3*B_a(XB$tYq;03cAz$<9<-T95SQF>i*u~
z0Aub|zjMtRoD8BK(^bLqFd5=%pc?#H#&k8%PRz7Sadpt0%Fi>WtAodpvyM$sR$yiH
zIT&y><YdIzn2Q|;X6~O{{+0Qzc%l2Mw&cX`Oy=w?5~A#&6_TvooTtUxLAUOuuL12q
z>u_#rnEbtrLHK(c^W4L-?`7SS`=2uje-&c@jl>JHvU1EkES##!FtMxkkZ`IiLsJ9i
zdEu*O43odJF|u|-<R*V(WBU53sR1;L087`9dR28jq+U&Z@cuzRcyA1(1Odeis1)7Q
z5#VIj2kP+(2dgn8moPIX|N92IJ%|gUPxZn32mIi@Q=pU+6S%8y?&&?jf4o~yH!tmA
zFl#Sr-PBgrrmQ6LUs>hKe`U2J|C^?R_9Zpzwftk&JMxctnFqM%{jIgA_5Fc-_}W{L
zD`ESOK)GUFi&5wM4gF_%kA7A&Fo4+o^qyDSvex$x`1?PrDL}<k??c4SgX?(M4keIj
zpgJCsd(yQ)IoWQihc9wIhsZ70fXH!pV#+;NgUVsir>+W-^T47nT^S<B5ePC9l#U_u
zl?)P)nX^nqP(P(ulfmTF^f~UG-FMHcU0T(`=o)lJuj~B*{}q)FLGnSZr>4*G2j!{v
z1`XVxJe6GZl?x<u3N+iu2wJ0>{L+jSH0Q(Wwz<`vakID?qcO(^2jhwv42PyCH{E1{
z&-;91Wp3p}m47_xCiHgoBrnj;_u5d<ekVqcW_3@diRVFaI`j0QHotaBx3{j0uArT&
zP18a9iO#h-wao;r*+0<VG${nM$`q8-K_-Co2erO8SirEVvv)g44pdv8-3|$9b|Fxi
z#^|~W?B}WAovWZYiV5yKz9)E(KWKIuw1-Rn2PpJFA=lIZ3OlxIe&-k@AZ8rrT{XRV
zB|Bqs8z&#Ah2?c2>O|bJE8fkk+ZkBh|B4xlUuO{J`u>0NZ*2zV)$NR{x{R}4F(gmr
z=J~A7VA2u){z3mPW=&T<&`rh{PbD2uyClrR%4N9XQ7a^cxo!g8(cG+dlEIL3>8a%J
z*6huyoeYzwfNmFSWtjYhg=6O7$xlQWCVyvT1hG^=EG7`kg#k31J2_m9;qfo`-;ZCU
z{cc|F#WWL~HyTfywa2w?YEx?i&5C<6fNYNg&3J66e+RLvmHXnaNg+x;pp^f9gZ{kC
zmrRkMcAb;=CT~#ag32yX=&D^xIs)^_`?agOixY}UKw)<O3G+&CK1LtVsKd^~k6Mz2
zc^Fz<lK+`7Gplwo2=|CEOfD~F5H4?JZapmd{{4sg?ON?Y9k<$-wRyGOYYl4+ybMzF
z{=@zKpxcoRIq&{2eo#;XGPBVIWaie(6Cbp?JpOO;6>MI4DZ}LQR%XG&a}U4&uzwS(
zS*-U#qu%zrAtpWiuDZRI<?8-o1_mL}9^dyH{3nQBe6R3+hb6q$hr})W2T;7*P4#dD
z#XV{cc7Mm|4jGA8TVyvi#!;^|xdn7TFGMVDVRG+t23Dwww)x3z&lw;xZVNWGikpGf
z7Nw=XzwrMK$OdH7Ctv^SINc3&wyWBUzuoJmPi;4w+QqKO%Ia=6RmKstN=x$C&3+m9
zzE#j%`%ff3%#|Q>{&tJIGcz!&w?77%V>PvleHC>5hH>at=o!=>Pl8f3s3i{Cfu9_A
zfD7Vx_XnW7A9kwIbu-sjhM-nZx?afjzM%hTSnFHY_ZQwbXL@UOCi}1EP`ea&Ea^z2
z%XDqf$meMm-UaV3)SpjkeP7_ev6V%bO_E{Nl((P}gbV9CwK|iXR<leNw`90Coq3Hr
z14z~Tb(7ge8J10d)CLI`wKtnvXF3?O&SH4{=jSiT&U{sGNN#xA^Zr8oj@|=mvljDn
z{R6F;fTc+#A4sYMrOBp-Ng<oOm3;g_JNr#RBUq}>-xuVs1F3+eVo0kWTWBr6fC#M<
z;MFdO&;r#-VTV8`Xn@w8fL6RP2#9-wMuEJ~g8JsGx`bIBSguWHUUi)D{et_ik~vw`
zW~K<UCa}I=@c*Uc!O2fp5{f6V7=Uxtg8MHxPl9w^n|{YRIs5}t@r7goI6wXa!{6}Y
z3F!tP5mtAwn$YhI55tQmup9Ndw0a72GB9nPK9gbdcX!4{SK(F`qnYR5Z|J`XQoo&*
z;ec=}OVPFIbKDnp&piBo1OJUymd7(y{(@8d0{e%O2a5w35<qINO`qW|*ll@win}>G
z!@1V3<aRchDekRZ$=z&n+u0ZdLi^{qPo9>}kbISmVLQ76Lu`L>zyX6|f#Zh70T&EF
z=g1dNxNcY+@W7yW!gIsofDZ=66TTb5Or9(j&X9bAjS1r8{Wm#J76%*<C=R$FP#o|;
zpg7=z0K`S|H<E=|#UQ$FICr`y-+9jQS#5zqvHAkAS=(6|e*6`^HhqG7ZohCDn}g(`
z$<Nq0Cb&-)bz@Av!pboD85;`<k9mT-V;AEwb2f&Cz<!Vn8)NcSRt9r61_22F7z32A
z5ZFJ*U3l7chU74i4;dc(6|e0tp0LcISYSEWZcr#r{?5*kJcFIDIKTlKd;iaX!%zYg
z<L?*9pD6|1*=-<v{W=40cj@6qchLGrM%U?T|Nrls_PpuY!G-LPXFmT|9ALlz3XA3?
zUQF*7>_5Ty7SiektuO+uahl}C<PB=ayf@h2wZ~=q78VBKOjV`M?#V4v1ZF;-%rXHM
zUPlFwZfE}hIu+C5Zcnj*r9tro6@$?I!mJ4_?-$q~ek{s*qtPXDGdNZcwRSz8&Gtxi
zL2<x=gyMh$iNygI5{d&ZBo+reNGJ|?kXRh>A)z?nL!#r>Del74#26okvpo>pI+>k8
zp?E=g324QB@rLpe!R-*!<M&GbG~Hhsx)6Lz<*5UpGdZ<7ivt`?Rz6&INZf;&L72m1
z4znr;18f)PW|ox<%_mqGkarX&w{ft6=a5fLa{=u-fSe``Ne%YfIZsYk|Nnn-`|&5B
zmaMYc_cOw*4ovR@>@PsgpQfy^f<f|OzCwcRvO{q5p}R(r?Rh+p<A<OdD2KE#DC>#*
zR@Pzp{XRkdr*P{L29Wssg!mtjR&x6>Vdf)$Cpd$~=9O2lFetBMVNhPg!T>rUK^g75
zhFNXK?QGy1DT*g>Sb^@c0PVG9)@b=H%+~T}=AnE62In5<S#7nUAa$Roh8h$Luv!;S
z2sHqy1Is&hI73Yl4K?_z%3xhAfRI(NpZPFf;DFuaX{?L~n`R!$S4iNSe2taS(RK2V
zZ~VzqI2aUJ7dB1)@r?n*7G#~+H2H@an9a%B30kePO^m^8Dkp2lnS*J`Pp&fLD?H!?
znPuy`or8ff`HL81qUa*F?HmjOAa<eXBoNyH#I6+WVw-&I+ka5+?r)Q5FDvVb6QFo>
zYuyC#Gsv|XFxNu->R{60jF2s!zzX#XL^i?b^9&B_%|CW9B)9Bf$QMX3oZ`{p3^KEo
zZORFRzRwy0DEc1gp_(d+BFmurd4>d%sSG-}OjSV9*Pw}Nsw#@?0`<?+G_2qDCAVy2
z$QL-EhRaL?6kQG~5dR?jQar&FMTLUW=V=yja~%|Mnd^X}>wp}pTU}9PAIN;3<^ea8
zK?awZ0Vui}BvH)_MUh<~{&`vi+{^=FxXesI(d8h5YGx{mY=Y3|X&G=c8w7EgS%9L8
zfgjb(QWRMQ-p|u2;AT4T;4-rTMb`mNR5M#qWFN49p4I_3lYt$VnG;ZSHL#$XITb~A
z0n_JcGvH<(V8mtS0=TZnv)SrUO<anQo6A=7dD;r=w|$RiY^%X#)&_+7sccoKW^F~t
zO=qk4JZ%TatV!D{aG7-gp?*GF394B~5pomRN<L3J0WxdOwjx|+T|lUx$yR`wW3D30
z=Y5`b17zNmZF#uNdw@_sku3++ZBG$$li9L9PkR9}Yu>gDTxNYhsGrT2hHBPVgxp-V
zl+V+CfXte)Ed`fZ3^tIGyyeg1sccE8X0amVrn4n{p2lJGw(s$zZ3(!{5<sY*&lZDf
zmMB7QB3sPoX%Zl_=4^|?WtIX${Y<t9RI^kOa<kdOK2OsCnKf-&7%sC65b7thg`k>c
zijbSi7W8?V1<0%k+k$YJ<$zE>m(35=ELViwd^VrY(>y?C&D!RJ%d7x|`sr+5sAh#C
z<YuyYe4Z8oGHc2<4_sy?Ak<G}b3-*N6(Kj7&E@m743Js#wmIQ4s{o;XHk$)x+Al?x
zxBEP;0%YE_ZFacKYe1-<%w~h?wpN7PR5q*6(>g$AP1t6I%d80q^>f+GP|cc(keknD
z@_E_}kXf^~ncy;O0Yd$BHX~HCmLlY4vKf4ywgP0<lx+sM%-VoZKamZsEwB|KH<?Z6
z^Ryixv*vBn!e!P0g!<WR8mR6%ijbSjruKQ-36NPcw&AS%FCf%UWm7>l>ncKSI-Anx
zX*WP-P1>e}%Uur;>gThe)%H&jaueC)K2LiAGHcE@ob~(%g!-9mQmF3wijbSlCh>XN
z50F{Ywn^Y}7lSRl44cd*hH4foLT)OX$meMswr~3$PuM1c%Pawe`nhZZm}y@WS)T9n
zGzpM-Gq&;JGEV`aekvOes@qf%a?{zkK2OsCnKfw}7cR355bEc%v7wq}ijbSg#`bxd
z1<0&9+gNa!<$zE>lZ^@0ELViwY&M3^(>y?CP20wR%d7yn`sB&z?SW8)+*D9|Aj0--
zU-AUp?STY@`nhZssP0Nd$jxUf`#dcJWY(;0Ww_i`fKWdjy**HhkekU?^m$qZ$gC;2
z+XD><^%Ftu0p!+mD?)BETi)ks9U!yjZOg&st_cYBv)Qsx{WujNH<vBr^RyWtvu5CK
z3oJmWpNifVSc;IF4r&Xm0GTxjcUxcsLj8QU1kAL*6<I#+^Ryix^JZ;}!{yHd2=&v^
z+XF`tax>YYK2JLVGHVL%_P_;%`ibc6fvX6)$)NVY4Uk#$wuRtw*8_z5*=#|m;r|pN
zH<vBo^RyQrvu11yz-874g!-xI?SZcdx#^(xzz>jFlW?~O80=u>Sn_-}4^(%tBIG85
z+5;SRZ~KzxY;(iqE&+u4nQShoW{D!?X0thco+be@YZ~tMfC57OWKeqmIqj<=<fgLO
zeV(QPGHU|vwtxXb{aiLHRCk#o<mR(ke4b_jGHcd03tWD5K&YRN-WG60$jt<`1w24z
zO~Kt32tcTx2x<#}di==#3`LeV_&hBFWZs-@dbr${fKWe^O$XJVsR+5*Y+9eEWq{0@
zhPypbfKWdfy**Hhkedo>4^)86nt;1K(11`smrV)PU9AYY`D_ZGr*(kLnzc;<mmen}
z)K5om4@^bK&194LJZ%QZtSPwL0}Bx9C!)6pmLlXPgW3ZtKxWO`hO@uF0ik|28(MFF
zD?)BAo6zTJJ3wa5*d~O_j|ULyr-Ir8$Z6szT<-6)&(ltTOqz_lC2#?*`r#wgaK8$d
zx%=qzv>PCE=5OP`<)R00)l1)@n)4Jcv-92OX)i$L%*NdU_yAYk`U<nG{|cAweD!(S
z50F_?K`j8#C|D18JPZ;NpwYt58U`C6qlGPhS|9Z|Z)#(8MT{hx!sQ<Ku&H%8V;`aX
z3m$tc77aBho?yBGR1Pw$9{Fqe7BsR48F~CXBf{XbD#)e?@VMm1M+eg$KfUU<uH&zp
zIV)(Ka0SCdu|*u_te|ni6$~H6CV|)v$zN75{1ofr5bpc-->fzHCI^FApKz-fgW>{V
zRtBb8KadR|Hz8~(o?yD8cml+hneRaI2)WOy25`BRj~r9~x+Q;E%5aEvFVqc7L2h7$
zxM3;C4Is7yNX<{NF4oCMzyAN**xNUmRgVF5%TkYX#|1=50|`q9cz9ukr7K+SaSNLm
zW;_JI<uUb!!sQ<KunA!5O@PZ|>P>~qJ?>}I!PHv-m&epw3YUA_&ZdE>w*fAXskap_
z_qd-;2~+O`xICubsc^Z+?QC+GdKbXuG4(Em%RTOAlfcxw0WOcJcPm`(aVwh$rrrZ^
zc}%@W;c}0A+4wN^UVzJE>b(k=d)&&#g{k)eTpm;JQ@GsYUN#m?y&vH6n0mj$<sP@P
zF<|Ot*oeDqV1>&i_pw!B>J@;?W7;bUmrHJAE5p>Q0GG$qs|uG(?qe&!)N25j$JA>I
zmrHJA%fZy^0GG$q>k5}k?qf^C)EfYo$J84NmrHJAOTyHf0GG$qn+lgp?qiF=)LQ_T
z$JAR2mrHJAi@?;|0GG$q+X|OU?qdtW)H?w#kEwSmTrRnd%@0%W0=PV;-lcH4<UTeJ
zOuZZ6@|b$J!sU|N*jzC69)QbZ>OBgVOYUQ{!_<2LE|01ADqJqPjm-*E?*q6zrrxJ;
zx#R{m15CXi;PRMyzry8`JJ__)^%kop7{K!H#AjC=l8>-4w7Ok6fT@nb2t{4U1%^(n
z>J~uEQ*HTk#UXhvt3s=5^3AJEy;#*U+=7{zJcmuL$K{H{<fp9+Jx7vHVwR4@stmv3
zs(aXEt~hkMCSSgaQ4$ubUJ!w+YhqKl;=t+J<D49Kl?}BfE>=ANaj9C%pX5%Ed0=%>
zS6MLB3Bb*3W|M=O7j~5iU7Y|tgpwz+i9meAD$sKz`4Afumhh~Co7#X`Ul*$~9DvDp
zKD**F`I#8Ql_Qv@2%xD_W4Ll;j`OBAklVm*wCUjn#cB!%iYJ5{fNp;7e169Tbk@`z
z@JgvW!M%s~1kVYccwVhlS&!v6cn#Zc$)lh-aL~znpwnPL`<v&ucufy+Z|$0RD#X3D
zskLk3u@HCA%x>}|Hl4}ezyH1BGv`R-vB}TbS>_x8on-rkLB_qad*<W(2j{y!s~42C
zg4z6C(_DmE6AtD-c;DIT`uOD4dy0FnI0){Y;?kLVwr|RjuY0F}{W;}`=+-L^FSmZ4
z@nhrT87r<_@!8JG&~Ucz%9+m1pJ%+-_;|vK3t%w^kl5LspJ!NXNS?Cd#ucB*&)OKS
zoXP)i{yNAcH-;%kbhm<7Y>ZQmJl*|yMg&ORJCHgyCa}7<pJ#Y%NS?Fe1z3y`EcRlG
z%XU@<7Lbbs_kNynW8>plD~^EeQvlgFbK~b3CpJEwwBi6*OaLTyci-n3J3#7ofyFpL
zVzJvk&sYIcw+$@D0ur0K@AHfqAaxtSVoV@0$!(u!bb!>Y0gEw$#A5e+o>2i(w+tlK
zzyK1PyXEtY43N4-ATbB9nB<<%Ga^9h=77W$z+yKyeV*X~Qa1x6CIA+jyX*4|3y``=
zATbWGnCzy{Gc-Wz`aohVV6mG!KF^Q<sp|lVF@eP*H+-JK0aDj;#phru$R(;fKF|2E
zA$j(Se^-1Kf<^K_tpE3U#)}QflUMw@;xiE@_Ve?M8z6OGuK0jr7!<nezkHr?0;KN4
z6`xj^y7!-F>;S2I1rnRw$_kF_{15rBKF?UOA$j78XW-az0O`+v`gz8T4aqZCJOGO+
zfW;nsp3wnPcLyvc02aIbc}4|D-8HZn2UzUd=NTCwb(g?mEMT#Vlb^FQHEy0fgOzcw
zTmFaso$K0aUGp!@|F*7;(KY{q{3p<==ll!z@4?n*f$ppY;iu4>l)X-XRtC4aZ)(x%
zOm6(f((9hw@{MicF_0P%e!5>6bT72hlYfwt@3;JW-|&B8v+9w5&1x<GnAKhWvAzYV
z17VO_1JDjaB(?Va$Z7?jg4BWV)BVZ{Pr&D$d{$>Ls4Np^`&R$4UwGO!hKv1^zkmM@
zTD=0X@yoyW4fnf1E7CzWf=)tVR%iJqc(PcH!BAMVoI$wk+jq~tVgWY8;tA{q#S=tK
zTHTY|zA;QZ=ha%wpkN?+x_Cl}LU90tN^yV#h}L+zU6}O&3;67>2K!c!`zmi1PY7Ws
z4q#v@4sc+2xV?Bnh(K`wgGh0J1BjN0-Ji_ECI(uw2HJzob`G@L4z%`uQ_K4a?|(BZ
zANj|uewb01^)O>H*K(m|)s}yg+rR!_HhnY428Yc*elRF5kZ?}sT`nNv&a82qVRHMo
z|C_IGXKH2N+`gS@bK7+X<F*?NkMmFbIeDyE)tOP4-<dI)Z9gCL3RZ^Z^{x!t&)xfF
zes1kO<punV%1S>NC-=QuEzI}to$`XKjLM6SGJ?!Zu3{5p)^KJ_X5!~=*7smw*5_bQ
zUhtk#S?NEcvce5UWu+60%zEt%M)Q<aK&;~o#%$*tl+{i!Fsm^$fmQ%1E1h6aR$yaP
zR$yj+xghyF2WPXIGvj1-XU61)Z)`nIC!EZWLG~T<96WJQnC%&O-|?M86AlTuD=!lR
zsbrdPjK@8|{n%7vHZez@;{nH+)ti~-9J+Bx<gl{JWu`f9iYq{FR9^HHbVC-Svesq>
zWu+YqjqXyd;4@|?=)VHRGibl!B^SskQH|hzPmkp#{`xozID<}80_}XBaM0%v=p-f3
z&S#OsF^8Mgo0%rFIWvLSGY%`OJZ6${FWvrFitXo|qsq%f8A0;GY|cy*4&FJ~b68nr
zGgHX%Ij))Ty*GMolUW&9-ha6N5VndG6xX1fq1OgVClJ~H_gA$Go&@cvY;;vtS@Q3_
zL;On6IY1!yLR|Y0el`(E7g)`N_cxg}TK<7jS+lwa(_}UersSS)3^Ux5pFL%`;BGWM
z`OQ<%-A*&E|8r`6KY{-i$TZNpwKL8W!2SiD9tHC+=;Wv=hi@EiRy)Bc%zA<`ne!^k
z1b61e#~C(rq%m-=(3_sj_lzYu?>O5Or{wNsOf%fhxILcs;@^a07u<!}Js6!@^`>1o
z)~wdSIOFh@!*dQP>-=DNKjHi(n4L`x%<3FW9fzG-Zyc66tgP^Z>HUQF;M>JPE}Av<
z%rR#54#vrB9*iJY$Q%ag2f2FvIhYAEoUR;pYMpU-&Y_sY?<eS=g^7d06Onh`Pv}1Z
z+8NU565~6W?I>e%`*nsJ?sJ@XO?f=``oH%R)}I9F1D$6FvKLZzsU2eAknv=36&D5V
zuvXQc+w*>c{*me8pxctzb;QL$yEfXilRJ+yFuGrHpW|#c{qfx6|7P|;)oZ+;;19mT
zMy(ZcR}#cj1`be+qwWxx9PY*-%;Cy7nd2zqWHwi($=}%z2pm;bU}caw>2uKMsInF-
zqp}Vwqq3eTqq2f1bI3)Jt6J?x4=XQ&obe>%tGs}fvDFQf)?_?+&Q5Gj{`QS2z<u&`
zH-=WWP1BW^u`?(yVP_EVS6;x*c;T?jApvih^B`Lvzx(!wS;L*NS=EDqS&f5X!a-Py
zN2GUUg&Pc@n?yvsW84{Cw@p`8`N1ILF5*44Us>%3gG{ipf&{3PU;vq|tia9;@*ikj
zv{T!mR@eOko|=aymw&UL`aZ^0!ZrEzbEXhSWA<+h$<LlK34i}?FZvi3E<BEqkZTp$
zH}(C8`gb66Ap1#>cUm^Ox4J>jA8Tb#ZadCkJpCKP<Lu?&lbs;9ltE%1l$RiJ<u0_Y
z#ct~R3GWwZwIw$!VFHz<kkc_#`^7~;r<pvx`hLOucc6R*N(IKPM;t)=ry%#~fKLs3
z2|hJU9JC+j`NCDx=Qy{*cN~D+%&f}F1G3@#6p))ieh0Z2`TR${*7pYbn^(1h>{bKa
zD6tEaKPPWz<(PV$_h=U@$fc9p)#t36KF7K9JjBeSY#=lH`$2AkxTQ4oD){7Z(28!*
zeo(#6_Z!yl(duSA30WT<)#~I8T15>yLBgw5?ULWQ_Y3%!f=;|x)sp;vB^zj$L)@|H
zQlQf<vZjhlfp$%2G0gM^op5t)`W)w(r<ql`7(lk_cT6td`hVv6WWG{H$e!R+(;>H6
zO=AG9Fa(_u2RpIGtM&bY^~+baJpQ}#7swrxLLm3FZSrP{gt-VLwh`=h&>k?zn)T@-
z%nZ#-QhsQ4uIpSiMXi<5t<&}Wg#NZp_n<S${9hTg+NQgLR)Dh>Lt?3Q_xlC*SKfc<
z|HZ7<$;hnb$;hmEl2KXj$RE({c%W6HM;PBX{QnC&L-JJHrB=UIM)&t0&i{a=FHqb-
zLN@gyD2`y_f=5B2-@KgtLnr*c0+3pesPfX~??7rnX$q90_8tU{lD;>{UksLAviwcq
zQE>^-s@aSMpqBr1HqaifW%Z5jlQ}-H%O3x%%3zZG?gzsRCu6qd44kKD#LD)A&PHHm
zmpG)X$HoBC)5<=P?eUxEe;})gLFJFyDM;8Xc@}iU>xAF2utQp1tEPNbcQDx3)tWxJ
zy}hA$fxCfPYp18UBzPa&llKksZ<9GqnL+z2CZ3-W%y|Aza8PUK>GvP*9RP_n9={U|
z+7kn638}TdZ?J#$SlaY&@dPh}OD?b*A04-Y+HPB+J1Ib=pSU<^4}$x>Rqd>9R#SUj
zTY}#=%zxACo-Fm13FQCg<;U-Io}LjbdHhar=kccLKf{xSzcMsUfyUS3&#Dd|-!J&T
z<NXK!`>@zl4TZ=qo%eo0{PvssLHqvIZUtQlyOeecbOICTbS$l2qt<;rn|jx^Z0oY>
zdap45f2(`)19xGs8(N(+&#Y<%<)HIz$!x3wYONF9g4(Wua@0%^ADmlXsq;@~XJ(k(
zuAVL|uF0@#dW&;%0}G$uwds<~49zP&FGgKpbz3%5xcekyqia;_`-b@Yl@GmIL1)0c
z{}8ujRX1pD^S||4J<6-5Fe<MJVN_n{!syq^>DKD{zG42Iz=N&s$(&!AzJ@^39ms_F
z*PJ3ZMKVQ$&LacuhX<X01v&W&c0LO<yiQI$JtLU$^qt_Dhm#w+SvNl~XKX$1)%u>{
zeB-K?t9SfbSwXp=!TwsO`(wthzhI%(>HrBf*Y5WV{x444{xT$Rd$TGpQ(i06^i?en
zw>w3C4N2S%al_Y;z5AUa--av&$0TeY+^QDHULU>A_Y36Ti=Kt#gw_MRZjG*LQ{Okp
zpXYp;EXoPqr#i`n3A_^xW_zkR#P-zY_Y36b)P{cC4?4Sc-cnEwg5DPht`(Q>-pulq
z0hCVX9Qmy7U^4l;IuoeptY9$b#QOvC$2#4UZ!Bl{tiHf-&Kc0|+&d>g`3$vogoG3O
zc1gF1u69%3H_Sge(LGu2D+5IQ_}0ebcfvs_8Ke`GGvRL37H0*O<*JqM7u=ut{)7Gw
zP@aYC^#J8uNKWb82+9qsTGn;iO=WbO35w7CGu@F(8&y?^IZI34FNp7b|6%=RkPfw0
z<IXP(?+@JH$?2XPwVZ)j-IK9cV7URadMAiBWLD>7EEZ4)@fnH*+zmkcl|a5PUf^zW
z#b<)g84pNl^nN{P&km>z3_1haZ3ZgE;W5)?)NR(etNZ-|`Kz`^!%j_>l46*AONwDT
zJA;65`>+2$#go53=kq%UNyRUhESs4e!o>yJKda6=(ao#vR_pr(^Is;OR9;oWsJteH
zQF)yTBWRU8=wv<njjRV@A=N4h@nLJ)`vv;{KY3pAs*PN^KzWfTBPdq?KZ1m``uwHG
z=Y(%P+!GMg3d-49oyk03Stgr{G9-s`G0Z$XC!lG%Un`^AL|4!~CllS11-`O@%!1Sa
zNnW7cW?rq3-LcqQB)>xSC&*6E{gsiA=WzW3l}xSfjGn&RL8jD3rtZJwRT}BLAH>Uz
z%-s%i{ZdYd>z78oU*P}w{fG54K_LnXM`eX2|2p0ET0y&Zm6cfjDMN4Q1n+uuu>S;d
z8K`#L&Ti1Wmpz&5D-*I#POLhg{CV#%{~b&xKZ5~t^Kw=WMpw{%nqN7Z8bG&Bfc8)@
zFL&kWOrPA&-cZ{w9O25C%>7+ta`;gO(2W$J(}(mrSG8mw77oA4AY6W&-S3{>bY-0{
zzhs=9K<9#k?s5FRuk-zc1rp4ld#}`6ervVsKAhVP*>~2)*2TVU`W$EBYhM^@yS7bl
zY6p!>Z8kf=5Zl*y&Z+fOE9jnu_Y*cm$UX(hfNo8g+A#Uc5%yD4=736nj*0Bb3O_lf
zxv+VDiUf^SS+#;js=Qh|-6yji`J=2c1?5Ib@ToKo_V+<5wb~)NAUYuRaqE9b46u5=
zU!Z>*zbW@`Axwdo0dnEwV?X~Jn;l^I+oyQXtj%`6Uz_fJu(<2D{~&)EfBVYN`ppz9
z22!{A*-r-9Yd7~hL0bf=-ytqgwST{W|8i}(DSS7}vO^6VTAj@*oScHL?*;VRguk0G
z^tvYte`lKhorz&`yZaL1??>2oO`qcoI$O4B`ZfnO7myD@;lZrR$uXI=<&U!7mS67^
z=I;WX*3+zd<oBwUUU$*w!sVt6kNLj;>U0O4QF-LAvci;qn5pdk>DujHt?wP;PshUh
zdg5Q17?@R4JEnhSVwl{jy5xPr2Txe(1xi1l`%2o5fl`X!y{H=v9L$<-3|d|5x{^6K
zMVdW18T`5@vo<h`vx0gdN0Z)v=%2f)C7GR7W->b~lii`o>_-{x4op5K$#AW8GRKj>
z!W=GtC$qQw6=rAo%jy=?I=Qoj;eEma&)lc2?m?}}lfE#WYkeQUkd*nBS)Ju?GAB3J
z!nB8CH%?4B)9l{KkUW`Ppjo};uQA(oh6_ig_Rl%dtmetEY1)+|AR5Lun||X2v-?a2
z<)$Z0QxA)OXJQa$SD!88yts*l3AB6if{WsUInK!)&l#?`Kb~{!U#t7#rY}s>S(zD{
zmp+a3YkfaqL-?w8NL%SyMCrpB0lLQ_rW~IZ;ymNPl>;q@Tn@wH=2K)+)TJn=XvnGI
zAlEgkx%|Cx1hgZ6&WS50W}JD<$N3HBp4R=!YD@ksYlViF|N9T`dqL+b`R-@*ZuE@Z
zJHZKJlllbFQ+}<G)0w{fc|YNTB}f%0&iC#I?;u*n!qBYl$*^nsofFMqzkXp--OsGa
z&Y--&j4@gKCBw<>%$lH^VO}ydyG1g6{RKMHw37j0;s-a7X&_S{qPVHm?fr-KEg*5r
z{Zj%Of34jQI*pnWJU#|F&p@1=nL(J{Jpd9yYyrY-NB*s9d7qFFA$Szg8vu=5KvXRA
zRcjS)Z)X67@Z?rk-x;Uw9D5&dz`5`zBovl<zn>70fzS!6w?Vt51<&#`I55gMim?f^
zvGLnY<2i&l<D)e6F1Y;wQm1-Q#Bnlv8N)Poqjpe9#Lu9>(RjAi&8#(f>Q#n?-FmIP
z@Rsw$ZdTW?zj@hqwL<b}s>u5V=Vu_yMaZ~{y<ea|9d!39v|QN>(ZS09e!=>wjIKZ7
zISAREZdlyuc@X3eUUw14$>M4Z$@RyXgxlHWcTMX#1QHi<6y{)1I5d58$8`oq59I|M
zjAqj%oI!pNafJCMdHz#|&i9}b4usp;Sz$VbIT+YP9B;ziu?gxYRX$#}_Y3mDr}fl=
z?;8d6_dvA?=!^*liRoV%K&KoOt!jC%@E{U&F8``l(EaD)Y@pr4$9UCR-zz9YGadz<
z4bAypt#$fSP|4t$`95I-C#bHO6auQJCbKSJ2Awwk-asC7LfBu?qsDAs9rl4*zX}X4
zk6l^+tZEg1#>61Zwk%bx^?kyE%*pHx2Oo2O{Z+ajqDmp?CAiN8svU*dTK>ZB3`XA(
z_dei3BI8SDH5SmQ(O+iOmcMsZK<)s!0^}>g`W3=Z_1{!O)(<){$m;^zwMKVF4@URN
zY%Kp6-9RS?DJy&dm7)J3r)jhNU)A#7;e!_F1R+LG$+ykwEdQF-T>i0og3|V8^Y09x
zu?NVVq@X*qS>4n?Jv@gC>ddMv|5($uvoSQhW!u#HenI>%kZV9=U@ZT<THj9)hy}R@
zwC9+3A06-lnSltAR1_Z(4v_~QsQP_1L2e-4eg=0`{gTQs{mDmISq#DBehdO^=Y-i?
z{y{?Yy@P>xvNJ0aC^SHK)}QQeJP#Tz1f{Z@{S%LWR0fp*p#CN34)3e`K_u){1kl+m
zo7zEX<cKrwRMKD%iWSh<a|<|TkW-9WN2)r=g^;vMT&j8C!}%1H+TJq+aD()MLI+kh
zLCe7JGR~9Rk2B2y=huVXZ-0YwG)Rn{x#KXb7Dd&={sklt)6>~K^EHRFFe@uFha)J@
z!}Qcb%QtBM1>9du|FEj1<1omE8P0#h4B17%Y|u?KQ=DfU+Ii3rT%Lf&K@!<T4hyq?
z`)|y;ox#}rDZ^wlF^0{o*Bz1>uCq0|y-(o3F`4b_e@HKs{WZiyVRm<Bh>5Z8AoD<?
zbDV|Q8JH%r&p0gpl!-x@)z$9(g!;RXw5-+&NzL_VL2ichk{aC}XC3`j2``x;p``v)
z#(5$;B#b71XIFrQ60Q(Ze}qsEx~Gc684@<arC<3$c7gg;u<!wu{}5Y_-{UykcvkWh
z$lV;yd~C98o39>an#_Kbq35t7E5roQ=mdL9Z7)cTjI(g6DZ@hc4w&DJ-%r?o9%Mdb
zR1Y=Q)Njf-FJy0?&dvZjHwzR~lfSdGeZ3AbX>waSgL1<%28arfEJ$3!dGhz~KNZ=P
z1-^sNP6D|bW-27?k6(tw=M-l~_la!E6P_`E^i6S=bQSJ6#-J>)f?*+B^E5UFn2A%I
zg<IPglm(tLoJ12piKH9ZB#@aG*_zuBW-zZ{XK+ll6@A$!%<93Y%y1QKrx-Z2rZ{)9
z{S{Si*ajAx;=B=VDmW!DPh<z3PzFg0tjg~v?B9bcywZ=!IB#TcZf6I(y%U}@CbEO>
zfC1@34h={QsvkzyGqJn#JcqL)D>ExA*bH2;4+=@;)ywxWo&$xQ5ZE6evF7FK`;;ea
zXMni&snq)k_cwy<#TL8Acgr|K(&ytd?EgUK$T(xBPKc@OJ7H;A`0IE6<jd>~wV@z$
zk^KWwIk`Q3TgTznv$ChK=0u+BETEj2KOd13(>H@`p5YA2y%1KTn<F%rgL1VZls(6J
zBl{F+s#O(uKOr7`GdaXxjc$+gj{ZVw-Gkd|?CU@|3KScYzklZkrKYFQk_vZh9A5=a
z@$KvkFg<f0b2uZ%2FQ&v&YbQC*+J*v!NLGJXM(~(dExS9AeA6?^YZkijP4h~>Y?$%
z_I^VA43J)k`{DV64Rlh;u|*JF#}|Q82(vo-B4g3346SafrYEyqXX<oI=Dg0(0WNz%
zCV*mqc`78uf%s0Wj*VckR)iQR6@kQ1?Qxp}v4?#Qt2@Ys<i6)jobJhe&%yZsBG*1^
z)$|^CnU3%g`%KWeecRzV93hiF9dtq<LI!5%s#bA6W(HwCy{Y2N%nZWJkEcxMU}l)y
z@nW*52di7BpXCBbS_GZ1J@+~Dat;R23BS#1d<@3oFBo=BPi{HJ^mzWYzo60x6qle9
z38ePtZARDkALf4o`5oj(P<(^rLGc#~FO#8d@?KEen^|>fk2o7>rYNmvjuVfQsJpTF
zat2n{UDK1hma=fVCpSE0fw-l$d+T8tCsy|kr{tFBAeqkR43IJvW*f68B%gx#u#iV~
zVeNio_qgtdr6iDgSgh2B`hxozpi|Qr1XfL7)gr|Ka;LKD*CtRbD6hTV0H#+zZxF8F
zU~xP*S=@|a-E<+g&DW1J9cpED1%(B8?(~EFBhWkpuj~5{^$$UPk<RmzzkcTjg;4zi
z5TDg`^3`^R_aElp?{(E{eg8rJeyb}dDE#g<x(d3!{~&)))b;%b`|BVb_pdd&%DRH?
zdV!=`*L&|LynlmQ55B(xYQJ1^0kvR2E_wgq|4o<+;%_2ucZc-vo|nRM7bu1n5-K0T
zec0ti$a-448_%QWM^H$D;vG2$f^1XPSe^%Qck9*n6Y{}xx{%z)zyKPBWIM+oF#S0b
zL-TU>o9o(=FS4^3vu$Nq)jpZk<=@3)pgZJvU6q-h{1awiU=SAgz*x*6z#tq@;Lytc
zSm+!0_L#}Xzy1H)Zv6Ed1IYKFd0y~*uhN%)qOKrQz&aTi7#LCXC;PC1?@2OlUFI;^
z{p<g~?X|ri{l2b^t}q?Q_JP6|a)S&b14y0$WTGJCreuiw-Ony&WcinTmYqpi>C3;#
z>?Z#}ZTD7pP>PU*xCF`l$^NWNtS^~eO~8Ht*(~eY2)fGv<WCqzQvW!X^-pam$Q2;9
zAXlRLr#AHJc7)47u47<;<$3YvObpEK?T5kcJT89N@H|+*dp?5$6UZ+x{8?SVWOBPZ
zL-7Q0lg;c544@So;_M6z!tBTY6^n-(Acse>K)3<OTxACKeIR-<&-Xo`ybekSkhw;f
zsSvk-NKkx3=AEa1VPKftlH#D&s;o5S-+Kl5IiT4;(5NIR##q5IfabsORqe@4Puax3
zGB60U9<>44sjTpQ8&v;{iS7^+zWhU&fb8B{kbdT;EYP&L9;{#Q`-b-u^ml+l^^yxD
zc0nNnb2+m9<j@67o7opQIBtijKy_bo_yPuyyzBO};T!j#4Nu$;i49mBK>D$*tKSD)
zkOqYjD6cpQvK>=80-8<oaa`2`8VeI<O*MOeVg8q8tq@+T>H7=&KZDdm+PE@)z2})V
z+!#RjjIh3DcJE;5bOY5!li9BSpZx6`zo2t+&Sf@cy<-d_j?Ef;49PEUFqMYSIIOIb
z!2s&PD=%PY5OI|7JLt~n8gf{|Pg#YXLBda2jhz9sdZ4Lc^0gn1f4e*!k4>A}*2T7J
z+7zeF*TfiGyXHOv#T_WG&U9PXv8g?o<vP>8R=3t%Jy6(zQe-8PErn2a<#y0Xbf9~b
zIO3aC{TP&0j{H+rVEGTqpYJE+-vG_?3cB&Sx4ONbaDP6iKL$F%(Dmyae`XDqf4Si^
z4huR%T%NgKvT)HI2F6o2&Ru(SrtRLkPOTncHkMy{t(~r+dRm>FC%*-xg=~vV^YLnR
zi{wmfYMAKZ)-jpg<rkxSqZ?@U)UVZ7PpdQY??P8d$Uc?7ckca#`L|YeC$qEiHLJJ$
zf{3Te3AcY|oE-Yy@o(p@sZ(2(7yM@EVts$%|8?a>s~JL1F1vN<O7n7VhDH}wuiodG
z3z*eeekHR_XJA%u`OVrbd7OE<H^Z*!kh7sd>RMTnKYwAH>%r>2t8Fs7%Wt<1VYVYb
zdtLonmG!3lu+)RhAa53%#SnY5d8s$(l<Xf6mmC#+f8qb-d(f2dROI~y`ODt|m^F|5
zNDH|Zq89bd8`;0g3N?(NFu;_7nQ&C#{e}PMzJbq$KDig3E}t<mOm1VFGsh`;+I0rS
z6?2@EyRI|b@O~_Vylw!L0zs>P92uJ$U^*?2%J{B4J{_WeMvqf+!&RmL&votK@lB{1
z&%kRBGQs0OpxzMAL1h(IhLD3XM`ccS96E6jG4=%-Q}YC$GwgLD>=5KGI2YH+Tt`8-
z%{9zo0i8;={p8wv=BMuc66SifdUEH_cc2p#LATF==Dcn=%yE!8eB-e40vAT*MJ9~R
zDkm8pPYC(H$y3P-bYdXrEI_PxH7LAfP*(a0t_wi(y_38^sksSy`yi;aI(g9XpiJP_
z^Pt)0pd&7>lR1wvXm#m<@4z!%(BhEXWWucIcB&P0^3r>S{#UhML3si)a|~NG)2z<L
zbgC6JTePYr_oA|jE90qFMK?p%_X_+En$=G+fLyHBI_H40+AM}6;2Y*3`XMzs$h<}u
zm|2DgWn32?hULc_!K+#&kK46^@)Xl_P>#CbIK>g0PiGvw1HMBO;=i?LRnN+}ZaqCE
zeCeqhuAIjwc+T)oPCm{y!<X~;9RC}>$#0*t!0eddxUOBReR8Q7L*vPPtyZl~(?Bi)
znIoJg#xUV9hij`VsIF6F1>I!%KH>fkP+kU&t#lk0aR=#`5{A$N8V{5_E91&}uJQbx
z@W%77^wcyRl*&LU45R{dGA`)eUeG-ldVPV;U2I$&$~r8+K=V1EnHgbrmfy;HSN<rg
zu>4onIr0Zo=PIjx`K7EN@>iMX$Zus0mS4(REWebMSU_t2D66sjQPz0!M_D1|pR!uY
zzxN;HKY&MUep!OnI!#Z`{m#(EF0KwbA67kM*Ypl&(2WqFyB~yE4Gv!251Net&1QAF
z>otSjq4DKc7u#fZmfx)&fgT_ifn5V~iQbc6$~-B*loeS1pxBN)@1`a4TUq1FA5dxd
z{zLt9(0D#*o&^>b$>AHAgr}=A9CT&YU}ad<KC#zo>SnPM49qLs84j@>Y%&ht!2mja
zej@v0(Xanx95+ut4jvnjfuEqbIsF>L!^6ohuW}`~ZsP)#p2Cw^85tObC0H3J&tPMm
zEY8N*c278%nNc``gK_c=4#tDc2OAw54>mbADJ!x3QdUd(rL3|A6o$W*HI_iaRqqPu
zK8ioeN=N=|eV06$LoHd3O>OhHuS|#7Ha|;aF#h(9$%!qn*SPE}lM|b9#tDYaSHCiC
zzV?mDIP@!%ao7(g$>YjO><q>gKbVvi*clJ8I<a2u4eSM#Tc9%gaqZDBl7~4C`y6I;
zZFFsFn6AzUY8M9o6^DolZxv@))!NiB(Qnx;P)%^@%C$@1S{glgJ%yQDekadkRTAcK
z`PHo6!63--SK{gYiGIEAoBQM(H@AyBcCicdANliZI_MlTP%ZdT{ITq}e+$!hbuqdn
zfB44M#>UF__}#aEn_EQ~om!QZuKZM1dGb?PL*%Ej7Ryg%wUi&qdPjb|{~-U2S^3Bh
zX0;<fPqhlOIx{Hi9QmQFm-6HNhx#YX%13@OtF`=O)^PdRtike=S-<5+v!2V3X7y%<
zW@TrF$&*wVgs18;R88I2Y23%eXxx>=;MC9P$*j)L(5&vyklg%Oz={24|K@w;Oq;)#
zGc~LBGYC&-XY}pg+-Ap|oO+!vsQpsYr?y6a9_Kkuh2ooA_c47G>+Rp%{@ro%RCaI-
zZf5`BFnK;Z<C#N~@AET0mU;ZAS)HE&tYR8F<H4qb&B_Y*8GgQ3R=CPInO%~>u2Ya-
zkX4ZH@x344k{h|$WY2AG6JZpduEyXroyXbHd0U?`^I-?$t4A4{RgeGwD^@7Jd3q{1
zt)1+TIsEv@jencl=Q(t-+s#l`-~iQvznaxqelx2b`PHoE^4p315PM+%)qdqguNagU
z{9<TUWdV<&GpoD&1)a1DN&(kG+#<I{szptUy4f4sdv*80ym`|d)Bnmn{`LIB-@U!y
zxIWf)?iwVvTRk{Eg_)21=G@x}mVt<GYWvplt%cQ7n3?6z)7^jNKD9Nv_c%4LXJYs$
z^ik~J)OFLr;nR5L(81=%BH{l)A--!mxWA_GpW*7>Q|+LX^Kmz*#Dk3-zyI+6G_xvb
zq#SZfC8)fE<xkKluODAGyR$MdyNfa~yO}aHyQwlbu|HzJ*?+Nr5t}(X--WCF!tB@I
zCHFsPF=zjzFU+nkm^}YEN3**tQ?pwr6SG?>6SI3N(<AmnY*+g)_A9a9?7w-q+1-_)
z*)5cT*{zg;**%rv5S#GScE-@&z+NSG(3zBxy+6g1UoB^Wm6Xlyu8hrYp^VIKrHst(
zsf-ZQl-Mu!-|S~~PcHt>)a>5M*z7iyk=bo4BeVNb6cw)Sk1M|ahz#}JpBP%ZJvKCV
zyJ=|b_S8^c_^eK|`&5Qzw^jybkF5;M?n@aCu|HzF+Q0cZJ0r-w>!v3kW93MGvYlgd
z$8m<_2R}HN-CY@&Jwh3nol6;--BKBn*qu0x)7cq~)6*Fiv4!?0=ZUj2ySp+ndxSDJ
zdz3OZyQMP1)GT5%P8Vkk?LX+2{OuW&-n8V5ZA{Fd&~goBV)iIyYIaLyN@736>e~-8
z5o}ueaq!58-BeJm0SXgH&k_`ip!Nc&9pQC?LEvHdrcRkdf^MLh<M$uxKdBy7J0;_2
z&i0?dF<tm(JLBZ3?TnMBwKEuJ?qpcl{IO4%o&Cele&fuW491y18Lozd?iyI?KDot<
zA^Dj)Go+4q&N&&perk^MF3_q2cUFd0maB(Z-Ilcmf$sl$Q~ULjiz@iWFHj3)l9yL2
z<lZkqw`*V(@~=`a_Og7Op}b%w!zGu8`<Jx}x`A}gf01}q#F5!Oim}<<i?P|GijmnZ
zi*fSRHb!9ycE(5S!qeLrefx!{wlSD9|7QTj#KF{sO~$3EpjovKo1cp_DzUxo^X$La
zAKE{8J3Hg#wo?q7S*|lQ9v3!mXJ9;T+!o@vcmLe3r}rkZfY`m@F%MA79+bX%*+K1y
zxBU~}gXUG=f0+Ne)je6_D+6eKFs#lm484n2PyCBsta?DJ*}QH9T>;%d1iHD<s8g#e
z`5Y_9<nN{oN8eB8Jo3k{4OEJ@x+jZ%<!V+r@+bK$3lrqtqE0VW?^bWWHfZQRO6Ck@
zPG(MJO_nQVPUhfb0j)!71+C;@fZVeJT4x4Y@ud_6TVs~Y$qBv#_^&wVcBtf&>`WjV
zYPW;P<QptZliOPuW<E}4=467HP`e*ubE6B$WsYEV5Sh^J5c+RO=KhZ%k?^npg_yD$
z%fI&@=6_7~W@P}ie_Gv>#lC~vmY~uDG&Ta7{Q<2$WsqRI*6OmVQ(14yAIk-xvM@R3
z14DB6bOvFzBY*usY3S{$*2f{N|7t@)^FN?fqM$h-P}+v9+zL7ZinUcOMy-0CMqTd(
z?k}IrDav5XY3ZmoGr4RggY1G<mgK~lOnz;bK=Yyk{|}`81jQkwWeICdf<!>=UQjB9
z^njE7*}yG7h%FF1)^!?nzW)%vA=!hKsrk4IL-Vl^2IgZW49v$<7$9X1s01^9_M9O(
z?<520PVDyr_qRY+Z9+^3`5$xx1*mNYD@B{#Ss9z%L>ZagOc|NoRiR}Q$fQZEH~ZI3
zPkyl-R01$CyM;0|yTVHpw!nVh{zYt|{f^?v>5$nCY$X7w?GD;eqpSv6A)wd!{=@w%
zpmog2{;Vv`M_U+}k56G}KDLFS`S=osN32flH+!%4E@Hpidupn2>lOylV=<2A9RC>(
zrU_4PXPkTkTuLy2N~nd+o4>L$PHtoS;M@PT|7O3;Ay^oK{3v*c;}D}O<OT*%2!d)8
zP@XdCT-EaagZ-RjA6BmB<3|{pk6mG4KK6xy`S=rX2!dMfuzFzK^yDAQIhc>LFf<<%
zVPHOC!oYk?h2aoe5_@RB5*w)W+s?*!A+UdP+qHL~dGBPt>ulTEKIu<xQxi-Uxz3Y(
zla+<}I13Z=Q4uEQ6DCZ}$5fb-*qvBCp(W>L)(sA!{mE(DnUY^0<=8hx4RphfK>VV>
zlgUh+Osu`2I~qWKa`IGbh4erQLz7uJ89?HVE~qk(53~MbKJLQEd^CiS`9uk0^RX0A
ziO%ZT4=T^u!R7hm|IdElb5Cgh;}1`N@%BHiKK{+Bt#!X%+t%&Ap^qgwe|YXs41Fxh
z`6Cm2E8enG4FaIM@Z#>Zoy)tXtajwrwr;B~WtA_#v^w8^*uQyIOR_I3*R?~p4nS_o
z>-7?5JMtUULwx_?|GcH{$y}j~%_>KJ3%V!seC2t}^z`4~kb_y1ySP4>bN^@H^;zm8
z=$m|;g)OKJqUZkYRlTt%Wn4j~c(sCSiEHhQ!qeLsuJ#(2r!y{WzS+C^dpP6W-uEBu
zA95aTRzLDPx&Jo{MEC!-t6GvBSeZb&AtL*yJ!WkE4RS%U#8l?w3oLBYyx6>xVlKrv
z#U`_GF(@m{VrcXQ^*gS)xOu91eTvR&-4qMzgFNP2`ulIlNzi>yzv9~73)r^={soO$
zOg!9j7-7cE?T=5ge7YK9y8UcO?Dnf6zTkU6K&cQ`8!`wSOj*@AxrOCJqnA17e+F|d
zhW|Sk$hd~M3SVz$5T4q`Xf+j-)`h3FF$m9SXV_fo$|!ujjnQqIafJrsBX-~Z)ZWdd
zYK#k;KsC?PKHq-fvTyt+`$PLdEsn<1tz6eyL1mZxq0p}nqd+MIlKYjs!df9cYe@MA
zxu*fN<{q@t6LjwgvsWuav)5DxX78m8&E8uXASI6e%ValJj&q>$>%;!3$quX>&7ib)
zEQC>bIv3+)(Jn^jqmVRrvv>2;Qbu9%ZiYwfPHZ=OFZK&hZ(}$&^<@9LDL4CV-6ygn
zmwsnTX6Iy3Yke=ke-)ILLFFpwJ_Xom>uRl#8G5zW$*dok-V2<+D|mD=izvfman3&%
z_lF|oft%nv*+BR1g6_uzt;=55vZ>pw8<Y;;-%WO5WedCHcMY_2w$&^76bs8T@LERD
z+UfiKpw)b<T8y7BXGr#7XL&q1{J${Ukw1_W68|o$?Oto<P0$Lc$H&tDZsts7d@tbt
zH1T8eaZZLP@Xn~X)~Sy-MNW!RYX#MEpgZnBYpX%`Tt2?a{tqNm8+vy;NY`X`2A0T=
z%*Qzy9t(W`@o_uyt_!19@MxUcmVfUB^p7yBLE5>i+Cb}E>pwwa4pg2&>Kjlg2C8Y4
zm5%%a?X^=@yYlb7!1@EA*l0cx!pMBMgpv6~3gaX8Lmc2X2*>8<>EPChtq17tbkHt5
zW;K_8$+bTi%-S2>A@=--mYg7aW*)j3J_lZMGJx-{namC<x!-@NKVWzkY}2t2M&@HB
zjLgTuHnCmphqQEU-IH^_gYU`N$Ue7w?(rDM?X0kpTlhvhqcEs#m(I?(usOF6RBi`?
z%WYZr<c#kOhO7v`I<i9ckbvsvpfjL#EbCe}b!v6J|FHgmR(rA+E1TDa=Ho03pwwa9
zX~M|po;+ha+hooUOv%qw7&}+AvLv(5WC5vo+-?4UGuuoDvo?@gwN_=FCx1ZW1Mdai
zp9Y<j&8*(?cU61f(amgA9d@;<wFR|;SK@xSe@m-9*_D-{S>?#z((O!<pcD$K`IEe?
zT0ynHUz=KM*s1pd{l`~zX`bB7In_b@DQG<0_56E*^UJl`rauL(u1Y-@)T(Nq?9Ixg
z*0!qkTpOc1sAakT)v6ZWgYO0Wmui9AQIhu8TD00Pd4b&DxcyZ7(*38peD^a&Uh>Kf
zPee&8df?He_X6t|f@&!(a2nbF77=b}=?W!{<j(`OgFtZ)N&}F1mw$xN3n~vlr2(it
zw5k*08`Z;lo$m$C&sx<c%zotWsaC&M@n;O6wOj|^e~7;)c@z|ag6^x@lN+D0Ky<Vo
zcrS2%I=Xtb{qH}--(J<O3Dv>qn%wb>0Tia7Tn`G*InE#+sE;-IDx?np=@t0)!ukQB
zy+8Xws$+XW>OrbOJVsX#50W<^<AR`el2)f)*WZvv&t<KQZlJu*e{od{C|@U^U;)kb
zeSG|7<-b*(XSe?iPoDmT0aD^yF~Vw8PzwxJ--1E~v=ZL$9B3^(BqbVknstNH;``~V
zI+MLwS(3du*_8EI{xG_qjcjyJKE}cZYB}y}4Qfqhe#w;F@`dUBhxaE|wS#7wlFu$-
z0<8&!sdy~-^54GB#}mH%OJ?C_P*!-&knEz)4DualB^YRhx?d~gE{WRk<eSeK3d55-
zo-^$0{JH;c<jegZBX91%8hH}j@&)BoP%8_xhL6#0RST${75_!_A*jcY?8(X?%=Yy^
zXgzVG+xrjqq2&ssC-m5h6+HI^sv&$sL1h3aJRu{$pgUy0h9^IJ&H@Tu&@QO=AM!g^
zwIsW;GBLXS4fSf3T(Js#SG)b4Rqc#!;81QiXMF$R{LWP^kAqqNfm*qsR0a#tmmz1t
z?giC`Xf0<3`!C6ED_KCdH*2nVFK~Y1W|pZAtt`fzGaYzOg3AA7H%n&WHc19>??WKJ
zXH~mbTcfL5>&M?98#Z}@e4ymT>I(7$;+AJ6FGzd3vXJeX(iO-$KfiNYokp$eIybev
zXSn}nRol5%wKlI-P%3}_VgH6^%_Dz#j~a8DGOlWA^h{1uWi(vT%9;E}g>f_MOb4~r
z_YD7Ev$C$5^0;i~zoXEyfhiIeQ=tBp+N}l#uN!{XK)o!GO`BS_bt<cE`D4}fp5gw}
zX4NBqR<$8)oWIiaAhYI?zpGlbW+rE-GBz$qZslb8E1CR9g&Ah!{U@M%Ow`)<O?g~2
z^ItM67sJtTWrbf1s5h)aZdQHF#`W(nSoZAp$BbP6loeJnyxjkoo9hp#e*@C>ayxQp
ztZISe-leUe6^}-p?-}Ob2CZ-e=i`5B&|H748Ps|Ml{|t+z1rS?xc_*vt0*`ZgVL%V
zxLic!7f4>&)T!0^{z3fHRqe^ntZeZ7I0Kx5*uqZzjj~*^4?OQa*<F+Yl72QGfB)hA
z)Kx9XPOL2AS3#w!YR!9w`b(?Y#IJ!$AGc~yJb_Z$`w#!8f_&uH7W((`rSQL(ykI%!
zlPBbc$Yt$cx36k{3m-=jKMGps{&eQ_qoCESOIhC=6hwo@D?sBGAh&}`K#<E<b?SAB
zUj?mpds;e~l|k_Rf&2}cC)F;kY5|pkYHjZg5@c4jvmRa63Q^Ts46Zj0<ZlGIXHp2r
z9iZ|F;tI9aOubd@g+D=}ps<3u4z#8kw!6&h2HU-$D-8@<o$Fd4X1eB0W^Lenf8hLz
zWL{RGuuEEPtGd9xRwxM2>SBD_e4LA+_whBT3sSS+ALw5>DGJsW32Ie}0<}fLTHiAm
zaA<WU{#^!I-}?s=hHV+3a?yTn?Lklrhu1y1{yR_9h0bQjY`<%uJ!YW&6<R&Q+}s};
zJ-2iJX8`w%|8#OH@+4pR$<eIN!{F80tm4Bk`5L%C25*a(L)+r%;I{bw-Jr7J@nP0K
z??3$Cx(eF%dVHGo*L#Hpo|C7yFiyVK!YDkwh2d(yad|o8!iJmuo4=$m9_<%>tLy%F
z`tu*msx5znuSq&wYu&4Ddl$BQO{+^2d`CE_jRk6RCHa6_UoaoTRFy_u-73uGaPaTe
z(x{hvLAer^BSE=y`gPD+2Y3E;om!ofTc<O0u|h)qX_!&h`vd(Glet($AYpzERK6J`
z7_Vv(JqQc!){yrH)=z?jHtP6Bv$_|<IdDiTulvOS3GHQppwNzQOJ-&jfQEP7cfQVM
z$E>IeNoSy8%?0WGK*LrOGi+h~9CvWo{$C0T+vM}Cpu7JTz`{29I4jG0g$Kr#4?!XK
z{)67P$=5m=Cr|HW6rSD*4&`*l$u~P0ZuW2f>B;yvZ1Zz-MqT%0o~sN?-I5!xvnaB1
zv4%~Zd`-k5x$!xuCHJS3MUm(6u`l01=_o*KRg3IP(5Oq2kK}fcPn3nOGJsVa{qp7K
zelFI@*F_w{rYZ}6Md&^8<<rIOOwma`7q?DkaX9#M>(`K6_^hXl6KLg2@+o$<2uEgR
zRt9FhqYSO?%^IwX%o?o>#?zlOY@U|RP%FN9`f)~M@pOjCH%>4Za%^V1;P6*`^EWZZ
z&C}T#L3dP@_D??k{r}H?(7LNR2SXfvTqPW3T=#a(?L5S~iA}cqY+n%j-|o<U(6}&2
zjm#lfu1{uWRf_QyW`AJ+S3EiQyMl!8#PsCK?+VTCtV}D9H@k~6wH}TLoa>(a{<)k;
zsI7Z)_I0_C&|3H8^y_jGk;zY<%Qd@$ZW)V+o$H?b_PLCSqpf>#=5?78$6EK~)ax=9
zuE~#{%Rp*W1_6-WjqVbjGKV?SgxT0WFuMN@1&J|hurf{#4`=9N-^_M`VcYbc!yq@Y
zGd=$F{9mhEZ|b&=iL8w7Q;&nx%6KxmO=RCSeFAvpFG%NR_8knnrYkQHXN>V}WfNq7
z{P+5w$?UAG!hEcPjLv@}Ci8u;S6r}>J-PWf`wZvQ`&XR5-m+>-F22rS*5>2;_{q_K
z6Wkv^Johj8`!fc!Hqa>syV{J}lZ(X}cXcEeUuH0Cp3M6Fe-|src94Bj+=baZ81$x1
ze#Yh?a_EXPEBi#&$Df}4+sOWS;_=@yzKrfW4-4i^Ocmr?$SRoM>Ic#%<2hL@oPp8p
z*Ys^rm&<s5g0n%Uf_$-Uy7GeSj55Bg?2psF|6z7#Wm?s4dz{%_l*#ik^YM0O(dTEp
zL2KxpT6@`8(?BbF-Zy}5qdxMF^Qm3y`vdR3LB_g3Edb86&QxKxV|ymIw(b#bJ<jYj
z?a)+ZrIdflDkA^EIzQaM4q5}&tkLq1S=r?u^Ko`2&exCsX8gM0|5z&h*I$Xp(>Z=I
zuV7~^+zuKogP7;GXL2j+9*|kWtgcLG=3PQJ&-XS+|4exO1K#`ld^rmjE2#XL-0r@7
z)$}ROQ_q2T&CAn8w@shnEPK4!ot>fec#Qwl!_%)aF*Gk-DjeXP$i5D=3S`<bhD~hA
zuf8!Tvd`^{asK-omX0NyTitg}n*&eR#bF0bEf0Z4_#mstTU`tnyicfq1rp~y<k&P_
z6tr)>bq1t{b>(|3H0|H}1MhZ&<a5ER2Pe5eNAX>o8rGf#-F0jVzF!^Ga`QU|YG<!%
z+0+SYXP#RR_SdiF;1O0(D{PY|q|F8D#lBk$^KJSJ(76O3?~7k&0^J+OHvJkCL-Vp@
ztc<R9)0Gv}89}jc&IoGDLCgTfA}HiRH8a~a1_@9rd-`@zxqaLaeSgSgwj+NLr(=Q6
z6$71)b>#2d$CKF=*o!Byn-&KMm`-MAfUqxs**swJ1VK|!%?#>EKwR|f&u4W8lR5D>
zj|p#Q=WsmU#SU_@Fnf9rXjk6S^Pn9$YfppL#F-ukg)nIS`5A9k_gzzyYqm34wF*as
zGYE5V@FW*)XPI37ow3o)SnMkUD|;*Z#XjLS_J7I6+Zk%V6$@~f7H<$UeVn=d&t%a3
z#UM8p2%5hCVE+*mtB}wKt11vM{RzHR8D?AP!2r+6><l%+>|%eC-#q7F)^KIG=$8DP
zjZ?yPb32=3@}uV*F|JP2XZ9t({l>=QX~>@Z@+sTqw(Sgm#r}FEKfb{xT=tE5GTR5{
zWZ7#hA-)?=wYqJd{*B?U_~z-`88%OQ#?YF&c`7R-s8j`&w#*u>jKb`#jDP$7iVCx~
za>h7=_CHQME%;8xS&@CS`wxb%{f)05i$d0_KwJ*;Ln(O038?e~^-cVaF$jQ0X6}D>
zecJ5K$#C{CB;7xMx~g;Gc_{nI*28M2CbM)h3UhXHo^b%>c2Hh#JlWx}kmY^B{bQPM
zA5T^JFTNGjI&&?2e_-8q2)niL{eg4yE<wjd{aPV+R)bb?o|^<RTY2^Jdx3u^b2=RS
zxgR8&HxVqlZuuR@pCHkP+d(OBRVOIz!E}F(^o6gP)jTTVJ9&C2Lo55#rhU_l*$y~#
zu?bHvW#G(^@jNtr*K|-RH{q}#`{S9<{z-UlV%^TJz_4rTzNsMbx$dCbok1Z2YH5Pj
z*nq+Wl!qWGj_n#~g_cab*>n+S;pyrOUF>GlFZeZ!x-)H?-aI{>iM1>FCM!eoO?D<k
z`DWG%UTXnb%LN(*`mq0Nv)Yk=;1MKsmw$yfOG9t&-`8peYF&THyjmLi5MBy_QZuvq
z@pB;efKobWl?BLMu+#;WKLe4Q;@lDBc~bm56N50ne+{!bKf@e9)x%SpC(l!7nB3&Y
zAl#S6#OTbKv7KLmp;>~DVKZwegI2rnv<e2!zByiprf-@K$~B;RUIr98)1UsE<5f0w
z6UV>limb<`Lsk~gIoPbu&%nwo$oDw^^RGF6y@y%dCwNU3S7+D+RbkBblwmRdw|{f|
zSlJ(cehyyGgz4sX&@Fi;yQWWYX4YV1N@nHYntq;%VRHZZg68G?3=)284~sSn%d0a?
zX7*>8%$LT*=+~LCok@X#c`_e^F>3{bQ~PAmVusDFtd25XBF@LAuY<<x6p+ispZ=5a
zs+wWMJZ-v!qaw#FaE#A53^JLOZzA90ynnwW{94^v5A%3|;&3zD4~FJr-~Q`?)rlOI
z@M~p%T>SlCj9+JW<7pW$b9M!WLh)VGS>0#ASCl6+u!?|E2B?e$r4I3%Obo)Dnp;5g
zYO7k3TiFHf_)P5Hcv$=d69cnGMskl&GAoCG@YPTTE>_|86sAUZMOH?)W-)e#R(3)5
z<il(XTGJlSWdFZuDx`JGy7K)7{YM=aDv!?aX?5p3Kg9#&QZuj%8{I?>&+utwe_Zzc
z-yNS0kIwFk&(C;(^50uFb2b5n_XYC(T79YyL3RsstcY$_=V0hP&#cVJFuBczN&FaS
zm!F#zBluL2=BaE9jqb?@Sy_@FzhIDYnl-)UFi1Ts`$RTDw#SLz|4nCS0NpNlVa^e?
zR?w}<?>E@}2Hlqo%7dUBSkwwC{hOz%F+9G{`s?C$P;UAtz6u;#Yqtx!zJE{$9y@+4
z!TL^^&*9+1?Tl`k`%B}BS`jPbK;;6nD(mj)TS2`&R-^X{6KX(d9+Ym7`vVOONd3KO
z2VIT2-fzgi7<m-5Qcmrb-Jw-2li6Dt><)nXevKZC9+TT$7}VN9>lxoGIMlJe1-1ES
zo}S`7!{LsDV4B(V83(5JC%-<<a^Zkl>-z}`KC9YA-(Cs<^~@lB1-n*I&kVG065fC8
zf4^b<Sy0~*qzcrV*%YZ1g;4hpy#Ka#|D}+x;i>Qv36xKT+1VF>%8<!zZu7;jf#RTT
z-g|`&=8{h#F}`%}`w0(XV7`Xbq@Xd7$=|*)H=Y93d!Q9<kn#3Spnl6=XrE=0-#Jiy
zyQ=g3gZ;Z)kAmFR*$nFCUOXRk#xcw5LfEOO6T)0vAGEp|J-2iHXRuxH{)5~NVbE=>
zt$wZ3uQ4!8ZadZoF^#SNeS<&*$P89aLGI-6pDdueIQ?4D`;Xz!{v)`L^I-q=RV~o=
zN!Q~`EZ~!SK)q_nJOON$03pJ=|C6UJ(#VG2Ij;+wS{U8dbuzDHVR--G{RdE(cR0NN
zFz+mAd_$`Z)GzyYg7N7c2jvCkjG)kf^v@yVij%*$F?T)(-A$f6i(QDvJ;pit$95r5
z$^rG%jk-Yd4u03z?wNH$e5uw5YK2^C-PHmLwfN<$+LL)$`9PzjitfqNpYerV0?CUX
z1C3%ls{@_>)4a-^;r)aCODaM8Z2wLKodUoET4@FyHxKJzoGjkKC@kK=aIrtPUpS(J
z0W@xYv){Pl26$9oxb6D?QupMH;~c_QyBLM1cQFc2>tgWi&+QYw(Zv8#<=1+tb#vx%
zhDJB2z2%_(=H{22jPD=3{{`y930MAP=R9i8&d^|-`H}&&*Y9s=a_e)3R@co_zcSo#
znBw5qI$2ztp?R4b->&Ih?E9v9wY^WMUwX%Z(Y2NR&H+d-7?x&1DSJ{>Y3NsQn;CQ;
zc2ff=t<5|HTK5b|e+&}fl=cteBDNf5y(ge`f&bn=ke|YN5;Q&vs>x)WJDavmmpKfI
z6-az|o^?D2Djh*%k&v;&b)D0Xf=1d~mui9L-XFyGf<|OlwL(l@mg&{{{=xri$&Rcn
zpx(0DsrMJ||6SDrnmvc8V9NxLs62>2zp5Rys==#u=3}N=ybr;m7ykcU)$%xo^$)B~
z0U8;Gv}<9d6i5VAPJvpfpmYIRQ_;XMdAk^c@b#~ZH~W((vkQ6M(CSR)V--p|W7Gq&
zby*^4wo0#iTlf11`;R9}u?kFPJMsr2mzH=7G~V!_zPa#V*rjHzBY!5}vSLVX<KpwX
z*2i@)Gw4d%sa3O9^-S*M{9w-YpP_TX`v>)hSG6a#tF?i2UVYrW+=pQy4`}vq^0anF
z@a*9;F-GGG55|Sfo1d{UZvJl0c(<=<_No@yx5+)TSeuuFMsv_}qB}GvnuA6g9>~vM
z)dF$fvv9B0Wv!2|vHSp)RFLuvG$H^xRp^orY?TM7^qLfP$p@sS(ZvaR>JUs8UDsD|
z*$9)J6!mgDOvl%dyW2tM1|8iFS~<Dw)~yQ+jBWQ`omkbP*9{uW6J~vCJ(=|Yzp~nq
zAMY2~e@o_N^*eQAGV1{ztxl-C<@*KuzbGrM<V)sa)jQ}45pA`&c1c-D<+rj5XocmL
zU+)*xe_GX*%+Jcl=yt1Bt@Yfs_Ye5jfkssrScF+Qx!!-Mo3NOllSg?07lZO5E(YZ#
zTnx&~Kr_XW{FB*Oeu4Br!e^QL`v>cvH><P!>TFh4`10%R;Y(LmbuxM-p1pVOVD__9
zle@V;Z0GsUFmu6sfdt7_?XOzZT9c=<TfG-Z5R^U0ta{|<`v>Q4vARzV4|V8b-z>JA
zL74pm`?cxGsmmFltJ&3Aez9^*<V+6yWzoDGG>?iNchjM9R}PN5_-3tM&{}u3)>o~M
z!+3wFMSb(W=5wtT5)x0<-!G7Vwk=X}fiSPb!DdxYK8Sd#+WQ6bpG=E71yz@-`hLOu
z$8M3JHKNx-*rKyq-F!i7Mb)CFvw=$bWow1mT)^S*{=@w9TD`6xr>|sUXkNL}3FO9!
z&u1=ZUVf5cBj?=n&C5F(CVy{de)=0UbIz=O<d>nF@KkXIyQy5PliS1@&b220c&^o~
z?#ZXDa^=@XPP?h^KiIW_O!@hF`f?_Q=HtihYQsUHuFU(B4-)EbhM*Ww)_d~f{e$!8
z1&@Mu1N6ElpL?#>tbXLj9OvZ5boFNSBR`c@e)55ILUb+D1L=DIVEvh7CRQbop1JPH
zcb_XnK<6zdi?=fhhqf~ci?uVH>{o=&T3+lg?Z4TttcGmTF)fHm{3nu`S!JLm-Fq%Y
zj7hDY${HwUse#N=)-(C}{sI5tWM)<|ka@lC$@iX%ND$$&<Uc<dK)TPhbFKizsqJ1+
zJN}Npvfh^;%3449U^M}oBFLWi5Bg^rn=W8b=2^*is}&}9OhK*n{e$;2Kr)MYR`N~X
z3Myrn27yHRw`=u2c4WN+I^*o#xkqQ<E4;z0!dZU3zc7FKs?N#WAJ}<)lHFN3Kxq%W
za)6;AOZ6org|Az)svRVj{NOj+dxi^%tJ)E<(k2Cx*?IW=1O3gb+8onCGl8I$fNHJ1
zr$G5CIqVP994A<szuF60G5E1>Ve{4ApZ#}x-#_rbqSc%1$I6z>vYH2E()$bb3s-eM
zj%EEenU&?YSL^$P{|B^sHQ$0(yH1Px=AGtax*3v69`~fb1*MXgdqMme&W-Mmh0>pc
zLT`@$N=PVrD{h74AG_Y#oe&n|=F(W-ouAbmK7vBHayQ6C-;MBfjiC8V=(@&}y^uAH
zFt>t2GymkO&d1KI*Fd59p1~mSF)!<tbFH8-1I;r9gs<ET39-JJ!r`F~T<nwCS$>21
z44^%lj~}l7G{qUT{#<cCD5j@w1l2)mw?J)@1_s!fUGEe8XRYdl#9*r#$j<k(lHFK2
zz&2jE-=nOx<j<<sWM@_u(E10EtsneXwX3zZK5kZZ`TL&XgZrv>NPc<7pw`-X94y)(
zzyqSyTHjxo-wiS0aUkoT=H;CnQ{O}Ea@7IZr9TC<_6AlXw|xMKoxhvx#>xP;zu^NH
zsE)W4vMEwAv8lo9M%bmvtSx^hcXDzGbGrN$|MvgCFq>PlTI=5^WgU~h%32|RmGxBq
zzW<Q_A7p>>QC5!W-~Ruf+@@9~%*OIptyNir<<I*M_3faOgG`Tu*2pm*3t?zJTEftL
zEQP^|?GgLM{<Hmy*u>bc_8Yf7XIKVW)6&2YmF&aH0<sxmqgsqwE7&fOoe=wefbBcW
z$^fzNm^Y&vXmsm-gHz<BD9h~-KeNiJwSxHXAFOYA9LD-VbUTP=xj*wPsO1AXUxYyd
zqVlOMXlBg6DcKnm6Mw@&XJH1NQP%qM=lzBL&#PLBwH!VsN3k+Au7I>f^uI!8#6ag?
zfJGQ4nAUy-oiy}#g8P4nNPuqPP4FzwUub+i^=f^8;r>5Rd3fY+uY2;L=S*I$;%uPy
zXIl4UR+qo;KfHf6DI^IzZw5IBjhJ)`YE`|T3yO7Llu;>AACOtC?Ii25>Bm8%bm}J=
z-4z!cWKZTf&M?K9mHqMTW#E2$hx-|KP#+A`D*^2=0I@;sI>@NvXH5nZ$Ab_b9J}>5
z6x0`9)$;y9{w}S~WCvC@SXw%E6Ld=C0<}}n)?V8!Fkclk%MH=3cKdz90u{g3Uf1^p
z^RIB81obN+<0qRuL9I4~%C_zA8yJ+1ZU?ET4F!$0z1*M7%4!73PoTNE1_p?k%P#&6
z1-YhwqgH3KBddYmHPE_L(CQ9|eA)%IR?tb2pcdZy3-Zr14>GGC`Llids#TNQx3Ai4
z{+(&9TW>R{4W9hv8P~xqtuD~Iw?=Q!$~QyM`qMv#T*=peb2O`QF)*upF*K`pF$mvp
zW1Jk<&L}*uoe{J)On7n|!(`ER#>o=x48ow5a5LH&j8mU78W$%sZhm@|ar2K1M&q<&
zjK&oij0>9-n-?}4r=~J&{uai#`Kc(Qad|kSaT=%{7|s~ld$TvT@BN0p8?D@d7a^@S
z(2N=+Pdb6~<heG8&)SZF!t4Eo`!}_^5<z{{Kjzz4trBM6zH0OK=S+}R1MA}6=E+mt
z89@FMKhDIUtonV$`vvRofYO8V!sVcuOc_w0BRS>+$HCN9Z9#35TUkFadYH5RXOMAX
z<uGIuz6@U3$2b|}r}T7&%|BK!ENlj?_k7!bvwzN^X7#rJ%FEao4&qfA+poOl*}rD>
zWB--cJ^P2>OyxD-{(;=|*x|>Ib8R3$Lj3Et{rv^`)5*N70^k_De&)>N_UmUrF?iN(
zA|wX?KjU-EOggiwMVOQG1Ebe=&i@RMIK0S`9Po>ec?Ao@6^98fH(cg;OpfbdoGjYG
zD15JtQ8>7badJdE<7D9u22gxXp47%5EYrp~S-y>7vUEG6uzWj%@a%TR$+z0U@i}>3
zJHzJB#*D_PM;SMNG6I>wu=&3|<L0y+2IG2rka-N7|JgAbKa*wz_You7!C@B7xcO-*
zgK>ohqj72|gK?c6<K}1I7>$dS8I9APF>d~$!DyU*opJMbb;iw4Ss|u_b`PbAF~;`4
z-*9dhE0^d^P)b0g3&>0>sH9HvVRSvXTbNbh;Kkjb-Vf+p)`OcNyR)(`G;k!dvI-?1
zW))g?NO*@B!>$%#b1??cirHjgcCq9}cCn}%X5Ew7j{Nq!mv$-d+^Wufz3(sBZ&}q-
zdGOQ$X3ZnNg)2|~*P5AJuPPjL$1yAHR?-#FSOaLB!O^F4!TSsK8-?3^7#vSZID%Sf
zlSA7XCyTW+ob3mta>ZuQe6l;^&Hl-A)EPF-NlyF2k(@k}JvnFs*I$w3e>$wpD|i_E
zT7|<QaWYxFg8{OF6cl=QdqI6AP>8(00BXsCTp88o2WmZs^8Ntr5CfgY2RrdiDP~g4
zC*Q1ArdZIvF*Z-oIdDobAXUP=3J0gTe2R36Mpl8Tw=@={8fJoHhVp{7jLM7tGE8pk
z1<fLS*v|2vVd`-iCqcG}Y@jvJ!jKjPgJ=KducC|#n|=E?e`jaB*{{6r+rP(i&-`KZ
z-MD|6OKEKGb~ewY`yqSxPMv5FFn)2AA=!&V<I)kWu4GnLjb*3K9lLgDU5m2HlV97q
zHg&$guz$B!XR-&Y%Bt3&)>{YO7c4N>>P`+`paI%38F%k}!2{b>-N|08YM?r%<u@dk
zJZlRAwE<=%^RcRIX0K-4+-}Yc+Jnp4oc!^*S{J)9+gAo<r6a$RTe&10Qz7et^R5ZA
zvVLfEX><dv?3Qs_*4fH7c}hDYXzdqhRqxpz<8sg{!J9oV`vuwV_B@uq{l_tPGW(I=
z!o0j6K)VaK^ZsW5x$1pEg6^uG<lqHD5Z(b}t)65bR)J=<BfrGAf$BN6TCmK8`o3Jy
zT8H1saUXcJnj2jk-9YDQn02(WP6qXo??F~4Zhm%*(YS0I<HF{PeVe~8XB1?<+xK|R
zo<G8qRT-qFuIgj-V{~g?&d0E+gOyKsT07(9`|XUv^V=DW)4nkp*Y9Us*bL5D-<LB^
z<csZlJp1V1WG)^7t;vn9jIJR2^!iv?Cr@o>6u#fi2+q|{pE7R#w-3}a2bJ3p8+#v1
zulbYwnv*}7*FtdFRKIzfw@+pGG(EZQ2hZlVD-N5tTwyTo;B+*bX3R0eVYAsa2DcfT
zJJ}dFwJ0x`#h|>%iV@=D`}4Fqo0o7gG_UkxcpSz02C}|+Q!J?0weWOuBR5C0y2~#v
z?t>YdThkdQcW``QbZ2x0?Pi(dxT}qo6`a;?K*9x-bB)W=7#21M_HX_!&Nz`Zw*T?m
z)qg-{flkf8=CaLG%?q>w`cpKcCurrgSF4++YGP9Zhz*m4i8Z=1`mt^Y?Fc`(UCpaB
z^5FjDDeR1oA8q?2z7@3ICpGDP!1?(w_creT6b&<h&0CnW;h^jG$6v3!ySN`A`YF0J
zG825lX4|o_TMZnO&BYjmEkwa%WXTiR1%mGAbtNBQ6#$)J8Fj;~)2e$@i!gi3-^pw&
ze;M8U?yc&4|6%^wRb7QoLG8w7b(g<4`yU<#wXQ&;cUSwbo(7H3%s2o^Q)yA4u{&kG
zE5F`fc>e-acQmUV`JEi`fl2hJ47i8pm@YiCoe`8%!E0VKS2BRsyn=c$#+fG>Kzo{g
zGAJ)nVFZ~2F;gw<{RRCeAhVLgKQQq^&4KKCfSKdj4>AQb0ti_-JLibx0_7zsjIc7r
zDH>FggtcCZ0+mGw(aBs52k&lAiUQF;_k+S_@{O;Ip!LBQ-+P_~wQ(94U~QJ9Gij&T
z?rrNf>H_%~;<hy3RXtWcdfo3Y@ZVb1rFatT%Fquipq@sfOQWaYiuVulet<+*O=)Fm
z<xIZ%g=ur^EQX-g_Ycm!U)65hI*Z}wf4{b*_Iqu&TGLwJf4IL5)Z*7%03wB18xDeM
z8PIvupteVn&m|vF4FjrGK&?X1nrG0eMyOk~-d|XMQTCwPsZ}kI)Z*&${z2adtu{!z
zI@KA}!&vuP@+oB04zd~$qEglA{eyRJVJcl6K`QxPLdNnyr|E;*grIgh+cmXI3=)|~
zlaH|ScwGRE*&201Y<IH*t(6DwU%TLca#f2fs7(2L@;uah+xHLNJ%^ib12+Hhsutb1
zATvPw%^;>MGk$*||EMWgFRy!Y-FFs2_vGg13|3Q<`8k;&DF}begZ54_MS{k`L8GIv
zk#G<jA_^0M@V<t?&R7Kd>tON$bblQ)K=|wY?o}<0p!VJ0lcyp6TB`s4LEbHxzmDpG
z{MC1LRg3ORRDY%EzQ6E(yWv^T2yU-?@~`JCwDXVZ*}W%0sRPtI0L_%?bxvOj8ly<{
zSk?0W!ud7HZlEz=P`XiTg@ihr>iY})>zdV%{7Vk_z#@7U9?n-GElyBQMbBZNaEA04
zKs^Ic`T(U$P^;(bcF>6AsT-j2$Yr<0cY@~WGJk>Q>6F!${7_cf@<UnS$dBZ?><X(|
z1YO@>=vxKa>5$CFs+HWqq62a3Qd>~}nSW8T7poGeH+=2V`vdnUuj)$nWYwC?-tzO&
z8PKlUTNmz~dv@y8iFe18RlfYF^#Pqc!K~Ku;~Hq3_=Ek`WGPk&2s{34G7GCjvr5ZP
zkhyu&z^gJ|E>{Ba`lfQRg4Rxe&VODtop~)gLoyGq0!XBJ`SW*^*^c~#gwiu%kXd$f
z-(T>by{d)tD6{5~pUEBy{LHFHejrq_314e{e?fnyR%bFNE2u^PGdc8w%=-s?J3#aL
z!t4sHT3wUBf9Fk}`CO*iU6MhVJ%JU>pZHvc*<F)iGP?nDGVgbWW_L@5$?eboO#XhI
zzw@{-`|>}@0_;)~eT3OQuqHqAVN6}o%9G4Bi+eNMOh)G8Yz&VjkN*?q{=hn!ljT?P
zKOatzSSwF5cRFM8cOOoes#c!IlIj1G|M{>px=XG|W^CtYWjAhn$<WHPnE%?p<ljEL
zAeGI>*ci^WJf4{Le=}P<gK`7guh9FGSy+CRt`MKa#30PY^>6x2CWgtKoZQT6UJRgq
z!TSsSTUZY=t8+21x=jxM?)bNR*Yv6FUF@%>PjNODe+E7YK#}Y5OwYfd(7M+8{=oU4
ztGXUXus(t8t7eM^jSXG%ar52g+pOa9L#_4w0l7cmSbD#l1H`lY&BY2D<DA^SJQcK7
z=H}t)+rVpNt}v^y`~cl-BH=X0`DVY&A;>r^<ct-NtCglJGqC@fK9`AMa&PXZ>9d&_
zCU<B5S6r}=_i=OW`{t#-p#3%v-c3vW$-Io0q1AnI*f+<&U7MzX&X;*Lt;flD+HnTo
zz6pm8?#Fa1D7`!G2et4sw`0ndhECl-EsAx&qhMjW(h;^}3>?Dj><XZD=JxHN9zLjd
z50cyd>?<omesUX|!21vKttcwK{bE8<!SVjX|0ZM=2wAZCjW9XO!oqZ=JCOM}(3<N8
z28bK9x*+?P`v0wJ5j+X1Wgv48u(<|M`2|V$%buNU4Qf?ZyYlD#f&H&RGnLJ1NB$%S
zeBcQ^E8*yv2I`@LdK$u@ew%1JxMiW({IVCcitlWHA!J0D0czGGgjxTe!Oe>Qz@|&A
zSsFhXKxRPAyZ8P;{UeY$$x$DeSWm)BuIY$221d!H^^<{df1~@_?aEr543gVh-Am!?
zKR_+7_aFS<!a~pWq-CMk4aZDS2!htEgT^jEd#M_|Aw63`Z_rHBTF-mXlJwb9P>GVi
za8-A*Co9`z(A*WIt-bhOD<~E3zg~HhS>wo`#}(Xvg(EZ=l+{@NPG)muXmpia@c16<
z?>SDLtPA0N8A!QnT;|3IX<e!_-t2!o*ZeQ5D=5BT^NOIB0jO2L==yd$XeJTViV-#!
zWdP5y>4Ey4rw)M51<~tFKFX@I?2zBRpgY1`M}BYWRAyjfxYPy-Nw%4*THYVne>Rzq
zRU_<Hv(}N{6Wx=)higv0rN!Wwp{y73+it2b2ge6SH&8oxt%r;wCz~QGs3i>Qn}9}|
zefu|mOJi8r9187qCHIOeKlTm#3$tMvWR&DU{qaV3S<tNR@8pmNOvH@aD=+#9cjvK#
z;PU2x{NZFiR<UN#e#WQ|Vnms;1YydveGpUj?<3hQ%Mhlp?SYsQzw05XK3ah=MQta<
zl>b|k`N6B8e<w$O5J<X0Oj@4Y)yb&5>L-J6dnf0$cF?II%8S?;7P3E<{{D~A%ho5T
zO_;sq&tx{1KVUmPyr00z#R_W4|7lit`E#>>;`wH^7SP^@KUe!3Pb)8Y#h|?C7Q;fW
z$0A*So0p$tym=nfPlxo}8C^kbXf{t!3wrV`DTjmU$#;J-fp$4=XJcU83tHRDvYm}V
zAi3l^!$)x;_U&v84#^qUnUbB^8UBj1x*LmsXV`2N&UkJ5+`Ze`85om~{9-a^XAt=4
z{`l&ve_`!!-9K*sDbB@ya6jl)&7TYpH_vrfVz1pE)_&Jri9L4vr6`D7N<)`|Pe1P6
ze<?~S=IeG)E4irw(pLAn0a~LEYNxB++SF~<15MjYKsiyXb6wB-1M}x6bAm(pPtX-!
zujHa%0)E%RF3C88MyL*E!RAgteQnSVT64yQ&7e_8$Qa1oUa!{o2mbG0)dJc#w5l}@
zyh_6U<f<0IvyhP>P`-4EM4j=CYkhyg|J$mT%D>IWxfve!wEqRU<{7laV4Dpx(|(#K
zsLlH)x$YNRXLHmA&?uo+H=|dxIyZwC###`Nt6(mAf8hVNRjrTOKyFDsz{>R0mX%8s
zY?dJRW5-{AAnsy{Uez*nJB+=qW#N7pd*^ngsL3o12WLWML2TXqf`yCjGB7Q>J(;ED
z)2W;1u0K27b|19IX;Y6{t1w#wXQS);hP*4n=8_DPx63fx>=(ZN6Evqko!vl~o#oSH
zww8~KZs6Sk5AMHIR$KBRS&CJUS-s_Bv-**bH~W*D+4Y*$SUxqYyL`IZpWMT)qrB=4
zgYt?u43pVhK0@NGtqZLG!2FhGb(fFHVIPQV{jd82F=H8MgyWbu#Ekd`!K2NpE*~el
zC%@P(*XpL$1{VMD{|@ilW>uEY%xXtIHLJONZdPykEX*z-pgiFXlk$>1Ov;PSFe$IN
z!xRhJ1p=A{{jyM8dD$N(<yCK()Y=*$KKwBMMlu7d*rT(P+j&@p+j#_Gxe#<`+eY@s
zlHdP<eFb(=S{>Nt1Nz^!dXl+VrLJ9W)^ho{);;-Sxb(Z@2Xk*-ym$W9Nl=+PxtI4t
zqc@{3X!P53!RGc7#xC}IQ=U!lVo_ef&Z4}Eo#ok-M)y5uczGG!@3k57B*(>ayT0Gn
z-K_4zFnNkJgK>Kac+?0yhBK|5;cTCASsHZoW;-Jn`_=xm={BdE)qB9<rL4ow0_{tK
z&KhCx?A!b`6*Pj@xB2^a#*6(mr^UhUS1W+J|F!K^P`vQEKQ8|MP58PxgR<6>4<e4t
zYCH^$?t-kzoYxpy*&knh{zb%5koB?jwSV`fbg?{}BHS+hALM3Xb8&{rZPE;eJdfRC
zzs`%|i~i@G=i}$Q&zD*C$cKLcc_H^g{37>7-t!SmY-&J{BUX3io;OU&3-+)muRFt}
zyyOl`tb20FcP?gimM@RaE)-W@^oK=x*&CL<TRR&MW+-cI`CvB{Jc{FH&i9`|*BMcF
zf%e{l>MqbI&gO5&7$LQnI4CW5r87PD+4iTkRe8-GhL4-)MdkTS-HwP!wq!_1^xx9z
zc`VEND9>l+_Ez`SR^^62OduVZyFusqE319^V7ncZX1<1l*u2|8Zo3M;H;e6_*Np}S
zP;EWgOqAhj|JCQoM_IYlZh=N$Hnl*<U#<mRS=Fi6_5MNpR;|v!hlnwlrJ#}<d_vLH
z{;kKaoS1O}G-3iOSs*dR7WMwX`3s<thvYco^3I$ypfLv}@IEQ8R>%wos62y+!bBiE
z&{)&M{mF+|wUQZFwUYVRHIjSSH9%!BXa^D7Jr;-LHWm#Rhva4!ji4*SR$>gsTn>()
zT}EM-Kqa(r)v5nc7t&72avkeB)M?kVs~fa0)AQWHbIIHs9Lb#=9F1-ef4G^yKj44F
z@t`nw%b&?SEPtZfpS3|`mid6|v<LT}FunxsSO?8T#P%nPvMV&YGkPeid;zVT`m3z)
z<&Uxw%U?!!<pr-9lokFkAWUHMgqX1ZL9!sL9PGZ2oBhdM>@v;jEPp_!>VWFRsVk6e
zXLN(;vY(SI#wx`Otv@gJC-<{UfOLV(2c5~NtZ;_mR4eG7gZB^WXC`y93So0savSK>
z7l>WSZCnf>pC~W*#USJGtnE}Qs4R(bfcW>>KQ%D_{Q>{YiAO;;@wz7$eCGkLruoC_
zp4|1E>tJTq3CId4M&G~DkkyBvRZMEF%xf_BO~KX_f>$yf$iD>YX(yj!WqN;L{h7()
zJ&cpXdKiVpd%(M+!Wo5QdKgx<-t0H7v0;pAQ)@MT)6STDoR#7IgZcL)A0~5mu`{c)
z{9)x>$TK<oJL9hDt?iGUfBr~LuVtUyF3qs_u!O^8c3Fna?d6Wj3gwIu4l;+Gd>LIK
zy$-}WDM*R~wP!&g0gBU`{g3CdzrhxE7q^1cB)=$Ud|dqZhh4AZb|>H3?fbeP*Zlo<
zc0b59hFd|S5~ZQJ;8sE)^o%^vJw3_CSjA2q(CSQPWEBJFK?`vP(70dnG<K2X7B&%3
zD>>_eS(jDsrcPKJiqUP^p>-|qAN2px>P{90&3>_f#(DoNYgJzGk^!`PbTV7ZZ%Ayh
zJptA0>t}$*)?0q_x+m9yVk+qh=;kO^_vFUse4x3Tv`e75n^irHo{T=A85~etd9^k#
z!5vrN^`8gUZwIZ~1Mg`&@O~p`HP(^eUaiUJS()BH*ne~~+Wx_C=>9<$#=AY7Z<$q(
z{C<BxuWfSsl>d{ri!%tDvU1e+YRv)7O|&A%-l?D8E=5g>QC8@MkE1HZFoEY}qFSAz
zLG3_c?uLV)Rv~Oel_?e`!|3yHJDX=|^vV4o@*{Kvn$nPe|AcVJr=0<XJbxo?LY{vC
zBINyNp@zKtIwC@T!@PHs+po|u<UxBEVD|{FYxx_h)%pH_|8~&%PpeuP-Mw0uwK2NA
zf8c+f@#ReLjkmD-13~TTqu`nfa?TW_zS`8is!Ol?{R8_M$&Ap|nc$W|+vZ!XVXf~s
z%zvrXnR*noj~moqP6EZng>|6&xc`98eo8)K&da=tn?bn8n<1Hzi%soTvkDhOhXd!+
zi3>Vh7P82m^=muT`u>97g500Y?p+KkpMzGAgVt|`wKh%H>P+@!Wr5T{N#GTfka7c7
zH!*ARFbMKI7Uu%5-n|sExz*eew71-E=Gy%|4&qBeGbpXE-W%-iMm6<uIP0%lt&DCU
z_s1`o;-J;$)js_yXw3AfB}7;1tM>-+9Wa|C!ENOvA5bm07QAO4wC)ykmK%e>y3S2q
ze?uAFv^w8!(BGZx%gUs7D(J|n7GbW2gOGK!??3#1wW^)b4YV>Pxy_w1`4~G>@;ol4
z_Z#$gtZI222U=CD<dr;wi>c8aGy)GgCt#A79eCA0h=0jN$qQKw#J{;8)Y>=+U;obN
z_Wr~EZ?I7ePzqo>#=ybq_WncsSC}YhJRfp`1KYKz6ATid_I;zvvQ|G(ujYXMRLCl+
zWKUMEj`;Tm`;TjNgIXq_b_vMkpftn3=CLR1AJB=3pn0LQ{U0xb=7qpx+-^~=H~X*N
zW>)j&e{Udv$M-9<n<oRadn7}%TO~uYdnSVudlFk@-y-(VzSurtHa4bHpfTG71>sfg
zkPtsQ=kaOwZ|@JxdjeTEKYbZ!EoItlNa?x^)N2ZukOFh9e;35HkE2<?fX4bEYt<q5
z=|Wm1ptc8S<c8VJm4Vqkl%d(Jl%d%@73z-AzD4Y@ed{`f+1MObwXSM;pU}Xi)tT%9
zUitI~bYtoK)1bOWtFx6I)Urr+XJwi`6_i3)FN0+3w}aCr!>U$@`_e9fMB^ueav7s1
zq)yuu2}`FCHEI_??TEBf?-LprR`n$NvT89e1Kmi*CKq%Cvi~{m9H@3+^fBlD&!D*o
zv`SRa9n`|Z)lzq7yx4ya>H@c;pxq;1{=5$`2x?x=$q3SSuNABlG&VM^ox!so(jx%P
zTY^>uKwQOkSkN7&bAn&<a!(?3s<jHbLv*Vh0QFqo2Ym2qUf#+0^)V>S?zIZKgY1R%
zL{1|0MBEv#_KQyg_0`z&KrV#Y{J{;RlX=-m#*dtk5TDE~!;s9v#uwM~3^bA!5Rkj7
zJK2ww3zAw=H@!db?;t3p+-rrT6t|5~bF<W1-v@kfY+mlk0I~sp7$AJowhrQx0K4Yn
zoeYng*k6Fg1|hz5TL&J^3z%TDbt`DZ05l2~+7IeSZ2ku7V}VA%Kp_gU4;C`V)`Rpw
z%oMPEx>c)FDGD@l2b$A6x*5S{^gOxyaVPgbP}+FEp}%ES=VK?<e~ww8lps7un*o#-
z7*~K-Z*J&s1+S3&18Xa@flljaeZL`oV(LZcJWA{P192-ee+si7`SS?cZcc;f4lq#G
z>U`|S`VBPS-|~l9?Z_YDscPW%*|zB*AA#4&Pi+UEC<pBg_HX_U@|Q9DG6tE$t!$5{
zl>ME%|B{bZr{!)~E{i+Ib}#7+=(L8<DhwtaG4BoJTUK?yztFc%@+jy;lJ^1i4auUc
zB8)!hB|;LL6MJMIBqzd4gaCn{WJgv$NM3WD<JJ0p!~TY34^|#fE&P7L{7<V|k{wxj
zKs6L-jV7pMdjFt*Yv5Z5>-<{Jlgz3|{=DCy_g$+SygK8L7c_@FoAG|b`hTmsZneg>
zzBgF^H@TIIL)cZ6LAdlQzwKL4`dfNFnTv;IGF!_ZNLo5p3^sLx|8LQ=&8jfbG{*NE
z_AlXmiqAieY~b=Oz`#}WEZB?%_g}7Rc^uCA1zdv#B!z%Rb3x-qpq8)rR8UQ|)aU(y
zeN#Yb8l+?TG;sOn4ROgb@Am;4M0&TYwRXC`5Ac7j)#JMtqO0}C`vY+kQFXa}hv+(%
z{yrc;%n^F#8fb2?(G?=I%yw1F`wgIzD3V=RIn+SAo&G^&+RWc?@PDIv6m%{j=={yE
z;+##O^9qI8pZ!mM`JCloh9E1bZ{6q$>0AGelW}YXj|=1JTTe@8P*%9g2r_eW_&3H)
z(_7mWSsx$y`Ug_Kfo2n7E^{*mm!xY}wLT7I{f3ZNEL7GLlv37dlv383DAmBMtf45a
ztY#>!tl}uGtQ07%tdJ<JtXC)rsTVrpg}GSX2y?T%cyGXeTbPYOpwU&UGpO}_0pAK?
zHU<{(P0|H^%fTts;X-Aj>#9yrxskxYe9VP``FIFJ^RW_!=Hn?S^~I_#P<;VjCmS$9
z9X#eQ1xcw-i$SjDzqYD7*`HNLS!<$XvzjNLIWt3pFmp3=hf|}EFy9Ae&Zlcvop9U8
zrg?CV+ve}-3}1gIyUtT@Ug5@&+{q(xsXeNV(Oq)^D?2M&a^o9`9_NYdk7tSgZ+2y4
zc>HbYKc(p#*_0WUzvytv{FvOyBQ%+v<(abDmnW0iS)MAZZIo2jX_QpfSSZ=()#|IP
z^yLZ2Z_Jup49%Y04DTH#WH-8M^{BPJcQ7c@>Sb0v^2DqCS{pRZ^Cq)0FugbE?_yRv
z@&r_Ffzr*Y4p4is(G8-;Emy5I`7j5UvWm#l_W=*Gg~K`-CyRG7P8REAxY!R_oBpv+
zII<Ho-}K>Xzj5VDhRx5_8A0<R%<3*rnl)OUY@TV$n0&35QCWlKi7>m%Q<=k)+1weD
zudQVSoxwest(`&mD&&lg$x}NSPWD6QnjkYvptCy8_HX`ql40|6bH+J`n$=vM7_+Zo
z<YGV83UT2x&}@8wLsBc3AQvn5<B2gJnROZ^nROW@n{^LLH0wA@HhMQJ9F%5OX_RhO
zag=7(WRz~!JSfGi)hN}h<tW9h%_tSu+N^z0(lW8BVe)hx2IKY~hD+enBtYTb$}@2*
z#3r{eP}sf?5MWu={n(xL7jifqQv;==2a(C{tXz|?cY$}Jfnp}MAG9BB^7SqTbDsYU
z2eXXJ+89A2&7j&iobhJ=WHy#(g6>fB13_`1tnlU8`v8Yf(Aj;HuY=DmVVpdzlOeW$
z^S3s}$=5p>K=lrWUO$B1hQMSuRwhs=?A;7$-!AQilp0Tc-Ydl4n#>(=5EL$Nx322G
zyA`BvRrgQ$i6oi_Wn8t|r=E{-Z9PA|4SXlVj5$up?bjKS`M)#Faeh4a`oB9)B8M4W
zV-C+ad;@;o0;s*2848-~1nqr;oW$mJ0(2^u-!VvTY5kzp`Tm3cbqH_iN6_9w|7##}
z{#FoKf6%M-{e|`Gy;`TYg4$fJ7VkIsFMzI|Zv(X+mYIWUhW9TatLMF1-v<bYPwxcH
zQJ?H>Uc$+c+-bsi$3?C6RBO}p7Kg{PP5whl5>PuDRNBC5FHoNa)Jj~{S*+>s(W`Y`
zi&5A64SAEnGtp0%bAW8=o5aOBy`2fPN4FL<6TSAd_;k>z4e4)GkMEi;>YhCHB?I$u
zcLv_~${H$vm9<R%D(g)7qpauhx5HV`z13qf`;kAO75Q!*yV`cOzMt^_H>7<C83_TE
z|NIONj5EAh4l^GQXJCBKh%(y;l5cd++&{w|e7_f4^3!Kbk%y=F!|uUjzTVEne2tx{
zv_BAX=8M1bgy#&5uBH2X-5yI{|24y3kX^!=pFx3xc||)TvjzwF_PCDlGvO10uLK*H
zvNGoOd-jEb^-l4h0KPMEjz8#*Lq^x7`)Bw=^iBw$5?t61Q8mYZ#$iU+jr*tg!|u^z
zKHkp6d<?}64InqD?$0e$R%sMaR+=dA>Y}ompa27x_*^CiVcxYjn$>w3R<(4#7iMK(
zR#w~c>HP-2PGyC)49%)XJ|%Oq>VWE`md}iC?+rF&CyTM_oV(ww+46a#$7J@FuZ?bQ
z9iSW98QrG3Ub=hj_WKF@pH1dcWtjZ^)_-NCFQ2r!R<$M1VOP0#{bzWx)K@9+SdxOG
z;H{gFu0Ff`?!2-d%LiozmQRh|$|_$zD66r2RMz<NL0OCCqp}Xmhso?MKa>@|e3;CB
z<g>C8h<5q1*(!ihS&!w@^j;>0$-TWXKVy_tzI<v{XZgUa=JH{u2dg_McIUc+ZcF}u
zSF0yknpL4$o#kh8JG;PSc9t)bSzLZHdJ1!YU{_ZA@<~~5$-Au!nAfo|C@UQK`hLRw
zTbeJK)sKMoFnnQFWBH`4^M-+0-Q{Dm8q3E`)0LIpFfpqi`Jk-vhoM=W<*Tw9h~M&2
zS>X;-vs%lC#Y|w;pEgZbR=LBZtn!9ISqrT4CoAVfmgJJ39L#H27?N7wFZlOVt39bT
zIrFu^`vrDSxmfe2f=(JrW@Hus#l}<*R(E5b&kS!*D=XMADy!8nDl^3}HmkRM0?n6z
z{5R9pul2F$tgnski<x*BlvQ{@<Eu={Du0+jer5Df*5F}K*5YAM*5P4LR^nk+R^wp?
zx#4lb&mYV>N8U559|6t1{Ma>JS?|lI$AWBc#7jYER~!vdR%`kE{=>VDX0;=q=B{W~
zXZhBw+VTyw<6c?e%O|_mW_6bDy=;nZ%6eZuyf?6)zN*a=6k^|-)mpwcs~`CanvGyq
zcln{Lapgm^8p{u5wI?5huZuHGzHQFH+uho&j2!zaS3XSsZOx#p^yHJW&X*62dndCM
z9AwsH6!;gJ7j-YnFM40JUd+6hf4<EM2L+f_8U>nF90mAd%~}INa}!W8h+5n-`=XKM
zCbKyl^xeOzEpz{5wuXbL+aY~%1_`eVY}b?(mi+sy;_y+eRS$gj_WK2Or@`gVo8>HO
zt?w7iI|VO)OhM((!o$$=XNl}-(0LWT9-QuO9miV1xB2`7ou~MI!v3w2pxfpDDJyX@
zfL3n7`pBS@T^ilzI5SOvtQZ5WC<NV71+iaQWy-(z3+5dL+x{G4`@Tak+tqbJw$Fu@
ze(iHakArOQ^l<BNYd_X@taUOw%RgbZmVfUj++QpCkXh9QdX^%nyoHp$!mI@cK|I*_
zM63Je>B||4H!O#rMF5il)gi8~pgII5^4C52^>T(*cjKwc8Hx?I))XsDttnPmilGyd
zqEe0CPw)fZUW#l+gp-W(<Zt2(6Hh_TTu^77p2ozWyy9DsjB{sq=V^%Oaz^oVCI)5A
z??E6}Ku&N0g%+s&{QkqaPRXaB5PSbY{wL@}Ns!M#eqt14JEwGpK>#e5@IeD4_x^z$
zI1E7YFn=(fUDeL&F3kFYAGFSq(G_F|$c-SH73^b>U6339AhloWiB&D{7sPK!j$ma1
z*(MIY|BPJ;;@anIU_UH+<_31P%6B)|y<w1Btks~cBez@c7u;W$coB5=X|Ma^KhJ*=
zv)(|woQXkM;kzE_^i`!Zpb%Kq&iK-<_5Fi;;5&stJ_Gp}6za^XtW&3#GBHeUJ*xWt
z!GG|HQXrLfpFyq$sRXS}Y2W~@JZ?J%zFGP&^nA_>`E9G(8BfASmSK0tv-}11ipATR
z7?gFsm%U#Qe`r<vV?WkEpi$Ts&?rrSL+GmZ%&(xn8>HowcJ^<mS}RzG;`fsG3+_J$
z^(H|f(ejtk9lTHN!2bWM+9Q85tGE0Gtt0Zg2hquP8q$97%m<kO9^YT|li~e>{g0FV
zLHp7svms2F|9e%t<4b0>mcO7i(IDHH)!lQImz-o!UUrkg@-&aLvfh$kpwR$W=r23=
ze!>4~ss}+UsTAFl=R9KxafGyPLANIe-)Li;JhctHD`a64q`m9g|FJK$AGF?ui(Pre
zO9oH~3$vyQDeHat^?pO$eUQwj$e&w3MNVdKu)DeSQ{>65pCZ48m+qZj4%%^cT&OlY
zx&1kVaqDsi(28EfSs?Ep)SUvQHc+Yql|!I12y(tK=o||M3Gq(Q3Qo@i&<f7Z<CD!*
z8CG@9eEdG)|6Pzzh1u0(W!y!)w@se{ZdFWt25P;4O6n<xMVu$MvvEMqv6=k+IKN%@
z#`n#xo(#;YoD7rMzWil%7iLpnejjkaJoGKI`<K6y)7k$dPvK;koX-9OQ{7_zFMr+#
zJTQv92sznc=`(2Cb<2B&{&lVULH15=XJb@ekj@BZvwz^9+~&qI2i%5P=?<YMvomnb
zImE2R&hRj0atjM+T!o|8t67~3+zxu&82){`D?bBhtY>m7s|uqVr|Vyl_Z#Z|{rnTv
z2C-N5F4W%j?-lr$KivxvJqi_VUHM*N{nE2rVfh;rvXC6w&H~M$jNlx)^cfF0hw6Uk
zK`T=p%sT=rQ|@mDl^d}9f+z_<`|Rp=3LXW?Tms*z3CeZv6B3d@>fc@gg+J(QsO_u*
z4Cbs1Yu+2YUvd#XIt+3XY<D5DJ0b34{|9v!3&dS86_RIbMO)oLdX2X(XE0`6;2>No
z`aziWD?cdZfW#r?6-+%y1e-08&{)m|v90|tI5ZYK`vbOB>H9y3t)P?$y4M_(8bM`4
z%RfdpJ<tsW2lgLX)yjAhR)axKR|VbX1uq+vzMH*YFu!3{E2wNxYZYd5`S(6xf$*x<
z!mps4)j=nnKyuH~*Ps-vtnuCG{f4;JpmR@9O$CKFav3*oIVikAB^M~P#Z#FWm{pIu
zLCd%&?;q^%1g)X2ya`DWsn8Lbr_<jn^tXUyK&4;YVwf2qAA;7?gHBcjtuY6U!9)8M
zS}o2~PcWZ!XVB{E^aACSQ?0Dv(rPh($lvz?3z#_1LhM+&1Ckb1r@R-4|Mxy&{}NVr
zkb3AGb$|j>;@@WXFMsX2AI}K?3y~9M6W{=a)%ySk2H(Hne8(=p_E_TkuVg+hj#{Z!
zug7n^euuRq%vsFO^5?xnK(**gh^Q-M2HYW_hW8=Jbm8yi42<U=&W4x|kp<^g2Z0KR
z7{omgb1sxA{+;L!5%&d~1W_AMs`zm-djlKDUXc4(-7Vc9G8>9zw?ot;n-fs<Sc3Hf
zLbb2kV*ZrB?;S1_JcajJL1}P0E2z)-lmoK6_ZiFdZ~y*JZael*{QJNE!tCm7)4%`w
zKe;{qB`7|XwYFZGo(gIM9K9qCY76LHy97?3>z-W#r%$c#S0L#Vkv3QlB2vRsRaQ4h
z%(yN%ssf60M$qYt5B@d7VjY${-ap9u%lUGy8*AEjRwf2>R%V9x3j1Gy+zZN0li67t
zCbzR6sdZ1z{>~tN9CX8}`kXFy(0O5?+k9ZAXhF-QrR&98L1TtbtKSRMzbc;ab#GHc
z@r0*f@+z1-3MRLL$)#X&Dwu2qlciuX6-<VLNmnpw3MN&-q$rqV1(T+GK<2B0Nl`G#
zx~HiDo2!q{!0l?*#SmAw7Q7dbzhA8S0c5u712B03OdbG}8^GiOFgXECHh{?jFqr@*
z1HhyMm^1*B3Sd$IOfrB;1CUEq6~Lqbm}J<~)DYp=nx35bok7M?nC<)j&1v5mKK3;p
z`x>g(+SDN8D*V-qVe+?c?5Q_}Z>Tz077BCxs2AptuwlEWbf<yAsa08r<u7PdAAED4
z)|EfXdRzXy|1keOv)Ylr&1x=xL1|-hsTsqfsmg6v|AEekW>#(a`~HLcBhcC$(0U$_
z%Fbrq=3Uc;S-;g!ZvFmWm{rtPS!c^1P)YUvL;Zbb)gyo3e~5q8tlIK7nRzS2*HF-i
zfgbp*ELb`eX8l?Z)~B-NA835`{fGGHpj(3{gYQ%WjkJPJw`X*p`RHJ?qx<A<-}z@g
zQe<D)Jo(#qhMA89*(Wwn{$|cF^ARU|XLD;eXkCEa^j7!H)1EWfP32`5?cF^6IfKk0
zF4hkC4UM2(9&PuoU1DHdc~<e<LHFe6$JsusEBq0jF3yk~#%=<;0S~lG!>Dsr=em}4
zU5s9g-e03Hfo6(7?0><^mCRns+<bf%!$B^)*^g7T{wIrbGr?|K1MLZD^a8Es4{Mzk
z1v*g$S>|ih-R;cBJQ<jeM=~@Yt7K?C4x3Yi%pgc{M@>5iy6MB=f$yrWWOr7rgXxpo
z**`ow1KlyA_T>ko52Kgiszy*R-C%-LqwA_3zt;B#28zt9Ss3m(JZg(-7YC0nwRwQX
zL$!M2TKDz77qH)Xtu?OAul2nHgX^lUWLH)h(EU8g6WQgOk8fc}p2DsGx;>}$G^i|Z
zK7Rac@+5W@P<sMm)-l&>U{@WGNOotHXmtnIK-}L?vAQRRO_x{JVEG};;qr4b8_Q4O
z@NUM*;@yll`_0+@Gl1?50j;HHRzLDXIJ%p`xcW82=I7~*$_hUiKzf%;D=Tp@C~{1`
z-pdGDkuN;0mvQpcUWS*wv3<UM&7eIh*LxX^+t)C@?Z4Q6t(A)%;-0oUeyt!g-a9Pd
zU)7cD$I8db!^(A#CAnBjy!rSPhOf6Fy^f=7;IWJstGXt0v;2A-#`*>lZUXF$u3Fuo
zaNEGUsvBaa8>=7az8(h#V{rIzLB~VEVR`H-DC8b+Bzv%OOupXDC_KHJaq_fo2GD-j
zgBhT)Og6^J*Si@&a|)pGOmRk#eK-5>wF$aIOiyC~g&^nzq4y36ETB1Bq>$o(gcN9(
zEXXvFDU-vy89+NTk<EDa2VsT+!{d0?d#k!YDGfP=rTJU~??-{9K1f-0RO9`ExZj}p
z6_5$j+d#82ZR!x0xh;Ng5K#R%mi3<RengBf`vp?@-e5!J;}F(+iTedPHtq$*uUUuX
zUTpRmZblYm-25}@>rP}5n7h74UEK()2Z~h{{($O^%0|{sQ2hbwS%KF4!}DVdyMW)l
z$(>*SgL+#*cjB%kT>;$%Vbrr~W~0kNZ{e#d4$u<B=KY8Lizk0KVNh0B@@LWX=Hu*t
zK=%VpW^MW1+pX3*_wf4<|93R2xBO<-IP&{cn_s)#j9Q80;-3ur+LDVc7@gXa%dc~^
zvOJz%^1IRHpeL%y^7Bwl?(Ob9-OBQKp2=Ux9>t{&kWfyQelOtvu{IR8u4q#<Wal_&
z%~7*^%OBzLKkUm|Cx2)EakF2TmF15z3+Sd&mA}eLpp!e~7k>>;=KspX=z4IwTKl;+
zFX#?PS4)WLM+M&t<i9Qr^@W~I0uy)TeJ}9-Wo2mOel@6$rRESFs-o`&{9m+!SHpnD
zhmpdS%j*VcR|sgw=c;Z-Pe<>`A({@ttzST;vCaDr|NACaf_8Fof@*?4n>*VXnvb9S
z54z)XGONp<-fpkfnaAIMxW5>*9zVIMoSBvLu|VeEIH>(kbs+XH<$o{W|DZNhb_K%Z
z_)cZDC4ZFrI6<|_AB1@RA7R#?Alq#lUEhD`|IO$Mnp=dN{SK-(6cd{oAfe5w4l(`c
z-}eIfw<<%=!uP>I`i$)Q;;rEExW+E_n4|9n=FbMDF;Mz~r8{Uly8gYu|6Z6}t2^k#
z*5vQo8UBVFUtP|?+6lR<7<Sv4R;N`f<c6Ln|2DO}H>hs_jX{8Fr$+bWhy@Iv)e{UF
zk9<~3Nch@6^W^61>Wso)#o^~CgIeEKt;%X&{=GLi|3|Bx(e-iggMY>9383@i|NZPg
zxSutBRl6|z_mjn{3?`4=zdM0yNXYofrk3VqtsKnDTsc_N=Qd3a-Nqoy{(XOMr|>s1
zhQ~4Atw1{fC%3a75N7|tnG9-oZ3nlzq!BF`P%G||OC|U&5Qra+{CjWke&=Hs)_<@%
zw$}CihyU*@Z+=$)u#?es&H;!Xkh>8&&TpG6F3RxuB>OLzu1eSUALhStz4%%E0a(||
z?FiNHH%}H<Wq5pu9dxVfKTt@Oy1xIg|E2ED&*~SzstflcRP%3~EN;s1_%!<$nAwG{
z??2psW_a<l`T?-&y+~&3ubV9H%JBFIJ7`oFY<4cl{f{4Wvwrxjz5%S>7Rhw|)sw|T
z86KZue+M%?6QusZV`kQOpVb$D)mtK)zhbg@D#-jdF!iY*^>-h0v%dPQJ^`%$=U#;C
z^_NZ-F9n(Z0;WC@r2f`pX4V&<)f>R-Yquh)Uo=^~6=eQ1nEF_d`s<ImS)Y7XF956G
zi){Y<$>LK%=0Ad|j|8c|@|c<R(P#Apu=<_I=Fgcdz7%Bs1DN_ykot>{xmoXhRu2HH
zw?sC7=4A1$AoK6Q)CYpppL@*Adgrsc16cjv%}DN_Hd*{A$oyL{^}ZnWryp~(-uSF;
z09IeS8%h1-$>LW*=3j%U_XMdw@tB$Q+GlkIu=+}5^CwIee+n`me6t`Z?YM%}AAQWt
zdg-&e09gG_Wb=C`i+=@~e*tE`BS`(B$IPr3KC3f;)!QPQ-!)mBmGSWr_H!`xwjlNU
zA9J&w`K<n72Pg;p-HGJ>_Q~R+jE~Q-pMt5k1gYQin3?s|XY~hQ^*=Wvsc)Gqt_m{$
z1WdgtNd3;o+^okwt6u=CuS7P#ak986$owNP^@bqz+a5Es9{H?(0IYs5!h8k$f0M;s
zLFONVsn-Rm-~5=H^}uKK4Pf=Q2=f)}e@`xFb$C37eIHD{CP@8;$IPtzKC3SPtG7fp
z|HtHVR)xn?*!RHHtAf<8eay|e>$Ca<u==0-;Qm#x|2nyxRp9X)_8l<wiXio?9y7D<
z_^jRlR$sdfN&TnE<*Xc!r?78>sh0(*U;dbzb<1b<0<ikM$mYMFT+Yh!cn<p}n0iT&
z`X!H<SvP%FPXMdmiERFx$>pp}kEgJ2fT<S+sbBb*n|0l1^#HJXOJwt3PA+F<d_0GJ
z4NSctNd3IW%&coZt2=<z|J{P*{%4cRTNxftVP6GP&kIsN`!P4`iqGl>VD+_oI6>vz
ztjCNXF$J(#?v`Xmwv_h^<gWA_V010q!w4!rXFO(LUG`a>0jwes$(H-~A3L)yf!P2m
zq3=(9%*DFsv-*dPpcJ}s55h(Acfn=zY4!y$^`Nr({-noDtP4J?KLD#YMKW9d7Pxdi
z%svmM9#lHt?|;n2I_I<c1+e<ByO7Mk4lSQ&!PJAx=bpz*tg}9=9{{WWxCu%96>tfC
zn0*FJJ*b4f-}#t}b=qh34Pf<!$mU-Jm(Zu#r@+*MO6dD-kC|Afd{$ooR=*Y5{Bz(E
z`Y`(>n0inNeZToJ7wd%2>Jz}~O_9w%4KATiv-iQ&gG%W84Ud^v`#!5TfYs-JxIY2m
zga60DW%MET9+(bL8NL4RV@}qt&*}wG9s7F`I_@6<m(nNMJ779MrF8$V#|*3;pVbqf
zI_7sFbnHI}E~gK$x50FP%IW;?kJ(vUKC1^nb=0>bbj;reE~$^RH^Fp(N^1WvkNH>|
zKC3%Gb;P$Ibky$#mDS1T*x_|OsI1oin9R!h@3XoAREK>dLPz`#P-&fflpVCb4qUr}
zN^Aai$vmvTKC3H0b?`%PEIjh>y@LH#P<fqv22t08%Io*9l9^e5d{!5L>Ua;j`5w~G
zSCHQXDzTFfvwws615{$4f1b?6`sK4a160TP?+91@Uk56)lTRV)d{CLa{z)<;>!;7^
zA2xt;ME-~MUl2O(uLhOc$p_g#!0Z5(+WilcIY71k1E`Mvj|d(6SAfdx<P+@hdLLA7
z=if`_2i5x*pgQv3A#}`N3M#pi&$Gj8eo)Ene><5CRP!Hz>hOP!&{4k#RCXsHV~5xM
zpt4*4Mlvs`?%x2_q5lG*BYr-p^iH134zK+|r8oc8WEN2EzW}O(|0zO;{TxvFojipd
zUjKv2@Ansz!S(+HsE+p!5jx~&f=ck@+3fHZ0H_2%e=eB`)B<RL>NtN7q2vElP#K;)
zi5=bs0F~kEPbYJN+5iPm9qVr+bljf=D#ep$vcp>epi;d5L^1=Y6_5bc(SHM>V}C!W
z98aFW4sQp5%JKZ8$?TwZKmb%n{#AsI`8}YLJb5}hyd?lC$^8!{^Rb@$tnL8S;eQFC
zqrMYVmM70+KLbl8pt4*abY9?@&*}zH9s1`%rTO{2$y}fsUjZt5{w%92WZX)BPcknn
zxVBe4_I?51w~hmhuK6F%p9Yoi`MZ+&LG?ZZR9F5fVfKIo(2Y#O>;Z|%6Q3XZE1Eoy
z^+>V|+mZJR`o4qehWrowC;o~iPi8%mEC>?SgPOP=Wcs_F11C4VU(olq<3Q&A%233t
zSo3mM4(8>p9Fy4s64o}$HurY3b|<r4Wtz+ukeDocmEo`W#Mhj!jauI?@cW87Yg-9k
z>-1Or>+js(VEK=Xu1DcLtM>`~6Jb3iSTAZ-+hlfEh8fNsPCd?#=RW<1E)SY(={PjG
z-Hl<w;hsY<S<qZ8vwHi=&*}^&pmE{G^Dy&fgr9I`nhsM3nuBR-m|g}tEn^v|b~Gtg
zclZdpsb%hAn2rnHSKRM}3-<G|@0#{Ev^I>@wF$1jsR3fs^F<JwW;laRbd`nc)oWYT
z>fs&Y9ueNz-^adh8mlY9?xu!j_p6K_pUVV3JPw-gP`ku-4K&{Yx=**&6?9J!^GX+n
z=9TUYp!4(JKZslI`4Tc0G9$#Rm1#O?MpmoKuXRp1XgsuO`kateonEc$x<D+gZm-rO
zA)xWrrs>TZEq|Fcj{M!sX398u`VU6oFewJ(t;-m$O|_e5+;+@iGy7Hs;c#h&$)Z0P
zC*P1@*u3o+!{&BzN4@D&`-LMU7&fy$bJ*O@?r3bbjp0<AaoceRM%Sh(pi_jLykT=f
zklQ9<eOb`F5F}jECxXHSv|<9Z{z3LAXvFvZhy5RzRge4wg=K_ih-*yf%$`0LR@Y_I
znx-?lB6@_NJvL|eI|>@JZ*_p4-~rkh3qHM}^LgV@o{P##tW2<&Oy*$~lJVWw)_7dP
zGntKDNWwK)j$HuMzhyfIT2aTWd6Yr8vXUWLl2c5=Q?@%<lwFK9J^9mfF||{m`<2&q
zu4+l{V-*l_oZ*-}^O=Zv73egVtX9yuEvbjY4kfplFe)!FVOCzm!nCgqGC!w&ZO#=4
ztNr?&E0Z}tuusooVwl|J#XI-d2@kKS?;GYVOn$eL0m8nw0CY>5jAQ3<keR!tw;Z11
z!^-(M=jWdumx)iOhchuKuV%OEak=9%!{da*=C<by$y`^tHnVMINbbJQ0h_gaFTj6G
z_hFC62^WOO`x}ZcXE=z5g2p3QO(8Bi{#@ds%+2=;{7zkR0i8EL$qN#;PM)CNc7S7G
zzijtoM)r50J%EC)?;HLtR#sTWpm;Rw&>SDZ{g7CI=!57G&jN=>31~LB^LW^yzk7F0
z-3z)Ary*_uNT=k{utQUPo^IVW)vk5!c8HzAtPTf3w_qhg`K6(I;q$DZnWN@qX$7F1
zi#vCN=9Prm-E&32`6~JGbq1yh65f66f5VK~zB7m%n#gW9T?Bp)3M|J$bUn{R*R`4L
zJ3|Lp4-XDK%hO`qryhsu`*58J(=J4L#x&t9c<1C%@Gd9FD9Wl9A4d;YM9lc_U)9d}
zc7_Wm-9zHXRZimK`vvbdG^-y0uXnlRVh7&61amtmJ=cOuNn{b!+2iTyObpG((_<SS
zi-&>k?l@L9Jq)zw^jI0Id!sv}E61TmSD!;O4&6C)6%pQGJ?c@d=clKEN;|fw8BTYc
zjMKg|NS<qSWpwK~bm0(azXq#Y@{D6l!q>$ah0DLQi#`Uq2Q;b$u|cf>rmGOXgNkWF
zWZ|MK%PuuYoVsx7%(YW(*Up_2W@lhgR(SHO(Op^T%P&?pWtAhp8r_uDuKW^a|MF8=
z11zKU<=0~VB|nsPj{E}6FAB4=27ph;dyscqJd=rm+0)Zsn2Y6Cqu2BlCWgr^OZ<|>
zIoYO%fY>S-k_+B{sQ(1IJ0-Ti_V@Hm(5dk!eUultFe)z!VRX!bs!L5~;A8^r9co_Y
z$*?)~8pF2szju@0xU;_hF#p|S5zc=g6F~D?U%$avf3F?g{{F-MH!~b$oI{+i_J92i
zG3!afV_wc5$_nm`5Zhk5Dl3IELgbdjIc7!fPiE(20<WK306M3SlM&*prB3f3_+8u<
zpcXPMge~%$XPVbFuT;=DV>o!7Y;>a=qdVyKyp#KRk3wShxc%JsAlBse<@Vy~Obo*8
z&+S^>dJYR528k;7UAKXy4QQJB|DIv}a!^b`=3haoCbvJgp5dG<xt#%G!f`7R=f{1=
zeu45k%pP}3m_6#25LM|GNcMDHH$%1O=-2lX=B+}vC*2g;9(NOjJuuypZ$Tl!>>6qe
zIvE~RWAk>Fih|4mr7Y0BR+>*iH6ZA=Hn2+7RD)IzL3dE=3AC1SGW(Ig!fY)6dR>c^
z9X={6vHVk3WBI47kn-<+!TFt%4~rQB1VA+rXvH3=odWWI^Kx~anTJ7V{y^#g1_4mI
zpWJp#i_z`9fP$qW#7(M4H9I{(D^ekA0$cupRz!eocweBuMf52smx?DdF$gm|t3$$?
z^{w!AaRye<I!UI-42zjQGrXTLZzZH`1(mFzS__fuKz^(h1+6Ip`4r?51_98WW@@J<
zv$gyKt+LYUe7_)mWwIA53$uC)=tSXvH~V)Up3K_v&#P5D477gxSpvvE%IlxYy+5FT
zbyW*1c(o$LHK{K^@usZ*UFQ9Se-l8Zwv#99&ScPOC4a$fE3X4=$J7onaDZ}^FlXjr
z&}yaD<Bcw$Q-?VjT3M3+ePK{*+s?|+01AC!R#wUP0rPK^UVQIRKM}NA2oiG7#Ai6o
zOrP8yzABMjS>QVZNM??cF#84egX}X7Uj&c;Lv|9X-GZD8*}%}O<p#Q&wi9#{iFh>w
zgD^MuZ1E^iP2%<PQXBLf6axdhRV|EXLF4a`b>5(TKd`g5qS`=f!@%cBH1u!fJQ~#c
z-r<0B>{F1aco`^s)TTpZ*MrXE|C3DYX((#Hz<b_6dLia4oBX~Ze?4gCnP@XKelaAs
za4|vRLiO7F3G067?uYo(yBFe5t~-kRSG9<4hp2ga?frzjZ<6p*S@0+*g+OvGNCmSh
z>rIddD4)o&g3^qmAf)XBT3?j>eK`Y27Fqq#D<Bbc^`O}1J=^NKs^z`I0qzqnpcywt
zx5=yxcJC+DEe7w%a5%u*;Q<nX$i1KNZ=qUitLu9Q2cGv1??1xqZFFZmYS;Sy!~S35
z;h>U;{k(|t(_6dRzk*X1Xy@!?_OJh0-5FhzOTII_|6u<E)RLLp?tXfPbM9@s*1st0
zcR{5iXvGrCKSnoD>r`3c%Rgl$mjB8sUqE^KKPWfk{{XEvYIKo&+pNy=uUXCIU#p97
zdppBs^Y0AXrYoyF`KPS*<sT^jc(pRRv%0-s;Qy6bt>s^{D$766+4}LDKxF}Fmn*0|
zfcb;i6<VM?3TnUdo~#vRbx%%O&IDTX(tNb_1t@PYtGd3J3tC0=kJoK6`<H+36*gFd
zavdn=L)5W8gQz?Dv=gk3)g7i%z!IhsRMw%d-vXWS@qWSj7ofGBF!w|5frhW&$^@-7
z<a_{Hqx`<Xf61!$$3CF-ouIWi!feOxskOdW5HMfWp7{~9Hlo>;lL6uq)w`heK_&kf
z-QFvFFaq@&B%d<7m;3|eYUQ?Pw?OGmnALR~xR)`Z?+i!<staIY2uf+7(oB^BIc0)M
zr{?AC*Ui~iiA`>6XPj|pAv-HO;&wVvh=SHmgW?^uQtkZ$|68Cv!ie&&^)SQ@M>m1Y
zQeO1@()$T~N6^bu&^{E<9TlLm1yZtr>fy<qE6*o)a)~uB=VVBp%P!^D20G6V6q+aX
zw7Miug68)?CCjGBNl~!7p26q$rGd+iXwYh^_XYpoPiAM}0iV3~mz0y&5GJv`fS45j
z8q^a3g<*2U2O$|p&^g?W8K9OGXy0fkbSJDBBj~(1$cZ}OQ@EG>1eHdA#lfy>3xb$6
z{~2f&6J!U750P^Vd|x2{6jVwXr+;NAJnonQG6`hM&C_$7g|CB8US<UCw+-wE-E|DJ
zBeq|8*-M5%=*j28VeR0P&o6@2Ku$gfyJN*qhU9iwiRQZC{e-^NpwI(_B60{qLf&&{
z=2l3|EnV<_!n+mNRLVGl{4ET+@q1c31FD;D_A4*@$?!Kkb9-jg#=RgrN~0#i*QW^{
z4RICl<Z<P2+^hcH;rt3%DukCve?fJhF#Gcj1WKgepj0)vU41RAM1q-wT>3)QteN3l
zdL5L`PdFo|am>;eqW<}E?CM+HlYcE|;B;?vPZoR108-n$d^xy<X4eWbx6?iO^Ku4A
ze;HKTfcppFHIuDNS>1QF39}vf*X#N|VgDA+r?653v_49!O*|E}mMzuz{Rh5}Fd2yX
z&lh5A@3bvobbHTWprr|3!^f=JIv>>Dnatku53&ye(%upI|31NfX`?%&t;0N*6O_XK
zwKlhQL*h5JU0DIt(plGqo-1t+njQj`XQ0y(K<&3pEn1!L3+nH$YEAZKW$-%(DvMTi
zvMPhhbjgz)2R?Z=y245q$of=JI|tN@QEPd>LH_irR>^~(Jb&)@YyGO2`SX+KWY&U%
z2lqo(oPo}w5eDCow)4H=SxC78Ims7vCe)FCkR0+%736~Zn`F=8x|L*MGw4ih(9J(;
zZC<T+d*6S!4_<eVd0H<lr8KJ_{l9N&b1N&u<gZ`(K|91iX@utxq$Y-`0=0-BDwP|K
zBGuF|d5B!|R91#VtOpy3Fl7R6Q+gZ;>z{BC<VsXGg50nUdOIq!`qBTprb0|w*f{z7
zcYct1kPjEJpY4~y;=9RWY>XgXldrciDzR;veu#b7)Pv1)2-wrCcJx2!9%_(_LAv#(
zLw3qBs~-Ko3Tpqu#z*XD`#~$67O@>nRczk;jg1j>%Lm9sSNn7OL8sTE`UDi(AoY_Y
z+89A5O%`usoGjMH;Fu0Ns|chY6w8WDSNkjbR!zOwkL*fNT>@#VLT~W|kDateO=fjq
ze(%6PHJO=JPVE+`jk&4?lB$k%oC2*)D~Ru%=q`JZm@_r!902Ku=vMm+(Ouu!=$_2W
z%IDX5=K$=)5YW2a_Y>q_uIh|@+N{a)H|UD;G8IP9-IK~oOc<H9TK<Ca&SY^*hC3&e
zSFkWBuVG>EY71&@bbG(SZvTlho$kpjKRE>5li6RgwYn!u|73%%B8QDlT?36r__fZs
zaOc9M*0*e|Y3~`%Z(Y?X`Bu2~2*XLGRh@z_Atkp`lvAW%E96ckrKn}Cki4(z`QE|5
z9d;8bO#X&Lt6MV9b+%;Y?;Murm7=~z9^8M&fz>^^_c=#$lRD?$?@(7<fQ(1AUs}5#
zDLmdn!Xy7jtNUXqR?tb(e;^^%_68zz{@Z5r1q^NMH}^u!X@{D_eu;NKM8usFV)Ah=
z*6k3H<u@QA?)NOABJ39-BI;MZ!pvcWh@>;W-3q$DSr^`p1?7x=QwKJ8PIm*3<CxBI
zN}hI|!EnVK=j5L249v^f|2>vo4j%g!Ze{-mszE^c0yRGv9)#$AX4vDD+<28qz;Ru>
z;(|HO$=xs$o`Fq(>^Ba%$a7Jcm6fUE(20YL@SRnlzPRsM3C~sSrJ>1xpEAvGuNBYj
zXMGJS;X$Q4^NQn)M(xS$984$NFF3E7njCY0Ve{3a3|4J+txPjO<vOU%-PDkJ3v|=<
z=BY;+?rvvZ;m(-M%E30l-}DevSJ(j-kS<UyXV<E%apjM)){{S=QEX5flxc=5=p^ia
z&1x**T}RC7E`L|{F|TN6H2(IC0kqCnvkx>I0<y7kd+0rwO}^k;r9k`Umcsj2!tLMw
zgHC2Jn%>Kv{Ny=P=ea^LF19W<qp9nr$v94A6=YRj_x0c7*;oG|!XPyCE?oa#u}#yG
z{~TignK6+)`TI8pRCUdINB=di=wo1B=f}W&n1dm?`Y<D?{7mjlWnez+!FZA5arWW=
zpfL%^jVcWS==a_!E3o`gR$}?1titlAd8r3O@|$g3%}YBNl3!fqN@n8VXkL1PA^FjE
zE+5b4<s6L3&%d%wHWg=RV^!AJ@~inM2ScFqMGtWAN$1EPWxXqZl$AjJqm+Nj3L^iR
zm!D&p%+B&#nP<x{Wi^&R${OHv|9&^Cw*FH*oZ$&N6@+Ozv&NBMl24P_I3VZiDg0mn
z-M#_3g=1ZNAn3eVtuMbi-IX=IfbC-hjW9YFZr5v_%zEU{`-Fb5{)5|VLtnyk5~D|>
zJEQyi5Ap9nsT7o2VKw0U5AyKyqe1I1mmLba6LzcZnBTny4y~?rE$g}<WzJK^$*c_Q
z&6;iu?+xttBr~zfoH_v7Ri@PmIvXme^`KU=D614`wK(%~PKK``F|Nt1-<jSg_;;Ox
zmRd*uzBl;4o6QrnPY!bHj#}$97tk6>VK$aOjjrz#&QD&|0y5#{7hyJ+Kdr9s6V^|H
zh#dU`T7w8`fAvp<h}``E3ag2(?-TMTKtwM70ImF->H0pwzaJuU@&jn+`drud3Hp5y
zk)=O`*<AiEbbX(|-@B?MS%OsnbejXHJr61C*yg`4@L$2Ke&p|}c92VwqaN@*Jw3;n
zS)=6-X!jfF1}ad?9@K)KJhh#{F>Ui#QATDxmOsYn=?tJV#F>>{{($cC`PhH6AF_wz
z*h}MfHpb~344_rQ7p8-6*?jg4vd@F{va-TYCS|RcOv(y3*_4$ynUpm+nUz&eGApZP
zGAV0GvMTHBWKq^T$pRiRRd)gH+4~Jzhp()1l0jL?l2KXhCWErZO9o}FpA5<hD;Yqi
zCpDg4)#}$K%zBcoY5J-b-lxK>os91j>RMN|aK2>obleIWhg!RJGK<5(se3_ZCN&;s
zRt2dA`FJN-cHvgz=SLZmo!R+v4?aBvT06h&76ap{8|SXI-J8tb^3$k&TPGyM()y;S
zfmRi(_1bl=YEjl>`Jt@C^5gvk{yVGMIZq;1DciMz*2FifxBR?x#je$^>wSRyS*>=<
zvoZcl&);$1dRmx`<>#qZ&|1qQp#9H3nx?O67X<59i-N2thM1tNwB$##YReDM$^7pF
z?%z^8s=Qz&L$kWe50G7`YSmiB-9YWwv|E>2-*3pDx2oOsXHe_=fcm3a?T%m7q9(H!
z9NfA8Yq(u&Qv-;naIg_x&fIZKj{d+f$Cc4lS&5B720o7oDvx1#XQ8`@Yx0}zEaKBa
zD=*tucd_o8I>&L>^rrTU?x40BEUz^$cl#o9=;;1t_16C~hn{W+)oU_`j&8pbCv)iK
z{yA|nhc52l<0NzF=l161$38z4mpOECdu8ZJc<y~D3dw^@Prf&}4?l|^QhuE~)*x`l
zv3VssgYb7v24%G;zmgf)6()a^WH4(_p2OyJ>cp)B%TC4JyW^~^vgB8*n_f4I>#A0(
z&g9<fa-43-eaB5ILz5@5n@s*`$&lQ{X_3s%F4wGn<X7@Mb_1i%=H)D3l3%OaPv$<r
zw3)k-xmmsC*QF!Z4kg`bUe*4;(Nnmq`>WclWwV1?-yg8M*{tWyz`Wwf=jP>njKb_4
z|GU_e)4p3UtDj~}PWo=ayqx=6^K$QR0?t#Mlew;$G3&51Ft1~0NM<=>&b;1_q4{_p
z1M^}&h9v$&?8f==jKaan495BY8JL%Ke-kbiW_Z+YxuAKu_t(wee=sF;{WCIV{lPT3
zL!4nV+cJh^7G|dA^I{Cmhu9dJkE$^+A2(xI#J~A{Ji{T@%}>8FCb9eWC-b~#U_M^P
z(0nwFp*gIZL5bbB|FOjNU&$>0^ft40Femf;VFI0UpUlC*#Kp0h{RD&2)OFMKrinO8
zI0>>T>s|XNaZr%;@yz4@CbJ)4+RXlwY1wq<W$oWKO-<%vW@tWM%D{X)m0=P4&3@%s
z{}`IpyBQZAZ$2K%z<k`5fq5ApBUon5KL%#iZpMYItcTXMX|*@HPjG5wpU5U~7^Fgw
z{qf7=|G3zUrf!<rtbUpiG_(7@;oT&Vea4(WnOJ#FO<`W{^0j$6%Qxd1(3!&RjQk7&
zjG)kuI|915DJf>^B1DV}f0txHjrGUVuRj3CbT_9$vKYG*B0ke@W!=cT*1Wd;|3~je
z&&eDIm^ODvGEeS4{dw7JMla)D5yrUI_Xqy%YS!^)U|xRYbMvYrUz(SnVPIa<@?|nx
z`~NO>WgV7Z%6crnlHYt2X;$NAOn&iAgjvn^8?&nK*Jf4TZ!%6jj;-vQzb|J>?%poM
ztObgx9tP%RJ`Bd}?##{V-3-byTYf9^ZuzyC_sB10xhubv<-h!5R_*-;TFtNMwwd=S
zLtg9qhIft4s;3#|o@8EjhC#TsmjN>*&oH2dBsU}^3*!EPLJJg{n>&9pv2rb&$-Lb2
zYx8o?Z^l)xn3NZ|GlI^v1@&T-7j!}VyABenmtve^K{sw4`SrM+{T!$^zUJcQ$>#kj
zdYdPsE2w6M@j-Iiz&B=r!?~T4EAu<^a+WX9eJQ!gKb~`83-!s|3|zgQiCZDL3l<x#
z|IIo-diU<-^bFh%4*#W~v0?BSu^X%F`-XG-o7KG;S-Bo3{dxv*BglS`TR`pxxi2YZ
zn`dAs$c3O(@^2xU{@u;$+)S;Uk01Oza&tRKA4pGWsP2A<dtH;nLqVe(tp@KO=shkC
zg{jco59;fK#!03)E=*Tefz1C1x0n6DDGs_XNbMA>`?{9ohG$G3k)0lTZEhW)@r_+=
zGhN>Y+@H?+5;Tj`d;FuTxGQLeT(#!C!TW8i+8NKza8P8OaTv71{>EX@SPEpfFysa(
z$c^owQt#TKTL;?Cf$qZ7>R#6cG2?0ZWL5{k_Xhc!lG$0^E**i))EraS>blk%)%reR
z|68q2-h-D~A*xwR-y7&}R`UXd7U;G!FX%02li7~^g6LeP3ei`;JeiMG0)OwawEtrN
z&3<KtU!Xg_nUjmZ>mbZggPQYy(cf_5da24P;CT?JJJggR?)X2imB?PMvf3{Oh#%7W
zAbRD`PIXUyzuW|LQ(&#AveGJsWG+^T$t+yVt_zq|S$;RGyZk=cfAlo7TFY<H&iqZS
z7yHj1e*dBGOrx7tTe38(K{MziF7=k*&8kO!3s02<@5|r3eK~_)+uYvw3;vx~Ub5sL
zvl`3qYpufUM}BQ?KgqCfrt+#I|4y|*Tym^cd7a6B<uzaaf#PERsa37aYDa#lweCEa
z?8Bz@zF^-G<wYw0m6x&n1D$os$~n2^2vc&!PtYCTzlGUbetWfnebR9MJ*em0%l0^w
z^$Y0MIAKnOgQi=PrP$O!t02TpL8*x~2GX{2z4lNX(gJ(d4QX|`^+I~3=`G3%tN4_4
zqIi|{e(@+P?c!5bImM@}c8gD0;}xGUs~6Avfb+++I+KN1`6hFLe8uVs5>?hv`Tahi
z|FW{qD!x^ng-1I*yxLEJMh1VmbzEzo>8h*-l0W}atCROBC`=u*mDm0J$E@1LpZp@7
z7j)LhvDRztpd85P_CCP>xmIWBS&;1efcMuu7l^xo$G?j~A$SVn--Q3$LE*HjMe=U4
z2b+XfTU0A3G$ylw-1NTT|GmeetREmbG?nRn!M-_KZPP<R`-fW@)mq;d+?)Pbl=U4b
zh9RM*tg(s#6vvxd-+wr_POI}V8|xcTD8AhY3P+F+-v_+k0}^?-6O#X16(FV`{rdia
z-r~vNH3YvHcsG|uZrl#?A;|Te9?E*Z_&^~5@ma6y`+)wNTAi{VkyI%B5<sY!==we&
z|GHM^V<FZLFg40bzXTpXP5;fj{N(?~6QBQ@>H#h@enZTh3pzLOidN@iN!B;a>PLQ0
z4i{%=?Pl#(=J+MBnB$ee#ly|2Tnv!B?P~r|^u5CWkE>c#&o*mtF@W5-to@<H<Qp0c
zZXFQwrh?2nFZ=L}14Iw2iL%Nrf%gjY-zlrD5|BK~tkxwkxwVDieL-FCGH97`)bPE+
z|M#HKQS*AZ4MZDty6zL^bU2v1uQW1t8^|8e8N0lDL2_zdq1!-ZBxs&xGTV`VkbL0Q
z@IJx+QM1~Se~Jeux+l;0#v%hhNu!-n_(nVUJ_FGC{tKaZ68ZLndJ@TxzcKA=YXz5y
zX5iH+6HomOe?0RWc*RPm8$|46*wO7Mc7jusTgCeX{@WlsWzSA@Po6}yoo~M}>}vy+
z!VuH{hCiP5?O&_g-|Z*E-foArfwkJ3-9;IhU0E5KJ<J)K-P9SASP!wE>|eyT`8hk|
z)&9wB1x&22$zQ)QF}qG@*f+J=y`6#CV>?5$+j0gc)<^6o`$6g!v0d$Fbxr=Z9Xv)0
z>Yp~d9cO5Ez0Sbw@twhLTC@9ehDU6NSkLxte#XYQi2ZKg<2T3tG`q7iF}sR0F}t}l
zFnfeEFgu$wHM^=aHG7mZJYr{dPiJsqjqP>f0F6U}+Tx(wlNYgq?DOpfjYul7n@zph
z4>}(LWFsi#U~7in2lRhS_Ge{jJ|4o@e9VQB`B(`f^YIkML+p>(uJ&K-S7N`}f6z7g
z^H&z;<1S3i$3mExkCreoA4_3MVn4(d+V9z~#1`2HJ|Fhq`w#VRSs#LGJXiPR*5{y+
z3&A@lK;a6h-6BJ;?hgz-x<A>EjjP%HC_}T~RR(5vR;FeTQKn}9uMEt7PZ^l~O_`XT
zRhbU)9pZSzp2Tk4vD9Jn^XrVp>Eet=Gd4f}&Zxv^oc^3qiFvc#35Lx(mNIO9ew-21
zC*Azw2IH>j$rCu(lHakj8n=IANX|OW!tCzK!0Zvq!0cSg(Cm@Q;KY%{4oY<(9g8@O
zJB~SkOtzbmoW{=VD5%%IX)5UcSIE3KZ=W&ib%yr^=U#)t6f)vf7~0eTTE}8p2-;~5
zn(qUhO$R#XH11pjL$f<5b%-*qYH9W`Wn^|$Wpv_r#14uFa4fK{>pIyl%-P1Yx%CT!
zaBCOSwoYTNo1nhTpZ5iMPq(u(Xeh7v#n61Tg`xS_6b9yFTNprlm=Cc%V!hhCi2Y*k
z-QHzW{o0IMwHV(Q<UN`k-pME|*2%b?`#;0vYn_a-eZr!h43npKGJ?)!bj%j!=Kf$@
zTFSWjYboQ^e$bhZldp9$7*}R8g3iPB>^s|UoTkQjwO@J3DF)?5znGej9${!cc7=iY
z*cXQ8<4+h6_JU5Kz1wTt>czNh>idFow<d>mF$#-!F-#WkVl*x<2bmt##b8{O#dx!S
z^K*Ab<z>GZnvaPvF&|@LVm_|I)O_58X%XASJ}36j{zssG!-8K-ka1tcs*6wFiiwa}
zDbTzM<Yx6%Et@*cI^TbgzZ>|n8I=A`gfKN9JHo(x;tB)vxe})4qbW?xhrci|gIvq;
zh~0?;6wZ&>KzRq0E*7yGvspTBewN0d#D2Da)AXBto2J3$DI@zpH+F+=%@Ur`#sEIw
z=UyA*!Bo)5|H9_YKQb5=HW^oBFc_yFXMEdloF>NjwhxqYV*56yUuU>*;m#3A%7&d)
z2pXpZ%|!W~3pxWDuiVvX)MW-b86{x-TdnqFS5|?rQ&A_Hj~`)RK6Ztn`REsh=3`G7
zoY)?*U+h2I4=NWx^Ho8uo4dX+yf5fm*L<9X2@-}TOwC7Cm=3W$Vh82OMXXxgcYA}{
z!dl-4{BHt{;3OX0%pU64=#_ksT>_MLm_cdh=oW_NV@p8hvtH~y*}I7CYVWS8li4g8
zmQDRQOL@UghK+2DZfdQdQP1}u?!N%d8f&#Di?E6?uiymV(GEHndOHULv$BE&<HbJE
z7!YXxx?>th9&+~4!sfGmAN#NNE35oq0G%%iI%iZkqLZ<CDJKIcwY}^ErF`SclMGk;
zL1&EKIe5tndEIW3msKlh%ogNR<`W{|^v8Vk3Ip?D6DH<kDoo8Mpkc%cirGi3CwoEW
zDY1b{+;j%e&F~ldulDYnI+;zHVcAr$Z@^=@U%;c0??3F{>G=?x0*{I?F`s~hq7!Qp
z8|XAB&pyzN@{3q~`^=^Zhqf_J7HwlZ*()s3#sC`ia!duCm~LDl!3etdS+Oaz4|Kcs
z#a`pqUkp7L%-SwN!mZ%ka!|N|Mu}U!9$#jE0rH<+yXF4mnOqDYw%~pcsnu?{9TK<i
z3-~62eR~Y#TN9?{V=7F@Dd4X-=p3lYVXcgl#altSO01P(JL`XjgK3J5xqXw{*gjnB
zFYP_qKj#7{-a%&j?gh;!A(um-ebDQ=Kxxma8+1!>{6gF-oIvA&L2clD@B#KmSG6na
zEcpXE)ney)URF?AncRAuLAdPb|Bti$T0!TlgHG*#|KUIQ9s$s4Uc4_ShjlUvi+3`H
z_6v)3GJsOZ!8B0ZXM$ZD*l%2UlfgJ$o$<zDWrf`gYxl2enY;gQcrxc#hT5N?@$`+X
zAo1Sqr`jOy0L@Ij|4@JWEPU<Gt`^W)LuQ@A>_`4BYkU8}{^P3li3boT4MA3_fWjBF
zvRkd~RO|Z!zdlgBfaU~1YjGedP{RonN_t(JI=6LMf%52w|9z|4CBgSCg4O~+ZsD>6
zpX31wBfqvw;M2|jZvuso?pbEFBY!7z9A!{eTJp!3U5#-vn>hn7n_6q(tdFyfwJNJT
z`J=2R0y-OH^Q!jHub>-jK)d!qp#xq00LoFKpi$MAz04Xe;4p920G&U|_Cc}vY#-<h
zPf$-lS?L9X+tl|3evQrQEPr~pL)-xhqf>3~KgjP~)o%F}v`zywo(WQK$of8E9%v=s
zAKCqo@`yo#?HXiu<H(;?E$=_nHwYeugbO(5skZzD`-SZYX#G;a|0SzhL818bt}vS^
zL*Xp7Rzo(>y_NTuA@rbzW7Gw3NOl@^8Fg>#+|~uML;n|gNHRr(%Jy?@L2aPbB<}<M
z_a_Ika{Uc|Ec^A(saDWgh@jJW{X1ISwYrkUzH%^Yf>vD~`3pK3_I<$lwo=i@<*WWR
zA4k-S%*U62>L+lC2x_C8nl9Y##jtGp<jUj!)mrzpPHyXDU~~hW0Q3IC|5>^}L915G
z*%=u9+9tQSGt4*)UWb;j?`2rqEl|uR*nw`){A13}z~t3>Zu*VGjoT|jP51kTs_uuJ
z7^rrNL10yjQLD1bk$=i+TmHRIsJjAL`E}&qsy5Ktul?^J^#N!-7G!?m)B(SHQ8(hQ
zC0$9o1UmJh+1-_4Rm-|gyPjtEPzIyUechm&4(z&{-Aftv^}KiZe|J?I=nQqW)~pLb
zcisoQf8KoDg|Ycq2)tGHi2V@T)qW**P%qrkU8^^__B&VeF&8H0;~`AU$4Z!*kEbv_
zVsm1@*>|xI)OJ)>yYfevOO`>13sh!-O8YCn-hbe~48HxFi&ZG>7V~iyCT3V^bX<ig
ziQS1Uu-~_T5qoU^WUh9mOS87kO7@Cm78dJaoIIVI@nZkx=hGR5#kv_T_Jdk6o7*E9
zlmCBVN&dT&WpjHdqj8%iV{*ke7SP><OtD|XKyx6F(;}RrL8nDbiZN>i&4eURc`gK+
z7ix4<_1XqX0ibgN9qeC#<{lnPxc+~9mF-JX6jSWM?dMv9+CVPf^6UMF^DjXC@-WaT
zF9~&*K=sY!P;eWF!JHjbN>+kPowMM!&P8z9V=n&htuQ<LT~PgF&c-0PosB^Nc50yV
zs*?=LYi@$tJdDi8jxaJGf5O;&{0k#WOJ&_p28dr8-9-1RwR*LkYkeQkKXFx?F6h?0
zKcLzI)anwR*3Kw=ubokNMmqzjJQNP@gtjG&(~dDNYzEgQk(~_2rJ~^0>f3(Leozf$
zT)C40)S^&lG-qcJR9<wF33RKb@~W2%Am5+d3L<ZY<?aQw*<n4b_W}8@K(jVS{xzOA
zWVM@W&d$J+{B1eIjKdSzAHQ4v53x=r`8X>ZB)|GyYhYlz2TFa)dMtm|weJIk`CrgE
z<MFRRb;+uB&;G|@?EgTk<3J?}s5U*<`rg6*Ff`||Y;HGqTs1wp>?;F!bU5$pzeaaR
z8*Wo1q@)C$%;X4NGYUSN^xbkMF4pPhpta`5AA?RM?L97T4my)rJ$~2p8P0;|r;CH+
z*dMQ&F5o`LS;U#uePVwX`?l$b6?`!BAo`X^gZA`*c2!M0J;fce<7sL?=o|<}cZ42L
zSh1Z0<=D!TGLDznCtq=A{P;Y^HN;VPx;jJh!)H9K>3_v5#glWsb9tQzIwEcbS{3{%
z6g0A;)p_%{-?6Ym;2kwqpdB?@H<(pB8Puk}56F9y{9q*$jMw)XvZrPubWe@)0(Hh_
z^^**(ERSD&`LoG$l2@}T<V;1#m;`Iu`v-i>R<&@Rbn;a40+ki8)zadspwS#v$M*{F
z{({6o@-R6;*Y^SMK0<c6fK1=|Id}Wlkdxa%YC!W^sqlFmaEL!z&cekC3DxCiS52Sb
z3<>>oj}G_AtYQq4uZ1$Ox_7Y|i*IL0PF}{qG+~Z2Yucvi$RW<^-slF=#qP>90k%U9
z6#l~O&z%`KWSm9Z&Dj+g1le~@FIIQ>C@glIVbk>FWYGSY8Q`-fLF3BkvB4l9;|f|a
zyYRS-<76>)hKcOkri0W?I4tAJ%KkX*`@gxz8QmD&IWt;aMI2e#Cx?eK9GV773!A{|
zHcxxXFy*j}t1ufI$K!<W|9l)d91-E#H(^z~B<M!Ve~_?zs`p+&4?Ok?3QyEsF4NUO
z>m1zl(bqY+|3|EIaQ_eLCnI`&uvDmd5TZLx8{0YukO|L_);Wlr^f_wCin+>x@obDE
zVpkwyM_*}ZQv+xXK~n?cSs7RSDnM(|Kx@)&_HTTx3BOk!+H306Yc=Xz*Yf_u{|}NU
zL35>$5&^WvY!i47mS3y58hE}?ep&1L3Hi5kKZ0s7`FDjsLH1t+uVw(18z}3PAY+aK
z4_)62>_26DR_zv}`>Gbu%(!1GcpXu}{3W7qo7GzWLRPuBD?-K~+j;LCnQ}mRkqYCC
zBf_mN4DUb0zh2eO`WCjT2UdE3N}Xk`kde)$obLth9|x5@kP-&eON5j$AXP8-PiA*G
zcyc?Vpw|h#PSClaN@qYj=|H3Ot2#mBUXU|Fg;^O`C$luzy-)bJTXVr*k@pF8yQiK2
zt=2ur4mtf4q<3@qPo#52SzR9@ok0&7i3g=2NZ18}PnZFfFQ7hZ&=JVpQmeX*I=8i0
zb%D||XvVXRb@JD*{2SSO4#Px**#$Tcvd=i&=~^iI{=@z+t`D1+pZX7T#Uu8I?aAlZ
zdBCcdpZdR%9aNUUc&?rY!Te5F;nq|C-+#FOK^If^d3KIuel8ZZS%xdnO>SjLKETeA
z+~C5>e4GWma{{DdBl`@9>%i^+*#|fORqWlsP?(>Uye4^pS~M`%2(t^YfP6BUm4OB7
zp68iAVY005AUSlszM;O*)+lI?Y1pZ_V{G7?ttQVBWzg!J{OcG0rtWQ>yIR1es2>IU
zKOB5kEGRUExj|tEIz1K=diNhBORx$xtDi&-zXR+-5d9~?`pcpEPyTlWyQ$MvnDylU
z_aFY>NtR^g!_a+@oe!pa@+&C@Pz=Ca0I~;SJH&+hH(Xz0(a*K;K&zK9w*b>*?g>oE
zT_Nl+^FXne&Iq^viY{39MraCDZurUYSEQBm=NFiIln@5HdH+S(w=h{q2t!)qOp%{F
zL4CkY-k`QTOa;ika)f<nJ#Pkv9^CI6`f)q<9R2hXC`ZrlwLOTLqw}AOJ_PlIPql(_
z?wkX;I)rjA>$&#=_C17hE~sw;N(-Pp#h|lR86-A!nRV^z)ar!z;^==y_sQ+Y*`R4u
z{pkORNV$pCeRA7zwi$;yK_>+lT7q--xxWujfMR8GJ3BOFL3w*(H=;D)bbWX~>O|Zz
zhz*cf4QB+!8H2!NZU%$oMozZm?nrpN3AeK|Dl4QjBHNPpeeVHGTNa|(0#X6X+sX{T
z82(DKay_2R`OC?BlQ$!L1@b3P&^~75n1k3@&RDq}q%tt{=6+B~<8=bGM;KJnfLb)0
zI<-2@x^}_K8dAf_@AbhmAomdnrvtE1g1E_?@lvO7`>+32vy8hV8I$|C*pNeo@7YQ$
zp@JUv%*Qzyk~yrHVJ1&*V`rRksFm~a?9AV~3z)nSWe#NTFTB)IKlxucom~N<9@*Z$
zdoQmL_6w6YqiZaD6dzJ2J%0tMqn=;qIT&$J=IHwm@=c)H9#rdt>Uy<9pnYo$9H8Cf
zp!5FUJM23HZeKlL&ID>R-#g94I$a&qc6B!cwQFad2DOiv)t7G)JicrC9p{;cXE;kf
z2bl=FwegIzSL^!;?<XLOfnpa_kAUhe@EOVuamT>6yau1??@)IXX3KMZkS%l1Lu_$h
zBYIj{Y05uk6_x+Hri1n)b~v|s@VZZC2c7Ki@(;9cai;5ggZt}YB{3*0VQf$h58@XV
zDqU5(9Cw`UdeB)0$?4Wi43oQ8FKb@T&9JJa@x7v}vfh?2?;Y$;DKA(Jy6xj@G7qZ}
z=(Z1+Z;Wp5FWg^~EW&EC&{Z7VDp=b0ULgPEs+MFfRs&{Lmv5k(HYT&T{19ei`3`c;
zL|0`EmT&J3_Ak@wN|pwdzbrpNCuVwG^gADRI_l)E>2nSw&tvCn)^holboAXl$Sp7L
z9pbiv!{h042Cvrl4s}~Vrhsne5Z7U15a#KT1K9&IA7)ptYgp@hgZKr>lB`;wyDpOZ
z*oA~SU4AxtsxEl%P`81LHEF7hV=Jd1XYX<5<=hOrrt=<FUJ%ZB<S<zE_n!jIx}2c3
z7Y_T@u4>O~eO&hY&$n1%?t+7J9FqIll^8wmI6zvMt@W&2r>6Hf7jnKA(BC`9;c?2Z
ze_B3`r_aFTYu^j3-yPM(75U5amY0|JvQ~&b)|&SM`nz@oXobuQ+2tM7n&su2*woO<
zK6$D+!`$93R*0&lmG1@ex12bzsvUG2`3wg}&qgo7*JroBKXC5V90yj;k6g(`KY8vr
z9CU@MFWcN1&iGzHe<Ns(*d2#cZQ^F2Io4;!#_i#Z9L@(_D?ipsPL{M}*xae<*u|;1
z;EuyY$y&*C(|epDCbSm47g)dHv8%%WIS#_y4hLmH_w;^mRyzW^1w`Y^x5u;DUO-eX
zZF)Z;|A$t$;L*wKsSGm@e~Z1kb&f;lb5MRzUc}x4QRUkBULgNJ$e)Z}urSc_`4)@p
z>!hQg`2KoYS%u|WqbF)ywtSlij?4MYTHTL@SYI@&vizKTa`H4whRtnej$LfRY%V_=
z-3?dVaNu!jWjCAdbC_A3<!3ABM>avWeXYsgo-@pFc>L()zkRLDI!Aset8Dr9Sb*o(
z9EZ8D6BjhAyL>O?Y3){K`3YKg`dwKKL?8LCtO24y>-s>n%MZ{>!#NJgHNROvr(w+W
zV0BNL*{tr#07`MnYG1wyvmN<1nVsePRIp3m|6t{gy{OfFb2rSt!dwmq6}N&&#=VG?
zpyhLQ_q%(RyPLIKzP-CAxf^r?>CxTaVzs&pcO#bwpq}oWU`PpM*ZJOIUJE!cyoHnv
z`<h{8gZevA*|74kxH_n3-JZpI9&|s*uIZpM0dnWZWcDNA8$af{zBlN9x2lElDQMR+
z(@ao_fY`GO;!S2LIEWAdwHF{G%b+p7RV|QQxvulQ!@1vJx4Z=3yyWoi7tAf`PghOv
zab9~ClopzoA5UC*df(JLjuV^}&)sombf3sBxgeSSILj1gR`!qVk7r-`2RgAtS!)Vp
zb+C@fU(nb@ha+hJH7JZ>H!>}BeQ&`37_!$I(H{VfC?a^Jp{RUNDF+hS3|ifJhMg<)
z<k?f8vjR?CXplH}?$VjIYi3<W?VuH&)6GDuI@wqtIp!FvR_DG>`0CCC`+bZjLHp++
zyXQfB=RqqwmtC@J-Pgja%z9A9apUnj?hB6xwVi8inhsJ4+i4F{+vo-{_1QnrU4ic%
z^gqfT^lB9s1NFVsf|j+uZ`j`~d2m`t<$kr+i<+T7r-gvr?YMthNNH&1c2Iv1R2zYI
zy54YXbx*$VoJqoUj%)It=L{T&Kr1$54&8B;IR>gzKs6WgicJwm=H+ewA$wf{96>j@
z9A^NXxX}4@^6~HgjlVsI_5|AgPdGf09nu>LaAb8i7C+8#6MV}QNWUPv4EVGP$lNE)
zEu@$Ya~mivL3)#Fw?Ma0f>P1>|H<yGBA`=<LA^*uH?P+B3GoL&BP5`B1@-x0JFzFT
zx%?GZ1C?lO-k@F6?;ZN@tZGl@0NwTN0@^hx09FAm^VD8~RJ1t1cksWps=e?eXm%z!
z_yOMx=gF)L%#hM)sj{-#lRxhn?C)uHRvw*vt%VVEL$tD*DI;h+?`pqe>f~uH44^%X
zp!uJL4KI7H_8;vB-6S%3nmEJ0X<clf8_+jRQ&zYMT4(ZCIJlirSfZU_vRFGKXrvD`
z<EYpSnuW~l7iME)?P3q@-!xrZl!-x@b*Twttxnr(=vtkp$|@@%E1Q*mGAJvZWK!0<
z$so+y$?#WaRm)>;)_13%b%(3OdxrXJSGR)v>eUKKS#GyMqjc*}uWD!f`!(btc&+nE
z_$?O#j?L=F{x5{aZ-^tS`)0B040rn=ZLnkig*)0Alof6;z<MJgj>h8G88$zA&d~W(
z*!}ze&1I0i_8?O>vQNR97MhnI`w!C(OF_nP6O3UdfK^QZn*d6yi1Yy61qB%c<C@HR
zfayKM{v)18F?u5j^XDl(1<e^j+HUSYAo*yS;z2h^tB(ESoD0fJR2X{>TsUy$$c!_f
zK1;3^o*oO>&ZkW88RQQV>aoDmzJz0pBeVMP|8~<0XA8hbyZYECe`{x)%>IFY^YrTs
zpd9wGA6w3W>7G2zoZ(^DuIV3VPi|*tnE*CNnEeAkDD*+$UI@;Co2Oo7xY^r7Ak3bA
zgM?ZA#y~7#7T>Lj6lTxAL&EHtz+^TC7D%Wa|AZN8feM5|t@ZtThW%@a4YlcFpfR^L
zE{riZ;`SDSbuVLsjJXA%>@9Nt_gETv%nkS6BGH2qj;x1c97Wud|6XU1@y0*CCVN!I
zvG@2C_Xx-2qU%gIym{g0YRR~^cF#OKd8;S`;yf)-NewEwn;KY8$~aDi=qtX?bi-d1
zr#?uTiqHv5Vbj_F{h!=^{95sZa06KB$uJ5=Ltr!nMnhmU1V%%Ej1bV()n!mEwo)j_
zEmg?O%PdhyOU%qkO;ONDEh@?{Qcz9N<YFi@)H4Se&E;Q^niuTksi0cS1>!3xD8$Fd
z$17j~An|yJESSlqprEf1AFmLDsTL$2A77)O5U&seGAq7@OQA-gMgc^CjDXmp0A|)G
zXn-uNQK*U6RH&&@KvJrp4l-RIWD0~C15z0SHrEDZ7T8pfMNr)!$LoV66ly?D)C4i1
zrp9wAD1fxb>(?mg#mDP|IW_ShjbOF$`d~^Qqz~j=sHed0fwALjxIlpf3fs)0!sLw1
z0-WIsR#T9PSH2`C3BP=1ZfX%u6%61wPAg9<!J`DMCbyuXl8~B|{M^LMJcYE(yu_T$
zs#FCmNd|0IK~7>xT7FS3L?v!hLH;i;PQ|GJB%hj`n3IE31p`9>%r3vg+*D{Bz$hzd
zf`zMbOHC{(ElMqhDNs;Qz)<7i7!;!5oL`z(0#{|FpjrxwQ@A;v0iFsjsb!hT2pciX
z2?0k8iYkyA1qTJyoKlY}6!V<(^NRCxQjyIBsYOxa5$uaB4{{uangHKWf@*?Nlk)RR
zP?TYq6P!_6l9FGZholNqO=)pKYF-MG63no44hV2YR)7@VZka{7<%vb93Qmc|h)@Li
z3KS;>6{<NEAn!B4)dho697G;QS}CZeD0n-estXEN@J~xCPDMnYf|UXm^Mb+^(2c}u
zo=0k80h)<e%>%1LH4$o_f<{SxNn(zs4#c?%8bztasYPX}DF~6$Vq{)gQEI9t7Xy;t
zlZz5dk~5GU3^v;d#b_r54TL#P3K}qD7=lXkN-}d(6+lIJSZYymW_}(l2tjd{qNkby
z4#VJ*#JrTmq7<+~*NT$VJdjdIZh^(WYehk7QD$yxUP)pOx;mH|nBkzh!WCMbD5R&B
zlw{_mEBJZ_J1Ru@xcYH1IDrx(IKO$i!1TaqSe`?uae<URFa=0y385ySD6>of#fvaE
zA=H2q9LN!HlQ7kQq)`I^Q%!(x0A@J>4oHMuAT{nqiFu_tiA9+ul@K?VDkNo=fND}y
zb&e@1MXANb3Qn0N#h^R@i4=qyUylG^1<$;+d}Md$lqzT#RHzzQRA?fHr%P&5X}Us4
zQD%C2Y7saB!Re(0D!|3S05?QI0Vy6J^#!z?FD^+eDk&|%TFisXd64gt^YhX&(@Tr6
z*9Hs>p?TSP`Q>>Gxv43sIjQLks>M1CdHH#%ptRwfn5U4JU!stan3s~1s*sysl&VmY
zk(dX{Ck3fRX$q-jsd?a#g18G_ui$I6FhJBo?NunLEJ#(*C`m~yNi>A!TZNFyf>bL7
z)f`Y82UN#^su)nx%t$OM0XrzMxHvOCFEvG>BwwK<BePfm5+a~X0#XlBr<!7=Py))<
z3a~&`$WMdVrkYa<G96rHfWs*@FEJ@66{ZkW{&RuFLH4GmD3oWGWaO8YD1h>4kwOZ%
zUIAIf0J8@|D}b5;X_;yH3TdS|IUoh4d61AxQOL<pP6XAGC8<S4r3EDn3=Ek$IjQMj
zvEq`V(&Q3Qo`<L|f<`C<LvChqVh+TkIr)hx(0ITqUt9u;95e$Ubu*eE0|Nutu(ZU|
z99YyMjAVcqgk3TvzZ4Qqi3J#LDJe=UP$)`G$t+4uhBa0}X$U1giV_Pz@uFIc(u`%u
zEh$UPVPIg$O-?K=PKBfoNSInFfXs#Hu?6R&oC*ciVi=Q)fg!gfGq1P=M3*Jz7%?#9
z7MCQJlom7OrWPcF>@O~0U?@stU??eIU`Q`uU??_ZU??_VU`RA%U`Pbf#taOJMhpyz
zrVI>;CJYRT<_rvpW(*9)#taO_MhpzarVI?lCJYS4<_rwQAaP3uhGGklIfe|yh6W5J
zh71fP1`G@(#taN4MhpxkrVI=vCJYQEW`z8~#h{;@kzbse$B<u;npd2ZsRPNY3=GAU
z#U-h^y2X$hT(=~(xP(C;6h8SWsi1JuPcA4eW?*2*NKGuzEzYb0W!B{UoD^M9%Rv_u
za>WdZc`2#IC8^07I*BF8#kr-Rus{+^H8wS1NX*G8&&<n9Ez&72%`-B{)J-vDNG>SV
z&CAa#N-asvE6FSa84b=0u>1;2lX|`pJ_@OM$@wXuT&bD@GCMOhH!&@xFgYhFtE8YT
zFC#m@sJx=GDjg&TN&_(c&cQ(ns>&5$Gd=Ul5_2+B6kuH%g|z%4h17}?Q1s?hD5RC<
zB}1583=A51r8zm83=G9dneoMW1x1;8C20ys8C1b9)W=65zqF*Fv_zq}qzL4)#Jm)^
z2&i?ESqv^cs#1&cLD>`R2GwGPg8bs*Oi;oGS9Q6G#n}p(#bEQeAaRIYO-5p|LMGG)
zpfFbeR|p`#sun90rKV@*=M^Iif{G(+f~ZkQN-R!=cvB(2C?&PXRyC(oAuT5{9h}TT
z%`B+il>AhP2Qm`NQWer*4K#=`AP+&+!5o#BT2Z0^N)n*3C@x7%2NmHdsfflFR6Q1T
ziO{+Z+%8i{PRvs;QAn*wO)f1-<zisaVPIg;Vqjp<WME*>&}3k!Of6=}%V%JKv;b67
z6p-8c5KBPLL&zg4O$7z8Jh)m$$b%vRTq`O-<iT}@YKm$xvK=7bLF;6Y8PL)JWD&w0
zU^PYQhEQ{Gs`1TF0X1?#<}e`H5d@A!RRg0GP<0HFg_@uXr4<-_trQqklRX(!lY<yk
zlfxNQlOq^Zixn7x^+T-`!0zT^@YT)DPf6us2!_(3Fd9<#f}D)-dvIlOP%5-}46+g0
zr-%C~xUx7HQZPWm1}YCyTAY{%YQ!XGq$Xz<Lu(Omo<b{d;by_(!P5n#E*Vmz!qYLN
zR#gDi%?ib-NKFk;K1DMVWIwdOS(2{+ZkmA8o&qQ?K@A2Rdf;sah-Jm`pur9eO_=ME
zhdaReHLX0ps60L&(u06z=tPBr{PNTyPz7%UZf@m(T3e93n^qnVaSW(1K+z0p*+8pT
zXg<%&SIAAx%`d711%^TqsPzlUT*Z*~02X;r#s`%c;5Y<@0VJ*!^7C>k;e|kQVjjpc
zP__*Uk5DK`Ey~R-1~=Wg7+`HINZAi+rxoNDfbE9_h=OXdLQ*QYVuU#k;wA;uJepsm
zPz);LAUPHqFqwG@MTvRosd^yy`+B;#`nbA-90^UmAV;ef`?_KiFEi9LG+<x=jWHP-
zLTMug28L2dngzv0Dy#>hkO%79XBI2u<maWQ7D3vGNu_CNsYTF=9@JZ6U?|Q_%uHke
z(WwQwpt=}bS*NDvfy9cF^V14)(?In_ad8Q_?ykyA&MPTmV5rK>D9B}CV5rJ2Vkpi9
zi9r-rfGe~DaOGB&nVghg1yY-wl%LDMP+V4!lv~2UP@Dp4|AFjGE-uQ<1J_l>xyg{m
zF2r7hcyV%aS~^H?VhX6@D=te+0acvExp@%#Gn3OYa|#%$Ky-02Lve9RQcg)x0ocvC
z$sngP6c@v2P(uXbH&Bqf1_fCugk+>DfKm*oTFA_U*B)S%3el=LrLmwWVF0UjgN*kT
zm*j&QTSX-b(W)S6kXcZvl6-~4<YZ8n1X`&oq!s1oDnL>o$W0)%usSxsAQ@D~fpQ^8
zbx~?!ihg-fW(jC?2i^i@U|=Z9EKV-dNzTd41GQ=x7>YB~GRsmC0wo!#i77hCmIem8
zU_~H%ki-(fg1WijwlYW#Vjik6INHE%lY*Sw5(5U+Vhv3z1q@#m=a$BU${ui-1p9_s
zfx}KUML{FLIaoDCQvqHf7MB(j<QJ7F<YcC2lqeMEq^1@qK#E)jqV%PJG@xjMw(Vh7
zA-k@iC_lX@F;}4^BUJ%3Qc$8$mYQ6WU!(_iXK_hNerbtrL1IY;Lvl)9u}*1XQHgGm
zVSxn$D&NqE0aP%7LpLkK!qC7#7o-#vX6cEU#W|@(I*A2IV4>3FB%O?s%rsDbEK1Ew
zElw=fDNfEz(=D=0G%!y$FafnyGZM2)GQqZil)>UHt<==SKsVU{ZaOqRLFR(h<z$wm
zR_K68kPrhyUa_H>si^^s24z=<;=F=los@Fj#DXNa8#D7tQgd`Fijxy_QelD>Ie8U2
z6$Qm$KFCO2Lp=inJ+K*8B_+_bRaB6hsS6s;)J@LGPtJy?IfOX0{hM2y$-tnWn3I`U
zoC<30G890%G7LGHd8HLPFdhR#a(-?>VhN}T2TQ++1v#0?3?Mgx`&-4j;Ib+uH3jO1
z%-rJ4WU!ftw3wHi3esh001g*Ox&;Xsz`_#50r^M|qyQ<+gTz7Qp#q}6=NS|Tu0<Ib
zkkr94L2-E|+?~+u0v1AQvxAH*E(fKB6mWO5m?0&z7}QCHlwXi84g;v=2vP%XHiG&G
zxtaN3KD0lP0v?fpcPrri45&D$<CK_}oXP;HP>Rvzb5nC6G9WWyjbv!|f&tX71hW|!
z7(fk3-Nd4FP(1-*r=%3Y#6kHGRL(;BG~f)Qo0yZ6U!Dr_3q%~&*MZAG`$W1Bx5B~;
zQr1J_20ZwnTavGvn^BOP3>pwlEh>h_FNz$P1M&kzUr}PYE?5XtZ)!RNxV|iAV1PBE
zVYO^YQDR<kP9mtE4$kM`w5yv|lv-GtnwMP3kX%|+l$uwfTU?L|_E=GBx-O_%1SPWk
z?8Hit{rTAp43PMYFR3g@1@*O{?giCZx=Eny0PD|z3Q$n|B3S`dn^~L)NzULF1jt;7
zzcPzK84YA_aYkkuXp8~G&dk>>&rB)F0IN$)*M+p4VBwiwnp#|<o0*rATA`biSyBuW
z2USui!ce=@i}FhgP$VFBBa1_9hluBu=IUmqfWjcRI8(PE5fnr)JCZXpb5e>xl|Mpl
zaeir0GB~qC#K6@wIMBiF2iHwdu~e8jc`2!7p#FbmE~w51*F4Ff)&&DYxMPr?r=L4$
zXiy=gD6<SS5mT&?iabIJY8B=tRw^WCfZ9o1kTxTzX{%bSi9D+T8lD5kJH%a?DLJXS
z;A$J;uHvLjc$d8(u_!T@0X*uX3yR4iT~Iv^Qk$ArQdFs%lUM>uHM-z#JVR<lW(l%T
zZf2ftQEG8!3X+=g#O&140%TPTp!B1Qa7i&kZf>bAIAJj`FzADF8fXw(7t*8!*^Mrw
z3~DjzCa31)6f-D86FQU&F3&>p^A&Ov^D0prp2Z3!`3h;76{Q8B8ZQ@=zvGKii_26~
z98@b9^73_a6G3Ax;J5;p>B$8J$qdPfd5MX6I@zgtDMghfsk+%l#-L)9p*X)FBRyXy
zxy;bQz#xeMnQv&60p}N|8ySELW~h2FAJiU2;+vQ-z{=Z_3`0{Ri1{UnMc_IXUSR2F
zf(jm_y4T#$&_EYdvY?9<R~9E1r86*q^LjBPZ9v=dp!SnOL2hO;wCe#XD2q!{i@<3F
z)b4_+gEX;lC{!(0D9(V+<Uq;=sA;MdkTDT12IMvZ$ej!oy5PP}u})$|fuX5^8OW2!
zVPFI*YawkmaNQ4z_hKYIXg~&;4{jSE^kjgQ>Xzo^q$U<;q^9U58i3koR<QmUIO_9K
z6jBl`4a|(e{S;8DDna-gJfR91r+_L7@bz>C%fsz8Hvu^tR<EX&nnT+tSlp2dnplCl
zBPAzY2Vy1z1FRhcZvv$mfT|yGx`mB3IfBN(6asu56+lg1(5MpwLqTpLQfg&jD9%VM
zN=?yC$xYNP$j{G#wk<&1lvMC2C<6niJ?<Z*0BNPd=NMC9qcO0?XF!0jBPd6ps#jIc
zsZgj>08{y8sYN-71;yYIWstkT1Dgm1pg?jB3WD3^n3Drir2r~3GE<8cKpjYhqS8Fj
zpccAXMC%zeb`ap}=;-1S1Z{&Ln~6}DmYJ6VZp4C&uY|hE5$sYfSlJ5BztH9ww2Ee6
zKx(HXmL!*_lo%NpfZGnbkm8#mGq0c&RR1I<gGLZ_Q&MvhD|K^=88Y+GML=V+nfai?
z4m6hmN~`GwnfZ_;o}UKl45FlM-Hh_w{5;*<<Wg*7m%8OCB_N|xL3S4uW#)sXbU<d7
zCFYcZ>xRT)P;(PBzM7m5Dq=xp0w~Q@7K8ZUj0Lh4;$djx9y+KI4JuecwLq+uLQ!f7
zhy{uQXuXIWPT>3iYEyyB!MsFp7^LQ<WF~_8xjC67B{`|OaDGx|I-CP4Z}RhCVGpWL
zAkE~A#Js%J97wsPoST$i0WG9KOi*PBDsN!zmBP~0($x6O6a~<LKxz?a4m=)QJI7~&
z2iYL?7sS08xv9CjAVc77@Zy~O5=aXKWG09g52_;+Y!q@cbMs1b6+rEs%%ap3h1}HQ
zV$g^pNE#Fn5OWKR5_MDZ^NW&Fb8>WxD~mz3KDc!O4W~q-0)#v)S{RT;LGcAGCo+wa
z4WNCGRM316XgXRq(<m9eOazO8#;rjq6f_zQaSPaw8O6B_3^0~1xYlA|PzEP5NWBMP
z=I50Z<>%z27D4RGE7AptgW4^5PzG`z2qdHn>TrV64!FS70SQ6MG+2F;l>sWRL4lxK
zkeQcUQj~*mcV>QWX$4%E0W{<l4;sLSrN^Yq_=4P0@K6{yJd!fwQ<6%G;vo}N@sJS>
z1_rPgh?AaL6b~MtgN%=Z#q&yYVG2QG=3p_fn)qT+yo1a=A@uM67NLLt?+E?-|3T>A
z|6|Jk{<|sv`){WF@BcL=2p=RiL+RiD2}=L|gJ=-8QvUaU22@>%^1uHeJ_zS2|NEbz
z{O^B~^1uHv%K!d@>|g{D4Il!<5@29x5MW?n`2U}w;s1Y-yTGlZcyJLBpOc>t9!qgE
z`u9J==->YtM*sdlF#7jj&G_H{EW>~Q?-~C4&%waJ07`E>3=9k)llT}I7(^Ht7=#!Y
z7z(WZ{Rd$VYX~i6{qMh#^}ql3tp5E!29?`_MuXJD@HeY}5H}Si7Q}-mB^Vf(vj6?x
zlK$`iy7Yhl52XM5e=Pmq|1;_T{$EP}_y0!vzyJ5r|NVcG{_p>*^nd?9r2qT>E&bpB
zKk5JeGiChy&yn%(KVQbb{~{Ux{!3;2`>&Ak@4s5czyCTJ|Na|g{QGZ_@$bJ~#=rkA
z8UOx!W&Haekn!(-SjNBqF&Y2<CuRKmpONwJzf9UF9>_4r%lP-dB;()zs*HdC8#4a=
zZ_D`izbE70|4AAD{?Ewx_kUi-zyC`z{{3H-@$dhJjDP>PW&HcUC*$A$LmB`6pUC+4
z|6Inu|5q~p{lAs*@Bf30fB&Cl{QLhV<KO>J8UOzO$oTjFU&g=xESdlQb7lVfFOd1~
zzgXtK|1z2X{wrnv`>&Dt@4sH=zyBtg|NdKL{`>Ec`R~75=D+_wng9L=W&Zmgk@@d`
zT;{+3DVhKNXJ!8TUy%9le_7_g|23Ka{x@a*``?lI?|)zBzyDJ*|NWnp`S1UN%zyuv
zW&ZoWCiCC_O_~4x@5uc3e_!Um|3@<a{XdoY@Bf9&fB&y#{`-F?^WXnRng9O3$o%*J
zUFN_4Uo!vw|CRagKSS2P|7=<R{_|x0`!AIB@4rOWzyESs|Ng6F{rj(#_3yty*1!K|
zS^xgqWc~Z^l=bhwN7iWC9muphYWHaR8%+bFX<#%BjHZFnG%%V5M$^D(8W>Fjq^AMD
ztbhMQvi|*#%KG;|A?x4&w5)&sbF%*ZFUtD&zas13|GKPy|68*D{qM^9_kTjxzyH&+
z{{5em_3!_ptbhMkWc~ZUF6-a_Em{Bm@5=i3|3KEi|Hrca{XdiS@BgK&fB$b}{ri6}
z>)-z;S^xgO%KG>JL)O3l-?IMw{{vE={_p>;(0~8ug#P<~AoSn=W1;{4p9%f<|5E6`
z|2IPa{l6Fb@Bfp~fB#>F{`>zS^xyw)q5uB>3H|q<DeT{Wj<A3K`NIDF7YY0KUn=b1
ze}%Ar|JB0&{nrWm_unY&-+zm+fB)^m{{43e`}f}~?BD-@uz&x<!v6h_3H$dyDeT|>
zjIe+I^THr@gX|y00}~b{&^V|H`}e;g?BD;kuz&x1!v6iA6!!1`jIe+I=Y{?Iza;G6
z|5aiC{%;8T_kUa1zyEu}{{24`_V53Ruz&y0h5h?~CG6k-TVenHKM4Ex|5@0-|8K(n
z{r?p9@BfdmfB*l5{rk@n{_j6m_`m-G;s5@Nh5!366aMeNQux3B8sY!`+r|F-{~_|<
z|5uU!{{M;m_n#^1-+zv%fB*TS{{0t;`uATd>fe8bsDJ;}qW=BYiTd~7DC*yTi>QD9
z?V|qucZvG<-z)0h|A44}|HGpG{f~+I_dhA>-~WuLfB*BM{{1hB`uD#o>fir{sDJ<4
zqW=BwiTd|{Qq;fyGot?epBMG-|B|SG|05zs@j!;bs;GbeH$?sWzb)$D|2<Lv{vV3^
z_y0uHzyIf={{6oa_3!_!sDJ+-ME(2!Eb8C?H&Oroe~S9||3}on|No-?{bz~(_n#~J
z-+zJVfB(gz|NWPV{`X%g`rm(z=zst9qW}FjiT?NBD*E4lhv<L*-J<{f_lf@ZKPdX&
z|A^>+|Kp<n{ZEPh_dhH8-~WQ>fB(y(|NXCt{`bEr`rrSK=zstFqW}G$68-Q0tmuFL
z7exR2zbyLS|25J7{%?x@_kTz9zyJH9|NTD_{qO&&=zsq&MF0DLE&AX8JJJ9CKZ^eM
z|3&n_|L>yz{r?jE@BgppfBzX`{{3f*`S+hE=HGvzn1BBzV*dS?i~09oCFb9Mt(brR
z4PyTNH;eiA-zMhYf2Wv#|2<;<{r8Lc_dg`&-~XtXfBzF={{2sj`S(93=HLIKn1BB(
zV*dTFi~0AzC1y134rJOLwR<%Eji!OoG%%V5M$^D(8W>FjqiJ9?4UDD%($hd!%)kE=
zV*dS~7W41_oS1+A7sdShzar+}|8+6{{%?u-_kUN+zyAkf{{24|^Y8zen1BB-#r*q!
zBj(@#doln1KZ*JG|5ePt{~u!h{r?v8@Bg2efB%_c|NZBP{r8_Q_TPVz*nj_}V*mYD
zi2e6pE%x7ko!Ec>jbi`(w}}1s|6An0|KHsI{lDS<@Bbh7fB%_0{{83h`1haB<KKS~
zkAMHAJpTPx@c8#%&EwyH9glzijXeJSxA6G)-_GOTe;1E`|Ghl^{SWZ?_dm?z-~Sko
zfB%y_{{7GJ`1e20<KO=hkAMHGJpTP}@c8$?&Ewzy9*=+jCwct)Kf~kS|9Kw&{x9+P
z_kWcK#BPxNqj+G#Vgob|wt4*fzsKX>|3e=C{-5yp_y3&7zyDV}{{6q@@$dfwkAMH4
zdHnnT#^c}rPagmN|M2+t|DVUd|16&W{&RW$`!C@6@4uMmzyC6x|Nbj^{`;@t`R~7;
z=fD3Zp8x(^dH(zF;Q8;ro9Dm(KA!*n2YLScAL04$f1KyP|0$mT{wEg~#e)}d$LE!T
z_8@}zMX8A?P%ik4hIq(+bMW4D@R<wokc~>9JupFm|NdtM{`-F{@ZbM8f&cys1^xTK
zDB$0JmB4@hyMq4xpAz)%|FWQe|2G8v`+q0s-~WQ3fBzdm?2v!|zl8kzUlscAKU?U(
z|0<#X{+osV`yUbd@BgyUfB#Q_<Rbq4?}_;Le_F)9|BE92{a+FB@Bcl}cv<AX|A)dM
zV{<#A{{24{_3!_esDJ<2qW}GuivIUsD;hG!wgNN;7ya*l3v?_6G>)<&`rrQz&@q$)
z(f|G@MgRMs7ya))U(CP%YBB%*Tg3eP?*<yzi23(FE9T$-XVL%u|B3$hzbN(Je;Ft)
zgVHcQvK&aP4l17qr9onCssH{@Nd5Oe1`j4AkF57v>c9WTu$YA`CY6S;4`en7!_4>t
z)r%|!VuRK!LiQv<mS-aIVdrjv(*aZsXiGs!DQG`Lett=OVoFLp(yl7-e(lVv)Od(u
zWPPyx1PtvA3=B+Ez-&aA(Zs;O&<0x5nv@w2+5r@wo>~$Q-Z=-}Y6ME=U^l|$igQ65
zdE>!{6~Ocr=R)*?7UQNu_uGQZgNYZV7MJFx#;0ZGWfp_>cVLkN2O5TXCE&%OpzzLs
znFUn{69es|0j)HJ@xkr{tASewaX(ByWY-U9gLnyOefYQi|Nb`|`1gOtfq(yV4*dHM
z;_uo2@BfDV|Ngfe`1c>OE<7Hxl{P*zuNbtT8)P9AgI2gQI504PXb=XmK^)LVR_HE)
z_+rrJ)OgUQ83u;`|NsC0{Qv*|FaQ7l|N8&`|8F1xs2GU(>;M1%zyJUL|L6bz|9}7g
z|Njpp`2Rn6T`kDUuKWM~*WLg3f5H8K|93!XkQg!s$$@t}f+MmhFEJ-Rv#2l)?((#h
zl6c78C~$g?PpX7&u4iCi0Lg(?vxBw~fzoY$QDr=I2{kxPg51CiB0zDK0olkBp90>n
z7!O`d4@=k#pnVsa$?^FGpe5DNeIN1QeIKBh0l6tJvxEV%w<8`J%pjXVEBP5B7#J8h
z_!$`)L1Fs9?f?H<ZvX#Zar^)OoZJ8Z0VLuRZvX!ua{K>(kK6zM+uZ*D-{AKD|0=it
z|ChM^|3A;||Nj|o|Nl>N`~Sbk?f?HaxBvee-2VTsa{K?k#O?q8Jh%V<#oYh@7jXao
zpUeIKe-?L$8jw0-@jti!|9`ms|NqJD|Nl2`|NlR8`~M%^Px#yj-me-DO5vd6!{Q5a
z6B!sX5{p5Mcu=8{pBE3^W&+)(0aja_S^`o5+q(f`$0KSnh?$_BF^HP(PUQdpdm{h;
zUl#fQe@W#3|4xzr{|iL^|9>yy|Nk`+|NmD-{QvI}@&CVA#Q*<K!vFu@6#oBzL-_yy
ze&PTB%Y^^`|0?YN{~clf|F?zx{~r?e|G!e$|NkFC|Nq|?`u~4V=>Pvwq5uDDh5rBl
zE9C$GQz8HV&kFhfKP%+_f2)xH|M^1x|4;B6#RC}zzk>h&e-r%w|Bc}P|5pV6|6dXO
z|G!7@|Nj!f|Np-T`u~4N(EtA(LI3|p1pWW75%mB6kHG)`PXzw|KO^w}|BS%@|1ARl
z|K|w&|Nln7|Nkoj{{OEC`2XJ{;QxP#fdBtr`2YXE!~g&P4*&oEBmDpW*YN-U|CitY
z|7ZOE|DWgg|9_6(|NlLu|Nl=a{r^9s^#A`TC@v`d|G%R2|Nn;4|Nq-c|NjT=>wxTL
zhzD=a1#QUymtvsuD7P@ar~-8ELt%VL1*DJyl^>wG6vBg$ATbz*h!7^3L4`VDWuq!a
zLtr!nMnhmU1V%$(Gz3ONU^E0qLxAWIaA06z0QIdWi7_yEK-nwA7#J#`>^d<9h8igQ
zh71Ek1C$M-Taeg2P_~yU1H%L;dzvx>!xShxLYaYK29#~4%)l@Q$`(*&VAud<_c<^y
zY=N@192gjOK-nOA4-)$W6U5B|z6=aspzI$^EDQ|H5OEe}76ub2ds7?(g9Vg*CXRu@
z2FeD}4oK__D7z<<fguOV4#{L-D1frfG8q_dK-n*tSr{Hb*&NC&3?M!z45RuO7~Vj|
z@ANS+e1NhU`WYC$K-nSv3=AAB5O?<UGcfQ#*&F&97zChfsR;}WB2ae91O^5PD0`DX
zBZCZ-y&#s6K>^C%(8s`_0%afRV_?vLvQH^6GU!0r9upWCT%c?gAr=M?C_6xig~12P
zJ|e`z5CCOA5Mp5nfwDz}Sr{Uq>?y)53^7o41`7*A0+h|b%EAERgTkSNg@qvpD!yPc
z0|ST;5)YAKVpswde=>!EVFi>OFol8P1C$*%je+3{l+7}Yf#DC7EjNvU0b~cr93EB{
z1{PLG7`jboU;yz!;wdsr3^Gvh3K=Gb8W?*9149FptuTXup#{nY(H%(a2~hSGRu+aS
zQ1%~I7KRy6wh9{y!yG8vhmD0{0hC?B#=@`!%AUi<!mt9$KElSrum;M0!^Xm}0m>F(
zXJOa^W!tc`FzkS`Q`lJ;_CVP^>?{lipzJN|EDT4W>^tl%3@4y$77iAMGf=h;2Mfao
zDEr=O28JI{_P*5&3=(XRu==%{fk6Sv7F)x>-~eN<V_@)rvVW{)V90>7AFX3xD1fq!
z)-f<lfU;MtXJD8CW&c~pz_0_#KC+&H;Q*A)v4Mf%0hC?0fq~%#l<l{Hfq{b^;+}OI
z85jhh>}4Am7!087m`w}}7Et!7jSLJCP`1Qo28IMEyJ-^xLj#m;x0!*V1Imut%)qb$
z%AT~Dfnfuby>2rD!v!e2WE%s+4Jg}d8w0}+D7$StXao@Awk_Kj7!)`lY>OQX3>r}O
zitP*x9#FQ(P6mbmC_7{a149UuEu+f9kOF0c=nP~wC&bJQP8Nn7Bz6guZS;_Vp#sLf
z&%jUvWhdQdU}%A|`5rPbbU@is4;UDFplqiH3=C7C>{kyM7-m4(aSs?6=0MqP4;UDh
zK-tG0FfgouvYYNRFsy;HH{EAo*aBrQdceT21Ij*kpMhZyl>P5M1H%z0`-&11!x<?1
zjuI2Y6)5|O5);E6DEosF6T=fI`;QV6!y71@MVX1=3zW^H%*5~q$`(;(VqoEdgq4Ic
z69W&Ft)k4tAOd9@C^Iq0K-m_`ObjYewu3SggASDKq0Gc!0%Zp%Gcnje*)hsY3@%W1
zhB6a_50qV^%)}4^W!ES(F~mUGEy_#`DNuHgG801%ls!e6iJ=6_o}<jfPy=NzQD$Oj
zfwDI!Gcoi)**lb(7^Xnk2b7r@W<c35xEUDcK-orej0_8q*h`SuE1>KoIYx#xP&P>Y
z1|;?tB=!y@_8uhm0VMVjB=!j?TWT*O!x<<WWc~#t_7x=d4J7s*B=!R&_7f!b3nca%
zB=!d+_7^1f4<z;<BsK##ByE7)#)8D=Kw|Si+3VyO83dqgka`g$wgeJe2FljpW?@i(
zvU9ju7(jeb{bIt+!k_~cf2Y960OEthD^!>mETG~C;+Yt1pzID6CI$y68zk-mWzSGy
zV(@^nx5P6s_(0ifRG1h7pzIa#Obj7V_6Zdxh7>3pL}wteLGA;)ft!V)04n}ViIJfK
z%D$t*#Lxj{Z{TKO=z+5DaI-K>fU<vZvoK77vPF1U7-m4(20SbbbD(S=9u|fLP<8<i
z3&Rp9yN8E`VFi?ZfQN+vWCzGSd$?H`wm`)LR2dmSe31ANRVIcbQ1L6OOblnB>?f*B
z3?Mgw)V$zkVR!%)pP<Uf0OEth|EMxCfZPgVv+%Gm{DG>upvuSq;)BF_)R-7RegLr*
zcvu)Dcp&K{NsW;K#0QB>s4+2s{03s%@USqLK-DZ#V`KpFLE;8#Obj4DgV+%~EDQlq
zHILL789;oHxPuxKLjqJhLXC+56fPj~8Xgvg5~#S6IwJ#!4-(H%V`2b>7l=KBhlODR
zR84_8BLj#J60cBWVpsqbZ%|`mSOI1Cs4+2YfU*~;F)@I`8l?UV4-3N)sQ58;Mg|Zc
zB)&zBiQx}aoI!(;frS?m4kj9m3>r|jnkFNI0hAr4$;c1_Wxvv7WN3i0rL-9tI-qPn
zZAOMQQ1%IJMusg=_7`nNh8s}!3LQp<2T=AM9YzKgK8U?GdW;M_Q1&i8Mg{{Y+sc5E
z!2-(8Ghk#$fU++bFfyb-*%J&I8A_n+20j*s3Me~-pM?R$2l=;$kA<NHDlTxHkpaX9
ziC<A;VweCGpToz(umsB9!pFh@(hpLTz|X=E!4GjKNH2&F5`Uw{#E=3NFW_fksDQFN
z_*ocgpll`+Mur9``;Q4DLkpCB!I+UjL;zwYh?YQN%Rt#W0xS#)P_~Bv3xf)jog%=(
z0Fnc_!9swA!2l|L&7YA0#0QJ3GckblfY>1dEDSzSHGTn%3?M#8JVKp`0b~}4T_C{1
zkO5V*C6JK;#0QCIs53ECK*bx>nHU<N>>hO{h7KrufjSez0x0`dI3vRnD0@j5Bf|+O
z+bE2Y;R2L>M}URl3Y0A&$ie{PgY0@Cz{2nVDt;uEkpaX9iG#||H&F4E1SW<LP&TOi
z`~qcz#D759pz`w%lnoMR5QK#D33Vn04k-J9IuirPZjkvZf-DR&Q1OO1Mg|ZcB>qL6
ziNORaULwN6U;$<C5Mg1kfwC1uSr{CkY!*=#1{Wy%h$st#2bBFll!d_u%GMEMVF-Y-
zr--pIgh1I9Vk`_1P_}?L3quT)9U{TPkN{;D2(mC_K-nNV2Z;@m1G%|IkcFWHDy}e#
zkpaX9i678mVpsze-!+$!VFQ$HF_)2H3zWTM1|!24C_8B$Bf}3U+iV^q!yhO+U>+j_
zsDB7DQ$UD?fkOxqw#()*GJyCX@e4Xk3?fkR1qn<H5>WOF9VP}DC>tcM0A>HsVPa5$
zvO(e+P&S7y6N3(v4H7qivL$qx7)+pSkhleut)a`rU;|}?#2uh)3tc7#7bts00uuwM
zPYZHq45$wa6%U!u$N=Jl#5wes7;>QEB|<C=APf?35Mp7dfQsuaU}OOCLE;j6Obi>K
z;#%_=8MZ*#2Np6ifcnfJH5Y_f7*0UNxfU}rfcPMB9X%!nP+uCvej~)f@C2%6(_%&j
z5FaFNqsPSX1uE{N$Hedl%8t=vVqg)5gnxk^69cFp4pOfm%)%f66_;4T$N=Jl#INWv
zF=#-=pXf0$7(m%S^q3eNpllCe76uRosSgomVeo;9do5vP0P#WMBKk}WEl}|*iy0X@
zplqF`j0~XuKS<32VHSoNQ1Omsj0_+?NL)dmiQx)VJZCQ>!wo3=+FnM6J5ctly^IVT
zA`pME9b{zSfwGehGBOB2**XUq8APD$X$Kh@ETC+ILyQbIP`1+{MurS1`_>^wh5{&C
z?hqpbC_jVT(;&jaPyrRsI?BiZ;)BHvm>4!d#XlWkWY_{_%N%870Ofy>nj<1C411vB
zOve}*Kzxw+90MkXFHrF}M;RG@K-p!-7#Toi1W1j5C<_CJD8!EsjxjQT_#p8Y222c~
zG6lre5oKXeK~e+agT#LrFfqhH#m!DIG9*CR7fvuT^g!7>Cm0zfK-ud~FfxG3Baq$;
zqAUz2pyEGHFfxGnAaPK;2vkmi*l$Ex7@k1YaGhdg0P#WM9EMB`GGY)nmz`u}P=K<R
zon&MHm1`h17Gf+622k-Irx+PPe2}<;ArnIeRD9PdMur?H`@$(k22j}tQqv;F!cYSh
zcR0<+0OEthV+@%XKxHL}y+DkGVFr>K5FaF-W5~pC0V=-bEF;4eC_CvaBLjmt#LZo2
z85vlhY=^Uq44`rrq*q3qg+T-=9(9h90mKK1uP|g{@PUdyIm^fp0A=%>V`PYdvQxxa
z7(f`LzCfIXAp<JjbCHn&#0QCgF=S$BfQp0Y79@5Dls!S5g#m;?>KBN!Fie4pZ@JIN
zFbB#Oxy8r;k^`xUFk)i302R;r#K>?3%HH*fk>LlFedjYH!yhQy<_jZepb$Kk%OJtR
zz#;(&6A+sN$`+AeVc>zX4J23?Kzxv03KA>~5>RoIZ;T8eK1lqJ5fcMQ9f)ls!NOny
zRm1j+kpaX9iE|h;F}Og*WsI2^K=m0&JVAnmAp$Bc@{f@L#0QDn7&9?cK*fEGnHXxI
zY@NT13=5#_X@40RmO$An7?~JWK-p$YObi>K><bbs3|pY=4-za4JD_X{Nfw3!Q1%34
zCI*l?ki8(WD^T$!7AA%}Q1&inCWZ%4_6lPr29Q}G^&qh?Q1MA@ObmaZY>;{eNl4i4
zFlJ)lfU>U`Gckbd2I&RK%Rt4Cu`@BKK-nO@8c;Tf)<I$uJzzhoa5Mx)Ltr!nMnhmU
z1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0q
zLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(
zGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
zU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU
z1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(6pV(zXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjDpb+7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7
zfzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fdK)GP+R~1|Nmcsfq}s@z%$;%
z(I*5djF*C`5BBwUamA~Wijo2h3^oi53?TQ8;*lEypmZ7>>>BUs=jG~5RBHYIAD#*u
z5NuEyF0L#tNzK(QE-fxd%}dcONi8mcE5*hD=>gdv;^Tx(8mkyP10w?{ueqn@r50r-
zV^u?pAQMzk1BeDW1k3<&h7L~5OGzz`FU~C`(#a6@1w^YS(pX%|8bI-+!N9=a%)r3l
z!vdjkDF%rbm*yE6Wa_3E>J}6b>nD&tkUb!pTDT-LHx*=-tFLDW2!q(za8X(wH~~8Q
zxdnkRHZ>rz%z{i1#o!rG48~v%79uIJ7;LWq0|NsHV^IPY$|%kS)4stT3?K~VU?GZ&
zAQ><uI4Br|u_yrxfif(J5fB_248kBbHVjKSp}qkOAdF27NGv5OIS)kpIXk(4Fo=x}
zCl?ez!Y?4e**PEpluWQGV@NAc0~aJAZsBeqj8zc>14B+~dSY@VM3w_WVI|8_^HTDQ
zz*3z5|NrL%v#<~;NhM%aK_N~qAdE!`Sg05hZ49o#!C(v)#6sj2RDfL<84=(M!dR4m
zg%}yYMI4wt6o{hyd~p0w+pUavGB&yttUQOgff>et(kxIKor0MI(+|@JQ_l+3zy_t+
zp)@Rg!4eM_RGb@1^FV1{D9s0@`Jpr{e+xqSLQq;5N{c{gQ7A12rNyDN1eBJ9(o#@*
zlo|~ITp<8U>$v1$;>n3Asd>q%@ui7H1oL%zVrFqpY7tRti&FDaixZ3Ei<2|cV0Pi6
zi!&0lOEQTvmZ3N^EwhX`=Q8AEmZVk?XDkEA{}x832DsdaEMAe5SD_2i0I~pC0t>r1
zH8(ROzqlkbFCB|4s*uE=|NlW4Us;H%gMk55Ho?jzWI0g$gUU5z3@i6Q>OlHH7*qzr
z)PS1CAPnMz<Uklyc7b|Kpt2Ff2Vsyr2!qN=5Dmg0aS#TTnIJtN3=#)nkT{42VNh8K
z!XP)`!XS5o^q|WV@)O8T5JvWs3<CoL2!refnF+!mHVA|K1foG0Bo4wLKY`2uVURco
zgZu=dK^P<s!su?J7a!z4Ty`a9ChBJ97E{nu!e#Q{5icsp&D4c8CJ8vJBqKF3MJL(P
zz(5z)oF$-R@JfTyKFoCmxw=KE#i<0#YnXaa{)Mpz6OHVrltfDdGh@>Hh08CA$vK&M
zCAztwz8$zxk4qtvIJCc<lZz`<+b4sH6(k)D3>hVa>o#N!q^d{Oi_8Y+0n`B)WND(<
zi6zP9DJ4b*L{)fLOhk@5EYfhH^n%QMP^^{^(Y^p_0;?~`FHbGXPb1iH0BJzNDGUq@
zAdDmg=A(-t%VT3B`>i<L$iT!%H#fNy<O|~S95!={OY<r+b<0yq$TSMsUD(Wri4|8C
zC+Fws7NsT;*I9$ACo|MxwnAv+v`JDS1<_6w5|;mq%OPVixD18m`OM_va$IT#gE%-$
zVFN*f!9fJv0BR?Nq%tvl{r5jVBbA8()XoY>WnuueT^drE7(o4JP+A7{pFwRYSicw4
x&SEHF0=H>9#2FYs?OIS<@%R7#`3wvU96$g6&;JI}NWgxWw1FhZB`_X>1^}jL`5XWM

literal 268312
zcmXqJVP)9d!pdOG$;L2I*O-Hq!I+hWVRI`BgE1Q?!{3Nx774~=5ms$+4i*Msj*h>r
z9{L&*oXOH08jVik%nS^|%+7x{GY30NH)3L#+|=}2+?fd^7Ma|X#KgSbiGkNIS?W9^
z^ExI5=Jibsa`WZpDJ#5V+{pC!P}09f2VZ4zEfxl0F0LQbqgWUwcX3TtR^Va~<a+EI
z^<SKefkBw-l|ivUl!15@NY$#Zoms|=QH;oL-rUK?V9dqNa8Mc9-J9Du8I0Mv7_g~)
zpHLvZnF-aOF!h^TnHa>`Sr~-bp9eN;v$HbmxU)9vw6lr_u`mcTEqc4Ty_?x?k~l8|
zgD~&eH^#h+9MdKl^D!~BIx{*OGx0GPGfi^b%$~z!%=F2jH628XvokOVv$Mb2%>K?n
zS>X|bveGAp>Fg{FliQEKnAxwa@`*uNZ4slg#v~M9>1r!$EkcP2WS^KSE9>BvwbWMD
zLzRWNAzeUO;Sm$WckC|8N+34KZO6rxRUR=Zt1&StYcMe(+jCV>S!)p!a=6M(e(YQP
z@!~;Y_7D8XDl-+0nNdSDnSq%tnQt@8<|bB#=EY77#(m5T!f||z#&z!)l=wFHF*8iQ
z*T=B=-#dmwe8&CE494~E8It%XUv6gH{P{7%=EsK_H$T42xcTv8##xh-qly_oDM(r2
zFyllfLFUI^#s4~;#F<$bgqf4C@G}@ND=P#uur7d!DPLw*W@gxYn3)NNA5R9QHc`D|
z0S5y}2s}4NieI*3ZHJG^y*vzz?#;`27?Ru487K0vvOo4J|8LCA&X62b%?U{XO=lq~
zU^9CTGbnZ;aa=6GWMa$+N;%;0Wc#cxU@*72wY&2;B;?g4iUq<Aid7j*eyXXiU}O+x
zU|^We%)&6axmmk;kuz)aVrJIO&6^!IHwQC`2ZMaYd|YmFYqBwGu|rb>M13(sfWX)N
zj10!DtPCKrVj(6IWsM-F&q@pilP_&znEc6zVe%p)hQC6_j*bkQKPfSQX{R6t<wZ*0
zgc}ciZB}Ap7CQyf_gP86MC>3)r`Tbpqf7_b4)GlmIw5sN?wryEwM$x8^sX7*FuP@S
z$L`*t1IG@XI&$vVr4!dq-8ysc+@lN6F1@<)?%Jmt-){Z7^Y7kgB?S|)<DZobOvFwy
zon|`Q=p=UDn3a*?eL#X*vw|xFvtlblv*J+(W+hfeX607KX62)d41q3zKA{4UA(0ZX
zF|o`VtSrqMt}M)&tt`!&M_HJ)SXrC3Tv?g5TUnd6kFqlBu(CDlxUw<pwz4(r9%W<J
zV`XpFb7g1NZ)I=RKg!;$#L7`TLCB<8$(5sc0+T_rk}D%eXfcC=0W{pG6i%O&7!1Xz
z7FM5?HkgQ={;agXMC>fc<jI$k7$$!bVt|ESgU~>QUMnaR4H2QpFTlXS=-BAU=+x-M
z=-lYc=+fxY=+5ZT=)vgO=*j5S=*8&W=*{TU=)>sS=*#HW=*Q^a=wBSbVA9k8O6S`{
zojfPEel_86dMv;7Qm3nj)8o@iFLk;myKH6f@M>zP4TY$K<VyA#Jcl8y<<mvnM4)W-
z=^=3T@@XPoB8NHML!6RNJcE|i%cq8Ti5!NS!^*-S%-TAc!x5Q(bP_6`6^-vY5hTyR
zz`#(<5FnKQA^sGI4Z`^b6S6@5$T#?q4xu+>Lui8n(?X@QZ0FTZd!6(<9&|M9aMVEt
z!OtoVADcB@nV6SxvdW%nUfRi~)!FFI=&IMguWjN%5$EK|(->G?TiFHKAI~`cPw-^3
z`bkDs_vF^+61*Uiq4)gz3l|cTdpISUmvgesac(@W*4i}P@?fj0xGKnJs%`HJ3dCez
zf@JSFCpWT7G)+(DV-<V3U6?h1^?kwyWn-%a49Q)bA|MqroRj(4h16P^rYB3XDuG1q
zIL|!XG(GU|bWIk9$(@}I&C5F(_!$hC8eeZd&dvnmeZ5_*>hSTsf`QNb2@^t=wZ4Dg
zVDZ?6_1i@EWR|ZoYOU`TCV0JPxZvNsoRfiB%adv2b>`)s43?KqO`qY+=(entm3_ux
zuh#bu6ufzVCUbHzG^=y5&2eu$-ZcHOAnT__SFhIh8w^|?OS66evkg9oJ{E<t6&wT}
z%d@@%iz_7PK9+>C878DW7KX74{2t4)z5%Oo*r5Gb9L8?&dn^cLZ&1*9EY11~X8Rq8
z?Lw@tKz1((do0WPqItO|!?ISdR*<VfE`I;ufT=L60qgsO0De#?=I(tg%Jt%o^Wz!p
zZw~H#%+B?u)m2;+6bnal-xn~{J(dHR2J-)V1p(W~BCJoqerA0v&-w^t?)wD-rjI3A
z9|^j?R}gTXE(r?p%uMA4D;Xa1u|5EaZg5myw36X5JL>~bNV2*u1G~iw9DeT~IG8_{
zV!g-DAi&(}uDs+YLoydEBs-6@x;9OJEX{hS6&#iY`j16f?|8MopCDlVSO6+&Fo8j<
z&G6v#tBeejTc6$#Kg!4;%(^u3{e%w^g}Xs6ZAb=%#RjIw;;c77EC<)eLaaByE`RVK
z?Xfu54N!_<+zz%w;6j;J8|PVwX{=WurX7uYKS4m`{e=x?U^NN}LXQPmuQaQBGPid3
zKAwIQWOHjAL~U!_`w0Pp5H?8P1Oc!f1_5`3xvl3Q@~rvqCrsdbf5E^IqNYF}p~m$L
zLQMeA`wJiRz-k-}xDjetPeIfi&3ivVfb0E*4LT4t4LS%lM~_3)wC25^aDn~(g#s<G
znhgtB5NcYFBGgP^eSg6~0~|UFE-)a}xE@BR31EJI;e%>28y6EO#oux7Jq(H`gxb~v
z5Vfv(?<Y)Pcz?k_`F%k^1d{wdh&;&u4R!A?7$`Ptc`{G_CB=|DgG&yS(vsP^tR}N|
zF+kLT{Krru%+2yGs8yJaf#X)|dxip=Tdfe;r+M!uC{!_Paj{;4iX6><KY^k0J;MdD
zRjtXqtR@h3sRi#REGU2P@Bkue)U3tI6xIfjTUzjb!h_QH6F%^*YE9;1HGqg7Eqp(r
zq2&F81Ds${J&0&((fbJs#qR|sxPwJ?Afl|r?<X86Y;<LHeQ)qVZB=VB2dfrDCbjte
z1cib|S4P+O1_7$8T9esWH6Suai{DRZ$a`<F!FE+^G7qa9L^QSJ{RD;F_W=_?ZsB2-
zfrzq}zMpU)yIGYJ8YZk|?<X9{YF71x@?FbUHol**AhTJu6DpEg@qWUBjAr#t2862A
z%DKHDbqeXtswZLUs@_jfNMqLGWPE>Ng4?RD_ZJErgrin5Xm!88U|=mAzLeoo>*TQ2
z48qq|L3OlNzMsI5{9fS#pH|m<g#y0Tw9dYuw$@aLOH*s#Pf$pFUtl1n)%Ct$gP2y^
zrB?B)pj^q?@P0x=JVX_%{rd?A;vjiw=5vU=Ys32m48o8y`9ab92@chubfMJ+P8l<~
zgx)7S@YL!~j#<F73>wp^_3tMnL``PxVuYBG+91ru^6mWug-B33@oK%)`hJ6hCd~d;
zkp1BxnJAD<f`TVZ=4r$G2@gU+G7vovj9@aZjqfKogm|^SUvMFN70e$^?<X(>gTw@K
zU}8s`-cL9X2oei`i?O!6pU@Bh5}S~=s=fELaQpZFKl@v`?(T<_8LZ->TOq7eF~O~?
zV16oiKS9Cw{e=VhAe|qQwA!x0>}`BMp~3sTKtUSJ)}>AFCnR`@Ut?qtW?R+*DYc%q
zfb>m>0+VH0ZI2mP7eHiK+aaOU+WdY3gZujn3o;?LxAL{_hOnOUZrluEx$>$)Sxb2o
zp)6LOryC)%soXcAtfO4M8zH7IZGgn=Q{(p&6dXah^%gj{GP=HJn7|0jt*j>RCpg&8
z-03K&bj0fb+cC963>@N;EDXY&nrzMLoD7YxH#sP|OmboJWOQ|8Y-(85@?Jq92-KHs
zUhZBq$NBNY<^Mo6^Me2`*6HFb49&~a8&*x9<NWeEvpOdONbj!c9nK*AAl;a@oc!Oc
z?upfw1Kto@o|htQY4GA=g^03O!EEuwYKz(-wqsrg7&un7fYLAXN*AX03JcsIdXE>(
zaZdiSoZ<b2hM;6VPNrscPPRGT6Aw2{S8IK5prEhT`d&bQ4a6>pRBL_Da3B^$He`X+
z-GQmQu)!as!a)b5+JG6vo)897_aF*HE=d2l-%(KM7z0Off}@F%3(WUy#~3(TUEg0Y
z$N+^6NHnr=(UoPFPF-lbcJADzGuKYtI&tsVqa)7_y*iM0uR&r}i(aR)){!5|dRKlZ
zYq0!M)?)dkti$q4S&!ux$Y<{r94y~YSm5|slfmR~c(VLYxmDeaUXyu_{7P%P)Ed`1
znT6%IF!u-cR<HLLHmGX8Y*s(=E2wkkbJZ2C&B|(Dez9`SJuduRoFVtNSL=I)29wF*
zp$=W_#_eAijHj()NUmPZ2hzdH2~qv?w=fqM6U5~A7d9yP-elHv`8k=DfkUnJeM5t5
ztIuTi5A2)g=rFG8O@6Rk;IF$^d-6+l*~#MS43JcH@}aWEmmizCelm!2voJ7gb4N_)
zW?^Vv%^j<(!}3Fz>jQh^ie|MVKl9pNwfeO-O<&b+`*t&HFXQ^<Qyr6=*##tB-wP}V
zntVOhp^JUl^cl{rZkwlVW1M{K+yByj;Wk-@8HZu6SrE3WH#vC~8}o85hGbTDk!E#n
zhUACaMJG?!Ww<w;c`Z9bG8eCqOfa(!C&$h2kL7HC%7lY#4Bal`4D$2EK9R#8_a=L@
zvT(XTmU#N3)g5F$#B^nyFF)QlGz6^beO$QeSF?J{&#A{DGVdD{Ojq?ju3GhpS>5I5
zU-#sP&-oC(e|Zt)`$l(Wb(Wu2GeJ3o^K?Y8<Z-`NWxX#yn5H+YANjd0KrLii2wUVg
z&or-VUT)soyw!ZB`LOwZinVJ^O>AmtR`=vMd3a9n-t+tn0jwZiUhACTrs;RL3bP&g
zb*lCK1q1d~?Y@6OewfVlft}UM`0E!2Wwj;0R<(mt1Lw<)TOqN@%4yg7xPko%YiH_B
zQ0y-d5e^S^;9^&sZY;KnA^Gbn29OyS_anmN;r6fL6Ssd2-?$$X4+>Ua!)5n3y6@Z$
zN$Ij@WkR*uTF*}xWnq}ys(N@`JEQAlHU=ie1+1*eJXaZJI8S7+{XJP+m0{o12?rs0
z!pKFK)!-l~AC!jvg_`r%J^9sg21t1_xqbP*RnwIhurol^gGvxk9%^(G|HjO~tk$;o
zpdl<LL0nN>fS%uAYT0%NTEf&a3M!ppJEwNa>xAF2pd$<dp!_2)1s?C)-mJpKac&AE
zcO@`ub;`QF7f8@<R`=rQJbov5=3%ears<%tZ*)~_eV_2bb5#rPK}hO;xq0$;5r)==
zna4q8r(f&L!*jx$rVDbu{qo5n$>oxZljkN+B`?;*rUr3w@Oa;bW_5RtsfXtTw;qQ1
z3}iA$6cnc**FwtO($J;`NcsAF>%{YSf*a4n)I;0?QV9x0knW}iNJtpDfcg#0sz*10
zWFTUUCqbr6Zg*eFyxg6G@i-(@l@~4NfUrQOsvQE=1PmN{ovT__J{6Z>VPMwqSeMMo
z!6W{inL(J{eVL4Nh;yy`)&At<?_6p#lodD_?gY#{z9;xjeB*IY=rBGlPH-_`bOpHz
zR`v_Jz84Uv5*G%IG$k)oR#?oT)nR*b`d4O#$*oI2%?Vw4dRE)4c1HKf9N-kgp3ExF
zIsueoeu47O2hUm4#lJE$2(zZn>p3iOQ1eiuyD&IywX!ES9A}#0G?A_LxA1gz2CK;s
zSE_$dR(Q-1bFg(g%oVVdCd{gEaPIcf&|Xk_I|8aH!1Y9di@{stI{}@?_XO{82Gs@-
zeTc9FrPT&-T7`rq=h5lknHiK9Eq{XuJ5bsLi8e2P{;Fv@$OMr7n82Cm_XOXGM#P$4
zYtwYmqcC}pi<#ArKcCLdz%aSJ{bw@!cZSyV$?fb7#S7dG7+sqhAS#wWg{VmXj;aD=
z4kVpS|HjPFyiDyeMBVc*5rN6=-(Y5Ka5vyQZxcKxe&T6RJcHbdaAQ-0=SfhmP&>tT
z4wNex1lG08Jh-Wo@f9NNf>N$lCpg_J1jIF~cd{%z+}S<#{Pbgt43pc~ev2OiwS3rq
zpKArx2OIp79a)*qwI>IgGOlW$d3xWJ#r-V*P)+k|Q)`8^VV-_}uQ0(ERTh?#CzrP}
zOgw(a(VU%u<!1k#gOkfy8KHa*D4z++7Xa~vOIcY2kAl@JfcWtEImW=znGOn5h)89j
z(iOE!e&^V(d0hxP6LyM0VpYq!&SFgllZBuj?t%#%j4z>WhPsW1_qZ=Syz)e+du?d)
z+%HVRTna^#xfF~T-M6zdIDphE>pc0RtoP;5`vn55qELPA)f12Jac?}n3|yP3wQdSf
z3Yiqb6#2<B$?KArYhqJ_Fqc5lWG(@t)cuoLTmJgBTADYjw)|z*Jn}cJ^?gDE<Ehr5
z*7pevjIR43uJyX$cP{8m)QPxbNk`HSv0VeXdO9}?!{qMnlI9iN49%;&8CJDS<IwBe
z)M?gj)w8e1sq5G*&^Yk>1q|k$?#W-LGfe(o$?))b^RjM+$?OmKlOJB^QC>8QL3xQ5
z<HB>zE4&#d&kJMN&dS7aY+iEn77pgc9SqFtJQ$KoCNm^wC^IKNIl`>Gh>Jma2^T|Y
zD5{T~yf=9(`AqTw`RsAs$-k33IG7$!kozl~TFPKtYRcHkro3PkgYueLjLPf07?oFK
zF)FX>VpLvon}N|ac7OA7560wq?TpRKI~bGur!#_eH{bZnyo`hKF;m)qFn{`u@4ow+
zm!DvKJkkCC(*1>@d-qRfWe|Y0c3H2yZwL^o4PCq4vQX&`+dZ{gUN`)%1zicd6m=o)
zTm!>rZ3Yui%R`uZbz-ynX@=zLuL7)|t6GxTRR!Z(*L4|nZR>o$pdmInY9&vxI)l;V
z>t7uIb}ySgwY`g7S?$RmVfG_`?54{&PyY6War5=-46WS{&&xO)OWtG<_Wb#O^LKT|
zUe~x*nZxfF97s`pm^>5Iy5wf)JbovB=3&s7TC@6*KgAQ+jTl`&1tf)B3UP|u6sZ(7
zDT*ojlec1GQv++}WKPZv%VsvZ`nA3f*pPUw6+{~(3bS(VxYVjP^?g7=0;nZ(^mpw3
z$?aGE7rH;r`~E|?lcmV3^?kqxuFvWYCY<R%`)__`W1So-$^a4#h<)70`7L()<2KG8
zF!TLd8(rTAY>0-MAB|*w)KqZUm>Rls|8x!(hRGcq{>;lc7$qNr>Y&eR3??9+*>nNt
z)LYEUJs4NDKQ4Lt4^*CjN>X8QRR#tQqv;XO>stPXP7Y&d6#n{+A(?SI%fU3^j&J|>
zx*C_WGbT%JWfEpx{%@gJ@|R^y$sFv=%*#(O%<O;3-p6h?jl;>uspG(z1E5lEk_)6<
zgRo0OL8U44at;PY*GAXE`w`)Z_nViVVBm1t+`8R?Y5L3U$xoLuZD(U*NM^jsl-z%n
z0pu=FIR_p+c4Kreg|`4ezJbYZYB%e!YFpK&*KW?r1Wx&ZaCI;>o$19J+zlL4-zz8x
zfm{P}2}}-@yLw&UFKBS(d<!ivtQ(L2f!87+wIDs5sUQ|a7pSKNQaibw-ExLE?{QGb
z&hh3<-!{F)x!AznpxD6O#MQi5!PG!`2@4NM_aqmPZiqXIH@KU4LS$7Kc$g+YOiDMI
z;mr##+l$p1Oy+p+nm)&w)m?eXbDmE7VgpkHuznLz83-~HWTG<I1lhtxXX5U)om+P5
z)QNM)E*-gc=+=RxJ88GFZsc8S5P+00*?P^(xfzx9w)|4ox$;X{>&dU=26iEkJs|O2
z)0tPYGbFQf3N))9`F$`=tE<*M`O9^NL+rNh+u0ZxLF`2FMeN(z7z9A<Lh(r;wnOss
z>td6SfB*ltxp|p4qilcB^yJd(Jd?}S7?S6+i%jM^@_RBX15;S*<VrDy_XP^|weDKo
z$u7&e9MdPWxBvSZQX9M1SD5Gfe`Sp?zyA8HTwz?^&X~;F&fToe@>^3p`S)`H=H;gu
zjM-l}B=>MKG^@A#p3JtKv5)Q4v^j^G)m?tyIn=D?$<yj?JpDOCXn&)NveHW)VK!+7
zh^_An1cbD@lh3YUVqWgeXw2cw__*lBKVfkV2CwN6&Y%>&x9c(I^1qK;xBYBZZTZct
z=JNYon^UW!*{YV@{a-`AIi$I`d2aJm^P1+x=KU!;Ddtj)Q|zW#wbpAcs-X7#($fsh
z%eWbo)mVOSX5HZ++`g2NkKJoJvobqFv$8wG&Qr|m*qD<!_*ia4X&z7R;$&i0<z!%1
zYx&)*=JH!vA?25{Qpqo-dCbeX8Jd@#W?<Gh@+%^mS()Wmv$D%CkclAmQf>3vn5M64
zQQclC-o@^@_iKpd{<|Slw}WCm>jrA9$K3<PJ1Ex0d07~Qd3pJp)p;3})wcXf?q(MO
z$F@2z<F4r~&dJRzBA`CP!8EPTO`Sx>_Lu7nAU8l`T+NqJw%==da@}>l$=@{@lBcmt
zP3AiC3l{bc34h&J^(G%(E;0GLB*VcRWtA_#CbJ*;t*rFr*W~t|f2Gm2QMNvv-pUGJ
zele^2GH&kCWla9|hGX(f9R}le6UGQ=3?=ipvnThqaf5Q|`w0{3TiufHE@Szu%3#E-
zewG20qLaVA5lU{pBP4wNk7I3jv%1T#wCSSlT<mt!d7Op6{$bpFbtyw@XYv$Q0Uqbg
z)0Q!u?Gri7tbXKou>iXfvpO#W=Wz>X$-`-_Ow$>?ldsNZY*ugib@MT_&&U+k`o5qc
z7vz`6cb9)@Uf#kp@i-(W3N9#(2Bnc}@Kl0GBT=nv-k>ycFnw~{_y5dlEWb+oC$la8
zmt231?XP&V>RE<lp6@Imx_Oxk53Bp;);$i!;@cU7-M{}Y?N?s(gon|4>i*3gCXC99
zJQ#)B@BIJh_W1d;Z;h_Ptvp8W0~S<+!lT#q{e%ydmN&toMehR~s#b0X`N;LUM11Jw
z4hN8_Ow+Zx9q+1cFO8nKy)>G2dt$WV{@Cb++d-ojm(H|Z1C3yuJBL1cA<hNrQE|O)
z*5G1PR(bLZ6l=+oIhekNfO@&u`nYPX(?USKTu3V8V%#;oc@;au;|{Jr2h&&euIt>?
zZPuCm<g3uS_FDX93R)`jVwCOAoBp`u`j5%soQwz4gxkLT-`maUZd`kkA-V0jQF7jQ
zp5!KWk;&n*487gGZo=WV43B%Sf0^n2_|@|-lfO$dBsZ};wYr1)>652(G9GMhbZLA(
z`6eghL6^zjfATjzU&u1~W+%hs?>`wDpHF0&eAAO*@^?#y#^;?ZlW%G=O#Ug!FnOmW
z!?`K%rc9o$!f<W+4d=h%k9oeo1NHf@9%oiR@^i2IW6|&LCV$svXguGneu|;djnRE`
z`xggLt$1zvl*2a;PyX%A@VJ@#&B1g~?4M#t=J{*Wtagf_dAS!T_S>#F7>i$LxY@6~
z=oe4r-pSKh8ExHP?zMG)JmdL`$?R+YEfjnF`P++RzO!b+ARlqDtLz2)$aXtu3?umr
zy8*Lm%g=kQ??3dPTh)^6!fF6<tMVdsMvyxnPi21sa$oXHc0I6LdbuApx;45ox~a9k
z|G@uJck4>`$B&jj28EZh9?Or%v)SJ$E3o{6#O5gmWwj^2l7IfyYIRTM{HfRJo-Fp$
z1T>byta{`ZC>2f!bi4>+zn@Ux+UlNsZ8^hdbp|6)-fmX!V)z-t=)Lg%WFD8_wLZ16
ztSe@?CnvsSGG}LENEUv{(yZF@Yli<7{|Vl?{mrT_zuxvGb3Ee!>0{+iuKvx@tnS4i
zEFR6UYx)i6$H_1MJT6iHJH!2Pg8F}u36B|H{+Z#tdHPPqytbeH4`+kQpR`tGtuMdc
z7cdyD>P@a)!w|Y3mYdUB-xn+}Sk?PDam_E#c+$1$cbp$jTK*s6_6?TJ>MXxl-8Wy~
z&e+<W9K4+2;q`Yd7q{Q=e$0RU2gF5>Gk<^k8UDES%L~xRL-TS^rsQ6Bi9Nx0!jn7M
zB|v^*R&)6U>Psu@Ecpd0pEjp&Wzg!;>rU=u7lX9?l2g8m^@7@o69nuePfix^W?0y4
z&dzY)X1}sd%Wq}9FTa}AxfnW+?{S8-Jt1lXtdm7qWk52po=IG5({xbHCEUtl#H@AX
z_xk_^D~Q?&7LOTNA6#k`Ze=NYA8^3p?C!_Hyhl30X$BO>k7u)=gQi^B?+-vJ%rQq<
z$K<y#d(Xe*((gQzIa|PWw;w3HnE$%3YDqr0Tx>G?pZ|YjK%<Yf-p#6~7=-7jFl=t$
z!nnDui!u4Zb~a`;FUI6Q$5~D|F{`!wYF2ak1!~<T3r}SQ)iucye?jwH3^R}43GO`3
zyp)TfX*%ywP<~-nZ~2ADFEb7^tGoQVaX9%P3yX1k7o)P0I%DWY;WiO)y$*6wgUG6u
z#{sK<fO1o^++PM}^-~NF-DmcL%;{slHXUZd&ydc2sO@G24M_WWfjX$&+~^8wmp@SZ
zyAeIDKmPpp52VZx+zlGvRNM^;_s5Ow8|DN*?qgpEay=}ro2D!4E&1^{l=aowEnrnG
z?1%0|KW=0{1X6_vi7gII(;u_39$3{<x@R(L%kQ|>_aDypvhMvF4$4U<H`dBL=IQ<X
zGo*5lBY6B7(lR_gX@<ApX;2$;hBv6~&Uma@)s3g~DWfZ-CmiaYoV%RmhCA~LcgDwM
z?Efc=sWTkRFy?sSuxT2j`(Fvg1+46kx!C{Sahk}s`MWsd<C)9<ZNC1Lp|$(zbv|~h
zY0c_vyv=HEyu$6`44cirGi;l#tnrLTS?e25<^IypLg-kyk&8Gh3j?$2(k@3<P|Fk2
zqlNXqp}lV{29u!H_Y)j^ATC#Lzu_&M8p@!ox8zUq_a_`T+>`%3VL|Sf39}#h3u@(V
zzCN9ywR`Px)=Xhe&I4*QgE+s=5RUX@+<63Sp6_J#um2~1|IWOL-8l0ngYp7RMn+fU
z-YcljI>*`kCv(Hs%X7k?UT&IRc(+zmxb!Qt5$kpqh6dx8OBh~m-~OGM0i^%n_R`Rk
zpb?~F3>-!-;$N8=m{n72K)!;6yCisYXmY!H^$cg&I9tbINN7XGSwN#KZ08sRrvGGS
znB2LtqIo$dqgH35%gn>8rnfkQ=G7TWTiuhdE@yZc4(c<4L>?3;hc00F8(usi-C*H?
z=H;G@yza@h-x)yR&c!~torO_t`roiAhbOW>p7;FU<aQQb;dT~LMz=<{35Ty7UdaA<
z_Va(ri&%I-eG1gE7F0KBb*}4tKY_vIVESK|<dUxpPON)fwzD%Zg4hp5lvua3GYEj#
zA4P;fYzGkgrwAA8WcRQC|2EI<NuI~a0r8h+_VlNqF+SB@j;Zej4%mZyx%Tj>=^f67
zXEEH*&dR8T?0$AuUSW1tWcN#d|JUjsbMSAt%+XGFWhGV~WffMQn4^rYsJ;<qWe|P8
z;X|nI*<y8vk03iG4%*FBR#?eUxSccg{f2-Li0eEPL2DrlPYSxeXD~2OUa^uv@nEyM
zCsXg?J;8IrC!TMbuGJ=aa{5-#nu4R3#kYdyO<OO#F9;CqJTbXlgyATQ^0J={%ByBF
zXzoAj((8V9Kl4&ghW8sj1b{{vw?fm0?m-z>&@7AQ`3P4|x5;708Iv22F-f{5&pO65
z`CB`~!gJf%8W=+RCx2sSTzLr8R|@SH{-(|_xvc!Z<e|xF?F<vUryidCjEynmsElLr
z1oo=p0D&qQ&*BN{RWYu`6U3_^>1yw+kfTSpZ)aop|5vQEzjpt2wgxaObvq=dd0k+;
z#vrk-Wvi=Jr?MW)A7urWf67WM|CCi&{wb@m{ChtkAu^ebRU~;fi^%jZ%nXxTjs(nc
zI5oX_1v^7>KZi*3G7rPQ;mQks7$`6LVURqRO<*$Xk-v@Z;y;)fm^Du9V|5nhV_@oC
zz^ul>05adWosFSbEX<%-RiLU^Ak3gy?Z{u@u%nDG-zA>=tjAz7#X)$gID_5PZ_}nY
z@v$0<9cEZHZO)+!hm@DFF(@x%V^Chf#-O~4jiGs2he0cQE1U9?8wSb!$2mdfuWLiG
z0Td<zVFt`<NB*vB(|re0fv}wcY&%5G@?EmrR~A%x2PApJPsx0#Oi<TN6KAlS26i3W
zrfG8yoxtm|$5W4gZ*^B*^~0cfd53}WvLB!kaOij+sB8hHu@9V(aCNcnIIybyu`uf^
zP&#?JUzoMQ@co7lTB|xzZ+=#D_&CQwS>vjKG3!qTWd%{j#I25kN=HEB7{#g#CR<(K
zPk3O*dJxpAf{Zn%n}N!|na4prdgi6=2B1<1#D<KWAaZutA+~d%*$%DFbzPfUwsn41
zb@<45^nHN<tK(6GY3+u)rZcZ%XGrGYV*4AO-0_8lS)I!uGc=j|I|Cw@DS1r-&tx>K
zdl@{Q`uyMI?<Ner?~~_nvLthIGW5EIwSiZy6kHH9JgBTN%RpJl%8=3Z;P%H|GygS%
z&3im+`Y*8VY14m|hQ@BM4fWj)$!V!8AUSR6-1h|wq6$MZx95gNZZB4I_y}^P_&;U_
zVLm<eW_3P>UDKHtvoj>~GqZt02sCd28dqsnX*SU7v^+UE>?mXJnO48e^X@S)dNjI#
zbT@18F-#VhU^p~=*No;B91MNz%<9bs$EM$LX64xY{W{}j^A8OBraaDm@kgy4;u_Y4
z5Z4@?{=VQqpt8bD@QgEPUIP-opw)z+Fh-tF0@(y9VOGk3R#}1K=j3VT<?RM~oynh{
zau|0VWk{}n#n!xp-Jmu+x%UZ+;h~G5`J{$`6i_V<(jzP`$>248+w?ikeC!ulc1@q*
z&dRC0?8(0y?#e5k{F~veyz0rnJKoA`zWjUNAdvT1Q0p&pDX0XAo#pNZv7wJAP5*@)
zbD(kj($I_hYeNt2$2LxybSCXo)``4h4Gds^{AOmD+^sFpyqp^p-mBRelKHrqnpL<B
z{)VsX+|-ra`$a^plhKRQC%KJN<RWO~yx~JQv$`k4<nZH+lfP~MpWN2Qth~UB@qNRD
z<l0cok<TQbOFmA%n|whdpvkT6j5FOH&%FL;J39l%<aTzJ+Wx}NtX%IKF2o0NJ{Gk4
z-K>7vfYCeoox8X>7ej-v7uN?)pP63M_cAg}?(J<C-^&OZvuN1P193gX)l-~bo@!ox
z%;4kk=H+b$KMymyfpSvwQf>xeaWRI??8g~aO=Vum%FxGtYWf`a*6x$9L8_aVwiy_;
z{uNhV_RS!<b18?>bUt>gnV>a1ptzd+T%18!<tM}Y1_93-4xkx7Wwn<KGh7z2Z~pGi
zsI2jl;fjkeNR8G_h6@hLDlZu(haF=~ZffIB?g?Xk*P7M(zTkk4SL;VBkX}~qi!93P
zKyeum_*lgHE2Hbfz0K<029GCCe-#`0aVy9zli9@>>{=iH-u}(5t#LcZ4euKQ92s3R
zt(w&t7?>sqm$xx+9-sW&9PF;i<!p?gnaECt$<N)vBAd&n!A07^BA`0Gw$Jn)$WN1>
zvonJHvv)hHIgVY1P<e<cJGUz@_{E^Q7gVRPT~oURnvr0T*gSP9XdLAaIK_ZlG@Nfi
zsTevc$jr&rtlDWXndQh|tv1lS>4KPM^-hE2%&#nKSIlrO7J$@g#Q_Rcp!CnYoRdMA
zO_V{c)oi+iv*3B<CF~5!%h(x|SFkfEuVQCtRzGgg%C4;T-2i0j`-B7GVACqTGJ$l1
z>=hOlWzd4=9&q02_WX}%?UjatN@V2rABbNYdK7DZXkY;QPHhXscaZ#WACj_~L1UiH
zoE*(dI}L=nj{MPT3u=9zaKNv5d8fgu7V*`L48q*m@zYl^GEDBuicBv0$^vpBXtZwf
zbP<MS)6J$cYqB%+v8%P+Y7J|(oB6(=f!hnz1OEdyu}y>lY@R2?yvIpj|KOTCs11Dz
zuIFKK0-4b=7Td<4tas!O$kyq<m>DK_bzKIniGbLf%*e^Xti@?i8@{eRne`PLC^RQ?
z9{Fq6Cb|No1Eg}YxG2M_>7aP%V+Vz#T`Oxh?|EkRE`~s^8K>WWc>fWk3)HjnYki-f
zU=NCkRV|MbK`upvIBdSFH1z9sW_3?csU+q8^XT^4(2wAmEo4_moj^@b;=h?0gt@s-
zfMz}*BSOhNTpZ0yyO7h9dGqovgXGe$Z04K||2Vy7ddf=LE-)@vXH1@K#(3j6B#qs1
z2ep<!Iw7g+eS(4sSYIVH<*0*71mu+S@%9XN*6zydH{3z(w#PHve#_3jaol%5a@qm;
z&B+^*g5E;ge5=|ZD-@pXnSPy_VRC!=W=2==N{Gy5;FS=MrLX^kwAzeZYQggwsC7u#
zAqD|vEmu%qmv!yoRbA6>f_e#@>&1UEGYE5@+}`NItlq^28lPF#s@A$|dMk_I;SOie
zI^X8yT}*<U6FEUW%9WtHmi6)LFMs}ugK7YA(2TY2_f4?12$Q@RT|u?M-|(~BG3{r3
z%jgBt1yMc8E2tGxt4wAwWe^9?#<!k-AE3Yk@uB-t=2h+rA7`|t8MDuV$)8Pr_>4t)
z(Q}3O0SP>hIk|p8YQ>YQ89gDX@zp9&Ze`_EYio2hZgppzdH6lUgo@_nTnrOAAAeT=
z@3{SazyXe>@E#<nZR04&c1-CAsHTUsrc{orwZ0Enz^v9f{R%Tf^O7ff-Ul?Wf?7ao
zt&mw08And{-tOe-&sjk21kg+s14m5gs+P{<cf4mF<_K+?ej{Q|1f#3W;TwnNIG7*5
z_e+@l`RW-rKF&5jzV;rdq!(uY{_e(&IR`+dLd=W|1<y|(fvlQSOwa7+Jr8P+O>R%$
zH^Eu)+#P2|cg+Qp+mACRvpr*(63)v0c-FFi!maJh`&!;RT&Mt<1aseKRR)vk-<TOD
zw=LT>$L)gKy6JPAB~RUP2kF|^lH9%wv@U@8vE=c8jV{RgKxHtb1P(gGAi;JGWPkJW
z^zEBjzA^}N9{J1awJ`G(csAZajP)(E>XE-Y%~!Pxv$it7y*|Tva+x{9PqF0GTMWYK
z?hG>y&k5iB{U^i2+wUDV6hd@85GuTioQFYa9F$H#D`!A`SFO%<EnjUD&q{<YO#j)x
z^6_VNhmXmVr?bd7@`Nr-6aH?_P$|yp_O>s%@)<+tF_69Q9X@17h8iva)k!i3Pd-Dm
zSwQK~#T8`2<HqTKASP~ot=6inrt<&&hx@0dKWAoWUjF>c9OvXG%R%e&KFmMK#R?H+
z{|Q<TxbQS6RWhrlE}zVL<e%Nt_XQv76dx{YZFCdA23jq&Y&NUw`wQ}&pfqi4x_|+c
zu8mn2IDl-1xXmD`bw7kPAu)1$Y3S7LwV|!xoZ)o>)V}iruNKnk1lMxkLGDpsuxmP~
z4iN6@1eMed0nwoJoZS9Xpx2GlZE_3y-#HGTaG2Pg%zK?Lxs6>QS>(9D4Hu9<ljXnj
zy$zpppjn-hWzL0Wbx)Q%Ad+M9O?QUL-`NEw|I}odd3f?mNd{ro2A1~*2E39dKdUn&
z2!ChikUTv3C1{M9UEt$u<#i^EpVb9K=9~eo2jff^W@m4x?VtSp`&-Gwlb^E-2!B^+
z0JE5sm40$S%qrmEJqj|5S-q1(xSXBC_Wb1U-``Ju&d$NC?g<hR0P7Gap1_{atj@_%
zJV9LKj)$_sPZm)B1Z0o0(oL41Wgz{N+pg75@c7!_nl`zOt>J3FaQXM|$_ghrK(;BX
zyyOUKeeW>A2Ndd{5QnXSniByEoyQY@zB{@d<Rg&%fuBM4IqskQvXem<9PXeH2Zg-X
z2~df+s#C8E5%%dFkk-Xyu1<z9kR8sTmQ*s&Pd<>zyzYhzAa*1(|KywF(A)iZ=JS8h
zkeB<;H^*Uy%g5Q1pQ|&>IWW0goZ;=`J0YFNL3>p?LYk%*s|$!UFZbk7UhtBmvV8J4
zb^&4b@AW_XJCCt~!xuEl4hzc##iHPNVP4+JG5H%i2gv_34+*EUb0{x)$#KJH^7rr0
zCzrW1%sd1NU&U_S*C1blOc(yn&h&LQD5TXHCV&6_S9#G-jvGFl-5?QmCQyh#L|D5)
z?K*Y=5bsWa@}i$Ca{`nX{A8Kq1B#bccV&fN42>?JFc2^Ug)?NO*(5Ku)=Ms+)D21n
zh1=CypV}Di{~GdeKPV4FLKPIg3<9cl$(*brt6Dr<r@v%oXkOX5@BN4UlR>SpM)%~(
z<$U5VLAB1y0%rA2hF#M;oE2H$J8aOI<G|`Z`I|XI^2}!fC*WcE{)7AksLt}`JP;i{
z&T}01wM}kk|C`)=mFa?m<$^iUP=5DSh8xbw8P6CVi$D7}BfKNzaq-iC7ovsRS(vBX
zxNt+_(2d)mc$wop^Dro0W`uxBnvIVcy-v8i|4`ovwW)SF8^k84+f*UyI*$vtwlKeU
z*q{Om6-erX)naoTCU&2_f5xTJP5c<BbT}3XDjoEX$8HCie7_l1wzzKwl`Vhwf<)_^
zV4}}Af<$@2YULYYqU{?%qI360M)htljVc7EVB~N<Xcc-86w2bSm>HP0v{t<T;QyCd
zor|H-J-K>08z}52cXmcGFGqxOfS6iqr;%1C$oBqUP_<RdnUK|75JUCt1yP7^K{?H<
z)yWf-0>Jve!Q9Ed4CKzz{UA~OuQ1W&OF*J)_m@T<1hrz0z*Yi+N_p^l$Pf9S-X|QW
zTGskL;R2)JNl*{}tQDv}0`-PLHFIg`Sx`+49;*P2E?fl5f@Bc&?i|N;Ese()roZf;
zd-$LM??F&W?{f8L|IFu%&=rFq^^j87fb;A2($KftC%1q7Z#Q+b`B#RWCl|h73R)q`
z0!qWMQkg+ua=979)qbPS-q-6|c6CBr+yDH1!h?Lj_EtCHX(|k-K&v&aI8P#KoK4`6
z$qhZaAG8`IG_<J!WG1L?1LX?PXi3xo27z@go4U+8ceSnR<aGCHyVk1K+H0@X#dsDH
z#-N-w$&1Mwma6<f<MIErx($y`o~gxfuGOpceSttasGXMF$i=j|^(TWd`%i~kQ*TW-
zW>0sV;JlgbJHtfw35Oof-u~}>!GuC)^=>9m3O{>Un6;bvy#qsK;{MX8!2Pj>i;gTi
zbn1ZLy`Vd3m)een-HN&qcP;5k)`h%t4WQLtE!%o_wP|&+x~G9hUVfUc>f}AR%|Xp&
znhTp}Qq-j=r|3=5N->jSm|{Qq`n7(FOiXNQ2x@)*;r(Z=-eg8rvCX_Q875CvVF1l;
zeTYsj+R2;NbE-wvd-`fdhRNNlr|^0;Yw<87r_SaA`R3mAInMW{H?{9|PktTF-mK2c
z(A%9n)twU*>&@zC8ImV_Wou;-<as=8?jKdJ=}Q<HCbvA9)V!33Avr~hbF#Q5!?Njf
zoR>{+Y6t1<?B4kt5@-Hr-X|;wX;$xLQcPFYTk`8?f9v^cpdM9}<WXkTBfqbK_I{Yf
zUi=!#y8xnd;_FuT$G^jWevM>Y0TDTP{br=#f~%453ns)ctM`J#^Km!(J7Lyd=JyT{
zlHYDsR@uwI$~lqe@eJMXFZU}e?PUV<ChC6wxLsKR%A2M8wRXR<9#rLI-LJ0um35%J
zIl7;Hw>PVwWl~n#%W(Jh9OtvQnN@qirZi1|JXiN);C5vtsM=||ALs7>8aZ_@D0RU~
z0|tS~-$fbLz6Pzb-2_Xod)_BJa1nHGbrW<0rB(p}%afp))$=!3wJ08yapVXEwInPb
zf1G_I1k@%~UZKLMyvl@e&H>KjGVY)~mK`CCo}iosEB6#aA*pneC#)POjr_YkH}dWF
z$jFD#oC?b23>@!2<X^TtDC5ZLzN!UWrq6!H6cH+TJi?vvI7cYc^f?Y6XU{pn=!sg=
zDELEizgH`hCn(oOMjqW>8u=Am?x~&fI|f=y3L0@-)j9nMGiW@SXYboNF6XBAI48HU
ziu4>jb5MB+E5r0@p!K6|#p070LFYJ>FuE_ynBX*7+?-)%zj1{aV;{RPt2jflEC<64
z*Im;mTnCNmPjJ3*T&rC;t&L&A;fZXIB`^Ou<I&+U(M{Ct+*H4*?+X?<GkU`OuH*&t
zJ@X0{2JxAU48oi%b1t}u&thZ{=JLut)qbdr(Y4WIVXEPRiR`Uxtsco-zZhmX=l19R
zp2*J1#_IZ5>eoNPgBOk@w{S2_IbhZyEb75v%*yJ>#rl3hga3&Gjc$q=u1A^GI2k5S
zcVn2^Z(PpC*u~Cz_=bbsbb;%jl+ELO!NKGB<fp9+Jcl<;S6;);)XFBv`B+@*ub}Ju
z5BV!Pj;J1WbbbHf{PK<yif02|-+$0we&U4UQSqaoRnJG&-(NW2snwb6%E~hRI5UIt
z^5yR!;rMtS>#I91!c)x|WPABo9YOAKTh%Ifc8-fMJ1b+v(R0%~4kzyI@Ob}$e@%zW
z`w#0^3v((Qyt@^|e!uGHUQn6@%|rzq0hM=Zrx*mL&twG6M@2DuF3b}3VqVJ0@czU4
zji6QT5#ZK&vgmgP8OP4<sn6$xfNIyx-+wX8JpA4vL64PlBIjcX&%cmx2bGMlQQ}jr
z;#0wMCt>dc0xBSB2{wDy?9R%-e4Ldbne#h?;0icz>T?EG)>hW1zl~gsTc10CQWs=q
zP4JoOf|;j5a;%4%kFzo`yR$OXial<B{*T#}l>sDT<RaS(Qf~xZJqXbUGP&`*Ry(6B
zE9++V<qXZo*%|)+hV{WAW4Q>Gt%qlx1*w%>kleA90iok9b{)rA89GmEwJS4xXJ|ey
z%FxQn%KjCq5@IIjIjw1{+BFv}?tlI-x&1iU$F1zGtf?rfKyK_jJ^AZb{^a(r49)JM
z46Lkwf5T>JAtp7uu`+12gVd}%*67~KZp`|f0VMYK*Q)m9wB-zzE0TG>GuX9)#3r+U
z{r`C8Ht0x0v)kAI#_ii2gw4enjM*PJ7=L{Z-B$q<UDXZ~e+p^=9An@xW<Scnc?x9P
zs`gg)#r@m=J)Zj<Y97QrlBYmE1H~Z7KOp}-o^>2WMKb?ZhU9{+OjuM(eS@kLX8-no
zGy7A9T~kwUO=kQ0A7tKN@xP*r8=f;fo&{3{v61l^>w;ER!E?>flv69l%KEqi<SJN7
zL5+FdL#x2yr8P}*K{EF@2Ik}J40f%p?2o0kLv2S@&-fIQDoR72?&p09YPo>sURYBZ
z-5cE|vo_c<x(TzkT0GSQosR)3{~&3n6xx0WIsz->!wy9qU=R>L#mpegmG!P!g^MA%
z!G#qxw+cGJpm}-Ae^C3N@pRL4!K2AnS1|~8xBOkz)#C7Yvde$eJQUT+<PB=YF?z$|
zMewXlVB>jESunYM`HLCOli6CCVy;SDopLw?X_gtgTUI><yQLB07Dn$zFZ^yXHcene
zbq~}vu5ZEXtU+t5k=I&-<_{Vew7S=If7W#P2rB*FKe&JHeSkr@R@Y}829rjY$y`VN
zfM$q-T3LPGFJQ0{eaWnP<d1MC3sdsjnGDIlH5oUz&ve)<{)YjyPO!FDS#8N5(TAs6
zAbQ>}cwmuuv(YuJ_5Ff|;%0R&_0HF6t?v)aZ&=p){=ohNr&=EFzt<Yo+H0G8H6{?m
zYMOo&nx2hZ#GiuZ>X$ABl@O5hBzY7xiZHo7eF^4VJwydme$fnP!RO+~LAzj{Uz`CA
zXOLX;^5qL!56=j0bQe4iOD{~*L1|;MxhR8OE6A=!ce~c62GEMjq&w&<E@A6zwR%8n
zeUx>M{DOp9{qFYx7o0(>)|;1eGlAC36l*$sOlDveX;ybtU)7b|%`PPVmYG4AckK*N
z+b6l1UFb$|G6TENoZ#eMc7Y_&9=eufAy&T6>I?>Jn?Y-2JG+x7unSCX_hPgIuW*{&
z;>GaZ;DY~T$UZ&?0Z-5_zE!=+&z7@*Mje}1uDm<_4l_gZnl<-Xy+M2QKqDNrp~=s-
zGlEt>J)7R)oXn=m_<n(dM6zruCv=q*XiuO+K-{X{$Ca!8Fsr)!es2)q16q^Ita;@3
zM7POb%o)_$PPK-$z7LoXqI*)%t<g2E_5A_|e%*u3>Y#Nk%Ijt`D6jg>pu9#KWOg*j
zf6Ys|nUY%X1UF4z)uMTj(QP7F4+D?rS<o6veCupMF8CPo-ax?R=KjASC-=V%`MDjm
zo~UX1`w0R@kXZh#DsZA$Rp7v9b%7I)XMKg14G=ldNfnS%0W{_Ynn?%k90857L-t}Y
zNI?3?nGK*Zh`pyl`&yTtUe&UxTd!wZr&U+ebddO}u6u2Bf|J_xx{bGgVKQ$0!nCXP
zy}$<hRo&}alBaMoOkB}46Qr|gx-omGqp|5zhRyA%j-CBMt&g8f|Cc=F3&Z1ta-?|-
z$jCEj&jn~?Zu(U4I)x{Yx|a3P`+y0I7xz!+WMG)w$@vAb3IMc&B<Tof?+D243=-nE
zKqb_v63`ks(2i51o^72=&o@n9)uq=BT8q@Ynw@DfdxPEP+rODMw^cH4-r3E(xx1Tr
z+f2~~%<5hYjqZ)El82e5uWC1L4|m+W{W-(t)>OyM?Oz>|znC+7wKh%B>PfuI>VrIz
zc*zU2S0t%b$p_@}$CH2ldz@4L_ve04$ym4@G@{(R{CPIEol2m!|Hvb+pH&!4K<X#A
zFVC3ae#d#&l$jv6w|6+)Z~)~%NWXE{)JZP;rb6;zqw7^@X#g5aGI9awZeH%53L4os
z;|x**iF1%FM6Nw~*Yu9V%8QWpAs%Dk_^i%gB7U8jfmyvhao6+{(DDG3|3PhPP@SRG
zDeAhe<^6^F<)Hb-iLUPp9GoT377N@IDV}gebTT^w2W%xitOpITk39ym2Fa^+S!>hu
z$?ObF#T(pBu&D>x2C@k(x4|8J;uFZ812&vb!TJ`sn}9+A;VUB-@vEQ`@F;lJ!4bSl
zO!6qm-pTFlA&3(2hI7Z^+TRg@xwmf|{<|I2P6YLg+0KFb#tZ_W^JYM4rS~mJXY=y(
zz@>-xO=0wCbf0rTc@YaEqib>pCj;m#k3a5^J(I{a2&gVobbbHe{SQdm<MLHjS;ZiE
zb}DENynw+Fv`W(VCgdcm<;RqjUNMAj2d$JS-4F6FWc(g#uji_k#^ZOwK|A)q{)L6p
z26qGKZa(myZBQ6M#_f|?S>+;JXS%IwPk!)B4&*OL|Kr#uSiKEu3xjHIE_TqYm)Uft
z_U6c?456-|RT0c9-5Hv1wKKfGVBfW!{eb)}&doo6GJKxNnXx%ti!r&CUF>goGSg47
zMi<uXWG+qyW7b&=*II8)c|YNT{o_|E|BEMZX3SgxGS3%o-unyntys+JVHf%vp3M1E
zsL`c0>oE)GALCXR#%ojFPcX1~{2F4C;R03H_ZQ|jf=*0A4&O;$kQ$m<la;~6QP=hT
z1^@q>(`Pc=J^wd6x%UfKqkC)G!yCr!>Wsw<>_Xe7KYl&^-@)w=)uyh^H$nc>{{zx-
z^7P;E<n}KdARRaF7_<LmC}uDhhUlo=-mJ;Wz^v)Y;OfeJ3$&yD{g2JhH5vDU^l<)U
z1G}4*^P6$23FD>KYg0HI-%lveef(18|HS<;owly;FZ6!}>FNc!jr%84qYG=+V=m55
zAYGh|mq7m228A5!_F@JGA<g~83<ko2`@>q_PcYC1g{I>6_Y)>)a&8B$@)OW_yZ8Ns
z4O$@aqkBQ)Ic(>Y&Ul?*5CHW?A@M5A$;$ZE8dTePwZ3;yhyvAi$*-2PtZJElikYE#
z)u}vCi;Y?9RI&JN@VukSWX=!l;F-|rDh!vVx4I^0PG^|oJn=ZQDmR1O)b|DojKYw0
zr5qp=8S+=PJpQ@z54QM#jN*XCaKdi29XoXZGKSN@v8rob%cf4VuFu*IAH~lwGcfDq
zq%o`WF#HWq&N|K@EUv}?YUwpEZ%+rUBuVZm=Y+V;TdG;zn?an7fkBv!P54slzA50j
z^|VfRt<Ge&uS_5pwz@KUhE091FrgGO8uTd=F&gC6%H|0g2f75BBT8V%c^tv|hgsE|
z0kl(mS!>wT_X!7zcuzK~^DxwgCBHOh?BayDgFXJ-^a;-QpuM`KP45E~6nwV_wT2q9
zdS>odYfUu$2yPid_TM!yu-#kLBFxG12h^UJ-1(9Zv`X$2Xg^!RfgHw@h!r8A6(C-%
zD@~7rbwl><fm)Ug43KidiyPE()#{wg$?|6v$gc_?QqQ#}2P|M>R`p`=0=YLm_p4v4
zqABQ93WJn$t&d$6{6m<p6a}(D@$Al%pmGFMZpOHBx@)y1_daJ}b?0<Vp8A~OhHEmz
zcP3DI0V*?ZxN^EamiqpWIlPUb`FbnEW0CLwM4Td=m{+he+;KFUerS4f`3;80FQ5Oh
zT)^qt)R6r4Im6>gY<~~3>a|X0W8iRPd++c-htbt_|CECfPLtbN8SPqc9E8a11EoK0
zR@cD&F>aFX$qC=tK&26=lm(5PFbIS=L28%uKbu-sb?S8{mtAM54OdoRV~98;-p&Zx
zi=ElU4yv`@U+_P;tnE~*U#s{w&{($H+xHvh-$JB7P<adLpMcsfYL`I!T|sStuu}{Y
z&04NZt6DBT6~74@;rILsYNaH%vx|V%?<6y`i!`g9WJvC36Pmu2nW1^<(dV^p$%)&9
zmQCw%+T8ht!MN)Q!^eZl3pg2)d$<^ymvgc0ai4iyS#Qf9(3<iie=Qe4(o4H#hchdy
zuox>N=tKa=CeWIO2F*rKSc?GEj`3^#<OymE2)e$1kUt&jo;RR1o3UpdUEe>@pQfy|
zlEL>VSbnOq+DeAdqvBgZqa#bD-*5Q;eHCbQgl+nEW(MU|%kL!jaIt~h!<q`&hX?Wp
z$ZsHjfn2YwvXTMjgM}YKW3wRDd)yn(H%%8~eLtZ=VO6W;!DjW74Ev^Z9I)IE@dvvu
z$R9_yGpn9tc>m!2G-g##hW8Khr!lK?g7{Ne_p_!(?w`zQa8PzTL~Q+($(#xY759Tw
zf>`e#^iPJ!@K5I4-mLD*!K~iOv9@{gH+6>O32ah`6cBU-G{d^8MYb6<W2e_CTqVvh
z`KLL<dw~r;rYDm*x!6D_Nc?qAe)62{v${e8h`0IrbB5OLpRb#jw}9vQCV&6_U3tkD
zj`souo|Y#+gXRv~fBpyc|CQK5vr;$vg`cx?G^=wm3YUNX4O;s)i~VLlcy>y?lc9Km
zc?u{5iYF{jQCxv(rh!Z9Lr`nAc!Ie|^KusO93d!-izldy6srdaG%t7IP+staqq1C>
z{d<0^+s}U1^yJQ)OrZJ6oBg0!Nzj}Z=lid-l^1>CK%`bB=&FRt&)J!-ZWm@}pK!DP
z<bJsQ&q4EQAU_${Ky6on+O7h%UFEY{fC9*Nu+8-#dm(lzFSx=1vg@-tg958NXnrku
z%1Z{&>=?{7keRoyvx_INE9~744zcgwzdz>ZdUJDYWoT0aXuX`;Ew+1*vI(-U7}Vc|
zte0EW0@}~Pta+3pxfOI8-bp6q1z)(7m(65K_TuDQ>z@2XogI>Mmj`ljg4U98GVGe(
z)DAj7hJj~Qw|FObY|=b=9yd7jc-_}F_jV_@K4(yCeg9zn^ycL(TxzY#%YHH;muZv0
z`-hQN(M@hW!lBmcYYa27)4X=OTI>4>8@ym5n%af?SzX^Bxc?V)UQK}lO#G#8;C5cu
z_XpztfW!@yVB#wcw{B+yss9BMzaR}0f2lEXKPO22PmuToS-7~4>3&d~x6$=|f`CXe
z8>`7@b%x)M+t@$pdYXFoddYenY))=fH&4#_$&lO^Zkjybo$>t#|H~j%e?JRuPoAF6
z`2K+ZiKF`)-AngQ=4Lnu37eO)#aa#@8$H$9nbq03&ULkNrv4Xi1&u8po%G&eg3-Np
zul8$gL2c7pL46@tJBS>s=6i<=2Ge^O87BAmOc3v3WDw@z(VE^3n%Usif|%TCJ-rLG
zN~=qAdM{`#;aP3*UeH>?v)ba_pjBL_wHuc-uW;c2rM0LING!5zpKA+(^kN+@Xf>~B
zVYuTU-oeNq%<)1KqGGuwLd6D+<`pcAcU&MUJTxFG*fkI;Ca5*9aABGg08z0*4Wc4l
z4WXhyrFq2>ra2)H6&$J%6~|Q&Dgu<6SGX|GiGZlcP==^bS4OBXP-tFpgn3R3M8ye3
zh>CVagbD$<<`ph1d!T;NP=Kg-E{{<0LArUx5tcnrzjVk!RJh9_R9uj3Ug5&J#{*)^
z3mJ%t<uV8r8^oJe9AVw#15x224N<`^jZiT`w0VUK+a6eWNJ3PkOCnSh2sf`d!nOw%
z9ug20$HfsU0tA~^v@qU*x+6mjqC#B^p~8T_c?Apm9jH4_h(J`diy%}8@HVe#VgCaS
zQw?E=iswQI6(6|%#6U!k3qnL8DNj}Ky@LT~^AZ-Wt4GpW-#Zj=G_PRcY+inZ<F8~=
zM_fBZEokQc0vo8De=l$#?=dgyjph|CoXyK!IP*HPkkm|I*}I#KQ#ewRVXb>I+fSC{
z*XoSD?#b*wndZ7Di~nSL|3QEL!);sLlLdb=y+4pYrF7r>4fPXCH@@Exzin0bV<y&9
zxjWx)h@TL;4U*<LUxIR0El7R~Ea#ql?z!!K!vzIUN#}I~)cS&)pwPge)tMZ<fJLus
zQzv8uPjNvjOES|;7Urd#oYz{_rW&e(&Nnb-pT(feu$<xR<!1GkzntmK%Q`ueJDxKL
zv$HcLw>)QPbf5YNbnbw%&X+%+wE}_*yjoF9Gf*3CAIs+FR~QiL=J$e6)B>-z@;bo4
z(X8&q0WBR{p0jLf(Q5<s#_t3-FJ<AJcz#dtAOD%BwK|)oGrk11<R-bmW~d+~<NFWu
zJ3!)Eod}uI$eZBaC1^bt*oNhB8(N>UY-`!nhHl56VElH(H(|2_)CV|q0M!0pb_moH
zXaKbUI2+v=J(P96fKK-M4O)!?TBD!b#4a$oT%BR^c5#Ny>>nH^|9t*`a*8>_M9#VC
zliR<uKkesrPi}fHAecUx&72{*{W=F{+GI8}hUBj6LcM8o*^+y&^G#+eV@Phi&eEFJ
z%a+`KU1%zZ?z=9uGrgDnX@7F>a{*5F<j&_p$&JT(IMX@VlbfIONTw&xdM+Y-U4=om
zTakUTNI8R78)&bYplj2t<d_9a!q;6Gm{nVT3zxU^PgiGP*fsrmlY2O5O^{^z&3@3T
zAJY}Au8dv~T}`u+y%#V*`W|eaklqKV&jA|c6TTk8AY6W&ee-m8Mz86cue&?S90sj6
zVst$>U0LBL$II=^s;nH7Igk7~*LqMFl)6^6Y<xet+?0XWz0>pY+~@BmdS2bj>YC^k
zxF6HKimpww9)~RW0dlV}E6X1g_vRqGw{W|lE2CHAe$aUQ`w!=zb)uLCk`vv}>FVfZ
zyPeaO(Mxsv<m)92f4e_^KbWqVKDpie$kYDGZ0run&DTL~8<*r6&zX>21JZeQFDLus
z-si7=Zby}2^m@5>GV4iD&+&u*{g-<|sRNWQK)u5Tj%M{%PSBY&pxr~Ehe2%=P}|Lz
z{egpU<@5ibmEMA!!Z*|zWz&T#POuBJe`i;lQQJS6&48&{m4hLf|2ju!nsBQbQ!?vv
z9^O=8)>5WqrsX`7+sc@dnXhw!)@zwDC9_;-*_kTbZpu*GzcDSD<2qj_TQb*mzLjao
zjMsS}>}0O(d^^)R*^-&B3pl0=vzs4TnpWFCxsB~WvgmbzkKN0r_XKmgvaSHdmN4g$
zKc`xi^^W|q)Mi#c@`qXN$nRC{rq6}TO&NOKI6WUrT>m2IxpF(J>$0|{naL3g7(g{D
zqwA^Z$_u`5AkqmajT~(j{t8KBtENA1Vpm+%D(L!h`_X1lY)<~(&M&Uaz+gA|Ia9K|
zqHD7%%O7Snmp{4N!D|;k<ev)N-`PC38>Dt2dmlSY?P42*+P(WBZWnZ&x_|Qb<Lt|(
z_c#l>F5TY7Ub$cRsyc&gry?sKD=3YF?Uw}EzjAvUJF=^mi-SZ(_rpq-_lHcut2O-Y
zwH*Vk*a*54cB_FyS!c^HP?)R&m!W1|!kjI?kxJ3VnJmnzT%66WoD5-YYEzGDfzmoF
z=U-SEs@8?23=L|9l%eN$3oh_$MT8uve-8>hSQ!da=f4wHhB9zWXJr7L(zdAAZj*x&
z_+$}Sj~F83`em*)b{W<cwm9^(uIV&J(sPV~1JoO9UalTH$C=Shc>ybfIR_KN<~CM_
z&(p&Viq$v_nmt$<iUrsViYJ5{7`X_4{lO3Fb3?`?A$rpzaq5jg*6Y^l#0okx96T}%
zx4AtOr)~~p-PmkC9*9$~1hQVR&EOdxWOqOJ#i?5ZRX4)No7y0LR`;6Y3<@bwPk&nn
zqub^-4tR(uGi*f)F-*PbZg}(x;Mcp{36EX{?0O+CX16EZw-BA_)}-qc-^|RwtbEwK
zS)G}|oQ;VAl(HB-;OR<(&7c_^#vI^uHOFz{aU&PdtN|#rm^GNeDX>@~!r-$yn*p=3
zD?{-Fc7tMp2!lC}5C0pvxV6qgicRr-%nZzWe1^;#d<@&#l^3uvZ0BHNV07Nx#?AmT
zqj)igfigI3n89YuaOQmsQoFBhS1U}-=cOD5%1TEWiYKsw)j;NvkW&l0_8e!eHi$pA
zb8vxO2+kubI1HFW*%&}&XQ?>nbLMb01}Ao_sl@^?znQuxcRyzcbx&@4&Lrxd+yk4@
zH*(qNKIfqFGFAqVuZ>(<k$87p1KnpF1oyquA9p_gW8?x;2XT{;3ux5|vuf&9kY0$G
z<WbNF$mDkQD~K5a*nVcvj3~2u`z6`qJi)z3&Dj_lgxR<L6ZTm4?`v3c-3x}~oMrHn
zn3|@-N{GK<X04zRTG03`XylziK>Q?V42ts{s29KT^o?N4<5PmCo-=1>Xi!$$@^3Q8
zOt<C#R<$ITd}B&ZTF%roEjfMx14wnV>XCnH;CVsVC<182s}j2U39<sRHuNlb-793x
zAj~#R@L7#(PtORqJw7FPBg8h9BmdwwdVp;#`oWT%u$-l7T5{|Hri<={p~<hNGi_Iw
zVVK<h{UBuLdGBMGOPJMK{>=#oo%e;`HLwzw(f$1f1xZ-AK*Ado+Re+`_cFRR9zPKc
zTCEOGHQ?2iAo<Dd?Yn0<UvZ9!Mx5gZiVI<O_FXd0o#*fP&xD@_<>8D_)6@V_wR}5B
z)tq4bs@%8AIJX|2<IbAe=!#1vNDgMI`zDa7cige7h2;A7AE0qGa9IuZ&HD)-vL%nc
zpRl0_77FhtB#6M+uyBI7+I@|T^TgwK!W)l+{KWeZVq*Gt=B4gx?>|hiVLUmRoz)&R
zmIZ1v*Y={CqIL*YE4hDZUgE9>T3>fTHra=jVR|WO#6Z<Xt@ZtZ1efFpRt83-^{A^_
z#mhja8!oc~$p?f!c4Gav3beBTEb0apO;D=5`u>9a--n>tMfmDjNUDCh0F*jbwah#|
z$G`J9=nU|t>5>l{U%>2ute=DUW%(<p%LFb)gT}ERf=vH#pc-Vt!`pX)KVApv2c<8N
z-zK?0^nykXK_iBeZz17ye5Q<Z@9{g{a}WDCH%$knL{OekR$KD#{RDwhh?@54GS1AZ
zNB+G8uQ!401p=k4=H=<rW<Ca;JP8Z?_ZI}fW8#ptE)d<zC(Af%wRN7K<Bf=GkX;~G
zfl7|)OF?7CttaQ61erOxJ$)jhJLn{dWajNmQ=BKVKbF4sZ*o|;Ll+xVe*L!T9nQv~
zPZ?M{n;Jm2gU)7I*S@JWS>!1LX!QihHIUiARW0v7Y!EO`-^#G6UGnj=_C{!2LDpIz
z)ImbD{pzX~Q2GF^P8DuzVR+B*Fo+QvPVViX^fU*Yo<Os$AlE}?3PEc%PMrX))i?(|
z5e;%S7UWDcy-rAqIV$bd`u>1}VzL9Piui7324?Nmr$IZ_R<%su30h0fdA89jxrJSg
zc@-!4<_BgqE{0aFiJZx7Y%1?R7&s&|v8sSnPVQV;r@X+E5p*I!vpN@Z=keyHo(!Nf
zV3xH`W^?%sNq=ghAlnXTt!m{wDa`hPS$rvI1pMf__ZRlh1g*;uUj>@W_gXvg^d0BM
z)1Y~lrs>Kmt5}rPcCkR*+bRe$!2xvczB{V~=njSl$*WqDJz3=%y@a`0eoyB9z`m?C
zs?DqQJwu~1??cd<jb*J~t;uhGGrVVTl%70Yi{adK&ZErgEWca1ZX5^6z2A_Kw5sKC
zDC-~N_9*7b?OcrO*u~g)O`qKU-G1_S_5)t6$~wPTlr^GQ-!oifTGbA5Nh+&XE9j01
zQ0yzOVebRetDy7>D7}om@BM)U?qoMsK3E=1V*>d=Kz3DYvNtQwWVRM)*rc(5#2F+(
zJ<C;Hoz0;BbmhU1hYw~mdT;0X&oH^0`-3pgk>AtLGK2OCcd+_eE&!=z<(|lu9RHgG
zwCl{Pb@H`##>rFL8HJ~}GhFR8E}zc0u=!^1=I`Z<cYEI-NJv}Nn(V;JrmVK)R}wgk
z90gakSUzo5J@N|_Vvd}#SDV$iSdU%<^?N|6Z*u$dM9@gd<L)azKxZI7mOlPZ_<D!~
z7kl1x9%p0GxeO<Jc@7`l4q8nH!cX`A4Od?FQ$cyfPX*;wKNXbM{8Rv~Zn@@yd5WA@
ztD7h2gfLKgd;H+nEl4`ji~^;#$8ub^kW)_EM^NY}u&-);EW&!{;_ij%jb2N)N<IYT
zGf;j3&4z*8+q``FB2Zp|rne8EnV-q6OUvF1JoFR<pIHkn1HdUSb>{nm4~3vS0}+Lo
z1S(}gx6%}=D}0<>_MLxX)8y%D4BMvLcDJ$bnx5*OJo!1p#1m?5t*($6oTCNr8!jkG
zJ_VUG$)ys!GNI8`tqmgkH1B=G20691wNTYhbKf@<sH?SsT-Lmlbt*(vYtH+I01d{c
zYZXAD_`YC43CJz*(qe)C4AHar+%xlxTH8XX4M)@8Hv}j`Tm$hJsMPO&^nOAA6No6N
zd@Bw(TvPmEVU0O62Sc&J;+kUR1vSFK&Wysv!VHh4nE!$9%mUrp1D02S$s2>^lew4~
zP}FlV|0{m5um+^(pnd*?{yhw!Hq)_IcLt8l)0Z<8Z}?sVZvlW#k#`p^XJy(vbvuLP
z>EZ>ZwV*R^B~KPFP_2ciD&7DQtNmKM0VW1%S^RZRe!HBZSlz*7J39+QZGWpf$b7-$
z#S36I6mM{^h3(^j#3X~sXLW@?is_iUGz?gEb!xBng4S&WG>FPRTnJ`85D|RK>b4Zj
zW)S!qUOYj(7GzuTgz#F>$vL&qkv0Yn&>X>1*Y^Pj1O>sd4+(AYsi0DAY5DsN@!g>C
zhKM5Kb6v}OfsY~EpM!SRw%gA+Gnt)%<<1$9O4x~^AhqBWJr#8N%+d1q0*=Thg@eZt
z8927HvooA!FP@-YGkptaeR_+>9Eaiw>@{~BiYJKI%yB865MHyLoso^veR4ZH(~QI0
z#TnQqw;yMkarpfK1Lw)CAGjcC@2Knh0~1V`mmT4r=>|%blUtwqgJxF>z<p>)ZIT?!
z%HxRGxeBq*ccvR?##WeZna{FTkd6yR2vbuX-XEBtb1>bUosqqjU6}p2l+0msaR&BQ
zH(~bUOd^NP)ft$C*^gh4Ic(0s$R^C@!L+Ou;vQE|*1j8#&DT{KHnVMGaALpNKj+Xy
z*2mMA{uAclU;^zI`vE%Jp$3%SC%3Cx&Ny7GE>LshaItzo&5Yxd*%g>TVNx6*Py@<K
z$l(f_14At{K>NfGri0u9cH;$^!=MnG5j45YongiyM)!s6GY&)I^J&ui0t0=JX^{9V
zRu?c3JuS@k_4nk`Z~RZ)lK*XEn9Tn5r|`G${K-#`F}1pFp8kyiv`V?D0hCIQL)nm#
z-p1p5g6H_7wo(vnT+n@Zo##I*2^a`3W@2DtZeyCfh>5|tHHks=U{eFcgig?@-2M~c
zZDfS*+R&y3&`2C)1P3%q3)^qgz%jj?kzsQC@}<n{*cq4?yE8PeXlGzvahzd__YLpn
z<L!*fT1S2>>!kcr))V=ytibYDS?S6jWtAs?l-a)gS$TG%yIzk`SMt;2Y>l3V$0oD5
z{1)au^5>~nt2gsW7KUO~0RzvYli7d%7XJR7Kl#TihRN(de}dVsUomW+{+pq;SMca&
zb{j_J26e_(&ScKnY^^MhAA9~q9sPmq^#P3mO=eeMS8n*qFqu7peR0EAhEDfnzOQV(
z?#aSmSthd!Fe^8L<P?|}gXsol<)*I;Q#~Jxn0>DW&3>BP3BGtA6wWtqgIXei+aLe&
z{JEJGWIroI;r3SdWZtg~T5XV(hpFGiOF=VnODDcJP+${gH(;L3uE4C!_=aII;~$2J
zo}BxI*%O#2vpX<<-9DN9Lvixa<xG>=KNu!oTFx?=o%NhB`v=G5obOEH<%|r%?Cq04
zYa8Y`gXTy7mQQYH4_Gx_nEeB1a`txy$V^N641@|;euul|J;W_fd)_M))E29L*xA%j
ztoi^<UI3E^z~lxnxd2Q~0Fw=1vH(mbfXM(b=>R4Tz@!406abS9VDiHbu=!x}0+>7i
zCO3e|1z>Ulm}~%(1z<7(Oa_2S2QX;>CKbRW1DO1<5o|J;yZ|N-fXNMDasil}045v2
zWC55=0Fwb=(g92wfJp@~DF7xJz~qMwVDrJ`1u%I4Ol|;^3&7+AFxdbm3&3Oom<#}u
z4q(y%Oe%m$1~7S{7;G|_WH17;4}jSlz~lljIRQ*IfXM<dnE)mOz@!71GyszdU{U}~
zGJwesMIbXDfXNGB@&K6J045iJ$q8Vx0ZbNv$pkPN045#4qyd;z0Fwe>@`D}NWH5OF
zOdbG}8^GiOFgXECHh{?jFqr@*1HhyMm^1*B3Sd$IOfrDU54K?Q!Q=%nc>qjq0Fw*A
z<ODF;0458-WCEBB0Fw@2(f~{<fJp%`$p9ul*nrIklNZ3`0Wi4%OfCSE6ToBxm@EL3
z31Bh+Ogex`12CxoCI!GG1DO0^4K^Q4UI3E^z~lxnxd2Q~0Fw=1vH(mbfXM(b=>R4T
zz@!406abS9VDf_%*nBW~0ZbkMlN-R~0x&rNOg4bY0x+2XCIi5v1DG@blL}x`08BD~
z$q&Y0^TFf=FnIt>ZUB=Dz~lrl*#IUBz+?iL3;>f3VA23gDu77=Fv$QWKY&yF12B03
zOdbG}8^GiOFgXECHh{?jFqr@*1HhyMm^1*B3Sd$IOnxYCY9L&89?wIRjM&T0<s}Fe
z=w;{9IpV3Ha$ME&y}|~~;t5|tCESFkVDc)MJPIbag2|;|aw?c?1(T&<G8IgQf=O2}
zX$mG)!K5gdWCfF7LFL?pr(p6bm^=z5w}Q!~U~(#$Yz330U@{d<hJr~~Flh=VRly`H
znEVPV;U+u<lUKpyQ82j`OfChJQ^8~_m@Ea8sbDe`OuB+eQ!uFtCPl#{E13KWD(5CV
z1(R37<WVrW6-+J#lT*QDE0`<=lc``b6im8;NmDSX3MN^><W*1!H{mImWCg|igri{g
zRxr5~Oil%ptzfbgOs0a#P%!BVCQZSlDwq@nldNF!E2x~C@Dxm51(Qd?<W?}b6iiM9
zldWK~6ilXq$xtxq3MNg#q$-#c1(RPvCESFkVDc)MJPIbag2|;|aw?c?1(T&<G8IgQ
zf=O2}X$mG)!K5gdWCfF7K_%RTr(p6bm^=z5w}Q!~U~(#$Yz330U@{d<hJr~~Flh=V
zRl%evm}CW$UqL0@gr{KgDwsS9CbxpgrC@R@m}~`;rC>4@OooC<S1@S`CRM?tD41jg
zlV3q4+=QoK@+z1-3MRLL$)#X&Dwu2qlciuX6-<VLNmnpw3MN&-q$rqV1(RPvCESFk
zVDc)MJPIbag2|;|aw?c?1(T&<G8IgQf=O2}X$mG)!K5gdWCfF7K_%RTr(p6bm^=z5
zw}Q!~U~(#$Yz330U@{d<hJr~~Flh=VRl%evm}CW$U%{#UDVV$pCXa&2tzdE~n4AhG
zTft;0m`nwep<vP#Oqzm8RWK<ECci?;PUhst%UK)+y$%RRsxrV%5)$U*v|0tatM5bq
zwLX@I9h2EV@Nb?z9lZZ+^Vj7JUagtneH5V4R!Hv!w4Qb{`v>Oar^|Uj>uSSJf%eqE
zPUC^>tP$>c_W!5*wyxx-?cBoBrVPSSstm%_-Hag9Io&sP3UhH;33IYqPySN+Z}aSQ
z#^lClY@j{){^uq?ZDHIzC6#ey&*m>BjG&zjD|`NiCinkhXm#B@wUu!*`vwQl$>M)S
zLHiF{8#g~SW%O#jYZTPFto5i7=IK<hJwhPU^G{5E%7SG2%AUzrH5pEB2l=Qp^yYS9
zkgw8~^MFQ_K`W6#E0TkbKz1{(>%4o^sLS`*wywK}R)OckglC&GfMzN=8$mt;&0z_%
zvRX}M`M@vS$!@)QN($rq5B>*V_H4eA!YKT`h4G=gS8Fo+cc%9r-tXsP?Q~OKFq1)9
zVHJb&f?Ev8XET8I4nuY^y#L_8_iuPI%U330_pkp!t7E1<W^EQO6KB}h*2-Rct2TVI
z_;-fd-id5ntiJm}D~uUkbGP@paj}MOFAc2)`wQe3(CGMNwj=+9*;@WhW_9_eXfODZ
zS=9x6CsAT2XpRLmLJk@!hm3?n#!EOH`56{)K}J;|B0L8{_iQ1HtXJR42HL0m6+GJp
zQ3Z;j_3B^2;@gq-FRyCnX9(ceU&=0$EV`9JfBA8lQs^FFMnR=>3<AnZTmChxyZlpD
z`SPz>z2)C}^{;%&YG3{_s~-7R1U}7$+Uh2Ue|7xZy=uCn;M8`dV_obF9IWofqRScf
zO<liyse_SAZ7(QnKqFoVm8|X{wIEdt99``Drh;N-{qm;?*j0nnQqSCAR)z=Z4NMHd
ztx%ek5z2?stV~colxAgy@}V><3zQF~Sy`ccD9y?S<wI#!b|@c8vvNTBP@0t!%7@ad
zTu?rgX61(Rp)@NGln<p@d7*qL&B_PmLupoiC?85Quzmpf|1y*gW`y#gbTAW?52b^d
zp?oME%mU>@>0nkUA4&(aLHSTRm>tT8(!m^1K9mmTgz}+uFc*{$rGvSld?+2v1LZ^M
zU|uL6N(b{n`A|BTAIgW)>ISR~Apffyh(c*qC~XR*U7>U+lum`xrBJ#RN>7E-OQG~u
zD18)4Uxm_7q4ZZM&B_S1A4;o2X;Uce3Z+A#bSjiCh0?81dMcD&3Z=I~>7!8kDwKW-
zrN4q{cBuc`p)|W8Bs|)oG`kU$52e|Sp?oOKZUW^)X?9a6A4;>ELHSUc-5kn?((D#c
zK9pv+gz}*@yA_lVrP-~ad??Ls1LZ?$c3UVPO0(NR`B0kO9?FN(kn$CDgM4$iDg$#k
zD+8$PeeM7&r6BSL(;ds#tFekqp327fv)B0BGlpcbZ4CRStyjA$_4J#Oi||%4cxinw
zoq+>%AMkp$uWZ8C*cdDOHh+D_kj%D?LBtVc&)NORr9D4`0CO|g)>d|90pv2@$b}Pp
zPcFm-pj9WJQWM4#Zw2kUWZi-+HocvhL3!EoO$f2+ZOou^0LAAxC3jzEnBktB`jp{@
zdve)whB?lUXI}r;=x*c!pXEHpz+riCRqF&-57*@UqfB#rThBxF3q$nZa8FJ>4l<?S
zDHB9L=+u=vPE!sty52e1bNI|5h|i2%Ah&Bl+{$@YydAX5-JM^?Il28gLo&x#knQl3
zA0ixO96@I#8o6*B^f(A|JE#Q&+ZD|qA>P5vAk2}$-K@^Rpsd642Xt0<ies}TD~ncV
zayL8U6!+w(R~W9iC;ylRb`|@7(5lbMaAlR3OcU8bD?c0EmDPSS!S)Az@?>-c?G2ja
z|M31~wwAwMZJ;{_o2D;xPyRHW1+>oi=kLkvTN!lSldHaS__b@bErad=c)A&~4m)+j
zdw~rG%<7yR&FV+~3bHFJyyU0_+n2Z>r2ppctKrG<Uzz;cm$hj@^{Q@w=v}(zy}$<@
zkP9I?ATC6ATc>++%NK^n4h#N(R4S{ig!;sEKg?E;7{q2#@P1lY+X{5%3TUP{^Cf5o
zckb!wQ$VL!w!CHZv|P|Moe_MFZgRm-ra2C*oD*5*cz^va%-V1e)K0kszEc#|YJu<|
zZI_8}VZC~eFrTpZ2hMLpjJt!z@L{r`G%3u=`t|*X_}d^Apt!`8n|~7~2U-;l+SSK)
z&+l3T!@3ruPS6<-z3#&8SN|vfd(JS^J^8_OCg}L=+%A?~Q|35;MsUGv+aJg`rhY`M
z^{xyBt@Qq^&XB<z-pPEkdGhz~?9FPP%*<+>%!k--_A9G=`7_nsuT@#$$RF@1y4sgN
zjSIl))jgS;)i|MgltsV%nF&^R<&Uz`lRwHLEPs^MzWfnf0n*FzM_GyGkFp9#jOEY!
z1@_B8J3f^)SpFz$vHXFh&g6s3nP9D(sqMn-EPp}cBaj=0mobF)&p6zydXkA*wUbGh
zjpfh#1M)~~)<M1i-JQ;?&dJ>B;@7II^yQDT!V{>SQ~tbP@P8gQJ0Blk{tKI(o2M*c
zaP6OQxN>{5dM7h8)UV1SU;cC=`%)C-qc49zxA!2a68-Y07g-fFEEKoHTnKUBM0bP>
zzx;W-wG*CRe8M=w-Z#wegvB^!YFT>q{fGJ;FnLgnZ|4G~8LtD7k^ANKpf&Ui99^ut
zrp|FR>jcIBXLW^-jIMVMfpmfTP@r`7S=|6E_I3Mqb_S+9hZtSYZh!wFel2L9AEWEd
z{Rh*hvV%lFZf6Mtt<$kzCwnx;v-R*~R!;`>)i0mb1;A#xZf|v0R{F`n=o-0SS&5T@
z(Y10rrVm_CzyA=w2ILlyI~WB)YtSIM5p-IWQRlYKVl4)fVs!?CPWR-FuPnOFlS|AQ
zlAmm6+IY6r6|{SiK_}Ujl>xL?1GUcr%8R}3m7$NPef=j9)vVgd6cDxyd?vJm)8k0i
zKNt6dPxe@F{_lGM1JHTPOz#6OWIm2z{gn%q(f{*aU;<0CIwy0p+DRs6wN9p0t!nKc
zJ018RN3j0zgwLHq@~-QF_aElZhxr8*53th*8eMoj)mj@}-*2d&-^#-I^6@N{{~&d+
z@Q3JU-S_^({MpFjGY^77j3exCcrxc#CQ#^rdQLuJ%4$dcwYn!i+|JbLp8Re(!}|^Y
zXELiD`N#PdR2Ef+g8UBZLxOmvU>-OvZTLTTD)<x~$XxuU_A}uEQ61siTHbGnU!Uy4
z%5dTUY!wtJHb8cRd;yxhWpsVN!G4wGQHV=bx4!@Ie*(y*Aayg{lV5BH_fgeOLDJpx
zNRT@rsm`c%TMH=NafD4~ZTa`Up&qo7`rn-cAh$uz#DvM*zu2sP1V!fk1pBG0+8=wf
z{<(92(e>wcj<CtCZVVt%gl>trn7EKApHP7)j!<QlC;vb_wD%MA*FSb({k5w7;r5Uy
zi8z?-m4C`=PyW4c`2P~2A0qdD0)GcW4B6)pA0J)*{=@x7n2$j*0qTpx&S22%+|*L6
z#bD6tp8OdUCzYYe)4wt>yS6dC7f{f~OqViI3!iU;oHe)L{MGjY3UL!c&V)=3+r_}^
z-rMzFKtNOUXivzAkoO87qCqt1{DSua3>KhN{$AliI-_gt_V)q`x<~idhJt$5uHbcU
zpm=&Opb)aEozZpXafrKF=e_^n{|(jMpt$LD-`0}c@RcR`!FHyVC!sNL;r)G3KNmS}
zKsgBH7f||PbbEhc{S!ne!F2WCL60|%u=f}8uY=<41T>x@bs;P@y}zJ;3E7pYQ{R7h
z{~G2>m@0@5Kyv!8(B(F@Pdv-&4hrX|4A4}e5TFKAB@lHcyd(U*!UuVn2&$P+C%*si
z9=v`8lzu_630sQ_x_w2jQ}p1b)=e$%FX*qE;Q(?c<8x(&pA4+<yKO-E3sQQ#-}zp^
z!AY3y$Uo3Mt^yjMkhr)Xv|bIgS`Bi8XM+H!W?ty7tj6+7S%c-5vKGrPWgQmK4x?Yn
zDlET}A1s%G<QsJjE>^3lGLD;CAZ0a2m@wCoUqPTfKfhMmC-bw4+=-YGaU}#-4fKA&
z`wiIYH^Ox)vuevPP<`6y`u@QCe#j~($SFRcRZZZQ%Le<^jIQW1;55$gp@z}*?)LW#
z236?t?;HH*GrGRqj_eah+rX0``x;%}H>{r>xF1<=s;%l-%(j9mivC7h!;^C&ZiM)?
zwz^=}@aGp`3xUT6mVd%m!!vFNpS*Bj{d~}x3{b5lxxdjBRO+oiRT+A8FJzrU>)}1Y
zd;B}$CrjzIZfZ4aL#$RnlpB!MIszY|`cCf&{^Q+yylJ}Z!9^_F*%>$&Htd@sUJ6=U
z^E8X)sLRp!AKvc<rB%oZ6$lG5x>>BsU@+G``RR5(P#Ol+D3G+WoE?<kA!V#?qfzIs
z>61%L8JgNbIraU7_%{$UAS+VAVhjAiyWn7T4m8(Hh+mAX5|XO>d)^B?0G&7huJx9+
zzMoJ(1z8oOHU;ftwqJ=X&J(8AD%=Jtq2o6rizC$Ue}^m%cGm>^E68GqFl69(Kf%6J
z@+c&nRHNR1SP!-hlxOF<CqIF-bs(W}{0Aa5j9NkU&9>I}3)X{82B`<xWY+e60b~^u
zNJIi&YrJ0&KNI8vbkX?>VWQAFV!{4BFcFTh_Y3YHLFV;8M&{}Ngz=F51M!Kg|N9U8
zb7At1f|J|7F)AGszVY3WfkU|B2czAL<oF8=!VwV;jP7$BMVwgKC$fI+mpLfNCdm5O
zgZ)3GpGcg(t7PiiibbE&F$RuW_f_r5b=%p5+gSfG&H~+}kj%b}#jF){?j0-BME2a<
zlf~E>4>mQr&wS+Ae9#@V=5Xeth3tyWlgqv{%zQMFU9cH++I{CK)^5-ax?R)lrb7JF
z$<EpQb-P*X)ZV8zr#OSg*?aqI!;QngGnDp+em8Q_1D_cMYMDZM#(&+l+LQkwTv8jM
zxFDGe<Q5s{$!x4lg6xkw+5dx1t(!az<RV7*nU4-OJGxK)_MLy`BSrRw&6B@@TqMXo
zv3c@0bB4}St=*vgop#f$pf2KM?}WQZ#2GZUy`AA||KsV;f9XyAxu4M$cEg15^-zY%
z-@h^ni>WirJinRkC<F5fHU`k>_vZF*4u8WoU;D<e`5PN!=ey19M;R0sOmVIipZV;g
zc<O&67d`L}mxJkI?6t1RU%oLMVzYGx-30?;CyFj&1K;oV<r_nx=p+!^A^Fue1|yfr
z$G-jl+a%g+1rC!+(Jr>HpccR}29D(NZ5+bkVGOI<x!8qE+5Xjb?V8@%tN5<g9TaPS
z-82^nv$8TJ|JcSh!?{tE`1qRn2oyi)amKuYouM||So}D{UpMf5;{UcWxc;8V-Y5#P
zrEojUe=l!>(gy=mZ{Oc=&~5Ft{hr_Trh?Cq0=c<<8^`4EFb1vmE~uOBrg!$LKKkpP
z{B1kO->_PktLwM1$v8KPf@1diKjLF{<|9x{qQ@??20H^Nl}+sb8@BoSH-=ib&Cl5x
zlk2xJJf3|0mmt&+Tld5La8(AB2E@Q=VAAs+dQ(%OyI5fT70|i((`SNi2hltQ8b8qM
zoO}L8Fz7rs)fIDsdrxmXxT<9{*H#8iFU18Q`8mPNM_Cw>C0!X!U7MzZL_qvG!L2M!
z(;rWm_0Ovn($;eF1f3rax#f$|^(%P90@7Xqod5=z4btjdcyNv*tNXf^<f89PGL8qk
zCbx<+@ElZbIL;vBsNBHLFvsDq_?!bX4}tb4p_&Vs+mUeu-CZbwq~qoOMo;lspjGTy
zdxg0_@K5G?z`vQ*+R>QRic!*h)y&7gto|!2c!K7{1m+wl1)mfI8j%RP0y&KXG%|rW
zkwdG~sMV}{Q<qiOx|Ye+;tcN>#LqY8UhR-PkDDhsCP8p=xfa7@ZU&~AhbMD0FyHF@
zD|x9c4t#<(qy6Jqod24Sb1~fNzImL{`&uWfuW$_)<J2=V9Fj}lGJ(!p5oQx-P*ym}
z06zCsos$9K<75^dhUC`eoXy828HC#<8Cs9;>U{VGn;wuXNFPY$$N!tVq8(egHg`ud
zCdVc)Lfj+F#=rzxWxv<<@l4Ktw`L<oP?VxTXMZF?@6U>B{p1ZEi#X23(CGc}GR(z0
zw>SDupTi6~`(g!X=5cfDc1PpZJ&dW=tL9E-f589v+xGv;3NxW0x^p|o&z-+B_nQ_f
zomD&Sbu#K8+j+m^K}W+5-@Etd&a+#uZoIq3AUK)h1DmqWl5fgdTfQmlJ^5zWZPdA~
zC7D-3dUAQi|Kv*??858}?8z<9B_^{Au&wlL^itON@@+9c%P-@sYYfR^ToRMn8JLy%
zzx--+nauv=ceC1&@6D<%-<efgzDKp&wW*r^a>#P=^4#UA<u%KT%llh&TFkW=x7cm5
zYEy5y@Fq4j2(vS=Cbv8nn#?|dEm`1)#N_gBhNb6|!!C${Yy{ahnSBEj$VRa3YG1yA
zY;IO(`7X@!<+rNu<lgi@er=6zUaiYo-xqwyTi3p-8x+nUv3))757;mBYFpM8*RItG
zI-QY+A-SZM(YU>qQJ9^bc`^T+f1sOelY4G4+4bb^e|(Sa!)EgX44YXlILz%q*nfe^
znDc-Gx*N9ce_UqvcXEj~!@)DmYDc~`y6_%?`TbU#vf7t#o|et(N4~eZ{1sQ$`|_<>
z{m8e+3|#Mo%e@&M^RT~hbWd)4$)o80c-qT12z|nA49p;3&xGh@f$3%W9=cVyf`e&t
zx&#YI9^@KONF4NR^m@$4^-Nif<=fk>AU7|B#?s2Y$=qBFAloF5JGv(~zhqH#Pwsfh
z#0+u=5Bn3)DZhWkcW!+=mF>f0DYh4udndCyusxRf@c<MDkGt64t=+q?Lzta`d2;)Y
z|BL%y{JXiGS)JwkWR5rgW7$EvuWoPFbotJ#+43FaYS6xWh`%%KK=E^{?OdyHTREdw
zYo-|}96DKk!o%U=Zcsnx+M%>th`!FP1E8HbkbOC;dN#Fh>q=&2RnY5Bp35pE;i%Q4
z%)rjT?9RrJ%*!q`dAAJ1ByL8}$(#X9j$Y!qpfg^4)0X-s%bIgC9}{PYJvO;ToZ()3
zGKU#w^D!2NMzP7?zVRog-(u)udo^u_Q`U5*cF=x&!NXr?GaqMRXmk~3WB)t3>>Gdb
z!@Eq($3++>Pg7-BH?56rGwU@5m|QE%<Ii{hO=dG-Pv*WZBFxVITe$o?|75lXCgDC2
zhUAyen5L&OGE8oJmdFJ^br5vMdn?P<{mjSM8TPf@YrEB&)VkJ&l@p``WY4E|!|%y$
zJQ9%J5ANL|pu2WjSw#0we%{W|%3``5bmvJci|BUdWn2u*Cs-Kt+8f<KW;0q&<kFf6
zGTnFk498@7b~#X(Y4to7XMe-!nYkaKesb71$DiAqkBKl$?h|1UW<S7I)|cG)Oh}l$
zfpv197ejLIGcn<|V?Tw<zVQdTC+8oRFc%kM5M~!|G7dk^z}hX$F@Y^vlwAa5qF#Ga
zE6BWCt;#A#ek-e8`JHIitas!WvtG+Dt(o7tB=<9~;9^+UX4fvv*76(VPGugJ--~%z
zeo30Z+<SH}$fSu}fu}&~Kx*C^L45LXuP{4<0Ax-?Ekb$GGXc=dhB7aE7|3tpU7&jA
zRhY7#%Wv^+&}o0#X`mfKjGm8W+3z$jcM}k1|G@t^;rpw}oD2e+JAXPfx<K@-3f|m0
z(*bn4W3R=kDUV;7{9n5lV#~2WxW1I{&mL|UPh(^dW>d46yS@3C3WG3v0DE%tGY(Kl
zCHFsLLxd7IOtOwMn2QS_g_P#|xm=Tfb^QnVuX&jl11Pj^wSH@vYO)X-S9f;{vpcXQ
zH#}oWZf0WzsWa<<#V9O9Wo<yA2?|xMnV(v|b+Pgt+&sBYg~6=DcRR@5rF%cM2y-~F
zvGVQR`l*GLZ|PPEM_8VD%*_5ktLNoLQ2SSyo%J6B=zbgi$!rf;lRrFT5@vV(zp5RS
zmRVhsOP?~_6&K#B4n0-e$b}U=8wQ%=YF_T{(0G1MIIh+9pwSS}>GN#o7PBw;H<{(j
zzgE!hkq`MFQ}06B4WQ8vkSfq=^^pC-t2*B=$X}$@2^q0D>h=CX{^4XEPKHL8&8#yW
zj9X_iy#J8@cGVQniIWgDtsd_mygv*v57fSam<c)~5@a{X<msKvpwn{QR<-!G>UF+<
z;J*)Yn#B7TAd&YE_`xGfAic1=bwF+cjmkk<MW9ixRV|x3A*qDR(3o>8L#r3#ieyJt
zrsVs-7?c~9FtoCOPStHZJtutP@uumU*=IUDp1AU#asvwk!eyY<FA&#(#->631)0wv
zpw~I|=&DXwD&*1znKbqIobXnVN$oQkk{wu?lpB^aw6Z)Fo(W#ra>)hMj)UERpw{_y
zyJaE5$KsvL48ok8<`O4jPAKcJFe>YbFs^FxIpEbQa3ti&`v?B(CbPLPsI`GcC6v{!
z{0lSzuabJuzaHdPCr?l)fZ80Eg-T~Yu4EAKIRMg$Y#w+tB3hW;g#k1U+S%RcGV?h|
zH%#xU7D((Y)qDTIe|fXok$({T6m4KKth(<X<gY;1gXxEpTF7=H`+<KEsviy-d9}WO
zkiYo7LxNCjq0$w$YYY;g`^C}SEqHb^TML6;n=tE<zm2XS-$xp43Q!6G?W=&SkahjN
z)E?OcWt}a5LXIH217yY#hRLige?g{z%;<!h@%JLcl%+p;?LoN<e3LkMj<}T<G%5fQ
z<2(w=Kgx@i^FVs6F@aML?+Kn0Jrh121UezO;b5}xSLlvqkY4DnKF~=R<)C}Y(iP``
z?oDIjVx11=KUZBfy~CODB*^UM<?iAWkK0Y<aD>=^I&Te8pDsJcIr+hIgnq?U)8{zP
zJPs;NnbqBecTMkso_`F=53qg$g8-wa?7_*Lu8g4E1I|yKUajvN{=Wr{mN9xJ|6R`D
z2RhlV3lz7YlnP6ylfy$DCbD#~@0-HBl7+!IawUUsr6j{e@LiFh8{<Li?2u32ZuHbV
zE6n4{sMVd+s@K`*^8Ug4rbf@nTp!p4xm&%3xfqxfL8n!9xG)>HsxZE9xc~I=%T@nC
zwsf)Inm)(bc=~LH&DWPRw06I|-^#N2<x7Ugb6ox=wZ4Dwz5x{HlR}sxL8nxLPOVn*
zft^(e@+&OwLvp@et6mpq{^-5K18Yz}FZt1OmSl#nER);6{AXot_1N6%&IoGH3ofv0
z73TQ*-*`F)<7V~;4o~~-rYFDn!jSy!2}AOeuMEl0pE6Bm7iD-Xd-PAEJLoKB<wc-d
z>sK-;FVRFfjUQA>IJN!+%?cf3;IKVA`MVl}@P9FenTLh*^%*9AcVpQ4m|6X(s*Ll(
z)4YDQ&aHmU8tn|iS1lNXD@qxXMUF8F|EOT_a5iL5uKUc8{A4LpZ&Pd6<QqRgXE^tW
zF+<YC=IQ?!R!#pap8RAf!{ZOz|H(L?{cq$_Dkf|SSw$h7@6V9AAC_`9m-91jZh!75
zyj7gxAh?GXbpdpe80^%<xO0#m8t9e)4c}xoRw>YVyzd{xKLn+V=_R1~Z<lYvoFCYe
ze=cX3xPn==oAv#J`k%?ED_Q0^2(yVYfYd+!y8PeYFk!ZC#_6e`z5A)sko=^2>-~rS
z8%uHCGz==Qnl(?WCO2_PfOg9IwUxRGb1*Rd4NVs0Vro|JR!{C=7paY1yC9j7i}h>&
z%=gS%#~2LRk{P&IHcxkD6lTBmKg0<%67aa-=|35_pmu~CRD~gKNWJ#{!~T_9_rLuF
z(fe40>(9CN8}3298`)X8QvZW(X=UeYbx-E{#m4B<=rfty<xeZm=B`dgL!PA0XD!J;
zeOOP;WL^$BMVpJ^TC1U3Tx%<fA!l;_cZOv4?+nR5U6?_>__&{WxhF&OaxaF*<=_9k
zpK$-!xmH8Bu-5kz?2j3`-D~x0eLrFT(Z{b{{w9B2!wAxmxu03>v|6is^7G>?%_`k$
z6WyX(m$e==Ue(U%`gj`qn`LcC{$YdoXX&N)ANJ2F-HMQDWr4`B9(?~nezxb{O>K}^
zU}XlWfylX@dH*4P=G?s?5s0iRBSc2^#QP8Xr*A}(Y5fn8aRr$-t#d1Ar9sdYSgL{a
z?IEcKbTc*R25rZ)>$;Qwy0SCt9#vh{*{sXUklf76v8~IhyVj@G=Uw}&7Uq>M49RtW
zSdyP;v)^h9YXgPGLrdL*@7i9qH@XUQ{QRHXI-Ti;bMmLxOvwrA%o7}pr=4MNnwDI3
zoWXeN9R{nZwW7%-D;bi@m$6)N-^l***UGcat6do$Kl1*~>Z-Y7^YlLqr@*;FoAL37
z^51t{HnLp&j_rotBxoNUl=eDLUT{oKKhE%2{P?dKj*q`Q`?astcYE_{7KX=ZHNQ8{
zu3<bi`|(5Xua)~_3)_w@I&$hj14rC7(5Yacv!tSKBwb0n1iJTYT{n-TR_A24R>rtC
zXxQz2{~^AqS&dVzS(TFkCi-;m`w#yckVTH}d;j75e`eKAR!}~A|KR>gP`*okwVY!z
zyC;J%w<jZ`*QyrrT4n}j-LreA*D^CSuRXhex((?3%rm=$c|Nc!Ykm2}tj@~-x(h6-
z_1*Npk;y6389+B-PR|0JqN%kxS(uCAS=aju_N)9_-#6UvTh$)bnq2xv?fr%OtDm)9
zYxRS=`RMldANaq6+yXmA`~8FayH>TZay>3s^GjS6v=fCj^!<nPUz$};sy2E~aY$}q
z<E!;y^%c)%WDw@=-UYGo)E@CH@O@5ur{{p&*|U0jF6bOj-_<u9{)Q)~-(lD+c9&t-
zw8`z?{)58eUYlQARO|Z>{_n#;x1hb7<C1)eT>{jzo6Oq4lq|$91v+mnnVnq@#D|9O
z_V*wB-^_8D*gcu`08`^}&}wS`*UwrZvQM|Z|B(L*!cN`#{=@p0b6kYKw=*OQf$rdB
zX9Ss(EX6J``8zw)yVjY<L41%2`p=)WLi~9&Y9q`05BkrhIJ9!E{MM}2i4u=Xm%jgy
z|D;*X6GgOj+4~Rtk3l|y#rM+X??1eM*sOk1jnzH5@wo^u=v*L?<Ysmeh})K~eg6S8
z=gO%L(go>vrp@d;4q>&;fSL1j_4^O`cbnBck<>k#22;m24W=%2_4^O+Z(-Yk3b}0#
z)LsJl6=M6*MejfG-vEUSJEP!fP&h)wTNl3n(0^@?3n+9Rcd)+$$(-Ga(8oIe{fGW5
zAbsKt$oh`XegA>~GDuvV0i@@#H2ag*t-{yC9YE(lG^@M(=3=*-F5#@K_vF|63-T?@
z>PLQqPJIB4@w0Y6=4QVJ@wZ#Y*3F=JZD4vlmHiQ<v}$da-3oDC>df~a)}Q$Z<+09u
z|Ka@U+Px4t)#>j)yg%g%y-N$!3idn3AOPu?FsmMI6g@b-1+=?7rE$6@=x!}djZ>|%
zhJLLRS>AuhKhC`L$p6%zkoFI#UjeGmL1iDT<b#cCBFa9{3Ao98tWtWN$=$3{(<?ze
z7R~DB<((YKli8)3mwPg3_4b|@F9)sQQ?F87(5!y^fA4WY_Qx`R|GkVt9zA4={^SiS
znZjBpMS)5u=H(|j{<<f>e=d~OI@4fPSF#MNK=bmG9H5fIt5tZqI)k#pUk1PF%1X-_
zTiKPhco~$Hco~#cco~${co~#6co~$J{p5K6p#KS|Oj*@3ncJ7)@w4SWSbe7Fg3FPL
z={ca=WX{wIbAMoGR_|q<d_BaW3miw2zkOje4!_R8+HHEAc{wkGvDh7k<h<!jpnD0Q
zO`YM$dKz>ene0KW=_1aphbFS^n>NEq*!kOk<MMQd8HYeRlGCR%%y48pt~Fg*VL9Wy
z=`)=Fh6RFFZ!PC#NPaaPTwaN%gYN7&UbJia6zAk#H{{d%ALxHx)$+J(^|zOMo7H*M
z9yh!HZ&u}H2!fSWP47SWuTfU;RsXnsRhuwdFSO-xbc%Q=xSXnc|G|G%<z9r0>STzF
zYW4dM>sL(XGC1hC^=s7Dy`c4ysCS;n9ZNdGAd$?>DmJ~E8FW@jT=U9qj^x>#BI1$Y
zKAPaFR%X?cs>w{OBFyW!Irq9JzdbH2<Jfzid4(&(6h~HPVfG*YjfF2WSWRyA&}t8H
z-aP#WgK*oo|C^>KXWU>&F8jfd{3VSc`9nHajJqNG)6bK|<rqFq?_#%`YUuWUg8$*>
z<=mXjYA02vM}h8%=i+K*7oIN8U^g8!BBi|IH;1wUJ40;@s~5Pue5BRw_!d+mPjC=D
zb;D&N3-9sfr7i!3Im8$?i}NsoT1RjDXFk8;uvz>R!@B9oUDuhc+Cb_u|34Ps{)4+s
zE#p4L_3?yn-+u0YEOGo#^RgrV=eRtc{OynODwh9h-BGQE+=gzqTHjCb-vK)H<mqpa
zt0y@86$iP{_7bc2)cvd4#KV{wgxS*mPY(sP3sq~Nagg%<L;i$Yoq^lGMmmC9rP$gR
z4GhLyp!>>PIURGfI*q!wbxr2}_J1;`%b!}AR-eWdo69>HH@=@7&dGSt1++6?^6^5J
zh0Vg>zcWZap2#w>8FWXZ<l|13&SuEm&%P;}r_5pSYCYEmy1nZChxdE@S~*R5AF9nv
zuJdHv{9T*z?)S|sT8@wFXaBj?@^JsD_C}Y~?YP<ypd1P+9fGbPTGU~eVC`v8%P1yL
zt4ptY?%_SbcY<3FH%(vF!+BP#4H6QqxsZ@(jd=gy{{Mq3rdNStI?KFyi5G)-4Ksr<
zkB+%`CNl%GW~LqJ){E)c%nZ$|wVfwEDO}O4!owiQbMXZ8QWmxM4d*9<PNRDKZ27-E
zK93)-{5Lr!)S-*#+4MQi!nI!+H(y`Q*xLQ``eboc2GC8RA1{OM&xpOhYx*4L$8)~?
zn%wKcnAiILLjH=$?Jf+@rZ=x)X8`f_S8cwthH>&A8HUH5JU^J1v8XjKYf(!UNn=&k
zxy8`D{D_($kFwq`hUVoiYRX!_7@Aei{9pQ`)m?eXFOEhZ<dO|EF9IstoP0O=rnO%3
z0fie#7xVHXYK@>3d<F$lt9nGQg6z<0pWN2M2nnIoXh;a9dcJ?K|84DdT=`VMm08=B
zDVdQ?YBI~W|C`IFF(l7smymJP>ipZ2Jc&h0&{eMo61rWA?;G;FlozaGNM>gh6J|ZY
z^WMNgN2@EDn^j<XG$^NMUv_j=Ugxd)-r#`Ns?KBvR-xwQT%5{lR<ks#b}~$!Ce8r5
zF<{@cF1A+oOVdQ%lvn%$-Pbt-qzZKFF-W#q)f21|qH1QZ)znMVc%drKPX(!Dbr)u9
zU<R26QFCe9-%v(Z<u$L>pyo|xUe3iiSzMf9*Yqy-OVgDXurnwx=vHr52c1dvTdi5W
zlTmpIh(5`vyzI9cvpP2`>+#8~AJ|#lASL*@>6^u-F(f~q$}qzjv|<*dqLt<GqbL8)
zwTg#=R-GI@B5Sm&#qupE_cKL)@<jBg)mkTofL3@zV!_n~5(}(W?;pfpoy?+eka;N=
z!~25!|8H)Gs8Dr+sCa7m{(=2vkcyzz_XY`)5BK}EzBhOvadtmQEO9?XwW~cuwX6R7
z2k{rahB!h^Icf_LKWYHFq3&zQ((RktjoGd-f!4f$R(1$aXJ=g1ezQ-nwde4Z<DmPW
zl$WtHfL0L2gIAP*Mp{5>K`R?UXGS-=FrF3WbY%dKksX--%d55d$`OY52loE~t-E0I
zRBMH-v;pY>t&s)k;XR4aQUAU9`Vj`^>q{8CS~s^mcbL3IgyH>x`#(^1e+@ahAH{^D
z2ovHzgKYF_h3K^ZimB7`AmS7nuLB63``<TTZ((4*wuGU>q0!Zt?HiNwG8TsS4g2qd
z&W)P?0b~+r6%S-g7c{<vEpISLn4Z+@T6%IaHz*Y1S~qpQKOp}K<f}$cR_}?=8&`nX
z$=7}|HD7-M_GwV-x#_K($%mga%<N~r-onu1u$lck)4r)qv$Q%NXRZDd2fEYm1t`T#
z3PGe8uU4i=P<jE$-hamFd33w!S<q+<V&qA$bLH8|;JEN>eShHo!{%#{kWFrR#sac?
z+w|n$&zYF7wJ>xzoNC?7{*B3Q>idTOmq70GYi(s$p7w>|{Q>!h$m=LUZL^vEAGeo=
ze%%f-)&9OPtHHse;2nmJN73zHdlJe1n;>&Ho(9<mvc1Q_t95hxai)D!-#6?(4H5yx
zI>?Q!?1$J7HXCn$4!)!Fuh`FizgFdGR~VG1gWYoj-8~?8?7t?=%5d=M_R`R+5VwGD
z^=frb?*7U!@$F=G2G-&Y>ISfTM8W(8>IR^Dum3_<aC}x*FfanOy;(sgC(bztSp^0e
zfrOc}ot;6Uc*Al-m^onng5`#&<}5HYa{1ca+Kpt!5l~(No%D3pl~-TzC}g!SDDPB;
z-i4-Q1`c6X1J?H&-v2|F*XjV@!v-F;WWNTw?IziegAH`TYjO_<8z>)m9RTGe1`fSW
zVRl!BMt8*pt?bF2;>;q>itH1d9!s70cf+ZVeIom2mahzq$JJVyrZYZOR+tGLEd`}%
zh+7_Wa{Qaj{^LKdJ1DJhHvbMjbzS)D^Zy_<m7*Y3g`rIim7&Qz91IYZ$f_zun;JlQ
z0yH+sAi;Lc@0?!eWY!~pH?^4B%RX#%Pku3-saf;LUr-CZwR`Sk(Ao>oojr5hL1#fK
zFPg~!N#&rD5tOz|Lyzt+427(`P&>sSz;<q3%VgFg|NfdvJ_YRtUDhh&c*h-bw&Nx6
z&QMTjz{;XkExixLD?u&Cm4`reHR!(WsmCE<5AqMlH-fJ33-&L7sPa4jx@%`ud*WZv
zO=~ar2fDsjxZqfNlhYlfTjHR2IH*6d{7nRu#r`(pDClmS+U=9ezA~%2CwGEov%>yo
zg4Swf9%nFTXJlh#hs^h}z83yo&M^5~JG18LrLX3?C39S76aFgBApBjOL70`5L-Me2
zsw%_8?y1LxQ(YNACtNr%B{zO!nam!*B+Qz?k=*r-VJ+x>rnYYkZ`~zblc#-SYHAQ>
zE#PQsXgwr+)to{2J3Aw5C&V035AyBh*!{w+3LKDgBthW<N`sKvVChdtssHre`v>{&
zL2(UF?eJ4OL8%e6yXF0c^H+I~epWLufa&pSTLu~xe*IZZ0V<|?A0oCMyj~a<wvfDI
z<N_H#U%tw2Du*v9%u&VFSK3YW0MC-4iZ5SoH`T)vi~41DQ#r7RFJEFe)dOrks1ySA
zK|!-wpk3Px0-!r-#H&CvonDJT^F`;T&v9>UZtcE!cvTCdt6t~(1ODqGUxH-3TF*^y
zUgggCUO^xrxi*v?B(`s6^D^*i8>Zx^*IB@^(*EVYaJv`-tH<V6b;ijY3`~Lx?Aj-@
zegD5%{04(D+Xsi#zD?7UUmRgb{`Q3-`N>g+<d>jRro<T@%ZmT44Ygdr=r$9y%JqPL
z4{~V+oAdH&eXk(kv8t_bJEU|4%^!h!v&`!5({@dt<Id;`ay{bA(f0?=gV&gXLJN`u
zF?&{Nhq4YZNI>G^`9!;^&6-CUlKVNiWIS11S$+SCZx;W{(AqG$>-+!K4rVP^#?7yO
zF<gBEUYA<H|M>lb{MXEyM^%NnTN$TEgKmw<KG>|r$<X+&b-}IHI8b^x1-fC%kaOXw
z<nJb|&FY;Dlc$2xcRR!6ub}ij`Kc&4jY=M#{8W_zltO17p8V96fmzLy;qiO7-;=}D
z7#{x)|E<>ge#8A=AhSSYy;pyM(&76J{cAZ-f^NS9@1okUeoe9@s{o>`K(wMJ`7rrH
zcFI9qo`3!QgY)-Sbr&ZTm4H?i$A4g6d0G{epMRcK>z>@x%_ttj$RNzqvn9E2B`-6m
zwOL-uaPa)(@>b@PuT>2_FM@mta-%S>G(++;H%5><lb?ojK5GTdjr8x%>TXs)$zaGi
z^YG(D>%YYh3QAx$?7aMtTRa*xLbrMy%;d)7Ad{z_|7pg06>f5m2*TvY;mn}>dfz{I
zzx7cI#N@~Q?C%~wF!_6TFDrN8{#KT^+gE{ZtJ_fj;^+QVtx=%xdcJo5dxZeazgv;*
zf85Oe=JEWM-)r}RL{s;|^H(}(K5TiR-Bb@pP>O+<4PbHg0=ua(j-2j#t<%H6>oHbt
zYE5o=&cy2u;is*H+!Y7mwJlF>d(Hr1yR8s+1I_faWxs#$ejlh*ftr47^7XHd3><&E
zA>$70S?i`-O`Y1_#jeO|H?`GW!g2HT?F@p)V*4cyLgrdPedk&@59DrC6P~9+Oi*O)
zVh7FQ8MzpTZe?KY1lf1?ET{$wJB7#rppz()j-(x8kl56f9C(0ZdJ1TEWl7??POYv+
zSG8H7(b@ciid+{#y`l^HC(pXCYDqr5oQ=^_JO<PwJkvj28kFL@V|~3RPd8zBG`)F^
zJHzHyEyuXFXKlu<nvCxsykDQz`o3ZPO3;iIXcQM@mfg(v7yR$7YIz*C`cE=5C)25!
zi~BkMVNbQ7+ODY~tZlj|xW66_a?|=X7r`qX!wy9qK$K?;0^-@AbsDQfLB0P~U8|-G
zvpTRauWV<0zrg-?GAFCd%oJhP1lIQp;(tjVocx3(p?Cs|0XP>eu>Z+<5~S<e^gGVU
z;UAcaFC+`V`SBkZ{)QJ%NH+k9u)2fQgnnmu7+ySq-Kf`v)oU^*1Jh>lSqz)Mt1}9>
zvKTeG&OHBqL;iD+df`@<qV22<2d+(@<G!$a=Hd4n-al<+c|6nPFG%*<^cn7)&8*#;
zhl|w?7<^VcV92b_%@8(S#=W&WxshFDJ3GU<tNkMGtz8qJNw`}!vvw!*u#1_qGYH)5
zFBUjvP(0zdA;g>;&YkYbSDteet1mG4thxX!x~}co^a<{oO{`s#hlJDFIVQO4!q_ZG
zY~~5>f=#SljK{XKF*Ka*o8WE>=9#lG2wd!&;O-0KDO~KE<9@QawY&59c6Npbf5rdy
z6$>mkD4wtkY#YdjbDLYcm%c9!aDayE{>PFBivt)WKr!)t!Tm?EM?tquOQ!$q|9HI7
z9kl+2(RKQ<|Nr+*d){>H%R=_YGoSw}4lrN<#Y*!MFQ)ek=HJ(Rie3{y)`tqSCa}C;
zF#qmjQPxL|F0xxEgW8}A%1b7*GYAxKC@)#Ne>*$F7mzErvojpJ+Mm1keZc;<JubqT
zs!EetCJ1zP&wULpH5bI+6g;|}{R6|~c6NumJ;ef+2E`Lp3^KPvY^c9(__cMvIXlCL
zTJfL#nOoPUfOJi6nIiCh!Tzh6H*an)4Q<^XTL_ws0i6m7Iuo*iL#wkmz`<nYL-8z7
z?V6>-tjfi(nPnwI^GX)bzGui@8wJD;)Z}(f7Oz%aW8|^&M9@k`)&`dM3+&Hxo}3;I
zDxKVQ#od`1l=Z%c39~XVy)VdbgV^Au20AGv65K*7-4D7mTe!7_;eA7X>vVU}S*XWD
zCUYG5Gr<|ub5mZ!!l1l}g+W=3<q!I9*JEwQ?Q9IiVqpfw6F9Ak1;PxP)sFlDt*@GS
zC|@AKvd8&YTWu&v&F8712E_ub*2NP-!D_(r<{i#Z6GTG|KC3cV7YiU{8%$?D%ok8F
z6`sn<=-9Zfjq&N^Ypje1J%zu1<ClE6kaJ;^@Yin)k`E_xPHYnXYQ`Y>u#>YBG~>KY
zjA7f%PEO@jCX5HulAl~<$QSrfK6x4|qphns2LogB7dA%F+H`Xc1_2Nov^L$GgTVpB
z2CYShtxjiU?KrWit-~3#*9qi<V$o28VhxxZTYiIl;Go^%ya^HpAlV75P#-{K6Euq@
zIINRdb}-}%EYLXNvZ)PZ7AxzCBOT5N69rK8D5#;DD2gKMpi(R$0X4Bf8JCF)D0&za
zQB71ukyVf{me7Ejm>`GCL<1B(52QgRg8Tya#RO9n6$d1XB`lz(GDzYw)d59MgBZwE
zgo&;wvI|6tB|M-eJ`l!bVgQPs1VL02Ls4WK_=_bXpe7#R!)0OuiXI0ZR1;HCWD~fG
zB{HBUF5tvvVgZUC1$I;uOHpJUSc@eppe8o3;4-lRMGpfLs)?;AvI-2v5*^l$Wp~u!
zGHn7}{o`3|HK=AyMaa!zt16b5Vf|QQM-?uU79dnlWvf6nX(>W(I$K$>#0u-j!aK@v
znY00+dIDPss!3ZBa+BDKiY0bfKbG53fXk!<2-UOM@=#4WijbSjmQyTo!uqk~jvQPj
zT|lUw#+C&#2{lJtMV8MfmbhX4SZGHEF4G<$RL^Hi0hxx#2~QDn6WLOVC0>ByFA0}P
z9}uc%u_d6I^c5jDhb^vH;s+@H;&7S7U;`<STYf*D$`*ra5-UP(I$Kn+1c%LI;T=)9
zOcFq-p1>A?YLX~IZW3Eqv4n)pW4Rq6xJ*(&sGiLhgldv1LT)ZwK(T~|&11<O0k}*u
zK&YO^=7(yMDMD@rn@_QXh0SA;9X_~BazLn_$mWG=k}E=PGMh)Sgon*z`5kV!ObS4#
zp2OyXYEmddZXTOcu|$N;W2qfZxJ*hwsGiQ|fND}ILT)CTU9m)l&12CWcDPI`K&YO?
zW&<(_HJz6t%UcyoRDj~o0+(qG2-UOM%s{3g(s?UFZZ4Ziu|x+b{!DP0Gy$P{8k-TS
zNmCJWGuRA@C1!x)&j6Q63lOR&vgx6kv=kvXnN6oyVg)Gvv~ZcU0ik*hn+B>$TM=^e
z*wl(8c7Wnf4VOs=5UQuMsi2y46d^a0O{rMo1StNLaG7)gp?VUV0;)+@5pq-5<ccM3
z*gO{4fwL9x0HJy=n-r=^PZ4tS*(8c3Uf4XA-XVd@O&<`dXRx8w`(F`qv)Dw6C4SgE
z7TY0$%OnO{co{XBO$gOZtO&WOYy!m+9JY@IcL?AzNdTdG9virxM@{FV$nspp5)!tL
zrFL-PGED)YdO8~is=HJXax>Z3iX}8`AB*l_!)1~ILiHpz7F3f=5pq-5n2IGVY#$5k
zV8UgR16+0TT(&w?lUxyU^Vw>OB|L1CrFYceGARI|dInn+s!5>;xmj!##S#&=$znSy
zaG8{VP(7Kg4ArDmgxplNl46Mr+hoBVCAdr~K&YO_R)A_!DMD@nTS2izg>ACTjyzl@
zH6T>aWXnM{sTCnNn=PwYqQf>>d`A{8lO`ZkPhrbIHEAkBZW>!!vBV79WT72txJ+7r
zP(7b53Du;f2)T)DNyQQ?Y?EboB;Yb>148vIwm6VUsOfwwvV2Uj#12sW#o#jS07CU-
zwkVKki1Pd>LT)NsM6tvPQ2a&UGU)<B^*pu^RFkeE<R-9%6ieIy#a|FElO7;c&twZg
zHR&lrZZ?}=vBV2d{Q2QB=>tOb6gD4JlfEM4rm=YyOZ))EpBFBZ80=u>RPuZ_H&l~Y
z5pomR+=?YQ?2=`7xZpBL0HJyon-i)@q6oP;Y!1Z|5_ZWFI~;JCq<~O8mCX*-Bvpjm
zbT*q}2@Shs;T<-(Ofo>Ip1@{>YLY2JZW5bCv4n+PvfK_cTqZdnRL^EJK{d%0Avc%J
zs93_oE?IJi5iXMg5UQuK8GuYeP3NJ=@_NM*5q8N!JM?gwmVi(_pG^y78X}#iBIG8r
zX%$OkfZ`8lf4=~sdKMd6Z@&~FH-}B7SfT<He=4}#)PPVul}!oNO|1yI>1+zc5*?uU
zQ@~}?1cd4dY;ve3O-0B}Vv{MBm;s7EDO@HkK&YP0CV^_wQiR-GHnC!f6`=SN!)4M2
zgz9N*BB&;9Maa!y6DpS2VV5kjLkO2i2N0?!vI(G?bQCW4_ffIL3A<#09XQ7VF2L2E
zeTQnwRk+O2N5v91K=IFk%QX++YPY^ZHRUN>X63tLi5GUsQaf<=`9Hwb&V2?l1vPDd
zh08X+Dwg<Rmn^!2;fhNu+m$0d&X7?kQ0fJb$!QpDfQ-qt{BC^&l4W&;%L$mm<sSF3
z$@Ms69|J@l;e+U4);RJfS)PLhb$riY1EdT*^5@~BgK3XnUbWF{{p$uElPh6md?=>G
z3LcXyVP*U%CIn(TB$u!<{uJY46>k3a->f4!ij~2vS-3-tL306UpGB?n-%yYZAXkCh
z3?8AIV7dcl%fxpeS(wacRRg%p!bgs&f8CP5EM+*vy4TH|6*MZil;NS+B35%&(5T>2
zhL2*CKx_w)nxA4_tdoy^{r|VIw~v$AnBy`-kF)YR7Dn`tbbyBzW=Oii<sP@Q@qxk_
z7GscD2!P9D>J5d<J?>}Yz|@-nm&eqb3YUA_&c=eNw*W4Wskam^_qdCV2UBkYTpm+z
zD_rhz6E-(bfXid*oeGzG+{MO(Y3~BKJf_~IaJl4WwmM9`8{qPodbh&mlDpU{F!dgQ
z%VX+23YSZ6W-GzedjT$wsrM>eF1d#-4^!_0xICubr*OICR<<lmy&vH6n0mj$<sNrp
z3ulInxJw3BxLk4*ws01J%VXLr3YWtk&I)jOOuedbx#T8n;cNhx$JA>ImrL%#7S0ZE
zc}%^oaJl3rY~dULm&eo_3YSanVoSk{qXf7-rruPzTyhgz0;b*qxICubQn*}l7h4pj
z-UhflrruV#Tyhgz7^dC{aCuC<Q{i&SU2FlEdKbXuG4(Em%Oy9l`C#hZ0GG$qyA>{%
z+{NaGsrLX}9#ij8xLk4*n-iwq3vhW%y;tFK$z5zVn0g<;<uUa>h07&3u~}g1{Q#H8
z)cX}Km)y#xf}vM6!2p(jCqBF4kbH!Vq1Elm0ZeraMkwk+E--XrRkr|cUh-@<i7O7R
zuE{sAGWB9r%Ww;3X7VgHi5{0L4wIj@GV~ltK8vOHQx!M>SKZAfcEut26qfo%mEkvB
zRTG=Y6^BmO<cn7^>qFHGA~1EG&!)Ice#XW)<p@~yt*e+dpy~m*uOO=37@(>zU&X9@
zR0ZH+mE6Z>aK$0{C>zrp<TlmxaD!qshN|KT;Rc}HL7mU%xNxT5?4NT4v<B+b^f~TR
zL9^bEL2Hrj1b3d^6Fet);&IR^w2}w&ALuUz?OXc(cZScLBaFu<KWArw=wo%CaR8(j
zyk6;X{)7AlpVbRWTDyf=9S+U}@#p71$e$02k;kX6J}ZQt_lIt}|J*q)lb^FQ`EI}B
zuyijZPDB}cj->7dhZ572BavH+C4OvtEWP5^6rb&^p!xkNXHqv8OIU137FzLOiqGU{
zZ46V+<bUYDUo4TaAz5<8FOV1;3rH;gSFuFIhGfAN-@sx_V6m^o5*{FRAHZUaV6hLy
z5-&D9mR>PsiqFK<vwc&}tlU&Aabv?{krflB_;i9rzV0ZNII-ce?24`_KCNJp+6~1L
zJ2pHPThRs*ncT|S0MfZ}N3p~Tkh%u2`3_UgSZ*kmn6V*QY{eh2hyut){y)VM9UGG6
zpe_>ti+wMar~s+^1XjlZ7W-5z@nYj+xfRF2zIOoGuy<pz#Ep%Q#a0{wiz$G_EO!=5
zoB*lY0~QkiiT&JGEU^QmZU<P510=S0U$Mjrkh)D^F&2=R?Y3fx86b7*z+y}wv7dX2
zB|1RrR)EDAL1L9#iX|#Q>Xv}S8W=!gwtI>tGC=C)fy5lZVt+RkOGJRw%>s!jfW<0z
z6-#)4)J*}234q0RZYq|r0I8b*65{}i{oPS4p#f6Y1rlQci-E#f0;H}DB*p|5+qt7y
zf&-+kVT#W|aBMK{D3<uKAz2(0$_v3F`5*NEfM)9Vy5)c1KMYA*tO7kpj&5AnR_mJo
zpufWryp|Yr4=4yf1+U40?RgJ7#C9&~0E0lQ`?i)<U7(%syE>CwzcKZ?C-;0~ns^MP
z1B9RM7iJA$ecvE|ko6&m55gcZ1J?Hq_xB4v1@S@n>HcDE27{mFliR=78(05km^^(8
zgK_q62GCjz;p*St-#7f<BY5(&I)kC`^h$=w-@kvq*<U<?-LP1I+n`uL(xlZrx%~@6
z>w&P=ORdEW3I@sToJ_?6kqX5D3@XI|4j@|N>ULq)2Q2R!;&)`;Ef$DmC=Os?DGqR8
z__)1TAX1<>fI*}<zyU-{<bwU`cMP)nh(Vyy)AgXZCo|~048F-MUzxpH-%p7D)2x1y
zak?Am%>FdK$zNFhBu~4}khoxub8^#ljvMZebEf}G{`!Q2S=|$=s*StRGnwr=OMtV8
zv&f+fhqfQP_iJ+7v(+Mpw;x-3Z*tqWcOi!_xKD9+IlgIHYoEyREAFj*SB^KUcQQe2
zY2y$%9CLWaVbEFm&6@2D;;x{b6;D~-Pl*2p+ePTty2%r?RvjXz%G~JrenS11v)daz
zA4^XEbH#avGeoA9amJyL!{*2D{Ssz>zIw)C^W$sp3A2BHcjGWK!al|+hi@E~IjpSm
zlc{-SJHz`4_unUiS8an%1qH3D)#`j`yQ+ors8<{4G}`@lKx^L+dmS=Qf>zkU)I!7W
z7kG!ng!&iF>Yh-4vHec&0pEA<><PmKccbaa51)YU2AFaEAH=OkzrCMe{{m$8B<PLz
zAb(8vU}l)yapD^;e>AI|WHf6_?hs?`aX;a1+`N=QafQ?L<j$uopwkkQGq$rhwIy>(
zFmGy`;l{k;7{g<s$Nzec-EeoBe&ZOkdM7l_+&)0VK<6hz@BXF+W_3;`<ptu5;BZm+
z$+UC7)6^5k4(`8jSa|_E<D5gvN<SD@f>zca0j<WK?gHBVdE^xX2l(vLn|FL5F`4$d
z(IvV4I>Qb3InKMLJe~{lsp^aO6Cfw<Bkvc1t#XHi;LE4Y>YR+tDxC~ot#f<cPq=>>
zln%w+K>OaFJx%UB&cNt?#eI&m+4RSAkN=z50|~>{NAD;6zYGdPMEpSVw~-4-1+!}E
zL(nQhh?t1y*He?ff3yGlJjPYRHTlVNz5qw#_HPWy`OkQSzkj!{d<|Zuq{)7V$5Hs2
z8v}?Z%<g_?-E?se@cj>Wr@Mk~UrxOPGFzDS=^f!RwgWMTMUKZD7dY*6n&-T-9y_D5
z0z0$EWsd8fhvpo<a~QP0MtKQ4gMfdlThC#`6#?#(r@Jw<vTd4<D%*4T!eN<10^Ty`
zCx^Q+JbwG_PmK2!=N{*tLst&Ma?})fj=FMKz&pg9(RI_bDaQr8McgO$T{$ii42r8O
zhvyuUxeQr%xvp(pJLq<5@ZHzoJGPTQE@#qe2c6f!=-TSW%DQ>_GKOT9qYRH<KmP~O
z!|3{Se=)<>B+$Lx#S9CeG%J*5fYMu)pz=_f6-qNGH8mjT4$vyD=H<^%*-c&7@_vH;
zU9HaK-X);>byY#@BA1Flc8RC*zu)k`85E1gttyVfrlJh6904&4lqXlUymy#CeY!bl
zHQDlmbDWc3E@x6}eeV!Ijf)i`di*Hp1eeb9ptxaHU3%DV>iY@&7eS^%_9&HxUWMjz
zka_D`-fx({i1DOaYoR@=8qj)EwM%~IK)0WHU4Wg*!XUA#MOlH3L9caPr%}&)hx>gH
zTc7Wk<DC3xIh$JRxz_g^;umXmHM+EVOL|Y{Vqh|!Ih$c~xfUbn<fc}Zna6qUCzo&i
zKlN}jV=D9GNg@9kU9qhm1+5)zR_9^Z{9K(;S>X@E<GCTfZ|*M*g{&Th)KqNeAS>ZP
zd52l^<rb}(t6J7|GP-rTg39pq$2#4U`N8)XgTwjhe@Hk#{qcT7{@eE-<R>t%a$#&<
z)xvnhho3=!xzSaa^(5o_3I6*T-Iuk6wOwlUYkmJ=e;*{*z;e>jb%>lKc@z}0liS_b
z-f(6-4oNvDkj~42)G(l3<EqDmSs9qtwY+z*ZwKj7Ua)*s<iY7?%nZ%TmaP&uV`gAh
zQ(MmHKHZd=p?N9mk~yGrdfALSmNU#eE#tJg{fh(WG}%^mWrZIM%6c3Oa~uWP9{+p(
z2YGcRsAd3}-Mrj=320BuXH5r#*7V8k?G42X+zmKAB^Q9|Vo+Jdzu~d8>i^;io(2cE
zgLZ|0&rSuGX`r2JkaCS>!3>90?W}ISu2xf-SF$s`pRj&ouY0oiSEf4-ou_96OCG-y
z+<Cld`p<CC2}MjZKdU-?gof|a_Z#xBzyHAhORH@<IOJJhL1bJXg7#h91fTW;yHy63
zvOsH@L2LP~I$7P5Gt`B(y4Q7XYT4Fh*E{p<CQwXl;Qx`#!zwV*%?otOMC<zv^ZSz7
zSOq|-KmQpd6}C^9<DC3zIUh(&|0yg-ET6J!I_Lz8<X%pm=|14|GAA*w;$dKQYjpLS
zCCqb*F{$<ag!7Ai->S8~SMZ;_svAV-_pEAHUZ=^ZylN$*@|s9SPB+jE5q6#LC+IIU
zJ<IBz%<+`zYX~IWfb_qg4NAqJJwB-G_SK*}Ae)!_Fw8tYBbf8}o#2IslN+^JL9RT1
z>%GGHJF8kgUSM_W1g+Gb;6J<5{W0rTc-XmKhlE}0+4mdx4>|6C8B)0Y@nr5l&8pl?
zYOPGuSG8Q+{xu|U``ZvlXw3wwQ5ZNtr(1$|3pn&&dB5TP9Z1Sp-gIiZ=t*9;MpwJm
z_Y?Z3aK7vXpIncqH{fx05n?avvG*JLcl`}{x!<exy~6o+L|Ft4^IC9PQ+F_!bL6wS
zgURIY>P&ZzfcBluIr092e_N+}@{Q#TpVb!_&N=g0eSyK96NqvK$t)9aU0N~6LDFra
zE2zvm-!;)aS>`Ll9f!u_cfuzghMbEIDZ}7yJOOdz(cSMi_-}as;r%7hE*V(az#t%Q
z32N147K6@bg_I04U9CXnVe3qklEL*T#2nY{?>C$WosMyiS(B4Nt@ZtZ_+OpwYBQ5>
zEoT7jmo1*K+yJy+ws^vFLr^_kJV71AXDFWFZqTfLk^$uR;sx#|S9~V;obh0E2bCY|
zPeDpjuM2+X;*NnzQ%H(ukkIN}*SV>CTZ>f>D4wQUf%a^#%6RY4zw`Zu_Xn9*aWQz!
zQaxzS&CoE}{rCUP-+wZI){g%buM|(N_|BJngOjZlbSn?bL^rjzd#&#`^xrK!tE@MZ
zL0PMlQCX*w5wwmtsP%n={kK&uf@jsBdC_$T#ILO@-f!Ta`!{6o0%avDMz2;?Q_xvM
z7Z1+~KX}-$6`ZemzOvcAZC2-GYMQRP0%j`62AIk7KR7-G=>nOs@bH}Qspla&SG9m{
z7!iEf=)&kW5tOPM{=c2*o-Fv41v8Jp@<;L<P6kl<^l^Lg^h`z&D{}j)mV?`WhLrCA
z8uD=a+mMUf;qkr(;s@6`?>C&E@cu*o=2b1M&^_G@5_;{c+ClsCtXetUmGz$dQC9f!
zPg#lOpRx+eKhTW~?-TTwf!qPAVYagwH1B28Yft9B$^?oh(3x?Bbo(!Y>E>rJU~XQ{
z%E9P5kzIMgSB|Cz&>sG<ONcW*qAoNrG%t7M5Dve}AY6W&eQmSe^xp1XH)d^ihRIQ`
zjLBWsc~-RuM}1`wW^4Hq20EK?K|=YePThx-uP<Q`S7&4pW=~)Eu^Y6*UbyNPBj_yp
zX7!do#@W9ZlDW7TqS{WihPA$5AW*^j5+pvgVe*$F?5C#8IRLt?3UZ?rZ2vsuRAIl?
zO_88o^PTRKS&#hjY6ab>q^vRJ5Av-^?-Tf^tm=HYJ*eAtJIGW}U+pn7*Dp`domzi{
zy?_4)_2M3Las6-v%L{w|f`~A3{n)!b44TrOPKU(O(n;?Z)PMUMxpY5hojvHhqqbwG
z4g}q4;9%Bd<y_Sw==$E^{H9*d$>o*|$y3dlh09N}PZtNRdvDJN`5Sb0Z`1T`4r(sb
zT-ZE6MJ7do*48sGW#JI!YWaPs^?kwn4$#<+R_D~`lgmvR9ygf(h4@Yl>N}OcsJ_#0
z^W6`=p&_BaHFbNjx`N4!L&fR_CN~Z#FJWU)UdG0tyn>CPSY5zGkiA$y+yvC;WMn{A
zSFFClWX7>#^#vw3juopj7)my?cF#D4s)GRxAf@DT?Z)$W+$Wv}m3W|b7o;=;wIm>E
z29aVACt@`)1Rk8O13FWMN3(f34}-Wm=zJ4*HD*nBwYA5mYlF^kc&*6jBg}Q=&t$HK
zgW}ep9W>mk%`3SX{)R9w<78OYda2E;^?kttnN=;IP)t6;!t}nNp=MP(i1+h8XvgZt
z<IHMD{xnU0%n|xm_Mx(ZHRH|gAlq1ZCUQT{{__j!etAaM#^ZC`LFF(kJ#C7Fq$tpN
z43Lu;YD2Gr&)@L60XxUS?^@WU28L!$HwLXPy-r5&<Tg$Q=GB}G#?}dp!mJ0F-+$nr
zxvC|ZfmK47ot0@a`%y-#Lv{yFwNB<Z@>iI{<?m$nmcPR6EPp4vNi(pzfl4!nOs&qz
zT`dfmPg~vZTu@%Z!gQ@Q2z1UfmsV%&OJ;SJzsYReJPXqvirqLd<xKPPPKJ-~K{vq}
zvt4JnaAa!#oD<E<JQ+4kyK)3X!}w;?Z=7IWev;wFg}H~POENP|?(_@<?c)WRpWI{4
zc*R8#)c0>UXT0J5Smye_R`)qqAmQ!J*R0CT0Lp^~8Csp9FXse6_503z4cgrU;br>l
zJq}W{AqW)a$_q>w?;L134B8v4xBzqqmVY-SRAFK2)#?P!r8kZ+tGoOKx&OuqX7wX~
z=bV^v=5asg7l>OY?pI#H!T{P80y1^i^gAb-m!D*~bD?)T==?ing=ofPaVy5e?aW$S
z49VP9jLqs@OkaNsvvx6DYkj|9LfF&oa{`wBUb<bFQ{kW^_#}8x-3i)}3{7kQCbPLS
z2(umex2r{~^L;}@jpR|-SOloG*{pu#-{jU72Cr7(_I8FlM`oOOUyx8#`Bx28B2^))
zgtVbK&+;=kFv>WJu?e%W@!L(~ImGA+X*HLIJ_YwmKzT#)tcc@e_A-WP?0W6nrf+JU
z<IK;Xz`=OF)s59PS@b%?!fsaA-ov0)1StPZ>}GZS`kR+cToiOtPioxz1^d@Cx}Mz*
z6FHjje!={8jIIawLw2DZO@pXxjeNgAel4SGD#+er3>?UAbHi|(=h01VAh+|n3ph@m
zuExOVoLq37MYx?^-f9}pA&`uKqc8`9!lCJ#JB~9jdMGd8U^JR80d~27<EH5lKO|3h
z%9JeknE`alf^a)KD@?C22Lqdc<3(`$4HN>xZDtJHS|RRqjd;Ic{vwcXYePZ)1>M92
zs%0=sj0T43>Y#q1`jh4*?rPJYGB8YTU8<u7Iyb{4Ifj)@T#K23S&QolXyiM&pIrb_
zf_Oh-^qI`n@<*7v;UK8wsEq`b9H&~ZwW+nfPY{UI>I9vXo9xKR_rBnP#j17?4^ncR
zJ<qJx0xmgH|3Xr)QzR_?g31I?Ewie1GTV_q;$om3l*<A@ZfUU5>a@MttbXLr(%X|+
z7cjqf_`lZlq%oVSBgo|U1_z{8bv{1L`2}<n<okjHh7eb;x&d;v=GEz1%nZ$|xUMsL
zPv&koxbQslN-hSFN@g`qhW7~<Jha-BRgU}tiAWx6R`+C>dAe!(W1-UTAl<Co6S*E|
z{Qe`jy*9LQKg2c%<yD=Jk8r*N)off0;4&}o&pXgPjJELhgfLsnU)X(u$_gx~ZHa;f
zHH<Hr)mZ*Ds~-8wtlIMTq7JNe0BcX+*Pl>`sy|f?SwHB^0l#ygQwJK|89f-?C$q8q
zWprEBqSvXc@dZ?8|5euc0=kFu@B4%c5sjXbZ=2Ow{x++*{B89F<w?*v2HU19>pc0R
ztoP*)=#EWRw^OZ*?x4865X!8|@)xvk@GTo_T5Ib24f$_CZfW`3tjhA&ul4<cf+Ubz
zKxd?W@&vV(i1X2dRFEl%5XnUG5vYZQKSUlRqw4q61i69)`x8<1e}wB#KEldkco5V_
z0G;Y8%--^EG8@Z3Mz{9~0<Ou<tW3<REZ{r3Pxd#S2i;x9tbXL*&HjnUBeg+g8K}eq
zrHrflK_qNPI)em$-z<m{d<!ZknblkVHLJP&LryD-`lR`cA)E6lD2=^mSWpks2`O2{
z%|WL)9A7HqJh}Zi6Qr~`*!}i5sAK|(u`_o-$0bnIF9ONI)OU7Ie9hr3%*x6Px*J`A
z15z^ALQ7`YNbhuTPfcaMR%gcnkm++AYQs0O&o~TXPiAjmn&BXGc<x!zb0Gd42Uhoo
z>@yBeX8-ozxOF>&u(=q+X7jHMn_HhdB=<gNX>@y^5Z^1z{`EgZ_2hPUW{635-9hF+
zM1|QIm?pB%I4mv-8WC@O|9%1g8&InCYK5iS_Xj}bBW$#c(fx7e(O;pU()1Vu2P9<D
zr^q-@WQT;y<nQbXu#mwPD$6G#)V6j{Jk8+@2@m1Yul%TC0xGMa=J#<NZagb_3gluA
zXFfJrw#`?Mg4#0-J%<%pA^JgMG3+h1y&yF*&cdmt3=7#ipuT$g<o$y6_dvdYpIHHS
z`|}PN=Y{Oe)7cq7C&+;6!pYy+*}h(fm@~O8ok6)_83U>cker0`<nP~qDzYmJe21Rg
z4r_ga+H{lK)0;cMu{OiG(M^zDS>QSYNY@N!NmpTx;|$6ID;N~nnZ?-|KsG{Tgjw4e
zlm)Ibc%q4WBI!mp31ns<J2N{w1L!1qm^mHJ!sXxj0$G(Ao`P)@1BcZNXHNFNqRI^0
z!D2I<4dG_aaR%KuF_B$)!gB^l8aR68{ettSF+xinln30)WSlp$H@CBc=8^b8c6N6E
z{SI<JC{{sds6*lqnh(Hw*o)EiOzdtv&*7}d%FN2j0E%~zIS_rY`~Zr3P<=bOT|K|!
zFef<Xg}^?U<E%VkJJh95&%9rte-OJ%pJ&TBLsI19GwlB$E<{U@s-T;tQ!@pjDJa<;
z;u=(!faW3?IHs$BMo^ZdbsT6tDSHfSj_ZWvIQ?sg90$ssAe-knFuEUv=3-E;T?l7`
z@-`&YpB{R@Ab$(UFOys#sg%+EaqiJyrLdd^4$I?lpm0VG|EJJW2z%Hcj|Qi1r1+Zp
zn8O)4+(GV>aprVC$gbS*9Ga3bW5GQflA7l@GrC^{tAx1Pb=Ug^{NS73AZ|vEclQtx
z_ZVjhXJgT;46SafrYEypXX*r<V#Ck@Zn;6inRzNZgA=P`BO(njx3Z(93W%wY^zhto
zf;;GjVPnyw49RR@6S*LH>yGm(_<8CeUxE0bv;wgQF4C|a>PuLDUDY~WjhSI`o15oU
z4^|IOXUheUbOSnXr1kj>w>wS~oQ$WxVAwT1nVF6Gu~6DSw9<m<<9$Zgjo=Y}N5-ZG
z<k$g^{esFGaO|l&^SH-23ph`8+dOR>L#yky>B$`1SUTO3`L020mDcW^=VhE*-8?`u
zp)8#4$sNxbAmtmx7tErpXrYDdmXq6&?GD|K9M2H_wV~h^Idn97RSN@$xGK2Zw_G+o
z=Ag(?iGzyo8eLgkD@{Qsm-4zsn)bT#x;mP+x^lX%wQY12be(D|>Z)nW=qhR3=ql?v
z*A$WtTIal9(BA>7H`HMD#)A60kkkyh*HBo}j6rXv5Swx2NhXjDrcfK4IE5oQ87*xe
z^Kkx{T>6ur(UsG7a%d+5tE;AIAWGV2H$YFz3kjAz$92&4w06%tjhX{sA%o~6t!jt(
z>ghyKPfc0*yT<zo`+tFa14-qep$A4mrE?4d)7e3Ng6E&swIyF<XEA2m$^aVQa`|`j
z81r#<23}WXrYHY|85kHC8H5EsFcvciFbD?}IJB}qo_PFUk;~-c-~Rt?H~#vK0o3|Y
zR$1~-S#8TdWu-6wL|rGdx`1_pbb~RH{$y`fh9Vc^)@2Tp-M{|-+g{rX((miq=n7Ve
zVPBC8qbo=S#LbHtS^h!Xz5IFdVRjafeUsTu{wb?``Pb?Wx|3HDY&#<Z%rr2KY`+^T
z6YE1}SCfB5;1jfDK{g}FKMrO6R~rhEgS!ez9yF2x$<yNOpjzemy%2X9_l4&`Y8%}^
zwlOl~GdM7TSTOuqUBF~=yE{Yi1aXti><kQ`QKRW%pc$Svw$IbT43NXOctV)LbT(!N
z<ppfFWR4rT*tLT4C8%WzIT6h3#B>oxhRH2UdevH$m8SfAZxDY`S#1e;43ib+cVzd5
zuWC<be99)y2^#U{yaLh#=|8r1g6_?JZxDZWqC3QdFaIDWAiJj)q@VdIi#RJNues)f
zZm4}fVg6N6yBBo-JS28NzK8i1HN7N<E@0ZszQDn8J4_9le8d6<ki6^m$?O3KSMCRq
zf%_R4Ks^db9|txn&UOtnF5c+%H$<50$X`&e6x1Juj${Q06hKF^4zaMjPk7*uJd*YB
zKC{}9zfIFuwMjl~<$Ae&IxA>))wNoj6*My7TKTvq?RT^Kk-rn1-%qGto4Y-^mkV@O
zT!2ytq=y5Uw*mDtK<)dd;PDXHDiP5A;h>S6=9QeULE}Q=;-Im(_P5Mh?rN=v#U;UK
ztG;M-0iC=Z)Y{6TY7SB*$ocri7wBy*pfjMAyg+FjlCF$gYDGbFyr6gog#v>FC>%hi
z%L#L~{AF}M)duS4y$>j;PWEDDVODSX3v&C-{+)-_TBmD*MyN7hieF=35N1m=KGmwc
z;3dQRf&kuCEwT?mqeYN-Yz+t9F7e)={uZdW0GgYEjkZr_X*dWufetZ830eckywaVi
z(FJ1u%E!sloD7;P)Y?F6&p`Ki+<!0n5_HQAC+p*9U%)LENWFCI!3?LF>66>TS0#d5
zo1mI(j*~F^1$I!I;{ApCouCm5$ZdY0^KC(+f^p{>7@D=*7(jhlac<CgQraovT%hw-
zR;^0z;$nb`B|*frR$OXhbOZO<9UjE4>f}5N8*zY*LBhthCvzY9bFU3FE)JT-TVTq0
zG^q8x!v`0~xA)q_*+AnEYH?t56do9ZMj?{JJ}}8R3SVny6rSGBIC)w-Ltwu-+kb|S
zeWCpa(-t;QZe#oKwf|<nvf3{Om<epr5EBmQlVpO%FNWl9E(S>4xH`Qz_<ulm|Ef;e
z{SXmVm-hzu_p3r{6waftTQ`hcK=RD0sxysE7cj`Nf>I154b_Uax+i~I&Va7cbt;O=
zBam|xdC#`Gg4PcRn4fTAbYpaHbeqiDVE5i&{)a};olFh}wjCZI5s2J-1Nrx@VDSys
z?=Qs9bre)O0&4R%x=S9kYt1!>l+VxmzupG1CbzrygKsbetC`IH^*^gSqib^UcLqnW
z%E|5QJsr-aH|<)Ff@gn0X`RS%jer1eLgN~zS|KAFjG%FifB+9>wHDYI#)N_>P}+y&
za8TZcgq+}6P}mu{7;jz9V9dI}LAX@(gD~q?eo)xL?zaM!#-MQm-jg7;$&Z#ZLE3le
zo0^ZhGjur5b!T;-%=YCUuiIkwFaO>fd@u)<mY^ICQTKd3L|rFX6-W)MJFnY&g91~S
zI#9kxghbF8(D+WvUq&}j3HUzXg7vBv!IL1@gK}<?7cB3B^S2f#r<_^|x?xXQ=@-L$
zg$F*XS{{3`{#n%;1RC=<2rypNQuwji)r$didJ)K_C4U*+-WzPt=X~1iUh-F&<rg$1
zs;ay<h@Syo`*jR-R}rXOQe^;z1SG6LEevM$<BPYmuM(Tg*3LNRP%FD4y9{(Z0TxPN
zw}Zw~0s;(@-C3Ey;~n7flh(ta^efD&sssub<(1Fpy*G%T2wAxR3N27+dv!mogz&q@
zb}tBe=V#IxL>U1olU~kAZsTHrvS)$H*yQ=_Vt#F){P<Qyt4k1GE^LZ~ofRF_ssug(
zUzq#IpIgu}V3{gN$9sVd#go|?cw~<<s~`E39P)rk!cjP^opG{wJL6=rc7}`4lHh9p
z!8Ap1Nl@B<vma(gS~kcGa0x45ke|%U$_FkDB0uoSIBw_u&)}GYTB>aRR>runS(u0C
zLumiz@9m5TliFm#CN25N@Lpg-)~fbfZECHMvMNnxU(2c1_W}l)E6>bu0J#h7KCs(B
z<|#H`?Kdt5nWcGFdD%|}2}gWtlvn&@NN(VQ*78ev-y59&ad5BVK?1s#{bcwX4$}L0
z3fCV<Tt4M_Z@~XGaBpUm<KEJ!!mY5<LGWmZtAHnuD~BVi`uhv-Z^FbOrN&EpPzq>X
z-rn%_He`nHc|G=0!_^)lzq|%kYCzH=qEv*+SKaWgy>8^v;g3kK;M|H-DneAUSIlq*
zsXXBfQVGg=h_m#<P9aXyb3JI(8F+40r(V~41qRhsEy*6N3_-1e%AyBB=cqQiAoAlS
zFUYM?lYC$~Q=EsHfmuf<3$$)&Iu~f9dQ~=~_hg=igL6+eujXP{*6P>Fyo{RxG!p$j
z;6d!FwxBkU*vxay%e@&I&o@m^=9<d5swMDmP^+h=<Il+~1qU7XgG_sz`1=ot=ehlB
z$lm>`2b0gUvVd|P<XmJ10i#aEQ<K?_{DY*Lw%@B--V1ziRXix;=+&myI{8{V<K(H}
z8jj&=?{>ET45j@ydmYmkHVd<}fB4ydxA&+ms7wO2^guZhG{;aH`gc3z^kGQIH>)50
zzi(=DD=Wj~uV2CADn>4#`5RDZLR5fieTXXMhNJL02_gp(Z=TA^aESFFv?q;I_XO;^
zdmJG>a9sK(9E8<_2s@42zcN5(VL&ce2c3sm*gX0BcYY=IoBc*EpfNR>Ly%q*L?6f>
zlf~H>4>mKaAN{|uS&1#S&xy^kY1dS2Ho(kmRy+EC-LxrAAUA^a=|N|Im{pJdUo{ot
z_J@s+*w6MaV%yI8pW$sEqEs<*0hKG5t^k=iS-g!=IJAvXSiFtlWWPD<e}>HdoBfXI
zpqNu^s_eVizisLqxX(eQDC9OS(EJc+?p3Q(nAL$<uWM81`wRYuk{MZLCUYJ6v#RA9
zv?O%9d8yT_^}T?A@<eypgT$17a}L1twq1kh4Uo?~+34=odgp*Jd&^(Q9L1&9_W=w1
zwK^4_GHbE?1>N@6tkv>Yd5H@nXr^ScxFy4#6Uxg>7{N1`Ygib(+8RN(TLt*9IdP`b
zJ(=?-m!Nwx?@N|e_hg2jOr?=(t?w_q-vMd$L1vj?bEM+z3=G2T?ANBVGcZhUUw$3b
z$DeWG&IQouFnDfw!vA|(orxcXTaPgGYH4+b-VNP<!=cqJne#eFGV6D?(#X)y5Hs3u
zLd-aRt8_oik8UR+eiRUFb(j1L6Mc39BD#V9F$?R5PItlWcN|#VlRKZYB)6(Fulx-$
zZ}|m?dG43CZik3GzXK6bf3$KxL}d9@h{*CA3!!S%IUpkHOtMfl>dX+4<1C`!x!SjT
z5h)dvuJ>V0nfs>FBENxpt&`i9ZJFZ)S`n|gVvcii_jLy5<?R0+OE3Rt<RaY4{tr|p
zpyoxzgAjdc8+)7t9FzO6GOTL{&!~67^gjD%<dO-V;hfCQ$`o>u=i;10cMhV>4<BRT
zkUT3B7!fFQ_{QPw$M5}`-2QyE%*E};*WR1l{{3CdMaW2r;!z3DRqdsr$^V}+&2X<3
z&+Qj|eZ_n3DOhcE!u^Kxs;S9Q4;VIIeac|h+B6L`asqO7>1|{72M(L3K4o~jy{Q3I
z4hpjt9BgX9X5tioN=$S;3d*Z$x7hB1@@oTwjOVJB($M73Uzz5({1t!OKk@w?pG}>u
zr!TnNaM(08IS%4hzc$d`BuFlBiiE7>DZLJJ^V#h;JPc3I@mYBKg3BET<IbZD$<ZH}
zj3a-7=J5Z5+ZbwB{xD5X{0Qnxg3gAV;d82WZ=dluGe+A!WxXSRKr0G;x4*o-nf-%<
zvE)yNhv0MPL19n`>X$%!66@MGb(pnlb%5s6l25WRFuJEIfI<+mI<L`Xv#9{%X0`_o
zy?u=C#%uzPPObY|BNcvvZ%f#0zJOsf>jsBOE^~W9EpJe$Z#D&u4t#I`@i(__chKrs
z*WT*#_$=EmM)#cxFF`gRW8g@R+`!bu%B;c4u&Vu_hu+kKshc}aIQ$jeEOvr{d4)T}
z+rEkH#^Dl-q5aD1p8tC+`t_fT<L2qd!LueZ&@*@=3m08kcB$>!sSD@MT{?5^)U6Zu
zjy*c^>`;Tm=Jaa}yILL|PkwuqE4gzUmt#h)gz$A%#>wHVjFWG$F$xE>F>e0K%4l55
z%DDL(8>4X<8>6xo%MWFpCqI<+w){|5`0`6xX~{2THId)S8drWPYo+{B);aPkc?JhZ
z@-#MuWEo}!<BH=<P8`M=I~X>XonSh|cC~-=x8qEQ*iQCs4n59feDye!al{Fx&DW1H
zO*{fR<8$-3V@y*H9Ab51jqTn1l$CK?fLh435Vpu~o@rj!yxhFEd8_$M^GQu?YIt0E
z^vlcx9S6=FV03MCeYk)6cP57B<?Y-5ii6e-OCIJp>~q+zbzf`k{)s+~p1ocZy@k13
zekF^r%LsG2`~;nA{Z~?u^XdIw_lZ86+sz#}_t-dsZcOfCe+0fU#IF6L_+yzj{}!e*
zdL@7O!PLgV%Jul&kAGgRL2a8`tr>UP2DM#l6=wBjm}twa?9I@u*Ud0_hBiYN&%sn<
zK1s&3IbI!%{<miQ6=hcEU}#qNU|?43U`S?u%;&^@v)}k?I@9Lw=}f}Y*%<@-H?v)3
zPENnhbFArDTTy$X^8_au=R$E~wxdkj`ag<I?BCp8?qK|FJHx@|&Fmi>0uFEfyq)2(
z-0eTj>KqJUx$oN<loehu9BjV&T3KNY11rBEhait2-{Z?Kf37@}%*VyFx!szvi~ZE}
zDb8J-j;;q&jagkCjX5kC|B4!4b7O2?cKrWGapURB7;^gq`)?e6EcWA{-%Mo%PKIXn
zmY>aPM}9J^v-~>5ezm_@&E=O9`<(-!{WA_QtG4_Bwf~z{S^j|Ht6AOU&mq>ky&JbW
zrp}t~m|iRT_{Z~4mixDL^!l`Vc6#-C3v(a&wRi8Vj!vIW&sMKaZ((kh-+Q+@rqzlT
zwKuxgiitQkuVP{-6ra|7ZQ8c!o4*}r2swPP`J>R|DfRzAp}1@M$9~XyaKruA+J!k?
zel~({Dg*UcK{MO$Kh$4jR&4>TO8}2Rf!cMDT4Pl^v#TpZ^RaLS=40gy%*WFi4zVS%
zhV};bDzQ)gR?ZOF`|=TJY#4NFdh=0phUR1H3`y)xY=QlY*nIm#`?s_4U6|Z<?OihS
zb(ZaHpY$iUsR<^FUFTpv?#{$~ES#zNXgO2!v2-SIPeh!J@n-+oe&OkD3^)7tg3cap
zn0);C|KvBzSs-OK^Ko}Z=40WE%}2`_n~$Y4BHPsJmi+A*6Z7$QM&@JF8Jmx8XKX&U
z9Naq-Mlsjb{c*|nUy-4;+Y>``x5tLYZZ{3}-JTj+30>R6>YiM*oM}}%r#omBesbq?
z21j?$$_U}9pnD2jnIJAPaw$YQvA@~fm9g0^l#$u3l#$szmGKcfD8DMPU+llx&+1<2
znq2pt0l#^W&=xK)Wk?ofmtuAoWngw=WoULaWoUL&WpH9o!U)k-?a4CN#hBeewz@Jl
zyOuIGyQMNBt88^k{`pL#*{zka*>x%-^ReZO%&uD*AF&-`J=>?mcCzncpQ~GP#x<ej
zwCh5hZlF^+k~yz49CQ=ra9~RQ@{B>4qk*aUm^(xB(QpRlqvZ_D$I=-fx=;2gv0dy-
ze#ge2e1?sW`4~GR^HFie<`d?O%}3Q4omi9DJo}8(#26Q``t~J;CTFs7CO<#M!F;Tp
zq4~sg2Ij-t8JdqSXE?->#0FAjoR-G0i1na{Z(s8B7i`H%Z0yMoj<GQxKhDs6^g09c
z(eDh*$DT7Ju^(df?f2|gVhij~3{B2wXHI_mjEVUeI}`H>ai-=I=1k2;)tSI8U@;EH
zi~XCQi!%yOYh}0yx>YyhJHzJf&!BgCwEu_1;p1Gk|BqiE`v*#k%_qW{m=BjTH6Kl9
zN@736VVo|`Xq=wTu!z;S-)Q>djN^YEKYR9P>-Nadi`!#E4{lEkE!}SlnSDCOz|rhJ
zm7&?Km4Vq~D+9CpQien9kJzsEE3t2W&dzwVf8BKB?b{iWkFatCJ_fD$N`C)?joICm
zf!QOJf!Vo~q1i1JlxH}M)7c?*vW501=Zdp3ySp+ndxSDJdqCngiQNgTW)U06b)o$S
z!6{yET5|d}CT4e6re@brCT5RPre?QPkRMom`#~ly0-2U}oWaP&ZYrq$gtfImJwniZ
z;-LMTkd=H7!#8!x91?WX>RQ*OYOZ@w#&L3s7sKRf?To@VA^kz)%$p359-(pOO9n)r
z&^Yra!_{!*1wR><x+gzXXBPhsYGp5%nk=r#09us`UWx3^%5e7ZvR2T_%$KIEEU7<L
zJq1??x?O7xYR$DRz1hq1afb4Onb7;sLHCtU^73kR@&uJdf^N%NgIWV^E3Zm8HoJQ<
zGP_1GPL2SNyD&}`ZD-j0OpI|m$A5;+Uqu<2J*pU)-Le?Z_B~>EVm+9u*nF~oax3cx
zCAQptP<({;U+kaUc8bB)ZF9>rhUAQI40GL+zdmP}+cojfL>A+=5XZgX(R@(Z2%5i2
zKFG>6`MW7Y=X+tcBmZ8Swz?-vd}RRLy#ne5gIre_dKbJ)6uXW@+g_|XKrK2@YYx=+
zf{kG{Fet0A{8`m$)R}yUl?!C+(Z|AUNB&H-ZFNtU{>ss;a^#P)%9KCJXINM!bGQ6i
z)*9F5*UIU=)Qi=N)i#+gl`)w+lr@>nmAP4^<qt@1S*xP$W3kl#k2yI1f$n_xD-N2i
zd3=%mA4mn`iez?BO~uL3$_^3-wG}}vMWranc$ix2r4Z1{JdoPt>nscp!ynK8^5?NE
z=byhJ7xy>1Y~BAc<Rd(^K;Z*gGcRkN?9IvmS`XFgo-Fnq9HXFcstvu1HlEw+zN!VZ
z)=Zf5$lq2^%LSm8W^&XAhU89jM$lNqN844ckHbK-Z=jJB#JDUd?Sj%QDE)#$eN~H5
zt6ry3*L#Ka3nz1mG8l7OI;zb~E}O|93%c<;aVC>mt6$qC(2kuwso;AyAu}wX+vh<p
z1H~k0JOh;KAhTD=er(_|6NoJ!JB&I(yF%U?Bzv$jH6M3jXg(Igz<jKPf%$j}1Ejpa
z*ssKH{OmbHa^6Ys=*@eD{0)$iONiMZn?U#ZfO-m$^1j)fm9g1Pl#$uZl#$t86<TkA
z%$dXrDmRj!ZwKXU24=TVhGtiINx>G_@7oW`*N)=JX`uBwm^mBaZjh^uI^Tbgzn1LC
z%GP|mg`xS_6b9yFTNs#+FF|to&Hl};=8VRzTNskrIGJLIndMOU365KY?~++K89*an
zjINLwF-%vS|CQ{;%GG@Q2t)I+D-6uXzA!K!e}dwQbJLT5EazZ8&ceWaOoXBNs0l;!
zF%<?Uwj_4+Hia?USBGSV>m2ZQh3Iu2V^#yl<QtqU%*R=nnvaSwF`qDDYCfidULK||
zXG+dF%CT<>cs4`f{oKft$*i0Vti2%DgHi)1eZW#jVJOUBAelxNWVy$OIR7ypcVTQk
z8p6nYw1lzwSPCPgrdq`2*$*nCAOCyy1MZrm$gc4O$Km6TFMk=cn>#+PI{wY7ZSQui
zwzb=RLmx|W{_xzN82VV0^GD`(*}_F<mYq6v;?j{@2ine^J9h0*+`XhbX}7X&<XvkJ
z(CSoHJMzn{+p0@h<;$=4AL6&HYDsov<(kZS<ae+4Qm<vLexOnQ5Aq9>xk?$ERgV0g
z=$_0T%KMn*>%YGt2eUxq&y%~jKJ@yi`b_jqKElEV8fo-uO|{nQjXf&k3epW85xfDJ
z^8)oQK;y{^o3Hk6{vOVFw^z`X^JugBk>AOTzu7>$1>S$KU%#p)*`F1Z55RWE&wR`>
z^*6}wWXV?M<O?ip$t+w9$_ld>7=6Dvq`6#kar4~fspd7!i_QB}bW+Tvm`$-+txmD3
zp#BQq*57|a9!qikxwyYs^~kTNw)X<}|2u+Ky8rrkx#jS|?T^o~e7YJUyZ>y+V{xuu
zwcD?TJQn8q6$|PMg6EhR-FmG-eNIsQhf#KPg3c`1*7E)X|HWh%Rvyq!&R)aHqcV;W
zj^-Ty875zAXP7L}&bax77^68e!++5DsPMdY22j1@m?q4|_Tg%;aoq{V&2_?zlf&8>
zAF*$Kew=ahj}r{Wbvqaon>RnZ#<=;}F-A~(1T-32*nhS^v|m}_B?D-#UB)%SmC+U1
z4zSsvF<8-d28hWZQ;my-86UA5SL|SbnGP~JjR9ur=4Wh-5R+#dxN`uMP9eDxGK*Xo
z`WIYEL-HeNA1tUuJD9Snv(d|(^FPDn7M2g@TnztrE|75zaTUJa&LBLsjWM!Uct$&e
z@bz{^;c0CQk$sy>S1|}*Zv(r7lhGGkn{F;W$&lK+u<2yKaM?G0-~Ok47yCo|Z}!hT
z-pX~Y)vs02F81rgC}j79wN3)hY=cJCL3@US&ahqcx&RqfXOLj_Y-MQnp32bdwUmL`
zdn;(h7c?6A!GC+QD=P<hAI^vPwq$=$N#?@Xd@O`9iSrOQ^RW^}=Hn@h#+j9j#+jLn
zi?~1~vT<f4Be)gD>dAPqf8CUu{kHBCS&~b?GbOi!ckBt=->1A_CHTfQCZwAv)u6jD
zC$oM4?Uxq#e?su+WEN3|$J06gT-+ZTn%u(40Mgg!aud9R1vFRfcMUXG4XVfE&Vgp4
zKszdpy0>+{|FC{FsN4nB>%v?ue_FjjbI!@fSy+}q=H5Q6{}0+VwW<X)bDw;Qo#pYA
z@c(gbpj`CR*01eWYvNtdeA8o3^S{PCri||e>@QS)Y<A~i@N1jQ%D@uUI`y$yE2!SS
z6oOoHCxLG}eSDeyUv22w?e7KdpP$Umz!LbC*`0^svGDgFYOSDpo9&#^8AzG{-BoSW
zx~XMd=X-(rwX53H+Rn9lweo^zDIqBdRC__<473~9?;L0i254X6`w#waSG6R&vNBEP
zI`Ws-YpLh5)-Z6M=f9QA<q9fq{!VmH<~L=8lsBN792VNJkbZoO<=@qiyWmyypgB&^
z$_9k_`LA%8e}z=@;r%oZNI&fm+ava?;B*Wc-{0$&{QDaNY}_x`0#;&39=aJ08gFlE
z0PFV%Wn^|PWn}h9Wjw?I%I)Heo1dpMC~<&VmwP>u|NMZP(da(Y1a8XVo8dBtLAyCH
zN}v{_R-?{spjjk={ZpHdyD%~z3t?=Ars+rQPHdnS!PS0H`b{qU&a|q{uidK+louM^
z?;0WJEl?aKw{kMv1h>VJWgx8@h|QoqJCoUu{9DzMYNUA<WFIIW!SWC&=YVnzsPAg)
zo}BZY3A7@8Bm3O$smF<F709|LXMATcWQEuca*-qJRcN~pl4?Nt9W;l=AhD`zUCXA<
z_YdlSYIP<1v4U!ChRN(7n2bA37#Y2i1;4XR=KR2v{7i+>c10^oGVe^L=Ho03kGswP
zZ|0uq5Z4CJp$oOT1CMUzp6YO^^<JA=TUhH-L#?i4S5}5wEho3<BF*Yw0?)$*wI+Fi
z=J!E)2$IL|&(-R-Ji3{4s)P7b1_oi))WG)w@Be7EL3YNp286ZR+OKMT?9KX1t&P$B
zTw7RcsO_qj*o*H4`hRJ)Eo%*HwY1mjy43=5Z{vQi?xp*^x?}glZdnEGl-KIiYhBm!
zUZDRwNWE9<UsF)ZfUQFZ<t)&yUr?$C%{4Me7<HMoZR-Nh?tkEa?0R-pOEM1^lZ>k{
z+mXLsM9k8?|G@vk_9W=8pk{YZ#%8xjMrOB4MrQX+Xe$#kI$`UcocEn+Bj@Cwl?=(9
zoJ@Bdgj-n{QRkwut#FZbPfq#HAl!NcTzW!U=AboEpil+Px`SHs$_sumFuESy&M1f|
zXFzMCv^tGi&AK3E&H87n+Jf34rA@CfB+Y=@SCD!O6e^(d0J8dHRSPt3Ec7}ja~}Eo
zUf}#AP+ky!23py~W)2#&wzQT!+N^fuuOR3K%7$kw5FJNN-wW_RK&U-t0#bX{a#gz}
zR5hb(a_2K7zkvKP#~D;sf$Mwdd}t_iJ~R?(J{02j*j|thka`FoaswYEzd>$c1l71&
zoqAn=LmEAowKBSSwZ8xGem-=C+Hn>JLHoyFSN>bod3F2W@Z{-V7$EH<E5=3_P^dt{
z1lA%YWN!W}gt?`*NaoJ|!tgUZx$!4cGAkEDE2pvocJud!d_`(6fLsm>`=|1Hotrw}
z3+SJQ<&C3qYOTD6ptjzs)^ly3UK^u(q8-T1h<XFTgOx*w6u}^{sznd9ms#Nb(N&$0
z_-d7WFTj5kX2Vhmwbp}Xs5ZzFumQAt_|$>0TTwUSu4P?--PV<KCGAq)xdslc?sZ*8
zo!h$KKe)e9t2fz=m7&!=`EWUNX)N;2;Y(3Y(VL=`VkX6W^37^xiUsW?2A%wxe1?mQ
z(VfwY(YMhBl;0=w9QiHG)ABnx(w+6M$Y%DL49&;C|9?E&{C};~V+r^FuUgaEqFUd7
z;QzR))%GN_+L7Ozd8aWXAFX9hZePXvsx=8D`@sIcRxfBRO!C=PpcQ<-AA7t1e(dn-
z-^uO9tTP$j3-q7d%)XOxa*Hg3a)UV|E7wI(I${6H^fCOg*w-(iu`@xttA9Vf@BX>f
zee?3^40C%<O;K)OVPNz%-Oj9g<hShh!dPB-4GSuX*{*?FT?`VdIzhLbnsvQ@@PEOo
z_GDL9hU7R-hQHy6)C|hmPTqE{pfs+m$MT2K-8Z_?9aP^ZpJZX#*BaL5*P6`qk}0|C
z3)A}t^FOU>PxfVHNIt!U3A7ItBL7(E<v+XbpZjaWllh-A6ox+*eEREZc;S9XI)BCR
z*hBs2t@gt0AHx&DX%Cd@K&uoO-8Py-?z#n~B2azu*oPH7O6?m8;=%F)xK?93@(;8U
zQm<3dp7$YWj0UtKLzwOB|3>h7Ku&mj2Bh<`7sMP;I)#{pC~rXJaMTI5YoHd6UiYTX
zZCzHN@aY4u@nB(eyVdH|`u@TH$E#YB9avd}xsUwiTmjA159U9Dv{(FE-wUjtv8pYq
z-4EQJ^E9Zu3n~{M&vE|?ngMw)kiWU`D=3s<?I9;`Sc?ecE5vF`;r6fpzlJA2e$KM4
zQwvmIwykPOc41{=bo(3X)hf7RRjXI)MH|riR#3T;+-}bJ{(=3iRV|N0AU*_@9<Z|G
zWeB#u0B8ios7tT&y+D8Os?Nz=q72FLD;aoKycf`4vzcY8Lo16h=S&CQgP?YBvY#a*
zsErrY`d+|)`KoqMo^N#h`J2^MZ~^johmsd^OCMCbF-U+`?84fa@7q?j39}#h3n~5I
zfAIgNc#v81$lp~hjh<RFlhafgSr@c&CjV1m+{`-DL9O+@Kz<u5tFqpbKdYuZE}8l7
zXe21?K;^ApD`d|h=w@YfF+`k(odVe(bOu!afNGy@UGEw8|3h^H|2y4-t6IWZ-!sVn
z1-V6-OO!!vX7X1R)<#c7kZV4uutHtKF#j*;u1nDPm0Ih*Dajc#nI2DY{||}T^HU3d
z!dwE%JunykjeNTu<jSktk47Fv$&C=#LEYB1t<$ROJ;VJkFxOoJrMD0IPjruhT(zo2
zYi4qWD&x!r$sL?5e<hRut1!b{W&Z`_s%32;ckP?<xM1c#P+5O8Tv_24L!%qaO^{pE
z&A>VOF)P=<zhL>J+aEJ<{R6cb9`1k4#RZz9`U}$c5Xq&WFoe|xt_Q)j0Ym&Nh&v%Q
z@iWMN*$@6V1<!)kZ}_!2S|jWQtz!n2Bh0Et{vt#{BCwbO^$7jWLCPjAP}$V={(=AX
zWCvC@SPrXSv#KT8os|Vt0!@F(z%aRU<&N5D%@rWqM2$sX!qoj=xvB-USJMv^pP>4`
zEew2`!TS&W=Y!fZe}deQ?2^iu_*1PF;TBMQIeCLz1j>c5Rox5%(|<BCOzu1>0bWTM
z{DDdQCliA(C#OWC3ut7ul|_)V@%SC^sRtkxkB=d*<_48FpgIXu6P-E$x;YY3H-T!T
ztP7wz$?zrAd?AqT>0g)_Cbzf<F?uG)ePEd5z{)w1rSte4_nC*ArVBm=sd()6^B<!t
z_WFt`_LDEDwi18K#K5fkmZe#pmqGkF69colIxDlLyV}j$;%}H3n00*E8+|5o9r+E~
zA1(fii9wj_71vzfW=$T3zafm?khS#JKz%udfNE%q;yeq}djo}NP+8;E3fbE|6Lc!X
zZ_ud_rGHg_Cd+U$fOb#|PgiFMnhqLQ{>7lIWX{Oy?YbW%eyQ{Efxn+XE^6fw<azw+
z&ksiE%p3B|gxV=kxO<%dwGM<?9R${OzF%PfQ}Liyn^q@i$M$=Jf~r+5jAy-CLAShu
zY6j#o&Z~8z_NtcBkLco)SriUl+z%Rg2ld(6?)hB<_1L2>fcordr?O5oFsy13W^Lfq
z>wLc;{!=n1tAJM9sxDAl@x8$ZXRR*Ir=XK|l0~?fK<6{u|AgpwL&nRKd@lJo`NGza
zf=ZDOnp$0jKPQ9swS!x!%lg5leRzKkG`0qs1Lk#4F8<Ed+3c7NI$fpF6Eqqp%+38l
zn5X5>S|9M3_@7QrMc&7^e*OT3np!KfrY~qziV-{}Hyu1mR9?=wu=!^1=I`l@cYEJ|
zh@S(xANlcN)<5q**!Qh!O=?qXeSC)X*L#BnZj;4387GHzG75`#GJw{DmNN=Rb~4=T
zH?GWN1f8G8`1bMi=|4d;)WX*!9j>)r)wR8=)y25KG|F(hFqgtXL(r(&F$NA9M{{-s
zhC=aO(^=hTK-c%e`p%%;0pj177=+o>UWhnFIB~e`n`SqCf)kJPs_7lhwPJro-!n|G
z+~lC-;>g(40LmB34xIwG*4mDN@<!Y>M825*i-}=!*Q&?O%ez3ML7hh3$vy01pp%4>
zo7p9rmvb>}JZ<RuenI?otuD)xTHw{a?;RARS9MChY*zPXn0Yv;wP|`#>wAU`W~(}R
z&jz)=UtoV7mT!`x5Uo5=uJLRA6bZ^Xg0AmB#I09eu!<q{<77^Sg9rCdW;^m5x`(0|
z5{K(It?Er?W)%XBeDb;{*L@f0Y(AK+toP*?qo+B~e}>83+#e?MwETwT!rqh3%Xt~p
zTA5d4#$G!#_R7JrSKk1Nz2rlz9PdB)e_GX=)~42)e43T*y}<!3ThN~F-|s)j%>t!`
z<Oj>ym{nUq{Fz*=)1NUhG%ssAv1*!dSU2Nj@oq+8@ot7GP8Y$eeubmEL9tw24H~Ur
zT<WUp)_aI~c^8A(bY%s1#^m<xEW+WE4y^3S(~dKMLU-Hr8HYhW<K$e(``G#Cm!Dff
zVIntAdC4k<$Ly@{Kx!UOWPbq?-8V;h(JF?=QmoHFVHLWSc{vxu<ZwxcR`y-f<{Zl1
z|1~lbzUp^XyIxzdI)lmdZy?t$J7zYW!+Brpdxiq0P0;iJOGT(E*^a<ePQX;zq1R#7
z4oY>?zcMjQZasQnitD~<9Zt#p91K$&w@shpys6EpZF1}P|L++lFv9G)f+q8z9wq~K
z0h+n4yK$RafYaOq$mSkn-~hQ({5z;LKE4e!I||81bDYs~5-5*>SBNGbWao%*WL9Qn
zVAeaz(CXf-!OF<2(aK;v{W-(tY3U5L;+v-*XPkWF1cR}7I)fp{X0{6sf5kU{6Jy*w
zot;tG{rmsYe$aj5Kl?$eRp%TGarAMOaFlV~#AciNvhNV9IV(HE%ignnLG0UE3m9_y
zL;D}GZ)anW2km45>5w@DnJ-UfU{!+D(V!6=P@g=;Rha#O{i>F~;>ii$6(n3IrYF~Y
zmy_|_c{s+i^{|BRT=(QB&*egVZQYX-uFHu8*19L>T$hOmOn&)X=1xfK;TaKg-IE_b
zm$?#Q>z<r{U1~~9t$T9zb*URM$uFKuf$VMs@9pnQt&IT9;etdu94222XXs)xX5R`<
zyX=e?Tqd`(Gd(W)_K(rM)s6KOZyKXVtE(UzNc9|tiR`;TtCAQ&ybg!W>_-`PP478;
z$EB4`kp1!h>whM<yRZm%xCk(M{*9c>@xfkk!AADvK6cg_&Z+mWIDfr$!R2wrvwx4%
zuKk<f{`m2Uf63pUF<7;M&Vn^--_(|zXwILUdy{7}>-Ya%tPne<xC^tnGE9EP=AbuC
z<j@soR`!Xkk3T>Aw~_tvH1^+fTo~Oq9-f%W=qB9k%FyZ|+|kMa(l^IpvRF97y6M}d
zPXO<<pW`qK&IY-gm2um2(0Q|STv*v3XMF!N$7AL3J05GF-wA1be#XI^jiF&Oi_70-
zZM<yn6W)JQYkgm!KMT>O0kvj2(}mlP@0r}*zGpM*R|c(V!mTXKiPm#GX1->0ef(SV
z?;RIL*T>V<|F*h6p7QfghePgmvrg6RyE-2i-TZWSKS;Oxp2_X(aNRA8E3M~ve7xM@
zuyucFXyAUtyyo=lObpG-)2rq<CqG%v!o>>VKd)OgeTwtkQ;?d$tzE`x+w>XEvWI1y
zdk_0K1vtm}gVsbRvTvStjA0Yo%;U)~zcDDX&+UtG{`(t}0%e@{O>1?Z15J;`VFye#
zPl4KKkTGmfkFnKL{3Zi~FlVOX^eYSulUq{c4Hvvm@ZShhD|yPX2~=`FmN5JO{({~C
zkXSAJyyQ)u(6I^EriQ&oA*QmO1C8A<2+VO@*Ru1p7HH(-L*5~XZ`yO_I4A#F&VbzG
z0k!f#<2rf=V18bn4?1D><9$%sJh_dnVusTdC%fq^he2^^&UkTqY3NDts!33Z13HUQ
z?GOWp_)Ac`(z6uQs$6(@Rm=Midb=TZx~I-@PJRwP#r4CxoiIDnGeLIDJPkUz5LANg
zn%?0I8&?GJL2US%^&_aZyvzfgd;_uN+!lx}&*Kob^lgUO!k!GX#ghSK1I%Pl4GvoS
ze-t#vdyPQ?VupI$9B0r-0s0v@li7~^1>NfNc{=#4{olplv-Xeto%?t)y8?Uh1a{Nn
z00Gm<><ke01u&ZjES?}}Y7_!W$DpucJI25PItlTiY2-l}$CHOWJX_saS(865XJPf2
zd?TD;at8;G@VD=b$$yr!Om1aon%LXuCfg^uAi3u&lX3fT24nFT46W=p`yRho{;zlf
zhiUN!G1JFSmj9W|&cFe-tw7L})t=E6<V%nb*R{h{JzW0l<^D!DIREAHA1}9;hTep>
zVto$=cur<#s1art`;+|oIR~?bE5k*%<Y#Q060V!u*&LG}KIe#Wb(%i2FZs<kHXcty
z_T(2&**3RrXZS1j*CYAS4L0GjZ_Ja~J}@WCTw@9GU3se2ZS(YR41dKpPkY9&dHQyS
z*3`{YSs6j4Jg8J>)@WrEW^ZNuD=N&|%K5i1#@YDWc7}<kIp4`RE3$8P|H1IJf9CVY
zqM-HGkW^sgQVL!>4Jyk);~b#zW=QW`tIO1WRhQ*kP&@tL>FG~EeUKwQa~zhQzT>d*
zyf`apWSsTnc1}=P)5ZAy!nyUrTwR>PoGyQRInOwpYV&KGd9uS{A<O%O^Xt4?-zUgl
zvV8b>ipziTt4s`_v!CBzcsCtUCM9`=wO#^`!-Luoc{5HNi2OU5OX1+p{b2s|jsv+j
z?>KzDoVa~e*URl+qi#Z5o~(yh-9;QHi>ot$YIe{bip_0L8I&8oF|e{fE&;6#2gMj<
zg$3`SR(H@U;LUAc89+Uf=3{IOPSg1r92i9ox3WJj{suk68KPRob!u}fJ7_23uJ+dB
zAoapCN*Ro%8*`j+=**CDJU0E%blCY^GKU1&9*ZCUC*e4G`cVdRHU)-F(?PX4$UR0b
za}FWgfNbhiu&I;5rh--^b0*6;GHb9g%$j~|`X;cuKqpcQvON|({twc^-o(0V>b|KU
z7f*q%ONO{r^JMY~Ru)h@VDj`(hE{grhzJH_vjYrvGmO~|I0#QKW#Hm~xOo@Y+zE#T
z*&j>3_$TAIiFM!9?d%E+FjLXi%^!iC-lNsIsU`UWD-)w@@^Kc1xo(VZpjk;zb5NcD
zl_?+}f<#;GD^boy&^!psp)#%$&$qfWx`{Y~!qN=v4uQiGuC45k%fJ8gapZ6W?Z0@-
zX3i$S@IE2_ILKs>si2x<`g3p{qS{E_S%`O-7@F7gNPtc!6u%B?Yqg7ldcJFqPruE?
z(7ak(6zMF)*Gvq;+^6M0Cz_$0g{bg=8`|pyorS1yARD>YOYkg2i2EgpJqr<(8$r1c
zH2R@-2{i8L=(-NHrfI?YPSvBr>_-_Uv$ryUPCV3VpUm#cu&Sle!>g6iqtT7g?Of}7
zgN7)rPS&^0>Rt>pPfu~4;c&-6FwJcGj002qlV2QXx^Mv0BA6hm)hYNAk^?~_Kwhm(
zk)RS4bOzu1)~De8B4@XkM*akqW#Cgare9%VXkNm?%)lYs-oh}s&4od&?Y)742;)<b
zc^}L`F$P)54@s5NuQ7qn9$AjQ<HP;`W9W_#_y3?6HiDiC1JR{;5TftcVr)A;Kzc#B
zIul%KO=dsJAac^@D6SnJF|HDxGDtf<VvfRge8`-Hv?3VK#yB>fhow=(>6)Na2im>R
z)WCRF#udK`-;<#DQo96c34=;e(2Qo%5eA8MEy*WYIgC03kFDy|1Dy%}jupHc5ckRD
z;<uR?n6<sZCqRndVq##{@_Nze1sao?dYV}Wx)V^1hoO~Akn6obKrCqf(63eUT(i0l
zbRS?TW9UcF$&mk_NB#u)AaXzGG|9)0e*FRQ61SIz27+4|AUA{37^uVtrLaWTb)D}g
z?0>9!bX5zZyBBz8G&nU0Tqx7(6nzWYJuKYn!l1m!gmKOR$i5<Vo;gP#tajNuN8W#s
zf1=gN2~Sf<DQd#~2e6a|69t_ec@w-=64GLWtwho5+V0BFu&N8Z&%BjYh0#rzm4VgV
zlb>NSOM~5e2K`Q9PEHlj2<&@?{En$7K)wEh&=a~gm;Yh_={wcx*T(AlSLEk^<Q5rh
z3|g2q;o#ftkX9Y2O$W1iRp+LzZ7o(^!kkCJ=Zb-LNVTzo*6D0y?*X^NK_bHJ0-T`J
z2|#DXcbYrCZC-xzKg|9|><`<M53=)sN@$SyMt0=|;o#l|i02AEDG8)c(_Hl-NCZXS
zQFe}GJ}#D{UTU)pSD?$bvLqj6XG`vLVFs;+Lzq7U;x4coKz4ylFE!1)2pa7I&1HaA
zF+xV(VS0qw1z14t2dx<KYIQWN{0Wm`1-tL&c45|lg9njDd4tY?(lcm=2y}|SQMXy=
zu5RI3q70Lf!b!ON7eDC4C$L%SNB>Xe0)-O9MSiWCw#hQAe9g;`poY{@b^);Z<wyR5
zLMj~^Qb+#7Ldvi8sB!FD41FhIA$;V&aF!H<a23dI<pu6={RhF}-s$Ss>S}C@O+QC+
z12+q+*JLgMCSmRgOvxSI>@b%g^iDO_d<e38BQ$j>GyG)uE6vLJcqaEBm}=zE^lRm{
zW_$^gfrKU`)g$I~Hi5^IVQN5jr85SCZo@eUIo)3ElHWN{IRXl4NRFJpO7o;vC+LI%
z&{+kL9J#?3c3#K1R$*382GDxli#n@XAbAgD8*J_fbf1CzN{}m%ML}bqF#AB|RopR<
zoqp${PQXsnU)8dy8#K=acB%T&|BUXF+mEwBQ=9tH{}YjN1grbxw&QFw4sm9Ka;Y#k
zcOfK)S}u71A?{o<CpQl$6eqW{L&I@mH!P2Gy4Fg6ybrbmoHmpflrtuCa<PHTY4sN7
zVGx+i!(hOf4KXj7y9ypl!tJ1&LfRRHdASQg_S`$3%*xA#YR^Jsdt^V}2g$;6oN~i2
zhFYmsuE%0rzp$6alYE$bLG>Zbbr2h;GgfW~l^;K$`2!SsptIRQB`GMEfa1-lYg?C9
z4_F@sA-8W=G9NcM&kzndh}+y5LE#qGCCvWk|E^iEP}|Ji#hA>%!zRoF2`Rg+$xJ+4
zps>JUuFS{#%<fza$-Q3i{4}|ZopHt?R<6f#RlfySfPJ?7$baE<b_IwGXBNn2VJ<GD
znBTV!v||d7JyM{v#Xu<&G;0THfk4*dDEWXw9Tdh_L2djapx&K0c&D!W%ZP&z*6}Mm
z2PKZa|G@tj)aC%SAxaCCj<OwBJM4Av+`UV8uHCwI<KDGLSDsyZb>ZDP2F_$wR-w($
zk1`mwCm&!J+SZxe%O)Vq)$;vP`}AWBpf-wz_%YDB5jQQZPGvooZ^}9>-`)!-6t8OG
zJ-Ew3%Z1DHTVz_)wJ5jfZP98m(_+|Szxk@Q&T{cgY-(s$ZTariDt;PNZ+92Hzp(%6
zsxDh?-jmE~+zg(lL>#9d2en<*b0ileHyz=a;oQnHk^S-PXaDw|y5qF=G-xGy)AUs>
znft-BdJpm!uIdJ@5d@uo>+&7qDm8hp*7q0YpD{fMs>#LAfM#oS(i?q*c^eM4o^ICV
zVYt`o)ylk#m*KsDLd>eRur?5X>Y?W4y$mx!X9I9AWsLkA)|#ql`W18*fbI5GExOy4
zwU&GbnFpSEdH3fRNJen~*AUnY%nip@_vHJ}86;fixF-L8&cJbKjw_>U%%MB3GRGio
zC+OMB#~3(79GRE5{fF$A4{&UC-#q;|L+e{mkF*v%&e*)X?f;C!uyZs699i9s#g8-G
z1j~VR3W84sf%HgY`+tJs{TKs>gk!UM`+vxZbpej8ZlJNC#<!D?ef$3vqEo&7KkPJ-
zs~94n_6?-{49c638AMQvN|;M4ky)LKq1Qe6(Q^^d9QvlN_ZQ~>S=E~C!72nkjpQ$A
z=KQ^YL%JmR6cyz32~L~bE`M*eLE<Kj4YW4${e}ITk~u-=c)0vc4*kF<;|P&G#&Qm_
zI%^7K&&<^x$c~wtJ&64>x7xf~@AkaEFn?X(*=BXHelBJWE(RG#;b|falSL)KyKW}m
zfS7P-Drg<DaXC99XrIf?KF4%sRnST2>>n03t4*84`m_IPzcKqR1}-*X4pvsJX<aOk
z{`S(KnA4D!+VWS2rc6HuYMDR#By(MFDn#`8<AB2~$3u=QYlJh(Tn^QFEW-K$)boeT
z*}dHh^Y5}BQ2#DA{8<`$cB?R}!NHHvUF8Cf&FaVgFNBuzA&#u>o5ij(-0cIG7wX6U
z3wN|LC@b7xfYqlVj>h8G87963jY>ntqnXu@{WnBP3(ypTCJN~%fKtct|1h&)>7x@R
zeH@3H1}Y(7DFj&zltw_Q1CmZatzco+15Dta)&%~|m@Q!iH?2<1r=XTF=sW^YYk1B9
zQ2w6W{`~%(0|(vjKwHD<@8_I>gzNIJb1uwP!r9ZB;J+T$(}MXb#*tb5_<y_Ug|h{~
zXGwxWuaAB5w|2(K>>v0yPruFp%2yxzK`9@SV^DQYo@UPQuxr=!kFzJYv$IS9n<32p
zfgcpsppY&E=akJ;uQJ^1?SanK;R}cUMY<S0f(52porYM$LH**L1EAH#u#jN?3=0YN
zZ*wke)W97Q>*t|{1SE~7ox|uo5;`vclD1FvI0ayw7vTQyu{3h;k<#-5L=Q?hvK|(3
zk8w=?dz~T19e+O&Rke&ae$}!^WgL5tPjQcMOfI_4bi<qXFszp<<J#Ii^YG-Yq6|#a
z;q_l=Qv;}f*VMpz7NibxwyTWes+OsT!DiH7XPD#Pdbnx&92byoVN+2CkX}fC9dx%B
ztjGIyJL^dq$EgsTi?1`?@E65tGbH`NbmF>^qJd%Zw{Ofd&oz1@=Exzt%94EIT0eP%
zc9m^{oc9i{g_rFB?P6j1^ZtVWU9FzXtDu?j&Subz_}%-CS&c5+x&AW<b8&r`eiF3W
z!*iSXX$A&i?(S`%^KQIaTUkJ>G?C}S!=W>(?w}df3-PO0b^EnGKF$5@{eyY?h1o?J
z&b38>Ys~in24x_-1bH5x{_?AHKl)nLO)ZRW>pGcNu`s+pApcdXv%}&2gSy?IS>~YD
z_YdN>Gd{iJpuE7G5xMULnMZ)EGJvcw0G-<aS!K|`F!_5M^R|{%okm@|x;mdv{$9qA
zJe^&DdASz@Xofqv_`5*!GA@S6;^GXurZcZRrYg*H<WCp-BWT_8Z26^DzgD}M?=PG`
zRe2J$Ghm^6viNtN7|1D7*`RO$olPe^t(_sX-?*#{bcz%=_lLlK(At2T{mM!|8DM5D
zTMRPm{RRDFf#5T(Cb}mJedmyI{OTq=qaC&en8CQboY6Sr1jE8+<BS&!AX7G{|6mYq
zzy3e@^)r^qU%oJddLqgyGZ`A)AT{8!c@T5gPh>m^IxWDQouT1ozp~0t@VqjkYb(3*
zqF)T?>Ee@j5_r!-Y3SYUpc>}rc5n(hgjg{TTHyyyGyfp=q)pw`0@`o*{sR9lNstfz
z&2ivt-Zgy=bpHz^9s*B-di_C1V5{lE4lxKAb?Kg4*EzivbnAhutXAjy3;j!1wI+MA
zvOr8`n+$4w*>7Lfn(WWY<kkBA!26G@T9Q3knWmp&V3^$1H3_u-4WwrOI?$LPXou9y
z$4s+0UxG$R-yb;taaGIXc-BAIMj}c>zk<hNK<R_+9%vm3B#l7Q2V@mWG6yT4UU%|Q
zR=#cBUk@4eKwPEP4RY!H<(V%hgVvLP^G#YecqQV6_bat}V^20~9r-i)mK8&C8y8m}
z*TKwHv&^~vGfeK}{4o6t1H<GVp3cq%?=RFZUe&JFmedZ?dGm3zx-WwwFQ}~n-sw97
zvYXbp!h>;PGiX=Q=I`c=cl(-VuWDg^o7}aE6}0XEef_y{xjQt!nS=A2|Cd!QX>DGu
z%UU1bWcdM#Y1F+bpj9%ky`_yVN4I|s`M6)QaM7J*x2|2fcdqT;sT=36UAl7X!lN_K
zPQ5zu?id3jXkE?$^>tmFy5BeK-;vD5>IFKh=m5|AhWp!<^;W7R^RQYRba!-BR#N$`
ztitk3S?$ZO_YLyfw7QbnS@{^<uC;=0==#57RjV)?1B)<gC*%7E_u3Y7bFxfkXZfY9
zz{Q}f#KoYj!o{Gh#>KF&O<Bj2ReT$$f6!JA(yOfY<;VLA{ga#3S$=gkgU;_rJo@vn
zW6r8hM(^#s{~16hwF&bc`8jdHdw~RjRqfAO)moD$vm3n^NZ^n?$gFzg=lcui{;|4G
z4i9zcV&5#boI#lV1N)`v$*Id3W;loTgVtKG{F=y_9Qm6Kw7N^Jm6aQmmyye~?a(l8
z2Zu5Ly;VI~ZECI0S|4BM`2o7^=Ke~_1(SIc4l=8rRDIv@e}z};`-b@|z6GR(TnllF
z+!m=8H7$xQ`kQx}kDKo{-?Y|iKAee74b#~`y`i?P!fY<TKt5e+ysF3dC!}xVy{K99
zv?|CwbI*fr$2r$(=r;L#JM%`)uiu;1TYfRCANeIbRh+?YDi`bIHgSgJKhG7K)laG_
zt6ceIH}(AkzkeXTKR-9CcdIw69r*zX(X?b`ou6vgTK|TtwJPg<`SJdM{6E2?%<3$^
zdfk(cJlAMm&dreA8m``~egt%a#t&tMpK1`DZ3!S3zCR%U8=`)$d-A#G3e3y785-S_
zMZ+0ED=Y4JgKSb(g6Uz4gXp>c9j@o#a~V`UbNoSiT0NCjV7k(xLAsRnOn$yUVE+Z8
zv)4WO%ySX2>$<~bL9SC)`>EFG25}o(BuK~m1M!E9O&5U5LU8I)i@esVtg%uJl=}7`
z0Ldt8tyF`QJgPTAqW|x%>Ur$Q`UJG*M_GgAm$DYiFVHG;Wj&T(?+@g!TGcz5^T<!o
z&P2x?VeSv?(|0p4OzzeW<@E)nImQ+5z$ttEs#U$oPOMyhZD2lwK}PCVX7wXKLA=NL
zum8Mf_z<tv4)SFjSViXb_XqYr(`r|1H9g#{#_}sU{w|Az^LF<C4B#^ZMZtUP87}tz
z?Ne;N+6z84u=o9i^V?SSJoaY2@p#&*ACNTNcTqSz)PakAG8@b9UDH5)yyXm!(^r3+
z;1t+D<IvRYp!B$OcTnrsnD-6m|Igh#nU&?Y7w8VsPpf(!GqYY>xOrdC#LdK<B$oW;
zCmSd}THQ0ZMi6oGqAgLXF7E!U?(h+m3L|%eQ;$E0t-4jlQ4P|IgYNu5J_!$Wn%cr<
z&`EgjFRWj>s`IfA>lIM!y=U0q`IwFMiZI)epWro$3>W-OcY{J;EA&iTP&)up+Jjaa
zg66N^U&!10-r@XFtu9EKc)A^wCid@1_F&}zn|Z*$OId3PsHf`6$|B5p<j?e-pcas(
zsTb(Z9fl2_tJ>9CJKr~}y8M05u)%RvJLuG>&f{QyfItL@2AR0N17gbKP}V=7KHkd5
z5c^Wsf@Jq^1=n;8kd&;Z3_3r}|M;rbWLH+u&4vL5(V#LMvBMD5dYjDE^7mTn-^fHR
z(EP9XxBvfz+1hf{T9vg-{wnLZ{8iRd`5R~evj6dE)*p~k#;sYHjpeUetFi{mA4Vh4
z{ad>CL3`<$kA*NaA1z^MK9<7Z#P*2&Vn68QyQ}?T?8a@+8J2-kct8QqV?Wk!*IFSq
zJxfKkNz(#s(=pah)4%=yKe>%9oY76Kwa`Lye=;L0AEd7Xn)Lwfdti`&_+53OR_FTz
z|Cc5^uyXtjSJwLSr&!D3BWNxC`wjm;t!hd3W@VWSI$wDOxK`g#{{_6SngzO_n&E?C
z>Q_*|@bN_V|6mmi8#F6#f>t;{!tt3DSoDDX22lBN<ZrKg^5N%9;%wkrW#VL3m%pI3
zBKqHu$HPEl4Kj}C^(%A)p%-$JA2jV9`2QCar>;orZp4o<F)*twixWLI{U~T1Tx*<O
zd!xJJf>!qA-s21+&W`MlXD|C_<T8nU-_#D*GvE_!Kr?ZTU>2yI1ZyQR2z=ILFi|}V
z@rfJ%-_TVp?=SE#)9M7R!(P=25pM(Co*JMK0^z0cgI3qP4^Rj`1(jz5-MAW{5Y+4H
z*ZMx-{$<XS$Soq!Y8i-5w|fws4gN>B*M|PwUmE&ye=;+x9;l53Y9XPn)NO#K(`T#@
zSFN9;)tT(csx_JO$RE%iB#4>ESU@Seen#v;Q2SoiJvsh6hoSrC>(7}$y^4dU4`yj~
zHF}$K|7V!o#RVSsU{?2HXjbcD5Wd&WI61DJQFwkEqwv&r&<P`q!q?gug(tUxc7ij2
zc10VfJ!3R3PG;Qv^eW@#9~q3ssYe-&D>4`tHYqkQY&K3yW7zyHjB)c*QAXqPa7N=)
zRz}cH`Ov<by|KOTH@y4W%AG92DhG0zA=l$Wzki%-gScAlH#j5?{O_qe*sO8n&s_K9
z`{LXi-8bL(!KADv@;AAIgG>A{6N50bvjejlGXrEKg5BX@>SQrDhJDjE%>a!Rf!4~&
zI2y7ZWSe{sJch&w+Es3xex1>{j*oF+vvK-y#<!qzs#kpb*R0<9UwIwdKUTbIWBZlY
zJo^Wl3sYYA?4Pp2VFpky18n-db_Ogaule@xvAo!Kn7`8AL;RKhzZP^-z#m`t<lygo
zf#CRX%v{yN=(U~mKWH`m2T<%x@R;Io$6<yG^NJ%3!oh8flLOirh3B;~3g2mCoIDjA
z3yhP6+ZiUywJ}Z>YGarz-N7gv-N86nzJmcAW4A!D*Uqr{t108crp+%T7&d=4W>jq6
z{4S4S^Cu%l;ovrg&HwEgjqB|hjq~~#jh|&R3P*G>7^jAULMLw@!{!$i44c2IF>Zbr
z$FR9fozXb$8>4Z#GNW;Y2BUH6Q^w8T)ftVSzhf{?V`JR>>;^+@@8;Bf4DUDS-Dc&I
zd<u%!i!6_Qe|=(fMJ+j*qGA0U(3+{M;GTdcxQ7B-?+%(3We`}`nS6qkX;TaDF##v7
zPR?h%3nsWMWDz_E9)&wF|9S3DP;V1?y*r2xnfZhCc|d(8Rq)+aYNsG;*g*R(H?^>y
z1DUw4)2xg0nJL&**+URh>t8(fWc`=S2RV}gVIE{3Cg{{<Y+{hL+qm~M6rN2!%gR%E
zYFqcqQ+B;SkAqH$d(^h8MXT%mf%EsY+G9^PYaaPM`RB?1t7aybnsOh^g5}49KDH~~
zALzdmcoOrx;WS3YW>BsI?T7}gEAg71{OS)|^3#`W$q^IS{)!|Qn6oo$urmmAx-$f|
z3Ws+vP8RK8oGjkK09hdqis`$(#uX8appz`#AE;lss`pV_Tw74<yVl3ocz?jwhJ$Vo
zMP41A*9zHHF`1X);K%)6V;}BUR@lp^tn`<`F;$Tll<$ODSwBoY4qCS-$ScSR>Q7C+
z3OYTZo#AYsaTy!q!sd&8FZ-|dE9?FJ_gGf_Z=-MEe$d$-ZRbFzdz?FV>BzN1w+<km
z?V+sl<X18Ws~Tt~1GHB<`4GFBR@b(!_XqY*(CSQfWmQ@Qy3x|%fW)fq<iG`Lr@*`h
zIjx>#FIJVwY%RZ`<;rZ(2}<t|<R4GwV^!MR-p#nV-JF?Oz2!G&bMlYp3SI20rYkFb
z`IX$rCE=KA*VgFL=mztVjMK8tR<_Ag+8M#VncmKDwg)sCy|DRa&&z&6w!1x#=imM_
znf=Ib$8=D?%N*1n;%5H<af<@~s@~+V1ws(s1Cdod$^NVY&1y$}L0oohJy_<z`Ms&2
zlHqr9;0Hdf{zkt>*JgEohO)L+K5#hRZ)X&q+|FQJyqIzGvv1(OX&QJmLa$knfAiCC
z43B5t{X2P*E`!)qux>YyZnM5`{b1b}+8HNL2KQ_kHh*3W)?EhHEy#bjua)ny)VIH4
zQ<M96_!#{e-DDg$^|A5`PitqKe5svr^89uN<Fqh_&HvYf%7(OWjG!?PLDty5$8+BN
zO@5Hcm&{?zuQqM7`80-e^S(__F8<83xpkYv=55;;jQR2$mQ6M0yXUZZ`&0(MdFxs>
zcOGX{UNDP6d65+(#NYZ~v^txYa4|Hm^kR4%&iV$_uUdFInVW~LS>5GV7q?@Ead$Z*
zqkE(4c8>oH!W<kQKr=X2ZLO@J5?J^u<V+UNe$aaFh0UPT!r2)Gxnuhu%kKFDGHb@+
z3x^p!A!n?hp0MH+yD8SI)y)%h#tNfbqo3%0Mt4THkK0QlPwr2ilFsn>?a@!-TfuAo
zroA`d|2ucPFlWQT*!_=xZTawYd-4HR0Z{$ybptet0cq8OZZJ0LOg*%!tMKf$mR+5o
z(|tjw{4%=fbtzhd`Y@n2A85woX8&2xt$BYzd$q6j-#sqOedG`5Oq5&DdhpqVORZt8
z?+@h90hOi6p&yuJ56U=#d&GF=RqpmEE6rqpnX#-FVut<<uo)2_m_(04&6o+U6&W_a
zgq>%$`6cpsW}9FBWKdSIWW+4JK`mcUY4~(Ih-_-`JqQYexO1Q|0G;L)1U`*E=}g+G
z28MOr$p=_DKx0j2J&?5C1|IR$>fY7!{=oUZRb86kwn=i_2c|~PMi;>q?=P(T3UceJ
zDXlE6oXMBIFd28wVgRR;3w>`_wR^Sx{GZnTsLikKUTakAO*6>_AXi|kVIX(xmWD!V
z7)Z;GK|l?1?)NfK3-nmh`vd)Lya!jch%W`jacj-{3+LWywM}0N8Wmew4eA5<y_9?k
zDfd~yH|{`GrdGYbp!XW4vb7SVa@{kCI?xz1s9gtYaf901keQaSQw$QZN7r>GA7$kN
z?b$Qxyw)ZTcEz*ORW0u~$p6#oiUj5UzXy*)>`*Ozf8pH|m>sSqL9OpE<UP>pQhf^3
z$>s;{V{M54Wq1;_tCrV2x$HZOpnG!ja|S_H&>2=l-PED*6KU7~B`?^?5T#LXw|gE0
z`2w^y19S#K&>04ab)6f}DlcGVm|hABBh|ZFo$ojNf0*pb$^z*%^n*@4@?~WL-A1zv
ze7?(5ThRERSL@8zTWvYP?qpuh$&g&~odI-O9=Lz7;r+T*EsrBXqlM@_0njMBC%7Jm
zo!ze2x%4Q+cGs)mkh_)a2C^NrQyLPY#}d_A-*5Q;qFMdOzvO@qETU&+92s2+pXdM@
z#f8Kn<jlR&(6jqNZ4}68C1|c)?J(PM>~rmqmBLG=&v8&z*z!YJ=g7C@Y3zJjJ%X<9
z54^k8aUhwSRVA5)hX>;Fr6-eG-*2ctm+Z+Zu&Ncr=AW~wE7_NoYchMwPi3VqKPIyu
z`Khe;<(n`k%P(d%mmk+!lUi$yJ)eSTQEShG&1y%!Lwu_i0up<_;s4E5Ey=9l7WL2M
zzz=fGnk_&5THhb&J3f6mXfA$v;T-4Wr^{tPVt&WCSRtavOF?VeL1TN#?d(#Z6{nNi
z-Mi;FtF<btfX4gI?P)&F!XV79z^c_d`TKX?<o@SurJ*ZVK<vz)ysGPQAnUhg6_y{M
zzQ(x&5L2IL&2dhCzgz?)*0&#K7dv<-Kyov?2xup!F#GWq5ocz#mhX(N+onr6&2hfj
zFLMaA?qC+yl?UKe2ggMigxM2VK`wbb_xU&G<0=f3*$tSJdA~C>A2(r`-2VK}<nPz{
zJC9FhPhfs5^Zm<2-^r{WSd*WvW!$;FmG?30-mjb6wlFduXJdFQx&5Co*9X>G@5jH^
zeg=uO@+Nb;Gd}*j_A^XPEAL}T_y3Q7t^LU8F1aF^JDr)8eKYGzhF0Fi{a61be_qQB
zQVCj7eX8^EM7RHw+1dYWZfj>yZeaW8dVew}%P-3XATi_ib_Qhz_J7mYfY#*tL{9GJ
z;Zj_%kmqq%&ClkgJ`8@X?=P&IpZc?TDG%t>+#kZ%zdF`->rEGJ=VG^;-mHG)huw4z
z=T`U4Q@1mm?BzKOTCK)#@Zw%!R)vE<;rq%8L8sg+G`cM{0?l!OW`99*VxW~Ih3VU$
zePtD92d!LT6Ih5%{@X7ms62-%7I~0dqnjmM22?J9$^_780%VOG%y!US5JsI>4OX>4
z))9bKV1f1%!`5bjN<UZ$rltv=C)r@X4s=RFqkD4b11925)mK*g$pABj?E%D;`zt}F
zw31?q2Er6IMTjZ&OF^cP<QA=;43hhK&w)Z4Gy~~%fPrIO%hZEfova7{hQ2>=eo?X;
zE5oW*wKlKTho+#ofvp`EW^FilbU%n}Y5?g5#T96k*!vIpzd-6hahM6NUqNF4uoebn
zuWkba+dWXfvC(JxD$tBf)@{(aTH>ogvx3<-1${vC9>ScQAJ%$4YYhX9lpXM&wW=rC
zgOv?*-xFwb{{4pi(@HNgYaIFWxSr>)aD)bfvKq_Z$!x9+jjoal9$#hsJIAS$bs-z9
zl?9qn^XxY+b7NfC44O?-XS~_}c&_<hR#)8hFQe<#?V!F`@<~=b&@NZMdyu|T&>h(B
z?*@)doyqKMI;&ceSy*+1xsLo+R$ybe1g#y9ozd%jzrnsInT1uWSqpq_-~VvU$+xr^
z95a;lLVknxnKinaGeg>iYds_vB;N>SmT~H2RfM}6bW0Veb(qEgYaN2zE&jLF9aICs
zY<k8B?w@a{Z*6o3-*EGr*c)y@ciO;AVfzm;MZPhaiB$r$do(%jgBUTRyUI&`!hNmw
z2V%<lKP0<l8Nw8|pAb|0e>^1BM=KDfq<w>!^8Rx&6J)1va@+?28OO<8ov;~FeD{E@
z`pF>N-pP5bU3mdJgYqJFhK1~prN94U^a7pUD$LFD$JQsPEw23*WY_YC{Q0b0pp(>?
z)mi?4&IG^NKk<CC8sx0-tNo3ql^48XP+oM4VIkLJ(XPME%TF@iJdXVg0MH)h$+x5&
z4yGsH{lz3aor`fh8w2BB_vBR2Iou2a$tBkrK8g#mZ)an0NY1#<l<dsT@K+o(e*c|e
zvsF0bwds4eZf9p;Og`|7X*)ZE0EjkcXAt=4es=p$aW3|Q`{%kVvB&NYYrpHR#9q5S
zto^OK@BY%zso?y)7uq^bKE>(~Sh(owsf%sbmt8)0{?gfNr*ECScl^=OXNO-M%)8$p
zY1Em_%4WB!Gnt9iPOnRt%|W2i)vNXWfq6HC*;zhKW^4J#=msvCKCJIec3`z(R&N2_
zNAU4xe{v_gRkIq)r)G7RPgnbso7k-;bGdv}R=UXm>PNsz$F$pE-5cItZ&r8tNc{b6
zh?22w3dDr-mj#b9Yq)%z=$`zFT@+^ivTG38_ZJ0^f^6XRNlyDCF`3<yMVQ@F02b@Y
zOV}AUvOkvm{tu?_*%gSs{Bx^%li68yn6+I#u60lTpU!<SLpWNSfzg-IXFJb-hRNL=
zADWl@GE5ecWiW1E0`7r>dbFU@2sEZJ4Lqj6#lHD_IiuI~tNk^HK`Q{SwJEEyvw-@B
z;9l(1b_UPB&0nW7E^PMg1F5{&Z*v^deo8wHamV|kQ1`nh=YD6|+`a^S=DqSFb{6F&
z>@3R5*jadak^^#>H}dxGe>J6x<<yiPM|gQyd6UC(7!SH{<b5pn_Y0%zz5u<Dc_Dm}
z|2*@&?s@rn@AKC4ndigj`ztm#v8kc6Sy}7L2hf^DMt2cMLDt7S*M70GKlc9q&v8Gf
z{5_bVti|#XQUaUv{Ri#g`=IL#D$`h*v6scipk=W*BdAPE|I_NOtnrgUI6}ffS%s5v
z?Oqv2(0J0pY|tz!sP8BYJuM-fabYuPcRpx52(;(kul4-~`Oe3VtY0Rxw0r{9Rer4-
zO?ZE*wZ1=azlj$#%Kr&u^5YivN38D3S}#GT8-Hq6Z~3gO17fp$R@MX2E}xZ^UNXhH
zCzpN~S_nF6nW<Tw<qIs%mu*p2`N;$g?{$y)Snn{ayL^0H_2!O@qhBjFH^SWaeuMu1
z$4;!TR<**+Qd<vlbN{Nx+^jd6)m%REx<4+vegkX{=<HA|vsQ@vo8E8m|Ml1#Jmc8r
z*E-ecu_)^kkWcl$JQiSm(yZR{>G1^iE3EFyYA-?OH$nWV0b;X!R@MU1E+GGc{8{^*
zX`#5X&QGvEl@)%nNN$F?kZlFTr~V68^*$D4y>xansHXq98$>oWfb^7x9^9?0@RO-D
z^x@{@gRESjo;2c)lT9s-$5wR)9t4dafW{FR-Sj%&KZrk@?8(Z87)986xEXYRpZbx%
zSNj*9zj9#40r1+0WuPAJvjwMGL7@cg|A!KHcjKHR$i048e;;(eRl~ui2Au7j4e?VD
z?Hpe4?aA2MImw4vwLl|&%TBeOJ9Prvh~KJ~WPVmPtFB}ob~U^1<W6=q8HeOHcC{FX
z<YsoY&6Wokx;XVZ4|Tis^m0lbN}kImF`297_hcTH-(l^~+MxGdKDfUt*@0DsS*-<h
zi|Ox+pwd#QSskJVbfS;4!fA$6t*mZpt?wVm?@0Cs)om@mnbnW{zS*DL!7h~C#?1gy
zue{(lLoyq<UH)5H;SYn1!?QN=X`s+$a|V@eF%F>m5yX1GVSQueNsyjix8(2NcsiSv
zHNO06bxUr%&f}Q9s#jT!<rkyR-xx;32`9WC*r8`)tny_5^-#fiU|KuF#oo=}`|m*K
z3xiKI*`R-ZRco>{D`-w<1OLHQt;xQuOyG9igZV#YpMw0EoN|_FvUnHc<j^k0$zoj$
zXZt~B2uF2+PC2Q{V%+@PoiVxNCttG~%WqcBg}jrme`DM>y|w+Z|Ics9`EwX$99Vgb
zdFD7OFPP5QtbXKI^1F847zgDA?Tn1BkkK>r6N*9OXP~jOMt4RJWt}g-l=WDCgZ!+l
z#q#^$*2k<I&mK2(JZp4=gx9gu_Y3B~f6T@D1UbGSa%|<GP<;O&{&un}D_gTVBqn0}
z4bL;Hv;0<8c*UTs@S6b?zYz6pB~bM@l6_fOK%=;zw${!5jmJUZ4~jEog*OZn_a+xl
zW8Bn}TzrPXs0ZYyR(8<%?BBh1J+j-exth@(w2Pk;JfjH8r;6K?PqK=DTCS%KfLgAg
zvsqv**R)Gn7aBOUI+K}Mg*J62Gq4F+btm((3z&5!cd-cwv$y=2%*OJE(QRGJ`v?Cg
zCOfeTG^?}x0gp&S(vLi-{Rukz7BmV1N|Wyw%)hJE>v|UCe_r?G3ec%Ipm1e%XY@(#
zf6n2U)#wRZ2RNDg$nVKKAJ`$Qk(yO7&s0HK0k}bb^{UoZPOsMFL#!<CH@u&-sx_|7
z3v{Xq)B6YYS0_(zVVr!eg;98V3n;aehchm0xY@t?iwon?{-@wuaRi@&@<#IGHw<=j
zK;f;(J30J2<1SG8IsfyUvO+f__IB8$7|6MSrJ-lRZK99hu%%9@_W!{Q)n%NRp=y7E
zR-t-+Dsrgyw<CwD`~iHS`jrNu3hG0`_Aak$`5OuvoqN9vbQ0mJRz~+_ZQvFD5A<Iq
zd$BSwy3RZT>SLmo(U5*Ug9NBw586GzcFpSos7K%EBFx?LcQO~tU(l!?s7}e>3O)&t
z3%rJ7gWkgT3jHg!I-}aJwSjg?gYG|G|LCz7>z`&-mcO9!?z8<rFN4+!fO^-xZeFc7
z`|sXnRy(QoUg7<b(67wLJQ<jeM=~@Yt7K?Co(aD1C9-c3duU&5pD-I6(>YK*X5dh>
zs$G04Xsp(i?eQ7*Z|@JBn*>_Rx~z5jG|(EZXDpD?L5<a~^}WFY513omuUggeIEM8L
z^5`OH-wkN30i-Sh)kJOQFlV2b-CP-%-9s6g-AWmn-BY3N3hi6O9^1FBQ<#m-VO8s@
zmiGn=inKbDU07Krv$p&O?Iqs70hEWeI$PO6`4@Dm<@8k0h$(9qNcMi8RwpD@Anr{w
z1c~}z2c6VLc%}lPM@<i00vaqx)ap(4V$}ehRaSWEU>2j#^f{oFjylTI=Q1!%?$x~x
zI!_BU!!OKz<TvA@=H(|D1l@17p|_1op>5-E#*6)zS|N5kQv#jkq}KZ0;DK@Ta!y8K
z^(|9?=}RzZUhYXyA4oOCMm9Onsm|{W9_TbL?_~V=92APg+RAnuWDdx+44NQ)%*#$P
z3UkRYK;qydr|Y?(o>!oiGzJNNT3yM`tXyfW?>Fpw2TDQD+Va5XNxwI6P;FlBNic*!
zHbGqcj2GhK1B#&afsY&6Ux7w&Aacu~atsQYTS2uuXe0$R8Ud=81N$MP5#ivQZ3W#S
zI^6g{rh!a<Z?HgybGugO+1-!Xxge`UChXt2s`Ie}>%D{NliS%pOqSJRm_8e{7H;)N
zNSwd<C_a~gL6}#U2UJUdYC6Uh;5mW`_jj!7eC*76tI;j44J@+Y{kPhS&syJau)9(D
zH>&+zTNXszfPq7+^RYkcwMI8k7*3w5#<02F-ErG=klUeYhQYWjjM1|{u%B7&$ghRX
zA3^l*oBd|(dedYMwX!`HdGjZ8yH=;_Zcuv`b#@FkcBRz`E;knJyZc^1{u#5ICj+y4
zBtx@XB}21&CPNaN6MJMIB$urM<uayItzNC~4IFHeU0AuMhk|laYAERBJN;X$T9dt4
zIY2u;?=J_R3CbbNb>xpQcgvsYv%uqGe;{F`eOP=B1A{P6&S6lg06M#r{~2UvV&~)c
z5A^SW?hy`a1J%THPrqNl|Fl{4$e&d`pc72%AFpbUYn^yJxfR?B{4?|Q`welYL8)e0
z>%F!l(CL5%4;Vo@-%p5Nw5sKC0P8Q@BVwR3n(Y_^$MmTnU$D-rgrAR&Dw8^Istu@o
z28{uNX0Jf&7#IW^T_Ne@*!)#3?-$tL1+P%!0MC7Z+Z4xUf=Uwoo4QAt)sFnz&d$&<
z`S|t!oK4DVNB#-3Kl`8j@;S@F3_;dLS498vZ=8%HbS@QozXj;lq|M(zeM``6DyVOn
zJT09;S>Y-p$kfT<-xxPdZ*5m(eSGBWAIOXeXvPcXHn*uDH`HHV)%rMu6?(c5NZz$j
zS*1}%S!tq-vYMcbvVx+lvYw%|vW}y)vR0t9vPPn`vRa|EvPz@0veHCpWrc;(%6c0m
z8@N}sK+?*;UGD|r4-0d%yb)#tg@jgTRO|Z!yL+G;Oq3N^UMMTEyiitQd7-Sv@<LgI
z<%O~q%L`>4mKVx;EH9K5SY9bBvAj}NVR@yj#_~#8gXNX77RxJT9hO(hdMvNrD;yAM
zbY0b{*7{!IfE4pF7Y63z&=q;dQ=p~3FSyj#>H?Me;1ziW4#HYJ$?mLDkhpBU2J$!m
zMlH}Nt6a0%NmWK)Vdf9a9ZsB2BNv@;+sI~lbdKBOGwlCBD~O-|PWE4{-n_z%A(@$1
z>Q=ij8_Nqucg+Q??5u3bT+1bUoF}qBo+bLf*_Dmq@wcV_5c3Gj-+;`D{h7?kD>Rv%
z<(abDmnV=CL0Rd`lgaEXPn8uww9C`UJS;C7y;^;h^}aj;g%YzSH$(GD9?<>gtc|W(
zpt=Zj!bdl=>X9ec+PvB!X{+tRWL5^I_X7VHF{>SU@(5I7f=<6|S62D*1W~rBomXq!
z*P48Yo$I}VK#(xxJVnN4b(bfT#X1=R`_0+@Gkoj=ovawzZ(RA4!8l!=G1;4ytyzr)
z)Wd#~e9f1!S?$PUWet`mGY$ziyD=nRt7Q~!Zevhh#Ky3BrY+;-Yn_afXLK?OPw!;d
z{Ne@!WDVfv7cUr?LAKoNWB{49`R7Z9%`Yq%joGUhx!A?qKs~dxntiQmt;!0*jPDf!
zJX*N~xm$T23&eh8^l4T&D8sDMDATOsD8sDDDATNYP?}k*QMy^nQJPtsQMy_Cpj5Mt
zqZG3)qg1o*LCK_6W}QZ<%EYFI$>O>U!tA_%CbzTyQJTI8bQ0M|WrpQ%Sb1f)Lc;CX
zc2F3<SD28Y)$`bg^#`cU1?&5?O$4Q^3HHg(tQ?cWyBLK*{WP&I22kC6Fe?_^Q=1&#
z1zw2<%5$JvL70o>nV|b6Xm9h`CQwW$D|~tOUO~Vbv@2usb#T})PM+4u05#!yCj(6P
zr8Zcd!nOgSv%vgu2<tVio~L^uY1VZ!q&;<X-FpH4_rg2|2Y-V0HG)q*Vc?h!E@@ps
z_hT>UZ%%e#Wm?rL9tH~GwqKyMZa)=V{(x4<8aQZzN~=jOpz;cK>OTVqWS!|!f6y6T
z`L`gvqXD3kI{I&_wW^w_wZ1h2&7SwafY{agMXmMyg!_Mx?K<`uWLJG3!mb7-WV@7(
zwYoEKY@WWHp?Jgc8ptkP$nHQR7jsr728fH4jxlijbx(f1oB^~`7o>K3P4R;1HN^{%
z^c(?|%;K$}vznHMy`OMzGsqs0{uswO&Yj&eAA{yHVCD4t5Axuh*pU5TcO2(9x1y^s
zP>2PY08s&PljKPwms(NKDgk5G1rEZcU-?1i8@aH8SD-@FOfLt`*t!?ihJ$WjG;%R+
zUG4zVfvgfyCqP2(>4Q}*?<d&5Ob%y--bn>2b3r?*kNktC&pDv5t^b~T5p*+IulwV_
z&;Q6cg352?wh1ifhV~y!Ti86gjqL;I6h!fICI)52?-`d|K&DDQL=K1P(?PCX-p{<$
zU2S?RXw~gfzxM_8QxQG~wF4kCSfE*}pevyL#w>ps-Bxw#b-uq~zhG61;7L%83E3k9
z+ZWTU&hl6M6zELeRf|C5SjtMj7~U`N-?*v;)UN>TV`=#V>WRz;?IiyQ>PP<#h4^$?
zzh5h)Kh6JoRco>zE0-{66|?)PHbytlT&w)dRV|J`nblkVg4RvIbhY*RwJNK;Vo+8C
z*^~c#Rco>%D+eQ7*Z!%iS~UMMgGSrbj{F6!Ay?Ko#h|Qpi(%vO9_PuR9ZBFixUI{t
z_5FnZ4>UnLvi>Y|PZs>nLd<&oE_P*|Uks4c$7=n4!@G}Pw}MW8xx4ji$l0xsFhs1M
zhwPSWV3>XcbVgarggFkK$6MW3btZpV&hS1!|LPo%89uwF&j9a)6@1Rm;J^slg*M~x
z92enkb`EB3ZU%k^1rFir)BMS@+$_yUT^KqXggL+bVRb*%Cd{V5{C>mx|FLhG-M{>q
zoX*aZJcW~CaymN)L>)}cV)ie8-f!^#?RXPXnmlb0Zw2+vQfuD}=&xG4A7m@!lm^Ht
zC!ig<liS@{ASY^Qx<hDTb_T8)hnrWoFeGN0d+~$Tz-CSE=H}q_5$57jY4if^Hvzfz
zabNq_T1ik1bg4D0jnno0hI`W=3vvF7YJ-+5wGi7`E8YwEFZ#L{BD%C1BD%Ejy}<hg
zcj2?;??2cdM5Itqo(9d`GH`%;a|aY>J^{(8wL;1>&>3C5Y^-V9Sp^u(SsB*6S6JTz
zl3&#VQvu1hh?V3JzTnwf(N=dO7vrtV86de`^n)-fwj7Vp3F(1@Rt<s984o%G$}25@
z8QsA5pj^m*3(6~?ek^2O9X6{D>RF5L0_Bxgg`oAU;Jh+n{y#)s0k5^+aQ?}vmduZ!
z{x~F^wW@>j$p*dCrQ0DT3TThvwiZ_R$!uT#z2C6@KIhYB_b>mH8@?cwD%0CRIleuh
zdAYk9T3G<j|Ej8Xt?vu`uL?c|g%YIngT%(s5=d;YX1^EU??A|ce2u(XD(VD-#Psb<
zpcNe{%`4d%m{+<pB=>MK30MB)7v}o%x6^A?3#<Dj@My1J>tg<pzwbAkzr=YKV$0Kf
zh%Kt=?*-O3z7OzU0#j*dU-_5W`^(?QGSPo8wF$EcaDYk{N%O?7%<f<QPG%Qido2I`
z*UclstzZ7Px<7ur{137%EPvi_$Uh_dbTZqMzpic|ogYnEA2z!``78XroI&#R!`UF!
z5ShjNpuEw45+ni|lLomGtp9}S&x!6JQD3kL5Ow^=HUCa#Z(sw7TOx_~AMM-@5<@n@
z|A_2YkQhvV%HQ`J_z!D>Pb>q~U#+eX-@7J7YJox+RBM3JH%M--8z>bsF_^P5GrSjw
ze*lyJTRyp+-DTBu(CM?^8N}N`x0kx7cCmxb^8?*o3e&Fz&1<d25Ic^>zGt}qy?Dac
zy-f|p6P|*}t6=gdnA{2`mx9TuV6qiVmV(JtFc}IaUBRR&m{bLmqF|C0Oq%WinXd{a
zMZqNNo~8zDu6~|~+tsO=5Lc%Ly=SO@Q>^*{WVY%9FnIw?9srXYz~lljIRQ*IfXM<d
znE)mOz@!71GyszdU{U}~GJr_~kV{n+z@z|}WZ2Wx0NUr-c5m4&$R5vYmu_9ScMh@7
z^Rv3bpV*Un-Dgiax+kY^=P+kyaQNAu+{13snyuBfs-@AV(M!04dyjA%_g?0eE)2~p
zSr{g>|NL*9Zppa$?{kLa+)CEu*}N<>T!ioFFgVTO?M`Yn?mfexdHAI56c^#|HVmMi
zgtEetU!YY<lfQjqS7x~WuUVDl*W{a;48oC?3`wo0W*)WvE1A`LuJx&LR%<IyqHS`^
zN`}%{)&)0QTGKzW7@I#}*fmSIjeW0h2m7AKva`P@Pv&A`^!<iqr{y)DZN6EpZoZ(M
zmg4P949x26yv-`^YO}aNy)4ijqM&_GpgTklu_dvE_WAZHu}AiWO#}C^6clW=dLO&8
z{+i6r^6MbzeE1)e+qpl0)}~EncY&^yWBJMGsjTqjhv_14`&&T4VpThcwXgfV0D~Q~
z4j03_Hb}qVnMqPRsBfdy9oE{c>BaD#VgHp^t>9S{1qEHL-p3BCUzpXo7?Y*hWti2y
z7?b7M<(SpG7<o@a%A(~mGn^mGvcGF|gPLau9#2wWU`lpim11>=sB)K@ahTOTIlf%B
zS=Hr7vl`0}Wet`e!l6Bk&FU>bgvEOpJ^O{ldKk=E|1)Iv3CHy?1oj)({bK;_Nttnw
z)qQfGD?@TvI^*QNRtDuotPH}}Iw3mef!q5G#(C!$K)tKN{>e8x8I1GZF>L<%lfgL8
zj?uV1oAFgEtQW+#My*wO!8ykF0s<9Uy^oz(pSAL`au#wuu9^9iS^X44>1{}9$@&`9
zF6=+5)!VFf<j3PU)>oj=doQp+8QLQjSfIJ89pdA*mms-)UGEhXq_lb;d$2x$_Hw}e
zF15p;J4y@+lRa5Egs*oo3eW3eoIDNE%W=#GyYyQbqww`E2GIHb#(DP`jLXv*LE@9S
zSbhn*UxUVz+7nQ?Dk~iM{azp-C)tUWMHtlAnb!&K>wwgQM$m+>gM5!L;~J>P19r!=
z2T1xe9*45t)9RhN8It#xioRb^w;nWlGrbKoX1q)U;<IHfAU*E|0#Y9bvp&%372OSL
zX+Y%Cz~;Rdn2`K95@eR*?#XN{Kex4-Zmo<p+}sMf-I(pOI>VpI-`Qn)4})^BWBSkj
ziN`;yFQ}RPon2t+<3{&lb%j5mlZ2WYKC26WRerq=Q~B`!QE=@GI=@+%HGmZ~TJ!!w
z-#^f3%VzTh3?RKRhd?cL$nF-<s#s8M4OtTlx&s)rr(dh{vlfF%t9$bQ?F@gzjjt|e
zVC@9yf$WQcodX!w3fe{SUZMX!qgQg&0)}F(1cT%@PKM9w2?@qkzZfPSF^<w=6fTuw
zxVSy6^}PcB-Bs<3u8(6r{Q9h(AOKPUaVuy%3UrPjgTSh`O)bT$3?|IWTsd0PnU}Y6
zOb*?~Al&x-WU}8i7TM;>?ceuL{%Oh}Tq(|weEB*PxYTyoHeHzg17~vXcP2<}qb`gn
zw<og)BqVoztD4LnkeEE@8$+vm^30zM$>N+0?>D@g(sO{()o?|zn!`s(`fW9b#OzU?
z_YCqKm7xefgZe7(72Z#O?8f@ftL<ECt?NtE)Qg{0KkO{s58^Yr=GrFS{H)5bqjdXw
zh5V`8*%=gG_TT*vk}Gwsv<<!aS@ptBN2uCL)6k2bRT(xoZhx<^e$sY!29B5gCx3&~
z=DPOUI$r&(x?$(k?e7)dPuR}R!1A(xFIX<qb*8Q9)z7L6b}rohUO~TqJ39l@%l?&M
zJ5pVBZ53~RR-LfZ6l8zzc6J7bm;I0Dvws4aTIp(N`<RpU(`VHOI}Jhd-P_q47{Kx$
zK=QG!U#%Z=vVQoiTCnr$*7pkeo!i+RAoA}(@{z6|LGtfDt0wIH2$F9Hop}q^{{|!<
z>RJktfAd*2U}q^vzI8jh07U;QkbIzPAxQq!XH|!tg&_In?d%*7`4=F0U)QZ5`4^v6
z4R&q?$v19iXMxB+1Ic^3ZUo6c`>d+4bK}<c0`>p5vok^DpMd0DT}?sqPd=*(>@)?*
z{{^kH0=w@KNWRe35G4QTv+9AJh9LRh3)5frKc2u2mbG>LYx$Uq^}%P=4?F&DelIZp
z=R}a~MD_<Dy_T*=4Igu}-utZjV8_AT?*;aM?*z$CV!sEHHFZ5{_?U<F&S%vNJA8M)
z7r6hm6(l>E{SHXh&^6TXF)!<_&#DJ@1nzz>@c;AV@U0B3-H#`;-vY_&x(0&eZ+uqW
zuwyDn{^R6wR)@z^*l&PjHC^W#KIUV+_E~koj+wjP3&?+%T+XWScq;ofkgTffLc_=W
ztXDp(PS~Nk`@MkuyUFFO0*|M$UjfM~y6PG}W&p`H?9kl(ULgL><Z@Py$J5y_fn;S}
z4GkYNvR?YETCn5m&i4ZKuO^qXvOJ!_egPya>H62~F%#>B&#DPKe(roPF#pBma#p6t
zGuh99WJO&M+C64wJ@;8PV8_9Y?*;Zhn_SMy_;?ok8IY`?tFPT-7S=PLRULNtZhS9r
z|H<U?R))v3*-wFFd0hkT9<#EZ`mAcOBXA=~gwxg2>@g4PiO;GEJ9>8}vv4}SUr={_
z>Bjd0_76d8=3e$cp38m=q%zTUq1|J4)?=Sl8+I-P$=`qMzzUYBb+xs7%*A@-v+9S9
zwj19I%)bjw{S(-afOJ;6T7u*ceO7(2(Gnzo8<IO8PhdX;k}q}rYx9_k^}uJ<3mgA#
zdoM8mCN%X-U_StoFLeD0lHd1P^}xoTAo=T%9Q$|z`#z9-u4^qwe$Qvs4I67g@>e0b
z_VEPvJs|l^*GiE5uFt9qHdcb<FGF(f;|c7$K=P@sdqMI$KC4dHxECaU5$f{^>^ng6
ziLN_A^4mVEHf-Dpl0Og4y%X5Cf#hRdZ9(!|KC2dNv<1nZh34J~>{~$ck*<~?`Awfy
z6E<3c<WEC$?*#TuAo)<&zgCaAST}rD4cPd1%X@+OC!x7_0{aG#e4y)3ko>yOsty}}
zg5-}wbMFN9bs%|P*IJPLn$M~R8*4%GN1?fQ0{a?}yr*j=NPg94RfUa}Ao;`4+&h7N
z6-eIIbuUPM#b;H4je9}z2M>bs&_wnXAX!J(R-?z<tjj*DGHh(z^Il;8esJEM#J&t9
zYwOx+^q7Zr$!FCM8+iA;7r4I{oOdU)F9FF~x{4Y-=4D;<S@ppN!9DK<{_h6o-6`yg
zK(eN;l17jDSQmU&y|Cf#uJ;1+yTEyOD*FPEtfA{ugU9@=^FFH{*pUBW{@nKh@;jip
zcMAJFkP2Pbn+A{hSm%6J-LN75L;dXc0{^!{^Y0vxyryd`NPgC5)de8=nePSuZwBY!
zDeSXA@~W<pAo&@eRVRStr@t5YzY&~=r?Afe$t$|f1<6nQtl9vQpZZ?l|9WsPp29v2
zBroea6C^+7vuXiIe)4;P|7*edcnbRzki4X;EJ%LRXVnCd{KWSH|5t-^@)Y(-AbC;O
z_aEvT9`mwJ_^cYRA^$^s|9gS^E5W&WGW!IO3eef{{{J5Hu=agcb=Z*q!M^vs!2adn
z96gD>52S+E_5BC^KaaUtdp@fgY{>s0-whJwbbbHf{IAChAW?-4`5*RoCNpueykBr{
z=Bn2G5BEFX3&bx5$MJmj4v>0BkoxbBIaoVBt1|4&|FFNU)&23*pKXtYIosYZsG9}S
zRp0u4!M@2L*8P_E3*;u}e~52^^(C8^yK;b93#;1JHp@0oW(`O%YVGZ2?M`mm#v;rX
zkeEF87z3+Y@~q<wjIZA>h?@!Ot3t*S5Ou%nPDtI)+WVftA3UB=2|gp6)$Q@T<9`zW
zzh7`~@<Zs!imTctv%50PaPDyGaeh4a=|99sG3Znh1`f~&O~;|h?QRSc4);KB*Z`e~
zA-){cYf+B{^@S0qm)!_I;fy$mjM25x71XkG_z1q)XBp^bAGRp7=@QPehhhE=@D6d8
zh@RNr$G&gc-_Y7HR#$|6biHn2sCxC<R<(M7^>>2xqw19j{P`F(f`aWd?q*F_rd2J;
z?VKE~uEMOXOrSm^^D0k<_ZQ}!Q+<0U#H+Pwdh_y=Oj>P0t(!X6bvI4F6SAtyt5vTD
z#L@z>x?3WerVCI1&A6&v_?jd`*woGDUl|@vjqEdKJL)i5>^I}O>633uGYE%EF&LX3
z1<gRTmpgX$Z)SbwARH~tU~IOHVRL)B<Eb{|w&M<ru1!-w<5!bHAR}0ybr_qxA?Kfh
zcR?Iu;E+5z@n|yZRtBGo$||f(@OV1Hb_}$-g@L13)8Qi`X4;*1O>c4TJ)+k7)b@tQ
z6_+^?#+)x5_&8ZzPl3a^X*whL77NssF3C)+QlK_8?4GrtBcL|4gzu`Bb)AgIWjvGH
z*ahaeB+p~#yW=vqJ9$1kAM;8UM&ZgzhGa=jzSi{QvhRG!y_`Z*96%@hB+viGBfbhW
z{<g{rG%}pr!7h;8X2Phv$b?yW2@4bCT*T+s?_7bf*l*6cF};$Bp?RgI#PljAhUQgT
zvb?8Hcz8{H-%$4kY~s7+3{d`SF4nNAGLD_cK___bn%;7Fjt?v6<E)>5dR*2Xz2h>&
z<AlTJw&x7V+*jE)vu$NaZoJN64!WU&&60sN?LEW)gQ5?6JWjYwhVc&wzMSJAUJ9D!
zVEra@@%;k556Gudz<LT-9Ip1y?S9<I{-HGV>~_$cgz_r(FA)2BTtGHHmc04{Ha5Cz
zs$J`Q2K(Ky7i0G$#NIQ=?+Uybx?RxqeM8+V(7lSX2WR-)-3ke-SL&d!dOV5!9a#Pa
zNM7>b44;$WolSeeX9GY+Qm2D+)H793?!=aZ88|?v*no1XF#B;O5$EK`*BO{5NO<?L
z{|z%{`_3S8Xd=7abP?#uj}S8vI+n{L>)6cpouLD)o(G{GekX*F<Ej=9SC|jqGsv$2
zo&G+@1sa}Dz~OltR8~!L@oHuAgpR%)W8i?e?zu#ad+%|O-6GD(|F1J(x)F981=ED9
z;1zRcK_h#|7&wevYQbe2#Pz5%Mj*49)zd{lu{60|{Wq&yqZ{L6M%RwRjjm@7PdI+%
z_*JMWpdEUX+m8#*aF#uO#d(I)9Vg?o?+k+H8eJLPdJbJU1X?A|>Xtn97}LS#$={#z
zw?2mCzv*S5(^K2N!gM75f`~Ish%8)mW!a?$iBlKOox61A+Nri{pcBTF6^{IBbW>Kk
z@{83?Sq02iyYfqz{mV~fjVHev-IcYz{94tjtaIcSBrUAs5MK&PkxMxi^Kbc~tas(t
z`wRE3HLGwjfc8K(dV+Gv<gTu_ohO>rPch7JzT+I*&w1L^{Ou3W9d6CbPcg*y=l(u<
z03@rtK%J3U(~CiQkvStMmrd^EeARjYbSeR}h9|@3XY7n`Z-Gxm2<KqD+245juIbkg
zpghOC!js|b_Nhm}D?=52GAJu?GD2MC`v3ifeHXR`sD(@mVT=6cndWuPD;0EhSUG5n
zTK!3*8>2huMy!+jAu+)ISb2#$qw+Fyusa}bIQekve%^!7@c%i(S@QS|=VXcPOgG$<
zMUOMFx}Q0G;rI-AZ2?VBhu(jX+W<;UkeUzF^M{$y{*^d0S`WORV0RYP3{c4j8f^fr
z9C_cMzfJUPv)Yk=6Wx<1d}D#`8iuZ*59~E(`_E9=k9^~IY;W?LW#IV$P!Ah)%P^?V
z4PtwSLhcxVnJr!hnk{~I{C&gw^|CNKCKGAL`(+HAXJICTY!N*AH~g{0*MFR@Z?}7f
z-i42ufP4Y5sqMh~2LF|C-%KRZrnjiR`5XRN^6NiV*RR_>L!WL3&AcIYwnJ7hfp)ut
zZp+-%4YBvwPOa{BJ!U;to%^~Db-H!AnkMtI%GJiMYDs2aDx2)hDg;s2w(VJKRI8_{
zR(mq%QrTorR+(1!<nAv*o$kp~zsLyR;9?XG<z#d$6K4CyKlxf0<K*y8M&XJd{GfT_
zkA0J`b}=Zie(YD`5Dx2P*v`TD|F6W!e$W|(p!*tx%f9g+Vg;Ro;Ka81yEvmcD+6P#
z=-IxD{V)4o_CMlE;@tcyjM4a|I^#lD(8^?Gg^<6>N-BR_-8)^jO-<(e&esV#|58La
zn2T}p4NgYKQqWwLa99^3c%?z{Xa31Qe(-1Z2}g7>EaG_Cuf!~TwUfb|kMV!4+~()v
zjG!}rU~YBdFfKdB=)}7D`*FtY91M(qC5+S97*F;maT%A1F+So1xz9MujdAl!b4KL_
zu8hiyOc~XtbFnA2f%f&kXSiUvss%A4jC{8!Y<4(#G8floa|OoD>>nI9vne<xzjo(L
zX8*+@9LC8wIjoZb6dIt=Q(~L^?Hm6gwu}8&`;#~~KUZf|R`~K~qAMr_THUuzeJu9<
zL$WLvi||!WM&WCn44{w(`B#Y*WP%gh$^J*27yCCqH)ou4aOZwVEUL`{#bT+YR(mqf
zR0i-Z(@#40v$~7!UDdL3`^k`*+d=Hdzs<fM4bg>`yQ|un-9;IhU0E5KPna_{A5&*c
zVs&Eo>|ewNT5T2DKbft7iPbgv+cT!-W9<ygC#EwrpV-d8d~`X(BQ_@vP#i0<f=<6a
z*|%#dt84PtZ48j|m-+Z{2Idpj8JbUgXJ|h9oFR$bi34P!ak@C;B39pivuTfWj{jjk
z%Ffh$LY%4jm^%aWiEswybLLFVN7b2_50^7AA4_LQVx2slgE6+(iDUBgHbx_t$<taH
zj8l&?Zhp?r7}~q}c{;;nu{H*)saN|!bD7XO4ZKRk>i~GpG$H<MvL7o8^T`lK=Ho7m
z&Bsa@n~$e3I&mhk8)v>`Sj29ed6U67^C!bW_v8=itj)(=n3#`;Ff|`5VPZa(!t{vU
ziT!5()qW+m*uI0VYONnlCEp%(PiFneu$`Sj@XiTP=>==QMTVZ;9~k;~d$apd24=sj
z49xDVOw1mlOw9gY8JL})GBo>{GBtasg3ROtg~sOR#~DE(vibRQMkQwB^y`d^I6$ET
z^3|^C#_dZTl3m%@jHV|i9cN2^@SIJrBl+!87UTAB49S_tS(x2j8Jb-~8JL|*8Jay(
z84j@~vHSKLr>8S)ZawC(h-2SWkXgxT+nHeP{LQQ<7>wDzGVt~pv)*8MKS2*X%LXaG
z3qzY4KxH_n`~{tL1UmDGL10s-S?44+A+}X5rsjb!nUA+HFrS#h(0u#|L-Wxq49thO
zFf^a|!oYlN2}AR-Ck##;AU8Z>2l?qN*d<DAp!~Op&6v~DQHV3J|7yS2^i$KpyJE%K
z!6$i5mS_i`s17>W3v_zd!Bo%*S;lGCKxcO`C^m0?b_{fS7wC-JG%?0paGCP9A7s*u
zBX^E~%3#PSGN_ENEM&W;bOpBi8?;J1?ihnavpXvzvxg|-s+MLCQ$}W2RYoU{N9>^V
z19F=Z>$=X(PnR<+n=0Je$+WFYn6r(^s_XrPymQ;x88nnv{A6f8+QPtmd<sMJu`LYE
z$CofTu|HzH*?YBj5&PZVu(oAWjaxMt-%rRp4O%e;T5Sd@9fid^8HGhV875EfVw^m+
zi@`A)Jg-n%%DDM!DI>`BpmK8ZwJrwZvNXoc-_jU8`_F=XrM%=NgYu%EOwC7+Ffbp#
z!q9x|3q$kqCrGx2&Ai(i)CRJ3+0^$F-W>+r7(5wdpLi$uMBuCa!jYW}pgV(a_Jd26
zWj`63kBKlbA7f!+KCZ&leB6X-5!=N+C-%_(N9;HIl^6VE!tD2eR-mJ%g;gz})F5gc
z_!68)PJr?VEFF|ELDE4A6En!I9EVsRu|Hx1h4I-wP-<3U1C<a;?4WdTvHxb@sp+St
zfl~qKBp=Y3ZZp~$gr~PL3g2sE6rRz>fSL**r=l5GWH2mjdfRWDCI-$mZ~J2VHm6@_
zxNre89e`2+=q?b@9U!2c0)FR^Zc^zo>$2*8pD_RSs_tYjRzBvF=pmiN2`U*t<-#KN
zuvSpn@P5L%sm;eh;U~h>e9VNY`KSsg7qj2&SDSgYe-Z1d&ak$-y<V;F6YM`^9^A~S
z>e%R$e43LBU)s4hbuyb3!?LL#XDKV}X4uHa=%&_MX}YRASq!w}i<`lmodHyjG0r#)
zYUfOz4w++eOm9}@W&oXYd9wdwA84NKYCm|TA*dcWDh%3TB@WqT1yTo6BMjYV^@?Hh
zb9cr&2hrnN$p>_|N?a@CE}V1SN4GPdVPRrECIU`_&Bv}VFdzNGz<k04ntGlvII$gK
zOX7LNYMgV1;cBmO4iBRe`^nx#?8Z5781D88_ewH6n)(W~+hVF(>s6aoosB+^rC8sA
z!Vi)TAtoJSd&GXV|6;!q`_2AW({Ziz0<H5}*bG|fHRnQB+qG6>(D}d<@+Lj%Z1t(!
z`?!neQ&{W!hJU}Yo36xuvHxcOUvbbnwaH<vjFZJ%8HL4L8Lsw2)@<JFcT87o1chd0
z@5%l-7p`svrFqco5vbQ4b%5=h+9?JBtxmlzqwZ~;yShS+Bu^sB98iCh$s1Jic(uMS
zIKP<LU6Qfcg_E(_&62U%U6b(<ixd0Jo~u2J*o9c{_N<z6YDz2groK!Y-@n43Rh8E}
z8H9zq87I%^Vg#M(Wt^POu=#~Jqi{H+ZDY>I@LyQIi$Pedn_=?2P6p7NB_wY|_TB9>
zu7AO}xjv6UIJ}#2^7Ssp&2={zjqBtXleivn8fU#?G%nuEU|fHKK{&db!MNfEgK_$I
z#?3EpGH(8{gJJTmE(UP@la&Q-kr<~xXEd(f&9M2UBqOL@0?NCaf9+y0&N{_loSqKS
z$FTW%IOB{1%8OhW=NwU9X2N)PFDSH-$0?!?FbFVvvNAS%i83;KsWLKqn=*pNEw&n9
z4>!<Fb^a5QudHM`#0AQAk&MQfnT$$Y#+jaslQ=iCS~51evAQjrs@A&H=-~F+&{EJ%
zrtlITa=wRFmmc``*ZmE+PWCv}D$I7|Z&2&|g8oTbovbJQTHiO^yTPn>1bn8%sxCpc
zkFyGAfzEQWG+WgY`&YP4iUG7%>3ze$*RK1URgV141-G@;Zh75+oFWA}Rm$&L(wPPZ
ztuDQ8&^=|ly5E23|Dn|>cox(;ycDu2QYi}7I`nFFic|!x)MY#JC#>xj=p49${+-Gy
zOa83tR0OSu|0B$Elwoq42?H<KC68KzS_4fK--7nNfp%&^_P!xf?7{|6iv8Jhv>$ZB
zgYtrI#=`B)sz?6(4NsQ*$^hEmx2z3f&s`hIgIb+?w=?Us{4wMKsqEeUH~caG*FRdF
z3z5PSw4%$Zb6ck{`;ot=+63)awMafpmf{4Tzr+;z$rHAki&^!^U(g8a`-Zq%pmGFR
z4%8b#4<S(atm`)FH0$2g_5MTuvsEpe;P8R0r-XzLtld1B?Z_XmwtL{vS-%_-I;sbm
z)sFm`%zc#MUaK)@7$az;2ogp?t-VH)2UoTD?nkcwkn=StL_pyLsSRH;fa}6VKN&zF
z6F2pJgWb8g`$1uKtqo%9OC#T(%&INm7&2si-(YuUCQ=BoT?5@E1xacAw-}Lbq5;*E
zr$DEN{RN%x`@Z1)>{YF-Ab0;&Yi)GnWh<Oz$QEk>3N6UUB1k<b98pCeqoknKb)ef%
zKy4S0eW1Hf%sStHcz+3UW(~xIBrnj|B*>goZ9$OTF$wV>lLJ_}{)Ru6{rU%Vl1&&?
zJpXp9d$Q<P4p#4G%_Dz7D@x9_zE9x4RVw<pV)eh~Q>bm5M_f+qn_s<R*!=1i!y@+0
zuYNI{n<dQc$*^peaP{f`li9i%py#!J$p5GM6Ev?hxy6e?dBHD+s5a30i}wxtws}GJ
zD>c~dxHStjGX=U)z^}D)du6EYe&0}ClzSXNWvfx^rj~V`?;G~bU)8482FiC=Z4qTG
zsB{IjUqR!mpmk!aTJ%8SaZvIoa?2aE<7}(qV|Uhn_-fo!Q;peF9YLi@qucur{-2Od
zfTdp0SvG9<!Y)Bpu|m%LZ}xU&X!Z(aVD?UBVD>3xSk<D}wW;%c!uoctPS7nyYOU`R
z{vU1z_bx&hnU9q)G9OQ2e8hf;?P@=$2Aa$x%5bya(R~t6a=~{Y=97pXM)UC$rX)@$
zcH_*K43PE)sI}qM208^tSxx2d`w#Dzf=)MKKF-1ft2>*It1u<8A7Tsb5A0vW9@{U>
z+s>3W*K2O_sg>fJ*;g?p|NFvli0cve=2umWn_qP?DsgXqmBqMhR&q*|=%ubxZE0=S
zKszTs_@4#Ur=Zj6_ss|IXqXOJ#e<xOK=}vM#(=djK&v;+#s9qp^?j7Jeu3H{pxIFY
z@IGjrUkuI1t}rqmJHp6({0U?8@h^-h?M%I242+(br6cIZ0ayu{JnK1^vKq^uMpt3p
zBY#vqB^Q8pJAuy9f1hxE-D4@$|IC_4{yg^M`~?Z4_aEL*ek{cL4s>r9C>HYXX>~?|
z)=vKc)uzJWHd8yJ@a1+!;i>HmlW%k~PM+Gy;Fu=N#`a<Jvor?dQdZE(k?G=$o4>L$
zf_(b1-?#r{-{zku8SeINPB#awO%_zvdc~lubc+e(`^N2?+gCAeX0u{^{QKLh(n!|*
zk&&jLc^vpSENDl;`{`Ppu`fX`s$bN6l!b};ga{M3)qE_3srf_+6Z2t68>snM3X>Cu
z6Wb%!N9>>zPeJ{8amLM0QyGNWL>ZLW7qR*F-|Z7(1Ft#zpuY*!^I`_|yg=#Us0g&x
z{RG@PYd!{Uld>kUA7VY(@7u4$wg}w&0`<m1`!DwI!r8_`tfs$n0FozQ<HLwj2~<Pu
zY5~;``#POE-zV5#Wd)xKXv{v7A^F8~CQz-QHuZhOxgU(Ks3jX_SyvkR6RBhc-De3h
zJ?xZO7wAq!t?qT5n_8?o-zUU>Q#{(N)$%uax)!Ti>-&bjyQ|tjE&!DhQJ_3`Mi%Ub
z<mchcVQrUM-#5JbfNVRWoCMv<^%PV`{yn=LWIL$c0vic@pK$+x=t0n#d>h$UO;4`)
z3Tk<?NE{SoeVq68AE+dPtZf2~^MQDv5(%Oo)K6v*0Nrzve1Mf{Rf{m^k$>Q`-xK)f
ztZD_FIRP^D@pX2vDWHC;UMom9Bvc{&642R&pxfBjwIm;AWzp->>YU7Z<S+Cb^MwBC
zt6D&NbV0iT9$#bs2Rd=btMz?A{in?>E{?0FfK~=1mrZ4m0lRkUzeX2O*fT|f?(c)u
z*^p8B>EWQ2(a)>qI48eb&cwwE;iuPwPTA`{E<PPJlgK_Bv@T!pJVb7J)vD<t?sJ?a
zoTv7KRzR`3&p^yNfc6Q3O*~$TYNC4;vWd^9BAeJ=ifSSwnu(yf2k~%_OVSG@oRjmu
zGj*{;_|Hr1rb{^U9-lr9G=JGP0W=3Gcz${qh^JNnx@%m-9p+AmsgO~PWJXp2)X)w)
z1zN$)tjWsInl9Y_{l9VLONLb~$<mxW5v~D_lf~2-l2fno)QbNUPk#8EXZkEA(48`!
zpj&N^9&Yp$j{@BR+?6IC&BVa0-JRXx;y3ku!Mk0c*`nlk%Nd~jom{L@ka@A?TnwOj
zu{$oUoR44q{By=(I~PNPFqg~U*34e6&Znj;&Nw93>}1;9s_J;DEvzm1^G=4=)D8zP
z&<!0|K=&BU`|dZh@GdA;(d&NkP|&P|tN;4|zdeku;G5YC&h1rRu!@24<Q<odzd`3k
zJOs~FfllMAg^u<?;x;{Mj&t&Z<t(st@H~3e^a;+O)$^0vpI3FbPi7Tkn0zgifz`c>
z%~*UpLvq0~rU}li>6@l+n+{6_tnQ6&5FN+MnI@piBB#3c;3-hE)k|kMCx2MRwEeq0
z!$kI7)0rkf_JQy-I55J@<zj`z>$0F#(<V6exNm1uV3^1@S^OA-+4No0AD3_YgQ*8%
z8&dl5k#J5f{mx|mU7i8t#^&Yixq?{igQOBj8e8rSO6B5hObo(o%d)08%Q%^{D=-MS
zf%FMaKgO_Y`s0ts(Cmij2enT?Gr$ZSGOmp7tZoaB%YakTMD}gdK|Y&sSjLr={c+m&
ze{+vBx-q(QX0*DBII^-&4i9HIG_8w$+jPkN@|&kUWtehU##NY&jpK0w;udz$4v+T_
z<le7pk$eh?^;Dzx0q^F3%4*bo9+22|cPyR|ZU7mDWf%pcAut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqalDZ1ax(E8B~j{6pD*e6*BWOOBB))Gjmc?6f{zcit>vTR8us$!14vT
zr8wow4E0R)3>g@>{0ma^f}K1SRExPl7Ahzx#K*_SD_{X2@py<Vn8~G}psx@guMmT&
z79<`YU!$N9uMh(=E53$Hp+=!b0Yrd|fY_n{X4WWZfGn(0sEOB9sHssvQmUX1GF=~J
z3WOO0QW*m_*9K%3*i?{3P~9NM>w_c|YCulZ1Tmqe#&ansfV9W!*C^=4$LoVRHSr*g
zV72l3U`ijP59C~^r@-!kvEysFK!F4b`^=)k<c!P$oZ$;rQ;>;Qz9c6JzkFtHY7tHq
z4B$9UD^DxIqXeubB|kSYGfyEcGcPeGvno{qOL76LE67PKNy{(Fg{Z`BD#&lC$%#2R
zxRo#jz|8VX%uR)cAB3_3CpEadTWVrSX;Er1L{dRP0Zrb+F(^dAIlnZo1ggSHLA8_%
zVZLX8r-DmrS!OcK7Bu}K;6OxD0g_j6P*BY&^{7HJ$2mW*I6o&9VHQXolDtQ-FG3FF
z6g2q&-%z~rL8(dk`6Wn7(DVmql$NCAm*>G%pv#vQ7o_H;z@^c{$vGgv86gP|N4LzP
z-15YtR0XHRVps@)Tn`Fog9_E03N8i)xSC*4>VU{XNGk=^6a{Z5WHmwI3jS$n#i_99
zP_R<KFefNn0o5oh=6Iwg7ND4f#T>92WRsxgC}@=Amn7zB>Oh>Qpiz`soLW?tnt~81
zEk@?06{V(Xg0e1>Uz3XxOOi7X4h5U-gkrRlf(F7ICj||tF+rtyC7HRY3ZP;$EVZaO
zGd~X!T%b5f(Nj&~Vqky>Ffh16i)4lL)RL0SymSR$&tOM|2p?BJE(Rx1f&iy)PZx-K
z7zs(^2zeJs4u(mC>?uapA5fH8rhw!WNZLW@2S+~0VyFq|@*pYKijvekkY9>HX#-Rp
zAoK_L2B7D`6cqb?0~Fkg67x!P5{oiRDnafmRY=M#fz&Ce<~XLL6r~myD>!AA6obMX
z*&JVw0AB^qytI6TJ9A1EGz=<K4J<0a5r{C$B{iuuT_L0>Gd(@E2;$}xg%T(i9M@1o
z6ciX3kir^LZi0N2oS&DLnO<6iy+mYS2+hmR%P-Gk0M)Va$@w`cpd8G=z>u4olA4p6
z&Y)VX!;qJsmkO#kofGpE^72a*G7|Gra#9s?^NUgyN-`4jKq<5!wJ1#?wJbFc8XlnX
z6JFNhtE3qi7>biJ;|p?2<3Vl!*#puGDtbXlDI>9{1Z-(yadBpPUTTU$Nxni!MrN@B
zq{IgW0!Teboob4eLJ26-z=KF3KTV;evLF>y5?X->kaBQ60QEOSR-+^(u_VzDnmZLj
zDhpCUs$p%6)V#!`oK%>h5Mw}YPDv^$iZ4zrDJ_UE&d5#81-TtAo>!V14~i)U1_rP?
z5Ia2;svhEJusFnUm{Nwk^nd@8(*OMrNdNa=EdAeq5FdnZrTzPVCGFpT5Dmg<>Hq#8
zgQ{JT{_j7C55lw3|NZYt|M$Nx{ontB^nd?BZenNvk&Fxs4FCT#H2nYX3W_FBq-EwQ
zWagD6=47TQ6qh8Hq$(tqD5O?omM}ol4=4^&QxwWGOEU6HOB6umL6JfVxE=zBBgn5{
z!T6NaoW#oboc#O(kWCXx|NUQA`tSdp(trQ?%KrWLDEs&STgkuwZl(YJb1*P4fHd<k
zFfa%(Ffi~jFffQPFfa%)FfhR45JD?}nht51Y559ir8zkuJ*9b&l$WBAlb@Ujs+mht
zi;7AMK<>@V$w^HIixrm?l_r;f$}5QKB4}HHfgv}uI57v3h;s51Q=sV>t9)?@C~>11
z0BH}P2{JG+fDKDaEX{#s4TO;l5QDHwmJ}rxC={ipWEQ0+!y34t@Iy(@MTrHVbgf#9
z()4A>Eh$UP0p-)=#M0taNPI!U%}N1eE<}$lxKzohP*5#~F}WBRa!WGvic3IrSz?Y6
z14Aw-@=J>ua#IVELG~9HFfbG)GBA`BFfgPSFfbGwGB6YyFfb$<GB6~9Xk!M3L?Z@<
zL{kQaL=y&vL~{m)L^B44Vq*q|Vj~8IVp9f&ViN|2Vsi$DVvx8c14FR|$Q(n4VnYLl
z5<>=t5(5T?5@QC25+eqN5>p0-5)%f75;H>n;9~Hq{`Vh*<Dm3{>VN-tRR8;5Q2p<J
z2UP4=6+{h)2B*=Y#DaKmzkz{4KRF}6I5m$UzaTZQI4M&HQa&;;6jv6Pq~_`tLs}rZ
zC8@<F4Emt(%}+@Mg|mKgL1{4q0|Tgt)CHB1x}eZ5W=PCSNi8l(P0r9sEJ-fTEd_-i
zl31#-sR2V`PEL7dUS4XEPH}0TkwK<ziXlUCL8)$DeqK>(Norn6W*NAA1;sn8Tmq$4
zJ>Li)h19&{{1i}0sG0&YJ2N#mF)gJqIVUNrq@XM>BRjvSyrQxy9VCaW-#Iu)K~=ee
zVbzR(|KH61_y5`KfBzrM{`ddZ?0^5S%>MWP-0Xk<Pt5-J|IqAz|M$%P_kY{$fB!ek
z{`Y^??0^54%>MU(-t2$>XUzWhf70xK|9fWt``<SE-~Wc$|Nd9a{`bFR_P_smv;Y0i
znEmg6((Hf#V`l&RA2$2n|A5*5{(H^-_upmqzyEf#|NXa^{qH}|^ie#JVPG`--+!Ii
z|Ng7Z{`X&D_P_s9v;X}Unf>oS-|T<?IcER+&oukr|39<-{r@)W-~SJ@{{4S7>)-z;
zv;O_RH|yX38?*lXzclOL|1-1x{XaJA-~R)%{{7!I>)-z^v;O^GH|yX36|?^RUo`9A
z|2eb%{hv1L-~S1-{{8Qo_3wYntbhOOX8rqLG3(#|qFMj`=gj)|KW)~({|U4H{g0aU
z?|;awfB*ev{rm4R>)(H;S^xgq%=-7=Y}UX32DASC*P8Y3zsjtC|K(==`!6x;-+!T5
z|NisL`uCr0*1!J@v;O`6HS^#9FEjuBe>d~r{}(g={eLv`-~T%^|NXx<^WXmqGynZR
zHS^#9BQyW~-#7E${~a^`{oge6-~Tl;|NUP!^WXmkGynacHS^#9DKr25@0<DWf5*&!
z|C?t1`(HEj-~Y0i|Na-u{P#a==D+_bGynaMoB8j5#LUsOJCJF2)b7#rH<|`U)4*sN
z7)=ACX<#%BjHZFnG%%V5NKXSnGynbfnfdR(+suFe9cKRfZ#DDZf0LR2{_D;B_g`b?
zzyC@z|NWPl`R~8j%zys{X8!xnHS^zpmYM(l|C{me|Bo5}{(l0EA<X#q|JjUx{~yfw
z_y5+6fB&z{`1k+ZjDP=6%=q{J(2Rfo_ssbBf7^_I|2NF|_kZ4ufB%<&^v(YFU!vpR
z|DLvg|AjjK{pacU_n)of-+zXVfB%2A|NH-?{ont0?f?G2X#e;BQTxCDciR8`zt;Zm
z|AqE{|4+65`+ubU-~WB>|Nif2|M!1W`@jEd+W-Au*8cDRg7$y^XSM(PKc)TO|GxHr
z|2x|M{cmdj_rIq7-~Y1qfBy^G|NYNu|Mx$o9bz}g{!u(IVG#$7gNXKj|AX59{r74A
z_usAk-+zbpfB&u8|NS><|My?7{oj9$_J9AC+W-BRY5(_Mto`4Af%bp@x!V8zXKDZU
z|6kj`|3BLP{r}YV@Bf>&fB&Dg{rmr*?ce`fZU6pXY5Vv8T-(3@C))n~Kh*Z`|DLvg
z|F^aM`@f;>-~Ux0wO#-IYxMp5uhjSNzf9l1|6+ar{tNW|`_I+)?>|f5zyJSw|NZ~b
z`|tm!-hcn!^#1$*toPsl2fhFP-|GGM|4Q$_|L1!D{XfzB@Bg9RfB*ON{`<eJ_uu~w
zz5o8N>izeBN$<b^^LqdNpV9m8|D@i3|9g7>{cr32_rIa{-~X!KfB#E*|NZyq9K{0}
z26?^z{%7?5`=8YN?|)41zyD#q|NaN`{`>FM`|rO?@4x?cz5o7O^#1#A)cfzhPVc|}
zYQ6vdEA;;RFV*|+zew-D|9rjw{&V#H`_I(-@Bg2kfB(Pr{QLi*=imQVJ^%hc>G}8n
zUeCY(H+ug4ztr>Z|CyeD|Bv<j`+uP4-~U}b|Nd|3`S*Wa&%ggGdj9=i)bsEEoSuLG
zr}g~%KcVN}|E`{Y|66+g{jcl!_rId&-~XbXfB$oO{{2tu`S(Ae=imRRo`3&Cdj9?Q
z>-qQJqvzj$r=EZRZF>IwH|zQL-=OE;f32Q>|5bYa{g><c_g|vt-+!T=fB$)U{{3g`
z`S+ip=imQd-T(f7>HhcsUH8BLFS`Hzf7Jc&|DEoC|F3ob`+uSP-~UtH|NbB8{`Y@h
z_rL!;y8r#()cx=On(lx9mv#U9zo7fy|5@Gt{!i&1O}hh`c1P_VO@E_lU^ESkrh(Bk
zFq#HN)4*sN7)=ACX@K-J(AWL%e@FMf|4rTh{?~N>`(M`m?|(t}zyDd?|Nf_R|N9@;
z{qKK7_rL!^-T(gkbpQMB*8T6lL-)V`R^9*pn{@yCuh;$Wzee}J|4QBe{>ya#`!Cl0
z@4rCzzyDm_|NgUd|NH;1>)-z$UH|@n>iYNpP1nEwx4QoQf6(>szh2+J{~=ZX{-3D$
z_usGT-+zy)fB&7T{{6S9`uE?g>fe8Zs(=5rs{Z{~srvU{uIk@^iK>79g{uDj=c)Sl
zpRMZOe}<}m|9@5f`~Ri#-~V@&|Ng(I{P+J+<-h-TD*yezR{8J$h01^bPgVZ=f28u?
z|9zGJ{_m*#_kUC6zyE70|NUQ9`S1UNN{HPc`$zG>gvBgq989VF_rI_5-~W!vfB%~*
z|NXD2{P(}C^56f0%76c}D*ydYsr>gpuJYgih{}KegDU_1_o@8%->vfBe}~F{|E((j
z{Wq!n_g}B_-+ztDfB%&#|NWP#{P$n1^51`f%76d4D*ydwsr>i<U&X)wKPvwH|5Wks
z|C@?`|DRR-`wv=27GGRal$n>#kX&38UzD1d5}#KJUaJb?mltK0q(TKi>&HBy>p{WG
z<v?ph)AEZHQY%V8%Lj8R6w*rbk|9hk$QoAgn#g$Qnn(r)hD~jdF}$MofB$Dd$8W>h
z{{3%j`}g0j<KKUej(`6{I{y8S>-hJ-q2u3wg^qv!O*;Pl-_Z5%|ADT5|F3lY`~Riu
z-+vKMUhVq#e_9u0+|I1;-+!mRfB(b!{{4^Z`}e=9@8AD<egFPX>HYU#sQ=&pGyVVm
zKkEPYpJT$m{|XcS{kNF#?|;CAfB%>C|NFnA|KI;L6aM`_G~wU>8x#Khe>LIX{~r_n
z{b!r_?|;vPfB$Dq`1fBUuQVq|6XK`hf}+g4k~9UR^{)zkp*}te`K2WVr6mfG;N$|Y
zTQ1HcO0hy>UJ6`0Xa_=OF?dyTRccW_XlW}0Xbse*ng9NSa06)F6_gF)Bg=vK9Z-1-
zC=C(=t-S)Rs{*Z+!i5RRBkKdL2?MR;LKXwDk;SG!*JgplL1u$6h>eVq#XxLO8dEJ+
zD9A4^&IB#025$|>O)Sn<$Sej2G8beGD0Vd&iN)|0%b@j_3gCSRP&12C(=+q)iV+4u
z#gR2Z)F>n+7N<gzu|j@PN@|g<YEG#_T25j*c$q9{!w6JwN`5LNqB0W8QWerNp&Lyg
z#(*LYst&e{Ixn@NL;<us6trTqxFj(hv`juF6~280y!KqRSOJT=MChIY@J<tj<itF6
z&|>V=<kFH<E(Qi21_lN#1_lOA1_lNVO$LU_)MAFbd<F){t_jr?1>`+Q5J!QWhmc2X
zDo{`W%Y$}sAn6B11Z;y6NFKZfTs1|t7)gyE$am1a4Inkp)x{u-5bgl0DM~j~fY^gm
zjc<MmXtNH;90nvig21t;YG9NC+S&k;g_@uXr4<-_trQqklRX(!lY<yklfxNQlOq^Z
zixn7x^+T;d`yhOEbMsSDxfp_>bSR95>~#P+7ZEPOmBm4+(5*fo+d!K_klhnpSsV;m
z6b$hXR34<%FJGZ3KR;IiR78S=L1M*;d7#Z9$r-81*~QS6=THSG3%KFo1&<d`7m&JS
z$PNd1x`ywefNXat25*wk(1e+cyd4spwxIjoO7cM~`imfGQ2`XUu(BL&Avws+Y31=n
z<?;ED9Z%4LDN&&yzdW@Fw1L71yg4NYvNr{)zPJRmF9TGlp=bu}4uLMQhvwtFe1+W9
z-29?Skmo?bRiXgNJjIaxn^@#Q85>k0fa3`qo|#pt@eu!m%UlRE9%N2&Noo;_Sbly<
zd}2yUd~RwkNIpLgy1xXf2ev;DSr2&I3CLfNbfb`;ms1IIBq$$(JO#@BLE#Y!1*t{3
znZ@88L?HM3db+s!xVnQhLsKWn(W=G1uGqw3`)43)&Ov)}3UUj;;R11;f@-lsQYv^s
zKP=E7eo#Oy8}f@3ia~V<q@;jGSZ1C=QDR<tsvZ|ZnW3Jc0Rsb=HiXhf3=9mVko3<`
zoST@L2nv_n)Ph{l`hM^RfYelQSQRJdrxoO;f!3237ngwd15{-u=am#OFjQq`6o48I
zRoO)h#kn9ch{6i+g7*UO;`ge|<fQy6klN&={9Fcx;<AFI+!6+c;uO#Z7zU8O;-btv
z@LKlb++@fmBamB)lM&*@$;oNyAiaqxpoQ_pWr-=Eh4rAd{Gh}UpPpJ0UkrA9Jh;#X
zmsM5@u0cUo3LzP(3Lr(GY5-$@OSEcEX)Gv;7{F@XAbX07OY#dKdZJZ9(qMavbK^nA
z#3yHfLNy+=MFQ-Wq|EpXm>f74#HVHEWfo_E`~a1MZlM9EF;umX_63p{c*6{eeMPCo
zrMamf`-(vOTCmB%EJTrm?py%H8z?zKy;hR1keHkd+KL9<5TKA&l%J~rN$DW9ZqNSx
z=Xv(;f8Miy|7)K8`w!x0J^S~c;n~0ceb4^=hwO`p&o4;MPf3l>%qz}gU?|EgPA=0)
z&dJOJ?c!iyD9%jFEK5ZQlw_nPrsyPF8W`w;6@lzQ5=#UN>gIyC4uRw#=3xkfq~I8|
zdx^n;fdNc2KxqevG)N4b1i||-3UYEw3>Z|4H8iahFhZd?w=^EK*9)8mf_+1+!11n{
zqM#Ar9ITq6sQ|C=i%Sa%@{39oax&91N)(E7Qd0{QAk_*3QTkFq8c?)>_BW*<tU`8O
zK~a8sQDUw_Nk*yyXrE_^LRo5ZNq&(Y*qtCpL!A>3HZdOL5C(?gl9c??65WEtk_?9A
zl)Pe{(!`<?-6F#R3kFoap%DWpse)rEE5pLjz(5zI6cl>tiJ8SYsYN=81xa9`(&Qwa
zjFQYWQ29}mnwMIfSgcc=oSCLuWSMASo^D_Q+T)Xvm|c<ywhg2V7XN9brX~iu$p&!K
zq3Hr-E?8YoW=U#=4u}K^F)-v68=9G#8o+2!k;G7(S5T~zQm&g=kOX&QMNVFYPDMd6
zSOBD5*HF*EKo6|ms-y&5@2P?shVWwoK$~W{7}8Qo;=!RApHh@rmRba^I~f>I_w1CX
zlo%NpfcFFG7U!21C8siE<`tBJ@?K&xXlITtcypU>ZZSh<9=Zr<e^h3^Zc!>IctKhi
z(hD;4b-`6<ej2C{EzU2<NYB?PPB$_zG1AQ_&&|)%%}p-FwkJrpJf#F=R4T}zf}+fP
z&^A+09F-;Jl!D40P^Ads7grW1=jZ7bfp=Sj${h$FZfj9$dTt_U4_9isZf3r2d1gup
zsCZ(?O9cBTH7_MI5meUaWR{fVr0T-?Ntx+z4#W-yh8n*A{|os3|8L;?|9=^j28khK
zkeq&EPG(|pDrk!oLjj~a$dHqnS6ZP1<AL^0<rXBCfSUcVG9<AeCo`ELGY`6tuUIz~
zv_Ur|H3eG6WabuUCWFmH<nO%XRFE!118|yxlpP=e16Vo)aX=|V52OI8+yRM$(+XlA
zp=VGaxTVFw0JbR}WPMRyVorQ!QDGV=h!~Lc!wRV4@=Un<p+y;32oyC)X$xdsaXCm3
znh!FKk`18gI~BB-6|`ktH`6E?Id7U98XADbl)(upIW;Gz7?P%v^YcoI@^f-hix`Sh
z(;?>M73qSMfdVKG%0SLPAR%2)AqGk#kTM!11PT@mJBurebqg}{l1qwm5OSIMxuq3w
zVTKg&*3V*wl+0q#hFC})UXoY>+877wQGxsl?oNUB&E;n1gZa>Xc90ehe7hYuzk&AO
zLB&BE5)<>1Q$c<Mb>h(Fk(+Z2u+AfN3myZgzXfJ9Fff2RR=SBr>7aHGgq@O71QUl8
zo3Oop;G#h{F()U#JQd;>)IET38R%X?U5Hy@aSv(lK++$0<Fjr_zHV+tL2feWAcxeV
zVrUvhkppu;;R4ZDlvu6{7Q)mEYIPJdFu*#NuohrRQDR<kPGU)Bejd1PNY2Sm&elyU
zN-Zo+%}cIiNG>fZO3f?LEiOm}d#WfkT{kZ=7o0KkvlA;pcIRg^K;tsLq_Q9tv=@;9
zR2hTf5XmU0`!kC{1ue*&;*88RP}u}xLwXCaut+aWEiTc`%u7kF&;@OYhlzt)P$<Gs
zGt-OmOAAmWAmM>54zUd)o>!Wyo0$Si=LkNeum*|c7H8@fB!avRvo|>-Gbg18)S!i^
z2RAdpfd=wFidZU4PhLuD8E8*zW-hp_1qDblsC5jJ&rHcl)rB<!q5ddN%7kwjEl4a%
z%w+)YOx6WyF46_HD?#?9=9Lsx>gFVtfMQ4&lv@}WKy5^1q1;SRfnJ=Mf~2NAF*~)i
z09h3SD6Vu7E-7Zn%`MdhM<N3QgFYxlgN}&Mg><<<cB2a^gL)3Ska9&Cny8>$aM>7=
zpRbUcm{*C~0V!4}$yZ3rtSBu2wMcS7`3O|AmZ_#Vs8%rK<?Dj$8(4h{assFWmS0pE
z57q=Ke<1Z>a+#rpfk6@j1GHWQ@ePeK;CxU$2`<>7@?buw?*b`@OEL^ijlktsa$;U$
zVxCTRYF<iFWl5@TwvjPd98?j5+d1$;K{peWx#8kj8Q?M&lzY*|Ky_YGIs*eZPZdMP
zp^_8xK>a_^u&F{pZe}vHTMX)#f%=}{JP2xUL)C$YQ*kL&EmkPbfS!N?DNCWIsa7a}
z$6G;TswIg<VE04Z$xs1lOcd)RRumYT8km7R335k#egP=yGr$athZq<SZUn$O%ZP9X
zg`<fPh!3d;z-={9`Y1-?r=!V(+j0o846st&(!8A1#Nv$96x~DvP&?ZSHWmR+B6%qa
zDT$T_X2#%tEhzPsAi@ZIm=I(<4XP->*V7p+4|j*T3CN4Ex;(Aa9NMPD;*MO<;U-Xb
zq~xUQK+J^oN8-VHLA^6jeV&(D!T^zvhjwYeZexJ8apBF|Gy_o80ScN31_lNWerR6<
z)W?8fP<+GoX*=enq!ud#_&O>;J6H@13<bG~NV$W7p*SP4C^bblB{xyGAU{6`+Aacd
zQ&Pbv128Z!_*MP??@{&tzf;x!|29?s|L?0L4VzW{|8G$B|G!q%|Nkmg|NqNX{r@jf
z_5Z(6)&KuIRsa99RsH|ZQ1$=+ugd@bzf}JJ|E}`?{}+}2|39ky|Nl<q|Nkvj|Nqxj
z{r_K4_5XiS6+{h49kDp4>i_?=s{j8Js{a3vs`~#wr0V~FbU)#9Be;DR4+=SO76Q*m
zAjCk~4=e;Oqd>JvW(w$p16b_{n#ss3%>@nVR&X&C)c^mV(f0p;P}~3i25tZU^R@l|
z|EBf-|1+)s|F3EN|G%g8|NorU|Nnhj|Nqx&{r{h<_5c4jE&u<YYx)0wL(BjFlUn}&
zFKYS!Kd9yZf1{TF|Akuq|Nqqd|No`t|Nl2N|NlR!`Tzf-=KueLn*aYdYX1LUsQLf@
zPfh>-UuydQe@D~*|19;Rcp$^TrT+i_zNY{GYnuN5k8Aq>-=XRMe<e`7H2weotnvT<
z6OI4>uWJ1Nzo+s4|D4AE|NR>O|2Js-|6i!_|Nk!y|Nob@{r|tE;s5_B4gdd_H2nV`
z((wPkNyGpDA`Solf2sffe+DR?>;M0sQ~&>eL;e5%S3qh&bp8MTI`#kmgT`f2b4x)L
zemp2;f>JN2KtUG=r*x162*WDR5@=_&m?0;zxCA@~1#VZxXC#(o=B39ML(X)93@#-W
zm4Nyz;GQnH%>mbpVO%_@;%9&jC&%ZPr4|)srlf*~5=wJYiy_kS@rj@lE8?Mt(j@0+
zq!xi1B=O~mMY*6F6>L+cQF44@N@77tY7vTkpw0z~0Hh-d6M|R)4g}E58pz>LYrz>B
z)Od_9$%ptjCB6jI#b5vp=0NN$0-r^PY8Fo4AcsytYH~?xN<8RL6o^Tfu7|j+C_ldh
ztOC{9V4=){OqkUS@!+;dd`V7Hd|FOvaR#J~1GWG@5ef?a;?$zd#2mObXnzpJuh7VZ
zdKOa?#9<(Dl-NZGBe@G9h#U_P(fD|9uvZ|3MSMnT1;o41WB%X{1uKQe5Ca2)AOiz~
zA_D`1G$@@iFfed4FffQSFfhn6Ffd3kFffQRFfgz)Fff4XN_hqb23F`9KcF*xI2jli
zn4tQ2p)`mBo%;i#L1zGgXc(4bU|?WjU|;~v;|N0qL1zU)nc%a6Kx_`EyFhGa5CO$9
zP#Q!@F)%Q&F)%Plf;dnt2Gs|06UYn@W?*Sxa03k~E^y^bWn`G?&9cypiHSjofvYKy
z#R;qe?gywbU~@qY7f@J$+z0XxD4am%gTe%)4rDLLKOny}Fz>n)5XILM6%=~v<vQhi
z6C|%M^*euROIYNIhmC6ScLIIytyX^4`Df0ZhNQWSABB{Dm^xPN&-pd`yXFxEiQBac
z_6TIGsGM6fhw-s-`kz+kghid~kAvsb-2LdKcCXv(LYHW^YDI_s%o}sEZg79M-`zAP
zxH566@uKUQ|3Jqpft-UCGczzU*fB6L9N}hR0QppqfrH^M0|SE!0}BHS6DaOE7-X0j
z81}HRfa3)u@4>{tAi|2^w}Ijd+}meh5MW?rIKaTbFhz)k0TeDE^%p@lBdL#LVqkdi
z1tbVjU(Uq9U?GT5Kbw((;fWx^Jpl|13|ElsH)djB;6XAEluouNz}&;j0BXmYFv0j7
zV1FDy(hq9jE#YEeSO88791Nz63=AynEZ{T;a&I#u1A_w-3quXm{~e4B3?hOE^SYTB
z7#47_FxWu#zhq!wutBm<oRNW{!IK4?Rs|V&8D26nFzf)i4{RPU!wLolh7ciy|6~{$
z7&wsp<Il*zuz(9;Um7C=g8-8JY7ifk;lO8TF@nd$pYS2vf1Z(n!Gwo}K?Ul*M~n;%
zD?DN0i<}D~aWG1bhQMeDjE2By2#kinXb6mkz-S1JhQL6FKnyDj1E^p3On`x*1Iqp;
zz`)Q0Wp5B;V3-1Bmq{=%EP%3uWEmKiK-vFf7#J=<*<R)h3|F9R5PbuQ{RhgP<p%07
zLhN1R#=xM$24VjSU|`UIvQ>f@7<8cQXMqe16QJw`Y%B~jpll9h76uR><o-jM3=B)4
z;`1^Y7*;^pVVMjJYoP2$84L^?pzN4*28JzAc2hb7!vQEeDT{&O2$Wrx!N70=$~MSg
zU^oM1Yh^JoT!6B<G8h=HK-pi+7#VIr*~`or8SX&YE^dqr51?!%H%5jhQ1*&+28I_<
z_KkD~hBr{Q#a9M~4^Xz)R|bYJP_|q;1H%s}+a?{-mjd}cK$wMrgB=ovKZIErc%bY6
z5f%mkD0_wo3xf!hZ6M0RAOU615M^PIfwEOVeKROKfP;kr#0Qz*!_LBB0~PPdWnl1u
zvX|vEFa$u^ECmb<HBfd&9s@%Ilzk_cfdQl+WX_&Dj0`uR;uZM}40oVxjeG`%Cs4Ls
zJ_ExGDEq-3Mg|WKh`+uSFfjN)*$o8@3?TP`%<SM`VaR}rA1GvCD1ow53K$qFplpi*
z1_qEikoq%s7#U_j#X<BOBsQq82~u;1gN0!URQv}A3&RR1TZEH^VGWdRz{$d}0m}B_
zWMS9>WoK}*FzkS`TR2%5_CVPSI9V7DK-qgZSs0E$**7>@7*0UhUpQG9&Oq4$Tr3P1
zplls37KSTOwg(pr!wo1qg^PvZ4V2x|$-wXh%1-HIVBp|{gxi8n1_l8rdrv0=g9?<r
zshfd82g;t(&A{LQWta3YFnB=O=eijfVxVk?UIvB~D0@N=149Lr9n;Ie&;VsG=w)D-
z0%a@pF)+-5vOo1QFl>ObW%?Nyc0k!~eGCj|pzKrq3=CJGY>R#dh8IwF!2|||4^Z}p
zeg*~>E{MOTO<-W)fwDJEU|>*yvR_SLV9<cFBPKF1*g)AKlNlIXplq$l3=9!a_KYbE
z3<*&7lF1AVB~W(8R0f6`D0|lw28I?Wn{O8bLkE<dw3C6M2g>f-$-poL%6_+#fnf%e
zy=o@|!yG94+D^!L11OE{_`<-j0xBNE&BU+)%1+^CV%Py?=WsJI9DuSbxS1GEK-n$a
zObi#G>>h3=h8s}!6mBMl2T=ALZYG8oQ1$|DCWa4C_8M*`h96M&4sIp}25v}r9^htT
z;DEAEa5FIoK-m|#nHVIX>>J!n3<^;86K*C34Ji8qHxq*al>LXBiNONOX5nFCaDcLT
zc$gSmpzMZE3=AGfY#$_c0F=Gu69YpClnqiJfy9nMVkaQ6Q;^shNbDRWb^#K*1c_aN
z#I8YNHz2WFkk}na>>ecc1SIwpB=!s>_8cVk0wnelB=!m<_8KJi1|;?tD4XRo1H%p|
z8x&T1kk|*1*r2gTP})1g&BAa3DlWpq!T{of#Gi1pFkFC&vwdS=xB_JxEM;W417(Bg
z2S{v?9+2KSyi5!)pyCRAObl<J>@~bh3?HCukoXrUdk-%Y!w)E1fRBmc50rg@7c}Sy
zNs|nGObjeM5cV5hCI*mOL3XL|urNqK#SeUEV32{b-z;Zj0Lg*W81ONH$L2un2p$#&
z3#gg~9u@{0D0>DE3xflcy@7{?!3D}b!NbDf0cAhnVPWurvKe?;7y_Vd30@Y45GdP$
zmxTdj2gt4j9u|fesQ86n3=AMXNZf#*i6H|j?!eE)Pyl5I@G~)h+yqk7!NbDP0u>kd
z&A<TSgTyoVnHWHB1+f?KurSPlstNebzyRWd#4Grj7(jjiv3KyWFl>RUdGwos0mKK1
zx9~GDfcyqxUjW5BRE^Rf1_lrxBtD0qi2>wi5c>rW3&RtrnxsDr3?M#8d<{Pn!w0DN
z5q>5HP`H4^Ie1wZSa>1vwdfB61Bee2zrxSN017V<TY;B_K?bVk!yg6)5FaG|grA8)
z11kQ8pNYW$%KpL6!~hCkkQxtO76uonxXoV%1`r=4&LhCYPyrP$`^&)40A(-x%fPS%
z%AW9#fng1lz2_eT!v!eY=RX6(A1J$ufsuiQ590oH42%pKP__yqBZC2y?Ze2(5CUcY
zVq|29fwHxj7#SL%>>y@Fh7Kru2QwqX8Yuf43nRl8C|iq_k>L)MJ%N>x;Q^HG!p6t|
z8e<0e%Y>hW;RRHD3qK3P8z_4XKMTVLDEkgS3&R&ETSb6{;RlqRBf!G&2g-gUz{0@5
z5AoL%0Tu=oC|iS*kwF8>-o(ks0J0BcuMIy7g9TLFij$E6#0QDT2rx0^K*e*o85s(o
zY$hH?hB;8S2R9?b0x0_)HzNbctsuR7_*ob>K*eRa7#TqR0g0dCXJOcZBo0ys5?>*}
z!~l{5v3CeCF@XFDVn5+$VR!&luffB}0OEthLFr#a0OH4GJd6wyQ1%5LMg~y0fYj&+
zurO#q#f^9w89;oH_z3|fh8U>$0bWLi1StCwFCzme96@SI1XvgfpyJ<n85ux)koW@u
zCWa+Y@g@OAh80k@g#aVN6(~DSfRW(_lr18_$N-81klrr>EDSH8;&yzD44`-diL(f@
zFnmA~2dM*z%Lp<tfaE}I9YH4WTnUIRA;`i2!XUPSAPa+xAS4`Ggc%t?e2{p9AQOWD
zR2)Q`AhAJnLLfCRf-DR+Q1KK&76u0>yG4+N0VD@f6C%jM-~knvv0!BIfwK857#Tov
zAT<vJnHWI&LF^Ji7KRL{ni>m6h8!r{#)**uBnMK%AjHG~vIE4PBFMtf0ae3e#mLYD
zWnZ&oWB|#5)CdSMG0cIAYX~thEP=93gqRrCK-nHbObi>K>^+u@40oXH8}^LgIWLeo
zZv<HwUO>flgjg6re31AbQ20Z|h1?k#zChU}2N)SZav(LJ`i?;e63$zMm>5`~Y*2m2
z0cC^4d7x}ieJ22AgTzIk><%F&1{o-Ofe;e|$Q>Z_ZG>1D3}E8!j0`4F_Lf783?Mm>
znjJz+3_ehC5FLQT2F-hc)Wis}FhoGbON3Y$KzxvRiVzD!0#v-rlaT?$2Z^5%VqyTP
z1F>s_SQsjxYB+ou89;oH_zh5eLB-z)F@fhGLE;O9SQutN#rFuYFwB9nZwRq4faE}G
z)(EjMEP;wo2xMef0cD2;F*1PUKx!<6nHWI&LF^MkEDQ&rYC!6bK-pCxj0_+-keUEt
zCI*llAodd>7KS@eH6Zm5pzNklMh1`^NKJw;6T=&*c#SX<!yhOcL^B9O;uOSofU@&?
z85vxlY>!?>1`jAZu9uMk)b|FN*&)orkOCFI(96hB0cEf2Wn=)!fz(_OXJY7qic7Gv
zFie25ABZzCOo6gN;xnM^58_M=bD(UH_yQ=KL4t{436u>IUjbzcNH8(1fwDDNSr|4z
z*$NU&3|nAqRu+Z>P_}~z3&Rm8`%NDs!wV?;Q!gXK8z|dg0wV)xOabJ60}&Pm4iQNB
zi1jft2te6;`WP8BplpXeMh1{Nkoq4IObj49Kx__4CI--W1c==s!orXORo^#}k)Z<0
zu9(Qk0Fnc#@sMO<0F7CI*cU`t7#2X)oSVqV0OEthBP5v^Za~E|B$*f<K-m?NObjoe
z>>f!b1_@D!o9|6zWRQWf`6e?mXh7K=qAUzLP`1P*Mh4LM2*~^lQ5FUZs5r+YMg|Wk
zd(R|B29O*`%?C*)h61QKgA@}(1(Yo!#l!$I7o^5OiirU<&H`dz5M^Ol167kZg^^(c
zlpQpMk>LQ84H{QD0%e27Rn9=!r)DxTfb@gR$&g}VU=f4(YuRE(1`a4&U<o4w50rgn
zF(ZQsl&!Ixk--AWu365=U;|})EoWp%fU-}mU}VUEvUOH4GW0;%Rx218CP3L9D;OE}
zK-m}eGcp{2vXu@nGCYB@ZyaP~cmZX*9b#mt5r?>wft`_|0m=roaay2k(3*k{C>yk1
zpa;qZ^;af9*`Rd^Q=n|nnu8fown9Dw!yG6ZROT&!vO()2mO$AItSk&Gpls0kfi+Mz
zXzj%YC>yknU<;HDS|hLn$_A}h*aKyQ)(RYevO((vjzHO<H4G=9Y|#3JGf*~YZN&vB
zTY#N`;R=)uS~GA1$_A|$xC3Q_)-F7NvO()8o<P~4H6bscY|wg)H&8ZcZO8{G8??^j
z3zQA2&woJKpfRn19%CN0e>4O}Ltr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(
zGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
zU=)moz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kW!5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7
zfzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S`WG8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*Oqai>kV1yd*|NsC03JeSkAPizdg-59o8Uhy3v;ayE91IK$pmf5I
zCoGEc^GonZk4lY(09hdbN_QX((#*ubz`)7Cz##GG|9=n$iGwgGeS+j+IE8_M0fb?E
z5DnskFi1U!&&<HU05T7RVQi2%h!3JcVjvn+7J3GF#s~ZQySRb`2w;#}4@aL60?G(V
zgUksIc8&M+^Kx}2(zN2r;*!){-Qv>Xg4Dbe-ICN|>{$|Ic8HG?K{tRDure@$^S*m(
zUTRThGDwIl3=7u=kZw?+0%m|X!v`nkrKA?e7w49e=_QE%0<!gEv9<w}-ZdB)7@Qdx
z7<^bDG!}Jmq2kg!BZExc6hqyD0&@KUH*A0yuD+fjAdJm=XFs<f5XL6w8Bojs!r0^l
z7#J8p7@M4Lum=MOW0MOB4hjZgY;pm?p}`=GO)k_ofB}TD$@w`uxqvV>Ip=@?XAs6F
z7vdJ~2Ey3nKw{|SC`b&7IsgCv4=Q@0Tm%&q;^YFt2oVI!H8_|7gb^Z`EEY^5xCkii
zf;h0U16C%(^ss^?85kJYpfo#_hWP{LU@oXQH<adq(!5Zb4@$$@H?VjXgo+D6X<;Zm
zN{xm9dI%&ZrljU2r^c5i7GbY+ku;<yW)|n977?YkC^av&II%dsI5{&7$q1~>;*7-X
zl1!qEWhl-}%Pb?#xePg(C8-s}8Os3jzlD*h0agd130CCfRp^2=fGj|hL+2K!=4NK(
z7nfw_rK3xc%ug&yE>9^jG9b#4cuY?($jsL*N-ZuSBF;g^fYle|m!}rxrxA=ykOnLm
zRwiPR!YNdoZe(C$q??;u3UX~K!Sso25VC#6rFj*Zy5%V)q#J{5Btvm!adLj1Zc%Cy
zah*n}dWu30*&is58A6=I%tYPH++qq^;X}x?G<0f7MrvY;PO_zefi6`W+cb1ChS3GN
z6lOvU6NwiXig_s|(bB-oc;LbeTj<gv921jsGV@Awb4xOFQ;V=!iY5l_bLQmYsukKN
z!<yY-of##B+aX|u3=9mUs0HbPxxKhN6U4=dVQ$V$E-uHZ2r2>UEA%KbF?{{^KR-r^
zi2>AS_#npw?lbr(Gckbr2D6wL7(jgkP`h6gst??kFkoT;^(CH&LdKmy{f6KF|K~F>
dFmU|*|3CjS2@&`~4CE51;R8g0#<Fl(4FKcI@xuTB

diff --git a/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin b/pc-bios/opensbi-riscv64-generic-fw_dynamic.bin
index 018b4731a710d13926559766a3433a4d058edacd..cce35c65c2981ddde240078083095ef9be84d0e3 100644
GIT binary patch
literal 273048
zcmXqJVP)9d!pdOG$;R-W;Xs-(2P=ayD+|NsRu%?hHcp1W5y>nPjL9Ob+Tt8648j~4
ze_K8DH6%Ebr8zVjoy3_L7=)RX|7>Osc9<T-#4x!j>9=?@6N4~w^3UX^BqrwlO$@w#
z$x`PTnfEa<Fz;t#l$$R%Pubud<3py$hm!s^I=p9Sh!(eEVG!mz^?kY*3&Z5DQx}yD
zxEK_<9{Wc97w2MN5awECSS%1_Fq=t$VU<wv1||b>FR=PAoms|=QH;nw*xbp+V9dqN
z@Sb5o46-jaw{bEUvvV<ERXf2!VKWn|uVLypw=yw^v$HS=v!@$1XS1_1=eV;r=d`nm
zJFzebGc9_vxxJg&Zjv}J1A{Q{+1JLriyYG?8S^nQv^q078#D1S7&A?B+{~WCWX$x*
zp*0;uinB8?2(z=l+|2&YLD}FDgR;pdhUx4q43pcBKcCsJZ1IUf*=7-=vcV)~WVgO&
zPzX^rS;U0wCp7tBWedFWLCQ9$@(`D(^D7%XVuAQkT}9ah#0I%AU0m7X5sR`76N|C|
z6C0{s34Y2Zi`bCeqHK}GCO7%9d-2D$M}^rx@S~~sFlI&#-()6cmSl#_ESsBH8JZ6l
zF)*J?VrV`W#K3&si9w0)5ML7i=EsK_H$T42xcTv8##xh-qly_oDM;DiFylfdMdrs|
z#s6BJ#F<$bgqaUt;b$;lRyGJ`U|j$cYrf2E%*?R)Ff$VjKb{OpZ3|3_1sn{Z{uPDC
zsSP`Ov9`m<<X#>IM)&6DJPgTg>5LP3SlJ(YmH#*9W@ku_sOE&ky3<)mtZ!z|VFtx0
zBwmXJm`scrL8%24dhP6=)ddXZHn(<n9*2Z;x@56HI8queR%I}G&tSl(x`L5Gn1O*|
zIx`Ey<Ys1`=10z~&5xN`H#cu~*xVe<B<>9IBl9u2$*sx8ti=vZ4G{Ik3;_aP_cJmW
zx3V&T#EONOOq30R*gh*U7)-vjiDB|5BZkR~j2Qk389O>MZ2qLg0H&RS7?d|Cy%BC?
zdfjZq#3uFyr0=tmfQi^6kWR5@Os|+8usz{>BlJP)huoh<50*Vy^<v$dO&_*>+4W=J
zAE$?IPrY9Hy$$*p_BHBf+}}qJpFMr`^4;4{AHRM5_4D7~&q@j=V(&gH8JLKDV*1AP
ztI<j9A0poxvobQgPnh7=Y|zTUY{<&kY}m@kY{bgMY|P5sY~0GMkf@TXlWS0DQfg6Y
zQ_F0@%F%4m%E4^O%Gqq$%E@fS%GGSu%EfHW%H3?;%FS%U%F}Gq%EN5S%G+$)%FArW
z%GYey%ExTa%HM3?%HM3%Do{Lu$)MSYRiJo+kV&&qE0acMF@u5uD7-=b9$ew|S!sib
z*tgG03rxg*f#PEFr6i`wpM)4NL$JVTphJ+6fnR`ufzh$ik<qEqiP5>ynbD=urO}<y
zqtS!Wv(b~$tI><myV0A`r_qPex6zl;uhEauztO)qfWf4x0Tlk*L!CTlw|+I@NO~;2
z^-`xRN801#OD}c0CcA89;3#Wqs11dvgXC29={%1itmo52vP7Wl<<ms+VC?j1B1IyP
zIo(Cll21H?mf6dvij;{whML35!XV7rI*B6@na_&GZ=HxH59Tv4FfbG|1PJASxPOun
z#9?4y$PW-;2KggDpa7hI^8*T4AbbH%kdoqn!!^Yp7S@<Eb1)PeEUqb5UQi<(?93=!
zEX?p&iuoTX&w|v0<rQG^#$fqmE@lQ4^<2#ViXSYj0qJ@FLH=+4hxwZs8G>0E9;7!g
zF$A|lX;wxkA4;<_LHSUcl^M#1(yS~{K9pu<h4P^^D;ty#rCHgbd??Mz0p&w!R!%4%
zO0#l7`B0jb8_I{$tUORYlxF3H@}V><ACwQJS^1%SD9yn70p$P7P&$|q%7@ayOi(_Q
z4rYe(p>!|{ln<qYS)qI=9n1#hL+N04C?84(b3pk}I+zp6htk1ZP(G9n=7#d2bTAK;
z52b^7p?oME%m?K|>0o{+A4&(aGCTtLKe!c2vob>YP@0tq%7@ad%uqg*W@Ul$p)@Ni
zln<p@*`RzV&B_ktLupnHC?86*azgn~nw1O6htjOvP(GAq<$>~{G%GKZ52ac8pnNFJ
z$`9p3X$IC$Apc*6(!q>SK9mk-g7TqsFf)`7rGr_Zd?+2v3gtuTU^XZpN(Zw;`A|BT
z1ImZe!JJS&ln&;C@}YDvH<S;hgL$BQC>_iT<wNOUJ}4hb2lGSuP#RRqfXbz<NuY9}
zm|+2wW`)uWP<pEpR31vRLTLu2rUnLvVs!<R8IOw94NPV{Q{KVGpuC5TL3slkQ?a^$
zi6DEifVc^$#$-fMSFFClWX7vv^#vv~-W97e7)VZL?Vj-oT?eRi^DSKTNbR5Bx3*_q
zzk)u6y=&l-sbzKltm^QQ*|L>oRm<#7R)*x>=K{R$$xY8$roI<u4Pbpg;elT=H>bd6
z^92md=A3L2$;mA2N`9@%HeX&bO>Z`Dd7Ui7s?coC$u=iFxs#o*X?ijnE8lyDjl9Xs
zoDlKk#^ZjiP16hSwz`U|g35hXqxTCQ2o-*X>YBx_q1MX0vxViofk1NQN43`X42IdU
zf6uk5wZ6a5AQ$>m(e=H7LH2ZY76#>A%k@Gpg85ls{=Vfpfj2>{=IzUMTV2&!mrb9M
ztT%ne<M#rIqPl<i83dSFT|x578<*=Ob8s?%?aZEexM{lKUy%Cu4;+#-e}Y*G4>Gjc
zl9^d0rkgS`Om0<OCeF&lAk4Z{{r!dyF1Fi+Sq)g<PhhYEg~VfN&UeYetU}`Ipx#Kk
znoKf3g8|db=bMkSGeOvYZ+}*2Fj*1({(ytfIgpR?9=ox=o9Ld*^i|+JgFynwP0icW
zl^%DqzY*7DVG!ojRAe^iWO&TX{s!a+=3Ol;jjpWhGajq8z86@?@mQSoRWc_RL$f&-
z+nnsi<4w~a%dx&_bX9A8|3D$^u>_Q@ups8K5RCnS_puD?Gq4(lf{MptFt$PbV*w~T
zpdj_J6zdbPngE9S$0AVng#g*da;%TwHs*tE6lHw`R_PGn@>rhr0VsYp#5|T_eb8*q
z$pCUSD9%7`e$TM6@NpaaJ<F}II6o@%e!_<0#}ce>1owh`bkGpw@&uX3(yVtt<`_gg
z7Gu2w(*IsS(G(IN9~d9Yu-@8J(%RkocseU6PM!)t;^e8o`wbhkA#7E__ZvQFfy_|Q
zP-|^<eb2BVQ>%^hEF>0>c0yFSD!$(^LE}AxVhY%7h7W#PZM+8|YFgVNYFZWFZwOF(
z&+ss@Y5HS%)=O(QgVhEY1S6T(0#SQZ;r)gQ%I_Hz;~{DsvJq-pn;>dh72a<MP<+qu
zFb1sVf&d3XjcWr$4agh;`S%P9qtsg88!XTQt55~`RkaSHLRInoh7U6D85$$hTHhZi
zNJFS#t%0Zjx%-0DdxpfYWHwGFa0<`wJ<RIbG##PVwGyHh6b=Fs?->>bgWcq?K^>un
zwH%^`Rq6eP3!?8C5(D2aa9~H0FGZ3Ue$SBT4~iSRuH<R#Dtl6ryVyM@x3)7t)VL~v
zN{IIx0tA^&TV4xuvb;IfD$K^f@t$Er<f&GOnpUOv8v^)2Wyl(Dh{#jr_ZtlO-ZNY<
zNaka8S_M_ds``Gz1)lc-2mF)ySRG^vSGC%81+_tR994b4L4f=H1_8xnZdN;(j#Tyc
z8#ZvhXZRS9%*|>86K&OazafC*y}|*RWNua~nCMc?_ZvR2HM+98zIO;HOy*>@fXTFK
zz26YP+UUyY`rctfelk0&8B8Ws`~8Lu%<lsfSdtl8O<<y}I`20GFugCB5RuHtY6KHq
zs{4M!2Zo*mh<jc2-)|6L=t+U_o*JxdY*c-};Xz$b21LZw==}zUx;Ysz6-SNd_CnMw
zsOiaps9`mIzu`c2Pl328s5D(V2_&y<v*p!$20@NhT@X>%iSHRMGHOA2sT1BaDAqQE
zVj_Gg!{o4448qq|F)*q(sxhiT%mmrnQ1;$ngR-*Cl2`8y43wGGT3)xNb<S%|g{V+9
zd%q!}<o$#Vj$joN0-TyvTV6}Eu|i{fsm1#Z2}O)<UagZ^893fgFmQv%v*r5@2MWAe
zS=}Hq6I@_2saEedDC9%TU;6C*hJ-v&ikkTxBEo9@{=k6{XgRv!g6*CXt<Ki&<mv2U
z?;9p$Cx<SO0J-EGG?l1Yzu%CMHJSCK5JdM<oA(<MGKJX~1SYexyaAOD0VW_8MAp^z
z{f35gaN2~bc;7G~3n70LB%g|++YTX{YWIG_f@F}H4TbP{wtv4NAqgbLPy`cu>hOMp
zLLx}40WPNM^nSyGc#s%F&i3%o(8=xLp_8YvGwquu9WKgH+CN#Gm1(<~vGL?KGvmg|
zGy8?7voQ%@Q)e)nzPaof!_R(maejVb_U|9IO&7lD&M;Ywoyl(I=Jsa{#+5%ACWm)2
z*v*_A&dI3OYB%%!g$JpVLphmFP1S0f{Pin8#OI)Jc@X|yfx!pn%2vDg8xDl2wTiPb
zF$l9QbAXh!s*dk3FvNmO<O2bmT5Y07r-RF-r6v$_R2|-LNC<w<z{n3XhgI?Y28W>c
z3=et1zN^-1lZEO@HH7F%wST`sA>cj3L2ig0sT)7;gs_foDBTIE6PItu|4=_0BAUA1
z5hlNG>qdx}>biwcR_j_-DC_AOMJUU4&E0JfbxT*DgtA(#AhxsKe80iL15p++y1r+)
zAOK5?OK-m4kl@znI(HwaR%bR}zC!Xe#6|7PCmvrleNM8~RGEiO4UU3J57?eCaJ>Ie
zP!D4Zo3nC2)VeQ~Jv{ZWusAD|aOibLaY*~%q}FtaWXa=;5|~o#rgJ1aGB!1U*o>|q
z7N!~P3oy-aKZ?%`MnR<)YERhScs*bcSk+Rj>hO_K71E+Q;0boua(Bk$l&=i$KNyrG
z^Fix~;)#cwrmMBScUX`Ms*yMNtF^ulVBiF`zZ~*Fq(Tk2E-8nqV-VyAsXmYeQhmV(
zq*{Ruq%I*FL^@P{+z<0hae|`>$cM=O1Mzu#g-t~nkVQfD^+q+297xo#Q0b@F$Do(*
z-ZU_>{nhF!)?_eYR^?=0*Q;!C<cqS&m2dAiIMfQa%Q6_7KVX<_F2(S(zwx-T4a=90
zYt+6@W?}ihto1#EW2~~xk}t{9ta^TL!=B#z^XSL3FMq?6`~C`<hlhp=vxkRH7H4PL
zHGOil6ay@$ZT|k7VKe(L2lU*wZTfaGe*VdA-#!RmcV`fu#>TX3x-t7ThM)by*V`F(
zO&7k-&bVv(<eThF`(`Q|u>4RqVfiun=TH90Tr58(^L$`u^+{&oViB&AVn~+aVu<T%
z<(+(6ngPUr%*FLjx|NsVy+MQi?C?~FKK5(VH;b)dNPfD8VMcOj|BT0RUCC|S3=kbZ
zw@+qc;0SA525J>AXh_~378+`9Zfv|=9OSyNP+@j+<H_ycKM2oYV-gl)XA+*u&SW;j
zYMR~DWo?bFGm;jvO%4}l*!-QHQMP|_xH`kf{=$B{>663V8Fo#7iQ*UG>)^2Y{+)mC
z+{aUH{Yjp+QwCIStF^xR@P5I9Bw_Xs>{`9aNy~+r%~`$*vwvVt&iF1RJe{41aq@IA
z7KX`fY-N)r%^8$Uo_t|-k9w$VaOKOknVY4*GfdY4%_yvz(Y%e5A-R)HY&I`1gR%k3
zH*qb{41(6=={hV7lY4X~?Of4p*77Z{?NO^&E7Nq_mz!C081=W8IwrHS3rM=Y7dTKV
z9iHpJ$F4SAB)Qeyc-nSGVYhGpKlX_{7G{%WfVlPj0tT2%^Ov)LYy{bs+{eZ@c`7fH
z@b#;VVbhsy*cp;pdH7}&F<Wyn1b%-kqw{k{706E4?a7|3e4Or&WuE?Mbw`-0Z1CmV
z`vnOxkT7^$y8KtOIm@@7$6<CJ2!P7eFaN-m&1}x{buuV?UOwjnrMSk)$|hgFOcw{w
zFC;4)eEHIB-tvXnoaIX&`>yG8k~@#jDW7@RtF>wRs*+cktFoR|yVWeKVXI{}ZTb4D
zz^jC-(kts(u4ZCW1M_ws2HxWm#j=O_83I^Ayu4P4Vy5Y5x5Ct}LQ)M1vxcOv;au6u
zHebFJZfC3g8jfrOSad%~cFC8$+qtsWZbz17s|Dq+t?;~Ucu=Nt;o<3`EDV!dQ^VJ_
zGr9}2F|a5uU{z1%JI*jAc_I7XUz5en8TL)>cnHeZR;{3%4Ppti2ONa(O2hANhm{rL
z&zKpQ)!ZT)-QIt&KLAn(QV)|YF2F2FAUf0nK|193!gN#?Dt%CU<M)K^3xkBL>vRzo
zhUP6#a^DL)2m*z8^Y-OApEVgw&P{1NJ_lT)fkF=4o0;%HXH^UDNv{`^zl$)4OM?1h
zFFiZYgZeantuqhLscxFy+R%7HkrO2U_IqoCBIn)xPMM1em`Wa{EXs6EY-$h}2loTh
zWRiOi&ncdH9_D(G9Wu#tikqf`TnQ=fOGBF)ATDZ8o_Kyvc_UnP({zw}kV;SpfY^xI
z1|%vj%EG{Gs+s_jh1no@6k^u#xK42W0+Iu%1&J!}ULFJDgK7u1Hw*$=%{!k$%t(z%
zJvse3Geh(8;||lGF*7tTbF%^E<g5M3`QLd!dYiW|kCd9KY{1HZ9A3o<E(VOQj}n|x
zSQDEXluefWQ*?c=P*4ccp}b>x7_)K9zsQr*UobOF?pR^nyq$yj;%P{kaLmN4V_Q3;
z`(##VTH)T#HX(T-d+o33Pnj7ew;nYCrI`tpho+0aV`fm+dS|A*L7dU@R3kKXwW=pK
z9cKZRW3|79r<*fa%}_Sj!N6?Z%mQ-1@}h4Bn%8ZL_mpqEtZb6<uW35SC5nF`zHRjd
z_1+y0F5E868gQ_4dugaGJT(^=xEQ?uP=5y$W}vWwg)4|J%-V1eSqvOv+m{<cViO?)
z5}(|@+<<{&M!L*HiKiToC2~8Sa~=nYD{p<S2Qmw!8Ws;WsS^*ceChQ-?TPqHW(HwS
zPTgh`PKM+z6~;LkYOSEL3D&1A36E!~{1<=D%)o5kt~H&Vfnjp{@^8uP-x*rdC%3aV
z6fbax#>Ao&rc6+5>?z(;eD!+Mbl0n}_<{KaVv4#N#1!{WNTzIXH-Ncr@^(=MVRJEt
zoBb0X3qEXWh%H?7K<!ThN81x+izR=QZMOW;Yi)Gh)bidzfs5Ik<!`fj%im^;c9!G@
z4i;ATU45L+j2@fI#2JP8p8ubDZaNzi!{oNK#gH~-+Tz`<ERM#l?2O55d`xWY$t;%{
zS)EVrPnP9iQERhng|ygO7rr+Ts9cu7mhz}15tP0xzWh<PVfm|UBl26>Amxv;$&)|t
z7fi5awrKg=Y|ircu_NmrYmOBR%;qhBn2lNfG+VU%ZuNWYIOCUE$L3ac#>M@t{}854
zzRt=hJe`$U_{VXE$=|*+I8IKM<zU#^z3~0gLo+*HitaosY~Iey>S}qqsbR1Cs*cjo
z$8)~@JD9#ud^YRye~uZCzi$6mE0HY0&J0TJ&D+(r9^Ri*{P8v{l$n=uFl=f?q>Wbh
z<g)J!X01&PYu)ee2jzN53FY;|?@7=DP${*lMGxG<S?KE3`u>1G>2ygJhRK~PRRo_l
zZ|7uaJ-(-U>S3?eg|5by6BvX!C5_%6xKJee5F|J8_@3&<<3X*<K=u_dl{jTC%4Et?
zYkiagDvgf1PA>0acqKaXajWYu(aGgpjE%=z-QS7d?VViC#ROu1g0NXY>~G?Cd%arU
zH$2FX-42U$uOEJ2+MWb`fVhZLTG?XDFJ+q}zmyHGfMbDq7bm!+WY#<>0cvkDn7lt=
zAm8cEY~J#x*^K26vsugUW>c2m$zP{4OfD~D`1xL3o`r!~|GnsB_6PjQub%Tx7UyJ|
zd~ZABrFqJW<}oNQ*~gH~%FhAvn`6af34W$p3E_J?7>$3hFmC5yVz8T+%q77p-NC|;
z{ADVGbO$Q~^Wt`f*&u!zGi&mfEex|kVk_JklHYMKD=*?>P+r2vP#Ow}eW%Jrl}uHj
z6xEYIxt*QqF~jzM$$bA9da@sPZ2Jcmk^c8ja{-to_wR>rYAHiuukwO*49a`nF(~i2
z#{e>CHoH87xEKqAvd%Y-M<oz58C^l97KSG7pUlc2ApVsRG+tQxe!&OE+R(u5&~(Ca
z^mws4gUPPxGm<0EgT<CVXGyO5$}w4tm1*+zXN<e1-*NsMmfU!qV>=r^gYmcP49U{h
z*ba#woP02Cp_p{X@_&wL$)DKRYsHfLjx#_^U}uz_%OqObs5QMNpV4*BLs*@1oT2yh
zl=`{HU}cT6$(Dbhy1IGk)4#h}w>oe*H%((UYx&3V2vkZix`Ij$<qfP1jIK=$pfqaE
z&cragos}W^$y0{e?BD+<KVHtXot=r{uXysi?F_KA&gc%Rd*koI$_|iDnB1y1y>@d}
zCWh^-%na{8$lr#kfywu}f@j+g2)M0kH+AiN4ffA=_pgno_modOj>tc?p?Be>^!pF-
ze;VDBU0E4g-8WBP&QQF;-M}&Ry@7)+y6Nvf?Ei_bvUr0#MsMW(2m9|R>J}hMLWql&
zzv(><b2B9V<|He3u=BkCF#j{EPIGt}s?5Q_!!!Y^|HV`c{jBcF9nX2*f2e;CF@e>6
zvpC2%=qAV(E_xC4qwP(D0NAYM>W_-G7)+AuzY6&Mnauw6f2(J52fM(sC#zb5T2DQQ
z`e4+l*Zuy$1eN6LD|tSvGZ-nGeEBu|`WMI9*OxOcoj?0}x<eoPWVV)H`=-rEn*99>
zvvK%$2G;J((=(DbPyfj<`S|z$Kl_7P=RE3leSctrj^)#2NlqrP&D)RP?mWIHf97Ge
z)+W$s|F7Z+>_*E{*fJkgGF3CWK1*;*ajH^HY-(Ulm1bq#aH~~y?)wG@ZHQj>8$UmP
z+&;Vg%Kt+5$LZgHNw=~X#k~pp^1eVIXI1xSEeDhLAMW2vc4uYUJaZ+(=AV&_$&H*$
zi>e-FKW5_mQM>&y59beLa}TISZl63=nxVB3WYYVF11ey(Je*%Vw?C>Z4ei|zb6INW
zTzLEP{fGHCAfXLSJ4i7Ni{JMj;;$jA0i`NCaJyBqaM6#pKMah^!0q<t?e3?QO}6|v
zdHmD|NSa{Y3F<>|a@;&v8-DK1r5D$p#QjP7k@h9)L*5(4$>7$1%65h((ZBAs;f~G8
zDcczinjd1V4OaxSADS;>tqm6hvp<?oVyzA51hapdcd;fPW@Y$m4r*C4r$0ZqYI^dM
z=S*ys&obSzmSsJvcB)xa!&Lhy_gR5k$=49I)@3D}iA@b`l}GnaE>~knp2{w^steTC
z5@v1rv8~&v>-_`)_Sw9w44_utW8dw+59SE>_WT3&L;uQr4XKUU&dJZPa)pz)<K$$<
z>Aafe$whC4z;>&r@3L-x=8(+61s-eq+H`7~@}4r@X0uM7R(Ip+&ly7d8(ox5Uh+t{
zf%{%8ARFILFyMmOmh82i6=G8R*4=HfjF103`vdAn3x_{r^qL;w{FtTvuW^|<<6|bX
zpJuH=ZTDK=f3Uv*GHq20%m?o$7_h?3dmOd>H^|qRVF3#Tux;k*8&nTBTd=bv_j0f>
zgW4&a94wHM&~@$Z)@=^L(^;8Ho4ux|<R`OnF)^!hGQ_nh8(jI(Gy|%C4McV7s%A5m
zA0QJzx<KmG+L&gnYGK^}HN<fH-H@sKOAD1AvOQ(sy!Ql}?pG??Z26Yl#;&sL4<wbe
zB!7)gZfB85Ze^9I4L|kc+?PuqZoPQ)Ani}qkGwC`ODE~`S55yKo&5Q^04NnGTYUMJ
zJds^yRVOqYzZ-SGpU{v73Q2IvJhPqmV2*ILG{aw++9-2Qeg;k-u;106&$8~dWlXMn
z%Q0CD)LVYWs5U*qIhoC!b90$GV{)e&FQg1lh;4OEzP6O@vl@dDL}&YSWs@sEl8fGo
z2($nFpUlTDBpv?OQ967%qc!_-M(OZ$2R=|q^kdhw8A-yWf0>QLmou<-C(E!4%t+ci
zbt!{y|BOe><}E*p1=t}bnlGQsdEBB{@^Drw)AUB~<d8Lt$->+mp!5Or)%yt!$uK`X
zzOemk^Klm5yN_2TaHTveajRTb$yVi-&6e}1#;JBuZCvZJY|q4|hG!)pc^D6r?m=}e
zsHK<uWgAB_({xry?6-D(Nnv&0&AQjYSbRH!u>1G_rTssiG<q-HFD$Ohpf+7u$(`||
zyEOaV|Bs(P|0d1KYt-oazQ7>5bvrmb%#XLb-nYmOy$vyKX={fA$SkJmtGZn;itc~^
z;eKDTJ1YaL?`H9}450XGHfQ+`s;@e?e~lL0|1g?y|J`WW{a>Ry_ZJo_ePsKp_Lf0X
zT!Mvx*<wXgG6x5T-_vV<)^&bXWiZj3(QL)Rklf0}k=)G5@i+9<3$K?!4{!Z=^r3O0
zR&VlCQ}fAFIhkr*Ya@gsI2e;tb}%@a9%2RYIv7B_MAJoJo(Gs$XgUeZ(*W}-O(Eq`
zt?6`D7KY}hPb;#fCMR!Y^2%J5$(8l2%B`BM#x3`2$f^Ra61CP>DZYtK4XZMrRsG#=
z)U&PCsx7Ql+2+YNv(EP)&L3AcS@P|%3+tcR?3@h3(wxk~RWb~q5eVUEZsueTE)L=8
zoJ@?98(lb`Prk{?G?|5gNq9OZv*TpO=Lc0L-{fQz{{EAn@%ciP$u~P0gunk}V0=DN
zW%5l=2I23P42;h^RVLrmWSIO@k|B9ACqt{st0|MGt1w)fe#7~1_+!rRpb?jEjVj5V
z>`Kh$E#LOKC-Z-IK=lQ(ADYcuzS+7bw>{Sat#@KhU!Dn?jR1}Df#NE;;;ja&douS+
z8&3CR*_STL7AjwvO<BH!YEcD?WDZuPcTYh4_Xi$mvAQRREoUeO*Ue9Uh_kUUFsrep
z{tTJU%fc|Z_iaitH=B%Od9C>7@|O(vzC3#a8flu$&GN%`L33I=LvsF22GB^;b~Yx4
z<jL1rMDm->TfXyT|Lsfexyr=KCC$#okX(11i+MXQ!(_222D9nSY3>Y<lW+cc{8jBQ
z$b`r5)IfcvZy*yMH(vk4oX*a$dD=?GthUYN*BKtpp3KU?6xXV3@a0FX_xlMBdRo27
zxvN?J#z?M!j(#!4wZ5NlKu4=LIdL@$DD8)V%5I_Q{~<m+Ak*red}BGNFZRPYd^uxn
zf8upyoeG+>S$G+=dLI|B{sZy7S}4TbkJFBS`5B(v`Gp5GKGVFtlO?&6U1(47p8Vui
zcA;j|mhYf3t)}T(oyokc0+W}UFeJ}p7wC2MYkhy<fFkF~zu};fSmW}S48O#UGru!T
z=VoD;-0dCEyq%k&^Z1@(NZZA)6%;E6<dVf$RX{S39@Mhdq}HbCr&_`7iGmCA%;qg$
zA?amV^|PF1xi=1jQo!R0?Dr;@>o6qGXP1~<?!)l7gZ&Pp8+h#KL;q9M)N^w4xmID;
z56qc6K_-AkNRyASvoV{pe0|jV{saGlWx1<b5VpY0zu~$a6pl+>-ydiYc`V9$2d3lw
zoK-Cc_e-~lfW|eUb!&piY!+6A<V!PI4yOMVPiFqD1hQ*c?#~d}-JseRR4yu;nEZS{
z;Q%{G<z&te%*p3w$~dM!dn3)s%W&_@yC=fD-~a!O0j+gzUhZx)d9Dh>?p75><Mv&Q
zk6(TLF`bQtp?O)G)#EQ$e}p(Qo3(tOJNNOtY2TB@R&#@Mg1NgDB%DuMN}iS|=RD24
zl#79By5e1kiR$Lo?Oz<4&04-QiI+BqO)q)>_&m!OkiU&Pb}=d|y<iY7*I}@IE?n-z
z02<W=g*EebZiZxjb^(j@WFB?_ka-|`cej3VV49vR$|?Xcx!rJCHS_i^p51L<96;^4
z>kK#hmACxjG2IDiDXPu|m%q#l_dY(x@~+ve<!i`ckX@FCAz`$;{fk4B_}AuZ)0OwI
z^MGTsk^KNT9NB-fLF{nXuH3I|!SY3PCn(lG-iL@j*SxqL<X+A55R=yKpIqL<(0RPo
z{gt?J=1+#n<vffa-a8nN3B>yZ<FPz$Wxvtt{te9EyZhc3h^g%=kZ|-?W!#QPNz1C)
zYM$k|<u1#u-SRd3-4kVtFJEH!EvuG9Q{$Gqs-<uX$n}qfem?-mjC#8K&+wliGv_yn
zGn==32l@2Jd&_+gx#hB`a+BNHd9O{M@f_l#r+Z-SVX)h_x63r1hO}R%B+oqbAx-cZ
zqbsOo3>wS2>Yn^+ISW|ba(4;PZUknH4)Mny*#A$S%FZNw{VAh0#}5ay>5cA+3tH75
zv;6qe9O}*>$o_cN(tn#nzcI9SzP$>XGngEHopIl^KY6X}f8P0SFAa5tx7)>8Ss0jA
zTZO<jsxpZ(P6XK-TL>zFK_gS3F$&P=)T$P{)_t9No$ogYhzqBNGBAlkT(z8!aiX%x
zl0V5`zHmWAj`Jpe`@(|WFIqIcd3*bx&DW<hw03VjKe_!&{p5CWhfCsLXIz}T@P+wz
zW>5+<_{qTN3K|7~^!!1+esGAIALslVK6%P_X3p~x)sm-~rgNSYX8p=6T>6#Sh;{Sx
zB@8#W{|!GUKDqrn^CtG({or*|zus>s5N<Ya`HfI{vcGaa$nT)>7q1_2Pm&(AJ!#+o
zyL!7i%c^d@9!AfJ&`|_%kAsO#VDk6h3|IS;=d$x9OY-ok{Q-r`is(%(?<W{|3r}-l
zxYx?--s<*#!2*%QlYU<&Pjz94Ydu&Q^dam`)Qi88?>Btlna%~8kJ0*T&c(!Fxj=c*
zZ3b4JgWSnYE$qyzxfz(Zbu)OiP8Q{6YMl7~LHwCUx5xghe;_48+RvA_nzwT?fM&}k
zhizvxF1KdfH!WG(owa#uH-qGY<lb*AGx8^7gGN+x`yWd_``79QGyn0Vmf!C;6o@`5
z0gcK$%5utvgsfBLqHLxdP{_`32kCoUp8hwv^Bcnr=f@SVA)_?2zx``;Te$yGNp9%R
z?WLhF;b{ewM!@OC^ymjrDuJbA!K08cOn;9yI?m3*puA!EJCIt?NQv4LuLqzJa)@g7
zw_2TzE;A3Wn%<J^)%t#efPSlc^0nm*P2vy5LH%El*ah9>&;<;C!;2@R8!S8m*0;R<
zIj?(i;ddtK_T&FS^F6}XpECxst4*KW&cgUNY|7z@?2qR?|2Mh4g;%(}MO1kMJHtZu
z$Fkr5DQ{unQSM;j0gcGOMsq8{vl(75K;wjZovT{jZ&1km8wOe%aImS?J^A@J22hTe
zEY8Yo>;5-vVN>#xZw!g%i`f5$O$4(G%_p({4eJE6E6uyulMk~q)S4&Da&m}svM>m9
zp1cQ|-&lHl+4PQN-Gfl~-^S*Ct?855S&`k(-pVV?-U@U7+~@y#-J8V!inF>ao3QdI
zbFlKrJdHTW=n9!1aRSeeOlEBm1;vjr>(TW04;<_>4}xqjR(JR)ad6+1jt7q0J5!<Z
zsmeA_{=9#{U<-27<aYPV9ghP~D!RTGV918JT=TNB!Aej&<FD$`Jt=dK?<wAs-Fh6P
zt7$s3dCOnHvs!JC@nlwQ@u#2>xmNr46BPVFa;&Fkvx_shs)JIo^0IGdKz1lEcz)*n
zgZOKYJy_pOzY3a*VBPAN`d-0-^XFb)_g?pl`@wDAtxHcqT(~s){euQGVOEEOmisGD
zf>IAC<xEMHNfc%mcp&n2N+xUbB6g9F6LNp{PktuOAn<iUDyO^1OJ$QI|0ahWV@~dQ
z#wO{W-0+ME;!0Izh$~es-cLB-3`zr_F*#=QmVdm>tlf;qCqFl5ka^i`-tuoEcn6D2
z=H%z@P!Zwj?M%sG><l2WcDPtM)8kn7Um!7dMwyp{OuTs=q!MHzOeJF0N%x>krto)h
z2F>#lxtwm3!;Uj2Hy&e>bW5IfjA`<>c80x&wzD-bg!WJV#?H9)&~`Qk#?XG@Z|V$_
z%gX;t9-5ri&M>ii?%~PL*ce6L$|M#~V6Q3;5U7$VES{iVC6ik`LA(l-b3wUq?<|=_
zk+;}X{M^5tt>OP)vC{s`{oC0Xz^uakpb@fVPZ|VHJ!pHgu4SvMvJJ~GWdoK!$|fv-
zlr305^9FykI^S<tP@l}eDv>;uMM9j9g+Z9_+<InHJ_fI;9Er)CtP;&?M-%^sD;s=G
zP&WCRkUX7Dq|sgcF*9f%)7(}+VSWatsVkVxm>EE(8@IDD6pMu!6l(}n6$^wJ2u~Ab
zXtr<ptv7A*G;xM~(<Y0$F$jm9V4lQgJmVb0XC(%c<T?C&rKgz9_!z{d2_$Wrro4rX
zQE!^E1sj914I6{90UMLD2^-U#N6l)iiLLCdYRVc{6Ox;r^TKSL-OA1|nXTnF+~x_a
zV4Fds>mYH*cOaE;Sq%mhS>1QZbJ*EIDv(|OS;+yc3gmL(Y2pl%r-?GyO<OljSi+6r
zvoeE;@H98DosXyTe@O1R#N2Gg$1rc&lq9nm$|eyEo2DVJN><*&#-wcUg8|w7k0(9<
z+Ul;X_cfteoi$Ne>uUmJln^vB2O1{?<>UlCNL=tuS2kG3@K}oV87Mcs1dX95LGoCt
zs<O$E-|sJMsHwfkY}fMZvzo(4Wu2=D&E|Xzr>1v2Ubq#M??5YF7zDPuepX>HQEPp_
z;XwkUyWmMso^IamK5^OfImt5*GcRXP1f}amDORnZd}Udv^h50n+n)x8RUPYEj5=fw
zg6hpR(aI)Q{wP}<`J-&J<j?yF3DM0KEq|FUSpGJfwfqT$)*|dZkk-(g<h`ej%Wg2#
zh9~nsV`1LLo{$-u%>InwQGrv*q7p^${Cs=DW69(Hgv%=!Y#(oYl-$U{bf{IW&8@Z9
zO&L0?^?rgw25csa_n`6y_C)0^><Nsn2vd|d98XZ*ay)_2_3QTBP~Yvfp_Tg~WyaG-
zkTT=x_xBST7z#rpx0i-`ZU^naV>Vvg2=Y;}n!`uC$<5}>413QruVYVK*Qa|F6lS2Z
zYI4|7W=1u$Rz?p-_hd#srpe+G49ynI42PyqVm~&0PCBc`=IhHDTD$G0KNjZu53$kp
z7R1J*pOp=+{8u)4^6!1ahl*x9mVcm<iqTbh!#f60ID^7iSe%cEaq^6Zpg9H5&Y|hw
znHie5t5-lmZ$@(H@#b{)#C2`SAHH&JnwtFgD@U_Ad&1w)<fiQ$pn4Bf=S>z3W3X!l
zm6^&GSHQE6$_8Klz2DHl2%5bxJSP5)nSt5tSrM}-%fDvRmcPwrEPp}%UNzNjnoN@L
zbTJ0A=|b$grq9S0W@Tk+Wm7hI`fo<QvdPnbGm4chp8lItu59!5-(%^mf8K9czyqqQ
z7+pbgXUyj939+G%Wxs!e%!h#7k4Q7qzc4dQZfVJ$lK}Ax^A2`~WG)UCW^;~&zv0PT
z-`Uo+TeVJO_4=S}!t&Rs6B5^;SxbR3uq(}3{xVy%{LyP=bnEn3cwQnERHh1l-u6G4
zQ<zcN;3UKQ4F{N+Dr-Y|S0uNJF-kf=o|g8n)$N_w<Tf^z(*DZ-!t7!UARi?+KWDOP
zJGi~syd&Z9wC6u!LlNob{elVgjIK<Tf44KIdn7XYC1-r+0)>rT=bQv%_MZ&R7VHek
ztsGp;i#-yP8JW47*Ks5!_wsRo{M6`X-0_@&*_49;6o#AGuQN<yUp0MBc5C;__qE2#
zt1=R{wI{d#V*`b*)l`{GWs5C;lueHOo%~#!LFT2h0W=4FnBT{2+Vc1PhxxNXbh9bT
zUuL_OKQf8TW-Naux3V%RZ}|G}G0(X#tbALy&u$lENN%~#xUVg7`?q%A?aBr(8Qw1l
zD6S1<s?^=i==%P{{!S2ie_FFS0|V0pNPGmnVEg0urh!5H7c+w}mse1;ITr(H1X0;!
z%O6mQuxxrWXl%ZplcV`5XQEb{Fl)=7_YDganxAtfCTDzQnYv;|a<KrUMk)?asA4wf
zVi0B%WdNyDn=X+ocwTu2JA?8bb_V4Q>`cmA*qNHu-4k2Ym9@SnfJ}Vf@IV@DR@ql3
zkln)Kq6}KoL8T5P-LZDNeul)!qfDo)(oj&j0L$GV5fHyN^yq$2n?LA7)Qh$!eqS0m
z#D6n02y<t<Hk)%pd}Fia7ijM163jPjYJWhsgZ=aSeZvA_kQ-LDBv*cA@%q7R&do4+
zx(LIv=|R((E!i0+v8zGbLawu+`FEGy%=ZlewqC98KiqEwnIzmM0`l|k_YDvDAZ9(z
z{rbzP@=*z-T@GrcJ7t5~<sjFB!anQ?B;=?6VrH1!waN<A69A>1T@W|6aPoM4VBX0I
z$`On|IY4G6|M|)l^djnkUKgYH!J}$lOc#LkY@6PaylM()%|mPV&BO0M_`iO?;6t!l
zD=YW=5BxubIXRh<d9zqSBU4_j?-zV<1hpBNpK~UjY89R;&R{oHi1o7?gURF9&wssN
zP!O=FgsIXgiz&MloD&{pF3JLhaP#&~P=21L{v8w-OqDS4MI{hENC!xa(G{fn{elnP
zFmq}{Q};7fhKBlr+Zv}H#Jy>I18Q+h|IG{<U(yDRB0<yJFVH&0Q`1|Lj~)p65%wkO
zL-SJ>NQ(RQzF<Nnh-c2#@K08%(@WAjId>~l?*ij8H^$`2sf-ieYk|tCX>*c5ZJ#-L
zpf(XmJv1eP^p}G8$rW3fnzwN?fKu6J_T>zxrcFtj#J+9%!}}AmS-UcCO~{`ddW`w;
z)X?9uvnISR-R@Mis0ubi2daA?WrJ#8Pz-`fShY7us}MSwO<Bc3E7**>-WP000gV_5
zbADh?&Y8(1Je`FJ)I+~Cy(bw`Gap_3{=x<}(0CN{R!(syF~&(Co$m__vO)SDSIqna
zDoY=wKvpDxN>osaQTyWeCg=qy-83+)LbWdzq;E3U2lnKrv)H^o)J6(Nax$?lP!?ci
zP&QFzRJKrM?05{a>wUoou-lR!%wl=y3USTTMei>pRDoOxauLX-Ok$U&L);Ym7ZSsZ
zN<g`7Q5L9;0g7X$N{~2A6cX>S{^IoG%nXy;*?)H=gW9FCy~d^sz^hf0*;oZY;Rab<
zHvJ?sXr0Cn&}xO`26JW+PsIgul9Rj58E1Gumbv~96atGfGebeX2Zi*i7Et;Ctz&)P
zP!Kr%D5#Hd^dqw+C;R(`39^!B#lJH%FsrM(gGR)Y|3Bvdt&I@Ad7Tl|O5KyQqd<8F
z3)5!v4-CqCSeTTTurMhvU}2d(-JC)4@Z{(0j5|sMPcyr-GH9Nj{9K%AM+HdKong)u
z@#CPiL+<aJpC4gNPWsN&yuFh_d4mZfqwAa}EsvGA%wzz$6B1J(m$IhUitn1fu^FUK
z+3x$RgZr7?MHxW-4|S&8?USFgGlgzvbZrH%WC67#AgwQO-Tpk?dR2?~QDz2VR@Wze
z>@siPH+(P^JPK+LEJ^{j2==6Wy}hUSPWs>LP16yguuunuHApwJY3dVDU%;}E?GLDx
z=Jf%TY8n_orMXt;iimZcMqQw?3lf4$?=Go$-!OqwtAq6*Bm~)wXScI3B>#ENH5rs{
zuUuzbHHCQx3&Y>=Ch=DG&1^pzYQuXUotr-MJ>z6$lNSui7B3iJB{HaFZ~~VYtuD#$
zUDzj!dou5Rojik+4ODZkhz8Z?ka*X;^}a#ClzAH`!?Lzht-S8<8z$5#9tG9v$?UTj
zlua}kl`S|JQnxp6<zxVrTM1<#xn}bY24#bv49(^ojLIfILG>FeNF1hq>3&9!h5K_u
zd-s=y?%fW_GhQDc<t!-mtZIR#A6<y=kDi63pN7h0237%ZEG%bNp3TY0ko@B(A0h=w
zB>oL=oZM{L&XC;ylS}*<GlMW2+gX{UMz`d);|z0>Th$)VJN_^E%``6Ylc2R|o@bg(
zIT`#~LG9u93l?O7%3M$z7@{-nWM}hF^VWH@JJ=bL-+p6}NV0AgVPte|bWdhG&XoLM
zI#cq$bcWfistn9}?2MD=u`*4*`i}A3R902x1xFbrl3Udu%N_q?-7e;+yx=8+@*+vb
z_X`e`AjbhHhe{;P?qFkpnfzGv_^+SaWwK*KA5S#@3dy^m*aE364ZXR&*}Q>)X#%Jg
zRr>=P6Ab#$_9X000|%(q1ce$GyI$v}&i4%$Bq1TEx{KM0i~W7WgH%MwrSs3`;$let
z@r!S=I2V)ft?P_IQz0S8Y|+k;%>07~qBnJC^Db6~<mtN@Y8N!`;$lc{*~P`YoQv_X
z)bxMm><kUU?&kkzvw8kcF1*f_+|S7Y($&0`bvtBEYw|T!hU6#DIGkFQZCHN4UvMCV
z*`nolvM(o-bo<Z$*6iwxYu!SllHWaJ5*FuV5{`V%Xw1p!*yw7^uE7{KJ;J+HRggnj
z@5R5zFHHY4dI_#z-rmI`diq?OSKFc1uvVt&T3zoKJcvh(Qa;KGYK5$Os*HNOT_!s=
z>hWCm&que1Mm^kL8uf5LB;;fZ+ukgCvFypI2Y!Eoel!Sxa@(rT6%l&i+*ZH_^26lT
zqsu_KZ9!1jmt;;>1!#KvGrNn0A^GDk1z3JddZ7jjH=A~bWX3-dpwdK`{rOUs<m72j
z7`85INl0#aA~wh4@f`F2+u0c!CLcHdFU{`xKl#^lsbmf=DUfZ=Tc0il#Y5v{;p?gl
z$+_Ppl3L#{c;J}q#mQA`758SX`)+Pe#;Z}uZ_5RfUug?QeMo!4tj@!b%>I*Uu6y!x
zb@618pF*u}$*-S@Br{(ZN@|yGlV(`!)~YVZp3L!$;qjd7|0JAS-IHHG7wYwz{)dra
za*q!`X!ePDDJMI#77xSwh6iOJmrQPTozA=)R8BKE!^-L9Z)US|GbDd}&NEq@n@RZg
zb;hWv9Er2pJO3xY`^5nn(|*qQZ2BDMXVaV7_hfuLeyPo??NKXe1<k6i_X`d{R?Xyq
zYvoF(s<75Y;1x8@?yL+m4=b;6VP@47<azvC`@850kl5SX%B!GaAGN=;E&z%Bysx|t
zD)wFbtKot@6^+M*&9xX5Uo%xN%4zg^l%2T$XH?>Tne4k!kLR~PuiQS_T#Mo8b&%e(
zmz7tzFc<D;bltd}srpg&qMWVUZ$$hJdn|kX&6JqOv!1<yh<=QkxL<jJ3u{no)AU9!
zkh!_ruSPXO^?Z$z-4DX2+I_c1eTaLL^djvEBt0SLL{O_1lovs13RHsYb#Ll4>w4e7
zkO&Fg)J9OMa?nj?hm~Q+uYuFl|6hEtG^I9G1YCyANK5AW&IPI`gjt_9up}l=Tf$Je
zq9q}@cL@h5J*odsX5-@6lXLR8_)btswz3{nk|jSg<p$S)kIcEPK(o-l-Y;;FWj1g5
zJ)4!AVRjoQLoy2&Tl0<<)@F512CKH94z<>%8K8J_(4O6Pi-FZWx!^ie@>DK1P#d4w
zoRc9r|2qrw^COI#&A&73=KA1($Zt$lPT66tkFr2*<vj&!|No4-x_wI4-KfXYo_%?_
ze@}r`8!Qbps6xzsTy*`<X7d0>kU6RQzea`b{~P5B&6l9|2B`G_S}W@Jgh2vP3+Q#d
zZ+PG{eJiLP;hGDn2N)!Mk3w?g@<ZTS;NMTAb_BF61Jwe&KiQ^lV`iA#wk)T4CmTcZ
z^qUO53z~OwG9>riWMN*;2`<Z+w|BA`9-qDi)Z10b?nwaEV-Gk%q7xkaT2HlJYGazd
zs`LE<2Fc`EoD4G(Kw;x34h|8{4-T+)1yhz^>mu;@@6X7u+a<E^Mm`o+|9KW#V#8{G
za8F*%ZM*Ct@$JkE!tCm)kU68|?&Az1&VuZZXD|B)Y9ZLQg4zZk*57al8&pez+LUTv
zU@Zk^t5z1!KABZr&FWmNX6?z3zcJXgPyfcupuF<ghUq&&?KaJL$f|42f<~9#*Ao}a
zaR%*`VVtPE;3q@#b}rUst*tCg(;+R2=W9V@&7fArL{3G{<Uh|Dn9aG^K{Ld=rYC*}
ziL13f+>WS|oU#^WF@k#%Ah$tkZ`ZS4A3$x0J?U4^@2NLt|KM=-v@qw_|8_IQpMqLU
zs_Dj+FB#q^IH-f%*SvFO2x~e-rZshQyC!3D=65zw$S7NU4|<>QKs~vSlMUiJ_9eEb
z)xHG12z%1#0%}2vzhVZR&y_TJ8Vl3p>(>}BP4{YRbWMIUi(yW(ajQAw%;WC`67(Q?
z-50c~Jbv@!52UxVC=28Vzt%^Ypj!2PLW3exWuqsuSYr4>_m$g0qHnh|Ri1>e%ml>;
zC|(!^+1`NmpfLzQ+<r9jeS(4%gv}ZWN=eOISlr(yJdg&p|I}I`?LwJEPWRsK<T=k-
z7zLGHfX1dQa#yuWq;sB@D3?60;i+u$<sbNzfqxr{*OYJHw%yLWe6{(6hdj?FBzLiK
zu@}w~P7`C8-1cm>F#Gp+6CQ8*yyH8_d`9rP*2vJNhRNcr%*hwoIUso>ee%xJpc0yK
zGMK;p`NYX$?hG^g`q=hO1FipUXHV|F&a}h(vGnqPFc%58va>52Z21Rr%lm`}JfM;I
zW>c1bpjEdZyFl&R>E9Va{f3RxzcDgQZfn~#!+9cmGW&8CP)$<`+V24x0b72&8`NL@
zcpDr8=F2;p#2Y7@O_xX(o@UM<+b5AP#AY>3a=~M+<G)P2ceM+%v$H>*wd~&<@Hkp!
zC~QSOXa)~FI|wp!yL)S^mtxjtmahzxSy_IowZ5O=5HXpx<+tWTW>uEo??2doNc{?$
zYn+h`^2g*dbB3Q{!s+e|$&YU_%y_)Vd-Hd9#-EqpCnPYz^@o7;XI_MqYfM#;@(h%o
z8yG-2jqT66mdUIwf3-T_e~5pzs$KITXoSbYbFvsaGiXL9`2rgYOD>Z*<K*NCPuL_9
zS=}JECg)t^0og3^P?(jKUD@QzpZ5U*)y?KDe?aLBln(7$L8%X{bNUk|B%R6ExF9-F
zRf5cUA8?@zln?D%l{HlUf=&G}e-~&MR&v5}HfGb7Kkq-x-wB#G6TW(#ar$#m|E}Et
zw3~C`VNmL1HdQTTbeqh|^4D(a`w0rhvQNdgf%YREb6(ck=*H^${=oZhAX`DFKI~@y
z;DB)F*YJhg|AtT84sk_6-pz2;{UGz3x3gzMMnk3~Hy>wXns~UW0Tg;_Um6%d<rLc=
ztxn-qHbzhjdvYfm<NJUO>7W*NOHy*rG@;2YEWdc&X1W?K*i$gMh5c7@(>I|x3Bupa
z8Rm8;^Bfm=JazlO89ATT9X^6m&ttjof8K`A0iD0VvFAavc_+u7C(P!Z0-$|;lgroz
zI=g2c0*%Z~7HelpzQV=;>Mu?fD~GX}gjpL{z+o29AOMO9$&<zE3<;CV*f~J@+!=(+
z*#$Bm&-wFNT|i{c53tE$+ZlShCYOJI3sS)@ApBh&(hp@)Hu)(4GVguB0dCQwpVb)>
z!0Nw!e=jW7&X^p*#y0smJICZ_Y#bm{B@a)2#x77ifi0ogoKv89g187M?SSH5+2AF|
zl#=c241d7-+rRJM#;$B~lVfuG_4)|~p#9GbjKb{f4LAFh4NeMxZ1rn>A5ahmiX~9&
zK*})TZ|oe7|3K!uZlC<ToxyZJC=Nj34;nWF#RVj;+yjc$8BA7n?wa0`tk)&n$-?N>
z`aWQS-<*WxmM<cc+u48dx*0CmQ9PNQ{a14L6QLQ&pw#?$#<71B@<Fo_O=69ck|nN*
zOvx^sEu5~-FypcCcQJ-!adx2{`QUOaUGn$}Z%`P6%dtPj>H;Fl8(s=9Z|@ZNSvI-t
zTfJ}@yFh6_=dsqb$!%;6q5aBRUV_6Br02bZKshL0SkHpuMYxQeqj_7WK;pC7FgdYW
zv5$SqTW$(WsTVH){#^K*8-wH_;dFM6g<Ug2v_P={djiOo$z|+J!fEOZGam_;UH>m!
z{_QWwhAH)(V0COvlgqxp2bnXWp0x`!XU8sJ&ff69R=gDKk_q*WU5v-f*+H{>klDAN
zP+KQ|V`G|l3^L~jGI2+`@|KqzJCc<*yyTcu4T{lLcV&iO42>?J5G}9)#Sf_8=9Hz@
z3YjHgb(0gj*k`&QG|vC!&-)MY^Fe-nxb<tu&+VYr4}%0~{u@-*y#KI&u~w(#QBcdm
zs}(Y*toEkaq~-5qwh!!$?ms+|-#lZ0%(=sIx%wy2o=V8xr{{*drgtPevc3=aU@#|v
z)m{7rGlMWkhr#4;<_yWxp9y@N{ljDOb9II}4<P1Yn&$o%WE!(M2g9!EJ;`$t_qBo2
zMso92rU@yQ3-%O4`Q29;W~3))JY#q){_Nihj~(8Ri=Y16P%hlg!nWnZhA$G2c6{HH
zGbg?C^qk_E$5(hXO^3MTh58;3;pyzm$)W5Fa}p+Y?|lEm1D8vdKS8(z;-?L2P~EZY
z48pA}?C%36sDeW3Q3@=qP<fCNZrRtK97qXweg(u89rBsmBO@cXgK|m(1KS@+$jkSv
zY8N~TiakjAto8*K?$|>8_$`p@Afeta1q<~Fl4`B*Kg2hF@tDl|fqhjwqkHn3tI*XW
z*BL>oh1u1wgX%)iZocMi&%{8f-wd=@p7nje28kUWpp*fsVUq8$LH!sY4iW>oYf%Zr
zWyow;>k^X7p9_L=Iml%b&oduqXX1R#>aN`IoC&d>DKYf!{@T#9@OBMEUpgO5Unf`}
z<7wpvb|hV?P+gUUY+pdTPeG%q3=*K$-m1<O(d$~?7ZeC-bxOCgFuebue{of-SL^$N
z4Wf)^m$mw}zW?yQ3lcA&u~N_oTxsah{f>g5^O%}MA!iIUPJI7ieg~|L1<Di95lC=L
zmh&2D1hVnD;)*%h6Hm`@ek{8jW$bb0(K(5o$H6V2d+bc0zQn2)y-rZAC(P>V|IqdQ
zfdy)^2SH{io2W9f9F%#fykR8+XhaaQdIQpSFAcrAA0!4EKYhD>>CxHkU;i_SHi<J%
zY@Dpuv1<BK*W@=}SwOqIuJ*5d4RRxB{tgrdE22TGGL#LD{8Khz`TxFP10%CV3uwOZ
zFR1-AS)7AO_}X>GR=4*B1zv(jA$EeoAvg3cc$6_Tw5cH%-0p#l>}+dU*J;$b=mBVi
zr-5Tvn^qU6yIR{Ra9HmDrqwQZ64GXY?9H-j1@*&%S|@|%eLk$euhpLW5i~BQY_sIo
z<g3>i)mlNj+TKq{uwgc9`2*?^CNpy~fp)D;p3ccM8RW9QWm7k|Ut!oZeNOU17Uex(
z{ym<#<)5;}6YyTR_Y)L6K{N5p<}AN$ye3a$XMTK<?T0Wc8@sa2lV9%x9CATs?%iHm
zc<#%s7u!0Gx|JR-`*Z5Yr4MXR88~;ffmZeSwdu98y5DMj|6%_ttuD!vpf%}`HS2EK
zL9J|6pq1)sARqjA|Dpe~R#)mr(3k_r_14^(jDD^6o-|vx{CGb>!63OPQ}A#2wKt$W
z1$kexeoVg0&UCKpRLfEy@i&YN!aP1q&0Dz`k{{0z0rg%UO`qfZXnIroWYF&P=i50z
za~Ztuz1_)Ep9?W>?`DLxFOp|IXKPhi$n{ug_8(QB>8}_WCU<EuG;iT#NKVw@oGh-%
zaBcb==WElO+Ce6Cb|+6|=Yz%kmT&J18j_lqbF(U@YxVx@e|fxFz2&<d=;W|(??3o2
zSk;=<`o7>misVty8sDte_Xi$W2i`1=VqF0->*o7b_s5^M|0s>Jgo<2z{`lA4Z>3R|
z3zT=vW?<D^$oW`W`}?yj*xLU06BrCY_JK=M7j}ka*{*wqTe;ca2Q-8%%MRVDyk$1a
z%k9b=X0u$}uDoY9Q|*4`9kZEI_bcz2%>c=x@253y?`BnAwVGv4`q9gCk}uw8Udqk7
zthH&n=l&*<#tF(>W-}yiFN`YO9vPLmee!ovhP%%Z;~k(@Imq`~ohza@b%Jt#L(sBT
zLHAZSMYs0_1~QIEL1*KDTBPT<t!n2)O09O_v<liiDUvMw&5S|!kwN~)S(BfMF^D{7
z`K)YW&McCq;oW&|O4iI%$`)UKfl^r0G*J3#HfQ;*;XPT5mHF{awqL@m?Ci=mUw*w0
zNN@$U`Vsj7V#C*PyVj<Lx8af7HN0<zzl7GZY+oj`w)}hlA%88Xqz9ErcCDa%$ZX#7
zkJU{idGc2?hU95SSq$<8(ge>5<T0KD?FiQJ2IX!hkSjnd%m0cbf1D-q*u-0S8XNQD
zIJjH>yboAl1KKN$F!yHo%l)8o0#qV_%8FGjkREyG_M=Zh<ISKoX~}%7GN5sa=55Q`
zIUaI6Rn}l-VDwN--g!t^oP&vRa*q>ezc}c09Crp#Y89Tw&b0Y^Dg)!B&l(IS6W`0^
zvTA^KT&_92<$d#34tC-6c7_S>-<+QDcuLmYf8f%6`SDGVlLXi{f%c#`Z)M#8DjS(i
zSvT0ua}sl$v}~%{)QN8I8x&F--9fGgm4c9v5nl-!VdAU<xfZluh*|mY+T=!dF^G9?
zYiG4JdN6t@rfM#jlijMO*U@--hI3|r>F+t&tZM5zzWz>b<6r=}L3zpXRmrRzLSXiq
z>nlL5$;ngQ7^e1uTq4Z+^h+P>`wam;VEG-(mnE~X3Nf2=GBmm>CMzDFJdKs9agu=Z
z<mqk<Q~UeaLG4lFiZq5Mu~pL>!Qqh1z`?ZP^p5uvl9_jKu(zrTr?oLCuVQDN@?Lob
zJKKcE64{~u6<yyyi2o`M-ie+$A2i;Pc`(uS{R8<gAX_K5tIzLv?0OVbM>DIZ&j-1S
zSygqu<y^=aH_sX0KdAo*l2tZXKF9Q=_)^fA#?y@V8|?2Ud$F>BLuffOgR<)KJW#wo
z7Gr$`GPn8p^I0IXgjtt9n>^K=VQ%jv*2%4{Oz$@o*lL1T2To>dWny(-HeKYcGQ(4*
zj>l(r&uTlm6|_Ew*_4yv{R8<Qpj5SVE65aP)1y<~KluL*B2)iuGP}dUom)Ze7|2?m
z=}VXynzyhd?>yl5W?^QB1Gr9jQ2!5<azOnk)~DdSmk-K6$uqt&$Rtnxrq1wj_QXRn
zk8Qj+e>Z2GdH8*Rf<Q~g#}AJ(A?*xMUlrEM0FA3MA7^Dq?tIPw8KDL9W<O_OWo>1B
z`WsY(GrCI71&x$|*wU@+3=kg71i@#z3uc}MspdTd(hD-NR_rnR_kYZ;tPIV^Ss6h3
zWZ@=2&XR!X2B~g5-RR!RZp{9bf!Up%p%!c>WSk6HRqx@}gN^Qz3zC0qXF#aVMN$p2
zr_mi%C+9h>X<F?dSFo}#=KuZ=G#j~Z>SKv#;E_3yuaNENJU#jASN`PouMExZq71C8
ze}5y|S#Wi3tPCJk8;>!%v$Ahyf6CB&jGf`{FT3{Sw66@j3zGSsGVE#xi3zuV|NnUA
zHn2?)S2Z8|{y({68#qK@F5T6Bbh}pj<LTS}A$AQLvma%UJhrO6m3?vl_J5$2wjjSD
zyH@g)*0fdapzv;GZ)IKF|NP%$sc&GLkX0q~Z)Hd>+{%Psb?UuZu}xEj*}wkRng$A~
zTCu;Piy6K#JeE3+VIt=<)dkSFc8A1nt=MA@;^Lb15GdTVrYSC9WliQf%Fyi2%J6vh
zcDNlNKcc1%&Zi(TkdI13@9yV)>L|#X3Ta;ov$k3^x`D<&8tmRPFxZ05F$bxI=m(8l
zf$|V&9#ZW~)Pn{FNV(T(+6+3cqFIF%G(Q{mM6YXAC+LLf=It#1FSYu$HlA*po(wu)
z?&zv6;ck|{EeVe&tNaJ$8pupMsFxnq%9IVtK_F2^@R|#l2rPvNo|P$VJU@LoXv8L6
zZ%VQ-J1euyUy+|Pp3Qg+awEt;2-m^fc2XPcwpN(iKx<A`buxN4dXeHfW77mig!@45
zg^cPVxATJ@Fi3#rHNbOaUGEbv1Z#Ev4P|tFzhVDWwbn-0_Zti<o83938lQvKCh{Kx
zh0Oa8_OEkq%9MiGP1B#Eu3x{(%)o4V)Dz?{co-a=ejT)SF5Lrd{rYug2IU>g-H_En
zR2~QIs0W9cx`a4LmFagESZG01EO%}_JfpbLofCfU3={Ztn#ty(43PW<Y9oO5v@ZK|
z=>uekD%;ajKNvVywP^K%W>uM0x!BkBZ0dcVFu^66kyYf@i)MFGDXs40UUs2-Pp01n
zuaB_>wc?T+*o9`4C-brk%qdRpVi#aG=VDQ7Z8qTowUNJp_jC!df?A9Q!q>MmC>uQa
zAw1ojIoXw+Z!&wgkX<XNJ*#Z;<;Q!60#jkuZb9%`lYj!NCK1pI6|J7e39VkqsVkY1
zJ6af}S$P=VZ<rvQEECEp%q9ccFU0}U^FE-!QLE>1{mMVgrY%33%~^g-{$kGX-XXv^
zs#UG+S?ff%_X!*P9Zw3nHM$11zTYr`OZ99}tFp~3CS{9R%*rOanBQ-hkOcBgvndx#
zR_mN{kh@Kf2DLJ}O>}*~VFJ7A(Pvq1*~_xoav<$@wkpV8Q?FLHN>B?PBzJc^$o9g>
z_YN1dVX9B=2g%e%zTEDXT^o6EJ50PbGIc+Uof}!Yz1h6w`?)Vo)6ac*zd=C)mNtr2
z1u#xa0-Zk#i)~1|6x1f2eg!m-vqWV^g6(0yFVk;=W<fkvn74B>7@qd}0UA$^dZBEy
z<(F2sQKwlK)ATtB&898CS9Q%P-pulwY4epWOvxgg3=0=9%>?xoo2GAO4|NP`ef)Ad
z_;eLWZws`K19EE1qRQ!48A0dgI*D%ut-e<ceV_0k0MZf#^~l6I85o2)J->$Tho(pA
ziSTn05T`$Y){aiU#>~*XO-%}vj+xEXB|&ZLZPQr~!$#&oBl6%;wSS;-_&LdTQ$b_#
zbCMZd?WQ8uutRJ)E(!`4NN>Iad;%XV9HH{UP&s(n0<s0N#${EDsO$R!_3I`=POfMu
zkYYSrJmHGSWOfFQ;sx#oAlo7H84$DB`Tky>Q~mZbXtr-MI|CDFKQE?QnEhax4ekao
z(<g{<J_YMqfO%>K$PeO>a)KQ>?+e1p2{uGI0ddQ5R#50En=NN~`dy~<>t!&{_&W=v
z1rBa~w@-Zv5@j}TXZAb}33JeyB%u8%jINEx_9TJM{{yvuL45+XH#^c5U6pOV{Mps=
z{=xZ+Af3wg%l}y(1<eAqy1sAtAPs7li9VfqW=BCpGUIuWT5v4=6$FppLC&ZF>0>re
z|MMuNay#Tsj^~#^b}Mgv_Uq>MM=7AuhQjR-Kd}F7JwB&?>S0)jHBASH&jxoBSlEHW
z1r#3W;!O?7EUan~o-^H(A3RqB<p@xIU`}^soPG^7Q<EmSs-277Y`TQA*>t9Mzb~M1
zhM*73*V!3CyR2H$o3E=ghPv+R1dT?$KM>ys8gVlJ{-2pie3SUk{?F6dGwixHr_W?a
z?qipk+%Ce9+{G@_=sxj`G3!r;bFE-q3*H|9>0(XaHU06^>HmraxH2Gl0g`V(IRa#>
z-xq|9zOG=M2jbg7I#KQ0*9o?-g<S${Ujw^DqkAXVKCqqz{JTMVz_vY`{;zlfCz5R-
zyHs7@AGqHLx-SCc3XsTz<SFU8uHcosCRhHvKk)uPXf^`0PIq(qHIUEvCWF@JcCqs{
zy0@mjyk^Y)jiH!<U1;6($FHyd%iRys-+Yyw(bQELenQZeKkpCZ|3;hy)ba;p*4g7A
zldc|abZ1RHc?n|9cA-^Zb9(nfLLU(duCDt!-yh)r4)X8G;~?K&JlyEsdjk}<oQ<&1
z<zET+@002O1owl&5@Lp}>-z)xpFz5J9tP=Nco-HloQ;sM@?Qqm`xH`^fp+(S!lamC
zgV52f#S9EWFZcSjzF(lfbm7+b3(hb8xF5vxUj$OOsIqqN`vv_=Kw(_Cx2YkraM6dh
zFAWlqH0yq0GHc6EyQ%LB0^|jcE-PRwVRTJRY-$i@ZTY$E&8ZjXo?LqH{zLpVVOEyk
zkXntw7qk)*RIfowXw5e9TcG(|tux8Fh?SV<rq4-kb)9&e*_4aHZt8o71y-PykFa%^
zAk*FlBm{v>dR#v956IqUDQ=m|GTE|N!S*AUYM?RM`(JYZBFZm_EOam26;Pka<%m}2
zswt8S-hZ(F1UmgQL4Q@dSL<WX58yHvwp$I<4g<{%`n>_|tT5^nX8XYYS;gVws?K%o
zjViU_$vJ9_lSMh1#HWL1_}SBiuRUcnnl9m-%rcz|QWCiD6=!2$5N31Z-qvc|`kW!?
z1!#WExa&E?`vQdmPWNP%r%aHNPjz>ztKZc34h@=4S&i<X_9Li$_9)X1JbTz|+VY3d
z4YcnwsP%n;LfPXm)<2-J*7#?jIYCf-*M=qMs58P=SV3I$Jl1Qvfb+6eNR8F{2An<u
zK4gK^J7pE_H*0<WVg7EAU9IlOwke+7c@kDC#dvD9ak?h=EC;O_nfjdJhG#PWcP3cL
zbi)%gr_3DA#@KwFmGQCY_kSWu5^2mkSQ+M|noU16JvsjdQ}To7ERScf{bgOi>DttQ
zA<vNf;5pOd8En5Fvg)-avVqn)ybo|tV{|Rt|M>0mA8)r$c_@+gkTsD_dB@X#AX&ZE
z_W=$ntgc)4$9PG)CntYr1C6?{eNlVEAR&?l3HRemlFP0$)P^e?urWwH1I>+34u8%l
zew~p)n7#evuIZ~<I-J34{B4f>d4E8EU$a>YX!Q24_%zTg>9bO`*7pnUF9FpKka8W?
zX8`rPy*@NBtZD(>EpYQ8Bv+)*Pwr-y62HdGz-*>AFPW81YWg+MT9jvVW+Wx^u}g?g
zWd`l}Ett&ufjRl*QVF%`Jjp-LE}O2rft_K~lw=;r`Tcw9XC4QgN7pnRw5LLI0XSW#
zs!kRbV`X-nq}Do_t%2!%!2wT1>VTvTMc4Ni_CEu;WODoQX&sM~Sy_b=UEg1*e+m&}
zp9&Te0I9Qo0&$t!<c>$6)kz?i3A3iAE8AT8^L|17c~Cecd$MwY(vPzC@|0wDP9D%{
zxvZ&sswW-?scM=IQZpk7WVZ6A<$WN!dAoZ*$WM?EVC$RvF`0>z4Ro)9MZM;EP>NRu
z??L+V2U24)n?ZIUfyP=GCr=htXV^8hj}_!!VOG`4$m-uO2+&y7s(2P!c7spnn~|h8
zo#XMztswQxs;Z5-`$3~89ZBym#6JOxnLcfOe_{S(2zzPk`wRCUf$Hv;TUk>VZik4v
zw!FVk{}42u61sOXd%(e3h-s#-P46%KzYkHv+VuW{{e6%c$GxDE!0!!cRZas#vw5q)
z<eS?WCjZi8NS@0j7xZH8WWBDduAq`4>cOfO;oss6;B#ae99Sp+v}Dlg6g<nkvqj)<
z_%iXo;+xBVG6+Y`WK!PpML@Vxk^wxoY`~!AdoY=Sn+vpC13Y^D>N!WTx<W#;85cwI
z_7(x-@aqh$-KDQ<!{x+l#eepLb+b0Gyf;Wt%6!^v-o;Qn!Ca(yI}3Qu8MJPxc!Ijf
zXSDzUknWGOD$9l0zvnA&xFXQ%_OqWgJ-PR$5M;I)G$JJYoSkXuxzgFmVw`NsTb>Aj
z$^!5Xf&!<KN10)*i@+<0nYV-dFi-q1s{K-)7eTY)cI}hDfB&8=$j!oR&c!tO`}g0V
zvy7$KZ}t~YU<a+FVl19up3-dI#aKLHdCJc1+u0i!V*5S!3xEIqw{-SnNzQ+f+rhKJ
z<=@{=p5DoDvmZ3C9=gBPRd{+S6X-OAFW~v(_XZBaQ2(kx{i_1?uS&6cfC9+Bm1V+g
z-|Ab_KK6s=o(pGR?N{FLL;w_KpVb)@;y6L)8nn6!r*jG<x9nsPF8}#{a+x~A<aBnX
znU5xyfB*Y+cJTyu1yH#N4+(fE2(z<KxY_@5>(8jOTR|-^P|XZ#eSzB9&E~Cwt6Ho&
z1rJ-~D{purqHHshCHWLPpQC$n_ICzI>66~v1v(Yic^7D&qP0a3R9nU0TGcMT9aJ{C
zFG-%wE&}oculw5OpZ&?L&ly0cj?2Gj-p(ST)~amtlLgem0oBx?8Xa`I!i5}|?&mX3
zZs&D<zrh}S+sFhbxcIEx?W~|4{Cm)e))Q>u;*&l1tF^vQ_)rTIai8V5U9I)~h6CO(
z5%u1^+d;km|F1!M1uWp=eKYrSy1w5~{|YQ_1s9)WyT1|K(gWv#0)bFaZNvMrjlH#5
z);+oLxtlKN<QW%U_vF6kF5ntz!~1TKn&dglUEXiV@8jJ5{=@m*pVb+DKki|Fcd%L3
z{c*?he_&lqyza>j&zT^)`a8h7<}G)4zk$CSr2gaYn_J&6kng>?{r!UYO{>~N?}{%6
zh3fM<zb~LsWVN>0oooz@p3G)!BB$C|HB<kIF9r4GQr{@sT=}JJ@Z=BJ<bZ@?kjc#E
zEPtBKT7LVrO+O0i`LX6e>(TD_0S<+R%bItz2!K+c_zp$}VU86OAu+go;;A;6j;9$A
z9Z$R82Pot<?_gn^lLC^3=;-K&=xFbUnx6(y&D!}sz#+SN2Mg1j9E9o>y%5#Qdm*Y-
zlOd{A+ujExWHj$+VcC;_P<^5sqWX9@M73)IM73-4`+$a2(7Mn)83@%cIw7i`cS2OB
z#zIu5HoOm5kkq`Rg>6p(LN!MRL^XQ{M0INvBotd~-v=CsZ{E?uzNZ4ATB8l3S{)jS
zOT!_mmsY(Gco5UPqlM!RlDj=xAgbM4AZ8y8fv7%O{yu;qs(D8X=N%+>XEZ@nr#C@V
zKMjPaep>QAKq0(&M+?^-BzJc-KvcIkKvc8(LsYXCy$^5*Y2MMoeFx%h&~1qvE9xL=
zXL%h&wW<$9wQBzRfP}#29W6Y6AnpdMK2ZZveY^&u+SL=H+BN5WK!acNjuzfO5O;%B
zzo>$!eqIGpo$3ZrotpVRV1ak@4i@G)CEySQtLCVLsAjK(sBU$JsBTSrA8^2<c?S#M
zoEn5`jdF-;^>T>nr4A6)OOxLRJaBE^!NUIs$!w2Oh-&vzi0Y%Z5Y<N$-Ul!^|ACkb
z&O^(KAu5(yLsY01zYloe(7c63<n9rO2<wjb0SD}xcd!UGZ*LK-wM4k-MHIxA=TQ(d
zQq3VcQlmh#Xy6)9;e+X84%So6J6MF9x3>t1gMFS64bhh#4KfR&cd0Q%@6xdM0S_#;
z?tH&s{pVHfP<0L`w}56)4sLnBVEvigJ(JlL4*uN-ky~yD;yvB>enLSZqP^H`-X_rN
zwzm0ee{$P(7SKq{o^+#jy|%fB_Y~jBZ#~>>$}R+&4_ws(IfX&;DX2{dJCSxWYrCLT
z>-!J>;PnZsT43T|Ltx_&YHt`MaM{sp$}ZFkvZr|BdBS$^{{Y#HY6qxqcIrjjmj(%~
z&g8HKY|Gx9dlL3%Q|G#_Mi<2ett`o%Dy+;~IfX!dHnpkm1s0??o45QlZlA@V%&?r{
z>1EI?D{uPbZ{PnWw?1QN-p(o9``QmQFaHxX8~gsl`47)hmSsMw0`<4tGC}=31mCL_
zBC?O=Xg{)^{<jb{AGgC?2XYn2h0La`!pa6Lzt*))E*Ay$zy&Tnm|U*PFgeAPq0{r~
z<GJaR+rP6v?dNq*Zh6inn9j?d-29x66GXQ?7vcrc{m%s?(|Oq?Gm_guBC_nsEzd<b
z(`DI{JD!WNf>iW97Z3%}ozEq9ruVWx?N4rJmy}HBWKZsW&Lfzf-1S^S5X77JoNw~=
z5{AFs4_^y^{lYreJz4&%j91%aR+e9&`!gB>lHC`uuw{XK4(Vxve2;M9M9;?)o_}L?
zh3F9GYG7`f_Be9EpJsEGU&2>i7=%k(`8Q8@XY`u7`MSHK%tO#>Kt|Vd)0GW=3V_UH
z%R-pS>dNQ^F{f$T<M0JPO7}CHatbKhZ22*nwdL1)fdk>q<}JUP&02o0YUzCr3Nup%
zUiXQfk2{{f>GXWL72=QH`--lNUa9*9U4^+Am|XXR^n!N7_FpmGFX+nXRk@!NB*PrJ
zpEEsq(sM51t11k#os&gM878-|I6&-IbZwgUIBda(i4DxAEWajyY2lwf{r~@E)1No7
z3pAT|3P`5k><6t(<lPTZFX-AdO)}$g?1DEF8<<s5bv%Cq(y{qDJ7`~+0ONK}S4J<*
z{iwErTr9aARSe?(qkB2iIoTh#KL2(weR8|`5ykYU{le_*4#{(#GoY#mnR{}pV!ALp
zyUXL*&mW=73Ue_q`)-}g+9?PMjrE7wvP`!^PT6RCbLv5Zz^WEdy433crOBtqLFrLA
z-IRgT^XhBiP;th&>7bYdrAy<sB@93NC$kwa@gya;UFYjeo7`r`l-zlpqZh(zx-I}>
zm4U=~K(b{_$qm;9K<gjPn38+03xLw&&;Ffh$sN}PcBXZ*C3jut+nAQzd0k*5h}U~v
zU}aiz^L4J3AYR{f0f^6+ru_u9Vh<!YUKbKB|IRwst<havf`LJpLt{%a_jQKJ&^9Fh
zHp>-)o*TDMbhm2-o#dGuv48>8I$?A@HC=hb7Xi?jwxGQ^p#8GUTUi8@O}6|3t%!av
zaKI3>rh?g`<(F3b%Eyz-O&NOK1U(-&UjM-9`E_rryX$^XDp)oBdDHUy3*A?>x^5Q^
zRcDax<YN_PWo3cMJ-@rEb)kFUc95B%HZA|!%I)IQ|NqyT{+vmD&qVjxtgH-kw@(%q
zXPErGoqyT%p5%q@GxvA8ckZ7YuFf#GyN`X@^fk!~-8;7<^C!CV?nl-$(Vcg@u&6jV
zf5B{azXo!ZCW^jJ_qTgNXWX89!@$_~2XwaWDo6?W<<y5uFN8T;ei*^Z$PN=$W>YSq
zW>-!IVYZf^pmLHy5>!sIa=t|`A<emjdtZasUO`L9_4AgMuvNNcflh9HmI*qm7Qy#x
zg@}MkNMt?vvmt6e!sp3^zkmJPo1V<_ouScH5In1?*9sc<1&y-Uv29LW#sJ~N#$=|m
zGB8YTZC&vG!~c~aH6XR9a!WtF|8V~zcDdFG??2Qp!!E}<_5FwVb1*s1!nS{lel7cU
z>eIP*mtI|acI#2xzocJj-?BdCy<=ehStK^`XF0Peo51Au_D`Exzc6g-d@t~TN2|YB
zjp0zSmcXH6RfR*J)f*Tl$DL;o{%*%Gxwwj9a=aCT-1N!+?HP>OzdN?N3V*g^m>hJT
zady~!M&Sx~2IHBj44Xe~V%Xfhjlr%rS(Jl8wtMr`rwr!T`5Dab@iGXrhkp>}tNUQY
zZp0_d{+(Tz?;rcyip&b*^7jnJb>|tMN~B8cno%@k@(u|GVG9Wc;|vML?K}S8e=4yH
zEVlUt2c!9p|NB!VtY#p|&qtBx;9wBtFyfHqFy>%)gsbA<VwlRYiDNFuW)5*jkojP<
zIC!wC<%6m<W*2u9HWz0wPG@J_zT*FW^Be#7Kb2tP_%tI`0%S(fjLk1zFbJDVFc_zc
zGcvw5zy5zd8+)p_)x2a0z6j$P*$kZN$vMkIl4mi62!HS6|5@fYeR5md%Vs-v26H|J
zCgJdUhDFmrKA-Vua<D&RGB;nq<j=(no7)yMnY;5dY<J>i5M`gsWW>IS2^3zFn?A8`
z-|_$V_VxdNgTiccQ9Q#_iKp`0xBS1oYsR$sPepzf@0tQ~+2sB54BL18-#xjx`R(TS
z@{CWVChrhoSTuPvOE{zQhRY0_AOB$7?!mz@dA|rq-R!9x+g-RAo=R=vn98zi)?AKF
zESulgGl0WtvlPQzmd%epGj3*??f^1-^Q#I5kZIdpco?R#Y+{+q0+QMMB7$-977>Qc
zPed5Ed!UD)Yyb8o|93wXnKlKa=4Oxi_5XW8Atg2)6uz$g+pqke+s5)#WZ9(c?|B)v
zKjvikSvGl-5X0pD_z#nti$6?mV|#1-{1L;VX`A>rG0%83x&J@=<mS)p+qeAxXTJRZ
zzs>dk88;W#GdvYZ72m$;|Gs}y<fcCr0@?L%62u0OX`3HCVlWryU=U?DVwYt%Zh!9p
zk~2;ZXV@;p!!VU;6VqI#&HeEX+b`AcZ)18Y1PaB?ZNUu2&)+jl-X_Kn+7DVE&-QWA
zv>A^;thU#};q{DQUI~cL_GxlU%bP{h7EPJ*ptAgDi7-3+&sP7*Ei7*~bNpa3=6=Gk
zXo~gpe1;hhKw~=Wua%}N8ysf@vD;sP*y#))HanPoo$+Uxar+I%O&v~cdL2JYC%3Y`
zoZQy-V$sw^)08*3GHz!7$&}R<*W=Zzyupkys&iK>Snq44=@QAwOzc8n-diw_f!zwk
zYk&2#ObL|!-by4dnl>fLSo{@(vIXZ4v*{qWx4i+2^*wU{@z}t;UDLupm~j*fw1eH%
z4mP{fjki0Q@w!^CTQc``l~%W8zUwOL417!=8$d2^w&(mQk-VAnJ7cjx7sJnz$t^7(
z7fn&#Ai@Y{e^@kS!UND458DT&Y03s{j39Q~d!=bSk3cN8_e#?$%Vi$@EEi^H|2nz7
z{hiYEMbl?I-ql-K{<BP&o&DY9wzf}7(@(W*=Dxy^)!FF7@tDzfbJt2nM(=yA#;sY5
z?->M4H@D|9DmN?#jlTU{_?ngbv2f=9$?Y->UUN^)O=kJSwy)>scHwX<2CwO$bxD)U
zsu--puRE}IKNe$u!^-t)`lhLm6Q%zDET7!Y{&LZD=3VRz;U7F2rCT`|8W({@KQ5X+
zC;9E+WCkui5WoH7qUp*T+!<kZJQn!#tFj#AhxU(?+u1*W`~W)P26Q$LNF3yo_79WW
z+uwsq1CZ>ZX#&YT$y1VkmRFWnmQHSGe=p45{!W;c_1&WBO4F65diBmpmPqDEeAcVh
zDg5snW21kkbFUZYiiPLcTlkoq=4DM!?)%H!%0IcRj$w1#GNyggHuGI~FlN5X5ME%+
zQ9PlIVRD!qLvm9Y)8p@#|2&=%_Lsc}qVMsvzki{APLR55xShR&kI8jEdjlU+?sia|
zwtrNbE|3gzmoPi~%gOESFF@{Pwqj=hon;eV;MNEV0rsE9oL?B4O*wxvZ{-w@YJ2~|
zz7MSXld{FiUz=H<F!;5;e=vV}XOh^&Zv|l`+e*YLzh#DHZOanN{!|@Qv#Ca?_EWB8
zVpD@U4<A$LZgmbmrrOQwEPPC<o5KrCIf?@s7&_C0*;#&y_Nz0nGrimcu@zKvb-Met
zD(_%rP~OAJpuB;VNqNgt#yJm_H$45VyyxqW_YdqBWNtU-;A1dn=VK7&i1;APUjD&|
z!-!p&;|II>zWTqZa-gzxJ4eG`;|hL8P`O$(<Ee!Cy86GnW~9n(W;xCXD)m4$iFw_J
zdQhDNs<*atG|UB++)pJw%>b1%=HVaeH$P!v1eqngLxN%Zj{3PEvz|)0O*hV%!2l^~
z*cl~H8?%)%x4O1^dvzFxr7`^6wXXB#PV?pUb3ygSV<x_TppxI*161<Mau~52aez$(
zyY>I??JFQ9Kggx2a!)0!<{bjpjKX$u490nKpxW{_qBcCiXuj|N?o>Iec}ViJQRMwN
z7)1Gu_+<Hv`HnlnRe506mM0j^{dmySZqATnH233!iLxJu)|TRo=Ij3N-hSi%-c-3Z
z4ySofB|s)0nqi#xjzM@ksJ1)~sV(P%>Hw=5$?_Zwtsd4helQA`doeh5wz^6_-aWN~
z!MKB)xps$exICk9c{{(~bY=^7hT09Dg>By!eOmVJ)T?vPE<FnS7xgRdThgbrcUiCU
zo;65eY1wqWXK<)r)%IDH;ZU)rz@cJ2g+s-v4Gh9JjxkIww_uoDT*)9DZ^<xkx^TTc
z!{+wqj;$V(>n#{2UpmGpefb)r@OO8H%~O6bZvG_1=r(y(ALH}6-J56pVA%egm%;oQ
zC&T3S@DIXlWgj-N8?k|U8^Ubg*mKKYR(|alW}p7Iv~P0f%)fTiH_e>9QxcjA%o(@u
z{J$S0z7H(A`Q=Lnb9P9*B+OpUWZeE7S~Hn5Zs+7-n98|{b8=@T)8=+_$I08p8E*D>
zzTSTQ|Nb`i$?ens+D%IqW%DzZ|IFB#p8V{%WAYRx2T<N)|0rD1!M~lEfobyfG6tpT
zVKX*=E@O~++-%LkF!`n%V{$9A4LGg2fzukB5xWr^IIXdLW8c30|L^UK{{JrRFYN=_
zF}Z2dU-KRRZwvpbWY{%*(<EVz8GpC${J$II8mk$gx)tP`&5u4Y?3xM6DaIKQ3?Tn*
zcj92!{F0M#DwFw+|FbtSf%I9;nA}vvw3#W~0ix1^5u|^+Cl|x!M@)=UIn6zI7&dW=
za)5kn#Ic#v+)<dLf(g``1DUw_WhAt1Xu-JMlMfy?#_Z<M)W^=aedYh%<~RQD-OPT9
z8RRZD4)a_8=Wdz_vYm~~Xa>j}VXj$!LE#=W4bpxyXB0LQV+iaA)k19_m8MBN624x>
z2&xO)-h*rSN)Vgv)8x+150&MtZi}WZnhC1kl{egE*v$Ea!CL$qxGn?LYZ8w(Gp%Q;
zEc;m|%*F;P<KHPw1J&ALjLHUTjO)6L+m|rin-tf&t2?=$SppPSpi)*MIhmi`0Ax$s
z2XI|H{U4*<bmKN?jSLo3-og0;tyX>ys^g)xvI@9XRsz?`O6m-3OwD^af3BJfvVr|8
zsQm$EeFW)<YGd@BT=t!j)2r7<aYZseyNEgq2a_<nEW@#BYSWS#9<x~W3V$zSFlIl_
z95>yV<C(+e)+Y?%A56jR0paUr49QIH!jDT{{dp`l{jWL?Lhoad$A5|^^f7=!lI<O+
zmM;Ud+unlM&`<)iuYp6X?F~r$8JNumW~V{azXpkmF;<pUmJ747y%uI~|D-gH<B>7f
z69$M_+bdyqP@4m!uAEWk5vXnzW^aE9s<%P4lwXgsK{!LBcV4IRhU1Klo|}0r85?~!
zv+rhXKFZDz)Mnhehw(kb1Jh>no}X(UxAH!oyygG0nQF6>nQ8@Fxlir~ht|){Y)=@3
zuiG)0fm;j0-|85w!;gbn3nJ`KTKSgE{x#|G!#GH5;r*iNpp_osAG8{!Te%o!E>P#-
zU@G0J&cMMGyA@nxK~;d*?e7*%zt-9eZe6H0Hk<PNX5PvroY(gLL;fsfi#5M4wT896
zf8f6bRA+805G(nX5|+6wQ!MLKRZ#V&YN47>IYGIba!V7N8o~?gz%?Xi`eb&NpELW_
z8`zm-H-hY7{|Tuf!%%9-DNjN5<JDh~`cZ#f<$iS@Hl~Za)j8Oher{H0VPkr@8SM9W
zO4FN-*%=_UfBW0X?d)$r;o5A^&cM8xodFcyptcPA+sW<iuP3*$y#mQDng;6MH1B3(
zXx@QP)Ba|1JNs)ydxzPcouMPSc@rDh^vUh*ptyVqYVEZ0%}HjqV`q5O2@cyYajzfG
zXFfA^@3dak-P_su7$&!uf7rwhDrwEx8~#E{*<I5c&u=gPP!AQI3lr^py_q$SiPd>l
zhg$#Ut6v#^?%D3n&tUG(%P^H)mVFbu5!f71skeRS|KH}z{{Q~kU)m2UGlbcu{oOay
zY8tq#FcV`iPBR0Q+P6V+uu}UZgZZ}qyFn`Lrh!TisG8YmYTP&&MA?kkgxSiNjN6Vo
zz*Ty3!Aq~ro#u`pn>N2Z$zblrgF`){w1d?I7yH3w-L?OFL3XmS?V1U44ag*`X`5gE
zWSDF&#<2OhIb$QJzL*QGFQyB=XLYxhf6h3$+>_x~ORLAs$GauU8I1WKGuQ5#d|iwY
zG|F>rI`e*ZhT2WAv57`^@ix#Ji8NDl4kl1Li(zvcEBN%;&*~fo%^s`_#S_>KK&Q}x
zMj(X0{@_O*+1S(u*KY{X&&IH=V{;n^+yrHYttciS>xSuFrVG)_ifXq7s@-nj@fUP=
zKhxCe0NpCKor4RZdpU;zb0`OcaJeZ%sW|6z=5P%LCw8l;FrUmxGzHCcGKIP)_daJ3
zbx)r5oT1en)Xtpq5adgc8|UN(y3cqx`TO_3yy=hIo`cuCgH(XzKx#HZ)r0sjH-W@K
zyHc1<Su2pm1&@N(mN#!-UWQmR2~rCZRo=C{1f&+kZr<KrGWYb9;@(q`^NP0r6K31`
zFFD~GQ>*(w_Ez@f>aPqiyPBqfOaSQwt%Cub9SWL3QF{YgX9?PaGP&hQ{)`00(<0>?
zkBJm-JOnv23Tk5ZGbUE|I(Am}<g%wsUZ54Zf3!NArX|NMU;wYk{p$r@dknjI6to)C
zDYG*4?Ec!&zu=u*$o9Bo&PdQbEmFPrm`L$nRC{usu|Vx9f64+{5dvD@(=;tPU;ztg
z^+%w4VQ6yBcLsBH83tkY?*}1wg@I1+6g&=^S%IwcnUP@EDpTDw9U)Q~dUktl=uh|#
zTJbW_3ZY{*qUS)NIJtd!BBML_mRPpqOjDdEg3ooC9S*vgZ2B_L8lYuy+onU#-7^k-
z%D~zQ3Pn(8LiQrSLKq~%nhKIb76HevDr+!E9AsPb@#9r9A2YflRsp|1Z~=S|C&V<y
zr=Wc!O$|t~(*j!UmU89&f(M17N8c}Ks9M$D_+G7b`c%*<JE<!`t61MNEYt^u5X8@r
zonW97H$I51YQMN&5`0bv<Qx<R0r6JQYW~#opgU6EGccAio3{LW&k&dhrY{8eg4WzY
zPAP%;Lzu0V0iuib3}_E<qw4zy0v;g$f_w#8nFl%{WqJ$9rAJPJRy%A+O7>x8m_8LW
z>#n*Uv>w60H8}!wn;*!0$eQF;t>V)dLHD|^Rcn2Jph4iV6YIZKt&MJKP;s@j?>Br<
zsJ#0A!2I8gt`Fg3tq`}k9)5q}LpkHg$?Q+<Q1b~SBw?<Hs7^ibe!+rLn41rl{}q4P
zza4aE&6Mj5daX?j2w$vfd4J(U%Bohzr<13$Ff~quxK|H+Ml)zU`qT%|c(h)pUMs|R
zu1l0{Sbn_UU|^o?#;UgL%c|B@Eua)8%%-Lany(P3Ue-F9?Z^)=sIQJKe7_;UT=3+o
zR$;ae%;Ke>U1_cS?+?gthMKp)tM&bc0Hb6-Rt3<$>~nA8{#<*K^yB@81LCV%8oe7m
zlU-QZz^Cf0VP+8KIb*u4RhX^ihga+S2OqdrwJ&S+YHfX={K$&+{eufklc#YqX|;py
za(px$G&T;B<vh=<-twbWbH?HK4<?8TJ_U`GCx8CUu&)~=`+kFh$f}mdVXVKP?wRb>
zI=!5kL3yn?=lcy8G?IN-nP4%;HVNd`4<*S?AhF48E<YhL+BO9&uF<US@-sQ)14FVX
ztAusCCG*1cO`N+se=^J#S7+EcfA(~9hTZMvjI-On+fV+^e!#0$9AuB~cc%9b1PWKR
zL+$VOY87A3%%IHq-3=^nTh0v1Ny<CfRbce{4FU4W{;Yg3ceQnZ>@Ubpb_Iz|W@CZ6
zi>(JNE}wa_S)JwQ$K##tmtH7qeEG4elhG?V{)525tXmJ#zD(}o`e4repMllKasfyk
ztJXx$<d|Q4&C5aOCeFUr&NzE&JEQdUc806H#^vdZv#+-^-0a=_J)H4w@B0k__N#i5
z-B{T`@$2#v6e|sdt6DVQJ_GHsf3P4k_UiO9(7ndTzFfV;tmg6)<cG=a>5__|bB{W&
z`~aQM^H}=$Kk4f!4%3%{^7v9QK6bt7JjuqQa~Mwc@;rXHe_07=KNJW*-S3vgmc6Lv
zZ#X!N?7s`aXwZDdvXW<+%d$Xs@_DtgRf6U=BpkQ1{%1ItHe0-%Q987pQCh5>;bgyb
zcsoOG-{dy74;TAO`)~HcVr1`Di0PsG-LhQa<tJ!wVx#)p)6&=78Md<tfbLcQAT8d`
zV7^R1th8U6jg6_*ZEv^X{N2;PF~}U|XZXO6*kxCVbay7`T$RaX-x<u=1jMF3GG`TF
z5N2ilFj?H4VY{k;*vtOOt*!ia)7DLIb?tc!GG#kEgTY_%;t9{K|AzNA7f<+Zz5V+~
z#!2GE6V$C*-JgNzy5ax^tKtBLI*|Iw;_S>9Cog@z@ZI0?+3oCt!t87YGKX8!h1uE+
zX19NjmpRl6y0Ms}ctd&Zc6J7)$?fb4#S6-7C$oRxFP^ZymNi|N-MwL=d+~zy+Tw&M
zwIDP31sE76x3dd8p7#7-aYAw}s6>I3H&<_=@?qr<NCjjC@iXJ;Yz(0D&Ge!B3f@l#
z-=6%OX?iI$gYw>^*FfclvhB5NpcJCK@!2&<djEb8VuN&;DuXl|Tb;D1DMRHf;nG%S
zVfGLFv)S32Y(0#{mop^i|4;+%85Lg!DplR&y4W{OpX~Pi{|slN=}hgP)gROePiJNN
z+Mn#kuA=A;(s8rDc*66#riRbzA7FCM>`Dl^?_fCwn4AN<0z!@*EGGby^JSMo$ccmH
z6ku{*>{19hb+DWPOwOHM0wHG(mUDo~xv+~N<lMn>0Wdj7b`gYJI9M(LCg;a4fRIZE
z%N4-nyxI8>a^+yT2AG@&I}bvx9V|BiCg;k|g^-&LmRkUmb7JREgoo#Hu-pcioIg7Y
zLT)=)?f^{Ahn)!_cN{Et0Ve0k&VZ1+Uf0yX3AN$uei-ZHb{H!b&T@paR>IYZ!daGZ
z*{54!dQZYxg?nLQbK$H;I7=6<P7u!exf`Y<bvG=%GpbEr3aa&8e~Gt(R^}ZweQ%(^
z4ys>4ZG=_rj4$n4-+y@j4OFj!c10<hEcpki1()u6-|)Zzbcz{B#rZEV6(GH^{Z8*c
z@V^s$IPnQc4$_Kfb^FKWnAXd-snwiSK<vH41IE&iAhBLH$F%LNObq6%B4Y0y8o+k|
zKy)NCvkHJ#1ABb{ow(G%ARXn(u$^6iL0Ym4l(#<!mw#n2uKda1`F^{)fY|KzcK)y@
zYG3@`tm@j${*z$_xJ29DE+A&j`IDhDeR6v{)2ZpLZk*{;z%movHnYEEfUqaCw=>wy
z1fAaqDm!LhH)q`2J=b$GivwHo6mv$|1xpXW_PA=gzCW<Pk6E3Q0i;qo+?>(2`>)Ak
z0dw%~RM45wi?Tqch(mUJZeJ!KHoL8jsny+@^CrXY>CYLI6@G$sf>yjD)Cr4uG0(or
z#TYngZ)c+$BtBf_-YZN<%-s$;w+$9&h%zdT1yV*m(}R>z%grEV6uTt2jM{&+2V6$k
zU+V*xQJbGl0GCnr-zP!JC{SD>$8-J-P)s4mGqdSZb@4V(38f|tsozvjz5j3^1r+a<
zUm+=>b>aI42L+G_C?)7$ftdliJAzT|v%12^$=|>8gX*8jV(JWL)Ax2ui;FYtoIh85
z;$u<x4b!czpw_oAtLhQZZ4K`mHUu!6wftiQ-#b$o3UU)D3>u-Tjvjp9aKRg-Vl7l;
z>4EnR7eYZI(@X#VpWLdt8fxDD_YDH!oKN2;#4iEW!S4$SI6(e}-PN?J<^6*Hx3xOo
z7s&T09>nk3)&pv73t{%{eBW@v59C+S?iENI9CR+v|Hm*fkefj^fkL>~U9UZv^(#yA
zk>yOS?#WzVSvuX5CB8C&{VL#C2XZ&ZGe%dCUXZ?t?#Ys08CGPz7bp~iiGgTHNH8B`
zWz)!Bllxvku?8dx((zfH;m_pn>@ux~KdUSJ5uW~?DLI^-;j{XJn#teU1sdNsy30Ic
zbambSSzQ3E?&beR_rKePSp!(XZeVy|0&+v<U6Ag*lUutd9~WnkdG-_Dj&FtDnEky5
zl>R_{30Qh;br&vYW!gM-I|JkS;svI)!lkS%jAx4%sDkTTkjml>5Yf`F#TyW!F#Uhs
zliz~wv~)0ObvK^6oME!~b*AJS><q;UU*UEY8@SdUg`V~S>IJ|5pucfdJ80ju<kMnx
zg+JgkoldYp&mxEPsX%>FVO9gy_Y4Z^p#E0r#a>sn*7pGqm{{K~1hX8NWS^?FvbrsG
zeeZCghSi-(yi~kcK)lwRorR%TAiNf&3%Qr}HQW^*9!nv+I2{D)B%i+j;J*<TD&nc2
zK7wn>`w9Mg-hVj19wrX+Er<`vt<PB@x%D~Y^fb^u>}NsZ>C6nu7T-f4xf9W=T-Eaa
zgZ?7Pw;&(AXHZPu{v6aRZ23F6z1?1zoq^@fg&9{M?gaJbLHa;pw5nb4tlFD{Y36DS
zOw&t1y}c)|Kqj=R39}u$09rq9kt}j(I~yb0M79}VnsM?%wi$;YK2R-xU+^JGt#x`T
zs8#D)^!|eaXl41|M=6X?LHT_BRFI7z`(QrX&d$zomc4j_dJU+R+`OH=vv>kKlzqIt
zc!D^T-QHF_A-rZgJ0lzDel|w;8HcxvGq6u?Kh8Ac@cRP_;PV(jsU|s^l?#-AAhpT+
z4F&}VQ?|1+vbU;CZa*&70@uarKI8EF4FNgZ)j_So;}=>E^Hff4oO;wE(VUf$t&3Hd
z)s<;i`>v^yy;q!>ud6c{vwdZlJ&lbqv|r-TME1wizW#%`1!U4^b%q-8>EL*%`K&Gg
zVcUJLDpn7unar-hG<_N~gYu?lRUm&B2ME-F$`nu@T$BPS13;xzvATc(?|EsqufHdk
zf8&4Zmi*xxlQiqspTcEd`5WDnpC4mrb>BUGIm6HXMs?6Gc@Xb7oCjJJyCc2Pz4o$2
zu|#$1Wmxz^_Sb_#=Cith!Nl{Ql>`ig7c()iF}E>IUc|&;+?vE7dyr8T)Iwx1*^}OR
zeoyh7dThI*K_g1Ch11(Xr;RQ@y66SyhIr6C_muP**&xy8<HwIGTd@2E?LSgBc=At~
z<;%adXD7NR|3A()nLUABm|cN=al=;z<%XvWo$kr(Uj=&Ili9xVwYn!ue-#jBH(;L3
zuE4C^_>^IB<5z}>ZW|X^PyNSWTq?@QsLFV9@^m()#>wlZx2h>Ouruyvf5$La9CQ+h
z@z!GuFZ)^9d!HwNKgIw$!)Du5<px#;&`LVh#HNNux5vMa{S#(q`P=Ge-S^HR)tT9Y
zo#C^FfI)H#2h(i!AHRjae&>H&z4(VT>yMw4%fIqJPWt@Idg?l;&5_$dA-gC2=Jh?r
zbE*$scWPBOIPwd$E>GFw$ZybDNXiCRKsSH=ZJN$(#`3G#wB;AG9m{WK^A^Y+REw5B
zt$wM_w)-cu2`~$@D=<%HZ(vq#yvne+@hO9H(^rP6Zaeo2vnMc5W_LjH{m$)LZID)0
z>U~J9{&e+wg#!hX*+1ANpIFW`nf-%d^7Z8`v)NhC3A2CTNlyIE0^dP59kicfdE&0=
zbHF=Tz<r~DmGf)elk>haz*T`)jJr>Use+{#n7vQ0LG7LXUcn)=Se0QzQ$w+;0+=)a
zlMY}q08A!;$pSFh0467Z$pv6?1DHGjCNF@=2Vn98m}J-pGFbpjDu77?FzEm$1Hfbg
zm@EL34PbHtm|OrRH-O0lVDbW(d;lgtfXN0skog5*G675mfJp~1X#ge_z@z|}JOCy)
zfXM}5asrrq046Vh$q!(X!3bnBgB6JUU<@K3fXNGB@&K6J045iJ$q8Vx0ZbNv$pkPN
z045#4qyd;z0Fwe>k^xM90NeEdOkMz!2f*Y8Fu4FsP5_e)V6p&ACV<HRFzEm$4Zx%V
zm=pk$3}C-}um!sxOkMz!2f*Y8Fu4FsP5_e)V6p&ACV<HRFzEm$4Zx%Vm=pk$3}Etu
z4cL4zc>zow0FxWQ<N`1`0ZcZ4$pSE$044*#qyv~V0Fw$}QUFXcfXNTmVDrJ`1u%I4
zOl|;^3&7+AFxdbm3&3Oom<#}u4q(y%Oe%m$0Wiq`CO?2<`2m=`045KB$qis~0hpWs
zCL6$H0hmkxlL27T0ZbZzNd+(|VAa$>e2#8UfaO(uIa+-ZOci>LJ~~6Z6x?5ndat0M
zQ#^qcl=~*Af=N>_=?W%8!DK3!ECrLTU~(#$TnZ+)g2|&`@+z2o3MRjTNmfw4n;;4%
zRl%ewm~;h`p<pr<OqPPlRxmjgOfChJTfyW}FnJYBJ_VCs!DK5a#ZD*%lc``b6im8;
zNmDSX3MNIt<WVrW6-+J#lT*RuQ!sfIOnwEEte_k*ffW=x6TX7--GrxL@+z1-3MRLL
z$)#X&Dwu2qlciuX6-<VLNmnpw3MN&-q$rqV1(RRFc0C1?SHa{_Fu4^>E(McQ!DK6#
zECrLPU@{a;x`IhlFsTYAMZqL1*e_o}`EJ5fFnJYB9tD$I!Q@gfITcK{g2_@anF=OD
z!K5pgGzF8YU{VxJvVzI4pnNysDVV$pCXa&2tzdE~n4AhGTft;0m`nwep<vP#Oqzm8
zRWK<ECRxGcSL>#R;t5Z|<W(?v6ijXflS{$mR4~~JCQHF&DwqrfldfRW6iljuNl`G#
z3MRjTWBDnVyb30dg2}C5aw(Xc3MN~@WGR?T1(Ts*(iKdaf=N{{DGJHa%%B^p83nx_
zNJpwNNON*p30J=S4?CrPRf{w$C&T*>_06kVrKg&J*2y!2MkF^+U(PW3`1k)H*}uK-
zKg{0;X(KXaLRyKSdA-T)&;C!|{+;>ZdGHS8m&<u#3)TM24pC)T^Z;@LP1u{ZCk-64
zTUe~5B~2NA&JeEbWS-3VfxpvzQ&*#kG#9J&=9!v|$sOO=Ag7Rmc2&Oru>Ke5^ij}G
z%E{~uER&zMGH#x#%DA$3^H)<w<C9An{)Q&^ePj4(*6O->>Qx3~_6-h`uWK><75&-Y
z+IY7&2y}|*X0_H+t?xhBZ-(uCT~x_b^(c$c6|@I-?o72-&^bTvKk$D6o$xdHDJz-{
zldozqq=L_01^evTa-N4rD-V4<1RBQy?b?Q%_Z9U3bjri3cI6Fh4AP;h46|pMGl0$y
zkY;7In*6JaxpF3G?sqcF2Y%^pc5Ab)O`Uq3o2P^@zW>nw=4H?3D<O=+-&+_Tx<|Dp
zvwvrL|3UvX7i*`RvcXIS(D}2<2DhL$X);wp&I@D8hK$F&|Iq*9Z+J4xS0-Wium2~P
zi!)4p%-SqmCeE<0t(Cp@R&DrZ@$U?^y%X8ESbg_TW@BJsbj{t~>&C?zx*Zg6p#Bwu
z1lt!z)yZrv|Ag6C{y|PSuKy_b5_EbEs9%)W3A*zO)H?$47+pauSQ*Zd$j`8V3)Bw;
zwdG-=JP-L90$9;S*PCx;1Bn^8eg)qk22;J6eS^b#^RH03?GDH$t!mfb$}W~Hx|KnH
z`*Eq#-yr=Ud62t7{X)>02cVuU=qAi&bC!SW&A;-2&OidqDS})Jaw{onVQxB@F5Le8
z|9Z8rY{J*r7%TfWe|^S~%(jg|#F3xDfa&ahm^)zV`56S5o5LX|61J)<3!wTCq?*?i
z<ZhUHkO-t_j4T4`tumXsf^T()iG%vnliS$(=OiU}UuT$+pPc%XVMcLs*>Z+C$&Y7V
z|JUdaG7EA_S>(~=unioLo#lRCg24BhgL2)bPQ7luw&_`*y9u+p8eO%z-Y<~<-@Jv3
zA-N%h-RlRVXY=tErsS#S%)42&9VfT3Fp8If$H`_IvuZKE7noo!+{(iEenI^!R!wWp
zl?*Kjk7tDZO=jd|+RU!SxVWGFpHn3ycR})&6Zme#rUs|VsJ5Wi>7}4i*{4(9FQ|X>
z5<Zt>cu=5_CpS5N8<S09>v@PTmo*@K`3&UCg6&KYU(QGqdD!SK@s#6n$1{X~K`hYu
zt)P$v<wsB+6b}R6=T#$<q-?+fI%WAEvqdXMMB=Ir(CsNx@{?0<Fia^<{>sJ-GWqzw
z=ItB;mEp=eUa(ALSKjbLpwV4<&kq*RXeK0w?MeQ5e=-}(Kex7Btxm1VCL({8EuQ>Q
zwqg0(G`-oK<=@ZWC&QURH{+VK{B5>q`I8*-l|`%VP#a_pk(Ce9wqd=eY$5U&r0cyv
zfMBx)_|DV6wV@!}m3ORQQFMpc{<wtwCusC>>;B2?FaE#1{MdWJuaEnuhl5VMb1zs3
zKIaQEhA=$@bb?t+zU6|Z=?hsHUp8-V`9JaWoa(o~g;^U8LP}`RSQ>-{DXBrT|DA7P
zDN7^k{RaNSpfH4_L{M)ZCMO;W8u?jT`2K@Ecux^1gi+;EOWuE|ho1}v+7$=tc?-8+
z{om^j+Ap8{;W^Vxcj;C(hU7QfnZ&_;zx01yth=Vpaojb%sU5U)SJ~vqFVKn8;IjU~
z{GXt59#q~lo3;EZ{8$+}cg1IQh74v4Ha49ylPclq=?s&@)tN=z!KW(8egXGyK`S+s
zWv={D)_d~j{RH`*$?PB4;W2O4@;mwPa;DkgUma&(U(UF4{_N}N4#Mm#|N21p;3l`a
zZJxG_A+&$SW1T#WEMc~mKkql}p9kxsgY4ERGAV=ED~YgIh6S`Q?2j_&9$vjCe-gKY
zU4(Sc_T2p@Wi~~uU>%c1*}<m{fXXV6j`tJxH=?`p@qy((P+bX1bA9aFrcX&`h0MS7
zO?kX>zfPG+kwsM}*j!~<(7oPU{(#Rsk$Lh*S?|lAzk4AndLb%6?gZaPd*zR^EJVe}
zy{zsaw}D(dSyY{A?si0q0ENQ)g!A7)X#y1Em?@$)^8E+-BQW`y?#WNLb5#~XV%PoA
z<msvmN*_SwGOVo+8iQtZo%0M<7JpVZ_z2=3-M^ikfqBj|M%TOBK_fHoKkQ!*Ivb|r
z8KdjP{Rh+MvV-JaZnw!&1D&t%$F6l>%li-i*MZcC9+jz`d0wq`a%&p{@@kvU>H=W1
z1NXPO&w2JJh0!&0yYdz`1`x{;W!3?bx?Ka`e~8}>^9!i_Py^qBy{ThcOR+M8NwGSE
zL8p6i(^nSVX5k8RhU5p^nHHXuYHf9WpRmCv*@cy%;|c7ZKG3<Hz3!Evk7s`UXHnF=
zl!MhE?@*gm>-&TWNjLX1t1`1IgH8()*q{WuMH?jlK0%?b6e44C1av?9UuBz=Kko%5
zD1b_lRjtgR@?<*)Tl2OKR_0|Ktf1QXeS&~~B7D>q;)_(z_aFYRg82e6#t1pBs?mkl
z6MX9Cg8%zkRXATho~801QW`L2f=UL6{-+@Q%aFxq9t6d^Mi%In#N?{4Oq0z`8Fcb`
zk5AsN$}knF1Zq@eRNd6_eu4Z>PVmgeq7=x8KB!%>#%G1c`vvv;rapzZi0#d$b_M~1
zqBZ#|ytlQyUr>J<9)1Z<DUjJQkgc#XhSBx?g8E~t+8JGE9*4Tq`Td9bIWT`NbWeV~
zov*UctfPx{`ZUnFb!vMcDR0}<8IGIUL1)*Ql&#4(C|Z&IzTp3ESo#B(zy<cJ8C4&<
zv;G5>+sY;@7#Lk)@)}-~Svwfs7yMrZ6M>ncY;xt_`-J)rFmbS7vfmf<PlSnp^tSv1
z+mNt-Bd8RInEwMjk`HQ$D4TFFFuDfrx2S@fYQyqZ+2qN;_XYWzAN#R>f#?9aXz%vQ
z(3MzH?NjsjAO3g4!U5E_ft?w?sl}}Gvl@c|t9x?cb|y~u%FyKLPZ^k9*;wBT9FT+f
z5p-TR$R!p<imySV<{HtU+y^Q{-wQmb0OhU?8EbOZHuZM#y1y4NaFRW`CSyg;djkjS
zW^<OmD{|Ikbe?`M@IYSKWF^CU0|zfqYx2Fo1F56?YeQYPmxdO?>-YBp43;SIXYl?*
zeFMzho$kr)Us*t|2bC7dkGC`JJgAWcI&&T5p7$5tgHCJu2XYUh>;UJlSzrHwN-1TN
zE&twMkZ*#8Jt&`pYB!B6i2n0mAG@-GPGI@l0WNz`TdnUe^uI@T+fwcKAJ%_^xeb;E
zA?Yqv@BN4OU(n??wNE_D3JqZmFHlMJUSUE7Ocgk7c)wRLD1wQgnz>Z>{fG7MVRE3g
zU2T6D7?qLg4_FPh&>gf^CHe7kHE9lZhRNcp43M(6y&qP>+GHhnuq%O1?*`o&bL5Az
z1<Oy+{(ohID?i>};J*SYO`1(xellCI{A4z3`O$2~@?%wd@?;J<W@9!sojj8=PIsqP
zWs5IAlx;+QDr-IYr7X$vOW7plm$Jc@U&<0!e!ZWtej4bcIAt4_U&;n7f0`{?em0x4
z{7iOU&LkcF)loWpIiu!$>F{)i$!smZ`Pj{-izKtU8H+7rxY#H1SeT9F*RfW+*7qCu
zSAtdsfz|?PWW8Tdznjq&#s{ZSh6yEqx4&ojPzV!!pTIxy<9>~-WIk3AkpIBGvN-ZX
z*#zXX{9~YVcECO}V*#}sek9Li7ueVOKH+?K>UNu~<VJST*%g26THzsLa^wdjRMsED
z5h^n{ctBwx@>AL7%MZ|b6UrtmzmzRle!ZWN--Z$f<}E*)Em(d&c3l4H>t36zqo+YG
z#1;eZcjK^Y5(k?_o=#D#oA5L?CXlVr7%+J9OW6W4mjAv%{y&PX(2#%Zw)_=p$P0r*
z-e|f2tWDD=@Hld-QLD1el^^dn@b3Vf0MY8M-0+PdbL-y-$*q4Q0=NH-5ZwPa{O8t2
zS5RrY{&8h!>t4vLLM!NGk?c<RX~=r5n_A7<5GT=sN@`GT3o1b@(ivTOPg@j6WQ!hm
z6kH?@IYrx?oq==V<XzJtc}SI6=B>=f_aE}%r}KiwL>UZZ-IG(c^Dqh;wRf>XX6D^e
zlwRmIf@YaFO$D7M(BWt_m8n%HUnBc{!})ojS_)KiLHO^t!}uE6;2c;G{}3kfS&hMD
zMHG0x$K=bu_W}yq%;qfrnoV2&ndBRQYJ>|gl?M4b*><h(3*?`}M0B!++u9gFV)s8H
z#Ozw%H}o%r^C2$kfbl^g0?Xs?3+5k}JPPqS>yP&z_~G-ZOF``=4o5-pcF;^ndw3Ts
zB(y+nVxv}2tN8td_)b{4@P2}P>s4@Fq2p^1q~ZB~!u<tTw}a{q7=Qoji~DtQ4T?Z=
z^G`h7uHp55g8h|)VA}s~>V6Qv|BLJXZLRMo<R47ku9K(XW!Cn7LVa7|eq<Lz+<Nrm
z`w#x`z5R3DlizOVViep2j~h0B$bE#Hrp|B#t?SxQ+<dg1b%l4M+xrIjO|Xzy;SG+9
zhI;T_*Pz$}*PIRgmzvF5{&hS9se|-JHWaVPUy=R3A^#Fc45V^}_xpzR@HpHMyv83a
z@);%%6R~fDi$LA5knMfL{gp6LWWT*{=--T7)<1pz{=<9l>E56gE-cQHgD)`6Zu`bO
z`&ya<qx+mhW(zh3R`rFfo4>O&$~;tLQ)GSYb{)L7o+w?<@#zv~|G>PeJ-K{4$K*EF
zKa;<){b6*~T#(Frl?8Mr#*E~J?4`FSi?K5`PHJ>-e8xB#bb>EvO~AoPGansPcWj<q
z_MLy`qlM~<AQr>SM-$Zrn?X0Q&3x3U&e_b`EqL5+Dl84Ps$bm?GPSe!@6{>EpfR-G
z`L*Go_3Nemf&W3O^rnJ*#OQhy-mXk8+Qv0GJdL3bd~<?uDcc|6vTw|ty{gY9vwdJr
ze!h*NZ~@57<j>nUWRfShvi?zIe|mfJG?0rK-5Z}ZP8J5OX`IH+405rf`oZSO-#{)_
zR9^^UG0c1<s6Me7bkEq#N1W=N&8^)NAG4}k!QBknW%)OJ^Yr5kAp1Zuko;jA)6vh0
z>>#^9HZKK_zd+8lczIPO88oidI}hZq>kL2p_x{$K8oD1c3IZB?1dV`9?*yIjy>cz+
zv~JLiPfHKaDCa!QG#xT(;Z(V(GBL5KVNP-D`K>2G<0hJ3o4K|!C@ui0pHs|yl!YN#
z(v{KFwP`v?1jL_H47wBb@q}6bK%<FXt*9mieK6+Q$}sh4^KljiR=3HlUw%XKSnH8i
zmc{&Ee!W*%Ap3Zd%YUXSuhyH}8C{p|XR2a!?cG23=nThJ_vFvdnPd_tHnnyMw~I4K
zJXCHt&LESh+`!H-$MLWEoP#qD{S|LK-_#(Jh%Vm*UB3^yC5}Ntt8-loXr<<6*6$AD
z?VxjJ+k1^!zcYYW?thSf2O2pOW`DrHYWm~a?|&dF(z}%nUNTH(XAqck0MxpAlmfY1
z4%A9n_T|)vb8jxaxc21MgSbDSHp{9Oqt<QRyTId_?<drs*xkL_LHL&xLtJ;VC>LLH
zK!NDw>rxD@-NM`qOfwG)b2Bi<bzN(VYCF}c)>>=z{)7F;$C6zCnvZib#C0)x-#nl6
zL->vtgK)VFgR;q!AAUWp-pTx&OwDSX49Q<_GfhblZWCje@Bmbg%}D@-2WW-cUvtnJ
zw7=qw&zsF#e%yTC>@LI5dYF~xu_)&sEIQm}7`}eq&1vP>s%hQT$>>y*9Fo9%t6i9l
zfhk#*lVe80U-QXq;tW$BC^H;qn315&z|QdXyERu9BdA>hI(-GSvY9RWQFTzOTNbD_
z19Cm1*V+4+ZlAb4?Mv2&yf=)#(`%R+Ciko<oy_}ze{<_vN8{EtjPF1Ezp6ENGW!Gm
z$KRL#SKcs%5fthmzbvX@s(qBJx*ufn<LT`0BDW{~fS5G-rWXUq&%)m&!69_3x7BM?
zw|EVBJ$}A0?+5<LJP-Jj|NLT_lK@H^Gae{6lr!QAtJcSVZIe5B!6rU_@$1iD+sBi6
z|2Wk^>^I!r=((BI*3p>NhVlIe`_rptKK^O*UwK0d+?@yan-(g)WP7XjltECsnf>=<
zjs~V}O-3Eb4>P1Dvk3^adNhemZW9yOJR^f)^N$-0$@4kb{<<YgT;^KL&+^Cd+(M7Z
z`~qx^&ce)J{;K-VZp;58xS*(cbGZcbp*~^0&;N}hB$$(n|1)fxKD(Wrc`^Uze~&-P
z{hwT-&T#O}<Z^e0na2;hCpZ2OTj-wL`9rLzEx8Re_V@4qV*a{+)7svD_<!Y9f>(;_
z+*K*OiA@cYzq2z<elN~)&;w+<=Bvr<49v>>U;a!kS7(@bTA1(2-$s|Bwujqc;=*ho
zk<|T@+sc179-G{L{O8N(lf%s!TDxZ+PIfuKlkCOD12QS`)=H>9RQET!B)2fL>}r#1
zQ#J|trfebdUD@WycV&YwKSAkP*<#BNWt$~G-hbGCu-T~PTeAhrcV@em@6GlsKbXy1
zel(l1{A4z5`T5tV)dl3gwYMj?cl^IQd+qmKZNh8}%=pc$-vcu5pgYI}ut^{jK_-K2
zFlzah-1&p0RpqZyQQOt65Enn)3vxe%J(+m})6%`h90web#V#;S-FjDlG5^2+mBOHK
z0mT6*W&-yXH6PtC+*Z%Ht4-M^<QuZ@lnsvjeE(to=4PXo@62W_Kakzisq)ik?p9E$
zx%P!Y5R`Jf9-jMi>Bp@P$~H^BZED}vmCVDcw5~I`g;ivRW3nK-2(vpI1G9C@_heRf
zk!G`&@Auw3dLg_^jN#dnyg#oVNK1J!G`a|L1~57LOz&l6nB2Se*ixVA-HZ&AyS+~(
z3#xN79}{PAJty2N&Jfg|%%jH1?8eJ5o1N_+XdP#A`X7ca_IK0gIKKm(s9G-0F!6Bd
z?Afere<y$c%HQag{OAwU?CEL@%x<y_Tj$T7F3zyK?JEOJo|X6Ur$7Is+1S7<qlDQS
zn1q>S8IqH}v2?NDn?A?+-t?w+;dF5ZR^Gzxpu2imc>}kD?%ZPK-MU{mU7dlIcj|uT
zW9$rey_ed~wMMnR{}8{RRRv@Qv%4(Atai=Mpj$4UWxM4p%VEoXRGZwzE&@u=T$#@*
z-Kv&Vu~n<JLQ;0KJ1+zCGcE>*DgTcx<XSlgWKQaSP{=Wxb2ETSG3Mj!43Fj6Up2bq
z?g#7G#>Mb+JD9bMi{aw-=H*-r!fY%*K&B`&eEG4Mfd!OO7r;zgyPbI(7sEoXWCk`d
zkec@&{?CKh)3~46RhB`RpMgoZuZv+eYwIu2eLTsD`$f#fgcyX`#F|>&jo9p_ZJxfJ
zVKSdA!^i%z=D&|Gx+l;7%Ej!e%P^UJ0vlXc)_w-#ux$*iU7W`z^XW3oW@lvp*$c8!
z+2qJ~Ws57{-+$P@gV~nld$U!`H;4;<ZWU%{5CE?XUhzy0yfT=LT@I9X#H&Cj#&gLj
zo4EX(UI}UiaLNjExBO^yc`V6(3$(wedHHi`P%Zg5>HDk6oD2fHJAXPfNlw1W$;9Xh
z(XA!5xmD8<JQwm|{V%PVk25X*&)o}hHNs^n-;^zme1HEzem%2s%eQ7LmhUU)sP3K2
zdh{nq4agT$&rWVF|2g+0#3xt2L)EWgwuPw&#hKt%@i5Tb%d^-*uni!w%>7cmtjvM?
z!LHrzuGn~fPBpHzaIi6z#r#YDw7Lqje);?UL;m~Po1nTJH1Y$xuZKZmRSRUz^HFZl
z$n^UM`4>QEhl9>v%YOrtW954P;Qd9AUfB7RAoC%u3%$<Pvubbro&-Hu)!FC*38^k|
z(0R&JkI$)YJ>E2ZbNft&WCvCz&{;UGERTg}{(F?ND3d7*WFG7uR<+Kr+asZOg(BS4
z$|UhY=8Lig3$wC~2s6(Uffpig-aqg^Hkqx3L9GqcV+D`%e3-u*=F-&v?;rSscVmKF
z3OaEyvJf&N2r>y`0?a&cFSlHny@dfZ_SV@w@j1vvcC8>?pjD-iaB=<h{(=5}P_KpA
ztmQAr&i5bYZ$Xm(@&186=q8K52;G=IdHNM(Kg?!`JKjH7zZ2aj|JOlmefsJBgY&!I
zJ6zC`g}Pr^Ys(*yts+k(UdX&rHeg{^HW6WFd^)?Gm0{+4kU5iCUH%HQw)_S6v_8bI
z0=WmY%1}HMyspOb{fGVEU_BjBn;&Eov+2=4pq9VnNl2=C{(I(e5KDR2@?T92kai?!
zYz{28VfnAgtWW-myD~Efv${&W7cgLEecJ5)<nLnsFYr{xf3o%_Le*2z_W~Cf3h#p4
z0!nu<`z6m#JUb)vuiL72M%U!0&lvdFcTMle2Du948W0VcjWRt7N@<|f#Rfi|U)&3v
zkA<2|xENM-CO5dSdcByF0lGD|kNq6z)B{GZHqeaZoRW!$o2H*?1^H2!mG#qmhYvn;
zGC*pScd&zIE~mNtb;<;}3X&E<Zfk0oliA0<YWke)z2MtgVI!*RT6%J|Iw2;dzJ2fT
z!9}Z0^X#00iKjvF0ot<&T3y-lcU3#*+Zh>r>{c_CElz?*dqJ&c#LDeWP}iuweD5IO
z0%~<b?03q9sCgL<S~&~avw8mm=*;-q{iX*&^AVuCx!L}JZ|3#{m0X%k&09Dbv^tZg
znJ}`hXh}$JGhqg~;{6BvFS$2CH#~sMnEwVeG6tH#1f4(*y9ENoZ$!DN0W@<8iD$1D
zK@X5aSxX!g%37Vt%`U8dPnyj+8A0uJ&?$?}JJ}ii+LD_&nVQWzLHD>%KL_<&>h1Rq
z0cIezAa&5Np6v2>Q6{rlCquJ2C&Tt_+wIKDSDVW`n(&-ijgzs9jf;JD_&4y(+(z)s
z+~l@rtA*LWzw2WM?fID83OdjKC4;iTO@?*Qd9dRQ!tUSym-f$i3=2V~EKm%BLJJa7
znFnQZ@1AdT2h{<>?Cj?!voSC!E@)Lx?!C^zlDzrK7lzi3w?9CuHoQIvBu{q(@3Vf>
z>bk0P^VF{l9cfMCzI_6Z8z+O#RZ-rul0kXLPX=WJQ$|So>tbcL<YG|XV#b&(?#U>+
zg4vRjA(`Ei`5b7E<%j#XQ^B#|2U>UX>QO<nNy{In63Chj*bUzh9w;_oA|Uo;mVkpW
z{@0MR@V+=`o-p~va;C}RtW3gJuQN_h2i^U)+;r9Sj$}q?&UHUH^SIqqjzm!2LCr&|
z2SIrVl#5rj3$wNgfy#N%N(s=;r}r1?KZ448(4E?#)e@l96O8W3f470l#P=8Ge*)cg
z3JPT_@Xe>v*Haxpd6jv4yP$FSb_Uk&hx-}bty-HJEDu8J6b1=ww#dH*nGCWCWD7|5
zjEBwJ*@fmjeSabT4aj`R*gR-`jPe%HKJBIkP;7!yJ=>pEEqbkx`yW87nYa9T?_gjr
z%)!6{ni&Ay1d*J-f(dlL$>jDg|64uwP2D_w1%omB2Zz-DUDJ~pS(%f+ePKxc@|7X^
z&r=3gR%F@7!mR%p-5Zb1c-HY~!Yfc5KyF}%l~cM$Cx2ICnEXkMVdmk<kCYfDe|KZp
z`M%k_ReVOW;_+U8Vg3)yt$xir*cpwdzGGnZ6TV@=AY4(wkSy|zQTRs%1M}u~hKKCQ
zneQ2d*+2icnrdvil|k4~lp*;^DnqgyAH$5~!q25*!lq*IJpz*-IWf3y?`>-BntkI3
zBcto%DL23)PR2i&7>zk19E43J!0To}_t0Ge-<Yh`#cawdp3KUs1iCM0*`N0h{@-L&
zoy_uqJ^9xXhTa9trd;ChAMAg`sG9tG2@5FgG%tT1D9t9y0J|OMasJmokhJxjak@Du
zZKeNPHGPV+Fxx31=(-J6NG<a8&ifDhTc4GH?sH?SDh&nQ;&$o>vt^ffG9RZ5vpFZj
zsa9c*3(S)_7+7jU6(8Svk@lzAT}$e345RnS=Sb!$K+H>h@czU82GGsUZrP7&a<?Zl
zh_im}?|eTa_aUq3`OV@_8HCxc|DTcyT6y-k=)}J{nFuqM%0SFez487-{vVJTYqvlB
z1k#!K9c1sRc1G_R`48D|^{{HE{s+0@;N@2LWcJ@&_ntg@koDu-m%J~DK8@au?$W%k
z|4X-vGbER!v+rjA>j2utdT;vVx#A4_=1%79`PavLYUbo#Ugk$Fj4P74zq34KN$%gm
z4Dz+wOpu>Jqd|#o=URnXTfRRo`2O#G!~WB!S`*#;THiOwp9bG;{5{d_A<O#)`%{mn
zZu#5FJ-eNoA^GogMvxhaJb~Mp%{v*Iw|6o;F8==O<o0EipgZ%NY8TZqn{`RHx+gz9
z&eUweB{|V8sC5~rhj0y4Z>~HIiUp9rL172E6MIt|G`_e%;RFevrDxuM$bSV>H*+gU
z2BNB!1EPX;@B0t_FHE;CYeUE#WrN5aJ$-UJLNt{XBAUAY{RjQ0AT#goPG(~j0-e--
z?n&Gi&`IK(JC8D~>rVb_DtPKe){DF+%(kuKTAhrp&9=M@$+LMG+%lbV7v+M^uwItA
zs2bGTy7VCIPtu39H_P5c{n*uI)-{>u12e17yY^QtiVNoCJY>0eoOyQ(gR$5j&<#Q_
z{xD2t|NY-?nz30KqhbH%?b(c=^S_KszcUoxyw(=fb`M+%%O9~knb-EJozY`5$M65i
zJ=2+{q$mHp%`_vySo{rx+w|nm&zL5+e*14Me1>7x)a07o49QvB8IoBzSeVT_7?K}6
zV@d9M#xx=SA$#GcWNr?oX6p`y$Iq?5gWL@|d7CZkQI%6QQ_Z6suy3F~VK(PrcwF}E
zk6p*j?ajMc7#_c@`MX)VhVj<y$1klvU);{<+SI`6D!4teu<gsD56j*(NPx~;kNa}!
z#ia*PKh||MtFj8N>YU7WR4A+s64I`_-hb#n*Sw5VqIoH&AWZb>uJ<4G&mxN)-TnRp
z{~6}3oZ_HTU^4dy_V*9!XM*m#N`5+<3lzGbxM1{}Zo|wlxhLm<aCfJWa8IY8@N^cY
z$>Gl#pG{|8%gzwhI^7r4e|~!^nT?BKdMt>oyZ-$J`Tp70Qylu(AA#Cf3{kD`FZ`ci
z966H#bpK3N+q+hXTU)nIcLUABvmH-n<7Ai~24Wvu{r*G$A<$i1Ah*Fvoc9m*gWble
z_4vc=AFxmqcLlXnmu`RmA%B1KmQHa-PhqYP%u^Cry_37y_-3U14Np$H#jsiIHp8yz
z+opqjf33|67EW8=f8gH(b;tJiAN+UE$pGypNp@nF5&kaDkj%j@HJP=638Er(+xrjt
zJLhBwe^+Oi%zA){@ibI?>-!Jux6jF#*bNc|tvUd?sCCQx5B}Sxhk{nHxz2~EJi7V)
z2mY-PcI)Q%AN;p~OlxOImS7hU{?5(_vMX7DT?jPZ1ktHFr}I2W6r#s<J!nn{BEvch
zBG$Sdw7+gj&O;Vf&Brs@J~VIRlmz(_7VE4F-hVj1ws~78N?K4|`2Iuw8f0~?i{5|m
zU){XDQ<Bv^x$C(A_|6l7<mv2uP<vLr|KPu}`8cN(NEalY+$MJ(hp^Np!R%{Y`ToQC
zWzEMWk<=ZV08_WDAEu6V<@*o*OJF$zbf+39Z$R=k!pExf-+y?&5EM%6jDn{@;R|t%
z>b&<K@)yj>0EN`!4)%8-nU8xxF~fQsq<ijG5D8J6I_v$1^>gQBfYg9u^|2)TBh$ST
zyP@IO_PB}t8A$a)Xw0O}dH-SkEXn;4-K?|Te>gu=aXW;!bmsdH?`OQ-3u+yK`m$<o
z7$n3kLHCz;ri1UwZBk+Od$Ouit@T{%`w#L*A*u6d@B0t^Q(F=qPgVK92-<^yjE#fJ
zK+s(Zpj=(7>F_a`omC;Zl~n;;;~r<%NS@Cwckan_OHdm=GZ9p0B)6M0CNq8&o0I%_
zuKEA8H|ttf^}PQuzbRRoRqE0M=IxyfV7<%RRg^c_Fe-0(!=P+1ol$wk9|7ehJVLGN
z%6oVOlsE7QfpWZBtMZnajNtv2I^PxEKUjYgG}<tk^8-7hrf^q}VDhV<Tw#Bre#CuA
z`Y=5kbQA6BiLBn!wLq&uyXwVrKx4-|vd!Cg#HFvNgW7o0rX)@N`ki_6wQUToT^mmc
zPh)3doFpu2#t=7EB+*!6H^bCp%@#Zi$EGDWa4_{Gb)KEv+A6qf>Xbxb=O6z!e@kPS
z@=zqP@z}9x${VIJ22B@9=3)z*w)q(wqsU_kr(`B|)>d_hnGn~%f6#ve<l@Kwe}03c
z9;TW!&`$mJt6CIag40wED22IYs<l2#Nlk2OU|!B6@t9Bjck@ynL0Bn}+6tPpfB&HV
zH|SIu<pnyDnfpPyUWP2oMCe@ACfs%g+Olz-2}upEEuecpn78#XG;iZ!FyFr2ZhQG^
zbCE|}>|N{=o(Z!*Up=|~`#a?gZy1!f{9yo@32_s`RFIip!yq;5)5(z3l3Mxx!TwLn
zG9Tr94e8uoSg7>T>m}P)21#SitqjQ}s)Bw`ul>38<KCA?AD+E=_2S(VwYRH!g?YaH
zH|yTi&FTwDE1D{Qef~ym{@%-&+|DjGc{(ps<K*NS>|&Fz^D<3lVPF!T&d%&OS@Q8g
zm4nT~-@o%qK3=G@5X54Td^}NQVzcmfa|X%BohqH+Ikr}n%_4IdCbPACk7`@in%DaN
z!}^opRCfIN->0vcH+PCBvoiC6*C4C5{z-nnhNsz_nPKViW>c0Q%oZ)*n=M*?2)BRz
zZ!E#fXf;EsU2%a-ej@wA<09#s#s4x0w|)D+Y5L>mSN}c!`t{%A&usr6KV<(ell^$!
zk3Y-iK7ObB`BloQ%x6_@)yt~cYM$k|<u1!zRlrr^mC5Mpo7mLAB+58(vbZRN-Bdo-
zM7PPTE#IZ4zHd0c4eY|@?Vp*qcZ#>FLuMJpL3@mqzI~cJU5sJdbkJH(&~13)rl8S@
zrvmRk@SjsW`87=33^W_COlf*5sPukX4vCki@$Vnl-vrr==^n4l(om3FHnZ$>eEetj
zn|m!M_r7aybV=L`vRxpV^`1z6BKy>H&8F=CXS0hjY@YrLyffl$f9qpri*|<1;%6Dw
zP2b$k?zp-2m;<P7GI^^g!`uFu&lB0r+C-8celz@gbuY6;`+uJ7$KpHwv9c+f9RIhg
zRj)PC?IEkO&6h9A22Z{zn{4^^zCnL^vuVpWW^<Nr&E_p%rzC#-2U;WDyzJQ{fn>YZ
z+3nx{gZRqpzdbPh_E?zpL*ZU<NF7&ynB2}T0x6L|H)=w1e%lvN*#s%$JS9P8+`4Y9
zE>IaUJqlb71c+xdGYE5c-$|aP!k7vgTj)~ZW?sr7@jl`HHL%Ic-TNMwe*O3O@ydVA
z+gZe=!y)~_ImwgDzA|sVex0GU`{i|EF;=F@;nx_iO`nr|^**y1H$&{LP1ENjKb|rD
zmvC!~5NJJ$GH8X1$&z31FZg#do3s34Hf{N}x%~-4^Y(T@Ws@(z-d{N1)oc#AwFF}B
z+S|;_SR|Uau}CJ%lrbw?++u3p-Xf`N^9w{vD4YCZYDsuJOXVx0J1BR8+GyY$TIE!|
zsM-oVs>i&&MY4H&iv;*SYlj6=TJ4f|L1rqOEcrFL?T8R0ji`n|(uk_t`v?EGF`Kvi
za@}7V4(j8AL*RJ&>AjC_Qm3BZQ@kgA?rG4<M$k%?rs-O3tY<-eYKSSWeh^b!UEe>L
zzX@~_0cc%<5%?UhR(EhY&G!8mqnlA{Qv*l_D#r8u2uKXH4x%*d>UPllb=woQKMfoL
znUJ2@@xOB(&v~BA%ceA${o8-z@^1{u;_OOZKO_>hI)C;j&t+FqboKiZ_GWq}sGfPb
ze_hx6g#RZ%`$v*_S>@he2oPA+B6ya0D<{MIg!-$XIqyeVpjm6RR>&>YlUW-KLAhU;
zb?LsK5AO{G#I(ASnOVgSx<W)<_k!G^yvhCZdxHRxWHweYaHuRlzEj+snL*iT`G;mx
zPDW76t5uzGGB|ZE__kxRm^j0(Y05TBeleSJGW4-snkMS@{sVs#L@)a`W^+!)X46gv
zVQ?)2QZrdhjA7HXKDL>?R#RKmFHPfh1BaQ`_f78~%>M_`*S_g*XsZi~U8}xrfY{Z?
zCd}5rd}$h^E7-mL(_g%QApaX=26H<5`sty}49!bh6PYbqeuHiY*)_e7{Sx>#O|a_a
z;ZH#$TVNlVeg}<xF@xF0Aa*B&ZTS7k)Ps%g!mJ<IAvLDcbmM7X7?M-JGKeID*1WZ<
zKc2Gv-=S7WiFEY1vJK1c_aDyxUDaaw78K&3um`OgfQ39H-5k{v2e*QcYQ29T-#?kf
z;o$oV4dqN#JGVmR)sf_TLGqVcAu+Rb@q2@Yx|91sJD4CMt&83pB-9?=4zlS{7D%n+
zUWh5F$`Dgh<=#Ko-|;o%?{0|rQ$>jQQ~CD~?AyPFI8|QV%xvB&(CRihd^<yLck;~Z
zOt7($$ztt{$tT&sYoz>-!N#2?v$hJpZ-|HA90FPg4AXJf^*w_@1SfniL8B|H>-z$K
z_)2o4c4M|{aPxT{DvLj5P!_w&psd2mpsc~lpx4^y`o7@)Wtd%#M{gbk<q)+$pcNjV
z6&s*c9;;duSwTCi-XGY1xcNE@W1|<V*Tm<&3z)C7Fecx8#l(DFg|YeC69%tVYxZ!)
zWasM)qVt=tA7SW8Xw}-?{+tQa``<UUY38c-$LXv72)DL?R!aPOf8hQ>&@DHhm;>FN
z2-)Le*9uxO(&-Kwxdo|wf1rMUr~AkK$(*bL$?dRnei|4+_y1~jDzYk@Z27aP^Zfz&
zUCrT~jLl&$89?J!$&;?LC3kZ2Fo$b0{xv@&&Z>TJvXi*uWMzq;49SJpIg}+|GBB#|
zoS*#oI>XfY%wZ=PCc1(0h%`GJLo(|%j^wA$m|ESEIj*yHx+TkAX93MoGGAw90Qtmj
zs<OaS2E!E~vupP+1j#djPQIIw2$7X|2y%%qYbQgiI>^5F2jVwF*0Y1gC_yXQl_fbD
z7~MU$?`Ho74ja(j&HMMh+|GO)ZUe(phTQ$Lr>ir}aD<wAFn2r1OwjG{!mI%YUBP?j
z3J<;nk41v!i@@WNEsCt`I^Q3#UkQq*v&WgQ9buU0)|1eDU4;?sH<oK0$?u;rw7Mm8
z!u;08zHe&tbyf!D2|pP)S1fc(7QW8X$G&gsoJ8dfKN&zeLGcWV-&XZQ;<e@nCo9i*
z!T<`nMt4vQDbM`E@cw}OQrJr9MVX+H<K6AYnfzKoZr?ZceZl?psr&a$Z9dM*pxp42
zp>%r}$b3iT1wR=;tDBn|K<2zZaDRa?tHQzD{jk*C>Ym*5m0{-F$?OcQ#T(QO5U0+8
zMHZ+V{M}v}`V~H^`&nJV0F;s^e`jX}ofa|YA!N=2$-M5b44rS^i5G8Jj%3<9(c%S5
z4UX<F4gHH`)&j6uZzs2Q<1*(PnmOO_nDZ68IbB~FX1**gScK%7;)F#8XZM$e9)*X)
zXLX2MK<!N|Zh@My1jURcILzp6#`Moz_vD7JEC=0_yS_5bec0>XB>s8ZasyD96ss>V
z_}S0snmlbgd_1*y!ZL8kl!k&v#d}?wM1O8?b!`(xoaYI0FRwe3IOty6HnHS}>rBbr
z&lze%8=r$lqY<%q(0$Isv-{_|&v}T5!;7xPsthLY87^=M9!01`K4tJMRK*4kTq^ED
zRZL*RrQ#-3MF9&g6<47u0+?{A5N0)CeZOJ<Vsv@X>fK~_RyN4)vUIy$)0=m&Gcd2<
zU`XcVU=eQbU}$s)&zv-|vx+1;vQKb&EVb<4jI>GY3)%P0U_B3O|G2d(8*KTfY$EcX
zX?n9o%fDt*mVb;-l{bhoBF=!C>Yn^#IYVJ+Qv*c2sR6V`6Ex1>zyR7s%l1dF6SVVm
zQwwOWlJ#k;d-99vOrV*v8R@Lutj}j8pK7&hmB<F&vC1@^5p;6spO)v4QG2FJP+3(P
zdUn4j^weJl3DCK}>sml2zW=cQqvTW2?wMt+GKq8Yk#`J%><8`nf!xZy@uheqXbj+_
zE~tc6n<|sI@x0%g=_;Uob}Z@BH9@Va&Y}(n&`R&gEi6p$Kghoke9COz@<%59=WLnh
zk0;Ok_b3xmf`Vq=K(11BeV?#?1H@cU4P}Fs46a{=Ssf03+&`JMfeo@I@TmHGg@F3p
ztA1~ojX4=+dWdT<GYE6Mh@Y+sI;|)*QCtnwk9n3fT@5r>m6jr|4qD0gJaxJ{c)UJ+
z))Zw0QATAGRz{w;0$)Y`T0FIR+woxG_U-H}5>wfiu_M~&Gf#K1O>R5(cX~SLw4CFs
zwoUJFZfclZUdo`=KDn%wdFtWbcXQp6d#^LGc7j$#3A3_t%secds>&ePEqPuz)s>;C
zq46AV<K%L7M%GS<jBq(SQ|;%b21cZlg&{2p*L9E<h3lgC5BQrv<sGDy1C6?X>VQoh
z0%>M_&D%H_goD)>lFOJGL8Wl=zi$kaTaOAs^s+8`e<2=xLnf%K)=8Z#&d$_0x%cdj
zLS~D0u4GOQrsl02jArdct()5H+LUcX{zB%rj{Iku0p4k4&hn4huH_%|whji6P5WAl
zTHhb=hoAQZO2e?z(?I!TU5ioY`wj0u@E-lFW?%qugX;pXwq>B3z`uT0Q-F%KLdE8T
z&k6*cng(jO!^&?+jylc>^0VDkk3dlQgDS_)0g>bI#guag?}WCS%7H~+I}1dg2Nr$D
znILi;;PMWXwjuM!4GhyGL236S=$1}~Voe5<Q`6_9w>GzSKRm4VWmOBKYtRe5uJ;G>
z=O;b|jZFo$o|@kL9I|Key@3J;Xf`>y=qndU?$q?=m+VZS^|r|`%~(ORZme#bTiqEq
zi<>bTb9`_xu9(4aXnJzfO(yuv+c#F`R!&s;$CGaUgXCSOEKpmcHWZXs7(JTJJ6R^4
z-&1_2eCFvxZGP>NZf{)~U6oBhdu^F5TK=4Cb84Fj+O4p`{^z0+rz}Wb1DOEQAJqC@
zA)t0uXYY299H{Mab~_{{)IWmCx?R&d(pei>J7o{T;=(3<;_*GjcdBO|W^`?u4!)`S
zEhr2@anjTP+0zQT=MiGc@i(icGp}rCOlITc^ZOI@W7(6iFBkl0q_?`&nr)tTjDfXz
za_6`ItliD4*qOAtHov^dQ289R(qu*S`v>}qn@w89rzBiF*CZA7A?{7mi^;dRm?m={
z6=L+(Tyd{e+!Qq0tXlm3Lj8HrDDd86$z|H?JsFc{h%!w6-pVlf2M5Q@!;@b~Fiif=
z$_Qd<fLKf*mIuRxl*!?043Gbs|9<>B?02(y7mM&54kqCk9;S(>!J&EFtUaoAQ(ID7
z)AR``Qxc+DAGN;U@c#+OCRXj6znH2YWjp17(*OGn`UjJxSoxNvJgRi6T2uwv3(J<t
z=n7g*0&+LpKhw0jixY}UKw-B3R<lXBc%%26gq5e0UYM@v$e7(N#sDf+gv(o*=N=Y)
ztZZ`S*ZU9l+qK%8&02o>bzEy#YrEAN)arPBHn$AJ`w#N_L32Hwr{j8(Cv!8f`pjnI
zVR-yj?YC1-@q>brX6tV8MwjO8+zfLcFI@2c!~RWL?I1IjwZ(x=5k1|i^8Um9UCrCO
z86R@bJ*?I~@d2y*Y!-Hg<i9G6%v-q`Czq8nOfGL_{&?x-=h-ac3^(_K{0j2*`wjY=
z9&@pNC}v;~0_{kCzd?WFV<y%Q?*;6y!NTC{URZj8qyzUepfqAP)x!~#PEh6APjR|W
zHv`Rnq$Su*jd9d#O>TM4#0wQ$77sedpB2hG7MtAmoB^V`EpAh*xEW~OS6bZr3-b?v
zY(O@B_Vurh)5Dk<nzyAL0qta7J0G-@*=%YbyCN&AyWLcoL}T&o43fug_RGL;1^}&;
z_=&`axfEm;$PDptW(H>S^!*UCtfqoiz;vX8Y&H(v3O#N9;aN~G%kK-QceSZAIp6>f
zBn;U11bxu!3VYM&x|!=MLr|;NkEj<5x!x!2{~6Z$*7f~?`j66_tPGjn$qw4wYJcLM
zBt2+!nXU~Qd(QqRy5RkV`b|l#?-S~uwyH?8NiwXQ^VT)2_5A_)A0S=HPTH)K#XTAB
zO=sTI&Hz&P|IuW2QHEvHAGJZkXj%X6)|n2*tg{#%|Ni+4G6Rt63duuHz20B2pWS;v
zZPsFbu79BZ8mOo3l)WgMDF@VpgRJy#YIsxv67d6_PhbijAMARcQ2z*|!U=pnh*LI1
zCH7EbUxN~A;Pp$0Py>Zo)Qh+$pz#}6|FnT)dNkPoD?lk(t6P}Wf#ufp=2h-Y?>D^f
zOy*=&nVBNYn!x&g1AnLF!O2fp5{f6V7=Y60`wj2gIZuLg-I{*KIXUtJQ}Kml0XRSK
z1JmE|;tA;nAQ4t~u$u7i44|6wp?L8GcB9(JD#>0KR<FsN3{1PlXEA`z3qRE=-O6G#
z^YHr(>mRnNJf3RuACmh08zm1G2QVan%(^vwMmlIeiQ?fY>9XNz;;miDeQZ)w(p$Td
zo7v=A-9Cwh_RmRw+T7ZGOB{5b^KpZ};s3;oCtNoup77kDc*1wEi$JDK77J%ezQM)>
z_RRwM-<&6l0}coj2V4*+4tO9?9PmK^Z2N-xpUJYUVi3D;ICr`y-+j(etg*m=c{?{l
zZD^io)O2RMb_SVrX5)4So^;_jJBDV9c81Af&dgJr1=58te{&YD<Kvk8ot<T4qe%MZ
z=f@d^i<y~QJAa98exA-S`GyC>*?!xm$y0wYpY3Pu;z>W-R3z5gB|QBabFJvb{+s>A
z6)PBor(b0P-8`He#?DY1UM5~E{<FV$!g8oz=A_SUZtZ^gxH!N85;qI%-+@C+0u-O`
z7sS7<Jo#Cj!9e)>bq3z<%F~VRpmnK?uG7W-|KB(5d6QfGLiWcqpZ_ZkFkk?MMzcvb
z%lifYUvj=>bOoh7P<n-oFMv`kXoTUt0srznDciTOFbHR=Ds^^GZkZx5^YLVs3D7XJ
ze<pZzJNpOF`N0l%dx`}t4T>kI82IiNW=&vuzaaj}V^P*yjV`g9r=+uj<M8nmwkNU+
zCbKhuP8=@*?KmjjP+r2izc}DPLUF)_gyMh)3B>^)64vgWk}f<=jQMdq+XKP95Yy`K
zi+)_Wy)<;@e$Z}^Qy)M(K(soG0~|~iK3w)i+=H1xm?NW#*_4Ap*@EQ<=yrn5EGrp6
zdti|FQZ79XTBY{??6MNjjta=>@X+|b$$4_R`v3ov+uNH#tz2c3@7IJ`8JOP(<o|(~
z-ch1#u!2GIVZOox@nv7&rbBH*w&mh~MK|NtBMgn8_QTKj3Gy32XP79uHM+h}h+jV)
z+;(1mL3t4i!-QnzH7pFui&&UoJ6x5KcH)Bev^KgLx3ht7iYcDJYE>){W&k>=f*CX)
z!p8D*=AnFn2G`oqo@C8NkZO?H&r?GUiUnA$izkGF)q>PGICmt&<cmc^4L++fSQiT*
z$ve(`m@n|aVe&Lqrp8G#59KQ;a8AC)$|TInz$84GjafLDnK@a6nZZ%@V3Y9YZ~P#(
zqUu5rn*qcYRGru){Mii5=2Y!$YVDf%h*gzS^>0|mg~mzAU$!yiD<m+3Os{pV4Hgb&
zW=u}G%;0Exhz-PRW&rULO&5WA&R|}l=_D{u8O*CR?P5zl%*Ie_IwhG^^~4!a9GkUn
zY6JNf<ey??n13K);$YH|j3hgO73y1vY=Tj-FtfFB@n(i(mdy<L0ttpwd^(arX11zL
zIfJB6SpY@f13gqzMNwoKbc=<BkxXUK!DXrfioOO-R8v(^WEZG^7E`u<+n3z3jUiv)
zfEq3{4N!DBs6hOK<d+GiC@K_`K8qQ{&2>=3Wv&B?t^;zYZgoYGeIWB$%o%PbgA6V+
z15k7|NTQk<iXyu}{Iggv+{^=FxXesI(d8h5YGx{mY=Y2dv1GWJ4T8ALEI`r4z>jKX
zDT=HD?`N@MxS0+-xXf%o(RF|m)y!5D*$3>O#hT$}GO*(^a{`L41{PE^r=rL%VEQaJ
z8E)nQMqFktfa`iZo2?Gj#H9$ixokC`#THw??Rz|9TMaI=HXzhbWvfCpYb!!-I$OnO
zvCSZ}CT*+0W!3?N`uS`nsAe5S$W3G``7CxAWY(N*MYznmfKWe^tpGE}Tt$}8`z&@D
zWZsl*dAQ7bfKWe?EeF+YPZ4sH*|I*1JqDRIZ(9Z~vpyiy&t^+QHR~%vZZ2EOXR*&9
zvu12d!DSYM4Wz7R`T2M%TN0{StO&X3Yzd#mm~GznJ)X2J0hd_<2=(*XVo=QzMaWHL
zi}@@j3^HrZwkTX?DInC(WQ#yGOBEqEn=S0Km@>$$Y1_hZnPq@bKbb8A)httl+*G!p
z&tk?PvnFf{!ey2NLj7DeKUA|^5pwg{d_IdggUp(>%?FoR0SNWe*}PEA3Ps4xWb^ne
z77Q|L$~F&NW+fohPh@jLH7gY%H<``lvsg07ta;m<aG6zrP(Pc^0W<BFBFo!-7Apps
zH*K38F7p}?>L;_=pt`LUAvcxH>a$og$gBz5tZ<n%0ik{_n;EKEQxS6W*-So*O$M1Y
zYnur!vlbxKPiHeiHEStCZYG<-XR*Z~v!-k_z-873g!+kWXl;S52)W5@I-kWhgUp(@
zO$(P<2N3FKvuU8Z>nK8QE}PnCvBMy<W^BV*_g_G$pUS3!YSvYR+;ldj&tjKBW=-0r
zgv(tI5bEc%q1E<J5pomR<UWf%2AMTy8_s(E148{wHYrqheMQL4W|R0V_8DZ>v~3c&
z+{IuEFT*CYiJ_XsijbSiCh}Q~+4gPU;|beDaG525P(PPV05k22BFpoA783@UH)9(g
zF7p%+>Zh{tpt?;JAvc|k>$8|L$gD}*xNw<efKWf5jSbZ-Q-s_^Hnz`V#vrriY-7P?
zmIFflOg1J|vs@8!v)LFvi#dbLnzoGrmstUD^~sab+XJBpxv8M`K(OuGzT^qG+XD#*
z^>f)OP~DY^kekm|_E{_$WY(;0Ww_i`fKWdjy**HhkekU?^jWMJWY!ei?STe_`iY?S
z0CMZO6(Kj7E$_2fGsvuY+j4NZYXU<3Y_=>^KTbu+&1K8@EH)Wr)(qTjfdvTlQ_<T3
zOA&I@L2ZG>AhRanZVPNcsGrZ4fSLBUBFo2p7TXLmZ`QUrT>d<OP(K~LJ#Z8uH<K;u
zv)EyfSyOPg2QDDgPegAITt&!D2DJw+gUp(@Ed-al9w5}uW(z_M|ECDKxoiQS#U6vq
znz1bamsuYW>ZhW&2fiZYri0o8pFw6#!rdNVu!EIj$@AGfP~F9fkedi<4=~%k?Mt4s
z%?+2k1Q6<Hvbms|C5n)n&F1u3Oc-R=G~De01%&#^p!NWA+E+!$O=YwDET#-HYXa`J
zfB{1NTsA9IcbOvO=CfIR7BdE!HEWv%E<ZXT)K5om3%DZWW`f!R&LFd<;BE^9Ak<F;
zwFN*ueq?`!BFh_m77GTMH)oq3F1IBh)X!woLG@=ULT)yj)@QL~kXh4kw+9Lk>L;VO
z2TBogQ$g*4Vvt!AaJL5<5bEc$DWSTn6(KjDP2saxGsvu2+Z1s5aRNg9boBPXRD|42
zHkr?2lR;)p!QCEMfKWdXy*;oLAvYP+9#{-AYu+}T{rwFH^|RT~diz@ua&y^)K8tMz
znKfgZ5H3F+K&YPzY7Zc%iKB42zt2949R`^+8Fx$I0$laON2uX`6)to4(Py#CAamw#
z<G|&j2XNI(-=UiG6fU##-Dk1KAaiEpZUKCNt8RUTS=N7r%XYr{EcO{>)>Kdn05l5L
z10D~9gamj*QQ2SvWJHnWXX~S$<V|g?;E_qNoPa4@?r{&BT2C^r(ahRV(1;zXo|fN}
zSs7TCJ_D@)fsIjqo)Ka2Sruesgh8`K%kOn<jjqX)IanAcPG<eUoSbr%p-JqoYi+1w
zBZz$vG>#am2xdP7jUt8$g4rKIV~C-gVD?YbF1E+V*lc>PfO0*^{V<n&)^LEk9@A&8
zaJk3LY%=Jf@>wGQE{~}<6fXC;n@tQ;ZvtE%Q*SC<?r}ex1g72sxICubQn=jXb~X`A
zy$x`AOuemexySu%e3*JCz~wRZPKC=oZfE1d)VlyKkEwSlT<&ovn;fRz4RCo(y<6dO
z*u&}oTpm;JQMerTu(|-3$JBcjE{8p=9>C=>^*)8mVGpYhaCuC<U*U3(``K79!-`=e
z?wraBmwVjK#(=3;04|SduP9tDxu2~HQ?CMC9#gL>TrRnttqfDI0bCwauPIzExu2~7
zQ?CPD9#gL?TrRntEeBI?09+nZZzx<Yxt}c!Q*Q!X9#d~BTrRntEeTU^0bCwaZz)_Z
zxt}ctQ*Q%Y9#d~CTrRntEdo>T1h_n=-l=f8<bJjwOuY->@|b#;!sU|t*<3L7Zh*^U
z>fH*LOKxX#z|?yHE|01AC|oYNpUnzW?*+I#rrxV?x#V^>Gfce?;PRMypTgymTiFaS
z^?rcMW9t11mrL$t(?Zu<teRi|%fAz!U2#Z0!p6|*cI5!3ItC*Ybs-lRI<cx-05Q*$
z<>wWL<aw+Lt**&8uQK&wRm*S-W@hqqHie#)D-M&NwlefQNj`~L8x*TD{D!M;W0Se!
z(CM0d`6@=qU#xmT1g@@^P40>Vr)y7ga@<umP+g4F#!x)~aj6;0&*T=6d0=%>S6MLB
z3Bb*3V-tg#7j~5iU7Y|tgp%j6$v}L=D$w&J`4Afumhh~Co7%!AfJOcQOuqBkl#I#G
z#2BW$z*HrGrb>-r%8NP4o7zBb1GhP*hZ_{DDI6%C5N-fE%eeFToQ%oO-5KV*0IhJ^
zliquHPw}4QiRaZ?l}%WFHcbc3^-3NE%~yj?00f=-2iosFC&g>JNOo)2#8V>Kt)ThV
zV<Oq0dDrAAY&w&_fB$<WV9t}qW0Rk=v&?w{I(_#GgA91x-OR`N58n5GRxc=N?FO;+
z`<ImnvnCwOf56}0>iYP^)q9eAr=)=W_Jnosl$6fYvwc&ZT-|%c;qUG#Dce~YSU~*B
zt)FN7*!XzziYr$FwzD!cob9`EL3Q`%880?Ip1tB6Sj+(=_H-l2EH{QJPej3{vN2A1
z!nyVHj2jyt&s=c=tWE)>E^y=L87DSAp19%&SWEyUCc5+Uj2$3#`@muxAhE04KF?SI
zQnw2%#sU%x+;_!+b#Jk-@rGoP#W$`5On%nJaOFb&hx6Az&xqKNJaxqjkQf^iNbLRd
z&oewWB+p&(2rR}37JKx0#*7WgGgo{8iz$G_^1pnZ(Xk<U;))MoF#)jH`_D5fK<ZwB
z#W=uXuRhPn0I7Qh7GnX6J^egm2FQ(Tz;0v$xiNIl=NTO!zbpfbF@nUVZuvZ;0;Fyc
zNUVVYBqq4$^Nb9Tx;Y>*2e8=1O`m5(fYi+Zi79}^rtbPY!vmyl5=cw{EGD|?^9&1+
zx;~H?2UzUlj?XhRK<YX`Vk}^>zzv^gNPyI}fW(-<Vxl`f&*0dYJafgrD**>nK`zPv
zkpJ)Vj2|Gs{kjsc5GMBX^NbguF!*vMU?NQH%jX$4K<YkR2>_)Qa2UM*JmUmN-K#4B
ztuS@3KF`<zQuhobHo27*oNDqv=s*2DW5tH#=_?+9!_WbwU;n}6=j=?TyVtb|vwmRC
zzwrOhx;94F{0sHpK`WT^FT_7-Rn7m9f7nqFa*A;=Lx2DXKiv;ndkR_A-N4Z5zNtm4
zGr92_ORsx!%Qv=($3SX8`00LOR?v;TPyT>z#Q>d6^S&W|XR~R`-)1wGzo2#1tZzZ;
zKp3RffK}N9S?&C7$Z7?jg4BWV)BVZ@Pr&zcfL7vEmI<?ctN++9JZ&4p#eUE_6NqhJ
z{=9Ff-vnA=4zdlj7l+xL<&WUo$=|<!FP^||P&`4zq}4sS{~J^1Ij`1Y1_guKFgY<{
zwr}4*_6v)ZGhOU|xnG#|0Sm<4_t%2ll6bdxLI^`~00T>LfCIzJ?SiL^Cxj>z2Qa7<
z2RMLejoAIg6G8-v0~kb#0~|oKMCkTpUN$k%nrP52bha;`lchlC@o#E*Kf(VyvvJE`
zX7grdVZLVOWbWg_&894WC%1q7zij$ujtvf*fBaxjTp*F0%y(Q+B%9fyopEyexBr{3
zZ)a*{-`u{PX>;3k2jjLI43G0q{5g26*|eESn7^4RnSDQB^FCIF=KZY<<~z3AnU}6M
zSKe@+k&A<iRe8%lMq!Q@tA$y=zEj@7%GmL=*{+>2x#pT+vt2V&GShwT=KXyP%=`Hm
zlsCL*R5tm~sJwxXQF+Tc299i_smeRnF>vG?vmJF%-gAzD*^HS*dBZtI<t^tJlnt&i
zDjQs8J-H(JCkJP<c{9^wwq~Z}rt54y$sOtD+qT<nFI#QS^N@?Ji>>3SFx#`$liR+%
zoA7wbbAfE-J>rZLUh`xN<R6=A%qHf@^IG6Nvl%n1Fncr0jK>q6%RExH_{=gVTX6-*
zjmle|GAeJl%BXCznMrxeK88kjDbUXFKkp~xgLVyo&uV*=0y%f95xjfrvAo1zo^*j^
z(D_u`%U7FEc-Y0(#m@5#bQ%?C=eNjXndi;s%&e2ynpr^X8IP4M9<#_~r*3~NaqZ`v
zm&$uY8A0;GY|Sha9?p5%^H|wpGmFUkIhm30T{?Pgp#Jsy5B2cXnV^;DpxvW-ZJ@gh
zAhPrCuWA=O3EDB*=&Ee6<llRT^-n;jCxLc}+JX0vemn@%2hs&rGvWOeW(yYZ+2+mW
z9W0aCI#`l>zA?<mPJZ^3VM4yq^yD{BL3c&Xxc<+n_5B3?t02=rtJQnbCxHD7I+F|J
zXD+CpK__rcc|7BJvsnkTFlz^MGUrv63E9k>+Zi`=q%m-=(3_sj_lzYu?>O6(q~z{p
zOf#~2@*Yon@o&Pb3Hie89ZXKGdebJnYc}Ixp7D6f^Er={Eq*Y)pU{66W^YpivpEM#
z$783~8P8=ND;xY^c|T$OX_)M+sXgzQ%{iDSvvn|mTp{xqq#xw+{F5*>Gm@q}cWRyS
zc+Ml4=kF)HKMoT|%|-7g_#X!C`)G8Lsh!N$%ADMOonc1)oa9|o9?!l0@BM`QBcRi#
zK&J(Q_7*_GRqY9bfJ`Avrno9-FS#n;+@ALn-tPmg7Hi&qTmZ5Y!%ZN$^Ed;e`;`1S
z$!60Z&prNcW)D<7_xlO_`$4WzYlYlt0xKIqt7<t4kyrFi4tHY^=4fS_%+bm`nXQ#&
z@^|(F0xy*nSQ%tK@;v2vt8Bu`tZc!`tZXC7tZX34YVy?NrB?gZ!^(SD8I*UhGRRbd
z@@K0XD80!P^8B3Ioc!$@lR*CD>0u15Y@4Pl?_p;Eox&zit-OJq5tK^=ie-LJ4i95^
z{O;QyW{Y;FX44J^W-|`(xop_dy|Td#24#~U3?juc`HZgHrYl?gV35fcDW2M|Z1aP`
zCRy1)f)OMSGGEz%9e&@NQ`@1|((M9;nujKrf3u(ZUM5!}Gx_y%CXrNQ_HPWy&z>;}
zfB$YT`WO~AJc*FdbN#+=>iZA&??7P%*(rj&gS64T)lHa<fkkmaD|>R=aR%e*-xwZe
zF9)BH1-bnU68oT?CD8c#zOKb?>iY@#v$fii8<sGEO4jM%wZ5v8#6>~t?U&Adzo7mG
z=yXR=N-%Cc;vj4)%J3)!lpeq*uf0V&c}*O&+lD=E)$}>Zz3@5@<Z@<H)sG;1-uHoB
zt_q4}kjo*bqJc_v&?#o`72+SQY6ZDLt@Zte{$-&0V)AxYj;W`4PfniB$}|~tx*OPz
z<KgS3&q<zm9%6RtYmnLcos6m=H$vQ28hUj<XpOPgkEj=*mDzfo?>C%ZuGP(W610ZY
zsWPh7348+^=zI;YR<%EVU*0e9p8+}%2(;rr`RPm!(2m)-C)1@sd;d=bh--n)Ry_4&
zrZ?nFpzGlM`;F(BO}Q9Aw);0Ss!lH7`hVv6WWG{H$az4grq2N1H8G80^09B=6Zt?V
z{lHH7@oIg)Kz}yK#>d}h{sOt`Q3+&S>!NIg`#@qlx5HWspq;V}450m1&0ARRXmzgZ
zTs1|lmC>!!^?if=|4#Ry7s>oz8MNA_tAf{S7enGOwekG|d(iFl-<i!gnVGFRnV2m*
znUzhB`~ls`*XSzT%EJ7<Vg5H}vz9-?Q#qL!C!T7%)XM1o{=@mNuoMW2H%Mr+UIoP-
zOkD6NBqc4s+<6?N1|$cfL88i=mR|z#L9PegJGb|sFlz(zdxiTK!Ls|8pDR2nF2T&e
ztZ||$nSq0aNkTY+gK4@LXb;yi%SQLf93R*}t1_4*zx%;3BgvR;IRoeE9hI{E!sg-(
ztn3nxlr7kpTG<z}J)Xz@7qZU<w8us53p9LA1-$_6?g@LM)wOEMXLSdIeO;~TliS-H
ziWj&WsI_)_ife-QvT>ex-%$TFnbVXRbOPhV^D~MW&(A3jYVADz{=>URAhE{dbIL&{
zW`bHyYOU`Z=0AEYZTh!(f|mhk4;$pRNyqJ=7T?zWh%yqiI+xje`N37~tZr6QdtH|#
zzi;^eq!)B&IupqM&D+xtbe^73EO~rRdFSz_=|97hg}*X1P5G?q@KKx<l=q%yG^)N|
zFn_`O5Bhgtak?}VBBz@2e!>5F7x#lsu~_y7bUs$vo2(akPe5mkY4sYl?(5mqyROBo
z+p6om!v8g`?#Ykcg-^ZE>YRCIRjXR-`vv<yfOcW4wN7*kYP;3?e#84F5Fe7G)%hoj
zaWYK@=QMRi;p^8JcTI0ePHtr3JNE>%$FF&(=a#TPtZvI@PVVAlZUpU1Xo$a__|&Tv
zbbikJ4|&&Cb%WL~ue+$#qr7Dbv+|A<X5~FD%zmw$Zmq8G8|GhOR1G}X>YmK`mFa5;
zBn^hOzHg{M=a#uF^HJ5JYNi^{DHUv4PSuaVCy2pLwSk1&^EDGs&nRX*J*Rx;;pB#H
z*3Hk$8C%bTY?NEQs^#h(zgAXoj*vgs>He7U>n~W?r8+>uE;Zo&0{ia7?Jq+Dw>O*e
zvgEZgO<&dWaJyUP*O0{R5I1}c*}LB@^KHmdaEz)wf!r6iss+^dT@kI<`F?@@4biiZ
z9Fe-1*R9c2ZR-1m|Hn9ACW~@1f$BHdjyIU?tmY8gTRq+{h;Ob9{kR`=j_|wVpcDhW
zuTULyhhh7?%`9ITK<O3K({?bK{9T=C&KuBv=s6$WAJ~7g(>?j>a)!_93k>E!ch-Sg
zDzN+r2_g4cl5P`S?WVqOxW9Lzd$QbD2B`SV#^ZD9L1`J3M?rZL<~mhvi0hWxy<d?3
z^Zf_@t&qCH>xJJFP<;W(D<`Lb^24f@b)9xo8Qo^OzHhj{eWp8dnX^;{VvefS`vvd6
zy#LU@0d)SS8ffRrzD{?wnaS6dGk{Ky0Phzt=VU6Lpl$#<5w&=NyFs&gCnLzW#S7d`
zrqoQR=qZ7eMxc^Ne=Vpqhn!^)^&;s3s7%-Dgv7?W7NhQMomM^X7yRF+dN%CM<XIw2
zlW$2eZD(f?kZ%9=|EGBJhvy=3Pl7%`_t$hV@8V|gnw5N!g|F2;`K`I&L^nTBE?6-C
zQZgT_fU-#^v$91dv$BmPv!EOJJd}p`mAnUGVf9o5;>V}j?-#6p2HHEbDEn`u<AUa$
z+zgYavoJMIJ~dO><QF&&L1&|WR)@r*@}8dzpm<c?@RP}__5FeWYdYPNPcG*G<+SGQ
z?e%+4&#7K}y4jSIMXeQ79<1t2X8OuD*<6%i_LVP;oktpvH=A>^G))g`Wptb9`o2Ma
z!9-AL!Uk~xqy}-SbjoJR@oR<b%)#c9{c~9VLR<-QW8n6mk&kC^{Q{M3t?rGUk^4a@
zOL@yrrnTE4=KhV0-To-+Yosfb|28smKP)6%Ss)?dD*b)||F!oY)=z|$^~x4Y{&c$Q
zwSsm6E8DRAf!)>x+MWE~!G0lVZzHI*-frH^AS}+xw1}N?@?Q32uJ269CU9ak;mM!(
z4)SwhCh#*DFgI^!6<~A)-4FUzps4{=CW6Yr=IyNlyzbHwu8eD&fA%N0Jr|lBew1O^
zn^P|)e=}#$>s-|$-OkRi@z~_=?fmP&JG-4)h1pnsE89E)-E8$+*+k^``w0%#%@!@c
zm@Qa-F`KviT-DC{Qnp)M4YUt!86y|F(R2}K;p<-*YP&a0Yl7ChsZ5Yic`EpR!TKYe
z?%*>ne=8eI`J-&}<rnhKiT4ikCxFi4S=A0I@9e<m@HCsT{5Cdwz_2;vIs@l9w>GEN
zQ?1}Le<lQog#HA{f=>RK*f9A^3;(GpQywsza|+nC3bHF3yc7VL0x}PD0vJf;WRLIv
z!Djuq!4UiF<93jkvH1gr%`a{+#NH3xzN^C(EH?SXkN;qCkh;r-+nu03Ir<gi6IZ79
z3;1{Z4POc0)w1jh1EW@Fvk9k=pzC`E`31t?O&EIJlSRKX2~QVc5H4@$pZ=YRVRF0r
z+FjG<B!kXIZkmoVHfYKzFqxI*r?SbGAMX?T|1+Dj{A@OD`LU{{*Io3vaJebNW1jE7
zP{Iyr#|bDL-#eWDQ@h=(^}U1tpICS=Qv4|s1GA}X_4Kby43k@3x4uuf5DqKrKs$0k
zH?y?;f!xw^>j48Jvt=8DR@b_&WKK?zW=~EA>26L2@V;|VQ18ao;r)m6(^s`5v$M)f
zW<Sbo_hd4AE3@5$$;TuauC-3)X!$M7(ei6DJIiljc9vhPZb7Y+J6RatCp3iRK5cam
zYE_=_h2>o9`+$VB%(tL(oRT@YxfZ596r1s7%8zFEPKM;k>;lc^EWeG}t}{${Gqr!t
zhvqa-hE3C^yaCZLzS;B{UzpuzGAK7ZVVQbZ{5unaF#GZiGRcb@SXe;2B`4%4E|`;?
z-0_@YO8(<H$NsgtFK+n4GF_CJp?T|4E5FwF6E29aYKOI}N*~^c(LD|^#eI!P`iuut
zp0qq-c@B%6XPItU%d*(A?OH)&xFFYocBIaD!))I2d(MX`UuOJx%*Xi+=APF5pxZi@
zwTeT+OZWW;{SMISa=!Z+y&FAa_fANH*tC49=qbNeWs4_2z-Q1+NT>s;0>%2?{mL6y
zn3VUhFf^xoGVGc@=Swr#uU}YH_cL3vGbnEWoh1E|;pBEuO_I$2lBwBElI80!(225~
zj0h72*g>X&Onr#rCRUaA5B~oHiCgZ!64Ur=?S9bt;hg(H^&8|A1aWcDX#wmOkPu?C
z5N2!nyQ<}Vf<v<4QACddG!6z)k!GsaD%{@A01DyBt*xdrKFxXeK0v{v@Fye`QjOnF
zn4pc&39Fk~5AriOFp9CsBucZf@q_vScGGwcAx_394ZRCLC&c#PWbrTtk;K{U?0ld-
z|3>ZGrq6NaXHej1JlpDK)|x!^D#OBVz1CiMt9xQMtLxX_ylT5zA$gYd#`_8P{~%09
z$UMFIeuDjP(7m$Ie!^~uj?_!<C+z>p==u|$n~+`XhQr0KU|;dNizLqOU}cysuErpI
zgOw?{{5XqrJG(rSIOF79)07v8F@pRqk~o=zL1A~hIQSfc%^lYnloxO?noXAg`%EMe
z=0}jOCh?n~(@G|MWol}WZf9o&i6Kmy%)!7Wk{AmQuT4;2FFntz_I^S<c#nE*D5!-4
z>Su!L6gBY8wbQ>cFidVeD!;1by}|)g(9H|0S|_s|`76!_D$(7}tF^vYP%vja%B+6m
zFXwx;*6B~d<w)K8gbgB~8V7O$_GH!t%%HR6-y8660qy-4J!;MN)nOl~Wvy^P{;@0T
zpH;2m&zKm5*_KtQwZ2biD4EROaPTqb*I%XkA*vYkUV_JfLH#0OHgNq2x~ut*vIPt1
z=4^O<`944)mGdRD8q42i)s{cZrYwKnGbreSTmq^+LH;6af<q*_2@O`rCV<Wn_xiy0
zhtYj98_QotH)WG8aCfX~dGByR8#MOI=qdTM*_`DstLH*?(Ct{0*;@Xxx~YNsi4Gey
zTiuvVS^oZGV@-R@wyE{~g80XbFF~UQpwU>b*7p+%lt4Cu`b)&SyTKpb-3%!1ChYSD
zUvv`|c!AtOf*ZWiO>hW+nK1kMSH`LDdC!7c@C*WMZ-m)f{(<hKW^{Y+FhL^OkClPh
zl;xk`NzgsFGmpP#Xovyz3qY-P(Ea0}Tjv@MHZ_3SwV>9l+MiABpw>rAI_Ne{Y%7!A
z2PC-gK5SNR`OB=%^0!&7<qxwO%b#Y|mfy^#EWf2YSQy?jI8;O0fuMb{#HEe}L7Yz^
z=_-H+<}+A{1t}SyUz16m+<u%1QvMw5e)}7gmqB9e%pHeewJWNg<(EP7Fg=~!jqf><
zg;`mdIUGS{7^5moS8eEBXb%fC(hF({Pi}vHepO4yV~`y)lK+MovWpxBv4z<in5HDp
zIMjMl_85o{8e2(Z7dZ?nN1H?&CknHF`>!{>(G67cK;(tl-I*bJW8FbIL85b#K{xMB
zWS?;u)KU;;Rn2}s!TwOI8*AD>Hnmnr+MN%+H4`#AX&io>X*S#U{~*0Hk|8G6!plcU
z_@p0|NuJ0K37yH`*%e^ngDY&(4<XdIcF#P`kqikH;nJ`C$l-z-qU`%Q9ygwqJOy$I
zM=~FqtlI9YN0}zGA7$t{tjG#60W`kB-tw{^q(&ln@^f<rMRpmePgxV*Pnf?MWIm%S
zs9Z!fefdtA<b~|b)7cq7@iX~5JKNLSAX8+LC%2_DC^sx)K*)l`C6Xt9|Nc{vU0L8e
z{4^<;iI7-q-vWulDanlP6WNp}JYxXqo02T)D%^35L0Mo0!$P*^X>4HoATq+OZ499E
z*iNE}pG4A)Y!b-Ki)_tp2s4;>uroNO+KRsH6K3^bRA#sewo_Uxi~$r@Q<6K`{+cQ`
zYy*o<N!|!I7n~}XC$cL~c+LPx7fS=)PuRZzS7^B}mr35p-rNoetxkB3n8*&g#|NYf
zGlbcfAnTdf-FcoPS&@~Ql@%NUxZ)lZmdcx!FW@`}3L|MTH?U7YqRrc%&r_bT9qL|H
z&-WAdPX*bGEq0I3kx8E8+^7zU+sCKb|AEYsNybc{P;+O3QZuM;1X3^j^*euZFgrtS
zD9ChVe}Pm_ZfBp~@woRO>miJMSbUrXWY3IbP%eeA8r>YBxfzsu6`|}o$s5_HKvSuz
z!}|&L;QL)6{xC+#e;|_(bv`8bwfBQ^6DTewfB()8a`97W`Gh+z+<U;Oy`7x_rf2SB
zj%4Jx0J&EtnbZ9syK=*GcnSxVR>-MbdGGQzkV;TUG;e?2#^`<#tR9kvo|?U%kpBl1
zY7oD`bb{Q?tlr)N(beA4>SitalmQ}|-V8eBch&S{&g)E_Zpqx&8Rj@kw?fhx$Rtqs
z!*VHzFFci<*>NIR6q*{rqF=xBgT&xAvNJO<tEbmaXJ=+;UanpXvX4oW)tzx-a^G_%
zPWR-#=iod6mfxOUy=r<7yj%zS52SDV^U77zK`9Po1IToQjC;kZ>B<d=bLC+6u4<jm
z!OSqZ!=p^pgVl}G*>VBAlw|6CFAjDUdr9+l4u<J$%nZ%T+KR2kUoe1Mdef6zjxjx+
znf3?f+e6|9CxcEwe|eqJ_5FwWpJ1*4#XKn1K{1&MFPXtUS?-=E>JBn_a+_M7wfJ`i
zaW-ZKW;M0kIY}TpT3vTdPv+ak!s(vO@{9%Ivexdc$02%;XR*3>Bqg^#2g!FmXW(#T
zR0Y`svzJ*El5;_PCsAk|K+8{%TVwa5x(t@OK<Yuc9TbAKp}zYo3!B81K7dYRV~}W^
zylVQY7AX#KR%Qle^RG!Dmng5lo&cuTK2H#?;9&7QH(T6{VeNcyS#bS0)1g*YSCD<6
zHre|R@()2X8oaLWKh!?}^;kO3PyYIy9~5Hs_d$GC*U4Ag8Qy=Gf3Me74|H<-y;fIF
zP<Y;LbQN@c|3Ut)D2R6zq{IGdqpPgz`w#bTL(+39@B0b)=TYm*^WYgm$eatvCGS7{
zzX5YW{0+oi_n^2IW_J&R<vUPFE+kZLvV;3&!N_`AyBp7==2TF4Lc$W!dji>}Y`xqM
z>TcHe6W)W<GbA5^dVZiW&FRmX7@C*2bFFJjzR1pE%(j(bRr_StmcJK|f$jn1byenh
z@<*6~fk9Z{17k6R0E2KqfkP|%<4MQCr>#vs{_X$Y>Be8bF@Wa6K=aJt`DU9he?(nD
zrhs)aFfcHp=x0<-_F)Cze`Vad%we+o*Z+T~*Y<);@O5o;1?fRm59&oiZvO$vF@OQ8
z`;Y%y%+2yA`5ZeFC<RPrF9DzL*6OZo^5vf-#3e}XXH-pgVr7wi$?RGJp63VIEDN<6
zWCIu@sRx}p4=R5i-(vq$8wzp_NC(WVAl0bu1&wQiL}3`@U|4A&{+x+{*`56hINXm<
z|7>_3WDcWyK7#`jOg)JHtS(?Ox!s+ic!IdeW_AV!(8>~Vb_NDv_T&GG#lsDd<D*z0
z+yG>*G7I}V5WSe;`#Vrc07?~*IZu#@APjN|1cTbepgs@VpXpy17$&zoVFImToAT$q
zLjO6?>?5cT1{$|y#S$O2;h+#nZhFop{*{42m{s*Z$W~?L@6VJ?Kqlm$n&=KO<I5k2
z8ED}H(cki%1(G&Z?}PO#et-0S!upw@_V=O^Mpsb(1Qa$PccbcOR6QI1IC#O2-Ruh-
z_U;F%!7Bd?Bwx9okpUL=kbdmZJMRN7sDZ);lw%kL+1@C<0L|y~q^@cKl{vz!s)Fw?
z$iG?E3gNj5yuV=o8q{lnw1#D>de1Xkv@tNNdoZxRW_Isj=yXeFyUsM5?fU=8-@fq+
zIwvPw=3usKV-#_0*5G4EesP1TG<?QkWt|KL(CLTD3)mS%93`p_x-+_l9G0k3R$*t5
zs8UvAXHeGp!O+w&``Qo3+1Hjaa-{BV6JrG3G~UOyYTA^f&DX>jTf16c!BYNAw{;zx
z+LKwYGwo}2YkkkKz!sJ=E0Js~gt8;IgH|9lr}i;0r~5HL?!9jkz1gd5aO9t|1<PMh
zzI{JIe|NKK%RfOkUiVhF_Y?NFfL4`&&PR;=JExl2g5_^+_>9AX&Jdq??l&z|ddVON
zx|#LS3%0lGI<<O)*^YeIYwdJ>&+x!TtCRC2=pNE%m2Np+tz4O)yLBgexOGfsXZgYC
z-slFJvGoJF+eWK1@$W%bNNA`2y!Yn)h5Hv)btiMN@-?fw{D6o*{Vv`9oq2ZXcgNXR
zmoo00JNs&?gYtsk41KKcFZ@5Nyk#{*>`Aq!mwq%a=VoYhVfE^LUbui+{mA!Zw&@Ja
z>MlQ7yCsh^Z|`Q<HGM{MX#b4IAa$)O$zQ&(&Gle)-_<smo#m%nhcH{q_g+`OR%M+j
z-`+DY7(?c;H;c_;2))_7wVOfNWXU(Ed)~djaR1~zXc}RC_x{5F6R#4OEnB{MrL0PE
zt9q7=>~Cd*8b(l9V9LNuc>41Fh5JXIWeamU9DKPIo?@RdF-&e#yEG>$dD?Xb#T9ds
zle?}n%m{xhgS?^vl$JqjlpGnG8elptkH&<qJU$(w|6ET}a>G?7fzWmB;89Yj8OOn^
zA~Hik`X;ltGV(lBwqRutc`EZ(=3~dBj;DxmGtj7<=SfhR;q@Wx3FHPnmfXo)t&Cco
z$xX9Z{N4n;*j~BX+<ez|J1(v+PGPQBt0#B<d<UAV0o^<Znr)krGABXi@r>un8(bKb
zx0o<Cn{+Zho)GdMG<OWX`_GIM_pKTRFBz0gelkGH2BykIS)kGZaw{R^M#7T^9S_RX
zZaoj0s|$L-k~^8Rl~Jop4}1rr>4KJo<R%klMYmI}!mTZg?-l%K*M0@%7N^WbnM_%*
zwLQ(|UCgIigIb%WuWHG?sBGcNc&b&=Es^!T!ubi!=3QV{tF_K~plmaXp#^*wC`3P`
z<_DSA=mIlK@u*DZ#>1dd5m29gNAjvx$>Vmdpj^f@9hAo=q)tgR$8m?qjE8fcg324v
zC`nVp-m|7>WipqZ-;%!d)Qnug<IK;GGfgN=PC3ptqf+pA^Yi0OGisCHK4*d1H6d|b
zyH@+;QZa_cllxk&TAQZ9%o0u$W0>%mBeT_2+2G4RN6<RSfA16azX0WO&@Fx)uSK#!
zI<}-C^ngYVCC|!aa-M5EzbCu#JS=@RO$VhqP|5+R0G-kcx^Ir{DFdhQWHzSBVUHO>
zYp8{VIhcea9y99o1v-Py`BK(;@?$b<%P(Q}mLJL{S3o0t|CJ4nfaZii_?t4vk)O&s
zB0rT)Sbiuguz==?ekof#`K4@;@<-Vu<=^`c@$W?+g6=!Ebf4qAQ$0BWG}poozMo2*
zosmJ9{dvN!=^f6Xd(S{O&k3^{9K5<;var>C(T}!242(_U!ZX;II@v*Pn;iCnab1V9
z$(J929+TNy!0v*$>Bt{t4w0WAw}Raaa|iMap2e46pi=YwhxlipIRnrv0W4%dCt7}e
z&+N|1(CjA4!0cwq(Cn_tAT8d`IC~l!V`zV1|Lp1Q3^)7D+4(LsstdDUf0x|;oXwp5
zlfE#!x?uAB=UmM0u1w8tp-jwfrA*E4sZ5x98`W=~Z+3TOV0I5>Xm%@QV0KMqm_5Cn
zQCggx@n-+kereHGhS=Wi><kTzs*{gD|DXJ5Iry|#P<%1FyD~Prg)%a`l`=NFr!rzQ
zoz*?L{5un~dn;qJ+f+tox2=rL?n|+%baj7R^Zi?7sPFc~(8~R>p_%(lLnHU6hI+zB
zrJ3EQGBmrjGBA5=WoUL^$}oFc8`zzp{l@9+jF7O{-SL${`o>qr&D(Y`B#UuywRYWo
zWZiLsAvr;UyV=c^q1hvpf!Vo~f!RG3tbg_l4#v&T#27a}O9O>0LufyvdU6&!d$XG>
zBeO>+W3xvoBeQ!dBiJqpkXkmddTH@?u-b!e$-kd5>CQ_|*v8WA=E}tE5z5r;QOd;Z
zp2~zvPjc3Aa32^n6R~c(-BeImg7N^QJq;=wL8Tz5bOfCf{V;q}r_3QiH_*J=`w#W+
zO^>R5k#RI<`_JH*K6`3Aqx4NsdT3`b&fLi``+7UW$39_p_76Y%jWcgD7-#-uxEc;R
zO@4N(7sFEbbuG!y)R`gad%4+UaZS(+k@K$UP3_I@tPHIxN6)jmEo%*GegEPAi`uV?
zN>n{T<s_(FU6ke33OV;$(Cr#n#r<cg7kgDc&QM-3lVMTG!~KG8Abs^uGp|ZGHoJK-
zHoHbKHhWYtHoIprN`qo*1}o!iv3ADUq3w)k`=mwN8O)jgGZ?3_F&<1cP7`C44sT~L
zE=^^a+{*d^6qhIaF81g4hxRwB&u%-#u$$#N!{qJkjB0I-$LG2yKYh+%%@*c3cmLnM
zr}rkRShs~ZuH6nRw?L`2mt9$H%fGk%Gv7C=3bP&g_x{8FSFP^J5?>jZRge6Gm1Bj_
z@lsI9id|Ry^IojFKxg%ydJy!Z?ai_$et#MSj5@WtlFzYnO#W`laP<9T&LhA4+TMSt
zf86SxEc%tJS>?#D<g+YHVP8OJ+ID)WdbfJ}wLwDK{$Vm_D04D%Dr>S_DRVLhCrh(B
zC+LO*g`W(Isz7JPLe9hmosX;5x-12BGHx;_Cj&^;Uvp)JpA5+-*_l8#)NTin$v0S-
zCbzdR%zT{8%*g~Xp>{vS=0+Eg%N)V#ATpubA@tvn%>5rjBEh4_pwIw?nX($ozxN;J
ze@ymfWnfl6@~_oBS?oIlEbKs|H=wkt_Qmf_0|VQiR+m+s%4$>oST1N*Kk_Fz<^w}=
z_jCqfwj+N)x6|6cUDf(Hg!Nx-C@4iODtVL%s&_#xP|)4SkXx5Qw{aV_>UA1*y%)IO
zHJekE!I;z1QEg^&*-Qr61+6T}i8Gn}+Ae|Sg#_*|PW=h0Cn5DFtgZx!fNnwt)y0s0
zUa~728^RV)KNYmz#;EiChx;p&{aBfpkGn859}8h%K32led^`nI2B4L$jq1sXKbau6
z#ei;qelPHU8tg^~knNxz9OzC0Q0)aPxtrZt8Jpci8JXQo8JXQx!6t%A)vNs%`#~i~
zZ2#=(t_;>~&lzU3u`wh+{RS#K7??dm8Jayx8JeMGlQdF!1IiIs`#~iJXk_r9c=BsV
z83G!4nZ&wlsvcS?0`W70gx3qUFUmGYK=;~qzW-2v5j2aG?8?g4e7uE$`S=uu=3`qJ
znvX6)Df4GfZDqLI3z`KuHPyIv3xn*j7)NuC{|pDyq^Gwt&c4ykID2Y4gK@ezBdEOD
z{FRk)avR$R-~O-tH~VD{!QucEE`o<R4l%m^-41b$*9!&-kZZR5G3s0eI(L6!vJWc{
z^YJ4L&Bv}VFdzHE(0u#}JO)7PRS|XE+WE;}mvc2AV_{%ECc?mc!i0hOxC(=`7#p}`
zzSsx4?F|&Nq5ZORx3lqG0No44s6M&v+B?Qc$*k8owzGZGpWLP<m@IakFZlv1Tk|m%
zCgu|&OwA`un3#{N;3%tivu<!;R8P*>&XoLODHka8_f2VZRcn1O(EmU7XfhKg6Kk)s
z!b<Q6gi|Ig6&8jjvv4wi#2Z~ep@EQje3<oL^D!4j<`W@|%_mA2nUAM{-H#m85MMB=
zA9Q>C<Jk|eJCBJlF(bQEjExc5$BgQazd!xKJKw4;Ir}LCD1FS_uh-VO-#7HJ9Ot*K
z`?cD>Zchw-EW!D$bw8+Wwd@ZA=cyl;KHPi4_B0QaI=*e|w(3&0`0`B)lrL7VYDxBE
z<+}Ff){93E(*9)q==Bn2JMsh6`hNc*e%ey^WUf%gW|bp91l^N)zw$h0diw8g$ib}1
zU0ff`x&Jfp`YiPk^i4j&!WPs9(NlkYRj=z=8CQ@gUag=yYxcEvM(OG83|D)N%hSQB
z=w>hIl;FF)??2Sv<viM~e&k1Te>p2ezx=XQEugt&kba2B|K7(8t-nETNS2t&oP2?W
z?OB#vHe1f48mHQ17A^*5g;@-ZzM!@n=-ybis%6=Et&3_w?YPH$OMm|jISIPC=zCn-
zdjbFZfq$FLS-wv^+;SLU#?9@IPq2Kt8lt=XY)I_(t0BJN+p!?)<v=T$L1!&PR?SW3
z`oJ&D^?`pf=Ldda&JX+tQ?$AdNhwJ+NhWblZejVr=(C;sKf}re5~;#r?aY(K+nFbe
zwKHAp-~26%QCO^<@oK+unH%F|v33TKm>HvRSUUqqOpS4JSUV#~tc+1{^40#-{+s=c
zr&)C#wMK#N`rhgKGcg7-Hwn6N3ADBhbbfDAD^m_=t`am03UO`Q6PSA&I99bVd$lq&
zdrf6v_Fl@+?7fv?T_>m{)W4bR&B}2ORIYyb-<|Br${{_Si*dGi7i06W5XPJR%*S0A
zH$VT)Fk7^nf%#Yo<K5oo<0<eqT$3m$mo`oWl~6bP&rMx7rBU71eIiS8>361Nc1{LR
zZh5~Jlp8?qMRqOhHY&B&$*dok-V3bXCU|r*izvfman3&%_lF|oqMO@6_3g4JryhXn
z&$c%W0_$2fb(?jA(yRa3WH(l}urGdplvP-MwR$C=VPRR;D$LgM3$%uHe`~XP%db@}
z#?O~COcrBjN<P8H@_1tSe_^&GzaVL;{%us-z1GUB&FV*fJwB5DcQa=y<9mVgdqe*=
zALnF<0`H@VYn}S|QRSj4wN_AFyex$+6I3sQYU0ON+5drLYD4dCe=nfFZ!$Xri|0q?
z<D3kS<-ULWxE*;-z7h0h@hyMe3!I+=x=kEZ#?5A91%=TE`A?v-0@4G7)T^LcbybT|
ztFp<FKcF32$~IU2ycf`)$$Y|vvH3&@BlGbRMsQ3>bTES2vBnt^jK&!+KxH|@=I88;
zpm+e?TMk+^09uWnT=$*9ti914W@G(+NL>u7iDw?V89oPIRzp_uOlCg<TDkM#{~p_e
zpfmtV4WRf3+lkQ&0oj(E_noO({m9>q>~p(YPsccJXNA=o(l^=}rKf>v4R&yT&+P-%
z8G+zBL)JYx<2!>PE5iSdtXIM7IY4cTpckN(3F}%mb!v6J|B$~<t3BD9mCfq|=#*zr
zx-srFVPteqp1GZEGUo@T<Yy|36IZmdBy-GU0jYT0ZT{bwZKeZArCKXwpWcx_?*;l7
zgF*zf18-Hk=SgF>sSco;cvq`hTM%e{;Gg#&<Zo)VC%dvTG@G>i$=%LW2?;AuTiB`<
z6k>jDpp?x&e^saDN%5zk(M#9u?-}C%OS7>uOn(Ym7vs7O)FR&hIoX$$X;tg)wwVrU
zZH(?9vHveuwTK>k&rttoSu03ANX-7@xfZQ<kRMF<pK9;jf2tE?Yi@WVN*dB@1&zMF
zXSn|Zly*RRLF=CD-y*`!vXJeM(htyxEJoU4sQ=1r-trgZb5NRqr33kg5Wj(Z1xk6K
zb^hSA*9r00(N%h#?-}-g1gRHhKl0~Pt6!`5GX@4>Hno-SKiJ=uJld>w<d2~Hs`lij
zXDkpstSjC#%zuZeqixyy5AwHGwHre9FuEppJOhu$z;4x;;|y|*^wf67*;gSw8%STr
zw-?mffb?!cdw=$W)W`OM+ze6=;z34wVQmd~o3c}{>u(67=dxBt&@Jg7`j4z?0kz|j
zPqQ$*|6u>|RC{vqN`_VK(w*!KANT(aPoDmT0aAx(F~aI^P<s+qyCcfhpbwDUFrYhJ
z%(_9Tv%h6kXR;qFOR^s)o3b9uFGlyXk&W)jCt28p*^d0)*BaEC%=VHgx%~^%`w#qk
zgx$aXmk$5VxT;<BeDc{POw8&>e#6u~mV5bUU+3ewU;ZSsa5E??yk<ytQD+8~pr8}m
znW~(!VXKmB!;^15XDAE@tytXG`E&o@$d~&+M&8_iHS#2URUW7n2wIoL=(egwuk-zf
z|DQ!4GOHf>o9xNTAkFsmKWIg1qucur_0Td1a?9{zFIMo}45&rz8wzUAfx;FtN+#X@
z_5auK<Y&)WK;vYfy)*A0?EkW=CE1mgiP7zEs8_4xidB%?(QmJ6XLJLVwV*qQ-+$;|
zv#RBBFzY{1+ZmK<Vd45R<SaDLdwmFc0qXrWFlcoewHkG;YkALb|Kw~gR)*x`A*_CH
zKs^J^74I41pBr<kI{r1;-J;^ids3KFlp*<82(w=sXyolZ!~Tb>+SS?`UA<a={syIx
zN134YQchWmvRJ`00*^95qA)Q?+Ck(UP#yr;zOHjq%X^0Z2hX*F(z05cS1Tw7y#H{2
zZL{W)KfFhcIZYW?wKRGrr>Qa;u4vUv{-eUUnRTXvTI+j;{|8uAS50|bHuK-nNSIxI
zt&pA%Bo#GqKyGVjdjhg+Q_HqaWt%O(th(Ma+}{PdTM^aH`O8cXGHZg`@>(;KGgKKH
z7bLfGvi!A7{-eSSvvdE>+3cbWYVG@`JT98~FPW8#;b^$B!Y>9!cUam1?TWGj-zE5%
zjqBfEu<Y6Gj~TiCDJ!gEc)9;EH`gCf4-Ta3<#yx{S=Azb6<p3`gVwYeb-rh)-_UH@
z@(1KfVfG_`)mp``fl39p%=aJe&u&&d@>lYxSKIp!_a9Am6=i5tg@u70xcr2K0LcHK
z^;+Qaz4QHp`U|T-r7jyNw}R^L^_{C)KzD|Pz4;r(x?mq@Wa92*cTt8$bx4}pdHnr{
z{PtBX$<C}S5Z9$9zGwKq4CE$=Ytj;g*^m4NrN8$d>L)d;ANlRq=KA;X#qht6z_*ct
z^3$S9$nA>D+P`jJ)&3Sf?=60m3AFxs_4K1mp!Lu3?;Q@XgGOpVBQ~&-5>z{_>eTCm
z%s{agO=e{fdw;<Hq~S@>T}Pm@QmyU10fXDBcGjcIS|O^I=7U%6AMif~TJN~11Qar$
z63h-9GN82cz-Co@=1-6~D1|=Cgvfx_+QN1zf$sml^q@gPt8-lo#8lU;$*c@Q?+^4J
zOlD>k3HzhfwyF#4Zv}yJtuDr=&BwVIdLLhdx*;|F{Q>_&kE&p++=E)#vOp`{!&=`n
zd=Sv;O8mPFw3hQHBox{FK(SFjE14TKmvZDMuX}RYcfQVcWxX#ylH)({ME!8gKKBH)
zV@a5s`-4_bqbI1{3myyj*{P|>lYIRrN3%K)gI8;_iVp**{SWE~!1@5?;5GrM50K6X
z>I3ZG2`W1tA7cIU{=@&xt3a)}pI)txPqF@bui%h9dwL7w>}xHI($iZ&ZRPTE#@Sa|
z7;g4&{*uCYv|skEuKVMu&wnthw)_;nCh2gk^*sYayz1R$nV{QwnQFAU{_X|&8MHSF
zA_7|D5A!`tRcX}2y~11$2hVPORP}RjY1GTDpcd$<2cUbH+TJXC(jYJ$Jm1aEqSv{q
zbM{nm22g*wjTI6TO9Lmjwz3#?y+3e%MKV9DNYn?dHmz<@T6k~J5DTjNZ$V>$)&Kp0
z_bZvILG4PmOyn`1X7etFQ=l05rEK$?2@(s-OhIEQ@=eJctOB6+DzAHT@ppmFc4f6M
zzmg+9aD{z2m=*U%s}s~01BE|mjL5H*S<4eoh=+qieEy<Ut$wY^=U7?Zf4Dyf9OA$H
zT9c2lvb<MN2r+!ftlIMH{Rh3hv%|W;Jp*a+E@;?GM|CmW>^H88V*DGn`MEozu6r`~
zRfeT*$<5bUK&x+NUlVaiZh8)C7yjy0QRIAl?8~=BRgbcxK<P|nRm)>()^|+RjN7?b
zK|YF_sw{Gq1+4DSmoE?ZPZnoo62AJJF>31U>mm-yqF-4+s-W_pQul*yn!UL7Yl!P!
zN9d^#GER_{S;+_4IV4h<m01~>?OGXI-J2~~nV2nD8I7kuXV^R~ouO8I^Yr74#^RuR
zT23$+YHVh^;P6*`^EWZZ&C}T#L3bII_D??k{r^w!`oB2`B~qC!S{Zo~MKW!>g-a_K
zoLG(6=XQGbUt;~+<=g*=ZSqui#>v-RnM3<y!8#-k!Ago`CRR0>T4DAF_J75bbH1xc
zR8CA!uK2Ff?9R%v@_4hmC`;>Mi`2R9$?u*knPl3!Cudz(GRduVPfok8WKo#>__<QE
zJ1cwZVT;<i?#XYSD}*H4x+iB`R|rY1bx%&Yt`L!#{P4K~q;6)A;Ae1PY;>0>lsU|q
zCd|h6fzkbMC`gRif|Y4@csN5B`)0Ni4BMvn9F}HhXOgJ}^@<uNJ^p|FPpeyR>b8!F
ztW(c})XNk~w}1ODEXK|x9R7@PBKxlCjBXRaYezvQZD!xWuxq;V0&&Jxkl&`WF)>bl
z{Pp>t$?U9L!hEb^jUKhZ!u%iX6&Gw|PiFYXF~d3a{uSr1w<b?zV*;7kIFWHua`83>
zy*8fO$M28+nc)67=lq}K@6Q;_+NK=7ad=moQM*-Ja`9sZsWxe5HU_h{<j-P^Zf&zU
zK<g777(s3Ttt6e`K6xG+(_~f;hRN67F|L~?oW|xb;m{RlR`th!pZ(d${#fMS51GnF
zw}qz#^CqSW@-1W)%y0Dr`A?#7_Vh6Dy|q=-8Qtur3xNG5QCKt`#s=A84E5)AkUuMh
zA^uGK{)gF}m1R}C?Qv#zQ5MJN%*WZ;MW6SSx4Qjfb878nV@(6C7kS@szP;JJ<sau$
zyVmyy)@_B18iLwUoN1k@!feO(Om1!6Bi!1~?lkStRLEU|DgVGaKg3@K>0~x$`PXdG
z@|XEII}79c$F;)0XVf=IOuoUv^jKW{cdhVa5$0daJJ^{bw}VC>A*Q<RncT{{2V|l!
zYby(?ssGQSn;Lo@q`z@HEcbx-tiE2(0?BvR8K+-oVwl{%ymZy{Damusfy=z@$N9HS
zpOMUZy4jtbq4&5<`P{>x^$^WlkMagM3$wE`t(!K*33NZ*Cbr~P-xwU(=l02@|NRZi
z4HC(%?z^VVf#;6T;Rj4tBJJC3bunD<K0*E&NPO<$gU!-y><o~72CnNMHT=;xk0(t3
z_kKg%Pmr3Q|3M?ti&7X}L9?8obrA;-g6<2}JrBwekkMtxxbLP;z0UU!{(S)Z@z-+j
zs2!+nyC@SfR;<?g{(;<kRG+h_f%f13ybW4c!fdY20GbDH-lq1S(baCcvVl6|w&}_n
z%o#!LScplW*agJ}sC58p87P~u{F%O;iJ^J>^8nCF806i1li6DSAkKyYovH;o8>;2c
z+{csI71)a>u$vYK2$)W0XMnITfZ04?@dQCrP}>01`+>Nq?Hg$K=AP)Ar-Zk&b2y#`
z-Bdm~{5qrfbtcgMrby7fv9;&7O`nsz^)zTbmhEv^jQ8ZTy6>8rT)Umgs#Q25oq>%*
zn1h2SxoA7f<nr&#jc&$bUl~~0TiGx63AeHTNiN>bQ2VV|fWx$SgP7^#jO~9Wvommj
z-BciG`u@ZI51@F4%w&O86$qIA1mDOEvoH3bK<;FAh8kgZu|LUgpK~y4xH3#;b6`$>
z&c-R>y1SjtG5OJRju=;K_7@B@=Ow@S#>V4msGj`dDckP0?F@g-CUbmXPJVcU&A3dA
zF<DlORit#|saChm)4wtN72iC4JHzH_&lp-$H&10{1eM;PQXQ0!h1pq|{`UP96=r1>
zl1VrI_LX7cX~B0g$&T!s-G4BA?QeYjSQN4n0^)X%FCh2$f>IHv|K#_CK>{@1wEwf~
z(`I*0hO>tux#9V}Rh<jZL)gpjZau8_W-<#WlQ1WzP)`b|JOGsjjVC)24zj#2xPMIZ
z?c=E`|3U3aVb-H3-*1Tf0%5bBe!s!)_M;R~N^;8dYlYkut?2sx!M)2Mvz0e5zY+L%
zGN;4ApZh_gb(g@RTb5sQ{0S0$xE-W(RVOGF!gPO)^o7rz+8$)KU}gRrE*ufTz^IYT
z^@C~lj8X<jSz^t0z=2hR(Va6{rf{~HIzyA#tm%!Dj!oY-9aK(EILxa4Smeb&nZnsq
zk209ED}Y-%yQZ%L%gVaXIE=cw0~B7M{02>zXF)e%Hm9?*n@yKUo;*#Rp^JUjG=ci&
zsckH~rZ-Pt&cfQ2e3O+S`6fFPqI|RhpP&O?QDpMu-}?{uKZ8~kFq^S}cAot$yjdE0
zb3bT(!TS&PpE9qOhCYOsU(kFCz9Sx#BX&*iNCvgmVW|%)e*_}ele{4@@enAFFsrAh
z&#Cl0KDAkR20Ihz<OD8`*?sH`jDCU~f8#qd%=r}<gvI&5>jTzJXP&&ACAs4tr?hA>
z1E`I|=su?qQjZ>+zG^yb-_>TeXAE-=39>&HdhySgosDr$p|tQ}1}0(QU}mOY(}mgG
z8D>Fup~)Num9x#u)#F+99_Rl1F{iTkIIH`V!r9{L;2H{MqB6rb23GYsl@PmF*+8{6
zD5ZjYXw>eC77E9=LVVegtdscjB*d5OkusHm$EP+=p25xpsz<swr2E+!8vQ16{0-tv
z-VXBRbciokO=q6BoF$n#o=aMyjsbF-1f#o5A*l9doHT3t=C-E{ho(<)+5}DqQw|HV
zKc4jBpK-e=qfDW++&Km&IpH`yrhn5Xv$`{U0`Ez4V4MN<=kkD7y~l4rH8ZPw>u~|N
zKU-NhO>aK-6}&%W%3)S@8K_S|{*<Zh>~1_QQwU0dh2p!Wv%1eX4D-8Qd*SwE7FH2Z
z+5?sNp!6sHl8Hf>vvX;)IVZ!amgG)$fjKo3yB8i8zsAJCtk&kyQ<2QcCNNo?jY;@w
zD1-2|=ZsveYSR>1m$f&#F;8F4GLb#mnVn(Pw8yiK|Jybd(ymvX@_qyVs}&D2PtK{B
z=*H;Ydw4>@<mqfojgujv0BRvksF=*I&M;ApmHlziw|{eLItn_wZ$9oR0hI-B+05Al
z7~U7ew`uihz7@a0#K5fa!akXYg9&sK^W?S`7Le<N*_Qod1fSQ@Je7^1(LMP*D^v30
z7Ys5<v!=H^W>ufarpWeKnEn5Bb_RyY?dd1yyijXZwmI_m{f4^r%yuo{m8hU{pr{p8
z8#PZ=V|aX#_0PlY+u0QuK8mjbhg>VT6p`x#-4Oj)g!P>;pToh2+Z){^_m{>MwIWu3
ziEjn<fK_)xdcaGY-y19thlM(*2M_AM2Ymqb;1PY`qm2(;jk?}%;J+DpbTYduquL+4
zC#zZ}v$HbVJplEA8a)_2Kr_^8?Vz=L?-eFUu)YQLc4nTQk~||}PKscf+4LC?ruHYl
zKF%`XiCXLX2@N)@+C|?!DgljQKxPmi{dLf;!DX%DSD6@uSyQXtZ}7hg>Q94IL3;H}
zRS0zt!8=uJ_dhE68lDO-7eVELF#GaZpwen`+p?L^eTFmMD+B~eK83{k(dq9eEbxQ*
zdh)k#%#FuDtK=ZN&HTPJaI`(y1nQ~%7C#0W|2UShsuMK&_x?fs@=(xR)^Bh>`B!ql
z2d<zGj#;3YnXoreFIKe(b8&rO^xV$%pTTy)`w#PGOS6kI+-mh}oqmjgVRGBC6o`3l
zsqY&$ID<wmST!fIBuD&Ynd9Ksir$9~2lt^je|KlR*?YJ5{e$|WTHUwW#gBqUY*Z5-
z2XaGC#X;OQ3JDufNI~Y0K;hQt4jT(WjQse$@%pf-h0$$YC-Y7ghW8KrZ-K(SBjNpr
zx(T51AFVdf*ucGR#;0>qloyyYf?6h!Q47eZ+T`zT%$?6Ce=lQ5p2;re<1XW#{C&F^
zs6QR_qd~x^3pB6e_owa6wibwgkA+QUJM#Ndt5xT!&i4=OC$DNx=4KUYRy*=r(LH(E
zGa=Ag29OGf>a>tct$wY|tJoQsSGzO3e_%f$nTb^ZG?qHiJz4fUpA7OW#8t>FL~fsF
zKWH==HU|;gFAZ9A%YK15`N?q}>9B4_X^C#e+2Y*{Z~KiiPB2Jc?P4^}_`x7Ot&3sy
z^e#r}=x&DGKI7`!3@7_%-|7O*-Tk`7V4RV`$Rx4(c{n4e{_tyU62H{i=mv3Ro0qc5
zlV6)Ne}Ka85wm&AugPD&urnS7tvb2eBRq|T2{d!WIO%U_GV6DSR@co_pE59~cQQ1a
zaWeR|P8JtuXx`Q)zH53P`@U)K6YQrpt9LRmy0)q-t3XzXfW{9%^HQJ@1l7c*2GFXG
z($KfyegWua>ZS%zx}A9l)IJ84lAsb2oM!()-Dj(8^W+bB#m58wKb$8)^90RmNB+q;
zcQ$REFLM~wx`4EjJ<mFx1DOCC_YHagGG|@q^sV6ej(Dw3qptT4^uH#1v$Cveg_xXX
z?bZ7JLHxmFN069Ts~Tuk?#)##$sVjs5EaL)z@t<T>UXYc2d#?nYMuF*X%_E8u;_*V
zH&?Yhj$!=+Ya4;a;vp^pxd~LxfkZ$h9jM(sdAk^c^!2ZdH~W*Pvx|Vvt^kdbfkw%a
z8CivrJ{a{t>})fR`Vsd<uX|hf`v?CwCd;r2OlCXs6C&qkd<!&k{h<GK=FzY}&00r(
z&c0>Eklew=ckW3a*TGEC2|;OZR<*2}HMx`XgE`lKhRy}=AIx97sy(Satqr92?&CWS
z3t7M`C8o7AO3!F#0Ie}IuJC~7QFBJndWE}vO|w_ED?Uu_oy9W8!3!ftyTesOa&&yh
zsvcOVwrP5`K5Kt`mFEX&EbCdyvP`zDM^%vVtVcO+nUK>jVB(K*K&l$uA@b<55Yb0D
zU&BGFV6u;@K5mD|d<}oP{cE^gYg0pEq0&dSx3_*UNV0u>_heOzUN@xdU8*#hwLwbR
z;>efx3-<p^=41`?dO4Z3K~k#|DzET<f&C9<o0Ve8e5@vqKCt>s7WZK~=n9cNDtGM<
zX!WGBfy&SK3-*6q)s@V^D!}M=t5vPl@9Fyo{*yuDQ4B1?tS5!uf6zO>n3Yp(GW(Hl
z${V;Cl(%p(>}ylDh!h8@hQ!}7NoAWaU*13HKi{l=<QsT&>{~JmD__vVRh^7p$#EZe
z?tM9!{p!W!Ztf4}y#E;{E_g5SKy_97yH>T<<az9N?*$&niXLQEZTa^80bk$j@KlFB
zc477p?ANAm7F)xRoVuI=y7F87$TwE4iJZxizigV9gJ!zX%jD(Y7zB-LmNSCNWc@d*
zdWG3qzNxjoYkho;_Xk(jvTC>7YtS0ZmGAum`<JUSB^ONQbvW2;+9?hVAD;IM_CJ4C
z#a43)s&Xm!`vvo#d1bCD;3|2Q;#Qs4x-8c>v8jP8YdRaK=5Sjn%*OHq6e90G$e&-;
z8~JzoN+yQpohxmdw{tQ~e7<o(^Y%{0hnyP^H*e=;ocz6=`RVUw^_CyaYDaz~x`FzR
zjFW{$#Tl%oN_U7eoNMJ{P5ymdui3m)Tv>(X=R;1rsqa7N9RZp3@bmQLObpG(ms>TP
zwS27&S7!Vv1&M_;CXoHgDo?(>fAD^rAm|K$Z@uoxC!Xsxo3nhK<DA@*uHCHO@(rX<
zS>dMyL>C(aNZ0!Z=Qk(wunIA&ANe-dJ^A``p$JD2@ERoP(00bz;_ZymV(knEQ&09w
zgH{ceu`z;H4PNY*p4!G>T(+HI_Kh}1>FI5Z7yD;l1BtLQf>tZN?F;O05)bWfoXjMC
zvmb1)3C!NMpAdWf*CaEu%0cbD_gscH_O^N|Tfl67_6cOOvWm&~_Yd-yXu`tj;&T>k
zH5a7bLY_TO{`ON0q}y@@DAoMj4QlhxDd*kZ3<>47bm`{ImT$0ni0$pIR%IJYNwwDZ
z7w-QwHeJA=%&=1G7NVYd1Cp`-0g_qFuu=+AvM*%?jg73IzN+`J7wZ+!nP>ODC|j_6
zQ?_CG_Wr{AKdU+?bAMpx^-1<%<p8B`@LCdv4F$R{!MW(dzMHGsL1M`df3v-35Xe~7
z4hnrpj6Zt@l395C{e%7~tJ)mXL9@M}6|8ElQ%`~NZ*uq_ra4ZqoOQK#_B7BMS5WPJ
zwfAQ~C|8}|wyHPTi<K>zYc&tZtoIkze_Pf0IEMAxWLB2%UajvF?ANa9)qLrdxhnHn
z)v{`~nui-fp)<p|(fzSx`g3rIRWIEN$&LGZTX#ZOp*z3EPTlxf-Qi=Sy0XfbZ!>pK
zp2^MxVokou$yB>_S@q0~u$8#dpt)+$ob|MJhLgRJS!#qEL7|twW>x2757rBy(0k8t
zA^b5D>xFZmnT>Ct`JNB4S9gNlQ4g{MWIo8Am0O|VcT_q&)q#(FGCRw6P|wF$d^yA8
z*Q-BF0q;OD+zyKQtNTDLs%1|=Yf>8oU}vknPv~#b>Vm|g>q}7F#{W)sW90z5;)4G}
zWwj;0R<(j=&xF}ret}#P5W1>et+n-Wv+9vw?->GoSG7apDea6}Yv*yWXoEvOhz6O)
z{{Ujb<3QFw&FWl&Q{O}EYP|=No&N>2ZVOgt9oq#8hxG@N-B=mG_BSZxLE0@&RiHM@
zsRv<SggH+MO=e~JEzEV~m-x5;|ApC}g{!sxjZ(Hy`K_!L@>|))<@fs!@4tiWPd>rQ
zG5y>B|C8I66@k|KsI`Jt0KNb4{y(#N%P-y2&Cs=-%|}ZZn2)6}fL36FR?c7TKie-Y
z*2W+$9?lTkXE|>fXysEwgH^H*D+|bOh`nh6YOP=!K{kVJ?f(F_^(-p`#MWc>jBcRS
z7w><tWiF~x+z#>i({pOAApZLc`=2}xX8mBfAH-AKUwIZZCI~tiq=5mV()EH?=lctw
zQ#zBKSvmfOd$oeryC^Gt`Sbq5`s1rwK5IIB1hu3ZH5pex+Cus#SG9n49163w`~izF
z6j;@MY*ugi^LT>!e~5^IQQ=MS%-tVIygl3C1<LF9z$NgXUiaif&zZbh#o0hTm9*x`
ztS*1ve|Y~0v?3SOZilS#CN5Qj%$5JIthD5hE6NDp^lMBE&CAl(O+5x4)!6R74m55)
zIqW#&zG;dJ4zh!H9y!By9(AOHMlV3UE6B(jsBH;3CGWE)gNfroh%eff{tX57>{qqC
zf6zZit25bwl?|S*mVnNYT)=v&6{7aoQZS$8RI3_PWZAO!4GWn4T6<mJ7u>(bc@orW
zgp4*p#@WCsw}C>Wt^R!j1LM){AQiQtppna$`;&QDO(1#e)C17kGl(r|bN+^cT(f?%
zR%fy&tC8Oy(Aw%%t>@aH^0U=igMPffV1GREtoim;t3dNs!tC2ufyQpkrf=T<oT<0D
zQ5`gMcl11H-VU^~O{)tubJyq%T1ROJT1WlMkSqDtZ;oa)E(T_GFNS9IE(YoQZH%+y
z+8L$iwKGajZDW+4+{Q3lw4HIbL_32tXkF!ub_V0rr;NtM$&8zyUS-_;BZJX6?HHqR
zMFu0NHU!m}ppwZrHI)Ih3UTvOQAXqPa7NHde9#)q(B7N9v3>6s-22|DZF?8gpIB4{
zTI~kOsce~`oC*<v`Se&HDE!`En7>1-tMnjtzd~9vstvu(pw`9Y(Bq6CpM%Dvl=Z%M
zy<gye4U|@t_bl&9=3tcrg;jFw2M(<^$J9%$!mO+x8a+TOkmoqIYHVZ$)dirH$f5n9
zx?uA+HgGE|wErb|{W0_M*8j}PM}9f7%?^XK6|VNr7Hek!sRQ}_YJX<`P4G%;Wt(sR
znwK5@-y{xdE6l#v#wb0njlnqmI-_wNA2_Ux(~mR0><jG&t+Kw^4^sd5e8#tPZ6N<b
zVwtV+{RR1z$qcMQ=GV`h0l8b4{rVY198ZMCadP|zKF7>eEyA3f9~iy1bN*+5#P3Cx
z<e*=CHyrM`G_PP`U|!L}APtIJ(RM~@;dTa)Pr>u#pp|o}M;VQajlugQuJ#(2nK4fB
zfW@P6xjLit{SHRs&+3e`<2o24d!^@fFi21DV7%BnTfBo&TC9V?IQ==Jah)CG=I7TL
zLAqz(=wOhJ=wR6VG?fA5Pf$9NzSqXM`G*GM#eU-o4e+iFP`hdKb9QJ7GG=5FZ4w2g
zA|~-Bad3+HrpCxPv2kK#@7><ezV{2{Zm?>xUInEUP|5-INI~fZna}775)o!qI9R(G
z)MEpw1D*Ejx;dGbRRXkkCs~q10(83EvM->WR=Zk+cZe|vn~O1kcKIaBu?r;kunXLJ
zVAegE?Z}UFZ_>Wxy;;?{ulN0h`4d+4WS%_rfm!p&58=v_|Fvc&7paO~df}LL?Mc#)
ztPjFmTpvJVEsj157rei)zgM`;hr#izgd?au3EGtcN+oB(D|12V#JJp@@oN9gesFq?
zdCs_LPICGmj^vb??8(6sxc-_X|JPw<UctlQ*D4*}!8lvAgK@Ta2LmVv-RuR0>)l>Z
ze{b_sR>t=i_OH?E1)q%dBdX1>^;P@hK;9pq-Ck^!u=C-ZY8KTn)jrByRsuOGj;#`O
zZk$sMQ!Pl{WOjvv&obGv7u6uEK-UXW`86D7f@6mAg0+mwi~cf9ZtG<b=HU3So#Q{l
z+~YD%f@~AnK=}vSW?}H`-~3e+oQHh-H-BemyxFh3?%Th|bI$x}bYHojt#a>vNbj$-
zQ0XDtQ_$*h;}=I6q$7SXCJS+Bo%^z?GntoF1G1uAuT$CP$v3mEP2KM=#LocNR%)P?
z1&<!QFKA%Z>PZe?paEKackRvlf(P8Ix|01^)j+EpT7HOw%U?D>zt;B`-hT$oneS$g
zVcgwb&djXd@`JNE`O|YX(A@P`24#yY-;#N_B!oqE7#uThy-53$^&{_#*;J4p89hP1
zoZ&Q)jY$#~ub{rd*?!P`5hz|S_8XUj{0LgjZ~Ri7@$sx>e-7qM?&0~co%cTj$ZhWv
zK2&M-CWkK&0`m$I7`3{S9ax1x=?&saH5ahVh5VPfC&6pg!#?l{OXxCe=3r%9)yn8L
z#c?7lli2L(ZH%BC1<F~QpC4y5F5V0-RW?6QXW0C08Y5&sM{M8YnWBGdZ6}NKG6~;(
z&bXO<DdXf;cLrfr4+gub>pB=cnwN1fFiA}0AkIAF7wn9Wr?2>v%+JjyEUwM)YN{Z+
z-t<QIiL6r`g{QJJO=Ja|bGeOi_KY?Luv>oYfVxYZ5#g?r{f}on{ga%0lIPU)<brQJ
z#%w1Yj5*mDl?}8QA-?zjwW@{Ll8fPS80#CiY|z^KMYW(El{-%-H*;}-R@HOyba8EN
zYiD%K*ft9kJB{v;*a7XPnaBo;A8>z8w4LE3I1Pg0=PXkET<m{5D-3iq$9I{>Zk5X_
z*{YspEz4%hX><Xt?N@7kRsven4`M@Pmu17m8r^4ZZ*;%8eOcw#kc<1pw}M7NT{Yha
z^f$m<I&=TCESN5~oXIQ=2TQj@_z*k3h7^L&gKqnB?n#5hWOFeFVGB_PP+6EfiCrM<
z59qwIbzRBx+4(?cpho@J)?(Fd)G5r~@_RBH%Wp=vOAkORLjRvx)tL!8>FxK&!=N)C
zW6w`!JMv4};3oqlC9x@icGD@_T>0_-LjMs^{n2dJ@-sQ&1C!`cNdM0<efE@gMo?ar
z2K6m^KxKX|c#q%3o}c}9dzwTVCn%fDWB{21G4q)0`wQpygUm{f{=me0QUW>x3JY&g
zet`6xA^pgU{iU!P(c&kA<N{@jOh(X}D9DHsXiUhjby+58Z5TpyGH1iVyW1aCf#{$6
zL7_7nwCnP@IOE0lo@YVhZVeKb9)$e?jj|<uNPE-vWm~sV7kG>foX^`tR`po*=ykup
zpucrhmm(+^{Y(!1z_RSkxhIV-jh=!l-aqIAwV8gdoYSh(s+oNC3)AM-Sqwp~?;r3j
zT-9#eI*Z}wf4{b*_Iqu&TGLwJe~8}(8tu|t03tyr!hzfk@d4-r>_<5u_k-#iQ2P?J
z4+*p$77|`=@84fIzee_;+M87^kd(5N`~8D;i?rGx?ewEupnl7_xsp#IW00(_pwUK%
z%2v+z5BL_qR4(NJsnnajsDP>DQ3~j6e~?PhJW1OVwLc9Ul}Be^`^xz6nb!}{__a|d
z#QtNfpgkJk{hb&5m#k{>JqQ}>zjz*E!&8>`58lm$*}%#IvVm{vsut6?ATtoLp7!hg
zh5QA!V7<KV$@Sk^1l^OHpEFoZO=jREax4L~n-DTT0GbO>YkgD#+D!stLquUB5Z>32
zm-`WZ%LM!F<0DkRvHd{!t$*68mdLXpza517P4)Zx2YNj)zqx{X!Vmn~SGB03`AzNX
z`wQzQ=^g})>i4=Q|9#Gq%*4q;Lb^8i$pCRP$S*KofY=aGm<WUi@|W$|t!F_g1=QyN
zjdAOBPG1Td<7WN3s^$F!{`O=~&}cR&4XL$4VlnN_`wRIUpxqD2!5>&O55imrF5$!>
zBUadR9iuC#Jb<Jbr%X_a0i{z=3+d~2!$PH>ULPA6+5W116+a1@(R_ImG^43(v*e4i
z$(Aq521mXmPhwYE)uQP7{(#&?(0pDp2dhqU6N?_i#ZN)K{saGiuWC(pWK~gX4SV|j
z!1;%(x{{q)btbd7e0%i6?`_b_sE7CdJp1zM!@D=i7GJ*9`Y>Czd}TIc`FagB68=H{
zO0qnw1cYsWCYh5}qFDtriuwM4+#c|1n#apkK&O)1?S`+O*$!Gaq;9loI`dw3hGb@5
zrRm2(t6<pAO=dgt4H9C<Zh=g+oBRI2|1YarIFB-G9{HB+p}@~<+VT~l>e<a}t?v)q
z|D@HK%mD5gd`ph`AoKphz89cX7{crdtXf@@zklaVp730**<F%Bm_30N%%AaGhS^<{
zVKTb`b29IDhGut5hS}}U|4jaVoxk(AF#Ga9$>Qu%6Mcl)KCmV~^I<Gq(aMv|GmCpO
z+e}90<7^C%C6E6T=KjDsnUm#v@&_MokXS2EGIu&-@=qU5n5tHu$CBy)lRx-yGP+By
zNM>v2XJt2Td&$tsvzY(dzvK@-{2-Oh$JiLowLG4f_J1>5JA-lu+qcmBlUZ24-&`O*
zi-|#)OY6(@nM@3mJ6G~Cn}Jq+g2qnr`$Z2jt8+21y3G#%?l}AUa>kwWXJ1cu=wp91
zeM+*i_%jC3=_8I@kEeV71%((Wl=P3U>Utc^`s7unSJtX5uIy*kZZ*ql*lM5UHk-73
z0mYEqLU4RNSq>`G4%jU~i!X7|YNwOOrypZtXx`?wnc0lx3+N^miKIEnH~VECy(;i3
zSyjSSshQZ+0CK<5bY%|qZ`0>8F--1#`+WLrCWgt~*-VNH4)Q+kt9{$NwHLIr>4My`
z)St}Dco|yVXNP?QpGdQD9^^EdSJQfujHexE@a>!M=;L-wSA+6EA^0wcNG!6Yp{@H@
zWyx-L6f8`K+z2Mj&aMF3$FRQzG@bw&R{+UvfA*CXAwRi|P2l~9`AsM)zWriCQNi*4
zLwy6X3WO}k{Pp1TPC(|z78a&2dH|Zy_4@*u2Zy*ps|&KXj{nc97QvH{k_NQ$9#+y!
zW;^l+k_(=#IoBH0s%&%R*ZTwYpccTNX0w*x$&nv;DvwGyI;NSk{$~K!+!5`Jvqjs%
zEf7#U>18iyb?4dsLRj5x18Y+pTY)e!9@Gwim>BwjBk~|gCK~)?0+|GHXWEkY2kLi$
zb_OKJeqfR%rBz|_lj-l?M)#fjl}$LAuI_DhkA<&P0iECT{=@p0u&_=%C|h{yfn(;P
z7odIhK|esFBA_vsMsG;pS<o9a-?rBCUaR;r(0C178YorQ|6bLd?8wRiYFk0Ylkc^H
zWa8IX-UPLT9#{PSBYa)mL0Rp|ug>Pjfe-%tHJ^P|oS~0(BkQWEli6GuBo{nxyZUR6
z(?WRP2-M#41n<uTwYdWOH-A@WyxISFuK8b9S5S`@)Vl@sUO}THpgt|5>)Y+1`BhMB
zNZ4GI;bwpGY<4|RTL>}-32HIwbtcbd*8#P1E<F(DI`VT<r!oT@!=*NetCxkZYI%P^
zen~P5t5&o6k)MK~dR!yy&*WR`4$68VKRcU~BLi5a+rIyo4ijVGV>4uP%+Q(!YFS%N
z1)Zj_)<beZGRHC|8AnA{P!A8bgUYvm^S3nc=@6mN9^T`*;(tLmME(TX4Q`R8wSz`A
z-XE}^)9B86l3D%8&*abtOt4xEoB~5})ndwvkj!a;n6rO+G9RlL$QQ{`AH;|>X9<!y
zjSzF}CzIixWngo_DI~29V$S})hot*!1(G?{5OeIil3Bp3?|&u-d=N<b0BNN|_Qu0n
z>BzG*U;6|5W5FXxle;*Xl=r-3xYjP*&MBn4ft^8l3p>L>_Q%rS|1o;m`UJHJv$y=3
z%*OHyY|{t*PF5|!x6S4(zh<5Wtr%cDt-RqEgYuSF3<tR$OLhHi-rmV{^Ejxz3u@;w
z)iAn(+PrSymb&!yUyRo5;f#O7rNhM?CSPM`N`Cr`Mfe&!BWP@DVRLfgHMYrO?99mz
zud~f{U&K}$CfJmma*g4m`6Ra5FitT0r+F7!@?kcHzviuOo2Pwac>M9%vsU$udndDh
zU~W~Pxc5;N#O~72#O<IKx99dpRZKNs!R)4n<Zss*{<^#F-|HT_{jPf@xG&Wpaq0!A
zM*!*%EPG?ry{#LX?$ba$1Fg<=J?{_be*ulAfzr*T2fSX%mA?eeJqi0G;|LlvJD3F@
z5rgg?HwTYffJRM0v#g-K44}I}_D@~a0@~ZQsx=C{HbwsUsusbskU4Tl7=dQCALYPq
z!ij2qe?kA+s+P*X&F<U`k9*4hg52{ATE-lU1(~`2RU~LF&(GwNUmW1|JU<>seE600
zL92_=r&*ng0dxKy;x?GO-XDnXS=D;44dkNa!>mm2KghqAW|v{G>JbIC*?$UhJ@)<n
z3*ttmnpG_e_ruuhS~hNnu{*c3Wr6ytx=>jV+jhHRq0;XLX0`8=Sy-NXefE3*>>JyE
z(4M?aJ!-AOYz#t;uI~%>Jrg#UWSG2NhT&$v^!1;h6%sSpjfB}-o=s+BdB*5=4%E_n
z@c*H*$&x3@(yX9cYM&*yvl}p*w>(Q`W;amY@P|ox%NwT2Y)76#V$IDLtmgnfsDyo*
z9QlFB(gHN{qP*u1l1XYD5R>w+sDk<jPX*nRE55T$z5y!rM4p05Jpo*$9^ZckU1!{-
z-Z60cK$Lpve?X<)AC}qIe=veh&Yyi<+(CKAAEs6}wKlLDKJ35B`?fjN<vDX&%k$>6
zBhQ=DSzZXU3kWDrc*CN+We<z;jx#LE8}6{hx+m9umt!_(dAU$rdCwmf<t=a6)Y=*$
z;rJo`Vlo%2*rQ*Q+j+Qz+j+!bxgB&v-b41slHdO!g`*YN<^%mlw0e^HS;fMhH)|bv
zy4F4UTe$e-TUrjuK>_0L-W|-1dVKHSt51`Ac|SCIGx~z&2y7Q@ZZBc%V!t=#+4L?J
z<pu0q%8S^!o=s_VS6=dki&vM?{a%|PPjYB1Z{_1{-OcJg43nowGZ?p*!1mUH_hg^#
zGcHR5httKr&EK~(a<O0SPn)i+@SUq!y@vthPGuE#E@;`t2s-=2vv2d)RIm<Tu#SuU
z%1Yn4AgSV+7Q{E}x0_yURzLET*Zpzb_b=eOSMSM_#}N;{h&VE<@h~*H3$iA69%E=#
zf6Vv&lZc}r>*LwS{@t6>#qw;5aJ%$>h!2F##TjO|Ni!JoJob<Myems8`&)Hbjacos
zTxQdjC%+1!N_Le<RsPD{R%4mi)PNputnSJkZ`hRg>|s;haE3#9#~qGXP|9Kf#oD7^
z3&oYU{NYgE^M+&P-d$N?HMQG8euem=O$p))|J7POk0n^2h1EFj2i-cLZ1Uwv<aSVe
ze+>t**X{?I0l6Ko?TOcq29C*QpwVhkhMRpypMiS&XCJBk5oT}sv#Dh=8_OR?H&8oq
zRi|Fp`v>-`wK{D<<@=wd=Rvp6>YkqSVa6BGYBo^M9^wu*>Guct7lZoD$$=k8=<&|^
z@d$kX-LeF>6t7mNN?1Q0A_^0M@Ps)V4n72z&q*IZH~q-^2tMNVk-q$uF<G2hEt!>7
zEt#2JExD0hZP^=^gyen}6_%9b9u}2TFU~yy-IW&iCG1by8@H}Qo%_12y7f9&wFDkI
zc_^8IgCn_*gRRjG;*+$m?+@fp(>*$wtL5ip9+sbB?a!dCo@2b=`tHH~+nk^qQ-3DU
zWS3L6Vfg_%TdmQZ(Ouc#HG}eo-wX&HYTOVV`)?#mv&uA^xBN_QXO{upSfae)C4;iT
zFNWR)$o4S0LDb7nNfu_60;}(5mtZ!7xI)?BG}wGrsH*)FlUZ4XU@k~*<75Ec*sZ+b
zCqptD7XwH)$Of5&XKkliL1%Evq(FRlY_}Si|Ng-H_QIph>MWpLl11NnI@^^szWiWy
zPmcM{bucsQ1!&cnRxhLX-)KfpP;0hXotHtawOPj(G2a8N-5@K#ZuV~eZVp;MbU=T_
zD$p9GbF57759BYJJ-vr<_O%{H>FGV-y?E}7v+wjUtZKd4zxj_1V_2J7>*hDp8IzB*
zGQ5BA|GMPEWac^S%<3#ZSv3`TXNP|W_b0_29y|X0k(^x3KDk|*Vdr_71XgWp?rKNn
z1?7w~Das4d8J%(&T|wi1kQxY5Z-VMjrW(+Q8Yna#&u4!F3$2rTo7G!>+O;P?_{}t%
zo1MX~J^6V$qck@=L*#a++}Qn5?I8Br{c-IO*~g#L|9{;MiaE`_rJ<?YpQV(B`hr^!
zh1)@MKy82G{xC3tTF%My*~QMiS=9+DS3xc8$rj=ao1cp_CeLRVN$zD6IrZVvi>wc3
zT~@u|QP`i8*;sxux-I*%4m4x@WmPw5jUUJ!kc*eKDjPu3$z-;cACTC4Hs7!H{f78A
zkkdk2e(<^{mwxB#Y)|{5tOAa`$nSjDo*c}&^<Y&CsJ+4H)#w8%gF$O?nOC}C#2wnX
zHV5*1K=UBr9hL{yw}Do)9r*#>VfjFQ-)!+t#@S(=jMCzr;J8d@l#c8K?W?SeWCYDp
zfcNYFc)vkzDQG3yWcHc=jZK#`Ox`Ze02*a{*}uDIIwNSFgjH)H3sT%V{rU#FeMnhh
zE+gn3dC-gzXr2i)Qxw<ws2X(I;AHNGgCIUko~afl)9CYX`?Jii(I@wV$dA;FkK07V
zM;kakF4HJJHq?KH$H#{KZ_(moDbexK1Bs8D0}vme^X_1GDXwez8>-d${=oSz&}nU}
zS{dEFT9>sky1jpJ{s`mCnMWXd<d`x+d*ncE^`rYiD;hv6spH<Xy*c%uL10t&sxH0m
z_Yds*k{Q9PVSkBFV_*<wOUt>{8rJ%L!~R`bovBAbD`5Qo1pP>Q0csQ9+XU)cgU(|}
zK4Q)bx(86Wr<);}k&A8FlV%exhK>ZzrxO=+WE^CXJqtRQ;r)TQ6S+T|-MJW7J_oJ%
zS8D^A-85aRGufAwWmyWSH|>-I>RUrr7<jcp)*CQe@h~XzJQnBr1+s5h%I;QkM`g7w
zzx-yd-QSZSz7#aO^K{jFgY}P4O?@2B`s-FJqZ`Qm@83;H&}#E)hm7gBYD09fu6}Re
ze;;OZ<aUS)KsDl8@M#oYAN<}x&Z1b?xvA@KD5INJ=lc!*4WP5*)V>6P*YGzSgsfVA
z|Ka~D*jX2L?a6KKjLFB?nUd#mF}+`4|94f(<5<=|i%Oibl4o!+F}g!m+dRr#lm$6Y
z2E+%+g3bYeiGlbx_Y1Q(96Sl%vB2o|{=@ulu<;Vuz9v?;_aE%P!bCx%@}My((1;Xh
ze}Y!0URR^bveqC_Z)n5(7m(Fq$!@G%E27^U)Gt^CpSJ?7Ap)hE{DqG_S^qSfviyDt
z+Eekn*Uhi>;brD+os#bj<hREDY<Bl#V0MpWXm+b)V0O!70G$^KT3-b|GgPdNA+}GN
zjg9FPs812_A!Sv&_*76FEe(Hsj{V#F1OIwJI~|s_PM-!|tr`YNX~)96THgl<n8MsC
ze-Gl$$8oG*K<yaNP6f~y8mKJ;8dU+!yPbOiYOypUpJ3{iip4eSI;Gjz99FfiYIz^<
zAzG_5*#)%L%jGBNZe;nn&FU^cwK`kXm9@V7NOossn%)W;>vt^!$;NkpQzyeJXm9XY
zCrEVtBTznL^aRy}pkA<7E2Q5IsY{lD$5PVXybrh#xT+`FomGc<8z)0D3!B2F2aZ`$
zKaxJgeF3dTU<B77jH{ZLb219LPiAZRiMy5U&UmpOHtMC;uGXro^X13;00X7w<(`Zn
zo%dS7dO>HmPHSfXjaxz5^q_GocgCCj5SOvF3cADe7RWU(?<7jETC1QtRDTo1-VIXC
z%TF@?eGCe@d#!@*AiHOS*1Ch{C{g+opj8x*_;phQxf5pl1Tm0a=53rzlRG(?AYsp{
zlg!G-_Y5?07hqtw3N-7^14%ip#qSUFy#%G2d(c#qRs=CMO-ZfweZU66=H;CXAoB@@
z1K2O%lI>VN#4jIsn~$Glc-+VS3^W=EF|{opJboBpz%z9#Xv_gLng&~M1PNDApAr<V
zAUg%!A-a|of^<PloxpK*t5zrI)?LW_<IUX&Hlydm&5t>G{()Pi3;v&2)%n<o_1|P^
z9wx`E$+x+gKxt#Pj1B{+eZjZ_yry+Q{mE6GkNsJHHM&9UN^=5>Z_t03dU5(xaC&um
zf57j2=1*bvmY>hsAgb81z^VciinKZ(d$E3NbOVRFS<6r1scH<n+uI$t&IkDobUqiT
zX9rqi1Ml1QgLf148?!HCkU8AS_IUE`KU4QV%F*i7+zhHcK>Kz;wMWv61_7<k&ngTi
zD<a+-^xt09{r*7QS;?c|lM(~;KPOAGiZJ@1ml&YZ0#s^XD={u8CcCimL2}_!Td&sl
z8{VH!_GaY)oeJ`P!T+tRT9RE@c|f%n{2aFj=U4hdc8omWU*vd}8MJzJgWe>qZqQmt
z&{=TM@Q8Z9f&bj9u3N2ft?v!=uO@eJaR|GLGJx(72?X5+_G|C?WL_SY$!smK`p*DV
zCcfXW{*>myW>uJI+oty${J*lkB<w3kHApEqLB#MZ*rWybK_?)Euzms6aiF>mJdT|0
zlmi+=hNN~?*7pb2?E<BCkPb*G`HUIjgEW@+0SA&c?pFhyjvwHESDJ^FA#^KL-^%v~
z^tPkvTMp6pO!<9)L&{$8nNVtPKy#Xnt`HeF(46K5`*!dQA%_}hC);0$%(8dyH|X!y
z1&vSrWpxLSdi_a``p)8*A;=0Eb!K#fj5^oG$vCpAfzlD~5$EJ7;*81)M;SqP0V=X0
zwNahF{ejGVf@VHpZen{4DrMjQUDf(Hg7q6hUYL>bg0hXEp0Y)wp0deAJq9*q14Vsh
z8$(@X3rAgLlR#Z%n?h|Z=v~H>xma$#H^|>4%*LS5=(?&Uto40@-8RsfP|6l8SCnm7
zt|%L@TvIk-xu$Hva!uKW<(jeq%ME1{mK*OKHdr;fuIdEch+5!?9?PI~3rfF;w5!zx
zs$U>6{h)MJcd{?55+qkXH3p~O#j8LkE2=ebYY}ht_{Y(aG`XXLxzSUY`2#cOQ_UqE
zc@NnP56;Qj{9T;!>+fWLV}0fwZ4AkMoC?=K_t;%!bk|(Ks?N%m%xbRKlf01q@hsN=
z&8}<=kH0Pbr!@T`n=;4pD;-IRACnt6WhS$;TvoREa$zz%%Oz!lL|tW*iQ38r3$>Lk
z8nu;eHfm1hVY$la&FZUc@Z|#QDrVD`i_6-R+HXNijA#0jSs9q#E5zStHfy<f4_t#M
zq^@dB_G9H!Hd%53QAQrq2i4aMR>_X6e9h)87n{vkE;O6AT-YrBmmxXImw9$r52Lhr
z4`XP*v{(<rcDDZvrF{p}Kzr__V|o~jYwj=v_8X_SGb$@Qxip#0<&reyOdrO;e$ZM^
z>1iztj;WxNeT>W47=>9`KLqx_>~Za%aVR-%ub}XCcBk19;Q0tf(CN{j)vv}sIKZnT
zGy6d+69fBi90J{e23ivfs+lhKf%aj6)*m^7&qV>v=@?f?Fn;WZ?8Oo}2y(wQ`z}Ul
zadier`d51j^5Fw*R_%pctvtycnXJvnc^E+Hr+Et(gR;e!3-28aB(%CfBJUkO$W6Y^
z!X$i$#c5S<qe^m!FXQ7$?5{xKs|F9<Hfc!c)}Qp<%52T3!)(K--E7mS#ca!{)ok0S
z+34MD(5TOB!l>VD(x}I5$*9+C*{I8G#i-kC)u<EK+HBpZEzHPh(9|$_x+Q~gdnd!S
z>B<|}8A0*is+qf6xYdopay!KJ$9Tc+3TW_L)&1C&^%tmD0INONZh(B|AP3s9F+04A
zQChr<5tLS9`=!OY7-olef$JW}EYQdxs5XMNA||u3T!z(l$2dT#Ls{d?rS|~~B$J(3
z*=AqwWR#xX$vAsjCqpb~&WUmM^-cyvO^MLU#)i=QKs4Efl?fCYXE(0uX50>0w~$&4
zDbrF}-YeKIoy;9@@GdySR(1b`pY@}8P$pBWed>9c+}88c+n5+8x3!&_la$<kogtb3
zJHwph$8)d$o0BH;n9)_{`HaUip26D3AUYF#TSaN;SLpeQpwo%f-uOL%<XYBwptBy<
zpN8<3&Ij#qJ%0*B+OGkT`$2alU&x>8)e5PlTF<{<u>WbY1L&kj@itJu>Df6@zCXVa
zvfBY1+VRsnL9_gxhnlx=G9-7JFwV(QYdzK4G`%I^@oba-kWvnGE*_{Pj4f3A^I65=
zW24HV2cTWnkUiFFt$LmB7wlUCp2dH*9JJnO!M(+k!KWl$XPiDAwCdux6lfNI?{V?v
zObpEC>Dx^Y@0u>^KAVk`A$jUc2Ik}K45F`<6{h@ARx<gkY@+hFBU#YB6?AjKZ_wST
zZXLVYcD25raQ``?%?)aCgU*7OkuP$X`S^4O$=8gosIrajmHThFce*8WTxUss`i#l;
z@RV}ceS|aWCsddA2lhLOJ5C0fGN&ALGa#dD?fzc3$1>M{%_x^h=4Vjgm{32Zy0AYK
ze0tKH@)?gAT?_Y5DWBp5l7pGSs17j!bn3+3{Zq<e_Z7nAh08&=);TcFDF@v&$LP9p
zzh~j1Ps`pVeQNvGASJ$ri9wjhXIZm355uaK&iBHs3@pkfTi(52P&ZfEU=2gFY0JB0
zE>;at9oX`L(e1rKfkLu4tH!x!&6X`6HiE+FQ=^+(hhHnBJEPlF*Su%%C&XW!&92Ju
zb+)q2mp7|=SG6TiXIF~)^)ozK=&RJJSC<}z{fqmS_AcucqqnjJ%PVCYmRHIqEN_%8
zSl%cbu)LYf-ttx1<jbqc>@DwwyL1_p4M1#`kIFhM?~JV+7^lx+Vwl{s=I_sFWrHv8
zn$25YF`Kcx+UddS4vMF_uAuv<?aylUCJTYq#;|-#Ze|yl%+B&*GK<SMM$gGyAJ~;m
zzPwYmS@L4;ia8F<W-ae#x+*Jt`Os|6@(!f8{-oy1X0w(z%w{dGnbTW7HmAFMR5rQG
zq-=4Pso9L>EwdTRYbNp7ezWP#=`5d=ZO$?=o3Xr6wt36IoPOkEllWqmvkc5;EpKo3
zZ=0^Hc9uce;4f3NI?Fd!&`$O0pKQ!)Ss1cf-!JI<snwp<n*96~-}?pUe!$Xe+Eiv^
zR)%CAW*$(CO!Z)OH|G7!;MVc;u(E+Iqq0UWqcV#x<F2;HlWV^&X5nQ3nXGKX%b;w)
z%cN|=%cQKv%b;w*%cN|>%LKCVapun-%(g8rnblj~Gpil>x^up=&X;$OMcLknw}Q?H
zQ0-SXS@Qn<1G^o~W-afgE?_og`P^*I@}=3d<umAfhF&&BH)V?@Z<I~Gym@c%{`IOh
z-IvVfEnk||k9<1yO4;VgD`s<+uhO^887@6iws`VN`nos+Z+B}qERKb%tr?VUp1e^u
z`0_?}>twcqgJGH5GR3k!RRvXVs{WJ{l)EW+TY*@~w-liov)0nYrUnpiTjr)*bdjKH
zWU<L?pwk&vwfXL!%+_$Q7TShmkYM|wthWSQN=Ub|FevLx`SX6kyGP)%;q`JBkl6bL
z?;gTJ8&WzvzX2*8=AIUx4k{hmOGS@^&PeI>aO-euKh}1vbuv54U(lW1?<eeEF8PpI
z)dhN<1gK1clu*K~1qVSq(0(S+IkTWWP0DHrcj$F0tAJeMcMI&2N6XnDF7dmG>Js-0
zAeU@B3~|Zx9NzOFm-KpYy1R88YuyF9NeSeVKkp~V&*yyEoZj-6Io;(i=q78>dO65=
z31q)gvpE9;(*)R9NUQti>B||4H!QCKmGh2BcNu~Bt|<4l{&i1&y_})d-FWJ9hGK)Q
zHN^^3Yl;<?V(1hv1*M;*dG8zcT>_bcY^p?>O!DM!;tUf{K~CgQXPutL#Gt(E+Y6cG
z&hF0B5Ygp~;^|Bb%I4o+f%HT6I)O&;K({Tte;~I*@~N`Pl7H_%$p2(EZGqoV0l8I-
zK>#e5V895Hd;g$r4QM<MG?oYRGvnD+?X2#?tRMJ6Yd#St@__7O1^XDXni16QpI!>;
zEvBZdYI(mP|5tJZD-$SQA$P((SAe*dogM6l4bSd?U2XCG&Z88_u6yu42GCib;68NQ
zjQ0!pe<of8wd#A_AOCs&i_m%q$eGXL<xC99s^7~Z;kS0IYG-_D*ZTg!zr`@Wf&46<
z3O;|NczP-51WwiL_YdSRHk-Hn1F4K#2vZ3f?`q%xjd-;^f!(_eKIs;;vap>Iy#5L_
zdIUM~0(9>-sOJqzcgp(T-QF+Q-@B^)u^;H3anQ~>(0D?F>Z<n4ub|UJAZ@9(?!TdG
ztzaES-(B7>h~JXz1?rE2?(GKE1)#M?_U~4;NB(R!Z-Mrnj&;KI*nGEpzd(LtvI8p@
zDEwOf!t{Vf40S((PU!}j&1~LoCq9jdLD}M(jpcbBXJwluzb3P}{84L#xI(S%{Q~_*
zst23ZT>dD!C(n7t5&~Tz2HL?SeWQ(WHfRTQIy-nhKV*g2$3EZw(EeugmfxUu?R1do
zYoD1x({q%v&6i*AH`q0T<X`Tc%-&#kaqrjggL|i!gKl$N9#b2h-2R-wxOKS$Xr2La
zF3kG}?|y>P7APNpLf`8LXoWLqZWDB}Ndt%YOwd}@m4?mcoD7}EC!4D>tm>Tk_<chC
z5s(Wex3%fbNCTBe&Cj3f?V3Kr8C0(;a0osJ)$Zo(3=K05&q$ig&dve3M|AS{<NS8r
zTOUuK%EZuo^r#NADJR2ZwlBX~-G$i{nBNC9a3nrtcK`Bwayt8;<SCpClhfIMfYd<M
zYa-Mx=Ku2ReLw=U?M+B4ll78#D`;f0wfMcj{eP|7LH18(XJ-V>d_mYB_=VZsS!BSc
z1Fm$3(39C2xMU79?_y(km@>JAB}<r#i=)>Iv<d`r_T=N9@UPol`9XKtsDRG6;dK3L
z@_s|y{GWfK+939}o`Bk$_g*0W`_ruuQPq<WQPqt10{_3Bgtv1+Aq~l&?JSV|`J54)
zKX*J^1kRr}-<P15DDOVON|gVbL8S&PuOP~SRW0uyoO>>K6qNfR=guqJEcx?3;eZvh
zY0KZYS3otQ`PM^>pcBltvkEX+vA$Q>{|hk^4RRI4R#+(n5`nl+{U6v}7T@Qgs^C03
zoBiv5R(D3%<dp9Wpz;c&2b79HG^C_LHVsubNDU+$mUBVuS^gIq4wJz48GN4s(E+NP
z8W_~Rfa)etiO}+w(M=C@>&Suon^(0mo`lsNkh6$Ec@|zG=zV8<zo7rjs#Z{m09rr8
z^7p;Ngp^gSg<nA>hqB3%KakwxY7fe@%0}N=-f!SL3pxo0)l^vN4lCLGuEF8}QL?qF
zLP|DPv-c0`n?WU8B{XHGu7sq8r{V7f>_KDj;4+Wz63h%xu2cI1T62KNb<?LXF*I*+
z`Q3U3l>eALHGgY$b$WqP|EX41chGL-#rz?^-#ZipbDo8yxYi{QTUbNh3*0~VKB2yg
z)g7cBI%DqeAt>>0v-_9dcHNI>g#U%e39|`sfI{oNgFv9~UvR!-7hroV@%>ja9~Vch
zRjb$IH(tNP+7ad~=4bi!-a)`e^d&^p6*ANAAmGdU5M;XW_i_ft^ABf3%!kN=bE?Ay
z4~Q7VJrHvyxGVmh=nfJ01)Bs>E8wR1aWZ=Y8^~Ue`&ivA-5@drF0$Jp>XFS6aDFVo
z`T?QZ*KIL>%J26M6C9tS<h<#up!$-P6S8Oe8O!u<|Nc*IOXC**{_npqySni7@BjW!
zZg2l89?Ha^Y`-;QI*8tXG($WL#J`p`9Yk+_mLnbx;(yPBq)<fa;5~?x9#~l2ATg8L
z^PVBW0F)vaLFb1)$lC;qd075<|KQzf&X;rDSktz%GBKF5GBdna*na?&M?m@MZ~5$Y
zb{E^Zf8CScEoXqVyq+_PFK1v7W>@d9nkwT6y7$XbkTnguwwaA>AH-(YIgm7Q)cU=E
z{jTB(U-vdO6i;{xCa;3YqhN9?m|O}br-I2=Fj)#FQ^8~?m~;h`reIPPOp1a@RxoM0
z2V}k~m=pz*tb3Xo@VdVRpZkyYLEW$aUci1`vFZnqEvgT|<OMK!08DNGlMBG)1TfhE
zCJVr10+<W{lMZ0g08A=?NdYj)045DUZdO$QlLBCpVNX+oL~3h#a^`minM7f>@BcTa
zeP{UC*Ldt}s9tMRgGi?EH#3IG-@dV@-U8)gP~F+U!I~!BTFPMQA<V|MC%JS518bTv
zo7x`O{U2X`Dcd~xwXQ|k;L4x(AL8FNo3Z?v{I!GuRAw)ls@!w+59me+X495G??2Q(
zXf|j04cc$Un%ddS+q`SKG%M@g$*tf2tIkz6*zyNdhQ0qFe-EO1{>x@lmOshNTN%EF
zLVERj;Pc@b1zXdVUd(Q1-^(Dt_Qn>Z^PjQ_=q|PTXP~>5Cr@K%YMjJu*7C2}l;t0z
zd*idl$-?XmOp~XvGasBZ^O2+a!RE=|zVpv~q^Q0S#A2BFNKk!Z^W<;l3^N~bs&_WG
zc29iFs^03pd)jjb(OzEl-P4~laIwlf5@hXo2utmtGl$r|Ui-r!x$&&#xr6S>FOIW)
zR#*5VJYAeAIgH&#?XA~Kzo$VDZ~eIU#i(;t=em}4U5s9g-e03Hf#$70?0?RxmCRAf
z+<aV$@gbLWcRJ(a6s`Zs;@nKHQa~qyaAmnwFRO0!0-dE3*7~dpbdC<P%-5*9+nbMj
zGB6*HWN1EC$-sOJ>ujfVHiI?WX@+yHey#5v4v4PmN_J#5I+#AWo&CeB7mq%?djdL>
zh|!nPD{@gIsMl_=AVjMN!b*sqlfb;Yg<)0i<ZJ9s!q?fEW_PoLcDa6Obx*$AuA0ov
zu42}Hul-dUWMs*W1vG{z%*yipy}<vLYpud;EZ;%4GJy8ey0I!WA6H>ap2x1#eB6XF
zc_O=7^Klo(*3;nD*75dP$@ADXz+<@JQ7Sg(YakaJY=}+vV3lcg2iItf-)FG8CkMBy
zHk+}01)s;l;qq<vb;y}IvHjcHXHRQm_}CW;K0^mIjtaW@OIhK|x5;cQ-)3L$W|W@Z
z%^2G+J*}HzJNtiz+P=VkX0w*Bv#)nEeC)s3udMKcfz>@ZaJ&5EaBe5i_$+AVAh3Ts
z>wgB&n)_V1`gR6I4zLcrAOB{DcQZ<hbu-5Hf$kv!nftfbx3Af><?HP5ZU$@iJ&bSr
zFZN$+1+{Xa;neBZ3bO0H!3F<SUCExTe5|^xS`S&0tF*+MkBcyVy$u<=JGv7z5^{g#
zD$w4UXOK8K02=-8_G^7_(BP=m4KeT74!_n$*Y^e!N>+6xJAqpANa5HFQXAk2x;+W(
zQgKiS%ogir0J#n{p6!^u`5PM}=yZJ0cxXD~&Hl-3EZ+s)A!f5}0mXx|#+PsJ4L-Oe
zJF&7zU+-p|J-wUpCS){xdN%`T-*Rj}C=@q;$I!nKNx#G6c-9-Mx<Dx!IVH2zxaBU(
zg{AR0czQba0Fj>F-*?>&DLqpkykAf^2{e}kGI@F%Xr^B6zIYjEY*Wqqy}<;l#{sOj
zGWR3G;Mh8l%J&8zEFOom-f-M5$gy!NC`FiceBF%cj>?V5VxAj+M(y2+ECO-u*Qli%
zVf9_Hs=^;o?N-^y+6k)RAp6l7IN_y1FuTa555iqv|1bM<>c_b+pc~B6{y^42Yt3qO
z+3DrzJ-fYxfi*Sx*Do$%R@FW4Kir==`FjcIHs&9TrZ*pN|IypsdKz?g)@0U}@1V0?
z{;vn^XlAxx`EjbvZbq#{a`8`weQiPQ$;BRwPVLFn*ST6%9#2d8-RNTJb<m476=c3J
zE9;)*(q9a$sSrEnPe!+6;ptYD$FoBILPnQel^`L0^wN8Q{%y6PpgYSTd!0dhl|j3k
zJrkQ6K&HO`aKBI4WXX@s?JW!t*KYjXs$#mm*}dhb@b^FL%UUOYXa8}tUzoM!hceHX
zAIc^wKb0*^e!l+@KmBWXGXGa5MpxhMYVDWWyxJgkvr0njW<CC1;QYGM(7^4e;;o0?
z3;3_C3|+fl4XPtm9HQgtsrLfwS9gNfje^!-z+)i_v?Cg__ZPH6RI3{`Y*hCo*Zg96
z|G~a#@=tKc|JvN%3G&S^)=Xhe%{{%{jpv2gSbj}rZ2_&$_;7zZXvJP~Upi~6%Hw$<
zzoVe;c*+fR$C38}`ipBrr!D}6H|w7FANoP{+b?Js{aV)9+r1IR#Ql>%CW36^-1B%^
z`ft#9zW+~UlO?|v%~WpT{MBsQ0=_$p{|##@sNPha+vxiKgZ^vOb&#NyAD|VGttzt6
zFgwZwagpo#_X7O0Dnoz5*X&GhXJTl6?*0%m3VGD2k6q^Ndx7`2L8%#(l3^(vD(~=K
z;QU#bT&p|i1m)!K+Zq0b8(&?{z}nf=0O`X)Zg<q`v}%Ri4))~Frk3{x`FEJjTmFLX
zcWQJ`j#$9(Sv|p^@yKVjgoLmCGf!^5uFfd@RUCfyIcOZus#V$M%b)iK=Wl4WGrB$w
ze(<kYJwX7}C;Hic5IWY#_Ju*Bd3&pXFnd74rk2T9w=>M0+}kPqO&oj!d@|qD7;t;d
zVdeZ<_vF0qVBUB8mGdh>cY8$%Plw*DJRQ{fZ2!J%`W*1Bvu042ANlj%Ab;{?aaE?|
z1ME?tJ1Rl$FLizYA^t-$J8Q&e^$Q#4Jb;|o1L>(E>pb5-S=^K<`7nDJOlP6%`w#m;
zD>*|xs~^}n=fTbGDC&DAi@P!<pJoq&sm}$ef0@k08uVFx!^SxeBKM=H@0=_i3Nk+c
zralv-{#h~?tKVn!1smr)n2TzD+hp-nkoi6^^{F8BkCT~LeLkyC*f{5bEUNj<lf_Fx
z=6k`^CxX;JNakYo_^jTran1utRP!4qi?@QzcY~>q1*yNA%*5*US-k+{-@QogSGfOo
zviMYx`7SW^ks$TAlDSx&KC35eobw=dD~kGGlf{>U%m>XEfKyT^Nd5I>CRT^f>H#4C
zqMHAGviMez`F1e#13~JqBy+Lad{%eZIOoAkRP(<~7C#Cy-wLMQ7o`4TG83!SXLSRR
ze^Jf<I9dEE$b1W!dQXu0bIDw+W}np+HqLo)cQcCn-%S>O3NqgWrrs5#{&X@EtI20|
z0g!)pqo{v9S^O)=d?T28N09mx$y}@kpVb*a=>gUJ7n8+VnUhbm>%r99g47>PW@6R*
zto~ucoCh;e&3`&sT$DNaFuM*+y(LKfp=2&rt<UNYHq3b-i)#L($>ORY^EF`VO+o7S
zCo{2Xd{)1(Va|iQJ5k(!f3mnK$b2=JdP9)<J;_|GDxcL4Y?$-l=0+6tcP5Lwg3MQf
zsn-Rm-<izBs`OcX!-hEzB2mr1DO}3xkSxrq08_6CQok*ki&gHk`hpE}9?V5G|C(?q
zs{&|cK1{tTNd4wyCRUlx>JvczMK%Aja4D+*Xk|W3y&_2chGZ^QiO=c{8|FNaL^c0{
za49QCvNWq0OuZ~f{n}(ER<Y0O1t9<KL-Frf;ZjzXWMNhjn0iT&`c=tXtU{mF6E@6w
z5W5XU{VCy6R;FZWRsooLQIPuOpmT*ks|SGmi)#LH$IfICRz8?&LD%;m?k`E^X65;;
z?yzCbgM}!j|39MG>H8L@me=+D2l++5M?b3@Y?$-Favvv%ztHpSXLSV-e;cbS==R?C
zAMVeOJP6Vgc<B9tch5Q=T-}50;{E$4i;FTPA7W<%sR5Opm9FnU%%7uq^0WE_P<gNg
zS@r!rpc@HcDr;TefA~L>_2_5y4;$w^DBQyc;?H0_`&pe~!<+|&TmFhpe9HOk{ery5
z9S`>IsSMq^=lz0ncRC*Q?wQOUkdQ3-m5F(KtH9*&?F_x$f5m$rPZn=yOg_iX0ISoC
zTHh~N_YhQ@LB>5QLy<<26ZkP^Q#cYqYLRP2o=4~+p#8dYoEp`69A`L5v#~Qgmih+X
zku5xxm5Fg8lXzq=vVLpU1r8jCCSPY|5@vT}kU7i)zk5Wy9W)1a{0!*i#a+|qBsZRi
zxq3%>M>^AVn7yD~y`c34&D+>cfz%eOJA4G)rO|sFrhZEJg#10(qVqw!D}}FLW3-y~
zH<Z=232s7D1H>-&V<7#zrq4(Qoh!);*Dn$-kZ+Mabv~$1J^A`I##OC$(^y>*E@*0K
zb{Azn_*kZP>v_<K0c_+CbgOHtt1v4o3-itvhUT5^4B!#{2mh{HJ`DO0_GU+lS1S{!
z1@&92%dd4$deihhDWFwNV7kkzbxB6kbm4F*hRy7zjFYcQG0g1uYTMkp-GR}yX$t66
zaL9N7=*)G{8UR?!1JoLT`UiY!C1{-jXzq^pBxp3^{fGLmpb_N1p%S42xi*<I=Lk<{
zVVWFrosrd5ZCcZG<a!*m7X9pgM?quutq#y}D06X!$>817ozEMO^88gcU}b^DLoz?B
zNKELyw#MTUg~^=kA`+R&g6tv^xw75KLhK?Eg|gkra_mB^>9yj?S>J^~W5AFR;Gh=`
z44~29<X%=0k;EB^$&;T+h<7nD2y=0*Wj5zxNM>ah0Il;*Zc|}Y-lM{-yn%&fUt9BW
z7G`nqIf>71Kt`S2Z*O?A<HgL=P~KI@81(b2JD%)$!RR@e^8@?zDkg@>U8|T{&vk@Y
zv#K(_Z}``l{AeW;j3?I#8Hu~j7&cWVvGX{{_FdCk9^VOJ)qI@(^G{F4#HZ6i^Mt$E
zAN6F+$(d2mk+Qk%IYTnvRkqD+TN#quu5*FL<w0Ze?*;BR+P>^5=*U5c>~AoAI3ocx
zYbMNk^bW**>Q5y;+B|%}pl>T^wK=0JY?Rt53v_>sKx$yWZ1-b6_E(@&M-*M(H|*<C
zHdw`Acoq~QcS62y1)08Us$DC@&i-Gn7eOX~%mSVA4lxB1np!iO&AAw69tY_>xpmjn
zR=1_wK_<>?2bsuu6eNBnBy}t3ytlRcOGD?vTgaf6FSDuYG|b!&&Uee$CWG>ebUQmk
za`JTsrU{VLw|p`zzwDa+H*CsdSUQ2_N{C*!er$T5_apRnVCV#yFU-EYTPA<%Y4JAD
zjS<hfK&H%YV`oVIe~dw*7@-?vGh)V-X~I?T{-vWxE$3A&JgKd29J&A4AYthLY*jnw
z+Zh?4+yaTK)?*SM-!I6U4Qh2m=40%@w>Q9i0`eK^><G9|alE~y@o}p=c<#fBJqAL5
zk2wktSBNV0rirIPK4La+Z<0ywJ*{lO&LFq~l+K#BKacD^4AI9PG5K0MGpl>@jAu;3
z*V&mtYiT5pCktL@0@)5KQ9<<N@89`b)xq<(%HL~1qD&JIw;V%eMwV8+e=u*-`w#cO
zPcLC&XkPN9GWk9W14Qm=#rp^MCWHJa-TLJ}q%}XijESN7*s=1z;a)HNo`B6({a&`M
zQ@j#1i+HlE^_h4kh_%vRaslX;QqZj8)BmmRkHkSM0YEFJLbt#F@c#oyd`5EZZ;0xX
zK9Bo3|FF6ziO+ZpQsW4oYliKZ(dvY{C;$C}d+iVxEX!|nVRUA7o1O}qZ9eKTJ%fp1
za>ogGh)UNy@d_peVGfVH-g7dEGm;HYGn;cT$RvNgJ@phQM1`-nGbc+PXMlwr>+#1t
z$Nwa=F*AT>Q<c|D&tRG`CvoTT=ItB|Pw#`n+<@Kb<#ter&TbKBFltWS4pI&A|MWD_
zu45;0<MfvdGaf@+pql#rfm{P<WOPvqWG@d$J=pZM(~~B%3kVz%-<<xFVa~&Y`+1Lo
z#G8+&C(V5iVoh#8o&+*knEiNSt6R@wfyW?G<>u=NurvlqiK)xpGrT_vifKrF4N^6^
zojra=a<b%h28apEV?~l5_Z|BMDluU8JdcLi;~oQ1<sOY>Pyh7@RC}Jzem`N~OmutN
zBarP;4@cMo(=GTC<f7)|-@`hOgLH#ZU}@;x{gw|a3za^AYo=1rnt{}iRu4gUWs@!c
zKr5vtv$y;eW@Gu+>sqYr@KITb<)5-b%D?vo`9CEe7Bd70fYKwVFAQp(fX&~Y9x(GT
zsNRRo(|}UQ<Tf^cMz{9@4EBm|K{3K?%Ien%UW)};uhQ}lWQVc>%fI&p=Rb=+ZB{?>
zPrR6kL72JO8xp#$(}k~#Gq85Ib}O?yW?0Pfnc@9}c{3SZL2(LN&jG3ruflUL$bYq>
zpqY1&FG2o;^!e4^z}6jTb-rJ)|5>s-D+{RP*m-y|Ys+7+R`D<f24S{i!Jv3hw)*b!
z{y_cQRV}Qb-L-$A?wAUev-s}xenMO$$oEc}u$y>6XA1lU=M}a$pxnYB01lDm?pNm?
zXZ5V(Y;<8<0TEHZ(yEgD_X~qs+o@JicnGty+PzPBKRNf}dx!f+LG$O3P*by=ku)=X
zc6<1$M0RC??+hTBIZ49o7uXN7&p3P$ycZ30w<hRj&7dEkb^Q$j%~ov;ps_p9y$j;i
z3=G2D-fP9PKy~)1IhWd?=M@-yNLbavcowvZ9&&r;qAI3pwbo@RptbZ-ZJ_gD!27rx
z&Y$Bv8r1sUfx+4LB}f!9j=5|lME3m|(7v+d@DEJHtzJ>q_{9J+1*98d65F!(4gDub
zG)3zdLvjlj6C_4b+uu)E_d<3*#IN1+A%5-Z7u>(9g>^ebjcVun33<;r_e0X8+7ku=
z-m|T)t6JVWBv>#%Wnl!ZHJHrWVE2B)ycyu#7Y+$l%uihyL1G}e_Y>r%tF^YezIS+F
z@!nzoYFM6XbZ0zj*ZTg${$HR{iP>DeBlk9_c9`7W-u@JRRu6pUzT`W@`w#!WgH$wc
zf8PA{HpF$V&4`<G1(8Y+kSw$5Q}BsPpmXJ=MN1h#=^18wt!b-!^7rKopwtd2b3ikx
z%%-k&AQ5C8kQQA718i2G<u9Wf=q_T|&3d5RaDOXkCce={5_Ia~-&U7}?4Z#tP=4`h
zWprl+t@har>-&I4c<r}<S~H-Q45&2(a}zP^6d<v{Ai#UF)|AyfIcYf)XfD6`C@ViG
zFEE=P<(mtdOaI5~wwV3PzxN6PF|b??QP;`?QRm9j30BAI4pUhW2~!F3G5R_N@XDqI
z@yl1WBi1oM?gs{y0ic<0aNbt=&i1~6{{U=dlXw{ugD_hg=p=uI4dJWWD?fr}0U<7V
z$_#PIQfAOBdC6Z!xAzJG!JySol24i4Oa6j#v2xcl22i{RvmVU@-(Ec7++L6hSm;4q
z01H1*%+;C-o2sJ3G`Q5*e*CXF`zo=?ZS9OR4lQJ7RY%<81qxBnTqAhJ#y>{4_Y3~d
z0IdxN&4RZchS;8(2lk!y_aE;kfbP_Ug%qUZ1no-#-6aGnMIdF!^h(g0YtHY<eOzLo
z8!M70v&;Ckf%Yze!;yi(UaL#;Bxnx~s1$irxu`0r6>=Uu_!NdTP)Vwm4+_=y4f$P@
z*%^4irz8C);dG=WKS8C%Z*j0$Y1t67*0&}zu!?|Bc8K{PB;yF)nUI0L*G!BNw9f`K
z#|D};0-al{ybReiwseST=Nmxd*B}>z_z;_prM@qS|KDuh^2<2=D?{dK#|)5JAbU=p
zpW`fj9efuO<Lqhe41xWidv6i8#P%z%cnLonSsHYXwpcspmZNWCjG(i}u0qdfRbKUz
zA-SE42@*3$<KIu{n*$0(P-r5DBqR<zA2@D>s8mgSKjGa>Y$|0OL34qiIYDghy4kP1
z;wQu3@WkzzQJs51wv<M#+zLx`l1D{613Z0PITGJ9Fx0$vSbrBL11sO={{^KTX7lCO
zb8myv;^cPr>$u9d`@cXcnzyH4{(2jfJA_$}Ucz3!LDgOQdmWVOL28**Suf!);UIdJ
zpGDT=dKOtvt9$aV<qVwejqb@}Pr)t7=H<)5vjTRlAa$MY$)A@qG&O+o3}_9hvf7e=
zV7pC^o@RC5)h5h#<X^Ar`-J~rIG@7uNVDpZe_Czgsh|~asc!E-?CXcgK-{B#0$ZEs
z*fB=8_Y4>G4PQddKMHE|OlEKS2U({p%;xe>SxMyo`-J&V8r>o79p=M=;MULV>*5Tp
z-H=#!^;A~)%<#S;?iYG{$Mm4?Ay7#N>aF{|0o|LrsYR>veS!VYRjsQ!lf79%GjxC6
zGdu_dmF<!zJ03K`d$Er)^;$tCw^u7@y^S#2Gq?8#@+YloP5tQC`kvuHP~p$XtOW;8
z?uV?r0G%8m4Za_0>0?Xq37-rSkTX6(=d&F73&}ZZmLS{bpH@7G>m~$HUIE=w0=k1l
zt<9?ybZhzj&!Bb`=;i=WOA^#J2AyB{6<&Wfo45W4-4ecTdUHEF1E|#x+Svd~Gct!D
z^&Tv}g4#zg)%&I@HylN(8)0f-^6REIPiJR1Bz|x*k)}<+XWG80J&rJQc<{Pv!a<PB
zQQeJj(+p>jDIoqj=pC1!5Ci#HTD+a%W<N;p?CI=`v#+x=V)OlEF*asq^Va{9ueULS
z?&{b$9~5#R9lNH2^vuC)J7m>pvsvqZ&|SnJmw?RD1K&caz`<<V`hOMFpR=#FGJ<yU
zodwUb&z{!Ca4;2A!hz=ML3av)+<CP>7ksk-s$W5I1e({M9nr=JGI6$e8{=%THU`IZ
z(5WOK{h;*GBq|-&#&EU2vafOCs;L+Ik=+d%$3yJw(dz`YlZ08H=1yj1V14hPe>9nk
zRYvU(s7zng0!^2YJLC)gFP!MkdX%^`_2wJ^nE=(#1G<0leZl{^jqarf{aWuF0G&((
zIhW{E>-z=#i&k|;KAqzL%4N)^EPp`rc8rsauRmp)J<Xh9${FPqDvZjjSQwPou`qNz
z>2#ZMA-VrLo1lAg>vI-X_vD$+S)e0h7a=20>6bxcM>D?6`SF&GHSIma`D?2>WuFSS
zvM|19cp$T?llLKPe9^CUQ6*@E@s0zldve!vj^xJcTx-vNja=3W36<8E_YV2nVK+d+
zRNruDbxY>E&XLUgoulwK#P0NS5WCwi1cJ_Ug4Viie<41P?`w5`EW-K$5hl<6KxFp!
zY&KuOFnhW<!_%!0la@nGO244HA0l#`6KXcM>UN08@*5Bl_WP1hHOtRKMA|P4Le;c0
zLPVA`pWQo|)8U{gynhGEAE0zSnDQ`awc_M9w(oP2lBZo~FkCSwIl1RL1M_nBzmKIM
zHzW(Uvi}9uK%l&VnkNhoLUgNr?nz2+yviitxUOAs!JOpeZkP$j!Q=Fhy>}vid43AB
zvNCr(>UfG6KLhpUea}jGu4*q0P5%3oX@+~Pd2T=JYf$|Fsu`Gfv@;pCC$n=fU2s3)
zym4-F%mRkpSC=wawb`{Y%>cDVLA60sL+VY?xc}~{OBwENXWr4yn9Rz-Hlf(`5L8##
z0v3=iP%UZK3R+XAZ1Us}WFGy?AEp_uf0<Q}`~$7A1GTA{&0GGg>;v7DZv5>T189Cl
zvrk#=$Ul&cmD@w_!ff&d--83%AF~u5$I|WJ{)29LG@Redp8WPX)6`=i-p2WmJ8_;f
zg7TQ7=;ZL{jO(VYnm)sMBI`tU<#kX0J)V8_A0kvjL+`>({A;#xUh<z~3?OrQ*^{4N
zXFyfgY}fj)c}E`u^Ey8U=EEEe$<>D$Cx89QpWK<sz<k()@gm3L?8E;-BOS06G|DEB
z)3(5;I4Q9FYF_HWko;sDPxI0ahU5oVd6GFfIGUH9U`T$oovV2%2P3ocQO0%c$vK<Z
zCYy>g%$_RBpscdxNApn*h9<El@y1DwlLMVEdMF!w`KN4f<d3q+l|SIyB~4QPDO-sA
zW!}!mIGMfWhcd^OAIc^yzmzRNYa3a<H=DBl(>$zE3%bjRX*#n-%Xi7A$!r`9&FL(^
zlns6`z*fS{YR}x>>fR*Y3EJECqe%>8Z{s9J_eOU{=gjSTt&>?>e!WldzX&p+c7JUs
z;&y08572pH??1@D1EpP18iv)T??2ps0~3RsEdn}qvhB;I2MrRCHHDCJh*e}VD+3p^
zRU5;51Nqm<EUYr8UQA|d`K{H-=mx$Ofx$sGS&UVR*|g<1==A2VAu_(ntlyd5C#*kw
z3R;#O<$rIm|CL)NXax!6R4v#!l)`LBem1(kPgs9;RSU?3mtR0DVOm|^C-k3zh#dU`
zx~B`&uFF3S5xM&T6kZcu-zWH=f{0xFA<WkDbEfP21kim^AahQB0G*RC*Y$k@{|Shi
zr9Xt(Sbi^beV_3D*s7LfNmc>S+O5fKF3|FlZSDJl{@u*#F27f`gG@+{e!%zk^c-hq
z4VPcdYAwH{FSj#-dJ>@4I_TU8$28C#BF5?I44_kqne~qRWL9SR1*-FX`#~%CAoD0~
zFRk0z7^ibEFih^qI0w0_aM?4+`s&t8${IhJl$BnxC>z}5P}bsPQdZz(Rn|GltgM&G
zq--L|u57WBP1)uo8?zc0XeZ$BX0?`|%<4yeDQlc$P&V;o1f6}ZtaXz?S?48#vffXI
zX7et_pthOESG5YWc5*gNU)93<RG5{M>3u@p?Nu$DFWoZt?gfo?E!{eq#o=J@-ez+y
zrpDvUrXaN-KX2R$lAXDA^Yfz&v#)<=eEPWZ?8kGag-S2go-zn}Jv{e^?JX!B8?|ri
zgw(Ig=1flmualc?*SV?%l&juPxIbxCJLkz)30^6yQn)goRob=kf=((_Z~1ZQhh3{(
z*ZYL`ty=AtXJx9Fo}ZJy6}<ZFR4Zsr&yjDSyHuK{uWA<r>vyX{HbL2B$+u=xmha4_
zE#KcK=uc5Rs=Q$(L$i6yH;`SZYSo}^<7KlhwZ7lb|6o<S>(8Lp_W|+$wAvlNx>ZeP
zFF3dpddmxlr*N<lUfSGoOpgA*FvpeARauFRK?Xi|3M!{zxo4rfNM`bz?JVNup!GfO
z2fJ8zO`QW?Uw+XY)VhP^tmfrxA7u_5-QTR<`d{YI)9uabNB_$lI=cN&n9QM<`}c&&
z9J;uFPn67|pWB<4w|#hME_3MO_R7$c+d*N@_SWkmgW!x*8RyC0)EU5cz%;X|O#UX$
zVAh#DpUp$<>9sGnK0JC6;VjL@$p8wSRySpvBj5CTSTa|&CUad^<8({rI<8b1nk>hz
zF!`4`Lvjz74QO>=ax=Rc=(dvNS?pFI9nH&+d|)<j`JVjjxy!RB%{eXKL7{r@&E(lO
z4Cnq_`mwotwqqZ6^Q!j$!d=~;8a>r!Et?(G`u;**bF*C!L-UH356#c{7=@>EFfmR}
z6z^hB&iQV`Y~I71obla;c{}&#=Iz~|1)QfiCo^2Lk#L^l3_1}HbPIbj$9Jpd<$es!
z=RsvR9|Nde3c5{r_I!Ru={P+G=55?xHoyPRAY3QM5Y=wEfO)z1C+qUZOvya&&8%Br
zFiA6ugV*_kZX-`-<zs3-B+k%$n4O{ds5(RQF>{7ROq(ASF&tvu{4|u|5!>0mMz!R=
z`wY#;${Csur86{#@-R-G4!RL0oZ<20?Z1*4-y7|2&0q$#Pm=jxGtIuC!I0d|!Nerm
z#j&~l1Owwlqp9nr>rE4JlyDMcQ`WooPvW2;>*JZn|4p85!?3x1x?>;vvgyp**uUsa
zOXlKZXm&4SV0KSqSj2v_UwPI)hGugf=9Q<L-NP7~-P{<Mm-8_$V!zt2yyhPRvndbr
zWY#u@WPWy)b!}ShjqVeiTGc1A2^?l##>Xhg{`lqbf8cxDuRUipn!0Ifvw07*aocf+
z_XYocA?)5ag?YKlCsys|?JS?It6wugc613a2DQFFaPRfAO1G+K*~@YcE`p^S;h*9R
z7dNj;SyshX?Un<|LtL4loZ8!++{3N}PAAjYB|vEdvVZdF^yI4VAn|XYG;#0EvnQ_}
z<o#h@+x}meyMd?I%XUF;cXB_w99ZWRb_q}#!c@t?)aV7eMN@c|6@xKXl%p_r_lG7a
zVPPwV$+x(e)Mjt)O<`#CjB0&<VBXzkn;wSd<t-nWceZ?Fetw1lGy~Z<sd=@_$A@BE
z?4Z&n`NcD#W-}h9<R{OBn78$QW?t(1sd+2!X9=esM^<&~^5sm)?AryJHQ5-NkM=My
zFY{s8-EPjzY|g{T$ED1=<;P;yBR|w;DT^%msVsKohqCySAIzp)UqI*e8gqSRn9SPp
zL(wg$^?gCzlV;N%#;IqUm!Dw}X6<4)dKx{R&M;t$Cmtq9Jk>qmXAoeVJl%?6b9*=>
zoh*0%)T-IMz5Vm<pD&p}w}>aRaf0Uwlocu&!T!Ghi!-*|N422*`nZSv2q>OlamJO&
z=n9H4)KG5yuWWPWn=m&6Q{moDcV(L|-!5)vbep=L(e2@8khyZFK_la!5pq`7_YHhY
zo6UQeS~(v-|M>!B55#<s&7gGgEZZ$-Sq@ibU?|8QP)f2pj;vd6VY4|8ODpH&mp}L2
z+zxYBX{hh+>8YSSM5-m?p`fvsrB?4By!&1n3RB^^8&;A&6os@iT6^Cc<iCKGo1mE=
z(9G5p$A#(2HY|Un+sppn6i@#BoJH*otNXf^<c4QV8ik!6dTnkUpqZ{+Z8Kfp2kbx1
z`x0~?$<*VMSsS3U46GgR4f^k|YG*t<!$FaC#$nLD-5cQBy&*HPkQ;6wJAFatZ(e$F
z?Md68Qy&-@S9R%iLELt<c`_@5#Crq&+sVwVZs*=WW}DIsR&|1RTqOMeqt(fK@Eo+Y
z^R(f;!TH<IGC^ldx@9fP@@i$P1f4s1>wz$L%a2=a5Z!Eg5WVqRl37?K2=#1B`!9m_
z5iI!0Ak6-OIl2717R;PBU5GjN*Z&PCwuh{|<R=4Mzcy6=>Q<tA*q{+vh%eOIA-eb9
zp6Z_bV!6q(FSVx1i&iouGq6fbZsBC91f4kWGZeIv>*uD{z;o|Etb4kuJ*xc_G!)dD
zLHd)Yup2Zl=VWNMX!$8UL!5z0LO6nh36u*rcW^jvzVU-ed7a4LW($^|$ELf@P~P$7
zpYk4-|H@lHBXIj~t!f3`<gC`Z@Tgr|@_BZx_XYD-Dz8!btGs~aU-NQL23F0<EiKH+
z<v;mAC!`9qxBT>K1KIk1g8m{<Z@rfdeBNFOTedK#!a?1=$#dD&K&}yY1?_-u6^FFe
zT(3VghqURAU4gXY)Y`<q|Nk${u3oRaWu=hv0#9M(ML&g<ckC2W-g8n&dBaT+<t;Bo
zgj+lL-v{LX(&|hWVC9?4#q#r7E2}3+R9Qpi=lg*D?aF&rifDBu9_{q-YCqK$)#lc5
zt$n7evI<Cc{yeQt-lw1w%p9|o^?v<h-r6ae{5+i(bb7(D)@$vI?x5WGK0tnsR;TY-
zknH;a`yR&y;1G5LjpVcCg8iCce*zRrt6F$3CZA=O@M;Td1%(7CL@u?ypU^+?u{i4o
zNM23ld0+6aQLAlwC@2TFa;vqzFW~$8Se*48vnk6@P>3n-SP41<<7Y41rq=f#`c7zd
zKIUM3v#f+I`|D0n7=nEFKH&TZkjUGOkdmO)5Mp}k|Mw64wohhfU{PN1lR<ZPY2?oB
zApe2f-sz#d;HMbK{}6xmy1oyn@6+mJ{feYw5wePjuI~fld$c+q3$uQJsZn0?Q|$56
z^xw?tr~W?{{QhgI2e^#*2{Ci7>-zxvPOZ+zQmk*7)sOs~9S$0=W$jk(`6;%z=cU-e
z)6Gjcq4PejE)PvXt%3Ij`LkEGI38?X!N~w}=d$*P7NFLFTL;9<sjlw>{x^$0z2g8G
z_dV(`c`7?o<3#0UKgHe~te>vDW2KnnQRZhS#U{75FuX6|`?RbTqEglFy#fEsWhKut
z*|HDr1BI7eXX-v-PKSdhx3OiHMwV^^*#|nEQ*|puRqi&>_%~?IXfoT8e~?`0*6=>z
z{QG9LBmXoHPIOP6`He*ezDvHH5&5J$Q2*p*FQ~@?>7^t;{>HSgt@SWyRNSl;G#@|l
z)Zg&OGrxh)W9W2)h@A{O3Z5N@+X_xu&&uB?<i7yfstB@mG6}Z6{l>7b4Pocs@W->h
z{cCmmyZvMsV#Z-rd$XG;BeN?jBl8J!M&{${jMAd5jI*b)F`n!LonQqTR}JlFRG-XN
zz{KjB{PP)8^RadY=A+XYm``kH*g2Q^_;LnmQC7y;)7sE<u(~FfZ3mAqgL=fxN3Szj
z&SO4)oPqhocZTL;&l#k}+Zkt1Wo7j3HwK+7Fs+T@W?!S);}^&NG#_PWVm=|x#C*)1
zf%#}S1M^{XCg$VnOwA|C8Jdr$L+qQ{$|x<t!6+@(#^~7xx(^dntATDEl@@Jh0H578
zy`90g_hP^4+(vcdt;@kPhM*cx4SY%+=)_L`_sQ<8Y|O_)7@Lo|Fft!2VQfC0!U#Tv
zZCV>+Xn$b;?CGFU<wo^`uF2oOvM?WaVQM}W!o+;Ego*iB3KQ4|)7Th8`#t+Xqsftd
zjB0AFpn2i<AM9VTJ_L>NxPnG8L1QX{cTPaY@j;{bk)c=j2ZkQqpX|fN!|ZXCf!XgW
z1G76TQ?rLC6SMzUhGzGt49$L~Ow7)zOtWWjFiJ~wFiOkuF@kI~P8Vl1&N#tnobiHD
zTDX~EbH`E#kUPOQ%%(pE-{iAt#?JZ1J5DedZ(qtFJei#d6vD#6%uK4!laqznt=qpb
zB<CMzVfJukX!ZzYVD>9zV0KSs0NDbv%{W5>Yy&9nK{~BFjyW)@?`HqOkev3N$x(1!
z`=+VJY^e;8m6g1G#;w;G-WR+(1&RU4$X#J*Q$uNJQ-f?_+Z)iGJEtD3YVrF6nmq;G
zywf1Sd_n}A=9*8KFoO0Kf@4y&mC-nrmC-m=6f}0uaI(Kid|g-LWNFSerp>Ki7=&B9
zn6`CVbKPW6HhJ>veZjlK+u0d3lvn&>Xg=P;(0ptP1M{&h49!QEFo06;?CI@{SNkva
z&z{=KaJLs!zWB8nw`wsioBF=M@4)QvPDW|5PR8xr{~2aq>tu}WlNRk{m<>8(Y-%Ti
zV>W0%opEU?<L0lWj92?XXJ*g7*2!R8naQ~MTN<Nh-`RfSG&RPn{mM&DF(@zk#ngQK
z2t)I+D-6uXzA!W&eS*aW%w{dWK&~)u^#Z$rZ^!JgE=FnbE{56SU5v)%<sf^ax)_YB
zvKVjnZ+`C1sJ!eKL-R2aCgx)-Ow7ksn3|89FfC%c*yqF^+W!dD+gb37=~;qX3TVC(
zbiOcXjmo2J&<YhuDhI831GVl}wQTA%>wN#A{$}XI=A$l5%_l;bn2#S}U_Nn$f%#ks
zQ}gi@Cg#Im7@ChgVF1PcY-r8`-QWyLZ=0VUWdx-HP#UvlvvdTF#+>b+J*|yl<NTX_
z8|T4hd?Wj2&uC`=o!lrrqm2Q4a>%_l#)GM#`3_KtxcNs01L%%l<BAOM&A@N_LAms8
zAIR+3zRl^^87^G7a|Dt{K<nzj`J`~shh=X-`@KLn0)X~|8Fd+Tn|1E$1m)lUXRF$i
zU08*}{=|K0K6ZqG`PdbP=A&O2n2$eUkQQSDmq{1<&h~-QG32&oWs@bpf?79sJpt7Z
zUChT>m>?l+!qj|Jg$a~yKt2ZN{Hd)BH+xrgH>w7;g|)s9c>fDD<6U{wnmyE!(JR@F
zU8?z53j;GK)g6VTI)sfU`#`DgDmc~cn>w4#l404@kF%6F>}1%e20ASPoPIyte+s&N
zXH|Q$2&)+L4o(K>d^qEF4hCjr1qsHBeV}`}K=*Vxrh()kH411J>1-e9JTqmL7Ywt-
zIvJ$JI~k=TIvJa{ax#EY>Pv8l8dsiV2<<mcS7*F&@KM#GYS5_QvlO>X(8!=uwOuP{
zj~O^+oe*IHhuzUD49tg3ASvwxBo%|obx`>V%AJt%-8hYn(Ks!QVe>OFP+7zP@~3gu
zafYkC!s1*^O`?pG8z=6X3c6Wi*;KGkZNB_aHn{Q&;^X*@kq<$B2HD$uRD_B7gb9;z
z>njFO>IT&WAiJ8)Sbq8Tf$RarT42BFe9#@r(qiq5zJ1aX?F^vN!Go!w6Ba?~3KSY3
zwYmL){WC6@wcP@>q8g;xA@?b;dOeO~e**ITu6D-l$&y?QAokt8AaYgv->sn35Y_rV
zq3&ffD32WzVQM}K2?0c0!ctGIxi#x@huLARjMCz*;Ik)N89+OW52i_nwld`QfzF={
z>@V&0?4NM~lu|%;6mA8r8v(5eft7urJIB^_8FiU;T6M4LeE-3II_`C5pi$GHHqiL#
z`+)gJR<(mp?O|4R`MvWzuPP`_O>RBTAY69z|HoN=t;z;pekq%5`St!o{Q=NEL(uI`
zyf2|A|ASrI$pA`82h%_)Bopdd<I0;1;1qIL*<d%r+Wo6q=I;L+p3M1`q4sC9Y0K}8
ztRV5;?Wfux?f~6F`~JiKV`sO6W=%k6bnR*Zt(h_do%8*7S=;*$_8(WZPdvZ~KL-V}
zdPmu0$sf?leb9Qo_X%>(FxU4$#>OG}JnRoBpX+sP>fF|41<L0i?zgOJmpqA_f*(~u
zQZOit{Ms&oPj-&q1PUS3v&?EPzbA7X1)X5<!<t=<aW<Pd1FxD|YvHVqvyQbY8$9`?
zY$Ede{fGN&SG9+JWi|)R6fF4x3LRJugycNOw3ofi7A-$PVcu-f@(a|S1En`e?(=H9
z)~c-Zg28R-`-FctKsR}`Zil!86iTPs-hZgyvZ~$iD=3YDMtwo*4O!nO*j)pq4$=Lv
z5M=uUIXU6TpH(gIKj?oGJo>1>sbo<JXtt@@l;sbzSqo^c_Alu4DElR=TA5Xk{QY@X
zn$47<aF$xDp&IDkK>LLVJ=jv5UMHy3+}63R3uMRp_mU^k>kUw?ajq>0d;|Uafct&P
zk*r*Q!yn6j{d1~SnC-}Kwbu6z@_$<0wYrk!zH%^Y9{CLsJ=OZ&Vg9dD)5qnj{xKuh
z!p9-CFuXJcx1&IPP3d+ohQisWrZ1Z=&DGAJ*1E41wCYmX<jb%3ANEgC1)Yuc%bcBo
zQMk>EVRDN*!;Hg)v%qT(6Y36xwcP^6bi%)bpfEINXJGPby)<2U-SdB}`zu3DxBG^w
zLQmaPd&3~Hs>P^P+2Y6_Wt%O3-Y3|tW;SE_3p&eUHXAGG{>TsW-$LpdP(1@0lUVlU
z)Q59#Zas+mlk_9)3+RscW_MSHRW0i}?RuKsLm7-Z_jNbBr!v@eH@lZI?CW{&Ab)yQ
zTe1%;pIU3yhf6Qs2lzi`KJLQUd@Ka1E!hrkOM`0^a2PbIJGyK2Cf9!FX+G}4#C$x2
ziTPLwQ}eMDCQyq7)b_jyYPC#jW4PPbsHUuU<;P@EUxtIKW^HP%$_AjBtt&s?fABxj
zY}WFl*_7o+G9#<VwI|KTS(unXZ3Srg1vX2Jjqzgt$$n5d8rwgctDR|g*Di+LUAGt*
z)suZAnP*SuW|S7|VZ7MC`S~9PX{l}o<E&o{Oj5#8TuhtWBN^3ZCIA1zlKj_`bu)Vu
zqj8%iV{*ke7SLD=Q|;F<(6|faZV$HXN7YU>i)zeTLE|sUlb;JI>#_W3bW`=(21+}i
z-PR8AH=5Os{Cq6o`v37wwoh(ZOtlBM`*rEHskL5eegEP7-LN*${Y38*_AQ$Yy0Ih_
z+&W`0XaCP|Fs%|?TAc;A!Y=lM$}Ds7e{Y4^+3#+CuFh!A#vr(zjX^+p!Al0veSylW
zPBJL3xe02GF)|-J!pMC531jo|FN`QHr*%IWApU4{Q{AuD>eY4*RKqu|YP0<ax*-l!
z$AH>{(x8*)@3k|6PWT1avca9u_Ka~F<OVQMJp?LIjY~xtLG7Zq{hr`cf{iP8GJx7N
z>Wt>>41&swPBKB<_L2eQ_lsLW<jt_sy~w@H_W}CPR<$#$9{JaJ-cZ$UsyRCYOY*nn
z3^NW-WPki_`9H+!rsR{XY@k&hYJWhtFtj}ZrBP)ymOty-_klwE4=A_Jzs;<E<j<;h
z&wkL}vBy`~{(){F0F{uSdih-Idk6aspwrnvw(M><cU(0+x$G+gc&t6|>%T^K$O?)@
zm5{UTK&Q*V#uCA&FFsw)!X(N#ak@L`WLWi`!s4b3pq*~Lr^Vfw7?{o5GeLXNL=SVZ
zP8SEMXkWT&x`6i_XOU!9_lfgC_q0zAf5y0NI%16`%yg*!RLFj|Imw;pr+7nlwZV3=
zJ!9N8ozWek6I7D2{Q=cRm1kuVFNr^VALA*K3bI2u{262N(`P)a>3_{D#gh}h^LTv-
zdLiz`#30O-6%X1|q}6%zG-&rwqYHSKl^1B2mDd_(RZd3Lx$gtkZBBl?k_pB;w`nr;
zJY3KotBKG(R>~XH8JpET8Cz8zKmGCtw0o)9w37jJN*rhm2fQ!m!MQc7S~yQKRXSyX
z%4xM$Na-$a3L5!(`ue>B-$9T#NFFAq==wfj-A>T%Cds29(>MOl-TpP?<aUr6(5zxA
zd>#!P8_$=sK-~765gOiotESI!p6<%T(7e<&h}B)XO`KtNSQtYWo3;3HhUCZF8JH%3
z;;wmnx<6~$rs>Er!Rp@V#x&t9e0>>cS0Y61avw(Z*<!~T%-IweAZEAvG>HkaHBJJV
zkem!M6?WzxXdM$GjzH-gw3<-H6SP)(;c1z~$ztjZ6WO;-2dSHISjLl;eKu&v<&$s!
zdQUUDF}ibRw7QBUvZ~Jx4`(<ut&4rz^i5#3lgqv{Zk~3PVaj0{PhmDTj>mc5|A2Qv
zB|>*WJ$N^DRlDR%@Yz@35I%b2y~4XyptZiBu@F1(_zNtxO*aFb?!4?K`l^)ne~48n
z?f*dI7l^(sOt0oai0)%ov8_r0nSin?<s;AAL{`i-DU4@jQW5(@5j#6eLqTVA6dY`7
zU_2|6iC+b1<soPV;?4ezuQgAi_5M2bT8%o_wSe|9NuC7FWyAJK!unW#t>R`(48m+~
zr<S$8pJ3mT`w_H$UH)C+Ptb~!i{P~<m4#j}^g2Oj4=Q~Con{U0S9UhKO>SjXVRRE_
zWni7m(qQ*KVcs;&1%FN6C&*2kdIGd6`XD=G&D`elp9~<~jq0G0RFE!K*N6Wh^)JXB
zkeLAlKQI(jD}%~7l$C7Yv0_)o$*c^_?*-=Husy5xhtYji%Vf5eKYp#CGuYl2#P1e;
z+iceI2eLMbT^h2Uik)rF8|5V`j8h)Wcp(fL9sF?r@v3&#w~tCd<s4`qDx{nPm5<9>
zA!E`<f4vvje-%_lg4BS{`Gl2*AXP8-PiA*GcoNzYM%?GK3e;|GvFZe+YtTBZ*;7Rs
zK&xanviE?`dIX6HvkP#7cBpi^CW^lQQ2)yJW%Kr~|FEzE)!nnNw>u^uW#<E%vc2p7
zMt0EL6^wV(^B|bt=_=gX_5b~c_-CrvO*q2NmCVA)#v~~m$;qTPlXU?$ds<nN53qA2
zH>j{OA7^2J*|Cv*2E@H!mw{}D*;aqw_ikV)sKf&8ZUB{dptdSZpD?=s3&?MiSs7R$
zuB*S3`4c9~>JE}a*XtYVyB`$Spp#bpzJ$Grd(!qK>O}*`<XNH&TAh=B{o>!$y{&Us
z3)mF%R&Z#9Gs1Yn+@R0|&BH>&^J=mjt5CCfCuWEqVHbkv>I9on4mG3mzbn{Xovy;H
zouKf%m@EsrdjN|GhoNy|-uZv>D=7w0yue%nQVnqh#FYPMLSJHa#X)wig$G)_gt-Nn
zCUZ|<O703_hq($Auj!01cicar3pQaRG#4p1{ABoR(#rYs3rsyqXoKB8|ETO+m@Fi;
z5vli4mQ(hkY|wg0m<o`6<p}!@dfp5SJ-FXD^y79=d|>9i){~IDcYlHEQOvwIzgZSE
z<_YREw6-wJdGMa0L7Px6OFi;lAbvifTn2LuXzw}XRJ%=GW?j2Fwcz=T(S36JaW-h0
zHE;bt5h=g1x=(I9&NkyvC+JkwLQ8N7_3re?BcRxs+|CXST~PTnu^U!Cak{>|AN3;c
z335n<GlF7`L0~dBgF$iwCtGq?Bs}JX+u0eF719}z?O1no>j6wV7NXbzl85DdWrkl2
ze=S+L9#7%?1&S#~q|@+0yXKK&4q{(9qvL*%%D~W@;2tHY91407_5{)%+SIkJQ>)Xe
z3*v{?|D=Y|x}6u#fZT^Kj38!r{)f0HoH3b$i(@v|um4R_Oj4k=2B6-=xmkX*ki$i9
z%SJ5Wf*SVB$2l25ErR5BD`sRnL=LxdKAz?ITXg|)8RV3;C<|T+nRosdPG?t`+{Vs`
z8t3cQe7r))Ka8%q@Rkpx?s)zRQkSUT;5jJqROaRT5AqG5)&Qtg0BYBO_A-LnHlI}-
zK7vjp*Xw-mAU6TrE_=P42_*8~L9QRtKD*91-5k^&W@lS9eNOUBXlr@-4#DHQrq4;A
zd3c7i<a1Cf1-1{jC*7;{{e<(|ki|p`7rk8eH0WpB+fxr41R<^2t}UR}?5dW=_l~a0
zCR;wecepnd)Ou_-ZTXbU%W4F^dEg79+xrXmXCzCp8Xa_n)N!pn?*;gutZGT-W;I|o
zZTSMa0bnwF%Qs;*mam}wtrK09HCVp9H>f|O)tM~8%Ga#U^1WI0$Tz>gac`4eraj#|
zx933eY*xNz%a$)$4~sP&K1#E4GQ4+?YXJNI*>VO5pYK1&9ATah?9**PHxKZ91K9+!
z0cKk-`1Hd6N0a4PH9)o`x3P-|bGm$Q^tN5_-huBoEd0`@$|SaG3v%{C+uyv0l{c6(
zwmb*x`SV+VS(g)ZGl0Xp@2lFgS|1nx`NNef%vo@7jzjD5M$b7Z!qX!e#3Aj%nqAX-
zl3O|73;183;~?G6$?!Pw`@gI2Usb-!_R3k6v#b@O&b8{jfd18Y34ST-QoO3XTKO_{
z6Pp@ZRVPnpWtx0-J0nEZ)AIKM`R6;HtZGl@W0jiW(CE|XE&2NC*7pbWKFo1w<(b{h
z!;t*vH_x1u$unaZ4!S~gwU!w7m@~c?IDZ;+PsE&*du`%op!wuB{e3f;w{kKZbWQvy
zJTsbsQBrcjoD@dMQ`38r|5`)z9xZq;u>SO8*Mk3Z96)oK3$OR2Kx9<&-wW`cg84&r
zKeIZ^*JiaN-*(Pd*7)+}@np6a;;Nv&hpNT<3I8`}bqXGx%$~|H^DtNL%e`|PI-gHh
z2c0v|ZUs?w)cn1`{MjJ?GkU_z<jO@33sCI8Jg=<7@(DFoTRu+&$LjnQp%0nWSiZBK
znk*K{Ak6Oa-Ezg86ai;e)os%!90$c5tLEf3HYP!Ktu|0EbdJO0#Gn7P+M3mmd{fpr
z^6BjNIS!Be*>5y@>n><kclp}dt;_~mhuQK~+2SW?&E_{{JrM2kO<CtB!yJdlmEW&{
z&MlcdJ(_{l-EL;HdMCq7k6mrb3SYjsbxdYw`6|rD@?|R6ZTIK3a!a>!Gq_&W>ioDH
z=08w)GHwNtid(ZDs%{3&4gcNEm8;d6x*OEr1nnpStr}kk+E3)5cM+W0A1r4B-RtCc
z0hU%FdENauD6g+PEN%|!89%RNJ-=(Z@O2g@Wet_T%34$YDC<1=(~;cj!RtPmz2%QE
z8_Qo%zL@Fy-avjTtfd4h+hA-^s~p6KxC64U3DjHOlME|?_I18@cy}D^riaTRw<I{c
zJBI42=X;S|)m{K{704BC;QJb&F8MRp6?CJ^dxQF(RV|E9K|9);W`f-DC==FG1@R`c
z6dXi|fa+>UOAdUuObe`3Sl9X9p>H49RqvK_K+1)_y{N8g-?D1@gk;lmppa|cuAaX3
zwB0nBv?<Oj&&^4PtZd)TxNn-|g5=igEHm6Ex3e=nmY)6(bb^Mm(v&~S3Sa&xo0$CN
zNCNHA2ZiEf_7?E%GYehc8`w8M_T(elL!kN;!7B|#<%7Z*Bm!Hfd-rwd$+M?GBZZ)K
zOXuEPdeQdBtjnk!v{rYz8F+o}cS!D4`>EBruM@O#?tMc14aSq8u`;&GXPItUpb;|A
z3Xx@B>{|D=yk|HN#(GdDap&<l`74hHwVi8inhsJ68CQd-Zghi~nf3{EXWM&+_0L(4
zdbNtHfqHCeOv_r|H^{G)Jh-f+aK9R8Us|B=&t)YbmltkdR#F-oxgFGxg!Nc&IJUYc
zUwF<G;X21P`Ok9(jz^&Nw=&1>xW*iV)o7)mh#dhUiOt*D{zH0j0<KNstnQ7Ijm3{M
z7(aW?(D_u@{ri98GRUrbkh%$nCqi3N5VatcjgxQogKBT)?QH)A*<}ucY=O)W!`wuw
z9Uv1xH7_WYLE5Kke;PQnIzg#x{kLRaRuRyBRG=OqqnlUj`-J#gps^QFEQ5M^YORk-
zKyeDX{Xkp|RMMvDfOgxzchJ8CF1ZDm)m{E1M?DY#s{oh9$8LjEv^c+acz=FXd*xZM
zipU3iGn^;0Hn2iUTviFtDa!8|;@@j^W}cmWt%Y&+^cF^C9aHdX_N)Dlsk5iGFo1T$
zf^HlG-9GlR=W72^(D}80W=|7m*gJ3bG&Kg$$;z9iDI44bt^4^S9o)_cn(>+~*3JkT
zXWaZOjR7?O09uui*)Pn-#yWetIzwpxrs<G!+Vv@P<<u+4$|<%d$`&gbl=WURD4YCb
zP&PQpqHJ-KNtl(B@jU~B@v4@`Y^?82LF+hHp7#v@pS|1*^0ikhB*nR%1&tD}2krD0
zXZ`Rsq;xN6<S7<@hPgmuvsv5!g=|y6Hz`TDwz^wSf6f3}D*}pfkeqNw8-udK3x<tw
zHK3E2TOUq7{{8>ge$br;4vfs^ZT}5XQpVN(M)kY!Hke2v^LCI53GmK80oPXd-P4aV
z%zO(n<0s4vunI`(0;P?cIK&ZYrh#Ksr(P!{?p*(Xcg8WyzZ{6!r%8z4runql6h5Bt
z9g_3fE**4(v<}<f&-nw|zt;0$!jmf}W_$sUE-*02;_3H*TOUuqyl1$7o>0FBkxOJ;
zo42+72kq)%oNP9|aJB$AJU}5md%8Kp<Ztbali5G;@1B000TePH`yru$p4Vhtnc=1w
zO$X^LoDI?|%+AgNF%i`iNF42+dX?dBFAq5Pg2ESjI39ft2}k+;kyyg<{z5~faCC=;
zBirH0Yz)xdeak;$3&{iyLLuq;;5~!=Zel}nx*BN2uWc{-h#&GkwDvzBUxG>+)bKMr
z2+_T4Cv?Qm72iHIlZQNig;`s%>_ZbhD3Qo|SjIKPJ^Al-2AO>PqkFPPWfFUjUvZak
zO)k35G^3dJFf3KXxVCoBJUn@;C<Ed|H&A&GD*u}rSWn6%PKD?zzRonGS`?=~h%XU3
zVdhU~|M!1#yL)@_gm42;Xn;b6VHA)R0=l}oV125^Rtg2Vr3#sOnI#HoiJ3X6DGC~?
zMMe2V3aTlZTnuG~dgdU7T>b^AdBIMe3aZ6iAijcvLVSFDyaE;g5|4+-f|*<j3i=B1
z@d`1RYC+=h@ihtx@d_~@v*K&G6lxS|6hH*X2#75TU}lYi2FSu1g_?Lxg_;@#B&7=K
zAk+0hra+i6AeAv-b8SFoflUQj1l0|4ygo=mp$6ncO%M}mYCM;M0!VwjevN`&e7ruG
zQxgx;2v!@f52o}%`asTwdJ60w7(2d(3mixc3=E*~%`7TR&d4ml8OEUS1gk5^#Hj`(
zUy_rAUp_N8wFsvQkS!4Rq?M<Y5KsnocWyyNB{Aw!@^ce2^AyrD^AdA1t5OxPBqOkS
z1v!Z&Y57ID5S92%2Kl$RI2ETNkbG)#VonZD6%hXh!0hx(%uR*H4~(*cC1wT&2Dm!6
z)Wnj~qSRuTA_WBntm-@*gF+OX^Gowe;3};YR7+v;4mZy;z*E5`wJb9kVLMjyLco!S
zq7tM|!9hVar_`eg!(8Y5yyE<vRAjS3>M_)L1p6YZ0XY_{x&Yr$qSOVYCgtaspeV&^
zUT{WfNlJcs9+FDz>Pm|XQu9)flwl8V=YRlbWJPH4;+9#ITb@{ys^FAZj0kCvZ$a^A
zP@$Sr0S+3tx?oUBg~-E5D+SdQ1#c%*bwS|@{%L8&sfcJ+uu{NcUQoCKx{+AT^GHoB
zKr<1md0=&@CPK|q&?w0-NzBpIfjCz|qbRjFwWusL1tC&ejLb_bN=?-S`-*`9;s4~K
z#FFF;WJiO|cS14VNkIc)mXm@8+^C?^ypqh^R0U9#5SCh0oSB~o3r0}<rRb@qfNcye
zNz6-0EJ^_@bgd{!%>yZg<Syj&;960TT9lcanpcvTgRT}?9n2C)?q*<cg;rGx>8T|p
znR)37zMjF33K2f8eqievoIr^coL4<vV0vLRa(+dqbAgm*FhywT452QdD6>of#p}rK
zM5qHNNRXr8CSq3yQi2*l*wqF224I#ukiceOK=Ln0oqJJYUTIEZQD#Xc#2=*!Ntq>}
z8XVz1kUGbdl%mw)Vg;wnl44MPfkqyRdA=S2z6zdsY5B<h$SGCOFsM*9u&970Fod}-
zsY#{j3L!<A>FKFO;0On&uM(&LBzhR&hAAk3qZFYZ%mvpQ(E6pgB(bQZv;b@M0#*m|
zNpgN(T4s7_5%yY$fgv<6J1@UHk0CcTB{e5Cok6u&2W(MZeqJhw;hdPKke6Sgkdc^|
zl9Q^Cn_rZwP?C|D2g+*&sYPiDsb#5o;1C3<hSaC<dJSJg3ZfkBPN*9cN-7Id6*Njx
z5=#;dp=E$VNM%8)m4a#xsO<&P0;=ag)f^~kXCxMtfE|}uT%4JnmzttblCMybky)$&
z2_aCBg4Bc5sis&dlz@r}1z3P9<flPwRLv;`*#N1kK<ZQT5|eULVG2R@4Hwv*AbV3&
z6v{J8GV)7H6hQgCNFfDWmw~JTIgbHm7lc*-HBr(s)AAM4N^^2Ric0e!A(^6(lb@Uj
zs;x^>i;7AMO2E1q7&3EmQq#fW#U(|h$t9q21frt|8qpAixtYa@IS^0h<R_*;;|HMz
zNxrxQ6lrLNK-vmuf(#4{V8hZ9OLJgRjxZ8zF~l(33R3b*Az_zTfZ-;P0VPF=1qwx}
zDVas7$*=}CNE{UIkTA1S0I31RmufLe(;K9WA-AL~F^7SHAvZa(v^W)#-Z1sqg7ToD
zSx$w5YB8J*3Vw#%lFYo~5(bDlMhpzO#U+U)rNs=nsRhX(3yKRsBm+ZHB7`o1^3$Po
zu^~jf*Z@K&Livd>zA;qX2uhnmX%i?7?maLtB$`3^#ZdLdQ1!)7^~F&2#ZdLdF!h#D
zeHKvK5aNJhLx=-PAY6tL2$!J*YJLgS{1T}7B~bHApypx^f7Gx8*{GkKkzbse$B<u;
znpd2ZsRJor7#NBxi%U{-b&Dab7u}LnP#`lfFzACcf#NGaB^4BJ`pE^Q#S9D#8L5c{
zy2Y7Q;6jFhfgw3RCq)<3lF|jmW-&Ow!O8{a;2;H6<qEJ#;fa~xYAr3lNFh0=w74X-
zNI|t!AsLj!RZA5>nnC=Md<AgvsHdl=5FFwd67THq=LYf(q}9W~kegXhtW#iNZU7CZ
z#JrT$;*!+l44uT1<l@{?uw@Jk3`pXs#-;`gi8(ptnR$7sMLNZ$c}51Ax+#zVPcA6c
z&CAa#N-asvE6FT_c?-oKpggJP8{wmnnwOlP0xH2&Q(*RFrsgK5r4%OTBxRKpl;ve)
z=NFY%R92<K<U#S{nOByWlbNCb>y9db0wJ}c1mv%r3Wc=NykrQIi-AESuQVq|lYyZ)
zDKow}ub?P1uOv+YsQ^>(3-$3)$S*A^C@oPaE-3=JCNVDsE&^%|W)_1>*Q(T_d~n_Y
zxdr47)nbK${NmzFP(}wgC2|vsvlTLn!Dd2L;#QZDSgeo<^$8@pK$SIAeNk$9W`15V
z!Z4^fvL=Wcg`~vdRET#K@{3YZi)>YMN)^&_64Svs9@@MGhrcSQLP&*pCL^&dRUr-5
zIEEMnax&B&n8Wf?D@qhV$q^JT#U+X9psFt=717Xzs>h-(5!!YDw}};!6Z6zd6jCcv
zlS@ldxfmEAwJQUI7AP<o7#K96v<8$>nF`7s3=Dbs5D7@@OEpCSxxWUn9OP^UxIChv
zpr8Pj2ZbsFLLL-R;8uqML>^*1gKDvAifS>EIzN!lq3s`#Ik1uxY#WBUqI5&3d3e?N
z=BI!<At3Xh_QKsA1def41EUmB(+8viW|A(90cr{PT7gIg2GwLwunDTkK~OpzN=HEG
zVu-q6{ZOzD=<p1KuWoLBN-7saFq963(UA5J)OSe!3$82<N`-cFK(2xs1b26EWpOa1
zu!DprR34<XI57{@z)a3aP0lWc*4p5_ilst>n+K0SPZyBdWJqfU-tYvO3u)CTfZ9h2
z#i>Y5KTtV<W;RGYbld?}7J}2W0w^7T8gE$ifC3Pt58i%*SXdkn8Vu9Wg!u${I1HS>
z(#qqD%H#7Py+UZAk*H9RU!Gb7YGfIKo5VSg7BR^DwDNdx;j92Ea8NXZTAI*i4KzkT
z>htmya#M5jiz-0@qfi9u!9X%@F{E9FMIKbJfJ!B(DUfyoBn>F!=jBu?Kn(!pPmrac
zVj(CzLZKkFC^xeh+$Do(g|&Yn^&F@jU65M<b_XPI6jX~9l2XBq5tt((Mk}C}1NlV?
z#h@}3QYt_LDKk%@C^0WRRS)D3Ur!fTA6IvfhhYhy3*>HJS8U>ChI-%{A4G#{AP^0z
z;!7dvnE{liq4Ajt>t!nBfyR6?ixqP6^U_m`Ano|1(zLYHB4|Sk+G$~6U?|Q_%mg)o
zigQy7atlCwP(vv-H4kJcNWM5ZKdm4)4a#LGE-nGLpQ<vG^Gb>s7^*Te3UV137^<?1
zz)Fg9LE;Dv72t}s0AA5nWhN)(SAp~;C*|idFcg;+B;}ScFchbN+Up?ulZ%To^WgPm
zac(lC!vZ#)fuXn<O};oeIV~MzPGSnEGA=GlOaWEu#kqM9cV#B0W#$wxRDtN?Vus@4
zl%$-JB4{fQY#+!QAakKKs{cXJ<Qf!Yr4W*l3Tbs@f~qxm%?4Jj5UrY18VgQHV6|?L
z@#Nx?d{E=Ks6-)J6)FwRM^NdKe1*j1WKj1L+VD|GE6UGRfTUiicfsmm?ScG)WKj7E
z%F!SlMX8A?`sGELC7{tlcrOB~u_&`RxlAWHCo>PyLM+Zq%PdPp2$W=`CZ^~lTN)VX
zf)zovF(8R2f+ciw!TleYJj7f~DR4A{+f@ZQxg`b+s>K?bRtgwCEzT{C2bF8!umYJG
z>>FwY4p-F_1&sjbVAT{&g_L|~C0<-wP>^3#qL7oBo>8JuoRgYbpa3b}8Hm!C0@8q@
z4cc#mS%vJvf};HNqQqQ<l8jUZ(8yAWLRo5ZNq&(Y*saASDfy)(x&?_P86amfB&XyR
z>y#!ImFN~37FaN#@(qm`Km{K-#IrIi3=Ir)K}tay(-Sj`b5e_R5(|>RLZ!(`IvFLI
zY0%~=Ls4p8YH?z*PH}Q(nr@M0qJeq3fr&8#Lvco8c1b4KMzB(7e5RF}ni%LN8^CRV
zii6AstINqONv+TUksu)khP+}!GgDIo7!At$AZIZY=M@y|q?GF>79_#l3X;goD@o1K
zsVGiP%t=L-sL08y(5WaW28)4=*EQ5LFwldWXH^2}=|a*=Q9*8|E@)U?H#sLiIh%oj
z0bLy0ugERV1lh{Kpr4qNnOF>MBrz~B6hOML3^|#3r4>3b9;iQ&TaZ`+YNA5)LCj4o
z$jJm3Qw$*YgZtgZy5RCLB^6S%K-6XC7H1}d8)As`o0psl(rpOoF+kLT1i-<`01aP|
z0LaIB5K#u?d;^jL=Uc=WfM-x3w1&r$zlzH<Vc`MGS70HqhY;=p8CzTq7Gz*xNC6K=
z6f>k`7J~*cAf5u1*N|>51E|#uQVVV}gZgE;nc$WttUs3m9_@p7>)`!7s5q$eoS2uK
z$^fb4iqYkBQ*$9QAUi-9)=_|V>li?7YA_ol$-uynms(Mxn^=?%s>47+5PnJuq}G7S
zgYq^=666m^KNFl0brW-P^2;F+2Tdoi{wG`p>Mvc0`(fdUsCOXo2p+`JEy>r-%_zuC
z22En57J;K5njTT)!5pY_pz=kD<+@;D3^R&SAze6dJzvbg0PA4DS_dUXiFw62iJ);F
zaCrjG2fArRsfDGfdC8Rw$)!a_sd**3#RaKgj~1n->w>Cri0c>_^0N~wL2k(hWgd9^
z$Cp$VfNDJkhU5ZJtq1crsBYCw0%bK=-y2kjgVF?&l_2Aw{>m&)gk%qJiwGnE39rmz
zScV3<r#K@s4U(%FK<Pp^GheqnGX+v0g5)7BLy&HmJJL&2i%WDf^HNePbdxemieciQ
zW*dqy)E((X`K1LY5)gMFi$h!i5zi~l)y+%+g;8#CrfxwZC<u}5PtM59Nhty~W)SL&
z^Gl18;ROps9NfeJM-D_c%$-p2R2V-mCAAEq0$eMC@)amxlR+&fh<LbTke{cYJ7@@7
zA*Cp@3^XxWtdNR4$`5J{=O$JvBxiuygy7TwYX5<?Xs8xzBG2rBhK|81GE;I=b-|4d
zkZ)n`L5M<Zhlv*_Wx|JO3KEMFa~Z&+kh&np7U_c8B{21=c_l@ax;cp@pj4;}9<l*T
zrB-B?APeVa=IIut7H6iQsVh&+PAx4!RteS)N{_k-*A+A5=9cQh6Dw%E2$ZuylQ+7M
zCO<?MC|yD3bYQ~Dpw_f*a%xTv#NW!$3<VPcwa-HG^A&Ov^D0pr=EVvn`3h;76{Q8B
z8ax+Nw!{~u7MH1}IH*?Ws6vLB7|_HS^73_a6ANJB2(Gu13ks4Mk`wb16Z3SkQ}a@a
zDoavzvyF_wMSpRAK}LGMPI8%{g@Hj50|OG@&?p1WFHScy09Pnbc`zT;jz{8~fQITI
z^+QR9p{WtX{F1~Xa61BCpz3CV3VWpXg}I@jfiA41Ll-ZuEKV*;XJ7!AH^q>2mYkRe
z>I;F|j|v63naR*D9H>ACjkAH%8z@|%>L5)_912y76^b*UGoFw-32K^Z1!VjRY#IY{
zdkExSh6-J9zp+>+v7*4x)W8hvSx~tT2~SY?m>7ZhkajD$odZfE#YlWmiHpn!w}U{6
z5c)E}%5_Wga#9nEGg4D@6Tz_n2?s>KIW03UMIj~8(!k6Z+~)%&&JwW8!QlX2!~hvr
zf+`B|^>hZy!|gXW0eb<NkIy~1ph-w1_oU>c>p;wgcmUQ8gf{`x48T<<$UU&}Qb*8O
zrb2+PqXMWq02w(g$W6qO${83?#6jVckyw<PqMMSNs9TVqp95`Ifw(ED;8A~wGZ<Wh
zg8YLNAgy`$+<ppr13e(X*AbM<7*N!!D(6%v)G2_e{Ib-doWz1+@T>~R&ESE5gaUA2
zGN9^r%*g?%Q~;GxnW@DJpw7EOQE47%@DiJPL~jE$o)h5f=;-1S1Z{UA`vaj49Pgk8
zKgfzosM{RDE{0kFsUN`Q0BX|%8a{~jSz<|Yc}j^9G<|{EBf5~P2COnOub>oEcP1u-
zMvZk-Qgae3b#sduGV{<yz{(lY3o`RT1ukgr4<rKSgR@M28mKdlTy7ZYW|ZgV=jrAq
zmtq^Y)-6vd0U4DFvcI4xGaoc93NjOfVRd#{VooWjB>@^t0f~dkjeJm%4=Q&+>7}wb
zIX@4QX+bW41O~LD1kFg%paLFLW5rr26s4AcSkO>JDNi9<p)M*)O$V2^d5Pd~NzF^i
zOazTR<YbnV<fQ7t`AM1S2oBsmFmplm9i)4ak(ig4ngb~#LH<zAP0Fu;RTiN7Iw`*b
zRQZGQ5v+|?Sejaz8lRb>02;hWEds4si3hhh;xi$GtEl~z;*8wXTwRd4aPi`t{1Qk@
z3uG>c7Z0kp6l@f7GjsDwa}_}Cyv(B16ouT>;$qM!Ge{Z~IFR&JV3eqvlAm9cl$w*H
zTU=QTYR!OKP0)5xqEP`t9u`#~?=c|DfCQlBPo_~axHy9L>rz4Url4gax|v3hei3>-
z0TTz!Z-5%tuo(-8`@rcxqd1p=0mjk=*Q^W-%HV{FsGlL+{JfH){G6QBB8dHYMY<qy
zPz|03Wgz!AK|;Eqjy@<}!3DMsNC@l!baxh47V8#d<|UUDfo7SI>Xpp=+|mk!6lf?j
z9yHkmOTS5(@ddf1;2}<MI3;DqrzDjW#X}~6;~}F@3=Ci~5GOsgC>}ic3Q`T3UjfVI
zmFB_~gWL-<2dp+8oHjr@R`CD(KZXC_|2_Qw{$Jq#_g_!(-~R;)|Ni$W{QK{u0O5ng
z7!>~f{~`bHKZpk59)*AZ|0w+X-=XmD|22hw|3Q2ZzM$~$|0#uk|BopA`@c`&-+z!D
zj3A-`M1WWV3=9nd3=9na|1&iF{|}lE0=M?!!9`7cPJTXk%qvO%-~ST*fB(1W|NH+(
z|KEQngMa_)^#1+-rUx;TgMonolrDJ~7#KjN@i8zkh%hiP2r)1)+%f<6AB2l6Aaskx
zzyEVA{{8o``1jucDkg_UgVe)tg2g|GyNVJE;=z+!3=COu|Nghd{rkTt?%)4?asU3`
ziu?EfTin0@Lh=9p>&5^3?-l>=e_H&%|4s4#{?Cj5_kUOXzyH_b|NS?L`}f~3?%#jV
z{9b%=aZx;|H4~p#3L1;_%l`MDFX!KXj+}r0nR5R9|C9ai|F`Ua|375^`~NEY-~T7s
z|Nh_0{`dbz_P_s^vj6=*ll|}ivFv~U4`l!QzbpIS|1H`7{;$ja_kTt9zyFJ}|NWnn
z{qO&@?0^3!WdHl$mHqF3OZLD2b=m*^S7iVDUzGjte@^zl|7qF({wHMr`yZA4@4rme
zC?3c#2+98Uzc2US|Bl>$|C@6E{jbUW_rEOn-~WQ#fB&;`|NT$N{r5jE_uv1B+<*Ur
za{vAJ$^G}=E%)DlhunYvt#beUH_83?UoZFHe~sLK|CMt8{g=u8_g^gc-+zJJfB(61
z|NUpl{rCT0&cFXZa{m4Ql=JWZo1B0DpXL1f{~+hz|64i#{$I)Y_y1hZzyBw4{{26c
z^Y8zjoPYnf<^21<A?M%!RXP9uFUk4$e_qbN|1)y_{hyTc?|)CuzyEDH|Nb}R{QF;(
z^Y4F2&cFY8Isg7=<ox@el=JU@OwPamVLAW)2ju+w@0IiKze~=)|8_b5{#)ey`)`!<
z@4rsYzyE4E|NblF{QEDJ^Y6b%&cFY1+5i4aWdHjwl>P5NPxin6Y}x<*Gi3k!|10a?
z|1Vkp{+nh0`)`o_@4r^|zyB)P|Nc8=|NC!~{qMgANKM+m|98^<{bxx3_n$5O-+!L;
zfB%Kj|NWOp|My=m{oj9;^nd@g(*ON8NdNcWEdAeqoAiJGoznmP_elTu-!J{&|B&>5
z|D)3X{ZB~$_dhND-~XKSfB%cp|NXB>|M$Nx{ontV^nd@m(*OORkpA!gwDf=f=cNDp
zzbO6R{}t)~{;vb+%SQDJz4NkO*1!Lwc;LbSRF*Et{r7)X?!W(2az|!fM$Vhq@-ir&
z!tyLAFN4ZFP`wALe?a;5T^fD!?3VO@|97ST`+p!E(vARC$>4zlXq^n=BURB1pfxh_
zko72_1`K%p3V5wrJY=9BG%ozB;NO3q!hiph3jh6YDg5_;S>eC`K?VQ*pDXzHU!dsU
zf2pE>|8<J~{WmN6_dluV-~Vrg|NgTT{rjI)^6!6F$-n;}O8)(yQ}XZsmXd$}kCpuU
z|DxpIf3ebk|HDfD{XbLw@Bf|hfB&DA|NH-`{NMi{<^TTcRs8!ur{dp#iSmE{qbmRX
z|55qxKUdYi|0Y%c{<~HE`yW;H?|)X+zyCKX|NVba`S1Uhs(=5FRQ>yZrRv}R2UY+6
zzo`26|3lTk|39k!{b#8D_kU5<zyIs1{{8o>{`Wtv`rrSG>VN;+s{j3;QT^}#s_K9L
z)vEvfx2gX3U$5og|7*<<Y=p!Hi6P5@_*PJPEhr5Vb87kbzpmxqe+fL;2ag=OzDX_r
z{&!$ek1Tc$NgiZ2vi)12av*V-*&sFpti24Ldw?{>LG4t?n0-8K9|cGmI6XkcL0y27
zQgG{)fdRBCAU-iAB_3@C0=yO@vnn+nq6t|)Y+MU$ZaV`50}~Z68xdwSF)%Q+fo+BK
zA3&qt@#(20@!**#@K8G_3xHLC!T~N1nT(GIFLDCQLiHEt#)H*>I%uhoIdZT*n0QfY
zacOQUC?GS7A=8xLaL7QD2L~utb4wtd1ZX_L^&x41*#{aQ1{ne4L)--#tw6CJ)qco`
zH)v5v323ZA=)u4L0T2HDpZDP3|4k46{Ri>aJ^1(E>A}DMT@N7T2xPDz9y0YEpP5&j
z2eK6tgL*&=4h#%nngL2Xz!;!;{?d5pbaFg+MmQccAPnj){r~^@|NsAA{{R2~_5c6>
z-~K}YNDRdK_5c6>-~a#r|MUO<|G)qL|NjRP{Qn=^|JwKG-~Ua2{{6r5=imP~P#PqL
zj6rfB*Mesn!4Y4SmzWcuSyY&Y;*+$Ll6c5`0XSd8Csjfh+JH1OFff4RL8FqOA#+gL
z&o8QshjziiDnMx(#9#&yp!myx49do*fF}y$!9z!|%mJED&CN`X&o2OV$-z2`!Ts*|
zv{G{u15gZt+?bbH!T=eQjE6=8$OWKLB(N69LM#RbP?wQ`pOKLf6!uCP|NqNm{QobO
z@&CU-#{d6)>7-$<jQ{^xGXDSnm;V3%kM#flKc)Zw|0eza|7Yp{|366o|NmC{|NmFg
z|NlRi{{R1p^#A`4rT_oGC;k8bZR!92Z%F_DKPlt?|Co&b|HCr={}0H3r~|1b7JFs<
z|L>CV|G!<v|Nj;l|Nk3h{Qs|$@&CVC#{d5c8UO!FW&HmylJWmPU&jCc92x)rGiCh$
z|0n(b|8MF4|9?pT{~tUa7!S%7pe-Zu1-Z}(w2Z`J5GNi~80F{1Lx)45>rTPyi&INL
zD!@St6Nil2CZ<3uQP?_Fkh*w8?YgV<|Nm8`|Nl3X{{J6T`v1RD>Hq(qO8);pRPz7-
zq>}&tlS=;oH!Au6pQ+^k|4YUH|1T>3|G%jC|9_|A|Nn)G|Nnnf^#A{+qW}M!ivIr(
zD*FFlsp$XzPlf;gA1eI+e^TN9|4D`a{~Hzl|IbwT|No_e|Nmzc{QrNY^#6aRvj6`L
zru_eJHs$|+o+<zT|C<cKB2)hVmznbazsi*V|Fxz-@(O6&2r@bn51tAI4flXkI@G_#
zxrOmX6`*`t7+(UNn*m9I(iALhgZMBE5{F@!7_l@nyp$kT$Edo|5Eu=C(GVC7fuSA(
z2@EV?FTmPKSH!?vh5|J4S5WZ{XyON;;ycj9n`9y896%F?@lW6ozkw$1qY5$S0h;(R
zWr+9-H1Rg5_y;ucB&hfgG;u4axB??uIDp#93=9k!XyPeQaRW4Q7~cYicmp%4`Eq^`
z_jjO)Pk{0lKxtUKtbp=gKxvq`UjoFO4`|{kQ1KsV;xIk~3#xly;s$8qJF+0=TcC+I
zK*b%<#FL=nE6~JGK>0hMG|c@U%pmT7$-~5tOn}&X0ZqNjM2PqeH1Q0m_yaWYJy3BD
zR){??^S?mF1<=H$CPB=XKof6)iYuUrpM#2Ppoz1DfLdb=3<hZ8Y{?LD3p8;lsCyjH
z#C4$J9%$k$>JW1R(8M=E-P3?3ULgzde+QblfE+}80-E>@sQ3&taRGUV`UPm>6;SaN
zXyOqH5cM0-#4kYkJD@ZyUOd<!>JOlaTd+gKVftX|UqIE}fYLB=qv?=%gvrCiKgdE_
z&l*sBVB%+HLDU<diL*?Dh{N0kQ=b4;7XYPU;@4(F)WhUq;u3NYdl#UoSC|V?zXDCX
zZ4N|S0_ty=Im_lj#1+uQeW2n7XyR#5aaj1l%n5+1bAZw?@hS5m=ELM+;u=u*7oe$k
zfQmmr6F;^9V$KUR@jR&b2Q+aQ{|63n4h~5C!`w3g$`^prF!38uz66wpi7RkI^edo=
zXF$a@(8M=D#SPHJe?Y}8(8L|MAm%%uiFZK7J<!B2K*a;l#3i^P=0u>0CqTs$(8O0j
z#WT>vKS0F`(8MixAm&$~i8nyS8_>j0K*bNBiRW#E#P0<(@c^he2Q-{u;ok)nmp~I=
z1{DuL6K~iIF+TxKJP9g315Mm#3q<`2H1Ro5^$*a*g|<S}e?Sw@fSRKLjUSl%^`Po4
z(8P<N;st2p@1WuhXyW^z;ycj9nYKgRa{^6VY#T(J0UDn$_iTWw7eEu2gNl2giTmt;
zm=l2}ehsRA0-AUcRQ&=p@jj^d4K(p%Q1KUN;*X%>3ea=}bN`Ip5ce3MiRVGZGtk6W
z?SZJTKoh?KRlfmEJZ3LM{Q)%bGf;DWpov@TgQ(}=h2#&IJ1d~(2%w2eSVGikpozoy
z1~|kY@Imy!%!lz`;1K_TCT{f{;!XyBRCDG$frxXUiJyUrOQ4BMK+RD=6R&v+F-HSU
zd<j(C0!{qeGl+TzH1Pva^&V*AFQDQPXyR9(<|Lqrzk#|x15I24YEA{3_$H`14QS#f
zQ1u;X;t5dk8EE1Ypyn(<6K8>nuRs$Ifr{@y6Bkg0)cYsU#3i8OH_*ftpyDsk#0{Y0
zKhVS-pyC_?sOiB2DlUO09sm{BKogIEid&$GCqTtL(8LR%;t^=#4N&n6H1Q6ocm<mH
z1gLlin)nQ;_zX1h1yJ!7XyO~7;ycj94?x9Fpow3Air+vJzX270fhPU{D*gja`~_5;
zLl8CmKS0GL(8Pa0#Wm2x8Pp)@!~#uR04nZ*CN2RLk3bVwfQl!ei8Fu}uz}8>Kojp#
zf%GE^aEMpn5N|*e-vc$L15F%e{sbK2GjND6z#+Z@hxi5@;yZANA3zgN*$)Ya6KLWv
z_g}yveglX2103QnaEO1vA^ro0ID-&sdV{%>1BbW(4si(_;tDv#HE@U<;1IXKA?|=f
z+yhNqKot@%0ched|3=^tPrxCbfhOJn<rhF{SiQ_43<+PDJWPBBR9y#@hKXxH`{OWq
znD`55eq4a2{)H<fzpp?O{{dCM0ZkmHeg~R3hdRWZ18Cwmpyr=I6IXz$zknuw0;>K7
znz#d0{SP#87@q+ePB8z%#9`qF6IXz$6M)h%aWhRw{KDj6;t^1L9njQIfbu<{G)(;q
zC_ey7!^9OtAn_Q1CLRG5Pe2o&02R+b6F&hJFF+F)5QUgufhO(&6>mTj-vAYd`2*(8
z6;O3EpfpT;hc+a9VDd0=4-H7X??6)@0Tn-iCY}KmhlLZ&90sVrKA@@p1+^C@4^!U&
zH3t^1FmVg0IT}zJCT^nxaX(BRCO!db4lEvE;ssFs2~Zj)z6oj$Odck_0BQ~_-eBS@
zp!#P(X_)vIs5vlsnD`E;Ik0$!i9dkqzW}9S;%2%Kf5GHo;wPZyd_YtG04fekFEI5Q
z(DWbyrD5U~Q1fB(F!2vib71KUCY}J*9{{Cc;`^ZHz~o`#44RPiQ-G$P11jEtCN2RL
zpMWNA02PO&Ynb^bpz3x&X_&Z#9wgjg@-T4^s5u;Bko*J_4}z+fKof6+iaVf*7wJRH
z4?q)N1QoA96E`z}sNaAlo?-|QKY%7a11kOkO<cqXqW%Y(xD!-dK^)azAE4p}XyPiy
z5OX5X#3z|R#52&uc}yYV6VSxxm_fuBpow3AieEqzH!z2&zkw$H0V@6hO`Jml;-4Sr
z;*t<?m^>^V6`<+`pfpUJ=@!IZm^@6p0Gb{&(9}CX`5sUjralA8=YZM|6IX!p1)wxc
z9Bwa~cn8d0G;s$g-vdg+%*lZA1E4faJj)8=uLv~p5^IQf0-Cr5RQ(S$aTuRL3KFg`
z^I_r~XyO`Bz5tYlsZW6NC7?7+d<K*c(+3lGfQlPHX_&YMbY24{4-<a?4L6uQF!2hg
z{tPG$6JG>12PO{_=g@+bOE7oA#5X|oFM!f8afvWUc*5l2;!txAps6>2ieEqzcYumN
zKogIEiVH}ihW~~bh`kbM;swzVaR)T<Z&48O05tIoC_e&9!`%M>%7@9r#2cXE1yC9$
zt_7V}g2}_gVeQWjH1!kQAmKa#O&r$#oPj0|Q@;RB9M=9^fhG=9zX46W0UDkM(8Omz
z#bN%2x&H@L-3urU6MqKvFH9aLz5!~EgbZqY%}|8!70|>Plpx|7XyO~7;s$8q6;N>t
zH1QeA5OW;R#4kX_J<!BGR3PdD(8Pa0#Us$f4?x8e(8M>WLd?lP6ThJj5idX!p8(}I
zKxtUG!T23G#9{hi>Q_M3&4AJ{@e2zf=^Q2x6W1_+q_-Dn>X$5msQ-W_uC){*{sT?C
zV*x}wLKfmbnEB73>J!k!cR|H7(8RAm#bNWJFmonA)ipqAn7Gz5h`lg*n79ShUo+6u
z-+<<?1!&>{Q1vU&#9`_;pou3y)$c$Php9h+CSCwle*#S$rv3t&cmq`Z4K#6>`Uhy@
z6QJr}pozoOe?Svo09F43P5c2gd|>m>u<+D?&O1v$X_)v8X!yhAVd52rkaXpNral77
zhtV+g1yJz>C=C<evK$h>FnO4G2h{uxXzJHN-LnHt+-N1l9N7Fh%$yHUbq}C4OuT0m
zL_JI%CcXe_FKoUYCawXUXP1D|FmaRB5OZMiF!2pgb1cx*AApK`pow3AibtS{zkrIv
z=J{dfPk^dxfYLDWDNy&o<YD3gMv(YgfTlhHD!u_tyaFnI0Zse?ln<j}=Kp|-zkt#(
z@ncZ;z~o`#Goa>MK-Ve2#KWNK9ni#Atbv3xY+VCPeF0Qm0+fb{v#o=uhsndlS3vFE
zfu{ZqbR6;kns~$kh&d<F#3i8O4AA-wW`5pbh<Xk*@gq=i0W|RrsJH~0_&=z)1Dbf>
z5s3L7XyOZ?;tgoxcaB2TPe2nlfr`WGXPEmpK-DdP(lBwR6A*J?@-T4&6G*!HfTn)N
zaftdKXyQAd;;{N3W{w23e&>MFF!5PXdtvf0@c^j35oqdLpz0IQ#5qnv+yiSzz|5Hd
zRo4KeVd5oF^)Pvu_zI}KuyzVe`~+104k!&1hnWMDhl%fin!^EYr@+LsPD9)&fF>>k
z756|Bw}XlYpozaZ1u+NKK7yIQ0jh2Rl!l4Vftmx8hl#_+i(u_3nD`5*{u@vlCf;`j
zVlPY{CVm3yUkzw`3MT#!YOevBxE9nLSbGhoJ^`vO07}EeYtBOKg~`LjA3*J0fTrFK
zs(uBUcnDM+*6xFua|5dG1eAt}?}Ms`$-~4oOd<IK)~<w!3qaeA3{V;-4l@TP4->b5
zniGJg-sb|uzY%ESpUy+XC!mSTLDkPd6F&o04{OiD>^%Whw*yMU#J@q!fyu+fE1>S=
zP(y7WHbB)2poy=5iff>WTR{0R8fJa~RNMhd!^E?$K>Q1nhl!tnx~Bk5J&a$0L%ab^
zd;*jYqhaQ6fQrw6(lBwZ#}N0dKojS<3lWFugQ>SLgQSxWXzCArgQ)+3Ca&-uBCY`K
zXTZz}_yG~uKoj2t6*oW=hw&|Nh&!N(M?m==P#R|M1SlUS4-+qdiYGv6n7GMrh&y5O
zF!2Y_aDbTy6JG(<KLbj`#5eqdm;;lCiGP5avja^%hdCsiVf{0>dZ@YwP#Pxg#RO6R
z0ZrThYL0>iYC3m-iff>WUt@%r6M!auiWMRrfhHcr1`$s{6MqF2FF+ID0OeOeX_)&z
zK=}<&8Yb?b332xXH1Q6o`(ft6)Wg*6KvN&U332BMH1Qe^i1-CG@dZ%xVeW#N4^#I8
zO??YD#2gN&dtvHf<_n;SZ-APwfF^zcDh~5E%p9104>a{>cp&yhpozomO+XWe@iTCU
zLssdGlA|Fo8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqhK@yMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
zU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU
z1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0q
zLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(
zGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU=)moz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#^aH(KP;t0tcwLXMktChoesjluI;)tUuV--^G<^or6rF
z0K`2N5Q+gBJfqYI4FOPo2o83Q_w@5}btXAifD+OF{~!_rH((cs<)h-t;*!){-Qv>X
zg4Dbe-ICPe5)32o3Bb$&xj)3m37=A|a_kI@44|^YJvA@2C^H$W8e#;Qpo$tmv;qSI
z1DFBgjAB}bKyGG1aePK`E-mfAW_Ds;N@{U@ac(I#Ng~7``U}X`PlOe;Qqlm*FB%LC
z49*M;3_dInnviA1rFljMnYt;4x&;N~h8eOQAU7cM2OGO2GdC6FCRbliaA^voL1Luf
zqO?44q2%o676j4<qd{y^aArX!Sh;6FF$xXlkU%6Q7K8l-Z9Xu-XcCM7D}`lQ-(U|g
zA4Y>YBoM_#kP0ItI4BsT4Mv05q+n151X3Rm911oEMuWsi!LS@1>Kg#o2BX0o5{Q(f
z<UEjaKW8TwWE#XK1t%92K+;b@04TdMI74Yt%mArPD^CMg%pq>!ZXiC42C+%OIjQN1
z$(0Bl90(>!tg_U+l>8#F7ETcP|Nnn54PujmQ<6%+rUZpR!Wl-BVg^WUF(g|sxCVoh
z51a<ck%DszD!`!=84=(M(g&kKY+^AZ1Gq^;tnyKHI6|N(KOdataY)ldn32qijgU52
z`xKX>nQ=)##aW;<E{YYG1P*a@_oBNG-96~`qua-ZW)C|WAHAGGFD$sw)N`ZpdC>U0
zXna02K0g{Cy`B_AlNUnc3#0Kx(D<Tgd@(e>I2vC9jW3DDmqO!@az{g8Gz3ONfYcB`
zFV{)ckFGvBF(oxGIW@jCv52I)I6X15I48A;WPL@cd8x&T#qq_-nQ7>5!N)JoNX#zD
zB-uKK;>@(nGSa=rkds-GT0y#X44`ndFfuj3=ND{p6*+kox**LUi?J!dAy%B4o0*Yc
zT#}iWjza}@VTnKg|AR2O?IG-@B1A#$0rWNiLKeXSrDssv0~sT?RY2x|FsQu(Qv(|Q
z17Q#!BnQHv`X4m33~IN4_#h0D2Vqd#1w?}|NF0Pg?H7<95C(~ZFi0FkgD|K)0>TKF
zlEwo00c0K_U4;A(avumI`(K8EfdPa;?gZHZ!XP#XgZvMoK^P<s!XW>H%m87KI0%FM
z528UBBo4xa+&UcPL19CVzY;SObu)8|DHzcv$JS9jq=rCIL2jllY><Wo%_SMBi77hC
zmIem8upuWBbdM?}Hv~ZCAvV1Qxw=KE#i=B<QIO36)eXq}Q8xY%z!eWEiIxUt#+1bc
zew(q&CMM@(=9TE?g2w&91B%#{5fp{a3+3eEN=faLK~*h5b23UuYrmo!NU45w^9b?5
z<sj;0Fd;2u$tRX1m#35%8IarnCek)s>5@q87|PNMGV?*HxrD_256mF2{(}7S)S~<}
zk~%an1JLLc1_lNYMiT~$VG~DJM=l>%xE7}y8JHO9<|dbdLW%tHmsEEZm*!Pu>XxUJ
z(8yX`{w39&F!jZi#mV`3x<#o;<PB;=^;0n=!CZ!)MlKg9s$lV3GvKnY`lGlUGEYm$
zL9luvGr72&klIms1_p3Cf=xP)1_;R^0P2T>G;Qz%jT|sAeEs)7AH+Wa<%9b5ApQy{
zAJ%Vu0p-KyS77BDY<>kcFM&Rv0qXyQ%wq_E*asRX0P$bwgGdGj*w_tB|L^}0_b@Op
XfR+A)^8dpuglMB0S)d6E5mX}q{ma>o

literal 272504
zcmXqJVP)9d!pdOG$;R-W;XtY}2P=ayD+|NsRu%?hHcp1W5y>nPjLFih+Tt8648j~4
ze_K8DH6%Ebg*dbtoy3_L7=)RX|7>Osc9<^2#4x!j>9@Eu6N4~w^7iDWBqrwlO$@w#
z$x`PTnfEa<Fz;t#l$$R%Pubud<3py$hm!s^I=p9Sh!VGAVG!mz^?iC43&Z3tub;{W
zTnvg_kA0*5i*qqB2y?A6EEb3|5U&EM%KF-wWy~1Gi0tmoooo!oT<i?*860Ae-M+bv
zlfjssivg?JgaFgcOsIZ^so&hn#30Vj!XV7vUe}z>&dQwQ&f1*Q&MIES!XV7#^mcQ5
zH?!R&ab5-nVcy&~#=MIh(<T}7F)_3{GddeH@i7=PO>*4Kp2K9!^vR($9Yl(=GcX9V
zFMqk2{hfod!6OD`lTQrO*;yDSx2M0D*{^Kzi9y+B5u>ufBxYo{zGpZPtZcG~3E59*
z@<GZLc;y3?ZBXT*E)h^Rc*FwnqkDm}35X4HA-jaK#UmDF8zvTI112_9yBPeGO%|~s
zyG3sDW6$D`HxCN4f8a+|>)>I`j2gDd49slFe4AM|H?cA_KXzg;?qg;Uj^krAu6xIz
z#J9PRnPKw1K8DTz-Z32FGwx?*Fs^^kki<Xvax>%R&yN{4KR(R3`SE4O&5s{5&YGMY
zRm=cNPs#>|85c4sGC%ez{@3Xw&ddTzcbEAY449P-f*DvBz{Hd<F&i^8Y(C7)1jCOf
zL(<*>qhbLE14uX=kB7&#4Lf_Ww!_EdULFQU_vYt349RWjj1zfS*&lnA|2O7lXGjjL
z=7gk%q%)Azu$euF85Gly_%0S;GBIWZr6N$ME@%6!E?_XXxwX6VI3)bpC5i>Y4T@D6
zOx`m%*odxRWSGv(!Z5kHIlTFiGi&o>X4cKkn;kYc2Q!HmgM7t&Om1>(vN3D1LsJ7I
zgD?XFLoq{uz}NkZ492aj3?Q*$Atn=LgCMrgN(=^*FKuF&{K<%6@**RKze2{2jtrYW
zDKUU)ryvI9ElO{M8=GD?8!@qoeF5qFtR!F}_6Vd?>>1N5rUz_K_}&P8koqC_XVHUY
zPgcEH_h!?FZC`f%*!Rcjq1#ihmws=9K8Agb`Wg54(Zgp?U%h<y_S462Uw{4l_xH1s
zf{EC>&q@X+VxO44G5u<E68mS&%E<6Opuwrxpp}8ykd?97u$7V7h?R-in3cKNxRqHU
zQ6*I;*Pzg()S}X+mf3=pquHXBgV~amv)Qthli7-utJ$iRi`kl$yV<&xo7skyr`e{J
zhuM~ux7oIpm)VY$ui37ZkJ+A;zuCT(zuAaYpm>6iNwZO_K=A}7gJz>vCXLKu1_c9X
zxDC2+`mD6UMC{vVr3EHpzd&&?`BD<o<WE8ju#kJ8H_#ymN^krE3=E8pjgE{?jZTct
zjn0fNjV_Juj2?|1jGm32j9!gijNXmjj6RJ%jJ}P&jDC%NjQ)-O#Q_W^O${LZ+e4i^
zXSaSe;YfNcy!A?_D@WSn^Gh#vx+c49W#A}lYN!o`sDtFi_USy2A*}T2B3U9(w)%9D
zJQ(}=G?5~a$DHmWX~`#^K}&1(X(DAJkD=zUvM>m<vQFkmMCP|nLgllf@mnW?<QX9O
zODO-t{Zk+|2<JN}aDe=g@6f;sp&d9O^Z{POLZzQ<f7QNvee`=9^fK&e)WZhG&ngZd
zn=M;en3r*~vYu<+%E_+P*{H(k+UTy=zOQZKK@sQV$<r8EU0c-!*&ok1{!j2^vw0^o
zt9x?Ca|vGe<ksg5z31Ow5Qt9h=agvP&dD|>x$(GKYtwYggRQROrXat$w!JU7z$W_=
zESsL(!Y<J?J(-bJ;^lT>)&SP`2^;K;trjpO_i~DWRLn?DW?~mnYh{|AEW@e<5}A`e
z^KjGjz`xTqSr{gFzN~NF&dJEnV8GP)dh>C1CK&JQ?P67jkBqAC6()o-s=l8f;Igds
z{euO@kDXY*O>|FY{VJo@`d;BeFr(^wh6!QK+c_DStvXqDUS{6j$)I@o)btt2jBd+X
zS=nbi_G*3q;DEd6*JMsEhGugvwmI32$D5`<mSg?U=<3z_e!~UF#}ZJsfr0L0At+m+
zLFBOv>pQR-g$AR?Vo)~2gzU!xFt$PHV=2}*U^NaKTpx?T*bh=4%dx%!i*ImHc`U*D
z3T}Ho*mil=7a+SGf*wn;zG&Xw$*`=|s}<yGkc;0xP%si^HDG<8@Iez4mZ5te3vs=e
zlm2)r`<s_rAG2`1X>}D>1;s^c?)w6UyvNe4ue@48{(rAv;PzOM^@&&O`wIf~k7ZaN
zfy{lsz`*da80#ZN*Y^qmzL0Rw%uwF2lHoBo>jRMJ2XEyqD;XZMus#5VB&*vpuv@&q
z;rIT*1LMcytoQgC1ejahm3RDPNalitWan{K*QV)@C0OsYg2Pe(6n=NSTHjA7P<t%P
zdJ8OSa6w$F&G6v#tBeejTc6$$Kg!4;%=$Fp{e%Ga$lajWS&#?{3jxN*BCIz+tOpK{
z<yo(RUH*U}^|1)o4N$sa+zvKPK%iQyjq@zTG}aps(^%u)Pbgq|e_?_?SdBu1_+vTN
zOU>q;Y^~kBkEb66*?cq>qV{O)`w0u`A#9Mo2X$aQ3<7=#b6YP#<XiLJPk2!C{(^uO
zM2&$NLXGPMh?=8$?<Xv%dVk@9I#`W^fhs}`>p6%TkU0qz?=MVHg{XPpj8Jp*G(?SS
z-unp(W$!NpD1+5(IKY5V(|Qu324v2I;`bK>6v3ghprHn##`QQv4cI+}?=M`COJ?I@
z0;l-=-ov1HLa1#$0#OS#FYo;Y0h#v&0$xb+hoJKL?<YLSd4EAbirK1@O}I*mAz6S+
zq1mdFCApo;W^!v6143OwmM}NV7hyIAj<D8St?wBMoNu*4WS8c@pU{xeyp)R-$}f07
zp&|V}!v@(^t;u|>W)M-=!uJyt(%w5H=z&E|n5|fug4!T*t%dI=B&58bkWja(HJO{$
z2qL<)==}tS<o6F6*ubI&5K-6S_Y)Q*z89F_4Hngdh(0ZTKfxiP(UsNpy}<;RRjtXK
ztU3@G*OK=W7Q{8WGP=Gu_~5jvHJP1N3nH_$<oyJO*!Kn-Vpg>#^ROyFL|seYPgoHB
zK45|-SX2%o`n2@@1c#_*Q%-1zJS}@a!6CBQv=hottytOEsQP{aLqxMFCnH49(#rP}
z7{Z&)IT;b^o>tB6g{VvjZ8q(Ms${KsKOrH6*@~0t{e=LBRbB5d7+7g_3rDSDcz@x8
z38R*9_)><+VXGO0udQNWRKL{PsK%%UvEymg`w0gE-YXPHXm!0;5Rhn1>zpUe#>LQ@
z3YD*WKjDDi`vL=Yt*-Y48`!1USQ%!saxsWs1?AG##`hB*_&`*;+P<Hl-~-81GoM4`
zS)1N3NZ^E()DNmaC3Qk(vsEXXR@dZTQVhxSxrE*)G$d<vCkHOzTh<EErP}y@LWBEc
z)>Dj7ev>d4%a`{P9Na*u$E)>H>-!B0R4+kQyEeU_u)qZ*69tk<c#s5>S=#h|0)sP1
z2BPPHK1_zS`Tc|hN3YiR3j)$+v$8^cv$XmB1O^9?XaSO_Ys>oy3+zCm6OcqxTi;J`
zumy>3NSG|n%G5Zy_q1^P_y0fpTe<G;hm<I)B7$2XtXAQxn^!?oJ18A5uzY{vKpIH*
zg&0tXUW59DwdwtY2j=eu0y0-YMV>alpK!oT{2C*JFq>K%q*Pnl2GSW20wN6xwAvms
zu+D?Xuy#U1thM$1gaqUF7a9_v_H*yt3}HRx(uJ~Ixg?>irJQ#+LS$JvZ$eqA9HCIw
zQFh0T5Yv}7L1KET(fbJvx|6vextY=RTI+j;32fJ({yS>)e!>FnMpx0DjDkupydJQ<
zQG3E5Ag;;6Ak4|h+-%Ot(D?dMf>X+(6sAl@SJuR)hE*-^6%-<;i?c8^Z%;3u<IJe~
z_`&jjp!)kjI4Ep|uU==It`3rIZ&)>bPV&pk%;ua7ATxGN???uj12P5EHqAfH=ABq=
za|nXi)?R>Y+k*hOZD6-7uY}pwiPbi>Cv0!L9xw>3YJsG1=AA7p?-d$+AZ8!W0-2rs
zWjVw93k)8~e4I?p=A3MEiYFd!ny%LR-oU{_t@XXY1U3*`AXlyRJ%d9ch*Zb}t1E}9
zyD-5Mq$0r;q<RB0h;5JsQkM`1A|0|n?spVadcwd_oZx7pl;X(P)Zi$n^nmRN14pat
z`wIfeixQZ?qM+6ws4d9$7uFiQ_vg`%XJ1}@c=x7(aaD_6r?SP7FUlrYz9}29{7^Pw
z`2q3OdxZphP`-VjTdc)k@;5wL@TbzM?nckaJT2eT+RnAcwN7SX`60~xfxXr1{e=&*
zmM@#lTfX~s&U|jVqP1Ds=F2x$&fe3)-^CenZ%easGQ3wvuwqo59G>dX$8OyIg~52*
zDu(2;)dC=0teg-XFMm(&<Ya-E{{F%SiP)>mmMmXeeI~OqaBQBg!>HD(Z1CmV`vwIg
zVfGK~t9p|&mkSBAe_)p8VP!~8SC^kG&dJm`8ItBs-km(toI%;-%a>C##idyon60$~
zr%SUiH1A#=t!%^cWir<X_L(c1&04-CwLNPMYGs<P)$aJT*_`Fu=GHZg`rE%c_@0+^
zeJ{`uD1ANGfsb8nx=3=XyYaMkMq#&a|3CJLJQi+~WdONMt@VAw0oPT%$<J4@N%!zF
zG;iZ%NbX}3VOHm6NX}{(oh-`3Bz*lUW8Cy+8+L}|MjnwFMa;IG3W1*=&-D2@qY7kq
z;eL^1P)J<t6M1}cYqBpZTc`VDk*_~m-4V7Z+kE-*zCpo$Rqx}!t9~?_w|rfA8fHI(
z;;P={N2{1XA;G(y*}PLB_pn59<#~RF09Ft$sa2wwX*%nEW^<OWli5EoCqIAAGg+J+
z9$GI?fkKMWz1h6wOCS5G>2s1hPtPfzc|539+2qN$rs>S)E#F=hc$KUw;i`O<>6NuA
zi!1wCwOh@y8n)VJxmK;3pneTo%lA{Q?=L9SYPA>s1o;LO#;u;lU%xOY+bsFEsvVSK
zIA5A>g~T>1r(Nsg2KGm+ovAk=Da1j7QB^oR6&%{e(^fJhe_h1@GUp&t=v>@h8oqLW
zX?X8`Q0y!)FAd+gozZ>jc1UiJJu6eG)z*4`x+)99<kr@`>)IJzC$llIC@x@CP3F1E
zFe7;(d+qPZ;-(DyrcQVW$u~+V!mI`dK{=>2^e@yLa2UN^&HyhN)L9rNx3}+DHC=fF
zI|D=?EWb6niGO2eU{+hU{r!jdldyaTaZhmpdhUd&X50GyL;W$B>dHc;4{Tr5-gv$6
zdlK}3K?0QLAT4swjm=v)6)sJI<w^!Ntxj3j_W}$W&D%Q_CLW(t-gul*)2p><Iw-Ci
zUDaCOCrmJ2)gpS3(NkEQlWB7Jbw=UuA`IuIw>AhKpOYNaI`i<H>Za+enr}ZWDqt#k
zl;V`RD3dA6HL<BdTpcvZsJ^P%yj@}H;W@>vhhcsMnGF)1Q`|Hi<Yq=!NO(0hKuYNJ
z;}g%%DQ`RvQx9<sNF_)eNH@5Adcwe=lmhCbFq^s_0m(o@iSZ=Jl*#Swi<q~!D=;31
zgs<|J<q8lMsEk*80;*FO1oS#rwQPJUuED~<Y|*hlnT>--{5vy)F#GZOGR`5+pwi%K
ze{%A7F0~oT1{@4~Qf40CQ@p3X@i-`i7@rm=xEL_Hg6a@h{h{dkUZ9{>Tp2X3)jUht
zV6lQ$hwaJfUzr&ux3UV&sa$$`R@<z0M)%1a;8diZ%qq@00hEe<O%^w2*ibray7*US
z24U8t(|aCE9MnA2=q?OSZ>{Rd4ab>gBrRmC{VhD*oWW``#GUQ}$_9@aVh*-$hq(fj
z`am_AFss7Bx!X%ad$&XU%k~Cb#}v32y#HW-Z%<0+@jb<Nl0o$YL?=iOB>X@rxB;Ak
zA$-oG)4ww_DDPO#0|`G^tbjzDw=d_0#33mBZBl2R-&4E?DdzNAo2H8%g~c4m&CKTQ
z9MjnuK<WQyGW&Oi*7V8k><z^W+zl9An;IZ0(%B#?(!Zms0GR_xE7QL*Gc<2|#tc#S
z{EJ0ua{D)!SsUC9IM3S@@2Q@68s=7n8=D#;PlED?+8eenp!~rgv94w2!A+fvuMp`M
zlzO!~!Kq)NprqNnlV#)K&hCYWrypZvnB2zpL;M)1CB^pRTq~%wo?w>j%*r&oos%Is
z#FTM1J1fJ?)BC0@?q~UjYNB78S}UZ5^z_Sng$XIBval50nGOmIct}5C;Fw(A$}sWx
zoJ3alEb*KDa~@7EXJv%&^I&`?2)_u-7cOOG5j+Y~Uk2tw%(5(0`l0s4?+x1@uMa^l
z8W>i!tm`b+WH4C>>QgUpsAqf$$~Dc~)hG0x-%~yJ^v(mF?zN%9Tna|X)4njZy8jXf
zsZ=)k^5^}6gc{km5Y_Iz6OZqyZaluM)vp!QB6(EcRI;dqsq#^#Q<h?4Qv*z&FqeQ4
zMDK!%%8Qd(TmJa9zW-qVsoAvUPf+XofDLs}^E%G{&fPCtxadXOn`KW<J@ESz^dsy`
z)Q7k?4FaFF8BC^Yfo4%&wKgyBVo0v|%E#)tswJ64l|QakuWM81`vnZ?$-ygmiq#p6
zCSU*JJp1}`#-;OTUr%@FV^=nL@=KV#<(J)bndHgezA#I7voLJFex0GU`|5F-WMj#j
z48op2|8M@T&e-c3*DCY){Q`zO&8NvTIhmTbb1`%t-;+P{Fldab*}Uaf@dS1wM%QNv
zZYj%B*fJkgI#n&IVyb?Wt(w@>z?v$}%DUlFtLohM0Re>|y+1#H+&;Vg%Kt+5$C=-M
zNpo`>MYX;U_+a>1-NA%2{b&Eh|7@(2Lq!=tq6T@7J2`)p?tk3K`3u>k4LOecOG7KS
zr-o*3k1bsEK<$s$kDw1>Z=znrJ!yO5_oabjx)dm6yh@s%cQH2a<YHXaGL2oY)2Pd=
zdsp|qnc&g*1rAc3?u@F*U#BxnF0W#E`J8!K7vp612mHy8j`Juln#rKNM3YhRT=RA=
zMqzO_CgI@ijN4h680;n|cWz;0UeV6byuzI!xnu@Ia+(Hn@*@#u<wcwf%1byIN<)_=
zu%$dIajINY$yD_y%PD(Nc4A^v!{Y+U|C8I<nH~#${v(`P%3xgT%E+pwykI4R@}5dY
z<sF%f%4<$BFuI=H&b*_Y5v;PE`}bq+&wrSAuroep<A&%K{QLu-?!fJZp^n=pvoZ)k
zdKRtw-#0u+uMOS0eYyk-!{iQ*WajN0Op=dFLz@~tt1*~>cxKZDl2dOnFYjPl)&98T
z=|4un$zrTbN-sdIapCLF7#ReNrbjrhYxx^GJB*!C`0F=@WXA0*2h)T*zWv|pYFy6F
zm@K)KNt$)}zlCDSUzRZ?bFecrFYjQOIbV1>JGhp#o0gH+@c>e`GJ<<35O!%OsHA1y
z&cVRwntEBHzVLqY(hdd=r`@gF9hj#7+@AboDbsc~CWd5&t4zs#R~cX>7^8cm+xrjo
z4?txgsH_F~1}3+vO|RXYm5BiqTcFY%rUoY8nO?lX-M}&Ry@G=Rx*RBF^t!%ZpkUAW
z7SiWn4`@8T2i$XjsRhxTsUTZHbqS;|22wk@-Q9OavFLG7sLm<oOy4%WCArwZ-JsaO
z-Q@iT`Cr8frUuF@Sa={l2l*S~lHv_u`5$0;4F(>j2@uoLJ!TY(!prPpbq13;#k;1@
zNoI9dUh$mg{fGZwiVaK+z-E|$N=cBrK(0~-n_*h0^zz&vwzq0ey&hiraqY{k5BJ_Y
zdhzVZs|R_17zC$Ff<}Tpotn3EGAWyE`H|ejE&{Rv#NRcYc_%wVGAE}{vw6!8v+loP
zjgz#xK(&AJlWz=7;<fI7!wxoq*pB9h*#Cwt1hW&(7qR~hn+RqXnonZ?8`jyB{P~+$
z@?my{TJz@TolHT~lk30pOfFYrNS?zkGMTI8$K-M`P%ED$4Al4d0qWPhFHp#u&CALF
zw#{QZw`2Nb_V#~_T3<u{#@PB!=KlU)+2YGLVV)1nD_0nomop}_mvc9pvwYVyPyX;+
zfO&Z*L$f){kD2qN+t?TyPYX|HW11Xxo$=H(<vnS<%;udut?rwr9cKvbZ*);MdC4OU
z>1D8lwZ1P%s0Z1b?7xSZd3h((?lxaW=~gy|$MsMD2v1{U5)OaH=rujUSvriJ(YEU`
z%k;mG8JGQJHf#BQtM&Z{`DLqGLic|Sd6nRm!j<`~(yeM)6<hVQY`2_cIc&L)YSmg-
zrSK*;H8d~nWMJOL$)K!u<=gJoZ4SayS(${xuQGZ~Psvw2#B9OFlFZA&WRWI%8sv+K
z=b2SG8KT;lW-xE(WB}=HRy*>|A|0d?B%{{GG<{Wz>HbRdF80j5Uqg8J-woNj9~AFu
zPubpjJv{dZOT3G)FidVaqBN&K*=EbP<PLT*P^`}>fW|okrx>VD0E+Qdokrxv`IB!9
zAQ!>ny@knddUDBkfyw1s49OGNrG&X#zE5UlV2J{Sxi=`x!To`=+r@>;r5FyTD_cDI
zwoqJ{z2!%v=GW-IQG0zjeL(#rQ15h3h;^4OqckrULvs0Fj>)22Op~uaWjr<gj`QrR
z?2LOmlY7G1ll!M~gL3iv2?ph@uE}?ovJ|T_7|n4}Hd*o`x#q7xGS^;#+2Ow&LA4>M
z=e4`toe@$ef<``sD}FH>hq5xVcBa1UNZve^mGNY6&tp(N0M&AH5<u<5nTNAlo2EB<
zCx@<K1f{*3k74Nu<fjKwFh4!Mx&3RiIw$YM<B&WmxZrCvD21#-N+Ylo64&}H8<avE
z(<ifi|NphW*^K4e?AGP~l0R=_s}=8YNp5`3(&5r<3QED&tg9S0PhZY3`S|z$Z~K)^
ze)2SWPu)LROqb!*H04EMjI-Hq{r~9p_}RB_jjqzHTt@E$7F6!sKPTbg<vrO~?=!1%
zGVEsE<<K;JRd?)F)BRtgH}3x$ExP|<H0%Dm(XHDH3za?wJ!Jc;_SWmA-_vV<ZvD9T
z<<W;{Z(hB4_k=-GTne-@<J3Q93oa&5OeG6*FntYKRlrr^mANXDE9+U6TlKPPwwh--
zZn?{H)mmSr_$D?rZ0iJ-iOl9)OlH%Yt=JhJw{!ie4QHIZs#mXbQ+IOZb`iby$!s5(
zYr`Cyl2e{B95i!cuMJZKvmcr%vDbzPg4rL<gxG7tIKk|nW?bya&g=|-&6v}>nBGl$
z{P)>6P^(k;IwzxJ+GN&m|3Q6v+wM*`<G<S(lKHP2B)@#dm(0&DA{{Qvz}wC1HapCg
z;W5+kFOu$$^RIsr{w~ds%)su@>JCb2pxzzh<VF|H=faVkOp{p{n1sbSnH?uHK0l};
z9LdQjT>g`v@%cg(;mA$~;qsphjL#>k2uFG{2$x$jFh1{85suVk5U!MDNEYT~XjOSP
zW%6_thHKMrIR6cQ%=!IIvpLJRMwP3lnax?g?R9@F`2Ee~@7fHF=bP2L7<RXRae&pD
z*QP7)Vdt6r+neEWKlh7+>3_wWRl69ZJ6RZ#dH-54t9LOpZ|~x<=6vbE>TWEq&Umw5
zdCM=J-o3)pS(*O2`R?88_E_lpv)OEG|0#-@wLh-8_9U5MugT<Z(hSM%Y)X5<K9$_x
zY|ipE`6Rm@vnk8hd#&$3<eyvBlI+N;$86s673%K8AQwNL%l-i5&g7}=I$$@oaz9{n
zYjl-vWnp;#;r!LNyEWY(XDz=E3Q1)HmT!;c*k37|uzUl@eR>yzvdxum$zR`Uu(~IA
zz0~4#PoDhJpwnI1;>#Ci)0XeOuJ0#Ya5udRV!xkIV9n~D9JZVR)OH2serEM9Mn><S
zA%?dn^RWD=^{I`uUC^A?&XD}}Cc}1iCWhq6KUqZbLAg;N`)^+|&o!oIwJt_hZfSOI
zhUCiY9L(lijFZKp8O)|Pr@1pceth%K<F96aK_)zYWA+zh!sEuDf0)zR88(aUWXx;Z
zTz;M5;q1w*3`}X@y6JsEg6yi^<k~e1soSBWMoej~?+X}YR`ov4Uh_kEx-LW5^a$t2
zLd*X{d=Q}DY~J#1b{j8)F{oYb&f1-Pc{xMj<!vnoxBm=(-1g<gXH5o^=Ixy<$=&Q?
zdy4nuC%3bUHJh@0XEts5+B6+hUTJkE^RkLSTFamodUD!#kzQB7*7p+(Oa)KYhEEP}
zXV_f+lc7rdX1}t@mmkgM;I?`3%)?QwP17MNCm1D5vPyttV11Lg)~4yrrY%3DTUm_W
z2RtxW-1}Ib_fRJ|HGtyou@L(OP<-3EKc4vfi8TA#e~vlICMrKCv-SK-{`!nZn6u>v
zs08<FeV-7JKbr+wTRTh_ncd0D@Hb{M@1Os|+#i@h=~H-)3d8Pp6Gr2<F2;SW$*-TY
zFspVkC4XPe65}*;F0&cS_vDGwS(C;0GJ{+=^Z1<d&g0BWxfq(J^BzUd4b0{&->*&o
z@jm%53kzt3ZgX1~<DEk{H%hmOfLjq>p!i@0x#w~4>>r@qk}UU^0pyCG;fR(f%#@!Y
zE4M-V6pgN+-bsSG>1OoQ`uN}5KaldEbGNbu%a?__na#Nv9&@m7kSKo4%Dw^QQc#RB
zO;<Kp^6haD>zk{4K>m2#%zkW7`r`)nV;~hEU+!kz>CiO&F+1y#RV^p?OlEEQ5!d?u
z1OMcuTfc^ba)9RMTA9b(y<dNZgzkZiGeFva>MLdxbDjp}pc%!WR=VV&oV3oTjINMg
zY^Zy3#&VV!?#wINnI4z1{|AjaPQLb>@nD8E#|wu|(-__VN+>R1Re#LE{`Zd4M7GV}
z#Tg&ZT>fwK^`{K2-A}KB)C*s~&S*8QCa;yf=3VOc($HAwD4kM@xF`z)vuf)CM^z?K
z#)+VoCDvZE7K2F;Xl}$6;$rr>Ak{O%g;PTrluefWN&f$YV}^V3$0uyFuYUp8y0AW|
zFnh}%P<wXs_2~?)-Fr{7W=eB%9<b(|$q*#@b%t=HC-cHHAd?Tc&SwAmfAaV5%$wMa
zGk-EDZ_s39bVcu5&q)^F$;iNL+4=41<vG<K?>9|PyjyF!UHs2~;nJ_nf5nYhH<$cm
zFn+m&;o$b|-<cUeCdKYA4Nct-32&%>O<BP{g@{QWh4|@s|BPhV$XUl@NZ3P0O+aHN
zY+o28pzY~iQ2SY{v(aVd;Z@UHl0mcb2l86oldmmjXcB)YUOa)_2qe~!n;g1;;cs~H
zgmi<A2b!06GV!`67k+1wZa)r=L*eVs83WlTx3e&+P5&D<<?uxI$Mc^5o7~>QE8N~9
z3K}I{$o_cl^MA@)Sa_6Iu<)RcouIl*t8-oF`w0!&wcvRl$L7B-$?4x2Kyfr#oRxX6
zOKrGfb8^aehKDAL*lWWD!R(JFlh|v+Il=6oCSB~Hw%lKn<O!Ty(>X!?hLd&EpMu8l
zT<<!jz86^F3-a~e!>6WqB&#08=^J)dMlEFDu($FGv$w*0Bm4bduX~d?tNUMZWfN8&
zWerxIh=Vdu8C_BRCd}F(`hG)zm+skOb%&22dnFFq%~Up6$&k36Gxhz34IU5|t}IdB
zv68{?q@wG4h5%FL4J(-x4}wOndJpd@-jhA?eA9HTHp!FIw}MtFJiRQwl@YW);{5x9
z1y!9VX19wl992<X@{>V%$xJ56{byZz-Oui4-pa}NenWvPXe4nfG>_;Wl*t6m!f2kC
z$mMjK9Cn;Jx$zj2q+9Z=V@#93wKFU{x1FtlA+&$;H+IIAhqkjZFoyOEe^Y0eTvq;H
z^3de8c7}=FQx8vm#>Ob}Rwl7{0((_)fIyW@Vetg@Dw*8k3F1|dw6=Ga$lIgax3e+)
z|0`D7U%P)hTLYMt3LpJwd(yzMu4SvMR;RKJ%P(aEmOsiSEPs?OSpF#6u>5&HK_Mua
zg;gYZCX2{)7EljhN$Q-0Q`4C@voj>~GK(~;9Zviku59o*LD}SULh@`j0b!1o-;8e4
zIanB)cVz5hbrt4gU}{~_yq$vqWWI4b8^h=6;Rc`e1geTBgc~%QxBQ-b?;P{b*U4Rc
zJjMD9CQ}k7i;FRAn*M9rlqBK#q70MRe@)#seY4zE#!0NoTdp&%o2I;jjX`-28-wx&
zHYVjQY)lg#H>)!zva+?RD{FjCNM<|639@ZAD;vY1He@@CC$PfpJk+-JF-R4{Jq$>4
z3!f)XKF5MAU##zdB;WfxnRz|aXFY^#zfGHxG<hD#wcn<0n+|g6bH<tbTiuoQJ|}=&
zr>ylkfzcH<x&s>10jDp1NSLMsbUawq{#cat6)26o+%L?^ko11T1bMCI)SI8x96ruT
zP}aGcV9ffHLD?Xcp>V4sbWRb}TiNOgnx$qv2<nZ2Rtq<8Z}$e3jWdsfdiBgp*%LwK
zFNh5p@r9JcULXA4ggs&V0~*29>Ri{gsbyQ|XH|!foJSi~-xnwpI37hZ&u!Oq=3VRz
z$sAm4f5VeIzOXQxb0uVkCUbvhKrTxcfk!Hv&ASpFPksJx^7j&k-uKCKI9ZZ8IT?E0
z!rH*AU<wSF4G$_C%t}x;u}WlgJ-GdG*UW#-VDlc&n*Ix{d)oA0pxUH1)OR~HpRIuA
zv$^jJ6kG~JGq>l4Ms6=wbNC2yr8pl8gD{_-O|v;4!!Ah5<Ywjojj({`CP4Gu%__`^
zdY!sQCx;zn?mg4$w|U+@21buY7m)5|3qFR);t~vprtg~3yn};b5<9axbK<e-bJAHg
zHh;g)xY_&z!@enxvtRsCYiCr0xF>ZX)IHPR7bsXO8_WdHNQ34sAR|;wB8?L;MM0|<
zK_x88jFLKo38dW7GytvU0>#|T)6CD=6ZJZizdq$K?mEhlT=<Hkc?)|&ZFqA36Bfl|
zlUW;>K;z{Fk)YZgq)S*_lEG{Gw&`<{h1e&zv@q?OJ|mlzQ+dymKQr=`H$3?_qgZ*%
zlYeu{m3Msk_rBpn(qnn8-^k@7WS*&cdwW7`=;H~~e<4avh)ikd#r?IR2lq!7F8a{+
zW!alkFU~!=^dRg{)Q`9?NgvYQWWC6H(jWl}&FS1M43oRFm7BM7gW_U0J3}%*H&e3-
zcf#NBb)80C$-Q6L)H)lzIDL})IN3lx@oIhFaKVS!ypv&a_;KdR-?slxZfj#!Hi%+;
z-w+T{8@jB3t>jsXTjsJ%wyZ~0PSuO5nQ9*8IOQ(NO-*cSNN#Osoay#>=Jh|V?(f7W
zx3ja<_7{GB->@NMa=R3RFlQ%Ia?ekOeO;0Jo6Wlu9#5YBBQ~^lJELpv_U3f&L`LuA
z_vYf0IRzd}zA4GT=_BbieJ>-!<leU};%gZhgn8fAZ0BhJ^(0In{+W{e@Kp11x5Ssn
zo0qdCemu<R2FiiWTe%s8#l;vlvma+zHI;cME5jtvTy1u1_rcd7)y+%U5~W$$82*|o
zulkmd+`g2<Xu1%))lAS@B2WmZwN8F6&Y*1Zli_`Xfz6B*(5eh&o0kkTG8VCK{%+2w
zZ19q4N{%o{jmb@>2`S1JFBv9>9b-;zY~xPuc4K|ln$`NgV1bZV>-!J!vp~8*X+U`o
zD6S1$CbLU3Jm!f0XxFW}ALNqR>|zXdt&jh1|7O?LxgBEv`-TlBjIQrL)K6<RXJBBO
zAY9(Yz<GS~b91n(CYQ4@&O8ow?Q?gq$ma5CaFKSf$aZ!H#@asHdk|IZj3D2%?ngDp
zvC9%F4>6^2zp}wE2Ftym5{d1P+80on)WEQL>QV+}lP!P1sR`U>===vt<GUbZi_Dx{
z&8eJ;lUZ8+XtjZ6RU6!!(>W89GrzK|T`?oMSO8KJ76&L)fpQ0E{7aZkltHc4Y`R3U
z;Cba8><r3#*cp^Jurn!dVP|SqcTa3pSJwKT05bJ`!U89-X%%0YK)ONp3X6*}XhHK9
zIA3*p{zsI0rJ<nN8RRx4h+i9e6vx~P)OWwYz60l#)gK^fs~I$M+RVw({FF0Mn5*TN
zR$EZ(`-BCS&CfX#SG9<*W@HfNejPJ?6(hssuB@=+qOU9<7cy_>W|%x(gkjlqv+2y1
z><p9G)!J^ghPB$we4j9(5R@YHe}YYH6JY?GX96+ranjd6xMp5zL!W|M2W?M4vm<_A
zK=UIF9L8eX7?f>}`~ulJoeMNa!u6DSI~N1Q-ee|D4rVLPgxc_R?a6Gf*g&B<nX~1$
zU7PF*kPeW_$>O36tEPkEVG=tiB<)&RyG744n{zP=b9FJz`27Au{yUI9;WiNlzt;B&
z4>Un>v8v^90?4hfx)U-p0;)kvL%)L7RDjAXN%x;ex7UV#+z*=5L3Vf4iv|vGnA>at
zhq*X63xhCs_RVH<Q2Ephs?{2}xSF4Gfl}0ONQz2OYJSd@m|Xdl&78C0AE(z$PgzOP
z6~<+1jLDNt87I8gnl8k?YucP7P^)WB9;mGa(ho^x?-Ls2z`CoxG8L;am^7P#$_7z}
z&Fsq=Hcgw7G>LuN^q03MWV3b^UYn3VIrJFw<0-DcWoJ!zpSvB=K7jbq2|V{x8~PU7
zW?a=K&c?#Ptj2b3`gLZ|yzeSTSMUmo%w-HSoF}qBmcITE(&|%6sSO3y`p7ve=tbC*
z1_oxUR+eUUF4nE5S9MLl$;>dhQ*)U(CulX8=E+7E(*<*!g{QJJF-}xo@ROl=I~VJ+
z)>f9L>7Z6JNSAaw3&TWCMb6}!?+nc5T<nvlt1#@EUif`>I}3wa>&NYX%|ST>v?gC!
z_xmB({N<u7Mpsa-_#1w9JEn^m-!giEbU{=v$_i?Q%y>>_DP<661+ANAWq9wfp%~(4
z_u0(5+7%woXiYO_p9Pcum;CS<i}IG|3hy006hG$V`UR;`IrlJnLQ?9hU7(!Is;So2
z=xW^R&N%b%dw~S*=H*-r3ppQuR{!s~{k=m#!BTjC4it8bf^2U<^H>Z5kT%+q?`o~@
z9SpM7TBl!OW@z4`viZG(KrU!TMy+*G3TRG7CXv&<w>x>}a~4qB12hB1AYhZbs-^Sz
zobs86H9VW9?<m<*uzlNhyDm1F$1|SKNiZ*8ZO+C1aW<&@pWOCrwJ`hlcUwN}_%a7&
zzAG}csR3jnWWH!}_*aJ3?wyCHv#~HtZaemFj?>!Hpiw`@$#c>si@7t*?CWFOH%)WF
z<o0&<<euv+JG>uDFaIap%Fe#8<-LPJJhF>HITO@ooZRmIYDV@Pf3xW#$x{zQP0O1s
zX3j9PZxY+SX*<04wM=ejXHRBb&hU8F^?!{n$fkhe6jFMFT9a&lKqfYCSAV{l<tu|Q
zXUiW}uZ5YXz%%>`?4oa(Ra^eN|6u=lRl6`NEBn*yGm<BlnKS$pOHRGTAe`>bFyrwa
zZ&0n*sQ&T#dxsBU5S<OoiB}P+1d>8v_Oku)d(*(6)w!<a{fGT;lQ~)WY&`ciw{|al
z{#o7OW0QE}<m747S!5DTJQt=4e>Z2S6lZmN+m~GVjG^-w$PMouCIm!=8ZMap+?_$@
z;mvpGr8!G3%$&!4(|<wCKKXcdCkumLtFns9-}fKvk3rUOq(1?#GJLU|4Kyo%{|J1Y
z(syQt=I!loK`R(no(83AW>eLxpxJx7sqYIW<Z3=#*4pSMehsu<Nv)67_5B6?e<0r)
zn=W90<O^fg1rDG*1a+_L#{Cf12bZP$OG6v?*M@G~4r*I^y#Tc?A*+?NI>EIJJ7}$@
z``KO7K{bqU7bjy->wAX{cAy-Q-1bx8Z|LL}_FuhjoNkR1=Olo_XJU6U*LA++W_E#O
z!Q%omazMU++n+4`o$qb<oCnS3oE&=|G@EyF?0M2`-YGEoraQyr@9YATe`+$!JUscO
zB!e((1Iv2@0ZGY|pVb)>guk<MNFJX2(i5!e<8$RbCd{AJ1w`ij0O{sT7iMQ~sO_Kp
z{rg+V!;_!03kZK#X8^O9ludpLK+FmdVLb{mtJ$nmK=^tY6Kl8W>B--}zn}b^on!Jh
zHi4OkKst*juqQN|a|#qs5Eq$KqHOS!1KiU$?-XDXXPm5T@{&V*IU@tJIs4}+1wZ>)
z!8YIQS2nmQ0I~@bDgp-RE#Ex_pwM|d<>$Mj+d)17*&6vBWK-n+$uBz@c=v-+q2HUJ
z7myYVsEl3Jsn>-F`Q=+7Etkn$oQz?u?;QlxK`pdo#-9QplX=|@7eMSt=J?4sC!x3d
z@yzG{AYl$pxkBFs<|NF>0F@Ey409e#E*EEb`g~7L=W)=^oE08T(~H#wM4GpE3Mg-Q
zDNtEH`5U`{F#GrVpZ%T3;6B^}3&#WXyk|k-SR3BFty4fwyjEQJ8#_m7KjX1hw|Qcr
z{mNTj3e2dP{Qdj$$z|>g;85jI?ACn^@-N5^;qUBBUuT12N1b8v_wRp|xBL{CQN!5{
z5@BZog$+c6wHwrWWETMO_M|9p`N^>-L3zVZjyV;exM_7)R`|ux=mH9j4-%ks4q4~2
zC`+w%Q3)uOgJQFAyISk}5C2yQ?*AHcb3Z6;gHkqV)C{x|@BIh)^~tQPVyjv>e5e0p
zW@z5Ia?Se>`+J#}b22chHo7NQFXw~QYb)n4n{zUPX6PJQ-#Zxa&q-i)pZv|7A$iI(
zp$;EdxW51JzY|F>4@6H-@|?tdZIj#Ce<e3xWtxy;xnNH*l;3@oVMcm##xsV;;?Mr=
z@Lu8ZxcKS64due^ENojoZ1^JaXvcSOEEUf@42q>a9-tCw=VL~%4xjfQ?3>|s6))$2
z*wv8?a^DAbh|136!mTXq?;Sp{AyQ;eE2K9zCt+gu(fd6)jc(${KqUs7H>kwm-yOOg
zWOn{v)KW)%8K~5`x)&t3{x_;z`Vx?w;C_(Y`=6+C%NK#<rf!dn+PS?nYAu!+_&+W7
zBq;pFe=##KTdkV%{=@pO%<5c_@Gn@-0jY&owlHr;gug;LC|2k9YITC_T>lBKzG^uW
zvbuzF)Nn{BgM`DPOr|WaR;NtR$}*4%{qIm+?LHmk>R7Ok&c8vGYo7{|Tf4n9GIT$v
zK83Aa1l1hSb(|miUoxt`Phg0c4VsxsSP(CH5<F`0p?)T)#sl^6K{b78=vh!(0lcmo
zG-}c$+Bot32m9%uQ5Hzs0n~B;trVP-xUQx1IHb;QJ^uc~{$}2THl8YPL8)QpbJ&_k
zkeQJ3{6YHH?WLh_x6f|>`oBq>Nwje?<HS|dH=YHhf4?V?9Kay4t5elIIqf^k<nl6x
ztNliut?$=CSG~Xgkbf8Cg9qM|r?W8mwYRznU%SqDs`Y)s1sTqh$bEiL2<C<!-49y-
z5*qpx+%kjJ;-HbCs0R%U>smH-nRV`JTh+<w?$ve;REK|<|4pll@hm9ULTaW(Sxnim
zHXEqc>;J0NZFq9>bS|dJH?K3EYX!}%T<{Z~&H`S|libL~w7K;sgE9M0hg(x`O*dvw
zcbt&Cne98nLiP!d9?#zX?|s3Ch-P(eR!|6?yf4hk&Hmn@A<S`qX;k5M$-+fHmVG((
z;oO@`FXH~R{kit!)`O%UX<xEF<h@~F)a%^TvaNepn^qUAdmLo6>BIilt2%iPJ}Yo5
zSysYU>6W!Di!J+6wNuTa8m8JuxqhwBGC32Q8iGJGDz8@cCbO|hfWpn1XC}kstJfLh
zTHhB4I42i&^4CV)>p9i3)C<}VYZZ>-Vq)IQ!;t)F77wTud~5m~=Uda8+V{FAKU>b(
zyq%YU7t|J<^IQm2dp2+FW!(JToiTaFcD7cPg*=ai=luB_rRp_(2_wVgmX_wpx44)<
zqX@~_TAY)`H5ryopX0o2dQ&^doX+m#ne2Rwy08?QzaJdGy3NaZSryYkbA3Pi8`Y<t
zf7SXvVS$O{QD)PYAFo>9FSsBbdGl+e>;i}xcb~VqKmNS@=hsNV6%dh&?;lsM`u;Ui
zaKY8c_XQgqLFR$N{Bali8{t-7_V*47_7Arz@7T-0s=1K+v7pZPm;05s>}3J-q;$T1
z+^)O<$`jW4TDxC)&t4|5oQ%$A*Zs;npgd8X&%WE6xA(Ft@7c?6_x7CRv$vU-^0I<d
zHcfvlrt>jy`{u8qjLKV}_Q>kI@7;eha_{!9kt?@?QavQi`#oWhnEYLoVef0uO5;tP
zu+ZpV2MP@aSwZ(!H$^v4I(NvkJP9ge_|L9tQ9LS>sNo4}(^x+KID1D9sGY66L4{d)
ziwX0b2b{-cvO&9BS9mab+BULwavp`0xeN4RWeu#PDUJNQJvZ|0_Q=SG;F1H>5(n)y
zdH-SkG0TH8iLCCcTEKP6>}O0Cxq`<f@)?h7crs0&lkjo&oCl1asAbs#O-Nbd)ykB~
zn%LA38F_SjY2;UM`wg_#ob3yw{kEz_{3kPL49no+ThO@5vgyn_K%=l65`QC<4LBH;
zO*j~pH8>ciPXn!{U6v?5kC8!`FE5GFO)+`$4GyLrC(!Cc#>tb#%^7C)8-Gt_U{s&P
zF3l>&Ao-rzyn}Jq^fjl8)f_&~NH#7LW1R3_IK7==#$&CviENLB@BL{u?POv$<z$-Z
zChE3qs@l}|1qaj`Js~0El*yFk*SZK?3OB2AGEASz$S}FHGm=@YlTmyYBZDv(SCn7-
zx;D_xZ^cx@1%m9YYONm0+^-m9oL}}gsz3cL$j++9>hW0e)xTsG4hChNlMKnN91O||
zHyO6If=W~2sjdvXy?m_i7bxf}o2+DD^hi8e8@e!qaboi_P6lCd4knPl+`;}5V`NnC
zW0yS)8bh?3ZgLt_A`2upn{_h0>=jOHW8ir&@OayF<rVB~tQr$J9}8IhRdjv-p?|uv
z#YzU<vx%<nKb)VYY_O8a_F$mv`w#rnlucGLX`U263SK{M`u@QG&#O9<eOOthA7^Gz
zUby@UA}$`wa6D^H?_?C7YR(|rE5s_y%F6V90fUNG2k$|UDq(h3CW*JprguEvxfK+a
z??3R*Vm9SueE*?;=44KVgT8wqy!A6uw}RS{ULQa$$*?C;4?wNS28O?p;<LfyKF*Au
zlW%e|EzA=2Vpip5c>h6v{;C$%qY~hr38=S}Ec%^6Cb6@-_4OVPP%7U1J)E&oedgi!
z4hNW6H3hjJi+cV=l-W*Mpi&#u(mK^DJ{2^B<!b*vz`zrdUTZ;h+Y<(kW_MNw=Hsjk
z$(-LAELXsJvz{}svbM55{jHS3=qfoERNpD3NVl>xK-iG^Pr+xZ3uc}Msbf9Ve4Lem
z*`1Z4R_t;6^MA~)tPCI#r4(7HUdX%zL?6hO#`9Y3jIOM#pfQu?<LnH7f5S#K&{eh`
zo_Q9eR&qgd$5IA_j<?u#9A{<dJgwEP%<!F|`M4-UD=RDeSEx#e?VRVdrmbq%T(G$R
z`M>1$<6z&nvbVCPqNoD7vGerguV49-+rKh2yNfcgvi|)In^}jL)a=H}pw$jiv++=)
zdn>y!>vsl_*xz5P+LP0kGgz)j=K0QG*9sDw%>MQN<C)u_V>iuiU;ih!ZDRn1E+}m6
zTAyxT)ee%s3yl|J_M;4(r$A<}YHwv<+`s)FXhs(jMiAR2Pl5aaiaU_&LB4rB>p0YW
zh>B$XtqjQpTbZz^l==o$Da`)u|7P~547;YL-kQwz^*_kGzv6#I7dJd-csvWH3Su7T
zGuZ`@*apQkD1K|j9&>yr5Zk<mR)NDvYntSOWbSVa%*WXo>{?sdA4_eAx&amn5L+0Z
zLVQ^o`gA|<Q`jsRYigq#quXTG20LNaR*Uxx2OL4?o`Bk7kn{p-;ec`%td9no`2w|W
z#7{9Z2y<!uZZ_d!NN#Xp1<iMZPN-<!&hj7BZfQK-G+pp$^3_!g!rd%?S9P@{Jf7@=
zH1-S1MNzFx*`R#H==~HrN+)<$rm*omsH~XWp8j=4@?<tvW|_YdKc_qvc@A+sZntE8
z0=uOV;uc2lMlbwsF*Z$L#FncWUEgj8&DDTrXHe&BKyx(>605rPdOmA9e3b6yWPsMB
z5B~3DRDB;%prO@Otjl21=rWnB<!6&5Xx1*M6;$>}b91w_`n+GTKtl8-vuVpu;Z7Eo
z<hL^!l7DM5?q=6^+&ujc187}gZLhM;k{_ZEPqjewzF*KFns~F(HLLag0*2sbbuQ1&
z*IBLa54?Y}to8i?`xU2J9`1kC3R=_h|7q$~nNkqDY5GrST31RD|H{n3Z0dR#loueW
zKoY!<W^z0GA<VTE5EY=&n91$z2WBJ-J{La@-iLH|26XiWNUnLi`@Yu0Gm0DC1<%7$
z5fixeKG|H9!LAi#SEIXKYf}UMHL<H&lns{r0Ih;nwmI?*7LxHxK_PiTxLAk5q}iN@
z1+*%#SkvKSG6$<jv%0INR(EnUyU6sv%nXxz&u#^^#*(|)g=Ul|bFd4|DNb%>7Xs~%
zSk;m&#me_toxxyjv$DyTZ=K!AGuQ<tvv)JvwSrbMPv-1qcyC~!1lnup*ZSTeKx#5*
z_hnD=o8>HjLmDR-SI%S*e+BB9aqSj=%gn%R+q=Kj8?^VYIh~6^tu^`ibjHckbr@bv
zXMW1gkj$>i2-;V=p(t6tlvB7(2DC1U17z+5!&N<xzpwhkY|8Tey}<`r(AqT68nB6O
zlfRfVsI`H1TYOMeJuB$e=$h2}e!_)J)uW(QuSu=SHglMiE&ecp)&(n@{9$^(purO4
z+h$W97G_hHA9Ko^rmt$zJjm!a5v<c7P4p~il`Fn=&>&ZQ40&%*AbNBE-;k60--i6$
z4q9>6H2wXA30#oaFIE*e0Lf_(KIo(p2p^R5ygq>HR#-jTzyN7uotz6AmDzb5v`2a2
z@l`E)-J3eix|*hgL|1jqDc;=jg=zDZ6z1e9oD8-rnr4F3HBH~l9_kp>`uOE^@Ms;R
zKLjcjAZ5bzsh~9?s^=j!tm>Kf0Sv(p_fO|!V3^!_@>?x<<OsBr2sAPes`0%(G%!s6
z#mq3d>(!Lz?OhC@aimQxjNYI&s#Z5>2MqI0cBaYf4R*$nKbed<XEI5yVBX%v(C99C
zm}&Z|_Ra0-j>+HE8G~AzX0B?fz1ZpkDjQ&9D@@t2(G^GzQ18dKtBcVUd93-f3WEtq
z_2l;B-7~W1q%*qingZJCHYWkng0-6pYQI8488qUhlmb%Sy#0A6c)SI&`x&$w8Z^rd
z9s_mn*fkxt4ho|0vpRzbWVc#-+pg&+4ntxJ(mx0FpjWksy1u_Ke-db>b)xJ00tHRR
zv&9pxh)iZ@;3!_;ZUAu!$Q=;7)f@j_o>TqyGAIvCW@lgm?UBG#3(NIjnGNpXQ?@{+
zJ1BEL1?yViZUU-7KqUdhok}U<PeCP-YBfSk^62#EpqZHGm57pPMtaBN+TRkTxwmIL
z|BKP42c7l<+TA_%B}ixUcK7m?=l4xf-oV1Z=$hQY$pAV#<xc+0!=QbUu(md6%mdV0
zS9E><K>rOWPYZLMDpIys#UOchDrjeE!2|JTb1p{LyU=sPE-0J4V#wVNT1!$2?yo@R
zA|N)Z=dWsMJU*u$6pvt^Zg4k&g#vUpBY0OlB3zR>S>-}JCEZuGC#PJO1LYx54nnk5
z8yJ|=T^S+0kYfwE*v+O(IGaspYHyBIWejx%tsG(A+0M{>i=FZP1^#c_zyD`$65k}b
z`R7lD&oenQHm7SbCbzMR{S8lM{wdbz!kV4T#mQjII*Z|2>#Zs8Cwx$P{7U72@dVC{
zg)2ZN`oc|oe?k8vR?~Xeh5m*obN&=+bZO0c%*^@6xYdR6+LZSb4CEibhL~lzKovB~
z{uXp%6)2aW=Urw?RtA<-UDx*)-oM(MK9k|@`M=@Gy<fN*-CNTh-Y{-gXDnu57uq)c
z@$2dT4sM62Hg#>j3G(Cl=O7&?PyY>1ZvVmo(sA>SG5b%3Vg_?zh>ptb&6cbT%$BVT
zuCC0t)EVDj=zp^LxhCUYkRHyTY+!e@a(**zHDSEedTk14<NFB(0*_y+{GYfVrqdSW
z{)Zr4y&$)7|72=(Va<BX#rX-Oi?i_($iIA`uw&g`%)lU|xxbjfKv-~p7-$VJA1FK(
zx4)k-froQDXr-h8_uIYiCv4yai67nD)L>c2_6M}j5mY9@%1U9*R>t=q;_riM9Iw{*
z4hqJg6|<mPC;8oUmg%>c8Jc%_g^1q*)j6l)#9uQr2y>tIoXq)w9X9&Iyqt^S()3o>
z<jm;|bCM?>XEx<#u$%f`!5|W}5|>GgaT45YFOb=fzs&rDEp{N|K%h~eTMyd)oceI>
zN!*{L9}J9I-RoLF<@RSShmYcSm>HODe7u>}c^DeC{)Q*#9A}se+KqSpIU{H;v3YyD
z->&I%oRj;*Ij6s7W|-W~ZQs1Tn?an7fkBw<nee67eN#Z|3lzLM-L*QC*}gI{Z{=oa
zb!GI7n)+Vhf)8X&=~*UXOv$U2tr9evbO|(0mY@*uID+*L^VV*L$t*2DmbFGreV?EZ
z&U?05orj?|EcuN&<K*d_Op|ZIT(jKu-1G^~*ILC}!Tqtq_YM<E3-^OYrtD9!dV1~$
zjcMF}c5*vtPbXwYXM;f7n^i5soGrhmzXZ+XavC#l?PNIBsy6j~LPG%KNyNTN(0)qL
zT7dhHeuCE}oC5C$1?>!N5P*~?UizSxr&i}=&X!-RK>k)JusPS79Jqjq*|dwnYwG)i
z1n=Chpz*!=_dsWXOt3oF`q+8FKZG4lRUlgw&+a@4D_dhcIo-9|l6#*su)1@)CQp6N
zaKkg1;X4zoT)pAR>H1je`#<JzHpb@btc;IEzW)<Rl1O9T!OAcv)ol8q>B;3c7#_cT
z{>O3wr)yI~^4sSOk0-JHeaNcUI+=}uBa!XB!vbbTSJ(Yh9!jK5Zf|9@Yn|~FBD1gc
zy~6`WR@cD&F<z4H$;sc@Kx0Xu(G}1rDuaYbn)q{O24?f)3Y%J1b?S8{mtAM54Occ`
zV~}_Tn*W>}{+v;~oe^{%XV|Xk9nSAB<gZ%RcB<8{ReT$G%>Byy4gU`#N@!5|4C-fq
z)*q<-X?x=J1Ga9W*{YRgRm;Jb;x9pCIVUAREsEp@b}`WSL~;+C2(x)7V=@Q3$n>qu
z49!bh&k3`AU{225CZsl<CwX({7Y5_5D-1smDsKRtUcm*LlV`h=-FaHsX3H<|TKwOj
z6KgCNKvHzN%mimvH7BvjYz<6~lR)b|8n_!hVJjy<J4*dp7gd7RPJrr?{C0?&I{88K
z`-MjnLG?=;Xtc%kELgr(*=8k!?^*G!pplTJI`22cKL(G4uub32%%Hq(`Jv=yE{^8y
zTx_hVchW)i3CJ%X|AG7lazAK<1?Gpjf0H}7Kzo4M?qttB+%z4uzZ*2eB|KG~!EP!a
z>-&a+x>c=~ptZJ)`=)d}u-p#ulREz#=T`Nb`<YEU8Q(wPZ(}y?WO)Cezm?gPli~dX
z{#M@Ytf`6HCvzGcRNM~{JKqc%ThZJOQVC+cf3Us@BBS4QbuTC#1U*2EDmI(93JBlY
z&L9lhWhTfjwW?+AWYDamUgzYW;tax7Rt)b20(^AOCiif%flj&s?>T$+ob9u^LIQ}t
z`TBE)*6xq*nYXtH{0*Nc{#X2Gzw(wZkeN$?4IY}{88>0}U;l;8#Tk^?L9=T&`-Pvg
zb2OWCG6|P|{|#DUIE(#eKX{hSoRhJ5f_X}_c_(A>gykuQE3lhu;GFst)CMh{U@p?U
zodrDS2@3h*3F;!n>Hz}H+gk*bH#`xjEEi_~p5N*Qn(s{JxWxpTZN1qKnqvjc-$CZ>
zzRm`@ml0{bG-RGhn4NvX&Hjt~L1xv4%Zayo){6h^7oJ|p1llbG^Wg+5s5?}k?offc
zL*=ttfC5M_*bVg{7eH)R-f%?#WaDRb1_jWZVX}x7BWT7C-BraC*cH}p2hCRsfB*jd
zaVO`S+`W~dE5WM}m%VBGf_)X@sus}h7-q{>!Q?j3sfL}b${W6jDDRoclI+dNx7I!R
zi8?zZXS2I=aazr6R_A2cHNB}FRH|)AT-7b!$;cqgc~UufJ~ucNdEM7G_jZHMT2yO&
z|KNRR^L7>ywN~XlKUwgvOq|@>A_yw8?Qg=&<WwmI&1p`!U;q<&DVDjP)%E>>{ZBxr
z2Tf3hi%WWL=XHI5!2U5<Too=ZyLLMxNc}^Q_ysw*xJc)IPLTQsU~vVwxP<P0P`kO&
z^?kyE(qs-+lh5i5zaO`<f710d_3rhO^*Y#`+^%k(ob!_*xgp#<dA>U%Xcreq)!)yY
z+molKGrm9Izv1ZqM)%yklerlVLP95#vslaFW1}admRdWrIlIX0E>4D4&D!7MrJ%a2
zwe-D10n5F1ul8$gL2c7pLA@YXV`#l5`rcs!)ASlfhRHoV#o|4T48lA;V$-`B876mk
zi$P59G??B6TII$iHoX_L8nahIyce_@vsXgA8#Ef)Ez!87c}I%?D7{5>K;rVa__?;A
zwo|R3Ipqa4%{y2a=cI^tFfs^ptPq2!ST2T8(NNXAgN12M4n#$VC`3iOC_+U-Me~jp
zmOTj&6&WHB73m@f6%J+1J6c%xWI$AS2t!o33nNr0lr-;XVcSyxQK2COQK2q`P{B~t
zyrYGEPX$B;haf}+yC6cvgZ$<lEgW~C?s&luQSqD~q2fSp^NtqIJ5YC=;De|*&WBL3
zAiH@-3)dZ}J67;QR4nI3sA$M+-qFH+2kMRv9*Bx|9)ya7^yVEcJb$3>$l!*kNaseV
za7b<5(Zc%&>JASshzfTugbIb^<{d1|b4nn-)!-Bd*RSfF2o(&8%{y55=F~t`aBx6W
zuyY_(Jcw)F!NUIsYQ_sTh>GWI2o(on{?tH3*`cD4l(&@iy#qsZ^A;A7t4GpW-#a)&
zHSb^%YTn)=_}4P2Bd#4`!h#4;`Tt(vLC#}d)*H<`ScIFmw+Q8RWFe_Z2-~}xjZ-*M
zl3}fTGTTp<<k#wqz3$2EKbhvbCyW1N0*&;a+_u#{S@0**`wjMgV)wn@;Qu>y<NFQw
z7p&@j%)ojocIW#I`oAjoLDIbE6;STV1<B8Y<zCLqTlc+hP^bls<eho}8pngIx^9rr
z>P(JVzydm{12RshxS*9Kxmkskc`K*THBkGHfgz>Yyyd4c`z!`!hUE-zFE^XB{N_z>
z-o`1M-0_@2n4O&|x#c-Sqx;lH*INBR<4M2Xf0*AVxWKCwwNwMGvEIkB`S}$FggW`2
zkKkS<Y!<B9yiEXFO13;_+0>%f2I|xANpIfDA~f;*p5i<8Gf!)EHce-I3F%Y9=DlDg
zq<lL_T&r_Y3QVRn@+L_({7J@d!~X_sHbBDl+!Ij9f>yIPNHm+X3M*T%{LtzI?af)&
z>3bSnCp|G|==4f_J~w@G`*-%I{k-nUZO?fG(|OsG`=0Z0rcY)wXGm_mF4UVQ+-Am*
z+<9C;GE11viXpk-xX@g-<lgH-vh2yt&&60lIy#>Vh=S;r=Mp>9d)c4%CpWoEN~UwN
zCwGF(Om2BD!O5OH>p9=#>m>|-yI(#(n68*Ux!wH8)Bee9><-CI*CmA6*<F&SKbM$%
zU4>z8_d@o`Q_2}QU4^+Am|Isco3aWBbG7`u)cT%*p^(|U<>#uF$mf&GO&NIIJG~yy
zfBp&Ki-}&3=RN<#>gv@tnU&?IFjoU})6C@91x(E5EI%h-cVU?Py`A4!+@0~%bmMS$
z#~F`7YpWPtuT57r_$k1-g4LDL3!<}W=41B-e=ySx#0Lv6E4ngz-P|t-av{^t?Uz6+
z0zRC7esI5_E2CHKeu&Fs_j9HvPk7FS>?ernimpvF9|tY?1#%IyDa%igtHjkA80@A$
zXL7d%ts#?42kl|~DbTtdqC*g*BXYqvuntvJ9qLjb9h;xKGlJH9*>2}_W%SbBk8CT*
zwW`~ZMIbI0+|SAWxc&LJ*1gDbApLLmPG;>C^lE+oA^+Cfy|DgS+Z(?>4FaGP1sd-G
zr6<?p;MDZYoT1Y*_Py|RF~+&+!sYG!pj5TF^$Ek*eqlBPrk=#)=HpzPX~L{#OvxR~
zd3aNWIZT<7d)Rq}SxcFc8<+D4vz0M{)PUA^nKLD~KWDK_pUiH~@U=g=<2er}dvfn{
zF2nTXZZNy?IiF^Fa@%u0PWI%6=K=@8X-PHxYril%`+?+1&jlu5R|BV_KK5nPdy+X_
zbr*or5U3w`uJt{`0Uu`bmS3yd4Btc3kmutm&%aFc?A*@ks@BFdGdW@b1E?NmbUim+
zdBYb0M1K&}8?<VjuFk-)YWnl0<)1(&dkVUK+>Q`S7hKh<=$gC#9H_tiVg0d-+b2&K
z1E)HWOB7vQx1+jE(X|pyM9_8Xeq=p@u3NVYUsYp}?NnstV};rMoC{=6=l(V};jeA{
zFwu5Skf`Z?SShrA-$d~Gl5=m`{(#n)TzYZs2?HZ&Y=0HFv^DAy=4|<aRNgk3urix+
z2{pTNGK96MO?}V6pa3d!SvkMLN?S87ETwG_w6tBnU2uV4D`XUbtr9Yh02)1jm9{W-
z`dh(gN`luKO=o3bnB1B=|NV#hEwElRthWu3bN%xEgZvHba;i(;fB3%vyIkwa_aEk8
zL6UpIzyX@WYTmAHHz%3VO?d+=gE<Ei!{#<t@czAGH4cMj4_1a^0X75BK0c)s;jcgV
z5hJ4zz3Ems^+q7;b!&AJbwt`d3(?(fhEq2OvTkfPA2-6OR{~kDTdTAvE2DHMt0TJG
zm+Rp)K?B(Y=~fN~gx*bU5Vs%Knv)C)FVKj>whl(O&21d;a8qX3iWF{`dfC<S=oP@P
z*IgNpUIpxWAue7nkJG;yxcv*!`&=5QUJGQsZmpQURhPiyVgr0GZWkflR;YUg<|J#i
zfzmXi$94`bM5<oFVZa>9#voj7%1|oK`J6dijlqfCYHG0n2RN0_Ni=m&?tab?3Tgo`
ziMl8EJcph-sg$zOea=JWJ*?ogpp?>z#G8{F=sx2isK3pd{<!n`AEgwSI{3`ORb~ce
zQ`Vn|(2+a}8vU5ue*8OPW&t*DB7Pk-a;5%__cTxO+@t2~3=Nanw*C`#U;eK&EV<x1
z6RUe2dveZl_=#6dQ(^hKHq5BCsR1+s0$C@{AR&GeG%A((5!7ejd3r{<=IJTL3lD8)
zXJ}Bi+44u2ee1u;$Cv+G)sp<}Ia90qKlbED%bA*{CC4vd0O@EpZTYL#3Yy1*jf8>5
z!74+Md9|Tu!D~lRZS;Hv(!clkjB4HEQ;HX!!(!v7=PY0w-+^t6UchwGy)ZQS#dN0a
z>M{(I+rJ-#?Eatm9%K^KCDl#Sk?qEG2_(cpVcWdD{Sl*U<M9>cpjGyeStoc|3fW)t
zU`FzkbenR-nTMc|7iMR_FO%GPeop;N_z7Da=?FDV4G>k!?|@Y8Nye|r{gzDf%=2@y
zSyOSTV@-vb*nV9mdE)sw`H1s8VfHerf>I77ZL8nuaAs8npMnUkGu}@Kh?PA0eu6;?
zEET+;;J^T5!+Z>JbNWS@<cY`k<ToA%nJoDhVj}x}=B@4S?>`jy2p*lx&TueU_$vdW
zE6fDYOdY5vz#srot$wF@OS?O0<YR+wvJWf6^ipvD-$bqT{ecBa$q}p!$g5sgwThR4
z&VW2-1d<Q1dhEpdZxv`S1Xwf;B)TD>uJY>p2mMVCw}b40t=fg8T+d^m*k9E$^Z1<V
z&f}ny*_)<IK5Tpevjeii4&t)*OHh{y7*>NudmKS0Jbx(Q0-5me_MY^Q*FpM0^M;__
z0&J}>$WG8aq~u#j7^&}<N$x#9r+n^Vp7f^aAeErGM`e>G|K3k1$bhJMzDFjR*|g=~
z%l{yG$ev(unp^I^XXazj94jo`-(P4b1cfAIr3yqh`%al;t+vkdbBYmZ0%R9R9XOts
zf<}r}@3fu;nK`+=eS4!Sqr2h)R`q1&?MzcZJHcij`!_i(-Jy>Sq9Xn3w&@+o#-UFc
zSUZ~<K=y;qtw|R7%AnT@neT<n5Uy%@|3N@;RV(Au$x~UF8YhBWzbHko734!uI6zcE
zLUZ}vRV|=&0a|S*+}6U-sQRA4F`W?_O2^lLQ&Ki4B`s@(gcD?!RB55o!&5)lo-X@y
z?#rbQ*WTQEaqr2a2Wfw@e&l^&;MD7crWX;f*7qAW)F(T!s)(OvW?;5ny#cgmZ&l0m
zlc3f9o?9BdlAGAon0Il4Z{uJ#<6>y#TF9Bq!lv^6!-U{u238g5{<bB`8$207H)eot
zSLi(6ytR`7G`qU2buydF4@l~J#_QGk{y+lPs#eaEpz(L{rJxb-)`Raa?4JkPCnLTJ
zv{H!cK;!8-=@XBGW?4X|?5tvexV4oF<kk-*t6G!2StUSh2BTFi$)2oojb6gsEI%f5
ze_&tM8U;Eho}tlP_F=O+%MZ}1^5l2F8QwEE>I;L`N{2sZJU5;5D6=}tk5;W2=RxxC
zHzXLWYIz*Y`e%1r6!YwMF2>o@w=+mjS7R`pFD-7)uyg+G_V4zSzq21`RQGCC*7?Pv
ztP#cfp5db8s&<IWp8oM_RbKIv0h9`qcd&1P(eF11WF>pC^1*W7vtJ<p7ci}AP4;Ky
znatJ#4VSdPAm4nbXjX6ev8t=HU0LPJkII9|K_7SyW;1$k=lKtsHTxjUbL7YLyP(x9
zZ`ZN<S}p*oX4Rg^l^pk*1GLA^t9ACZcE;IL+Zm;&w=-PrH7=jdIQx1#!_D5!-^&^A
z_BN`%Kj7fCsx{e>l?`+vbrLwF9;&QrQGD5K+Vb72^*zHw8Q-hTYFw;WFEOhf`2q6B
z<aYLsMm5C+ttyW@uKa-Pe?0zA`g)23AA8<(o@8UuxeO<Jc^)6#4q6Qc!cX`A4Oiat
zQ$cydPo-4}Tq(~=mQ}J<J<D>-UY5<4^QgwDc2TWYt6QZf=)661ZidH?e%%74HqgB{
zpmg?Ffa?x&s%d)#3LSy;RjrT3SnoXCy)eDeYw2FehoJlg%ioZ^^1KU_Qy^(g?d9~V
zpc7D3=e`#>m>~#0(-)fi!KrTPj`sx<LP2>QBFZSJ^a4`8f^G|HR4G<h_$XZdoqu+i
zJHzbhY7ATF+jh^MF3zxXeyV%&<mU_%PpGxEx{6-~rQoO2-Zy;Uk$eit$Ccm{GaFsi
z+90y5Q{OifaHzGdg{o$q^1k7NpjsPvCTgo{6-3q2N$(pBggKwSXK-K#h2r}Hh7gdO
zAZ5X-miG(t8x;={a@EW;YHbUl_O$lCZz$k~xCv4=g3A8)7a3LGFUY?L5eJnx3=G8q
zhii&IEUYnS=3po`SX@)Ayr4!n*qKqdSeW6l6!SmOoo1l>mB8`}FnMFJd@>g^1B!Ys
z=6}Tx7S@3Dy#FBoH-AF@A_h<!=}D_Q=p6gy48<G1*TCBWpcDJuh09r)Hc#EoAbGlY
zfoU!1JYdO_#S2txA*zZuK*Val7H@!wLE0C8-IL#fP9SqI+0M?wP}|??zIpm`2EpUS
z3t%=BZ*Z?Y3m@ZR5CE;T`K+$+M=||pKl;891J?Hp3M!>ndqHbG91JRXpDqNmCRDIK
zWOZ8#W)~E<x;Ke`6)&D3UJJ6bctUt>F6@jVa614r53tnry@Nri;8R5Ef|PWr)8B7c
z{{<n6h~ITB?*$60wu4u>wA<e~Gnt)%WzGdi96{m^p3;|sQnl->_X3T6Ad^5f704V&
z+TG61&Ty8!c!GM(^dromb0l-;Bot3zubGolJVCr>PDb&B@S5%HjBJeVliS&uW*puw
z&cHso{W#N%!|x9WXijGRz$Fe@kDdMgK!FtVvKF41Zqtu~Y*Z}+&7cG*LfiyOH_0Ka
zJdB9lyAb<|XM%T239~ILTGk5Eu|Wc1YHHg10|i0{)6Ll#*<00x*^f)f95xqcU~hF3
zW<Sm(a@bs*fk~MC_yw86<{XS{!fYN)%UU7sY0YQtyW!Y;U6o-o+cpMiadyU={c{dY
zWPLns=|5o(4kplEw;!MrBx*n<!Q^)LxEYU&)dgy1JTF!csG0G4GP?p3C{&6A1ZqIJ
z3*rk%$X13nHK3Lzpm9~l^zCX4OnZ`9)hD+dyD;OBIXffUWHxt(Ifoi2E3(TRhQ#R6
z*7pSlf}nVSlp>(J1zXQcvwi(Nx%3<VQ@7;*+Zd$Tzy1_1`_7;I{1{WKoAvZ(48~ud
zGcc+)HL$u{iyw#cK(_8lZ#=%IcuqBH>jly31(`qb{AVQr1L4I?3~bD8Op_NeF&MWd
zF~}YSnFukX^ZcITIrZ4qoq^6q0gcCk#$r+D^%^9mmoqX<ZeKnZwEJO7`i$)6<L!*f
z7A!xNZLa)KHhA(&ndQr`wFf7<uj?}EN`85qjnUKa)MOTxpOd*;ex-V|`ZS+pVF0=B
z<Z0>lpT8%Ad|YvxLAw3tPcS?GHiNbJ8-}0#pf&7_Cn2|0T$`@kV9v;@ncO*>t(E0*
zzUOb$@lD7%B%smp$?OX3$_-x`CbK87FK+nC(CMDc@Rg(2Jz4ZC%Vc%|X5~hZoC5P=
zFx|kc-1L<})bp``+V@(}+@{H%^o#dFA$#*S=;Uw5?T>3be=<pe&W=1aOSyrIA#r=F
zdou4=2CX(ooxYR<GRvmg^<H5@lrXyi^JI1fX643L42v6oF$j7}ZWm@xV4lqG!2EUl
zWcCks$)}bxO=kaKn0$LV%WQVmbF<snL1*OhBqv{InLLf1NxU4i%E7&R^7Utop!G1I
zxzNAmv)kDNR?Y{ht#wb%yUu`6xqJ_@N?7iPx$fwHi0h8FyjR!|P^|i4V^c%1>H{!&
z0ZbkMlN-R~0x&rNOg4bY0x+2XCIi5v1DG@blL}x`08BD~$qyUA=7Y%#VDbQ%+yEvQ
zfXNA9vH?sMfXM_f82~07z@!0~Q~;9<V6wmlWO4$S3;>f3VA23gDu77=Fv$QWH-O0n
zU~&SOYyguNz~lii`2b877=cXwU<)E2fXNGB@&K6J045iJ$q8Vx0ZbNv$pkPN045#4
zqyd;z0Fwe>k^xM90NeG!4rB`h*hU2~DF7xDz+?cJbO4hEVDbT&yZ|N-fXNMDasil}
z045v2<Ogez$q&Hf1u%I4Ol|;^3&7+AFxdbm3&3Oom<#}u4q(y%Oe%m$0Wiq`CO=q#
z%?Fbgz~liixdBWr0Fx8IWCNHi0Fwz|G5}0EfJp-|sQ@Mgz$62h{9p_=A52~VlLx@$
z1~9n*Oilok4PdeWOeTQI05ItQCJn%(0+<v4lMG<;12~i(fW!X+m^=U`H-O0nU~&SO
zYygu5U@`$r27pNiFlhiL6~Lqbm}IbPY9KymFYiRoulRB{`)*{F=s8>Uuy`tHc3;)~
zy@G&n@r19S{5Rn#n7j%mkAlgqU~(y#oC+pe!DK0zOa+snVA2&#nu1AHFewTqS;6F2
zP%fPC6ii+PlSjeiRxr5~Oil%ptzfbgOs0a#P%!BVCQZSlDwt#ilck`XF(DO9hJr~~
zFlh=VRl%evm}CW$TfyW~FgX=Wwt~s4VDc!Kd<rH@L2*9eD=7a>cnT)3g2|&`ax0iz
z3MQw5$yP8~3MNy*WGI+)1(T*=QWZ>!f=N~|`4w!}S5R7*zzVie6-<hP$y6{I3MO5_
zq$!wu3MQ|D$)jL$E0|mgCZ~eQRxtS$l>a6?1(R37<WVrW6-+J#lT*QDE0`<=lc``b
z6im8;NmDSX3MNItBrBNw3d(;Io`T7%VDc!K+zKX_g2}01vK360g2_}c844y{!K5je
zR0WfwV3HL~eg);f2~WY~RWNxJOl}2}OTpw+Fxd(wOTlC+m<$Dzu3*v>OsaxOQ8390
zCclD1=_xq;uY$>=U~(&%TnZ+qg2`4eSqdgo!DJ|ybOn>9U{V!Kih@a2NX}+Xez}~5
zQPAswbfhYSG$*H(aOKPYu+wN5HCMHO<{ImpW=}C;nEa)Mc{2M4{>{^;gLmI-{<@q2
zBx}D9(voC?-s%Qgn+RUH_G&o~XpLgn8^kF|Q7_`2G;mCAfA(LP{Q>i~uH>xmT(cup
z8D@8KT1iWrGEDyY^1pC(H`pFdccZRGO=(V6>&ahA|81U~&Y0Z%41C&2{?ExzTNpP_
zNo8Ewv-wL2BdDjavgdDTa>FmCpH{7|o2P~{Zf4)$ARMK|@K@Bh>K8+6<L0NXj3C#>
zZ}w|l*82X#{Y{u>AT7!UtycuCJoW!P`6&yM4J&&lhiWk#+z#?vY3Rf4!k`<pGMDp!
zR;YvSX94YIhwQCrU|83A^`udk>#1#BSC6e~mkw2BP~O1CAkE5ZB|Y1m0W?cfITPeZ
z@SK3^WR?&7(w*$qo2R5OzW;Fk^~;{kS5g>-zqc?xboXjaX8+Fg{zLvNF4j&r<qb0#
zlnqufC~vq08rMX+wFS1r^8JVN&;N!evwUR|cK`YxbbiOw$E?l5W#SC`+FIFbZ`Fox
z7XQvr+dGksi`92O=vFMy>2$qrT&$tnOG9hHz5|WegU*Vb%+~Txn2qJ%WY(6yjH>TH
z$bS?B?Zx^F8uL!<1dU^Z#@|6aMpqCE(i`PS<Y!pG1?jUwM0g&8?tVfRS#Q3TO)15=
z^(%P(0-_2OTkFlgg2lHxfckR~@m1~o3<3Q5TiHdDMYl5OZ$B<m3f&)BS*Y}dK>{>$
z&}`oFSJ~jpzh-lmf9uV^@+q5q`3D*iRVo3wi&0SN4TFHP(w2YC>Ms8p)s<Dg{A*Tk
z`PZnvUi~Ydvf7t_%&JHJC4o;>BG$~=;a|aL1h1U$C<r>0U+GC7I|B!+yRqnUhJ91l
zZ(r)5lv3LZ3L}tDkX5s~L)3#*GH~><@0$vWsrB2RCg9QmQBPg-gIO6Kq&F}z1h+zI
zRz@fvO0zOS`B0jb8On#!tSnGIlxAgx@}V><8<Y>FS=pg{D9y?N<wI#!PADHrvvNWC
zP@0t+%7@adJWxKAX61$Qp)@NWln<p@`JsF$&A|Er<p0Z1I+zj4htk1JP(G9nW`^>i
zbTA8)52b@yp?oME%m(E{>0ov!A4&&vK>1KQm=nr}(!pF%K9mmThVr3wFb|XurGt5)
zd?+2v2jxTQV16hcN(ZwtJOcSYxD`sXGD7)Knw1I4htjOfP(GAqWr6acG%G8V52abz
zpnNFJ$`0j2X;uy>A4;=wLitddl?%#;(yZK2K9pwVf%2g=D=(A}rCIr)d??Mz59LE?
z2G&m?|6hjE!HiHoln!Qs@}YDvGn5adgIS<_C>_iS<wNOUHYguT2eU)@P&$|c%7@ay
zoKQZL4(5XLp>!}eln<qYd7ykK9n1^mL+M~XC?84(^F#Si8dA1`?pALOS7l%hXJr7D
z$Il&LB^F42`}hC+3>=Q>li1g*v5HKd%EtJ&*ZA8vhGemA47;YSSGy|p^c!d|J{yCu
zsVKZ8KbX$I0lE!$z1mkc;cIM+m3^DPK4VB`+r}W`2(s_&e&m{fpFx1R8Ekv2y0QRr
zeV~-W3BF$t<Py-0fsm0U7*D(vG>476Pgf~rdOI_N@`mMyKqW3j-SjqQhRJQuGUg;D
zcVB0ik)53Slwn4Ga@lf*ImwS_UjNtVu9O1Ve+yA>d2m(hgiMay<ou&db1GZUL-nUX
z_2(z29tW9H@RSLnzvp4k(>ZBV9x}SldD`>1=NZIjN-3q_^AI6sa-J1$2ki-NPmoDY
zZhy{@%<&au``qWyJ?9dsGKrw``IJ&P9&$VdxgFG^fbAP?U=Z(M2CXZOX*TCzfSs4^
zlG<#^%AwVn+|AB7B|G`)6^1GK$v>unUB&(%v~sR8T-o9!%S3k2>bXXDWt*QYh@DN4
z^AYD%KfFJgjpdJ58)!vT)AWVz$)BdPG^?}x`T2V``&I^B_vEVY9DeOuZOhuGr-Eix
zpT33k$x>gv7YNX0Hs=K0+xkb4UD@EJKrPt5#Qh-sH-BFZPmce}<k!BeO$(}5^%X?#
z(r51lCTN0O2+;v?A-dZ--IH6sFg$ix@CT$)*<vNsC#L&hwt~bUHj9FHJ%aYxfcD!k
zNK9V|nz7UT4w^}udwTj3(CLXT42+(Z3!0`gz6FUU7yM+JlfcTkkY!Hs*YCot4F^GO
zm`5p~J1{}*1q2V$uIYRW>z!(3y+4qD7ctHW8Z(8-fl{O}>r$`xAL?&|RDfa<RW8-%
z{fGTGVREP|_tv!-flry~br){G`hPYjD?{?X=L|F5lOIfH5>E$@nO*N<*)?U318Bqy
zykhvl{gtU75i8&-LqTicKC3fiFo$!p&tgA0x!J6fjoFNoZT57~II*(MmtRxe{aTex
zj{H)#xbjO`@5?XU6=3z|oovl!oNORH%CcX6%>=8u@=Mv`$uDIY7O+aj6(F4~zmzRl
zet}Lof4|`VUTJn#c!~t=%d=`tKKz_%cKCO2%V;O~20vkTmOp)<^H-Bw-8N5K#t_;+
z<8iZTCo8ilC#x`9%dhtb<kuqn0P+Dd)HSUxptF%ctA(HZQnvZ>OWEYgulEb;w_)1)
z_{8&HxNO}#WeJ08|BT0l+ndcf*<ofY%Y6COiR?>Rh%a?fRmpz&)r+hO8Ww`vTU}r#
zO`fj8v~fQoh3MpIWW8^=KMxkmm?@-H|NV#foiKS&3~%QG&0KgrfW&kAF32247wfL6
za~#b&LGk@rUEw36>zrq>UKVKH;j_8{SnTWe?d%LpbDlA}p56ZbgZ(;X(D^m4H}@Y*
zpUMsr{kUBPbZ7Jj`Sr3#WlCEQPiF08Kwow6SzQ2Zmh1LbcV&~G42-Uk`;|>N85mtF
zw`2O?soMJw_G@820QD9?=j4I*IDyW}GwR&d3A(wqSe?P3(>=N4D~oRP<Pvj+<R{yi
zmL6<%1?>|{uuOJkWdO~RW9|d$b*~J4Jnid0i=t*#PF91wW#E&E9sD0hvi`ZaAA0J+
zg8x$)Ro@E~uz=LO5BO00IEwXGEL>K83P^SWQ?ofITeDdwE3+CW>#A0@c97i;(vL$}
ze`JEr&j8O<LGrDt?E4S@=fnI2iVrpDU9*iYyq;>Ujjr!E%s<_#!uj&?EEVuN3)qSc
zi2kKA??3#XjT}ES4}wBYBkON?<K*P(uS_5_K`T3S@{~=E{A+bje!QKj(>?jYa;8RA
zM%DKl_8(<7Yx&3d7Gwrw?zA+t3A~aVa`&K)pN7}_4f{_{eF`!OG9S9BeNDbW(F*Tv
zE$=tf-${01W$1VUTZ;lpBOn*R${<G9_Z#A`OCE)|S5@@=hyN2`{*`o3&e_fdib>G@
zstgj_TDn-Lr-9CSN}IfG>I}zC?VugjjqY=vz~T#3PQITYzk*S9Rr}*m)_-reYj{m=
zZDDvnp?(FV`~<16s4^*AlfNR{ph(%~$)EQV-XB@j{y2{HSLuF`xIxj1Y-O7(f8ICz
z|BujPPz2KPeuDlygqVgGs1N$SVg5Z(PjAi>gbcC|AwFZ}e*Yo98Rj#HpFpd@Ag5e`
zPHijJVlZfRPyP%F|H{zh>0cR`UD;UQ3pi-Pd<UutAiL6RiZ(vq1}>RF^Tqw|K<SDh
zc0<ORoXKIkK&P&Cy%!MB6Fs^nV@1w;1%q@D4cbxuUf_W#D1E<I_)rAuVZRq(&_24q
zHq>={X=ownv=MOHdoREcysDkib>?x1+mAB6|Iq&()$O33c&GcemgN4gOvw+nGwnR6
zkp&Ko3-i0sLj#m|lBa!T0GC1+_V**g2^4n_9;8mw$a;TaeiJ0_ULxFc;r(A^_qhIj
z|DpdK%ssG_1aT|t|Mwrxzd@JV)IRYnt2-!EpE7__L>t3<1p{N4DsbF-zgO6x0~0|t
z6Kvmem>ekXKryHG2Gq-E`J>k<dT>+grk3{?)<2t(0CFeeb7g~{46N|IgrGDBD<RHb
z2E~<wlQ3J$-$vK>0RkqV&^ovuv?2(!9_Z8$(25`iPSA;YitfrLh`J5d%2Kvr`Ielz
zTuM9~RR6Z8aIsoVmF{F`kZ}avUjZtYHL^fwrw6r7W^MWY{)7G3WJXr8JtaE|w&W;F
zeEHGo?$xSnaOH=x$&(+-k}N-zwZ8m#zrg<#xCXOf`JrsU@(Xvp+42*;-efjy`7X@H
z@}tr9{eks6A!|z9DnYACJQJH5G_u}r*ngSP6<r*hwizZ=GrHd0{+{7N1-ktEhVxq)
zU0-fT^-KMW$de%Z8eQKvyx$nOA60h#Gu5*ozp?yKHevYz+QXuXuK$VUNl-XIYH=^n
z4e~#fEx!B!g~$5^{JSv2;PJudpU`V@SQx-+@xOb)yWJ0*Kh^3EIy0Qnm2-ciE2w1C
z|4|wGcPnJxxApLz;ycxy@UwRGS~s<twIODYL1hN0429IQpH&1tLiL^AQ+%hq_juEE
z*@KHjwzD&EE}XD$3M93wUT1m9^7j3Q^?O0(Gh}TUgaw&BFIHtRnCqVWd^;b=WKi7!
zNj2%tpfVp)m+Lkfb?%xzxx|#AsU4g{7o2Z_m;qTg2oZZf3t3DfYjSHF!}|&GJCH?T
zX}lkF_KyIA2)K?j<78dd`hJ4^N@SJIrl2}ht@Ztc`u)h_I$3J1!fhav@1H~#hpS)k
zz71I%?6wK@Z;-`6;RwsW?<d@!3#(h69)JHqe>E%@&vj3JvK@3*&I3q@xSOy&Vc>v-
zh*2vj7j0{OzhM0*n0lQ&4KK5{_Y3~7fr)@>5glKHAPvv=3-<59CORLyt_jrQ*2y&}
z0;#Ki3{$7!^?t$q*T}s1CS>0HnJ^x*e;~1bbl>|A{qVM&qu}iJZ_G+hq;Gt8WZ;mF
zSixw`@q-~b{sMz^M1}*S`<z6PBv$o>tY7<O9xAdavOe};{}1UA607qn**dpk(W&%=
zfde#3y{bLAbUTM|8|xq8GPXaUQ~Z;8m$8_&&H$Yj#<Gw-_x5BlcBaNjjqZ)l7$<{H
zX_+j>&U|pv%tr^+9h*U`7G^$LsICZNG0c24QC+YZbcXuON1f`N&7iZF?WRI}*{Xhb
zzgg?l-nTcWB!kA|d*|1N8;5^qDD8LstdycR6%;?9Rw|@l44NO%YES-(?6TSj#RbU>
z%h=3XWx#GzWPjYr{vUMC7idL5<0MA+#%GO_h1nUHCQpO7&{6$h^W<;e`DZ>-R9^^U
zG0c1<s6Me7bUx<HN1W=N&8^*?$E~0)WQDs>BpEakzMbJ}|Ko|zf9Xv<x*c?i8N_A6
z*HalLfB(uX3_6ki{ARYJ49q*&7(ip?yW77x{0-ZD?Hj}9Z)}X6?>4g^Wl&r&CAn67
z=Cg<5ssEKy^uT)#Ky5xLc45{J%*ju#Gc<|Sy8aD6*bHJjnjT{N8@>?CPBdM__BVVY
zm|bW(iS2KACzxGn+QpW9n2n*<R4K&@9BL4EB^Phw5)MyeSk=zQE?mm?N4V@8^RDTg
zy}Hjpv7B77oda|?spbM<R#ukekJ~tABu{Q-{j-ogm7@3+eB7!Ii($~3nA&h-@#732
zo51&J|KG;o`*|Td$R?1zbN9o-;OA9P`eI<|o%c5!bYpvMzwUp%sjyq@lB>6IO%6|E
z&}#34`^66Amsg;4k^Esh*WWPE+E}P>Dz<URfPJIL{<!1%KT1=?#K)}aur$GJ!Oj3m
ztrO?}4cmPE8w1GJ&Cl5xlMA*nJ)U#@ha$pn+u?q@C<97AV&L>M>-jgmsiENWwLqs7
zfley|%>y+sfJP!FcXo<^#vJrI=boQY4mvqYb;X?G-qRZou4>uLwUt5BOK|~6eois-
zQ5J?|NmoWw*QV(p5fFb)G3Y*w#}j7#^J+zmkvL^R?!IDl{kk1_tO#T)=%hid&V>i(
zII_C0Ye_Ep&Lop~uxoOwI0Mf^<%Z)7GKtC!><n`p{+iD@F!NAy+jAyVb0KGm$s`K5
zi!(?d>3F%n(G$8ZnM0WS1OH^M2mG5^tsRY7tr*{bsQ<8P=Hs7M|CJ3qK{Igza}MN!
zPXq+r-2~d}3c9(e?aR3*h})aAI*nS*x;J%Mb**ceTrJM<eu4aPYwpz!$rHKxk^>Ti
zLANkZ=4N1;d3Z861M{uUzm}KUV5cnq|L}Mw=fCFTTnx9mPo8G<zSha=D_q0HIQ7g7
zhvd??OrUczgxSOylnqWYfKT5v=VU<mI+=xsA-R1yXY+AM2H|!|hSuY|Iv;+)rUxVo
z(g#xc@&E3wXvbEq-Q8A<$?*w{5EluvF))GGPJh_{{P7IVf4jT08PQj6!S0WWYh6?g
zTEPW!ccb^!`!H9p+}`LreGN0i<er>Q;JMY-?T*H+dl=t;kiWfZ?qv1{{ExqG|F3K?
z6B@D$w}VWW_&pJPgEr{qY{=c|=l<OKz#wSUCEd*aTbQkZX<JuNM{;hO&}0q)0amvr
z31hJ|hRGcg0-)1(lZDs>{<<Y|U6z{6Hi0d9+I4}+<?ReBAFp(o%qhT@?9L^$n4jfW
zvIH03WOfE-W&SU}ggKx5X7s++=GFH8!~92}bMscEz)sGyW=&;es|MW){W!qkFGwfE
z9AUN%Op`gj{9fuN-Iw`CaKWjL&E+$goSKC@fBZL&n8B3%`5VKh>9gC}nHTr}`1iPQ
z@;~8fb%tbiZVpCo(L=l1K=<h?TWt9TTBZH|!~Bb&Td+a5n1b4+f2~-(A9Hejn_TYB
zu=e^v_vFSeTnpVFPx$g}SDP>!12d}L`)5IVz<SMFzOicmwUXUG`8zuk$gPuKinAPa
zdCbH0fzhpV|711?w#Qx9-$8uvc5gB_7X!$Sna2;hCwF~eTIinK|ApZ(58J!N{3rj_
zO8(ty%;De&GDn#00u$%{QyriX1Nji-r-%FRYW|d1%y0Ss?RKcUK>jgU@=e+1$+!0(
z;*T(!w|r+dW%&kj+pad@wn|2@%Wal?d;g*S5VET|wSQVUZe0kDq28^aUd**OX@3ws
z8OY8C$i9YEJ)7FMbtN;iD(H15Phu64NYv_4W?*Mvc4uQqW?~nbyjzB0_H1tkM$gHd
z0Zfiw;<2C;FLakK^-Y#D=VU%6&ft4$a*H@aTzfL78E5lx7KTRi$=|>8C#U~n=wg30
zeU9_1=}qmR+2x6cOJ_G9WnpM^lWt@EJGuNDfAXWhOwC6{psU3}YsGi7ePe*hwz53_
z^!MLnb_4e0_OBwdTUmdDPL`d_-oPZ>EW(idYCDs77$bu)+p+~+ted9JaojY$sa-f-
zoS~Iv?SAHC><s%_?zP=&O=^ArVg3eIO^_bu<01^R+7-VixAI6p`Zk~*5%zWVpc`LW
zSy=aj&Yo^%QQa<_uFlZP!n%EiW3nK-5-4=EdL9e0zhm@_-Ov1tivi?wh;8*J7jjv1
zsxpFXtlZALjEmvwcIItd3_tgS_8fqEWgvCR3}1dMW?=d8{zLo*g!-NPLE$mEPlRDI
z`vEqPuCiv~zAlF3)~`ad+gpEuLROfSfhjrvtC)BwBLlPP(b>kKUl~|CC$mprOMD8_
z0XE$t<(sn2k?-$6%s;?v*Ycg&nB_ajO`p2H?ggn?$W?g^r0)HP`W4okD;Yp;J-bzy
zok3vwGVnaeYUL%*1jLs!Gbr=2uLAiNQlh_FrEKEzQ+ze(1U2nl!aOZM7(E}$v)^f6
z-X<W-{(=8->i1WZIT-|Ycm8x}k_4U3+UNq&>9u@w>r4mG>3Q!z*iTqB<?&0C|6BJ$
zY-3xBr2pB$?ZT`MY{`vFxsqGIa;<AmYQ5D8@{6*?6_9^6gZu*W6UaZaT0V8LGOKPC
zcLSw_wqn!m%*Rw1CbI{yCv$#dna$n?4l&T3*U68+vP}<VWN6;1+OhfSSB6$_h)qQb
zu`Ay}w!HsPzqZ+q<vYxVZ!Mp?gq!6UE^eOOr@}CsosHq=c2HPH?)}y>ncaa6B$v7M
zTMLNx+zOJZ-7b*`%R!GB+3#ufl<owz%B0y@|1ofYc1TQSd%&9f=^2wWyX*f|?I00W
z*W~i240pjfM|i6`eD5YJcwTGza?mY3%O^FSpHq!%jWTEi1T^}=_GK~ul0TDKzWi+k
zt-t?}|1<S2WHbjf;sH_x8-ZnzSk?J{f&V3~PI1Woj=Aq2oIjS#!^zO-vYB<JgK_Ij
zhW8)xzk=dQ<v&DC>g@Lq{EtJ-1C4w^%w+qb^Z{fy$Ye-M=H-l4Eq<+fo$nv4KM1}j
z>BIXEAd&YE@(+V_gY>GkK1u=U2enH;D`Ft0`LX?JU|7`xNi$u|n>wvKmol_^F|J5<
zWMxXe|BFGnVF^Pk3+P7b#?y1ECmwH_zMFlf!{do7|0y@HFg!w8=K?za7~*5lh%;<d
zZ|c!iosBNyvp_qivT8vlO+7xRy7hR|^v&%v8Im1XnUourGqkci7M}SJ<km+ipmQ!^
zC+@3te%&5fi14xaO3*&lmz@$HWWFd{urMpzh%m2e;d$cKD)2(&&HD%IH%?}2VF2Cl
z#pnti!Teyq9K25I!TC)f)15Lw;Q*@bBMX&2fZWL-!Se*97uiJcs6)9hdkcfI&67W!
z-Hk3YpM!M6^sZ`w#!ut>2mPy>&079KY<&MAe!;31@u{FaH%sf^Kj>eLtP8~-GeQ2y
ztVOmJ*&q5#(fzT1mRIZh2l>n1J2c41g53@pdt35H;DN{!i5D_&lnq#zl}$vL1<&fW
zEou{H1&ysKo3#9U|3MzS7Zx;wBkl@Xx!G#*{zLtDWHV4rP}bV=NAfJl{>iK^e?cZG
zn_T(#{=@u9Am4z@ncdFH@bogow54Y6Kg|CG%5k8%V36OLO`pbrdXx|`&ZE<(Gczdf
zT^<AJi`t}4J-nxQPw`CnC{WY%$?OdW(RP!%f_JWhP9JCo<wke?InK$?movd{asi7z
zw^%j3Bbo6e$cE<a?3ojf+fC(2gxG_6VmN39x_SF^tvSxgkI_wOHv!!TGxNCkbkKh4
z<te+S_dw5xMo!HP5{#a#M<;W(GJ<jzD6hTm@@joQ;e8vUDrl^b(KGq)a?pK+5A=IL
z;RH&@uv9!bJk?<#OCS5bDa<=r7>pxVG6+{nGF$}TQt0;uvH}luyJFOfxF<;u8aNs~
zEzb(`v@&XS>vblzzJK7~!l>Ek(&z~~wONt7)mxa0fd#bVExFT$*}7GQ@qNSme~hY+
zU#$8EvZ;^#*7P~a#?xmrY`(snp|$(r{Z^IDFJCe|p6&7%WSV}{vIMr2M<q^`ppyWd
zvKM7D<-pDZ1o>F)4X9)RosGvJv8qL{Rj&&)bM)S!!4=dSOMbeXEt%~r+vN5y|Aje3
z8CpFyx4JV5voWv;F0kt`p1y)%Gy4OFr~P)*lV5ycNdESOA^FKyhU6DdnI^MKFtD;d
zmOJsM(H(Tgt@4(i49Xig8I^ZvGD1QOR8B!g_q95H?$_#Qbbq*Cn1g|((fuH3B>V{j
zhv&h`-_;l<{}%(@G4@`cVe)r3hNaJ$&0F1Mk~f~_^%G|Pz|893Y{AYbeAR+MxT2IH
zS>za_@Q(@xj`T$K<hsuc$xoLu^)|J3&A#!2k<m4|SBx2wUN(#WXPC_Q_5Zi&$xoIt
zJpRA^k4*B>|4J#PV#20k450Kp`Mp0w<bGJX+WeiLadZ23N8zpF47K1E|G7Vq_CBcP
zf9u1&H;-OCd-Cc*-X8|RRh=4z$t<jLlUW%!-aoK^07)^^TR=15OBjVYKd>kNTF$U>
z1@l%;w)YSI|6){4&REGZ$3dD+lmT`c>f=w#|NRXUZac|1-4!(FuNn)@f1>X{$ge96
zMQ!=BRX@vi%UPDgmiwp{)c$AQ+3A+d%_#-yO`U2L=D5H-nS+6)HdOL`^YTv5<VJRh
zzcGy7Qx_!ji8Fug?|eTa_aQ6m`OV@_8HCxc|DTcy>eoLmI`MB#Cc*`*p%53a3cdgE
zf9c-+Uq69#6@EX}&geZOe>M*{!$Wpf?b_d98yeV!THTXbesi(<%x3@nztKxs?aQ~>
z+&m1zTrJ->^F}fzf6nG?RzLDhm|ce9A=mEqa!1gqkh`W&o+i$)Z`!pM;kjlEYBNFZ
z2b~@Mt~JpusP!RBa{hOQWcKe2$((bUKz{tWA9VXi^Y&hb$K~Juy`QlE{i)VOw>;43
z>-$7E@R>ss>fb$<p8F^H-)u&Z4pttJD?l!I{4o3HL$1fqX8&j2*6Gpep8VoCOY;^^
zkBM%ORjKkfR<$#_KAyw=Vp$s^6qdR`LP3@L{fGHem+nQ#usTCzSbx6%@PG2oy_?z~
zG1uw{QUj4Y%JTk${iM#VAQ6b{QhSKZQik^*=1)*Xl3}%j$h3mY>$BVn+9wtE2eDHM
z)R#x}<2QF5WpF*Xt~2>VC?~URtD9C=vn?+}ayu`FS@*7PVV)1ntv>JCU$rprY+*<)
z_`{a`T$BA?TU6V*R?u0q@h5E$zH58c-smdK@$-Lj+jOQG>B*m8G9@RfGfzk`o_2=8
zX<BmiaRy=5@BcT?xWnK!HMwLZLvqD3mMQrU*&qJec(!?GE5qXlk-u484Of8f1Q2Hb
z`G42+<R_YpkN=wgoRjmA<>qHbSM)wP>aEV5CnuyPrypl{EOz|YjKs&EpZ(g`>bkvo
zCkw;lRGZ(MXWB5Hn)&!$<mbZurG;!yl^!np!@zm!$Gs<@`6JMda@c<Ib=^FUTAh>G
zjxxrzLBjCpxAz~`|7up_bO+sA0~1aC{{DmiPh=6-AMZct|6n!+-BAt7yY)*z=MjU-
z`{ei2IVQ7rG6-{bGBSFJ_kvE=e|uzlFEc~)-rSSZbwDQ@z9|sq`M|Dh^W_`l<m2az
z%<8-hQLXQ$|BXyena<F>lAU3?7wC+`Q?HVRxfq^xy}vMjsbA~+hWQIY=b}cnCfEE?
zdw)TG`Lnibt$t9qvwnR4;r%<%Ny#90!ODmC59+sr+{UW)xN6Q1aaB-FpBnrAga4am
zlTNor&nXGX9c+B9zLR-AFpK+u&RgX9BJK@7NAcU_S$`SDy+HT%ocb>A3+i#6eKaHG
zZ+P<aI}Dqr-DQ}}{{8>9>7a1A*XGv->f^nC7S;OxL;tfm8OGnk8Ixt%B|s-zO=fLi
zN)~0868^5vkj%v{2jWA+`{Vl$>mSd_nAkm;^#D`jaZnmt|L9dKME2>2_aDwbgs_)>
zc>jU_;hYTN@9hl9qU-{~-`N>K<|NCq3xGxjAi2c#=FH<DQII+M_u%GydC2nqgZ|wq
z39Xt7KQ)_idVt&vi(S@x??2?<ZZ_*giF4Ka??3S0LRQ!M;Qfd9H=4~mJy_k7`=5*O
zx+k|j7fJ467lOF3^~L)S@2@qhb9#bwO?Ly$#=BkYJPu*0U4Yy7{QZagE6wVjNa~KA
zgQ;6~7N)NC+4~RgFG70AkXb|2J~C(y5#(2h?Mv^x|G<A96h7>Xf~P^D2^GKn{zL!S
zIT@fZdfdVO4kUASE0Vq&??3dP2I&)LK+$*o{RjS2AaQjDke<g9>`zwi6~3PCpltBv
z2k6cQK6bn563L*s()Sng|1q1l{Af03`2m_gVC{a)!hQ|v@BKS>gJQRV>G34?N03;0
zx{q}$#C1ony#KKN@JA@`>81A{&L67X3z2KR^!~&9gRXl)Z4bz-GU%2stxiZ=QuU1N
z!Rb>#dxcrfOxI*&nB2)}aH{qF2l<13tqWP+fAHVOytU<j?N>w#0@TX^oeT~+zYBCa
zIOu*j(8=Ji8{$5LZsFizm08!4+{r2<4sMHU9&J|V6ilATE(1Epc2#fhc~E;$n0@&X
z#Rbjg?f-j^E3!YH^Y>q76ymHd)LZ0&THUfhCwDQcdkTVfem@t<1Lcu_T3yMKtU}G|
zo`RtIU#%51V<LS08l&=pzYJc}l})xYwyG<y;bl<X!poq%gO@>B>!-l`2j}mCN&sQ@
z5A4F-y$p?-k5j+@VD*_^&CJleJG*Xr4>Lpao;MwkawoS5)G}n=&dWCW8tAkS(B0a?
z-@Y>&haYEP?N&X^yqufCSo92oG4pMP<n-@s!qeE97$;4ZFk^T&gLyj#1MhKWJ5GjV
z20o^u={(7eXBV<=n>r(LvfJ1HrTsG=f>babFPg4wu$__FoSA`(Eo+)*zp}w&1_`HR
z4s+&Kb*Oo)3>@IIao>Sl{`lvwZ#VZgn=v!ghM(+HHn`02SjPM>^KxGI#~kK=o0sx3
zz{|6}$|hfay#KI%A?Usk<rTK>wcA&<3Adevwscz0L(|Fj_aE}-du~O@JUt7MN!{}P
z!}+<wTm}cHZY_;!-3r>-0%=u4PTz*LtCM+I#l&ZWMpL|(HEVGTCQs!On;yx`FuBuH
za#bty)=sx%9##=%y>7w1?#a)Oi^?SSo@d_C$}lC7)mfPR$A4qt%M4bNTRpVeMbbA<
z|G^;K_U-?s>B$*47?R6=FeHCTV@Up)&Lxwd$o}**lbmoIAJb%UIfhTu``8oR?54h-
zaQ+#ydbeQnwoW(kC{Ta+l_0CSuoyTl#KjmkP48phHeFfgwSe*lc81y*R!>mr)_-eN
zx9h{^EuC&N5_r!~$a%=ZdWv}m%m3Nz;tZR`A$RR;{?5)go0Xkm=JPozn?-jr9GaTk
z^_9t}9i+PO*W<a|zhEu?MU_ldkQRSf>!U2tjvATlDVdL_fBW)t|6_?~f10<o{GXHY
zc=ESDtnA8Lp8Q+Z9oPDhJJIbPsHbxabVL2q-_7dXf-@5Snk(!47O=eE>b-UQsy6X3
zX3*Fm8#LcT^Lgr=_aFRQ?sa)?{~EP-KPXRLdI8Io$a#{1(U@y1Lvp<<``;MH9IZ~H
z?rmL@xxf9N%-Ql|@*N(gS{YW~&EK^d*Ph>8K9lj_<H_NiOp{p{n2f)-GfF-_sB*Ab
z`1^N$$;S&-7J^s|l8+~<Ol$_-_b2(dQ>C-HwR_^@R+Y^na~Zr^&$WT>BYOX#f1@90
ztnx1BQ?;3olRSSjx+3y5;w*pA{g9wMy_rSJ@o~}YKet+H_n&HSbcqDdqFj0q^#j)a
z3i|`PWhw1V){DF+4H7n~T3veGb3r}b^wz^o(^vIyp4Ec3|5%qnQZ4I*_Ydkn-CQxf
z3v}0uR&Dc^E(Y-)W(HxNoLccpW(H=<m-e7r6CinB+iT(z-v!MkJPe9FC(kf1WpRJs
zpg+G^9dys_<EP92?J0QtXyw1jF{uuHJkO@jNfxgC%Dnmda>mx~kJp98S;4n%-kUxr
z`R;w@?OY75_jgSPt(5-qYjST3V_xg~3;gpYx3@4no8G*KodLu@KY#O`HH?%0$S^!^
z<N3k7jK#fq8;eJ>NE)lM#Vw}h?JXXPJjyn|KrDA<lV42DCO!Yxera`AUhzwy(Fa?*
z&M9|MZd&W39MI@X^Y#{Z=It#Wji6PB1{<VT^~hcX*`d`wx$Oun-%o~wQ)|Qf2mkNa
zZpW6Z8#n|qo2^<|l9}10CbNJ0Z(RP30n{3iNL<zOvp;zXyOg5qx^D3<P;TQ&f8Vfv
z256U7GAFB;Fl&S4dxHa-t2&c;Sp~$SL8Zd$8;-8ZCf4rn4IDJII+K||rFNH~vcYP$
zo(#}!0F09-i-|Mrn%0rf$JVNTZkni@vd%Ao_aDypG^=+B&dBIUfRuziDU-#-7&c7<
zshZhqHTB#yUZ_g_E|5xLwg%?Ep~xnJRI<9Co5tv>tn=CfVrqUnb9$HHWN~qZUDNy6
zLFa0+Gbn3RyU!_6w)yQgr$X7_x5u0sWs~0?&C9r0dyh4`3$uP;Z*>LL-F)m`(~YNn
zWk^o{${><_u}|bNNKLEy<44#3ooW>i1&vU#o&w#JysE|UEvR&Gssxn{kFr3egIepO
z5>VMN-4xW*Y^@PD1+^wy3*SGeKR%g7;UKdq7sLC8^SuwZLsX<zK~$s`zJCyZ6r{qh
z^}WFXv4{J;THhNuh@IUJ63g5VQQcY&QQeyM{z3hruOXgLQ&`I&;;b3(AN)V?HDvAf
zP3^{P*O*`{S)`}4Gp=gC*{9dq^Z3ef<t6M4$}89z8eQK{(C>$>6oIVqVSD5CfI*<q
zh4HK~XDb7E{O^GL2d~!VD=duf57>VKt(9TQRBMH-76R!3tvCYd;XR4a@&8TpbrweE
z>rWWGS~s^mcbL3IgyH>x_;;wfzlI#$k7B}6gbDXwfNb<?h3MS>3R9=$LBt6qUJnpD
z?VmPZKf=I#?FmCiLZhoO+czfV6)X(zC-gUfPH2)xtT%QAttJJXG=x2O*q&Y2x%R9u
zHz*XMT8+BiADDk1<f}&SR<DWASFQlDlW+fKYQC<*2(rzu)w;c$u~j?S`8b2%e2^P@
z5_Y#gX9D%b_f2J*1*+M#Iv+p%^(U(J{ek&+K`G}^2_ofqwK{?Cl>o`^zs>1+bi3n0
z)OMX-=gzZ}!Lj1k`u@QFYakaiUwguk+;*LX`ML_@&iToIuQM@UJHpVBaH@4T`!}%N
zc2nOs{Qm?}>(|<<t~}!l!}|mKuQI~d7eekJojU*F_R`R=+d(GZzbwpZaPTO2-(=uX
zkQ)#?5!Q9?MT+P8b0BjUo(I_p3WuHqzt-LD$HDgQoBF<?{xwJxln$D&u`sr(9}+(}
z*?9YN24nUI4u8#l_ItG|&$z;%JQL)m`ZMTm0>{^BVOEBNPq&wbUIn`cGBVogp4|PF
zVdC4#><p~M8`KS8H%Ef`3)BrjcQXG4t%iQW!0}mK!9Xcx@^^Mt&@B;j9x{SwD&XdH
zePw8T`%S!f!*aMO-$aWSEHya0zclnHbnNW2`T_%`l&_OpyOH#RSG$7F1Ul>bp5Z~U
z;88~SiGG!#;F~7FDuh`LSl@4mpMx&1)d9Ni3o^ROuDok{M{=?o2V1iSD?@S%2OB6~
zcs&5+Ed~L-PGR;|hDMD>cf|#*>dBqr%p%E->=T?GOR@c*kv55aA^T>QuMCXG)moXR
zGd@)|m<ifPo8XiJTg_b=`k0gBU#&&2dtvC~C+z<#L(gt63~g$t3{7U|V1S4xe`aR{
ziGc1cg56rg_Q&syUgu=imOq<XKr2CIAA&}9rZY8Lw)|<{-pSC~J@+waRR`!!mpR#>
zQv;Q^%tV^m0L^NE!muzDb~7)71lyN&E#Q^DAM8I!K4ms-`Ma!DCUH(a?9@q64+P|Q
z&{}X%sj{l2_n~+vXvF`d0O*v#Wz***PdyG>4-Q#lsOb8>;Ql&@s!Tr6O)RV06aNac
zDja;dUzoLl>Aix0eeO+8caVOGgW}<!olDOHC7wc9?!gjo_f6?|P`Z6`*;nSJ?#Yec
zSU~3}wX&~c2d(jG?VkI3a(O9(R{P|#R_2B0SH7C-mfUfjjkR-fxjKU|D=Wv$!@{Ym
z41(Rf$Awc}8JZe|SqnHo=Sw&+fy_#NeVt*gJEv=M+c$={?vk#_Gruu_WCNIlSra%O
zcYpf_Duce><87Q=&d$i%2{BE$oSiB2zUzKrRs|05cs@8SL23b2Q%GsQRQ&w|{zstl
z8<M6W;RZ@I3<9832ikuFI+cp|=w~$p1Bjld;$CgbTHinDzxP>90V<{{0TJ`R3o2z7
zr9eUzl0%fhJJ6c9r~kB@>fs9-%S9D`{@rdWhbN|Z`Zv3&9N5%<v773FP5o!PsT_eI
zb3n6fp!G(ebw{ApKMf3^+eo18kdL5QuyfPrq_;M=cAq@Fs)f;2uk-x@|3!f>K{8&g
z=cYHmYG-_}P~ewb6Uq(}+c&fMStn?n2}|;m>nzC)-&nxo@9km?tR9<N)fqvfxq=Jq
z+Bb{eU@&I;;E>w4X?pUDBMiykzAz*|Im(dy3UvCAI72JjV>$7^wV{>^7~N*Ng4XB8
z|7Uc?oX7KOeXlUVZB<+4c1S4-nh^u-mSZ+of4XaWM>=aGYbWDbSj`MF$NnoQ4nclz
zY5?t^0^KSFxnC;mOVo$BH%Twjo@6~}5P*~w#~;{DW!7Y6OlITciSd+3ZT0?ZzIpm@
z2G(ZbuJ8X@yPGvz8I7}kF=Rf6uBa`@|G=pF{=xfu%_gmGQxevmgU)w*Pv$zxC~gfN
z$NDL_;#zA|>-z`%d#B_)WZ8Kt`Ik29oQ%m=(-~Sjg}=2kNKY?in8(U_476?m)L#<*
z&dw-#c=A(K2GFR<%)^tPx-v{idHl}o_vCOjhR46$e>aK7wKh(Czv2IzDLJj$4_WSh
z1EtCL8`huZJPEo@4ZPoL!}(Lm!mL7w-BM0fi>jEaA7wk`EXrZZWpoA2nZf+={xQfO
z`Iof1ixY}UKp{8(VY5lM+nj{t7IwZ?uVn5@{>igBnI_-nW}3`%no-;aG*)-!bw>s$
z|DHTQxxAJ6;_LSx_8(+aHN80{VM2;@uM|V_voc1Io0DI-b3OyD!gz3g&8sfZDC^9_
zj~{FOEq+i?0<mS`<tE8iFVI?nLhk9-jG&VnpFzxSJPtB@>iPE{{_kc~eayr90c?5?
z$aFJ^>5tr*Z-MS;eeizSBe3a@JK5hoeyH{L?bcQ;&;6}hU$;*dWo2rd7}olJ!~UBe
z_ak`sZ?x`zuOOiIaxcOykGt4kJ(jHeUb+<|7P}QSSGMo7o9Y2Oj~h~QfM@;K_u5U3
zapZK@Yn^Te8hc}VxT!U{<vA0tJA~i%0CLwDgtzQoa@%tT2s`b*xEW~WLfZZJ5A=~w
zKz}m(`d3E=j@j3jGeT1N@oj78TTKP+@9$$*WVM^x>MoJEdHQw+!DF%g5)UCWMxZ&7
zS~w5nc63wHH^EF%WbI=I%~dL;7>90UVC@9ule=d@`6TQMBB#LeNrS+quH@hY9FQ3z
zmUZhowYnNz)n<W4hVvgNa$N-Vnl7y04I1w~>z;gOIvb;>cnqlL=<{{DG$>BJlYPA>
zPj_K>G`)FGJHzf)EyuXFXKlu<nvCxs^e;$jec!PDq&251BWM&EVp{)YkZG)%k3(nw
zNoM9`IyG}~KPSq)ZiqAuO3zIVVQtezLHz^PSdhE=&p_rgL1Qh*V=oOH)4M^p>aAV~
z8a>eJUNv2q)q$mX<#ERM8~mpyGqB3cOc7>HV12(Kf12dM$xm1kiYKrbKysP?RL+wi
zUALy+aZZl-z*Kx8Spd!t_`vixym&&o0rPflhF15e=@HJ!*Pb&pi9ZxCp1^KY8`<m9
z>QyBv%*DX8d-^Pf&EJ1AG^$ItvKXCeZB?0h`2B|bH;<>d{D+t~BOSD2n)m!?^#fq@
zqNa<aw{|6WvI)%%dnR_ZAH<vZOd{Q~nYBBapIwaAy+|B%Q`d0=i2fVSo$krko^ycO
zSRnU+^sj7c?V5RL@^f|$k@U4NHVYD)StNa9Q)^e_u~xTVU^^y)d4I$Hfq8quyjHhQ
zVBT3M@0-}weu;EX@cQoB@G^1GU0lTzmP6e!Cw(rcPI+D&-~bIn{zl1z#Q_WwpiqCm
zLBApNB<L<-$@HK7FHbkRgVrE1x=ug#|Np*e&zp|DSjhf(=JS8W0R{}97-%->W_iEh
z{~yDrxXxn{W=&vuzu^9_$8xNX8eLTPehqsi_E+p{e=9iDUT&St&Y)1dpuA)<JA**+
zhVqi7+usMw@7<F!IYm{eQKhq6m~(<a>w9o1x}g4><k9Wy9~dULvpX1P{$wbgU}8`#
zplJ}e9b!xU7t4=px7UUjf&Cn~RW}o)PndJ2!21RJKV{y$xV<!VC3uwS)CbTg6KLd@
zfl;foIKaVV<3sT(&=`PMC8+PZnPnwI^GX)b9$EN48D;3cpX3fs7SLHV^_P*ygFs_I
zAlu$AkblE@a(X&wO+vddsO_a}^L-DveOB;(62uO!V$c{vAh_*Tx?j<)(N!3<|E}Tu
zlIh`~TVmUHDKBDS5aww4H6a<)t5aUb!hmg;)1kITSL1dzhGMZWgW?ISR>cBg2F+$I
zzd&o+W**8HXt1sg?MXh=rr8Km^?7QjL9qa<b@7Byuqu#>1j~-(Lv0}0V$o28&#Da8
z#R3S~2J@K@^92;lg{QJIF-~09#`$#eHCCp{oD59DQ`wjuCrUm%sClqS`0F=*$%hLy
z7lK#}k`E_pPHYnXYQ`Y>uv4?MskLk3qgKsM&A(yFYfKm$CnbN`#*i-{P&j!SD^soO
z--yXKI2e<k++YB&u8){}qk{p&1Fx@-n0&(n%mc5mkC=Qz1I$CLv1e61abi<jN3ya3
z%MZ98G+=&U`2q5wgLX&qCb$oaC$K_&2$4<D{5*rhI=N*BL%zTQjSi1ZZ6LE)RXa{}
zBqK}|K+&V1hH9cHimZdm=NS@E6C0FqnW%uGhd~k5L{$`71^Lf2G@vFX$l)^407cIO
zX^@E^zrcJ^Ji!!2#R19BGc2H{GDzYw)d59MgBZwEgo&;wvI|5$&+ven_&^w!i2*2j
z5(H6A3`LP`;Qu@$0&3y`K3paypy+YnK{YWIMK*!!^Nb9ri3>P!nOK0LM}ZyH#8MPl
z2iDIsDxfAdu;4PW0Ywi36RL@=D6$F+pJ#MfKc2gz4wq>Y;OZaGVyi(lYbru+4qMgd
z88fUO&)89g%cKPe)l=CjP)%Bjkekj{_Ibt%>&KIKl;JXI148u#wh~m6wj$&vu@!xu
zvBUcDyd4F&Ogey2J)12L)uf{cxw&jPpJ$w~emrwW4la`}AXHCd%L18%nj@|v%V&I^
zal`uYq#YT!OnZP(J)bQFWEvtTJVnS&WJ~!x;{_=Gl5m;y0ik*pTLP*{UlDS1*y29V
z_yLN)I9w(%*g(o_mLHF&vc;g9#EOuc&KC7~28Ye#$vdKOnIwQvJ%KF()g)1b+$6TJ
z&od-!9?#nmg3BZYgzDLBL8vCFBIM?>1$>^NVe@$AjsRRH86Z?oWAj5b$rK?sgU#pj
z3=5mbQ+D{^GRXm<dLo+_s!6U0xyfuEpJ#a3Jf6S94VOs)2-S1gTu@C4Maa!#bNW0Z
z!shX;9ZtARN<gTd&gOt>QYu1jCY#;o85uT@r|z)BWl{k`^&~bMkV&ZNycAj9>hp{W
zQ2bfoGOYojdN!LG$TUPcZ$-$>Wi$CaqXQIwCb&$RfKWY+%?Q<`sR+3lYzCia%mBro
z0WOmkAXHCe(?d0BDMD^Co6hGMD?st5h0CN32-S1gG*C_2ijbSfruKQp4p985;WFs}
zLiKbu6;zXsBIIVWDSe)C0u+BrxJ<f$P(6uF0oA0d2)QY2a-V11uz5UT2hLW&1BB|i
zY*MHuJw?dPXOs9m<Au%R**hd~x#<H!^$a$&djBgzZWf!!=NUh29#7jLg3BZZTX-2Y
znN0}QO{@sHscZtDXK>g)p14B*mq`K$)$`cE^*m}i7e$um`aDCz_VKJ8T)0eAK&YP1
z#)0ZCRfOD3Hnz_*G;AMF-NA;-Bm;!%No*{rCYd7Srm!)6o?&78c)|`QTqZfdRVUA7
zt3x%(6(KjDt>*I#58LF~J8E#56o61YgRKhHq)>$1EVhczGa_u0r|qb~Wl{n{^<=g(
zRFhH>a#Pt#KF`RoO`f=;1eZw#2-Wl03Q$cdMaWHHEBHL4!Zvx%jyzl@H6T>aWXnM{
zsTCnNn=R|}j1Jr6={vG;nKS{RdJ0<xs!3B3a?{w-KF^q8n>=Yp8ZMI-AXLw1OF}hi
zDMD@{ThiwlD{PbJ?nuC8(guX;S!{72lTg$7R%H2@&og#_;x7i5X$KIhC$mL?Ohc6C
zM-g&U*&;sAI01^k2wWyzK&YO_7J_QhRfOCGwvf*=Zh+!12$x9@5UOXg1)!Sr6d^a8
z&F}M!7ohm_!)4M3gz715KBy*rMaWHK^ZGpF2Ppo$aGAtl2P>zN=d-z?n#78bo5<$&
zc?O4F^4uLRxJ(j2sGh~<gldu~LT(P5!{-?icF8k#IN&l#0ik*-n;oi2stCF1Y&M@~
zXxJrB-eH5wBm;!%32auVCYd7SCb3z3o?&5^Ja2~?E|VM(s%NvApqk{0kekb9^m&Gd
zUGmHwMz~B0K&YO^W&kn?HJyhd%j<of5n-1+X@?#z(-IJ>=d)>nOhcseRD|3_Hm%Py
zGC=W%v%g<}P(6zct+!u_kekD%@_9xDDE?G%xv2r6dMcX|s+(F7a?{xqKF{a?#h(H$
zlO`ZkPhgWnHEAkBZW5c!=NU6V@h64Lqy-4ov)Lq2O<IbOo69EldBzG*{E6W*X#+y_
zG&T`bleQw{X0Qo;p0UF&dCCqUTqYersGi6sfNIiFxZK}IpJ$w~OP;U;=UBi6xZ1Pt
zP))fCmpS_A^Nbsy_~*dong?*TTVJ7?@)Rz!^4;edFYJ<M?ZDaR{{UAz_Zi3()U^E-
zF5CF(^Nb&M$y0YQOz~({n{uKj88Qk5O1+>lyU!X18z5tLEI(Qwfn-_1qkbT{VgXaQ
z+~amOnVw|q<Ak-LFw+n^T7EsA!6tC14RkUDNVZra!r-&2!G>ai2m@w|mS2r-$)X%A
zj1xiUMI@(eWoQ!p>sA};*a%`DG&{sv8>$FqKQvp!S{o_|W`8uB#9AB531<H^>tanl
z%*ycBtW|Bw1(3U8Apmx{h6CK?n7(p_%RO#l<HOV&0GG$q8w!_u+{MO$sW$;GkEu5m
zF88>JjRjM00bCwaZz){vaX%Xmrrrj)Jf_}OxZLA*Y;K+am&epQ6)yL<pN$FA-UV=Z
zOub9ta>*TRb(nfLz~wRZZiUMw_p?=C>OBCL$JBciE|=WFR)VSb0$d(b?^U>5awA&-
zrrrl|c}%@e;d04cY+0CkKfvWN^?rrRJ?_I6&I}uI=TcU<Tyi_Ma29~eW7;bUm%|>;
z3UGN$y{d4z<aTV~Yyg+X)N2ZtOYUdO!wf42xICs_SGZhqJGO8RfXid*4TZ}k_p_y7
z+M58E$JCn&mrHJEOTg4y0GG$qTMCy;?q`d_)Y|};$JE;jmrHJE3&Yeq0WOcJcPd;i
zxt}cnQ||(}Jf_~IaJl4mHXlsA8{qPodbh&mlKa`*F!dgQ%VX+23YSZ6XLG{TdjT$w
zsrM>eF1er022<|?xICubr*OICb~X!4y&vH6n0mj$<&wMDR50|aCK$l-@5E<U9FmW)
zF|@i}Ie@8-!3afN$OVQ@tm+oP%}buoCUM1~)iwF%Ri<97Y8h_9%uJrlCe@R2#bNT(
zR)(G@$p_g4FkK*U0Is@^P3($8@;NN^jVi-$xT*<kVh}S$8G4>{x+Y(|idiqJUJ!w)
z?|e2TW%4sN#wky(ICQ!u-@1xf6RIA7`wpVojRC6q@>R?_NL2tHX370*23H)CkFqh%
zL2l<v4>u@QW2ge%5D(fr)cJf)3TOJw{y9%TYnx6@pOZedxwU)k^UvxGCVSF5Pwy$-
zlRWV_=qy~xgZU5EFQ1bFx;6WT&zvWW$0t8$XMyNrb)Rtnq!+Y`YUbno2j`c3Rxc=N
z?G|QrI0)u1&VTTJF(_spAHVu6a4)E()2f#L!T&3Ed-NC1Ntyhdohfnu6^FT7!C}NS
z<%#3gD-NYwizR++d@Q!&))k-atPBlj`>vd+++8e@u_0M*#jh(qlb^A%Tsf2ff&X{0
zM8t+<u@&FIVoYGMZ^aTGAax(WVvJz1kDq5)Y)GED;t@!!jR7Q<|EO5v#fHaXE2doW
znV1T)p>b2O#ElJ)<yZ7w@#zGMoZV3@abm+`i4|Q}d|JUGp&N=Nc5HYoxS|atGP#u%
z?6%Gw#S$w(>KZ`ivpHNjBe<bhV#bDK!4-eNA_`y|e-}%1Y)F=bx>f)z_N`c=0;KK}
zSRDsg>|?RSi;a&ZR~!TT-T~ycsT+$WZftxkxZ)64OaUY&xU*Q|1W4T;u$TZy?Bcd!
zi5(zyJHTQbAhD_YiX~Qn)NKNbv4F%xw-rmw0I6FC7Gna5UEEVF(E(Do0xZS|5)0f?
zEKvbcw*(~CzyJ~x-BT=)0a7;)B<27XySk}ZA_Amt7D!A1EEc${Si%FOZVE_D04z3f
zQ?Y~vNZkaG7zbGF>W*Rw4UoDnkQfVC3>3~1Aa!jZF($Cs#2v*F93XWKS9}hFV?%O7
zvBZxJ$wHt|UI-S+|Iq(?T^s1Ux%>zI{g7PBD$w)fC-{sK1`g0&k0AUMd`cPexg1ds
z8W>vLx3#S50`0%w)tTJ-jj7i?x#t_x#A6^GApCT{Flzwo`-c0ESRaD;APf>SV13^(
z|DoVh5Fdn}?l0D6F!)(Mx&3>+arJKo&`O5M)3-1fXa8n+-|+w5<nrI&B~ShhpC>-K
z{rh*2ipkR}nKnO9XDpt;Zcr>BY0~PR-2R23^*~tbrPg8w1%u>vPNrgkNQL4629@Ff
z2N11sb-OU@1D5v<|8HjAEf$DmC=Os?DGqR8__)1TAX1<>fI*}<zyU-{<brR4N36$g
z^b9>H9?8rg%y}|?GRs$H(76ioUz^Q4nWu+=&&Nre{DtLD^0ey=g$w2+C%0VZn34ZD
zXZpY7?@u_G%{!SOs@mcjJ(D@Evv8#IB%5#BZnwQ`wK>m2F19YVj;F$G&sI-v`}R)Y
zvB>iY`BSo4-fx=L+9&dQN`7nKl=sc%oU9Nt++su?%RHa)7<5K|vn4wtWT!-G*!v0h
z-@$em`n5t<n?vN5hBSJ<pYZ?9+3k&<k0q!7=}DiEynWktJM;3@<`W)vv2n5UJe%D1
zY_%}^_jgks&v?!Zx2r7_#Fu%jZ1Ix?V%Agt=AG<}?<dH=2n6pb0G(C}I;B*r^Zf_;
zx2sw>k9xH=y1q})2cJHT*uhYF5_#1uBqTMx!TTO2%zw~q-pK;-U7BBV5BRo)XHOU=
z<Qq*-e)t4*Gr^4O|Dg7}zn>8Q0D1lFgyf!de7<Qm>tvoD!OSqZV}-j}TXKgOYfpAZ
zzH#$X2E`Rl(~~=&vVcx#OwQQO;?$PRDZ#v{ZAKRJjyA@}LXZFTyqb~kG=0W9W^+zx
zJf}IqLxgGX_NE4Ab50iJ4dRS5p36K|Hu%Z1a=+8mj&}$5Pk64pft_*ABW05x3^Sp(
z!Lz-Y9s=4Wy2P460CcLV{KYvn5MQ&|HM%6XUuT$+KPP$Dl*e;nzGbz1KcOCc&oJ^%
z5YWnFwI>V$kWf5n)@;tn)NI1Z=+!#6=lz8Jr$MO_vfHiABDwQ81Ec$t{5i>H(;v@0
z{%>XvBpg$X-%q%I8WfI*I0CH?1fP%+3cer17_<TqA|_J!^xWj{-|XMMmdTaKOn&y9
zPaxH}{ToAa;xj(s@89h+--Fi~DX{DDBnn@1V*v4l+0}K|O&5;<-9W)%Fg+A>18%Dx
z#CBE#;WD-ZGS5X`%e)u(%=4Y+x3Ud8v$6p@tHyJU*O7<jJf8Dhc@H~-@(y+ef$CPb
zp2vnO1o9_O4`XO$+cX_jw&(GL=Q583ie-LJ4i95^{Px=)nevYG9-R4W!s98=1&T%T
z8C^F`oAO$qSR{L5-<0<z$)Na}@_f!C8|cX@dadi)OZS(Co`vpBXmwBixSUC=9dwQe
zqid@hE9>Uz%NUYbjxs!c4ZDwn(e>$m1~4dQ*qQ{ozqy!U0hDHi(hN{~s}fWmO0z;~
z1`sW%^a7T%Kr6DEw?CJ)o4T&${e<<Gv^tY}mw@hAWd*Hld>Sau3flRU>hpfX`R}0k
zG;URK1l_3uTVD>zcc47Fs^z_d{j%xqpp{|iM`k#KcFH8@erHl^eebY;3H;m|i2Pa5
zi8B+=gW`+XlvND0H}w5cMpcjvkUdGIp;w_L0Lbihpi|_hbDmTK?R)--stUC4N9~W-
z55F%-589r<PLXNgnBB?Bpw+2tz{cR$x~|2j=e<Mx9Ej`McR^j3_MHuUM&gG3(^qvh
zy0m&rdI@tguo%yr%^=;%!m#<f7Nd3RN`_XJ&eQKd%>OvKeCz*4^{I!G8C{tl&rA7>
zZA~CkP9pf$bRLGy&(#@~4gN4Zo|*Fd=Kj*qi%2yb+aJi9cu*c=w&Y~fnz^cFT_>Yk
zr>j@%`w9NLI^C1`!8hH4W1-a=5(}&*?>FS%fB#{A5A&`TrsiEN%q=ybTWT6zg;_b7
z-%ohINq8zJ6QldGwy?HKt&9`jfB4@8$ze(<kdS`*ACc=MkAmWUa=ZG!8R?A2AuD=2
zo<nHRZXwXwP@r>g7$kI039~jZuWNblaDNI&kMj2AzZ_3O!t(gi<`wJ=jPBwd%nZyH
zFV;_YWoBsJn!0kbI6G70<jK?28T!}{O`nszZW^n)aoci+&eL<8TKgw&7iVZ?mwBXY
z!N&CX_lrO1dxk)^G;eSJ0@@MtS<}IwHGOh>dqeR8cLPpO$pxSq9aO@dU-Vd7^?&gM
zPlJQoLHk5X;VA~R=LAw3x_khg$Ij~3>uNQXc_%x|`w96=dfk&HzB0{8={!B7Sn~Ls
z^3LN;(|?A8&R=4h`B~NBBP6s{6&h9FZ^%FK{zLy)t+wgln0TrJkxP|+zv29`i~B+A
zmrp$atzY*06Z8XhoxfElt9x?3y0BLFy3S24+q&#}XP({E>eu>y!}(Xq%&bBa-Mm0&
zTC~33Fuw`30~3@_^glsDHGRSyXGYcJ2g^Yvxx@JnsJW+o=Bnw<JJ}hM8#wu<$AHe~
zeDjcb7Y_rgTcfMrEMXol<|NQ=<*A7e)mq;x@XuJ)4WidiSk<n)N0V83%SvYD9g)nO
zZlD`4>^k31@ShCIt9#G0x+ix$XZjifNmC#*&i8`W^s{9?szhDUuhzOO1+)gbd3z7T
z%;PhPIgigNUwJsWNt+eqi}OzzRo^T4KV8-G@&c<{Cuptq1peMm_s1+>f5Af1RS*)A
zN7>$Q(BD+K{bfkz_Q#XB|1_I&vw(I$t!lZr9kes@ZOC3|tb*z#1_7<kbuG}H1P=c9
zLAO(!KMP4M%P*dqE_#yJt<lx4_5B3?HqMv5Pe3IFq6UK5&B_h2oAv+u4f(77hP(vr
z(p1RrL6l_>6Wh;#)1SJ7!JHSL)g4SGe^+Ok^9HmNZO(`H7xG&>-IK2_X8^5up7RA{
z6QtxqG6h^8tDKmVAn7*I6|{qI|DTEO$ueIV=A<+ppHn~aaMN^zKA7v4GC^FY`t|*W
z{sr$ptUn9NjgT{`KsPRc$_!!7lZQYj0YOTQnXXo#-GSd`qLdn{3=ngcet5ruf6n_4
z`X`w!IT_Si-ygXDv(sH|X7aV=49(`9OyITC=A5A0*A1G@IT?#5xEnN^cQS%}TfD&C
zWJ=A1ik=ck$pR`<)*nTbxM6RiUVzG6(7l<fTJ$<Mb#3dk>W0V9QAXA2(V(^OueZP7
z;J=x97dM02EX}i%#U+_qCvRtC5cq5UQ!M%CH=*PpPOet><Ok-g6W#pUuC>13;D0fh
zpH)D4OA52{ju2+$JtoY8ZjGRn)KLFI5VVsVk{>@q{FwUa{f6_se<M>DH1FhQfZSZJ
zZ1Rg?+04)C4hG6Qeloz~Pk9fBtze+M;U}nOIw1eD(>?jra*pQh-3&KR&#69n+N%{*
z8m#I}X8FpIJcW~GPeP+-({$Sv*xa)JzU@z8aZV<XZpO*VCa)Ogo}W|Qdme5E$5$r7
zhmD?$ZWF<7-+yN!_&#*Vu2IDKW3bc5k_9=LK&9Ky?VwbpyyYj;QqUbb4auTE89?Gw
z_y3Fx-TyW6;P$tXrTbwiru8u-6j(34Ur-Oa7h@G<_f-RfUi+$c(9S=rR!(<ilP7<a
zEx!Cwwqg0BY{2qQ*@Wfa`-JoRL3^J-d;GSWH!}!}u`(@UXPmT`eO+5J_ctb(Ia**-
zI^E4$l}*0<QMP!3W=j5Um?``W2F%UdSp^tfC$cMV_$tuU06O*H+?!huKr7NueYo`E
z+LO3H42;d&TLmUZ9%T^z-pRkVS#Nr8cduKsH9LcJv@2tB&vl+vEt8|ZGJsZkM}f|D
zT(H4jtIPJ`<e!xc;_RS1FOJ{n;@mZ}c{wM;<X^uSL1*=Y##J`I{>6~o#l;ZUb_%o)
zYC{7H?@N&Q#D>XVTKG>*neza2YZv5ZFU0D0$SEeU(@Q$tC$qNv0No4m<%hDxlpnBl
z@t~Qf_X+3MXm#D(4l;A{>0kdh|NhPJxQXkR<9?9H=GVU&9(Qy7@Z5f_doNgI^6B3Y
zH4R)pwr-Dt)*`IuA@S9E^8JGPN3~IN!E5%HeL450?GGq~7#Nu?S%p@$2)e#E=-=Gy
zIl0`DA$htvv#_`%gK&8}|8#ZGD*ENOKqnZ0+AmGh5q^Q5z_OJ^K$wf=$EDWy1^Np?
zZqw?V`h0S^DZ}GF^WR_}{!#<Q<u7FmmEWLSvtT!iyiZs^&v!rgE{g>Id8ymM%}s`4
zbp?|dkBZd|OlCY&-oeJ8yoU{RZ!A->x`2rwd$EAH38+uZh@!4oeS^u2SH<cJOlG_T
z-MAz<nYDYyCsZ8}(;;=<^0LPBbMhyib`(^40J?_(aVthsLuBEi53qA4V5fG2PWoz)
zh&(vmhMA#xkB?^ab{+<CbI=Kf?JCTc?e1HTPqzl06|-7~(MOo8<>zFshJ)hXpi>UG
z3qYmB-w@_)oD9oaFSU8KzAtcaTh#&z%jBahOz#UOsI6)T@qXS1?T}r0n%S)7XVdgm
z?T^_*|FS++Hn3*AxE*94E6+mi$60@ViMxaC&1!V#JT8$9I!k?3JGK)b9_84zf=++<
z8-8{>$WNzUoO^QV0mx@zf1-XgNHANsF|6v;>tyswX5(gH*5YO`wsK$;W^G`5|3SZh
zRZB7-tC%qRQRd0)t;|+W>>iwIoy^hl8?=*RGCRv}VRn{Zlij2kSlvMTktWD$bx!VL
zVXS=E>b~c}HBif=z`#_iGxjC3Im@qPHZGopX%EF_e3|m2S-qR#<NIcFmfyx~*BK_f
znc6?+Lvxxp!=`Cd-hgNr-)#DfFU;zv8Fn0)dw9Ag=+v0ZqoAF`%8OW7l6%Y<r{pMt
zMkm_M8E51_mbw0~)&0)_NQh@gHk)!Ygtfk3u%Sq+Q}pGX7^wb(Gha8Gb2C7Aod@<F
z2dN220EN2p1{20PPg)*>b|Wh;0JZ$jH$uX6SteW7qbjFruU5BAP-xD0!))I23*`P8
zUzp8Xe$V+Z<HuuuZm3%)?pNNx!lb;1g`qj!n_<`VIbWL9Pc!T}(7T;^7bk<VK{R8s
zxD{jKc4jLshGcFl#%6Udmao5sS-BXmwZ30)A^z$1J26XtFWoN8sc_H{e4`(zE(Yy^
zhNL$2-;>$e89;aW>}t{KeBUrZU-Iap0;Uqst$m<<(9Py8e<!!HFnYBLx3@FQc{Ag~
z`+^NJm4DS*-)~4@LskiCtFs>DXK-MY77JsLNt9+|;|HB@W;c!J5NvmRY3Nf>pAno#
zEYHqnFJll%oIO390dzuvUi-G`n_A~M^D`)LFrII9V|7gyz0R<(o7J`VFl=|~#BNsC
zufKWKAZ3v2)b|VQXMyg%fQc-f{(gb{Oh(s(`=^8J*rjtJDpe=EUod|<qiZV2_9qM+
zsP1&b>dwfso7zCW>2()Kl<r_<5N2m!O@45lZT56E2HW{e;*686rYS41F@n_aItwID
zzQO7w%)!8xoPC*TcRM>H$WO)`-x!n?Bp8jROMv|)khp0&#D`4cP2!A`Z}u~~CeQo|
z+Of^Spzw0LFgt_1E9le!a0p4anK5i@h4`Sg_x*zUZcsSXf^WeD-C_o6!GqfGryd};
z;2Q*{n}hnX&+j*HX?LIgl!0M#>rxA~*7pVs>d7&zY~ohT49r$t4?&~%$^GmCkdlV`
zKBLcMu9jcI+zkgoB}{E3sDwGydaX^Z^?iW?gH|W#Y~o}`PQLdA2??v(K|DwabM`#5
zS<A1c>5n;5|AJcF%TiF=+@QAhs@BPDF2BUtK>IhJwSwI8KwqoV_GYuX%de%kC$lbK
ze($jVnCVGtHdRNE$?pvmcvf{jKF#?Bbc^Qu0*6S5tF^9yT&;O^x)n1+^R82u8NDZS
zHym7eo_Qx114t#a87IU0gb(>zZJ_%YK_ZgJKqrFDJl!<?u~6xEkZxA)g<Ov_e*Y2N
zUK`rDA7WdA=&H`gM>yYk?gy&?m5h0R-huA0v<2S<0Xk_}m<`<a_@ivX@<-W%1+^7X
za6ygpC9@jK-)7a8Kg^~qf8H}3(1x`uU@Z~+CVY@WH(`MVvI&s!<pu_}KaB368%7!3
zK&@7I-B+N%)aWVswAq~HPpjubc2HYqGF!_ZR<~2FjP8&)Y;^;<>>t}(HrBM()b|_S
zKVp2zY}WFp*_7pvU+en?1_dDd7L_nnKFS2Os)%#9fgpZ&6An8AesmKYJV7oY!413^
zCiuZjNIuWX#CsOhvjL692(!2Ro6N@YkJ0UYf<S(<A1ed1Da${>lg;KW|7IS4&)^UR
z>eYbGWdX(hRnX}T2b&s*3yBGAl5asbpfjtp{A*Tg`HPw!7L>qTM4V{`5}Z##@%5hJ
z0{E6$P-s9(Sx}8F%%1*1CV6uEaVAK4a<KdDZ%|1D5@ToXI1CvJK~et}BnMO9**)_$
zN3t+0D>H{9xWrY3=%@{S3hlFkLJQQoncRN-<*JsB#~{;ZB>xRFWEVLMVhgi3FilCG
zaj5mA>@g63MsllLBD=_8P?_H(D$M@vf8#{G>5Xp5<;Phd^1|%y%n-e??jW5Y(K*SW
zdxs{n&p0eD%FH0l+FJd7LH><aw|{JEt*~^O551)e6f4Hz$C+lcfv!+?V4RT*F|ig@
zVm@KufQHL`ndFJ=kWiWYom~MIF4)3k`5lDX*6xX?Ig%lvAzb>E9}ym~Rvpy*n;efj
z&oZ6^xt=3gTFi_=R&DpyqfC?8k23TeR%C^k02=jSZ+Y3@s18ymkv#diIfEj*4AhrP
z3*Il_KLskyA?Icw$J6u6GRX_so2Rog91=e`85B2@zq7M_y$&)*CV6sOI)ie<G6qx?
zAUTQT$=|>KRAg5c_zpc2ALedIET*4>#bKkHAiJ`_bq0{G8Of5a!W_pLlm%8WD6%t)
zvonBfgvbc9wlgRTTxIY?6Zb^YjcgLg%s_T#c6J8PIsGtmI+BIUzw-sMDl<F<+X!kM
zfWm7=GAH|AQ)PzjV9^=LhHz8CX@YqoyYhtR43Jczn)rSJ|90%*m3~krc_VvsJ39mD
z#s`qCo!x)GgM0vrThRIRkeEacWA%OLdM0*vp65tbWMyV$WdOxK$Q(wbJb@aP>bp7~
z3!VbmAuZ;{0P@Y8WaSClp{_j|`F?>u_?|V)*k#`?lMG3ljp~n2v;PB`A%mVaT|u)9
zsapi0X$dsKm3*8X>@J93K)DpvMeQ3q9`_z(J%o|_ieb4Als7@P%}8!^bA;w$P@YwU
zvgagkWS;^}pQ?fH7w|7YgtswDt^=7A3vEe3@`U;-P*@|!!Bc2ygd_ZygVQ)toXvgA
zk&GJlAh*gSbGjd7S8jL?P0?8Vy$F)3=Oi<_Uj(a!q?lHZ_Y2-nM)&|Z_K(jO@s>%K
zaJCk`%D^PbII-1j)%0Zc>r9<)$z0bN<~U2YLUI8lteK~>GdPJlP6VY0r4&Y0&?q!>
zD<n3M#UM67^4jv5Q@m$D&2M#MoS4i8GaclsIq9pW_drW%7$1~+AojsU8n#1y4U6ej
zt<&8=GpffXPxWB+;B;nOF~=EHz9?`^{?5)c_xTL3IcXD|tf#+V0JTncO;2WJV}2~3
z_6NBvX;cTP{dt?w_5BBV_^B_*G1sW>3yoWdZO?joyhPpSq*;q^XPDpwGP%`t*YsrW
zZ7iJb$qdg}U~XvbUVC_s6RUeiT5{`ikX+Yu1`bC?RZtkgauTyBD?BV2Ro`w$by@9x
zRCm;FM@<pA`)fl}_cIDMiG${VK<C7*YGDv)oGk7NsyR}dmQ9y=Dsocdpz5<mS5}b!
zo`cS8<#m1kq5fH~D~SI8wAGap#DCi8D(L$D!~Z9uAl^N2XxwXbm34jpVgF-D3VN#k
ze!~6tC^gZ7`{zNe1K9kLw4@n>HRnzSP#Ityd6EfY>;C%?Tb(3@BRQGhf7pNTF%##H
z$)!K}LAKn#J2|wI0pvRSyIW!PmO1!5sB-i?u@GN52G+B@1YJ*ScjI~VoCHZ%$a!Z~
zJH(HwvY>vTvf=lF_Y>qFB6168Y@@PJ=?jCzbarNj=H=>q>)Mhpva=YoZDjzD%Kg20
zjQKb_1Fx$x&yzpG3=9m648j5*7>gMM7=!}~99r2QPdxrlsbuo;Z~y;JH~#vK0o0pR
zHdyjc*<{N<Wt%U5L|s8=aDjBfF_L~p)nsp02Bi|?)@2Tp-M{|-JH56SWP-12qboM`
zN+po{cOh<G%+2x#;_l~6$w$~(K=w^$FZru%@Z}%qChjl)B*C^bGQiDZU_fy{qiV7v
zD~s$)X4jIxN+lqhWnCLV_iupI!7!40K_xV()OdW0{ZDNuL<fpnL3)tX*M@$C<}q=0
zP~5Bk2yvHjUwICsr_l}MDn^EU1_ve(3x+?d3z$r9cV{S`Aa1gmoq+)~YBgPrnW1@`
z+mFxF!VHkZzj#8J!E`oe2IW<3pJa|Vsw<_~fp1U*wLI0nfcg+#AEtj{V3^#}vJW(t
zHs#NIgZd}RHcP-g8&**0{6RLaHXP)`<j&`8;+&wB9-42JO{V-2|H{B1%$mAOS?MRk
zdxQE16Wt*ueE9=00eAR9&1-(n0!@cMloft5yq|D?2dIq<>VYu2g4(;F@PPRr**%P^
z$)O9FcC#;VXx$H2gA~4us>u-x7(nu_+b6RJ99#(|1EDj}pw!L4fS3t@%)2&lv^~-4
zT-Vv?^*2PAtK~PSCk*NXLr2*X9`Hj)*$%O=yiZUlKptg#c%Rv<<#*HcRc(?FTeV(p
zpZ*op>pr>)5<*8;Jnl*R-E7|SdqVR23G)59+mm~_7%*pGL9?%*UdL1LNDXX-4e0iF
z&=^zmPR~1_5i4<Z(0CpDBWA01_uj+enxM00SKerJX*T6#2x@I*dH-SlCy+Wt&d1Nc
zKyT$i+|2>0rIb=?ML{#+pt=l{CK?z(y-Uz(d%~P8e;D0QwSjt<?-L%#B)hY+G@G~l
z*?Cy4b-E>J-0Y>U_%#LwVYX)$r&^Ua{A74vu)$(gi|j*?DoAV|eFVB4<h?=tYfx;0
zdXs9ci%LN8Ihm#5Amk)I*bFVmcc2x0%sbmzlG!+!T0I+G{&9kO`@&qO)GZf)Z!~yN
z|D5%0t4gyvC#!TD3&Z1QU%>6A>1LqX@R`btq?zfn+rw8Sg4@2}`ZGzG{Q~<z_8EuY
zU#MRS8Yfxy1T@!)7$<2EXx3_D0QI1g=W#KKbAis6Id$k#8>1U|M8F{-bNX)vhRNOC
zlU8-|o`sETz-AKtS|3${#x<b&_9FB>NQLO*?pxKF`Bj+v$gf*%pb>r0Ean0Q&Z9xC
z?;Qeye4pNG6aNMZMYdkBeF_icn$?f|N)G?PB;zQ3t({SNdOPFnY3&Sw{pM`{89w%f
z_8&}}eZ8GwavR%+ul+asl{J1bz|1%X9-Dcuut17LGqip&BzJN_Tdk?*-W$YUklYW6
z!`6%M4eHM;ZeP_YxE<1WR(rxAz<ajU6|`1Dz?1nY3uB`jquXTG2D|qT@7o$dH)uH+
z_%lCs0iF172a<d5klzZvS<7LA@B0h?dtmLDMt8=ecCGI}?EeKWrMJ7UetR3ln%us8
z)l*QN2p;{K&HnX2t2?7>a>;jw_aFX$hp1p*-jSSp)2<bEwkGFM*qts)DdMc)cJnf0
z(*+FDqNU(_Um)qd*0j|<`P*^^bhWCBkkx{60w^E&y#bYwSVvg`E@Y#RvYcv#jI)48
zSpqI(B8{j_2#5#e08n`b8Bu|_hVd-iZz<mygjqj8`<hBAkUPvE;mshxdlKyKN6VQ&
zBYKnD-M=><ZD;66p6kx)KAG*yKVG-R>|g%9H`rhYYL$R`#}IYLzd+P=f>nXku)6cQ
zy*DthfvH3FY0wLhUt9h#x`E2S_W=`PSG5S91i2iPcb&3exfh(ntw1?t)w^@8UaiV1
zzZl*tFxakYdF;jdXH{zuXg0z?z-m=X;m2mzE(XwPO(2(+{9$x^Z%|;y`Lx-+<c~7j
zFKCK$-SOVQeq|!GCR9qPH5E2hMT#|0+l1Nt`HSuBtHdU=wKL8+)T$2ZLqpm#uuuZK
z9W<U3AP|)7!pa01$!Uf4V|IefP&WPk<h{ZCMU1X6|AR`|tKbz7pmM?QPum;B3J65W
z04?txCAV=gK-eoEfJ)ZnY3veyZQy*%pkScYB?vDc9#z85Sqo})ssfb|kP<-r87Qy2
zg@N@57$i()XW-#I$qdTzVGo!j9HqnB8E1>PGtL%kXSfK>@mKo~rb&lGa(rq3&HhI9
zTWt_?js=0tQC{+s;k`gXbTT8W065>re&CaF+|K=<!7&H51ljzpj1g3J2=nlK2<_ke
zy`Ax9Kg_H)Kd@QLKxS<STh)H6O|2DTOPcS#mQ$_o1p-2so|xePavj)}U>AZ+1i9^M
zzi~Opv_^H+lgcZ8GDtWQQm4G?CsLWCy6nAyeCNrnkTS=0<$DABj?lfVCy6j;#ZQL6
z;lBGbqXM^<Mmd5`9|V^gl1D{613Z0PITGJ9Jg9hoq5mj)sWbmCD3>&EPe1zhHi$L3
z{rC}FrOy3d5EbeNag{ny`TaBUYp*M%bOeKHR7frd=Ut>S2coil&x~ZSN_UV-P|bun
zf}i%JK_K*?QK##nRh@cW?-dS+tZGU2WMv3yea~<pRP-R|eAz}9P@RN2(!MAMwzfrF
zhM9rc=1g?6IS<2hDbQGXS3INlWS)kDt>>F}b1^Jy^=oC`#?1g43x6N*pk`HDP#Z|B
z^$=(^K<D|U>B-zv8CSIg{sr0D;1~IIGE2e1%IzTY9w+?%1L8Su{~EG&zwN=~L#%9|
zRUTe1Ky^BUgi)vEsmW|d{z6hwoA#=f_W}ZjmIq}Vz1q}TXJ2b)oIMp>zcF0x-Ol!(
zp|t;IuVXqmeX_HE_}PEAw^8-|hxzZ2XO}>;9i^dvw?j^1hJ<gkdF%fs(Z-4UrZ%^-
zGJx(o1@$zQQb4m!ps<Cg0<{JZDwP|K!s`HtJVLH{Dl5Yw(Sy)_K3-EM;5MZPJerE%
z6%!7^>LFA&7`K0AfXowtT(u55Qv?bb(8!jwcss+*ex;Pz)7cqkUuS2OIfOjA1oG!>
zaW=3Fvw7=(kS=MlHip<fP#8&zu`x=Au`%wNipy@8ZOvw_|JO~M;sgpykU4tLnJZ?~
z*8i)fLVP#-YAfUH>FtbX`)5yUW7y96pW$sEa%rWM0xGXC-3Kyzws;$(bZ8r+w0IlC
z$$oRz{|uS^H~Ssah1uCZNQbpCG>KOBHBP+PzisLqcqoB#31p57lvl#OGze&Q3bQh>
z>UC}Ee19Q-WilVD)MTzBzgD$egO-rXSirZ12~6Oe=+1kT*z$GG0l0ofsD9SOqmAxf
zt#=Lxv$y=7%*OJY(d|;}`+$UOtxm;<a~zsYTYfW}viugF&d$U*+4%ZXrrFcX8K#`+
zc%r<*gi(1F3xo1H7KTo@85fc}u5$^xC-*#OVRcV#c+ONBsn+`bLjD3!E?$-bS)=CF
z%9aVLGsM{$7=+o`FHL7>V3^$g{4!_^V#b#_KS1N*?<dSZuGLxiQMi?b@jZisgjQ$l
z-Prwi99Z3xJD+nTw_ax}jlBCAV#4xk5EImI)b5A*jO{DLXAjC--C4iFM3;Smh&Gfx
z=4AcQ>2A6GhC{1cGUs)cWY+IYhQA@^xu1oacYg17h=}?fsK}#@`ynFkmmwnT*H=Q-
zJm-Ljs57ZT)ub~+MBG_r!86le_d@akC=G*BJ}AZR!<ka|O{HZ{1@)RIx2gHfNdoOy
z&|EPmIl22f1M_nBzmKJt|5Hj4Ze{-qDqT=>u;M|8zGYrLNdk_^{Z|>*wS(6abiwo<
z|EH9a84A)lnVpqc<S)<9IgjQ%MVl9Y!ob0MP@q<%(tP`NyY1zx%|#w@v3IdgcqYvL
zeD&n^@9!jj%KU}2ek_klc&=(M4Nd;^lx2o{t$A)gqdMz*<{j;f$vhnJTNiG)Uvb_!
zH#zD8!|tnB8SGk_W`M?cK(6?DYd6~khuu@JGQ8d1)Bq}9g;@(gGhH~$WoM$y+*s(!
zyS68w)y@qZGM=kiN<)*sd}W&B^4I)rf1~=u_cKb2I$2NOak=2IcW!dr0noTQ1E|hm
znhslYwx|-+M=rf)&33?H_tc{dXSXx&Xkkp|=3tpqu<-O9mm3bdJGV0=M?YZNee)%Q
zFx!zopgCY=n=8MVW`zD_Ry*>i*{tRFoPu+$8~ZkYQ)4vkQ&v0j2eenMa)0J+YxV~Y
zyJx;+0Nq0XK12OrBB(d=gn^^k-Ibx)EtG-Tt(1Y;J(U4e`purk#(1?KR4QNWzu7Nb
zUdmATp4pw1f!R%zq1n}xq1jE9L0Y_>5mfdDf=f!@{?PvIY<w3O)hD-Id)KI*%yyk+
zJKHDy$!%(a$#T~@nB85OnB78|nq5non%z>F5W0QA`a}B})lJWvvokaZyFdS*ocx^)
zH0A_J56teajLdGKjLoj4jLmMTj0nA;G8$wvqk5}b^7m&<%<ip>%x+T|n_aguHoGmw
zs`9AY<G;^-M23cLPYiY49vfP?-!wFFe`;tTw5`tSo?Nt?X;nL?JNSm}&gTq{?x1s2
zlfnHN2PTM{lu`<jZaQdocV%pL3uR<>D`jMMPX*T?sA1Ts&gx$1nq2pt0l&GB(gGCX
z$%5<(%<iHL%x<hmVb0DdE!M_}EzDQ7CyQK{VRi?(!WAj3&~<>r>hCj&X17+xX4k2V
z%*U29GP`bNoIS0LarRVJ#<P8(y7gq=#lA*0SGVMhYhuZ1*Tp*BggF?Pk~yz49CQ=r
za9~RQ@{B>4qk*aUm^(xB(QpRlqvZ_D$I=-<CV)&rm@;`P8&l&%={7co<Y%nH$u4X{
z&BxdonU9JyHlHwOY(A>aC@sngw*6$^?5V8`o1cj>p6zQ?o6X9>kQkc$l#M$%`5IUA
zv37>$6Vn-(4{v8+KCzquWXJ3o9E>2<(h?mEo1djIY<|YZ=;+a?mYny3E&1g(w&e6{
zY|O`xGcX^$&cJ-)J45ra=L{gbK<US`-#DEeWGe$G<t2tDCvIm+&VR<#e2krm`Gh!A
z^9ggN=A-INv!}N)&KBcfyxPC{xj5tOX{`)b`)9YYGwht7{Ng&pX7g_ho7q1&2!Cz=
z4@nn~-){T&IQ!Z^=Hu>6%_qW{m=BjTF`q~Wr+1Khjnl;$LGCq9PiFwRK$?S{!F2xP
zB=*0L6Q2F)+#ea5x<58Fbbn%~>weSFQg|Mn%FyiA%E0Wgm4VrPDa7~F*}<-22c>d`
zoBh@u+Zi^S?O;eg$;x&2*>1KI49QQ}xS2t@+ar{L*{_s=*&`L4Yhms%PCpKH3p*pD
zdUEb{HgHb!2xV;cK+0(n9E>2Bg7O;3^`P)N=+>y7{O=i)bTcc1HQQl^<oq-ya1Qqf
zWoq_7%HdGGAblYHAic?%#~GATKr4v$P1TzUDz9Pn4XEc1yZsw9Rsq^+_%M7^m&_qS
zH*jy^L;QQ&qcV=OS-2RaxxE->PitqCz6oh>8)x2RfV8-cGhZ?wx4A(lHeU@_Uhs>7
zQFEz#@^f`&@#~;A$nuiO;+mj!XU^bNs_v`|chBEy1+CFz)qekB|BG8KrC(J&6;}wl
zT>`Dq`!N4`?oD28;p)@>l^0|&f<_P)l|0IH%374gl<n2ZR0$db6m+`<R(t<R<wX(4
z=Hs4>%ts>`XWwXJlm?}vscj6Pkl4=gpJDS?QAXwym5j{CG8ujQL1iu|WgbkOeGSxh
zoZQO#;Vn2HZhp?r7}|fae|Fmu2J7x;42|lxZns(()sr*7G0b&O{`Q<<Zr991g4(xQ
ztlL~1XM)!^fL1pst8Mw0e3+GK@^@2)neT<!j{JN7!TuGaYAa}u1p~9{k$<r9g2K?d
zcy-->#;6M3nSr4T)^-K8Tw!Aj4Fbw4EWcKD8g+uwA;|W-&xP5J{CfW({t?)Afv;T6
zDo1`Pt4#Toe2|50GIz_bWvy{-pgYg(A8>jzsxI|n^-5+)WlrV`WliREWo}k!`2~_+
z2HInEk5TopNb3K`Y@Gi<H;hTQfB&zn@RH$i9Qz-TI>r^r?3@fBnO1dWg`W(d7ASH*
z64r+VsZGAl!tgNs@%%4;9?Nq6`5SU^f1^w9{*NIap<{v!0-#V+R%7`G+GCXL&C0;6
ze&k=Pd$QPf23XkDhTcWmJp>wAYjt1MqOA7ik1*$vKdqjY3!2rB{7H`fz>wT!&IqdS
z-+#FOW>xFsP}YC7p^!8L8ixX<9Z)|Lw1N?IKRswa!KxOcR=rN6uJ;Q4H)eB+G8l7O
zI;zb~E}O|9yP%aNIdLYFTB~2%CD2ZiPpLmaJxa((xLWI@6ws^=NCdRjaZx5y7Gwq~
z*_934n}yf{vcsqov{T{zhyMS`eymK*$6XkjkA*NWA1h&CKAwWq61WI%3xLLHk`sS2
zLGBU*^{L-0_&-J8BLupW2Gr())MU->tc=ZWqKwRLri{$)s*Ipo5tQ1m_QTASp6<%9
zo9#OTxQ0l5#sVs_m_0%nnmtMxnB5>HmNZg10;-(?`<cWUCpU>TPI44a&c4n7ngwbS
zpTycY8NEzFgeu6tAm18wzW-o<G1;A!t@(HhL-VmI49v&2Ffboqg2lg}QfhOnIiqpw
z7KUVYPNo>*#;+BAG9W@96c@=XoD9keD;XGFA@d)I7=XDb|9P@MD^K(BBMi;Qt}rkk
z`@+C{{0WkaU~RG8?dFWq?d%MUs<T@;8Intub1@%hVPHNc!oYmOgrWJE3b=%aw98<n
zHl$@HI~US6ljdM$NM^gv0dJj2UgxuBGjL44$H~HcoQ0|Rs0dT@2@|H~V=9nZYbq<F
zZ$GHqLMp+TlB?LbL7}s63V3u}LI14p$z)be2G(AXKS90+rAAm<EDVK(07$0M1zGO#
zA<loy$6XkikA*NcpD1B$K9&Ni(U97fAiG2R8PyNECI5fM#C(i}sreYhjm*bYm_Y3z
zP^t>;Gfoo&>12rPV^n+m{pb(gdD84`49TVJjG&bxo%=z%C>STL-0mCtSeo<O-2I86
zkHtB^?cH8lsPu5zpHn|BeYo|4?diEM*WTQF0=uD^fm5qf+2+VMvu>*{Ws5K0-hYr^
zwW=lAot0}c=aC=1-b=lfwfcd^hCjqlVN^}#DrIa|Ir3wodooWb?_=h#|Ne#?%mR&D
zPVVCR(Cee>GtoEsBnum8L<)44fBZGA-q@2et{@X;gGP>SKxRfZKV@YEjYEP)I<EF^
z{vOT<89A!I!+Eq>{m75xrgV1DI{5b=<}X>*lI+0B1armzZbsF|{8N8|T#+o<%A9<G
zg)Nzdi$Pgo76YR%_Pcx+)n>Ii)p{m2H9Y3s`ulIlV=1mb7xy=twtSCjd#|9sCh}*q
zIm`Etms<`W-2V6^%crX$rrXbkJQnBrRlEIa$YWuyU$LNe3V4i?(e3>Q`Ae{#7$Wxt
zJpkvwPSBYF+gjd#$lsCd#L5G$S@$L$l}Mb-_JM!$R5s?x5$(*A#oL*M#oC#KXS6Zp
z_JLYnlO@_2g(tHyZT`W*c(GqttexQz8%W%^ERA7uTsy<&fA<(b_3Fib;kb52$24I!
zwhx=1UuQI~lVenzy!rWY#zN4{lEF^~iBv{ckolA2+L?vr+L?^&_A!7|P8Mxv-29c5
z5u{dFqMhMvzi~wd!{pF*hOfP#T6l68XjEwPH!()V$yfV9rp<W(O3kn`7L?BmL;r$r
zg9Pn+oy_uqANiKowkHi72Qw$nW?>ed-NH0^77LSBC!^0J7IUuupu2-VtXv?GDjWv!
z`(&|pri=Zc6d)|t&Um%oxGarvGIVr0j8QnOo#ASKY9Gi&AXRQ)7a5nEGv4fPJk6@}
zs1=m9>{qz{OpHPFE}5zzcPJ*cLiWPK=7@tnv_0|r0@^VK+AY@X)ymN9J(YpkdnrS+
z=T^`xVi%~y%%7X=%gO=XfAZn|&t!L2j^^VojLpYF7-!GwVw^pjn{o52Dn{mGC5+6+
zQy4ctjbxOT?uM6No1dmKUhQuZ1(jl;5wM&6m!__p(x`6hK9ME4^g9!%)>dnMFYx~*
zsPq828QZOolUYA7fmF$V5j;AXMU>&OIOm^>`$OSnOQXxp?VvUZWZom{17zj{bi)&9
zRBc_0QTMja_aDwrNOodn1GQ3wxmtd;dQIj&@+<iS3(K-r@Ep&F^Pig4TYjx-N%m%C
zNj}Za@_0)4|F||tZu|enukBWA<xSA+#$yljzs5YKjPC{He-(agcIRR6Yn#l<z!KFu
z^|4wjsO5oewfN)9?Eh**&u$0ln#|6?;`x=?ormGE(Dxr|tsl2n7P5U&`T(gN7$meh
zjaoOgtm}L)P=8}K8!Lla8)#<g{fGY_5$O(;>R>Smibv3Ve*=eB=lc)+_rc{9(`2qA
zzj?iudM;}X1D8|hPlDGwbh(2{s^5a{$^GVxkDH$V`x}BB?y#FSA0K1+cQxcLJXNFG
zvHlKrJNgfkV+Xt!?E&pYPh$i3q(OZzSTCnheXm>cpKlDXnUD7$<eOlnjpU)5;h>S(
zrUtM{9-)lP&ZUgZ9;u9=9uKJ10V**zKTl@>^}s-Rx>0?vNAlkvaMK#y-+zdo4>#}d
z&2X8+p!?%6%CQ!sR-?{spcxE-{rf;U0bF}QQ$NTiPz?-e;ammJZ`ryh7k_8+YX`-n
zR~slFf$W+;0}+!<S)jN~ZslaS8Lqqlxdj1hzd>99+Tk*p{m9={E$=_fpJICuWIHGy
z!tx%-c2IqY7{3AKv*f(*OwH;?{%&NS+ueFPg2-7pS@-0O?+k{l5LbfS=g4|>KP0_D
z$~MrL7wBfC298x->smH-zJGB4mR47?11lS-T{4;d1Cw#52_vIdvha7d$($dUlAozC
zc7ock{4<%FkFzj5?l%9wnR})~TpKKR&p)Bn?Ra)G_f&^Vt+U&>8PwXsK=bK`w7QaA
zSs8A%)b7uX0;SYPC7?0_Ql<s9GF5>_&p<g4QbyPxS=DKIQv51t6;JDo_X6=tq}f;*
zre6iEU1^;TGV%WBRjs?*W;#6fWc{Vq#^??blYh0U#rNWSf%=6Y)yrBzV(}l(wP<yL
z+&*!;SNGQKr#f@D!|p}}?Pu5O)N5VW@?OAx9z+kQ?3D-K#R^+X2MRCH$RH?hwmnh%
z)4*ZWW!AQ>3p^wJf&W_KQP2)DE+!dQVYVZ`y@;Mi>c8!I5OkwYv%4o_vs)x1vs)!2
zvwJ2u&tORb3Ex>Za)NehCU<i(-EaVnvP%;+H!JH79{XxN!hi^OP;CMVanSs6v-*+W
z;QqDiQIrx4wEhKDhM9FiN-_DKAaMGJm1FjoA?XU#8ib^N&<Fsi=MPz>u&PD;C^-IV
z^*SeW9{KZL;6GTuU%U7*(3~?{4QPJ%{fGVMB#$<$9r+{ZzN$UB=@|<|*V3x@0{>e;
z`3<JNtrDvK^s08vlMo$@uF0Lx&~DY7;|%JV%?7Ph0kz4dw=;x7XY(RaX7gfuA*&x4
zRYCnXkRB)>yuJ&PTfJVu`*WRoU4KIuJ(smIg7yJ^@b3Ywx$<jGKEuNB{=@tajH;*F
zlZ#g}tZJ9;WM_D}|8IEm^e+sMwwo4XqYEgkARz^7RTHv7zYW=j`d5sqtJ;%`RT)nq
zY?%Fp;b(X<<4>k!RxSosO=Sh_Hth|8tZahROyHIrG;WS2>2+@Ed@tbt4wU+*9|h;H
zM9{9l`+Gs{(p9bJ+CcqYM)&t0?6-jY0BJ9Q$`S+*(m$<4sr^>9=z(?^3#@;!suL2U
ztTFEe&Ob-k!x{~;Cw_afBP&y*CbCWQ*CNcuW)rBzf9b=uH@9A-{mJ^l_H@~wQ$Nmq
z0k!(`zA$itPqykc>wf=0zHe1evKuQyt9$a{bmp%y*xJudwTo)gS|8Pb+Rw@=EI*PR
zxp*4g8a*3*8eN1rKQIaN9QiSsyX8mnZ8O%%?N9!{nhsiB`q$*I_+uIM|9>qXPc!@f
ztThQ-%DsQKs@3!?v)Yj#yLqQEBp=OXPUf1$`m8k$B>TYr<*J@!FIJ{xhgEFNYArt=
zpEUdZ_`uD7C$}53&Sg;6+w%Rrfc~py^&{V3%~fvDWt`n2&d{n^3rb1sUzt9JKNkG@
z<!X%S{$}--ACGUDe{OY8zC4}bugR+^$_*?GjXu2Fn{|%-Fx>w!MiE-ZLrSf-C!p40
z1IMaP(4D7dUGE?C|5?=zDvgulI2rziqm~Lz*><g<l0jLI<rky7Z*-$Os0EUIl7(eo
zYgn6KYckVIrsS?KOz$7q-&xh3?90lKe0m8Jv-*+W5c$VKFaOzf|J+|2p3MK0p)mZh
z;L~4M!wdIAa>6Ty#~$iGZ?zY0{}`SKAE}wlb_BFa=EMCjl24JxwjTSig2%ahLqRKu
zVEF}HgR&j@3t9)L*ZKZK{YTM<%&JHJg4Q8Ovwi*F2w5lh;s1MBDgvdU$6l=P6^Fi|
zAQ4cx4r=K`YC_P73!s*lUiYTXZCzGf?;q&DTGf*5#md6yb_>)Ze_(%hRZFrHD~mAq
zk>8vvK;?i}>-z`yPea;Jey#5X-tPpJS5fV--kf}6=3P+f`goT6-yqQW3j+R^6TgDO
z8&vm!%3!B#SW6A$JGL*79LgXe-Tw9e*YM=0&so-WYIVMUkpFO1OR^g)6QkSTP_I_S
z6{|ol`e46uRePg4#3jk?=8W$j{6Dm+<#7<ir=ZdXR@S@>`3v4H2q~RGr{sY4zJW@2
zqb^YG=f7??7b^p3oGST#2qW)`_X7N9{+bwbsygm&QE}uwD9kC!kbEwL@l>l{TTttJ
zf%C^!wX3yxwKlr`{LShrxB%N-uc);F$Sz1d(!U%OO2X_%{=jOI{&$)OnKh66S=G|$
zsWme>O_h;%L91r+e-*~ftTP=zeTMhTX0wYjfJWx_O?g~A^WV`(Sb6Q&3R%C_ta;=Q
zx)>sc!`^__&<1^gxnf(_djbCWP<Q->xr6_i?!i?pVXf~4{O2-j9{DZJCCZ>SGx@6u
zYon(k$VDGiSYa+YKNsvGy)VDiTK7#!&X~#cc!K+XNG!kKQuq@T%b+$6D3)R8Q2dR2
zyS-WS$nUG$k47Gax5**t59B_m>p-V{fZR6~;l69&_~yT(dlclZRV`XGlQUEqXD$HU
zD)`qj`M(M?%w7IdX0wShENfTRyYg$>l*a`#|AFd;qv6U5zZe?bVXlJQtPaWPk6F3?
z{RPV(-Ts(?>z}g1Du##qA9Hd20i|7#zK2L@2Q*3wtJzZ-A+<+-7u2PHAT|55|B#xR
z|DxpCX4NBq{Mz1sh`#}goky9V^}V1vmsu4NXOLKg#TcSj3(Ax0T8u#XaU-bb2TASk
zAH+|A<W5lOH2ow4!{pA+AGOhjE1Ff0{C@wT{-W$ln9BVVSG9mv-}$w^XSn|#<Wj%3
zFz`79??1dh7SvYxm09)3?_`%$#>%g1t*9a7lnp8iL3tCl=9xiaIwxqY@yZ;~DH+MZ
zADE!)&T|@FKzC@jswi?c9-osBI)w(L;_)%$mCm4Y2Xt}=<kSw(O_JB1+<FlAC+SDp
zm#hzYZx|RgUruKMpEs8_#{pt;XIi6Ya@+?7u<4qLoSnz#WY0X@G@bM59EZope*R;0
zMLwqja_WXt&7vBn+DEyd`z6KyGBGgQu4QXB=VcK8&cwiM{+u0jlEcCK;(wSJm~D7?
z8$tW4e}MKYLskvHiks`(Y{|p$H-ym}vd;V(sPAczpb2V`c(o><XJLA8uz?eKo%zh;
z%w{b=KzprA|Em5>mf>b-R_9_6o^H+%G#xaW|BFG{#GH}U+jT!k{8G!~gMUAPT-3^=
z$n*HspC6pi`CHg*5-7~o-he{g>ji_vsup2Z29b50?-$sA(LAWtrqv0WJ%8_@V6du%
z@vK+t`vvu1L8U!%ndjB|o?$`6s+L@Ee;Zk5GK<2&llws@MJ#)B>P6cZ&}k8%lOp22
zfKI>2deH!}Pe>1B-&@d$Ia+P2y1;4LprBl<i}NY-DlUd(5iX{%*7pnUzlEHi;Fh^8
z6LfyUqH3m^M>$TpL9J|ApmP+$THiAWm}+$u{+!Hq<R>JD96Jv-?SuYFtzO@=&FV*f
z^13Hie&_0JSJwOT<8j1?Uyj+0o}iIOVQ%gZ!aOZM*ZNq3W+Q%fYAW(RzVY)%vpO$>
zS}U`rF9WEh3m$!(-p+8f*SNeKyrS}E@8<96uyMy(t6J4sA0K4>^ZvvA?p3WxZECHL
zPqF@bZ_rROTfCETc33B)w0I{2Xw76fqjY2^!_9u<%1lPkS!<2zoNpgbnf{YmwdJSq
zHA#nSt?wBe%586IbqQ`Sjbhv`%%yOU5j1}Ign>gQ(VSg@p-_C+bXNBn&|PG(o<3+L
zy*L{)gD_j0tw@qY8b{W?X?D{mB=IDJ?k}!2`)m51LBI#zcQ0J@W7(HeA0Q{(Ku)(o
z<PmXh@OdMa&F0*UTAiSNYjO*_M6-D}LvlBW=4RM<I??t0g8GZAx-3s>K}LTZ76fZ`
zNxlS~fid%NSZfog7s*iIsnx}M78Hy17ZJG#H4ni~uu*h<|G{pTvcYPG(2v4g3I`AF
zU)DOA?Z^*Ej4s;*>N)DKS=Exv%_;;M<>hrxF8eOj*{-bi<;UZo55F998a=o3{AU2I
zbrt4q`7!-36GQV}-Q#l{yjq)AyI{oQba*_rL*w!N-&L(%t;xq(Io^Npf4{0VtIex5
z`2Z`&djp0D)wj&5EkE9Ws9W5;oR@)7HTlVMHi$^vqRHZ{Ou|>MGfw};#L&Er?X>i@
zZpPWuyBVdYcQdS-cCp{Md^+Ro+uaOPl5X~I{@u;E`FS~Gqxw=;UANvt%;wyTX491o
z!Wom>x3frJmvmrNPo8$10TkNXrq6f`@@c2$LYBv8e}1an3ksuu%atuwGd$*JeFIYS
zcqaQZkm$T+$|kEB9t*KP1BG4SUS@M{hS}F89a`0QO`G#5cYkTrTF_dn2cR=*R<-N3
z6{|CtfL1OwZ)=k_o6eEEuk}5{2X0vUfTb!_mCqz#DmU<8sO-?|Flz^;!s)D_Q!Q0R
zr)2J%){&Il&%rPyaocpzxzbK;vs=Iaf6rh5*F7Z_Rb~PgA#<1V<2H8!A51s8xgX#*
zLgw8-?gZ_>Vm4pS4LXm=9GtJ_B%|dlP@V&?hip_&KEuu-k;<&h%D`;b%Gm1OY{AOJ
zY{ANCJpDPt=4t5+wc?wnA7`9=;{=1Tcshfj#%8t)4u8c#<Kdg9voi|2fB#?F54w5$
zXFq7I+nj?EsmvCwj68`VnbP9N8Kgxy7;Q6*%h?&tIoKJDOIaB``)5yeWi)3kV0hUJ
zUIWCqos~iUZQmvK(Ef{)L352Db7T%d)>S04vZ_JqcF>5E-<JjsnOtG^2llI4{)#83
zepivmoS2?m_+3RNaOdHez}CYOrE}erUp`k7skC)ZPQ9)qQd{euoOoTyA~E^hbA>$~
zt%rBy%ymzG@myg`fvtOT%5{Y;CAIF!3D*^NR3yKBE(fx^(S1gO%wf*7M)$v=p!o!l
zSVw~N^>79*_RVZZ8O)~h9G>0I&NL%u@-%j)#z~J0KxgYH9_CGB^k{VzWCN+6kubaM
z`+wo7Y)q5Go-zuun@v|%U}pr$bR-zFL(FJZhnrA-{m<lf77pPK77<3zzmbzUKG-WR
z*vOvD^Mh@MbL#yo&R=g$$eAq4&eS;Zaq6~zkhL|B6Sn=E;QsjSi9c3t$={waOgVhx
zuvz=2HovyyM03H}oNNqUZOK_T`J_47!28iV5<sU6OmGM3o_y^o<78G>2H`X|hjr5?
z9J=Dns{Z)jvp*ZzA4~lBF(aeV-SYUvR7N-9W><z*58;khunAKVq^F02cjB&_wrkpi
zLm>Z5Ntgv^cO-0PV+G}U1#!k!^%)t^@Ok{~&zyjb$L|CzeZR+}^?6SUtJ`Fjmfv-3
z%i4I^-Y2{Vor_rTz8BGg0=1nw(}mlP@0r}*zGpM*R|c(V!mTZ=??2REnG-PaJ)`U6
zUz&gC<S>EuqcSnNJ{JD@r`7%Ogr9#p5`4FtwOMYrYJ>Ryana2WNB4uwa^Ew#ogHBo
z)B6wm&(8_Cd%GiH>-N&n!0m{+>*>##7@D`M7tV1`ezBYdUIv0ik5{dlJ|(&J9Hd5i
zc2y>6+w>X9tjA@Xryk}>3viYxUpH-vlQ26w)8=W%7&fuZJf8gW8-pYJ+&-D~zrP`A
zS|)klv{v^y&=meT{DA4s(~wpRXw(Qa%F^m7zLSALnDb@i^evzrjZeZ27rakcKLez;
z^ZdbP={9x-P&?r9H1q%OFZk^TiNF00YR5oESr}bG?M2WC_EP9+g=}9yW;004aa`B3
z^sp9a?B;{t5r|LQlc49XR()qcpVbG|P3I1xhCzE4=(O0Mw?U=s<hEr;XCzHYvzyNH
zc-wU44d#rs`%6PXC+RjdfOfNhPKi_lon8#yWBKwBs4cqiIA{zzZx6)w<x$|XHD4_U
z&GCHT+l^}1@nn!)Gf#s~R|KuT*fqT)88*HO;)B?XuAp8%rfr;in$0^IAhz{wh1hmH
z7}++xEvU9VkAd0N$*^mBhcnCukoll>`bR;lKK?W?K+Iwfn*+N42)w@(`4m6U-YL)x
zN1q|L4E%=NGSKp8?&Hbq3hc!b*iDNA1WYHhGeFoEz-%6{c!Hp55_nf3te%3N-T0yY
zwdYY8$D4;aa$DV5S(864XJPf2d?THqjbm~L2aoW#@65@6m$OW6WoMb#+vp}cPjW$W
z?^h;k_HPWv;x8Cl*>CneezE*t@dOUj;tgV^j~_4pGnt)%18ir3py~S$`#&+d!s?iH
z?QnJPm;ZRUztIiOf4=+&XeH@QXq(&hs6g&yc7_^ZcCkOn@1AooYq&B@W_Mste!<Qu
z;X0Ykfq8d3n`83B=NvJv*6c4BX3k4~{f&*s(@;J6`BS#tZQB|CnoZ{Tz?}Tx2Ago%
zH|As+F;<b%m8V+WHc$V?@K=2Ev}X*Pr*CIyP2D_|l@V0)fNC0M3sxp!c2=gpqQb1K
zLVx>Y(v81uXP9`J^PNnxBl~9e9}HjnXFh){3R>F?*-xO9QVL$D44NebtyluBTmr4W
zZxGPxdjFyR^Qtb(x1ip|!PAgFRLYDw2}@7UN!fV5)l-}mG#1Tz>>uZ37A~gu7v8NA
z=He0(=4|=Z%h{81s?D!$=E;tPgDme8@~3*WzE7w>X!-E*6qo<vPnj5mSzSBcUpO}f
zc~&s2bx{>)MLei&b8be*lgPi5xfBlm+z;kY?|6`Vb56?F%Zb}pb-mpFHR>j`h0J@5
z)m<cUwzxX@T(ND_VJ8$!76a8l>!v9;d}Cl$e_a3U52TENv<5)Bm@QZtK&n7`8z(i1
zubb95x%n6y!=dTm()%!`E>P_+91+35sxh0LgCV*2JA+jRh}Eb%_q_DHQU)fu$>JPL
zwZX!1d`!YOo-;DKcjgHPGc(B~ZmvjY_%!|7^kdL{9-BFyF(@zi!63-~Sm?z+iNx8{
zkAmI5YdWZ1vJ0w8DP_(fN5-ZGh?{ZSzVPtud8G_Z5ZmJ>--FrCnGbS_Od`lO<Kp9t
z-=_bX-n@c?VHVhj$_vC91=$}9VzVC-0>~kzdNTPqD_b+D{bP23;cxil8xahR8pa$4
z92!-VyM8c9PcCI(5(fE}(Va6-CQ({Uoq<X0({#p3v!-u?+Q-f~o1GmL8xwzk{5<t2
z!*+HBh9=Qn(;FwQ1FM;G7<rXEsN{m3|E<-zsU`U$D-)w@@(C7(xo(VZkQwOsZ^&g4
zNE~$5Mdn>(QA7B?FqzD`hbOu*x;MHCBu<{r#?&|&;<lc{0-2N9)fpzLv9dod{`QY2
zwbhLy5p;T%Ihz2(`vm#*urdHt8&3ZYst1>6G?I4?<Qpc?Igp&7a~Z{-gGLY7SwN!)
zTaQnF&BV~WTbl*x9LV2H48q*pNuX2OP|kr=IG_q0IRKplsUX0HJaRz9IgsE{i}n~&
z&VdAtK6-rstw&}113Fhgt25DcU8hmk`w8+NRF4X?yE0B@XJrJP_Ndi9nZ1=^RZF9X
zS1Y3jXm{{A(1~>QTAi$Ko6WlzW}cpsJR@OFieQ@A^cfGP_9wqM&NSf(=-jdi`dXcW
zFCpVvptYp1b)=wEwCmqI1@9m^yS+5>CwPUX+7q@n)1NRgG;c}y#2_Ht&cZmkt%X6Y
z?Y)731>;k&c_EN=0IH`TxoG+|CWgsvX#wbaKHC4m_I$Me1LZl`s0l=u;z5YMXFk~W
ze1P;K@A+tD6#2;W7U!OiLXljYdp_REe1zmW#<Mc1jpt#t9pa2pQ2K-H-e5c{lZju2
z?@8ny0%*1sG&7y_pn+puOY%up4x`S%W2-v#THk-Df5!^mX^44F!J=%)>KO6YObpD{
zuWx`(!4!YR#K3H|>T;tOXoPF(X=WSfE<-aOhE^^`uJ-~H%0OcTeyx({n$3F{8qYUP
z2dxAP{Ro<$+W$QAC&&kp`$1+se)Q`Ph?fX&Yr@hQER_kfGBB^}d_Q6TN!6pPS{U8E
zz<aP6-OjbXS6CpZ)hYTGv{zYqi3y`{YYW4i2hjaSJab+^SjXk(yaAo`qSeU>Pg%(6
z>i;oVdV`6APSCswzWD?)djMIhW$ww(pw+dmv(arbE2j#h8)#SBWR?cI_YCK!3UhL*
zC@y%<pg*<u1n5-3gY1xVpEiI0$<U|{$^oZZSzZ5{{QQq-i^5hhAd3jICL9E{P(fjU
zI<v5<#i(mr*RD=s&es2+(iyaOYW7r7@LtG`>^<O9+CXB$>;jyivk<^1^ndvOIrL@o
z_Ll!3_cW@5_W6NVLtJlnOg_ub12$)S%m0n+$_w1VeK3$(S9c`+?@e**=SXhlWNVU~
ze3O&u+Dun3-UT4tm^QU?B_C&JOYXN~W<JgZ?k$1TZDgMTaWmL;Ap0RMzW>7aE+jrc
z>wrP4$wA}VFqaCm3$TD(2U=GIYJvZMTKE$t#|n1$#qGkZ0S9Z5=IcOnb#YHXr++ta
zXmxMu+SanGd-6<C2IP<w{{E96?jrNn|H53LP(-+@{(iC)t3b1PH@1*Gz%B%KgLyYN
zB*P&gY2N)GIV9t6XTHR#pAV*g@=HmE$v;7EQC?sUH|HQYexTuV&GRV^bI!1HBsX!h
zw0a722{29On!uFYZOsld8QF~amn<KG%-F~dYb_}^d|~)&-OBQKI`<!#4)n0LKhO9Q
zCI<;?M86a?C*zd82t2kAQv<RwoUsxdA2&h$gCA;N{NAwr@%qrf03Lk?=j!+#!;@N_
zjP7cPTrCg~vZ{skDJWN;YZYegWKcHv$?%>bL1$G9BnN|12JD;y&^;9QyFe)hSrjxL
zeG|IpA9M}~Xzkmn2Vq}8Yu`XSu2;1fb(?kV>V&wp^*^Kg<o4ri&=hIj`hOx)j$(D6
z+;*I8#v#tk?Oyy0!knCile@T7EEl~05O*z^os$QYnkTojLv#GZZcuK&*2?KxYx(m&
z*nDUTPiIW-<Yep20+l1I-jlf*1cZ4Q3?_GR6@p5S<jzb;Ty1apFWk<~sH{-Vc&!Iy
z%fIu<Ej(<fwk!nOa;lZn^{)-+WLD%HuFUX@;jbkt*W>A&zZhMSTiCGk3Kr#n+SxF-
zL2PSh^xO|BeGY<i4rHD?><wsj4yeum%^88u%<ls0GAAy?I#bNO`57j+uoMb&bAv<7
z?r?Gs3tzK&=YRANy9M%#2{gpaJE36^&X~;4#WtJk*MBA{;V3SqCaKA{xR^F~doprn
zn|tvyoSP-g&0Q$W#ieqq#c;v<4|aPGp224NC9vsFFEbzKWJvC{g66Ew|C8I;8D|`7
z<$OG`@~_|uh~GN@3#YRyKx8^owtGT+Fu9Xc1!RNV_PHmp*>DbO1GX9zG-?A1+q<AX
z3wS&hvVZpYONpmY)>WQ^5-;C>@c#*GXBHMJePsKp_SWmA-_xLn*Z$o4aqr8c56|Ab
zdch!>%+4yb`T0=>qxR%O>_TRp$^C2s!dxw1FSSo!#=tPStu07=8F)QV=&DX-8<sEc
z1p+u%wXhysRlrr^mANXDE9+U6TlKPPwwh--Zn<i$uTp$LcfqK(eD!M;zYVVE<KJJX
z-vOGz2F<lNM6jM^HsfaSJSUPk{W_@an;ydIuDBqX^*D!9drz`3hd9GR_Qx}~{abo&
zPTJPfUTv3Jo2IX7aoi6+&HF)r`>K}5POLw`Cj)<lxXsPeul4<f_;tDmL9Kx4w?Qpm
zZhuA}(76S@r<wP1L(VNQ<7Id+u%K{NTUZ-te?{-1W^-P~iQx9cRL01^AlD`MnSKPF
zQNX)hS!>EykZIu4&h!8L0*M-K{~DqQ3il@r95)<W-IMP>XNYi}<C^^YIRnR|Ij)SZ
zGRN+?#vFsRx}axPKVjeyNo3y6_8+oCU%-_~yw#m?^5*Hs8K%Ak^|WijW4g`T+5XQs
zJQ14n1zelNS>27rk25q*z6q8GnIOn6a~Rf^jO~93b%{h`vpM^JNE-p9uhp$_GH6_^
z@$KYe-~NAv=r(8n57G;2jb6nN0k!P>zJT(l*AGa`u7P9vPbP-Roh#=vFXv?Fbx(ft
zTx4CB7HGBdh4~LxwI(~Uih$2g`OWACT5<58R`Miz2@X!F+%CUwwLxO(nf|rbpw{;n
z?oUo;2Aw?O@;f;mbn*y9woUIEWNqFQ$ey#SJ&+w|H+zuxo89fX)fUv+sPg_oeShfD
zW_6d}$*~`}nxAnpOlEIjm2fm}{l)~^TR$7R_D)(1w3-`iQs2e?+0#TA9MhK01C2L>
zP9Z7mpFK^D!MJTD!_EHLQ&bp?+qW?Ycd)WDNj8Z~JUcW+IFgeIG%GW?ZP^6z>r4#7
z?CNtsJKoHuvb>Ubr);9i2x%2Qe{S;(!b*QA^Y1-Fg6?A})_0)!<yLjjYSX)0VPT-A
z2nmDv&4wRKLw{}+W;HnY5OfB~69x`}#AdU${|nh5XDCRxwz^wSe-7S32`)>_+Wrf7
zv@s|vykOV}SF?NibB3AVRP+^kVl1<H+kZo(baEAkIHWHEN|_+_u(a9gzI*y{hKXPk
zf5LQb2dRLi9@yLgGm0pvjfvWy1GQ)&J-YXkbkW<|0uQ3JIt{_KvhoTSSX=u#6T{^8
z_Rcv^4!Ykt0SV9J@8*1gu+qQI0iBI4j=N8%-w*54LHs6>DC62}*8U%I#)8@O!r21g
zv(!PMIeWS}!{l%6jFZ_v@b8{}odJ{&KlX$C2pP-5ZURVG;cSpTVRm*Fh-s)MfZD|l
zjG*1|XThd{@*BRe(Qh=x2pa`YtxikyusIG28~5rtPeAM1VWIQ<BWmb8V8t0a4e@_b
zLudLiP~UY~6?)$lab7|DACT)|<qaf66c0l5sg?I63AiQ`IIp0U+2kS5UtE1xgG7;9
zoPF27HV+}CsOUk7MApM0?lP{)f3GvhWaICpqN&cuuUht~Ok(fxEAA4m$wk+hW)$-t
zhV_wSTwA+m9-h2al!0kFtQJM|mRZ54f`dj37zAVzSG7z%3^t?wI>Vgu*27KH@3??;
zgVxa?MhrlAyTMF&yPfr<OyX3C&BfQ5W>kyfv>B2fVLF={CV%_J+<2_f-LAE%0W{LO
z?1|r>27$IWryhXDT%$gKTBVynGvB|U<?4e~oyuw~zusT)-?OU46SSJ)7kJkDS916V
zj)Pf@p61;D89+Oz#8)ve2y=1Wo4y)+e%(FR1@9m1J0{I8%5bSIuI&+M?`^^Z2GEI7
z6IqfYf3nPR@M~q&L|@;K4xSeW?W(%j3*J|Cp}t3}=TUo5>*GkCU)WlZcCDZmWTX34
zjP=c%S{U8dbu#Z_VR(N){<KzSN5cCD^Y&`BodVS(59)R@KAn>S>f0dqdLgqiu#f?T
z2`FqJ;nE;5`Fk7lww6_$MqRtQI-gJeUdE6-nO&rLc^3oo@>2}S|DOvrZ{q@wo-*%j
za}%B}&ai8`Fwc=+ee92*wOHF((7r0WneQ+7FHdG=6<}6B@@t`cvcPwN2uB|9DO%u@
ztRf(1aye#8PitkIeWR68dTJ|Z^zFmuZ)J?2-4USr$GEf<wErkgjB)nWRtDqpbVkp<
z&0kX)Z}$84HHkBcHBP?RuWa&@0cN+`F_7KwFRY*M2tEUBqI<H)cMb_hVYUm*AX{gL
zLTo(?-rWSYp*)=tv`0d^{rdk#_2k@VETDablfQgn2K9rKEoL$_x<S$j+d;6|2jZVI
zo&?>9#p+(iezRZM;wJ+rbQoP*)s>h00`K|7w)3Vm^zL?0U3PRkD1FX61ez6t%(j8n
zgM!oJUx+<z+jq4n>#_WKf5CsU<WXkzBY)>Oa5nFpKj#1>79sH$coI}<2E71{+kono
zuqO=+MqRq+)^$#A1+9Ws<=5(be_;OKRjtXMtSk_d)3$oGzQ6E)>Z;ace^w^1*7pbU
zcY@EqVw%2+fnjpjt1Zx7Iv4DFK_i@gZC<T2A2ZG3e7Ov?eh;kraXjlEY^x<pL%)LO
zE<vk}Kr54?et_<;IR(DSChQMlWs+WZ@)=gXZQaS8Y<xyNP<O4>>U@9Ue{1Di@CqYv
zYkJvQ@T%1d{LQOcG7o}Q7)f6@XPAB6oFVjdllbIY*BK9Hu9^kgy*7Of1H<H=H>)Nt
zcz>b3aaDU#dsZ7r|HbEb92T<7z5(9X$S6Id9elonafJso51KQAPHni`*QnMsdsVyW
z+vJ{EETHu)=y}#1t{#?W^)G7mrnPyszG{8d{y2>H2VxBs<Q5v(Dk{j$K8@~2w|@=)
zxc_T7s8j;=Hq_n*J-qjY?JKCqaqZ8oACTV0yC)2i;NH5IUe~7X_YLtAllfT#KxZ;F
zNWO2VpP+2A(k+>f)uPpXlDMO*vVqD^Ws@&I-Z$LuTh*1!&dLWmLkV=3TYT55R?wZH
z!mKA5-#>_JS<K7HGMW9zH{}gn49Z)$81}U(8$_~0LceV$Xg`p$&6h9l57@tHRzLC$
zT>5=WJeeH+fyXgtRVSnOc3$|ppKmi4ycb}QUDXb{Z6tXnyU}|A22s|d%&INl-e2f@
z&Zx@jJ~=$qp^tsD*m4G8_7CjWrYEN^XPA*3+7DiB^KBw$a`bODP}@(fl~o%(q_=}Z
z8npTgx@zb`|E^U%S#4^q&srZ};rS8P`o3X*ljMTQJPHSyO*`G*H{5UZYJJ~O-w5h&
zy-Gptak=F#%S~&2mILZ>O=ko3)}Czu-5v(=@%s<;S6B78{)F_wRyQ?UcDsSjAl!Jk
zc{?ZLxz<Ft$=}<VA98;E4qCC^tajuFq@5%zD$Zavm5)`rU7R8L_jQG4^G-Kql_x*!
zroMlm_X}jg!_Up?-JZ>6EzsUqT8pyIPmfEjf5X*Ul~ulcdw*d6RY6eB{?_ZBeB!xY
z^Kx#6<TiKRX7!eDAYIBDKcQvLu|}{<5A44LQ9su``S^1c=H=WBjqb^!?u?*yHgn3s
zdTf5WiBALdL)+>hdg{-^^&EOGgQlk%q^H$W+2E%KM3-7ENSCsT$@ljM?w^L}>~&8*
z{agg>x?XqX=Jb|t$|gTO8lm>ERfBZAKM+3+bkZkGRIU0_tFp#Q4^S%HKLsSCthLeu
zQYJkG-PC#@e#@%XRXvY=SRbjiDqFC8Q?_CG_I|_t53717bGCd-c4y^r%n|1Pz&?F8
zsFqz_&g%<WamKjf9q4wO4fY>b^(MQra{0A^`3wamsb87ZTfTvKkMm#udCy>wqty=b
zT^v|N=Jodn?(frTS8LTh-mG@yTXN7{HVNnL?Ee|SyN^U6^})s7zkQ(E0JQ$Fo$)5<
zoV*MClUMaT_GG>BSY*`?Na|j<lTlSTJk^1ZeKH%%_g&LK{m<nLk5g8En~)UPKjYEP
z{h(CYyF0A)Ys~uw{~N8FC$qAA_X6E?dtz13V+Pi1otyXd*zP9w)U@QUKY2hg((0bL
zHN;WC5wyb?bRvxO<u*p?scj4gQ>8&?zQwgMN=vjcOm1cU0NPz>Tq?>4I>!TazKU^$
z1fz5q=uD5deW3mLxqVmr1N)oAnZ!Z8=C8YHVQTO0&*}~z8`VK6op(1lh1P@EpnCP-
zW*JA^Clv~_vwr~XIftH9c;Nr9Rh^IBSkJ8j#XQ3XzsC%$=Y-i>zJb@yGF%8bxDyoK
ziW?zq8Bi+*H2N6!r9og7>^9H~dGi=m-#fhT(dvSv!KDj9DO0{D*@Kk>Z0-j8lgesK
zeywUvc4cJ|=5+ZreI{r%wq}4A=zb=K0>4%5YOS5`n^lkede2bcwyNE)O|7-_IG7(`
z5Cx(^cXsVR4l(6%DC-~49RAA3Q2VBV?P~?sxeSoJ_RI!+Lfu@jouIon117|xw);Ts
zy~$iGzpu6ajV$C6<~;IC{M-Nk!fa^?YOTs@Ccl*}Tz)ItsQiBaVf}xQ3m%_h{W1O9
z|NoQQ+Ny-vT0pn>sjz@fJ!xlFZ~0|=8+5h?^RW<y=A$JH&Bsz0K>I^Ma}yW)Atw!j
zc58++ShIa+SOyB~00WN49<1N4wL)xVi$u58{|DIC^Q<2rwyJqDx`Ae!;u|!#C$q5f
zf!ZcsA3$vr&<th+10*b-g7$(O@c*)^HQ9lc<8QdK(w9G<H61>BwZ7kQe?y}tWY@DW
zSIZy972p=fhWJgZT0rN;Lw83rOfXIT+N|F4=kY}I|6mmi0lJkpC$k;-0}0t<CScJ6
z>;HpGus^--$%mgaiL-&qMYhh#tS*1NTHk-je*+r9hU}Je$^y-J$T;HO_lTY<=U-G-
zTJon9+}eTk`NW?wF)*vOO%**h{V5Z}<kr-wdhLvAjqZvITGf+#jx&fjJF-8Xz3iV-
z$|UxEQ#(?TdySwrAY$LlXH5nZ)w2-4uxb7cUDfjb!2e%bouD19t6CxAZ5nE=?*kNk
zA-rXppcPo}0~CBt!Q{2T^4`6!ey#5V>{oD}WORkJ96@WyLGxV@oo$~XIvYHWZm$jf
zxxX~@<^E(IRs%?GLO;_RqUV@A#7+A@YIP<%v+7OeJo0N*>$x_F>@zt~T7UmM^dzVc
zB<r3W_MOYnee?C_OpWTwYF~a`Jby4ttE<r))}I396J~WUhGw-c2I+h4jI-m~8Kvig
z%C>gK*`n=?(%0G;r6;#B%$8_p0JYtW)1EOJ7bi1retMO0^N$Qh<J6;!#uXXh(hgL5
zgUSx$v^0jz-@+I-KNV#(E)QokPGw~T^|eC#ZuZ9ZGO9JIf^G-)yU?ngEWxS(a;G8J
z<1@d%!ThjH1RN>{`fn$mWL7@%Yp#3pm2{qs?#98NnP#&ygZA+Jx_esu9utEwUtU?W
zDj$Pm#`Jqk43qo#%B-0;gHM4F=HU1s<0w3xl}R}4IHUA^@OT~g%yHxN=Zv5=t00$#
z_HX{q&R90>X1~m#2**}cL)O{xh_i|}KmQI^3Gx?cT{}DD&3;e`D)X#a?dbm|ab<;l
z4B%6p?ze%$jKMhlJEL*EJUA>Mwy-gVg3qbB*)Q|#@yt}X58F5(KFmLx%mx}|Jo3xe
zJvs2ZKp;4#95Yw7FnVq0{12LY`2dPF<`pgs%`1*DOmJad%)&6oWA@Yz#@V+!7-!G#
zV2~E?V3dyTV3d~cV3-}(%qR`2i$t3lXA3to%ob~7oGsMGu=&3|qj9}G<L0NOjI(ca
zFc_z&GfGEvFc_y^W!(JPm~r#7V~m?W88Oa|Yh##wtDR9AbgtICc81MQzcOzAp}`39
zjd6trqjYdHgK=spgK@Dk<K|~!44ePyF&fv|L1H?cozXZg4BU1!PEBRl{OlT|aoRD)
z&EM4-n?#w!o5W)K7$-A{Hcn(zyV@Js`+mc_O{`jyPeJj2k>#=fuMgPfZa}3lXuaKC
za9-Cu3CgRW9UW?Kyk0O!tm{lZ!OFC$h4+|1l2#|@Gu{OgG7ho`o&%qfa6o=%F8ov^
z*e*6iE`;>qKz%^fgCJAY-mrmJMuPS%Z)#yZ2QqP8r&$;0GgGjsvWFn1+V6Vo$@(vu
zkBdRsU>4FTKal;)ptH9Tb|A!>8j^WfMUqdkiX?NeiGcR+#Qj0t!IK2vzq76T=^?w`
zkLN-AMjy59YSHR?f8hKot@gr$&6-DkO#XTD|EihEHKyDLvtYUSpwGqy?+^5^@I5Hw
zC_ST{5!9lWp56}bts7_DU;w3c<BS&!pj>F2@q>X;1GH{S`1*53uj$FJc-WJlzGO>|
zn85beB)PzxUB+3M)14s*GSUs*{|suCVT_s_;QzU*_fcD1TTtt})_3iX@AG~`?0|5~
zLfr#l*9zK6G?|^@AgB-aaKEy`UPfglUPi}MMP5*=N|=@PLox>k6X@(NL0&;l(AjRY
zuY%Je!`VLLGBI$<y4d%!|7yRo-rs+ZWz_#Rx;sMqbD;gauwA^6eZ8Q)ylH>3et`D#
zD%(8ymdwnm2AV_C>)h0ne3o5hRp+*@_XqevXJk0BDy;&I92rcgS=F5!u|Neh^YY%|
z0FzdCvLma?WVV(ckkXZH-6@c|1Mep$v$87fZqH`i-9DX}S-s^4XLIuB=L%iyo7uiH
zC|g|lmfXc9COku%!7<fr2BRm;e>0qzBqy@LMnOR1{%89^J_D677yChH1%t{L<Cp4;
zk7u*}bxarLJ@UgGwBLh^{R7xd1_ec{dXr-o2tarnDpvI*yRr(rf|mYlN5SF;-nUnR
z#?XEw$9&)so~O%T%zTt_RV$<06h|hpiLBuE>-{#y+4I^MHa~yPxcOfnxXc2bfwTFW
z8|a)C@y5xqeUE3R{+T?Tmud3d=Ztw%wdSpAWptk6$Rtdx3C54p86M9#`ZsTCaw8Al
z<QX~)t7bI1i#Sf6%FZMRcE#*_ZH&@jSAfpxfw|&1Bf=GD`yWe){!LCl$#rUaa>+L?
zW9GvSQZtn|XfZ;3%71uO3+R5#$APTxn$26j?>wE%%gqKlt*DEei`%%XoY65gXm+E!
zImdqnPzqyK=VAb@MHl2kj|DbH)L6LM|5z&PFSB{ecbUhHE}(tiZk5X_*{Yspxn(cQ
zX3Ke01KRhk*7~djwC}soedGQ{_mlg-hTPmQJ{7c1^yr%R2KxK9ZlBE3aPZ{z<O8e%
zpjsVNr-MdAL1TVV9~uOVI#Um=>MA_Dtz}my=mciaNz9CHdR^~7$X`x&X60!%XZd~i
zJm~IR*Ylv$_CX_Jx1h1TY{eze`4k)EUxLce<cJSUqM)-8L1&N?n4fAAX`G;JG81&i
z2Drb<wiIGg{S&ZBQ6HFCPZD!eM{NIONp>dCdKhI3OGeD{8&Y~V9DKSRR4z6(gdPNq
zOT~Rb9+!&x0opOwAhE7H`5-HYQJ3jCvmQupTQ&zY7Nym_tLOcO`?pqg8G^^4lH)%x
zHF`F>2(Ea4f$uqJRBGj%R+U!G<jY@}j5}vBfX7`g=-pe@?$!G9e_H#aHovxepgYGu
z{NF3N0OStr<3yl+cBP?L!SzgKq0$G?>U*^};IrP_KyBA!<?lDtU*bKuss$Rqliy$9
zyRX$YeJW_I@988^f1>Y}<WorL&kA054^g>v;`<AEcVH@yP5`NVcO9Y*H2w~14}xYl
zA#<Csy}Yg`*L5ZzW90(vPBrSh295Ky-c>E{H~c@T)#V6k;r%{&9Ad}Qp7$5@uEFeJ
z?E%eUuDht!rTg?+n>g70Zb{%i+Xnk%mSCN{?#bofSp?mao1ZfXvVzXGBPPag_JdAU
zM9iW-%7UG|QX2Jkd*ne-uLHE^1+<nc=tTp=y3VBsl^3uwOfLn666+zY&i5PY*Q{zy
zc4K7$?YW%)a#agxBvhE|$RB7A<3s&>(8#A(YvcR(ALc*j1iAJPXoeSbR|;sR65PL7
zaR0@smdD}fBcY(41ZW;25~)sSkXYBU^(e#zPj`Y`5WghZgOvp|JAdRaBy`d$K|P@Q
zEzRmj{w4=~U{O3M;mGI;9-k10j!)pYxdK#TBhCQ>#bs&e+5Mn43uH7lv~bZwwZCmo
zy?*+A4f+`NHtJ>E)1-&b{=E9}?n?vb^e;@Hd#X;&Nl-S}@<rL=$fx8v?0i~1imvYu
z^lk5Wkj&1imdwS&193g;x}?_k8|r6(=eC8CTHi02e|1$CsGOM04jLKy@&!D?X!GTh
zFel4*X0w(r*IJWW-+zd|75Eaunt#djXtP<%XNa%cvcaMo{)5ht<7Wlk((^4j`h#4v
zX3ICf*7pa_Et<X^wEBVF5xiI8-EtX_Xx>8jUJ0<Qy4R}dbCN-$m&v{CQlPcMliSnx
z&PfK1Eq(d&{=&L7pmTnN*%er|dMAJX&YRr)oTD_fcLCV$1@UKAbv=$|{nBj0@&(j)
z>6;C)^SCA0&L_*oK%#oHQ0;u~1hO-^m0bk1A6b|^eVa%!vl+{0M%QiAC6eYO-|Uxp
zv@U@!<yDDS<*G`qs#jTF*{ia-a-P+=)h?^e1g-u!F2W$pp1=xn(c_uVzcC+IVVKNr
zz?{tcouT=-3B&C6=YJ-Dzs}!zd@_3i^J9tcUncraX8pjL{A?}b%<Zkbj~VxV-Q2c?
zk@+|q!(++q|Ae_du-1A%{<iirNTiiFncJQ5@&C0SVQN}=A4|IbfBbFjM@Dza70KM`
z%&hF2Szj`=@-FVb`Y-wOT4s<+(0cq+osTEF{h!Rv{&RC%JA-lq+dtR)lQ~(wTP^^J
z8Mn7HC^NACo4yCMs``!k<Zd1j#RUg>9(UFJY~I?#09s|@*O&UUc_|M=vpLIG>FZw|
zrNfsq>du!APj}#Bx0~K<-tyIMI!AJ=`{t?J8BX@{JU$7&d*a|;VOE8MFF`Z?;59pi
zpnD4x8r|N1h@S$RUxdv)7N&21_LWtb9kgzUP2l|p`$<?-eEY=&Rl)K8gZu<c6(Cu#
z`F$`sP&o)YQKRh%=*$I}D?sP}g3h6v-@U2@vW^3G0tW2-3s6Z3EA5`yfoF;~_<skT
zE7Itm9Pxljl*qdhKsj33<|hNptYvQ@X7zspnbk_VSq49uU}mM6LCiY;7GxF~?lSqw
zB)DDl9Au{e=$1$Zfpsl&4{CMt9{d~nenb3+WOr7ERjr_tHQs-Se+`-2Wy%Dt2M5)C
zN1=B<!{U+A9Tfil-(cZicoI}YgZ8we?r3k2X!`={mp1xL?*h$JWxbrtedMQjHv@w(
zxAt>EAJ8n2Fem4SwVuyf!$6~U8}>h6)syVV%5kqPstq(x@qR=9z0!-I`ucJGpFhIa
z)g6@ep8V)+ejM@O&tLP|*Tot7*f+9IW^-k*n<}~BG4Iu1Gn^J;w3XeUtu*6ub<kOd
z>W}A`|7CT>U86I)UfmAr<0YSBH30eS+!ILK<I)4zZv6&{O`XXcY<jC&l37{xgt?CV
zR90YPxCE^=({Ac@zTfcvQZg&64#@3-?#Tt;btc~exjy7)XLE8?04u`vju{~Ln=}7s
zu$u}RfmrJyxgfc7851_2q%lC+o1h)Bp!F(`=ZODpbqCdNFuS4SARG8kH@buGQ~H@4
zM*MwB%8P!&ebFWe9&gx?e=M1mRRZLX<iHOS#EyY0FF}};#s@L!{6VtZv<zXA8#lxx
z{k;##@!bl9NotVMlnwnml9|B!=6@!~eGrgvoZQ99L~ISNyyqu_a66~awRYtV><r3V
z*clG8KbHRfkI`!~cgrtfZkAuRK0$49?YAH|V|~z{$*Ps?&k8DGe}VQSw)|o|t-RqE
zgYuSF3<tR$OLzTk-rmV{@iZgWv<Yf!N?-rQXw4qZ_%~cST-;&uHFl=tXU|wb`?G|v
zu`?#8Tm!M07d9t9xy~}zeGyx2m|#<K$~A_M=9AcJ!#Kh0pXOa`$%ok({+hSCZJzdx
zp;7(uuV+tM)pu^4%>IG7Rek2xh0V#&t~1<qKe&Cbd+q+W?iaV0hVBKo#+QQ0riSF>
ztS*U#N}s)6vwc^4@Ao|D@wI=qe%<@_=+m=zuU@@-#vpCfnasrIw5l_ipVdLHOPGy8
zq|p^Lb6s~(n7!rMWHy#(pgB*_`Q7J1r#aa*o3lJi?qs)PHg9>B%*t*znd`_?P`^dl
z<R!dJefAbo4*Jh+RzLDIIr0M&aj6l#Y)+dGG3WdYLD0FlPX*nRlfR3>N?W#<5ZU+B
zAhNtZ$+>@|CbM&L2(xpFz+zf?2Rp+<_Q#Un|H1UNJ%{MapS-F!nVr>uS^LP-weHE^
z(s_lWwH=a!5_k`0F#0n3fX-r=+|BW!dATpcWD!{g<Mt(tpfL;3*oE}8b_US6#Wd)+
z1sD6~@8yhM)35d`D}3i@Uf#=atxZ{lokJQj#=$syYC8jHWyMsmdfz^f>Wlr#O5Zsk
zZ8f*M5I5;}LH**MocEn&bNdp;F7{K?l^3vcC@*5?P+r2$!K;%Tn8Uo0ckT99Q@U7A
zO;KL*go9UyRW~^-hw-5MM&8Ggf4?xg?kbQf`IQotxhqpD>swV=^|orUnr}H_x!ZDM
z6Pp^qr-(dx9QffE^D<rrMt2cMLDt8e$9}P@Kc4;kU*`77H$Wwz$kWc|<Y)nm5)iac
z+nnz|1E>ttbq1AzSK(!#bZ9#xXyoH$zj4_ycxetATWwT-JSY86tGlwoPo~+|e=zQD
z7iXM(UEBe*zGLH78Ao&O{|pDSLFbgf#<vioQj@#6KY(Ve%faVd__e;@;D7$HKkJ9d
zEG*AKwIL{V{+}=S71WmGzxr5+^+U5d%X5%Tk2~4#F{dAS&Yb4*yg9Aqd2>3;i&j@<
zgO@DIN;{d9O-?c?Tij%dbx*GPF0@cw+2$uxvpLI4SW0<zSlQ$!3pi#L%>VG1ne`U4
z`jMxP>)+gvarA4&?pB05-*0$-<gpLyvsJBd^Y;3+zF+YF^<zHPE6r+0p7OdsuDpH)
zY!;|r4<C&KuNK92x7ddB`yV^AK7#pq|AfaftPeoGUVrqlIO_wDuOClfzktQZ7BAV9
zHFmNn+ni)kHn_<a>z-WuooS)CvdK@-c*;v<o1bhqH^SYy4dUnchpT!Y3$mVb-3@A8
zlx_x*O${JDrJ<F(L7`O|8o4|994iN;W!DD1A!k#I=b=@dwr7ReTmDRDWBJ4ArUyDX
z^l-8pE6BD#TMsjvxBRg@Kj*=WCzIKZ{D$O#whiF%w*~)ig3gr!jd&1WYRq|oyiy&!
z?w7UUAn4Y$hJ#HFxLZ{Ew~<>^^FQNiQGrGvA*Tp}P89@=KC(T%^Z_;k3A&4QSLePi
zr*5~NUT?uebG?)OIaQK-SyYm{IaQK7xm08llH1r-WKxow*;OPDB~NFQ5aw$6F`0+u
zM^O7S*v+jE_HRsfWmRf6Z~2kj$gad}29Z_XaFPL3`>;aJt$Pr^9<=rutg4S)D4C5L
zR8Rd-Hu%ku%m(TewER#u_`@KR@T^U|3^caE=B>Pdok1oAR3n2}?-$%ZoO`fYo#jWb
zTk_v;Je}>z3SWM-x+P!##&a-hRWE400He>}7{t0fVcrkypi^ViTANq;GJtMq1gHIJ
z?F<)tH-Ae5muXiK=a_HE2d#i|VPyf$+n#S*)e5?OAPCfMd@%n#>r2qthRLaSnPyM#
zWSo7qlTmtFC+IZpvNXooH#-?F_HX_f$+-EsIb)-Ga^r8lW;K={teOjXXJ7xuxOG0L
z#CYue^ILM_9A=pWRvpj?o;A-LN96_68E3QeFeGPv=aETKUeM0S=n5Ludsc#NTn{v+
zr)<LVL)n1k$HA?Sxw)S`=Hz+S=mrh1Vo*rEUr@jCF(2y_<amOlQ?_=n`~&-o$*!RE
z-11}XVP<odAIckEg5wDkqY#zPS|BRtp98HC1I5_N<6xBruNgpbv~lmY_T<lZ7@oDy
z?qO#DvD+9QwM+M~Gk``rTh*0qzI<ccZq;ME9p>6bcSiTb{iUIz;QHNifARrVF;Ln(
z1wQ5S+!xHzajni|PFA5!oylx$LRQ_$%<MvDUC9k>Lc;7VKPI!W{9trj*Yf^>d{?pu
zXh#^!kI8H;-yz}9rVhFz8RTlvn2fT)FNXIE>=&%+1+5lq`OXU}K|tqG>3sRd>dxqs
z9P*vZF{{yYJJ)~E8qN=sxsQCG%=3X=))$m=yjq)=V4g%34o*3s64M=AvcF$&|KqCG
zR!y(g<io5i?-$5FUey{0I>YD;D--A>#o5za7-wH=VU(WU0zQi>oN@M*7KWSso4>d)
z9_?>bXMD-5e&l=d(>Dyslb18H>M*Ofd|${rJN!H2PDsi*{qvi$LN~#*Q5t#_9KJ92
zgGQUE6~^a3V}`MtAZ8f<?<6&hc}WW6`L~h7`2HE>FrL44V8R&E;{}}}0_ySp4F!$k
z<u`&(4_(#D=)SCt(ao#%{e$)Qlf76O7+q%`!7QgCHBbWwWP}xTTBp|!(5OPAi!gV~
zZ_ru~&<G^B{{0O;k&_F0=Ej1!PmHSX1@1r4>Wpf?*2d@to_l!k{>Ebu)<4arEWaOK
zZ8mTD-RtJndiOrFS*OQ)f&c$Pe=;BQWMDoX$<TbPlA-x{CWEv%<R-4jzS*D?h5KUr
zq}kY*&Vgo>3>-37wTqWBfX;~!czl-q+xrc1KS8USm$gnW1FxCmgXFk0e!tfD1_z8_
zE{*@Vs^xJk>leg`EM#XQsD1;@GD1#3Yx@H_{|xn%KxQ{r24?qAhGw@?hGuurEh{kB
zg@WA|+qbS$nvKn2RqLvj_XZB}TAj%*tSpmRU4E#wzF(04saf6ShgN5+y0X%jAIa{l
zOw&U_BfL+OL9+hmv^pU%195emIY=~rQnE8E6Qd_&j__F~`V660D_bRKju4{9%>-OB
z8aViB^(OnXYJg4=EWC6ui_vF#4QQpQkMZ<c28PMKzIQ=q+=14H3v;*pkX+QfoRd+|
z{Z<=#ySfxyl7QOP;fxpiFSSB!Ni$Yf`2zBhL4$1ba!(R;x*5WBK9Fo)-bsW`ka~!%
zZF=B!dj<|-&C5?R{(KG!OTunO(tif3UkId=c^fAas}3Y4CU<f&`JQ_PT0vy6z!H37
zI#*ij`wewhK&k0jTORo2`S%73_?nk@GLT~DF<FS64BXAjPcl62Wq$!0JA(QLD(ArI
zxfN9ROGEE>2dyIy><7(0gH~FEGlFhr7IcT`IVKM>59Fu!1_xOG?$zpiy7@5^&pmLg
zPvC#Cs`Ifo>z&CmJWL0(q@{Ei#A_KCgn4uSLSp^x-^q7)m|!u_xB@)4F`@tYs?Ns_
zthXB7vf98R3;eg&UVPX3euLfK%D++Vm!R#PHc7Cof<b{+=VMRSYmIK8aGX3<jbV3t
zyW`gRAooMl4})=88KY-^U_a<=N{~-LbLe{D6(g-|kEh=G6S-Zh({?jxYzcG@<gz#D
z<7Qf&uu|mTT2LucKZn`PlY!YilA+nHlA+l>lL2&p4XA90?1SaJRiK>5bPBZM+hBou
zvI{F0BzLjud4cjCX#C%cl>@XBxc@5nWKs^$xRo$>%g^ampwYQ5p6S(~m7CqC#cLQq
zrv;t?l^5Xh@g`($W#{Af56)i%-G~j^XXw>B_w@S({Y#ovkNjNK13HJ;e%7k?xYmis
zlUsQhn$=r=&V2oTgWU#D8d}zRuPq65mZw5N7O2*LKSBS(s+PwAtiN!N!ofxxA+s2&
zi{F2!Uk)2_M3sBG`2C0dOJQ=Lc{tFz3<iltS4gT!Te_;{{eu4s!80Hn;MqBF3-;MO
za0xTR6f{Tpm(?BIfBlmj{hh@zLy(ox4KyYP>W!}TsEw0wWL1OB{(|l#2kk_FjK;xM
z`8290PZ4KSRyfMYtbXLLBI|5K`@rejAIQudXr>3|Dz@1m+vm?%)%rM`^&3K7n33_k
zvO%MPvW23)vWcL9vdu(2WfMbvWdlcjWt%`<Ws5{zWs^c(WrIdtWt)lG$`%W?l}$Ek
zGw>l&&Acv9s^R}B%*}FBn2kZ9(REczRO|Z!xh0@c7-b8VE6O%3SCkD{t|^<aTvN7S
zxu$Hxa!uKQ<%Y5e%Z>K}0r`!tt2(_}-wRwQg{M4MXv%}vNWRcAU#kmL=0j2*1A|si
zvJ0ycB-UJCfYRIk4_ZCRZmep}+gjWjJv)+;nOPNDJ^pb_?&x3^X8ypexS%8NA)DsW
zIa!;(i!*-xo$O_-&%C3JA-RuJ;a0ma8_QKjcg+Q?>a1+ZtmcY6$qU&Z&tm=G?8?UQ
z_}kKdi204>cR=R&{!MP?l$y-Wa#`8t%Y}pKliS%pC|i8FFqxg@lCsU0bCcO!E(!Cp
zTy6Af^;Nd`a!z*<vuVpkwf1YUeExJYD+AMe0sh;}W-S*Vf%20=K*p-pWFJ;OWrHOb
z5GB~N$6l@P6#{HQcW^PAwVZD@Wx0@i)0cVnwI0UV(|Z`Dr}r>i?T7Zd`<cyIF3!Hw
z!@z9Da(?rlHw>GfPiItC_;LxkWn|6@y8RinuLZ37N(+N9ha1Dso}>LThnme>E^MCu
zmm&E^Ewk`-b|-0xc81wv?ToV{+8K>YSAcg&oa|#ZWw{6%BNpapW610e?T<JFDqF#0
zOVisKF7}zT{bwlbzu5;i|9U$EB!?Vp{@H)EzuBziyfu3jqqMj>gIBAv!ViY`3I+PD
zT8iAPyvd!Btj+Gc450MWY{Jc;Z1Uy8dw~l+T3sNK_W}XIldrQdO}@k8w5q#N<?(gj
z*N<D-Ux7k)S$i5hY~9X5!q)$2=vGFbW`jlpW)nt(W|KyJW=lr>X3IuBW-CU$W~)YB
zW@|>>X6r_sW}8NBW?M$>X4^)sq*i7dMjc^BM#H9t$<r-CW3N9ax3m9Ln!aed@&@*Y
z$_&fzv}%U#hWLr?5ZGl36MVFK9(%L?0JZpFeX(Ppv$hmAC?-3za?B3zVw4u|Vw^43
z#Q>@s4raxIcNxtN?*i{0gVjR9Tr8Ib-C?zX+Fnq~P}cZz>Aix1ENC`*_VrFiX;9yD
zS|<b4gzKFQFx{8hV0BpAE`-hrl8?h!&uR7C-3!ex`=RZ*o$m$K&lTn|IQVfdqzwzY
zoe^4|pIz1RenS0j$UO<-VW7Ua+Zj+<a{e-WWwOBoVMtpRG=~GbcZ5M;dMc>BmFl;u
z<^6~LOAsDw0B8m9`img4ehr9}-vL@}z<&v9-!Zk;_Y>;3pxAd5Y~L9q`*;xcfmYYH
zx-)QWp1z!+c*F7<$bLtVC<BL5ia9G2185~Jg#Xt)`So&!R(FWn?KQ;<rq>iNK+*%A
zRTQ5JIt?xL-unsbzQf9SnbbMSo!v7ZgJx=A^}+iO@_#|{kiCU-Qs*SMqN^}C;D=BF
zaf9T^Rqd?q!mJ<olbfG2z|PiEN?}F1t9N=i6GQWI_wd^A<j&^|N-4&z%N;=LFhD+m
zsYKK~kdRB=1d6Hq3zEZGp=<s?<v(-<0k{S_wgMEk@f&h4g6fQ3_s4&q|B-P7)diqj
z3u;l!p4QF~2wg=G+J7(&)S8&w#`fWB|IL2!awZ04h3|fln;Rt`B8SBE>7Y6I;{nWD
z+uf&61+8voeek}3{}ICPke&_b3=7a1@IfCyyWT-#YO6Z+I^SQY?_1R(2;TV)nK6aU
zmo}TT{1Ly!1nP?)292vJtNdbkKjHt|RV|ObSpR@_FSYyzjijD`wW=laBdCY-Hx!Z|
z+h+T<LVElDD_6B9d$4i|bGH0pbU)R`=mwg9j&EPp;`kGEo(W9HvzdOa$`+vU0sUp*
zb@*%u)%7i_T68~x#`{1g2`SsWVpw>($9XcF%WsHn%clFazMrsvmgP}qb(h}@-IImC
zvk-TG(d_B!49W_>m>_9x>Dl)i_%1x%JDH`y?(E*LA%C}mR%9)Eg4neH+JV_1F#QT>
zO~#Rpa}qj_x4N(DO#ZT*;eEjQzUJpFOfzzJO`qY+2tHXz@HuFgHt5Fc8HeX&2zRk_
zFl&L%`%&N!t~$k^EX&2xe6)q3BSDz+%P&^<Q*FX*3e4{}oWC6Umf8KwugU4`Jjqiy
z878N*b3oL=)GTKI^6UKu{quoWAtj0GBuGi3+V!46{^s2MAX_14n7D(_^$=$Nz(2X&
zodt55i>5n-7G`JQnsK;!7Yk!zCiqm6E-nsXPR^`eZ_wE!&C9tMK>NTII3D+vf339y
zo#Aq;mDBb82EHGUg*g8OwL$Do?S|O>wB<cR{KdD>vW>M<JQdVeZLNFH@c;Z(_=<t|
zAMPJSq)J3-2kJpGh|GKfDp%B67o~tovR1c$Z01`JG4`^trfp{xV6b9+FR=eONX4oa
zm>Ni)M%~@bcy>1X*Z-{UjIQ82iC91IL&_vr&PCM&T8{);iv+n(DCh+!XSDobbOYbK
zbm9CRP|g7DL}01}oxY~lx(IycCMe}Xa>lF4pjE$+oDshVkuzBSfYuA??}X$GmOqdb
z)_NM8D>kfKS-Krkf-p$1ec9H+>OPt6%is4K__uIAZFc|i7j*g%sAPcTc4+<<YTn-N
zj+XPmxn1>?UF-V-{>6e%5n&679o80TJXF4CsNar|1(gTLtI48XG;n~<F`3-{ysddB
zI|K8|c8260PA1{XpZvmHUw(Ibt!iO)zXTp-_G?|tAM*SC2L0unXCbwUYCXi3rKRr~
z<Tt)|u)haW`ToQGkA;7ky}$f^EFJy#QkyWF00*cfdH*5)L*Yke_b<OEvkS02mi_+g
z;0fv0FaKNJA3t3F2iYc;U+*{cFJOH+neEAMS2u{>`EOVsHoHIhE&RQlLGtv&*&y{0
zxyAgToY6lQB*F+*y_g?lLjD}xuM^!tqP|d3kUIX^hCe5>H?V=kEs@0gXPWK@i6NWd
zKZErvNDQVw<@fsy{L=+Nr<;OntyWh^7^D`yXE-1Q3TaSn0jsO#x`EO#6N5P`GsAm<
z_}MV|zvZ*r*<Du72i+H5>z<r<9lZ8bJe`3-nBBc>^7Utopp!2_w@<@N(t_nXXv{v%
zdCw5Pta!rLy-f|p6P|*}t6=gdnA{2`mx9TuV6qiVmV(JtFc}IaUBRR&m{bLmqF|C0
zOq%WinXd{aMZqNNo~8!8?k~dOesH_wX(c4Qo+i9!h@Vxg`T=B%>H{!&0ZbkMlN-R~
z0x&rNOg4bY0x+2XCIi5v1DG@blL}x`08BD~Ndu6ZRTaRb0GMRh)6@W3d)M|<?JxGV
zcc0Z2{v;k;*M0S@qkD3~b}n;v28W;h$&KtztU0W?t6H==8+}3dTIlSN=H=bnY}v`c
zY{khix&7yV<L91?Kl_uPb+Rvg4%&xq&ApfLT3c`T%JXyGlYeaIG;3A1x$@=x2m3e7
z=A4X^zt=K=+P2CTOTI0dE?oYd9ke%6x#9W0W>c2$!ckfblW$rwn6>)NdjCQGZmm>Q
z>m|?$g?FM_TXo-m`2ReaWfendtm2Ahbx%fN&Q7L@hg)?X&)oezc^VHBqc8SVZp&)3
zTHV0w+$OW}>}lN(DP!8tFz;-4pFJms0p1gYjX}VBg0L|N>$Wot;C`S&gS=MnV_()E
zli69mJLW2zfL0mug8E@!CbPSIQ#JtcSwMS8zc6|!+kE*{xCq=@7g)f)stdwW;A`H=
z!ocdzyt{>A@^wz8$#*!Nw0asflS9H8lP9vPfWpJCT|5ok{&fWPE8<$;Gpzsr3Ou&|
zUV(vEtM{=F>xVf$$uroM?)W6nWmlOKF!l6w@QEYKt>!pCp1}SN+?xZN!Djyo)YlUT
zNJw^Im1}huKMp<@$3o_Ct9$a@aAlmmy06e)-4{@=4zx}Z+Ozuxnu(GI%|uP_WZ2I7
zpCPyZWdBW2KkzGPMoO63jbZc8mkgjeDVam9?#b8NnJ0&HJ4s)L>^qX4+78-t13u@z
z*_7ogsO2Zj+{W;>|7L&8A?dJg#@XWCjMC!W3>U%eL(tu_%%HV<(cKKMT8*n;Gi-jI
z&S>2Z>fNX_K*MP%s9*P);l03zKydur1Fh==&j@{C)tcPW!t}Uk*Zn&lUvEQ7ao0DX
zJ=*)fX!SN*w|sdV&-w%$Hw*!}(D4C=3&pFtAZD|@2FnRdDAno(ji*8TTi~!gwhuIx
zu)z!5-@4w#C_TN4arU$>2GBkQ$81n<sf`hI<H+pmUEm&5I^)g$$=od81>NtpK}=VB
z28tbJjW6Hc3mCXz>u<F&&W854K)UaN`deVT+a4oyPH=i0%X&krmvJ*F^_*)@gQlNj
z((v?i``~6sDa0!KenDIdX!L4&8fY|~O$O4}YO4g9_g>(F?c*@kTUx!LI}vH<*dvIX
zfX(A*kUfbzC$q79Gi$rMyE3+LW2<|zz*mmX>I{D-e`lBJJq{{M9MgaHPdxrveL>CS
z@9Y9opEJ6GME6dfd|aI2WxvcbP@Dd<x&T<m*UKO|kdBAHAMOXWlt8^gVb%avWs@WS
z-e2%L&urH6543k1qz+-mqXefE$SLQbc_&co2C>HzbpC`^=VvVjlUDcS|Jxb<h8tg9
z&cNCUYTv+iS}p?bwG3+o-FWg|;rt{<ujHr&48>Xr2FY!l44>5#5{#>UF-$yS9Hqr5
zTq?zIaeG+ndj<aqtJ)b|AIE(7^;tbZ0HgwR&!f@@uNR<wlYUPaBv!Q<br!2Km^5#1
z6%b|*NSJ(cJHy<`lYd$=O#ULyklgvq>2JAoJG+DF{93o<<Yx}E+rQiIohRMS#_-cU
z`QdXX(AmV$dQocfwdahxrp<BMHNC0*y}<snlf$nvwst2^Ww!&}vQ_H({=@zc$$YFf
z#i|!JDjTfCIH~@<K>ex7;YUGwX0uy?^c1?j|4{!nnT6G=SoOfhkK5l1#GjZP{*<A$
zJ9!qn1xSUZD`>T3GBc}1vFd{jx!d0h*dLo5eifu*Cc7C(g{kZN5B4vUnOMz=RWEEv
z1l`|zWODdXkct`XCLk4tuJ1p{KTl?4H7Qm-uwm}@_X7V9P7dD+QZb#~2&6*S_5Fwc
zPm&o}jfzz_Y?!$Hy}<qb!lkSZ$>OXAAbCxY{G((BR)b>I1sg;`@_U6#SrwASS@l5j
zsv!9X$qcM|#i|oF2!iBy3zxDAB#X1^faF0ZhyTBq%)qKstlF^Q>elxH_jd}HvT`Jg
zvuc6lWkLGyBr~vT6{{9(xCoNpE?mmWk}S@u0g{&l$=^z5VAUvAP1q0$lHV#^%F2{1
z&Z-8I7X``RNM>MFD^?BI5D1dr?AVzs!Kwn16$JVJdNL!cO0lZLhPhkc3;f@x*qJQJ
zssxhd1%=<$WF}UnVpW3;3%7#AI6>xJPUc`$C{|V2Ai6iXl|||Og1AGvTi*-VubUkH
z6cmRu+2ufLD?$1%CNr_h6{|kjsJQjLfczRp)nqSL8IWu(DE`hTGqcJRtA5z{cJq4y
z`&E;}Qz81LKq?|Z`p+gau}T%ICTx7T`MrSripk-jAQdy%B|s`dLGC}D%*ZNHtQxQ}
zcJq6I|4S!_yMk0qXBPvh2n4zJL^1=bSh1?Z#=y<*1@14N9Bv9yF^ydWq{7$r{fGO<
zlKEMMid79Z_HKSJuz%s?a8;0ssq8`^6`r8<dnB2URiIc^VPoUw_X6|hPYxFashGkp
z08-)V`u@ZGL&?0Xe8s8)8!dOg7pR{*Ih+-wVlq1)NQEOPJs(KsVdW`SW!U(2C#cOi
zIs7X_Yxl>;AbDGm{65#S#i}1R{M`9opnm4$@TH8c-FLyVnIQA`c%Cg*U9j=s#`gmA
zr%w)_%Gla{@Ht3tD#(4iOwSgpPT1(X@x8$QsguK78C$#8f@Kpy{@Y=Bwpg`cW8lX3
z0{16R4liYF?cNBMjRl3zHpPR*ss$V8ZhSBBf8ylut&FYRbHTE?pzz(wd$3q_!^VXh
zi`5)HLTV<}$Bb&wa{9*m4{;wVLs@r%@9_Bd@z47ObxRC)g51RjiocDe7mHOHHfU~q
zzu@0o!Htk|Q|$=@xXfwZ(kig3Em`C#)8y-07<#)|-IM1%XP7&owPWH7qt^Ee<}C!3
zp0K_p!v3Xq;Pzj5{~_+h&ya_pcK;Iw4vs`f-xAWN<avb51FiI(<J73m<2b`fnvI>|
zvDCMJN-4rqS(%u`87D^eLi-0#KxH@shc)X02aZFNud^}<v%4|K9Oi-D`Jv8W0&1Nw
zn;&1dYx<mI#93fF(mT=-=X!za4v>pMXE{LCuLh}~dK}hsm=eyYHX~nj-efU0rajrh
z*RC;IP5T?l>WVl?yQu-ygyqW#nXszWY8t8uF_8x!gK8bMFKmB6XC8s>fox!4wrpiy
z)soD`$<pd7%*x8ryt9R&*{YM_{e`-9vTygK__a1oZ#M5_(dr6oZJNF(WmOkQWKW7#
zr(f%mjHc<ESwk6xqof!%x4JqCM@lmIwQX)yb!2pHnu1w(!EOhTJUa1cGV4|bp1;Zl
ztSpe2fu#q~t<0!?eLiE?bmpDx49R?)OkS<CS=bmrw>>ngbuuxVcQQ7cbFx~uU2y<~
z9Vp~jT|r^jG@a2Elwv?Pi-1NfKx^BM?oVcAm4So+sOANotpKWbBSJwdycmzm6ejnv
z3(Uz#p2jXPCueSV@^p5AIR$gOlP9waw5BH)d>2S&;uM>b0J{AodFD4h@l)XOw|>yb
zS8^}AP;#3Jqw*dVX5|emERfT3+HTH?*zyFzPP@J3Me;OuK1R>!olFePJ3HB@cQG+E
z@8S}YJ>L;x&8o`yzG2>T(78U0s>zR*Gr`2-p22p{giV!6>^#nF&c(26dduTGA*`B@
zQ-1#G$yj@IPR@*ij+D)9&l!@rud;1s+scsKbDe|LvyO8zn<WEl+IxokYegUS6m;ak
z`D+AU&Pfn&1&!xEy(aVV{epKtu$@aaCFN@W-0sJn?C(lL&u*XI&cvX+nf)5XzMc$_
zjgKX-{s4^!fyRP%O|@%%&mg}%_G0Y*>Ff*)liQac-}3~*dVYM*3&HIOmG2qmFR{H_
zxn0rqeZ#&d$_A?#WDnj5Dcvi+3lyrWDnX(8crN=Zu>2#CyyU?fA*owI`&<@+SMES^
zw)j>i24>Tx6{z_gbcTxfc2Liuy;Q&%)Q3-ge2jr<f<!TB2kGSN*BEzAuMMB^7?SoN
zCL#2=7va*=0o4IYt+3l3cv4rjw7PNR{$m4$!FvYz>7diw=VU-am-Q$pbom}bQlnQZ
zWIqSQMu-d3vt{z99tYVDwe{aI26T7AM#GsVfX+c{ICvIX%At;&fp=dmf1WYDjR|yb
zz(-d1#>e0|+sgi7#<ROnJ=3>=WZTl_I5nQ1ktUNo@wl=9JA>tlWclMvknjNMY2Kdx
z_U&zPP>h?gzY)IH&dlnbEcc8-_&PhYaQS!s%-@s0f9G#ipK}VLhiL-r253;5((6Ug
z15nHev$iHq-vSzwZHa$>!EW#S5C6Y6uVi6NzQoA{m5+aap>7{!M9nFaDNDNb=l?~S
zpb>iJl`IT@!{?k3?*gTWt|!TyoD6dc<|H?se*a<q=f~2V|3LRMeEprw&dD&Npw<16
zxXk0y?I0TLYWwdGDv{2`2ki;f>V(+o8u9)@-4=+uSi*W78a)|ZTiwLlm>7iF*zUES
zoKr9(S@HOc6q)3|w?Sbee7&7HS>ieq%<rs^L4KdzDbB#^`thes+REcHNpJ6iZ8c!O
zb#nh>{_DRa4=S%PVPu*Bp@rE61f0Z;GeK(z)fpkKc<TTD!o77cpF{i%Q9YSmK;V!#
z=p<NW6E((@`*{z7Vs>)7yY~!d$>TH9lO?t@%_vS5J<i1H-t&CI=Na(R9U*D%=)(6O
z_Vt2BvLG`sp#BET40d<o%wS#ke!{;SsAhmtJ*ck(y0Q6vga2I3gUxD3{!MgGp8Smk
zx&sxu$~mwXGQ){}=Q^Wm^4nz$jH;mA04kS}?|b$PeT#A@G^C%$#_+yj{WQyi%n+Nz
zzp+R-g3lp@?(IC=59-su?Yr84Fby>03YwKE?Fa43NlyI6B;Cr+(0Lx&Ho>ER!yik0
z{m1G0cDrZjT`V>}`~JS6zaQ?mDJ1yq9lGEChCi14`j6H1>vqr3r`thu7N8r8f_{Kz
zE0SJ-ZZHC!x3sAf;#aqiTAg}5W?fd@`?}wMh<};P$13$VYE?@zN2p}7H!B}R)w8#t
znalSd;-4pTg-RxSu}ZYMCwG3~>vT_^_C;cH7&o(UcsJAJZ{PSAu?a_XgGMu$KsnZl
z-8kb011RM_Vh5clF*~fAQ8=8Nu}KVct^`QM<nV3=C2^RlL*gJ+Ah{%I<Ma$hMYqXp
zEWeZup8RTc?{qPnmdx^%r_()I=BvQ$soadSud;$~lmwkLIr&~Uv+zA`X5q`-Op|YL
zGYQ}5W}JMTo6)ylnc*7aVuoXk%8Y3Yiy6fjm6_NW7c+fhP!@j1V9h?20W{|w)CL;2
zf6rjxx~c_qt`l44qe`c$MO94IkFuR|)LNINfcB>U4R4&B{3xA!Gkbz#^1E`**<sv_
z(&60<Ab-!E*2XY9yqgi^r>p&-^*J~DrKLePTc(5N`hN+6ebVY~Htn&%*Dqj`-j=h@
zzRJxw`RiAH>FeDLv!}K)%)SmW;VjsM*nZHRnV{2V7Vd|{L)ukHJlsE*%rli?Rm<aG
z))$TYSzUYgu4-Ah{bb0*?I8Bi5L0NmtJU7@F3QO4%F4*>Vb0j>rp_oW+R8Y4Iy>XZ
zevpenr*?u)Q=ZILz{KjB{OcQ2vs*g@v&VFXW{>R*%&yBBW>0Hll$PKCpSmb5+6rB3
z(5SX|E~{(u*KG`tlDOIZI0LiCb%th-?+neZ&lx}`Re^OqXJ_2}T$~Z)x3m3?>ZbD^
zzc~Jf*_EBC*+ZPE+0C7S*(02R+0UG**;Sp1*}0s7*)5#`<VNY~ZH%*La4^mm<6sQ!
zH%=90R7wGz9t1MUI6WP7Rt<x1Z)m^m+}Z5x48~iRgJ+gOr3L5=TTqK`Rm=MX`Kih7
ztZd9DLl~KlyD&B%D`9Ltp28?C$;l`!-p&Xr8$oL;jWcgDfJ#0_&4cdAU)5QekGU{0
z9}i(_K32lid_08-bHx>-+Cf*)eEI#Cl5dZ?C$s)!*v`%%c;^Ht*TdR>k)dbz2ZsLL
z-t2yqf!XgW1G76T6SIdX6SMzU24?4{49$L~OwAsuOyIDR;{&@05@yF4jnhHl_MA~#
zxS7E?{W|098K6^m#2G=S#qFGL+`iNy*_n;QXnJzOaSq{m>`b70tdg_dvFUXrKVQmb
z-F}^6b}JjhY(6%I<ox3-%<irX%+8?<%>Jbe%^sk&o9&F!!pw}Ia0H#z12TPg>s3eN
zbaBSL;P6a-ww(#qQ`pRUg29;WC?jv5G3yP6_Y?G9B1-7O(541ZNe`L5@_GR}YllH%
zQ>R(y>}hTc(qe85p!EjwA7UReA8%n`J~4%%`S=kA=3`eFm=AAZXg=|Uq50?%hUQ~W
z7(hM;opA<=7f^_RLf~RQ$c3O72dANFZ4B0ImX07(efzKWZ=7#9AGA(O8nhB7uALEd
z<`j6f%e{8+xuFMBLFelkr(I**{38RrdlGbRk#R)^<b0bnF~;0}&{?8y`vd#0_RlzS
z=Ll-O7+cu(WYGiI?qbL-DGeOW?x4IR%DAef*~65P*;N&sJ3uZ5<t30iLAm5)f0MXg
zSL5W(tzQ^~S-Y6FbxCu!G41MnKf&+nc6J60WsP49&Bt39nvYFkU_Q2mf%*6nhS}5D
z7(wQMN{@Dii~W$(qoi3m89=6lwFOOmKOyfTXq}35SSRD`YoO8HPDW|bPKMc_G1aME
z4362LkyOwLyqmw4GJ<?19oES(`&t)+aakH8XkUeA|5>nal~rCbC@cM90>wr%C^n9L
zVPHP~1gjgYStA)6Cu?>3wSn9Las}VX*&r8)L+)?}-T!>GA9RN^=mzJT{h&LXmDPSR
zG#?XTVm`*g#C%+Zsrk4G(;~KueNOD5{f|Ir@GAUbLSKUnxg7;HC9P@!rKR^D{-1Vz
z+I-xFiTMO5R~}(#J_<@fB}||c#C$A;3FLNA3YtBY6&!}3QVSFxXZt`oMp~>5Ty9B=
zw=-CCS~_0rzuC9DU7c}vn;IiH1x;&boDDk7Y(_iygf3~&IWsfb7*JCXXcQiDLSqI4
z=(NVS{l;lx;GFulFSc)U`gMj27tqrXWKH$CH<0zzZGTREh(o%09eig|=dP~z3HO(4
zbtikX3NW8M!oYm|3Pba;FAUAcpFq}tOLl@wDo`l}Dy@QAL1oqZ33{`dkAgy1gsJ(M
z2~+cN6{gu!TNyz$50m80UeG!JS9?L~)n?x9UDX}b)~E`)W$^x<%#*vhRUI3BlMi$A
zfL0PPAD_a|d~6Ft^YJBM`#`4L?1kvP+uJ1CIPuoh*=?2#%cg#urMzJm!$vj8$$|5q
zYIQeiCd;sjG;il(FlT3AmcH7}IO8y=6$YxeW>4#8a7=IB%EbUWkMCsv$3D=F&sY05
z{|3!Zlrzpb3YsAS&6LcZ*2w@;2Uc?vbSpS)cI3`M$m(ylO33=}N7YWyd*-8B*|I^a
zzvH@p?r%QM!o+-3gsJ%`q-<$EVZzjWOofU01SC~Ui?T9;$`(-W0{QM_|HWQVP6gM1
zPgy}FFT>UTo4vww*_oO|g=2Y{8Yj-~k!E-`wNV|kmulHmwN~({y&viquj+2}eJsrS
z25jdskev{_VCEyvXWZRBoe|es9#D%Bl%7CqdFEV5YrE8H%({~C{RF>>t-j6LEkCAi
zecZzPA*l6z!@b`in;?0~1e}*J%Zb0{)~(AOW{0&h&K3uyfL5fnhmPsep{?K;sO&x2
zKj(t$UQiALmDHeHyVTw=NN9Df>ja&YP~XFO5>Wy|&LRtHeV<_ejoDp_vDt--vDwXv
zvDsaVarTrJa5}r$bF~MQ!tVAoi3qVaPFOYN(v(*4&4WR$??3#X=lgRq+XsH(8Enjx
zZ*(#X2X`_HPw!-&JhhW)vUn%6uvjOP@Vqvr&0kp=jmy{=LA4Jkw@#kX$tWz*$tXOT
zjmfuv^N$mZlc$1qaT!;fU=$YXWO&53`D-euL}P&HU}v0sqmw~6qLTrXmq9viFigJM
z$#}8fxZ(zba9Ahf!8A~KgH?Y`Wte=klL=Hd7?-6n2uF4@ZT@+a!MO4!gKs~mzA*>i
zK|kZcoG0jE0U5;somS)Z0W^*k^`L=)*^8Bt*;|yc*-Mp?+0&G9Rm-~0_aDxGmpq9&
z62+7aI%!6&^?gG8!{pm5nWUw;8KtGV7>%>C7>zSM8E4PxVld8(WQ5#HJc)BNt0iNj
z8><^A<-Pw9-{rf%Hnes-Xq|@IAJDq3pbu@}(=N2S^uRaruK$4Rl#5fX!fZ!=gX8gu
zRwwIOzt;B+^R9vRL(XP%W%xL2qWZ_#tGXK1AU6Yp;!S?Vs+QQF(rr=<;5KoC+>6xh
z%_>KJ`-1xt%bq}b6JcLKcSeCu=5G+t>eTB3-+t8n{saGuRV{*Nakrr-v$^~VYr6!R
zZ!I|At8B95*Q##Algw%^zd&V-Fwap2UbT<23THK{F{(k@y7Kd9w{tQWzQvW7K=}w1
zzo5LNyy!QBvOzba<923MmtTLwlcl~g2(!2RI@boZ^Mm|y$%Cs}TDLRXwEQyU0jZt1
z|8MwXzOR2)wXEC@iDS@6Wdj4-AFIx7ouD13r`q0ss0W4c!(=H=22jj`*8jj(|1g`j
z{PAi#*ZRJp?kc(*sP}~kvA8#FZ$PJbX?3paHUi&P_x=O_)m1H=7~uu$aezWAsO=so
zv=aXR0)>`Vx9vetXierm%5bmMn#+uFHk%bvn1N19{of7pW9jzUVO@-~#X;?aE|d}h
z6gHqTSvsnV!MN%b!{+DijLJ&C8T{I=wZ=_--|+85>wZY6LGAvqf3oXOX495mAQgtJ
z?;GwN+ldrbY=1yEmO)Y?{|QE<v=2)4r$9G1{P6?r)=b#{ZdEHUs9*g@t+mmOSFLcC
zq1yWo{~JKz2AOjN>0nkp@&{D}J>`Q|D1q{tQI{Dgza5YSuUC9j0$H*6D9Z_a)7q&v
zP`?h8>+T;+j%4Nf8~#}K>mSg$FJX}V9tr$&7*$){lV!hhuzELZ9{CMAi{xDE`-J{k
zrKXQ7R{v{0)xv;WKhB;73Qcy#&97cDY<_hM)X!nq{OT7&6ZqaOX>L!@ja${H|1X=R
zsC}!A(d`;&XU&KApL9QNXJ=rX+~UO`%;w3Uyx<o@;jBhb528VC1L!s=HBheHcx%>n
zb_OQpb-(`kwX*K73^m>E8>+e;HpT@ivl%3`I*nR4fl8SMyIHf@SQ$Wb9iTXue}^cq
zKqFa@o)BdJ8)&Tg{fGQ@l1GvIC*Ykk3<|!F-B|w-*A6%})tXJ!5mY9DPJ!uvifkIB
zrE}^7sIAlX=h_q0-DAx@t_;oIp$yDEsSM3tr3|ZD^tv{6z7LS!t<{<A$0`Dfqy7EO
z;67RiBlEEmM&{!w(3Tt<BdkR%%`M7svtL@)o1szN(LJj>x$wIP^GUS6nk1-I%8t@v
z0=1VIHNDzE`<#^3RDQny;NO?bz$(IgoP`Nivx3@B;J(K+Hpb9?P^}i&AKO2hy`9Or
zJDt&*Tbq$lJ^65^<Yx9P#^f(wm}bxBW}H2zhjH`k*^HZCRWVA-^e}9G)x`)&3Cm_B
zr$>oi>N?ey)dooe{=1{v!1p9I*iD^%t&<Vd?vb7jYU{vu2{?kzPx=5_9|CLrC@cM9
zFc<&#7Sy*?*7^mi#qVxsXAn?Uc*UTs18QMkVPrmbgpv996UOG_Ul>tZ*m}Ph2=ARs
zp7WebS&ijKqw8eeBR^C<B^NZS9{G_6%BunKuNYMyORD~7);#j#u@C1jNcg>fF#p$M
z5!N?;key)(@8@cDdj4%zKk@@~W+G%2d^;m}CCk)yhS@hd8D~%JWN=Ia-A}doSsH_J
zDJytq9i%p91@F-Q*zenavTyUxlMHwJHm932nzJ(qDr<pyD7TnEVW7Kzb9)x!W;QFv
z$3MQkDvi|L9vLYM9z}zVhl6^V`3+i~l`laliT^byW|>cbTE;F+%|}C+nopE4F&{Qz
zVm=1yi=;5Y`U;R3Zv(gD&-QJ8CI(7#;I%iPKEvI<z<y~qQ3gi!Mm1?MH^@obAJ)$U
z^_rMLJrGd(0ku0p?aX6O7?`2$PEb1&+~x$07fxkmJlXHt4>Awj-h3_&wk@>(V*k$h
z#MEhb4nXo5Y#bl8j@s2C%zot0zD}pk_X+k3MM0;U{IO=A$&mc&ITPsIMo`V9HuZhO
zy4T2aE!a!h($Jsa+YMoD3{WWxYG;^rO=fHPt<}A*b5n~|=lg{JM>LN%Yqk7No}tAG
zD!KYDf=VJ`_9MSRrBPJt`-J&3WI-<Zo%}qU8C3JWZ&>%3(G|VN2ikSYtlIMX>2_w-
zBfrmX2iXrQx8UQw3H!T6K|8emZB$=1J-Om5sF%SaaZr%;ao*Q|piqIVZ9yK<1+{KL
zt4u)W{etdfNj|{Jw5mmz^T=QD>F@#nuY*q$WB{Gq_xL*dKUk@$*9s~%Az=%ft88FU
zR%7|It_8GrT(3*3b22CB)Irc4EAIp9FN62|GBv9o`SbW1`#(lEaGNH;e#Pz<7spjo
zwzD&^B$rKPkU0o)?bLsbE}$9>)NXLfg0&nVGcwcD!Rz&X=Qt-nUCzQJ$~aM2+>`+#
znjQ|CbL~AXz8riH_SId}XC#Xr=3<4&w)?M|F5*4MSt5Dre8?OVXoV=N`;5boQ8^Uz
z-LaY<h+_VEH1j>Nna_x3K4=z6JRRh|c1H>4M)l;>?~ogLrkOK9#M!;grb{IAo}Rvp
ziJ^JhvJ)Vl=;7&UAfB6Z7dz-ydJ%6_UqEbu%q1jqvVu=TMO}N}Ai!+N%FvoF-2VN)
zapg;fRV~TFoO}_U0;!Wl*_kF^d&-!ceT}Eq{HJ*G^XEL%S22O^%Q*n*t6n|c=qa8B
zx}!PEOgx(jbZ@gmhle$*DdYQszG<K{&KXs~^Px~Nzp1eK&?v}!=yvFQs7I^j<0n7=
z^rTGYZ27hGV5`?ZF4nAGF2w~sDakcEnLxABpq6KH@h*ne)Q$wNsqY`Go95U0{=vRO
zK{E^Qf?CPQHxGfvn8i~;^P{OE?*raVVRZeuU(xk_!MmBt8&)wep1k9+@O$9?($I(C
zQ%6CwlC{urUTAvIoa3DQY&i?Wwa*zLqUyS<rcZF5z8rMhTKdKg@7b(k4AR#_!Q<Xc
z;;n9slXp+s#*kdFjA=r0Yx<_?yQWWprk_?fMt6w5=WCfJpvxksuIGwVpf<R#o{^mV
zX&KXYb`FQh?cxWz*mq55nlJ-?OC2n2P8MTj62AJ35t0g?DXp3|!Kuf4JDUQ-Z1H0Z
zP2v;T8Yi1g-!=Vl(Y8OBx*>KWQr>e(aLOzH&ScKc;ULT|egNd|=I!Z=xUkp{NmZb`
zVJ3$^XN08D<5Ih(PjCk1Ghuf2`7+5oV7Ew%A7hxv#w5ONI^*PB(;wGt`-SQjh)Iw#
z3$(68#*@*V)otf#nZ(Ir>I@Uvw@nA_zL;=W#*>wOHfYtylW+f8&ojC)x^rf<y0WT^
zB+d>GX8`RxX%as)t#R_U>6^ehCYOC@+&t|n!<54^p2BQw9FMcV|KUk(b>m2c&iFp~
zw|!NM<Wop$Y5nrvLGBZ%JcO-QfrJkv{+A0DPY5@Fln4x?U^E0qLtr!nMnhmU1V%$(
zGz3Oy2<YnSf_<)9Y^6|KoT`wSmsz5amYA87nxdeQT2z!@q@bFj$;AMYFUT#$DPLx&
zXR2q&z`*5SkeV0l<f))q%mp%7K|vutK0aOn3jm47LuA2BE(HaBh4^@d7)-Sw@%Z=}
z1%-Hp7?4@<HCzfc3N;EK0%Qcl76mY~MnMB)VU0pfyrx1;jRKNV1$B_=`XEyv%ovc$
z7_hlEAhW=xf-HjS2030IB%x3Pa-t@P2{kpIOF;poJzl>?K`%aDAIzzV2WbSWjn@ZL
z`XGHE=R!RNb`OjlU&93sBnAd>_+}OrCTC<8;0$9>c!J^~vmg_v8jyTRP7;3k%-qx>
zoGL)JK-`m7o>oFY8Q9$^`MHUic?xNnd5JlhRjCSCk`Gv2K~7>xT7FS3L?wQcLH<Zh
zPRz-{uZ$r8W~N_aZYnffA(Rz33Bu*wQWHx`i&Bdrk_rk6X!0J8K_Lpx`K5U!P!(1R
zs-;{A^F0GR6<kuwGLvDppy>|*2P%>Zki3F}f@)5wM-`Ge&iQ%8`8lZwvq0*Q<UN9Y
z5pp1>pvedLhT@eEN=?eoFF{g*raw5Nv?L|JJP)n{UB0xqAT=)qE{z^e&H(|=2uXN2
zx@8vSmM0daDmWz;!$Jt;dQdnURH)`uKodG#T`(x6KvY0TD+SdQ1#c&GbwS|@{%L8&
zsjz5Kuu{NkUQoCKs*yO%^GHoBKrs=Ad0=(OCPK|q&?w0-NzBpIfjCz|qbRjFwWusL
z1tC&ejLb_bN=?;-`ig-8;s4~K#FFF;grmXcJE0iwq@aN?%Sk~4$*7>xypqh^R0U8`
z8<tvBoSB~o2}V$SrRb@qKy8EwGBCJ8i*kkZ)RL0SymSR$&tOM|2p?BJh(ae&q5<at
zPZx+D7zxP-2zeJsZih*O>?`JCK*$FaWtJ%*ISG=!5c1#z0<s)x0=hg%%C({-H4o&c
zVo>@4RV4`h0lop~`7{N^e%}BE_oBqS(wxMi%#uow`$`p(GD{%!5vn<kDJey%#l;Fv
znI*-b@JBYs*CW7J!80!{AK}iNQUwiz3RMG(3V4Jf%yUUiDos}iDauSwPc4GDJ4K-c
z%7p|n0|NupFa-rjF^d##5CKrR2l8QZeqLH;dT9~%(v*QAG%q_ZzdVltRA0v@=jWt=
zay<hBLvCtHYEEi8gKDu3*ucE}yi^dwIWbQmFTX?~BQY-}CsiRgzbI9qBqK2ol!^;d
zi_#QQ%Tn{8VFXeSatFM;##ix!6oc>wW)Rs>oRk?~kXsrLau-MdWDckp2PL_T#G(?g
zBNB^?Gt=`@Qxr<_6-qKPixnU>2q=(1>OtyMQ>+w9Kp71lgbMj-3MG{Vsh|?o3PgaE
zgX<M&SU_YoN>UO_5)GlbS|OyeAQhw<)P{k%Cp9lIDJK<XFvKX3yHk=%isFk?OG*pk
zi!*Xlb3y9i;(4XH@u1iQ2{JG+fYpNd>8VgX5DB<?h$V0>Wf}ker)B*6ACmF!zd**n
z{~$gHpGg1r|4{nB{~#KK^D_SZKbP_Ee^$o7{~I#?{Ri<ucu~f`|5Gyl{cp?o_rD_J
z-+!=e4Iq+{fq~)we};ztU@=!vG=d^EGfyEiuPiYqGex1eB(Wq_A+bauwIZ_wq=kWj
z;qUYR|Lgz%{|^dpQ2eB(D3oWGWaO8YD1ge9B83!iT?Y<hkQR`?z!LE(sX2+2@j3bV
z1t9S$W&i$fD*N~ULD|3mLgoMd`;`Ct|E=`je~&VV8#x#l7(j;bFfcF(FfcIiF)%QQ
zFfcF(fiyEPFu>v(LMwopE@_!*`3h;JIXNJGrFoDPo1&1DpPUG44V0u76_pmi{E?ZH
zlbQ||FD@x6O)deIgAg4>&~^yKqTI~l#2iSX%gIknf#w5*8YKDR5>VzqGX&BWK@((P
zU;rDImROnt%UTE{!4^Xd!>ypCD6v4HC^aRsC^Z?@@CIoF#S0`%tQ0_MK>0zn7^O)L
zQpS*5QkIwl%J<2MrNya`b{nQXTTrQGXqHo<pjr%PgMybKw<I&KxP$>>ju8VxE-0~-
z7Bl3g79@i#C<eze14B_Fh{wQC0_CSe>0(2Oc(DP5PK5FkVSHn#xDk{#h0-Qa+8j!o
zLFi(r`eLa1VyOCJsQO~4`eK-ROQ=2zC~XLFK(Qgj0VNPFLkWb-Py#i-1ZsW>)cg{t
z`6W<uv4=lu*nw>PQvL5g2y@jyXrG#Y|5IxI{g<iv_um96wgjpMM1%8DQDQ+nxNpV4
zpr4$PU!0o9kYA9RSDcio11a|z7>X;4OHy-niy^Hs-I7#LBrz~B=z}Z;#dm&6Dk$Fd
zlM70V85kHqRe&z24$uX~elbI0UP@|lNosP2PGU)Nac(J88?tz+v8e$=VopwZW?o)u
zkxp@Go{>SOZi*pTX>viSZeD&~QEEwQUP)#dxDEkHfWie<-h%Rso^OPYLTX-eehR3B
zS4{z_0pZNl+{Cn$!sMK!tdfGVyo~JpqVkH$s&tSX2qT;092}&es$2mQX3(4Y@4wZ|
zfB#Kp{`(&^^WT4;ng9N~&HVS@VdlU8duIImUo-RH|FW6?{uj*r_djdqzyB#S|NW1f
z`R{+k%zytE&HDF$&a8j`r_K8Jf5NPP|GQ@W``<F_-~YN<|Nd9Z`uD$R*1!Kbv;O^0
zoAvL1!mNM)qh|g4A2RFTf4^D({(H>&_umPmXZpYYU88uw!oX(MzyD^l{{1(Y_3yvd
ztbhMiX8rpwH|yVjiCO>t3(flXpJ&#;|7^4V{b!i<@Bgov|NeiO`S1U`ng9O3nECJj
zqnZEy-<kRE|FxO_{$H5+@BgWp|NbAD`S1U}ng9OpnECJjrkVf#ubKJp|FW6?{x6vM
z@Bgfs|Nc*z`R{+<%zytoX8!x%H1ps8o*DoCx6SzXzhTC||5Y>o{V$pE?|<HmfB!RP
z{QI9Y<KO=!GyeUbH{;*`88iO<pETp&{|z(#{a-cX-~Vkh{{2^)`R~8X%zyvIX8!vx
zF!SGku9^S-v&{VW|KE&%|9{N*_y5z3fB)ai`1k+WjDP<h%=q{J){KAuugv)O|J;m!
z|4+>L_y5q0fB*l?`uG3atbhMM%=-8L)vSO2pUnFA|K6;B|8LCt_y5wYfB(<S`uG3X
ztbhLx%=-6#*Q|g4x6JzYf8DHq|5wcV_g@2K|I~l~y{7#8FE;hxe}Sq0{&P+J_n&3z
zzyJTH{QLi7%D?}gru_T=X3D?+&!+tQ|6t0$|F@?6`+sH1zyIf^{QG}m%D?}Iru_TA
zXUf0-+ot^czhTP1|Es3_`@dw$zyI^5{QEy+%D?}Uru_TgGv(j^wkiMqH%$5WziP_A
z|0PrY{m+~7?|;UWfB!vZ{`(&?^WT5Jng9Oh%>4I1ZRWrK2{Zrwj{?QZjDP>9&HVR&
z!pwjFyJr6T-!k*x|GJs~{#VTW_rC~~zi0jXzirmP{~Kog`@d?|zyC{S{rf*}*1!KV
zX8rp=Y1Y60J+uD(Z=3b+f5WVQ|Ep&G`(HBa-~YT>|Ndvp`u9I+*1!KTAU)In{a-SQ
z2P_Q2X8rpgFzercuUY^8yUhCc-)`2w{}!|U{WqHR@4wEhfB)5H{rj&l>)(H=S^xfv
z%=-7AZ`Qy69JBuYXPWiz|DT!v{(qbK@BfFH|Ng(4`S1Ueng9OZoB8kmjhX-cUz+*v
z|CyQp{vVt9@Be|B|Nifq`S1Uhng9N;oB8km3Q*ZU^WXnDpu9cf-~R<O{{5dd<KO=&
zGyeVWoAK{|$Bcjfn?QBPjDP?4&G`3!$BcjfH_iC>f6a`4|4+^M_y5R@fB!Gc`1jvt
z=D+`DGynZJnECI&*35tZRc8MCFE{hwe~Fp@{tM0g_n&9xzyEAA|NUo}`S1U)8UOx&
znep%cyBYufznJmw|DzfI{@<DL@4wjWfByw$|NGB1``>?-+5i6koAvMik6Hizf1360
z|C?F={y&@b@Bf2Y|Nh^a_3!_cS^xf@oAvMiiCO>t9|F}sAp58O`=2u9-+zOt|Nd)D
z{r6vG>c9VTQ~&*!nELO((A0nbd8YpR&o=ene}<|5{{Nct@Bf!6|Ng(5^6&qPDgXXI
zn)2`eohkqRUz_sp|Ai_4{-2ui@Bfi0|Nifr^6&qSDgXX&n)2`enkoPOFPrl3|AHz1
z{?D57@Bfr3|Ni$)`S-tL%D?|jQ~v!2)#>rYB}JKe>EQY}xwt64C^a!9KCcwq9|G~q
zi!w`6p#q?K+!NZ*05@qseUG&KB8Ak75>RU?r$QmEG%p##<YHg|wST~E>3C>c8q^n9
z{O^C&;(z}yE&lia$Krqg<(B;WzhlwA|1TE(`#)jHzyGtA{QJLb$-n;_mi+sFY01C;
zMN9tuZ(H*3|C?q1{{LF`??2!2fB!X>|NHN>{NMku<^TTQS@!RL+^T>7%U1pS-?ZxA
z|7olK{hzn$-~T<U{{6qV>firMEC2luTmA39z?y&m)z<v`AF$@%|BN;N{x_`o_kYHk
zfB#>s{`ddS>VN;gtoiq!Ywf@P3TyxUH(LAezr)&p|NYkf`+sH4zyFWcK>9Ztd8Iiy
znh<{#7ZhdYm82;k^`{j4LVbJ`@=Hq!N=p<V!3u76gTtXXk0=caiFqk-BS52OnZ@8<
zbX96mKG?8;ZU6p1*$Tnakk}wGWH}Ij9#q~3N`u6fZTt6s!M1<@mGIy?JaXvzK<3TD
zq8?f76p}p1Y;5*}#9?NG*q{W-DA2?J>hUrPG%0{+Q2J9XRw&3XF3tpX>cK-;xrxQu
z3Yo>=zz2sAq+f(xT}EQD0<5PDYC9`{$IhVU7Nw?V=I0e741<azYl5gzNJ=bDg(P!@
z{Gyc9B3sp*QiZgf#B^|v3pM}>)t{1|3W>yw#IjU{v`pyWDa0s{lcDNh4$DieC{X}4
z??J8X;*!L4&=5{aDq<)Usve8FMCce7c+^xOIWbQiG!T%QTw0RK#lQd=C1POE0tGGu
z1A``%)_^i9Q$f8828O(Rhy-NxPc=mWdAuEBImp=zaCyYQn1TXW9x@^cmj^`@Y%m@q
z4>6uWwOBPpwU_~6jvvV9&~ZADI#^E@Y#WBUqI5$Ah<$j~`R1p92B|^jLG6XRD+nCp
zss=_WprJaD3YbZ{Fa~Js&esY=GBBtndxA|+O%8(6;ZQmPLKj2S1?z``b@=M$=BK1`
zF$6>DP#6sv&x863$zQ>h#X+gi;ct*@K!c$SsPe&(P9ntLP<fD2zkG$F{QO)6P;m?u
z29K8&C+2|$Mw2sAle3GVqa;v87y}IOaDm6Crwd4JGGz1)oL4{|1=$B5FN6%|6@v!>
zH8f#1AWtWP-2t5^D#-_pP!&Paw*n|#!0Hez10EoI(#qqD%H#7PvjWh<Fj1i(zdW@F
zG)QO!9;D5IjL|~X7ngv>9zg{uie}J=D0El|8uB3ZdHD*tsk!+@l^~CTg0MsZk}-=R
z^PpJdK?Mh>)Pb79zyJ>8%&OFQNLYZ&dk8ZgWL9xWY7r>dP{i}|OX3q#QsQ${b3tnI
z^B5rY3RE9#ehpn8c&HWRZb;fv$j{5EggF?L-$9-P6*EEM5efyVMY);9;E{ERQ&o$7
zJzZRVT-`wiz!EqYsJ!%b#U>6LM}~}3fX1f_atpxW1aYN;YOz96DtIso7KjkPD4>=@
z`9%uFpt=lFDnTPLGf$x?F)uw;kBgzqP!BwU1EN7A5+E8hWK#;sCk&u60u&I%xrv#e
zp{e5B)Pmds28Lqr09I-$DD1%U#mV_;1-WS;HV79Nmw?B$sxp)FN{Sd5sxmVQKn<I!
zY-oJsg2WLTD!>CN1@Hlss?6l1{3?*X<fQyu28QCYf~4FM28QAk&|omg{^a7K%sluw
zNO5j5WI!HdIVe7h(d3Jhlhe{c<|L+o23d;B5>r5fHK2A9C{e|yr<TM+JQokHOrYj~
zqRTZX$Vwq3BUJ&U5L88BjQK{Z=9I>QBO0vM4KlA^T#{b^(G#r-l?JE7jN;sQkWul;
z8K78*2Mq;++yt@`>>ijrI5)+oW#(lTXMiL@{z}S>2kD0mF=MKSC`1#73?d`x2isqi
zT3ni&3bMZlHqMKp4=RuB02F!Xs2RvcP&h%oU6QYmn4Aon?tu<CDWnzU=PE#Q4M;5r
zUt#+He+JY4|6I)f|I0A{{}19zF#rGG!}S0E52pYBA>(rK`31@ODXH<9dBxC#R+L$s
zT&9zplbHt@X)Ml6%PdPp2$W=`CZ^~lTN)VXf)#=60%0WaM6iTzE_j$7BnQF}bFoT+
zq~RFU7GiK<U;xt$P}%_^4H5$<WAJ!jK~8Ro0fTC>hNhJQM#vQBmd1nTPrzvgq&wI*
z)C!zdR8tf*0-S?YQ#2LejhEumf`a^_5`~=1^o$aP;+)jf0tHC*#z2(56p#iKZJ_yp
z6oggCE-Wa@PcKT$RVc|wRRGPomMD~^CYR(F>4Dt}ayZmE@n93<K@MSHC@x9KFD=n6
zNGyS*)Z~=BVx7{&q7vOA!vYHi1{A)b5d$b`gJUi$!@|(OKo_JG6b|W$nZ-G&MLLNE
zNnoMU<RqPplFT&durfnYYF=t_VzEwfa%P%tk!7NRdAfm#F#|(!Mq+kJCfG)>QfRtJ
zD>XGS&`mag+W-{@nGIH#lUb5lp#vg8LJSOf#fE04rUoz?ROEr2#Za7AP^^<uuA5kp
z1a~V)q9P}+LZ_mj7%T`fM%Pf!z(5bK&#DBHvq1Sn71RKRFZ%&aY;!TBrIf^jLpeUB
zD6=fJ2waylFd&Z~mn4^`lo%O+oeLhn)-BF2ElP%z7@2tmr63y;lR=}$y5LD8-P~e^
z%sg}vkZTzj(hD;4b&FC#!4J{~;e)I6{4`MEU7TN#k)E$poNi=bVx*f<o|~Vio10vU
zZTwodJf#F=R4T}zf}+fP&@?c_76t}LtAT-`EHS4P<Wf+j4U#LaEKbhP(=7t8o&c3c
z5I)=mMXBkzi3JP{MXBk!nfbcqnJJJ2m6r(iUus@TW+JF4$jK}z$w}3P^OG{u5gfR=
z3=9u6{{O$A@&Er5jsO1zG$Axd3>kyu^b>P36N{mZa0Uj30!X)+Aty7hv_c2Q1C9UZ
z79^H{x<DY`Ffc&Nje?v^aCOI!nFpOWE7nZ~O|GY;LaHc;y3E|-%w%vwA5l)^C8vUP
z8$u!&q7EbgiEn6n1qpysmL5cufdQ#J1IdBgd5AeY&!9kPixF&NJjf|Ud5JmknMH+Z
zpx{H+4=ePF%QNBrffkWqA&5tzB*NVwYm3XF!VFM%W*Q|!TnNc8si661&~g>sOe0A6
zfD#@w-<um68o<Ss!3i@tH75rgJdkvmoS#=xl%JE6S_DcDV5`99<`wCJl!H{}K^b6i
zX#NBV>4FMOP&$Cr4<I41!_e(7t}NCq$jnPFDFV&%fXcDNBCz{1^K(lp5K<}NY1(3j
zl+0q#q&6f{LFShvmVhRPK)q6s1HoNV(7aJ@Cb%aDn{R@&+Thbp;Cx)1l&J$12Tcwp
z<|U_s{0Zs^qst>VRYBG;z&hg4X($FzpB2mo%Q7(JrB;;aCKjcG+H@cx2tOqS()xnR
zLyB&YG;AIWTomah=H%p;LlQ2e9){14!DXQS(uKGmmTnO3H%K}LFLux^$=A)zD9B9)
zE&56=0>v6kJ&HV-19l7pOui_wTo){iVFtMUTFk%z>$t;Oy(LA7dBr)2p!sQVeU+S(
zpPa3mR+L&;nwpnf$&g%HRFs-mqFY>$3icqVoXJbfg=hTy?8Hit8}hS3Bm)B^-s4Lu
z3qYk914D8FsMW~80BSsd;vC6num*^~GmBvr0Lc8}jLbAp83|GV;={^DFdy8WNiR(;
zF44`*OG&NJ1udb0`5)9uLlK6SH|a(Br3EMw5POluA+|!q^Gb7dGgCkzkKjWp5s(<j
z9l6Dsx&?`#paJn<_9tg#=A;yX8u<`?;3hUWa3QK->Y(DOFn(T2Y8gZYxRnLU51;@`
z2K5{u;+ZKqsk-2XFT@29^AVyDRWS34lQQ8+upqH0F_!_nN<kN7Xpt_coefi;npaX(
zshg8n0*Y;2P|k$NfZEH*!nv8CN~kz91x;OfVs>h20kTSne$YHE!ga+Axw)mf@I(Qc
zF9zit(DF20NS79(3sjFmR;|H=l|j8RT|_yj3{AK&Ay7LZBtKsvH!-ggwPRPTP?E2Z
zmRV6+0BVWlg7Pk?<xr-Y;-FfgqY9bUWk3^W$jjFS*Qc;{2FQt^j&FWZWjxq0s6(Ok
zesY<ig@Hj50|OG@&?p1W2ek{p6%|w-%m?)sA@xy7hM}nuxSUN+%u7tn)5%WFODU=>
zN!86ZG6svo%U^hbrJD&VOyS~L8Q^*WR+6BLgW3;8=?o0ud|eFcKU=~2-k{-gg@WA7
zWatnDs6Pzq|AWf`P`D;1=7IX?;9+%K3RR00iZh@qHz9c+YMN?=0(jgVY#LHM0dX%w
zg)X=WQ>>F%QDA6lU<URqs2!1;nH-;A07>Ma`T}ZrJjC#LurAo(1xOyb{RQGf>Mw9R
z78F&*NPN)D0Wu%l&IKt#=*s{r*DcM<Nlh%yNKMgA1jimE+z{hJX_<K`3Mq+}24=?K
zF$Pd#E&=-#9B$yn(vWdfsG<O0PiL?^+<tQtu$Phf_}r5VT9k?8o|K$)9f;Ww4?xU`
zPb)PyF#z>|L2Z}3%n}BOns`XH1WNzl)+Z>RLHY&oE<u_Btm=ad5Hc`ufK29x_Sryv
zH5dkogZv3wZ{e7il3J_~;OnRW?ZATLF%e`NT5e-tD9A+;2Zeh^Vo_>}Zc1*VZb5#2
z4z&FU;-;j6S0{liV_;x#nEC&|)y)6@O=kZ8uQ&7m{|z%p!x}UH|5uv%|G&)4|Nq5i
z{{Js9^Z$RYng9Q@%>4iV-;DqNf6Vy*|I>{B|KH5`|Nq&H|NkG%`2YXbjQ{_y%=rKR
z+>HPK8)p9hUp4dp|B{*i|L4v8|Np}b(s0Ji|NoO_{{J5{^Z);_ng9O>%>4h~Yv%v|
zE;IlCx10I@zs1b||BYt;|F1Li|9`ca|Nkq@{QqBS=Kud9GynhRoB97gxE&b}3O#Uk
zgwAq7`#oTBP<Dn3gWI>D+AuQ(v_cD3>w{*=@=9|-(*e+h&v6U>|Myz(|G&<H|Nr?G
z{Qv)M{{R2y=Kue{ZvOxOee?hS&zt}Mzu)}-|8?g7|Iao5|Nj^B{{KHV@Bja43;+Kw
zS@{2d(8B-!4Ho|Y&$saZ|2GT%|39_h|Nj*rvljjT|6$?(|Cbj2|G#D7|NlCR{{LSx
z@BjaTdH?@sEcpMwYXM|kAZUCfHMbO00mXw{2l53d%F)Haz6MFa3g!}M2e6nSC$YE$
zJU#?&55#9AmSyIp#}`A^F+&EB5{pVeZF+F;5nKntHDeeT52|n&U_-|7`DLj^MVTq7
zpl*9<PHHhkIzB!Tv`Q%+x|lLKKO?mWR58YvCl=*`N@}o8nMTR+i7AN%C8<Ry_JJDL
zC<2g9983se1vmgeGj<?{L#+izD5%jBUy={;aY}p%sCmr*8a#p6Sp?pzfoc{`-ynxh
zL27bIYDzq4Q6I!4OxHtPR+OJ#0#<?QY_L#fK_<*<hInut7hjT-6rYw;TATr?KfxBj
zCs{$kUz}Q$nV19D2JI)I_!SzNP|sp&f;bE$juN{FVI+4U1d-zbA{rkL4)zM9u!zq{
zt$=tJx(x>IP_R;X41v-n0|SE~0|SF10|SFJl+Vq;z#z`Rz#z-Oz#zfEz#z)Nz`)MH
zzyK;&<rx?lSfT4sLF-OA85kItp!#^BG>8JNO$E`Qb*dm5hUFL-7+64Sw;321grS0<
z^{h}Pcs(nK4Jyb%?gFvFtD!**1_lNhC=H^d7#JAX7#J8NK^!O+gZc;LCXhWKa~N0{
z7~L2e7#SA2@})8`%;aWKG;?BV5Mtoy2xM^rsYLhzY7E$1P~`^-3y}Lj{sFlMWIiZN
zK<YsDg8T!Tm1<z#btxc<uO})f^wi6B%J(KnUSH~W{?wMR$P*76)#C32`rccu{H*iO
zoI4Fka~VGhDg7{YtlFRRYxZ}|BMK6?YZvSh$XHQ1w`LCGW8?Hct<DLHI@uow&#Afl
z(M#=Kx7UR((QMU<4*i)o=49RA{%*g!X-;ru;!@*9*E9ctmH>mCgB3HwM==r7cHl7L
zU@#B{g%D&dF-Z0=RNMj_LktWokf33ZVFINQ4h9Z(h<b3CGB7ZBK*bx-#M{8@lNlK<
zK-aZ`%m(2DQ1ds)LCk@L<3*@=0-8B-Odz*0GAMin=|<pksJ#+0sOHROgt#+679tKy
zdjU}MHPFmAhMH4=CJsuMf(*P28AcFuAS43=s4XVQz`+o}1QCIS11Ow8;sR*qfEp(t
z@ecwJ^$wuM2m=FyDb$?~Tu^bS*P5Z?8Bp^VK%^NupyC&#Ap$UayP@uX!2=P8b`Ka{
zLj9WnH3z0%9Bd9R!-jZ>dJU+(FQMWEQ2%m3q#0H~%`t$+7c4ww!0I^|GSK|%4;6m_
z^)JlcG^lt5n)=m@koc7V6)sS>fGAKffx<070^$(p&^yC<s5t^65OEKXVg?3=M__SY
z295-XI4oU3rAMjJ5Eu=C(GVC7fzc44X$aha)^D)(st%~Z2x<#KD^!@c4OCnLP22#~
z=w@JG&_EMk2d&T?(8O1P8t9;Q7@BwxRJ;LATn@UgrvptK#-D&gd<U9%6SU$zfF?c#
zD*ggZd;(-S7sCfM@iW1Y==gyq-UAg+;DprYuyCt@@(Z9eOkBVmq7Ehx6VHH-?>C^S
zcY%s`po#y<g1Bb_ns^6Pd<L30M<zu50yJ?wsQ3;vaTdt*6T<;CaT%!jC(y)iLCv{<
zCVmO({u^lGTcGM6pozaT1GT6a7+#=>FMx`FKof6php7L7CLRYBXMna_Vc{GCwU+};
zya6gMfF@o6ZO==fiHAYO70|>_L6#dZXrPI|fQrM~(J=RLC_vJK2by{dMTmF+n)nN-
zcm$ewg%U)40-AV-GDJKBO*}#cB3^(d-T>uSKxvpeJ)rG&m^@6}fE!}Y1~m0L;Mqn7
zh6`xo5rvR+cmqv*4^&(LY97pd0cgKW0!_RIYCg<<nEDTQA?aZSntCm$`5Vy0Z$ZsJ
zfF}L{Dt-b@T;d+Yd<$rJ!0cTIoyc@R6Sshh!@>`yeg{-t1(b$~S3yVSC!mSTK+Tzf
zCjJ5HFPM2Sa~PoRyn&`3#(#iA9M(UBnUlZ^iQf-s>SsX3f1rt9fQmCfX_z@2d=PUu
z(8L{};sR*m6;N>rH1Q2kaRoH-7f^8xG;sxfh`k1A;t^1B3pDWwP;mz|@e@#S4>WNG
zX#X()P22)19)Tua02OaQ6JOT>$rlsQ#3w+-cc6)%f{LF&6MqI3|9~cbp$lR@12mjq
z@v;dju7M^#sT-o+0!{o4RDA-Pcv=rceF2*II;c4_(8Qad>Q|tNAA^ctKoj@tg_!>U
zO<WEt&H;@dn7<7AAnGO1#EYQn9ni!dLDdJKiTgmsE6~J?`XT0bpow!p#W$dd&wz>_
zKoj2r6@P&y{st=k15G?`0>oYgXgY%VH)Rq;+yG773Mw9fCcb7eM12OD_!g-8325Rq
zQy}UWpoyP@nzI2-{L@Z|`W<NE9#HWEXyPSM@e63;7og%d(8MP|#UG%F?|_QK#&uxf
z^WzJ|JwMRYA9x2T&p8Ak<pfOq38=UPn)n5%xCWZ|1E{zKn)nB(xCff}52$zqnmEII
zh<h^7#5thi6=>oDQ1K2laRsRO3^Z{AsQ3yraSN#U4m5EGsQ3vqaSy2Y4K(opsQ3#s
z@dT*&4>a)ts5plZYWO!m#U;?hJD}nkXyOx~;s$8qD?UNu-2#WW0}gQyH1Ru7a{|!B
zVdh8R5Kq7%o`FNW0Ec)54)F#Y;vG1|C*TmDfkS)&4)GN@#5dp&-+@E?01ojJIK(gD
z5Wj&#`~eQ}7dXT};1K_TL!1FRF99nzVCjJahqwTmxXEWo`jkKuhnb^*LtF!gIBcE-
z<{k&AItwTb6TblE!{lM&1yFGhC=C<$`37-k0Gc@4GDvxqfF=&(XW$Tr*#k4*<0HhJ
z3N-aMpyCZ^;t^2s4m5F?`Uz;_8Bp~z(8Nzb#TTH7H$cT#po#B*if=#@UjP+{g)7Wo
zAE4@PKxvpb(+@~^K0p)yvH}tgFnuufFQDeb<`ZDz5zzSs2`CK{UjgMSKxvrx4Jcm&
zO2foCL?Pv`0h+i4RNMkhJOe83fF`~ID(-<Megi5VfF`aX2C*0B514y0pz0E!G)&y$
zHzeF(@-XoapCI8@fu^3}Geo=tO<Vvf4htukIXj^0Hb7~Zcoo!Mm^@5e18NQ|Tw&rb
zp!y#`X_)vPs5vlsn79Sh99TTS#3i8NCIF>j;zoZU;Q*6|iF-iJfyEnK9ID>|O2foU
zpyqg>i6=nKfyFaSeFaoq0hES`Z-bfxlZS~HK+WkuQ{Mp<hou*o`W;Yp8=y2y{0G#0
zm^@5;2Gkr_`htnSfa-q$rD5VWe<9%plZT0~fSU6IP5lO_I0rPH!qgvtio?<`Oxyyh
z&Hzfo#JiyO!sKD%H=yQJps7CsRo{Uo{sk(&0ZshQKZw5$pow#UPX}XQc!4H92P&>0
z4#|Ho_nd*w!5g57GcZE(Q3RTJ6;wO}O?(Mdd;*$y029QV1!&?8Q1KIJ;=7n3>TjTl
z>##t?8KCp7F!xVkg@_BFiJyRqJD`ahutC&&pou?$io@o0Vdh_es*8ZqF!2eJkZ?>u
z6K{ZuXP}8cfQlEOi3dnQ%&9;VKL8bPKof6(&a-!*i5Eb{H=v2LaY6jM15LaODh~4>
z%wG?n>TW=3n79N~Jxm@ZZtw+Sz5>*LF!66Z5OEDO@fA?<1T^srQ1J{j@g}G^EL>sc
zFMz7+fYLDWUr=|#;s+*v0IF^Vl!l4J)Wgh!iFZK#1=9x;p8*wz#V1Vs1Jv9XP#Pw#
z#0v=rm^@4zR{k46;~6I20#$E;CcX+P4ofdE^$AdQ5l|W?&cg?>7bXuAUjcRh0yOor
zpz2qkiLZf*!_p(noC{EOC!jQ39I75B4--ECwO0U|PGRC%f)IB~poz;t#RJg9-Js$T
zXyQKvAm+gG0nGdfP<0hh8YV8p4^a=xPcZQfP<0(p8YT`?4>J!Y&hZsu4on|RTmmW%
zTNeWpzX3HDM#IEkK*b+GX_)vf5s3LPd6;+s)O-%;IwP1kj4yyg9JVeArrrRmP60~8
z#0#K&4JZv0-vH&q^ufdfpyC!#8YV7c0dc<rnm8L&9HtMZ{sz=vF#BQR6QKGlpfpUp
z3~EjTn)odzh`lg<F!c=IAmT88z{D>=_3wbvFmWL(i24I);&&_|;xK(M^#V}yAE2q%
zfQo-W6SshhGsr^f0hl=fP;m}4@k3C19ni!BpbNNQ>&sx~BtX?gKxvrx11KLR4-;>I
zif2G+n0SZ>#J>e-;%<i_;xK(M^|1b32b%f=P=8H86NmNhW}u0~)Gt62hxPAPpozoO
zZ$J~D0JZl3n)nK+I4nG1?q`6mD|>;a{t+}BKA?#oI0^{|m_C>}C!pplK+S`R!}uCF
z#9`~&VCo&9>MWo%OuPWfhsndl1EAs_P#Pw_#|z?4m^@7U0o0u^^I+l)Q2iB98YVu;
z4`L2X9wz<)YR&{S^&H<J>S60EVd_sn)$M@NFmVQXNPakgCT;;0hv|c<e*jf?0ZPNf
z1%e^=-ar$71QmzrgQ-t|x)WwUOk4tLF9(!{iNnknKoeI9gV+nx2UA}GH6P{=n0NqG
zzXOzpiNnnIKofTehnNr32UFhxH9rAO{R*gf1DZID-+@E?1)6x>M2Ni~(8MF4;y=*D
z^Pu9ed2g6IE1>h>22dI%{s5{z0!@4$R2-%crhdU6h<h5))OSGFyL6z5Z-A<wfF=%8
zKLbtt095?~G;x^v6=>oYpz1fEiNn<IKofreReu0Yd<NA0C(y({K-FJB6Q2N8{{l_?
z1a$qt2Q=}2lOW+H0hNb^Clgd$0ZrU&3Pe3@odQh#3aGjWC=C-=gPN0pCVmboJ_AiW
z04feM4`$AVzYu$2{(y-;fQrM`N5I4*pz9(8pfpT;%2bFs7HHyiP;r<(n0k$W5cRNi
z7BKM_Q2iZH8YX@XY7R^uCT;;W=Led452!c?biD>leFRio0!_RCDjtC*{sd}o0-8AA
zbg28$#4VufKpN1*C8j~t!`6?$-17sfZU&TwiE}~K??4mZ0~LqqgQ>p(bw3Bxewg?R
zsJH~0IKzL4dtmN`saJrC!`8FF#7{u=H$Z8ac-ahyIUQ)?5m50J=;F}z6&ujRVe3^6
zpotgEgP0GqA7*a?)SUvVka`RzzGDeQy#$)L+ER$P0-E>}sQLgjaSQ0UaRi!p6I46_
zP23ME-hn0_vkGGG3^ef*D<R?s(8SH4;wR9=U7+F&YN-BgI|MO@15NxHRNMef{L~SM
zdJ8mh7ijw`LLJro1MCp>325T5ahwb^aoE0z0yJ^hK8Ol5aoGGy1DZH&zeWd|IBfsL
z1T=Bjev=t!;;?q!0yJ@0J81=)IBXxv26S=geu^Dv;;{WP2hhY}`z%hNiNp3yTtE|t
ztz)}^CJvi-e}E<q+fVTVO&qp=<O7;Gte^Y?O&r#rVbDO0ci6rR4m5Gte2D;>IDG#F
znmBA<i2|Cq0JJ{UKojSHiW{Jb!}jS|pozowA330j!}bk%pozo!=K*NquytCHQQuK=
zGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
zU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU
z1V%$(Gz3ONU=)moz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kW!5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7
zfzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S`WG8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiSS03(`L{zHKS0|NsHgSco)M!6#}1PY*j2BirQ
z=792H>4zW6$43?A=a=A<AC(&ofzc2c4FPI~0H}NdVVIdrPzEQImiY7kKL~@=fH16F
zgG$4x6b1$c5QYmt86Ytb2I&O}F@p#O1_qctFq)7!te*7@@Qe@k^>=ZFnnNrF(&ypm
z6GE(dO4Whv3l4UT_w@5}b*8}9;>zNZ)Lh--(&B>DycFG%)METq1jybHA19KX&&t5a
z0E#2`)V$Q9%w&@F!!*F+vjHTaz`(!&W`H=Ocrb-PVqQvWaeQ%ZDUBQjF~5Lj<`d!U
z22gs|U|?WyW?*3OVS&(u^c9!p85v~irWooL6woSc2)SV-$h-P_f=fjhO{|}t{oH~;
zYGE{pO$_!7C<ZHo(O?b{gaA|xjD~UvQog|+U^Orr%prmZ2@VPdDTC1<HZeFLI25c8
zMiZk4q$boi07NmsXfTHe!q3^s1*8l{gV@Ai=YRlEc4UCj#OML332_T|L#9D&QZTM|
z3m!ATO`!k(|AT2f>QJPDLLlJ+qfsRBa9o4I(Z>Lz@hHVB#e!EBw<M^nM3#ls<1jH;
z`wYfMw}%xb0j1fXG>l@0F`zVhe4qz17gQaL;)XGxG!K-9QM@n)l;(rdFbci@jh>$c
zVG5zN5R`^d!Z5}tJsJX|Aut*OM20|eVoGXWa%y~OViEq18=86PiJ8SYsYN8~D@x5v
zElw<sFHX)(Lo*UDw>Tp)yCjoj>llhN(=y9Q_Z~w|W=U!V>DDoT!qLLW)Bvw%ut-+q
z<W=Z`G=nV0B9BX`I5jsjBfq#LGcO&N5}Jr7mL!*_lo%P1>`^jZlU|USuUnK_TtZ?x
zg;@vIUyxs(T9ltgQo@57KqQUcP9aho$;yh;jSNhTbaRtSL7|dLQr^X987}u1m*!Pu
z>XxUJP}e$~PARS|PR`HMElN!yZ_)v(pXM=+E4*-eY*d0KA&{7vsGFHvOu@(?O`J7q
z=r9d|l8n^E6rE&C0|VUw9Yh?a!3+0RK`xyt9Jr12VT{%r^a<ybL`wrR<KdZxND0BA
zlHL-Nb29TvbaP8Gb5n~*@gP(!bY3SX7gvk8eKPt`Ayg-X$|xbNUkcI1z(B4(n0}bQ
zi_0@%LU?JIKQohy%ke6NO2WoNcd$T4PQU*9pAVAiV1@8u<D(Kx5I$^tw1N%7hmCj6
zf^ZpN<DC*9Ll_tsM4>c{f{&*PKs3O{Q%`6^RKUhlVfugnhq#A<fdQ=aCzOAgMhVwJ
T4HhC0_l#5$v~B@}arqwr%#ejp

diff --git a/roms/opensbi b/roms/opensbi
index 43cace6c36..a32a910691 160000
--- a/roms/opensbi
+++ b/roms/opensbi
@@ -1 +1 @@
-Subproject commit 43cace6c3671e5172d0df0a8963e552bb04b7b20
+Subproject commit a32a91069119e7a5aa31e6bc51d5e00860be3d80

From 191df346175283af013f414375f4be59fb850120 Mon Sep 17 00:00:00 2001
From: Frank Chang <frank.chang@sifive.com>
Date: Fri, 12 Sep 2025 00:06:43 +0800
Subject: [PATCH 0857/2396] hw/char: sifive_uart: Raise IRQ according to the
 Tx/Rx watermark thresholds

Currently, the SiFive UART raises an IRQ whenever:

  1. ie.txwm is enabled.
  2. ie.rxwm is enabled and the Rx FIFO is not empty.

It does not check the watermark thresholds set by software. However,
since commit [1] changed the SiFive UART character printing from
synchronous to asynchronous, Tx overflows may occur, causing characters
to be dropped when running Linux because:

  1. The Linux SiFive UART driver sets the transmit watermark level to 1
     [2], meaning a transmit watermark interrupt is raised whenever a
     character is enqueued into the Tx FIFO.
  2. Upon receiving a transmit watermark interrupt, the Linux driver
     transfers up to a full Tx FIFO's worth of characters from the Linux
     serial transmit buffer [3], without checking the txdata.full flag
     before transferring multiple characters [4].

To fix this issue, we must honor the Tx/Rx watermark thresholds and
raise interrupts only when the Tx threshold is exceeded or the Rx
threshold is undercut.

[1] 53c1557b230986ab6320a58e1b2c26216ecd86d5
[2] https://github.com/torvalds/linux/blob/master/drivers/tty/serial/sifive.c#L1039
[3] https://github.com/torvalds/linux/blob/master/drivers/tty/serial/sifive.c#L538
[4] https://github.com/torvalds/linux/blob/master/drivers/tty/serial/sifive.c#L291

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Signed-off-by: Emmanuel Blot <emmanuel.blot@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911160647.5710-2-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/sifive_uart.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index 9bc697a67b..138c31fcab 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -35,16 +35,17 @@
  */
 
 /* Returns the state of the IP (interrupt pending) register */
-static uint64_t sifive_uart_ip(SiFiveUARTState *s)
+static uint32_t sifive_uart_ip(SiFiveUARTState *s)
 {
-    uint64_t ret = 0;
+    uint32_t ret = 0;
 
-    uint64_t txcnt = SIFIVE_UART_GET_TXCNT(s->txctrl);
-    uint64_t rxcnt = SIFIVE_UART_GET_RXCNT(s->rxctrl);
+    uint32_t txcnt = SIFIVE_UART_GET_TXCNT(s->txctrl);
+    uint32_t rxcnt = SIFIVE_UART_GET_RXCNT(s->rxctrl);
 
-    if (txcnt != 0) {
+    if (fifo8_num_used(&s->tx_fifo) < txcnt) {
         ret |= SIFIVE_UART_IP_TXWM;
     }
+
     if (s->rx_fifo_len > rxcnt) {
         ret |= SIFIVE_UART_IP_RXWM;
     }
@@ -55,15 +56,14 @@ static uint64_t sifive_uart_ip(SiFiveUARTState *s)
 static void sifive_uart_update_irq(SiFiveUARTState *s)
 {
     int cond = 0;
-    if ((s->ie & SIFIVE_UART_IE_TXWM) ||
-        ((s->ie & SIFIVE_UART_IE_RXWM) && s->rx_fifo_len)) {
+    uint32_t ip = sifive_uart_ip(s);
+
+    if (((ip & SIFIVE_UART_IP_TXWM) && (s->ie & SIFIVE_UART_IE_TXWM)) ||
+        ((ip & SIFIVE_UART_IP_RXWM) && (s->ie & SIFIVE_UART_IE_RXWM))) {
         cond = 1;
     }
-    if (cond) {
-        qemu_irq_raise(s->irq);
-    } else {
-        qemu_irq_lower(s->irq);
-    }
+
+    qemu_set_irq(s->irq, cond);
 }
 
 static gboolean sifive_uart_xmit(void *do_not_use, GIOCondition cond,

From a090ecd880a1b211e92c41029d1a90edf6686a48 Mon Sep 17 00:00:00 2001
From: Frank Chang <frank.chang@sifive.com>
Date: Fri, 12 Sep 2025 00:06:44 +0800
Subject: [PATCH 0858/2396] hw/char: sifive_uart: Avoid pushing Tx FIFO when
 size is zero

There's no need to call fifo8_push_all() when size is zero.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911160647.5710-3-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/sifive_uart.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index 138c31fcab..401f869680 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -122,7 +122,9 @@ static void sifive_uart_write_tx_fifo(SiFiveUARTState *s, const uint8_t *buf,
         qemu_log_mask(LOG_GUEST_ERROR, "sifive_uart: TX FIFO overflow");
     }
 
-    fifo8_push_all(&s->tx_fifo, buf, size);
+    if (size > 0) {
+        fifo8_push_all(&s->tx_fifo, buf, size);
+    }
 
     if (fifo8_is_full(&s->tx_fifo)) {
         s->txfifo |= SIFIVE_UART_TXFIFO_FULL;

From 9100b9e67fbd2d60b53a6c5620c4ca2e6e43a0db Mon Sep 17 00:00:00 2001
From: Frank Chang <frank.chang@sifive.com>
Date: Fri, 12 Sep 2025 00:06:45 +0800
Subject: [PATCH 0859/2396] hw/char: sifive_uart: Remove outdated comment about
 Tx FIFO

Since Tx FIFO is now implemented using "qemu/fifo8.h", remove the comment
that no longer reflects the current implementation.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911160647.5710-4-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/sifive_uart.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index 401f869680..baef0bd9c2 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -28,12 +28,6 @@
 
 #define TX_INTERRUPT_TRIGGER_DELAY_NS 100
 
-/*
- * Not yet implemented:
- *
- * Transmit FIFO using "qemu/fifo8.h"
- */
-
 /* Returns the state of the IP (interrupt pending) register */
 static uint32_t sifive_uart_ip(SiFiveUARTState *s)
 {

From e04886254f0d88881ea14533c438859537ed1dfb Mon Sep 17 00:00:00 2001
From: Frank Chang <frank.chang@sifive.com>
Date: Fri, 12 Sep 2025 00:06:46 +0800
Subject: [PATCH 0860/2396] hw/char: sifive_uart: Add newline to error message

Adds a missing newline character to the error message.

Signed-off-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911160647.5710-5-frank.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/char/sifive_uart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/sifive_uart.c b/hw/char/sifive_uart.c
index baef0bd9c2..e7357d585a 100644
--- a/hw/char/sifive_uart.c
+++ b/hw/char/sifive_uart.c
@@ -113,7 +113,7 @@ static void sifive_uart_write_tx_fifo(SiFiveUARTState *s, const uint8_t *buf,
 
     if (size > fifo8_num_free(&s->tx_fifo)) {
         size = fifo8_num_free(&s->tx_fifo);
-        qemu_log_mask(LOG_GUEST_ERROR, "sifive_uart: TX FIFO overflow");
+        qemu_log_mask(LOG_GUEST_ERROR, "sifive_uart: TX FIFO overflow.\n");
     }
 
     if (size > 0) {

From 63181b069be342c49b2bb95344654d3667250f46 Mon Sep 17 00:00:00 2001
From: TANG Tiancheng <lyndra@linux.alibaba.com>
Date: Thu, 11 Sep 2025 17:56:13 +0800
Subject: [PATCH 0861/2396] hw/intc: Save time_delta in RISC-V mtimer VMState

In QEMU's RISC-V ACLINT timer model, 'mtime' is not stored directly as a
state variable. It is computed on demand as:

    mtime = rtc_r + time_delta

where:
- 'rtc_r' is the current VM virtual time (in ticks) obtained via
  cpu_riscv_read_rtc_raw() from QEMU_CLOCK_VIRTUAL.
- 'time_delta' is an offset applied when the guest writes a new 'mtime'
  value via riscv_aclint_mtimer_write():

    time_delta = value - rtc_r

Under this design, 'rtc_r' is assumed to be monotonically increasing
during VM execution. Even if the guest writes an 'mtime' value smaller
than the current one (making 'time_delta' negative in signed arithmetic,
or underflow in unsigned arithmetic), the computed 'mtime' remains
correct because 'rtc_r_new > rtc_r_old':

    mtime_new = rtc_r_new + (value - rtc_r_old)

However, this monotonicity assumption breaks on snapshot load.

Before restoring a snapshot, QEMU resets the guest, which calls
riscv_aclint_mtimer_reset_enter() to set 'mtime' to 0 and recompute
'time_delta' as:

    time_delta = 0 - rtc_r_reset

Here, the time_delta differs from the value that was present when the
snapshot was saved. As a result, subsequent reads produce a fixed offset
from the true mtime.

This can be observed with the 'date' command inside the guest: after loading
a snapshot, the reported time appears "frozen" at the save point, and only
resumes correctly after the guest has run long enough to compensate for the
erroneous offset.

The fix is to treat 'time_delta' as part of the device's migratable
state and save/restore it via vmstate. This preserves the correct
relation between 'rtc_r' and 'mtime' across snapshot save/load, ensuring
'mtime' continues incrementing from the precise saved value after
restore.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911-timers-v3-1-60508f640050@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index 4623cfa029..318a9c8248 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -323,9 +323,10 @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type)
 
 static const VMStateDescription vmstate_riscv_mtimer = {
     .name = "riscv_mtimer",
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (const VMStateField[]) {
+            VMSTATE_UINT64(time_delta, RISCVAclintMTimerState),
             VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState,
                                   num_harts, 0,
                                   vmstate_info_uint64, uint64_t),

From 1d9a832b58be63e53ef0d2342c271a34ecb349db Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Fri, 26 Sep 2025 10:54:23 +0200
Subject: [PATCH 0862/2396] vfio: Remove workaround for kernel DMA unmap
 overflow bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A kernel bug was introduced in Linux v4.15 via commit 71a7d3d78e3c
("vfio/type1: Check for address space wrap-around on unmap"), which
added a test for address space wrap-around in the vfio DMA unmap path.
Unfortunately, due to an integer overflow, the kernel would
incorrectly detect an unmap of the last page in the 64-bit address
space as a wrap-around, causing the unmap to fail with -EINVAL.

A QEMU workaround was introduced in commit 567d7d3e6be5 ("vfio/common:
Work around kernel overflow bug in DMA unmap") to retry the unmap,
excluding the final page of the range.

The kernel bug was then fixed in Linux v5.0 via commit 58fec830fc19
("vfio/type1: Fix dma_unmap wrap-around check"). Since the oldest
supported LTS kernel is now v5.4, kernels affected by this bug are
considered deprecated, and the workaround is no longer necessary.

This change reverts 567d7d3e6be5, removing the workaround.

Link: https://bugzilla.redhat.com/show_bug.cgi?id=1662291
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Link: https://lore.kernel.org/qemu-devel/20250926085423.375547-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-legacy.c | 20 +-------------------
 hw/vfio/trace-events       |  1 -
 2 files changed, 1 insertion(+), 20 deletions(-)

diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index c0f87f774a..25a15ea867 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -147,25 +147,7 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
         need_dirty_sync = true;
     }
 
-    while (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
-        /*
-         * The type1 backend has an off-by-one bug in the kernel (71a7d3d78e3c
-         * v4.15) where an overflow in its wrap-around check prevents us from
-         * unmapping the last page of the address space.  Test for the error
-         * condition and re-try the unmap excluding the last page.  The
-         * expectation is that we've never mapped the last page anyway and this
-         * unmap request comes via vIOMMU support which also makes it unlikely
-         * that this page is used.  This bug was introduced well after type1 v2
-         * support was introduced, so we shouldn't need to test for v1.  A fix
-         * is queued for kernel v5.0 so this workaround can be removed once
-         * affected kernels are sufficiently deprecated.
-         */
-        if (errno == EINVAL && unmap.size && !(unmap.iova + unmap.size) &&
-            container->iommu_type == VFIO_TYPE1v2_IOMMU) {
-            trace_vfio_legacy_dma_unmap_overflow_workaround();
-            unmap.size -= 1ULL << ctz64(bcontainer->pgsizes);
-            continue;
-        }
+    if (ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, &unmap)) {
         return -errno;
     }
 
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index e3d571f8c8..7496e1b64b 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -112,7 +112,6 @@ vfio_container_disconnect(int fd) "close container->fd=%d"
 vfio_group_put(int fd) "close group->fd=%d"
 vfio_device_get(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"
 vfio_device_put(int fd) "close vdev->fd=%d"
-vfio_legacy_dma_unmap_overflow_workaround(void) ""
 
 # region.c
 vfio_region_write(const char *name, int index, uint64_t addr, uint64_t data, unsigned size) " (%s:region%d+0x%"PRIx64", 0x%"PRIx64 ", %d)"

From 70a7e33ddb7f2ca7caacf286222bd80fd330c454 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 14:35:25 +0200
Subject: [PATCH 0863/2396] system/iommufd: Use uint64_t type for IOVA mapping
 size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ram_addr_t' type is described as:

  a QEMU internal address space that maps guest RAM physical
  addresses into an intermediate address space that can map
  to host virtual address spaces.

This doesn't represent well an IOVA mapping size. Simply use
the uint64_t type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-2-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 backends/iommufd.c       | 6 +++---
 include/system/iommufd.h | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/backends/iommufd.c b/backends/iommufd.c
index 2a33c7ab0b..fdfb7c9d67 100644
--- a/backends/iommufd.c
+++ b/backends/iommufd.c
@@ -197,7 +197,7 @@ void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id)
 }
 
 int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
-                            ram_addr_t size, void *vaddr, bool readonly)
+                            uint64_t size, void *vaddr, bool readonly)
 {
     int ret, fd = be->fd;
     struct iommu_ioas_map map = {
@@ -230,7 +230,7 @@ int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
 }
 
 int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-                                 hwaddr iova, ram_addr_t size,
+                                 hwaddr iova, uint64_t size,
                                  int mfd, unsigned long start, bool readonly)
 {
     int ret, fd = be->fd;
@@ -268,7 +268,7 @@ int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
 }
 
 int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-                              hwaddr iova, ram_addr_t size)
+                              hwaddr iova, uint64_t size)
 {
     int ret, fd = be->fd;
     struct iommu_ioas_unmap unmap = {
diff --git a/include/system/iommufd.h b/include/system/iommufd.h
index c9c72ffc45..a659f36a20 100644
--- a/include/system/iommufd.h
+++ b/include/system/iommufd.h
@@ -45,12 +45,12 @@ bool iommufd_backend_alloc_ioas(IOMMUFDBackend *be, uint32_t *ioas_id,
                                 Error **errp);
 void iommufd_backend_free_id(IOMMUFDBackend *be, uint32_t id);
 int iommufd_backend_map_file_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-                                 hwaddr iova, ram_addr_t size, int fd,
+                                 hwaddr iova, uint64_t size, int fd,
                                  unsigned long start, bool readonly);
 int iommufd_backend_map_dma(IOMMUFDBackend *be, uint32_t ioas_id, hwaddr iova,
-                            ram_addr_t size, void *vaddr, bool readonly);
+                            uint64_t size, void *vaddr, bool readonly);
 int iommufd_backend_unmap_dma(IOMMUFDBackend *be, uint32_t ioas_id,
-                              hwaddr iova, ram_addr_t size);
+                              hwaddr iova, uint64_t size);
 bool iommufd_backend_get_device_info(IOMMUFDBackend *be, uint32_t devid,
                                      uint32_t *type, void *data, uint32_t len,
                                      uint64_t *caps, Error **errp);

From 5764a715277afc4d6076fbf2bae1697dbd2fa182 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 14:35:26 +0200
Subject: [PATCH 0864/2396] hw/vfio: Reorder
 vfio_container_query_dirty_bitmap() trace format
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the trace-events comments after the changes from
commit dcce51b1938 ("hw/vfio/container-base.c: rename file
to container.c") and commit a3bcae62b6a ("hw/vfio/container.c:
rename file to container-legacy.c").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-3-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/trace-events | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index 7496e1b64b..b1b470cc29 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -104,10 +104,10 @@ vfio_device_dirty_tracking_update(uint64_t start, uint64_t end, uint64_t min, ui
 vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32, uint64_t min64, uint64_t max64, uint64_t minpci, uint64_t maxpci) "nr_ranges %d 32:[0x%"PRIx64" - 0x%"PRIx64"], 64:[0x%"PRIx64" - 0x%"PRIx64"], pci64:[0x%"PRIx64" - 0x%"PRIx64"]"
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
 
-# container-base.c
+# container.c
 vfio_container_query_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
 
-# container.c
+# container-legacy.c
 vfio_container_disconnect(int fd) "close container->fd=%d"
 vfio_group_put(int fd) "close group->fd=%d"
 vfio_device_get(const char * name, unsigned int flags, unsigned int num_regions, unsigned int num_irqs) "Device %s flags: %u, regions: %u, irqs: %u"

From 0ca70d3bf722a94c53f254670e6a642e77aa077c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 14:35:27 +0200
Subject: [PATCH 0865/2396] hw/vfio: Avoid ram_addr_t in
 vfio_container_query_dirty_bitmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ram_addr_t' type is described as:

  a QEMU internal address space that maps guest RAM physical
  addresses into an intermediate address space that can map
  to host virtual address spaces.

vfio_container_query_dirty_bitmap() doesn't expect such QEMU
intermediate address, but a guest physical addresses. Use the
appropriate 'hwaddr' type, rename as @translated_addr for
clarity.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-4-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container.c              | 11 ++++++-----
 hw/vfio/listener.c               | 18 +++++++++---------
 hw/vfio/trace-events             |  2 +-
 include/hw/vfio/vfio-container.h |  3 ++-
 4 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 250b20f424..9d69439371 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -246,7 +246,7 @@ static int vfio_container_devices_query_dirty_bitmap(
 
 int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
                                       uint64_t iova, uint64_t size,
-                                      ram_addr_t ram_addr, Error **errp)
+                                      hwaddr translated_addr, Error **errp)
 {
     bool all_device_dirty_tracking =
         vfio_container_devices_dirty_tracking_is_supported(bcontainer);
@@ -255,7 +255,7 @@ int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
     int ret;
 
     if (!bcontainer->dirty_pages_supported && !all_device_dirty_tracking) {
-        cpu_physical_memory_set_dirty_range(ram_addr, size,
+        cpu_physical_memory_set_dirty_range(translated_addr, size,
                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
                                             DIRTY_CLIENTS_NOCODE);
         return 0;
@@ -280,11 +280,12 @@ int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
         goto out;
     }
 
-    dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap, ram_addr,
+    dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
+                                                         translated_addr,
                                                          vbmap.pages);
 
-    trace_vfio_container_query_dirty_bitmap(iova, size, vbmap.size, ram_addr,
-                                            dirty_pages);
+    trace_vfio_container_query_dirty_bitmap(iova, size, vbmap.size,
+                                            translated_addr, dirty_pages);
 out:
     g_free(vbmap.bitmap);
 
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 3b6f17f0c3..a2c19a3cec 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -1059,7 +1059,7 @@ static void vfio_iommu_map_dirty_notify(IOMMUNotifier *n, IOMMUTLBEntry *iotlb)
     VFIOGuestIOMMU *giommu = gdn->giommu;
     VFIOContainer *bcontainer = giommu->bcontainer;
     hwaddr iova = iotlb->iova + giommu->iommu_offset;
-    ram_addr_t translated_addr;
+    hwaddr translated_addr;
     Error *local_err = NULL;
     int ret = -EINVAL;
     MemoryRegion *mr;
@@ -1108,8 +1108,8 @@ static int vfio_ram_discard_query_dirty_bitmap(MemoryRegionSection *section,
 {
     const hwaddr size = int128_get64(section->size);
     const hwaddr iova = section->offset_within_address_space;
-    const ram_addr_t ram_addr = memory_region_get_ram_addr(section->mr) +
-                                section->offset_within_region;
+    const hwaddr translated_addr = memory_region_get_ram_addr(section->mr) +
+                                   section->offset_within_region;
     VFIORamDiscardListener *vrdl = opaque;
     Error *local_err = NULL;
     int ret;
@@ -1118,8 +1118,8 @@ static int vfio_ram_discard_query_dirty_bitmap(MemoryRegionSection *section,
      * Sync the whole mapped region (spanning multiple individual mappings)
      * in one go.
      */
-    ret = vfio_container_query_dirty_bitmap(vrdl->bcontainer, iova, size, ram_addr,
-                                &local_err);
+    ret = vfio_container_query_dirty_bitmap(vrdl->bcontainer, iova, size,
+                                            translated_addr, &local_err);
     if (ret) {
         error_report_err(local_err);
     }
@@ -1183,7 +1183,7 @@ static int vfio_sync_iommu_dirty_bitmap(VFIOContainer *bcontainer,
 static int vfio_sync_dirty_bitmap(VFIOContainer *bcontainer,
                                   MemoryRegionSection *section, Error **errp)
 {
-    ram_addr_t ram_addr;
+    hwaddr translated_addr;
 
     if (memory_region_is_iommu(section->mr)) {
         return vfio_sync_iommu_dirty_bitmap(bcontainer, section);
@@ -1198,12 +1198,12 @@ static int vfio_sync_dirty_bitmap(VFIOContainer *bcontainer,
         return ret;
     }
 
-    ram_addr = memory_region_get_ram_addr(section->mr) +
-               section->offset_within_region;
+    translated_addr = memory_region_get_ram_addr(section->mr) +
+                      section->offset_within_region;
 
     return vfio_container_query_dirty_bitmap(bcontainer,
                    REAL_HOST_PAGE_ALIGN(section->offset_within_address_space),
-                                 int128_get64(section->size), ram_addr, errp);
+                   int128_get64(section->size), translated_addr, errp);
 }
 
 static void vfio_listener_log_sync(MemoryListener *listener,
diff --git a/hw/vfio/trace-events b/hw/vfio/trace-events
index b1b470cc29..1e895448cd 100644
--- a/hw/vfio/trace-events
+++ b/hw/vfio/trace-events
@@ -105,7 +105,7 @@ vfio_device_dirty_tracking_start(int nr_ranges, uint64_t min32, uint64_t max32,
 vfio_iommu_map_dirty_notify(uint64_t iova_start, uint64_t iova_end) "iommu dirty @ 0x%"PRIx64" - 0x%"PRIx64
 
 # container.c
-vfio_container_query_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t start, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" start=0x%"PRIx64" dirty_pages=%"PRIu64
+vfio_container_query_dirty_bitmap(uint64_t iova, uint64_t size, uint64_t bitmap_size, uint64_t translated_addr, uint64_t dirty_pages) "iova=0x%"PRIx64" size= 0x%"PRIx64" bitmap_size=0x%"PRIx64" gpa=0x%"PRIx64" dirty_pages=%"PRIu64
 
 # container-legacy.c
 vfio_container_disconnect(int fd) "close container->fd=%d"
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index b8fb2b8b5d..093c360f0e 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -98,7 +98,8 @@ bool vfio_container_dirty_tracking_is_started(
 bool vfio_container_devices_dirty_tracking_is_supported(
     const VFIOContainer *bcontainer);
 int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
-    uint64_t iova, uint64_t size, ram_addr_t ram_addr, Error **errp);
+                                      uint64_t iova, uint64_t size,
+                                      hwaddr translated_addr, Error **errp);
 
 GList *vfio_container_get_iova_ranges(const VFIOContainer *bcontainer);
 

From f0b52aa08ab0868c18d881381a8fda4b59b37517 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 14:35:28 +0200
Subject: [PATCH 0866/2396] hw/vfio: Use uint64_t for IOVA mapping size in
 vfio_container_dma_*map
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ram_addr_t' type is described as:

  a QEMU internal address space that maps guest RAM physical
  addresses into an intermediate address space that can map
  to host virtual address spaces.

This doesn't represent well an IOVA mapping size. Simply use
the uint64_t type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250930123528.42878-5-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/container.c         |  4 ++--
 hw/vfio/container-legacy.c       |  8 ++++----
 hw/vfio/container.c              |  4 ++--
 hw/vfio/cpr-legacy.c             |  2 +-
 hw/vfio/iommufd.c                |  6 +++---
 include/hw/vfio/vfio-container.h | 10 +++++-----
 include/hw/vfio/vfio-cpr.h       |  2 +-
 7 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index 411eb7b28b..e45192fef6 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -39,7 +39,7 @@ static void vfio_user_listener_commit(VFIOContainer *bcontainer)
 }
 
 static int vfio_user_dma_unmap(const VFIOContainer *bcontainer,
-                               hwaddr iova, ram_addr_t size,
+                               hwaddr iova, uint64_t size,
                                IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
@@ -81,7 +81,7 @@ static int vfio_user_dma_unmap(const VFIOContainer *bcontainer,
 }
 
 static int vfio_user_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
-                             ram_addr_t size, void *vaddr, bool readonly,
+                             uint64_t size, void *vaddr, bool readonly,
                              MemoryRegion *mrp)
 {
     VFIOUserContainer *container = VFIO_IOMMU_USER(bcontainer);
diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index 25a15ea867..34352dd31f 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -69,7 +69,7 @@ static int vfio_ram_block_discard_disable(VFIOLegacyContainer *container,
 }
 
 static int vfio_dma_unmap_bitmap(const VFIOLegacyContainer *container,
-                                 hwaddr iova, ram_addr_t size,
+                                 hwaddr iova, uint64_t size,
                                  IOMMUTLBEntry *iotlb)
 {
     const VFIOContainer *bcontainer = VFIO_IOMMU(container);
@@ -122,7 +122,7 @@ unmap_exit:
 }
 
 static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
-                                     hwaddr iova, ram_addr_t size,
+                                     hwaddr iova, uint64_t size,
                                      IOMMUTLBEntry *iotlb)
 {
     const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
@@ -167,7 +167,7 @@ static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
  * DMA - Mapping and unmapping for the "type1" IOMMU interface used on x86
  */
 static int vfio_legacy_dma_unmap(const VFIOContainer *bcontainer,
-                                 hwaddr iova, ram_addr_t size,
+                                 hwaddr iova, uint64_t size,
                                  IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     int ret;
@@ -192,7 +192,7 @@ static int vfio_legacy_dma_unmap(const VFIOContainer *bcontainer,
 }
 
 static int vfio_legacy_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
-                               ram_addr_t size, void *vaddr, bool readonly,
+                               uint64_t size, void *vaddr, bool readonly,
                                MemoryRegion *mr)
 {
     const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 9d69439371..41de343924 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -74,7 +74,7 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
 }
 
 int vfio_container_dma_map(VFIOContainer *bcontainer,
-                           hwaddr iova, ram_addr_t size,
+                           hwaddr iova, uint64_t size,
                            void *vaddr, bool readonly, MemoryRegion *mr)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
@@ -93,7 +93,7 @@ int vfio_container_dma_map(VFIOContainer *bcontainer,
 }
 
 int vfio_container_dma_unmap(VFIOContainer *bcontainer,
-                             hwaddr iova, ram_addr_t size,
+                             hwaddr iova, uint64_t size,
                              IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     VFIOIOMMUClass *vioc = VFIO_IOMMU_GET_CLASS(bcontainer);
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index bbf7a0d35f..3a1d126556 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -39,7 +39,7 @@ static bool vfio_dma_unmap_vaddr_all(VFIOLegacyContainer *container,
  * The incoming state is cleared thereafter.
  */
 static int vfio_legacy_cpr_dma_map(const VFIOContainer *bcontainer,
-                                   hwaddr iova, ram_addr_t size, void *vaddr,
+                                   hwaddr iova, uint64_t size, void *vaddr,
                                    bool readonly, MemoryRegion *mr)
 {
     const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index f0ffe23591..68470d552e 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -35,7 +35,7 @@
             TYPE_HOST_IOMMU_DEVICE_IOMMUFD "-vfio"
 
 static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
-                            ram_addr_t size, void *vaddr, bool readonly,
+                            uint64_t size, void *vaddr, bool readonly,
                             MemoryRegion *mr)
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
@@ -46,7 +46,7 @@ static int iommufd_cdev_map(const VFIOContainer *bcontainer, hwaddr iova,
 }
 
 static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
-                                 hwaddr iova, ram_addr_t size,
+                                 hwaddr iova, uint64_t size,
                                  int fd, unsigned long start, bool readonly)
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
@@ -57,7 +57,7 @@ static int iommufd_cdev_map_file(const VFIOContainer *bcontainer,
 }
 
 static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
-                              hwaddr iova, ram_addr_t size,
+                              hwaddr iova, uint64_t size,
                               IOMMUTLBEntry *iotlb, bool unmap_all)
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
diff --git a/include/hw/vfio/vfio-container.h b/include/hw/vfio/vfio-container.h
index 093c360f0e..c4b58d664b 100644
--- a/include/hw/vfio/vfio-container.h
+++ b/include/hw/vfio/vfio-container.h
@@ -81,10 +81,10 @@ void vfio_address_space_insert(VFIOAddressSpace *space,
                                VFIOContainer *bcontainer);
 
 int vfio_container_dma_map(VFIOContainer *bcontainer,
-                           hwaddr iova, ram_addr_t size,
+                           hwaddr iova, uint64_t size,
                            void *vaddr, bool readonly, MemoryRegion *mr);
 int vfio_container_dma_unmap(VFIOContainer *bcontainer,
-                             hwaddr iova, ram_addr_t size,
+                             hwaddr iova, uint64_t size,
                              IOMMUTLBEntry *iotlb, bool unmap_all);
 bool vfio_container_add_section_window(VFIOContainer *bcontainer,
                                        MemoryRegionSection *section,
@@ -167,7 +167,7 @@ struct VFIOIOMMUClass {
      * Returns 0 to indicate success and -errno otherwise.
      */
     int (*dma_map)(const VFIOContainer *bcontainer,
-                   hwaddr iova, ram_addr_t size,
+                   hwaddr iova, uint64_t size,
                    void *vaddr, bool readonly, MemoryRegion *mr);
     /**
      * @dma_map_file
@@ -182,7 +182,7 @@ struct VFIOIOMMUClass {
      * @readonly: map read only if true
      */
     int (*dma_map_file)(const VFIOContainer *bcontainer,
-                        hwaddr iova, ram_addr_t size,
+                        hwaddr iova, uint64_t size,
                         int fd, unsigned long start, bool readonly);
     /**
      * @dma_unmap
@@ -198,7 +198,7 @@ struct VFIOIOMMUClass {
      * Returns 0 to indicate success and -errno otherwise.
      */
     int (*dma_unmap)(const VFIOContainer *bcontainer,
-                     hwaddr iova, ram_addr_t size,
+                     hwaddr iova, uint64_t size,
                      IOMMUTLBEntry *iotlb, bool unmap_all);
 
 
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 26ee0c4fe1..81f4e24e22 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -21,7 +21,7 @@ struct VFIOIOMMUFDContainer;
 struct IOMMUFDBackend;
 
 typedef int (*dma_map_fn)(const struct VFIOContainer *bcontainer,
-                          hwaddr iova, ram_addr_t size, void *vaddr,
+                          hwaddr iova, uint64_t size, void *vaddr,
                           bool readonly, MemoryRegion *mr);
 
 typedef struct VFIOContainerCPR {

From 30478e2ff7839a692c3894ae5f6c28e780f0bc6d Mon Sep 17 00:00:00 2001
From: TANG Tiancheng <lyndra@linux.alibaba.com>
Date: Thu, 11 Sep 2025 17:56:14 +0800
Subject: [PATCH 0867/2396] migration: Add support for a variable-length array
 of UINT32 pointers

Add support for defining a vmstate field which is a variable-length array
of pointers, and use this to define a VMSTATE_TIMER_PTR_VARRAY() which allows
a variable-length array of QEMUTimer* to be used by devices.

Message-id: 20250909-timers-v1-0-7ee18a9d8f4b@linux.alibaba.com
Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911-timers-v3-2-60508f640050@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/migration/vmstate.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 1ff7bd9ac4..1cfddf31b5 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -522,6 +522,16 @@ extern const VMStateInfo vmstate_info_qlist;
     .offset     = vmstate_offset_array(_s, _f, _type*, _n),          \
 }
 
+#define VMSTATE_VARRAY_OF_POINTER_UINT32(_field, _state, _field_num, _version, _info, _type) { \
+    .name       = (stringify(_field)),                                    \
+    .version_id = (_version),                                             \
+    .num_offset = vmstate_offset_value(_state, _field_num, uint32_t),     \
+    .info       = &(_info),                                               \
+    .size       = sizeof(_type),                                          \
+    .flags      = VMS_VARRAY_UINT32 | VMS_ARRAY_OF_POINTER | VMS_POINTER, \
+    .offset     = vmstate_offset_pointer(_state, _field, _type),          \
+}
+
 #define VMSTATE_STRUCT_SUB_ARRAY(_field, _state, _start, _num, _version, _vmsd, _type) { \
     .name       = (stringify(_field)),                                     \
     .version_id = (_version),                                              \

From 09f89ccc9763a20c0cf9030661af2c04647c1eec Mon Sep 17 00:00:00 2001
From: TANG Tiancheng <lyndra@linux.alibaba.com>
Date: Thu, 11 Sep 2025 17:56:15 +0800
Subject: [PATCH 0868/2396] hw/intc: Save timers array in RISC-V mtimer VMState

The current 'timecmp' field in vmstate_riscv_mtimer is insufficient to keep
timers functional after migration.

If an mtimer's entry in 'mtimer->timers' is active at the time the snapshot
is taken, it means riscv_aclint_mtimer_write_timecmp() has written to
'mtimecmp' and scheduled a timer into QEMU's main loop 'timer_list'.

During snapshot save, these active timers must also be migrated; otherwise,
after snapshot load there is no mechanism to restore 'mtimer->timers' back
into the 'timer_list', and any pending timer events would be lost.

QEMU's migration framework commonly uses VMSTATE_TIMER_xxx macros to save
and restore 'QEMUTimer' variables. However, 'timers' is a pointer array
with variable length, and vmstate.h did not previously provide a helper
macro for such type.

This commit adds a new macro, 'VMSTATE_TIMER_PTR_VARRAY', to handle saving
and restoring a variable-length array of 'QEMUTimer *'. We then use this
macro to migrate the 'mtimer->timers' array, ensuring that timer events
remain scheduled correctly after snapshot load.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911-timers-v3-3-60508f640050@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c         | 6 ++++--
 include/hw/intc/riscv_aclint.h | 4 ++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index 318a9c8248..9f4c36e965 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -323,13 +323,15 @@ static void riscv_aclint_mtimer_reset_enter(Object *obj, ResetType type)
 
 static const VMStateDescription vmstate_riscv_mtimer = {
     .name = "riscv_mtimer",
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
             VMSTATE_UINT64(time_delta, RISCVAclintMTimerState),
             VMSTATE_VARRAY_UINT32(timecmp, RISCVAclintMTimerState,
                                   num_harts, 0,
                                   vmstate_info_uint64, uint64_t),
+            VMSTATE_TIMER_PTR_VARRAY(timers, RISCVAclintMTimerState,
+                                     num_harts),
             VMSTATE_END_OF_LIST()
         }
 };
diff --git a/include/hw/intc/riscv_aclint.h b/include/hw/intc/riscv_aclint.h
index 693415eb6d..4b7406eec0 100644
--- a/include/hw/intc/riscv_aclint.h
+++ b/include/hw/intc/riscv_aclint.h
@@ -80,4 +80,8 @@ enum {
     RISCV_ACLINT_SWI_SIZE              = 0x4000
 };
 
+#define VMSTATE_TIMER_PTR_VARRAY(_f, _s, _f_n)                        \
+VMSTATE_VARRAY_OF_POINTER_UINT32(_f, _s, _f_n, 0, vmstate_info_timer, \
+                                                        QEMUTimer *)
+
 #endif

From b0daaa172a1cd7e8bc8320bfd6612edbebef157f Mon Sep 17 00:00:00 2001
From: TANG Tiancheng <lyndra@linux.alibaba.com>
Date: Thu, 11 Sep 2025 17:56:16 +0800
Subject: [PATCH 0869/2396] target/riscv: Save stimer and vstimer in CPU
 vmstate

vmstate_riscv_cpu was missing env.stimer and env.vstimer.
Without migrating these QEMUTimer fields, active S/VS-mode
timer events are lost after snapshot or migration.

Add VMSTATE_TIMER_PTR() entries to save and restore them.

Reviewed-by: LIU Zhiwei <zhiwei_liu@linux.alibaba.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: TANG Tiancheng <lyndra@linux.alibaba.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250911-timers-v3-4-60508f640050@linux.alibaba.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/machine.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index 1600ec44f0..51e0567ed3 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -400,6 +400,30 @@ static const VMStateDescription vmstate_ssp = {
     }
 };
 
+static bool sstc_timer_needed(void *opaque)
+{
+    RISCVCPU *cpu = opaque;
+    CPURISCVState *env = &cpu->env;
+
+    if (!cpu->cfg.ext_sstc) {
+        return false;
+    }
+
+    return env->stimer != NULL || env->vstimer != NULL;
+}
+
+static const VMStateDescription vmstate_sstc = {
+    .name = "cpu/timer",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = sstc_timer_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_TIMER_PTR(env.stimer, RISCVCPU),
+        VMSTATE_TIMER_PTR(env.vstimer, RISCVCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 const VMStateDescription vmstate_riscv_cpu = {
     .name = "cpu",
     .version_id = 10,
@@ -476,6 +500,7 @@ const VMStateDescription vmstate_riscv_cpu = {
         &vmstate_elp,
         &vmstate_ssp,
         &vmstate_ctr,
+        &vmstate_sstc,
         NULL
     }
 };

From c69fc80035b708a8b997cbab0d393e2702364a3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:45:15 +0200
Subject: [PATCH 0870/2396] target/riscv/kvm: Use riscv_cpu_is_32bit() when
 handling SBI_DBCN reg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the existing riscv_cpu_is_32bit() helper to check for 32-bit CPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Andrew Jones <ajones@ventanamicro.com>
Message-ID: <20250924164515.51782-1-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 5c19062c19..187c2c9501 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1588,7 +1588,7 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
          * Handle the case where a 32 bit CPU is running in a
          * 64 bit addressing env.
          */
-        if (riscv_cpu_mxl(&cpu->env) == MXL_RV32) {
+        if (riscv_cpu_is_32bit(cpu)) {
             addr |= (uint64_t)run->riscv_sbi.args[2] << 32;
         }
 

From cebaf7434b4af059caca053ee1ec7ed8df91c2a7 Mon Sep 17 00:00:00 2001
From: stove <stove@rivosinc.com>
Date: Wed, 27 Aug 2025 13:36:17 -0700
Subject: [PATCH 0871/2396] target/riscv: use riscv_csrr in riscv_csr_read

Commit 38c83e8d3a33 ("target/riscv: raise an exception when CSRRS/CSRRC
writes a read-only CSR") changed the behavior of riscv_csrrw, which
would formerly be treated as read-only if the write mask were set to 0.

Fixes an exception being raised when accessing read-only vector CSRs
like vtype.

Fixes: 38c83e8d3a33 ("target/riscv: raise an exception when CSRRS/CSRRC writes a read-only CSR")

Signed-off-by: stove <stove@rivosinc.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20250827203617.79947-1-stove@rivosinc.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 738e68fa6e..2c2266415e 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -874,7 +874,7 @@ static inline void riscv_csr_write(CPURISCVState *env, int csrno,
 static inline target_ulong riscv_csr_read(CPURISCVState *env, int csrno)
 {
     target_ulong val = 0;
-    riscv_csrrw(env, csrno, &val, 0, 0, 0);
+    riscv_csrr(env, csrno, &val);
     return val;
 }
 

From ec139c3dd00599e3e71b28c30b8207f6f15207c7 Mon Sep 17 00:00:00 2001
From: Xuemei Liu <liu.xuemei1@zte.com.cn>
Date: Wed, 24 Sep 2025 13:18:03 +0800
Subject: [PATCH 0872/2396] qemu/osdep: align memory allocations to 2M on
 RISC-V

Similar to other architectures (e.g., x86_64, aarch64), utilizing THP on RISC-V
KVM requires 2MiB-aligned memory blocks.

Signed-off-by: Xuemei Liu <liu.xuemei1@zte.com.cn>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-ID: <20250924131803656Yqt9ZJKfevWkInaGppFdE@zte.com.cn>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 include/qemu/osdep.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 1b38cb7e45..6de6c0c4e5 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -561,7 +561,7 @@ int madvise(char *, size_t, int);
 
 #if defined(__linux__) && \
     (defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) \
-     || defined(__powerpc64__))
+     || defined(__powerpc64__) || defined(__riscv))
    /* Use 2 MiB alignment so transparent hugepages can be used by KVM.
       Valgrind does not support alignments larger than 1 MiB,
       therefore we need special code which handles running on Valgrind. */

From a86d3352ab70f33f5feabbf9bad9450d3c19d0bf Mon Sep 17 00:00:00 2001
From: Vladimir Isaev <vladimir.isaev@syntacore.com>
Date: Fri, 15 Aug 2025 17:06:33 +0300
Subject: [PATCH 0873/2396] target/riscv: do not use translator_ldl in
 opcode_at

opcode_at is used only in semihosting checks to match opcodes with expected
pattern.

This is not a translator and if we got following assert if page is not in TLB:
qemu-system-riscv64: ../accel/tcg/translator.c:363: record_save: Assertion
`offset == db->record_start + db->record_len' failed.

Fixes: 1f9c4462334f ("target/riscv: Use translator_ld* for everything")
Signed-off-by: Vladimir Isaev <vladimir.isaev@syntacore.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250815140633.86920-1-vladimir.isaev@syntacore.com>
[ Changes by AF:
 - Fixup header includes after rebase
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/translate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 9ddef2d6e2..6fc06c71f5 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -24,6 +24,7 @@
 #include "exec/helper-gen.h"
 #include "exec/target_page.h"
 #include "exec/translator.h"
+#include "accel/tcg/cpu-ldst.h"
 #include "exec/translation-block.h"
 #include "exec/log.h"
 #include "semihosting/semihost.h"
@@ -1166,7 +1167,7 @@ static uint32_t opcode_at(DisasContextBase *dcbase, target_ulong pc)
     CPUState *cpu = ctx->cs;
     CPURISCVState *env = cpu_env(cpu);
 
-    return translator_ldl(env, &ctx->base, pc);
+    return cpu_ldl_code(env, pc);
 }
 
 #define SS_MMU_INDEX(ctx) (ctx->mem_idx | MMU_IDX_SS_WRITE)

From c851052a77fd79300708df2070297b5428b4be8d Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Wed, 24 Sep 2025 15:48:16 +0800
Subject: [PATCH 0874/2396] target/riscv: Fix the mepc when sspopchk triggers
 the exception

When sspopchk is in the middle of TB and triggers the SW check
exception, it should update PC from gen_update_pc(). If not, RISC-V mepc
CSR will get wrong PC address which is still at the start of TB.

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250924074818.230010-2-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzicfiss.c.inc | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index b0096adcd0..45686af4d6 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -40,6 +40,7 @@ static bool trans_sspopchk(DisasContext *ctx, arg_sspopchk *a)
     tcg_gen_brcond_tl(TCG_COND_EQ, data, rs1, skip);
     tcg_gen_st_tl(tcg_constant_tl(RISCV_EXCP_SW_CHECK_BCFI_TVAL),
                   tcg_env, offsetof(CPURISCVState, sw_check_code));
+    gen_update_pc(ctx, 0);
     gen_helper_raise_exception(tcg_env,
                   tcg_constant_i32(RISCV_EXCP_SW_CHECK));
     gen_set_label(skip);

From 84c1605b7606d810ded4c1c3a2717f158dc89e3f Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Wed, 24 Sep 2025 15:48:17 +0800
Subject: [PATCH 0875/2396] target/riscv: Fix SSP CSR error handling in VU/VS
 mode

In VU/VS mode, accessing $ssp CSR will trigger the virtual instruction
exception instead of illegal instruction exception if SSE is disabled
via xenvcfg CSRs.

This is from RISC-V CFI v1.0 spec ch2.2.4. Shadow Stack Pointer

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250924074818.230010-3-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/csr.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index 3c8989f522..ea36eccb3d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -203,6 +203,8 @@ static RISCVException cfi_ss(CPURISCVState *env, int csrno)
 #if !defined(CONFIG_USER_ONLY)
         if (env->debugger) {
             return RISCV_EXCP_NONE;
+        } else if (env->virt_enabled) {
+            return RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
         }
 #endif
         return RISCV_EXCP_ILLEGAL_INST;

From 0b16c7b6a854d461cdfd418769b51d58e43dd92a Mon Sep 17 00:00:00 2001
From: Jim Shu <jim.shu@sifive.com>
Date: Wed, 24 Sep 2025 15:48:18 +0800
Subject: [PATCH 0876/2396] target/riscv: Fix ssamoswap error handling

Follow the RISC-V CFI v1.0 spec [1] to fix the exception type
when ssamoswap is disabled by xSSE.

[1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location

Signed-off-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250924074818.230010-4-jim.shu@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                         |  5 ++
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  8 +++
 target/riscv/op_helper.c                      | 49 +++++++++++++++++++
 3 files changed, 62 insertions(+)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index f712b1c368..c82bacdc39 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1284,3 +1284,8 @@ DEF_HELPER_4(vgmul_vv, void, ptr, ptr, env, i32)
 DEF_HELPER_5(vsm4k_vi, void, ptr, ptr, i32, env, i32)
 DEF_HELPER_4(vsm4r_vv, void, ptr, ptr, env, i32)
 DEF_HELPER_4(vsm4r_vs, void, ptr, ptr, env, i32)
+
+/* CFI (zicfiss) helpers */
+#ifndef CONFIG_USER_ONLY
+DEF_HELPER_1(ssamoswap_disabled, void, env)
+#endif
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index 45686af4d6..f4a1c12ca0 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -91,7 +91,11 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
     }
 
     if (!ctx->bcfi_enabled) {
+#ifndef CONFIG_USER_ONLY
+        gen_helper_ssamoswap_disabled(tcg_env);
+#else
         return false;
+#endif
     }
 
     TCGv dest = dest_gpr(ctx, a->rd);
@@ -116,7 +120,11 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
     }
 
     if (!ctx->bcfi_enabled) {
+#ifndef CONFIG_USER_ONLY
+        gen_helper_ssamoswap_disabled(tcg_env);
+#else
         return false;
+#endif
     }
 
     TCGv dest = dest_gpr(ctx, a->rd);
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 110292e84d..8382aa94cb 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -717,4 +717,53 @@ target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
     return cpu_ldl_code_mmu(env, addr, oi, ra);
 }
 
+void helper_ssamoswap_disabled(CPURISCVState *env)
+{
+    int exception = RISCV_EXCP_ILLEGAL_INST;
+
+    /*
+     * Here we follow the RISC-V CFI spec [1] to implement the exception type
+     * of ssamoswap* instruction.
+     *
+     * [1] RISC-V CFI spec v1.0, ch2.7 Atomic Swap from a Shadow Stack Location
+     *
+     * Note: We have already checked some conditions in trans_* functions:
+     *   1. The effective priv mode is not M-mode.
+     *   2. The xSSE specific to the effictive priv mode is disabled.
+     */
+    if (!get_field(env->menvcfg, MENVCFG_SSE)) {
+        /*
+         * Disabled M-mode SSE always trigger illegal instruction when
+         * current priv mode is not M-mode.
+         */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    }
+
+    if (!riscv_has_ext(env, RVS)) {
+        /* S-mode is not implemented */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    } else if (env->virt_enabled) {
+        /*
+         * VU/VS-mode with disabled xSSE will trigger the virtual instruction
+         * exception.
+         */
+        exception = RISCV_EXCP_VIRT_INSTRUCTION_FAULT;
+        goto done;
+    } else {
+        /*
+         * U-mode with disabled S-mode SSE will trigger the illegal instruction
+         * exception.
+         *
+         * Note: S-mode is already handled in the disabled M-mode SSE case.
+         */
+        exception = RISCV_EXCP_ILLEGAL_INST;
+        goto done;
+    }
+
+done:
+    riscv_raise_exception(env, exception, GETPC());
+}
+
 #endif /* !CONFIG_USER_ONLY */

From ae4a37f57818e47e212272821a5a86ad54620eb8 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 23 Sep 2025 17:07:28 +0800
Subject: [PATCH 0877/2396] target/riscv: rvv: Replace checking V by checking
 Zve32x

The Zve32x extension will be applied by the V and Zve* extensions.
Therefore we can replace the original V checking with Zve32x checking for both
the V and Zve* extensions.

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250923090729.1887406-2-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c            | 2 +-
 target/riscv/csr.c            | 3 ++-
 target/riscv/machine.c        | 3 ++-
 target/riscv/riscv-qmp-cmds.c | 2 +-
 target/riscv/tcg/tcg-cpu.c    | 2 +-
 5 files changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index d055ddf462..a877018ab0 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -604,7 +604,7 @@ static void riscv_cpu_dump_state(CPUState *cs, FILE *f, int flags)
             }
         }
     }
-    if (riscv_has_ext(env, RVV) && (flags & CPU_DUMP_VPU)) {
+    if (riscv_cpu_cfg(env)->ext_zve32x && (flags & CPU_DUMP_VPU)) {
         static const int dump_rvv_csrs[] = {
                     CSR_VSTART,
                     CSR_VXSAT,
diff --git a/target/riscv/csr.c b/target/riscv/csr.c
index ea36eccb3d..5c91658c3d 100644
--- a/target/riscv/csr.c
+++ b/target/riscv/csr.c
@@ -2005,7 +2005,8 @@ static RISCVException write_mstatus(CPURISCVState *env, int csrno,
     if (riscv_has_ext(env, RVF)) {
         mask |= MSTATUS_FS;
     }
-    if (riscv_has_ext(env, RVV)) {
+
+    if (riscv_cpu_cfg(env)->ext_zve32x) {
         mask |= MSTATUS_VS;
     }
 
diff --git a/target/riscv/machine.c b/target/riscv/machine.c
index 51e0567ed3..18d790af0d 100644
--- a/target/riscv/machine.c
+++ b/target/riscv/machine.c
@@ -131,7 +131,8 @@ static bool vector_needed(void *opaque)
     RISCVCPU *cpu = opaque;
     CPURISCVState *env = &cpu->env;
 
-    return riscv_has_ext(env, RVV);
+    return kvm_enabled() ? riscv_has_ext(env, RVV) :
+                           riscv_cpu_cfg(env)->ext_zve32x;
 }
 
 static const VMStateDescription vmstate_vector = {
diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index b63de8dd45..c499f9b9a7 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -342,7 +342,7 @@ int target_get_monitor_def(CPUState *cs, const char *name, uint64_t *pval)
     }
 
     if (reg_is_vreg(name)) {
-        if (!riscv_has_ext(env, RVV)) {
+        if (!riscv_cpu_cfg(env)->ext_zve32x) {
             return -EINVAL;
         }
 
diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 143ab079d4..b3b7f14503 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -661,7 +661,7 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (riscv_has_ext(env, RVV)) {
+    if (cpu->cfg.ext_zve32x) {
         riscv_cpu_validate_v(env, &cpu->cfg, &local_err);
         if (local_err != NULL) {
             error_propagate(errp, local_err);

From be50ff3a73859ebbbdc0e6f704793062b1743d93 Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Tue, 23 Sep 2025 17:07:29 +0800
Subject: [PATCH 0878/2396] target/riscv: rvv: Modify minimum VLEN according to
 enabled vector extensions

According to the RISC-V unprivileged specification, the VLEN should be greater
or equal to the ELEN. This commit modifies the minimum VLEN based on the vector
extensions and introduces a check rule for VLEN and ELEN.

  Extension     Minimum VLEN
* V                      128
* Zve64[d|f|x]            64
* Zve32[f|x]              32

Signed-off-by: Max Chou <max.chou@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250923090729.1887406-3-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index b3b7f14503..1150bd1469 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -417,12 +417,21 @@ static void riscv_cpu_validate_misa_priv(CPURISCVState *env, Error **errp)
 static void riscv_cpu_validate_v(CPURISCVState *env, RISCVCPUConfig *cfg,
                                  Error **errp)
 {
+    uint32_t min_vlen;
     uint32_t vlen = cfg->vlenb << 3;
 
-    if (vlen > RV_VLEN_MAX || vlen < 128) {
+    if (riscv_has_ext(env, RVV)) {
+        min_vlen = 128;
+    } else if (cfg->ext_zve64x) {
+        min_vlen = 64;
+    } else if (cfg->ext_zve32x) {
+        min_vlen = 32;
+    }
+
+    if (vlen > RV_VLEN_MAX || vlen < min_vlen) {
         error_setg(errp,
                    "Vector extension implementation only supports VLEN "
-                   "in the range [128, %d]", RV_VLEN_MAX);
+                   "in the range [%d, %d]", min_vlen, RV_VLEN_MAX);
         return;
     }
 
@@ -432,6 +441,12 @@ static void riscv_cpu_validate_v(CPURISCVState *env, RISCVCPUConfig *cfg,
                    "in the range [8, 64]");
         return;
     }
+
+    if (vlen < cfg->elen) {
+        error_setg(errp, "Vector extension implementation requires VLEN "
+                         "to be greater than or equal to ELEN");
+        return;
+    }
 }
 
 static void riscv_cpu_disable_priv_spec_isa_exts(RISCVCPU *cpu)

From 81d1885dcc4424fec6761120f6e251eb3408fb8e Mon Sep 17 00:00:00 2001
From: Max Chou <max.chou@sifive.com>
Date: Fri, 24 Jan 2025 15:33:22 +0800
Subject: [PATCH 0879/2396] target/riscv: rvv: Fix vslide1[up|down].vx
 unexpected result when XLEN=32 and SEW=64

When XLEN is 32 and SEW is 64, the original implementation of
vslide1up.vx and vslide1down.vx helper functions fills the 32-bit value
of rs1 into the first element of the destination vector register (rd),
which is a 64-bit element.

This commit attempted to resolve the issue by extending the rs1 value
to 64 bits during the TCG translation phase to ensure that the helper
functions won't lost the higer 32 bits.

Signed-off-by: Max Chou <max.chou@sifive.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20250124073325.2467664-1-max.chou@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/helper.h                   | 16 ++++----
 target/riscv/insn_trans/trans_rvv.c.inc | 50 ++++++++++++++++++++++++-
 target/riscv/vector_helper.c            | 20 +++++-----
 3 files changed, 66 insertions(+), 20 deletions(-)

diff --git a/target/riscv/helper.h b/target/riscv/helper.h
index c82bacdc39..b785456ee0 100644
--- a/target/riscv/helper.h
+++ b/target/riscv/helper.h
@@ -1101,14 +1101,14 @@ DEF_HELPER_6(vslidedown_vx_b, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vslidedown_vx_h, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vslidedown_vx_w, void, ptr, ptr, tl, ptr, env, i32)
 DEF_HELPER_6(vslidedown_vx_d, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1up_vx_b, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1up_vx_h, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1up_vx_w, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1up_vx_d, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1down_vx_b, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1down_vx_h, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1down_vx_w, void, ptr, ptr, tl, ptr, env, i32)
-DEF_HELPER_6(vslide1down_vx_d, void, ptr, ptr, tl, ptr, env, i32)
+DEF_HELPER_6(vslide1up_vx_b, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1up_vx_h, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1up_vx_w, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1up_vx_d, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1down_vx_b, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1down_vx_h, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1down_vx_w, void, ptr, ptr, i64, ptr, env, i32)
+DEF_HELPER_6(vslide1down_vx_d, void, ptr, ptr, i64, ptr, env, i32)
 
 DEF_HELPER_6(vfslide1up_vf_h, void, ptr, ptr, i64, ptr, env, i32)
 DEF_HELPER_6(vfslide1up_vf_w, void, ptr, ptr, i64, ptr, env, i32)
diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index 71f98fb350..f4b5460340 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -3561,7 +3561,6 @@ static bool slideup_check(DisasContext *s, arg_rmrr *a)
 }
 
 GEN_OPIVX_TRANS(vslideup_vx, slideup_check)
-GEN_OPIVX_TRANS(vslide1up_vx, slideup_check)
 GEN_OPIVI_TRANS(vslideup_vi, IMM_ZX, vslideup_vx, slideup_check)
 
 static bool slidedown_check(DisasContext *s, arg_rmrr *a)
@@ -3572,9 +3571,56 @@ static bool slidedown_check(DisasContext *s, arg_rmrr *a)
 }
 
 GEN_OPIVX_TRANS(vslidedown_vx, slidedown_check)
-GEN_OPIVX_TRANS(vslide1down_vx, slidedown_check)
 GEN_OPIVI_TRANS(vslidedown_vi, IMM_ZX, vslidedown_vx, slidedown_check)
 
+typedef void gen_helper_vslide1_vx(TCGv_ptr, TCGv_ptr, TCGv_i64, TCGv_ptr,
+                                TCGv_env, TCGv_i32);
+
+#define GEN_OPIVX_VSLIDE1_TRANS(NAME, CHECK)                            \
+static bool trans_##NAME(DisasContext *s, arg_rmrr *a)                  \
+{                                                                       \
+    if (CHECK(s, a)) {                                                  \
+        static gen_helper_vslide1_vx * const fns[4] = {                 \
+            gen_helper_##NAME##_b, gen_helper_##NAME##_h,               \
+            gen_helper_##NAME##_w, gen_helper_##NAME##_d,               \
+        };                                                              \
+                                                                        \
+        TCGv_ptr dest, src2, mask;                                      \
+        TCGv_i64 src1;                                                  \
+        TCGv_i32 desc;                                                  \
+        uint32_t data = 0;                                              \
+                                                                        \
+        dest = tcg_temp_new_ptr();                                      \
+        mask = tcg_temp_new_ptr();                                      \
+        src2 = tcg_temp_new_ptr();                                      \
+        src1 = tcg_temp_new_i64();                                      \
+                                                                        \
+        data = FIELD_DP32(data, VDATA, VM, a->vm);                      \
+        data = FIELD_DP32(data, VDATA, LMUL, s->lmul);                  \
+        data = FIELD_DP32(data, VDATA, VTA, s->vta);                    \
+        data = FIELD_DP32(data, VDATA, VTA_ALL_1S, s->cfg_vta_all_1s);  \
+        data = FIELD_DP32(data, VDATA, VMA, s->vma);                    \
+        desc = tcg_constant_i32(simd_desc(s->cfg_ptr->vlenb,            \
+                                s->cfg_ptr->vlenb, data));              \
+                                                                        \
+        tcg_gen_addi_ptr(dest, tcg_env, vreg_ofs(s, a->rd));            \
+        tcg_gen_addi_ptr(src2, tcg_env, vreg_ofs(s, a->rs2));           \
+        tcg_gen_addi_ptr(mask, tcg_env, vreg_ofs(s, 0));                \
+        tcg_gen_ext_tl_i64(src1, get_gpr(s, a->rs1, EXT_SIGN));         \
+                                                                        \
+        fns[s->sew](dest, mask, src1, src2, tcg_env, desc);             \
+                                                                        \
+        tcg_gen_movi_tl(cpu_vstart, 0);                                 \
+        finalize_rvv_inst(s);                                           \
+                                                                        \
+        return true;                                                    \
+    }                                                                   \
+    return false;                                                       \
+}
+
+GEN_OPIVX_VSLIDE1_TRANS(vslide1up_vx, slideup_check)
+GEN_OPIVX_VSLIDE1_TRANS(vslide1down_vx, slidedown_check)
+
 /* Vector Floating-Point Slide Instructions */
 static bool fslideup_check(DisasContext *s, arg_rmrr *a)
 {
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 7c67d67a13..41ea223106 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -5198,11 +5198,11 @@ GEN_VEXT_VSLIE1UP(16, H2)
 GEN_VEXT_VSLIE1UP(32, H4)
 GEN_VEXT_VSLIE1UP(64, H8)
 
-#define GEN_VEXT_VSLIDE1UP_VX(NAME, BITWIDTH)                     \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2, \
-                  CPURISCVState *env, uint32_t desc)              \
-{                                                                 \
-    vslide1up_##BITWIDTH(vd, v0, s1, vs2, env, desc);             \
+#define GEN_VEXT_VSLIDE1UP_VX(NAME, BITWIDTH)                   \
+void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,   \
+                  CPURISCVState *env, uint32_t desc)            \
+{                                                               \
+    vslide1up_##BITWIDTH(vd, v0, s1, vs2, env, desc);           \
 }
 
 /* vslide1up.vx vd, vs2, rs1, vm # vd[0]=x[rs1], vd[i+1] = vs2[i] */
@@ -5249,11 +5249,11 @@ GEN_VEXT_VSLIDE1DOWN(16, H2)
 GEN_VEXT_VSLIDE1DOWN(32, H4)
 GEN_VEXT_VSLIDE1DOWN(64, H8)
 
-#define GEN_VEXT_VSLIDE1DOWN_VX(NAME, BITWIDTH)                   \
-void HELPER(NAME)(void *vd, void *v0, target_ulong s1, void *vs2, \
-                  CPURISCVState *env, uint32_t desc)              \
-{                                                                 \
-    vslide1down_##BITWIDTH(vd, v0, s1, vs2, env, desc);           \
+#define GEN_VEXT_VSLIDE1DOWN_VX(NAME, BITWIDTH)                 \
+void HELPER(NAME)(void *vd, void *v0, uint64_t s1, void *vs2,   \
+                  CPURISCVState *env, uint32_t desc)            \
+{                                                               \
+    vslide1down_##BITWIDTH(vd, v0, s1, vs2, env, desc);         \
 }
 
 /* vslide1down.vx vd, vs2, rs1, vm # vd[i] = vs2[i+1], vd[vl-1]=x[rs1] */

From 15abfced803929f935bb59a0e1b02558bd8325c4 Mon Sep 17 00:00:00 2001
From: "Guo Ren (Alibaba DAMO Academy)" <guoren@kernel.org>
Date: Sat, 13 Sep 2025 00:12:33 -0400
Subject: [PATCH 0880/2396] hw/riscv/riscv-iommu: Fixup PDT Nested Walk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Current implementation is wrong when iohgatp != bare. The RISC-V
IOMMU specification has defined that the PDT is based on GPA, not
SPA. So this patch fixes the problem, making PDT walk correctly
when the G-stage table walk is enabled.

Fixes: 0c54acb8243d ("hw/riscv: add RISC-V IOMMU base emulation")
Cc: qemu-stable@nongnu.org
Cc: Sebastien Boeuf <seb@rivosinc.com>
Cc: Tomasz Jeznach <tjeznach@rivosinc.com>
Reviewed-by: Weiwei Li <liwei1518@gmail.com>
Reviewed-by: Nutty Liu <liujingqi@lanxincomputing.com>
Signed-off-by: Guo Ren (Alibaba DAMO Academy) <guoren@kernel.org>
Tested-by: Chen Pei <cp0613@linux.alibaba.com>
Tested-by: Fangyu Yu <fangyu.yu@linux.alibaba.com>
Message-ID: <20250913041233.972870-1-guoren@kernel.org>
[ Changes by AF:
 - Add braces to if statements
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/riscv-iommu.c | 143 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 141 insertions(+), 2 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index 155190d032..b33c7fe325 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -869,6 +869,145 @@ static bool riscv_iommu_validate_process_ctx(RISCVIOMMUState *s,
     return true;
 }
 
+/**
+ * pdt_memory_read: PDT wrapper of dma_memory_read.
+ *
+ * @s: IOMMU Device State
+ * @ctx: Device Translation Context with devid and pasid set
+ * @addr: address within that address space
+ * @buf: buffer with the data transferred
+ * @len: length of the data transferred
+ * @attrs: memory transaction attributes
+ */
+static MemTxResult pdt_memory_read(RISCVIOMMUState *s,
+                                   RISCVIOMMUContext *ctx,
+                                   dma_addr_t addr,
+                                   void *buf, dma_addr_t len,
+                                   MemTxAttrs attrs)
+{
+    uint64_t gatp_mode, pte;
+    struct {
+        unsigned char step;
+        unsigned char levels;
+        unsigned char ptidxbits;
+        unsigned char ptesize;
+    } sc;
+    MemTxResult ret;
+    dma_addr_t base = addr;
+
+    /* G stages translation mode */
+    gatp_mode = get_field(ctx->gatp, RISCV_IOMMU_ATP_MODE_FIELD);
+    if (gatp_mode == RISCV_IOMMU_DC_IOHGATP_MODE_BARE) {
+        goto out;
+    }
+
+    /* G stages translation tables root pointer */
+    base = PPN_PHYS(get_field(ctx->gatp, RISCV_IOMMU_ATP_PPN_FIELD));
+
+    /* Start at step 0 */
+    sc.step = 0;
+
+    if (s->fctl & RISCV_IOMMU_FCTL_GXL) {
+        /* 32bit mode for GXL == 1 */
+        switch (gatp_mode) {
+        case RISCV_IOMMU_DC_IOHGATP_MODE_SV32X4:
+            if (!(s->cap & RISCV_IOMMU_CAP_SV32X4)) {
+                return MEMTX_ACCESS_ERROR;
+            }
+            sc.levels    = 2;
+            sc.ptidxbits = 10;
+            sc.ptesize   = 4;
+            break;
+        default:
+            return MEMTX_ACCESS_ERROR;
+        }
+    } else {
+        /* 64bit mode for GXL == 0 */
+        switch (gatp_mode) {
+        case RISCV_IOMMU_DC_IOHGATP_MODE_SV39X4:
+            if (!(s->cap & RISCV_IOMMU_CAP_SV39X4)) {
+                return MEMTX_ACCESS_ERROR;
+            }
+            sc.levels    = 3;
+            sc.ptidxbits = 9;
+            sc.ptesize   = 8;
+            break;
+        case RISCV_IOMMU_DC_IOHGATP_MODE_SV48X4:
+            if (!(s->cap & RISCV_IOMMU_CAP_SV48X4)) {
+                return MEMTX_ACCESS_ERROR;
+            }
+            sc.levels    = 4;
+            sc.ptidxbits = 9;
+            sc.ptesize   = 8;
+            break;
+        case RISCV_IOMMU_DC_IOHGATP_MODE_SV57X4:
+            if (!(s->cap & RISCV_IOMMU_CAP_SV57X4)) {
+                return MEMTX_ACCESS_ERROR;
+            }
+            sc.levels    = 5;
+            sc.ptidxbits = 9;
+            sc.ptesize   = 8;
+            break;
+        default:
+            return MEMTX_ACCESS_ERROR;
+        }
+    }
+
+    do {
+        const unsigned va_bits = (sc.step ? 0 : 2) + sc.ptidxbits;
+        const unsigned va_skip = TARGET_PAGE_BITS + sc.ptidxbits *
+                                 (sc.levels - 1 - sc.step);
+        const unsigned idx = (addr >> va_skip) & ((1 << va_bits) - 1);
+        const dma_addr_t pte_addr = base + idx * sc.ptesize;
+
+        /* Address range check before first level lookup */
+        if (!sc.step) {
+            const uint64_t va_mask = (1ULL << (va_skip + va_bits)) - 1;
+            if ((addr & va_mask) != addr) {
+                return MEMTX_ACCESS_ERROR;
+            }
+        }
+
+        /* Read page table entry */
+        if (sc.ptesize == 4) {
+            uint32_t pte32 = 0;
+            ret = ldl_le_dma(s->target_as, pte_addr, &pte32, attrs);
+            pte = pte32;
+        } else {
+            ret = ldq_le_dma(s->target_as, pte_addr, &pte, attrs);
+        }
+        if (ret != MEMTX_OK) {
+            return ret;
+        }
+
+        sc.step++;
+        hwaddr ppn = pte >> PTE_PPN_SHIFT;
+
+        if (!(pte & PTE_V)) {
+            return MEMTX_ACCESS_ERROR; /* Invalid PTE */
+        } else if (!(pte & (PTE_R | PTE_W | PTE_X))) {
+            base = PPN_PHYS(ppn); /* Inner PTE, continue walking */
+        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == PTE_W) {
+            return MEMTX_ACCESS_ERROR; /* Reserved leaf PTE flags: PTE_W */
+        } else if ((pte & (PTE_R | PTE_W | PTE_X)) == (PTE_W | PTE_X)) {
+            return MEMTX_ACCESS_ERROR; /* Reserved leaf PTE flags: PTE_W + PTE_X */
+        } else if (ppn & ((1ULL << (va_skip - TARGET_PAGE_BITS)) - 1)) {
+            return MEMTX_ACCESS_ERROR; /* Misaligned PPN */
+        } else {
+            /* Leaf PTE, translation completed. */
+            base = PPN_PHYS(ppn) | (addr & ((1ULL << va_skip) - 1));
+            break;
+        }
+
+        if (sc.step == sc.levels) {
+            return MEMTX_ACCESS_ERROR; /* Can't find leaf PTE */
+        }
+    } while (1);
+
+out:
+    return dma_memory_read(s->target_as, base, buf, len, attrs);
+}
+
 /*
  * RISC-V IOMMU Device Context Loopkup - Device Directory Tree Walk
  *
@@ -1041,7 +1180,7 @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
          */
         const int split = depth * 9 + 8;
         addr |= ((ctx->process_id >> split) << 3) & ~TARGET_PAGE_MASK;
-        if (dma_memory_read(s->target_as, addr, &de, sizeof(de),
+        if (pdt_memory_read(s, ctx, addr, &de, sizeof(de),
                             MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
             return RISCV_IOMMU_FQ_CAUSE_PDT_LOAD_FAULT;
         }
@@ -1056,7 +1195,7 @@ static int riscv_iommu_ctx_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx)
 
     /* Leaf entry in PDT */
     addr |= (ctx->process_id << 4) & ~TARGET_PAGE_MASK;
-    if (dma_memory_read(s->target_as, addr, &dc.ta, sizeof(uint64_t) * 2,
+    if (pdt_memory_read(s, ctx, addr, &dc.ta, sizeof(uint64_t) * 2,
                         MEMTXATTRS_UNSPECIFIED) != MEMTX_OK) {
         return RISCV_IOMMU_FQ_CAUSE_PDT_LOAD_FAULT;
     }

From b25133d38fe693589cf695b85968caa0724bfafd Mon Sep 17 00:00:00 2001
From: vhaudiquet <vhaudiquet343@hotmail.fr>
Date: Mon, 29 Sep 2025 13:55:43 +0200
Subject: [PATCH 0881/2396] target/riscv: Fix endianness swap on compressed
 instructions

Three instructions were not using the endianness swap flag, which resulted in a bug on big-endian architectures.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3131
Buglink: https://bugs.launchpad.net/ubuntu/+source/qemu/+bug/2123828

Fixes: e0a3054f18e ("target/riscv: add support for Zcb extension")
Signed-off-by: Valentin Haudiquet <valentin.haudiquet@canonical.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250929115543.1648157-1-valentin.haudiquet@canonical.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzce.c.inc | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index c77c2b927b..dd15af0f54 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -88,13 +88,13 @@ static bool trans_c_lbu(DisasContext *ctx, arg_c_lbu *a)
 static bool trans_c_lhu(DisasContext *ctx, arg_c_lhu *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_UW);
+    return gen_load(ctx, a, MO_TEUW);
 }
 
 static bool trans_c_lh(DisasContext *ctx, arg_c_lh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_SW);
+    return gen_load(ctx, a, MO_TESW);
 }
 
 static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
@@ -106,7 +106,7 @@ static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
 static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_store(ctx, a, MO_UW);
+    return gen_store(ctx, a, MO_TEUW);
 }
 
 #define X_S0    8

From ad2a0aa2824b1dac9f61bac33980e866e9a88856 Mon Sep 17 00:00:00 2001
From: Joel Stanley <joel@jms.id.au>
Date: Thu, 14 Aug 2025 09:44:50 +0930
Subject: [PATCH 0882/2396] docs: riscv-iommu: Update status of kernel support

The iommu Linux kernel support is now upstream. VFIO is still
downstream at this stage.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-ID: <20250814001452.504510-1-joel@jms.id.au>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 docs/specs/riscv-iommu.rst | 33 ++++++++++++---------------------
 1 file changed, 12 insertions(+), 21 deletions(-)

diff --git a/docs/specs/riscv-iommu.rst b/docs/specs/riscv-iommu.rst
index 991d376fdc..571a6a6cc9 100644
--- a/docs/specs/riscv-iommu.rst
+++ b/docs/specs/riscv-iommu.rst
@@ -30,15 +30,15 @@ This will add a RISC-V IOMMU PCI device in the board following any additional
 PCI parameters (like PCI bus address).  The behavior of the RISC-V IOMMU is
 defined by the spec but its operation is OS dependent.
 
-As of this writing the existing Linux kernel support `linux-v8`_, not yet merged,
-does not have support for features like VFIO passthrough.  The IOMMU emulation
-was tested using a public Ventana Micro Systems kernel repository in
-`ventana-linux`_.  This kernel is based on `linux-v8`_ with additional patches that
-enable features like KVM VFIO passthrough with irqbypass.  Until the kernel support
-is feature complete feel free to use the kernel available in the Ventana Micro Systems
-mirror.
+Linux kernel iommu support was merged in v6.13. QEMU IOMMU emulation can be
+used with mainline kernels for simple IOMMU PCIe support.
 
-The current Linux kernel support will use the IOMMU device to create IOMMU groups
+As of v6.17, it does not have support for features like VFIO passthrough.
+There is a `VFIO`_ RFC series that is not yet merged. The public Ventana Micro
+Systems kernel repository in `ventana-linux`_ can be used for testing the VFIO
+functions.
+
+The v6.13+ Linux kernel support uses the IOMMU device to create IOMMU groups
 with any eligible cards available in the system, regardless of factors such as the
 order in which the devices are added in the command line.
 
@@ -49,7 +49,7 @@ IOMMU kernel driver behaves:
 
   $ qemu-system-riscv64 \
         -M virt,aia=aplic-imsic,aia-guests=5 \
-        -device riscv-iommu-pci,addr=1.0,vendor-id=0x1efd,device-id=0xedf1 \
+        -device riscv-iommu-pci,addr=1.0 \
         -device e1000e,netdev=net1 -netdev user,id=net1,net=192.168.0.0/24 \
         -device e1000e,netdev=net2 -netdev user,id=net2,net=192.168.200.0/24 \
         (...)
@@ -58,21 +58,11 @@ IOMMU kernel driver behaves:
         -M virt,aia=aplic-imsic,aia-guests=5 \
         -device e1000e,netdev=net1 -netdev user,id=net1,net=192.168.0.0/24 \
         -device e1000e,netdev=net2 -netdev user,id=net2,net=192.168.200.0/24 \
-        -device riscv-iommu-pci,addr=1.0,vendor-id=0x1efd,device-id=0xedf1 \
+        -device riscv-iommu-pci,addr=3.0 \
         (...)
 
 Both will create iommu groups for the two e1000e cards.
 
-Another thing to notice on `linux-v8`_ and `ventana-linux`_ is that the kernel driver
-considers an IOMMU identified as a Rivos device, i.e. it uses Rivos vendor ID.  To
-use the riscv-iommu-pci device with the existing kernel support we need to emulate
-a Rivos PCI IOMMU by setting 'vendor-id' and 'device-id':
-
-.. code-block:: bash
-
-  $ qemu-system-riscv64 -M virt	\
-     -device riscv-iommu-pci,vendor-id=0x1efd,device-id=0xedf1 (...)
-
 Several options are available to control the capabilities of the device, namely:
 
 - "bus": the bus that the IOMMU device uses
@@ -84,6 +74,7 @@ Several options are available to control the capabilities of the device, namely:
 - "g-stage": enable g-stage support
 - "hpm-counters": number of hardware performance counters available. Maximum value is 31.
   Default value is 31. Use 0 (zero) to disable HPM support
+- "vendor-id"/"device-id": pci device ID. Defaults to 1b36:0014 (Redhat)
 
 riscv-iommu-sys device
 ----------------------
@@ -111,6 +102,6 @@ riscv-iommu options:
 
 .. _iommu1.0.0: https://github.com/riscv-non-isa/riscv-iommu/releases/download/v1.0.0/riscv-iommu.pdf
 
-.. _linux-v8: https://lore.kernel.org/linux-riscv/cover.1718388908.git.tjeznach@rivosinc.com/
+.. _VFIO: https://lore.kernel.org/linux-riscv/20241114161845.502027-17-ajones@ventanamicro.com/
 
 .. _ventana-linux: https://github.com/ventanamicro/linux/tree/dev-upstream

From faccaa34f0cb75b93ff1f4bcdd2f40f23f6aa10f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 30 Sep 2025 13:59:20 +0200
Subject: [PATCH 0883/2396] subprojects: Remove version number from .gitignore
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Get rid of all the version numbers, and use wildcard matches instead,
because peopl will repeatedly forgot to change these versions.

Suggested-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 subprojects/.gitignore | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index 58a29f0120..0b5d963409 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -6,21 +6,21 @@
 /keycodemapdb
 /libvfio-user
 /slirp
-/anyhow-1.0.98
-/arbitrary-int-1.2.7
-/attrs-0.2.9
-/bilge-0.2.0
-/bilge-impl-0.2.0
-/either-1.12.0
-/foreign-0.3.1
-/itertools-0.11.0
-/libc-0.2.162
-/proc-macro-error-1.0.4
-/proc-macro-error-attr-1.0.4
-/proc-macro2-1.0.95
-/quote-1.0.36
-/syn-2.0.66
-/unicode-ident-1.0.12
+/anyhow-*
+/arbitrary-int-*
+/attrs-*
+/bilge-*
+/bilge-impl-*
+/either-*
+/foreign-*
+/itertools-*
+/libc-*
+/proc-macro-error-*
+/proc-macro-error-attr-*
+/proc-macro*
+/quote-*
+/syn-*
+/unicode-ident-*
 
 # Workaround for Meson v1.9.0 https://github.com/mesonbuild/meson/issues/14948
 /.wraplock

From 4c18783a88726c3fc39cea9117b720adb82e557f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 1 Oct 2025 08:52:32 +0200
Subject: [PATCH 0884/2396] subprojects: add glib-sys-rs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/meson.build                              |  2 ++
 scripts/archive-source.sh                     |  1 +
 subprojects/.gitignore                        |  1 +
 subprojects/glib-sys-0.21-rs.wrap             |  7 ++++
 .../packagefiles/glib-sys-0.21-rs/meson.build | 33 +++++++++++++++++++
 5 files changed, 44 insertions(+)
 create mode 100644 subprojects/glib-sys-0.21-rs.wrap
 create mode 100644 subprojects/packagefiles/glib-sys-0.21-rs/meson.build

diff --git a/rust/meson.build b/rust/meson.build
index 695d5a62de..6ba075c8c7 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -2,12 +2,14 @@ subproject('anyhow-1-rs', required: true)
 subproject('bilge-0.2-rs', required: true)
 subproject('bilge-impl-0.2-rs', required: true)
 subproject('foreign-0.3-rs', required: true)
+subproject('glib-sys-0.21-rs', required: true)
 subproject('libc-0.2-rs', required: true)
 
 anyhow_rs = dependency('anyhow-1-rs')
 bilge_rs = dependency('bilge-0.2-rs')
 bilge_impl_rs = dependency('bilge-impl-0.2-rs')
 foreign_rs = dependency('foreign-0.3-rs')
+glib_sys_rs = dependency('glib-sys-0.21-rs')
 libc_rs = dependency('libc-0.2-rs')
 
 subproject('proc-macro2-1-rs', required: true)
diff --git a/scripts/archive-source.sh b/scripts/archive-source.sh
index a725dd923d..8f97b19a08 100755
--- a/scripts/archive-source.sh
+++ b/scripts/archive-source.sh
@@ -36,6 +36,7 @@ subprojects=(
   bilge-impl-0.2-rs
   either-1-rs
   foreign-0.3-rs
+  glib-sys-0.21-rs
   itertools-0.11-rs
   keycodemapdb
   libc-0.2-rs
diff --git a/subprojects/.gitignore b/subprojects/.gitignore
index 0b5d963409..c00c847837 100644
--- a/subprojects/.gitignore
+++ b/subprojects/.gitignore
@@ -13,6 +13,7 @@
 /bilge-impl-*
 /either-*
 /foreign-*
+/glib-sys-*
 /itertools-*
 /libc-*
 /proc-macro-error-*
diff --git a/subprojects/glib-sys-0.21-rs.wrap b/subprojects/glib-sys-0.21-rs.wrap
new file mode 100644
index 0000000000..313ced731a
--- /dev/null
+++ b/subprojects/glib-sys-0.21-rs.wrap
@@ -0,0 +1,7 @@
+[wrap-file]
+directory = glib-sys-0.21.2
+source_url = https://crates.io/api/v1/crates/glib-sys/0.21.2/download
+source_filename = glib-sys-0.21.2.tar.gz
+source_hash = d09d3d0fddf7239521674e57b0465dfbd844632fec54f059f7f56112e3f927e1
+#method = cargo
+patch_directory = glib-sys-0.21-rs
diff --git a/subprojects/packagefiles/glib-sys-0.21-rs/meson.build b/subprojects/packagefiles/glib-sys-0.21-rs/meson.build
new file mode 100644
index 0000000000..8c5483311e
--- /dev/null
+++ b/subprojects/packagefiles/glib-sys-0.21-rs/meson.build
@@ -0,0 +1,33 @@
+project('glib-sys-0.21-rs', 'rust',
+  meson_version: '>=1.5.0',
+  version: '0.21.2',
+  license: 'MIT',
+  default_options: [])
+
+subproject('libc-0.2-rs', required: true)
+libc_rs = dependency('libc-0.2-rs')
+
+_glib_sys_rs = static_library(
+  'glib_sys',
+  files('src/lib.rs'),
+  gnu_symbol_visibility: 'hidden',
+  override_options: ['rust_std=2021', 'build.rust_std=2021'],
+  rust_abi: 'rust',
+  rust_args: [
+    '--cap-lints', 'allow',
+    '--cfg', 'feature="v2_66"',
+    '--cfg', 'feature="v2_64"',
+    '--cfg', 'feature="v2_62"',
+    '--cfg', 'feature="v2_60"',
+    '--cfg', 'feature="v2_58"',
+  ],
+  # should also link with glib; don't bother doing it here since all
+  # QEMU targets have it
+  dependencies: [libc_rs],
+)
+
+glib_sys_dep = declare_dependency(
+  link_with: _glib_sys_rs,
+)
+
+meson.override_dependency('glib-sys-0.21-rs', glib_sys_dep)

From 9c40c1ff970d7ec3d4456aeb65245d66e1226118 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 24 Sep 2025 17:56:38 +0400
Subject: [PATCH 0885/2396] rust: use glib-sys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don't generate FFI for glib, rely on glib-sys crate.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/hw/core/cpu.h              |   2 +-
 meson.build                        |   1 +
 rust/Cargo.lock                    | 180 +++++++++++++++++++++++++++++
 rust/Cargo.toml                    |   1 +
 rust/bql/Cargo.toml                |   1 +
 rust/bql/meson.build               |   1 +
 rust/bql/src/bindings.rs           |   4 +
 rust/chardev/Cargo.toml            |   1 +
 rust/chardev/meson.build           |   2 +-
 rust/chardev/src/bindings.rs       |   4 +
 rust/hw/char/pl011/Cargo.toml      |   1 +
 rust/hw/char/pl011/meson.build     |   1 +
 rust/hw/char/pl011/src/bindings.rs |   5 +
 rust/hw/core/Cargo.toml            |   1 +
 rust/hw/core/meson.build           |   2 +-
 rust/hw/core/src/bindings.rs       |   3 +
 rust/migration/Cargo.toml          |   1 +
 rust/migration/meson.build         |   2 +-
 rust/migration/src/bindings.rs     |   1 +
 rust/qom/Cargo.toml                |   1 +
 rust/qom/meson.build               |   2 +-
 rust/qom/src/bindings.rs           |   2 +
 rust/system/Cargo.toml             |   1 +
 rust/system/meson.build            |   2 +-
 rust/system/src/bindings.rs        |   4 +
 rust/util/Cargo.toml               |   1 +
 rust/util/meson.build              |   2 +-
 rust/util/src/bindings.rs          |   2 +
 28 files changed, 224 insertions(+), 7 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index c9f40c2539..4196293ba1 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -169,7 +169,7 @@ struct CPUClass {
     vaddr (*gdb_adjust_breakpoint)(CPUState *cpu, vaddr addr);
 
     const char *gdb_core_xml_file;
-    const gchar * (*gdb_arch_name)(CPUState *cpu);
+    const char * (*gdb_arch_name)(CPUState *cpu);
     const char * (*gdb_get_core_xml_file)(CPUState *cpu);
 
     void (*disas_set_info)(CPUState *cpu, disassemble_info *info);
diff --git a/meson.build b/meson.build
index 55c8202a4d..62766c0f19 100644
--- a/meson.build
+++ b/meson.build
@@ -4239,6 +4239,7 @@ if have_rust
     '--no-prepend-enum-name',
     '--allowlist-file', meson.project_source_root() + '/include/.*',
     '--allowlist-file', meson.project_build_root() + '/.*',
+    '--blocklist-file', glib_pc.get_variable('includedir') + '/glib-2.0/.*',
     ]
   if not rustfmt.found()
     if bindgen.version().version_compare('<0.65.0')
diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 444ef516a7..1108513349 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -58,15 +58,27 @@ dependencies = [
 name = "bql"
 version = "0.1.0"
 dependencies = [
+ "glib-sys",
  "migration",
 ]
 
+[[package]]
+name = "cfg-expr"
+version = "0.20.3"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a2c5f3bf25ec225351aa1c8e230d04d880d3bd89dea133537dafad4ae291e5c"
+dependencies = [
+ "smallvec",
+ "target-lexicon",
+]
+
 [[package]]
 name = "chardev"
 version = "0.1.0"
 dependencies = [
  "bql",
  "common",
+ "glib-sys",
  "migration",
  "qom",
  "util",
@@ -86,6 +98,12 @@ version = "1.12.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "3dca9240753cf90908d7e4aac30f630662b02aebaa1b58a3cadabdb23385b58b"
 
+[[package]]
+name = "equivalent"
+version = "1.0.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "877a4ace8713b0bcf2a4e7eec82529c029f1d0619886d18145fea96c3ffe5c0f"
+
 [[package]]
 name = "foreign"
 version = "0.3.1"
@@ -95,6 +113,28 @@ dependencies = [
  "libc",
 ]
 
+[[package]]
+name = "glib-sys"
+version = "0.21.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "d09d3d0fddf7239521674e57b0465dfbd844632fec54f059f7f56112e3f927e1"
+dependencies = [
+ "libc",
+ "system-deps",
+]
+
+[[package]]
+name = "hashbrown"
+version = "0.16.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "5419bdc4f6a9207fbeba6d11b604d481addf78ecd10c11ad51e76c2f6482748d"
+
+[[package]]
+name = "heck"
+version = "0.5.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2304e00983f87ffb38b55b444b5e3b60a884b5d30c0fca7d82fe33449bbe55ea"
+
 [[package]]
 name = "hpet"
 version = "0.1.0"
@@ -115,6 +155,7 @@ dependencies = [
  "bql",
  "chardev",
  "common",
+ "glib-sys",
  "migration",
  "qemu_macros",
  "qom",
@@ -122,6 +163,16 @@ dependencies = [
  "util",
 ]
 
+[[package]]
+name = "indexmap"
+version = "2.11.4"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "4b0f83760fb341a774ed326568e19f5a863af4a952def8c39f9ab92fd95b88e5"
+dependencies = [
+ "equivalent",
+ "hashbrown",
+]
+
 [[package]]
 name = "itertools"
 version = "0.11.0"
@@ -137,14 +188,27 @@ version = "0.2.162"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "18d287de67fe55fd7e1581fe933d965a5a9477b38e949cfa9f8574ef01506398"
 
+[[package]]
+name = "memchr"
+version = "2.7.6"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
+
 [[package]]
 name = "migration"
 version = "0.1.0"
 dependencies = [
  "common",
+ "glib-sys",
  "util",
 ]
 
+[[package]]
+name = "pkg-config"
+version = "0.3.32"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7edddbd0b52d732b21ad9a5fab5c704c14cd949e5e9a1ec5929a24fded1b904c"
+
 [[package]]
 name = "pl011"
 version = "0.1.0"
@@ -155,6 +219,7 @@ dependencies = [
  "bql",
  "chardev",
  "common",
+ "glib-sys",
  "hwcore",
  "migration",
  "qom",
@@ -211,6 +276,7 @@ version = "0.1.0"
 dependencies = [
  "bql",
  "common",
+ "glib-sys",
  "migration",
  "qemu_macros",
  "util",
@@ -225,6 +291,50 @@ dependencies = [
  "proc-macro2",
 ]
 
+[[package]]
+name = "serde"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "0dca6411025b24b60bfa7ec1fe1f8e710ac09782dca409ee8237ba74b51295fd"
+dependencies = [
+ "serde_core",
+]
+
+[[package]]
+name = "serde_core"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "ba2ba63999edb9dac981fb34b3e5c0d111a69b0924e253ed29d83f7c99e966a4"
+dependencies = [
+ "serde_derive",
+]
+
+[[package]]
+name = "serde_derive"
+version = "1.0.226"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8db53ae22f34573731bafa1db20f04027b2d25e02d8205921b569171699cdb33"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
+[[package]]
+name = "serde_spanned"
+version = "0.6.9"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bf41e0cfaf7226dca15e8197172c295a782857fcb97fad1808a166870dee75a3"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "smallvec"
+version = "1.15.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "67b1b7a3b5fe4f1376887184045fcf45c69e92af734b7aaddc05fb777b6fbd03"
+
 [[package]]
 name = "syn"
 version = "2.0.104"
@@ -241,10 +351,30 @@ name = "system"
 version = "0.1.0"
 dependencies = [
  "common",
+ "glib-sys",
  "qom",
  "util",
 ]
 
+[[package]]
+name = "system-deps"
+version = "7.0.5"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e4be53aa0cba896d2dc615bd42bbc130acdcffa239e0a2d965ea5b3b2a86ffdb"
+dependencies = [
+ "cfg-expr",
+ "heck",
+ "pkg-config",
+ "toml",
+ "version-compare",
+]
+
+[[package]]
+name = "target-lexicon"
+version = "0.13.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "e502f78cdbb8ba4718f566c418c52bc729126ffd16baee5baa718cf25dd5a69a"
+
 [[package]]
 name = "tests"
 version = "0.1.0"
@@ -259,6 +389,40 @@ dependencies = [
  "util",
 ]
 
+[[package]]
+name = "toml"
+version = "0.8.23"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "dc1beb996b9d83529a9e75c17a1686767d148d70663143c7854d8b4a09ced362"
+dependencies = [
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "toml_edit",
+]
+
+[[package]]
+name = "toml_datetime"
+version = "0.6.11"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "22cddaf88f4fbc13c51aebbf5f8eceb5c7c5a9da2ac40a13519eb5b0a0e8f11c"
+dependencies = [
+ "serde",
+]
+
+[[package]]
+name = "toml_edit"
+version = "0.22.27"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "41fe8c660ae4257887cf66394862d21dbca4a6ddd26f04a3560410406a2f819a"
+dependencies = [
+ "indexmap",
+ "serde",
+ "serde_spanned",
+ "toml_datetime",
+ "winnow",
+]
+
 [[package]]
 name = "trace"
 version = "0.1.0"
@@ -279,11 +443,27 @@ dependencies = [
  "anyhow",
  "common",
  "foreign",
+ "glib-sys",
  "libc",
 ]
 
+[[package]]
+name = "version-compare"
+version = "0.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "852e951cb7832cb45cb1169900d19760cfa39b82bc0ea9c0e5a14ae88411c98b"
+
 [[package]]
 name = "version_check"
 version = "0.9.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "49874b5167b65d7193b8aba1567f5c7d93d001cafc34600cee003eda787e483f"
+
+[[package]]
+name = "winnow"
+version = "0.7.13"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "21a0236b59786fed61e2a80582dd500fe61f18b5dca67a4a067d0bc9039339cf"
+dependencies = [
+ "memchr",
+]
diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index f372d7dbf7..783e626802 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -29,6 +29,7 @@ authors = ["The QEMU Project Developers <qemu-devel@nongnu.org>"]
 anyhow = "~1.0"
 foreign = "~0.3.1"
 libc = "0.2.162"
+glib-sys = { version = "0.21.2", features = ["v2_66"] }
 
 [workspace.lints.rust]
 unexpected_cfgs = { level = "deny", check-cfg = ['cfg(MESON)'] }
diff --git a/rust/bql/Cargo.toml b/rust/bql/Cargo.toml
index 1041bd4ea9..d5177e5f8e 100644
--- a/rust/bql/Cargo.toml
+++ b/rust/bql/Cargo.toml
@@ -14,6 +14,7 @@ rust-version.workspace = true
 
 [dependencies]
 migration = { path = "../migration" }
+glib-sys.workspace = true
 
 [features]
 default = ["debug_cell"]
diff --git a/rust/bql/meson.build b/rust/bql/meson.build
index bc51c7f160..22d7c9b877 100644
--- a/rust/bql/meson.build
+++ b/rust/bql/meson.build
@@ -38,6 +38,7 @@ _bql_rs = static_library(
   rust_abi: 'rust',
   rust_args: _bql_cfg,
   link_with: [_migration_rs],
+  dependencies: [glib_sys_rs],
 )
 
 bql_rs = declare_dependency(link_with: [_bql_rs],
diff --git a/rust/bql/src/bindings.rs b/rust/bql/src/bindings.rs
index 9ffff12cde..8c70f3a87c 100644
--- a/rust/bql/src/bindings.rs
+++ b/rust/bql/src/bindings.rs
@@ -18,6 +18,10 @@
     clippy::too_many_arguments
 )]
 
+use glib_sys::{
+    guint, GArray, GHashTable, GHashTableIter, GList, GPollFD, GPtrArray, GQueue, GSList, GSource,
+};
+
 #[cfg(MESON)]
 include!("bindings.inc.rs");
 
diff --git a/rust/chardev/Cargo.toml b/rust/chardev/Cargo.toml
index 3e77972546..f105189dcc 100644
--- a/rust/chardev/Cargo.toml
+++ b/rust/chardev/Cargo.toml
@@ -13,6 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+glib-sys = { workspace = true }
 common = { path = "../common" }
 bql = { path = "../bql" }
 migration = { path = "../migration" }
diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
index e7ce02b3bc..d365d8dd0f 100644
--- a/rust/chardev/meson.build
+++ b/rust/chardev/meson.build
@@ -36,7 +36,7 @@ _chardev_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
-  dependencies: [common_rs, qemu_macros],
+  dependencies: [glib_sys_rs, common_rs, qemu_macros],
 )
 
 chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [chardev, qemuutil])
diff --git a/rust/chardev/src/bindings.rs b/rust/chardev/src/bindings.rs
index 2d98026d62..c95dc89c56 100644
--- a/rust/chardev/src/bindings.rs
+++ b/rust/chardev/src/bindings.rs
@@ -19,6 +19,10 @@
 )]
 
 use common::Zeroable;
+use glib_sys::{
+    gboolean, guint, GArray, GHashTable, GHashTableIter, GIOCondition, GList, GMainContext,
+    GPollFD, GPtrArray, GQueue, GSList, GSource, GSourceFunc,
+};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/hw/char/pl011/Cargo.toml b/rust/hw/char/pl011/Cargo.toml
index dc41d0e499..5b319455ee 100644
--- a/rust/hw/char/pl011/Cargo.toml
+++ b/rust/hw/char/pl011/Cargo.toml
@@ -13,6 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+glib-sys.workspace = true
 bilge = { version = "0.2.0" }
 bilge-impl = { version = "0.2.0" }
 bits = { path = "../../../bits" }
diff --git a/rust/hw/char/pl011/meson.build b/rust/hw/char/pl011/meson.build
index 07b3da17e8..33b91f2191 100644
--- a/rust/hw/char/pl011/meson.build
+++ b/rust/hw/char/pl011/meson.build
@@ -33,6 +33,7 @@ _libpl011_rs = static_library(
     bilge_impl_rs,
     bits_rs,
     common_rs,
+    glib_sys_rs,
     util_rs,
     migration_rs,
     bql_rs,
diff --git a/rust/hw/char/pl011/src/bindings.rs b/rust/hw/char/pl011/src/bindings.rs
index bd5ea840cb..52a76d0de5 100644
--- a/rust/hw/char/pl011/src/bindings.rs
+++ b/rust/hw/char/pl011/src/bindings.rs
@@ -20,6 +20,11 @@
 
 //! `bindgen`-generated declarations.
 
+use glib_sys::{
+    gboolean, guint, GArray, GByteArray, GHashTable, GHashTableIter, GIOCondition, GList,
+    GMainContext, GPollFD, GPtrArray, GQueue, GSList, GSource, GSourceFunc, GString,
+};
+
 #[cfg(MESON)]
 include!("bindings.inc.rs");
 
diff --git a/rust/hw/core/Cargo.toml b/rust/hw/core/Cargo.toml
index 9a9aa51708..ecfb564718 100644
--- a/rust/hw/core/Cargo.toml
+++ b/rust/hw/core/Cargo.toml
@@ -13,6 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+glib-sys.workspace = true
 qemu_macros = { path = "../../qemu-macros" }
 common = { path = "../../common" }
 bql = { path = "../../bql" }
diff --git a/rust/hw/core/meson.build b/rust/hw/core/meson.build
index e1ae95ed61..1560dd20c6 100644
--- a/rust/hw/core/meson.build
+++ b/rust/hw/core/meson.build
@@ -59,7 +59,7 @@ _hwcore_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _chardev_rs, _migration_rs, _qom_rs, _system_rs, _util_rs],
-  dependencies: [qemu_macros, common_rs],
+  dependencies: [glib_sys_rs, qemu_macros, common_rs],
 )
 
 hwcore_rs = declare_dependency(link_with: [_hwcore_rs],
diff --git a/rust/hw/core/src/bindings.rs b/rust/hw/core/src/bindings.rs
index 919c02b56a..65b9aae753 100644
--- a/rust/hw/core/src/bindings.rs
+++ b/rust/hw/core/src/bindings.rs
@@ -20,6 +20,9 @@
 
 use chardev::bindings::Chardev;
 use common::Zeroable;
+use glib_sys::{
+    GArray, GByteArray, GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList, GString,
+};
 use migration::bindings::VMStateDescription;
 use qom::bindings::ObjectClass;
 use system::bindings::MemoryRegion;
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
index 708bfaaa68..94504f3625 100644
--- a/rust/migration/Cargo.toml
+++ b/rust/migration/Cargo.toml
@@ -15,6 +15,7 @@ rust-version.workspace = true
 [dependencies]
 common = { path = "../common" }
 util = { path = "../util" }
+glib-sys.workspace = true
 
 [lints]
 workspace = true
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index ddf5c2f51d..18be65c92c 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -38,7 +38,7 @@ _migration_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_util_rs],
-  dependencies: [common_rs],
+  dependencies: [common_rs, glib_sys_rs],
 )
 
 migration_rs = declare_dependency(link_with: [_migration_rs],
diff --git a/rust/migration/src/bindings.rs b/rust/migration/src/bindings.rs
index 8ce13a9000..24503eb69b 100644
--- a/rust/migration/src/bindings.rs
+++ b/rust/migration/src/bindings.rs
@@ -19,6 +19,7 @@
 )]
 
 use common::Zeroable;
+use glib_sys::{GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/qom/Cargo.toml b/rust/qom/Cargo.toml
index 060ad2ec34..4be3c2541b 100644
--- a/rust/qom/Cargo.toml
+++ b/rust/qom/Cargo.toml
@@ -18,6 +18,7 @@ bql = { path = "../bql" }
 migration = { path = "../migration" }
 qemu_macros = { path = "../qemu-macros" }
 util = { path = "../util" }
+glib-sys.workspace = true
 
 [lints]
 workspace = true
diff --git a/rust/qom/meson.build b/rust/qom/meson.build
index 71fdac696c..e50f41858d 100644
--- a/rust/qom/meson.build
+++ b/rust/qom/meson.build
@@ -29,7 +29,7 @@ _qom_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs],
-  dependencies: [common_rs, qemu_macros],
+  dependencies: [common_rs, glib_sys_rs, qemu_macros],
 )
 
 qom_rs = declare_dependency(link_with: [_qom_rs], dependencies: [qemu_macros, qom])
diff --git a/rust/qom/src/bindings.rs b/rust/qom/src/bindings.rs
index 9ffff12cde..91de42f242 100644
--- a/rust/qom/src/bindings.rs
+++ b/rust/qom/src/bindings.rs
@@ -18,6 +18,8 @@
     clippy::too_many_arguments
 )]
 
+use glib_sys::{GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList};
+
 #[cfg(MESON)]
 include!("bindings.inc.rs");
 
diff --git a/rust/system/Cargo.toml b/rust/system/Cargo.toml
index 7fd369b9e3..186ea00bff 100644
--- a/rust/system/Cargo.toml
+++ b/rust/system/Cargo.toml
@@ -16,6 +16,7 @@ rust-version.workspace = true
 common = { path = "../common" }
 qom = { path = "../qom" }
 util = { path = "../util" }
+glib-sys.workspace = true
 
 [lints]
 workspace = true
diff --git a/rust/system/meson.build b/rust/system/meson.build
index 0859f39745..73d6199114 100644
--- a/rust/system/meson.build
+++ b/rust/system/meson.build
@@ -36,7 +36,7 @@ _system_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_bql_rs, _migration_rs, _qom_rs, _util_rs],
-  dependencies: [common_rs, qemu_macros],
+  dependencies: [glib_sys_rs, common_rs, qemu_macros],
 )
 
 system_rs = declare_dependency(link_with: [_system_rs],
diff --git a/rust/system/src/bindings.rs b/rust/system/src/bindings.rs
index 43edd98807..6cbb588de3 100644
--- a/rust/system/src/bindings.rs
+++ b/rust/system/src/bindings.rs
@@ -19,6 +19,10 @@
 )]
 
 use common::Zeroable;
+use glib_sys::{
+    guint, GArray, GByteArray, GHashTable, GHashTableIter, GList, GPollFD, GPtrArray, GQueue,
+    GSList, GString,
+};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/util/Cargo.toml b/rust/util/Cargo.toml
index 1f6767ed9d..85f9143654 100644
--- a/rust/util/Cargo.toml
+++ b/rust/util/Cargo.toml
@@ -15,6 +15,7 @@ rust-version.workspace = true
 [dependencies]
 anyhow = { workspace = true }
 foreign = { workspace = true }
+glib-sys = { workspace = true }
 libc = { workspace = true }
 common = { path = "../common" }
 
diff --git a/rust/util/meson.build b/rust/util/meson.build
index 094b43355a..b0b75e93ff 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -40,7 +40,7 @@ _util_rs = static_library(
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
-  dependencies: [anyhow_rs, libc_rs, foreign_rs, common_rs, qom, qemuutil],
+  dependencies: [anyhow_rs, libc_rs, foreign_rs, glib_sys_rs, common_rs, qom, qemuutil],
 )
 
 util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
diff --git a/rust/util/src/bindings.rs b/rust/util/src/bindings.rs
index 9ffff12cde..c277a295ad 100644
--- a/rust/util/src/bindings.rs
+++ b/rust/util/src/bindings.rs
@@ -18,6 +18,8 @@
     clippy::too_many_arguments
 )]
 
+use glib_sys::{guint, GList, GPollFD, GQueue, GSList, GString};
+
 #[cfg(MESON)]
 include!("bindings.inc.rs");
 

From 73b42fc58d035cb2fcfe90083d6b33aeb4fa1b2a Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:18 +0530
Subject: [PATCH 0886/2396] migration: push Error **errp into
 vmstate_subsection_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that vmstate_subsection_load() must report an error
in errp, in case of failure.

The errors are temporarily reported using error_report_err().
This is removed in the subsequent patches in this series,
when we are actually able to propagate the error to the calling
function using errp.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-1-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/vmstate.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/migration/vmstate.c b/migration/vmstate.c
index 5feaa3244d..08f2b562e3 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -25,7 +25,7 @@ static int vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
                                    void *opaque, JSONWriter *vmdesc,
                                    Error **errp);
 static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
-                                   void *opaque);
+                                   void *opaque, Error **errp);
 
 /* Whether this field should exist for either save or load the VM? */
 static bool
@@ -136,6 +136,7 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
 {
     const VMStateField *field = vmsd->fields;
     int ret = 0;
+    Error *local_err = NULL;
 
     trace_vmstate_load_state(vmsd->name, version_id);
     if (version_id > vmsd->version_id) {
@@ -225,9 +226,10 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         field++;
     }
     assert(field->flags == VMS_END);
-    ret = vmstate_subsection_load(f, vmsd, opaque);
+    ret = vmstate_subsection_load(f, vmsd, opaque, &local_err);
     if (ret != 0) {
         qemu_file_set_error(f, ret);
+        error_report_err(local_err);
         return ret;
     }
     if (vmsd->post_load) {
@@ -566,7 +568,7 @@ vmstate_get_subsection(const VMStateDescription * const *sub,
 }
 
 static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
-                                   void *opaque)
+                                   void *opaque, Error **errp)
 {
     trace_vmstate_subsection_load(vmsd->name);
 
@@ -598,6 +600,8 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
         sub_vmsd = vmstate_get_subsection(vmsd->subsections, idstr);
         if (sub_vmsd == NULL) {
             trace_vmstate_subsection_load_bad(vmsd->name, idstr, "(lookup)");
+            error_setg(errp, "VM subsection '%s' in '%s' does not exist",
+                       idstr, vmsd->name);
             return -ENOENT;
         }
         qemu_file_skip(f, 1); /* subsection */
@@ -608,6 +612,9 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
         ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
         if (ret) {
             trace_vmstate_subsection_load_bad(vmsd->name, idstr, "(child)");
+            error_setg(errp,
+                       "Loading VM subsection '%s' in '%s' failed: %d",
+                       idstr, vmsd->name, ret);
             return ret;
         }
     }

From c632ffbd74a497e88bbb4e4d55a357055eae6f47 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:19 +0530
Subject: [PATCH 0887/2396] migration: push Error **errp into
 vmstate_load_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that vmstate_load_state() must report an error
in errp, in case of failure.

The errors are temporarily reported using error_report_err().
This is removed in the subsequent patches in this series,
when we are actually able to propagate the error to the calling
function using errp. Whereas, if we want the function to exit on
error, then error_fatal is passed.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-2-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/display/virtio-gpu.c     |  2 +-
 hw/pci/pci.c                |  3 +-
 hw/s390x/virtio-ccw.c       |  2 +-
 hw/scsi/spapr_vscsi.c       |  4 ++-
 hw/vfio/pci.c               |  5 ++-
 hw/virtio/virtio-mmio.c     |  3 +-
 hw/virtio/virtio-pci.c      |  2 +-
 hw/virtio/virtio.c          |  7 +++--
 include/migration/vmstate.h |  2 +-
 migration/cpr.c             |  3 +-
 migration/savevm.c          |  8 +++--
 migration/vmstate-types.c   | 28 ++++++++++-------
 migration/vmstate.c         | 61 +++++++++++++++++++++++------------
 tests/unit/test-vmstate.c   | 63 +++++++++++++++++++++++++++++++------
 ui/vdagent.c                |  5 ++-
 15 files changed, 143 insertions(+), 55 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index de35902213..e61585aa61 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1347,7 +1347,7 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
     }
 
     /* load & apply scanout state */
-    vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1);
+    vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1, &error_fatal);
 
     return 0;
 }
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c3df9d6656..17715ca1b3 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -934,7 +934,8 @@ void pci_device_save(PCIDevice *s, QEMUFile *f)
 int pci_device_load(PCIDevice *s, QEMUFile *f)
 {
     int ret;
-    ret = vmstate_load_state(f, &vmstate_pci_device, s, s->version_id);
+    ret = vmstate_load_state(f, &vmstate_pci_device, s, s->version_id,
+                             &error_fatal);
     /* Restore the interrupt status bit. */
     pci_update_irq_status(s);
     return ret;
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index d2f85b39f3..6a9641a03d 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1136,7 +1136,7 @@ static void virtio_ccw_save_config(DeviceState *d, QEMUFile *f)
 static int virtio_ccw_load_config(DeviceState *d, QEMUFile *f)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
-    return vmstate_load_state(f, &vmstate_virtio_ccw_dev, dev, 1);
+    return vmstate_load_state(f, &vmstate_virtio_ccw_dev, dev, 1, &error_fatal);
 }
 
 static void virtio_ccw_pre_plugged(DeviceState *d, Error **errp)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index 20f70fb272..da173f4867 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -642,15 +642,17 @@ static void *vscsi_load_request(QEMUFile *f, SCSIRequest *sreq)
     VSCSIState *s = VIO_SPAPR_VSCSI_DEVICE(bus->qbus.parent);
     vscsi_req *req;
     int rc;
+    Error *local_err = NULL;
 
     assert(sreq->tag < VSCSI_REQ_LIMIT);
     req = &s->reqs[sreq->tag];
     assert(!req->active);
 
     memset(req, 0, sizeof(*req));
-    rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1);
+    rc = vmstate_load_state(f, &vmstate_spapr_vscsi_req, req, 1, &local_err);
     if (rc) {
         fprintf(stderr, "VSCSI: failed loading request tag#%u\n", sreq->tag);
+        error_report_err(local_err);
         return NULL;
     }
     assert(req->active);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 5b022da19e..a5df4685d4 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2831,13 +2831,16 @@ static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
     PCIDevice *pdev = PCI_DEVICE(vdev);
     pcibus_t old_addr[PCI_NUM_REGIONS - 1];
     int bar, ret;
+    Error *local_err = NULL;
 
     for (bar = 0; bar < PCI_ROM_SLOT; bar++) {
         old_addr[bar] = pdev->io_regions[bar].addr;
     }
 
-    ret = vmstate_load_state(f, &vmstate_vfio_pci_config, vdev, 1);
+    ret = vmstate_load_state(f, &vmstate_vfio_pci_config, vdev, 1,
+                             &local_err);
     if (ret) {
+        error_report_err(local_err);
         return ret;
     }
 
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 532c67107b..0a688909fc 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -34,6 +34,7 @@
 #include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "trace.h"
+#include "qapi/error.h"
 
 static bool virtio_mmio_ioeventfd_enabled(DeviceState *d)
 {
@@ -619,7 +620,7 @@ static int virtio_mmio_load_extra_state(DeviceState *opaque, QEMUFile *f)
 {
     VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
 
-    return vmstate_load_state(f, &vmstate_virtio_mmio, proxy, 1);
+    return vmstate_load_state(f, &vmstate_virtio_mmio, proxy, 1, &error_fatal);
 }
 
 static bool virtio_mmio_has_extra_state(DeviceState *opaque)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 767216d795..b04faa1e5c 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -161,7 +161,7 @@ static int virtio_pci_load_extra_state(DeviceState *d, QEMUFile *f)
 {
     VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
 
-    return vmstate_load_state(f, &vmstate_virtio_pci, proxy, 1);
+    return vmstate_load_state(f, &vmstate_virtio_pci, proxy, 1, &error_fatal);
 }
 
 static void virtio_pci_save_queue(DeviceState *d, int n, QEMUFile *f)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 9a81ad912e..018803c80d 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3235,6 +3235,7 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
     BusState *qbus = qdev_get_parent_bus(DEVICE(vdev));
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
+    Error *local_err = NULL;
 
     /*
      * We poison the endianness to ensure it does not get used before
@@ -3327,15 +3328,17 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
     }
 
     if (vdc->vmsd) {
-        ret = vmstate_load_state(f, vdc->vmsd, vdev, version_id);
+        ret = vmstate_load_state(f, vdc->vmsd, vdev, version_id, &local_err);
         if (ret) {
+            error_report_err(local_err);
             return ret;
         }
     }
 
     /* Subsections */
-    ret = vmstate_load_state(f, &vmstate_virtio, vdev, 1);
+    ret = vmstate_load_state(f, &vmstate_virtio, vdev, 1, &local_err);
     if (ret) {
+        error_report_err(local_err);
         return ret;
     }
 
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 1ff7bd9ac4..056781b1c2 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -1196,7 +1196,7 @@ extern const VMStateInfo vmstate_info_qlist;
     }
 
 int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
-                       void *opaque, int version_id);
+                       void *opaque, int version_id, Error **errp);
 int vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd,
                        void *opaque, JSONWriter *vmdesc);
 int vmstate_save_state_with_err(QEMUFile *f, const VMStateDescription *vmsd,
diff --git a/migration/cpr.c b/migration/cpr.c
index 9848a21ea6..6b0e19651a 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -234,9 +234,8 @@ int cpr_state_load(MigrationChannel *channel, Error **errp)
         return -ENOTSUP;
     }
 
-    ret = vmstate_load_state(f, &vmstate_cpr_state, &cpr_state, 1);
+    ret = vmstate_load_state(f, &vmstate_cpr_state, &cpr_state, 1, errp);
     if (ret) {
-        error_setg(errp, "vmstate_load_state error %d", ret);
         qemu_fclose(f);
         return ret;
     }
diff --git a/migration/savevm.c b/migration/savevm.c
index abe0547f9b..55c99e0902 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -969,7 +969,8 @@ static int vmstate_load(QEMUFile *f, SaveStateEntry *se)
     if (!se->vmsd) {         /* Old style */
         return se->ops->load_state(f, se->opaque, se->load_version_id);
     }
-    return vmstate_load_state(f, se->vmsd, se->opaque, se->load_version_id);
+    return vmstate_load_state(f, se->vmsd, se->opaque, se->load_version_id,
+                              &error_fatal);
 }
 
 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se,
@@ -2817,6 +2818,7 @@ static int qemu_loadvm_state_header(QEMUFile *f)
 {
     unsigned int v;
     int ret;
+    Error *local_err = NULL;
 
     v = qemu_get_be32(f);
     if (v != QEMU_VM_FILE_MAGIC) {
@@ -2839,9 +2841,11 @@ static int qemu_loadvm_state_header(QEMUFile *f)
             error_report("Configuration section missing");
             return -EINVAL;
         }
-        ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0);
+        ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0,
+                                 &local_err);
 
         if (ret) {
+            error_report_err(local_err);
             return ret;
         }
     }
diff --git a/migration/vmstate-types.c b/migration/vmstate-types.c
index 741a588b7e..c5cfd861e3 100644
--- a/migration/vmstate-types.c
+++ b/migration/vmstate-types.c
@@ -19,6 +19,7 @@
 #include "qemu/error-report.h"
 #include "qemu/queue.h"
 #include "trace.h"
+#include "qapi/error.h"
 
 /* bool */
 
@@ -543,13 +544,17 @@ static int get_tmp(QEMUFile *f, void *pv, size_t size,
                    const VMStateField *field)
 {
     int ret;
+    Error *local_err = NULL;
     const VMStateDescription *vmsd = field->vmsd;
     int version_id = field->version_id;
     void *tmp = g_malloc(size);
 
     /* Writes the parent field which is at the start of the tmp */
     *(void **)tmp = pv;
-    ret = vmstate_load_state(f, vmsd, tmp, version_id);
+    ret = vmstate_load_state(f, vmsd, tmp, version_id, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     g_free(tmp);
     return ret;
 }
@@ -626,6 +631,7 @@ static int get_qtailq(QEMUFile *f, void *pv, size_t unused_size,
                       const VMStateField *field)
 {
     int ret = 0;
+    Error *local_err = NULL;
     const VMStateDescription *vmsd = field->vmsd;
     /* size of a QTAILQ element */
     size_t size = field->size;
@@ -649,8 +655,9 @@ static int get_qtailq(QEMUFile *f, void *pv, size_t unused_size,
 
     while (qemu_get_byte(f)) {
         elm = g_malloc(size);
-        ret = vmstate_load_state(f, vmsd, elm, version_id);
+        ret = vmstate_load_state(f, vmsd, elm, version_id, &local_err);
         if (ret) {
+            error_report_err(local_err);
             return ret;
         }
         QTAILQ_RAW_INSERT_TAIL(pv, elm, entry_offset);
@@ -772,6 +779,7 @@ static int get_gtree(QEMUFile *f, void *pv, size_t unused_size,
     GTree *tree = *pval;
     void *key, *val;
     int ret = 0;
+    Error *local_err = NULL;
 
     /* in case of direct key, the key vmsd can be {}, ie. check fields */
     if (!direct_key && version_id > key_vmsd->version_id) {
@@ -803,18 +811,16 @@ static int get_gtree(QEMUFile *f, void *pv, size_t unused_size,
             key = (void *)(uintptr_t)qemu_get_be64(f);
         } else {
             key = g_malloc0(key_size);
-            ret = vmstate_load_state(f, key_vmsd, key, version_id);
+            ret = vmstate_load_state(f, key_vmsd, key, version_id, &local_err);
             if (ret) {
-                error_report("%s : failed to load %s (%d)",
-                             field->name, key_vmsd->name, ret);
+                error_report_err(local_err);
                 goto key_error;
             }
         }
         val = g_malloc0(val_size);
-        ret = vmstate_load_state(f, val_vmsd, val, version_id);
+        ret = vmstate_load_state(f, val_vmsd, val, version_id, &local_err);
         if (ret) {
-            error_report("%s : failed to load %s (%d)",
-                         field->name, val_vmsd->name, ret);
+            error_report_err(local_err);
             goto val_error;
         }
         g_tree_insert(tree, key, val);
@@ -872,6 +878,7 @@ static int get_qlist(QEMUFile *f, void *pv, size_t unused_size,
                      const VMStateField *field)
 {
     int ret = 0;
+    Error *local_err = NULL;
     const VMStateDescription *vmsd = field->vmsd;
     /* size of a QLIST element */
     size_t size = field->size;
@@ -892,10 +899,9 @@ static int get_qlist(QEMUFile *f, void *pv, size_t unused_size,
 
     while (qemu_get_byte(f)) {
         elm = g_malloc(size);
-        ret = vmstate_load_state(f, vmsd, elm, version_id);
+        ret = vmstate_load_state(f, vmsd, elm, version_id, &local_err);
         if (ret) {
-            error_report("%s: failed to load %s (%d)", field->name,
-                         vmsd->name, ret);
+            error_report_err(local_err);
             g_free(elm);
             return ret;
         }
diff --git a/migration/vmstate.c b/migration/vmstate.c
index 08f2b562e3..8d1e9eb62b 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -132,30 +132,33 @@ static void vmstate_handle_alloc(void *ptr, const VMStateField *field,
 }
 
 int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
-                       void *opaque, int version_id)
+                       void *opaque, int version_id, Error **errp)
 {
     const VMStateField *field = vmsd->fields;
     int ret = 0;
-    Error *local_err = NULL;
 
     trace_vmstate_load_state(vmsd->name, version_id);
     if (version_id > vmsd->version_id) {
-        error_report("%s: incoming version_id %d is too new "
-                     "for local version_id %d",
-                     vmsd->name, version_id, vmsd->version_id);
+        error_setg(errp, "%s: incoming version_id %d is too new "
+                   "for local version_id %d",
+                   vmsd->name, version_id, vmsd->version_id);
         trace_vmstate_load_state_end(vmsd->name, "too new", -EINVAL);
         return -EINVAL;
     }
     if  (version_id < vmsd->minimum_version_id) {
-        error_report("%s: incoming version_id %d is too old "
-                     "for local minimum version_id  %d",
-                     vmsd->name, version_id, vmsd->minimum_version_id);
+        error_setg(errp, "%s: incoming version_id %d is too old "
+                   "for local minimum version_id %d",
+                   vmsd->name, version_id, vmsd->minimum_version_id);
         trace_vmstate_load_state_end(vmsd->name, "too old", -EINVAL);
         return -EINVAL;
     }
     if (vmsd->pre_load) {
         ret = vmsd->pre_load(opaque);
         if (ret) {
+            error_setg(errp, "pre load hook failed for: '%s', "
+                       "version_id: %d, minimum version_id: %d, ret: %d",
+                       vmsd->name, vmsd->version_id, vmsd->minimum_version_id,
+                       ret);
             return ret;
         }
     }
@@ -193,13 +196,21 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
 
                 if (inner_field->flags & VMS_STRUCT) {
                     ret = vmstate_load_state(f, inner_field->vmsd, curr_elem,
-                                             inner_field->vmsd->version_id);
+                                             inner_field->vmsd->version_id,
+                                             errp);
                 } else if (inner_field->flags & VMS_VSTRUCT) {
                     ret = vmstate_load_state(f, inner_field->vmsd, curr_elem,
-                                             inner_field->struct_version_id);
+                                             inner_field->struct_version_id,
+                                             errp);
                 } else {
                     ret = inner_field->info->get(f, curr_elem, size,
                                                  inner_field);
+                    if (ret < 0) {
+                        error_setg(errp,
+                                   "Failed to load element of type %s for %s: "
+                                   "%d", inner_field->info->name,
+                                   inner_field->name, ret);
+                    }
                 }
 
                 /* If we used a fake temp field.. free it now */
@@ -209,31 +220,40 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
 
                 if (ret >= 0) {
                     ret = qemu_file_get_error(f);
+                    if (ret < 0) {
+                        error_setg(errp,
+                                   "Failed to load %s state: stream error: %d",
+                                   vmsd->name, ret);
+                    }
                 }
                 if (ret < 0) {
                     qemu_file_set_error(f, ret);
-                    error_report("Failed to load %s:%s", vmsd->name,
-                                 field->name);
                     trace_vmstate_load_field_error(field->name, ret);
                     return ret;
                 }
             }
         } else if (field->flags & VMS_MUST_EXIST) {
-            error_report("Input validation failed: %s/%s",
-                         vmsd->name, field->name);
+            error_setg(errp, "Input validation failed: %s/%s version_id: %d",
+                       vmsd->name, field->name, vmsd->version_id);
             return -1;
         }
         field++;
     }
     assert(field->flags == VMS_END);
-    ret = vmstate_subsection_load(f, vmsd, opaque, &local_err);
+    ret = vmstate_subsection_load(f, vmsd, opaque, errp);
     if (ret != 0) {
         qemu_file_set_error(f, ret);
-        error_report_err(local_err);
         return ret;
     }
     if (vmsd->post_load) {
         ret = vmsd->post_load(opaque, version_id);
+        if (ret < 0) {
+            error_setg(errp,
+                       "post load hook failed for: %s, version_id: %d, "
+                       "minimum_version: %d, ret: %d",
+                       vmsd->name, vmsd->version_id, vmsd->minimum_version_id,
+                       ret);
+        }
     }
     trace_vmstate_load_state_end(vmsd->name, "end", ret);
     return ret;
@@ -570,6 +590,7 @@ vmstate_get_subsection(const VMStateDescription * const *sub,
 static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
                                    void *opaque, Error **errp)
 {
+    ERRP_GUARD();
     trace_vmstate_subsection_load(vmsd->name);
 
     while (qemu_peek_byte(f, 0) == QEMU_VM_SUBSECTION) {
@@ -609,12 +630,12 @@ static int vmstate_subsection_load(QEMUFile *f, const VMStateDescription *vmsd,
         qemu_file_skip(f, len); /* idstr */
         version_id = qemu_get_be32(f);
 
-        ret = vmstate_load_state(f, sub_vmsd, opaque, version_id);
+        ret = vmstate_load_state(f, sub_vmsd, opaque, version_id, errp);
         if (ret) {
             trace_vmstate_subsection_load_bad(vmsd->name, idstr, "(child)");
-            error_setg(errp,
-                       "Loading VM subsection '%s' in '%s' failed: %d",
-                       idstr, vmsd->name, ret);
+            error_prepend(errp,
+                          "Loading VM subsection '%s' in '%s' failed: %d: ",
+                          idstr, vmsd->name, ret);
             return ret;
         }
     }
diff --git a/tests/unit/test-vmstate.c b/tests/unit/test-vmstate.c
index 63f28f26f4..4ff0ab632f 100644
--- a/tests/unit/test-vmstate.c
+++ b/tests/unit/test-vmstate.c
@@ -30,6 +30,7 @@
 #include "../migration/savevm.h"
 #include "qemu/module.h"
 #include "io/channel-file.h"
+#include "qapi/error.h"
 
 static int temp_fd;
 
@@ -108,14 +109,16 @@ static int load_vmstate_one(const VMStateDescription *desc, void *obj,
 {
     QEMUFile *f;
     int ret;
+    Error *local_err = NULL;
 
     f = open_test_file(true);
     qemu_put_buffer(f, wire, size);
     qemu_fclose(f);
 
     f = open_test_file(false);
-    ret = vmstate_load_state(f, desc, obj, version);
+    ret = vmstate_load_state(f, desc, obj, version, &local_err);
     if (ret) {
+        error_report_err(local_err);
         g_assert(qemu_file_get_error(f));
     } else{
         g_assert(!qemu_file_get_error(f));
@@ -355,6 +358,8 @@ static const VMStateDescription vmstate_versioned = {
 
 static void test_load_v1(void)
 {
+    Error *local_err = NULL;
+    int ret;
     uint8_t buf[] = {
         0, 0, 0, 10,             /* a */
         0, 0, 0, 30,             /* c */
@@ -365,7 +370,10 @@ static void test_load_v1(void)
 
     QEMUFile *loading = open_test_file(false);
     TestStruct obj = { .b = 200, .e = 500, .f = 600 };
-    vmstate_load_state(loading, &vmstate_versioned, &obj, 1);
+    ret = vmstate_load_state(loading, &vmstate_versioned, &obj, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     g_assert(!qemu_file_get_error(loading));
     g_assert_cmpint(obj.a, ==, 10);
     g_assert_cmpint(obj.b, ==, 200);
@@ -378,6 +386,8 @@ static void test_load_v1(void)
 
 static void test_load_v2(void)
 {
+    Error *local_err = NULL;
+    int ret;
     uint8_t buf[] = {
         0, 0, 0, 10,             /* a */
         0, 0, 0, 20,             /* b */
@@ -391,7 +401,10 @@ static void test_load_v2(void)
 
     QEMUFile *loading = open_test_file(false);
     TestStruct obj;
-    vmstate_load_state(loading, &vmstate_versioned, &obj, 2);
+    ret = vmstate_load_state(loading, &vmstate_versioned, &obj, 2, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     g_assert_cmpint(obj.a, ==, 10);
     g_assert_cmpint(obj.b, ==, 20);
     g_assert_cmpint(obj.c, ==, 30);
@@ -467,6 +480,8 @@ static void test_save_skip(void)
 
 static void test_load_noskip(void)
 {
+    Error *local_err = NULL;
+    int ret;
     uint8_t buf[] = {
         0, 0, 0, 10,             /* a */
         0, 0, 0, 20,             /* b */
@@ -480,7 +495,10 @@ static void test_load_noskip(void)
 
     QEMUFile *loading = open_test_file(false);
     TestStruct obj = { .skip_c_e = false };
-    vmstate_load_state(loading, &vmstate_skipping, &obj, 2);
+    ret = vmstate_load_state(loading, &vmstate_skipping, &obj, 2, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     g_assert(!qemu_file_get_error(loading));
     g_assert_cmpint(obj.a, ==, 10);
     g_assert_cmpint(obj.b, ==, 20);
@@ -493,6 +511,8 @@ static void test_load_noskip(void)
 
 static void test_load_skip(void)
 {
+    Error *local_err = NULL;
+    int ret;
     uint8_t buf[] = {
         0, 0, 0, 10,             /* a */
         0, 0, 0, 20,             /* b */
@@ -504,7 +524,10 @@ static void test_load_skip(void)
 
     QEMUFile *loading = open_test_file(false);
     TestStruct obj = { .skip_c_e = true, .c = 300, .e = 500 };
-    vmstate_load_state(loading, &vmstate_skipping, &obj, 2);
+    ret = vmstate_load_state(loading, &vmstate_skipping, &obj, 2, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     g_assert(!qemu_file_get_error(loading));
     g_assert_cmpint(obj.a, ==, 10);
     g_assert_cmpint(obj.b, ==, 20);
@@ -744,6 +767,8 @@ static void test_save_q(void)
 
 static void test_load_q(void)
 {
+    int ret;
+    Error *local_err = NULL;
     TestQtailq obj_q = {
         .i16 = -512,
         .i32 = 70000,
@@ -773,7 +798,10 @@ static void test_load_q(void)
     TestQtailq tgt;
 
     QTAILQ_INIT(&tgt.q);
-    vmstate_load_state(fload, &vmstate_q, &tgt, 1);
+    ret = vmstate_load_state(fload, &vmstate_q, &tgt, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     char eof = qemu_get_byte(fload);
     g_assert(!qemu_file_get_error(fload));
     g_assert_cmpint(tgt.i16, ==, obj_q.i16);
@@ -1115,6 +1143,8 @@ static void diff_iommu(TestGTreeIOMMU *iommu1, TestGTreeIOMMU *iommu2)
 
 static void test_gtree_load_domain(void)
 {
+    Error *local_err = NULL;
+    int ret;
     TestGTreeDomain *dest_domain = g_new0(TestGTreeDomain, 1);
     TestGTreeDomain *orig_domain = create_first_domain();
     QEMUFile *fload, *fsave;
@@ -1127,7 +1157,11 @@ static void test_gtree_load_domain(void)
 
     fload = open_test_file(false);
 
-    vmstate_load_state(fload, &vmstate_domain, dest_domain, 1);
+    ret = vmstate_load_state(fload, &vmstate_domain, dest_domain, 1,
+                             &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     eof = qemu_get_byte(fload);
     g_assert(!qemu_file_get_error(fload));
     g_assert_cmpint(orig_domain->id, ==, dest_domain->id);
@@ -1230,6 +1264,8 @@ static void test_gtree_save_iommu(void)
 
 static void test_gtree_load_iommu(void)
 {
+    Error *local_err = NULL;
+    int ret;
     TestGTreeIOMMU *dest_iommu = g_new0(TestGTreeIOMMU, 1);
     TestGTreeIOMMU *orig_iommu = create_iommu();
     QEMUFile *fsave, *fload;
@@ -1241,7 +1277,10 @@ static void test_gtree_load_iommu(void)
     qemu_fclose(fsave);
 
     fload = open_test_file(false);
-    vmstate_load_state(fload, &vmstate_iommu, dest_iommu, 1);
+    ret = vmstate_load_state(fload, &vmstate_iommu, dest_iommu, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     eof = qemu_get_byte(fload);
     g_assert(!qemu_file_get_error(fload));
     g_assert_cmpint(orig_iommu->id, ==, dest_iommu->id);
@@ -1363,6 +1402,8 @@ static void test_save_qlist(void)
 
 static void test_load_qlist(void)
 {
+    Error *local_err = NULL;
+    int ret;
     QEMUFile *fsave, *fload;
     TestQListContainer *orig_container = alloc_container();
     TestQListContainer *dest_container = g_new0(TestQListContainer, 1);
@@ -1376,7 +1417,11 @@ static void test_load_qlist(void)
     qemu_fclose(fsave);
 
     fload = open_test_file(false);
-    vmstate_load_state(fload, &vmstate_container, dest_container, 1);
+    ret = vmstate_load_state(fload, &vmstate_container, dest_container, 1,
+                             &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     eof = qemu_get_byte(fload);
     g_assert(!qemu_file_get_error(fload));
     g_assert_cmpint(eof, ==, QEMU_VM_EOF);
diff --git a/ui/vdagent.c b/ui/vdagent.c
index c0746fe5b1..bc3c77f013 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -1001,6 +1001,7 @@ static int get_cbinfo(QEMUFile *f, void *pv, size_t size,
     VDAgentChardev *vd = QEMU_VDAGENT_CHARDEV(pv);
     struct CBInfoArray cbinfo = {};
     int i, ret;
+    Error *local_err = NULL;
 
     if (!have_clipboard(vd)) {
         return 0;
@@ -1008,8 +1009,10 @@ static int get_cbinfo(QEMUFile *f, void *pv, size_t size,
 
     vdagent_clipboard_peer_register(vd);
 
-    ret = vmstate_load_state(f, &vmstate_cbinfo_array, &cbinfo, 0);
+    ret = vmstate_load_state(f, &vmstate_cbinfo_array, &cbinfo, 0,
+                             &local_err);
     if (ret) {
+        error_report_err(local_err);
         return ret;
     }
 

From 71cf63a471a5814fa2c29c74e268838851b14d01 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:20 +0530
Subject: [PATCH 0888/2396] migration: push Error **errp into
 qemu_loadvm_state_header()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_loadvm_state_header() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-3-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 55c99e0902..8ac3d33814 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2814,38 +2814,43 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
     return 0;
 }
 
-static int qemu_loadvm_state_header(QEMUFile *f)
+static int qemu_loadvm_state_header(QEMUFile *f, Error **errp)
 {
     unsigned int v;
     int ret;
-    Error *local_err = NULL;
 
     v = qemu_get_be32(f);
     if (v != QEMU_VM_FILE_MAGIC) {
-        error_report("Not a migration stream");
+        error_setg(errp, "Not a migration stream, magic: %x != %x",
+                   v, QEMU_VM_FILE_MAGIC);
         return -EINVAL;
     }
 
     v = qemu_get_be32(f);
     if (v == QEMU_VM_FILE_VERSION_COMPAT) {
-        error_report("SaveVM v2 format is obsolete and don't work anymore");
+        error_setg(errp,
+                   "SaveVM v2 format is obsolete and no longer supported");
+
         return -ENOTSUP;
     }
     if (v != QEMU_VM_FILE_VERSION) {
-        error_report("Unsupported migration stream version");
+        error_setg(errp, "Unsupported migration stream version, "
+                   "file version %x != %x",
+                   v, QEMU_VM_FILE_VERSION);
         return -ENOTSUP;
     }
 
     if (migrate_get_current()->send_configuration) {
-        if (qemu_get_byte(f) != QEMU_VM_CONFIGURATION) {
-            error_report("Configuration section missing");
+        v = qemu_get_byte(f);
+        if (v != QEMU_VM_CONFIGURATION) {
+            error_setg(errp, "Configuration section missing, %x != %x",
+                       v, QEMU_VM_CONFIGURATION);
             return -EINVAL;
         }
-        ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0,
-                                 &local_err);
 
+        ret = vmstate_load_state(f, &vmstate_configuration, &savevm_state, 0,
+                                 errp);
         if (ret) {
-            error_report_err(local_err);
             return ret;
         }
     }
@@ -3121,8 +3126,9 @@ int qemu_loadvm_state(QEMUFile *f)
 
     qemu_loadvm_thread_pool_create(mis);
 
-    ret = qemu_loadvm_state_header(f);
+    ret = qemu_loadvm_state_header(f, &local_err);
     if (ret) {
+        error_report_err(local_err);
         return ret;
     }
 

From e97da6b583d7cf7d5289cbe9faf280bd453d6391 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:21 +0530
Subject: [PATCH 0889/2396] migration: push Error **errp into vmstate_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that vmstate_load() must report an error
in errp, in case of failure.

The errors are temporarily reported using error_report_err().
This is removed in the subsequent patches in this series
when we are actually able to propagate the error to the calling
function.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-4-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 8ac3d33814..fffea57cd9 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -963,14 +963,20 @@ void vmstate_unregister(VMStateIf *obj, const VMStateDescription *vmsd,
     }
 }
 
-static int vmstate_load(QEMUFile *f, SaveStateEntry *se)
+static int vmstate_load(QEMUFile *f, SaveStateEntry *se, Error **errp)
 {
+    int ret;
     trace_vmstate_load(se->idstr, se->vmsd ? se->vmsd->name : "(old)");
     if (!se->vmsd) {         /* Old style */
-        return se->ops->load_state(f, se->opaque, se->load_version_id);
+        ret = se->ops->load_state(f, se->opaque, se->load_version_id);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load vmstate version_id: %d, ret: %d",
+                       se->load_version_id, ret);
+        }
+        return ret;
     }
     return vmstate_load_state(f, se->vmsd, se->opaque, se->load_version_id,
-                              &error_fatal);
+                              errp);
 }
 
 static void vmstate_save_old_style(QEMUFile *f, SaveStateEntry *se,
@@ -2692,6 +2698,7 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
     SaveStateEntry *se;
     char idstr[256];
     int ret;
+    Error *local_err = NULL;
 
     /* Read section start */
     section_id = qemu_get_be32(f);
@@ -2741,10 +2748,11 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
         start_ts = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
     }
 
-    ret = vmstate_load(f, se);
+    ret = vmstate_load(f, se, &local_err);
     if (ret < 0) {
         error_report("error while loading state for instance 0x%"PRIx32" of"
                      " device '%s'", instance_id, idstr);
+        error_report_err(local_err);
         return ret;
     }
 
@@ -2769,6 +2777,7 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
     uint32_t section_id;
     SaveStateEntry *se;
     int ret;
+    Error *local_err = NULL;
 
     section_id = qemu_get_be32(f);
 
@@ -2794,10 +2803,9 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
         start_ts = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
     }
 
-    ret = vmstate_load(f, se);
+    ret = vmstate_load(f, se, &local_err);
     if (ret < 0) {
-        error_report("error while loading state section id %d(%s)",
-                     section_id, se->idstr);
+        error_report_err(local_err);
         return ret;
     }
 

From 5fb0cfbb3576d5f545fef5746a08719ce8ab50ea Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:22 +0530
Subject: [PATCH 0890/2396] migration: push Error **errp into
 loadvm_process_command()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_process_command() must report an error
in errp, in case of failure.

The errors are temporarily reported using error_report_err().
This is removed in the subsequent patches in this series
when we are actually able to propagate the error to the calling
function.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-5-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 86 +++++++++++++++++++++++++++++++++-------------
 1 file changed, 63 insertions(+), 23 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index fffea57cd9..d1ed2e1cde 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2546,32 +2546,37 @@ static int loadvm_postcopy_handle_switchover_start(void)
  * LOADVM_QUIT All good, but exit the loop
  * <0          Error
  */
-static int loadvm_process_command(QEMUFile *f)
+static int loadvm_process_command(QEMUFile *f, Error **errp)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
     uint16_t cmd;
     uint16_t len;
     uint32_t tmp32;
+    int ret;
 
     cmd = qemu_get_be16(f);
     len = qemu_get_be16(f);
 
     /* Check validity before continue processing of cmds */
-    if (qemu_file_get_error(f)) {
-        return qemu_file_get_error(f);
+    ret = qemu_file_get_error(f);
+    if (ret) {
+        error_setg(errp,
+                   "Failed to load VM process command: stream error: %d",
+                   ret);
+        return ret;
     }
 
     if (cmd >= MIG_CMD_MAX || cmd == MIG_CMD_INVALID) {
-        error_report("MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
+        error_setg(errp, "MIG_CMD 0x%x unknown (len 0x%x)", cmd, len);
         return -EINVAL;
     }
 
     trace_loadvm_process_command(mig_cmd_args[cmd].name, len);
 
     if (mig_cmd_args[cmd].len != -1 && mig_cmd_args[cmd].len != len) {
-        error_report("%s received with bad length - expecting %zu, got %d",
-                     mig_cmd_args[cmd].name,
-                     (size_t)mig_cmd_args[cmd].len, len);
+        error_setg(errp, "%s received with bad length - expecting %zu, got %d",
+                   mig_cmd_args[cmd].name,
+                   (size_t)mig_cmd_args[cmd].len, len);
         return -ERANGE;
     }
 
@@ -2584,7 +2589,7 @@ static int loadvm_process_command(QEMUFile *f)
         }
         mis->to_src_file = qemu_file_get_return_path(f);
         if (!mis->to_src_file) {
-            error_report("CMD_OPEN_RETURN_PATH failed");
+            error_setg(errp, "CMD_OPEN_RETURN_PATH failed");
             return -1;
         }
 
@@ -2594,11 +2599,10 @@ static int loadvm_process_command(QEMUFile *f)
          * been created.
          */
         if (migrate_switchover_ack() && !mis->switchover_ack_pending_num) {
-            int ret = migrate_send_rp_switchover_ack(mis);
+            ret = migrate_send_rp_switchover_ack(mis);
             if (ret) {
-                error_report(
-                    "Could not send switchover ack RP MSG, err %d (%s)", ret,
-                    strerror(-ret));
+                error_setg_errno(errp, -ret,
+                                 "Could not send switchover ack RP MSG");
                 return ret;
             }
         }
@@ -2608,39 +2612,71 @@ static int loadvm_process_command(QEMUFile *f)
         tmp32 = qemu_get_be32(f);
         trace_loadvm_process_command_ping(tmp32);
         if (!mis->to_src_file) {
-            error_report("CMD_PING (0x%x) received with no return path",
-                         tmp32);
+            error_setg(errp, "CMD_PING (0x%x) received with no return path",
+                       tmp32);
             return -1;
         }
         migrate_send_rp_pong(mis, tmp32);
         break;
 
     case MIG_CMD_PACKAGED:
-        return loadvm_handle_cmd_packaged(mis);
+        ret = loadvm_handle_cmd_packaged(mis);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_POSTCOPY_ADVISE:
-        return loadvm_postcopy_handle_advise(mis, len);
+        ret = loadvm_postcopy_handle_advise(mis, len);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_POSTCOPY_LISTEN:
-        return loadvm_postcopy_handle_listen(mis);
+        ret = loadvm_postcopy_handle_listen(mis);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_POSTCOPY_RUN:
-        return loadvm_postcopy_handle_run(mis);
+        ret = loadvm_postcopy_handle_run(mis);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_POSTCOPY_RAM_DISCARD:
-        return loadvm_postcopy_ram_handle_discard(mis, len);
+        ret = loadvm_postcopy_ram_handle_discard(mis, len);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_POSTCOPY_RESUME:
         return loadvm_postcopy_handle_resume(mis);
 
     case MIG_CMD_RECV_BITMAP:
-        return loadvm_handle_recv_bitmap(mis, len);
+        ret = loadvm_handle_recv_bitmap(mis, len);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_ENABLE_COLO:
-        return loadvm_process_enable_colo(mis);
+        ret = loadvm_process_enable_colo(mis);
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
 
     case MIG_CMD_SWITCHOVER_START:
-        return loadvm_postcopy_handle_switchover_start();
+        ret = loadvm_postcopy_handle_switchover_start();
+        if (ret < 0) {
+            error_setg(errp, "Failed to load device state command: %d", ret);
+        }
+        return ret;
     }
 
     return 0;
@@ -3049,6 +3085,7 @@ int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
 {
     uint8_t section_type;
     int ret = 0;
+    Error *local_err = NULL;
 
 retry:
     while (true) {
@@ -3076,7 +3113,10 @@ retry:
             }
             break;
         case QEMU_VM_COMMAND:
-            ret = loadvm_process_command(f);
+            ret = loadvm_process_command(f, &local_err);
+            if (ret < 0) {
+                error_report_err(local_err);
+            }
             trace_qemu_loadvm_state_section_command(ret);
             if ((ret < 0) || (ret == LOADVM_QUIT)) {
                 goto out;

From 829f0d238dd402d60738464a4cac81574b74f431 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:23 +0530
Subject: [PATCH 0891/2396] migration: push Error **errp into
 loadvm_handle_cmd_packaged()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_handle_cmd_packaged() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-6-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index d1ed2e1cde..5e54651652 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2405,7 +2405,7 @@ static int loadvm_postcopy_handle_resume(MigrationIncomingState *mis)
  * Returns: Negative values on error
  *
  */
-static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
+static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis, Error **errp)
 {
     int ret;
     size_t length;
@@ -2415,7 +2415,7 @@ static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
     trace_loadvm_handle_cmd_packaged(length);
 
     if (length > MAX_VM_CMD_PACKAGED_SIZE) {
-        error_report("Unreasonably large packaged state: %zu", length);
+        error_setg(errp, "Unreasonably large packaged state: %zu", length);
         return -1;
     }
 
@@ -2426,8 +2426,8 @@ static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
                           length);
     if (ret != length) {
         object_unref(OBJECT(bioc));
-        error_report("CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
-                     ret, length);
+        error_setg(errp, "CMD_PACKAGED: Buffer receive fail ret=%d length=%zu",
+                   ret, length);
         return (ret < 0) ? ret : -EAGAIN;
     }
     bioc->usage += length;
@@ -2457,6 +2457,9 @@ static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis)
     } while (1);
 
     ret = qemu_loadvm_state_main(packf, mis);
+    if (ret < 0) {
+        error_setg(errp, "VM state load failed: %d", ret);
+    }
     trace_loadvm_handle_cmd_packaged_main(ret);
     qemu_fclose(packf);
     object_unref(OBJECT(bioc));
@@ -2620,11 +2623,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         break;
 
     case MIG_CMD_PACKAGED:
-        ret = loadvm_handle_cmd_packaged(mis);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_handle_cmd_packaged(mis, errp);
 
     case MIG_CMD_POSTCOPY_ADVISE:
         ret = loadvm_postcopy_handle_advise(mis, len);

From 9535435795983caa31070b8b642539b5a658dc2f Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:24 +0530
Subject: [PATCH 0892/2396] migration: push Error **errp into
 qemu_loadvm_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_loadvm_state() must report an error
in errp, in case of failure.

When postcopy live migration runs, the device states are loaded by
both the qemu coroutine process_incoming_migration_co() and the
postcopy_ram_listen_thread(). Therefore, it is important that the
coroutine also reports the error in case of failure, with
error_report_err(). Otherwise, the source qemu will not display
any errors before going into the postcopy pause state.

Suggested-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-7-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 14 ++++++++++++--
 migration/savevm.c    | 30 ++++++++++++++++++------------
 migration/savevm.h    |  2 +-
 3 files changed, 31 insertions(+), 15 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index e1ac4d73c2..cba2a39355 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -881,7 +881,7 @@ process_incoming_migration_co(void *opaque)
                       MIGRATION_STATUS_ACTIVE);
 
     mis->loadvm_co = qemu_coroutine_self();
-    ret = qemu_loadvm_state(mis->from_src_file);
+    ret = qemu_loadvm_state(mis->from_src_file, &local_err);
     mis->loadvm_co = NULL;
 
     trace_vmstate_downtime_checkpoint("dst-precopy-loadvm-completed");
@@ -908,7 +908,8 @@ process_incoming_migration_co(void *opaque)
     }
 
     if (ret < 0) {
-        error_setg(&local_err, "load of migration failed: %s", strerror(-ret));
+        error_prepend(&local_err, "load of migration failed: %s: ",
+                      strerror(-ret));
         goto fail;
     }
 
@@ -935,6 +936,15 @@ fail:
         }
 
         exit(EXIT_FAILURE);
+    } else {
+        /*
+         * Report the error here in case that QEMU abruptly exits
+         * when postcopy is enabled.
+         */
+        WITH_QEMU_LOCK_GUARD(&s->error_mutex) {
+            error_report_err(s->error);
+            s->error = NULL;
+        }
     }
 out:
     /* Pairs with the refcount taken in qmp_migrate_incoming() */
diff --git a/migration/savevm.c b/migration/savevm.c
index 5e54651652..88116ed278 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3159,28 +3159,24 @@ out:
     return ret;
 }
 
-int qemu_loadvm_state(QEMUFile *f)
+int qemu_loadvm_state(QEMUFile *f, Error **errp)
 {
     MigrationState *s = migrate_get_current();
     MigrationIncomingState *mis = migration_incoming_get_current();
-    Error *local_err = NULL;
     int ret;
 
-    if (qemu_savevm_state_blocked(&local_err)) {
-        error_report_err(local_err);
+    if (qemu_savevm_state_blocked(errp)) {
         return -EINVAL;
     }
 
     qemu_loadvm_thread_pool_create(mis);
 
-    ret = qemu_loadvm_state_header(f, &local_err);
+    ret = qemu_loadvm_state_header(f, errp);
     if (ret) {
-        error_report_err(local_err);
         return ret;
     }
 
-    if (qemu_loadvm_state_setup(f, &local_err) != 0) {
-        error_report_err(local_err);
+    if (qemu_loadvm_state_setup(f, errp) != 0) {
         return -EINVAL;
     }
 
@@ -3191,6 +3187,9 @@ int qemu_loadvm_state(QEMUFile *f)
     cpu_synchronize_all_pre_loadvm();
 
     ret = qemu_loadvm_state_main(f, mis);
+    if (ret < 0) {
+        error_setg(errp, "Load VM state failed: %d", ret);
+    }
     qemu_event_set(&mis->main_thread_load_event);
 
     trace_qemu_loadvm_state_post_main(ret);
@@ -3208,8 +3207,15 @@ int qemu_loadvm_state(QEMUFile *f)
         if (migrate_has_error(migrate_get_current()) ||
             !qemu_loadvm_thread_pool_wait(s, mis)) {
             ret = -EINVAL;
+            error_setg(errp,
+                       "Error while loading vmstate");
         } else {
             ret = qemu_file_get_error(f);
+            if (ret < 0) {
+                error_setg(errp,
+                           "Error while loading vmstate: stream error: %d",
+                           ret);
+            }
         }
     }
     /*
@@ -3474,6 +3480,7 @@ void qmp_xen_save_devices_state(const char *filename, bool has_live, bool live,
 
 void qmp_xen_load_devices_state(const char *filename, Error **errp)
 {
+    ERRP_GUARD();
     QEMUFile *f;
     QIOChannelFile *ioc;
     int ret;
@@ -3495,10 +3502,10 @@ void qmp_xen_load_devices_state(const char *filename, Error **errp)
     f = qemu_file_new_input(QIO_CHANNEL(ioc));
     object_unref(OBJECT(ioc));
 
-    ret = qemu_loadvm_state(f);
+    ret = qemu_loadvm_state(f, errp);
     qemu_fclose(f);
     if (ret < 0) {
-        error_setg(errp, "loading Xen device state failed");
+        error_prepend(errp, "loading Xen device state failed: ");
     }
     migration_incoming_state_destroy();
 }
@@ -3569,13 +3576,12 @@ bool load_snapshot(const char *name, const char *vmstate,
         ret = -EINVAL;
         goto err_drain;
     }
-    ret = qemu_loadvm_state(f);
+    ret = qemu_loadvm_state(f, errp);
     migration_incoming_state_destroy();
 
     bdrv_drain_all_end();
 
     if (ret < 0) {
-        error_setg(errp, "Error %d while loading VM state", ret);
         return false;
     }
 
diff --git a/migration/savevm.h b/migration/savevm.h
index 2d5e9c7166..b80770b746 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -64,7 +64,7 @@ void qemu_savevm_send_colo_enable(QEMUFile *f);
 void qemu_savevm_live_state(QEMUFile *f);
 int qemu_save_device_state(QEMUFile *f);
 
-int qemu_loadvm_state(QEMUFile *f);
+int qemu_loadvm_state(QEMUFile *f, Error **errp);
 void qemu_loadvm_state_cleanup(MigrationIncomingState *mis);
 int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
 int qemu_load_device_state(QEMUFile *f);

From 84279d5dc1afb115c673007d65bae575da04e115 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:25 +0530
Subject: [PATCH 0893/2396] migration: push Error **errp into
 qemu_load_device_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_load_device_state() must report an error
in errp, in case of failure.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-8-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/colo.c   | 3 +--
 migration/savevm.c | 4 ++--
 migration/savevm.h | 2 +-
 3 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/migration/colo.c b/migration/colo.c
index cf4d71d9ed..a426ec5b60 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -729,9 +729,8 @@ static void colo_incoming_process_checkpoint(MigrationIncomingState *mis,
     bql_lock();
     vmstate_loading = true;
     colo_flush_ram_cache();
-    ret = qemu_load_device_state(fb);
+    ret = qemu_load_device_state(fb, errp);
     if (ret < 0) {
-        error_setg(errp, "COLO: load device state failed");
         vmstate_loading = false;
         bql_unlock();
         return;
diff --git a/migration/savevm.c b/migration/savevm.c
index 88116ed278..9e30718995 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3264,7 +3264,7 @@ int qemu_loadvm_state(QEMUFile *f, Error **errp)
     return ret;
 }
 
-int qemu_load_device_state(QEMUFile *f)
+int qemu_load_device_state(QEMUFile *f, Error **errp)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
     int ret;
@@ -3272,7 +3272,7 @@ int qemu_load_device_state(QEMUFile *f)
     /* Load QEMU_VM_SECTION_FULL section */
     ret = qemu_loadvm_state_main(f, mis);
     if (ret < 0) {
-        error_report("Failed to load device state: %d", ret);
+        error_setg(errp, "Failed to load device state: %d", ret);
         return ret;
     }
 
diff --git a/migration/savevm.h b/migration/savevm.h
index b80770b746..b12681839f 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -67,7 +67,7 @@ int qemu_save_device_state(QEMUFile *f);
 int qemu_loadvm_state(QEMUFile *f, Error **errp);
 void qemu_loadvm_state_cleanup(MigrationIncomingState *mis);
 int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
-int qemu_load_device_state(QEMUFile *f);
+int qemu_load_device_state(QEMUFile *f, Error **errp);
 int qemu_loadvm_approve_switchover(void);
 int qemu_savevm_state_complete_precopy_non_iterable(QEMUFile *f,
         bool in_postcopy);

From deecb4e7133c573a85558e29dff61ae428a9cfe8 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:26 +0530
Subject: [PATCH 0894/2396] migration: push Error **errp into
 qemu_loadvm_state_main()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_loadvm_state_main() must report an error
in errp, in case of failure.

Set errp explicitly if it is NULL in case of failure in the out
section. This will be removed in the subsequent patch when all of
the calls are converted to passing errp.

The error message in the default case of qemu_loadvm_state_main()
has the word "savevm". This is removed because it can confuse the
user while reading destination side error logs.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-9-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/colo.c   |  3 +--
 migration/savevm.c | 36 +++++++++++++++++-------------------
 migration/savevm.h |  3 ++-
 3 files changed, 20 insertions(+), 22 deletions(-)

diff --git a/migration/colo.c b/migration/colo.c
index a426ec5b60..ad50a3abc9 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -686,11 +686,10 @@ static void colo_incoming_process_checkpoint(MigrationIncomingState *mis,
 
     bql_lock();
     cpu_synchronize_all_states();
-    ret = qemu_loadvm_state_main(mis->from_src_file, mis);
+    ret = qemu_loadvm_state_main(mis->from_src_file, mis, errp);
     bql_unlock();
 
     if (ret < 0) {
-        error_setg(errp, "Load VM's live state (ram) error");
         return;
     }
 
diff --git a/migration/savevm.c b/migration/savevm.c
index 9e30718995..f1338f5cf6 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2105,7 +2105,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
     qemu_file_set_blocking(f, true, &error_fatal);
 
     /* TODO: sanity check that only postcopiable data will be loaded here */
-    load_res = qemu_loadvm_state_main(f, mis);
+    load_res = qemu_loadvm_state_main(f, mis, &error_fatal);
 
     /*
      * This is tricky, but, mis->from_src_file can change after it
@@ -2456,10 +2456,7 @@ static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis, Error **errp)
         qemu_coroutine_yield();
     } while (1);
 
-    ret = qemu_loadvm_state_main(packf, mis);
-    if (ret < 0) {
-        error_setg(errp, "VM state load failed: %d", ret);
-    }
+    ret = qemu_loadvm_state_main(packf, mis, errp);
     trace_loadvm_handle_cmd_packaged_main(ret);
     qemu_fclose(packf);
     object_unref(OBJECT(bioc));
@@ -3080,18 +3077,22 @@ static bool postcopy_pause_incoming(MigrationIncomingState *mis)
     return true;
 }
 
-int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis)
+int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis,
+                           Error **errp)
 {
+    ERRP_GUARD();
     uint8_t section_type;
     int ret = 0;
-    Error *local_err = NULL;
 
 retry:
     while (true) {
         section_type = qemu_get_byte(f);
 
-        ret = qemu_file_get_error_obj_any(f, mis->postcopy_qemufile_dst, NULL);
+        ret = qemu_file_get_error_obj_any(f, mis->postcopy_qemufile_dst, errp);
         if (ret) {
+            error_prepend(errp,
+                          "Failed to load section ID: stream error: %d: ",
+                          ret);
             break;
         }
 
@@ -3112,10 +3113,7 @@ retry:
             }
             break;
         case QEMU_VM_COMMAND:
-            ret = loadvm_process_command(f, &local_err);
-            if (ret < 0) {
-                error_report_err(local_err);
-            }
+            ret = loadvm_process_command(f, errp);
             trace_qemu_loadvm_state_section_command(ret);
             if ((ret < 0) || (ret == LOADVM_QUIT)) {
                 goto out;
@@ -3125,7 +3123,7 @@ retry:
             /* This is the end of migration */
             goto out;
         default:
-            error_report("Unknown savevm section type %d", section_type);
+            error_setg(errp, "Unknown section type %d", section_type);
             ret = -EINVAL;
             goto out;
         }
@@ -3133,6 +3131,9 @@ retry:
 
 out:
     if (ret < 0) {
+        if (*errp == NULL) {
+            error_setg(errp, "Loading VM state failed: %d", ret);
+        }
         qemu_file_set_error(f, ret);
 
         /* Cancel bitmaps incoming regardless of recovery */
@@ -3153,6 +3154,7 @@ out:
             migrate_postcopy_ram() && postcopy_pause_incoming(mis)) {
             /* Reset f to point to the newly created channel */
             f = mis->from_src_file;
+            error_free_or_abort(errp);
             goto retry;
         }
     }
@@ -3186,10 +3188,7 @@ int qemu_loadvm_state(QEMUFile *f, Error **errp)
 
     cpu_synchronize_all_pre_loadvm();
 
-    ret = qemu_loadvm_state_main(f, mis);
-    if (ret < 0) {
-        error_setg(errp, "Load VM state failed: %d", ret);
-    }
+    ret = qemu_loadvm_state_main(f, mis, errp);
     qemu_event_set(&mis->main_thread_load_event);
 
     trace_qemu_loadvm_state_post_main(ret);
@@ -3270,9 +3269,8 @@ int qemu_load_device_state(QEMUFile *f, Error **errp)
     int ret;
 
     /* Load QEMU_VM_SECTION_FULL section */
-    ret = qemu_loadvm_state_main(f, mis);
+    ret = qemu_loadvm_state_main(f, mis, errp);
     if (ret < 0) {
-        error_setg(errp, "Failed to load device state: %d", ret);
         return ret;
     }
 
diff --git a/migration/savevm.h b/migration/savevm.h
index b12681839f..c337e3e3d1 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -66,7 +66,8 @@ int qemu_save_device_state(QEMUFile *f);
 
 int qemu_loadvm_state(QEMUFile *f, Error **errp);
 void qemu_loadvm_state_cleanup(MigrationIncomingState *mis);
-int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis);
+int qemu_loadvm_state_main(QEMUFile *f, MigrationIncomingState *mis,
+                           Error **errp);
 int qemu_load_device_state(QEMUFile *f, Error **errp);
 int qemu_loadvm_approve_switchover(void);
 int qemu_savevm_state_complete_precopy_non_iterable(QEMUFile *f,

From 4493752653141b480d6f4c4df4b25b71a8753b98 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:27 +0530
Subject: [PATCH 0895/2396] migration: push Error **errp into
 qemu_loadvm_section_start_full()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_loadvm_section_start_full() must report an error
in errp, in case of failure.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-10-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index f1338f5cf6..83d8fb8f41 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2722,21 +2722,21 @@ static bool check_section_footer(QEMUFile *f, SaveStateEntry *se)
 }
 
 static int
-qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
+qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type, Error **errp)
 {
+    ERRP_GUARD();
     bool trace_downtime = (type == QEMU_VM_SECTION_FULL);
     uint32_t instance_id, version_id, section_id;
     int64_t start_ts, end_ts;
     SaveStateEntry *se;
     char idstr[256];
     int ret;
-    Error *local_err = NULL;
 
     /* Read section start */
     section_id = qemu_get_be32(f);
     if (!qemu_get_counted_string(f, idstr)) {
-        error_report("Unable to read ID string for section %u",
-                     section_id);
+        error_setg(errp, "Unable to read ID string for section %u",
+                   section_id);
         return -EINVAL;
     }
     instance_id = qemu_get_be32(f);
@@ -2744,8 +2744,7 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
 
     ret = qemu_file_get_error(f);
     if (ret) {
-        error_report("%s: Failed to read instance/version ID: %d",
-                     __func__, ret);
+        error_setg(errp, "Failed to read instance/version ID: %d", ret);
         return ret;
     }
 
@@ -2754,17 +2753,17 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
     /* Find savevm section */
     se = find_se(idstr, instance_id);
     if (se == NULL) {
-        error_report("Unknown savevm section or instance '%s' %"PRIu32". "
-                     "Make sure that your current VM setup matches your "
-                     "saved VM setup, including any hotplugged devices",
-                     idstr, instance_id);
+        error_setg(errp, "Unknown section or instance '%s' %"PRIu32". "
+                   "Make sure that your current VM setup matches your "
+                   "saved VM setup, including any hotplugged devices",
+                   idstr, instance_id);
         return -EINVAL;
     }
 
     /* Validate version */
     if (version_id > se->version_id) {
-        error_report("savevm: unsupported version %d for '%s' v%d",
-                     version_id, idstr, se->version_id);
+        error_setg(errp, "unsupported version %d for '%s' v%d",
+                   version_id, idstr, se->version_id);
         return -EINVAL;
     }
     se->load_version_id = version_id;
@@ -2772,7 +2771,7 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
 
     /* Validate if it is a device's state */
     if (xen_enabled() && se->is_ram) {
-        error_report("loadvm: %s RAM loading not allowed on Xen", idstr);
+        error_setg(errp, "loadvm: %s RAM loading not allowed on Xen", idstr);
         return -EINVAL;
     }
 
@@ -2780,11 +2779,11 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
         start_ts = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
     }
 
-    ret = vmstate_load(f, se, &local_err);
+    ret = vmstate_load(f, se, errp);
     if (ret < 0) {
-        error_report("error while loading state for instance 0x%"PRIx32" of"
-                     " device '%s'", instance_id, idstr);
-        error_report_err(local_err);
+        error_prepend(errp,
+                      "error while loading state for instance 0x%"PRIx32" of"
+                      " device '%s': ", instance_id, idstr);
         return ret;
     }
 
@@ -2795,6 +2794,8 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type)
     }
 
     if (!check_section_footer(f, se)) {
+        error_setg(errp, "Section footer error, section_id: %d",
+                   section_id);
         return -EINVAL;
     }
 
@@ -3100,7 +3101,7 @@ retry:
         switch (section_type) {
         case QEMU_VM_SECTION_START:
         case QEMU_VM_SECTION_FULL:
-            ret = qemu_loadvm_section_start_full(f, section_type);
+            ret = qemu_loadvm_section_start_full(f, section_type, errp);
             if (ret < 0) {
                 goto out;
             }

From 8b6dad124ba757ba96a3b4456223e53632371bc8 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:28 +0530
Subject: [PATCH 0896/2396] migration: push Error **errp into
 qemu_loadvm_section_part_end()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that qemu_loadvm_section_part_end() must report an error
in errp, in case of failure.
This patch also removes the setting of errp when errp is NULL in the
out section as it is no longer required in the series.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-11-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 83d8fb8f41..c1ae36b50a 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2803,21 +2803,19 @@ qemu_loadvm_section_start_full(QEMUFile *f, uint8_t type, Error **errp)
 }
 
 static int
-qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
+qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type, Error **errp)
 {
     bool trace_downtime = (type == QEMU_VM_SECTION_END);
     int64_t start_ts, end_ts;
     uint32_t section_id;
     SaveStateEntry *se;
     int ret;
-    Error *local_err = NULL;
 
     section_id = qemu_get_be32(f);
 
     ret = qemu_file_get_error(f);
     if (ret) {
-        error_report("%s: Failed to read section ID: %d",
-                     __func__, ret);
+        error_setg(errp, "Failed to read section ID: %d", ret);
         return ret;
     }
 
@@ -2828,7 +2826,7 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
         }
     }
     if (se == NULL) {
-        error_report("Unknown savevm section %d", section_id);
+        error_setg(errp, "Unknown section %d", section_id);
         return -EINVAL;
     }
 
@@ -2836,9 +2834,8 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
         start_ts = qemu_clock_get_us(QEMU_CLOCK_REALTIME);
     }
 
-    ret = vmstate_load(f, se, &local_err);
+    ret = vmstate_load(f, se, errp);
     if (ret < 0) {
-        error_report_err(local_err);
         return ret;
     }
 
@@ -2849,6 +2846,8 @@ qemu_loadvm_section_part_end(QEMUFile *f, uint8_t type)
     }
 
     if (!check_section_footer(f, se)) {
+        error_setg(errp, "Section footer error, section_id: %d",
+                   section_id);
         return -EINVAL;
     }
 
@@ -3108,7 +3107,7 @@ retry:
             break;
         case QEMU_VM_SECTION_PART:
         case QEMU_VM_SECTION_END:
-            ret = qemu_loadvm_section_part_end(f, section_type);
+            ret = qemu_loadvm_section_part_end(f, section_type, errp);
             if (ret < 0) {
                 goto out;
             }
@@ -3132,9 +3131,6 @@ retry:
 
 out:
     if (ret < 0) {
-        if (*errp == NULL) {
-            error_setg(errp, "Loading VM state failed: %d", ret);
-        }
         qemu_file_set_error(f, ret);
 
         /* Cancel bitmaps incoming regardless of recovery */

From 3f9d6e77b0471c844d5050cc71db0863eb4d1b64 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:29 +0530
Subject: [PATCH 0897/2396] migration: Update qemu_file_get_return_path() docs
 and remove dead checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The documentation of qemu_file_get_return_path() states that it can
return NULL on failure. However, a review of the current implementation
reveals that it is guaranteed that it will always succeed and will never
return NULL.

As a result, the NULL checks post calling the function become redundant.
This commit updates the documentation for the function and removes all
NULL checks throughout the migration code.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-12-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/colo.c      |  4 ----
 migration/migration.c | 12 ++----------
 migration/qemu-file.c |  1 -
 migration/savevm.c    |  4 ----
 4 files changed, 2 insertions(+), 19 deletions(-)

diff --git a/migration/colo.c b/migration/colo.c
index ad50a3abc9..db783f6fa7 100644
--- a/migration/colo.c
+++ b/migration/colo.c
@@ -847,10 +847,6 @@ static void *colo_process_incoming_thread(void *opaque)
     failover_init_state();
 
     mis->to_src_file = qemu_file_get_return_path(mis->from_src_file);
-    if (!mis->to_src_file) {
-        error_report("COLO incoming thread: Open QEMUFile to_src_file failed");
-        goto out;
-    }
     /*
      * Note: the communication between Primary side and Secondary side
      * should be sequential, we set the fd to unblocked in migration incoming
diff --git a/migration/migration.c b/migration/migration.c
index cba2a39355..ce17dcc1c0 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2656,12 +2656,9 @@ out:
     return NULL;
 }
 
-static int open_return_path_on_source(MigrationState *ms)
+static void open_return_path_on_source(MigrationState *ms)
 {
     ms->rp_state.from_dst_file = qemu_file_get_return_path(ms->to_dst_file);
-    if (!ms->rp_state.from_dst_file) {
-        return -1;
-    }
 
     trace_open_return_path_on_source();
 
@@ -2670,8 +2667,6 @@ static int open_return_path_on_source(MigrationState *ms)
     ms->rp_state.rp_thread_created = true;
 
     trace_open_return_path_on_source_continue();
-
-    return 0;
 }
 
 /* Return true if error detected, or false otherwise */
@@ -4022,10 +4017,7 @@ void migration_connect(MigrationState *s, Error *error_in)
      * QEMU uses the return path.
      */
     if (migrate_postcopy_ram() || migrate_return_path()) {
-        if (open_return_path_on_source(s)) {
-            error_setg(&local_err, "Unable to open return-path for postcopy");
-            goto fail;
-        }
+        open_return_path_on_source(s);
     }
 
     /*
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 0f4280df21..0ee0f48a3e 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -125,7 +125,6 @@ static QEMUFile *qemu_file_new_impl(QIOChannel *ioc, bool is_writable)
 
 /*
  * Result: QEMUFile* for a 'return path' for comms in the opposite direction
- *         NULL if not available
  */
 QEMUFile *qemu_file_get_return_path(QEMUFile *f)
 {
diff --git a/migration/savevm.c b/migration/savevm.c
index c1ae36b50a..eb2a905f32 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2588,10 +2588,6 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
             return 0;
         }
         mis->to_src_file = qemu_file_get_return_path(f);
-        if (!mis->to_src_file) {
-            error_setg(errp, "CMD_OPEN_RETURN_PATH failed");
-            return -1;
-        }
 
         /*
          * Switchover ack is enabled but no device uses it, so send an ACK to

From 3cd7a260e54a350e4cf0b49f69dfd61baebfa8fb Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:30 +0530
Subject: [PATCH 0898/2396] migration: make loadvm_postcopy_handle_resume()
 void
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.

Use warn_report() instead of error_report(); it ensures that
a resume command received while the migration is not
in postcopy recover state is not fatal. It only informs that
the command received is unusual, and therefore we should not set
errp with the error string.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-13-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index eb2a905f32..d145e7b1e5 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2334,12 +2334,12 @@ static void migrate_send_rp_req_pages_pending(MigrationIncomingState *mis)
     }
 }
 
-static int loadvm_postcopy_handle_resume(MigrationIncomingState *mis)
+static void loadvm_postcopy_handle_resume(MigrationIncomingState *mis)
 {
     if (mis->state != MIGRATION_STATUS_POSTCOPY_RECOVER) {
-        error_report("%s: illegal resume received", __func__);
+        warn_report("%s: illegal resume received", __func__);
         /* Don't fail the load, only for this. */
-        return 0;
+        return;
     }
 
     /*
@@ -2391,8 +2391,6 @@ static int loadvm_postcopy_handle_resume(MigrationIncomingState *mis)
         /* Kick the fast ram load thread too */
         qemu_sem_post(&mis->postcopy_pause_sem_fast_load);
     }
-
-    return 0;
 }
 
 /**
@@ -2647,7 +2645,8 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return ret;
 
     case MIG_CMD_POSTCOPY_RESUME:
-        return loadvm_postcopy_handle_resume(mis);
+        loadvm_postcopy_handle_resume(mis);
+        return 0;
 
     case MIG_CMD_RECV_BITMAP:
         ret = loadvm_handle_recv_bitmap(mis, len);

From 44cdbaa98e8ccafcda3326d7307f393f06538558 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:31 +0530
Subject: [PATCH 0899/2396] migration: push Error **errp into
 ram_postcopy_incoming_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that ram_postcopy_incoming_init() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-14-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 9 ++++++---
 migration/postcopy-ram.h | 2 +-
 migration/ram.c          | 4 ++--
 migration/ram.h          | 2 +-
 migration/savevm.c       | 2 +-
 5 files changed, 11 insertions(+), 8 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 0172172343..5471efb4f0 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -681,6 +681,7 @@ out:
  */
 static int init_range(RAMBlock *rb, void *opaque)
 {
+    Error **errp = opaque;
     const char *block_name = qemu_ram_get_idstr(rb);
     void *host_addr = qemu_ram_get_host_addr(rb);
     ram_addr_t offset = qemu_ram_get_offset(rb);
@@ -701,6 +702,8 @@ static int init_range(RAMBlock *rb, void *opaque)
      * (Precopy will just overwrite this data, so doesn't need the discard)
      */
     if (ram_discard_range(block_name, 0, length)) {
+        error_setg(errp, "failed to discard RAM block %s len=%zu",
+                   block_name, length);
         return -1;
     }
 
@@ -749,9 +752,9 @@ static int cleanup_range(RAMBlock *rb, void *opaque)
  * postcopy later; must be called prior to any precopy.
  * called from arch_init's similarly named ram_postcopy_incoming_init
  */
-int postcopy_ram_incoming_init(MigrationIncomingState *mis)
+int postcopy_ram_incoming_init(MigrationIncomingState *mis, Error **errp)
 {
-    if (foreach_not_ignored_block(init_range, NULL)) {
+    if (foreach_not_ignored_block(init_range, errp)) {
         return -1;
     }
 
@@ -1703,7 +1706,7 @@ bool postcopy_ram_supported_by_host(MigrationIncomingState *mis, Error **errp)
     return false;
 }
 
-int postcopy_ram_incoming_init(MigrationIncomingState *mis)
+int postcopy_ram_incoming_init(MigrationIncomingState *mis, Error **errp)
 {
     error_report("postcopy_ram_incoming_init: No OS support");
     return -1;
diff --git a/migration/postcopy-ram.h b/migration/postcopy-ram.h
index 3852141d7e..ca19433b24 100644
--- a/migration/postcopy-ram.h
+++ b/migration/postcopy-ram.h
@@ -30,7 +30,7 @@ int postcopy_ram_incoming_setup(MigrationIncomingState *mis);
  * postcopy later; must be called prior to any precopy.
  * called from ram.c's similarly named ram_postcopy_incoming_init
  */
-int postcopy_ram_incoming_init(MigrationIncomingState *mis);
+int postcopy_ram_incoming_init(MigrationIncomingState *mis, Error **errp);
 
 /*
  * At the end of a migration where postcopy_ram_incoming_init was called.
diff --git a/migration/ram.c b/migration/ram.c
index 7208bc114f..6a0dcc04f4 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3716,9 +3716,9 @@ static int ram_load_cleanup(void *opaque)
  * postcopy-ram. postcopy-ram's similarly names
  * postcopy_ram_incoming_init does the work.
  */
-int ram_postcopy_incoming_init(MigrationIncomingState *mis)
+int ram_postcopy_incoming_init(MigrationIncomingState *mis, Error **errp)
 {
-    return postcopy_ram_incoming_init(mis);
+    return postcopy_ram_incoming_init(mis, errp);
 }
 
 /**
diff --git a/migration/ram.h b/migration/ram.h
index 921c39a2c5..275709a991 100644
--- a/migration/ram.h
+++ b/migration/ram.h
@@ -86,7 +86,7 @@ void ram_postcopy_migrated_memory_release(MigrationState *ms);
 void ram_postcopy_send_discard_bitmap(MigrationState *ms);
 /* For incoming postcopy discard */
 int ram_discard_range(const char *block_name, uint64_t start, size_t length);
-int ram_postcopy_incoming_init(MigrationIncomingState *mis);
+int ram_postcopy_incoming_init(MigrationIncomingState *mis, Error **errp);
 int ram_load_postcopy(QEMUFile *f, int channel);
 
 void ram_handle_zero(void *host, uint64_t size);
diff --git a/migration/savevm.c b/migration/savevm.c
index d145e7b1e5..338d1a9756 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1989,7 +1989,7 @@ static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis,
         return -1;
     }
 
-    if (ram_postcopy_incoming_init(mis)) {
+    if (ram_postcopy_incoming_init(mis, NULL) < 0) {
         return -1;
     }
 

From 34a94fe28da7d2e54e02a44e3bce35f1695ee013 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:32 +0530
Subject: [PATCH 0900/2396] migration: push Error **errp into
 loadvm_postcopy_handle_advise()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_postcopy_handle_advise() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-15-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 40 +++++++++++++++++++---------------------
 1 file changed, 19 insertions(+), 21 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 338d1a9756..38e22b435b 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1912,39 +1912,39 @@ enum LoadVMExitCodes {
  * quickly.
  */
 static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis,
-                                         uint16_t len)
+                                         uint16_t len, Error **errp)
 {
     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_ADVISE);
     uint64_t remote_pagesize_summary, local_pagesize_summary, remote_tps;
     size_t page_size = qemu_target_page_size();
-    Error *local_err = NULL;
 
     trace_loadvm_postcopy_handle_advise();
     if (ps != POSTCOPY_INCOMING_NONE) {
-        error_report("CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)", ps);
+        error_setg(errp, "CMD_POSTCOPY_ADVISE in wrong postcopy state (%d)",
+                   ps);
         return -1;
     }
 
     switch (len) {
     case 0:
         if (migrate_postcopy_ram()) {
-            error_report("RAM postcopy is enabled but have 0 byte advise");
+            error_setg(errp, "RAM postcopy is enabled but have 0 byte advise");
             return -EINVAL;
         }
         return 0;
     case 8 + 8:
         if (!migrate_postcopy_ram()) {
-            error_report("RAM postcopy is disabled but have 16 byte advise");
+            error_setg(errp,
+                       "RAM postcopy is disabled but have 16 byte advise");
             return -EINVAL;
         }
         break;
     default:
-        error_report("CMD_POSTCOPY_ADVISE invalid length (%d)", len);
+        error_setg(errp, "CMD_POSTCOPY_ADVISE invalid length (%d)", len);
         return -EINVAL;
     }
 
-    if (!postcopy_ram_supported_by_host(mis, &local_err)) {
-        error_report_err(local_err);
+    if (!postcopy_ram_supported_by_host(mis, errp)) {
         postcopy_state_set(POSTCOPY_INCOMING_NONE);
         return -1;
     }
@@ -1967,9 +1967,10 @@ static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis,
          *      also fails when passed to an older qemu that doesn't
          *      do huge pages.
          */
-        error_report("Postcopy needs matching RAM page sizes (s=%" PRIx64
-                                                             " d=%" PRIx64 ")",
-                     remote_pagesize_summary, local_pagesize_summary);
+        error_setg(errp,
+                   "Postcopy needs matching RAM page sizes "
+                   "(s=%" PRIx64 " d=%" PRIx64 ")",
+                   remote_pagesize_summary, local_pagesize_summary);
         return -1;
     }
 
@@ -1979,17 +1980,18 @@ static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis,
          * Again, some differences could be dealt with, but for now keep it
          * simple.
          */
-        error_report("Postcopy needs matching target page sizes (s=%d d=%zd)",
-                     (int)remote_tps, page_size);
+        error_setg(errp,
+                   "Postcopy needs matching target page sizes (s=%d d=%zd)",
+                   (int)remote_tps, page_size);
         return -1;
     }
 
-    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_ADVISE, &local_err)) {
-        error_report_err(local_err);
+    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_ADVISE, errp)) {
         return -1;
     }
 
-    if (ram_postcopy_incoming_init(mis, NULL) < 0) {
+    if (ram_postcopy_incoming_init(mis, errp) < 0) {
+        error_prepend(errp, "Postcopy RAM incoming init failed: ");
         return -1;
     }
 
@@ -2617,11 +2619,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_handle_cmd_packaged(mis, errp);
 
     case MIG_CMD_POSTCOPY_ADVISE:
-        ret = loadvm_postcopy_handle_advise(mis, len);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_postcopy_handle_advise(mis, len, errp);
 
     case MIG_CMD_POSTCOPY_LISTEN:
         ret = loadvm_postcopy_handle_listen(mis);

From 208e5227669ec8de02bd253626566fd72eb3090c Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:33 +0530
Subject: [PATCH 0901/2396] migration: push Error **errp into
 loadvm_postcopy_handle_listen()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_postcopy_handle_listen() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-16-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 17 +++++++----------
 1 file changed, 7 insertions(+), 10 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 38e22b435b..ce88f56498 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2181,15 +2181,16 @@ static void *postcopy_ram_listen_thread(void *opaque)
 }
 
 /* After this message we must be able to immediately receive postcopy data */
-static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
+static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis,
+                                         Error **errp)
 {
     PostcopyState ps = postcopy_state_set(POSTCOPY_INCOMING_LISTENING);
-    Error *local_err = NULL;
 
     trace_loadvm_postcopy_handle_listen("enter");
 
     if (ps != POSTCOPY_INCOMING_ADVISE && ps != POSTCOPY_INCOMING_DISCARD) {
-        error_report("CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
+        error_setg(errp,
+                   "CMD_POSTCOPY_LISTEN in wrong postcopy state (%d)", ps);
         return -1;
     }
     if (ps == POSTCOPY_INCOMING_ADVISE) {
@@ -2212,14 +2213,14 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis)
     if (migrate_postcopy_ram()) {
         if (postcopy_ram_incoming_setup(mis)) {
             postcopy_ram_incoming_cleanup(mis);
+            error_setg(errp, "Failed to setup incoming postcopy RAM blocks");
             return -1;
         }
     }
 
     trace_loadvm_postcopy_handle_listen("after uffd");
 
-    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_LISTEN, &local_err)) {
-        error_report_err(local_err);
+    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_LISTEN, errp)) {
         return -1;
     }
 
@@ -2622,11 +2623,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_postcopy_handle_advise(mis, len, errp);
 
     case MIG_CMD_POSTCOPY_LISTEN:
-        ret = loadvm_postcopy_handle_listen(mis);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_postcopy_handle_listen(mis, errp);
 
     case MIG_CMD_POSTCOPY_RUN:
         ret = loadvm_postcopy_handle_run(mis);

From ff6ae44e00aec1769629919e30efb3bbd3f991cc Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:34 +0530
Subject: [PATCH 0902/2396] migration: push Error **errp into
 loadvm_postcopy_handle_run()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_postcopy_handle_run() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-17-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index ce88f56498..f7947160fd 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2273,13 +2273,13 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
 }
 
 /* After all discards we can start running and asking for pages */
-static int loadvm_postcopy_handle_run(MigrationIncomingState *mis)
+static int loadvm_postcopy_handle_run(MigrationIncomingState *mis, Error **errp)
 {
     PostcopyState ps = postcopy_state_get();
 
     trace_loadvm_postcopy_handle_run();
     if (ps != POSTCOPY_INCOMING_LISTENING) {
-        error_report("CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
+        error_setg(errp, "CMD_POSTCOPY_RUN in wrong postcopy state (%d)", ps);
         return -1;
     }
 
@@ -2626,11 +2626,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_postcopy_handle_listen(mis, errp);
 
     case MIG_CMD_POSTCOPY_RUN:
-        ret = loadvm_postcopy_handle_run(mis);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_postcopy_handle_run(mis, errp);
 
     case MIG_CMD_POSTCOPY_RAM_DISCARD:
         ret = loadvm_postcopy_ram_handle_discard(mis, len);

From fd487d7fc78e168f530096f63a3159d7ebde4e5d Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:35 +0530
Subject: [PATCH 0903/2396] migration: push Error **errp into
 loadvm_postcopy_ram_handle_discard()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_postcopy_ram_handle_discard() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-18-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index f7947160fd..b80da04b47 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2004,7 +2004,7 @@ static int loadvm_postcopy_handle_advise(MigrationIncomingState *mis,
  * There can be 0..many of these messages, each encoding multiple pages.
  */
 static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
-                                              uint16_t len)
+                                              uint16_t len, Error **errp)
 {
     int tmp;
     char ramid[256];
@@ -2017,6 +2017,7 @@ static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
         /* 1st discard */
         tmp = postcopy_ram_prepare_discard(mis);
         if (tmp) {
+            error_setg(errp, "Failed to prepare for RAM discard: %d", tmp);
             return tmp;
         }
         break;
@@ -2026,8 +2027,9 @@ static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
         break;
 
     default:
-        error_report("CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
-                     ps);
+        error_setg(errp,
+                   "CMD_POSTCOPY_RAM_DISCARD in wrong postcopy state (%d)",
+                   ps);
         return -1;
     }
     /* We're expecting a
@@ -2036,29 +2038,30 @@ static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
      *    then at least 1 16 byte chunk
     */
     if (len < (1 + 1 + 1 + 1 + 2 * 8)) {
-        error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
+        error_setg(errp, "CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
         return -1;
     }
 
     tmp = qemu_get_byte(mis->from_src_file);
     if (tmp != postcopy_ram_discard_version) {
-        error_report("CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
+        error_setg(errp, "CMD_POSTCOPY_RAM_DISCARD invalid version (%d)", tmp);
         return -1;
     }
 
     if (!qemu_get_counted_string(mis->from_src_file, ramid)) {
-        error_report("CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
+        error_setg(errp,
+                   "CMD_POSTCOPY_RAM_DISCARD Failed to read RAMBlock ID");
         return -1;
     }
     tmp = qemu_get_byte(mis->from_src_file);
     if (tmp != 0) {
-        error_report("CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
+        error_setg(errp, "CMD_POSTCOPY_RAM_DISCARD missing nil (%d)", tmp);
         return -1;
     }
 
     len -= 3 + strlen(ramid);
     if (len % 16) {
-        error_report("CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
+        error_setg(errp, "CMD_POSTCOPY_RAM_DISCARD invalid length (%d)", len);
         return -1;
     }
     trace_loadvm_postcopy_ram_handle_discard_header(ramid, len);
@@ -2070,6 +2073,7 @@ static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
         len -= 16;
         int ret = ram_discard_range(ramid, start_addr, block_length);
         if (ret) {
+            error_setg(errp, "Failed to discard RAM range %s: %d", ramid, ret);
             return ret;
         }
     }
@@ -2629,11 +2633,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_postcopy_handle_run(mis, errp);
 
     case MIG_CMD_POSTCOPY_RAM_DISCARD:
-        ret = loadvm_postcopy_ram_handle_discard(mis, len);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_postcopy_ram_handle_discard(mis, len, errp);
 
     case MIG_CMD_POSTCOPY_RESUME:
         loadvm_postcopy_handle_resume(mis);

From 97c2fad858b521afef1d0aad7b6bb880fbe0fb05 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:36 +0530
Subject: [PATCH 0904/2396] migration: push Error **errp into
 loadvm_handle_recv_bitmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_handle_recv_bitmap() must report an error
in errp, in case of failure.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-19-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index b80da04b47..2e8776768f 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2476,32 +2476,35 @@ static int loadvm_handle_cmd_packaged(MigrationIncomingState *mis, Error **errp)
  * len (1 byte) + ramblock_name (<255 bytes)
  */
 static int loadvm_handle_recv_bitmap(MigrationIncomingState *mis,
-                                     uint16_t len)
+                                     uint16_t len, Error **errp)
 {
     QEMUFile *file = mis->from_src_file;
     RAMBlock *rb;
     char block_name[256];
     size_t cnt;
+    int ret;
 
     cnt = qemu_get_counted_string(file, block_name);
     if (!cnt) {
-        error_report("%s: failed to read block name", __func__);
+        error_setg(errp, "failed to read block name");
         return -EINVAL;
     }
 
     /* Validate before using the data */
-    if (qemu_file_get_error(file)) {
-        return qemu_file_get_error(file);
+    ret = qemu_file_get_error(file);
+    if (ret < 0) {
+        error_setg(errp, "loadvm failed: stream error: %d", ret);
+        return ret;
     }
 
     if (len != cnt + 1) {
-        error_report("%s: invalid payload length (%d)", __func__, len);
+        error_setg(errp, "invalid payload length (%d)", len);
         return -EINVAL;
     }
 
     rb = qemu_ram_block_by_name(block_name);
     if (!rb) {
-        error_report("%s: block '%s' not found", __func__, block_name);
+        error_setg(errp, "block '%s' not found", block_name);
         return -EINVAL;
     }
 
@@ -2640,11 +2643,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return 0;
 
     case MIG_CMD_RECV_BITMAP:
-        ret = loadvm_handle_recv_bitmap(mis, len);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_handle_recv_bitmap(mis, len, errp);
 
     case MIG_CMD_ENABLE_COLO:
         ret = loadvm_process_enable_colo(mis);

From d9d7c8d81398bb45d59cbdf1b4c2ed30f56c733d Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:37 +0530
Subject: [PATCH 0905/2396] migration: Return -1 on memory allocation failure
 in ram.c

The function colo_init_ram_cache() currently returns -errno if
qemu_anon_ram_alloc() fails. However, the subsequent cleanup loop that
calls qemu_anon_ram_free() could potentially alter the value of errno.
This would cause the function to return a value that does not accurately
represent the original allocation failure.

This commit changes the return value to -1 on memory allocation failure.
This ensures that the return value is consistent and is not affected by
any errno changes that may occur during the free process.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-20-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/ram.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index 6a0dcc04f4..163265a57f 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3575,6 +3575,8 @@ static void colo_init_ram_state(void)
  * colo cache: this is for secondary VM, we cache the whole
  * memory of the secondary VM, it is need to hold the global lock
  * to call this helper.
+ *
+ * Returns zero to indicate success or -1 on error.
  */
 int colo_init_ram_cache(void)
 {
@@ -3594,7 +3596,7 @@ int colo_init_ram_cache(void)
                         block->colo_cache = NULL;
                     }
                 }
-                return -errno;
+                return -1;
             }
             if (!machine_dump_guest_core(current_machine)) {
                 qemu_madvise(block->colo_cache, block->used_length,

From d865e4aabd4bec6d9807c3189eac8956b38b6b8d Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:38 +0530
Subject: [PATCH 0906/2396] migration: push Error **errp into
 loadvm_process_enable_colo()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
It is ensured that loadvm_process_enable_colo() must report an error
in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-21-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/colo.h |  2 +-
 migration/migration.c    | 12 ++++++------
 migration/ram.c          |  8 ++++----
 migration/ram.h          |  2 +-
 migration/savevm.c       | 26 ++++++++++++++------------
 5 files changed, 26 insertions(+), 24 deletions(-)

diff --git a/include/migration/colo.h b/include/migration/colo.h
index 43222ef5ae..d4fe422e4d 100644
--- a/include/migration/colo.h
+++ b/include/migration/colo.h
@@ -25,7 +25,7 @@ void migrate_start_colo_process(MigrationState *s);
 bool migration_in_colo_state(void);
 
 /* loadvm */
-int migration_incoming_enable_colo(void);
+int migration_incoming_enable_colo(Error **errp);
 void migration_incoming_disable_colo(void);
 bool migration_incoming_colo_enabled(void);
 bool migration_incoming_in_colo_state(void);
diff --git a/migration/migration.c b/migration/migration.c
index ce17dcc1c0..2f55f2784b 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -623,22 +623,22 @@ void migration_incoming_disable_colo(void)
     migration_colo_enabled = false;
 }
 
-int migration_incoming_enable_colo(void)
+int migration_incoming_enable_colo(Error **errp)
 {
 #ifndef CONFIG_REPLICATION
-    error_report("ENABLE_COLO command come in migration stream, but the "
-                 "replication module is not built in");
+    error_setg(errp, "ENABLE_COLO command come in migration stream, but the "
+               "replication module is not built in");
     return -ENOTSUP;
 #endif
 
     if (!migrate_colo()) {
-        error_report("ENABLE_COLO command come in migration stream, but x-colo "
-                     "capability is not set");
+        error_setg(errp, "ENABLE_COLO command come in migration stream"
+                   ", but x-colo capability is not set");
         return -EINVAL;
     }
 
     if (ram_block_discard_disable(true)) {
-        error_report("COLO: cannot disable RAM discard");
+        error_setg(errp, "COLO: cannot disable RAM discard");
         return -EBUSY;
     }
     migration_colo_enabled = true;
diff --git a/migration/ram.c b/migration/ram.c
index 163265a57f..a8e8d2cc67 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3578,7 +3578,7 @@ static void colo_init_ram_state(void)
  *
  * Returns zero to indicate success or -1 on error.
  */
-int colo_init_ram_cache(void)
+int colo_init_ram_cache(Error **errp)
 {
     RAMBlock *block;
 
@@ -3587,9 +3587,9 @@ int colo_init_ram_cache(void)
             block->colo_cache = qemu_anon_ram_alloc(block->used_length,
                                                     NULL, false, false);
             if (!block->colo_cache) {
-                error_report("%s: Can't alloc memory for COLO cache of block %s,"
-                             "size 0x" RAM_ADDR_FMT, __func__, block->idstr,
-                             block->used_length);
+                error_setg(errp, "Can't alloc memory for COLO cache of "
+                           "block %s, size 0x" RAM_ADDR_FMT,
+                           block->idstr, block->used_length);
                 RAMBLOCK_FOREACH_NOT_IGNORED(block) {
                     if (block->colo_cache) {
                         qemu_anon_ram_free(block->colo_cache, block->used_length);
diff --git a/migration/ram.h b/migration/ram.h
index 275709a991..24cd0bf585 100644
--- a/migration/ram.h
+++ b/migration/ram.h
@@ -109,7 +109,7 @@ void ramblock_set_file_bmap_atomic(RAMBlock *block, ram_addr_t offset,
                                    bool set);
 
 /* ram cache */
-int colo_init_ram_cache(void);
+int colo_init_ram_cache(Error **errp);
 void colo_flush_ram_cache(void);
 void colo_release_ram_cache(void);
 void colo_incoming_start_dirty_log(void);
diff --git a/migration/savevm.c b/migration/savevm.c
index 2e8776768f..8937496d9f 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2515,15 +2515,21 @@ static int loadvm_handle_recv_bitmap(MigrationIncomingState *mis,
     return 0;
 }
 
-static int loadvm_process_enable_colo(MigrationIncomingState *mis)
+static int loadvm_process_enable_colo(MigrationIncomingState *mis,
+                                      Error **errp)
 {
-    int ret = migration_incoming_enable_colo();
+    ERRP_GUARD();
+    int ret;
 
-    if (!ret) {
-        ret = colo_init_ram_cache();
-        if (ret) {
-            migration_incoming_disable_colo();
-        }
+    ret = migration_incoming_enable_colo(errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    ret = colo_init_ram_cache(errp);
+    if (ret) {
+        error_prepend(errp, "failed to init colo RAM cache: %d: ", ret);
+        migration_incoming_disable_colo();
     }
     return ret;
 }
@@ -2646,11 +2652,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_handle_recv_bitmap(mis, len, errp);
 
     case MIG_CMD_ENABLE_COLO:
-        ret = loadvm_process_enable_colo(mis);
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_process_enable_colo(mis, errp);
 
     case MIG_CMD_SWITCHOVER_START:
         ret = loadvm_postcopy_handle_switchover_start();

From aa77746602cdf7e29d588d100e27f34bd6e46226 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:39 +0530
Subject: [PATCH 0907/2396] migration: push Error **errp into
 loadvm_postcopy_handle_switchover_start()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading code to report
error via Error objects instead of directly printing it to console/monitor.
It is ensured that loadvm_postcopy_handle_switchover_start() must report
an error in errp, in case of failure.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-22-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 8937496d9f..34b7a28d38 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2534,7 +2534,7 @@ static int loadvm_process_enable_colo(MigrationIncomingState *mis,
     return ret;
 }
 
-static int loadvm_postcopy_handle_switchover_start(void)
+static int loadvm_postcopy_handle_switchover_start(Error **errp)
 {
     SaveStateEntry *se;
 
@@ -2547,6 +2547,7 @@ static int loadvm_postcopy_handle_switchover_start(void)
 
         ret = se->ops->switchover_start(se->opaque);
         if (ret < 0) {
+            error_setg(errp, "Switchover start failed: %d", ret);
             return ret;
         }
     }
@@ -2655,11 +2656,7 @@ static int loadvm_process_command(QEMUFile *f, Error **errp)
         return loadvm_process_enable_colo(mis, errp);
 
     case MIG_CMD_SWITCHOVER_START:
-        ret = loadvm_postcopy_handle_switchover_start();
-        if (ret < 0) {
-            error_setg(errp, "Failed to load device state command: %d", ret);
-        }
-        return ret;
+        return loadvm_postcopy_handle_switchover_start(errp);
     }
 
     return 0;

From 94272d9b45bbf17b8bb143b39fd3060aeef7dc3d Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:40 +0530
Subject: [PATCH 0908/2396] migration: Capture error in
 postcopy_ram_listen_thread()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is an incremental step in converting vmstate loading
code to report error via Error objects instead of directly
printing it to console/monitor.
postcopy_ram_listen_thread() calls qemu_loadvm_state_main()
to load the vm, and in case of a failure, it should set the error
in the migration object.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-23-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index 34b7a28d38..996673b679 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2095,6 +2095,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
     QEMUFile *f = mis->from_src_file;
     int load_res;
     MigrationState *migr = migrate_get_current();
+    Error *local_err = NULL;
 
     object_ref(OBJECT(migr));
 
@@ -2111,7 +2112,7 @@ static void *postcopy_ram_listen_thread(void *opaque)
     qemu_file_set_blocking(f, true, &error_fatal);
 
     /* TODO: sanity check that only postcopiable data will be loaded here */
-    load_res = qemu_loadvm_state_main(f, mis, &error_fatal);
+    load_res = qemu_loadvm_state_main(f, mis, &local_err);
 
     /*
      * This is tricky, but, mis->from_src_file can change after it
@@ -2137,7 +2138,10 @@ static void *postcopy_ram_listen_thread(void *opaque)
                          __func__, load_res);
             load_res = 0; /* prevent further exit() */
         } else {
-            error_report("%s: loadvm failed: %d", __func__, load_res);
+            error_prepend(&local_err,
+                          "loadvm failed during postcopy: %d: ", load_res);
+            migrate_set_error(migr, local_err);
+            error_report_err(local_err);
             migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                                            MIGRATION_STATUS_FAILED);
         }

From 6f9fc6f5012344292f7014e079e5225b8988383d Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:41 +0530
Subject: [PATCH 0909/2396] migration: Remove error variant of
 vmstate_save_state() function

This commit removes the redundant vmstate_save_state_with_err()
function.

Previously, commit 969298f9d7 introduced vmstate_save_state_with_err()
to handle error propagation, while vmstate_save_state() existed for
non-error scenarios.
This is because there were code paths where vmstate_save_state_v()
(called internally by vmstate_save_state) did not explicitly set
errors on failure.

This change unifies error handling by
 - updating vmstate_save_state() to accept an Error **errp argument.
 - vmstate_save_state_v() ensures errors are set directly within the errp
   object, eliminating the need for two separate functions.

All calls to vmstate_save_state_with_err() are replaced with
vmstate_save_state(). This simplifies the API and improves code
maintainability.

vmstate_save_state() that only calls vmstate_save_state_v(),
by inference, also has errors set in errp in case of failure.
The errors are reported using error_report_err().
If we want the function to exit on error, then &error_fatal is
passed.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-24-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/display/virtio-gpu.c     |  3 ++-
 hw/pci/pci.c                |  2 +-
 hw/s390x/virtio-ccw.c       |  2 +-
 hw/scsi/spapr_vscsi.c       |  2 +-
 hw/vfio/pci.c               |  4 ++--
 hw/virtio/virtio-mmio.c     |  2 +-
 hw/virtio/virtio-pci.c      |  2 +-
 hw/virtio/virtio.c          |  6 ++++--
 include/migration/vmstate.h |  2 --
 migration/cpr.c             |  3 +--
 migration/savevm.c          | 11 ++++++++---
 migration/vmstate-types.c   | 25 ++++++++++++++++++-------
 migration/vmstate.c         | 10 ++--------
 tests/unit/test-vmstate.c   | 20 +++++++++++++++++---
 ui/vdagent.c                |  3 ++-
 15 files changed, 61 insertions(+), 36 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index e61585aa61..3a555125be 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1248,7 +1248,8 @@ static int virtio_gpu_save(QEMUFile *f, void *opaque, size_t size,
     }
     qemu_put_be32(f, 0); /* end of list */
 
-    return vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL);
+    return vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL,
+                              &error_fatal);
 }
 
 static bool virtio_gpu_load_restore_mapping(VirtIOGPU *g,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 17715ca1b3..5e2c3c6fc2 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -926,7 +926,7 @@ void pci_device_save(PCIDevice *s, QEMUFile *f)
      * This makes us compatible with old devices
      * which never set or clear this bit. */
     s->config[PCI_STATUS] &= ~PCI_STATUS_INTERRUPT;
-    vmstate_save_state(f, &vmstate_pci_device, s, NULL);
+    vmstate_save_state(f, &vmstate_pci_device, s, NULL, &error_fatal);
     /* Restore the interrupt status bit. */
     pci_update_irq_status(s);
 }
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 6a9641a03d..4cb1ced001 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1130,7 +1130,7 @@ static int virtio_ccw_load_queue(DeviceState *d, int n, QEMUFile *f)
 static void virtio_ccw_save_config(DeviceState *d, QEMUFile *f)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
-    vmstate_save_state(f, &vmstate_virtio_ccw_dev, dev, NULL);
+    vmstate_save_state(f, &vmstate_virtio_ccw_dev, dev, NULL, &error_fatal);
 }
 
 static int virtio_ccw_load_config(DeviceState *d, QEMUFile *f)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index da173f4867..f0a7dd2b88 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -630,7 +630,7 @@ static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
     vscsi_req *req = sreq->hba_private;
     assert(req->active);
 
-    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req, NULL);
+    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req, NULL, &error_fatal);
 
     trace_spapr_vscsi_save_request(req->qtag, req->cur_desc_num,
                                    req->cur_desc_offset);
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index a5df4685d4..06b06afc2b 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2821,8 +2821,8 @@ static int vfio_pci_save_config(VFIODevice *vbasedev, QEMUFile *f, Error **errp)
 {
     VFIOPCIDevice *vdev = container_of(vbasedev, VFIOPCIDevice, vbasedev);
 
-    return vmstate_save_state_with_err(f, &vmstate_vfio_pci_config, vdev, NULL,
-                                       errp);
+    return vmstate_save_state(f, &vmstate_vfio_pci_config, vdev, NULL,
+                              errp);
 }
 
 static int vfio_pci_load_config(VFIODevice *vbasedev, QEMUFile *f)
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index 0a688909fc..fb58c36452 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -613,7 +613,7 @@ static void virtio_mmio_save_extra_state(DeviceState *opaque, QEMUFile *f)
 {
     VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
 
-    vmstate_save_state(f, &vmstate_virtio_mmio, proxy, NULL);
+    vmstate_save_state(f, &vmstate_virtio_mmio, proxy, NULL, &error_fatal);
 }
 
 static int virtio_mmio_load_extra_state(DeviceState *opaque, QEMUFile *f)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index b04faa1e5c..d2595fbd55 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -154,7 +154,7 @@ static void virtio_pci_save_extra_state(DeviceState *d, QEMUFile *f)
 {
     VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
 
-    vmstate_save_state(f, &vmstate_virtio_pci, proxy, NULL);
+    vmstate_save_state(f, &vmstate_virtio_pci, proxy, NULL, &error_fatal);
 }
 
 static int virtio_pci_load_extra_state(DeviceState *d, QEMUFile *f)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 018803c80d..0a68f1b6f1 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2992,6 +2992,7 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint32_t guest_features_lo = (vdev->guest_features & 0xffffffff);
     int i;
+    Error *local_err = NULL;
 
     if (k->save_config) {
         k->save_config(qbus->parent, f);
@@ -3035,14 +3036,15 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
     }
 
     if (vdc->vmsd) {
-        int ret = vmstate_save_state(f, vdc->vmsd, vdev, NULL);
+        int ret = vmstate_save_state(f, vdc->vmsd, vdev, NULL, &local_err);
         if (ret) {
+            error_report_err(local_err);
             return ret;
         }
     }
 
     /* Subsections */
-    return vmstate_save_state(f, &vmstate_virtio, vdev, NULL);
+    return vmstate_save_state(f, &vmstate_virtio, vdev, NULL, &error_fatal);
 }
 
 /* A wrapper for use as a VMState .put function */
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 056781b1c2..5fe9bbf390 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -1198,8 +1198,6 @@ extern const VMStateInfo vmstate_info_qlist;
 int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
                        void *opaque, int version_id, Error **errp);
 int vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd,
-                       void *opaque, JSONWriter *vmdesc);
-int vmstate_save_state_with_err(QEMUFile *f, const VMStateDescription *vmsd,
                        void *opaque, JSONWriter *vmdesc, Error **errp);
 int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
                          void *opaque, JSONWriter *vmdesc,
diff --git a/migration/cpr.c b/migration/cpr.c
index 6b0e19651a..e0b47df222 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -183,9 +183,8 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
     qemu_put_be32(f, QEMU_CPR_FILE_MAGIC);
     qemu_put_be32(f, QEMU_CPR_FILE_VERSION);
 
-    ret = vmstate_save_state(f, &vmstate_cpr_state, &cpr_state, 0);
+    ret = vmstate_save_state(f, &vmstate_cpr_state, &cpr_state, 0, errp);
     if (ret) {
-        error_setg(errp, "vmstate_save_state error %d", ret);
         qemu_fclose(f);
         return ret;
     }
diff --git a/migration/savevm.c b/migration/savevm.c
index 996673b679..7b35ec4dd0 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1056,8 +1056,8 @@ static int vmstate_save(QEMUFile *f, SaveStateEntry *se, JSONWriter *vmdesc,
     if (!se->vmsd) {
         vmstate_save_old_style(f, se, vmdesc);
     } else {
-        ret = vmstate_save_state_with_err(f, se->vmsd, se->opaque, vmdesc,
-                                          errp);
+        ret = vmstate_save_state(f, se->vmsd, se->opaque, vmdesc,
+                                 errp);
         if (ret) {
             return ret;
         }
@@ -1285,6 +1285,7 @@ void qemu_savevm_state_header(QEMUFile *f)
 {
     MigrationState *s = migrate_get_current();
     JSONWriter *vmdesc = s->vmdesc;
+    Error *local_err = NULL;
 
     trace_savevm_state_header();
     qemu_put_be32(f, QEMU_VM_FILE_MAGIC);
@@ -1303,7 +1304,11 @@ void qemu_savevm_state_header(QEMUFile *f)
             json_writer_start_object(vmdesc, "configuration");
         }
 
-        vmstate_save_state(f, &vmstate_configuration, &savevm_state, vmdesc);
+        vmstate_save_state(f, &vmstate_configuration, &savevm_state,
+                           vmdesc, &local_err);
+        if (local_err) {
+            error_report_err(local_err);
+        }
 
         if (vmdesc) {
             json_writer_end_object(vmdesc);
diff --git a/migration/vmstate-types.c b/migration/vmstate-types.c
index c5cfd861e3..a1cd7a95fa 100644
--- a/migration/vmstate-types.c
+++ b/migration/vmstate-types.c
@@ -565,10 +565,14 @@ static int put_tmp(QEMUFile *f, void *pv, size_t size,
     const VMStateDescription *vmsd = field->vmsd;
     void *tmp = g_malloc(size);
     int ret;
+    Error *local_err = NULL;
 
     /* Writes the parent field which is at the start of the tmp */
     *(void **)tmp = pv;
-    ret = vmstate_save_state(f, vmsd, tmp, vmdesc);
+    ret = vmstate_save_state(f, vmsd, tmp, vmdesc, &local_err);
+    if (ret) {
+        error_report_err(local_err);
+    }
     g_free(tmp);
 
     return ret;
@@ -676,13 +680,15 @@ static int put_qtailq(QEMUFile *f, void *pv, size_t unused_size,
     size_t entry_offset = field->start;
     void *elm;
     int ret;
+    Error *local_err = NULL;
 
     trace_put_qtailq(vmsd->name, vmsd->version_id);
 
     QTAILQ_RAW_FOREACH(elm, pv, entry_offset) {
         qemu_put_byte(f, true);
-        ret = vmstate_save_state(f, vmsd, elm, vmdesc);
+        ret = vmstate_save_state(f, vmsd, elm, vmdesc, &local_err);
         if (ret) {
+            error_report_err(local_err);
             return ret;
         }
     }
@@ -711,6 +717,7 @@ static gboolean put_gtree_elem(gpointer key, gpointer value, gpointer data)
     struct put_gtree_data *capsule = (struct put_gtree_data *)data;
     QEMUFile *f = capsule->f;
     int ret;
+    Error *local_err = NULL;
 
     qemu_put_byte(f, true);
 
@@ -718,16 +725,20 @@ static gboolean put_gtree_elem(gpointer key, gpointer value, gpointer data)
     if (!capsule->key_vmsd) {
         qemu_put_be64(f, (uint64_t)(uintptr_t)(key)); /* direct key */
     } else {
-        ret = vmstate_save_state(f, capsule->key_vmsd, key, capsule->vmdesc);
+        ret = vmstate_save_state(f, capsule->key_vmsd, key, capsule->vmdesc,
+                                 &local_err);
         if (ret) {
+            error_report_err(local_err);
             capsule->ret = ret;
             return true;
         }
     }
 
     /* put the data */
-    ret = vmstate_save_state(f, capsule->val_vmsd, value, capsule->vmdesc);
+    ret = vmstate_save_state(f, capsule->val_vmsd, value, capsule->vmdesc,
+                             &local_err);
     if (ret) {
+        error_report_err(local_err);
         capsule->ret = ret;
         return true;
     }
@@ -857,14 +868,14 @@ static int put_qlist(QEMUFile *f, void *pv, size_t unused_size,
     size_t entry_offset = field->start;
     void *elm;
     int ret;
+    Error *local_err = NULL;
 
     trace_put_qlist(field->name, vmsd->name, vmsd->version_id);
     QLIST_RAW_FOREACH(elm, pv, entry_offset) {
         qemu_put_byte(f, true);
-        ret = vmstate_save_state(f, vmsd, elm, vmdesc);
+        ret = vmstate_save_state(f, vmsd, elm, vmdesc, &local_err);
         if (ret) {
-            error_report("%s: failed to save %s (%d)", field->name,
-                         vmsd->name, ret);
+            error_report_err(local_err);
             return ret;
         }
     }
diff --git a/migration/vmstate.c b/migration/vmstate.c
index 8d1e9eb62b..ad8e5b71ae 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -406,12 +406,6 @@ bool vmstate_section_needed(const VMStateDescription *vmsd, void *opaque)
 
 
 int vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd,
-                       void *opaque, JSONWriter *vmdesc_id)
-{
-    return vmstate_save_state_v(f, vmsd, opaque, vmdesc_id, vmsd->version_id, NULL);
-}
-
-int vmstate_save_state_with_err(QEMUFile *f, const VMStateDescription *vmsd,
                        void *opaque, JSONWriter *vmdesc_id, Error **errp)
 {
     return vmstate_save_state_v(f, vmsd, opaque, vmdesc_id, vmsd->version_id, errp);
@@ -512,7 +506,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
 
                 if (inner_field->flags & VMS_STRUCT) {
                     ret = vmstate_save_state(f, inner_field->vmsd,
-                                             curr_elem, vmdesc_loop);
+                                             curr_elem, vmdesc_loop, errp);
                 } else if (inner_field->flags & VMS_VSTRUCT) {
                     ret = vmstate_save_state_v(f, inner_field->vmsd,
                                                curr_elem, vmdesc_loop,
@@ -674,7 +668,7 @@ static int vmstate_subsection_save(QEMUFile *f, const VMStateDescription *vmsd,
             qemu_put_byte(f, len);
             qemu_put_buffer(f, (uint8_t *)vmsdsub->name, len);
             qemu_put_be32(f, vmsdsub->version_id);
-            ret = vmstate_save_state_with_err(f, vmsdsub, opaque, vmdesc, errp);
+            ret = vmstate_save_state(f, vmsdsub, opaque, vmdesc, errp);
             if (ret) {
                 return ret;
             }
diff --git a/tests/unit/test-vmstate.c b/tests/unit/test-vmstate.c
index 4ff0ab632f..cadbab3c5e 100644
--- a/tests/unit/test-vmstate.c
+++ b/tests/unit/test-vmstate.c
@@ -67,9 +67,13 @@ static QEMUFile *open_test_file(bool write)
 static void save_vmstate(const VMStateDescription *desc, void *obj)
 {
     QEMUFile *f = open_test_file(true);
+    Error *local_err = NULL;
 
     /* Save file with vmstate */
-    int ret = vmstate_save_state(f, desc, obj, NULL);
+    int ret = vmstate_save_state(f, desc, obj, NULL, &local_err);
+    if (ret) {
+        error_report_err(local_err);
+    }
     g_assert(!ret);
     qemu_put_byte(f, QEMU_VM_EOF);
     g_assert(!qemu_file_get_error(f));
@@ -438,10 +442,15 @@ static const VMStateDescription vmstate_skipping = {
 
 static void test_save_noskip(void)
 {
+    Error *local_err = NULL;
     QEMUFile *fsave = open_test_file(true);
     TestStruct obj = { .a = 1, .b = 2, .c = 3, .d = 4, .e = 5, .f = 6,
                        .skip_c_e = false };
-    int ret = vmstate_save_state(fsave, &vmstate_skipping, &obj, NULL);
+    int ret = vmstate_save_state(fsave, &vmstate_skipping, &obj, NULL,
+                                 &local_err);
+    if (ret) {
+        error_report_err(local_err);
+    }
     g_assert(!ret);
     g_assert(!qemu_file_get_error(fsave));
 
@@ -460,10 +469,15 @@ static void test_save_noskip(void)
 
 static void test_save_skip(void)
 {
+    Error *local_err = NULL;
     QEMUFile *fsave = open_test_file(true);
     TestStruct obj = { .a = 1, .b = 2, .c = 3, .d = 4, .e = 5, .f = 6,
                        .skip_c_e = true };
-    int ret = vmstate_save_state(fsave, &vmstate_skipping, &obj, NULL);
+    int ret = vmstate_save_state(fsave, &vmstate_skipping, &obj, NULL,
+                                 &local_err);
+    if (ret) {
+        error_report_err(local_err);
+    }
     g_assert(!ret);
     g_assert(!qemu_file_get_error(fsave));
 
diff --git a/ui/vdagent.c b/ui/vdagent.c
index bc3c77f013..ddb91e75c6 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -992,7 +992,8 @@ static int put_cbinfo(QEMUFile *f, void *pv, size_t size,
         }
     }
 
-    return vmstate_save_state(f, &vmstate_cbinfo_array, &cbinfo, vmdesc);
+    return vmstate_save_state(f, &vmstate_cbinfo_array, &cbinfo, vmdesc,
+                              &error_fatal);
 }
 
 static int get_cbinfo(QEMUFile *f, void *pv, size_t size,

From 40de712a89d8fe26af398dd23c24e94834ca442b Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:43 +0530
Subject: [PATCH 0910/2396] migration: Add error-parameterized function
 variants in VMSD struct

- We need to have good error reporting in the callbacks in
  VMStateDescription struct. Specifically pre_save, pre_load
  and post_load callbacks.
- It is not possible to change these functions everywhere in one
  patch, therefore, we introduce a duplicate set of callbacks
  with Error object passed to them.
- So, in this commit, we implement 'errp' variants of these callbacks,
  introducing an explicit Error object parameter.
- This is a functional step towards transitioning the entire codebase
  to the new error-parameterized functions.
- Deliberately called in mutual exclusion from their counterparts,
  to prevent conflicts during the transition.
- New impls should preferentally use 'errp' variants of
  these methods, and existing impls incrementally converted.
  The variants without 'errp' are intended to be removed
  once all usage is converted.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-26-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 docs/devel/migration/main.rst | 19 +++++++++++++++++++
 include/migration/vmstate.h   | 14 ++++++++++++++
 migration/vmstate.c           | 31 ++++++++++++++++++++++++++++---
 3 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/docs/devel/migration/main.rst b/docs/devel/migration/main.rst
index 6493c1d2bc..1afe7b9689 100644
--- a/docs/devel/migration/main.rst
+++ b/docs/devel/migration/main.rst
@@ -444,6 +444,25 @@ The functions to do that are inside a vmstate definition, and are called:
   This function is called after we save the state of one device
   (even upon failure, unless the call to pre_save returned an error).
 
+Following are the errp variants of these functions.
+
+- ``int (*pre_load_errp)(void *opaque, Error **errp);``
+
+  This function is called before we load the state of one device.
+
+- ``int (*post_load_errp)(void *opaque, int version_id, Error **errp);``
+
+  This function is called after we load the state of one device.
+
+- ``int (*pre_save_errp)(void *opaque, Error **errp);``
+
+  This function is called before we save the state of one device.
+
+New impls should preferentally use 'errp' variants of these
+methods and existing impls incrementally converted.
+The variants without 'errp' are intended to be removed
+once all usage is converted.
+
 Example: You can look at hpet.c, that uses the first three functions
 to massage the state that is transferred.
 
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 5fe9bbf390..5567fd78d0 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -200,14 +200,28 @@ struct VMStateDescription {
      * exclusive. For this reason, also early_setup VMSDs are migrated in a
      * QEMU_VM_SECTION_FULL section, while save_setup() data is migrated in
      * a QEMU_VM_SECTION_START section.
+     *
+     * There are duplicate impls of the post/pre save/load hooks.
+     * New impls should preferentally use 'errp' variants of these
+     * methods and existing impls incrementally converted.
+     * The variants without 'errp' are intended to be removed
+     * once all usage is converted.
+     *
+     * For the errp variants,
+     * Returns: 0 on success,
+     *          <0 on error where -value is an error number from errno.h
      */
+
     bool early_setup;
     int version_id;
     int minimum_version_id;
     MigrationPriority priority;
     int (*pre_load)(void *opaque);
+    int (*pre_load_errp)(void *opaque, Error **errp);
     int (*post_load)(void *opaque, int version_id);
+    int (*post_load_errp)(void *opaque, int version_id, Error **errp);
     int (*pre_save)(void *opaque);
+    int (*pre_save_errp)(void *opaque, Error **errp);
     int (*post_save)(void *opaque);
     bool (*needed)(void *opaque);
     bool (*dev_unplug_pending)(void *opaque);
diff --git a/migration/vmstate.c b/migration/vmstate.c
index ad8e5b71ae..81eadde553 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -134,6 +134,7 @@ static void vmstate_handle_alloc(void *ptr, const VMStateField *field,
 int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
                        void *opaque, int version_id, Error **errp)
 {
+    ERRP_GUARD();
     const VMStateField *field = vmsd->fields;
     int ret = 0;
 
@@ -152,7 +153,16 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         trace_vmstate_load_state_end(vmsd->name, "too old", -EINVAL);
         return -EINVAL;
     }
-    if (vmsd->pre_load) {
+    if (vmsd->pre_load_errp) {
+        ret = vmsd->pre_load_errp(opaque, errp);
+        if (ret < 0) {
+            error_prepend(errp, "pre load hook failed for: '%s', "
+                          "version_id: %d, minimum version_id: %d, "
+                          "ret: %d: ", vmsd->name, vmsd->version_id,
+                          vmsd->minimum_version_id, ret);
+            return ret;
+        }
+    } else if (vmsd->pre_load) {
         ret = vmsd->pre_load(opaque);
         if (ret) {
             error_setg(errp, "pre load hook failed for: '%s', "
@@ -245,7 +255,14 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         qemu_file_set_error(f, ret);
         return ret;
     }
-    if (vmsd->post_load) {
+    if (vmsd->post_load_errp) {
+        ret = vmsd->post_load_errp(opaque, version_id, errp);
+        if (ret < 0) {
+            error_prepend(errp, "post load hook failed for: %s, version_id: "
+                          "%d, minimum_version: %d, ret: %d: ", vmsd->name,
+                          vmsd->version_id, vmsd->minimum_version_id, ret);
+        }
+    } else if (vmsd->post_load) {
         ret = vmsd->post_load(opaque, version_id);
         if (ret < 0) {
             error_setg(errp,
@@ -414,12 +431,20 @@ int vmstate_save_state(QEMUFile *f, const VMStateDescription *vmsd,
 int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
                          void *opaque, JSONWriter *vmdesc, int version_id, Error **errp)
 {
+    ERRP_GUARD();
     int ret = 0;
     const VMStateField *field = vmsd->fields;
 
     trace_vmstate_save_state_top(vmsd->name);
 
-    if (vmsd->pre_save) {
+    if (vmsd->pre_save_errp) {
+        ret = vmsd->pre_save_errp(opaque, errp);
+        trace_vmstate_save_state_pre_save_res(vmsd->name, ret);
+        if (ret < 0) {
+            error_prepend(errp, "pre-save for %s failed, ret: %d: ",
+                          vmsd->name, ret);
+        }
+    } else if (vmsd->pre_save) {
         ret = vmsd->pre_save(opaque);
         trace_vmstate_save_state_pre_save_res(vmsd->name, ret);
         if (ret) {

From 42e556fa3f7acfd0d0bc834dd0b002eb24d20eea Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Thu, 18 Sep 2025 20:53:44 +0530
Subject: [PATCH 0911/2396] backends/tpm: Propagate vTPM error on migration
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- When migration of a VM with encrypted vTPM fails on the
  destination host, (e.g., due to a mismatch in secret values),
  the error message displayed on the source host is generic and unhelpful.
- For example, a typical error looks like this:
  "operation failed: job 'migration out' failed: Sibling indicated error 1.
  operation failed: job 'migration in' failed: load of migration failed:
  Input/output error"
- Such generic errors are logged using error_report(), which prints to
  the console/monitor but does not make the detailed error accessible via
  the QMP query-migrate command.
- This change, along with the set of changes of passing errp Error object
  to the VM state loading functions, help in addressing the issue.
  We use the post_load_errp hook of VMStateDescription to propagate errors
  by setting Error **errp objects in case of failure in the TPM backend.
- It can then be retrieved using QMP command:
  {"execute" : "query-migrate"}

Buglink: https://issues.redhat.com/browse/RHEL-82826

Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Signed-off-by: Arun Menon <armenon@redhat.com>
Tested-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20250918-propagate_tpm_error-v14-27-36f11a6fb9d3@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 backends/tpm/tpm_emulator.c | 40 +++++++++++++++++++------------------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index 4a234ab2c0..dacfca5ab7 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -819,7 +819,8 @@ static int tpm_emulator_get_state_blobs(TPMEmulator *tpm_emu)
 static int tpm_emulator_set_state_blob(TPMEmulator *tpm_emu,
                                        uint32_t type,
                                        TPMSizedBuffer *tsb,
-                                       uint32_t flags)
+                                       uint32_t flags,
+                                       Error **errp)
 {
     ssize_t n;
     ptm_setstate pss;
@@ -838,17 +839,18 @@ static int tpm_emulator_set_state_blob(TPMEmulator *tpm_emu,
     /* write the header only */
     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_STATEBLOB, &pss,
                              offsetof(ptm_setstate, u.req.data), 0, 0) < 0) {
-        error_report("tpm-emulator: could not set state blob type %d : %s",
-                     type, strerror(errno));
+        error_setg_errno(errp, errno,
+                         "tpm-emulator: could not set state blob type %d",
+                         type);
         return -1;
     }
 
     /* now the body */
     n = qemu_chr_fe_write_all(&tpm_emu->ctrl_chr, tsb->buffer, tsb->size);
     if (n != tsb->size) {
-        error_report("tpm-emulator: Writing the stateblob (type %d) "
-                     "failed; could not write %u bytes, but only %zd",
-                     type, tsb->size, n);
+        error_setg(errp, "tpm-emulator: Writing the stateblob (type %d) "
+                   "failed; could not write %u bytes, but only %zd",
+                   type, tsb->size, n);
         return -1;
     }
 
@@ -856,17 +858,17 @@ static int tpm_emulator_set_state_blob(TPMEmulator *tpm_emu,
     n = qemu_chr_fe_read_all(&tpm_emu->ctrl_chr,
                              (uint8_t *)&pss, sizeof(pss.u.resp));
     if (n != sizeof(pss.u.resp)) {
-        error_report("tpm-emulator: Reading response from writing stateblob "
-                     "(type %d) failed; expected %zu bytes, got %zd", type,
-                     sizeof(pss.u.resp), n);
+        error_setg(errp, "tpm-emulator: Reading response from writing "
+                   "stateblob (type %d) failed; expected %zu bytes, "
+                   "got %zd", type, sizeof(pss.u.resp), n);
         return -1;
     }
 
     tpm_result = be32_to_cpu(pss.u.resp.tpm_result);
     if (tpm_result != 0) {
-        error_report("tpm-emulator: Setting the stateblob (type %d) failed "
-                     "with a TPM error 0x%x %s", type, tpm_result,
-                     tpm_emulator_strerror(tpm_result));
+        error_setg(errp, "tpm-emulator: Setting the stateblob (type %d) "
+                   "failed with a TPM error 0x%x %s", type, tpm_result,
+                   tpm_emulator_strerror(tpm_result));
         return -1;
     }
 
@@ -880,7 +882,7 @@ static int tpm_emulator_set_state_blob(TPMEmulator *tpm_emu,
  *
  * Returns a negative errno code in case of error.
  */
-static int tpm_emulator_set_state_blobs(TPMBackend *tb)
+static int tpm_emulator_set_state_blobs(TPMBackend *tb, Error **errp)
 {
     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
     TPMBlobBuffers *state_blobs = &tpm_emu->state_blobs;
@@ -894,13 +896,13 @@ static int tpm_emulator_set_state_blobs(TPMBackend *tb)
 
     if (tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_PERMANENT,
                                     &state_blobs->permanent,
-                                    state_blobs->permanent_flags) < 0 ||
+                                    state_blobs->permanent_flags, errp) < 0 ||
         tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_VOLATILE,
                                     &state_blobs->volatil,
-                                    state_blobs->volatil_flags) < 0 ||
+                                    state_blobs->volatil_flags, errp) < 0 ||
         tpm_emulator_set_state_blob(tpm_emu, PTM_BLOB_TYPE_SAVESTATE,
                                     &state_blobs->savestate,
-                                    state_blobs->savestate_flags) < 0) {
+                                    state_blobs->savestate_flags, errp) < 0) {
         return -EIO;
     }
 
@@ -948,12 +950,12 @@ static void tpm_emulator_vm_state_change(void *opaque, bool running,
  *
  * Returns negative errno codes in case of error.
  */
-static int tpm_emulator_post_load(void *opaque, int version_id)
+static int tpm_emulator_post_load(void *opaque, int version_id, Error **errp)
 {
     TPMBackend *tb = opaque;
     int ret;
 
-    ret = tpm_emulator_set_state_blobs(tb);
+    ret = tpm_emulator_set_state_blobs(tb, errp);
     if (ret < 0) {
         return ret;
     }
@@ -969,7 +971,7 @@ static const VMStateDescription vmstate_tpm_emulator = {
     .name = "tpm-emulator",
     .version_id = 0,
     .pre_save = tpm_emulator_pre_save,
-    .post_load = tpm_emulator_post_load,
+    .post_load_errp = tpm_emulator_post_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(state_blobs.permanent_flags, TPMEmulator),
         VMSTATE_UINT32(state_blobs.permanent.size, TPMEmulator),

From 7e0c22d585581b8083ffdeb332ea497218665daf Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 18 Sep 2025 16:39:36 -0400
Subject: [PATCH 0912/2396] io/crypto: Move tls premature termination handling
 into QIO layer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QCryptoTLSSession allows TLS premature termination in two cases, one of the
case is when the channel shutdown() is invoked on READ side.

It's possible the shutdown() happened after the read thread blocked at
gnutls_record_recv().  In this case, we should allow the premature
termination to happen.

The problem is by the time qcrypto_tls_session_read() was invoked,
tioc->shutdown may not have been set, so this may instead be treated as an
error if there is concurrent shutdown() calls.

To allow the flag to reflect the latest status of tioc->shutdown, move the
check upper into the QIOChannel level, so as to read the flag only after
QEMU gets an GNUTLS_E_PREMATURE_TERMINATION.

When at it, introduce qio_channel_tls_allow_premature_termination() helper
to make the condition checks easier to read.  When doing so, change the
qatomic_load_acquire() to qatomic_read(): here we don't need any ordering
of memory accesses, but reading a flag.  qatomic_read() would suffice
because it guarantees fetching from memory.  Nothing else we should need to
order on memory access.

This patch will fix a qemu qtest warning when running the preempt tls test,
reporting premature termination:

QTEST_QEMU_BINARY=./qemu-system-x86_64 ./tests/qtest/migration-test --full -r /x86_64/migration/postcopy/preempt/tls/psk
...
qemu-kvm: Cannot read from TLS channel: The TLS connection was non-properly terminated.
...

In this specific case, the error was set by postcopy_preempt_thread, which
normally will be concurrently shutdown()ed by the main thread.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250918203937.200833-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 crypto/tlssession.c         |  7 ++-----
 include/crypto/tlssession.h | 10 +++-------
 io/channel-tls.c            | 21 +++++++++++++++++++--
 3 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 86d407a142..ac38c2121d 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -552,7 +552,6 @@ ssize_t
 qcrypto_tls_session_read(QCryptoTLSSession *session,
                          char *buf,
                          size_t len,
-                         bool gracefulTermination,
                          Error **errp)
 {
     ssize_t ret;
@@ -570,9 +569,8 @@ qcrypto_tls_session_read(QCryptoTLSSession *session,
     if (ret < 0) {
         if (ret == GNUTLS_E_AGAIN) {
             return QCRYPTO_TLS_SESSION_ERR_BLOCK;
-        } else if ((ret == GNUTLS_E_PREMATURE_TERMINATION) &&
-                   gracefulTermination){
-            return 0;
+        } else if (ret == GNUTLS_E_PREMATURE_TERMINATION) {
+            return QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION;
         } else {
             if (session->rerr) {
                 error_propagate(errp, session->rerr);
@@ -789,7 +787,6 @@ ssize_t
 qcrypto_tls_session_read(QCryptoTLSSession *sess,
                          char *buf,
                          size_t len,
-                         bool gracefulTermination,
                          Error **errp)
 {
     error_setg(errp, "TLS requires GNUTLS support");
diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h
index 2f62ce2d67..2e9fe11cf6 100644
--- a/include/crypto/tlssession.h
+++ b/include/crypto/tlssession.h
@@ -110,6 +110,7 @@
 typedef struct QCryptoTLSSession QCryptoTLSSession;
 
 #define QCRYPTO_TLS_SESSION_ERR_BLOCK -2
+#define QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION -3
 
 /**
  * qcrypto_tls_session_new:
@@ -259,7 +260,6 @@ ssize_t qcrypto_tls_session_write(QCryptoTLSSession *sess,
  * @sess: the TLS session object
  * @buf: to fill with plain text received
  * @len: the length of @buf
- * @gracefulTermination: treat premature termination as graceful EOF
  * @errp: pointer to hold returned error object
  *
  * Receive up to @len bytes of data from the remote peer
@@ -267,22 +267,18 @@ ssize_t qcrypto_tls_session_write(QCryptoTLSSession *sess,
  * qcrypto_tls_session_set_callbacks(), decrypt it and
  * store it in @buf.
  *
- * If @gracefulTermination is true, then a premature termination
- * of the TLS session will be treated as indicating EOF, as
- * opposed to an error.
- *
  * It is an error to call this before
  * qcrypto_tls_session_handshake() returns
  * QCRYPTO_TLS_HANDSHAKE_COMPLETE
  *
  * Returns: the number of bytes received,
  * or QCRYPTO_TLS_SESSION_ERR_BLOCK if the receive would block,
- * or -1 on error.
+ * or QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION if a premature termination
+ * is detected, or -1 on error.
  */
 ssize_t qcrypto_tls_session_read(QCryptoTLSSession *sess,
                                  char *buf,
                                  size_t len,
-                                 bool gracefulTermination,
                                  Error **errp);
 
 /**
diff --git a/io/channel-tls.c b/io/channel-tls.c
index 7135896f79..1fbed4be0c 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -346,6 +346,19 @@ static void qio_channel_tls_finalize(Object *obj)
     qcrypto_tls_session_free(ioc->session);
 }
 
+static bool
+qio_channel_tls_allow_premature_termination(QIOChannelTLS *tioc, int flags)
+{
+    if (flags & QIO_CHANNEL_READ_FLAG_RELAXED_EOF) {
+        return true;
+    }
+
+    if (qatomic_read(&tioc->shutdown) & QIO_CHANNEL_SHUTDOWN_READ) {
+        return true;
+    }
+
+    return false;
+}
 
 static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
                                      const struct iovec *iov,
@@ -364,8 +377,6 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
             tioc->session,
             iov[i].iov_base,
             iov[i].iov_len,
-            flags & QIO_CHANNEL_READ_FLAG_RELAXED_EOF ||
-            qatomic_load_acquire(&tioc->shutdown) & QIO_CHANNEL_SHUTDOWN_READ,
             errp);
         if (ret == QCRYPTO_TLS_SESSION_ERR_BLOCK) {
             if (got) {
@@ -373,6 +384,12 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
             } else {
                 return QIO_CHANNEL_ERR_BLOCK;
             }
+        } else if (ret == QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION) {
+            if (qio_channel_tls_allow_premature_termination(tioc, flags)) {
+                ret = 0;
+            } else {
+                return -1;
+            }
         } else if (ret < 0) {
             return -1;
         }

From dc487044d5c09d32dd19c8e85e76396fbbc9dde1 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 18 Sep 2025 16:39:37 -0400
Subject: [PATCH 0913/2396] migration: Make migration_has_failed() work even
 for CANCELLING

No issue I hit, the change is only from code observation when I am looking
at a TLS premature termination issue.

We set CANCELLED very late, it means migration_has_failed() may not work
correctly if it's invoked before updating CANCELLING to CANCELLED.

Allow that state will make migration_has_failed() working as expected even
if it's invoked slightly earlier.

One current user is the multifd code for the TLS graceful termination,
where it's before updating to CANCELLED.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250918203937.200833-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/migration/migration.c b/migration/migration.c
index 2f55f2784b..3ff85098d5 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1712,7 +1712,8 @@ int migration_call_notifiers(MigrationState *s, MigrationEventType type,
 
 bool migration_has_failed(MigrationState *s)
 {
-    return (s->state == MIGRATION_STATUS_CANCELLED ||
+    return (s->state == MIGRATION_STATUS_CANCELLING ||
+            s->state == MIGRATION_STATUS_CANCELLED ||
             s->state == MIGRATION_STATUS_FAILED);
 }
 

From 2aae7171224b6a305f2bf228754b59f0f99d255a Mon Sep 17 00:00:00 2001
From: Bin Guo <guobin@linux.alibaba.com>
Date: Mon, 29 Sep 2025 10:12:13 +0800
Subject: [PATCH 0914/2396] migration: HMP: Adjust the order of output fields

Adjust the positions of 'tls-authz' and 'max-postcopy-bandwidth' in
the fields output by the 'info migrate_parameters' command so that
related fields are next to each other.

For clarity only, no functional changes.

Sample output after this commit:
(qemu) info migrate_parameters
...
max-cpu-throttle: 99
tls-creds: ''
tls-hostname: ''
tls-authz: ''
max-bandwidth: 134217728 bytes/second
avail-switchover-bandwidth: 0 bytes/second
max-postcopy-bandwidth: 0 bytes/second
downtime-limit: 300 ms
...

Cc: Dr. David Alan Gilbert <dave@treblig.org>
Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250929021213.28369-1-guobin@linux.alibaba.com
[peterx: move postcopy-bw before avail-switchover-bw]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration-hmp-cmds.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 0fc21f0647..814221b260 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -353,6 +353,10 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "%s: '%s'\n",
             MigrationParameter_str(MIGRATION_PARAMETER_TLS_HOSTNAME),
             params->tls_hostname);
+        assert(params->tls_authz);
+        monitor_printf(mon, "%s: '%s'\n",
+            MigrationParameter_str(MIGRATION_PARAMETER_TLS_AUTHZ),
+            params->tls_authz);
         assert(params->has_max_bandwidth);
         monitor_printf(mon, "%s: %" PRIu64 " bytes/second\n",
             MigrationParameter_str(MIGRATION_PARAMETER_MAX_BANDWIDTH),
@@ -361,6 +365,10 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "%s: %" PRIu64 " bytes/second\n",
             MigrationParameter_str(MIGRATION_PARAMETER_AVAIL_SWITCHOVER_BANDWIDTH),
             params->avail_switchover_bandwidth);
+        assert(params->has_max_postcopy_bandwidth);
+        monitor_printf(mon, "%s: %" PRIu64 " bytes/second\n",
+            MigrationParameter_str(MIGRATION_PARAMETER_MAX_POSTCOPY_BANDWIDTH),
+            params->max_postcopy_bandwidth);
         assert(params->has_downtime_limit);
         monitor_printf(mon, "%s: %" PRIu64 " ms\n",
             MigrationParameter_str(MIGRATION_PARAMETER_DOWNTIME_LIMIT),
@@ -383,12 +391,6 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "%s: %" PRIu64 " bytes\n",
             MigrationParameter_str(MIGRATION_PARAMETER_XBZRLE_CACHE_SIZE),
             params->xbzrle_cache_size);
-        monitor_printf(mon, "%s: %" PRIu64 "\n",
-            MigrationParameter_str(MIGRATION_PARAMETER_MAX_POSTCOPY_BANDWIDTH),
-            params->max_postcopy_bandwidth);
-        monitor_printf(mon, "%s: '%s'\n",
-            MigrationParameter_str(MIGRATION_PARAMETER_TLS_AUTHZ),
-            params->tls_authz);
 
         if (params->has_block_bitmap_mapping) {
             const BitmapMigrationNodeAliasList *bmnal;

From 82f038d5961a8c8f896b499e31c638266e0291e9 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 25 Sep 2025 16:16:01 -0400
Subject: [PATCH 0915/2396] migration/multifd/tls: Cleanup BYE message
 processing on sender side

This patch is a trivial cleanup to the BYE messages on the multifd sender
side.  It could also be a fix, but since we do not have a solid clue,
taking this as a cleanup only.

One trivial concern is, migration_tls_channel_end() might be unsafe to be
invoked in the migration thread if migration is not successful, because
when failed / cancelled we do not know whether the multifd sender threads
can be writting to the channels, while GnuTLS library (when it's a TLS
channel) logically doesn't support concurrent writes.

When at it, cleanup on a few things.  What changed:

  - Introduce a helper to do graceful shutdowns with rich comment, hiding
    the details

  - Only send bye() iff migration succeeded, skip if it failed / cancelled

  - Detect TLS channel using channel type rather than thread created flags

  - Move the loop into the existing one that will close the channels, but
    do graceful shutdowns before channel shutdowns

  - local_err seems to have been leaked if set, fix it along the way

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250925201601.290546-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd.c | 65 ++++++++++++++++++++++++---------------------
 1 file changed, 34 insertions(+), 31 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index b255778855..98873cee74 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -439,6 +439,39 @@ static void multifd_send_set_error(Error *err)
     }
 }
 
+/*
+ * Gracefully shutdown IOChannels. Only needed for successful migrations on
+ * top of TLS channels.  Otherwise it is same to qio_channel_shutdown().
+ *
+ * A successful migration also guarantees multifd sender threads are
+ * properly flushed and halted.  It is only safe to send BYE in the
+ * migration thread here when we know there's no other thread writting to
+ * the channel, because GnuTLS doesn't support concurrent writers.
+ */
+static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
+{
+    g_autoptr(Error) local_err = NULL;
+
+    if (!migration_has_failed(migrate_get_current()) &&
+        object_dynamic_cast((Object *)ioc, TYPE_QIO_CHANNEL_TLS)) {
+
+        /*
+         * The destination expects the TLS session to always be properly
+         * terminated. This helps to detect a premature termination in the
+         * middle of the stream.  Note that older QEMUs always break the
+         * connection on the source and the destination always sees
+         * GNUTLS_E_PREMATURE_TERMINATION.
+         */
+        migration_tls_channel_end(ioc, &local_err);
+        if (local_err) {
+            warn_report("Failed to gracefully terminate TLS connection: %s",
+                        error_get_pretty(local_err));
+        }
+    }
+
+    qio_channel_shutdown(ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+}
+
 static void multifd_send_terminate_threads(void)
 {
     int i;
@@ -460,7 +493,7 @@ static void multifd_send_terminate_threads(void)
 
         qemu_sem_post(&p->sem);
         if (p->c) {
-            qio_channel_shutdown(p->c, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+            migration_ioc_shutdown_gracefully(p->c);
         }
     }
 
@@ -547,36 +580,6 @@ void multifd_send_shutdown(void)
         return;
     }
 
-    for (i = 0; i < migrate_multifd_channels(); i++) {
-        MultiFDSendParams *p = &multifd_send_state->params[i];
-
-        /* thread_created implies the TLS handshake has succeeded */
-        if (p->tls_thread_created && p->thread_created) {
-            Error *local_err = NULL;
-            /*
-             * The destination expects the TLS session to always be
-             * properly terminated. This helps to detect a premature
-             * termination in the middle of the stream.  Note that
-             * older QEMUs always break the connection on the source
-             * and the destination always sees
-             * GNUTLS_E_PREMATURE_TERMINATION.
-             */
-            migration_tls_channel_end(p->c, &local_err);
-
-            /*
-             * The above can return an error in case the migration has
-             * already failed. If the migration succeeded, errors are
-             * not expected but there's no need to kill the source.
-             */
-            if (local_err && !migration_has_failed(migrate_get_current())) {
-                warn_report(
-                    "multifd_send_%d: Failed to terminate TLS connection: %s",
-                    p->id, error_get_pretty(local_err));
-                break;
-            }
-        }
-    }
-
     multifd_send_terminate_threads();
 
     for (i = 0; i < migrate_multifd_channels(); i++) {

From 725a9e5f7885a3c0d0cd82022d6eb5a758ac9d47 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Tue, 26 Aug 2025 13:51:40 +0200
Subject: [PATCH 0916/2396] migration: Fix state transition in postcopy_start()
 error handling

Commit 48814111366b ("migration: Always set DEVICE state") introduced
DEVICE state to postcopy, which moved the actual state transition that
leads to POSTCOPY_ACTIVE.

However, the error handling part of the postcopy_start() function still
expects the state POSTCOPY_ACTIVE, but depending on where an error
happens, now the state can be either ACTIVE, DEVICE or CANCELLING, but
never POSTCOPY_ACTIVE, as this transition now happens just before a
successful return from the function.

Instead, accept any state except CANCELLING when transitioning to FAILED
state.

Cc: qemu-stable@nongnu.org
Fixes: 48814111366b ("migration: Always set DEVICE state")
Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20250826115145.871272-1-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 3ff85098d5..edb8ff0d46 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2878,8 +2878,9 @@ static int postcopy_start(MigrationState *ms, Error **errp)
 fail_closefb:
     qemu_fclose(fb);
 fail:
-    migrate_set_state(&ms->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
-                          MIGRATION_STATUS_FAILED);
+    if (ms->state != MIGRATION_STATUS_CANCELLING) {
+        migrate_set_state(&ms->state, ms->state, MIGRATION_STATUS_FAILED);
+    }
     migration_block_activate(NULL);
     migration_call_notifiers(ms, MIG_EVENT_PRECOPY_FAILED, NULL);
     bql_unlock();

From d943cef76090b5255e68ba38ce6ddf20537b07bc Mon Sep 17 00:00:00 2001
From: Yanfei Xu <yanfei.xu@bytedance.com>
Date: Mon, 18 Aug 2025 21:11:27 +0800
Subject: [PATCH 0917/2396] migration: ensure APIC is loaded prior to VFIO PCI
 devices

The load procedure of VFIO PCI devices involves setting up IRT
for each VFIO PCI devices. This requires determining whether an
interrupt is single-destination interrupt to decide between
Posted Interrupt(PI) or remapping mode for the IRTE. However,
determining this may require accessing the VM's APIC registers.

For example:
ioctl(vbasedev->fd, VFIO_DEVICE_SET_IRQS, irqs)
  ...
    kvm_arch_irq_bypass_add_producer
      kvm_x86_call(pi_update_irte)
        vmx_pi_update_irte
          kvm_intr_is_single_vcpu

If the LAPIC has not been loaded yet, interrupts will use remapping
mode. To prevent the fallback of interrupt mode, keep APIC is always
loaded prior to VFIO PCI devices.

Signed-off-by: Yicong Shen <shenyicong.1023@bytedance.com>
Signed-off-by: Yanfei Xu <yanfei.xu@bytedance.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20250818131127.1021648-1-yanfei.xu@bytedance.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/intc/apic_common.c       | 1 +
 include/migration/vmstate.h | 1 +
 2 files changed, 2 insertions(+)

diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
index 37a7a7019d..394fe02013 100644
--- a/hw/intc/apic_common.c
+++ b/hw/intc/apic_common.c
@@ -379,6 +379,7 @@ static const VMStateDescription vmstate_apic_common = {
     .pre_load = apic_pre_load,
     .pre_save = apic_dispatch_pre_save,
     .post_load = apic_dispatch_post_load,
+    .priority = MIG_PRI_APIC,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(apicbase, APICCommonState),
         VMSTATE_UINT8(id, APICCommonState),
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 5567fd78d0..6f5a9fed68 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -163,6 +163,7 @@ typedef enum {
     MIG_PRI_IOMMU,              /* Must happen before PCI devices */
     MIG_PRI_PCI_BUS,            /* Must happen before IOMMU */
     MIG_PRI_VIRTIO_MEM,         /* Must happen before IOMMU */
+    MIG_PRI_APIC,               /* Must happen before PCI devices */
     MIG_PRI_GICV3_ITS,          /* Must happen before PCI devices */
     MIG_PRI_GICV3,              /* Must happen before the ITS */
     MIG_PRI_MAX,

From 9e7bfda4909cc688dd0327e17985019f08a78d5d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 29 Sep 2025 15:42:26 +0100
Subject: [PATCH 0918/2396] include/system/memory.h: Clarify
 address_space_destroy() behaviour

address_space_destroy() doesn't actually immediately destroy the AS;
it queues it to be destroyed via RCU. This means you can't g_free()
the memory the AS struct is in until that has happened.

Clarify this in the documentation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20250929144228.1994037-2-peter.maydell@linaro.org
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/system/memory.h | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/include/system/memory.h b/include/system/memory.h
index aa85fc27a1..827e2c5aa4 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -2727,9 +2727,14 @@ void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name);
 /**
  * address_space_destroy: destroy an address space
  *
- * Releases all resources associated with an address space.  After an address space
- * is destroyed, its root memory region (given by address_space_init()) may be destroyed
- * as well.
+ * Releases all resources associated with an address space.  After an
+ * address space is destroyed, the reference the AddressSpace had to
+ * its root memory region is dropped, which may result in the
+ * destruction of that memory region as well.
+ *
+ * Note that destruction of the AddressSpace is done via RCU;
+ * it is therefore not valid to free the memory the AddressSpace
+ * struct is in until after that RCU callback has completed.
  *
  * @as: address space to be destroyed
  */

From 041600e23f2fe2a9c252c9a8b26c7d147bedf982 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 29 Sep 2025 15:42:27 +0100
Subject: [PATCH 0919/2396] memory: New AS helper to serialize destroy+free

If an AddressSpace has been created in its own allocated
memory, cleaning it up requires first destroying the AS
and then freeing the memory. Doing this doesn't work:

    address_space_destroy(as);
    g_free_rcu(as, rcu);

because both address_space_destroy() and g_free_rcu()
try to use the same 'rcu' node in the AddressSpace struct
and the address_space_destroy hook gets overwritten.

Provide a new address_space_destroy_free() function which
will destroy the AS and then free the memory it uses, all
in one RCU callback.

(CC to stable because the next commit needs this function.)

Cc: qemu-stable@nongnu.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20250929144228.1994037-3-peter.maydell@linaro.org
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/system/memory.h | 13 +++++++++++++
 system/memory.c         | 20 +++++++++++++++++++-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/include/system/memory.h b/include/system/memory.h
index 827e2c5aa4..08daf0fc59 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -2735,11 +2735,24 @@ void address_space_init(AddressSpace *as, MemoryRegion *root, const char *name);
  * Note that destruction of the AddressSpace is done via RCU;
  * it is therefore not valid to free the memory the AddressSpace
  * struct is in until after that RCU callback has completed.
+ * If you want to g_free() the AddressSpace after destruction you
+ * can do that with address_space_destroy_free().
  *
  * @as: address space to be destroyed
  */
 void address_space_destroy(AddressSpace *as);
 
+/**
+ * address_space_destroy_free: destroy an address space and free it
+ *
+ * This does the same thing as address_space_destroy(), and then also
+ * frees (via g_free()) the AddressSpace itself once the destruction
+ * is complete.
+ *
+ * @as: address space to be destroyed
+ */
+void address_space_destroy_free(AddressSpace *as);
+
 /**
  * address_space_remove_listeners: unregister all listeners of an address space
  *
diff --git a/system/memory.c b/system/memory.c
index cf8cad6961..fe8b28a096 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -3278,7 +3278,14 @@ static void do_address_space_destroy(AddressSpace *as)
     memory_region_unref(as->root);
 }
 
-void address_space_destroy(AddressSpace *as)
+static void do_address_space_destroy_free(AddressSpace *as)
+{
+    do_address_space_destroy(as);
+    g_free(as);
+}
+
+/* Detach address space from global view, notify all listeners */
+static void address_space_detach(AddressSpace *as)
 {
     MemoryRegion *root = as->root;
 
@@ -3293,9 +3300,20 @@ void address_space_destroy(AddressSpace *as)
      * values to expire before freeing the data.
      */
     as->root = root;
+}
+
+void address_space_destroy(AddressSpace *as)
+{
+    address_space_detach(as);
     call_rcu(as, do_address_space_destroy, rcu);
 }
 
+void address_space_destroy_free(AddressSpace *as)
+{
+    address_space_detach(as);
+    call_rcu(as, do_address_space_destroy_free, rcu);
+}
+
 static const char *memory_region_type(MemoryRegion *mr)
 {
     if (mr->alias) {

From 300a87c502c4ba7ffc7720d8f3583e3d1a68348a Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 29 Sep 2025 15:42:28 +0100
Subject: [PATCH 0920/2396] physmem: Destroy all CPU AddressSpaces on unrealize

When we unrealize a CPU object (which happens on vCPU hot-unplug), we
should destroy all the AddressSpace objects we created via calls to
cpu_address_space_init() when the CPU was realized.

Commit 24bec42f3d6eae added a function to do this for a specific
AddressSpace, but did not add any places where the function was
called.

Since we always want to destroy all the AddressSpaces on unrealize,
regardless of the target architecture, we don't need to try to keep
track of how many are still undestroyed, or make the target
architecture code manually call a destroy function for each AS it
created.  Instead we can adjust the function to always completely
destroy the whole cpu->ases array, and arrange for it to be called
during CPU unrealize as part of the common code.

Without this fix, AddressSanitizer will report a leak like this
from a run where we hot-plugged and then hot-unplugged an x86 KVM
vCPU:

Direct leak of 416 byte(s) in 1 object(s) allocated from:
    #0 0x5b638565053d in calloc (/data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/qemu-system-x86_64+0x1ee153d) (BuildId: c1cd6022b195142106e1bffeca23498c2b752bca)
    #1 0x7c28083f77b1 in g_malloc0 (/lib/x86_64-linux-gnu/libglib-2.0.so.0+0x637b1) (BuildId: 1eb6131419edb83b2178b682829a6913cf682d75)
    #2 0x5b6386999c7c in cpu_address_space_init /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../system/physmem.c:797:25
    #3 0x5b638727f049 in kvm_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/kvm/kvm-cpu.c:102:5
    #4 0x5b6385745f40 in accel_cpu_common_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../accel/accel-common.c:101:13
    #5 0x5b638568fe3c in cpu_exec_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/cpu-common.c:232:10
    #6 0x5b63874a2cd5 in x86_cpu_realizefn /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../target/i386/cpu.c:9321:5
    #7 0x5b6387a0469a in device_set_realized /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:494:13
    #8 0x5b6387a27d9e in property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:2375:5
    #9 0x5b6387a2090b in object_property_set /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1450:5
    #10 0x5b6387a35b05 in object_property_set_qobject /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/qom-qobject.c:28:10
    #11 0x5b6387a21739 in object_property_set_bool /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../qom/object.c:1520:15
    #12 0x5b63879fe510 in qdev_realize /data_nvme1n1/linaro/qemu-from-laptop/qemu/build/x86-tgts-asan/../../hw/core/qdev.c:276:12

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2517
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/r/20250929144228.1994037-4-peter.maydell@linaro.org
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/core/cpu-common.c               |  1 +
 include/exec/cpu-common.h          | 10 ++++-----
 include/hw/core/cpu.h              |  1 -
 stubs/cpu-destroy-address-spaces.c | 15 +++++++++++++
 stubs/meson.build                  |  1 +
 system/physmem.c                   | 34 ++++++++++++++----------------
 6 files changed, 38 insertions(+), 24 deletions(-)
 create mode 100644 stubs/cpu-destroy-address-spaces.c

diff --git a/hw/core/cpu-common.c b/hw/core/cpu-common.c
index 41a339903c..8c306c89e4 100644
--- a/hw/core/cpu-common.c
+++ b/hw/core/cpu-common.c
@@ -294,6 +294,7 @@ void cpu_exec_unrealizefn(CPUState *cpu)
      * accel_cpu_common_unrealize, which may free fields using call_rcu.
      */
     accel_cpu_common_unrealize(cpu);
+    cpu_destroy_address_spaces(cpu);
 }
 
 static void cpu_common_initfn(Object *obj)
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index f373781ae0..b96ac49844 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -123,13 +123,13 @@ size_t qemu_ram_pagesize_largest(void);
 void cpu_address_space_init(CPUState *cpu, int asidx,
                             const char *prefix, MemoryRegion *mr);
 /**
- * cpu_address_space_destroy:
- * @cpu: CPU for which address space needs to be destroyed
- * @asidx: integer index of this address space
+ * cpu_destroy_address_spaces:
+ * @cpu: CPU for which address spaces need to be destroyed
  *
- * Note that with KVM only one address space is supported.
+ * Destroy all address spaces associated with this CPU; this
+ * is called as part of unrealizing the CPU.
  */
-void cpu_address_space_destroy(CPUState *cpu, int asidx);
+void cpu_destroy_address_spaces(CPUState *cpu);
 
 void cpu_physical_memory_rw(hwaddr addr, void *buf,
                             hwaddr len, bool is_write);
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index c9f40c2539..0fcbc923f3 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -515,7 +515,6 @@ struct CPUState {
     QSIMPLEQ_HEAD(, qemu_work_item) work_list;
 
     struct CPUAddressSpace *cpu_ases;
-    int cpu_ases_count;
     int num_ases;
     AddressSpace *as;
     MemoryRegion *memory;
diff --git a/stubs/cpu-destroy-address-spaces.c b/stubs/cpu-destroy-address-spaces.c
new file mode 100644
index 0000000000..dc6813f5bd
--- /dev/null
+++ b/stubs/cpu-destroy-address-spaces.c
@@ -0,0 +1,15 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "qemu/osdep.h"
+#include "exec/cpu-common.h"
+
+/*
+ * user-mode CPUs never create address spaces with
+ * cpu_address_space_init(), so the cleanup function doesn't
+ * need to do anything. We need this stub because cpu-common.c
+ * is built-once so it can't #ifndef CONFIG_USER around the
+ * call; the real function is in physmem.c which is system-only.
+ */
+void cpu_destroy_address_spaces(CPUState *cpu)
+{
+}
diff --git a/stubs/meson.build b/stubs/meson.build
index cef046e685..5d577467bf 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -55,6 +55,7 @@ endif
 if have_user
   # Symbols that are used by hw/core.
   stub_ss.add(files('cpu-synchronize-state.c'))
+  stub_ss.add(files('cpu-destroy-address-spaces.c'))
 
   # Stubs for QAPI events.  Those can always be included in the build, but
   # they are not built at all for --disable-system builds.
diff --git a/system/physmem.c b/system/physmem.c
index ae8ecd50ea..dbb2a4e017 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -795,7 +795,6 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
 
     if (!cpu->cpu_ases) {
         cpu->cpu_ases = g_new0(CPUAddressSpace, cpu->num_ases);
-        cpu->cpu_ases_count = cpu->num_ases;
     }
 
     newas = &cpu->cpu_ases[asidx];
@@ -809,30 +808,29 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
     }
 }
 
-void cpu_address_space_destroy(CPUState *cpu, int asidx)
+void cpu_destroy_address_spaces(CPUState *cpu)
 {
     CPUAddressSpace *cpuas;
+    int asidx;
 
     assert(cpu->cpu_ases);
-    assert(asidx >= 0 && asidx < cpu->num_ases);
 
-    cpuas = &cpu->cpu_ases[asidx];
-    if (tcg_enabled()) {
-        memory_listener_unregister(&cpuas->tcg_as_listener);
+    /* convenience alias just points to some cpu_ases[n] */
+    cpu->as = NULL;
+
+    for (asidx = 0; asidx < cpu->num_ases; asidx++) {
+        cpuas = &cpu->cpu_ases[asidx];
+        if (!cpuas->as) {
+            /* This index was never initialized; no deinit needed */
+            continue;
+        }
+        if (tcg_enabled()) {
+            memory_listener_unregister(&cpuas->tcg_as_listener);
+        }
+        g_clear_pointer(&cpuas->as, address_space_destroy_free);
     }
 
-    address_space_destroy(cpuas->as);
-    g_free_rcu(cpuas->as, rcu);
-
-    if (asidx == 0) {
-        /* reset the convenience alias for address space 0 */
-        cpu->as = NULL;
-    }
-
-    if (--cpu->cpu_ases_count == 0) {
-        g_free(cpu->cpu_ases);
-        cpu->cpu_ases = NULL;
-    }
+    g_clear_pointer(&cpu->cpu_ases, g_free);
 }
 
 AddressSpace *cpu_get_address_space(CPUState *cpu, int asidx)

From a5bc1ccca9596ecbf57b05bed10bd39e8854e475 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 1 Aug 2025 18:02:11 +0100
Subject: [PATCH 0921/2396] migration: simplify error reporting after channel
 read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code handling the return value of qio_channel_read proceses
len == 0 (EOF) separately from len < 1  (error), but in both
cases ends up calling qemu_file_set_error_obj() with -EIO as the
errno. This logic can be merged into one codepath to simplify it.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Prasad Pandit <pjp@fedoraproject.org>
Link: https://lore.kernel.org/r/20250801170212.54409-2-berrange@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/qemu-file.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 0ee0f48a3e..2d4ce174a5 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -348,17 +348,13 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
             } else {
                 qio_channel_wait(f->ioc, G_IO_IN);
             }
-        } else if (len < 0) {
-            len = -EIO;
         }
     } while (len == QIO_CHANNEL_ERR_BLOCK);
 
     if (len > 0) {
         f->buf_size += len;
-    } else if (len == 0) {
-        qemu_file_set_error_obj(f, -EIO, local_error);
     } else {
-        qemu_file_set_error_obj(f, len, local_error);
+        qemu_file_set_error_obj(f, -EIO, local_error);
     }
 
     for (int i = 0; i < nfd; i++) {

From dc79c7d5e15be05b23f24fab12f0d5e2bf831514 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:53 -0700
Subject: [PATCH 0922/2396] migration: multi-mode notifier

Allow a notifier to be added for multiple migration modes.
To allow a notifier to appear on multiple per-node lists, use
a generic list type.  We can no longer use NotifierWithReturnList,
because it shoe horns the notifier onto a single list.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/1759332851-370353-2-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/misc.h | 12 ++++++++
 migration/migration.c    | 60 +++++++++++++++++++++++++++++++---------
 2 files changed, 59 insertions(+), 13 deletions(-)

diff --git a/include/migration/misc.h b/include/migration/misc.h
index a261f99d89..592b93021e 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -95,7 +95,19 @@ void migration_add_notifier(NotifierWithReturn *notify,
 void migration_add_notifier_mode(NotifierWithReturn *notify,
                                  MigrationNotifyFunc func, MigMode mode);
 
+/*
+ * Same as migration_add_notifier, but applies to all @mode in the argument
+ * list.  The list is terminated by -1 or MIG_MODE_ALL.  For the latter,
+ * the notifier is added for all modes.
+ */
+void migration_add_notifier_modes(NotifierWithReturn *notify,
+                                  MigrationNotifyFunc func, MigMode mode, ...);
+
+/*
+ * Remove a notifier from all modes.
+ */
 void migration_remove_notifier(NotifierWithReturn *notify);
+
 void migration_file_set_error(int ret, Error *err);
 
 /* True if incoming migration entered POSTCOPY_INCOMING_DISCARD */
diff --git a/migration/migration.c b/migration/migration.c
index edb8ff0d46..a399735f02 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -74,11 +74,7 @@
 
 #define INMIGRATE_DEFAULT_EXIT_ON_ERROR true
 
-static NotifierWithReturnList migration_state_notifiers[] = {
-    NOTIFIER_ELEM_INIT(migration_state_notifiers, MIG_MODE_NORMAL),
-    NOTIFIER_ELEM_INIT(migration_state_notifiers, MIG_MODE_CPR_REBOOT),
-    NOTIFIER_ELEM_INIT(migration_state_notifiers, MIG_MODE_CPR_TRANSFER),
-};
+static GSList *migration_state_notifiers[MIG_MODE__MAX];
 
 /* Messages sent on the return path from destination to source */
 enum mig_rp_message_type {
@@ -1675,23 +1671,51 @@ void migration_cancel(void)
     }
 }
 
+static int get_modes(MigMode mode, va_list ap);
+
+static void add_notifiers(NotifierWithReturn *notify, int modes)
+{
+    for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
+        if (modes & BIT(mode)) {
+            migration_state_notifiers[mode] =
+                g_slist_prepend(migration_state_notifiers[mode], notify);
+        }
+    }
+}
+
+void migration_add_notifier_modes(NotifierWithReturn *notify,
+                                  MigrationNotifyFunc func, MigMode mode, ...)
+{
+    int modes;
+    va_list ap;
+
+    va_start(ap, mode);
+    modes = get_modes(mode, ap);
+    va_end(ap);
+
+    notify->notify = (NotifierWithReturnFunc)func;
+    add_notifiers(notify, modes);
+}
+
 void migration_add_notifier_mode(NotifierWithReturn *notify,
                                  MigrationNotifyFunc func, MigMode mode)
 {
-    notify->notify = (NotifierWithReturnFunc)func;
-    notifier_with_return_list_add(&migration_state_notifiers[mode], notify);
+    migration_add_notifier_modes(notify, func, mode, -1);
 }
 
 void migration_add_notifier(NotifierWithReturn *notify,
                             MigrationNotifyFunc func)
 {
-    migration_add_notifier_mode(notify, func, MIG_MODE_NORMAL);
+    migration_add_notifier_modes(notify, func, MIG_MODE_NORMAL, -1);
 }
 
 void migration_remove_notifier(NotifierWithReturn *notify)
 {
     if (notify->notify) {
-        notifier_with_return_remove(notify);
+        for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
+            migration_blockers[mode] =
+                g_slist_remove(migration_state_notifiers[mode], notify);
+        }
         notify->notify = NULL;
     }
 }
@@ -1701,13 +1725,23 @@ int migration_call_notifiers(MigrationState *s, MigrationEventType type,
 {
     MigMode mode = s->parameters.mode;
     MigrationEvent e;
+    NotifierWithReturn *notifier;
+    GSList *elem, *next;
     int ret;
 
     e.type = type;
-    ret = notifier_with_return_list_notify(&migration_state_notifiers[mode],
-                                           &e, errp);
-    assert(!ret || type == MIG_EVENT_PRECOPY_SETUP);
-    return ret;
+
+    for (elem = migration_state_notifiers[mode]; elem; elem = next) {
+        next = elem->next;
+        notifier = (NotifierWithReturn *)elem->data;
+        ret = notifier->notify(notifier, &e, errp);
+        if (ret) {
+            assert(type == MIG_EVENT_PRECOPY_SETUP);
+            return ret;
+        }
+    }
+
+    return 0;
 }
 
 bool migration_has_failed(MigrationState *s)

From a9f9eee58bc5cfacc1aa5cb7a138b5a8c12a493c Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:54 -0700
Subject: [PATCH 0923/2396] migration: add cpr_walk_fd

Add a helper to walk all CPR fd's and run a callback for each.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/1759332851-370353-3-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/cpr.h |  3 +++
 migration/cpr.c         | 13 +++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index 3fc19a74ef..2b074d7a65 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -34,6 +34,9 @@ void cpr_resave_fd(const char *name, int id, int fd);
 int cpr_open_fd(const char *path, int flags, const char *name, int id,
                 Error **errp);
 
+typedef bool (*cpr_walk_fd_cb)(int fd);
+bool cpr_walk_fd(cpr_walk_fd_cb cb);
+
 MigMode cpr_get_incoming_mode(void);
 void cpr_set_incoming_mode(MigMode mode);
 bool cpr_is_incoming(void);
diff --git a/migration/cpr.c b/migration/cpr.c
index e0b47df222..6feda78f1b 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -122,6 +122,19 @@ int cpr_open_fd(const char *path, int flags, const char *name, int id,
     return fd;
 }
 
+bool cpr_walk_fd(cpr_walk_fd_cb cb)
+{
+    CprFd *elem;
+
+    QLIST_FOREACH(elem, &cpr_state.fds, next) {
+        g_assert(elem->fd >= 0);
+        if (!cb(elem->fd)) {
+            return false;
+        }
+    }
+    return true;
+}
+
 /*************************************************************************/
 static const VMStateDescription vmstate_cpr_state = {
     .name = CPR_STATE,

From fe72a8073ed63cf0fc138d1f4450da2e6e5b5271 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:55 -0700
Subject: [PATCH 0924/2396] oslib: qemu_clear_cloexec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define qemu_clear_cloexec, analogous to qemu_set_cloexec.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/1759332851-370353-4-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/qemu/osdep.h | 9 +++++++++
 util/oslib-posix.c   | 9 +++++++++
 util/oslib-win32.c   | 4 ++++
 3 files changed, 22 insertions(+)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index 1b38cb7e45..ed3e511a8e 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -689,6 +689,15 @@ ssize_t qemu_write_full(int fd, const void *buf, size_t count)
 void qemu_set_cloexec(int fd);
 bool qemu_set_blocking(int fd, bool block, Error **errp);
 
+/*
+ * Clear FD_CLOEXEC for a descriptor.
+ *
+ * The caller must guarantee that no other fork+exec's occur before the
+ * exec that is intended to inherit this descriptor, eg by suspending CPUs
+ * and blocking monitor commands.
+ */
+void qemu_clear_cloexec(int fd);
+
 /* Return a dynamically allocated directory path that is appropriate for storing
  * local state.
  *
diff --git a/util/oslib-posix.c b/util/oslib-posix.c
index 14cf94ac03..3c14b72665 100644
--- a/util/oslib-posix.c
+++ b/util/oslib-posix.c
@@ -305,6 +305,15 @@ int qemu_socketpair(int domain, int type, int protocol, int sv[2])
     return ret;
 }
 
+void qemu_clear_cloexec(int fd)
+{
+    int f;
+    f = fcntl(fd, F_GETFD);
+    assert(f != -1);
+    f = fcntl(fd, F_SETFD, f & ~FD_CLOEXEC);
+    assert(f != -1);
+}
+
 char *
 qemu_get_local_state_dir(void)
 {
diff --git a/util/oslib-win32.c b/util/oslib-win32.c
index 84bc65a765..839b8a4170 100644
--- a/util/oslib-win32.c
+++ b/util/oslib-win32.c
@@ -219,6 +219,10 @@ void qemu_set_cloexec(int fd)
 {
 }
 
+void qemu_clear_cloexec(int fd)
+{
+}
+
 int qemu_get_thread_id(void)
 {
     return GetCurrentThreadId();

From f57ff59f1e14f8162efda41725d1c013ed76b7d7 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:56 -0700
Subject: [PATCH 0925/2396] migration: cpr-exec-command parameter

Create the cpr-exec-command migration parameter, defined as a list of
strings.  It will be used for cpr-exec migration mode in a subsequent
patch, and contains forward references to cpr-exec mode in the qapi
doc.

No functional change, except that cpr-exec-command is shown by the
'info migrate' command.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/1759332851-370353-5-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hmp-commands.hx                |  2 +-
 migration/migration-hmp-cmds.c | 30 ++++++++++++++++++++++++++++++
 migration/options.c            | 14 ++++++++++++++
 qapi/migration.json            | 21 ++++++++++++++++++---
 4 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index d0e4f35a30..3cace8f1f7 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1009,7 +1009,7 @@ ERST
 
     {
         .name       = "migrate_set_parameter",
-        .args_type  = "parameter:s,value:s",
+        .args_type  = "parameter:s,value:S",
         .params     = "parameter value",
         .help       = "Set the parameter for migration",
         .cmd        = hmp_migrate_set_parameter,
diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 814221b260..847d18faaa 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -306,6 +306,18 @@ void hmp_info_migrate_capabilities(Monitor *mon, const QDict *qdict)
     qapi_free_MigrationCapabilityStatusList(caps);
 }
 
+static void monitor_print_cpr_exec_command(Monitor *mon, strList *args)
+{
+    monitor_printf(mon, "%s:",
+        MigrationParameter_str(MIGRATION_PARAMETER_CPR_EXEC_COMMAND));
+
+    while (args) {
+        monitor_printf(mon, " %s", args->value);
+        args = args->next;
+    }
+    monitor_printf(mon, "\n");
+}
+
 void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
 {
     MigrationParameters *params;
@@ -437,6 +449,9 @@ void hmp_info_migrate_parameters(Monitor *mon, const QDict *qdict)
                                MIGRATION_PARAMETER_DIRECT_IO),
                            params->direct_io ? "on" : "off");
         }
+
+        assert(params->has_cpr_exec_command);
+        monitor_print_cpr_exec_command(mon, params->cpr_exec_command);
     }
 
     qapi_free_MigrationParameters(params);
@@ -718,6 +733,21 @@ void hmp_migrate_set_parameter(Monitor *mon, const QDict *qdict)
         p->has_direct_io = true;
         visit_type_bool(v, param, &p->direct_io, &err);
         break;
+    case MIGRATION_PARAMETER_CPR_EXEC_COMMAND: {
+        g_autofree char **strv = NULL;
+        g_autoptr(GError) gerr = NULL;
+        strList **tail = &p->cpr_exec_command;
+
+        if (!g_shell_parse_argv(valuestr, NULL, &strv, &gerr)) {
+            error_setg(&err, "%s", gerr->message);
+            break;
+        }
+        for (int i = 0; strv[i]; i++) {
+            QAPI_LIST_APPEND(tail, strv[i]);
+        }
+        p->has_cpr_exec_command = true;
+        break;
+    }
     default:
         g_assert_not_reached();
     }
diff --git a/migration/options.c b/migration/options.c
index 4e923a2e07..5183112775 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -959,6 +959,9 @@ MigrationParameters *qmp_query_migrate_parameters(Error **errp)
     params->zero_page_detection = s->parameters.zero_page_detection;
     params->has_direct_io = true;
     params->direct_io = s->parameters.direct_io;
+    params->has_cpr_exec_command = true;
+    params->cpr_exec_command = QAPI_CLONE(strList,
+                                          s->parameters.cpr_exec_command);
 
     return params;
 }
@@ -993,6 +996,7 @@ void migrate_params_init(MigrationParameters *params)
     params->has_mode = true;
     params->has_zero_page_detection = true;
     params->has_direct_io = true;
+    params->has_cpr_exec_command = true;
 }
 
 /*
@@ -1297,6 +1301,10 @@ static void migrate_params_test_apply(MigrateSetParameters *params,
     if (params->has_direct_io) {
         dest->direct_io = params->direct_io;
     }
+
+    if (params->has_cpr_exec_command) {
+        dest->cpr_exec_command = params->cpr_exec_command;
+    }
 }
 
 static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
@@ -1429,6 +1437,12 @@ static void migrate_params_apply(MigrateSetParameters *params, Error **errp)
     if (params->has_direct_io) {
         s->parameters.direct_io = params->direct_io;
     }
+
+    if (params->has_cpr_exec_command) {
+        qapi_free_strList(s->parameters.cpr_exec_command);
+        s->parameters.cpr_exec_command =
+            QAPI_CLONE(strList, params->cpr_exec_command);
+    }
 }
 
 void qmp_migrate_set_parameters(MigrateSetParameters *params, Error **errp)
diff --git a/qapi/migration.json b/qapi/migration.json
index 2387c21e9c..2be8fa1d16 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -924,6 +924,10 @@
 #     only has effect if the @mapped-ram capability is enabled.
 #     (Since 9.1)
 #
+# @cpr-exec-command: Command to start the new QEMU process when @mode
+#     is @cpr-exec.  The first list element is the program's filename,
+#     the remainder its arguments.  (Since 10.2)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and
@@ -950,7 +954,8 @@
            'vcpu-dirty-limit',
            'mode',
            'zero-page-detection',
-           'direct-io'] }
+           'direct-io',
+           'cpr-exec-command'] }
 
 ##
 # @MigrateSetParameters:
@@ -1105,6 +1110,10 @@
 #     only has effect if the @mapped-ram capability is enabled.
 #     (Since 9.1)
 #
+# @cpr-exec-command: Command to start the new QEMU process when @mode
+#     is @cpr-exec.  The first list element is the program's filename,
+#     the remainder its arguments.  (Since 10.2)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and
@@ -1146,7 +1155,8 @@
             '*vcpu-dirty-limit': 'uint64',
             '*mode': 'MigMode',
             '*zero-page-detection': 'ZeroPageDetection',
-            '*direct-io': 'bool' } }
+            '*direct-io': 'bool',
+            '*cpr-exec-command': [ 'str' ]} }
 
 ##
 # @migrate-set-parameters:
@@ -1315,6 +1325,10 @@
 #     only has effect if the @mapped-ram capability is enabled.
 #     (Since 9.1)
 #
+# @cpr-exec-command: Command to start the new QEMU process when @mode
+#     is @cpr-exec.  The first list element is the program's filename,
+#     the remainder its arguments.  (Since 10.2)
+#
 # Features:
 #
 # @unstable: Members @x-checkpoint-delay and
@@ -1353,7 +1367,8 @@
             '*vcpu-dirty-limit': 'uint64',
             '*mode': 'MigMode',
             '*zero-page-detection': 'ZeroPageDetection',
-            '*direct-io': 'bool' } }
+            '*direct-io': 'bool',
+            '*cpr-exec-command': [ 'str' ]} }
 
 ##
 # @query-migrate-parameters:

From efc65873131dac48d2f7620adfcd683834acc94b Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:57 -0700
Subject: [PATCH 0926/2396] migration: cpr-exec save and load

To preserve CPR state across exec, create a QEMUFile based on a memfd, and
keep the memfd open across exec.  Save the value of the memfd in an
environment variable so post-exec QEMU can find it.

These new functions are called in a subsequent patch.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/r/1759332851-370353-6-git-send-email-steven.sistare@oracle.com
[peterx: fix build for Windows]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/cpr.h |  5 +++
 migration/cpr-exec.c    | 99 +++++++++++++++++++++++++++++++++++++++++
 migration/meson.build   |  1 +
 3 files changed, 105 insertions(+)
 create mode 100644 migration/cpr-exec.c

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index 2b074d7a65..b84389ff04 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -53,4 +53,9 @@ int cpr_get_fd_param(const char *name, const char *fdname, int index,
 QEMUFile *cpr_transfer_output(MigrationChannel *channel, Error **errp);
 QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);
 
+QEMUFile *cpr_exec_output(Error **errp);
+QEMUFile *cpr_exec_input(Error **errp);
+void cpr_exec_persist_state(QEMUFile *f);
+bool cpr_exec_has_state(void);
+void cpr_exec_unpersist_state(void);
 #endif
diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
new file mode 100644
index 0000000000..81d84425e1
--- /dev/null
+++ b/migration/cpr-exec.c
@@ -0,0 +1,99 @@
+/*
+ * Copyright (c) 2021-2025 Oracle and/or its affiliates.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/cutils.h"
+#include "qemu/memfd.h"
+#include "qapi/error.h"
+#include "io/channel-file.h"
+#include "io/channel-socket.h"
+#include "migration/cpr.h"
+#include "migration/qemu-file.h"
+#include "migration/misc.h"
+#include "migration/vmstate.h"
+#include "system/runstate.h"
+
+#define CPR_EXEC_STATE_NAME "QEMU_CPR_EXEC_STATE"
+
+static QEMUFile *qemu_file_new_fd_input(int fd, const char *name)
+{
+    g_autoptr(QIOChannelFile) fioc = qio_channel_file_new_fd(fd);
+    QIOChannel *ioc = QIO_CHANNEL(fioc);
+    qio_channel_set_name(ioc, name);
+    return qemu_file_new_input(ioc);
+}
+
+static QEMUFile *qemu_file_new_fd_output(int fd, const char *name)
+{
+    g_autoptr(QIOChannelFile) fioc = qio_channel_file_new_fd(fd);
+    QIOChannel *ioc = QIO_CHANNEL(fioc);
+    qio_channel_set_name(ioc, name);
+    return qemu_file_new_output(ioc);
+}
+
+void cpr_exec_persist_state(QEMUFile *f)
+{
+    QIOChannelFile *fioc = QIO_CHANNEL_FILE(qemu_file_get_ioc(f));
+    int mfd = dup(fioc->fd);
+    char val[16];
+
+    /* Remember mfd in environment for post-exec load */
+    qemu_clear_cloexec(mfd);
+    snprintf(val, sizeof(val), "%d", mfd);
+    g_setenv(CPR_EXEC_STATE_NAME, val, 1);
+}
+
+static int cpr_exec_find_state(void)
+{
+    const char *val = g_getenv(CPR_EXEC_STATE_NAME);
+    int mfd;
+
+    assert(val);
+    g_unsetenv(CPR_EXEC_STATE_NAME);
+    assert(!qemu_strtoi(val, NULL, 10, &mfd));
+    return mfd;
+}
+
+bool cpr_exec_has_state(void)
+{
+    return g_getenv(CPR_EXEC_STATE_NAME) != NULL;
+}
+
+void cpr_exec_unpersist_state(void)
+{
+    int mfd;
+    const char *val = g_getenv(CPR_EXEC_STATE_NAME);
+
+    g_unsetenv(CPR_EXEC_STATE_NAME);
+    assert(val);
+    assert(!qemu_strtoi(val, NULL, 10, &mfd));
+    close(mfd);
+}
+
+QEMUFile *cpr_exec_output(Error **errp)
+{
+    int mfd;
+
+#ifdef CONFIG_LINUX
+    mfd = qemu_memfd_create(CPR_EXEC_STATE_NAME, 0, false, 0, 0, errp);
+#else
+    mfd = -1;
+#endif
+
+    if (mfd < 0) {
+        return NULL;
+    }
+
+    return qemu_file_new_fd_output(mfd, CPR_EXEC_STATE_NAME);
+}
+
+QEMUFile *cpr_exec_input(Error **errp)
+{
+    int mfd = cpr_exec_find_state();
+
+    lseek(mfd, 0, SEEK_SET);
+    return qemu_file_new_fd_input(mfd, CPR_EXEC_STATE_NAME);
+}
diff --git a/migration/meson.build b/migration/meson.build
index 0f71544a82..16909d54c5 100644
--- a/migration/meson.build
+++ b/migration/meson.build
@@ -16,6 +16,7 @@ system_ss.add(files(
   'channel-block.c',
   'cpr.c',
   'cpr-transfer.c',
+  'cpr-exec.c',
   'cpu-throttle.c',
   'dirtyrate.c',
   'exec.c',

From a3eae205c601dd491d2e83fa9ff0d15fce7236b5 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:58 -0700
Subject: [PATCH 0927/2396] migration: cpr-exec mode

Add the cpr-exec migration mode.  Usage:
  qemu-system-$arch -machine aux-ram-share=on ...
  migrate_set_parameter mode cpr-exec
  migrate_set_parameter cpr-exec-command \
    <arg1> <arg2> ... -incoming <uri-1> \
  migrate -d <uri-1>

The migrate command stops the VM, saves state to uri-1,
directly exec's a new version of QEMU on the same host,
replacing the original process while retaining its PID, and
loads state from uri-1.  Guest RAM is preserved in place,
albeit with new virtual addresses.

The new QEMU process is started by exec'ing the command
specified by the @cpr-exec-command parameter.  The first word of
the command is the binary, and the remaining words are its
arguments.  The command may be a direct invocation of new QEMU,
or may be a non-QEMU command that exec's the new QEMU binary.

This mode creates a second migration channel that is not visible
to the user.  At the start of migration, old QEMU saves CPR state
to the second channel, and at the end of migration, it tells the
main loop to call cpr_exec.  New QEMU loads CPR state early, before
objects are created.

Because old QEMU terminates when new QEMU starts, one cannot
stream data between the two, so uri-1 must be a type,
such as a file, that accepts all data before old QEMU exits.
Otherwise, old QEMU may quietly block writing to the channel.

Memory-backend objects must have the share=on attribute, but
memory-backend-epc is not supported.  The VM must be started with
the '-machine aux-ram-share=on' option, which allows anonymous
memory to be transferred in place to the new process.  The memfds
are kept open across exec by clearing the close-on-exec flag, their
values are saved in CPR state, and they are mmap'd in new QEMU.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/1759332851-370353-7-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/cpr.h   |  2 +
 migration/cpr-exec.c      | 95 +++++++++++++++++++++++++++++++++++++++
 migration/cpr.c           | 23 +++++++++-
 migration/migration.c     | 10 ++++-
 migration/ram.c           |  1 +
 migration/trace-events    |  1 +
 migration/vmstate-types.c |  8 ++++
 qapi/migration.json       | 25 ++++++++++-
 system/vl.c               |  4 +-
 9 files changed, 164 insertions(+), 5 deletions(-)

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index b84389ff04..a412d6663c 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -53,9 +53,11 @@ int cpr_get_fd_param(const char *name, const char *fdname, int index,
 QEMUFile *cpr_transfer_output(MigrationChannel *channel, Error **errp);
 QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);
 
+void cpr_exec_init(void);
 QEMUFile *cpr_exec_output(Error **errp);
 QEMUFile *cpr_exec_input(Error **errp);
 void cpr_exec_persist_state(QEMUFile *f);
 bool cpr_exec_has_state(void);
 void cpr_exec_unpersist_state(void);
+void cpr_exec_unpreserve_fds(void);
 #endif
diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index 81d84425e1..d57714bc5d 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -6,15 +6,21 @@
 
 #include "qemu/osdep.h"
 #include "qemu/cutils.h"
+#include "qemu/error-report.h"
 #include "qemu/memfd.h"
 #include "qapi/error.h"
+#include "qapi/type-helpers.h"
 #include "io/channel-file.h"
 #include "io/channel-socket.h"
+#include "block/block-global-state.h"
+#include "qemu/main-loop.h"
 #include "migration/cpr.h"
 #include "migration/qemu-file.h"
+#include "migration/migration.h"
 #include "migration/misc.h"
 #include "migration/vmstate.h"
 #include "system/runstate.h"
+#include "trace.h"
 
 #define CPR_EXEC_STATE_NAME "QEMU_CPR_EXEC_STATE"
 
@@ -97,3 +103,92 @@ QEMUFile *cpr_exec_input(Error **errp)
     lseek(mfd, 0, SEEK_SET);
     return qemu_file_new_fd_input(mfd, CPR_EXEC_STATE_NAME);
 }
+
+static bool preserve_fd(int fd)
+{
+    qemu_clear_cloexec(fd);
+    return true;
+}
+
+static bool unpreserve_fd(int fd)
+{
+    qemu_set_cloexec(fd);
+    return true;
+}
+
+static void cpr_exec_preserve_fds(void)
+{
+    cpr_walk_fd(preserve_fd);
+}
+
+void cpr_exec_unpreserve_fds(void)
+{
+    cpr_walk_fd(unpreserve_fd);
+}
+
+static void cpr_exec_cb(void *opaque)
+{
+    MigrationState *s = migrate_get_current();
+    char **argv = strv_from_str_list(s->parameters.cpr_exec_command);
+    Error *err = NULL;
+
+    /*
+     * Clear the close-on-exec flag for all preserved fd's.  We cannot do so
+     * earlier because they should not persist across miscellaneous fork and
+     * exec calls that are performed during normal operation.
+     */
+    cpr_exec_preserve_fds();
+
+    trace_cpr_exec();
+    execvp(argv[0], argv);
+
+    /*
+     * exec should only fail if argv[0] is bogus, or has a permissions problem,
+     * or the system is very short on resources.
+     */
+    g_strfreev(argv);
+    cpr_exec_unpreserve_fds();
+
+    error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
+    error_report_err(error_copy(err));
+    migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
+    migrate_set_error(s, err);
+
+    /* Note, we can go from state COMPLETED to FAILED */
+    migration_call_notifiers(s, MIG_EVENT_PRECOPY_FAILED, NULL);
+
+    err = NULL;
+    if (!migration_block_activate(&err)) {
+        /* error was already reported */
+        error_free(err);
+        return;
+    }
+
+    if (runstate_is_live(s->vm_old_state)) {
+        vm_start();
+    }
+}
+
+static int cpr_exec_notifier(NotifierWithReturn *notifier, MigrationEvent *e,
+                             Error **errp)
+{
+    MigrationState *s = migrate_get_current();
+
+    if (e->type == MIG_EVENT_PRECOPY_DONE) {
+        QEMUBH *cpr_exec_bh = qemu_bh_new(cpr_exec_cb, NULL);
+        assert(s->state == MIGRATION_STATUS_COMPLETED);
+        qemu_bh_schedule(cpr_exec_bh);
+        qemu_notify_event();
+    } else if (e->type == MIG_EVENT_PRECOPY_FAILED) {
+        cpr_exec_unpersist_state();
+    }
+    return 0;
+}
+
+void cpr_exec_init(void)
+{
+    static NotifierWithReturn exec_notifier;
+
+    migration_add_notifier_mode(&exec_notifier, cpr_exec_notifier,
+                                MIG_MODE_CPR_EXEC);
+}
diff --git a/migration/cpr.c b/migration/cpr.c
index 6feda78f1b..22dbac7c72 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -6,6 +6,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-device.h"
@@ -186,6 +187,8 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
     if (mode == MIG_MODE_CPR_TRANSFER) {
         g_assert(channel);
         f = cpr_transfer_output(channel, errp);
+    } else if (mode == MIG_MODE_CPR_EXEC) {
+        f = cpr_exec_output(errp);
     } else {
         return 0;
     }
@@ -202,6 +205,10 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
         return ret;
     }
 
+    if (migrate_mode() == MIG_MODE_CPR_EXEC) {
+        cpr_exec_persist_state(f);
+    }
+
     /*
      * Close the socket only partially so we can later detect when the other
      * end closes by getting a HUP event.
@@ -220,7 +227,13 @@ int cpr_state_load(MigrationChannel *channel, Error **errp)
     QEMUFile *f;
     MigMode mode = 0;
 
-    if (channel) {
+    if (cpr_exec_has_state()) {
+        mode = MIG_MODE_CPR_EXEC;
+        f = cpr_exec_input(errp);
+        if (channel) {
+            warn_report("ignoring cpr channel for migration mode cpr-exec");
+        }
+    } else if (channel) {
         mode = MIG_MODE_CPR_TRANSFER;
         cpr_set_incoming_mode(mode);
         f = cpr_transfer_input(channel, errp);
@@ -232,6 +245,7 @@ int cpr_state_load(MigrationChannel *channel, Error **errp)
     }
 
     trace_cpr_state_load(MigMode_str(mode));
+    cpr_set_incoming_mode(mode);
 
     v = qemu_get_be32(f);
     if (v != QEMU_CPR_FILE_MAGIC) {
@@ -252,6 +266,11 @@ int cpr_state_load(MigrationChannel *channel, Error **errp)
         return ret;
     }
 
+    if (migrate_mode() == MIG_MODE_CPR_EXEC) {
+        /* Set cloexec to prevent fd leaks from fork until the next cpr-exec */
+        cpr_exec_unpreserve_fds();
+    }
+
     /*
      * Let the caller decide when to close the socket (and generate a HUP event
      * for the sending side).
@@ -272,7 +291,7 @@ void cpr_state_close(void)
 bool cpr_incoming_needed(void *opaque)
 {
     MigMode mode = migrate_mode();
-    return mode == MIG_MODE_CPR_TRANSFER;
+    return mode == MIG_MODE_CPR_TRANSFER || mode == MIG_MODE_CPR_EXEC;
 }
 
 /*
diff --git a/migration/migration.c b/migration/migration.c
index a399735f02..a63b46bbef 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -333,6 +333,7 @@ void migration_object_init(void)
 
     ram_mig_init();
     dirty_bitmap_mig_init();
+    cpr_exec_init();
 
     /* Initialize cpu throttle timers */
     cpu_throttle_init();
@@ -1807,7 +1808,8 @@ bool migrate_mode_is_cpr(MigrationState *s)
 {
     MigMode mode = s->parameters.mode;
     return mode == MIG_MODE_CPR_REBOOT ||
-           mode == MIG_MODE_CPR_TRANSFER;
+           mode == MIG_MODE_CPR_TRANSFER ||
+           mode == MIG_MODE_CPR_EXEC;
 }
 
 int migrate_init(MigrationState *s, Error **errp)
@@ -2156,6 +2158,12 @@ static bool migrate_prepare(MigrationState *s, bool resume, Error **errp)
         return false;
     }
 
+    if (migrate_mode() == MIG_MODE_CPR_EXEC &&
+        !s->parameters.has_cpr_exec_command) {
+        error_setg(errp, "cpr-exec mode requires setting cpr-exec-command");
+        return false;
+    }
+
     if (migration_is_blocked(errp)) {
         return false;
     }
diff --git a/migration/ram.c b/migration/ram.c
index a8e8d2cc67..9aac89638a 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -228,6 +228,7 @@ bool migrate_ram_is_ignored(RAMBlock *block)
     MigMode mode = migrate_mode();
     return !qemu_ram_is_migratable(block) ||
            mode == MIG_MODE_CPR_TRANSFER ||
+           mode == MIG_MODE_CPR_EXEC ||
            (migrate_ignore_shared() && qemu_ram_is_shared(block)
                                     && qemu_ram_is_named_file(block));
 }
diff --git a/migration/trace-events b/migration/trace-events
index 706db97def..e8edd1fbba 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -354,6 +354,7 @@ cpr_state_save(const char *mode) "%s mode"
 cpr_state_load(const char *mode) "%s mode"
 cpr_transfer_input(const char *path) "%s"
 cpr_transfer_output(const char *path) "%s"
+cpr_exec(void) ""
 
 # block-dirty-bitmap.c
 send_bitmap_header_enter(void) ""
diff --git a/migration/vmstate-types.c b/migration/vmstate-types.c
index a1cd7a95fa..4b01dc19c2 100644
--- a/migration/vmstate-types.c
+++ b/migration/vmstate-types.c
@@ -322,6 +322,10 @@ static int get_fd(QEMUFile *f, void *pv, size_t size,
                   const VMStateField *field)
 {
     int32_t *v = pv;
+    if (migrate_mode() == MIG_MODE_CPR_EXEC) {
+        qemu_get_sbe32s(f, v);
+        return 0;
+    }
     *v = qemu_file_get_fd(f);
     return 0;
 }
@@ -330,6 +334,10 @@ static int put_fd(QEMUFile *f, void *pv, size_t size,
                   const VMStateField *field, JSONWriter *vmdesc)
 {
     int32_t *v = pv;
+    if (migrate_mode() == MIG_MODE_CPR_EXEC) {
+        qemu_put_sbe32s(f, v);
+        return 0;
+    }
     return qemu_file_put_fd(f, *v);
 }
 
diff --git a/qapi/migration.json b/qapi/migration.json
index 2be8fa1d16..be0f3fcc12 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -694,9 +694,32 @@
 #     until you issue the `migrate-incoming` command.
 #
 #     (since 10.0)
+#
+# @cpr-exec: The migrate command stops the VM, saves state to the
+#     migration channel, directly exec's a new version of QEMU on the
+#     same host, replacing the original process while retaining its
+#     PID, and loads state from the channel.  Guest RAM is preserved
+#     in place.  Devices and their pinned pages are also preserved for
+#     VFIO and IOMMUFD.
+#
+#     Old QEMU starts new QEMU by exec'ing the command specified by
+#     the @cpr-exec-command parameter.  The command may be a direct
+#     invocation of new QEMU, or may be a wrapper that exec's the new
+#     QEMU binary.
+#
+#     Because old QEMU terminates when new QEMU starts, one cannot
+#     stream data between the two, so the channel must be a type,
+#     such as a file, that accepts all data before old QEMU exits.
+#     Otherwise, old QEMU may quietly block writing to the channel.
+#
+#     Memory-backend objects must have the share=on attribute, but
+#     memory-backend-epc is not supported.  The VM must be started
+#     with the '-machine aux-ram-share=on' option.
+#
+#     (since 10.2)
 ##
 { 'enum': 'MigMode',
-  'data': [ 'normal', 'cpr-reboot', 'cpr-transfer' ] }
+  'data': [ 'normal', 'cpr-reboot', 'cpr-transfer', 'cpr-exec' ] }
 
 ##
 # @ZeroPageDetection:
diff --git a/system/vl.c b/system/vl.c
index 00f3694725..646239e4a6 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -3837,6 +3837,8 @@ void qemu_init(int argc, char **argv)
     }
     qemu_init_displays();
     accel_setup_post(current_machine);
-    os_setup_post();
+    if (migrate_mode() != MIG_MODE_CPR_EXEC) {
+        os_setup_post();
+    }
     resume_mux_open();
 }

From 2f9dc012ec31856573009ee922855ba4ab5183a9 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:33:59 -0700
Subject: [PATCH 0928/2396] migration: cpr-exec docs

Update developer documentation for cpr-exec mode.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/1759332851-370353-8-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 docs/devel/migration/CPR.rst | 112 ++++++++++++++++++++++++++++++++++-
 1 file changed, 111 insertions(+), 1 deletion(-)

diff --git a/docs/devel/migration/CPR.rst b/docs/devel/migration/CPR.rst
index 0a0fd4f6dc..b6178568a8 100644
--- a/docs/devel/migration/CPR.rst
+++ b/docs/devel/migration/CPR.rst
@@ -5,7 +5,7 @@ CPR is the umbrella name for a set of migration modes in which the
 VM is migrated to a new QEMU instance on the same host.  It is
 intended for use when the goal is to update host software components
 that run the VM, such as QEMU or even the host kernel.  At this time,
-the cpr-reboot and cpr-transfer modes are available.
+the cpr-reboot, cpr-transfer, and cpr-exec modes are available.
 
 Because QEMU is restarted on the same host, with access to the same
 local devices, CPR is allowed in certain cases where normal migration
@@ -324,3 +324,113 @@ descriptors from old to new QEMU.  In the future, descriptors for
 vhost, and char devices could be transferred,
 preserving those devices and their kernel state without interruption,
 even if they do not explicitly support live migration.
+
+cpr-exec mode
+-------------
+
+In this mode, QEMU stops the VM, writes VM state to the migration
+URI, and directly exec's a new version of QEMU on the same host,
+replacing the original process while retaining its PID.  Guest RAM is
+preserved in place, albeit with new virtual addresses.  The user
+completes the migration by specifying the ``-incoming`` option, and
+by issuing the ``migrate-incoming`` command if necessary; see details
+below.
+
+This mode supports VFIO/IOMMUFD devices by preserving device
+descriptors and hence kernel state across the exec, even for devices
+that do not support live migration.
+
+Because the old and new QEMU instances are not active concurrently,
+the URI cannot be a type that streams data from one instance to the
+other.
+
+This mode does not require a channel of type ``cpr``.  The information
+that is passed over that channel for cpr-transfer mode is instead
+serialized to a memfd, the number of the fd is saved in the
+QEMU_CPR_EXEC_STATE environment variable during the exec of new QEMU.
+and new QEMU mmaps the memfd.
+
+Usage
+^^^^^
+
+Arguments for the new QEMU process are taken from the
+@cpr-exec-command parameter.  The first argument should be the
+path of a new QEMU binary, or a prefix command that exec's the
+new QEMU binary, and the arguments should include the ''-incoming''
+option.
+
+Memory backend objects must have the ``share=on`` attribute.
+The VM must be started with the ``-machine aux-ram-share=on`` option.
+
+Outgoing:
+  * Set the migration mode parameter to ``cpr-exec``.
+  * Set the ``cpr-exec-command`` parameter.
+  * Issue the ``migrate`` command.  It is recommended that the URI be
+    a ``file`` type, but one can use other types such as ``exec``,
+    provided the command captures all the data from the outgoing side,
+    and provides all the data to the incoming side.
+
+Incoming:
+  * You do not need to explicitly start new QEMU.  It is started as
+    a side effect of the migrate command above.
+  * If the VM was running when the outgoing ``migrate`` command was
+    issued, then QEMU automatically resumes VM execution.
+
+Example 1: incoming URI
+^^^^^^^^^^^^^^^^^^^^^^^
+
+In these examples, we simply restart the same version of QEMU, but in
+a real scenario one would set a new QEMU binary path in
+cpr-exec-command.
+
+::
+
+  # qemu-kvm -monitor stdio
+  -object memory-backend-memfd,id=ram0,size=4G
+  -machine memory-backend=ram0
+  -machine aux-ram-share=on
+  ...
+
+  QEMU 10.2.50 monitor - type 'help' for more information
+  (qemu) info status
+  VM status: running
+  (qemu) migrate_set_parameter mode cpr-exec
+  (qemu) migrate_set_parameter cpr-exec-command qemu-kvm ... -incoming file:vm.state
+  (qemu) migrate -d file:vm.state
+  (qemu) QEMU 10.2.50 monitor - type 'help' for more information
+  (qemu) info status
+  VM status: running
+
+Example 2: incoming defer
+^^^^^^^^^^^^^^^^^^^^^^^^^
+::
+
+  # qemu-kvm -monitor stdio
+  -object memory-backend-memfd,id=ram0,size=4G
+  -machine memory-backend=ram0
+  -machine aux-ram-share=on
+  ...
+
+  QEMU 10.2.50 monitor - type 'help' for more information
+  (qemu) info status
+  VM status: running
+  (qemu) migrate_set_parameter mode cpr-exec
+  (qemu) migrate_set_parameter cpr-exec-command qemu-kvm ... -incoming defer
+  (qemu) migrate -d file:vm.state
+  (qemu) QEMU 10.2.50 monitor - type 'help' for more information
+  (qemu) info status
+  status: paused (inmigrate)
+  (qemu) migrate_incoming file:vm.state
+  (qemu) info status
+  VM status: running
+
+Caveats
+^^^^^^^
+
+cpr-exec mode may not be used with postcopy, background-snapshot,
+or COLO.
+
+cpr-exec mode requires permission to use the exec system call, which
+is denied by certain sandbox options, such as spawn.
+
+The guest pause time increases for large guest RAM backed by small pages.

From ee1ca09fc1e6362ab94e92c25600ae51413d8ee4 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Mon, 30 Sep 2024 09:31:52 -0700
Subject: [PATCH 0929/2396] vfio: cpr-exec mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All blockers and notifiers for cpr-transfer mode also apply to cpr-exec.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Acked-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/30750362-d4a1-4392-8dd6-016624d01be1@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/vfio/container-legacy.c |  3 ++-
 hw/vfio/cpr-iommufd.c      |  3 ++-
 hw/vfio/cpr-legacy.c       |  9 +++++----
 hw/vfio/cpr.c              | 13 +++++++------
 4 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index c0f87f774a..c0540f2bdc 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -990,7 +990,8 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
         error_setg(&vbasedev->cpr.mdev_blocker,
                    "CPR does not support vfio mdev %s", vbasedev->name);
         if (migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, errp,
-                                      MIG_MODE_CPR_TRANSFER, -1) < 0) {
+                                      MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC,
+                                      -1) < 0) {
             goto hiod_unref_exit;
         }
     }
diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 1d70c87996..8a4d65de5e 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -159,7 +159,8 @@ bool vfio_iommufd_cpr_register_iommufd(IOMMUFDBackend *be, Error **errp)
 
     if (!vfio_cpr_supported(be, cpr_blocker)) {
         return migrate_add_blocker_modes(cpr_blocker, errp,
-                                         MIG_MODE_CPR_TRANSFER, -1) == 0;
+                                         MIG_MODE_CPR_TRANSFER,
+                                         MIG_MODE_CPR_EXEC, -1) == 0;
     }
 
     vmstate_register(NULL, -1, &iommufd_cpr_vmstate, be);
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index bbf7a0d35f..1a16cb1188 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -179,16 +179,17 @@ bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
 
     if (!vfio_cpr_supported(container, cpr_blocker)) {
         return migrate_add_blocker_modes(cpr_blocker, errp,
-                                         MIG_MODE_CPR_TRANSFER, -1) == 0;
+                                         MIG_MODE_CPR_TRANSFER,
+                                         MIG_MODE_CPR_EXEC, -1) == 0;
     }
 
     vfio_cpr_add_kvm_notifier();
 
     vmstate_register(NULL, -1, &vfio_container_vmstate, container);
 
-    migration_add_notifier_mode(&container->cpr.transfer_notifier,
-                                vfio_cpr_fail_notifier,
-                                MIG_MODE_CPR_TRANSFER);
+    migration_add_notifier_modes(&container->cpr.transfer_notifier,
+                                 vfio_cpr_fail_notifier,
+                                 MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC, -1);
     return true;
 }
 
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index 2c71fc1e8e..db462aabcb 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -195,9 +195,10 @@ static int vfio_cpr_kvm_close_notifier(NotifierWithReturn *notifier,
 void vfio_cpr_add_kvm_notifier(void)
 {
     if (!kvm_close_notifier.notify) {
-        migration_add_notifier_mode(&kvm_close_notifier,
-                                    vfio_cpr_kvm_close_notifier,
-                                    MIG_MODE_CPR_TRANSFER);
+        migration_add_notifier_modes(&kvm_close_notifier,
+                                     vfio_cpr_kvm_close_notifier,
+                                     MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC,
+                                     -1);
     }
 }
 
@@ -282,9 +283,9 @@ static int vfio_cpr_pci_notifier(NotifierWithReturn *notifier,
 
 void vfio_cpr_pci_register_device(VFIOPCIDevice *vdev)
 {
-    migration_add_notifier_mode(&vdev->cpr.transfer_notifier,
-                                vfio_cpr_pci_notifier,
-                                MIG_MODE_CPR_TRANSFER);
+    migration_add_notifier_modes(&vdev->cpr.transfer_notifier,
+                                 vfio_cpr_pci_notifier,
+                                 MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC, -1);
 }
 
 void vfio_cpr_pci_unregister_device(VFIOPCIDevice *vdev)

From 27cffe16354816d57710d2d4357f16139405c749 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Wed, 1 Oct 2025 08:34:11 -0700
Subject: [PATCH 0930/2396] migration-test: test cpr-exec

Add a test for the cpr-exec migration mode.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/r/1759332851-370353-20-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/cpr-tests.c | 133 ++++++++++++++++++++++++++++++
 1 file changed, 133 insertions(+)

diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index c4ce60ff66..9388ad64be 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -113,6 +113,138 @@ static void test_mode_transfer_defer(void)
     test_mode_transfer_common(true);
 }
 
+static void set_cpr_exec_args(QTestState *who, MigrateCommon *args)
+{
+    g_autofree char *qtest_from_args = NULL;
+    g_autofree char *from_args = NULL;
+    g_autofree char *to_args = NULL;
+    g_autofree char *exec_args = NULL;
+    g_auto(GStrv) argv = NULL;
+    char *from_str, *src, *dst;
+    int ret;
+
+    /*
+     * hide_stderr appends "2>/dev/null" to the command line, but cpr-exec
+     * passes the command-line words to execv, not to the shell, so suppress it
+     * here.  fd 2 was already bound in the source VM, and execv preserves it.
+     */
+    g_assert(args->start.hide_stderr == false);
+
+    ret = migrate_args(&from_args, &to_args, args->listen_uri, &args->start);
+    g_assert(!ret);
+    qtest_from_args = qtest_qemu_args(from_args);
+
+    /*
+     * The generated args may have been formatted using "%s %s" with empty
+     * strings, which can produce consecutive spaces, which g_strsplit would
+     * convert into empty strings.  Ditto for leading and trailing space.
+     * De-dup spaces to avoid that.
+     */
+
+    from_str = src = dst = g_strstrip(qtest_from_args);
+    do {
+        if (*src != ' ' || src[-1] != ' ') {
+            *dst++ = *src;
+        }
+    } while (*src++);
+
+    exec_args = g_strconcat(qtest_qemu_binary(migration_get_env()->qemu_dst),
+                            " -incoming defer ", from_str, NULL);
+    argv = g_strsplit(exec_args, " ", -1);
+    migrate_set_parameter_strv(who, "cpr-exec-command", argv);
+}
+
+static void wait_for_migration_event(QTestState *who, const char *waitfor)
+{
+    QDict *rsp, *data;
+    char *status;
+    bool done = false;
+
+    while (!done) {
+        rsp = qtest_qmp_eventwait_ref(who, "MIGRATION");
+        g_assert(qdict_haskey(rsp, "data"));
+        data = qdict_get_qdict(rsp, "data");
+        g_assert(qdict_haskey(data, "status"));
+        status = g_strdup(qdict_get_str(data, "status"));
+        g_assert(strcmp(status, "failed"));
+        done = !strcmp(status, waitfor);
+        qobject_unref(rsp);
+    }
+}
+
+static void test_cpr_exec(MigrateCommon *args)
+{
+    QTestState *from, *to;
+    void *data_hook = NULL;
+    g_autofree char *connect_uri = g_strdup(args->connect_uri);
+    g_autofree char *filename = g_strdup_printf("%s/%s", tmpfs,
+                                                FILE_TEST_FILENAME);
+
+    if (migrate_start(&from, NULL, args->listen_uri, &args->start)) {
+        return;
+    }
+
+    /* Source and dest never run concurrently */
+    g_assert_false(args->live);
+
+    if (args->start_hook) {
+        data_hook = args->start_hook(from, NULL);
+    }
+
+    wait_for_serial("src_serial");
+    set_cpr_exec_args(from, args);
+    migrate_set_capability(from, "events", true);
+    migrate_qmp(from, NULL, connect_uri, NULL, "{}");
+    wait_for_migration_event(from, "completed");
+
+    to = qtest_init_after_exec(from);
+
+    qtest_qmp_assert_success(to, "{ 'execute': 'migrate-incoming',"
+                             "  'arguments': { "
+                             "      'channels': [ { 'channel-type': 'main',"
+                             "      'addr': { 'transport': 'file',"
+                             "                'filename': %s,"
+                             "                'offset': 0  } } ] } }",
+                             filename);
+    wait_for_migration_complete(to);
+
+    wait_for_resume(to, get_dst());
+    /* Device on target is still named src_serial because args do not change */
+    wait_for_serial("src_serial");
+
+    if (args->end_hook) {
+        args->end_hook(from, to, data_hook);
+    }
+
+    migrate_end(from, to, args->result == MIG_TEST_SUCCEED);
+}
+
+static void *test_mode_exec_start(QTestState *from, QTestState *to)
+{
+    assert(!to);
+    migrate_set_parameter_str(from, "mode", "cpr-exec");
+    return NULL;
+}
+
+static void test_mode_exec(void)
+{
+    g_autofree char *uri = g_strdup_printf("file:%s/%s", tmpfs,
+                                           FILE_TEST_FILENAME);
+    g_autofree char *listen_uri = g_strdup_printf("defer");
+
+    MigrateCommon args = {
+        .start.only_source = true,
+        .start.opts_source = "-machine aux-ram-share=on -nodefaults",
+        .start.memory_backend = "-object memory-backend-memfd,id=pc.ram,size=%s"
+                                " -machine memory-backend=pc.ram",
+        .connect_uri = uri,
+        .listen_uri = listen_uri,
+        .start_hook = test_mode_exec_start,
+    };
+
+    test_cpr_exec(&args);
+}
+
 void migration_test_add_cpr(MigrationTestEnv *env)
 {
     tmpfs = env->tmpfs;
@@ -135,5 +267,6 @@ void migration_test_add_cpr(MigrationTestEnv *env)
         migration_test_add("/migration/mode/transfer", test_mode_transfer);
         migration_test_add("/migration/mode/transfer/defer",
                            test_mode_transfer_defer);
+        migration_test_add("/migration/mode/exec", test_mode_exec);
     }
 }

From e5fd02d8253abdc25c0eb145765734890c256b71 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:15 +0200
Subject: [PATCH 0931/2396] net: bundle all offloads in a single struct

The set_offload() argument list is already pretty long and
we are going to introduce soon a bunch of additional offloads.

Replace the offload arguments with a single struct and update
all the relevant call-sites.

No functional changes intended.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <a9d4dd043b8c71b791e9ff05e17ef06072d9714e.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/e1000e_core.c |  5 +++--
 hw/net/igb_core.c    |  5 +++--
 hw/net/virtio-net.c  | 19 +++++++++++--------
 hw/net/vmxnet3.c     | 13 +++++--------
 include/net/net.h    | 15 ++++++++++++---
 net/net.c            |  5 ++---
 net/netmap.c         |  3 +--
 net/tap-bsd.c        |  3 +--
 net/tap-linux.c      | 21 ++++++++++++---------
 net/tap-solaris.c    |  4 ++--
 net/tap-stub.c       |  3 +--
 net/tap.c            |  8 ++++----
 net/tap_int.h        |  4 ++--
 13 files changed, 59 insertions(+), 49 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 06657bb3ac..8fef598b49 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -2822,8 +2822,9 @@ e1000e_update_rx_offloads(E1000ECore *core)
     trace_e1000e_rx_set_cso(cso_state);
 
     if (core->has_vnet) {
-        qemu_set_offload(qemu_get_queue(core->owner_nic)->peer,
-                         cso_state, 0, 0, 0, 0, 0, 0);
+        NetOffloads ol = { .csum = cso_state };
+
+        qemu_set_offload(qemu_get_queue(core->owner_nic)->peer, &ol);
     }
 }
 
diff --git a/hw/net/igb_core.c b/hw/net/igb_core.c
index 39e3ce1c8f..45d8fd795b 100644
--- a/hw/net/igb_core.c
+++ b/hw/net/igb_core.c
@@ -3058,8 +3058,9 @@ igb_update_rx_offloads(IGBCore *core)
     trace_e1000e_rx_set_cso(cso_state);
 
     if (core->has_vnet) {
-        qemu_set_offload(qemu_get_queue(core->owner_nic)->peer,
-                         cso_state, 0, 0, 0, 0, 0, 0);
+        NetOffloads ol = {.csum = cso_state };
+
+        qemu_set_offload(qemu_get_queue(core->owner_nic)->peer, &ol);
     }
 }
 
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 7848e26278..129bebd82e 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -773,14 +773,17 @@ static uint64_t virtio_net_bad_features(VirtIODevice *vdev)
 
 static void virtio_net_apply_guest_offloads(VirtIONet *n)
 {
-    qemu_set_offload(qemu_get_queue(n->nic)->peer,
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_CSUM)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_TSO4)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_TSO6)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_ECN)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_UFO)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO4)),
-            !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO6)));
+    NetOffloads ol = {
+       .csum = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_CSUM)),
+       .tso4 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_TSO4)),
+       .tso6 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_TSO6)),
+       .ecn  = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_ECN)),
+       .ufo  = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_UFO)),
+       .uso4 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO4)),
+       .uso6 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO6)),
+    };
+
+    qemu_set_offload(qemu_get_queue(n->nic)->peer, &ol);
 }
 
 static uint64_t virtio_net_guest_offloads_by_features(uint64_t features)
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index af73aa8ef2..03732375a7 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -1322,14 +1322,11 @@ static void vmxnet3_update_features(VMXNET3State *s)
               s->lro_supported, rxcso_supported,
               s->rx_vlan_stripping);
     if (s->peer_has_vhdr) {
-        qemu_set_offload(qemu_get_queue(s->nic)->peer,
-                         rxcso_supported,
-                         s->lro_supported,
-                         s->lro_supported,
-                         0,
-                         0,
-                         0,
-                         0);
+        NetOffloads ol = { .csum = rxcso_supported,
+                           .tso4 = s->lro_supported,
+                           .tso6 = s->lro_supported };
+
+        qemu_set_offload(qemu_get_queue(s->nic)->peer, &ol);
     }
 }
 
diff --git a/include/net/net.h b/include/net/net.h
index 84ee18e0f9..48ba333d02 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -35,6 +35,16 @@ typedef struct NICConf {
     int32_t bootindex;
 } NICConf;
 
+typedef struct NetOffloads {
+    bool csum;
+    bool tso4;
+    bool tso6;
+    bool ecn;
+    bool ufo;
+    bool uso4;
+    bool uso6;
+} NetOffloads;
+
 #define DEFINE_NIC_PROPERTIES(_state, _conf)                            \
     DEFINE_PROP_MACADDR("mac",   _state, _conf.macaddr),                \
     DEFINE_PROP_NETDEV("netdev", _state, _conf.peers)
@@ -57,7 +67,7 @@ typedef bool (HasUfo)(NetClientState *);
 typedef bool (HasUso)(NetClientState *);
 typedef bool (HasVnetHdr)(NetClientState *);
 typedef bool (HasVnetHdrLen)(NetClientState *, int);
-typedef void (SetOffload)(NetClientState *, int, int, int, int, int, int, int);
+typedef void (SetOffload)(NetClientState *, const NetOffloads *);
 typedef int (GetVnetHdrLen)(NetClientState *);
 typedef void (SetVnetHdrLen)(NetClientState *, int);
 typedef bool (GetVnetHashSupportedTypes)(NetClientState *, uint32_t *);
@@ -189,8 +199,7 @@ bool qemu_has_ufo(NetClientState *nc);
 bool qemu_has_uso(NetClientState *nc);
 bool qemu_has_vnet_hdr(NetClientState *nc);
 bool qemu_has_vnet_hdr_len(NetClientState *nc, int len);
-void qemu_set_offload(NetClientState *nc, int csum, int tso4, int tso6,
-                      int ecn, int ufo, int uso4, int uso6);
+void qemu_set_offload(NetClientState *nc, const NetOffloads *ol);
 int qemu_get_vnet_hdr_len(NetClientState *nc);
 void qemu_set_vnet_hdr_len(NetClientState *nc, int len);
 bool qemu_get_vnet_hash_supported_types(NetClientState *nc, uint32_t *types);
diff --git a/net/net.c b/net/net.c
index da275db86e..63872b6855 100644
--- a/net/net.c
+++ b/net/net.c
@@ -540,14 +540,13 @@ bool qemu_has_vnet_hdr_len(NetClientState *nc, int len)
     return nc->info->has_vnet_hdr_len(nc, len);
 }
 
-void qemu_set_offload(NetClientState *nc, int csum, int tso4, int tso6,
-                          int ecn, int ufo, int uso4, int uso6)
+void qemu_set_offload(NetClientState *nc, const NetOffloads *ol)
 {
     if (!nc || !nc->info->set_offload) {
         return;
     }
 
-    nc->info->set_offload(nc, csum, tso4, tso6, ecn, ufo, uso4, uso6);
+    nc->info->set_offload(nc, ol);
 }
 
 int qemu_get_vnet_hdr_len(NetClientState *nc)
diff --git a/net/netmap.c b/net/netmap.c
index 297510e190..6cd8f2bdc5 100644
--- a/net/netmap.c
+++ b/net/netmap.c
@@ -366,8 +366,7 @@ static void netmap_set_vnet_hdr_len(NetClientState *nc, int len)
     }
 }
 
-static void netmap_set_offload(NetClientState *nc, int csum, int tso4, int tso6,
-                               int ecn, int ufo, int uso4, int uso6)
+static void netmap_set_offload(NetClientState *nc, const NetOffloads *ol)
 {
     NetmapState *s = DO_UPCAST(NetmapState, nc, nc);
 
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index 3f98d0ea82..38eb28cb58 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -239,8 +239,7 @@ int tap_fd_set_vnet_be(int fd, int is_be)
     return -EINVAL;
 }
 
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo, int uso4, int uso6)
+void tap_fd_set_offload(int fd, const NetOffloads *ol)
 {
 }
 
diff --git a/net/tap-linux.c b/net/tap-linux.c
index e832810665..79a9dd0da0 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -244,8 +244,7 @@ int tap_fd_set_vnet_be(int fd, int is_be)
     abort();
 }
 
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo, int uso4, int uso6)
+void tap_fd_set_offload(int fd, const NetOffloads *ol)
 {
     unsigned int offload = 0;
 
@@ -254,20 +253,24 @@ void tap_fd_set_offload(int fd, int csum, int tso4,
         return;
     }
 
-    if (csum) {
+    if (ol->csum) {
         offload |= TUN_F_CSUM;
-        if (tso4)
+        if (ol->tso4) {
             offload |= TUN_F_TSO4;
-        if (tso6)
+        }
+        if (ol->tso6) {
             offload |= TUN_F_TSO6;
-        if ((tso4 || tso6) && ecn)
+        }
+        if ((ol->tso4 || ol->tso6) && ol->ecn) {
             offload |= TUN_F_TSO_ECN;
-        if (ufo)
+        }
+        if (ol->ufo) {
             offload |= TUN_F_UFO;
-        if (uso4) {
+        }
+        if (ol->uso4) {
             offload |= TUN_F_USO4;
         }
-        if (uso6) {
+        if (ol->uso6) {
             offload |= TUN_F_USO6;
         }
     }
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index af2ebb16f5..ef8e0feeb0 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -27,6 +27,7 @@
 #include "tap_int.h"
 #include "qemu/ctype.h"
 #include "qemu/cutils.h"
+#include "net/net.h"
 
 #include <sys/ethernet.h>
 #include <sys/sockio.h>
@@ -240,8 +241,7 @@ int tap_fd_set_vnet_be(int fd, int is_be)
     return -EINVAL;
 }
 
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo, int uso4, int uso6)
+void tap_fd_set_offload(int fd, const NetOffloads *ol)
 {
 }
 
diff --git a/net/tap-stub.c b/net/tap-stub.c
index 38673434cb..67d14ad4d5 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -66,8 +66,7 @@ int tap_fd_set_vnet_be(int fd, int is_be)
     return -EINVAL;
 }
 
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo, int uso4, int uso6)
+void tap_fd_set_offload(int fd, const NetOffloads *ol)
 {
 }
 
diff --git a/net/tap.c b/net/tap.c
index f37133e301..df23283744 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -285,15 +285,14 @@ static int tap_set_vnet_be(NetClientState *nc, bool is_be)
     return tap_fd_set_vnet_be(s->fd, is_be);
 }
 
-static void tap_set_offload(NetClientState *nc, int csum, int tso4,
-                     int tso6, int ecn, int ufo, int uso4, int uso6)
+static void tap_set_offload(NetClientState *nc, const NetOffloads *ol)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
     if (s->fd < 0) {
         return;
     }
 
-    tap_fd_set_offload(s->fd, csum, tso4, tso6, ecn, ufo, uso4, uso6);
+    tap_fd_set_offload(s->fd, ol);
 }
 
 static void tap_exit_notify(Notifier *notifier, void *data)
@@ -391,6 +390,7 @@ static TAPState *net_tap_fd_init(NetClientState *peer,
                                  int fd,
                                  int vnet_hdr)
 {
+    NetOffloads ol = {};
     NetClientState *nc;
     TAPState *s;
 
@@ -404,7 +404,7 @@ static TAPState *net_tap_fd_init(NetClientState *peer,
     s->has_ufo = tap_probe_has_ufo(s->fd);
     s->has_uso = tap_probe_has_uso(s->fd);
     s->enabled = true;
-    tap_set_offload(&s->nc, 0, 0, 0, 0, 0, 0, 0);
+    tap_set_offload(&s->nc, &ol);
     /*
      * Make sure host header length is set correctly in tap:
      * it might have been modified by another instance of qemu.
diff --git a/net/tap_int.h b/net/tap_int.h
index 8857ff299d..f8bbe1cb0c 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -27,6 +27,7 @@
 #define NET_TAP_INT_H
 
 #include "qapi/qapi-types-net.h"
+#include "net/net.h"
 
 int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
              int vnet_hdr_required, int mq_required, Error **errp);
@@ -37,8 +38,7 @@ void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp);
 int tap_probe_vnet_hdr(int fd, Error **errp);
 int tap_probe_has_ufo(int fd);
 int tap_probe_has_uso(int fd);
-void tap_fd_set_offload(int fd, int csum, int tso4, int tso6, int ecn, int ufo,
-                        int uso4, int uso6);
+void tap_fd_set_offload(int fd, const NetOffloads *ol);
 void tap_fd_set_vnet_hdr_len(int fd, int len);
 int tap_fd_set_vnet_le(int fd, int vnet_is_le);
 int tap_fd_set_vnet_be(int fd, int vnet_is_be);

From c3d9dcd87f0d228ea3ac5a42076da829cff401f0 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:16 +0200
Subject: [PATCH 0932/2396] linux-headers: deal with counted_by annotation

Such annotation is present into the kernel uAPI headers since
v6.7, and will be used soon by the vhost_type.h. Deal with it
just stripping it.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <a1430f43cc954d2a931fa60581bda6d6af4bc771.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 scripts/update-linux-headers.sh | 1 +
 1 file changed, 1 insertion(+)

diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index 717c379f9e..64c0d7c4eb 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -90,6 +90,7 @@ cp_portable() {
         -e 's/<linux\/\([^>]*\)>/"standard-headers\/linux\/\1"/' \
         -e "$arch_cmd" \
         -e 's/__bitwise//' \
+        -e 's/__counted_by(\w*)//' \
         -e 's/__attribute__((packed))/QEMU_PACKED/' \
         -e 's/__inline__/inline/' \
         -e 's/__BITS_PER_LONG/HOST_LONG_BITS/' \

From 8de6cd5452eb9c58c0d105dbc9718bd0e83cc70f Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:17 +0200
Subject: [PATCH 0933/2396] linux-headers: Update to Linux v6.17-rc1

Update headers to include the virtio GSO over UDP tunnel features

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <0b1f3c011f90583ab52aa4fef04df6db35cc4a69.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/standard-headers/drm/drm_fourcc.h     |  56 ++++++-
 include/standard-headers/linux/ethtool.h      |   4 +-
 .../linux/input-event-codes.h                 |   8 +
 include/standard-headers/linux/input.h        |   1 +
 include/standard-headers/linux/pci_regs.h     |   9 +
 include/standard-headers/linux/vhost_types.h  |   5 +
 include/standard-headers/linux/virtio_net.h   |  33 ++++
 linux-headers/LICENSES/preferred/GPL-2.0      |  10 +-
 linux-headers/asm-arm64/unistd_64.h           |   2 +
 linux-headers/asm-generic/unistd.h            |   8 +-
 linux-headers/asm-loongarch/unistd_64.h       |   2 +
 linux-headers/asm-mips/unistd_n32.h           |   2 +
 linux-headers/asm-mips/unistd_n64.h           |   2 +
 linux-headers/asm-mips/unistd_o32.h           |   2 +
 linux-headers/asm-powerpc/kvm.h               |  13 --
 linux-headers/asm-powerpc/unistd_32.h         |   2 +
 linux-headers/asm-powerpc/unistd_64.h         |   2 +
 linux-headers/asm-riscv/kvm.h                 |   1 +
 linux-headers/asm-riscv/unistd_32.h           |   2 +
 linux-headers/asm-riscv/unistd_64.h           |   2 +
 linux-headers/asm-s390/unistd_32.h            |   2 +
 linux-headers/asm-s390/unistd_64.h            |   2 +
 linux-headers/asm-x86/unistd_32.h             |   2 +
 linux-headers/asm-x86/unistd_64.h             |   2 +
 linux-headers/asm-x86/unistd_x32.h            |   2 +
 linux-headers/linux/iommufd.h                 | 154 +++++++++++++++++-
 linux-headers/linux/kvm.h                     |   2 +
 linux-headers/linux/vfio.h                    |  12 +-
 linux-headers/linux/vhost.h                   |  35 ++++
 29 files changed, 352 insertions(+), 27 deletions(-)

diff --git a/include/standard-headers/drm/drm_fourcc.h b/include/standard-headers/drm/drm_fourcc.h
index c8309d378b..cef077dfb3 100644
--- a/include/standard-headers/drm/drm_fourcc.h
+++ b/include/standard-headers/drm/drm_fourcc.h
@@ -209,6 +209,10 @@ extern "C" {
 #define DRM_FORMAT_RGBA1010102	fourcc_code('R', 'A', '3', '0') /* [31:0] R:G:B:A 10:10:10:2 little endian */
 #define DRM_FORMAT_BGRA1010102	fourcc_code('B', 'A', '3', '0') /* [31:0] B:G:R:A 10:10:10:2 little endian */
 
+/* 48 bpp RGB */
+#define DRM_FORMAT_RGB161616 fourcc_code('R', 'G', '4', '8') /* [47:0] R:G:B 16:16:16 little endian */
+#define DRM_FORMAT_BGR161616 fourcc_code('B', 'G', '4', '8') /* [47:0] B:G:R 16:16:16 little endian */
+
 /* 64 bpp RGB */
 #define DRM_FORMAT_XRGB16161616	fourcc_code('X', 'R', '4', '8') /* [63:0] x:R:G:B 16:16:16:16 little endian */
 #define DRM_FORMAT_XBGR16161616	fourcc_code('X', 'B', '4', '8') /* [63:0] x:B:G:R 16:16:16:16 little endian */
@@ -217,7 +221,7 @@ extern "C" {
 #define DRM_FORMAT_ABGR16161616	fourcc_code('A', 'B', '4', '8') /* [63:0] A:B:G:R 16:16:16:16 little endian */
 
 /*
- * Floating point 64bpp RGB
+ * Half-Floating point - 16b/component
  * IEEE 754-2008 binary16 half-precision float
  * [15:0] sign:exponent:mantissa 1:5:10
  */
@@ -227,6 +231,20 @@ extern "C" {
 #define DRM_FORMAT_ARGB16161616F fourcc_code('A', 'R', '4', 'H') /* [63:0] A:R:G:B 16:16:16:16 little endian */
 #define DRM_FORMAT_ABGR16161616F fourcc_code('A', 'B', '4', 'H') /* [63:0] A:B:G:R 16:16:16:16 little endian */
 
+#define DRM_FORMAT_R16F          fourcc_code('R', ' ', ' ', 'H') /* [15:0] R 16 little endian */
+#define DRM_FORMAT_GR1616F       fourcc_code('G', 'R', ' ', 'H') /* [31:0] G:R 16:16 little endian */
+#define DRM_FORMAT_BGR161616F    fourcc_code('B', 'G', 'R', 'H') /* [47:0] B:G:R 16:16:16 little endian */
+
+/*
+ * Floating point - 32b/component
+ * IEEE 754-2008 binary32 float
+ * [31:0] sign:exponent:mantissa 1:8:23
+ */
+#define DRM_FORMAT_R32F          fourcc_code('R', ' ', ' ', 'F') /* [31:0] R 32 little endian */
+#define DRM_FORMAT_GR3232F       fourcc_code('G', 'R', ' ', 'F') /* [63:0] R:G 32:32 little endian */
+#define DRM_FORMAT_BGR323232F    fourcc_code('B', 'G', 'R', 'F') /* [95:0] R:G:B 32:32:32 little endian */
+#define DRM_FORMAT_ABGR32323232F fourcc_code('A', 'B', '8', 'F') /* [127:0] R:G:B:A 32:32:32:32 little endian */
+
 /*
  * RGBA format with 10-bit components packed in 64-bit per pixel, with 6 bits
  * of unused padding per component:
@@ -376,6 +394,42 @@ extern "C" {
  */
 #define DRM_FORMAT_Q401		fourcc_code('Q', '4', '0', '1')
 
+/*
+ * 3 plane YCbCr LSB aligned
+ * In order to use these formats in a similar fashion to MSB aligned ones
+ * implementation can multiply the values by 2^6=64. For that reason the padding
+ * must only contain zeros.
+ * index 0 = Y plane, [15:0] z:Y [6:10] little endian
+ * index 1 = Cr plane, [15:0] z:Cr [6:10] little endian
+ * index 2 = Cb plane, [15:0] z:Cb [6:10] little endian
+ */
+#define DRM_FORMAT_S010	fourcc_code('S', '0', '1', '0') /* 2x2 subsampled Cb (1) and Cr (2) planes 10 bits per channel */
+#define DRM_FORMAT_S210	fourcc_code('S', '2', '1', '0') /* 2x1 subsampled Cb (1) and Cr (2) planes 10 bits per channel */
+#define DRM_FORMAT_S410	fourcc_code('S', '4', '1', '0') /* non-subsampled Cb (1) and Cr (2) planes 10 bits per channel */
+
+/*
+ * 3 plane YCbCr LSB aligned
+ * In order to use these formats in a similar fashion to MSB aligned ones
+ * implementation can multiply the values by 2^4=16. For that reason the padding
+ * must only contain zeros.
+ * index 0 = Y plane, [15:0] z:Y [4:12] little endian
+ * index 1 = Cr plane, [15:0] z:Cr [4:12] little endian
+ * index 2 = Cb plane, [15:0] z:Cb [4:12] little endian
+ */
+#define DRM_FORMAT_S012	fourcc_code('S', '0', '1', '2') /* 2x2 subsampled Cb (1) and Cr (2) planes 12 bits per channel */
+#define DRM_FORMAT_S212	fourcc_code('S', '2', '1', '2') /* 2x1 subsampled Cb (1) and Cr (2) planes 12 bits per channel */
+#define DRM_FORMAT_S412	fourcc_code('S', '4', '1', '2') /* non-subsampled Cb (1) and Cr (2) planes 12 bits per channel */
+
+/*
+ * 3 plane YCbCr
+ * index 0 = Y plane, [15:0] Y little endian
+ * index 1 = Cr plane, [15:0] Cr little endian
+ * index 2 = Cb plane, [15:0] Cb little endian
+ */
+#define DRM_FORMAT_S016	fourcc_code('S', '0', '1', '6') /* 2x2 subsampled Cb (1) and Cr (2) planes 16 bits per channel */
+#define DRM_FORMAT_S216	fourcc_code('S', '2', '1', '6') /* 2x1 subsampled Cb (1) and Cr (2) planes 16 bits per channel */
+#define DRM_FORMAT_S416	fourcc_code('S', '4', '1', '6') /* non-subsampled Cb (1) and Cr (2) planes 16 bits per channel */
+
 /*
  * 3 plane YCbCr
  * index 0: Y plane, [7:0] Y
diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index cef0d207a6..eb80314028 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -2314,7 +2314,7 @@ enum {
 	IPV6_USER_FLOW	= 0x0e, /* spec only (usr_ip6_spec; nfc only) */
 	IPV4_FLOW	= 0x10, /* hash only */
 	IPV6_FLOW	= 0x11, /* hash only */
-	ETHER_FLOW	= 0x12, /* spec only (ether_spec) */
+	ETHER_FLOW	= 0x12, /* hash or spec (ether_spec) */
 
 	/* Used for GTP-U IPv4 and IPv6.
 	 * The format of GTP packets only includes
@@ -2371,7 +2371,7 @@ enum {
 /* Flag to enable RSS spreading of traffic matching rule (nfc only) */
 #define	FLOW_RSS	0x20000000
 
-/* L3-L4 network traffic flow hash options */
+/* L2-L4 network traffic flow hash options */
 #define	RXH_L2DA	(1 << 1)
 #define	RXH_VLAN	(1 << 2)
 #define	RXH_L3_PROTO	(1 << 3)
diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
index a82ff795e0..00dc9caac9 100644
--- a/include/standard-headers/linux/input-event-codes.h
+++ b/include/standard-headers/linux/input-event-codes.h
@@ -601,6 +601,11 @@
 #define BTN_DPAD_LEFT		0x222
 #define BTN_DPAD_RIGHT		0x223
 
+#define BTN_GRIPL		0x224
+#define BTN_GRIPR		0x225
+#define BTN_GRIPL2		0x226
+#define BTN_GRIPR2		0x227
+
 #define KEY_ALS_TOGGLE		0x230	/* Ambient light sensor */
 #define KEY_ROTATE_LOCK_TOGGLE	0x231	/* Display rotation lock */
 #define KEY_REFRESH_RATE_TOGGLE	0x232	/* Display refresh rate toggle */
@@ -765,6 +770,9 @@
 #define KEY_KBD_LCD_MENU4		0x2bb
 #define KEY_KBD_LCD_MENU5		0x2bc
 
+/* Performance Boost key (Alienware)/G-Mode key (Dell) */
+#define KEY_PERFORMANCE			0x2bd
+
 #define BTN_TRIGGER_HAPPY		0x2c0
 #define BTN_TRIGGER_HAPPY1		0x2c0
 #define BTN_TRIGGER_HAPPY2		0x2c1
diff --git a/include/standard-headers/linux/input.h b/include/standard-headers/linux/input.h
index 942ea6aaa9..d4512c20b5 100644
--- a/include/standard-headers/linux/input.h
+++ b/include/standard-headers/linux/input.h
@@ -272,6 +272,7 @@ struct input_mask {
 #define BUS_CEC			0x1E
 #define BUS_INTEL_ISHTP		0x1F
 #define BUS_AMD_SFH		0x20
+#define BUS_SDW			0x21
 
 /*
  * MT_TOOL types
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index a3a3e942de..f5b17745de 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -745,6 +745,7 @@
 #define PCI_EXT_CAP_ID_L1SS	0x1E	/* L1 PM Substates */
 #define PCI_EXT_CAP_ID_PTM	0x1F	/* Precision Time Measurement */
 #define PCI_EXT_CAP_ID_DVSEC	0x23	/* Designated Vendor-Specific */
+#define PCI_EXT_CAP_ID_VF_REBAR 0x24	/* VF Resizable BAR */
 #define PCI_EXT_CAP_ID_DLF	0x25	/* Data Link Feature */
 #define PCI_EXT_CAP_ID_PL_16GT	0x26	/* Physical Layer 16.0 GT/s */
 #define PCI_EXT_CAP_ID_NPEM	0x29	/* Native PCIe Enclosure Management */
@@ -1141,6 +1142,14 @@
 #define PCI_DVSEC_HEADER2		0x8 /* Designated Vendor-Specific Header2 */
 #define  PCI_DVSEC_HEADER2_ID(x)		((x) & 0xffff)
 
+/* VF Resizable BARs, same layout as PCI_REBAR */
+#define PCI_VF_REBAR_CAP	PCI_REBAR_CAP
+#define  PCI_VF_REBAR_CAP_SIZES		PCI_REBAR_CAP_SIZES
+#define PCI_VF_REBAR_CTRL	PCI_REBAR_CTRL
+#define  PCI_VF_REBAR_CTRL_BAR_IDX	PCI_REBAR_CTRL_BAR_IDX
+#define  PCI_VF_REBAR_CTRL_NBAR_MASK	PCI_REBAR_CTRL_NBAR_MASK
+#define  PCI_VF_REBAR_CTRL_BAR_SIZE	PCI_REBAR_CTRL_BAR_SIZE
+
 /* Data Link Feature */
 #define PCI_DLF_CAP		0x04	/* Capabilities Register */
 #define  PCI_DLF_EXCHANGE_ENABLE	0x80000000  /* Data Link Feature Exchange Enable */
diff --git a/include/standard-headers/linux/vhost_types.h b/include/standard-headers/linux/vhost_types.h
index fd54044936..79b53a931a 100644
--- a/include/standard-headers/linux/vhost_types.h
+++ b/include/standard-headers/linux/vhost_types.h
@@ -110,6 +110,11 @@ struct vhost_msg_v2 {
 	};
 };
 
+struct vhost_features_array {
+	uint64_t count; /* number of entries present in features array */
+	uint64_t features[] ;
+};
+
 struct vhost_memory_region {
 	uint64_t guest_phys_addr;
 	uint64_t memory_size; /* bytes */
diff --git a/include/standard-headers/linux/virtio_net.h b/include/standard-headers/linux/virtio_net.h
index 982e854f14..93abaae0b9 100644
--- a/include/standard-headers/linux/virtio_net.h
+++ b/include/standard-headers/linux/virtio_net.h
@@ -70,6 +70,28 @@
 					 * with the same MAC.
 					 */
 #define VIRTIO_NET_F_SPEED_DUPLEX 63	/* Device set linkspeed and duplex */
+#define VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO 65 /* Driver can receive
+					      * GSO-over-UDP-tunnel packets
+					      */
+#define VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM 66 /* Driver handles
+						   * GSO-over-UDP-tunnel
+						   * packets with partial csum
+						   * for the outer header
+						   */
+#define VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO 67 /* Device can receive
+					     * GSO-over-UDP-tunnel packets
+					     */
+#define VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM 68 /* Device handles
+						  * GSO-over-UDP-tunnel
+						  * packets with partial csum
+						  * for the outer header
+						  */
+
+/* Offloads bits corresponding to VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO{,_CSUM}
+ * features
+ */
+#define VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_MAPPED	46
+#define VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM_MAPPED	47
 
 #ifndef VIRTIO_NET_NO_LEGACY
 #define VIRTIO_NET_F_GSO	6	/* Host handles pkts w/ any GSO type */
@@ -131,12 +153,17 @@ struct virtio_net_hdr_v1 {
 #define VIRTIO_NET_HDR_F_NEEDS_CSUM	1	/* Use csum_start, csum_offset */
 #define VIRTIO_NET_HDR_F_DATA_VALID	2	/* Csum is valid */
 #define VIRTIO_NET_HDR_F_RSC_INFO	4	/* rsc info in csum_ fields */
+#define VIRTIO_NET_HDR_F_UDP_TUNNEL_CSUM 8	/* UDP tunnel csum offload */
 	uint8_t flags;
 #define VIRTIO_NET_HDR_GSO_NONE		0	/* Not a GSO frame */
 #define VIRTIO_NET_HDR_GSO_TCPV4	1	/* GSO frame, IPv4 TCP (TSO) */
 #define VIRTIO_NET_HDR_GSO_UDP		3	/* GSO frame, IPv4 UDP (UFO) */
 #define VIRTIO_NET_HDR_GSO_TCPV6	4	/* GSO frame, IPv6 TCP */
 #define VIRTIO_NET_HDR_GSO_UDP_L4	5	/* GSO frame, IPv4& IPv6 UDP (USO) */
+#define VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4 0x20 /* UDPv4 tunnel present */
+#define VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6 0x40 /* UDPv6 tunnel present */
+#define VIRTIO_NET_HDR_GSO_UDP_TUNNEL (VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV4 | \
+				       VIRTIO_NET_HDR_GSO_UDP_TUNNEL_IPV6)
 #define VIRTIO_NET_HDR_GSO_ECN		0x80	/* TCP has ECN set */
 	uint8_t gso_type;
 	__virtio16 hdr_len;	/* Ethernet + IP + tcp/udp hdrs */
@@ -181,6 +208,12 @@ struct virtio_net_hdr_v1_hash {
 	uint16_t padding;
 };
 
+struct virtio_net_hdr_v1_hash_tunnel {
+	struct virtio_net_hdr_v1_hash hash_hdr;
+	uint16_t outer_th_offset;
+	uint16_t inner_nh_offset;
+};
+
 #ifndef VIRTIO_NET_NO_LEGACY
 /* This header comes first in the scatter-gather list.
  * For legacy virtio, if VIRTIO_F_ANY_LAYOUT is not negotiated, it must
diff --git a/linux-headers/LICENSES/preferred/GPL-2.0 b/linux-headers/LICENSES/preferred/GPL-2.0
index ff0812fd89..ea8e93dc44 100644
--- a/linux-headers/LICENSES/preferred/GPL-2.0
+++ b/linux-headers/LICENSES/preferred/GPL-2.0
@@ -20,8 +20,8 @@ License-Text:
 		    GNU GENERAL PUBLIC LICENSE
 		       Version 2, June 1991
 
- Copyright (C) 1989, 1991 Free Software Foundation, Inc.
-                       51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ <https://fsf.org/>
  Everyone is permitted to copy and distribute verbatim copies
  of this license document, but changing it is not allowed.
 
@@ -322,10 +322,8 @@ the "copyright" line and a pointer to where the full notice is found.
     MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
     GNU General Public License for more details.
 
-    You should have received a copy of the GNU General Public License
-    along with this program; if not, write to the Free Software
-    Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
-
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, see <https://www.gnu.org/licenses/>.
 
 Also add information on how to contact you by electronic and paper mail.
 
diff --git a/linux-headers/asm-arm64/unistd_64.h b/linux-headers/asm-arm64/unistd_64.h
index ee9aaebdf3..4ae25c2b91 100644
--- a/linux-headers/asm-arm64/unistd_64.h
+++ b/linux-headers/asm-arm64/unistd_64.h
@@ -324,6 +324,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-generic/unistd.h b/linux-headers/asm-generic/unistd.h
index 2892a45023..04e0077fb4 100644
--- a/linux-headers/asm-generic/unistd.h
+++ b/linux-headers/asm-generic/unistd.h
@@ -852,8 +852,14 @@ __SYSCALL(__NR_removexattrat, sys_removexattrat)
 #define __NR_open_tree_attr 467
 __SYSCALL(__NR_open_tree_attr, sys_open_tree_attr)
 
+/* fs/inode.c */
+#define __NR_file_getattr 468
+__SYSCALL(__NR_file_getattr, sys_file_getattr)
+#define __NR_file_setattr 469
+__SYSCALL(__NR_file_setattr, sys_file_setattr)
+
 #undef __NR_syscalls
-#define __NR_syscalls 468
+#define __NR_syscalls 470
 
 /*
  * 32 bit systems traditionally used different
diff --git a/linux-headers/asm-loongarch/unistd_64.h b/linux-headers/asm-loongarch/unistd_64.h
index 50d22df8f7..5033fc8f2f 100644
--- a/linux-headers/asm-loongarch/unistd_64.h
+++ b/linux-headers/asm-loongarch/unistd_64.h
@@ -320,6 +320,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-mips/unistd_n32.h b/linux-headers/asm-mips/unistd_n32.h
index bdcc2f460b..c99c10e5bf 100644
--- a/linux-headers/asm-mips/unistd_n32.h
+++ b/linux-headers/asm-mips/unistd_n32.h
@@ -396,5 +396,7 @@
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
 #define __NR_open_tree_attr (__NR_Linux + 467)
+#define __NR_file_getattr (__NR_Linux + 468)
+#define __NR_file_setattr (__NR_Linux + 469)
 
 #endif /* _ASM_UNISTD_N32_H */
diff --git a/linux-headers/asm-mips/unistd_n64.h b/linux-headers/asm-mips/unistd_n64.h
index 3b6b0193b6..0d975bb185 100644
--- a/linux-headers/asm-mips/unistd_n64.h
+++ b/linux-headers/asm-mips/unistd_n64.h
@@ -372,5 +372,7 @@
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
 #define __NR_open_tree_attr (__NR_Linux + 467)
+#define __NR_file_getattr (__NR_Linux + 468)
+#define __NR_file_setattr (__NR_Linux + 469)
 
 #endif /* _ASM_UNISTD_N64_H */
diff --git a/linux-headers/asm-mips/unistd_o32.h b/linux-headers/asm-mips/unistd_o32.h
index 4609a4b4d3..86ac0ac84b 100644
--- a/linux-headers/asm-mips/unistd_o32.h
+++ b/linux-headers/asm-mips/unistd_o32.h
@@ -442,5 +442,7 @@
 #define __NR_listxattrat (__NR_Linux + 465)
 #define __NR_removexattrat (__NR_Linux + 466)
 #define __NR_open_tree_attr (__NR_Linux + 467)
+#define __NR_file_getattr (__NR_Linux + 468)
+#define __NR_file_setattr (__NR_Linux + 469)
 
 #endif /* _ASM_UNISTD_O32_H */
diff --git a/linux-headers/asm-powerpc/kvm.h b/linux-headers/asm-powerpc/kvm.h
index eaeda00178..077c5437f5 100644
--- a/linux-headers/asm-powerpc/kvm.h
+++ b/linux-headers/asm-powerpc/kvm.h
@@ -1,18 +1,5 @@
 /* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
 /*
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License, version 2, as
- * published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
- *
  * Copyright IBM Corp. 2007
  *
  * Authors: Hollis Blanchard <hollisb@us.ibm.com>
diff --git a/linux-headers/asm-powerpc/unistd_32.h b/linux-headers/asm-powerpc/unistd_32.h
index 5d38a427e0..d7a32c5e06 100644
--- a/linux-headers/asm-powerpc/unistd_32.h
+++ b/linux-headers/asm-powerpc/unistd_32.h
@@ -449,6 +449,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-powerpc/unistd_64.h b/linux-headers/asm-powerpc/unistd_64.h
index 860a488e4d..ff35c51fc6 100644
--- a/linux-headers/asm-powerpc/unistd_64.h
+++ b/linux-headers/asm-powerpc/unistd_64.h
@@ -421,6 +421,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index 5f59fd226c..ef27d4289d 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -18,6 +18,7 @@
 #define __KVM_HAVE_IRQ_LINE
 
 #define KVM_COALESCED_MMIO_PAGE_OFFSET 1
+#define KVM_DIRTY_LOG_PAGE_OFFSET 64
 
 #define KVM_INTERRUPT_SET	-1U
 #define KVM_INTERRUPT_UNSET	-2U
diff --git a/linux-headers/asm-riscv/unistd_32.h b/linux-headers/asm-riscv/unistd_32.h
index a5e769f1d9..6083373e88 100644
--- a/linux-headers/asm-riscv/unistd_32.h
+++ b/linux-headers/asm-riscv/unistd_32.h
@@ -315,6 +315,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-riscv/unistd_64.h b/linux-headers/asm-riscv/unistd_64.h
index 8df4d64841..f0c7585c60 100644
--- a/linux-headers/asm-riscv/unistd_64.h
+++ b/linux-headers/asm-riscv/unistd_64.h
@@ -325,6 +325,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-s390/unistd_32.h b/linux-headers/asm-s390/unistd_32.h
index 85eedbd18e..37b8f6f358 100644
--- a/linux-headers/asm-s390/unistd_32.h
+++ b/linux-headers/asm-s390/unistd_32.h
@@ -440,5 +440,7 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 #endif /* _ASM_S390_UNISTD_32_H */
diff --git a/linux-headers/asm-s390/unistd_64.h b/linux-headers/asm-s390/unistd_64.h
index c03b1b9701..0652ba6331 100644
--- a/linux-headers/asm-s390/unistd_64.h
+++ b/linux-headers/asm-s390/unistd_64.h
@@ -388,5 +388,7 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 #endif /* _ASM_S390_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_32.h b/linux-headers/asm-x86/unistd_32.h
index 491d6b4eb6..8f784a5634 100644
--- a/linux-headers/asm-x86/unistd_32.h
+++ b/linux-headers/asm-x86/unistd_32.h
@@ -458,6 +458,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_32_H */
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index 7cf88bf9bd..2f55bebb81 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -381,6 +381,8 @@
 #define __NR_listxattrat 465
 #define __NR_removexattrat 466
 #define __NR_open_tree_attr 467
+#define __NR_file_getattr 468
+#define __NR_file_setattr 469
 
 
 #endif /* _ASM_UNISTD_64_H */
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index 82959111e6..8cc8673f15 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -334,6 +334,8 @@
 #define __NR_listxattrat (__X32_SYSCALL_BIT + 465)
 #define __NR_removexattrat (__X32_SYSCALL_BIT + 466)
 #define __NR_open_tree_attr (__X32_SYSCALL_BIT + 467)
+#define __NR_file_getattr (__X32_SYSCALL_BIT + 468)
+#define __NR_file_setattr (__X32_SYSCALL_BIT + 469)
 #define __NR_rt_sigaction (__X32_SYSCALL_BIT + 512)
 #define __NR_rt_sigreturn (__X32_SYSCALL_BIT + 513)
 #define __NR_ioctl (__X32_SYSCALL_BIT + 514)
diff --git a/linux-headers/linux/iommufd.h b/linux-headers/linux/iommufd.h
index cb0f7d6b4d..2105a03955 100644
--- a/linux-headers/linux/iommufd.h
+++ b/linux-headers/linux/iommufd.h
@@ -56,6 +56,7 @@ enum {
 	IOMMUFD_CMD_VDEVICE_ALLOC = 0x91,
 	IOMMUFD_CMD_IOAS_CHANGE_PROCESS = 0x92,
 	IOMMUFD_CMD_VEVENTQ_ALLOC = 0x93,
+	IOMMUFD_CMD_HW_QUEUE_ALLOC = 0x94,
 };
 
 /**
@@ -590,17 +591,44 @@ struct iommu_hw_info_arm_smmuv3 {
 	__u32 aidr;
 };
 
+/**
+ * struct iommu_hw_info_tegra241_cmdqv - NVIDIA Tegra241 CMDQV Hardware
+ *         Information (IOMMU_HW_INFO_TYPE_TEGRA241_CMDQV)
+ *
+ * @flags: Must be 0
+ * @version: Version number for the CMDQ-V HW for PARAM bits[03:00]
+ * @log2vcmdqs: Log2 of the total number of VCMDQs for PARAM bits[07:04]
+ * @log2vsids: Log2 of the total number of SID replacements for PARAM bits[15:12]
+ * @__reserved: Must be 0
+ *
+ * VMM can use these fields directly in its emulated global PARAM register. Note
+ * that only one Virtual Interface (VINTF) should be exposed to a VM, i.e. PARAM
+ * bits[11:08] should be set to 0 for log2 of the total number of VINTFs.
+ */
+struct iommu_hw_info_tegra241_cmdqv {
+	__u32 flags;
+	__u8 version;
+	__u8 log2vcmdqs;
+	__u8 log2vsids;
+	__u8 __reserved;
+};
+
 /**
  * enum iommu_hw_info_type - IOMMU Hardware Info Types
- * @IOMMU_HW_INFO_TYPE_NONE: Used by the drivers that do not report hardware
+ * @IOMMU_HW_INFO_TYPE_NONE: Output by the drivers that do not report hardware
  *                           info
+ * @IOMMU_HW_INFO_TYPE_DEFAULT: Input to request for a default type
  * @IOMMU_HW_INFO_TYPE_INTEL_VTD: Intel VT-d iommu info type
  * @IOMMU_HW_INFO_TYPE_ARM_SMMUV3: ARM SMMUv3 iommu info type
+ * @IOMMU_HW_INFO_TYPE_TEGRA241_CMDQV: NVIDIA Tegra241 CMDQV (extension for ARM
+ *                                     SMMUv3) info type
  */
 enum iommu_hw_info_type {
 	IOMMU_HW_INFO_TYPE_NONE = 0,
+	IOMMU_HW_INFO_TYPE_DEFAULT = 0,
 	IOMMU_HW_INFO_TYPE_INTEL_VTD = 1,
 	IOMMU_HW_INFO_TYPE_ARM_SMMUV3 = 2,
+	IOMMU_HW_INFO_TYPE_TEGRA241_CMDQV = 3,
 };
 
 /**
@@ -625,6 +653,15 @@ enum iommufd_hw_capabilities {
 	IOMMU_HW_CAP_PCI_PASID_PRIV = 1 << 2,
 };
 
+/**
+ * enum iommufd_hw_info_flags - Flags for iommu_hw_info
+ * @IOMMU_HW_INFO_FLAG_INPUT_TYPE: If set, @in_data_type carries an input type
+ *                                 for user space to request for a specific info
+ */
+enum iommufd_hw_info_flags {
+	IOMMU_HW_INFO_FLAG_INPUT_TYPE = 1 << 0,
+};
+
 /**
  * struct iommu_hw_info - ioctl(IOMMU_GET_HW_INFO)
  * @size: sizeof(struct iommu_hw_info)
@@ -634,6 +671,12 @@ enum iommufd_hw_capabilities {
  *            data that kernel supports
  * @data_uptr: User pointer to a user-space buffer used by the kernel to fill
  *             the iommu type specific hardware information data
+ * @in_data_type: This shares the same field with @out_data_type, making it be
+ *                a bidirectional field. When IOMMU_HW_INFO_FLAG_INPUT_TYPE is
+ *                set, an input type carried via this @in_data_type field will
+ *                be valid, requesting for the info data to the given type. If
+ *                IOMMU_HW_INFO_FLAG_INPUT_TYPE is unset, any input value will
+ *                be seen as IOMMU_HW_INFO_TYPE_DEFAULT
  * @out_data_type: Output the iommu hardware info type as defined in the enum
  *                 iommu_hw_info_type.
  * @out_capabilities: Output the generic iommu capability info type as defined
@@ -663,7 +706,10 @@ struct iommu_hw_info {
 	__u32 dev_id;
 	__u32 data_len;
 	__aligned_u64 data_uptr;
-	__u32 out_data_type;
+	union {
+		__u32 in_data_type;
+		__u32 out_data_type;
+	};
 	__u8 out_max_pasid_log2;
 	__u8 __reserved[3];
 	__aligned_u64 out_capabilities;
@@ -951,10 +997,29 @@ struct iommu_fault_alloc {
  * enum iommu_viommu_type - Virtual IOMMU Type
  * @IOMMU_VIOMMU_TYPE_DEFAULT: Reserved for future use
  * @IOMMU_VIOMMU_TYPE_ARM_SMMUV3: ARM SMMUv3 driver specific type
+ * @IOMMU_VIOMMU_TYPE_TEGRA241_CMDQV: NVIDIA Tegra241 CMDQV (extension for ARM
+ *                                    SMMUv3) enabled ARM SMMUv3 type
  */
 enum iommu_viommu_type {
 	IOMMU_VIOMMU_TYPE_DEFAULT = 0,
 	IOMMU_VIOMMU_TYPE_ARM_SMMUV3 = 1,
+	IOMMU_VIOMMU_TYPE_TEGRA241_CMDQV = 2,
+};
+
+/**
+ * struct iommu_viommu_tegra241_cmdqv - NVIDIA Tegra241 CMDQV Virtual Interface
+ *                                      (IOMMU_VIOMMU_TYPE_TEGRA241_CMDQV)
+ * @out_vintf_mmap_offset: mmap offset argument for VINTF's page0
+ * @out_vintf_mmap_length: mmap length argument for VINTF's page0
+ *
+ * Both @out_vintf_mmap_offset and @out_vintf_mmap_length are reported by kernel
+ * for user space to mmap the VINTF page0 from the host physical address space
+ * to the guest physical address space so that a guest kernel can directly R/W
+ * access to the VINTF page0 in order to control its virtual command queues.
+ */
+struct iommu_viommu_tegra241_cmdqv {
+	__aligned_u64 out_vintf_mmap_offset;
+	__aligned_u64 out_vintf_mmap_length;
 };
 
 /**
@@ -965,6 +1030,9 @@ enum iommu_viommu_type {
  * @dev_id: The device's physical IOMMU will be used to back the virtual IOMMU
  * @hwpt_id: ID of a nesting parent HWPT to associate to
  * @out_viommu_id: Output virtual IOMMU ID for the allocated object
+ * @data_len: Length of the type specific data
+ * @__reserved: Must be 0
+ * @data_uptr: User pointer to a driver-specific virtual IOMMU data
  *
  * Allocate a virtual IOMMU object, representing the underlying physical IOMMU's
  * virtualization support that is a security-isolated slice of the real IOMMU HW
@@ -985,6 +1053,9 @@ struct iommu_viommu_alloc {
 	__u32 dev_id;
 	__u32 hwpt_id;
 	__u32 out_viommu_id;
+	__u32 data_len;
+	__u32 __reserved;
+	__aligned_u64 data_uptr;
 };
 #define IOMMU_VIOMMU_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VIOMMU_ALLOC)
 
@@ -995,10 +1066,15 @@ struct iommu_viommu_alloc {
  * @dev_id: The physical device to allocate a virtual instance on the vIOMMU
  * @out_vdevice_id: Object handle for the vDevice. Pass to IOMMU_DESTORY
  * @virt_id: Virtual device ID per vIOMMU, e.g. vSID of ARM SMMUv3, vDeviceID
- *           of AMD IOMMU, and vRID of a nested Intel VT-d to a Context Table
+ *           of AMD IOMMU, and vRID of Intel VT-d
  *
  * Allocate a virtual device instance (for a physical device) against a vIOMMU.
  * This instance holds the device's information (related to its vIOMMU) in a VM.
+ * User should use IOMMU_DESTROY to destroy the virtual device before
+ * destroying the physical device (by closing vfio_cdev fd). Otherwise the
+ * virtual device would be forcibly destroyed on physical device destruction,
+ * its vdevice_id would be permanently leaked (unremovable & unreusable) until
+ * iommu fd closed.
  */
 struct iommu_vdevice_alloc {
 	__u32 size;
@@ -1075,10 +1151,12 @@ struct iommufd_vevent_header {
  * enum iommu_veventq_type - Virtual Event Queue Type
  * @IOMMU_VEVENTQ_TYPE_DEFAULT: Reserved for future use
  * @IOMMU_VEVENTQ_TYPE_ARM_SMMUV3: ARM SMMUv3 Virtual Event Queue
+ * @IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV: NVIDIA Tegra241 CMDQV Extension IRQ
  */
 enum iommu_veventq_type {
 	IOMMU_VEVENTQ_TYPE_DEFAULT = 0,
 	IOMMU_VEVENTQ_TYPE_ARM_SMMUV3 = 1,
+	IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV = 2,
 };
 
 /**
@@ -1102,6 +1180,19 @@ struct iommu_vevent_arm_smmuv3 {
 	__aligned_le64 evt[4];
 };
 
+/**
+ * struct iommu_vevent_tegra241_cmdqv - Tegra241 CMDQV IRQ
+ *                                      (IOMMU_VEVENTQ_TYPE_TEGRA241_CMDQV)
+ * @lvcmdq_err_map: 128-bit logical vcmdq error map, little-endian.
+ *                  (Refer to register LVCMDQ_ERR_MAPs per VINTF )
+ *
+ * The 128-bit register value from HW exclusively reflect the error bits for a
+ * Virtual Interface represented by a vIOMMU object. Read and report directly.
+ */
+struct iommu_vevent_tegra241_cmdqv {
+	__aligned_le64 lvcmdq_err_map[2];
+};
+
 /**
  * struct iommu_veventq_alloc - ioctl(IOMMU_VEVENTQ_ALLOC)
  * @size: sizeof(struct iommu_veventq_alloc)
@@ -1141,4 +1232,61 @@ struct iommu_veventq_alloc {
 	__u32 __reserved;
 };
 #define IOMMU_VEVENTQ_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_VEVENTQ_ALLOC)
+
+/**
+ * enum iommu_hw_queue_type - HW Queue Type
+ * @IOMMU_HW_QUEUE_TYPE_DEFAULT: Reserved for future use
+ * @IOMMU_HW_QUEUE_TYPE_TEGRA241_CMDQV: NVIDIA Tegra241 CMDQV (extension for ARM
+ *                                      SMMUv3) Virtual Command Queue (VCMDQ)
+ */
+enum iommu_hw_queue_type {
+	IOMMU_HW_QUEUE_TYPE_DEFAULT = 0,
+	/*
+	 * TEGRA241_CMDQV requirements (otherwise, allocation will fail)
+	 * - alloc starts from the lowest @index=0 in ascending order
+	 * - destroy starts from the last allocated @index in descending order
+	 * - @base_addr must be aligned to @length in bytes and mapped in IOAS
+	 * - @length must be a power of 2, with a minimum 32 bytes and a maximum
+	 *   2 ^ idr[1].CMDQS * 16 bytes (use GET_HW_INFO call to read idr[1]
+	 *   from struct iommu_hw_info_arm_smmuv3)
+	 * - suggest to back the queue memory with contiguous physical pages or
+	 *   a single huge page with alignment of the queue size, and limit the
+	 *   emulated vSMMU's IDR1.CMDQS to log2(huge page size / 16 bytes)
+	 */
+	IOMMU_HW_QUEUE_TYPE_TEGRA241_CMDQV = 1,
+};
+
+/**
+ * struct iommu_hw_queue_alloc - ioctl(IOMMU_HW_QUEUE_ALLOC)
+ * @size: sizeof(struct iommu_hw_queue_alloc)
+ * @flags: Must be 0
+ * @viommu_id: Virtual IOMMU ID to associate the HW queue with
+ * @type: One of enum iommu_hw_queue_type
+ * @index: The logical index to the HW queue per virtual IOMMU for a multi-queue
+ *         model
+ * @out_hw_queue_id: The ID of the new HW queue
+ * @nesting_parent_iova: Base address of the queue memory in the guest physical
+ *                       address space
+ * @length: Length of the queue memory
+ *
+ * Allocate a HW queue object for a vIOMMU-specific HW-accelerated queue, which
+ * allows HW to access a guest queue memory described using @nesting_parent_iova
+ * and @length.
+ *
+ * A vIOMMU can allocate multiple queues, but it must use a different @index per
+ * type to separate each allocation, e.g::
+ *
+ *     Type1 HW queue0, Type1 HW queue1, Type2 HW queue0, ...
+ */
+struct iommu_hw_queue_alloc {
+	__u32 size;
+	__u32 flags;
+	__u32 viommu_id;
+	__u32 type;
+	__u32 index;
+	__u32 out_hw_queue_id;
+	__aligned_u64 nesting_parent_iova;
+	__aligned_u64 length;
+};
+#define IOMMU_HW_QUEUE_ALLOC _IO(IOMMUFD_TYPE, IOMMUFD_CMD_HW_QUEUE_ALLOC)
 #endif
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index 32c5885a3c..be704965d8 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -636,6 +636,7 @@ struct kvm_ioeventfd {
 #define KVM_X86_DISABLE_EXITS_HLT            (1 << 1)
 #define KVM_X86_DISABLE_EXITS_PAUSE          (1 << 2)
 #define KVM_X86_DISABLE_EXITS_CSTATE         (1 << 3)
+#define KVM_X86_DISABLE_EXITS_APERFMPERF     (1 << 4)
 
 /* for KVM_ENABLE_CAP */
 struct kvm_enable_cap {
@@ -952,6 +953,7 @@ struct kvm_enable_cap {
 #define KVM_CAP_ARM_EL2 240
 #define KVM_CAP_ARM_EL2_E2H0 241
 #define KVM_CAP_RISCV_MP_STATE_RESET 242
+#define KVM_CAP_ARM_CACHEABLE_PFNMAP_SUPPORTED 243
 
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
diff --git a/linux-headers/linux/vfio.h b/linux-headers/linux/vfio.h
index 79bf8c0cc5..4d96d1fc12 100644
--- a/linux-headers/linux/vfio.h
+++ b/linux-headers/linux/vfio.h
@@ -905,10 +905,12 @@ struct vfio_device_feature {
  * VFIO_DEVICE_BIND_IOMMUFD - _IOR(VFIO_TYPE, VFIO_BASE + 18,
  *				   struct vfio_device_bind_iommufd)
  * @argsz:	 User filled size of this data.
- * @flags:	 Must be 0.
+ * @flags:	 Must be 0 or a bit flags of VFIO_DEVICE_BIND_*
  * @iommufd:	 iommufd to bind.
  * @out_devid:	 The device id generated by this bind. devid is a handle for
  *		 this device/iommufd bond and can be used in IOMMUFD commands.
+ * @token_uuid_ptr: Valid if VFIO_DEVICE_BIND_FLAG_TOKEN. Points to a 16 byte
+ *                  UUID in the same format as VFIO_DEVICE_FEATURE_PCI_VF_TOKEN.
  *
  * Bind a vfio_device to the specified iommufd.
  *
@@ -917,13 +919,21 @@ struct vfio_device_feature {
  *
  * Unbind is automatically conducted when device fd is closed.
  *
+ * A token is sometimes required to open the device, unless this is known to be
+ * needed VFIO_DEVICE_BIND_FLAG_TOKEN should not be set and token_uuid_ptr is
+ * ignored. The only case today is a PF/VF relationship where the VF bind must
+ * be provided the same token as VFIO_DEVICE_FEATURE_PCI_VF_TOKEN provided to
+ * the PF.
+ *
  * Return: 0 on success, -errno on failure.
  */
 struct vfio_device_bind_iommufd {
 	__u32		argsz;
 	__u32		flags;
+#define VFIO_DEVICE_BIND_FLAG_TOKEN (1 << 0)
 	__s32		iommufd;
 	__u32		out_devid;
+	__aligned_u64	token_uuid_ptr;
 };
 
 #define VFIO_DEVICE_BIND_IOMMUFD	_IO(VFIO_TYPE, VFIO_BASE + 18)
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index d4b3e2ae13..283348b64a 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -235,4 +235,39 @@
  */
 #define VHOST_VDPA_GET_VRING_SIZE	_IOWR(VHOST_VIRTIO, 0x82,	\
 					      struct vhost_vring_state)
+
+/* Extended features manipulation */
+#define VHOST_GET_FEATURES_ARRAY _IOR(VHOST_VIRTIO, 0x83, \
+				       struct vhost_features_array)
+#define VHOST_SET_FEATURES_ARRAY _IOW(VHOST_VIRTIO, 0x83, \
+				       struct vhost_features_array)
+
+/* fork_owner values for vhost */
+#define VHOST_FORK_OWNER_KTHREAD 0
+#define VHOST_FORK_OWNER_TASK 1
+
+/**
+ * VHOST_SET_FORK_FROM_OWNER - Set the fork_owner flag for the vhost device,
+ * This ioctl must called before VHOST_SET_OWNER.
+ * Only available when CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
+ *
+ * @param fork_owner: An 8-bit value that determines the vhost thread mode
+ *
+ * When fork_owner is set to VHOST_FORK_OWNER_TASK(default value):
+ *   - Vhost will create vhost worker as tasks forked from the owner,
+ *     inheriting all of the owner's attributes.
+ *
+ * When fork_owner is set to VHOST_FORK_OWNER_KTHREAD:
+ *   - Vhost will create vhost workers as kernel threads.
+ */
+#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x83, __u8)
+
+/**
+ * VHOST_GET_FORK_OWNER - Get the current fork_owner flag for the vhost device.
+ * Only available when CONFIG_VHOST_ENABLE_FORK_OWNER_CONTROL=y
+ *
+ * @return: An 8-bit value indicating the current thread mode.
+ */
+#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x84, __u8)
+
 #endif

From b15a61fdae976eb1ca8f2deee6a63dc3407d7ec6 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:18 +0200
Subject: [PATCH 0934/2396] virtio: introduce extended features type

The virtio specifications allows for up to 128 bits for the
device features. Soon we are going to use some of the 'extended'
bits features (bit 64 and above) for the virtio net driver.

Represent the virtio features bitmask with a fixed size array, and
introduce a few helpers to help manipulate them.

Most drivers will keep using only 64 bits features space: use union
to allow them access the lower part of the extended space without any
per driver change.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <6a9bbb5eb33830f20afbcb7e64d300af4126dd98.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 include/hw/virtio/virtio-features.h | 126 ++++++++++++++++++++++++++++
 include/hw/virtio/virtio.h          |   7 +-
 2 files changed, 130 insertions(+), 3 deletions(-)
 create mode 100644 include/hw/virtio/virtio-features.h

diff --git a/include/hw/virtio/virtio-features.h b/include/hw/virtio/virtio-features.h
new file mode 100644
index 0000000000..e29b7fe48f
--- /dev/null
+++ b/include/hw/virtio/virtio-features.h
@@ -0,0 +1,126 @@
+/*
+ * Virtio features helpers
+ *
+ * Copyright 2025 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef QEMU_VIRTIO_FEATURES_H
+#define QEMU_VIRTIO_FEATURES_H
+
+#include "qemu/bitops.h"
+
+#define VIRTIO_FEATURES_FMT        "%016"PRIx64"%016"PRIx64
+#define VIRTIO_FEATURES_PR(f)      (f)[1], (f)[0]
+
+#define VIRTIO_FEATURES_MAX        128
+#define VIRTIO_FEATURES_BIT(b)     BIT_ULL((b) % 64)
+#define VIRTIO_FEATURES_U64(b)     ((b) / 64)
+#define VIRTIO_FEATURES_NU32S      (VIRTIO_FEATURES_MAX / 32)
+#define VIRTIO_FEATURES_NU64S      (VIRTIO_FEATURES_MAX / 64)
+
+#define VIRTIO_DECLARE_FEATURES(name)                        \
+    union {                                                  \
+        uint64_t name;                                       \
+        uint64_t name##_ex[VIRTIO_FEATURES_NU64S];           \
+    }
+
+#define VIRTIO_DEFINE_PROP_FEATURE(_name, _state, _field, _bit, _defval)   \
+    DEFINE_PROP_BIT64(_name, _state, _field[VIRTIO_FEATURES_U64(_bit)],    \
+                      (_bit) % 64, _defval)
+
+static inline void virtio_features_clear(uint64_t *features)
+{
+    memset(features, 0, sizeof(features[0]) * VIRTIO_FEATURES_NU64S);
+}
+
+static inline void virtio_features_from_u64(uint64_t *features, uint64_t from)
+{
+    virtio_features_clear(features);
+    features[0] = from;
+}
+
+static inline bool virtio_has_feature_ex(const uint64_t *features,
+                                         unsigned int fbit)
+{
+    assert(fbit < VIRTIO_FEATURES_MAX);
+    return features[VIRTIO_FEATURES_U64(fbit)] & VIRTIO_FEATURES_BIT(fbit);
+}
+
+static inline void virtio_add_feature_ex(uint64_t *features,
+                                         unsigned int fbit)
+{
+    assert(fbit < VIRTIO_FEATURES_MAX);
+    features[VIRTIO_FEATURES_U64(fbit)] |= VIRTIO_FEATURES_BIT(fbit);
+}
+
+static inline void virtio_clear_feature_ex(uint64_t *features,
+                                           unsigned int fbit)
+{
+    assert(fbit < VIRTIO_FEATURES_MAX);
+    features[VIRTIO_FEATURES_U64(fbit)] &= ~VIRTIO_FEATURES_BIT(fbit);
+}
+
+static inline bool virtio_features_equal(const uint64_t *f1,
+                                         const uint64_t *f2)
+{
+    return !memcmp(f1, f2, sizeof(uint64_t) * VIRTIO_FEATURES_NU64S);
+}
+
+static inline bool virtio_features_use_ex(const uint64_t *features)
+{
+    int i;
+
+    for (i = 1; i < VIRTIO_FEATURES_NU64S; ++i) {
+        if (features[i]) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static inline bool virtio_features_empty(const uint64_t *features)
+{
+    return !virtio_features_use_ex(features) && !features[0];
+}
+
+static inline void virtio_features_copy(uint64_t *to, const uint64_t *from)
+{
+    memcpy(to, from, sizeof(to[0]) * VIRTIO_FEATURES_NU64S);
+}
+
+static inline bool virtio_features_andnot(uint64_t *to, const uint64_t *f1,
+                                           const uint64_t *f2)
+{
+    uint64_t diff = 0;
+    int i;
+
+    for (i = 0; i < VIRTIO_FEATURES_NU64S; i++) {
+        to[i] = f1[i] & ~f2[i];
+        diff |= to[i];
+    }
+    return diff;
+}
+
+static inline void virtio_features_and(uint64_t *to, const uint64_t *f1,
+                                       const uint64_t *f2)
+{
+    int i;
+
+    for (i = 0; i < VIRTIO_FEATURES_NU64S; i++) {
+        to[i] = f1[i] & f2[i];
+    }
+}
+
+static inline void virtio_features_or(uint64_t *to, const uint64_t *f1,
+                                       const uint64_t *f2)
+{
+    int i;
+
+    for (i = 0; i < VIRTIO_FEATURES_NU64S; i++) {
+        to[i] = f1[i] | f2[i];
+    }
+}
+
+#endif
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index c594764f23..39e4059a66 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -16,6 +16,7 @@
 
 #include "system/memory.h"
 #include "hw/qdev-core.h"
+#include "hw/virtio/virtio-features.h"
 #include "net/net.h"
 #include "migration/vmstate.h"
 #include "qemu/event_notifier.h"
@@ -121,9 +122,9 @@ struct VirtIODevice
      * backend (e.g. vhost) and could potentially be a subset of the
      * total feature set offered by QEMU.
      */
-    uint64_t host_features;
-    uint64_t guest_features;
-    uint64_t backend_features;
+    VIRTIO_DECLARE_FEATURES(host_features);
+    VIRTIO_DECLARE_FEATURES(guest_features);
+    VIRTIO_DECLARE_FEATURES(backend_features);
 
     size_t config_len;
     void *config;

From 0a49a97433279512a03f3d9f36164a46caf498c6 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:19 +0200
Subject: [PATCH 0935/2396] virtio: serialize extended features state

If the driver uses any of the extended features (i.e. 64 or above),
store the extended features range (64-127 bits).

At load time, let legacy features initialize the full features range
and pass it to the set helper; sub-states loading will have filled-up
the extended part as needed.

This is one of the few spots that need explicitly to know and set
in stone the extended features array size; add a build bug to prevent
breaking the migration should such size change again in the future:
more serialization plumbing will be needed.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <d5d9d398675bee6c4c7d7308c5d3d5d3c6d17d87.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 88 ++++++++++++++++++++++++++++++----------------
 1 file changed, 57 insertions(+), 31 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 9a81ad912e..bf53c211e5 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2964,6 +2964,30 @@ static const VMStateDescription vmstate_virtio_disabled = {
     }
 };
 
+static bool virtio_128bit_features_needed(void *opaque)
+{
+    VirtIODevice *vdev = opaque;
+
+    return virtio_features_use_ex(vdev->host_features_ex);
+}
+
+static const VMStateDescription vmstate_virtio_128bit_features = {
+    .name = "virtio/128bit_features",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = &virtio_128bit_features_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64(guest_features_ex[1], VirtIODevice),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+/*
+ * Avoid silently breaking migration should the feature space increase
+ * even more in the (far away) future
+ */
+QEMU_BUILD_BUG_ON(VIRTIO_FEATURES_NU64S != 2);
+
 static const VMStateDescription vmstate_virtio = {
     .name = "virtio",
     .version_id = 1,
@@ -2973,6 +2997,7 @@ static const VMStateDescription vmstate_virtio = {
     },
     .subsections = (const VMStateDescription * const []) {
         &vmstate_virtio_device_endian,
+        &vmstate_virtio_128bit_features,
         &vmstate_virtio_64bit_features,
         &vmstate_virtio_virtqueues,
         &vmstate_virtio_ringsize,
@@ -3069,23 +3094,28 @@ const VMStateInfo  virtio_vmstate_info = {
     .put = virtio_device_put,
 };
 
-static int virtio_set_features_nocheck(VirtIODevice *vdev, uint64_t val)
+static int virtio_set_features_nocheck(VirtIODevice *vdev, const uint64_t *val)
 {
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
-    bool bad = (val & ~(vdev->host_features)) != 0;
+    uint64_t tmp[VIRTIO_FEATURES_NU64S];
+    bool bad;
+
+    bad = virtio_features_andnot(tmp, val, vdev->host_features_ex);
+    virtio_features_and(tmp, val, vdev->host_features_ex);
 
-    val &= vdev->host_features;
     if (k->set_features) {
-        k->set_features(vdev, val);
+        bad = bad || virtio_features_use_ex(tmp);
+        k->set_features(vdev, tmp[0]);
     }
-    vdev->guest_features = val;
+
+    virtio_features_copy(vdev->guest_features_ex, tmp);
     return bad ? -1 : 0;
 }
 
 typedef struct VirtioSetFeaturesNocheckData {
     Coroutine *co;
     VirtIODevice *vdev;
-    uint64_t val;
+    uint64_t val[VIRTIO_FEATURES_NU64S];
     int ret;
 } VirtioSetFeaturesNocheckData;
 
@@ -3098,14 +3128,15 @@ static void virtio_set_features_nocheck_bh(void *opaque)
 }
 
 static int coroutine_mixed_fn
-virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev, uint64_t val)
+virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev,
+                                     const uint64_t *val)
 {
     if (qemu_in_coroutine()) {
         VirtioSetFeaturesNocheckData data = {
             .co = qemu_coroutine_self(),
             .vdev = vdev,
-            .val = val,
         };
+        virtio_features_copy(data.val, val);
         aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
                                 virtio_set_features_nocheck_bh, &data);
         qemu_coroutine_yield();
@@ -3117,6 +3148,7 @@ virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev, uint64_t val)
 
 int virtio_set_features(VirtIODevice *vdev, uint64_t val)
 {
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     int ret;
     /*
      * The driver must not attempt to set features after feature negotiation
@@ -3132,7 +3164,8 @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
                       __func__, vdev->name);
     }
 
-    ret = virtio_set_features_nocheck(vdev, val);
+    virtio_features_from_u64(features, val);
+    ret = virtio_set_features_nocheck(vdev, features);
     if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
         /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches.  */
         int i;
@@ -3155,6 +3188,7 @@ void virtio_reset(void *opaque)
 {
     VirtIODevice *vdev = opaque;
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     int i;
 
     virtio_set_status(vdev, 0);
@@ -3181,7 +3215,8 @@ void virtio_reset(void *opaque)
     vdev->start_on_kick = false;
     vdev->started = false;
     vdev->broken = false;
-    virtio_set_features_nocheck(vdev, 0);
+    virtio_features_clear(features);
+    virtio_set_features_nocheck(vdev, features);
     vdev->queue_sel = 0;
     vdev->status = 0;
     vdev->disabled = false;
@@ -3264,7 +3299,7 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
      * Note: devices should always test host features in future - don't create
      * new dependencies like this.
      */
-    vdev->guest_features = features;
+    virtio_features_from_u64(vdev->guest_features_ex, features);
 
     config_len = qemu_get_be32(f);
 
@@ -3343,26 +3378,17 @@ virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
         vdev->device_endian = virtio_default_endian();
     }
 
-    if (virtio_64bit_features_needed(vdev)) {
-        /*
-         * Subsection load filled vdev->guest_features.  Run them
-         * through virtio_set_features to sanity-check them against
-         * host_features.
-         */
-        uint64_t features64 = vdev->guest_features;
-        if (virtio_set_features_nocheck_maybe_co(vdev, features64) < 0) {
-            error_report("Features 0x%" PRIx64 " unsupported. "
-                         "Allowed features: 0x%" PRIx64,
-                         features64, vdev->host_features);
-            return -1;
-        }
-    } else {
-        if (virtio_set_features_nocheck_maybe_co(vdev, features) < 0) {
-            error_report("Features 0x%x unsupported. "
-                         "Allowed features: 0x%" PRIx64,
-                         features, vdev->host_features);
-            return -1;
-        }
+    /*
+     * guest_features_ex is fully initialized with u32 features and upper
+     * bits have been filled as needed by the later load.
+     */
+    if (virtio_set_features_nocheck_maybe_co(vdev,
+                                             vdev->guest_features_ex) < 0) {
+        error_report("Features 0x" VIRTIO_FEATURES_FMT " unsupported. "
+                     "Allowed features: 0x" VIRTIO_FEATURES_FMT,
+                     VIRTIO_FEATURES_PR(vdev->guest_features_ex),
+                     VIRTIO_FEATURES_PR(vdev->host_features_ex));
+        return -1;
     }
 
     if (!virtio_device_started(vdev, vdev->status) &&

From 64a6a336f42bc6305ab7589fd874cb4a3d403bd0 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:20 +0200
Subject: [PATCH 0936/2396] virtio: add support for negotiating extended
 features

The virtio specifications allows for a device features space up
to 128 bits and more. Soon we are going to use some of the 'extended'
bits features for the virtio net driver.

Add support to allow extended features negotiation on a per
devices basis. Devices willing to negotiated extended features
need to implemented a new pair of features getter/setter, the
core will conditionally use them instead of the basic one.

Note that 'bad_features' don't need to be extended, as they are
bound to the 64 bits limit.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <9bb29d70adc3f2b8c7756d4e3cd076cffee87826.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-bus.c     | 11 ++++++++---
 hw/virtio/virtio.c         | 14 +++++++++++---
 include/hw/virtio/virtio.h |  4 ++++
 3 files changed, 23 insertions(+), 6 deletions(-)

diff --git a/hw/virtio/virtio-bus.c b/hw/virtio/virtio-bus.c
index 11adfbf3ab..cef944e015 100644
--- a/hw/virtio/virtio-bus.c
+++ b/hw/virtio/virtio-bus.c
@@ -62,9 +62,14 @@ void virtio_bus_device_plugged(VirtIODevice *vdev, Error **errp)
     }
 
     /* Get the features of the plugged device. */
-    assert(vdc->get_features != NULL);
-    vdev->host_features = vdc->get_features(vdev, vdev->host_features,
-                                            &local_err);
+    if (vdc->get_features_ex) {
+        vdc->get_features_ex(vdev, vdev->host_features_ex, &local_err);
+    } else {
+        assert(vdc->get_features != NULL);
+        virtio_features_from_u64(vdev->host_features_ex,
+                                 vdc->get_features(vdev, vdev->host_features,
+                                                   &local_err));
+    }
     if (local_err) {
         error_propagate(errp, local_err);
         return;
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index bf53c211e5..34f977a3c9 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3103,7 +3103,9 @@ static int virtio_set_features_nocheck(VirtIODevice *vdev, const uint64_t *val)
     bad = virtio_features_andnot(tmp, val, vdev->host_features_ex);
     virtio_features_and(tmp, val, vdev->host_features_ex);
 
-    if (k->set_features) {
+    if (k->set_features_ex) {
+        k->set_features_ex(vdev, val);
+    } else if (k->set_features) {
         bad = bad || virtio_features_use_ex(tmp);
         k->set_features(vdev, tmp[0]);
     }
@@ -3149,6 +3151,13 @@ virtio_set_features_nocheck_maybe_co(VirtIODevice *vdev,
 int virtio_set_features(VirtIODevice *vdev, uint64_t val)
 {
     uint64_t features[VIRTIO_FEATURES_NU64S];
+
+    virtio_features_from_u64(features, val);
+    return virtio_set_features_ex(vdev, features);
+}
+
+int virtio_set_features_ex(VirtIODevice *vdev, const uint64_t *features)
+{
     int ret;
     /*
      * The driver must not attempt to set features after feature negotiation
@@ -3158,13 +3167,12 @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
         return -EINVAL;
     }
 
-    if (val & (1ull << VIRTIO_F_BAD_FEATURE)) {
+    if (features[0] & (1ull << VIRTIO_F_BAD_FEATURE)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: guest driver for %s has enabled UNUSED(30) feature bit!\n",
                       __func__, vdev->name);
     }
 
-    virtio_features_from_u64(features, val);
     ret = virtio_set_features_nocheck(vdev, features);
     if (virtio_vdev_has_feature(vdev, VIRTIO_RING_F_EVENT_IDX)) {
         /* VIRTIO_RING_F_EVENT_IDX changes the size of the caches.  */
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 39e4059a66..2aeb021fb3 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -178,6 +178,9 @@ struct VirtioDeviceClass {
     /* This is what a VirtioDevice must implement */
     DeviceRealize realize;
     DeviceUnrealize unrealize;
+    void (*get_features_ex)(VirtIODevice *vdev, uint64_t *requested_features,
+                            Error **errp);
+    void (*set_features_ex)(VirtIODevice *vdev, const uint64_t *val);
     uint64_t (*get_features)(VirtIODevice *vdev,
                              uint64_t requested_features,
                              Error **errp);
@@ -373,6 +376,7 @@ void virtio_queue_reset(VirtIODevice *vdev, uint32_t queue_index);
 void virtio_queue_enable(VirtIODevice *vdev, uint32_t queue_index);
 void virtio_update_irq(VirtIODevice *vdev);
 int virtio_set_features(VirtIODevice *vdev, uint64_t val);
+int virtio_set_features_ex(VirtIODevice *vdev, const uint64_t *val);
 
 /* Base devices.  */
 typedef struct VirtIOBlkConf VirtIOBlkConf;

From 712c79d6d374e7abe94599de5ba2d155d5a79955 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:21 +0200
Subject: [PATCH 0937/2396] virtio-pci: implement support for extended features

Extend the features configuration space to 128 bits. If the virtio
device supports any extended features, allow the common read/write
operation to access all of it, otherwise keep exposing only the
lower 64 bits.

On migration, save the 128 bit version of the features only if the
upper bits are non zero. Relay on reset to clear all the feature
space before load.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <c0b81601f65b41ca8310eba8f05e2dcf3702de89.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-pci.c         | 76 ++++++++++++++++++++++++++++++----
 include/hw/virtio/virtio-pci.h |  2 +-
 2 files changed, 68 insertions(+), 10 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 767216d795..01e4fecaf4 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -109,6 +109,29 @@ static const VMStateDescription vmstate_virtio_pci_modern_queue_state = {
     }
 };
 
+static bool virtio_pci_modern_state_features128_needed(void *opaque)
+{
+    VirtIOPCIProxy *proxy = opaque;
+    uint32_t features = 0;
+    int i;
+
+    for (i = 2; i < ARRAY_SIZE(proxy->guest_features); ++i) {
+        features |= proxy->guest_features[i];
+    }
+    return features;
+}
+
+static const VMStateDescription vmstate_virtio_pci_modern_state_features128 = {
+    .name = "virtio_pci/modern_state/features128",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = &virtio_pci_modern_state_features128_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32_SUB_ARRAY(guest_features, VirtIOPCIProxy, 2, 2),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool virtio_pci_modern_state_needed(void *opaque)
 {
     VirtIOPCIProxy *proxy = opaque;
@@ -116,6 +139,12 @@ static bool virtio_pci_modern_state_needed(void *opaque)
     return virtio_pci_modern(proxy);
 }
 
+/*
+ * Avoid silently breaking migration should the feature space increase
+ * even more in the (far away) future
+ */
+QEMU_BUILD_BUG_ON(VIRTIO_FEATURES_NU32S != 4);
+
 static const VMStateDescription vmstate_virtio_pci_modern_state_sub = {
     .name = "virtio_pci/modern_state",
     .version_id = 1,
@@ -124,11 +153,15 @@ static const VMStateDescription vmstate_virtio_pci_modern_state_sub = {
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(dfselect, VirtIOPCIProxy),
         VMSTATE_UINT32(gfselect, VirtIOPCIProxy),
-        VMSTATE_UINT32_ARRAY(guest_features, VirtIOPCIProxy, 2),
+        VMSTATE_UINT32_SUB_ARRAY(guest_features, VirtIOPCIProxy, 0, 2),
         VMSTATE_STRUCT_ARRAY(vqs, VirtIOPCIProxy, VIRTIO_QUEUE_MAX, 0,
                              vmstate_virtio_pci_modern_queue_state,
                              VirtIOPCIQueue),
         VMSTATE_END_OF_LIST()
+    },
+    .subsections = (const VMStateDescription * const []) {
+        &vmstate_virtio_pci_modern_state_features128,
+        NULL
     }
 };
 
@@ -1477,6 +1510,19 @@ int virtio_pci_add_shm_cap(VirtIOPCIProxy *proxy,
     return virtio_pci_add_mem_cap(proxy, &cap.cap);
 }
 
+static int virtio_pci_select_max(const VirtIODevice *vdev)
+{
+    int i;
+
+    for (i = VIRTIO_FEATURES_NU64S - 1; i > 0; i--) {
+        if (vdev->host_features_ex[i]) {
+            return (i + 1) * 2;
+        }
+    }
+
+    return 2;
+}
+
 static uint64_t virtio_pci_common_read(void *opaque, hwaddr addr,
                                        unsigned size)
 {
@@ -1494,18 +1540,21 @@ static uint64_t virtio_pci_common_read(void *opaque, hwaddr addr,
         val = proxy->dfselect;
         break;
     case VIRTIO_PCI_COMMON_DF:
-        if (proxy->dfselect <= 1) {
+        if (proxy->dfselect < virtio_pci_select_max(vdev)) {
             VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
 
-            val = (vdev->host_features & ~vdc->legacy_features) >>
-                (32 * proxy->dfselect);
+            val = vdev->host_features_ex[proxy->dfselect >> 1] >>
+                  (32 * (proxy->dfselect & 1));
+            if (proxy->dfselect <= 1) {
+                val &= (~vdc->legacy_features) >> (32 * proxy->dfselect);
+            }
         }
         break;
     case VIRTIO_PCI_COMMON_GFSELECT:
         val = proxy->gfselect;
         break;
     case VIRTIO_PCI_COMMON_GF:
-        if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) {
+        if (proxy->gfselect < virtio_pci_select_max(vdev)) {
             val = proxy->guest_features[proxy->gfselect];
         }
         break;
@@ -1588,11 +1637,18 @@ static void virtio_pci_common_write(void *opaque, hwaddr addr,
         proxy->gfselect = val;
         break;
     case VIRTIO_PCI_COMMON_GF:
-        if (proxy->gfselect < ARRAY_SIZE(proxy->guest_features)) {
+        if (proxy->gfselect < virtio_pci_select_max(vdev)) {
+            uint64_t features[VIRTIO_FEATURES_NU64S];
+            int i;
+
             proxy->guest_features[proxy->gfselect] = val;
-            virtio_set_features(vdev,
-                                (((uint64_t)proxy->guest_features[1]) << 32) |
-                                proxy->guest_features[0]);
+            virtio_features_clear(features);
+            for (i = 0; i < ARRAY_SIZE(proxy->guest_features); ++i) {
+                uint64_t cur = proxy->guest_features[i];
+
+                features[i >> 1] |= cur << ((i & 1) * 32);
+            }
+            virtio_set_features_ex(vdev, features);
         }
         break;
     case VIRTIO_PCI_COMMON_MSIX:
@@ -2311,6 +2367,8 @@ static void virtio_pci_reset(DeviceState *qdev)
     virtio_bus_reset(bus);
     msix_unuse_all_vectors(&proxy->pci_dev);
 
+    memset(proxy->guest_features, 0, sizeof(proxy->guest_features));
+
     for (i = 0; i < VIRTIO_QUEUE_MAX; i++) {
         proxy->vqs[i].enabled = 0;
         proxy->vqs[i].reset = 0;
diff --git a/include/hw/virtio/virtio-pci.h b/include/hw/virtio/virtio-pci.h
index eab5394898..639752977e 100644
--- a/include/hw/virtio/virtio-pci.h
+++ b/include/hw/virtio/virtio-pci.h
@@ -158,7 +158,7 @@ struct VirtIOPCIProxy {
     uint32_t nvectors;
     uint32_t dfselect;
     uint32_t gfselect;
-    uint32_t guest_features[2];
+    uint32_t guest_features[VIRTIO_FEATURES_NU32S];
     VirtIOPCIQueue vqs[VIRTIO_QUEUE_MAX];
 
     VirtIOIRQFD *vector_irqfd;

From 9f979ef0e01a2dd47d167c482a9e2d1dcdff2d3f Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:22 +0200
Subject: [PATCH 0938/2396] vhost: add support for negotiating extended
 features

Similar to virtio infra, vhost core maintains the features status
in the full extended format and allows the devices to implement
extended version of the getter/setter.

Note that 'protocol_features' are not extended: they are only
used by vhost-user, and the latter device is not going to implement
extended features soon.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <a0062c3b1847fb2baedd6cd8f6ef13b051d6beb2.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c                 | 68 ++++++++++++++++++++++---------
 include/hw/virtio/vhost-backend.h |  6 +++
 include/hw/virtio/vhost.h         | 56 +++++++++++++++++++++----
 3 files changed, 103 insertions(+), 27 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 6557c58d12..5f485ad6cb 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -972,20 +972,34 @@ static int vhost_virtqueue_set_addr(struct vhost_dev *dev,
 static int vhost_dev_set_features(struct vhost_dev *dev,
                                   bool enable_log)
 {
-    uint64_t features = dev->acked_features;
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     int r;
+
+    virtio_features_copy(features, dev->acked_features_ex);
     if (enable_log) {
-        features |= 0x1ULL << VHOST_F_LOG_ALL;
+        virtio_add_feature_ex(features, VHOST_F_LOG_ALL);
     }
     if (!vhost_dev_has_iommu(dev)) {
-        features &= ~(0x1ULL << VIRTIO_F_IOMMU_PLATFORM);
+        virtio_clear_feature_ex(features, VIRTIO_F_IOMMU_PLATFORM);
     }
     if (dev->vhost_ops->vhost_force_iommu) {
         if (dev->vhost_ops->vhost_force_iommu(dev) == true) {
-            features |= 0x1ULL << VIRTIO_F_IOMMU_PLATFORM;
+            virtio_add_feature_ex(features, VIRTIO_F_IOMMU_PLATFORM);
        }
     }
-    r = dev->vhost_ops->vhost_set_features(dev, features);
+
+    if (virtio_features_use_ex(features) &&
+        !dev->vhost_ops->vhost_set_features_ex) {
+        r = -EINVAL;
+        VHOST_OPS_DEBUG(r, "extended features without device support");
+        goto out;
+    }
+
+    if (dev->vhost_ops->vhost_set_features_ex) {
+        r = dev->vhost_ops->vhost_set_features_ex(dev, features);
+    } else {
+        r = dev->vhost_ops->vhost_set_features(dev, features[0]);
+    }
     if (r < 0) {
         VHOST_OPS_DEBUG(r, "vhost_set_features failed");
         goto out;
@@ -1508,12 +1522,27 @@ static void vhost_virtqueue_cleanup(struct vhost_virtqueue *vq)
     }
 }
 
+static int vhost_dev_get_features(struct vhost_dev *hdev,
+                                  uint64_t *features)
+{
+    uint64_t features64;
+    int r;
+
+    if (hdev->vhost_ops->vhost_get_features_ex) {
+        return hdev->vhost_ops->vhost_get_features_ex(hdev, features);
+    }
+
+    r = hdev->vhost_ops->vhost_get_features(hdev, &features64);
+    virtio_features_from_u64(features, features64);
+    return r;
+}
+
 int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
                    VhostBackendType backend_type, uint32_t busyloop_timeout,
                    Error **errp)
 {
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     unsigned int used, reserved, limit;
-    uint64_t features;
     int i, r, n_initialized_vqs = 0;
 
     hdev->vdev = NULL;
@@ -1533,7 +1562,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
         goto fail;
     }
 
-    r = hdev->vhost_ops->vhost_get_features(hdev, &features);
+    r = vhost_dev_get_features(hdev, features);
     if (r < 0) {
         error_setg_errno(errp, -r, "vhost_get_features failed");
         goto fail;
@@ -1571,7 +1600,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
         }
     }
 
-    hdev->features = features;
+    virtio_features_copy(hdev->features_ex, features);
 
     hdev->memory_listener = (MemoryListener) {
         .name = "vhost",
@@ -1594,7 +1623,7 @@ int vhost_dev_init(struct vhost_dev *hdev, void *opaque,
     };
 
     if (hdev->migration_blocker == NULL) {
-        if (!(hdev->features & (0x1ULL << VHOST_F_LOG_ALL))) {
+        if (!virtio_has_feature_ex(hdev->features_ex, VHOST_F_LOG_ALL)) {
             error_setg(&hdev->migration_blocker,
                        "Migration disabled: vhost lacks VHOST_F_LOG_ALL feature.");
         } else if (vhost_dev_log_is_shared(hdev) && !qemu_memfd_alloc_check()) {
@@ -1859,28 +1888,27 @@ static void vhost_start_config_intr(struct vhost_dev *dev)
     }
 }
 
-uint64_t vhost_get_features(struct vhost_dev *hdev, const int *feature_bits,
-                            uint64_t features)
+void vhost_get_features_ex(struct vhost_dev *hdev,
+                           const int *feature_bits,
+                           uint64_t *features)
 {
     const int *bit = feature_bits;
+
     while (*bit != VHOST_INVALID_FEATURE_BIT) {
-        uint64_t bit_mask = (1ULL << *bit);
-        if (!(hdev->features & bit_mask)) {
-            features &= ~bit_mask;
+        if (!virtio_has_feature_ex(hdev->features_ex, *bit)) {
+            virtio_clear_feature_ex(features, *bit);
         }
         bit++;
     }
-    return features;
 }
 
-void vhost_ack_features(struct vhost_dev *hdev, const int *feature_bits,
-                        uint64_t features)
+void vhost_ack_features_ex(struct vhost_dev *hdev, const int *feature_bits,
+                           const uint64_t *features)
 {
     const int *bit = feature_bits;
     while (*bit != VHOST_INVALID_FEATURE_BIT) {
-        uint64_t bit_mask = (1ULL << *bit);
-        if (features & bit_mask) {
-            hdev->acked_features |= bit_mask;
+        if (virtio_has_feature_ex(features, *bit)) {
+            virtio_add_feature_ex(hdev->acked_features_ex, *bit);
         }
         bit++;
     }
diff --git a/include/hw/virtio/vhost-backend.h b/include/hw/virtio/vhost-backend.h
index d6df209a2f..ff94fa1734 100644
--- a/include/hw/virtio/vhost-backend.h
+++ b/include/hw/virtio/vhost-backend.h
@@ -95,6 +95,10 @@ typedef int (*vhost_new_worker_op)(struct vhost_dev *dev,
                                    struct vhost_worker_state *worker);
 typedef int (*vhost_free_worker_op)(struct vhost_dev *dev,
                                     struct vhost_worker_state *worker);
+typedef int (*vhost_set_features_ex_op)(struct vhost_dev *dev,
+                                        const uint64_t *features);
+typedef int (*vhost_get_features_ex_op)(struct vhost_dev *dev,
+                                        uint64_t *features);
 typedef int (*vhost_set_features_op)(struct vhost_dev *dev,
                                      uint64_t features);
 typedef int (*vhost_get_features_op)(struct vhost_dev *dev,
@@ -186,6 +190,8 @@ typedef struct VhostOps {
     vhost_free_worker_op vhost_free_worker;
     vhost_get_vring_worker_op vhost_get_vring_worker;
     vhost_attach_vring_worker_op vhost_attach_vring_worker;
+    vhost_set_features_ex_op vhost_set_features_ex;
+    vhost_get_features_ex_op vhost_get_features_ex;
     vhost_set_features_op vhost_set_features;
     vhost_get_features_op vhost_get_features;
     vhost_set_backend_cap_op vhost_set_backend_cap;
diff --git a/include/hw/virtio/vhost.h b/include/hw/virtio/vhost.h
index 66be6afc88..08bbb4dfe9 100644
--- a/include/hw/virtio/vhost.h
+++ b/include/hw/virtio/vhost.h
@@ -107,9 +107,9 @@ struct vhost_dev {
      * future use should be discouraged and the variable retired as
      * its easy to confuse with the VirtIO backend_features.
      */
-    uint64_t features;
-    uint64_t acked_features;
-    uint64_t backend_features;
+    VIRTIO_DECLARE_FEATURES(features);
+    VIRTIO_DECLARE_FEATURES(acked_features);
+    VIRTIO_DECLARE_FEATURES(backend_features);
 
     /**
      * @protocol_features: is the vhost-user only feature set by
@@ -320,6 +320,20 @@ bool vhost_virtqueue_pending(struct vhost_dev *hdev, int n);
 void vhost_virtqueue_mask(struct vhost_dev *hdev, VirtIODevice *vdev, int n,
                           bool mask);
 
+/**
+ * vhost_get_features_ex() - sanitize the extended features set
+ * @hdev: common vhost_dev structure
+ * @feature_bits: pointer to terminated table of feature bits
+ * @features: original features set, filtered out on return
+ *
+ * This is the extended variant of vhost_get_features(), supporting the
+ * the extended features set. Filter it with the intersection of what is
+ * supported by the vhost backend (hdev->features) and the supported
+ * feature_bits.
+ */
+void vhost_get_features_ex(struct vhost_dev *hdev,
+                           const int *feature_bits,
+                           uint64_t *features);
 /**
  * vhost_get_features() - return a sanitised set of feature bits
  * @hdev: common vhost_dev structure
@@ -330,8 +344,28 @@ void vhost_virtqueue_mask(struct vhost_dev *hdev, VirtIODevice *vdev, int n,
  * is supported by the vhost backend (hdev->features), the supported
  * feature_bits and the requested feature set.
  */
-uint64_t vhost_get_features(struct vhost_dev *hdev, const int *feature_bits,
-                            uint64_t features);
+static inline uint64_t vhost_get_features(struct vhost_dev *hdev,
+                                          const int *feature_bits,
+                                          uint64_t features)
+{
+    uint64_t features_ex[VIRTIO_FEATURES_NU64S];
+
+    virtio_features_from_u64(features_ex, features);
+    vhost_get_features_ex(hdev, feature_bits, features_ex);
+    return features_ex[0];
+}
+
+/**
+ * vhost_ack_features_ex() - set vhost full set of acked_features
+ * @hdev: common vhost_dev structure
+ * @feature_bits: pointer to terminated table of feature bits
+ * @features: requested feature set
+ *
+ * This sets the internal hdev->acked_features to the intersection of
+ * the backends advertised features and the supported feature_bits.
+ */
+void vhost_ack_features_ex(struct vhost_dev *hdev, const int *feature_bits,
+                           const uint64_t *features);
 
 /**
  * vhost_ack_features() - set vhost acked_features
@@ -342,8 +376,16 @@ uint64_t vhost_get_features(struct vhost_dev *hdev, const int *feature_bits,
  * This sets the internal hdev->acked_features to the intersection of
  * the backends advertised features and the supported feature_bits.
  */
-void vhost_ack_features(struct vhost_dev *hdev, const int *feature_bits,
-                        uint64_t features);
+static inline void vhost_ack_features(struct vhost_dev *hdev,
+                                      const int *feature_bits,
+                                      uint64_t features)
+{
+    uint64_t features_ex[VIRTIO_FEATURES_NU64S];
+
+    virtio_features_from_u64(features_ex, features);
+    vhost_ack_features_ex(hdev, feature_bits, features_ex);
+}
+
 unsigned int vhost_get_max_memslots(void);
 unsigned int vhost_get_free_memslots(void);
 

From a76f5b795cab8ea0654e4813caa694470d7250a9 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:23 +0200
Subject: [PATCH 0939/2396] qmp: update virtio features map to support extended
 features

Extend the VirtioDeviceFeatures struct with an additional u64
to track unknown features in the 64-127 bit range and decode
the full virtio features spaces for vhost and virtio devices.

Also add entries for the soon-to-be-supported virtio net GSO over
UDP features.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <e51969f94d89045b333f1bc5ef5fca9e12fc371a.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio-hmp-cmds.c |  3 +-
 hw/virtio/virtio-qmp.c      | 91 +++++++++++++++++++++++++------------
 hw/virtio/virtio-qmp.h      |  3 +-
 qapi/virtio.json            |  9 +++-
 4 files changed, 74 insertions(+), 32 deletions(-)

diff --git a/hw/virtio/virtio-hmp-cmds.c b/hw/virtio/virtio-hmp-cmds.c
index 7d8677bcf0..1daae482d3 100644
--- a/hw/virtio/virtio-hmp-cmds.c
+++ b/hw/virtio/virtio-hmp-cmds.c
@@ -74,7 +74,8 @@ static void hmp_virtio_dump_features(Monitor *mon,
     }
 
     if (features->has_unknown_dev_features) {
-        monitor_printf(mon, "  unknown-features(0x%016"PRIx64")\n",
+        monitor_printf(mon, "  unknown-features(0x%016"PRIx64"%016"PRIx64")\n",
+                       features->unknown_dev_features2,
                        features->unknown_dev_features);
     }
 }
diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
index 3b6377cf0d..b338344c6c 100644
--- a/hw/virtio/virtio-qmp.c
+++ b/hw/virtio/virtio-qmp.c
@@ -325,6 +325,20 @@ static const qmp_virtio_feature_map_t virtio_net_feature_map[] = {
     FEATURE_ENTRY(VHOST_USER_F_PROTOCOL_FEATURES, \
             "VHOST_USER_F_PROTOCOL_FEATURES: Vhost-user protocol features "
             "negotiation supported"),
+    FEATURE_ENTRY(VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO, \
+            "VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO: Driver can receive GSO over "
+            "UDP tunnel packets"),
+    FEATURE_ENTRY(VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM, \
+            "VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO: Driver can receive GSO over "
+            "UDP tunnel packets requiring checksum offload for the outer "
+            "header"),
+    FEATURE_ENTRY(VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO, \
+            "VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO: Device can receive GSO over "
+            "UDP tunnel packets"),
+    FEATURE_ENTRY(VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM, \
+            "VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM: Device can receive GSO over "
+            "UDP tunnel packets requiring checksum offload for the outer "
+            "header"),
     { -1, "" }
 };
 #endif
@@ -510,6 +524,24 @@ static const qmp_virtio_feature_map_t virtio_gpio_feature_map[] = {
         list;                                            \
     })
 
+#define CONVERT_FEATURES_EX(type, map, bitmap)           \
+    ({                                                   \
+        type *list = NULL;                               \
+        type *node;                                      \
+        for (i = 0; map[i].virtio_bit != -1; i++) {      \
+            bit = map[i].virtio_bit;                     \
+            if (!virtio_has_feature_ex(bitmap, bit)) {   \
+                continue;                                \
+            }                                            \
+            node = g_new0(type, 1);                      \
+            node->value = g_strdup(map[i].feature_desc); \
+            node->next = list;                           \
+            list = node;                                 \
+            virtio_clear_feature_ex(bitmap, bit);        \
+        }                                                \
+        list;                                            \
+    })
+
 VirtioDeviceStatus *qmp_decode_status(uint8_t bitmap)
 {
     VirtioDeviceStatus *status;
@@ -545,109 +577,112 @@ VhostDeviceProtocols *qmp_decode_protocols(uint64_t bitmap)
     return vhu_protocols;
 }
 
-VirtioDeviceFeatures *qmp_decode_features(uint16_t device_id, uint64_t bitmap)
+VirtioDeviceFeatures *qmp_decode_features(uint16_t device_id,
+                                          const uint64_t *bmap)
 {
+    uint64_t bitmap[VIRTIO_FEATURES_NU64S];
     VirtioDeviceFeatures *features;
     uint64_t bit;
     int i;
 
+    virtio_features_copy(bitmap, bmap);
     features = g_new0(VirtioDeviceFeatures, 1);
     features->has_dev_features = true;
 
     /* transport features */
-    features->transports = CONVERT_FEATURES(strList, virtio_transport_map, 0,
-                                            bitmap);
+    features->transports = CONVERT_FEATURES_EX(strList, virtio_transport_map,
+                                               bitmap);
 
     /* device features */
     switch (device_id) {
 #ifdef CONFIG_VIRTIO_SERIAL
     case VIRTIO_ID_CONSOLE:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_serial_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_serial_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_BLK
     case VIRTIO_ID_BLOCK:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_blk_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_blk_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_GPU
     case VIRTIO_ID_GPU:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_gpu_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_gpu_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_NET
     case VIRTIO_ID_NET:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_net_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_net_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_SCSI
     case VIRTIO_ID_SCSI:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_scsi_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_scsi_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_BALLOON
     case VIRTIO_ID_BALLOON:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_balloon_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_balloon_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_IOMMU
     case VIRTIO_ID_IOMMU:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_iommu_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_iommu_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_INPUT
     case VIRTIO_ID_INPUT:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_input_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_input_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VHOST_USER_FS
     case VIRTIO_ID_FS:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_fs_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_fs_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VHOST_VSOCK
     case VIRTIO_ID_VSOCK:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_vsock_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_vsock_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_CRYPTO
     case VIRTIO_ID_CRYPTO:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_crypto_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_crypto_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_MEM
     case VIRTIO_ID_MEM:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_mem_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_mem_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_I2C_ADAPTER
     case VIRTIO_ID_I2C_ADAPTER:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_i2c_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_i2c_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VIRTIO_RNG
     case VIRTIO_ID_RNG:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_rng_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_rng_feature_map, bitmap);
         break;
 #endif
 #ifdef CONFIG_VHOST_USER_GPIO
     case VIRTIO_ID_GPIO:
         features->dev_features =
-            CONVERT_FEATURES(strList, virtio_gpio_feature_map, 0, bitmap);
+            CONVERT_FEATURES_EX(strList, virtio_gpio_feature_map, bitmap);
         break;
 #endif
     /* No features */
@@ -680,10 +715,9 @@ VirtioDeviceFeatures *qmp_decode_features(uint16_t device_id, uint64_t bitmap)
         g_assert_not_reached();
     }
 
-    features->has_unknown_dev_features = bitmap != 0;
-    if (features->has_unknown_dev_features) {
-        features->unknown_dev_features = bitmap;
-    }
+    features->has_unknown_dev_features = !virtio_features_empty(bitmap);
+    features->unknown_dev_features = bitmap[0];
+    features->unknown_dev_features2 = bitmap[1];
 
     return features;
 }
@@ -743,11 +777,11 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp)
     status->device_id = vdev->device_id;
     status->vhost_started = vdev->vhost_started;
     status->guest_features = qmp_decode_features(vdev->device_id,
-                                                 vdev->guest_features);
+                                                 vdev->guest_features_ex);
     status->host_features = qmp_decode_features(vdev->device_id,
-                                                vdev->host_features);
+                                                vdev->host_features_ex);
     status->backend_features = qmp_decode_features(vdev->device_id,
-                                                   vdev->backend_features);
+                                                 vdev->backend_features_ex);
 
     switch (vdev->device_endian) {
     case VIRTIO_DEVICE_ENDIAN_LITTLE:
@@ -785,11 +819,12 @@ VirtioStatus *qmp_x_query_virtio_status(const char *path, Error **errp)
         status->vhost_dev->nvqs = hdev->nvqs;
         status->vhost_dev->vq_index = hdev->vq_index;
         status->vhost_dev->features =
-            qmp_decode_features(vdev->device_id, hdev->features);
+            qmp_decode_features(vdev->device_id, hdev->features_ex);
         status->vhost_dev->acked_features =
-            qmp_decode_features(vdev->device_id, hdev->acked_features);
+            qmp_decode_features(vdev->device_id, hdev->acked_features_ex);
         status->vhost_dev->backend_features =
-            qmp_decode_features(vdev->device_id, hdev->backend_features);
+            qmp_decode_features(vdev->device_id, hdev->backend_features_ex);
+
         status->vhost_dev->protocol_features =
             qmp_decode_protocols(hdev->protocol_features);
         status->vhost_dev->max_queues = hdev->max_queues;
diff --git a/hw/virtio/virtio-qmp.h b/hw/virtio/virtio-qmp.h
index 245a446a56..e0a1e49035 100644
--- a/hw/virtio/virtio-qmp.h
+++ b/hw/virtio/virtio-qmp.h
@@ -18,6 +18,7 @@
 VirtIODevice *qmp_find_virtio_device(const char *path);
 VirtioDeviceStatus *qmp_decode_status(uint8_t bitmap);
 VhostDeviceProtocols *qmp_decode_protocols(uint64_t bitmap);
-VirtioDeviceFeatures *qmp_decode_features(uint16_t device_id, uint64_t bitmap);
+VirtioDeviceFeatures *qmp_decode_features(uint16_t device_id,
+                                          const uint64_t *bitmap);
 
 #endif
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 9d652fe4a8..05295ab665 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -247,6 +247,7 @@
 #              },
 #              "host-features": {
 #                  "unknown-dev-features": 1073741824,
+#                  "unknown-dev-features2": 0,
 #                  "dev-features": [],
 #                  "transports": [
 #                      "VIRTIO_RING_F_EVENT_IDX: Used & avail. event fields enabled",
@@ -490,14 +491,18 @@
 #     unique features)
 #
 # @unknown-dev-features: Virtio device features bitmap that have not
-#     been decoded
+#     been decoded (bits 0-63)
+#
+# @unknown-dev-features2: Virtio device features bitmap that have not
+#     been decoded (bits 64-127) (since 10.2)
 #
 # Since: 7.2
 ##
 { 'struct': 'VirtioDeviceFeatures',
   'data': { 'transports': [ 'str' ],
             '*dev-features': [ 'str' ],
-            '*unknown-dev-features': 'uint64' } }
+            '*unknown-dev-features': 'uint64',
+            '*unknown-dev-features2': 'uint64' } }
 
 ##
 # @VirtQueueStatus:

From f412c1f57ab58fd595efee26264193759220ca6f Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:24 +0200
Subject: [PATCH 0940/2396] vhost-backend: implement extended features support

Leverage the kernel extended features manipulation ioctls(), if
available, and fallback to old ops otherwise. Error out when setting
extended features but kernel support is not available.

Note that extended support for get/set backend features is not needed,
as the only feature that can be changed belongs to the 64 bit range.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <150daade3d59e77629276920e014ee8e5fc12121.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost-backend.c | 62 ++++++++++++++++++++++++++++++++-------
 1 file changed, 51 insertions(+), 11 deletions(-)

diff --git a/hw/virtio/vhost-backend.c b/hw/virtio/vhost-backend.c
index 833804dd40..4367db0d95 100644
--- a/hw/virtio/vhost-backend.c
+++ b/hw/virtio/vhost-backend.c
@@ -20,6 +20,11 @@
 #include <linux/vhost.h>
 #include <sys/ioctl.h>
 
+struct vhost_features {
+    uint64_t count;
+    uint64_t features[VIRTIO_FEATURES_NU64S];
+};
+
 static int vhost_kernel_call(struct vhost_dev *dev, unsigned long int request,
                              void *arg)
 {
@@ -182,12 +187,6 @@ static int vhost_kernel_get_vring_worker(struct vhost_dev *dev,
     return vhost_kernel_call(dev, VHOST_GET_VRING_WORKER, worker);
 }
 
-static int vhost_kernel_set_features(struct vhost_dev *dev,
-                                     uint64_t features)
-{
-    return vhost_kernel_call(dev, VHOST_SET_FEATURES, &features);
-}
-
 static int vhost_kernel_set_backend_cap(struct vhost_dev *dev)
 {
     uint64_t features;
@@ -210,10 +209,51 @@ static int vhost_kernel_set_backend_cap(struct vhost_dev *dev)
     return 0;
 }
 
-static int vhost_kernel_get_features(struct vhost_dev *dev,
-                                     uint64_t *features)
+static int vhost_kernel_set_features(struct vhost_dev *dev,
+                                     const uint64_t *features)
 {
-    return vhost_kernel_call(dev, VHOST_GET_FEATURES, features);
+    struct vhost_features farray;
+    bool extended_in_use;
+    int r;
+
+    farray.count = VIRTIO_FEATURES_NU64S;
+    virtio_features_copy(farray.features, features);
+    extended_in_use = virtio_features_use_ex(farray.features);
+
+    /*
+     * Can't check for ENOTTY: for unknown ioctls the kernel interprets
+     * the argument as a virtio queue id and most likely errors out validating
+     * such id, instead of reporting an unknown operation.
+     */
+    r = vhost_kernel_call(dev, VHOST_SET_FEATURES_ARRAY, &farray);
+    if (!r) {
+        return 0;
+    }
+
+    if (extended_in_use) {
+        error_report("Trying to set extended features without kernel support");
+        return -EINVAL;
+    }
+    return vhost_kernel_call(dev, VHOST_SET_FEATURES, &farray.features[0]);
+}
+
+static int vhost_kernel_get_features(struct vhost_dev *dev, uint64_t *features)
+{
+    struct vhost_features farray;
+    int r;
+
+    farray.count = VIRTIO_FEATURES_NU64S;
+    r = vhost_kernel_call(dev, VHOST_GET_FEATURES_ARRAY, &farray);
+    if (r) {
+        memset(&farray, 0, sizeof(farray));
+        r = vhost_kernel_call(dev, VHOST_GET_FEATURES, &farray.features[0]);
+    }
+    if (r) {
+        return r;
+    }
+
+    virtio_features_copy(features, farray.features);
+    return 0;
 }
 
 static int vhost_kernel_set_owner(struct vhost_dev *dev)
@@ -341,8 +381,8 @@ const VhostOps kernel_ops = {
         .vhost_attach_vring_worker = vhost_kernel_attach_vring_worker,
         .vhost_new_worker = vhost_kernel_new_worker,
         .vhost_free_worker = vhost_kernel_free_worker,
-        .vhost_set_features = vhost_kernel_set_features,
-        .vhost_get_features = vhost_kernel_get_features,
+        .vhost_set_features_ex = vhost_kernel_set_features,
+        .vhost_get_features_ex = vhost_kernel_get_features,
         .vhost_set_backend_cap = vhost_kernel_set_backend_cap,
         .vhost_set_owner = vhost_kernel_set_owner,
         .vhost_get_vq_index = vhost_kernel_get_vq_index,

From d55ad8c9a9a5edd8152f13fc97879d66972f103e Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:25 +0200
Subject: [PATCH 0941/2396] vhost-net: implement extended features support

Provide extended version of the features manipulation helpers,
and let the device initialization deal with the full features space,
adjusting the relevant format strings accordingly.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <69c78c432e28e146a8874b2a7d00e9cbd111b1ba.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/vhost_net-stub.c |  8 +++-----
 hw/net/vhost_net.c      | 45 +++++++++++++++++++++++------------------
 include/net/vhost_net.h | 33 +++++++++++++++++++++++++++---
 3 files changed, 58 insertions(+), 28 deletions(-)

diff --git a/hw/net/vhost_net-stub.c b/hw/net/vhost_net-stub.c
index 7d49f82906..0740d5a2eb 100644
--- a/hw/net/vhost_net-stub.c
+++ b/hw/net/vhost_net-stub.c
@@ -46,9 +46,8 @@ void vhost_net_cleanup(struct vhost_net *net)
 {
 }
 
-uint64_t vhost_net_get_features(struct vhost_net *net, uint64_t features)
+void vhost_net_get_features_ex(struct vhost_net *net, uint64_t *features)
 {
-    return features;
 }
 
 int vhost_net_get_config(struct vhost_net *net,  uint8_t *config,
@@ -62,13 +61,12 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data,
     return 0;
 }
 
-void vhost_net_ack_features(struct vhost_net *net, uint64_t features)
+void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features)
 {
 }
 
-uint64_t vhost_net_get_acked_features(VHostNetState *net)
+void vhost_net_get_acked_features_ex(VHostNetState *net, uint64_t *features)
 {
-    return 0;
 }
 
 bool vhost_net_virtqueue_pending(VHostNetState *net, int idx)
diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index 540492b37d..a8ee18a912 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -35,10 +35,9 @@
 #include "hw/virtio/virtio-bus.h"
 #include "linux-headers/linux/vhost.h"
 
-uint64_t vhost_net_get_features(struct vhost_net *net, uint64_t features)
+void vhost_net_get_features_ex(struct vhost_net *net, uint64_t *features)
 {
-    return vhost_get_features(&net->dev, net->feature_bits,
-            features);
+    vhost_get_features_ex(&net->dev, net->feature_bits, features);
 }
 int vhost_net_get_config(struct vhost_net *net,  uint8_t *config,
                          uint32_t config_len)
@@ -51,10 +50,11 @@ int vhost_net_set_config(struct vhost_net *net, const uint8_t *data,
     return vhost_dev_set_config(&net->dev, data, offset, size, flags);
 }
 
-void vhost_net_ack_features(struct vhost_net *net, uint64_t features)
+void vhost_net_ack_features_ex(struct vhost_net *net, const uint64_t *features)
 {
-    net->dev.acked_features = net->dev.backend_features;
-    vhost_ack_features(&net->dev, net->feature_bits, features);
+    virtio_features_copy(net->dev.acked_features_ex,
+                         net->dev.backend_features_ex);
+    vhost_ack_features_ex(&net->dev, net->feature_bits, features);
 }
 
 uint64_t vhost_net_get_max_queues(VHostNetState *net)
@@ -62,9 +62,9 @@ uint64_t vhost_net_get_max_queues(VHostNetState *net)
     return net->dev.max_queues;
 }
 
-uint64_t vhost_net_get_acked_features(VHostNetState *net)
+void vhost_net_get_acked_features_ex(VHostNetState *net, uint64_t *features)
 {
-    return net->dev.acked_features;
+    virtio_features_copy(features, net->dev.acked_features_ex);
 }
 
 void vhost_net_save_acked_features(NetClientState *nc)
@@ -234,7 +234,8 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     int r;
     bool backend_kernel = options->backend_type == VHOST_BACKEND_TYPE_KERNEL;
     struct vhost_net *net = g_new0(struct vhost_net, 1);
-    uint64_t features = 0;
+    uint64_t missing_features[VIRTIO_FEATURES_NU64S];
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     Error *local_err = NULL;
 
     if (!options->net_backend) {
@@ -247,6 +248,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
     net->save_acked_features = options->save_acked_features;
     net->max_tx_queue_size = options->max_tx_queue_size;
     net->is_vhost_user = options->is_vhost_user;
+    virtio_features_clear(features);
 
     net->dev.max_queues = 1;
     net->dev.vqs = net->vqs;
@@ -261,7 +263,7 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
         net->backend = r;
         net->dev.protocol_features = 0;
     } else {
-        net->dev.backend_features = 0;
+        virtio_features_clear(net->dev.backend_features_ex);
         net->dev.protocol_features = 0;
         net->backend = -1;
 
@@ -281,26 +283,29 @@ struct vhost_net *vhost_net_init(VhostNetOptions *options)
                                sizeof(struct virtio_net_hdr_mrg_rxbuf))) {
             net->dev.features &= ~(1ULL << VIRTIO_NET_F_MRG_RXBUF);
         }
-        if (~net->dev.features & net->dev.backend_features) {
-            fprintf(stderr, "vhost lacks feature mask 0x%" PRIx64
-                   " for backend\n",
-                   (uint64_t)(~net->dev.features & net->dev.backend_features));
+
+        if (virtio_features_andnot(missing_features,
+                                   net->dev.backend_features_ex,
+                                   net->dev.features_ex)) {
+            fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT
+                   " for backend\n", VIRTIO_FEATURES_PR(missing_features));
             goto fail;
         }
     }
 
     /* Set sane init value. Override when guest acks. */
     if (options->get_acked_features) {
-        features = options->get_acked_features(net->nc);
-        if (~net->dev.features & features) {
-            fprintf(stderr, "vhost lacks feature mask 0x%" PRIx64
-                    " for backend\n",
-                    (uint64_t)(~net->dev.features & features));
+        virtio_features_from_u64(features,
+                                 options->get_acked_features(net->nc));
+        if (virtio_features_andnot(missing_features, features,
+                                   net->dev.features_ex)) {
+            fprintf(stderr, "vhost lacks feature mask 0x" VIRTIO_FEATURES_FMT
+                    " for backend\n", VIRTIO_FEATURES_PR(missing_features));
             goto fail;
         }
     }
 
-    vhost_net_ack_features(net, features);
+    vhost_net_ack_features_ex(net, features);
 
     return net;
 
diff --git a/include/net/vhost_net.h b/include/net/vhost_net.h
index 879781dad7..0225207491 100644
--- a/include/net/vhost_net.h
+++ b/include/net/vhost_net.h
@@ -2,6 +2,7 @@
 #define VHOST_NET_H
 
 #include "net/net.h"
+#include "hw/virtio/virtio-features.h"
 #include "hw/virtio/vhost-backend.h"
 
 struct vhost_net;
@@ -33,8 +34,26 @@ void vhost_net_stop(VirtIODevice *dev, NetClientState *ncs,
 
 void vhost_net_cleanup(VHostNetState *net);
 
-uint64_t vhost_net_get_features(VHostNetState *net, uint64_t features);
-void vhost_net_ack_features(VHostNetState *net, uint64_t features);
+void vhost_net_get_features_ex(VHostNetState *net, uint64_t *features);
+static inline uint64_t vhost_net_get_features(VHostNetState *net,
+                                              uint64_t features)
+{
+    uint64_t features_array[VIRTIO_FEATURES_NU64S];
+
+    virtio_features_from_u64(features_array, features);
+    vhost_net_get_features_ex(net, features_array);
+    return features_array[0];
+}
+
+void vhost_net_ack_features_ex(VHostNetState *net, const uint64_t *features);
+static inline void vhost_net_ack_features(VHostNetState *net,
+                                          uint64_t features)
+{
+    uint64_t features_array[VIRTIO_FEATURES_NU64S];
+
+    virtio_features_from_u64(features_array, features);
+    vhost_net_ack_features_ex(net, features_array);
+}
 
 int vhost_net_get_config(struct vhost_net *net,  uint8_t *config,
                          uint32_t config_len);
@@ -51,7 +70,15 @@ VHostNetState *get_vhost_net(NetClientState *nc);
 
 int vhost_net_set_vring_enable(NetClientState *nc, int enable);
 
-uint64_t vhost_net_get_acked_features(VHostNetState *net);
+void vhost_net_get_acked_features_ex(VHostNetState *net, uint64_t *features);
+static inline uint64_t vhost_net_get_acked_features(VHostNetState *net)
+{
+    uint64_t features[VIRTIO_FEATURES_NU64S];
+
+    vhost_net_get_acked_features_ex(net, features);
+    assert(!virtio_features_use_ex(features));
+    return features[0];
+}
 
 int vhost_net_set_mtu(struct vhost_net *net, uint16_t mtu);
 

From 3a7741c3bdc3537de4159418d712debbd22e4df6 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:26 +0200
Subject: [PATCH 0942/2396] virtio-net: implement extended features support

Use the extended types and helpers to manipulate the virtio_net
features.

Note that offloads are still 64bits wide, as per specification,
and extended offloads will be mapped into such range.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <bc5afdc5c1cb1a37238dd2b36004db3d46cbf211.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c            | 140 +++++++++++++++++++--------------
 include/hw/virtio/virtio-net.h |   2 +-
 2 files changed, 83 insertions(+), 59 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 129bebd82e..39f2a8c987 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -90,6 +90,19 @@
                                          VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
                                          VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
 
+/*
+ * Features starting from VIRTIO_NET_FEATURES_MAP_MIN bit correspond
+ * to guest offloads in the VIRTIO_NET_OFFLOAD_MAP range
+ */
+#define VIRTIO_NET_OFFLOAD_MAP_MIN    46
+#define VIRTIO_NET_OFFLOAD_MAP_LENGTH 4
+#define VIRTIO_NET_OFFLOAD_MAP        MAKE_64BIT_MASK(                    \
+                                              VIRTIO_NET_OFFLOAD_MAP_MIN, \
+                                              VIRTIO_NET_OFFLOAD_MAP_LENGTH)
+#define VIRTIO_NET_FEATURES_MAP_MIN   65
+#define VIRTIO_NET_F2O_SHIFT          (VIRTIO_NET_OFFLOAD_MAP_MIN - \
+                                       VIRTIO_NET_FEATURES_MAP_MIN + 64)
+
 static const VirtIOFeature feature_sizes[] = {
     {.flags = 1ULL << VIRTIO_NET_F_MAC,
      .end = endof(struct virtio_net_config, mac)},
@@ -786,7 +799,14 @@ static void virtio_net_apply_guest_offloads(VirtIONet *n)
     qemu_set_offload(qemu_get_queue(n->nic)->peer, &ol);
 }
 
-static uint64_t virtio_net_guest_offloads_by_features(uint64_t features)
+static uint64_t virtio_net_features_to_offload(const uint64_t *features)
+{
+    return (features[0] & ~VIRTIO_NET_OFFLOAD_MAP) |
+           ((features[1] << VIRTIO_NET_F2O_SHIFT) & VIRTIO_NET_OFFLOAD_MAP);
+}
+
+static uint64_t
+virtio_net_guest_offloads_by_features(const uint64_t *features)
 {
     static const uint64_t guest_offloads_mask =
         (1ULL << VIRTIO_NET_F_GUEST_CSUM) |
@@ -797,13 +817,13 @@ static uint64_t virtio_net_guest_offloads_by_features(uint64_t features)
         (1ULL << VIRTIO_NET_F_GUEST_USO4) |
         (1ULL << VIRTIO_NET_F_GUEST_USO6);
 
-    return guest_offloads_mask & features;
+    return guest_offloads_mask & virtio_net_features_to_offload(features);
 }
 
 uint64_t virtio_net_supported_guest_offloads(const VirtIONet *n)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-    return virtio_net_guest_offloads_by_features(vdev->guest_features);
+    return virtio_net_guest_offloads_by_features(vdev->guest_features_ex);
 }
 
 typedef struct {
@@ -882,34 +902,39 @@ static void failover_add_primary(VirtIONet *n, Error **errp)
     error_propagate(errp, err);
 }
 
-static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
+static void virtio_net_set_features(VirtIODevice *vdev,
+                                    const uint64_t *in_features)
 {
+    uint64_t features[VIRTIO_FEATURES_NU64S];
     VirtIONet *n = VIRTIO_NET(vdev);
     Error *err = NULL;
     int i;
 
+    virtio_features_copy(features, in_features);
     if (n->mtu_bypass_backend &&
             !virtio_has_feature(vdev->backend_features, VIRTIO_NET_F_MTU)) {
-        features &= ~(1ULL << VIRTIO_NET_F_MTU);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_MTU);
     }
 
     virtio_net_set_multiqueue(n,
-                              virtio_has_feature(features, VIRTIO_NET_F_RSS) ||
-                              virtio_has_feature(features, VIRTIO_NET_F_MQ));
+                              virtio_has_feature_ex(features,
+                                                    VIRTIO_NET_F_RSS) ||
+                              virtio_has_feature_ex(features,
+                                                    VIRTIO_NET_F_MQ));
 
     virtio_net_set_mrg_rx_bufs(n,
-                               virtio_has_feature(features,
+                               virtio_has_feature_ex(features,
                                                   VIRTIO_NET_F_MRG_RXBUF),
-                               virtio_has_feature(features,
+                               virtio_has_feature_ex(features,
                                                   VIRTIO_F_VERSION_1),
-                               virtio_has_feature(features,
+                               virtio_has_feature_ex(features,
                                                   VIRTIO_NET_F_HASH_REPORT));
 
-    n->rsc4_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
-        virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO4);
-    n->rsc6_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
-        virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO6);
-    n->rss_data.redirect = virtio_has_feature(features, VIRTIO_NET_F_RSS);
+    n->rsc4_enabled = virtio_has_feature_ex(features, VIRTIO_NET_F_RSC_EXT) &&
+        virtio_has_feature_ex(features, VIRTIO_NET_F_GUEST_TSO4);
+    n->rsc6_enabled = virtio_has_feature_ex(features, VIRTIO_NET_F_RSC_EXT) &&
+        virtio_has_feature_ex(features, VIRTIO_NET_F_GUEST_TSO6);
+    n->rss_data.redirect = virtio_has_feature_ex(features, VIRTIO_NET_F_RSS);
 
     if (n->has_vnet_hdr) {
         n->curr_guest_offloads =
@@ -923,7 +948,7 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         if (!get_vhost_net(nc->peer)) {
             continue;
         }
-        vhost_net_ack_features(get_vhost_net(nc->peer), features);
+        vhost_net_ack_features_ex(get_vhost_net(nc->peer), features);
 
         /*
          * keep acked_features in NetVhostUserState up-to-date so it
@@ -932,12 +957,14 @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
         vhost_net_save_acked_features(nc->peer);
     }
 
-    if (virtio_has_feature(vdev->guest_features ^ features, VIRTIO_NET_F_CTRL_VLAN)) {
-        bool vlan = virtio_has_feature(features, VIRTIO_NET_F_CTRL_VLAN);
+    if (virtio_has_feature_ex(features, VIRTIO_NET_F_CTRL_VLAN) !=
+        virtio_has_feature_ex(vdev->guest_features_ex,
+                              VIRTIO_NET_F_CTRL_VLAN)) {
+        bool vlan = virtio_has_feature_ex(features, VIRTIO_NET_F_CTRL_VLAN);
         memset(n->vlans, vlan ? 0 : 0xff, MAX_VLAN >> 3);
     }
 
-    if (virtio_has_feature(features, VIRTIO_NET_F_STANDBY)) {
+    if (virtio_has_feature_ex(features, VIRTIO_NET_F_STANDBY)) {
         qapi_event_send_failover_negotiated(n->netclient_name);
         qatomic_set(&n->failover_primary_hidden, false);
         failover_add_primary(n, &err);
@@ -1908,10 +1935,10 @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
                 virtio_error(vdev, "virtio-net unexpected empty queue: "
                              "i %zd mergeable %d offset %zd, size %zd, "
                              "guest hdr len %zd, host hdr len %zd "
-                             "guest features 0x%" PRIx64,
+                             "guest features 0x" VIRTIO_FEATURES_FMT,
                              i, n->mergeable_rx_bufs, offset, size,
                              n->guest_hdr_len, n->host_hdr_len,
-                             vdev->guest_features);
+                             VIRTIO_FEATURES_PR(vdev->guest_features_ex));
             }
             err = -1;
             goto err;
@@ -3018,8 +3045,8 @@ static int virtio_net_pre_load_queues(VirtIODevice *vdev, uint32_t n)
     return 0;
 }
 
-static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
-                                        Error **errp)
+static void virtio_net_get_features(VirtIODevice *vdev, uint64_t *features,
+                                    Error **errp)
 {
     VirtIONet *n = VIRTIO_NET(vdev);
     NetClientState *nc = qemu_get_queue(n->nic);
@@ -3033,68 +3060,67 @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         (supported_hash_types & peer_hash_types) == supported_hash_types;
 
     /* Firstly sync all virtio-net possible supported features */
-    features |= n->host_features;
+    virtio_features_or(features, features, n->host_features_ex);
 
-    virtio_add_feature(&features, VIRTIO_NET_F_MAC);
+    virtio_add_feature_ex(features, VIRTIO_NET_F_MAC);
 
     if (!peer_has_vnet_hdr(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_CSUM);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_TSO6);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_ECN);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_CSUM);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_TSO4);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_TSO6);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_ECN);
 
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_CSUM);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_CSUM);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_TSO4);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_TSO6);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_ECN);
 
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_USO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO4);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO6);
 
-        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HASH_REPORT);
     }
 
     if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_UFO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_UFO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_UFO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_UFO);
     }
-
     if (!peer_has_uso(n)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_HOST_USO);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO4);
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_USO6);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_USO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO4);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO6);
     }
 
     if (!get_vhost_net(nc->peer)) {
         if (!use_own_hash) {
-            virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
-            virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-        } else if (virtio_has_feature(features, VIRTIO_NET_F_RSS)) {
+            virtio_clear_feature_ex(features, VIRTIO_NET_F_HASH_REPORT);
+            virtio_clear_feature_ex(features, VIRTIO_NET_F_RSS);
+        } else if (virtio_has_feature_ex(features, VIRTIO_NET_F_RSS)) {
             virtio_net_load_ebpf(n, errp);
         }
 
-        return features;
+        return;
     }
 
     if (!use_peer_hash) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HASH_REPORT);
 
         if (!use_own_hash || !virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
             if (!virtio_net_load_ebpf(n, errp)) {
-                return features;
+                return;
             }
 
-            virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+            virtio_clear_feature_ex(features, VIRTIO_NET_F_RSS);
         }
     }
 
-    features = vhost_net_get_features(get_vhost_net(nc->peer), features);
-    vdev->backend_features = features;
+    vhost_net_get_features_ex(get_vhost_net(nc->peer), features);
+    virtio_features_copy(vdev->backend_features_ex, features);
 
     if (n->mtu_bypass_backend &&
             (n->host_features & 1ULL << VIRTIO_NET_F_MTU)) {
-        features |= (1ULL << VIRTIO_NET_F_MTU);
+        virtio_add_feature_ex(features, VIRTIO_NET_F_MTU);
     }
 
     /*
@@ -3109,10 +3135,8 @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
      * support it.
      */
     if (!virtio_has_feature(vdev->backend_features, VIRTIO_NET_F_CTRL_VQ)) {
-        virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ANNOUNCE);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_ANNOUNCE);
     }
-
-    return features;
 }
 
 static int virtio_net_post_load_device(void *opaque, int version_id)
@@ -4244,8 +4268,8 @@ static void virtio_net_class_init(ObjectClass *klass, const void *data)
     vdc->unrealize = virtio_net_device_unrealize;
     vdc->get_config = virtio_net_get_config;
     vdc->set_config = virtio_net_set_config;
-    vdc->get_features = virtio_net_get_features;
-    vdc->set_features = virtio_net_set_features;
+    vdc->get_features_ex = virtio_net_get_features;
+    vdc->set_features_ex = virtio_net_set_features;
     vdc->bad_features = virtio_net_bad_features;
     vdc->reset = virtio_net_reset;
     vdc->queue_reset = virtio_net_queue_reset;
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index 73fdefc0dc..5b8ab7bda7 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -182,7 +182,7 @@ struct VirtIONet {
     uint32_t has_vnet_hdr;
     size_t host_hdr_len;
     size_t guest_hdr_len;
-    uint64_t host_features;
+    VIRTIO_DECLARE_FEATURES(host_features);
     uint32_t rsc_timeout;
     uint8_t rsc4_enabled;
     uint8_t rsc6_enabled;

From fffac046282c99801b62fa7fa1032cdc261bca6d Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:27 +0200
Subject: [PATCH 0943/2396] net: implement tunnel probing

Tap devices support GSO over UDP tunnel offload. Probe for such
feature in a similar manner to other offloads.

GSO over UDP tunnel needs to be enabled in addition to a "plain"
offload (TSO or USO).

No need to check separately for the outer header checksum offload:
the kernel is going to support both of them or none.

The new features are disabled by default to avoid compat issues,
and could be enabled, after that hw_compat_10_1 will be added,
together with the related compat entries.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <a987a8a7613cbf33bb2209c7c7f5889b512638a7.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 41 +++++++++++++++++++++++++++++++++++++++++
 include/net/net.h   |  3 +++
 net/net.c           |  9 +++++++++
 net/tap-bsd.c       |  5 +++++
 net/tap-linux.c     | 11 +++++++++++
 net/tap-linux.h     |  9 +++++++++
 net/tap-solaris.c   |  5 +++++
 net/tap-stub.c      |  5 +++++
 net/tap.c           | 11 +++++++++++
 net/tap_int.h       |  1 +
 10 files changed, 100 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 39f2a8c987..f8e2b4823e 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -649,6 +649,15 @@ static int peer_has_uso(VirtIONet *n)
     return qemu_has_uso(qemu_get_queue(n->nic)->peer);
 }
 
+static bool peer_has_tunnel(VirtIONet *n)
+{
+    if (!peer_has_vnet_hdr(n)) {
+        return false;
+    }
+
+    return qemu_has_tunnel(qemu_get_queue(n->nic)->peer);
+}
+
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
                                        int version_1, int hash_report)
 {
@@ -3079,6 +3088,13 @@ static void virtio_net_get_features(VirtIODevice *vdev, uint64_t *features,
         virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO4);
         virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO6);
 
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO);
+        virtio_clear_feature_ex(features,
+                                VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM);
+        virtio_clear_feature_ex(features,
+                                VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM);
+
         virtio_clear_feature_ex(features, VIRTIO_NET_F_HASH_REPORT);
     }
 
@@ -3092,6 +3108,15 @@ static void virtio_net_get_features(VirtIODevice *vdev, uint64_t *features,
         virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_USO6);
     }
 
+    if (!peer_has_tunnel(n)) {
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO);
+        virtio_clear_feature_ex(features, VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO);
+        virtio_clear_feature_ex(features,
+                                VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM);
+        virtio_clear_feature_ex(features,
+                                VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM);
+    }
+
     if (!get_vhost_net(nc->peer)) {
         if (!use_own_hash) {
             virtio_clear_feature_ex(features, VIRTIO_NET_F_HASH_REPORT);
@@ -4254,6 +4279,22 @@ static const Property virtio_net_properties[] = {
                                   rss_data.specified_hash_types,
                                   VIRTIO_NET_HASH_REPORT_UDPv6_EX - 1,
                                   ON_OFF_AUTO_AUTO),
+    VIRTIO_DEFINE_PROP_FEATURE("host_tunnel", VirtIONet,
+                               host_features_ex,
+                               VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO,
+                               false),
+    VIRTIO_DEFINE_PROP_FEATURE("host_tunnel_csum", VirtIONet,
+                               host_features_ex,
+                               VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM,
+                               false),
+    VIRTIO_DEFINE_PROP_FEATURE("guest_tunnel", VirtIONet,
+                               host_features_ex,
+                               VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO,
+                               false),
+    VIRTIO_DEFINE_PROP_FEATURE("guest_tunnel_csum", VirtIONet,
+                               host_features_ex,
+                               VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM,
+                               false),
 };
 
 static void virtio_net_class_init(ObjectClass *klass, const void *data)
diff --git a/include/net/net.h b/include/net/net.h
index 48ba333d02..9a9084690d 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -65,6 +65,7 @@ typedef void (NetClientDestructor)(NetClientState *);
 typedef RxFilterInfo *(QueryRxFilter)(NetClientState *);
 typedef bool (HasUfo)(NetClientState *);
 typedef bool (HasUso)(NetClientState *);
+typedef bool (HasTunnel)(NetClientState *);
 typedef bool (HasVnetHdr)(NetClientState *);
 typedef bool (HasVnetHdrLen)(NetClientState *, int);
 typedef void (SetOffload)(NetClientState *, const NetOffloads *);
@@ -95,6 +96,7 @@ typedef struct NetClientInfo {
     NetPoll *poll;
     HasUfo *has_ufo;
     HasUso *has_uso;
+    HasTunnel *has_tunnel;
     HasVnetHdr *has_vnet_hdr;
     HasVnetHdrLen *has_vnet_hdr_len;
     SetOffload *set_offload;
@@ -197,6 +199,7 @@ void qemu_set_info_str(NetClientState *nc,
 void qemu_format_nic_info_str(NetClientState *nc, uint8_t macaddr[6]);
 bool qemu_has_ufo(NetClientState *nc);
 bool qemu_has_uso(NetClientState *nc);
+bool qemu_has_tunnel(NetClientState *nc);
 bool qemu_has_vnet_hdr(NetClientState *nc);
 bool qemu_has_vnet_hdr_len(NetClientState *nc, int len);
 void qemu_set_offload(NetClientState *nc, const NetOffloads *ol);
diff --git a/net/net.c b/net/net.c
index 63872b6855..9536184a0c 100644
--- a/net/net.c
+++ b/net/net.c
@@ -522,6 +522,15 @@ bool qemu_has_uso(NetClientState *nc)
     return nc->info->has_uso(nc);
 }
 
+bool qemu_has_tunnel(NetClientState *nc)
+{
+    if (!nc || !nc->info->has_tunnel) {
+        return false;
+    }
+
+    return nc->info->has_tunnel(nc);
+}
+
 bool qemu_has_vnet_hdr(NetClientState *nc)
 {
     if (!nc || !nc->info->has_vnet_hdr) {
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index 38eb28cb58..bbf84d1828 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -225,6 +225,11 @@ int tap_probe_has_uso(int fd)
     return 0;
 }
 
+bool tap_probe_has_tunnel(int fd)
+{
+    return false;
+}
+
 void tap_fd_set_vnet_hdr_len(int fd, int len)
 {
 }
diff --git a/net/tap-linux.c b/net/tap-linux.c
index 79a9dd0da0..98b0ae9602 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -201,6 +201,17 @@ int tap_probe_has_uso(int fd)
     return 1;
 }
 
+bool tap_probe_has_tunnel(int fd)
+{
+    unsigned offload;
+
+    offload = TUN_F_CSUM | TUN_F_TSO4 | TUN_F_UDP_TUNNEL_GSO;
+    if (ioctl(fd, TUNSETOFFLOAD, offload) < 0) {
+        return false;
+    }
+    return true;
+}
+
 void tap_fd_set_vnet_hdr_len(int fd, int len)
 {
     if (ioctl(fd, TUNSETVNETHDRSZ, &len) == -1) {
diff --git a/net/tap-linux.h b/net/tap-linux.h
index 9a58cecb7f..8cd6b5874b 100644
--- a/net/tap-linux.h
+++ b/net/tap-linux.h
@@ -53,4 +53,13 @@
 #define TUN_F_USO4    0x20    /* I can handle USO for IPv4 packets */
 #define TUN_F_USO6    0x40    /* I can handle USO for IPv6 packets */
 
+/* I can handle TSO/USO for UDP tunneled packets */
+#define TUN_F_UDP_TUNNEL_GSO       0x080
+
+/*
+ * I can handle TSO/USO for UDP tunneled packets requiring csum offload for
+ * the outer header
+ */
+#define TUN_F_UDP_TUNNEL_GSO_CSUM  0x100
+
 #endif /* QEMU_TAP_LINUX_H */
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index ef8e0feeb0..75397e6c54 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -227,6 +227,11 @@ int tap_probe_has_uso(int fd)
     return 0;
 }
 
+bool tap_probe_has_tunnel(int fd)
+{
+    return false;
+}
+
 void tap_fd_set_vnet_hdr_len(int fd, int len)
 {
 }
diff --git a/net/tap-stub.c b/net/tap-stub.c
index 67d14ad4d5..f7a5e0c163 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -52,6 +52,11 @@ int tap_probe_has_uso(int fd)
     return 0;
 }
 
+bool tap_probe_has_tunnel(int fd)
+{
+    return false;
+}
+
 void tap_fd_set_vnet_hdr_len(int fd, int len)
 {
 }
diff --git a/net/tap.c b/net/tap.c
index df23283744..5124372316 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -76,6 +76,7 @@ typedef struct TAPState {
     bool using_vnet_hdr;
     bool has_ufo;
     bool has_uso;
+    bool has_tunnel;
     bool enabled;
     VHostNetState *vhost_net;
     unsigned host_vnet_hdr_len;
@@ -246,6 +247,14 @@ static bool tap_has_uso(NetClientState *nc)
     return s->has_uso;
 }
 
+static bool tap_has_tunnel(NetClientState *nc)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+    return s->has_tunnel;
+}
+
 static bool tap_has_vnet_hdr(NetClientState *nc)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -374,6 +383,7 @@ static NetClientInfo net_tap_info = {
     .cleanup = tap_cleanup,
     .has_ufo = tap_has_ufo,
     .has_uso = tap_has_uso,
+    .has_tunnel = tap_has_tunnel,
     .has_vnet_hdr = tap_has_vnet_hdr,
     .has_vnet_hdr_len = tap_has_vnet_hdr_len,
     .set_offload = tap_set_offload,
@@ -403,6 +413,7 @@ static TAPState *net_tap_fd_init(NetClientState *peer,
     s->using_vnet_hdr = false;
     s->has_ufo = tap_probe_has_ufo(s->fd);
     s->has_uso = tap_probe_has_uso(s->fd);
+    s->has_tunnel = tap_probe_has_tunnel(s->fd);
     s->enabled = true;
     tap_set_offload(&s->nc, &ol);
     /*
diff --git a/net/tap_int.h b/net/tap_int.h
index f8bbe1cb0c..b76a05044b 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -38,6 +38,7 @@ void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp);
 int tap_probe_vnet_hdr(int fd, Error **errp);
 int tap_probe_has_ufo(int fd);
 int tap_probe_has_uso(int fd);
+bool tap_probe_has_tunnel(int fd);
 void tap_fd_set_offload(int fd, const NetOffloads *ol);
 void tap_fd_set_vnet_hdr_len(int fd, int len);
 int tap_fd_set_vnet_le(int fd, int vnet_is_le);

From a5289563ad74a2a37e8d2101d82935454c71fef4 Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Mon, 22 Sep 2025 16:18:28 +0200
Subject: [PATCH 0944/2396] net: implement UDP tunnel features offloading

When any host or guest GSO over UDP tunnel offload is enabled the
virtio net header includes the additional tunnel-related fields,
update the size accordingly.

Push the GSO over UDP tunnel offloads all the way down to the tap
device extending the newly introduced NetFeatures struct, and
eventually enable the associated features.

As per virtio specification, to convert features bit to offload bit,
map the extended features into the reserved range.

Finally, make the vhost backend aware of the exact header layout, to
copy it correctly. The tunnel-related field are present if either
the guest or the host negotiated any UDP tunnel related feature:
add them to the kernel supported features list, to allow qemu
transfer to the backend the needed information.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <093b4bc68368046bffbcab2202227632d6e4e83b.1758549625.git.pabeni@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/net/virtio-net.c | 34 ++++++++++++++++++++++++++--------
 include/net/net.h   |  2 ++
 net/net.c           |  3 ++-
 net/tap-linux.c     |  6 ++++++
 net/tap.c           |  2 ++
 5 files changed, 38 insertions(+), 9 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index f8e2b4823e..33116712eb 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -103,6 +103,12 @@
 #define VIRTIO_NET_F2O_SHIFT          (VIRTIO_NET_OFFLOAD_MAP_MIN - \
                                        VIRTIO_NET_FEATURES_MAP_MIN + 64)
 
+static bool virtio_has_tunnel_hdr(const uint64_t *features)
+{
+    return virtio_has_feature_ex(features, VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO) ||
+           virtio_has_feature_ex(features, VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO);
+}
+
 static const VirtIOFeature feature_sizes[] = {
     {.flags = 1ULL << VIRTIO_NET_F_MAC,
      .end = endof(struct virtio_net_config, mac)},
@@ -659,7 +665,8 @@ static bool peer_has_tunnel(VirtIONet *n)
 }
 
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
-                                       int version_1, int hash_report)
+                                       int version_1, int hash_report,
+                                       int tunnel)
 {
     int i;
     NetClientState *nc;
@@ -667,9 +674,11 @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
     n->mergeable_rx_bufs = mergeable_rx_bufs;
 
     if (version_1) {
-        n->guest_hdr_len = hash_report ?
-            sizeof(struct virtio_net_hdr_v1_hash) :
-            sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        n->guest_hdr_len = tunnel ?
+            sizeof(struct virtio_net_hdr_v1_hash_tunnel) :
+            (hash_report ?
+             sizeof(struct virtio_net_hdr_v1_hash) :
+             sizeof(struct virtio_net_hdr_mrg_rxbuf));
         n->rss_data.populate_hash = !!hash_report;
     } else {
         n->guest_hdr_len = n->mergeable_rx_bufs ?
@@ -803,6 +812,10 @@ static void virtio_net_apply_guest_offloads(VirtIONet *n)
        .ufo  = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_UFO)),
        .uso4 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO4)),
        .uso6 = !!(n->curr_guest_offloads & (1ULL << VIRTIO_NET_F_GUEST_USO6)),
+       .tnl  = !!(n->curr_guest_offloads &
+                  (1ULL << VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_MAPPED)),
+       .tnl_csum = !!(n->curr_guest_offloads &
+                      (1ULL << VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM_MAPPED)),
     };
 
     qemu_set_offload(qemu_get_queue(n->nic)->peer, &ol);
@@ -824,7 +837,9 @@ virtio_net_guest_offloads_by_features(const uint64_t *features)
         (1ULL << VIRTIO_NET_F_GUEST_ECN)  |
         (1ULL << VIRTIO_NET_F_GUEST_UFO)  |
         (1ULL << VIRTIO_NET_F_GUEST_USO4) |
-        (1ULL << VIRTIO_NET_F_GUEST_USO6);
+        (1ULL << VIRTIO_NET_F_GUEST_USO6) |
+        (1ULL << VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_MAPPED) |
+        (1ULL << VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM_MAPPED);
 
     return guest_offloads_mask & virtio_net_features_to_offload(features);
 }
@@ -937,7 +952,8 @@ static void virtio_net_set_features(VirtIODevice *vdev,
                                virtio_has_feature_ex(features,
                                                   VIRTIO_F_VERSION_1),
                                virtio_has_feature_ex(features,
-                                                  VIRTIO_NET_F_HASH_REPORT));
+                                                  VIRTIO_NET_F_HASH_REPORT),
+                               virtio_has_tunnel_hdr(features));
 
     n->rsc4_enabled = virtio_has_feature_ex(features, VIRTIO_NET_F_RSC_EXT) &&
         virtio_has_feature_ex(features, VIRTIO_NET_F_GUEST_TSO4);
@@ -3169,13 +3185,15 @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     VirtIONet *n = opaque;
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     int i, link_down;
+    bool has_tunnel_hdr = virtio_has_tunnel_hdr(vdev->guest_features_ex);
 
     trace_virtio_net_post_load_device();
     virtio_net_set_mrg_rx_bufs(n, n->mergeable_rx_bufs,
                                virtio_vdev_has_feature(vdev,
                                                        VIRTIO_F_VERSION_1),
                                virtio_vdev_has_feature(vdev,
-                                                       VIRTIO_NET_F_HASH_REPORT));
+                                                      VIRTIO_NET_F_HASH_REPORT),
+                               has_tunnel_hdr);
 
     /* MAC_TABLE_ENTRIES may be different from the saved image */
     if (n->mac_table.in_use > MAC_TABLE_ENTRIES) {
@@ -3995,7 +4013,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     n->vqs[0].tx_waiting = 0;
     n->tx_burst = n->net_conf.txburst;
-    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0);
+    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0, 0);
     n->promisc = 1; /* for compatibility */
 
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
diff --git a/include/net/net.h b/include/net/net.h
index 9a9084690d..72b476ee1d 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -43,6 +43,8 @@ typedef struct NetOffloads {
     bool ufo;
     bool uso4;
     bool uso6;
+    bool tnl;
+    bool tnl_csum;
 } NetOffloads;
 
 #define DEFINE_NIC_PROPERTIES(_state, _conf)                            \
diff --git a/net/net.c b/net/net.c
index 9536184a0c..27e0d27807 100644
--- a/net/net.c
+++ b/net/net.c
@@ -575,7 +575,8 @@ void qemu_set_vnet_hdr_len(NetClientState *nc, int len)
 
     assert(len == sizeof(struct virtio_net_hdr_mrg_rxbuf) ||
            len == sizeof(struct virtio_net_hdr) ||
-           len == sizeof(struct virtio_net_hdr_v1_hash));
+           len == sizeof(struct virtio_net_hdr_v1_hash) ||
+           len == sizeof(struct virtio_net_hdr_v1_hash_tunnel));
 
     nc->vnet_hdr_len = len;
     nc->info->set_vnet_hdr_len(nc, len);
diff --git a/net/tap-linux.c b/net/tap-linux.c
index 98b0ae9602..2a90b58467 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -284,6 +284,12 @@ void tap_fd_set_offload(int fd, const NetOffloads *ol)
         if (ol->uso6) {
             offload |= TUN_F_USO6;
         }
+        if (ol->tnl) {
+            offload |= TUN_F_UDP_TUNNEL_GSO;
+        }
+        if (ol->tnl_csum) {
+            offload |= TUN_F_UDP_TUNNEL_GSO_CSUM;
+        }
     }
 
     if (ioctl(fd, TUNSETOFFLOAD, offload) != 0) {
diff --git a/net/tap.c b/net/tap.c
index 5124372316..abe3b2d036 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -62,6 +62,8 @@ static const int kernel_feature_bits[] = {
     VIRTIO_F_NOTIFICATION_DATA,
     VIRTIO_NET_F_RSC_EXT,
     VIRTIO_NET_F_HASH_REPORT,
+    VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO,
+    VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO,
     VHOST_INVALID_FEATURE_BIT
 };
 

From 6d65290d83919267a7775bd4877d923a505aae9a Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:03:55 +0200
Subject: [PATCH 0945/2396] Revert "hw/acpi/ghes: Make
 ghes_record_cper_errors() static"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ghes_record_cper_errors() function was introduced to be used
by other types of errors, as part of the error injection
patch series. That's why it is not static.

Make it non-static again to allow its usage outside ghes.c

This reverts commit 611f3bdb20f7828b0813aa90d47d1275ef18329b.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <14f2a888cfbf922d5f2bf94d7612114f25107d59.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c         | 6 ++++--
 include/hw/acpi/ghes.h | 2 ++
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index b85bb48195..b709c177cd 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -390,8 +390,8 @@ static void get_hw_error_offsets(uint64_t ghes_addr,
     *read_ack_register_addr = ghes_addr + sizeof(uint64_t);
 }
 
-static void ghes_record_cper_errors(const void *cper, size_t len,
-                                    uint16_t source_id, Error **errp)
+void ghes_record_cper_errors(const void *cper, size_t len,
+                             uint16_t source_id, Error **errp)
 {
     uint64_t cper_addr = 0, read_ack_register_addr = 0, read_ack_register;
     AcpiGedState *acpi_ged_state;
@@ -440,6 +440,8 @@ static void ghes_record_cper_errors(const void *cper, size_t len,
 
     /* Write the generic error data entry into guest memory */
     cpu_physical_memory_write(cper_addr, cper, len);
+
+    return;
 }
 
 int acpi_ghes_memory_errors(uint16_t source_id, uint64_t physical_address)
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 578a582203..39619a2457 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -75,6 +75,8 @@ void acpi_build_hest(GArray *table_data, GArray *hardware_errors,
 void acpi_ghes_add_fw_cfg(AcpiGhesState *vms, FWCfgState *s,
                           GArray *hardware_errors);
 int acpi_ghes_memory_errors(uint16_t source_id, uint64_t error_physical_addr);
+void ghes_record_cper_errors(const void *cper, size_t len,
+                             uint16_t source_id, Error **errp);
 
 /**
  * acpi_ghes_present: Report whether ACPI GHES table is present

From 1547c5a5ff894eac9d3666ded3cbf80ce82a28e4 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:03:56 +0200
Subject: [PATCH 0946/2396] acpi/ghes: Cleanup the code which gets ghes ged
 state

Move the check logic into a common function and simplify the
code which checks if GHES is enabled and was properly setup.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <2bbb1d3eb88b0a668114adef2f1c2a94deebba0e.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes-stub.c    |  7 ++++---
 hw/acpi/ghes.c         | 38 +++++++++++---------------------------
 include/hw/acpi/ghes.h | 14 +++++++-------
 target/arm/kvm.c       |  7 +++++--
 4 files changed, 27 insertions(+), 39 deletions(-)

diff --git a/hw/acpi/ghes-stub.c b/hw/acpi/ghes-stub.c
index 7cec1812da..40f660c246 100644
--- a/hw/acpi/ghes-stub.c
+++ b/hw/acpi/ghes-stub.c
@@ -11,12 +11,13 @@
 #include "qemu/osdep.h"
 #include "hw/acpi/ghes.h"
 
-int acpi_ghes_memory_errors(uint16_t source_id, uint64_t physical_address)
+int acpi_ghes_memory_errors(AcpiGhesState *ags, uint16_t source_id,
+                            uint64_t physical_address)
 {
     return -1;
 }
 
-bool acpi_ghes_present(void)
+AcpiGhesState *acpi_ghes_get_state(void)
 {
-    return false;
+    return NULL;
 }
diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index b709c177cd..84b891fd3d 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -360,18 +360,12 @@ void acpi_ghes_add_fw_cfg(AcpiGhesState *ags, FWCfgState *s,
     /* Create a read-write fw_cfg file for Address */
     fw_cfg_add_file_callback(s, ACPI_HW_ERROR_ADDR_FW_CFG_FILE, NULL, NULL,
         NULL, &(ags->hw_error_le), sizeof(ags->hw_error_le), false);
-
-    ags->present = true;
 }
 
 static void get_hw_error_offsets(uint64_t ghes_addr,
                                  uint64_t *cper_addr,
                                  uint64_t *read_ack_register_addr)
 {
-    if (!ghes_addr) {
-        return;
-    }
-
     /*
      * non-HEST version supports only one source, so no need to change
      * the start offset based on the source ID. Also, we can't validate
@@ -390,35 +384,20 @@ static void get_hw_error_offsets(uint64_t ghes_addr,
     *read_ack_register_addr = ghes_addr + sizeof(uint64_t);
 }
 
-void ghes_record_cper_errors(const void *cper, size_t len,
+void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
                              uint16_t source_id, Error **errp)
 {
     uint64_t cper_addr = 0, read_ack_register_addr = 0, read_ack_register;
-    AcpiGedState *acpi_ged_state;
-    AcpiGhesState *ags;
 
     if (len > ACPI_GHES_MAX_RAW_DATA_LENGTH) {
         error_setg(errp, "GHES CPER record is too big: %zd", len);
         return;
     }
 
-    acpi_ged_state = ACPI_GED(object_resolve_path_type("", TYPE_ACPI_GED,
-                                                       NULL));
-    if (!acpi_ged_state) {
-        error_setg(errp, "Can't find ACPI_GED object");
-        return;
-    }
-    ags = &acpi_ged_state->ghes_state;
-
     assert(ACPI_GHES_ERROR_SOURCE_COUNT == 1);
     get_hw_error_offsets(le64_to_cpu(ags->hw_error_le),
                          &cper_addr, &read_ack_register_addr);
 
-    if (!cper_addr) {
-        error_setg(errp, "can not find Generic Error Status Block");
-        return;
-    }
-
     cpu_physical_memory_read(read_ack_register_addr,
                              &read_ack_register, sizeof(read_ack_register));
 
@@ -444,7 +423,8 @@ void ghes_record_cper_errors(const void *cper, size_t len,
     return;
 }
 
-int acpi_ghes_memory_errors(uint16_t source_id, uint64_t physical_address)
+int acpi_ghes_memory_errors(AcpiGhesState *ags, uint16_t source_id,
+                            uint64_t physical_address)
 {
     /* Memory Error Section Type */
     const uint8_t guid[] =
@@ -470,7 +450,7 @@ int acpi_ghes_memory_errors(uint16_t source_id, uint64_t physical_address)
     acpi_ghes_build_append_mem_cper(block, physical_address);
 
     /* Report the error */
-    ghes_record_cper_errors(block->data, block->len, source_id, &errp);
+    ghes_record_cper_errors(ags, block->data, block->len, source_id, &errp);
 
     g_array_free(block, true);
 
@@ -482,7 +462,7 @@ int acpi_ghes_memory_errors(uint16_t source_id, uint64_t physical_address)
     return 0;
 }
 
-bool acpi_ghes_present(void)
+AcpiGhesState *acpi_ghes_get_state(void)
 {
     AcpiGedState *acpi_ged_state;
     AcpiGhesState *ags;
@@ -491,8 +471,12 @@ bool acpi_ghes_present(void)
                                                        NULL));
 
     if (!acpi_ged_state) {
-        return false;
+        return NULL;
     }
     ags = &acpi_ged_state->ghes_state;
-    return ags->present;
+
+    if (!ags->hw_error_le) {
+        return NULL;
+    }
+    return ags;
 }
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 39619a2457..f96ac3e85c 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -66,7 +66,6 @@ enum {
 
 typedef struct AcpiGhesState {
     uint64_t hw_error_le;
-    bool present; /* True if GHES is present at all on this board */
 } AcpiGhesState;
 
 void acpi_build_hest(GArray *table_data, GArray *hardware_errors,
@@ -74,15 +73,16 @@ void acpi_build_hest(GArray *table_data, GArray *hardware_errors,
                      const char *oem_id, const char *oem_table_id);
 void acpi_ghes_add_fw_cfg(AcpiGhesState *vms, FWCfgState *s,
                           GArray *hardware_errors);
-int acpi_ghes_memory_errors(uint16_t source_id, uint64_t error_physical_addr);
-void ghes_record_cper_errors(const void *cper, size_t len,
+int acpi_ghes_memory_errors(AcpiGhesState *ags, uint16_t source_id,
+                            uint64_t error_physical_addr);
+void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
                              uint16_t source_id, Error **errp);
 
 /**
- * acpi_ghes_present: Report whether ACPI GHES table is present
+ * acpi_ghes_get_state: Get a pointer for ACPI ghes state
  *
- * Returns: true if the system has an ACPI GHES table and it is
- * safe to call acpi_ghes_memory_errors() to record a memory error.
+ * Returns: a pointer to ghes state if the system has an ACPI GHES table,
+ * NULL, otherwise.
  */
-bool acpi_ghes_present(void);
+AcpiGhesState *acpi_ghes_get_state(void);
 #endif
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index b8a1c071f5..891d4fcde9 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -2433,10 +2433,12 @@ void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
 {
     ram_addr_t ram_addr;
     hwaddr paddr;
+    AcpiGhesState *ags;
 
     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
 
-    if (acpi_ghes_present() && addr) {
+    ags = acpi_ghes_get_state();
+    if (ags && addr) {
         ram_addr = qemu_ram_addr_from_host(addr);
         if (ram_addr != RAM_ADDR_INVALID &&
             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
@@ -2454,7 +2456,8 @@ void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
              */
             if (code == BUS_MCEERR_AR) {
                 kvm_cpu_synchronize_state(c);
-                if (!acpi_ghes_memory_errors(ACPI_HEST_SRC_ID_SEA, paddr)) {
+                if (!acpi_ghes_memory_errors(ags, ACPI_HEST_SRC_ID_SEA,
+                                             paddr)) {
                     kvm_inject_arm_sea(c);
                 } else {
                     error_report("failed to record the error");

From 2e9c5c5bc85a4f79a5e5c9d52df6c62bd1b2e116 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:03:57 +0200
Subject: [PATCH 0947/2396] acpi/ghes: prepare to change the way HEST offsets
 are calculated

Add a new ags flag to change the way HEST offsets are calculated.
Currently, offsets needed to store ACPI HEST offsets and read ack
are calculated based on a previous knowledge from the logic
which creates the HEST table.

Such logic is not generic, not allowing to easily add more HEST
entries nor replicates what OSPM does.

As the next patches will be adding a more generic logic, add a
new use_hest_addr, set to false, in preparation for such changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <f5de17bf04b27828e1a439ad396b4f7982eaf156.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c           | 39 ++++++++++++++++++++++++---------------
 hw/arm/virt-acpi-build.c | 13 ++++++++++---
 include/hw/acpi/ghes.h   | 12 +++++++++++-
 3 files changed, 45 insertions(+), 19 deletions(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index 84b891fd3d..9243b5ad4a 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -206,7 +206,8 @@ ghes_gen_err_data_uncorrectable_recoverable(GArray *block,
  * Initialize "etc/hardware_errors" and "etc/hardware_errors_addr" fw_cfg blobs.
  * See docs/specs/acpi_hest_ghes.rst for blobs format.
  */
-static void build_ghes_error_table(GArray *hardware_errors, BIOSLinker *linker)
+static void build_ghes_error_table(AcpiGhesState *ags, GArray *hardware_errors,
+                                   BIOSLinker *linker)
 {
     int i, error_status_block_offset;
 
@@ -251,13 +252,15 @@ static void build_ghes_error_table(GArray *hardware_errors, BIOSLinker *linker)
                                        i * ACPI_GHES_MAX_RAW_DATA_LENGTH);
     }
 
-    /*
-     * tell firmware to write hardware_errors GPA into
-     * hardware_errors_addr fw_cfg, once the former has been initialized.
-     */
-    bios_linker_loader_write_pointer(linker, ACPI_HW_ERROR_ADDR_FW_CFG_FILE, 0,
-                                     sizeof(uint64_t),
-                                     ACPI_HW_ERROR_FW_CFG_FILE, 0);
+    if (!ags->use_hest_addr) {
+        /*
+         * Tell firmware to write hardware_errors GPA into
+         * hardware_errors_addr fw_cfg, once the former has been initialized.
+         */
+        bios_linker_loader_write_pointer(linker, ACPI_HW_ERROR_ADDR_FW_CFG_FILE,
+                                         0, sizeof(uint64_t),
+                                         ACPI_HW_ERROR_FW_CFG_FILE, 0);
+    }
 }
 
 /* Build Generic Hardware Error Source version 2 (GHESv2) */
@@ -331,14 +334,15 @@ static void build_ghes_v2(GArray *table_data,
 }
 
 /* Build Hardware Error Source Table */
-void acpi_build_hest(GArray *table_data, GArray *hardware_errors,
+void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
+                     GArray *hardware_errors,
                      BIOSLinker *linker,
                      const char *oem_id, const char *oem_table_id)
 {
     AcpiTable table = { .sig = "HEST", .rev = 1,
                         .oem_id = oem_id, .oem_table_id = oem_table_id };
 
-    build_ghes_error_table(hardware_errors, linker);
+    build_ghes_error_table(ags, hardware_errors, linker);
 
     acpi_table_begin(&table, table_data);
 
@@ -357,9 +361,11 @@ void acpi_ghes_add_fw_cfg(AcpiGhesState *ags, FWCfgState *s,
     fw_cfg_add_file(s, ACPI_HW_ERROR_FW_CFG_FILE, hardware_error->data,
                     hardware_error->len);
 
-    /* Create a read-write fw_cfg file for Address */
-    fw_cfg_add_file_callback(s, ACPI_HW_ERROR_ADDR_FW_CFG_FILE, NULL, NULL,
-        NULL, &(ags->hw_error_le), sizeof(ags->hw_error_le), false);
+    if (!ags->use_hest_addr) {
+        /* Create a read-write fw_cfg file for Address */
+        fw_cfg_add_file_callback(s, ACPI_HW_ERROR_ADDR_FW_CFG_FILE, NULL, NULL,
+            NULL, &(ags->hw_error_le), sizeof(ags->hw_error_le), false);
+    }
 }
 
 static void get_hw_error_offsets(uint64_t ghes_addr,
@@ -395,8 +401,11 @@ void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
     }
 
     assert(ACPI_GHES_ERROR_SOURCE_COUNT == 1);
-    get_hw_error_offsets(le64_to_cpu(ags->hw_error_le),
-                         &cper_addr, &read_ack_register_addr);
+
+    if (!ags->use_hest_addr) {
+        get_hw_error_offsets(le64_to_cpu(ags->hw_error_le),
+                             &cper_addr, &read_ack_register_addr);
+    }
 
     cpu_physical_memory_read(read_ack_register_addr,
                              &read_ack_register, sizeof(read_ack_register));
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 96830f7c4e..bbe83fab9a 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1181,9 +1181,16 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     build_dbg2(tables_blob, tables->linker, vms);
 
     if (vms->ras) {
-        acpi_add_table(table_offsets, tables_blob);
-        acpi_build_hest(tables_blob, tables->hardware_errors, tables->linker,
-                        vms->oem_id, vms->oem_table_id);
+        AcpiGedState *acpi_ged_state;
+        AcpiGhesState *ags;
+
+        acpi_ged_state = ACPI_GED(vms->acpi_dev);
+        ags = &acpi_ged_state->ghes_state;
+        if (ags) {
+            acpi_add_table(table_offsets, tables_blob);
+            acpi_build_hest(ags, tables_blob, tables->hardware_errors,
+                            tables->linker, vms->oem_id, vms->oem_table_id);
+        }
     }
 
     if (ms->numa_state->num_nodes > 0) {
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index f96ac3e85c..411f592662 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -64,11 +64,21 @@ enum {
     ACPI_GHES_ERROR_SOURCE_COUNT
 };
 
+/*
+ * AcpiGhesState stores GPA values that will be used to fill HEST entries.
+ *
+ * When use_hest_addr is false, the GPA of the etc/hardware_errors firmware
+ * is stored at hw_error_le. This is the default on QEMU 9.x.
+ *
+ * An GPA value equal to zero means that GHES is not present.
+ */
 typedef struct AcpiGhesState {
     uint64_t hw_error_le;
+    bool use_hest_addr;         /* Currently, always false */
 } AcpiGhesState;
 
-void acpi_build_hest(GArray *table_data, GArray *hardware_errors,
+void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
+                     GArray *hardware_errors,
                      BIOSLinker *linker,
                      const char *oem_id, const char *oem_table_id);
 void acpi_ghes_add_fw_cfg(AcpiGhesState *vms, FWCfgState *s,

From db16153f196f0ed7560aa138f08e2ef312ecf005 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:03:58 +0200
Subject: [PATCH 0948/2396] acpi/ghes: add a firmware file with HEST address

Store HEST table address at GPA, placing its the start of the table at
hest_addr_le variable.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <c29aa5e6ab9b2d93dd5328481630c3b03da86261.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c         | 22 ++++++++++++++++++++--
 include/hw/acpi/ghes.h |  6 +++++-
 2 files changed, 25 insertions(+), 3 deletions(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index 9243b5ad4a..cbc96c1909 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -30,6 +30,7 @@
 
 #define ACPI_HW_ERROR_FW_CFG_FILE           "etc/hardware_errors"
 #define ACPI_HW_ERROR_ADDR_FW_CFG_FILE      "etc/hardware_errors_addr"
+#define ACPI_HEST_ADDR_FW_CFG_FILE          "etc/acpi_table_hest_addr"
 
 /* The max size in bytes for one error block */
 #define ACPI_GHES_MAX_RAW_DATA_LENGTH   (1 * KiB)
@@ -341,6 +342,9 @@ void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
 {
     AcpiTable table = { .sig = "HEST", .rev = 1,
                         .oem_id = oem_id, .oem_table_id = oem_table_id };
+    uint32_t hest_offset;
+
+    hest_offset = table_data->len;
 
     build_ghes_error_table(ags, hardware_errors, linker);
 
@@ -352,6 +356,17 @@ void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
                   ACPI_GHES_NOTIFY_SEA, ACPI_HEST_SRC_ID_SEA);
 
     acpi_table_end(linker, &table);
+
+    if (ags->use_hest_addr) {
+        /*
+         * Tell firmware to write into GPA the address of HEST via fw_cfg,
+         * once initialized.
+         */
+        bios_linker_loader_write_pointer(linker,
+                                         ACPI_HEST_ADDR_FW_CFG_FILE, 0,
+                                         sizeof(uint64_t),
+                                         ACPI_BUILD_TABLE_FILE, hest_offset);
+    }
 }
 
 void acpi_ghes_add_fw_cfg(AcpiGhesState *ags, FWCfgState *s,
@@ -361,7 +376,10 @@ void acpi_ghes_add_fw_cfg(AcpiGhesState *ags, FWCfgState *s,
     fw_cfg_add_file(s, ACPI_HW_ERROR_FW_CFG_FILE, hardware_error->data,
                     hardware_error->len);
 
-    if (!ags->use_hest_addr) {
+    if (ags->use_hest_addr) {
+        fw_cfg_add_file_callback(s, ACPI_HEST_ADDR_FW_CFG_FILE, NULL, NULL,
+            NULL, &(ags->hest_addr_le), sizeof(ags->hest_addr_le), false);
+    } else {
         /* Create a read-write fw_cfg file for Address */
         fw_cfg_add_file_callback(s, ACPI_HW_ERROR_ADDR_FW_CFG_FILE, NULL, NULL,
             NULL, &(ags->hw_error_le), sizeof(ags->hw_error_le), false);
@@ -484,7 +502,7 @@ AcpiGhesState *acpi_ghes_get_state(void)
     }
     ags = &acpi_ged_state->ghes_state;
 
-    if (!ags->hw_error_le) {
+    if (!ags->hw_error_le && !ags->hest_addr_le) {
         return NULL;
     }
     return ags;
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 411f592662..ea9baab764 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -70,9 +70,13 @@ enum {
  * When use_hest_addr is false, the GPA of the etc/hardware_errors firmware
  * is stored at hw_error_le. This is the default on QEMU 9.x.
  *
- * An GPA value equal to zero means that GHES is not present.
+ * When use_hest_addr is true, the GPA of the HEST table is stored at
+ * hest_addr_le. This is the default for QEMU 10.x and above.
+ *
+ * Whe both GPA values are equal to zero means that GHES is not present.
  */
 typedef struct AcpiGhesState {
+    uint64_t hest_addr_le;
     uint64_t hw_error_le;
     bool use_hest_addr;         /* Currently, always false */
 } AcpiGhesState;

From b74d843f7bf43f5e7e1e5b9c34da2034d622cf78 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:03:59 +0200
Subject: [PATCH 0949/2396] acpi/ghes: Use HEST table offsets when preparing
 GHES records

There are two pointers that are needed during error injection:

1. The start address of the CPER block to be stored;
2. The address of the read ack.

It is preferable to calculate them from the HEST table.  This allows
checking the source ID, the size of the table and the type of the
HEST error block structures.

Yet, keep the old code, as this is needed for migration purposes
from older QEMU versions.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <d4344e8dbe66372e1e093d968eda2e8b0527ba48.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c         | 100 +++++++++++++++++++++++++++++++++++++++++
 include/hw/acpi/ghes.h |   2 +-
 2 files changed, 101 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index cbc96c1909..668ca72587 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -41,6 +41,12 @@
 /* Address offset in Generic Address Structure(GAS) */
 #define GAS_ADDR_OFFSET 4
 
+/*
+ * ACPI spec 1.0b
+ * 5.2.3 System Description Table Header
+ */
+#define ACPI_DESC_HEADER_OFFSET     36
+
 /*
  * The total size of Generic Error Data Entry
  * ACPI 6.1/6.2: 18.3.2.7.1 Generic Error Data,
@@ -61,6 +67,30 @@
  */
 #define ACPI_GHES_GESB_SIZE                 20
 
+/*
+ * See the memory layout map at docs/specs/acpi_hest_ghes.rst.
+ */
+
+/*
+ * ACPI 6.1: 18.3.2.8 Generic Hardware Error Source version 2
+ * Table 18-344 Generic Hardware Error Source version 2 (GHESv2) Structure
+ */
+#define HEST_GHES_V2_ENTRY_SIZE  92
+
+/*
+ * ACPI 6.1: 18.3.2.8 Generic Hardware Error Source version 2
+ * Table 18-344 Generic Hardware Error Source version 2 (GHESv2) Structure
+ * Read Ack Register
+ */
+#define GHES_READ_ACK_ADDR_OFF          64
+
+/*
+ * ACPI 6.1: 18.3.2.7: Generic Hardware Error Source
+ * Table 18-341 Generic Hardware Error Source Structure
+ * Error Status Address
+ */
+#define GHES_ERR_STATUS_ADDR_OFF  20
+
 /*
  * Values for error_severity field
  */
@@ -408,6 +438,73 @@ static void get_hw_error_offsets(uint64_t ghes_addr,
     *read_ack_register_addr = ghes_addr + sizeof(uint64_t);
 }
 
+static void get_ghes_source_offsets(uint16_t source_id,
+                                    uint64_t hest_addr,
+                                    uint64_t *cper_addr,
+                                    uint64_t *read_ack_start_addr,
+                                    Error **errp)
+{
+    uint64_t hest_err_block_addr, hest_read_ack_addr;
+    uint64_t err_source_entry, error_block_addr;
+    uint32_t num_sources, i;
+
+    hest_addr += ACPI_DESC_HEADER_OFFSET;
+
+    cpu_physical_memory_read(hest_addr, &num_sources,
+                             sizeof(num_sources));
+    num_sources = le32_to_cpu(num_sources);
+
+    err_source_entry = hest_addr + sizeof(num_sources);
+
+    /*
+     * Currently, HEST Error source navigates only for GHESv2 tables
+     */
+    for (i = 0; i < num_sources; i++) {
+        uint64_t addr = err_source_entry;
+        uint16_t type, src_id;
+
+        cpu_physical_memory_read(addr, &type, sizeof(type));
+        type = le16_to_cpu(type);
+
+        /* For now, we only know the size of GHESv2 table */
+        if (type != ACPI_GHES_SOURCE_GENERIC_ERROR_V2) {
+            error_setg(errp, "HEST: type %d not supported.", type);
+            return;
+        }
+
+        /* Compare CPER source ID at the GHESv2 structure */
+        addr += sizeof(type);
+        cpu_physical_memory_read(addr, &src_id, sizeof(src_id));
+        if (le16_to_cpu(src_id) == source_id) {
+            break;
+        }
+
+        err_source_entry += HEST_GHES_V2_ENTRY_SIZE;
+    }
+    if (i == num_sources) {
+        error_setg(errp, "HEST: Source %d not found.", source_id);
+        return;
+    }
+
+    /* Navigate through table address pointers */
+    hest_err_block_addr = err_source_entry + GHES_ERR_STATUS_ADDR_OFF +
+                          GAS_ADDR_OFFSET;
+
+    cpu_physical_memory_read(hest_err_block_addr, &error_block_addr,
+                             sizeof(error_block_addr));
+    error_block_addr = le64_to_cpu(error_block_addr);
+
+    cpu_physical_memory_read(error_block_addr, cper_addr,
+                             sizeof(*cper_addr));
+    *cper_addr = le64_to_cpu(*cper_addr);
+
+    hest_read_ack_addr = err_source_entry + GHES_READ_ACK_ADDR_OFF +
+                         GAS_ADDR_OFFSET;
+    cpu_physical_memory_read(hest_read_ack_addr, read_ack_start_addr,
+                             sizeof(*read_ack_start_addr));
+    *read_ack_start_addr = le64_to_cpu(*read_ack_start_addr);
+}
+
 void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
                              uint16_t source_id, Error **errp)
 {
@@ -423,6 +520,9 @@ void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
     if (!ags->use_hest_addr) {
         get_hw_error_offsets(le64_to_cpu(ags->hw_error_le),
                              &cper_addr, &read_ack_register_addr);
+    } else {
+        get_ghes_source_offsets(source_id, le64_to_cpu(ags->hest_addr_le),
+                                &cper_addr, &read_ack_register_addr, errp);
     }
 
     cpu_physical_memory_read(read_ack_register_addr,
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index ea9baab764..5265102ba5 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -78,7 +78,7 @@ enum {
 typedef struct AcpiGhesState {
     uint64_t hest_addr_le;
     uint64_t hw_error_le;
-    bool use_hest_addr;         /* Currently, always false */
+    bool use_hest_addr; /* True if HEST address is present */
 } AcpiGhesState;
 
 void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,

From 2c5a2616ed047e9d5e70970af5c4b2a54e9fa290 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:00 +0200
Subject: [PATCH 0950/2396] acpi/ghes: don't hard-code the number of sources
 for HEST table

The current code is actually dependent on having just one error
structure with a single source, as any change there would cause
migration issues.

As the number of sources should be arch-dependent, as it will depend on
what kind of notifications will exist, and how many errors can be
reported at the same time, change the logic to be more flexible,
allowing the number of sources to be defined when building the
HEST table by the caller.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <1698680848c11d6f26368426f1657e14faaf55c4.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c           | 39 +++++++++++++++++++++------------------
 hw/arm/virt-acpi-build.c |  8 +++++++-
 include/hw/acpi/ghes.h   | 17 ++++++++++++-----
 target/arm/kvm.c         |  2 +-
 4 files changed, 41 insertions(+), 25 deletions(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index 668ca72587..f49d0d628f 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -238,17 +238,17 @@ ghes_gen_err_data_uncorrectable_recoverable(GArray *block,
  * See docs/specs/acpi_hest_ghes.rst for blobs format.
  */
 static void build_ghes_error_table(AcpiGhesState *ags, GArray *hardware_errors,
-                                   BIOSLinker *linker)
+                                   BIOSLinker *linker, int num_sources)
 {
     int i, error_status_block_offset;
 
     /* Build error_block_address */
-    for (i = 0; i < ACPI_GHES_ERROR_SOURCE_COUNT; i++) {
+    for (i = 0; i < num_sources; i++) {
         build_append_int_noprefix(hardware_errors, 0, sizeof(uint64_t));
     }
 
     /* Build read_ack_register */
-    for (i = 0; i < ACPI_GHES_ERROR_SOURCE_COUNT; i++) {
+    for (i = 0; i < num_sources; i++) {
         /*
          * Initialize the value of read_ack_register to 1, so GHES can be
          * writable after (re)boot.
@@ -263,13 +263,13 @@ static void build_ghes_error_table(AcpiGhesState *ags, GArray *hardware_errors,
 
     /* Reserve space for Error Status Data Block */
     acpi_data_push(hardware_errors,
-        ACPI_GHES_MAX_RAW_DATA_LENGTH * ACPI_GHES_ERROR_SOURCE_COUNT);
+        ACPI_GHES_MAX_RAW_DATA_LENGTH * num_sources);
 
     /* Tell guest firmware to place hardware_errors blob into RAM */
     bios_linker_loader_alloc(linker, ACPI_HW_ERROR_FW_CFG_FILE,
                              hardware_errors, sizeof(uint64_t), false);
 
-    for (i = 0; i < ACPI_GHES_ERROR_SOURCE_COUNT; i++) {
+    for (i = 0; i < num_sources; i++) {
         /*
          * Tell firmware to patch error_block_address entries to point to
          * corresponding "Generic Error Status Block"
@@ -295,12 +295,14 @@ static void build_ghes_error_table(AcpiGhesState *ags, GArray *hardware_errors,
 }
 
 /* Build Generic Hardware Error Source version 2 (GHESv2) */
-static void build_ghes_v2(GArray *table_data,
-                          BIOSLinker *linker,
-                          enum AcpiGhesNotifyType notify,
-                          uint16_t source_id)
+static void build_ghes_v2_entry(GArray *table_data,
+                                BIOSLinker *linker,
+                                const AcpiNotificationSourceId *notif_src,
+                                uint16_t index, int num_sources)
 {
     uint64_t address_offset;
+    const uint16_t notify = notif_src->notify;
+    const uint16_t source_id = notif_src->source_id;
 
     /*
      * Type:
@@ -331,7 +333,7 @@ static void build_ghes_v2(GArray *table_data,
                                    address_offset + GAS_ADDR_OFFSET,
                                    sizeof(uint64_t),
                                    ACPI_HW_ERROR_FW_CFG_FILE,
-                                   source_id * sizeof(uint64_t));
+                                   index * sizeof(uint64_t));
 
     /* Notification Structure */
     build_ghes_hw_error_notification(table_data, notify);
@@ -351,8 +353,7 @@ static void build_ghes_v2(GArray *table_data,
                                    address_offset + GAS_ADDR_OFFSET,
                                    sizeof(uint64_t),
                                    ACPI_HW_ERROR_FW_CFG_FILE,
-                                   (ACPI_GHES_ERROR_SOURCE_COUNT + source_id)
-                                   * sizeof(uint64_t));
+                                   (num_sources + index) * sizeof(uint64_t));
 
     /*
      * Read Ack Preserve field
@@ -368,22 +369,26 @@ static void build_ghes_v2(GArray *table_data,
 void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
                      GArray *hardware_errors,
                      BIOSLinker *linker,
+                     const AcpiNotificationSourceId *notif_source,
+                     int num_sources,
                      const char *oem_id, const char *oem_table_id)
 {
     AcpiTable table = { .sig = "HEST", .rev = 1,
                         .oem_id = oem_id, .oem_table_id = oem_table_id };
     uint32_t hest_offset;
+    int i;
 
     hest_offset = table_data->len;
 
-    build_ghes_error_table(ags, hardware_errors, linker);
+    build_ghes_error_table(ags, hardware_errors, linker, num_sources);
 
     acpi_table_begin(&table, table_data);
 
     /* Error Source Count */
-    build_append_int_noprefix(table_data, ACPI_GHES_ERROR_SOURCE_COUNT, 4);
-    build_ghes_v2(table_data, linker,
-                  ACPI_GHES_NOTIFY_SEA, ACPI_HEST_SRC_ID_SEA);
+    build_append_int_noprefix(table_data, num_sources, 4);
+    for (i = 0; i < num_sources; i++) {
+        build_ghes_v2_entry(table_data, linker, &notif_source[i], i, num_sources);
+    }
 
     acpi_table_end(linker, &table);
 
@@ -515,8 +520,6 @@ void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
         return;
     }
 
-    assert(ACPI_GHES_ERROR_SOURCE_COUNT == 1);
-
     if (!ags->use_hest_addr) {
         get_hw_error_offsets(le64_to_cpu(ags->hw_error_le),
                              &cper_addr, &read_ack_register_addr);
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index bbe83fab9a..c856d293c6 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1125,6 +1125,10 @@ static void acpi_align_size(GArray *blob, unsigned align)
     g_array_set_size(blob, ROUND_UP(acpi_data_len(blob), align));
 }
 
+static const AcpiNotificationSourceId hest_ghes_notify[] = {
+    { ACPI_HEST_SRC_ID_SYNC, ACPI_GHES_NOTIFY_SEA },
+};
+
 static
 void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
 {
@@ -1189,7 +1193,9 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
         if (ags) {
             acpi_add_table(table_offsets, tables_blob);
             acpi_build_hest(ags, tables_blob, tables->hardware_errors,
-                            tables->linker, vms->oem_id, vms->oem_table_id);
+                            tables->linker, hest_ghes_notify,
+                            ARRAY_SIZE(hest_ghes_notify),
+                            vms->oem_id, vms->oem_table_id);
         }
     }
 
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 5265102ba5..8c4b084337 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -57,13 +57,18 @@ enum AcpiGhesNotifyType {
     ACPI_GHES_NOTIFY_RESERVED = 12
 };
 
-enum {
-    ACPI_HEST_SRC_ID_SEA = 0,
-    /* future ids go here */
-
-    ACPI_GHES_ERROR_SOURCE_COUNT
+/*
+ * ID numbers used to fill HEST source ID field
+ */
+enum AcpiGhesSourceID {
+    ACPI_HEST_SRC_ID_SYNC,
 };
 
+typedef struct AcpiNotificationSourceId {
+    enum AcpiGhesSourceID source_id;
+    enum AcpiGhesNotifyType notify;
+} AcpiNotificationSourceId;
+
 /*
  * AcpiGhesState stores GPA values that will be used to fill HEST entries.
  *
@@ -84,6 +89,8 @@ typedef struct AcpiGhesState {
 void acpi_build_hest(AcpiGhesState *ags, GArray *table_data,
                      GArray *hardware_errors,
                      BIOSLinker *linker,
+                     const AcpiNotificationSourceId * const notif_source,
+                     int num_sources,
                      const char *oem_id, const char *oem_table_id);
 void acpi_ghes_add_fw_cfg(AcpiGhesState *vms, FWCfgState *s,
                           GArray *hardware_errors);
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 891d4fcde9..4f769d69b3 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -2456,7 +2456,7 @@ void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
              */
             if (code == BUS_MCEERR_AR) {
                 kvm_cpu_synchronize_state(c);
-                if (!acpi_ghes_memory_errors(ags, ACPI_HEST_SRC_ID_SEA,
+                if (!acpi_ghes_memory_errors(ags, ACPI_HEST_SRC_ID_SYNC,
                                              paddr)) {
                     kvm_inject_arm_sea(c);
                 } else {

From 7a857a8933e073d6e0c5ae2c09ff6c45751be3d7 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:01 +0200
Subject: [PATCH 0951/2396] acpi/ghes: add a notifier to notify when error data
 is ready

Some error injection notify methods are async, like GPIO
notify. Add a notifier to be used when the error record is
ready to be sent to the guest OS.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <edf9c6e5b80dc57e3443893bf9e1eb25cb9d266b.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/ghes.c         | 5 ++++-
 include/hw/acpi/ghes.h | 3 +++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index f49d0d628f..d666f1b10b 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -510,6 +510,9 @@ static void get_ghes_source_offsets(uint16_t source_id,
     *read_ack_start_addr = le64_to_cpu(*read_ack_start_addr);
 }
 
+NotifierList acpi_generic_error_notifiers =
+    NOTIFIER_LIST_INITIALIZER(acpi_generic_error_notifiers);
+
 void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
                              uint16_t source_id, Error **errp)
 {
@@ -550,7 +553,7 @@ void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
     /* Write the generic error data entry into guest memory */
     cpu_physical_memory_write(cper_addr, cper, len);
 
-    return;
+    notifier_list_notify(&acpi_generic_error_notifiers, NULL);
 }
 
 int acpi_ghes_memory_errors(AcpiGhesState *ags, uint16_t source_id,
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 8c4b084337..390943e46d 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -24,6 +24,9 @@
 
 #include "hw/acpi/bios-linker-loader.h"
 #include "qapi/error.h"
+#include "qemu/notify.h"
+
+extern NotifierList acpi_generic_error_notifiers;
 
 /*
  * Values for Hardware Error Notification Type field

From d238dedae699a924c92228cb8b3bb8dc861008b5 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:02 +0200
Subject: [PATCH 0952/2396] acpi/generic_event_device: Update GHES migration to
 cover hest addr

The GHES migration logic should now support HEST table location too.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <ede7ddf4b10f34094a4327dc458d630ad319bd1c.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 95682b79a2..55998303c2 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -436,6 +436,34 @@ static const VMStateDescription vmstate_pcihp_state = {
     }
 };
 
+static const VMStateDescription vmstate_hest = {
+    .name = "acpi-hest",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64(hest_addr_le, AcpiGhesState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
+static bool hest_needed(void *opaque)
+{
+    AcpiGedState *s = opaque;
+    return s->ghes_state.hest_addr_le;
+}
+
+static const VMStateDescription vmstate_hest_state = {
+    .name = "acpi-ged/hest",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = hest_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_STRUCT(ghes_state, AcpiGedState, 1,
+                       vmstate_hest, AcpiGhesState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_acpi_ged = {
     .name = "acpi-ged",
     .version_id = 1,
@@ -449,6 +477,7 @@ static const VMStateDescription vmstate_acpi_ged = {
         &vmstate_cpuhp_state,
         &vmstate_ghes_state,
         &vmstate_pcihp_state,
+        &vmstate_hest_state,
         NULL
     }
 };

From f3f747ddcfc9af2c2c58f70a68723b99db82f778 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:03 +0200
Subject: [PATCH 0953/2396] acpi/generic_event_device: add logic to detect if
 HEST addr is available

Create a new property (x-has-hest-addr) and use it to detect if
the GHES table offsets can be calculated from the HEST address
(qemu 10.0 and upper) or via the legacy way via an offset obtained
from the hardware_errors firmware file.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <c4eb3cf32a3f158ae62dac29e866ac3f373956c3.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c |  2 ++
 hw/arm/virt-acpi-build.c       | 18 ++++++++++++++++--
 hw/core/machine.c              |  5 ++++-
 3 files changed, 22 insertions(+), 3 deletions(-)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index 55998303c2..b1ff6ab74d 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -349,6 +349,8 @@ static const Property acpi_ged_properties[] = {
                      pcihp_state.use_acpi_hotplug_bridge, 0),
     DEFINE_PROP_LINK("bus", AcpiGedState, pcihp_state.root,
                      TYPE_PCI_BUS, PCIBus *),
+    DEFINE_PROP_BOOL("x-has-hest-addr", AcpiGedState,
+                     ghes_state.use_hest_addr, false),
 };
 
 static const VMStateDescription vmstate_memhp_state = {
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index c856d293c6..ff3b7a794b 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1129,6 +1129,10 @@ static const AcpiNotificationSourceId hest_ghes_notify[] = {
     { ACPI_HEST_SRC_ID_SYNC, ACPI_GHES_NOTIFY_SEA },
 };
 
+static const AcpiNotificationSourceId hest_ghes_notify_10_0[] = {
+    { ACPI_HEST_SRC_ID_SYNC, ACPI_GHES_NOTIFY_SEA },
+};
+
 static
 void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
 {
@@ -1186,15 +1190,25 @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
 
     if (vms->ras) {
         AcpiGedState *acpi_ged_state;
+        static const AcpiNotificationSourceId *notify;
+        unsigned int notify_sz;
         AcpiGhesState *ags;
 
         acpi_ged_state = ACPI_GED(vms->acpi_dev);
         ags = &acpi_ged_state->ghes_state;
         if (ags) {
             acpi_add_table(table_offsets, tables_blob);
+
+            if (!ags->use_hest_addr) {
+                notify = hest_ghes_notify_10_0;
+                notify_sz = ARRAY_SIZE(hest_ghes_notify_10_0);
+            } else {
+                notify = hest_ghes_notify;
+                notify_sz = ARRAY_SIZE(hest_ghes_notify);
+            }
+
             acpi_build_hest(ags, tables_blob, tables->hardware_errors,
-                            tables->linker, hest_ghes_notify,
-                            ARRAY_SIZE(hest_ghes_notify),
+                            tables->linker, notify, notify_sz,
                             vms->oem_id, vms->oem_table_id);
         }
     }
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 38c949c4f2..7b7a381b0a 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -35,9 +35,12 @@
 #include "hw/virtio/virtio-pci.h"
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-iommu.h"
+#include "hw/acpi/generic_event_device.h"
 #include "audio/audio.h"
 
-GlobalProperty hw_compat_10_1[] = {};
+GlobalProperty hw_compat_10_1[] = {
+    { TYPE_ACPI_GED, "x-has-hest-addr", "false" },
+};
 const size_t hw_compat_10_1_len = G_N_ELEMENTS(hw_compat_10_1);
 
 GlobalProperty hw_compat_10_0[] = {

From c498a36bcb59d1f96faf4771efe8f655ff5faa20 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:04 +0200
Subject: [PATCH 0954/2396] acpi/generic_event_device: add an APEI error device

Adds a generic error device to handle generic hardware error
events as specified at ACPI 6.5 specification at 18.3.2.7.2:
https://uefi.org/specs/ACPI/6.5/18_Platform_Error_Interfaces.html#event-notification-for-generic-error-sources
using HID PNP0C33.

The PNP0C33 device is used to report hardware errors to
the guest via ACPI APEI Generic Hardware Error Source (GHES).

Co-authored-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <2790f664c849d53de0ce3049fa8c7950c1de1f86.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/aml-build.c                    | 10 ++++++++++
 hw/acpi/generic_event_device.c         | 13 +++++++++++++
 include/hw/acpi/acpi_dev_interface.h   |  1 +
 include/hw/acpi/aml-build.h            |  2 ++
 include/hw/acpi/generic_event_device.h |  1 +
 5 files changed, 27 insertions(+)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index 1e685f982f..2d5826a8f1 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -2629,3 +2629,13 @@ Aml *aml_i2c_serial_bus_device(uint16_t address, const char *resource_source)
 
     return var;
 }
+
+/* ACPI 5.0b: 18.3.2.6.2 Event Notification For Generic Error Sources */
+Aml *aml_error_device(void)
+{
+    Aml *dev = aml_device(ACPI_APEI_ERROR_DEVICE);
+    aml_append(dev, aml_name_decl("_HID", aml_string("PNP0C33")));
+    aml_append(dev, aml_name_decl("_UID", aml_int(0)));
+
+    return dev;
+}
diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index b1ff6ab74d..e575b9404b 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -30,6 +30,7 @@ static const uint32_t ged_supported_events[] = {
     ACPI_GED_NVDIMM_HOTPLUG_EVT,
     ACPI_GED_CPU_HOTPLUG_EVT,
     ACPI_GED_PCI_HOTPLUG_EVT,
+    ACPI_GED_ERROR_EVT,
 };
 
 /*
@@ -120,6 +121,16 @@ void build_ged_aml(Aml *table, const char *name, HotplugHandler *hotplug_dev,
                            aml_notify(aml_name(ACPI_POWER_BUTTON_DEVICE),
                                       aml_int(0x80)));
                 break;
+            case ACPI_GED_ERROR_EVT:
+                /*
+                 * ACPI 5.0b: 5.6.6 Device Object Notifications
+                 * Table 5-135 Error Device Notification Values
+                 * Defines 0x80 as the value to be used on notifications
+                 */
+                aml_append(if_ctx,
+                           aml_notify(aml_name(ACPI_APEI_ERROR_DEVICE),
+                                      aml_int(0x80)));
+                break;
             case ACPI_GED_NVDIMM_HOTPLUG_EVT:
                 aml_append(if_ctx,
                            aml_notify(aml_name("\\_SB.NVDR"),
@@ -320,6 +331,8 @@ static void acpi_ged_send_event(AcpiDeviceIf *adev, AcpiEventStatusBits ev)
         sel = ACPI_GED_MEM_HOTPLUG_EVT;
     } else if (ev & ACPI_POWER_DOWN_STATUS) {
         sel = ACPI_GED_PWR_DOWN_EVT;
+    } else if (ev & ACPI_GENERIC_ERROR) {
+        sel = ACPI_GED_ERROR_EVT;
     } else if (ev & ACPI_NVDIMM_HOTPLUG_STATUS) {
         sel = ACPI_GED_NVDIMM_HOTPLUG_EVT;
     } else if (ev & ACPI_CPU_HOTPLUG_STATUS) {
diff --git a/include/hw/acpi/acpi_dev_interface.h b/include/hw/acpi/acpi_dev_interface.h
index 68d9d15f50..8294f8f0cc 100644
--- a/include/hw/acpi/acpi_dev_interface.h
+++ b/include/hw/acpi/acpi_dev_interface.h
@@ -13,6 +13,7 @@ typedef enum {
     ACPI_NVDIMM_HOTPLUG_STATUS = 16,
     ACPI_VMGENID_CHANGE_STATUS = 32,
     ACPI_POWER_DOWN_STATUS = 64,
+    ACPI_GENERIC_ERROR = 128,
 } AcpiEventStatusBits;
 
 #define TYPE_ACPI_DEVICE_IF "acpi-device-interface"
diff --git a/include/hw/acpi/aml-build.h b/include/hw/acpi/aml-build.h
index c18f681342..f38e129719 100644
--- a/include/hw/acpi/aml-build.h
+++ b/include/hw/acpi/aml-build.h
@@ -252,6 +252,7 @@ struct CrsRangeSet {
 /* Consumer/Producer */
 #define AML_SERIAL_BUS_FLAG_CONSUME_ONLY        (1 << 1)
 
+#define ACPI_APEI_ERROR_DEVICE   "GEDD"
 /**
  * init_aml_allocator:
  *
@@ -382,6 +383,7 @@ Aml *aml_dma(AmlDmaType typ, AmlDmaBusMaster bm, AmlTransferSize sz,
              uint8_t channel);
 Aml *aml_sleep(uint64_t msec);
 Aml *aml_i2c_serial_bus_device(uint16_t address, const char *resource_source);
+Aml *aml_error_device(void);
 
 /* Block AML object primitives */
 Aml *aml_scope(const char *name_format, ...) G_GNUC_PRINTF(1, 2);
diff --git a/include/hw/acpi/generic_event_device.h b/include/hw/acpi/generic_event_device.h
index 2c5b055327..130c014d3f 100644
--- a/include/hw/acpi/generic_event_device.h
+++ b/include/hw/acpi/generic_event_device.h
@@ -103,6 +103,7 @@ OBJECT_DECLARE_TYPE(AcpiGedState, AcpiGedClass, ACPI_GED)
 #define ACPI_GED_NVDIMM_HOTPLUG_EVT 0x4
 #define ACPI_GED_CPU_HOTPLUG_EVT    0x8
 #define ACPI_GED_PCI_HOTPLUG_EVT    0x10
+#define ACPI_GED_ERROR_EVT          0x20
 
 typedef struct GEDState {
     MemoryRegion evt;

From c187a67c9dcdece58138f4df5ca4dd846934eddc Mon Sep 17 00:00:00 2001
From: Filip Hejsek <filip.hejsek@gmail.com>
Date: Sat, 13 Sep 2025 00:58:35 +0200
Subject: [PATCH 0955/2396] ui/gtk: Fix callback function signature
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The correct type for opaque pointer is gpointer,
not gpointer * (which is a pointer to a pointer).

Signed-off-by: Filip Hejsek <filip.hejsek@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 ui/gtk.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/ui/gtk.c b/ui/gtk.c
index 9a08cadc88..48571bedbf 100644
--- a/ui/gtk.c
+++ b/ui/gtk.c
@@ -766,9 +766,9 @@ static gboolean gd_render_event(GtkGLArea *area, GdkGLContext *context,
 }
 
 static void gd_resize_event(GtkGLArea *area,
-                            gint width, gint height, gpointer *opaque)
+                            gint width, gint height, gpointer opaque)
 {
-    VirtualConsole *vc = (void *)opaque;
+    VirtualConsole *vc = opaque;
     double pw = width, ph = height;
     double sx = vc->gfx.scale_x, sy = vc->gfx.scale_y;
     GdkWindow *window = gtk_widget_get_window(GTK_WIDGET(area));

From d56a30a7bba66de1b796af775928f77da25ca89b Mon Sep 17 00:00:00 2001
From: SillyZ <1357816113@qq.com>
Date: Tue, 16 Sep 2025 16:10:09 +0800
Subject: [PATCH 0956/2396] hw/net/can: Remove redundant status bit setting in
 can_sja1000

In PeliCAN mode reception, the RBS (Receive Buffer Status) bit
is set twice at line 842 and 845 with identical operations:
  s->status_pel |= 0x01;
  s->status_pel |= (1 << 0);

Between these two operations, only interrupt_pel is modified and
status_pel bit 4 is cleared, neither affecting bit 0. The second
operation is redundant.

This cleanup aligns PeliCAN mode with BasicCAN mode, which correctly
sets this bit only once (line 883).

Signed-off-by: SillyZ <1357816113@qq.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/net/can/can_sja1000.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c
index 5b6ba9df6c..6b08e977a1 100644
--- a/hw/net/can/can_sja1000.c
+++ b/hw/net/can/can_sja1000.c
@@ -842,7 +842,6 @@ ssize_t can_sja_receive(CanBusClientState *client, const qemu_can_frame *frames,
         s->status_pel |= 0x01; /* Set the Receive Buffer Status. DS-p23 */
         s->interrupt_pel |= 0x01;
         s->status_pel &= ~(1 << 4);
-        s->status_pel |= (1 << 0);
         can_sja_update_pel_irq(s);
     } else { /* BasicCAN mode */
 

From 383c7224839cf3acd8f1a609ad394daf7cfc8b6d Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Wed, 17 Sep 2025 17:26:45 +0300
Subject: [PATCH 0957/2396] vhost-user-test: remove trailing newlines in
 g_test_message() calls

Fixes: c9a1ea9c52 Revert "tests/qtest: use qos_printf instead of g_test_message"
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/qtest/vhost-user-test.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index 6ec4ec2d5a..609ff24059 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -391,7 +391,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * We don't need to do anything here, the remote is just
          * letting us know it is in charge. Just log it.
          */
-        g_test_message("set_owner: start of session\n");
+        g_test_message("set_owner: start of session");
         break;
 
     case VHOST_USER_GET_PROTOCOL_FEATURES:
@@ -417,7 +417,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * the remote end to send this. There is no handshake reply so
          * just log the details for debugging.
          */
-        g_test_message("set_protocol_features: 0x%"PRIx64 "\n", msg.payload.u64);
+        g_test_message("set_protocol_features: 0x%"PRIx64, msg.payload.u64);
         break;
 
         /*
@@ -425,11 +425,11 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * address of the vrings but we can simply report them.
          */
     case VHOST_USER_SET_VRING_NUM:
-        g_test_message("set_vring_num: %d/%d\n",
+        g_test_message("set_vring_num: %d/%d",
                    msg.payload.state.index, msg.payload.state.num);
         break;
     case VHOST_USER_SET_VRING_ADDR:
-        g_test_message("set_vring_addr: 0x%"PRIx64"/0x%"PRIx64"/0x%"PRIx64"\n",
+        g_test_message("set_vring_addr: 0x%"PRIx64"/0x%"PRIx64"/0x%"PRIx64,
                    msg.payload.addr.avail_user_addr,
                    msg.payload.addr.desc_user_addr,
                    msg.payload.addr.used_user_addr);
@@ -462,7 +462,7 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
     case VHOST_USER_SET_VRING_CALL:
         /* consume the fd */
         if (!qemu_chr_fe_get_msgfds(chr, &fd, 1) && fd < 0) {
-            g_test_message("call fd: %d, do not set non-blocking\n", fd);
+            g_test_message("call fd: %d, do not set non-blocking", fd);
             break;
         }
         /*
@@ -507,12 +507,12 @@ static void chr_read(void *opaque, const uint8_t *buf, int size)
          * fully functioning vhost-user we would enable/disable the
          * vring monitoring.
          */
-        g_test_message("set_vring(%d)=%s\n", msg.payload.state.index,
+        g_test_message("set_vring(%d)=%s", msg.payload.state.index,
                    msg.payload.state.num ? "enabled" : "disabled");
         break;
 
     default:
-        g_test_message("vhost-user: un-handled message: %d\n", msg.request);
+        g_test_message("vhost-user: un-handled message: %d", msg.request);
         break;
     }
 

From 1c0f5142d921525f1023152eac63d2ff3d33e3b2 Mon Sep 17 00:00:00 2001
From: ShengYi Hung <aokblast@FreeBSD.org>
Date: Mon, 15 Sep 2025 13:57:30 -0400
Subject: [PATCH 0958/2396] hid: fix incorrect return value for hid

The return value of hid_keyboard_write is used to set the packet's actual_length
and pass to xhci directly to allow guest know how many byte actually processed.
Therefore, return 1 to indicate a successful transfer or it will be
considered as a wrong xfer.

Signed-off-by: ShengYi Hung <aokblast@FreeBSD.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/input/hid.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/input/hid.c b/hw/input/hid.c
index 76bedc1844..de24cd0ef0 100644
--- a/hw/input/hid.c
+++ b/hw/input/hid.c
@@ -478,6 +478,7 @@ int hid_keyboard_write(HIDState *hs, uint8_t *buf, int len)
             ledstate |= QEMU_CAPS_LOCK_LED;
         }
         kbd_put_ledstate(ledstate);
+        return 1;
     }
     return 0;
 }

From 5240186e82b9d0f8e81f1e8f74348a4fa089998a Mon Sep 17 00:00:00 2001
From: ShengYi Hung <aokblast@FreeBSD.org>
Date: Mon, 15 Sep 2025 14:07:33 -0400
Subject: [PATCH 0959/2396] wdt_i6300esb: fix incorrect mask for interrupt type

According to Intel 6300ESB Controller Hub Datasheet 14.4.15, the interrupt
type mask should be 0x03 (0b11) instead of 0x11. In the original
implementation, when we want to disable all interrupt by setting the
value to 0x03, we will get 0x01 which is incorrect when we want to read
the value again. However, there is no problem when considering the correct
behavior since 0x01 is reserved and unused just like 0x03. This patch is
just a fix to return the register value.

Signed-off-by: ShengYi Hung <aokblast@FreeBSD.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/watchdog/wdt_i6300esb.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/watchdog/wdt_i6300esb.c b/hw/watchdog/wdt_i6300esb.c
index bb8a2766b6..3aa01b8d68 100644
--- a/hw/watchdog/wdt_i6300esb.c
+++ b/hw/watchdog/wdt_i6300esb.c
@@ -55,7 +55,7 @@
 /* Config register bits */
 #define ESB_WDT_REBOOT  (0x01 << 5)   /* Enable reboot on timeout          */
 #define ESB_WDT_FREQ    (0x01 << 2)   /* Decrement frequency               */
-#define ESB_WDT_INTTYPE (0x11 << 0)   /* Interrupt type on timer1 timeout  */
+#define ESB_WDT_INTTYPE (0x03 << 0)   /* Interrupt type on timer1 timeout  */
 
 /* Reload register bits */
 #define ESB_WDT_RELOAD  (0x01 << 8)    /* prevent timeout                   */

From f65918497cc6b9034ce8f81a4df1d6407e110367 Mon Sep 17 00:00:00 2001
From: nanliu <nanliu@redhat.com>
Date: Mon, 22 Sep 2025 14:57:14 +0800
Subject: [PATCH 0960/2396] docs/devel: Correct uefi-vars-x64 device name

The documentation for UEFI variable storage in uefi-vars.rst
incorrectly listed the device name as `uefi-vars-x86`.

The correct device name as implemented in the source code is
`uefi-vars-x64`.

This commit updates the documentation to use the correct name,
aligning it with the implementation.

Signed-off-by: Nana Liu <nanliu@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/devel/uefi-vars.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/uefi-vars.rst b/docs/devel/uefi-vars.rst
index 0151a26a0a..b4013b5d12 100644
--- a/docs/devel/uefi-vars.rst
+++ b/docs/devel/uefi-vars.rst
@@ -34,7 +34,7 @@ configures the shared buffer location and size, and traps to the host
 to process the requests.
 
 The ``uefi-vars`` device implements the UEFI virtual device.  It comes
-in ``uefi-vars-x86`` and ``uefi-vars-sysbus`` flavours.  The device
+in ``uefi-vars-x64`` and ``uefi-vars-sysbus`` flavours.  The device
 reimplements the handlers needed, specifically
 ``EfiSmmVariableProtocol`` and ``VarCheckPolicyLibMmiHandler``.  It
 also consumes events (``EfiEndOfDxeEventGroup``,
@@ -57,7 +57,7 @@ usage on x86_64
 .. code::
 
    qemu-system-x86_64 \
-      -device uefi-vars-x86,jsonfile=/path/to/vars.json
+      -device uefi-vars-x64,jsonfile=/path/to/vars.json
 
 usage on aarch64
 ----------------

From 9348c33779a7313c5fc8b24935d71f920138e3d7 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 23 Sep 2025 13:01:18 +0100
Subject: [PATCH 0961/2396] docs/specs/spdm.rst: Fix typo in x86_64
 architecture name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The spdm.rst docs call the 64-bit x86 architecture "x64-64".
This is a typo; correct it to our canonical name for the
architecture, "x86_64".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/specs/spdm.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/specs/spdm.rst b/docs/specs/spdm.rst
index f7de080ff0..0e3ad25bc6 100644
--- a/docs/specs/spdm.rst
+++ b/docs/specs/spdm.rst
@@ -102,7 +102,7 @@ Then you can add this to your QEMU command line:
 
 At which point QEMU will try to connect to the SPDM server.
 
-Note that if using x64-64 you will want to use the q35 machine instead
+Note that if using x86_64 you will want to use the q35 machine instead
 of the default. So the entire QEMU command might look like this
 
 .. code-block:: shell

From 0af5926a0feb0b69a127f5c24eaa605408fed2ec Mon Sep 17 00:00:00 2001
From: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Date: Thu, 2 Oct 2025 16:41:45 +0200
Subject: [PATCH 0962/2396] system/runstate: remove duplicate in runstate
 transitions

Remove duplicate entry PRELAUNCH->INMIGRATE from runstate_transitions_def.
Move PRELAUNCH->SUSPENDED entry with all the other PRELAUNCH->XXX entries.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 system/runstate.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/system/runstate.c b/system/runstate.c
index 6178b0091a..32467aa882 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -76,9 +76,6 @@ typedef struct {
 } RunStateTransition;
 
 static const RunStateTransition runstate_transitions_def[] = {
-    { RUN_STATE_PRELAUNCH, RUN_STATE_INMIGRATE },
-    { RUN_STATE_PRELAUNCH, RUN_STATE_SUSPENDED },
-
     { RUN_STATE_DEBUG, RUN_STATE_RUNNING },
     { RUN_STATE_DEBUG, RUN_STATE_FINISH_MIGRATE },
     { RUN_STATE_DEBUG, RUN_STATE_PRELAUNCH },
@@ -118,6 +115,7 @@ static const RunStateTransition runstate_transitions_def[] = {
     { RUN_STATE_PRELAUNCH, RUN_STATE_RUNNING },
     { RUN_STATE_PRELAUNCH, RUN_STATE_FINISH_MIGRATE },
     { RUN_STATE_PRELAUNCH, RUN_STATE_INMIGRATE },
+    { RUN_STATE_PRELAUNCH, RUN_STATE_SUSPENDED },
 
     { RUN_STATE_FINISH_MIGRATE, RUN_STATE_RUNNING },
     { RUN_STATE_FINISH_MIGRATE, RUN_STATE_PAUSED },

From 79b10b6639456d244118cf564214495637494931 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:05 +0200
Subject: [PATCH 0963/2396] tests/acpi: virt: allow acpi table changes at DSDT
 and HEST tables

We'll be adding a new GED device for HEST GPIO notification and
increasing the number of entries at the HEST table.

Blocklist testing HEST and DSDT tables until such changes
are completed.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <7fca7eb9b801f1b196210f66538234b94bd31c23.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..cb4b0a9469 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,12 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/HEST",
+"tests/data/acpi/aarch64/virt/DSDT",
+"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
+"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
+"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",
+"tests/data/acpi/aarch64/virt/DSDT.memhp",
+"tests/data/acpi/aarch64/virt/DSDT.pxb",
+"tests/data/acpi/aarch64/virt/DSDT.topology",
+"tests/data/acpi/aarch64/virt/DSDT.viot",
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",

From d352e33e1f92e60e12a00be1ea80f47b4e024c88 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:06 +0200
Subject: [PATCH 0964/2396] arm/virt: Wire up a GED error device for ACPI /
 GHES

Adds support to ARM virtualization to allow handling
generic error ACPI Event via GED & error source device.

It is aligned with Linux Kernel patch:
https://lore.kernel.org/lkml/1272350481-27951-8-git-send-email-ying.huang@intel.com/

Co-authored-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <3237a76b1469d669436399495825348bf34122cd.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt-acpi-build.c |  1 +
 hw/arm/virt.c            | 12 +++++++++++-
 include/hw/arm/virt.h    |  1 +
 3 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index ff3b7a794b..2b63008df0 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1066,6 +1066,7 @@ build_dsdt(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     }
 
     acpi_dsdt_add_power_button(scope);
+    aml_append(scope, aml_error_device());
 #ifdef CONFIG_TPM
     acpi_dsdt_add_tpm(scope, vms);
 #endif
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 02209fadcf..6960f6113f 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -693,7 +693,7 @@ static inline DeviceState *create_acpi_ged(VirtMachineState *vms)
     MachineState *ms = MACHINE(vms);
     SysBusDevice *sbdev;
     int irq = vms->irqmap[VIRT_ACPI_GED];
-    uint32_t event = ACPI_GED_PWR_DOWN_EVT;
+    uint32_t event = ACPI_GED_PWR_DOWN_EVT | ACPI_GED_ERROR_EVT;
     bool acpi_pcihp;
 
     if (ms->ram_slots) {
@@ -1050,6 +1050,13 @@ static void virt_powerdown_req(Notifier *n, void *opaque)
     }
 }
 
+static void virt_generic_error_req(Notifier *n, void *opaque)
+{
+    VirtMachineState *s = container_of(n, VirtMachineState, generic_error_notifier);
+
+    acpi_send_event(s->acpi_dev, ACPI_GENERIC_ERROR);
+}
+
 static void create_gpio_keys(char *fdt, DeviceState *pl061_dev,
                              uint32_t phandle)
 {
@@ -2500,6 +2507,9 @@ static void machvirt_init(MachineState *machine)
 
     if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
         vms->acpi_dev = create_acpi_ged(vms);
+        vms->generic_error_notifier.notify = virt_generic_error_req;
+        notifier_list_add(&acpi_generic_error_notifiers,
+                          &vms->generic_error_notifier);
     } else {
         create_gpio_devices(vms, VIRT_GPIO, sysmem);
     }
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index ea2cff05b0..e14ea0f9d4 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -174,6 +174,7 @@ struct VirtMachineState {
     DeviceState *gic;
     DeviceState *acpi_dev;
     Notifier powerdown_notifier;
+    Notifier generic_error_notifier;
     PCIBus *bus;
     char *oem_id;
     char *oem_table_id;

From ddd8f3baa27dc05251f52e94d1b643bfb93cbc83 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:07 +0200
Subject: [PATCH 0965/2396] qapi/acpi-hest: add an interface to do generic CPER
 error injection

Create a QMP command to be used for generic ACPI APEI hardware error
injection (HEST) via GHESv2, and add support for it for ARM guests.

Error injection uses ACPI_HEST_SRC_ID_QMP source ID to be platform
independent. This is mapped at arch virt bindings, depending on the
types supported by QEMU and by the BIOS. So, on ARM, this is supported
via ACPI_GHES_NOTIFY_GPIO notification type.

This patch was co-authored:
    - original ghes logic to inject a simple ARM record by Shiju Jose;
    - generic logic to handle block addresses by Jonathan Cameron;
    - generic GHESv2 error inject by Mauro Carvalho Chehab;

Co-authored-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Co-authored-by: Shiju Jose <shiju.jose@huawei.com>
Co-authored-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Signed-off-by: Shiju Jose <shiju.jose@huawei.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <81e2118b3c8b7e5da341817f277d61251655e0db.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS              |  7 +++++++
 hw/acpi/Kconfig          |  5 +++++
 hw/acpi/ghes.c           |  2 +-
 hw/acpi/ghes_cper.c      | 40 ++++++++++++++++++++++++++++++++++++++++
 hw/acpi/ghes_cper_stub.c | 20 ++++++++++++++++++++
 hw/acpi/meson.build      |  2 ++
 hw/arm/virt-acpi-build.c |  1 +
 hw/arm/virt.c            |  7 +++++++
 include/hw/acpi/ghes.h   |  1 +
 include/hw/arm/virt.h    |  1 +
 qapi/acpi-hest.json      | 36 ++++++++++++++++++++++++++++++++++++
 qapi/meson.build         |  1 +
 qapi/qapi-schema.json    |  1 +
 13 files changed, 123 insertions(+), 1 deletion(-)
 create mode 100644 hw/acpi/ghes_cper.c
 create mode 100644 hw/acpi/ghes_cper_stub.c
 create mode 100644 qapi/acpi-hest.json

diff --git a/MAINTAINERS b/MAINTAINERS
index 406cef88f0..b31ae5193d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2173,6 +2173,13 @@ F: hw/acpi/ghes.c
 F: include/hw/acpi/ghes.h
 F: docs/specs/acpi_hest_ghes.rst
 
+ACPI/HEST/GHES/ARM processor CPER
+R: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+S: Maintained
+F: hw/arm/ghes_cper.c
+F: hw/acpi/ghes_cper_stub.c
+F: qapi/acpi-hest.json
+
 ppc4xx
 L: qemu-ppc@nongnu.org
 S: Orphan
diff --git a/hw/acpi/Kconfig b/hw/acpi/Kconfig
index 1d4e9f0845..daabbe6cd1 100644
--- a/hw/acpi/Kconfig
+++ b/hw/acpi/Kconfig
@@ -51,6 +51,11 @@ config ACPI_APEI
     bool
     depends on ACPI
 
+config GHES_CPER
+    bool
+    depends on ACPI_APEI
+    default y
+
 config ACPI_PCI
     bool
     depends on ACPI && PCI
diff --git a/hw/acpi/ghes.c b/hw/acpi/ghes.c
index d666f1b10b..06555905ce 100644
--- a/hw/acpi/ghes.c
+++ b/hw/acpi/ghes.c
@@ -553,7 +553,7 @@ void ghes_record_cper_errors(AcpiGhesState *ags, const void *cper, size_t len,
     /* Write the generic error data entry into guest memory */
     cpu_physical_memory_write(cper_addr, cper, len);
 
-    notifier_list_notify(&acpi_generic_error_notifiers, NULL);
+    notifier_list_notify(&acpi_generic_error_notifiers, &source_id);
 }
 
 int acpi_ghes_memory_errors(AcpiGhesState *ags, uint16_t source_id,
diff --git a/hw/acpi/ghes_cper.c b/hw/acpi/ghes_cper.c
new file mode 100644
index 0000000000..31cb2ffabe
--- /dev/null
+++ b/hw/acpi/ghes_cper.c
@@ -0,0 +1,40 @@
+/*
+ * CPER payload parser for error injection
+ *
+ * Copyright(C) 2024-2025 Huawei LTD.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "qemu/base64.h"
+#include "qemu/error-report.h"
+#include "qemu/uuid.h"
+#include "qapi/qapi-commands-acpi-hest.h"
+#include "hw/acpi/ghes.h"
+
+void qmp_inject_ghes_v2_error(const char *qmp_cper, Error **errp)
+{
+    AcpiGhesState *ags;
+    uint8_t *cper;
+    size_t  len;
+
+    ags = acpi_ghes_get_state();
+    if (!ags) {
+        return;
+    }
+
+    cper = qbase64_decode(qmp_cper, -1, &len, errp);
+    if (!cper) {
+        error_setg(errp, "missing GHES CPER payload");
+        return;
+    }
+
+    ghes_record_cper_errors(ags, cper, len, ACPI_HEST_SRC_ID_QMP, errp);
+
+    g_free(cper);
+}
diff --git a/hw/acpi/ghes_cper_stub.c b/hw/acpi/ghes_cper_stub.c
new file mode 100644
index 0000000000..b16be73502
--- /dev/null
+++ b/hw/acpi/ghes_cper_stub.c
@@ -0,0 +1,20 @@
+/*
+ * Stub interface for CPER payload parser for error injection
+ *
+ * Copyright(C) 2024-2025 Huawei LTD.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qapi-commands-acpi-hest.h"
+#include "hw/acpi/ghes.h"
+
+void qmp_inject_ghes_v2_error(const char *cper, Error **errp)
+{
+    error_setg(errp, "GHES QMP error inject is not compiled in");
+}
diff --git a/hw/acpi/meson.build b/hw/acpi/meson.build
index 73f02b9691..56b5d1ec96 100644
--- a/hw/acpi/meson.build
+++ b/hw/acpi/meson.build
@@ -34,4 +34,6 @@ endif
 system_ss.add(when: 'CONFIG_ACPI', if_false: files('acpi-stub.c', 'aml-build-stub.c', 'ghes-stub.c', 'acpi_interface.c'))
 system_ss.add(when: 'CONFIG_ACPI_PCI_BRIDGE', if_false: files('pci-bridge-stub.c'))
 system_ss.add_all(when: 'CONFIG_ACPI', if_true: acpi_ss)
+system_ss.add(when: 'CONFIG_GHES_CPER', if_true: files('ghes_cper.c'))
+system_ss.add(when: 'CONFIG_GHES_CPER', if_false: files('ghes_cper_stub.c'))
 system_ss.add(files('acpi-qmp-cmds.c'))
diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 2b63008df0..8bb6b60515 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -1128,6 +1128,7 @@ static void acpi_align_size(GArray *blob, unsigned align)
 
 static const AcpiNotificationSourceId hest_ghes_notify[] = {
     { ACPI_HEST_SRC_ID_SYNC, ACPI_GHES_NOTIFY_SEA },
+    { ACPI_HEST_SRC_ID_QMP, ACPI_GHES_NOTIFY_GPIO },
 };
 
 static const AcpiNotificationSourceId hest_ghes_notify_10_0[] = {
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6960f6113f..aad557be1a 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1052,6 +1052,13 @@ static void virt_powerdown_req(Notifier *n, void *opaque)
 
 static void virt_generic_error_req(Notifier *n, void *opaque)
 {
+    uint16_t *source_id = opaque;
+
+    /* Currently, only QMP source ID is async */
+    if (*source_id != ACPI_HEST_SRC_ID_QMP) {
+        return;
+    }
+
     VirtMachineState *s = container_of(n, VirtMachineState, generic_error_notifier);
 
     acpi_send_event(s->acpi_dev, ACPI_GENERIC_ERROR);
diff --git a/include/hw/acpi/ghes.h b/include/hw/acpi/ghes.h
index 390943e46d..df2ecbf6e4 100644
--- a/include/hw/acpi/ghes.h
+++ b/include/hw/acpi/ghes.h
@@ -65,6 +65,7 @@ enum AcpiGhesNotifyType {
  */
 enum AcpiGhesSourceID {
     ACPI_HEST_SRC_ID_SYNC,
+    ACPI_HEST_SRC_ID_QMP,       /* Use it only for QMP injected errors */
 };
 
 typedef struct AcpiNotificationSourceId {
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index e14ea0f9d4..04a09af354 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -33,6 +33,7 @@
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 #include "hw/boards.h"
+#include "hw/acpi/ghes.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/bsa.h"
 #include "hw/block/flash.h"
diff --git a/qapi/acpi-hest.json b/qapi/acpi-hest.json
new file mode 100644
index 0000000000..28af1266a7
--- /dev/null
+++ b/qapi/acpi-hest.json
@@ -0,0 +1,36 @@
+# -*- Mode: Python -*-
+# vim: filetype=python
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+##
+# == GHESv2 CPER Error Injection
+#
+# Defined since ACPI Specification 6.1,
+# section 18.3.2.8 Generic Hardware Error Source version 2. See:
+#
+# https://uefi.org/sites/default/files/resources/ACPI_6_1.pdf
+##
+
+
+##
+# @inject-ghes-v2-error:
+#
+# Inject an error with additional ACPI 6.1 GHESv2 error information
+#
+# @cper: contains a base64 encoded string with raw data for a single
+#     CPER record with Generic Error Status Block, Generic Error Data
+#     Entry and generic error data payload, as described at
+#     https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html#format
+#
+# Features:
+#
+# @unstable: This command is experimental.
+#
+# Since: 10.2
+##
+{ 'command': 'inject-ghes-v2-error',
+  'data': {
+    'cper': 'str'
+  },
+  'features': [ 'unstable' ]
+}
diff --git a/qapi/meson.build b/qapi/meson.build
index ca6b61a608..a46269b5a0 100644
--- a/qapi/meson.build
+++ b/qapi/meson.build
@@ -59,6 +59,7 @@ if have_system
   qapi_all_modules += [
     'accelerator',
     'acpi',
+    'acpi-hest',
     'audio',
     'cryptodev',
     'qdev',
diff --git a/qapi/qapi-schema.json b/qapi/qapi-schema.json
index 82f111ba06..b93dd68d94 100644
--- a/qapi/qapi-schema.json
+++ b/qapi/qapi-schema.json
@@ -68,6 +68,7 @@
 { 'include': 'misc-i386.json' }
 { 'include': 'audio.json' }
 { 'include': 'acpi.json' }
+{ 'include': 'acpi-hest.json' }
 { 'include': 'pci.json' }
 { 'include': 'stats.json' }
 { 'include': 'virtio.json' }

From ecd06271dc3ec2e1963f9c294201fc6337ca7779 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:08 +0200
Subject: [PATCH 0966/2396] acpi/generic_event_device.c: enable use_hest_addr
 for QEMU 10.x

Now that we have everything in place, enable using HEST GPA
instead of etc/hardware_errors GPA.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <ad77b64aa1f09141efe942539445908631423975.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/acpi/generic_event_device.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/acpi/generic_event_device.c b/hw/acpi/generic_event_device.c
index e575b9404b..e7b773d84d 100644
--- a/hw/acpi/generic_event_device.c
+++ b/hw/acpi/generic_event_device.c
@@ -363,7 +363,7 @@ static const Property acpi_ged_properties[] = {
     DEFINE_PROP_LINK("bus", AcpiGedState, pcihp_state.root,
                      TYPE_PCI_BUS, PCIBus *),
     DEFINE_PROP_BOOL("x-has-hest-addr", AcpiGedState,
-                     ghes_state.use_hest_addr, false),
+                     ghes_state.use_hest_addr, true),
 };
 
 static const VMStateDescription vmstate_memhp_state = {

From 237ca3d57898e4438bc3af6cd87f0a3279198bae Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:09 +0200
Subject: [PATCH 0967/2396] tests/acpi: virt: update HEST and DSDT tables

The following changes for DSDT affecting all files
under tests/data/acpi/aarch64/virt/DSDT* :

    -"tests/data/acpi/aarch64/virt/DSDT",
    -"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
    -"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
    -"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",
    -"tests/data/acpi/aarch64/virt/DSDT.memhp",
    -"tests/data/acpi/aarch64/virt/DSDT.pxb",
    -"tests/data/acpi/aarch64/virt/DSDT.topology",
    -"tests/data/acpi/aarch64/virt/DSDT.viot",
    -"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
    -"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",

    --- /tmp/DSDT_old.dsl   2025-09-05 15:03:18.964968499 +0200
    +++ /tmp/DSDT.dsl       2025-09-05 15:03:18.966968470 +0200
    @@ -1886,6 +1886,11 @@
                     {
                         Notify (PWRB, 0x80) // Status Change
                     }
    +
    +                If (((Local0 & 0x20) == 0x20))
    +                {
    +                    Notify (GEDD, 0x80) // Status Change
    +                }
                 }
             }

    @@ -1894,6 +1899,12 @@
                 Name (_HID, "PNP0C0C" /* Power Button Device */)  // _HID: Hardware ID
                 Name (_UID, Zero)  // _UID: Unique ID
             }
    +
    +        Device (GEDD)
    +        {
    +            Name (_HID, "PNP0C33" /* Error Device */)  // _HID: Hardware ID
    +            Name (_UID, Zero)  // _UID: Unique ID
    +        }
         }

         Scope (\_SB.PCI0)

Additionally, HEST changes:
    -"tests/data/acpi/aarch64/virt/HEST",

    --- /tmp/HEST_old.dsl   2025-09-05 15:03:19.078653625 +0200
    +++ /tmp/HEST.dsl       2025-09-05 15:03:19.079511472 +0200
    @@ -3,7 +3,7 @@
      * AML/ASL+ Disassembler version 20240322 (64-bit version)
      * Copyright (c) 2000 - 2023 Intel Corporation
      *
    - * Disassembly of /tmp/HEST_old
    + * Disassembly of /tmp/HEST
      *
      * ACPI Data Table [HEST]
      *
    @@ -11,16 +11,16 @@
      */

     [000h 0000 004h]                   Signature : "HEST"    [Hardware Error Source Table]
    -[004h 0004 004h]                Table Length : 00000084
    +[004h 0004 004h]                Table Length : 000000E0
     [008h 0008 001h]                    Revision : 01
    -[009h 0009 001h]                    Checksum : E2
    +[009h 0009 001h]                    Checksum : 6C
     [00Ah 0010 006h]                      Oem ID : "BOCHS "
     [010h 0016 008h]                Oem Table ID : "BXPC    "
     [018h 0024 004h]                Oem Revision : 00000001
     [01Ch 0028 004h]             Asl Compiler ID : "BXPC"
     [020h 0032 004h]       Asl Compiler Revision : 00000001

    -[024h 0036 004h]          Error Source Count : 00000001
    +[024h 0036 004h]          Error Source Count : 00000002

     [028h 0040 002h]               Subtable Type : 000A [Generic Hardware Error Source V2]
     [02Ah 0042 002h]                   Source Id : 0000
    @@ -55,19 +55,62 @@
     [069h 0105 001h]                   Bit Width : 40
     [06Ah 0106 001h]                  Bit Offset : 00
     [06Bh 0107 001h]        Encoded Access Width : 04 [QWord Access:64]
    -[06Ch 0108 008h]                     Address : 0000000043DA0008
    +[06Ch 0108 008h]                     Address : 0000000043DA0010

     [074h 0116 008h]           Read Ack Preserve : FFFFFFFFFFFFFFFE
     [07Ch 0124 008h]              Read Ack Write : 0000000000000001

    -Raw Table Data: Length 132 (0x84)
    +[084h 0132 002h]               Subtable Type : 000A [Generic Hardware Error Source V2]
    +[086h 0134 002h]                   Source Id : 0001
    +[088h 0136 002h]           Related Source Id : FFFF
    +[08Ah 0138 001h]                    Reserved : 00
    +[08Bh 0139 001h]                     Enabled : 01
    +[08Ch 0140 004h]      Records To Preallocate : 00000001
    +[090h 0144 004h]     Max Sections Per Record : 00000001
    +[094h 0148 004h]         Max Raw Data Length : 00000400
    +
    +[098h 0152 00Ch]        Error Status Address : [Generic Address Structure]
    +[098h 0152 001h]                    Space ID : 00 [SystemMemory]
    +[099h 0153 001h]                   Bit Width : 40
    +[09Ah 0154 001h]                  Bit Offset : 00
    +[09Bh 0155 001h]        Encoded Access Width : 04 [QWord Access:64]
    +[09Ch 0156 008h]                     Address : 0000000043DA0008
    +
    +[0A4h 0164 01Ch]                      Notify : [Hardware Error Notification Structure]
    +[0A4h 0164 001h]                 Notify Type : 07 [GPIO]
    +[0A5h 0165 001h]               Notify Length : 1C
    +[0A6h 0166 002h]  Configuration Write Enable : 0000
    +[0A8h 0168 004h]                PollInterval : 00000000
    +[0ACh 0172 004h]                      Vector : 00000000
    +[0B0h 0176 004h]     Polling Threshold Value : 00000000
    +[0B4h 0180 004h]    Polling Threshold Window : 00000000
    +[0B8h 0184 004h]       Error Threshold Value : 00000000
    +[0BCh 0188 004h]      Error Threshold Window : 00000000
    +
    +[0C0h 0192 004h]   Error Status Block Length : 00000400
    +[0C4h 0196 00Ch]           Read Ack Register : [Generic Address Structure]
    +[0C4h 0196 001h]                    Space ID : 00 [SystemMemory]
    +[0C5h 0197 001h]                   Bit Width : 40
    +[0C6h 0198 001h]                  Bit Offset : 00
    +[0C7h 0199 001h]        Encoded Access Width : 04 [QWord Access:64]
    +[0C8h 0200 008h]                     Address : 0000000043DA0018

    -    0000: 48 45 53 54 84 00 00 00 01 E2 42 4F 43 48 53 20  // HEST......BOCHS
    +[0D0h 0208 008h]           Read Ack Preserve : FFFFFFFFFFFFFFFE
    +[0D8h 0216 008h]              Read Ack Write : 0000000000000001
    +
    +Raw Table Data: Length 224 (0xE0)
    +
    +    0000: 48 45 53 54 E0 00 00 00 01 6C 42 4F 43 48 53 20  // HEST.....lBOCHS
         0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
    -    0020: 01 00 00 00 01 00 00 00 0A 00 00 00 FF FF 00 01  // ................
    +    0020: 01 00 00 00 02 00 00 00 0A 00 00 00 FF FF 00 01  // ................
         0030: 01 00 00 00 01 00 00 00 00 04 00 00 00 40 00 04  // .............@..
         0040: 00 00 DA 43 00 00 00 00 08 1C 00 00 00 00 00 00  // ...C............
         0050: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
    -    0060: 00 00 00 00 00 04 00 00 00 40 00 04 08 00 DA 43  // .........@.....C
    +    0060: 00 00 00 00 00 04 00 00 00 40 00 04 10 00 DA 43  // .........@.....C
         0070: 00 00 00 00 FE FF FF FF FF FF FF FF 01 00 00 00  // ................
    -    0080: 00 00 00 00                                      // ....
    +    0080: 00 00 00 00 0A 00 01 00 FF FF 00 01 01 00 00 00  // ................
    +    0090: 01 00 00 00 00 04 00 00 00 40 00 04 08 00 DA 43  // .........@.....C
    +    00A0: 00 00 00 00 07 1C 00 00 00 00 00 00 00 00 00 00  // ................
    +    00B0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
    +    00C0: 00 04 00 00 00 40 00 04 18 00 DA 43 00 00 00 00  // .....@.....C....
    +    00D0: FE FF FF FF FF FF FF FF 01 00 00 00 00 00 00 00  // ................

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <2253eb50df797ab320b4ca610bd22a38e5cfd17a.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/data/acpi/aarch64/virt/DSDT             | Bin 5293 -> 5337 bytes
 .../data/acpi/aarch64/virt/DSDT.acpihmatvirt  | Bin 5379 -> 5423 bytes
 tests/data/acpi/aarch64/virt/DSDT.acpipcihp   | Bin 6202 -> 6246 bytes
 .../acpi/aarch64/virt/DSDT.hpoffacpiindex     | Bin 5347 -> 5391 bytes
 tests/data/acpi/aarch64/virt/DSDT.memhp       | Bin 6654 -> 6698 bytes
 tests/data/acpi/aarch64/virt/DSDT.pxb         | Bin 7768 -> 7812 bytes
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev  | Bin 10230 -> 10274 bytes
 .../data/acpi/aarch64/virt/DSDT.smmuv3-legacy | Bin 10230 -> 10274 bytes
 tests/data/acpi/aarch64/virt/DSDT.topology    | Bin 5495 -> 5539 bytes
 tests/data/acpi/aarch64/virt/DSDT.viot        | Bin 5310 -> 5354 bytes
 tests/data/acpi/aarch64/virt/HEST             | Bin 132 -> 224 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |  11 -----------
 12 files changed, 11 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT b/tests/data/acpi/aarch64/virt/DSDT
index 18d97e8f22979411a528705c0e314acb424bbfa5..38f01adb61e6e4704821cee5e397888bb6b7e46d 100644
GIT binary patch
delta 83
zcmZ3hc~g_iCD<k8rU(NA(~^l?(oDTh8`X=1nVdN$&lV15)SLWXScZRrz~t%#E(HcI
lg*JCr7njMLBC;aUO_CrsN4$rp3vYm5fPu5I@nm_CJ^<pE7PJ5W

delta 46
zcmcbqxmJ_QCD<iotq21H)2oSG(oBsG8`X=1nVi@s&lV15l%4!uSZ1<}i1g$jk#+z^
C-wmMv

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt b/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt
index 2cef095bcc1bb404f8cd9ec77a879ed81c191875..37a9af713b94a3fd34907dc86c40aaa79e93239c 100644
GIT binary patch
delta 106
zcmZqHTCc_B66_M9FUr8cls}P6nyJ}iqxuP9CTEVxABBT;^x|E^LO2UtgI#?R76?qP
zPT*o<;9_bE2oG}NYJdnRFmNffxx2c!OpX_k6^U+=1hF~dJv?1_1N;IEoQ;hqmx}ZO
E01$>96aWAK

delta 68
zcmZ3l)vU$k66_MfEXu&Zv}_`mG*i3lM)ecIOit{RKMDs+%f`Egg>V+Q2D|zsED)Gn
YoxsJ!z{S)S5FX?-xj;mA@(Pi50D|okbpQYW

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpipcihp b/tests/data/acpi/aarch64/virt/DSDT.acpipcihp
index 8d55a877a40cb4c4dffdc70378204e12d2261a75..04427e2d8eb8d2db0a7ae3dbe546d9072406d09b 100644
GIT binary patch
delta 87
zcmdmG@XUbACD<h-O@e`esbC_PG*h?RM)e|LCP$vhvxS41eAp&`5RMdFATYT)flGmb
pOQFr()y0LYVX~))v`BQ5B#6fm@8Rjf8{ijU;B0KXIacH@GXO1n7#aWo

delta 48
zcmaE6u*-nUCD<jzN`irbX~sk@X{LVXjp{|hOb*<WXA1{2d9zObARIY4N<@0|1d(gZ
E098B=djJ3c

diff --git a/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex b/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex
index 970d43f68bca060361105f70dbb00b3a25646db4..43ab60496e5a06706d4626d9e7b58b2d7e809e75 100644
GIT binary patch
delta 83
zcmaE?*{{Xr66_MfFUr8c<UNr~nyJ@mqk54rlQYNU*}}n$dXwJ^%kVD{m|UH}rNF?Y
l(B|&y;xd_2L{=oaNfN~7i1+Yx;SKN$FmN_Do-8kN1OSU26}12W

delta 46
zcmeCzdaTLi66_N4ScHLrY0^Y4X{JVpjp{|hOit{RXA1{2%1(YSEHha~M0#?N$X)<I
C3=N_H

diff --git a/tests/data/acpi/aarch64/virt/DSDT.memhp b/tests/data/acpi/aarch64/virt/DSDT.memhp
index 372ca3d7fb1e2927c7c12f97eec406d597f294ab..3c391674446167bc9c79fd5dcb1c37e80cc7bbae 100644
GIT binary patch
delta 85
zcmexoyvl^jCD<iIONxPk>GDJ_X{NsE8`X=1nVh&M&lV15@@1X;LD-9bfxzVI1TF;z
nE`>ICR~MJf79#enBGFBfAPz^oho=i~fM0-tv$65y0?9rA9#a?T

delta 48
zcmZ2w^3RydCD<k8pCkhV6Zb?eX{M&B8`X=1nH;$$&lV15@?n|$LD*}vw}>t4<i(Qh
E0BCy-)&Kwi

diff --git a/tests/data/acpi/aarch64/virt/DSDT.pxb b/tests/data/acpi/aarch64/virt/DSDT.pxb
index c2779882494e16920787b8ab7b4cb3c3b70f224b..71c632cedcca63a77a4cdde53d9bc392102687b6 100644
GIT binary patch
delta 107
zcmca%(_+iz66_MvBFDhMBs`HznyKsdM)m(POwJsWHDrSs^(NQI$~Y_#m|UH}rNF?Y
z(B|&y;=<Js-6R<h9^}Lk@8Rjf8{ijU;B4T`z!4wn>B11*BneW3BxP(od5!EE06qd8
AQ~&?~

delta 46
zcmZp%y<x-U66_KZA;-YL<Ta5?nyK%`M)m(POit{RHDrSsWhd9j%1mA<D?RzX>{0+f
CX%1!p

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
index 53d4c07f423886d8c4b57f1da6498eef5a08b556..e8c2b376df7bddc2392945ea8cbb550b3d3b5e26 100644
GIT binary patch
delta 107
zcmez7zbJsqCD<iINrQobX~je?X{Pp)jp{vWOwJsWx2gp*>P_ZUmvLAiFu6K`OM!t)
zq0QaZ#f7UOx=Au1JjjV7-ow*{H^48zz}di=fg?WD(}f|rNfM+6Ny^xGvZeZ707Eq#
A^#A|>

delta 63
zcmZ1!@XepgCD<k8n>qsn(}Rgz(oEfj8`XQ%n4H)rZ&eFsl%33}E+Z1%BpDDM<irv0
T;pxH~;1^)vY~VaORedi2dNUIB

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
index 53d4c07f423886d8c4b57f1da6498eef5a08b556..e8c2b376df7bddc2392945ea8cbb550b3d3b5e26 100644
GIT binary patch
delta 107
zcmez7zbJsqCD<iINrQobX~je?X{Pp)jp{vWOwJsWx2gp*>P_ZUmvLAiFu6K`OM!t)
zq0QaZ#f7UOx=Au1JjjV7-ow*{H^48zz}di=fg?WD(}f|rNfM+6Ny^xGvZeZ707Eq#
A^#A|>

delta 63
zcmZ1!@XepgCD<k8n>qsn(}Rgz(oEfj8`XQ%n4H)rZ&eFsl%33}E+Z1%BpDDM<irv0
T;pxH~;1^)vY~VaORedi2dNUIB

diff --git a/tests/data/acpi/aarch64/virt/DSDT.topology b/tests/data/acpi/aarch64/virt/DSDT.topology
index ebbeedc1ed30d811315c350f4cb42f8aa265af73..9f22cd3dc81efe3ebcb8caf913842a8dea910627 100644
GIT binary patch
delta 107
zcmeyawOE_WCD<iou_yxr(~OB+(oF6C8`W(@n4CE#r-}qK>P_A$BIB??U~+W=mjVNq
zLYup*iwjpnbdzL2c#soEyoaX?Z-8HbfwO@#14n$Qrwc=LlO#wDl9aLW<d-6S04<Rn
AEdT%j

delta 63
zcmZ3i{auU8CD<jTT$F)<>HI`4X{K(Ujp{ZcOit{RQ$>OqWhd_xkr9b*k_-qBa^i^h
T@O0q~@Cz_-HgKLSD%uACG~E#{

diff --git a/tests/data/acpi/aarch64/virt/DSDT.viot b/tests/data/acpi/aarch64/virt/DSDT.viot
index b897d667971500da4732000091a6f0828d05d89e..dd3775a0762ae1a5ddb89dd656d81eee581dccb6 100644
GIT binary patch
delta 83
zcmdm|`AU<^CD<k8l?Vd^liNftX{KJMjp{|hOwJsWXA1{2>P>zxEW^J*U~+W=mjVNq
lLYup*i_2tA5m}MwCP@&RBi_T)g*U)2z`)tqc(T06d;r-X7McJ6

delta 46
zcmaE*xlfbJCD<iop9lj3Q_n;$X{JVpjp{|hOit{RXA1{2%1(YSEHha~M0#?N$P55O
CpAClq

diff --git a/tests/data/acpi/aarch64/virt/HEST b/tests/data/acpi/aarch64/virt/HEST
index 4c5d8c5b5da5b3241f93cd0839e94272bf6b1486..674272922db7d48f7821aa7c83ec76bb3b556d2a 100644
GIT binary patch
delta 68
zcmZo+e89-%;TjzBfPsO5F=rx|6eH6_Rd+^#iMisuTnvm1|Nk>EGJ@nLCJHmL%S;Ru
WnV7)J#lXPAz`)?Zz#=g*R~!HcF%5eF

delta 29
lcmaFB*uu!=;Tjy$!oa}5_-G=R6eHtARriT=I3|_|004Ge2nqlI

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index cb4b0a9469..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,12 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/HEST",
-"tests/data/acpi/aarch64/virt/DSDT",
-"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
-"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
-"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",
-"tests/data/acpi/aarch64/virt/DSDT.memhp",
-"tests/data/acpi/aarch64/virt/DSDT.pxb",
-"tests/data/acpi/aarch64/virt/DSDT.topology",
-"tests/data/acpi/aarch64/virt/DSDT.viot",
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",

From 92aad3fc4a0f511819a18a443797069aff77b9ba Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:10 +0200
Subject: [PATCH 0968/2396] docs: hest: add new "etc/acpi_table_hest_addr" and
 update workflow

While the HEST layout didn't change, there are some internal
changes related to how offsets are calculated and how memory error
events are triggered.

Update specs to reflect such changes.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <e3e8bd92ce40d997c67ac1d4d973c0041b8f59fc.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/specs/acpi_hest_ghes.rst | 28 +++++++++++++++++-----------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/docs/specs/acpi_hest_ghes.rst b/docs/specs/acpi_hest_ghes.rst
index c3e9f8d9a7..aaf7b1ad11 100644
--- a/docs/specs/acpi_hest_ghes.rst
+++ b/docs/specs/acpi_hest_ghes.rst
@@ -89,12 +89,21 @@ Design Details
     addresses in the "error_block_address" fields with a pointer to the
     respective "Error Status Data Block" in the "etc/hardware_errors" blob.
 
-(8) QEMU defines a third and write-only fw_cfg blob which is called
-    "etc/hardware_errors_addr". Through that blob, the firmware can send back
-    the guest-side allocation addresses to QEMU. The "etc/hardware_errors_addr"
-    blob contains a 8-byte entry. QEMU generates a single WRITE_POINTER command
-    for the firmware. The firmware will write back the start address of
-    "etc/hardware_errors" blob to the fw_cfg file "etc/hardware_errors_addr".
+(8) QEMU defines a third and write-only fw_cfg blob to store the location
+    where the error block offsets, read ack registers and CPER records are
+    stored.
+
+    Up to QEMU 9.2, the location was at "etc/hardware_errors_addr", and
+    contains a GPA for the beginning of "etc/hardware_errors".
+
+    Newer versions place the location at "etc/acpi_table_hest_addr",
+    pointing to the GPA of the HEST table.
+
+    Using above mentioned 'fw_cfg' files, the firmware can send back the
+    guest-side allocation addresses to QEMU. They contain a 8-byte entry.
+    QEMU generates a single WRITE_POINTER command for the firmware. The
+    firmware will write back the start address of either "etc/hardware_errors"
+    or HEST table at the corresponding fw_cfg file.
 
 (9) When QEMU gets a SIGBUS from the kernel, QEMU writes CPER into corresponding
     "Error Status Data Block", guest memory, and then injects platform specific
@@ -105,8 +114,5 @@ Design Details
      kernel, on receiving notification, guest APEI driver could read the CPER error
      and take appropriate action.
 
-(11) kvm_arch_on_sigbus_vcpu() uses source_id as index in "etc/hardware_errors" to
-     find out "Error Status Data Block" entry corresponding to error source. So supported
-     source_id values should be assigned here and not be changed afterwards to make sure
-     that guest will write error into expected "Error Status Data Block" even if guest was
-     migrated to a newer QEMU.
+(11) kvm_arch_on_sigbus_vcpu() reports RAS errors via a SEA notifications,
+     when a SIGBUS event is triggered.

From 4cc103081b170a80afe3344da4899b525fd4d0a8 Mon Sep 17 00:00:00 2001
From: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Date: Tue, 23 Sep 2025 09:04:11 +0200
Subject: [PATCH 0969/2396] scripts/ghes_inject: add a script to generate GHES
 error inject

Using the QMP GHESv2 API requires preparing a raw data array
containing a CPER record.

Add a helper script with subcommands to prepare such data.

Currently, only ARM Processor error CPER record is supported, by
using:
	$ ghes_inject.py arm

which produces those warnings on Linux:

[  705.032426] [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
[  774.866308] {4}[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
[  774.866583] {4}[Hardware Error]: event severity: recoverable
[  774.866738] {4}[Hardware Error]:  Error 0, type: recoverable
[  774.866889] {4}[Hardware Error]:   section_type: ARM processor error
[  774.867048] {4}[Hardware Error]:   MIDR: 0x00000000000f0510
[  774.867189] {4}[Hardware Error]:   running state: 0x0
[  774.867321] {4}[Hardware Error]:   Power State Coordination Interface state: 0
[  774.867511] {4}[Hardware Error]:   Error info structure 0:
[  774.867679] {4}[Hardware Error]:   num errors: 2
[  774.867801] {4}[Hardware Error]:    error_type: 0x02: cache error
[  774.867962] {4}[Hardware Error]:    error_info: 0x000000000091000f
[  774.868124] {4}[Hardware Error]:     transaction type: Data Access
[  774.868280] {4}[Hardware Error]:     cache error, operation type: Data write
[  774.868465] {4}[Hardware Error]:     cache level: 2
[  774.868592] {4}[Hardware Error]:     processor context not corrupted
[  774.868774] [Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error

Such script allows customizing the error data, allowing to change
all fields at the record. Please use:

	$ ghes_inject.py arm -h

For more details about its usage.

Signed-off-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Reviewed-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <5ea174638e33d23635332fa6d4ae9d751355f127.1758610789.git.mchehab+huawei@kernel.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 MAINTAINERS                    |   3 +
 scripts/arm_processor_error.py | 476 ++++++++++++++++++++++
 scripts/ghes_inject.py         |  51 +++
 scripts/qmp_helper.py          | 703 +++++++++++++++++++++++++++++++++
 4 files changed, 1233 insertions(+)
 create mode 100644 scripts/arm_processor_error.py
 create mode 100755 scripts/ghes_inject.py
 create mode 100755 scripts/qmp_helper.py

diff --git a/MAINTAINERS b/MAINTAINERS
index b31ae5193d..75e1fa5c30 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2179,6 +2179,9 @@ S: Maintained
 F: hw/arm/ghes_cper.c
 F: hw/acpi/ghes_cper_stub.c
 F: qapi/acpi-hest.json
+F: scripts/ghes_inject.py
+F: scripts/arm_processor_error.py
+F: scripts/qmp_helper.py
 
 ppc4xx
 L: qemu-ppc@nongnu.org
diff --git a/scripts/arm_processor_error.py b/scripts/arm_processor_error.py
new file mode 100644
index 0000000000..73d069f070
--- /dev/null
+++ b/scripts/arm_processor_error.py
@@ -0,0 +1,476 @@
+#!/usr/bin/env python3
+#
+# pylint: disable=C0301,C0114,R0903,R0912,R0913,R0914,R0915,W0511
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (C) 2024-2025 Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+# TODO: current implementation has dummy defaults.
+#
+# For a better implementation, a QMP addition/call is needed to
+# retrieve some data for ARM Processor Error injection:
+#
+#   - ARM registers: power_state, mpidr.
+
+"""
+Generate an ARM processor error CPER, compatible with
+UEFI 2.9A Errata.
+
+Injecting such errors can be done using:
+
+    $ ./scripts/ghes_inject.py arm
+    Error injected.
+
+Produces a simple CPER register, as detected on a Linux guest:
+
+[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+[Hardware Error]: event severity: recoverable
+[Hardware Error]:  Error 0, type: recoverable
+[Hardware Error]:   section_type: ARM processor error
+[Hardware Error]:   MIDR: 0x0000000000000000
+[Hardware Error]:   running state: 0x0
+[Hardware Error]:   Power State Coordination Interface state: 0
+[Hardware Error]:   Error info structure 0:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x02: cache error
+[Hardware Error]:    error_info: 0x000000000091000f
+[Hardware Error]:     transaction type: Data Access
+[Hardware Error]:     cache error, operation type: Data write
+[Hardware Error]:     cache level: 2
+[Hardware Error]:     processor context not corrupted
+[Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
+
+The ARM Processor Error message can be customized via command line
+parameters. For instance:
+
+    $ ./scripts/ghes_inject.py arm --mpidr 0x444 --running --affinity 1 \
+        --error-info 12345678 --vendor 0x13,123,4,5,1 --ctx-array 0,1,2,3,4,5 \
+        -t cache tlb bus micro-arch tlb,micro-arch
+    Error injected.
+
+Injects this error, as detected on a Linux guest:
+
+[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 1
+[Hardware Error]: event severity: recoverable
+[Hardware Error]:  Error 0, type: recoverable
+[Hardware Error]:   section_type: ARM processor error
+[Hardware Error]:   MIDR: 0x0000000000000000
+[Hardware Error]:   Multiprocessor Affinity Register (MPIDR): 0x0000000000000000
+[Hardware Error]:   error affinity level: 0
+[Hardware Error]:   running state: 0x1
+[Hardware Error]:   Power State Coordination Interface state: 0
+[Hardware Error]:   Error info structure 0:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x02: cache error
+[Hardware Error]:    error_info: 0x0000000000bc614e
+[Hardware Error]:     cache level: 2
+[Hardware Error]:     processor context not corrupted
+[Hardware Error]:   Error info structure 1:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x04: TLB error
+[Hardware Error]:    error_info: 0x000000000054007f
+[Hardware Error]:     transaction type: Instruction
+[Hardware Error]:     TLB error, operation type: Instruction fetch
+[Hardware Error]:     TLB level: 1
+[Hardware Error]:     processor context not corrupted
+[Hardware Error]:     the error has not been corrected
+[Hardware Error]:     PC is imprecise
+[Hardware Error]:   Error info structure 2:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x08: bus error
+[Hardware Error]:    error_info: 0x00000080d6460fff
+[Hardware Error]:     transaction type: Generic
+[Hardware Error]:     bus error, operation type: Generic read (type of instruction or data request cannot be determined)
+[Hardware Error]:     affinity level at which the bus error occurred: 1
+[Hardware Error]:     processor context corrupted
+[Hardware Error]:     the error has been corrected
+[Hardware Error]:     PC is imprecise
+[Hardware Error]:     Program execution can be restarted reliably at the PC associated with the error.
+[Hardware Error]:     participation type: Local processor observed
+[Hardware Error]:     request timed out
+[Hardware Error]:     address space: External Memory Access
+[Hardware Error]:     memory access attributes:0x20
+[Hardware Error]:     access mode: secure
+[Hardware Error]:   Error info structure 3:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x10: micro-architectural error
+[Hardware Error]:    error_info: 0x0000000078da03ff
+[Hardware Error]:   Error info structure 4:
+[Hardware Error]:   num errors: 2
+[Hardware Error]:    error_type: 0x14: TLB error|micro-architectural error
+[Hardware Error]:   Context info structure 0:
+[Hardware Error]:    register context type: AArch64 EL1 context registers
+[Hardware Error]:    00000000: 00000000 00000000
+[Hardware Error]:   Vendor specific error info has 5 bytes:
+[Hardware Error]:    00000000: 13 7b 04 05 01                                   .{...
+[Firmware Warn]: GHES: Unhandled processor error type 0x02: cache error
+[Firmware Warn]: GHES: Unhandled processor error type 0x04: TLB error
+[Firmware Warn]: GHES: Unhandled processor error type 0x08: bus error
+[Firmware Warn]: GHES: Unhandled processor error type 0x10: micro-architectural error
+[Firmware Warn]: GHES: Unhandled processor error type 0x14: TLB error|micro-architectural error
+"""
+
+import argparse
+import re
+
+from qmp_helper import qmp, util, cper_guid
+
+
+class ArmProcessorEinj:
+    """
+    Implements ARM Processor Error injection via GHES
+    """
+
+    DESC = """
+    Generates an ARM processor error CPER, compatible with
+    UEFI 2.9A Errata.
+    """
+
+    ACPI_GHES_ARM_CPER_LENGTH = 40
+    ACPI_GHES_ARM_CPER_PEI_LENGTH = 32
+
+    # Context types
+    CONTEXT_AARCH32_EL1 = 1
+    CONTEXT_AARCH64_EL1 = 5
+    CONTEXT_MISC_REG = 8
+
+    def __init__(self, subparsers):
+        """Initialize the error injection class and add subparser"""
+
+        # Valid choice values
+        self.arm_valid_bits = {
+            "mpidr":    util.bit(0),
+            "affinity": util.bit(1),
+            "running":  util.bit(2),
+            "vendor":   util.bit(3),
+        }
+
+        self.pei_flags = {
+            "first":        util.bit(0),
+            "last":         util.bit(1),
+            "propagated":   util.bit(2),
+            "overflow":     util.bit(3),
+        }
+
+        self.pei_error_types = {
+            "cache":        util.bit(1),
+            "tlb":          util.bit(2),
+            "bus":          util.bit(3),
+            "micro-arch":   util.bit(4),
+        }
+
+        self.pei_valid_bits = {
+            "multiple-error":   util.bit(0),
+            "flags":            util.bit(1),
+            "error-info":       util.bit(2),
+            "virt-addr":        util.bit(3),
+            "phy-addr":         util.bit(4),
+        }
+
+        self.data = bytearray()
+
+        parser = subparsers.add_parser("arm", description=self.DESC)
+
+        arm_valid_bits = ",".join(self.arm_valid_bits.keys())
+        flags = ",".join(self.pei_flags.keys())
+        error_types = ",".join(self.pei_error_types.keys())
+        pei_valid_bits = ",".join(self.pei_valid_bits.keys())
+
+        # UEFI N.16 ARM Validation bits
+        g_arm = parser.add_argument_group("ARM processor")
+        g_arm.add_argument("--arm", "--arm-valid",
+                           help=f"ARM valid bits: {arm_valid_bits}")
+        g_arm.add_argument("-a", "--affinity",  "--level", "--affinity-level",
+                           type=lambda x: int(x, 0),
+                           help="Affinity level (when multiple levels apply)")
+        g_arm.add_argument("-l", "--mpidr", type=lambda x: int(x, 0),
+                           help="Multiprocessor Affinity Register")
+        g_arm.add_argument("-i", "--midr", type=lambda x: int(x, 0),
+                           help="Main ID Register")
+        g_arm.add_argument("-r", "--running",
+                           action=argparse.BooleanOptionalAction,
+                           default=None,
+                           help="Indicates if the processor is running or not")
+        g_arm.add_argument("--psci", "--psci-state",
+                           type=lambda x: int(x, 0),
+                           help="Power State Coordination Interface - PSCI state")
+
+        # TODO: Add vendor-specific support
+
+        # UEFI N.17 bitmaps (type and flags)
+        g_pei = parser.add_argument_group("ARM Processor Error Info (PEI)")
+        g_pei.add_argument("-t", "--type", nargs="+",
+                        help=f"one or more error types: {error_types}")
+        g_pei.add_argument("-f", "--flags", nargs="*",
+                        help=f"zero or more error flags: {flags}")
+        g_pei.add_argument("-V", "--pei-valid", "--error-valid", nargs="*",
+                        help=f"zero or more PEI valid bits: {pei_valid_bits}")
+
+        # UEFI N.17 Integer values
+        g_pei.add_argument("-m", "--multiple-error", nargs="+",
+                        help="Number of errors: 0: Single error, 1: Multiple errors, 2-65535: Error count if known")
+        g_pei.add_argument("-e", "--error-info", nargs="+",
+                        help="Error information (UEFI 2.10 tables N.18 to N.20)")
+        g_pei.add_argument("-p", "--physical-address",  nargs="+",
+                        help="Physical address")
+        g_pei.add_argument("-v", "--virtual-address",  nargs="+",
+                        help="Virtual address")
+
+        # UEFI N.21 Context
+        g_ctx = parser.add_argument_group("Processor Context")
+        g_ctx.add_argument("--ctx-type", "--context-type", nargs="*",
+                        help="Type of the context (0=ARM32 GPR, 5=ARM64 EL1, other values supported)")
+        g_ctx.add_argument("--ctx-size", "--context-size", nargs="*",
+                        help="Minimal size of the context")
+        g_ctx.add_argument("--ctx-array", "--context-array", nargs="*",
+                        help="Comma-separated arrays for each context")
+
+        # Vendor-specific data
+        g_vendor = parser.add_argument_group("Vendor-specific data")
+        g_vendor.add_argument("--vendor", "--vendor-specific", nargs="+",
+                        help="Vendor-specific byte arrays of data")
+
+        # Add arguments for Generic Error Data
+        qmp.argparse(parser)
+
+        parser.set_defaults(func=self.send_cper)
+
+    def send_cper(self, args):
+        """Parse subcommand arguments and send a CPER via QMP"""
+
+        qmp_cmd = qmp(args.host, args.port, args.debug)
+
+        # Handle Generic Error Data arguments if any
+        qmp_cmd.set_args(args)
+
+        is_cpu_type = re.compile(r"^([\w+]+\-)?arm\-cpu$")
+        cpus = qmp_cmd.search_qom("/machine/unattached/device",
+                                  "type", is_cpu_type)
+
+        cper = {}
+        pei = {}
+        ctx = {}
+        vendor = {}
+
+        arg = vars(args)
+
+        # Handle global parameters
+        if args.arm:
+            arm_valid_init = False
+            cper["valid"] = util.get_choice(name="valid",
+                                       value=args.arm,
+                                       choices=self.arm_valid_bits,
+                                       suffixes=["-error", "-err"])
+        else:
+            cper["valid"] = 0
+            arm_valid_init = True
+
+        if "running" in arg:
+            if args.running:
+                cper["running-state"] = util.bit(0)
+            else:
+                cper["running-state"] = 0
+        else:
+            cper["running-state"] = 0
+
+        if arm_valid_init:
+            if args.affinity:
+                cper["valid"] |= self.arm_valid_bits["affinity"]
+
+            if args.mpidr:
+                cper["valid"] |= self.arm_valid_bits["mpidr"]
+
+            if "running-state" in cper:
+                cper["valid"] |= self.arm_valid_bits["running"]
+
+            if args.psci:
+                cper["valid"] |= self.arm_valid_bits["running"]
+
+        # Handle PEI
+        if not args.type:
+            args.type = ["cache-error"]
+
+        util.get_mult_choices(
+            pei,
+            name="valid",
+            values=args.pei_valid,
+            choices=self.pei_valid_bits,
+            suffixes=["-valid", "--addr"],
+        )
+        util.get_mult_choices(
+            pei,
+            name="type",
+            values=args.type,
+            choices=self.pei_error_types,
+            suffixes=["-error", "-err"],
+        )
+        util.get_mult_choices(
+            pei,
+            name="flags",
+            values=args.flags,
+            choices=self.pei_flags,
+            suffixes=["-error", "-cap"],
+        )
+        util.get_mult_int(pei, "error-info", args.error_info)
+        util.get_mult_int(pei, "multiple-error", args.multiple_error)
+        util.get_mult_int(pei, "phy-addr", args.physical_address)
+        util.get_mult_int(pei, "virt-addr", args.virtual_address)
+
+        # Handle context
+        util.get_mult_int(ctx, "type", args.ctx_type, allow_zero=True)
+        util.get_mult_int(ctx, "minimal-size", args.ctx_size, allow_zero=True)
+        util.get_mult_array(ctx, "register", args.ctx_array, allow_zero=True)
+
+        util.get_mult_array(vendor, "bytes", args.vendor, max_val=255)
+
+        # Store PEI
+        pei_data = bytearray()
+        default_flags  = self.pei_flags["first"]
+        default_flags |= self.pei_flags["last"]
+
+        error_info_num = 0
+
+        for i, p in pei.items():        # pylint: disable=W0612
+            error_info_num += 1
+
+            # UEFI 2.10 doesn't define how to encode error information
+            # when multiple types are raised. So, provide a default only
+            # if a single type is there
+            if "error-info" not in p:
+                if p["type"] == util.bit(1):
+                    p["error-info"] = 0x0091000F
+                if p["type"] == util.bit(2):
+                    p["error-info"] = 0x0054007F
+                if p["type"] == util.bit(3):
+                    p["error-info"] = 0x80D6460FFF
+                if p["type"] == util.bit(4):
+                    p["error-info"] = 0x78DA03FF
+
+            if "valid" not in p:
+                p["valid"] = 0
+                if "multiple-error" in p:
+                    p["valid"] |= self.pei_valid_bits["multiple-error"]
+
+                if "flags" in p:
+                    p["valid"] |= self.pei_valid_bits["flags"]
+
+                if "error-info" in p:
+                    p["valid"] |= self.pei_valid_bits["error-info"]
+
+                if "phy-addr" in p:
+                    p["valid"] |= self.pei_valid_bits["phy-addr"]
+
+                if "virt-addr" in p:
+                    p["valid"] |= self.pei_valid_bits["virt-addr"]
+
+            # Version
+            util.data_add(pei_data, 0, 1)
+
+            util.data_add(pei_data,
+                         self.ACPI_GHES_ARM_CPER_PEI_LENGTH, 1)
+
+            util.data_add(pei_data, p["valid"], 2)
+            util.data_add(pei_data, p["type"], 1)
+            util.data_add(pei_data, p.get("multiple-error", 1), 2)
+            util.data_add(pei_data, p.get("flags", default_flags), 1)
+            util.data_add(pei_data, p.get("error-info", 0), 8)
+            util.data_add(pei_data, p.get("virt-addr", 0xDEADBEEF), 8)
+            util.data_add(pei_data, p.get("phy-addr", 0xABBA0BAD), 8)
+
+        # Store Context
+        ctx_data = bytearray()
+        context_info_num = 0
+
+        if ctx:
+            ret = qmp_cmd.send_cmd("query-target", may_open=True)
+
+            default_ctx = self.CONTEXT_MISC_REG
+
+            if "arch" in ret:
+                if ret["arch"] == "aarch64":
+                    default_ctx = self.CONTEXT_AARCH64_EL1
+                elif ret["arch"] == "arm":
+                    default_ctx = self.CONTEXT_AARCH32_EL1
+
+            for k in sorted(ctx.keys()):
+                context_info_num += 1
+
+                if "type" not in ctx[k]:
+                    ctx[k]["type"] = default_ctx
+
+                if "register" not in ctx[k]:
+                    ctx[k]["register"] = []
+
+                reg_size = len(ctx[k]["register"])
+                size = 0
+
+                if "minimal-size" in ctx:
+                    size = ctx[k]["minimal-size"]
+
+                size = max(size, reg_size)
+
+                size = (size + 1) % 0xFFFE
+
+                # Version
+                util.data_add(ctx_data, 0, 2)
+
+                util.data_add(ctx_data, ctx[k]["type"], 2)
+
+                util.data_add(ctx_data, 8 * size, 4)
+
+                for r in ctx[k]["register"]:
+                    util.data_add(ctx_data, r, 8)
+
+                for i in range(reg_size, size):   # pylint: disable=W0612
+                    util.data_add(ctx_data, 0, 8)
+
+        # Vendor-specific bytes are not grouped
+        vendor_data = bytearray()
+        if vendor:
+            for k in sorted(vendor.keys()):
+                for b in vendor[k]["bytes"]:
+                    util.data_add(vendor_data, b, 1)
+
+        # Encode ARM Processor Error
+        data = bytearray()
+
+        util.data_add(data, cper["valid"], 4)
+
+        util.data_add(data, error_info_num, 2)
+        util.data_add(data, context_info_num, 2)
+
+        # Calculate the length of the CPER data
+        cper_length = self.ACPI_GHES_ARM_CPER_LENGTH
+        cper_length += len(pei_data)
+        cper_length += len(vendor_data)
+        cper_length += len(ctx_data)
+        util.data_add(data, cper_length, 4)
+
+        util.data_add(data, arg.get("affinity-level", 0), 1)
+
+        # Reserved
+        util.data_add(data, 0, 3)
+
+        if "midr-el1" not in arg:
+            if cpus:
+                cmd_arg = {
+                    'path': cpus[0],
+                    'property': "midr"
+                }
+                ret = qmp_cmd.send_cmd("qom-get", cmd_arg, may_open=True)
+                if isinstance(ret, int):
+                    arg["midr-el1"] = ret
+
+        util.data_add(data, arg.get("mpidr-el1", 0), 8)
+        util.data_add(data, arg.get("midr-el1", 0), 8)
+        util.data_add(data, cper["running-state"], 4)
+        util.data_add(data, arg.get("psci-state", 0), 4)
+
+        # Add PEI
+        data.extend(pei_data)
+        data.extend(ctx_data)
+        data.extend(vendor_data)
+
+        self.data = data
+
+        qmp_cmd.send_cper(cper_guid.CPER_PROC_ARM, self.data)
diff --git a/scripts/ghes_inject.py b/scripts/ghes_inject.py
new file mode 100755
index 0000000000..9a23520141
--- /dev/null
+++ b/scripts/ghes_inject.py
@@ -0,0 +1,51 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (C) 2024-2025 Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+"""
+Handle ACPI GHESv2 error injection logic QEMU QMP interface.
+"""
+
+import argparse
+import sys
+
+from arm_processor_error import ArmProcessorEinj
+
+EINJ_DESC = """
+Handle ACPI GHESv2 error injection logic QEMU QMP interface.
+
+It allows using UEFI BIOS EINJ features to generate GHES records.
+
+It helps testing CPER and GHES drivers at the guest OS and how
+userspace applications at the guest handle them.
+"""
+
+def main():
+    """Main program"""
+
+    # Main parser - handle generic args like QEMU QMP TCP socket options
+    parser = argparse.ArgumentParser(formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+                                     usage="%(prog)s [options]",
+                                     description=EINJ_DESC)
+
+    g_options = parser.add_argument_group("QEMU QMP socket options")
+    g_options.add_argument("-H", "--host", default="localhost", type=str,
+                           help="host name")
+    g_options.add_argument("-P", "--port", default=4445, type=int,
+                           help="TCP port number")
+    g_options.add_argument('-d', '--debug', action='store_true')
+
+    subparsers = parser.add_subparsers()
+
+    ArmProcessorEinj(subparsers)
+
+    args = parser.parse_args()
+    if "func" in args:
+        args.func(args)
+    else:
+        sys.exit(f"Please specify a valid command for {sys.argv[0]}")
+
+if __name__ == "__main__":
+    main()
diff --git a/scripts/qmp_helper.py b/scripts/qmp_helper.py
new file mode 100755
index 0000000000..c1e7e0fd80
--- /dev/null
+++ b/scripts/qmp_helper.py
@@ -0,0 +1,703 @@
+#!/usr/bin/env python3
+#
+# pylint: disable=C0103,E0213,E1135,E1136,E1137,R0902,R0903,R0912,R0913,R0917
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright (C) 2024-2025 Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
+
+"""
+Helper classes to be used by ghes_inject command classes.
+"""
+
+import json
+import sys
+
+from datetime import datetime
+from os import path as os_path
+
+try:
+    qemu_dir = os_path.abspath(os_path.dirname(os_path.dirname(__file__)))
+    sys.path.append(os_path.join(qemu_dir, 'python'))
+
+    from qemu.qmp.legacy import QEMUMonitorProtocol
+
+except ModuleNotFoundError as exc:
+    print(f"Module '{exc.name}' not found.")
+    print("Try export PYTHONPATH=top-qemu-dir/python or run from top-qemu-dir")
+    sys.exit(1)
+
+from base64 import b64encode
+
+class util:
+    """
+    Ancillary functions to deal with bitmaps, parse arguments,
+    generate GUID and encode data on a bytearray buffer.
+    """
+
+    #
+    # Helper routines to handle multiple choice arguments
+    #
+    def get_choice(name, value, choices, suffixes=None, bitmask=True):
+        """Produce a list from multiple choice argument"""
+
+        new_values = 0
+
+        if not value:
+            return new_values
+
+        for val in value.split(","):
+            val = val.lower()
+
+            if suffixes:
+                for suffix in suffixes:
+                    val = val.removesuffix(suffix)
+
+            if val not in choices.keys():
+                if suffixes:
+                    for suffix in suffixes:
+                        if val + suffix in choices.keys():
+                            val += suffix
+                            break
+
+            if val not in choices.keys():
+                sys.exit(f"Error on '{name}': choice '{val}' is invalid.")
+
+            val = choices[val]
+
+            if bitmask:
+                new_values |= val
+            else:
+                if new_values:
+                    sys.exit(f"Error on '{name}': only one value is accepted.")
+
+                new_values = val
+
+        return new_values
+
+    def get_array(name, values, max_val=None):
+        """Add numbered hashes from integer lists into an array"""
+
+        array = []
+
+        for value in values:
+            for val in value.split(","):
+                try:
+                    val = int(val, 0)
+                except ValueError:
+                    sys.exit(f"Error on '{name}': {val} is not an integer")
+
+                if val < 0:
+                    sys.exit(f"Error on '{name}': {val} is not unsigned")
+
+                if max_val and val > max_val:
+                    sys.exit(f"Error on '{name}': {val} is too little")
+
+                array.append(val)
+
+        return array
+
+    def get_mult_array(mult, name, values, allow_zero=False, max_val=None):
+        """Add numbered hashes from integer lists"""
+
+        if not allow_zero:
+            if not values:
+                return
+        else:
+            if values is None:
+                return
+
+            if not values:
+                i = 0
+                if i not in mult:
+                    mult[i] = {}
+
+                mult[i][name] = []
+                return
+
+        i = 0
+        for value in values:
+            for val in value.split(","):
+                try:
+                    val = int(val, 0)
+                except ValueError:
+                    sys.exit(f"Error on '{name}': {val} is not an integer")
+
+                if val < 0:
+                    sys.exit(f"Error on '{name}': {val} is not unsigned")
+
+                if max_val and val > max_val:
+                    sys.exit(f"Error on '{name}': {val} is too little")
+
+                if i not in mult:
+                    mult[i] = {}
+
+                if name not in mult[i]:
+                    mult[i][name] = []
+
+                mult[i][name].append(val)
+
+            i += 1
+
+
+    def get_mult_choices(mult, name, values, choices,
+                        suffixes=None, allow_zero=False):
+        """Add numbered hashes from multiple choice arguments"""
+
+        if not allow_zero:
+            if not values:
+                return
+        else:
+            if values is None:
+                return
+
+        i = 0
+        for val in values:
+            new_values = util.get_choice(name, val, choices, suffixes)
+
+            if i not in mult:
+                mult[i] = {}
+
+            mult[i][name] = new_values
+            i += 1
+
+
+    def get_mult_int(mult, name, values, allow_zero=False):
+        """Add numbered hashes from integer arguments"""
+        if not allow_zero:
+            if not values:
+                return
+        else:
+            if values is None:
+                return
+
+        i = 0
+        for val in values:
+            try:
+                val = int(val, 0)
+            except ValueError:
+                sys.exit(f"Error on '{name}': {val} is not an integer")
+
+            if val < 0:
+                sys.exit(f"Error on '{name}': {val} is not unsigned")
+
+            if i not in mult:
+                mult[i] = {}
+
+            mult[i][name] = val
+            i += 1
+
+
+    #
+    # Data encode helper functions
+    #
+    def bit(b):
+        """Simple macro to define a bit on a bitmask"""
+        return 1 << b
+
+
+    def data_add(data, value, num_bytes):
+        """Adds bytes from value inside a bitarray"""
+
+        data.extend(value.to_bytes(num_bytes, byteorder="little"))  # pylint: disable=E1101
+
+    def dump_bytearray(name, data):
+        """Does an hexdump of a byte array, grouping in bytes"""
+
+        print(f"{name} ({len(data)} bytes):")
+
+        for ln_start in range(0, len(data), 16):
+            ln_end = min(ln_start + 16, len(data))
+            print(f"      {ln_start:08x}  ", end="")
+            for i in range(ln_start, ln_end):
+                print(f"{data[i]:02x} ", end="")
+            for i in range(ln_end, ln_start + 16):
+                print("   ", end="")
+            print("  ", end="")
+            for i in range(ln_start, ln_end):
+                if data[i] >= 32 and data[i] < 127:
+                    print(chr(data[i]), end="")
+                else:
+                    print(".", end="")
+
+            print()
+        print()
+
+    def time(string):
+        """Handle BCD timestamps used on Generic Error Data Block"""
+
+        time = None
+
+        # Formats to be used when parsing time stamps
+        formats = [
+            "%Y-%m-%d %H:%M:%S",
+        ]
+
+        if string == "now":
+            time = datetime.now()
+
+        if time is None:
+            for fmt in formats:
+                try:
+                    time = datetime.strptime(string, fmt)
+                    break
+                except ValueError:
+                    pass
+
+            if time is None:
+                raise ValueError("Invalid time format")
+
+        return time
+
+class guid:
+    """
+    Simple class to handle GUID fields.
+    """
+
+    def __init__(self, time_low, time_mid, time_high, nodes):
+        """Initialize a GUID value"""
+
+        assert len(nodes) == 8
+
+        self.time_low = time_low
+        self.time_mid = time_mid
+        self.time_high = time_high
+        self.nodes = nodes
+
+    @classmethod
+    def UUID(cls, guid_str):
+        """Initialize a GUID using a string on its standard format"""
+
+        if len(guid_str) != 36:
+            print("Size not 36")
+            raise ValueError('Invalid GUID size')
+
+        # It is easier to parse without separators. So, drop them
+        guid_str = guid_str.replace('-', '')
+
+        if len(guid_str) != 32:
+            print("Size not 32", guid_str, len(guid_str))
+            raise ValueError('Invalid GUID hex size')
+
+        time_low = 0
+        time_mid = 0
+        time_high = 0
+        nodes = []
+
+        for i in reversed(range(16, 32, 2)):
+            h = guid_str[i:i + 2]
+            value = int(h, 16)
+            nodes.insert(0, value)
+
+        time_high = int(guid_str[12:16], 16)
+        time_mid = int(guid_str[8:12], 16)
+        time_low = int(guid_str[0:8], 16)
+
+        return cls(time_low, time_mid, time_high, nodes)
+
+    def __str__(self):
+        """Output a GUID value on its default string representation"""
+
+        clock = self.nodes[0] << 8 | self.nodes[1]
+
+        node = 0
+        for i in range(2, len(self.nodes)):
+            node = node << 8 | self.nodes[i]
+
+        s = f"{self.time_low:08x}-{self.time_mid:04x}-"
+        s += f"{self.time_high:04x}-{clock:04x}-{node:012x}"
+        return s
+
+    def to_bytes(self):
+        """Output a GUID value in bytes"""
+
+        data = bytearray()
+
+        util.data_add(data, self.time_low, 4)
+        util.data_add(data, self.time_mid, 2)
+        util.data_add(data, self.time_high, 2)
+        data.extend(bytearray(self.nodes))
+
+        return data
+
+class qmp:
+    """
+    Opens a connection and send/receive QMP commands.
+    """
+
+    def send_cmd(self, command, args=None, may_open=False, return_error=True):
+        """Send a command to QMP, optinally opening a connection"""
+
+        if may_open:
+            self._connect()
+        elif not self.connected:
+            return False
+
+        msg = { 'execute': command }
+        if args:
+            msg['arguments'] = args
+
+        try:
+            obj = self.qmp_monitor.cmd_obj(msg)
+        # Can we use some other exception class here?
+        except Exception as e:                         # pylint: disable=W0718
+            print(f"Command: {command}")
+            print(f"Failed to inject error: {e}.")
+            return None
+
+        if "return" in obj:
+            if isinstance(obj.get("return"), dict):
+                if obj["return"]:
+                    return obj["return"]
+                return "OK"
+
+            return obj["return"]
+
+        if isinstance(obj.get("error"), dict):
+            error = obj["error"]
+            if return_error:
+                print(f"Command: {msg}")
+                print(f'{error["class"]}: {error["desc"]}')
+        else:
+            print(json.dumps(obj))
+
+        return None
+
+    def _close(self):
+        """Shutdown and close the socket, if opened"""
+        if not self.connected:
+            return
+
+        self.qmp_monitor.close()
+        self.connected = False
+
+    def _connect(self):
+        """Connect to a QMP TCP/IP port, if not connected yet"""
+
+        if self.connected:
+            return True
+
+        try:
+            self.qmp_monitor.connect(negotiate=True)
+        except ConnectionError:
+            sys.exit(f"Can't connect to QMP host {self.host}:{self.port}")
+
+        self.connected = True
+
+        return True
+
+    BLOCK_STATUS_BITS = {
+        "uncorrectable":            util.bit(0),
+        "correctable":              util.bit(1),
+        "multi-uncorrectable":      util.bit(2),
+        "multi-correctable":        util.bit(3),
+    }
+
+    ERROR_SEVERITY = {
+        "recoverable":  0,
+        "fatal":        1,
+        "corrected":    2,
+        "none":         3,
+    }
+
+    VALIDATION_BITS = {
+        "fru-id":       util.bit(0),
+        "fru-text":     util.bit(1),
+        "timestamp":    util.bit(2),
+    }
+
+    GEDB_FLAGS_BITS = {
+        "recovered":    util.bit(0),
+        "prev-error":   util.bit(1),
+        "simulated":    util.bit(2),
+    }
+
+    GENERIC_DATA_SIZE = 72
+
+    def argparse(parser):
+        """Prepare a parser group to query generic error data"""
+
+        block_status_bits = ",".join(qmp.BLOCK_STATUS_BITS.keys())
+        error_severity_enum = ",".join(qmp.ERROR_SEVERITY.keys())
+        validation_bits = ",".join(qmp.VALIDATION_BITS.keys())
+        gedb_flags_bits = ",".join(qmp.GEDB_FLAGS_BITS.keys())
+
+        g_gen = parser.add_argument_group("Generic Error Data")  # pylint: disable=E1101
+        g_gen.add_argument("--block-status",
+                           help=f"block status bits: {block_status_bits}")
+        g_gen.add_argument("--raw-data", nargs="+",
+                        help="Raw data inside the Error Status Block")
+        g_gen.add_argument("--error-severity", "--severity",
+                           help=f"error severity: {error_severity_enum}")
+        g_gen.add_argument("--gen-err-valid-bits",
+                           "--generic-error-validation-bits",
+                           help=f"validation bits: {validation_bits}")
+        g_gen.add_argument("--fru-id", type=guid.UUID,
+                           help="GUID representing a physical device")
+        g_gen.add_argument("--fru-text",
+                           help="ASCII string identifying the FRU hardware")
+        g_gen.add_argument("--timestamp", type=util.time,
+                           help="Time when the error info was collected")
+        g_gen.add_argument("--precise", "--precise-timestamp",
+                           action='store_true',
+                           help="Marks the timestamp as precise if --timestamp is used")
+        g_gen.add_argument("--gedb-flags",
+                           help=f"General Error Data Block flags: {gedb_flags_bits}")
+
+    def set_args(self, args):
+        """Set the arguments optionally defined via self.argparse()"""
+
+        if args.block_status:
+            self.block_status = util.get_choice(name="block-status",
+                                                value=args.block_status,
+                                                choices=self.BLOCK_STATUS_BITS,
+                                                bitmask=False)
+        if args.raw_data:
+            self.raw_data = util.get_array("raw-data", args.raw_data,
+                                           max_val=255)
+            print(self.raw_data)
+
+        if args.error_severity:
+            self.error_severity = util.get_choice(name="error-severity",
+                                                  value=args.error_severity,
+                                                  choices=self.ERROR_SEVERITY,
+                                                  bitmask=False)
+
+        if args.fru_id:
+            self.fru_id = args.fru_id.to_bytes()
+            if not args.gen_err_valid_bits:
+                self.validation_bits |= self.VALIDATION_BITS["fru-id"]
+
+        if args.fru_text:
+            text = bytearray(args.fru_text.encode('ascii'))
+            if len(text) > 20:
+                sys.exit("FRU text is too big to fit")
+
+            self.fru_text = text
+            if not args.gen_err_valid_bits:
+                self.validation_bits |= self.VALIDATION_BITS["fru-text"]
+
+        if args.timestamp:
+            time = args.timestamp
+            century = int(time.year / 100)
+
+            bcd = bytearray()
+            util.data_add(bcd, (time.second // 10) << 4 | (time.second % 10), 1)
+            util.data_add(bcd, (time.minute // 10) << 4 | (time.minute % 10), 1)
+            util.data_add(bcd, (time.hour // 10) << 4 | (time.hour % 10), 1)
+
+            if args.precise:
+                util.data_add(bcd, 1, 1)
+            else:
+                util.data_add(bcd, 0, 1)
+
+            util.data_add(bcd, (time.day // 10) << 4 | (time.day % 10), 1)
+            util.data_add(bcd, (time.month // 10) << 4 | (time.month % 10), 1)
+            util.data_add(bcd,
+                          ((time.year % 100) // 10) << 4 | (time.year % 10), 1)
+            util.data_add(bcd, ((century % 100) // 10) << 4 | (century % 10), 1)
+
+            self.timestamp = bcd
+            if not args.gen_err_valid_bits:
+                self.validation_bits |= self.VALIDATION_BITS["timestamp"]
+
+        if args.gen_err_valid_bits:
+            self.validation_bits = util.get_choice(name="validation",
+                                                   value=args.gen_err_valid_bits,
+                                                   choices=self.VALIDATION_BITS)
+
+    def __init__(self, host, port, debug=False):
+        """Initialize variables used by the QMP send logic"""
+
+        self.connected = False
+        self.host = host
+        self.port = port
+        self.debug = debug
+
+        # ACPI 6.1: 18.3.2.7.1 Generic Error Data: Generic Error Status Block
+        self.block_status = self.BLOCK_STATUS_BITS["uncorrectable"]
+        self.raw_data = []
+        self.error_severity = self.ERROR_SEVERITY["recoverable"]
+
+        # ACPI 6.1: 18.3.2.7.1 Generic Error Data: Generic Error Data Entry
+        self.validation_bits = 0
+        self.flags = 0
+        self.fru_id = bytearray(16)
+        self.fru_text = bytearray(20)
+        self.timestamp = bytearray(8)
+
+        self.qmp_monitor = QEMUMonitorProtocol(address=(self.host, self.port))
+
+    #
+    # Socket QMP send command
+    #
+    def send_cper_raw(self, cper_data):
+        """Send a raw CPER data to QEMU though QMP TCP socket"""
+
+        data = b64encode(bytes(cper_data)).decode('ascii')
+
+        cmd_arg = {
+            'cper': data
+        }
+
+        self._connect()
+
+        if self.send_cmd("inject-ghes-v2-error", cmd_arg):
+            print("Error injected.")
+
+    def send_cper(self, notif_type, payload):
+        """Send commands to QEMU though QMP TCP socket"""
+
+        # Fill CPER record header
+
+        # NOTE: bits 4 to 13 of block status contain the number of
+        # data entries in the data section. This is currently unsupported.
+
+        cper_length = len(payload)
+        data_length = cper_length + len(self.raw_data) + self.GENERIC_DATA_SIZE
+
+        #  Generic Error Data Entry
+        gede = bytearray()
+
+        gede.extend(notif_type.to_bytes())
+        util.data_add(gede, self.error_severity, 4)
+        util.data_add(gede, 0x300, 2)
+        util.data_add(gede, self.validation_bits, 1)
+        util.data_add(gede, self.flags, 1)
+        util.data_add(gede, cper_length, 4)
+        gede.extend(self.fru_id)
+        gede.extend(self.fru_text)
+        gede.extend(self.timestamp)
+
+        # Generic Error Status Block
+        gebs = bytearray()
+
+        if self.raw_data:
+            raw_data_offset = len(gebs)
+        else:
+            raw_data_offset = 0
+
+        util.data_add(gebs, self.block_status, 4)
+        util.data_add(gebs, raw_data_offset, 4)
+        util.data_add(gebs, len(self.raw_data), 4)
+        util.data_add(gebs, data_length, 4)
+        util.data_add(gebs, self.error_severity, 4)
+
+        cper_data = bytearray()
+        cper_data.extend(gebs)
+        cper_data.extend(gede)
+        cper_data.extend(bytearray(self.raw_data))
+        cper_data.extend(bytearray(payload))
+
+        if self.debug:
+            print(f"GUID: {notif_type}")
+
+            util.dump_bytearray("Generic Error Status Block", gebs)
+            util.dump_bytearray("Generic Error Data Entry", gede)
+
+            if self.raw_data:
+                util.dump_bytearray("Raw data", bytearray(self.raw_data))
+
+            util.dump_bytearray("Payload", payload)
+
+        self.send_cper_raw(cper_data)
+
+
+    def search_qom(self, path, prop, regex):
+        """
+        Return a list of devices that match path array like:
+
+            /machine/unattached/device
+            /machine/peripheral-anon/device
+            ...
+        """
+
+        found = []
+
+        i = 0
+        while 1:
+            dev = f"{path}[{i}]"
+            args = {
+                'path': dev,
+                'property': prop
+            }
+            ret = self.send_cmd("qom-get", args, may_open=True,
+                                return_error=False)
+            if not ret:
+                break
+
+            if isinstance(ret, str):
+                if regex.search(ret):
+                    found.append(dev)
+
+            i += 1
+            if i > 10000:
+                print("Too many objects returned by qom-get!")
+                break
+
+        return found
+
+class cper_guid:
+    """
+    Contains CPER GUID, as per:
+    https://uefi.org/specs/UEFI/2.10/Apx_N_Common_Platform_Error_Record.html
+    """
+
+    CPER_PROC_GENERIC =  guid(0x9876CCAD, 0x47B4, 0x4bdb,
+                              [0xB6, 0x5E, 0x16, 0xF1,
+                               0x93, 0xC4, 0xF3, 0xDB])
+
+    CPER_PROC_X86 = guid(0xDC3EA0B0, 0xA144, 0x4797,
+                         [0xB9, 0x5B, 0x53, 0xFA,
+                          0x24, 0x2B, 0x6E, 0x1D])
+
+    CPER_PROC_ITANIUM = guid(0xe429faf1, 0x3cb7, 0x11d4,
+                             [0xbc, 0xa7, 0x00, 0x80,
+                              0xc7, 0x3c, 0x88, 0x81])
+
+    CPER_PROC_ARM = guid(0xE19E3D16, 0xBC11, 0x11E4,
+                         [0x9C, 0xAA, 0xC2, 0x05,
+                          0x1D, 0x5D, 0x46, 0xB0])
+
+    CPER_PLATFORM_MEM = guid(0xA5BC1114, 0x6F64, 0x4EDE,
+                             [0xB8, 0x63, 0x3E, 0x83,
+                              0xED, 0x7C, 0x83, 0xB1])
+
+    CPER_PLATFORM_MEM2 = guid(0x61EC04FC, 0x48E6, 0xD813,
+                              [0x25, 0xC9, 0x8D, 0xAA,
+                               0x44, 0x75, 0x0B, 0x12])
+
+    CPER_PCIE = guid(0xD995E954, 0xBBC1, 0x430F,
+                     [0xAD, 0x91, 0xB4, 0x4D,
+                      0xCB, 0x3C, 0x6F, 0x35])
+
+    CPER_PCI_BUS = guid(0xC5753963, 0x3B84, 0x4095,
+                        [0xBF, 0x78, 0xED, 0xDA,
+                         0xD3, 0xF9, 0xC9, 0xDD])
+
+    CPER_PCI_DEV = guid(0xEB5E4685, 0xCA66, 0x4769,
+                        [0xB6, 0xA2, 0x26, 0x06,
+                         0x8B, 0x00, 0x13, 0x26])
+
+    CPER_FW_ERROR = guid(0x81212A96, 0x09ED, 0x4996,
+                         [0x94, 0x71, 0x8D, 0x72,
+                          0x9C, 0x8E, 0x69, 0xED])
+
+    CPER_DMA_GENERIC = guid(0x5B51FEF7, 0xC79D, 0x4434,
+                            [0x8F, 0x1B, 0xAA, 0x62,
+                             0xDE, 0x3E, 0x2C, 0x64])
+
+    CPER_DMA_VT = guid(0x71761D37, 0x32B2, 0x45cd,
+                       [0xA7, 0xD0, 0xB0, 0xFE,
+                        0xDD, 0x93, 0xE8, 0xCF])
+
+    CPER_DMA_IOMMU = guid(0x036F84E1, 0x7F37, 0x428c,
+                         [0xA7, 0x9E, 0x57, 0x5F,
+                          0xDF, 0xAA, 0x84, 0xEC])
+
+    CPER_CCIX_PER = guid(0x91335EF6, 0xEBFB, 0x4478,
+                         [0xA6, 0xA6, 0x88, 0xB7,
+                          0x28, 0xCF, 0x75, 0xD7])
+
+    CPER_CXL_PROT_ERR = guid(0x80B9EFB4, 0x52B5, 0x4DE3,
+                             [0xA7, 0x77, 0x68, 0x78,
+                              0x4B, 0x77, 0x10, 0x48])

From d285591d29e28abe2841ecec9a82f57fc773719f Mon Sep 17 00:00:00 2001
From: Daniil Tatianin <d-tatianin@yandex-team.ru>
Date: Thu, 24 Jul 2025 22:54:09 +0300
Subject: [PATCH 0970/2396] hw/smbios: allow clearing the VM bit in SMBIOS
 table 0

This is useful to be able to freeze a specific version of SeaBIOS to
prevent guest visible changes between BIOS updates. This is currently
not possible since the extension byte 2 provided by SeaBIOS does not
set the VM bit, whereas QEMU sets it unconditionally.

Allowing to clear it also seems useful if we want to hide the fact that
the guest system is running inside a virtual machine.

Signed-off-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250724195409.43499-1-d-tatianin@yandex-team.ru>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/smbios/smbios.c           | 11 ++++++++++-
 include/hw/firmware/smbios.h |  2 +-
 qemu-options.hx              |  2 +-
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index 1ac063cfb4..13e21a9c43 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -179,6 +179,10 @@ static const QemuOptDesc qemu_smbios_type0_opts[] = {
         .name = "uefi",
         .type = QEMU_OPT_BOOL,
         .help = "uefi support",
+    },{
+        .name = "vm",
+        .type = QEMU_OPT_BOOL,
+        .help = "virtual machine",
     },
     { /* end of list */ }
 };
@@ -574,10 +578,14 @@ static void smbios_build_type_0_table(void)
 
     t->bios_characteristics = cpu_to_le64(0x08); /* Not supported */
     t->bios_characteristics_extension_bytes[0] = 0;
-    t->bios_characteristics_extension_bytes[1] = 0x14; /* TCD/SVVP | VM */
+
+    t->bios_characteristics_extension_bytes[1] = 0x04; /* TCD/SVVP */
     if (smbios_type0.uefi) {
         t->bios_characteristics_extension_bytes[1] |= 0x08; /* |= UEFI */
     }
+    if (smbios_type0.vm) {
+        t->bios_characteristics_extension_bytes[1] |= 0x10; /* |= VM */
+    }
 
     if (smbios_type0.have_major_minor) {
         t->system_bios_major_release = smbios_type0.major;
@@ -1405,6 +1413,7 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
             save_opt(&smbios_type0.version, opts, "version");
             save_opt(&smbios_type0.date, opts, "date");
             smbios_type0.uefi = qemu_opt_get_bool(opts, "uefi", false);
+            smbios_type0.vm = qemu_opt_get_bool(opts, "vm", true);
 
             val = qemu_opt_get(opts, "release");
             if (val) {
diff --git a/include/hw/firmware/smbios.h b/include/hw/firmware/smbios.h
index f066ab7262..3ea732f4e6 100644
--- a/include/hw/firmware/smbios.h
+++ b/include/hw/firmware/smbios.h
@@ -22,7 +22,7 @@ extern GArray *usr_blobs_sizes;
 
 typedef struct {
     const char *vendor, *version, *date;
-    bool have_major_minor, uefi;
+    bool have_major_minor, uefi, vm;
     uint8_t major, minor;
 } smbios_type0_t;
 extern smbios_type0_t smbios_type0;
diff --git a/qemu-options.hx b/qemu-options.hx
index 075f4be2e3..3ff10ec09d 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -2700,7 +2700,7 @@ DEF("smbios", HAS_ARG, QEMU_OPTION_smbios,
     "-smbios file=binary\n"
     "                load SMBIOS entry from binary file\n"
     "-smbios type=0[,vendor=str][,version=str][,date=str][,release=%d.%d]\n"
-    "              [,uefi=on|off]\n"
+    "              [,uefi=on|off][,vm=on|off]\n"
     "                specify SMBIOS type 0 fields\n"
     "-smbios type=1[,manufacturer=str][,product=str][,version=str][,serial=str]\n"
     "              [,uuid=uuid][,sku=str][,family=str]\n"

From d1193481dee63442fc41e47ca6ebc4cd34f1f69c Mon Sep 17 00:00:00 2001
From: peng guo <engguopeng@buaa.edu.cn>
Date: Tue, 5 Aug 2025 22:23:00 +0800
Subject: [PATCH 0971/2396] hw/i386/pc: Avoid overlap between CXL window and
 PCI 64bit BARs in QEMU

When using a CXL Type 3 device together with a virtio 9p device in QEMU on a
physical server, the 9p device fails to initialize properly. The kernel reports
the following error:

    virtio: device uses modern interface but does not have VIRTIO_F_VERSION_1
    9pnet_virtio virtio0: probe with driver 9pnet_virtio failed with error -22

Further investigation revealed that the 64-bit BAR space assigned to the 9pnet
device was overlapped by the memory window allocated for the CXL devices. As a
result, the kernel could not correctly access the BAR region, causing the
virtio device to malfunction.

An excerpt from /proc/iomem shows:

    480010000-cffffffff : CXL Window 0
      480010000-4bfffffff : PCI Bus 0000:00
      4c0000000-4c01fffff : PCI Bus 0000:0c
        4c0000000-4c01fffff : PCI Bus 0000:0d
      4c0200000-cffffffff : PCI Bus 0000:00
        4c0200000-4c0203fff : 0000:00:03.0
          4c0200000-4c0203fff : virtio-pci-modern

To address this issue, this patch adds the reserved memory end calculation
for cxl devices to reserve sufficient address space and ensure that CXL memory
windows are allocated beyond all PCI 64-bit BARs. This prevents overlap with
64-bit BARs regions such as those used by virtio or other pcie devices,
resolving the conflict.

QEMU Build Configuration:

    ./configure --prefix=/home/work/qemu_master/build/ \
                --target-list=x86_64-softmmu \
                --enable-kvm \
                --enable-virtfs

QEMU Boot Command:

    sudo /home/work/qemu_master/qemu/build/qemu-system-x86_64 \
        -nographic -machine q35,cxl=on -enable-kvm -m 16G -smp 8 \
        -hda /home/work/gp_qemu/rootfs.img \
        -virtfs local,path=/home/work/gp_qemu/share,mount_tag=host0,security_model=passthrough,id=host0 \
        -kernel /home/work/linux_output/arch/x86/boot/bzImage \
        --append "console=ttyS0 crashkernel=256M root=/dev/sda rootfstype=ext4 rw loglevel=8" \
        -object memory-backend-ram,id=vmem0,share=on,size=4096M \
        -device pxb-cxl,bus_nr=12,bus=pcie.0,id=cxl.1 \
        -device cxl-rp,port=0,bus=cxl.1,id=root_port13,chassis=0,slot=2 \
        -device cxl-type3,bus=root_port13,volatile-memdev=vmem0,id=cxl-vmem0,sn=0x123456789 \
        -M cxl-fmw.0.targets.0=cxl.1,cxl-fmw.0.size=4G

Fixes: 03b39fcf64bc ("hw/cxl: Make the CXL fixed memory window setup a machine parameter")
Signed-off-by: peng guo <engguopeng@buaa.edu.cn>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250805142300.15226-1-engguopeng@buaa.edu.cn>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/pc.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index bc048a6d13..eb36d50589 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -837,6 +837,7 @@ void pc_memory_init(PCMachineState *pcms,
     hwaddr maxphysaddr, maxusedaddr;
     hwaddr cxl_base, cxl_resv_end = 0;
     X86CPU *cpu = X86_CPU(first_cpu);
+    uint64_t res_mem_end;
 
     assert(machine->ram_size == x86ms->below_4g_mem_size +
                                 x86ms->above_4g_mem_size);
@@ -978,16 +979,17 @@ void pc_memory_init(PCMachineState *pcms,
 
     rom_set_fw(fw_cfg);
 
-    if (machine->device_memory) {
-        uint64_t *val = g_malloc(sizeof(*val));
-        uint64_t res_mem_end;
+    if (pcms->cxl_devices_state.is_enabled) {
+        res_mem_end = cxl_resv_end;
+    } else if (machine->device_memory) {
+        res_mem_end = machine->device_memory->base
+                      + memory_region_size(&machine->device_memory->mr);
+    } else {
+        res_mem_end = 0;
+    }
 
-        if (pcms->cxl_devices_state.is_enabled) {
-            res_mem_end = cxl_resv_end;
-        } else {
-            res_mem_end = machine->device_memory->base
-                          + memory_region_size(&machine->device_memory->mr);
-        }
+    if (res_mem_end) {
+        uint64_t *val = g_malloc(sizeof(*val));
         *val = cpu_to_le64(ROUND_UP(res_mem_end, 1 * GiB));
         fw_cfg_add_file(fw_cfg, "etc/reserved-memory-end", val, sizeof(*val));
     }

From 2e54e5fda779a7ba45578884276dca62462f7a06 Mon Sep 17 00:00:00 2001
From: Damien Bergamini <damien.bergamini@eviden.com>
Date: Mon, 1 Sep 2025 15:14:23 +0000
Subject: [PATCH 0972/2396] pcie_sriov: Fix broken MMIO accesses from SR-IOV
 VFs

Starting with commit cab1398a60eb, SR-IOV VFs are realized as soon as
pcie_sriov_pf_init() is called.  Because pcie_sriov_pf_init() must be
called before pcie_sriov_pf_init_vf_bar(), the VF BARs types won't be
known when the VF realize function calls pcie_sriov_vf_register_bar().

This breaks the memory regions of the VFs (for instance with igbvf):

$ lspci
...
    Region 0: Memory at 281a00000 (64-bit, prefetchable) [virtual] [size=16K]
    Region 3: Memory at 281a20000 (64-bit, prefetchable) [virtual] [size=16K]

$ info mtree
...
address-space: pci_bridge_pci_mem
  0000000000000000-ffffffffffffffff (prio 0, i/o): pci_bridge_pci
    0000000081a00000-0000000081a03fff (prio 1, i/o): igbvf-mmio
    0000000081a20000-0000000081a23fff (prio 1, i/o): igbvf-msix

and causes MMIO accesses to fail:

    Invalid write at addr 0x281A01520, size 4, region '(null)', reason: rejected
    Invalid read at addr 0x281A00C40, size 4, region '(null)', reason: rejected

To fix this, VF BARs are now registered with pci_register_bar() which
has a type parameter and pcie_sriov_vf_register_bar() is removed.

Fixes: cab1398a60eb ("pcie_sriov: Reuse SR-IOV VF device instances")
Signed-off-by: Damien Bergamini <damien.bergamini@eviden.com>
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901151314.1038020-1-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/pcie_sriov.txt         |  5 ++---
 hw/net/igbvf.c              |  6 ++++--
 hw/nvme/ctrl.c              |  8 ++------
 hw/pci/pci.c                |  3 ---
 hw/pci/pcie_sriov.c         | 11 -----------
 include/hw/pci/pcie_sriov.h |  4 ----
 6 files changed, 8 insertions(+), 29 deletions(-)

diff --git a/docs/pcie_sriov.txt b/docs/pcie_sriov.txt
index ab2142807f..00d7bd93fd 100644
--- a/docs/pcie_sriov.txt
+++ b/docs/pcie_sriov.txt
@@ -72,8 +72,7 @@ setting up a BAR for a VF.
 2) Similarly in the implementation of the virtual function, you need to
    make it a PCI Express device and add a similar set of capabilities
    except for the SR/IOV capability. Then you need to set up the VF BARs as
-   subregions of the PFs SR/IOV VF BARs by calling
-   pcie_sriov_vf_register_bar() instead of the normal pci_register_bar() call:
+   subregions of the PFs SR/IOV VF BARs by calling pci_register_bar():
 
    pci_your_vf_dev_realize( ... )
    {
@@ -83,7 +82,7 @@ setting up a BAR for a VF.
       pcie_ari_init(d, 0x100);
       ...
       memory_region_init(mr, ... )
-      pcie_sriov_vf_register_bar(d, bar_nr, mr);
+      pci_register_bar(d, bar_nr, bar_type, mr);
       ...
    }
 
diff --git a/hw/net/igbvf.c b/hw/net/igbvf.c
index 31d72c4977..9b0db8f841 100644
--- a/hw/net/igbvf.c
+++ b/hw/net/igbvf.c
@@ -251,10 +251,12 @@ static void igbvf_pci_realize(PCIDevice *dev, Error **errp)
 
     memory_region_init_io(&s->mmio, OBJECT(dev), &mmio_ops, s, "igbvf-mmio",
         IGBVF_MMIO_SIZE);
-    pcie_sriov_vf_register_bar(dev, IGBVF_MMIO_BAR_IDX, &s->mmio);
+    pci_register_bar(dev, IGBVF_MMIO_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 |
+                     PCI_BASE_ADDRESS_MEM_PREFETCH, &s->mmio);
 
     memory_region_init(&s->msix, OBJECT(dev), "igbvf-msix", IGBVF_MSIX_SIZE);
-    pcie_sriov_vf_register_bar(dev, IGBVF_MSIX_BAR_IDX, &s->msix);
+    pci_register_bar(dev, IGBVF_MSIX_BAR_IDX, PCI_BASE_ADDRESS_MEM_TYPE_64 |
+                     PCI_BASE_ADDRESS_MEM_PREFETCH, &s->msix);
 
     ret = msix_init(dev, IGBVF_MSIX_VEC_NUM, &s->msix, IGBVF_MSIX_BAR_IDX, 0,
         &s->msix, IGBVF_MSIX_BAR_IDX, 0x2000, 0x70, errp);
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index f5ee6bf260..cd81f73997 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8708,12 +8708,8 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
                               msix_table_offset);
         memory_region_add_subregion(&n->bar0, 0, &n->iomem);
 
-        if (pci_is_vf(pci_dev)) {
-            pcie_sriov_vf_register_bar(pci_dev, 0, &n->bar0);
-        } else {
-            pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
-                             PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
-        }
+        pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY |
+                         PCI_BASE_ADDRESS_MEM_TYPE_64, &n->bar0);
 
         ret = msix_init(pci_dev, nr_vectors,
                         &n->bar0, 0, msix_table_offset,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index c3df9d6656..4854d3d618 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1491,9 +1491,6 @@ void pci_register_bar(PCIDevice *pci_dev, int region_num,
                         : pci_get_bus(pci_dev)->address_space_mem;
 
     if (pci_is_vf(pci_dev)) {
-        PCIDevice *pf = pci_dev->exp.sriov_vf.pf;
-        assert(!pf || type == pf->exp.sriov_pf.vf_bar_type[region_num]);
-
         r->addr = pci_bar_address(pci_dev, region_num, r->type, r->size);
         if (r->addr != PCI_BAR_UNMAPPED) {
             memory_region_add_subregion_overlap(r->address_space,
diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 8a4bf0d6f7..29474d749a 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -242,17 +242,6 @@ void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
     dev->exp.sriov_pf.vf_bar_type[region_num] = type;
 }
 
-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
-                                MemoryRegion *memory)
-{
-    uint8_t type;
-
-    assert(dev->exp.sriov_vf.pf);
-    type = dev->exp.sriov_vf.pf->exp.sriov_pf.vf_bar_type[region_num];
-
-    return pci_register_bar(dev, region_num, type, memory);
-}
-
 static gint compare_vf_devfns(gconstpointer a, gconstpointer b)
 {
     return (*(PCIDevice **)a)->devfn - (*(PCIDevice **)b)->devfn;
diff --git a/include/hw/pci/pcie_sriov.h b/include/hw/pci/pcie_sriov.h
index aeaa38cf34..b0ea6a62c7 100644
--- a/include/hw/pci/pcie_sriov.h
+++ b/include/hw/pci/pcie_sriov.h
@@ -37,10 +37,6 @@ void pcie_sriov_pf_exit(PCIDevice *dev);
 void pcie_sriov_pf_init_vf_bar(PCIDevice *dev, int region_num,
                                uint8_t type, dma_addr_t size);
 
-/* Instantiate a bar for a VF */
-void pcie_sriov_vf_register_bar(PCIDevice *dev, int region_num,
-                                MemoryRegion *memory);
-
 /**
  * pcie_sriov_pf_init_from_user_created_vfs() - Initialize PF with user-created
  *                                              VFs, adding ARI to PF

From 722e9022a0b6db175209bad75aa52b24033249e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 1 Sep 2025 11:59:48 +0100
Subject: [PATCH 0973/2396] hw/virtio: rename vhost-user-device and make user
 creatable
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We didn't make the device user creatable in the first place because we
were worried users might get confused. Rename the device to make its
nature as a test device even more explicit. While we are at it add a
Kconfig variable so it can be skipped for those that want to thin out
their build configuration even further.

Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20250820195632.1956795-1-alex.bennee@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901105948.982583-1-alex.bennee@linaro.org>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 docs/system/devices/vhost-user.rst            | 20 +++++++------------
 hw/virtio/Kconfig                             |  5 +++++
 hw/virtio/meson.build                         |  5 +++--
 ...ice-pci.c => vhost-user-test-device-pci.c} | 17 +++++++---------
 ...user-device.c => vhost-user-test-device.c} |  9 +++------
 include/hw/virtio/vhost-user-base.h           |  2 +-
 6 files changed, 26 insertions(+), 32 deletions(-)
 rename hw/virtio/{vhost-user-device-pci.c => vhost-user-test-device-pci.c} (77%)
 rename hw/virtio/{vhost-user-device.c => vhost-user-test-device.c} (87%)

diff --git a/docs/system/devices/vhost-user.rst b/docs/system/devices/vhost-user.rst
index 35259d8ec7..bddf8df5ed 100644
--- a/docs/system/devices/vhost-user.rst
+++ b/docs/system/devices/vhost-user.rst
@@ -62,26 +62,20 @@ platform details for what sort of virtio bus to use.
 The referenced *daemons* are not exhaustive, any conforming backend
 implementing the device and using the vhost-user protocol should work.
 
-vhost-user-device
-^^^^^^^^^^^^^^^^^
+vhost-user-test-device
+^^^^^^^^^^^^^^^^^^^^^^
 
-The vhost-user-device is a generic development device intended for
-expert use while developing new backends. The user needs to specify
-all the required parameters including:
+The vhost-user-test-device is a generic development device intended
+for expert use while developing new backends. The user needs to
+specify all the required parameters including:
 
   - Device ``virtio-id``
   - The ``num_vqs`` it needs and their ``vq_size``
   - The ``config_size`` if needed
 
 .. note::
-  To prevent user confusion you cannot currently instantiate
-  vhost-user-device without first patching out::
-
-    /* Reason: stop inexperienced users confusing themselves */
-    dc->user_creatable = false;
-
-  in ``vhost-user-device.c`` and ``vhost-user-device-pci.c`` file and
-  rebuilding.
+  While this is a useful device for development it is not recommended
+  for production use.
 
 vhost-user daemon
 =================
diff --git a/hw/virtio/Kconfig b/hw/virtio/Kconfig
index 7648a2d68d..10f5c53ac0 100644
--- a/hw/virtio/Kconfig
+++ b/hw/virtio/Kconfig
@@ -126,3 +126,8 @@ config VHOST_USER_SCMI
     bool
     default y
     depends on VIRTIO && VHOST_USER && ARM
+
+config VHOST_USER_TEST
+    bool
+    default y
+    depends on VIRTIO && VHOST_USER
diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index 3ea7b3cec8..48b9fedfa5 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -22,7 +22,7 @@ if have_vhost
     system_virtio_ss.add(files('vhost-user-base.c'))
 
     # MMIO Stubs
-    system_virtio_ss.add(files('vhost-user-device.c'))
+    system_virtio_ss.add(when: 'CONFIG_VHOST_USER_TEST', if_true: files('vhost-user-test-device.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_GPIO', if_true: files('vhost-user-gpio.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_I2C', if_true: files('vhost-user-i2c.c'))
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_RNG', if_true: files('vhost-user-rng.c'))
@@ -30,7 +30,8 @@ if have_vhost
     system_virtio_ss.add(when: 'CONFIG_VHOST_USER_INPUT', if_true: files('vhost-user-input.c'))
 
     # PCI Stubs
-    system_virtio_ss.add(when: 'CONFIG_VIRTIO_PCI', if_true: files('vhost-user-device-pci.c'))
+    system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_TEST'],
+                         if_true: files('vhost-user-test-device-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_GPIO'],
                          if_true: files('vhost-user-gpio-pci.c'))
     system_virtio_ss.add(when: ['CONFIG_VIRTIO_PCI', 'CONFIG_VHOST_USER_I2C'],
diff --git a/hw/virtio/vhost-user-device-pci.c b/hw/virtio/vhost-user-test-device-pci.c
similarity index 77%
rename from hw/virtio/vhost-user-device-pci.c
rename to hw/virtio/vhost-user-test-device-pci.c
index f10bac874e..b4ed0efb50 100644
--- a/hw/virtio/vhost-user-device-pci.c
+++ b/hw/virtio/vhost-user-test-device-pci.c
@@ -18,13 +18,13 @@ struct VHostUserDevicePCI {
     VHostUserBase vub;
 };
 
-#define TYPE_VHOST_USER_DEVICE_PCI "vhost-user-device-pci-base"
+#define TYPE_VHOST_USER_TEST_DEVICE_PCI "vhost-user-test-device-pci-base"
 
-OBJECT_DECLARE_SIMPLE_TYPE(VHostUserDevicePCI, VHOST_USER_DEVICE_PCI)
+OBJECT_DECLARE_SIMPLE_TYPE(VHostUserDevicePCI, VHOST_USER_TEST_DEVICE_PCI)
 
 static void vhost_user_device_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
 {
-    VHostUserDevicePCI *dev = VHOST_USER_DEVICE_PCI(vpci_dev);
+    VHostUserDevicePCI *dev = VHOST_USER_TEST_DEVICE_PCI(vpci_dev);
     DeviceState *vdev = DEVICE(&dev->vub);
 
     vpci_dev->nvectors = 1;
@@ -38,9 +38,6 @@ static void vhost_user_device_pci_class_init(ObjectClass *klass,
     VirtioPCIClass *k = VIRTIO_PCI_CLASS(klass);
     PCIDeviceClass *pcidev_k = PCI_DEVICE_CLASS(klass);
 
-    /* Reason: stop users confusing themselves */
-    dc->user_creatable = false;
-
     k->realize = vhost_user_device_pci_realize;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
     pcidev_k->vendor_id = PCI_VENDOR_ID_REDHAT_QUMRANET;
@@ -51,15 +48,15 @@ static void vhost_user_device_pci_class_init(ObjectClass *klass,
 
 static void vhost_user_device_pci_instance_init(Object *obj)
 {
-    VHostUserDevicePCI *dev = VHOST_USER_DEVICE_PCI(obj);
+    VHostUserDevicePCI *dev = VHOST_USER_TEST_DEVICE_PCI(obj);
 
     virtio_instance_init_common(obj, &dev->vub, sizeof(dev->vub),
-                                TYPE_VHOST_USER_DEVICE);
+                                TYPE_VHOST_USER_TEST_DEVICE);
 }
 
 static const VirtioPCIDeviceTypeInfo vhost_user_device_pci_info = {
-    .base_name = TYPE_VHOST_USER_DEVICE_PCI,
-    .non_transitional_name = "vhost-user-device-pci",
+    .base_name = TYPE_VHOST_USER_TEST_DEVICE_PCI,
+    .non_transitional_name = "vhost-user-test-device-pci",
     .instance_size = sizeof(VHostUserDevicePCI),
     .instance_init = vhost_user_device_pci_instance_init,
     .class_init = vhost_user_device_pci_class_init,
diff --git a/hw/virtio/vhost-user-device.c b/hw/virtio/vhost-user-test-device.c
similarity index 87%
rename from hw/virtio/vhost-user-device.c
rename to hw/virtio/vhost-user-test-device.c
index 3939bdf755..1b98ea3e48 100644
--- a/hw/virtio/vhost-user-device.c
+++ b/hw/virtio/vhost-user-test-device.c
@@ -1,5 +1,5 @@
 /*
- * Generic vhost-user-device implementation for any vhost-user-backend
+ * Generic vhost-user-test-device implementation for any vhost-user-backend
  *
  * This is a concrete implementation of vhost-user-base which can be
  * configured via properties. It is useful for development and
@@ -25,7 +25,7 @@
  */
 
 static const VMStateDescription vud_vmstate = {
-    .name = "vhost-user-device",
+    .name = "vhost-user-test-device",
     .unmigratable = 1,
 };
 
@@ -41,16 +41,13 @@ static void vud_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    /* Reason: stop inexperienced users confusing themselves */
-    dc->user_creatable = false;
-
     device_class_set_props(dc, vud_properties);
     dc->vmsd = &vud_vmstate;
     set_bit(DEVICE_CATEGORY_INPUT, dc->categories);
 }
 
 static const TypeInfo vud_info = {
-    .name = TYPE_VHOST_USER_DEVICE,
+    .name = TYPE_VHOST_USER_TEST_DEVICE,
     .parent = TYPE_VHOST_USER_BASE,
     .class_init = vud_class_init,
 };
diff --git a/include/hw/virtio/vhost-user-base.h b/include/hw/virtio/vhost-user-base.h
index 51d0968b89..387e434b80 100644
--- a/include/hw/virtio/vhost-user-base.h
+++ b/include/hw/virtio/vhost-user-base.h
@@ -44,6 +44,6 @@ struct VHostUserBaseClass {
 };
 
 
-#define TYPE_VHOST_USER_DEVICE "vhost-user-device"
+#define TYPE_VHOST_USER_TEST_DEVICE "vhost-user-test-device"
 
 #endif /* QEMU_VHOST_USER_BASE_H */

From fa82ce2ddee8208c83a5a10bf3ab7348ad3d334a Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Mon, 1 Sep 2025 10:49:15 +0200
Subject: [PATCH 0974/2396] smbios: cap DIMM size to 2Tb as workaround for
 broken Windows

With current limit set to match max spec size (2PTb),
Windows fails to parse type 17 records when DIMM size reaches 4Tb+.
Failure happens in GetPhysicallyInstalledSystemMemory() function,
and fails "Check SMBIOS System Memory Tables" SVVP test.
Though not fatal, it might cause issues for userspace apps,
something like [1].

Lets cap default DIMM size to 2Tb for now, until MS fixes it.

1) https://issues.redhat.com/browse/RHEL-81999?focusedId=27731200&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-27731200

PS: It's obvious 32 int overflow math somewhere in Windows,
    MS admitted that it's Windows bug and in a process of fixing it.
    However it's unclear if W10 and earlier would get the fix.
    So however I dislike changing defaults, we heed to work around
    the issue (it looks like QEMU regression while not being it).
    Hopefully 2Tb/DIMM split will last longer until VM memory size
    will become large enough to cause to many type 17 records issue
    again.
PPS:
    Alternatively, instead of messing with defaults, we can create
    a dedicated knob to ask for desired DIMM size cap explicitly
    on CLI. That will let users to enable workaround when they
    hit this corner case. Downside is that knob has to be propagated
    up all mgmt stack, which might be not desirable.
PPPS:
    Yet alternatively, users can configure initial RAM to be less
    than 4Tb and all additional RAM add as DIMMs on QEMU CLI.
    (however it's the job to be done by mgmt which could know
    Windows version and total amount of RAM)

Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Fixes: 62f182c97b ("smbios: make memory device size configurable per Machine")
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901084915.2607632-1-imammedo@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/arm/virt.c     | 1 +
 hw/core/machine.c | 5 ++++-
 hw/i386/pc_piix.c | 1 +
 hw/i386/pc_q35.c  | 1 +
 4 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index aad557be1a..175023897a 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3537,6 +3537,7 @@ DEFINE_VIRT_MACHINE_AS_LATEST(10, 2)
 static void virt_machine_10_1_options(MachineClass *mc)
 {
     virt_machine_10_2_options(mc);
+    mc->smbios_memory_device_size = 2047 * TiB;
     compat_props_add(mc->compat_props, hw_compat_10_1, hw_compat_10_1_len);
 }
 DEFINE_VIRT_MACHINE(10, 1)
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 7b7a381b0a..681adbb7ac 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1118,8 +1118,11 @@ static void machine_class_init(ObjectClass *oc, const void *data)
      * SMBIOS 3.1.0 7.18.5 Memory Device — Extended Size
      * use max possible value that could be encoded into
      * 'Extended Size' field (2047Tb).
+     *
+     * Unfortunately (current) Windows Server 2025 and earlier do not handle
+     * 4Tb+ DIMM size.
      */
-    mc->smbios_memory_device_size = 2047 * TiB;
+    mc->smbios_memory_device_size = 2 * TiB;
 
     /* numa node memory size aligned on 8MB by default.
      * On Linux, each node's border has to be 8MB aligned
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index caf8bab68e..7b3611e973 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -448,6 +448,7 @@ DEFINE_I440FX_MACHINE_AS_LATEST(10, 2);
 static void pc_i440fx_machine_10_1_options(MachineClass *m)
 {
     pc_i440fx_machine_10_2_options(m);
+    m->smbios_memory_device_size = 2047 * TiB;
     compat_props_add(m->compat_props, hw_compat_10_1, hw_compat_10_1_len);
     compat_props_add(m->compat_props, pc_compat_10_1, pc_compat_10_1_len);
 }
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index e89951285e..6015e639d7 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -384,6 +384,7 @@ DEFINE_Q35_MACHINE_AS_LATEST(10, 2);
 static void pc_q35_machine_10_1_options(MachineClass *m)
 {
     pc_q35_machine_10_2_options(m);
+    m->smbios_memory_device_size = 2047 * TiB;
     compat_props_add(m->compat_props, hw_compat_10_1, hw_compat_10_1_len);
     compat_props_add(m->compat_props, pc_compat_10_1, pc_compat_10_1_len);
 }

From ec450d185e4c885396a8e9b9bd2a435c9e0c118f Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 1 Sep 2025 11:17:19 +0000
Subject: [PATCH 0975/2396] pcie: Add a way to get the outstanding page request
 allocation (pri) from the config space.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901111630.1018573-2-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie.c         | 8 ++++++++
 include/hw/pci/pcie.h | 1 +
 2 files changed, 9 insertions(+)

diff --git a/hw/pci/pcie.c b/hw/pci/pcie.c
index eaeb68894e..b302de6419 100644
--- a/hw/pci/pcie.c
+++ b/hw/pci/pcie.c
@@ -1266,6 +1266,14 @@ void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
     dev->exp.pri_cap = offset;
 }
 
+uint32_t pcie_pri_get_req_alloc(const PCIDevice *dev)
+{
+    if (!pcie_pri_enabled(dev)) {
+        return 0;
+    }
+    return pci_get_long(dev->config + dev->exp.pri_cap + PCI_PRI_ALLOC_REQ);
+}
+
 bool pcie_pri_enabled(const PCIDevice *dev)
 {
     if (!pci_is_express(dev) || !dev->exp.pri_cap) {
diff --git a/include/hw/pci/pcie.h b/include/hw/pci/pcie.h
index ff6ce08e13..42cebcd033 100644
--- a/include/hw/pci/pcie.h
+++ b/include/hw/pci/pcie.h
@@ -158,6 +158,7 @@ void pcie_pasid_init(PCIDevice *dev, uint16_t offset, uint8_t pasid_width,
 void pcie_pri_init(PCIDevice *dev, uint16_t offset, uint32_t outstanding_pr_cap,
                    bool prg_response_pasid_req);
 
+uint32_t pcie_pri_get_req_alloc(const PCIDevice *dev);
 bool pcie_pri_enabled(const PCIDevice *dev);
 bool pcie_pasid_enabled(const PCIDevice *dev);
 bool pcie_ats_enabled(const PCIDevice *dev);

From 57ac646a2ecb2967c46febcfd0f40d396868b4dc Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 1 Sep 2025 11:17:20 +0000
Subject: [PATCH 0976/2396] intel_iommu: Bypass barrier wait descriptor

wait_desc with SW=0,IF=0,FN=1 must not be considered as an
invalid descriptor as it is used to implement section 7.10 of
the VT-d spec.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901111630.1018573-3-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 83c5e44413..4e7ad3a290 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2857,7 +2857,13 @@ static bool vtd_process_wait_desc(IntelIOMMUState *s, VTDInvDesc *inv_desc)
         vtd_generate_completion_event(s);
     }
 
-    if (!(inv_desc->lo & (VTD_INV_DESC_WAIT_IF | VTD_INV_DESC_WAIT_SW))) {
+    /*
+     * SW=0, IF=0, FN=1 is also a valid descriptor (VT-d 7.10)
+     * Nothing to do as we process the descriptors in order
+     */
+
+    if (!(inv_desc->lo & (VTD_INV_DESC_WAIT_IF | VTD_INV_DESC_WAIT_SW |
+                                                 VTD_INV_DESC_WAIT_FN))) {
         error_report_once("%s: invalid wait desc: hi=%"PRIx64", lo=%"PRIx64
                           " (unknown type)", __func__, inv_desc->hi,
                           inv_desc->lo);

From fadc6b0402b6e3edc941b638dfca11789d07d730 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 1 Sep 2025 11:17:21 +0000
Subject: [PATCH 0977/2396] intel_iommu: Declare PRI constants and structures

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901111630.1018573-4-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu_internal.h | 49 ++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 360e937989..04a8d4c769 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -190,6 +190,7 @@
 #define VTD_ECAP_EIM                (1ULL << 4)
 #define VTD_ECAP_PT                 (1ULL << 6)
 #define VTD_ECAP_SC                 (1ULL << 7)
+#define VTD_ECAP_PRS                (1ULL << 29)
 #define VTD_ECAP_MHMV               (15ULL << 20)
 #define VTD_ECAP_SRS                (1ULL << 31)
 #define VTD_ECAP_PSS                (7ULL << 35) /* limit: MemTxAttrs::pid */
@@ -376,6 +377,18 @@ union VTDInvDesc {
 };
 typedef union VTDInvDesc VTDInvDesc;
 
+/* Page Request Descriptor */
+union VTDPRDesc {
+    struct {
+        uint64_t lo;
+        uint64_t hi;
+    };
+    struct {
+        uint64_t val[4];
+    };
+};
+typedef union VTDPRDesc VTDPRDesc;
+
 /* Masks for struct VTDInvDesc */
 #define VTD_INV_DESC_ALL_ONE            -1ULL
 #define VTD_INV_DESC_TYPE(val)          ((((val) >> 5) & 0x70ULL) | \
@@ -389,6 +402,7 @@ typedef union VTDInvDesc VTDInvDesc;
 #define VTD_INV_DESC_PIOTLB             0x6 /* PASID-IOTLB Invalidate Desc */
 #define VTD_INV_DESC_PC                 0x7 /* PASID-cache Invalidate Desc */
 #define VTD_INV_DESC_DEV_PIOTLB         0x8 /* PASID-based-DIOTLB inv_desc*/
+#define VTD_INV_DESC_PGRESP             0x9 /* Page Group Response Desc */
 #define VTD_INV_DESC_NONE               0   /* Not an Invalidate Descriptor */
 
 /* Masks for Invalidation Wait Descriptor*/
@@ -440,6 +454,15 @@ typedef union VTDInvDesc VTDInvDesc;
 #define VTD_INV_DESC_PASID_DEVICE_IOTLB_RSVD_VAL0 0xfff000000000f000ULL
 #define VTD_INV_DESC_PASID_DEVICE_IOTLB_RSVD_VAL1 0x7feULL
 
+/* Mask for Page Group Response Descriptor */
+#define VTD_INV_DESC_PGRESP_RSVD_HI             0xfffffffffffff003ULL
+#define VTD_INV_DESC_PGRESP_RSVD_LO             0xfff00000000001e0ULL
+#define VTD_INV_DESC_PGRESP_PP(val)             (((val) >> 4) & 0x1ULL)
+#define VTD_INV_DESC_PGRESP_RC(val)             (((val) >> 12) & 0xfULL)
+#define VTD_INV_DESC_PGRESP_RID(val)            (((val) >> 16) & 0xffffULL)
+#define VTD_INV_DESC_PGRESP_PASID(val)          (((val) >> 32) & 0xfffffULL)
+#define VTD_INV_DESC_PGRESP_PRGI(val)           (((val) >> 3) & 0x1ffULL)
+
 /* Rsvd field masks for spte */
 #define VTD_SPTE_SNP 0x800ULL
 
@@ -491,6 +514,31 @@ typedef union VTDInvDesc VTDInvDesc;
 #define VTD_INV_DESC_PIOTLB_RSVD_VAL0     0xfff000000000f1c0ULL
 #define VTD_INV_DESC_PIOTLB_RSVD_VAL1     0xf80ULL
 
+/* Page Request Descriptor */
+/* For the low 64-bit of 128-bit */
+#define VTD_PRD_TYPE            (1ULL)
+#define VTD_PRD_PP(val)         (((val) & 1ULL) << 8)
+#define VTD_PRD_RID(val)        (((val) & 0xffffULL) << 16)
+#define VTD_PRD_PASID(val)      (((val) & 0xfffffULL) << 32)
+#define VTD_PRD_EXR(val)        (((val) & 1ULL) << 52)
+#define VTD_PRD_PMR(val)        (((val) & 1ULL) << 53)
+/* For the high 64-bit of 128-bit */
+#define VTD_PRD_RDR(val)        ((val) & 1ULL)
+#define VTD_PRD_WRR(val)        (((val) & 1ULL) << 1)
+#define VTD_PRD_LPIG(val)       (((val) & 1ULL) << 2)
+#define VTD_PRD_PRGI(val)       (((val) & 0x1ffULL) << 3)
+#define VTD_PRD_ADDR(val)       ((val) & 0xfffffffffffff000ULL)
+
+/* Page Request Queue constants */
+#define VTD_PQA_ENTRY_SIZE      32 /* Size of an entry in bytes */
+/* Page Request Queue masks */
+#define VTD_PQA_ADDR            0xfffffffffffff000ULL /* PR queue address */
+#define VTD_PQA_SIZE            0x7ULL /* PR queue size */
+#define VTD_PR_STATUS_PPR       1UL /* Pending page request */
+#define VTD_PR_STATUS_PRO       2UL /* Page request overflow */
+#define VTD_PR_PECTL_IP         0x40000000UL /* PR control interrup pending */
+#define VTD_PR_PECTL_IM         0x80000000UL /* PR control interrup mask */
+
 /* Information about page-selective IOTLB invalidate */
 struct VTDIOTLBPageInvInfo {
     uint16_t domain_id;
@@ -550,6 +598,7 @@ typedef struct VTDRootEntry VTDRootEntry;
 #define VTD_SM_CONTEXT_ENTRY_RID2PASID_MASK 0xfffff
 #define VTD_SM_CONTEXT_ENTRY_RSVD_VAL0(aw)  (0x1e0ULL | ~VTD_HAW_MASK(aw))
 #define VTD_SM_CONTEXT_ENTRY_RSVD_VAL1      0xffffffffffe00000ULL
+#define VTD_SM_CONTEXT_ENTRY_PRE            0x10ULL
 
 /* PASID Table Related Definitions */
 #define VTD_PASID_DIR_BASE_ADDR_MASK  (~0xfffULL)

From b84e1e0730f3063fc453ce2d0a77136f101467a2 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 1 Sep 2025 11:17:23 +0000
Subject: [PATCH 0978/2396] intel_iommu: Declare registers for PRI

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901111630.1018573-5-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 55 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 55 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 4e7ad3a290..d952ec1428 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3386,6 +3386,27 @@ static void vtd_handle_iectl_write(IntelIOMMUState *s)
     }
 }
 
+static void vtd_handle_prs_write(IntelIOMMUState *s)
+{
+    uint32_t prs = vtd_get_long_raw(s, DMAR_PRS_REG);
+    if (!(prs & VTD_PR_STATUS_PPR) && !(prs & VTD_PR_STATUS_PRO)) {
+        vtd_set_clear_mask_long(s, DMAR_PECTL_REG, VTD_PR_PECTL_IP, 0);
+    }
+}
+
+static void vtd_handle_pectl_write(IntelIOMMUState *s)
+{
+    uint32_t pectl = vtd_get_long_raw(s, DMAR_PECTL_REG);
+    if ((pectl & VTD_PR_PECTL_IP) && !(pectl & VTD_PR_PECTL_IM)) {
+        /*
+         * If IP field was 1 when software clears the IM field,
+         * the  interrupt is generated along with clearing the IP field.
+         */
+        vtd_set_clear_mask_long(s, DMAR_PECTL_REG, VTD_PR_PECTL_IP, 0);
+        vtd_generate_interrupt(s, DMAR_PEADDR_REG, DMAR_PEDATA_REG);
+    }
+}
+
 static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
 {
     IntelIOMMUState *s = opaque;
@@ -3428,6 +3449,11 @@ static uint64_t vtd_mem_read(void *opaque, hwaddr addr, unsigned size)
         val = s->iq >> 32;
         break;
 
+    case DMAR_PEUADDR_REG:
+        assert(size == 4);
+        val = vtd_get_long_raw(s, DMAR_PEUADDR_REG);
+        break;
+
     default:
         if (size == 4) {
             val = vtd_get_long(s, addr);
@@ -3491,6 +3517,11 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
         vtd_handle_iotlb_write(s);
         break;
 
+    case DMAR_PEUADDR_REG:
+        assert(size == 4);
+        vtd_set_long(s, addr, val);
+        break;
+
     /* Invalidate Address Register, 64-bit */
     case DMAR_IVA_REG:
         if (size == 4) {
@@ -3671,6 +3702,18 @@ static void vtd_mem_write(void *opaque, hwaddr addr,
         vtd_set_long(s, addr, val);
         break;
 
+    case DMAR_PRS_REG:
+        assert(size == 4);
+        vtd_set_long(s, addr, val);
+        vtd_handle_prs_write(s);
+        break;
+
+    case DMAR_PECTL_REG:
+        assert(size == 4);
+        vtd_set_long(s, addr, val);
+        vtd_handle_pectl_write(s);
+        break;
+
     default:
         if (size == 4) {
             vtd_set_long(s, addr, val);
@@ -4722,6 +4765,18 @@ static void vtd_init(IntelIOMMUState *s)
      * Interrupt remapping registers.
      */
     vtd_define_quad(s, DMAR_IRTA_REG, 0, 0xfffffffffffff80fULL, 0);
+
+    /* Page request registers */
+    if (s->ecap & VTD_ECAP_PRS) {
+        vtd_define_quad(s, DMAR_PQH_REG, 0, 0x7ffe0ULL, 0);
+        vtd_define_quad(s, DMAR_PQT_REG, 0, 0x7ffe0ULL, 0);
+        vtd_define_quad(s, DMAR_PQA_REG, 0, 0xfffffffffffff007ULL, 0);
+        vtd_define_long(s, DMAR_PRS_REG, 0, 0, 0x3UL);
+        vtd_define_long(s, DMAR_PECTL_REG, 0, 0x80000000UL, 0);
+        vtd_define_long(s, DMAR_PEDATA_REG, 0, 0xffffUL, 0);
+        vtd_define_long(s, DMAR_PEADDR_REG, 0, 0xfffffffcUL, 0);
+        vtd_define_long(s, DMAR_PEUADDR_REG, 0, 0xffffffffUL, 0);
+    }
 }
 
 /* Should not reset address_spaces when reset because devices will still use

From 676757e50ce0ce206969b02dc2433c9e825e55f5 Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 1 Sep 2025 11:17:24 +0000
Subject: [PATCH 0979/2396] intel_iommu: Add PRI operations support

Implement the PRI callbacks in vtd_iommu_ops.

Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250901111630.1018573-6-clement.mathieu--drif@eviden.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c          | 274 +++++++++++++++++++++++++++++++++
 hw/i386/intel_iommu_internal.h |   2 +
 include/hw/i386/intel_iommu.h  |   1 +
 3 files changed, 277 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index d952ec1428..2cc9bd5e45 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -45,6 +45,8 @@
     ((ce)->val[1] & VTD_SM_CONTEXT_ENTRY_RID2PASID_MASK)
 #define VTD_CE_GET_PASID_DIR_TABLE(ce) \
     ((ce)->val[0] & VTD_PASID_DIR_BASE_ADDR_MASK)
+#define VTD_CE_GET_PRE(ce) \
+    ((ce)->val[0] & VTD_SM_CONTEXT_ENTRY_PRE)
 
 /* pe operations */
 #define VTD_PE_GET_TYPE(pe) ((pe)->val[0] & VTD_SM_PASID_ENTRY_PGTT)
@@ -1838,6 +1840,7 @@ static const bool vtd_qualified_faults[] = {
     [VTD_FR_FS_NON_CANONICAL] = true,
     [VTD_FR_FS_PAGING_ENTRY_US] = true,
     [VTD_FR_SM_WRITE] = true,
+    [VTD_FR_SM_PRE_ABS] = true,
     [VTD_FR_SM_INTERRUPT_ADDR] = true,
     [VTD_FR_FS_BIT_UPDATE_FAILED] = true,
     [VTD_FR_MAX] = false,
@@ -3152,6 +3155,59 @@ static bool vtd_process_device_piotlb_desc(IntelIOMMUState *s,
     return true;
 }
 
+static bool vtd_process_page_group_response_desc(IntelIOMMUState *s,
+                                                 VTDInvDesc *inv_desc)
+{
+    VTDAddressSpace *vtd_dev_as;
+    bool pasid_present;
+    uint8_t response_code;
+    uint16_t rid;
+    uint32_t pasid;
+    uint16_t prgi;
+    IOMMUPRIResponse response;
+
+    if ((inv_desc->lo & VTD_INV_DESC_PGRESP_RSVD_LO) ||
+        (inv_desc->hi & VTD_INV_DESC_PGRESP_RSVD_HI)) {
+        error_report_once("%s: invalid page group response desc: hi=%"PRIx64
+                            ", lo=%"PRIx64" (reserved nonzero)", __func__,
+                            inv_desc->hi, inv_desc->lo);
+        return false;
+    }
+
+    pasid_present = VTD_INV_DESC_PGRESP_PP(inv_desc->lo);
+    response_code = VTD_INV_DESC_PGRESP_RC(inv_desc->lo);
+    rid = VTD_INV_DESC_PGRESP_RID(inv_desc->lo);
+    pasid = VTD_INV_DESC_PGRESP_PASID(inv_desc->lo);
+    prgi = VTD_INV_DESC_PGRESP_PRGI(inv_desc->hi);
+
+    if (!pasid_present) {
+        error_report_once("Page group response without PASID is"
+                          "not supported yet");
+        return false;
+    }
+
+    vtd_dev_as = vtd_get_as_by_sid_and_pasid(s, rid, pasid);
+    if (!vtd_dev_as) {
+        return true;
+    }
+
+    response.prgi = prgi;
+
+    if (response_code == 0x0u) {
+        response.response_code = IOMMU_PRI_RESP_SUCCESS;
+    } else if (response_code == 0x1u) {
+        response.response_code = IOMMU_PRI_RESP_INVALID_REQUEST;
+    } else {
+        response.response_code = IOMMU_PRI_RESP_FAILURE;
+    }
+
+    if (vtd_dev_as->pri_notifier) {
+        vtd_dev_as->pri_notifier->notify(vtd_dev_as->pri_notifier, &response);
+    }
+
+    return true;
+}
+
 static bool vtd_process_device_iotlb_desc(IntelIOMMUState *s,
                                           VTDInvDesc *inv_desc)
 {
@@ -3252,6 +3308,13 @@ static bool vtd_process_inv_desc(IntelIOMMUState *s)
         }
         break;
 
+    case VTD_INV_DESC_PGRESP:
+        trace_vtd_inv_desc("page group response", inv_desc.hi, inv_desc.lo);
+        if (!vtd_process_page_group_response_desc(s, &inv_desc)) {
+            return false;
+        }
+        break;
+
     /*
      * TODO: the entity of below two cases will be implemented in future series.
      * To make guest (which integrates scalable mode support patch set in
@@ -4864,6 +4927,194 @@ static ssize_t vtd_ats_request_translation(PCIBus *bus, void *opaque,
     return res_index;
 }
 
+/* 11.4.11.3 : The number of entries in the page request queue is 2^(PQS + 7) */
+static inline uint64_t vtd_prq_size(IntelIOMMUState *s)
+{
+    return 1ULL << ((vtd_get_quad(s, DMAR_PQA_REG) & VTD_PQA_SIZE) + 7);
+}
+
+/**
+ * Return true if the bit is accessible and correctly set, false otherwise
+ */
+static bool vtd_check_pre_bit(VTDAddressSpace *vtd_as, hwaddr addr,
+                              uint16_t sid, bool is_write)
+{
+    int ret;
+    IntelIOMMUState *s = vtd_as->iommu_state;
+    uint8_t bus_n = pci_bus_num(vtd_as->bus);
+    VTDContextEntry ce;
+    bool is_fpd_set = false;
+
+    ret = vtd_dev_to_context_entry(s, bus_n, vtd_as->devfn, &ce);
+
+    if (ret) {
+        goto error_report;
+    }
+
+    if (!VTD_CE_GET_PRE(&ce)) {
+        ret = -VTD_FR_SM_PRE_ABS;
+        goto error_get_fpd_and_report;
+    }
+
+    return true;
+
+error_get_fpd_and_report:
+    /* Try to get fpd (may not work but we are already on an error path) */
+    is_fpd_set = ce.lo & VTD_CONTEXT_ENTRY_FPD;
+    vtd_ce_get_pasid_fpd(s, &ce, &is_fpd_set, vtd_as->pasid);
+error_report:
+    vtd_report_fault(s, -ret, is_fpd_set, sid, addr, is_write,
+                     vtd_as->pasid != PCI_NO_PASID, vtd_as->pasid);
+    return false;
+}
+
+/* Logic described in section 7.5 */
+static void vtd_generate_page_request_event(IntelIOMMUState *s,
+                                            uint32_t old_pr_status)
+{
+    uint32_t current_pectl = vtd_get_long(s, DMAR_PECTL_REG);
+    /*
+     * Hardware evaluates PPR and PRO fields in the Page Request Status Register
+     * and if any of them is set, Page Request Event is not generated
+     */
+    if (old_pr_status & (VTD_PR_STATUS_PRO | VTD_PR_STATUS_PPR)) {
+        return;
+    }
+
+    vtd_set_clear_mask_long(s, DMAR_PECTL_REG, 0, VTD_PR_PECTL_IP);
+    if (!(current_pectl & VTD_PR_PECTL_IM)) {
+        vtd_set_clear_mask_long(s, DMAR_PECTL_REG, VTD_PR_PECTL_IP, 0);
+        vtd_generate_interrupt(s, DMAR_PEADDR_REG, DMAR_PEDATA_REG);
+    }
+}
+
+/* When calling this function, we known that we are in scalable mode */
+static int vtd_pri_perform_implicit_invalidation(VTDAddressSpace *vtd_as,
+                                                 hwaddr addr)
+{
+    IntelIOMMUState *s = vtd_as->iommu_state;
+    VTDContextEntry ce;
+    VTDPASIDEntry pe;
+    uint16_t pgtt;
+    uint16_t domain_id;
+    int ret = vtd_dev_to_context_entry(s, pci_bus_num(vtd_as->bus),
+                                       vtd_as->devfn, &ce);
+    if (ret) {
+        return -EINVAL;
+    }
+    ret = vtd_ce_get_rid2pasid_entry(s, &ce, &pe, vtd_as->pasid);
+    if (ret) {
+        return -EINVAL;
+    }
+    pgtt = VTD_PE_GET_TYPE(&pe);
+    domain_id = VTD_SM_PASID_ENTRY_DID(pe.val[1]);
+    ret = 0;
+    switch (pgtt) {
+    case VTD_SM_PASID_ENTRY_FLT:
+        vtd_piotlb_page_invalidate(s, domain_id, vtd_as->pasid, addr, 0);
+        break;
+    /* Room for other pgtt values */
+    default:
+        error_report_once("Translation type not supported yet : %d", pgtt);
+        ret = -EINVAL;
+        break;
+    }
+
+    return ret;
+}
+
+/* Page Request Descriptor : 7.4.1.1 */
+static int vtd_pri_request_page(PCIBus *bus, void *opaque, int devfn,
+                                uint32_t pasid, bool priv_req, bool exec_req,
+                                hwaddr addr, bool lpig, uint16_t prgi,
+                                bool is_read, bool is_write)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+
+    uint64_t queue_addr_reg = vtd_get_quad(s, DMAR_PQA_REG);
+    uint64_t queue_tail_offset_reg = vtd_get_quad(s, DMAR_PQT_REG);
+    uint64_t new_queue_tail_offset = (
+                                (queue_tail_offset_reg + VTD_PQA_ENTRY_SIZE) %
+                                (vtd_prq_size(s) * VTD_PQA_ENTRY_SIZE));
+    uint64_t queue_head_offset_reg = vtd_get_quad(s, DMAR_PQH_REG);
+    hwaddr queue_tail = (queue_addr_reg & VTD_PQA_ADDR) + queue_tail_offset_reg;
+    uint32_t old_pr_status = vtd_get_long(s, DMAR_PRS_REG);
+    uint16_t sid = PCI_BUILD_BDF(pci_bus_num(vtd_as->bus), vtd_as->devfn);
+    VTDPRDesc desc;
+
+    if (!(s->ecap & VTD_ECAP_PRS)) {
+        return -EPERM;
+    }
+
+    /*
+     * No need to check if scalable mode is enabled as we already known that
+     * VTD_ECAP_PRS is set (see vtd_decide_config)
+     */
+
+    /* We do not support PRI without PASID */
+    if (vtd_as->pasid == PCI_NO_PASID) {
+        return -EPERM;
+    }
+    if (exec_req && !is_read) {
+        return -EINVAL;
+    }
+
+    /* Check PRE bit in the scalable mode context entry */
+    if (!vtd_check_pre_bit(vtd_as, addr, sid, is_write)) {
+        return -EPERM;
+    }
+
+    if (old_pr_status & VTD_PR_STATUS_PRO) {
+        /*
+         * No action is taken by hardware to report a fault
+         * or generate an event
+         */
+        return -ENOSPC;
+    }
+
+    /* Check for overflow */
+    if (new_queue_tail_offset == queue_head_offset_reg) {
+        vtd_set_clear_mask_long(s, DMAR_PRS_REG, 0, VTD_PR_STATUS_PRO);
+        vtd_generate_page_request_event(s, old_pr_status);
+        return -ENOSPC;
+    }
+
+    if (vtd_pri_perform_implicit_invalidation(vtd_as, addr)) {
+        return -EINVAL;
+    }
+
+    desc.lo = VTD_PRD_TYPE | VTD_PRD_PP(true) | VTD_PRD_RID(sid) |
+              VTD_PRD_PASID(vtd_as->pasid) | VTD_PRD_PMR(priv_req);
+    desc.hi = VTD_PRD_RDR(is_read) | VTD_PRD_WRR(is_write) |
+              VTD_PRD_LPIG(lpig) | VTD_PRD_PRGI(prgi) | VTD_PRD_ADDR(addr);
+
+    desc.lo = cpu_to_le64(desc.lo);
+    desc.hi = cpu_to_le64(desc.hi);
+    if (dma_memory_write(&address_space_memory, queue_tail, &desc, sizeof(desc),
+                         MEMTXATTRS_UNSPECIFIED)) {
+        error_report_once("IO error, the PQ tail cannot be updated");
+        return -EIO;
+    }
+
+    /* increment the tail register and set the pending request bit */
+    vtd_set_quad(s, DMAR_PQT_REG, new_queue_tail_offset);
+    /*
+     * read status again so that the kernel does not miss a request.
+     * in some cases, we can trigger an unecessary interrupt but this strategy
+     * drastically improves performance as we don't need to take a lock.
+     */
+    old_pr_status = vtd_get_long(s, DMAR_PRS_REG);
+    if (!(old_pr_status & VTD_PR_STATUS_PPR)) {
+        vtd_set_clear_mask_long(s, DMAR_PRS_REG, 0, VTD_PR_STATUS_PPR);
+        vtd_generate_page_request_event(s, old_pr_status);
+    }
+
+    return 0;
+}
+
 static void vtd_init_iotlb_notifier(PCIBus *bus, void *opaque, int devfn,
                                     IOMMUNotifier *n, IOMMUNotify fn,
                                     void *user_opaque)
@@ -4905,6 +5156,26 @@ static void vtd_unregister_iotlb_notifier(PCIBus *bus, void *opaque,
     memory_region_unregister_iommu_notifier(MEMORY_REGION(&vtd_as->iommu), n);
 }
 
+static void vtd_pri_register_notifier(PCIBus *bus, void *opaque, int devfn,
+                               uint32_t pasid, IOMMUPRINotifier *notifier)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+    vtd_as->pri_notifier = notifier;
+}
+
+static void vtd_pri_unregister_notifier(PCIBus *bus, void *opaque,
+                                        int devfn, uint32_t pasid)
+{
+    IntelIOMMUState *s = opaque;
+    VTDAddressSpace *vtd_as;
+
+    vtd_as = vtd_find_add_as(s, bus, devfn, pasid);
+    vtd_as->pri_notifier = NULL;
+}
+
 static PCIIOMMUOps vtd_iommu_ops = {
     .get_address_space = vtd_host_dma_iommu,
     .set_iommu_device = vtd_dev_set_iommu_device,
@@ -4914,6 +5185,9 @@ static PCIIOMMUOps vtd_iommu_ops = {
     .register_iotlb_notifier = vtd_register_iotlb_notifier,
     .unregister_iotlb_notifier = vtd_unregister_iotlb_notifier,
     .ats_request_translation = vtd_ats_request_translation,
+    .pri_register_notifier = vtd_pri_register_notifier,
+    .pri_unregister_notifier = vtd_pri_unregister_notifier,
+    .pri_request_page = vtd_pri_request_page,
 };
 
 static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)
diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 04a8d4c769..0d0069a612 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -315,6 +315,8 @@ typedef enum VTDFaultReason {
                                   * request while disabled */
     VTD_FR_IR_SID_ERR = 0x26,   /* Invalid Source-ID */
 
+    VTD_FR_SM_PRE_ABS = 0x47,   /* SCT.8 : PRE bit in a present SM CE is 0 */
+
     /* PASID directory entry access failure */
     VTD_FR_PASID_DIR_ACCESS_ERR = 0x50,
     /* The Present(P) field of pasid directory entry is 0 */
diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
index e95477e855..47730ac3c7 100644
--- a/include/hw/i386/intel_iommu.h
+++ b/include/hw/i386/intel_iommu.h
@@ -110,6 +110,7 @@ struct VTDAddressSpace {
     QLIST_ENTRY(VTDAddressSpace) next;
     /* Superset of notifier flags that this address space has */
     IOMMUNotifierFlag notifier_flags;
+    IOMMUPRINotifier *pri_notifier;
     /*
      * @iova_tree traces mapped IOVA ranges.
      *

From b10166b104fad54d5d79024beafe1bcfe8a35c4a Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Mon, 22 Sep 2025 15:26:00 +0200
Subject: [PATCH 0980/2396] x86: ich9: fix default value of 'No Reboot' bit in
 GCS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[2] initialized 'No Reboot' bit to 1 by default. And due to quirk it happened
to work with linux iTCO_wdt driver (which clears it on module load).

However spec [1] states:
"
R/W. This bit is set when the “No Reboot” strap (SPKR pin on
ICH9) is sampled high on PWROK.
"

So it should be set only when  '-global ICH9-LPC.noreboot=true' and cleared
when it's false (which should be default).

Fix it to behave according to spec and set 'No Reboot' bit only when
'-global ICH9-LPC.noreboot=true'.

1)
Intel I/O Controller Hub 9 (ICH9) Family Datasheet (rev: 004)
2)

Fixes: 920557971b6 (ich9: add TCO interface emulation)
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Tested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922132600.562193-1-imammedo@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/isa/lpc_ich9.c             | 7 ++++++-
 include/hw/southbridge/ich9.h | 2 +-
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/isa/lpc_ich9.c b/hw/isa/lpc_ich9.c
index 304dffac32..c9cb8f7779 100644
--- a/hw/isa/lpc_ich9.c
+++ b/hw/isa/lpc_ich9.c
@@ -132,6 +132,11 @@ static void ich9_cc_init(ICH9LPCState *lpc)
 static void ich9_cc_reset(ICH9LPCState *lpc)
 {
     uint8_t *c = lpc->chip_config;
+    uint32_t gcs = ICH9_CC_GCS_DEFAULT;
+
+    if (lpc->pin_strap.spkr_hi) {
+        gcs |= ICH9_CC_GCS_NO_REBOOT;
+    }
 
     memset(lpc->chip_config, 0, sizeof(lpc->chip_config));
 
@@ -142,7 +147,7 @@ static void ich9_cc_reset(ICH9LPCState *lpc)
     pci_set_long(c + ICH9_CC_D27IR, ICH9_CC_DIR_DEFAULT);
     pci_set_long(c + ICH9_CC_D26IR, ICH9_CC_DIR_DEFAULT);
     pci_set_long(c + ICH9_CC_D25IR, ICH9_CC_DIR_DEFAULT);
-    pci_set_long(c + ICH9_CC_GCS, ICH9_CC_GCS_DEFAULT);
+    pci_set_long(c + ICH9_CC_GCS, gcs);
 
     ich9_cc_update(lpc);
 }
diff --git a/include/hw/southbridge/ich9.h b/include/hw/southbridge/ich9.h
index 1e231e89c9..2c35dd0484 100644
--- a/include/hw/southbridge/ich9.h
+++ b/include/hw/southbridge/ich9.h
@@ -95,7 +95,7 @@ struct ICH9LPCState {
 #define ICH9_CC_OIC                             0x31FF
 #define ICH9_CC_OIC_AEN                         0x1
 #define ICH9_CC_GCS                             0x3410
-#define ICH9_CC_GCS_DEFAULT                     0x00000020
+#define ICH9_CC_GCS_DEFAULT                     0x00000000
 #define ICH9_CC_GCS_NO_REBOOT                   (1 << 5)
 
 /* D28:F[0-5] */

From 2e41580328a9cdfffce3ee496857c1b2d6ed365e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 22 Sep 2025 18:01:45 -0400
Subject: [PATCH 0981/2396] vhost: use virtio_config_get_guest_notifier()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is a getter function so avoid accessing the ->config_notifier
field directly.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922220149.498967-2-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vhost.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 5f485ad6cb..c120ef38b9 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1846,7 +1846,7 @@ void vhost_config_mask(struct vhost_dev *hdev, VirtIODevice *vdev, bool mask)
     int r;
     EventNotifier *notifier =
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier;
-    EventNotifier *config_notifier = &vdev->config_notifier;
+    EventNotifier *config_notifier = virtio_config_get_guest_notifier(vdev);
     assert(hdev->vhost_ops);
 
     if ((hdev->started == false) ||
@@ -1877,13 +1877,15 @@ static void vhost_stop_config_intr(struct vhost_dev *dev)
 static void vhost_start_config_intr(struct vhost_dev *dev)
 {
     int r;
+    EventNotifier *config_notifier =
+        virtio_config_get_guest_notifier(dev->vdev);
 
     assert(dev->vhost_ops);
-    int fd = event_notifier_get_fd(&dev->vdev->config_notifier);
+    int fd = event_notifier_get_fd(config_notifier);
     if (dev->vhost_ops->vhost_set_config_call) {
         r = dev->vhost_ops->vhost_set_config_call(dev, fd);
         if (!r) {
-            event_notifier_set(&dev->vdev->config_notifier);
+            event_notifier_set(config_notifier);
         }
     }
 }
@@ -2167,12 +2169,13 @@ static int do_vhost_dev_stop(struct vhost_dev *hdev, VirtIODevice *vdev,
 {
     int i;
     int rc = 0;
+    EventNotifier *config_notifier = virtio_config_get_guest_notifier(vdev);
 
     /* should only be called after backend is connected */
     assert(hdev->vhost_ops);
     event_notifier_test_and_clear(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
-    event_notifier_test_and_clear(&vdev->config_notifier);
+    event_notifier_test_and_clear(config_notifier);
     event_notifier_cleanup(
         &hdev->vqs[VHOST_QUEUE_NUM_CONFIG_INR].masked_config_notifier);
 

From 1e9181dc5277f27fcda21f64a399f12bbf578e5e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 22 Sep 2025 18:01:46 -0400
Subject: [PATCH 0982/2396] virtio: unify virtio_notify_irqfd() and
 virtio_notify()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The difference between these two functions:
- virtio_notify() uses the interrupt code path (MSI or classic IRQs)
- virtio_notify_irqfd() uses guest notifiers (irqfds)

virtio_notify() can only be called with the BQL held because the
interrupt code path requires the BQL. Device models use
virtio_notify_irqfd() from IOThreads since the BQL is not held.

The two functions can be unified by pushing down the if
(qemu_in_iothread()) check from virtio-blk and virtio-scsi into core
virtio code. This is in preparation for the next commit that will add
irqfd support to virtio_notify_config() and where it's unattractive to
introduce another irqfd-only API for device model callers.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922220149.498967-3-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/block/virtio-blk.c      |  6 +-----
 hw/scsi/virtio-scsi.c      |  6 +-----
 hw/virtio/trace-events     |  1 -
 hw/virtio/virtio.c         | 28 +++++++++++++---------------
 include/hw/virtio/virtio.h |  1 -
 5 files changed, 15 insertions(+), 27 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index 9bab2716c1..64efce4846 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -62,11 +62,7 @@ void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
     iov_discard_undo(&req->inhdr_undo);
     iov_discard_undo(&req->outhdr_undo);
     virtqueue_push(req->vq, &req->elem, req->in_len);
-    if (qemu_in_iothread()) {
-        virtio_notify_irqfd(vdev, req->vq);
-    } else {
-        virtio_notify(vdev, req->vq);
-    }
+    virtio_notify(vdev, req->vq);
 }
 
 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index 34ae14f7bf..d817fc42b4 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -116,11 +116,7 @@ static void virtio_scsi_complete_req(VirtIOSCSIReq *req, QemuMutex *vq_lock)
     }
 
     virtqueue_push(vq, &req->elem, req->qsgl.size + req->resp_iov.size);
-    if (s->dataplane_started && !s->dataplane_fenced) {
-        virtio_notify_irqfd(vdev, vq);
-    } else {
-        virtio_notify(vdev, vq);
-    }
+    virtio_notify(vdev, vq);
 
     if (vq_lock) {
         qemu_mutex_unlock(vq_lock);
diff --git a/hw/virtio/trace-events b/hw/virtio/trace-events
index 76f0d458b2..658cc365e7 100644
--- a/hw/virtio/trace-events
+++ b/hw/virtio/trace-events
@@ -75,7 +75,6 @@ virtqueue_flush(void *vq, unsigned int count) "vq %p count %u"
 virtqueue_pop(void *vq, void *elem, unsigned int in_num, unsigned int out_num) "vq %p elem %p in_num %u out_num %u"
 virtio_queue_notify(void *vdev, int n, void *vq) "vdev %p n %d vq %p"
 virtio_notify_irqfd_deferred_fn(void *vdev, void *vq) "vdev %p vq %p"
-virtio_notify_irqfd(void *vdev, void *vq) "vdev %p vq %p"
 virtio_notify(void *vdev, void *vq) "vdev %p vq %p"
 virtio_set_status(void *vdev, uint8_t val) "vdev %p val %u"
 
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 34f977a3c9..6ce5823898 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -31,6 +31,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/virtio/virtio-access.h"
 #include "system/dma.h"
+#include "system/iothread.h"
 #include "system/runstate.h"
 #include "virtio-qmp.h"
 
@@ -2654,16 +2655,8 @@ static void virtio_notify_irqfd_deferred_fn(void *opaque)
     event_notifier_set(notifier);
 }
 
-void virtio_notify_irqfd(VirtIODevice *vdev, VirtQueue *vq)
+static void virtio_irq(VirtQueue *vq)
 {
-    WITH_RCU_READ_LOCK_GUARD() {
-        if (!virtio_should_notify(vdev, vq)) {
-            return;
-        }
-    }
-
-    trace_virtio_notify_irqfd(vdev, vq);
-
     /*
      * virtio spec 1.0 says ISR bit 0 should be ignored with MSI, but
      * windows drivers included in virtio-win 1.8.0 (circa 2015) are
@@ -2680,13 +2673,18 @@ void virtio_notify_irqfd(VirtIODevice *vdev, VirtQueue *vq)
      * to an atomic operation.
      */
     virtio_set_isr(vq->vdev, 0x1);
-    defer_call(virtio_notify_irqfd_deferred_fn, &vq->guest_notifier);
-}
 
-static void virtio_irq(VirtQueue *vq)
-{
-    virtio_set_isr(vq->vdev, 0x1);
-    virtio_notify_vector(vq->vdev, vq->vector);
+    /*
+     * The interrupt code path requires the Big QEMU Lock (BQL), so use the
+     * notifier instead when in an IOThread. This assumes that device models
+     * have already called ->set_guest_notifiers() sometime before calling this
+     * function.
+     */
+    if (qemu_in_iothread()) {
+        defer_call(virtio_notify_irqfd_deferred_fn, &vq->guest_notifier);
+    } else {
+        virtio_notify_vector(vq->vdev, vq->vector);
+    }
 }
 
 void virtio_notify(VirtIODevice *vdev, VirtQueue *vq)
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index 2aeb021fb3..d97529c3f1 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -294,7 +294,6 @@ int virtqueue_get_avail_bytes(VirtQueue *vq, unsigned int *in_bytes,
                               unsigned int *out_bytes, unsigned max_in_bytes,
                               unsigned max_out_bytes);
 
-void virtio_notify_irqfd(VirtIODevice *vdev, VirtQueue *vq);
 void virtio_notify(VirtIODevice *vdev, VirtQueue *vq);
 
 int virtio_save(VirtIODevice *vdev, QEMUFile *f);

From 3b11003fa67b3f055637ff52e1fe8327f7590ee1 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 22 Sep 2025 18:01:47 -0400
Subject: [PATCH 0983/2396] virtio: support irqfd in virtio_notify_config()

virtio_error() calls virtio_notify_config() to inject a VIRTIO
Configuration Change Notification. This doesn't work from IOThreads
because the BQL is not held and the interrupt code path requires the
BQL.

Follow the same approach as virtio_notify() and use ->config_notifier
(an irqfd) when called from the IOThread.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922220149.498967-4-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/virtio.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 6ce5823898..de89e8104a 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -2706,7 +2706,12 @@ void virtio_notify_config(VirtIODevice *vdev)
 
     virtio_set_isr(vdev, 0x3);
     vdev->generation++;
-    virtio_notify_vector(vdev, vdev->config_vector);
+
+    if (qemu_in_iothread()) {
+        defer_call(virtio_notify_irqfd_deferred_fn, &vdev->config_notifier);
+    } else {
+        virtio_notify_vector(vdev, vdev->config_vector);
+    }
 }
 
 static bool virtio_device_endian_needed(void *opaque)

From e06d96d5a9f81608ede08576445ac20ac2e73dcc Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 22 Sep 2025 18:01:48 -0400
Subject: [PATCH 0984/2396] tests/libqos: extract qvirtqueue_set_avail_idx()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Setting the vring's avail.idx can be useful for low-level VIRTIO tests,
especially for testing error scenarios with invalid vrings. Extract it
into a new function so that the next commit can add a test that uses
this new test API.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922220149.498967-5-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/libqos/virtio.c | 16 ++++++++++++----
 tests/qtest/libqos/virtio.h |  2 ++
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/tests/qtest/libqos/virtio.c b/tests/qtest/libqos/virtio.c
index 5a709d0bc5..010ff40834 100644
--- a/tests/qtest/libqos/virtio.c
+++ b/tests/qtest/libqos/virtio.c
@@ -265,8 +265,9 @@ void qvring_init(QTestState *qts, const QGuestAllocator *alloc, QVirtQueue *vq,
 
     /* vq->avail->flags */
     qvirtio_writew(vq->vdev, qts, vq->avail, 0);
-    /* vq->avail->idx */
-    qvirtio_writew(vq->vdev, qts, vq->avail + 2, 0);
+
+    qvirtqueue_set_avail_idx(qts, vq->vdev, vq, 0);
+
     /* vq->avail->used_event */
     qvirtio_writew(vq->vdev, qts, vq->avail + 4 + (2 * vq->size), 0);
 
@@ -388,6 +389,13 @@ uint32_t qvirtqueue_add_indirect(QTestState *qts, QVirtQueue *vq,
     return vq->free_head++; /* Return and increase, in this order */
 }
 
+void qvirtqueue_set_avail_idx(QTestState *qts, QVirtioDevice *d,
+                              QVirtQueue *vq, uint16_t idx)
+{
+    /* vq->avail->idx */
+    qvirtio_writew(d, qts, vq->avail + 2, idx);
+}
+
 void qvirtqueue_kick(QTestState *qts, QVirtioDevice *d, QVirtQueue *vq,
                      uint32_t free_head)
 {
@@ -400,8 +408,8 @@ void qvirtqueue_kick(QTestState *qts, QVirtioDevice *d, QVirtQueue *vq,
 
     /* vq->avail->ring[idx % vq->size] */
     qvirtio_writew(d, qts, vq->avail + 4 + (2 * (idx % vq->size)), free_head);
-    /* vq->avail->idx */
-    qvirtio_writew(d, qts, vq->avail + 2, idx + 1);
+
+    qvirtqueue_set_avail_idx(qts, d, vq, idx + 1);
 
     /* Must read after idx is updated */
     flags = qvirtio_readw(d, qts, vq->used);
diff --git a/tests/qtest/libqos/virtio.h b/tests/qtest/libqos/virtio.h
index 7adc7cbd10..e238f1726f 100644
--- a/tests/qtest/libqos/virtio.h
+++ b/tests/qtest/libqos/virtio.h
@@ -143,6 +143,8 @@ uint32_t qvirtqueue_add(QTestState *qts, QVirtQueue *vq, uint64_t data,
                         uint32_t len, bool write, bool next);
 uint32_t qvirtqueue_add_indirect(QTestState *qts, QVirtQueue *vq,
                                  QVRingIndirectDesc *indirect);
+void qvirtqueue_set_avail_idx(QTestState *qts, QVirtioDevice *d,
+                              QVirtQueue *vq, uint16_t idx);
 void qvirtqueue_kick(QTestState *qts, QVirtioDevice *d, QVirtQueue *vq,
                      uint32_t free_head);
 bool qvirtqueue_get_buf(QTestState *qts, QVirtQueue *vq, uint32_t *desc_idx,

From acaa3be3f7f73d9aafeb2454c01fe50eb8b4a807 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 22 Sep 2025 18:01:49 -0400
Subject: [PATCH 0985/2396] tests/virtio-scsi: add a virtio_error() IOThread
 test

Now that virtio_error() calls should work in an IOThread, add a
virtio-scsi IOThread test cases that triggers virtio_error().

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250922220149.498967-6-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 tests/qtest/virtio-scsi-test.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/tests/qtest/virtio-scsi-test.c b/tests/qtest/virtio-scsi-test.c
index db10d572d0..e2350c52f6 100644
--- a/tests/qtest/virtio-scsi-test.c
+++ b/tests/qtest/virtio-scsi-test.c
@@ -311,6 +311,31 @@ fail:
     unlink(tmp_path);
 }
 
+static void test_iothread_virtio_error(void *obj, void *data,
+                                       QGuestAllocator *t_alloc)
+{
+    QVirtioSCSIPCI *scsi_pci = obj;
+    QVirtioSCSI *scsi = &scsi_pci->scsi;
+    QVirtioSCSIQueues *vs;
+    QVirtQueue *vq;
+
+    alloc = t_alloc;
+    vs = qvirtio_scsi_init(scsi->vdev);
+    vq = vs->vq[2];
+
+    /* Move avail.idx out of bounds to trigger virtio_error() */
+    qvirtqueue_set_avail_idx(global_qtest, scsi->vdev, vq, vq->size * 2);
+    scsi->vdev->bus->virtqueue_kick(scsi->vdev, vq);
+
+    /*
+     * Reset the device out of the error state. If QEMU hangs or crashes then
+     * this will fail.
+     */
+    qvirtio_reset(scsi->vdev);
+
+    qvirtio_scsi_pci_free(vs);
+}
+
 static void *virtio_scsi_hotplug_setup(GString *cmd_line, void *arg)
 {
     g_string_append(cmd_line,
@@ -383,6 +408,13 @@ static void register_virtio_scsi_test(void)
     };
     qos_add_test("iothread-attach-node", "virtio-scsi-pci",
                  test_iothread_attach_node, &opts);
+
+    opts.before = virtio_scsi_setup_iothread;
+    opts.edge = (QOSGraphEdgeOptions) {
+        .extra_device_opts = "iothread=thread0",
+    };
+    qos_add_test("iothread-virtio-error", "virtio-scsi-pci",
+                 test_iothread_virtio_error, &opts);
 }
 
 libqos_init(register_virtio_scsi_test);

From bab681f752048c3bc22d561b1d314c7ec16419c9 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 24 Sep 2025 11:51:53 -0400
Subject: [PATCH 0986/2396] pcie_sriov: make pcie_sriov_pf_exit() safe on
 non-SR-IOV devices

Commit 3f9cfaa92c96 ("virtio-pci: Implement SR-IOV PF") added an
unconditional call from virtio_pci_exit() to pcie_sriov_pf_exit().

pcie_sriov_pf_exit() reads from the SR-IOV Capability in Configuration
Space:

  uint8_t *cfg = dev->config + dev->exp.sriov_cap;
  ...
  unparent_vfs(dev, pci_get_word(cfg + PCI_SRIOV_TOTAL_VF));
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

This results in undefined behavior when dev->exp.sriov_cap is 0 because
this is not an SR-IOV device. For example, unparent_vfs() segfaults when
total_vfs happens to be non-zero.

Fix this by returning early from pcie_sriov_pf_exit() when
dev->exp.sriov_cap is 0 because this is not an SR-IOV device.

Cc: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Cc: Michael S. Tsirkin <mst@redhat.com>
Reported-by: Qing Wang <qinwang@redhat.com>
Buglink: https://issues.redhat.com/browse/RHEL-116443
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Fixes: cab1398a60eb ("pcie_sriov: Reuse SR-IOV VF device instances")
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250924155153.579495-1-stefanha@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pcie_sriov.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index 29474d749a..c4f88f0975 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -195,7 +195,9 @@ bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
 
 void pcie_sriov_pf_exit(PCIDevice *dev)
 {
-    uint8_t *cfg = dev->config + dev->exp.sriov_cap;
+    if (dev->exp.sriov_cap == 0) {
+        return;
+    }
 
     if (dev->exp.sriov_pf.vf_user_created) {
         uint16_t ven_id = pci_get_word(dev->config + PCI_VENDOR_ID);
@@ -211,6 +213,8 @@ void pcie_sriov_pf_exit(PCIDevice *dev)
             pci_config_set_device_id(dev->exp.sriov_pf.vf[i]->config, vf_dev_id);
         }
     } else {
+        uint8_t *cfg = dev->config + dev->exp.sriov_cap;
+
         unparent_vfs(dev, pci_get_word(cfg + PCI_SRIOV_TOTAL_VF));
     }
 }

From 6d10e021318b16e3e90f98b7b2fa187826e26c0a Mon Sep 17 00:00:00 2001
From: Viktor Kurilko <murlockkinght@gmail.com>
Date: Fri, 8 Aug 2025 21:29:25 +0700
Subject: [PATCH 0987/2396] Add a feature for mapping a host unix socket to a
 guest tcp socket

This patch adds the ability to map a host unix socket to a guest tcp socket when
using the slirp backend. This feature was added in libslirp version 4.7.0.

A new syntax for unix socket: -hostfwd=unix:hostpath-[guestaddr]:guestport

Signed-off-by: Viktor Kurilko <murlockkinght@gmail.com>
Signed-off-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Message-ID: <20250808143904.363907-1-murlockkinght@gmail.com>
---
 docs/system/devices/net.rst |   2 +-
 hmp-commands.hx             |   4 +-
 net/slirp.c                 | 114 +++++++++++++++++++++++++++---------
 qapi/net.json               |   2 +-
 qemu-options.hx             |  11 +++-
 5 files changed, 100 insertions(+), 33 deletions(-)

diff --git a/docs/system/devices/net.rst b/docs/system/devices/net.rst
index 7d76fe88c4..13199a44fd 100644
--- a/docs/system/devices/net.rst
+++ b/docs/system/devices/net.rst
@@ -79,7 +79,7 @@ those sockets. To allow ping for GID 100 (usually users group)::
 
 When using the built-in TFTP server, the router is also the TFTP server.
 
-When using the ``'-netdev user,hostfwd=...'`` option, TCP or UDP
+When using the ``'-netdev user,hostfwd=...'`` option, TCP, UDP or UNIX
 connections can be redirected from the host to the guest. It allows for
 example to redirect X11, telnet or SSH connections.
 
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 3cace8f1f7..15f6082596 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -1357,8 +1357,8 @@ ERST
     {
         .name       = "hostfwd_add",
         .args_type  = "arg1:s,arg2:s?",
-        .params     = "[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
-        .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
+        .params     = "[netdev_id] [tcp|udp|unix]:[[hostaddr]:hostport|hostpath]-[guestaddr]:guestport",
+        .help       = "redirect TCP, UDP or UNIX connections from host to guest (requires -net user)",
         .cmd        = hmp_hostfwd_add,
     },
 #endif
diff --git a/net/slirp.c b/net/slirp.c
index 0a1c2a5eac..c627a9dd24 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -732,6 +732,7 @@ static SlirpState *slirp_lookup(Monitor *mon, const char *id)
 
 void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 {
+    /* TODO: support removing unix fwd */
     struct sockaddr_in host_addr = {
         .sin_family = AF_INET,
         .sin_addr = {
@@ -800,12 +801,13 @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
 
 static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
 {
-    struct sockaddr_in host_addr = {
-        .sin_family = AF_INET,
-        .sin_addr = {
-            .s_addr = INADDR_ANY,
-        },
-    };
+    union {
+        struct sockaddr_in in;
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+        struct sockaddr_un un;
+#endif
+    } host_addr = {0};
+
     struct sockaddr_in guest_addr = {
         .sin_family = AF_INET,
         .sin_addr = {
@@ -816,9 +818,13 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
     int host_port, guest_port;
     const char *p;
     char buf[256];
-    int is_udp;
+    int is_udp = 0;
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+    int is_unix = 0;
+#endif
     const char *end;
     const char *fail_reason = "Unknown reason";
+    socklen_t host_addr_size;
 
     p = redir_str;
     if (!p || get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
@@ -829,30 +835,83 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
         is_udp = 0;
     } else if (!strcmp(buf, "udp")) {
         is_udp = 1;
-    } else {
+    }
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+    else if (!strcmp(buf, "unix")) {
+        is_unix = 1;
+    }
+#endif
+    else {
         fail_reason = "Bad protocol name";
         goto fail_syntax;
     }
 
-    if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
-        fail_reason = "Missing : separator";
-        goto fail_syntax;
-    }
-    if (buf[0] != '\0' && !inet_aton(buf, &host_addr.sin_addr)) {
-        fail_reason = "Bad host address";
-        goto fail_syntax;
-    }
+#if !defined(WIN32) && SLIRP_CHECK_VERSION(4, 7, 0)
+    if (is_unix) {
+        if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
+            fail_reason = "Missing - separator";
+            goto fail_syntax;
+        }
+        if (buf[0] == '\0') {
+            fail_reason = "Missing unix socket path";
+            goto fail_syntax;
+        }
+        if (buf[0] != '/') {
+            fail_reason = "unix socket path must be absolute";
+            goto fail_syntax;
+        }
 
-    if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
-        fail_reason = "Bad host port separator";
-        goto fail_syntax;
+        size_t path_len = strlen(buf);
+        if (path_len > sizeof(host_addr.un.sun_path) - 1) {
+            fail_reason = "Unix socket path is too long";
+            goto fail_syntax;
+        }
+
+        struct stat st;
+        if (stat(buf, &st) == 0) {
+            if (!S_ISSOCK(st.st_mode)) {
+                fail_reason = "file exists and it's not unix socket";
+                goto fail_syntax;
+            }
+
+            if (unlink(buf) < 0) {
+                error_setg_errno(errp, errno, "Failed to unlink '%s'", buf);
+                goto fail_syntax;
+            }
+        }
+        host_addr.un.sun_family = AF_UNIX;
+        memcpy(host_addr.un.sun_path, buf, path_len);
+        host_addr_size = sizeof(host_addr.un);
+    } else
+#endif
+    {
+        host_addr.in.sin_family = AF_INET;
+        host_addr.in.sin_addr.s_addr = INADDR_ANY;
+
+        if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
+            fail_reason = "Missing : separator";
+            goto fail_syntax;
+        }
+
+        if (buf[0] != '\0' && !inet_aton(buf, &host_addr.in.sin_addr)) {
+            fail_reason = "Bad host address";
+            goto fail_syntax;
+        }
+
+        if (get_str_sep(buf, sizeof(buf), &p, '-') < 0) {
+            fail_reason = "Bad host port separator";
+            goto fail_syntax;
+        }
+
+        err = qemu_strtoi(buf, &end, 0, &host_port);
+        if (err || host_port < 0 || host_port > 65535) {
+            fail_reason = "Bad host port";
+            goto fail_syntax;
+        }
+
+        host_addr.in.sin_port = htons(host_port);
+        host_addr_size = sizeof(host_addr.in);
     }
-    err = qemu_strtoi(buf, &end, 0, &host_port);
-    if (err || host_port < 0 || host_port > 65535) {
-        fail_reason = "Bad host port";
-        goto fail_syntax;
-    }
-    host_addr.sin_port = htons(host_port);
 
     if (get_str_sep(buf, sizeof(buf), &p, ':') < 0) {
         fail_reason = "Missing guest address";
@@ -872,12 +931,13 @@ static int slirp_hostfwd(SlirpState *s, const char *redir_str, Error **errp)
 
 #if SLIRP_CHECK_VERSION(4, 5, 0)
     err = slirp_add_hostxfwd(s->slirp,
-            (struct sockaddr *) &host_addr, sizeof(host_addr),
+            (struct sockaddr *) &host_addr, host_addr_size,
             (struct sockaddr *) &guest_addr, sizeof(guest_addr),
             is_udp ? SLIRP_HOSTFWD_UDP : 0);
 #else
+    (void) host_addr_size;
     err = slirp_add_hostfwd(s->slirp, is_udp,
-            host_addr.sin_addr, host_port,
+            host_addr.in.sin_addr, host_port,
             guest_addr.sin_addr, guest_port);
 #endif
 
diff --git a/qapi/net.json b/qapi/net.json
index 78bcc9871e..60d196afe5 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -281,7 +281,7 @@
 #
 # @smbserver: IP address of the built-in SMB server
 #
-# @hostfwd: redirect incoming TCP or UDP host connections to guest
+# @hostfwd: redirect incoming TCP, UDP or UNIX host connections to guest
 #     endpoints
 #
 # @guestfwd: forward guest TCP connections
diff --git a/qemu-options.hx b/qemu-options.hx
index 075f4be2e3..a9d640d9e6 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -3324,8 +3324,8 @@ SRST
 
         Note that a SAMBA server must be installed on the host OS.
 
-    ``hostfwd=[tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport``
-        Redirect incoming TCP or UDP connections to the host port
+    ``hostfwd=[tcp|udp|unix]:[[hostaddr]:hostport|hostpath]-[guestaddr]:guestport``
+        Redirect incoming TCP, UDP or UNIX connections to the host port
         hostport to the guest IP address guestaddr on guest port
         guestport. If guestaddr is not specified, its value is x.x.x.15
         (default first address given by the built-in DHCP server). By
@@ -3355,6 +3355,13 @@ SRST
         Then when you use on the host ``telnet localhost 5555``, you
         connect to the guest telnet server.
 
+        To redirect host unix socket /tmp/vm to guest tcp socket 23 use
+        following:
+
+        .. parsed-literal::
+            # on the host
+            |qemu_system| -nic user,hostfwd=unix:/tmp/vm-:23
+
     ``guestfwd=[tcp]:server:port-dev``; \ ``guestfwd=[tcp]:server:port-cmd:command``
         Forward guest TCP connections to the IP address server on port
         port to the character device dev or to a program executed by

From bc54fb0168961fc61f8752ecdf979e4ab4e2439d Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:54 +0000
Subject: [PATCH 0988/2396] memory: Adjust event ranges to fit within notifier
 boundaries

Invalidating the entire address space (i.e. range of [0, ~0ULL]) is a
valid and required operation by vIOMMU implementations. However, such
invalidations currently trigger an assertion unless they originate from
device IOTLB invalidations.

Although in recent Linux guests this case is not exercised by the VTD
implementation due to various optimizations, the assertion will be hit
by upcoming AMD vIOMMU changes to support DMA address translation. More
specifically, when running a Linux guest with VFIO passthrough device,
and a kernel that does not contain commmit 3f2571fed2fa ("iommu/amd:
Remove redundant domain flush from attach_device()").

Remove the assertion altogether and adjust the range to ensure it does
not cross notifier boundaries.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20201116165506.31315-6-eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-2-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 system/memory.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/system/memory.c b/system/memory.c
index cf8cad6961..5c6ccc5c57 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2044,13 +2044,9 @@ void memory_region_notify_iommu_one(IOMMUNotifier *notifier,
         return;
     }
 
-    if (notifier->notifier_flags & IOMMU_NOTIFIER_DEVIOTLB_UNMAP) {
-        /* Crop (iova, addr_mask) to range */
-        tmp.iova = MAX(tmp.iova, notifier->start);
-        tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
-    } else {
-        assert(entry->iova >= notifier->start && entry_end <= notifier->end);
-    }
+    /* Crop (iova, addr_mask) to range */
+    tmp.iova = MAX(tmp.iova, notifier->start);
+    tmp.addr_mask = MIN(entry_end, notifier->end) - tmp.iova;
 
     if (event->type & notifier->notifier_flags) {
         notifier->notify(notifier, &tmp);

From 918973f1d476a62922761c9a5484b309491b652c Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:55 +0000
Subject: [PATCH 0989/2396] amd_iommu: Document '-device amd-iommu' common
 options

Document the common parameters used when emulating AMD vIOMMU.
Besides the two amd-iommu specific options: 'xtsup' and 'dma-remap', the
the generic x86 IOMMU option 'intremap' is also included, since it is
typically specified in QEMU command line examples and mailing list threads.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-3-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 qemu-options.hx | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index 3ff10ec09d..9b4e870350 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -1238,6 +1238,29 @@ SRST
         Accepts either the default root complex (pcie.0) or a
         pxb-pcie based root complex.
 
+``-device amd-iommu[,option=...]``
+    Enables emulation of an AMD-Vi I/O Memory Management Unit (IOMMU).
+    Only available with ``-machine q35``, it supports the following options:
+
+    ``dma-remap=on|off`` (default: off)
+        Support for DMA address translation and access permission checking for
+        guests attaching passthrough devices to paging domains, using the AMD v1
+        I/O Page Table format. This enables ``-device vfio-pci,...`` to work
+        correctly with a guest using the DMA remapping feature of the vIOMMU.
+
+    ``intremap=on|off`` (default: auto)
+        Generic x86 IOMMU functionality implemented by ``amd-iommu`` device.
+        Enables interrupt remapping feature in guests, which is also required to
+        enable x2apic support.
+        Currently only available with ``kernel-irqchip=off|split``, it is
+        automatically enabled when either of those modes is in use, and disabled
+        with ``kernel-irqchip=on``.
+
+    ``xtsup=on|off`` (default: off)
+        Interrupt remapping table supports x2apic mode, enabling the use of
+        128-bit IRTE format with 32-bit destination field by the guest. Required
+        to support routing interrupts to vCPUs with APIC IDs larger than 0xff.
+
 ERST
 
 DEF("name", HAS_ARG, QEMU_OPTION_name,

From f76fc5d4ca54ea27597b3f0503ddb6e9030bb52d Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:56 +0000
Subject: [PATCH 0990/2396] amd_iommu: Reorder device and page table helpers

Move code related to Device Table and Page Table to an earlier location in
the file, where it does not require forward declarations to be used by the
various invalidation functions that will need to query the DTE and walk the
page table in upcoming changes.

This change consist of code movement only, no functional change intended.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-4-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 172 ++++++++++++++++++++++----------------------
 1 file changed, 86 insertions(+), 86 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 26be69bec8..3cbc9499db 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -438,6 +438,92 @@ static void amdvi_completion_wait(AMDVIState *s, uint64_t *cmd)
     trace_amdvi_completion_wait(addr, data);
 }
 
+static inline uint64_t amdvi_get_perms(uint64_t entry)
+{
+    return (entry & (AMDVI_DEV_PERM_READ | AMDVI_DEV_PERM_WRITE)) >>
+           AMDVI_DEV_PERM_SHIFT;
+}
+
+/* validate that reserved bits are honoured */
+static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
+                               uint64_t *dte)
+{
+    if ((dte[0] & AMDVI_DTE_QUAD0_RESERVED) ||
+        (dte[1] & AMDVI_DTE_QUAD1_RESERVED) ||
+        (dte[2] & AMDVI_DTE_QUAD2_RESERVED) ||
+        (dte[3] & AMDVI_DTE_QUAD3_RESERVED)) {
+        amdvi_log_illegaldevtab_error(s, devid,
+                                      s->devtab +
+                                      devid * AMDVI_DEVTAB_ENTRY_SIZE, 0);
+        return false;
+    }
+
+    return true;
+}
+
+/* get a device table entry given the devid */
+static bool amdvi_get_dte(AMDVIState *s, int devid, uint64_t *entry)
+{
+    uint32_t offset = devid * AMDVI_DEVTAB_ENTRY_SIZE;
+
+    if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
+                        AMDVI_DEVTAB_ENTRY_SIZE, MEMTXATTRS_UNSPECIFIED)) {
+        trace_amdvi_dte_get_fail(s->devtab, offset);
+        /* log error accessing dte */
+        amdvi_log_devtab_error(s, devid, s->devtab + offset, 0);
+        return false;
+    }
+
+    *entry = le64_to_cpu(*entry);
+    if (!amdvi_validate_dte(s, devid, entry)) {
+        trace_amdvi_invalid_dte(entry[0]);
+        return false;
+    }
+
+    return true;
+}
+
+/* get pte translation mode */
+static inline uint8_t get_pte_translation_mode(uint64_t pte)
+{
+    return (pte >> AMDVI_DEV_MODE_RSHIFT) & AMDVI_DEV_MODE_MASK;
+}
+
+static inline uint64_t pte_override_page_mask(uint64_t pte)
+{
+    uint8_t page_mask = 13;
+    uint64_t addr = (pte & AMDVI_DEV_PT_ROOT_MASK) >> 12;
+    /* find the first zero bit */
+    while (addr & 1) {
+        page_mask++;
+        addr = addr >> 1;
+    }
+
+    return ~((1ULL << page_mask) - 1);
+}
+
+static inline uint64_t pte_get_page_mask(uint64_t oldlevel)
+{
+    return ~((1UL << ((oldlevel * 9) + 3)) - 1);
+}
+
+static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
+                                          uint16_t devid)
+{
+    uint64_t pte;
+
+    if (dma_memory_read(&address_space_memory, pte_addr,
+                        &pte, sizeof(pte), MEMTXATTRS_UNSPECIFIED)) {
+        trace_amdvi_get_pte_hwerror(pte_addr);
+        amdvi_log_pagetab_error(s, devid, pte_addr, 0);
+        pte = 0;
+        return pte;
+    }
+
+    pte = le64_to_cpu(pte);
+    return pte;
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -894,92 +980,6 @@ static void amdvi_mmio_write(void *opaque, hwaddr addr, uint64_t val,
     }
 }
 
-static inline uint64_t amdvi_get_perms(uint64_t entry)
-{
-    return (entry & (AMDVI_DEV_PERM_READ | AMDVI_DEV_PERM_WRITE)) >>
-           AMDVI_DEV_PERM_SHIFT;
-}
-
-/* validate that reserved bits are honoured */
-static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
-                               uint64_t *dte)
-{
-    if ((dte[0] & AMDVI_DTE_QUAD0_RESERVED) ||
-        (dte[1] & AMDVI_DTE_QUAD1_RESERVED) ||
-        (dte[2] & AMDVI_DTE_QUAD2_RESERVED) ||
-        (dte[3] & AMDVI_DTE_QUAD3_RESERVED)) {
-        amdvi_log_illegaldevtab_error(s, devid,
-                                      s->devtab +
-                                      devid * AMDVI_DEVTAB_ENTRY_SIZE, 0);
-        return false;
-    }
-
-    return true;
-}
-
-/* get a device table entry given the devid */
-static bool amdvi_get_dte(AMDVIState *s, int devid, uint64_t *entry)
-{
-    uint32_t offset = devid * AMDVI_DEVTAB_ENTRY_SIZE;
-
-    if (dma_memory_read(&address_space_memory, s->devtab + offset, entry,
-                        AMDVI_DEVTAB_ENTRY_SIZE, MEMTXATTRS_UNSPECIFIED)) {
-        trace_amdvi_dte_get_fail(s->devtab, offset);
-        /* log error accessing dte */
-        amdvi_log_devtab_error(s, devid, s->devtab + offset, 0);
-        return false;
-    }
-
-    *entry = le64_to_cpu(*entry);
-    if (!amdvi_validate_dte(s, devid, entry)) {
-        trace_amdvi_invalid_dte(entry[0]);
-        return false;
-    }
-
-    return true;
-}
-
-/* get pte translation mode */
-static inline uint8_t get_pte_translation_mode(uint64_t pte)
-{
-    return (pte >> AMDVI_DEV_MODE_RSHIFT) & AMDVI_DEV_MODE_MASK;
-}
-
-static inline uint64_t pte_override_page_mask(uint64_t pte)
-{
-    uint8_t page_mask = 13;
-    uint64_t addr = (pte & AMDVI_DEV_PT_ROOT_MASK) >> 12;
-    /* find the first zero bit */
-    while (addr & 1) {
-        page_mask++;
-        addr = addr >> 1;
-    }
-
-    return ~((1ULL << page_mask) - 1);
-}
-
-static inline uint64_t pte_get_page_mask(uint64_t oldlevel)
-{
-    return ~((1UL << ((oldlevel * 9) + 3)) - 1);
-}
-
-static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
-                                          uint16_t devid)
-{
-    uint64_t pte;
-
-    if (dma_memory_read(&address_space_memory, pte_addr,
-                        &pte, sizeof(pte), MEMTXATTRS_UNSPECIFIED)) {
-        trace_amdvi_get_pte_hwerror(pte_addr);
-        amdvi_log_pagetab_error(s, devid, pte_addr, 0);
-        pte = 0;
-        return pte;
-    }
-
-    pte = le64_to_cpu(pte);
-    return pte;
-}
-
 static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
                             IOMMUTLBEntry *ret, unsigned perms,
                             hwaddr addr)

From e8992fee661ace87c4e871f29f5b2caab1153327 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:57 +0000
Subject: [PATCH 0991/2396] amd_iommu: Helper to decode size of page
 invalidation command

The size of the region to invalidate depends on the S bit and address
encoded in the command. Add a helper to extract this information, which
will be used to sync shadow page tables in upcoming changes.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-5-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 34 ++++++++++++++++++++++++++++++++++
 hw/i386/amd_iommu.h |  4 ++++
 2 files changed, 38 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 3cbc9499db..202f0f8c6e 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -577,6 +577,40 @@ static gboolean amdvi_iotlb_remove_by_domid(gpointer key, gpointer value,
     return entry->domid == domid;
 }
 
+/*
+ * Helper to decode the size of the range to invalidate encoded in the
+ * INVALIDATE_IOMMU_PAGES Command format.
+ * The size of the region to invalidate depends on the S bit and address.
+ * S bit value:
+ * 0 :  Invalidation size is 4 Kbytes.
+ * 1 :  Invalidation size is determined by first zero bit in the address
+ *      starting from Address[12].
+ *
+ * In the AMD IOMMU Linux driver, an invalidation command with address
+ * ((1 << 63) - 1) is sent when intending to clear the entire cache.
+ * However, Table 14: Example Page Size Encodings shows that an address of
+ * ((1ULL << 51) - 1) encodes the entire cache, so effectively any address with
+ * first zero at bit 51 or larger is a request to invalidate the entire address
+ * space.
+ */
+static uint64_t __attribute__((unused))
+amdvi_decode_invalidation_size(hwaddr addr, uint16_t flags)
+{
+    uint64_t size = AMDVI_PAGE_SIZE;
+    uint8_t fzbit = 0;
+
+    if (flags & AMDVI_CMD_INVAL_IOMMU_PAGES_S) {
+        fzbit = cto64(addr | 0xFFF);
+
+        if (fzbit >= 51) {
+            size = AMDVI_INV_ALL_PAGES;
+        } else {
+            size = 1ULL << (fzbit + 1);
+        }
+    }
+    return size;
+}
+
 /* we don't have devid - we can't remove pages by address */
 static void amdvi_inval_pages(AMDVIState *s, uint64_t *cmd)
 {
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 2476296c49..c1170a8202 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -126,6 +126,10 @@
 #define AMDVI_CMD_COMPLETE_PPR_REQUEST    0x07
 #define AMDVI_CMD_INVAL_AMDVI_ALL         0x08
 
+
+#define AMDVI_CMD_INVAL_IOMMU_PAGES_S   (1ULL << 0)
+#define AMDVI_INV_ALL_PAGES             (1ULL << 52)
+
 #define AMDVI_DEVTAB_ENTRY_SIZE           32
 
 /* Device table entry bits 0:63 */

From 786d11853095af9c935aab19d5fd341cfb118feb Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:58 +0000
Subject: [PATCH 0992/2396] amd_iommu: Add helper function to extract the DTE

Extracting the DTE from a given AMDVIAddressSpace pointer structure is a
common operation required for syncing the shadow page tables. Implement a
helper to do it and check for common error conditions.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-6-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 48 +++++++++++++++++++++++++++++++++++++++------
 1 file changed, 42 insertions(+), 6 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 202f0f8c6e..dc7531fd4a 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -77,6 +77,18 @@ typedef struct AMDVIIOTLBEntry {
     uint64_t page_mask;         /* physical page size  */
 } AMDVIIOTLBEntry;
 
+/*
+ * These 'fault' reasons have an overloaded meaning since they are not only
+ * intended for describing reasons that generate an IO_PAGE_FAULT as per the AMD
+ * IOMMU specification, but are also used to signal internal errors in the
+ * emulation code.
+ */
+typedef enum AMDVIFaultReason {
+    AMDVI_FR_DTE_RTR_ERR = 1,   /* Failure to retrieve DTE */
+    AMDVI_FR_DTE_V,             /* DTE[V] = 0 */
+    AMDVI_FR_DTE_TV,            /* DTE[TV] = 0 */
+} AMDVIFaultReason;
+
 uint64_t amdvi_extended_feature_register(AMDVIState *s)
 {
     uint64_t feature = AMDVI_DEFAULT_EXT_FEATURES;
@@ -524,6 +536,28 @@ static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
     return pte;
 }
 
+static int amdvi_as_to_dte(AMDVIAddressSpace *as, uint64_t *dte)
+{
+    uint16_t devid = PCI_BUILD_BDF(as->bus_num, as->devfn);
+    AMDVIState *s = as->iommu_state;
+
+    if (!amdvi_get_dte(s, devid, dte)) {
+        /* Unable to retrieve DTE for devid */
+        return -AMDVI_FR_DTE_RTR_ERR;
+    }
+
+    if (!(dte[0] & AMDVI_DEV_VALID)) {
+        /* DTE[V] not set, address is passed untranslated for devid */
+        return -AMDVI_FR_DTE_V;
+    }
+
+    if (!(dte[0] & AMDVI_DEV_TRANSLATION_VALID)) {
+        /* DTE[TV] not set, host page table not valid for devid */
+        return -AMDVI_FR_DTE_TV;
+    }
+    return 0;
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -1081,6 +1115,7 @@ static void amdvi_do_translate(AMDVIAddressSpace *as, hwaddr addr,
     uint16_t devid = PCI_BUILD_BDF(as->bus_num, as->devfn);
     AMDVIIOTLBEntry *iotlb_entry = amdvi_iotlb_lookup(s, addr, devid);
     uint64_t entry[4];
+    int dte_ret;
 
     if (iotlb_entry) {
         trace_amdvi_iotlb_hit(PCI_BUS_NUM(devid), PCI_SLOT(devid),
@@ -1092,13 +1127,14 @@ static void amdvi_do_translate(AMDVIAddressSpace *as, hwaddr addr,
         return;
     }
 
-    if (!amdvi_get_dte(s, devid, entry)) {
-        return;
-    }
+    dte_ret = amdvi_as_to_dte(as, entry);
 
-    /* devices with V = 0 are not translated */
-    if (!(entry[0] & AMDVI_DEV_VALID)) {
-        goto out;
+    if (dte_ret < 0) {
+        if (dte_ret == -AMDVI_FR_DTE_V) {
+            /* DTE[V]=0, address is passed untranslated */
+            goto out;
+        }
+        return;
     }
 
     amdvi_page_walk(as, entry, ret,

From 0f13cc5642ea81fc952ef20515891d12c5193d24 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:34:59 +0000
Subject: [PATCH 0993/2396] amd_iommu: Return an error when unable to read PTE
 from guest memory

Make amdvi_get_pte_entry() return an error value (-1) in cases where the
memory read fails, versus the current return of 0 to indicate failure.
The reason is that 0 is also a valid value to have stored in the PTE in
guest memory i.e. the guest does not have a mapping. Before this change,
amdvi_get_pte_entry() returned 0 for both an error and for empty PTEs, but
the page walker implementation that will be introduced in upcoming changes
needs a method to differentiate between the two scenarios.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-7-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index dc7531fd4a..29ed3f0ef2 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -528,7 +528,7 @@ static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
                         &pte, sizeof(pte), MEMTXATTRS_UNSPECIFIED)) {
         trace_amdvi_get_pte_hwerror(pte_addr);
         amdvi_log_pagetab_error(s, devid, pte_addr, 0);
-        pte = 0;
+        pte = (uint64_t)-1;
         return pte;
     }
 
@@ -1081,7 +1081,7 @@ static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
             /* add offset and load pte */
             pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
             pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
-            if (!pte) {
+            if (!pte || (pte == (uint64_t)-1)) {
                 return;
             }
             oldlevel = level;

From a74bb3110a5b7b5da51ada160732cfc2c83d80d7 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:00 +0000
Subject: [PATCH 0994/2396] amd_iommu: Add helpers to walk AMD v1 Page Table
 format

The current amdvi_page_walk() is designed to be called by the replay()
method. Rather than drastically altering it, introduce helpers to fetch
guest PTEs that will be used by a page walker implementation.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-8-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 123 ++++++++++++++++++++++++++++++++++++++++++++
 hw/i386/amd_iommu.h |  40 ++++++++++++++
 2 files changed, 163 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 29ed3f0ef2..c25981ff93 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -87,6 +87,8 @@ typedef enum AMDVIFaultReason {
     AMDVI_FR_DTE_RTR_ERR = 1,   /* Failure to retrieve DTE */
     AMDVI_FR_DTE_V,             /* DTE[V] = 0 */
     AMDVI_FR_DTE_TV,            /* DTE[TV] = 0 */
+    AMDVI_FR_PT_ROOT_INV,       /* Page Table Root ptr invalid */
+    AMDVI_FR_PT_ENTRY_INV,      /* Failure to read PTE from guest memory */
 } AMDVIFaultReason;
 
 uint64_t amdvi_extended_feature_register(AMDVIState *s)
@@ -558,6 +560,127 @@ static int amdvi_as_to_dte(AMDVIAddressSpace *as, uint64_t *dte)
     return 0;
 }
 
+/*
+ * For a PTE encoding a large page, return the page size it encodes as described
+ * by the AMD IOMMU Specification Table 14: Example Page Size Encodings.
+ * No need to adjust the value of the PTE to point to the first PTE in the large
+ * page since the encoding guarantees all "base" PTEs in the large page are the
+ * same.
+ */
+static uint64_t large_pte_page_size(uint64_t pte)
+{
+    assert(PTE_NEXT_LEVEL(pte) == 7);
+
+    /* Determine size of the large/contiguous page encoded in the PTE */
+    return PTE_LARGE_PAGE_SIZE(pte);
+}
+
+/*
+ * Helper function to fetch a PTE using AMD v1 pgtable format.
+ * On successful page walk, returns 0 and pte parameter points to a valid PTE.
+ * On failure, returns:
+ * -AMDVI_FR_PT_ROOT_INV: A page walk is not possible due to conditions like DTE
+ *      with invalid permissions, Page Table Root can not be read from DTE, or a
+ *      larger IOVA than supported by page table level encoded in DTE[Mode].
+ * -AMDVI_FR_PT_ENTRY_INV: A PTE could not be read from guest memory during a
+ *      page table walk. This means that the DTE has valid data, but one of the
+ *      lower level entries in the Page Table could not be read.
+ */
+static int __attribute__((unused))
+fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte, uint64_t *pte,
+          hwaddr *page_size)
+{
+    IOMMUAccessFlags perms = amdvi_get_perms(dte);
+
+    uint8_t level, mode;
+    uint64_t pte_addr;
+
+    *pte = dte;
+    *page_size = 0;
+
+    if (perms == IOMMU_NONE) {
+        return -AMDVI_FR_PT_ROOT_INV;
+    }
+
+    /*
+     * The Linux kernel driver initializes the default mode to 3, corresponding
+     * to a 39-bit GPA space, where each entry in the pagetable translates to a
+     * 1GB (2^30) page size.
+     */
+    level = mode = get_pte_translation_mode(dte);
+    assert(mode > 0 && mode < 7);
+
+    /*
+     * If IOVA is larger than the max supported by the current pgtable level,
+     * there is nothing to do.
+     */
+    if (address > PT_LEVEL_MAX_ADDR(mode - 1)) {
+        /* IOVA too large for the current DTE */
+        return -AMDVI_FR_PT_ROOT_INV;
+    }
+
+    do {
+        level -= 1;
+
+        /* Update the page_size */
+        *page_size = PTE_LEVEL_PAGE_SIZE(level);
+
+        /* Permission bits are ANDed at every level, including the DTE */
+        perms &= amdvi_get_perms(*pte);
+        if (perms == IOMMU_NONE) {
+            return 0;
+        }
+
+        /* Not Present */
+        if (!IOMMU_PTE_PRESENT(*pte)) {
+            return 0;
+        }
+
+        /* Large or Leaf PTE found */
+        if (PTE_NEXT_LEVEL(*pte) == 7 || PTE_NEXT_LEVEL(*pte) == 0) {
+            /* Leaf PTE found */
+            break;
+        }
+
+        /*
+         * Index the pgtable using the IOVA bits corresponding to current level
+         * and walk down to the lower level.
+         */
+        pte_addr = NEXT_PTE_ADDR(*pte, level, address);
+        *pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
+
+        if (*pte == (uint64_t)-1) {
+            /*
+             * A returned PTE of -1 indicates a failure to read the page table
+             * entry from guest memory.
+             */
+            if (level == mode - 1) {
+                /* Failure to retrieve the Page Table from Root Pointer */
+                *page_size = 0;
+                return -AMDVI_FR_PT_ROOT_INV;
+            } else {
+                /* Failure to read PTE. Page walk skips a page_size chunk */
+                return -AMDVI_FR_PT_ENTRY_INV;
+            }
+        }
+    } while (level > 0);
+
+    assert(PTE_NEXT_LEVEL(*pte) == 0 || PTE_NEXT_LEVEL(*pte) == 7 ||
+           level == 0);
+    /*
+     * Page walk ends when Next Level field on PTE shows that either a leaf PTE
+     * or a series of large PTEs have been reached. In the latter case, even if
+     * the range starts in the middle of a contiguous page, the returned PTE
+     * must be the first PTE of the series.
+     */
+    if (PTE_NEXT_LEVEL(*pte) == 7) {
+        /* Update page_size with the large PTE page size */
+        *page_size = large_pte_page_size(*pte);
+    }
+
+    return 0;
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index c1170a8202..9f833b297d 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -178,6 +178,46 @@
 #define AMDVI_GATS_MODE                 (2ULL <<  12)
 #define AMDVI_HATS_MODE                 (2ULL <<  10)
 
+/* Page Table format */
+
+#define AMDVI_PTE_PR                    (1ULL << 0)
+#define AMDVI_PTE_NEXT_LEVEL_MASK       GENMASK64(11, 9)
+
+#define IOMMU_PTE_PRESENT(pte)          ((pte) & AMDVI_PTE_PR)
+
+/* Using level=0 for leaf PTE at 4K page size */
+#define PT_LEVEL_SHIFT(level)           (12 + ((level) * 9))
+
+/* Return IOVA bit group used to index the Page Table at specific level */
+#define PT_LEVEL_INDEX(level, iova)     (((iova) >> PT_LEVEL_SHIFT(level)) & \
+                                        GENMASK64(8, 0))
+
+/* Return the max address for a specified level i.e. max_oaddr */
+#define PT_LEVEL_MAX_ADDR(x)    (((x) < 5) ? \
+                                ((1ULL << PT_LEVEL_SHIFT((x + 1))) - 1) : \
+                                (~(0ULL)))
+
+/* Extract the NextLevel field from PTE/PDE */
+#define PTE_NEXT_LEVEL(pte)     (((pte) & AMDVI_PTE_NEXT_LEVEL_MASK) >> 9)
+
+/* Take page table level and return default pagetable size for level */
+#define PTE_LEVEL_PAGE_SIZE(level)      (1ULL << (PT_LEVEL_SHIFT(level)))
+
+/*
+ * Return address of lower level page table encoded in PTE and specified by
+ * current level and corresponding IOVA bit group at such level.
+ */
+#define NEXT_PTE_ADDR(pte, level, iova) (((pte) & AMDVI_DEV_PT_ROOT_MASK) + \
+                                        (PT_LEVEL_INDEX(level, iova) * 8))
+
+/*
+ * Take a PTE value with mode=0x07 and return the page size it encodes.
+ */
+#define PTE_LARGE_PAGE_SIZE(pte)    (1ULL << (1 + cto64(((pte) | 0xfffULL))))
+
+/* Return number of PTEs to use for a given page size (expected power of 2) */
+#define PAGE_SIZE_PTE_COUNT(pgsz)       (1ULL << ((ctz64(pgsz) - 12) % 9))
+
 /* IOTLB */
 #define AMDVI_IOTLB_MAX_SIZE 1024
 #define AMDVI_DEVID_SHIFT    36

From 7a2ce64950fbe43038eeba1889a142c5784f5021 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:01 +0000
Subject: [PATCH 0995/2396] amd_iommu: Add a page walker to sync shadow page
 tables on invalidation

For the specified address range, walk the page table identifying regions
as mapped or unmapped and invoke registered notifiers with the
corresponding event type.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-9-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 80 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 80 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index c25981ff93..0e45435c77 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -681,6 +681,86 @@ fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte, uint64_t *pte,
     return 0;
 }
 
+/*
+ * Walk the guest page table for an IOVA and range and signal the registered
+ * notifiers to sync the shadow page tables in the host.
+ * Must be called with a valid DTE for DMA remapping i.e. V=1,TV=1
+ */
+static void __attribute__((unused))
+amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as, uint64_t *dte,
+                                   hwaddr addr, uint64_t size, bool send_unmap)
+{
+    IOMMUTLBEvent event;
+
+    hwaddr iova_next, page_mask, pagesize;
+    hwaddr iova = addr;
+    hwaddr end = iova + size - 1;
+
+    uint64_t pte;
+    int ret;
+
+    while (iova < end) {
+
+        ret = fetch_pte(as, iova, dte[0], &pte, &pagesize);
+
+        if (ret == -AMDVI_FR_PT_ROOT_INV) {
+            /*
+             * Invalid conditions such as the IOVA being larger than supported
+             * by current page table mode as configured in the DTE, or a failure
+             * to fetch the Page Table from the Page Table Root Pointer in DTE.
+             */
+            assert(pagesize == 0);
+            return;
+        }
+        /* PTE has been validated for major errors and pagesize is set */
+        assert(pagesize);
+        page_mask = ~(pagesize - 1);
+        iova_next = (iova & page_mask) + pagesize;
+
+        if (ret == -AMDVI_FR_PT_ENTRY_INV) {
+            /*
+             * Failure to read PTE from memory, the pagesize matches the current
+             * level. Unable to determine the region type, so a safe strategy is
+             * to skip the range and continue the page walk.
+             */
+            goto next;
+        }
+
+        event.entry.target_as = &address_space_memory;
+        event.entry.iova = iova & page_mask;
+        /* translated_addr is irrelevant for the unmap case */
+        event.entry.translated_addr = (pte & AMDVI_DEV_PT_ROOT_MASK) &
+                                      page_mask;
+        event.entry.addr_mask = ~page_mask;
+        event.entry.perm = amdvi_get_perms(pte);
+
+        /*
+         * In cases where the leaf PTE is not found, or it has invalid
+         * permissions, an UNMAP type notification is sent, but only if the
+         * caller requested it.
+         */
+        if (!IOMMU_PTE_PRESENT(pte) || (event.entry.perm == IOMMU_NONE)) {
+            if (!send_unmap) {
+                goto next;
+            }
+            event.type = IOMMU_NOTIFIER_UNMAP;
+        } else {
+            event.type = IOMMU_NOTIFIER_MAP;
+        }
+
+        /* Invoke the notifiers registered for this address space */
+        memory_region_notify_iommu(&as->iommu, 0, event);
+
+next:
+        /* Check for 64-bit overflow and terminate walk in such cases */
+        if (iova_next < iova) {
+            break;
+        } else {
+            iova = iova_next;
+        }
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {

From 557f4cda12da8cd4c77af3a2b41c8331116996af Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:02 +0000
Subject: [PATCH 0996/2396] amd_iommu: Add basic structure to support IOMMU
 notifier updates

Add the minimal data structures required to maintain a list of address
spaces (i.e. devices) with registered notifiers, and to update the type of
events that require notifications.
Note that the ability to register for MAP notifications is not available.
It will be unblocked by following changes that enable the synchronization of
guest I/O page tables with host IOMMU state, at which point an amd-iommu
device property will be introduced to control this capability.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-10-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 20 ++++++++++++++++++++
 hw/i386/amd_iommu.h |  3 +++
 2 files changed, 23 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 0e45435c77..d8a451b3a5 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -66,6 +66,11 @@ struct AMDVIAddressSpace {
     MemoryRegion iommu_nodma;   /* Alias of shared nodma memory region  */
     MemoryRegion iommu_ir;      /* Device's interrupt remapping region  */
     AddressSpace as;            /* device's corresponding address space */
+
+    /* DMA address translation support */
+    IOMMUNotifierFlag notifier_flags;
+    /* entry in list of Address spaces with registered notifiers */
+    QLIST_ENTRY(AMDVIAddressSpace) next;
 };
 
 /* AMDVI cache entry */
@@ -1773,6 +1778,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
         iommu_as[devfn]->bus_num = (uint8_t)bus_num;
         iommu_as[devfn]->devfn = (uint8_t)devfn;
         iommu_as[devfn]->iommu_state = s;
+        iommu_as[devfn]->notifier_flags = IOMMU_NOTIFIER_NONE;
 
         amdvi_dev_as = iommu_as[devfn];
 
@@ -1846,6 +1852,7 @@ static int amdvi_iommu_notify_flag_changed(IOMMUMemoryRegion *iommu,
                                            Error **errp)
 {
     AMDVIAddressSpace *as = container_of(iommu, AMDVIAddressSpace, iommu);
+    AMDVIState *s = as->iommu_state;
 
     if (new & IOMMU_NOTIFIER_MAP) {
         error_setg(errp,
@@ -1854,6 +1861,19 @@ static int amdvi_iommu_notify_flag_changed(IOMMUMemoryRegion *iommu,
                    PCI_FUNC(as->devfn));
         return -EINVAL;
     }
+
+    /*
+     * Update notifier flags for address space and the list of address spaces
+     * with registered notifiers.
+     */
+    as->notifier_flags = new;
+
+    if (old == IOMMU_NOTIFIER_NONE) {
+        QLIST_INSERT_HEAD(&s->amdvi_as_with_notifiers, as, next);
+    } else if (new == IOMMU_NOTIFIER_NONE) {
+        QLIST_REMOVE(as, next);
+    }
+
     return 0;
 }
 
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 9f833b297d..b51aa74368 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -409,6 +409,9 @@ struct AMDVIState {
     /* for each served device */
     AMDVIAddressSpace **address_spaces[PCI_BUS_MAX];
 
+    /* list of address spaces with registered notifiers */
+    QLIST_HEAD(, AMDVIAddressSpace) amdvi_as_with_notifiers;
+
     /* IOTLB */
     GHashTable *iotlb;
 

From a1c97c395729164747f2f30e9b8ec5d497af95c9 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:03 +0000
Subject: [PATCH 0997/2396] amd_iommu: Sync shadow page tables on page
 invalidation

When the guest issues an INVALIDATE_IOMMU_PAGES command, decode the address
and size of the invalidation and sync the guest page table state with the
host. This requires walking the guest page table and calling notifiers
registered for address spaces matching the domain ID encoded in the command.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-11-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 82 ++++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 74 insertions(+), 8 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index d8a451b3a5..caae65c4b3 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -591,9 +591,8 @@ static uint64_t large_pte_page_size(uint64_t pte)
  *      page table walk. This means that the DTE has valid data, but one of the
  *      lower level entries in the Page Table could not be read.
  */
-static int __attribute__((unused))
-fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte, uint64_t *pte,
-          hwaddr *page_size)
+static uint64_t fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte,
+                          uint64_t *pte, hwaddr *page_size)
 {
     IOMMUAccessFlags perms = amdvi_get_perms(dte);
 
@@ -691,9 +690,9 @@ fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte, uint64_t *pte,
  * notifiers to sync the shadow page tables in the host.
  * Must be called with a valid DTE for DMA remapping i.e. V=1,TV=1
  */
-static void __attribute__((unused))
-amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as, uint64_t *dte,
-                                   hwaddr addr, uint64_t size, bool send_unmap)
+static void amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as,
+                                               uint64_t *dte, hwaddr addr,
+                                               uint64_t size, bool send_unmap)
 {
     IOMMUTLBEvent event;
 
@@ -835,8 +834,7 @@ static gboolean amdvi_iotlb_remove_by_domid(gpointer key, gpointer value,
  * first zero at bit 51 or larger is a request to invalidate the entire address
  * space.
  */
-static uint64_t __attribute__((unused))
-amdvi_decode_invalidation_size(hwaddr addr, uint16_t flags)
+static uint64_t amdvi_decode_invalidation_size(hwaddr addr, uint16_t flags)
 {
     uint64_t size = AMDVI_PAGE_SIZE;
     uint8_t fzbit = 0;
@@ -853,10 +851,76 @@ amdvi_decode_invalidation_size(hwaddr addr, uint16_t flags)
     return size;
 }
 
+/*
+ * Synchronize the guest page tables with the shadow page tables kept in the
+ * host for the specified range.
+ * The invalidation command issued by the guest and intercepted by the VMM
+ * does not specify a device, but a domain, since all devices in the same domain
+ * share the same page tables. However, vIOMMU emulation creates separate
+ * address spaces per device, so it is necessary to traverse the list of all of
+ * address spaces (i.e. devices) that have notifiers registered in order to
+ * propagate the changes to the host page tables.
+ * We cannot return early from this function once a matching domain has been
+ * identified and its page tables synced (based on the fact that all devices in
+ * the same domain share the page tables). The reason is that different devices
+ * (i.e. address spaces) could have different notifiers registered, and by
+ * skipping address spaces that appear later on the amdvi_as_with_notifiers list
+ * their notifiers (which could differ from the ones registered for the first
+ * device/address space) would not be invoked.
+ */
+static void amdvi_sync_domain(AMDVIState *s, uint16_t domid, uint64_t addr,
+                              uint16_t flags)
+{
+    AMDVIAddressSpace *as;
+
+    uint64_t size = amdvi_decode_invalidation_size(addr, flags);
+
+    if (size == AMDVI_INV_ALL_PAGES) {
+        addr = 0;       /* Set start address to 0 and invalidate entire AS */
+    } else {
+        addr &= ~(size - 1);
+    }
+
+    /*
+     * Call notifiers that have registered for each address space matching the
+     * domain ID, in order to sync the guest pagetable state with the host.
+     */
+    QLIST_FOREACH(as, &s->amdvi_as_with_notifiers, next) {
+
+        uint64_t dte[4] = { 0 };
+
+        /*
+         * Retrieve the Device Table entry for the devid corresponding to the
+         * current address space, and verify the DomainID matches i.e. the page
+         * tables to be synced belong to devices in the domain.
+         */
+        if (amdvi_as_to_dte(as, dte)) {
+            continue;
+        }
+
+        /* Only need to sync the Page Tables for a matching domain */
+        if (domid != (dte[1] & AMDVI_DEV_DOMID_ID_MASK)) {
+            continue;
+        }
+
+        /*
+         * We have determined that there is a valid Device Table Entry for a
+         * device matching the DomainID in the INV_IOMMU_PAGES command issued by
+         * the guest. Walk the guest page table to sync shadow page table.
+         */
+        if (as->notifier_flags & IOMMU_NOTIFIER_MAP) {
+            /* Sync guest IOMMU mappings with host */
+            amdvi_sync_shadow_page_table_range(as, &dte[0], addr, size, true);
+        }
+    }
+}
+
 /* we don't have devid - we can't remove pages by address */
 static void amdvi_inval_pages(AMDVIState *s, uint64_t *cmd)
 {
     uint16_t domid = cpu_to_le16((uint16_t)extract64(cmd[0], 32, 16));
+    uint64_t addr = cpu_to_le64(extract64(cmd[1], 12, 52)) << 12;
+    uint16_t flags = cpu_to_le16((uint16_t)extract64(cmd[1], 0, 3));
 
     if (extract64(cmd[0], 20, 12) || extract64(cmd[0], 48, 12) ||
         extract64(cmd[1], 3, 9)) {
@@ -866,6 +930,8 @@ static void amdvi_inval_pages(AMDVIState *s, uint64_t *cmd)
 
     g_hash_table_foreach_remove(s->iotlb, amdvi_iotlb_remove_by_domid,
                                 &domid);
+
+    amdvi_sync_domain(s, domid, addr, flags);
     trace_amdvi_pages_inval(domid);
 }
 

From fe0a58f770330165c885d323632541c4d9f2983d Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:04 +0000
Subject: [PATCH 0998/2396] amd_iommu: Use iova_tree records to determine large
 page size on UNMAP

Keep a record of mapped IOVA ranges per address space, using the iova_tree
implementation. Besides enabling optimizations like avoiding unnecessary
notifications, a record of existing <IOVA, size> mappings makes it possible
to determine if a specific IOVA is mapped by the guest using a large page,
and adjust the size when notifying UNMAP events.

When unmapping a large page, the information in the guest PTE encoding the
page size is lost, since the guest clears the PTE before issuing the
invalidation command to the IOMMU. In such case, the size of the original
mapping can be retrieved from the iova_tree and used to issue the UNMAP
notification. Using the correct size is essential since the VFIO IOMMU
Type1v2 driver in the host kernel will reject unmap requests that do not
fully cover previous mappings.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-12-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 95 ++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 89 insertions(+), 6 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index caae65c4b3..4376e977f8 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -33,6 +33,7 @@
 #include "hw/i386/apic-msidef.h"
 #include "hw/qdev-properties.h"
 #include "kvm/kvm_i386.h"
+#include "qemu/iova-tree.h"
 
 /* used AMD-Vi MMIO registers */
 const char *amdvi_mmio_low[] = {
@@ -71,6 +72,8 @@ struct AMDVIAddressSpace {
     IOMMUNotifierFlag notifier_flags;
     /* entry in list of Address spaces with registered notifiers */
     QLIST_ENTRY(AMDVIAddressSpace) next;
+    /* Record DMA translation ranges */
+    IOVATree *iova_tree;
 };
 
 /* AMDVI cache entry */
@@ -685,6 +688,75 @@ static uint64_t fetch_pte(AMDVIAddressSpace *as, hwaddr address, uint64_t dte,
     return 0;
 }
 
+/*
+ * Invoke notifiers registered for the address space. Update record of mapped
+ * ranges in IOVA Tree.
+ */
+static void amdvi_notify_iommu(AMDVIAddressSpace *as, IOMMUTLBEvent *event)
+{
+    IOMMUTLBEntry *entry = &event->entry;
+
+    DMAMap target = {
+        .iova = entry->iova,
+        .size = entry->addr_mask,
+        .translated_addr = entry->translated_addr,
+        .perm = entry->perm,
+    };
+
+    /*
+     * Search the IOVA Tree for an existing translation for the target, and skip
+     * the notification if the mapping is already recorded.
+     * When the guest uses large pages, comparing against the record makes it
+     * possible to determine the size of the original MAP and adjust the UNMAP
+     * request to match it. This avoids failed checks against the mappings kept
+     * by the VFIO kernel driver.
+     */
+    const DMAMap *mapped = iova_tree_find(as->iova_tree, &target);
+
+    if (event->type == IOMMU_NOTIFIER_UNMAP) {
+        if (!mapped) {
+            /* No record exists of this mapping, nothing to do */
+            return;
+        }
+        /*
+         * Adjust the size based on the original record. This is essential to
+         * determine when large/contiguous pages are used, since the guest has
+         * already cleared the PTE (erasing the pagesize encoded on it) before
+         * issuing the invalidation command.
+         */
+        if (mapped->size != target.size) {
+            assert(mapped->size > target.size);
+            target.size = mapped->size;
+            /* Adjust event to invoke notifier with correct range */
+            entry->addr_mask = mapped->size;
+        }
+        iova_tree_remove(as->iova_tree, target);
+    } else { /* IOMMU_NOTIFIER_MAP */
+        if (mapped) {
+            /*
+             * If a mapping is present and matches the request, skip the
+             * notification.
+             */
+            if (!memcmp(mapped, &target, sizeof(DMAMap))) {
+                return;
+            } else {
+                /*
+                 * This should never happen unless a buggy guest OS omits or
+                 * sends incorrect invalidation(s). Report an error in the event
+                 * it does happen.
+                 */
+                error_report("Found conflicting translation. This could be due "
+                             "to an incorrect or missing invalidation command");
+            }
+        }
+        /* Record the new mapping */
+        iova_tree_insert(as->iova_tree, &target);
+    }
+
+    /* Invoke the notifiers registered for this address space */
+    memory_region_notify_iommu(&as->iommu, 0, *event);
+}
+
 /*
  * Walk the guest page table for an IOVA and range and signal the registered
  * notifiers to sync the shadow page tables in the host.
@@ -696,7 +768,7 @@ static void amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as,
 {
     IOMMUTLBEvent event;
 
-    hwaddr iova_next, page_mask, pagesize;
+    hwaddr page_mask, pagesize;
     hwaddr iova = addr;
     hwaddr end = iova + size - 1;
 
@@ -719,7 +791,6 @@ static void amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as,
         /* PTE has been validated for major errors and pagesize is set */
         assert(pagesize);
         page_mask = ~(pagesize - 1);
-        iova_next = (iova & page_mask) + pagesize;
 
         if (ret == -AMDVI_FR_PT_ENTRY_INV) {
             /*
@@ -752,15 +823,26 @@ static void amdvi_sync_shadow_page_table_range(AMDVIAddressSpace *as,
             event.type = IOMMU_NOTIFIER_MAP;
         }
 
-        /* Invoke the notifiers registered for this address space */
-        memory_region_notify_iommu(&as->iommu, 0, event);
+        /*
+         * The following call might need to adjust event.entry.size in cases
+         * where the guest unmapped a series of large pages.
+         */
+        amdvi_notify_iommu(as, &event);
+        /*
+         * In the special scenario where the guest is unmapping a large page,
+         * addr_mask has been adjusted before sending the notification. Update
+         * pagesize accordingly in order to correctly compute the next IOVA.
+         */
+        pagesize = event.entry.addr_mask + 1;
 
 next:
+        iova &= ~(pagesize - 1);
+
         /* Check for 64-bit overflow and terminate walk in such cases */
-        if (iova_next < iova) {
+        if ((iova + pagesize) < iova) {
             break;
         } else {
-            iova = iova_next;
+            iova += pagesize;
         }
     }
 }
@@ -1845,6 +1927,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
         iommu_as[devfn]->devfn = (uint8_t)devfn;
         iommu_as[devfn]->iommu_state = s;
         iommu_as[devfn]->notifier_flags = IOMMU_NOTIFIER_NONE;
+        iommu_as[devfn]->iova_tree = iova_tree_new();
 
         amdvi_dev_as = iommu_as[devfn];
 

From 63e39ec114d51c15f2b76709e874bef5bbd413cb Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:05 +0000
Subject: [PATCH 0999/2396] amd_iommu: Unmap all address spaces under the AMD
 IOMMU on reset

Support dropping all existing mappings on reset. When the guest kernel
reboots it will create new ones, but other components that run before
the kernel (e.g. OVMF) should not be able to use existing mappings from
the previous boot.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-13-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 74 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 74 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 4376e977f8..497f18c540 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -847,6 +847,77 @@ next:
     }
 }
 
+/*
+ * Unmap entire range that the notifier registered for i.e. the full AS.
+ *
+ * This is seemingly technically equivalent to directly calling
+ * memory_region_unmap_iommu_notifier_range(), but it allows to check for
+ * notifier boundaries and issue notifications with ranges within those bounds.
+ */
+static void amdvi_address_space_unmap(AMDVIAddressSpace *as, IOMMUNotifier *n)
+{
+
+    hwaddr start = n->start;
+    hwaddr end = n->end;
+    hwaddr remain;
+    DMAMap map;
+
+    assert(start <= end);
+    remain = end - start + 1;
+
+    /*
+     * Divide the notifier range into chunks that are aligned and do not exceed
+     * the notifier boundaries.
+     */
+    while (remain >= AMDVI_PAGE_SIZE) {
+
+        IOMMUTLBEvent event;
+
+        uint64_t mask = dma_aligned_pow2_mask(start, end, 64);
+
+        event.type = IOMMU_NOTIFIER_UNMAP;
+
+        IOMMUTLBEntry entry = {
+            .target_as = &address_space_memory,
+            .iova = start,
+            .translated_addr = 0,   /* irrelevant for unmap case */
+            .addr_mask = mask,
+            .perm = IOMMU_NONE,
+        };
+        event.entry = entry;
+
+        /* Call notifier registered for updates on this address space */
+        memory_region_notify_iommu_one(n, &event);
+
+        start += mask + 1;
+        remain -= mask + 1;
+    }
+
+    assert(!remain);
+
+    map.iova = n->start;
+    map.size = n->end - n->start;
+
+    iova_tree_remove(as->iova_tree, map);
+}
+
+/*
+ * For all the address spaces with notifiers registered, unmap the entire range
+ * the notifier registered for i.e. clear all the address spaces managed by the
+ * IOMMU.
+ */
+static void amdvi_address_space_unmap_all(AMDVIState *s)
+{
+    AMDVIAddressSpace *as;
+    IOMMUNotifier *n;
+
+    QLIST_FOREACH(as, &s->amdvi_as_with_notifiers, next) {
+        IOMMU_NOTIFIER_FOREACH(n, &as->iommu) {
+            amdvi_address_space_unmap(as, n);
+        }
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -2099,6 +2170,9 @@ static void amdvi_sysbus_reset(DeviceState *dev)
 
     msi_reset(&s->pci->dev);
     amdvi_init(s);
+
+    /* Discard all mappings on device reset */
+    amdvi_address_space_unmap_all(s);
 }
 
 static const VMStateDescription vmstate_amdvi_sysbus_migratable = {

From 1221c4a44902ed6162b06b30b7fcc245c39c2006 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:06 +0000
Subject: [PATCH 1000/2396] amd_iommu: Add replay callback

A replay() method is necessary to efficiently synchronize the host page
tables after VFIO registers a notifier for IOMMU events. It is called to
ensure that existing mappings from an IOMMU memory region are "replayed" to
a specified notifier, initializing or updating the shadow page tables on the
host.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-14-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 497f18c540..9027f7c054 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -918,6 +918,29 @@ static void amdvi_address_space_unmap_all(AMDVIState *s)
     }
 }
 
+/*
+ * For every translation present in the IOMMU, construct IOMMUTLBEntry data
+ * and pass it as parameter to notifier callback.
+ */
+static void amdvi_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n)
+{
+    AMDVIAddressSpace *as = container_of(iommu_mr, AMDVIAddressSpace, iommu);
+    uint64_t dte[4] = { 0 };
+
+    if (!(n->notifier_flags & IOMMU_NOTIFIER_MAP)) {
+        return;
+    }
+
+    if (amdvi_as_to_dte(as, dte)) {
+        return;
+    }
+
+    /* Dropping all mappings for the address space. Also clears the IOVA tree */
+    amdvi_address_space_unmap(as, n);
+
+    amdvi_sync_shadow_page_table_range(as, &dte[0], 0, UINT64_MAX, false);
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -2364,6 +2387,7 @@ static void amdvi_iommu_memory_region_class_init(ObjectClass *klass,
 
     imrc->translate = amdvi_translate;
     imrc->notify_flag_changed = amdvi_iommu_notify_flag_changed;
+    imrc->replay = amdvi_iommu_replay;
 }
 
 static const TypeInfo amdvi_iommu_memory_region_info = {

From b6a59a2ebf13df35370440b63ea1b8cf0f06435b Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:07 +0000
Subject: [PATCH 1001/2396] amd_iommu: Invalidate address translations on
 INVALIDATE_IOMMU_ALL

When the kernel IOMMU driver issues an INVALIDATE_IOMMU_ALL, the address
translation and interrupt remapping information must be cleared for all
Device IDs and all domains. Introduce a helper to sync the shadow page table
for all the address spaces with registered notifiers, which replays both MAP
and UNMAP events.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-15-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 48 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 9027f7c054..d74d42b3dd 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -941,6 +941,47 @@ static void amdvi_iommu_replay(IOMMUMemoryRegion *iommu_mr, IOMMUNotifier *n)
     amdvi_sync_shadow_page_table_range(as, &dte[0], 0, UINT64_MAX, false);
 }
 
+static void amdvi_address_space_sync(AMDVIAddressSpace *as)
+{
+    IOMMUNotifier *n;
+    uint64_t dte[4] = { 0 };
+
+    /* If only UNMAP notifiers are registered, drop all existing mappings */
+    if (!(as->notifier_flags & IOMMU_NOTIFIER_MAP)) {
+        IOMMU_NOTIFIER_FOREACH(n, &as->iommu) {
+            /*
+             * Directly calling memory_region_unmap_iommu_notifier_range() does
+             * not guarantee that the addr_mask eventually passed as parameter
+             * to the notifier is valid. Use amdvi_address_space_unmap() which
+             * ensures the notifier range is divided into properly aligned
+             * regions, and issues notifications for each one.
+             */
+            amdvi_address_space_unmap(as, n);
+        }
+        return;
+    }
+
+    if (amdvi_as_to_dte(as, dte)) {
+        return;
+    }
+
+    amdvi_sync_shadow_page_table_range(as, &dte[0], 0, UINT64_MAX, true);
+}
+
+/*
+ * This differs from the replay() method in that it issues both MAP and UNMAP
+ * notifications since it is called after global invalidation events in order to
+ * re-sync all address spaces.
+ */
+static void amdvi_iommu_address_space_sync_all(AMDVIState *s)
+{
+    AMDVIAddressSpace *as;
+
+    QLIST_FOREACH(as, &s->amdvi_as_with_notifiers, next) {
+        amdvi_address_space_sync(as);
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -983,6 +1024,13 @@ static void amdvi_inval_all(AMDVIState *s, uint64_t *cmd)
     amdvi_intremap_inval_notify_all(s, true, 0, 0);
 
     amdvi_iotlb_reset(s);
+
+    /*
+     * Fully replay the address space i.e. send both UNMAP and MAP events in
+     * order to synchronize guest and host IO page tables tables.
+     */
+    amdvi_iommu_address_space_sync_all(s);
+
     trace_amdvi_all_inval();
 }
 

From cb906e6f69d9ac7de819ad83a0e8a89d836a6bb8 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:08 +0000
Subject: [PATCH 1002/2396] amd_iommu: Toggle memory regions based on address
 translation mode

Enable the appropriate memory region for an address space depending on the
address translation mode selected for it. This is currently based on a
generic x86 IOMMU property, and only done during the address space
initialization. Extract the code into a helper and toggle the regions based
on whether the specific address space is using address translation (via the
newly introduced addr_translation field). Later, region activation will also
be controlled by availability of DMA remapping capability (via dma-remap
property to be introduced in follow up changes).

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-16-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index d74d42b3dd..67a26f5247 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -74,6 +74,8 @@ struct AMDVIAddressSpace {
     QLIST_ENTRY(AMDVIAddressSpace) next;
     /* Record DMA translation ranges */
     IOVATree *iova_tree;
+    /* DMA address translation active */
+    bool addr_translation;
 };
 
 /* AMDVI cache entry */
@@ -982,6 +984,23 @@ static void amdvi_iommu_address_space_sync_all(AMDVIState *s)
     }
 }
 
+/*
+ * Toggle between address translation and passthrough modes by enabling the
+ * corresponding memory regions.
+ */
+static void amdvi_switch_address_space(AMDVIAddressSpace *amdvi_as)
+{
+    if (amdvi_as->addr_translation) {
+        /* Enabling DMA region */
+        memory_region_set_enabled(&amdvi_as->iommu_nodma, false);
+        memory_region_set_enabled(MEMORY_REGION(&amdvi_as->iommu), true);
+    } else {
+        /* Disabling DMA region, using passthrough */
+        memory_region_set_enabled(MEMORY_REGION(&amdvi_as->iommu), false);
+        memory_region_set_enabled(&amdvi_as->iommu_nodma, true);
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -2070,6 +2089,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
         iommu_as[devfn]->iommu_state = s;
         iommu_as[devfn]->notifier_flags = IOMMU_NOTIFIER_NONE;
         iommu_as[devfn]->iova_tree = iova_tree_new();
+        iommu_as[devfn]->addr_translation = false;
 
         amdvi_dev_as = iommu_as[devfn];
 
@@ -2112,8 +2132,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
                                             AMDVI_INT_ADDR_FIRST,
                                             &amdvi_dev_as->iommu_ir, 1);
 
-        memory_region_set_enabled(&amdvi_dev_as->iommu_nodma, false);
-        memory_region_set_enabled(MEMORY_REGION(&amdvi_dev_as->iommu), true);
+        amdvi_switch_address_space(amdvi_dev_as);
     }
     return &iommu_as[devfn]->as;
 }

From 01f599d39c0e845d1cd0f7521aac7d409a3a6ad7 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:09 +0000
Subject: [PATCH 1003/2396] amd_iommu: Set all address spaces to use
 passthrough mode on reset

On reset, restore the default address translation mode (passthrough) for all
the address spaces managed by the vIOMMU.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-17-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 67a26f5247..e9ce7b46e8 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1001,6 +1001,35 @@ static void amdvi_switch_address_space(AMDVIAddressSpace *amdvi_as)
     }
 }
 
+/*
+ * For all existing address spaces managed by the IOMMU, enable/disable the
+ * corresponding memory regions to reset the address translation mode and
+ * use passthrough by default.
+ */
+static void amdvi_reset_address_translation_all(AMDVIState *s)
+{
+    AMDVIAddressSpace **iommu_as;
+
+    for (int bus_num = 0; bus_num < PCI_BUS_MAX; bus_num++) {
+
+        /* Nothing to do if there are no devices on the current bus */
+        if (!s->address_spaces[bus_num]) {
+            continue;
+        }
+        iommu_as = s->address_spaces[bus_num];
+
+        for (int devfn = 0; devfn < PCI_DEVFN_MAX; devfn++) {
+
+            if (!iommu_as[devfn]) {
+                continue;
+            }
+            /* Use passthrough as default mode after reset */
+            iommu_as[devfn]->addr_translation = false;
+            amdvi_switch_address_space(iommu_as[devfn]);
+        }
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
@@ -2263,6 +2292,7 @@ static void amdvi_sysbus_reset(DeviceState *dev)
 
     /* Discard all mappings on device reset */
     amdvi_address_space_unmap_all(s);
+    amdvi_reset_address_translation_all(s);
 }
 
 static const VMStateDescription vmstate_amdvi_sysbus_migratable = {

From 7e24cddf1f7941825e195e3239f0345d81927c14 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:10 +0000
Subject: [PATCH 1004/2396] amd_iommu: Add dma-remap property to AMD vIOMMU
 device

In order to enable device assignment with IOMMU protection and guest DMA
address translation, IOMMU MAP notifier support is necessary to allow users
like VFIO to synchronize the shadow page tables i.e. to receive
notifications when the guest updates its I/O page tables and replay the
mappings onto host I/O page tables.

Provide a new dma-remap property to govern the ability to register for MAP
notifications, effectively providing global control over the DMA address
translation functionality that was implemented in previous changes.

Note that DMA remapping support also requires the vIOMMU is configured with
the NpCache capability, so a guest driver issues IOMMU invalidations for
both map() and unmap() operations. This capability is already set by default
and written to the configuration in amdvi_pci_realize() as part of
AMDVI_CAPAB_FEATURES.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-18-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 24 +++++++++++++++++-------
 hw/i386/amd_iommu.h |  3 +++
 2 files changed, 20 insertions(+), 7 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index e9ce7b46e8..ce5d4c3662 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -990,7 +990,9 @@ static void amdvi_iommu_address_space_sync_all(AMDVIState *s)
  */
 static void amdvi_switch_address_space(AMDVIAddressSpace *amdvi_as)
 {
-    if (amdvi_as->addr_translation) {
+    AMDVIState *s = amdvi_as->iommu_state;
+
+    if (s->dma_remap && amdvi_as->addr_translation) {
         /* Enabling DMA region */
         memory_region_set_enabled(&amdvi_as->iommu_nodma, false);
         memory_region_set_enabled(MEMORY_REGION(&amdvi_as->iommu), true);
@@ -2193,12 +2195,19 @@ static int amdvi_iommu_notify_flag_changed(IOMMUMemoryRegion *iommu,
     AMDVIAddressSpace *as = container_of(iommu, AMDVIAddressSpace, iommu);
     AMDVIState *s = as->iommu_state;
 
-    if (new & IOMMU_NOTIFIER_MAP) {
-        error_setg(errp,
-                   "device %02x.%02x.%x requires iommu notifier which is not "
-                   "currently supported", as->bus_num, PCI_SLOT(as->devfn),
-                   PCI_FUNC(as->devfn));
-        return -EINVAL;
+    /*
+     * Accurate synchronization of the vIOMMU page tables required to support
+     * MAP notifiers is provided by the dma-remap feature. In addition, this
+     * also requires that the vIOMMU presents the NpCache capability, so a guest
+     * driver issues invalidations for both map() and unmap() operations. The
+     * capability is already set by default as part of AMDVI_CAPAB_FEATURES and
+     * written to the configuration in amdvi_pci_realize().
+     */
+    if (!s->dma_remap && (new & IOMMU_NOTIFIER_MAP)) {
+        error_setg_errno(errp, ENOTSUP,
+            "device %02x.%02x.%x requires dma-remap=1",
+            as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn));
+        return -ENOTSUP;
     }
 
     /*
@@ -2423,6 +2432,7 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
 static const Property amdvi_properties[] = {
     DEFINE_PROP_BOOL("xtsup", AMDVIState, xtsup, false),
     DEFINE_PROP_STRING("pci-id", AMDVIState, pci_id),
+    DEFINE_PROP_BOOL("dma-remap", AMDVIState, dma_remap, false),
 };
 
 static const VMStateDescription vmstate_amdvi_sysbus = {
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index b51aa74368..e1354686b6 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -418,6 +418,9 @@ struct AMDVIState {
     /* Interrupt remapping */
     bool ga_enabled;
     bool xtsup;
+
+    /* DMA address translation */
+    bool dma_remap;
 };
 
 uint64_t amdvi_extended_feature_register(AMDVIState *s);

From a9721c5d80ff23a018f40cc3693678a60630c659 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:11 +0000
Subject: [PATCH 1005/2396] amd_iommu: Toggle address translation mode on
 devtab entry invalidation

A guest must issue an INVALIDATE_DEVTAB_ENTRY command after changing a
Device Table entry (DTE) e.g. after attaching a device and setting up its
DTE. When intercepting this event, determine if the DTE has been configured
for paging or not, and toggle the appropriate memory regions to allow DMA
address translation for the address space if needed. Requires dma-remap=on.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-19-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 122 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 120 insertions(+), 2 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index ce5d4c3662..e916dcb2be 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1032,18 +1032,136 @@ static void amdvi_reset_address_translation_all(AMDVIState *s)
     }
 }
 
+static void enable_dma_mode(AMDVIAddressSpace *as, bool inval_current)
+{
+    /*
+     * When enabling DMA mode for the purpose of isolating guest devices on
+     * a failure to retrieve or invalid DTE, all existing mappings must be
+     * dropped.
+     */
+    if (inval_current) {
+        IOMMUNotifier *n;
+        IOMMU_NOTIFIER_FOREACH(n, &as->iommu) {
+            amdvi_address_space_unmap(as, n);
+        }
+    }
+
+    if (as->addr_translation) {
+        return;
+    }
+
+    /* Installing DTE enabling translation, activate region */
+    as->addr_translation = true;
+    amdvi_switch_address_space(as);
+    /* Sync shadow page tables */
+    amdvi_address_space_sync(as);
+}
+
+/*
+ * If paging was previously in use in the address space
+ * - invalidate all existing mappings
+ * - switch to no_dma memory region
+ */
+static void enable_nodma_mode(AMDVIAddressSpace *as)
+{
+    IOMMUNotifier *n;
+
+    if (!as->addr_translation) {
+        /* passthrough is already active, nothing to do */
+        return;
+    }
+
+    as->addr_translation = false;
+    IOMMU_NOTIFIER_FOREACH(n, &as->iommu) {
+        /* Drop all mappings for the address space */
+        amdvi_address_space_unmap(as, n);
+    }
+    amdvi_switch_address_space(as);
+}
+
+/*
+ * A guest driver must issue the INVALIDATE_DEVTAB_ENTRY command to the IOMMU
+ * after changing a Device Table entry. We can use this fact to detect when a
+ * Device Table entry is created for a device attached to a paging domain and
+ * enable the corresponding IOMMU memory region to allow for DMA translation if
+ * appropriate.
+ */
+static void amdvi_update_addr_translation_mode(AMDVIState *s, uint16_t devid)
+{
+    uint8_t bus_num, devfn, dte_mode;
+    AMDVIAddressSpace *as;
+    uint64_t dte[4] = { 0 };
+    int ret;
+
+    /*
+     * Convert the devid encoded in the command to a bus and devfn in
+     * order to retrieve the corresponding address space.
+     */
+    bus_num = PCI_BUS_NUM(devid);
+    devfn = devid & 0xff;
+
+    /*
+     * The main buffer of size (AMDVIAddressSpace *) * (PCI_BUS_MAX) has already
+     * been allocated within AMDVIState, but must be careful to not access
+     * unallocated devfn.
+     */
+    if (!s->address_spaces[bus_num] || !s->address_spaces[bus_num][devfn]) {
+        return;
+    }
+    as = s->address_spaces[bus_num][devfn];
+
+    ret = amdvi_as_to_dte(as, dte);
+
+    if (!ret) {
+        dte_mode = (dte[0] >> AMDVI_DEV_MODE_RSHIFT) & AMDVI_DEV_MODE_MASK;
+    }
+
+    switch (ret) {
+    case 0:
+        /* DTE was successfully retrieved */
+        if (!dte_mode) {
+            enable_nodma_mode(as); /* DTE[V]=1 && DTE[Mode]=0 => passthrough */
+        } else {
+            enable_dma_mode(as, false); /* Enable DMA translation */
+        }
+        break;
+    case -AMDVI_FR_DTE_V:
+        /* DTE[V]=0, address is passed untranslated */
+        enable_nodma_mode(as);
+        break;
+    case -AMDVI_FR_DTE_RTR_ERR:
+    case -AMDVI_FR_DTE_TV:
+        /*
+         * Enforce isolation by using DMA in rare scenarios where the DTE cannot
+         * be retrieved or DTE[TV]=0. Existing mappings are dropped.
+         */
+        enable_dma_mode(as, true);
+        break;
+    }
+}
+
 /* log error without aborting since linux seems to be using reserved bits */
 static void amdvi_inval_devtab_entry(AMDVIState *s, uint64_t *cmd)
 {
     uint16_t devid = cpu_to_le16((uint16_t)extract64(cmd[0], 0, 16));
 
+    trace_amdvi_devtab_inval(PCI_BUS_NUM(devid), PCI_SLOT(devid),
+                             PCI_FUNC(devid));
+
     /* This command should invalidate internal caches of which there isn't */
     if (extract64(cmd[0], 16, 44) || cmd[1]) {
         amdvi_log_illegalcom_error(s, extract64(cmd[0], 60, 4),
                                    s->cmdbuf + s->cmdbuf_head);
+        return;
+    }
+
+    /*
+     * When DMA remapping capability is enabled, check if updated DTE is setup
+     * for paging or not, and configure the corresponding memory regions.
+     */
+    if (s->dma_remap) {
+        amdvi_update_addr_translation_mode(s, devid);
     }
-    trace_amdvi_devtab_inval(PCI_BUS_NUM(devid), PCI_SLOT(devid),
-                             PCI_FUNC(devid));
 }
 
 static void amdvi_complete_ppr(AMDVIState *s, uint64_t *cmd)

From f6b5644c90847a9a7b9d2926556e1e71c4d1c797 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:12 +0000
Subject: [PATCH 1006/2396] amd_iommu: Do not assume passthrough translation
 when DTE[TV]=0

The AMD I/O Virtualization Technology (IOMMU) Specification (see Table
8: V, TV, and GV Fields in Device Table Entry), specifies that a DTE
with V=1, TV=0 does not contain a valid address translation information.
If a request requires a table walk, the walk is terminated when this
condition is encountered.

Do not assume that addresses for a device with DTE[TV]=0 are passed
through (i.e. not remapped) and instead terminate the page table walk
early.

Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-20-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 95 +++++++++++++++++++++++++--------------------
 1 file changed, 52 insertions(+), 43 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index e916dcb2be..1bda2a8ac3 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -1722,51 +1722,60 @@ static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
     uint64_t pte = dte[0], pte_addr, page_mask;
 
     /* make sure the DTE has TV = 1 */
-    if (pte & AMDVI_DEV_TRANSLATION_VALID) {
-        level = get_pte_translation_mode(pte);
-        if (level >= 7) {
-            trace_amdvi_mode_invalid(level, addr);
-            return;
-        }
-        if (level == 0) {
-            goto no_remap;
-        }
-
-        /* we are at the leaf page table or page table encodes a huge page */
-        do {
-            pte_perms = amdvi_get_perms(pte);
-            present = pte & 1;
-            if (!present || perms != (perms & pte_perms)) {
-                amdvi_page_fault(as->iommu_state, as->devfn, addr, perms);
-                trace_amdvi_page_fault(addr);
-                return;
-            }
-
-            /* go to the next lower level */
-            pte_addr = pte & AMDVI_DEV_PT_ROOT_MASK;
-            /* add offset and load pte */
-            pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
-            pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
-            if (!pte || (pte == (uint64_t)-1)) {
-                return;
-            }
-            oldlevel = level;
-            level = get_pte_translation_mode(pte);
-        } while (level > 0 && level < 7);
-
-        if (level == 0x7) {
-            page_mask = pte_override_page_mask(pte);
-        } else {
-            page_mask = pte_get_page_mask(oldlevel);
-        }
-
-        /* get access permissions from pte */
-        ret->iova = addr & page_mask;
-        ret->translated_addr = (pte & AMDVI_DEV_PT_ROOT_MASK) & page_mask;
-        ret->addr_mask = ~page_mask;
-        ret->perm = amdvi_get_perms(pte);
+    if (!(pte & AMDVI_DEV_TRANSLATION_VALID)) {
+        /*
+         * A DTE with V=1, TV=0 does not have a valid Page Table Root Pointer.
+         * An IOMMU processing a request that requires a table walk terminates
+         * the walk when it encounters this condition. Do the same and return
+         * instead of assuming that the address is forwarded without translation
+         * i.e. the passthrough case, as it is done for the case where DTE[V]=0.
+         */
         return;
     }
+
+    level = get_pte_translation_mode(pte);
+    if (level >= 7) {
+        trace_amdvi_mode_invalid(level, addr);
+        return;
+    }
+    if (level == 0) {
+        goto no_remap;
+    }
+
+    /* we are at the leaf page table or page table encodes a huge page */
+    do {
+        pte_perms = amdvi_get_perms(pte);
+        present = pte & 1;
+        if (!present || perms != (perms & pte_perms)) {
+            amdvi_page_fault(as->iommu_state, as->devfn, addr, perms);
+            trace_amdvi_page_fault(addr);
+            return;
+        }
+        /* go to the next lower level */
+        pte_addr = pte & AMDVI_DEV_PT_ROOT_MASK;
+        /* add offset and load pte */
+        pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
+        pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
+        if (!pte) {
+            return;
+        }
+        oldlevel = level;
+        level = get_pte_translation_mode(pte);
+    } while (level > 0 && level < 7);
+
+    if (level == 0x7) {
+        page_mask = pte_override_page_mask(pte);
+    } else {
+        page_mask = pte_get_page_mask(oldlevel);
+    }
+
+    /* get access permissions from pte */
+    ret->iova = addr & page_mask;
+    ret->translated_addr = (pte & AMDVI_DEV_PT_ROOT_MASK) & page_mask;
+    ret->addr_mask = ~page_mask;
+    ret->perm = amdvi_get_perms(pte);
+    return;
+
 no_remap:
     ret->iova = addr & AMDVI_PAGE_MASK_4K;
     ret->translated_addr = addr & AMDVI_PAGE_MASK_4K;

From de83472bee07aea583b777dce4666faa677d1c18 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Fri, 19 Sep 2025 21:35:13 +0000
Subject: [PATCH 1007/2396] amd_iommu: Refactor amdvi_page_walk() to use common
 code for page walk

Simplify amdvi_page_walk() by making it call the fetch_pte() helper that is
already in use by the shadow page synchronization code. Ensures all code
uses the same page table walking algorithm.

Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-21-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/amd_iommu.c | 77 ++++++++++++++++-----------------------------
 1 file changed, 27 insertions(+), 50 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 1bda2a8ac3..b6851784fb 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -513,24 +513,6 @@ static inline uint8_t get_pte_translation_mode(uint64_t pte)
     return (pte >> AMDVI_DEV_MODE_RSHIFT) & AMDVI_DEV_MODE_MASK;
 }
 
-static inline uint64_t pte_override_page_mask(uint64_t pte)
-{
-    uint8_t page_mask = 13;
-    uint64_t addr = (pte & AMDVI_DEV_PT_ROOT_MASK) >> 12;
-    /* find the first zero bit */
-    while (addr & 1) {
-        page_mask++;
-        addr = addr >> 1;
-    }
-
-    return ~((1ULL << page_mask) - 1);
-}
-
-static inline uint64_t pte_get_page_mask(uint64_t oldlevel)
-{
-    return ~((1UL << ((oldlevel * 9) + 3)) - 1);
-}
-
 static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
                                           uint16_t devid)
 {
@@ -1718,11 +1700,13 @@ static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
                             IOMMUTLBEntry *ret, unsigned perms,
                             hwaddr addr)
 {
-    unsigned level, present, pte_perms, oldlevel;
-    uint64_t pte = dte[0], pte_addr, page_mask;
+    hwaddr page_mask, pagesize = 0;
+    uint8_t mode;
+    uint64_t pte;
+    int fetch_ret;
 
     /* make sure the DTE has TV = 1 */
-    if (!(pte & AMDVI_DEV_TRANSLATION_VALID)) {
+    if (!(dte[0] & AMDVI_DEV_TRANSLATION_VALID)) {
         /*
          * A DTE with V=1, TV=0 does not have a valid Page Table Root Pointer.
          * An IOMMU processing a request that requires a table walk terminates
@@ -1733,42 +1717,35 @@ static void amdvi_page_walk(AMDVIAddressSpace *as, uint64_t *dte,
         return;
     }
 
-    level = get_pte_translation_mode(pte);
-    if (level >= 7) {
-        trace_amdvi_mode_invalid(level, addr);
+    mode = get_pte_translation_mode(dte[0]);
+    if (mode >= 7) {
+        trace_amdvi_mode_invalid(mode, addr);
         return;
     }
-    if (level == 0) {
+    if (mode == 0) {
         goto no_remap;
     }
 
-    /* we are at the leaf page table or page table encodes a huge page */
-    do {
-        pte_perms = amdvi_get_perms(pte);
-        present = pte & 1;
-        if (!present || perms != (perms & pte_perms)) {
-            amdvi_page_fault(as->iommu_state, as->devfn, addr, perms);
-            trace_amdvi_page_fault(addr);
-            return;
-        }
-        /* go to the next lower level */
-        pte_addr = pte & AMDVI_DEV_PT_ROOT_MASK;
-        /* add offset and load pte */
-        pte_addr += ((addr >> (3 + 9 * level)) & 0x1FF) << 3;
-        pte = amdvi_get_pte_entry(as->iommu_state, pte_addr, as->devfn);
-        if (!pte) {
-            return;
-        }
-        oldlevel = level;
-        level = get_pte_translation_mode(pte);
-    } while (level > 0 && level < 7);
+    /* Attempt to fetch the PTE to determine if a valid mapping exists */
+    fetch_ret = fetch_pte(as, addr, dte[0], &pte, &pagesize);
 
-    if (level == 0x7) {
-        page_mask = pte_override_page_mask(pte);
-    } else {
-        page_mask = pte_get_page_mask(oldlevel);
+    /*
+     * If walking the page table results in an error of any type, returns an
+     * empty PTE i.e. no mapping, or the permissions do not match, return since
+     * there is no translation available.
+     */
+    if (fetch_ret < 0 || !IOMMU_PTE_PRESENT(pte) ||
+        perms != (perms & amdvi_get_perms(pte))) {
+
+        amdvi_page_fault(as->iommu_state, as->devfn, addr, perms);
+        trace_amdvi_page_fault(addr);
+        return;
     }
 
+    /* A valid PTE and page size has been retrieved */
+    assert(pagesize);
+    page_mask = ~(pagesize - 1);
+
     /* get access permissions from pte */
     ret->iova = addr & page_mask;
     ret->translated_addr = (pte & AMDVI_DEV_PT_ROOT_MASK) & page_mask;
@@ -1780,7 +1757,7 @@ no_remap:
     ret->iova = addr & AMDVI_PAGE_MASK_4K;
     ret->translated_addr = addr & AMDVI_PAGE_MASK_4K;
     ret->addr_mask = ~AMDVI_PAGE_MASK_4K;
-    ret->perm = amdvi_get_perms(pte);
+    ret->perm = amdvi_get_perms(dte[0]);
 }
 
 static void amdvi_do_translate(AMDVIAddressSpace *as, hwaddr addr,

From b6b49c2cd6c2be8aac80f7563950398c7128f19e Mon Sep 17 00:00:00 2001
From: Joao Martins <joao.m.martins@oracle.com>
Date: Fri, 19 Sep 2025 21:35:14 +0000
Subject: [PATCH 1008/2396] intel-iommu: Move dma_translation to x86-iommu

To be later reused by AMD, now that it shares similar property.

Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-22-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c       | 5 ++---
 hw/i386/x86-iommu.c         | 1 +
 include/hw/i386/x86-iommu.h | 1 +
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 2cc9bd5e45..fa2ad9c2eb 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -2704,7 +2704,7 @@ static void vtd_handle_gcmd_write(IntelIOMMUState *s)
     uint32_t changed = status ^ val;
 
     trace_vtd_reg_write_gcmd(status, val);
-    if ((changed & VTD_GCMD_TE) && s->dma_translation) {
+    if ((changed & VTD_GCMD_TE) && x86_iommu->dma_translation) {
         /* Translation enable/disable */
         vtd_handle_gcmd_te(s, val & VTD_GCMD_TE);
     }
@@ -3947,7 +3947,6 @@ static const Property vtd_properties[] = {
     DEFINE_PROP_BOOL("snoop-control", IntelIOMMUState, snoop_control, false),
     DEFINE_PROP_BOOL("x-pasid-mode", IntelIOMMUState, pasid, false),
     DEFINE_PROP_BOOL("dma-drain", IntelIOMMUState, dma_drain, true),
-    DEFINE_PROP_BOOL("dma-translation", IntelIOMMUState, dma_translation, true),
     DEFINE_PROP_BOOL("stale-tm", IntelIOMMUState, stale_tm, false),
     DEFINE_PROP_BOOL("fs1gp", IntelIOMMUState, fs1gp, true),
 };
@@ -4665,7 +4664,7 @@ static void vtd_cap_init(IntelIOMMUState *s)
     if (s->dma_drain) {
         s->cap |= VTD_CAP_DRAIN;
     }
-    if (s->dma_translation) {
+    if (x86_iommu->dma_translation) {
             if (s->aw_bits >= VTD_HOST_AW_39BIT) {
                     s->cap |= VTD_CAP_SAGAW_39bit;
             }
diff --git a/hw/i386/x86-iommu.c b/hw/i386/x86-iommu.c
index d34a6849f4..c127a44bb4 100644
--- a/hw/i386/x86-iommu.c
+++ b/hw/i386/x86-iommu.c
@@ -130,6 +130,7 @@ static const Property x86_iommu_properties[] = {
                             intr_supported, ON_OFF_AUTO_AUTO),
     DEFINE_PROP_BOOL("device-iotlb", X86IOMMUState, dt_supported, false),
     DEFINE_PROP_BOOL("pt", X86IOMMUState, pt_supported, true),
+    DEFINE_PROP_BOOL("dma-translation", X86IOMMUState, dma_translation, true),
 };
 
 static void x86_iommu_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/i386/x86-iommu.h b/include/hw/i386/x86-iommu.h
index bfd21649d0..e89f55a5c2 100644
--- a/include/hw/i386/x86-iommu.h
+++ b/include/hw/i386/x86-iommu.h
@@ -64,6 +64,7 @@ struct X86IOMMUState {
     OnOffAuto intr_supported;   /* Whether vIOMMU supports IR */
     bool dt_supported;          /* Whether vIOMMU supports DT */
     bool pt_supported;          /* Whether vIOMMU supports pass-through */
+    bool dma_translation;       /* Whether vIOMMU supports DMA translation */
     QLIST_HEAD(, IEC_Notifier) iec_notifiers; /* IEC notify list */
 };
 

From d9ec848fb515f4c98f5737ad1f788ef06887fc2c Mon Sep 17 00:00:00 2001
From: Joao Martins <joao.m.martins@oracle.com>
Date: Fri, 19 Sep 2025 21:35:15 +0000
Subject: [PATCH 1009/2396] amd_iommu: HATDis/HATS=11 support

Add a way to disable DMA translation support in AMD IOMMU by
allowing to set IVHD HATDis to 1, and exposing HATS (Host Address
Translation Size) as Reserved value.

Signed-off-by: Joao Martins <joao.m.martins@oracle.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250919213515.917111-23-alejandro.j.jimenez@oracle.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/acpi-build.c |  6 +++++-
 hw/i386/amd_iommu.c  | 19 +++++++++++++++++++
 hw/i386/amd_iommu.h  |  1 +
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/hw/i386/acpi-build.c b/hw/i386/acpi-build.c
index 423c4959fe..9446a9f862 100644
--- a/hw/i386/acpi-build.c
+++ b/hw/i386/acpi-build.c
@@ -1863,7 +1863,11 @@ build_amd_iommu(GArray *table_data, BIOSLinker *linker, const char *oem_id,
     /* IOMMU info */
     build_append_int_noprefix(table_data, 0, 2);
     /* IOMMU Attributes */
-    build_append_int_noprefix(table_data, 0, 4);
+    if (!s->iommu.dma_translation) {
+        build_append_int_noprefix(table_data, (1UL << 0) /* HATDis */, 4);
+    } else {
+        build_append_int_noprefix(table_data, 0, 4);
+    }
     /* EFR Register Image */
     build_append_int_noprefix(table_data,
                               amdvi_extended_feature_register(s),
diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index b6851784fb..378e0cb55e 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -107,6 +107,9 @@ uint64_t amdvi_extended_feature_register(AMDVIState *s)
     if (s->xtsup) {
         feature |= AMDVI_FEATURE_XT;
     }
+    if (!s->iommu.dma_translation) {
+        feature |= AMDVI_HATS_MODE_RESERVED;
+    }
 
     return feature;
 }
@@ -472,6 +475,9 @@ static inline uint64_t amdvi_get_perms(uint64_t entry)
 static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
                                uint64_t *dte)
 {
+
+    uint64_t root;
+
     if ((dte[0] & AMDVI_DTE_QUAD0_RESERVED) ||
         (dte[1] & AMDVI_DTE_QUAD1_RESERVED) ||
         (dte[2] & AMDVI_DTE_QUAD2_RESERVED) ||
@@ -482,6 +488,19 @@ static bool amdvi_validate_dte(AMDVIState *s, uint16_t devid,
         return false;
     }
 
+    /*
+     * 1 = Host Address Translation is not supported. Value in MMIO Offset
+     * 0030h[HATS] is not meaningful. A non-zero host page table root pointer
+     * in the DTE would result in an ILLEGAL_DEV_TABLE_ENTRY event.
+     */
+    root = (dte[0] & AMDVI_DEV_PT_ROOT_MASK) >> 12;
+    if (root && !s->iommu.dma_translation) {
+        amdvi_log_illegaldevtab_error(s, devid,
+                                      s->devtab +
+                                      devid * AMDVI_DEVTAB_ENTRY_SIZE, 0);
+        return false;
+    }
+
     return true;
 }
 
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index e1354686b6..daf82fc85f 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -177,6 +177,7 @@
 /* AMDVI paging mode */
 #define AMDVI_GATS_MODE                 (2ULL <<  12)
 #define AMDVI_HATS_MODE                 (2ULL <<  10)
+#define AMDVI_HATS_MODE_RESERVED        (3ULL <<  10)
 
 /* Page Table format */
 

From 221e59e3835c71bd3a09d05a39cd192e772aaec3 Mon Sep 17 00:00:00 2001
From: Li Zhaoxin <lizhaoxin04@baidu.com>
Date: Fri, 26 Sep 2025 19:08:17 +0800
Subject: [PATCH 1010/2396] vdpa-dev: add get_vhost() callback for vhost-vdpa
 device

Commit c255488d67 "virtio: add vhost support for virtio devices"
added the get_vhost() function, but it did not include vhost-vdpa devices.

So when I use the vdpa device and query the status of the vdpa device
with the x-query-virtio-status qmp command, since vdpa does not implement
vhost_get, it will cause qemu to crash.

Therefore, in order to obtain the status of the virtio device under vhost-vdpa,
we need to add a vhost_get implement for the vdpa device.

Co-developed-by: Miao Kezhan <miaokezhan@baidu.com>
Signed-off-by: Miao Kezhan <miaokezhan@baidu.com>
Signed-off-by: Li Zhaoxin <lizhaoxin04@baidu.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <2778f817cb6740a15ecb37927804a67288b062d1.1758860411.git.lizhaoxin04@baidu.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/virtio/vdpa-dev.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/virtio/vdpa-dev.c b/hw/virtio/vdpa-dev.c
index d1da40afc8..4a7b970976 100644
--- a/hw/virtio/vdpa-dev.c
+++ b/hw/virtio/vdpa-dev.c
@@ -338,6 +338,12 @@ static int vhost_vdpa_device_set_status(VirtIODevice *vdev, uint8_t status)
     return 0;
 }
 
+static struct vhost_dev *vhost_vdpa_device_get_vhost(VirtIODevice *vdev)
+{
+    VhostVdpaDevice *s = VHOST_VDPA_DEVICE(vdev);
+    return &s->dev;
+}
+
 static const Property vhost_vdpa_device_properties[] = {
     DEFINE_PROP_STRING("vhostdev", VhostVdpaDevice, vhostdev),
     DEFINE_PROP_UINT16("queue-size", VhostVdpaDevice, queue_size, 0),
@@ -369,6 +375,7 @@ static void vhost_vdpa_device_class_init(ObjectClass *klass, const void *data)
     vdc->set_config = vhost_vdpa_device_set_config;
     vdc->get_features = vhost_vdpa_device_get_features;
     vdc->set_status = vhost_vdpa_device_set_status;
+    vdc->get_vhost = vhost_vdpa_device_get_vhost;
 }
 
 static void vhost_vdpa_device_instance_init(Object *obj)

From 0305eceecdf100b98e4f230bf5a821621815a026 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 23:42:04 -0400
Subject: [PATCH 1011/2396] intel_iommu: Enable Enhanced Set Root Table Pointer
 Support (ESRTPS)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to VTD spec rev 4.1 section 6.6:
"For implementations reporting the Enhanced Set Root Table Pointer Support
(ESRTPS) field as Clear, on a 'Set Root Table Pointer' operation, software
must perform a global invalidate of the context cache, PASID-cache (if
applicable), and IOTLB, in that order. This is required to ensure hardware
references only the remapping structures referenced by the new root table
pointer and not stale cached entries.

For implementations reporting the Enhanced Set Root Table Pointer Support
(ESRTPS) field as Set, as part of 'Set Root Table Pointer' operation,
hardware performs global invalidation on all DMA remapping translation
caches and hence software is not required to perform additional
invalidations"

We already implemented ESRTPS capability in vtd_handle_gcmd_srtp() by
calling vtd_reset_caches(), just set ESRTPS in DMAR_CAP_REG to avoid
unnecessary global invalidation requests of context, PASID-cache and
IOTLB from guest.

This change doesn't impact migration as the content of DMAR_CAP_REG is
migrated too.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250929034206.439266-2-zhenzhong.duan@intel.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c          | 2 +-
 hw/i386/intel_iommu_internal.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index fa2ad9c2eb..0378551038 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -4660,7 +4660,7 @@ static void vtd_cap_init(IntelIOMMUState *s)
 
     s->cap = VTD_CAP_FRO | VTD_CAP_NFR | VTD_CAP_ND |
              VTD_CAP_MAMV | VTD_CAP_PSI | VTD_CAP_SLLPS |
-             VTD_CAP_MGAW(s->aw_bits);
+             VTD_CAP_ESRTPS | VTD_CAP_MGAW(s->aw_bits);
     if (s->dma_drain) {
         s->cap |= VTD_CAP_DRAIN;
     }
diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 0d0069a612..0f6a1237e4 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -215,6 +215,7 @@
 #define VTD_CAP_DRAIN_WRITE         (1ULL << 54)
 #define VTD_CAP_DRAIN_READ          (1ULL << 55)
 #define VTD_CAP_FS1GP               (1ULL << 56)
+#define VTD_CAP_ESRTPS              (1ULL << 63)
 #define VTD_CAP_DRAIN               (VTD_CAP_DRAIN_READ | VTD_CAP_DRAIN_WRITE)
 #define VTD_CAP_CM                  (1ULL << 7)
 #define VTD_PASID_ID_SHIFT          20

From 3cda33e06e72412512c0f376a5261e0ff6ebe73f Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 23:42:05 -0400
Subject: [PATCH 1012/2396] intel_iommu: Simplify caching mode check with VFIO
 device

In early days, we had different tricks to ensure caching-mode=on with VFIO
device:

28cf553afe ("intel_iommu: Sanity check vfio-pci config on machine init done")
c6cbc29d36 ("pc/q35: Disallow vfio-pci hotplug without VT-d caching mode")

There is also a patch with the same purpose but for VDPA device:

b8d78277c0 ("intel-iommu: fail MAP notifier without caching mode")

Because without caching mode, MAP notifier won't work correctly since guest
won't send IOTLB update event when it establishes new mappings in the I/O page
tables.

Now with host IOMMU device interface between VFIO and vIOMMU, we can simplify
first two commits above with a small check in set_iommu_device(). This also
works for future IOMMUFD backed VDPA implementation which may also need caching
mode on. But for legacy VDPA we still need commit b8d78277c0 as it doesn't
use the host IOMMU device interface.

For coldplug VFIO device:

  qemu-system-x86_64: -device vfio-pci,host=0000:3b:00.0,id=hostdev3,bus=root0,iommufd=iommufd0: vfio 0000:3b:00.0: Failed to set vIOMMU: Device assignment is not allowed without enabling caching-mode=on for Intel IOMMU.

For hotplug VFIO device:

  if "iommu=off" is configured in guest,
    Error: vfio 0000:3b:00.0: Failed to set vIOMMU: Device assignment is not allowed without enabling caching-mode=on for Intel IOMMU.
  else
    Error: vfio 0000:3b:00.0: memory listener initialization failed: Region vtd-00.0-dmar: device 01.00.0 requires caching mode: Operation not supported

The specialty for hotplug is due to the check in commit b8d78277c0 happen before
the check in set_iommu_device.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250929034206.439266-3-zhenzhong.duan@intel.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/i386/intel_iommu.c | 40 ++++++----------------------------------
 hw/i386/pc.c          | 20 --------------------
 2 files changed, 6 insertions(+), 54 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 0378551038..6a168d5107 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -87,13 +87,6 @@ struct vtd_iotlb_key {
 static void vtd_address_space_refresh_all(IntelIOMMUState *s);
 static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n);
 
-static void vtd_panic_require_caching_mode(void)
-{
-    error_report("We need to set caching-mode=on for intel-iommu to enable "
-                 "device assignment with IOMMU protection.");
-    exit(1);
-}
-
 static void vtd_define_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val,
                             uint64_t wmask, uint64_t w1cmask)
 {
@@ -4489,6 +4482,12 @@ static bool vtd_dev_set_iommu_device(PCIBus *bus, void *opaque, int devfn,
 
     assert(hiod);
 
+    if (!s->caching_mode) {
+        error_setg(errp, "Device assignment is not allowed without enabling "
+                   "caching-mode=on for Intel IOMMU.");
+        return false;
+    }
+
     vtd_iommu_lock(s);
 
     if (g_hash_table_lookup(s->vtd_host_iommu_dev, &key)) {
@@ -5244,32 +5243,6 @@ static bool vtd_decide_config(IntelIOMMUState *s, Error **errp)
     return true;
 }
 
-static int vtd_machine_done_notify_one(Object *child, void *unused)
-{
-    IntelIOMMUState *iommu = INTEL_IOMMU_DEVICE(x86_iommu_get_default());
-
-    /*
-     * We hard-coded here because vfio-pci is the only special case
-     * here.  Let's be more elegant in the future when we can, but so
-     * far there seems to be no better way.
-     */
-    if (object_dynamic_cast(child, "vfio-pci") && !iommu->caching_mode) {
-        vtd_panic_require_caching_mode();
-    }
-
-    return 0;
-}
-
-static void vtd_machine_done_hook(Notifier *notifier, void *unused)
-{
-    object_child_foreach_recursive(object_get_root(),
-                                   vtd_machine_done_notify_one, NULL);
-}
-
-static Notifier vtd_machine_done_notify = {
-    .notify = vtd_machine_done_hook,
-};
-
 static void vtd_realize(DeviceState *dev, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
@@ -5324,7 +5297,6 @@ static void vtd_realize(DeviceState *dev, Error **errp)
     pci_setup_iommu(bus, &vtd_iommu_ops, dev);
     /* Pseudo address space under root PCI bus. */
     x86ms->ioapic_as = vtd_host_dma_iommu(bus, s, Q35_PSEUDO_DEVFN_IOAPIC);
-    qemu_add_machine_init_done_notifier(&vtd_machine_done_notify);
 }
 
 static void vtd_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index eb36d50589..34b00663f2 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -1722,25 +1722,6 @@ static void pc_machine_wakeup(MachineState *machine)
     cpu_synchronize_all_post_reset();
 }
 
-static bool pc_hotplug_allowed(MachineState *ms, DeviceState *dev, Error **errp)
-{
-    X86IOMMUState *iommu = x86_iommu_get_default();
-    IntelIOMMUState *intel_iommu;
-
-    if (iommu &&
-        object_dynamic_cast((Object *)iommu, TYPE_INTEL_IOMMU_DEVICE) &&
-        object_dynamic_cast((Object *)dev, "vfio-pci")) {
-        intel_iommu = INTEL_IOMMU_DEVICE(iommu);
-        if (!intel_iommu->caching_mode) {
-            error_setg(errp, "Device assignment is not allowed without "
-                       "enabling caching-mode=on for Intel IOMMU.");
-            return false;
-        }
-    }
-
-    return true;
-}
-
 static void pc_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -1760,7 +1741,6 @@ static void pc_machine_class_init(ObjectClass *oc, const void *data)
     x86mc->apic_xrupt_override = true;
     assert(!mc->get_hotplug_handler);
     mc->get_hotplug_handler = pc_get_hotplug_handler;
-    mc->hotplug_allowed = pc_hotplug_allowed;
     mc->auto_enable_numa_with_memhp = true;
     mc->auto_enable_numa_with_memdev = true;
     mc->has_hotpluggable_cpus = true;

From 5c1ded52ac04ee818f642766e3f3b69c78fa160f Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 23:42:06 -0400
Subject: [PATCH 1013/2396] pci: Fix wrong parameter passing to
 pci_device_get_iommu_bus_devfn()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 2nd parameter of pci_device_get_iommu_bus_devfn() about root PCIBus
backed by an IOMMU for the PCI device, the 3rd is about aliased PCIBus
of the PCI device.

Meanwhile the 3rd and 4th parameters are optional, pass NULL if they
are not needed.

Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250929034206.439266-4-zhenzhong.duan@intel.com>
Fixes: a849ff5d6f ("pci: Add a pci-level initialization function for IOMMU notifiers")
Fixes: f0f37daf8e ("pci: Add a PCI-level API for PRI")
Fixes: e9b457500a ("pci: Add a pci-level API for ATS")
Fixes: 042cbc9aec ("pci: Add an API to get IOMMU's min page size and virtual address width")
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/pci/pci.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 4854d3d618..541e03b38c 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2964,7 +2964,7 @@ int pci_iommu_init_iotlb_notifier(PCIDevice *dev, IOMMUNotifier *n,
     PCIBus *iommu_bus;
     int devfn;
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->init_iotlb_notifier) {
         iommu_bus->iommu_ops->init_iotlb_notifier(bus, iommu_bus->iommu_opaque,
                                                   devfn, n, fn, opaque);
@@ -3022,7 +3022,7 @@ int pci_pri_request_page(PCIDevice *dev, uint32_t pasid, bool priv_req,
         return -EPERM;
     }
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->pri_request_page) {
         return iommu_bus->iommu_ops->pri_request_page(bus,
                                                      iommu_bus->iommu_opaque,
@@ -3046,7 +3046,7 @@ int pci_pri_register_notifier(PCIDevice *dev, uint32_t pasid,
         return -EPERM;
     }
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->pri_register_notifier) {
         iommu_bus->iommu_ops->pri_register_notifier(bus,
                                                     iommu_bus->iommu_opaque,
@@ -3063,7 +3063,7 @@ void pci_pri_unregister_notifier(PCIDevice *dev, uint32_t pasid)
     PCIBus *iommu_bus;
     int devfn;
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->pri_unregister_notifier) {
         iommu_bus->iommu_ops->pri_unregister_notifier(bus,
                                                       iommu_bus->iommu_opaque,
@@ -3095,7 +3095,7 @@ ssize_t pci_ats_request_translation(PCIDevice *dev, uint32_t pasid,
         return -EPERM;
     }
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->ats_request_translation) {
         return iommu_bus->iommu_ops->ats_request_translation(bus,
                                                      iommu_bus->iommu_opaque,
@@ -3119,7 +3119,7 @@ int pci_iommu_register_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
         return -EPERM;
     }
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->register_iotlb_notifier) {
         iommu_bus->iommu_ops->register_iotlb_notifier(bus,
                                            iommu_bus->iommu_opaque, devfn,
@@ -3141,7 +3141,7 @@ int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
         return -EPERM;
     }
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, &bus, &devfn);
     if (iommu_bus && iommu_bus->iommu_ops->unregister_iotlb_notifier) {
         iommu_bus->iommu_ops->unregister_iotlb_notifier(bus,
                                                         iommu_bus->iommu_opaque,
@@ -3155,11 +3155,9 @@ int pci_iommu_unregister_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
 int pci_iommu_get_iotlb_info(PCIDevice *dev, uint8_t *addr_width,
                              uint32_t *min_page_size)
 {
-    PCIBus *bus;
     PCIBus *iommu_bus;
-    int devfn;
 
-    pci_device_get_iommu_bus_devfn(dev, &bus, &iommu_bus, &devfn);
+    pci_device_get_iommu_bus_devfn(dev, &iommu_bus, NULL, NULL);
     if (iommu_bus && iommu_bus->iommu_ops->get_iotlb_info) {
         iommu_bus->iommu_ops->get_iotlb_info(iommu_bus->iommu_opaque,
                                              addr_width, min_page_size);

From e209d4d7a31b9f82925a2205e6e19e61a3facbe0 Mon Sep 17 00:00:00 2001
From: Alessandro Ratti <alessandro@0x65c.net>
Date: Wed, 24 Sep 2025 11:14:04 +0200
Subject: [PATCH 1014/2396] virtio: improve virtqueue mapping error messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Improve error reporting when virtqueue ring mapping fails by including a
device identifier in the error message.

Introduce a helper qdev_get_printable_name() in qdev-core, which returns
either:

 - the device ID, if explicitly provided (e.g. -device ...,id=foo)
 - the QOM path from qdev_get_dev_path(dev) otherwise
 - "<unknown device>" as a fallback when no identifier is present

This makes it easier to identify which device triggered the error in
multi-device setups or when debugging complex guest configurations.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/230
Buglink: https://bugs.launchpad.net/qemu/+bug/1919021
Suggested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Alessandro Ratti <alessandro@0x65c.net>
Message-Id: <20250924093138.559872-2-alessandro@0x65c.net>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
---
 hw/core/qdev.c         | 29 +++++++++++++++++++++++++++++
 hw/virtio/virtio.c     | 15 ++++++++++++---
 include/hw/qdev-core.h |  1 +
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/hw/core/qdev.c b/hw/core/qdev.c
index f600226176..fab42a7270 100644
--- a/hw/core/qdev.c
+++ b/hw/core/qdev.c
@@ -411,6 +411,35 @@ char *qdev_get_dev_path(DeviceState *dev)
     return NULL;
 }
 
+const char *qdev_get_printable_name(DeviceState *vdev)
+{
+    /*
+     * Return device ID if explicity set
+     * (e.g. -device virtio-blk-pci,id=foo)
+     * This allows users to correlate errors with their custom device
+     * names.
+     */
+    if (vdev->id) {
+        return vdev->id;
+    }
+    /*
+     * Fall back to the canonical QOM device path (eg. ID for PCI
+     * devices).
+     * This ensures the device is still uniquely and meaningfully
+     * identified.
+     */
+    const char *path = qdev_get_dev_path(vdev);
+    if (path) {
+        return path;
+    }
+
+    /*
+     * Final fallback: if all else fails, return a placeholder string.
+     * This ensures the error message always contains a valid string.
+     */
+    return "<unknown device>";
+}
+
 void qdev_add_unplug_blocker(DeviceState *dev, Error *reason)
 {
     dev->unplug_blockers = g_slist_prepend(dev->unplug_blockers, reason);
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index de89e8104a..d38aafe5eb 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -257,7 +257,10 @@ void virtio_init_region_cache(VirtIODevice *vdev, int n)
     len = address_space_cache_init(&new->desc, vdev->dma_as,
                                    addr, size, packed);
     if (len < size) {
-        virtio_error(vdev, "Cannot map desc");
+        virtio_error(vdev,
+                "Failed to map descriptor ring for device %s: "
+                "invalid guest physical address or corrupted queue setup",
+                qdev_get_printable_name(DEVICE(vdev)));
         goto err_desc;
     }
 
@@ -265,7 +268,10 @@ void virtio_init_region_cache(VirtIODevice *vdev, int n)
     len = address_space_cache_init(&new->used, vdev->dma_as,
                                    vq->vring.used, size, true);
     if (len < size) {
-        virtio_error(vdev, "Cannot map used");
+        virtio_error(vdev,
+                "Failed to map used ring for device %s: "
+                "possible guest misconfiguration or insufficient memory",
+                qdev_get_printable_name(DEVICE(vdev)));
         goto err_used;
     }
 
@@ -273,7 +279,10 @@ void virtio_init_region_cache(VirtIODevice *vdev, int n)
     len = address_space_cache_init(&new->avail, vdev->dma_as,
                                    vq->vring.avail, size, false);
     if (len < size) {
-        virtio_error(vdev, "Cannot map avail");
+        virtio_error(vdev,
+                "Failed to map avalaible ring for device %s: "
+                "possible queue misconfiguration or overlapping memory region",
+                qdev_get_printable_name(DEVICE(vdev)));
         goto err_avail;
     }
 
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index 530f3da702..a7bfb10dc7 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -1064,6 +1064,7 @@ bool qdev_set_parent_bus(DeviceState *dev, BusState *bus, Error **errp);
 extern bool qdev_hot_removed;
 
 char *qdev_get_dev_path(DeviceState *dev);
+const char *qdev_get_printable_name(DeviceState *dev);
 
 void qbus_set_hotplug_handler(BusState *bus, Object *handler);
 void qbus_set_bus_hotplug_handler(BusState *bus);

From 21659e726e3832b33d108faa1046db79eb6f611c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 24 Sep 2025 18:39:11 +0200
Subject: [PATCH 1015/2396] scripts/checkpatch: Avoid recommending legacy
 qemu_bh_new_guarded()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_bh_new_guarded() is considered legacy since commit 9c86c97f12c
("async: Add an optional reentrancy guard to the BH API"); recommend
the new API: aio_bh_new_guarded().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250924163911.51479-1-philmd@linaro.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 scripts/checkpatch.pl | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 40b6955c69..d3d75f3f13 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3198,9 +3198,9 @@ sub process {
 		if ($line =~ /\bsignal\s*\(/ && !($line =~ /SIG_(?:IGN|DFL)/)) {
 			ERROR("use sigaction to establish signal handlers; signal is not portable\n" . $herecurr);
 		}
-# recommend qemu_bh_new_guarded instead of qemu_bh_new
-        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\bqemu_bh_new\s*\(/) {
-			ERROR("use qemu_bh_new_guarded() instead of qemu_bh_new() to avoid reentrancy problems\n" . $herecurr);
+# recommend aio_bh_new_guarded instead of legacy qemu_bh_new / qemu_bh_new_guarded
+        if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\bqemu_bh_new(_guarded)?\s*\(/) {
+			ERROR("use aio_bh_new_guarded() instead of qemu_bh_new*() to avoid reentrancy problems\n" . $herecurr);
 		}
 # recommend aio_bh_new_guarded instead of aio_bh_new
         if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\baio_bh_new\s*\(/) {

From eb7abb4a719f93ddd56571bf91681044b4159399 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 6 Oct 2025 13:54:50 -0700
Subject: [PATCH 1016/2396] hw/intc/loongarch_dintc: Set class_size for
 LoongArchDINTCClass

Fixes: 4d4baab24179 ("loongarch: add a direct interrupt controller device")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/intc/loongarch_dintc.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/intc/loongarch_dintc.c b/hw/intc/loongarch_dintc.c
index dc8f7ffdf6..32bdd171c5 100644
--- a/hw/intc/loongarch_dintc.c
+++ b/hw/intc/loongarch_dintc.c
@@ -197,6 +197,7 @@ static const TypeInfo loongarch_dintc_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(LoongArchDINTCState),
     .instance_init = loongarch_dintc_init,
+    .class_size    = sizeof(LoongArchDINTCClass),
     .class_init    = loongarch_dintc_class_init,
     .interfaces    = (const InterfaceInfo[]) {
         { TYPE_HOTPLUG_HANDLER },

From 971e25424c0e2cbbea28cc7e6d09a4569ca6cb06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 17:16:23 +0200
Subject: [PATCH 1017/2396] system/ramblock: Remove obsolete comment
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This comment was added almost 5 years ago in commit 41aa4e9fd84
("ram_addr: Split RAMBlock definition"). Clearly it got ignored:

  $ git grep -l system/ramblock.h
  hw/display/virtio-gpu-udmabuf.c
  hw/hyperv/hv-balloon.c
  hw/virtio/vhost-user.c
  migration/dirtyrate.c
  migration/file.c
  migration/multifd-nocomp.c
  migration/multifd-qatzip.c
  migration/multifd-qpl.c
  migration/multifd-uadk.c
  migration/multifd-zero-page.c
  migration/multifd-zlib.c
  migration/multifd-zstd.c
  migration/multifd.c
  migration/postcopy-ram.c
  system/ram-block-attributes.c
  target/i386/kvm/tdx.c
  tests/qtest/fuzz/generic_fuzz.c

At this point it seems saner to just remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251002032812.26069-2-philmd@linaro.org>
---
 include/system/ramblock.h | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 87e847e184..8999206592 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -11,11 +11,6 @@
  *
  */
 
-/*
- * This header is for use by exec.c and memory.c ONLY.  Do not include it.
- * The functions declared here will be removed soon.
- */
-
 #ifndef SYSTEM_RAMBLOCK_H
 #define SYSTEM_RAMBLOCK_H
 

From 34f9b0ad082268e347cee5c4903940e4ea67614f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 17:12:12 +0200
Subject: [PATCH 1018/2396] system/ramblock: Move ram_block_is_pmem()
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move ramblock_is_pmem() along with the RAM Block API
exposed by the "system/ramblock.h" header. Rename as
ram_block_is_pmem() to keep API prefix consistency.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251002032812.26069-3-philmd@linaro.org>
---
 include/system/ram_addr.h | 2 --
 include/system/ramblock.h | 5 +++++
 migration/ram.c           | 3 ++-
 system/physmem.c          | 5 +++--
 4 files changed, 10 insertions(+), 5 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 15a1b1a4fa..53c0c8c385 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -99,8 +99,6 @@ static inline unsigned long int ramblock_recv_bitmap_offset(void *host_addr,
     return host_addr_offset >> TARGET_PAGE_BITS;
 }
 
-bool ramblock_is_pmem(RAMBlock *rb);
-
 /**
  * qemu_ram_alloc_from_file,
  * qemu_ram_alloc_from_fd:  Allocate a ram block from the specified backing
diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 8999206592..7059b20d91 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -108,4 +108,9 @@ void ram_block_attributes_destroy(RamBlockAttributes *attr);
 int ram_block_attributes_state_change(RamBlockAttributes *attr, uint64_t offset,
                                       uint64_t size, bool to_discard);
 
+/**
+ * ram_block_is_pmem: Whether the RAM block is of persistent memory
+ */
+bool ram_block_is_pmem(RAMBlock *rb);
+
 #endif
diff --git a/migration/ram.c b/migration/ram.c
index 9aac89638a..189931d24d 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -53,6 +53,7 @@
 #include "qemu/rcu_queue.h"
 #include "migration/colo.h"
 #include "system/cpu-throttle.h"
+#include "system/ramblock.h"
 #include "savevm.h"
 #include "qemu/iov.h"
 #include "multifd.h"
@@ -4370,7 +4371,7 @@ static bool ram_has_postcopy(void *opaque)
 {
     RAMBlock *rb;
     RAMBLOCK_FOREACH_NOT_IGNORED(rb) {
-        if (ramblock_is_pmem(rb)) {
+        if (ram_block_is_pmem(rb)) {
             info_report("Block: %s, host: %p is a nvdimm memory, postcopy"
                          "is not supported now!", rb->idstr, rb->host);
             return false;
diff --git a/system/physmem.c b/system/physmem.c
index dbb2a4e017..cb3e5fcfdc 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -43,6 +43,7 @@
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "system/qtest.h"
+#include "system/ramblock.h"
 #include "qemu/timer.h"
 #include "qemu/config-file.h"
 #include "qemu/error-report.h"
@@ -1802,7 +1803,7 @@ void qemu_ram_msync(RAMBlock *block, ram_addr_t start, ram_addr_t length)
 
 #ifdef CONFIG_LIBPMEM
     /* The lack of support for pmem should not block the sync */
-    if (ramblock_is_pmem(block)) {
+    if (ram_block_is_pmem(block)) {
         void *addr = ramblock_ptr(block, start);
         pmem_persist(addr, length);
         return;
@@ -3941,7 +3942,7 @@ int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
     return ret;
 }
 
-bool ramblock_is_pmem(RAMBlock *rb)
+bool ram_block_is_pmem(RAMBlock *rb)
 {
     return rb->flags & RAM_PMEM;
 }

From 8fe6ce40190872b4ccb4a3d601f4361b4bcdb0bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 16:25:59 +0200
Subject: [PATCH 1019/2396] system/ramblock: Move ram_block_discard_*_range()
 declarations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Keep RAM blocks API in the same header: "system/ramblock.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251002032812.26069-4-philmd@linaro.org>
---
 accel/kvm/kvm-all.c                       | 1 +
 hw/hyperv/hv-balloon-our_range_memslots.c | 1 +
 hw/virtio/virtio-balloon.c                | 1 +
 hw/virtio/virtio-mem.c                    | 1 +
 include/exec/cpu-common.h                 | 3 ---
 include/system/ramblock.h                 | 4 ++++
 6 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 9060599cd7..e3c8472340 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -32,6 +32,7 @@
 #include "system/runstate.h"
 #include "system/cpus.h"
 #include "system/accel-blocker.h"
+#include "system/ramblock.h"
 #include "accel/accel-ops.h"
 #include "qemu/bswap.h"
 #include "exec/tswap.h"
diff --git a/hw/hyperv/hv-balloon-our_range_memslots.c b/hw/hyperv/hv-balloon-our_range_memslots.c
index 1505a395cf..1fc95e1648 100644
--- a/hw/hyperv/hv-balloon-our_range_memslots.c
+++ b/hw/hyperv/hv-balloon-our_range_memslots.c
@@ -8,6 +8,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "system/ramblock.h"
 #include "hv-balloon-internal.h"
 #include "hv-balloon-our_range_memslots.h"
 #include "trace.h"
diff --git a/hw/virtio/virtio-balloon.c b/hw/virtio/virtio-balloon.c
index db787d00b3..02cdd807d7 100644
--- a/hw/virtio/virtio-balloon.c
+++ b/hw/virtio/virtio-balloon.c
@@ -23,6 +23,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/boards.h"
 #include "system/balloon.h"
+#include "system/ramblock.h"
 #include "hw/virtio/virtio-balloon.h"
 #include "system/address-spaces.h"
 #include "qapi/error.h"
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index c46f6f9c3e..1de2d3de52 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -17,6 +17,7 @@
 #include "qemu/units.h"
 #include "system/numa.h"
 #include "system/system.h"
+#include "system/ramblock.h"
 #include "system/reset.h"
 #include "system/runstate.h"
 #include "hw/virtio/virtio.h"
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index b96ac49844..df520f15d3 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -163,9 +163,6 @@ void cpu_flush_icache_range(hwaddr start, hwaddr len);
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
-int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
-int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
-                                        size_t length);
 
 /* Returns: 0 on success, -1 on error */
 int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 7059b20d91..530c5a2e4c 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -103,6 +103,10 @@ struct RamBlockAttributes {
     QLIST_HEAD(, RamDiscardListener) rdl_list;
 };
 
+int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
+int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
+                                        size_t length);
+
 RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block);
 void ram_block_attributes_destroy(RamBlockAttributes *attr);
 int ram_block_attributes_state_change(RamBlockAttributes *attr, uint64_t offset,

From fe11c4957b8120c48ed650e7c970ea004d8432f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 16:18:18 +0200
Subject: [PATCH 1020/2396] system/ramblock: Rename @start -> @offset in
 ram_block_discard_range()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename @start as @offset, since it express an offset within a RAMBlock.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251002032812.26069-5-philmd@linaro.org>
---
 include/system/ramblock.h |  6 ++++--
 system/physmem.c          | 28 ++++++++++++++--------------
 2 files changed, 18 insertions(+), 16 deletions(-)

diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 530c5a2e4c..85cceff6bc 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -103,8 +103,10 @@ struct RamBlockAttributes {
     QLIST_HEAD(, RamDiscardListener) rdl_list;
 };
 
-int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length);
-int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
+/* @offset: the offset within the RAMBlock */
+int ram_block_discard_range(RAMBlock *rb, uint64_t offset, size_t length);
+/* @offset: the offset within the RAMBlock */
+int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t offset,
                                         size_t length);
 
 RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block);
diff --git a/system/physmem.c b/system/physmem.c
index cb3e5fcfdc..a37592fd32 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3795,18 +3795,18 @@ int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
 }
 
 /*
- * Unmap pages of memory from start to start+length such that
+ * Unmap pages of memory from offset to offset+length such that
  * they a) read as 0, b) Trigger whatever fault mechanism
  * the OS provides for postcopy.
  * The pages must be unmapped by the end of the function.
  * Returns: 0 on success, none-0 on failure
  *
  */
-int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
+int ram_block_discard_range(RAMBlock *rb, uint64_t offset, size_t length)
 {
     int ret = -1;
 
-    uint8_t *host_startaddr = rb->host + start;
+    uint8_t *host_startaddr = rb->host + offset;
 
     if (!QEMU_PTR_IS_ALIGNED(host_startaddr, rb->page_size)) {
         error_report("%s: Unaligned start address: %p",
@@ -3814,7 +3814,7 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
         goto err;
     }
 
-    if ((start + length) <= rb->max_length) {
+    if ((offset + length) <= rb->max_length) {
         bool need_madvise, need_fallocate;
         if (!QEMU_IS_ALIGNED(length, rb->page_size)) {
             error_report("%s: Unaligned length: %zx", __func__, length);
@@ -3865,11 +3865,11 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
             }
 
             ret = fallocate(rb->fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-                            start + rb->fd_offset, length);
+                            offset + rb->fd_offset, length);
             if (ret) {
                 ret = -errno;
                 error_report("%s: Failed to fallocate %s:%" PRIx64 "+%" PRIx64
-                             " +%zx (%d)", __func__, rb->idstr, start,
+                             " +%zx (%d)", __func__, rb->idstr, offset,
                              rb->fd_offset, length, ret);
                 goto err;
             }
@@ -3877,7 +3877,7 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
             ret = -ENOSYS;
             error_report("%s: fallocate not available/file"
                          "%s:%" PRIx64 "+%" PRIx64 " +%zx (%d)", __func__,
-                         rb->idstr, start, rb->fd_offset, length, ret);
+                         rb->idstr, offset, rb->fd_offset, length, ret);
             goto err;
 #endif
         }
@@ -3897,13 +3897,13 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
                 ret = -errno;
                 error_report("%s: Failed to discard range "
                              "%s:%" PRIx64 " +%zx (%d)",
-                             __func__, rb->idstr, start, length, ret);
+                             __func__, rb->idstr, offset, length, ret);
                 goto err;
             }
 #else
             ret = -ENOSYS;
             error_report("%s: MADVISE not available %s:%" PRIx64 " +%zx (%d)",
-                         __func__, rb->idstr, start, length, ret);
+                         __func__, rb->idstr, offset, length, ret);
             goto err;
 #endif
         }
@@ -3911,14 +3911,14 @@ int ram_block_discard_range(RAMBlock *rb, uint64_t start, size_t length)
                                       need_madvise, need_fallocate, ret);
     } else {
         error_report("%s: Overrun block '%s' (%" PRIu64 "/%zx/" RAM_ADDR_FMT")",
-                     __func__, rb->idstr, start, length, rb->max_length);
+                     __func__, rb->idstr, offset, length, rb->max_length);
     }
 
 err:
     return ret;
 }
 
-int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
+int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t offset,
                                         size_t length)
 {
     int ret = -1;
@@ -3926,17 +3926,17 @@ int ram_block_discard_guest_memfd_range(RAMBlock *rb, uint64_t start,
 #ifdef CONFIG_FALLOCATE_PUNCH_HOLE
     /* ignore fd_offset with guest_memfd */
     ret = fallocate(rb->guest_memfd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE,
-                    start, length);
+                    offset, length);
 
     if (ret) {
         ret = -errno;
         error_report("%s: Failed to fallocate %s:%" PRIx64 " +%zx (%d)",
-                     __func__, rb->idstr, start, length, ret);
+                     __func__, rb->idstr, offset, length, ret);
     }
 #else
     ret = -ENOSYS;
     error_report("%s: fallocate not available %s:%" PRIx64 " +%zx (%d)",
-                 __func__, rb->idstr, start, length, ret);
+                 __func__, rb->idstr, offset, length, ret);
 #endif
 
     return ret;

From 6feb119d32ed1b8853e407495fad33795b9c2137 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 17:36:46 +0200
Subject: [PATCH 1021/2396] system/ramblock: Move RAMBlock helpers out of
 "system/ram_addr.h"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251002032812.26069-6-philmd@linaro.org>
---
 include/system/ram_addr.h | 11 -----------
 include/system/ramblock.h | 11 +++++++++++
 2 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 53c0c8c385..6b528338ef 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -80,17 +80,6 @@ static inline bool clear_bmap_test_and_clear(RAMBlock *rb, uint64_t page)
     return bitmap_test_and_clear(rb->clear_bmap, page >> shift, 1);
 }
 
-static inline bool offset_in_ramblock(RAMBlock *b, ram_addr_t offset)
-{
-    return (b && b->host && offset < b->used_length) ? true : false;
-}
-
-static inline void *ramblock_ptr(RAMBlock *block, ram_addr_t offset)
-{
-    assert(offset_in_ramblock(block, offset));
-    return (char *)block->host + offset;
-}
-
 static inline unsigned long int ramblock_recv_bitmap_offset(void *host_addr,
                                                             RAMBlock *rb)
 {
diff --git a/include/system/ramblock.h b/include/system/ramblock.h
index 85cceff6bc..76694fe1b5 100644
--- a/include/system/ramblock.h
+++ b/include/system/ramblock.h
@@ -119,4 +119,15 @@ int ram_block_attributes_state_change(RamBlockAttributes *attr, uint64_t offset,
  */
 bool ram_block_is_pmem(RAMBlock *rb);
 
+static inline bool offset_in_ramblock(RAMBlock *b, ram_addr_t offset)
+{
+    return b && b->host && (offset < b->used_length);
+}
+
+static inline void *ramblock_ptr(RAMBlock *block, ram_addr_t offset)
+{
+    assert(offset_in_ramblock(block, offset));
+    return (char *)block->host + offset;
+}
+
 #endif

From bb02dcf2d4c0ec446fb53516eea76087f8b7a3ed Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 22 Sep 2025 12:29:40 -0700
Subject: [PATCH 1022/2396] system/memory: Split
 address_space_write_rom_internal
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In 2dbaf58bbe7 we conditionally skipped the increment
of buf because ubsan warns incrementing NULL, and buf
is always NULL for FLUSH_CACHE.  However, the existence
of the test for NULL caused Coverity to warn that the
memcpy in the WRITE_DATA case lacked a test for NULL.

Duplicate address_space_write_rom_internal into the two
callers, dropping enum write_rom_type, and simplify.
This eliminates buf in the flush case, and eliminates
the conditional increment of buf in the write case.

Coverity: CID 1621220
Fixes: 2dbaf58bbe7 ("system/physmem: Silence warning from ubsan")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250922192940.2908002-1-richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/physmem.c | 90 ++++++++++++++++++++----------------------------
 1 file changed, 37 insertions(+), 53 deletions(-)

diff --git a/system/physmem.c b/system/physmem.c
index a37592fd32..34216fa538 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3186,63 +3186,33 @@ void cpu_physical_memory_rw(hwaddr addr, void *buf,
                      buf, len, is_write);
 }
 
-enum write_rom_type {
-    WRITE_DATA,
-    FLUSH_CACHE,
-};
-
-static inline MemTxResult address_space_write_rom_internal(AddressSpace *as,
-                                                           hwaddr addr,
-                                                           MemTxAttrs attrs,
-                                                           const void *ptr,
-                                                           hwaddr len,
-                                                           enum write_rom_type type)
-{
-    hwaddr l;
-    uint8_t *ram_ptr;
-    hwaddr addr1;
-    MemoryRegion *mr;
-    const uint8_t *buf = ptr;
-
-    RCU_READ_LOCK_GUARD();
-    while (len > 0) {
-        l = len;
-        mr = address_space_translate(as, addr, &addr1, &l, true, attrs);
-
-        if (!memory_region_supports_direct_access(mr)) {
-            l = memory_access_size(mr, l, addr1);
-        } else {
-            /* ROM/RAM case */
-            ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
-            switch (type) {
-            case WRITE_DATA:
-                memcpy(ram_ptr, buf, l);
-                invalidate_and_set_dirty(mr, addr1, l);
-                break;
-            case FLUSH_CACHE:
-                flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
-                break;
-            }
-        }
-        len -= l;
-        addr += l;
-        if (buf) {
-            buf += l;
-        }
-    }
-    return MEMTX_OK;
-}
-
 /* used for ROM loading : can write in RAM and ROM */
 MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
                                     MemTxAttrs attrs,
                                     const void *buf, hwaddr len)
 {
-    return address_space_write_rom_internal(as, addr, attrs,
-                                            buf, len, WRITE_DATA);
+    RCU_READ_LOCK_GUARD();
+    while (len > 0) {
+        hwaddr addr1, l = len;
+        MemoryRegion *mr = address_space_translate(as, addr, &addr1, &l,
+                                                   true, attrs);
+
+        if (!memory_region_supports_direct_access(mr)) {
+            l = memory_access_size(mr, l, addr1);
+        } else {
+            /* ROM/RAM case */
+            void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
+            memcpy(ram_ptr, buf, l);
+            invalidate_and_set_dirty(mr, addr1, l);
+        }
+        len -= l;
+        addr += l;
+        buf += l;
+    }
+    return MEMTX_OK;
 }
 
-void cpu_flush_icache_range(hwaddr start, hwaddr len)
+void cpu_flush_icache_range(hwaddr addr, hwaddr len)
 {
     /*
      * This function should do the same thing as an icache flush that was
@@ -3254,9 +3224,23 @@ void cpu_flush_icache_range(hwaddr start, hwaddr len)
         return;
     }
 
-    address_space_write_rom_internal(&address_space_memory,
-                                     start, MEMTXATTRS_UNSPECIFIED,
-                                     NULL, len, FLUSH_CACHE);
+    RCU_READ_LOCK_GUARD();
+    while (len > 0) {
+        hwaddr addr1, l = len;
+        MemoryRegion *mr = address_space_translate(&address_space_memory,
+                                                   addr, &addr1, &l, true,
+                                                   MEMTXATTRS_UNSPECIFIED);
+
+        if (!memory_region_supports_direct_access(mr)) {
+            l = memory_access_size(mr, l, addr1);
+        } else {
+            /* ROM/RAM case */
+            void *ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
+            flush_idcache_range((uintptr_t)ram_ptr, (uintptr_t)ram_ptr, l);
+        }
+        len -= l;
+        addr += l;
+    }
 }
 
 /*

From 7d4c9d2cb89818ef800718a4f462b34a21ee65cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 20:27:48 +0200
Subject: [PATCH 1023/2396] docs/devel/loads-stores: Stop mentioning
 cpu_physical_memory_write_rom()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the documentation after commit 3c8133f9737 ("Rename
cpu_physical_memory_write_rom() to address_space_write_rom()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-2-philmd@linaro.org>
---
 docs/devel/loads-stores.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst
index 9471bac859..f9b565da57 100644
--- a/docs/devel/loads-stores.rst
+++ b/docs/devel/loads-stores.rst
@@ -474,7 +474,7 @@ This function is intended for use by the GDB stub and similar code.
 It takes a virtual address, converts it to a physical address via
 an MMU lookup using the current settings of the specified CPU,
 and then performs the access (using ``address_space_rw`` for
-reads or ``cpu_physical_memory_write_rom`` for writes).
+reads or ``address_space_write_rom`` for writes).
 This means that if the access is a write to a ROM then this
 function will modify the contents (whereas a normal guest CPU access
 would ignore the write attempt).

From 839976e9da4b577aca284847b7e965332f2ca687 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 14:36:19 +0200
Subject: [PATCH 1024/2396] system/memory: Factor address_space_is_io() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor address_space_is_io() out of cpu_physical_memory_is_io().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-3-philmd@linaro.org>
---
 include/system/memory.h |  9 +++++++++
 system/physmem.c        | 21 ++++++++++++---------
 2 files changed, 21 insertions(+), 9 deletions(-)

diff --git a/include/system/memory.h b/include/system/memory.h
index 08daf0fc59..f222743b6f 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -3047,6 +3047,15 @@ static inline MemoryRegion *address_space_translate(AddressSpace *as,
 bool address_space_access_valid(AddressSpace *as, hwaddr addr, hwaddr len,
                                 bool is_write, MemTxAttrs attrs);
 
+/**
+ * address_space_is_io: check whether an guest physical addresses
+ *                      whithin an address space is I/O memory.
+ *
+ * @as: #AddressSpace to be accessed
+ * @addr: address within that address space
+ */
+bool address_space_is_io(AddressSpace *as, hwaddr addr);
+
 /* address_space_map: map a physical memory region into a host virtual address
  *
  * May map a subset of the requested range, given by and returned in @plen.
diff --git a/system/physmem.c b/system/physmem.c
index 34216fa538..5574c424f0 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3356,6 +3356,17 @@ bool address_space_access_valid(AddressSpace *as, hwaddr addr,
     return flatview_access_valid(fv, addr, len, is_write, attrs);
 }
 
+bool address_space_is_io(AddressSpace *as, hwaddr addr)
+{
+    MemoryRegion *mr;
+
+    RCU_READ_LOCK_GUARD();
+    mr = address_space_translate(as, addr, &addr, NULL, false,
+                                 MEMTXATTRS_UNSPECIFIED);
+
+    return !(memory_region_is_ram(mr) || memory_region_is_romd(mr));
+}
+
 static hwaddr
 flatview_extend_translation(FlatView *fv, hwaddr addr,
                             hwaddr target_len,
@@ -3752,15 +3763,7 @@ int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
 
 bool cpu_physical_memory_is_io(hwaddr phys_addr)
 {
-    MemoryRegion*mr;
-    hwaddr l = 1;
-
-    RCU_READ_LOCK_GUARD();
-    mr = address_space_translate(&address_space_memory,
-                                 phys_addr, &phys_addr, &l, false,
-                                 MEMTXATTRS_UNSPECIFIED);
-
-    return !(memory_region_is_ram(mr) || memory_region_is_romd(mr));
+    return address_space_is_io(&address_space_memory, phys_addr);
 }
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)

From 6ffaa9219616d12bc6c3e7cb26a77f7432ac0c70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:35:28 +0200
Subject: [PATCH 1025/2396] target/i386/arch_memory_mapping: Use
 address_space_memory_is_io()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since all functions have an address space argument, it is
trivial to replace cpu_physical_memory_is_io() by
address_space_memory_is_io().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-4-philmd@linaro.org>
---
 target/i386/arch_memory_mapping.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/i386/arch_memory_mapping.c b/target/i386/arch_memory_mapping.c
index a2398c2173..560f4689ab 100644
--- a/target/i386/arch_memory_mapping.c
+++ b/target/i386/arch_memory_mapping.c
@@ -35,7 +35,7 @@ static void walk_pte(MemoryMappingList *list, AddressSpace *as,
         }
 
         start_paddr = (pte & ~0xfff) & ~(0x1ULL << 63);
-        if (cpu_physical_memory_is_io(start_paddr)) {
+        if (address_space_is_io(as, start_paddr)) {
             /* I/O region */
             continue;
         }
@@ -65,7 +65,7 @@ static void walk_pte2(MemoryMappingList *list, AddressSpace *as,
         }
 
         start_paddr = pte & ~0xfff;
-        if (cpu_physical_memory_is_io(start_paddr)) {
+        if (address_space_is_io(as, start_paddr)) {
             /* I/O region */
             continue;
         }
@@ -100,7 +100,7 @@ static void walk_pde(MemoryMappingList *list, AddressSpace *as,
         if (pde & PG_PSE_MASK) {
             /* 2 MB page */
             start_paddr = (pde & ~0x1fffff) & ~(0x1ULL << 63);
-            if (cpu_physical_memory_is_io(start_paddr)) {
+            if (address_space_is_io(as, start_paddr)) {
                 /* I/O region */
                 continue;
             }
@@ -142,7 +142,7 @@ static void walk_pde2(MemoryMappingList *list, AddressSpace *as,
              */
             high_paddr = ((hwaddr)(pde & 0x1fe000) << 19);
             start_paddr = (pde & ~0x3fffff) | high_paddr;
-            if (cpu_physical_memory_is_io(start_paddr)) {
+            if (address_space_is_io(as, start_paddr)) {
                 /* I/O region */
                 continue;
             }
@@ -203,7 +203,7 @@ static void walk_pdpe(MemoryMappingList *list, AddressSpace *as,
         if (pdpe & PG_PSE_MASK) {
             /* 1 GB page */
             start_paddr = (pdpe & ~0x3fffffff) & ~(0x1ULL << 63);
-            if (cpu_physical_memory_is_io(start_paddr)) {
+            if (address_space_is_io(as, start_paddr)) {
                 /* I/O region */
                 continue;
             }

From 1e440937d699514207946c36c353a7a616f8b805 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:28:06 +0200
Subject: [PATCH 1026/2396] hw/s390x/sclp: Use address_space_memory_is_io() in
 sclp_service_call()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When cpu_address_space_init() isn't called during vCPU creation,
its single address space is the global &address_space_memory.

As s390x boards don't call cpu_address_space_init(), cpu->as
points to &address_space_memory.

We can then replace cpu_physical_memory_is_io() by the semantically
equivalent address_space_memory_is_io() call.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20251002084203.63899-5-philmd@linaro.org>
---
 hw/s390x/sclp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 9718564fa4..16057356b1 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -16,6 +16,7 @@
 #include "qemu/units.h"
 #include "qapi/error.h"
 #include "hw/boards.h"
+#include "system/memory.h"
 #include "hw/s390x/sclp.h"
 #include "hw/s390x/event-facility.h"
 #include "hw/s390x/s390-pci-bus.h"
@@ -308,7 +309,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
     if (env->psw.mask & PSW_MASK_PSTATE) {
         return -PGM_PRIVILEGED;
     }
-    if (cpu_physical_memory_is_io(sccb)) {
+    if (address_space_is_io(CPU(cpu)->as, sccb)) {
         return -PGM_ADDRESSING;
     }
     if ((sccb & ~0x1fffUL) == 0 || (sccb & ~0x1fffUL) == env->psa

From ec1eb357cb86eee74d63940154db1e1bfa86026a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:36:08 +0200
Subject: [PATCH 1027/2396] system/physmem: Remove cpu_physical_memory_is_io()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are no more uses of the legacy cpu_physical_memory_is_io()
method. Remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-6-philmd@linaro.org>
---
 include/exec/cpu-common.h | 2 --
 system/physmem.c          | 5 -----
 2 files changed, 7 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index df520f15d3..55911c1d9f 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -149,8 +149,6 @@ void *cpu_physical_memory_map(hwaddr addr,
 void cpu_physical_memory_unmap(void *buffer, hwaddr len,
                                bool is_write, hwaddr access_len);
 
-bool cpu_physical_memory_is_io(hwaddr phys_addr);
-
 /* Coalesced MMIO regions are areas where write operations can be reordered.
  * This usually implies that write operations are side-effect free.  This allows
  * batching which can make a major impact on performance when using
diff --git a/system/physmem.c b/system/physmem.c
index 5574c424f0..c8a1fda55b 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3761,11 +3761,6 @@ int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
     return 0;
 }
 
-bool cpu_physical_memory_is_io(hwaddr phys_addr)
-{
-    return address_space_is_io(&address_space_memory, phys_addr);
-}
-
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque)
 {
     RAMBlock *block;

From c2cac27dba3db3348563154f9b4b436ecde7b09a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:40:33 +0200
Subject: [PATCH 1028/2396] system/physmem: Pass address space argument to
 cpu_flush_icache_range()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename cpu_flush_icache_range() as address_space_flush_icache_range(),
passing an address space by argument. The single caller, rom_reset(),
already operates on an address space. Use it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-7-philmd@linaro.org>
---
 hw/core/loader.c          | 2 +-
 include/exec/cpu-common.h | 2 --
 include/system/memory.h   | 2 ++
 system/physmem.c          | 5 ++---
 4 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index 524af6f14a..477661a025 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -1242,7 +1242,7 @@ static void rom_reset(void *unused)
          * that the instruction cache for that new region is clear, so that the
          * CPU definitely fetches its instructions from the just written data.
          */
-        cpu_flush_icache_range(rom->addr, rom->datasize);
+        address_space_flush_icache_range(rom->as, rom->addr, rom->datasize);
 
         trace_loader_write_rom(rom->name, rom->addr, rom->datasize, rom->isrom);
     }
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 55911c1d9f..2e5aa684e9 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -156,8 +156,6 @@ void cpu_physical_memory_unmap(void *buffer, hwaddr len,
  */
 void qemu_flush_coalesced_mmio_buffer(void);
 
-void cpu_flush_icache_range(hwaddr start, hwaddr len);
-
 typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
diff --git a/include/system/memory.h b/include/system/memory.h
index f222743b6f..3bd5ffa5e0 100644
--- a/include/system/memory.h
+++ b/include/system/memory.h
@@ -2995,6 +2995,8 @@ void address_space_cache_invalidate(MemoryRegionCache *cache,
  */
 void address_space_cache_destroy(MemoryRegionCache *cache);
 
+void address_space_flush_icache_range(AddressSpace *as, hwaddr addr, hwaddr len);
+
 /* address_space_get_iotlb_entry: translate an address into an IOTLB
  * entry. Should be called from an RCU critical section.
  */
diff --git a/system/physmem.c b/system/physmem.c
index c8a1fda55b..018b8f3157 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3212,7 +3212,7 @@ MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
     return MEMTX_OK;
 }
 
-void cpu_flush_icache_range(hwaddr addr, hwaddr len)
+void address_space_flush_icache_range(AddressSpace *as, hwaddr addr, hwaddr len)
 {
     /*
      * This function should do the same thing as an icache flush that was
@@ -3227,8 +3227,7 @@ void cpu_flush_icache_range(hwaddr addr, hwaddr len)
     RCU_READ_LOCK_GUARD();
     while (len > 0) {
         hwaddr addr1, l = len;
-        MemoryRegion *mr = address_space_translate(&address_space_memory,
-                                                   addr, &addr1, &l, true,
+        MemoryRegion *mr = address_space_translate(as, addr, &addr1, &l, true,
                                                    MEMTXATTRS_UNSPECIFIED);
 
         if (!memory_region_supports_direct_access(mr)) {

From 0d4e15e8f80e77a5bf22e3620ed990331f05256d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 05:57:57 +0200
Subject: [PATCH 1029/2396] hw/s390x/sclp: Replace [cpu_physical_memory ->
 address_space]_r/w()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_physical_memory_read() and cpu_physical_memory_write() are
legacy (see commit b7ecba0f6f6), replace by address_space_read()
and address_space_write().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-Id: <20251002084203.63899-8-philmd@linaro.org>
---
 hw/s390x/sclp.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 16057356b1..51e88ba8f1 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -304,6 +304,8 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
     SCLPDeviceClass *sclp_c = SCLP_GET_CLASS(sclp);
     SCCBHeader header;
     g_autofree SCCB *work_sccb = NULL;
+    AddressSpace *as = CPU(cpu)->as;
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 
     /* first some basic checks on program checks */
     if (env->psw.mask & PSW_MASK_PSTATE) {
@@ -318,7 +320,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
     }
 
     /* the header contains the actual length of the sccb */
-    cpu_physical_memory_read(sccb, &header, sizeof(SCCBHeader));
+    address_space_read(as, sccb, attrs, &header, sizeof(SCCBHeader));
 
     /* Valid sccb sizes */
     if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) {
@@ -331,7 +333,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
      * the host has checked the values
      */
     work_sccb = g_malloc0(be16_to_cpu(header.length));
-    cpu_physical_memory_read(sccb, work_sccb, be16_to_cpu(header.length));
+    address_space_read(as, sccb, attrs, work_sccb, be16_to_cpu(header.length));
 
     if (!sclp_command_code_valid(code)) {
         work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);
@@ -345,8 +347,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
 
     sclp_c->execute(sclp, work_sccb, code);
 out_write:
-    cpu_physical_memory_write(sccb, work_sccb,
-                              be16_to_cpu(work_sccb->h.length));
+    address_space_write(as, sccb, attrs, work_sccb, be16_to_cpu(header.length));
 
     sclp_c->service_interrupt(sclp, sccb);
 

From 2fd38d9c2944efef3b96fe9047b3c0f4d4e25eb4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:43:45 +0200
Subject: [PATCH 1030/2396] target/s390x/mmu: Replace [cpu_physical_memory ->
 address_space]_rw()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When cpu_address_space_init() isn't called during vCPU creation,
its single address space is the global &address_space_memory.

As s390x boards don't call cpu_address_space_init(), cpu->as
points to &address_space_memory.

We can then replace cpu_physical_memory_rw() by the semantically
equivalent address_space_rw() call.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-9-philmd@linaro.org>
---
 target/s390x/mmu_helper.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 00946e9c0f..487c41bf93 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -23,6 +23,7 @@
 #include "kvm/kvm_s390x.h"
 #include "system/kvm.h"
 #include "system/tcg.h"
+#include "system/memory.h"
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "hw/hw.h"
@@ -522,6 +523,7 @@ int s390_cpu_pv_mem_rw(S390CPU *cpu, unsigned int offset, void *hostbuf,
 int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
                          int len, bool is_write)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     int currlen, nr_pages, i;
     target_ulong *pages;
     uint64_t tec;
@@ -542,11 +544,13 @@ int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
     if (ret) {
         trigger_access_exception(&cpu->env, ret, tec);
     } else if (hostbuf != NULL) {
+        AddressSpace *as = CPU(cpu)->as;
+
         /* Copy data by stepping through the area page by page */
         for (i = 0; i < nr_pages; i++) {
             currlen = MIN(len, TARGET_PAGE_SIZE - (laddr % TARGET_PAGE_SIZE));
-            cpu_physical_memory_rw(pages[i] | (laddr & ~TARGET_PAGE_MASK),
-                                   hostbuf, currlen, is_write);
+            address_space_rw(as, pages[i] | (laddr & ~TARGET_PAGE_MASK),
+                             attrs, hostbuf, currlen, is_write);
             laddr += currlen;
             hostbuf += currlen;
             len -= currlen;

From 04979ddde45f1064aa98317172b0a5b99b4b4d39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:51:33 +0200
Subject: [PATCH 1031/2396] target/i386/whpx: Replace legacy
 cpu_physical_memory_rw() call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Get the vCPU address space and convert the legacy
cpu_physical_memory_rw() by address_space_rw().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-10-philmd@linaro.org>
---
 target/i386/whpx/whpx-all.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 2a85168ed5..256761834c 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -788,8 +788,11 @@ static HRESULT CALLBACK whpx_emu_mmio_callback(
     void *ctx,
     WHV_EMULATOR_MEMORY_ACCESS_INFO *ma)
 {
-    cpu_physical_memory_rw(ma->GpaAddress, ma->Data, ma->AccessSize,
-                           ma->Direction);
+    CPUState *cs = (CPUState *)ctx;
+    AddressSpace *as = cpu_addressspace(cs, MEMTXATTRS_UNSPECIFIED);
+
+    address_space_rw(as, ma->GpaAddress, MEMTXATTRS_UNSPECIFIED,
+                     ma->Data, ma->AccessSize, ma->Direction);
     return S_OK;
 }
 

From 12a65afbbfd8bef09cafb1e0e7883c30ddc1c956 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:47:18 +0200
Subject: [PATCH 1032/2396] target/i386/kvm: Replace legacy
 cpu_physical_memory_rw() call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Get the vCPU address space and convert the legacy
cpu_physical_memory_rw() by address_space_rw().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-11-philmd@linaro.org>
---
 target/i386/kvm/xen-emu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/kvm/xen-emu.c b/target/i386/kvm/xen-emu.c
index 284c5ef6f6..52de019834 100644
--- a/target/i386/kvm/xen-emu.c
+++ b/target/i386/kvm/xen-emu.c
@@ -21,6 +21,7 @@
 #include "system/address-spaces.h"
 #include "xen-emu.h"
 #include "trace.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 
 #include "hw/pci/msi.h"
@@ -75,6 +76,7 @@ static bool kvm_gva_to_gpa(CPUState *cs, uint64_t gva, uint64_t *gpa,
 static int kvm_gva_rw(CPUState *cs, uint64_t gva, void *_buf, size_t sz,
                       bool is_write)
 {
+    AddressSpace *as = cpu_addressspace(cs, MEMTXATTRS_UNSPECIFIED);
     uint8_t *buf = (uint8_t *)_buf;
     uint64_t gpa;
     size_t len;
@@ -87,7 +89,7 @@ static int kvm_gva_rw(CPUState *cs, uint64_t gva, void *_buf, size_t sz,
             len = sz;
         }
 
-        cpu_physical_memory_rw(gpa, buf, len, is_write);
+        address_space_rw(as, gpa, MEMTXATTRS_UNSPECIFIED, buf, len, is_write);
 
         buf += len;
         sz -= len;

From 5699f6a4409af985d45cd67a0695a97655fec8bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:53:21 +0200
Subject: [PATCH 1033/2396] target/i386/nvmm: Inline cpu_physical_memory_rw()
 in nvmm_mem_callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-12-philmd@linaro.org>
---
 target/i386/nvmm/nvmm-all.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index ed42425167..2e442baf4b 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -15,6 +15,7 @@
 #include "accel/accel-ops.h"
 #include "system/nvmm.h"
 #include "system/cpus.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 #include "qemu/main-loop.h"
 #include "qemu/error-report.h"
@@ -516,7 +517,9 @@ nvmm_io_callback(struct nvmm_io *io)
 static void
 nvmm_mem_callback(struct nvmm_mem *mem)
 {
-    cpu_physical_memory_rw(mem->gpa, mem->data, mem->size, mem->write);
+    /* TODO: Get CPUState via mem->vcpu? */
+    address_space_rw(&address_space_memory, mem->gpa, MEMTXATTRS_UNSPECIFIED,
+                     mem->data, mem->size, mem->write);
 
     /* Needed, otherwise infinite loop. */
     current_cpu->vcpu_dirty = false;

From 94c460835df5b810309a5ae4c89f0cddddbd9f6e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:55:07 +0200
Subject: [PATCH 1034/2396] hw/xen/hvm: Inline cpu_physical_memory_rw() in
 rw_phys_req_item()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_physical_memory_rw() is legacy, replace by address_space_rw().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-13-philmd@linaro.org>
---
 hw/xen/xen-hvm-common.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 78e0bc8f64..52e2cce397 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -12,6 +12,7 @@
 #include "hw/xen/xen-bus.h"
 #include "hw/boards.h"
 #include "hw/xen/arch_hvm.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 #include "system/system.h"
 #include "system/xen.h"
@@ -279,8 +280,8 @@ static void do_outp(uint32_t addr,
  * memory, as part of the implementation of an ioreq.
  *
  * Equivalent to
- *   cpu_physical_memory_rw(addr + (req->df ? -1 : +1) * req->size * i,
- *                          val, req->size, 0/1)
+ *   address_space_rw(as, addr + (req->df ? -1 : +1) * req->size * i,
+ *                    attrs, val, req->size, 0/1)
  * except without the integer overflow problems.
  */
 static void rw_phys_req_item(hwaddr addr,
@@ -295,7 +296,8 @@ static void rw_phys_req_item(hwaddr addr,
     } else {
         addr += offset;
     }
-    cpu_physical_memory_rw(addr, val, req->size, rw);
+    address_space_rw(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+                     val, req->size, rw);
 }
 
 static inline void read_phys_req_item(hwaddr addr,

From be481476bae495191c1184b368531401a5584904 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:57:57 +0200
Subject: [PATCH 1035/2396] system/physmem: Un-inline
 cpu_physical_memory_read/write()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to remove cpu_physical_memory_rw() in a pair of commits,
and due to a cyclic dependency between "exec/cpu-common.h" and
"system/memory.h", un-inline cpu_physical_memory_read() and
cpu_physical_memory_write() as a prerequired step.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-14-philmd@linaro.org>
---
 include/exec/cpu-common.h | 12 ++----------
 system/physmem.c          | 10 ++++++++++
 2 files changed, 12 insertions(+), 10 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 2e5aa684e9..ed35a18704 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -133,16 +133,8 @@ void cpu_destroy_address_spaces(CPUState *cpu);
 
 void cpu_physical_memory_rw(hwaddr addr, void *buf,
                             hwaddr len, bool is_write);
-static inline void cpu_physical_memory_read(hwaddr addr,
-                                            void *buf, hwaddr len)
-{
-    cpu_physical_memory_rw(addr, buf, len, false);
-}
-static inline void cpu_physical_memory_write(hwaddr addr,
-                                             const void *buf, hwaddr len)
-{
-    cpu_physical_memory_rw(addr, (void *)buf, len, true);
-}
+void cpu_physical_memory_read(hwaddr addr, void *buf, hwaddr len);
+void cpu_physical_memory_write(hwaddr addr, const void *buf, hwaddr len);
 void *cpu_physical_memory_map(hwaddr addr,
                               hwaddr *plen,
                               bool is_write);
diff --git a/system/physmem.c b/system/physmem.c
index 018b8f3157..4dc66ac2c7 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3186,6 +3186,16 @@ void cpu_physical_memory_rw(hwaddr addr, void *buf,
                      buf, len, is_write);
 }
 
+void cpu_physical_memory_read(hwaddr addr, void *buf, hwaddr len)
+{
+    cpu_physical_memory_rw(addr, buf, len, false);
+}
+
+void cpu_physical_memory_write(hwaddr addr, const void *buf, hwaddr len)
+{
+    cpu_physical_memory_rw(addr, (void *)buf, len, true);
+}
+
 /* used for ROM loading : can write in RAM and ROM */
 MemTxResult address_space_write_rom(AddressSpace *as, hwaddr addr,
                                     MemTxAttrs attrs,

From 5b7502234c7ede51ab6e684b6abc64d5fee3c1a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 10:14:35 +0200
Subject: [PATCH 1036/2396] system/physmem: Avoid cpu_physical_memory_rw when
 is_write is constant
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Following the mechanical changes of commit adeefe01671 ("Avoid
cpu_physical_memory_rw() with a constant is_write argument"),
replace:

 - cpu_physical_memory_rw(, is_write=false) -> address_space_read()
 - cpu_physical_memory_rw(, is_write=true)  -> address_space_write()

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-15-philmd@linaro.org>
---
 scripts/coccinelle/exec_rw_const.cocci | 12 ------------
 system/physmem.c                       |  6 ++++--
 2 files changed, 4 insertions(+), 14 deletions(-)

diff --git a/scripts/coccinelle/exec_rw_const.cocci b/scripts/coccinelle/exec_rw_const.cocci
index 1a20296951..35ab79e6d7 100644
--- a/scripts/coccinelle/exec_rw_const.cocci
+++ b/scripts/coccinelle/exec_rw_const.cocci
@@ -62,18 +62,6 @@ symbol true, false;
 + address_space_write(E1, E2, E3, E4, E5)
 )
 
-// Avoid uses of cpu_physical_memory_rw() with a constant is_write argument.
-@@
-expression E1, E2, E3;
-@@
-(
-- cpu_physical_memory_rw(E1, E2, E3, false)
-+ cpu_physical_memory_read(E1, E2, E3)
-|
-- cpu_physical_memory_rw(E1, E2, E3, true)
-+ cpu_physical_memory_write(E1, E2, E3)
-)
-
 // Remove useless cast
 @@
 expression E1, E2, E3, E4, E5, E6;
diff --git a/system/physmem.c b/system/physmem.c
index 4dc66ac2c7..8d65b4c125 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3188,12 +3188,14 @@ void cpu_physical_memory_rw(hwaddr addr, void *buf,
 
 void cpu_physical_memory_read(hwaddr addr, void *buf, hwaddr len)
 {
-    cpu_physical_memory_rw(addr, buf, len, false);
+    address_space_read(&address_space_memory, addr,
+                       MEMTXATTRS_UNSPECIFIED, buf, len);
 }
 
 void cpu_physical_memory_write(hwaddr addr, const void *buf, hwaddr len)
 {
-    cpu_physical_memory_rw(addr, (void *)buf, len, true);
+    address_space_write(&address_space_memory, addr,
+                        MEMTXATTRS_UNSPECIFIED, buf, len);
 }
 
 /* used for ROM loading : can write in RAM and ROM */

From e98ae807c42e5c9f5089c947f7c6ef444248a946 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 15:58:17 +0200
Subject: [PATCH 1037/2396] system/physmem: Remove legacy
 cpu_physical_memory_rw()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The legacy cpu_physical_memory_rw() method is no more used,
remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-16-philmd@linaro.org>
---
 docs/devel/loads-stores.rst            |  4 +---
 include/exec/cpu-common.h              |  2 --
 scripts/coccinelle/exec_rw_const.cocci | 10 ----------
 system/physmem.c                       |  7 -------
 4 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/docs/devel/loads-stores.rst b/docs/devel/loads-stores.rst
index f9b565da57..c906c6509e 100644
--- a/docs/devel/loads-stores.rst
+++ b/docs/devel/loads-stores.rst
@@ -460,10 +460,8 @@ For new code they are better avoided:
 
 ``cpu_physical_memory_write``
 
-``cpu_physical_memory_rw``
-
 Regexes for git grep:
- - ``\<cpu_physical_memory_\(read\|write\|rw\)\>``
+ - ``\<cpu_physical_memory_\(read\|write\)\>``
 
 ``cpu_memory_rw_debug``
 ~~~~~~~~~~~~~~~~~~~~~~~
diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index ed35a18704..67e15c8e50 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -131,8 +131,6 @@ void cpu_address_space_init(CPUState *cpu, int asidx,
  */
 void cpu_destroy_address_spaces(CPUState *cpu);
 
-void cpu_physical_memory_rw(hwaddr addr, void *buf,
-                            hwaddr len, bool is_write);
 void cpu_physical_memory_read(hwaddr addr, void *buf, hwaddr len);
 void cpu_physical_memory_write(hwaddr addr, const void *buf, hwaddr len);
 void *cpu_physical_memory_map(hwaddr addr,
diff --git a/scripts/coccinelle/exec_rw_const.cocci b/scripts/coccinelle/exec_rw_const.cocci
index 35ab79e6d7..4c02c94e04 100644
--- a/scripts/coccinelle/exec_rw_const.cocci
+++ b/scripts/coccinelle/exec_rw_const.cocci
@@ -21,13 +21,6 @@ expression E1, E2, E3, E4, E5;
 + address_space_rw(E1, E2, E3, E4, E5, true)
 |
 
-- cpu_physical_memory_rw(E1, E2, E3, 0)
-+ cpu_physical_memory_rw(E1, E2, E3, false)
-|
-- cpu_physical_memory_rw(E1, E2, E3, 1)
-+ cpu_physical_memory_rw(E1, E2, E3, true)
-|
-
 - cpu_physical_memory_map(E1, E2, 0)
 + cpu_physical_memory_map(E1, E2, false)
 |
@@ -81,9 +74,6 @@ type T;
 + address_space_write_rom(E1, E2, E3, E4, E5)
 |
 
-- cpu_physical_memory_rw(E1, (T *)(E2), E3, E4)
-+ cpu_physical_memory_rw(E1, E2, E3, E4)
-|
 - cpu_physical_memory_read(E1, (T *)(E2), E3)
 + cpu_physical_memory_read(E1, E2, E3)
 |
diff --git a/system/physmem.c b/system/physmem.c
index 8d65b4c125..36f327ca94 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3179,13 +3179,6 @@ MemTxResult address_space_set(AddressSpace *as, hwaddr addr,
     return error;
 }
 
-void cpu_physical_memory_rw(hwaddr addr, void *buf,
-                            hwaddr len, bool is_write)
-{
-    address_space_rw(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
-                     buf, len, is_write);
-}
-
 void cpu_physical_memory_read(hwaddr addr, void *buf, hwaddr len)
 {
     address_space_read(&address_space_memory, addr,

From 41d5e37e0e2080e9d351f75ebd60d21e0b4e115e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 16:03:33 +0200
Subject: [PATCH 1038/2396] hw/virtio/vhost: Replace legacy
 cpu_physical_memory_*map() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use VirtIODevice::dma_as address space to convert the legacy
cpu_physical_memory_[un]map() calls to address_space_[un]map().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-17-philmd@linaro.org>
---
 hw/virtio/vhost.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index c120ef38b9..266a11514a 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -27,6 +27,7 @@
 #include "migration/blocker.h"
 #include "migration/qemu-file-types.h"
 #include "system/dma.h"
+#include "system/memory.h"
 #include "trace.h"
 
 /* enabled until disconnected backend stabilizes */
@@ -455,7 +456,8 @@ static void *vhost_memory_map(struct vhost_dev *dev, hwaddr addr,
                               hwaddr *plen, bool is_write)
 {
     if (!vhost_dev_has_iommu(dev)) {
-        return cpu_physical_memory_map(addr, plen, is_write);
+        return address_space_map(dev->vdev->dma_as, addr, plen, is_write,
+                                 MEMTXATTRS_UNSPECIFIED);
     } else {
         return (void *)(uintptr_t)addr;
     }
@@ -466,7 +468,8 @@ static void vhost_memory_unmap(struct vhost_dev *dev, void *buffer,
                                hwaddr access_len)
 {
     if (!vhost_dev_has_iommu(dev)) {
-        cpu_physical_memory_unmap(buffer, len, is_write, access_len);
+        address_space_unmap(dev->vdev->dma_as, buffer, len, is_write,
+                            access_len);
     }
 }
 

From f9f713f1b4a272826f4acc4d57483e9dd1faa3f7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 16:06:27 +0200
Subject: [PATCH 1039/2396] hw/virtio/virtio: Replace legacy
 cpu_physical_memory_map() call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Propagate VirtIODevice::dma_as to virtqueue_undo_map_desc()
in order to replace the legacy cpu_physical_memory_unmap()
call by address_space_unmap().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251002084203.63899-18-philmd@linaro.org>
---
 hw/virtio/virtio.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index be73753b59..153ee0a0cf 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -32,6 +32,7 @@
 #include "hw/virtio/virtio-access.h"
 #include "system/dma.h"
 #include "system/iothread.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 #include "virtio-qmp.h"
 
@@ -1632,7 +1633,8 @@ out:
  * virtqueue_unmap_sg() can't be used).  Assumes buffers weren't written to
  * yet.
  */
-static void virtqueue_undo_map_desc(unsigned int out_num, unsigned int in_num,
+static void virtqueue_undo_map_desc(AddressSpace *as,
+                                    unsigned int out_num, unsigned int in_num,
                                     struct iovec *iov)
 {
     unsigned int i;
@@ -1640,7 +1642,7 @@ static void virtqueue_undo_map_desc(unsigned int out_num, unsigned int in_num,
     for (i = 0; i < out_num + in_num; i++) {
         int is_write = i >= out_num;
 
-        cpu_physical_memory_unmap(iov->iov_base, iov->iov_len, is_write, 0);
+        address_space_unmap(as, iov->iov_base, iov->iov_len, is_write, 0);
         iov++;
     }
 }
@@ -1842,7 +1844,7 @@ done:
     return elem;
 
 err_undo_map:
-    virtqueue_undo_map_desc(out_num, in_num, iov);
+    virtqueue_undo_map_desc(vdev->dma_as, out_num, in_num, iov);
     goto done;
 }
 
@@ -1992,7 +1994,7 @@ done:
     return elem;
 
 err_undo_map:
-    virtqueue_undo_map_desc(out_num, in_num, iov);
+    virtqueue_undo_map_desc(vdev->dma_as, out_num, in_num, iov);
     goto done;
 }
 

From 2fb5ae9832728f766b66120fd23c7cf9db9d3ec2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 06:50:01 +0200
Subject: [PATCH 1040/2396] system/ram_addr: Remove unnecessary
 'exec/cpu-common.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Nothing in "system/ram_addr.h" requires definitions from
"exec/cpu-common.h", remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-2-philmd@linaro.org>
---
 include/system/ram_addr.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 6b528338ef..f74a0ecee5 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -29,7 +29,6 @@
 #include "qemu/rcu.h"
 
 #include "exec/hwaddr.h"
-#include "exec/cpu-common.h"
 
 extern uint64_t total_dirty_pages;
 

From a55e8ffe47ebe0d7da7b5008b5efdfa652545a7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 09:52:40 +0200
Subject: [PATCH 1041/2396] accel/kvm: Include missing 'exec/target_page.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "exec/target_page.h" header is indirectly pulled from
"system/ram_addr.h". Include it explicitly, in order to
avoid unrelated issues when refactoring "system/ram_addr.h":

  accel/kvm/kvm-all.c: In function ‘kvm_init’:
  accel/kvm/kvm-all.c:2636:12: error: ‘TARGET_PAGE_SIZE’ undeclared (first use in this function); did you mean ‘TARGET_PAGE_BITS’?
   2636 |     assert(TARGET_PAGE_SIZE <= qemu_real_host_page_size());
        |            ^~~~~~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-3-philmd@linaro.org>
---
 accel/kvm/kvm-all.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index e3c8472340..08b2b5a371 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -36,6 +36,7 @@
 #include "accel/accel-ops.h"
 #include "qemu/bswap.h"
 #include "exec/tswap.h"
+#include "exec/target_page.h"
 #include "system/memory.h"
 #include "system/ram_addr.h"
 #include "qemu/event_notifier.h"

From d08bc190a0302d1fad8ca71a3ba13c51f7337bbf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 09:54:51 +0200
Subject: [PATCH 1042/2396] hw/s390x/s390-stattrib: Include missing
 'exec/target_page.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "exec/target_page.h" header is indirectly pulled from
"system/ram_addr.h". Include it explicitly, in order to
avoid unrelated issues when refactoring "system/ram_addr.h":

  hw/s390x/s390-stattrib-kvm.c: In function ‘kvm_s390_stattrib_set_stattr’:
  hw/s390x/s390-stattrib-kvm.c:89:57: error: ‘TARGET_PAGE_SIZE’ undeclared (first use in this function); did you mean ‘TARGET_PAGE_BITS’?
     89 |     unsigned long max = s390_get_memory_limit(s390ms) / TARGET_PAGE_SIZE;
        |                                                         ^~~~~~~~~~~~~~~~
        |                                                         TARGET_PAGE_BITS

Since "system/ram_addr.h" is actually not needed, remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20251001175448.18933-4-philmd@linaro.org>
---
 hw/s390x/s390-stattrib-kvm.c | 2 +-
 hw/s390x/s390-stattrib.c     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/s390x/s390-stattrib-kvm.c b/hw/s390x/s390-stattrib-kvm.c
index e1fee361dc..73df1f600b 100644
--- a/hw/s390x/s390-stattrib-kvm.c
+++ b/hw/s390x/s390-stattrib-kvm.c
@@ -10,13 +10,13 @@
  */
 
 #include "qemu/osdep.h"
+#include "exec/target_page.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "migration/qemu-file.h"
 #include "hw/s390x/storage-attributes.h"
 #include "qemu/error-report.h"
 #include "system/kvm.h"
 #include "system/memory_mapping.h"
-#include "system/ram_addr.h"
 #include "kvm/kvm_s390x.h"
 #include "qapi/error.h"
 
diff --git a/hw/s390x/s390-stattrib.c b/hw/s390x/s390-stattrib.c
index 13a678a803..aa18537291 100644
--- a/hw/s390x/s390-stattrib.c
+++ b/hw/s390x/s390-stattrib.c
@@ -11,12 +11,12 @@
 
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "exec/target_page.h"
 #include "migration/qemu-file.h"
 #include "migration/register.h"
 #include "hw/qdev-properties.h"
 #include "hw/s390x/storage-attributes.h"
 #include "qemu/error-report.h"
-#include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qobject/qdict.h"
 #include "cpu.h"

From edd1f91d38dfc341cac02529fcd315609e959763 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 09:56:41 +0200
Subject: [PATCH 1043/2396] hw/vfio/listener: Include missing
 'exec/target_page.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "exec/target_page.h" header is indirectly pulled from
"system/ram_addr.h". Include it explicitly, in order to
avoid unrelated issues when refactoring "system/ram_addr.h":

  hw/vfio/listener.c: In function ‘vfio_ram_discard_register_listener’:
  hw/vfio/listener.c:258:28: error: implicit declaration of function ‘qemu_target_page_size’; did you mean ‘qemu_ram_pagesize’?
    258 |     int target_page_size = qemu_target_page_size();
        |                            ^~~~~~~~~~~~~~~~~~~~~

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20251001175448.18933-5-philmd@linaro.org>
---
 hw/vfio/listener.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index a2c19a3cec..b5cefc9395 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -25,6 +25,7 @@
 #endif
 #include <linux/vfio.h>
 
+#include "exec/target_page.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/pci.h"
 #include "system/address-spaces.h"

From 6204f64260b78cc4080ca7b1ee221718273d6566 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 10:33:33 +0200
Subject: [PATCH 1044/2396] target/arm/tcg/mte: Include missing
 'exec/target_page.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The "exec/target_page.h" header is indirectly pulled from
"system/ram_addr.h". Include it explicitly, in order to
avoid unrelated issues when refactoring "system/ram_addr.h":

  target/arm/tcg/mte_helper.c:815:23: error: use of undeclared identifier 'TARGET_PAGE_MASK'
    815 |     prev_page = ptr & TARGET_PAGE_MASK;
        |                       ^
  target/arm/tcg/mte_helper.c:816:29: error: use of undeclared identifier 'TARGET_PAGE_SIZE'
    816 |     next_page = prev_page + TARGET_PAGE_SIZE;
        |                             ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-6-philmd@linaro.org>
---
 target/arm/tcg/mte_helper.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 302e899287..7d80244788 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -21,6 +21,7 @@
 #include "qemu/log.h"
 #include "cpu.h"
 #include "internals.h"
+#include "exec/target_page.h"
 #include "exec/page-protection.h"
 #ifdef CONFIG_USER_ONLY
 #include "user/cpu_loop.h"

From 97480ca692e94bb790190a43bb122bd0752b8f62 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 09:20:38 +0200
Subject: [PATCH 1045/2396] hw: Remove unnecessary 'system/ram_addr.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

None of these files require definition exposed by "system/ram_addr.h",
remove its inclusion.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Jagannathan Raman <jag.raman@oracle.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251001175448.18933-7-philmd@linaro.org>
---
 hw/ppc/spapr.c                    | 1 -
 hw/ppc/spapr_caps.c               | 1 -
 hw/ppc/spapr_pci.c                | 1 -
 hw/remote/memory.c                | 1 -
 hw/remote/proxy-memory-listener.c | 1 -
 hw/s390x/s390-virtio-ccw.c        | 1 -
 hw/vfio/spapr.c                   | 1 -
 hw/virtio/virtio-mem.c            | 1 -
 8 files changed, 8 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 82fb23beaa..97ab6bebd2 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -77,7 +77,6 @@
 #include "hw/virtio/virtio-scsi.h"
 #include "hw/virtio/vhost-scsi-common.h"
 
-#include "system/ram_addr.h"
 #include "system/confidential-guest-support.h"
 #include "hw/usb.h"
 #include "qemu/config-file.h"
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index f2f5722d8a..0f94c192fd 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -27,7 +27,6 @@
 #include "qapi/error.h"
 #include "qapi/visitor.h"
 #include "system/hw_accel.h"
-#include "system/ram_addr.h"
 #include "target/ppc/cpu.h"
 #include "target/ppc/mmu-hash64.h"
 #include "cpu-models.h"
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index 1ac1185825..f9095552e8 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -34,7 +34,6 @@
 #include "hw/pci/pci_host.h"
 #include "hw/ppc/spapr.h"
 #include "hw/pci-host/spapr.h"
-#include "system/ram_addr.h"
 #include <libfdt.h>
 #include "trace.h"
 #include "qemu/error-report.h"
diff --git a/hw/remote/memory.c b/hw/remote/memory.c
index 00193a552f..8195aa5fb8 100644
--- a/hw/remote/memory.c
+++ b/hw/remote/memory.c
@@ -11,7 +11,6 @@
 #include "qemu/osdep.h"
 
 #include "hw/remote/memory.h"
-#include "system/ram_addr.h"
 #include "qapi/error.h"
 
 static void remote_sysmem_reset(void)
diff --git a/hw/remote/proxy-memory-listener.c b/hw/remote/proxy-memory-listener.c
index 30ac74961d..e1a52d24f0 100644
--- a/hw/remote/proxy-memory-listener.c
+++ b/hw/remote/proxy-memory-listener.c
@@ -12,7 +12,6 @@
 #include "qemu/range.h"
 #include "system/memory.h"
 #include "exec/cpu-common.h"
-#include "system/ram_addr.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "hw/remote/mpqemu-link.h"
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index d0c6e80cb0..ad2c48188a 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -13,7 +13,6 @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "system/ram_addr.h"
 #include "system/confidential-guest-support.h"
 #include "hw/boards.h"
 #include "hw/s390x/sclp.h"
diff --git a/hw/vfio/spapr.c b/hw/vfio/spapr.c
index 8d9d68da4e..0f23681a3f 100644
--- a/hw/vfio/spapr.c
+++ b/hw/vfio/spapr.c
@@ -17,7 +17,6 @@
 
 #include "hw/vfio/vfio-container-legacy.h"
 #include "hw/hw.h"
-#include "system/ram_addr.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "trace.h"
diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 1de2d3de52..15ba6799f2 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -25,7 +25,6 @@
 #include "hw/virtio/virtio-mem.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
-#include "system/ram_addr.h"
 #include "migration/misc.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"

From 81aef73696c37c1680412e52d0a63c9c1fdd0466 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:31:32 +0200
Subject: [PATCH 1046/2396] system/physmem: Un-inline
 cpu_physical_memory_get_dirty_flag()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

cpu_physical_memory_get_dirty() doesn't involve any CPU,
remove the 'cpu_' prefix.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-8-philmd@linaro.org>
---
 include/system/ram_addr.h | 46 +--------------------------------------
 system/physmem.c          | 44 +++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 45 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index f74a0ecee5..f8a307d1a3 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -142,46 +142,6 @@ static inline void qemu_ram_block_writeback(RAMBlock *block)
 #define DIRTY_CLIENTS_ALL     ((1 << DIRTY_MEMORY_NUM) - 1)
 #define DIRTY_CLIENTS_NOCODE  (DIRTY_CLIENTS_ALL & ~(1 << DIRTY_MEMORY_CODE))
 
-static inline bool cpu_physical_memory_get_dirty(ram_addr_t start,
-                                                 ram_addr_t length,
-                                                 unsigned client)
-{
-    DirtyMemoryBlocks *blocks;
-    unsigned long end, page;
-    unsigned long idx, offset, base;
-    bool dirty = false;
-
-    assert(client < DIRTY_MEMORY_NUM);
-
-    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
-    page = start >> TARGET_PAGE_BITS;
-
-    WITH_RCU_READ_LOCK_GUARD() {
-        blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
-
-        idx = page / DIRTY_MEMORY_BLOCK_SIZE;
-        offset = page % DIRTY_MEMORY_BLOCK_SIZE;
-        base = page - offset;
-        while (page < end) {
-            unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
-            unsigned long num = next - base;
-            unsigned long found = find_next_bit(blocks->blocks[idx],
-                                                num, offset);
-            if (found < num) {
-                dirty = true;
-                break;
-            }
-
-            page = next;
-            idx++;
-            offset = 0;
-            base += DIRTY_MEMORY_BLOCK_SIZE;
-        }
-    }
-
-    return dirty;
-}
-
 static inline bool cpu_physical_memory_all_dirty(ram_addr_t start,
                                                  ram_addr_t length,
                                                  unsigned client)
@@ -221,11 +181,7 @@ static inline bool cpu_physical_memory_all_dirty(ram_addr_t start,
     return dirty;
 }
 
-static inline bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr,
-                                                      unsigned client)
-{
-    return cpu_physical_memory_get_dirty(addr, 1, client);
-}
+bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
 
 static inline bool cpu_physical_memory_is_clean(ram_addr_t addr)
 {
diff --git a/system/physmem.c b/system/physmem.c
index 36f327ca94..3d81272f9f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -899,6 +899,50 @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length)
     }
 }
 
+static bool physical_memory_get_dirty(ram_addr_t start, ram_addr_t length,
+                                      unsigned client)
+{
+    DirtyMemoryBlocks *blocks;
+    unsigned long end, page;
+    unsigned long idx, offset, base;
+    bool dirty = false;
+
+    assert(client < DIRTY_MEMORY_NUM);
+
+    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
+    page = start >> TARGET_PAGE_BITS;
+
+    WITH_RCU_READ_LOCK_GUARD() {
+        blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
+
+        idx = page / DIRTY_MEMORY_BLOCK_SIZE;
+        offset = page % DIRTY_MEMORY_BLOCK_SIZE;
+        base = page - offset;
+        while (page < end) {
+            unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
+            unsigned long num = next - base;
+            unsigned long found = find_next_bit(blocks->blocks[idx],
+                                                num, offset);
+            if (found < num) {
+                dirty = true;
+                break;
+            }
+
+            page = next;
+            idx++;
+            offset = 0;
+            base += DIRTY_MEMORY_BLOCK_SIZE;
+        }
+    }
+
+    return dirty;
+}
+
+bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client)
+{
+    return physical_memory_get_dirty(addr, 1, client);
+}
+
 /* Note: start and end must be within the same ram block.  */
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,

From 3a0539afcbdf83aa919e32a36107bbe357ae9ef2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:33:02 +0200
Subject: [PATCH 1047/2396] system/physmem: Un-inline
 cpu_physical_memory_is_clean()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-9-philmd@linaro.org>
---
 include/system/ram_addr.h | 9 +--------
 system/physmem.c          | 9 +++++++++
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index f8a307d1a3..cdf25c315b 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -183,14 +183,7 @@ static inline bool cpu_physical_memory_all_dirty(ram_addr_t start,
 
 bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
 
-static inline bool cpu_physical_memory_is_clean(ram_addr_t addr)
-{
-    bool vga = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_VGA);
-    bool code = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_CODE);
-    bool migration =
-        cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_MIGRATION);
-    return !(vga && code && migration);
-}
+bool cpu_physical_memory_is_clean(ram_addr_t addr);
 
 static inline uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
                                                                ram_addr_t length,
diff --git a/system/physmem.c b/system/physmem.c
index 3d81272f9f..e555b3196f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -943,6 +943,15 @@ bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client)
     return physical_memory_get_dirty(addr, 1, client);
 }
 
+bool cpu_physical_memory_is_clean(ram_addr_t addr)
+{
+    bool vga = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_VGA);
+    bool code = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_CODE);
+    bool migration =
+        cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_MIGRATION);
+    return !(vga && code && migration);
+}
+
 /* Note: start and end must be within the same ram block.  */
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,

From 84a8e6399bc06550e41f5b2f7b94e4a2213b2ebc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:35:49 +0200
Subject: [PATCH 1048/2396] system/physmem: Un-inline
 cpu_physical_memory_range_includes_clean()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

cpu_physical_memory_all_dirty() doesn't involve any CPU,
remove the 'cpu_' prefix.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-10-philmd@linaro.org>
---
 include/system/ram_addr.h | 62 ++-------------------------------------
 system/physmem.c          | 60 +++++++++++++++++++++++++++++++++++++
 2 files changed, 63 insertions(+), 59 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index cdf25c315b..2dcca260b2 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -142,69 +142,13 @@ static inline void qemu_ram_block_writeback(RAMBlock *block)
 #define DIRTY_CLIENTS_ALL     ((1 << DIRTY_MEMORY_NUM) - 1)
 #define DIRTY_CLIENTS_NOCODE  (DIRTY_CLIENTS_ALL & ~(1 << DIRTY_MEMORY_CODE))
 
-static inline bool cpu_physical_memory_all_dirty(ram_addr_t start,
-                                                 ram_addr_t length,
-                                                 unsigned client)
-{
-    DirtyMemoryBlocks *blocks;
-    unsigned long end, page;
-    unsigned long idx, offset, base;
-    bool dirty = true;
-
-    assert(client < DIRTY_MEMORY_NUM);
-
-    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
-    page = start >> TARGET_PAGE_BITS;
-
-    RCU_READ_LOCK_GUARD();
-
-    blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
-
-    idx = page / DIRTY_MEMORY_BLOCK_SIZE;
-    offset = page % DIRTY_MEMORY_BLOCK_SIZE;
-    base = page - offset;
-    while (page < end) {
-        unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
-        unsigned long num = next - base;
-        unsigned long found = find_next_zero_bit(blocks->blocks[idx], num, offset);
-        if (found < num) {
-            dirty = false;
-            break;
-        }
-
-        page = next;
-        idx++;
-        offset = 0;
-        base += DIRTY_MEMORY_BLOCK_SIZE;
-    }
-
-    return dirty;
-}
-
 bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
 
 bool cpu_physical_memory_is_clean(ram_addr_t addr);
 
-static inline uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
-                                                               ram_addr_t length,
-                                                               uint8_t mask)
-{
-    uint8_t ret = 0;
-
-    if (mask & (1 << DIRTY_MEMORY_VGA) &&
-        !cpu_physical_memory_all_dirty(start, length, DIRTY_MEMORY_VGA)) {
-        ret |= (1 << DIRTY_MEMORY_VGA);
-    }
-    if (mask & (1 << DIRTY_MEMORY_CODE) &&
-        !cpu_physical_memory_all_dirty(start, length, DIRTY_MEMORY_CODE)) {
-        ret |= (1 << DIRTY_MEMORY_CODE);
-    }
-    if (mask & (1 << DIRTY_MEMORY_MIGRATION) &&
-        !cpu_physical_memory_all_dirty(start, length, DIRTY_MEMORY_MIGRATION)) {
-        ret |= (1 << DIRTY_MEMORY_MIGRATION);
-    }
-    return ret;
-}
+uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
+                                                 ram_addr_t length,
+                                                 uint8_t mask);
 
 static inline void cpu_physical_memory_set_dirty_flag(ram_addr_t addr,
                                                       unsigned client)
diff --git a/system/physmem.c b/system/physmem.c
index e555b3196f..144fd7303b 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -952,6 +952,66 @@ bool cpu_physical_memory_is_clean(ram_addr_t addr)
     return !(vga && code && migration);
 }
 
+static bool physical_memory_all_dirty(ram_addr_t start, ram_addr_t length,
+                                      unsigned client)
+{
+    DirtyMemoryBlocks *blocks;
+    unsigned long end, page;
+    unsigned long idx, offset, base;
+    bool dirty = true;
+
+    assert(client < DIRTY_MEMORY_NUM);
+
+    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
+    page = start >> TARGET_PAGE_BITS;
+
+    RCU_READ_LOCK_GUARD();
+
+    blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
+
+    idx = page / DIRTY_MEMORY_BLOCK_SIZE;
+    offset = page % DIRTY_MEMORY_BLOCK_SIZE;
+    base = page - offset;
+    while (page < end) {
+        unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
+        unsigned long num = next - base;
+        unsigned long found = find_next_zero_bit(blocks->blocks[idx],
+                                                 num, offset);
+        if (found < num) {
+            dirty = false;
+            break;
+        }
+
+        page = next;
+        idx++;
+        offset = 0;
+        base += DIRTY_MEMORY_BLOCK_SIZE;
+    }
+
+    return dirty;
+}
+
+uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
+                                                 ram_addr_t length,
+                                                 uint8_t mask)
+{
+    uint8_t ret = 0;
+
+    if (mask & (1 << DIRTY_MEMORY_VGA) &&
+        !physical_memory_all_dirty(start, length, DIRTY_MEMORY_VGA)) {
+        ret |= (1 << DIRTY_MEMORY_VGA);
+    }
+    if (mask & (1 << DIRTY_MEMORY_CODE) &&
+        !physical_memory_all_dirty(start, length, DIRTY_MEMORY_CODE)) {
+        ret |= (1 << DIRTY_MEMORY_CODE);
+    }
+    if (mask & (1 << DIRTY_MEMORY_MIGRATION) &&
+        !physical_memory_all_dirty(start, length, DIRTY_MEMORY_MIGRATION)) {
+        ret |= (1 << DIRTY_MEMORY_MIGRATION);
+    }
+    return ret;
+}
+
 /* Note: start and end must be within the same ram block.  */
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,

From 62c889eb7dfd4da5e30e9496496917bad53851fe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:38:52 +0200
Subject: [PATCH 1049/2396] system/physmem: Un-inline
 cpu_physical_memory_set_dirty_flag()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-11-philmd@linaro.org>
---
 include/system/ram_addr.h | 19 +------------------
 system/physmem.c          | 18 ++++++++++++++++++
 2 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 2dcca260b2..81d26eb149 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -150,24 +150,7 @@ uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
                                                  ram_addr_t length,
                                                  uint8_t mask);
 
-static inline void cpu_physical_memory_set_dirty_flag(ram_addr_t addr,
-                                                      unsigned client)
-{
-    unsigned long page, idx, offset;
-    DirtyMemoryBlocks *blocks;
-
-    assert(client < DIRTY_MEMORY_NUM);
-
-    page = addr >> TARGET_PAGE_BITS;
-    idx = page / DIRTY_MEMORY_BLOCK_SIZE;
-    offset = page % DIRTY_MEMORY_BLOCK_SIZE;
-
-    RCU_READ_LOCK_GUARD();
-
-    blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
-
-    set_bit_atomic(offset, blocks->blocks[idx]);
-}
+void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
 
 static inline void cpu_physical_memory_set_dirty_range(ram_addr_t start,
                                                        ram_addr_t length,
diff --git a/system/physmem.c b/system/physmem.c
index 144fd7303b..50235e8853 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1012,6 +1012,24 @@ uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
     return ret;
 }
 
+void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client)
+{
+    unsigned long page, idx, offset;
+    DirtyMemoryBlocks *blocks;
+
+    assert(client < DIRTY_MEMORY_NUM);
+
+    page = addr >> TARGET_PAGE_BITS;
+    idx = page / DIRTY_MEMORY_BLOCK_SIZE;
+    offset = page % DIRTY_MEMORY_BLOCK_SIZE;
+
+    RCU_READ_LOCK_GUARD();
+
+    blocks = qatomic_rcu_read(&ram_list.dirty_memory[client]);
+
+    set_bit_atomic(offset, blocks->blocks[idx]);
+}
+
 /* Note: start and end must be within the same ram block.  */
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,

From 6290580e9b712d5cbaa1cc2a314d07cd4a6c283d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:40:29 +0200
Subject: [PATCH 1050/2396] system/physmem: Un-inline
 cpu_physical_memory_set_dirty_range()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-12-philmd@linaro.org>
---
 include/system/ram_addr.h | 53 ++-------------------------------------
 system/physmem.c          | 51 +++++++++++++++++++++++++++++++++++++
 2 files changed, 53 insertions(+), 51 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 81d26eb149..ca5ae84244 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -152,57 +152,8 @@ uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
 
 void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
 
-static inline void cpu_physical_memory_set_dirty_range(ram_addr_t start,
-                                                       ram_addr_t length,
-                                                       uint8_t mask)
-{
-    DirtyMemoryBlocks *blocks[DIRTY_MEMORY_NUM];
-    unsigned long end, page;
-    unsigned long idx, offset, base;
-    int i;
-
-    if (!mask && !xen_enabled()) {
-        return;
-    }
-
-    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
-    page = start >> TARGET_PAGE_BITS;
-
-    WITH_RCU_READ_LOCK_GUARD() {
-        for (i = 0; i < DIRTY_MEMORY_NUM; i++) {
-            blocks[i] = qatomic_rcu_read(&ram_list.dirty_memory[i]);
-        }
-
-        idx = page / DIRTY_MEMORY_BLOCK_SIZE;
-        offset = page % DIRTY_MEMORY_BLOCK_SIZE;
-        base = page - offset;
-        while (page < end) {
-            unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
-
-            if (likely(mask & (1 << DIRTY_MEMORY_MIGRATION))) {
-                bitmap_set_atomic(blocks[DIRTY_MEMORY_MIGRATION]->blocks[idx],
-                                  offset, next - page);
-            }
-            if (unlikely(mask & (1 << DIRTY_MEMORY_VGA))) {
-                bitmap_set_atomic(blocks[DIRTY_MEMORY_VGA]->blocks[idx],
-                                  offset, next - page);
-            }
-            if (unlikely(mask & (1 << DIRTY_MEMORY_CODE))) {
-                bitmap_set_atomic(blocks[DIRTY_MEMORY_CODE]->blocks[idx],
-                                  offset, next - page);
-            }
-
-            page = next;
-            idx++;
-            offset = 0;
-            base += DIRTY_MEMORY_BLOCK_SIZE;
-        }
-    }
-
-    if (xen_enabled()) {
-        xen_hvm_modified_memory(start, length);
-    }
-}
+void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
+                                         uint8_t mask);
 
 #if !defined(_WIN32)
 
diff --git a/system/physmem.c b/system/physmem.c
index 50235e8853..bcd9d6fb8f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1030,6 +1030,57 @@ void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client)
     set_bit_atomic(offset, blocks->blocks[idx]);
 }
 
+void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
+                                         uint8_t mask)
+{
+    DirtyMemoryBlocks *blocks[DIRTY_MEMORY_NUM];
+    unsigned long end, page;
+    unsigned long idx, offset, base;
+    int i;
+
+    if (!mask && !xen_enabled()) {
+        return;
+    }
+
+    end = TARGET_PAGE_ALIGN(start + length) >> TARGET_PAGE_BITS;
+    page = start >> TARGET_PAGE_BITS;
+
+    WITH_RCU_READ_LOCK_GUARD() {
+        for (i = 0; i < DIRTY_MEMORY_NUM; i++) {
+            blocks[i] = qatomic_rcu_read(&ram_list.dirty_memory[i]);
+        }
+
+        idx = page / DIRTY_MEMORY_BLOCK_SIZE;
+        offset = page % DIRTY_MEMORY_BLOCK_SIZE;
+        base = page - offset;
+        while (page < end) {
+            unsigned long next = MIN(end, base + DIRTY_MEMORY_BLOCK_SIZE);
+
+            if (likely(mask & (1 << DIRTY_MEMORY_MIGRATION))) {
+                bitmap_set_atomic(blocks[DIRTY_MEMORY_MIGRATION]->blocks[idx],
+                                  offset, next - page);
+            }
+            if (unlikely(mask & (1 << DIRTY_MEMORY_VGA))) {
+                bitmap_set_atomic(blocks[DIRTY_MEMORY_VGA]->blocks[idx],
+                                  offset, next - page);
+            }
+            if (unlikely(mask & (1 << DIRTY_MEMORY_CODE))) {
+                bitmap_set_atomic(blocks[DIRTY_MEMORY_CODE]->blocks[idx],
+                                  offset, next - page);
+            }
+
+            page = next;
+            idx++;
+            offset = 0;
+            base += DIRTY_MEMORY_BLOCK_SIZE;
+        }
+    }
+
+    if (xen_enabled()) {
+        xen_hvm_modified_memory(start, length);
+    }
+}
+
 /* Note: start and end must be within the same ram block.  */
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,

From 3037def8b8e91ed3ce3f711dc646e07e0ef894dc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 19:06:19 +0200
Subject: [PATCH 1051/2396] system/physmem: Remove _WIN32 #ifdef'ry
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit fb3ecb7ea40 ("exec: Exclude non portable function for
MinGW") guarded cpu_physical_memory_set_dirty_lebitmap() within
_WIN32 #ifdef'ry because of the non-portable ffsl() call, which
was later replaced for the same reason by commit 7224f66ec3c
("exec: replace ffsl with ctzl"); we don't need that anymore.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-13-philmd@linaro.org>
---
 include/system/ram_addr.h | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index ca5ae84244..fbf57a05b2 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -155,8 +155,6 @@ void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
 void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
                                          uint8_t mask);
 
-#if !defined(_WIN32)
-
 /*
  * Contrary to cpu_physical_memory_sync_dirty_bitmap() this function returns
  * the number of dirty pages in @bitmap passed as argument. On the other hand,
@@ -265,7 +263,6 @@ uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
 
     return num_dirty;
 }
-#endif /* not _WIN32 */
 
 static inline void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start,
                                                           ram_addr_t length)

From 198c5f707f43d970b22e9b52a0ec573aa595ef35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:43:30 +0200
Subject: [PATCH 1052/2396] system/physmem: Un-inline
 cpu_physical_memory_set_dirty_lebitmap()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

Remove the now unneeded "system/xen.h" header.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-14-philmd@linaro.org>
---
 include/system/ram_addr.h | 102 +------------------------------------
 system/physmem.c          | 103 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 104 insertions(+), 101 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index fbf57a05b2..49e9a9c66d 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -19,7 +19,6 @@
 #ifndef SYSTEM_RAM_ADDR_H
 #define SYSTEM_RAM_ADDR_H
 
-#include "system/xen.h"
 #include "system/tcg.h"
 #include "exec/cputlb.h"
 #include "exec/ramlist.h"
@@ -161,108 +160,9 @@ void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
  * cpu_physical_memory_sync_dirty_bitmap() returns newly dirtied pages that
  * weren't set in the global migration bitmap.
  */
-static inline
 uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
                                                 ram_addr_t start,
-                                                ram_addr_t pages)
-{
-    unsigned long i, j;
-    unsigned long page_number, c, nbits;
-    hwaddr addr;
-    ram_addr_t ram_addr;
-    uint64_t num_dirty = 0;
-    unsigned long len = (pages + HOST_LONG_BITS - 1) / HOST_LONG_BITS;
-    unsigned long hpratio = qemu_real_host_page_size() / TARGET_PAGE_SIZE;
-    unsigned long page = BIT_WORD(start >> TARGET_PAGE_BITS);
-
-    /* start address is aligned at the start of a word? */
-    if ((((page * BITS_PER_LONG) << TARGET_PAGE_BITS) == start) &&
-        (hpratio == 1)) {
-        unsigned long **blocks[DIRTY_MEMORY_NUM];
-        unsigned long idx;
-        unsigned long offset;
-        long k;
-        long nr = BITS_TO_LONGS(pages);
-
-        idx = (start >> TARGET_PAGE_BITS) / DIRTY_MEMORY_BLOCK_SIZE;
-        offset = BIT_WORD((start >> TARGET_PAGE_BITS) %
-                          DIRTY_MEMORY_BLOCK_SIZE);
-
-        WITH_RCU_READ_LOCK_GUARD() {
-            for (i = 0; i < DIRTY_MEMORY_NUM; i++) {
-                blocks[i] =
-                    qatomic_rcu_read(&ram_list.dirty_memory[i])->blocks;
-            }
-
-            for (k = 0; k < nr; k++) {
-                if (bitmap[k]) {
-                    unsigned long temp = leul_to_cpu(bitmap[k]);
-
-                    nbits = ctpopl(temp);
-                    qatomic_or(&blocks[DIRTY_MEMORY_VGA][idx][offset], temp);
-
-                    if (global_dirty_tracking) {
-                        qatomic_or(
-                                &blocks[DIRTY_MEMORY_MIGRATION][idx][offset],
-                                temp);
-                        if (unlikely(
-                            global_dirty_tracking & GLOBAL_DIRTY_DIRTY_RATE)) {
-                            total_dirty_pages += nbits;
-                        }
-                    }
-
-                    num_dirty += nbits;
-
-                    if (tcg_enabled()) {
-                        qatomic_or(&blocks[DIRTY_MEMORY_CODE][idx][offset],
-                                   temp);
-                    }
-                }
-
-                if (++offset >= BITS_TO_LONGS(DIRTY_MEMORY_BLOCK_SIZE)) {
-                    offset = 0;
-                    idx++;
-                }
-            }
-        }
-
-        if (xen_enabled()) {
-            xen_hvm_modified_memory(start, pages << TARGET_PAGE_BITS);
-        }
-    } else {
-        uint8_t clients = tcg_enabled() ? DIRTY_CLIENTS_ALL : DIRTY_CLIENTS_NOCODE;
-
-        if (!global_dirty_tracking) {
-            clients &= ~(1 << DIRTY_MEMORY_MIGRATION);
-        }
-
-        /*
-         * bitmap-traveling is faster than memory-traveling (for addr...)
-         * especially when most of the memory is not dirty.
-         */
-        for (i = 0; i < len; i++) {
-            if (bitmap[i] != 0) {
-                c = leul_to_cpu(bitmap[i]);
-                nbits = ctpopl(c);
-                if (unlikely(global_dirty_tracking & GLOBAL_DIRTY_DIRTY_RATE)) {
-                    total_dirty_pages += nbits;
-                }
-                num_dirty += nbits;
-                do {
-                    j = ctzl(c);
-                    c &= ~(1ul << j);
-                    page_number = (i * HOST_LONG_BITS + j) * hpratio;
-                    addr = page_number * TARGET_PAGE_SIZE;
-                    ram_addr = start + addr;
-                    cpu_physical_memory_set_dirty_range(ram_addr,
-                                       TARGET_PAGE_SIZE * hpratio, clients);
-                } while (c != 0);
-            }
-        }
-    }
-
-    return num_dirty;
-}
+                                                ram_addr_t pages);
 
 static inline void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start,
                                                           ram_addr_t length)
diff --git a/system/physmem.c b/system/physmem.c
index bcd9d6fb8f..e85552483a 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1205,6 +1205,109 @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
     return false;
 }
 
+uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
+                                                ram_addr_t start,
+                                                ram_addr_t pages)
+{
+    unsigned long i, j;
+    unsigned long page_number, c, nbits;
+    hwaddr addr;
+    ram_addr_t ram_addr;
+    uint64_t num_dirty = 0;
+    unsigned long len = (pages + HOST_LONG_BITS - 1) / HOST_LONG_BITS;
+    unsigned long hpratio = qemu_real_host_page_size() / TARGET_PAGE_SIZE;
+    unsigned long page = BIT_WORD(start >> TARGET_PAGE_BITS);
+
+    /* start address is aligned at the start of a word? */
+    if ((((page * BITS_PER_LONG) << TARGET_PAGE_BITS) == start) &&
+        (hpratio == 1)) {
+        unsigned long **blocks[DIRTY_MEMORY_NUM];
+        unsigned long idx;
+        unsigned long offset;
+        long k;
+        long nr = BITS_TO_LONGS(pages);
+
+        idx = (start >> TARGET_PAGE_BITS) / DIRTY_MEMORY_BLOCK_SIZE;
+        offset = BIT_WORD((start >> TARGET_PAGE_BITS) %
+                          DIRTY_MEMORY_BLOCK_SIZE);
+
+        WITH_RCU_READ_LOCK_GUARD() {
+            for (i = 0; i < DIRTY_MEMORY_NUM; i++) {
+                blocks[i] =
+                    qatomic_rcu_read(&ram_list.dirty_memory[i])->blocks;
+            }
+
+            for (k = 0; k < nr; k++) {
+                if (bitmap[k]) {
+                    unsigned long temp = leul_to_cpu(bitmap[k]);
+
+                    nbits = ctpopl(temp);
+                    qatomic_or(&blocks[DIRTY_MEMORY_VGA][idx][offset], temp);
+
+                    if (global_dirty_tracking) {
+                        qatomic_or(
+                                &blocks[DIRTY_MEMORY_MIGRATION][idx][offset],
+                                temp);
+                        if (unlikely(
+                            global_dirty_tracking & GLOBAL_DIRTY_DIRTY_RATE)) {
+                            total_dirty_pages += nbits;
+                        }
+                    }
+
+                    num_dirty += nbits;
+
+                    if (tcg_enabled()) {
+                        qatomic_or(&blocks[DIRTY_MEMORY_CODE][idx][offset],
+                                   temp);
+                    }
+                }
+
+                if (++offset >= BITS_TO_LONGS(DIRTY_MEMORY_BLOCK_SIZE)) {
+                    offset = 0;
+                    idx++;
+                }
+            }
+        }
+
+        if (xen_enabled()) {
+            xen_hvm_modified_memory(start, pages << TARGET_PAGE_BITS);
+        }
+    } else {
+        uint8_t clients = tcg_enabled() ? DIRTY_CLIENTS_ALL
+                                        : DIRTY_CLIENTS_NOCODE;
+
+        if (!global_dirty_tracking) {
+            clients &= ~(1 << DIRTY_MEMORY_MIGRATION);
+        }
+
+        /*
+         * bitmap-traveling is faster than memory-traveling (for addr...)
+         * especially when most of the memory is not dirty.
+         */
+        for (i = 0; i < len; i++) {
+            if (bitmap[i] != 0) {
+                c = leul_to_cpu(bitmap[i]);
+                nbits = ctpopl(c);
+                if (unlikely(global_dirty_tracking & GLOBAL_DIRTY_DIRTY_RATE)) {
+                    total_dirty_pages += nbits;
+                }
+                num_dirty += nbits;
+                do {
+                    j = ctzl(c);
+                    c &= ~(1ul << j);
+                    page_number = (i * HOST_LONG_BITS + j) * hpratio;
+                    addr = page_number * TARGET_PAGE_SIZE;
+                    ram_addr = start + addr;
+                    cpu_physical_memory_set_dirty_range(ram_addr,
+                                       TARGET_PAGE_SIZE * hpratio, clients);
+                } while (c != 0);
+            }
+        }
+    }
+
+    return num_dirty;
+}
+
 static int subpage_register(subpage_t *mmio, uint32_t start, uint32_t end,
                             uint16_t section);
 static subpage_t *subpage_init(FlatView *fv, hwaddr base);

From 57f3d859bf947cdef418dec14445b1f8935f2d20 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:53:07 +0200
Subject: [PATCH 1053/2396] system/physmem: Un-inline
 cpu_physical_memory_dirty_bits_cleared()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid maintaining large functions in header, rely on the
linker to optimize at linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-15-philmd@linaro.org>
---
 include/system/ram_addr.h | 10 +---------
 system/physmem.c          |  7 +++++++
 2 files changed, 8 insertions(+), 9 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 49e9a9c66d..54b5f5ec16 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -19,8 +19,6 @@
 #ifndef SYSTEM_RAM_ADDR_H
 #define SYSTEM_RAM_ADDR_H
 
-#include "system/tcg.h"
-#include "exec/cputlb.h"
 #include "exec/ramlist.h"
 #include "system/ramblock.h"
 #include "system/memory.h"
@@ -164,14 +162,8 @@ uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
                                                 ram_addr_t start,
                                                 ram_addr_t pages);
 
-static inline void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start,
-                                                          ram_addr_t length)
-{
-    if (tcg_enabled()) {
-        tlb_reset_dirty_range_all(start, length);
-    }
+void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length);
 
-}
 bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,
                                               unsigned client);
diff --git a/system/physmem.c b/system/physmem.c
index e85552483a..24b654fb3f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -899,6 +899,13 @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length)
     }
 }
 
+void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length)
+{
+    if (tcg_enabled()) {
+        tlb_reset_dirty_range_all(start, length);
+    }
+}
+
 static bool physical_memory_get_dirty(ram_addr_t start, ram_addr_t length,
                                       unsigned client)
 {

From 1085a44ebb55346b30888ce1b7b18565a719f78b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:55:15 +0200
Subject: [PATCH 1054/2396] system/physmem: Reduce
 cpu_physical_memory_clear_dirty_range() scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_physical_memory_clear_dirty_range() is now only called within
system/physmem.c, by qemu_ram_resize(). Reduce its scope by making
it internal to this file. Since it doesn't involve any CPU, remove
the 'cpu_' prefix. As it operates on a range, rename @start as @addr.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-16-philmd@linaro.org>
---
 include/system/ram_addr.h | 9 ---------
 system/physmem.c          | 9 ++++++++-
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 54b5f5ec16..cafd258580 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -175,15 +175,6 @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
                                             ram_addr_t start,
                                             ram_addr_t length);
 
-static inline void cpu_physical_memory_clear_dirty_range(ram_addr_t start,
-                                                         ram_addr_t length)
-{
-    cpu_physical_memory_test_and_clear_dirty(start, length, DIRTY_MEMORY_MIGRATION);
-    cpu_physical_memory_test_and_clear_dirty(start, length, DIRTY_MEMORY_VGA);
-    cpu_physical_memory_test_and_clear_dirty(start, length, DIRTY_MEMORY_CODE);
-}
-
-
 /* Called with RCU critical section */
 static inline
 uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
diff --git a/system/physmem.c b/system/physmem.c
index 24b654fb3f..079bdbff30 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -1137,6 +1137,13 @@ bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
     return dirty;
 }
 
+static void physical_memory_clear_dirty_range(ram_addr_t addr, ram_addr_t length)
+{
+    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_MIGRATION);
+    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_VGA);
+    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_CODE);
+}
+
 DirtyBitmapSnapshot *cpu_physical_memory_snapshot_and_clear_dirty
     (MemoryRegion *mr, hwaddr offset, hwaddr length, unsigned client)
 {
@@ -2071,7 +2078,7 @@ int qemu_ram_resize(RAMBlock *block, ram_addr_t newsize, Error **errp)
         ram_block_notify_resize(block->host, oldsize, newsize);
     }
 
-    cpu_physical_memory_clear_dirty_range(block->offset, block->used_length);
+    physical_memory_clear_dirty_range(block->offset, block->used_length);
     block->used_length = newsize;
     cpu_physical_memory_set_dirty_range(block->offset, block->used_length,
                                         DIRTY_CLIENTS_ALL);

From 8bf3a883088b65430f58aeb3d2d1db87f01eabec Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 29 Sep 2025 13:58:03 +0200
Subject: [PATCH 1055/2396] system/physmem: Reduce
 cpu_physical_memory_sync_dirty_bitmap() scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_physical_memory_sync_dirty_bitmap() is now only called within
system/physmem.c, by ramblock_sync_dirty_bitmap(). Reduce its scope
by making it internal to this file. Since it doesn't involve any CPU,
remove the 'cpu_' prefix.
Remove the now unneeded "qemu/rcu.h" and "system/memory.h" headers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251001175448.18933-17-philmd@linaro.org>
---
 include/system/ram_addr.h | 79 ---------------------------------------
 migration/ram.c           | 77 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 76 insertions(+), 80 deletions(-)

diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index cafd258580..d2d088bbea 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -21,10 +21,7 @@
 
 #include "exec/ramlist.h"
 #include "system/ramblock.h"
-#include "system/memory.h"
 #include "exec/target_page.h"
-#include "qemu/rcu.h"
-
 #include "exec/hwaddr.h"
 
 extern uint64_t total_dirty_pages;
@@ -175,80 +172,4 @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
                                             ram_addr_t start,
                                             ram_addr_t length);
 
-/* Called with RCU critical section */
-static inline
-uint64_t cpu_physical_memory_sync_dirty_bitmap(RAMBlock *rb,
-                                               ram_addr_t start,
-                                               ram_addr_t length)
-{
-    ram_addr_t addr;
-    unsigned long word = BIT_WORD((start + rb->offset) >> TARGET_PAGE_BITS);
-    uint64_t num_dirty = 0;
-    unsigned long *dest = rb->bmap;
-
-    /* start address and length is aligned at the start of a word? */
-    if (((word * BITS_PER_LONG) << TARGET_PAGE_BITS) ==
-         (start + rb->offset) &&
-        !(length & ((BITS_PER_LONG << TARGET_PAGE_BITS) - 1))) {
-        int k;
-        int nr = BITS_TO_LONGS(length >> TARGET_PAGE_BITS);
-        unsigned long * const *src;
-        unsigned long idx = (word * BITS_PER_LONG) / DIRTY_MEMORY_BLOCK_SIZE;
-        unsigned long offset = BIT_WORD((word * BITS_PER_LONG) %
-                                        DIRTY_MEMORY_BLOCK_SIZE);
-        unsigned long page = BIT_WORD(start >> TARGET_PAGE_BITS);
-
-        src = qatomic_rcu_read(
-                &ram_list.dirty_memory[DIRTY_MEMORY_MIGRATION])->blocks;
-
-        for (k = page; k < page + nr; k++) {
-            if (src[idx][offset]) {
-                unsigned long bits = qatomic_xchg(&src[idx][offset], 0);
-                unsigned long new_dirty;
-                new_dirty = ~dest[k];
-                dest[k] |= bits;
-                new_dirty &= bits;
-                num_dirty += ctpopl(new_dirty);
-            }
-
-            if (++offset >= BITS_TO_LONGS(DIRTY_MEMORY_BLOCK_SIZE)) {
-                offset = 0;
-                idx++;
-            }
-        }
-        if (num_dirty) {
-            cpu_physical_memory_dirty_bits_cleared(start, length);
-        }
-
-        if (rb->clear_bmap) {
-            /*
-             * Postpone the dirty bitmap clear to the point before we
-             * really send the pages, also we will split the clear
-             * dirty procedure into smaller chunks.
-             */
-            clear_bmap_set(rb, start >> TARGET_PAGE_BITS,
-                           length >> TARGET_PAGE_BITS);
-        } else {
-            /* Slow path - still do that in a huge chunk */
-            memory_region_clear_dirty_bitmap(rb->mr, start, length);
-        }
-    } else {
-        ram_addr_t offset = rb->offset;
-
-        for (addr = 0; addr < length; addr += TARGET_PAGE_SIZE) {
-            if (cpu_physical_memory_test_and_clear_dirty(
-                        start + addr + offset,
-                        TARGET_PAGE_SIZE,
-                        DIRTY_MEMORY_MIGRATION)) {
-                long k = (start + addr) >> TARGET_PAGE_BITS;
-                if (!test_and_set_bit(k, dest)) {
-                    num_dirty++;
-                }
-            }
-        }
-    }
-
-    return num_dirty;
-}
-
 #endif
diff --git a/migration/ram.c b/migration/ram.c
index 189931d24d..f7c165dfb3 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -936,11 +936,86 @@ bool ramblock_page_is_discarded(RAMBlock *rb, ram_addr_t start)
     return false;
 }
 
+/* Called with RCU critical section */
+static uint64_t physical_memory_sync_dirty_bitmap(RAMBlock *rb,
+                                                  ram_addr_t start,
+                                                  ram_addr_t length)
+{
+    ram_addr_t addr;
+    unsigned long word = BIT_WORD((start + rb->offset) >> TARGET_PAGE_BITS);
+    uint64_t num_dirty = 0;
+    unsigned long *dest = rb->bmap;
+
+    /* start address and length is aligned at the start of a word? */
+    if (((word * BITS_PER_LONG) << TARGET_PAGE_BITS) ==
+         (start + rb->offset) &&
+        !(length & ((BITS_PER_LONG << TARGET_PAGE_BITS) - 1))) {
+        int k;
+        int nr = BITS_TO_LONGS(length >> TARGET_PAGE_BITS);
+        unsigned long * const *src;
+        unsigned long idx = (word * BITS_PER_LONG) / DIRTY_MEMORY_BLOCK_SIZE;
+        unsigned long offset = BIT_WORD((word * BITS_PER_LONG) %
+                                        DIRTY_MEMORY_BLOCK_SIZE);
+        unsigned long page = BIT_WORD(start >> TARGET_PAGE_BITS);
+
+        src = qatomic_rcu_read(
+                &ram_list.dirty_memory[DIRTY_MEMORY_MIGRATION])->blocks;
+
+        for (k = page; k < page + nr; k++) {
+            if (src[idx][offset]) {
+                unsigned long bits = qatomic_xchg(&src[idx][offset], 0);
+                unsigned long new_dirty;
+                new_dirty = ~dest[k];
+                dest[k] |= bits;
+                new_dirty &= bits;
+                num_dirty += ctpopl(new_dirty);
+            }
+
+            if (++offset >= BITS_TO_LONGS(DIRTY_MEMORY_BLOCK_SIZE)) {
+                offset = 0;
+                idx++;
+            }
+        }
+        if (num_dirty) {
+            cpu_physical_memory_dirty_bits_cleared(start, length);
+        }
+
+        if (rb->clear_bmap) {
+            /*
+             * Postpone the dirty bitmap clear to the point before we
+             * really send the pages, also we will split the clear
+             * dirty procedure into smaller chunks.
+             */
+            clear_bmap_set(rb, start >> TARGET_PAGE_BITS,
+                           length >> TARGET_PAGE_BITS);
+        } else {
+            /* Slow path - still do that in a huge chunk */
+            memory_region_clear_dirty_bitmap(rb->mr, start, length);
+        }
+    } else {
+        ram_addr_t offset = rb->offset;
+
+        for (addr = 0; addr < length; addr += TARGET_PAGE_SIZE) {
+            if (cpu_physical_memory_test_and_clear_dirty(
+                        start + addr + offset,
+                        TARGET_PAGE_SIZE,
+                        DIRTY_MEMORY_MIGRATION)) {
+                long k = (start + addr) >> TARGET_PAGE_BITS;
+                if (!test_and_set_bit(k, dest)) {
+                    num_dirty++;
+                }
+            }
+        }
+    }
+
+    return num_dirty;
+}
+
 /* Called with RCU critical section */
 static void ramblock_sync_dirty_bitmap(RAMState *rs, RAMBlock *rb)
 {
     uint64_t new_dirty_pages =
-        cpu_physical_memory_sync_dirty_bitmap(rb, 0, rb->used_length);
+        physical_memory_sync_dirty_bitmap(rb, 0, rb->used_length);
 
     rs->migration_dirty_pages += new_dirty_pages;
     rs->num_dirty_pages_period += new_dirty_pages;

From aa60bdb700f4afa8577a495c734870516910864f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 09:08:44 +0200
Subject: [PATCH 1056/2396] system/physmem: Drop 'cpu_' prefix in Physical
 Memory API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The functions related to the Physical Memory API declared
in "system/ram_addr.h" do not operate on vCPU. Remove the
'cpu_' prefix.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20251001175448.18933-18-philmd@linaro.org>
---
 accel/kvm/kvm-all.c         |  2 +-
 accel/tcg/cputlb.c          | 12 +++++-----
 hw/vfio/container-legacy.c  |  8 +++----
 hw/vfio/container.c         |  4 ++--
 include/system/ram_addr.h   | 24 +++++++++----------
 migration/ram.c             |  4 ++--
 system/memory.c             |  8 +++----
 system/memory_ldst.c.inc    |  2 +-
 system/physmem.c            | 48 ++++++++++++++++++-------------------
 target/arm/tcg/mte_helper.c |  2 +-
 tests/tsan/ignore.tsan      |  4 ++--
 11 files changed, 59 insertions(+), 59 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 08b2b5a371..a7ece7db96 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -758,7 +758,7 @@ static void kvm_slot_sync_dirty_pages(KVMSlot *slot)
     ram_addr_t start = slot->ram_start_offset;
     ram_addr_t pages = slot->memory_size / qemu_real_host_page_size();
 
-    cpu_physical_memory_set_dirty_lebitmap(slot->dirty_bmap, start, pages);
+    physical_memory_set_dirty_lebitmap(slot->dirty_bmap, start, pages);
 }
 
 static void kvm_slot_reset_dirty_pages(KVMSlot *slot)
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 2a6aa01c57..a721235dea 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -858,7 +858,7 @@ void tlb_flush_page_bits_by_mmuidx_all_cpus_synced(CPUState *src_cpu,
    can be detected */
 void tlb_protect_code(ram_addr_t ram_addr)
 {
-    cpu_physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
+    physical_memory_test_and_clear_dirty(ram_addr & TARGET_PAGE_MASK,
                                              TARGET_PAGE_SIZE,
                                              DIRTY_MEMORY_CODE);
 }
@@ -867,7 +867,7 @@ void tlb_protect_code(ram_addr_t ram_addr)
    tested for self modifying code */
 void tlb_unprotect_code(ram_addr_t ram_addr)
 {
-    cpu_physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_CODE);
+    physical_memory_set_dirty_flag(ram_addr, DIRTY_MEMORY_CODE);
 }
 
 
@@ -1085,7 +1085,7 @@ void tlb_set_page_full(CPUState *cpu, int mmu_idx,
         if (prot & PAGE_WRITE) {
             if (section->readonly) {
                 write_flags |= TLB_DISCARD_WRITE;
-            } else if (cpu_physical_memory_is_clean(iotlb)) {
+            } else if (physical_memory_is_clean(iotlb)) {
                 write_flags |= TLB_NOTDIRTY;
             }
         }
@@ -1341,7 +1341,7 @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
 
     trace_memory_notdirty_write_access(mem_vaddr, ram_addr, size);
 
-    if (!cpu_physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
+    if (!physical_memory_get_dirty_flag(ram_addr, DIRTY_MEMORY_CODE)) {
         tb_invalidate_phys_range_fast(cpu, ram_addr, size, retaddr);
     }
 
@@ -1349,10 +1349,10 @@ static void notdirty_write(CPUState *cpu, vaddr mem_vaddr, unsigned size,
      * Set both VGA and migration bits for simplicity and to remove
      * the notdirty callback faster.
      */
-    cpu_physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
+    physical_memory_set_dirty_range(ram_addr, size, DIRTY_CLIENTS_NOCODE);
 
     /* We remove the notdirty callback only if the code has been flushed. */
-    if (!cpu_physical_memory_is_clean(ram_addr)) {
+    if (!physical_memory_is_clean(ram_addr)) {
         trace_memory_notdirty_set_dirty(mem_vaddr);
         tlb_set_dirty(cpu, mem_vaddr);
     }
diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index 629ff23b0b..765be7f024 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -92,7 +92,7 @@ static int vfio_dma_unmap_bitmap(const VFIOLegacyContainer *container,
     bitmap = (struct vfio_bitmap *)&unmap->data;
 
     /*
-     * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
+     * physical_memory_set_dirty_lebitmap() supports pages in bitmap of
      * qemu_real_host_page_size to mark those dirty. Hence set bitmap_pgsize
      * to qemu_real_host_page_size.
      */
@@ -108,7 +108,7 @@ static int vfio_dma_unmap_bitmap(const VFIOLegacyContainer *container,
 
     ret = ioctl(container->fd, VFIO_IOMMU_UNMAP_DMA, unmap);
     if (!ret) {
-        cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
+        physical_memory_set_dirty_lebitmap(vbmap.bitmap,
                 iotlb->translated_addr, vbmap.pages);
     } else {
         error_report("VFIO_UNMAP_DMA with DIRTY_BITMAP : %m");
@@ -266,7 +266,7 @@ static int vfio_legacy_query_dirty_bitmap(const VFIOContainer *bcontainer,
     range->size = size;
 
     /*
-     * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
+     * physical_memory_set_dirty_lebitmap() supports pages in bitmap of
      * qemu_real_host_page_size to mark those dirty. Hence set bitmap's pgsize
      * to qemu_real_host_page_size.
      */
@@ -485,7 +485,7 @@ static void vfio_get_iommu_info_migration(VFIOLegacyContainer *container,
                             header);
 
     /*
-     * cpu_physical_memory_set_dirty_lebitmap() supports pages in bitmap of
+     * physical_memory_set_dirty_lebitmap() supports pages in bitmap of
      * qemu_real_host_page_size to mark those dirty.
      */
     if (cap_mig->pgsize_bitmap & qemu_real_host_page_size()) {
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 41de343924..3fb19a1c8a 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -255,7 +255,7 @@ int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
     int ret;
 
     if (!bcontainer->dirty_pages_supported && !all_device_dirty_tracking) {
-        cpu_physical_memory_set_dirty_range(translated_addr, size,
+        physical_memory_set_dirty_range(translated_addr, size,
                                             tcg_enabled() ? DIRTY_CLIENTS_ALL :
                                             DIRTY_CLIENTS_NOCODE);
         return 0;
@@ -280,7 +280,7 @@ int vfio_container_query_dirty_bitmap(const VFIOContainer *bcontainer,
         goto out;
     }
 
-    dirty_pages = cpu_physical_memory_set_dirty_lebitmap(vbmap.bitmap,
+    dirty_pages = physical_memory_set_dirty_lebitmap(vbmap.bitmap,
                                                          translated_addr,
                                                          vbmap.pages);
 
diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index d2d088bbea..3894a84fb9 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -136,39 +136,39 @@ static inline void qemu_ram_block_writeback(RAMBlock *block)
 #define DIRTY_CLIENTS_ALL     ((1 << DIRTY_MEMORY_NUM) - 1)
 #define DIRTY_CLIENTS_NOCODE  (DIRTY_CLIENTS_ALL & ~(1 << DIRTY_MEMORY_CODE))
 
-bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
+bool physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
 
-bool cpu_physical_memory_is_clean(ram_addr_t addr);
+bool physical_memory_is_clean(ram_addr_t addr);
 
-uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
+uint8_t physical_memory_range_includes_clean(ram_addr_t start,
                                                  ram_addr_t length,
                                                  uint8_t mask);
 
-void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
+void physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
 
-void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
+void physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
                                          uint8_t mask);
 
 /*
- * Contrary to cpu_physical_memory_sync_dirty_bitmap() this function returns
+ * Contrary to physical_memory_sync_dirty_bitmap() this function returns
  * the number of dirty pages in @bitmap passed as argument. On the other hand,
- * cpu_physical_memory_sync_dirty_bitmap() returns newly dirtied pages that
+ * physical_memory_sync_dirty_bitmap() returns newly dirtied pages that
  * weren't set in the global migration bitmap.
  */
-uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
+uint64_t physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
                                                 ram_addr_t start,
                                                 ram_addr_t pages);
 
-void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length);
+void physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length);
 
-bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
+bool physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,
                                               unsigned client);
 
-DirtyBitmapSnapshot *cpu_physical_memory_snapshot_and_clear_dirty
+DirtyBitmapSnapshot *physical_memory_snapshot_and_clear_dirty
     (MemoryRegion *mr, hwaddr offset, hwaddr length, unsigned client);
 
-bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
+bool physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
                                             ram_addr_t start,
                                             ram_addr_t length);
 
diff --git a/migration/ram.c b/migration/ram.c
index f7c165dfb3..ba01654228 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -977,7 +977,7 @@ static uint64_t physical_memory_sync_dirty_bitmap(RAMBlock *rb,
             }
         }
         if (num_dirty) {
-            cpu_physical_memory_dirty_bits_cleared(start, length);
+            physical_memory_dirty_bits_cleared(start, length);
         }
 
         if (rb->clear_bmap) {
@@ -996,7 +996,7 @@ static uint64_t physical_memory_sync_dirty_bitmap(RAMBlock *rb,
         ram_addr_t offset = rb->offset;
 
         for (addr = 0; addr < length; addr += TARGET_PAGE_SIZE) {
-            if (cpu_physical_memory_test_and_clear_dirty(
+            if (physical_memory_test_and_clear_dirty(
                         start + addr + offset,
                         TARGET_PAGE_SIZE,
                         DIRTY_MEMORY_MIGRATION)) {
diff --git a/system/memory.c b/system/memory.c
index 41797ceef4..5c14e56ebb 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -2271,7 +2271,7 @@ void memory_region_set_dirty(MemoryRegion *mr, hwaddr addr,
                              hwaddr size)
 {
     assert(mr->ram_block);
-    cpu_physical_memory_set_dirty_range(memory_region_get_ram_addr(mr) + addr,
+    physical_memory_set_dirty_range(memory_region_get_ram_addr(mr) + addr,
                                         size,
                                         memory_region_get_dirty_log_mask(mr));
 }
@@ -2375,7 +2375,7 @@ DirtyBitmapSnapshot *memory_region_snapshot_and_clear_dirty(MemoryRegion *mr,
     DirtyBitmapSnapshot *snapshot;
     assert(mr->ram_block);
     memory_region_sync_dirty_bitmap(mr, false);
-    snapshot = cpu_physical_memory_snapshot_and_clear_dirty(mr, addr, size, client);
+    snapshot = physical_memory_snapshot_and_clear_dirty(mr, addr, size, client);
     memory_global_after_dirty_log_sync();
     return snapshot;
 }
@@ -2384,7 +2384,7 @@ bool memory_region_snapshot_get_dirty(MemoryRegion *mr, DirtyBitmapSnapshot *sna
                                       hwaddr addr, hwaddr size)
 {
     assert(mr->ram_block);
-    return cpu_physical_memory_snapshot_get_dirty(snap,
+    return physical_memory_snapshot_get_dirty(snap,
                 memory_region_get_ram_addr(mr) + addr, size);
 }
 
@@ -2422,7 +2422,7 @@ void memory_region_reset_dirty(MemoryRegion *mr, hwaddr addr,
                                hwaddr size, unsigned client)
 {
     assert(mr->ram_block);
-    cpu_physical_memory_test_and_clear_dirty(
+    physical_memory_test_and_clear_dirty(
         memory_region_get_ram_addr(mr) + addr, size, client);
 }
 
diff --git a/system/memory_ldst.c.inc b/system/memory_ldst.c.inc
index 7f32d3d9ff..333da209d1 100644
--- a/system/memory_ldst.c.inc
+++ b/system/memory_ldst.c.inc
@@ -287,7 +287,7 @@ void glue(address_space_stl_notdirty, SUFFIX)(ARG1_DECL,
 
         dirty_log_mask = memory_region_get_dirty_log_mask(mr);
         dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);
-        cpu_physical_memory_set_dirty_range(memory_region_get_ram_addr(mr) + addr,
+        physical_memory_set_dirty_range(memory_region_get_ram_addr(mr) + addr,
                                             4, dirty_log_mask);
         r = MEMTX_OK;
     }
diff --git a/system/physmem.c b/system/physmem.c
index 079bdbff30..347119b8c2 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -899,7 +899,7 @@ void tlb_reset_dirty_range_all(ram_addr_t start, ram_addr_t length)
     }
 }
 
-void cpu_physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length)
+void physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length)
 {
     if (tcg_enabled()) {
         tlb_reset_dirty_range_all(start, length);
@@ -945,17 +945,17 @@ static bool physical_memory_get_dirty(ram_addr_t start, ram_addr_t length,
     return dirty;
 }
 
-bool cpu_physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client)
+bool physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client)
 {
     return physical_memory_get_dirty(addr, 1, client);
 }
 
-bool cpu_physical_memory_is_clean(ram_addr_t addr)
+bool physical_memory_is_clean(ram_addr_t addr)
 {
-    bool vga = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_VGA);
-    bool code = cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_CODE);
+    bool vga = physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_VGA);
+    bool code = physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_CODE);
     bool migration =
-        cpu_physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_MIGRATION);
+        physical_memory_get_dirty_flag(addr, DIRTY_MEMORY_MIGRATION);
     return !(vga && code && migration);
 }
 
@@ -998,7 +998,7 @@ static bool physical_memory_all_dirty(ram_addr_t start, ram_addr_t length,
     return dirty;
 }
 
-uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
+uint8_t physical_memory_range_includes_clean(ram_addr_t start,
                                                  ram_addr_t length,
                                                  uint8_t mask)
 {
@@ -1019,7 +1019,7 @@ uint8_t cpu_physical_memory_range_includes_clean(ram_addr_t start,
     return ret;
 }
 
-void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client)
+void physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client)
 {
     unsigned long page, idx, offset;
     DirtyMemoryBlocks *blocks;
@@ -1037,7 +1037,7 @@ void cpu_physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client)
     set_bit_atomic(offset, blocks->blocks[idx]);
 }
 
-void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
+void physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
                                          uint8_t mask)
 {
     DirtyMemoryBlocks *blocks[DIRTY_MEMORY_NUM];
@@ -1089,7 +1089,7 @@ void cpu_physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
 }
 
 /* Note: start and end must be within the same ram block.  */
-bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
+bool physical_memory_test_and_clear_dirty(ram_addr_t start,
                                               ram_addr_t length,
                                               unsigned client)
 {
@@ -1131,7 +1131,7 @@ bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
     }
 
     if (dirty) {
-        cpu_physical_memory_dirty_bits_cleared(start, length);
+        physical_memory_dirty_bits_cleared(start, length);
     }
 
     return dirty;
@@ -1139,12 +1139,12 @@ bool cpu_physical_memory_test_and_clear_dirty(ram_addr_t start,
 
 static void physical_memory_clear_dirty_range(ram_addr_t addr, ram_addr_t length)
 {
-    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_MIGRATION);
-    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_VGA);
-    cpu_physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_CODE);
+    physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_MIGRATION);
+    physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_VGA);
+    physical_memory_test_and_clear_dirty(addr, length, DIRTY_MEMORY_CODE);
 }
 
-DirtyBitmapSnapshot *cpu_physical_memory_snapshot_and_clear_dirty
+DirtyBitmapSnapshot *physical_memory_snapshot_and_clear_dirty
     (MemoryRegion *mr, hwaddr offset, hwaddr length, unsigned client)
 {
     DirtyMemoryBlocks *blocks;
@@ -1191,14 +1191,14 @@ DirtyBitmapSnapshot *cpu_physical_memory_snapshot_and_clear_dirty
         }
     }
 
-    cpu_physical_memory_dirty_bits_cleared(start, length);
+    physical_memory_dirty_bits_cleared(start, length);
 
     memory_region_clear_dirty_bitmap(mr, offset, length);
 
     return snap;
 }
 
-bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
+bool physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
                                             ram_addr_t start,
                                             ram_addr_t length)
 {
@@ -1219,7 +1219,7 @@ bool cpu_physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
     return false;
 }
 
-uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
+uint64_t physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
                                                 ram_addr_t start,
                                                 ram_addr_t pages)
 {
@@ -1312,7 +1312,7 @@ uint64_t cpu_physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
                     page_number = (i * HOST_LONG_BITS + j) * hpratio;
                     addr = page_number * TARGET_PAGE_SIZE;
                     ram_addr = start + addr;
-                    cpu_physical_memory_set_dirty_range(ram_addr,
+                    physical_memory_set_dirty_range(ram_addr,
                                        TARGET_PAGE_SIZE * hpratio, clients);
                 } while (c != 0);
             }
@@ -2080,7 +2080,7 @@ int qemu_ram_resize(RAMBlock *block, ram_addr_t newsize, Error **errp)
 
     physical_memory_clear_dirty_range(block->offset, block->used_length);
     block->used_length = newsize;
-    cpu_physical_memory_set_dirty_range(block->offset, block->used_length,
+    physical_memory_set_dirty_range(block->offset, block->used_length,
                                         DIRTY_CLIENTS_ALL);
     memory_region_set_size(block->mr, unaligned_size);
     if (block->resized) {
@@ -2285,7 +2285,7 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
     ram_list.version++;
     qemu_mutex_unlock_ramlist();
 
-    cpu_physical_memory_set_dirty_range(new_block->offset,
+    physical_memory_set_dirty_range(new_block->offset,
                                         new_block->used_length,
                                         DIRTY_CLIENTS_ALL);
 
@@ -3134,19 +3134,19 @@ static void invalidate_and_set_dirty(MemoryRegion *mr, hwaddr addr,
     addr += ramaddr;
 
     /* No early return if dirty_log_mask is or becomes 0, because
-     * cpu_physical_memory_set_dirty_range will still call
+     * physical_memory_set_dirty_range will still call
      * xen_modified_memory.
      */
     if (dirty_log_mask) {
         dirty_log_mask =
-            cpu_physical_memory_range_includes_clean(addr, length, dirty_log_mask);
+            physical_memory_range_includes_clean(addr, length, dirty_log_mask);
     }
     if (dirty_log_mask & (1 << DIRTY_MEMORY_CODE)) {
         assert(tcg_enabled());
         tb_invalidate_phys_range(NULL, addr, addr + length - 1);
         dirty_log_mask &= ~(1 << DIRTY_MEMORY_CODE);
     }
-    cpu_physical_memory_set_dirty_range(addr, length, dirty_log_mask);
+    physical_memory_set_dirty_range(addr, length, dirty_log_mask);
 }
 
 void memory_region_flush_rom_device(MemoryRegion *mr, hwaddr addr, hwaddr size)
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 7d80244788..077ff4b2b2 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -189,7 +189,7 @@ uint8_t *allocation_tag_mem_probe(CPUARMState *env, int ptr_mmu_idx,
      */
     if (tag_access == MMU_DATA_STORE) {
         ram_addr_t tag_ra = memory_region_get_ram_addr(mr) + xlat;
-        cpu_physical_memory_set_dirty_flag(tag_ra, DIRTY_MEMORY_MIGRATION);
+        physical_memory_set_dirty_flag(tag_ra, DIRTY_MEMORY_MIGRATION);
     }
 
     return memory_region_get_ram_ptr(mr) + xlat;
diff --git a/tests/tsan/ignore.tsan b/tests/tsan/ignore.tsan
index 423e482d2f..8fa00a2c49 100644
--- a/tests/tsan/ignore.tsan
+++ b/tests/tsan/ignore.tsan
@@ -4,7 +4,7 @@
 # The eventual goal would be to fix these warnings.
 
 # TSan is not happy about setting/getting of dirty bits,
-# for example, cpu_physical_memory_set_dirty_range,
-# and cpu_physical_memory_get_dirty.
+# for example, physical_memory_set_dirty_range,
+# and physical_memory_get_dirty.
 src:bitops.c
 src:bitmap.c

From 4db362f68c7cd28a6b1aa2f9ada68aa3556f9613 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 30 Sep 2025 09:08:54 +0200
Subject: [PATCH 1057/2396] system/physmem: Extract API out of
 'system/ram_addr.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Very few files use the Physical Memory API. Declare its
methods in their own header: "system/physmem.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-Id: <20251001175448.18933-19-philmd@linaro.org>
---
 MAINTAINERS                 |  1 +
 accel/kvm/kvm-all.c         |  2 +-
 accel/tcg/cputlb.c          |  1 +
 hw/vfio/container-legacy.c  |  2 +-
 hw/vfio/container.c         |  1 +
 hw/vfio/listener.c          |  1 -
 include/system/physmem.h    | 54 +++++++++++++++++++++++++++++++++++++
 include/system/ram_addr.h   | 40 ---------------------------
 migration/ram.c             |  1 +
 system/memory.c             |  1 +
 system/physmem.c            |  1 +
 target/arm/tcg/mte_helper.c |  2 +-
 12 files changed, 63 insertions(+), 44 deletions(-)
 create mode 100644 include/system/physmem.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 75e1fa5c30..43d8d0bab5 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3223,6 +3223,7 @@ S: Supported
 F: include/system/ioport.h
 F: include/exec/memop.h
 F: include/system/memory.h
+F: include/system/physmem.h
 F: include/system/ram_addr.h
 F: include/system/ramblock.h
 F: include/system/memory_mapping.h
diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index a7ece7db96..58802f7c3c 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -32,13 +32,13 @@
 #include "system/runstate.h"
 #include "system/cpus.h"
 #include "system/accel-blocker.h"
+#include "system/physmem.h"
 #include "system/ramblock.h"
 #include "accel/accel-ops.h"
 #include "qemu/bswap.h"
 #include "exec/tswap.h"
 #include "exec/target_page.h"
 #include "system/memory.h"
-#include "system/ram_addr.h"
 #include "qemu/event_notifier.h"
 #include "qemu/main-loop.h"
 #include "trace.h"
diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index a721235dea..7214d41cb5 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -25,6 +25,7 @@
 #include "accel/tcg/probe.h"
 #include "exec/page-protection.h"
 #include "system/memory.h"
+#include "system/physmem.h"
 #include "accel/tcg/cpu-ldst-common.h"
 #include "accel/tcg/cpu-mmu-index.h"
 #include "exec/cputlb.h"
diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index 765be7f024..a3615d7b5d 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -25,7 +25,7 @@
 #include "hw/vfio/vfio-device.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
-#include "system/ram_addr.h"
+#include "system/physmem.h"
 #include "qemu/error-report.h"
 #include "qemu/range.h"
 #include "system/reset.h"
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 3fb19a1c8a..9ddec300e3 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -20,6 +20,7 @@
 #include "qemu/error-report.h"
 #include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-device.h" /* vfio_device_reset_handler */
+#include "system/physmem.h"
 #include "system/reset.h"
 #include "vfio-helpers.h"
 
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index b5cefc9395..c6bb58f520 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -30,7 +30,6 @@
 #include "hw/vfio/pci.h"
 #include "system/address-spaces.h"
 #include "system/memory.h"
-#include "system/ram_addr.h"
 #include "hw/hw.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
diff --git a/include/system/physmem.h b/include/system/physmem.h
new file mode 100644
index 0000000000..879f6eae38
--- /dev/null
+++ b/include/system/physmem.h
@@ -0,0 +1,54 @@
+/*
+ * QEMU physical memory interfaces (target independent).
+ *
+ *  Copyright (c) 2003 Fabrice Bellard
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef QEMU_SYSTEM_PHYSMEM_H
+#define QEMU_SYSTEM_PHYSMEM_H
+
+#include "exec/hwaddr.h"
+#include "exec/ramlist.h"
+
+#define DIRTY_CLIENTS_ALL     ((1 << DIRTY_MEMORY_NUM) - 1)
+#define DIRTY_CLIENTS_NOCODE  (DIRTY_CLIENTS_ALL & ~(1 << DIRTY_MEMORY_CODE))
+
+bool physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
+
+bool physical_memory_is_clean(ram_addr_t addr);
+
+uint8_t physical_memory_range_includes_clean(ram_addr_t start,
+                                             ram_addr_t length,
+                                             uint8_t mask);
+
+void physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
+
+void physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
+                                     uint8_t mask);
+
+/*
+ * Contrary to physical_memory_sync_dirty_bitmap() this function returns
+ * the number of dirty pages in @bitmap passed as argument. On the other hand,
+ * physical_memory_sync_dirty_bitmap() returns newly dirtied pages that
+ * weren't set in the global migration bitmap.
+ */
+uint64_t physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
+                                            ram_addr_t start,
+                                            ram_addr_t pages);
+
+void physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length);
+
+bool physical_memory_test_and_clear_dirty(ram_addr_t start,
+                                          ram_addr_t length,
+                                          unsigned client);
+
+DirtyBitmapSnapshot *
+physical_memory_snapshot_and_clear_dirty(MemoryRegion *mr, hwaddr offset,
+                                         hwaddr length, unsigned client);
+
+bool physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
+                                        ram_addr_t start,
+                                        ram_addr_t length);
+
+#endif
diff --git a/include/system/ram_addr.h b/include/system/ram_addr.h
index 3894a84fb9..683485980c 100644
--- a/include/system/ram_addr.h
+++ b/include/system/ram_addr.h
@@ -19,7 +19,6 @@
 #ifndef SYSTEM_RAM_ADDR_H
 #define SYSTEM_RAM_ADDR_H
 
-#include "exec/ramlist.h"
 #include "system/ramblock.h"
 #include "exec/target_page.h"
 #include "exec/hwaddr.h"
@@ -133,43 +132,4 @@ static inline void qemu_ram_block_writeback(RAMBlock *block)
     qemu_ram_msync(block, 0, block->used_length);
 }
 
-#define DIRTY_CLIENTS_ALL     ((1 << DIRTY_MEMORY_NUM) - 1)
-#define DIRTY_CLIENTS_NOCODE  (DIRTY_CLIENTS_ALL & ~(1 << DIRTY_MEMORY_CODE))
-
-bool physical_memory_get_dirty_flag(ram_addr_t addr, unsigned client);
-
-bool physical_memory_is_clean(ram_addr_t addr);
-
-uint8_t physical_memory_range_includes_clean(ram_addr_t start,
-                                                 ram_addr_t length,
-                                                 uint8_t mask);
-
-void physical_memory_set_dirty_flag(ram_addr_t addr, unsigned client);
-
-void physical_memory_set_dirty_range(ram_addr_t start, ram_addr_t length,
-                                         uint8_t mask);
-
-/*
- * Contrary to physical_memory_sync_dirty_bitmap() this function returns
- * the number of dirty pages in @bitmap passed as argument. On the other hand,
- * physical_memory_sync_dirty_bitmap() returns newly dirtied pages that
- * weren't set in the global migration bitmap.
- */
-uint64_t physical_memory_set_dirty_lebitmap(unsigned long *bitmap,
-                                                ram_addr_t start,
-                                                ram_addr_t pages);
-
-void physical_memory_dirty_bits_cleared(ram_addr_t start, ram_addr_t length);
-
-bool physical_memory_test_and_clear_dirty(ram_addr_t start,
-                                              ram_addr_t length,
-                                              unsigned client);
-
-DirtyBitmapSnapshot *physical_memory_snapshot_and_clear_dirty
-    (MemoryRegion *mr, hwaddr offset, hwaddr length, unsigned client);
-
-bool physical_memory_snapshot_get_dirty(DirtyBitmapSnapshot *snap,
-                                            ram_addr_t start,
-                                            ram_addr_t length);
-
 #endif
diff --git a/migration/ram.c b/migration/ram.c
index ba01654228..5eef2efc78 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -53,6 +53,7 @@
 #include "qemu/rcu_queue.h"
 #include "migration/colo.h"
 #include "system/cpu-throttle.h"
+#include "system/physmem.h"
 #include "system/ramblock.h"
 #include "savevm.h"
 #include "qemu/iov.h"
diff --git a/system/memory.c b/system/memory.c
index 5c14e56ebb..8b84661ae3 100644
--- a/system/memory.c
+++ b/system/memory.c
@@ -25,6 +25,7 @@
 #include "qemu/target-info.h"
 #include "qom/object.h"
 #include "trace.h"
+#include "system/physmem.h"
 #include "system/ram_addr.h"
 #include "system/kvm.h"
 #include "system/runstate.h"
diff --git a/system/physmem.c b/system/physmem.c
index 347119b8c2..a340ca3e61 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -43,6 +43,7 @@
 #include "system/kvm.h"
 #include "system/tcg.h"
 #include "system/qtest.h"
+#include "system/physmem.h"
 #include "system/ramblock.h"
 #include "qemu/timer.h"
 #include "qemu/config-file.h"
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index 077ff4b2b2..b96c953f80 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -27,7 +27,7 @@
 #include "user/cpu_loop.h"
 #include "user/page-protection.h"
 #else
-#include "system/ram_addr.h"
+#include "system/physmem.h"
 #endif
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/probe.h"

From 547d94ffc62a96736953c35c94c7916181805895 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:41 +0100
Subject: [PATCH 1058/2396] .gitpublish: use origin/master as default base
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is very much the result of my recent fat finger but I think it's
safer to assume that origin/master points to a recent commit (or at
least a commit a given branch is based on) than master.

Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-2-alex.bennee@linaro.org>
---
 .gitpublish | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/.gitpublish b/.gitpublish
index a13f8c7c0e..a3adb21ffa 100644
--- a/.gitpublish
+++ b/.gitpublish
@@ -4,48 +4,48 @@
 # See https://github.com/stefanha/git-publish for more information
 #
 [gitpublishprofile "default"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "rfc"]
-base = master
+base = origin/master
 prefix = RFC PATCH
 to = qemu-devel@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "stable"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-stable@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "trivial"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-trivial@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "block"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-block@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "arm"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-arm@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "s390"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-s390@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null
 
 [gitpublishprofile "ppc"]
-base = master
+base = origin/master
 to = qemu-devel@nongnu.org
 cc = qemu-ppc@nongnu.org
 cccmd = scripts/get_maintainer.pl --noroles --norolestats --nogit --nogit-fallback 2>/dev/null

From 43a1c177426ff1babb863b3c45281fbc9f47f130 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:42 +0100
Subject: [PATCH 1059/2396] .gitmodules: restore qemu-project mirror of u-boot
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With this change also reference the upstream repo.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-3-alex.bennee@linaro.org>
---
 .gitmodules | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index e27dfe8c2c..e51abe6525 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -15,7 +15,8 @@
 	url = https://gitlab.com/qemu-project/qemu-palcode.git
 [submodule "roms/u-boot"]
 	path = roms/u-boot
-	url = https://gitlab.com/qemu-project-mirrors/u-boot.git
+        # upstream is https://github.com/u-boot/u-boot
+	url = https://gitlab.com/qemu-project/u-boot.git
 [submodule "roms/skiboot"]
 	path = roms/skiboot
 	url = https://gitlab.com/qemu-project/skiboot.git

From 88091789f0d6234d9050c1c7a2dfc2515044ece0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:43 +0100
Subject: [PATCH 1060/2396] .gitmodules: restore qemu-project mirror of
 u-boot-sam460ex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With this change also reference the upstream repo.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-4-alex.bennee@linaro.org>
---
 .gitmodules | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.gitmodules b/.gitmodules
index e51abe6525..c307216d17 100644
--- a/.gitmodules
+++ b/.gitmodules
@@ -28,7 +28,8 @@
 	url = https://gitlab.com/qemu-project/seabios-hppa.git
 [submodule "roms/u-boot-sam460ex"]
 	path = roms/u-boot-sam460ex
-	url = https://gitlab.com/qemu-project-mirrors/u-boot-sam460ex.git
+        # upstream is https://github.com/zbalaton/u-boot-sam460ex
+	url = https://gitlab.com/qemu-project/u-boot-sam460ex.git
 [submodule "roms/edk2"]
 	path = roms/edk2
 	url = https://gitlab.com/qemu-project/edk2.git

From 3d8c04b0eee35b7345c34c5265bb0478fcfc90ac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:44 +0100
Subject: [PATCH 1061/2396] tests/lcitool: drop 64 bit guests from i686 cross
 build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With only TCG available we can't support 64 bit guests on a 32 bit
host.

Fixes: 5c27baf9519 (docs/about/deprecated: Deprecate 32-bit x86 hosts for system emulation)
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-5-alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-i686-cross.docker | 2 +-
 tests/lcitool/refresh                             | 2 --
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 4e8b3a8293..2998764065 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -178,7 +178,7 @@ ENV ABI "i686-linux-gnu"
 ENV MESON_OPTS "--cross-file=i686-linux-gnu"
 ENV RUST_TARGET "i686-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=i686-linux-gnu-
-ENV DEF_TARGET_LIST x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user
+ENV DEF_TARGET_LIST i386-softmmu,i386-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 645959318a..185a47cebe 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -216,8 +216,6 @@ try:
     generate_dockerfile("debian-i686-cross", "debian-13",
                         cross="i686",
                         trailer=cross_build("i686-linux-gnu-",
-                                            "x86_64-softmmu,"
-                                            "x86_64-linux-user,"
                                             "i386-softmmu,i386-linux-user"))
 
     # mips no longer supported in debian-13

From 07a58aac21c80c3b74b2955ea9f9ba02070be75b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:45 +0100
Subject: [PATCH 1062/2396] tests/lcitool: bump custom runner packages to
 Ubuntu 24.04
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In anticipation of new runners lets move to a newer Ubuntu LTS.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-6-alex.bennee@linaro.org>
---
 scripts/ci/setup/gitlab-runner.yml                   |  2 +-
 scripts/ci/setup/ubuntu/build-environment.yml        | 12 ++++++------
 ...tu-2204-aarch64.yaml => ubuntu-2404-aarch64.yaml} |  4 +++-
 ...ubuntu-2204-s390x.yaml => ubuntu-2404-s390x.yaml} |  4 +++-
 tests/lcitool/refresh                                |  4 ++--
 5 files changed, 15 insertions(+), 11 deletions(-)
 rename scripts/ci/setup/ubuntu/{ubuntu-2204-aarch64.yaml => ubuntu-2404-aarch64.yaml} (96%)
 rename scripts/ci/setup/ubuntu/{ubuntu-2204-s390x.yaml => ubuntu-2404-s390x.yaml} (96%)

diff --git a/scripts/ci/setup/gitlab-runner.yml b/scripts/ci/setup/gitlab-runner.yml
index 57e7faebf1..7350f6cff4 100644
--- a/scripts/ci/setup/gitlab-runner.yml
+++ b/scripts/ci/setup/gitlab-runner.yml
@@ -103,7 +103,7 @@
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
         - ansible_facts['architecture'] == 'aarch64'
-        - ansible_facts['distribution_version'] == '22.04'
+        - ansible_facts['distribution_version'] == '24.04'
 
     - name: Install the gitlab-runner service using its own functionality
       command: "/usr/bin/gitlab-runner install --user gitlab-runner --working-directory /home/gitlab-runner"
diff --git a/scripts/ci/setup/ubuntu/build-environment.yml b/scripts/ci/setup/ubuntu/build-environment.yml
index 56b51609e3..6042750cb4 100644
--- a/scripts/ci/setup/ubuntu/build-environment.yml
+++ b/scripts/ci/setup/ubuntu/build-environment.yml
@@ -35,19 +35,19 @@
     # the package lists are updated by "make lcitool-refresh"
     - name: Include package lists based on OS and architecture
       include_vars:
-        file: "ubuntu-2204-{{ ansible_facts['architecture'] }}.yaml"
+        file: "ubuntu-2404-{{ ansible_facts['architecture'] }}.yaml"
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '22.04'
+        - ansible_facts['distribution_version'] == '24.04'
 
-    - name: Install packages for QEMU on Ubuntu 22.04
+    - name: Install packages for QEMU on Ubuntu 24.04
       package:
         name: "{{ packages }}"
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '22.04'
+        - ansible_facts['distribution_version'] == '24.04'
 
-    - name: Install armhf cross-compile packages to build QEMU on AArch64 Ubuntu 22.04
+    - name: Install armhf cross-compile packages to build QEMU on AArch64 Ubuntu 24.04
       package:
         name:
           - binutils-arm-linux-gnueabihf
@@ -62,6 +62,6 @@
           - zlib1g-dev:armhf
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '22.04'
+        - ansible_facts['distribution_version'] == '24.04'
         - ansible_facts['architecture'] == 'aarch64'
 
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
similarity index 96%
rename from scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
rename to scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
index 2ca4a5392f..ce632d9710 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
@@ -1,12 +1,13 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool variables --host-arch aarch64 ubuntu-2204 qemu
+#  $ lcitool variables --host-arch aarch64 ubuntu-2404 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
 packages:
   - bash
   - bc
+  - bindgen
   - bison
   - bsdextrautils
   - bzip2
@@ -92,6 +93,7 @@ packages:
   - libvdeplug-dev
   - libvirglrenderer-dev
   - libvte-2.91-dev
+  - libxdp-dev
   - libxen-dev
   - libzstd-dev
   - llvm
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
similarity index 96%
rename from scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
rename to scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
index 7198fbbcbb..f45f75c960 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
@@ -1,12 +1,13 @@
 # THIS FILE WAS AUTO-GENERATED
 #
-#  $ lcitool variables --host-arch s390x ubuntu-2204 qemu
+#  $ lcitool variables --host-arch s390x ubuntu-2404 qemu
 #
 # https://gitlab.com/libvirt/libvirt-ci
 
 packages:
   - bash
   - bc
+  - bindgen
   - bison
   - bsdextrautils
   - bzip2
@@ -91,6 +92,7 @@ packages:
   - libvdeplug-dev
   - libvirglrenderer-dev
   - libvte-2.91-dev
+  - libxdp-dev
   - libzstd-dev
   - llvm
   - locales
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 185a47cebe..056cfb6e9d 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -270,8 +270,8 @@ try:
     #
     # Ansible package lists
     #
-    generate_yaml("ubuntu", "ubuntu-2204", "aarch64")
-    generate_yaml("ubuntu", "ubuntu-2204", "s390x")
+    generate_yaml("ubuntu", "ubuntu-2404", "aarch64")
+    generate_yaml("ubuntu", "ubuntu-2404", "s390x")
 
 
     sys.exit(0)

From eafc5f69e621725dcdcedcc1955d820af7abfc82 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:46 +0100
Subject: [PATCH 1063/2396] gitlab: move custom runners to Ubuntu 24.04
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-7-alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners.yml               |  6 ++--
 ...4-aarch32.yml => ubuntu-24.04-aarch32.yml} |  8 ++---
 ...4-aarch64.yml => ubuntu-24.04-aarch64.yml} | 32 +++++++++----------
 ...22.04-s390x.yml => ubuntu-24.04-s390x.yml} | 28 ++++++++--------
 4 files changed, 37 insertions(+), 37 deletions(-)
 rename .gitlab-ci.d/custom-runners/{ubuntu-22.04-aarch32.yml => ubuntu-24.04-aarch32.yml} (78%)
 rename .gitlab-ci.d/custom-runners/{ubuntu-22.04-aarch64.yml => ubuntu-24.04-aarch64.yml} (89%)
 rename .gitlab-ci.d/custom-runners/{ubuntu-22.04-s390x.yml => ubuntu-24.04-s390x.yml} (88%)

diff --git a/.gitlab-ci.d/custom-runners.yml b/.gitlab-ci.d/custom-runners.yml
index 2d493f70f7..3eb8216d57 100644
--- a/.gitlab-ci.d/custom-runners.yml
+++ b/.gitlab-ci.d/custom-runners.yml
@@ -29,6 +29,6 @@
       junit: build/meson-logs/*.junit.xml
 
 include:
-  - local: '/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml'
-  - local: '/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch64.yml'
-  - local: '/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch32.yml'
+  - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml'
+  - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml'
+  - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml'
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch32.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
similarity index 78%
rename from .gitlab-ci.d/custom-runners/ubuntu-22.04-aarch32.yml
rename to .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
index 8727687e2b..75029c9187 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch32.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
@@ -1,13 +1,13 @@
-# All ubuntu-22.04 jobs should run successfully in an environment
+# All ubuntu-24.04 jobs should run successfully in an environment
 # setup by the scripts/ci/setup/ubuntu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 22.04"
+# "Install basic packages to build QEMU on Ubuntu 24.04"
 
-ubuntu-22.04-aarch32-all:
+ubuntu-24.04-aarch32-all:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch32
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
similarity index 89%
rename from .gitlab-ci.d/custom-runners/ubuntu-22.04-aarch64.yml
rename to .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index ca2f140471..d26c7827f4 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-22.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -1,13 +1,13 @@
-# All ubuntu-22.04 jobs should run successfully in an environment
+# All ubuntu-24.04 jobs should run successfully in an environment
 # setup by the scripts/ci/setup/ubuntu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 22.04"
+# "Install basic packages to build QEMU on Ubuntu 24.04"
 
-ubuntu-22.04-aarch64-all-linux-static:
+ubuntu-24.04-aarch64-all-linux-static:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -23,12 +23,12 @@ ubuntu-22.04-aarch64-all-linux-static:
  - make check-tcg
  - make --output-sync -j`nproc --ignore=40` check
 
-ubuntu-22.04-aarch64-all:
+ubuntu-24.04-aarch64-all:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -45,12 +45,12 @@ ubuntu-22.04-aarch64-all:
  - make --output-sync -j`nproc --ignore=40`
  - make --output-sync -j`nproc --ignore=40` check
 
-ubuntu-22.04-aarch64-without-defaults:
+ubuntu-24.04-aarch64-without-defaults:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -67,12 +67,12 @@ ubuntu-22.04-aarch64-without-defaults:
  - make --output-sync -j`nproc --ignore=40`
  - make --output-sync -j`nproc --ignore=40` check
 
-ubuntu-22.04-aarch64-alldbg:
+ubuntu-24.04-aarch64-alldbg:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -86,12 +86,12 @@ ubuntu-22.04-aarch64-alldbg:
  - make --output-sync -j`nproc --ignore=40`
  - make --output-sync -j`nproc --ignore=40` check
 
-ubuntu-22.04-aarch64-clang:
+ubuntu-24.04-aarch64-clang:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -108,11 +108,11 @@ ubuntu-22.04-aarch64-clang:
  - make --output-sync -j`nproc --ignore=40`
  - make --output-sync -j`nproc --ignore=40` check
 
-ubuntu-22.04-aarch64-tci:
+ubuntu-24.04-aarch64-tci:
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -128,12 +128,12 @@ ubuntu-22.04-aarch64-tci:
    || { cat config.log meson-logs/meson-log.txt; exit 1; }
  - make --output-sync -j`nproc --ignore=40`
 
-ubuntu-22.04-aarch64-notcg:
+ubuntu-24.04-aarch64-notcg:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - aarch64
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
similarity index 88%
rename from .gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml
rename to .gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
index e62ff1763f..45dbee1788 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-22.04-s390x.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
@@ -1,13 +1,13 @@
-# All ubuntu-22.04 jobs should run successfully in an environment
+# All ubuntu-24.04 jobs should run successfully in an environment
 # setup by the scripts/ci/setup/ubuntu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 22.04"
+# "Install basic packages to build QEMU on Ubuntu 24.04"
 
-ubuntu-22.04-s390x-all-linux:
+ubuntu-24.04-s390x-all-linux:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -21,12 +21,12 @@ ubuntu-22.04-s390x-all-linux:
  - make --output-sync check-tcg
  - make --output-sync -j`nproc` check
 
-ubuntu-22.04-s390x-all-system:
+ubuntu-24.04-s390x-all-system:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  timeout: 75m
  rules:
@@ -42,12 +42,12 @@ ubuntu-22.04-s390x-all-system:
  - make --output-sync -j`nproc`
  - make --output-sync -j`nproc` check
 
-ubuntu-22.04-s390x-alldbg:
+ubuntu-24.04-s390x-alldbg:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -65,12 +65,12 @@ ubuntu-22.04-s390x-alldbg:
  - make --output-sync -j`nproc`
  - make --output-sync -j`nproc` check
 
-ubuntu-22.04-s390x-clang:
+ubuntu-24.04-s390x-clang:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -87,11 +87,11 @@ ubuntu-22.04-s390x-clang:
  - make --output-sync -j`nproc`
  - make --output-sync -j`nproc` check
 
-ubuntu-22.04-s390x-tci:
+ubuntu-24.04-s390x-tci:
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
@@ -107,12 +107,12 @@ ubuntu-22.04-s390x-tci:
    || { cat config.log meson-logs/meson-log.txt; exit 1; }
  - make --output-sync -j`nproc`
 
-ubuntu-22.04-s390x-notcg:
+ubuntu-24.04-s390x-notcg:
  extends: .custom_runner_template
  needs: []
  stage: build
  tags:
- - ubuntu_22.04
+ - ubuntu_24.04
  - s390x
  rules:
  - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'

From 1f3a37ae1c170114ae2730176b4a8cba73abb620 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 1 Oct 2025 18:09:47 +0100
Subject: [PATCH 1064/2396] scripts/ci: use recommended registration command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The registration-token method is being deprecated:

  https://docs.gitlab.com/ci/runners/new_creation_workflow/

As a result we can drop a bunch of the descriptive stuff as that is
entered on the web UI. We don't need a secondary runner if we just
create one with both aarch64 and aarch32 tags.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251001170947.2769296-8-alex.bennee@linaro.org>
---
 scripts/ci/setup/gitlab-runner.yml | 12 ++----------
 scripts/ci/setup/vars.yml.template |  5 +++--
 2 files changed, 5 insertions(+), 12 deletions(-)

diff --git a/scripts/ci/setup/gitlab-runner.yml b/scripts/ci/setup/gitlab-runner.yml
index 7350f6cff4..7025935487 100644
--- a/scripts/ci/setup/gitlab-runner.yml
+++ b/scripts/ci/setup/gitlab-runner.yml
@@ -16,7 +16,7 @@
   tasks:
     - debug:
         msg: 'Checking for a valid GitLab registration token'
-      failed_when: "gitlab_runner_registration_token == 'PLEASE_PROVIDE_A_VALID_TOKEN'"
+      failed_when: "gitlab_runner_authentication_token == 'PLEASE_PROVIDE_A_VALID_TOKEN'"
 
     - name: Create a group for the gitlab-runner service
       group:
@@ -95,15 +95,7 @@
 
     # Register Runners
     - name: Register the gitlab-runner
-      command: "/usr/bin/gitlab-runner register --non-interactive --url {{ gitlab_runner_server_url }} --registration-token {{ gitlab_runner_registration_token }} --executor shell --tag-list {{ ansible_facts[\"architecture\"] }},{{ ansible_facts[\"distribution\"]|lower }}_{{ ansible_facts[\"distribution_version\"] }} --description '{{ ansible_facts[\"distribution\"] }} {{ ansible_facts[\"distribution_version\"] }} {{ ansible_facts[\"architecture\"] }} ({{ ansible_facts[\"os_family\"] }})'"
-
-    # The secondary runner will still run under the single gitlab-runner service
-    - name: Register secondary gitlab-runner
-      command: "/usr/bin/gitlab-runner register --non-interactive --url {{ gitlab_runner_server_url }} --registration-token {{ gitlab_runner_registration_token }} --executor shell --tag-list aarch32,{{ ansible_facts[\"distribution\"]|lower }}_{{ ansible_facts[\"distribution_version\"] }} --description '{{ ansible_facts[\"distribution\"] }} {{ ansible_facts[\"distribution_version\"] }} {{ ansible_facts[\"architecture\"] }} ({{ ansible_facts[\"os_family\"] }})'"
-      when:
-        - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['architecture'] == 'aarch64'
-        - ansible_facts['distribution_version'] == '24.04'
+      command: "/usr/bin/gitlab-runner register --non-interactive --url {{ gitlab_runner_server_url }} --token {{ gitlab_runner_authentication_token }} --executor shell"
 
     - name: Install the gitlab-runner service using its own functionality
       command: "/usr/bin/gitlab-runner install --user gitlab-runner --working-directory /home/gitlab-runner"
diff --git a/scripts/ci/setup/vars.yml.template b/scripts/ci/setup/vars.yml.template
index 4b355fb80f..e9ddc05f3b 100644
--- a/scripts/ci/setup/vars.yml.template
+++ b/scripts/ci/setup/vars.yml.template
@@ -6,5 +6,6 @@ ansible_to_gitlab_arch:
   x86_64: amd64
   aarch64: arm64
   s390x: s390x
-# A unique token made available by GitLab to your project for registering runners
-gitlab_runner_registration_token: PLEASE_PROVIDE_A_VALID_TOKEN
+# A unique token made obtained from GitLab for each runner
+# see: https://gitlab.com/PROJECT/REPO/-/runners/new
+gitlab_runner_authentication_token: PLEASE_PROVIDE_A_VALID_TOKEN

From 75b1786996c422878d09bd12f166004a7d32e459 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:12 +0000
Subject: [PATCH 1065/2396] tests/functional: Re-activate the check-venv target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add check-venv target as a dependency for the functional tests. This
causes Python modules listed in pythondeps.toml, under the testdeps
group, to be installed when 'make check-functional{-<ARCH>}' is executed
to prepare and run the functional tests.

Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-2-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/Makefile.include | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/Makefile.include b/tests/Makefile.include
index 62a4fc8ed3..e47ef4d45c 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -105,11 +105,11 @@ check-venv: $(TESTS_VENV_TOKEN)
 
 FUNCTIONAL_TARGETS=$(patsubst %-softmmu,check-functional-%, $(filter %-softmmu,$(TARGETS)))
 .PHONY: $(FUNCTIONAL_TARGETS)
-$(FUNCTIONAL_TARGETS):
+$(FUNCTIONAL_TARGETS): check-venv
 	@$(MAKE) SPEED=thorough $(subst -functional,-func,$@)
 
 .PHONY: check-functional
-check-functional:
+check-functional: check-venv
 	@$(NINJA) precache-functional
 	@QEMU_TEST_NO_DOWNLOAD=1 $(MAKE) SPEED=thorough check-func check-func-quick
 

From c8f24e1b95430759f79223dc75c66fa7ec3ef2ee Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:13 +0000
Subject: [PATCH 1066/2396] python: Install pygdbmi in meson's venv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upcoming changes in the reverse_debugging functional test to remove
Avocado as a dependency will require pygdbmi for interacting with GDB,
so install it in meson's venv (located in the build dir's pyvenv/).

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-3-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 pythondeps.toml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/pythondeps.toml b/pythondeps.toml
index 16fb2a989c..98e99e7900 100644
--- a/pythondeps.toml
+++ b/pythondeps.toml
@@ -33,3 +33,4 @@ sphinx_rtd_theme = { accepted = ">=0.5", installed = "1.2.2" }
 
 [testdeps]
 qemu.qmp = { accepted = ">=0.0.3", installed = "0.0.3" }
+pygdbmi = { accepted = ">=0.11.0.0", installed = "0.11.0.0" }

From b46b3818cf8d838991b15f20d3cb747b71ce040e Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:14 +0000
Subject: [PATCH 1067/2396] tests/functional: Provide GDB to the functional
 tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The probe of GDB is done in 'configure' and the full path is passed to
meson.build via the -Dgdb=option.

Meson then can pass the location of GDB to the functional tests via an
environment variable: QEMU_TEST_GDB.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-4-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 configure                     | 2 ++
 meson_options.txt             | 2 ++
 scripts/meson-buildoptions.sh | 2 ++
 tests/functional/meson.build  | 6 ++++++
 4 files changed, 12 insertions(+)

diff --git a/configure b/configure
index 78445cbb4b..21d1679f58 100755
--- a/configure
+++ b/configure
@@ -2003,6 +2003,8 @@ if test "$skip_meson" = no; then
   test -n "${LIB_FUZZING_ENGINE+xxx}" && meson_option_add "-Dfuzzing_engine=$LIB_FUZZING_ENGINE"
   test "$plugins" = yes && meson_option_add "-Dplugins=true"
   test "$tcg" != enabled && meson_option_add "-Dtcg=$tcg"
+  test -n "$gdb_bin" && meson_option_add "-Dgdb=$gdb_bin"
+
   run_meson() {
     NINJA=$ninja $meson setup "$@" "$PWD" "$source_path"
   }
diff --git a/meson_options.txt b/meson_options.txt
index fff1521e58..5bb41bcbc4 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -36,6 +36,8 @@ option('trace_file', type: 'string', value: 'trace',
 option('coroutine_backend', type: 'combo',
        choices: ['ucontext', 'sigaltstack', 'windows', 'wasm', 'auto'],
        value: 'auto', description: 'coroutine backend to use')
+option('gdb', type: 'string', value: '',
+       description: 'Path to GDB')
 
 # Everything else can be set via --enable/--disable-* option
 # on the configure script command line.  After adding an option
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 0ebe6bc52a..f4bd21220e 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -58,6 +58,7 @@ meson_options_help() {
   printf "%s\n" '  --enable-ubsan           enable undefined behaviour sanitizer'
   printf "%s\n" '  --firmwarepath=VALUES    search PATH for firmware files [share/qemu-'
   printf "%s\n" '                           firmware]'
+  printf "%s\n" '  --gdb=VALUE              Path to GDB'
   printf "%s\n" '  --iasl=VALUE             Path to ACPI disassembler'
   printf "%s\n" '  --includedir=VALUE       Header file directory [include]'
   printf "%s\n" '  --interp-prefix=VALUE    where to find shared libraries etc., use %M for'
@@ -323,6 +324,7 @@ _meson_option_parse() {
     --disable-fuzzing) printf "%s" -Dfuzzing=false ;;
     --enable-gcrypt) printf "%s" -Dgcrypt=enabled ;;
     --disable-gcrypt) printf "%s" -Dgcrypt=disabled ;;
+    --gdb=*) quote_sh "-Dgdb=$2" ;;
     --enable-gettext) printf "%s" -Dgettext=enabled ;;
     --disable-gettext) printf "%s" -Dgettext=disabled ;;
     --enable-gio) printf "%s" -Dgio=enabled ;;
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index 2a0c5aa141..725630d308 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -77,6 +77,12 @@ foreach speed : ['quick', 'thorough']
     test_env.set('PYTHONPATH', meson.project_source_root() / 'python:' +
                                meson.current_source_dir())
 
+    # Define the GDB environment variable if gdb is available.
+    gdb = get_option('gdb')
+    if gdb != ''
+      test_env.set('QEMU_TEST_GDB', gdb)
+    endif
+
     foreach test : target_tests
       testname = '@0@-@1@'.format(target_base, test)
       if fs.exists('generic' / 'test_' + test + '.py')

From aa7b1b726a0009c9147d9e2f64e0f6e82d4394af Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:15 +0000
Subject: [PATCH 1068/2396] tests/functional: Add GDB class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add GDB class, which provides methods to run GDB commands and capture
their output. The GDB class is a wrapper around the pygdbmi module and
interacts with GDB via GDB's machine interface (MI).

Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-5-gustavo.romero@linaro.org>
[AJB: trimmed excess license text]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/qemu_test/__init__.py |  1 +
 tests/functional/qemu_test/gdb.py      | 86 ++++++++++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 tests/functional/qemu_test/gdb.py

diff --git a/tests/functional/qemu_test/__init__.py b/tests/functional/qemu_test/__init__.py
index 6e666a059f..60d19891bf 100644
--- a/tests/functional/qemu_test/__init__.py
+++ b/tests/functional/qemu_test/__init__.py
@@ -18,3 +18,4 @@ from .decorators import skipIfMissingCommands, skipIfNotMachine, \
     skipIfMissingImports, skipIfOperatingSystem, skipLockedMemoryTest
 from .archive import archive_extract
 from .uncompress import uncompress
+from .gdb import GDB
diff --git a/tests/functional/qemu_test/gdb.py b/tests/functional/qemu_test/gdb.py
new file mode 100644
index 0000000000..558d476a68
--- /dev/null
+++ b/tests/functional/qemu_test/gdb.py
@@ -0,0 +1,86 @@
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# A simple interface module built around pygdbmi for handling GDB commands.
+#
+# Copyright (c) 2025 Linaro Limited
+#
+# Author:
+#  Gustavo Romero <gustavo.romero@linaro.org>
+#
+
+import re
+
+
+class GDB:
+    """Provides methods to run and capture GDB command output."""
+
+
+    def __init__(self, gdb_path, echo=True, suffix='# ', prompt="$ "):
+        from pygdbmi.gdbcontroller import GdbController
+        from pygdbmi.constants import GdbTimeoutError
+        type(self).TimeoutError = GdbTimeoutError
+
+        gdb_cmd = [gdb_path, "-q", "--interpreter=mi2"]
+        self.gdbmi = GdbController(gdb_cmd)
+        self.echo = echo
+        self.suffix = suffix
+        self.prompt = prompt
+        self.response = None
+        self.cmd_output = None
+
+
+    def get_payload(self, response, kind):
+        output = []
+        for o in response:
+            # Unpack payloads of the same type.
+            _type, _, payload, *_ = o.values()
+            if _type == kind:
+                output += [payload]
+
+        # Some output lines do not end with \n but begin with it,
+        # so remove the leading \n and merge them with the next line
+        # that ends with \n.
+        lines = [line.lstrip('\n') for line in output]
+        lines = "".join(lines)
+        lines = lines.splitlines(keepends=True)
+
+        return lines
+
+
+    def cli(self, cmd, timeout=32.0):
+        self.response = self.gdbmi.write(cmd, timeout_sec=timeout)
+        self.cmd_output = self.get_payload(self.response, kind="console")
+        if self.echo:
+            print(self.suffix + self.prompt + cmd)
+
+            if len(self.cmd_output) > 0:
+                cmd_output = self.suffix.join(self.cmd_output)
+                print(self.suffix + cmd_output, end="")
+
+        return self
+
+
+    def get_addr(self):
+        address_pattern = r"0x[0-9A-Fa-f]+"
+        cmd_output = "".join(self.cmd_output) # Concat output lines.
+
+        match = re.search(address_pattern, cmd_output)
+
+        return int(match[0], 16) if match else None
+
+
+    def get_log(self):
+        r = self.get_payload(self.response, kind="log")
+        r = "".join(r)
+
+        return r
+
+
+    def get_console(self):
+        r = "".join(self.cmd_output)
+
+        return r
+
+
+    def exit(self):
+        self.gdbmi.exit()

From a0ad64c390b19242ae1d246d1ccfff77dcc752a4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 3 Oct 2025 14:18:16 +0000
Subject: [PATCH 1069/2396] tests/functional: replace avocado process with
 subprocess
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The standard python subprocess.check_call method is better than
avocado.utils.process as it doesn't require stuffing all args
into a single string.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251003141820.85278-6-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/reverse_debugging.py | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/functional/reverse_debugging.py b/tests/functional/reverse_debugging.py
index f9a1d395f1..a7ff47cb90 100644
--- a/tests/functional/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -11,6 +11,7 @@
 # later.  See the COPYING file in the top-level directory.
 import os
 import logging
+from subprocess import check_output
 
 from qemu_test import LinuxKernelTest, get_qemu_img
 from qemu_test.ports import Ports
@@ -100,7 +101,6 @@ class ReverseDebugging(LinuxKernelTest):
 
     def reverse_debugging(self, shift=7, args=None):
         from avocado.utils import gdb
-        from avocado.utils import process
 
         logger = logging.getLogger('replay')
 
@@ -111,8 +111,9 @@ class ReverseDebugging(LinuxKernelTest):
         if qemu_img is None:
             self.skipTest('Could not find "qemu-img", which is required to '
                           'create the temporary qcow2 image')
-        cmd = '%s create -f qcow2 %s 128M' % (qemu_img, image_path)
-        process.run(cmd)
+        out = check_output([qemu_img, 'create', '-f', 'qcow2', image_path, '128M'],
+                           encoding='utf8')
+        logger.info("qemu-img: %s" % out)
 
         replay_path = os.path.join(self.workdir, 'replay.bin')
 

From db205774d1b2dc8e3a0e925f090a5b2f59b9bb70 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 3 Oct 2025 14:18:17 +0000
Subject: [PATCH 1070/2396] tests/functional: drop datadrainer class in reverse
 debugging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reverse debugging test uses the avocado datadrainer class to
create a background thread that reads from the console socket and
dumps it via python logger.

Most tests log console output as a side effect of doing calls
to match strings, but this test never tries to match anything.

This isn't critical, so just drop the functionality.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251003141820.85278-7-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/reverse_debugging.py | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tests/functional/reverse_debugging.py b/tests/functional/reverse_debugging.py
index a7ff47cb90..7fd8c7607f 100644
--- a/tests/functional/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -34,8 +34,6 @@ class ReverseDebugging(LinuxKernelTest):
     endian_is_le = True
 
     def run_vm(self, record, shift, args, replay_path, image_path, port):
-        from avocado.utils import datadrainer
-
         logger = logging.getLogger('replay')
         vm = self.get_vm(name='record' if record else 'replay')
         vm.set_console()
@@ -53,10 +51,6 @@ class ReverseDebugging(LinuxKernelTest):
         if args:
             vm.add_args(*args)
         vm.launch()
-        console_drainer = datadrainer.LineLogger(vm.console_socket.fileno(),
-                                    logger=self.log.getChild('console'),
-                                    stop_check=(lambda : not vm.is_running()))
-        console_drainer.start()
         return vm
 
     @staticmethod

From fb8f35949384c3a00ef56528cb43e851c95268e6 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:18 +0000
Subject: [PATCH 1071/2396] tests/functional: Add decorator to skip test on
 missing env vars
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a decorator to skip tests on missing env variable(s). Multiple
variable names can be provided and if one or more of them are not set in
the test environment the test is skipped and the missing vars are
printed out.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-8-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/qemu_test/__init__.py   |  3 ++-
 tests/functional/qemu_test/decorators.py | 18 ++++++++++++++++++
 2 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/__init__.py b/tests/functional/qemu_test/__init__.py
index 60d19891bf..320193591b 100644
--- a/tests/functional/qemu_test/__init__.py
+++ b/tests/functional/qemu_test/__init__.py
@@ -15,7 +15,8 @@ from .testcase import QemuBaseTest, QemuUserTest, QemuSystemTest
 from .linuxkernel import LinuxKernelTest
 from .decorators import skipIfMissingCommands, skipIfNotMachine, \
     skipFlakyTest, skipUntrustedTest, skipBigDataTest, skipSlowTest, \
-    skipIfMissingImports, skipIfOperatingSystem, skipLockedMemoryTest
+    skipIfMissingImports, skipIfOperatingSystem, skipLockedMemoryTest, \
+    skipIfMissingEnv
 from .archive import archive_extract
 from .uncompress import uncompress
 from .gdb import GDB
diff --git a/tests/functional/qemu_test/decorators.py b/tests/functional/qemu_test/decorators.py
index c0d1567b14..b239295804 100644
--- a/tests/functional/qemu_test/decorators.py
+++ b/tests/functional/qemu_test/decorators.py
@@ -11,6 +11,24 @@ from unittest import skipIf, skipUnless
 from .cmd import which
 
 '''
+Decorator to skip execution of a test if the provided
+environment variables are not set.
+Example:
+
+  @skipIfMissingEnv("QEMU_ENV_VAR0", "QEMU_ENV_VAR1")
+'''
+def skipIfMissingEnv(*vars_):
+    missing_vars = []
+    for var in vars_:
+        if os.getenv(var) == None:
+            missing_vars.append(var)
+
+    has_vars = True if len(missing_vars) == 0 else False
+
+    return skipUnless(has_vars, f"Missing env var(s): {', '.join(missing_vars)}")
+
+'''
+
 Decorator to skip execution of a test if the list
 of command binaries is not available in $PATH.
 Example:

From bddce216192122c51ff7fef171a16af9da514b61 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:19 +0000
Subject: [PATCH 1072/2396] tests/functional: Adapt reverse_debugging to run
 w/o Avocado
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit removes Avocado as a dependency for running the
reverse_debugging test.

The main benefit, beyond eliminating an extra dependency, is that there
is no longer any need to handle GDB packets manually. This removes the
need for ad-hoc functions dealing with endianness and arch-specific
register numbers, making the test easier to read. The timeout variable
is also removed, since Meson now manages timeouts automatically.

reverse_debugging now uses the pygdbmi module to interact with GDB, if
it is available in the test environment, otherwise the test is skipped.
GDB is detect via the QEMU_TEST_GDB env. variable.

This commit also significantly improves the output for the test and
now prints all the GDB commands used in sequence. It also adds
some clarifications to existing comments, for example, clarifying that
once the replay-break is reached, a SIGINT is captured in GDB.

reverse_debugging is kept "skipped" for aarch64, ppc64, and x86_64, so
won't run unless QEMU_TEST_FLAKY_TESTS=1 is set in the test environment,
before running 'make check-functional' or 'meson test [...]'.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-9-gustavo.romero@linaro.org>
[AJB: it is and broke long line]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/reverse_debugging.py | 139 ++++++++++++++------------
 1 file changed, 75 insertions(+), 64 deletions(-)

diff --git a/tests/functional/reverse_debugging.py b/tests/functional/reverse_debugging.py
index 7fd8c7607f..68cfcb3985 100644
--- a/tests/functional/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -1,19 +1,23 @@
-# Reverse debugging test
-#
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
+# Reverse debugging test
+#
 # Copyright (c) 2020 ISP RAS
+# Copyright (c) 2025 Linaro Limited
 #
 # Author:
 #  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#  Gustavo Romero <gustavo.romero@linaro.org> (Run without Avocado)
 #
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
-import os
+
 import logging
+import os
 from subprocess import check_output
 
-from qemu_test import LinuxKernelTest, get_qemu_img
+from qemu_test import LinuxKernelTest, get_qemu_img, GDB, \
+    skipIfMissingEnv, skipIfMissingImports
 from qemu_test.ports import Ports
 
 
@@ -29,9 +33,7 @@ class ReverseDebugging(LinuxKernelTest):
     that the execution is stopped at the last of them.
     """
 
-    timeout = 10
     STEPS = 10
-    endian_is_le = True
 
     def run_vm(self, record, shift, args, replay_path, image_path, port):
         logger = logging.getLogger('replay')
@@ -54,47 +56,17 @@ class ReverseDebugging(LinuxKernelTest):
         return vm
 
     @staticmethod
-    def get_reg_le(g, reg):
-        res = g.cmd(b'p%x' % reg)
-        num = 0
-        for i in range(len(res))[-2::-2]:
-            num = 0x100 * num + int(res[i:i + 2], 16)
-        return num
-
-    @staticmethod
-    def get_reg_be(g, reg):
-        res = g.cmd(b'p%x' % reg)
-        return int(res, 16)
-
-    def get_reg(self, g, reg):
-        # value may be encoded in BE or LE order
-        if self.endian_is_le:
-            return self.get_reg_le(g, reg)
-        else:
-            return self.get_reg_be(g, reg)
-
-    def get_pc(self, g):
-        return self.get_reg(g, self.REG_PC)
-
-    def check_pc(self, g, addr):
-        pc = self.get_pc(g)
-        if pc != addr:
-            self.fail('Invalid PC (read %x instead of %x)' % (pc, addr))
-
-    @staticmethod
-    def gdb_step(g):
-        g.cmd(b's', b'T05thread:01;')
-
-    @staticmethod
-    def gdb_bstep(g):
-        g.cmd(b'bs', b'T05thread:01;')
+    def get_pc(gdb: GDB):
+        return gdb.cli("print $pc").get_addr()
 
     @staticmethod
     def vm_get_icount(vm):
         return vm.qmp('query-replay')['return']['icount']
 
-    def reverse_debugging(self, shift=7, args=None):
-        from avocado.utils import gdb
+    @skipIfMissingImports("pygdbmi") # Required by GDB class
+    @skipIfMissingEnv("QEMU_TEST_GDB")
+    def reverse_debugging(self, gdb_arch, shift=7, args=None):
+        from qemu_test import GDB
 
         logger = logging.getLogger('replay')
 
@@ -124,68 +96,107 @@ class ReverseDebugging(LinuxKernelTest):
         with Ports() as ports:
             port = ports.find_free_port()
             vm = self.run_vm(False, shift, args, replay_path, image_path, port)
-        logger.info('connecting to gdbstub')
-        g = gdb.GDBRemote('127.0.0.1', port, False, False)
-        g.connect()
-        r = g.cmd(b'qSupported')
-        if b'qXfer:features:read+' in r:
-            g.cmd(b'qXfer:features:read:target.xml:0,ffb')
-        if b'ReverseStep+' not in r:
+
+        try:
+            logger.info('Connecting to gdbstub...')
+            self.reverse_debugging_run(vm, port, gdb_arch, last_icount)
+            logger.info('Test passed.')
+        except GDB.TimeoutError:
+            # Convert a GDB timeout exception into a unittest failure exception.
+            raise self.failureException("Timeout while connecting to or "
+                                        "communicating with gdbstub...") from None
+        except Exception:
+            # Re-throw exceptions from unittest, like the ones caused by fail(),
+            # skipTest(), etc.
+            raise
+
+    def reverse_debugging_run(self, vm, port, gdb_arch, last_icount):
+        logger = logging.getLogger('replay')
+
+        gdb_cmd = os.getenv('QEMU_TEST_GDB')
+        gdb = GDB(gdb_cmd)
+
+        r = gdb.cli("set architecture").get_log()
+        if gdb_arch not in r:
+            self.skipTest(f"GDB does not support arch '{gdb_arch}'")
+
+        gdb.cli("set debug remote 1")
+
+        c = gdb.cli(f"target remote localhost:{port}").get_console()
+        if not f"Remote debugging using localhost:{port}" in c:
+            self.fail("Could not connect to gdbstub!")
+
+        # Remote debug messages are in 'log' payloads.
+        r = gdb.get_log()
+        if 'ReverseStep+' not in r:
             self.fail('Reverse step is not supported by QEMU')
-        if b'ReverseContinue+' not in r:
+        if 'ReverseContinue+' not in r:
             self.fail('Reverse continue is not supported by QEMU')
 
+        gdb.cli("set debug remote 0")
+
         logger.info('stepping forward')
         steps = []
         # record first instruction addresses
         for _ in range(self.STEPS):
-            pc = self.get_pc(g)
+            pc = self.get_pc(gdb)
             logger.info('saving position %x' % pc)
             steps.append(pc)
-            self.gdb_step(g)
+            gdb.cli("stepi")
 
         # visit the recorded instruction in reverse order
         logger.info('stepping backward')
         for addr in steps[::-1]:
-            self.gdb_bstep(g)
-            self.check_pc(g, addr)
             logger.info('found position %x' % addr)
+            gdb.cli("reverse-stepi")
+            pc = self.get_pc(gdb)
+            if pc != addr:
+                logger.info('Invalid PC (read %x instead of %x)' % (pc, addr))
+                self.fail('Reverse stepping failed!')
 
         # visit the recorded instruction in forward order
         logger.info('stepping forward')
         for addr in steps:
-            self.check_pc(g, addr)
-            self.gdb_step(g)
             logger.info('found position %x' % addr)
+            pc = self.get_pc(gdb)
+            if pc != addr:
+                logger.info('Invalid PC (read %x instead of %x)' % (pc, addr))
+                self.fail('Forward stepping failed!')
+            gdb.cli("stepi")
 
         # set breakpoints for the instructions just stepped over
         logger.info('setting breakpoints')
         for addr in steps:
-            # hardware breakpoint at addr with len=1
-            g.cmd(b'Z1,%x,1' % addr, b'OK')
+            gdb.cli(f"break *{hex(addr)}")
 
         # this may hit a breakpoint if first instructions are executed
         # again
         logger.info('continuing execution')
         vm.qmp('replay-break', icount=last_icount - 1)
         # continue - will return after pausing
-        # This could stop at the end and get a T02 return, or by
-        # re-executing one of the breakpoints and get a T05 return.
-        g.cmd(b'c')
+        # This can stop at the end of the replay-break and gdb gets a SIGINT,
+        # or by re-executing one of the breakpoints and gdb stops at a
+        # breakpoint.
+        gdb.cli("continue")
+
         if self.vm_get_icount(vm) == last_icount - 1:
             logger.info('reached the end (icount %s)' % (last_icount - 1))
         else:
             logger.info('hit a breakpoint again at %x (icount %s)' %
-                        (self.get_pc(g), self.vm_get_icount(vm)))
+                        (self.get_pc(gdb), self.vm_get_icount(vm)))
 
         logger.info('running reverse continue to reach %x' % steps[-1])
         # reverse continue - will return after stopping at the breakpoint
-        g.cmd(b'bc', b'T05thread:01;')
+        gdb.cli("reverse-continue")
 
         # assume that none of the first instructions is executed again
         # breaking the order of the breakpoints
-        self.check_pc(g, steps[-1])
+        pc = self.get_pc(gdb)
+        if pc != steps[-1]:
+            self.fail("'reverse-continue' did not hit the first PC in reverse order!")
+
         logger.info('successfully reached %x' % steps[-1])
 
         logger.info('exiting gdb and qemu')
+        gdb.exit()
         vm.shutdown()

From 4d3eb329ccf34da76b0b7822eecaaacc6e6fe646 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Fri, 3 Oct 2025 14:18:20 +0000
Subject: [PATCH 1073/2396] tests/functional: Adapt arches to reverse_debugging
 w/o Avocado
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

reverse_debugging no longer depends on Avocado, so remove the import
checks for Avocado, the per-arch endianness tweaks, and the per-arch
register settings. All of these are now handled in the ReverseDebugging
class, automatically.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-ID: <20251003141820.85278-10-gustavo.romero@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/aarch64/test_reverse_debug.py | 11 +++++------
 tests/functional/ppc64/test_reverse_debug.py   | 15 ++++++---------
 tests/functional/x86_64/test_reverse_debug.py  | 15 +++++----------
 3 files changed, 16 insertions(+), 25 deletions(-)

diff --git a/tests/functional/aarch64/test_reverse_debug.py b/tests/functional/aarch64/test_reverse_debug.py
index 8bc91ccfde..906f10aec5 100755
--- a/tests/functional/aarch64/test_reverse_debug.py
+++ b/tests/functional/aarch64/test_reverse_debug.py
@@ -2,25 +2,24 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
-# Reverse debugging test
+# Reverse debugging test for aarch64
 #
 # Copyright (c) 2020 ISP RAS
+# Copyright (c) 2025 Linaro Limited
 #
 # Author:
 #  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#  Gustavo Romero <gustavo.romero@linaro.org> (Run without Avocado)
 #
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-from qemu_test import Asset, skipIfMissingImports, skipFlakyTest
+from qemu_test import Asset, skipFlakyTest
 from reverse_debugging import ReverseDebugging
 
 
-@skipIfMissingImports('avocado.utils')
 class ReverseDebugging_AArch64(ReverseDebugging):
 
-    REG_PC = 32
-
     ASSET_KERNEL = Asset(
         ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'
          'releases/29/Everything/aarch64/os/images/pxeboot/vmlinuz'),
@@ -31,7 +30,7 @@ class ReverseDebugging_AArch64(ReverseDebugging):
         self.set_machine('virt')
         self.cpu = 'cortex-a53'
         kernel_path = self.ASSET_KERNEL.fetch()
-        self.reverse_debugging(args=('-kernel', kernel_path))
+        self.reverse_debugging(gdb_arch='aarch64', args=('-kernel', kernel_path))
 
 
 if __name__ == '__main__':
diff --git a/tests/functional/ppc64/test_reverse_debug.py b/tests/functional/ppc64/test_reverse_debug.py
index 5931adef5a..69551fb84d 100755
--- a/tests/functional/ppc64/test_reverse_debug.py
+++ b/tests/functional/ppc64/test_reverse_debug.py
@@ -2,39 +2,36 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
-# Reverse debugging test
+# Reverse debugging test for ppc64
 #
 # Copyright (c) 2020 ISP RAS
+# Copyright (c) 2025 Linaro Limited
 #
 # Author:
 #  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#  Gustavo Romero <gustavo.romero@linaro.org> (Run without Avocado)
 #
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-from qemu_test import skipIfMissingImports, skipFlakyTest
+from qemu_test import skipFlakyTest
 from reverse_debugging import ReverseDebugging
 
 
-@skipIfMissingImports('avocado.utils')
 class ReverseDebugging_ppc64(ReverseDebugging):
 
-    REG_PC = 0x40
-
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/1992")
     def test_ppc64_pseries(self):
         self.set_machine('pseries')
         # SLOF branches back to its entry point, which causes this test
         # to take the 'hit a breakpoint again' path. That's not a problem,
         # just slightly different than the other machines.
-        self.endian_is_le = False
-        self.reverse_debugging()
+        self.reverse_debugging(gdb_arch='powerpc:common64')
 
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/1992")
     def test_ppc64_powernv(self):
         self.set_machine('powernv')
-        self.endian_is_le = False
-        self.reverse_debugging()
+        self.reverse_debugging(gdb_arch='powerpc:common64')
 
 
 if __name__ == '__main__':
diff --git a/tests/functional/x86_64/test_reverse_debug.py b/tests/functional/x86_64/test_reverse_debug.py
index d713e91e14..2b31ae8724 100755
--- a/tests/functional/x86_64/test_reverse_debug.py
+++ b/tests/functional/x86_64/test_reverse_debug.py
@@ -2,34 +2,29 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 #
-# Reverse debugging test
+# Reverse debugging test for x86_64
 #
 # Copyright (c) 2020 ISP RAS
+# Copyright (c) 2025 Linaro Limited
 #
 # Author:
 #  Pavel Dovgalyuk <Pavel.Dovgalyuk@ispras.ru>
+#  Gustavo Romero <gustavo.romero@linaro.org> (Run without Avocado)
 #
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-from qemu_test import skipIfMissingImports, skipFlakyTest
+from qemu_test import skipFlakyTest
 from reverse_debugging import ReverseDebugging
 
 
-@skipIfMissingImports('avocado.utils')
 class ReverseDebugging_X86_64(ReverseDebugging):
 
-    REG_PC = 0x10
-    REG_CS = 0x12
-    def get_pc(self, g):
-        return self.get_reg_le(g, self.REG_PC) \
-            + self.get_reg_le(g, self.REG_CS) * 0x10
-
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2922")
     def test_x86_64_pc(self):
         self.set_machine('pc')
         # start with BIOS only
-        self.reverse_debugging()
+        self.reverse_debugging(gdb_arch='x86-64')
 
 
 if __name__ == '__main__':

From 41f8f2be27736192bab29aa38380c9ebaae810fa Mon Sep 17 00:00:00 2001
From: Vladimir Lukianov <1844144@gmail.com>
Date: Tue, 3 Jun 2025 14:54:59 +0200
Subject: [PATCH 1074/2396] record/replay: fix race condition on
 test_aarch64_reverse_debug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Ensures EVENT_INSTRUCTION written to replay.bin before EVENT_SHUTDOWN_HOST_QMP

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2921
Signed-off-by: Vladimir Lukianov <1844144@gmail.com>
Message-ID: <20250603125459.17688-1-1844144@gmail.com>
[AJB: fix re-base file mode]
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 replay/replay.c                                | 2 ++
 tests/functional/aarch64/test_reverse_debug.py | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/replay/replay.c b/replay/replay.c
index a3e24c967a..b2121788c1 100644
--- a/replay/replay.c
+++ b/replay/replay.c
@@ -263,6 +263,8 @@ bool replay_has_interrupt(void)
 
 void replay_shutdown_request(ShutdownCause cause)
 {
+    replay_save_instructions();
+
     if (replay_mode == REPLAY_MODE_RECORD) {
         g_assert(replay_mutex_locked());
         replay_put_event(EVENT_SHUTDOWN + cause);
diff --git a/tests/functional/aarch64/test_reverse_debug.py b/tests/functional/aarch64/test_reverse_debug.py
index 906f10aec5..ec3348c96d 100755
--- a/tests/functional/aarch64/test_reverse_debug.py
+++ b/tests/functional/aarch64/test_reverse_debug.py
@@ -25,7 +25,6 @@ class ReverseDebugging_AArch64(ReverseDebugging):
          'releases/29/Everything/aarch64/os/images/pxeboot/vmlinuz'),
         '7e1430b81c26bdd0da025eeb8fbd77b5dc961da4364af26e771bd39f379cbbf7')
 
-    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2921")
     def test_aarch64_virt(self):
         self.set_machine('virt')
         self.cpu = 'cortex-a53'

From a23e719ca8e80d22eafe4b2b57833918d439fa0c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 25 Sep 2025 12:57:23 +0100
Subject: [PATCH 1075/2396] target/arm: Don't set HCR.RW for AArch32 only CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit 39ec3fc0301 we fixed a bug where we were not implementing
HCR_EL2.RW as RAO/WI for CPUs where EL1 doesn't support AArch32.
However, we got the condition wrong, so we now set this bit even on
CPUs which have no AArch64 support at all.  This is wrong because the
AArch32 HCR register defines this bit as RES0.

Correct the condition we use for forcing HCR_RW to be set.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3128
Fixes: 39ec3fc0301 ("target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250925115723.1293233-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index aa730addf2..792a47a9c5 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3742,7 +3742,8 @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
     value &= valid_mask;
 
     /* RW is RAO/WI if EL1 is AArch64 only */
-    if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
+    if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+        !cpu_isar_feature(aa64_aa32_el1, cpu)) {
         value |= HCR_RW;
     }
 

From 3471ae96b10bc0a1efeeeff85aea7a823cb57f77 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:19 +0200
Subject: [PATCH 1076/2396] hw/arm/xlnx-versal: split the xlnx-versal type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split the xlnx-versal device into two classes, a base, abstract class
and the existing concrete one. Introduce a VersalVersion type that will
be used across several device models when versal2 implementation is
added.

This is in preparation for versal2 implementation.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-2-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c                 | 31 +++++++++++++++++++++-------
 include/hw/arm/xlnx-versal-version.h | 15 ++++++++++++++
 include/hw/arm/xlnx-versal.h         | 12 ++++++++++-
 3 files changed, 50 insertions(+), 8 deletions(-)
 create mode 100644 include/hw/arm/xlnx-versal-version.h

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index a42b9e7140..4da656318f 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -2,6 +2,7 @@
  * Xilinx Versal SoC model.
  *
  * Copyright (c) 2018 Xilinx Inc.
+ * Copyright (c) 2025 Advanced Micro Devices, Inc.
  * Written by Edgar E. Iglesias
  *
  * This program is free software; you can redistribute it and/or modify
@@ -920,7 +921,7 @@ static void versal_unimp(Versal *s)
 
 static void versal_realize(DeviceState *dev, Error **errp)
 {
-    Versal *s = XLNX_VERSAL(dev);
+    Versal *s = XLNX_VERSAL_BASE(dev);
     qemu_irq pic[XLNX_VERSAL_NR_IRQS];
 
     versal_create_apu_cpus(s);
@@ -955,9 +956,9 @@ static void versal_realize(DeviceState *dev, Error **errp)
                                         &s->lpd.rpu.mr_ps_alias, 0);
 }
 
-static void versal_init(Object *obj)
+static void versal_base_init(Object *obj)
 {
-    Versal *s = XLNX_VERSAL(obj);
+    Versal *s = XLNX_VERSAL_BASE(obj);
 
     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
     memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
@@ -975,7 +976,7 @@ static const Property versal_properties[] = {
                       TYPE_CAN_BUS, CanBusState *),
 };
 
-static void versal_class_init(ObjectClass *klass, const void *data)
+static void versal_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
@@ -984,16 +985,32 @@ static void versal_class_init(ObjectClass *klass, const void *data)
     /* No VMSD since we haven't got any top-level SoC state to save.  */
 }
 
-static const TypeInfo versal_info = {
-    .name = TYPE_XLNX_VERSAL,
+static void versal_class_init(ObjectClass *klass, const void *data)
+{
+    VersalClass *vc = XLNX_VERSAL_BASE_CLASS(klass);
+
+    vc->version = VERSAL_VER_VERSAL;
+}
+
+static const TypeInfo versal_base_info = {
+    .name = TYPE_XLNX_VERSAL_BASE,
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Versal),
-    .instance_init = versal_init,
+    .instance_init = versal_base_init,
+    .class_init = versal_base_class_init,
+    .class_size = sizeof(VersalClass),
+    .abstract = true,
+};
+
+static const TypeInfo versal_info = {
+    .name = TYPE_XLNX_VERSAL,
+    .parent = TYPE_XLNX_VERSAL_BASE,
     .class_init = versal_class_init,
 };
 
 static void versal_register_types(void)
 {
+    type_register_static(&versal_base_info);
     type_register_static(&versal_info);
 }
 
diff --git a/include/hw/arm/xlnx-versal-version.h b/include/hw/arm/xlnx-versal-version.h
new file mode 100644
index 0000000000..c4307d1304
--- /dev/null
+++ b/include/hw/arm/xlnx-versal-version.h
@@ -0,0 +1,15 @@
+/*
+ * AMD Versal versions
+ *
+ * Copyright (c) 2025 Advanced Micro Devices, Inc.
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_ARM_XLNX_VERSAL_VERSION_H
+#define HW_ARM_XLNX_VERSAL_VERSION_H
+
+typedef enum VersalVersion {
+    VERSAL_VER_VERSAL,
+} VersalVersion;
+
+#endif
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 05ed641b6b..1f92e314d6 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -2,6 +2,7 @@
  * Model of the Xilinx Versal
  *
  * Copyright (c) 2018 Xilinx Inc.
+ * Copyright (c) 2025 Advanced Micro Devices, Inc.
  * Written by Edgar E. Iglesias
  *
  * This program is free software; you can redistribute it and/or modify
@@ -35,9 +36,12 @@
 #include "hw/misc/xlnx-versal-cfu.h"
 #include "hw/misc/xlnx-versal-cframe-reg.h"
 #include "target/arm/cpu.h"
+#include "hw/arm/xlnx-versal-version.h"
+
+#define TYPE_XLNX_VERSAL_BASE "xlnx-versal-base"
+OBJECT_DECLARE_TYPE(Versal, VersalClass, XLNX_VERSAL_BASE)
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
-OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
 
 #define XLNX_VERSAL_NR_ACPUS   2
 #define XLNX_VERSAL_NR_RCPUS   2
@@ -137,6 +141,12 @@ struct Versal {
     } cfg;
 };
 
+struct VersalClass {
+    SysBusDeviceClass parent;
+
+    VersalVersion version;
+};
+
 /* Memory-map and IRQ definitions. Copied a subset from
  * auto-generated files.  */
 

From d82be8c5de7a8bc1602b89678e69312c1716bd10 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:20 +0200
Subject: [PATCH 1077/2396] hw/arm/xlnx-versal: prepare for FDT creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The following commits will move FDT creation logic from the
xlnx-versal-virt machine to the xlnx-versal SoC itself. Prepare this by
passing the FDT handle to the SoC before it is realized.

For now the SoC only creates the two clock nodes. The ones from the
xlnx-versal virt machine are renamed with a `old-' prefix and will be
removed once they are not referenced anymore.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-3-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  9 ++++++---
 hw/arm/xlnx-versal.c         | 24 ++++++++++++++++++++++++
 include/hw/arm/xlnx-versal.h | 12 ++++++++++++
 3 files changed, 42 insertions(+), 3 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index adadbb7290..d1c65afa2a 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -2,6 +2,7 @@
  * Xilinx Versal Virtual board.
  *
  * Copyright (c) 2018 Xilinx Inc.
+ * Copyright (c) 2025 Advanced Micro Devices, Inc.
  * Written by Edgar E. Iglesias
  *
  * This program is free software; you can redistribute it and/or modify
@@ -697,10 +698,12 @@ static void versal_virt_init(MachineState *machine)
                              &error_abort);
     object_property_set_link(OBJECT(&s->soc), "canbus1", OBJECT(s->canbus[1]),
                              &error_abort);
-    sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
 
     fdt_create(s);
+    versal_set_fdt(&s->soc, s->fdt);
+    sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
     create_virtio_regions(s);
+
     fdt_add_gem_nodes(s);
     fdt_add_uart_nodes(s);
     fdt_add_canfd_nodes(s);
@@ -714,8 +717,8 @@ static void versal_virt_init(MachineState *machine)
     fdt_add_efuse_ctrl_node(s);
     fdt_add_efuse_cache_node(s);
     fdt_add_cpu_nodes(s, psci_conduit);
-    fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);
-    fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);
+    fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
+    fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
 
     /* Make the APU cpu address space visible to virtio and other
      * modules unaware of multiple address-spaces.  */
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 4da656318f..3b59621956 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -24,6 +24,8 @@
 #include "qemu/log.h"
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
+#include "system/device_tree.h"
+#include "hw/arm/fdt.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -919,11 +921,33 @@ static void versal_unimp(Versal *s)
                                 gpio_in);
 }
 
+static uint32_t fdt_add_clk_node(Versal *s, const char *name,
+                                 unsigned int freq_hz)
+{
+    uint32_t phandle;
+
+    phandle = qemu_fdt_alloc_phandle(s->cfg.fdt);
+
+    qemu_fdt_add_subnode(s->cfg.fdt, name);
+    qemu_fdt_setprop_cell(s->cfg.fdt, name, "phandle", phandle);
+    qemu_fdt_setprop_cell(s->cfg.fdt, name, "clock-frequency", freq_hz);
+    qemu_fdt_setprop_cell(s->cfg.fdt, name, "#clock-cells", 0x0);
+    qemu_fdt_setprop_string(s->cfg.fdt, name, "compatible", "fixed-clock");
+    qemu_fdt_setprop(s->cfg.fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
+
+    return phandle;
+}
+
 static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
     qemu_irq pic[XLNX_VERSAL_NR_IRQS];
 
+    g_assert(s->cfg.fdt != NULL);
+
+    s->phandle.clk_25mhz = fdt_add_clk_node(s, "/clk25", 25 * 1000 * 1000);
+    s->phandle.clk_125mhz = fdt_add_clk_node(s, "/clk125", 125 * 1000 * 1000);
+
     versal_create_apu_cpus(s);
     versal_create_apu_gic(s, pic);
     versal_create_rpu_cpus(s);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 1f92e314d6..f2a62b4355 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -136,8 +136,14 @@ struct Versal {
         OrIRQState apb_irq_orgate;
     } pmc;
 
+    struct {
+        uint32_t clk_25mhz;
+        uint32_t clk_125mhz;
+    } phandle;
+
     struct {
         MemoryRegion *mr_ddr;
+        void *fdt;
     } cfg;
 };
 
@@ -147,6 +153,12 @@ struct VersalClass {
     VersalVersion version;
 };
 
+static inline void versal_set_fdt(Versal *s, void *fdt)
+{
+    g_assert(!qdev_is_realized(DEVICE(s)));
+    s->cfg.fdt = fdt;
+}
+
 /* Memory-map and IRQ definitions. Copied a subset from
  * auto-generated files.  */
 

From 288dc87244c97c8674967c12bb5c8e38fd7d9ff5 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:21 +0200
Subject: [PATCH 1078/2396] hw/arm/xlnx-versal: uart: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the UARTs creations. The VersalMap struct is now used to
describe the SoC and its peripherals. For now it contains the two UARTs
mapping information. The creation function now embeds the FDT creation
logic as well. The devices are now created dynamically using qdev_new
and (qdev|sysbus)_realize_and_unref.

This will allow to rely entirely on the VersalMap structure to create
the SoC and allow easy addition of new SoCs of the same family (like
versal2 coming with next commits).

Note that the connection to the CRL is removed for now and will be
re-added by next commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-4-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  36 +--------
 hw/arm/xlnx-versal.c         | 144 ++++++++++++++++++++++++++++-------
 include/hw/arm/xlnx-versal.h |   2 -
 3 files changed, 119 insertions(+), 63 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index d1c65afa2a..e1deae1131 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -77,6 +77,7 @@ static void fdt_create(VersalVirt *s)
     s->phandle.dwc = qemu_fdt_alloc_phandle(s->fdt);
     /* Create /chosen node for load_dtb.  */
     qemu_fdt_add_subnode(s->fdt, "/chosen");
+    qemu_fdt_add_subnode(s->fdt, "/aliases");
 
     /* Header */
     qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
@@ -208,40 +209,6 @@ static void fdt_add_usb_xhci_nodes(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_uart_nodes(VersalVirt *s)
-{
-    uint64_t addrs[] = { MM_UART1, MM_UART0 };
-    unsigned int irqs[] = { VERSAL_UART1_IRQ_0, VERSAL_UART0_IRQ_0 };
-    const char compat[] = "arm,pl011\0arm,sbsa-uart";
-    const char clocknames[] = "uartclk\0apb_pclk";
-    int i;
-
-    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
-        char *name = g_strdup_printf("/uart@%" PRIx64, addrs[i]);
-        qemu_fdt_add_subnode(s->fdt, name);
-        qemu_fdt_setprop_cell(s->fdt, name, "current-speed", 115200);
-        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
-        qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                     2, addrs[i], 2, 0x1000);
-        qemu_fdt_setprop(s->fdt, name, "compatible",
-                         compat, sizeof(compat));
-        qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
-
-        if (addrs[i] == MM_UART0) {
-            /* Select UART0.  */
-            qemu_fdt_setprop_string(s->fdt, "/chosen", "stdout-path", name);
-        }
-        g_free(name);
-    }
-}
-
 static void fdt_add_canfd_nodes(VersalVirt *s)
 {
     uint64_t addrs[] = { MM_CANFD1, MM_CANFD0 };
@@ -705,7 +672,6 @@ static void versal_virt_init(MachineState *machine)
     create_virtio_regions(s);
 
     fdt_add_gem_nodes(s);
-    fdt_add_uart_nodes(s);
     fdt_add_canfd_nodes(s);
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 3b59621956..b16af79e8a 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -26,6 +26,7 @@
 #include "target/arm/gtimer.h"
 #include "system/device_tree.h"
 #include "hw/arm/fdt.h"
+#include "hw/char/pl011.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -34,6 +35,83 @@
 #define VERSAL_NUM_PMC_APB_IRQS 18
 #define NUM_OSPI_IRQ_LINES 3
 
+typedef struct VersalSimplePeriphMap {
+    uint64_t addr;
+    int irq;
+} VersalSimplePeriphMap;
+
+typedef struct VersalMap {
+    VersalSimplePeriphMap uart[2];
+    size_t num_uart;
+} VersalMap;
+
+static const VersalMap VERSAL_MAP = {
+    .uart[0] = { 0xff000000, 18 },
+    .uart[1] = { 0xff010000, 19 },
+    .num_uart = 2,
+};
+
+static const VersalMap *VERSION_TO_MAP[] = {
+    [VERSAL_VER_VERSAL] = &VERSAL_MAP,
+};
+
+static inline VersalVersion versal_get_version(Versal *s)
+{
+    return XLNX_VERSAL_BASE_GET_CLASS(s)->version;
+}
+
+static inline const VersalMap *versal_get_map(Versal *s)
+{
+    return VERSION_TO_MAP[versal_get_version(s)];
+}
+
+
+static qemu_irq versal_get_irq(Versal *s, int irq_idx)
+{
+    return qdev_get_gpio_in(DEVICE(&s->fpd.apu.gic), irq_idx);
+}
+
+static void versal_sysbus_connect_irq(Versal *s, SysBusDevice *sbd,
+                                      int sbd_idx, int irq_idx)
+{
+    qemu_irq irq = versal_get_irq(s, irq_idx);
+
+    if (irq == NULL) {
+        return;
+    }
+
+    sysbus_connect_irq(sbd, sbd_idx, irq);
+}
+
+static inline char *versal_fdt_add_subnode(Versal *s, const char *path,
+                                           uint64_t at, const char *compat,
+                                           size_t compat_sz)
+{
+    char *p;
+
+    p = g_strdup_printf("%s@%" PRIx64, path, at);
+    qemu_fdt_add_subnode(s->cfg.fdt, p);
+
+    if (!strncmp(compat, "memory", compat_sz)) {
+        qemu_fdt_setprop(s->cfg.fdt, p, "device_type", compat, compat_sz);
+    } else {
+        qemu_fdt_setprop(s->cfg.fdt, p, "compatible", compat, compat_sz);
+    }
+
+    return p;
+}
+
+static inline char *versal_fdt_add_simple_subnode(Versal *s, const char *path,
+                                                  uint64_t addr, uint64_t len,
+                                                  const char *compat,
+                                                  size_t compat_sz)
+{
+    char *p = versal_fdt_add_subnode(s, path, addr, compat, compat_sz);
+
+    qemu_fdt_setprop_sized_cells(s->cfg.fdt, p, "reg", 2, addr, 2, len);
+    return p;
+}
+
 static void versal_create_apu_cpus(Versal *s)
 {
     int i;
@@ -167,28 +245,44 @@ static void versal_create_rpu_cpus(Versal *s)
     qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
 }
 
-static void versal_create_uarts(Versal *s, qemu_irq *pic)
+static void versal_create_uart(Versal *s,
+                               const VersalSimplePeriphMap *map,
+                               int chardev_idx)
 {
-    int i;
+    DeviceState *dev;
+    MemoryRegion *mr;
+    g_autofree char *node;
+    g_autofree char *alias;
+    const char compatible[] = "arm,pl011\0arm,sbsa-uart";
+    const char clocknames[] = "uartclk\0apb_pclk";
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
-        static const int irqs[] = { VERSAL_UART0_IRQ_0, VERSAL_UART1_IRQ_0};
-        static const uint64_t addrs[] = { MM_UART0, MM_UART1 };
-        char *name = g_strdup_printf("uart%d", i);
-        DeviceState *dev;
-        MemoryRegion *mr;
+    dev = qdev_new(TYPE_PL011);
+    object_property_add_child(OBJECT(s), "uart[*]", OBJECT(dev));
+    qdev_prop_set_chr(dev, "chardev", serial_hd(chardev_idx));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-        object_initialize_child(OBJECT(s), name, &s->lpd.iou.uart[i],
-                                TYPE_PL011);
-        dev = DEVICE(&s->lpd.iou.uart[i]);
-        qdev_prop_set_chr(dev, "chardev", serial_hd(i));
-        sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_add_subregion(&s->mr_ps, map->addr, mr);
 
-        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
-        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->irq);
 
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[irqs[i]]);
-        g_free(name);
+    node = versal_fdt_add_simple_subnode(s, "/uart", map->addr, 0x1000,
+                                         compatible, sizeof(compatible));
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "current-speed", 115200);
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                           s->phandle.clk_125mhz, s->phandle.clk_125mhz);
+    qemu_fdt_setprop(s->cfg.fdt, node, "clock-names", clocknames,
+                     sizeof(clocknames));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                           GIC_FDT_IRQ_TYPE_SPI, map->irq,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop(s->cfg.fdt, node, "u-boot,dm-pre-reloc", NULL, 0);
+
+    alias = g_strdup_printf("serial%d", chardev_idx);
+    qemu_fdt_setprop_string(s->cfg.fdt, "/aliases", alias, node);
+
+    if (chardev_idx == 0) {
+        qemu_fdt_setprop_string(s->cfg.fdt, "/chosen", "stdout-path", node);
     }
 }
 
@@ -783,14 +877,6 @@ static void versal_create_crl(Versal *s, qemu_irq *pic)
                                  &error_abort);
     }
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.uart); i++) {
-        g_autofree gchar *name = g_strdup_printf("uart[%d]", i);
-
-        object_property_set_link(OBJECT(&s->lpd.crl),
-                                 name, OBJECT(&s->lpd.iou.uart[i]),
-                                 &error_abort);
-    }
-
     object_property_set_link(OBJECT(&s->lpd.crl),
                              "usb", OBJECT(&s->lpd.iou.usb),
                              &error_abort);
@@ -942,6 +1028,8 @@ static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
     qemu_irq pic[XLNX_VERSAL_NR_IRQS];
+    const VersalMap *map = versal_get_map(s);
+    size_t i;
 
     g_assert(s->cfg.fdt != NULL);
 
@@ -951,7 +1039,11 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_apu_cpus(s);
     versal_create_apu_gic(s, pic);
     versal_create_rpu_cpus(s);
-    versal_create_uarts(s, pic);
+
+    for (i = 0; i < map->num_uart; i++) {
+        versal_create_uart(s, &map->uart[i], i);
+    }
+
     versal_create_canfds(s, pic);
     versal_create_usbs(s, pic);
     versal_create_gems(s, pic);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index f2a62b4355..b01ddeb142 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -18,7 +18,6 @@
 #include "hw/or-irq.h"
 #include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
-#include "hw/char/pl011.h"
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
@@ -80,7 +79,6 @@ struct Versal {
         MemoryRegion mr_ocm;
 
         struct {
-            PL011State uart[XLNX_VERSAL_NR_UARTS];
             CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
             OrIRQState gem_irq_orgate[XLNX_VERSAL_NR_GEMS];
             XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];

From d70df574d67c459521f7b93fae42451b8e83bbea Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:22 +0200
Subject: [PATCH 1079/2396] hw/arm/xlnx-versal: canfd: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the CAN controllers creation using the VersalMap structure.

Note that the connection to the CRL is removed for now and will be
re-added by next commits.

The xlnx-versal-virt machine now dynamically creates the correct amount
of CAN bus link properties based on the number of CAN controller
advertised by the SoC.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-5-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 73 +++++++++-------------------
 hw/arm/xlnx-versal.c         | 94 +++++++++++++++++++++++++-----------
 include/hw/arm/xlnx-versal.h |  7 +--
 3 files changed, 95 insertions(+), 79 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index e1deae1131..334252564b 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -43,11 +43,11 @@ struct VersalVirt {
         uint32_t clk_25Mhz;
         uint32_t usb;
         uint32_t dwc;
-        uint32_t canfd[2];
     } phandle;
     struct arm_boot_info binfo;
 
-    CanBusState *canbus[XLNX_VERSAL_NR_CANFD];
+    CanBusState **canbus;
+
     struct {
         bool secure;
     } cfg;
@@ -209,38 +209,6 @@ static void fdt_add_usb_xhci_nodes(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_canfd_nodes(VersalVirt *s)
-{
-    uint64_t addrs[] = { MM_CANFD1, MM_CANFD0 };
-    uint32_t size[] = { MM_CANFD1_SIZE, MM_CANFD0_SIZE };
-    unsigned int irqs[] = { VERSAL_CANFD1_IRQ_0, VERSAL_CANFD0_IRQ_0 };
-    const char clocknames[] = "can_clk\0s_axi_aclk";
-    int i;
-
-    /* Create and connect CANFD0 and CANFD1 nodes to canbus0. */
-    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
-        char *name = g_strdup_printf("/canfd@%" PRIx64, addrs[i]);
-        qemu_fdt_add_subnode(s->fdt, name);
-
-        qemu_fdt_setprop_cell(s->fdt, name, "rx-fifo-depth", 0x40);
-        qemu_fdt_setprop_cell(s->fdt, name, "tx-mailbox-count", 0x20);
-
-        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
-        qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                     2, addrs[i], 2, size[i]);
-        qemu_fdt_setprop_string(s->fdt, name, "compatible",
-                                "xlnx,canfd-2.0");
-
-        g_free(name);
-    }
-}
-
 static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
                                      uint32_t phandle)
 {
@@ -661,10 +629,14 @@ static void versal_virt_init(MachineState *machine)
                             TYPE_XLNX_VERSAL);
     object_property_set_link(OBJECT(&s->soc), "ddr", OBJECT(machine->ram),
                              &error_abort);
-    object_property_set_link(OBJECT(&s->soc), "canbus0", OBJECT(s->canbus[0]),
-                             &error_abort);
-    object_property_set_link(OBJECT(&s->soc), "canbus1", OBJECT(s->canbus[1]),
-                             &error_abort);
+
+    for (i = 0; i < versal_get_num_can(VERSAL_VER_VERSAL); i++) {
+        g_autofree char *prop_name = g_strdup_printf("canbus%d", i);
+
+        object_property_set_link(OBJECT(&s->soc), prop_name,
+                                 OBJECT(s->canbus[i]),
+                                 &error_abort);
+    }
 
     fdt_create(s);
     versal_set_fdt(&s->soc, s->fdt);
@@ -672,7 +644,6 @@ static void versal_virt_init(MachineState *machine)
     create_virtio_regions(s);
 
     fdt_add_gem_nodes(s);
-    fdt_add_canfd_nodes(s);
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
     fdt_add_zdma_nodes(s);
@@ -755,19 +726,22 @@ static void versal_virt_init(MachineState *machine)
 static void versal_virt_machine_instance_init(Object *obj)
 {
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
+    size_t i, num_can;
+
+    num_can = versal_get_num_can(VERSAL_VER_VERSAL);
+    s->canbus = g_new0(CanBusState *, num_can);
 
     /*
-     * User can set canbus0 and canbus1 properties to can-bus object and connect
-     * to socketcan(optional) interface via command line.
+     * User can set canbusx properties to can-bus object and optionally connect
+     * to socketcan interface via command line.
      */
-    object_property_add_link(obj, "canbus0", TYPE_CAN_BUS,
-                             (Object **)&s->canbus[0],
-                             object_property_allow_set_link,
-                             0);
-    object_property_add_link(obj, "canbus1", TYPE_CAN_BUS,
-                             (Object **)&s->canbus[1],
-                             object_property_allow_set_link,
-                             0);
+    for (i = 0; i < num_can; i++) {
+        g_autofree char *prop_name = g_strdup_printf("canbus%zu", i);
+
+        object_property_add_link(obj, prop_name, TYPE_CAN_BUS,
+                                 (Object **) &s->canbus[i],
+                                 object_property_allow_set_link, 0);
+    }
 }
 
 static void versal_virt_machine_finalize(Object *obj)
@@ -775,6 +749,7 @@ static void versal_virt_machine_finalize(Object *obj)
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
 
     g_free(s->ospi_model);
+    g_free(s->canbus);
 }
 
 static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index b16af79e8a..3d2e33d3da 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -27,6 +27,7 @@
 #include "system/device_tree.h"
 #include "hw/arm/fdt.h"
 #include "hw/char/pl011.h"
+#include "hw/net/xlnx-versal-canfd.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -43,12 +44,19 @@ typedef struct VersalSimplePeriphMap {
 typedef struct VersalMap {
     VersalSimplePeriphMap uart[2];
     size_t num_uart;
+
+    VersalSimplePeriphMap canfd[4];
+    size_t num_canfd;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
     .uart[0] = { 0xff000000, 18 },
     .uart[1] = { 0xff010000, 19 },
     .num_uart = 2,
+
+    .canfd[0] = { 0xff060000, 20 },
+    .canfd[1] = { 0xff070000, 21 },
+    .num_canfd = 2,
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -286,36 +294,42 @@ static void versal_create_uart(Versal *s,
     }
 }
 
-static void versal_create_canfds(Versal *s, qemu_irq *pic)
+static void versal_create_canfd(Versal *s, const VersalSimplePeriphMap *map,
+                                CanBusState *bus)
 {
-    int i;
-    uint32_t irqs[] = { VERSAL_CANFD0_IRQ_0, VERSAL_CANFD1_IRQ_0};
-    uint64_t addrs[] = { MM_CANFD0, MM_CANFD1 };
+    SysBusDevice *sbd;
+    MemoryRegion *mr;
+    g_autofree char *node;
+    const char compatible[] = "xlnx,canfd-2.0";
+    const char clocknames[] = "can_clk\0s_axi_aclk";
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.canfd); i++) {
-        char *name = g_strdup_printf("canfd%d", i);
-        SysBusDevice *sbd;
-        MemoryRegion *mr;
+    sbd = SYS_BUS_DEVICE(qdev_new(TYPE_XILINX_CANFD));
+    object_property_add_child(OBJECT(s), "canfd[*]", OBJECT(sbd));
 
-        object_initialize_child(OBJECT(s), name, &s->lpd.iou.canfd[i],
-                                TYPE_XILINX_CANFD);
-        sbd = SYS_BUS_DEVICE(&s->lpd.iou.canfd[i]);
+    object_property_set_int(OBJECT(sbd), "ext_clk_freq",
+                            25 * 1000 * 1000 , &error_abort);
 
-        object_property_set_int(OBJECT(&s->lpd.iou.canfd[i]), "ext_clk_freq",
-                                XLNX_VERSAL_CANFD_REF_CLK , &error_abort);
+    object_property_set_link(OBJECT(sbd), "canfdbus", OBJECT(bus),
+                             &error_abort);
 
-        object_property_set_link(OBJECT(&s->lpd.iou.canfd[i]), "canfdbus",
-                                 OBJECT(s->lpd.iou.canbus[i]),
-                                 &error_abort);
+    sysbus_realize_and_unref(sbd, &error_fatal);
 
-        sysbus_realize(sbd, &error_fatal);
+    mr = sysbus_mmio_get_region(sbd, 0);
+    memory_region_add_subregion(&s->mr_ps, map->addr, mr);
 
-        mr = sysbus_mmio_get_region(sbd, 0);
-        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+    versal_sysbus_connect_irq(s, sbd, 0, map->irq);
 
-        sysbus_connect_irq(sbd, 0, pic[irqs[i]]);
-        g_free(name);
-    }
+    node = versal_fdt_add_simple_subnode(s, "/canfd", map->addr, 0x10000,
+                                         compatible, sizeof(compatible));
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "rx-fifo-depth", 0x40);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "tx-mailbox-count", 0x20);
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                           s->phandle.clk_25mhz, s->phandle.clk_25mhz);
+    qemu_fdt_setprop(s->cfg.fdt, node, "clock-names",
+                     clocknames, sizeof(clocknames));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                           GIC_FDT_IRQ_TYPE_SPI, map->irq,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 }
 
 static void versal_create_usbs(Versal *s, qemu_irq *pic)
@@ -1044,7 +1058,10 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_uart(s, &map->uart[i], i);
     }
 
-    versal_create_canfds(s, pic);
+    for (i = 0; i < map->num_canfd; i++) {
+        versal_create_canfd(s, &map->canfd[i], s->cfg.canbus[i]);
+    }
+
     versal_create_usbs(s, pic);
     versal_create_gems(s, pic);
     versal_create_admas(s, pic);
@@ -1072,24 +1089,46 @@ static void versal_realize(DeviceState *dev, Error **errp)
                                         &s->lpd.rpu.mr_ps_alias, 0);
 }
 
+int versal_get_num_can(VersalVersion version)
+{
+    const VersalMap *map = VERSION_TO_MAP[version];
+
+    return map->num_canfd;
+}
+
 static void versal_base_init(Object *obj)
 {
     Versal *s = XLNX_VERSAL_BASE(obj);
+    size_t i, num_can;
 
     memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
     memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
     memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
                              "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
+
+    num_can = versal_get_map(s)->num_canfd;
+    s->cfg.canbus = g_new0(CanBusState *, num_can);
+
+    for (i = 0; i < num_can; i++) {
+        g_autofree char *prop_name = g_strdup_printf("canbus%zu", i);
+
+        object_property_add_link(obj, prop_name, TYPE_CAN_BUS,
+                                 (Object **) &s->cfg.canbus[i],
+                                 object_property_allow_set_link, 0);
+    }
+}
+
+static void versal_base_finalize(Object *obj)
+{
+    Versal *s = XLNX_VERSAL_BASE(obj);
+
+    g_free(s->cfg.canbus);
 }
 
 static const Property versal_properties[] = {
     DEFINE_PROP_LINK("ddr", Versal, cfg.mr_ddr, TYPE_MEMORY_REGION,
                      MemoryRegion *),
-    DEFINE_PROP_LINK("canbus0", Versal, lpd.iou.canbus[0],
-                      TYPE_CAN_BUS, CanBusState *),
-    DEFINE_PROP_LINK("canbus1", Versal, lpd.iou.canbus[1],
-                      TYPE_CAN_BUS, CanBusState *),
 };
 
 static void versal_base_class_init(ObjectClass *klass, const void *data)
@@ -1113,6 +1152,7 @@ static const TypeInfo versal_base_info = {
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(Versal),
     .instance_init = versal_base_init,
+    .instance_finalize = versal_base_finalize,
     .class_init = versal_base_class_init,
     .class_size = sizeof(VersalClass),
     .abstract = true,
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index b01ddeb142..007c91b596 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -31,7 +31,7 @@
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 #include "hw/misc/xlnx-versal-trng.h"
-#include "hw/net/xlnx-versal-canfd.h"
+#include "net/can_emu.h"
 #include "hw/misc/xlnx-versal-cfu.h"
 #include "hw/misc/xlnx-versal-cframe-reg.h"
 #include "target/arm/cpu.h"
@@ -83,8 +83,6 @@ struct Versal {
             OrIRQState gem_irq_orgate[XLNX_VERSAL_NR_GEMS];
             XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
             VersalUsb2 usb;
-            CanBusState *canbus[XLNX_VERSAL_NR_CANFD];
-            XlnxVersalCANFDState canfd[XLNX_VERSAL_NR_CANFD];
         } iou;
 
         /* Real-time Processing Unit.  */
@@ -141,6 +139,7 @@ struct Versal {
 
     struct {
         MemoryRegion *mr_ddr;
+        CanBusState **canbus;
         void *fdt;
     } cfg;
 };
@@ -157,6 +156,8 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
     s->cfg.fdt = fdt;
 }
 
+int versal_get_num_can(VersalVersion version);
+
 /* Memory-map and IRQ definitions. Copied a subset from
  * auto-generated files.  */
 

From b392177e42e25b076104eb8fe3a484a9a16642c7 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:23 +0200
Subject: [PATCH 1080/2396] hw/arm/xlnx-versal: sdhci: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the SDHCI controllers creation using the VersalMap structure.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-6-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 43 ++--------------
 hw/arm/xlnx-versal.c         | 96 ++++++++++++++++++++++++++++--------
 include/hw/arm/xlnx-versal.h |  5 +-
 3 files changed, 83 insertions(+), 61 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 334252564b..52852082d4 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -284,32 +284,6 @@ static void fdt_add_zdma_nodes(VersalVirt *s)
     }
 }
 
-static void fdt_add_sd_nodes(VersalVirt *s)
-{
-    const char clocknames[] = "clk_xin\0clk_ahb";
-    const char compat[] = "arasan,sdhci-8.9a";
-    int i;
-
-    for (i = ARRAY_SIZE(s->soc.pmc.iou.sd) - 1; i >= 0; i--) {
-        uint64_t addr = MM_PMC_SD0 + MM_PMC_SD0_SIZE * i;
-        char *name = g_strdup_printf("/sdhci@%" PRIx64, addr);
-
-        qemu_fdt_add_subnode(s->fdt, name);
-
-        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
-        qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, VERSAL_SD0_IRQ_0 + i * 2,
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                     2, addr, 2, MM_PMC_SD0_SIZE);
-        qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-        g_free(name);
-    }
-}
-
 static void fdt_add_rtc_node(VersalVirt *s)
 {
     const char compat[] = "xlnx,zynqmp-rtc";
@@ -564,16 +538,11 @@ static void efuse_attach_drive(XlnxEFuse *dev)
     }
 }
 
-static void sd_plugin_card(SDHCIState *sd, DriveInfo *di)
+static void sd_plug_card(VersalVirt *s, int idx, DriveInfo *di)
 {
     BlockBackend *blk = di ? blk_by_legacy_dinfo(di) : NULL;
-    DeviceState *card;
 
-    card = qdev_new(TYPE_SD_CARD);
-    object_property_add_child(OBJECT(sd), "card[*]", OBJECT(card));
-    qdev_prop_set_drive_err(card, "drive", blk, &error_fatal);
-    qdev_realize_and_unref(card, qdev_get_child_bus(DEVICE(sd), "sd-bus"),
-                           &error_fatal);
+    versal_sdhci_plug_card(&s->soc, idx, blk);
 }
 
 static char *versal_get_ospi_model(Object *obj, Error **errp)
@@ -648,7 +617,6 @@ static void versal_virt_init(MachineState *machine)
     fdt_add_timer_nodes(s);
     fdt_add_zdma_nodes(s);
     fdt_add_usb_xhci_nodes(s);
-    fdt_add_sd_nodes(s);
     fdt_add_rtc_node(s);
     fdt_add_bbram_node(s);
     fdt_add_efuse_ctrl_node(s);
@@ -668,10 +636,9 @@ static void versal_virt_init(MachineState *machine)
     /* Attach efuse backend, if given */
     efuse_attach_drive(&s->soc.pmc.efuse);
 
-    /* Plugin SD cards.  */
-    for (i = 0; i < ARRAY_SIZE(s->soc.pmc.iou.sd); i++) {
-        sd_plugin_card(&s->soc.pmc.iou.sd[i],
-                       drive_get(IF_SD, 0, i));
+    /* Plug SD cards */
+    for (i = 0; i < versal_get_num_sdhci(VERSAL_VER_VERSAL); i++) {
+        sd_plug_card(s, i, drive_get(IF_SD, 0, i));
     }
 
     s->binfo.ram_size = machine->ram_size;
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 3d2e33d3da..ff2f47daad 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -28,6 +28,7 @@
 #include "hw/arm/fdt.h"
 #include "hw/char/pl011.h"
 #include "hw/net/xlnx-versal-canfd.h"
+#include "hw/sd/sdhci.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -47,6 +48,9 @@ typedef struct VersalMap {
 
     VersalSimplePeriphMap canfd[4];
     size_t num_canfd;
+
+    VersalSimplePeriphMap sdhci[2];
+    size_t num_sdhci;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -57,6 +61,10 @@ static const VersalMap VERSAL_MAP = {
     .canfd[0] = { 0xff060000, 20 },
     .canfd[1] = { 0xff070000, 21 },
     .num_canfd = 2,
+
+    .sdhci[0] = { 0xf1040000, 126 },
+    .sdhci[1] = { 0xf1050000, 128 },
+    .num_sdhci = 2,
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -73,6 +81,18 @@ static inline const VersalMap *versal_get_map(Versal *s)
     return VERSION_TO_MAP[versal_get_version(s)];
 }
 
+static inline Object *versal_get_child(Versal *s, const char *child)
+{
+    return object_resolve_path_at(OBJECT(s), child);
+}
+
+static inline Object *versal_get_child_idx(Versal *s, const char *child,
+                                           size_t idx)
+{
+    g_autofree char *n = g_strdup_printf("%s[%zu]", child, idx);
+
+    return versal_get_child(s, n);
+}
 
 static qemu_irq versal_get_irq(Versal *s, int irq_idx)
 {
@@ -424,32 +444,39 @@ static void versal_create_admas(Versal *s, qemu_irq *pic)
 }
 
 #define SDHCI_CAPABILITIES  0x280737ec6481 /* Same as on ZynqMP.  */
-static void versal_create_sds(Versal *s, qemu_irq *pic)
+static void versal_create_sdhci(Versal *s,
+                                const VersalSimplePeriphMap *map)
 {
-    int i;
+    DeviceState *dev;
+    MemoryRegion *mr;
+    g_autofree char *node;
+    const char compatible[] = "arasan,sdhci-8.9a";
+    const char clocknames[] = "clk_xin\0clk_ahb";
 
-    for (i = 0; i < ARRAY_SIZE(s->pmc.iou.sd); i++) {
-        DeviceState *dev;
-        MemoryRegion *mr;
+    dev = qdev_new(TYPE_SYSBUS_SDHCI);
+    object_property_add_child(OBJECT(s), "sdhci[*]", OBJECT(dev));
 
-        object_initialize_child(OBJECT(s), "sd[*]", &s->pmc.iou.sd[i],
-                                TYPE_SYSBUS_SDHCI);
-        dev = DEVICE(&s->pmc.iou.sd[i]);
+    object_property_set_uint(OBJECT(dev), "sd-spec-version", 3,
+                             &error_fatal);
+    object_property_set_uint(OBJECT(dev), "capareg", SDHCI_CAPABILITIES,
+                             &error_fatal);
+    object_property_set_uint(OBJECT(dev), "uhs", UHS_I, &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-        object_property_set_uint(OBJECT(dev), "sd-spec-version", 3,
-                                 &error_fatal);
-        object_property_set_uint(OBJECT(dev), "capareg", SDHCI_CAPABILITIES,
-                                 &error_fatal);
-        object_property_set_uint(OBJECT(dev), "uhs", UHS_I, &error_fatal);
-        sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_add_subregion(&s->mr_ps, map->addr, mr);
 
-        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
-        memory_region_add_subregion(&s->mr_ps,
-                                    MM_PMC_SD0 + i * MM_PMC_SD0_SIZE, mr);
+    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->irq);
 
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
-                           pic[VERSAL_SD0_IRQ_0 + i * 2]);
-    }
+    node = versal_fdt_add_simple_subnode(s, "/sdhci", map->addr, 0x10000,
+                                         compatible, sizeof(compatible));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                           s->phandle.clk_25mhz, s->phandle.clk_25mhz);
+    qemu_fdt_setprop(s->cfg.fdt, node, "clock-names",
+                     clocknames, sizeof(clocknames));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                           GIC_FDT_IRQ_TYPE_SPI, map->irq,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 }
 
 static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
@@ -1062,10 +1089,13 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_canfd(s, &map->canfd[i], s->cfg.canbus[i]);
     }
 
+    for (i = 0; i < map->num_sdhci; i++) {
+        versal_create_sdhci(s, &map->sdhci[i]);
+    }
+
     versal_create_usbs(s, pic);
     versal_create_gems(s, pic);
     versal_create_admas(s, pic);
-    versal_create_sds(s, pic);
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
@@ -1089,6 +1119,23 @@ static void versal_realize(DeviceState *dev, Error **errp)
                                         &s->lpd.rpu.mr_ps_alias, 0);
 }
 
+void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk)
+{
+    DeviceState *sdhci, *card;
+
+    sdhci = DEVICE(versal_get_child_idx(s, "sdhci", sd_idx));
+
+    if (sdhci == NULL) {
+        return;
+    }
+
+    card = qdev_new(TYPE_SD_CARD);
+    object_property_add_child(OBJECT(sdhci), "card[*]", OBJECT(card));
+    qdev_prop_set_drive_err(card, "drive", blk, &error_fatal);
+    qdev_realize_and_unref(card, qdev_get_child_bus(DEVICE(sdhci), "sd-bus"),
+                           &error_fatal);
+}
+
 int versal_get_num_can(VersalVersion version)
 {
     const VersalMap *map = VERSION_TO_MAP[version];
@@ -1096,6 +1143,13 @@ int versal_get_num_can(VersalVersion version)
     return map->num_canfd;
 }
 
+int versal_get_num_sdhci(VersalVersion version)
+{
+    const VersalMap *map = VERSION_TO_MAP[version];
+
+    return map->num_sdhci;
+}
+
 static void versal_base_init(Object *obj)
 {
     Versal *s = XLNX_VERSAL_BASE(obj);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 007c91b596..4a7a2d85aa 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -16,7 +16,6 @@
 #include "hw/sysbus.h"
 #include "hw/cpu/cluster.h"
 #include "hw/or-irq.h"
-#include "hw/sd/sdhci.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/net/cadence_gem.h"
@@ -105,7 +104,6 @@ struct Versal {
     /* The Platform Management Controller subsystem.  */
     struct {
         struct {
-            SDHCIState sd[XLNX_VERSAL_NR_SDS];
             XlnxVersalPmcIouSlcr slcr;
 
             struct {
@@ -156,7 +154,10 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
     s->cfg.fdt = fdt;
 }
 
+void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
+
 int versal_get_num_can(VersalVersion version);
+int versal_get_num_sdhci(VersalVersion version);
 
 /* Memory-map and IRQ definitions. Copied a subset from
  * auto-generated files.  */

From 8aaeb96405d2e4b6593cb9d5d943a54e36cbccbc Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:24 +0200
Subject: [PATCH 1081/2396] hw/arm/xlnx-versal: gem: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the GEM ethernet controllers creation using the VersalMap
structure.

Note that the connection to the CRL is removed for now and will be
re-added by next commits.

The FDT nodes are created in reverse order compared to the devices
creation to keep backward compatibility with the previous generated
FDTs.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-7-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  54 ------------
 hw/arm/xlnx-versal.c         | 155 ++++++++++++++++++++++++++---------
 include/hw/arm/xlnx-versal.h |   3 -
 3 files changed, 116 insertions(+), 96 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 52852082d4..0634cc90ea 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -38,7 +38,6 @@ struct VersalVirt {
     int fdt_size;
     struct {
         uint32_t gic;
-        uint32_t ethernet_phy[2];
         uint32_t clk_125Mhz;
         uint32_t clk_25Mhz;
         uint32_t usb;
@@ -57,7 +56,6 @@ struct VersalVirt {
 static void fdt_create(VersalVirt *s)
 {
     MachineClass *mc = MACHINE_GET_CLASS(s);
-    int i;
 
     s->fdt = create_device_tree(&s->fdt_size);
     if (!s->fdt) {
@@ -67,9 +65,6 @@ static void fdt_create(VersalVirt *s)
 
     /* Allocate all phandles.  */
     s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
-    for (i = 0; i < ARRAY_SIZE(s->phandle.ethernet_phy); i++) {
-        s->phandle.ethernet_phy[i] = qemu_fdt_alloc_phandle(s->fdt);
-    }
     s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
     s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
 
@@ -209,54 +204,6 @@ static void fdt_add_usb_xhci_nodes(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_fixed_link_nodes(VersalVirt *s, char *gemname,
-                                     uint32_t phandle)
-{
-    char *name = g_strdup_printf("%s/fixed-link", gemname);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
-    qemu_fdt_setprop(s->fdt, name, "full-duplex", NULL, 0);
-    qemu_fdt_setprop_cell(s->fdt, name, "speed", 1000);
-    g_free(name);
-}
-
-static void fdt_add_gem_nodes(VersalVirt *s)
-{
-    uint64_t addrs[] = { MM_GEM1, MM_GEM0 };
-    unsigned int irqs[] = { VERSAL_GEM1_IRQ_0, VERSAL_GEM0_IRQ_0 };
-    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
-    const char compat_gem[] = "cdns,zynqmp-gem\0cdns,gem";
-    int i;
-
-    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
-        char *name = g_strdup_printf("/ethernet@%" PRIx64, addrs[i]);
-        qemu_fdt_add_subnode(s->fdt, name);
-
-        fdt_add_fixed_link_nodes(s, name, s->phandle.ethernet_phy[i]);
-        qemu_fdt_setprop_string(s->fdt, name, "phy-mode", "rgmii-id");
-        qemu_fdt_setprop_cell(s->fdt, name, "phy-handle",
-                              s->phandle.ethernet_phy[i]);
-        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz,
-                               s->phandle.clk_125Mhz, s->phandle.clk_125Mhz);
-        qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-                               GIC_FDT_IRQ_TYPE_SPI, irqs[i],
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                     2, addrs[i], 2, 0x1000);
-        qemu_fdt_setprop(s->fdt, name, "compatible",
-                         compat_gem, sizeof(compat_gem));
-        qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 1);
-        qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 0);
-        g_free(name);
-    }
-}
-
 static void fdt_add_zdma_nodes(VersalVirt *s)
 {
     const char clocknames[] = "clk_main\0clk_apb";
@@ -612,7 +559,6 @@ static void versal_virt_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
     create_virtio_regions(s);
 
-    fdt_add_gem_nodes(s);
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
     fdt_add_zdma_nodes(s);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index ff2f47daad..7c53bc82a2 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -29,6 +29,7 @@
 #include "hw/char/pl011.h"
 #include "hw/net/xlnx-versal-canfd.h"
 #include "hw/sd/sdhci.h"
+#include "hw/net/cadence_gem.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -51,6 +52,14 @@ typedef struct VersalMap {
 
     VersalSimplePeriphMap sdhci[2];
     size_t num_sdhci;
+
+    struct VersalGemMap {
+        VersalSimplePeriphMap map;
+        size_t num_prio_queue;
+        const char *phy_mode;
+        const uint32_t speed;
+    } gem[3];
+    size_t num_gem;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -65,6 +74,10 @@ static const VersalMap VERSAL_MAP = {
     .sdhci[0] = { 0xf1040000, 126 },
     .sdhci[1] = { 0xf1050000, 128 },
     .num_sdhci = 2,
+
+    .gem[0] = { { 0xff0c0000, 56 }, 2, "rgmii-id", 1000 },
+    .gem[1] = { { 0xff0d0000, 58 }, 2, "rgmii-id", 1000 },
+    .num_gem = 2,
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -111,6 +124,18 @@ static void versal_sysbus_connect_irq(Versal *s, SysBusDevice *sbd,
     sysbus_connect_irq(sbd, sbd_idx, irq);
 }
 
+static void versal_qdev_connect_gpio_out(Versal *s, DeviceState *dev,
+                                         int dev_idx, int irq_idx)
+{
+    qemu_irq irq = versal_get_irq(s, irq_idx);
+
+    if (irq == NULL) {
+        return;
+    }
+
+    qdev_connect_gpio_out(dev, dev_idx, irq);
+}
+
 static inline char *versal_fdt_add_subnode(Versal *s, const char *path,
                                            uint64_t at, const char *compat,
                                            size_t compat_sz)
@@ -140,6 +165,21 @@ static inline char *versal_fdt_add_simple_subnode(Versal *s, const char *path,
     return p;
 }
 
+static inline DeviceState *create_or_gate(Versal *s, Object *parent,
+                                          const char *name, uint16_t num_lines,
+                                          int irq_idx)
+{
+    DeviceState *or;
+
+    or = qdev_new(TYPE_OR_IRQ);
+    qdev_prop_set_uint16(or, "num-lines", num_lines);
+    object_property_add_child(parent, name, OBJECT(or));
+    qdev_realize_and_unref(or, NULL, &error_abort);
+    versal_qdev_connect_gpio_out(s, or, 0, irq_idx);
+
+    return or;
+}
+
 static void versal_create_apu_cpus(Versal *s)
 {
     int i;
@@ -377,46 +417,82 @@ static void versal_create_usbs(Versal *s, qemu_irq *pic)
     memory_region_add_subregion(&s->mr_ps, MM_USB2_CTRL_REGS, mr);
 }
 
-static void versal_create_gems(Versal *s, qemu_irq *pic)
+static void versal_create_gem(Versal *s,
+                              const struct VersalGemMap *map)
 {
+    DeviceState *dev;
+    MemoryRegion *mr;
+    DeviceState *or;
     int i;
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
-        static const int irqs[] = { VERSAL_GEM0_IRQ_0, VERSAL_GEM1_IRQ_0};
-        static const uint64_t addrs[] = { MM_GEM0, MM_GEM1 };
-        char *name = g_strdup_printf("gem%d", i);
-        DeviceState *dev;
-        MemoryRegion *mr;
-        OrIRQState *or_irq;
+    dev = qdev_new(TYPE_CADENCE_GEM);
+    object_property_add_child(OBJECT(s), "gem[*]", OBJECT(dev));
 
-        object_initialize_child(OBJECT(s), name, &s->lpd.iou.gem[i],
-                                TYPE_CADENCE_GEM);
-        or_irq = &s->lpd.iou.gem_irq_orgate[i];
-        object_initialize_child(OBJECT(s), "gem-irq-orgate[*]",
-                                or_irq, TYPE_OR_IRQ);
-        dev = DEVICE(&s->lpd.iou.gem[i]);
-        qemu_configure_nic_device(dev, true, NULL);
-        object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
-        object_property_set_int(OBJECT(dev), "num-priority-queues", 2,
-                                &error_abort);
-        object_property_set_int(OBJECT(or_irq),
-                                "num-lines", 2, &error_fatal);
-        qdev_realize(DEVICE(or_irq), NULL, &error_fatal);
-        qdev_connect_gpio_out(DEVICE(or_irq), 0, pic[irqs[i]]);
+    qemu_configure_nic_device(dev, true, NULL);
+    object_property_set_int(OBJECT(dev), "phy-addr", 23, &error_abort);
+    object_property_set_int(OBJECT(dev), "num-priority-queues",
+                            map->num_prio_queue, &error_abort);
 
-        object_property_set_link(OBJECT(dev), "dma", OBJECT(&s->mr_ps),
-                                 &error_abort);
-        sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
+    object_property_set_link(OBJECT(dev), "dma", OBJECT(&s->mr_ps),
+                             &error_abort);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-        mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
-        memory_region_add_subregion(&s->mr_ps, addrs[i], mr);
+    mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
+    memory_region_add_subregion(&s->mr_ps, map->map.addr, mr);
 
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(DEVICE(or_irq), 0));
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 1, qdev_get_gpio_in(DEVICE(or_irq), 1));
-        g_free(name);
+    /*
+     * The GEM controller exposes one IRQ line per priority queue. In Versal
+     * family devices, those are OR'ed together.
+     */
+    or = create_or_gate(s, OBJECT(dev), "irq-orgate",
+                        map->num_prio_queue, map->map.irq);
+
+    for (i = 0; i < map->num_prio_queue; i++) {
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), i, qdev_get_gpio_in(or, i));
     }
 }
 
+static void versal_create_gem_fdt(Versal *s,
+                                  const struct VersalGemMap *map)
+{
+    int i;
+    g_autofree char *node;
+    g_autofree char *phy_node;
+    int phy_phandle;
+    const char compatible[] = "cdns,zynqmp-gem\0cdns,gem";
+    const char clocknames[] = "pclk\0hclk\0tx_clk\0rx_clk";
+    g_autofree uint32_t *irq_prop;
+
+    node = versal_fdt_add_simple_subnode(s, "/ethernet", map->map.addr, 0x1000,
+                                         compatible, sizeof(compatible));
+    phy_node = g_strdup_printf("%s/fixed-link", node);
+    phy_phandle = qemu_fdt_alloc_phandle(s->cfg.fdt);
+
+    /* Fixed link PHY node */
+    qemu_fdt_add_subnode(s->cfg.fdt, phy_node);
+    qemu_fdt_setprop_cell(s->cfg.fdt, phy_node, "phandle", phy_phandle);
+    qemu_fdt_setprop(s->cfg.fdt, phy_node, "full-duplex", NULL, 0);
+    qemu_fdt_setprop_cell(s->cfg.fdt, phy_node, "speed", map->speed);
+
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "phy-mode", map->phy_mode);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "phy-handle", phy_phandle);
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                           s->phandle.clk_25mhz, s->phandle.clk_25mhz,
+                           s->phandle.clk_125mhz, s->phandle.clk_125mhz);
+    qemu_fdt_setprop(s->cfg.fdt, node, "clock-names",
+                     clocknames, sizeof(clocknames));
+
+    irq_prop = g_new(uint32_t, map->num_prio_queue * 3);
+    for (i = 0; i < map->num_prio_queue; i++) {
+        irq_prop[3 * i] = cpu_to_be32(GIC_FDT_IRQ_TYPE_SPI);
+        irq_prop[3 * i + 1] = cpu_to_be32(map->map.irq);
+        irq_prop[3 * i + 2] = cpu_to_be32(GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    }
+    qemu_fdt_setprop(s->cfg.fdt, node, "interrupts", irq_prop,
+                     sizeof(uint32_t) * map->num_prio_queue * 3);
+}
+
+
 static void versal_create_admas(Versal *s, qemu_irq *pic)
 {
     int i;
@@ -902,14 +978,6 @@ static void versal_create_crl(Versal *s, qemu_irq *pic)
                                  &error_abort);
     }
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.gem); i++) {
-        g_autofree gchar *name = g_strdup_printf("gem[%d]", i);
-
-        object_property_set_link(OBJECT(&s->lpd.crl),
-                                 name, OBJECT(&s->lpd.iou.gem[i]),
-                                 &error_abort);
-    }
-
     for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
         g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
 
@@ -1093,8 +1161,17 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_sdhci(s, &map->sdhci[i]);
     }
 
+    for (i = 0; i < map->num_gem; i++) {
+        versal_create_gem(s, &map->gem[i]);
+        /*
+         * Create fdt node in reverse order to keep backward compatibility with
+         * previous versions of the generated FDT. This affects Linux kernel
+         * interface naming order when persistent naming scheme is not in use.
+         */
+        versal_create_gem_fdt(s, &map->gem[map->num_gem - 1 - i]);
+    }
+
     versal_create_usbs(s, pic);
-    versal_create_gems(s, pic);
     versal_create_admas(s, pic);
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 4a7a2d85aa..1fcc2b623d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -18,7 +18,6 @@
 #include "hw/or-irq.h"
 #include "hw/intc/arm_gicv3.h"
 #include "hw/dma/xlnx-zdma.h"
-#include "hw/net/cadence_gem.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
@@ -78,8 +77,6 @@ struct Versal {
         MemoryRegion mr_ocm;
 
         struct {
-            CadenceGEMState gem[XLNX_VERSAL_NR_GEMS];
-            OrIRQState gem_irq_orgate[XLNX_VERSAL_NR_GEMS];
             XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
             VersalUsb2 usb;
         } iou;

From 51668b79be5ac5d490ffc7fcde2a95f9a2460997 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:25 +0200
Subject: [PATCH 1082/2396] hw/arm/xlnx-versal: adma: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the ADMA creation using the VersalMap structure.

Note that the connection to the CRL is removed for now and will be
re-added by next commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-8-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 28 --------------
 hw/arm/xlnx-versal.c         | 72 ++++++++++++++++++++++++------------
 include/hw/arm/xlnx-versal.h |  2 -
 3 files changed, 48 insertions(+), 54 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 0634cc90ea..418e4c6e98 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -204,33 +204,6 @@ static void fdt_add_usb_xhci_nodes(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_zdma_nodes(VersalVirt *s)
-{
-    const char clocknames[] = "clk_main\0clk_apb";
-    const char compat[] = "xlnx,zynqmp-dma-1.0";
-    int i;
-
-    for (i = XLNX_VERSAL_NR_ADMAS - 1; i >= 0; i--) {
-        uint64_t addr = MM_ADMA_CH0 + MM_ADMA_CH0_SIZE * i;
-        char *name = g_strdup_printf("/dma@%" PRIx64, addr);
-
-        qemu_fdt_add_subnode(s->fdt, name);
-
-        qemu_fdt_setprop_cell(s->fdt, name, "xlnx,bus-width", 64);
-        qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);
-        qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, VERSAL_ADMA_IRQ_0 + i,
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                     2, addr, 2, 0x1000);
-        qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-        g_free(name);
-    }
-}
-
 static void fdt_add_rtc_node(VersalVirt *s)
 {
     const char compat[] = "xlnx,zynqmp-rtc";
@@ -561,7 +534,6 @@ static void versal_virt_init(MachineState *machine)
 
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
-    fdt_add_zdma_nodes(s);
     fdt_add_usb_xhci_nodes(s);
     fdt_add_rtc_node(s);
     fdt_add_bbram_node(s);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 7c53bc82a2..5c2bd4be1f 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -30,6 +30,7 @@
 #include "hw/net/xlnx-versal-canfd.h"
 #include "hw/sd/sdhci.h"
 #include "hw/net/cadence_gem.h"
+#include "hw/dma/xlnx-zdma.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -60,6 +61,16 @@ typedef struct VersalMap {
         const uint32_t speed;
     } gem[3];
     size_t num_gem;
+
+    struct VersalZDMAMap {
+        const char *name;
+        VersalSimplePeriphMap map;
+        size_t num_chan;
+        uint64_t chan_stride;
+        int irq_stride;
+    } zdma[2];
+    size_t num_zdma;
+
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -78,6 +89,9 @@ static const VersalMap VERSAL_MAP = {
     .gem[0] = { { 0xff0c0000, 56 }, 2, "rgmii-id", 1000 },
     .gem[1] = { { 0xff0d0000, 58 }, 2, "rgmii-id", 1000 },
     .num_gem = 2,
+
+    .zdma[0] = { "adma", { 0xffa80000, 60 }, 8, 0x10000, 1 },
+    .num_zdma = 1,
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -492,30 +506,45 @@ static void versal_create_gem_fdt(Versal *s,
                      sizeof(uint32_t) * map->num_prio_queue * 3);
 }
 
-
-static void versal_create_admas(Versal *s, qemu_irq *pic)
+static void versal_create_zdma(Versal *s,
+                               const struct VersalZDMAMap *map)
 {
-    int i;
+    DeviceState *dev;
+    MemoryRegion *mr;
+    g_autofree char *name;
+    const char compatible[] = "xlnx,zynqmp-dma-1.0";
+    const char clocknames[] = "clk_main\0clk_apb";
+    size_t i;
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
-        char *name = g_strdup_printf("adma%d", i);
-        DeviceState *dev;
-        MemoryRegion *mr;
+    name = g_strdup_printf("%s[*]", map->name);
 
-        object_initialize_child(OBJECT(s), name, &s->lpd.iou.adma[i],
-                                TYPE_XLNX_ZDMA);
-        dev = DEVICE(&s->lpd.iou.adma[i]);
+    for (i = 0; i < map->num_chan; i++) {
+        uint64_t addr = map->map.addr + map->chan_stride * i;
+        int irq = map->map.irq + map->irq_stride * i;
+        g_autofree char *node;
+
+        dev = qdev_new(TYPE_XLNX_ZDMA);
+        object_property_add_child(OBJECT(s), name, OBJECT(dev));
         object_property_set_int(OBJECT(dev), "bus-width", 128, &error_abort);
         object_property_set_link(OBJECT(dev), "dma",
                                  OBJECT(get_system_memory()), &error_fatal);
-        sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
         mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
-        memory_region_add_subregion(&s->mr_ps,
-                                    MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);
+        memory_region_add_subregion(&s->mr_ps, addr, mr);
 
-        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_ADMA_IRQ_0 + i]);
-        g_free(name);
+        versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, irq);
+
+        node = versal_fdt_add_simple_subnode(s, "/dma", addr, 0x1000,
+                                             compatible, sizeof(compatible));
+        qemu_fdt_setprop_cell(s->cfg.fdt, node, "xlnx,bus-width", 64);
+        qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                               s->phandle.clk_25mhz, s->phandle.clk_25mhz);
+        qemu_fdt_setprop(s->cfg.fdt, node, "clock-names",
+                         clocknames, sizeof(clocknames));
+        qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, irq,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
     }
 }
 
@@ -978,14 +1007,6 @@ static void versal_create_crl(Versal *s, qemu_irq *pic)
                                  &error_abort);
     }
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {
-        g_autofree gchar *name = g_strdup_printf("adma[%d]", i);
-
-        object_property_set_link(OBJECT(&s->lpd.crl),
-                                 name, OBJECT(&s->lpd.iou.adma[i]),
-                                 &error_abort);
-    }
-
     object_property_set_link(OBJECT(&s->lpd.crl),
                              "usb", OBJECT(&s->lpd.iou.usb),
                              &error_abort);
@@ -1171,8 +1192,11 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_gem_fdt(s, &map->gem[map->num_gem - 1 - i]);
     }
 
+    for (i = 0; i < map->num_zdma; i++) {
+        versal_create_zdma(s, &map->zdma[i]);
+    }
+
     versal_create_usbs(s, pic);
-    versal_create_admas(s, pic);
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 1fcc2b623d..4eeea98ff3 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -17,7 +17,6 @@
 #include "hw/cpu/cluster.h"
 #include "hw/or-irq.h"
 #include "hw/intc/arm_gicv3.h"
-#include "hw/dma/xlnx-zdma.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
@@ -77,7 +76,6 @@ struct Versal {
         MemoryRegion mr_ocm;
 
         struct {
-            XlnxZDMA adma[XLNX_VERSAL_NR_ADMAS];
             VersalUsb2 usb;
         } iou;
 

From 3d10ac78480f4bdb17b908733fa9d2cf30ea2939 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:26 +0200
Subject: [PATCH 1083/2396] hw/arm/xlnx-versal: xram: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the XRAM devices creation using the VersalMap structure.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-9-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 59 +++++++++++++++++++++---------------
 include/hw/arm/xlnx-versal.h |  6 ----
 2 files changed, 35 insertions(+), 30 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 5c2bd4be1f..295fca3d60 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -31,6 +31,7 @@
 #include "hw/sd/sdhci.h"
 #include "hw/net/cadence_gem.h"
 #include "hw/dma/xlnx-zdma.h"
+#include "hw/misc/xlnx-versal-xramc.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -71,6 +72,14 @@ typedef struct VersalMap {
     } zdma[2];
     size_t num_zdma;
 
+    struct VersalXramMap {
+        uint64_t mem;
+        uint64_t mem_stride;
+        uint64_t ctrl;
+        uint64_t ctrl_stride;
+        int irq;
+        size_t num;
+    } xram;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -92,6 +101,13 @@ static const VersalMap VERSAL_MAP = {
 
     .zdma[0] = { "adma", { 0xffa80000, 60 }, 8, 0x10000, 1 },
     .num_zdma = 1,
+
+    .xram = {
+        .num = 4,
+        .mem = 0xfe800000, .mem_stride = 1 * MiB,
+        .ctrl = 0xff8e0000, .ctrl_stride = 0x10000,
+        .irq = 79,
+    },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -641,37 +657,31 @@ static void versal_create_trng(Versal *s, qemu_irq *pic)
     sysbus_connect_irq(sbd, 0, pic[VERSAL_TRNG_IRQ]);
 }
 
-static void versal_create_xrams(Versal *s, qemu_irq *pic)
+static void versal_create_xrams(Versal *s, const struct VersalXramMap *map)
 {
-    int nr_xrams = ARRAY_SIZE(s->lpd.xram.ctrl);
-    DeviceState *orgate;
-    int i;
+    SysBusDevice *sbd;
+    MemoryRegion *mr;
+    DeviceState *or;
+    size_t i;
 
-    /* XRAM IRQs get ORed into a single line.  */
-    object_initialize_child(OBJECT(s), "xram-irq-orgate",
-                            &s->lpd.xram.irq_orgate, TYPE_OR_IRQ);
-    orgate = DEVICE(&s->lpd.xram.irq_orgate);
-    object_property_set_int(OBJECT(orgate),
-                            "num-lines", nr_xrams, &error_fatal);
-    qdev_realize(orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_XRAM_IRQ_0]);
+    or = create_or_gate(s, OBJECT(s), "xram-orgate", map->num, map->irq);
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.xram.ctrl); i++) {
-        SysBusDevice *sbd;
-        MemoryRegion *mr;
+    for (i = 0; i < map->num; i++) {
+        hwaddr ctrl, mem;
 
-        object_initialize_child(OBJECT(s), "xram[*]", &s->lpd.xram.ctrl[i],
-                                TYPE_XLNX_XRAM_CTRL);
-        sbd = SYS_BUS_DEVICE(&s->lpd.xram.ctrl[i]);
-        sysbus_realize(sbd, &error_fatal);
+        sbd = SYS_BUS_DEVICE(qdev_new(TYPE_XLNX_XRAM_CTRL));
+        object_property_add_child(OBJECT(s), "xram[*]", OBJECT(sbd));
+        sysbus_realize_and_unref(sbd, &error_fatal);
+
+        ctrl = map->ctrl + map->ctrl_stride * i;
+        mem = map->mem + map->mem_stride * i;
 
         mr = sysbus_mmio_get_region(sbd, 0);
-        memory_region_add_subregion(&s->mr_ps,
-                                    MM_XRAMC + i * MM_XRAMC_SIZE, mr);
+        memory_region_add_subregion(&s->mr_ps, ctrl, mr);
         mr = sysbus_mmio_get_region(sbd, 1);
-        memory_region_add_subregion(&s->mr_ps, MM_XRAM + i * MiB, mr);
+        memory_region_add_subregion(&s->mr_ps, mem, mr);
 
-        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(orgate, i));
+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(or, i));
     }
 }
 
@@ -1196,11 +1206,12 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_zdma(s, &map->zdma[i]);
     }
 
+    versal_create_xrams(s, &map->xram);
+
     versal_create_usbs(s, pic);
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
-    versal_create_xrams(s, pic);
     versal_create_bbram(s, pic);
     versal_create_efuse(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 4eeea98ff3..71c3314b8b 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -20,7 +20,6 @@
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
-#include "hw/misc/xlnx-versal-xramc.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
@@ -88,11 +87,6 @@ struct Versal {
             ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
         } rpu;
 
-        struct {
-            OrIRQState irq_orgate;
-            XlnxXramCtrl ctrl[XLNX_VERSAL_NR_XRAM];
-        } xram;
-
         XlnxVersalCRL crl;
     } lpd;
 

From a0b535a57b28fe2c58481fb07e17b2f4a5dcae2e Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:27 +0200
Subject: [PATCH 1084/2396] hw/arm/xlnx-versal: usb: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the USB controller creation using the VersalMap structure.

Note that the connection to the CRL is removed for now and will be
re-added by next commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-10-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 56 +--------------------------
 hw/arm/xlnx-versal.c         | 74 +++++++++++++++++++++++++++++-------
 include/hw/arm/xlnx-versal.h |  5 ---
 3 files changed, 62 insertions(+), 73 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 418e4c6e98..5801598da7 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -14,6 +14,7 @@
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "system/device_tree.h"
+#include "system/address-spaces.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
 #include "hw/sysbus.h"
@@ -40,8 +41,6 @@ struct VersalVirt {
         uint32_t gic;
         uint32_t clk_125Mhz;
         uint32_t clk_25Mhz;
-        uint32_t usb;
-        uint32_t dwc;
     } phandle;
     struct arm_boot_info binfo;
 
@@ -68,8 +67,6 @@ static void fdt_create(VersalVirt *s)
     s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
     s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
 
-    s->phandle.usb = qemu_fdt_alloc_phandle(s->fdt);
-    s->phandle.dwc = qemu_fdt_alloc_phandle(s->fdt);
     /* Create /chosen node for load_dtb.  */
     qemu_fdt_add_subnode(s->fdt, "/chosen");
     qemu_fdt_add_subnode(s->fdt, "/aliases");
@@ -154,56 +151,6 @@ static void fdt_add_timer_nodes(VersalVirt *s)
                      compat, sizeof(compat));
 }
 
-static void fdt_add_usb_xhci_nodes(VersalVirt *s)
-{
-    const char clocknames[] = "bus_clk\0ref_clk";
-    const char irq_name[] = "dwc_usb3";
-    const char compatVersalDWC3[] = "xlnx,versal-dwc3";
-    const char compatDWC3[] = "snps,dwc3";
-    char *name = g_strdup_printf("/usb@%" PRIx32, MM_USB2_CTRL_REGS);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-    qemu_fdt_setprop(s->fdt, name, "compatible",
-                         compatVersalDWC3, sizeof(compatVersalDWC3));
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_USB2_CTRL_REGS,
-                                 2, MM_USB2_CTRL_REGS_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "clock-names",
-                         clocknames, sizeof(clocknames));
-    qemu_fdt_setprop_cells(s->fdt, name, "clocks",
-                               s->phandle.clk_25Mhz, s->phandle.clk_125Mhz);
-    qemu_fdt_setprop(s->fdt, name, "ranges", NULL, 0);
-    qemu_fdt_setprop_cell(s->fdt, name, "#address-cells", 2);
-    qemu_fdt_setprop_cell(s->fdt, name, "#size-cells", 2);
-    qemu_fdt_setprop_cell(s->fdt, name, "phandle", s->phandle.usb);
-    g_free(name);
-
-    name = g_strdup_printf("/usb@%" PRIx32 "/dwc3@%" PRIx32,
-                           MM_USB2_CTRL_REGS, MM_USB_0);
-    qemu_fdt_add_subnode(s->fdt, name);
-    qemu_fdt_setprop(s->fdt, name, "compatible",
-                     compatDWC3, sizeof(compatDWC3));
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_USB_0, 2, MM_USB_0_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
-                     irq_name, sizeof(irq_name));
-    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, VERSAL_USB0_IRQ_0,
-                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    qemu_fdt_setprop_cell(s->fdt, name,
-                          "snps,quirk-frame-length-adjustment", 0x20);
-    qemu_fdt_setprop_cells(s->fdt, name, "#stream-id-cells", 1);
-    qemu_fdt_setprop_string(s->fdt, name, "dr_mode", "host");
-    qemu_fdt_setprop_string(s->fdt, name, "phy-names", "usb3-phy");
-    qemu_fdt_setprop(s->fdt, name, "snps,dis_u2_susphy_quirk", NULL, 0);
-    qemu_fdt_setprop(s->fdt, name, "snps,dis_u3_susphy_quirk", NULL, 0);
-    qemu_fdt_setprop(s->fdt, name, "snps,refclk_fladj", NULL, 0);
-    qemu_fdt_setprop(s->fdt, name, "snps,mask_phy_reset", NULL, 0);
-    qemu_fdt_setprop_cell(s->fdt, name, "phandle", s->phandle.dwc);
-    qemu_fdt_setprop_string(s->fdt, name, "maximum-speed", "high-speed");
-    g_free(name);
-}
-
 static void fdt_add_rtc_node(VersalVirt *s)
 {
     const char compat[] = "xlnx,zynqmp-rtc";
@@ -534,7 +481,6 @@ static void versal_virt_init(MachineState *machine)
 
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
-    fdt_add_usb_xhci_nodes(s);
     fdt_add_rtc_node(s);
     fdt_add_bbram_node(s);
     fdt_add_efuse_ctrl_node(s);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 295fca3d60..946c017067 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -32,6 +32,7 @@
 #include "hw/net/cadence_gem.h"
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/misc/xlnx-versal-xramc.h"
+#include "hw/usb/xlnx-usb-subsystem.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -80,6 +81,13 @@ typedef struct VersalMap {
         int irq;
         size_t num;
     } xram;
+
+    struct VersalUsbMap {
+        uint64_t xhci;
+        uint64_t ctrl;
+        int irq;
+    } usb[2];
+    size_t num_usb;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -108,6 +116,9 @@ static const VersalMap VERSAL_MAP = {
         .ctrl = 0xff8e0000, .ctrl_stride = 0x10000,
         .irq = 79,
     },
+
+    .usb[0] = { .xhci = 0xfe200000, .ctrl = 0xff9d0000, .irq = 22 },
+    .num_usb = 1,
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -422,29 +433,67 @@ static void versal_create_canfd(Versal *s, const VersalSimplePeriphMap *map,
                            GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 }
 
-static void versal_create_usbs(Versal *s, qemu_irq *pic)
+static void versal_create_usb(Versal *s,
+                              const struct VersalUsbMap *map)
 {
     DeviceState *dev;
     MemoryRegion *mr;
+    g_autofree char *node, *subnode;
+    const char clocknames[] = "bus_clk\0ref_clk";
+    const char irq_name[] = "dwc_usb3";
+    const char compat_versal_dwc3[] = "xlnx,versal-dwc3";
+    const char compat_dwc3[] = "snps,dwc3";
 
-    object_initialize_child(OBJECT(s), "usb2", &s->lpd.iou.usb,
-                            TYPE_XILINX_VERSAL_USB2);
-    dev = DEVICE(&s->lpd.iou.usb);
+    dev = qdev_new(TYPE_XILINX_VERSAL_USB2);
+    object_property_add_child(OBJECT(s), "usb[*]", OBJECT(dev));
 
     object_property_set_link(OBJECT(dev), "dma", OBJECT(&s->mr_ps),
                              &error_abort);
     qdev_prop_set_uint32(dev, "intrs", 1);
     qdev_prop_set_uint32(dev, "slots", 2);
 
-    sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
-    memory_region_add_subregion(&s->mr_ps, MM_USB_0, mr);
+    memory_region_add_subregion(&s->mr_ps, map->xhci, mr);
 
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[VERSAL_USB0_IRQ_0]);
+    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->irq);
 
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1);
-    memory_region_add_subregion(&s->mr_ps, MM_USB2_CTRL_REGS, mr);
+    memory_region_add_subregion(&s->mr_ps, map->ctrl, mr);
+
+    node = versal_fdt_add_simple_subnode(s, "/usb", map->ctrl, 0x10000,
+                                         compat_versal_dwc3,
+                                         sizeof(compat_versal_dwc3));
+    qemu_fdt_setprop(s->cfg.fdt, node, "clock-names",
+                         clocknames, sizeof(clocknames));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "clocks",
+                               s->phandle.clk_25mhz, s->phandle.clk_125mhz);
+    qemu_fdt_setprop(s->cfg.fdt, node, "ranges", NULL, 0);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "#address-cells", 2);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "#size-cells", 2);
+
+    subnode = g_strdup_printf("/%s/dwc3", node);
+    g_free(node);
+
+    node = versal_fdt_add_simple_subnode(s, subnode, map->xhci, 0x10000,
+                                         compat_dwc3,
+                                         sizeof(compat_dwc3));
+    qemu_fdt_setprop(s->cfg.fdt, node, "interrupt-names",
+                     irq_name, sizeof(irq_name));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, map->irq,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node,
+                          "snps,quirk-frame-length-adjustment", 0x20);
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "#stream-id-cells", 1);
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "dr_mode", "host");
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "phy-names", "usb3-phy");
+    qemu_fdt_setprop(s->cfg.fdt, node, "snps,dis_u2_susphy_quirk", NULL, 0);
+    qemu_fdt_setprop(s->cfg.fdt, node, "snps,dis_u3_susphy_quirk", NULL, 0);
+    qemu_fdt_setprop(s->cfg.fdt, node, "snps,refclk_fladj", NULL, 0);
+    qemu_fdt_setprop(s->cfg.fdt, node, "snps,mask_phy_reset", NULL, 0);
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "maximum-speed", "high-speed");
 }
 
 static void versal_create_gem(Versal *s,
@@ -1017,10 +1066,6 @@ static void versal_create_crl(Versal *s, qemu_irq *pic)
                                  &error_abort);
     }
 
-    object_property_set_link(OBJECT(&s->lpd.crl),
-                             "usb", OBJECT(&s->lpd.iou.usb),
-                             &error_abort);
-
     sysbus_realize(sbd, &error_fatal);
     memory_region_add_subregion(&s->mr_ps, MM_CRL,
                                 sysbus_mmio_get_region(sbd, 0));
@@ -1208,7 +1253,10 @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     versal_create_xrams(s, &map->xram);
 
-    versal_create_usbs(s, pic);
+    for (i = 0; i < map->num_usb; i++) {
+        versal_create_usb(s, &map->usb[i]);
+    }
+
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 71c3314b8b..5d4b30f0ff 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -19,7 +19,6 @@
 #include "hw/intc/arm_gicv3.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
-#include "hw/usb/xlnx-usb-subsystem.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
@@ -74,10 +73,6 @@ struct Versal {
     struct {
         MemoryRegion mr_ocm;
 
-        struct {
-            VersalUsb2 usb;
-        } iou;
-
         /* Real-time Processing Unit.  */
         struct {
             MemoryRegion mr;

From 98cb650c5cd73e28ec389373dcc7a656bf70368a Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:28 +0200
Subject: [PATCH 1085/2396] hw/arm/xlnx-versal: efuse: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactore the eFuse devices creation using the VersalMap structure.

Note that the corresponding FDT nodes are removed. They do not
correspond to any real node in standard Versal DTBs. No matching drivers
exist for them.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-11-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 43 ++------------------
 hw/arm/xlnx-versal.c         | 78 +++++++++++++++++++++++-------------
 include/hw/arm/xlnx-versal.h |  5 +--
 3 files changed, 54 insertions(+), 72 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 5801598da7..b6c49dafe0 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -192,41 +192,6 @@ static void fdt_add_bbram_node(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_efuse_ctrl_node(VersalVirt *s)
-{
-    const char compat[] = TYPE_XLNX_VERSAL_EFUSE_CTRL;
-    const char interrupt_names[] = "pmc_efuse";
-    char *name = g_strdup_printf("/pmc_efuse@%x", MM_PMC_EFUSE_CTRL);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-
-    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_EFUSE_IRQ,
-                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
-                     interrupt_names, sizeof(interrupt_names));
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_PMC_EFUSE_CTRL,
-                                 2, MM_PMC_EFUSE_CTRL_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-    g_free(name);
-}
-
-static void fdt_add_efuse_cache_node(VersalVirt *s)
-{
-    const char compat[] = TYPE_XLNX_VERSAL_EFUSE_CACHE;
-    char *name = g_strdup_printf("/xlnx_pmc_efuse_cache@%x",
-                                 MM_PMC_EFUSE_CACHE);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_PMC_EFUSE_CACHE,
-                                 2, MM_PMC_EFUSE_CACHE_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-    g_free(name);
-}
-
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -393,7 +358,7 @@ static void bbram_attach_drive(XlnxBBRam *dev)
     }
 }
 
-static void efuse_attach_drive(XlnxEFuse *dev)
+static void efuse_attach_drive(VersalVirt *s)
 {
     DriveInfo *dinfo;
     BlockBackend *blk;
@@ -401,7 +366,7 @@ static void efuse_attach_drive(XlnxEFuse *dev)
     dinfo = drive_get_by_index(IF_PFLASH, 1);
     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
     if (blk) {
-        qdev_prop_set_drive(DEVICE(dev), "drive", blk);
+        versal_efuse_attach_drive(&s->soc, blk);
     }
 }
 
@@ -483,8 +448,6 @@ static void versal_virt_init(MachineState *machine)
     fdt_add_timer_nodes(s);
     fdt_add_rtc_node(s);
     fdt_add_bbram_node(s);
-    fdt_add_efuse_ctrl_node(s);
-    fdt_add_efuse_cache_node(s);
     fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
@@ -498,7 +461,7 @@ static void versal_virt_init(MachineState *machine)
     bbram_attach_drive(&s->soc.pmc.bbram);
 
     /* Attach efuse backend, if given */
-    efuse_attach_drive(&s->soc.pmc.efuse);
+    efuse_attach_drive(s);
 
     /* Plug SD cards */
     for (i = 0; i < versal_get_num_sdhci(VERSAL_VER_VERSAL); i++) {
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 946c017067..f8291ac614 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -33,6 +33,7 @@
 #include "hw/dma/xlnx-zdma.h"
 #include "hw/misc/xlnx-versal-xramc.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
+#include "hw/nvram/xlnx-versal-efuse.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -88,6 +89,12 @@ typedef struct VersalMap {
         int irq;
     } usb[2];
     size_t num_usb;
+
+    struct VersalEfuseMap {
+        uint64_t ctrl;
+        uint64_t cache;
+        int irq;
+    } efuse;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -119,6 +126,8 @@ static const VersalMap VERSAL_MAP = {
 
     .usb[0] = { .xhci = 0xfe200000, .ctrl = 0xff9d0000, .irq = 22 },
     .num_usb = 1,
+
+    .efuse = { .ctrl = 0xf1240000, .cache = 0xf1250000, .irq = 139 },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -752,42 +761,41 @@ static void versal_create_bbram(Versal *s, qemu_irq *pic)
                        qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 1));
 }
 
-static void versal_realize_efuse_part(Versal *s, Object *dev, hwaddr base)
+static void versal_create_efuse(Versal *s,
+                                const struct VersalEfuseMap *map)
 {
-    SysBusDevice *part = SYS_BUS_DEVICE(dev);
+    DeviceState *bits;
+    DeviceState *ctrl;
+    DeviceState *cache;
 
-    object_property_set_link(OBJECT(part), "efuse",
-                             OBJECT(&s->pmc.efuse), &error_abort);
+    ctrl = qdev_new(TYPE_XLNX_VERSAL_EFUSE_CTRL);
+    cache = qdev_new(TYPE_XLNX_VERSAL_EFUSE_CACHE);
+    bits = qdev_new(TYPE_XLNX_EFUSE);
 
-    sysbus_realize(part, &error_abort);
-    memory_region_add_subregion(&s->mr_ps, base,
-                                sysbus_mmio_get_region(part, 0));
-}
+    qdev_prop_set_uint32(bits, "efuse-nr", 3);
+    qdev_prop_set_uint32(bits, "efuse-size", 8192);
 
-static void versal_create_efuse(Versal *s, qemu_irq *pic)
-{
-    Object *bits = OBJECT(&s->pmc.efuse);
-    Object *ctrl = OBJECT(&s->pmc.efuse_ctrl);
-    Object *cache = OBJECT(&s->pmc.efuse_cache);
+    object_property_add_child(OBJECT(s), "efuse", OBJECT(bits));
+    qdev_realize_and_unref(bits, NULL, &error_abort);
 
-    object_initialize_child(OBJECT(s), "efuse-ctrl", &s->pmc.efuse_ctrl,
-                            TYPE_XLNX_VERSAL_EFUSE_CTRL);
+    object_property_set_link(OBJECT(ctrl), "efuse", OBJECT(bits), &error_abort);
 
-    object_initialize_child(OBJECT(s), "efuse-cache", &s->pmc.efuse_cache,
-                            TYPE_XLNX_VERSAL_EFUSE_CACHE);
+    object_property_set_link(OBJECT(cache), "efuse", OBJECT(bits),
+                             &error_abort);
 
-    object_initialize_child_with_props(ctrl, "xlnx-efuse@0", bits,
-                                       sizeof(s->pmc.efuse),
-                                       TYPE_XLNX_EFUSE, &error_abort,
-                                       "efuse-nr", "3",
-                                       "efuse-size", "8192",
-                                       NULL);
+    object_property_add_child(OBJECT(s), "efuse-cache", OBJECT(cache));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(cache), &error_abort);
 
-    qdev_realize(DEVICE(bits), NULL, &error_abort);
-    versal_realize_efuse_part(s, ctrl, MM_PMC_EFUSE_CTRL);
-    versal_realize_efuse_part(s, cache, MM_PMC_EFUSE_CACHE);
+    object_property_add_child(OBJECT(s), "efuse-ctrl", OBJECT(ctrl));
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(ctrl), &error_abort);
 
-    sysbus_connect_irq(SYS_BUS_DEVICE(ctrl), 0, pic[VERSAL_EFUSE_IRQ]);
+    memory_region_add_subregion(&s->mr_ps, map->ctrl,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(ctrl),
+                                                       0));
+    memory_region_add_subregion(&s->mr_ps, map->cache,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(cache),
+                                                       0));
+    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(ctrl), 0, map->irq);
 }
 
 static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
@@ -1257,11 +1265,12 @@ static void versal_realize(DeviceState *dev, Error **errp)
         versal_create_usb(s, &map->usb[i]);
     }
 
+    versal_create_efuse(s, &map->efuse);
+
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
     versal_create_bbram(s, pic);
-    versal_create_efuse(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
     versal_create_ospi(s, pic);
     versal_create_crl(s, pic);
@@ -1296,6 +1305,19 @@ void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk)
                            &error_fatal);
 }
 
+void versal_efuse_attach_drive(Versal *s, BlockBackend *blk)
+{
+    DeviceState *efuse;
+
+    efuse = DEVICE(versal_get_child(s, "efuse"));
+
+    if (efuse == NULL) {
+        return;
+    }
+
+    qdev_prop_set_drive(efuse, "drive", blk);
+}
+
 int versal_get_num_can(VersalVersion version)
 {
     const VersalMap *map = VERSION_TO_MAP[version];
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 5d4b30f0ff..79ca9b1332 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -20,7 +20,6 @@
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/nvram/xlnx-bbram.h"
-#include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
 #include "hw/dma/xlnx_csu_dma.h"
 #include "hw/misc/xlnx-versal-crl.h"
@@ -102,9 +101,6 @@ struct Versal {
         XlnxZynqMPRTC rtc;
         XlnxVersalTRng trng;
         XlnxBBRam bbram;
-        XlnxEFuse efuse;
-        XlnxVersalEFuseCtrl efuse_ctrl;
-        XlnxVersalEFuseCache efuse_cache;
         XlnxVersalCFUAPB cfu_apb;
         XlnxVersalCFUFDRO cfu_fdro;
         XlnxVersalCFUSFR cfu_sfr;
@@ -139,6 +135,7 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
 }
 
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
+void versal_efuse_attach_drive(Versal *s, BlockBackend *blk);
 
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);

From 6532bc7cc7f5560b7782a2799d9d5f0ac2719c42 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:29 +0200
Subject: [PATCH 1086/2396] hw/arm/xlnx-versal: ospi: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the OSPI controller creation using the VersalMap structure.

Note that the connection to the PMC IOU SLCR is removed for now and will
be re-added by next commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-12-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  41 ++++------
 hw/arm/xlnx-versal.c         | 142 ++++++++++++++++++++---------------
 include/hw/arm/xlnx-versal.h |  12 +--
 3 files changed, 98 insertions(+), 97 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index b6c49dafe0..a948e24aea 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -48,8 +48,8 @@ struct VersalVirt {
 
     struct {
         bool secure;
+        char *ospi_model;
     } cfg;
-    char *ospi_model;
 };
 
 static void fdt_create(VersalVirt *s)
@@ -381,15 +381,15 @@ static char *versal_get_ospi_model(Object *obj, Error **errp)
 {
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
 
-    return g_strdup(s->ospi_model);
+    return g_strdup(s->cfg.ospi_model);
 }
 
 static void versal_set_ospi_model(Object *obj, const char *value, Error **errp)
 {
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
 
-    g_free(s->ospi_model);
-    s->ospi_model = g_strdup(value);
+    g_free(s->cfg.ospi_model);
+    s->cfg.ospi_model = g_strdup(value);
 }
 
 
@@ -482,38 +482,27 @@ static void versal_virt_init(MachineState *machine)
     arm_load_kernel(&s->soc.fpd.apu.cpu[0], machine, &s->binfo);
 
     for (i = 0; i < XLNX_VERSAL_NUM_OSPI_FLASH; i++) {
-        BusState *spi_bus;
-        DeviceState *flash_dev;
         ObjectClass *flash_klass;
-        qemu_irq cs_line;
         DriveInfo *dinfo = drive_get(IF_MTD, 0, i);
+        BlockBackend *blk;
+        const char *mdl;
 
-        spi_bus = qdev_get_child_bus(DEVICE(&s->soc.pmc.iou.ospi), "spi0");
-
-        if (s->ospi_model) {
-            flash_klass = object_class_by_name(s->ospi_model);
+        if (s->cfg.ospi_model) {
+            flash_klass = object_class_by_name(s->cfg.ospi_model);
             if (!flash_klass ||
                 object_class_is_abstract(flash_klass) ||
                 !object_class_dynamic_cast(flash_klass, TYPE_M25P80)) {
                 error_report("'%s' is either abstract or"
-                       " not a subtype of m25p80", s->ospi_model);
+                       " not a subtype of m25p80", s->cfg.ospi_model);
                 exit(1);
             }
+            mdl = s->cfg.ospi_model;
+        } else {
+            mdl = "mt35xu01g";
         }
 
-        flash_dev = qdev_new(s->ospi_model ? s->ospi_model : "mt35xu01g");
-
-        if (dinfo) {
-            qdev_prop_set_drive_err(flash_dev, "drive",
-                                    blk_by_legacy_dinfo(dinfo), &error_fatal);
-        }
-        qdev_prop_set_uint8(flash_dev, "cs", i);
-        qdev_realize_and_unref(flash_dev, spi_bus, &error_fatal);
-
-        cs_line = qdev_get_gpio_in_named(flash_dev, SSI_GPIO_CS, 0);
-
-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->soc.pmc.iou.ospi),
-                           i + 1, cs_line);
+        blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
+        versal_ospi_create_flash(&s->soc, i, mdl, blk);
     }
 }
 
@@ -542,7 +531,7 @@ static void versal_virt_machine_finalize(Object *obj)
 {
     VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
 
-    g_free(s->ospi_model);
+    g_free(s->cfg.ospi_model);
     g_free(s->canbus);
 }
 
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index f8291ac614..964250bf15 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -34,6 +34,7 @@
 #include "hw/misc/xlnx-versal-xramc.h"
 #include "hw/usb/xlnx-usb-subsystem.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
+#include "hw/ssi/xlnx-versal-ospi.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -95,6 +96,15 @@ typedef struct VersalMap {
         uint64_t cache;
         int irq;
     } efuse;
+
+    struct VersalOspiMap {
+        uint64_t ctrl;
+        uint64_t dac;
+        uint64_t dac_sz;
+        uint64_t dma_src;
+        uint64_t dma_dst;
+        int irq;
+    } ospi;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -128,6 +138,13 @@ static const VersalMap VERSAL_MAP = {
     .num_usb = 1,
 
     .efuse = { .ctrl = 0xf1240000, .cache = 0xf1250000, .irq = 139 },
+
+    .ospi = {
+        .ctrl = 0xf1010000,
+        .dac = 0xc0000000, .dac_sz = 0x20000000,
+        .dma_src = 0xf1011000, .dma_dst = 0xf1011800,
+        .irq = 124,
+    },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -815,95 +832,74 @@ static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
                        qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
 }
 
-static void versal_create_ospi(Versal *s, qemu_irq *pic)
+static DeviceState *versal_create_ospi(Versal *s,
+                                       const struct VersalOspiMap *map)
 {
     SysBusDevice *sbd;
     MemoryRegion *mr_dac;
-    qemu_irq ospi_mux_sel;
-    DeviceState *orgate;
+    DeviceState *dev, *dma_dst, *dma_src, *orgate;
+    MemoryRegion *linear_mr = g_new(MemoryRegion, 1);
 
-    memory_region_init(&s->pmc.iou.ospi.linear_mr, OBJECT(s),
-                       "versal-ospi-linear-mr" , MM_PMC_OSPI_DAC_SIZE);
+    dev = qdev_new(TYPE_XILINX_VERSAL_OSPI);
+    object_property_add_child(OBJECT(s), "ospi", OBJECT(dev));
 
-    object_initialize_child(OBJECT(s), "versal-ospi", &s->pmc.iou.ospi.ospi,
-                            TYPE_XILINX_VERSAL_OSPI);
+    memory_region_init(linear_mr, OBJECT(dev), "linear-mr", map->dac_sz);
 
-    mr_dac = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 1);
-    memory_region_add_subregion(&s->pmc.iou.ospi.linear_mr, 0x0, mr_dac);
+    mr_dac = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 1);
+    memory_region_add_subregion(linear_mr, 0x0, mr_dac);
 
     /* Create the OSPI destination DMA */
-    object_initialize_child(OBJECT(s), "versal-ospi-dma-dst",
-                            &s->pmc.iou.ospi.dma_dst,
-                            TYPE_XLNX_CSU_DMA);
+    dma_dst = qdev_new(TYPE_XLNX_CSU_DMA);
+    object_property_add_child(OBJECT(dev), "dma-dst-dev", OBJECT(dma_dst));
+    object_property_set_link(OBJECT(dma_dst), "dma",
+                             OBJECT(get_system_memory()), &error_abort);
 
-    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_dst),
-                            "dma", OBJECT(get_system_memory()),
-                             &error_abort);
+    sbd = SYS_BUS_DEVICE(dma_dst);
+    sysbus_realize_and_unref(sbd, &error_fatal);
 
-    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst);
-    sysbus_realize(sbd, &error_fatal);
-
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_DST,
+    memory_region_add_subregion(&s->mr_ps, map->dma_dst,
                                 sysbus_mmio_get_region(sbd, 0));
 
     /* Create the OSPI source DMA */
-    object_initialize_child(OBJECT(s), "versal-ospi-dma-src",
-                            &s->pmc.iou.ospi.dma_src,
-                            TYPE_XLNX_CSU_DMA);
+    dma_src = qdev_new(TYPE_XLNX_CSU_DMA);
+    object_property_add_child(OBJECT(dev), "dma-src-dev", OBJECT(dma_src));
 
-    object_property_set_bool(OBJECT(&s->pmc.iou.ospi.dma_src), "is-dst",
-                             false, &error_abort);
+    object_property_set_bool(OBJECT(dma_src), "is-dst", false, &error_abort);
 
-    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
-                            "dma", OBJECT(mr_dac), &error_abort);
-
-    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
-                            "stream-connected-dma",
-                             OBJECT(&s->pmc.iou.ospi.dma_dst),
+    object_property_set_link(OBJECT(dma_src), "dma", OBJECT(mr_dac),
                              &error_abort);
 
-    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src);
-    sysbus_realize(sbd, &error_fatal);
+    object_property_set_link(OBJECT(dma_src), "stream-connected-dma",
+                             OBJECT(dma_dst), &error_abort);
 
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_SRC,
+    sbd = SYS_BUS_DEVICE(dma_src);
+    sysbus_realize_and_unref(sbd, &error_fatal);
+
+    memory_region_add_subregion(&s->mr_ps, map->dma_src,
                                 sysbus_mmio_get_region(sbd, 0));
 
     /* Realize the OSPI */
-    object_property_set_link(OBJECT(&s->pmc.iou.ospi.ospi), "dma-src",
-                             OBJECT(&s->pmc.iou.ospi.dma_src), &error_abort);
+    object_property_set_link(OBJECT(dev), "dma-src",
+                             OBJECT(dma_src), &error_abort);
 
-    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi);
-    sysbus_realize(sbd, &error_fatal);
+    sbd = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(sbd, &error_fatal);
 
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI,
+    memory_region_add_subregion(&s->mr_ps, map->ctrl,
                                 sysbus_mmio_get_region(sbd, 0));
 
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DAC,
-                                &s->pmc.iou.ospi.linear_mr);
-
-    /* ospi_mux_sel */
-    ospi_mux_sel = qdev_get_gpio_in_named(DEVICE(&s->pmc.iou.ospi.ospi),
-                                          "ospi-mux-sel", 0);
-    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "ospi-mux-sel", 0,
-                                ospi_mux_sel);
+    memory_region_add_subregion(&s->mr_ps, map->dac,
+                                linear_mr);
 
     /* OSPI irq */
-    object_initialize_child(OBJECT(s), "ospi-irq-orgate",
-                            &s->pmc.iou.ospi.irq_orgate, TYPE_OR_IRQ);
-    object_property_set_int(OBJECT(&s->pmc.iou.ospi.irq_orgate),
-                            "num-lines", NUM_OSPI_IRQ_LINES, &error_fatal);
+    orgate = create_or_gate(s, OBJECT(dev), "irq-orgate", NUM_OSPI_IRQ_LINES,
+                            map->irq);
 
-    orgate = DEVICE(&s->pmc.iou.ospi.irq_orgate);
-    qdev_realize(orgate, NULL, &error_fatal);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(orgate, 0));
+    sysbus_connect_irq(SYS_BUS_DEVICE(dma_src), 0, qdev_get_gpio_in(orgate, 1));
+    sysbus_connect_irq(SYS_BUS_DEVICE(dma_dst), 0, qdev_get_gpio_in(orgate, 2));
 
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 0,
-                       qdev_get_gpio_in(orgate, 0));
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src), 0,
-                       qdev_get_gpio_in(orgate, 1));
-    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst), 0,
-                       qdev_get_gpio_in(orgate, 2));
-
-    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
+    return dev;
 }
 
 static void versal_create_cfu(Versal *s, qemu_irq *pic)
@@ -1266,13 +1262,13 @@ static void versal_realize(DeviceState *dev, Error **errp)
     }
 
     versal_create_efuse(s, &map->efuse);
+    versal_create_ospi(s, &map->ospi);
 
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
     versal_create_bbram(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
-    versal_create_ospi(s, pic);
     versal_create_crl(s, pic);
     versal_create_cfu(s, pic);
     versal_map_ddr(s);
@@ -1318,6 +1314,30 @@ void versal_efuse_attach_drive(Versal *s, BlockBackend *blk)
     qdev_prop_set_drive(efuse, "drive", blk);
 }
 
+void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
+                              BlockBackend *blk)
+{
+    BusState *spi_bus;
+    DeviceState *flash, *ospi;
+    qemu_irq cs_line;
+
+    ospi = DEVICE(versal_get_child(s, "ospi"));
+    spi_bus = qdev_get_child_bus(ospi, "spi0");
+
+    flash = qdev_new(flash_mdl);
+
+    if (blk) {
+        qdev_prop_set_drive_err(flash, "drive", blk, &error_fatal);
+    }
+    qdev_prop_set_uint8(flash, "cs", flash_idx);
+    qdev_realize_and_unref(flash, spi_bus, &error_fatal);
+
+    cs_line = qdev_get_gpio_in_named(flash, SSI_GPIO_CS, 0);
+
+    sysbus_connect_irq(SYS_BUS_DEVICE(ospi),
+                       flash_idx + 1, cs_line);
+}
+
 int versal_get_num_can(VersalVersion version)
 {
     const VersalMap *map = VERSION_TO_MAP[version];
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 79ca9b1332..b7ef255d6f 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -20,8 +20,6 @@
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/nvram/xlnx-bbram.h"
-#include "hw/ssi/xlnx-versal-ospi.h"
-#include "hw/dma/xlnx_csu_dma.h"
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 #include "hw/misc/xlnx-versal-trng.h"
@@ -88,14 +86,6 @@ struct Versal {
     struct {
         struct {
             XlnxVersalPmcIouSlcr slcr;
-
-            struct {
-                XlnxVersalOspi ospi;
-                XlnxCSUDMA dma_src;
-                XlnxCSUDMA dma_dst;
-                MemoryRegion linear_mr;
-                OrIRQState irq_orgate;
-            } ospi;
         } iou;
 
         XlnxZynqMPRTC rtc;
@@ -136,6 +126,8 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
 
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
 void versal_efuse_attach_drive(Versal *s, BlockBackend *blk);
+void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
+                              BlockBackend *blk);
 
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);

From 1bec18fc13dce2f9a066fcb52b5d15b6d3141499 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:30 +0200
Subject: [PATCH 1087/2396] hw/arm/xlnx-versal: VersalMap: add support for
 OR'ed IRQs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Improve the IRQ index in the VersalMap structure to turn it into a
descriptor:
   - the lower 16 bits still represent the IRQ index
   - bit 18 is used to indicate a shared IRQ connected to a OR gate
   - bits 19 to 22 indicate the index on the OR gate.

This allows to share an IRQ among multiple devices. An OR gate is
created to connect the devices to the actual IRQ pin.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-13-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 63 +++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 62 insertions(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 964250bf15..d3a084a063 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -43,6 +43,17 @@
 #define VERSAL_NUM_PMC_APB_IRQS 18
 #define NUM_OSPI_IRQ_LINES 3
 
+/*
+ * IRQ descriptor to catch the following cases:
+ *   - Multiple devices can connect to the same IRQ. They are OR'ed together.
+ */
+FIELD(VERSAL_IRQ, IRQ, 0, 16)
+FIELD(VERSAL_IRQ, ORED, 18, 1)
+FIELD(VERSAL_IRQ, OR_IDX, 19, 4) /* input index on the IRQ OR gate */
+
+#define OR_IRQ(irq, or_idx) \
+    (R_VERSAL_IRQ_ORED_MASK | ((or_idx) << R_VERSAL_IRQ_OR_IDX_SHIFT) | (irq))
+
 typedef struct VersalSimplePeriphMap {
     uint64_t addr;
     int irq;
@@ -174,9 +185,53 @@ static inline Object *versal_get_child_idx(Versal *s, const char *child,
     return versal_get_child(s, n);
 }
 
+/*
+ * When the R_VERSAL_IRQ_ORED flag is set on an IRQ descriptor, this function is
+ * used to return the corresponding or gate input IRQ. The or gate is created if
+ * not already existant.
+ *
+ * Or gates are placed under the /soc/irq-or-gates QOM container.
+ */
+static qemu_irq versal_get_irq_or_gate_in(Versal *s, int irq_idx,
+                                          qemu_irq target_irq)
+{
+    Object *container = versal_get_child(s, "irq-or-gates");
+    DeviceState *dev;
+    g_autofree char *name;
+    int idx, or_idx;
+
+    idx = FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ);
+    or_idx = FIELD_EX32(irq_idx, VERSAL_IRQ, OR_IDX);
+
+    name = g_strdup_printf("irq[%d]", idx);
+    dev = DEVICE(object_resolve_path_at(container, name));
+
+    if (dev == NULL) {
+        dev = qdev_new(TYPE_OR_IRQ);
+        object_property_add_child(container, name, OBJECT(dev));
+        qdev_prop_set_uint16(dev, "num-lines", 1 << R_VERSAL_IRQ_OR_IDX_LENGTH);
+        qdev_realize_and_unref(dev, NULL, &error_abort);
+        qdev_connect_gpio_out(dev, 0, target_irq);
+    }
+
+    return qdev_get_gpio_in(dev, or_idx);
+}
+
 static qemu_irq versal_get_irq(Versal *s, int irq_idx)
 {
-    return qdev_get_gpio_in(DEVICE(&s->fpd.apu.gic), irq_idx);
+    qemu_irq irq;
+    bool ored;
+
+    ored = FIELD_EX32(irq_idx, VERSAL_IRQ, ORED);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->fpd.apu.gic),
+                           FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ));
+
+    if (ored) {
+        irq = versal_get_irq_or_gate_in(s, irq_idx, irq);
+    }
+
+    return irq;
 }
 
 static void versal_sysbus_connect_irq(Versal *s, SysBusDevice *sbd,
@@ -1217,6 +1272,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
     qemu_irq pic[XLNX_VERSAL_NR_IRQS];
+    Object *container;
     const VersalMap *map = versal_get_map(s);
     size_t i;
 
@@ -1227,6 +1283,11 @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     versal_create_apu_cpus(s);
     versal_create_apu_gic(s, pic);
+
+    container = object_new(TYPE_CONTAINER);
+    object_property_add_child(OBJECT(s), "irq-or-gates", container);
+    object_unref(container);
+
     versal_create_rpu_cpus(s);
 
     for (i = 0; i < map->num_uart; i++) {

From 482f95526a52eff123b810953b6f5eb9674e279b Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:31 +0200
Subject: [PATCH 1088/2396] hw/arm/xlnx-versal: PMC IOU SCLR: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the PMC IOU SLCR device creation using the VersalMap structure.
This is the first user of a shared IRQ using an OR gate. The OSPI
controller is reconnected to the SLCR.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-14-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 48 +++++++++++++++++++++---------------
 include/hw/arm/xlnx-versal.h |  5 ----
 2 files changed, 28 insertions(+), 25 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index d3a084a063..e71c774e72 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -35,6 +35,7 @@
 #include "hw/usb/xlnx-usb-subsystem.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
+#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -116,6 +117,8 @@ typedef struct VersalMap {
         uint64_t dma_dst;
         int irq;
     } ospi;
+
+    VersalSimplePeriphMap pmc_iou_slcr;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -156,6 +159,8 @@ static const VersalMap VERSAL_MAP = {
         .dma_src = 0xf1011000, .dma_dst = 0xf1011800,
         .irq = 124,
     },
+
+    .pmc_iou_slcr = { 0xf1060000, OR_IRQ(121, 0) },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -870,21 +875,24 @@ static void versal_create_efuse(Versal *s,
     versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(ctrl), 0, map->irq);
 }
 
-static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
+static DeviceState *versal_create_pmc_iou_slcr(Versal *s,
+                                               const VersalSimplePeriphMap *map)
 {
     SysBusDevice *sbd;
+    DeviceState *dev;
 
-    object_initialize_child(OBJECT(s), "versal-pmc-iou-slcr", &s->pmc.iou.slcr,
-                            TYPE_XILINX_VERSAL_PMC_IOU_SLCR);
+    dev = qdev_new(TYPE_XILINX_VERSAL_PMC_IOU_SLCR);
+    object_property_add_child(OBJECT(s), "pmc-iou-slcr", OBJECT(dev));
 
-    sbd = SYS_BUS_DEVICE(&s->pmc.iou.slcr);
-    sysbus_realize(sbd, &error_fatal);
+    sbd = SYS_BUS_DEVICE(dev);
+    sysbus_realize_and_unref(sbd, &error_fatal);
 
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_PMC_IOU_SLCR,
+    memory_region_add_subregion(&s->mr_ps, map->addr,
                                 sysbus_mmio_get_region(sbd, 0));
 
-    sysbus_connect_irq(sbd, 0,
-                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
+    versal_sysbus_connect_irq(s, sbd, 0, map->irq);
+
+    return dev;
 }
 
 static DeviceState *versal_create_ospi(Versal *s,
@@ -1210,6 +1218,7 @@ static void versal_unimp_irq_parity_imr(void *opaque, int n, int level)
 
 static void versal_unimp(Versal *s)
 {
+    DeviceState *slcr;
     qemu_irq gpio_in;
 
     versal_unimp_area(s, "psm", &s->mr_ps,
@@ -1232,23 +1241,18 @@ static void versal_unimp(Versal *s)
     qdev_init_gpio_in_named(DEVICE(s), versal_unimp_irq_parity_imr,
                             "irq-parity-imr-dummy", 1);
 
+    slcr = DEVICE(versal_get_child(s, "pmc-iou-slcr"));
     gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 0);
-    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 0,
-                                gpio_in);
+    qdev_connect_gpio_out_named(slcr, "sd-emmc-sel", 0, gpio_in);
 
     gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 1);
-    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 1,
-                                gpio_in);
+    qdev_connect_gpio_out_named(slcr, "sd-emmc-sel", 1, gpio_in);
 
     gpio_in = qdev_get_gpio_in_named(DEVICE(s), "qspi-ospi-mux-sel-dummy", 0);
-    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
-                                "qspi-ospi-mux-sel", 0,
-                                gpio_in);
+    qdev_connect_gpio_out_named(slcr, "qspi-ospi-mux-sel", 0, gpio_in);
 
     gpio_in = qdev_get_gpio_in_named(DEVICE(s), "irq-parity-imr-dummy", 0);
-    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
-                                SYSBUS_DEVICE_GPIO_IRQ, 0,
-                                gpio_in);
+    qdev_connect_gpio_out_named(slcr, SYSBUS_DEVICE_GPIO_IRQ, 0, gpio_in);
 }
 
 static uint32_t fdt_add_clk_node(Versal *s, const char *name,
@@ -1271,6 +1275,7 @@ static uint32_t fdt_add_clk_node(Versal *s, const char *name,
 static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
+    DeviceState *slcr, *ospi;
     qemu_irq pic[XLNX_VERSAL_NR_IRQS];
     Object *container;
     const VersalMap *map = versal_get_map(s);
@@ -1323,13 +1328,16 @@ static void versal_realize(DeviceState *dev, Error **errp)
     }
 
     versal_create_efuse(s, &map->efuse);
-    versal_create_ospi(s, &map->ospi);
+    ospi = versal_create_ospi(s, &map->ospi);
+    slcr = versal_create_pmc_iou_slcr(s, &map->pmc_iou_slcr);
 
+    qdev_connect_gpio_out_named(slcr, "ospi-mux-sel", 0,
+                                qdev_get_gpio_in_named(ospi,
+                                                       "ospi-mux-sel", 0));
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
     versal_create_bbram(s, pic);
-    versal_create_pmc_iou_slcr(s, pic);
     versal_create_crl(s, pic);
     versal_create_cfu(s, pic);
     versal_map_ddr(s);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index b7ef255d6f..78442e6c2c 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -21,7 +21,6 @@
 #include "qom/object.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/misc/xlnx-versal-crl.h"
-#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 #include "hw/misc/xlnx-versal-trng.h"
 #include "net/can_emu.h"
 #include "hw/misc/xlnx-versal-cfu.h"
@@ -84,10 +83,6 @@ struct Versal {
 
     /* The Platform Management Controller subsystem.  */
     struct {
-        struct {
-            XlnxVersalPmcIouSlcr slcr;
-        } iou;
-
         XlnxZynqMPRTC rtc;
         XlnxVersalTRng trng;
         XlnxBBRam bbram;

From c58d45a2b9d62638b94cc003c61603f5030dcba7 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:32 +0200
Subject: [PATCH 1089/2396] hw/arm/xlnx-versal: bbram: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the BBRAM device creation using the VersalMap structure.

Note that the corresponding FDT node is removed. It does not correspond
to any real node in standard Versal DTBs. No matching drivers exist for
it.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-15-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 27 +++---------------------
 hw/arm/xlnx-versal.c         | 41 +++++++++++++++++++++++++-----------
 include/hw/arm/xlnx-versal.h |  3 +--
 3 files changed, 33 insertions(+), 38 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index a948e24aea..f766a3e102 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -172,26 +172,6 @@ static void fdt_add_rtc_node(VersalVirt *s)
     g_free(name);
 }
 
-static void fdt_add_bbram_node(VersalVirt *s)
-{
-    const char compat[] = TYPE_XLNX_BBRAM;
-    const char interrupt_names[] = "bbram-error";
-    char *name = g_strdup_printf("/bbram@%x", MM_PMC_BBRAM_CTRL);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-
-    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_PMC_APB_IRQ,
-                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
-                     interrupt_names, sizeof(interrupt_names));
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_PMC_BBRAM_CTRL,
-                                 2, MM_PMC_BBRAM_CTRL_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-    g_free(name);
-}
-
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -346,7 +326,7 @@ static void create_virtio_regions(VersalVirt *s)
     }
 }
 
-static void bbram_attach_drive(XlnxBBRam *dev)
+static void bbram_attach_drive(VersalVirt *s)
 {
     DriveInfo *dinfo;
     BlockBackend *blk;
@@ -354,7 +334,7 @@ static void bbram_attach_drive(XlnxBBRam *dev)
     dinfo = drive_get_by_index(IF_PFLASH, 0);
     blk = dinfo ? blk_by_legacy_dinfo(dinfo) : NULL;
     if (blk) {
-        qdev_prop_set_drive(DEVICE(dev), "drive", blk);
+        versal_bbram_attach_drive(&s->soc, blk);
     }
 }
 
@@ -447,7 +427,6 @@ static void versal_virt_init(MachineState *machine)
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
     fdt_add_rtc_node(s);
-    fdt_add_bbram_node(s);
     fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
@@ -458,7 +437,7 @@ static void versal_virt_init(MachineState *machine)
                                         0, &s->soc.fpd.apu.mr, 0);
 
     /* Attach bbram backend, if given */
-    bbram_attach_drive(&s->soc.pmc.bbram);
+    bbram_attach_drive(s);
 
     /* Attach efuse backend, if given */
     efuse_attach_drive(s);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index e71c774e72..31ceaf61be 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -36,6 +36,7 @@
 #include "hw/nvram/xlnx-versal-efuse.h"
 #include "hw/ssi/xlnx-versal-ospi.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
+#include "hw/nvram/xlnx-bbram.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -119,6 +120,7 @@ typedef struct VersalMap {
     } ospi;
 
     VersalSimplePeriphMap pmc_iou_slcr;
+    VersalSimplePeriphMap bbram;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -161,6 +163,7 @@ static const VersalMap VERSAL_MAP = {
     },
 
     .pmc_iou_slcr = { 0xf1060000, OR_IRQ(121, 0) },
+    .bbram = { 0xf11f0000, OR_IRQ(121, 1) },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -820,22 +823,21 @@ static void versal_create_xrams(Versal *s, const struct VersalXramMap *map)
     }
 }
 
-static void versal_create_bbram(Versal *s, qemu_irq *pic)
+static void versal_create_bbram(Versal *s,
+                                const VersalSimplePeriphMap *map)
 {
+    DeviceState *dev;
     SysBusDevice *sbd;
 
-    object_initialize_child_with_props(OBJECT(s), "bbram", &s->pmc.bbram,
-                                       sizeof(s->pmc.bbram), TYPE_XLNX_BBRAM,
-                                       &error_fatal,
-                                       "crc-zpads", "0",
-                                       NULL);
-    sbd = SYS_BUS_DEVICE(&s->pmc.bbram);
+    dev = qdev_new(TYPE_XLNX_BBRAM);
+    sbd = SYS_BUS_DEVICE(dev);
 
-    sysbus_realize(sbd, &error_fatal);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_BBRAM_CTRL,
+    object_property_add_child(OBJECT(s), "bbram", OBJECT(dev));
+    qdev_prop_set_uint32(dev, "crc-zpads", 0);
+    sysbus_realize_and_unref(sbd, &error_abort);
+    memory_region_add_subregion(&s->mr_ps, map->addr,
                                 sysbus_mmio_get_region(sbd, 0));
-    sysbus_connect_irq(sbd, 0,
-                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 1));
+    versal_sysbus_connect_irq(s, sbd, 0, map->irq);
 }
 
 static void versal_create_efuse(Versal *s,
@@ -1334,10 +1336,12 @@ static void versal_realize(DeviceState *dev, Error **errp)
     qdev_connect_gpio_out_named(slcr, "ospi-mux-sel", 0,
                                 qdev_get_gpio_in_named(ospi,
                                                        "ospi-mux-sel", 0));
+
+    versal_create_bbram(s, &map->bbram);
+
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_trng(s, pic);
-    versal_create_bbram(s, pic);
     versal_create_crl(s, pic);
     versal_create_cfu(s, pic);
     versal_map_ddr(s);
@@ -1383,6 +1387,19 @@ void versal_efuse_attach_drive(Versal *s, BlockBackend *blk)
     qdev_prop_set_drive(efuse, "drive", blk);
 }
 
+void versal_bbram_attach_drive(Versal *s, BlockBackend *blk)
+{
+    DeviceState *bbram;
+
+    bbram = DEVICE(versal_get_child(s, "bbram"));
+
+    if (bbram == NULL) {
+        return;
+    }
+
+    qdev_prop_set_drive(bbram, "drive", blk);
+}
+
 void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
                               BlockBackend *blk)
 {
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 78442e6c2c..9adce02f8a 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -19,7 +19,6 @@
 #include "hw/intc/arm_gicv3.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
-#include "hw/nvram/xlnx-bbram.h"
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/misc/xlnx-versal-trng.h"
 #include "net/can_emu.h"
@@ -85,7 +84,6 @@ struct Versal {
     struct {
         XlnxZynqMPRTC rtc;
         XlnxVersalTRng trng;
-        XlnxBBRam bbram;
         XlnxVersalCFUAPB cfu_apb;
         XlnxVersalCFUFDRO cfu_fdro;
         XlnxVersalCFUSFR cfu_sfr;
@@ -121,6 +119,7 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
 
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
 void versal_efuse_attach_drive(Versal *s, BlockBackend *blk);
+void versal_bbram_attach_drive(Versal *s, BlockBackend *blk);
 void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
                               BlockBackend *blk);
 

From 060b809271f9d0d6205fe2232d0aead4a37fa0e7 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:33 +0200
Subject: [PATCH 1090/2396] hw/arm/xlnx-versal: trng: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the TRNG device creation using the VersalMap structure.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-16-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 18 ++++++++++--------
 include/hw/arm/xlnx-versal.h |  2 --
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 31ceaf61be..7a97d5df6b 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -37,6 +37,7 @@
 #include "hw/ssi/xlnx-versal-ospi.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 #include "hw/nvram/xlnx-bbram.h"
+#include "hw/misc/xlnx-versal-trng.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -121,6 +122,7 @@ typedef struct VersalMap {
 
     VersalSimplePeriphMap pmc_iou_slcr;
     VersalSimplePeriphMap bbram;
+    VersalSimplePeriphMap trng;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -164,6 +166,7 @@ static const VersalMap VERSAL_MAP = {
 
     .pmc_iou_slcr = { 0xf1060000, OR_IRQ(121, 0) },
     .bbram = { 0xf11f0000, OR_IRQ(121, 1) },
+    .trng = { 0xf1230000, 141 },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -780,19 +783,18 @@ static void versal_create_rtc(Versal *s, qemu_irq *pic)
                        qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 0));
 }
 
-static void versal_create_trng(Versal *s, qemu_irq *pic)
+static void versal_create_trng(Versal *s, const VersalSimplePeriphMap *map)
 {
     SysBusDevice *sbd;
     MemoryRegion *mr;
 
-    object_initialize_child(OBJECT(s), "trng", &s->pmc.trng,
-                            TYPE_XLNX_VERSAL_TRNG);
-    sbd = SYS_BUS_DEVICE(&s->pmc.trng);
-    sysbus_realize(sbd, &error_fatal);
+    sbd = SYS_BUS_DEVICE(qdev_new(TYPE_XLNX_VERSAL_TRNG));
+    object_property_add_child(OBJECT(s), "trng", OBJECT(sbd));
+    sysbus_realize_and_unref(sbd, &error_abort);
 
     mr = sysbus_mmio_get_region(sbd, 0);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_TRNG, mr);
-    sysbus_connect_irq(sbd, 0, pic[VERSAL_TRNG_IRQ]);
+    memory_region_add_subregion(&s->mr_ps, map->addr, mr);
+    versal_sysbus_connect_irq(s, sbd, 0, map->irq);
 }
 
 static void versal_create_xrams(Versal *s, const struct VersalXramMap *map)
@@ -1338,10 +1340,10 @@ static void versal_realize(DeviceState *dev, Error **errp)
                                                        "ospi-mux-sel", 0));
 
     versal_create_bbram(s, &map->bbram);
+    versal_create_trng(s, &map->trng);
 
     versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
-    versal_create_trng(s, pic);
     versal_create_crl(s, pic);
     versal_create_cfu(s, pic);
     versal_map_ddr(s);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 9adce02f8a..bba96201d3 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -20,7 +20,6 @@
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/misc/xlnx-versal-crl.h"
-#include "hw/misc/xlnx-versal-trng.h"
 #include "net/can_emu.h"
 #include "hw/misc/xlnx-versal-cfu.h"
 #include "hw/misc/xlnx-versal-cframe-reg.h"
@@ -83,7 +82,6 @@ struct Versal {
     /* The Platform Management Controller subsystem.  */
     struct {
         XlnxZynqMPRTC rtc;
-        XlnxVersalTRng trng;
         XlnxVersalCFUAPB cfu_apb;
         XlnxVersalCFUFDRO cfu_fdro;
         XlnxVersalCFUSFR cfu_sfr;

From 176faad4bf7565966398df0d6e8cd05825dfceea Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:34 +0200
Subject: [PATCH 1091/2396] hw/arm/xlnx-versal: rtc: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the RTC device creation using the VersalMap structure.

The sysbus IRQ output 0 (APB IRQ) is connected instead of the output 1
(addr error IRQ). This does not change the current behaviour since the
RTC model does not implement those IRQs anyway.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-17-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 22 --------------------
 hw/arm/xlnx-versal.c         | 40 ++++++++++++++++++++++++++++--------
 include/hw/arm/xlnx-versal.h |  2 --
 3 files changed, 31 insertions(+), 33 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index f766a3e102..d96f343392 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -151,27 +151,6 @@ static void fdt_add_timer_nodes(VersalVirt *s)
                      compat, sizeof(compat));
 }
 
-static void fdt_add_rtc_node(VersalVirt *s)
-{
-    const char compat[] = "xlnx,zynqmp-rtc";
-    const char interrupt_names[] = "alarm\0sec";
-    char *name = g_strdup_printf("/rtc@%x", MM_PMC_RTC);
-
-    qemu_fdt_add_subnode(s->fdt, name);
-
-    qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_ALARM_IRQ,
-                           GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_RTC_SECONDS_IRQ,
-                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    qemu_fdt_setprop(s->fdt, name, "interrupt-names",
-                     interrupt_names, sizeof(interrupt_names));
-    qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
-                                 2, MM_PMC_RTC, 2, MM_PMC_RTC_SIZE);
-    qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));
-    g_free(name);
-}
-
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -426,7 +405,6 @@ static void versal_virt_init(MachineState *machine)
 
     fdt_add_gic_nodes(s);
     fdt_add_timer_nodes(s);
-    fdt_add_rtc_node(s);
     fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 7a97d5df6b..9b1e0d46f1 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -38,6 +38,7 @@
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/misc/xlnx-versal-trng.h"
+#include "hw/rtc/xlnx-zynqmp-rtc.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -123,6 +124,12 @@ typedef struct VersalMap {
     VersalSimplePeriphMap pmc_iou_slcr;
     VersalSimplePeriphMap bbram;
     VersalSimplePeriphMap trng;
+
+    struct VersalRtcMap {
+        VersalSimplePeriphMap map;
+        int alarm_irq;
+        int second_irq;
+    } rtc;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -167,6 +174,10 @@ static const VersalMap VERSAL_MAP = {
     .pmc_iou_slcr = { 0xf1060000, OR_IRQ(121, 0) },
     .bbram = { 0xf11f0000, OR_IRQ(121, 1) },
     .trng = { 0xf1230000, 141 },
+    .rtc = {
+        { 0xf12a0000, OR_IRQ(121, 2) },
+        .alarm_irq = 142, .second_irq = 143
+    },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -762,25 +773,36 @@ static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
     qdev_connect_gpio_out(orgate, 0, pic[VERSAL_PMC_APB_IRQ]);
 }
 
-static void versal_create_rtc(Versal *s, qemu_irq *pic)
+static void versal_create_rtc(Versal *s, const struct VersalRtcMap *map)
 {
     SysBusDevice *sbd;
     MemoryRegion *mr;
+    g_autofree char *node;
+    const char compatible[] = "xlnx,zynqmp-rtc";
+    const char interrupt_names[] = "alarm\0sec";
 
-    object_initialize_child(OBJECT(s), "rtc", &s->pmc.rtc,
-                            TYPE_XLNX_ZYNQMP_RTC);
-    sbd = SYS_BUS_DEVICE(&s->pmc.rtc);
-    sysbus_realize(sbd, &error_fatal);
+    sbd = SYS_BUS_DEVICE(qdev_new(TYPE_XLNX_ZYNQMP_RTC));
+    object_property_add_child(OBJECT(s), "rtc", OBJECT(sbd));
+    sysbus_realize_and_unref(sbd, &error_abort);
 
     mr = sysbus_mmio_get_region(sbd, 0);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_RTC, mr);
+    memory_region_add_subregion(&s->mr_ps, map->map.addr, mr);
 
     /*
      * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
      * supports them.
      */
-    sysbus_connect_irq(sbd, 1,
-                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 0));
+    versal_sysbus_connect_irq(s, sbd, 0, map->map.irq);
+
+    node = versal_fdt_add_simple_subnode(s, "/rtc", map->map.addr, 0x10000,
+                                         compatible, sizeof(compatible));
+    qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                           GIC_FDT_IRQ_TYPE_SPI, map->alarm_irq,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                           GIC_FDT_IRQ_TYPE_SPI, map->second_irq,
+                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+    qemu_fdt_setprop(s->cfg.fdt, node, "interrupt-names",
+                     interrupt_names, sizeof(interrupt_names));
 }
 
 static void versal_create_trng(Versal *s, const VersalSimplePeriphMap *map)
@@ -1341,9 +1363,9 @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     versal_create_bbram(s, &map->bbram);
     versal_create_trng(s, &map->trng);
+    versal_create_rtc(s, &map->rtc);
 
     versal_create_pmc_apb_irq_orgate(s, pic);
-    versal_create_rtc(s, pic);
     versal_create_crl(s, pic);
     versal_create_cfu(s, pic);
     versal_map_ddr(s);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index bba96201d3..abdbed1568 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -17,7 +17,6 @@
 #include "hw/cpu/cluster.h"
 #include "hw/or-irq.h"
 #include "hw/intc/arm_gicv3.h"
-#include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "qom/object.h"
 #include "hw/misc/xlnx-versal-crl.h"
 #include "net/can_emu.h"
@@ -81,7 +80,6 @@ struct Versal {
 
     /* The Platform Management Controller subsystem.  */
     struct {
-        XlnxZynqMPRTC rtc;
         XlnxVersalCFUAPB cfu_apb;
         XlnxVersalCFUFDRO cfu_fdro;
         XlnxVersalCFUSFR cfu_sfr;

From b913b3cb26d531f71ccf89e886c0d0f520e80077 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:35 +0200
Subject: [PATCH 1092/2396] hw/arm/xlnx-versal: cfu: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the CFU device creation using the VersalMap structure. All
users of the APB IRQ OR gate have now been converted. The OR gate device
can be dropped.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-18-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 276 ++++++++++++++++-------------------
 include/hw/arm/xlnx-versal.h |  14 --
 2 files changed, 124 insertions(+), 166 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 9b1e0d46f1..81adf8d35b 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -39,6 +39,9 @@
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/misc/xlnx-versal-trng.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
+#include "hw/misc/xlnx-versal-cfu.h"
+#include "hw/misc/xlnx-versal-cframe-reg.h"
+#include "hw/or-irq.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -130,6 +133,24 @@ typedef struct VersalMap {
         int alarm_irq;
         int second_irq;
     } rtc;
+
+    struct VersalCfuMap {
+        uint64_t cframe_base;
+        uint64_t cframe_stride;
+        uint64_t cfu_fdro;
+        uint64_t cframe_bcast_reg;
+        uint64_t cframe_bcast_fdri;
+        uint64_t cfu_apb;
+        uint64_t cfu_stream;
+        uint64_t cfu_stream_2;
+        uint64_t cfu_sfr;
+        int cfu_apb_irq;
+        int cframe_irq;
+        size_t num_cframe;
+        struct VersalCfuCframeCfg {
+            uint32_t blktype_frames[7];
+        } cframe_cfg[15];
+    } cfu;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -178,6 +199,22 @@ static const VersalMap VERSAL_MAP = {
         { 0xf12a0000, OR_IRQ(121, 2) },
         .alarm_irq = 142, .second_irq = 143
     },
+
+    .cfu = {
+        .cframe_base = 0xf12d0000, .cframe_stride = 0x1000,
+        .cframe_bcast_reg = 0xf12ee000, .cframe_bcast_fdri = 0xf12ef000,
+        .cfu_apb = 0xf12b0000, .cfu_sfr = 0xf12c1000,
+        .cfu_stream = 0xf12c0000, .cfu_stream_2 = 0xf1f80000,
+        .cfu_fdro = 0xf12c2000,
+        .cfu_apb_irq = 120, .cframe_irq = OR_IRQ(121, 3),
+        .num_cframe = 15,
+        .cframe_cfg = {
+            { { 34111, 3528, 12800, 11, 5, 1, 1 } },
+            { { 38498, 3841, 15361, 13, 7, 3, 1 } },
+            { { 38498, 3841, 15361, 13, 7, 3, 1 } },
+            { { 38498, 3841, 15361, 13, 7, 3, 1 } },
+        },
+    },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -752,27 +789,6 @@ static void versal_create_sdhci(Versal *s,
                            GIC_FDT_IRQ_FLAGS_LEVEL_HI);
 }
 
-static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
-{
-    DeviceState *orgate;
-
-    /*
-     * The VERSAL_PMC_APB_IRQ is an 'or' of the interrupts from the following
-     * models:
-     *  - RTC
-     *  - BBRAM
-     *  - PMC SLCR
-     *  - CFRAME regs (input 3 - 17 to the orgate)
-     */
-    object_initialize_child(OBJECT(s), "pmc-apb-irq-orgate",
-                            &s->pmc.apb_irq_orgate, TYPE_OR_IRQ);
-    orgate = DEVICE(&s->pmc.apb_irq_orgate);
-    object_property_set_int(OBJECT(orgate),
-                            "num-lines", VERSAL_NUM_PMC_APB_IRQS, &error_fatal);
-    qdev_realize(orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_PMC_APB_IRQ]);
-}
-
 static void versal_create_rtc(Versal *s, const struct VersalRtcMap *map)
 {
     SysBusDevice *sbd;
@@ -991,154 +1007,111 @@ static DeviceState *versal_create_ospi(Versal *s,
     return dev;
 }
 
-static void versal_create_cfu(Versal *s, qemu_irq *pic)
+static void versal_create_cfu(Versal *s, const struct VersalCfuMap *map)
 {
     SysBusDevice *sbd;
-    DeviceState *dev;
+    Object *container;
+    DeviceState *cfu_fdro, *cfu_apb, *cfu_sfr, *cframe_bcast;
+    DeviceState *cframe_irq_or;
     int i;
-    const struct {
-        uint64_t reg_base;
-        uint64_t fdri_base;
-    } cframe_addr[] = {
-        { MM_PMC_CFRAME0_REG, MM_PMC_CFRAME0_FDRI },
-        { MM_PMC_CFRAME1_REG, MM_PMC_CFRAME1_FDRI },
-        { MM_PMC_CFRAME2_REG, MM_PMC_CFRAME2_FDRI },
-        { MM_PMC_CFRAME3_REG, MM_PMC_CFRAME3_FDRI },
-        { MM_PMC_CFRAME4_REG, MM_PMC_CFRAME4_FDRI },
-        { MM_PMC_CFRAME5_REG, MM_PMC_CFRAME5_FDRI },
-        { MM_PMC_CFRAME6_REG, MM_PMC_CFRAME6_FDRI },
-        { MM_PMC_CFRAME7_REG, MM_PMC_CFRAME7_FDRI },
-        { MM_PMC_CFRAME8_REG, MM_PMC_CFRAME8_FDRI },
-        { MM_PMC_CFRAME9_REG, MM_PMC_CFRAME9_FDRI },
-        { MM_PMC_CFRAME10_REG, MM_PMC_CFRAME10_FDRI },
-        { MM_PMC_CFRAME11_REG, MM_PMC_CFRAME11_FDRI },
-        { MM_PMC_CFRAME12_REG, MM_PMC_CFRAME12_FDRI },
-        { MM_PMC_CFRAME13_REG, MM_PMC_CFRAME13_FDRI },
-        { MM_PMC_CFRAME14_REG, MM_PMC_CFRAME14_FDRI },
-    };
-    const struct {
-        uint32_t blktype0_frames;
-        uint32_t blktype1_frames;
-        uint32_t blktype2_frames;
-        uint32_t blktype3_frames;
-        uint32_t blktype4_frames;
-        uint32_t blktype5_frames;
-        uint32_t blktype6_frames;
-    } cframe_cfg[] = {
-        [0] = { 34111, 3528, 12800, 11, 5, 1, 1 },
-        [1] = { 38498, 3841, 15361, 13, 7, 3, 1 },
-        [2] = { 38498, 3841, 15361, 13, 7, 3, 1 },
-        [3] = { 38498, 3841, 15361, 13, 7, 3, 1 },
-    };
+
+    container = object_new(TYPE_CONTAINER);
+    object_property_add_child(OBJECT(s), "cfu", container);
+    object_unref(container);
 
     /* CFU FDRO */
-    object_initialize_child(OBJECT(s), "cfu-fdro", &s->pmc.cfu_fdro,
-                            TYPE_XLNX_VERSAL_CFU_FDRO);
-    sbd = SYS_BUS_DEVICE(&s->pmc.cfu_fdro);
+    cfu_fdro = qdev_new(TYPE_XLNX_VERSAL_CFU_FDRO);
+    object_property_add_child(container, "cfu-fdro", OBJECT(cfu_fdro));
+    sbd = SYS_BUS_DEVICE(cfu_fdro);
 
-    sysbus_realize(sbd, &error_fatal);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFU_FDRO,
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    memory_region_add_subregion(&s->mr_ps, map->cfu_fdro,
                                 sysbus_mmio_get_region(sbd, 0));
 
-    /* CFRAME REG */
-    for (i = 0; i < ARRAY_SIZE(s->pmc.cframe); i++) {
-        g_autofree char *name = g_strdup_printf("cframe%d", i);
-
-        object_initialize_child(OBJECT(s), name, &s->pmc.cframe[i],
-                                TYPE_XLNX_VERSAL_CFRAME_REG);
-
-        sbd = SYS_BUS_DEVICE(&s->pmc.cframe[i]);
-        dev = DEVICE(&s->pmc.cframe[i]);
-
-        if (i < ARRAY_SIZE(cframe_cfg)) {
-            object_property_set_int(OBJECT(dev), "blktype0-frames",
-                                    cframe_cfg[i].blktype0_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype1-frames",
-                                    cframe_cfg[i].blktype1_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype2-frames",
-                                    cframe_cfg[i].blktype2_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype3-frames",
-                                    cframe_cfg[i].blktype3_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype4-frames",
-                                    cframe_cfg[i].blktype4_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype5-frames",
-                                    cframe_cfg[i].blktype5_frames,
-                                    &error_abort);
-            object_property_set_int(OBJECT(dev), "blktype6-frames",
-                                    cframe_cfg[i].blktype6_frames,
-                                    &error_abort);
-        }
-        object_property_set_link(OBJECT(dev), "cfu-fdro",
-                                 OBJECT(&s->pmc.cfu_fdro), &error_fatal);
-
-        sysbus_realize(SYS_BUS_DEVICE(dev), &error_fatal);
-
-        memory_region_add_subregion(&s->mr_ps, cframe_addr[i].reg_base,
-                                    sysbus_mmio_get_region(sbd, 0));
-        memory_region_add_subregion(&s->mr_ps, cframe_addr[i].fdri_base,
-                                    sysbus_mmio_get_region(sbd, 1));
-        sysbus_connect_irq(sbd, 0,
-                           qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate),
-                                            3 + i));
-    }
-
-    /* CFRAME BCAST */
-    object_initialize_child(OBJECT(s), "cframe_bcast", &s->pmc.cframe_bcast,
-                            TYPE_XLNX_VERSAL_CFRAME_BCAST_REG);
-
-    sbd = SYS_BUS_DEVICE(&s->pmc.cframe_bcast);
-    dev = DEVICE(&s->pmc.cframe_bcast);
-
-    for (i = 0; i < ARRAY_SIZE(s->pmc.cframe); i++) {
-        g_autofree char *propname = g_strdup_printf("cframe%d", i);
-        object_property_set_link(OBJECT(dev), propname,
-                                 OBJECT(&s->pmc.cframe[i]), &error_fatal);
-    }
-
-    sysbus_realize(sbd, &error_fatal);
-
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFRAME_BCAST_REG,
-                                sysbus_mmio_get_region(sbd, 0));
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFRAME_BCAST_FDRI,
-                                sysbus_mmio_get_region(sbd, 1));
+    /* cframe bcast */
+    cframe_bcast = qdev_new(TYPE_XLNX_VERSAL_CFRAME_BCAST_REG);
+    object_property_add_child(container, "cframe-bcast", OBJECT(cframe_bcast));
 
     /* CFU APB */
-    object_initialize_child(OBJECT(s), "cfu-apb", &s->pmc.cfu_apb,
-                            TYPE_XLNX_VERSAL_CFU_APB);
-    sbd = SYS_BUS_DEVICE(&s->pmc.cfu_apb);
-    dev = DEVICE(&s->pmc.cfu_apb);
+    cfu_apb = qdev_new(TYPE_XLNX_VERSAL_CFU_APB);
+    object_property_add_child(container, "cfu-apb", OBJECT(cfu_apb));
 
-    for (i = 0; i < ARRAY_SIZE(s->pmc.cframe); i++) {
-        g_autofree char *propname = g_strdup_printf("cframe%d", i);
-        object_property_set_link(OBJECT(dev), propname,
-                                 OBJECT(&s->pmc.cframe[i]), &error_fatal);
+    /* IRQ or gate for cframes */
+    cframe_irq_or = qdev_new(TYPE_OR_IRQ);
+    object_property_add_child(container, "cframe-irq-or-gate",
+                              OBJECT(cframe_irq_or));
+    qdev_prop_set_uint16(cframe_irq_or, "num-lines", map->num_cframe);
+    qdev_realize_and_unref(cframe_irq_or, NULL, &error_abort);
+    versal_qdev_connect_gpio_out(s, cframe_irq_or, 0, map->cframe_irq);
+
+    /* cframe reg */
+    for (i = 0; i < map->num_cframe; i++) {
+        uint64_t reg_base;
+        uint64_t fdri_base;
+        DeviceState *dev;
+        g_autofree char *prop_name;
+        size_t j;
+
+        dev = qdev_new(TYPE_XLNX_VERSAL_CFRAME_REG);
+        object_property_add_child(container, "cframe[*]", OBJECT(dev));
+
+        sbd = SYS_BUS_DEVICE(dev);
+
+        for (j = 0; j < ARRAY_SIZE(map->cframe_cfg[i].blktype_frames); j++) {
+            g_autofree char *blktype_prop_name;
+
+            blktype_prop_name = g_strdup_printf("blktype%zu-frames", j);
+            object_property_set_int(OBJECT(dev), blktype_prop_name,
+                                    map->cframe_cfg[i].blktype_frames[j],
+                                    &error_abort);
+        }
+
+        object_property_set_link(OBJECT(dev), "cfu-fdro",
+                                 OBJECT(cfu_fdro), &error_abort);
+
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_abort);
+
+        reg_base = map->cframe_base + i * map->cframe_stride * 2;
+        fdri_base = reg_base + map->cframe_stride;
+        memory_region_add_subregion(&s->mr_ps, reg_base,
+                                    sysbus_mmio_get_region(sbd, 0));
+        memory_region_add_subregion(&s->mr_ps, fdri_base,
+                                    sysbus_mmio_get_region(sbd, 1));
+        sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(cframe_irq_or, i));
+
+        prop_name = g_strdup_printf("cframe%d", i);
+        object_property_set_link(OBJECT(cframe_bcast), prop_name,
+                                 OBJECT(dev), &error_abort);
+        object_property_set_link(OBJECT(cfu_apb), prop_name,
+                                 OBJECT(dev), &error_abort);
     }
 
-    sysbus_realize(sbd, &error_fatal);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFU_APB,
+    sbd = SYS_BUS_DEVICE(cframe_bcast);
+    sysbus_realize_and_unref(sbd, &error_abort);
+    memory_region_add_subregion(&s->mr_ps, map->cframe_bcast_reg,
                                 sysbus_mmio_get_region(sbd, 0));
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFU_STREAM,
+    memory_region_add_subregion(&s->mr_ps, map->cframe_bcast_fdri,
                                 sysbus_mmio_get_region(sbd, 1));
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFU_STREAM_2,
+
+    sbd = SYS_BUS_DEVICE(cfu_apb);
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    memory_region_add_subregion(&s->mr_ps, map->cfu_apb,
+                                sysbus_mmio_get_region(sbd, 0));
+    memory_region_add_subregion(&s->mr_ps, map->cfu_stream,
+                                sysbus_mmio_get_region(sbd, 1));
+    memory_region_add_subregion(&s->mr_ps, map->cfu_stream_2,
                                 sysbus_mmio_get_region(sbd, 2));
-    sysbus_connect_irq(sbd, 0, pic[VERSAL_CFU_IRQ_0]);
+    versal_sysbus_connect_irq(s, sbd, 0, map->cfu_apb_irq);
 
     /* CFU SFR */
-    object_initialize_child(OBJECT(s), "cfu-sfr", &s->pmc.cfu_sfr,
-                            TYPE_XLNX_VERSAL_CFU_SFR);
+    cfu_sfr = qdev_new(TYPE_XLNX_VERSAL_CFU_SFR);
+    object_property_add_child(container, "cfu-sfr", OBJECT(cfu_sfr));
+    sbd = SYS_BUS_DEVICE(cfu_sfr);
 
-    sbd = SYS_BUS_DEVICE(&s->pmc.cfu_sfr);
-
-    object_property_set_link(OBJECT(&s->pmc.cfu_sfr),
-                            "cfu", OBJECT(&s->pmc.cfu_apb), &error_abort);
-
-    sysbus_realize(sbd, &error_fatal);
-    memory_region_add_subregion(&s->mr_ps, MM_PMC_CFU_SFR,
+    object_property_set_link(OBJECT(cfu_sfr),
+                            "cfu", OBJECT(cfu_apb), &error_abort);
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    memory_region_add_subregion(&s->mr_ps, map->cfu_sfr,
                                 sysbus_mmio_get_region(sbd, 0));
 }
 
@@ -1364,10 +1337,9 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_bbram(s, &map->bbram);
     versal_create_trng(s, &map->trng);
     versal_create_rtc(s, &map->rtc);
+    versal_create_cfu(s, &map->cfu);
 
-    versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_crl(s, pic);
-    versal_create_cfu(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index abdbed1568..5a685aea6d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -15,13 +15,10 @@
 
 #include "hw/sysbus.h"
 #include "hw/cpu/cluster.h"
-#include "hw/or-irq.h"
 #include "hw/intc/arm_gicv3.h"
 #include "qom/object.h"
 #include "hw/misc/xlnx-versal-crl.h"
 #include "net/can_emu.h"
-#include "hw/misc/xlnx-versal-cfu.h"
-#include "hw/misc/xlnx-versal-cframe-reg.h"
 #include "target/arm/cpu.h"
 #include "hw/arm/xlnx-versal-version.h"
 
@@ -78,17 +75,6 @@ struct Versal {
         XlnxVersalCRL crl;
     } lpd;
 
-    /* The Platform Management Controller subsystem.  */
-    struct {
-        XlnxVersalCFUAPB cfu_apb;
-        XlnxVersalCFUFDRO cfu_fdro;
-        XlnxVersalCFUSFR cfu_sfr;
-        XlnxVersalCFrameReg cframe[XLNX_VERSAL_NR_CFRAME];
-        XlnxVersalCFrameBcastReg cframe_bcast;
-
-        OrIRQState apb_irq_orgate;
-    } pmc;
-
     struct {
         uint32_t clk_25mhz;
         uint32_t clk_125mhz;

From aaf889ebdc6ed054a975465fee18feea2450c446 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:36 +0200
Subject: [PATCH 1093/2396] hw/arm/xlnx-versal: crl: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the CRL device creation using the VersalMap structure. The
connections to the RPU CPUs are temporarily removed and will be
reintroduced with next refactoring commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-19-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 36 +++++++++++++++++++-----------------
 include/hw/arm/xlnx-versal.h |  3 ---
 2 files changed, 19 insertions(+), 20 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 81adf8d35b..f5f98a3030 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -42,6 +42,7 @@
 #include "hw/misc/xlnx-versal-cfu.h"
 #include "hw/misc/xlnx-versal-cframe-reg.h"
 #include "hw/or-irq.h"
+#include "hw/misc/xlnx-versal-crl.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -151,6 +152,8 @@ typedef struct VersalMap {
             uint32_t blktype_frames[7];
         } cframe_cfg[15];
     } cfu;
+
+    VersalSimplePeriphMap crl;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -215,6 +218,8 @@ static const VersalMap VERSAL_MAP = {
             { { 38498, 3841, 15361, 13, 7, 3, 1 } },
         },
     },
+
+    .crl = { 0xff5e0000, 10 },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -1115,27 +1120,24 @@ static void versal_create_cfu(Versal *s, const struct VersalCfuMap *map)
                                 sysbus_mmio_get_region(sbd, 0));
 }
 
-static void versal_create_crl(Versal *s, qemu_irq *pic)
+static inline void versal_create_crl(Versal *s)
 {
-    SysBusDevice *sbd;
-    int i;
+    const VersalMap *map;
+    const char *crl_class;
+    DeviceState *dev;
 
-    object_initialize_child(OBJECT(s), "crl", &s->lpd.crl,
-                            TYPE_XLNX_VERSAL_CRL);
-    sbd = SYS_BUS_DEVICE(&s->lpd.crl);
+    map = versal_get_map(s);
 
-    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
-        g_autofree gchar *name = g_strdup_printf("cpu_r5[%d]", i);
+    crl_class = TYPE_XLNX_VERSAL_CRL;
+    dev = qdev_new(crl_class);
+    object_property_add_child(OBJECT(s), "crl", OBJECT(dev));
 
-        object_property_set_link(OBJECT(&s->lpd.crl),
-                                 name, OBJECT(&s->lpd.rpu.cpu[i]),
-                                 &error_abort);
-    }
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_abort);
 
-    sysbus_realize(sbd, &error_fatal);
-    memory_region_add_subregion(&s->mr_ps, MM_CRL,
-                                sysbus_mmio_get_region(sbd, 0));
-    sysbus_connect_irq(sbd, 0, pic[VERSAL_CRL_IRQ]);
+    memory_region_add_subregion(&s->mr_ps, map->crl.addr,
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
+
+    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->crl.irq);
 }
 
 /* This takes the board allocated linear DDR memory and creates aliases
@@ -1338,8 +1340,8 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_trng(s, &map->trng);
     versal_create_rtc(s, &map->rtc);
     versal_create_cfu(s, &map->cfu);
+    versal_create_crl(s);
 
-    versal_create_crl(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 5a685aea6d..d3ce13e69d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -17,7 +17,6 @@
 #include "hw/cpu/cluster.h"
 #include "hw/intc/arm_gicv3.h"
 #include "qom/object.h"
-#include "hw/misc/xlnx-versal-crl.h"
 #include "net/can_emu.h"
 #include "target/arm/cpu.h"
 #include "hw/arm/xlnx-versal-version.h"
@@ -71,8 +70,6 @@ struct Versal {
             CPUClusterState cluster;
             ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
         } rpu;
-
-        XlnxVersalCRL crl;
     } lpd;
 
     struct {

From e17df660769d24dc6d5d0c75ab4de16033705924 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:37 +0200
Subject: [PATCH 1094/2396] hw/arm/xlnx-versal-virt: virtio: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the creation of virtio devices. Use the accessors provided by
the Versal SoC to retrieve the reserved MMIO and IRQ space. Those are
defined in the VersalMap structure.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-20-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 31 ++++++++++++-------------------
 hw/arm/xlnx-versal.c         | 26 ++++++++++++++++++++++++++
 include/hw/arm/xlnx-versal.h |  3 +++
 3 files changed, 41 insertions(+), 19 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index d96f343392..b981d01255 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -271,37 +271,30 @@ static void create_virtio_regions(VersalVirt *s)
     int i;
 
     for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
-        char *name = g_strdup_printf("virtio%d", i);
-        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
-        int irq = VERSAL_RSVD_IRQ_FIRST + i;
+        hwaddr base = versal_get_reserved_mmio_addr(&s->soc)
+            + i * virtio_mmio_size;
+        g_autofree char *node = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
+        int dtb_irq;
         MemoryRegion *mr;
         DeviceState *dev;
         qemu_irq pic_irq;
 
-        pic_irq = qdev_get_gpio_in(DEVICE(&s->soc.fpd.apu.gic), irq);
+        pic_irq = versal_get_reserved_irq(&s->soc, i, &dtb_irq);
         dev = qdev_new("virtio-mmio");
-        object_property_add_child(OBJECT(&s->soc), name, OBJECT(dev));
+        object_property_add_child(OBJECT(s), "virtio-mmio[*]", OBJECT(dev));
         sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic_irq);
         mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0);
         memory_region_add_subregion(&s->soc.mr_ps, base, mr);
-        g_free(name);
-    }
 
-    for (i = 0; i < NUM_VIRTIO_TRANSPORT; i++) {
-        hwaddr base = MM_TOP_RSVD + i * virtio_mmio_size;
-        int irq = VERSAL_RSVD_IRQ_FIRST + i;
-        char *name = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
-
-        qemu_fdt_add_subnode(s->fdt, name);
-        qemu_fdt_setprop(s->fdt, name, "dma-coherent", NULL, 0);
-        qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                               GIC_FDT_IRQ_TYPE_SPI, irq,
+        qemu_fdt_add_subnode(s->fdt, node);
+        qemu_fdt_setprop(s->fdt, node, "dma-coherent", NULL, 0);
+        qemu_fdt_setprop_cells(s->fdt, node, "interrupts",
+                               GIC_FDT_IRQ_TYPE_SPI, dtb_irq,
                                GIC_FDT_IRQ_FLAGS_EDGE_LO_HI);
-        qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",
+        qemu_fdt_setprop_sized_cells(s->fdt, node, "reg",
                                      2, base, 2, virtio_mmio_size);
-        qemu_fdt_setprop_string(s->fdt, name, "compatible", "virtio,mmio");
-        g_free(name);
+        qemu_fdt_setprop_string(s->fdt, node, "compatible", "virtio,mmio");
     }
 }
 
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index f5f98a3030..23aac709dc 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -154,6 +154,13 @@ typedef struct VersalMap {
     } cfu;
 
     VersalSimplePeriphMap crl;
+
+    /* reserved MMIO/IRQ space that can safely be used for virtio devices */
+    struct VersalReserved {
+        uint64_t mmio_start;
+        int irq_start;
+        int irq_num;
+    } reserved;
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
@@ -220,6 +227,8 @@ static const VersalMap VERSAL_MAP = {
     },
 
     .crl = { 0xff5e0000, 10 },
+
+    .reserved = { 0xa0000000, 111, 8 },
 };
 
 static const VersalMap *VERSION_TO_MAP[] = {
@@ -1422,6 +1431,23 @@ void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
                        flash_idx + 1, cs_line);
 }
 
+qemu_irq versal_get_reserved_irq(Versal *s, int idx, int *dtb_idx)
+{
+    const VersalMap *map = versal_get_map(s);
+
+    g_assert(idx < map->reserved.irq_num);
+
+    *dtb_idx = map->reserved.irq_start + idx;
+    return versal_get_irq(s, *dtb_idx);
+}
+
+hwaddr versal_get_reserved_mmio_addr(Versal *s)
+{
+    const VersalMap *map = versal_get_map(s);
+
+    return map->reserved.mmio_start;
+}
+
 int versal_get_num_can(VersalVersion version)
 {
     const VersalMap *map = VERSION_TO_MAP[version];
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index d3ce13e69d..af47acb288 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -102,6 +102,9 @@ void versal_bbram_attach_drive(Versal *s, BlockBackend *blk);
 void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
                               BlockBackend *blk);
 
+qemu_irq versal_get_reserved_irq(Versal *s, int idx, int *dtb_idx);
+hwaddr versal_get_reserved_mmio_addr(Versal *s);
+
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);
 

From 7c21633676fe3249cb8af80e3831bffea1457242 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:38 +0200
Subject: [PATCH 1095/2396] hw/arm/xlnx-versal: refactor CPU cluster creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the CPU cluster creation using the VersalMap structure. There
is no functional change. The clusters properties are now described in
the VersalMap structure. For now only the APU is converted. The RPU will
be taken care of by next commits.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-21-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  80 +-------
 hw/arm/xlnx-versal.c         | 354 ++++++++++++++++++++++++++---------
 include/hw/arm/xlnx-versal.h |  12 +-
 3 files changed, 276 insertions(+), 170 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index b981d01255..27594f78c8 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -38,7 +38,6 @@ struct VersalVirt {
     void *fdt;
     int fdt_size;
     struct {
-        uint32_t gic;
         uint32_t clk_125Mhz;
         uint32_t clk_25Mhz;
     } phandle;
@@ -63,7 +62,6 @@ static void fdt_create(VersalVirt *s)
     }
 
     /* Allocate all phandles.  */
-    s->phandle.gic = qemu_fdt_alloc_phandle(s->fdt);
     s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
     s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
 
@@ -72,9 +70,6 @@ static void fdt_create(VersalVirt *s)
     qemu_fdt_add_subnode(s->fdt, "/aliases");
 
     /* Header */
-    qemu_fdt_setprop_cell(s->fdt, "/", "interrupt-parent", s->phandle.gic);
-    qemu_fdt_setprop_cell(s->fdt, "/", "#size-cells", 0x2);
-    qemu_fdt_setprop_cell(s->fdt, "/", "#address-cells", 0x2);
     qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
     qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
 }
@@ -90,67 +85,6 @@ static void fdt_add_clk_node(VersalVirt *s, const char *name,
     qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
 }
 
-static void fdt_add_cpu_nodes(VersalVirt *s, uint32_t psci_conduit)
-{
-    int i;
-
-    qemu_fdt_add_subnode(s->fdt, "/cpus");
-    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#size-cells", 0x0);
-    qemu_fdt_setprop_cell(s->fdt, "/cpus", "#address-cells", 1);
-
-    for (i = XLNX_VERSAL_NR_ACPUS - 1; i >= 0; i--) {
-        char *name = g_strdup_printf("/cpus/cpu@%d", i);
-        ARMCPU *armcpu = ARM_CPU(qemu_get_cpu(i));
-
-        qemu_fdt_add_subnode(s->fdt, name);
-        qemu_fdt_setprop_cell(s->fdt, name, "reg",
-                              arm_cpu_mp_affinity(armcpu));
-        if (psci_conduit != QEMU_PSCI_CONDUIT_DISABLED) {
-            qemu_fdt_setprop_string(s->fdt, name, "enable-method", "psci");
-        }
-        qemu_fdt_setprop_string(s->fdt, name, "device_type", "cpu");
-        qemu_fdt_setprop_string(s->fdt, name, "compatible",
-                                armcpu->dtb_compatible);
-        g_free(name);
-    }
-}
-
-static void fdt_add_gic_nodes(VersalVirt *s)
-{
-    char *nodename;
-
-    nodename = g_strdup_printf("/gic@%x", MM_GIC_APU_DIST_MAIN);
-    qemu_fdt_add_subnode(s->fdt, nodename);
-    qemu_fdt_setprop_cell(s->fdt, nodename, "phandle", s->phandle.gic);
-    qemu_fdt_setprop_cells(s->fdt, nodename, "interrupts",
-                           GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
-                           GIC_FDT_IRQ_FLAGS_LEVEL_HI);
-    qemu_fdt_setprop(s->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_sized_cells(s->fdt, nodename, "reg",
-                                 2, MM_GIC_APU_DIST_MAIN,
-                                 2, MM_GIC_APU_DIST_MAIN_SIZE,
-                                 2, MM_GIC_APU_REDIST_0,
-                                 2, MM_GIC_APU_REDIST_0_SIZE);
-    qemu_fdt_setprop_cell(s->fdt, nodename, "#interrupt-cells", 3);
-    qemu_fdt_setprop_string(s->fdt, nodename, "compatible", "arm,gic-v3");
-    g_free(nodename);
-}
-
-static void fdt_add_timer_nodes(VersalVirt *s)
-{
-    const char compat[] = "arm,armv8-timer";
-    uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
-
-    qemu_fdt_add_subnode(s->fdt, "/timer");
-    qemu_fdt_setprop_cells(s->fdt, "/timer", "interrupts",
-            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ, irqflags,
-            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ, irqflags,
-            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ, irqflags,
-            GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ, irqflags);
-    qemu_fdt_setprop(s->fdt, "/timer", "compatible",
-                     compat, sizeof(compat));
-}
-
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -396,16 +330,14 @@ static void versal_virt_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
     create_virtio_regions(s);
 
-    fdt_add_gic_nodes(s);
-    fdt_add_timer_nodes(s);
-    fdt_add_cpu_nodes(s, psci_conduit);
     fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
     fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
 
-    /* Make the APU cpu address space visible to virtio and other
-     * modules unaware of multiple address-spaces.  */
-    memory_region_add_subregion_overlap(get_system_memory(),
-                                        0, &s->soc.fpd.apu.mr, 0);
+    /*
+     * Map the SoC address space onto system memory. This will allow virtio and
+     * other modules unaware of multiple address-spaces to work.
+     */
+    memory_region_add_subregion(get_system_memory(), 0, &s->soc.mr_ps);
 
     /* Attach bbram backend, if given */
     bbram_attach_drive(s);
@@ -429,7 +361,7 @@ static void versal_virt_init(MachineState *machine)
         s->binfo.loader_start = 0x1000;
         s->binfo.dtb_limit = 0x1000000;
     }
-    arm_load_kernel(&s->soc.fpd.apu.cpu[0], machine, &s->binfo);
+    arm_load_kernel(ARM_CPU(versal_get_boot_cpu(&s->soc)), machine, &s->binfo);
 
     for (i = 0; i < XLNX_VERSAL_NUM_OSPI_FLASH; i++) {
         ObjectClass *flash_klass;
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 23aac709dc..b4cad856dc 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -43,6 +43,7 @@
 #include "hw/misc/xlnx-versal-cframe-reg.h"
 #include "hw/or-irq.h"
 #include "hw/misc/xlnx-versal-crl.h"
+#include "hw/intc/arm_gicv3_common.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -67,7 +68,34 @@ typedef struct VersalSimplePeriphMap {
     int irq;
 } VersalSimplePeriphMap;
 
+typedef struct VersalGicMap {
+    int version;
+    uint64_t dist;
+    uint64_t redist;
+    size_t num_irq;
+} VersalGicMap;
+
+enum StartPoweredOffMode {
+    SPO_SECONDARIES,
+    SPO_ALL,
+};
+
+typedef struct VersalCpuClusterMap {
+    VersalGicMap gic;
+
+    const char *name;
+    const char *cpu_model;
+    size_t num_core;
+    size_t num_cluster;
+    uint32_t qemu_cluster_id;
+    bool dtb_expose;
+
+    enum StartPoweredOffMode start_powered_off;
+} VersalCpuClusterMap;
+
 typedef struct VersalMap {
+    VersalCpuClusterMap apu;
+
     VersalSimplePeriphMap uart[2];
     size_t num_uart;
 
@@ -164,6 +192,22 @@ typedef struct VersalMap {
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
+    .apu = {
+        .name = "apu",
+        .cpu_model = ARM_CPU_TYPE_NAME("cortex-a72"),
+        .num_cluster = 1,
+        .num_core = 2,
+        .qemu_cluster_id = 0,
+        .start_powered_off = SPO_SECONDARIES,
+        .dtb_expose = true,
+        .gic = {
+            .version = 3,
+            .dist = 0xf9000000,
+            .redist = 0xf9080000,
+            .num_irq = 192,
+        },
+    },
+
     .uart[0] = { 0xff000000, 18 },
     .uart[1] = { 0xff010000, 19 },
     .num_uart = 2,
@@ -294,11 +338,12 @@ static qemu_irq versal_get_irq(Versal *s, int irq_idx)
 {
     qemu_irq irq;
     bool ored;
+    DeviceState *gic;
 
     ored = FIELD_EX32(irq_idx, VERSAL_IRQ, ORED);
 
-    irq = qdev_get_gpio_in(DEVICE(&s->fpd.apu.gic),
-                           FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ));
+    gic = DEVICE(versal_get_child_idx(s, "apu-gic", 0));
+    irq = qdev_get_gpio_in(gic, FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ));
 
     if (ored) {
         irq = versal_get_irq_or_gate_in(s, irq_idx, irq);
@@ -375,107 +420,239 @@ static inline DeviceState *create_or_gate(Versal *s, Object *parent,
     return or;
 }
 
-static void versal_create_apu_cpus(Versal *s)
+static MemoryRegion *create_cpu_mr(Versal *s, DeviceState *cluster,
+                                   const VersalCpuClusterMap *map)
 {
-    int i;
+    MemoryRegion *mr, *root_alias;
+    char *name;
 
-    object_initialize_child(OBJECT(s), "apu-cluster", &s->fpd.apu.cluster,
-                            TYPE_CPU_CLUSTER);
-    qdev_prop_set_uint32(DEVICE(&s->fpd.apu.cluster), "cluster-id", 0);
+    mr = g_new(MemoryRegion, 1);
+    name = g_strdup_printf("%s-mr", map->name);
+    memory_region_init(mr, OBJECT(cluster), name, UINT64_MAX);
+    g_free(name);
 
-    for (i = 0; i < ARRAY_SIZE(s->fpd.apu.cpu); i++) {
-        Object *obj;
+    root_alias = g_new(MemoryRegion, 1);
+    name = g_strdup_printf("ps-alias-for-%s", map->name);
+    memory_region_init_alias(root_alias, OBJECT(cluster), name,
+                             &s->mr_ps, 0, UINT64_MAX);
+    g_free(name);
+    memory_region_add_subregion(mr, 0, root_alias);
 
-        object_initialize_child(OBJECT(&s->fpd.apu.cluster),
-                                "apu-cpu[*]", &s->fpd.apu.cpu[i],
-                                XLNX_VERSAL_ACPU_TYPE);
-        obj = OBJECT(&s->fpd.apu.cpu[i]);
-        if (i) {
-            /* Secondary CPUs start in powered-down state */
-            object_property_set_bool(obj, "start-powered-off", true,
-                                     &error_abort);
-        }
-
-        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->fpd.apu.cpu),
-                                &error_abort);
-        object_property_set_link(obj, "memory", OBJECT(&s->fpd.apu.mr),
-                                 &error_abort);
-        qdev_realize(DEVICE(obj), NULL, &error_fatal);
-    }
-
-    qdev_realize(DEVICE(&s->fpd.apu.cluster), NULL, &error_fatal);
+    return mr;
 }
 
-static void versal_create_apu_gic(Versal *s, qemu_irq *pic)
+static DeviceState *versal_create_gic(Versal *s,
+                                      const VersalCpuClusterMap *map,
+                                      MemoryRegion *mr,
+                                      size_t num_cpu)
 {
-    static const uint64_t addrs[] = {
-        MM_GIC_APU_DIST_MAIN,
-        MM_GIC_APU_REDIST_0
-    };
-    SysBusDevice *gicbusdev;
-    DeviceState *gicdev;
+    DeviceState *dev;
+    SysBusDevice *sbd;
     QList *redist_region_count;
-    int nr_apu_cpus = ARRAY_SIZE(s->fpd.apu.cpu);
-    int i;
+    g_autofree char *node = NULL;
+    g_autofree char *name = NULL;
+    const char compatible[] = "arm,gic-v3";
 
-    object_initialize_child(OBJECT(s), "apu-gic", &s->fpd.apu.gic,
-                            gicv3_class_name());
-    gicbusdev = SYS_BUS_DEVICE(&s->fpd.apu.gic);
-    gicdev = DEVICE(&s->fpd.apu.gic);
-    qdev_prop_set_uint32(gicdev, "revision", 3);
-    qdev_prop_set_uint32(gicdev, "num-cpu", nr_apu_cpus);
-    qdev_prop_set_uint32(gicdev, "num-irq", XLNX_VERSAL_NR_IRQS + 32);
+    dev = qdev_new(gicv3_class_name());
+    name = g_strdup_printf("%s-gic[*]", map->name);
+    object_property_add_child(OBJECT(s), name, OBJECT(dev));
+    sbd = SYS_BUS_DEVICE(dev);
+    qdev_prop_set_uint32(dev, "revision", 3);
+    qdev_prop_set_uint32(dev, "num-cpu", num_cpu);
+    qdev_prop_set_uint32(dev, "num-irq", map->gic.num_irq + 32);
 
     redist_region_count = qlist_new();
-    qlist_append_int(redist_region_count, nr_apu_cpus);
-    qdev_prop_set_array(gicdev, "redist-region-count", redist_region_count);
+    qlist_append_int(redist_region_count, num_cpu);
+    qdev_prop_set_array(dev, "redist-region-count", redist_region_count);
 
-    qdev_prop_set_bit(gicdev, "has-security-extensions", true);
+    qdev_prop_set_bit(dev, "has-security-extensions", true);
+    object_property_set_link(OBJECT(dev), "sysmem", OBJECT(mr), &error_abort);
 
-    sysbus_realize(SYS_BUS_DEVICE(&s->fpd.apu.gic), &error_fatal);
+    sysbus_realize_and_unref(sbd, &error_fatal);
 
-    for (i = 0; i < ARRAY_SIZE(addrs); i++) {
-        MemoryRegion *mr;
+    memory_region_add_subregion(mr, map->gic.dist,
+                                sysbus_mmio_get_region(sbd, 0));
+    memory_region_add_subregion(mr, map->gic.redist,
+                                sysbus_mmio_get_region(sbd, 1));
 
-        mr = sysbus_mmio_get_region(gicbusdev, i);
-        memory_region_add_subregion(&s->fpd.apu.mr, addrs[i], mr);
+    if (map->dtb_expose) {
+        node = versal_fdt_add_subnode(s, "/gic", map->gic.dist, compatible,
+                                      sizeof(compatible));
+        qemu_fdt_setprop_cell(s->cfg.fdt, node, "phandle", s->phandle.gic);
+        qemu_fdt_setprop_cell(s->cfg.fdt, node, "#interrupt-cells", 3);
+        qemu_fdt_setprop_sized_cells(s->cfg.fdt, node, "reg",
+                                     2, map->gic.dist,
+                                     2, 0x10000,
+                                     2, map->gic.redist,
+                                     2, GICV3_REDIST_SIZE * num_cpu);
+        qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
+                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop(s->cfg.fdt, node, "interrupt-controller", NULL, 0);
     }
 
-    for (i = 0; i < nr_apu_cpus; i++) {
-        DeviceState *cpudev = DEVICE(&s->fpd.apu.cpu[i]);
-        int ppibase = XLNX_VERSAL_NR_IRQS + i * GIC_INTERNAL + GIC_NR_SGIS;
-        qemu_irq maint_irq;
-        int ti;
-        /* Mapping from the output timer irq lines from the CPU to the
-         * GIC PPI inputs.
-         */
-        const int timer_irq[] = {
-            [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
-            [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
-            [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
-            [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
-        };
+    return dev;
+}
 
+static void connect_gic_to_cpu(const VersalCpuClusterMap *map,
+                               DeviceState *gic, DeviceState *cpu, size_t idx,
+                               size_t num_cpu)
+{
+    SysBusDevice *sbd = SYS_BUS_DEVICE(gic);
+    int ppibase = map->gic.num_irq + idx * GIC_INTERNAL + GIC_NR_SGIS;
+    int ti;
+    bool has_gtimer;
+    /*
+     * Mapping from the output timer irq lines from the CPU to the
+     * GIC PPI inputs.
+     */
+    const int timer_irq[] = {
+        [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
+        [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
+        [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
+        [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
+    };
+
+    has_gtimer = arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_GENERIC_TIMER);
+
+    if (has_gtimer) {
         for (ti = 0; ti < ARRAY_SIZE(timer_irq); ti++) {
-            qdev_connect_gpio_out(cpudev, ti,
-                                  qdev_get_gpio_in(gicdev,
+            qdev_connect_gpio_out(cpu, ti,
+                                  qdev_get_gpio_in(gic,
                                                    ppibase + timer_irq[ti]));
         }
-        maint_irq = qdev_get_gpio_in(gicdev,
-                                        ppibase + VERSAL_GIC_MAINT_IRQ);
-        qdev_connect_gpio_out_named(cpudev, "gicv3-maintenance-interrupt",
-                                    0, maint_irq);
-        sysbus_connect_irq(gicbusdev, i, qdev_get_gpio_in(cpudev, ARM_CPU_IRQ));
-        sysbus_connect_irq(gicbusdev, i + nr_apu_cpus,
-                           qdev_get_gpio_in(cpudev, ARM_CPU_FIQ));
-        sysbus_connect_irq(gicbusdev, i + 2 * nr_apu_cpus,
-                           qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
-        sysbus_connect_irq(gicbusdev, i + 3 * nr_apu_cpus,
-                           qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
     }
 
-    for (i = 0; i < XLNX_VERSAL_NR_IRQS; i++) {
-        pic[i] = qdev_get_gpio_in(gicdev, i);
+    if (map->gic.version == 3) {
+        qemu_irq maint_irq;
+
+        maint_irq = qdev_get_gpio_in(gic,
+                                     ppibase + VERSAL_GIC_MAINT_IRQ);
+        qdev_connect_gpio_out_named(cpu, "gicv3-maintenance-interrupt",
+                                    0, maint_irq);
+    }
+
+    sysbus_connect_irq(sbd, idx, qdev_get_gpio_in(cpu, ARM_CPU_IRQ));
+    sysbus_connect_irq(sbd, idx + num_cpu,
+                       qdev_get_gpio_in(cpu, ARM_CPU_FIQ));
+    sysbus_connect_irq(sbd, idx + 2 * num_cpu,
+                       qdev_get_gpio_in(cpu, ARM_CPU_VIRQ));
+    sysbus_connect_irq(sbd, idx + 3 * num_cpu,
+                       qdev_get_gpio_in(cpu, ARM_CPU_VFIQ));
+}
+
+static inline void versal_create_and_connect_gic(Versal *s,
+                                                 const VersalCpuClusterMap *map,
+                                                 MemoryRegion *mr,
+                                                 DeviceState **cpus,
+                                                 size_t num_cpu)
+{
+    DeviceState *gic;
+    size_t i;
+
+    gic = versal_create_gic(s, map, mr, num_cpu);
+
+    for (i = 0; i < num_cpu; i++) {
+        connect_gic_to_cpu(map, gic, cpus[i], i, num_cpu);
+    }
+}
+
+static DeviceState *versal_create_cpu(Versal *s,
+                                      const VersalCpuClusterMap *map,
+                                      DeviceState *qemu_cluster,
+                                      MemoryRegion *cpu_mr,
+                                      size_t cluster_idx,
+                                      size_t core_idx)
+{
+    DeviceState *cpu = qdev_new(map->cpu_model);
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    Object *obj = OBJECT(cpu);
+    bool start_off;
+    size_t idx = cluster_idx * map->num_core + core_idx;
+    g_autofree char *name;
+    g_autofree char *node = NULL;
+
+    start_off = map->start_powered_off == SPO_ALL
+        || ((map->start_powered_off == SPO_SECONDARIES)
+            && (cluster_idx || core_idx));
+
+    name = g_strdup_printf("%s[*]", map->name);
+    object_property_add_child(OBJECT(qemu_cluster), name, obj);
+    object_property_set_bool(obj, "start-powered-off", start_off,
+                             &error_abort);
+    qdev_prop_set_int32(cpu, "core-count",  map->num_core);
+    object_property_set_link(obj, "memory", OBJECT(cpu_mr), &error_abort);
+    qdev_realize_and_unref(cpu, NULL, &error_fatal);
+
+    if (!map->dtb_expose) {
+        return cpu;
+    }
+
+    node = versal_fdt_add_subnode(s, "/cpus/cpu", idx,
+                                  arm_cpu->dtb_compatible,
+                                  strlen(arm_cpu->dtb_compatible) + 1);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "reg",
+                          arm_cpu_mp_affinity(arm_cpu) & ARM64_AFFINITY_MASK);
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "device_type", "cpu");
+    qemu_fdt_setprop_string(s->cfg.fdt, node, "enable-method", "psci");
+
+    return cpu;
+}
+
+static void versal_create_cpu_cluster(Versal *s, const VersalCpuClusterMap *map)
+{
+    size_t i, j;
+    DeviceState *cluster;
+    MemoryRegion *mr;
+    char *name;
+    g_autofree DeviceState **cpus;
+    const char compatible[] = "arm,armv8-timer";
+    bool has_gtimer;
+
+    cluster = qdev_new(TYPE_CPU_CLUSTER);
+    name = g_strdup_printf("%s-cluster", map->name);
+    object_property_add_child(OBJECT(s), name, OBJECT(cluster));
+    g_free(name);
+    qdev_prop_set_uint32(cluster, "cluster-id", map->qemu_cluster_id);
+
+    mr = create_cpu_mr(s, cluster, map);
+
+    cpus = g_new(DeviceState *, map->num_cluster * map->num_core);
+
+    if (map->dtb_expose) {
+        qemu_fdt_add_subnode(s->cfg.fdt, "/cpus");
+        qemu_fdt_setprop_cell(s->cfg.fdt, "/cpus", "#size-cells", 0);
+        qemu_fdt_setprop_cell(s->cfg.fdt, "/cpus", "#address-cells", 1);
+    }
+
+    for (i = 0; i < map->num_cluster; i++) {
+        for (j = 0; j < map->num_core; j++) {
+            DeviceState *cpu = versal_create_cpu(s, map, cluster, mr, i, j);
+
+            cpus[i * map->num_core + j] = cpu;
+        }
+
+    }
+
+    qdev_realize_and_unref(cluster, NULL, &error_fatal);
+
+    versal_create_and_connect_gic(s, map, mr, cpus,
+                                  map->num_cluster * map->num_core);
+
+    has_gtimer = arm_feature(&ARM_CPU(cpus[0])->env, ARM_FEATURE_GENERIC_TIMER);
+    if (map->dtb_expose && has_gtimer) {
+        qemu_fdt_add_subnode(s->cfg.fdt, "/timer");
+        qemu_fdt_setprop_cells(s->cfg.fdt, "/timer", "interrupts",
+                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI,
+                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ,
+                               GIC_FDT_IRQ_FLAGS_LEVEL_HI);
+        qemu_fdt_setprop(s->cfg.fdt, "/timer", "compatible",
+                         compatible, sizeof(compatible));
     }
 }
 
@@ -1286,7 +1463,6 @@ static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
     DeviceState *slcr, *ospi;
-    qemu_irq pic[XLNX_VERSAL_NR_IRQS];
     Object *container;
     const VersalMap *map = versal_get_map(s);
     size_t i;
@@ -1295,14 +1471,17 @@ static void versal_realize(DeviceState *dev, Error **errp)
 
     s->phandle.clk_25mhz = fdt_add_clk_node(s, "/clk25", 25 * 1000 * 1000);
     s->phandle.clk_125mhz = fdt_add_clk_node(s, "/clk125", 125 * 1000 * 1000);
-
-    versal_create_apu_cpus(s);
-    versal_create_apu_gic(s, pic);
+    s->phandle.gic = qemu_fdt_alloc_phandle(s->cfg.fdt);
 
     container = object_new(TYPE_CONTAINER);
     object_property_add_child(OBJECT(s), "irq-or-gates", container);
     object_unref(container);
 
+    qemu_fdt_setprop_cell(s->cfg.fdt, "/", "interrupt-parent", s->phandle.gic);
+    qemu_fdt_setprop_cell(s->cfg.fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_setprop_cell(s->cfg.fdt, "/", "#address-cells", 0x2);
+
+    versal_create_cpu_cluster(s, &map->apu);
     versal_create_rpu_cpus(s);
 
     for (i = 0; i < map->num_uart; i++) {
@@ -1359,11 +1538,15 @@ static void versal_realize(DeviceState *dev, Error **errp)
                            MM_OCM_SIZE, &error_fatal);
 
     memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
-    memory_region_add_subregion_overlap(&s->fpd.apu.mr, 0, &s->mr_ps, 0);
     memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
                                         &s->lpd.rpu.mr_ps_alias, 0);
 }
 
+DeviceState *versal_get_boot_cpu(Versal *s)
+{
+    return DEVICE(versal_get_child_idx(s, "apu-cluster/apu", 0));
+}
+
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk)
 {
     DeviceState *sdhci, *card;
@@ -1467,7 +1650,6 @@ static void versal_base_init(Object *obj)
     Versal *s = XLNX_VERSAL_BASE(obj);
     size_t i, num_can;
 
-    memory_region_init(&s->fpd.apu.mr, obj, "mr-apu", UINT64_MAX);
     memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
     memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index af47acb288..9d9ccfb001 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -15,7 +15,6 @@
 
 #include "hw/sysbus.h"
 #include "hw/cpu/cluster.h"
-#include "hw/intc/arm_gicv3.h"
 #include "qom/object.h"
 #include "net/can_emu.h"
 #include "target/arm/cpu.h"
@@ -43,15 +42,6 @@ struct Versal {
     SysBusDevice parent_obj;
 
     /*< public >*/
-    struct {
-        struct {
-            MemoryRegion mr;
-            CPUClusterState cluster;
-            ARMCPU cpu[XLNX_VERSAL_NR_ACPUS];
-            GICv3State gic;
-        } apu;
-    } fpd;
-
     MemoryRegion mr_ps;
 
     struct {
@@ -75,6 +65,7 @@ struct Versal {
     struct {
         uint32_t clk_25mhz;
         uint32_t clk_125mhz;
+        uint32_t gic;
     } phandle;
 
     struct {
@@ -96,6 +87,7 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
     s->cfg.fdt = fdt;
 }
 
+DeviceState *versal_get_boot_cpu(Versal *s);
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
 void versal_efuse_attach_drive(Versal *s, BlockBackend *blk);
 void versal_bbram_attach_drive(Versal *s, BlockBackend *blk);

From c2ba2adf2dc0f51146f70eaeb32c84932573a906 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:39 +0200
Subject: [PATCH 1096/2396] hw/arm/xlnx-versal: add the mp_affinity property to
 the CPU mapping
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a way to configure the MP affinity value of the CPUs given their
core and cluster IDs. For the Versal APU CPUs, the MP affinity value is
given by the core ID in Aff0.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-22-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index b4cad856dc..ccb78fadd7 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -90,6 +90,12 @@ typedef struct VersalCpuClusterMap {
     uint32_t qemu_cluster_id;
     bool dtb_expose;
 
+    struct {
+        uint64_t base;
+        uint64_t core_shift;
+        uint64_t cluster_shift;
+    } mp_affinity;
+
     enum StartPoweredOffMode start_powered_off;
 } VersalCpuClusterMap;
 
@@ -198,6 +204,10 @@ static const VersalMap VERSAL_MAP = {
         .num_cluster = 1,
         .num_core = 2,
         .qemu_cluster_id = 0,
+        .mp_affinity = {
+            .core_shift = ARM_AFF0_SHIFT,
+            .cluster_shift = ARM_AFF1_SHIFT,
+        },
         .start_powered_off = SPO_SECONDARIES,
         .dtb_expose = true,
         .gic = {
@@ -567,11 +577,16 @@ static DeviceState *versal_create_cpu(Versal *s,
     DeviceState *cpu = qdev_new(map->cpu_model);
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     Object *obj = OBJECT(cpu);
+    uint64_t affinity;
     bool start_off;
     size_t idx = cluster_idx * map->num_core + core_idx;
     g_autofree char *name;
     g_autofree char *node = NULL;
 
+    affinity = map->mp_affinity.base;
+    affinity |= (cluster_idx & 0xff) << map->mp_affinity.cluster_shift;
+    affinity |= (core_idx & 0xff) << map->mp_affinity.core_shift;
+
     start_off = map->start_powered_off == SPO_ALL
         || ((map->start_powered_off == SPO_SECONDARIES)
             && (cluster_idx || core_idx));
@@ -580,6 +595,7 @@ static DeviceState *versal_create_cpu(Versal *s,
     object_property_add_child(OBJECT(qemu_cluster), name, obj);
     object_property_set_bool(obj, "start-powered-off", start_off,
                              &error_abort);
+    qdev_prop_set_uint64(cpu, "mp-affinity", affinity);
     qdev_prop_set_int32(cpu, "core-count",  map->num_core);
     object_property_set_link(obj, "memory", OBJECT(cpu_mr), &error_abort);
     qdev_realize_and_unref(cpu, NULL, &error_fatal);

From 6926b0b26071ce740f026212f5c437a694117645 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:40 +0200
Subject: [PATCH 1097/2396] hw/arm/xlnx-versal: instantiate the GIC ITS in the
 APU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the instance of the GIC ITS in the APU.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-23-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 50 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index ccb78fadd7..e03411bc21 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -44,6 +44,7 @@
 #include "hw/or-irq.h"
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/intc/arm_gicv3_common.h"
+#include "hw/intc/arm_gicv3_its_common.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -72,7 +73,9 @@ typedef struct VersalGicMap {
     int version;
     uint64_t dist;
     uint64_t redist;
+    uint64_t its;
     size_t num_irq;
+    bool has_its;
 } VersalGicMap;
 
 enum StartPoweredOffMode {
@@ -215,6 +218,8 @@ static const VersalMap VERSAL_MAP = {
             .dist = 0xf9000000,
             .redist = 0xf9080000,
             .num_irq = 192,
+            .has_its = true,
+            .its = 0xf9020000,
         },
     },
 
@@ -451,6 +456,48 @@ static MemoryRegion *create_cpu_mr(Versal *s, DeviceState *cluster,
     return mr;
 }
 
+static void versal_create_gic_its(Versal *s,
+                                  const VersalCpuClusterMap *map,
+                                  DeviceState *gic,
+                                  MemoryRegion *mr,
+                                  char *gic_node)
+{
+    DeviceState *dev;
+    SysBusDevice *sbd;
+    g_autofree char *node_pat = NULL, *node = NULL;
+    const char compatible[] = "arm,gic-v3-its";
+
+    if (!map->gic.has_its) {
+        return;
+    }
+
+    dev = qdev_new(TYPE_ARM_GICV3_ITS);
+    sbd = SYS_BUS_DEVICE(dev);
+
+    object_property_add_child(OBJECT(gic), "its", OBJECT(dev));
+    object_property_set_link(OBJECT(dev), "parent-gicv3", OBJECT(gic),
+                             &error_abort);
+
+    sysbus_realize_and_unref(sbd, &error_abort);
+
+    memory_region_add_subregion(mr, map->gic.its,
+                                sysbus_mmio_get_region(sbd, 0));
+
+    if (!map->dtb_expose) {
+        return;
+    }
+
+    qemu_fdt_setprop(s->cfg.fdt, gic_node, "ranges", NULL, 0);
+    qemu_fdt_setprop_cell(s->cfg.fdt, gic_node, "#address-cells", 2);
+    qemu_fdt_setprop_cell(s->cfg.fdt, gic_node, "#size-cells", 2);
+
+    node_pat = g_strdup_printf("%s/its", gic_node);
+    node = versal_fdt_add_simple_subnode(s, node_pat, map->gic.its, 0x20000,
+                                         compatible, sizeof(compatible));
+    qemu_fdt_setprop(s->cfg.fdt, node, "msi-controller", NULL, 0);
+    qemu_fdt_setprop_cell(s->cfg.fdt, node, "#msi-cells", 1);
+}
+
 static DeviceState *versal_create_gic(Versal *s,
                                       const VersalCpuClusterMap *map,
                                       MemoryRegion *mr,
@@ -476,6 +523,7 @@ static DeviceState *versal_create_gic(Versal *s,
     qdev_prop_set_array(dev, "redist-region-count", redist_region_count);
 
     qdev_prop_set_bit(dev, "has-security-extensions", true);
+    qdev_prop_set_bit(dev, "has-lpi", map->gic.has_its);
     object_property_set_link(OBJECT(dev), "sysmem", OBJECT(mr), &error_abort);
 
     sysbus_realize_and_unref(sbd, &error_fatal);
@@ -501,6 +549,8 @@ static DeviceState *versal_create_gic(Versal *s,
         qemu_fdt_setprop(s->cfg.fdt, node, "interrupt-controller", NULL, 0);
     }
 
+    versal_create_gic_its(s, map, dev, mr, node);
+
     return dev;
 }
 

From 27493e5e687e65829f548bf0145dd44bc223fbe5 Mon Sep 17 00:00:00 2001
From: Francisco Iglesias <francisco.iglesias@xilinx.com>
Date: Fri, 26 Sep 2025 09:07:41 +0200
Subject: [PATCH 1098/2396] hw/intc/arm_gicv3: Introduce a 'first-cpu-index'
 property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a 'first-cpu-index' property for specifying the first QEMU CPU
connected to the GICv3. This makes it possible to have multiple instances
of the GICv3 connected to different CPU clusters.

For KVM, mark this property has unsupported. It probably does not make
much sense as it is intented to be used to model non-SMP systems.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Signed-off-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Sai Pavan Boddu <sai.pavan.boddu@amd.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-24-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_common.c         | 3 ++-
 hw/intc/arm_gicv3_cpuif.c          | 2 +-
 hw/intc/arm_gicv3_kvm.c            | 6 ++++++
 include/hw/intc/arm_gicv3_common.h | 1 +
 4 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index e438d8c042..2d0df6da86 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -436,7 +436,7 @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
-        CPUState *cpu = qemu_get_cpu(i);
+        CPUState *cpu = qemu_get_cpu(s->first_cpu_idx + i);
         uint64_t cpu_affid;
 
         s->cpu[i].cpu = cpu;
@@ -622,6 +622,7 @@ static const Property arm_gicv3_common_properties[] = {
                       redist_region_count, qdev_prop_uint32, uint32_t),
     DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
                      MemoryRegion *),
+    DEFINE_PROP_UINT32("first-cpu-index", GICv3State, first_cpu_idx, 0),
 };
 
 static void arm_gicv3_common_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index 72e91f971a..2e6c1f778a 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -3024,7 +3024,7 @@ void gicv3_init_cpuif(GICv3State *s)
     int i;
 
     for (i = 0; i < s->num_cpu; i++) {
-        ARMCPU *cpu = ARM_CPU(qemu_get_cpu(i));
+        ARMCPU *cpu = ARM_CPU(qemu_get_cpu(s->first_cpu_idx + i));
         GICv3CPUState *cs = &s->cpu[i];
 
         /*
diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 0cd14d78a7..9829e2146d 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -821,6 +821,12 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->first_cpu_idx != 0) {
+        error_setg(errp, "Non-zero first-cpu-idx is unsupported with the "
+                   "in-kernel GIC");
+        return;
+    }
+
     gicv3_init_irqs_and_mmio(s, kvm_arm_gicv3_set_irq, NULL);
 
     for (i = 0; i < s->num_cpu; i++) {
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index 572d971d22..38aa1961c5 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -229,6 +229,7 @@ struct GICv3State {
     uint32_t *redist_region_count; /* redistributor count within each region */
     uint32_t nb_redist_regions; /* number of redist regions */
 
+    uint32_t first_cpu_idx;
     uint32_t num_cpu;
     uint32_t num_irq;
     uint32_t revision;

From d95bf385567dc635f4cf275af118f3774e3b3d29 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:42 +0200
Subject: [PATCH 1099/2396] hw/arm/xlnx-versal: add support for multiple GICs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Versal SoC contains two GICs: one GICv3 in the APU and one GICv2 in
the RPU (currently not instantiated). To prepare for the GICv2
instantiation, add support for multiple GICs when connecting interrupts.

When a GIC is created, the first-cpu-index property is set on it, and a
pointer to the GIC is stored in the intc array. When connecting an IRQ,
a TYPE_SPLIT_IRQ device is created with its num-lines property set to
the number of GICs in the SoC. The split device is used to fan out the
IRQ to all the GICs.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-25-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 56 +++++++++++++++++++++++++++++++++---
 include/hw/arm/xlnx-versal.h |  1 +
 2 files changed, 53 insertions(+), 4 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index e03411bc21..9256eceffc 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -45,6 +45,7 @@
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "hw/intc/arm_gicv3_its_common.h"
+#include "hw/core/split-irq.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -317,6 +318,43 @@ static inline Object *versal_get_child_idx(Versal *s, const char *child,
     return versal_get_child(s, n);
 }
 
+/*
+ * The SoC embeds multiple GICs. They all receives the same IRQ lines at the
+ * same index. This function creates a TYPE_SPLIT_IRQ device to fan out the
+ * given IRQ input to all the GICs.
+ *
+ * The TYPE_SPLIT_IRQ devices lie in the /soc/irq-splits QOM container
+ */
+static qemu_irq versal_get_gic_irq(Versal *s, int irq_idx)
+{
+    DeviceState *split;
+    Object *container = versal_get_child(s, "irq-splits");
+    int idx = FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ);
+    g_autofree char *name = g_strdup_printf("irq[%d]", idx);
+
+    split = DEVICE(object_resolve_path_at(container, name));
+
+    if (split == NULL) {
+        size_t i;
+
+        split = qdev_new(TYPE_SPLIT_IRQ);
+        qdev_prop_set_uint16(split, "num-lines", s->intc->len);
+        object_property_add_child(container, name, OBJECT(split));
+        qdev_realize_and_unref(split, NULL, &error_abort);
+
+        for (i = 0; i < s->intc->len; i++) {
+            DeviceState *gic;
+
+            gic = g_array_index(s->intc, DeviceState *, i);
+            qdev_connect_gpio_out(split, i, qdev_get_gpio_in(gic, idx));
+        }
+    } else {
+        g_assert(FIELD_EX32(irq_idx, VERSAL_IRQ, ORED));
+    }
+
+    return qdev_get_gpio_in(split, 0);
+}
+
 /*
  * When the R_VERSAL_IRQ_ORED flag is set on an IRQ descriptor, this function is
  * used to return the corresponding or gate input IRQ. The or gate is created if
@@ -353,12 +391,10 @@ static qemu_irq versal_get_irq(Versal *s, int irq_idx)
 {
     qemu_irq irq;
     bool ored;
-    DeviceState *gic;
 
     ored = FIELD_EX32(irq_idx, VERSAL_IRQ, ORED);
 
-    gic = DEVICE(versal_get_child_idx(s, "apu-gic", 0));
-    irq = qdev_get_gpio_in(gic, FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ));
+    irq = versal_get_gic_irq(s, irq_idx);
 
     if (ored) {
         irq = versal_get_irq_or_gate_in(s, irq_idx, irq);
@@ -501,6 +537,7 @@ static void versal_create_gic_its(Versal *s,
 static DeviceState *versal_create_gic(Versal *s,
                                       const VersalCpuClusterMap *map,
                                       MemoryRegion *mr,
+                                      int first_cpu_idx,
                                       size_t num_cpu)
 {
     DeviceState *dev;
@@ -525,6 +562,7 @@ static DeviceState *versal_create_gic(Versal *s,
     qdev_prop_set_bit(dev, "has-security-extensions", true);
     qdev_prop_set_bit(dev, "has-lpi", map->gic.has_its);
     object_property_set_link(OBJECT(dev), "sysmem", OBJECT(mr), &error_abort);
+    qdev_prop_set_uint32(dev, "first-cpu-index", first_cpu_idx);
 
     sysbus_realize_and_unref(sbd, &error_fatal);
 
@@ -551,6 +589,8 @@ static DeviceState *versal_create_gic(Versal *s,
 
     versal_create_gic_its(s, map, dev, mr, node);
 
+    g_array_append_val(s->intc, dev);
+
     return dev;
 }
 
@@ -608,9 +648,11 @@ static inline void versal_create_and_connect_gic(Versal *s,
                                                  size_t num_cpu)
 {
     DeviceState *gic;
+    int first_cpu_idx;
     size_t i;
 
-    gic = versal_create_gic(s, map, mr, num_cpu);
+    first_cpu_idx = CPU(cpus[0])->cpu_index;
+    gic = versal_create_gic(s, map, mr, first_cpu_idx, num_cpu);
 
     for (i = 0; i < num_cpu; i++) {
         connect_gic_to_cpu(map, gic, cpus[i], i, num_cpu);
@@ -1539,6 +1581,10 @@ static void versal_realize(DeviceState *dev, Error **errp)
     s->phandle.clk_125mhz = fdt_add_clk_node(s, "/clk125", 125 * 1000 * 1000);
     s->phandle.gic = qemu_fdt_alloc_phandle(s->cfg.fdt);
 
+    container = object_new(TYPE_CONTAINER);
+    object_property_add_child(OBJECT(s), "irq-splits", container);
+    object_unref(container);
+
     container = object_new(TYPE_CONTAINER);
     object_property_add_child(OBJECT(s), "irq-or-gates", container);
     object_unref(container);
@@ -1720,6 +1766,7 @@ static void versal_base_init(Object *obj)
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
     memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
                              "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
+    s->intc = g_array_new(false, false, sizeof(DeviceState *));
 
     num_can = versal_get_map(s)->num_canfd;
     s->cfg.canbus = g_new0(CanBusState *, num_can);
@@ -1737,6 +1784,7 @@ static void versal_base_finalize(Object *obj)
 {
     Versal *s = XLNX_VERSAL_BASE(obj);
 
+    g_array_free(s->intc, true);
     g_free(s->cfg.canbus);
 }
 
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 9d9ccfb001..984f9f2ccd 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -42,6 +42,7 @@ struct Versal {
     SysBusDevice parent_obj;
 
     /*< public >*/
+    GArray *intc;
     MemoryRegion mr_ps;
 
     struct {

From 0dfff625b5dafcb6cd722dd094ddc54c031e9169 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:43 +0200
Subject: [PATCH 1100/2396] hw/arm/xlnx-versal: add support for GICv2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for GICv2 instantiation in the Versal SoC. This is in
preparation for the RPU refactoring.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-26-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 82 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 62 insertions(+), 20 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 9256eceffc..45ea47a8b9 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -45,6 +45,7 @@
 #include "hw/misc/xlnx-versal-crl.h"
 #include "hw/intc/arm_gicv3_common.h"
 #include "hw/intc/arm_gicv3_its_common.h"
+#include "hw/intc/arm_gic.h"
 #include "hw/core/split-irq.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
@@ -74,6 +75,7 @@ typedef struct VersalGicMap {
     int version;
     uint64_t dist;
     uint64_t redist;
+    uint64_t cpu_iface;
     uint64_t its;
     size_t num_irq;
     bool has_its;
@@ -503,6 +505,10 @@ static void versal_create_gic_its(Versal *s,
     g_autofree char *node_pat = NULL, *node = NULL;
     const char compatible[] = "arm,gic-v3-its";
 
+    if (map->gic.version != 3) {
+        return;
+    }
+
     if (!map->gic.has_its) {
         return;
     }
@@ -542,45 +548,81 @@ static DeviceState *versal_create_gic(Versal *s,
 {
     DeviceState *dev;
     SysBusDevice *sbd;
-    QList *redist_region_count;
     g_autofree char *node = NULL;
     g_autofree char *name = NULL;
-    const char compatible[] = "arm,gic-v3";
+    const char gicv3_compat[] = "arm,gic-v3";
+    const char gicv2_compat[] = "arm,cortex-a15-gic";
+
+    switch (map->gic.version) {
+    case 2:
+        dev = qdev_new(gic_class_name());
+        break;
+
+    case 3:
+        dev = qdev_new(gicv3_class_name());
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
 
-    dev = qdev_new(gicv3_class_name());
     name = g_strdup_printf("%s-gic[*]", map->name);
     object_property_add_child(OBJECT(s), name, OBJECT(dev));
     sbd = SYS_BUS_DEVICE(dev);
-    qdev_prop_set_uint32(dev, "revision", 3);
+    qdev_prop_set_uint32(dev, "revision", map->gic.version);
     qdev_prop_set_uint32(dev, "num-cpu", num_cpu);
     qdev_prop_set_uint32(dev, "num-irq", map->gic.num_irq + 32);
-
-    redist_region_count = qlist_new();
-    qlist_append_int(redist_region_count, num_cpu);
-    qdev_prop_set_array(dev, "redist-region-count", redist_region_count);
-
     qdev_prop_set_bit(dev, "has-security-extensions", true);
-    qdev_prop_set_bit(dev, "has-lpi", map->gic.has_its);
-    object_property_set_link(OBJECT(dev), "sysmem", OBJECT(mr), &error_abort);
     qdev_prop_set_uint32(dev, "first-cpu-index", first_cpu_idx);
 
+    if (map->gic.version == 3) {
+        QList *redist_region_count;
+
+        redist_region_count = qlist_new();
+        qlist_append_int(redist_region_count, num_cpu);
+        qdev_prop_set_array(dev, "redist-region-count", redist_region_count);
+        qdev_prop_set_bit(dev, "has-lpi", map->gic.has_its);
+        object_property_set_link(OBJECT(dev), "sysmem", OBJECT(mr),
+                                 &error_abort);
+
+    }
+
     sysbus_realize_and_unref(sbd, &error_fatal);
 
     memory_region_add_subregion(mr, map->gic.dist,
                                 sysbus_mmio_get_region(sbd, 0));
-    memory_region_add_subregion(mr, map->gic.redist,
-                                sysbus_mmio_get_region(sbd, 1));
+
+    if (map->gic.version == 3) {
+        memory_region_add_subregion(mr, map->gic.redist,
+                                    sysbus_mmio_get_region(sbd, 1));
+    } else {
+        memory_region_add_subregion(mr, map->gic.cpu_iface,
+                                    sysbus_mmio_get_region(sbd, 1));
+    }
 
     if (map->dtb_expose) {
-        node = versal_fdt_add_subnode(s, "/gic", map->gic.dist, compatible,
-                                      sizeof(compatible));
+        if (map->gic.version == 3) {
+            node = versal_fdt_add_subnode(s, "/gic", map->gic.dist,
+                                          gicv3_compat,
+                                          sizeof(gicv3_compat));
+            qemu_fdt_setprop_sized_cells(s->cfg.fdt, node, "reg",
+                                         2, map->gic.dist,
+                                         2, 0x10000,
+                                         2, map->gic.redist,
+                                         2, GICV3_REDIST_SIZE * num_cpu);
+        } else {
+            node = versal_fdt_add_subnode(s, "/gic", map->gic.dist,
+                                          gicv2_compat,
+                                          sizeof(gicv2_compat));
+            qemu_fdt_setprop_sized_cells(s->cfg.fdt, node, "reg",
+                                         2, map->gic.dist,
+                                         2, 0x1000,
+                                         2, map->gic.cpu_iface,
+                                         2, 0x1000);
+        }
+
         qemu_fdt_setprop_cell(s->cfg.fdt, node, "phandle", s->phandle.gic);
         qemu_fdt_setprop_cell(s->cfg.fdt, node, "#interrupt-cells", 3);
-        qemu_fdt_setprop_sized_cells(s->cfg.fdt, node, "reg",
-                                     2, map->gic.dist,
-                                     2, 0x10000,
-                                     2, map->gic.redist,
-                                     2, GICV3_REDIST_SIZE * num_cpu);
         qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
                                GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI);

From 805bdea08a17db38f0d860f9acad2eb3cf8e6fb5 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:44 +0200
Subject: [PATCH 1101/2396] hw/arm/xlnx-versal: rpu: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the RPU cluster creation using the VersalMap structure. This
effectively instantiate the RPU GICv2 which was not instantiated before.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-27-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    |  1 +
 hw/arm/xlnx-versal.c         | 60 +++++++++++++++---------------------
 include/hw/arm/xlnx-versal.h | 11 -------
 3 files changed, 26 insertions(+), 46 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 27594f78c8..5958e71251 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -24,6 +24,7 @@
 #include "hw/arm/boot.h"
 #include "target/arm/multiprocessing.h"
 #include "qom/object.h"
+#include "target/arm/cpu.h"
 
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
 OBJECT_DECLARE_SIMPLE_TYPE(VersalVirt, XLNX_VERSAL_VIRT_MACHINE)
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 45ea47a8b9..e89c66313c 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -47,6 +47,8 @@
 #include "hw/intc/arm_gicv3_its_common.h"
 #include "hw/intc/arm_gic.h"
 #include "hw/core/split-irq.h"
+#include "target/arm/cpu.h"
+#include "hw/cpu/cluster.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -107,6 +109,7 @@ typedef struct VersalCpuClusterMap {
 
 typedef struct VersalMap {
     VersalCpuClusterMap apu;
+    VersalCpuClusterMap rpu;
 
     VersalSimplePeriphMap uart[2];
     size_t num_uart;
@@ -226,6 +229,27 @@ static const VersalMap VERSAL_MAP = {
         },
     },
 
+    .rpu = {
+        .name = "rpu",
+        .cpu_model = ARM_CPU_TYPE_NAME("cortex-r5f"),
+        .num_cluster = 1,
+        .num_core = 2,
+        .qemu_cluster_id = 1,
+        .mp_affinity = {
+            .base = 0x100,
+            .core_shift = ARM_AFF0_SHIFT,
+            .cluster_shift = ARM_AFF1_SHIFT,
+        },
+        .start_powered_off = SPO_ALL,
+        .dtb_expose = false,
+        .gic = {
+            .version = 2,
+            .dist = 0xf9000000,
+            .cpu_iface = 0xf9001000,
+            .num_irq = 192,
+        },
+    },
+
     .uart[0] = { 0xff000000, 18 },
     .uart[1] = { 0xff010000, 19 },
     .num_uart = 2,
@@ -806,35 +830,6 @@ static void versal_create_cpu_cluster(Versal *s, const VersalCpuClusterMap *map)
     }
 }
 
-static void versal_create_rpu_cpus(Versal *s)
-{
-    int i;
-
-    object_initialize_child(OBJECT(s), "rpu-cluster", &s->lpd.rpu.cluster,
-                            TYPE_CPU_CLUSTER);
-    qdev_prop_set_uint32(DEVICE(&s->lpd.rpu.cluster), "cluster-id", 1);
-
-    for (i = 0; i < ARRAY_SIZE(s->lpd.rpu.cpu); i++) {
-        Object *obj;
-
-        object_initialize_child(OBJECT(&s->lpd.rpu.cluster),
-                                "rpu-cpu[*]", &s->lpd.rpu.cpu[i],
-                                XLNX_VERSAL_RCPU_TYPE);
-        obj = OBJECT(&s->lpd.rpu.cpu[i]);
-        object_property_set_bool(obj, "start-powered-off", true,
-                                 &error_abort);
-
-        object_property_set_int(obj, "mp-affinity", 0x100 | i, &error_abort);
-        object_property_set_int(obj, "core-count", ARRAY_SIZE(s->lpd.rpu.cpu),
-                                &error_abort);
-        object_property_set_link(obj, "memory", OBJECT(&s->lpd.rpu.mr),
-                                 &error_abort);
-        qdev_realize(DEVICE(obj), NULL, &error_fatal);
-    }
-
-    qdev_realize(DEVICE(&s->lpd.rpu.cluster), NULL, &error_fatal);
-}
-
 static void versal_create_uart(Versal *s,
                                const VersalSimplePeriphMap *map,
                                int chardev_idx)
@@ -1636,7 +1631,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
     qemu_fdt_setprop_cell(s->cfg.fdt, "/", "#address-cells", 0x2);
 
     versal_create_cpu_cluster(s, &map->apu);
-    versal_create_rpu_cpus(s);
+    versal_create_cpu_cluster(s, &map->rpu);
 
     for (i = 0; i < map->num_uart; i++) {
         versal_create_uart(s, &map->uart[i], i);
@@ -1692,8 +1687,6 @@ static void versal_realize(DeviceState *dev, Error **errp)
                            MM_OCM_SIZE, &error_fatal);
 
     memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
-    memory_region_add_subregion_overlap(&s->lpd.rpu.mr, 0,
-                                        &s->lpd.rpu.mr_ps_alias, 0);
 }
 
 DeviceState *versal_get_boot_cpu(Versal *s)
@@ -1804,10 +1797,7 @@ static void versal_base_init(Object *obj)
     Versal *s = XLNX_VERSAL_BASE(obj);
     size_t i, num_can;
 
-    memory_region_init(&s->lpd.rpu.mr, obj, "mr-rpu", UINT64_MAX);
     memory_region_init(&s->mr_ps, obj, "mr-ps-switch", UINT64_MAX);
-    memory_region_init_alias(&s->lpd.rpu.mr_ps_alias, OBJECT(s),
-                             "mr-rpu-ps-alias", &s->mr_ps, 0, UINT64_MAX);
     s->intc = g_array_new(false, false, sizeof(DeviceState *));
 
     num_can = versal_get_map(s)->num_canfd;
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 984f9f2ccd..0a91ec7ae3 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -14,10 +14,8 @@
 #define XLNX_VERSAL_H
 
 #include "hw/sysbus.h"
-#include "hw/cpu/cluster.h"
 #include "qom/object.h"
 #include "net/can_emu.h"
-#include "target/arm/cpu.h"
 #include "hw/arm/xlnx-versal-version.h"
 
 #define TYPE_XLNX_VERSAL_BASE "xlnx-versal-base"
@@ -52,15 +50,6 @@ struct Versal {
 
     struct {
         MemoryRegion mr_ocm;
-
-        /* Real-time Processing Unit.  */
-        struct {
-            MemoryRegion mr;
-            MemoryRegion mr_ps_alias;
-
-            CPUClusterState cluster;
-            ARMCPU cpu[XLNX_VERSAL_NR_RCPUS];
-        } rpu;
     } lpd;
 
     struct {

From cf8f12b6e719dca00e015febb5d5bbb1f3d6aa7f Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:45 +0200
Subject: [PATCH 1102/2396] hw/arm/xlnx-versal: ocm: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the OCM creation using the VersalMap structure.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-28-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 20 ++++++++++++++++----
 include/hw/arm/xlnx-versal.h |  4 ----
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index e89c66313c..8aa82ceb83 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -73,6 +73,11 @@ typedef struct VersalSimplePeriphMap {
     int irq;
 } VersalSimplePeriphMap;
 
+typedef struct VersalMemMap {
+    uint64_t addr;
+    uint64_t size;
+} VersalMemMap;
+
 typedef struct VersalGicMap {
     int version;
     uint64_t dist;
@@ -108,6 +113,8 @@ typedef struct VersalCpuClusterMap {
 } VersalCpuClusterMap;
 
 typedef struct VersalMap {
+    VersalMemMap ocm;
+
     VersalCpuClusterMap apu;
     VersalCpuClusterMap rpu;
 
@@ -207,6 +214,11 @@ typedef struct VersalMap {
 } VersalMap;
 
 static const VersalMap VERSAL_MAP = {
+    .ocm = {
+        .addr = 0xfffc0000,
+        .size = 0x40000,
+    },
+
     .apu = {
         .name = "apu",
         .cpu_model = ARM_CPU_TYPE_NAME("cortex-a72"),
@@ -1608,6 +1620,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
 {
     Versal *s = XLNX_VERSAL_BASE(dev);
     DeviceState *slcr, *ospi;
+    MemoryRegion *ocm;
     Object *container;
     const VersalMap *map = versal_get_map(s);
     size_t i;
@@ -1683,10 +1696,9 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_unimp(s);
 
     /* Create the On Chip Memory (OCM).  */
-    memory_region_init_ram(&s->lpd.mr_ocm, OBJECT(s), "ocm",
-                           MM_OCM_SIZE, &error_fatal);
-
-    memory_region_add_subregion_overlap(&s->mr_ps, MM_OCM, &s->lpd.mr_ocm, 0);
+    ocm = g_new(MemoryRegion, 1);
+    memory_region_init_ram(ocm, OBJECT(s), "ocm", map->ocm.size, &error_fatal);
+    memory_region_add_subregion_overlap(&s->mr_ps, map->ocm.addr, ocm, 0);
 }
 
 DeviceState *versal_get_boot_cpu(Versal *s)
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 0a91ec7ae3..e1d6e54549 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -48,10 +48,6 @@ struct Versal {
         MemoryRegion mr_ddr_ranges[4];
     } noc;
 
-    struct {
-        MemoryRegion mr_ocm;
-    } lpd;
-
     struct {
         uint32_t clk_25mhz;
         uint32_t clk_125mhz;

From e4a9bc0aae9f98c64a9689f9471234636e6d3ae0 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:46 +0200
Subject: [PATCH 1103/2396] hw/arm/xlnx-versal: ddr: refactor creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the DDR aperture regions creation using the VersalMap
structure. Device creation and FDT node creation are split into two
functions because the later must happen during ARM virtual bootloader
modify_dtb callback.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-29-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 79 +-----------------------------------
 hw/arm/xlnx-versal.c         | 73 ++++++++++++++++++++++-----------
 include/hw/arm/xlnx-versal.h |  7 +---
 3 files changed, 53 insertions(+), 106 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 5958e71251..ad7b3135a6 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -106,88 +106,13 @@ static void fdt_nop_memory_nodes(void *fdt, Error **errp)
     g_strfreev(node_path);
 }
 
-static void fdt_add_memory_nodes(VersalVirt *s, void *fdt, uint64_t ram_size)
-{
-    /* Describes the various split DDR access regions.  */
-    static const struct {
-        uint64_t base;
-        uint64_t size;
-    } addr_ranges[] = {
-        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
-        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
-        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
-        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
-    };
-    uint64_t mem_reg_prop[8] = {0};
-    uint64_t size = ram_size;
-    Error *err = NULL;
-    char *name;
-    int i;
-
-    fdt_nop_memory_nodes(fdt, &err);
-    if (err) {
-        error_report_err(err);
-        return;
-    }
-
-    name = g_strdup_printf("/memory@%x", MM_TOP_DDR);
-    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
-        uint64_t mapsize;
-
-        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
-
-        mem_reg_prop[i * 2] = addr_ranges[i].base;
-        mem_reg_prop[i * 2 + 1] = mapsize;
-        size -= mapsize;
-    }
-    qemu_fdt_add_subnode(fdt, name);
-    qemu_fdt_setprop_string(fdt, name, "device_type", "memory");
-
-    switch (i) {
-    case 1:
-        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
-                                     2, mem_reg_prop[0],
-                                     2, mem_reg_prop[1]);
-        break;
-    case 2:
-        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
-                                     2, mem_reg_prop[0],
-                                     2, mem_reg_prop[1],
-                                     2, mem_reg_prop[2],
-                                     2, mem_reg_prop[3]);
-        break;
-    case 3:
-        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
-                                     2, mem_reg_prop[0],
-                                     2, mem_reg_prop[1],
-                                     2, mem_reg_prop[2],
-                                     2, mem_reg_prop[3],
-                                     2, mem_reg_prop[4],
-                                     2, mem_reg_prop[5]);
-        break;
-    case 4:
-        qemu_fdt_setprop_sized_cells(fdt, name, "reg",
-                                     2, mem_reg_prop[0],
-                                     2, mem_reg_prop[1],
-                                     2, mem_reg_prop[2],
-                                     2, mem_reg_prop[3],
-                                     2, mem_reg_prop[4],
-                                     2, mem_reg_prop[5],
-                                     2, mem_reg_prop[6],
-                                     2, mem_reg_prop[7]);
-        break;
-    default:
-        g_assert_not_reached();
-    }
-    g_free(name);
-}
-
 static void versal_virt_modify_dtb(const struct arm_boot_info *binfo,
                                     void *fdt)
 {
     VersalVirt *s = container_of(binfo, VersalVirt, binfo);
 
-    fdt_add_memory_nodes(s, fdt, binfo->ram_size);
+    fdt_nop_memory_nodes(s->fdt, &error_abort);
+    versal_fdt_add_memory_nodes(&s->soc, binfo->ram_size);
 }
 
 static void *versal_virt_get_dtb(const struct arm_boot_info *binfo,
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 8aa82ceb83..f1b704175f 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -115,6 +115,11 @@ typedef struct VersalCpuClusterMap {
 typedef struct VersalMap {
     VersalMemMap ocm;
 
+    struct VersalDDRMap {
+        VersalMemMap chan[4];
+        size_t num_chan;
+    } ddr;
+
     VersalCpuClusterMap apu;
     VersalCpuClusterMap rpu;
 
@@ -219,6 +224,14 @@ static const VersalMap VERSAL_MAP = {
         .size = 0x40000,
     },
 
+    .ddr = {
+        .chan[0] = { .addr = 0x0, .size = 2 * GiB },
+        .chan[1] = { .addr = 0x800000000ull, .size = 32 * GiB },
+        .chan[2] = { .addr = 0xc00000000ull, .size = 256 * GiB },
+        .chan[3] = { .addr = 0x10000000000ull, .size = 734 * GiB },
+        .num_chan = 4,
+    },
+
     .apu = {
         .name = "apu",
         .cpu_model = ARM_CPU_TYPE_NAME("cortex-a72"),
@@ -1483,46 +1496,58 @@ static inline void versal_create_crl(Versal *s)
     versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->crl.irq);
 }
 
-/* This takes the board allocated linear DDR memory and creates aliases
+/*
+ * This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
-static void versal_map_ddr(Versal *s)
+static void versal_map_ddr(Versal *s, const struct VersalDDRMap *map)
 {
     uint64_t size = memory_region_size(s->cfg.mr_ddr);
-    /* Describes the various split DDR access regions.  */
-    static const struct {
-        uint64_t base;
-        uint64_t size;
-    } addr_ranges[] = {
-        { MM_TOP_DDR, MM_TOP_DDR_SIZE },
-        { MM_TOP_DDR_2, MM_TOP_DDR_2_SIZE },
-        { MM_TOP_DDR_3, MM_TOP_DDR_3_SIZE },
-        { MM_TOP_DDR_4, MM_TOP_DDR_4_SIZE }
-    };
     uint64_t offset = 0;
     int i;
 
-    assert(ARRAY_SIZE(addr_ranges) == ARRAY_SIZE(s->noc.mr_ddr_ranges));
-    for (i = 0; i < ARRAY_SIZE(addr_ranges) && size; i++) {
-        char *name;
+    for (i = 0; i < map->num_chan && size; i++) {
         uint64_t mapsize;
+        MemoryRegion *alias;
+
+        mapsize = MIN(size, map->chan[i].size);
 
-        mapsize = size < addr_ranges[i].size ? size : addr_ranges[i].size;
-        name = g_strdup_printf("noc-ddr-range%d", i);
         /* Create the MR alias.  */
-        memory_region_init_alias(&s->noc.mr_ddr_ranges[i], OBJECT(s),
-                                 name, s->cfg.mr_ddr,
-                                 offset, mapsize);
+        alias = g_new(MemoryRegion, 1);
+        memory_region_init_alias(alias, OBJECT(s), "noc-ddr-range",
+                                 s->cfg.mr_ddr, offset, mapsize);
 
         /* Map it onto the NoC MR.  */
-        memory_region_add_subregion(&s->mr_ps, addr_ranges[i].base,
-                                    &s->noc.mr_ddr_ranges[i]);
+        memory_region_add_subregion(&s->mr_ps, map->chan[i].addr, alias);
         offset += mapsize;
         size -= mapsize;
-        g_free(name);
     }
 }
 
+void versal_fdt_add_memory_nodes(Versal *s, uint64_t size)
+{
+    const struct VersalDDRMap *map = &versal_get_map(s)->ddr;
+    g_autofree char *node;
+    g_autofree uint64_t *reg;
+    int i;
+
+    reg = g_new(uint64_t, map->num_chan * 2);
+
+    for (i = 0; i < map->num_chan && size; i++) {
+        uint64_t mapsize;
+
+        mapsize = MIN(size, map->chan[i].size);
+
+        reg[i * 2] = cpu_to_be64(map->chan[i].addr);
+        reg[i * 2 + 1] = cpu_to_be64(mapsize);
+
+        size -= mapsize;
+    }
+
+    node = versal_fdt_add_subnode(s, "/memory", 0, "memory", sizeof("memory"));
+    qemu_fdt_setprop(s->cfg.fdt, node, "reg", reg, sizeof(uint64_t) * i * 2);
+}
+
 static void versal_unimp_area(Versal *s, const char *name,
                                 MemoryRegion *mr,
                                 hwaddr base, hwaddr size)
@@ -1692,7 +1717,7 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_cfu(s, &map->cfu);
     versal_create_crl(s);
 
-    versal_map_ddr(s);
+    versal_map_ddr(s, &map->ddr);
     versal_unimp(s);
 
     /* Create the On Chip Memory (OCM).  */
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index e1d6e54549..39bc414c85 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -43,11 +43,6 @@ struct Versal {
     GArray *intc;
     MemoryRegion mr_ps;
 
-    struct {
-        /* 4 ranges to access DDR.  */
-        MemoryRegion mr_ddr_ranges[4];
-    } noc;
-
     struct {
         uint32_t clk_25mhz;
         uint32_t clk_125mhz;
@@ -73,6 +68,8 @@ static inline void versal_set_fdt(Versal *s, void *fdt)
     s->cfg.fdt = fdt;
 }
 
+void versal_fdt_add_memory_nodes(Versal *s, uint64_t ram_size);
+
 DeviceState *versal_get_boot_cpu(Versal *s);
 void versal_sdhci_plug_card(Versal *s, int sd_idx, BlockBackend *blk);
 void versal_efuse_attach_drive(Versal *s, BlockBackend *blk);

From 87830c4dd626804072181cf126daa206c5721dc4 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:47 +0200
Subject: [PATCH 1104/2396] hw/arm/xlnx-versal: add the versal_get_num_cpu
 accessor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the versal_get_num_cpu accessor to the Versal SoC to retrieve the
number of CPUs in the SoC. Use it in the xlnx-versal-virt machine.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-30-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c    | 7 ++++---
 hw/arm/xlnx-versal.c         | 8 ++++++++
 include/hw/arm/xlnx-versal.h | 1 +
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index ad7b3135a6..274a7ef988 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -346,12 +346,13 @@ static void versal_virt_machine_finalize(Object *obj)
 static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
+    int num_cpu = versal_get_num_cpu(VERSAL_VER_VERSAL);
 
     mc->desc = "Xilinx Versal Virtual development board";
     mc->init = versal_virt_init;
-    mc->min_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
-    mc->max_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
-    mc->default_cpus = XLNX_VERSAL_NR_ACPUS + XLNX_VERSAL_NR_RCPUS;
+    mc->min_cpus = num_cpu;
+    mc->max_cpus = num_cpu;
+    mc->default_cpus = num_cpu;
     mc->no_cdrom = true;
     mc->auto_create_sdcard = true;
     mc->default_ram_id = "ddr";
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index f1b704175f..2e28b807d7 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -1815,6 +1815,14 @@ hwaddr versal_get_reserved_mmio_addr(Versal *s)
     return map->reserved.mmio_start;
 }
 
+int versal_get_num_cpu(VersalVersion version)
+{
+    const VersalMap *map = VERSION_TO_MAP[version];
+
+    return map->apu.num_cluster * map->apu.num_core
+        + map->rpu.num_cluster * map->rpu.num_core;
+}
+
 int versal_get_num_can(VersalVersion version)
 {
     const VersalMap *map = VERSION_TO_MAP[version];
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 39bc414c85..7bdf6dab62 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -80,6 +80,7 @@ void versal_ospi_create_flash(Versal *s, int flash_idx, const char *flash_mdl,
 qemu_irq versal_get_reserved_irq(Versal *s, int idx, int *dtb_idx);
 hwaddr versal_get_reserved_mmio_addr(Versal *s);
 
+int versal_get_num_cpu(VersalVersion version);
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);
 

From 3074e35115f51387d26774a37d79ca761721fb5c Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:48 +0200
Subject: [PATCH 1105/2396] hw/misc/xlnx-versal-crl: remove unnecessary include
 directives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop unused include directives from xlnx-versal-crl.c

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-31-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-crl.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index 08ff2fcc24..f288545967 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -1,16 +1,13 @@
 /*
  * QEMU model of the Clock-Reset-LPD (CRL).
  *
- * Copyright (c) 2022 Advanced Micro Devices, Inc.
+ * Copyright (c) 2022-2025 Advanced Micro Devices, Inc.
  * SPDX-License-Identifier: GPL-2.0-or-later
  *
  * Written by Edgar E. Iglesias <edgar.iglesias@amd.com>
  */
 
 #include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "qemu/log.h"
-#include "qemu/bitops.h"
 #include "migration/vmstate.h"
 #include "hw/qdev-properties.h"
 #include "hw/sysbus.h"

From c27ca57288109b434a464b8ee8d05ec4a387e468 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:49 +0200
Subject: [PATCH 1106/2396] hw/misc/xlnx-versal-crl: split into base/concrete
 classes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split the TYPE_XLNX_VERSAL_CRL type into base and concrete classes. This
is in preparation for the versal2 version of the CRL.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-32-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-crl.c         | 48 +++++++++++++++++++------------
 include/hw/misc/xlnx-versal-crl.h | 31 ++++++++++++++++++--
 2 files changed, 58 insertions(+), 21 deletions(-)

diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index f288545967..be89e0da40 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -298,7 +298,7 @@ static const RegisterAccessInfo crl_regs_info[] = {
     }
 };
 
-static void crl_reset_enter(Object *obj, ResetType type)
+static void versal_crl_reset_enter(Object *obj, ResetType type)
 {
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
     unsigned int i;
@@ -308,7 +308,7 @@ static void crl_reset_enter(Object *obj, ResetType type)
     }
 }
 
-static void crl_reset_hold(Object *obj, ResetType type)
+static void versal_crl_reset_hold(Object *obj, ResetType type)
 {
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
 
@@ -325,20 +325,22 @@ static const MemoryRegionOps crl_ops = {
     },
 };
 
-static void crl_init(Object *obj)
+static void versal_crl_init(Object *obj)
 {
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    XlnxVersalCRLBase *xvcb = XLNX_VERSAL_CRL_BASE(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
     int i;
 
-    s->reg_array =
+    xvcb->reg_array =
         register_init_block32(DEVICE(obj), crl_regs_info,
                               ARRAY_SIZE(crl_regs_info),
                               s->regs_info, s->regs,
                               &crl_ops,
                               XLNX_VERSAL_CRL_ERR_DEBUG,
                               CRL_R_MAX * 4);
-    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    xvcb->regs = s->regs;
+    sysbus_init_mmio(sbd, &xvcb->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 
     for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
@@ -377,11 +379,11 @@ static void crl_init(Object *obj)
 
 static void crl_finalize(Object *obj)
 {
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
+    XlnxVersalCRLBase *s = XLNX_VERSAL_CRL_BASE(obj);
     register_finalize_block(s->reg_array);
 }
 
-static const VMStateDescription vmstate_crl = {
+static const VMStateDescription vmstate_versal_crl = {
     .name = TYPE_XLNX_VERSAL_CRL,
     .version_id = 1,
     .minimum_version_id = 1,
@@ -391,29 +393,37 @@ static const VMStateDescription vmstate_crl = {
     }
 };
 
-static void crl_class_init(ObjectClass *klass, const void *data)
+static void versal_crl_class_init(ObjectClass *klass, const void *data)
 {
-    ResettableClass *rc = RESETTABLE_CLASS(klass);
     DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
 
-    dc->vmsd = &vmstate_crl;
-
-    rc->phases.enter = crl_reset_enter;
-    rc->phases.hold = crl_reset_hold;
+    dc->vmsd = &vmstate_versal_crl;
+    rc->phases.enter = versal_crl_reset_enter;
+    rc->phases.hold = versal_crl_reset_hold;
 }
 
-static const TypeInfo crl_info = {
-    .name          = TYPE_XLNX_VERSAL_CRL,
+static const TypeInfo crl_base_info = {
+    .name          = TYPE_XLNX_VERSAL_CRL_BASE,
     .parent        = TYPE_SYS_BUS_DEVICE,
-    .instance_size = sizeof(XlnxVersalCRL),
-    .class_init    = crl_class_init,
-    .instance_init = crl_init,
+    .instance_size = sizeof(XlnxVersalCRLBase),
+    .class_size    = sizeof(XlnxVersalCRLBaseClass),
     .instance_finalize = crl_finalize,
+    .abstract      = true,
+};
+
+static const TypeInfo versal_crl_info = {
+    .name          = TYPE_XLNX_VERSAL_CRL,
+    .parent        = TYPE_XLNX_VERSAL_CRL_BASE,
+    .instance_size = sizeof(XlnxVersalCRL),
+    .instance_init = versal_crl_init,
+    .class_init    = versal_crl_class_init,
 };
 
 static void crl_register_types(void)
 {
-    type_register_static(&crl_info);
+    type_register_static(&crl_base_info);
+    type_register_static(&versal_crl_info);
 }
 
 type_init(crl_register_types)
diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
index dba6d3585d..2b39d203a6 100644
--- a/include/hw/misc/xlnx-versal-crl.h
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -2,6 +2,7 @@
  * QEMU model of the Clock-Reset-LPD (CRL).
  *
  * Copyright (c) 2022 Xilinx Inc.
+ * Copyright (c) 2025 Advanced Micro Devices, Inc.
  * SPDX-License-Identifier: GPL-2.0-or-later
  *
  * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
@@ -12,8 +13,13 @@
 #include "hw/sysbus.h"
 #include "hw/register.h"
 #include "target/arm/cpu-qom.h"
+#include "hw/arm/xlnx-versal-version.h"
 
+#define TYPE_XLNX_VERSAL_CRL_BASE "xlnx-versal-crl-base"
 #define TYPE_XLNX_VERSAL_CRL "xlnx-versal-crl"
+
+OBJECT_DECLARE_TYPE(XlnxVersalCRLBase, XlnxVersalCRLBaseClass,
+                    XLNX_VERSAL_CRL_BASE)
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
 
 REG32(ERR_CTRL, 0x0)
@@ -216,8 +222,19 @@ REG32(PSM_RST_MODE, 0x370)
 
 #define RPU_MAX_CPU 2
 
-struct XlnxVersalCRL {
+struct XlnxVersalCRLBase {
     SysBusDevice parent_obj;
+
+    RegisterInfoArray *reg_array;
+    uint32_t *regs;
+};
+
+struct XlnxVersalCRLBaseClass {
+    SysBusDeviceClass parent_class;
+};
+
+struct XlnxVersalCRL {
+    XlnxVersalCRLBase parent_obj;
     qemu_irq irq;
 
     struct {
@@ -228,8 +245,18 @@ struct XlnxVersalCRL {
         DeviceState *usb;
     } cfg;
 
-    RegisterInfoArray *reg_array;
     uint32_t regs[CRL_R_MAX];
     RegisterInfo regs_info[CRL_R_MAX];
 };
+
+static inline const char *xlnx_versal_crl_class_name(VersalVersion ver)
+{
+    switch (ver) {
+    case VERSAL_VER_VERSAL:
+        return TYPE_XLNX_VERSAL_CRL;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 #endif

From ff789d1556af9994494f0bebf7191b50eaacc126 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:50 +0200
Subject: [PATCH 1107/2396] hw/misc/xlnx-versal-crl: refactor device reset
 logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the device reset logic to have a common register write callback
for all the devices. This uses a decode function to map the register
address to the actual peripheral to reset. This refactoring changes the
CPU property name from cpu_r5[*] to rpu[*] to ease with the connections
in the Versal SoC. It also fixes a bug where the gem device pointer
was mapped to the usb link property.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-33-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-crl.c         | 169 ++++++++++++++++--------------
 include/hw/misc/xlnx-versal-crl.h |   8 +-
 2 files changed, 95 insertions(+), 82 deletions(-)

diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index be89e0da40..6225a92e0b 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -55,90 +55,99 @@ static uint64_t crl_disable_prew(RegisterInfo *reg, uint64_t val64)
     return 0;
 }
 
-static void crl_reset_dev(XlnxVersalCRL *s, DeviceState *dev,
-                          bool rst_old, bool rst_new)
+static DeviceState **versal_decode_periph_rst(XlnxVersalCRLBase *s,
+                                              hwaddr addr, size_t *count)
 {
-    device_cold_reset(dev);
-}
+    size_t idx;
+    XlnxVersalCRL *xvc = XLNX_VERSAL_CRL(s);
 
-static void crl_reset_cpu(XlnxVersalCRL *s, ARMCPU *armcpu,
-                          bool rst_old, bool rst_new)
-{
-    if (rst_new) {
-        arm_set_cpu_off(arm_cpu_mp_affinity(armcpu));
-    } else {
-        arm_set_cpu_on_and_reset(arm_cpu_mp_affinity(armcpu));
+    *count = 1;
+
+    switch (addr) {
+    case A_RST_CPU_R5:
+        return xvc->cfg.rpu;
+
+    case A_RST_ADMA:
+        /* A single register fans out to all DMA reset inputs */
+        *count = ARRAY_SIZE(xvc->cfg.adma);
+        return xvc->cfg.adma;
+
+    case A_RST_UART0 ... A_RST_UART1:
+        idx = (addr - A_RST_UART0) / sizeof(uint32_t);
+        return xvc->cfg.uart + idx;
+
+    case A_RST_GEM0 ... A_RST_GEM1:
+        idx = (addr - A_RST_GEM0) / sizeof(uint32_t);
+        return xvc->cfg.gem + idx;
+
+    case A_RST_USB0:
+        return xvc->cfg.usb;
+
+    default:
+        /* invalid or unimplemented */
+        return NULL;
     }
 }
 
-#define REGFIELD_RESET(type, s, reg, f, new_val, dev) {     \
-    bool old_f = ARRAY_FIELD_EX32((s)->regs, reg, f);       \
-    bool new_f = FIELD_EX32(new_val, reg, f);               \
-                                                            \
-    /* Detect edges.  */                                    \
-    if (dev && old_f != new_f) {                            \
-        crl_reset_ ## type(s, dev, old_f, new_f);           \
-    }                                                       \
-}
-
-static uint64_t crl_rst_r5_prew(RegisterInfo *reg, uint64_t val64)
+static uint64_t crl_rst_cpu_prew(RegisterInfo *reg, uint64_t val64)
 {
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    XlnxVersalCRLBase *s = XLNX_VERSAL_CRL_BASE(reg->opaque);
+    XlnxVersalCRLBaseClass *xvcbc = XLNX_VERSAL_CRL_BASE_GET_CLASS(s);
+    DeviceState **dev;
+    size_t i, count;
 
-    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU0, val64, s->cfg.cpu_r5[0]);
-    REGFIELD_RESET(cpu, s, RST_CPU_R5, RESET_CPU1, val64, s->cfg.cpu_r5[1]);
-    return val64;
-}
+    dev = xvcbc->decode_periph_rst(s, reg->access->addr, &count);
 
-static uint64_t crl_rst_adma_prew(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-    int i;
+    for (i = 0; i < 2; i++) {
+        bool prev, new;
+        uint64_t aff;
 
-    /* A single register fans out to all ADMA reset inputs.  */
-    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); i++) {
-        REGFIELD_RESET(dev, s, RST_ADMA, RESET, val64, s->cfg.adma[i]);
+        prev = extract32(s->regs[reg->access->addr / 4], i, 1);
+        new = extract32(val64, i, 1);
+
+        if (prev == new) {
+            continue;
+        }
+
+        aff = arm_cpu_mp_affinity(ARM_CPU(dev[i]));
+
+        if (new) {
+            arm_set_cpu_off(aff);
+        } else {
+            arm_set_cpu_on_and_reset(aff);
+        }
     }
+
     return val64;
 }
 
-static uint64_t crl_rst_uart0_prew(RegisterInfo *reg, uint64_t val64)
+static uint64_t crl_rst_dev_prew(RegisterInfo *reg, uint64_t val64)
 {
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    XlnxVersalCRLBase *s = XLNX_VERSAL_CRL_BASE(reg->opaque);
+    XlnxVersalCRLBaseClass *xvcbc = XLNX_VERSAL_CRL_BASE_GET_CLASS(s);
+    DeviceState **dev;
+    bool prev, new;
+    size_t i, count;
 
-    REGFIELD_RESET(dev, s, RST_UART0, RESET, val64, s->cfg.uart[0]);
-    return val64;
-}
+    dev = xvcbc->decode_periph_rst(s, reg->access->addr, &count);
 
-static uint64_t crl_rst_uart1_prew(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    if (dev == NULL) {
+        return val64;
+    }
 
-    REGFIELD_RESET(dev, s, RST_UART1, RESET, val64, s->cfg.uart[1]);
-    return val64;
-}
+    prev = s->regs[reg->access->addr / 4] & 0x1;
+    new = val64 & 0x1;
 
-static uint64_t crl_rst_gem0_prew(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
+    if (prev == new) {
+        return val64;
+    }
 
-    REGFIELD_RESET(dev, s, RST_GEM0, RESET, val64, s->cfg.gem[0]);
-    return val64;
-}
+    for (i = 0; i < count; i++) {
+        if (dev[i]) {
+            device_cold_reset(dev[i]);
+        }
+    }
 
-static uint64_t crl_rst_gem1_prew(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-
-    REGFIELD_RESET(dev, s, RST_GEM1, RESET, val64, s->cfg.gem[1]);
-    return val64;
-}
-
-static uint64_t crl_rst_usb_prew(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCRL *s = XLNX_VERSAL_CRL(reg->opaque);
-
-    REGFIELD_RESET(dev, s, RST_USB0, RESET, val64, s->cfg.usb);
     return val64;
 }
 
@@ -244,27 +253,27 @@ static const RegisterAccessInfo crl_regs_info[] = {
     },{ .name = "RST_CPU_R5",  .addr = A_RST_CPU_R5,
         .reset = 0x17,
         .rsvd = 0x8,
-        .pre_write = crl_rst_r5_prew,
+        .pre_write = crl_rst_cpu_prew,
     },{ .name = "RST_ADMA",  .addr = A_RST_ADMA,
         .reset = 0x1,
-        .pre_write = crl_rst_adma_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_GEM0",  .addr = A_RST_GEM0,
         .reset = 0x1,
-        .pre_write = crl_rst_gem0_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_GEM1",  .addr = A_RST_GEM1,
         .reset = 0x1,
-        .pre_write = crl_rst_gem1_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_SPARE",  .addr = A_RST_SPARE,
         .reset = 0x1,
     },{ .name = "RST_USB0",  .addr = A_RST_USB0,
         .reset = 0x1,
-        .pre_write = crl_rst_usb_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_UART0",  .addr = A_RST_UART0,
         .reset = 0x1,
-        .pre_write = crl_rst_uart0_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_UART1",  .addr = A_RST_UART1,
         .reset = 0x1,
-        .pre_write = crl_rst_uart1_prew,
+        .pre_write = crl_rst_dev_prew,
     },{ .name = "RST_SPI0",  .addr = A_RST_SPI0,
         .reset = 0x1,
     },{ .name = "RST_SPI1",  .addr = A_RST_SPI1,
@@ -343,9 +352,9 @@ static void versal_crl_init(Object *obj)
     sysbus_init_mmio(sbd, &xvcb->reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 
-    for (i = 0; i < ARRAY_SIZE(s->cfg.cpu_r5); ++i) {
-        object_property_add_link(obj, "cpu_r5[*]", TYPE_ARM_CPU,
-                                 (Object **)&s->cfg.cpu_r5[i],
+    for (i = 0; i < ARRAY_SIZE(s->cfg.rpu); ++i) {
+        object_property_add_link(obj, "rpu[*]", TYPE_ARM_CPU,
+                                 (Object **)&s->cfg.rpu[i],
                                  qdev_prop_allow_set_link_before_realize,
                                  OBJ_PROP_LINK_STRONG);
     }
@@ -371,10 +380,12 @@ static void versal_crl_init(Object *obj)
                                  OBJ_PROP_LINK_STRONG);
     }
 
-    object_property_add_link(obj, "usb", TYPE_DEVICE,
-                             (Object **)&s->cfg.gem[i],
-                             qdev_prop_allow_set_link_before_realize,
-                             OBJ_PROP_LINK_STRONG);
+    for (i = 0; i < ARRAY_SIZE(s->cfg.usb); ++i) {
+        object_property_add_link(obj, "usb[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.usb[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
 }
 
 static void crl_finalize(Object *obj)
@@ -396,11 +407,13 @@ static const VMStateDescription vmstate_versal_crl = {
 static void versal_crl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
+    XlnxVersalCRLBaseClass *xvcc = XLNX_VERSAL_CRL_BASE_CLASS(klass);
     ResettableClass *rc = RESETTABLE_CLASS(klass);
 
     dc->vmsd = &vmstate_versal_crl;
     rc->phases.enter = versal_crl_reset_enter;
     rc->phases.hold = versal_crl_reset_hold;
+    xvcc->decode_periph_rst = versal_decode_periph_rst;
 }
 
 static const TypeInfo crl_base_info = {
diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
index 2b39d203a6..7e50a95ad3 100644
--- a/include/hw/misc/xlnx-versal-crl.h
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -220,8 +220,6 @@ REG32(PSM_RST_MODE, 0x370)
 
 #define CRL_R_MAX (R_PSM_RST_MODE + 1)
 
-#define RPU_MAX_CPU 2
-
 struct XlnxVersalCRLBase {
     SysBusDevice parent_obj;
 
@@ -231,6 +229,8 @@ struct XlnxVersalCRLBase {
 
 struct XlnxVersalCRLBaseClass {
     SysBusDeviceClass parent_class;
+
+    DeviceState ** (*decode_periph_rst)(XlnxVersalCRLBase *s, hwaddr, size_t *);
 };
 
 struct XlnxVersalCRL {
@@ -238,11 +238,11 @@ struct XlnxVersalCRL {
     qemu_irq irq;
 
     struct {
-        ARMCPU *cpu_r5[RPU_MAX_CPU];
+        DeviceState *rpu[2];
         DeviceState *adma[8];
         DeviceState *uart[2];
         DeviceState *gem[2];
-        DeviceState *usb;
+        DeviceState *usb[1];
     } cfg;
 
     uint32_t regs[CRL_R_MAX];

From 9401022bcddf3de377c5d64a68dad59b493a1315 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:51 +0200
Subject: [PATCH 1108/2396] hw/arm/xlnx-versal: reconnect the CRL to the other
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CRL connects to various devices through link properties to be able
to reset them. The connections were dropped during the SoC refactoring.
Reintroduce them now.

Rely on the QOM tree to retrieve the devices to connect. The component
parts of the device names are chosen to match the properties on the CRL.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-34-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 31 ++++++++++++++++++++++++++++++-
 1 file changed, 30 insertions(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 2e28b807d7..6604e24a9c 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -1476,17 +1476,46 @@ static void versal_create_cfu(Versal *s, const struct VersalCfuMap *map)
                                 sysbus_mmio_get_region(sbd, 0));
 }
 
+static inline void crl_connect_dev(Object *crl, Object *dev)
+{
+    const char *prop = object_get_canonical_path_component(dev);
+
+    /* The component part of the device path matches the CRL property name */
+    object_property_set_link(crl, prop, dev, &error_abort);
+}
+
+static inline void crl_connect_dev_by_name(Versal *s, Object *crl,
+                                           const char *name, size_t num)
+{
+    size_t i;
+
+    for (i = 0; i < num; i++) {
+        Object *dev = versal_get_child_idx(s, name, i);
+
+        crl_connect_dev(crl, dev);
+    }
+}
+
 static inline void versal_create_crl(Versal *s)
 {
     const VersalMap *map;
     const char *crl_class;
     DeviceState *dev;
+    Object *obj;
 
     map = versal_get_map(s);
 
     crl_class = TYPE_XLNX_VERSAL_CRL;
     dev = qdev_new(crl_class);
-    object_property_add_child(OBJECT(s), "crl", OBJECT(dev));
+    obj = OBJECT(dev);
+    object_property_add_child(OBJECT(s), "crl", obj);
+
+    crl_connect_dev_by_name(s, obj, "rpu-cluster/rpu",
+                            map->rpu.num_cluster * map->rpu.num_core);
+    crl_connect_dev_by_name(s, obj, map->zdma[0].name, map->zdma[0].num_chan);
+    crl_connect_dev_by_name(s, obj, "uart", map->num_uart);
+    crl_connect_dev_by_name(s, obj, "gem", map->num_gem);
+    crl_connect_dev_by_name(s, obj, "usb", map->num_usb);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_abort);
 

From 48111f7e7266cc94816507bf8c82d8986edfec9c Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:52 +0200
Subject: [PATCH 1109/2396] hw/arm/xlnx-versal: use hw/arm/bsa.h for timer IRQ
 indices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the bsa.h header for ARM timer and maintainance IRQ indices instead
of redefining our owns.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-35-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 28 +++++++++++++++++-----------
 include/hw/arm/xlnx-versal.h |  6 ------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 6604e24a9c..dc38830018 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -49,6 +49,7 @@
 #include "hw/core/split-irq.h"
 #include "target/arm/cpu.h"
 #include "hw/cpu/cluster.h"
+#include "hw/arm/bsa.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
@@ -673,7 +674,8 @@ static DeviceState *versal_create_gic(Versal *s,
         qemu_fdt_setprop_cell(s->cfg.fdt, node, "phandle", s->phandle.gic);
         qemu_fdt_setprop_cell(s->cfg.fdt, node, "#interrupt-cells", 3);
         qemu_fdt_setprop_cells(s->cfg.fdt, node, "interrupts",
-                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_GIC_MAINT_IRQ,
+                               GIC_FDT_IRQ_TYPE_PPI,
+                               INTID_TO_PPI(ARCH_GIC_MAINT_IRQ),
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI);
         qemu_fdt_setprop(s->cfg.fdt, node, "interrupt-controller", NULL, 0);
     }
@@ -698,10 +700,10 @@ static void connect_gic_to_cpu(const VersalCpuClusterMap *map,
      * GIC PPI inputs.
      */
     const int timer_irq[] = {
-        [GTIMER_PHYS] = VERSAL_TIMER_NS_EL1_IRQ,
-        [GTIMER_VIRT] = VERSAL_TIMER_VIRT_IRQ,
-        [GTIMER_HYP]  = VERSAL_TIMER_NS_EL2_IRQ,
-        [GTIMER_SEC]  = VERSAL_TIMER_S_EL1_IRQ,
+        [GTIMER_PHYS] = INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ),
+        [GTIMER_VIRT] = INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ),
+        [GTIMER_HYP]  = INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ),
+        [GTIMER_SEC]  = INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ),
     };
 
     has_gtimer = arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_GENERIC_TIMER);
@@ -716,9 +718,9 @@ static void connect_gic_to_cpu(const VersalCpuClusterMap *map,
 
     if (map->gic.version == 3) {
         qemu_irq maint_irq;
+        int maint_idx = ppibase + INTID_TO_PPI(ARCH_GIC_MAINT_IRQ);
 
-        maint_irq = qdev_get_gpio_in(gic,
-                                     ppibase + VERSAL_GIC_MAINT_IRQ);
+        maint_irq = qdev_get_gpio_in(gic, maint_idx);
         qdev_connect_gpio_out_named(cpu, "gicv3-maintenance-interrupt",
                                     0, maint_irq);
     }
@@ -842,13 +844,17 @@ static void versal_create_cpu_cluster(Versal *s, const VersalCpuClusterMap *map)
     if (map->dtb_expose && has_gtimer) {
         qemu_fdt_add_subnode(s->cfg.fdt, "/timer");
         qemu_fdt_setprop_cells(s->cfg.fdt, "/timer", "interrupts",
-                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_S_EL1_IRQ,
+                               GIC_FDT_IRQ_TYPE_PPI,
+                               INTID_TO_PPI(ARCH_TIMER_S_EL1_IRQ),
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL1_IRQ,
+                               GIC_FDT_IRQ_TYPE_PPI,
+                               INTID_TO_PPI(ARCH_TIMER_NS_EL1_IRQ),
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_VIRT_IRQ,
+                               GIC_FDT_IRQ_TYPE_PPI,
+                               INTID_TO_PPI(ARCH_TIMER_VIRT_IRQ),
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI,
-                               GIC_FDT_IRQ_TYPE_PPI, VERSAL_TIMER_NS_EL2_IRQ,
+                               GIC_FDT_IRQ_TYPE_PPI,
+                               INTID_TO_PPI(ARCH_TIMER_NS_EL2_IRQ),
                                GIC_FDT_IRQ_FLAGS_LEVEL_HI);
         qemu_fdt_setprop(s->cfg.fdt, "/timer", "compatible",
                          compatible, sizeof(compatible));
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index 7bdf6dab62..da0260b83d 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -87,12 +87,6 @@ int versal_get_num_sdhci(VersalVersion version);
 /* Memory-map and IRQ definitions. Copied a subset from
  * auto-generated files.  */
 
-#define VERSAL_GIC_MAINT_IRQ        9
-#define VERSAL_TIMER_VIRT_IRQ       11
-#define VERSAL_TIMER_S_EL1_IRQ      13
-#define VERSAL_TIMER_NS_EL1_IRQ     14
-#define VERSAL_TIMER_NS_EL2_IRQ     10
-
 #define VERSAL_CRL_IRQ             10
 #define VERSAL_UART0_IRQ_0         18
 #define VERSAL_UART1_IRQ_0         19

From 4707024bc3362f4b9859214357a687b9154c84cf Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:53 +0200
Subject: [PATCH 1110/2396] hw/arm/xlnx-versal: tidy up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove now unused macros in xlnx-versal.[ch]. Those macros have been
replaced by the VersalMap structure that serves as a central description
for the SoC. The ones still in use in the versal_unimp function are
inlined.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-36-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         |  28 ++---
 include/hw/arm/xlnx-versal.h | 204 -----------------------------------
 2 files changed, 7 insertions(+), 225 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index dc38830018..49b5b24440 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -18,7 +18,6 @@
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "system/system.h"
-#include "hw/arm/boot.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/xlnx-versal.h"
 #include "qemu/log.h"
@@ -51,13 +50,6 @@
 #include "hw/cpu/cluster.h"
 #include "hw/arm/bsa.h"
 
-#define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
-#define XLNX_VERSAL_RCPU_TYPE ARM_CPU_TYPE_NAME("cortex-r5f")
-#define GEM_REVISION        0x40070106
-
-#define VERSAL_NUM_PMC_APB_IRQS 18
-#define NUM_OSPI_IRQ_LINES 3
-
 /*
  * IRQ descriptor to catch the following cases:
  *   - Multiple devices can connect to the same IRQ. They are OR'ed together.
@@ -1364,7 +1356,7 @@ static DeviceState *versal_create_ospi(Versal *s,
                                 linear_mr);
 
     /* OSPI irq */
-    orgate = create_or_gate(s, OBJECT(dev), "irq-orgate", NUM_OSPI_IRQ_LINES,
+    orgate = create_or_gate(s, OBJECT(dev), "irq-orgate", 3,
                             map->irq);
 
     sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, qdev_get_gpio_in(orgate, 0));
@@ -1625,18 +1617,12 @@ static void versal_unimp(Versal *s)
     DeviceState *slcr;
     qemu_irq gpio_in;
 
-    versal_unimp_area(s, "psm", &s->mr_ps,
-                        MM_PSM_START, MM_PSM_END - MM_PSM_START);
-    versal_unimp_area(s, "crf", &s->mr_ps,
-                        MM_FPD_CRF, MM_FPD_CRF_SIZE);
-    versal_unimp_area(s, "apu", &s->mr_ps,
-                        MM_FPD_FPD_APU, MM_FPD_FPD_APU_SIZE);
-    versal_unimp_area(s, "crp", &s->mr_ps,
-                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
-    versal_unimp_area(s, "iou-scntr", &s->mr_ps,
-                        MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
-    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-                        MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
+    versal_unimp_area(s, "psm", &s->mr_ps, 0xffc80000, 0x70000);
+    versal_unimp_area(s, "crf", &s->mr_ps, 0xfd1a0000, 0x140000);
+    versal_unimp_area(s, "apu", &s->mr_ps, 0xfd5c0000, 0x100);
+    versal_unimp_area(s, "crp", &s->mr_ps, 0xf1260000, 0x10000);
+    versal_unimp_area(s, "iou-scntr", &s->mr_ps, 0xff130000, 0x10000);
+    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps, 0xff140000, 0x10000);
 
     qdev_init_gpio_in_named(DEVICE(s), versal_unimp_sd_emmc_sel,
                             "sd-emmc-sel-dummy", 2);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index da0260b83d..b6cc71f720 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -23,18 +23,6 @@ OBJECT_DECLARE_TYPE(Versal, VersalClass, XLNX_VERSAL_BASE)
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 
-#define XLNX_VERSAL_NR_ACPUS   2
-#define XLNX_VERSAL_NR_RCPUS   2
-#define XLNX_VERSAL_NR_UARTS   2
-#define XLNX_VERSAL_NR_GEMS    2
-#define XLNX_VERSAL_NR_ADMAS   8
-#define XLNX_VERSAL_NR_SDS     2
-#define XLNX_VERSAL_NR_XRAM    4
-#define XLNX_VERSAL_NR_IRQS    192
-#define XLNX_VERSAL_NR_CANFD   2
-#define XLNX_VERSAL_CANFD_REF_CLK (24 * 1000 * 1000)
-#define XLNX_VERSAL_NR_CFRAME  15
-
 struct Versal {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -84,196 +72,4 @@ int versal_get_num_cpu(VersalVersion version);
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);
 
-/* Memory-map and IRQ definitions. Copied a subset from
- * auto-generated files.  */
-
-#define VERSAL_CRL_IRQ             10
-#define VERSAL_UART0_IRQ_0         18
-#define VERSAL_UART1_IRQ_0         19
-#define VERSAL_CANFD0_IRQ_0        20
-#define VERSAL_CANFD1_IRQ_0        21
-#define VERSAL_USB0_IRQ_0          22
-#define VERSAL_GEM0_IRQ_0          56
-#define VERSAL_GEM0_WAKE_IRQ_0     57
-#define VERSAL_GEM1_IRQ_0          58
-#define VERSAL_GEM1_WAKE_IRQ_0     59
-#define VERSAL_ADMA_IRQ_0          60
-#define VERSAL_XRAM_IRQ_0          79
-#define VERSAL_CFU_IRQ_0           120
-#define VERSAL_PMC_APB_IRQ         121
-#define VERSAL_OSPI_IRQ            124
-#define VERSAL_SD0_IRQ_0           126
-#define VERSAL_EFUSE_IRQ           139
-#define VERSAL_TRNG_IRQ            141
-#define VERSAL_RTC_ALARM_IRQ       142
-#define VERSAL_RTC_SECONDS_IRQ     143
-
-/* Architecturally reserved IRQs suitable for virtualization.  */
-#define VERSAL_RSVD_IRQ_FIRST 111
-#define VERSAL_RSVD_IRQ_LAST  118
-
-#define MM_TOP_RSVD                 0xa0000000U
-#define MM_TOP_RSVD_SIZE            0x4000000
-#define MM_GIC_APU_DIST_MAIN        0xf9000000U
-#define MM_GIC_APU_DIST_MAIN_SIZE   0x10000
-#define MM_GIC_APU_REDIST_0         0xf9080000U
-#define MM_GIC_APU_REDIST_0_SIZE    0x80000
-
-#define MM_UART0                    0xff000000U
-#define MM_UART0_SIZE               0x10000
-#define MM_UART1                    0xff010000U
-#define MM_UART1_SIZE               0x10000
-
-#define MM_CANFD0                   0xff060000U
-#define MM_CANFD0_SIZE              0x10000
-#define MM_CANFD1                   0xff070000U
-#define MM_CANFD1_SIZE              0x10000
-
-#define MM_GEM0                     0xff0c0000U
-#define MM_GEM0_SIZE                0x10000
-#define MM_GEM1                     0xff0d0000U
-#define MM_GEM1_SIZE                0x10000
-
-#define MM_ADMA_CH0                 0xffa80000U
-#define MM_ADMA_CH0_SIZE            0x10000
-
-#define MM_OCM                      0xfffc0000U
-#define MM_OCM_SIZE                 0x40000
-
-#define MM_XRAM                     0xfe800000
-#define MM_XRAMC                    0xff8e0000
-#define MM_XRAMC_SIZE               0x10000
-
-#define MM_USB2_CTRL_REGS           0xFF9D0000
-#define MM_USB2_CTRL_REGS_SIZE      0x10000
-
-#define MM_USB_0                    0xFE200000
-#define MM_USB_0_SIZE               0x10000
-
-#define MM_TOP_DDR                  0x0
-#define MM_TOP_DDR_SIZE             0x80000000U
-#define MM_TOP_DDR_2                0x800000000ULL
-#define MM_TOP_DDR_2_SIZE           0x800000000ULL
-#define MM_TOP_DDR_3                0xc000000000ULL
-#define MM_TOP_DDR_3_SIZE           0x4000000000ULL
-#define MM_TOP_DDR_4                0x10000000000ULL
-#define MM_TOP_DDR_4_SIZE           0xb780000000ULL
-
-#define MM_PSM_START                0xffc80000U
-#define MM_PSM_END                  0xffcf0000U
-
-#define MM_CRL                      0xff5e0000U
-#define MM_CRL_SIZE                 0x300000
-#define MM_IOU_SCNTR                0xff130000U
-#define MM_IOU_SCNTR_SIZE           0x10000
-#define MM_IOU_SCNTRS               0xff140000U
-#define MM_IOU_SCNTRS_SIZE          0x10000
-#define MM_FPD_CRF                  0xfd1a0000U
-#define MM_FPD_CRF_SIZE             0x140000
-#define MM_FPD_FPD_APU              0xfd5c0000
-#define MM_FPD_FPD_APU_SIZE         0x100
-
-#define MM_PMC_PMC_IOU_SLCR         0xf1060000
-#define MM_PMC_PMC_IOU_SLCR_SIZE    0x10000
-
-#define MM_PMC_OSPI                 0xf1010000
-#define MM_PMC_OSPI_SIZE            0x10000
-
-#define MM_PMC_OSPI_DAC             0xc0000000
-#define MM_PMC_OSPI_DAC_SIZE        0x20000000
-
-#define MM_PMC_OSPI_DMA_DST         0xf1011800
-#define MM_PMC_OSPI_DMA_SRC         0xf1011000
-
-#define MM_PMC_SD0                  0xf1040000U
-#define MM_PMC_SD0_SIZE             0x10000
-#define MM_PMC_BBRAM_CTRL           0xf11f0000
-#define MM_PMC_BBRAM_CTRL_SIZE      0x00050
-#define MM_PMC_EFUSE_CTRL           0xf1240000
-#define MM_PMC_EFUSE_CTRL_SIZE      0x00104
-#define MM_PMC_EFUSE_CACHE          0xf1250000
-#define MM_PMC_EFUSE_CACHE_SIZE     0x00C00
-
-#define MM_PMC_CFU_APB              0xf12b0000
-#define MM_PMC_CFU_APB_SIZE         0x10000
-#define MM_PMC_CFU_STREAM           0xf12c0000
-#define MM_PMC_CFU_STREAM_SIZE      0x1000
-#define MM_PMC_CFU_SFR              0xf12c1000
-#define MM_PMC_CFU_SFR_SIZE         0x1000
-#define MM_PMC_CFU_FDRO             0xf12c2000
-#define MM_PMC_CFU_FDRO_SIZE        0x1000
-#define MM_PMC_CFU_STREAM_2         0xf1f80000
-#define MM_PMC_CFU_STREAM_2_SIZE    0x40000
-
-#define MM_PMC_CFRAME0_REG          0xf12d0000
-#define MM_PMC_CFRAME0_REG_SIZE     0x1000
-#define MM_PMC_CFRAME0_FDRI         0xf12d1000
-#define MM_PMC_CFRAME0_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME1_REG          0xf12d2000
-#define MM_PMC_CFRAME1_REG_SIZE     0x1000
-#define MM_PMC_CFRAME1_FDRI         0xf12d3000
-#define MM_PMC_CFRAME1_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME2_REG          0xf12d4000
-#define MM_PMC_CFRAME2_REG_SIZE     0x1000
-#define MM_PMC_CFRAME2_FDRI         0xf12d5000
-#define MM_PMC_CFRAME2_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME3_REG          0xf12d6000
-#define MM_PMC_CFRAME3_REG_SIZE     0x1000
-#define MM_PMC_CFRAME3_FDRI         0xf12d7000
-#define MM_PMC_CFRAME3_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME4_REG          0xf12d8000
-#define MM_PMC_CFRAME4_REG_SIZE     0x1000
-#define MM_PMC_CFRAME4_FDRI         0xf12d9000
-#define MM_PMC_CFRAME4_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME5_REG          0xf12da000
-#define MM_PMC_CFRAME5_REG_SIZE     0x1000
-#define MM_PMC_CFRAME5_FDRI         0xf12db000
-#define MM_PMC_CFRAME5_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME6_REG          0xf12dc000
-#define MM_PMC_CFRAME6_REG_SIZE     0x1000
-#define MM_PMC_CFRAME6_FDRI         0xf12dd000
-#define MM_PMC_CFRAME6_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME7_REG          0xf12de000
-#define MM_PMC_CFRAME7_REG_SIZE     0x1000
-#define MM_PMC_CFRAME7_FDRI         0xf12df000
-#define MM_PMC_CFRAME7_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME8_REG          0xf12e0000
-#define MM_PMC_CFRAME8_REG_SIZE     0x1000
-#define MM_PMC_CFRAME8_FDRI         0xf12e1000
-#define MM_PMC_CFRAME8_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME9_REG          0xf12e2000
-#define MM_PMC_CFRAME9_REG_SIZE     0x1000
-#define MM_PMC_CFRAME9_FDRI         0xf12e3000
-#define MM_PMC_CFRAME9_FDRI_SIZE    0x1000
-#define MM_PMC_CFRAME10_REG         0xf12e4000
-#define MM_PMC_CFRAME10_REG_SIZE    0x1000
-#define MM_PMC_CFRAME10_FDRI        0xf12e5000
-#define MM_PMC_CFRAME10_FDRI_SIZE   0x1000
-#define MM_PMC_CFRAME11_REG         0xf12e6000
-#define MM_PMC_CFRAME11_REG_SIZE    0x1000
-#define MM_PMC_CFRAME11_FDRI        0xf12e7000
-#define MM_PMC_CFRAME11_FDRI_SIZE   0x1000
-#define MM_PMC_CFRAME12_REG         0xf12e8000
-#define MM_PMC_CFRAME12_REG_SIZE    0x1000
-#define MM_PMC_CFRAME12_FDRI        0xf12e9000
-#define MM_PMC_CFRAME12_FDRI_SIZE   0x1000
-#define MM_PMC_CFRAME13_REG         0xf12ea000
-#define MM_PMC_CFRAME13_REG_SIZE    0x1000
-#define MM_PMC_CFRAME13_FDRI        0xf12eb000
-#define MM_PMC_CFRAME13_FDRI_SIZE   0x1000
-#define MM_PMC_CFRAME14_REG         0xf12ec000
-#define MM_PMC_CFRAME14_REG_SIZE    0x1000
-#define MM_PMC_CFRAME14_FDRI        0xf12ed000
-#define MM_PMC_CFRAME14_FDRI_SIZE   0x1000
-#define MM_PMC_CFRAME_BCAST_REG       0xf12ee000
-#define MM_PMC_CFRAME_BCAST_REG_SIZE  0x1000
-#define MM_PMC_CFRAME_BCAST_FDRI      0xf12ef000
-#define MM_PMC_CFRAME_BCAST_FDRI_SIZE 0x1000
-
-#define MM_PMC_CRP                  0xf1260000U
-#define MM_PMC_CRP_SIZE             0x10000
-#define MM_PMC_RTC                  0xf12a0000
-#define MM_PMC_RTC_SIZE             0x10000
-#define MM_PMC_TRNG                 0xf1230000
-#define MM_PMC_TRNG_SIZE            0x10000
 #endif

From 00580a9d715138ec1560b91c596dedee07286fee Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:54 +0200
Subject: [PATCH 1111/2396] hw/misc/xlnx-versal-crl: add the versal2 version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the versal2 version of the CRL device. For the implemented part, it
is similar to the versal version but drives reset line of more devices.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-37-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/xlnx-versal-crl.c            | 392 +++++++++++++++++++++++++++
 include/hw/arm/xlnx-versal-version.h |   1 +
 include/hw/misc/xlnx-versal-crl.h    | 329 ++++++++++++++++++++++
 3 files changed, 722 insertions(+)

diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index 6225a92e0b..10e6af002b 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -83,6 +83,51 @@ static DeviceState **versal_decode_periph_rst(XlnxVersalCRLBase *s,
     case A_RST_USB0:
         return xvc->cfg.usb;
 
+    default:
+        /* invalid or unimplemented */
+        g_assert_not_reached();
+    }
+}
+
+static DeviceState **versal2_decode_periph_rst(XlnxVersalCRLBase *s,
+                                               hwaddr addr, size_t *count)
+{
+    size_t idx;
+    XlnxVersal2CRL *xvc = XLNX_VERSAL2_CRL(s);
+
+    *count = 1;
+
+    switch (addr) {
+    case A_VERSAL2_RST_RPU_A ... A_VERSAL2_RST_RPU_E:
+        idx = (addr - A_VERSAL2_RST_RPU_A) / sizeof(uint32_t);
+        idx *= 2; /* two RPUs per RST_RPU_x registers */
+        return xvc->cfg.rpu + idx;
+
+    case A_VERSAL2_RST_ADMA:
+        /* A single register fans out to all DMA reset inputs */
+        *count = ARRAY_SIZE(xvc->cfg.adma);
+        return xvc->cfg.adma;
+
+    case A_VERSAL2_RST_SDMA:
+        *count = ARRAY_SIZE(xvc->cfg.sdma);
+        return xvc->cfg.sdma;
+
+    case A_VERSAL2_RST_UART0 ... A_VERSAL2_RST_UART1:
+        idx = (addr - A_VERSAL2_RST_UART0) / sizeof(uint32_t);
+        return xvc->cfg.uart + idx;
+
+    case A_VERSAL2_RST_GEM0 ... A_VERSAL2_RST_GEM1:
+        idx = (addr - A_VERSAL2_RST_GEM0) / sizeof(uint32_t);
+        return xvc->cfg.gem + idx;
+
+    case A_VERSAL2_RST_USB0 ... A_VERSAL2_RST_USB1:
+        idx = (addr - A_VERSAL2_RST_USB0) / sizeof(uint32_t);
+        return xvc->cfg.usb + idx;
+
+    case A_VERSAL2_RST_CAN0 ... A_VERSAL2_RST_CAN3:
+        idx = (addr - A_VERSAL2_RST_CAN0) / sizeof(uint32_t);
+        return xvc->cfg.can + idx;
+
     default:
         /* invalid or unimplemented */
         return NULL;
@@ -307,6 +352,246 @@ static const RegisterAccessInfo crl_regs_info[] = {
     }
 };
 
+static const RegisterAccessInfo versal2_crl_regs_info[] = {
+    {   .name = "ERR_CTRL",  .addr = A_VERSAL2_ERR_CTRL,
+        .reset = 0x1,
+    },{ .name = "WPROT",  .addr = A_VERSAL2_WPROT,
+    },{ .name = "RPLL_CTRL",  .addr = A_VERSAL2_RPLL_CTRL,
+        .reset = 0x24809,
+        .rsvd = 0xf88c00f6,
+    },{ .name = "RPLL_CFG",  .addr = A_VERSAL2_RPLL_CFG,
+        .reset = 0x7e5dcc6c,
+        .rsvd = 0x1801210,
+    },{ .name = "FLXPLL_CTRL",  .addr = A_VERSAL2_FLXPLL_CTRL,
+        .reset = 0x24809,
+        .rsvd = 0xf88c00f6,
+    },{ .name = "FLXPLL_CFG",  .addr = A_VERSAL2_FLXPLL_CFG,
+        .reset = 0x7e5dcc6c,
+        .rsvd = 0x1801210,
+    },{ .name = "PLL_STATUS",  .addr = A_VERSAL2_PLL_STATUS,
+        .reset = 0xf,
+        .rsvd = 0xf0,
+        .ro = 0xf,
+    },{ .name = "RPLL_TO_XPD_CTRL",  .addr = A_VERSAL2_RPLL_TO_XPD_CTRL,
+        .reset = 0x2000100,
+        .rsvd = 0xfdfc00ff,
+    },{ .name = "LPX_TOP_SWITCH_CTRL",  .addr = A_VERSAL2_LPX_TOP_SWITCH_CTRL,
+        .reset = 0xe000300,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "LPX_LSBUS_CLK_CTRL",  .addr = A_VERSAL2_LPX_LSBUS_CLK_CTRL,
+        .reset = 0x2000800,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "RPU_CLK_CTRL",  .addr = A_VERSAL2_RPU_CLK_CTRL,
+        .reset = 0x3f00300,
+        .rsvd = 0xfc0c00f8,
+    },{ .name = "OCM_CLK_CTRL",  .addr = A_VERSAL2_OCM_CLK_CTRL,
+        .reset = 0x1e00000,
+        .rsvd = 0xfe1fffff,
+    },{ .name = "IOU_SWITCH_CLK_CTRL",  .addr = A_VERSAL2_IOU_SWITCH_CLK_CTRL,
+        .reset = 0x2000500,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "GEM0_REF_CTRL",  .addr = A_VERSAL2_GEM0_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM1_REF_CTRL",  .addr = A_VERSAL2_GEM1_REF_CTRL,
+        .reset = 0xe000a00,
+        .rsvd = 0xf1fc00f8,
+    },{ .name = "GEM_TSU_REF_CLK_CTRL",  .addr = A_VERSAL2_GEM_TSU_REF_CLK_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB0_BUS_REF_CLK_CTRL",
+        .addr = A_VERSAL2_USB0_BUS_REF_CLK_CTRL,
+        .reset = 0x2001900,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "USB1_BUS_REF_CLK_CTRL",
+        .addr = A_VERSAL2_USB1_BUS_REF_CLK_CTRL,
+        .reset = 0x2001900,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART0_REF_CLK_CTRL",  .addr = A_VERSAL2_UART0_REF_CLK_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "UART1_REF_CLK_CTRL",  .addr = A_VERSAL2_UART1_REF_CLK_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI0_REF_CLK_CTRL",  .addr = A_VERSAL2_SPI0_REF_CLK_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SPI1_REF_CLK_CTRL",  .addr = A_VERSAL2_SPI1_REF_CLK_CTRL,
+        .reset = 0x600,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN0_REF_2X_CTRL",  .addr = A_VERSAL2_CAN0_REF_2X_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN1_REF_2X_CTRL",  .addr = A_VERSAL2_CAN1_REF_2X_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN2_REF_2X_CTRL",  .addr = A_VERSAL2_CAN2_REF_2X_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "CAN3_REF_2X_CTRL",  .addr = A_VERSAL2_CAN3_REF_2X_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C0_REF_CTRL",  .addr = A_VERSAL2_I3C0_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C1_REF_CTRL",  .addr = A_VERSAL2_I3C1_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C2_REF_CTRL",  .addr = A_VERSAL2_I3C2_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C3_REF_CTRL",  .addr = A_VERSAL2_I3C3_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C4_REF_CTRL",  .addr = A_VERSAL2_I3C4_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C5_REF_CTRL",  .addr = A_VERSAL2_I3C5_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C6_REF_CTRL",  .addr = A_VERSAL2_I3C6_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "I3C7_REF_CTRL",  .addr = A_VERSAL2_I3C7_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "DBG_LPX_CTRL",  .addr = A_VERSAL2_DBG_LPX_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "TIMESTAMP_REF_CTRL",  .addr = A_VERSAL2_TIMESTAMP_REF_CTRL,
+        .reset = 0x2000c00,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "SAFETY_CHK",  .addr = A_VERSAL2_SAFETY_CHK,
+    },{ .name = "ASU_CLK_CTRL",  .addr = A_VERSAL2_ASU_CLK_CTRL,
+        .reset = 0x2000f04,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "DBG_TSTMP_CLK_CTRL",  .addr = A_VERSAL2_DBG_TSTMP_CLK_CTRL,
+        .reset = 0x300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "MMI_TOPSW_CLK_CTRL",  .addr = A_VERSAL2_MMI_TOPSW_CLK_CTRL,
+        .reset = 0x2000300,
+        .rsvd = 0xfdfc00f8,
+    },{ .name = "WWDT_PLL_CLK_CTRL",  .addr = A_VERSAL2_WWDT_PLL_CLK_CTRL,
+        .reset = 0xc00,
+        .rsvd = 0xfffc00f8,
+    },{ .name = "RCLK_CTRL",  .addr = A_VERSAL2_RCLK_CTRL,
+        .rsvd = 0xc040,
+    },{ .name = "RST_RPU_A",  .addr = A_VERSAL2_RST_RPU_A,
+        .reset = 0x10303,
+        .rsvd = 0xfffefcfc,
+        .pre_write = crl_rst_cpu_prew,
+    },{ .name = "RST_RPU_B",  .addr = A_VERSAL2_RST_RPU_B,
+        .reset = 0x10303,
+        .rsvd = 0xfffefcfc,
+        .pre_write = crl_rst_cpu_prew,
+    },{ .name = "RST_RPU_C",  .addr = A_VERSAL2_RST_RPU_C,
+        .reset = 0x10303,
+        .rsvd = 0xfffefcfc,
+        .pre_write = crl_rst_cpu_prew,
+    },{ .name = "RST_RPU_D",  .addr = A_VERSAL2_RST_RPU_D,
+        .reset = 0x10303,
+        .rsvd = 0xfffefcfc,
+        .pre_write = crl_rst_cpu_prew,
+    },{ .name = "RST_RPU_E",  .addr = A_VERSAL2_RST_RPU_E,
+        .reset = 0x10303,
+        .rsvd = 0xfffefcfc,
+        .pre_write = crl_rst_cpu_prew,
+    },{ .name = "RST_RPU_GD_0",  .addr = A_VERSAL2_RST_RPU_GD_0,
+        .reset = 0x3,
+    },{ .name = "RST_RPU_GD_1",  .addr = A_VERSAL2_RST_RPU_GD_1,
+        .reset = 0x3,
+    },{ .name = "RST_ASU_GD",  .addr = A_VERSAL2_RST_ASU_GD,
+        .reset = 0x3,
+    },{ .name = "RST_ADMA",  .addr = A_VERSAL2_RST_ADMA,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_SDMA",  .addr = A_VERSAL2_RST_SDMA,
+        .pre_write = crl_rst_dev_prew,
+        .reset = 0x1,
+    },{ .name = "RST_GEM0",  .addr = A_VERSAL2_RST_GEM0,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_GEM1",  .addr = A_VERSAL2_RST_GEM1,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_USB0",  .addr = A_VERSAL2_RST_USB0,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_USB1",  .addr = A_VERSAL2_RST_USB1,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_UART0",  .addr = A_VERSAL2_RST_UART0,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_UART1",  .addr = A_VERSAL2_RST_UART1,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_SPI0",  .addr = A_VERSAL2_RST_SPI0,
+        .reset = 0x1,
+    },{ .name = "RST_SPI1",  .addr = A_VERSAL2_RST_SPI1,
+        .reset = 0x1,
+    },{ .name = "RST_CAN0",  .addr = A_VERSAL2_RST_CAN0,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_CAN1",  .addr = A_VERSAL2_RST_CAN1,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_CAN2",  .addr = A_VERSAL2_RST_CAN2,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_CAN3",  .addr = A_VERSAL2_RST_CAN3,
+        .reset = 0x1,
+        .pre_write = crl_rst_dev_prew,
+    },{ .name = "RST_I3C0",  .addr = A_VERSAL2_RST_I3C0,
+        .reset = 0x1,
+    },{ .name = "RST_I3C1",  .addr = A_VERSAL2_RST_I3C1,
+        .reset = 0x1,
+    },{ .name = "RST_I3C2",  .addr = A_VERSAL2_RST_I3C2,
+        .reset = 0x1,
+    },{ .name = "RST_I3C3",  .addr = A_VERSAL2_RST_I3C3,
+        .reset = 0x1,
+    },{ .name = "RST_I3C4",  .addr = A_VERSAL2_RST_I3C4,
+        .reset = 0x1,
+    },{ .name = "RST_I3C5",  .addr = A_VERSAL2_RST_I3C5,
+        .reset = 0x1,
+    },{ .name = "RST_I3C6",  .addr = A_VERSAL2_RST_I3C6,
+        .reset = 0x1,
+    },{ .name = "RST_I3C7",  .addr = A_VERSAL2_RST_I3C7,
+        .reset = 0x1,
+    },{ .name = "RST_DBG_LPX",  .addr = A_VERSAL2_RST_DBG_LPX,
+        .reset = 0x3,
+        .rsvd = 0xfc,
+    },{ .name = "RST_GPIO",  .addr = A_VERSAL2_RST_GPIO,
+        .reset = 0x1,
+    },{ .name = "RST_TTC",  .addr = A_VERSAL2_RST_TTC,
+        .reset = 0xff,
+    },{ .name = "RST_TIMESTAMP",  .addr = A_VERSAL2_RST_TIMESTAMP,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT0",  .addr = A_VERSAL2_RST_SWDT0,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT1",  .addr = A_VERSAL2_RST_SWDT1,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT2",  .addr = A_VERSAL2_RST_SWDT2,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT3",  .addr = A_VERSAL2_RST_SWDT3,
+        .reset = 0x1,
+    },{ .name = "RST_SWDT4",  .addr = A_VERSAL2_RST_SWDT4,
+        .reset = 0x1,
+    },{ .name = "RST_IPI",  .addr = A_VERSAL2_RST_IPI,
+    },{ .name = "RST_SYSMON",  .addr = A_VERSAL2_RST_SYSMON,
+    },{ .name = "ASU_MB_RST_MODE",  .addr = A_VERSAL2_ASU_MB_RST_MODE,
+        .reset = 0x1,
+        .rsvd = 0xf8,
+    },{ .name = "FPX_TOPSW_MUX_CTRL",  .addr = A_VERSAL2_FPX_TOPSW_MUX_CTRL,
+        .reset = 0x1,
+    },{ .name = "RST_FPX",  .addr = A_VERSAL2_RST_FPX,
+        .reset = 0x3,
+    },{ .name = "RST_MMI",  .addr = A_VERSAL2_RST_MMI,
+        .reset = 0x1,
+    },{ .name = "RST_OCM",  .addr = A_VERSAL2_RST_OCM,
+    }
+};
+
 static void versal_crl_reset_enter(Object *obj, ResetType type)
 {
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
@@ -317,6 +602,16 @@ static void versal_crl_reset_enter(Object *obj, ResetType type)
     }
 }
 
+static void versal2_crl_reset_enter(Object *obj, ResetType type)
+{
+    XlnxVersal2CRL *s = XLNX_VERSAL2_CRL(obj);
+    size_t i;
+
+    for (i = 0; i < VERSAL2_CRL_R_MAX; ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
 static void versal_crl_reset_hold(Object *obj, ResetType type)
 {
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
@@ -388,6 +683,73 @@ static void versal_crl_init(Object *obj)
     }
 }
 
+static void versal2_crl_init(Object *obj)
+{
+    XlnxVersal2CRL *s = XLNX_VERSAL2_CRL(obj);
+    XlnxVersalCRLBase *xvcb = XLNX_VERSAL_CRL_BASE(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    size_t i;
+
+    xvcb->reg_array = register_init_block32(DEVICE(obj), versal2_crl_regs_info,
+                                            ARRAY_SIZE(versal2_crl_regs_info),
+                                            s->regs_info, s->regs,
+                                            &crl_ops,
+                                            XLNX_VERSAL_CRL_ERR_DEBUG,
+                                            VERSAL2_CRL_R_MAX * 4);
+    xvcb->regs = s->regs;
+
+    sysbus_init_mmio(sbd, &xvcb->reg_array->mem);
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.rpu); ++i) {
+        object_property_add_link(obj, "rpu[*]", TYPE_ARM_CPU,
+                                 (Object **)&s->cfg.rpu[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.adma); ++i) {
+        object_property_add_link(obj, "adma[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.adma[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.sdma); ++i) {
+        object_property_add_link(obj, "sdma[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.sdma[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.uart); ++i) {
+        object_property_add_link(obj, "uart[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.uart[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.gem); ++i) {
+        object_property_add_link(obj, "gem[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.gem[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.usb); ++i) {
+        object_property_add_link(obj, "usb[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.usb[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+
+    for (i = 0; i < ARRAY_SIZE(s->cfg.can); ++i) {
+        object_property_add_link(obj, "can[*]", TYPE_DEVICE,
+                                 (Object **)&s->cfg.can[i],
+                                 qdev_prop_allow_set_link_before_realize,
+                                 OBJ_PROP_LINK_STRONG);
+    }
+}
+
 static void crl_finalize(Object *obj)
 {
     XlnxVersalCRLBase *s = XLNX_VERSAL_CRL_BASE(obj);
@@ -404,6 +766,16 @@ static const VMStateDescription vmstate_versal_crl = {
     }
 };
 
+static const VMStateDescription vmstate_versal2_crl = {
+    .name = TYPE_XLNX_VERSAL2_CRL,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxVersal2CRL, VERSAL2_CRL_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
 static void versal_crl_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
@@ -416,6 +788,17 @@ static void versal_crl_class_init(ObjectClass *klass, const void *data)
     xvcc->decode_periph_rst = versal_decode_periph_rst;
 }
 
+static void versal2_crl_class_init(ObjectClass *klass, const void *data)
+{
+    XlnxVersalCRLBaseClass *xvcc = XLNX_VERSAL_CRL_BASE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    dc->vmsd = &vmstate_versal2_crl;
+    rc->phases.enter = versal2_crl_reset_enter;
+    xvcc->decode_periph_rst = versal2_decode_periph_rst;
+}
+
 static const TypeInfo crl_base_info = {
     .name          = TYPE_XLNX_VERSAL_CRL_BASE,
     .parent        = TYPE_SYS_BUS_DEVICE,
@@ -433,10 +816,19 @@ static const TypeInfo versal_crl_info = {
     .class_init    = versal_crl_class_init,
 };
 
+static const TypeInfo versal2_crl_info = {
+    .name          = TYPE_XLNX_VERSAL2_CRL,
+    .parent        = TYPE_XLNX_VERSAL_CRL_BASE,
+    .instance_size = sizeof(XlnxVersal2CRL),
+    .instance_init = versal2_crl_init,
+    .class_init    = versal2_crl_class_init,
+};
+
 static void crl_register_types(void)
 {
     type_register_static(&crl_base_info);
     type_register_static(&versal_crl_info);
+    type_register_static(&versal2_crl_info);
 }
 
 type_init(crl_register_types)
diff --git a/include/hw/arm/xlnx-versal-version.h b/include/hw/arm/xlnx-versal-version.h
index c4307d1304..5b6b6e57a5 100644
--- a/include/hw/arm/xlnx-versal-version.h
+++ b/include/hw/arm/xlnx-versal-version.h
@@ -10,6 +10,7 @@
 
 typedef enum VersalVersion {
     VERSAL_VER_VERSAL,
+    VERSAL_VER_VERSAL2,
 } VersalVersion;
 
 #endif
diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
index 7e50a95ad3..f6b8694ebe 100644
--- a/include/hw/misc/xlnx-versal-crl.h
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -17,10 +17,12 @@
 
 #define TYPE_XLNX_VERSAL_CRL_BASE "xlnx-versal-crl-base"
 #define TYPE_XLNX_VERSAL_CRL "xlnx-versal-crl"
+#define TYPE_XLNX_VERSAL2_CRL "xlnx-versal2-crl"
 
 OBJECT_DECLARE_TYPE(XlnxVersalCRLBase, XlnxVersalCRLBaseClass,
                     XLNX_VERSAL_CRL_BASE)
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalCRL, XLNX_VERSAL_CRL)
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersal2CRL, XLNX_VERSAL2_CRL)
 
 REG32(ERR_CTRL, 0x0)
     FIELD(ERR_CTRL, SLVERR_ENABLE, 0, 1)
@@ -220,6 +222,314 @@ REG32(PSM_RST_MODE, 0x370)
 
 #define CRL_R_MAX (R_PSM_RST_MODE + 1)
 
+REG32(VERSAL2_ERR_CTRL, 0x0)
+REG32(VERSAL2_WPROT, 0x1c)
+    FIELD(VERSAL2_WPROT, ACTIVE, 0, 1)
+REG32(VERSAL2_RPLL_CTRL, 0x40)
+    FIELD(VERSAL2_RPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(VERSAL2_RPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(VERSAL2_RPLL_CTRL, CLKOUTDIV, 16, 2)
+    FIELD(VERSAL2_RPLL_CTRL, FBDIV, 8, 8)
+    FIELD(VERSAL2_RPLL_CTRL, BYPASS, 3, 1)
+    FIELD(VERSAL2_RPLL_CTRL, RESET, 0, 1)
+REG32(VERSAL2_RPLL_CFG, 0x44)
+    FIELD(VERSAL2_RPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(VERSAL2_RPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(VERSAL2_RPLL_CFG, LFHF, 10, 2)
+    FIELD(VERSAL2_RPLL_CFG, CP, 5, 4)
+    FIELD(VERSAL2_RPLL_CFG, RES, 0, 4)
+REG32(VERSAL2_FLXPLL_CTRL, 0x50)
+    FIELD(VERSAL2_FLXPLL_CTRL, POST_SRC, 24, 3)
+    FIELD(VERSAL2_FLXPLL_CTRL, PRE_SRC, 20, 3)
+    FIELD(VERSAL2_FLXPLL_CTRL, CLKOUTDIV, 16, 2)
+    FIELD(VERSAL2_FLXPLL_CTRL, FBDIV, 8, 8)
+    FIELD(VERSAL2_FLXPLL_CTRL, BYPASS, 3, 1)
+    FIELD(VERSAL2_FLXPLL_CTRL, RESET, 0, 1)
+REG32(VERSAL2_FLXPLL_CFG, 0x54)
+    FIELD(VERSAL2_FLXPLL_CFG, LOCK_DLY, 25, 7)
+    FIELD(VERSAL2_FLXPLL_CFG, LOCK_CNT, 13, 10)
+    FIELD(VERSAL2_FLXPLL_CFG, LFHF, 10, 2)
+    FIELD(VERSAL2_FLXPLL_CFG, CP, 5, 4)
+    FIELD(VERSAL2_FLXPLL_CFG, RES, 0, 4)
+REG32(VERSAL2_PLL_STATUS, 0x60)
+    FIELD(VERSAL2_PLL_STATUS, FLXPLL_STABLE, 3, 1)
+    FIELD(VERSAL2_PLL_STATUS, RPLL_STABLE, 2, 1)
+    FIELD(VERSAL2_PLL_STATUS, FLXPLL_LOCK, 1, 1)
+    FIELD(VERSAL2_PLL_STATUS, RPLL_LOCK, 0, 1)
+REG32(VERSAL2_RPLL_TO_XPD_CTRL, 0x100)
+    FIELD(VERSAL2_RPLL_TO_XPD_CTRL, DIVISOR0, 8, 10)
+REG32(VERSAL2_LPX_TOP_SWITCH_CTRL, 0x104)
+    FIELD(VERSAL2_LPX_TOP_SWITCH_CTRL, CLKACT_ADMA, 26, 1)
+    FIELD(VERSAL2_LPX_TOP_SWITCH_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_LPX_TOP_SWITCH_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_LPX_TOP_SWITCH_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_LPX_LSBUS_CLK_CTRL, 0x108)
+    FIELD(VERSAL2_LPX_LSBUS_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_LPX_LSBUS_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_LPX_LSBUS_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_RPU_CLK_CTRL, 0x10c)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT_CLUSTERE, 24, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT_CLUSTERD, 23, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT_CLUSTERC, 22, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT_CLUSTERB, 21, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, CLKACT_CLUSTERA, 20, 1)
+    FIELD(VERSAL2_RPU_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_RPU_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_OCM_CLK_CTRL, 0x120)
+    FIELD(VERSAL2_OCM_CLK_CTRL, CLKACT_OCM3, 24, 1)
+    FIELD(VERSAL2_OCM_CLK_CTRL, CLKACT_OCM2, 23, 1)
+    FIELD(VERSAL2_OCM_CLK_CTRL, CLKACT_OCM1, 22, 1)
+    FIELD(VERSAL2_OCM_CLK_CTRL, CLKACT_OCM0, 21, 1)
+REG32(VERSAL2_IOU_SWITCH_CLK_CTRL, 0x124)
+    FIELD(VERSAL2_IOU_SWITCH_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_IOU_SWITCH_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_IOU_SWITCH_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_GEM0_REF_CTRL, 0x128)
+    FIELD(VERSAL2_GEM0_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(VERSAL2_GEM0_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(VERSAL2_GEM0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_GEM0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_GEM0_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_GEM1_REF_CTRL, 0x12c)
+    FIELD(VERSAL2_GEM1_REF_CTRL, CLKACT_RX, 27, 1)
+    FIELD(VERSAL2_GEM1_REF_CTRL, CLKACT_TX, 26, 1)
+    FIELD(VERSAL2_GEM1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_GEM1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_GEM1_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_GEM_TSU_REF_CLK_CTRL, 0x130)
+    FIELD(VERSAL2_GEM_TSU_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_GEM_TSU_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_GEM_TSU_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_USB0_BUS_REF_CLK_CTRL, 0x134)
+    FIELD(VERSAL2_USB0_BUS_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_USB0_BUS_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_USB0_BUS_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_USB1_BUS_REF_CLK_CTRL, 0x138)
+    FIELD(VERSAL2_USB1_BUS_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_USB1_BUS_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_USB1_BUS_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_UART0_REF_CLK_CTRL, 0x13c)
+    FIELD(VERSAL2_UART0_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_UART0_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_UART0_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_UART1_REF_CLK_CTRL, 0x140)
+    FIELD(VERSAL2_UART1_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_UART1_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_UART1_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_SPI0_REF_CLK_CTRL, 0x144)
+    FIELD(VERSAL2_SPI0_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_SPI0_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_SPI0_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_SPI1_REF_CLK_CTRL, 0x148)
+    FIELD(VERSAL2_SPI1_REF_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_SPI1_REF_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_SPI1_REF_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_CAN0_REF_2X_CTRL, 0x14c)
+    FIELD(VERSAL2_CAN0_REF_2X_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_CAN0_REF_2X_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_CAN0_REF_2X_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_CAN1_REF_2X_CTRL, 0x150)
+    FIELD(VERSAL2_CAN1_REF_2X_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_CAN1_REF_2X_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_CAN1_REF_2X_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_CAN2_REF_2X_CTRL, 0x154)
+    FIELD(VERSAL2_CAN2_REF_2X_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_CAN2_REF_2X_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_CAN2_REF_2X_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_CAN3_REF_2X_CTRL, 0x158)
+    FIELD(VERSAL2_CAN3_REF_2X_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_CAN3_REF_2X_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_CAN3_REF_2X_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C0_REF_CTRL, 0x15c)
+    FIELD(VERSAL2_I3C0_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C0_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C0_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C1_REF_CTRL, 0x160)
+    FIELD(VERSAL2_I3C1_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C1_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C1_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C2_REF_CTRL, 0x164)
+    FIELD(VERSAL2_I3C2_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C2_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C2_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C3_REF_CTRL, 0x168)
+    FIELD(VERSAL2_I3C3_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C3_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C3_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C4_REF_CTRL, 0x16c)
+    FIELD(VERSAL2_I3C4_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C4_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C4_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C5_REF_CTRL, 0x170)
+    FIELD(VERSAL2_I3C5_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C5_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C5_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C6_REF_CTRL, 0x174)
+    FIELD(VERSAL2_I3C6_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C6_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C6_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_I3C7_REF_CTRL, 0x178)
+    FIELD(VERSAL2_I3C7_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_I3C7_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_I3C7_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_DBG_LPX_CTRL, 0x17c)
+    FIELD(VERSAL2_DBG_LPX_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_DBG_LPX_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_DBG_LPX_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_TIMESTAMP_REF_CTRL, 0x180)
+    FIELD(VERSAL2_TIMESTAMP_REF_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_TIMESTAMP_REF_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_TIMESTAMP_REF_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_SAFETY_CHK, 0x184)
+REG32(VERSAL2_ASU_CLK_CTRL, 0x188)
+    FIELD(VERSAL2_ASU_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_ASU_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_DBG_TSTMP_CLK_CTRL, 0x18c)
+    FIELD(VERSAL2_DBG_TSTMP_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_DBG_TSTMP_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_DBG_TSTMP_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_MMI_TOPSW_CLK_CTRL, 0x190)
+    FIELD(VERSAL2_MMI_TOPSW_CLK_CTRL, CLKACT, 25, 1)
+    FIELD(VERSAL2_MMI_TOPSW_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_MMI_TOPSW_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_WWDT_PLL_CLK_CTRL, 0x194)
+    FIELD(VERSAL2_WWDT_PLL_CLK_CTRL, DIVISOR0, 8, 10)
+    FIELD(VERSAL2_WWDT_PLL_CLK_CTRL, SRCSEL, 0, 3)
+REG32(VERSAL2_RCLK_CTRL, 0x1a0)
+    FIELD(VERSAL2_RCLK_CTRL, CLKACT, 8, 6)
+    FIELD(VERSAL2_RCLK_CTRL, SELECT, 0, 6)
+REG32(VERSAL2_RST_RPU_A, 0x310)
+    FIELD(VERSAL2_RST_RPU_A, TOPRESET, 16, 1)
+    FIELD(VERSAL2_RST_RPU_A, CORE1_POR, 9, 1)
+    FIELD(VERSAL2_RST_RPU_A, CORE0_POR, 8, 1)
+    FIELD(VERSAL2_RST_RPU_A, CORE1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_A, CORE0_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_B, 0x314)
+    FIELD(VERSAL2_RST_RPU_B, TOPRESET, 16, 1)
+    FIELD(VERSAL2_RST_RPU_B, CORE1_POR, 9, 1)
+    FIELD(VERSAL2_RST_RPU_B, CORE0_POR, 8, 1)
+    FIELD(VERSAL2_RST_RPU_B, CORE1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_B, CORE0_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_C, 0x318)
+    FIELD(VERSAL2_RST_RPU_C, TOPRESET, 16, 1)
+    FIELD(VERSAL2_RST_RPU_C, CORE1_POR, 9, 1)
+    FIELD(VERSAL2_RST_RPU_C, CORE0_POR, 8, 1)
+    FIELD(VERSAL2_RST_RPU_C, CORE1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_C, CORE0_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_D, 0x31c)
+    FIELD(VERSAL2_RST_RPU_D, TOPRESET, 16, 1)
+    FIELD(VERSAL2_RST_RPU_D, CORE1_POR, 9, 1)
+    FIELD(VERSAL2_RST_RPU_D, CORE0_POR, 8, 1)
+    FIELD(VERSAL2_RST_RPU_D, CORE1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_D, CORE0_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_E, 0x320)
+    FIELD(VERSAL2_RST_RPU_E, TOPRESET, 16, 1)
+    FIELD(VERSAL2_RST_RPU_E, CORE1_POR, 9, 1)
+    FIELD(VERSAL2_RST_RPU_E, CORE0_POR, 8, 1)
+    FIELD(VERSAL2_RST_RPU_E, CORE1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_E, CORE0_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_GD_0, 0x324)
+    FIELD(VERSAL2_RST_RPU_GD_0, RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_GD_0, TOP_RESET, 0, 1)
+REG32(VERSAL2_RST_RPU_GD_1, 0x328)
+    FIELD(VERSAL2_RST_RPU_GD_1, RESET, 1, 1)
+    FIELD(VERSAL2_RST_RPU_GD_1, TOP_RESET, 0, 1)
+REG32(VERSAL2_RST_ASU_GD, 0x32c)
+    FIELD(VERSAL2_RST_ASU_GD, RESET, 1, 1)
+    FIELD(VERSAL2_RST_ASU_GD, TOP_RESET, 0, 1)
+REG32(VERSAL2_RST_ADMA, 0x334)
+    FIELD(VERSAL2_RST_ADMA, RESET, 0, 1)
+REG32(VERSAL2_RST_SDMA, 0x338)
+    FIELD(VERSAL2_RST_SDMA, RESET, 0, 1)
+REG32(VERSAL2_RST_GEM0, 0x33c)
+    FIELD(VERSAL2_RST_GEM0, RESET, 0, 1)
+REG32(VERSAL2_RST_GEM1, 0x340)
+    FIELD(VERSAL2_RST_GEM1, RESET, 0, 1)
+REG32(VERSAL2_RST_USB0, 0x348)
+    FIELD(VERSAL2_RST_USB0, RESET, 0, 1)
+REG32(VERSAL2_RST_USB1, 0x34c)
+    FIELD(VERSAL2_RST_USB1, RESET, 0, 1)
+REG32(VERSAL2_RST_UART0, 0x350)
+    FIELD(VERSAL2_RST_UART0, RESET, 0, 1)
+REG32(VERSAL2_RST_UART1, 0x354)
+    FIELD(VERSAL2_RST_UART1, RESET, 0, 1)
+REG32(VERSAL2_RST_SPI0, 0x358)
+    FIELD(VERSAL2_RST_SPI0, RESET, 0, 1)
+REG32(VERSAL2_RST_SPI1, 0x35c)
+    FIELD(VERSAL2_RST_SPI1, RESET, 0, 1)
+REG32(VERSAL2_RST_CAN0, 0x360)
+    FIELD(VERSAL2_RST_CAN0, RESET, 0, 1)
+REG32(VERSAL2_RST_CAN1, 0x364)
+    FIELD(VERSAL2_RST_CAN1, RESET, 0, 1)
+REG32(VERSAL2_RST_CAN2, 0x368)
+    FIELD(VERSAL2_RST_CAN2, RESET, 0, 1)
+REG32(VERSAL2_RST_CAN3, 0x36c)
+    FIELD(VERSAL2_RST_CAN3, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C0, 0x374)
+    FIELD(VERSAL2_RST_I3C0, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C1, 0x378)
+    FIELD(VERSAL2_RST_I3C1, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C2, 0x37c)
+    FIELD(VERSAL2_RST_I3C2, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C3, 0x380)
+    FIELD(VERSAL2_RST_I3C3, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C4, 0x384)
+    FIELD(VERSAL2_RST_I3C4, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C5, 0x388)
+    FIELD(VERSAL2_RST_I3C5, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C6, 0x38c)
+    FIELD(VERSAL2_RST_I3C6, RESET, 0, 1)
+REG32(VERSAL2_RST_I3C7, 0x390)
+    FIELD(VERSAL2_RST_I3C7, RESET, 0, 1)
+REG32(VERSAL2_RST_DBG_LPX, 0x398)
+    FIELD(VERSAL2_RST_DBG_LPX, RESET_HSDP, 1, 1)
+    FIELD(VERSAL2_RST_DBG_LPX, RESET, 0, 1)
+REG32(VERSAL2_RST_GPIO, 0x39c)
+    FIELD(VERSAL2_RST_GPIO, RESET, 0, 1)
+REG32(VERSAL2_RST_TTC, 0x3a0)
+    FIELD(VERSAL2_RST_TTC, TTC7_RESET, 7, 1)
+    FIELD(VERSAL2_RST_TTC, TTC6_RESET, 6, 1)
+    FIELD(VERSAL2_RST_TTC, TTC5_RESET, 5, 1)
+    FIELD(VERSAL2_RST_TTC, TTC4_RESET, 4, 1)
+    FIELD(VERSAL2_RST_TTC, TTC3_RESET, 3, 1)
+    FIELD(VERSAL2_RST_TTC, TTC2_RESET, 2, 1)
+    FIELD(VERSAL2_RST_TTC, TTC1_RESET, 1, 1)
+    FIELD(VERSAL2_RST_TTC, TTC0_RESET, 0, 1)
+REG32(VERSAL2_RST_TIMESTAMP, 0x3a4)
+    FIELD(VERSAL2_RST_TIMESTAMP, RESET, 0, 1)
+REG32(VERSAL2_RST_SWDT0, 0x3a8)
+    FIELD(VERSAL2_RST_SWDT0, RESET, 0, 1)
+REG32(VERSAL2_RST_SWDT1, 0x3ac)
+    FIELD(VERSAL2_RST_SWDT1, RESET, 0, 1)
+REG32(VERSAL2_RST_SWDT2, 0x3b0)
+    FIELD(VERSAL2_RST_SWDT2, RESET, 0, 1)
+REG32(VERSAL2_RST_SWDT3, 0x3b4)
+    FIELD(VERSAL2_RST_SWDT3, RESET, 0, 1)
+REG32(VERSAL2_RST_SWDT4, 0x3b8)
+    FIELD(VERSAL2_RST_SWDT4, RESET, 0, 1)
+REG32(VERSAL2_RST_IPI, 0x3bc)
+    FIELD(VERSAL2_RST_IPI, RESET, 0, 1)
+REG32(VERSAL2_RST_SYSMON, 0x3c0)
+    FIELD(VERSAL2_RST_SYSMON, CFG_RST, 0, 1)
+REG32(VERSAL2_ASU_MB_RST_MODE, 0x3c4)
+    FIELD(VERSAL2_ASU_MB_RST_MODE, WAKEUP, 2, 1)
+    FIELD(VERSAL2_ASU_MB_RST_MODE, RST_MODE, 0, 2)
+REG32(VERSAL2_FPX_TOPSW_MUX_CTRL, 0x3c8)
+    FIELD(VERSAL2_FPX_TOPSW_MUX_CTRL, SELECT, 0, 1)
+REG32(VERSAL2_RST_FPX, 0x3d0)
+    FIELD(VERSAL2_RST_FPX, SRST, 1, 1)
+    FIELD(VERSAL2_RST_FPX, POR, 0, 1)
+REG32(VERSAL2_RST_MMI, 0x3d4)
+    FIELD(VERSAL2_RST_MMI, POR, 0, 1)
+REG32(VERSAL2_RST_OCM, 0x3d8)
+    FIELD(VERSAL2_RST_OCM, RESET_OCM3, 3, 1)
+    FIELD(VERSAL2_RST_OCM, RESET_OCM2, 2, 1)
+    FIELD(VERSAL2_RST_OCM, RESET_OCM1, 1, 1)
+    FIELD(VERSAL2_RST_OCM, RESET_OCM0, 0, 1)
+
+#define VERSAL2_CRL_R_MAX (R_VERSAL2_RST_OCM + 1)
+
 struct XlnxVersalCRLBase {
     SysBusDevice parent_obj;
 
@@ -249,11 +559,30 @@ struct XlnxVersalCRL {
     RegisterInfo regs_info[CRL_R_MAX];
 };
 
+struct XlnxVersal2CRL {
+    XlnxVersalCRLBase parent_obj;
+
+    struct {
+        DeviceState *rpu[10];
+        DeviceState *adma[8];
+        DeviceState *sdma[8];
+        DeviceState *uart[2];
+        DeviceState *gem[2];
+        DeviceState *usb[2];
+        DeviceState *can[4];
+    } cfg;
+
+    RegisterInfo regs_info[VERSAL2_CRL_R_MAX];
+    uint32_t regs[VERSAL2_CRL_R_MAX];
+};
+
 static inline const char *xlnx_versal_crl_class_name(VersalVersion ver)
 {
     switch (ver) {
     case VERSAL_VER_VERSAL:
         return TYPE_XLNX_VERSAL_CRL;
+    case VERSAL_VER_VERSAL2:
+        return TYPE_XLNX_VERSAL2_CRL;
     default:
         g_assert_not_reached();
     }

From 268f7a3d24a73b94bfab1dd86c6b41f7afd196fc Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:55 +0200
Subject: [PATCH 1112/2396] hw/arm/xlnx-versal: add a per_cluster_gic switch to
 VersalCpuClusterMap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the per_cluster_gic switch to the VersalCpuClusterMap structure.
When set, this indicates that a GIC instance should by created
per-cluster instead of globally for the whole RPU or APU. This is in
preparation for versal2.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-38-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 15 +++++++++++++--
 1 file changed, 13 insertions(+), 2 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 49b5b24440..3d960ed263 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -88,6 +88,11 @@ enum StartPoweredOffMode {
 
 typedef struct VersalCpuClusterMap {
     VersalGicMap gic;
+    /*
+     * true: one GIC per cluster.
+     * false: one GIC for all CPUs
+     */
+    bool per_cluster_gic;
 
     const char *name;
     const char *cpu_model;
@@ -825,12 +830,18 @@ static void versal_create_cpu_cluster(Versal *s, const VersalCpuClusterMap *map)
             cpus[i * map->num_core + j] = cpu;
         }
 
+        if (map->per_cluster_gic) {
+            versal_create_and_connect_gic(s, map, mr, &cpus[i * map->num_core],
+                                          map->num_core);
+        }
     }
 
     qdev_realize_and_unref(cluster, NULL, &error_fatal);
 
-    versal_create_and_connect_gic(s, map, mr, cpus,
-                                  map->num_cluster * map->num_core);
+    if (!map->per_cluster_gic) {
+        versal_create_and_connect_gic(s, map, mr, cpus,
+                                      map->num_cluster * map->num_core);
+    }
 
     has_gtimer = arm_feature(&ARM_CPU(cpus[0])->env, ARM_FEATURE_GENERIC_TIMER);
     if (map->dtb_expose && has_gtimer) {

From 16aa53c971c4a2fef5608f8aac372dd03305f0d2 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:56 +0200
Subject: [PATCH 1113/2396] hw/arm/xlnx-versal: add the target field in IRQ
 descriptor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the target field in the IRQ descriptor. This allows to target an IRQ
to another IRQ controller than the GIC(s). Other supported targets are
the PMC PPU1 CPU interrupt controller and the EAM (Error management)
device. Those two devices are currently not implemented so IRQs
targeting those will be left unconnected. This is in preparation for
versal2.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-39-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c | 41 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 3d960ed263..6474440118 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -52,14 +52,26 @@
 
 /*
  * IRQ descriptor to catch the following cases:
+ *   - An IRQ can either connect to the GICs, to the PPU1 intc, or the the EAM
  *   - Multiple devices can connect to the same IRQ. They are OR'ed together.
  */
 FIELD(VERSAL_IRQ, IRQ, 0, 16)
+FIELD(VERSAL_IRQ, TARGET, 16, 2)
 FIELD(VERSAL_IRQ, ORED, 18, 1)
 FIELD(VERSAL_IRQ, OR_IDX, 19, 4) /* input index on the IRQ OR gate */
 
+typedef enum VersalIrqTarget {
+    IRQ_TARGET_GIC,
+    IRQ_TARGET_PPU1,
+    IRQ_TARGET_EAM,
+} VersalIrqTarget;
+
+#define PPU1_IRQ(irq) ((IRQ_TARGET_PPU1 << R_VERSAL_IRQ_TARGET_SHIFT) | (irq))
+#define EAM_IRQ(irq) ((IRQ_TARGET_EAM << R_VERSAL_IRQ_TARGET_SHIFT) | (irq))
 #define OR_IRQ(irq, or_idx) \
     (R_VERSAL_IRQ_ORED_MASK | ((or_idx) << R_VERSAL_IRQ_OR_IDX_SHIFT) | (irq))
+#define PPU1_OR_IRQ(irq, or_idx) \
+    ((IRQ_TARGET_PPU1 << R_VERSAL_IRQ_TARGET_SHIFT) | OR_IRQ(irq, or_idx))
 
 typedef struct VersalSimplePeriphMap {
     uint64_t addr;
@@ -414,6 +426,13 @@ static qemu_irq versal_get_gic_irq(Versal *s, int irq_idx)
 static qemu_irq versal_get_irq_or_gate_in(Versal *s, int irq_idx,
                                           qemu_irq target_irq)
 {
+    static const char *TARGET_STR[] = {
+        [IRQ_TARGET_GIC] = "gic",
+        [IRQ_TARGET_PPU1] = "ppu1",
+        [IRQ_TARGET_EAM] = "eam",
+    };
+
+    VersalIrqTarget target;
     Object *container = versal_get_child(s, "irq-or-gates");
     DeviceState *dev;
     g_autofree char *name;
@@ -421,8 +440,9 @@ static qemu_irq versal_get_irq_or_gate_in(Versal *s, int irq_idx,
 
     idx = FIELD_EX32(irq_idx, VERSAL_IRQ, IRQ);
     or_idx = FIELD_EX32(irq_idx, VERSAL_IRQ, OR_IDX);
+    target = FIELD_EX32(irq_idx, VERSAL_IRQ, TARGET);
 
-    name = g_strdup_printf("irq[%d]", idx);
+    name = g_strdup_printf("%s-irq[%d]", TARGET_STR[target], idx);
     dev = DEVICE(object_resolve_path_at(container, name));
 
     if (dev == NULL) {
@@ -438,12 +458,29 @@ static qemu_irq versal_get_irq_or_gate_in(Versal *s, int irq_idx,
 
 static qemu_irq versal_get_irq(Versal *s, int irq_idx)
 {
+    VersalIrqTarget target;
     qemu_irq irq;
     bool ored;
 
+    target = FIELD_EX32(irq_idx, VERSAL_IRQ, TARGET);
     ored = FIELD_EX32(irq_idx, VERSAL_IRQ, ORED);
 
-    irq = versal_get_gic_irq(s, irq_idx);
+    switch (target) {
+    case IRQ_TARGET_EAM:
+        /* EAM not implemented */
+        return NULL;
+
+    case IRQ_TARGET_PPU1:
+        /* PPU1 CPU not implemented */
+        return NULL;
+
+    case IRQ_TARGET_GIC:
+        irq = versal_get_gic_irq(s, irq_idx);
+        break;
+
+    default:
+        g_assert_not_reached();
+    }
 
     if (ored) {
         irq = versal_get_irq_or_gate_in(s, irq_idx, irq);

From 0252b88c796d05ffbfefe57d4c8f7dc7a69556dd Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:57 +0200
Subject: [PATCH 1114/2396] target/arm/tcg/cpu64: add the cortex-a78ae CPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add support for the ARM Cortex-A78AE CPU.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-40-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/cpu64.c | 78 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 78 insertions(+)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index abef6a246e..90b6c0ebb0 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -406,6 +406,79 @@ static void aarch64_a76_initfn(Object *obj)
     cpu->isar.reset_pmcr_el0 = 0x410b3000;
 }
 
+static void aarch64_a78ae_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    ARMISARegisters *isar = &cpu->isar;
+
+    cpu->dtb_compatible = "arm,cortex-a78ae";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+
+    /* Ordered by 3.2.4 AArch64 registers by functional group */
+    SET_IDREG(isar, CLIDR, 0x82000023);
+    cpu->ctr = 0x9444c004;
+    cpu->dcz_blocksize = 4;
+    SET_IDREG(isar, ID_AA64DFR0, 0x0000000110305408ull);
+    SET_IDREG(isar, ID_AA64ISAR0, 0x0010100010211120ull);
+    SET_IDREG(isar, ID_AA64ISAR1, 0x0000000001200031ull);
+    SET_IDREG(isar, ID_AA64MMFR0, 0x0000000000101125ull);
+    SET_IDREG(isar, ID_AA64MMFR1, 0x0000000010212122ull);
+    SET_IDREG(isar, ID_AA64MMFR2, 0x0000000100001011ull);
+    SET_IDREG(isar, ID_AA64PFR0, 0x1100000010111112ull); /* GIC filled in later */
+    SET_IDREG(isar, ID_AA64PFR1, 0x0000000000000010ull);
+    SET_IDREG(isar, ID_AFR0, 0x00000000);
+    SET_IDREG(isar, ID_DFR0, 0x04010088);
+    SET_IDREG(isar, ID_ISAR0, 0x02101110);
+    SET_IDREG(isar, ID_ISAR1, 0x13112111);
+    SET_IDREG(isar, ID_ISAR2, 0x21232042);
+    SET_IDREG(isar, ID_ISAR3, 0x01112131);
+    SET_IDREG(isar, ID_ISAR4, 0x00010142);
+    SET_IDREG(isar, ID_ISAR5, 0x01011121);
+    SET_IDREG(isar, ID_ISAR6, 0x00000010);
+    SET_IDREG(isar, ID_MMFR0, 0x10201105);
+    SET_IDREG(isar, ID_MMFR1, 0x40000000);
+    SET_IDREG(isar, ID_MMFR2, 0x01260000);
+    SET_IDREG(isar, ID_MMFR3, 0x02122211);
+    SET_IDREG(isar, ID_MMFR4, 0x00021110);
+    SET_IDREG(isar, ID_PFR0, 0x10010131);
+    SET_IDREG(isar, ID_PFR1, 0x00010000); /* GIC filled in later */
+    SET_IDREG(isar, ID_PFR2, 0x00000011);
+    cpu->midr = 0x410fd423;          /* r0p3 */
+    cpu->revidr = 0;
+
+    /* From 3.2.33 CCSIDR_EL1 */
+    /* 64KB L1 dcache */
+    cpu->ccsidr[0] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 64, 64 * KiB, 7);
+    /* 64KB L1 icache */
+    cpu->ccsidr[1] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 4, 64, 64 * KiB, 2);
+    /* 512KB L2 cache */
+    cpu->ccsidr[2] = make_ccsidr(CCSIDR_FORMAT_LEGACY, 8, 64, 512 * KiB, 7);
+
+    /* From 3.2.118 SCTLR_EL3 */
+    cpu->reset_sctlr = 0x30c50838;
+
+    /* From 3.4.23 ICH_VTR_EL2 */
+    cpu->gic_num_lrs = 4;
+    cpu->gic_vpribits = 5;
+    cpu->gic_vprebits = 5;
+    /* From 3.4.8 ICC_CTLR_EL3 */
+    cpu->gic_pribits = 5;
+
+    /* From 3.5.1 AdvSIMD AArch64 register summary */
+    cpu->isar.mvfr0 = 0x10110222;
+    cpu->isar.mvfr1 = 0x13211111;
+    cpu->isar.mvfr2 = 0x00000043;
+
+    /* From 5.5.1 AArch64 PMU register summary */
+    cpu->isar.reset_pmcr_el0 = 0x41223000;
+}
+
 static void aarch64_a64fx_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -1321,6 +1394,11 @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a55",         .initfn = aarch64_a55_initfn },
     { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
     { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
+    /*
+     * The Cortex-A78AE differs slightly from the plain Cortex-A78. We don't
+     * currently model the latter.
+     */
+    { .name = "cortex-a78ae",       .initfn = aarch64_a78ae_initfn },
     { .name = "cortex-a710",        .initfn = aarch64_a710_initfn },
     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
     { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },

From 8cd160dccf763b6680a8c7c6b503965d5aa04cbd Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:58 +0200
Subject: [PATCH 1115/2396] hw/arm/xlnx-versal: add versal2 SoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the Versal Gen 2 (versal2) version of the Versal SoC family.
This version embeds up to 8 Cortex-A78AE cores (split into 4 clusters)
and 10 Cortex-R52 cores (split into 5 clusters). The similarities
between versal and versal2 in term of architecture allow to reuse the
VersalMap structure to almost fully describe the implemented parts of
versal2.

The versal2 eFuse device differs quite a lot from the versal one and is
left as future work.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-41-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal.c         | 207 ++++++++++++++++++++++++++++++++---
 include/hw/arm/xlnx-versal.h |  17 ++-
 2 files changed, 209 insertions(+), 15 deletions(-)

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index 6474440118..81cb6294cf 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -1,5 +1,5 @@
 /*
- * Xilinx Versal SoC model.
+ * AMD/Xilinx Versal family SoC model.
  *
  * Copyright (c) 2018 Xilinx Inc.
  * Copyright (c) 2025 Advanced Micro Devices, Inc.
@@ -352,8 +352,124 @@ static const VersalMap VERSAL_MAP = {
     .reserved = { 0xa0000000, 111, 8 },
 };
 
+static const VersalMap VERSAL2_MAP = {
+    .ocm = {
+        .addr = 0xbbe00000,
+        .size = 2 * MiB,
+    },
+
+    .ddr = {
+        .chan[0] = { .addr = 0x0, .size = 2046 * MiB },
+        .chan[1] = { .addr = 0x800000000ull, .size = 32 * GiB },
+        .chan[2] = { .addr = 0xc00000000ull, .size = 256 * GiB },
+        .chan[3] = { .addr = 0x10000000000ull, .size = 734 * GiB },
+        .num_chan = 4,
+    },
+
+    .apu = {
+        .name = "apu",
+        .cpu_model = ARM_CPU_TYPE_NAME("cortex-a78ae"),
+        .num_cluster = 4,
+        .num_core = 2,
+        .qemu_cluster_id = 0,
+        .mp_affinity = {
+            .base = 0x0, /* TODO: the MT bit should be set */
+            .core_shift = ARM_AFF1_SHIFT,
+            .cluster_shift = ARM_AFF2_SHIFT,
+        },
+        .start_powered_off = SPO_SECONDARIES,
+        .dtb_expose = true,
+        .gic = {
+            .version = 3,
+            .dist = 0xe2000000,
+            .redist = 0xe2060000,
+            .num_irq = 544,
+            .has_its = true,
+            .its = 0xe2040000,
+        },
+    },
+
+    .rpu = {
+        .name = "rpu",
+        .cpu_model = ARM_CPU_TYPE_NAME("cortex-r52"),
+        .num_cluster = 5,
+        .num_core = 2,
+        .qemu_cluster_id = 1,
+        .mp_affinity = {
+            .core_shift = ARM_AFF0_SHIFT,
+            .cluster_shift = ARM_AFF1_SHIFT,
+        },
+        .start_powered_off = SPO_ALL,
+        .dtb_expose = false,
+        .per_cluster_gic = true,
+        .gic = {
+            .version = 3,
+            .dist = 0x0,
+            .redist = 0x100000,
+            .num_irq = 288,
+        },
+    },
+
+    .uart[0] = { 0xf1920000, 25 },
+    .uart[1] = { 0xf1930000, 26 },
+    .num_uart = 2,
+
+    .canfd[0] = { 0xf19e0000, 27 },
+    .canfd[1] = { 0xf19f0000, 28 },
+    .canfd[2] = { 0xf1a00000, 95 },
+    .canfd[3] = { 0xf1a10000, 96 },
+    .num_canfd = 4,
+
+    .gem[0] = { { 0xf1a60000, 39 }, 2, "rgmii-id", 1000 },
+    .gem[1] = { { 0xf1a70000, 41 }, 2, "rgmii-id", 1000 },
+    .gem[2] = { { 0xed920000, 164 }, 4, "usxgmii", 10000 }, /* MMI 10Gb GEM */
+    .num_gem = 3,
+
+    .zdma[0] = { "adma", { 0xebd00000, 72 }, 8, 0x10000, 1 },
+    .zdma[1] = { "sdma", { 0xebd80000, 112 }, 8, 0x10000, 1 },
+    .num_zdma = 2,
+
+    .usb[0] = { .xhci = 0xf1b00000, .ctrl = 0xf1ee0000, .irq = 29 },
+    .usb[1] = { .xhci = 0xf1c00000, .ctrl = 0xf1ef0000, .irq = 34 },
+    .num_usb = 2,
+
+    .efuse = { .ctrl = 0xf1240000, .cache = 0xf1250000, .irq = 230 },
+
+    .ospi = {
+        .ctrl = 0xf1010000,
+        .dac = 0xc0000000, .dac_sz = 0x20000000,
+        .dma_src = 0xf1011000, .dma_dst = 0xf1011800,
+        .irq = 216,
+    },
+
+    .sdhci[0] = { 0xf1040000, 218 },
+    .sdhci[1] = { 0xf1050000, 220 }, /* eMMC */
+    .num_sdhci = 2,
+
+    .pmc_iou_slcr = { 0xf1060000, 222 },
+    .bbram = { 0xf11f0000, PPU1_OR_IRQ(18, 0) },
+    .crl = { 0xeb5e0000 },
+    .trng = { 0xf1230000, 233 },
+    .rtc = {
+        { 0xf12a0000, PPU1_OR_IRQ(18, 1) },
+        .alarm_irq = 200, .second_irq = 201
+    },
+
+    .cfu = {
+        .cframe_base = 0xf12d0000, .cframe_stride = 0x1000,
+        .cframe_bcast_reg = 0xf12ee000, .cframe_bcast_fdri = 0xf12ef000,
+        .cfu_apb = 0xf12b0000, .cfu_sfr = 0xf12c1000,
+        .cfu_stream = 0xf12c0000, .cfu_stream_2 = 0xf1f80000,
+        .cfu_fdro = 0xf12c2000,
+        .cfu_apb_irq = 235, .cframe_irq = EAM_IRQ(7),
+    },
+
+    .reserved = { 0xf5e00000, 270, 8 },
+};
+
 static const VersalMap *VERSION_TO_MAP[] = {
     [VERSAL_VER_VERSAL] = &VERSAL_MAP,
+    [VERSAL_VER_VERSAL2] = &VERSAL2_MAP,
 };
 
 static inline VersalVersion versal_get_version(Versal *s)
@@ -1294,6 +1410,11 @@ static void versal_create_efuse(Versal *s,
     DeviceState *ctrl;
     DeviceState *cache;
 
+    if (versal_get_version(s) != VERSAL_VER_VERSAL) {
+        /* TODO for versal2 */
+        return;
+    }
+
     ctrl = qdev_new(TYPE_XLNX_VERSAL_EFUSE_CTRL);
     cache = qdev_new(TYPE_XLNX_VERSAL_EFUSE_CACHE);
     bits = qdev_new(TYPE_XLNX_EFUSE);
@@ -1545,22 +1666,32 @@ static inline void crl_connect_dev_by_name(Versal *s, Object *crl,
 static inline void versal_create_crl(Versal *s)
 {
     const VersalMap *map;
+    VersalVersion ver;
     const char *crl_class;
     DeviceState *dev;
+    size_t num_gem;
     Object *obj;
 
     map = versal_get_map(s);
+    ver = versal_get_version(s);
 
-    crl_class = TYPE_XLNX_VERSAL_CRL;
+    crl_class = xlnx_versal_crl_class_name(ver);
     dev = qdev_new(crl_class);
     obj = OBJECT(dev);
     object_property_add_child(OBJECT(s), "crl", obj);
 
+    /*
+     * The 3rd GEM controller on versal2 is in the MMI subsystem.
+     * Its reset line is not connected to the CRL. Consider only the first two
+     * ones.
+     */
+    num_gem = ver == VERSAL_VER_VERSAL2 ? 2 : map->num_gem;
+
     crl_connect_dev_by_name(s, obj, "rpu-cluster/rpu",
                             map->rpu.num_cluster * map->rpu.num_core);
     crl_connect_dev_by_name(s, obj, map->zdma[0].name, map->zdma[0].num_chan);
     crl_connect_dev_by_name(s, obj, "uart", map->num_uart);
-    crl_connect_dev_by_name(s, obj, "gem", map->num_gem);
+    crl_connect_dev_by_name(s, obj, "gem", num_gem);
     crl_connect_dev_by_name(s, obj, "usb", map->num_usb);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_abort);
@@ -1568,7 +1699,10 @@ static inline void versal_create_crl(Versal *s)
     memory_region_add_subregion(&s->mr_ps, map->crl.addr,
                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
 
-    versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->crl.irq);
+    if (ver == VERSAL_VER_VERSAL) {
+        /* CRL IRQ line has been removed in versal2 */
+        versal_sysbus_connect_irq(s, SYS_BUS_DEVICE(dev), 0, map->crl.irq);
+    }
 }
 
 /*
@@ -1660,17 +1794,12 @@ static void versal_unimp_irq_parity_imr(void *opaque, int n, int level)
                   "is not yet implemented\n");
 }
 
-static void versal_unimp(Versal *s)
+static void versal_unimp_common(Versal *s)
 {
     DeviceState *slcr;
     qemu_irq gpio_in;
 
-    versal_unimp_area(s, "psm", &s->mr_ps, 0xffc80000, 0x70000);
-    versal_unimp_area(s, "crf", &s->mr_ps, 0xfd1a0000, 0x140000);
-    versal_unimp_area(s, "apu", &s->mr_ps, 0xfd5c0000, 0x100);
     versal_unimp_area(s, "crp", &s->mr_ps, 0xf1260000, 0x10000);
-    versal_unimp_area(s, "iou-scntr", &s->mr_ps, 0xff130000, 0x10000);
-    versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps, 0xff140000, 0x10000);
 
     qdev_init_gpio_in_named(DEVICE(s), versal_unimp_sd_emmc_sel,
                             "sd-emmc-sel-dummy", 2);
@@ -1693,6 +1822,25 @@ static void versal_unimp(Versal *s)
     qdev_connect_gpio_out_named(slcr, SYSBUS_DEVICE_GPIO_IRQ, 0, gpio_in);
 }
 
+static void versal_unimp(Versal *s)
+{
+    versal_unimp_area(s, "psm", &s->mr_ps, 0xffc80000, 0x70000);
+    versal_unimp_area(s, "crf", &s->mr_ps, 0xfd1a0000, 0x140000);
+    versal_unimp_area(s, "apu", &s->mr_ps, 0xfd5c0000, 0x100);
+    versal_unimp_area(s, "iou-scntr", &s->mr_ps, 0xff130000, 0x10000);
+    versal_unimp_area(s, "iou-scntr-secure", &s->mr_ps, 0xff140000, 0x10000);
+
+    versal_unimp_common(s);
+}
+
+static void versal2_unimp(Versal *s)
+{
+    versal_unimp_area(s, "fpd-systmr-ctrl", &s->mr_ps, 0xec920000, 0x1000);
+    versal_unimp_area(s, "crf", &s->mr_ps, 0xec200000, 0x100000);
+
+    versal_unimp_common(s);
+}
+
 static uint32_t fdt_add_clk_node(Versal *s, const char *name,
                                  unsigned int freq_hz)
 {
@@ -1710,9 +1858,8 @@ static uint32_t fdt_add_clk_node(Versal *s, const char *name,
     return phandle;
 }
 
-static void versal_realize(DeviceState *dev, Error **errp)
+static void versal_realize_common(Versal *s)
 {
-    Versal *s = XLNX_VERSAL_BASE(dev);
     DeviceState *slcr, *ospi;
     MemoryRegion *ocm;
     Object *container;
@@ -1787,7 +1934,6 @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_crl(s);
 
     versal_map_ddr(s, &map->ddr);
-    versal_unimp(s);
 
     /* Create the On Chip Memory (OCM).  */
     ocm = g_new(MemoryRegion, 1);
@@ -1795,6 +1941,22 @@ static void versal_realize(DeviceState *dev, Error **errp)
     memory_region_add_subregion_overlap(&s->mr_ps, map->ocm.addr, ocm, 0);
 }
 
+static void versal_realize(DeviceState *dev, Error **errp)
+{
+    Versal *s = XLNX_VERSAL_BASE(dev);
+
+    versal_realize_common(s);
+    versal_unimp(s);
+}
+
+static void versal2_realize(DeviceState *dev, Error **errp)
+{
+    Versal *s = XLNX_VERSAL_BASE(dev);
+
+    versal_realize_common(s);
+    versal2_unimp(s);
+}
+
 DeviceState *versal_get_boot_cpu(Versal *s)
 {
     return DEVICE(versal_get_child_idx(s, "apu-cluster/apu", 0));
@@ -1943,7 +2105,6 @@ static void versal_base_class_init(ObjectClass *klass, const void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
 
-    dc->realize = versal_realize;
     device_class_set_props(dc, versal_properties);
     /* No VMSD since we haven't got any top-level SoC state to save.  */
 }
@@ -1951,8 +2112,19 @@ static void versal_base_class_init(ObjectClass *klass, const void *data)
 static void versal_class_init(ObjectClass *klass, const void *data)
 {
     VersalClass *vc = XLNX_VERSAL_BASE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
 
     vc->version = VERSAL_VER_VERSAL;
+    dc->realize = versal_realize;
+}
+
+static void versal2_class_init(ObjectClass *klass, const void *data)
+{
+    VersalClass *vc = XLNX_VERSAL_BASE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    vc->version = VERSAL_VER_VERSAL2;
+    dc->realize = versal2_realize;
 }
 
 static const TypeInfo versal_base_info = {
@@ -1972,10 +2144,17 @@ static const TypeInfo versal_info = {
     .class_init = versal_class_init,
 };
 
+static const TypeInfo versal2_info = {
+    .name = TYPE_XLNX_VERSAL2,
+    .parent = TYPE_XLNX_VERSAL_BASE,
+    .class_init = versal2_class_init,
+};
+
 static void versal_register_types(void)
 {
     type_register_static(&versal_base_info);
     type_register_static(&versal_info);
+    type_register_static(&versal2_info);
 }
 
 type_init(versal_register_types);
diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index b6cc71f720..e1fb1f4cf5 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -1,5 +1,5 @@
 /*
- * Model of the Xilinx Versal
+ * AMD/Xilinx Versal family SoC model.
  *
  * Copyright (c) 2018 Xilinx Inc.
  * Copyright (c) 2025 Advanced Micro Devices, Inc.
@@ -22,6 +22,7 @@
 OBJECT_DECLARE_TYPE(Versal, VersalClass, XLNX_VERSAL_BASE)
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
+#define TYPE_XLNX_VERSAL2 "xlnx-versal2"
 
 struct Versal {
     /*< private >*/
@@ -72,4 +73,18 @@ int versal_get_num_cpu(VersalVersion version);
 int versal_get_num_can(VersalVersion version);
 int versal_get_num_sdhci(VersalVersion version);
 
+static inline const char *versal_get_class(VersalVersion version)
+{
+    switch (version) {
+    case VERSAL_VER_VERSAL:
+        return TYPE_XLNX_VERSAL;
+
+    case VERSAL_VER_VERSAL2:
+        return TYPE_XLNX_VERSAL2;
+
+    default:
+        g_assert_not_reached();
+    }
+}
+
 #endif

From 84a759c3d24baf13bbf3e95667280758ebb70545 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:07:59 +0200
Subject: [PATCH 1116/2396] hw/arm/xlnx-versal-virt: rename the machine to
 amd-versal-virt
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To align with current branding and ensure coherency with the upcoming
versal2 machine, rename the xlnx-versal-virt machine to amd-versal-virt.
Keep an alias of the old name to the new one for command-line backward
compatibility.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-42-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xlnx-versal-virt.rst         | 26 +++++++++++---------
 hw/arm/xlnx-versal-virt.c                    | 11 ++++++---
 tests/functional/aarch64/test_xlnx_versal.py |  6 ++---
 3 files changed, 25 insertions(+), 18 deletions(-)

diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
index c5f35f28e4..2c63fbf519 100644
--- a/docs/system/arm/xlnx-versal-virt.rst
+++ b/docs/system/arm/xlnx-versal-virt.rst
@@ -1,19 +1,23 @@
-Xilinx Versal Virt (``xlnx-versal-virt``)
-=========================================
+AMD Versal Virt (``amd-versal-virt``)
+=====================================
 
-Xilinx Versal is a family of heterogeneous multi-core SoCs
+AMD Versal is a family of heterogeneous multi-core SoCs
 (System on Chip) that combine traditional hardened CPUs and I/O
 peripherals in a Processing System (PS) with runtime programmable
 FPGA logic (PL) and an Artificial Intelligence Engine (AIE).
 
+QEMU implements the Versal Series variant of Versal SoCs, with the
+``amd-versal-virt`` machine. The alias ``xlnx-versal-virt`` is kept for
+backward compatibility.
+
 More details here:
-https://www.xilinx.com/products/silicon-devices/acap/versal.html
+https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal.html
 
 The family of Versal SoCs share a single architecture but come in
 different parts with different speed grades, amounts of PL and
 other differences.
 
-The Xilinx Versal Virt board in QEMU is a model of a virtual board
+The AMD Versal Virt board in QEMU is a model of a virtual board
 (does not exist in reality) with a virtual Versal SoC without I/O
 limitations. Currently, we support the following cores and devices:
 
@@ -74,7 +78,7 @@ Direct Linux boot of a generic ARM64 upstream Linux kernel:
 
 .. code-block:: bash
 
-  $ qemu-system-aarch64 -M xlnx-versal-virt -m 2G \
+  $ qemu-system-aarch64 -M amd-versal-virt -m 2G \
       -serial mon:stdio -display none \
       -kernel arch/arm64/boot/Image \
       -nic user -nic user \
@@ -87,7 +91,7 @@ Direct Linux boot of PetaLinux 2019.2:
 
 .. code-block:: bash
 
-  $ qemu-system-aarch64  -M xlnx-versal-virt -m 2G \
+  $ qemu-system-aarch64  -M amd-versal-virt -m 2G \
       -serial mon:stdio -display none \
       -kernel petalinux-v2019.2/Image \
       -append "rdinit=/sbin/init console=ttyAMA0,115200n8 earlycon=pl011,mmio,0xFF000000,115200n8" \
@@ -100,7 +104,7 @@ version of ATF tries to configure the CCI which we don't model) and U-boot:
 
 .. code-block:: bash
 
-  $ qemu-system-aarch64 -M xlnx-versal-virt -m 2G \
+  $ qemu-system-aarch64 -M amd-versal-virt -m 2G \
       -serial stdio -display none \
       -device loader,file=petalinux-v2018.3/bl31.elf,cpu-num=0 \
       -device loader,file=petalinux-v2019.2/u-boot.elf \
@@ -125,7 +129,7 @@ Boot Linux as DOM0 on Xen via U-Boot:
 
 .. code-block:: bash
 
-  $ qemu-system-aarch64 -M xlnx-versal-virt -m 4G \
+  $ qemu-system-aarch64 -M amd-versal-virt -m 4G \
       -serial stdio -display none \
       -device loader,file=petalinux-v2019.2/u-boot.elf,cpu-num=0 \
       -device loader,addr=0x30000000,file=linux/2018-04-24/xen \
@@ -153,7 +157,7 @@ Boot Linux as Dom0 on Xen via ARM Trusted Firmware and U-Boot:
 
 .. code-block:: bash
 
-  $ qemu-system-aarch64 -M xlnx-versal-virt -m 4G \
+  $ qemu-system-aarch64 -M amd-versal-virt -m 4G \
       -serial stdio -display none \
       -device loader,file=petalinux-v2018.3/bl31.elf,cpu-num=0 \
       -device loader,file=petalinux-v2019.2/u-boot.elf \
@@ -227,7 +231,7 @@ To use a different index value, N, from default of 1, add:
   is highly recommended (albeit with usage complexity).
 
   Better yet, do not use actual product data when running guest image
-  on this Xilinx Versal Virt board.
+  on this AMD Versal Virt board.
 
 Using CANFDs for Versal Virt
 """"""""""""""""""""""""""""
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 274a7ef988..6ef56103a7 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -1,5 +1,5 @@
 /*
- * Xilinx Versal Virtual board.
+ * AMD/Xilinx Versal Virtual board.
  *
  * Copyright (c) 2018 Xilinx Inc.
  * Copyright (c) 2025 Advanced Micro Devices, Inc.
@@ -26,7 +26,7 @@
 #include "qom/object.h"
 #include "target/arm/cpu.h"
 
-#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
+#define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("amd-versal-virt")
 OBJECT_DECLARE_SIMPLE_TYPE(VersalVirt, XLNX_VERSAL_VIRT_MACHINE)
 
 #define XLNX_VERSAL_NUM_OSPI_FLASH 4
@@ -55,6 +55,7 @@ struct VersalVirt {
 static void fdt_create(VersalVirt *s)
 {
     MachineClass *mc = MACHINE_GET_CLASS(s);
+    const char versal_compat[] = "amd-versal-virt\0xlnx-versal-virt";
 
     s->fdt = create_device_tree(&s->fdt_size);
     if (!s->fdt) {
@@ -72,7 +73,8 @@ static void fdt_create(VersalVirt *s)
 
     /* Header */
     qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
-    qemu_fdt_setprop_string(s->fdt, "/", "compatible", "xlnx-versal-virt");
+    qemu_fdt_setprop(s->fdt, "/", "compatible", versal_compat,
+                     sizeof(versal_compat));
 }
 
 static void fdt_add_clk_node(VersalVirt *s, const char *name,
@@ -348,7 +350,8 @@ static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     int num_cpu = versal_get_num_cpu(VERSAL_VER_VERSAL);
 
-    mc->desc = "Xilinx Versal Virtual development board";
+    mc->desc = "AMD Versal Virtual development board";
+    mc->alias = "xlnx-versal-virt";
     mc->init = versal_virt_init;
     mc->min_cpus = num_cpu;
     mc->max_cpus = num_cpu;
diff --git a/tests/functional/aarch64/test_xlnx_versal.py b/tests/functional/aarch64/test_xlnx_versal.py
index 4b9c49e5d6..95e5c44771 100755
--- a/tests/functional/aarch64/test_xlnx_versal.py
+++ b/tests/functional/aarch64/test_xlnx_versal.py
@@ -6,7 +6,7 @@
 
 from qemu_test import LinuxKernelTest, Asset
 
-class XlnxVersalVirtMachine(LinuxKernelTest):
+class AmdVersalVirtMachine(LinuxKernelTest):
 
     ASSET_KERNEL = Asset(
         ('http://ports.ubuntu.com/ubuntu-ports/dists/bionic-updates/main/'
@@ -20,8 +20,8 @@ class XlnxVersalVirtMachine(LinuxKernelTest):
          '/ubuntu-installer/arm64/initrd.gz'),
         'e7a5e716b6f516d8be315c06e7331aaf16994fe4222e0e7cfb34bc015698929e')
 
-    def test_aarch64_xlnx_versal_virt(self):
-        self.set_machine('xlnx-versal-virt')
+    def test_aarch64_amd_versal_virt(self):
+        self.set_machine('amd-versal-virt')
         kernel_path = self.ASSET_KERNEL.fetch()
         initrd_path = self.ASSET_INITRD.fetch()
 

From ea7028b87b62c4e93f4c2455760253a224626773 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:00 +0200
Subject: [PATCH 1117/2396] hw/arm/xlnx-versal-virt: split into base/concrete
 classes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Split the xlnx-versal-virt machine type into a base abstract type and a
concrete type. There is no functional change. This is in preparation for
the versal2 machine.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-43-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 74 +++++++++++++++++++++++++++------------
 1 file changed, 52 insertions(+), 22 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 6ef56103a7..f9abb9ed63 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -26,8 +26,11 @@
 #include "qom/object.h"
 #include "target/arm/cpu.h"
 
+#define TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE \
+    MACHINE_TYPE_NAME("amd-versal-virt-base")
+OBJECT_DECLARE_TYPE(VersalVirt, VersalVirtClass, XLNX_VERSAL_VIRT_BASE_MACHINE)
+
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("amd-versal-virt")
-OBJECT_DECLARE_SIMPLE_TYPE(VersalVirt, XLNX_VERSAL_VIRT_MACHINE)
 
 #define XLNX_VERSAL_NUM_OSPI_FLASH 4
 
@@ -52,6 +55,12 @@ struct VersalVirt {
     } cfg;
 };
 
+struct VersalVirtClass {
+    MachineClass parent_class;
+
+    VersalVersion version;
+};
+
 static void fdt_create(VersalVirt *s)
 {
     MachineClass *mc = MACHINE_GET_CLASS(s);
@@ -193,14 +202,14 @@ static void sd_plug_card(VersalVirt *s, int idx, DriveInfo *di)
 
 static char *versal_get_ospi_model(Object *obj, Error **errp)
 {
-    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
+    VersalVirt *s = XLNX_VERSAL_VIRT_BASE_MACHINE(obj);
 
     return g_strdup(s->cfg.ospi_model);
 }
 
 static void versal_set_ospi_model(Object *obj, const char *value, Error **errp)
 {
-    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
+    VersalVirt *s = XLNX_VERSAL_VIRT_BASE_MACHINE(obj);
 
     g_free(s->cfg.ospi_model);
     s->cfg.ospi_model = g_strdup(value);
@@ -209,7 +218,8 @@ static void versal_set_ospi_model(Object *obj, const char *value, Error **errp)
 
 static void versal_virt_init(MachineState *machine)
 {
-    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(machine);
+    VersalVirt *s = XLNX_VERSAL_VIRT_BASE_MACHINE(machine);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_GET_CLASS(machine);
     int psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
     int i;
 
@@ -241,11 +251,11 @@ static void versal_virt_init(MachineState *machine)
     }
 
     object_initialize_child(OBJECT(machine), "xlnx-versal", &s->soc,
-                            TYPE_XLNX_VERSAL);
+                            versal_get_class(vvc->version));
     object_property_set_link(OBJECT(&s->soc), "ddr", OBJECT(machine->ram),
                              &error_abort);
 
-    for (i = 0; i < versal_get_num_can(VERSAL_VER_VERSAL); i++) {
+    for (i = 0; i < versal_get_num_can(vvc->version); i++) {
         g_autofree char *prop_name = g_strdup_printf("canbus%d", i);
 
         object_property_set_link(OBJECT(&s->soc), prop_name,
@@ -274,7 +284,7 @@ static void versal_virt_init(MachineState *machine)
     efuse_attach_drive(s);
 
     /* Plug SD cards */
-    for (i = 0; i < versal_get_num_sdhci(VERSAL_VER_VERSAL); i++) {
+    for (i = 0; i < versal_get_num_sdhci(vvc->version); i++) {
         sd_plug_card(s, i, drive_get(IF_SD, 0, i));
     }
 
@@ -318,10 +328,11 @@ static void versal_virt_init(MachineState *machine)
 
 static void versal_virt_machine_instance_init(Object *obj)
 {
-    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
+    VersalVirt *s = XLNX_VERSAL_VIRT_BASE_MACHINE(obj);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_GET_CLASS(s);
     size_t i, num_can;
 
-    num_can = versal_get_num_can(VERSAL_VER_VERSAL);
+    num_can = versal_get_num_can(vvc->version);
     s->canbus = g_new0(CanBusState *, num_can);
 
     /*
@@ -339,45 +350,64 @@ static void versal_virt_machine_instance_init(Object *obj)
 
 static void versal_virt_machine_finalize(Object *obj)
 {
-    VersalVirt *s = XLNX_VERSAL_VIRT_MACHINE(obj);
+    VersalVirt *s = XLNX_VERSAL_VIRT_BASE_MACHINE(obj);
 
     g_free(s->cfg.ospi_model);
     g_free(s->canbus);
 }
 
-static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
+static void versal_virt_machine_class_init_common(ObjectClass *oc)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-    int num_cpu = versal_get_num_cpu(VERSAL_VER_VERSAL);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_CLASS(mc);
+    int num_cpu = versal_get_num_cpu(vvc->version);
 
-    mc->desc = "AMD Versal Virtual development board";
-    mc->alias = "xlnx-versal-virt";
-    mc->init = versal_virt_init;
-    mc->min_cpus = num_cpu;
-    mc->max_cpus = num_cpu;
-    mc->default_cpus = num_cpu;
     mc->no_cdrom = true;
     mc->auto_create_sdcard = true;
     mc->default_ram_id = "ddr";
+    mc->min_cpus = num_cpu;
+    mc->max_cpus = num_cpu;
+    mc->default_cpus = num_cpu;
+    mc->init = versal_virt_init;
+
     object_class_property_add_str(oc, "ospi-flash", versal_get_ospi_model,
                                    versal_set_ospi_model);
     object_class_property_set_description(oc, "ospi-flash",
                                           "Change the OSPI Flash model");
 }
 
-static const TypeInfo versal_virt_machine_init_typeinfo = {
-    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
+static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_CLASS(oc);
+
+    mc->desc = "AMD Versal Virtual development board";
+    mc->alias = "xlnx-versal-virt";
+    vvc->version = VERSAL_VER_VERSAL;
+
+    versal_virt_machine_class_init_common(oc);
+}
+
+static const TypeInfo versal_virt_base_machine_init_typeinfo = {
+    .name       = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
     .parent     = TYPE_MACHINE,
-    .class_init = versal_virt_machine_class_init,
+    .class_size = sizeof(VersalVirtClass),
     .instance_init = versal_virt_machine_instance_init,
     .instance_size = sizeof(VersalVirt),
     .instance_finalize = versal_virt_machine_finalize,
+    .abstract = true,
+};
+
+static const TypeInfo versal_virt_machine_init_typeinfo = {
+    .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
+    .parent     = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
+    .class_init = versal_virt_machine_class_init,
 };
 
 static void versal_virt_machine_init_register_types(void)
 {
+    type_register_static(&versal_virt_base_machine_init_typeinfo);
     type_register_static(&versal_virt_machine_init_typeinfo);
 }
 
 type_init(versal_virt_machine_init_register_types)
-

From e2e9b9e129f484398326f262de2933a3db3f8c62 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:01 +0200
Subject: [PATCH 1118/2396] hw/arm/xlnx-versal-virt: tidy up
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove now unused clock nodes. They have been replaced by the ones
created in the SoC. Remove the unused cfg.secure VersalVirt field.
Remove unecessary include directives.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-44-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 25 -------------------------
 1 file changed, 25 deletions(-)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index f9abb9ed63..14c2d5cc92 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -19,10 +19,8 @@
 #include "hw/boards.h"
 #include "hw/sysbus.h"
 #include "hw/arm/fdt.h"
-#include "hw/qdev-properties.h"
 #include "hw/arm/xlnx-versal.h"
 #include "hw/arm/boot.h"
-#include "target/arm/multiprocessing.h"
 #include "qom/object.h"
 #include "target/arm/cpu.h"
 
@@ -41,16 +39,11 @@ struct VersalVirt {
 
     void *fdt;
     int fdt_size;
-    struct {
-        uint32_t clk_125Mhz;
-        uint32_t clk_25Mhz;
-    } phandle;
     struct arm_boot_info binfo;
 
     CanBusState **canbus;
 
     struct {
-        bool secure;
         char *ospi_model;
     } cfg;
 };
@@ -72,10 +65,6 @@ static void fdt_create(VersalVirt *s)
         exit(1);
     }
 
-    /* Allocate all phandles.  */
-    s->phandle.clk_25Mhz = qemu_fdt_alloc_phandle(s->fdt);
-    s->phandle.clk_125Mhz = qemu_fdt_alloc_phandle(s->fdt);
-
     /* Create /chosen node for load_dtb.  */
     qemu_fdt_add_subnode(s->fdt, "/chosen");
     qemu_fdt_add_subnode(s->fdt, "/aliases");
@@ -86,17 +75,6 @@ static void fdt_create(VersalVirt *s)
                      sizeof(versal_compat));
 }
 
-static void fdt_add_clk_node(VersalVirt *s, const char *name,
-                             unsigned int freq_hz, uint32_t phandle)
-{
-    qemu_fdt_add_subnode(s->fdt, name);
-    qemu_fdt_setprop_cell(s->fdt, name, "phandle", phandle);
-    qemu_fdt_setprop_cell(s->fdt, name, "clock-frequency", freq_hz);
-    qemu_fdt_setprop_cell(s->fdt, name, "#clock-cells", 0x0);
-    qemu_fdt_setprop_string(s->fdt, name, "compatible", "fixed-clock");
-    qemu_fdt_setprop(s->fdt, name, "u-boot,dm-pre-reloc", NULL, 0);
-}
-
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
 {
     Error *err = NULL;
@@ -268,9 +246,6 @@ static void versal_virt_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
     create_virtio_regions(s);
 
-    fdt_add_clk_node(s, "/old-clk125", 125000000, s->phandle.clk_125Mhz);
-    fdt_add_clk_node(s, "/old-clk25", 25000000, s->phandle.clk_25Mhz);
-
     /*
      * Map the SoC address space onto system memory. This will allow virtio and
      * other modules unaware of multiple address-spaces to work.

From 0ec8c4296d48efc0a9ee7ac7bdc7523b793de4bd Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:02 +0200
Subject: [PATCH 1119/2396] docs/system/arm/xlnx-versal-virt: update supported
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the list of supported devices in the Versal SoCs.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-45-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xlnx-versal-virt.rst | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
index 2c63fbf519..94c8bacf61 100644
--- a/docs/system/arm/xlnx-versal-virt.rst
+++ b/docs/system/arm/xlnx-versal-virt.rst
@@ -23,11 +23,11 @@ limitations. Currently, we support the following cores and devices:
 
 Implemented CPU cores:
 
-- 2 ACPUs (ARM Cortex-A72)
+- 2 ACPUs (ARM Cortex-A72) with their GICv3 and ITS
+- 2 RCPUs (ARM Cortex-R5F) with their GICv2
 
 Implemented devices:
 
-- Interrupt controller (ARM GICv3)
 - 2 UARTs (ARM PL011)
 - An RTC (Versal built-in)
 - 2 GEMs (Cadence MACB Ethernet MACs)
@@ -39,6 +39,9 @@ Implemented devices:
 - BBRAM (36 bytes of Battery-backed RAM)
 - eFUSE (3072 bytes of one-time field-programmable bit array)
 - 2 CANFDs
+- USB controller
+- OSPI controller
+- TRNG controller
 
 QEMU does not yet model any other devices, including the PL and the AI Engine.
 

From 39cf696fc57a74a40beafaa1d341d4ef9b41bbd0 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:03 +0200
Subject: [PATCH 1120/2396] docs/system/arm/xlnx-versal-virt: add a note about
 dumpdtb
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a note in the DTB section explaining how to dump the generated DTB
using the dumpdtb machine option.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-46-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xlnx-versal-virt.rst | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
index 94c8bacf61..5d7fa18592 100644
--- a/docs/system/arm/xlnx-versal-virt.rst
+++ b/docs/system/arm/xlnx-versal-virt.rst
@@ -65,7 +65,13 @@ When loading an OS, QEMU generates a DTB and selects an appropriate address
 where it gets loaded. This DTB will be passed to the kernel in register x0.
 
 If there's no ``-kernel`` option, we generate a DTB and place it at 0x1000
-for boot-loaders or firmware to pick it up.
+for boot-loaders or firmware to pick it up. To dump and observe the generated
+DTB, one can use the ``dumpdtb`` machine option:
+
+.. code-block:: bash
+
+  $ qemu-system-aarch64 -M amd-versal-virt,dumpdtb=example.dtb -m 2G
+
 
 If users want to provide their own DTB, they can use the ``-dtb`` option.
 These DTBs will have their memory nodes modified to match QEMU's

From 3429cdd8bfe6ee8239ea19d0f8211c671832e44b Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:04 +0200
Subject: [PATCH 1121/2396] hw/arm/xlnx-versal-virt: add the xlnx-versal2-virt
 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the Versal Gen 2 Virtual development machine embedding a
versal2 SoC. This machine follows the same principle than the
xlnx-versal-virt machine. It creates its own DTB and feeds it to the
software payload. This way only implemented devices are exposed to the
guest and the user does not need to provide a DTB.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-47-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/xlnx-versal-virt.rst | 49 ++++++++++++++++++++++++----
 hw/arm/xlnx-versal-virt.c            | 37 +++++++++++++++++++--
 2 files changed, 76 insertions(+), 10 deletions(-)

diff --git a/docs/system/arm/xlnx-versal-virt.rst b/docs/system/arm/xlnx-versal-virt.rst
index 5d7fa18592..640cc07f80 100644
--- a/docs/system/arm/xlnx-versal-virt.rst
+++ b/docs/system/arm/xlnx-versal-virt.rst
@@ -1,14 +1,16 @@
-AMD Versal Virt (``amd-versal-virt``)
-=====================================
+AMD Versal Virt (``amd-versal-virt``, ``amd-versal2-virt``)
+===========================================================
 
 AMD Versal is a family of heterogeneous multi-core SoCs
 (System on Chip) that combine traditional hardened CPUs and I/O
 peripherals in a Processing System (PS) with runtime programmable
 FPGA logic (PL) and an Artificial Intelligence Engine (AIE).
 
-QEMU implements the Versal Series variant of Versal SoCs, with the
-``amd-versal-virt`` machine. The alias ``xlnx-versal-virt`` is kept for
-backward compatibility.
+QEMU implements the following Versal SoCs variants:
+
+- Versal (the ``amd-versal-virt`` machine, the alias ``xlnx-versal-virt`` is
+  kept for backward compatibility)
+- Versal Gen 2 (the ``amd-versal2-virt`` machine)
 
 More details here:
 https://www.amd.com/en/products/adaptive-socs-and-fpgas/versal.html
@@ -21,6 +23,8 @@ The AMD Versal Virt board in QEMU is a model of a virtual board
 (does not exist in reality) with a virtual Versal SoC without I/O
 limitations. Currently, we support the following cores and devices:
 
+Versal
+""""""
 Implemented CPU cores:
 
 - 2 ACPUs (ARM Cortex-A72) with their GICv3 and ITS
@@ -43,6 +47,28 @@ Implemented devices:
 - OSPI controller
 - TRNG controller
 
+Versal Gen 2
+""""""""""""
+Implemented CPU cores:
+
+- 8 ACPUs (ARM Cortex-A78AE) with their GICv3 and ITS
+- 10 RCPUs (ARM Cortex-R52) with their GICv3 (one per cluster)
+
+Implemented devices:
+
+- 2 UARTs (ARM PL011)
+- An RTC (Versal built-in)
+- 3 GEMs (Cadence MACB Ethernet MACs)
+- 8 ADMA (Xilinx zDMA) channels
+- 2 SD Controllers
+- OCM (256KB of On Chip Memory)
+- DDR memory
+- BBRAM (36 bytes of Battery-backed RAM)
+- 2 CANFDs
+- 2 USB controllers
+- OSPI controller
+- TRNG controller
+
 QEMU does not yet model any other devices, including the PL and the AI Engine.
 
 Other differences between the hardware and the QEMU model:
@@ -51,8 +77,8 @@ Other differences between the hardware and the QEMU model:
   ``-m`` argument. If a DTB is provided on the command line then QEMU will
   edit it to include suitable entries describing the Versal DDR memory ranges.
 
-- QEMU provides 8 virtio-mmio virtio transports; these start at
-  address ``0xa0000000`` and have IRQs from 111 and upwards.
+- QEMU provides 8 virtio-mmio virtio transports. They use reserved memory
+  regions and IRQ pins to avoid conflicts with real SoC peripherals.
 
 Running
 """""""
@@ -214,6 +240,11 @@ To use a different index value, N, from default of 0, add:
 
 eFUSE File Backend
 """"""""""""""""""
+
+.. note::
+   The eFUSE device is not implemented in the Versal Gen 2 QEMU model
+   yet.
+
 eFUSE can have an optional file backend, which must be a seekable
 binary file with a size of 3072 bytes or larger. A file with all
 binary 0s is a 'blank'.
@@ -271,3 +302,7 @@ To connect CANFD0 and CANFD1 to host machine's CAN interface can0:
 
     -object can-bus,id=canbus -machine canbus0=canbus -machine canbus1=canbus
     -object can-host-socketcan,id=canhost0,if=can0,canbus=canbus
+
+.. note::
+   Versal Gen 2 has 4 CAN controllers. ``canbus0`` to ``canbus3`` can
+   be specified on the command line.
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 14c2d5cc92..149b448546 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -1,5 +1,5 @@
 /*
- * AMD/Xilinx Versal Virtual board.
+ * AMD/Xilinx Versal family Virtual board.
  *
  * Copyright (c) 2018 Xilinx Inc.
  * Copyright (c) 2025 Advanced Micro Devices, Inc.
@@ -29,6 +29,7 @@
 OBJECT_DECLARE_TYPE(VersalVirt, VersalVirtClass, XLNX_VERSAL_VIRT_BASE_MACHINE)
 
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("amd-versal-virt")
+#define TYPE_XLNX_VERSAL2_VIRT_MACHINE MACHINE_TYPE_NAME("amd-versal2-virt")
 
 #define XLNX_VERSAL_NUM_OSPI_FLASH 4
 
@@ -57,7 +58,9 @@ struct VersalVirtClass {
 static void fdt_create(VersalVirt *s)
 {
     MachineClass *mc = MACHINE_GET_CLASS(s);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_GET_CLASS(s);
     const char versal_compat[] = "amd-versal-virt\0xlnx-versal-virt";
+    const char versal2_compat[] = "amd-versal2-virt";
 
     s->fdt = create_device_tree(&s->fdt_size);
     if (!s->fdt) {
@@ -71,8 +74,18 @@ static void fdt_create(VersalVirt *s)
 
     /* Header */
     qemu_fdt_setprop_string(s->fdt, "/", "model", mc->desc);
-    qemu_fdt_setprop(s->fdt, "/", "compatible", versal_compat,
-                     sizeof(versal_compat));
+
+    switch (vvc->version) {
+    case VERSAL_VER_VERSAL:
+        qemu_fdt_setprop(s->fdt, "/", "compatible", versal_compat,
+                         sizeof(versal_compat));
+        break;
+
+    case VERSAL_VER_VERSAL2:
+        qemu_fdt_setprop(s->fdt, "/", "compatible", versal2_compat,
+                         sizeof(versal2_compat));
+        break;
+    }
 }
 
 static void fdt_nop_memory_nodes(void *fdt, Error **errp)
@@ -363,6 +376,17 @@ static void versal_virt_machine_class_init(ObjectClass *oc, const void *data)
     versal_virt_machine_class_init_common(oc);
 }
 
+static void versal2_virt_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    VersalVirtClass *vvc = XLNX_VERSAL_VIRT_BASE_MACHINE_CLASS(oc);
+
+    mc->desc = "AMD Versal Gen 2 Virtual development board";
+    vvc->version = VERSAL_VER_VERSAL2;
+
+    versal_virt_machine_class_init_common(oc);
+}
+
 static const TypeInfo versal_virt_base_machine_init_typeinfo = {
     .name       = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
     .parent     = TYPE_MACHINE,
@@ -379,10 +403,17 @@ static const TypeInfo versal_virt_machine_init_typeinfo = {
     .class_init = versal_virt_machine_class_init,
 };
 
+static const TypeInfo versal2_virt_machine_init_typeinfo = {
+    .name       = TYPE_XLNX_VERSAL2_VIRT_MACHINE,
+    .parent     = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
+    .class_init = versal2_virt_machine_class_init,
+};
+
 static void versal_virt_machine_init_register_types(void)
 {
     type_register_static(&versal_virt_base_machine_init_typeinfo);
     type_register_static(&versal_virt_machine_init_typeinfo);
+    type_register_static(&versal2_virt_machine_init_typeinfo);
 }
 
 type_init(versal_virt_machine_init_register_types)

From f1924af144115a159f854500f134c3769ec388df Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 26 Sep 2025 09:08:05 +0200
Subject: [PATCH 1122/2396] tests/functional/test_aarch64_xlnx_versal: test the
 versal2 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a test for the amd-versal2-virt machine using the same command line,
kernel, initrd than the ones used for amd-versal-virt.

Signed-off-by: Luc Michel <luc.michel@amd.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250926070806.292065-48-luc.michel@amd.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/aarch64/test_xlnx_versal.py | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/tests/functional/aarch64/test_xlnx_versal.py b/tests/functional/aarch64/test_xlnx_versal.py
index 95e5c44771..45aa6e1b88 100755
--- a/tests/functional/aarch64/test_xlnx_versal.py
+++ b/tests/functional/aarch64/test_xlnx_versal.py
@@ -20,8 +20,8 @@ class AmdVersalVirtMachine(LinuxKernelTest):
          '/ubuntu-installer/arm64/initrd.gz'),
         'e7a5e716b6f516d8be315c06e7331aaf16994fe4222e0e7cfb34bc015698929e')
 
-    def test_aarch64_amd_versal_virt(self):
-        self.set_machine('amd-versal-virt')
+    def common_aarch64_amd_versal_virt(self, machine):
+        self.set_machine(machine)
         kernel_path = self.ASSET_KERNEL.fetch()
         initrd_path = self.ASSET_INITRD.fetch()
 
@@ -33,5 +33,11 @@ class AmdVersalVirtMachine(LinuxKernelTest):
         self.vm.launch()
         self.wait_for_console_pattern('Checked W+X mappings: passed')
 
+    def test_aarch64_amd_versal_virt(self):
+        self.common_aarch64_amd_versal_virt('amd-versal-virt')
+
+    def test_aarch64_amd_versal2_virt(self):
+        self.common_aarch64_amd_versal_virt('amd-versal2-virt')
+
 if __name__ == '__main__':
     LinuxKernelTest.main()

From b94246a252a3c04424269928a465d3fac02115e8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
Date: Tue, 30 Sep 2025 13:57:16 +0200
Subject: [PATCH 1123/2396] hw/arm/xlnx-zynqmp: move GIC_NUM_SPI_INTR define in
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This define will be needed in a later patch in XlnxZynqMPState
structure, hence move it within xlnx-zynqmp header.

Add XLXN_ZYNQMP prefix as it's now public.

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-id: 20250930115718.437100-2-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c         | 11 +++++------
 include/hw/arm/xlnx-zynqmp.h |  1 +
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index ec96a46eec..d7adc070f8 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -26,8 +26,6 @@
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
 
-#define GIC_NUM_SPI_INTR 160
-
 #define ARM_PHYS_TIMER_PPI  30
 #define ARM_VIRT_TIMER_PPI  27
 #define ARM_HYP_TIMER_PPI   26
@@ -206,7 +204,7 @@ static const XlnxZynqMPGICRegion xlnx_zynqmp_gic_regions[] = {
 
 static inline int arm_gic_ppi_index(int cpu_nr, int ppi_index)
 {
-    return GIC_NUM_SPI_INTR + cpu_nr * GIC_INTERNAL + ppi_index;
+    return XLNX_ZYNQMP_GIC_NUM_SPI_INTR + cpu_nr * GIC_INTERNAL + ppi_index;
 }
 
 static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
@@ -454,7 +452,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     int num_apus = MIN(ms->smp.cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
     const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
     ram_addr_t ddr_low_size, ddr_high_size;
-    qemu_irq gic_spi[GIC_NUM_SPI_INTR];
+    qemu_irq gic_spi[XLNX_ZYNQMP_GIC_NUM_SPI_INTR];
     Error *err = NULL;
 
     ram_size = memory_region_size(s->ddr_ram);
@@ -502,7 +500,8 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         g_free(ocm_name);
     }
 
-    qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq",
+                         XLNX_ZYNQMP_GIC_NUM_SPI_INTR + 32);
     qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
     qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
     qdev_prop_set_bit(DEVICE(&s->gic), "has-security-extensions", s->secure);
@@ -613,7 +612,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    for (i = 0; i < GIC_NUM_SPI_INTR; i++) {
+    for (i = 0; i < XLNX_ZYNQMP_GIC_NUM_SPI_INTR; i++) {
         gic_spi[i] = qdev_get_gpio_in(DEVICE(&s->gic), i);
     }
 
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index c137ac59e8..6a407c2962 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -67,6 +67,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
 #define XLNX_ZYNQMP_OCM_RAM_SIZE 0x10000
 
 #define XLNX_ZYNQMP_GIC_REGIONS 6
+#define XLNX_ZYNQMP_GIC_NUM_SPI_INTR 160
 
 /*
  * ZynqMP maps the ARM GIC regions (GICC, GICD ...) at consecutive 64k offsets

From f51ad36255516a5d41e05734e918b32885923151 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20Chigot?= <chigot@adacore.com>
Date: Tue, 30 Sep 2025 13:57:17 +0200
Subject: [PATCH 1124/2396] hw/arm/xlnx-zynqmp: introduce helper to compute RPU
 number
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This helper will avoid repeating the MIN/MAX formula everytime the
number of RPUs available is requested.

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-id: 20250930115718.437100-3-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index d7adc070f8..3d8c46986e 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -207,14 +207,23 @@ static inline int arm_gic_ppi_index(int cpu_nr, int ppi_index)
     return XLNX_ZYNQMP_GIC_NUM_SPI_INTR + cpu_nr * GIC_INTERNAL + ppi_index;
 }
 
+static unsigned int xlnx_zynqmp_get_rpu_number(MachineState *ms)
+{
+    /*
+     * RPUs will be created only if "-smp" is higher than the maximum
+     * of APUs. Round it up to 0 to avoid dealing with negative values.
+     */
+    return MAX(0, MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
+                      XLNX_ZYNQMP_NUM_RPU_CPUS));
+}
+
 static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
                                    const char *boot_cpu, Error **errp)
 {
     int i;
-    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
-                       XLNX_ZYNQMP_NUM_RPU_CPUS);
+    int num_rpus = xlnx_zynqmp_get_rpu_number(ms);
 
-    if (num_rpus <= 0) {
+    if (!num_rpus) {
         /* Don't create rpu-cluster object if there's nothing to put in it */
         return;
     }

From e836211f7df4b7102f571a33bf01722c9b9bd8b8 Mon Sep 17 00:00:00 2001
From: Frederic Konrad <konrad.frederic@yahoo.fr>
Date: Tue, 30 Sep 2025 13:57:18 +0200
Subject: [PATCH 1125/2396] hw/arm/xlnx-zynqmp: wire a second GIC for the
 Cortex-R5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This wires a second GIC for the Cortex-R5, all the IRQs are split when there
is an RPU instanciated.

Signed-off-by: Clément Chigot <chigot@adacore.com>
Acked-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-id: 20250930115718.437100-4-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c         | 77 +++++++++++++++++++++++++++++++++++-
 include/hw/arm/xlnx-zynqmp.h |  4 ++
 2 files changed, 80 insertions(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index 3d8c46986e..ffed6e5126 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -384,6 +384,7 @@ static void xlnx_zynqmp_init(Object *obj)
     XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
     int i;
     int num_apus = MIN(ms->smp.cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
+    int num_rpus = xlnx_zynqmp_get_rpu_number(ms);
 
     object_initialize_child(obj, "apu-cluster", &s->apu_cluster,
                             TYPE_CPU_CLUSTER);
@@ -397,6 +398,12 @@ static void xlnx_zynqmp_init(Object *obj)
 
     object_initialize_child(obj, "gic", &s->gic, gic_class_name());
 
+    if (num_rpus) {
+        /* Do not create the rpu_gic if we don't have rpus */
+        object_initialize_child(obj, "rpu_gic", &s->rpu_gic,
+                                gic_class_name());
+    }
+
     for (i = 0; i < XLNX_ZYNQMP_NUM_GEMS; i++) {
         object_initialize_child(obj, "gem[*]", &s->gem[i], TYPE_CADENCE_GEM);
         object_initialize_child(obj, "gem-irq-orgate[*]",
@@ -446,6 +453,15 @@ static void xlnx_zynqmp_init(Object *obj)
     object_initialize_child(obj, "qspi-irq-orgate",
                             &s->qspi_irq_orgate, TYPE_OR_IRQ);
 
+    if (num_rpus) {
+        for (i = 0; i < ARRAY_SIZE(s->splitter); i++) {
+            g_autofree char *name = g_strdup_printf("irq-splitter%d", i);
+            object_initialize_child(obj, name, &s->splitter[i], TYPE_SPLIT_IRQ);
+        }
+    }
+
+
+
     for (i = 0; i < XLNX_ZYNQMP_NUM_USB; i++) {
         object_initialize_child(obj, "usb[*]", &s->usb[i], TYPE_USB_DWC3);
     }
@@ -459,6 +475,7 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     uint8_t i;
     uint64_t ram_size;
     int num_apus = MIN(ms->smp.cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
+    int num_rpus = xlnx_zynqmp_get_rpu_number(ms);
     const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
     ram_addr_t ddr_low_size, ddr_high_size;
     qemu_irq gic_spi[XLNX_ZYNQMP_GIC_NUM_SPI_INTR];
@@ -517,6 +534,14 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     qdev_prop_set_bit(DEVICE(&s->gic),
                       "has-virtualization-extensions", s->virt);
 
+    if (num_rpus) {
+        qdev_prop_set_uint32(DEVICE(&s->rpu_gic), "num-irq",
+                             XLNX_ZYNQMP_GIC_NUM_SPI_INTR + 32);
+        qdev_prop_set_uint32(DEVICE(&s->rpu_gic), "revision", 1);
+        qdev_prop_set_uint32(DEVICE(&s->rpu_gic), "num-cpu", num_rpus);
+        qdev_prop_set_uint32(DEVICE(&s->rpu_gic), "first-cpu-index", 4);
+    }
+
     qdev_realize(DEVICE(&s->apu_cluster), NULL, &error_fatal);
 
     /* Realize APUs before realizing the GIC. KVM requires this.  */
@@ -616,13 +641,63 @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (num_rpus) {
+        if (!sysbus_realize(SYS_BUS_DEVICE(&s->rpu_gic), errp)) {
+            return;
+        }
+
+        for (i = 0; i < num_rpus; i++) {
+            qemu_irq irq;
+
+            sysbus_mmio_map(SYS_BUS_DEVICE(&s->rpu_gic), i + 1,
+                            GIC_BASE_ADDR + i * 0x1000);
+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->rpu_gic), i,
+                               qdev_get_gpio_in(DEVICE(&s->rpu_cpu[i]),
+                                                ARM_CPU_IRQ));
+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->rpu_gic), i + num_rpus,
+                               qdev_get_gpio_in(DEVICE(&s->rpu_cpu[i]),
+                                                ARM_CPU_FIQ));
+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->rpu_gic), i + num_rpus * 2,
+                               qdev_get_gpio_in(DEVICE(&s->rpu_cpu[i]),
+                                                ARM_CPU_VIRQ));
+            sysbus_connect_irq(SYS_BUS_DEVICE(&s->rpu_gic), i + num_rpus * 3,
+                               qdev_get_gpio_in(DEVICE(&s->rpu_cpu[i]),
+                                                ARM_CPU_VFIQ));
+            irq = qdev_get_gpio_in(DEVICE(&s->rpu_gic),
+                                   arm_gic_ppi_index(i, ARM_PHYS_TIMER_PPI));
+            qdev_connect_gpio_out(DEVICE(&s->rpu_cpu[i]), GTIMER_PHYS, irq);
+            irq = qdev_get_gpio_in(DEVICE(&s->rpu_gic),
+                                   arm_gic_ppi_index(i, ARM_VIRT_TIMER_PPI));
+            qdev_connect_gpio_out(DEVICE(&s->rpu_cpu[i]), GTIMER_VIRT, irq);
+            irq = qdev_get_gpio_in(DEVICE(&s->rpu_gic),
+                                   arm_gic_ppi_index(i, ARM_HYP_TIMER_PPI));
+            qdev_connect_gpio_out(DEVICE(&s->rpu_cpu[i]), GTIMER_HYP, irq);
+            irq = qdev_get_gpio_in(DEVICE(&s->rpu_gic),
+                                   arm_gic_ppi_index(i, ARM_SEC_TIMER_PPI));
+            qdev_connect_gpio_out(DEVICE(&s->rpu_cpu[i]), GTIMER_SEC, irq);
+        }
+
+        sysbus_mmio_map(SYS_BUS_DEVICE(&s->rpu_gic), 0, GIC_BASE_ADDR);
+    }
+
     if (!s->boot_cpu_ptr) {
         error_setg(errp, "ZynqMP Boot cpu %s not found", boot_cpu);
         return;
     }
 
     for (i = 0; i < XLNX_ZYNQMP_GIC_NUM_SPI_INTR; i++) {
-        gic_spi[i] = qdev_get_gpio_in(DEVICE(&s->gic), i);
+        if (num_rpus) {
+            DeviceState *splitter = DEVICE(&s->splitter[i]);
+            qdev_prop_set_uint16(splitter, "num-lines", 2);
+            qdev_realize(splitter, NULL, &error_abort);
+            gic_spi[i] = qdev_get_gpio_in(splitter, 0);
+            qdev_connect_gpio_out(splitter, 0,
+                                  qdev_get_gpio_in(DEVICE(&s->gic), i));
+            qdev_connect_gpio_out(splitter, 1,
+                                  qdev_get_gpio_in(DEVICE(&s->rpu_gic), i));
+        } else {
+            gic_spi[i] = qdev_get_gpio_in(DEVICE(&s->gic), i);
+        }
     }
 
     for (i = 0; i < XLNX_ZYNQMP_NUM_GEMS; i++) {
diff --git a/include/hw/arm/xlnx-zynqmp.h b/include/hw/arm/xlnx-zynqmp.h
index 6a407c2962..a3117bd6c5 100644
--- a/include/hw/arm/xlnx-zynqmp.h
+++ b/include/hw/arm/xlnx-zynqmp.h
@@ -42,6 +42,7 @@
 #include "hw/misc/xlnx-zynqmp-crf.h"
 #include "hw/timer/cadence_ttc.h"
 #include "hw/usb/hcd-dwc3.h"
+#include "hw/core/split-irq.h"
 
 #define TYPE_XLNX_ZYNQMP "xlnx-zynqmp"
 OBJECT_DECLARE_SIMPLE_TYPE(XlnxZynqMPState, XLNX_ZYNQMP)
@@ -106,6 +107,9 @@ struct XlnxZynqMPState {
     GICState gic;
     MemoryRegion gic_mr[XLNX_ZYNQMP_GIC_REGIONS][XLNX_ZYNQMP_GIC_ALIASES];
 
+    GICState rpu_gic;
+    SplitIRQ splitter[XLNX_ZYNQMP_GIC_NUM_SPI_INTR];
+
     MemoryRegion ocm_ram[XLNX_ZYNQMP_NUM_OCM_BANKS];
 
     MemoryRegion *ddr_ram;

From cedbe3b24a875c2abd84d1925abf3d288f753e33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 10:40:47 +0200
Subject: [PATCH 1126/2396] hw/arm: Remove sl_bootparam_write() and
 'hw/arm/sharpsl.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When removing the spitz and tosa board, commit b62151489ae
("hw/arm: Remove deprecated akita, borzoi spitz, terrier,
tosa boards") removed the last calls to sl_bootparam_write().
Remove it, along with the "hw/arm/sharpsl.h" header.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251001084047.67423-1-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS              |  1 -
 hw/gpio/zaurus.c         | 42 ----------------------------------------
 include/hw/arm/sharpsl.h | 17 ----------------
 3 files changed, 60 deletions(-)
 delete mode 100644 include/hw/arm/sharpsl.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 75e1fa5c30..bb7fa76c32 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1006,7 +1006,6 @@ S: Odd Fixes
 F: hw/arm/collie.c
 F: hw/arm/strongarm*
 F: hw/gpio/zaurus.c
-F: include/hw/arm/sharpsl.h
 F: docs/system/arm/collie.rst
 F: tests/functional/arm/test_collie.py
 
diff --git a/hw/gpio/zaurus.c b/hw/gpio/zaurus.c
index b8d27f5973..590ffde89d 100644
--- a/hw/gpio/zaurus.c
+++ b/hw/gpio/zaurus.c
@@ -18,7 +18,6 @@
 
 #include "qemu/osdep.h"
 #include "hw/irq.h"
-#include "hw/arm/sharpsl.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
@@ -265,44 +264,3 @@ static void scoop_register_types(void)
 }
 
 type_init(scoop_register_types)
-
-/* Write the bootloader parameters memory area.  */
-
-#define MAGIC_CHG(a, b, c, d)   ((d << 24) | (c << 16) | (b << 8) | a)
-
-static struct QEMU_PACKED sl_param_info {
-    uint32_t comadj_keyword;
-    int32_t comadj;
-
-    uint32_t uuid_keyword;
-    char uuid[16];
-
-    uint32_t touch_keyword;
-    int32_t touch_xp;
-    int32_t touch_yp;
-    int32_t touch_xd;
-    int32_t touch_yd;
-
-    uint32_t adadj_keyword;
-    int32_t adadj;
-
-    uint32_t phad_keyword;
-    int32_t phadadj;
-} zaurus_bootparam = {
-    .comadj_keyword     = MAGIC_CHG('C', 'M', 'A', 'D'),
-    .comadj             = 125,
-    .uuid_keyword       = MAGIC_CHG('U', 'U', 'I', 'D'),
-    .uuid               = { -1 },
-    .touch_keyword      = MAGIC_CHG('T', 'U', 'C', 'H'),
-    .touch_xp           = -1,
-    .adadj_keyword      = MAGIC_CHG('B', 'V', 'A', 'D'),
-    .adadj              = -1,
-    .phad_keyword       = MAGIC_CHG('P', 'H', 'A', 'D'),
-    .phadadj            = 0x01,
-};
-
-void sl_bootparam_write(hwaddr ptr)
-{
-    cpu_physical_memory_write(ptr, &zaurus_bootparam,
-                              sizeof(struct sl_param_info));
-}
diff --git a/include/hw/arm/sharpsl.h b/include/hw/arm/sharpsl.h
deleted file mode 100644
index 1e3992fcd0..0000000000
--- a/include/hw/arm/sharpsl.h
+++ /dev/null
@@ -1,17 +0,0 @@
-/*
- * Common declarations for the Zaurii.
- *
- * This file is licensed under the GNU GPL.
- */
-
-#ifndef QEMU_SHARPSL_H
-#define QEMU_SHARPSL_H
-
-#include "exec/hwaddr.h"
-
-/* zaurus.c */
-
-#define SL_PXA_PARAM_BASE   0xa0000a00
-void sl_bootparam_write(hwaddr ptr);
-
-#endif

From 0407192ae6a06d649d693a9be5e864243e6de702 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:25 -0700
Subject: [PATCH 1127/2396] target/arm: Add isar feature test for FEAT_RME_GPC2

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 602f6a88e5..f59c18b6ef 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -1091,6 +1091,11 @@ static inline bool isar_feature_aa64_rme(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64PFR0, RME) != 0;
 }
 
+static inline bool isar_feature_aa64_rme_gpc2(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64PFR0, RME) >= 2;
+}
+
 static inline bool isar_feature_aa64_dit(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64PFR0, DIT) != 0;

From e2c25b123d48a9bb2d723f19a595914690e348b0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:26 -0700
Subject: [PATCH 1128/2396] target/arm: Add GPCCR fields from ARM revision L.b

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 2b9585dc80..41414ac22b 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1995,13 +1995,19 @@ FIELD(V7M_VPR, MASK01, 16, 4)
 FIELD(V7M_VPR, MASK23, 20, 4)
 
 FIELD(GPCCR, PPS, 0, 3)
+FIELD(GPCCR, RLPAD, 5, 1)
+FIELD(GPCCR, NSPAD, 6, 1)
+FIELD(GPCCR, SPAD, 7, 1)
 FIELD(GPCCR, IRGN, 8, 2)
 FIELD(GPCCR, ORGN, 10, 2)
 FIELD(GPCCR, SH, 12, 2)
 FIELD(GPCCR, PGS, 14, 2)
 FIELD(GPCCR, GPC, 16, 1)
 FIELD(GPCCR, GPCP, 17, 1)
+FIELD(GPCCR, TBGPCD, 18, 1)
+FIELD(GPCCR, NSO, 19, 1)
 FIELD(GPCCR, L0GPTSZ, 20, 4)
+FIELD(GPCCR, APPSAA, 24, 1)
 
 FIELD(MFAR, FPA, 12, 40)
 FIELD(MFAR, NSE, 62, 1)

From af95e2aaa0b00615728834a79de5c827158b3d9a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:27 -0700
Subject: [PATCH 1129/2396] target/arm: Enable FEAT_RME_GPC2 bits in
 gpccr_write

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 792a47a9c5..b7bf45afc1 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -4933,6 +4933,11 @@ static void gpccr_write(CPUARMState *env, const ARMCPRegInfo *ri,
         R_GPCCR_ORGN_MASK | R_GPCCR_SH_MASK | R_GPCCR_PGS_MASK |
         R_GPCCR_GPC_MASK | R_GPCCR_GPCP_MASK;
 
+    if (cpu_isar_feature(aa64_rme_gpc2, env_archcpu(env))) {
+        rw_mask |= R_GPCCR_APPSAA_MASK | R_GPCCR_NSO_MASK |
+                   R_GPCCR_SPAD_MASK | R_GPCCR_NSPAD_MASK | R_GPCCR_RLPAD_MASK;
+    }
+
     env->cp15.gpccr_el3 = (value & rw_mask) | (env->cp15.gpccr_el3 & ~rw_mask);
 }
 

From bd08319bb52cd009f86e9a04af8810f6aa540d8c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:28 -0700
Subject: [PATCH 1130/2396] target/arm: Add cur_space to S1Translate

We've been updating in_space and then using hacks to access
the original space.  Instead, update cur_space and leave
in_space unchanged.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 +++++++++++++++++++------------------
 1 file changed, 19 insertions(+), 18 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 6344971fa6..1cafe8f4f7 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -36,8 +36,6 @@ typedef struct S1Translate {
     /*
      * in_space: the security space for this walk. This plus
      * the in_mmu_idx specify the architectural translation regime.
-     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-     * this field is updated accordingly.
      *
      * Note that the security space for the in_ptw_idx may be different
      * from that for the in_mmu_idx. We do not need to explicitly track
@@ -52,6 +50,11 @@ typedef struct S1Translate {
      *    value being Stage2 vs Stage2_S distinguishes those.
      */
     ARMSecuritySpace in_space;
+    /*
+     * Like in_space, except this may be "downgraded" to NonSecure
+     * by an NSTable bit.
+     */
+    ARMSecuritySpace cur_space;
     /*
      * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
      * accesses will not update the guest page table access flags
@@ -587,7 +590,8 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
-        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
+        ARMSecuritySpace s2_space
+            = S2_security_space(ptw->cur_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
@@ -630,7 +634,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     }
 
     if (regime_is_stage2(s2_mmu_idx)) {
-        uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
+        uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->cur_space);
 
         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
             /*
@@ -641,7 +645,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
+            fi->s1ns = fault_s1ns(ptw->cur_space, s2_mmu_idx);
             return false;
         }
     }
@@ -657,7 +661,7 @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     fi->s2addr = addr;
     fi->stage2 = regime_is_stage2(s2_mmu_idx);
     fi->s1ptw = fi->stage2;
-    fi->s1ns = fault_s1ns(ptw->in_space, s2_mmu_idx);
+    fi->s1ns = fault_s1ns(ptw->cur_space, s2_mmu_idx);
     return false;
 }
 
@@ -844,7 +848,7 @@ static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
             fi->s2addr = ptw->out_virt;
             fi->stage2 = true;
             fi->s1ptw = true;
-            fi->s1ns = fault_s1ns(ptw->in_space, ptw->in_ptw_idx);
+            fi->s1ns = fault_s1ns(ptw->cur_space, ptw->in_ptw_idx);
             return 0;
         }
 
@@ -1224,7 +1228,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
             g_assert_not_reached();
         }
     }
-    out_space = ptw->in_space;
+    out_space = ptw->cur_space;
     if (ns) {
         /*
          * The NS bit will (as required by the architecture) have no effect if
@@ -1254,7 +1258,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         }
 
         result->f.prot = get_S1prot(env, mmu_idx, false, user_rw, prot_rw,
-                                    xn, pxn, result->f.attrs.space, out_space);
+                                    xn, pxn, ptw->in_space, out_space);
         if (ptw->in_prot_check & ~result->f.prot) {
             /* Access permission fault.  */
             fi->type = ARMFault_Permission;
@@ -1857,7 +1861,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * NonSecure.  With RME, the EL3 translation regime does not change
      * from Root to NonSecure.
      */
-    if (ptw->in_space == ARMSS_Secure
+    if (ptw->cur_space == ARMSS_Secure
         && !regime_is_stage2(mmu_idx)
         && extract32(tableattrs, 4, 1)) {
         /*
@@ -1867,7 +1871,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_S + 1 != ARMMMUIdx_Phys_NS);
         QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2_S + 1 != ARMMMUIdx_Stage2);
         ptw->in_ptw_idx += 1;
-        ptw->in_space = ARMSS_NonSecure;
+        ptw->cur_space = ARMSS_NonSecure;
     }
 
     if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
@@ -1991,7 +1995,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     }
 
     ap = extract32(attrs, 6, 2);
-    out_space = ptw->in_space;
+    out_space = ptw->cur_space;
     if (regime_is_stage2(mmu_idx)) {
         /*
          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
@@ -2089,12 +2093,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
         user_rw = simple_ap_to_rw_prot_is_user(ap, true);
         prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-        /*
-         * Note that we modified ptw->in_space earlier for NSTable, but
-         * result->f.attrs retains a copy of the original security space.
-         */
         result->f.prot = get_S1prot(env, mmu_idx, aarch64, user_rw, prot_rw,
-                                    xn, pxn, result->f.attrs.space, out_space);
+                                    xn, pxn, ptw->in_space, out_space);
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
@@ -2192,7 +2192,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         fi->level = level;
         fi->stage2 = regime_is_stage2(mmu_idx);
     }
-    fi->s1ns = fault_s1ns(ptw->in_space, mmu_idx);
+    fi->s1ns = fault_s1ns(ptw->cur_space, mmu_idx);
     return true;
 }
 
@@ -3413,6 +3413,7 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
      * cannot upgrade a NonSecure translation regime's attributes
      * to Secure or Realm.
      */
+    ptw->cur_space = ptw->in_space;
     result->f.attrs.space = ptw->in_space;
     result->f.attrs.secure = arm_space_is_secure(ptw->in_space);
 

From 11dee1cb2f075185ed93b38ad964995290630041 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:29 -0700
Subject: [PATCH 1131/2396] target/arm: GPT_Secure is reserved without
 FEAT_SEL2

For GPT_Secure, if SEL2 is not enabled, raise a GPCF_Walk exception.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 1cafe8f4f7..3df5d4da12 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -478,10 +478,14 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
         break;
     case 0b1111: /* all access */
         return true;
-    case 0b1000:
-    case 0b1001:
-    case 0b1010:
-    case 0b1011:
+    case 0b1000: /* secure */
+        if (!cpu_isar_feature(aa64_sel2, cpu)) {
+            goto fault_walk;
+        }
+        /* fall through */
+    case 0b1001: /* non-secure */
+    case 0b1010: /* root */
+    case 0b1011: /* realm */
         if (pspace == (gpi & 3)) {
             return true;
         }

From ee45f4b4e9e58be886bb48b31ca58c2273f3630a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:30 -0700
Subject: [PATCH 1132/2396] target/arm: Implement GPT_NonSecureOnly

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 3df5d4da12..56a3cd8fa0 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -318,6 +318,7 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
 
 static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
                                      ARMSecuritySpace pspace,
+                                     ARMSecuritySpace ss,
                                      ARMMMUFaultInfo *fi)
 {
     MemTxAttrs attrs = {
@@ -490,6 +491,13 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
             return true;
         }
         break;
+    case 0b1101: /* non-secure only */
+        /* aa64_rme_gpc2 was checked in gpccr_write */
+        if (FIELD_EX64(gpccr, GPCCR, NSO)) {
+            return (pspace == ARMSS_NonSecure &&
+                    (ss == ARMSS_NonSecure || ss == ARMSS_Root));
+        }
+        goto fault_walk;
     default:
         goto fault_walk; /* reserved */
     }
@@ -3553,7 +3561,7 @@ static bool get_phys_addr_gpc(CPUARMState *env, S1Translate *ptw,
         return true;
     }
     if (!granule_protection_check(env, result->f.phys_addr,
-                                  result->f.attrs.space, fi)) {
+                                  result->f.attrs.space, ptw->in_space, fi)) {
         fi->type = ARMFault_GPCFOnOutput;
         return true;
     }

From 59bcd13b64bf54b35acac8a364b569964d7e0461 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:31 -0700
Subject: [PATCH 1133/2396] target/arm: Implement SPAD, NSPAD, RLPAD

These bits disable all access to a particular address space.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 56a3cd8fa0..36917be83e 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -387,7 +387,25 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
     l0gptsz = 30 + FIELD_EX64(gpccr, GPCCR, L0GPTSZ);
 
     /*
-     * GPC Priority 2: Secure, Realm or Root address exceeds PPS.
+     * GPC Priority 2: Access to Secure, NonSecure or Realm is prevented
+     * by one of the GPCCR_EL3 address space disable bits (R_TCWMD).
+     * All of these bits are checked vs aa64_rme_gpc2 in gpccr_write.
+     */
+    {
+        static const uint8_t disable_masks[4] = {
+            [ARMSS_Secure] = R_GPCCR_SPAD_MASK,
+            [ARMSS_NonSecure] = R_GPCCR_NSPAD_MASK,
+            [ARMSS_Root] = 0,
+            [ARMSS_Realm] = R_GPCCR_RLPAD_MASK,
+        };
+
+        if (gpccr & disable_masks[pspace]) {
+            goto fault_fail;
+        }
+    }
+
+    /*
+     * GPC Priority 3: Secure, Realm or Root address exceeds PPS.
      * R_CPDSB: A NonSecure physical address input exceeding PPS
      * does not experience any fault.
      */
@@ -398,7 +416,7 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
         goto fault_size;
     }
 
-    /* GPC Priority 3: the base address of GPTBR_EL3 exceeds PPS. */
+    /* GPC Priority 4: the base address of GPTBR_EL3 exceeds PPS. */
     tableaddr = env->cp15.gptbr_el3 << 12;
     if (tableaddr & ~pps_mask) {
         goto fault_size;
@@ -502,6 +520,7 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
         goto fault_walk; /* reserved */
     }
 
+ fault_fail:
     fi->gpcf = GPCF_Fail;
     goto fault_common;
  fault_eabt:

From a0f1bb0dfeb2c8cd806349aa5938d9aab6ef1d61 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:32 -0700
Subject: [PATCH 1134/2396] target/arm: Fix GPT fault type for address outside
 PPS

The GPT address size fault is for the table itself.  The physical
address being checked gets Granule protection fault at Level 0 (R_JFFHB).

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 36917be83e..236c3a9569 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -413,7 +413,7 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
         if (pspace == ARMSS_NonSecure) {
             return true;
         }
-        goto fault_size;
+        goto fault_fail;
     }
 
     /* GPC Priority 4: the base address of GPTBR_EL3 exceeds PPS. */

From 663f9c253eb31d4deacacf5b9de70bfa4674371f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:33 -0700
Subject: [PATCH 1135/2396] target/arm: Implement APPSAA

This bit allows all spaces to access memory above PPS.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 236c3a9569..e03657f309 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -408,9 +408,10 @@ static bool granule_protection_check(CPUARMState *env, uint64_t paddress,
      * GPC Priority 3: Secure, Realm or Root address exceeds PPS.
      * R_CPDSB: A NonSecure physical address input exceeding PPS
      * does not experience any fault.
+     * R_PBPSH: Other address spaces have fault suppressed by APPSAA.
      */
     if (paddress & ~pps_mask) {
-        if (pspace == ARMSS_NonSecure) {
+        if (pspace == ARMSS_NonSecure || FIELD_EX64(gpccr, GPCCR, APPSAA)) {
             return true;
         }
         goto fault_fail;

From 932cac41ca633f24f192a69770bf91b55c4d27bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 25 Sep 2025 17:11:34 -0700
Subject: [PATCH 1136/2396] target/arm: Enable FEAT_RME_GPC2 for -cpu max with
 x-rme

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-id: 20250926001134.295547-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 3 ++-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 6b04c96c8c..1aa0a6e4c3 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -120,6 +120,7 @@ the following architecture extensions:
 - FEAT_RASv1p1 (RAS Extension v1.1)
 - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
 - FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
+- FEAT_RME_GPC2 (RME Granule Protection Check 2 Extension)
 - FEAT_RNG (Random number generator)
 - FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 90b6c0ebb0..8c617fe37b 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -159,7 +159,8 @@ static void cpu_arm_set_rme(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
-    FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR0, RME, value);
+    /* Enable FEAT_RME_GPC2 */
+    FIELD_DP64_IDREG(&cpu->isar, ID_AA64PFR0, RME, value ? 2 : 0);
 }
 
 static void cpu_max_set_l0gptsz(Object *obj, Visitor *v, const char *name,

From 2438f18ee01108ead65be81be056e5a5da69120c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 7 Oct 2025 17:45:58 +0400
Subject: [PATCH 1137/2396] build-sys: default to host vendor for rust target
 triple
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes docker-test@alpine, which uses "alpine" vendor.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20251007134558.251670-1-marcandre.lureau@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 configure | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/configure b/configure
index 78445cbb4b..a467f3a2e0 100755
--- a/configure
+++ b/configure
@@ -1216,8 +1216,9 @@ fi
 if test "$rust" != disabled && test -z "$rust_target_triple"; then
   # arch and os generally matches between meson and rust
   rust_arch=$host_arch
+  # default to host vendor
+  rust_vendor=$(echo "$rust_host_triple" | cut -d'-' -f2)
   rust_os=$host_os
-  rust_machine=unknown
   rust_osvariant=
 
   # tweak rust_os if needed; also, machine and variant depend on the OS
@@ -1225,7 +1226,7 @@ if test "$rust" != disabled && test -z "$rust_target_triple"; then
   case "$host_os" in
   darwin)
     # e.g. aarch64-apple-darwin
-    rust_machine=apple
+    rust_vendor=apple
     ;;
 
   linux)
@@ -1273,13 +1274,13 @@ EOF
     ;;
 
   sunos)
-    rust_machine=pc
+    rust_vendor=pc
     rust_os=solaris
     ;;
 
   windows)
     # e.g. aarch64-pc-windows-gnullvm, x86_64-pc-windows-gnu (MSVC not supported)
-    rust_machine=pc
+    rust_vendor=pc
     if test "$host_arch" = aarch64; then
       rust_osvariant=gnullvm
     else
@@ -1310,7 +1311,7 @@ EOF
   sparc64)
     if test "$rust_os" = solaris; then
       rust_arch=sparcv9
-      rust_machine=sun
+      rust_vendor=sun
     fi
     ;;
 
@@ -1324,7 +1325,7 @@ EOF
     # e.g. aarch64-linux-android
     rust_target_triple=$rust_arch-$rust_os-$rust_osvariant
   else
-    rust_target_triple=$rust_arch-$rust_machine-$rust_os${rust_osvariant:+-$rust_osvariant}
+    rust_target_triple=$rust_arch-$rust_vendor-$rust_os${rust_osvariant:+-$rust_osvariant}
   fi
 fi
 

From e9efa4a77168ac2816bf9471f878252ce6224710 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 23 Sep 2025 12:22:54 +0200
Subject: [PATCH 1138/2396] target/i386: add compatibility property for
 arch_capabilities

Prior to v10.1, if requested by user, arch-capabilities is always on
despite the fact that CPUID advertises it to be off/unvailable.
This causes a migration issue for VMs that are run on a machine
without arch-capabilities and expect this feature to be present
on the destination host with QEMU 10.1.

Add a compatibility property to restore the legacy behavior for all
machines with version prior to 10.1.

To preserve the functionality (added by 10.1) of turning off
ARCH_CAPABILITIES where Windows does not like it, use directly
the guest CPU vendor: x86_cpu_get_supported_feature_word is not
KVM-specific and therefore should not necessarily use the host
CPUID.

Co-authored-by: Hector Cao <hector.cao@canonical.com>
Signed-off-by: Hector Cao <hector.cao@canonical.com>
Fixes: d3a24134e37 ("target/i386: do not expose ARCH_CAPABILITIES on AMD CPU", 2025-07-17)
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c          |  1 +
 target/i386/cpu.c     | 17 +++++++++++++++++
 target/i386/cpu.h     |  6 ++++++
 target/i386/kvm/kvm.c |  6 +-----
 4 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index bc048a6d13..d7f48150fd 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -87,6 +87,7 @@ const size_t pc_compat_10_1_len = G_N_ELEMENTS(pc_compat_10_1);
 GlobalProperty pc_compat_10_0[] = {
     { TYPE_X86_CPU, "x-consistent-cache", "false" },
     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
+    { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
 };
 const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 6d85149e6e..fe369bb128 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7539,6 +7539,20 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w)
 #endif
         break;
 
+    case FEAT_7_0_EDX:
+        /*
+         * Windows does not like ARCH_CAPABILITIES on AMD machines at all.
+         * Do not show the fake ARCH_CAPABILITIES MSR that KVM sets up,
+         * except if needed for migration.
+         *
+         * When arch_cap_always_on is removed, this tweak can move to
+         * kvm_arch_get_supported_cpuid.
+         */
+        if (cpu && IS_AMD_CPU(&cpu->env) && !cpu->arch_cap_always_on) {
+            unavail = CPUID_7_0_EDX_ARCH_CAPABILITIES;
+        }
+        break;
+
     default:
         break;
     }
@@ -10004,6 +10018,9 @@ static const Property x86_cpu_properties[] = {
                      true),
     DEFINE_PROP_BOOL("x-l1-cache-per-thread", X86CPU, l1_cache_per_core, true),
     DEFINE_PROP_BOOL("x-force-cpuid-0x1f", X86CPU, force_cpuid_0x1f, false),
+
+    DEFINE_PROP_BOOL("x-arch-cap-always-on", X86CPU,
+                     arch_cap_always_on, false),
 };
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index e0be7a7406..414ca968e8 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2314,6 +2314,12 @@ struct ArchCPU {
     /* Forcefully disable KVM PV features not exposed in guest CPUIDs */
     bool kvm_pv_enforce_cpuid;
 
+    /*
+     * Expose arch-capabilities unconditionally even on AMD models, for backwards
+     * compatibility with QEMU <10.1.
+     */
+    bool arch_cap_always_on;
+
     /* Number of physical address bits supported */
     uint32_t phys_bits;
 
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 6a3a1c1ed8..db40caa341 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -503,12 +503,8 @@ uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
          * Linux v4.17-v4.20 incorrectly return ARCH_CAPABILITIES on SVM hosts.
          * We can detect the bug by checking if MSR_IA32_ARCH_CAPABILITIES is
          * returned by KVM_GET_MSR_INDEX_LIST.
-         *
-         * But also, because Windows does not like ARCH_CAPABILITIES on AMD
-         * mcahines at all, do not show the fake ARCH_CAPABILITIES MSR that
-         * KVM sets up.
          */
-        if (!has_msr_arch_capabs || !(edx & CPUID_7_0_EDX_ARCH_CAPABILITIES)) {
+        if (!has_msr_arch_capabs) {
             ret &= ~CPUID_7_0_EDX_ARCH_CAPABILITIES;
         }
     } else if (function == 7 && index == 1 && reg == R_EAX) {

From 6529f31e0dccadb532c80b36e3efe7aef83f9cad Mon Sep 17 00:00:00 2001
From: Hector Cao <hector.cao@canonical.com>
Date: Tue, 23 Sep 2025 12:16:41 +0200
Subject: [PATCH 1139/2396] target/i386: add compatibility property for pdcm
 feature

The pdcm feature is supposed to be disabled when PMU is not
available. Up until v10.1, pdcm feature is enabled even when PMU
is off. This behavior has been fixed but this change breaks the
migration of VMs that are run with QEMU < 10.0 and expect the pdcm
feature to be enabled on the destination host.

This commit restores the legacy behavior for machines with version
prior to 10.1 to allow the migration from older QEMU to QEMU 10.1.

Signed-off-by: Hector Cao <hector.cao@canonical.com>
Link: https://lore.kernel.org/r/20250910115733.21149-3-hector.cao@canonical.com
Fixes: e68ec298090 ("i386/cpu: Move adjustment of CPUID_EXT_PDCM before feature_dependencies[] check", 2025-06-20)
[Move property from migration object to CPU. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/pc.c      |  1 +
 target/i386/cpu.c | 15 ++++++++++++---
 target/i386/cpu.h |  6 ++++++
 3 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index d7f48150fd..4668918746 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -88,6 +88,7 @@ GlobalProperty pc_compat_10_0[] = {
     { TYPE_X86_CPU, "x-consistent-cache", "false" },
     { TYPE_X86_CPU, "x-vendor-cpuid-only-v2", "false" },
     { TYPE_X86_CPU, "x-arch-cap-always-on", "true" },
+    { TYPE_X86_CPU, "x-pdcm-on-even-without-pmu", "true" },
 };
 const size_t pc_compat_10_0_len = G_N_ELEMENTS(pc_compat_10_0);
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index fe369bb128..ab18de894e 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -7908,6 +7908,11 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
             /* Fixup overflow: max value for bits 23-16 is 255. */
             *ebx |= MIN(num, 255) << 16;
         }
+        if (cpu->pdcm_on_even_without_pmu) {
+            if (!cpu->enable_pmu) {
+                *ecx &= ~CPUID_EXT_PDCM;
+            }
+        }
         break;
     case 2: { /* cache info: needed for Pentium Pro compatibility */
         const CPUCaches *caches;
@@ -8958,9 +8963,11 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
         }
     }
 
-    /* PDCM is fixed1 bit for TDX */
-    if (!cpu->enable_pmu && !is_tdx_vm()) {
-        env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
+    if (!cpu->pdcm_on_even_without_pmu) {
+        /* PDCM is fixed1 bit for TDX */
+        if (!cpu->enable_pmu && !is_tdx_vm()) {
+            env->features[FEAT_1_ECX] &= ~CPUID_EXT_PDCM;
+        }
     }
 
     for (i = 0; i < ARRAY_SIZE(feature_dependencies); i++) {
@@ -10021,6 +10028,8 @@ static const Property x86_cpu_properties[] = {
 
     DEFINE_PROP_BOOL("x-arch-cap-always-on", X86CPU,
                      arch_cap_always_on, false),
+    DEFINE_PROP_BOOL("x-pdcm-on-even-without-pmu", X86CPU,
+                     pdcm_on_even_without_pmu, false),
 };
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 414ca968e8..42168f1d6d 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2320,6 +2320,12 @@ struct ArchCPU {
      */
     bool arch_cap_always_on;
 
+    /*
+     * Backwards compatibility with QEMU <10.1. The PDCM feature is now disabled when
+     * PMU is not available, but prior to 10.1 it was enabled even if PMU is off.
+     */
+    bool pdcm_on_even_without_pmu;
+
     /* Number of physical address bits supported */
     uint32_t phys_bits;
 

From 37e12da5df8eb74042f11e9e7bec8a50b8090adb Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:21 +0200
Subject: [PATCH 1140/2396] accel: Add Meson and config support for MSHV
 accelerator
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce a Meson feature option and default-config entry to allow
building QEMU with MSHV (Microsoft Hypervisor) acceleration support.

This is the first step toward implementing an MSHV backend in QEMU.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250916164847.77883-2-magnuskulke@linux.microsoft.com
[Add error for unavailable accelerator. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/Kconfig                 |  3 +++
 meson.build                   | 13 +++++++++++++
 meson_options.txt             |  2 ++
 scripts/meson-buildoptions.sh |  3 +++
 4 files changed, 21 insertions(+)

diff --git a/accel/Kconfig b/accel/Kconfig
index 4263cab722..a60f114923 100644
--- a/accel/Kconfig
+++ b/accel/Kconfig
@@ -13,6 +13,9 @@ config TCG
 config KVM
     bool
 
+config MSHV
+    bool
+
 config XEN
     bool
     select FSDEV_9P if VIRTFS
diff --git a/meson.build b/meson.build
index 62766c0f19..167021ed62 100644
--- a/meson.build
+++ b/meson.build
@@ -334,6 +334,7 @@ elif cpu == 'x86_64'
     'CONFIG_HVF': ['x86_64-softmmu'],
     'CONFIG_NVMM': ['i386-softmmu', 'x86_64-softmmu'],
     'CONFIG_WHPX': ['i386-softmmu', 'x86_64-softmmu'],
+    'CONFIG_MSHV': ['x86_64-softmmu'],
   }
 endif
 
@@ -883,6 +884,14 @@ accelerators = []
 if get_option('kvm').allowed() and host_os == 'linux'
   accelerators += 'CONFIG_KVM'
 endif
+
+if get_option('mshv').allowed() and host_os == 'linux'
+  if get_option('mshv').enabled() and host_machine.cpu() != 'x86_64'
+    error('mshv accelerator requires x64_64 host')
+  endif
+  accelerators += 'CONFIG_MSHV'
+endif
+
 if get_option('whpx').allowed() and host_os == 'windows'
   if get_option('whpx').enabled() and host_machine.cpu() != 'x86_64'
     error('WHPX requires 64-bit host')
@@ -952,6 +961,9 @@ endif
 if 'CONFIG_WHPX' not in accelerators and get_option('whpx').enabled()
   error('WHPX not available on this platform')
 endif
+if 'CONFIG_MSHV' not in accelerators and get_option('mshv').enabled()
+  error('mshv not available on this platform')
+endif
 
 xen = not_found
 if get_option('xen').enabled() or (get_option('xen').auto() and have_system)
@@ -4827,6 +4839,7 @@ if have_system
   summary_info += {'HVF support':       config_all_accel.has_key('CONFIG_HVF')}
   summary_info += {'WHPX support':      config_all_accel.has_key('CONFIG_WHPX')}
   summary_info += {'NVMM support':      config_all_accel.has_key('CONFIG_NVMM')}
+  summary_info += {'MSHV support':      config_all_accel.has_key('CONFIG_MSHV')}
   summary_info += {'Xen support':       xen.found()}
   if xen.found()
     summary_info += {'xen ctrl version':  xen.version()}
diff --git a/meson_options.txt b/meson_options.txt
index fff1521e58..1be7d61efd 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -71,6 +71,8 @@ option('malloc', type : 'combo', choices : ['system', 'tcmalloc', 'jemalloc'],
 
 option('kvm', type: 'feature', value: 'auto',
        description: 'KVM acceleration support')
+option('mshv', type: 'feature', value: 'auto',
+       description: 'MSHV acceleration support')
 option('whpx', type: 'feature', value: 'auto',
        description: 'WHPX acceleration support')
 option('hvf', type: 'feature', value: 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index 0ebe6bc52a..d3d8f48bbb 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -154,6 +154,7 @@ meson_options_help() {
   printf "%s\n" '  membarrier      membarrier system call (for Linux 4.14+ or Windows'
   printf "%s\n" '  modules         modules support (non Windows)'
   printf "%s\n" '  mpath           Multipath persistent reservation passthrough'
+  printf "%s\n" '  mshv            MSHV acceleration support'
   printf "%s\n" '  multiprocess    Out of process device emulation support'
   printf "%s\n" '  netmap          netmap network backend support'
   printf "%s\n" '  nettle          nettle cryptography support'
@@ -408,6 +409,8 @@ _meson_option_parse() {
     --disable-modules) printf "%s" -Dmodules=disabled ;;
     --enable-mpath) printf "%s" -Dmpath=enabled ;;
     --disable-mpath) printf "%s" -Dmpath=disabled ;;
+    --enable-mshv) printf "%s" -Dmshv=enabled ;;
+    --disable-mshv) printf "%s" -Dmshv=disabled ;;
     --enable-multiprocess) printf "%s" -Dmultiprocess=enabled ;;
     --disable-multiprocess) printf "%s" -Dmultiprocess=disabled ;;
     --enable-netmap) printf "%s" -Dnetmap=enabled ;;

From 1e25327b244a217078e3fa5df18322c70932f478 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:22 +0200
Subject: [PATCH 1141/2396] target/i386/emulate: Allow instruction decoding
 from stream

Introduce a new helper function to decode x86 instructions from a
raw instruction byte stream. MSHV delivers an instruction stream in a
buffer of the vm_exit message. It can be used to speed up MMIO
emulation, since instructions do not have to be fetched and translated.

Added "fetch_instruction()" op to x86_emul_ops() to improve
traceability.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-3-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c | 27 +++++++++++++++++++++++----
 target/i386/emulate/x86_decode.h |  9 +++++++++
 target/i386/emulate/x86_emu.c    |  3 ++-
 target/i386/emulate/x86_emu.h    |  2 ++
 4 files changed, 36 insertions(+), 5 deletions(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index 2eca39802e..97bd6f1a3b 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -71,10 +71,16 @@ static inline uint64_t decode_bytes(CPUX86State *env, struct x86_decode *decode,
         VM_PANIC_EX("%s invalid size %d\n", __func__, size);
         break;
     }
-    target_ulong va  = linear_rip(env_cpu(env), env->eip) + decode->len;
-    emul_ops->read_mem(env_cpu(env), &val, va, size);
+
+    /* copy the bytes from the instruction stream, if available */
+    if (decode->stream && decode->len + size <= decode->stream->len) {
+        memcpy(&val, decode->stream->bytes + decode->len, size);
+    } else {
+        target_ulong va = linear_rip(env_cpu(env), env->eip) + decode->len;
+        emul_ops->fetch_instruction(env_cpu(env), &val, va, size);
+    }
     decode->len += size;
-    
+
     return val;
 }
 
@@ -2076,9 +2082,10 @@ static void decode_opcodes(CPUX86State *env, struct x86_decode *decode)
     }
 }
 
-uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode)
+static uint32_t decode_opcode(CPUX86State *env, struct x86_decode *decode)
 {
     memset(decode, 0, sizeof(*decode));
+
     decode_prefix(env, decode);
     set_addressing_size(env, decode);
     set_operand_size(env, decode);
@@ -2088,6 +2095,18 @@ uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode)
     return decode->len;
 }
 
+uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode)
+{
+    return decode_opcode(env, decode);
+}
+
+uint32_t decode_instruction_stream(CPUX86State *env, struct x86_decode *decode,
+                                   struct x86_insn_stream *stream)
+{
+    decode->stream = stream;
+    return decode_opcode(env, decode);
+}
+
 void init_decoder(void)
 {
     int i;
diff --git a/target/i386/emulate/x86_decode.h b/target/i386/emulate/x86_decode.h
index 927645af1a..1cadf3694f 100644
--- a/target/i386/emulate/x86_decode.h
+++ b/target/i386/emulate/x86_decode.h
@@ -272,6 +272,11 @@ typedef struct x86_decode_op {
     };
 } x86_decode_op;
 
+typedef struct x86_insn_stream {
+    const uint8_t *bytes;
+    size_t len;
+} x86_insn_stream;
+
 typedef struct x86_decode {
     int len;
     uint8_t opcode[4];
@@ -298,11 +303,15 @@ typedef struct x86_decode {
     struct x86_modrm modrm;
     struct x86_decode_op op[4];
     bool is_fpu;
+
+    x86_insn_stream *stream;
 } x86_decode;
 
 uint64_t sign(uint64_t val, int size);
 
 uint32_t decode_instruction(CPUX86State *env, struct x86_decode *decode);
+uint32_t decode_instruction_stream(CPUX86State *env, struct x86_decode *decode,
+                                   struct x86_insn_stream *stream);
 
 void *get_reg_ref(CPUX86State *env, int reg, int rex_present,
                   int is_extended, int size);
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index db7a7f7437..4409f7bc13 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -1246,7 +1246,8 @@ static void init_cmd_handler(void)
 bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
 {
     if (!_cmd_handler[ins->cmd].handler) {
-        printf("Unimplemented handler (" TARGET_FMT_lx ") for %d (%x %x) \n", env->eip,
+        printf("Unimplemented handler (" TARGET_FMT_lx ") for %d (%x %x)\n",
+                env->eip,
                 ins->cmd, ins->opcode[0],
                 ins->opcode_len > 1 ? ins->opcode[1] : 0);
         env->eip += ins->len;
diff --git a/target/i386/emulate/x86_emu.h b/target/i386/emulate/x86_emu.h
index a1a961284b..05686b162f 100644
--- a/target/i386/emulate/x86_emu.h
+++ b/target/i386/emulate/x86_emu.h
@@ -24,6 +24,8 @@
 #include "cpu.h"
 
 struct x86_emul_ops {
+    void (*fetch_instruction)(CPUState *cpu, void *data, target_ulong addr,
+                              int bytes);
     void (*read_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
     void (*write_mem)(CPUState *cpu, void *data, target_ulong addr, int bytes);
     void (*read_segment_descriptor)(CPUState *cpu, struct x86_segment_descriptor *desc,

From 0daf817c80b57e58168309420abf0a8a3d2a60f6 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:23 +0200
Subject: [PATCH 1142/2396] target/i386/mshv: Add x86 decoder/emu
 implementation

The MSHV accelerator requires a x86 decoder/emulator in userland to
emulate MMIO instructions. This change contains the implementations for
the generalized i386 instruction decoder/emulator.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-4-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/mshv.h           |  25 +++
 target/i386/cpu.h               |   2 +-
 target/i386/emulate/meson.build |   7 +-
 target/i386/meson.build         |   2 +
 target/i386/mshv/meson.build    |   7 +
 target/i386/mshv/x86.c          | 297 ++++++++++++++++++++++++++++++++
 6 files changed, 337 insertions(+), 3 deletions(-)
 create mode 100644 include/system/mshv.h
 create mode 100644 target/i386/mshv/meson.build
 create mode 100644 target/i386/mshv/x86.c

diff --git a/include/system/mshv.h b/include/system/mshv.h
new file mode 100644
index 0000000000..342f1ef6a9
--- /dev/null
+++ b/include/system/mshv.h
@@ -0,0 +1,25 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou  <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke <magnuskulke@microsoft.com>
+ *          Jinank Jain  <jinankjain@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ */
+
+#ifndef QEMU_MSHV_H
+#define QEMU_MSHV_H
+
+#ifdef COMPILING_PER_TARGET
+#ifdef CONFIG_MSHV
+#define CONFIG_MSHV_IS_POSSIBLE
+#endif
+#else
+#define CONFIG_MSHV_IS_POSSIBLE
+#endif
+
+#endif
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 42168f1d6d..3aec8fd41c 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2126,7 +2126,7 @@ typedef struct CPUArchState {
     QEMUTimer *xen_periodic_timer;
     QemuMutex xen_timers_lock;
 #endif
-#if defined(CONFIG_HVF)
+#if defined(CONFIG_HVF) || defined(CONFIG_MSHV)
     void *emu_mmio_buf;
 #endif
 
diff --git a/target/i386/emulate/meson.build b/target/i386/emulate/meson.build
index 4edd4f462f..b6dafb6a5b 100644
--- a/target/i386/emulate/meson.build
+++ b/target/i386/emulate/meson.build
@@ -1,5 +1,8 @@
-i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: files(
+emulator_files = files(
   'x86_decode.c',
   'x86_emu.c',
   'x86_flags.c',
-))
+)
+
+i386_system_ss.add(when: [hvf, 'CONFIG_HVF'], if_true: emulator_files)
+i386_system_ss.add(when: 'CONFIG_MSHV', if_true: emulator_files)
diff --git a/target/i386/meson.build b/target/i386/meson.build
index 092af34e2d..89ba4912aa 100644
--- a/target/i386/meson.build
+++ b/target/i386/meson.build
@@ -13,6 +13,7 @@ i386_ss.add(when: 'CONFIG_KVM', if_true: files('host-cpu.c'))
 i386_ss.add(when: 'CONFIG_HVF', if_true: files('host-cpu.c'))
 i386_ss.add(when: 'CONFIG_WHPX', if_true: files('host-cpu.c'))
 i386_ss.add(when: 'CONFIG_NVMM', if_true: files('host-cpu.c'))
+i386_ss.add(when: 'CONFIG_MSHV', if_true: files('host-cpu.c'))
 
 i386_system_ss = ss.source_set()
 i386_system_ss.add(files(
@@ -34,6 +35,7 @@ subdir('nvmm')
 subdir('hvf')
 subdir('tcg')
 subdir('emulate')
+subdir('mshv')
 
 target_arch += {'i386': i386_ss}
 target_system_arch += {'i386': i386_system_ss}
diff --git a/target/i386/mshv/meson.build b/target/i386/mshv/meson.build
new file mode 100644
index 0000000000..8ddaa7c11d
--- /dev/null
+++ b/target/i386/mshv/meson.build
@@ -0,0 +1,7 @@
+i386_mshv_ss = ss.source_set()
+
+i386_mshv_ss.add(files(
+  'x86.c',
+))
+
+i386_system_ss.add_all(when: 'CONFIG_MSHV', if_true: i386_mshv_ss)
diff --git a/target/i386/mshv/x86.c b/target/i386/mshv/x86.c
new file mode 100644
index 0000000000..d574b3bc52
--- /dev/null
+++ b/target/i386/mshv/x86.c
@@ -0,0 +1,297 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Magnus Kulke <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "cpu.h"
+#include "emulate/x86_decode.h"
+#include "emulate/x86_emu.h"
+#include "qemu/typedefs.h"
+#include "qemu/error-report.h"
+#include "system/mshv.h"
+
+/* RW or Exec segment */
+static const uint8_t RWRX_SEGMENT_TYPE        = 0x2;
+static const uint8_t CODE_SEGMENT_TYPE        = 0x8;
+static const uint8_t EXPAND_DOWN_SEGMENT_TYPE = 0x4;
+
+typedef enum CpuMode {
+    REAL_MODE,
+    PROTECTED_MODE,
+    LONG_MODE,
+} CpuMode;
+
+static CpuMode cpu_mode(CPUState *cpu)
+{
+    enum CpuMode m = REAL_MODE;
+
+    if (x86_is_protected(cpu)) {
+        m = PROTECTED_MODE;
+
+        if (x86_is_long_mode(cpu)) {
+            m = LONG_MODE;
+        }
+    }
+
+    return m;
+}
+
+static bool segment_type_ro(const SegmentCache *seg)
+{
+    uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+    return (type_ & (~RWRX_SEGMENT_TYPE)) == 0;
+}
+
+static bool segment_type_code(const SegmentCache *seg)
+{
+    uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+    return (type_ & CODE_SEGMENT_TYPE) != 0;
+}
+
+static bool segment_expands_down(const SegmentCache *seg)
+{
+    uint32_t type_ = (seg->flags >> DESC_TYPE_SHIFT) & 15;
+
+    if (segment_type_code(seg)) {
+        return false;
+    }
+
+    return (type_ & EXPAND_DOWN_SEGMENT_TYPE) != 0;
+}
+
+static uint32_t segment_limit(const SegmentCache *seg)
+{
+    uint32_t limit = seg->limit;
+    uint32_t granularity = (seg->flags & DESC_G_MASK) != 0;
+
+    if (granularity != 0) {
+        limit = (limit << 12) | 0xFFF;
+    }
+
+    return limit;
+}
+
+static uint8_t segment_db(const SegmentCache *seg)
+{
+    return (seg->flags >> DESC_B_SHIFT) & 1;
+}
+
+static uint32_t segment_max_limit(const SegmentCache *seg)
+{
+    if (segment_db(seg) != 0) {
+        return 0xFFFFFFFF;
+    }
+    return 0xFFFF;
+}
+
+static int linearize(CPUState *cpu,
+                     target_ulong logical_addr, target_ulong *linear_addr,
+                     X86Seg seg_idx)
+{
+    enum CpuMode mode;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    SegmentCache *seg = &env->segs[seg_idx];
+    target_ulong base = seg->base;
+    target_ulong logical_addr_32b;
+    uint32_t limit;
+    /* TODO: the emulator will not pass us "write" indicator yet */
+    bool write = false;
+
+    mode = cpu_mode(cpu);
+
+    switch (mode) {
+    case LONG_MODE:
+        if (__builtin_add_overflow(logical_addr, base, linear_addr)) {
+            error_report("Address overflow");
+            return -1;
+        }
+        break;
+    case PROTECTED_MODE:
+    case REAL_MODE:
+        if (segment_type_ro(seg) && write) {
+            error_report("Cannot write to read-only segment");
+            return -1;
+        }
+
+        logical_addr_32b = logical_addr & 0xFFFFFFFF;
+        limit = segment_limit(seg);
+
+        if (segment_expands_down(seg)) {
+            if (logical_addr_32b >= limit) {
+                error_report("Address exceeds limit (expands down)");
+                return -1;
+            }
+
+            limit = segment_max_limit(seg);
+        }
+
+        if (logical_addr_32b > limit) {
+            error_report("Address exceeds limit %u", limit);
+            return -1;
+        }
+        *linear_addr = logical_addr_32b + base;
+        break;
+    default:
+        error_report("Unknown cpu mode: %d", mode);
+        return -1;
+    }
+
+    return 0;
+}
+
+bool x86_read_segment_descriptor(CPUState *cpu,
+                                 struct x86_segment_descriptor *desc,
+                                 x86_segment_selector sel)
+{
+    target_ulong base;
+    uint32_t limit;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    target_ulong gva;
+
+    memset(desc, 0, sizeof(*desc));
+
+    /* valid gdt descriptors start from index 1 */
+    if (!sel.index && GDT_SEL == sel.ti) {
+        return false;
+    }
+
+    if (GDT_SEL == sel.ti) {
+        base = env->gdt.base;
+        limit = env->gdt.limit;
+    } else {
+        base = env->ldt.base;
+        limit = env->ldt.limit;
+    }
+
+    if (sel.index * 8 >= limit) {
+        return false;
+    }
+
+    gva = base + sel.index * 8;
+    emul_ops->read_mem(cpu, desc, gva, sizeof(*desc));
+
+    return true;
+}
+
+bool x86_read_call_gate(CPUState *cpu, struct x86_call_gate *idt_desc,
+                        int gate)
+{
+    target_ulong base;
+    uint32_t limit;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    target_ulong gva;
+
+    base = env->idt.base;
+    limit = env->idt.limit;
+
+    memset(idt_desc, 0, sizeof(*idt_desc));
+    if (gate * 8 >= limit) {
+        perror("call gate exceeds idt limit");
+        return false;
+    }
+
+    gva = base + gate * 8;
+    emul_ops->read_mem(cpu, idt_desc, gva, sizeof(*idt_desc));
+
+    return true;
+}
+
+bool x86_is_protected(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint64_t cr0 = env->cr[0];
+
+    return cr0 & CR0_PE_MASK;
+}
+
+bool x86_is_real(CPUState *cpu)
+{
+    return !x86_is_protected(cpu);
+}
+
+bool x86_is_v8086(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    return x86_is_protected(cpu) && (env->eflags & VM_MASK);
+}
+
+bool x86_is_long_mode(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint64_t efer = env->efer;
+    uint64_t lme_lma = (MSR_EFER_LME | MSR_EFER_LMA);
+
+    return ((efer & lme_lma) == lme_lma);
+}
+
+bool x86_is_long64_mode(CPUState *cpu)
+{
+    error_report("unimplemented: is_long64_mode()");
+    abort();
+}
+
+bool x86_is_paging_mode(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint64_t cr0 = env->cr[0];
+
+    return cr0 & CR0_PG_MASK;
+}
+
+bool x86_is_pae_enabled(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint64_t cr4 = env->cr[4];
+
+    return cr4 & CR4_PAE_MASK;
+}
+
+target_ulong linear_addr(CPUState *cpu, target_ulong addr, X86Seg seg)
+{
+    int ret;
+    target_ulong linear_addr;
+
+    ret = linearize(cpu, addr, &linear_addr, seg);
+    if (ret < 0) {
+        error_report("failed to linearize address");
+        abort();
+    }
+
+    return linear_addr;
+}
+
+target_ulong linear_addr_size(CPUState *cpu, target_ulong addr, int size,
+                              X86Seg seg)
+{
+    switch (size) {
+    case 2:
+        addr = (uint16_t)addr;
+        break;
+    case 4:
+        addr = (uint32_t)addr;
+        break;
+    default:
+        break;
+    }
+    return linear_addr(cpu, addr, seg);
+}
+
+target_ulong linear_rip(CPUState *cpu, target_ulong rip)
+{
+    return linear_addr(cpu, rip, R_CS);
+}

From 638ac1c78457dd93ccd795b9c6c2673af8c7dd21 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:24 +0200
Subject: [PATCH 1143/2396] hw/intc: Generalize APIC helper names from kvm_* to
 accel_*

Rename APIC helper functions to use an accel_* prefix instead of kvm_*
to support use by accelerators other than KVM. This is a preparatory
step for integrating MSHV support with common APIC logic.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-5-magnuskulke@linux.microsoft.com
[Remove dead definition of mshv_msi_via_irqfd_enabled. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/accel-irq.c          | 106 +++++++++++++++++++++++++++++++++++++
 accel/meson.build          |   2 +-
 hw/intc/ioapic.c           |  20 ++++---
 hw/virtio/virtio-pci.c     |  21 ++++----
 include/system/accel-irq.h |  37 +++++++++++++
 include/system/mshv.h      |  17 ++++++
 6 files changed, 185 insertions(+), 18 deletions(-)
 create mode 100644 accel/accel-irq.c
 create mode 100644 include/system/accel-irq.h

diff --git a/accel/accel-irq.c b/accel/accel-irq.c
new file mode 100644
index 0000000000..7f864e35c4
--- /dev/null
+++ b/accel/accel-irq.c
@@ -0,0 +1,106 @@
+/*
+ * Accelerated irqchip abstraction
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/msi.h"
+
+#include "system/kvm.h"
+#include "system/mshv.h"
+#include "system/accel-irq.h"
+
+int accel_irqchip_add_msi_route(KVMRouteChange *c, int vector, PCIDevice *dev)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        return mshv_irqchip_add_msi_route(vector, dev);
+    }
+#endif
+    if (kvm_enabled()) {
+        return kvm_irqchip_add_msi_route(c, vector, dev);
+    }
+    return -ENOSYS;
+}
+
+int accel_irqchip_update_msi_route(int vector, MSIMessage msg, PCIDevice *dev)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        return mshv_irqchip_update_msi_route(vector, msg, dev);
+    }
+#endif
+    if (kvm_enabled()) {
+        return kvm_irqchip_update_msi_route(kvm_state, vector, msg, dev);
+    }
+    return -ENOSYS;
+}
+
+void accel_irqchip_commit_route_changes(KVMRouteChange *c)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        mshv_irqchip_commit_routes();
+    }
+#endif
+    if (kvm_enabled()) {
+        kvm_irqchip_commit_route_changes(c);
+    }
+}
+
+void accel_irqchip_commit_routes(void)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        mshv_irqchip_commit_routes();
+    }
+#endif
+    if (kvm_enabled()) {
+        kvm_irqchip_commit_routes(kvm_state);
+    }
+}
+
+void accel_irqchip_release_virq(int virq)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        mshv_irqchip_release_virq(virq);
+    }
+#endif
+    if (kvm_enabled()) {
+        kvm_irqchip_release_virq(kvm_state, virq);
+    }
+}
+
+int accel_irqchip_add_irqfd_notifier_gsi(EventNotifier *n, EventNotifier *rn,
+                                         int virq)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        return mshv_irqchip_add_irqfd_notifier_gsi(n, rn, virq);
+    }
+#endif
+    if (kvm_enabled()) {
+        return kvm_irqchip_add_irqfd_notifier_gsi(kvm_state, n, rn, virq);
+    }
+    return -ENOSYS;
+}
+
+int accel_irqchip_remove_irqfd_notifier_gsi(EventNotifier *n, int virq)
+{
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+    if (mshv_msi_via_irqfd_enabled()) {
+        return mshv_irqchip_remove_irqfd_notifier_gsi(n, virq);
+    }
+#endif
+    if (kvm_enabled()) {
+        return kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, n, virq);
+    }
+    return -ENOSYS;
+}
diff --git a/accel/meson.build b/accel/meson.build
index 25b0f100b5..6349efe682 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -1,6 +1,6 @@
 common_ss.add(files('accel-common.c'))
 specific_ss.add(files('accel-target.c'))
-system_ss.add(files('accel-system.c', 'accel-blocker.c', 'accel-qmp.c'))
+system_ss.add(files('accel-system.c', 'accel-blocker.c', 'accel-qmp.c', 'accel-irq.c'))
 user_ss.add(files('accel-user.c'))
 
 subdir('tcg')
diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index 133bef852d..e431d00311 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -30,12 +30,18 @@
 #include "hw/intc/ioapic_internal.h"
 #include "hw/pci/msi.h"
 #include "hw/qdev-properties.h"
+#include "system/accel-irq.h"
 #include "system/kvm.h"
 #include "system/system.h"
 #include "hw/i386/apic-msidef.h"
 #include "hw/i386/x86-iommu.h"
 #include "trace.h"
 
+
+#if defined(CONFIG_KVM) || defined(CONFIG_MSHV)
+#define ACCEL_GSI_IRQFD_POSSIBLE
+#endif
+
 #define APIC_DELIVERY_MODE_SHIFT 8
 #define APIC_POLARITY_SHIFT 14
 #define APIC_TRIG_MODE_SHIFT 15
@@ -191,10 +197,10 @@ static void ioapic_set_irq(void *opaque, int vector, int level)
 
 static void ioapic_update_kvm_routes(IOAPICCommonState *s)
 {
-#ifdef CONFIG_KVM
+#ifdef ACCEL_GSI_IRQFD_POSSIBLE
     int i;
 
-    if (kvm_irqchip_is_split()) {
+    if (accel_irqchip_is_split()) {
         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
             MSIMessage msg;
             struct ioapic_entry_info info;
@@ -202,15 +208,15 @@ static void ioapic_update_kvm_routes(IOAPICCommonState *s)
             if (!info.masked) {
                 msg.address = info.addr;
                 msg.data = info.data;
-                kvm_irqchip_update_msi_route(kvm_state, i, msg, NULL);
+                accel_irqchip_update_msi_route(i, msg, NULL);
             }
         }
-        kvm_irqchip_commit_routes(kvm_state);
+        accel_irqchip_commit_routes();
     }
 #endif
 }
 
-#ifdef CONFIG_KVM
+#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
 static void ioapic_iec_notifier(void *private, bool global,
                                 uint32_t index, uint32_t mask)
 {
@@ -428,11 +434,11 @@ static const MemoryRegionOps ioapic_io_ops = {
 
 static void ioapic_machine_done_notify(Notifier *notifier, void *data)
 {
-#ifdef CONFIG_KVM
+#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
     IOAPICCommonState *s = container_of(notifier, IOAPICCommonState,
                                         machine_done);
 
-    if (kvm_irqchip_is_split()) {
+    if (accel_irqchip_is_split()) {
         X86IOMMUState *iommu = x86_iommu_get_default();
         if (iommu) {
             /* Register this IOAPIC with IOMMU IEC notifier, so that
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 767216d795..0cdc16217f 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -34,6 +34,7 @@
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/loader.h"
+#include "system/accel-irq.h"
 #include "system/kvm.h"
 #include "hw/virtio/virtio-pci.h"
 #include "qemu/range.h"
@@ -825,11 +826,11 @@ static int kvm_virtio_pci_vq_vector_use(VirtIOPCIProxy *proxy,
 
     if (irqfd->users == 0) {
         KVMRouteChange c = kvm_irqchip_begin_route_changes(kvm_state);
-        ret = kvm_irqchip_add_msi_route(&c, vector, &proxy->pci_dev);
+        ret = accel_irqchip_add_msi_route(&c, vector, &proxy->pci_dev);
         if (ret < 0) {
             return ret;
         }
-        kvm_irqchip_commit_route_changes(&c);
+        accel_irqchip_commit_route_changes(&c);
         irqfd->virq = ret;
     }
     irqfd->users++;
@@ -841,7 +842,7 @@ static void kvm_virtio_pci_vq_vector_release(VirtIOPCIProxy *proxy,
 {
     VirtIOIRQFD *irqfd = &proxy->vector_irqfd[vector];
     if (--irqfd->users == 0) {
-        kvm_irqchip_release_virq(kvm_state, irqfd->virq);
+        accel_irqchip_release_virq(irqfd->virq);
     }
 }
 
@@ -850,7 +851,7 @@ static int kvm_virtio_pci_irqfd_use(VirtIOPCIProxy *proxy,
                                  unsigned int vector)
 {
     VirtIOIRQFD *irqfd = &proxy->vector_irqfd[vector];
-    return kvm_irqchip_add_irqfd_notifier_gsi(kvm_state, n, NULL, irqfd->virq);
+    return accel_irqchip_add_irqfd_notifier_gsi(n, NULL, irqfd->virq);
 }
 
 static void kvm_virtio_pci_irqfd_release(VirtIOPCIProxy *proxy,
@@ -860,7 +861,7 @@ static void kvm_virtio_pci_irqfd_release(VirtIOPCIProxy *proxy,
     VirtIOIRQFD *irqfd = &proxy->vector_irqfd[vector];
     int ret;
 
-    ret = kvm_irqchip_remove_irqfd_notifier_gsi(kvm_state, n, irqfd->virq);
+    ret = accel_irqchip_remove_irqfd_notifier_gsi(n, irqfd->virq);
     assert(ret == 0);
 }
 static int virtio_pci_get_notifier(VirtIOPCIProxy *proxy, int queue_no,
@@ -995,12 +996,12 @@ static int virtio_pci_one_vector_unmask(VirtIOPCIProxy *proxy,
     if (proxy->vector_irqfd) {
         irqfd = &proxy->vector_irqfd[vector];
         if (irqfd->msg.data != msg.data || irqfd->msg.address != msg.address) {
-            ret = kvm_irqchip_update_msi_route(kvm_state, irqfd->virq, msg,
-                                               &proxy->pci_dev);
+            ret = accel_irqchip_update_msi_route(irqfd->virq, msg,
+                                                 &proxy->pci_dev);
             if (ret < 0) {
                 return ret;
             }
-            kvm_irqchip_commit_routes(kvm_state);
+            accel_irqchip_commit_routes();
         }
     }
 
@@ -1229,7 +1230,7 @@ static int virtio_pci_set_guest_notifiers(DeviceState *d, int nvqs, bool assign)
     VirtioDeviceClass *k = VIRTIO_DEVICE_GET_CLASS(vdev);
     int r, n;
     bool with_irqfd = msix_enabled(&proxy->pci_dev) &&
-        kvm_msi_via_irqfd_enabled();
+        accel_msi_via_irqfd_enabled() ;
 
     nvqs = MIN(nvqs, VIRTIO_QUEUE_MAX);
 
@@ -1433,7 +1434,7 @@ static void virtio_pci_set_vector(VirtIODevice *vdev,
                                   uint16_t new_vector)
 {
     bool kvm_irqfd = (vdev->status & VIRTIO_CONFIG_S_DRIVER_OK) &&
-        msix_enabled(&proxy->pci_dev) && kvm_msi_via_irqfd_enabled();
+        msix_enabled(&proxy->pci_dev) && accel_msi_via_irqfd_enabled();
 
     if (new_vector == old_vector) {
         return;
diff --git a/include/system/accel-irq.h b/include/system/accel-irq.h
new file mode 100644
index 0000000000..671fb7dfdb
--- /dev/null
+++ b/include/system/accel-irq.h
@@ -0,0 +1,37 @@
+/*
+ * Accelerated irqchip abstraction
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef SYSTEM_ACCEL_IRQ_H
+#define SYSTEM_ACCEL_IRQ_H
+#include "hw/pci/msi.h"
+#include "qemu/osdep.h"
+#include "system/kvm.h"
+#include "system/mshv.h"
+
+static inline bool accel_msi_via_irqfd_enabled(void)
+{
+    return mshv_msi_via_irqfd_enabled() || kvm_msi_via_irqfd_enabled();
+}
+
+static inline bool accel_irqchip_is_split(void)
+{
+    return mshv_msi_via_irqfd_enabled() || kvm_irqchip_is_split();
+}
+
+int accel_irqchip_add_msi_route(KVMRouteChange *c, int vector, PCIDevice *dev);
+int accel_irqchip_update_msi_route(int vector, MSIMessage msg, PCIDevice *dev);
+void accel_irqchip_commit_route_changes(KVMRouteChange *c);
+void accel_irqchip_commit_routes(void);
+void accel_irqchip_release_virq(int virq);
+int accel_irqchip_add_irqfd_notifier_gsi(EventNotifier *n, EventNotifier *rn,
+                                         int virq);
+int accel_irqchip_remove_irqfd_notifier_gsi(EventNotifier *n, int virq);
+#endif
diff --git a/include/system/mshv.h b/include/system/mshv.h
index 342f1ef6a9..2a504ed81f 100644
--- a/include/system/mshv.h
+++ b/include/system/mshv.h
@@ -22,4 +22,21 @@
 #define CONFIG_MSHV_IS_POSSIBLE
 #endif
 
+#ifdef CONFIG_MSHV_IS_POSSIBLE
+extern bool mshv_allowed;
+#define mshv_enabled() (mshv_allowed)
+#else /* CONFIG_MSHV_IS_POSSIBLE */
+#define mshv_enabled() false
+#endif
+#define mshv_msi_via_irqfd_enabled() false
+
+/* interrupt */
+int mshv_irqchip_add_msi_route(int vector, PCIDevice *dev);
+int mshv_irqchip_update_msi_route(int virq, MSIMessage msg, PCIDevice *dev);
+void mshv_irqchip_commit_routes(void);
+void mshv_irqchip_release_virq(int virq);
+int mshv_irqchip_add_irqfd_notifier_gsi(const EventNotifier *n,
+                                        const EventNotifier *rn, int virq);
+int mshv_irqchip_remove_irqfd_notifier_gsi(const EventNotifier *n, int virq);
+
 #endif

From 7db6086287502ad5a015ccc31e85ec9cac7e2716 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:25 +0200
Subject: [PATCH 1144/2396] include/hw/hyperv: Add MSHV ABI header definitions

Introduce headers for the Microsoft Hypervisor (MSHV) userspace ABI,
including IOCTLs and structures used to interface with the hypervisor.

These definitions are based on the upstream Linux MSHV interface and
will be used by the MSHV accelerator backend in later patches.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-6-magnuskulke@linux.microsoft.com
[Do not use __uN types. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/hw/hyperv/hvgdk.h       |  20 +
 include/hw/hyperv/hvgdk_mini.h  | 817 ++++++++++++++++++++++++++++++++
 include/hw/hyperv/hvhdk.h       | 249 ++++++++++
 include/hw/hyperv/hvhdk_mini.h  | 102 ++++
 scripts/update-linux-headers.sh |   2 +-
 5 files changed, 1189 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/hyperv/hvgdk.h
 create mode 100644 include/hw/hyperv/hvgdk_mini.h
 create mode 100644 include/hw/hyperv/hvhdk.h
 create mode 100644 include/hw/hyperv/hvhdk_mini.h

diff --git a/include/hw/hyperv/hvgdk.h b/include/hw/hyperv/hvgdk.h
new file mode 100644
index 0000000000..71161f477c
--- /dev/null
+++ b/include/hw/hyperv/hvgdk.h
@@ -0,0 +1,20 @@
+/*
+ * Type definitions for the mshv guest interface.
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_HYPERV_HVGDK_H
+#define HW_HYPERV_HVGDK_H
+
+#define HVGDK_H_VERSION         (25125)
+
+enum hv_unimplemented_msr_action {
+    HV_UNIMPLEMENTED_MSR_ACTION_FAULT = 0,
+    HV_UNIMPLEMENTED_MSR_ACTION_IGNORE_WRITE_READ_ZERO = 1,
+    HV_UNIMPLEMENTED_MSR_ACTION_COUNT = 2,
+};
+
+#endif /* HW_HYPERV_HVGDK_H */
diff --git a/include/hw/hyperv/hvgdk_mini.h b/include/hw/hyperv/hvgdk_mini.h
new file mode 100644
index 0000000000..d89315f545
--- /dev/null
+++ b/include/hw/hyperv/hvgdk_mini.h
@@ -0,0 +1,817 @@
+/*
+ * Userspace interfaces for /dev/mshv* devices and derived fds
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_HYPERV_HVGDK_MINI_H
+#define HW_HYPERV_HVGDK_MINI_H
+
+#define MSHV_IOCTL  0xB8
+
+typedef enum hv_register_name {
+    /* Pending Interruption Register */
+    HV_REGISTER_PENDING_INTERRUPTION = 0x00010002,
+
+    /* X64 User-Mode Registers */
+    HV_X64_REGISTER_RAX     = 0x00020000,
+    HV_X64_REGISTER_RCX     = 0x00020001,
+    HV_X64_REGISTER_RDX     = 0x00020002,
+    HV_X64_REGISTER_RBX     = 0x00020003,
+    HV_X64_REGISTER_RSP     = 0x00020004,
+    HV_X64_REGISTER_RBP     = 0x00020005,
+    HV_X64_REGISTER_RSI     = 0x00020006,
+    HV_X64_REGISTER_RDI     = 0x00020007,
+    HV_X64_REGISTER_R8      = 0x00020008,
+    HV_X64_REGISTER_R9      = 0x00020009,
+    HV_X64_REGISTER_R10     = 0x0002000A,
+    HV_X64_REGISTER_R11     = 0x0002000B,
+    HV_X64_REGISTER_R12     = 0x0002000C,
+    HV_X64_REGISTER_R13     = 0x0002000D,
+    HV_X64_REGISTER_R14     = 0x0002000E,
+    HV_X64_REGISTER_R15     = 0x0002000F,
+    HV_X64_REGISTER_RIP     = 0x00020010,
+    HV_X64_REGISTER_RFLAGS  = 0x00020011,
+
+    /* X64 Floating Point and Vector Registers */
+    HV_X64_REGISTER_XMM0                = 0x00030000,
+    HV_X64_REGISTER_XMM1                = 0x00030001,
+    HV_X64_REGISTER_XMM2                = 0x00030002,
+    HV_X64_REGISTER_XMM3                = 0x00030003,
+    HV_X64_REGISTER_XMM4                = 0x00030004,
+    HV_X64_REGISTER_XMM5                = 0x00030005,
+    HV_X64_REGISTER_XMM6                = 0x00030006,
+    HV_X64_REGISTER_XMM7                = 0x00030007,
+    HV_X64_REGISTER_XMM8                = 0x00030008,
+    HV_X64_REGISTER_XMM9                = 0x00030009,
+    HV_X64_REGISTER_XMM10               = 0x0003000A,
+    HV_X64_REGISTER_XMM11               = 0x0003000B,
+    HV_X64_REGISTER_XMM12               = 0x0003000C,
+    HV_X64_REGISTER_XMM13               = 0x0003000D,
+    HV_X64_REGISTER_XMM14               = 0x0003000E,
+    HV_X64_REGISTER_XMM15               = 0x0003000F,
+    HV_X64_REGISTER_FP_MMX0             = 0x00030010,
+    HV_X64_REGISTER_FP_MMX1             = 0x00030011,
+    HV_X64_REGISTER_FP_MMX2             = 0x00030012,
+    HV_X64_REGISTER_FP_MMX3             = 0x00030013,
+    HV_X64_REGISTER_FP_MMX4             = 0x00030014,
+    HV_X64_REGISTER_FP_MMX5             = 0x00030015,
+    HV_X64_REGISTER_FP_MMX6             = 0x00030016,
+    HV_X64_REGISTER_FP_MMX7             = 0x00030017,
+    HV_X64_REGISTER_FP_CONTROL_STATUS   = 0x00030018,
+    HV_X64_REGISTER_XMM_CONTROL_STATUS  = 0x00030019,
+
+    /* X64 Control Registers */
+    HV_X64_REGISTER_CR0     = 0x00040000,
+    HV_X64_REGISTER_CR2     = 0x00040001,
+    HV_X64_REGISTER_CR3     = 0x00040002,
+    HV_X64_REGISTER_CR4     = 0x00040003,
+    HV_X64_REGISTER_CR8     = 0x00040004,
+    HV_X64_REGISTER_XFEM    = 0x00040005,
+
+    /* X64 Segment Registers */
+    HV_X64_REGISTER_ES      = 0x00060000,
+    HV_X64_REGISTER_CS      = 0x00060001,
+    HV_X64_REGISTER_SS      = 0x00060002,
+    HV_X64_REGISTER_DS      = 0x00060003,
+    HV_X64_REGISTER_FS      = 0x00060004,
+    HV_X64_REGISTER_GS      = 0x00060005,
+    HV_X64_REGISTER_LDTR    = 0x00060006,
+    HV_X64_REGISTER_TR      = 0x00060007,
+
+    /* X64 Table Registers */
+    HV_X64_REGISTER_IDTR    = 0x00070000,
+    HV_X64_REGISTER_GDTR    = 0x00070001,
+
+    /* X64 Virtualized MSRs */
+    HV_X64_REGISTER_TSC             = 0x00080000,
+    HV_X64_REGISTER_EFER            = 0x00080001,
+    HV_X64_REGISTER_KERNEL_GS_BASE  = 0x00080002,
+    HV_X64_REGISTER_APIC_BASE       = 0x00080003,
+    HV_X64_REGISTER_PAT             = 0x00080004,
+    HV_X64_REGISTER_SYSENTER_CS     = 0x00080005,
+    HV_X64_REGISTER_SYSENTER_EIP    = 0x00080006,
+    HV_X64_REGISTER_SYSENTER_ESP    = 0x00080007,
+    HV_X64_REGISTER_STAR            = 0x00080008,
+    HV_X64_REGISTER_LSTAR           = 0x00080009,
+    HV_X64_REGISTER_CSTAR           = 0x0008000A,
+    HV_X64_REGISTER_SFMASK          = 0x0008000B,
+    HV_X64_REGISTER_INITIAL_APIC_ID = 0x0008000C,
+
+    /* X64 Cache control MSRs */
+    HV_X64_REGISTER_MSR_MTRR_CAP            = 0x0008000D,
+    HV_X64_REGISTER_MSR_MTRR_DEF_TYPE       = 0x0008000E,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE0     = 0x00080010,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE1     = 0x00080011,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE2     = 0x00080012,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE3     = 0x00080013,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE4     = 0x00080014,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE5     = 0x00080015,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE6     = 0x00080016,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE7     = 0x00080017,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE8     = 0x00080018,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASE9     = 0x00080019,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASEA     = 0x0008001A,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASEB     = 0x0008001B,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASEC     = 0x0008001C,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASED     = 0x0008001D,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASEE     = 0x0008001E,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_BASEF     = 0x0008001F,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK0     = 0x00080040,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK1     = 0x00080041,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK2     = 0x00080042,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK3     = 0x00080043,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK4     = 0x00080044,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK5     = 0x00080045,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK6     = 0x00080046,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK7     = 0x00080047,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK8     = 0x00080048,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASK9     = 0x00080049,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKA     = 0x0008004A,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKB     = 0x0008004B,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKC     = 0x0008004C,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKD     = 0x0008004D,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKE     = 0x0008004E,
+    HV_X64_REGISTER_MSR_MTRR_PHYS_MASKF     = 0x0008004F,
+    HV_X64_REGISTER_MSR_MTRR_FIX64K00000    = 0x00080070,
+    HV_X64_REGISTER_MSR_MTRR_FIX16K80000    = 0x00080071,
+    HV_X64_REGISTER_MSR_MTRR_FIX16KA0000    = 0x00080072,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KC0000     = 0x00080073,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KC8000     = 0x00080074,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KD0000     = 0x00080075,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KD8000     = 0x00080076,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KE0000     = 0x00080077,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KE8000     = 0x00080078,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KF0000     = 0x00080079,
+    HV_X64_REGISTER_MSR_MTRR_FIX4KF8000     = 0x0008007A,
+
+    HV_X64_REGISTER_TSC_AUX     = 0x0008007B,
+    HV_X64_REGISTER_BNDCFGS     = 0x0008007C,
+    HV_X64_REGISTER_DEBUG_CTL   = 0x0008007D,
+
+    /* Available */
+
+    HV_X64_REGISTER_SPEC_CTRL       = 0x00080084,
+    HV_X64_REGISTER_TSC_ADJUST      = 0x00080096,
+
+    /* Other MSRs */
+    HV_X64_REGISTER_MSR_IA32_MISC_ENABLE = 0x000800A0,
+
+    /* Misc */
+    HV_REGISTER_GUEST_OS_ID         = 0x00090002,
+    HV_REGISTER_REFERENCE_TSC       = 0x00090017,
+
+    /* Hypervisor-defined Registers (Synic) */
+    HV_REGISTER_SINT0       = 0x000A0000,
+    HV_REGISTER_SINT1       = 0x000A0001,
+    HV_REGISTER_SINT2       = 0x000A0002,
+    HV_REGISTER_SINT3       = 0x000A0003,
+    HV_REGISTER_SINT4       = 0x000A0004,
+    HV_REGISTER_SINT5       = 0x000A0005,
+    HV_REGISTER_SINT6       = 0x000A0006,
+    HV_REGISTER_SINT7       = 0x000A0007,
+    HV_REGISTER_SINT8       = 0x000A0008,
+    HV_REGISTER_SINT9       = 0x000A0009,
+    HV_REGISTER_SINT10      = 0x000A000A,
+    HV_REGISTER_SINT11      = 0x000A000B,
+    HV_REGISTER_SINT12      = 0x000A000C,
+    HV_REGISTER_SINT13      = 0x000A000D,
+    HV_REGISTER_SINT14      = 0x000A000E,
+    HV_REGISTER_SINT15      = 0x000A000F,
+    HV_REGISTER_SCONTROL    = 0x000A0010,
+    HV_REGISTER_SVERSION    = 0x000A0011,
+    HV_REGISTER_SIEFP       = 0x000A0012,
+    HV_REGISTER_SIMP        = 0x000A0013,
+    HV_REGISTER_EOM         = 0x000A0014,
+    HV_REGISTER_SIRBP       = 0x000A0015,
+} hv_register_name;
+
+enum hv_intercept_type {
+    HV_INTERCEPT_TYPE_X64_IO_PORT       = 0X00000000,
+    HV_INTERCEPT_TYPE_X64_MSR           = 0X00000001,
+    HV_INTERCEPT_TYPE_X64_CPUID         = 0X00000002,
+    HV_INTERCEPT_TYPE_EXCEPTION         = 0X00000003,
+
+    /* Used to be HV_INTERCEPT_TYPE_REGISTER */
+    HV_INTERCEPT_TYPE_RESERVED0         = 0X00000004,
+    HV_INTERCEPT_TYPE_MMIO              = 0X00000005,
+    HV_INTERCEPT_TYPE_X64_GLOBAL_CPUID  = 0X00000006,
+    HV_INTERCEPT_TYPE_X64_APIC_SMI      = 0X00000007,
+    HV_INTERCEPT_TYPE_HYPERCALL         = 0X00000008,
+
+    HV_INTERCEPT_TYPE_X64_APIC_INIT_SIPI        = 0X00000009,
+    HV_INTERCEPT_MC_UPDATE_PATCH_LEVEL_MSR_READ = 0X0000000A,
+
+    HV_INTERCEPT_TYPE_X64_APIC_WRITE        = 0X0000000B,
+    HV_INTERCEPT_TYPE_X64_MSR_INDEX         = 0X0000000C,
+    HV_INTERCEPT_TYPE_MAX,
+    HV_INTERCEPT_TYPE_INVALID               = 0XFFFFFFFF,
+};
+
+struct hv_u128 {
+    uint64_t low_part;
+    uint64_t high_part;
+};
+
+union hv_x64_xmm_control_status_register {
+    struct hv_u128 as_uint128;
+    struct {
+        union {
+            /* long mode */
+            uint64_t last_fp_rdp;
+            /* 32 bit mode */
+            struct {
+                uint32_t last_fp_dp;
+                uint16_t last_fp_ds;
+                uint16_t padding;
+            };
+        };
+        uint32_t xmm_status_control;
+        uint32_t xmm_status_control_mask;
+    };
+};
+
+union hv_x64_fp_register {
+    struct hv_u128 as_uint128;
+    struct {
+        uint64_t mantissa;
+        uint64_t biased_exponent:15;
+        uint64_t sign:1;
+        uint64_t reserved:48;
+    };
+};
+
+union hv_x64_pending_exception_event {
+    uint64_t as_uint64[2];
+    struct {
+        uint32_t event_pending:1;
+        uint32_t event_type:3;
+        uint32_t reserved0:4;
+        uint32_t deliver_error_code:1;
+        uint32_t reserved1:7;
+        uint32_t vector:16;
+        uint32_t error_code;
+        uint64_t exception_parameter;
+    };
+};
+
+union hv_x64_pending_virtualization_fault_event {
+    uint64_t as_uint64[2];
+    struct {
+        uint32_t event_pending:1;
+        uint32_t event_type:3;
+        uint32_t reserved0:4;
+        uint32_t reserved1:8;
+        uint32_t parameter0:16;
+        uint32_t code;
+        uint64_t parameter1;
+    };
+};
+
+union hv_x64_pending_interruption_register {
+    uint64_t as_uint64;
+    struct {
+        uint32_t interruption_pending:1;
+        uint32_t interruption_type:3;
+        uint32_t deliver_error_code:1;
+        uint32_t instruction_length:4;
+        uint32_t nested_event:1;
+        uint32_t reserved:6;
+        uint32_t interruption_vector:16;
+        uint32_t error_code;
+    };
+};
+
+union hv_x64_register_sev_control {
+    uint64_t as_uint64;
+    struct {
+        uint64_t enable_encrypted_state:1;
+        uint64_t reserved_z:11;
+        uint64_t vmsa_gpa_page_number:52;
+    };
+};
+
+union hv_x64_msr_npiep_config_contents {
+    uint64_t as_uint64;
+    struct {
+        /*
+         * These bits enable instruction execution prevention for
+         * specific instructions.
+         */
+        uint64_t prevents_gdt:1;
+        uint64_t prevents_idt:1;
+        uint64_t prevents_ldt:1;
+        uint64_t prevents_tr:1;
+
+        /* The reserved bits must always be 0. */
+        uint64_t reserved:60;
+    };
+};
+
+typedef struct hv_x64_segment_register {
+    uint64_t base;
+    uint32_t limit;
+    uint16_t selector;
+    union {
+        struct {
+            uint16_t segment_type:4;
+            uint16_t non_system_segment:1;
+            uint16_t descriptor_privilege_level:2;
+            uint16_t present:1;
+            uint16_t reserved:4;
+            uint16_t available:1;
+            uint16_t _long:1;
+            uint16_t _default:1;
+            uint16_t granularity:1;
+        };
+        uint16_t attributes;
+    };
+} hv_x64_segment_register;
+
+typedef struct hv_x64_table_register {
+    uint16_t pad[3];
+    uint16_t limit;
+    uint64_t base;
+} hv_x64_table_register;
+
+union hv_x64_fp_control_status_register {
+    struct hv_u128 as_uint128;
+    struct {
+        uint16_t fp_control;
+        uint16_t fp_status;
+        uint8_t fp_tag;
+        uint8_t reserved;
+        uint16_t last_fp_op;
+        union {
+            /* long mode */
+            uint64_t last_fp_rip;
+            /* 32 bit mode */
+            struct {
+                uint32_t last_fp_eip;
+                uint16_t last_fp_cs;
+                uint16_t padding;
+            };
+        };
+    };
+};
+
+/* General Hypervisor Register Content Definitions */
+
+union hv_explicit_suspend_register {
+    uint64_t as_uint64;
+    struct {
+        uint64_t suspended:1;
+        uint64_t reserved:63;
+    };
+};
+
+union hv_internal_activity_register {
+    uint64_t as_uint64;
+
+    struct {
+        uint64_t startup_suspend:1;
+        uint64_t halt_suspend:1;
+        uint64_t idle_suspend:1;
+        uint64_t rsvd_z:61;
+    };
+};
+
+union hv_x64_interrupt_state_register {
+    uint64_t as_uint64;
+    struct {
+        uint64_t interrupt_shadow:1;
+        uint64_t nmi_masked:1;
+        uint64_t reserved:62;
+    };
+};
+
+union hv_intercept_suspend_register {
+    uint64_t as_uint64;
+    struct {
+        uint64_t suspended:1;
+        uint64_t reserved:63;
+    };
+};
+
+typedef union hv_register_value {
+    struct hv_u128 reg128;
+    uint64_t reg64;
+    uint32_t reg32;
+    uint16_t reg16;
+    uint8_t reg8;
+    union hv_x64_fp_register fp;
+    union hv_x64_fp_control_status_register fp_control_status;
+    union hv_x64_xmm_control_status_register xmm_control_status;
+    struct hv_x64_segment_register segment;
+    struct hv_x64_table_register table;
+    union hv_explicit_suspend_register explicit_suspend;
+    union hv_intercept_suspend_register intercept_suspend;
+    union hv_internal_activity_register internal_activity;
+    union hv_x64_interrupt_state_register interrupt_state;
+    union hv_x64_pending_interruption_register pending_interruption;
+    union hv_x64_msr_npiep_config_contents npiep_config;
+    union hv_x64_pending_exception_event pending_exception_event;
+    union hv_x64_pending_virtualization_fault_event
+        pending_virtualization_fault_event;
+    union hv_x64_register_sev_control sev_control;
+} hv_register_value;
+
+typedef struct hv_register_assoc {
+    uint32_t name;         /* enum hv_register_name */
+    uint32_t reserved1;
+    uint64_t reserved2;
+    union hv_register_value value;
+} hv_register_assoc;
+
+union hv_input_vtl {
+    uint8_t as_uint8;
+    struct {
+        uint8_t target_vtl:4;
+        uint8_t use_target_vtl:1;
+        uint8_t reserved_z:3;
+    };
+};
+
+typedef struct hv_input_get_vp_registers {
+    uint64_t partition_id;
+    uint32_t vp_index;
+    union hv_input_vtl input_vtl;
+    uint8_t  rsvd_z8;
+    uint16_t rsvd_z16;
+    uint32_t names[];
+} hv_input_get_vp_registers;
+
+typedef struct hv_input_set_vp_registers {
+    uint64_t partition_id;
+    uint32_t vp_index;
+    union hv_input_vtl input_vtl;
+    uint8_t  rsvd_z8;
+    uint16_t rsvd_z16;
+    struct hv_register_assoc elements[];
+} hv_input_set_vp_registers;
+
+#define MSHV_VP_MAX_REGISTERS   128
+
+struct mshv_vp_registers {
+    int count; /* at most MSHV_VP_MAX_REGISTERS */
+    struct hv_register_assoc *regs;
+};
+
+union hv_interrupt_control {
+    uint64_t as_uint64;
+    struct {
+        uint32_t interrupt_type; /* enum hv_interrupt type */
+        uint32_t level_triggered:1;
+        uint32_t logical_dest_mode:1;
+        uint32_t rsvd:30;
+    };
+};
+
+struct hv_input_assert_virtual_interrupt {
+    uint64_t partition_id;
+    union hv_interrupt_control control;
+    uint64_t dest_addr; /* cpu's apic id */
+    uint32_t vector;
+    uint8_t target_vtl;
+    uint8_t rsvd_z0;
+    uint16_t rsvd_z1;
+};
+
+/* /dev/mshv */
+#define MSHV_CREATE_PARTITION   _IOW(MSHV_IOCTL, 0x00, struct mshv_create_partition)
+#define MSHV_CREATE_VP          _IOW(MSHV_IOCTL, 0x01, struct mshv_create_vp)
+
+/* Partition fds created with MSHV_CREATE_PARTITION */
+#define MSHV_INITIALIZE_PARTITION   _IO(MSHV_IOCTL, 0x00)
+#define MSHV_SET_GUEST_MEMORY       _IOW(MSHV_IOCTL, 0x02, struct mshv_user_mem_region)
+#define MSHV_IRQFD                  _IOW(MSHV_IOCTL, 0x03, struct mshv_user_irqfd)
+#define MSHV_IOEVENTFD              _IOW(MSHV_IOCTL, 0x04, struct mshv_user_ioeventfd)
+#define MSHV_SET_MSI_ROUTING        _IOW(MSHV_IOCTL, 0x05, struct mshv_user_irq_table)
+
+/*
+ ********************************
+ * VP APIs for child partitions *
+ ********************************
+ */
+
+struct hv_local_interrupt_controller_state {
+    /* HV_X64_INTERRUPT_CONTROLLER_STATE */
+    uint32_t apic_id;
+    uint32_t apic_version;
+    uint32_t apic_ldr;
+    uint32_t apic_dfr;
+    uint32_t apic_spurious;
+    uint32_t apic_isr[8];
+    uint32_t apic_tmr[8];
+    uint32_t apic_irr[8];
+    uint32_t apic_esr;
+    uint32_t apic_icr_high;
+    uint32_t apic_icr_low;
+    uint32_t apic_lvt_timer;
+    uint32_t apic_lvt_thermal;
+    uint32_t apic_lvt_perfmon;
+    uint32_t apic_lvt_lint0;
+    uint32_t apic_lvt_lint1;
+    uint32_t apic_lvt_error;
+    uint32_t apic_lvt_cmci;
+    uint32_t apic_error_status;
+    uint32_t apic_initial_count;
+    uint32_t apic_counter_value;
+    uint32_t apic_divide_configuration;
+    uint32_t apic_remote_read;
+};
+
+/* Generic hypercall */
+#define MSHV_ROOT_HVCALL        _IOWR(MSHV_IOCTL, 0x07, struct mshv_root_hvcall)
+
+/* From hvgdk_mini.h */
+
+#define HV_X64_MSR_GUEST_OS_ID      0x40000000
+#define HV_X64_MSR_SINT0            0x40000090
+#define HV_X64_MSR_SINT1            0x40000091
+#define HV_X64_MSR_SINT2            0x40000092
+#define HV_X64_MSR_SINT3            0x40000093
+#define HV_X64_MSR_SINT4            0x40000094
+#define HV_X64_MSR_SINT5            0x40000095
+#define HV_X64_MSR_SINT6            0x40000096
+#define HV_X64_MSR_SINT7            0x40000097
+#define HV_X64_MSR_SINT8            0x40000098
+#define HV_X64_MSR_SINT9            0x40000099
+#define HV_X64_MSR_SINT10           0x4000009A
+#define HV_X64_MSR_SINT11           0x4000009B
+#define HV_X64_MSR_SINT12           0x4000009C
+#define HV_X64_MSR_SINT13           0x4000009D
+#define HV_X64_MSR_SINT14           0x4000009E
+#define HV_X64_MSR_SINT15           0x4000009F
+#define HV_X64_MSR_SCONTROL         0x40000080
+#define HV_X64_MSR_SIEFP            0x40000082
+#define HV_X64_MSR_SIMP             0x40000083
+#define HV_X64_MSR_REFERENCE_TSC    0x40000021
+#define HV_X64_MSR_EOM              0x40000084
+
+/* Define port identifier type. */
+union hv_port_id {
+    uint32_t asuint32_t;
+    struct {
+        uint32_t id:24;
+        uint32_t reserved:8;
+    };
+};
+
+#define HV_MESSAGE_SIZE                 (256)
+#define HV_MESSAGE_PAYLOAD_BYTE_COUNT   (240)
+#define HV_MESSAGE_PAYLOAD_QWORD_COUNT  (30)
+
+/* Define hypervisor message types. */
+enum hv_message_type {
+    HVMSG_NONE                          = 0x00000000,
+
+    /* Memory access messages. */
+    HVMSG_UNMAPPED_GPA                  = 0x80000000,
+    HVMSG_GPA_INTERCEPT                 = 0x80000001,
+    HVMSG_UNACCEPTED_GPA                = 0x80000003,
+    HVMSG_GPA_ATTRIBUTE_INTERCEPT       = 0x80000004,
+
+    /* Timer notification messages. */
+    HVMSG_TIMER_EXPIRED                 = 0x80000010,
+
+    /* Error messages. */
+    HVMSG_INVALID_VP_REGISTER_VALUE     = 0x80000020,
+    HVMSG_UNRECOVERABLE_EXCEPTION       = 0x80000021,
+    HVMSG_UNSUPPORTED_FEATURE           = 0x80000022,
+
+    /*
+     * Opaque intercept message. The original intercept message is only
+     * accessible from the mapped intercept message page.
+     */
+    HVMSG_OPAQUE_INTERCEPT              = 0x8000003F,
+
+    /* Trace buffer complete messages. */
+    HVMSG_EVENTLOG_BUFFERCOMPLETE       = 0x80000040,
+
+    /* Hypercall intercept */
+    HVMSG_HYPERCALL_INTERCEPT           = 0x80000050,
+
+    /* SynIC intercepts */
+    HVMSG_SYNIC_EVENT_INTERCEPT         = 0x80000060,
+    HVMSG_SYNIC_SINT_INTERCEPT          = 0x80000061,
+    HVMSG_SYNIC_SINT_DELIVERABLE        = 0x80000062,
+
+    /* Async call completion intercept */
+    HVMSG_ASYNC_CALL_COMPLETION         = 0x80000070,
+
+    /* Root scheduler messages */
+    HVMSG_SCHEDULER_VP_SIGNAL_BITSE     = 0x80000100,
+    HVMSG_SCHEDULER_VP_SIGNAL_PAIR      = 0x80000101,
+
+    /* Platform-specific processor intercept messages. */
+    HVMSG_X64_IO_PORT_INTERCEPT         = 0x80010000,
+    HVMSG_X64_MSR_INTERCEPT             = 0x80010001,
+    HVMSG_X64_CPUID_INTERCEPT           = 0x80010002,
+    HVMSG_X64_EXCEPTION_INTERCEPT       = 0x80010003,
+    HVMSG_X64_APIC_EOI                  = 0x80010004,
+    HVMSG_X64_LEGACY_FP_ERROR           = 0x80010005,
+    HVMSG_X64_IOMMU_PRQ                 = 0x80010006,
+    HVMSG_X64_HALT                      = 0x80010007,
+    HVMSG_X64_INTERRUPTION_DELIVERABLE  = 0x80010008,
+    HVMSG_X64_SIPI_INTERCEPT            = 0x80010009,
+    HVMSG_X64_SEV_VMGEXIT_INTERCEPT     = 0x80010013,
+};
+
+union hv_x64_vp_execution_state {
+    uint16_t as_uint16;
+    struct {
+        uint16_t cpl:2;
+        uint16_t cr0_pe:1;
+        uint16_t cr0_am:1;
+        uint16_t efer_lma:1;
+        uint16_t debug_active:1;
+        uint16_t interruption_pending:1;
+        uint16_t vtl:4;
+        uint16_t enclave_mode:1;
+        uint16_t interrupt_shadow:1;
+        uint16_t virtualization_fault_active:1;
+        uint16_t reserved:2;
+    };
+};
+
+/* From openvmm::hvdef */
+enum hv_x64_intercept_access_type {
+    HV_X64_INTERCEPT_ACCESS_TYPE_READ = 0,
+    HV_X64_INTERCEPT_ACCESS_TYPE_WRITE = 1,
+    HV_X64_INTERCEPT_ACCESS_TYPE_EXECUTE = 2,
+};
+
+struct hv_x64_intercept_message_header {
+    uint32_t vp_index;
+    uint8_t instruction_length:4;
+    uint8_t cr8:4; /* Only set for exo partitions */
+    uint8_t intercept_access_type;
+    union hv_x64_vp_execution_state execution_state;
+    struct hv_x64_segment_register cs_segment;
+    uint64_t rip;
+    uint64_t rflags;
+};
+
+union hv_x64_io_port_access_info {
+    uint8_t as_uint8;
+    struct {
+        uint8_t access_size:3;
+        uint8_t string_op:1;
+        uint8_t rep_prefix:1;
+        uint8_t reserved:3;
+    };
+};
+
+typedef struct hv_x64_io_port_intercept_message {
+    struct hv_x64_intercept_message_header header;
+    uint16_t port_number;
+    union hv_x64_io_port_access_info access_info;
+    uint8_t instruction_byte_count;
+    uint32_t reserved;
+    uint64_t rax;
+    uint8_t instruction_bytes[16];
+    struct hv_x64_segment_register ds_segment;
+    struct hv_x64_segment_register es_segment;
+    uint64_t rcx;
+    uint64_t rsi;
+    uint64_t rdi;
+} hv_x64_io_port_intercept_message;
+
+union hv_x64_memory_access_info {
+    uint8_t as_uint8;
+    struct {
+        uint8_t gva_valid:1;
+        uint8_t gva_gpa_valid:1;
+        uint8_t hypercall_output_pending:1;
+        uint8_t tlb_locked_no_overlay:1;
+        uint8_t reserved:4;
+    };
+};
+
+struct hv_x64_memory_intercept_message {
+    struct hv_x64_intercept_message_header header;
+    uint32_t cache_type; /* enum hv_cache_type */
+    uint8_t instruction_byte_count;
+    union hv_x64_memory_access_info memory_access_info;
+    uint8_t tpr_priority;
+    uint8_t reserved1;
+    uint64_t guest_virtual_address;
+    uint64_t guest_physical_address;
+    uint8_t instruction_bytes[16];
+};
+
+union hv_message_flags {
+    uint8_t asu8;
+    struct {
+        uint8_t msg_pending:1;
+        uint8_t reserved:7;
+    };
+};
+
+struct hv_message_header {
+    uint32_t message_type;
+    uint8_t payload_size;
+    union hv_message_flags message_flags;
+    uint8_t reserved[2];
+    union {
+        uint64_t sender;
+        union hv_port_id port;
+    };
+};
+
+struct hv_message {
+    struct hv_message_header header;
+    union {
+        uint64_t payload[HV_MESSAGE_PAYLOAD_QWORD_COUNT];
+    } u;
+};
+
+/* From  github.com/rust-vmm/mshv-bindings/src/x86_64/regs.rs */
+
+struct hv_cpuid_entry {
+    uint32_t function;
+    uint32_t index;
+    uint32_t flags;
+    uint32_t eax;
+    uint32_t ebx;
+    uint32_t ecx;
+    uint32_t edx;
+    uint32_t padding[3];
+};
+
+struct hv_cpuid {
+    uint32_t nent;
+    uint32_t padding;
+    struct hv_cpuid_entry entries[0];
+};
+
+#define IA32_MSR_TSC            0x00000010
+#define IA32_MSR_EFER           0xC0000080
+#define IA32_MSR_KERNEL_GS_BASE 0xC0000102
+#define IA32_MSR_APIC_BASE      0x0000001B
+#define IA32_MSR_PAT            0x0277
+#define IA32_MSR_SYSENTER_CS    0x00000174
+#define IA32_MSR_SYSENTER_ESP   0x00000175
+#define IA32_MSR_SYSENTER_EIP   0x00000176
+#define IA32_MSR_STAR           0xC0000081
+#define IA32_MSR_LSTAR          0xC0000082
+#define IA32_MSR_CSTAR          0xC0000083
+#define IA32_MSR_SFMASK         0xC0000084
+
+#define IA32_MSR_MTRR_CAP       0x00FE
+#define IA32_MSR_MTRR_DEF_TYPE  0x02FF
+#define IA32_MSR_MTRR_PHYSBASE0 0x0200
+#define IA32_MSR_MTRR_PHYSMASK0 0x0201
+#define IA32_MSR_MTRR_PHYSBASE1 0x0202
+#define IA32_MSR_MTRR_PHYSMASK1 0x0203
+#define IA32_MSR_MTRR_PHYSBASE2 0x0204
+#define IA32_MSR_MTRR_PHYSMASK2 0x0205
+#define IA32_MSR_MTRR_PHYSBASE3 0x0206
+#define IA32_MSR_MTRR_PHYSMASK3 0x0207
+#define IA32_MSR_MTRR_PHYSBASE4 0x0208
+#define IA32_MSR_MTRR_PHYSMASK4 0x0209
+#define IA32_MSR_MTRR_PHYSBASE5 0x020A
+#define IA32_MSR_MTRR_PHYSMASK5 0x020B
+#define IA32_MSR_MTRR_PHYSBASE6 0x020C
+#define IA32_MSR_MTRR_PHYSMASK6 0x020D
+#define IA32_MSR_MTRR_PHYSBASE7 0x020E
+#define IA32_MSR_MTRR_PHYSMASK7 0x020F
+
+#define IA32_MSR_MTRR_FIX64K_00000 0x0250
+#define IA32_MSR_MTRR_FIX16K_80000 0x0258
+#define IA32_MSR_MTRR_FIX16K_A0000 0x0259
+#define IA32_MSR_MTRR_FIX4K_C0000 0x0268
+#define IA32_MSR_MTRR_FIX4K_C8000 0x0269
+#define IA32_MSR_MTRR_FIX4K_D0000 0x026A
+#define IA32_MSR_MTRR_FIX4K_D8000 0x026B
+#define IA32_MSR_MTRR_FIX4K_E0000 0x026C
+#define IA32_MSR_MTRR_FIX4K_E8000 0x026D
+#define IA32_MSR_MTRR_FIX4K_F0000 0x026E
+#define IA32_MSR_MTRR_FIX4K_F8000 0x026F
+
+#define IA32_MSR_TSC_AUX          0xC0000103
+#define IA32_MSR_BNDCFGS          0x00000d90
+#define IA32_MSR_DEBUG_CTL        0x1D9
+#define IA32_MSR_SPEC_CTRL        0x00000048
+#define IA32_MSR_TSC_ADJUST       0x0000003b
+
+#define IA32_MSR_MISC_ENABLE 0x000001a0
+
+#define HV_TRANSLATE_GVA_VALIDATE_READ       (0x0001)
+#define HV_TRANSLATE_GVA_VALIDATE_WRITE      (0x0002)
+#define HV_TRANSLATE_GVA_VALIDATE_EXECUTE    (0x0004)
+
+#define HV_HYP_PAGE_SHIFT       12
+#define HV_HYP_PAGE_SIZE        BIT(HV_HYP_PAGE_SHIFT)
+#define HV_HYP_PAGE_MASK        (~(HV_HYP_PAGE_SIZE - 1))
+
+#define HVCALL_GET_PARTITION_PROPERTY    0x0044
+#define HVCALL_SET_PARTITION_PROPERTY    0x0045
+#define HVCALL_GET_VP_REGISTERS          0x0050
+#define HVCALL_SET_VP_REGISTERS          0x0051
+#define HVCALL_TRANSLATE_VIRTUAL_ADDRESS 0x0052
+#define HVCALL_REGISTER_INTERCEPT_RESULT 0x0091
+#define HVCALL_ASSERT_VIRTUAL_INTERRUPT  0x0094
+
+#endif /* HW_HYPERV_HVGDK_MINI_H */
diff --git a/include/hw/hyperv/hvhdk.h b/include/hw/hyperv/hvhdk.h
new file mode 100644
index 0000000000..866c8211bf
--- /dev/null
+++ b/include/hw/hyperv/hvhdk.h
@@ -0,0 +1,249 @@
+/*
+ * Type definitions for the mshv host.
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_HYPERV_HVHDK_H
+#define HW_HYPERV_HVHDK_H
+
+#define HV_PARTITION_SYNTHETIC_PROCESSOR_FEATURES_BANKS 1
+
+struct hv_input_set_partition_property {
+    uint64_t partition_id;
+    uint32_t property_code; /* enum hv_partition_property_code */
+    uint32_t padding;
+    uint64_t property_value;
+};
+
+union hv_partition_synthetic_processor_features {
+    uint64_t as_uint64[HV_PARTITION_SYNTHETIC_PROCESSOR_FEATURES_BANKS];
+
+    struct {
+        /*
+         * Report a hypervisor is present. CPUID leaves
+         * 0x40000000 and 0x40000001 are supported.
+         */
+        uint64_t hypervisor_present:1;
+
+        /*
+         * Features associated with HV#1:
+         */
+
+        /* Report support for Hv1 (CPUID leaves 0x40000000 - 0x40000006). */
+        uint64_t hv1:1;
+
+        /*
+         * Access to HV_X64_MSR_VP_RUNTIME.
+         * Corresponds to access_vp_run_time_reg privilege.
+         */
+        uint64_t access_vp_run_time_reg:1;
+
+        /*
+         * Access to HV_X64_MSR_TIME_REF_COUNT.
+         * Corresponds to access_partition_reference_counter privilege.
+         */
+        uint64_t access_partition_reference_counter:1;
+
+        /*
+         * Access to SINT-related registers (HV_X64_MSR_SCONTROL through
+         * HV_X64_MSR_EOM and HV_X64_MSR_SINT0 through HV_X64_MSR_SINT15).
+         * Corresponds to access_synic_regs privilege.
+         */
+        uint64_t access_synic_regs:1;
+
+        /*
+         * Access to synthetic timers and associated MSRs
+         * (HV_X64_MSR_STIMER0_CONFIG through HV_X64_MSR_STIMER3_COUNT).
+         * Corresponds to access_synthetic_timer_regs privilege.
+         */
+        uint64_t access_synthetic_timer_regs:1;
+
+        /*
+         * Access to APIC MSRs (HV_X64_MSR_EOI, HV_X64_MSR_ICR and
+         * HV_X64_MSR_TPR) as well as the VP assist page.
+         * Corresponds to access_intr_ctrl_regs privilege.
+         */
+        uint64_t access_intr_ctrl_regs:1;
+
+        /*
+         * Access to registers associated with hypercalls
+         * (HV_X64_MSR_GUEST_OS_ID and HV_X64_MSR_HYPERCALL).
+         * Corresponds to access_hypercall_msrs privilege.
+         */
+        uint64_t access_hypercall_regs:1;
+
+        /* VP index can be queried. corresponds to access_vp_index privilege. */
+        uint64_t access_vp_index:1;
+
+        /*
+         * Access to the reference TSC. Corresponds to
+         * access_partition_reference_tsc privilege.
+         */
+        uint64_t access_partition_reference_tsc:1;
+
+        /*
+         * Partition has access to the guest idle reg. Corresponds to
+         * access_guest_idle_reg privilege.
+         */
+        uint64_t access_guest_idle_reg:1;
+
+        /*
+         * Partition has access to frequency regs. corresponds to
+         * access_frequency_regs privilege.
+         */
+        uint64_t access_frequency_regs:1;
+
+        uint64_t reserved_z12:1; /* Reserved for access_reenlightenment_controls */
+        uint64_t reserved_z13:1; /* Reserved for access_root_scheduler_reg */
+        uint64_t reserved_z14:1; /* Reserved for access_tsc_invariant_controls */
+
+        /*
+         * Extended GVA ranges for HvCallFlushVirtualAddressList hypercall.
+         * Corresponds to privilege.
+         */
+        uint64_t enable_extended_gva_ranges_for_flush_virtual_address_list:1;
+
+        uint64_t reserved_z16:1; /* Reserved for access_vsm. */
+        uint64_t reserved_z17:1; /* Reserved for access_vp_registers. */
+
+        /* Use fast hypercall output. Corresponds to privilege. */
+        uint64_t fast_hypercall_output:1;
+
+        uint64_t reserved_z19:1; /* Reserved for enable_extended_hypercalls. */
+
+        /*
+         * HvStartVirtualProcessor can be used to start virtual processors.
+         * Corresponds to privilege.
+         */
+        uint64_t start_virtual_processor:1;
+
+        uint64_t reserved_z21:1; /* Reserved for Isolation. */
+
+        /* Synthetic timers in direct mode. */
+        uint64_t direct_synthetic_timers:1;
+
+        uint64_t reserved_z23:1; /* Reserved for synthetic time unhalted timer */
+
+        /* Use extended processor masks. */
+        uint64_t extended_processor_masks:1;
+
+        /*
+         * HvCallFlushVirtualAddressSpace / HvCallFlushVirtualAddressList are
+         * supported.
+         */
+        uint64_t tb_flush_hypercalls:1;
+
+        /* HvCallSendSyntheticClusterIpi is supported. */
+        uint64_t synthetic_cluster_ipi:1;
+
+        /* HvCallNotifyLongSpinWait is supported. */
+        uint64_t notify_long_spin_wait:1;
+
+        /* HvCallQueryNumaDistance is supported. */
+        uint64_t query_numa_distance:1;
+
+        /* HvCallSignalEvent is supported. Corresponds to privilege. */
+        uint64_t signal_events:1;
+
+        /* HvCallRetargetDeviceInterrupt is supported. */
+        uint64_t retarget_device_interrupt:1;
+
+        /* HvCallRestorePartitionTime is supported. */
+        uint64_t restore_time:1;
+
+        /* EnlightenedVmcs nested enlightenment is supported. */
+        uint64_t enlightened_vmcs:1;
+
+        uint64_t reserved:30;
+    };
+};
+
+enum hv_translate_gva_result_code {
+    HV_TRANSLATE_GVA_SUCCESS                    = 0,
+
+    /* Translation failures. */
+    HV_TRANSLATE_GVA_PAGE_NOT_PRESENT           = 1,
+    HV_TRANSLATE_GVA_PRIVILEGE_VIOLATION        = 2,
+    HV_TRANSLATE_GVA_INVALIDE_PAGE_TABLE_FLAGS  = 3,
+
+    /* GPA access failures. */
+    HV_TRANSLATE_GVA_GPA_UNMAPPED               = 4,
+    HV_TRANSLATE_GVA_GPA_NO_READ_ACCESS         = 5,
+    HV_TRANSLATE_GVA_GPA_NO_WRITE_ACCESS        = 6,
+    HV_TRANSLATE_GVA_GPA_ILLEGAL_OVERLAY_ACCESS = 7,
+
+    /*
+     * Intercept for memory access by either
+     *  - a higher VTL
+     *  - a nested hypervisor (due to a violation of the nested page table)
+     */
+    HV_TRANSLATE_GVA_INTERCEPT                  = 8,
+
+    HV_TRANSLATE_GVA_GPA_UNACCEPTED             = 9,
+};
+
+union hv_translate_gva_result {
+    uint64_t as_uint64;
+    struct {
+        uint32_t result_code; /* enum hv_translate_hva_result_code */
+        uint32_t cache_type:8;
+        uint32_t overlay_page:1;
+        uint32_t reserved:23;
+    };
+};
+
+typedef struct hv_input_translate_virtual_address {
+    uint64_t partition_id;
+    uint32_t vp_index;
+    uint32_t padding;
+    uint64_t control_flags;
+    uint64_t gva_page;
+} hv_input_translate_virtual_address;
+
+typedef struct hv_output_translate_virtual_address {
+    union hv_translate_gva_result translation_result;
+    uint64_t gpa_page;
+} hv_output_translate_virtual_address;
+
+typedef struct hv_register_x64_cpuid_result_parameters {
+    struct {
+        uint32_t eax;
+        uint32_t ecx;
+        uint8_t subleaf_specific;
+        uint8_t always_override;
+        uint16_t padding;
+    } input;
+    struct {
+        uint32_t eax;
+        uint32_t eax_mask;
+        uint32_t ebx;
+        uint32_t ebx_mask;
+        uint32_t ecx;
+        uint32_t ecx_mask;
+        uint32_t edx;
+        uint32_t edx_mask;
+    } result;
+} hv_register_x64_cpuid_result_parameters;
+
+typedef struct hv_register_x64_msr_result_parameters {
+    uint32_t msr_index;
+    uint32_t access_type;
+    uint32_t action; /* enum hv_unimplemented_msr_action */
+} hv_register_x64_msr_result_parameters;
+
+union hv_register_intercept_result_parameters {
+    struct hv_register_x64_cpuid_result_parameters cpuid;
+    struct hv_register_x64_msr_result_parameters msr;
+};
+
+typedef struct hv_input_register_intercept_result {
+    uint64_t partition_id;
+    uint32_t vp_index;
+    uint32_t intercept_type; /* enum hv_intercept_type */
+    union hv_register_intercept_result_parameters parameters;
+} hv_input_register_intercept_result;
+
+#endif /* HW_HYPERV_HVHDK_H */
diff --git a/include/hw/hyperv/hvhdk_mini.h b/include/hw/hyperv/hvhdk_mini.h
new file mode 100644
index 0000000000..9c2f3cf5ae
--- /dev/null
+++ b/include/hw/hyperv/hvhdk_mini.h
@@ -0,0 +1,102 @@
+/*
+ * Type definitions for the mshv host interface.
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_HYPERV_HVHDK_MINI_H
+#define HW_HYPERV_HVHDK_MINI_H
+
+#define HVHVK_MINI_VERSION (25294)
+
+/* Each generic set contains 64 elements */
+#define HV_GENERIC_SET_SHIFT (6)
+#define HV_GENERIC_SET_MASK  (63)
+
+enum hv_generic_set_format {
+    HV_GENERIC_SET_SPARSE_4K,
+    HV_GENERIC_SET_ALL,
+};
+
+enum hv_partition_property_code {
+    /* Privilege properties */
+    HV_PARTITION_PROPERTY_PRIVILEGE_FLAGS         = 0x00010000,
+    HV_PARTITION_PROPERTY_SYNTHETIC_PROC_FEATURES = 0x00010001,
+
+    /* Scheduling properties */
+    HV_PARTITION_PROPERTY_SUSPEND      = 0x00020000,
+    HV_PARTITION_PROPERTY_CPU_RESERVE  = 0x00020001,
+    HV_PARTITION_PROPERTY_CPU_CAP      = 0x00020002,
+    HV_PARTITION_PROPERTY_CPU_WEIGHT   = 0x00020003,
+    HV_PARTITION_PROPERTY_CPU_GROUP_ID = 0x00020004,
+
+    /* Time properties */
+    HV_PARTITION_PROPERTY_TIME_FREEZE    = 0x00030003,
+    HV_PARTITION_PROPERTY_REFERENCE_TIME = 0x00030005,
+
+    /* Debugging properties */
+    HV_PARTITION_PROPERTY_DEBUG_CHANNEL_ID = 0x00040000,
+
+    /* Resource properties */
+    HV_PARTITION_PROPERTY_VIRTUAL_TLB_PAGE_COUNT                 = 0x00050000,
+    HV_PARTITION_PROPERTY_VSM_CONFIG                             = 0x00050001,
+    HV_PARTITION_PROPERTY_ZERO_MEMORY_ON_RESET                   = 0x00050002,
+    HV_PARTITION_PROPERTY_PROCESSORS_PER_SOCKET                  = 0x00050003,
+    HV_PARTITION_PROPERTY_NESTED_TLB_SIZE                        = 0x00050004,
+    HV_PARTITION_PROPERTY_GPA_PAGE_ACCESS_TRACKING               = 0x00050005,
+    HV_PARTITION_PROPERTY_VSM_PERMISSIONS_DIRTY_SINCE_LAST_QUERY = 0x00050006,
+    HV_PARTITION_PROPERTY_SGX_LAUNCH_CONTROL_CONFIG              = 0x00050007,
+    HV_PARTITION_PROPERTY_DEFAULT_SGX_LAUNCH_CONTROL0            = 0x00050008,
+    HV_PARTITION_PROPERTY_DEFAULT_SGX_LAUNCH_CONTROL1            = 0x00050009,
+    HV_PARTITION_PROPERTY_DEFAULT_SGX_LAUNCH_CONTROL2            = 0x0005000a,
+    HV_PARTITION_PROPERTY_DEFAULT_SGX_LAUNCH_CONTROL3            = 0x0005000b,
+    HV_PARTITION_PROPERTY_ISOLATION_STATE                        = 0x0005000c,
+    HV_PARTITION_PROPERTY_ISOLATION_CONTROL                      = 0x0005000d,
+    HV_PARTITION_PROPERTY_ALLOCATION_ID                          = 0x0005000e,
+    HV_PARTITION_PROPERTY_MONITORING_ID                          = 0x0005000f,
+    HV_PARTITION_PROPERTY_IMPLEMENTED_PHYSICAL_ADDRESS_BITS      = 0x00050010,
+    HV_PARTITION_PROPERTY_NON_ARCHITECTURAL_CORE_SHARING         = 0x00050011,
+    HV_PARTITION_PROPERTY_HYPERCALL_DOORBELL_PAGE                = 0x00050012,
+    HV_PARTITION_PROPERTY_ISOLATION_POLICY                       = 0x00050014,
+    HV_PARTITION_PROPERTY_UNIMPLEMENTED_MSR_ACTION               = 0x00050017,
+    HV_PARTITION_PROPERTY_SEV_VMGEXIT_OFFLOADS                   = 0x00050022,
+
+    /* Compatibility properties */
+    HV_PARTITION_PROPERTY_PROCESSOR_VENDOR              = 0x00060000,
+    HV_PARTITION_PROPERTY_PROCESSOR_FEATURES_DEPRECATED = 0x00060001,
+    HV_PARTITION_PROPERTY_PROCESSOR_XSAVE_FEATURES      = 0x00060002,
+    HV_PARTITION_PROPERTY_PROCESSOR_CL_FLUSH_SIZE       = 0x00060003,
+    HV_PARTITION_PROPERTY_ENLIGHTENMENT_MODIFICATIONS   = 0x00060004,
+    HV_PARTITION_PROPERTY_COMPATIBILITY_VERSION         = 0x00060005,
+    HV_PARTITION_PROPERTY_PHYSICAL_ADDRESS_WIDTH        = 0x00060006,
+    HV_PARTITION_PROPERTY_XSAVE_STATES                  = 0x00060007,
+    HV_PARTITION_PROPERTY_MAX_XSAVE_DATA_SIZE           = 0x00060008,
+    HV_PARTITION_PROPERTY_PROCESSOR_CLOCK_FREQUENCY     = 0x00060009,
+    HV_PARTITION_PROPERTY_PROCESSOR_FEATURES0           = 0x0006000a,
+    HV_PARTITION_PROPERTY_PROCESSOR_FEATURES1           = 0x0006000b,
+
+    /* Guest software properties */
+    HV_PARTITION_PROPERTY_GUEST_OS_ID = 0x00070000,
+
+    /* Nested virtualization properties */
+    HV_PARTITION_PROPERTY_PROCESSOR_VIRTUALIZATION_FEATURES = 0x00080000,
+};
+
+/* HV Map GPA (Guest Physical Address) Flags */
+#define HV_MAP_GPA_PERMISSIONS_NONE        0x0
+#define HV_MAP_GPA_READABLE                0x1
+#define HV_MAP_GPA_WRITABLE                0x2
+#define HV_MAP_GPA_KERNEL_EXECUTABLE       0x4
+#define HV_MAP_GPA_USER_EXECUTABLE         0x8
+#define HV_MAP_GPA_EXECUTABLE              0xC
+#define HV_MAP_GPA_PERMISSIONS_MASK        0xF
+#define HV_MAP_GPA_ADJUSTABLE           0x8000
+#define HV_MAP_GPA_NO_ACCESS           0x10000
+#define HV_MAP_GPA_NOT_CACHED         0x200000
+#define HV_MAP_GPA_LARGE_PAGE       0x80000000
+
+#define HV_PFN_RNG_PAGEBITS 24  /* HV_SPA_PAGE_RANGE_ADDITIONAL_PAGES_BITS */
+
+#endif /* HW_HYPERV_HVHDK_MINI_H */
diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index 717c379f9e..828a7809f7 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -195,7 +195,7 @@ rm -rf "$output/linux-headers/linux"
 mkdir -p "$output/linux-headers/linux"
 for header in const.h stddef.h kvm.h vfio.h vfio_ccw.h vfio_zdev.h vhost.h \
               psci.h psp-sev.h userfaultfd.h memfd.h mman.h nvme_ioctl.h \
-              vduse.h iommufd.h bits.h; do
+              vduse.h iommufd.h bits.h mshv.h; do
     cp "$hdrdir/include/linux/$header" "$output/linux-headers/linux"
 done
 

From a6d6878650a0f4982918e8cd9d7ea6c3c3c681f7 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:26 +0200
Subject: [PATCH 1145/2396] linux-headers/linux: Add mshv.h headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This file has been added to the tree by running `update-linux-header.sh`
on linux v6.16.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20250916164847.77883-7-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 linux-headers/linux/mshv.h | 291 +++++++++++++++++++++++++++++++++++++
 1 file changed, 291 insertions(+)
 create mode 100644 linux-headers/linux/mshv.h

diff --git a/linux-headers/linux/mshv.h b/linux-headers/linux/mshv.h
new file mode 100644
index 0000000000..5bc83db6a3
--- /dev/null
+++ b/linux-headers/linux/mshv.h
@@ -0,0 +1,291 @@
+/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
+/*
+ * Userspace interfaces for /dev/mshv* devices and derived fds
+ *
+ * This file is divided into sections containing data structures and IOCTLs for
+ * a particular set of related devices or derived file descriptors.
+ *
+ * The IOCTL definitions are at the end of each section. They are grouped by
+ * device/fd, so that new IOCTLs can easily be added with a monotonically
+ * increasing number.
+ */
+#ifndef _LINUX_MSHV_H
+#define _LINUX_MSHV_H
+
+#include <linux/types.h>
+
+#define MSHV_IOCTL	0xB8
+
+/*
+ *******************************************
+ * Entry point to main VMM APIs: /dev/mshv *
+ *******************************************
+ */
+
+enum {
+	MSHV_PT_BIT_LAPIC,
+	MSHV_PT_BIT_X2APIC,
+	MSHV_PT_BIT_GPA_SUPER_PAGES,
+	MSHV_PT_BIT_COUNT,
+};
+
+#define MSHV_PT_FLAGS_MASK ((1 << MSHV_PT_BIT_COUNT) - 1)
+
+enum {
+	MSHV_PT_ISOLATION_NONE,
+	MSHV_PT_ISOLATION_COUNT,
+};
+
+/**
+ * struct mshv_create_partition - arguments for MSHV_CREATE_PARTITION
+ * @pt_flags: Bitmask of 1 << MSHV_PT_BIT_*
+ * @pt_isolation: MSHV_PT_ISOLATION_*
+ *
+ * Returns a file descriptor to act as a handle to a guest partition.
+ * At this point the partition is not yet initialized in the hypervisor.
+ * Some operations must be done with the partition in this state, e.g. setting
+ * so-called "early" partition properties. The partition can then be
+ * initialized with MSHV_INITIALIZE_PARTITION.
+ */
+struct mshv_create_partition {
+	__u64 pt_flags;
+	__u64 pt_isolation;
+};
+
+/* /dev/mshv */
+#define MSHV_CREATE_PARTITION	_IOW(MSHV_IOCTL, 0x00, struct mshv_create_partition)
+
+/*
+ ************************
+ * Child partition APIs *
+ ************************
+ */
+
+struct mshv_create_vp {
+	__u32 vp_index;
+};
+
+enum {
+	MSHV_SET_MEM_BIT_WRITABLE,
+	MSHV_SET_MEM_BIT_EXECUTABLE,
+	MSHV_SET_MEM_BIT_UNMAP,
+	MSHV_SET_MEM_BIT_COUNT
+};
+
+#define MSHV_SET_MEM_FLAGS_MASK ((1 << MSHV_SET_MEM_BIT_COUNT) - 1)
+
+/* The hypervisor's "native" page size */
+#define MSHV_HV_PAGE_SIZE	0x1000
+
+/**
+ * struct mshv_user_mem_region - arguments for MSHV_SET_GUEST_MEMORY
+ * @size: Size of the memory region (bytes). Must be aligned to
+ *        MSHV_HV_PAGE_SIZE
+ * @guest_pfn: Base guest page number to map
+ * @userspace_addr: Base address of userspace memory. Must be aligned to
+ *                  MSHV_HV_PAGE_SIZE
+ * @flags: Bitmask of 1 << MSHV_SET_MEM_BIT_*. If (1 << MSHV_SET_MEM_BIT_UNMAP)
+ *         is set, ignore other bits.
+ * @rsvd: MBZ
+ *
+ * Map or unmap a region of userspace memory to Guest Physical Addresses (GPA).
+ * Mappings can't overlap in GPA space or userspace.
+ * To unmap, these fields must match an existing mapping.
+ */
+struct mshv_user_mem_region {
+	__u64 size;
+	__u64 guest_pfn;
+	__u64 userspace_addr;
+	__u8 flags;
+	__u8 rsvd[7];
+};
+
+enum {
+	MSHV_IRQFD_BIT_DEASSIGN,
+	MSHV_IRQFD_BIT_RESAMPLE,
+	MSHV_IRQFD_BIT_COUNT,
+};
+
+#define MSHV_IRQFD_FLAGS_MASK	((1 << MSHV_IRQFD_BIT_COUNT) - 1)
+
+struct mshv_user_irqfd {
+	__s32 fd;
+	__s32 resamplefd;
+	__u32 gsi;
+	__u32 flags;
+};
+
+enum {
+	MSHV_IOEVENTFD_BIT_DATAMATCH,
+	MSHV_IOEVENTFD_BIT_PIO,
+	MSHV_IOEVENTFD_BIT_DEASSIGN,
+	MSHV_IOEVENTFD_BIT_COUNT,
+};
+
+#define MSHV_IOEVENTFD_FLAGS_MASK	((1 << MSHV_IOEVENTFD_BIT_COUNT) - 1)
+
+struct mshv_user_ioeventfd {
+	__u64 datamatch;
+	__u64 addr;	   /* legal pio/mmio address */
+	__u32 len;	   /* 1, 2, 4, or 8 bytes    */
+	__s32 fd;
+	__u32 flags;
+	__u8  rsvd[4];
+};
+
+struct mshv_user_irq_entry {
+	__u32 gsi;
+	__u32 address_lo;
+	__u32 address_hi;
+	__u32 data;
+};
+
+struct mshv_user_irq_table {
+	__u32 nr;
+	__u32 rsvd; /* MBZ */
+	struct mshv_user_irq_entry entries[];
+};
+
+enum {
+	MSHV_GPAP_ACCESS_TYPE_ACCESSED,
+	MSHV_GPAP_ACCESS_TYPE_DIRTY,
+	MSHV_GPAP_ACCESS_TYPE_COUNT		/* Count of enum members */
+};
+
+enum {
+	MSHV_GPAP_ACCESS_OP_NOOP,
+	MSHV_GPAP_ACCESS_OP_CLEAR,
+	MSHV_GPAP_ACCESS_OP_SET,
+	MSHV_GPAP_ACCESS_OP_COUNT		/* Count of enum members */
+};
+
+/**
+ * struct mshv_gpap_access_bitmap - arguments for MSHV_GET_GPAP_ACCESS_BITMAP
+ * @access_type: MSHV_GPAP_ACCESS_TYPE_* - The type of access to record in the
+ *               bitmap
+ * @access_op: MSHV_GPAP_ACCESS_OP_* - Allows an optional clear or set of all
+ *             the access states in the range, after retrieving the current
+ *             states.
+ * @rsvd: MBZ
+ * @page_count: Number of pages
+ * @gpap_base: Base gpa page number
+ * @bitmap_ptr: Output buffer for bitmap, at least (page_count + 7) / 8 bytes
+ *
+ * Retrieve a bitmap of either ACCESSED or DIRTY bits for a given range of guest
+ * memory, and optionally clear or set the bits.
+ */
+struct mshv_gpap_access_bitmap {
+	__u8 access_type;
+	__u8 access_op;
+	__u8 rsvd[6];
+	__u64 page_count;
+	__u64 gpap_base;
+	__u64 bitmap_ptr;
+};
+
+/**
+ * struct mshv_root_hvcall - arguments for MSHV_ROOT_HVCALL
+ * @code: Hypercall code (HVCALL_*)
+ * @reps: in: Rep count ('repcount')
+ *	  out: Reps completed ('repcomp'). MBZ unless rep hvcall
+ * @in_sz: Size of input incl rep data. <= MSHV_HV_PAGE_SIZE
+ * @out_sz: Size of output buffer. <= MSHV_HV_PAGE_SIZE. MBZ if out_ptr is 0
+ * @status: in: MBZ
+ *	    out: HV_STATUS_* from hypercall
+ * @rsvd: MBZ
+ * @in_ptr: Input data buffer (struct hv_input_*). If used with partition or
+ *	    vp fd, partition id field is populated by kernel.
+ * @out_ptr: Output data buffer (optional)
+ */
+struct mshv_root_hvcall {
+	__u16 code;
+	__u16 reps;
+	__u16 in_sz;
+	__u16 out_sz;
+	__u16 status;
+	__u8 rsvd[6];
+	__u64 in_ptr;
+	__u64 out_ptr;
+};
+
+/* Partition fds created with MSHV_CREATE_PARTITION */
+#define MSHV_INITIALIZE_PARTITION	_IO(MSHV_IOCTL, 0x00)
+#define MSHV_CREATE_VP			_IOW(MSHV_IOCTL, 0x01, struct mshv_create_vp)
+#define MSHV_SET_GUEST_MEMORY		_IOW(MSHV_IOCTL, 0x02, struct mshv_user_mem_region)
+#define MSHV_IRQFD			_IOW(MSHV_IOCTL, 0x03, struct mshv_user_irqfd)
+#define MSHV_IOEVENTFD			_IOW(MSHV_IOCTL, 0x04, struct mshv_user_ioeventfd)
+#define MSHV_SET_MSI_ROUTING		_IOW(MSHV_IOCTL, 0x05, struct mshv_user_irq_table)
+#define MSHV_GET_GPAP_ACCESS_BITMAP	_IOWR(MSHV_IOCTL, 0x06, struct mshv_gpap_access_bitmap)
+/* Generic hypercall */
+#define MSHV_ROOT_HVCALL		_IOWR(MSHV_IOCTL, 0x07, struct mshv_root_hvcall)
+
+/*
+ ********************************
+ * VP APIs for child partitions *
+ ********************************
+ */
+
+#define MSHV_RUN_VP_BUF_SZ 256
+
+/*
+ * VP state pages may be mapped to userspace via mmap().
+ * To specify which state page, use MSHV_VP_MMAP_OFFSET_ values multiplied by
+ * the system page size.
+ * e.g.
+ * long page_size = sysconf(_SC_PAGE_SIZE);
+ * void *reg_page = mmap(NULL, MSHV_HV_PAGE_SIZE, PROT_READ|PROT_WRITE,
+ *                       MAP_SHARED, vp_fd,
+ *                       MSHV_VP_MMAP_OFFSET_REGISTERS * page_size);
+ */
+enum {
+	MSHV_VP_MMAP_OFFSET_REGISTERS,
+	MSHV_VP_MMAP_OFFSET_INTERCEPT_MESSAGE,
+	MSHV_VP_MMAP_OFFSET_GHCB,
+	MSHV_VP_MMAP_OFFSET_COUNT
+};
+
+/**
+ * struct mshv_run_vp - argument for MSHV_RUN_VP
+ * @msg_buf: On success, the intercept message is copied here. It can be
+ *           interpreted using the relevant hypervisor definitions.
+ */
+struct mshv_run_vp {
+	__u8 msg_buf[MSHV_RUN_VP_BUF_SZ];
+};
+
+enum {
+	MSHV_VP_STATE_LAPIC,		/* Local interrupt controller state (either arch) */
+	MSHV_VP_STATE_XSAVE,		/* XSAVE data in compacted form (x86_64) */
+	MSHV_VP_STATE_SIMP,
+	MSHV_VP_STATE_SIEFP,
+	MSHV_VP_STATE_SYNTHETIC_TIMERS,
+	MSHV_VP_STATE_COUNT,
+};
+
+/**
+ * struct mshv_get_set_vp_state - arguments for MSHV_[GET,SET]_VP_STATE
+ * @type: MSHV_VP_STATE_*
+ * @rsvd: MBZ
+ * @buf_sz: in: 4k page-aligned size of buffer
+ *          out: Actual size of data (on EINVAL, check this to see if buffer
+ *               was too small)
+ * @buf_ptr: 4k page-aligned data buffer
+ */
+struct mshv_get_set_vp_state {
+	__u8 type;
+	__u8 rsvd[3];
+	__u32 buf_sz;
+	__u64 buf_ptr;
+};
+
+/* VP fds created with MSHV_CREATE_VP */
+#define MSHV_RUN_VP			_IOR(MSHV_IOCTL, 0x00, struct mshv_run_vp)
+#define MSHV_GET_VP_STATE		_IOWR(MSHV_IOCTL, 0x01, struct mshv_get_set_vp_state)
+#define MSHV_SET_VP_STATE		_IOWR(MSHV_IOCTL, 0x02, struct mshv_get_set_vp_state)
+/*
+ * Generic hypercall
+ * Defined above in partition IOCTLs, avoid redefining it here
+ * #define MSHV_ROOT_HVCALL			_IOWR(MSHV_IOCTL, 0x07, struct mshv_root_hvcall)
+ */
+
+#endif

From d0d2918f968c55628e17e2733b799fcefb50f16b Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Thu, 2 Oct 2025 18:25:02 +0200
Subject: [PATCH 1146/2396] accel/mshv: Add accelerator skeleton

Introduce the initial scaffold for the MSHV (Microsoft Hypervisor)
accelerator backend. This includes the basic directory structure and
stub implementations needed to integrate with QEMU's accelerator
framework.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-8-magnuskulke@linux.microsoft.com
[Move include of linux/mshv.h in the per-target section; create
 include/system/mshv_int.h. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/meson.build         |   1 +
 accel/mshv/meson.build    |   6 ++
 accel/mshv/mshv-all.c     | 144 ++++++++++++++++++++++++++++++++++++++
 include/system/mshv.h     |  12 ++++
 include/system/mshv_int.h |  41 +++++++++++
 5 files changed, 204 insertions(+)
 create mode 100644 accel/mshv/meson.build
 create mode 100644 accel/mshv/mshv-all.c
 create mode 100644 include/system/mshv_int.h

diff --git a/accel/meson.build b/accel/meson.build
index 6349efe682..983dfd0bd5 100644
--- a/accel/meson.build
+++ b/accel/meson.build
@@ -10,6 +10,7 @@ if have_system
   subdir('kvm')
   subdir('xen')
   subdir('stubs')
+  subdir('mshv')
 endif
 
 # qtest
diff --git a/accel/mshv/meson.build b/accel/mshv/meson.build
new file mode 100644
index 0000000000..4c03ac7921
--- /dev/null
+++ b/accel/mshv/meson.build
@@ -0,0 +1,6 @@
+mshv_ss = ss.source_set()
+mshv_ss.add(if_true: files(
+  'mshv-all.c'
+))
+
+specific_ss.add_all(when: 'CONFIG_MSHV', if_true: mshv_ss)
diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
new file mode 100644
index 0000000000..ae12f0f58b
--- /dev/null
+++ b/accel/mshv/mshv-all.c
@@ -0,0 +1,144 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors:
+ *  Ziqiao Zhou       <ziqiaozhou@microsoft.com>
+ *  Magnus Kulke      <magnuskulke@microsoft.com>
+ *  Jinank Jain       <jinankjain@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/event_notifier.h"
+#include "qemu/module.h"
+#include "qemu/main-loop.h"
+#include "hw/boards.h"
+
+#include "hw/hyperv/hvhdk.h"
+#include "hw/hyperv/hvhdk_mini.h"
+#include "hw/hyperv/hvgdk.h"
+#include "linux/mshv.h"
+
+#include "qemu/accel.h"
+#include "qemu/guest-random.h"
+#include "accel/accel-ops.h"
+#include "accel/accel-cpu-ops.h"
+#include "system/cpus.h"
+#include "system/runstate.h"
+#include "system/accel-blocker.h"
+#include "system/address-spaces.h"
+#include "system/mshv.h"
+#include "system/mshv_int.h"
+#include "system/reset.h"
+#include "trace.h"
+#include <err.h>
+#include <stdint.h>
+#include <sys/ioctl.h>
+
+#define TYPE_MSHV_ACCEL ACCEL_CLASS_NAME("mshv")
+
+DECLARE_INSTANCE_CHECKER(MshvState, MSHV_STATE, TYPE_MSHV_ACCEL)
+
+bool mshv_allowed;
+
+MshvState *mshv_state;
+
+static int mshv_init(AccelState *as, MachineState *ms)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_start_vcpu_thread(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_cpu_synchronize_post_init(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_cpu_synchronize_post_reset(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_cpu_synchronize_pre_loadvm(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_cpu_synchronize(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static bool mshv_cpus_are_resettable(void)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+static void mshv_accel_class_init(ObjectClass *oc, const void *data)
+{
+    AccelClass *ac = ACCEL_CLASS(oc);
+
+    ac->name = "MSHV";
+    ac->init_machine = mshv_init;
+    ac->allowed = &mshv_allowed;
+}
+
+static void mshv_accel_instance_init(Object *obj)
+{
+    MshvState *s = MSHV_STATE(obj);
+
+    s->vm = 0;
+}
+
+static const TypeInfo mshv_accel_type = {
+    .name = TYPE_MSHV_ACCEL,
+    .parent = TYPE_ACCEL,
+    .instance_init = mshv_accel_instance_init,
+    .class_init = mshv_accel_class_init,
+    .instance_size = sizeof(MshvState),
+};
+
+static void mshv_accel_ops_class_init(ObjectClass *oc, const void *data)
+{
+    AccelOpsClass *ops = ACCEL_OPS_CLASS(oc);
+
+    ops->create_vcpu_thread = mshv_start_vcpu_thread;
+    ops->synchronize_post_init = mshv_cpu_synchronize_post_init;
+    ops->synchronize_post_reset = mshv_cpu_synchronize_post_reset;
+    ops->synchronize_state = mshv_cpu_synchronize;
+    ops->synchronize_pre_loadvm = mshv_cpu_synchronize_pre_loadvm;
+    ops->cpus_are_resettable = mshv_cpus_are_resettable;
+    ops->handle_interrupt = generic_handle_interrupt;
+}
+
+static const TypeInfo mshv_accel_ops_type = {
+    .name = ACCEL_OPS_NAME("mshv"),
+    .parent = TYPE_ACCEL_OPS,
+    .class_init = mshv_accel_ops_class_init,
+    .abstract = true,
+};
+
+static void mshv_type_init(void)
+{
+    type_register_static(&mshv_accel_type);
+    type_register_static(&mshv_accel_ops_type);
+}
+
+type_init(mshv_type_init);
diff --git a/include/system/mshv.h b/include/system/mshv.h
index 2a504ed81f..434ea9682e 100644
--- a/include/system/mshv.h
+++ b/include/system/mshv.h
@@ -14,8 +14,17 @@
 #ifndef QEMU_MSHV_H
 #define QEMU_MSHV_H
 
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+#include "hw/hyperv/hyperv-proto.h"
+#include "hw/hyperv/hvhdk.h"
+#include "qapi/qapi-types-common.h"
+#include "system/memory.h"
+#include "accel/accel-ops.h"
+
 #ifdef COMPILING_PER_TARGET
 #ifdef CONFIG_MSHV
+#include <linux/mshv.h>
 #define CONFIG_MSHV_IS_POSSIBLE
 #endif
 #else
@@ -30,6 +39,9 @@ extern bool mshv_allowed;
 #endif
 #define mshv_msi_via_irqfd_enabled() false
 
+typedef struct MshvState MshvState;
+extern MshvState *mshv_state;
+
 /* interrupt */
 int mshv_irqchip_add_msi_route(int vector, PCIDevice *dev);
 int mshv_irqchip_update_msi_route(int virq, MSIMessage msg, PCIDevice *dev);
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
new file mode 100644
index 0000000000..132491b599
--- /dev/null
+++ b/include/system/mshv_int.h
@@ -0,0 +1,41 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou  <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke <magnuskulke@microsoft.com>
+ *          Jinank Jain  <jinankjain@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ */
+
+#ifndef QEMU_MSHV_INT_H
+#define QEMU_MSHV_INT_H
+
+struct AccelCPUState {
+    int cpufd;
+    bool dirty;
+};
+
+typedef struct MshvMemoryListener {
+    MemoryListener listener;
+    int as_id;
+} MshvMemoryListener;
+
+typedef struct MshvAddressSpace {
+    MshvMemoryListener *ml;
+    AddressSpace *as;
+} MshvAddressSpace;
+
+struct MshvState {
+    AccelState parent_obj;
+    int vm;
+    MshvMemoryListener memory_listener;
+    /* number of listeners */
+    int nr_as;
+    MshvAddressSpace *as;
+};
+
+#endif

From 5006ea1344d134356a9b2e1afd521cf8df0c6a85 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:28 +0200
Subject: [PATCH 1147/2396] accel/mshv: Register memory region listeners

Add memory listener hooks for the MSHV accelerator to track guest
memory regions. This enables the backend to respond to region
additions, removals and will be used to manage guest memory mappings
inside the hypervisor.

Actually registering physical memory in the hypervisor is still stubbed
out.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-9-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mem.c          | 25 +++++++++++++++
 accel/mshv/meson.build    |  1 +
 accel/mshv/mshv-all.c     | 67 +++++++++++++++++++++++++++++++++++++--
 include/system/mshv_int.h |  4 +++
 4 files changed, 95 insertions(+), 2 deletions(-)
 create mode 100644 accel/mshv/mem.c

diff --git a/accel/mshv/mem.c b/accel/mshv/mem.c
new file mode 100644
index 0000000000..9889918c31
--- /dev/null
+++ b/accel/mshv/mem.c
@@ -0,0 +1,25 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors:
+ *  Magnus Kulke      <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "system/address-spaces.h"
+#include "system/mshv.h"
+#include "system/mshv_int.h"
+
+void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
+                       bool add)
+{
+    error_report("unimplemented");
+    abort();
+}
+
diff --git a/accel/mshv/meson.build b/accel/mshv/meson.build
index 4c03ac7921..8a6beb3fb1 100644
--- a/accel/mshv/meson.build
+++ b/accel/mshv/meson.build
@@ -1,5 +1,6 @@
 mshv_ss = ss.source_set()
 mshv_ss.add(if_true: files(
+  'mem.c',
   'mshv-all.c'
 ))
 
diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index ae12f0f58b..a684a36677 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -49,10 +49,73 @@ bool mshv_allowed;
 
 MshvState *mshv_state;
 
+static void mem_region_add(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    MshvMemoryListener *mml;
+    mml = container_of(listener, MshvMemoryListener, listener);
+    memory_region_ref(section->mr);
+    mshv_set_phys_mem(mml, section, true);
+}
+
+static void mem_region_del(MemoryListener *listener,
+                           MemoryRegionSection *section)
+{
+    MshvMemoryListener *mml;
+    mml = container_of(listener, MshvMemoryListener, listener);
+    mshv_set_phys_mem(mml, section, false);
+    memory_region_unref(section->mr);
+}
+
+static MemoryListener mshv_memory_listener = {
+    .name = "mshv",
+    .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
+    .region_add = mem_region_add,
+    .region_del = mem_region_del,
+};
+
+static MemoryListener mshv_io_listener = {
+    .name = "mshv", .priority = MEMORY_LISTENER_PRIORITY_DEV_BACKEND,
+    /* MSHV does not support PIO eventfd */
+};
+
+static void register_mshv_memory_listener(MshvState *s, MshvMemoryListener *mml,
+                                          AddressSpace *as, int as_id,
+                                          const char *name)
+{
+    int i;
+
+    mml->listener = mshv_memory_listener;
+    mml->listener.name = name;
+    memory_listener_register(&mml->listener, as);
+    for (i = 0; i < s->nr_as; ++i) {
+        if (!s->as[i].as) {
+            s->as[i].as = as;
+            s->as[i].ml = mml;
+            break;
+        }
+    }
+}
+
 static int mshv_init(AccelState *as, MachineState *ms)
 {
-    error_report("unimplemented");
-    abort();
+    MshvState *s;
+    s = MSHV_STATE(as);
+
+    accel_blocker_init();
+
+    s->vm = 0;
+
+    s->nr_as = 1;
+    s->as = g_new0(MshvAddressSpace, s->nr_as);
+
+    mshv_state = s;
+
+    register_mshv_memory_listener(s, &s->memory_listener, &address_space_memory,
+                                  0, "mshv-memory");
+    memory_listener_register(&mshv_io_listener, &address_space_io);
+
+    return 0;
 }
 
 static void mshv_start_vcpu_thread(CPUState *cpu)
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index 132491b599..cfa177ff72 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -38,4 +38,8 @@ struct MshvState {
     MshvAddressSpace *as;
 };
 
+/* memory */
+void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
+                       bool add);
+
 #endif

From c5f23bccde416aab52fe14dec6f6716a85f0cd04 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Thu, 2 Oct 2025 18:28:16 +0200
Subject: [PATCH 1148/2396] accel/mshv: Initialize VM partition

Create the MSHV virtual machine by opening a partition and issuing
the necessary ioctl to initialize it. This sets up the basic VM
structure and initial configuration used by MSHV to manage guest state.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-10-magnuskulke@linux.microsoft.com
[Add stubs; fix format strings for trace-events; make mshv_hvcall
 available only in per-target files; mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/irq.c             | 399 +++++++++++++++++++++++++++++++++++
 accel/mshv/mem.c             | 129 ++++++++++-
 accel/mshv/meson.build       |   1 +
 accel/mshv/mshv-all.c        | 326 ++++++++++++++++++++++++++++
 accel/mshv/trace-events      |  26 +++
 accel/mshv/trace.h           |  14 ++
 accel/stubs/meson.build      |   1 +
 accel/stubs/mshv-stub.c      |  44 ++++
 hw/intc/apic.c               |   8 +
 include/system/mshv.h        |  11 +-
 include/system/mshv_int.h    |  25 +++
 meson.build                  |   1 +
 target/i386/mshv/meson.build |   1 +
 target/i386/mshv/mshv-cpu.c  |  72 +++++++
 14 files changed, 1054 insertions(+), 4 deletions(-)
 create mode 100644 accel/mshv/irq.c
 create mode 100644 accel/mshv/trace-events
 create mode 100644 accel/mshv/trace.h
 create mode 100644 accel/stubs/mshv-stub.c
 create mode 100644 target/i386/mshv/mshv-cpu.c

diff --git a/accel/mshv/irq.c b/accel/mshv/irq.c
new file mode 100644
index 0000000000..adf8f337d9
--- /dev/null
+++ b/accel/mshv/irq.c
@@ -0,0 +1,399 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke <magnuskulke@microsoft.com>
+ *          Stanislav Kinsburskii <skinsburskii@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "linux/mshv.h"
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "hw/hyperv/hvhdk_mini.h"
+#include "hw/hyperv/hvgdk_mini.h"
+#include "hw/intc/ioapic.h"
+#include "hw/pci/msi.h"
+#include "system/mshv.h"
+#include "system/mshv_int.h"
+#include "trace.h"
+#include <stdint.h>
+#include <sys/ioctl.h>
+
+#define MSHV_IRQFD_RESAMPLE_FLAG (1 << MSHV_IRQFD_BIT_RESAMPLE)
+#define MSHV_IRQFD_BIT_DEASSIGN_FLAG (1 << MSHV_IRQFD_BIT_DEASSIGN)
+
+static MshvMsiControl *msi_control;
+static QemuMutex msi_control_mutex;
+
+void mshv_init_msicontrol(void)
+{
+    qemu_mutex_init(&msi_control_mutex);
+    msi_control = g_new0(MshvMsiControl, 1);
+    msi_control->gsi_routes = g_hash_table_new(g_direct_hash, g_direct_equal);
+    msi_control->updated = false;
+}
+
+static int set_msi_routing(uint32_t gsi, uint64_t addr, uint32_t data)
+{
+    struct mshv_user_irq_entry *entry;
+    uint32_t high_addr = addr >> 32;
+    uint32_t low_addr = addr & 0xFFFFFFFF;
+    GHashTable *gsi_routes;
+
+    trace_mshv_set_msi_routing(gsi, addr, data);
+
+    if (gsi >= MSHV_MAX_MSI_ROUTES) {
+        error_report("gsi >= MSHV_MAX_MSI_ROUTES");
+        return -1;
+    }
+
+    assert(msi_control);
+
+    WITH_QEMU_LOCK_GUARD(&msi_control_mutex) {
+        gsi_routes = msi_control->gsi_routes;
+        entry = g_hash_table_lookup(gsi_routes, GINT_TO_POINTER(gsi));
+
+        if (entry
+            && entry->address_hi == high_addr
+            && entry->address_lo == low_addr
+            && entry->data == data)
+        {
+            /* nothing to update */
+            return 0;
+        }
+
+        /* free old entry */
+        g_free(entry);
+
+        /* create new entry */
+        entry = g_new0(struct mshv_user_irq_entry, 1);
+        entry->gsi = gsi;
+        entry->address_hi = high_addr;
+        entry->address_lo = low_addr;
+        entry->data = data;
+
+        g_hash_table_insert(gsi_routes, GINT_TO_POINTER(gsi), entry);
+        msi_control->updated = true;
+    }
+
+    return 0;
+}
+
+static int add_msi_routing(uint64_t addr, uint32_t data)
+{
+    struct mshv_user_irq_entry *route_entry;
+    uint32_t high_addr = addr >> 32;
+    uint32_t low_addr = addr & 0xFFFFFFFF;
+    int gsi;
+    GHashTable *gsi_routes;
+
+    trace_mshv_add_msi_routing(addr, data);
+
+    assert(msi_control);
+
+    WITH_QEMU_LOCK_GUARD(&msi_control_mutex) {
+        /* find an empty slot */
+        gsi = 0;
+        gsi_routes = msi_control->gsi_routes;
+        while (gsi < MSHV_MAX_MSI_ROUTES) {
+            route_entry = g_hash_table_lookup(gsi_routes, GINT_TO_POINTER(gsi));
+            if (!route_entry) {
+                break;
+            }
+            gsi++;
+        }
+        if (gsi >= MSHV_MAX_MSI_ROUTES) {
+            error_report("No empty gsi slot available");
+            return -1;
+        }
+
+        /* create new entry */
+        route_entry = g_new0(struct mshv_user_irq_entry, 1);
+        route_entry->gsi = gsi;
+        route_entry->address_hi = high_addr;
+        route_entry->address_lo = low_addr;
+        route_entry->data = data;
+
+        g_hash_table_insert(gsi_routes, GINT_TO_POINTER(gsi), route_entry);
+        msi_control->updated = true;
+    }
+
+    return gsi;
+}
+
+static int commit_msi_routing_table(int vm_fd)
+{
+    guint len;
+    int i, ret;
+    size_t table_size;
+    struct mshv_user_irq_table *table;
+    GHashTableIter iter;
+    gpointer key, value;
+
+    assert(msi_control);
+
+    WITH_QEMU_LOCK_GUARD(&msi_control_mutex) {
+        if (!msi_control->updated) {
+            /* nothing to update */
+            return 0;
+        }
+
+        /* Calculate the size of the table */
+        len = g_hash_table_size(msi_control->gsi_routes);
+        table_size = sizeof(struct mshv_user_irq_table)
+                     + len * sizeof(struct mshv_user_irq_entry);
+        table = g_malloc0(table_size);
+
+        g_hash_table_iter_init(&iter, msi_control->gsi_routes);
+        i = 0;
+        while (g_hash_table_iter_next(&iter, &key, &value)) {
+            struct mshv_user_irq_entry *entry = value;
+            table->entries[i] = *entry;
+            i++;
+        }
+        table->nr = i;
+
+        trace_mshv_commit_msi_routing_table(vm_fd, len);
+
+        ret = ioctl(vm_fd, MSHV_SET_MSI_ROUTING, table);
+        g_free(table);
+        if (ret < 0) {
+            error_report("Failed to commit msi routing table");
+            return -1;
+        }
+        msi_control->updated = false;
+    }
+    return 0;
+}
+
+static int remove_msi_routing(uint32_t gsi)
+{
+    struct mshv_user_irq_entry *route_entry;
+    GHashTable *gsi_routes;
+
+    trace_mshv_remove_msi_routing(gsi);
+
+    if (gsi >= MSHV_MAX_MSI_ROUTES) {
+        error_report("Invalid GSI: %u", gsi);
+        return -1;
+    }
+
+    assert(msi_control);
+
+    WITH_QEMU_LOCK_GUARD(&msi_control_mutex) {
+        gsi_routes = msi_control->gsi_routes;
+        route_entry = g_hash_table_lookup(gsi_routes, GINT_TO_POINTER(gsi));
+        if (route_entry) {
+            g_hash_table_remove(gsi_routes, GINT_TO_POINTER(gsi));
+            g_free(route_entry);
+            msi_control->updated = true;
+        }
+    }
+
+    return 0;
+}
+
+/* Pass an eventfd which is to be used for injecting interrupts from userland */
+static int irqfd(int vm_fd, int fd, int resample_fd, uint32_t gsi,
+                 uint32_t flags)
+{
+    int ret;
+    struct mshv_user_irqfd arg = {
+        .fd = fd,
+        .resamplefd = resample_fd,
+        .gsi = gsi,
+        .flags = flags,
+    };
+
+    ret = ioctl(vm_fd, MSHV_IRQFD, &arg);
+    if (ret < 0) {
+        error_report("Failed to set irqfd: gsi=%u, fd=%d", gsi, fd);
+        return -1;
+    }
+    return ret;
+}
+
+static int register_irqfd(int vm_fd, int event_fd, uint32_t gsi)
+{
+    int ret;
+
+    trace_mshv_register_irqfd(vm_fd, event_fd, gsi);
+
+    ret = irqfd(vm_fd, event_fd, 0, gsi, 0);
+    if (ret < 0) {
+        error_report("Failed to register irqfd: gsi=%u", gsi);
+        return -1;
+    }
+    return 0;
+}
+
+static int register_irqfd_with_resample(int vm_fd, int event_fd,
+                                        int resample_fd, uint32_t gsi)
+{
+    int ret;
+    uint32_t flags = MSHV_IRQFD_RESAMPLE_FLAG;
+
+    ret = irqfd(vm_fd, event_fd, resample_fd, gsi, flags);
+    if (ret < 0) {
+        error_report("Failed to register irqfd with resample: gsi=%u", gsi);
+        return -errno;
+    }
+    return 0;
+}
+
+static int unregister_irqfd(int vm_fd, int event_fd, uint32_t gsi)
+{
+    int ret;
+    uint32_t flags = MSHV_IRQFD_BIT_DEASSIGN_FLAG;
+
+    ret = irqfd(vm_fd, event_fd, 0, gsi, flags);
+    if (ret < 0) {
+        error_report("Failed to unregister irqfd: gsi=%u", gsi);
+        return -errno;
+    }
+    return 0;
+}
+
+static int irqchip_update_irqfd_notifier_gsi(const EventNotifier *event,
+                                             const EventNotifier *resample,
+                                             int virq, bool add)
+{
+    int fd = event_notifier_get_fd(event);
+    int rfd = resample ? event_notifier_get_fd(resample) : -1;
+    int vm_fd = mshv_state->vm;
+
+    trace_mshv_irqchip_update_irqfd_notifier_gsi(fd, rfd, virq, add);
+
+    if (!add) {
+        return unregister_irqfd(vm_fd, fd, virq);
+    }
+
+    if (rfd > 0) {
+        return register_irqfd_with_resample(vm_fd, fd, rfd, virq);
+    }
+
+    return register_irqfd(vm_fd, fd, virq);
+}
+
+
+int mshv_irqchip_add_msi_route(int vector, PCIDevice *dev)
+{
+    MSIMessage msg = { 0, 0 };
+    int virq = 0;
+
+    if (pci_available && dev) {
+        msg = pci_get_msi_message(dev, vector);
+        virq = add_msi_routing(msg.address, le32_to_cpu(msg.data));
+    }
+
+    return virq;
+}
+
+void mshv_irqchip_release_virq(int virq)
+{
+    remove_msi_routing(virq);
+}
+
+int mshv_irqchip_update_msi_route(int virq, MSIMessage msg, PCIDevice *dev)
+{
+    int ret;
+
+    ret = set_msi_routing(virq, msg.address, le32_to_cpu(msg.data));
+    if (ret < 0) {
+        error_report("Failed to set msi routing");
+        return -1;
+    }
+
+    return 0;
+}
+
+int mshv_request_interrupt(MshvState *mshv_state, uint32_t interrupt_type, uint32_t vector,
+                           uint32_t vp_index, bool logical_dest_mode,
+                           bool level_triggered)
+{
+    int ret;
+    int vm_fd = mshv_state->vm;
+
+    if (vector == 0) {
+        warn_report("Ignoring request for interrupt vector 0");
+        return 0;
+    }
+
+    union hv_interrupt_control control = {
+        .interrupt_type = interrupt_type,
+        .level_triggered = level_triggered,
+        .logical_dest_mode = logical_dest_mode,
+        .rsvd = 0,
+    };
+
+    struct hv_input_assert_virtual_interrupt arg = {0};
+    arg.control = control;
+    arg.dest_addr = (uint64_t)vp_index;
+    arg.vector = vector;
+
+    struct mshv_root_hvcall args = {0};
+    args.code   = HVCALL_ASSERT_VIRTUAL_INTERRUPT;
+    args.in_sz  = sizeof(arg);
+    args.in_ptr = (uint64_t)&arg;
+
+    ret = mshv_hvcall(vm_fd, &args);
+    if (ret < 0) {
+        error_report("Failed to request interrupt");
+        return -errno;
+    }
+    return 0;
+}
+
+void mshv_irqchip_commit_routes(void)
+{
+    int ret;
+    int vm_fd = mshv_state->vm;
+
+    ret = commit_msi_routing_table(vm_fd);
+    if (ret < 0) {
+        error_report("Failed to commit msi routing table");
+        abort();
+    }
+}
+
+int mshv_irqchip_add_irqfd_notifier_gsi(const EventNotifier *event,
+                                        const EventNotifier *resample,
+                                        int virq)
+{
+    return irqchip_update_irqfd_notifier_gsi(event, resample, virq, true);
+}
+
+int mshv_irqchip_remove_irqfd_notifier_gsi(const EventNotifier *event,
+                                           int virq)
+{
+    return irqchip_update_irqfd_notifier_gsi(event, NULL, virq, false);
+}
+
+int mshv_reserve_ioapic_msi_routes(int vm_fd)
+{
+    int ret, gsi;
+
+    /*
+     * Reserve GSI 0-23 for IOAPIC pins, to avoid conflicts of legacy
+     * peripherals with MSI-X devices
+     */
+    for (gsi = 0; gsi < IOAPIC_NUM_PINS; gsi++) {
+        ret = add_msi_routing(0, 0);
+        if (ret < 0) {
+            error_report("Failed to reserve GSI %d", gsi);
+            return -1;
+        }
+    }
+
+    ret = commit_msi_routing_table(vm_fd);
+    if (ret < 0) {
+        error_report("Failed to commit reserved IOAPIC MSI routes");
+        return -1;
+    }
+
+    return 0;
+}
diff --git a/accel/mshv/mem.c b/accel/mshv/mem.c
index 9889918c31..a0a40eb333 100644
--- a/accel/mshv/mem.c
+++ b/accel/mshv/mem.c
@@ -12,14 +12,137 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "linux/mshv.h"
 #include "system/address-spaces.h"
 #include "system/mshv.h"
 #include "system/mshv_int.h"
+#include "exec/memattrs.h"
+#include <sys/ioctl.h>
+#include "trace.h"
+
+static int set_guest_memory(int vm_fd,
+                            const struct mshv_user_mem_region *region)
+{
+    int ret;
+
+    ret = ioctl(vm_fd, MSHV_SET_GUEST_MEMORY, region);
+    if (ret < 0) {
+        error_report("failed to set guest memory");
+        return -errno;
+    }
+
+    return 0;
+}
+
+static int map_or_unmap(int vm_fd, const MshvMemoryRegion *mr, bool map)
+{
+    struct mshv_user_mem_region region = {0};
+
+    region.guest_pfn = mr->guest_phys_addr >> MSHV_PAGE_SHIFT;
+    region.size = mr->memory_size;
+    region.userspace_addr = mr->userspace_addr;
+
+    if (!map) {
+        region.flags |= (1 << MSHV_SET_MEM_BIT_UNMAP);
+        trace_mshv_unmap_memory(mr->userspace_addr, mr->guest_phys_addr,
+                                mr->memory_size);
+        return set_guest_memory(vm_fd, &region);
+    }
+
+    region.flags = BIT(MSHV_SET_MEM_BIT_EXECUTABLE);
+    if (!mr->readonly) {
+        region.flags |= BIT(MSHV_SET_MEM_BIT_WRITABLE);
+    }
+
+    trace_mshv_map_memory(mr->userspace_addr, mr->guest_phys_addr,
+                          mr->memory_size);
+    return set_guest_memory(vm_fd, &region);
+}
+
+static int set_memory(const MshvMemoryRegion *mshv_mr, bool add)
+{
+    int ret = 0;
+
+    if (!mshv_mr) {
+        error_report("Invalid mshv_mr");
+        return -1;
+    }
+
+    trace_mshv_set_memory(add, mshv_mr->guest_phys_addr,
+                          mshv_mr->memory_size,
+                          mshv_mr->userspace_addr, mshv_mr->readonly,
+                          ret);
+    return map_or_unmap(mshv_state->vm, mshv_mr, add);
+}
+
+/*
+ * Calculate and align the start address and the size of the section.
+ * Return the size. If the size is 0, the aligned section is empty.
+ */
+static hwaddr align_section(MemoryRegionSection *section, hwaddr *start)
+{
+    hwaddr size = int128_get64(section->size);
+    hwaddr delta, aligned;
+
+    /*
+     * works in page size chunks, but the function may be called
+     * with sub-page size and unaligned start address. Pad the start
+     * address to next and truncate size to previous page boundary.
+     */
+    aligned = ROUND_UP(section->offset_within_address_space,
+                       qemu_real_host_page_size());
+    delta = aligned - section->offset_within_address_space;
+    *start = aligned;
+    if (delta > size) {
+        return 0;
+    }
+
+    return (size - delta) & qemu_real_host_page_mask();
+}
 
 void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
                        bool add)
 {
-    error_report("unimplemented");
-    abort();
-}
+    int ret = 0;
+    MemoryRegion *area = section->mr;
+    bool writable = !area->readonly && !area->rom_device;
+    hwaddr start_addr, mr_offset, size;
+    void *ram;
+    MshvMemoryRegion mshv_mr = {0};
 
+    size = align_section(section, &start_addr);
+    trace_mshv_set_phys_mem(add, section->mr->name, start_addr);
+
+    /*
+     * If the memory device is a writable non-ram area, we do not
+     * want to map it into the guest memory. If it is not a ROM device,
+     * we want to remove mshv memory mapping, so accesses will trap.
+     */
+    if (!memory_region_is_ram(area)) {
+        if (writable) {
+            return;
+        } else if (!area->romd_mode) {
+            add = false;
+        }
+    }
+
+    if (!size) {
+        return;
+    }
+
+    mr_offset = section->offset_within_region + start_addr -
+                section->offset_within_address_space;
+
+    ram = memory_region_get_ram_ptr(area) + mr_offset;
+
+    mshv_mr.guest_phys_addr = start_addr;
+    mshv_mr.memory_size = size;
+    mshv_mr.readonly = !writable;
+    mshv_mr.userspace_addr = (uint64_t)ram;
+
+    ret = set_memory(&mshv_mr, add);
+    if (ret < 0) {
+        error_report("Failed to set memory region");
+        abort();
+    }
+}
diff --git a/accel/mshv/meson.build b/accel/mshv/meson.build
index 8a6beb3fb1..f88fc8678c 100644
--- a/accel/mshv/meson.build
+++ b/accel/mshv/meson.build
@@ -1,5 +1,6 @@
 mshv_ss = ss.source_set()
 mshv_ss.add(if_true: files(
+  'irq.c',
   'mem.c',
   'mshv-all.c'
 ))
diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index a684a36677..653195c57c 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -7,6 +7,7 @@
  *  Ziqiao Zhou       <ziqiaozhou@microsoft.com>
  *  Magnus Kulke      <magnuskulke@microsoft.com>
  *  Jinank Jain       <jinankjain@microsoft.com>
+ *  Wei Liu           <liuwe@microsoft.com>
  *
  * SPDX-License-Identifier: GPL-2.0-or-later
  *
@@ -23,6 +24,7 @@
 #include "hw/hyperv/hvhdk.h"
 #include "hw/hyperv/hvhdk_mini.h"
 #include "hw/hyperv/hvgdk.h"
+#include "hw/hyperv/hvgdk_mini.h"
 #include "linux/mshv.h"
 
 #include "qemu/accel.h"
@@ -49,6 +51,175 @@ bool mshv_allowed;
 
 MshvState *mshv_state;
 
+static int init_mshv(int *mshv_fd)
+{
+    int fd = open("/dev/mshv", O_RDWR | O_CLOEXEC);
+    if (fd < 0) {
+        error_report("Failed to open /dev/mshv: %s", strerror(errno));
+        return -1;
+    }
+    *mshv_fd = fd;
+    return 0;
+}
+
+/* freeze 1 to pause, 0 to resume */
+static int set_time_freeze(int vm_fd, int freeze)
+{
+    int ret;
+    struct hv_input_set_partition_property in = {0};
+    in.property_code = HV_PARTITION_PROPERTY_TIME_FREEZE;
+    in.property_value = freeze;
+
+    struct mshv_root_hvcall args = {0};
+    args.code = HVCALL_SET_PARTITION_PROPERTY;
+    args.in_sz = sizeof(in);
+    args.in_ptr = (uint64_t)&in;
+
+    ret = mshv_hvcall(vm_fd, &args);
+    if (ret < 0) {
+        error_report("Failed to set time freeze");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int pause_vm(int vm_fd)
+{
+    int ret;
+
+    ret = set_time_freeze(vm_fd, 1);
+    if (ret < 0) {
+        error_report("Failed to pause partition: %s", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int resume_vm(int vm_fd)
+{
+    int ret;
+
+    ret = set_time_freeze(vm_fd, 0);
+    if (ret < 0) {
+        error_report("Failed to resume partition: %s", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int create_partition(int mshv_fd, int *vm_fd)
+{
+    int ret;
+    struct mshv_create_partition args = {0};
+
+    /* Initialize pt_flags with the desired features */
+    uint64_t pt_flags = (1ULL << MSHV_PT_BIT_LAPIC) |
+                        (1ULL << MSHV_PT_BIT_X2APIC) |
+                        (1ULL << MSHV_PT_BIT_GPA_SUPER_PAGES);
+
+    /* Set default isolation type */
+    uint64_t pt_isolation = MSHV_PT_ISOLATION_NONE;
+
+    args.pt_flags = pt_flags;
+    args.pt_isolation = pt_isolation;
+
+    ret = ioctl(mshv_fd, MSHV_CREATE_PARTITION, &args);
+    if (ret < 0) {
+        error_report("Failed to create partition: %s", strerror(errno));
+        return -1;
+    }
+
+    *vm_fd = ret;
+    return 0;
+}
+
+static int set_synthetic_proc_features(int vm_fd)
+{
+    int ret;
+    struct hv_input_set_partition_property in = {0};
+    union hv_partition_synthetic_processor_features features = {0};
+
+    /* Access the bitfield and set the desired features */
+    features.hypervisor_present = 1;
+    features.hv1 = 1;
+    features.access_partition_reference_counter = 1;
+    features.access_synic_regs = 1;
+    features.access_synthetic_timer_regs = 1;
+    features.access_partition_reference_tsc = 1;
+    features.access_frequency_regs = 1;
+    features.access_intr_ctrl_regs = 1;
+    features.access_vp_index = 1;
+    features.access_hypercall_regs = 1;
+    features.tb_flush_hypercalls = 1;
+    features.synthetic_cluster_ipi = 1;
+    features.direct_synthetic_timers = 1;
+
+    mshv_arch_amend_proc_features(&features);
+
+    in.property_code = HV_PARTITION_PROPERTY_SYNTHETIC_PROC_FEATURES;
+    in.property_value = features.as_uint64[0];
+
+    struct mshv_root_hvcall args = {0};
+    args.code = HVCALL_SET_PARTITION_PROPERTY;
+    args.in_sz = sizeof(in);
+    args.in_ptr = (uint64_t)&in;
+
+    trace_mshv_hvcall_args("synthetic_proc_features", args.code, args.in_sz);
+
+    ret = mshv_hvcall(vm_fd, &args);
+    if (ret < 0) {
+        error_report("Failed to set synthethic proc features");
+        return -errno;
+    }
+    return 0;
+}
+
+static int initialize_vm(int vm_fd)
+{
+    int ret = ioctl(vm_fd, MSHV_INITIALIZE_PARTITION);
+    if (ret < 0) {
+        error_report("Failed to initialize partition: %s", strerror(errno));
+        return -1;
+    }
+    return 0;
+}
+
+static int create_vm(int mshv_fd, int *vm_fd)
+{
+    int ret = create_partition(mshv_fd, vm_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    ret = set_synthetic_proc_features(*vm_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    ret = initialize_vm(*vm_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    ret = mshv_reserve_ioapic_msi_routes(*vm_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    ret = mshv_arch_post_init_vm(*vm_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    /* Always create a frozen partition */
+    pause_vm(*vm_fd);
+
+    return 0;
+}
+
 static void mem_region_add(MemoryListener *listener,
                            MemoryRegionSection *section)
 {
@@ -67,11 +238,124 @@ static void mem_region_del(MemoryListener *listener,
     memory_region_unref(section->mr);
 }
 
+typedef enum {
+    DATAMATCH_NONE,
+    DATAMATCH_U32,
+    DATAMATCH_U64,
+} DatamatchTag;
+
+typedef struct {
+    DatamatchTag tag;
+    union {
+        uint32_t u32;
+        uint64_t u64;
+    } value;
+} Datamatch;
+
+/* flags: determine whether to de/assign */
+static int ioeventfd(int vm_fd, int event_fd, uint64_t addr, Datamatch dm,
+                     uint32_t flags)
+{
+    struct mshv_user_ioeventfd args = {0};
+    args.fd = event_fd;
+    args.addr = addr;
+    args.flags = flags;
+
+    if (dm.tag == DATAMATCH_NONE) {
+        args.datamatch = 0;
+    } else {
+        flags |= BIT(MSHV_IOEVENTFD_BIT_DATAMATCH);
+        args.flags = flags;
+        if (dm.tag == DATAMATCH_U64) {
+            args.len = sizeof(uint64_t);
+            args.datamatch = dm.value.u64;
+        } else {
+            args.len = sizeof(uint32_t);
+            args.datamatch = dm.value.u32;
+        }
+    }
+
+    return ioctl(vm_fd, MSHV_IOEVENTFD, &args);
+}
+
+static int unregister_ioevent(int vm_fd, int event_fd, uint64_t mmio_addr)
+{
+    uint32_t flags = 0;
+    Datamatch dm = {0};
+
+    flags |= BIT(MSHV_IOEVENTFD_BIT_DEASSIGN);
+    dm.tag = DATAMATCH_NONE;
+
+    return ioeventfd(vm_fd, event_fd, mmio_addr, dm, flags);
+}
+
+static int register_ioevent(int vm_fd, int event_fd, uint64_t mmio_addr,
+                            uint64_t val, bool is_64bit, bool is_datamatch)
+{
+    uint32_t flags = 0;
+    Datamatch dm = {0};
+
+    if (!is_datamatch) {
+        dm.tag = DATAMATCH_NONE;
+    } else if (is_64bit) {
+        dm.tag = DATAMATCH_U64;
+        dm.value.u64 = val;
+    } else {
+        dm.tag = DATAMATCH_U32;
+        dm.value.u32 = val;
+    }
+
+    return ioeventfd(vm_fd, event_fd, mmio_addr, dm, flags);
+}
+
+static void mem_ioeventfd_add(MemoryListener *listener,
+                              MemoryRegionSection *section,
+                              bool match_data, uint64_t data,
+                              EventNotifier *e)
+{
+    int fd = event_notifier_get_fd(e);
+    int ret;
+    bool is_64 = int128_get64(section->size) == 8;
+    uint64_t addr = section->offset_within_address_space;
+
+    trace_mshv_mem_ioeventfd_add(addr, int128_get64(section->size), data);
+
+    ret = register_ioevent(mshv_state->vm, fd, addr, data, is_64, match_data);
+
+    if (ret < 0) {
+        error_report("Failed to register ioeventfd: %s (%d)", strerror(-ret),
+                     -ret);
+        abort();
+    }
+}
+
+static void mem_ioeventfd_del(MemoryListener *listener,
+                              MemoryRegionSection *section,
+                              bool match_data, uint64_t data,
+                              EventNotifier *e)
+{
+    int fd = event_notifier_get_fd(e);
+    int ret;
+    uint64_t addr = section->offset_within_address_space;
+
+    trace_mshv_mem_ioeventfd_del(section->offset_within_address_space,
+                                 int128_get64(section->size), data);
+
+    ret = unregister_ioevent(mshv_state->vm, fd, addr);
+    if (ret < 0) {
+        error_report("Failed to unregister ioeventfd: %s (%d)", strerror(-ret),
+                     -ret);
+        abort();
+    }
+}
+
 static MemoryListener mshv_memory_listener = {
     .name = "mshv",
     .priority = MEMORY_LISTENER_PRIORITY_ACCEL,
     .region_add = mem_region_add,
     .region_del = mem_region_del,
+    .eventfd_add = mem_ioeventfd_add,
+    .eventfd_del = mem_ioeventfd_del,
 };
 
 static MemoryListener mshv_io_listener = {
@@ -97,15 +381,57 @@ static void register_mshv_memory_listener(MshvState *s, MshvMemoryListener *mml,
     }
 }
 
+int mshv_hvcall(int fd, const struct mshv_root_hvcall *args)
+{
+    int ret = 0;
+
+    ret = ioctl(fd, MSHV_ROOT_HVCALL, args);
+    if (ret < 0) {
+        error_report("Failed to perform hvcall: %s", strerror(errno));
+        return -1;
+    }
+    return ret;
+}
+
+
 static int mshv_init(AccelState *as, MachineState *ms)
 {
     MshvState *s;
+    int mshv_fd, vm_fd, ret;
+
+    if (mshv_state) {
+        warn_report("MSHV accelerator already initialized");
+        return 0;
+    }
+
     s = MSHV_STATE(as);
 
     accel_blocker_init();
 
     s->vm = 0;
 
+    ret = init_mshv(&mshv_fd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    mshv_init_msicontrol();
+
+    ret = create_vm(mshv_fd, &vm_fd);
+    if (ret < 0) {
+        close(mshv_fd);
+        return -1;
+    }
+
+    ret = resume_vm(vm_fd);
+    if (ret < 0) {
+        close(mshv_fd);
+        close(vm_fd);
+        return -1;
+    }
+
+    s->vm = vm_fd;
+    s->fd = mshv_fd;
     s->nr_as = 1;
     s->as = g_new0(MshvAddressSpace, s->nr_as);
 
diff --git a/accel/mshv/trace-events b/accel/mshv/trace-events
new file mode 100644
index 0000000000..6130c4abf8
--- /dev/null
+++ b/accel/mshv/trace-events
@@ -0,0 +1,26 @@
+# Authors: Ziqiao Zhou <ziqiaozhou@microsoft.com>
+#          Magnus Kulke <magnuskulke@microsoft.com>
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+mshv_set_memory(bool add, uint64_t gpa, uint64_t size, uint64_t user_addr, bool readonly, int ret) "add=%d gpa=0x%" PRIx64 " size=0x%" PRIx64 " user=0x%" PRIx64 " readonly=%d result=%d"
+mshv_mem_ioeventfd_add(uint64_t addr, uint32_t size, uint32_t data) "addr=0x%" PRIx64 " size=%d data=0x%x"
+mshv_mem_ioeventfd_del(uint64_t addr, uint32_t size, uint32_t data) "addr=0x%" PRIx64 " size=%d data=0x%x"
+
+mshv_hvcall_args(const char* hvcall, uint16_t code, uint16_t in_sz) "built args for '%s' code: %d in_sz: %d"
+
+mshv_handle_interrupt(uint32_t cpu, int mask) "cpu_index=%d mask=0x%x"
+mshv_set_msi_routing(uint32_t gsi, uint64_t addr, uint32_t data) "gsi=%d addr=0x%" PRIx64 " data=0x%x"
+mshv_remove_msi_routing(uint32_t gsi) "gsi=%d"
+mshv_add_msi_routing(uint64_t addr, uint32_t data) "addr=0x%" PRIx64 " data=0x%x"
+mshv_commit_msi_routing_table(int vm_fd, int len) "vm_fd=%d table_size=%d"
+mshv_register_irqfd(int vm_fd, int event_fd, uint32_t gsi) "vm_fd=%d event_fd=%d gsi=%d"
+mshv_irqchip_update_irqfd_notifier_gsi(int event_fd, int resample_fd, int virq, bool add) "event_fd=%d resample_fd=%d virq=%d add=%d"
+
+mshv_insn_fetch(uint64_t addr, size_t size) "gpa=0x%" PRIx64 " size=%zu"
+mshv_mem_write(uint64_t addr, size_t size) "\tgpa=0x%" PRIx64 " size=%zu"
+mshv_mem_read(uint64_t addr, size_t size) "\tgpa=0x%" PRIx64 " size=%zu"
+mshv_map_memory(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
+mshv_unmap_memory(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
+mshv_set_phys_mem(bool add, const char *name, uint64_t gpa) "\tadd=%d name=%s gpa=0x%010" PRIx64
+mshv_handle_mmio(uint64_t gva, uint64_t gpa, uint64_t size, uint8_t access_type) "\tgva=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%" PRIx64 " access_type=%d"
diff --git a/accel/mshv/trace.h b/accel/mshv/trace.h
new file mode 100644
index 0000000000..0dca48f917
--- /dev/null
+++ b/accel/mshv/trace.h
@@ -0,0 +1,14 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors:
+ *  Ziqiao Zhou       <ziqiaozhou@microsoft.com>
+ *  Magnus Kulke      <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ */
+
+#include "trace/trace-accel_mshv.h"
diff --git a/accel/stubs/meson.build b/accel/stubs/meson.build
index 9dfc4f9dda..48eccd1b86 100644
--- a/accel/stubs/meson.build
+++ b/accel/stubs/meson.build
@@ -5,5 +5,6 @@ system_stubs_ss.add(when: 'CONFIG_TCG', if_false: files('tcg-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_HVF', if_false: files('hvf-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_NVMM', if_false: files('nvmm-stub.c'))
 system_stubs_ss.add(when: 'CONFIG_WHPX', if_false: files('whpx-stub.c'))
+system_stubs_ss.add(when: 'CONFIG_MSHV', if_false: files('mshv-stub.c'))
 
 specific_ss.add_all(when: ['CONFIG_SYSTEM_ONLY'], if_true: system_stubs_ss)
diff --git a/accel/stubs/mshv-stub.c b/accel/stubs/mshv-stub.c
new file mode 100644
index 0000000000..e499b199d9
--- /dev/null
+++ b/accel/stubs/mshv-stub.c
@@ -0,0 +1,44 @@
+/*
+ * QEMU MSHV stub
+ *
+ * Copyright Red Hat, Inc. 2025
+ *
+ * Author: Paolo Bonzini     <pbonzini@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/pci/msi.h"
+#include "system/mshv.h"
+
+bool mshv_allowed;
+
+int mshv_irqchip_add_msi_route(int vector, PCIDevice *dev)
+{
+    return -ENOSYS;
+}
+
+void mshv_irqchip_release_virq(int virq)
+{
+}
+
+int mshv_irqchip_update_msi_route(int virq, MSIMessage msg, PCIDevice *dev)
+{
+    return -ENOSYS;
+}
+
+void mshv_irqchip_commit_routes(void)
+{
+}
+
+int mshv_irqchip_add_irqfd_notifier_gsi(const EventNotifier *n,
+                                        const EventNotifier *rn, int virq)
+{
+    return -ENOSYS;
+}
+
+int mshv_irqchip_remove_irqfd_notifier_gsi(const EventNotifier *n, int virq)
+{
+    return -ENOSYS;
+}
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index bcb103560c..6d7859640c 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -27,6 +27,7 @@
 #include "hw/pci/msi.h"
 #include "qemu/host-utils.h"
 #include "system/kvm.h"
+#include "system/mshv.h"
 #include "trace.h"
 #include "hw/i386/apic-msidef.h"
 #include "qapi/error.h"
@@ -932,6 +933,13 @@ static void apic_send_msi(MSIMessage *msi)
     uint8_t trigger_mode = (data >> MSI_DATA_TRIGGER_SHIFT) & 0x1;
     uint8_t delivery = (data >> MSI_DATA_DELIVERY_MODE_SHIFT) & 0x7;
     /* XXX: Ignore redirection hint. */
+#ifdef CONFIG_MSHV
+    if (mshv_enabled()) {
+        mshv_request_interrupt(mshv_state, delivery, vector, dest,
+                               dest_mode, trigger_mode);
+        return;
+    }
+#endif
     apic_deliver_irq(dest, dest_mode, delivery, vector, trigger_mode);
 }
 
diff --git a/include/system/mshv.h b/include/system/mshv.h
index 434ea9682e..1011e81df4 100644
--- a/include/system/mshv.h
+++ b/include/system/mshv.h
@@ -31,18 +31,27 @@
 #define CONFIG_MSHV_IS_POSSIBLE
 #endif
 
+#define MSHV_MAX_MSI_ROUTES 4096
+
+#define MSHV_PAGE_SHIFT 12
+
 #ifdef CONFIG_MSHV_IS_POSSIBLE
 extern bool mshv_allowed;
 #define mshv_enabled() (mshv_allowed)
+#define mshv_msi_via_irqfd_enabled() mshv_enabled()
 #else /* CONFIG_MSHV_IS_POSSIBLE */
 #define mshv_enabled() false
-#endif
 #define mshv_msi_via_irqfd_enabled() false
+#endif
 
 typedef struct MshvState MshvState;
 extern MshvState *mshv_state;
 
 /* interrupt */
+int mshv_request_interrupt(MshvState *mshv_state, uint32_t interrupt_type, uint32_t vector,
+                           uint32_t vp_index, bool logical_destination_mode,
+                           bool level_triggered);
+
 int mshv_irqchip_add_msi_route(int vector, PCIDevice *dev);
 int mshv_irqchip_update_msi_route(int virq, MSIMessage msg, PCIDevice *dev);
 void mshv_irqchip_commit_routes(void);
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index cfa177ff72..b36124a0ea 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -36,10 +36,35 @@ struct MshvState {
     /* number of listeners */
     int nr_as;
     MshvAddressSpace *as;
+    int fd;
 };
 
+typedef struct MshvMsiControl {
+    bool updated;
+    GHashTable *gsi_routes;
+} MshvMsiControl;
+
+void mshv_arch_amend_proc_features(
+    union hv_partition_synthetic_processor_features *features);
+int mshv_arch_post_init_vm(int vm_fd);
+
+#if defined COMPILING_PER_TARGET && defined CONFIG_MSHV_IS_POSSIBLE
+int mshv_hvcall(int fd, const struct mshv_root_hvcall *args);
+#endif
+
 /* memory */
+typedef struct MshvMemoryRegion {
+    uint64_t guest_phys_addr;
+    uint64_t memory_size;
+    uint64_t userspace_addr;
+    bool readonly;
+} MshvMemoryRegion;
+
 void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
                        bool add);
 
+/* interrupt */
+void mshv_init_msicontrol(void);
+int mshv_reserve_ioapic_msi_routes(int vm_fd);
+
 #endif
diff --git a/meson.build b/meson.build
index 167021ed62..afaefa0172 100644
--- a/meson.build
+++ b/meson.build
@@ -3668,6 +3668,7 @@ if have_system
   trace_events_subdirs += [
     'accel/hvf',
     'accel/kvm',
+    'accel/mshv',
     'audio',
     'backends',
     'backends/tpm',
diff --git a/target/i386/mshv/meson.build b/target/i386/mshv/meson.build
index 8ddaa7c11d..647e5dafb7 100644
--- a/target/i386/mshv/meson.build
+++ b/target/i386/mshv/meson.build
@@ -1,6 +1,7 @@
 i386_mshv_ss = ss.source_set()
 
 i386_mshv_ss.add(files(
+  'mshv-cpu.c',
   'x86.c',
 ))
 
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
new file mode 100644
index 0000000000..de0c26bc6c
--- /dev/null
+++ b/target/i386/mshv/mshv-cpu.c
@@ -0,0 +1,72 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Ziqiao Zhou   <ziqiaozhou@microsoft.com>
+ *          Magnus Kulke  <magnuskulke@microsoft.com>
+ *          Jinank Jain   <jinankjain@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+#include "qemu/typedefs.h"
+
+#include "system/mshv.h"
+#include "system/mshv_int.h"
+#include "system/address-spaces.h"
+#include "linux/mshv.h"
+#include "hw/hyperv/hvgdk.h"
+#include "hw/hyperv/hvgdk_mini.h"
+#include "hw/hyperv/hvhdk_mini.h"
+
+#include "trace-accel_mshv.h"
+#include "trace.h"
+
+void mshv_arch_amend_proc_features(
+    union hv_partition_synthetic_processor_features *features)
+{
+    features->access_guest_idle_reg = 1;
+}
+
+/*
+ * Default Microsoft Hypervisor behavior for unimplemented MSR is to send a
+ * fault to the guest if it tries to access it. It is possible to override
+ * this behavior with a more suitable option i.e., ignore writes from the guest
+ * and return zero in attempt to read unimplemented.
+ */
+static int set_unimplemented_msr_action(int vm_fd)
+{
+    struct hv_input_set_partition_property in = {0};
+    struct mshv_root_hvcall args = {0};
+
+    in.property_code  = HV_PARTITION_PROPERTY_UNIMPLEMENTED_MSR_ACTION;
+    in.property_value = HV_UNIMPLEMENTED_MSR_ACTION_IGNORE_WRITE_READ_ZERO;
+
+    args.code   = HVCALL_SET_PARTITION_PROPERTY;
+    args.in_sz  = sizeof(in);
+    args.in_ptr = (uint64_t)&in;
+
+    trace_mshv_hvcall_args("unimplemented_msr_action", args.code, args.in_sz);
+
+    int ret = mshv_hvcall(vm_fd, &args);
+    if (ret < 0) {
+        error_report("Failed to set unimplemented MSR action");
+        return -1;
+    }
+    return 0;
+}
+
+int mshv_arch_post_init_vm(int vm_fd)
+{
+    int ret;
+
+    ret = set_unimplemented_msr_action(vm_fd);
+    if (ret < 0) {
+        error_report("Failed to set unimplemented MSR action");
+    }
+
+    return ret;
+}

From 4dc5d4257259764b6fcd035870517fc4140d8962 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:30 +0200
Subject: [PATCH 1149/2396] accel/mshv: Add vCPU creation and execution loop

Create MSHV vCPUs using MSHV_CREATE_VP and initialize their state.
Register the MSHV CPU execution loop loop with the QEMU accelerator
framework to enable guest code execution.

The target/i386 functionality is still mostly stubbed out and will be
populated in a later commit in this series.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-11-magnuskulke@linux.microsoft.com
[Fix g_free/g_clear_pointer confusion; rename qemu_wait_io_event;
 mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mshv-all.c       | 186 +++++++++++++++++++++++++++++++++---
 accel/mshv/trace-events     |   2 +
 include/system/mshv.h       |   2 +-
 include/system/mshv_int.h   |  20 ++++
 target/i386/mshv/mshv-cpu.c |  63 ++++++++++++
 5 files changed, 260 insertions(+), 13 deletions(-)

diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index 653195c57c..e02421d79d 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -393,6 +393,24 @@ int mshv_hvcall(int fd, const struct mshv_root_hvcall *args)
     return ret;
 }
 
+static int mshv_init_vcpu(CPUState *cpu)
+{
+    int vm_fd = mshv_state->vm;
+    uint8_t vp_index = cpu->cpu_index;
+    int ret;
+
+    mshv_arch_init_vcpu(cpu);
+    cpu->accel = g_new0(AccelCPUState, 1);
+
+    ret = mshv_create_vcpu(vm_fd, vp_index, &cpu->accel->cpufd);
+    if (ret < 0) {
+        return -1;
+    }
+
+    cpu->accel->dirty = true;
+
+    return 0;
+}
 
 static int mshv_init(AccelState *as, MachineState *ms)
 {
@@ -415,6 +433,8 @@ static int mshv_init(AccelState *as, MachineState *ms)
         return -1;
     }
 
+    mshv_init_mmio_emu();
+
     mshv_init_msicontrol();
 
     ret = create_vm(mshv_fd, &vm_fd);
@@ -444,40 +464,182 @@ static int mshv_init(AccelState *as, MachineState *ms)
     return 0;
 }
 
+static int mshv_destroy_vcpu(CPUState *cpu)
+{
+    int cpu_fd = mshv_vcpufd(cpu);
+    int vm_fd = mshv_state->vm;
+
+    mshv_remove_vcpu(vm_fd, cpu_fd);
+    mshv_vcpufd(cpu) = 0;
+
+    mshv_arch_destroy_vcpu(cpu);
+    g_clear_pointer(&cpu->accel, g_free);
+    return 0;
+}
+
+static int mshv_cpu_exec(CPUState *cpu)
+{
+    hv_message mshv_msg;
+    enum MshvVmExit exit_reason;
+    int ret = 0;
+
+    bql_unlock();
+    cpu_exec_start(cpu);
+
+    do {
+        if (cpu->accel->dirty) {
+            ret = mshv_arch_put_registers(cpu);
+            if (ret) {
+                error_report("Failed to put registers after init: %s",
+                              strerror(-ret));
+                ret = -1;
+                break;
+            }
+            cpu->accel->dirty = false;
+        }
+
+        ret = mshv_run_vcpu(mshv_state->vm, cpu, &mshv_msg, &exit_reason);
+        if (ret < 0) {
+            error_report("Failed to run on vcpu %d", cpu->cpu_index);
+            abort();
+        }
+
+        switch (exit_reason) {
+        case MshvVmExitIgnore:
+            break;
+        default:
+            ret = EXCP_INTERRUPT;
+            break;
+        }
+    } while (ret == 0);
+
+    cpu_exec_end(cpu);
+    bql_lock();
+
+    if (ret < 0) {
+        cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
+        vm_stop(RUN_STATE_INTERNAL_ERROR);
+    }
+
+    return ret;
+}
+
+static void *mshv_vcpu_thread(void *arg)
+{
+    CPUState *cpu = arg;
+    int ret;
+
+    rcu_register_thread();
+
+    bql_lock();
+    qemu_thread_get_self(cpu->thread);
+    cpu->thread_id = qemu_get_thread_id();
+    current_cpu = cpu;
+    ret = mshv_init_vcpu(cpu);
+    if (ret < 0) {
+        error_report("Failed to init vcpu %d", cpu->cpu_index);
+        goto cleanup;
+    }
+
+    /* signal CPU creation */
+    cpu_thread_signal_created(cpu);
+    qemu_guest_random_seed_thread_part2(cpu->random_seed);
+
+    do {
+        qemu_process_cpu_events(cpu);
+        if (cpu_can_run(cpu)) {
+            mshv_cpu_exec(cpu);
+        }
+    } while (!cpu->unplug || cpu_can_run(cpu));
+
+    mshv_destroy_vcpu(cpu);
+cleanup:
+    cpu_thread_signal_destroyed(cpu);
+    bql_unlock();
+    rcu_unregister_thread();
+    return NULL;
+}
+
 static void mshv_start_vcpu_thread(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    char thread_name[VCPU_THREAD_NAME_SIZE];
+
+    cpu->thread = g_malloc0(sizeof(QemuThread));
+    cpu->halt_cond = g_malloc0(sizeof(QemuCond));
+
+    qemu_cond_init(cpu->halt_cond);
+
+    trace_mshv_start_vcpu_thread(thread_name, cpu->cpu_index);
+    qemu_thread_create(cpu->thread, thread_name, mshv_vcpu_thread, cpu,
+                       QEMU_THREAD_JOINABLE);
+}
+
+static void do_mshv_cpu_synchronize_post_init(CPUState *cpu,
+                                              run_on_cpu_data arg)
+{
+    int ret = mshv_arch_put_registers(cpu);
+    if (ret < 0) {
+        error_report("Failed to put registers after init: %s", strerror(-ret));
+        abort();
+    }
+
+    cpu->accel->dirty = false;
 }
 
 static void mshv_cpu_synchronize_post_init(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    run_on_cpu(cpu, do_mshv_cpu_synchronize_post_init, RUN_ON_CPU_NULL);
 }
 
 static void mshv_cpu_synchronize_post_reset(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    int ret = mshv_arch_put_registers(cpu);
+    if (ret) {
+        error_report("Failed to put registers after reset: %s",
+                     strerror(-ret));
+        cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
+        vm_stop(RUN_STATE_INTERNAL_ERROR);
+    }
+    cpu->accel->dirty = false;
+}
+
+static void do_mshv_cpu_synchronize_pre_loadvm(CPUState *cpu,
+                                               run_on_cpu_data arg)
+{
+    cpu->accel->dirty = true;
 }
 
 static void mshv_cpu_synchronize_pre_loadvm(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    run_on_cpu(cpu, do_mshv_cpu_synchronize_pre_loadvm, RUN_ON_CPU_NULL);
+}
+
+static void do_mshv_cpu_synchronize(CPUState *cpu, run_on_cpu_data arg)
+{
+    if (!cpu->accel->dirty) {
+        int ret = mshv_load_regs(cpu);
+        if (ret < 0) {
+            error_report("Failed to load registers for vcpu %d",
+                         cpu->cpu_index);
+
+            cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
+            vm_stop(RUN_STATE_INTERNAL_ERROR);
+        }
+
+        cpu->accel->dirty = true;
+    }
 }
 
 static void mshv_cpu_synchronize(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    if (!cpu->accel->dirty) {
+        run_on_cpu(cpu, do_mshv_cpu_synchronize, RUN_ON_CPU_NULL);
+    }
 }
 
 static bool mshv_cpus_are_resettable(void)
 {
-    error_report("unimplemented");
-    abort();
+    return false;
 }
 
 static void mshv_accel_class_init(ObjectClass *oc, const void *data)
diff --git a/accel/mshv/trace-events b/accel/mshv/trace-events
index 6130c4abf8..a4dffeb24a 100644
--- a/accel/mshv/trace-events
+++ b/accel/mshv/trace-events
@@ -3,6 +3,8 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
+mshv_start_vcpu_thread(const char* thread, uint32_t cpu) "thread=%s cpu_index=%d"
+
 mshv_set_memory(bool add, uint64_t gpa, uint64_t size, uint64_t user_addr, bool readonly, int ret) "add=%d gpa=0x%" PRIx64 " size=0x%" PRIx64 " user=0x%" PRIx64 " readonly=%d result=%d"
 mshv_mem_ioeventfd_add(uint64_t addr, uint32_t size, uint32_t data) "addr=0x%" PRIx64 " size=%d data=0x%x"
 mshv_mem_ioeventfd_del(uint64_t addr, uint32_t size, uint32_t data) "addr=0x%" PRIx64 " size=%d data=0x%x"
diff --git a/include/system/mshv.h b/include/system/mshv.h
index 1011e81df4..bbc42f4dc3 100644
--- a/include/system/mshv.h
+++ b/include/system/mshv.h
@@ -41,7 +41,7 @@ extern bool mshv_allowed;
 #define mshv_msi_via_irqfd_enabled() mshv_enabled()
 #else /* CONFIG_MSHV_IS_POSSIBLE */
 #define mshv_enabled() false
-#define mshv_msi_via_irqfd_enabled() false
+#define mshv_msi_via_irqfd_enabled() mshv_enabled()
 #endif
 
 typedef struct MshvState MshvState;
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index b36124a0ea..fb80f69772 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -14,6 +14,8 @@
 #ifndef QEMU_MSHV_INT_H
 #define QEMU_MSHV_INT_H
 
+typedef struct hyperv_message hv_message;
+
 struct AccelCPUState {
     int cpufd;
     bool dirty;
@@ -44,6 +46,24 @@ typedef struct MshvMsiControl {
     GHashTable *gsi_routes;
 } MshvMsiControl;
 
+#define mshv_vcpufd(cpu) (cpu->accel->cpufd)
+
+/* cpu */
+typedef enum MshvVmExit {
+    MshvVmExitIgnore   = 0,
+    MshvVmExitShutdown = 1,
+    MshvVmExitSpecial  = 2,
+} MshvVmExit;
+
+void mshv_init_mmio_emu(void);
+int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd);
+void mshv_remove_vcpu(int vm_fd, int cpu_fd);
+int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit);
+int mshv_load_regs(CPUState *cpu);
+int mshv_store_regs(CPUState *cpu);
+int mshv_arch_put_registers(const CPUState *cpu);
+void mshv_arch_init_vcpu(CPUState *cpu);
+void mshv_arch_destroy_vcpu(CPUState *cpu);
 void mshv_arch_amend_proc_features(
     union hv_partition_synthetic_processor_features *features);
 int mshv_arch_post_init_vm(int vm_fd);
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index de0c26bc6c..02d71ebc14 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -22,15 +22,78 @@
 #include "hw/hyperv/hvgdk_mini.h"
 #include "hw/hyperv/hvhdk_mini.h"
 
+#include "cpu.h"
+#include "emulate/x86_decode.h"
+#include "emulate/x86_emu.h"
+#include "emulate/x86_flags.h"
+
 #include "trace-accel_mshv.h"
 #include "trace.h"
 
+int mshv_store_regs(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+int mshv_load_regs(CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+int mshv_arch_put_registers(const CPUState *cpu)
+{
+    error_report("unimplemented");
+    abort();
+}
+
 void mshv_arch_amend_proc_features(
     union hv_partition_synthetic_processor_features *features)
 {
     features->access_guest_idle_reg = 1;
 }
 
+int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+void mshv_remove_vcpu(int vm_fd, int cpu_fd)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+void mshv_init_mmio_emu(void)
+{
+    error_report("unimplemented");
+    abort();
+}
+
+void mshv_arch_init_vcpu(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
+    env->emu_mmio_buf = g_new(char, 4096);
+}
+
+void mshv_arch_destroy_vcpu(CPUState *cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
+    g_clear_pointer(&env->emu_mmio_buf, g_free);
+}
+
 /*
  * Default Microsoft Hypervisor behavior for unimplemented MSR is to send a
  * fault to the guest if it tries to access it. It is possible to override

From 575df4df54e060661db45e6f80293b29ea8901c1 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:31 +0200
Subject: [PATCH 1150/2396] accel/mshv: Add vCPU signal handling

Implement signal handling for MSHV vCPUs to support asynchronous
interrupts from the main thread.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-12-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mshv-all.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index e02421d79d..fa1f8f35bd 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -524,6 +524,35 @@ static int mshv_cpu_exec(CPUState *cpu)
     return ret;
 }
 
+/*
+ * The signal handler is triggered when QEMU's main thread receives a SIG_IPI
+ * (SIGUSR1). This signal causes the current CPU thread to be kicked, forcing a
+ * VM exit on the CPU. The VM exit generates an exit reason that breaks the loop
+ * (see mshv_cpu_exec). If the exit is due to a Ctrl+A+x command, the system
+ * will shut down. For other cases, the system will continue running.
+ */
+static void sa_ipi_handler(int sig)
+{
+    /* TODO: call IOCTL to set_immediate_exit, once implemented. */
+
+    qemu_cpu_kick_self();
+}
+
+static void init_signal(CPUState *cpu)
+{
+    /* init cpu signals */
+    struct sigaction sigact;
+    sigset_t set;
+
+    memset(&sigact, 0, sizeof(sigact));
+    sigact.sa_handler = sa_ipi_handler;
+    sigaction(SIG_IPI, &sigact, NULL);
+
+    pthread_sigmask(SIG_BLOCK, NULL, &set);
+    sigdelset(&set, SIG_IPI);
+    pthread_sigmask(SIG_SETMASK, &set, NULL);
+}
+
 static void *mshv_vcpu_thread(void *arg)
 {
     CPUState *cpu = arg;
@@ -540,6 +569,7 @@ static void *mshv_vcpu_thread(void *arg)
         error_report("Failed to init vcpu %d", cpu->cpu_index);
         goto cleanup;
     }
+    init_signal(cpu);
 
     /* signal CPU creation */
     cpu_thread_signal_created(cpu);

From 4ed605c06e743b2ec0bfe35954d88b8c64dd3767 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:32 +0200
Subject: [PATCH 1151/2396] target/i386/mshv: Add CPU create and remove logic

Implement MSHV-specific hooks for vCPU creation and teardown in the
i386 target.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-13-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 02d71ebc14..5069ab7a22 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -30,6 +30,8 @@
 #include "trace-accel_mshv.h"
 #include "trace.h"
 
+#include <sys/ioctl.h>
+
 int mshv_store_regs(CPUState *cpu)
 {
     error_report("unimplemented");
@@ -62,20 +64,29 @@ int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit)
 
 void mshv_remove_vcpu(int vm_fd, int cpu_fd)
 {
-    error_report("unimplemented");
-    abort();
+    close(cpu_fd);
 }
 
+
 int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd)
 {
-    error_report("unimplemented");
-    abort();
+    int ret;
+    struct mshv_create_vp vp_arg = {
+        .vp_index = vp_index,
+    };
+    ret = ioctl(vm_fd, MSHV_CREATE_VP, &vp_arg);
+    if (ret < 0) {
+        error_report("failed to create mshv vcpu: %s", strerror(errno));
+        return -1;
+    }
+
+    *cpu_fd = ret;
+
+    return 0;
 }
 
 void mshv_init_mmio_emu(void)
 {
-    error_report("unimplemented");
-    abort();
 }
 
 void mshv_arch_init_vcpu(CPUState *cpu)

From 2bd7a6aa4743ee85c77c0520e8b422b3bfeab386 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Thu, 2 Oct 2025 18:13:31 +0200
Subject: [PATCH 1152/2396] target/i386/mshv: Implement mshv_store_regs()

Add support for writing general-purpose registers to MSHV vCPUs
during initialization or migration using the MSHV register interface. A
generic set_register call is introduced to abstract the HV call over
the various register types.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-14-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/mshv.h       |   1 +
 include/system/mshv_int.h   |   2 +
 target/i386/mshv/mshv-cpu.c | 116 +++++++++++++++++++++++++++++++++++-
 3 files changed, 117 insertions(+), 2 deletions(-)

diff --git a/include/system/mshv.h b/include/system/mshv.h
index bbc42f4dc3..8b1fc20c80 100644
--- a/include/system/mshv.h
+++ b/include/system/mshv.h
@@ -18,6 +18,7 @@
 #include "qemu/accel.h"
 #include "hw/hyperv/hyperv-proto.h"
 #include "hw/hyperv/hvhdk.h"
+#include "hw/hyperv/hvgdk_mini.h"
 #include "qapi/qapi-types-common.h"
 #include "system/memory.h"
 #include "accel/accel-ops.h"
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index fb80f69772..731841af92 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -61,6 +61,8 @@ void mshv_remove_vcpu(int vm_fd, int cpu_fd);
 int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit);
 int mshv_load_regs(CPUState *cpu);
 int mshv_store_regs(CPUState *cpu);
+int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
+                          size_t n_regs);
 int mshv_arch_put_registers(const CPUState *cpu);
 void mshv_arch_init_vcpu(CPUState *cpu);
 void mshv_arch_destroy_vcpu(CPUState *cpu);
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 5069ab7a22..9ead03ca2d 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -32,12 +32,124 @@
 
 #include <sys/ioctl.h>
 
+static enum hv_register_name STANDARD_REGISTER_NAMES[18] = {
+    HV_X64_REGISTER_RAX,
+    HV_X64_REGISTER_RBX,
+    HV_X64_REGISTER_RCX,
+    HV_X64_REGISTER_RDX,
+    HV_X64_REGISTER_RSI,
+    HV_X64_REGISTER_RDI,
+    HV_X64_REGISTER_RSP,
+    HV_X64_REGISTER_RBP,
+    HV_X64_REGISTER_R8,
+    HV_X64_REGISTER_R9,
+    HV_X64_REGISTER_R10,
+    HV_X64_REGISTER_R11,
+    HV_X64_REGISTER_R12,
+    HV_X64_REGISTER_R13,
+    HV_X64_REGISTER_R14,
+    HV_X64_REGISTER_R15,
+    HV_X64_REGISTER_RIP,
+    HV_X64_REGISTER_RFLAGS,
+};
+
+int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
+                          size_t n_regs)
+{
+    int cpu_fd = mshv_vcpufd(cpu);
+    int vp_index = cpu->cpu_index;
+    size_t in_sz, assocs_sz;
+    hv_input_set_vp_registers *in;
+    struct mshv_root_hvcall args = {0};
+    int ret;
+
+    /* find out the size of the struct w/ a flexible array at the tail */
+    assocs_sz = n_regs * sizeof(hv_register_assoc);
+    in_sz = sizeof(hv_input_set_vp_registers) + assocs_sz;
+
+    /* fill the input struct */
+    in = g_malloc0(in_sz);
+    in->vp_index = vp_index;
+    memcpy(in->elements, assocs, assocs_sz);
+
+    /* create the hvcall envelope */
+    args.code = HVCALL_SET_VP_REGISTERS;
+    args.in_sz = in_sz;
+    args.in_ptr = (uint64_t) in;
+    args.reps = (uint16_t) n_regs;
+
+    /* perform the call */
+    ret = mshv_hvcall(cpu_fd, &args);
+    g_free(in);
+    if (ret < 0) {
+        error_report("Failed to set registers");
+        return -1;
+    }
+
+    /* assert we set all registers */
+    if (args.reps != n_regs) {
+        error_report("Failed to set registers: expected %zu elements"
+                     ", got %u", n_regs, args.reps);
+        return -1;
+    }
+
+    return 0;
+}
+
+static int set_standard_regs(const CPUState *cpu)
+{
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    hv_register_assoc assocs[ARRAY_SIZE(STANDARD_REGISTER_NAMES)];
+    int ret;
+    size_t n_regs = ARRAY_SIZE(STANDARD_REGISTER_NAMES);
+
+    /* set names */
+    for (size_t i = 0; i < ARRAY_SIZE(STANDARD_REGISTER_NAMES); i++) {
+        assocs[i].name = STANDARD_REGISTER_NAMES[i];
+    }
+    assocs[0].value.reg64 = env->regs[R_EAX];
+    assocs[1].value.reg64 = env->regs[R_EBX];
+    assocs[2].value.reg64 = env->regs[R_ECX];
+    assocs[3].value.reg64 = env->regs[R_EDX];
+    assocs[4].value.reg64 = env->regs[R_ESI];
+    assocs[5].value.reg64 = env->regs[R_EDI];
+    assocs[6].value.reg64 = env->regs[R_ESP];
+    assocs[7].value.reg64 = env->regs[R_EBP];
+    assocs[8].value.reg64 = env->regs[R_R8];
+    assocs[9].value.reg64 = env->regs[R_R9];
+    assocs[10].value.reg64 = env->regs[R_R10];
+    assocs[11].value.reg64 = env->regs[R_R11];
+    assocs[12].value.reg64 = env->regs[R_R12];
+    assocs[13].value.reg64 = env->regs[R_R13];
+    assocs[14].value.reg64 = env->regs[R_R14];
+    assocs[15].value.reg64 = env->regs[R_R15];
+    assocs[16].value.reg64 = env->eip;
+    lflags_to_rflags(env);
+    assocs[17].value.reg64 = env->eflags;
+
+    ret = mshv_set_generic_regs(cpu, assocs, n_regs);
+    if (ret < 0) {
+        error_report("failed to set standard registers");
+        return -errno;
+    }
+    return 0;
+}
+
 int mshv_store_regs(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    int ret;
+
+    ret = set_standard_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to store standard registers");
+        return -1;
+    }
+
+    return 0;
 }
 
+
 int mshv_load_regs(CPUState *cpu)
 {
     error_report("unimplemented");

From 66480a048a01fc833ba153410282609f26166141 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:34 +0200
Subject: [PATCH 1153/2396] target/i386/mshv: Implement
 mshv_get_standard_regs()

Fetch standard register state from MSHV vCPUs to support debugging,
migration, and other introspection features in QEMU.

Fetch standard register state from a MHSV vCPU's. A generic get_regs()
function and a mapper to map the different register representations are
introduced.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-15-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/mshv_int.h   |   1 +
 target/i386/mshv/mshv-cpu.c | 116 +++++++++++++++++++++++++++++++++++-
 2 files changed, 115 insertions(+), 2 deletions(-)

diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index 731841af92..b0a79296ad 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -58,6 +58,7 @@ typedef enum MshvVmExit {
 void mshv_init_mmio_emu(void);
 int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd);
 void mshv_remove_vcpu(int vm_fd, int cpu_fd);
+int mshv_get_standard_regs(CPUState *cpu);
 int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit);
 int mshv_load_regs(CPUState *cpu);
 int mshv_store_regs(CPUState *cpu);
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 9ead03ca2d..4e3eee113b 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -96,6 +96,66 @@ int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
     return 0;
 }
 
+static int get_generic_regs(CPUState *cpu, hv_register_assoc *assocs,
+                            size_t n_regs)
+{
+    int cpu_fd = mshv_vcpufd(cpu);
+    int vp_index = cpu->cpu_index;
+    hv_input_get_vp_registers *in;
+    hv_register_value *values;
+    size_t in_sz, names_sz, values_sz;
+    int i, ret;
+    struct mshv_root_hvcall args = {0};
+
+    /* find out the size of the struct w/ a flexible array at the tail */
+    names_sz = n_regs * sizeof(hv_register_name);
+    in_sz = sizeof(hv_input_get_vp_registers) + names_sz;
+
+    /* fill the input struct */
+    in = g_malloc0(in_sz);
+    in->vp_index = vp_index;
+    for (i = 0; i < n_regs; i++) {
+        in->names[i] = assocs[i].name;
+    }
+
+    /* allocate value output buffer */
+    values_sz = n_regs * sizeof(union hv_register_value);
+    values = g_malloc0(values_sz);
+
+    /* create the hvcall envelope */
+    args.code = HVCALL_GET_VP_REGISTERS;
+    args.in_sz = in_sz;
+    args.in_ptr = (uint64_t) in;
+    args.out_sz = values_sz;
+    args.out_ptr = (uint64_t) values;
+    args.reps = (uint16_t) n_regs;
+
+    /* perform the call */
+    ret = mshv_hvcall(cpu_fd, &args);
+    g_free(in);
+    if (ret < 0) {
+        g_free(values);
+        error_report("Failed to retrieve registers");
+        return -1;
+    }
+
+    /* assert we got all registers */
+    if (args.reps != n_regs) {
+        g_free(values);
+        error_report("Failed to retrieve registers: expected %zu elements"
+                     ", got %u", n_regs, args.reps);
+        return -1;
+    }
+
+    /* copy values into assoc */
+    for (i = 0; i < n_regs; i++) {
+        assocs[i].value = values[i];
+    }
+    g_free(values);
+
+    return 0;
+}
+
 static int set_standard_regs(const CPUState *cpu)
 {
     X86CPU *x86cpu = X86_CPU(cpu);
@@ -149,11 +209,63 @@ int mshv_store_regs(CPUState *cpu)
     return 0;
 }
 
+static void populate_standard_regs(const hv_register_assoc *assocs,
+                                   CPUX86State *env)
+{
+    env->regs[R_EAX] = assocs[0].value.reg64;
+    env->regs[R_EBX] = assocs[1].value.reg64;
+    env->regs[R_ECX] = assocs[2].value.reg64;
+    env->regs[R_EDX] = assocs[3].value.reg64;
+    env->regs[R_ESI] = assocs[4].value.reg64;
+    env->regs[R_EDI] = assocs[5].value.reg64;
+    env->regs[R_ESP] = assocs[6].value.reg64;
+    env->regs[R_EBP] = assocs[7].value.reg64;
+    env->regs[R_R8]  = assocs[8].value.reg64;
+    env->regs[R_R9]  = assocs[9].value.reg64;
+    env->regs[R_R10] = assocs[10].value.reg64;
+    env->regs[R_R11] = assocs[11].value.reg64;
+    env->regs[R_R12] = assocs[12].value.reg64;
+    env->regs[R_R13] = assocs[13].value.reg64;
+    env->regs[R_R14] = assocs[14].value.reg64;
+    env->regs[R_R15] = assocs[15].value.reg64;
+
+    env->eip = assocs[16].value.reg64;
+    env->eflags = assocs[17].value.reg64;
+    rflags_to_lflags(env);
+}
+
+int mshv_get_standard_regs(CPUState *cpu)
+{
+    struct hv_register_assoc assocs[ARRAY_SIZE(STANDARD_REGISTER_NAMES)];
+    int ret;
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    size_t n_regs = ARRAY_SIZE(STANDARD_REGISTER_NAMES);
+
+    for (size_t i = 0; i < n_regs; i++) {
+        assocs[i].name = STANDARD_REGISTER_NAMES[i];
+    }
+    ret = get_generic_regs(cpu, assocs, n_regs);
+    if (ret < 0) {
+        error_report("failed to get standard registers");
+        return -1;
+    }
+
+    populate_standard_regs(assocs, env);
+    return 0;
+}
 
 int mshv_load_regs(CPUState *cpu)
 {
-    error_report("unimplemented");
-    abort();
+    int ret;
+
+    ret = mshv_get_standard_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to load standard registers");
+        return -1;
+    }
+
+    return 0;
 }
 
 int mshv_arch_put_registers(const CPUState *cpu)

From 0382c2c8544da66619d16988caaab8e3d9e881d4 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:35 +0200
Subject: [PATCH 1154/2396] target/i386/mshv: Implement mshv_get_special_regs()

Retrieve special registers (e.g. segment, control, and descriptor
table registers) from MSHV vCPUs.

Various helper functions to map register state representations between
Qemu and MSHV are introduced.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-16-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/mshv_int.h   |   1 +
 target/i386/mshv/mshv-cpu.c | 104 ++++++++++++++++++++++++++++++++++++
 2 files changed, 105 insertions(+)

diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index b0a79296ad..c6e6e8af30 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -59,6 +59,7 @@ void mshv_init_mmio_emu(void);
 int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd);
 void mshv_remove_vcpu(int vm_fd, int cpu_fd);
 int mshv_get_standard_regs(CPUState *cpu);
+int mshv_get_special_regs(CPUState *cpu);
 int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit);
 int mshv_load_regs(CPUState *cpu);
 int mshv_store_regs(CPUState *cpu);
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 4e3eee113b..bc75686f82 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -53,6 +53,26 @@ static enum hv_register_name STANDARD_REGISTER_NAMES[18] = {
     HV_X64_REGISTER_RFLAGS,
 };
 
+static enum hv_register_name SPECIAL_REGISTER_NAMES[17] = {
+    HV_X64_REGISTER_CS,
+    HV_X64_REGISTER_DS,
+    HV_X64_REGISTER_ES,
+    HV_X64_REGISTER_FS,
+    HV_X64_REGISTER_GS,
+    HV_X64_REGISTER_SS,
+    HV_X64_REGISTER_TR,
+    HV_X64_REGISTER_LDTR,
+    HV_X64_REGISTER_GDTR,
+    HV_X64_REGISTER_IDTR,
+    HV_X64_REGISTER_CR0,
+    HV_X64_REGISTER_CR2,
+    HV_X64_REGISTER_CR3,
+    HV_X64_REGISTER_CR4,
+    HV_X64_REGISTER_CR8,
+    HV_X64_REGISTER_EFER,
+    HV_X64_REGISTER_APIC_BASE,
+};
+
 int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
                           size_t n_regs)
 {
@@ -255,6 +275,84 @@ int mshv_get_standard_regs(CPUState *cpu)
     return 0;
 }
 
+static inline void populate_segment_reg(const hv_x64_segment_register *hv_seg,
+                                        SegmentCache *seg)
+{
+    memset(seg, 0, sizeof(SegmentCache));
+
+    seg->base = hv_seg->base;
+    seg->limit = hv_seg->limit;
+    seg->selector = hv_seg->selector;
+
+    seg->flags = (hv_seg->segment_type << DESC_TYPE_SHIFT)
+                 | (hv_seg->present * DESC_P_MASK)
+                 | (hv_seg->descriptor_privilege_level << DESC_DPL_SHIFT)
+                 | (hv_seg->_default << DESC_B_SHIFT)
+                 | (hv_seg->non_system_segment * DESC_S_MASK)
+                 | (hv_seg->_long << DESC_L_SHIFT)
+                 | (hv_seg->granularity * DESC_G_MASK)
+                 | (hv_seg->available * DESC_AVL_MASK);
+
+}
+
+static inline void populate_table_reg(const hv_x64_table_register *hv_seg,
+                                      SegmentCache *tbl)
+{
+    memset(tbl, 0, sizeof(SegmentCache));
+
+    tbl->base = hv_seg->base;
+    tbl->limit = hv_seg->limit;
+}
+
+static void populate_special_regs(const hv_register_assoc *assocs,
+                                  X86CPU *x86cpu)
+{
+    CPUX86State *env = &x86cpu->env;
+
+    populate_segment_reg(&assocs[0].value.segment, &env->segs[R_CS]);
+    populate_segment_reg(&assocs[1].value.segment, &env->segs[R_DS]);
+    populate_segment_reg(&assocs[2].value.segment, &env->segs[R_ES]);
+    populate_segment_reg(&assocs[3].value.segment, &env->segs[R_FS]);
+    populate_segment_reg(&assocs[4].value.segment, &env->segs[R_GS]);
+    populate_segment_reg(&assocs[5].value.segment, &env->segs[R_SS]);
+
+    populate_segment_reg(&assocs[6].value.segment, &env->tr);
+    populate_segment_reg(&assocs[7].value.segment, &env->ldt);
+
+    populate_table_reg(&assocs[8].value.table, &env->gdt);
+    populate_table_reg(&assocs[9].value.table, &env->idt);
+
+    env->cr[0] = assocs[10].value.reg64;
+    env->cr[2] = assocs[11].value.reg64;
+    env->cr[3] = assocs[12].value.reg64;
+    env->cr[4] = assocs[13].value.reg64;
+
+    cpu_set_apic_tpr(x86cpu->apic_state, assocs[14].value.reg64);
+    env->efer = assocs[15].value.reg64;
+    cpu_set_apic_base(x86cpu->apic_state, assocs[16].value.reg64);
+}
+
+
+int mshv_get_special_regs(CPUState *cpu)
+{
+    struct hv_register_assoc assocs[ARRAY_SIZE(SPECIAL_REGISTER_NAMES)];
+    int ret;
+    X86CPU *x86cpu = X86_CPU(cpu);
+    size_t n_regs = ARRAY_SIZE(SPECIAL_REGISTER_NAMES);
+
+    for (size_t i = 0; i < n_regs; i++) {
+        assocs[i].name = SPECIAL_REGISTER_NAMES[i];
+    }
+    ret = get_generic_regs(cpu, assocs, n_regs);
+    if (ret < 0) {
+        error_report("failed to get special registers");
+        return -errno;
+    }
+
+    populate_special_regs(assocs, x86cpu);
+    return 0;
+}
+
 int mshv_load_regs(CPUState *cpu)
 {
     int ret;
@@ -265,6 +363,12 @@ int mshv_load_regs(CPUState *cpu)
         return -1;
     }
 
+    ret = mshv_get_special_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to load special registers");
+        return -1;
+    }
+
     return 0;
 }
 

From 25a1d871e0f19bbf8fee471af5fefec52465bb09 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:36 +0200
Subject: [PATCH 1155/2396] target/i386/mshv: Implement
 mshv_arch_put_registers()

Write CPU register state to MSHV vCPUs. Various mapping functions to
prepare the payload for the HV call have been implemented.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-17-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/mshv_int.h   |  15 +++
 target/i386/mshv/mshv-cpu.c | 237 ++++++++++++++++++++++++++++++++++++
 2 files changed, 252 insertions(+)

diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index c6e6e8af30..0ea8d504fa 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -49,6 +49,20 @@ typedef struct MshvMsiControl {
 #define mshv_vcpufd(cpu) (cpu->accel->cpufd)
 
 /* cpu */
+typedef struct MshvFPU {
+    uint8_t fpr[8][16];
+    uint16_t fcw;
+    uint16_t fsw;
+    uint8_t ftwx;
+    uint8_t pad1;
+    uint16_t last_opcode;
+    uint64_t last_ip;
+    uint64_t last_dp;
+    uint8_t xmm[16][16];
+    uint32_t mxcsr;
+    uint32_t pad2;
+} MshvFPU;
+
 typedef enum MshvVmExit {
     MshvVmExitIgnore   = 0,
     MshvVmExitShutdown = 1,
@@ -58,6 +72,7 @@ typedef enum MshvVmExit {
 void mshv_init_mmio_emu(void);
 int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd);
 void mshv_remove_vcpu(int vm_fd, int cpu_fd);
+int mshv_configure_vcpu(const CPUState *cpu, const MshvFPU *fpu, uint64_t xcr0);
 int mshv_get_standard_regs(CPUState *cpu);
 int mshv_get_special_regs(CPUState *cpu);
 int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit);
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index bc75686f82..8b10c79e54 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -73,6 +73,35 @@ static enum hv_register_name SPECIAL_REGISTER_NAMES[17] = {
     HV_X64_REGISTER_APIC_BASE,
 };
 
+static enum hv_register_name FPU_REGISTER_NAMES[26] = {
+    HV_X64_REGISTER_XMM0,
+    HV_X64_REGISTER_XMM1,
+    HV_X64_REGISTER_XMM2,
+    HV_X64_REGISTER_XMM3,
+    HV_X64_REGISTER_XMM4,
+    HV_X64_REGISTER_XMM5,
+    HV_X64_REGISTER_XMM6,
+    HV_X64_REGISTER_XMM7,
+    HV_X64_REGISTER_XMM8,
+    HV_X64_REGISTER_XMM9,
+    HV_X64_REGISTER_XMM10,
+    HV_X64_REGISTER_XMM11,
+    HV_X64_REGISTER_XMM12,
+    HV_X64_REGISTER_XMM13,
+    HV_X64_REGISTER_XMM14,
+    HV_X64_REGISTER_XMM15,
+    HV_X64_REGISTER_FP_MMX0,
+    HV_X64_REGISTER_FP_MMX1,
+    HV_X64_REGISTER_FP_MMX2,
+    HV_X64_REGISTER_FP_MMX3,
+    HV_X64_REGISTER_FP_MMX4,
+    HV_X64_REGISTER_FP_MMX5,
+    HV_X64_REGISTER_FP_MMX6,
+    HV_X64_REGISTER_FP_MMX7,
+    HV_X64_REGISTER_FP_CONTROL_STATUS,
+    HV_X64_REGISTER_XMM_CONTROL_STATUS,
+};
+
 int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
                           size_t n_regs)
 {
@@ -372,8 +401,216 @@ int mshv_load_regs(CPUState *cpu)
     return 0;
 }
 
+static inline void populate_hv_segment_reg(SegmentCache *seg,
+                                           hv_x64_segment_register *hv_reg)
+{
+    uint32_t flags = seg->flags;
+
+    hv_reg->base = seg->base;
+    hv_reg->limit = seg->limit;
+    hv_reg->selector = seg->selector;
+    hv_reg->segment_type = (flags >> DESC_TYPE_SHIFT) & 0xF;
+    hv_reg->non_system_segment = (flags & DESC_S_MASK) != 0;
+    hv_reg->descriptor_privilege_level = (flags >> DESC_DPL_SHIFT) & 0x3;
+    hv_reg->present = (flags & DESC_P_MASK) != 0;
+    hv_reg->reserved = 0;
+    hv_reg->available = (flags & DESC_AVL_MASK) != 0;
+    hv_reg->_long = (flags >> DESC_L_SHIFT) & 0x1;
+    hv_reg->_default = (flags >> DESC_B_SHIFT) & 0x1;
+    hv_reg->granularity = (flags & DESC_G_MASK) != 0;
+}
+
+static inline void populate_hv_table_reg(const struct SegmentCache *seg,
+                                         hv_x64_table_register *hv_reg)
+{
+    memset(hv_reg, 0, sizeof(*hv_reg));
+
+    hv_reg->base = seg->base;
+    hv_reg->limit = seg->limit;
+}
+
+static int set_special_regs(const CPUState *cpu)
+{
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    struct hv_register_assoc assocs[ARRAY_SIZE(SPECIAL_REGISTER_NAMES)];
+    size_t n_regs = ARRAY_SIZE(SPECIAL_REGISTER_NAMES);
+    int ret;
+
+    /* set names */
+    for (size_t i = 0; i < n_regs; i++) {
+        assocs[i].name = SPECIAL_REGISTER_NAMES[i];
+    }
+    populate_hv_segment_reg(&env->segs[R_CS], &assocs[0].value.segment);
+    populate_hv_segment_reg(&env->segs[R_DS], &assocs[1].value.segment);
+    populate_hv_segment_reg(&env->segs[R_ES], &assocs[2].value.segment);
+    populate_hv_segment_reg(&env->segs[R_FS], &assocs[3].value.segment);
+    populate_hv_segment_reg(&env->segs[R_GS], &assocs[4].value.segment);
+    populate_hv_segment_reg(&env->segs[R_SS], &assocs[5].value.segment);
+    populate_hv_segment_reg(&env->tr, &assocs[6].value.segment);
+    populate_hv_segment_reg(&env->ldt, &assocs[7].value.segment);
+
+    populate_hv_table_reg(&env->gdt, &assocs[8].value.table);
+    populate_hv_table_reg(&env->idt, &assocs[9].value.table);
+
+    assocs[10].value.reg64 = env->cr[0];
+    assocs[11].value.reg64 = env->cr[2];
+    assocs[12].value.reg64 = env->cr[3];
+    assocs[13].value.reg64 = env->cr[4];
+    assocs[14].value.reg64 = cpu_get_apic_tpr(x86cpu->apic_state);
+    assocs[15].value.reg64 = env->efer;
+    assocs[16].value.reg64 = cpu_get_apic_base(x86cpu->apic_state);
+
+    ret = mshv_set_generic_regs(cpu, assocs, n_regs);
+    if (ret < 0) {
+        error_report("failed to set special registers");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int set_fpu(const CPUState *cpu, const struct MshvFPU *regs)
+{
+    struct hv_register_assoc assocs[ARRAY_SIZE(FPU_REGISTER_NAMES)];
+    union hv_register_value *value;
+    size_t fp_i;
+    union hv_x64_fp_control_status_register *ctrl_status;
+    union hv_x64_xmm_control_status_register *xmm_ctrl_status;
+    int ret;
+    size_t n_regs = ARRAY_SIZE(FPU_REGISTER_NAMES);
+
+    /* first 16 registers are xmm0-xmm15 */
+    for (size_t i = 0; i < 16; i++) {
+        assocs[i].name = FPU_REGISTER_NAMES[i];
+        value = &assocs[i].value;
+        memcpy(&value->reg128, &regs->xmm[i], 16);
+    }
+
+    /* next 8 registers are fp_mmx0-fp_mmx7 */
+    for (size_t i = 16; i < 24; i++) {
+        assocs[i].name = FPU_REGISTER_NAMES[i];
+        fp_i = (i - 16);
+        value = &assocs[i].value;
+        memcpy(&value->reg128, &regs->fpr[fp_i], 16);
+    }
+
+    /* last two registers are fp_control_status and xmm_control_status */
+    assocs[24].name = FPU_REGISTER_NAMES[24];
+    value = &assocs[24].value;
+    ctrl_status = &value->fp_control_status;
+    ctrl_status->fp_control = regs->fcw;
+    ctrl_status->fp_status = regs->fsw;
+    ctrl_status->fp_tag = regs->ftwx;
+    ctrl_status->reserved = 0;
+    ctrl_status->last_fp_op = regs->last_opcode;
+    ctrl_status->last_fp_rip = regs->last_ip;
+
+    assocs[25].name = FPU_REGISTER_NAMES[25];
+    value = &assocs[25].value;
+    xmm_ctrl_status = &value->xmm_control_status;
+    xmm_ctrl_status->xmm_status_control = regs->mxcsr;
+    xmm_ctrl_status->xmm_status_control_mask = 0;
+    xmm_ctrl_status->last_fp_rdp = regs->last_dp;
+
+    ret = mshv_set_generic_regs(cpu, assocs, n_regs);
+    if (ret < 0) {
+        error_report("failed to set fpu registers");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int set_xc_reg(const CPUState *cpu, uint64_t xcr0)
+{
+    int ret;
+    struct hv_register_assoc assoc = {
+        .name = HV_X64_REGISTER_XFEM,
+        .value.reg64 = xcr0,
+    };
+
+    ret = mshv_set_generic_regs(cpu, &assoc, 1);
+    if (ret < 0) {
+        error_report("failed to set xcr0");
+        return -errno;
+    }
+    return 0;
+}
+
+static int set_cpu_state(const CPUState *cpu, const MshvFPU *fpu_regs,
+                         uint64_t xcr0)
+{
+    int ret;
+
+    ret = set_standard_regs(cpu);
+    if (ret < 0) {
+        return ret;
+    }
+    ret = set_special_regs(cpu);
+    if (ret < 0) {
+        return ret;
+    }
+    ret = set_fpu(cpu, fpu_regs);
+    if (ret < 0) {
+        return ret;
+    }
+    ret = set_xc_reg(cpu, xcr0);
+    if (ret < 0) {
+        return ret;
+    }
+    return 0;
+}
+
+/*
+ * TODO: populate topology info:
+ *
+ * X86CPU *x86cpu = X86_CPU(cpu);
+ * CPUX86State *env = &x86cpu->env;
+ * X86CPUTopoInfo *topo_info = &env->topo_info;
+ */
+int mshv_configure_vcpu(const CPUState *cpu, const struct MshvFPU *fpu,
+                        uint64_t xcr0)
+{
+    int ret;
+
+    ret = set_cpu_state(cpu, fpu, xcr0);
+    if (ret < 0) {
+        error_report("failed to set cpu state");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int put_regs(const CPUState *cpu)
+{
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    MshvFPU fpu = {0};
+    int ret;
+
+    memset(&fpu, 0, sizeof(fpu));
+
+    ret = mshv_configure_vcpu(cpu, &fpu, env->xcr0);
+    if (ret < 0) {
+        error_report("failed to configure vcpu");
+        return ret;
+    }
+
+    return 0;
+}
+
 int mshv_arch_put_registers(const CPUState *cpu)
 {
+    int ret;
+
+    ret = put_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to put registers");
+        return -1;
+    }
+
     error_report("unimplemented");
     abort();
 }

From ca20d46fa94887a6e42061646a71ee44cbc9adb0 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:37 +0200
Subject: [PATCH 1156/2396] target/i386/mshv: Set local interrupt controller
 state

To set the local interrupt controller state, perform hv calls retrieving
partition state from the hypervisor.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-18-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 117 ++++++++++++++++++++++++++++++++++++
 1 file changed, 117 insertions(+)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 8b10c79e54..0fe3cbb48d 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -12,6 +12,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
+#include "qemu/memalign.h"
 #include "qemu/typedefs.h"
 
 #include "system/mshv.h"
@@ -21,6 +22,7 @@
 #include "hw/hyperv/hvgdk.h"
 #include "hw/hyperv/hvgdk_mini.h"
 #include "hw/hyperv/hvhdk_mini.h"
+#include "hw/i386/apic_internal.h"
 
 #include "cpu.h"
 #include "emulate/x86_decode.h"
@@ -562,6 +564,114 @@ static int set_cpu_state(const CPUState *cpu, const MshvFPU *fpu_regs,
     return 0;
 }
 
+static int get_vp_state(int cpu_fd, struct mshv_get_set_vp_state *state)
+{
+    int ret;
+
+    ret = ioctl(cpu_fd, MSHV_GET_VP_STATE, state);
+    if (ret < 0) {
+        error_report("failed to get partition state: %s", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int get_lapic(int cpu_fd,
+                     struct hv_local_interrupt_controller_state *state)
+{
+    int ret;
+    size_t size = 4096;
+    /* buffer aligned to 4k, as *state requires that */
+    void *buffer = qemu_memalign(size, size);
+    struct mshv_get_set_vp_state mshv_state = { 0 };
+
+    mshv_state.buf_ptr = (uint64_t) buffer;
+    mshv_state.buf_sz = size;
+    mshv_state.type = MSHV_VP_STATE_LAPIC;
+
+    ret = get_vp_state(cpu_fd, &mshv_state);
+    if (ret == 0) {
+        memcpy(state, buffer, sizeof(*state));
+    }
+    qemu_vfree(buffer);
+    if (ret < 0) {
+        error_report("failed to get lapic");
+        return -1;
+    }
+
+    return 0;
+}
+
+static uint32_t set_apic_delivery_mode(uint32_t reg, uint32_t mode)
+{
+    return ((reg) & ~0x700) | ((mode) << 8);
+}
+
+static int set_vp_state(int cpu_fd, const struct mshv_get_set_vp_state *state)
+{
+    int ret;
+
+    ret = ioctl(cpu_fd, MSHV_SET_VP_STATE, state);
+    if (ret < 0) {
+        error_report("failed to set partition state: %s", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int set_lapic(int cpu_fd,
+                     const struct hv_local_interrupt_controller_state *state)
+{
+    int ret;
+    size_t size = 4096;
+    /* buffer aligned to 4k, as *state requires that */
+    void *buffer = qemu_memalign(size, size);
+    struct mshv_get_set_vp_state mshv_state = { 0 };
+
+    if (!state) {
+        error_report("lapic state is NULL");
+        return -1;
+    }
+    memcpy(buffer, state, sizeof(*state));
+
+    mshv_state.buf_ptr = (uint64_t) buffer;
+    mshv_state.buf_sz = size;
+    mshv_state.type = MSHV_VP_STATE_LAPIC;
+
+    ret = set_vp_state(cpu_fd, &mshv_state);
+    qemu_vfree(buffer);
+    if (ret < 0) {
+        error_report("failed to set lapic: %s", strerror(errno));
+        return -1;
+    }
+
+    return 0;
+}
+
+static int set_lint(int cpu_fd)
+{
+    int ret;
+    uint32_t *lvt_lint0, *lvt_lint1;
+
+    struct hv_local_interrupt_controller_state lapic_state = { 0 };
+    ret = get_lapic(cpu_fd, &lapic_state);
+    if (ret < 0) {
+        return ret;
+    }
+
+    lvt_lint0 = &lapic_state.apic_lvt_lint0;
+    *lvt_lint0 = set_apic_delivery_mode(*lvt_lint0, APIC_DM_EXTINT);
+
+    lvt_lint1 = &lapic_state.apic_lvt_lint1;
+    *lvt_lint1 = set_apic_delivery_mode(*lvt_lint1, APIC_DM_NMI);
+
+    /* TODO: should we skip setting lapic if the values are the same? */
+
+    return set_lapic(cpu_fd, &lapic_state);
+}
+
 /*
  * TODO: populate topology info:
  *
@@ -573,6 +683,7 @@ int mshv_configure_vcpu(const CPUState *cpu, const struct MshvFPU *fpu,
                         uint64_t xcr0)
 {
     int ret;
+    int cpu_fd = mshv_vcpufd(cpu);
 
     ret = set_cpu_state(cpu, fpu, xcr0);
     if (ret < 0) {
@@ -580,6 +691,12 @@ int mshv_configure_vcpu(const CPUState *cpu, const struct MshvFPU *fpu,
         return -1;
     }
 
+    ret = set_lint(cpu_fd);
+    if (ret < 0) {
+        error_report("failed to set lpic int");
+        return -1;
+    }
+
     return 0;
 }
 

From 4fa04dd16216e266564606b7da582e5fce07bced Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:38 +0200
Subject: [PATCH 1157/2396] target/i386/mshv: Register CPUID entries with MSHV

Convert the guest CPU's CPUID model into MSHV's format and register it
with the hypervisor. This ensures that the guest observes the correct
CPU feature set during CPUID instructions.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-19-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 206 ++++++++++++++++++++++++++++++++++++
 1 file changed, 206 insertions(+)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 0fe3cbb48d..2b7a81274b 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -403,6 +403,206 @@ int mshv_load_regs(CPUState *cpu)
     return 0;
 }
 
+static void add_cpuid_entry(GList *cpuid_entries,
+                            uint32_t function, uint32_t index,
+                            uint32_t eax, uint32_t ebx,
+                            uint32_t ecx, uint32_t edx)
+{
+    struct hv_cpuid_entry *entry;
+
+    entry = g_malloc0(sizeof(struct hv_cpuid_entry));
+    entry->function = function;
+    entry->index = index;
+    entry->eax = eax;
+    entry->ebx = ebx;
+    entry->ecx = ecx;
+    entry->edx = edx;
+
+    cpuid_entries = g_list_append(cpuid_entries, entry);
+}
+
+static void collect_cpuid_entries(const CPUState *cpu, GList *cpuid_entries)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    uint32_t eax, ebx, ecx, edx;
+    uint32_t leaf, subleaf;
+    size_t max_leaf = 0x1F;
+    size_t max_subleaf = 0x20;
+
+    uint32_t leaves_with_subleaves[] = {0x4, 0x7, 0xD, 0xF, 0x10};
+    int n_subleaf_leaves = ARRAY_SIZE(leaves_with_subleaves);
+
+    /* Regular leaves without subleaves */
+    for (leaf = 0; leaf <= max_leaf; leaf++) {
+        bool has_subleaves = false;
+        for (int i = 0; i < n_subleaf_leaves; i++) {
+            if (leaf == leaves_with_subleaves[i]) {
+                has_subleaves = true;
+                break;
+            }
+        }
+
+        if (!has_subleaves) {
+            cpu_x86_cpuid(env, leaf, 0, &eax, &ebx, &ecx, &edx);
+            if (eax == 0 && ebx == 0 && ecx == 0 && edx == 0) {
+                /* all zeroes indicates no more leaves */
+                continue;
+            }
+
+            add_cpuid_entry(cpuid_entries, leaf, 0, eax, ebx, ecx, edx);
+            continue;
+        }
+
+        subleaf = 0;
+        while (subleaf < max_subleaf) {
+            cpu_x86_cpuid(env, leaf, subleaf, &eax, &ebx, &ecx, &edx);
+
+            if (eax == 0 && ebx == 0 && ecx == 0 && edx == 0) {
+                /* all zeroes indicates no more leaves */
+                break;
+            }
+            add_cpuid_entry(cpuid_entries, leaf, 0, eax, ebx, ecx, edx);
+            subleaf++;
+        }
+    }
+}
+
+static int register_intercept_result_cpuid_entry(const CPUState *cpu,
+                                                 uint8_t subleaf_specific,
+                                                 uint8_t always_override,
+                                                 struct hv_cpuid_entry *entry)
+{
+    int ret;
+    int vp_index = cpu->cpu_index;
+    int cpu_fd = mshv_vcpufd(cpu);
+
+    struct hv_register_x64_cpuid_result_parameters cpuid_params = {
+        .input.eax = entry->function,
+        .input.ecx = entry->index,
+        .input.subleaf_specific = subleaf_specific,
+        .input.always_override = always_override,
+        .input.padding = 0,
+        /*
+         * With regard to masks - these are to specify bits to be overwritten
+         * The current CpuidEntry structure wouldn't allow to carry the masks
+         * in addition to the actual register values. For this reason, the
+         * masks are set to the exact values of the corresponding register bits
+         * to be registered for an overwrite. To view resulting values the
+         * hypervisor would return, HvCallGetVpCpuidValues hypercall can be
+         * used.
+         */
+        .result.eax = entry->eax,
+        .result.eax_mask = entry->eax,
+        .result.ebx = entry->ebx,
+        .result.ebx_mask = entry->ebx,
+        .result.ecx = entry->ecx,
+        .result.ecx_mask = entry->ecx,
+        .result.edx = entry->edx,
+        .result.edx_mask = entry->edx,
+    };
+    union hv_register_intercept_result_parameters parameters = {
+        .cpuid = cpuid_params,
+    };
+
+    hv_input_register_intercept_result in = {0};
+    in.vp_index = vp_index;
+    in.intercept_type = HV_INTERCEPT_TYPE_X64_CPUID;
+    in.parameters = parameters;
+
+    struct mshv_root_hvcall args = {0};
+    args.code   = HVCALL_REGISTER_INTERCEPT_RESULT;
+    args.in_sz  = sizeof(in);
+    args.in_ptr = (uint64_t)&in;
+
+    ret = mshv_hvcall(cpu_fd, &args);
+    if (ret < 0) {
+        error_report("failed to register intercept result for cpuid");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int register_intercept_result_cpuid(const CPUState *cpu,
+                                           struct hv_cpuid *cpuid)
+{
+    int ret = 0, entry_ret;
+    struct hv_cpuid_entry *entry;
+    uint8_t subleaf_specific, always_override;
+
+    for (size_t i = 0; i < cpuid->nent; i++) {
+        entry = &cpuid->entries[i];
+
+        /* set defaults */
+        subleaf_specific = 0;
+        always_override = 1;
+
+        /* Intel */
+        /* 0xb - Extended Topology Enumeration Leaf */
+        /* 0x1f - V2 Extended Topology Enumeration Leaf */
+        /* AMD */
+        /* 0x8000_001e - Processor Topology Information */
+        /* 0x8000_0026 - Extended CPU Topology */
+        if (entry->function == 0xb
+            || entry->function == 0x1f
+            || entry->function == 0x8000001e
+            || entry->function == 0x80000026) {
+            subleaf_specific = 1;
+            always_override = 1;
+        } else if (entry->function == 0x00000001
+            || entry->function == 0x80000000
+            || entry->function == 0x80000001
+            || entry->function == 0x80000008) {
+            subleaf_specific = 0;
+            always_override = 1;
+        }
+
+        entry_ret = register_intercept_result_cpuid_entry(cpu, subleaf_specific,
+                                                          always_override,
+                                                          entry);
+        if ((entry_ret < 0) && (ret == 0)) {
+            ret = entry_ret;
+        }
+    }
+
+    return ret;
+}
+
+static int set_cpuid2(const CPUState *cpu)
+{
+    int ret;
+    size_t n_entries, cpuid_size;
+    struct hv_cpuid *cpuid;
+    struct hv_cpuid_entry *entry;
+    GList *entries = NULL;
+
+    collect_cpuid_entries(cpu, entries);
+    n_entries = g_list_length(entries);
+
+    cpuid_size = sizeof(struct hv_cpuid)
+        + n_entries * sizeof(struct hv_cpuid_entry);
+
+    cpuid = g_malloc0(cpuid_size);
+    cpuid->nent = n_entries;
+    cpuid->padding = 0;
+
+    for (size_t i = 0; i < n_entries; i++) {
+        entry = g_list_nth_data(entries, i);
+        cpuid->entries[i] = *entry;
+        g_free(entry);
+    }
+    g_list_free(entries);
+
+    ret = register_intercept_result_cpuid(cpu, cpuid);
+    g_free(cpuid);
+    if (ret < 0) {
+        return ret;
+    }
+
+    return 0;
+}
+
 static inline void populate_hv_segment_reg(SegmentCache *seg,
                                            hv_x64_segment_register *hv_reg)
 {
@@ -685,6 +885,12 @@ int mshv_configure_vcpu(const CPUState *cpu, const struct MshvFPU *fpu,
     int ret;
     int cpu_fd = mshv_vcpufd(cpu);
 
+    ret = set_cpuid2(cpu);
+    if (ret < 0) {
+        error_report("failed to set cpuid");
+        return -1;
+    }
+
     ret = set_cpu_state(cpu, fpu, xcr0);
     if (ret < 0) {
         error_report("failed to set cpu state");

From f38e2a63e541730e114f6ed09e5f8719e388c8db Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Thu, 2 Oct 2025 18:19:22 +0200
Subject: [PATCH 1158/2396] target/i386/mshv: Register MSRs with MSHV

Build and register the guest vCPU's model-specific registers using
the MSHV interface.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-20-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/meson.build      |   1 +
 accel/mshv/msr.c            | 375 ++++++++++++++++++++++++++++++++++++
 include/system/mshv_int.h   |  17 ++
 target/i386/cpu.h           |   2 +
 target/i386/mshv/mshv-cpu.c |  33 ++++
 5 files changed, 428 insertions(+)
 create mode 100644 accel/mshv/msr.c

diff --git a/accel/mshv/meson.build b/accel/mshv/meson.build
index f88fc8678c..d3a2b32581 100644
--- a/accel/mshv/meson.build
+++ b/accel/mshv/meson.build
@@ -2,6 +2,7 @@ mshv_ss = ss.source_set()
 mshv_ss.add(if_true: files(
   'irq.c',
   'mem.c',
+  'msr.c',
   'mshv-all.c'
 ))
 
diff --git a/accel/mshv/msr.c b/accel/mshv/msr.c
new file mode 100644
index 0000000000..e6e5baef50
--- /dev/null
+++ b/accel/mshv/msr.c
@@ -0,0 +1,375 @@
+/*
+ * QEMU MSHV support
+ *
+ * Copyright Microsoft, Corp. 2025
+ *
+ * Authors: Magnus Kulke  <magnuskulke@microsoft.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "system/mshv.h"
+#include "system/mshv_int.h"
+#include "hw/hyperv/hvgdk_mini.h"
+#include "linux/mshv.h"
+#include "qemu/error-report.h"
+
+static uint32_t supported_msrs[64] = {
+    IA32_MSR_TSC,
+    IA32_MSR_EFER,
+    IA32_MSR_KERNEL_GS_BASE,
+    IA32_MSR_APIC_BASE,
+    IA32_MSR_PAT,
+    IA32_MSR_SYSENTER_CS,
+    IA32_MSR_SYSENTER_ESP,
+    IA32_MSR_SYSENTER_EIP,
+    IA32_MSR_STAR,
+    IA32_MSR_LSTAR,
+    IA32_MSR_CSTAR,
+    IA32_MSR_SFMASK,
+    IA32_MSR_MTRR_DEF_TYPE,
+    IA32_MSR_MTRR_PHYSBASE0,
+    IA32_MSR_MTRR_PHYSMASK0,
+    IA32_MSR_MTRR_PHYSBASE1,
+    IA32_MSR_MTRR_PHYSMASK1,
+    IA32_MSR_MTRR_PHYSBASE2,
+    IA32_MSR_MTRR_PHYSMASK2,
+    IA32_MSR_MTRR_PHYSBASE3,
+    IA32_MSR_MTRR_PHYSMASK3,
+    IA32_MSR_MTRR_PHYSBASE4,
+    IA32_MSR_MTRR_PHYSMASK4,
+    IA32_MSR_MTRR_PHYSBASE5,
+    IA32_MSR_MTRR_PHYSMASK5,
+    IA32_MSR_MTRR_PHYSBASE6,
+    IA32_MSR_MTRR_PHYSMASK6,
+    IA32_MSR_MTRR_PHYSBASE7,
+    IA32_MSR_MTRR_PHYSMASK7,
+    IA32_MSR_MTRR_FIX64K_00000,
+    IA32_MSR_MTRR_FIX16K_80000,
+    IA32_MSR_MTRR_FIX16K_A0000,
+    IA32_MSR_MTRR_FIX4K_C0000,
+    IA32_MSR_MTRR_FIX4K_C8000,
+    IA32_MSR_MTRR_FIX4K_D0000,
+    IA32_MSR_MTRR_FIX4K_D8000,
+    IA32_MSR_MTRR_FIX4K_E0000,
+    IA32_MSR_MTRR_FIX4K_E8000,
+    IA32_MSR_MTRR_FIX4K_F0000,
+    IA32_MSR_MTRR_FIX4K_F8000,
+    IA32_MSR_TSC_AUX,
+    IA32_MSR_DEBUG_CTL,
+    HV_X64_MSR_GUEST_OS_ID,
+    HV_X64_MSR_SINT0,
+    HV_X64_MSR_SINT1,
+    HV_X64_MSR_SINT2,
+    HV_X64_MSR_SINT3,
+    HV_X64_MSR_SINT4,
+    HV_X64_MSR_SINT5,
+    HV_X64_MSR_SINT6,
+    HV_X64_MSR_SINT7,
+    HV_X64_MSR_SINT8,
+    HV_X64_MSR_SINT9,
+    HV_X64_MSR_SINT10,
+    HV_X64_MSR_SINT11,
+    HV_X64_MSR_SINT12,
+    HV_X64_MSR_SINT13,
+    HV_X64_MSR_SINT14,
+    HV_X64_MSR_SINT15,
+    HV_X64_MSR_SCONTROL,
+    HV_X64_MSR_SIEFP,
+    HV_X64_MSR_SIMP,
+    HV_X64_MSR_REFERENCE_TSC,
+    HV_X64_MSR_EOM,
+};
+static const size_t msr_count = ARRAY_SIZE(supported_msrs);
+
+static int compare_msr_index(const void *a, const void *b)
+{
+    return *(uint32_t *)a - *(uint32_t *)b;
+}
+
+__attribute__((constructor))
+static void init_sorted_msr_map(void)
+{
+    qsort(supported_msrs, msr_count, sizeof(uint32_t), compare_msr_index);
+}
+
+static int mshv_is_supported_msr(uint32_t msr)
+{
+    return bsearch(&msr, supported_msrs, msr_count, sizeof(uint32_t),
+                   compare_msr_index) != NULL;
+}
+
+static int mshv_msr_to_hv_reg_name(uint32_t msr, uint32_t *hv_reg)
+{
+    switch (msr) {
+    case IA32_MSR_TSC:
+        *hv_reg = HV_X64_REGISTER_TSC;
+        return 0;
+    case IA32_MSR_EFER:
+        *hv_reg = HV_X64_REGISTER_EFER;
+        return 0;
+    case IA32_MSR_KERNEL_GS_BASE:
+        *hv_reg = HV_X64_REGISTER_KERNEL_GS_BASE;
+        return 0;
+    case IA32_MSR_APIC_BASE:
+        *hv_reg = HV_X64_REGISTER_APIC_BASE;
+        return 0;
+    case IA32_MSR_PAT:
+        *hv_reg = HV_X64_REGISTER_PAT;
+        return 0;
+    case IA32_MSR_SYSENTER_CS:
+        *hv_reg = HV_X64_REGISTER_SYSENTER_CS;
+        return 0;
+    case IA32_MSR_SYSENTER_ESP:
+        *hv_reg = HV_X64_REGISTER_SYSENTER_ESP;
+        return 0;
+    case IA32_MSR_SYSENTER_EIP:
+        *hv_reg = HV_X64_REGISTER_SYSENTER_EIP;
+        return 0;
+    case IA32_MSR_STAR:
+        *hv_reg = HV_X64_REGISTER_STAR;
+        return 0;
+    case IA32_MSR_LSTAR:
+        *hv_reg = HV_X64_REGISTER_LSTAR;
+        return 0;
+    case IA32_MSR_CSTAR:
+        *hv_reg = HV_X64_REGISTER_CSTAR;
+        return 0;
+    case IA32_MSR_SFMASK:
+        *hv_reg = HV_X64_REGISTER_SFMASK;
+        return 0;
+    case IA32_MSR_MTRR_CAP:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_CAP;
+        return 0;
+    case IA32_MSR_MTRR_DEF_TYPE:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_DEF_TYPE;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE0:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE0;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK0:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK0;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE1:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE1;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK1:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK1;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE2:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE2;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK2:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK2;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE3:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE3;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK3:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK3;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE4:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE4;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK4:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK4;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE5:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE5;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK5:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK5;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE6:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE6;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK6:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK6;
+        return 0;
+    case IA32_MSR_MTRR_PHYSBASE7:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_BASE7;
+        return 0;
+    case IA32_MSR_MTRR_PHYSMASK7:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_PHYS_MASK7;
+        return 0;
+    case IA32_MSR_MTRR_FIX64K_00000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX64K00000;
+        return 0;
+    case IA32_MSR_MTRR_FIX16K_80000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX16K80000;
+        return 0;
+    case IA32_MSR_MTRR_FIX16K_A0000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX16KA0000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_C0000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KC0000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_C8000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KC8000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_D0000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KD0000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_D8000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KD8000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_E0000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KE0000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_E8000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KE8000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_F0000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KF0000;
+        return 0;
+    case IA32_MSR_MTRR_FIX4K_F8000:
+        *hv_reg = HV_X64_REGISTER_MSR_MTRR_FIX4KF8000;
+        return 0;
+    case IA32_MSR_TSC_AUX:
+        *hv_reg = HV_X64_REGISTER_TSC_AUX;
+        return 0;
+    case IA32_MSR_BNDCFGS:
+        *hv_reg = HV_X64_REGISTER_BNDCFGS;
+        return 0;
+    case IA32_MSR_DEBUG_CTL:
+        *hv_reg = HV_X64_REGISTER_DEBUG_CTL;
+        return 0;
+    case IA32_MSR_TSC_ADJUST:
+        *hv_reg = HV_X64_REGISTER_TSC_ADJUST;
+        return 0;
+    case IA32_MSR_SPEC_CTRL:
+        *hv_reg = HV_X64_REGISTER_SPEC_CTRL;
+        return 0;
+    case HV_X64_MSR_GUEST_OS_ID:
+        *hv_reg = HV_REGISTER_GUEST_OS_ID;
+        return 0;
+    case HV_X64_MSR_SINT0:
+        *hv_reg = HV_REGISTER_SINT0;
+        return 0;
+    case HV_X64_MSR_SINT1:
+        *hv_reg = HV_REGISTER_SINT1;
+        return 0;
+    case HV_X64_MSR_SINT2:
+        *hv_reg = HV_REGISTER_SINT2;
+        return 0;
+    case HV_X64_MSR_SINT3:
+        *hv_reg = HV_REGISTER_SINT3;
+        return 0;
+    case HV_X64_MSR_SINT4:
+        *hv_reg = HV_REGISTER_SINT4;
+        return 0;
+    case HV_X64_MSR_SINT5:
+        *hv_reg = HV_REGISTER_SINT5;
+        return 0;
+    case HV_X64_MSR_SINT6:
+        *hv_reg = HV_REGISTER_SINT6;
+        return 0;
+    case HV_X64_MSR_SINT7:
+        *hv_reg = HV_REGISTER_SINT7;
+        return 0;
+    case HV_X64_MSR_SINT8:
+        *hv_reg = HV_REGISTER_SINT8;
+        return 0;
+    case HV_X64_MSR_SINT9:
+        *hv_reg = HV_REGISTER_SINT9;
+        return 0;
+    case HV_X64_MSR_SINT10:
+        *hv_reg = HV_REGISTER_SINT10;
+        return 0;
+    case HV_X64_MSR_SINT11:
+        *hv_reg = HV_REGISTER_SINT11;
+        return 0;
+    case HV_X64_MSR_SINT12:
+        *hv_reg = HV_REGISTER_SINT12;
+        return 0;
+    case HV_X64_MSR_SINT13:
+        *hv_reg = HV_REGISTER_SINT13;
+        return 0;
+    case HV_X64_MSR_SINT14:
+        *hv_reg = HV_REGISTER_SINT14;
+        return 0;
+    case HV_X64_MSR_SINT15:
+        *hv_reg = HV_REGISTER_SINT15;
+        return 0;
+    case IA32_MSR_MISC_ENABLE:
+        *hv_reg = HV_X64_REGISTER_MSR_IA32_MISC_ENABLE;
+        return 0;
+    case HV_X64_MSR_SCONTROL:
+        *hv_reg = HV_REGISTER_SCONTROL;
+        return 0;
+    case HV_X64_MSR_SIEFP:
+        *hv_reg = HV_REGISTER_SIEFP;
+        return 0;
+    case HV_X64_MSR_SIMP:
+        *hv_reg = HV_REGISTER_SIMP;
+        return 0;
+    case HV_X64_MSR_REFERENCE_TSC:
+        *hv_reg = HV_REGISTER_REFERENCE_TSC;
+        return 0;
+    case HV_X64_MSR_EOM:
+        *hv_reg = HV_REGISTER_EOM;
+        return 0;
+    default:
+        error_report("failed to map MSR %u to HV register name", msr);
+        return -1;
+    }
+}
+
+static int set_msrs(const CPUState *cpu, GList *msrs)
+{
+    size_t n_msrs;
+    GList *entries;
+    MshvMsrEntry *entry;
+    enum hv_register_name name;
+    struct hv_register_assoc *assoc;
+    int ret;
+    size_t i = 0;
+
+    n_msrs = g_list_length(msrs);
+    hv_register_assoc *assocs = g_new0(hv_register_assoc, n_msrs);
+
+    entries = msrs;
+    for (const GList *elem = entries; elem != NULL; elem = elem->next) {
+        entry = elem->data;
+        ret = mshv_msr_to_hv_reg_name(entry->index, &name);
+        if (ret < 0) {
+            g_free(assocs);
+            return ret;
+        }
+        assoc = &assocs[i];
+        assoc->name = name;
+        /* the union has been initialized to 0 */
+        assoc->value.reg64 = entry->data;
+        i++;
+    }
+    ret = mshv_set_generic_regs(cpu, assocs, n_msrs);
+    g_free(assocs);
+    if (ret < 0) {
+        error_report("failed to set msrs");
+        return -1;
+    }
+    return 0;
+}
+
+
+int mshv_configure_msr(const CPUState *cpu, const MshvMsrEntry *msrs,
+                       size_t n_msrs)
+{
+    GList *valid_msrs = NULL;
+    uint32_t msr_index;
+    int ret;
+
+    for (size_t i = 0; i < n_msrs; i++) {
+        msr_index = msrs[i].index;
+        /* check whether index of msrs is in SUPPORTED_MSRS */
+        if (mshv_is_supported_msr(msr_index)) {
+            valid_msrs = g_list_append(valid_msrs, (void *) &msrs[i]);
+        }
+    }
+
+    ret = set_msrs(cpu, valid_msrs);
+    g_list_free(valid_msrs);
+
+    return ret;
+}
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index 0ea8d504fa..6649438313 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -14,6 +14,8 @@
 #ifndef QEMU_MSHV_INT_H
 #define QEMU_MSHV_INT_H
 
+#define MSHV_MSR_ENTRIES_COUNT 64
+
 typedef struct hyperv_message hv_message;
 
 struct AccelCPUState {
@@ -102,6 +104,21 @@ typedef struct MshvMemoryRegion {
 void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
                        bool add);
 
+/* msr */
+typedef struct MshvMsrEntry {
+  uint32_t index;
+  uint32_t reserved;
+  uint64_t data;
+} MshvMsrEntry;
+
+typedef struct MshvMsrEntries {
+    MshvMsrEntry entries[MSHV_MSR_ENTRIES_COUNT];
+    uint32_t nmsrs;
+} MshvMsrEntries;
+
+int mshv_configure_msr(const CPUState *cpu, const MshvMsrEntry *msrs,
+                       size_t n_msrs);
+
 /* interrupt */
 void mshv_init_msicontrol(void);
 int mshv_reserve_ioapic_msi_routes(int vm_fd);
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 3aec8fd41c..8b7c173838 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -435,9 +435,11 @@ typedef enum X86Seg {
 #define MSR_SMI_COUNT                   0x34
 #define MSR_CORE_THREAD_COUNT           0x35
 #define MSR_MTRRcap                     0xfe
+#define MSR_MTRR_MEM_TYPE_WB            0x06
 #define MSR_MTRRcap_VCNT                8
 #define MSR_MTRRcap_FIXRANGE_SUPPORT    (1 << 8)
 #define MSR_MTRRcap_WC_SUPPORTED        (1 << 10)
+#define MSR_MTRR_ENABLE                 (1 << 11)
 
 #define MSR_IA32_SYSENTER_CS            0x174
 #define MSR_IA32_SYSENTER_ESP           0x175
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 2b7a81274b..1f43dfc58a 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -872,6 +872,33 @@ static int set_lint(int cpu_fd)
     return set_lapic(cpu_fd, &lapic_state);
 }
 
+static int setup_msrs(const CPUState *cpu)
+{
+    int ret;
+    uint64_t default_type = MSR_MTRR_ENABLE | MSR_MTRR_MEM_TYPE_WB;
+
+    /* boot msr entries */
+    MshvMsrEntry msrs[9] = {
+        { .index = IA32_MSR_SYSENTER_CS, .data = 0x0, },
+        { .index = IA32_MSR_SYSENTER_ESP, .data = 0x0, },
+        { .index = IA32_MSR_SYSENTER_EIP, .data = 0x0, },
+        { .index = IA32_MSR_STAR, .data = 0x0, },
+        { .index = IA32_MSR_CSTAR, .data = 0x0, },
+        { .index = IA32_MSR_LSTAR, .data = 0x0, },
+        { .index = IA32_MSR_KERNEL_GS_BASE, .data = 0x0, },
+        { .index = IA32_MSR_SFMASK, .data = 0x0, },
+        { .index = IA32_MSR_MTRR_DEF_TYPE, .data = default_type, },
+    };
+
+    ret = mshv_configure_msr(cpu, msrs, 9);
+    if (ret < 0) {
+        error_report("failed to setup msrs");
+        return -1;
+    }
+
+    return 0;
+}
+
 /*
  * TODO: populate topology info:
  *
@@ -891,6 +918,12 @@ int mshv_configure_vcpu(const CPUState *cpu, const struct MshvFPU *fpu,
         return -1;
     }
 
+    ret = setup_msrs(cpu);
+    if (ret < 0) {
+        error_report("failed to setup msrs");
+        return -1;
+    }
+
     ret = set_cpu_state(cpu, fpu, xcr0);
     if (ret < 0) {
         error_report("failed to set cpu state");

From 9bc6a1d29605a13c541629a651e41787af65a963 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:40 +0200
Subject: [PATCH 1159/2396] target/i386/mshv: Integrate x86 instruction
 decoder/emulator

Connect the x86 instruction decoder and emulator to the MSHV backend
to handle intercepted instructions. This enables software emulation
of MMIO operations in MSHV guests. MSHV has a translate_gva hypercall
that is used to accessing the physical guest memory.

A guest might read from unmapped memory regions (e.g. OVMF will probe
0xfed40000 for a vTPM). In those cases 0xFF bytes is returned instead of
aborting the execution.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-21-magnuskulke@linux.microsoft.com
[mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mem.c            |  65 +++++++++++++++++
 include/system/mshv_int.h   |   4 ++
 target/i386/mshv/mshv-cpu.c | 135 ++++++++++++++++++++++++++++++++++++
 3 files changed, 204 insertions(+)

diff --git a/accel/mshv/mem.c b/accel/mshv/mem.c
index a0a40eb333..e55c38d4db 100644
--- a/accel/mshv/mem.c
+++ b/accel/mshv/mem.c
@@ -59,6 +59,71 @@ static int map_or_unmap(int vm_fd, const MshvMemoryRegion *mr, bool map)
     return set_guest_memory(vm_fd, &region);
 }
 
+static int handle_unmapped_mmio_region_read(uint64_t gpa, uint64_t size,
+                                            uint8_t *data)
+{
+    warn_report("read from unmapped mmio region gpa=0x%lx size=%lu", gpa, size);
+
+    if (size == 0 || size > 8) {
+        error_report("invalid size %lu for reading from unmapped mmio region",
+                     size);
+        return -1;
+    }
+
+    memset(data, 0xFF, size);
+
+    return 0;
+}
+
+int mshv_guest_mem_read(uint64_t gpa, uint8_t *data, uintptr_t size,
+                        bool is_secure_mode, bool instruction_fetch)
+{
+    int ret;
+    MemTxAttrs memattr = { .secure = is_secure_mode };
+
+    if (instruction_fetch) {
+        trace_mshv_insn_fetch(gpa, size);
+    } else {
+        trace_mshv_mem_read(gpa, size);
+    }
+
+    ret = address_space_rw(&address_space_memory, gpa, memattr, (void *)data,
+                           size, false);
+    if (ret == MEMTX_OK) {
+        return 0;
+    }
+
+    if (ret == MEMTX_DECODE_ERROR) {
+        return handle_unmapped_mmio_region_read(gpa, size, data);
+    }
+
+    error_report("failed to read guest memory at 0x%lx", gpa);
+    return -1;
+}
+
+int mshv_guest_mem_write(uint64_t gpa, const uint8_t *data, uintptr_t size,
+                         bool is_secure_mode)
+{
+    int ret;
+    MemTxAttrs memattr = { .secure = is_secure_mode };
+
+    trace_mshv_mem_write(gpa, size);
+    ret = address_space_rw(&address_space_memory, gpa, memattr, (void *)data,
+                           size, true);
+    if (ret == MEMTX_OK) {
+        return 0;
+    }
+
+    if (ret == MEMTX_DECODE_ERROR) {
+        warn_report("write to unmapped mmio region gpa=0x%lx size=%lu", gpa,
+                    size);
+        return 0;
+    }
+
+    error_report("Failed to write guest memory");
+    return -1;
+}
+
 static int set_memory(const MshvMemoryRegion *mshv_mr, bool add)
 {
     int ret = 0;
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index 6649438313..b29d39911d 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -101,6 +101,10 @@ typedef struct MshvMemoryRegion {
     bool readonly;
 } MshvMemoryRegion;
 
+int mshv_guest_mem_read(uint64_t gpa, uint8_t *data, uintptr_t size,
+                        bool is_secure_mode, bool instruction_fetch);
+int mshv_guest_mem_write(uint64_t gpa, const uint8_t *data, uintptr_t size,
+                         bool is_secure_mode);
 void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
                        bool add);
 
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 1f43dfc58a..424ebdb122 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -104,6 +104,47 @@ static enum hv_register_name FPU_REGISTER_NAMES[26] = {
     HV_X64_REGISTER_XMM_CONTROL_STATUS,
 };
 
+static int translate_gva(const CPUState *cpu, uint64_t gva, uint64_t *gpa,
+                         uint64_t flags)
+{
+    int ret;
+    int cpu_fd = mshv_vcpufd(cpu);
+    int vp_index = cpu->cpu_index;
+
+    hv_input_translate_virtual_address in = { 0 };
+    hv_output_translate_virtual_address out = { 0 };
+    struct mshv_root_hvcall args = {0};
+    uint64_t gva_page = gva >> HV_HYP_PAGE_SHIFT;
+
+    in.vp_index = vp_index;
+    in.control_flags = flags;
+    in.gva_page = gva_page;
+
+    /* create the hvcall envelope */
+    args.code = HVCALL_TRANSLATE_VIRTUAL_ADDRESS;
+    args.in_sz = sizeof(in);
+    args.in_ptr = (uint64_t) &in;
+    args.out_sz = sizeof(out);
+    args.out_ptr = (uint64_t) &out;
+
+    /* perform the call */
+    ret = mshv_hvcall(cpu_fd, &args);
+    if (ret < 0) {
+        error_report("Failed to invoke gva->gpa translation");
+        return -errno;
+    }
+
+    if (out.translation_result.result_code != HV_TRANSLATE_GVA_SUCCESS) {
+        error_report("Failed to translate gva (" TARGET_FMT_lx ") to gpa", gva);
+        return -1;
+    }
+
+    *gpa = ((out.gpa_page << HV_HYP_PAGE_SHIFT)
+         | (gva & ~(uint64_t)HV_HYP_PAGE_MASK));
+
+    return 0;
+}
+
 int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
                           size_t n_regs)
 {
@@ -1006,8 +1047,102 @@ int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd)
     return 0;
 }
 
+static int guest_mem_read_with_gva(const CPUState *cpu, uint64_t gva,
+                                   uint8_t *data, uintptr_t size,
+                                   bool fetch_instruction)
+{
+    int ret;
+    uint64_t gpa, flags;
+
+    flags = HV_TRANSLATE_GVA_VALIDATE_READ;
+    ret = translate_gva(cpu, gva, &gpa, flags);
+    if (ret < 0) {
+        error_report("failed to translate gva to gpa");
+        return -1;
+    }
+
+    ret = mshv_guest_mem_read(gpa, data, size, false, fetch_instruction);
+    if (ret < 0) {
+        error_report("failed to read from guest memory");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int guest_mem_write_with_gva(const CPUState *cpu, uint64_t gva,
+                                    const uint8_t *data, uintptr_t size)
+{
+    int ret;
+    uint64_t gpa, flags;
+
+    flags = HV_TRANSLATE_GVA_VALIDATE_WRITE;
+    ret = translate_gva(cpu, gva, &gpa, flags);
+    if (ret < 0) {
+        error_report("failed to translate gva to gpa");
+        return -1;
+    }
+    ret = mshv_guest_mem_write(gpa, data, size, false);
+    if (ret < 0) {
+        error_report("failed to write to guest memory");
+        return -1;
+    }
+    return 0;
+}
+
+static void write_mem(CPUState *cpu, void *data, target_ulong addr, int bytes)
+{
+    if (guest_mem_write_with_gva(cpu, addr, data, bytes) < 0) {
+        error_report("failed to write memory");
+        abort();
+    }
+}
+
+static void fetch_instruction(CPUState *cpu, void *data,
+                              target_ulong addr, int bytes)
+{
+    if (guest_mem_read_with_gva(cpu, addr, data, bytes, true) < 0) {
+        error_report("failed to fetch instruction");
+        abort();
+    }
+}
+
+static void read_mem(CPUState *cpu, void *data, target_ulong addr, int bytes)
+{
+    if (guest_mem_read_with_gva(cpu, addr, data, bytes, false) < 0) {
+        error_report("failed to read memory");
+        abort();
+    }
+}
+
+static void read_segment_descriptor(CPUState *cpu,
+                                    struct x86_segment_descriptor *desc,
+                                    enum X86Seg seg_idx)
+{
+    bool ret;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    SegmentCache *seg = &env->segs[seg_idx];
+    x86_segment_selector sel = { .sel = seg->selector & 0xFFFF };
+
+    ret = x86_read_segment_descriptor(cpu, desc, sel);
+    if (ret == false) {
+        error_report("failed to read segment descriptor");
+        abort();
+    }
+}
+
+static const struct x86_emul_ops mshv_x86_emul_ops = {
+    .fetch_instruction = fetch_instruction,
+    .read_mem = read_mem,
+    .write_mem = write_mem,
+    .read_segment_descriptor = read_segment_descriptor,
+};
+
 void mshv_init_mmio_emu(void)
 {
+    init_decoder();
+    init_emu(&mshv_x86_emul_ops);
 }
 
 void mshv_arch_init_vcpu(CPUState *cpu)

From 64118f452cbd97cd9fa790b1c15b65b435f136d2 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:41 +0200
Subject: [PATCH 1160/2396] target/i386/mshv: Write MSRs to the hypervisor

Push current model-specific register (MSR) values to MSHV's vCPUs as
part of setting state to the hypervisor.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-22-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 68 +++++++++++++++++++++++++++++++++++--
 1 file changed, 66 insertions(+), 2 deletions(-)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 424ebdb122..33a3ce8b11 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -998,6 +998,65 @@ static int put_regs(const CPUState *cpu)
     return 0;
 }
 
+struct MsrPair {
+    uint32_t index;
+    uint64_t value;
+};
+
+static int put_msrs(const CPUState *cpu)
+{
+    int ret = 0;
+    X86CPU *x86cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86cpu->env;
+    MshvMsrEntries *msrs = g_malloc0(sizeof(MshvMsrEntries));
+
+    struct MsrPair pairs[] = {
+        { MSR_IA32_SYSENTER_CS,    env->sysenter_cs },
+        { MSR_IA32_SYSENTER_ESP,   env->sysenter_esp },
+        { MSR_IA32_SYSENTER_EIP,   env->sysenter_eip },
+        { MSR_EFER,                env->efer },
+        { MSR_PAT,                 env->pat },
+        { MSR_STAR,                env->star },
+        { MSR_CSTAR,               env->cstar },
+        { MSR_LSTAR,               env->lstar },
+        { MSR_KERNELGSBASE,        env->kernelgsbase },
+        { MSR_FMASK,               env->fmask },
+        { MSR_MTRRdefType,         env->mtrr_deftype },
+        { MSR_VM_HSAVE_PA,         env->vm_hsave },
+        { MSR_SMI_COUNT,           env->msr_smi_count },
+        { MSR_IA32_PKRS,           env->pkrs },
+        { MSR_IA32_BNDCFGS,        env->msr_bndcfgs },
+        { MSR_IA32_XSS,            env->xss },
+        { MSR_IA32_UMWAIT_CONTROL, env->umwait },
+        { MSR_IA32_TSX_CTRL,       env->tsx_ctrl },
+        { MSR_AMD64_TSC_RATIO,     env->amd_tsc_scale_msr },
+        { MSR_TSC_AUX,             env->tsc_aux },
+        { MSR_TSC_ADJUST,          env->tsc_adjust },
+        { MSR_IA32_SMBASE,         env->smbase },
+        { MSR_IA32_SPEC_CTRL,      env->spec_ctrl },
+        { MSR_VIRT_SSBD,           env->virt_ssbd },
+    };
+
+    if (ARRAY_SIZE(pairs) > MSHV_MSR_ENTRIES_COUNT) {
+        error_report("MSR entries exceed maximum size");
+        g_free(msrs);
+        return -1;
+    }
+
+    for (size_t i = 0; i < ARRAY_SIZE(pairs); i++) {
+        MshvMsrEntry *entry = &msrs->entries[i];
+        entry->index = pairs[i].index;
+        entry->reserved = 0;
+        entry->data = pairs[i].value;
+        msrs->nmsrs++;
+    }
+
+    ret = mshv_configure_msr(cpu, &msrs->entries[0], msrs->nmsrs);
+    g_free(msrs);
+    return ret;
+}
+
+
 int mshv_arch_put_registers(const CPUState *cpu)
 {
     int ret;
@@ -1008,8 +1067,13 @@ int mshv_arch_put_registers(const CPUState *cpu)
         return -1;
     }
 
-    error_report("unimplemented");
-    abort();
+    ret = put_msrs(cpu);
+    if (ret < 0) {
+        error_report("Failed to put msrs");
+        return -1;
+    }
+
+    return 0;
 }
 
 void mshv_arch_amend_proc_features(

From 6dec60528c419781f1f79cd9837d5f26415a3fd7 Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:42 +0200
Subject: [PATCH 1161/2396] target/i386/mshv: Implement mshv_vcpu_run()

Add the main vCPU execution loop for MSHV using the MSHV_RUN_VP ioctl.

The execution loop handles guest entry and VM exits. There are handlers for
memory r/w, PIO and MMIO to which the exit events are dispatched.

In case of MMIO the i386 instruction decoder/emulator is invoked to
perform the operation in user space.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-23-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 444 +++++++++++++++++++++++++++++++++++-
 1 file changed, 442 insertions(+), 2 deletions(-)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 33a3ce8b11..7edc032cea 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -1082,10 +1082,450 @@ void mshv_arch_amend_proc_features(
     features->access_guest_idle_reg = 1;
 }
 
+static int set_memory_info(const struct hyperv_message *msg,
+                           struct hv_x64_memory_intercept_message *info)
+{
+    if (msg->header.message_type != HVMSG_GPA_INTERCEPT
+            && msg->header.message_type != HVMSG_UNMAPPED_GPA
+            && msg->header.message_type != HVMSG_UNACCEPTED_GPA) {
+        error_report("invalid message type");
+        return -1;
+    }
+    memcpy(info, msg->payload, sizeof(*info));
+
+    return 0;
+}
+
+static int emulate_instruction(CPUState *cpu,
+                               const uint8_t *insn_bytes, size_t insn_len,
+                               uint64_t gva, uint64_t gpa)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+    struct x86_decode decode = { 0 };
+    int ret;
+    x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len };
+
+    ret = mshv_load_regs(cpu);
+    if (ret < 0) {
+        error_report("failed to load registers");
+        return -1;
+    }
+
+    decode_instruction_stream(env, &decode, &stream);
+    exec_instruction(env, &decode);
+
+    ret = mshv_store_regs(cpu);
+    if (ret < 0) {
+        error_report("failed to store registers");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg,
+                       MshvVmExit *exit_reason)
+{
+    struct hv_x64_memory_intercept_message info = { 0 };
+    size_t insn_len;
+    uint8_t access_type;
+    uint8_t *instruction_bytes;
+    int ret;
+
+    ret = set_memory_info(msg, &info);
+    if (ret < 0) {
+        error_report("failed to convert message to memory info");
+        return -1;
+    }
+    insn_len = info.instruction_byte_count;
+    access_type = info.header.intercept_access_type;
+
+    if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_EXECUTE) {
+        error_report("invalid intercept access type: execute");
+        return -1;
+    }
+
+    if (insn_len > 16) {
+        error_report("invalid mmio instruction length: %zu", insn_len);
+        return -1;
+    }
+
+    trace_mshv_handle_mmio(info.guest_virtual_address,
+                           info.guest_physical_address,
+                           info.instruction_byte_count, access_type);
+
+    instruction_bytes = info.instruction_bytes;
+
+    ret = emulate_instruction(cpu, instruction_bytes, insn_len,
+                              info.guest_virtual_address,
+                              info.guest_physical_address);
+    if (ret < 0) {
+        error_report("failed to emulate mmio");
+        return -1;
+    }
+
+    *exit_reason = MshvVmExitIgnore;
+
+    return 0;
+}
+
+static int set_ioport_info(const struct hyperv_message *msg,
+                           hv_x64_io_port_intercept_message *info)
+{
+    if (msg->header.message_type != HVMSG_X64_IO_PORT_INTERCEPT) {
+        error_report("Invalid message type");
+        return -1;
+    }
+    memcpy(info, msg->payload, sizeof(*info));
+
+    return 0;
+}
+
+static int set_x64_registers(const CPUState *cpu, const uint32_t *names,
+                             const uint64_t *values)
+{
+
+    hv_register_assoc assocs[2];
+    int ret;
+
+    for (size_t i = 0; i < ARRAY_SIZE(assocs); i++) {
+        assocs[i].name = names[i];
+        assocs[i].value.reg64 = values[i];
+    }
+
+    ret = mshv_set_generic_regs(cpu, assocs, ARRAY_SIZE(assocs));
+    if (ret < 0) {
+        error_report("failed to set x64 registers");
+        return -1;
+    }
+
+    return 0;
+}
+
+static inline MemTxAttrs get_mem_attrs(bool is_secure_mode)
+{
+    MemTxAttrs memattr = {0};
+    memattr.secure = is_secure_mode;
+    return memattr;
+}
+
+static void pio_read(uint64_t port, uint8_t *data, uintptr_t size,
+                     bool is_secure_mode)
+{
+    int ret = 0;
+    MemTxAttrs memattr = get_mem_attrs(is_secure_mode);
+    ret = address_space_rw(&address_space_io, port, memattr, (void *)data, size,
+                           false);
+    if (ret != MEMTX_OK) {
+        error_report("Failed to read from port %lx: %d", port, ret);
+        abort();
+    }
+}
+
+static int pio_write(uint64_t port, const uint8_t *data, uintptr_t size,
+                     bool is_secure_mode)
+{
+    int ret = 0;
+    MemTxAttrs memattr = get_mem_attrs(is_secure_mode);
+    ret = address_space_rw(&address_space_io, port, memattr, (void *)data, size,
+                           true);
+    return ret;
+}
+
+static int handle_pio_non_str(const CPUState *cpu,
+                              hv_x64_io_port_intercept_message *info)
+{
+    size_t len = info->access_info.access_size;
+    uint8_t access_type = info->header.intercept_access_type;
+    int ret;
+    uint32_t val, eax;
+    const uint32_t eax_mask =  0xffffffffu >> (32 - len * 8);
+    size_t insn_len;
+    uint64_t rip, rax;
+    uint32_t reg_names[2];
+    uint64_t reg_values[2];
+    uint16_t port = info->port_number;
+
+    if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) {
+        union {
+            uint32_t u32;
+            uint8_t bytes[4];
+        } conv;
+
+        /* convert the first 4 bytes of rax to bytes */
+        conv.u32 = (uint32_t)info->rax;
+        /* secure mode is set to false */
+        ret = pio_write(port, conv.bytes, len, false);
+        if (ret < 0) {
+            error_report("Failed to write to io port");
+            return -1;
+        }
+    } else {
+        uint8_t data[4] = { 0 };
+        /* secure mode is set to false */
+        pio_read(info->port_number, data, len, false);
+
+        /* Preserve high bits in EAX, but clear out high bits in RAX */
+        val = *(uint32_t *)data;
+        eax = (((uint32_t)info->rax) & ~eax_mask) | (val & eax_mask);
+        info->rax = (uint64_t)eax;
+    }
+
+    insn_len = info->header.instruction_length;
+
+    /* Advance RIP and update RAX */
+    rip = info->header.rip + insn_len;
+    rax = info->rax;
+
+    reg_names[0] = HV_X64_REGISTER_RIP;
+    reg_values[0] = rip;
+    reg_names[1] = HV_X64_REGISTER_RAX;
+    reg_values[1] = rax;
+
+    ret = set_x64_registers(cpu, reg_names, reg_values);
+    if (ret < 0) {
+        error_report("Failed to set x64 registers");
+        return -1;
+    }
+
+    cpu->accel->dirty = false;
+
+    return 0;
+}
+
+static int fetch_guest_state(CPUState *cpu)
+{
+    int ret;
+
+    ret = mshv_get_standard_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to get standard registers");
+        return -1;
+    }
+
+    ret = mshv_get_special_regs(cpu);
+    if (ret < 0) {
+        error_report("Failed to get special registers");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int read_memory(const CPUState *cpu, uint64_t initial_gva,
+                       uint64_t initial_gpa, uint64_t gva, uint8_t *data,
+                       size_t len)
+{
+    int ret;
+    uint64_t gpa, flags;
+
+    if (gva == initial_gva) {
+        gpa = initial_gpa;
+    } else {
+        flags = HV_TRANSLATE_GVA_VALIDATE_READ;
+        ret = translate_gva(cpu, gva, &gpa, flags);
+        if (ret < 0) {
+            return -1;
+        }
+
+        ret = mshv_guest_mem_read(gpa, data, len, false, false);
+        if (ret < 0) {
+            error_report("failed to read guest mem");
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+static int write_memory(const CPUState *cpu, uint64_t initial_gva,
+                        uint64_t initial_gpa, uint64_t gva, const uint8_t *data,
+                        size_t len)
+{
+    int ret;
+    uint64_t gpa, flags;
+
+    if (gva == initial_gva) {
+        gpa = initial_gpa;
+    } else {
+        flags = HV_TRANSLATE_GVA_VALIDATE_WRITE;
+        ret = translate_gva(cpu, gva, &gpa, flags);
+        if (ret < 0) {
+            error_report("failed to translate gva to gpa");
+            return -1;
+        }
+    }
+    ret = mshv_guest_mem_write(gpa, data, len, false);
+    if (ret != MEMTX_OK) {
+        error_report("failed to write to mmio");
+        return -1;
+    }
+
+    return 0;
+}
+
+static int handle_pio_str_write(CPUState *cpu,
+                                hv_x64_io_port_intercept_message *info,
+                                size_t repeat, uint16_t port,
+                                bool direction_flag)
+{
+    int ret;
+    uint64_t src;
+    uint8_t data[4] = { 0 };
+    size_t len = info->access_info.access_size;
+
+    src = linear_addr(cpu, info->rsi, R_DS);
+
+    for (size_t i = 0; i < repeat; i++) {
+        ret = read_memory(cpu, 0, 0, src, data, len);
+        if (ret < 0) {
+            error_report("Failed to read memory");
+            return -1;
+        }
+        ret = pio_write(port, data, len, false);
+        if (ret < 0) {
+            error_report("Failed to write to io port");
+            return -1;
+        }
+        src += direction_flag ? -len : len;
+        info->rsi += direction_flag ? -len : len;
+    }
+
+    return 0;
+}
+
+static int handle_pio_str_read(CPUState *cpu,
+                               hv_x64_io_port_intercept_message *info,
+                               size_t repeat, uint16_t port,
+                               bool direction_flag)
+{
+    int ret;
+    uint64_t dst;
+    size_t len = info->access_info.access_size;
+    uint8_t data[4] = { 0 };
+
+    dst = linear_addr(cpu, info->rdi, R_ES);
+
+    for (size_t i = 0; i < repeat; i++) {
+        pio_read(port, data, len, false);
+
+        ret = write_memory(cpu, 0, 0, dst, data, len);
+        if (ret < 0) {
+            error_report("Failed to write memory");
+            return -1;
+        }
+        dst += direction_flag ? -len : len;
+        info->rdi += direction_flag ? -len : len;
+    }
+
+    return 0;
+}
+
+static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info)
+{
+    uint8_t access_type = info->header.intercept_access_type;
+    uint16_t port = info->port_number;
+    bool repop = info->access_info.rep_prefix == 1;
+    size_t repeat = repop ? info->rcx : 1;
+    size_t insn_len = info->header.instruction_length;
+    bool direction_flag;
+    uint32_t reg_names[3];
+    uint64_t reg_values[3];
+    int ret;
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
+    ret = fetch_guest_state(cpu);
+    if (ret < 0) {
+        error_report("Failed to fetch guest state");
+        return -1;
+    }
+
+    direction_flag = (env->eflags & DESC_E_MASK) != 0;
+
+    if (access_type == HV_X64_INTERCEPT_ACCESS_TYPE_WRITE) {
+        ret = handle_pio_str_write(cpu, info, repeat, port, direction_flag);
+        if (ret < 0) {
+            error_report("Failed to handle pio str write");
+            return -1;
+        }
+        reg_names[0] = HV_X64_REGISTER_RSI;
+        reg_values[0] = info->rsi;
+    } else {
+        ret = handle_pio_str_read(cpu, info, repeat, port, direction_flag);
+        reg_names[0] = HV_X64_REGISTER_RDI;
+        reg_values[0] = info->rdi;
+    }
+
+    reg_names[1] = HV_X64_REGISTER_RIP;
+    reg_values[1] = info->header.rip + insn_len;
+    reg_names[2] = HV_X64_REGISTER_RAX;
+    reg_values[2] = info->rax;
+
+    ret = set_x64_registers(cpu, reg_names, reg_values);
+    if (ret < 0) {
+        error_report("Failed to set x64 registers");
+        return -1;
+    }
+
+    cpu->accel->dirty = false;
+
+    return 0;
+}
+
+static int handle_pio(CPUState *cpu, const struct hyperv_message *msg)
+{
+    struct hv_x64_io_port_intercept_message info = { 0 };
+    int ret;
+
+    ret = set_ioport_info(msg, &info);
+    if (ret < 0) {
+        error_report("Failed to convert message to ioport info");
+        return -1;
+    }
+
+    if (info.access_info.string_op) {
+        return handle_pio_str(cpu, &info);
+    }
+
+    return handle_pio_non_str(cpu, &info);
+}
+
 int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit)
 {
-    error_report("unimplemented");
-    abort();
+    int ret;
+    enum MshvVmExit exit_reason;
+    int cpu_fd = mshv_vcpufd(cpu);
+
+    ret = ioctl(cpu_fd, MSHV_RUN_VP, msg);
+    if (ret < 0) {
+        return MshvVmExitShutdown;
+    }
+
+    switch (msg->header.message_type) {
+    case HVMSG_UNRECOVERABLE_EXCEPTION:
+        return MshvVmExitShutdown;
+    case HVMSG_UNMAPPED_GPA:
+    case HVMSG_GPA_INTERCEPT:
+        ret = handle_mmio(cpu, msg, &exit_reason);
+        if (ret < 0) {
+            error_report("failed to handle mmio");
+            return -1;
+        }
+        return exit_reason;
+    case HVMSG_X64_IO_PORT_INTERCEPT:
+        ret = handle_pio(cpu, msg);
+        if (ret < 0) {
+            return MshvVmExitSpecial;
+        }
+        return MshvVmExitIgnore;
+    default:
+        break;
+    }
+
+    *exit = MshvVmExitIgnore;
+    return 0;
 }
 
 void mshv_remove_vcpu(int vm_fd, int cpu_fd)

From efc4093358511a58846a409b965213aa1bb9f31a Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:43 +0200
Subject: [PATCH 1162/2396] accel/mshv: Handle overlapping mem mappings

QEMU maps certain regions into the guest multiple times, as seen in the
trace below. Currently the MSHV kernel driver will reject those
mappings. To workaround this, a record is kept (a static global list of
"slots", inspired by what the HVF accelerator has implemented). An
overlapping region is not registered at the hypervisor, and marked as
mapped=false. If there is an UNMAPPED_GPA exit, we can look for a slot
that is unmapped and would cover the GPA. In this case we map out the
conflicting slot and map in the requested region.

mshv_set_phys_mem       add=1 name=pc.bios
mshv_map_memory      => u_a=7ffff4e00000 gpa=00fffc0000 size=00040000
mshv_set_phys_mem       add=1 name=ioapic
mshv_set_phys_mem       add=1 name=hpet
mshv_set_phys_mem       add=0 name=pc.ram
mshv_unmap_memory       u_a=7fff67e00000 gpa=0000000000 size=80000000
mshv_set_phys_mem       add=1 name=pc.ram
mshv_map_memory         u_a=7fff67e00000 gpa=0000000000 size=000c0000
mshv_set_phys_mem       add=1 name=pc.rom
mshv_map_memory         u_a=7ffff4c00000 gpa=00000c0000 size=00020000
mshv_set_phys_mem       add=1 name=pc.bios
mshv_remap_attempt   => u_a=7ffff4e20000 gpa=00000e0000 size=00020000

The mapping table is guarded by a mutex for concurrent modification and
RCU mechanisms for concurrent reads. Writes occur rarely, but we'll have
to verify whether an unmapped region exist for each UNMAPPED_GPA exit,
which happens frequently.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-24-magnuskulke@linux.microsoft.com
[Fix format strings for trace-events; mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mem.c            | 406 +++++++++++++++++++++++++++++++++---
 accel/mshv/mshv-all.c       |   2 +
 accel/mshv/trace-events     |   5 +
 include/system/mshv_int.h   |  22 +-
 target/i386/mshv/mshv-cpu.c |  43 ++++
 5 files changed, 448 insertions(+), 30 deletions(-)

diff --git a/accel/mshv/mem.c b/accel/mshv/mem.c
index e55c38d4db..0e2164af3e 100644
--- a/accel/mshv/mem.c
+++ b/accel/mshv/mem.c
@@ -11,7 +11,9 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/lockable.h"
 #include "qemu/error-report.h"
+#include "qemu/rcu.h"
 #include "linux/mshv.h"
 #include "system/address-spaces.h"
 #include "system/mshv.h"
@@ -20,6 +22,137 @@
 #include <sys/ioctl.h>
 #include "trace.h"
 
+typedef struct SlotsRCUReclaim {
+    struct rcu_head rcu;
+    GList *old_head;
+    MshvMemorySlot *removed_slot;
+} SlotsRCUReclaim;
+
+static void rcu_reclaim_slotlist(struct rcu_head *rcu)
+{
+    SlotsRCUReclaim *r = container_of(rcu, SlotsRCUReclaim, rcu);
+    g_list_free(r->old_head);
+    g_free(r->removed_slot);
+    g_free(r);
+}
+
+static void publish_slots(GList *new_head, GList *old_head,
+                          MshvMemorySlot *removed_slot)
+{
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    assert(manager);
+    qatomic_store_release(&manager->slots, new_head);
+
+    SlotsRCUReclaim *r = g_new(SlotsRCUReclaim, 1);
+    r->old_head = old_head;
+    r->removed_slot = removed_slot;
+
+    call_rcu1(&r->rcu, rcu_reclaim_slotlist);
+}
+
+/* Needs to be called with mshv_state->msm.mutex held */
+static int remove_slot(MshvMemorySlot *slot)
+{
+    GList *old_head, *new_head;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    assert(manager);
+    old_head = qatomic_load_acquire(&manager->slots);
+
+    if (!g_list_find(old_head, slot)) {
+        error_report("slot requested for removal not found");
+        return -1;
+    }
+
+    new_head = g_list_copy(old_head);
+    new_head = g_list_remove(new_head, slot);
+    manager->n_slots--;
+
+    publish_slots(new_head, old_head, slot);
+
+    return 0;
+}
+
+/* Needs to be called with mshv_state->msm.mutex held */
+static MshvMemorySlot *append_slot(uint64_t gpa, uint64_t userspace_addr,
+                                   uint64_t size, bool readonly)
+{
+    GList *old_head, *new_head;
+    MshvMemorySlot *slot;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    assert(manager);
+
+    old_head = qatomic_load_acquire(&manager->slots);
+
+    if (manager->n_slots >= MSHV_MAX_MEM_SLOTS) {
+        error_report("no free memory slots available");
+        return NULL;
+    }
+
+    slot = g_new0(MshvMemorySlot, 1);
+    slot->guest_phys_addr = gpa;
+    slot->userspace_addr = userspace_addr;
+    slot->memory_size = size;
+    slot->readonly = readonly;
+
+    new_head = g_list_copy(old_head);
+    new_head = g_list_append(new_head, slot);
+    manager->n_slots++;
+
+    publish_slots(new_head, old_head, NULL);
+
+    return slot;
+}
+
+static int slot_overlaps(const MshvMemorySlot *slot1,
+                         const MshvMemorySlot *slot2)
+{
+    uint64_t start_1 = slot1->userspace_addr,
+             start_2 = slot2->userspace_addr;
+    size_t len_1 = slot1->memory_size,
+           len_2 = slot2->memory_size;
+
+    if (slot1 == slot2) {
+        return -1;
+    }
+
+    return ranges_overlap(start_1, len_1, start_2, len_2) ?  0 : -1;
+}
+
+static bool is_mapped(MshvMemorySlot *slot)
+{
+    /* Subsequent reads of mapped field see a fully-initialized slot */
+    return qatomic_load_acquire(&slot->mapped);
+}
+
+/*
+ * Find slot that is:
+ * - overlapping in userspace
+ * - currently mapped in the guest
+ *
+ * Needs to be called with mshv_state->msm.mutex or RCU read lock held.
+ */
+static MshvMemorySlot *find_overlap_mem_slot(GList *head, MshvMemorySlot *slot)
+{
+    GList *found;
+    MshvMemorySlot *overlap_slot;
+
+    found = g_list_find_custom(head, slot, (GCompareFunc) slot_overlaps);
+
+    if (!found) {
+        return NULL;
+    }
+
+    overlap_slot = found->data;
+    if (!overlap_slot || !is_mapped(overlap_slot)) {
+        return NULL;
+    }
+
+    return overlap_slot;
+}
+
 static int set_guest_memory(int vm_fd,
                             const struct mshv_user_mem_region *region)
 {
@@ -27,38 +160,169 @@ static int set_guest_memory(int vm_fd,
 
     ret = ioctl(vm_fd, MSHV_SET_GUEST_MEMORY, region);
     if (ret < 0) {
-        error_report("failed to set guest memory");
-        return -errno;
+        error_report("failed to set guest memory: %s", strerror(errno));
+        return -1;
     }
 
     return 0;
 }
 
-static int map_or_unmap(int vm_fd, const MshvMemoryRegion *mr, bool map)
+static int map_or_unmap(int vm_fd, const MshvMemorySlot *slot, bool map)
 {
     struct mshv_user_mem_region region = {0};
 
-    region.guest_pfn = mr->guest_phys_addr >> MSHV_PAGE_SHIFT;
-    region.size = mr->memory_size;
-    region.userspace_addr = mr->userspace_addr;
+    region.guest_pfn = slot->guest_phys_addr >> MSHV_PAGE_SHIFT;
+    region.size = slot->memory_size;
+    region.userspace_addr = slot->userspace_addr;
 
     if (!map) {
         region.flags |= (1 << MSHV_SET_MEM_BIT_UNMAP);
-        trace_mshv_unmap_memory(mr->userspace_addr, mr->guest_phys_addr,
-                                mr->memory_size);
+        trace_mshv_unmap_memory(slot->userspace_addr, slot->guest_phys_addr,
+                                slot->memory_size);
         return set_guest_memory(vm_fd, &region);
     }
 
     region.flags = BIT(MSHV_SET_MEM_BIT_EXECUTABLE);
-    if (!mr->readonly) {
+    if (!slot->readonly) {
         region.flags |= BIT(MSHV_SET_MEM_BIT_WRITABLE);
     }
 
-    trace_mshv_map_memory(mr->userspace_addr, mr->guest_phys_addr,
-                          mr->memory_size);
+    trace_mshv_map_memory(slot->userspace_addr, slot->guest_phys_addr,
+                          slot->memory_size);
     return set_guest_memory(vm_fd, &region);
 }
 
+static int slot_matches_region(const MshvMemorySlot *slot1,
+                               const MshvMemorySlot *slot2)
+{
+    return (slot1->guest_phys_addr == slot2->guest_phys_addr &&
+            slot1->userspace_addr  == slot2->userspace_addr &&
+            slot1->memory_size     == slot2->memory_size) ? 0 : -1;
+}
+
+/* Needs to be called with mshv_state->msm.mutex held */
+static MshvMemorySlot *find_mem_slot_by_region(uint64_t gpa, uint64_t size,
+                                               uint64_t userspace_addr)
+{
+    MshvMemorySlot ref_slot = {
+        .guest_phys_addr = gpa,
+        .userspace_addr  = userspace_addr,
+        .memory_size     = size,
+    };
+    GList *found;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    assert(manager);
+    found = g_list_find_custom(manager->slots, &ref_slot,
+                               (GCompareFunc) slot_matches_region);
+
+    return found ? found->data : NULL;
+}
+
+static int slot_covers_gpa(const MshvMemorySlot *slot, uint64_t *gpa_p)
+{
+    uint64_t gpa_offset, gpa = *gpa_p;
+
+    gpa_offset = gpa - slot->guest_phys_addr;
+    return (slot->guest_phys_addr <= gpa && gpa_offset < slot->memory_size)
+        ? 0 : -1;
+}
+
+/* Needs to be called with mshv_state->msm.mutex or RCU read lock held */
+static MshvMemorySlot *find_mem_slot_by_gpa(GList *head, uint64_t gpa)
+{
+    GList *found;
+    MshvMemorySlot *slot;
+
+    trace_mshv_find_slot_by_gpa(gpa);
+
+    found = g_list_find_custom(head, &gpa, (GCompareFunc) slot_covers_gpa);
+    if (found) {
+        slot = found->data;
+        trace_mshv_found_slot(slot->userspace_addr, slot->guest_phys_addr,
+                              slot->memory_size);
+        return slot;
+    }
+
+    return NULL;
+}
+
+/* Needs to be called with mshv_state->msm.mutex held */
+static void set_mapped(MshvMemorySlot *slot, bool mapped)
+{
+    /* prior writes to mapped field becomes visible before readers see slot */
+    qatomic_store_release(&slot->mapped, mapped);
+}
+
+MshvRemapResult mshv_remap_overlap_region(int vm_fd, uint64_t gpa)
+{
+    MshvMemorySlot *gpa_slot, *overlap_slot;
+    GList *head;
+    int ret;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    /* fast path, called often by unmapped_gpa vm exit */
+    WITH_RCU_READ_LOCK_GUARD() {
+        assert(manager);
+        head = qatomic_load_acquire(&manager->slots);
+        /* return early if no slot is found */
+        gpa_slot = find_mem_slot_by_gpa(head, gpa);
+        if (gpa_slot == NULL) {
+            return MshvRemapNoMapping;
+        }
+
+        /* return early if no overlapping slot is found */
+        overlap_slot = find_overlap_mem_slot(head, gpa_slot);
+        if (overlap_slot == NULL) {
+            return MshvRemapNoOverlap;
+        }
+    }
+
+    /*
+     * We'll modify the mapping list, so we need to upgrade to mutex and
+     * recheck.
+     */
+    assert(manager);
+    QEMU_LOCK_GUARD(&manager->mutex);
+
+    /* return early if no slot is found */
+    gpa_slot = find_mem_slot_by_gpa(manager->slots, gpa);
+    if (gpa_slot == NULL) {
+        return MshvRemapNoMapping;
+    }
+
+    /* return early if no overlapping slot is found */
+    overlap_slot = find_overlap_mem_slot(manager->slots, gpa_slot);
+    if (overlap_slot == NULL) {
+        return MshvRemapNoOverlap;
+    }
+
+    /* unmap overlapping slot */
+    ret = map_or_unmap(vm_fd, overlap_slot, false);
+    if (ret < 0) {
+        error_report("failed to unmap overlap region");
+        abort();
+    }
+    set_mapped(overlap_slot, false);
+    warn_report("mapped out userspace_addr=0x%016lx gpa=0x%010lx size=0x%lx",
+                overlap_slot->userspace_addr,
+                overlap_slot->guest_phys_addr,
+                overlap_slot->memory_size);
+
+    /* map region for gpa */
+    ret = map_or_unmap(vm_fd, gpa_slot, true);
+    if (ret < 0) {
+        error_report("failed to map new region");
+        abort();
+    }
+    set_mapped(gpa_slot, true);
+    warn_report("mapped in  userspace_addr=0x%016lx gpa=0x%010lx size=0x%lx",
+                gpa_slot->userspace_addr, gpa_slot->guest_phys_addr,
+                gpa_slot->memory_size);
+
+    return MshvRemapOk;
+}
+
 static int handle_unmapped_mmio_region_read(uint64_t gpa, uint64_t size,
                                             uint8_t *data)
 {
@@ -124,20 +388,97 @@ int mshv_guest_mem_write(uint64_t gpa, const uint8_t *data, uintptr_t size,
     return -1;
 }
 
-static int set_memory(const MshvMemoryRegion *mshv_mr, bool add)
+static int tracked_unmap(int vm_fd, uint64_t gpa, uint64_t size,
+                        uint64_t userspace_addr)
 {
-    int ret = 0;
+    int ret;
+    MshvMemorySlot *slot;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
 
-    if (!mshv_mr) {
-        error_report("Invalid mshv_mr");
+    assert(manager);
+
+    QEMU_LOCK_GUARD(&manager->mutex);
+
+    slot = find_mem_slot_by_region(gpa, size, userspace_addr);
+    if (!slot) {
+        trace_mshv_skip_unset_mem(userspace_addr, gpa, size);
+        /* no work to do */
+        return 0;
+    }
+
+    if (!is_mapped(slot)) {
+        /* remove slot, no need to unmap */
+        return remove_slot(slot);
+    }
+
+    ret = map_or_unmap(vm_fd, slot, false);
+    if (ret < 0) {
+        error_report("failed to unmap memory region");
+        return ret;
+    }
+    return remove_slot(slot);
+}
+
+static int tracked_map(int vm_fd, uint64_t gpa, uint64_t size, bool readonly,
+                       uint64_t userspace_addr)
+{
+    MshvMemorySlot *slot, *overlap_slot;
+    int ret;
+    MshvMemorySlotManager *manager = &mshv_state->msm;
+
+    assert(manager);
+
+    QEMU_LOCK_GUARD(&manager->mutex);
+
+    slot = find_mem_slot_by_region(gpa, size, userspace_addr);
+    if (slot) {
+        error_report("memory region already mapped at gpa=0x%lx, "
+                     "userspace_addr=0x%lx, size=0x%lx",
+                     slot->guest_phys_addr, slot->userspace_addr,
+                     slot->memory_size);
         return -1;
     }
 
-    trace_mshv_set_memory(add, mshv_mr->guest_phys_addr,
-                          mshv_mr->memory_size,
-                          mshv_mr->userspace_addr, mshv_mr->readonly,
-                          ret);
-    return map_or_unmap(mshv_state->vm, mshv_mr, add);
+    slot = append_slot(gpa, userspace_addr, size, readonly);
+
+    overlap_slot = find_overlap_mem_slot(manager->slots, slot);
+    if (overlap_slot) {
+        trace_mshv_remap_attempt(slot->userspace_addr,
+                                 slot->guest_phys_addr,
+                                 slot->memory_size);
+        warn_report("attempt to map region [0x%lx-0x%lx], while "
+                    "[0x%lx-0x%lx] is already mapped in the guest",
+                    userspace_addr, userspace_addr + size - 1,
+                    overlap_slot->userspace_addr,
+                    overlap_slot->userspace_addr +
+                    overlap_slot->memory_size - 1);
+
+        /* do not register mem slot in hv, but record for later swap-in */
+        set_mapped(slot, false);
+
+        return 0;
+    }
+
+    ret = map_or_unmap(vm_fd, slot, true);
+    if (ret < 0) {
+        error_report("failed to map memory region");
+        return -1;
+    }
+    set_mapped(slot, true);
+
+    return 0;
+}
+
+static int set_memory(uint64_t gpa, uint64_t size, bool readonly,
+                      uint64_t userspace_addr, bool add)
+{
+    int vm_fd = mshv_state->vm;
+
+    if (add) {
+        return tracked_map(vm_fd, gpa, size, readonly, userspace_addr);
+    }
+
+    return tracked_unmap(vm_fd, gpa, size, userspace_addr);
 }
 
 /*
@@ -173,7 +514,9 @@ void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
     bool writable = !area->readonly && !area->rom_device;
     hwaddr start_addr, mr_offset, size;
     void *ram;
-    MshvMemoryRegion mshv_mr = {0};
+
+    size = align_section(section, &start_addr);
+    trace_mshv_set_phys_mem(add, section->mr->name, start_addr);
 
     size = align_section(section, &start_addr);
     trace_mshv_set_phys_mem(add, section->mr->name, start_addr);
@@ -200,14 +543,21 @@ void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
 
     ram = memory_region_get_ram_ptr(area) + mr_offset;
 
-    mshv_mr.guest_phys_addr = start_addr;
-    mshv_mr.memory_size = size;
-    mshv_mr.readonly = !writable;
-    mshv_mr.userspace_addr = (uint64_t)ram;
-
-    ret = set_memory(&mshv_mr, add);
+    ret = set_memory(start_addr, size, !writable, (uint64_t)ram, add);
     if (ret < 0) {
-        error_report("Failed to set memory region");
+        error_report("failed to set memory region");
         abort();
     }
 }
+
+void mshv_init_memory_slot_manager(MshvState *mshv_state)
+{
+    MshvMemorySlotManager *manager;
+
+    assert(mshv_state);
+    manager = &mshv_state->msm;
+
+    manager->n_slots = 0;
+    manager->slots = NULL;
+    qemu_mutex_init(&manager->mutex);
+}
diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index fa1f8f35bd..5edfcbad9d 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -437,6 +437,8 @@ static int mshv_init(AccelState *as, MachineState *ms)
 
     mshv_init_msicontrol();
 
+    mshv_init_memory_slot_manager(s);
+
     ret = create_vm(mshv_fd, &vm_fd);
     if (ret < 0) {
         close(mshv_fd);
diff --git a/accel/mshv/trace-events b/accel/mshv/trace-events
index a4dffeb24a..36f0d59b38 100644
--- a/accel/mshv/trace-events
+++ b/accel/mshv/trace-events
@@ -26,3 +26,8 @@ mshv_map_memory(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%
 mshv_unmap_memory(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
 mshv_set_phys_mem(bool add, const char *name, uint64_t gpa) "\tadd=%d name=%s gpa=0x%010" PRIx64
 mshv_handle_mmio(uint64_t gva, uint64_t gpa, uint64_t size, uint8_t access_type) "\tgva=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%" PRIx64 " access_type=%d"
+
+mshv_found_slot(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
+mshv_skip_unset_mem(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
+mshv_remap_attempt(uint64_t userspace_addr, uint64_t gpa, uint64_t size) "\tu_a=0x%" PRIx64 " gpa=0x%010" PRIx64 " size=0x%08" PRIx64
+mshv_find_slot_by_gpa(uint64_t gpa) "\tgpa=0x%010" PRIx64
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index b29d39911d..6350c69e9d 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -16,6 +16,8 @@
 
 #define MSHV_MSR_ENTRIES_COUNT 64
 
+#define MSHV_MAX_MEM_SLOTS 32
+
 typedef struct hyperv_message hv_message;
 
 struct AccelCPUState {
@@ -33,6 +35,12 @@ typedef struct MshvAddressSpace {
     AddressSpace *as;
 } MshvAddressSpace;
 
+typedef struct MshvMemorySlotManager {
+    size_t n_slots;
+    GList *slots;
+    QemuMutex mutex;
+} MshvMemorySlotManager;
+
 struct MshvState {
     AccelState parent_obj;
     int vm;
@@ -41,6 +49,7 @@ struct MshvState {
     int nr_as;
     MshvAddressSpace *as;
     int fd;
+    MshvMemorySlotManager msm;
 };
 
 typedef struct MshvMsiControl {
@@ -71,6 +80,12 @@ typedef enum MshvVmExit {
     MshvVmExitSpecial  = 2,
 } MshvVmExit;
 
+typedef enum MshvRemapResult {
+    MshvRemapOk = 0,
+    MshvRemapNoMapping = 1,
+    MshvRemapNoOverlap = 2,
+} MshvRemapResult;
+
 void mshv_init_mmio_emu(void);
 int mshv_create_vcpu(int vm_fd, uint8_t vp_index, int *cpu_fd);
 void mshv_remove_vcpu(int vm_fd, int cpu_fd);
@@ -94,19 +109,22 @@ int mshv_hvcall(int fd, const struct mshv_root_hvcall *args);
 #endif
 
 /* memory */
-typedef struct MshvMemoryRegion {
+typedef struct MshvMemorySlot {
     uint64_t guest_phys_addr;
     uint64_t memory_size;
     uint64_t userspace_addr;
     bool readonly;
-} MshvMemoryRegion;
+    bool mapped;
+} MshvMemorySlot;
 
+MshvRemapResult mshv_remap_overlap_region(int vm_fd, uint64_t gpa);
 int mshv_guest_mem_read(uint64_t gpa, uint8_t *data, uintptr_t size,
                         bool is_secure_mode, bool instruction_fetch);
 int mshv_guest_mem_write(uint64_t gpa, const uint8_t *data, uintptr_t size,
                          bool is_secure_mode);
 void mshv_set_phys_mem(MshvMemoryListener *mml, MemoryRegionSection *section,
                        bool add);
+void mshv_init_memory_slot_manager(MshvState *mshv_state);
 
 /* msr */
 typedef struct MshvMsrEntry {
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 7edc032cea..de87142bff 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -1170,6 +1170,43 @@ static int handle_mmio(CPUState *cpu, const struct hyperv_message *msg,
     return 0;
 }
 
+static int handle_unmapped_mem(int vm_fd, CPUState *cpu,
+                               const struct hyperv_message *msg,
+                               MshvVmExit *exit_reason)
+{
+    struct hv_x64_memory_intercept_message info = { 0 };
+    uint64_t gpa;
+    int ret;
+    enum MshvRemapResult remap_result;
+
+    ret = set_memory_info(msg, &info);
+    if (ret < 0) {
+        error_report("failed to convert message to memory info");
+        return -1;
+    }
+
+    gpa = info.guest_physical_address;
+
+    /* attempt to remap the region, in case of overlapping userspace mappings */
+    remap_result = mshv_remap_overlap_region(vm_fd, gpa);
+    *exit_reason = MshvVmExitIgnore;
+
+    switch (remap_result) {
+    case MshvRemapNoMapping:
+        /* if we didn't find a mapping, it is probably mmio */
+        return handle_mmio(cpu, msg, exit_reason);
+    case MshvRemapOk:
+        break;
+    case MshvRemapNoOverlap:
+        /* This should not happen, but we are forgiving it */
+        warn_report("found no overlap for unmapped region");
+        *exit_reason = MshvVmExitSpecial;
+        break;
+    }
+
+    return 0;
+}
+
 static int set_ioport_info(const struct hyperv_message *msg,
                            hv_x64_io_port_intercept_message *info)
 {
@@ -1507,6 +1544,12 @@ int mshv_run_vcpu(int vm_fd, CPUState *cpu, hv_message *msg, MshvVmExit *exit)
     case HVMSG_UNRECOVERABLE_EXCEPTION:
         return MshvVmExitShutdown;
     case HVMSG_UNMAPPED_GPA:
+        ret = handle_unmapped_mem(vm_fd, cpu, msg, &exit_reason);
+        if (ret < 0) {
+            error_report("failed to handle unmapped memory");
+            return -1;
+        }
+        return exit_reason;
     case HVMSG_GPA_INTERCEPT:
         ret = handle_mmio(cpu, msg, &exit_reason);
         if (ret < 0) {

From e7b08dfb902430b4f8226d23d7cf9b2762b6fc83 Mon Sep 17 00:00:00 2001
From: Praveen K Paladugu <prapal@microsoft.com>
Date: Tue, 16 Sep 2025 18:48:44 +0200
Subject: [PATCH 1163/2396] qapi/accel: Allow to query mshv capabilities

Allow to query mshv capabilities via query-mshv QMP and info mshv HMP commands.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Link: https://lore.kernel.org/r/20250916164847.77883-25-magnuskulke@linux.microsoft.com
[Fix "since" version. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hmp-commands-info.hx       | 13 +++++++++++++
 hw/core/machine-hmp-cmds.c | 15 +++++++++++++++
 hw/core/machine-qmp-cmds.c | 14 ++++++++++++++
 include/monitor/hmp.h      |  1 +
 include/system/hw_accel.h  |  1 +
 qapi/accelerator.json      | 29 +++++++++++++++++++++++++++++
 6 files changed, 73 insertions(+)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 6142f60e7b..eaaa880c1b 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -307,6 +307,19 @@ SRST
     Show KVM information.
 ERST
 
+    {
+        .name       = "mshv",
+        .args_type  = "",
+        .params     = "",
+        .help       = "show MSHV information",
+        .cmd        = hmp_info_mshv,
+    },
+
+SRST
+  ``info mshv``
+    Show MSHV information.
+ERST
+
     {
         .name       = "numa",
         .args_type  = "",
diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
index 3a612e2232..682ed9f49b 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -163,6 +163,21 @@ void hmp_info_kvm(Monitor *mon, const QDict *qdict)
     qapi_free_KvmInfo(info);
 }
 
+void hmp_info_mshv(Monitor *mon, const QDict *qdict)
+{
+    MshvInfo *info;
+
+    info = qmp_query_mshv(NULL);
+    monitor_printf(mon, "mshv support: ");
+    if (info->present) {
+        monitor_printf(mon, "%s\n", info->enabled ? "enabled" : "disabled");
+    } else {
+        monitor_printf(mon, "not compiled\n");
+    }
+
+    qapi_free_MshvInfo(info);
+}
+
 void hmp_info_uuid(Monitor *mon, const QDict *qdict)
 {
     UuidInfo *info;
diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index 6aca1a626e..e24bf0d97b 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -28,6 +28,20 @@
 #include "system/runstate.h"
 #include "system/system.h"
 #include "hw/s390x/storage-keys.h"
+#include <sys/stat.h>
+
+/*
+ * QMP query for MSHV
+ */
+MshvInfo *qmp_query_mshv(Error **errp)
+{
+    MshvInfo *info = g_malloc0(sizeof(*info));
+
+    info->enabled = mshv_enabled();
+    info->present = accel_find("mshv");
+
+    return info;
+}
 
 /*
  * fast means: we NEVER interrupt vCPU threads to retrieve
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index ae116d9804..31bd812e5f 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -24,6 +24,7 @@ strList *hmp_split_at_comma(const char *str);
 void hmp_info_name(Monitor *mon, const QDict *qdict);
 void hmp_info_version(Monitor *mon, const QDict *qdict);
 void hmp_info_kvm(Monitor *mon, const QDict *qdict);
+void hmp_info_mshv(Monitor *mon, const QDict *qdict);
 void hmp_info_status(Monitor *mon, const QDict *qdict);
 void hmp_info_uuid(Monitor *mon, const QDict *qdict);
 void hmp_info_chardev(Monitor *mon, const QDict *qdict);
diff --git a/include/system/hw_accel.h b/include/system/hw_accel.h
index fa9228d5d2..55497edc29 100644
--- a/include/system/hw_accel.h
+++ b/include/system/hw_accel.h
@@ -14,6 +14,7 @@
 #include "hw/core/cpu.h"
 #include "system/kvm.h"
 #include "system/hvf.h"
+#include "system/mshv.h"
 #include "system/whpx.h"
 #include "system/nvmm.h"
 
diff --git a/qapi/accelerator.json b/qapi/accelerator.json
index fb28c8d920..664e027246 100644
--- a/qapi/accelerator.json
+++ b/qapi/accelerator.json
@@ -54,3 +54,32 @@
 { 'command': 'x-accel-stats',
   'returns': 'HumanReadableText',
   'features': [ 'unstable' ] }
+
+##
+# @MshvInfo:
+#
+# Information about support for MSHV acceleration
+#
+# @enabled: true if MSHV acceleration is active
+#
+# @present: true if MSHV acceleration is built into this executable
+#
+# Since: 10.2.0
+##
+{ 'struct': 'MshvInfo', 'data': {'enabled': 'bool', 'present': 'bool'} }
+
+##
+# @query-mshv:
+#
+# Return information about MSHV acceleration
+#
+# Returns: @MshvInfo
+#
+# Since: 10.0.92
+#
+# .. qmp-example::
+#
+#     -> { "execute": "query-mshv" }
+#     <- { "return": { "enabled": true, "present": true } }
+##
+{ 'command': 'query-mshv', 'returns': 'MshvInfo' }

From e4a20afce59937073298d716cc829bdc026542dc Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Thu, 2 Oct 2025 09:50:12 +0200
Subject: [PATCH 1164/2396] target/i386/mshv: Use preallocated page for hvcall

There are hvcalls that are invoked during MMIO exits, the payload is of
dynamic size. To avoid heap allocations we can use preallocated pages as
in/out buffer for those calls. A page is reserved per vCPU and used for
set/get register hv calls.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-26-magnuskulke@linux.microsoft.com
[Use standard MAX_CONST macro; mshv.h/mshv_int.h split. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mshv-all.c       |  2 +-
 include/system/mshv_int.h   |  7 +++++++
 target/i386/mshv/mshv-cpu.c | 38 +++++++++++++++++++++++++------------
 3 files changed, 34 insertions(+), 13 deletions(-)

diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index 5edfcbad9d..45174f7c4e 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -399,8 +399,8 @@ static int mshv_init_vcpu(CPUState *cpu)
     uint8_t vp_index = cpu->cpu_index;
     int ret;
 
-    mshv_arch_init_vcpu(cpu);
     cpu->accel = g_new0(AccelCPUState, 1);
+    mshv_arch_init_vcpu(cpu);
 
     ret = mshv_create_vcpu(vm_fd, vp_index, &cpu->accel->cpufd);
     if (ret < 0) {
diff --git a/include/system/mshv_int.h b/include/system/mshv_int.h
index 6350c69e9d..490563c1ab 100644
--- a/include/system/mshv_int.h
+++ b/include/system/mshv_int.h
@@ -20,9 +20,16 @@
 
 typedef struct hyperv_message hv_message;
 
+typedef struct MshvHvCallArgs {
+    void *base;
+    void *input_page;
+    void *output_page;
+} MshvHvCallArgs;
+
 struct AccelCPUState {
     int cpufd;
     bool dirty;
+    MshvHvCallArgs hvcall_args;
 };
 
 typedef struct MshvMemoryListener {
diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index de87142bff..1f7b9cb37e 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -34,6 +34,10 @@
 
 #include <sys/ioctl.h>
 
+#define MAX_REGISTER_COUNT (MAX_CONST(ARRAY_SIZE(STANDARD_REGISTER_NAMES), \
+                            MAX_CONST(ARRAY_SIZE(SPECIAL_REGISTER_NAMES), \
+                                      ARRAY_SIZE(FPU_REGISTER_NAMES))))
+
 static enum hv_register_name STANDARD_REGISTER_NAMES[18] = {
     HV_X64_REGISTER_RAX,
     HV_X64_REGISTER_RBX,
@@ -151,7 +155,7 @@ int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
     int cpu_fd = mshv_vcpufd(cpu);
     int vp_index = cpu->cpu_index;
     size_t in_sz, assocs_sz;
-    hv_input_set_vp_registers *in;
+    hv_input_set_vp_registers *in = cpu->accel->hvcall_args.input_page;
     struct mshv_root_hvcall args = {0};
     int ret;
 
@@ -160,7 +164,7 @@ int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
     in_sz = sizeof(hv_input_set_vp_registers) + assocs_sz;
 
     /* fill the input struct */
-    in = g_malloc0(in_sz);
+    memset(in, 0, sizeof(hv_input_set_vp_registers));
     in->vp_index = vp_index;
     memcpy(in->elements, assocs, assocs_sz);
 
@@ -172,7 +176,6 @@ int mshv_set_generic_regs(const CPUState *cpu, const hv_register_assoc *assocs,
 
     /* perform the call */
     ret = mshv_hvcall(cpu_fd, &args);
-    g_free(in);
     if (ret < 0) {
         error_report("Failed to set registers");
         return -1;
@@ -193,8 +196,8 @@ static int get_generic_regs(CPUState *cpu, hv_register_assoc *assocs,
 {
     int cpu_fd = mshv_vcpufd(cpu);
     int vp_index = cpu->cpu_index;
-    hv_input_get_vp_registers *in;
-    hv_register_value *values;
+    hv_input_get_vp_registers *in = cpu->accel->hvcall_args.input_page;
+    hv_register_value *values = cpu->accel->hvcall_args.output_page;
     size_t in_sz, names_sz, values_sz;
     int i, ret;
     struct mshv_root_hvcall args = {0};
@@ -204,15 +207,14 @@ static int get_generic_regs(CPUState *cpu, hv_register_assoc *assocs,
     in_sz = sizeof(hv_input_get_vp_registers) + names_sz;
 
     /* fill the input struct */
-    in = g_malloc0(in_sz);
+    memset(in, 0, sizeof(hv_input_get_vp_registers));
     in->vp_index = vp_index;
     for (i = 0; i < n_regs; i++) {
         in->names[i] = assocs[i].name;
     }
 
-    /* allocate value output buffer */
+    /* determine size of value output buffer */
     values_sz = n_regs * sizeof(union hv_register_value);
-    values = g_malloc0(values_sz);
 
     /* create the hvcall envelope */
     args.code = HVCALL_GET_VP_REGISTERS;
@@ -224,16 +226,13 @@ static int get_generic_regs(CPUState *cpu, hv_register_assoc *assocs,
 
     /* perform the call */
     ret = mshv_hvcall(cpu_fd, &args);
-    g_free(in);
     if (ret < 0) {
-        g_free(values);
         error_report("Failed to retrieve registers");
         return -1;
     }
 
     /* assert we got all registers */
     if (args.reps != n_regs) {
-        g_free(values);
         error_report("Failed to retrieve registers: expected %zu elements"
                      ", got %u", n_regs, args.reps);
         return -1;
@@ -243,7 +242,6 @@ static int get_generic_regs(CPUState *cpu, hv_register_assoc *assocs,
     for (i = 0; i < n_regs; i++) {
         assocs[i].value = values[i];
     }
-    g_free(values);
 
     return 0;
 }
@@ -1696,6 +1694,19 @@ void mshv_arch_init_vcpu(CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
+    AccelCPUState *state = cpu->accel;
+    size_t page = HV_HYP_PAGE_SIZE;
+    void *mem = qemu_memalign(page, 2 * page);
+
+    /* sanity check, to make sure we don't overflow the page */
+    QEMU_BUILD_BUG_ON((MAX_REGISTER_COUNT
+                      * sizeof(hv_register_assoc)
+                      + sizeof(hv_input_get_vp_registers)
+                      > HV_HYP_PAGE_SIZE));
+
+    state->hvcall_args.base = mem;
+    state->hvcall_args.input_page = mem;
+    state->hvcall_args.output_page = (uint8_t *)mem + page;
 
     env->emu_mmio_buf = g_new(char, 4096);
 }
@@ -1704,7 +1715,10 @@ void mshv_arch_destroy_vcpu(CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;
+    AccelCPUState *state = cpu->accel;
 
+    g_free(state->hvcall_args.base);
+    state->hvcall_args = (MshvHvCallArgs){0};
     g_clear_pointer(&env->emu_mmio_buf, g_free);
 }
 

From 3af71a1a6a7a497df7d3026239d6136b56e3d5ab Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:46 +0200
Subject: [PATCH 1165/2396] docs: Add mshv to documentation

Added mshv to the list of accelerators in doc text.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-27-magnuskulke@linux.microsoft.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/about/build-platforms.rst |  2 +-
 docs/devel/codebase.rst        |  2 +-
 docs/glossary.rst              |  7 +++----
 docs/system/introduction.rst   |  3 +++
 qemu-options.hx                | 16 ++++++++--------
 5 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index 798cb4631d..fc2743658d 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -53,7 +53,7 @@ Those hosts are officially supported, with various accelerators:
    * - SPARC
      - tcg
    * - x86
-     - hvf (64 bit only), kvm, nvmm, tcg, whpx (64 bit only), xen
+     - hvf (64 bit only), mshv (64 bit only), kvm, nvmm, tcg, whpx (64 bit only), xen
 
 Other host architectures are not supported. It is possible to build QEMU system
 emulation on an unsupported host architecture using the configure
diff --git a/docs/devel/codebase.rst b/docs/devel/codebase.rst
index 2a3143787a..69d8827117 100644
--- a/docs/devel/codebase.rst
+++ b/docs/devel/codebase.rst
@@ -48,7 +48,7 @@ yet, so sometimes the source code is all you have.
 * `accel <https://gitlab.com/qemu-project/qemu/-/tree/master/accel>`_:
   Infrastructure and architecture agnostic code related to the various
   `accelerators <Accelerators>` supported by QEMU
-  (TCG, KVM, hvf, whpx, xen, nvmm).
+  (TCG, KVM, hvf, whpx, xen, nvmm, mshv).
   Contains interfaces for operations that will be implemented per
   `target <https://gitlab.com/qemu-project/qemu/-/tree/master/target>`_.
 * `audio <https://gitlab.com/qemu-project/qemu/-/tree/master/audio>`_:
diff --git a/docs/glossary.rst b/docs/glossary.rst
index 4fa044bfb6..2857731bc4 100644
--- a/docs/glossary.rst
+++ b/docs/glossary.rst
@@ -12,7 +12,7 @@ Accelerator
 
 A specific API used to accelerate execution of guest instructions. It can be
 hardware-based, through a virtualization API provided by the host OS (kvm, hvf,
-whpx, ...), or software-based (tcg). See this description of `supported
+whpx, mshv, ...), or software-based (tcg). See this description of `supported
 accelerators<Accelerators>`.
 
 Board
@@ -101,9 +101,8 @@ manage a virtual machine. QEMU is a virtualizer, that interacts with various
 hypervisors.
 
 In the context of QEMU, an hypervisor is an API, provided by the Host OS,
-allowing to execute virtual machines. Linux implementation is KVM (and supports
-Xen as well). For MacOS, it's HVF. Windows defines WHPX. And NetBSD provides
-NVMM.
+allowing to execute virtual machines.  Linux provides a choice of KVM, Xen
+or MSHV; MacOS provides HVF; Windows provides WHPX; NetBSD provides NVMM.
 
 .. _machine:
 
diff --git a/docs/system/introduction.rst b/docs/system/introduction.rst
index 4cd46b5b8f..9c57523b6c 100644
--- a/docs/system/introduction.rst
+++ b/docs/system/introduction.rst
@@ -23,6 +23,9 @@ Tiny Code Generator (TCG) capable of emulating many CPUs.
   * - Xen
     - Linux (as dom0)
     - Arm, x86
+  * - MSHV
+    - Linux (as dom0)
+    - x86
   * - Hypervisor Framework (hvf)
     - MacOS
     - x86 (64 bit only), Arm (64 bit only)
diff --git a/qemu-options.hx b/qemu-options.hx
index 075f4be2e3..56db4bf9e5 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -28,7 +28,7 @@ DEF("machine", HAS_ARG, QEMU_OPTION_machine, \
     "-machine [type=]name[,prop[=value][,...]]\n"
     "                selects emulated machine ('-machine help' for list)\n"
     "                property accel=accel1[:accel2[:...]] selects accelerator\n"
-    "                supported accelerators are kvm, xen, hvf, nvmm, whpx or tcg (default: tcg)\n"
+    "                supported accelerators are kvm, xen, hvf, nvmm, whpx, mshv or tcg (default: tcg)\n"
     "                vmport=on|off|auto controls emulation of vmport (default: auto)\n"
     "                dump-guest-core=on|off include guest memory in a core dump (default=on)\n"
     "                mem-merge=on|off controls memory merge support (default: on)\n"
@@ -66,10 +66,10 @@ SRST
 
     ``accel=accels1[:accels2[:...]]``
         This is used to enable an accelerator. Depending on the target
-        architecture, kvm, xen, hvf, nvmm, whpx or tcg can be available.
-        By default, tcg is used. If there is more than one accelerator
-        specified, the next one is used if the previous one fails to
-        initialize.
+        architecture, kvm, xen, hvf, nvmm, whpx, mshv or tcg can be
+        available. By default, tcg is used. If there is more than one
+        accelerator specified, the next one is used if the previous one
+        fails to initialize.
 
     ``vmport=on|off|auto``
         Enables emulation of VMWare IO port, for vmmouse etc. auto says
@@ -226,7 +226,7 @@ ERST
 
 DEF("accel", HAS_ARG, QEMU_OPTION_accel,
     "-accel [accel=]accelerator[,prop[=value][,...]]\n"
-    "                select accelerator (kvm, xen, hvf, nvmm, whpx or tcg; use 'help' for a list)\n"
+    "                select accelerator (kvm, xen, hvf, nvmm, whpx, mshv or tcg; use 'help' for a list)\n"
     "                igd-passthru=on|off (enable Xen integrated Intel graphics passthrough, default=off)\n"
     "                kernel-irqchip=on|off|split controls accelerated irqchip support (default=on)\n"
     "                kvm-shadow-mem=size of KVM shadow MMU in bytes\n"
@@ -241,8 +241,8 @@ DEF("accel", HAS_ARG, QEMU_OPTION_accel,
 SRST
 ``-accel name[,prop=value[,...]]``
     This is used to enable an accelerator. Depending on the target
-    architecture, kvm, xen, hvf, nvmm, whpx or tcg can be available. By
-    default, tcg is used. If there is more than one accelerator
+    architecture, kvm, xen, hvf, nvmm, whpx, mshv or tcg can be available.
+    By default, tcg is used. If there is more than one accelerator
     specified, the next one is used if the previous one fails to
     initialize.
 

From 1872bd9f2dad5113b0c27d352ec49683e0953c7f Mon Sep 17 00:00:00 2001
From: Magnus Kulke <magnuskulke@linux.microsoft.com>
Date: Tue, 16 Sep 2025 18:48:47 +0200
Subject: [PATCH 1166/2396] MAINTAINERS: Add maintainers for mshv accelerator

Adding Magnus Kulke and Wei Liu to the maintainers file for the
respective folders/files.

Signed-off-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Link: https://lore.kernel.org/r/20250916164847.77883-28-magnuskulke@linux.microsoft.com
[Rename "MAHV CPUs" to mention x86. - Paolo]
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 MAINTAINERS | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 406cef88f0..645344c4fa 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -551,6 +551,21 @@ F: target/i386/whpx/
 F: accel/stubs/whpx-stub.c
 F: include/system/whpx.h
 
+MSHV
+M: Magnus Kulke <magnus.kulke@linux.microsoft.com>
+R: Wei Liu <wei.liu@kernel.org>
+S: Supported
+F: accel/mshv/
+F: include/system/mshv.h
+F: include/hw/hyperv/hvgdk*.h
+F: include/hw/hyperv/hvhdk*.h
+
+X86 MSHV CPUs
+M: Magnus Kulke <magnus.kulke@linux.microsoft.com>
+R: Wei Liu <wei.liu@kernel.org>
+S: Supported
+F: target/i386/mshv/
+
 X86 Instruction Emulator
 M: Cameron Esfahani <dirty@apple.com>
 M: Roman Bolshakov <rbolshakov@ddn.com>

From 1a583ca382f63be537977e76bf54a0670e57a2a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 7 Oct 2025 19:34:05 +0400
Subject: [PATCH 1167/2396] tests/docker: make --enable-rust overridable with
 EXTRA_CONFIGURE_OPTS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20251007153406.421032-1-marcandre.lureau@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/docker/common.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/docker/common.rc b/tests/docker/common.rc
index 752f4f3aed..79d533ab2e 100755
--- a/tests/docker/common.rc
+++ b/tests/docker/common.rc
@@ -53,8 +53,8 @@ configure_qemu()
     config_opts="--enable-werror \
                  ${TARGET_LIST:+--target-list=${TARGET_LIST}} \
                  --prefix=$INSTALL_DIR \
-                 $QEMU_CONFIGURE_OPTS $EXTRA_CONFIGURE_OPTS \
                  $enable_rust \
+                 $QEMU_CONFIGURE_OPTS $EXTRA_CONFIGURE_OPTS \
                  $@"
     echo "Configure options:"
     echo $config_opts

From b9ef6198d709f431d893d1b5525cdf7fd7a3e11b Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 7 Oct 2025 15:44:27 -0400
Subject: [PATCH 1168/2396] rust: fix path to rust_root_crate.sh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generated Rust root crate source files contain the wrong path to the
rust_root_crate.sh script.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251007194427.118871-1-stefanha@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/rust/rust_root_crate.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/rust/rust_root_crate.sh b/scripts/rust/rust_root_crate.sh
index 975bddf7f1..f05b8d0210 100755
--- a/scripts/rust/rust_root_crate.sh
+++ b/scripts/rust/rust_root_crate.sh
@@ -4,7 +4,7 @@ set -eu
 
 cat <<EOF
 // @generated
-// This file is autogenerated by scripts/rust_root_crate.sh
+// This file is autogenerated by scripts/rust/rust_root_crate.sh
 
 EOF
 

From cdcb1d39eb72410bee55b6d3344f176c86224447 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@kernel.org>
Date: Tue, 23 Sep 2025 22:35:40 +0800
Subject: [PATCH 1169/2396] bios-tables-test-allowed-diff.h: Allow LoongArch
 DSDT.*

Signed-off-by: Huacai Chen <chenhuacai@kernel.org>
Reviewed-by: <maobibo@loongson.cn>
Message-ID: <20250923143542.2391576-2-chenhuacai@kernel.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..2ed837faee 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,5 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/loongarch64/virt/DSDT",
+"tests/data/acpi/loongarch64/virt/DSDT.memhp",
+"tests/data/acpi/loongarch64/virt/DSDT.numamem",
+"tests/data/acpi/loongarch64/virt/DSDT.topology",

From dd333bf0e3ab2096702844ae0d0cff8a8864e5f7 Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@loongson.cn>
Date: Tue, 23 Sep 2025 22:35:41 +0800
Subject: [PATCH 1170/2396] hw/loongarch/virt: Align VIRT_GED_CPUHP_ADDR to 4
 bytes

Now VIRT_GED_CPUHP_ADDR is not aligned to 4 bytes, but if Linux kernel
is built with ACPI_MISALIGNMENT_NOT_SUPPORTED, it assumes the alignment,
otherwise we get ACPI errors at boot phase:

ACPI Error: AE_AML_ALIGNMENT, Returned by Handler for [SystemMemory] (20250404/evregion-301)
ACPI Error: Aborting method \_SB.CPUS.CSTA due to previous error (AE_AML_ALIGNMENT) (20250404/psparse-529)
ACPI Error: Aborting method \_SB.CPUS.C000._STA due to previous error (AE_AML_ALIGNMENT) (20250404/psparse-529)
ACPI Error: Method execution failed \_SB.CPUS.C000._STA due to previous error (AE_AML_ALIGNMENT) (20250404/uteval-68)

VIRT_GED_MEM_ADDR and VIRT_GED_REG_ADDR are already aligned now, but use
QEMU_ALIGN_UP() to explicitly align them can make code more robust.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Suggested-by: WANG Rui <wangrui@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-ID: <20250923143542.2391576-3-chenhuacai@kernel.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 include/hw/loongarch/virt.h | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index cd97bdfb8d..76fa57cd07 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -49,9 +49,9 @@
 #define VIRT_LOWMEM_SIZE        0x10000000
 #define VIRT_HIGHMEM_BASE       0x80000000
 #define VIRT_GED_EVT_ADDR       0x100e0000
-#define VIRT_GED_MEM_ADDR       (VIRT_GED_EVT_ADDR + ACPI_GED_EVT_SEL_LEN)
-#define VIRT_GED_REG_ADDR       (VIRT_GED_MEM_ADDR + MEMORY_HOTPLUG_IO_LEN)
-#define VIRT_GED_CPUHP_ADDR     (VIRT_GED_REG_ADDR + ACPI_GED_REG_COUNT)
+#define VIRT_GED_MEM_ADDR       QEMU_ALIGN_UP(VIRT_GED_EVT_ADDR + ACPI_GED_EVT_SEL_LEN, 4)
+#define VIRT_GED_REG_ADDR       QEMU_ALIGN_UP(VIRT_GED_MEM_ADDR + MEMORY_HOTPLUG_IO_LEN, 4)
+#define VIRT_GED_CPUHP_ADDR     QEMU_ALIGN_UP(VIRT_GED_REG_ADDR + ACPI_GED_REG_COUNT, 4)
 
 #define COMMAND_LINE_SIZE       512
 

From 68e8df8cfa4fcf053e306f24edeaea59d90b0b3d Mon Sep 17 00:00:00 2001
From: Huacai Chen <chenhuacai@kernel.org>
Date: Tue, 23 Sep 2025 22:35:42 +0800
Subject: [PATCH 1171/2396] tests/data/acpi/loongarch64: Update expected DSDT.*

DSDT diffs from "iasl -d":

@@ -11,7 +11,7 @@
  *     Signature        "DSDT"
  *     Length           0x000011FB (4603)
  *     Revision         0x01 **** 32-bit table (V1), no 64-bit math support
- *     Checksum         0x5D
+ *     Checksum         0x5B
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
@@ -1426,11 +1426,11 @@
             Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
             {
                 Memory32Fixed (ReadWrite,
-                    0x100E001F,         // Address Base
+                    0x100E0020,         // Address Base
                     0x0000000C,         // Address Length
                     )
             })
-            OperationRegion (PRST, SystemMemory, 0x100E001F, 0x0C)
+            OperationRegion (PRST, SystemMemory, 0x100E0020, 0x0C)
             Field (PRST, ByteAcc, NoLock, WriteAsZeros)
             {
                 Offset (0x04),

Signed-off-by: Huacai Chen <chenhuacai@kernel.org>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-ID: <20250923143542.2391576-4-chenhuacai@kernel.org>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 tests/data/acpi/loongarch64/virt/DSDT         | Bin 4603 -> 4603 bytes
 tests/data/acpi/loongarch64/virt/DSDT.memhp   | Bin 5824 -> 5824 bytes
 tests/data/acpi/loongarch64/virt/DSDT.numamem | Bin 4609 -> 4609 bytes
 .../data/acpi/loongarch64/virt/DSDT.topology  | Bin 4905 -> 4905 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |   4 ----
 5 files changed, 4 deletions(-)

diff --git a/tests/data/acpi/loongarch64/virt/DSDT b/tests/data/acpi/loongarch64/virt/DSDT
index b31841aec6ed296f10ea1695a67ead38f45424d5..55aa34f988d6ef69293e91c5fe45bee0a02bc5f1 100644
GIT binary patch
delta 44
zcmeyZ{9BpJCD<k8w;%%pWAsL@BfP>2415AS3=9mF4ABh%LBSymJPMm1@=CD)02#3h
APXGV_

delta 44
zcmeyZ{9BpJCD<k8w;%%pW9&w*BfP@$415AS3=9mF4ABh%LBSymJo1|#@=CD)02$8<
APXGV_

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.memhp b/tests/data/acpi/loongarch64/virt/DSDT.memhp
index e291200fc91caa3d93dcd6ec4736f7340f5e3f65..c0955eb60448cc5f4d38d410abc260ae54ea2e9a 100644
GIT binary patch
delta 44
zcmX@0dq9`VCD<k8fEWV<W5PzRW+7n(20j5E1_p*ohUkWXpx_V&9)-;dgcMi+`vnS0

delta 44
zcmX@0dq9`VCD<k8fEWV<W70;hW+7pD20j5E1_p*ohUkWXpx_V&9{J4+gcMi+`y&cU

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.numamem b/tests/data/acpi/loongarch64/virt/DSDT.numamem
index 07923ac39584c5a5e73c9556d251814ce10de6cc..61e47e7252155dcf9c76879c4f60f4b3eef63f86 100644
GIT binary patch
delta 44
zcmZovX;k5I33dr#6k=dte72G62(PdL1D^m70|P@PLv%wxP;dwXkHY4Myb3G;-$V)Z

delta 44
zcmZovX;k5I33dr#6k=dte6f-12(Pd_1D^m70|P@PLv%wxP;dwXkNoC`yb3G;-(m^%

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.topology b/tests/data/acpi/loongarch64/virt/DSDT.topology
index 6dfbb495f88b74b87849b58473e46717bc588a56..b2afebc938ce45d798c8aa5f45a463f1617e257e 100644
GIT binary patch
delta 44
zcmZ3fwo;ADCD<iIQ<#B)@!UqPBfP>2415AS3=9mF4ABh%LBSymJPMm1@_MiW0PuGT
Ag8%>k

delta 44
zcmZ3fwo;ADCD<iIQ<#B)@xn%~BfP@$415AS3=9mF4ABh%LBSymJo1|#@_MiW0PvLx
Ag8%>k

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index 2ed837faee..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,5 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/loongarch64/virt/DSDT",
-"tests/data/acpi/loongarch64/virt/DSDT.memhp",
-"tests/data/acpi/loongarch64/virt/DSDT.numamem",
-"tests/data/acpi/loongarch64/virt/DSDT.topology",

From 410dfbf620aef6361a4fdb40f7a7ee32bf5581b4 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 29 Sep 2025 11:53:36 +0800
Subject: [PATCH 1172/2396] target/loongarch: Move TCG specified functions to
 tcg_cpu.c

New file target/loongarch/tcg/tcg_cpu.c is created, and move TCG
specified functions to here from file target/loongarch/cpu.c

It is only code movement and there is no any function change.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250929035338.2320419-2-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c               | 262 +-------------------------
 target/loongarch/internals.h         |   2 +
 target/loongarch/tcg/meson.build     |   1 +
 target/loongarch/tcg/tcg_cpu.c       | 266 +++++++++++++++++++++++++++
 target/loongarch/tcg/tcg_loongarch.h |   1 +
 5 files changed, 272 insertions(+), 260 deletions(-)
 create mode 100644 target/loongarch/tcg/tcg_cpu.c

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 993602fb8c..245c6d3ab9 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -28,11 +28,6 @@
 #ifdef CONFIG_KVM
 #include <linux/kvm.h>
 #endif
-#ifdef CONFIG_TCG
-#include "accel/tcg/cpu-ldst.h"
-#include "accel/tcg/cpu-ops.h"
-#include "tcg/tcg.h"
-#endif
 #include "tcg/tcg_loongarch.h"
 
 const char * const regnames[32] = {
@@ -140,18 +135,8 @@ void loongarch_cpu_set_irq(void *opaque, int irq, int level)
     }
 }
 
-static inline bool cpu_loongarch_hw_interrupts_enabled(CPULoongArchState *env)
-{
-    bool ret = 0;
-
-    ret = (FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE) &&
-          !(FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)));
-
-    return ret;
-}
-
 /* Check if there is pending and not masked out interrupt */
-static inline bool cpu_loongarch_hw_interrupts_pending(CPULoongArchState *env)
+bool cpu_loongarch_hw_interrupts_pending(CPULoongArchState *env)
 {
     uint32_t pending;
     uint32_t status;
@@ -163,217 +148,8 @@ static inline bool cpu_loongarch_hw_interrupts_pending(CPULoongArchState *env)
 }
 #endif
 
-#ifdef CONFIG_TCG
 #ifndef CONFIG_USER_ONLY
-static void loongarch_cpu_do_interrupt(CPUState *cs)
-{
-    CPULoongArchState *env = cpu_env(cs);
-    bool update_badinstr = 1;
-    int cause = -1;
-    bool tlbfill = FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR);
-    uint32_t vec_size = FIELD_EX64(env->CSR_ECFG, CSR_ECFG, VS);
-
-    if (cs->exception_index != EXCCODE_INT) {
-        qemu_log_mask(CPU_LOG_INT,
-                     "%s enter: pc " TARGET_FMT_lx " ERA " TARGET_FMT_lx
-                     " TLBRERA " TARGET_FMT_lx " exception: %d (%s)\n",
-                     __func__, env->pc, env->CSR_ERA, env->CSR_TLBRERA,
-                     cs->exception_index,
-                     loongarch_exception_name(cs->exception_index));
-    }
-
-    switch (cs->exception_index) {
-    case EXCCODE_DBP:
-        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DCL, 1);
-        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, ECODE, 0xC);
-        goto set_DERA;
-    set_DERA:
-        env->CSR_DERA = env->pc;
-        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DST, 1);
-        set_pc(env, env->CSR_EENTRY + 0x480);
-        break;
-    case EXCCODE_INT:
-        if (FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)) {
-            env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DEI, 1);
-            goto set_DERA;
-        }
-        QEMU_FALLTHROUGH;
-    case EXCCODE_PIF:
-    case EXCCODE_ADEF:
-        cause = cs->exception_index;
-        update_badinstr = 0;
-        break;
-    case EXCCODE_SYS:
-    case EXCCODE_BRK:
-    case EXCCODE_INE:
-    case EXCCODE_IPE:
-    case EXCCODE_FPD:
-    case EXCCODE_FPE:
-    case EXCCODE_SXD:
-    case EXCCODE_ASXD:
-        env->CSR_BADV = env->pc;
-        QEMU_FALLTHROUGH;
-    case EXCCODE_BCE:
-    case EXCCODE_ADEM:
-    case EXCCODE_PIL:
-    case EXCCODE_PIS:
-    case EXCCODE_PME:
-    case EXCCODE_PNR:
-    case EXCCODE_PNX:
-    case EXCCODE_PPI:
-        cause = cs->exception_index;
-        break;
-    default:
-        qemu_log("Error: exception(%d) has not been supported\n",
-                 cs->exception_index);
-        abort();
-    }
-
-    if (update_badinstr) {
-        env->CSR_BADI = cpu_ldl_code(env, env->pc);
-    }
-
-    /* Save PLV and IE */
-    if (tlbfill) {
-        env->CSR_TLBRPRMD = FIELD_DP64(env->CSR_TLBRPRMD, CSR_TLBRPRMD, PPLV,
-                                       FIELD_EX64(env->CSR_CRMD,
-                                       CSR_CRMD, PLV));
-        env->CSR_TLBRPRMD = FIELD_DP64(env->CSR_TLBRPRMD, CSR_TLBRPRMD, PIE,
-                                       FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE));
-        /* set the DA mode */
-        env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, DA, 1);
-        env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, PG, 0);
-        env->CSR_TLBRERA = FIELD_DP64(env->CSR_TLBRERA, CSR_TLBRERA,
-                                      PC, (env->pc >> 2));
-    } else {
-        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE,
-                                    EXCODE_MCODE(cause));
-        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ESUBCODE,
-                                    EXCODE_SUBCODE(cause));
-        env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PPLV,
-                                   FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV));
-        env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PIE,
-                                   FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE));
-        env->CSR_ERA = env->pc;
-    }
-
-    env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, PLV, 0);
-    env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, IE, 0);
-
-    if (vec_size) {
-        vec_size = (1 << vec_size) * 4;
-    }
-
-    if  (cs->exception_index == EXCCODE_INT) {
-        /* Interrupt */
-        uint32_t vector = 0;
-        uint32_t pending = FIELD_EX64(env->CSR_ESTAT, CSR_ESTAT, IS);
-        pending &= FIELD_EX64(env->CSR_ECFG, CSR_ECFG, LIE);
-
-        /* Find the highest-priority interrupt. */
-        vector = 31 - clz32(pending);
-        set_pc(env, env->CSR_EENTRY + \
-               (EXCCODE_EXTERNAL_INT + vector) * vec_size);
-        qemu_log_mask(CPU_LOG_INT,
-                      "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
-                      " cause %d\n" "    A " TARGET_FMT_lx " D "
-                      TARGET_FMT_lx " vector = %d ExC " TARGET_FMT_lx "ExS"
-                      TARGET_FMT_lx "\n",
-                      __func__, env->pc, env->CSR_ERA,
-                      cause, env->CSR_BADV, env->CSR_DERA, vector,
-                      env->CSR_ECFG, env->CSR_ESTAT);
-    } else {
-        if (tlbfill) {
-            set_pc(env, env->CSR_TLBRENTRY);
-        } else {
-            set_pc(env, env->CSR_EENTRY + EXCODE_MCODE(cause) * vec_size);
-        }
-        qemu_log_mask(CPU_LOG_INT,
-                      "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
-                      " cause %d%s\n, ESTAT " TARGET_FMT_lx
-                      " EXCFG " TARGET_FMT_lx " BADVA " TARGET_FMT_lx
-                      "BADI " TARGET_FMT_lx " SYS_NUM " TARGET_FMT_lu
-                      " cpu %d asid " TARGET_FMT_lx "\n", __func__, env->pc,
-                      tlbfill ? env->CSR_TLBRERA : env->CSR_ERA,
-                      cause, tlbfill ? "(refill)" : "", env->CSR_ESTAT,
-                      env->CSR_ECFG,
-                      tlbfill ? env->CSR_TLBRBADV : env->CSR_BADV,
-                      env->CSR_BADI, env->gpr[11], cs->cpu_index,
-                      env->CSR_ASID);
-    }
-    cs->exception_index = -1;
-}
-
-static void loongarch_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
-                                                vaddr addr, unsigned size,
-                                                MMUAccessType access_type,
-                                                int mmu_idx, MemTxAttrs attrs,
-                                                MemTxResult response,
-                                                uintptr_t retaddr)
-{
-    CPULoongArchState *env = cpu_env(cs);
-
-    if (access_type == MMU_INST_FETCH) {
-        do_raise_exception(env, EXCCODE_ADEF, retaddr);
-    } else {
-        do_raise_exception(env, EXCCODE_ADEM, retaddr);
-    }
-}
-
-static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
-{
-    if (interrupt_request & CPU_INTERRUPT_HARD) {
-        CPULoongArchState *env = cpu_env(cs);
-
-        if (cpu_loongarch_hw_interrupts_enabled(env) &&
-            cpu_loongarch_hw_interrupts_pending(env)) {
-            /* Raise it */
-            cs->exception_index = EXCCODE_INT;
-            loongarch_cpu_do_interrupt(cs);
-            return true;
-        }
-    }
-    return false;
-}
-
-static vaddr loongarch_pointer_wrap(CPUState *cs, int mmu_idx,
-                                    vaddr result, vaddr base)
-{
-    return is_va32(cpu_env(cs)) ? (uint32_t)result : result;
-}
-#endif
-
-static TCGTBCPUState loongarch_get_tb_cpu_state(CPUState *cs)
-{
-    CPULoongArchState *env = cpu_env(cs);
-    uint32_t flags;
-
-    flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
-    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
-    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
-    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
-    flags |= is_va32(env) * HW_FLAGS_VA32;
-
-    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
-}
-
-static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
-                                              const TranslationBlock *tb)
-{
-    tcg_debug_assert(!tcg_cflags_has(cs, CF_PCREL));
-    set_pc(cpu_env(cs), tb->pc);
-}
-
-static void loongarch_restore_state_to_opc(CPUState *cs,
-                                           const TranslationBlock *tb,
-                                           const uint64_t *data)
-{
-    set_pc(cpu_env(cs), data[0]);
-}
-#endif /* CONFIG_TCG */
-
-#ifndef CONFIG_USER_ONLY
-static bool loongarch_cpu_has_work(CPUState *cs)
+bool loongarch_cpu_has_work(CPUState *cs)
 {
     bool has_work = false;
 
@@ -386,16 +162,6 @@ static bool loongarch_cpu_has_work(CPUState *cs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
-static int loongarch_cpu_mmu_index(CPUState *cs, bool ifetch)
-{
-    CPULoongArchState *env = cpu_env(cs);
-
-    if (FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PG)) {
-        return FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV);
-    }
-    return MMU_DA_IDX;
-}
-
 static void loongarch_la464_init_csr(Object *obj)
 {
 #ifndef CONFIG_USER_ONLY
@@ -911,30 +677,6 @@ static void loongarch_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 }
 
-#ifdef CONFIG_TCG
-static const TCGCPUOps loongarch_tcg_ops = {
-    .guest_default_memory_order = 0,
-    .mttcg_supported = true,
-
-    .initialize = loongarch_translate_init,
-    .translate_code = loongarch_translate_code,
-    .get_tb_cpu_state = loongarch_get_tb_cpu_state,
-    .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
-    .restore_state_to_opc = loongarch_restore_state_to_opc,
-    .mmu_index = loongarch_cpu_mmu_index,
-
-#ifndef CONFIG_USER_ONLY
-    .tlb_fill = loongarch_cpu_tlb_fill,
-    .pointer_wrap = loongarch_pointer_wrap,
-    .cpu_exec_interrupt = loongarch_cpu_exec_interrupt,
-    .cpu_exec_halt = loongarch_cpu_has_work,
-    .cpu_exec_reset = cpu_reset,
-    .do_interrupt = loongarch_cpu_do_interrupt,
-    .do_transaction_failed = loongarch_cpu_do_transaction_failed,
-#endif
-};
-#endif /* CONFIG_TCG */
-
 #ifndef CONFIG_USER_ONLY
 #include "hw/core/sysemu-cpu-ops.h"
 
diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index e50d109767..e994f5a3d3 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -41,6 +41,8 @@ uint64_t cpu_loongarch_get_constant_timer_counter(LoongArchCPU *cpu);
 uint64_t cpu_loongarch_get_constant_timer_ticks(LoongArchCPU *cpu);
 void cpu_loongarch_store_constant_timer_config(LoongArchCPU *cpu,
                                                uint64_t value);
+bool loongarch_cpu_has_work(CPUState *cs);
+bool cpu_loongarch_hw_interrupts_pending(CPULoongArchState *env);
 #endif /* !CONFIG_USER_ONLY */
 
 uint64_t read_fcc(CPULoongArchState *env);
diff --git a/target/loongarch/tcg/meson.build b/target/loongarch/tcg/meson.build
index bdf34f9673..b7adfe46f1 100644
--- a/target/loongarch/tcg/meson.build
+++ b/target/loongarch/tcg/meson.build
@@ -7,6 +7,7 @@ loongarch_ss.add([zlib, gen])
 loongarch_ss.add(files(
   'fpu_helper.c',
   'op_helper.c',
+  'tcg_cpu.c',
   'translate.c',
   'vec_helper.c',
 ))
diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
new file mode 100644
index 0000000000..c7f49838e3
--- /dev/null
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -0,0 +1,266 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * LoongArch CPU parameters for QEMU.
+ *
+ * Copyright (c) 2025 Loongson Technology Corporation Limited
+ */
+#include "qemu/osdep.h"
+#include "qemu/accel.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "accel/accel-cpu-target.h"
+#include "accel/tcg/cpu-ldst.h"
+#include "accel/tcg/cpu-ops.h"
+#include "exec/translation-block.h"
+#include "exec/target_page.h"
+#include "tcg_loongarch.h"
+#include "internals.h"
+
+#ifndef CONFIG_USER_ONLY
+static void loongarch_cpu_do_interrupt(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    bool update_badinstr = 1;
+    int cause = -1;
+    bool tlbfill = FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR);
+    uint32_t vec_size = FIELD_EX64(env->CSR_ECFG, CSR_ECFG, VS);
+
+    if (cs->exception_index != EXCCODE_INT) {
+        qemu_log_mask(CPU_LOG_INT,
+                     "%s enter: pc " TARGET_FMT_lx " ERA " TARGET_FMT_lx
+                     " TLBRERA " TARGET_FMT_lx " exception: %d (%s)\n",
+                     __func__, env->pc, env->CSR_ERA, env->CSR_TLBRERA,
+                     cs->exception_index,
+                     loongarch_exception_name(cs->exception_index));
+    }
+
+    switch (cs->exception_index) {
+    case EXCCODE_DBP:
+        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DCL, 1);
+        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, ECODE, 0xC);
+        goto set_DERA;
+    set_DERA:
+        env->CSR_DERA = env->pc;
+        env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DST, 1);
+        set_pc(env, env->CSR_EENTRY + 0x480);
+        break;
+    case EXCCODE_INT:
+        if (FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)) {
+            env->CSR_DBG = FIELD_DP64(env->CSR_DBG, CSR_DBG, DEI, 1);
+            goto set_DERA;
+        }
+        QEMU_FALLTHROUGH;
+    case EXCCODE_PIF:
+    case EXCCODE_ADEF:
+        cause = cs->exception_index;
+        update_badinstr = 0;
+        break;
+    case EXCCODE_SYS:
+    case EXCCODE_BRK:
+    case EXCCODE_INE:
+    case EXCCODE_IPE:
+    case EXCCODE_FPD:
+    case EXCCODE_FPE:
+    case EXCCODE_SXD:
+    case EXCCODE_ASXD:
+        env->CSR_BADV = env->pc;
+        QEMU_FALLTHROUGH;
+    case EXCCODE_BCE:
+    case EXCCODE_ADEM:
+    case EXCCODE_PIL:
+    case EXCCODE_PIS:
+    case EXCCODE_PME:
+    case EXCCODE_PNR:
+    case EXCCODE_PNX:
+    case EXCCODE_PPI:
+        cause = cs->exception_index;
+        break;
+    default:
+        qemu_log("Error: exception(%d) has not been supported\n",
+                 cs->exception_index);
+        abort();
+    }
+
+    if (update_badinstr) {
+        env->CSR_BADI = cpu_ldl_code(env, env->pc);
+    }
+
+    /* Save PLV and IE */
+    if (tlbfill) {
+        env->CSR_TLBRPRMD = FIELD_DP64(env->CSR_TLBRPRMD, CSR_TLBRPRMD, PPLV,
+                                       FIELD_EX64(env->CSR_CRMD,
+                                       CSR_CRMD, PLV));
+        env->CSR_TLBRPRMD = FIELD_DP64(env->CSR_TLBRPRMD, CSR_TLBRPRMD, PIE,
+                                       FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE));
+        /* set the DA mode */
+        env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, DA, 1);
+        env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, PG, 0);
+        env->CSR_TLBRERA = FIELD_DP64(env->CSR_TLBRERA, CSR_TLBRERA,
+                                      PC, (env->pc >> 2));
+    } else {
+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ECODE,
+                                    EXCODE_MCODE(cause));
+        env->CSR_ESTAT = FIELD_DP64(env->CSR_ESTAT, CSR_ESTAT, ESUBCODE,
+                                    EXCODE_SUBCODE(cause));
+        env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PPLV,
+                                   FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV));
+        env->CSR_PRMD = FIELD_DP64(env->CSR_PRMD, CSR_PRMD, PIE,
+                                   FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE));
+        env->CSR_ERA = env->pc;
+    }
+
+    env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, PLV, 0);
+    env->CSR_CRMD = FIELD_DP64(env->CSR_CRMD, CSR_CRMD, IE, 0);
+
+    if (vec_size) {
+        vec_size = (1 << vec_size) * 4;
+    }
+
+    if  (cs->exception_index == EXCCODE_INT) {
+        /* Interrupt */
+        uint32_t vector = 0;
+        uint32_t pending = FIELD_EX64(env->CSR_ESTAT, CSR_ESTAT, IS);
+        pending &= FIELD_EX64(env->CSR_ECFG, CSR_ECFG, LIE);
+
+        /* Find the highest-priority interrupt. */
+        vector = 31 - clz32(pending);
+        set_pc(env, env->CSR_EENTRY + \
+               (EXCCODE_EXTERNAL_INT + vector) * vec_size);
+        qemu_log_mask(CPU_LOG_INT,
+                      "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
+                      " cause %d\n" "    A " TARGET_FMT_lx " D "
+                      TARGET_FMT_lx " vector = %d ExC " TARGET_FMT_lx "ExS"
+                      TARGET_FMT_lx "\n",
+                      __func__, env->pc, env->CSR_ERA,
+                      cause, env->CSR_BADV, env->CSR_DERA, vector,
+                      env->CSR_ECFG, env->CSR_ESTAT);
+    } else {
+        if (tlbfill) {
+            set_pc(env, env->CSR_TLBRENTRY);
+        } else {
+            set_pc(env, env->CSR_EENTRY + EXCODE_MCODE(cause) * vec_size);
+        }
+        qemu_log_mask(CPU_LOG_INT,
+                      "%s: PC " TARGET_FMT_lx " ERA " TARGET_FMT_lx
+                      " cause %d%s\n, ESTAT " TARGET_FMT_lx
+                      " EXCFG " TARGET_FMT_lx " BADVA " TARGET_FMT_lx
+                      "BADI " TARGET_FMT_lx " SYS_NUM " TARGET_FMT_lu
+                      " cpu %d asid " TARGET_FMT_lx "\n", __func__, env->pc,
+                      tlbfill ? env->CSR_TLBRERA : env->CSR_ERA,
+                      cause, tlbfill ? "(refill)" : "", env->CSR_ESTAT,
+                      env->CSR_ECFG,
+                      tlbfill ? env->CSR_TLBRBADV : env->CSR_BADV,
+                      env->CSR_BADI, env->gpr[11], cs->cpu_index,
+                      env->CSR_ASID);
+    }
+    cs->exception_index = -1;
+}
+
+static void loongarch_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
+                                                vaddr addr, unsigned size,
+                                                MMUAccessType access_type,
+                                                int mmu_idx, MemTxAttrs attrs,
+                                                MemTxResult response,
+                                                uintptr_t retaddr)
+{
+    CPULoongArchState *env = cpu_env(cs);
+
+    if (access_type == MMU_INST_FETCH) {
+        do_raise_exception(env, EXCCODE_ADEF, retaddr);
+    } else {
+        do_raise_exception(env, EXCCODE_ADEM, retaddr);
+    }
+}
+
+static inline bool cpu_loongarch_hw_interrupts_enabled(CPULoongArchState *env)
+{
+    bool ret = 0;
+
+    ret = (FIELD_EX64(env->CSR_CRMD, CSR_CRMD, IE) &&
+          !(FIELD_EX64(env->CSR_DBG, CSR_DBG, DST)));
+
+    return ret;
+}
+
+static bool loongarch_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
+{
+    if (interrupt_request & CPU_INTERRUPT_HARD) {
+        CPULoongArchState *env = cpu_env(cs);
+
+        if (cpu_loongarch_hw_interrupts_enabled(env) &&
+            cpu_loongarch_hw_interrupts_pending(env)) {
+            /* Raise it */
+            cs->exception_index = EXCCODE_INT;
+            loongarch_cpu_do_interrupt(cs);
+            return true;
+        }
+    }
+    return false;
+}
+
+static vaddr loongarch_pointer_wrap(CPUState *cs, int mmu_idx,
+                                    vaddr result, vaddr base)
+{
+    return is_va32(cpu_env(cs)) ? (uint32_t)result : result;
+}
+#endif
+
+static TCGTBCPUState loongarch_get_tb_cpu_state(CPUState *cs)
+{
+    CPULoongArchState *env = cpu_env(cs);
+    uint32_t flags;
+
+    flags = env->CSR_CRMD & (R_CSR_CRMD_PLV_MASK | R_CSR_CRMD_PG_MASK);
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, FPE) * HW_FLAGS_EUEN_FPE;
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, SXE) * HW_FLAGS_EUEN_SXE;
+    flags |= FIELD_EX64(env->CSR_EUEN, CSR_EUEN, ASXE) * HW_FLAGS_EUEN_ASXE;
+    flags |= is_va32(env) * HW_FLAGS_VA32;
+
+    return (TCGTBCPUState){ .pc = env->pc, .flags = flags };
+}
+
+static void loongarch_cpu_synchronize_from_tb(CPUState *cs,
+                                              const TranslationBlock *tb)
+{
+    tcg_debug_assert(!tcg_cflags_has(cs, CF_PCREL));
+    set_pc(cpu_env(cs), tb->pc);
+}
+
+static void loongarch_restore_state_to_opc(CPUState *cs,
+                                           const TranslationBlock *tb,
+                                           const uint64_t *data)
+{
+    set_pc(cpu_env(cs), data[0]);
+}
+
+static int loongarch_cpu_mmu_index(CPUState *cs, bool ifetch)
+{
+    CPULoongArchState *env = cpu_env(cs);
+
+    if (FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PG)) {
+        return FIELD_EX64(env->CSR_CRMD, CSR_CRMD, PLV);
+    }
+    return MMU_DA_IDX;
+}
+
+const TCGCPUOps loongarch_tcg_ops = {
+    .guest_default_memory_order = 0,
+    .mttcg_supported = true,
+
+    .initialize = loongarch_translate_init,
+    .translate_code = loongarch_translate_code,
+    .get_tb_cpu_state = loongarch_get_tb_cpu_state,
+    .synchronize_from_tb = loongarch_cpu_synchronize_from_tb,
+    .restore_state_to_opc = loongarch_restore_state_to_opc,
+    .mmu_index = loongarch_cpu_mmu_index,
+
+#ifndef CONFIG_USER_ONLY
+    .tlb_fill = loongarch_cpu_tlb_fill,
+    .pointer_wrap = loongarch_pointer_wrap,
+    .cpu_exec_interrupt = loongarch_cpu_exec_interrupt,
+    .cpu_exec_halt = loongarch_cpu_has_work,
+    .cpu_exec_reset = cpu_reset,
+    .do_interrupt = loongarch_cpu_do_interrupt,
+    .do_transaction_failed = loongarch_cpu_do_transaction_failed,
+#endif
+};
diff --git a/target/loongarch/tcg/tcg_loongarch.h b/target/loongarch/tcg/tcg_loongarch.h
index 47702893e3..7fb627f2d6 100644
--- a/target/loongarch/tcg/tcg_loongarch.h
+++ b/target/loongarch/tcg/tcg_loongarch.h
@@ -9,6 +9,7 @@
 #include "cpu.h"
 #include "cpu-mmu.h"
 
+extern const TCGCPUOps loongarch_tcg_ops;
 void loongarch_csr_translate_init(void);
 
 bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,

From 29332340e14738998a7ebcb62c5c9a310e8fb455 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 29 Sep 2025 11:53:37 +0800
Subject: [PATCH 1173/2396] target/loongarch: Move function
 do_raise_exception() to tcg_cpu.c

Function do_raise_exception() is specified with TCG mode, so move
it to file target/loongarch/tcg/tcg_cpu.c

It is only code movement and there is no any function change.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250929035338.2320419-3-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c         | 56 ----------------------------------
 target/loongarch/tcg/tcg_cpu.c | 56 ++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+), 56 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 245c6d3ab9..86490e0f72 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -44,62 +44,6 @@ const char * const fregnames[32] = {
     "f24", "f25", "f26", "f27", "f28", "f29", "f30", "f31",
 };
 
-struct TypeExcp {
-    int32_t exccode;
-    const char * const name;
-};
-
-static const struct TypeExcp excp_names[] = {
-    {EXCCODE_INT, "Interrupt"},
-    {EXCCODE_PIL, "Page invalid exception for load"},
-    {EXCCODE_PIS, "Page invalid exception for store"},
-    {EXCCODE_PIF, "Page invalid exception for fetch"},
-    {EXCCODE_PME, "Page modified exception"},
-    {EXCCODE_PNR, "Page Not Readable exception"},
-    {EXCCODE_PNX, "Page Not Executable exception"},
-    {EXCCODE_PPI, "Page Privilege error"},
-    {EXCCODE_ADEF, "Address error for instruction fetch"},
-    {EXCCODE_ADEM, "Address error for Memory access"},
-    {EXCCODE_SYS, "Syscall"},
-    {EXCCODE_BRK, "Break"},
-    {EXCCODE_INE, "Instruction Non-Existent"},
-    {EXCCODE_IPE, "Instruction privilege error"},
-    {EXCCODE_FPD, "Floating Point Disabled"},
-    {EXCCODE_FPE, "Floating Point Exception"},
-    {EXCCODE_DBP, "Debug breakpoint"},
-    {EXCCODE_BCE, "Bound Check Exception"},
-    {EXCCODE_SXD, "128 bit vector instructions Disable exception"},
-    {EXCCODE_ASXD, "256 bit vector instructions Disable exception"},
-    {EXCP_HLT, "EXCP_HLT"},
-};
-
-const char *loongarch_exception_name(int32_t exception)
-{
-    int i;
-
-    for (i = 0; i < ARRAY_SIZE(excp_names); i++) {
-        if (excp_names[i].exccode == exception) {
-            return excp_names[i].name;
-        }
-    }
-    return "Unknown";
-}
-
-void G_NORETURN do_raise_exception(CPULoongArchState *env,
-                                   uint32_t exception,
-                                   uintptr_t pc)
-{
-    CPUState *cs = env_cpu(env);
-
-    qemu_log_mask(CPU_LOG_INT, "%s: exception: %d (%s)\n",
-                  __func__,
-                  exception,
-                  loongarch_exception_name(exception));
-    cs->exception_index = exception;
-
-    cpu_loop_exit_restore(cs, pc);
-}
-
 static void loongarch_cpu_set_pc(CPUState *cs, vaddr value)
 {
     set_pc(cpu_env(cs), value);
diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index c7f49838e3..59b5800ecf 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -16,6 +16,62 @@
 #include "tcg_loongarch.h"
 #include "internals.h"
 
+struct TypeExcp {
+    int32_t exccode;
+    const char * const name;
+};
+
+static const struct TypeExcp excp_names[] = {
+    {EXCCODE_INT, "Interrupt"},
+    {EXCCODE_PIL, "Page invalid exception for load"},
+    {EXCCODE_PIS, "Page invalid exception for store"},
+    {EXCCODE_PIF, "Page invalid exception for fetch"},
+    {EXCCODE_PME, "Page modified exception"},
+    {EXCCODE_PNR, "Page Not Readable exception"},
+    {EXCCODE_PNX, "Page Not Executable exception"},
+    {EXCCODE_PPI, "Page Privilege error"},
+    {EXCCODE_ADEF, "Address error for instruction fetch"},
+    {EXCCODE_ADEM, "Address error for Memory access"},
+    {EXCCODE_SYS, "Syscall"},
+    {EXCCODE_BRK, "Break"},
+    {EXCCODE_INE, "Instruction Non-Existent"},
+    {EXCCODE_IPE, "Instruction privilege error"},
+    {EXCCODE_FPD, "Floating Point Disabled"},
+    {EXCCODE_FPE, "Floating Point Exception"},
+    {EXCCODE_DBP, "Debug breakpoint"},
+    {EXCCODE_BCE, "Bound Check Exception"},
+    {EXCCODE_SXD, "128 bit vector instructions Disable exception"},
+    {EXCCODE_ASXD, "256 bit vector instructions Disable exception"},
+    {EXCP_HLT, "EXCP_HLT"},
+};
+
+const char *loongarch_exception_name(int32_t exception)
+{
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(excp_names); i++) {
+        if (excp_names[i].exccode == exception) {
+            return excp_names[i].name;
+        }
+    }
+    return "Unknown";
+}
+
+void G_NORETURN do_raise_exception(CPULoongArchState *env,
+                                   uint32_t exception,
+                                   uintptr_t pc)
+{
+    CPUState *cs = env_cpu(env);
+
+    qemu_log_mask(CPU_LOG_INT, "%s: exception: %d (%s)\n",
+                  __func__,
+                  exception,
+                  loongarch_exception_name(exception));
+    cs->exception_index = exception;
+
+    cpu_loop_exit_restore(cs, pc);
+}
+
 #ifndef CONFIG_USER_ONLY
 static void loongarch_cpu_do_interrupt(CPUState *cs)
 {

From fa6af7f6bf6dbc4c83595905d2572ad86358aa67 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 29 Sep 2025 11:53:38 +0800
Subject: [PATCH 1174/2396] target/loongarch: Define loongarch_exception_name()
 as static

Function loongarch_exception_name() is only called in defined file
target/loongarch/tcg/tcg_cpu.c, set this function as static.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250929035338.2320419-4-maobibo@loongson.cn>
Signed-off-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/internals.h   | 2 --
 target/loongarch/tcg/tcg_cpu.c | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/target/loongarch/internals.h b/target/loongarch/internals.h
index e994f5a3d3..8793bd9df6 100644
--- a/target/loongarch/internals.h
+++ b/target/loongarch/internals.h
@@ -24,8 +24,6 @@ void G_NORETURN do_raise_exception(CPULoongArchState *env,
                                    uint32_t exception,
                                    uintptr_t pc);
 
-const char *loongarch_exception_name(int32_t exception);
-
 #ifdef CONFIG_TCG
 int ieee_ex_to_loongarch(int xcpt);
 void restore_fp_status(CPULoongArchState *env);
diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index 59b5800ecf..82b54e6dc3 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -45,7 +45,7 @@ static const struct TypeExcp excp_names[] = {
     {EXCP_HLT, "EXCP_HLT"},
 };
 
-const char *loongarch_exception_name(int32_t exception)
+static const char *loongarch_exception_name(int32_t exception)
 {
     int i;
 

From 18beee5c6bb875ec5a1455e5e7118338701e2a16 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 9 Oct 2025 23:05:08 +0200
Subject: [PATCH 1175/2396] rust: pl011: fix warning with new clippy

Newer versions of clippy are able to see that all the variants in
the PL011 word length enum end with "Bits", and complain about it.
Allow it.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/registers.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/hw/char/pl011/src/registers.rs b/rust/hw/char/pl011/src/registers.rs
index 0c3a4d7d21..fa572811b2 100644
--- a/rust/hw/char/pl011/src/registers.rs
+++ b/rust/hw/char/pl011/src/registers.rs
@@ -255,6 +255,7 @@ pub enum Mode {
 
 #[bitsize(2)]
 #[derive(Clone, Copy, Debug, Eq, FromBits, PartialEq)]
+#[allow(clippy::enum_variant_names)]
 /// `WLEN` Word length, field of [Line Control register](LineControl).
 ///
 /// These bits indicate the number of data bits transmitted or received in a

From 314a31ea0ba06160a54972ecf08ae56bc0c6b094 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 6 Oct 2025 19:03:04 +0200
Subject: [PATCH 1176/2396] tests/functional: Drop the "Attempting to cache
 ..." log text
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The fetch() function already either prints "Using cached asset ..."
or "Downloading ... to ..." with the same file name to the log,
so the "Attempting to cache ..." message does not provide any
additional valuable information. Thus let's drop it to limit the
length of the logging output to a more reasonable size.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251006170304.197387-1-thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index 2971a989d1..f666125bfa 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -225,7 +225,6 @@ class Asset:
         log.addHandler(handler)
         for name, asset in vars(test.__class__).items():
             if name.startswith("ASSET_") and type(asset) == Asset:
-                log.info("Attempting to cache '%s'" % asset)
                 try:
                     asset.fetch()
                 except AssetError as e:

From 8dd912b042f47bb0468f097df708cf2fab2af614 Mon Sep 17 00:00:00 2001
From: Jaehoon Kim <jhkim@linux.ibm.com>
Date: Wed, 1 Oct 2025 10:39:38 -0500
Subject: [PATCH 1177/2396] s390x/pci: fix interrupt blocking by returning only
 the device's summary bit

Previously, set_ind_atomic() returned the entire byte containing
multiple summary bits. This meant that if any other summary bit in the
byte was set, interrupt injection could be incorrectly blocked, even
when the current device's summary bit was not set. As a result, the
guest could remain blocked after I/O completion during FIO tests.

This patch replaces set_ind_atomic() with set_ind_bit_atomic(), which
returns true if the bit was set by this function, and false if it was
already set or mapping failed. Interrupts are now blocked only when
the device's own summary bit was not previously set, avoiding
unintended blocking when multiple PCI summary bits exist within the
same byte.

Signed-off-by: Jaehoon Kim <jhkim@linux.ibm.com>
Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Matthew Rosato <mjrosato@linux.ibm.com>
Message-ID: <20251001154004.71917-1-jhkim@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-pci-bus.c | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index f87d2748b6..e8e41c8a9a 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -652,7 +652,16 @@ static const PCIIOMMUOps s390_iommu_ops = {
     .get_address_space = s390_pci_dma_iommu,
 };
 
-static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
+/**
+ * set_ind_bit_atomic - Atomically set a bit in an indicator
+ *
+ * @ind_loc:   Address of the indicator
+ * @to_be_set: Bit to set
+ *
+ * Returns true if the bit was set by this function, false if it was
+ * already set or mapping failed.
+ */
+static bool set_ind_bit_atomic(uint64_t ind_loc, uint8_t to_be_set)
 {
     uint8_t expected, actual;
     hwaddr len = 1;
@@ -662,7 +671,7 @@ static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
     ind_addr = cpu_physical_memory_map(ind_loc, &len, true);
     if (!ind_addr) {
         s390_pci_generate_error_event(ERR_EVENT_AIRERR, 0, 0, 0, 0);
-        return -1;
+        return false;
     }
     actual = *ind_addr;
     do {
@@ -671,7 +680,7 @@ static uint8_t set_ind_atomic(uint64_t ind_loc, uint8_t to_be_set)
     } while (actual != expected);
     cpu_physical_memory_unmap((void *)ind_addr, len, 1, len);
 
-    return actual;
+    return (actual & to_be_set) ? false : true;
 }
 
 static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
@@ -693,10 +702,10 @@ static void s390_msi_ctrl_write(void *opaque, hwaddr addr, uint64_t data,
     ind_bit = pbdev->routes.adapter.ind_offset;
     sum_bit = pbdev->routes.adapter.summary_offset;
 
-    set_ind_atomic(pbdev->routes.adapter.ind_addr + (ind_bit + vec) / 8,
+    set_ind_bit_atomic(pbdev->routes.adapter.ind_addr + (ind_bit + vec) / 8,
                    0x80 >> ((ind_bit + vec) % 8));
-    if (!set_ind_atomic(pbdev->routes.adapter.summary_addr + sum_bit / 8,
-                                       0x80 >> (sum_bit % 8))) {
+    if (set_ind_bit_atomic(pbdev->routes.adapter.summary_addr + sum_bit / 8,
+                   0x80 >> (sum_bit % 8))) {
         css_adapter_interrupt(CSS_IO_ADAPTER_PCI, pbdev->isc);
     }
 }

From d24ac20c6a86b32d64b90a90693c97086eba0f33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:27 +0200
Subject: [PATCH 1178/2396] target/s390x: Replace legacy
 cpu_physical_memory_[un]map() calls (1/3)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Replace the *_map() / *_unmap() methods in mchk_store_vregs().
No behavioral change expected.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251002091132.65703-5-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/excp_helper.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 4c7faeee82..5e1d4dc958 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -30,6 +30,7 @@
 #ifndef CONFIG_USER_ONLY
 #include "qemu/timer.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "hw/s390x/ioinst.h"
 #include "hw/s390x/s390_flic.h"
 #include "hw/boards.h"
@@ -418,16 +419,18 @@ QEMU_BUILD_BUG_ON(sizeof(MchkExtSaveArea) != 1024);
 
 static int mchk_store_vregs(CPUS390XState *env, uint64_t mcesao)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+    AddressSpace *as = env_cpu(env)->as;
     hwaddr len = sizeof(MchkExtSaveArea);
     MchkExtSaveArea *sa;
     int i;
 
-    sa = cpu_physical_memory_map(mcesao, &len, true);
+    sa = address_space_map(as, mcesao, &len, true, attrs);
     if (!sa) {
         return -EFAULT;
     }
     if (len != sizeof(MchkExtSaveArea)) {
-        cpu_physical_memory_unmap(sa, len, 1, 0);
+        address_space_unmap(as, sa, len, true, 0);
         return -EFAULT;
     }
 
@@ -436,7 +439,7 @@ static int mchk_store_vregs(CPUS390XState *env, uint64_t mcesao)
         sa->vregs[i][1] = cpu_to_be64(env->vregs[i][1]);
     }
 
-    cpu_physical_memory_unmap(sa, len, 1, len);
+    address_space_unmap(as, sa, len, true, len);
     return 0;
 }
 

From c35b166c1dc2d0332d2199ea8f36cf4eaa9eda35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:28 +0200
Subject: [PATCH 1179/2396] target/s390x: Propagate CPUS390XState to
 cpu_unmap_lowcore()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

To be able to access the CPU state in cpu_unmap_lowcore()
in the next commit, propagate it as argument.
cpu_map_lowcore() already takes it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-6-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/helper.c          |  4 ++--
 target/s390x/s390x-internal.h  |  2 +-
 target/s390x/tcg/excp_helper.c | 10 +++++-----
 target/s390x/tcg/misc_helper.c |  4 ++--
 4 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index 5c127da1a6..a6d4a1ce05 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -117,7 +117,7 @@ LowCore *cpu_map_lowcore(CPUS390XState *env)
     return lowcore;
 }
 
-void cpu_unmap_lowcore(LowCore *lowcore)
+void cpu_unmap_lowcore(CPUS390XState *env, LowCore *lowcore)
 {
     cpu_physical_memory_unmap(lowcore, sizeof(LowCore), 1, sizeof(LowCore));
 }
@@ -134,7 +134,7 @@ void do_restart_interrupt(CPUS390XState *env)
     mask = be64_to_cpu(lowcore->restart_new_psw.mask);
     addr = be64_to_cpu(lowcore->restart_new_psw.addr);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
     env->pending_int &= ~INTERRUPT_RESTART;
 
     s390_cpu_set_psw(env, mask, addr);
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index 56cce2e7f5..1fb752aa1d 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -327,7 +327,7 @@ hwaddr s390_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
 int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch);
 int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len);
 LowCore *cpu_map_lowcore(CPUS390XState *env);
-void cpu_unmap_lowcore(LowCore *lowcore);
+void cpu_unmap_lowcore(CPUS390XState *env, LowCore *lowcore);
 #endif /* CONFIG_USER_ONLY */
 
 
diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 5e1d4dc958..0ae4e26606 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -285,7 +285,7 @@ static void do_program_interrupt(CPUS390XState *env)
     addr = be64_to_cpu(lowcore->program_new_psw.addr);
     lowcore->per_breaking_event_addr = cpu_to_be64(env->gbea);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
 
     s390_cpu_set_psw(env, mask, addr);
 }
@@ -304,7 +304,7 @@ static void do_svc_interrupt(CPUS390XState *env)
     mask = be64_to_cpu(lowcore->svc_new_psw.mask);
     addr = be64_to_cpu(lowcore->svc_new_psw.addr);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
 
     s390_cpu_set_psw(env, mask, addr);
 
@@ -378,7 +378,7 @@ static void do_ext_interrupt(CPUS390XState *env)
     lowcore->external_old_psw.mask = cpu_to_be64(s390_cpu_get_psw_mask(env));
     lowcore->external_old_psw.addr = cpu_to_be64(env->psw.addr);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
 
     s390_cpu_set_psw(env, mask, addr);
 }
@@ -405,7 +405,7 @@ static void do_io_interrupt(CPUS390XState *env)
     mask = be64_to_cpu(lowcore->io_new_psw.mask);
     addr = be64_to_cpu(lowcore->io_new_psw.addr);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
     g_free(io);
 
     s390_cpu_set_psw(env, mask, addr);
@@ -491,7 +491,7 @@ static void do_mchk_interrupt(CPUS390XState *env)
     mask = be64_to_cpu(lowcore->mcck_new_psw.mask);
     addr = be64_to_cpu(lowcore->mcck_new_psw.addr);
 
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
 
     s390_cpu_set_psw(env, mask, addr);
 }
diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index f7101be574..6d9d601d29 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -570,7 +570,7 @@ uint32_t HELPER(tpi)(CPUS390XState *env, uint64_t addr)
         lowcore->subchannel_nr = cpu_to_be16(io->nr);
         lowcore->io_int_parm = cpu_to_be32(io->parm);
         lowcore->io_int_word = cpu_to_be32(io->word);
-        cpu_unmap_lowcore(lowcore);
+        cpu_unmap_lowcore(env, lowcore);
     }
 
     g_free(io);
@@ -700,7 +700,7 @@ void HELPER(stfl)(CPUS390XState *env)
     lowcore = cpu_map_lowcore(env);
     prepare_stfl();
     memcpy(&lowcore->stfl_fac_list, stfl_bytes, sizeof(lowcore->stfl_fac_list));
-    cpu_unmap_lowcore(lowcore);
+    cpu_unmap_lowcore(env, lowcore);
 }
 #endif
 

From 64321858d0735191b6160ba78f2282a67df6d9d9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:29 +0200
Subject: [PATCH 1180/2396] target/s390x: Replace legacy
 cpu_physical_memory_[un]map() calls (2/3)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Replace the *_map() / *_unmap() methods in cpu_[un]map_lowcore().
No behavioral change expected.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-7-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/helper.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index a6d4a1ce05..b01b7d9bbb 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -26,6 +26,7 @@
 #include "hw/s390x/ioinst.h"
 #include "target/s390x/kvm/pv.h"
 #include "system/hw_accel.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 #include "exec/target_page.h"
 #include "exec/watchpoint.h"
@@ -107,11 +108,13 @@ LowCore *cpu_map_lowcore(CPUS390XState *env)
 {
     LowCore *lowcore;
     hwaddr len = sizeof(LowCore);
+    CPUState *cs = env_cpu(env);
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
 
-    lowcore = cpu_physical_memory_map(env->psa, &len, true);
+    lowcore = address_space_map(cs->as, env->psa, &len, true, attrs);
 
     if (len < sizeof(LowCore)) {
-        cpu_abort(env_cpu(env), "Could not map lowcore\n");
+        cpu_abort(cs, "Could not map lowcore\n");
     }
 
     return lowcore;
@@ -119,7 +122,9 @@ LowCore *cpu_map_lowcore(CPUS390XState *env)
 
 void cpu_unmap_lowcore(CPUS390XState *env, LowCore *lowcore)
 {
-    cpu_physical_memory_unmap(lowcore, sizeof(LowCore), 1, sizeof(LowCore));
+    AddressSpace *as = env_cpu(env)->as;
+
+    address_space_unmap(as, lowcore, sizeof(LowCore), true, sizeof(LowCore));
 }
 
 void do_restart_interrupt(CPUS390XState *env)

From 1819902285177c8781ab4ef92cc44e0882c0dec5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:30 +0200
Subject: [PATCH 1181/2396] target/s390x: Reduce s390_store_adtl_status() scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

s390_store_adtl_status() is only called within sigp.c,
move it and the SigpAdtlSaveArea structure definition
there where it belongs, with other SIGP handling code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-8-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/helper.c         | 40 -----------------------------------
 target/s390x/s390x-internal.h |  1 -
 target/s390x/sigp.c           | 40 +++++++++++++++++++++++++++++++++++
 3 files changed, 40 insertions(+), 41 deletions(-)

diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index b01b7d9bbb..84321e1d68 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -248,43 +248,3 @@ int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
 
     return 0;
 }
-
-typedef struct SigpAdtlSaveArea {
-    uint64_t    vregs[32][2];                     /* 0x0000 */
-    uint8_t     pad_0x0200[0x0400 - 0x0200];      /* 0x0200 */
-    uint64_t    gscb[4];                          /* 0x0400 */
-    uint8_t     pad_0x0420[0x1000 - 0x0420];      /* 0x0420 */
-} SigpAdtlSaveArea;
-QEMU_BUILD_BUG_ON(sizeof(SigpAdtlSaveArea) != 4096);
-
-#define ADTL_GS_MIN_SIZE 2048 /* minimal size of adtl save area for GS */
-int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len)
-{
-    SigpAdtlSaveArea *sa;
-    hwaddr save = len;
-    int i;
-
-    sa = cpu_physical_memory_map(addr, &save, true);
-    if (!sa) {
-        return -EFAULT;
-    }
-    if (save != len) {
-        cpu_physical_memory_unmap(sa, len, 1, 0);
-        return -EFAULT;
-    }
-
-    if (s390_has_feat(S390_FEAT_VECTOR)) {
-        for (i = 0; i < 32; i++) {
-            sa->vregs[i][0] = cpu_to_be64(cpu->env.vregs[i][0]);
-            sa->vregs[i][1] = cpu_to_be64(cpu->env.vregs[i][1]);
-        }
-    }
-    if (s390_has_feat(S390_FEAT_GUARDED_STORAGE) && len >= ADTL_GS_MIN_SIZE) {
-        for (i = 0; i < 4; i++) {
-            sa->gscb[i] = cpu_to_be64(cpu->env.gscb[i]);
-        }
-    }
-
-    cpu_physical_memory_unmap(sa, len, 1, len);
-    return 0;
-}
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index 1fb752aa1d..a49dca94a7 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -325,7 +325,6 @@ hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 hwaddr s390_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
 #define S390_STORE_STATUS_DEF_ADDR offsetof(LowCore, floating_pt_save_area)
 int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch);
-int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len);
 LowCore *cpu_map_lowcore(CPUS390XState *env);
 void cpu_unmap_lowcore(CPUS390XState *env, LowCore *lowcore);
 #endif /* CONFIG_USER_ONLY */
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index 5e95c4978f..1464be7698 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -172,6 +172,46 @@ static void sigp_store_status_at_address(CPUState *cs, run_on_cpu_data arg)
     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
 }
 
+typedef struct SigpAdtlSaveArea {
+    uint64_t    vregs[32][2];                     /* 0x0000 */
+    uint8_t     pad_0x0200[0x0400 - 0x0200];      /* 0x0200 */
+    uint64_t    gscb[4];                          /* 0x0400 */
+    uint8_t     pad_0x0420[0x1000 - 0x0420];      /* 0x0420 */
+} SigpAdtlSaveArea;
+QEMU_BUILD_BUG_ON(sizeof(SigpAdtlSaveArea) != 4096);
+
+#define ADTL_GS_MIN_SIZE 2048 /* minimal size of adtl save area for GS */
+static int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len)
+{
+    SigpAdtlSaveArea *sa;
+    hwaddr save = len;
+    int i;
+
+    sa = cpu_physical_memory_map(addr, &save, true);
+    if (!sa) {
+        return -EFAULT;
+    }
+    if (save != len) {
+        cpu_physical_memory_unmap(sa, len, 1, 0);
+        return -EFAULT;
+    }
+
+    if (s390_has_feat(S390_FEAT_VECTOR)) {
+        for (i = 0; i < 32; i++) {
+            sa->vregs[i][0] = cpu_to_be64(cpu->env.vregs[i][0]);
+            sa->vregs[i][1] = cpu_to_be64(cpu->env.vregs[i][1]);
+        }
+    }
+    if (s390_has_feat(S390_FEAT_GUARDED_STORAGE) && len >= ADTL_GS_MIN_SIZE) {
+        for (i = 0; i < 4; i++) {
+            sa->gscb[i] = cpu_to_be64(cpu->env.gscb[i]);
+        }
+    }
+
+    cpu_physical_memory_unmap(sa, len, 1, len);
+    return 0;
+}
+
 #define ADTL_SAVE_LC_MASK  0xfUL
 static void sigp_store_adtl_status(CPUState *cs, run_on_cpu_data arg)
 {

From db7721857b3033222a521acc2ace7d3ed9529cb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:31 +0200
Subject: [PATCH 1182/2396] target/s390x: Reduce s390_store_status() scope
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

s390_store_status() is only called within sigp.c,
move it and the SigpSaveArea structure definition
there where it belongs, with other SIGP handling
code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251002091132.65703-9-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/helper.c         | 67 ----------------------------------
 target/s390x/s390x-internal.h |  2 --
 target/s390x/sigp.c           | 68 +++++++++++++++++++++++++++++++++++
 3 files changed, 68 insertions(+), 69 deletions(-)

diff --git a/target/s390x/helper.c b/target/s390x/helper.c
index 84321e1d68..184428c6d9 100644
--- a/target/s390x/helper.c
+++ b/target/s390x/helper.c
@@ -24,7 +24,6 @@
 #include "gdbstub/helpers.h"
 #include "qemu/timer.h"
 #include "hw/s390x/ioinst.h"
-#include "target/s390x/kvm/pv.h"
 #include "system/hw_accel.h"
 #include "system/memory.h"
 #include "system/runstate.h"
@@ -182,69 +181,3 @@ void s390_cpu_recompute_watchpoints(CPUState *cs)
                               wp_flags, NULL);
     }
 }
-
-typedef struct SigpSaveArea {
-    uint64_t    fprs[16];                       /* 0x0000 */
-    uint64_t    grs[16];                        /* 0x0080 */
-    PSW         psw;                            /* 0x0100 */
-    uint8_t     pad_0x0110[0x0118 - 0x0110];    /* 0x0110 */
-    uint32_t    prefix;                         /* 0x0118 */
-    uint32_t    fpc;                            /* 0x011c */
-    uint8_t     pad_0x0120[0x0124 - 0x0120];    /* 0x0120 */
-    uint32_t    todpr;                          /* 0x0124 */
-    uint64_t    cputm;                          /* 0x0128 */
-    uint64_t    ckc;                            /* 0x0130 */
-    uint8_t     pad_0x0138[0x0140 - 0x0138];    /* 0x0138 */
-    uint32_t    ars[16];                        /* 0x0140 */
-    uint64_t    crs[16];                        /* 0x0384 */
-} SigpSaveArea;
-QEMU_BUILD_BUG_ON(sizeof(SigpSaveArea) != 512);
-
-int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
-{
-    static const uint8_t ar_id = 1;
-    SigpSaveArea *sa;
-    hwaddr len = sizeof(*sa);
-    int i;
-
-    /* For PVMs storing will occur when this cpu enters SIE again */
-    if (s390_is_pv()) {
-        return 0;
-    }
-
-    sa = cpu_physical_memory_map(addr, &len, true);
-    if (!sa) {
-        return -EFAULT;
-    }
-    if (len != sizeof(*sa)) {
-        cpu_physical_memory_unmap(sa, len, 1, 0);
-        return -EFAULT;
-    }
-
-    if (store_arch) {
-        cpu_physical_memory_write(offsetof(LowCore, ar_access_id), &ar_id, 1);
-    }
-    for (i = 0; i < 16; ++i) {
-        sa->fprs[i] = cpu_to_be64(*get_freg(&cpu->env, i));
-    }
-    for (i = 0; i < 16; ++i) {
-        sa->grs[i] = cpu_to_be64(cpu->env.regs[i]);
-    }
-    sa->psw.addr = cpu_to_be64(cpu->env.psw.addr);
-    sa->psw.mask = cpu_to_be64(s390_cpu_get_psw_mask(&cpu->env));
-    sa->prefix = cpu_to_be32(cpu->env.psa);
-    sa->fpc = cpu_to_be32(cpu->env.fpc);
-    sa->todpr = cpu_to_be32(cpu->env.todpr);
-    sa->cputm = cpu_to_be64(cpu->env.cputm);
-    sa->ckc = cpu_to_be64(cpu->env.ckc >> 8);
-    for (i = 0; i < 16; ++i) {
-        sa->ars[i] = cpu_to_be32(cpu->env.aregs[i]);
-    }
-    for (i = 0; i < 16; ++i) {
-        sa->crs[i] = cpu_to_be64(cpu->env.cregs[i]);
-    }
-
-    cpu_physical_memory_unmap(sa, len, 1, len);
-
-    return 0;
-}
diff --git a/target/s390x/s390x-internal.h b/target/s390x/s390x-internal.h
index a49dca94a7..9691366ec9 100644
--- a/target/s390x/s390x-internal.h
+++ b/target/s390x/s390x-internal.h
@@ -323,8 +323,6 @@ void s390x_cpu_timer(void *opaque);
 void s390_handle_wait(S390CPU *cpu);
 hwaddr s390_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 hwaddr s390_cpu_get_phys_addr_debug(CPUState *cpu, vaddr addr);
-#define S390_STORE_STATUS_DEF_ADDR offsetof(LowCore, floating_pt_save_area)
-int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch);
 LowCore *cpu_map_lowcore(CPUS390XState *env);
 void cpu_unmap_lowcore(CPUS390XState *env, LowCore *lowcore);
 #endif /* CONFIG_USER_ONLY */
diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index 1464be7698..2487acdb49 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -19,6 +19,7 @@
 #include "system/tcg.h"
 #include "trace.h"
 #include "qapi/qapi-types-machine.h"
+#include "target/s390x/kvm/pv.h"
 
 QemuMutex qemu_sigp_mutex;
 
@@ -126,6 +127,73 @@ static void sigp_stop(CPUState *cs, run_on_cpu_data arg)
     si->cc = SIGP_CC_ORDER_CODE_ACCEPTED;
 }
 
+typedef struct SigpSaveArea {
+    uint64_t    fprs[16];                       /* 0x0000 */
+    uint64_t    grs[16];                        /* 0x0080 */
+    PSW         psw;                            /* 0x0100 */
+    uint8_t     pad_0x0110[0x0118 - 0x0110];    /* 0x0110 */
+    uint32_t    prefix;                         /* 0x0118 */
+    uint32_t    fpc;                            /* 0x011c */
+    uint8_t     pad_0x0120[0x0124 - 0x0120];    /* 0x0120 */
+    uint32_t    todpr;                          /* 0x0124 */
+    uint64_t    cputm;                          /* 0x0128 */
+    uint64_t    ckc;                            /* 0x0130 */
+    uint8_t     pad_0x0138[0x0140 - 0x0138];    /* 0x0138 */
+    uint32_t    ars[16];                        /* 0x0140 */
+    uint64_t    crs[16];                        /* 0x0384 */
+} SigpSaveArea;
+QEMU_BUILD_BUG_ON(sizeof(SigpSaveArea) != 512);
+
+#define S390_STORE_STATUS_DEF_ADDR offsetof(LowCore, floating_pt_save_area)
+static int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
+{
+    static const uint8_t ar_id = 1;
+    SigpSaveArea *sa;
+    hwaddr len = sizeof(*sa);
+    int i;
+
+    /* For PVMs storing will occur when this cpu enters SIE again */
+    if (s390_is_pv()) {
+        return 0;
+    }
+
+    sa = cpu_physical_memory_map(addr, &len, true);
+    if (!sa) {
+        return -EFAULT;
+    }
+    if (len != sizeof(*sa)) {
+        cpu_physical_memory_unmap(sa, len, 1, 0);
+        return -EFAULT;
+    }
+
+    if (store_arch) {
+        cpu_physical_memory_write(offsetof(LowCore, ar_access_id), &ar_id, 1);
+    }
+    for (i = 0; i < 16; ++i) {
+        sa->fprs[i] = cpu_to_be64(*get_freg(&cpu->env, i));
+    }
+    for (i = 0; i < 16; ++i) {
+        sa->grs[i] = cpu_to_be64(cpu->env.regs[i]);
+    }
+    sa->psw.addr = cpu_to_be64(cpu->env.psw.addr);
+    sa->psw.mask = cpu_to_be64(s390_cpu_get_psw_mask(&cpu->env));
+    sa->prefix = cpu_to_be32(cpu->env.psa);
+    sa->fpc = cpu_to_be32(cpu->env.fpc);
+    sa->todpr = cpu_to_be32(cpu->env.todpr);
+    sa->cputm = cpu_to_be64(cpu->env.cputm);
+    sa->ckc = cpu_to_be64(cpu->env.ckc >> 8);
+    for (i = 0; i < 16; ++i) {
+        sa->ars[i] = cpu_to_be32(cpu->env.aregs[i]);
+    }
+    for (i = 0; i < 16; ++i) {
+        sa->crs[i] = cpu_to_be64(cpu->env.cregs[i]);
+    }
+
+    cpu_physical_memory_unmap(sa, len, 1, len);
+
+    return 0;
+}
+
 static void sigp_stop_and_store_status(CPUState *cs, run_on_cpu_data arg)
 {
     S390CPU *cpu = S390_CPU(cs);

From 00457aed51a240d6478e0870cd17fdcaa5f6a0ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 11:11:32 +0200
Subject: [PATCH 1183/2396] target/s390x: Replace legacy
 cpu_physical_memory_[un]map() calls (3/3)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Replace the *_map() / *_unmap() methods in s390_store_status()
and s390_store_adtl_status(). In s390_store_status(), replace
cpu_physical_memory_write() by address_space_stb(), restricting
@ar_id scope. No behavioral change expected.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251002091132.65703-10-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/sigp.c | 25 +++++++++++++++++--------
 1 file changed, 17 insertions(+), 8 deletions(-)

diff --git a/target/s390x/sigp.c b/target/s390x/sigp.c
index 2487acdb49..f5d7bc0fa2 100644
--- a/target/s390x/sigp.c
+++ b/target/s390x/sigp.c
@@ -13,6 +13,7 @@
 #include "s390x-internal.h"
 #include "hw/boards.h"
 #include "system/hw_accel.h"
+#include "system/memory.h"
 #include "system/runstate.h"
 #include "system/address-spaces.h"
 #include "exec/cputlb.h"
@@ -147,7 +148,8 @@ QEMU_BUILD_BUG_ON(sizeof(SigpSaveArea) != 512);
 #define S390_STORE_STATUS_DEF_ADDR offsetof(LowCore, floating_pt_save_area)
 static int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
 {
-    static const uint8_t ar_id = 1;
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+    AddressSpace *as = CPU(cpu)->as;
     SigpSaveArea *sa;
     hwaddr len = sizeof(*sa);
     int i;
@@ -157,17 +159,21 @@ static int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
         return 0;
     }
 
-    sa = cpu_physical_memory_map(addr, &len, true);
+    sa = address_space_map(as, addr, &len, true, attrs);
     if (!sa) {
         return -EFAULT;
     }
     if (len != sizeof(*sa)) {
-        cpu_physical_memory_unmap(sa, len, 1, 0);
+        address_space_unmap(as, sa, len, true, 0);
         return -EFAULT;
     }
 
     if (store_arch) {
-        cpu_physical_memory_write(offsetof(LowCore, ar_access_id), &ar_id, 1);
+        static const uint8_t ar_id = 1;
+
+        address_space_stb(as, offsetof(LowCore, ar_access_id),
+                          ar_id, attrs, NULL);
+
     }
     for (i = 0; i < 16; ++i) {
         sa->fprs[i] = cpu_to_be64(*get_freg(&cpu->env, i));
@@ -189,7 +195,7 @@ static int s390_store_status(S390CPU *cpu, hwaddr addr, bool store_arch)
         sa->crs[i] = cpu_to_be64(cpu->env.cregs[i]);
     }
 
-    cpu_physical_memory_unmap(sa, len, 1, len);
+    address_space_unmap(as, sa, len, true, len);
 
     return 0;
 }
@@ -251,16 +257,18 @@ QEMU_BUILD_BUG_ON(sizeof(SigpAdtlSaveArea) != 4096);
 #define ADTL_GS_MIN_SIZE 2048 /* minimal size of adtl save area for GS */
 static int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+    AddressSpace *as = CPU(cpu)->as;
     SigpAdtlSaveArea *sa;
     hwaddr save = len;
     int i;
 
-    sa = cpu_physical_memory_map(addr, &save, true);
+    sa = address_space_map(as, addr, &save, true, attrs);
     if (!sa) {
         return -EFAULT;
     }
     if (save != len) {
-        cpu_physical_memory_unmap(sa, len, 1, 0);
+        address_space_unmap(as, sa, len, true, 0);
         return -EFAULT;
     }
 
@@ -276,7 +284,8 @@ static int s390_store_adtl_status(S390CPU *cpu, hwaddr addr, hwaddr len)
         }
     }
 
-    cpu_physical_memory_unmap(sa, len, 1, len);
+    address_space_unmap(as, sa, len, true, len);
+
     return 0;
 }
 

From 47ea7263701e85ea03270d34c9a90f3971597e06 Mon Sep 17 00:00:00 2001
From: Matthew Rosato <mjrosato@linux.ibm.com>
Date: Wed, 8 Oct 2025 16:33:50 -0400
Subject: [PATCH 1184/2396] s390x/pci: set kvm_msi_via_irqfd_allowed

Allow irqfd to be used for virtio-pci on s390x if the kernel supports
it.  This improves s390x virtio-pci performance when using kvm
acceleration by allowing kvm to deliver interrupts instead of QEMU.

Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Farhan Ali <alifm@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Message-ID: <20251008203350.354121-1-mjrosato@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-pci-bus.c         | 1 +
 include/hw/s390x/s390-pci-kvm.h | 7 +++++++
 2 files changed, 8 insertions(+)

diff --git a/hw/s390x/s390-pci-bus.c b/hw/s390x/s390-pci-bus.c
index e8e41c8a9a..52820894fa 100644
--- a/hw/s390x/s390-pci-bus.c
+++ b/hw/s390x/s390-pci-bus.c
@@ -900,6 +900,7 @@ static void s390_pcihost_realize(DeviceState *dev, Error **errp)
     s390_pci_init_default_group();
     css_register_io_adapters(CSS_IO_ADAPTER_PCI, true, false,
                              S390_ADAPTER_SUPPRESSIBLE, errp);
+    s390_pcihost_kvm_realize();
 }
 
 static void s390_pcihost_unrealize(DeviceState *dev)
diff --git a/include/hw/s390x/s390-pci-kvm.h b/include/hw/s390x/s390-pci-kvm.h
index 933814a402..c33f2833a3 100644
--- a/include/hw/s390x/s390-pci-kvm.h
+++ b/include/hw/s390x/s390-pci-kvm.h
@@ -14,12 +14,19 @@
 
 #include "hw/s390x/s390-pci-bus.h"
 #include "hw/s390x/s390-pci-inst.h"
+#include "system/kvm.h"
 
 #ifdef CONFIG_KVM
+static inline void s390_pcihost_kvm_realize(void)
+{
+    kvm_msi_via_irqfd_allowed = kvm_irqfds_enabled();
+}
+
 bool s390_pci_kvm_interp_allowed(void);
 int s390_pci_kvm_aif_enable(S390PCIBusDevice *pbdev, ZpciFib *fib, bool assist);
 int s390_pci_kvm_aif_disable(S390PCIBusDevice *pbdev);
 #else
+static inline void s390_pcihost_kvm_realize(void) {}
 static inline bool s390_pci_kvm_interp_allowed(void)
 {
     return false;

From 5d7148ae8c0f881425badb9b624e2d44efcdc0be Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Wed, 8 Oct 2025 14:55:01 -0700
Subject: [PATCH 1185/2396] tests/functional: update tests using TF-A/TF-RMM to
 support FEAT_GCS

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/functional/aarch64/test_device_passthrough.py | 4 ++--
 tests/functional/aarch64/test_rme_sbsaref.py        | 4 ++--
 tests/functional/aarch64/test_rme_virt.py           | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/functional/aarch64/test_device_passthrough.py b/tests/functional/aarch64/test_device_passthrough.py
index 17437784bb..05a3f52d5e 100755
--- a/tests/functional/aarch64/test_device_passthrough.py
+++ b/tests/functional/aarch64/test_device_passthrough.py
@@ -85,8 +85,8 @@ class Aarch64DevicePassthrough(QemuSystemTest):
     # https://docs.kernel.org/driver-api/vfio.html#vfio-device-cde
     ASSET_DEVICE_PASSTHROUGH_STACK = Asset(
         ('https://github.com/pbo-linaro/qemu-linux-stack/'
-         'releases/download/build/device_passthrough-c3fb84a.tar.xz'),
-         '15ac2b02bed0c0ea8e3e007de0bcfdaf6fd51c1ba98213f841dc7d01d6f72f04')
+         'releases/download/build/device_passthrough-a9612a2.tar.xz'),
+         'f7d2f70912e7231986e6e293e1a2c4786dd02bec113a7acb6bfc619e96155455')
 
     # This tests the device passthrough implementation, by booting a VM
     # supporting it with two nvme disks attached, and launching a nested VM
diff --git a/tests/functional/aarch64/test_rme_sbsaref.py b/tests/functional/aarch64/test_rme_sbsaref.py
index ca892e0a8c..6f92858397 100755
--- a/tests/functional/aarch64/test_rme_sbsaref.py
+++ b/tests/functional/aarch64/test_rme_sbsaref.py
@@ -25,8 +25,8 @@ class Aarch64RMESbsaRefMachine(QemuSystemTest):
     # ./build.sh && ./archive_artifacts.sh out.tar.xz
     ASSET_RME_STACK_SBSA = Asset(
         ('https://github.com/pbo-linaro/qemu-linux-stack/'
-         'releases/download/build/rme_sbsa_release-a7f02cf.tar.xz'),
-         '27d8400b11befb828d6db0cab97e7ae102d0992c928d3dfbf38b24b6cf6c324c')
+         'releases/download/build/rme_sbsa_release-6a2dfc5.tar.xz'),
+         '5adba482aa069912292a8da746c6b21268224d9d81c97fe7c0bed690579ebdcb')
 
     # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
     # and launching a nested VM using it.
diff --git a/tests/functional/aarch64/test_rme_virt.py b/tests/functional/aarch64/test_rme_virt.py
index bb603aaa26..5e23773f93 100755
--- a/tests/functional/aarch64/test_rme_virt.py
+++ b/tests/functional/aarch64/test_rme_virt.py
@@ -23,8 +23,8 @@ class Aarch64RMEVirtMachine(QemuSystemTest):
     # ./build.sh && ./archive_artifacts.sh out.tar.xz
     ASSET_RME_STACK_VIRT = Asset(
         ('https://github.com/pbo-linaro/qemu-linux-stack/'
-         'releases/download/build/rme_release-86101e5.tar.xz'),
-         'e42fef8439badb52a071ac446fc33cff4cb7d61314c7a28fdbe61a11e1faad3a')
+         'releases/download/build/rme_release-56bc99e.tar.xz'),
+         '0e3dc6b8a4b828dbae09c951a40dcb710eded084b32432b50c69cf4173ffa4be')
 
     # This tests the FEAT_RME cpu implementation, by booting a VM supporting it,
     # and launching a nested VM using it.

From c817b325c16bee80a130e30c756021da95745b9e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:02 -0700
Subject: [PATCH 1186/2396] target/arm: Add isar feature test for FEAT_S1PIE,
 FEAT_S2PIE

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index f59c18b6ef..f3e90408f7 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -1349,6 +1349,16 @@ static inline bool isar_feature_aa64_sctlr2(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64MMFR3, SCTLRX) != 0;
 }
 
+static inline bool isar_feature_aa64_s1pie(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, S1PIE) != 0;
+}
+
+static inline bool isar_feature_aa64_s2pie(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, S2PIE) != 0;
+}
+
 static inline bool isar_feature_aa64_pmuv3p1(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 4 &&

From 48669f526deae089f23f75638819e7bb90c57d32 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:03 -0700
Subject: [PATCH 1187/2396] target/arm: Enable TCR2_ELx.PIE

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index b7bf45afc1..c9ebdf144e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5902,8 +5902,12 @@ static CPAccessResult tcr2_el1_access(CPUARMState *env, const ARMCPRegInfo *ri,
 static void tcr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
                            uint64_t value)
 {
+    ARMCPU *cpu = env_archcpu(env);
     uint64_t valid_mask = 0;
 
+    if (cpu_isar_feature(aa64_s1pie, cpu)) {
+        valid_mask |= TCR2_PIE;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }
@@ -5911,8 +5915,12 @@ static void tcr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static void tcr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
                            uint64_t value)
 {
+    ARMCPU *cpu = env_archcpu(env);
     uint64_t valid_mask = 0;
 
+    if (cpu_isar_feature(aa64_s1pie, cpu)) {
+        valid_mask |= TCR2_PIE;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }

From 0277e0652b663770bb42113ed3fea1ea0dfeaf19 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:04 -0700
Subject: [PATCH 1188/2396] target/arm: Implement PIR_ELx, PIRE0_ELx, S2PIR_EL2
 registers

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h |  2 ++
 target/arm/cpu.c    |  4 +++
 target/arm/cpu.h    |  4 +++
 target/arm/helper.c | 69 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 79 insertions(+)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 57fde5f57a..f48c4df30f 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -781,6 +781,8 @@ typedef enum FGTBit {
     DO_BIT(HFGRTR, ERRIDR_EL1),
     DO_REV_BIT(HFGRTR, NSMPRI_EL1),
     DO_REV_BIT(HFGRTR, NTPIDR2_EL0),
+    DO_REV_BIT(HFGRTR, NPIRE0_EL1),
+    DO_REV_BIT(HFGRTR, NPIR_EL1),
 
     /* Trap bits in HDFGRTR_EL2 / HDFGWTR_EL2, starting from bit 0. */
     DO_BIT(HDFGRTR, DBGBCRN_EL1),
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 30e29fd315..9bca1b8eae 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -641,6 +641,10 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
             if (cpu_isar_feature(aa64_sctlr2, cpu)) {
                 env->cp15.scr_el3 |= SCR_SCTLR2EN;
             }
+            if (cpu_isar_feature(aa64_s1pie, cpu) ||
+                cpu_isar_feature(aa64_s2pie, cpu)) {
+                env->cp15.scr_el3 |= SCR_PIEN;
+            }
         }
 
         if (target_el == 2) {
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 41414ac22b..c9ea160d03 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -368,6 +368,9 @@ typedef struct CPUArchState {
         uint64_t tcr2_el[3];
         uint64_t vtcr_el2; /* Virtualization Translation Control.  */
         uint64_t vstcr_el2; /* Secure Virtualization Translation Control. */
+        uint64_t pir_el[4]; /* PIRE0_EL1, PIR_EL1, PIR_EL2, PIR_EL3 */
+        uint64_t pire0_el2;
+        uint64_t s2pir_el2;
         uint32_t c2_data; /* MPU data cacheable bits.  */
         uint32_t c2_insn; /* MPU instruction cacheable bits.  */
         union { /* MMU domain access control register
@@ -1720,6 +1723,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_ENTP2             (1ULL << 41)
 #define SCR_TCR2EN            (1ULL << 43)
 #define SCR_SCTLR2EN          (1ULL << 44)
+#define SCR_PIEN              (1ULL << 45)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index c9ebdf144e..20a189ef4f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -770,6 +770,10 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_sctlr2, cpu)) {
             valid_mask |= SCR_SCTLR2EN;
         }
+        if (cpu_isar_feature(aa64_s1pie, cpu) ||
+            cpu_isar_feature(aa64_s2pie, cpu)) {
+            valid_mask |= SCR_PIEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -5941,6 +5945,64 @@ static const ARMCPRegInfo tcr2_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.tcr2_el[2]) },
 };
 
+static CPAccessResult pien_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_PIEN)
+        && arm_current_el(env) < 3) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult pien_el1_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    CPAccessResult ret = access_tvm_trvm(env, ri, isread);
+    if (ret == CP_ACCESS_OK) {
+        ret = pien_access(env, ri, isread);
+    }
+    return ret;
+}
+
+static const ARMCPRegInfo s1pie_reginfo[] = {
+    { .name = "PIR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .opc2 = 3, .crn = 10, .crm = 2,
+      .access = PL1_RW, .accessfn = pien_el1_access,
+      .fgt = FGT_NPIR_EL1, .nv2_redirect_offset = 0x2a0 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 2, 3),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 3),
+      .fieldoffset = offsetof(CPUARMState, cp15.pir_el[1]) },
+    { .name = "PIR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 3, .crn = 10, .crm = 2,
+      .access = PL2_RW, .accessfn = pien_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.pir_el[2]) },
+    { .name = "PIR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .opc2 = 3, .crn = 10, .crm = 2,
+      .access = PL3_RW,
+      .fieldoffset = offsetof(CPUARMState, cp15.pir_el[3]) },
+    { .name = "PIRE0_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .opc2 = 2, .crn = 10, .crm = 2,
+      .access = PL1_RW, .accessfn = pien_el1_access,
+      .fgt = FGT_NPIRE0_EL1, .nv2_redirect_offset = 0x290 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 2, 2),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 2),
+      .fieldoffset = offsetof(CPUARMState, cp15.pir_el[0]) },
+    { .name = "PIRE0_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 2, .crn = 10, .crm = 2,
+      .access = PL2_RW, .accessfn = pien_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.pire0_el2) },
+};
+
+static const ARMCPRegInfo s2pie_reginfo[] = {
+    { .name = "S2PIR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 5, .crn = 10, .crm = 2,
+      .access = PL2_RW, .accessfn = pien_access,
+      .nv2_redirect_offset = 0x2b0,
+      .fieldoffset = offsetof(CPUARMState, cp15.s2pir_el2) },
+};
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -7173,6 +7235,13 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, tcr2_reginfo);
     }
 
+    if (cpu_isar_feature(aa64_s1pie, cpu)) {
+        define_arm_cp_regs(cpu, s1pie_reginfo);
+    }
+    if (cpu_isar_feature(aa64_s2pie, cpu)) {
+        define_arm_cp_regs(cpu, s2pie_reginfo);
+    }
+
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);
     }

From 26c7b95eb1342907c569cc6da7e27ded0959e4fe Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:05 -0700
Subject: [PATCH 1189/2396] target/arm: Force HPD for stage2 translations

Stage2 translations do not have hierarchial permissions.
Setting HPD means we can eliminate an extra check against
regime_is_stage2.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c |  7 +++++--
 target/arm/ptw.c    | 24 +++++++++++++-----------
 2 files changed, 18 insertions(+), 13 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 20a189ef4f..b7bc27436f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9397,8 +9397,11 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         tsz = extract32(tcr, 0, 6);
         gran = tg0_to_gran_size(extract32(tcr, 14, 2));
         if (stage2) {
-            /* VTCR_EL2 */
-            hpd = false;
+            /*
+             * Stage2 does not have hierarchical permissions.
+             * Thus disabling them makes things easier during ptw.
+             */
+            hpd = true;
         } else {
             hpd = extract32(tcr, 24, 1);
         }
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e03657f309..2657023120 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1507,8 +1507,12 @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
         }
         tsz = sextract32(tcr, 0, 4) + 8;
         select = 0;
-        hpd = false;
         epd = false;
+        /*
+         * Stage2 does not have hierarchical permissions.
+         * Thus disabling them makes things easier during ptw.
+         */
+        hpd = true;
     } else if (el == 2) {
         /* HTCR */
         tsz = extract32(tcr, 0, 3);
@@ -2014,16 +2018,14 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * except NSTable (which we have already handled).
      */
     attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
-    if (!regime_is_stage2(mmu_idx)) {
-        if (!param.hpd) {
-            attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-            /*
-             * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-             * means "force PL1 access only", which means forcing AP[1] to 0.
-             */
-            attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
-            attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
-        }
+    if (!param.hpd) {
+        attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
+        /*
+         * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
+         * means "force PL1 access only", which means forcing AP[1] to 0.
+         */
+        attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
+        attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
     }
 
     ap = extract32(attrs, 6, 2);

From 67f3eda009d9af5afb64886cbadc01454fd987a5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:06 -0700
Subject: [PATCH 1190/2396] target/arm: Cache NV1 early in get_phys_addr_lpae

We were not using the correct security space in the existing call
to nv_nv1_enabled, because it may have been modified for NSTable.

Cache it early, as we will shortly need it elsewhere as well.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 20 +++++++++++++-------
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 2657023120..e1515675eb 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -79,6 +79,8 @@ typedef struct S1Translate {
      * may be suppressed for debug or AT insns.
      */
     uint8_t in_prot_check;
+    /* Cached EffectiveHCR_EL2_NVx() bit */
+    bool in_nv1;
     bool out_rw;
     bool out_be;
     ARMSecuritySpace out_space;
@@ -1677,12 +1679,6 @@ static bool lpae_block_desc_valid(ARMCPU *cpu, bool ds,
     }
 }
 
-static bool nv_nv1_enabled(CPUARMState *env, S1Translate *ptw)
-{
-    uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
-    return (hcr & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1);
-}
-
 /**
  * get_phys_addr_lpae: perform one stage of page table walk, LPAE format
  *
@@ -1734,6 +1730,16 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                    !arm_el_is_aa64(env, 1));
         level = 0;
 
+        /*
+         * Cache NV1 before we adjust ptw->in_space for NSTable.
+         * Note that this is only relevant for EL1&0, and that
+         * computing it would assert for ARMSS_Root.
+         */
+        if (el == 1) {
+            uint64_t hcr = arm_hcr_el2_eff_secstate(env, ptw->in_space);
+            ptw->in_nv1 = (hcr & (HCR_NV | HCR_NV1)) == (HCR_NV | HCR_NV1);
+        }
+
         /*
          * If TxSZ is programmed to a value larger than the maximum,
          * or smaller than the effective minimum, it is IMPLEMENTATION
@@ -2109,7 +2115,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         xn = extract64(attrs, 54, 1);
         pxn = extract64(attrs, 53, 1);
 
-        if (el == 1 && nv_nv1_enabled(env, ptw)) {
+        if (el == 1 && ptw->in_nv1) {
             /*
              * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
              * descriptor bit 54 holds PXN, 53 is RES0, and the effective value

From 1952f58f984a36bb30b9780ed0257e6879252fcd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:07 -0700
Subject: [PATCH 1191/2396] target/arm: Populate PIE in aa64_va_parameters

Select the PIE bit for the translation regime.
With PIE, the PTE layout changes, forcing HPD.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 19 ++++++++++++++++++-
 target/arm/internals.h |  3 ++-
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index b7bc27436f..37865bf70e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9386,11 +9386,12 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    bool el1_is_aa32)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    bool epd, hpd, tsz_oob, ds, ha, hd;
+    bool epd, hpd, tsz_oob, ds, ha, hd, pie = false;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
     bool stage2 = regime_is_stage2(mmu_idx);
+    int r_el = regime_el(env, mmu_idx);
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -9402,8 +9403,17 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              * Thus disabling them makes things easier during ptw.
              */
             hpd = true;
+            pie = extract64(tcr, 36, 1) && cpu_isar_feature(aa64_s2pie, cpu);
         } else {
             hpd = extract32(tcr, 24, 1);
+            if (r_el == 3) {
+                pie = (extract64(tcr, 35, 1)
+                       && cpu_isar_feature(aa64_s1pie, cpu));
+            } else {
+                pie = ((env->cp15.tcr2_el[2] & TCR2_PIE)
+                       && (!arm_feature(env, ARM_FEATURE_EL3)
+                           || (env->cp15.scr_el3 & SCR_TCR2EN)));
+            }
         }
         epd = false;
         sh = extract32(tcr, 12, 2);
@@ -9443,7 +9453,13 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             regime_is_user(env, mmu_idx)) {
             epd = true;
         }
+
+        pie = ((env->cp15.tcr2_el[r_el] & TCR2_PIE)
+               && (!arm_feature(env, ARM_FEATURE_EL3)
+                   || (env->cp15.scr_el3 & SCR_TCR2EN))
+               && (r_el == 2 || (arm_hcrx_el2_eff(env) & HCRX_TCR2EN)));
     }
+    hpd |= pie;
 
     gran = sanitize_gran_size(cpu, gran, stage2);
 
@@ -9522,6 +9538,7 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .ha = ha,
         .hd = ha && hd,
         .gran = gran,
+        .pie = pie,
     };
 }
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 1d958dbf68..face1019f5 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1491,7 +1491,7 @@ static inline int arm_granule_bits(ARMGranuleSize gran)
 
 /*
  * Parameters of a given virtual address, as extracted from the
- * translation control register (TCR) for a given regime.
+ * translation controls for a given regime.
  */
 typedef struct ARMVAParameters {
     unsigned tsz    : 8;
@@ -1506,6 +1506,7 @@ typedef struct ARMVAParameters {
     bool ha         : 1;
     bool hd         : 1;
     ARMGranuleSize gran : 2;
+    bool pie        : 1;
 } ARMVAParameters;
 
 /**

From 1cbaf63a109db8529589b0660df06ea69fd07b05 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:08 -0700
Subject: [PATCH 1192/2396] target/arm: Implement get_S1prot_indirect

This approximately corresponds to AArch64.S1IndirectBasePermissions
and the tail of AArch64.S1ComputePermissions which applies WXN.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 161 ++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 139 insertions(+), 22 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index e1515675eb..5913556077 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1484,6 +1484,106 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
     return prot_rw | PAGE_EXEC;
 }
 
+/* Extra page permission bits, during get_S1prot_indirect only. */
+#define PAGE_GCS      (1 << 3)
+#define PAGE_WXN      (1 << 4)
+#define PAGE_OVERLAY  (1 << 5)
+QEMU_BUILD_BUG_ON(PAGE_RWX & (PAGE_GCS | PAGE_WXN | PAGE_OVERLAY));
+
+static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
+                               ARMMMUIdx mmu_idx, int pi_index, int po_index,
+                               ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
+{
+    static const uint8_t perm_table[16] = {
+        /* 0 */ PAGE_OVERLAY,  /* no access */
+        /* 1 */ PAGE_OVERLAY | PAGE_READ,
+        /* 2 */ PAGE_OVERLAY | PAGE_EXEC,
+        /* 3 */ PAGE_OVERLAY | PAGE_READ | PAGE_EXEC,
+        /* 4 */ PAGE_OVERLAY,  /* reserved */
+        /* 5 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE,
+        /* 6 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE | PAGE_EXEC | PAGE_WXN,
+        /* 7 */ PAGE_OVERLAY | PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+        /* 8 */ PAGE_READ,
+        /* 9 */ PAGE_READ | PAGE_GCS,
+        /* A */ PAGE_READ | PAGE_EXEC,
+        /* B */ 0,             /* reserved */
+        /* C */ PAGE_READ | PAGE_WRITE,
+        /* D */ 0,             /* reserved */
+        /* E */ PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+        /* F */ 0,             /* reserved */
+    };
+
+    uint32_t el = regime_el(env, mmu_idx);
+    uint64_t pir = env->cp15.pir_el[el];
+    uint64_t pire0 = 0;
+    int perm;
+
+    if (el < 3) {
+        if (arm_feature(env, ARM_FEATURE_EL3)
+            && !(env->cp15.scr_el3 & SCR_PIEN)) {
+            pir = 0;
+        } else if (el == 2) {
+            pire0 = env->cp15.pire0_el2;
+        } else if (!ptw->in_nv1) {
+            pire0 = env->cp15.pir_el[0];
+        }
+    }
+    perm = perm_table[extract64(pir, pi_index * 4, 4)];
+
+    if (regime_has_2_ranges(mmu_idx)) {
+        int p_perm = perm;
+        int u_perm = perm_table[extract64(pire0, pi_index * 4, 4)];
+
+        if ((p_perm & (PAGE_EXEC | PAGE_GCS)) &&
+            (u_perm & (PAGE_WRITE | PAGE_GCS))) {
+            p_perm &= ~(PAGE_RWX | PAGE_GCS);
+            u_perm &= ~(PAGE_RWX | PAGE_GCS);
+        }
+        if ((u_perm & (PAGE_RWX | PAGE_GCS)) && regime_is_pan(env, mmu_idx)) {
+            p_perm &= ~(PAGE_READ | PAGE_WRITE);
+        }
+        perm = regime_is_user(env, mmu_idx) ? u_perm : p_perm;
+    }
+
+    if (in_pa != out_pa) {
+        switch (in_pa) {
+        case ARMSS_Root:
+            /*
+             * R_ZWRVD: permission fault for insn fetched from non-Root,
+             * I_WWBFB: SIF has no effect in EL3.
+             */
+            perm &= ~(PAGE_EXEC | PAGE_GCS);
+            break;
+        case ARMSS_Realm:
+            /*
+             * R_PKTDS: permission fault for insn fetched from non-Realm,
+             * for Realm EL2 or EL2&0.  The corresponding fault for EL1&0
+             * happens during any stage2 translation.
+             */
+            if (el == 2) {
+                perm &= ~(PAGE_EXEC | PAGE_GCS);
+            }
+            break;
+        case ARMSS_Secure:
+            if (env->cp15.scr_el3 & SCR_SIF) {
+                perm &= ~(PAGE_EXEC | PAGE_GCS);
+            }
+            break;
+        default:
+            /* Input NonSecure must have output NonSecure. */
+            g_assert_not_reached();
+        }
+    }
+
+    if (perm & PAGE_WXN) {
+        perm &= ~PAGE_EXEC;
+    }
+
+    /* TODO: FEAT_GCS */
+
+    return perm & PAGE_RWX;
+}
+
 static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                           ARMMMUIdx mmu_idx)
 {
@@ -1713,7 +1813,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    int ap, xn, pxn;
+    int ap;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
@@ -2047,7 +2147,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             out_space = ARMSS_NonSecure;
             result->f.prot = get_S2prot_noexecute(ap);
         } else {
-            xn = extract64(attrs, 53, 2);
+            int xn = extract64(attrs, 53, 2);
             result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
         }
 
@@ -2063,7 +2163,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         int nse, ns = extract32(attrs, 5, 1);
         uint8_t attrindx;
         uint64_t mair;
-        int user_rw, prot_rw;
 
         switch (out_space) {
         case ARMSS_Root:
@@ -2112,29 +2211,47 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         default:
             g_assert_not_reached();
         }
-        xn = extract64(attrs, 54, 1);
-        pxn = extract64(attrs, 53, 1);
 
-        if (el == 1 && ptw->in_nv1) {
+        if (param.pie) {
+            int pi = extract64(attrs, 6, 1)
+                   | (extract64(attrs, 51, 1) << 1)
+                   | (extract64(attrs, 53, 2) << 2);
+            int po = extract64(attrs, 60, 3);
             /*
-             * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1}, the block/page
-             * descriptor bit 54 holds PXN, 53 is RES0, and the effective value
-             * of UXN is 0. Similarly for bits 59 and 60 in table descriptors
-             * (which we have already folded into bits 53 and 54 of attrs).
-             * AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
-             * Similarly, APTable[0] from the table descriptor is treated as 0;
-             * we already folded this into AP[1] and squashing that to 0 does
-             * the right thing.
+             * Note that we modified ptw->in_space earlier for NSTable, but
+             * result->f.attrs retains a copy of the original security space.
              */
-            pxn = xn;
-            xn = 0;
-            ap &= ~1;
-        }
+            result->f.prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
+                                                 result->f.attrs.space,
+                                                 out_space);
+        } else {
+            int xn = extract64(attrs, 54, 1);
+            int pxn = extract64(attrs, 53, 1);
+            int user_rw, prot_rw;
 
-        user_rw = simple_ap_to_rw_prot_is_user(ap, true);
-        prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-        result->f.prot = get_S1prot(env, mmu_idx, aarch64, user_rw, prot_rw,
-                                    xn, pxn, ptw->in_space, out_space);
+            if (el == 1 && ptw->in_nv1) {
+                /*
+                 * With FEAT_NV, when HCR_EL2.{NV,NV1} == {1,1},
+                 * the block/page descriptor bit 54 holds PXN,
+                 * 53 is RES0, and the effective value of UXN is 0.
+                 * Similarly for bits 59 and 60 in table descriptors
+                 * (which we have already folded into bits 53 and 54 of attrs).
+                 * AP[1] (descriptor bit 6, our ap bit 0) is treated as 0.
+                 * Similarly, APTable[0] from the table descriptor is treated
+                 * as 0; we already folded this into AP[1] and squashing
+                 * that to 0 does the right thing.
+                 */
+                pxn = xn;
+                xn = 0;
+                ap &= ~1;
+            }
+
+            user_rw = simple_ap_to_rw_prot_is_user(ap, true);
+            prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
+            result->f.prot = get_S1prot(env, mmu_idx, aarch64,
+                                        user_rw, prot_rw, xn, pxn,
+                                        ptw->in_space, out_space);
+        }
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);

From a811c5dafb728087fa6f222ad1322ec26d080fdd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:09 -0700
Subject: [PATCH 1193/2396] target/arm: Implement get_S2prot_indirect

Move the stage2 permissions for normal accesses to
GetPhysAddrResult.s2prot.  Put the stage2 permissions
for page table walking in CPUTLBEntryFull.prot.
This allows the permission checks in S1_ptw_translate
and arm_casq_ptw to see the right permission.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  7 ++++
 target/arm/ptw.c       | 81 +++++++++++++++++++++++++++++++-----------
 2 files changed, 68 insertions(+), 20 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index face1019f5..22947c4b78 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1577,6 +1577,13 @@ typedef struct ARMCacheAttrs {
 typedef struct GetPhysAddrResult {
     CPUTLBEntryFull f;
     ARMCacheAttrs cacheattrs;
+    /*
+     * For ARMMMUIdx_Stage2*, the protection installed into f.prot
+     * is the result for AccessType_TTW, i.e. the page table walk itself.
+     * The protection installed info s2prot is the one to be merged
+     * with the stage1 protection.
+     */
+    int s2prot;
 } GetPhysAddrResult;
 
 /**
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 5913556077..2e026a7c59 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1316,7 +1316,7 @@ do_fault:
  * @xn:      XN (execute-never) bits
  * @s1_is_el0: true if this is S2 of an S1+2 walk for EL0
  */
-static int get_S2prot_noexecute(int s2ap)
+static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
 {
     int prot = 0;
 
@@ -1326,12 +1326,6 @@ static int get_S2prot_noexecute(int s2ap)
     if (s2ap & 2) {
         prot |= PAGE_WRITE;
     }
-    return prot;
-}
-
-static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
-{
-    int prot = get_S2prot_noexecute(s2ap);
 
     if (cpu_isar_feature(any_tts2uxn, env_archcpu(env))) {
         switch (xn) {
@@ -1363,6 +1357,44 @@ static int get_S2prot(CPUARMState *env, int s2ap, int xn, bool s1_is_el0)
     return prot;
 }
 
+static int get_S2prot_indirect(CPUARMState *env, GetPhysAddrResult *result,
+                               int pi_index, int po_index, bool s1_is_el0)
+{
+    /* Last index is (priv, unpriv, ttw) */
+    static const uint8_t perm_table[16][3] = {
+        /* 0 */ { 0, 0, 0 },   /* no access */
+        /* 1 */ { 0, 0, 0 },   /* reserved */
+        /* 2 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
+        /* 3 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
+        /* 4 */ { PAGE_WRITE, PAGE_WRITE, 0 },
+        /* 5 */ { 0, 0, 0 },   /* reserved */
+        /* 6 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
+        /* 7 */ { PAGE_READ, PAGE_READ, PAGE_READ | PAGE_WRITE },
+        /* 8 */ { PAGE_READ, PAGE_READ, PAGE_READ },
+        /* 9 */ { PAGE_READ, PAGE_READ | PAGE_EXEC, PAGE_READ },
+        /* A */ { PAGE_READ | PAGE_EXEC, PAGE_READ, PAGE_READ },
+        /* B */ { PAGE_READ | PAGE_EXEC, PAGE_READ | PAGE_EXEC, PAGE_READ },
+        /* C */ { PAGE_READ | PAGE_WRITE,
+                  PAGE_READ | PAGE_WRITE,
+                  PAGE_READ | PAGE_WRITE },
+        /* D */ { PAGE_READ | PAGE_WRITE,
+                  PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+                  PAGE_READ | PAGE_WRITE },
+        /* E */ { PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+                  PAGE_READ | PAGE_WRITE,
+                  PAGE_READ | PAGE_WRITE },
+        /* F */ { PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+                  PAGE_READ | PAGE_WRITE | PAGE_EXEC,
+                  PAGE_READ | PAGE_WRITE },
+    };
+
+    uint64_t pir = (env->cp15.scr_el3 & SCR_PIEN ? env->cp15.s2pir_el2 : 0);
+    int s2pi = extract64(pir, pi_index * 4, 4);
+
+    result->f.prot = perm_table[s2pi][2];
+    return perm_table[s2pi][s1_is_el0];
+}
+
 /*
  * Translate section/page access permissions to protection flags
  * @env:     CPUARMState
@@ -1813,7 +1845,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    int ap;
+    int ap, prot;
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
@@ -2137,6 +2169,18 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     ap = extract32(attrs, 6, 2);
     out_space = ptw->cur_space;
     if (regime_is_stage2(mmu_idx)) {
+        if (param.pie) {
+            int pi = extract64(attrs, 6, 1)
+                   | (extract64(attrs, 51, 1) << 1)
+                   | (extract64(attrs, 53, 2) << 2);
+            int po = extract64(attrs, 60, 3);
+            prot = get_S2prot_indirect(env, result, pi, po, ptw->in_s1_is_el0);
+        } else {
+            int xn = extract64(attrs, 53, 2);
+            prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
+            /* Install TTW permissions in f.prot. */
+            result->f.prot = prot & (PAGE_READ | PAGE_WRITE);
+        }
         /*
          * R_GYNXY: For stage2 in Realm security state, bit 55 is NS.
          * The bit remains ignored for other security states.
@@ -2145,11 +2189,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          */
         if (out_space == ARMSS_Realm && extract64(attrs, 55, 1)) {
             out_space = ARMSS_NonSecure;
-            result->f.prot = get_S2prot_noexecute(ap);
-        } else {
-            int xn = extract64(attrs, 53, 2);
-            result->f.prot = get_S2prot(env, ap, xn, ptw->in_s1_is_el0);
+            prot &= ~PAGE_EXEC;
         }
+        result->s2prot = prot;
 
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -2221,9 +2263,8 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
              * Note that we modified ptw->in_space earlier for NSTable, but
              * result->f.attrs retains a copy of the original security space.
              */
-            result->f.prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
-                                                 result->f.attrs.space,
-                                                 out_space);
+            prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
+                                       result->f.attrs.space, out_space);
         } else {
             int xn = extract64(attrs, 54, 1);
             int pxn = extract64(attrs, 53, 1);
@@ -2248,10 +2289,10 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
             user_rw = simple_ap_to_rw_prot_is_user(ap, true);
             prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-            result->f.prot = get_S1prot(env, mmu_idx, aarch64,
-                                        user_rw, prot_rw, xn, pxn,
-                                        ptw->in_space, out_space);
+            prot = get_S1prot(env, mmu_idx, aarch64, user_rw, prot_rw,
+                              xn, pxn, ptw->in_space, out_space);
         }
+        result->f.prot = prot;
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
@@ -2297,7 +2338,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.tlb_fill_flags = 0;
     }
 
-    if (ptw->in_prot_check & ~result->f.prot) {
+    if (ptw->in_prot_check & ~prot) {
         fi->type = ARMFault_Permission;
         goto do_fault;
     }
@@ -3495,7 +3536,7 @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     fi->s2addr = ipa;
 
     /* Combine the S1 and S2 perms.  */
-    result->f.prot &= s1_prot;
+    result->f.prot = s1_prot & result->s2prot;
 
     /* If S2 fails, return early.  */
     if (ret) {

From 5a3197bc73040e657017d08445918c88c542f7d4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:10 -0700
Subject: [PATCH 1194/2396] target/arm: Expand CPUARMState.exception.syndrome
 to 64 bits

This will be used for storing the ISS2 portion of the
ESR_ELx registers in aarch64 state.  Re-order the fsr
member to eliminate two structure holes.

Drop the comment about "if we implement EL2" since we
have already done so.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |  7 ++-----
 target/arm/helper.c  |  2 +-
 target/arm/machine.c | 32 +++++++++++++++++++++++++++++++-
 3 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index c9ea160d03..04b57f1dc5 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -633,13 +633,10 @@ typedef struct CPUArchState {
      * entry process.
      */
     struct {
-        uint32_t syndrome; /* AArch64 format syndrome register */
-        uint32_t fsr; /* AArch32 format fault status register info */
+        uint64_t syndrome; /* AArch64 format syndrome register */
         uint64_t vaddress; /* virtual addr associated with exception, if any */
+        uint32_t fsr; /* AArch32 format fault status register info */
         uint32_t target_el; /* EL the exception should be targeted for */
-        /* If we implement EL2 we will also need to store information
-         * about the intermediate physical address for stage 2 faults.
-         */
     } exception;
 
     /* Information associated with an SError */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 37865bf70e..bd5321348a 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9196,7 +9196,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
                   new_el);
     if (qemu_loglevel_mask(CPU_LOG_INT)
         && !excp_is_internal(cs->exception_index)) {
-        qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx32 "\n",
+        qemu_log_mask(CPU_LOG_INT, "...with ESR 0x%x/0x%" PRIx64 "\n",
                       syn_get_ec(env->exception.syndrome),
                       env->exception.syndrome);
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 6666a0c50c..ce20b46f50 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -848,6 +848,23 @@ static const VMStateInfo vmstate_powered_off = {
     .put = put_power,
 };
 
+static bool syndrome64_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    return cpu->env.exception.syndrome > UINT32_MAX;
+}
+
+static const VMStateDescription vmstate_syndrome64 = {
+    .name = "cpu/syndrome64",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = syndrome64_needed,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT64(env.exception.syndrome, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static int cpu_pre_save(void *opaque)
 {
     ARMCPU *cpu = opaque;
@@ -1065,7 +1082,19 @@ const VMStateDescription vmstate_arm_cpu = {
         VMSTATE_UINT64(env.exclusive_val, ARMCPU),
         VMSTATE_UINT64(env.exclusive_high, ARMCPU),
         VMSTATE_UNUSED(sizeof(uint64_t)),
-        VMSTATE_UINT32(env.exception.syndrome, ARMCPU),
+        /*
+         * If any bits are set in the upper 32 bits of syndrome,
+         * then the cpu/syndrome64 subsection will override this
+         * with the full 64 bit state.
+         */
+        {
+            .name = "env.exception.syndrome",
+            .version_id = 0,
+            .size = sizeof(uint32_t),
+            .info = &vmstate_info_uint32,
+            .flags = VMS_SINGLE,
+            .offset = offsetoflow32(ARMCPU, env.exception.syndrome),
+        },
         VMSTATE_UINT32(env.exception.fsr, ARMCPU),
         VMSTATE_UINT64(env.exception.vaddress, ARMCPU),
         VMSTATE_TIMER_PTR(gt_timer[GTIMER_PHYS], ARMCPU),
@@ -1098,6 +1127,7 @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_serror,
         &vmstate_irq_line_state,
         &vmstate_wfxt_timer,
+        &vmstate_syndrome64,
         NULL
     }
 };

From 9190d68e83dc13c08b50b538f6473894b1b7b024 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:11 -0700
Subject: [PATCH 1195/2396] target/arm: Expand syndrome parameter to
 raise_exception*

Prepare for raising exceptions with 64-bit syndromes.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h     | 6 +++---
 target/arm/tcg-stubs.c     | 2 +-
 target/arm/tcg/op_helper.c | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 22947c4b78..b59650959e 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -304,14 +304,14 @@ FIELD(CNTHCTL, CNTPMASK, 19, 1)
  * and never returns because we will longjump back up to the CPU main loop.
  */
 G_NORETURN void raise_exception(CPUARMState *env, uint32_t excp,
-                                uint32_t syndrome, uint32_t target_el);
+                                uint64_t syndrome, uint32_t target_el);
 
 /*
  * Similarly, but also use unwinding to restore cpu state.
  */
 G_NORETURN void raise_exception_ra(CPUARMState *env, uint32_t excp,
-                                      uint32_t syndrome, uint32_t target_el,
-                                      uintptr_t ra);
+                                   uint64_t syndrome, uint32_t target_el,
+                                   uintptr_t ra);
 
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
diff --git a/target/arm/tcg-stubs.c b/target/arm/tcg-stubs.c
index aac99b2672..aeeede8066 100644
--- a/target/arm/tcg-stubs.c
+++ b/target/arm/tcg-stubs.c
@@ -16,7 +16,7 @@ void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
     g_assert_not_reached();
 }
 
-void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+void raise_exception_ra(CPUARMState *env, uint32_t excp, uint64_t syndrome,
                         uint32_t target_el, uintptr_t ra)
 {
     g_assert_not_reached();
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index 5373e0e998..dd3700dc6f 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -46,7 +46,7 @@ int exception_target_el(CPUARMState *env)
 }
 
 void raise_exception(CPUARMState *env, uint32_t excp,
-                     uint32_t syndrome, uint32_t target_el)
+                     uint64_t syndrome, uint32_t target_el)
 {
     CPUState *cs = env_cpu(env);
 
@@ -70,7 +70,7 @@ void raise_exception(CPUARMState *env, uint32_t excp,
     cpu_loop_exit(cs);
 }
 
-void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+void raise_exception_ra(CPUARMState *env, uint32_t excp, uint64_t syndrome,
                         uint32_t target_el, uintptr_t ra)
 {
     CPUState *cs = env_cpu(env);

From cfd363ca4c374ba34673e34467d973255ca009e5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:12 -0700
Subject: [PATCH 1196/2396] target/arm: Implement dirtybit check for PIE

Both S1PIE and S2PIE have a bit to make software tracking
of dirty pages easier.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h      |  1 +
 target/arm/ptw.c            | 16 ++++++++++++++++
 target/arm/tcg/tlb_helper.c | 12 +++++++++---
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index b59650959e..69eb1df617 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -752,6 +752,7 @@ struct ARMMMUFaultInfo {
     bool s1ptw;
     bool s1ns;
     bool ea;
+    bool dirtybit;  /* FEAT_S1PIE, FEAT_S2PIE */
 };
 
 /**
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 2e026a7c59..21540a1ec3 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2343,6 +2343,22 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         goto do_fault;
     }
 
+    /* S1PIE and S2PIE both have a bit for software dirty page tracking. */
+    if (access_type == MMU_DATA_STORE && param.pie) {
+        /*
+         * For S1PIE, bit 7 is nDirty and both HA and HD are checked.
+         * For S2PIE, bit 7 is Dirty and only HD is checked.
+         */
+        bool bit7 = extract64(attrs, 7, 1);
+        if (regime_is_stage2(mmu_idx)
+            ? !bit7 && !param.hd
+            : bit7 && !(param.ha && param.hd)) {
+            fi->type = ARMFault_Permission;
+            fi->dirtybit = true;
+            goto do_fault;
+        }
+    }
+
     /* If FEAT_HAFDBS has made changes, update the PTE. */
     if (new_descriptor != descriptor) {
         new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index 23c72a99f5..ae2acd6727 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -24,13 +24,13 @@ bool arm_s1_regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
     return regime_using_lpae_format(env, mmu_idx);
 }
 
-static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+static inline uint64_t merge_syn_data_abort(uint32_t template_syn,
                                             ARMMMUFaultInfo *fi,
                                             unsigned int target_el,
                                             bool same_el, bool is_write,
                                             int fsc)
 {
-    uint32_t syn;
+    uint64_t syn;
 
     /*
      * ISV is only set for stage-2 data aborts routed to EL2 and
@@ -75,6 +75,10 @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
         /* Merge the runtime syndrome with the template syndrome.  */
         syn |= template_syn;
     }
+
+    /* Form ISS2 at the top of the syndrome. */
+    syn |= (uint64_t)fi->dirtybit << 37;
+
     return syn;
 }
 
@@ -176,7 +180,9 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
     int target_el = exception_target_el(env);
     int current_el = arm_current_el(env);
     bool same_el;
-    uint32_t syn, exc, fsr, fsc;
+    uint32_t exc, fsr, fsc;
+    uint64_t syn;
+
     /*
      * We know this must be a data or insn abort, and that
      * env->exception.syndrome contains the template syndrome set

From 4983e3ccc9c384c7ae12822945943a0d8bce6537 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:13 -0700
Subject: [PATCH 1197/2396] target/arm: Enable FEAT_S1PIE and FEAT_S2PIE on
 -cpu max

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 2 ++
 target/arm/tcg/cpu64.c        | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 1aa0a6e4c3..c779a50570 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -123,6 +123,8 @@ the following architecture extensions:
 - FEAT_RME_GPC2 (RME Granule Protection Check 2 Extension)
 - FEAT_RNG (Random number generator)
 - FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
+- FEAT_S1PIE (Stage 1 permission indirections)
+- FEAT_S2PIE (Stage 2 permission indirections)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
 - FEAT_SB (Speculation Barrier)
 - FEAT_SCTLR2 (Extension to SCTLR_ELx)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 8c617fe37b..f024db1d29 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1327,6 +1327,8 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR3, TCRX, 1);       /* FEAT_TCR2 */
     t = FIELD_DP64(t, ID_AA64MMFR3, SCTLRX, 1);     /* FEAT_SCTLR2 */
     t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
+    t = FIELD_DP64(t, ID_AA64MMFR3, S1PIE, 1);    /* FEAT_S1PIE */
+    t = FIELD_DP64(t, ID_AA64MMFR3, S2PIE, 1);    /* FEAT_S2PIE */
     SET_IDREG(isar, ID_AA64MMFR3, t);
 
     t = GET_IDREG(isar, ID_AA64ZFR0);

From d182123974c4377757d50ce93108daef687a8951 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:14 -0700
Subject: [PATCH 1198/2396] include/exec/memopidx: Adjust for 32 mmu indexes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/memopidx.h | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/include/exec/memopidx.h b/include/exec/memopidx.h
index eb7f1591a3..66d9c58b3a 100644
--- a/include/exec/memopidx.h
+++ b/include/exec/memopidx.h
@@ -25,9 +25,10 @@ typedef uint32_t MemOpIdx;
 static inline MemOpIdx make_memop_idx(MemOp op, unsigned idx)
 {
 #ifdef CONFIG_DEBUG_TCG
-    assert(idx <= 15);
+    assert(idx <= 31);
+    assert(clz32(op) >= 5);
 #endif
-    return (op << 4) | idx;
+    return (op << 5) | idx;
 }
 
 /**
@@ -38,7 +39,7 @@ static inline MemOpIdx make_memop_idx(MemOp op, unsigned idx)
  */
 static inline MemOp get_memop(MemOpIdx oi)
 {
-    return oi >> 4;
+    return oi >> 5;
 }
 
 /**
@@ -49,7 +50,7 @@ static inline MemOp get_memop(MemOpIdx oi)
  */
 static inline unsigned get_mmuidx(MemOpIdx oi)
 {
-    return oi & 15;
+    return oi & 31;
 }
 
 #endif

From e1e2f08b431890c757e8dffc760c2719e9577f86 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:15 -0700
Subject: [PATCH 1199/2396] include/hw/core/cpu: Widen MMUIdxMap

Widen MMUIdxMap to 32 bits.  Do not yet expand NB_MMU_MODES,
but widen the map type in preparation.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/cputlb.c    | 3 ---
 include/hw/core/cpu.h | 2 +-
 2 files changed, 1 insertion(+), 4 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 7214d41cb5..3010dd4f5d 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -90,9 +90,6 @@
  */
 QEMU_BUILD_BUG_ON(sizeof(vaddr) > sizeof(run_on_cpu_data));
 
-/* We currently can't handle more than 16 bits in the MMUIDX bitmask.
- */
-QEMU_BUILD_BUG_ON(NB_MMU_MODES > 16);
 #define ALL_MMUIDX_BITS ((1 << NB_MMU_MODES) - 1)
 
 static inline size_t tlb_n_entries(CPUTLBDescFast *fast)
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index 4f7026a119..d175edb6f8 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -201,7 +201,7 @@ struct CPUClass {
  * Fix the number of mmu modes to 16.
  */
 #define NB_MMU_MODES 16
-typedef uint16_t MMUIdxMap;
+typedef uint32_t MMUIdxMap;
 
 /* Use a fully associative victim tlb of 8 entries. */
 #define CPU_VTLB_SIZE 8

From e886dccc8276f22296582338c30c639a24e45ea3 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:16 -0700
Subject: [PATCH 1200/2396] target/arm: Split out mmuidx.h from cpu.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 207 +-----------------------------------------
 target/arm/mmuidx.h | 216 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 217 insertions(+), 206 deletions(-)
 create mode 100644 target/arm/mmuidx.h

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 04b57f1dc5..6773676973 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -33,6 +33,7 @@
 #include "target/arm/multiprocessing.h"
 #include "target/arm/gtimer.h"
 #include "target/arm/cpu-sysregs.h"
+#include "target/arm/mmuidx.h"
 
 #define EXCP_UDEF            1   /* undefined instruction */
 #define EXCP_SWI             2   /* software interrupt */
@@ -2301,212 +2302,6 @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 
 #define TYPE_ARM_HOST_CPU "host-" TYPE_ARM_CPU
 
-/* ARM has the following "translation regimes" (as the ARM ARM calls them):
- *
- * If EL3 is 64-bit:
- *  + NonSecure EL1 & 0 stage 1
- *  + NonSecure EL1 & 0 stage 2
- *  + NonSecure EL2
- *  + NonSecure EL2 & 0   (ARMv8.1-VHE)
- *  + Secure EL1 & 0 stage 1
- *  + Secure EL1 & 0 stage 2 (FEAT_SEL2)
- *  + Secure EL2 (FEAT_SEL2)
- *  + Secure EL2 & 0 (FEAT_SEL2)
- *  + Realm EL1 & 0 stage 1 (FEAT_RME)
- *  + Realm EL1 & 0 stage 2 (FEAT_RME)
- *  + Realm EL2 (FEAT_RME)
- *  + EL3
- * If EL3 is 32-bit:
- *  + NonSecure PL1 & 0 stage 1
- *  + NonSecure PL1 & 0 stage 2
- *  + NonSecure PL2
- *  + Secure PL1 & 0
- * (reminder: for 32 bit EL3, Secure PL1 is *EL3*, not EL1.)
- *
- * For QEMU, an mmu_idx is not quite the same as a translation regime because:
- *  1. we need to split the "EL1 & 0" and "EL2 & 0" regimes into two mmu_idxes,
- *     because they may differ in access permissions even if the VA->PA map is
- *     the same
- *  2. we want to cache in our TLB the full VA->IPA->PA lookup for a stage 1+2
- *     translation, which means that we have one mmu_idx that deals with two
- *     concatenated translation regimes [this sort of combined s1+2 TLB is
- *     architecturally permitted]
- *  3. we don't need to allocate an mmu_idx to translations that we won't be
- *     handling via the TLB. The only way to do a stage 1 translation without
- *     the immediate stage 2 translation is via the ATS or AT system insns,
- *     which can be slow-pathed and always do a page table walk.
- *     The only use of stage 2 translations is either as part of an s1+2
- *     lookup or when loading the descriptors during a stage 1 page table walk,
- *     and in both those cases we don't use the TLB.
- *  4. we can also safely fold together the "32 bit EL3" and "64 bit EL3"
- *     translation regimes, because they map reasonably well to each other
- *     and they can't both be active at the same time.
- *  5. we want to be able to use the TLB for accesses done as part of a
- *     stage1 page table walk, rather than having to walk the stage2 page
- *     table over and over.
- *  6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access
- *     Never (PAN) bit within PSTATE.
- *  7. we fold together most secure and non-secure regimes for A-profile,
- *     because there are no banked system registers for aarch64, so the
- *     process of switching between secure and non-secure is
- *     already heavyweight.
- *  8. we cannot fold together Stage 2 Secure and Stage 2 NonSecure,
- *     because both are in use simultaneously for Secure EL2.
- *
- * This gives us the following list of cases:
- *
- * EL0 EL1&0 stage 1+2 (aka NS PL0 PL1&0 stage 1+2)
- * EL1 EL1&0 stage 1+2 (aka NS PL1 PL1&0 stage 1+2)
- * EL1 EL1&0 stage 1+2 +PAN (aka NS PL1 P1&0 stage 1+2 +PAN)
- * EL0 EL2&0
- * EL2 EL2&0
- * EL2 EL2&0 +PAN
- * EL2 (aka NS PL2)
- * EL3 (aka AArch32 S PL1 PL1&0)
- * AArch32 S PL0 PL1&0 (we call this EL30_0)
- * AArch32 S PL1 PL1&0 +PAN (we call this EL30_3_PAN)
- * Stage2 Secure
- * Stage2 NonSecure
- * plus one TLB per Physical address space: S, NS, Realm, Root
- *
- * for a total of 16 different mmu_idx.
- *
- * R profile CPUs have an MPU, but can use the same set of MMU indexes
- * as A profile. They only need to distinguish EL0 and EL1 (and
- * EL2 for cores like the Cortex-R52).
- *
- * M profile CPUs are rather different as they do not have a true MMU.
- * They have the following different MMU indexes:
- *  User
- *  Privileged
- *  User, execution priority negative (ie the MPU HFNMIENA bit may apply)
- *  Privileged, execution priority negative (ditto)
- * If the CPU supports the v8M Security Extension then there are also:
- *  Secure User
- *  Secure Privileged
- *  Secure User, execution priority negative
- *  Secure Privileged, execution priority negative
- *
- * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
- * are not quite the same -- different CPU types (most notably M profile
- * vs A/R profile) would like to use MMU indexes with different semantics,
- * but since we don't ever need to use all of those in a single CPU we
- * can avoid having to set NB_MMU_MODES to "total number of A profile MMU
- * modes + total number of M profile MMU modes". The lower bits of
- * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
- * the same for any particular CPU.
- * Variables of type ARMMUIdx are always full values, and the core
- * index values are in variables of type 'int'.
- *
- * Our enumeration includes at the end some entries which are not "true"
- * mmu_idx values in that they don't have corresponding TLBs and are only
- * valid for doing slow path page table walks.
- *
- * The constant names here are patterned after the general style of the names
- * of the AT/ATS operations.
- * The values used are carefully arranged to make mmu_idx => EL lookup easy.
- * For M profile we arrange them to have a bit for priv, a bit for negpri
- * and a bit for secure.
- */
-#define ARM_MMU_IDX_A     0x10  /* A profile */
-#define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
-#define ARM_MMU_IDX_M     0x40  /* M profile */
-
-/* Meanings of the bits for M profile mmu idx values */
-#define ARM_MMU_IDX_M_PRIV   0x1
-#define ARM_MMU_IDX_M_NEGPRI 0x2
-#define ARM_MMU_IDX_M_S      0x4  /* Secure */
-
-#define ARM_MMU_IDX_TYPE_MASK \
-    (ARM_MMU_IDX_A | ARM_MMU_IDX_M | ARM_MMU_IDX_NOTLB)
-#define ARM_MMU_IDX_COREIDX_MASK 0xf
-
-typedef enum ARMMMUIdx {
-    /*
-     * A-profile.
-     */
-    ARMMMUIdx_E10_0     = 0 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_0     = 1 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E10_1     = 2 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2     = 3 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E30_0     = 8 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E30_3_PAN = 9 | ARM_MMU_IDX_A,
-
-    /*
-     * Used for second stage of an S12 page table walk, or for descriptor
-     * loads during first stage of an S1 page table walk.  Note that both
-     * are in use simultaneously for SecureEL2: the security state for
-     * the S2 ptw is selected by the NS bit from the S1 ptw.
-     */
-    ARMMMUIdx_Stage2_S  = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Stage2    = 11 | ARM_MMU_IDX_A,
-
-    /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_S     = 12 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_NS    = 13 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_Root  = 14 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_Realm = 15 | ARM_MMU_IDX_A,
-
-    /*
-     * These are not allocated TLBs and are used only for AT system
-     * instructions or for the first stage of an S12 page table walk.
-     */
-    ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
-    ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
-
-    /*
-     * M-profile.
-     */
-    ARMMMUIdx_MUser = ARM_MMU_IDX_M,
-    ARMMMUIdx_MPriv = ARM_MMU_IDX_M | ARM_MMU_IDX_M_PRIV,
-    ARMMMUIdx_MUserNegPri = ARMMMUIdx_MUser | ARM_MMU_IDX_M_NEGPRI,
-    ARMMMUIdx_MPrivNegPri = ARMMMUIdx_MPriv | ARM_MMU_IDX_M_NEGPRI,
-    ARMMMUIdx_MSUser = ARMMMUIdx_MUser | ARM_MMU_IDX_M_S,
-    ARMMMUIdx_MSPriv = ARMMMUIdx_MPriv | ARM_MMU_IDX_M_S,
-    ARMMMUIdx_MSUserNegPri = ARMMMUIdx_MUserNegPri | ARM_MMU_IDX_M_S,
-    ARMMMUIdx_MSPrivNegPri = ARMMMUIdx_MPrivNegPri | ARM_MMU_IDX_M_S,
-} ARMMMUIdx;
-
-/*
- * Bit macros for the core-mmu-index values for each index,
- * for use when calling tlb_flush_by_mmuidx() and friends.
- */
-#define TO_CORE_BIT(NAME) \
-    ARMMMUIdxBit_##NAME = 1 << (ARMMMUIdx_##NAME & ARM_MMU_IDX_COREIDX_MASK)
-
-typedef enum ARMMMUIdxBit {
-    TO_CORE_BIT(E10_0),
-    TO_CORE_BIT(E20_0),
-    TO_CORE_BIT(E10_1),
-    TO_CORE_BIT(E10_1_PAN),
-    TO_CORE_BIT(E2),
-    TO_CORE_BIT(E20_2),
-    TO_CORE_BIT(E20_2_PAN),
-    TO_CORE_BIT(E3),
-    TO_CORE_BIT(E30_0),
-    TO_CORE_BIT(E30_3_PAN),
-    TO_CORE_BIT(Stage2),
-    TO_CORE_BIT(Stage2_S),
-
-    TO_CORE_BIT(MUser),
-    TO_CORE_BIT(MPriv),
-    TO_CORE_BIT(MUserNegPri),
-    TO_CORE_BIT(MPrivNegPri),
-    TO_CORE_BIT(MSUser),
-    TO_CORE_BIT(MSPriv),
-    TO_CORE_BIT(MSUserNegPri),
-    TO_CORE_BIT(MSPrivNegPri),
-} ARMMMUIdxBit;
-
-#undef TO_CORE_BIT
-
-#define MMU_USER_IDX 0
-
 /* Indexes used when registering address spaces with cpu_address_space_init */
 typedef enum ARMASIdx {
     ARMASIdx_NS = 0,
diff --git a/target/arm/mmuidx.h b/target/arm/mmuidx.h
new file mode 100644
index 0000000000..5b9b4bc84f
--- /dev/null
+++ b/target/arm/mmuidx.h
@@ -0,0 +1,216 @@
+/*
+ * QEMU Arm software mmu index definitions
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef TARGET_ARM_MMUIDX_H
+#define TARGET_ARM_MMUIDX_H
+
+/*
+ * Arm has the following "translation regimes" (as the Arm ARM calls them):
+ *
+ * If EL3 is 64-bit:
+ *  + NonSecure EL1 & 0 stage 1
+ *  + NonSecure EL1 & 0 stage 2
+ *  + NonSecure EL2
+ *  + NonSecure EL2 & 0   (ARMv8.1-VHE)
+ *  + Secure EL1 & 0 stage 1
+ *  + Secure EL1 & 0 stage 2 (FEAT_SEL2)
+ *  + Secure EL2 (FEAT_SEL2)
+ *  + Secure EL2 & 0 (FEAT_SEL2)
+ *  + Realm EL1 & 0 stage 1 (FEAT_RME)
+ *  + Realm EL1 & 0 stage 2 (FEAT_RME)
+ *  + Realm EL2 (FEAT_RME)
+ *  + EL3
+ * If EL3 is 32-bit:
+ *  + NonSecure PL1 & 0 stage 1
+ *  + NonSecure PL1 & 0 stage 2
+ *  + NonSecure PL2
+ *  + Secure PL1 & 0
+ * (reminder: for 32 bit EL3, Secure PL1 is *EL3*, not EL1.)
+ *
+ * For QEMU, an mmu_idx is not quite the same as a translation regime because:
+ *  1. we need to split the "EL1 & 0" and "EL2 & 0" regimes into two mmu_idxes,
+ *     because they may differ in access permissions even if the VA->PA map is
+ *     the same
+ *  2. we want to cache in our TLB the full VA->IPA->PA lookup for a stage 1+2
+ *     translation, which means that we have one mmu_idx that deals with two
+ *     concatenated translation regimes [this sort of combined s1+2 TLB is
+ *     architecturally permitted]
+ *  3. we don't need to allocate an mmu_idx to translations that we won't be
+ *     handling via the TLB. The only way to do a stage 1 translation without
+ *     the immediate stage 2 translation is via the ATS or AT system insns,
+ *     which can be slow-pathed and always do a page table walk.
+ *     The only use of stage 2 translations is either as part of an s1+2
+ *     lookup or when loading the descriptors during a stage 1 page table walk,
+ *     and in both those cases we don't use the TLB.
+ *  4. we can also safely fold together the "32 bit EL3" and "64 bit EL3"
+ *     translation regimes, because they map reasonably well to each other
+ *     and they can't both be active at the same time.
+ *  5. we want to be able to use the TLB for accesses done as part of a
+ *     stage1 page table walk, rather than having to walk the stage2 page
+ *     table over and over.
+ *  6. we need separate EL1/EL2 mmu_idx for handling the Privileged Access
+ *     Never (PAN) bit within PSTATE.
+ *  7. we fold together most secure and non-secure regimes for A-profile,
+ *     because there are no banked system registers for aarch64, so the
+ *     process of switching between secure and non-secure is
+ *     already heavyweight.
+ *  8. we cannot fold together Stage 2 Secure and Stage 2 NonSecure,
+ *     because both are in use simultaneously for Secure EL2.
+ *
+ * This gives us the following list of cases:
+ *
+ * EL0 EL1&0 stage 1+2 (aka NS PL0 PL1&0 stage 1+2)
+ * EL1 EL1&0 stage 1+2 (aka NS PL1 PL1&0 stage 1+2)
+ * EL1 EL1&0 stage 1+2 +PAN (aka NS PL1 P1&0 stage 1+2 +PAN)
+ * EL0 EL2&0
+ * EL2 EL2&0
+ * EL2 EL2&0 +PAN
+ * EL2 (aka NS PL2)
+ * EL3 (aka AArch32 S PL1 PL1&0)
+ * AArch32 S PL0 PL1&0 (we call this EL30_0)
+ * AArch32 S PL1 PL1&0 +PAN (we call this EL30_3_PAN)
+ * Stage2 Secure
+ * Stage2 NonSecure
+ * plus one TLB per Physical address space: S, NS, Realm, Root
+ *
+ * for a total of 16 different mmu_idx.
+ *
+ * R profile CPUs have an MPU, but can use the same set of MMU indexes
+ * as A profile. They only need to distinguish EL0 and EL1 (and
+ * EL2 for cores like the Cortex-R52).
+ *
+ * M profile CPUs are rather different as they do not have a true MMU.
+ * They have the following different MMU indexes:
+ *  User
+ *  Privileged
+ *  User, execution priority negative (ie the MPU HFNMIENA bit may apply)
+ *  Privileged, execution priority negative (ditto)
+ * If the CPU supports the v8M Security Extension then there are also:
+ *  Secure User
+ *  Secure Privileged
+ *  Secure User, execution priority negative
+ *  Secure Privileged, execution priority negative
+ *
+ * The ARMMMUIdx and the mmu index value used by the core QEMU TLB code
+ * are not quite the same -- different CPU types (most notably M profile
+ * vs A/R profile) would like to use MMU indexes with different semantics,
+ * but since we don't ever need to use all of those in a single CPU we
+ * can avoid having to set NB_MMU_MODES to "total number of A profile MMU
+ * modes + total number of M profile MMU modes". The lower bits of
+ * ARMMMUIdx are the core TLB mmu index, and the higher bits are always
+ * the same for any particular CPU.
+ * Variables of type ARMMUIdx are always full values, and the core
+ * index values are in variables of type 'int'.
+ *
+ * Our enumeration includes at the end some entries which are not "true"
+ * mmu_idx values in that they don't have corresponding TLBs and are only
+ * valid for doing slow path page table walks.
+ *
+ * The constant names here are patterned after the general style of the names
+ * of the AT/ATS operations.
+ * The values used are carefully arranged to make mmu_idx => EL lookup easy.
+ * For M profile we arrange them to have a bit for priv, a bit for negpri
+ * and a bit for secure.
+ */
+#define ARM_MMU_IDX_A     0x10  /* A profile */
+#define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
+#define ARM_MMU_IDX_M     0x40  /* M profile */
+
+/* Meanings of the bits for M profile mmu idx values */
+#define ARM_MMU_IDX_M_PRIV   0x1
+#define ARM_MMU_IDX_M_NEGPRI 0x2
+#define ARM_MMU_IDX_M_S      0x4  /* Secure */
+
+#define ARM_MMU_IDX_TYPE_MASK \
+    (ARM_MMU_IDX_A | ARM_MMU_IDX_M | ARM_MMU_IDX_NOTLB)
+#define ARM_MMU_IDX_COREIDX_MASK 0xf
+
+typedef enum ARMMMUIdx {
+    /*
+     * A-profile.
+     */
+    ARMMMUIdx_E10_0     = 0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_0     = 1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1     = 2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2     = 3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E30_0     = 8 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E30_3_PAN = 9 | ARM_MMU_IDX_A,
+
+    /*
+     * Used for second stage of an S12 page table walk, or for descriptor
+     * loads during first stage of an S1 page table walk.  Note that both
+     * are in use simultaneously for SecureEL2: the security state for
+     * the S2 ptw is selected by the NS bit from the S1 ptw.
+     */
+    ARMMMUIdx_Stage2_S  = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2    = 11 | ARM_MMU_IDX_A,
+
+    /* TLBs with 1-1 mapping to the physical address spaces. */
+    ARMMMUIdx_Phys_S     = 12 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS    = 13 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Root  = 14 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Realm = 15 | ARM_MMU_IDX_A,
+
+    /*
+     * These are not allocated TLBs and are used only for AT system
+     * instructions or for the first stage of an S12 page table walk.
+     */
+    ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
+
+    /*
+     * M-profile.
+     */
+    ARMMMUIdx_MUser = ARM_MMU_IDX_M,
+    ARMMMUIdx_MPriv = ARM_MMU_IDX_M | ARM_MMU_IDX_M_PRIV,
+    ARMMMUIdx_MUserNegPri = ARMMMUIdx_MUser | ARM_MMU_IDX_M_NEGPRI,
+    ARMMMUIdx_MPrivNegPri = ARMMMUIdx_MPriv | ARM_MMU_IDX_M_NEGPRI,
+    ARMMMUIdx_MSUser = ARMMMUIdx_MUser | ARM_MMU_IDX_M_S,
+    ARMMMUIdx_MSPriv = ARMMMUIdx_MPriv | ARM_MMU_IDX_M_S,
+    ARMMMUIdx_MSUserNegPri = ARMMMUIdx_MUserNegPri | ARM_MMU_IDX_M_S,
+    ARMMMUIdx_MSPrivNegPri = ARMMMUIdx_MPrivNegPri | ARM_MMU_IDX_M_S,
+} ARMMMUIdx;
+
+/*
+ * Bit macros for the core-mmu-index values for each index,
+ * for use when calling tlb_flush_by_mmuidx() and friends.
+ */
+#define TO_CORE_BIT(NAME) \
+    ARMMMUIdxBit_##NAME = 1 << (ARMMMUIdx_##NAME & ARM_MMU_IDX_COREIDX_MASK)
+
+typedef enum ARMMMUIdxBit {
+    TO_CORE_BIT(E10_0),
+    TO_CORE_BIT(E20_0),
+    TO_CORE_BIT(E10_1),
+    TO_CORE_BIT(E10_1_PAN),
+    TO_CORE_BIT(E2),
+    TO_CORE_BIT(E20_2),
+    TO_CORE_BIT(E20_2_PAN),
+    TO_CORE_BIT(E3),
+    TO_CORE_BIT(E30_0),
+    TO_CORE_BIT(E30_3_PAN),
+    TO_CORE_BIT(Stage2),
+    TO_CORE_BIT(Stage2_S),
+
+    TO_CORE_BIT(MUser),
+    TO_CORE_BIT(MPriv),
+    TO_CORE_BIT(MUserNegPri),
+    TO_CORE_BIT(MPrivNegPri),
+    TO_CORE_BIT(MSUser),
+    TO_CORE_BIT(MSPriv),
+    TO_CORE_BIT(MSUserNegPri),
+    TO_CORE_BIT(MSPrivNegPri),
+} ARMMMUIdxBit;
+
+#undef TO_CORE_BIT
+
+#define MMU_USER_IDX 0
+
+#endif /* TARGET_ARM_MMUIDX_H */

From 65ef0f2b33621fcc24ca54936475a00604e9a62e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:17 -0700
Subject: [PATCH 1201/2396] target/arm: Convert arm_mmu_idx_to_el from switch
 to table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In an effort to keep all ARMMMUIdx data in one place, begin construction
of an info table describing all of the properties of the mmu_idx.  Begin
with the access EL.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c          | 27 ------------------------
 target/arm/internals.h       |  3 +--
 target/arm/meson.build       |  7 +++++-
 target/arm/mmuidx-internal.h | 29 +++++++++++++++++++++++++
 target/arm/mmuidx.c          | 41 ++++++++++++++++++++++++++++++++++++
 5 files changed, 77 insertions(+), 30 deletions(-)
 create mode 100644 target/arm/mmuidx-internal.h
 create mode 100644 target/arm/mmuidx.c

diff --git a/target/arm/helper.c b/target/arm/helper.c
index bd5321348a..b1d68da133 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9653,33 +9653,6 @@ int fp_exception_el(CPUARMState *env, int cur_el)
     return 0;
 }
 
-/* Return the exception level we're running at if this is our mmu_idx */
-int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-{
-    if (mmu_idx & ARM_MMU_IDX_M) {
-        return mmu_idx & ARM_MMU_IDX_M_PRIV;
-    }
-
-    switch (mmu_idx) {
-    case ARMMMUIdx_E10_0:
-    case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_E30_0:
-        return 0;
-    case ARMMMUIdx_E10_1:
-    case ARMMMUIdx_E10_1_PAN:
-        return 1;
-    case ARMMMUIdx_E2:
-    case ARMMMUIdx_E20_2:
-    case ARMMMUIdx_E20_2_PAN:
-        return 2;
-    case ARMMMUIdx_E3:
-    case ARMMMUIdx_E30_3_PAN:
-        return 3;
-    default:
-        g_assert_not_reached();
-    }
-}
-
 #ifndef CONFIG_TCG
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 69eb1df617..1a234d41c2 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -34,6 +34,7 @@
 #include "system/memory.h"
 #include "syndrome.h"
 #include "cpu-features.h"
+#include "mmuidx-internal.h"
 
 /* register banks for CPU modes */
 #define BANK_USRSYS 0
@@ -984,8 +985,6 @@ static inline ARMMMUIdx core_to_aa64_mmu_idx(int mmu_idx)
     return mmu_idx | ARM_MMU_IDX_A;
 }
 
-int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
-
 /* Return the MMU index for a v7M CPU in the specified security state */
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
 
diff --git a/target/arm/meson.build b/target/arm/meson.build
index 638ee62525..f9f0beef05 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -6,7 +6,12 @@ arm_ss.add(files(
 
 arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'cpu64.c',
-  'gdbstub64.c'))
+  'gdbstub64.c'
+))
+
+arm_common_ss.add(files(
+  'mmuidx.c',
+))
 
 arm_system_ss = ss.source_set()
 arm_common_system_ss = ss.source_set()
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
new file mode 100644
index 0000000000..29bba4ecb5
--- /dev/null
+++ b/target/arm/mmuidx-internal.h
@@ -0,0 +1,29 @@
+/*
+ * QEMU Arm software mmu index internal definitions
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef TARGET_ARM_MMUIDX_INTERNAL_H
+#define TARGET_ARM_MMUIDX_INTERNAL_H
+
+#include "mmuidx.h"
+#include "tcg/debug-assert.h"
+#include "hw/registerfields.h"
+
+
+FIELD(MMUIDXINFO, EL, 0, 2)
+FIELD(MMUIDXINFO, ELVALID, 2, 1)
+
+extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
+
+#define arm_mmuidx_is_valid(x)  ((unsigned)(x) < ARRAY_SIZE(arm_mmuidx_table))
+
+/* Return the exception level associated with this mmu index. */
+static inline int arm_mmu_idx_to_el(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    tcg_debug_assert(FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, ELVALID));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, EL);
+}
+
+#endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
new file mode 100644
index 0000000000..309b1d68df
--- /dev/null
+++ b/target/arm/mmuidx.c
@@ -0,0 +1,41 @@
+/*
+ * QEMU Arm software mmu index definitions
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "mmuidx-internal.h"
+
+
+#define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK)
+
+const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
+    /*
+     * A-profile.
+     */
+    [ARMMMUIdx_E10_0]           = EL(0),
+    [ARMMMUIdx_E10_1]           = EL(1),
+    [ARMMMUIdx_E10_1_PAN]       = EL(1),
+
+    [ARMMMUIdx_E20_0]           = EL(0),
+    [ARMMMUIdx_E20_2]           = EL(2),
+    [ARMMMUIdx_E20_2_PAN]       = EL(2),
+
+    [ARMMMUIdx_E2]              = EL(2),
+
+    [ARMMMUIdx_E3]              = EL(3),
+    [ARMMMUIdx_E30_0]           = EL(0),
+    [ARMMMUIdx_E30_3_PAN]       = EL(3),
+
+    /*
+     * M-profile.
+     */
+    [ARMMMUIdx_MUser]           = EL(0),
+    [ARMMMUIdx_MPriv]           = EL(1),
+    [ARMMMUIdx_MUserNegPri]     = EL(0),
+    [ARMMMUIdx_MPrivNegPri]     = EL(1),
+    [ARMMMUIdx_MSUser]          = EL(0),
+    [ARMMMUIdx_MSPriv]          = EL(1),
+    [ARMMMUIdx_MSUserNegPri]    = EL(0),
+    [ARMMMUIdx_MSPrivNegPri]    = EL(1),
+};

From 5dccad96b1f089a2d97262565a26960cf04e1579 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:18 -0700
Subject: [PATCH 1202/2396] target/arm: Remove unused env argument from
 regime_el
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c         |  2 +-
 target/arm/internals.h      |  8 ++++----
 target/arm/ptw.c            | 34 +++++++++++++++++-----------------
 target/arm/tcg/mte_helper.c |  2 +-
 4 files changed, 23 insertions(+), 23 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index b1d68da133..a55161ef40 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9391,7 +9391,7 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
     bool stage2 = regime_is_stage2(mmu_idx);
-    int r_el = regime_el(env, mmu_idx);
+    int r_el = regime_el(mmu_idx);
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 1a234d41c2..bd7ea82067 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1074,7 +1074,7 @@ static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
 }
 
 /* Return the exception level which controls this address translation regime */
-static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
+static inline uint32_t regime_el(ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
     case ARMMMUIdx_E20_0:
@@ -1128,7 +1128,7 @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
 /* Return the SCTLR value which controls this address translation regime */
 static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
-    return env->cp15.sctlr_el[regime_el(env, mmu_idx)];
+    return env->cp15.sctlr_el[regime_el(mmu_idx)];
 }
 
 /*
@@ -1160,13 +1160,13 @@ static inline uint64_t regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
         v |= env->cp15.vtcr_el2 & VTCR_SHARED_FIELD_MASK;
         return v;
     }
-    return env->cp15.tcr_el[regime_el(env, mmu_idx)];
+    return env->cp15.tcr_el[regime_el(mmu_idx)];
 }
 
 /* Return true if the translation regime is using LPAE format page tables */
 static inline bool regime_using_lpae_format(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
-    int el = regime_el(env, mmu_idx);
+    int el = regime_el(mmu_idx);
     if (el == 2 || arm_el_is_aa64(env, el)) {
         return true;
     }
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 21540a1ec3..9c89ffe8a5 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -235,9 +235,9 @@ static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
         return env->cp15.vsttbr_el2;
     }
     if (ttbrn == 0) {
-        return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
+        return env->cp15.ttbr0_el[regime_el(mmu_idx)];
     } else {
-        return env->cp15.ttbr1_el[regime_el(env, mmu_idx)];
+        return env->cp15.ttbr1_el[regime_el(mmu_idx)];
     }
 }
 
@@ -1059,7 +1059,7 @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
     }
     type = (desc & 3);
     domain = (desc >> 5) & 0x0f;
-    if (regime_el(env, ptw->in_mmu_idx) == 1) {
+    if (regime_el(ptw->in_mmu_idx) == 1) {
         dacr = env->cp15.dacr_ns;
     } else {
         dacr = env->cp15.dacr_s;
@@ -1198,7 +1198,7 @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         /* Page or Section.  */
         domain = (desc >> 5) & 0x0f;
     }
-    if (regime_el(env, mmu_idx) == 1) {
+    if (regime_el(mmu_idx) == 1) {
         dacr = env->cp15.dacr_ns;
     } else {
         dacr = env->cp15.dacr_s;
@@ -1489,7 +1489,7 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
             xn = pxn || (user_rw & PAGE_WRITE);
         }
     } else if (arm_feature(env, ARM_FEATURE_V7)) {
-        switch (regime_el(env, mmu_idx)) {
+        switch (regime_el(mmu_idx)) {
         case 1:
         case 3:
             if (is_user) {
@@ -1545,7 +1545,7 @@ static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
         /* F */ 0,             /* reserved */
     };
 
-    uint32_t el = regime_el(env, mmu_idx);
+    uint32_t el = regime_el(mmu_idx);
     uint64_t pir = env->cp15.pir_el[el];
     uint64_t pire0 = 0;
     int perm;
@@ -1620,7 +1620,7 @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
                                           ARMMMUIdx mmu_idx)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    uint32_t el = regime_el(env, mmu_idx);
+    uint32_t el = regime_el(mmu_idx);
     int select, tsz;
     bool epd, hpd;
 
@@ -1846,7 +1846,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
     int ap, prot;
-    uint32_t el = regime_el(env, mmu_idx);
+    uint32_t el = regime_el(mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     uint64_t descriptor, new_descriptor;
@@ -2296,7 +2296,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
-        mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
+        mair = env->cp15.mair_el[regime_el(mmu_idx)];
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
@@ -2774,7 +2774,7 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
 static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
                              uint32_t secure)
 {
-    if (regime_el(env, mmu_idx) == 2) {
+    if (regime_el(mmu_idx) == 2) {
         return env->pmsav8.hprbar;
     } else {
         return env->pmsav8.rbar[secure];
@@ -2784,7 +2784,7 @@ static uint32_t *regime_rbar(CPUARMState *env, ARMMMUIdx mmu_idx,
 static uint32_t *regime_rlar(CPUARMState *env, ARMMMUIdx mmu_idx,
                              uint32_t secure)
 {
-    if (regime_el(env, mmu_idx) == 2) {
+    if (regime_el(mmu_idx) == 2) {
         return env->pmsav8.hprlar;
     } else {
         return env->pmsav8.rlar[secure];
@@ -2816,7 +2816,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
     uint32_t addr_page_limit = addr_page_base + (TARGET_PAGE_SIZE - 1);
     int region_counter;
 
-    if (regime_el(env, mmu_idx) == 2) {
+    if (regime_el(mmu_idx) == 2) {
         region_counter = cpu->pmsav8r_hdregion;
     } else {
         region_counter = cpu->pmsav7_dregion;
@@ -2942,7 +2942,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
             xn = 1;
         }
 
-        if (regime_el(env, mmu_idx) == 2) {
+        if (regime_el(mmu_idx) == 2) {
             result->f.prot = simple_ap_to_rw_prot_is_user(ap,
                                             mmu_idx != ARMMMUIdx_E2);
         } else {
@@ -2951,7 +2951,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
 
         if (!arm_feature(env, ARM_FEATURE_M)) {
             uint8_t attrindx = extract32(matched_rlar, 1, 3);
-            uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
+            uint64_t mair = env->cp15.mair_el[regime_el(mmu_idx)];
             uint8_t sh = extract32(matched_rlar, 3, 2);
 
             if (regime_sctlr(env, mmu_idx) & SCTLR_WXN &&
@@ -2959,7 +2959,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
                 xn = 0x1;
             }
 
-            if ((regime_el(env, mmu_idx) == 1) &&
+            if ((regime_el(mmu_idx) == 1) &&
                 regime_sctlr(env, mmu_idx) & SCTLR_UWXN && ap == 0x1) {
                 pxn = 0x1;
             }
@@ -3444,7 +3444,7 @@ static bool get_phys_addr_disabled(CPUARMState *env,
         break;
 
     default:
-        r_el = regime_el(env, mmu_idx);
+        r_el = regime_el(mmu_idx);
         if (arm_el_is_aa64(env, r_el)) {
             int pamax = arm_pamax(env_archcpu(env));
             uint64_t tcr = env->cp15.tcr_el[r_el];
@@ -3697,7 +3697,7 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
      */
     if (address < 0x02000000 && mmu_idx != ARMMMUIdx_Stage2
         && !arm_feature(env, ARM_FEATURE_V8)) {
-        if (regime_el(env, mmu_idx) == 3) {
+        if (regime_el(mmu_idx) == 3) {
             address += env->cp15.fcseidr_s;
         } else {
             address += env->cp15.fcseidr_ns;
diff --git a/target/arm/tcg/mte_helper.c b/target/arm/tcg/mte_helper.c
index b96c953f80..bb48fe359b 100644
--- a/target/arm/tcg/mte_helper.c
+++ b/target/arm/tcg/mte_helper.c
@@ -605,7 +605,7 @@ void mte_check_fail(CPUARMState *env, uint32_t desc,
     int el, reg_el, tcf;
     uint64_t sctlr;
 
-    reg_el = regime_el(env, arm_mmu_idx);
+    reg_el = regime_el(arm_mmu_idx);
     sctlr = env->cp15.sctlr_el[reg_el];
 
     switch (arm_mmu_idx) {

From 9fe4b77afef948acfee1681ae7c0c2860c48dd5d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:19 -0700
Subject: [PATCH 1203/2396] target/arm: Convert regime_el from switch to table

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 35 ----------------------------
 target/arm/mmuidx-internal.h | 13 +++++++++++
 target/arm/mmuidx.c          | 44 +++++++++++++++++++++---------------
 3 files changed, 39 insertions(+), 53 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index bd7ea82067..319c39a4ac 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1073,41 +1073,6 @@ static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
     return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 }
 
-/* Return the exception level which controls this address translation regime */
-static inline uint32_t regime_el(ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_E20_2:
-    case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_Stage2:
-    case ARMMMUIdx_Stage2_S:
-    case ARMMMUIdx_E2:
-        return 2;
-    case ARMMMUIdx_E3:
-    case ARMMMUIdx_E30_0:
-    case ARMMMUIdx_E30_3_PAN:
-        return 3;
-    case ARMMMUIdx_E10_0:
-    case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_Stage1_E1:
-    case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_E10_1:
-    case ARMMMUIdx_E10_1_PAN:
-    case ARMMMUIdx_MPrivNegPri:
-    case ARMMMUIdx_MUserNegPri:
-    case ARMMMUIdx_MPriv:
-    case ARMMMUIdx_MUser:
-    case ARMMMUIdx_MSPrivNegPri:
-    case ARMMMUIdx_MSUserNegPri:
-    case ARMMMUIdx_MSPriv:
-    case ARMMMUIdx_MSUser:
-        return 1;
-    default:
-        g_assert_not_reached();
-    }
-}
-
 static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index 29bba4ecb5..d8d64a14d6 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -13,6 +13,8 @@
 
 FIELD(MMUIDXINFO, EL, 0, 2)
 FIELD(MMUIDXINFO, ELVALID, 2, 1)
+FIELD(MMUIDXINFO, REL, 3, 2)
+FIELD(MMUIDXINFO, RELVALID, 5, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -26,4 +28,15 @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, EL);
 }
 
+/*
+ * Return the exception level for the address translation regime
+ * associated with this mmu index.
+ */
+static inline uint32_t regime_el(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    tcg_debug_assert(FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, RELVALID));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, REL);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 309b1d68df..6dfefa56c2 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -8,34 +8,42 @@
 
 
 #define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK)
+#define REL(X) ((X << R_MMUIDXINFO_REL_SHIFT) | R_MMUIDXINFO_RELVALID_MASK)
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
      * A-profile.
      */
-    [ARMMMUIdx_E10_0]           = EL(0),
-    [ARMMMUIdx_E10_1]           = EL(1),
-    [ARMMMUIdx_E10_1_PAN]       = EL(1),
+    [ARMMMUIdx_E10_0]           = EL(0) | REL(1),
+    [ARMMMUIdx_E10_1]           = EL(1) | REL(1),
+    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1),
 
-    [ARMMMUIdx_E20_0]           = EL(0),
-    [ARMMMUIdx_E20_2]           = EL(2),
-    [ARMMMUIdx_E20_2_PAN]       = EL(2),
+    [ARMMMUIdx_E20_0]           = EL(0) | REL(2),
+    [ARMMMUIdx_E20_2]           = EL(2) | REL(2),
+    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2),
 
-    [ARMMMUIdx_E2]              = EL(2),
+    [ARMMMUIdx_E2]              = EL(2) | REL(2),
 
-    [ARMMMUIdx_E3]              = EL(3),
-    [ARMMMUIdx_E30_0]           = EL(0),
-    [ARMMMUIdx_E30_3_PAN]       = EL(3),
+    [ARMMMUIdx_E3]              = EL(3) | REL(3),
+    [ARMMMUIdx_E30_0]           = EL(0) | REL(3),
+    [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3),
+
+    [ARMMMUIdx_Stage2_S]        = REL(2),
+    [ARMMMUIdx_Stage2]          = REL(2),
+
+    [ARMMMUIdx_Stage1_E0]       = REL(1),
+    [ARMMMUIdx_Stage1_E1]       = REL(1),
+    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1),
 
     /*
      * M-profile.
      */
-    [ARMMMUIdx_MUser]           = EL(0),
-    [ARMMMUIdx_MPriv]           = EL(1),
-    [ARMMMUIdx_MUserNegPri]     = EL(0),
-    [ARMMMUIdx_MPrivNegPri]     = EL(1),
-    [ARMMMUIdx_MSUser]          = EL(0),
-    [ARMMMUIdx_MSPriv]          = EL(1),
-    [ARMMMUIdx_MSUserNegPri]    = EL(0),
-    [ARMMMUIdx_MSPrivNegPri]    = EL(1),
+    [ARMMMUIdx_MUser]           = EL(0) | REL(1),
+    [ARMMMUIdx_MPriv]           = EL(1) | REL(1),
+    [ARMMMUIdx_MUserNegPri]     = EL(0) | REL(1),
+    [ARMMMUIdx_MPrivNegPri]     = EL(1) | REL(1),
+    [ARMMMUIdx_MSUser]          = EL(0) | REL(1),
+    [ARMMMUIdx_MSPriv]          = EL(1) | REL(1),
+    [ARMMMUIdx_MSUserNegPri]    = EL(0) | REL(1),
+    [ARMMMUIdx_MSPrivNegPri]    = EL(1) | REL(1),
 };

From bb39dd76d7f66eb4e5d513cdc2ed0179f5c1cc7f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:20 -0700
Subject: [PATCH 1204/2396] target/arm: Convert regime_has_2_ranges from switch
 to table

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 28 ----------------------------
 target/arm/mmuidx-internal.h | 17 +++++++++++++++++
 target/arm/mmuidx.c          | 19 ++++++++++---------
 3 files changed, 27 insertions(+), 37 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 319c39a4ac..061472a943 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1027,34 +1027,6 @@ static inline void arm_call_el_change_hook(ARMCPU *cpu)
     }
 }
 
-/*
- * Return true if this address translation regime has two ranges.
- * Note that this will not return the correct answer for AArch32
- * Secure PL1&0 (i.e. mmu indexes E3, E30_0, E30_3_PAN), but it is
- * never called from a context where EL3 can be AArch32. (The
- * correct return value for ARMMMUIdx_E3 would be different for
- * that case, so we can't just make the function return the
- * correct value anyway; we would need an extra "bool e3_is_aarch32"
- * argument which all the current callsites would pass as 'false'.)
- */
-static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_Stage1_E1:
-    case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_E10_0:
-    case ARMMMUIdx_E10_1:
-    case ARMMMUIdx_E10_1_PAN:
-    case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_E20_2:
-    case ARMMMUIdx_E20_2_PAN:
-        return true;
-    default:
-        return false;
-    }
-}
-
 static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index d8d64a14d6..f03a2ab94c 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -15,6 +15,7 @@ FIELD(MMUIDXINFO, EL, 0, 2)
 FIELD(MMUIDXINFO, ELVALID, 2, 1)
 FIELD(MMUIDXINFO, REL, 3, 2)
 FIELD(MMUIDXINFO, RELVALID, 5, 1)
+FIELD(MMUIDXINFO, 2RANGES, 6, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -39,4 +40,20 @@ static inline uint32_t regime_el(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, REL);
 }
 
+/*
+ * Return true if this address translation regime has two ranges.
+ * Note that this will not return the correct answer for AArch32
+ * Secure PL1&0 (i.e. mmu indexes E3, E30_0, E30_3_PAN), but it is
+ * never called from a context where EL3 can be AArch32. (The
+ * correct return value for ARMMMUIdx_E3 would be different for
+ * that case, so we can't just make the function return the
+ * correct value anyway; we would need an extra "bool e3_is_aarch32"
+ * argument which all the current callsites would pass as 'false'.)
+ */
+static inline bool regime_has_2_ranges(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, 2RANGES);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 6dfefa56c2..f880d21606 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -9,18 +9,19 @@
 
 #define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK)
 #define REL(X) ((X << R_MMUIDXINFO_REL_SHIFT) | R_MMUIDXINFO_RELVALID_MASK)
+#define R2     R_MMUIDXINFO_2RANGES_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
      * A-profile.
      */
-    [ARMMMUIdx_E10_0]           = EL(0) | REL(1),
-    [ARMMMUIdx_E10_1]           = EL(1) | REL(1),
-    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1),
+    [ARMMMUIdx_E10_0]           = EL(0) | REL(1) | R2,
+    [ARMMMUIdx_E10_1]           = EL(1) | REL(1) | R2,
+    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2,
 
-    [ARMMMUIdx_E20_0]           = EL(0) | REL(2),
-    [ARMMMUIdx_E20_2]           = EL(2) | REL(2),
-    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2),
+    [ARMMMUIdx_E20_0]           = EL(0) | REL(2) | R2,
+    [ARMMMUIdx_E20_2]           = EL(2) | REL(2) | R2,
+    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2,
 
     [ARMMMUIdx_E2]              = EL(2) | REL(2),
 
@@ -31,9 +32,9 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_Stage2_S]        = REL(2),
     [ARMMMUIdx_Stage2]          = REL(2),
 
-    [ARMMMUIdx_Stage1_E0]       = REL(1),
-    [ARMMMUIdx_Stage1_E1]       = REL(1),
-    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1),
+    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2,
+    [ARMMMUIdx_Stage1_E1]       = REL(1) | R2,
+    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2,
 
     /*
      * M-profile.

From 59af12841b749c15d2a26a8f4222bc7627d00d01 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:21 -0700
Subject: [PATCH 1205/2396] target/arm: Remove unused env argument from
 regime_is_pan
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 +-
 target/arm/ptw.c       | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 061472a943..cb2ffeff59 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1027,7 +1027,7 @@ static inline void arm_call_el_change_hook(ARMCPU *cpu)
     }
 }
 
-static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
+static inline bool regime_is_pan(ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
     case ARMMMUIdx_Stage1_E1_PAN:
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 9c89ffe8a5..1080b6d69d 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1429,10 +1429,10 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
          * We make the IMPDEF choices that SCR_EL3.SIF and Realm EL2&0
          * do not affect EPAN.
          */
-        if (user_rw && regime_is_pan(env, mmu_idx)) {
+        if (user_rw && regime_is_pan(mmu_idx)) {
             prot_rw = 0;
         } else if (cpu_isar_feature(aa64_pan3, cpu) && is_aa64 &&
-                   regime_is_pan(env, mmu_idx) &&
+                   regime_is_pan(mmu_idx) &&
                    (regime_sctlr(env, mmu_idx) & SCTLR_EPAN) && !xn) {
             prot_rw = 0;
         }
@@ -1571,7 +1571,7 @@ static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
             p_perm &= ~(PAGE_RWX | PAGE_GCS);
             u_perm &= ~(PAGE_RWX | PAGE_GCS);
         }
-        if ((u_perm & (PAGE_RWX | PAGE_GCS)) && regime_is_pan(env, mmu_idx)) {
+        if ((u_perm & (PAGE_RWX | PAGE_GCS)) && regime_is_pan(mmu_idx)) {
             p_perm &= ~(PAGE_READ | PAGE_WRITE);
         }
         perm = regime_is_user(env, mmu_idx) ? u_perm : p_perm;

From ceab42c677484b9d6c97c91e59f8263685e891f5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:22 -0700
Subject: [PATCH 1206/2396] target/arm: Convert regime_is_pan from switch to
 table

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 13 -------------
 target/arm/mmuidx-internal.h |  8 ++++++++
 target/arm/mmuidx.c          |  9 +++++----
 3 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index cb2ffeff59..819ada7a5d 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1027,19 +1027,6 @@ static inline void arm_call_el_change_hook(ARMCPU *cpu)
     }
 }
 
-static inline bool regime_is_pan(ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_Stage1_E1_PAN:
-    case ARMMMUIdx_E10_1_PAN:
-    case ARMMMUIdx_E20_2_PAN:
-    case ARMMMUIdx_E30_3_PAN:
-        return true;
-    default:
-        return false;
-    }
-}
-
 static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
 {
     return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index f03a2ab94c..41baf1a003 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -16,6 +16,7 @@ FIELD(MMUIDXINFO, ELVALID, 2, 1)
 FIELD(MMUIDXINFO, REL, 3, 2)
 FIELD(MMUIDXINFO, RELVALID, 5, 1)
 FIELD(MMUIDXINFO, 2RANGES, 6, 1)
+FIELD(MMUIDXINFO, PAN, 7, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -56,4 +57,11 @@ static inline bool regime_has_2_ranges(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, 2RANGES);
 }
 
+/* Return true if Privileged Access Never is enabled for this mmu index. */
+static inline bool regime_is_pan(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, PAN);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index f880d21606..98db02b8e5 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -10,6 +10,7 @@
 #define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK)
 #define REL(X) ((X << R_MMUIDXINFO_REL_SHIFT) | R_MMUIDXINFO_RELVALID_MASK)
 #define R2     R_MMUIDXINFO_2RANGES_MASK
+#define PAN    R_MMUIDXINFO_PAN_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
@@ -17,24 +18,24 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
      */
     [ARMMMUIdx_E10_0]           = EL(0) | REL(1) | R2,
     [ARMMMUIdx_E10_1]           = EL(1) | REL(1) | R2,
-    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2,
+    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2 | PAN,
 
     [ARMMMUIdx_E20_0]           = EL(0) | REL(2) | R2,
     [ARMMMUIdx_E20_2]           = EL(2) | REL(2) | R2,
-    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2,
+    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2 | PAN,
 
     [ARMMMUIdx_E2]              = EL(2) | REL(2),
 
     [ARMMMUIdx_E3]              = EL(3) | REL(3),
     [ARMMMUIdx_E30_0]           = EL(0) | REL(3),
-    [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3),
+    [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3) | PAN,
 
     [ARMMMUIdx_Stage2_S]        = REL(2),
     [ARMMMUIdx_Stage2]          = REL(2),
 
     [ARMMMUIdx_Stage1_E0]       = REL(1) | R2,
     [ARMMMUIdx_Stage1_E1]       = REL(1) | R2,
-    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2,
+    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | PAN,
 
     /*
      * M-profile.

From b1af3bb87a808270bd6a0a48833e71a6ba506829 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:23 -0700
Subject: [PATCH 1207/2396] target/arm: Remove unused env argument from
 regime_is_user
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    |  2 +-
 target/arm/internals.h |  2 +-
 target/arm/ptw.c       | 16 ++++++++--------
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index a55161ef40..aed245fd86 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9450,7 +9450,7 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         ds = extract64(tcr, 59, 1);
 
         if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
-            regime_is_user(env, mmu_idx)) {
+            regime_is_user(mmu_idx)) {
             epd = true;
         }
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 819ada7a5d..d0d976cbb0 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1032,7 +1032,7 @@ static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
     return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 }
 
-static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
+static inline bool regime_is_user(ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
     case ARMMMUIdx_E10_0:
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 1080b6d69d..d6d4bf3b23 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1000,7 +1000,7 @@ static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
                          int ap, int domain_prot)
 {
    return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
-                                regime_is_user(env, mmu_idx));
+                                regime_is_user(mmu_idx));
 }
 
 /*
@@ -1026,7 +1026,7 @@ static int simple_ap_to_rw_prot_is_user(int ap, bool is_user)
 
 static int simple_ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx, int ap)
 {
-    return simple_ap_to_rw_prot_is_user(ap, regime_is_user(env, mmu_idx));
+    return simple_ap_to_rw_prot_is_user(ap, regime_is_user(mmu_idx));
 }
 
 static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
@@ -1412,7 +1412,7 @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
                       ARMSecuritySpace in_pa, ARMSecuritySpace out_pa)
 {
     ARMCPU *cpu = env_archcpu(env);
-    bool is_user = regime_is_user(env, mmu_idx);
+    bool is_user = regime_is_user(mmu_idx);
     bool have_wxn;
     int wxn = 0;
 
@@ -1574,7 +1574,7 @@ static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
         if ((u_perm & (PAGE_RWX | PAGE_GCS)) && regime_is_pan(mmu_idx)) {
             p_perm &= ~(PAGE_READ | PAGE_WRITE);
         }
-        perm = regime_is_user(env, mmu_idx) ? u_perm : p_perm;
+        perm = regime_is_user(mmu_idx) ? u_perm : p_perm;
     }
 
     if (in_pa != out_pa) {
@@ -2421,7 +2421,7 @@ static bool get_phys_addr_pmsav5(CPUARMState *env,
     uint32_t mask;
     uint32_t base;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_user = regime_is_user(env, mmu_idx);
+    bool is_user = regime_is_user(mmu_idx);
 
     if (regime_translation_disabled(env, mmu_idx, ptw->in_space)) {
         /* MPU disabled.  */
@@ -2588,7 +2588,7 @@ static bool get_phys_addr_pmsav7(CPUARMState *env,
     ARMCPU *cpu = env_archcpu(env);
     int n;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    bool is_user = regime_is_user(env, mmu_idx);
+    bool is_user = regime_is_user(mmu_idx);
     bool secure = arm_space_is_secure(ptw->in_space);
 
     result->f.phys_addr = address;
@@ -2808,7 +2808,7 @@ bool pmsav8_mpu_lookup(CPUARMState *env, uint32_t address,
      * memory system to use a subpage.
      */
     ARMCPU *cpu = env_archcpu(env);
-    bool is_user = regime_is_user(env, mmu_idx);
+    bool is_user = regime_is_user(mmu_idx);
     int n;
     int matchregion = -1;
     bool hit = false;
@@ -3689,7 +3689,7 @@ static bool get_phys_addr_nogpc(CPUARMState *env, S1Translate *ptw,
         break;
     }
 
-    result->f.attrs.user = regime_is_user(env, mmu_idx);
+    result->f.attrs.user = regime_is_user(mmu_idx);
 
     /*
      * Fast Context Switch Extension. This doesn't exist at all in v8.

From 38e5e7018b9d3dbce30999b38d10cc5d7315da8c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:24 -0700
Subject: [PATCH 1208/2396] target/arm: Convert regime_is_user from switch to
 table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-25-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 17 -----------------
 target/arm/mmuidx-internal.h | 12 ++++++++++++
 target/arm/mmuidx.c          |  6 ++++--
 3 files changed, 16 insertions(+), 19 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index d0d976cbb0..c4aef8b50e 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1032,23 +1032,6 @@ static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
     return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 }
 
-static inline bool regime_is_user(ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_E10_0:
-    case ARMMMUIdx_E20_0:
-    case ARMMMUIdx_E30_0:
-    case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_MUser:
-    case ARMMMUIdx_MSUser:
-    case ARMMMUIdx_MUserNegPri:
-    case ARMMMUIdx_MSUserNegPri:
-        return true;
-    default:
-        return false;
-    }
-}
-
 /* Return the SCTLR value which controls this address translation regime */
 static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index 41baf1a003..3e51c0f579 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -17,6 +17,7 @@ FIELD(MMUIDXINFO, REL, 3, 2)
 FIELD(MMUIDXINFO, RELVALID, 5, 1)
 FIELD(MMUIDXINFO, 2RANGES, 6, 1)
 FIELD(MMUIDXINFO, PAN, 7, 1)
+FIELD(MMUIDXINFO, USER, 8, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -64,4 +65,15 @@ static inline bool regime_is_pan(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, PAN);
 }
 
+/*
+ * Return true if the exception level associated with this mmu index is 0.
+ * Differs from arm_mmu_idx_to_el(idx) == 0 in that this allows querying
+ * Stage1 and Stage2 mmu indexes.
+ */
+static inline bool regime_is_user(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, USER);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 98db02b8e5..1c1e062bfe 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -7,10 +7,12 @@
 #include "mmuidx-internal.h"
 
 
-#define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK)
+#define EL(X)  ((X << R_MMUIDXINFO_EL_SHIFT) | R_MMUIDXINFO_ELVALID_MASK | \
+                ((X == 0) << R_MMUIDXINFO_USER_SHIFT))
 #define REL(X) ((X << R_MMUIDXINFO_REL_SHIFT) | R_MMUIDXINFO_RELVALID_MASK)
 #define R2     R_MMUIDXINFO_2RANGES_MASK
 #define PAN    R_MMUIDXINFO_PAN_MASK
+#define USER   R_MMUIDXINFO_USER_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
@@ -33,7 +35,7 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_Stage2_S]        = REL(2),
     [ARMMMUIdx_Stage2]          = REL(2),
 
-    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2,
+    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | USER,
     [ARMMMUIdx_Stage1_E1]       = REL(1) | R2,
     [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | PAN,
 

From 346feee01c87713230e5f3da7b1126da1b43027f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:25 -0700
Subject: [PATCH 1209/2396] target/arm: Convert arm_mmu_idx_is_stage1_of_2 from
 switch to table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-26-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 19 -------------------
 target/arm/mmuidx-internal.h |  8 ++++++++
 target/arm/mmuidx.c          |  7 ++++---
 3 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index c4aef8b50e..92883b6c0e 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1285,25 +1285,6 @@ ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx);
 ARMMMUIdx arm_stage1_mmu_idx(CPUARMState *env);
 #endif
 
-/**
- * arm_mmu_idx_is_stage1_of_2:
- * @mmu_idx: The ARMMMUIdx to test
- *
- * Return true if @mmu_idx is a NOTLB mmu_idx that is the
- * first stage of a two stage regime.
- */
-static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
-{
-    switch (mmu_idx) {
-    case ARMMMUIdx_Stage1_E0:
-    case ARMMMUIdx_Stage1_E1:
-    case ARMMMUIdx_Stage1_E1_PAN:
-        return true;
-    default:
-        return false;
-    }
-}
-
 static inline uint32_t aarch32_cpsr_valid_mask(uint64_t features,
                                                const ARMISARegisters *id)
 {
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index 3e51c0f579..55fba4aae2 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -18,6 +18,7 @@ FIELD(MMUIDXINFO, RELVALID, 5, 1)
 FIELD(MMUIDXINFO, 2RANGES, 6, 1)
 FIELD(MMUIDXINFO, PAN, 7, 1)
 FIELD(MMUIDXINFO, USER, 8, 1)
+FIELD(MMUIDXINFO, STAGE1, 9, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -76,4 +77,11 @@ static inline bool regime_is_user(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, USER);
 }
 
+/* Return true if this mmu index is stage 1 of a 2-stage translation. */
+static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, STAGE1);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 1c1e062bfe..c5b43a5932 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -13,6 +13,7 @@
 #define R2     R_MMUIDXINFO_2RANGES_MASK
 #define PAN    R_MMUIDXINFO_PAN_MASK
 #define USER   R_MMUIDXINFO_USER_MASK
+#define S1     R_MMUIDXINFO_STAGE1_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
@@ -35,9 +36,9 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_Stage2_S]        = REL(2),
     [ARMMMUIdx_Stage2]          = REL(2),
 
-    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | USER,
-    [ARMMMUIdx_Stage1_E1]       = REL(1) | R2,
-    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | PAN,
+    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | S1 | USER,
+    [ARMMMUIdx_Stage1_E1]       = REL(1) | R2 | S1,
+    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | S1 | PAN,
 
     /*
      * M-profile.

From 35ba9340114dc6122f5e7b65565a85795c2dc7d7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:26 -0700
Subject: [PATCH 1210/2396] target/arm: Convert regime_is_stage2 to table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This wasn't using a switch, but two comparisons.
Convert it to arm_mmuidx_table for consistency.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-27-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h       | 5 -----
 target/arm/mmuidx-internal.h | 8 ++++++++
 target/arm/mmuidx.c          | 5 +++--
 3 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 92883b6c0e..591b509e68 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1027,11 +1027,6 @@ static inline void arm_call_el_change_hook(ARMCPU *cpu)
     }
 }
 
-static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
-{
-    return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
-}
-
 /* Return the SCTLR value which controls this address translation regime */
 static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index 55fba4aae2..1d948aa6f4 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -19,6 +19,7 @@ FIELD(MMUIDXINFO, 2RANGES, 6, 1)
 FIELD(MMUIDXINFO, PAN, 7, 1)
 FIELD(MMUIDXINFO, USER, 8, 1)
 FIELD(MMUIDXINFO, STAGE1, 9, 1)
+FIELD(MMUIDXINFO, STAGE2, 10, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -84,4 +85,11 @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, STAGE1);
 }
 
+/* Return true if this mmu index is stage 2 of a 2-stage translation. */
+static inline bool regime_is_stage2(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, STAGE2);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index c5b43a5932..61a682e655 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -14,6 +14,7 @@
 #define PAN    R_MMUIDXINFO_PAN_MASK
 #define USER   R_MMUIDXINFO_USER_MASK
 #define S1     R_MMUIDXINFO_STAGE1_MASK
+#define S2     R_MMUIDXINFO_STAGE2_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
@@ -33,8 +34,8 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_E30_0]           = EL(0) | REL(3),
     [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3) | PAN,
 
-    [ARMMMUIdx_Stage2_S]        = REL(2),
-    [ARMMMUIdx_Stage2]          = REL(2),
+    [ARMMMUIdx_Stage2_S]        = REL(2) | S2,
+    [ARMMMUIdx_Stage2]          = REL(2) | S2,
 
     [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | S1 | USER,
     [ARMMMUIdx_Stage1_E1]       = REL(1) | R2 | S1,

From f76cee647cb4b2057d45d315ae73e89fa6d6f336 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:27 -0700
Subject: [PATCH 1211/2396] target/arm: Introduce mmu indexes for GCS

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-28-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/core/cpu.h        |  5 ++-
 target/arm/helper.c          | 15 ++++++--
 target/arm/mmuidx-internal.h |  8 ++++
 target/arm/mmuidx.c          |  9 +++++
 target/arm/mmuidx.h          | 71 ++++++++++++++++++++++++------------
 target/arm/ptw.c             | 20 ++++++++++
 target/arm/tcg/tlb-insns.c   | 47 ++++++++++++++++--------
 7 files changed, 132 insertions(+), 43 deletions(-)

diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index d175edb6f8..e79e8e0a8e 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -198,9 +198,10 @@ struct CPUClass {
 };
 
 /*
- * Fix the number of mmu modes to 16.
+ * Fix the number of mmu modes across all targets.
+ * Current maximum is target/arm/.
  */
-#define NB_MMU_MODES 16
+#define NB_MMU_MODES 22
 typedef uint32_t MMUIdxMap;
 
 /* Use a fully associative victim tlb of 8 entries. */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index aed245fd86..6642cae0cc 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -420,7 +420,9 @@ int alle1_tlbmask(CPUARMState *env)
      */
     return (ARMMMUIdxBit_E10_1 |
             ARMMMUIdxBit_E10_1_PAN |
+            ARMMMUIdxBit_E10_1_GCS |
             ARMMMUIdxBit_E10_0 |
+            ARMMMUIdxBit_E10_0_GCS |
             ARMMMUIdxBit_Stage2 |
             ARMMMUIdxBit_Stage2_S);
 }
@@ -808,12 +810,17 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
      */
     if (changed & (SCR_NS | SCR_NSE)) {
         tlb_flush_by_mmuidx(env_cpu(env), (ARMMMUIdxBit_E10_0 |
+                                           ARMMMUIdxBit_E10_0_GCS |
                                            ARMMMUIdxBit_E20_0 |
+                                           ARMMMUIdxBit_E20_0_GCS |
                                            ARMMMUIdxBit_E10_1 |
-                                           ARMMMUIdxBit_E20_2 |
                                            ARMMMUIdxBit_E10_1_PAN |
+                                           ARMMMUIdxBit_E10_1_GCS |
+                                           ARMMMUIdxBit_E20_2 |
                                            ARMMMUIdxBit_E20_2_PAN |
-                                           ARMMMUIdxBit_E2));
+                                           ARMMMUIdxBit_E20_2_GCS |
+                                           ARMMMUIdxBit_E2 |
+                                           ARMMMUIdxBit_E2_GCS));
     }
 }
 
@@ -2787,7 +2794,9 @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
         (arm_hcr_el2_eff(env) & HCR_E2H)) {
         uint16_t mask = ARMMMUIdxBit_E20_2 |
                         ARMMMUIdxBit_E20_2_PAN |
-                        ARMMMUIdxBit_E20_0;
+                        ARMMMUIdxBit_E20_2_GCS |
+                        ARMMMUIdxBit_E20_0 |
+                        ARMMMUIdxBit_E20_0_GCS;
         tlb_flush_by_mmuidx(env_cpu(env), mask);
     }
     raw_write(env, ri, value);
diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index 1d948aa6f4..f494ec348d 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -20,6 +20,7 @@ FIELD(MMUIDXINFO, PAN, 7, 1)
 FIELD(MMUIDXINFO, USER, 8, 1)
 FIELD(MMUIDXINFO, STAGE1, 9, 1)
 FIELD(MMUIDXINFO, STAGE2, 10, 1)
+FIELD(MMUIDXINFO, GCS, 11, 1)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -92,4 +93,11 @@ static inline bool regime_is_stage2(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, STAGE2);
 }
 
+/* Return true if this mmu index implies AccessType_GCS. */
+static inline bool regime_is_gcs(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, GCS);
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 61a682e655..42b003db9c 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -15,22 +15,29 @@
 #define USER   R_MMUIDXINFO_USER_MASK
 #define S1     R_MMUIDXINFO_STAGE1_MASK
 #define S2     R_MMUIDXINFO_STAGE2_MASK
+#define GCS    R_MMUIDXINFO_GCS_MASK
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
      * A-profile.
      */
     [ARMMMUIdx_E10_0]           = EL(0) | REL(1) | R2,
+    [ARMMMUIdx_E10_0_GCS]       = EL(0) | REL(1) | R2 | GCS,
     [ARMMMUIdx_E10_1]           = EL(1) | REL(1) | R2,
     [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2 | PAN,
+    [ARMMMUIdx_E10_1_GCS]       = EL(1) | REL(1) | R2 | GCS,
 
     [ARMMMUIdx_E20_0]           = EL(0) | REL(2) | R2,
+    [ARMMMUIdx_E20_0_GCS]       = EL(0) | REL(2) | R2 | GCS,
     [ARMMMUIdx_E20_2]           = EL(2) | REL(2) | R2,
     [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2 | PAN,
+    [ARMMMUIdx_E20_2_GCS]       = EL(2) | REL(2) | R2 | GCS,
 
     [ARMMMUIdx_E2]              = EL(2) | REL(2),
+    [ARMMMUIdx_E2_GCS]          = EL(2) | REL(2) | GCS,
 
     [ARMMMUIdx_E3]              = EL(3) | REL(3),
+    [ARMMMUIdx_E3_GCS]          = EL(3) | REL(3) | GCS,
     [ARMMMUIdx_E30_0]           = EL(0) | REL(3),
     [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3) | PAN,
 
@@ -38,8 +45,10 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_Stage2]          = REL(2) | S2,
 
     [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | S1 | USER,
+    [ARMMMUIdx_Stage1_E0_GCS]   = REL(1) | R2 | S1 | USER | GCS,
     [ARMMMUIdx_Stage1_E1]       = REL(1) | R2 | S1,
     [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | S1 | PAN,
+    [ARMMMUIdx_Stage1_E1_GCS]   = REL(1) | R2 | S1 | GCS,
 
     /*
      * M-profile.
diff --git a/target/arm/mmuidx.h b/target/arm/mmuidx.h
index 5b9b4bc84f..8d8d27337e 100644
--- a/target/arm/mmuidx.h
+++ b/target/arm/mmuidx.h
@@ -58,24 +58,31 @@
  *     already heavyweight.
  *  8. we cannot fold together Stage 2 Secure and Stage 2 NonSecure,
  *     because both are in use simultaneously for Secure EL2.
+ *  9. we need separate indexes for handling AccessType_GCS.
  *
  * This gives us the following list of cases:
  *
  * EL0 EL1&0 stage 1+2 (aka NS PL0 PL1&0 stage 1+2)
+ * EL0 EL1&0 stage 1+2 +GCS
  * EL1 EL1&0 stage 1+2 (aka NS PL1 PL1&0 stage 1+2)
  * EL1 EL1&0 stage 1+2 +PAN (aka NS PL1 P1&0 stage 1+2 +PAN)
+ * EL1 EL1&0 stage 1+2 +GCS
  * EL0 EL2&0
+ * EL0 EL2&0 +GCS
  * EL2 EL2&0
  * EL2 EL2&0 +PAN
+ * EL2 EL2&0 +GCS
  * EL2 (aka NS PL2)
+ * EL2 +GCS
  * EL3 (aka AArch32 S PL1 PL1&0)
+ * EL3 +GCS
  * AArch32 S PL0 PL1&0 (we call this EL30_0)
  * AArch32 S PL1 PL1&0 +PAN (we call this EL30_3_PAN)
  * Stage2 Secure
  * Stage2 NonSecure
  * plus one TLB per Physical address space: S, NS, Realm, Root
  *
- * for a total of 16 different mmu_idx.
+ * for a total of 22 different mmu_idx.
  *
  * R profile CPUs have an MPU, but can use the same set of MMU indexes
  * as A profile. They only need to distinguish EL0 and EL1 (and
@@ -114,9 +121,9 @@
  * For M profile we arrange them to have a bit for priv, a bit for negpri
  * and a bit for secure.
  */
-#define ARM_MMU_IDX_A     0x10  /* A profile */
-#define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
-#define ARM_MMU_IDX_M     0x40  /* M profile */
+#define ARM_MMU_IDX_A     0x20  /* A profile */
+#define ARM_MMU_IDX_NOTLB 0x40  /* does not have a TLB */
+#define ARM_MMU_IDX_M     0x80  /* M profile */
 
 /* Meanings of the bits for M profile mmu idx values */
 #define ARM_MMU_IDX_M_PRIV   0x1
@@ -125,22 +132,32 @@
 
 #define ARM_MMU_IDX_TYPE_MASK \
     (ARM_MMU_IDX_A | ARM_MMU_IDX_M | ARM_MMU_IDX_NOTLB)
-#define ARM_MMU_IDX_COREIDX_MASK 0xf
+#define ARM_MMU_IDX_COREIDX_MASK 0x1f
 
 typedef enum ARMMMUIdx {
     /*
      * A-profile.
      */
-    ARMMMUIdx_E10_0     = 0 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_0     = 1 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E10_1     = 2 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2     = 3 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E10_1_PAN = 4 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2_PAN = 5 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E2        = 6 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E3        = 7 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E30_0     = 8 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E30_3_PAN = 9 | ARM_MMU_IDX_A,
+
+    ARMMMUIdx_E10_0      = 0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_0_GCS  = 1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1      = 2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1_PAN  = 3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_1_GCS  = 4 | ARM_MMU_IDX_A,
+
+    ARMMMUIdx_E20_0      = 5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_0_GCS  = 6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2      = 7 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2_PAN  = 8 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E20_2_GCS  = 9 | ARM_MMU_IDX_A,
+
+    ARMMMUIdx_E2         = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E2_GCS     = 11 | ARM_MMU_IDX_A,
+
+    ARMMMUIdx_E3         = 12 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E3_GCS     = 13 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E30_0      = 14 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E30_3_PAN  = 15 | ARM_MMU_IDX_A,
 
     /*
      * Used for second stage of an S12 page table walk, or for descriptor
@@ -148,14 +165,14 @@ typedef enum ARMMMUIdx {
      * are in use simultaneously for SecureEL2: the security state for
      * the S2 ptw is selected by the NS bit from the S1 ptw.
      */
-    ARMMMUIdx_Stage2_S  = 10 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Stage2    = 11 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2_S   = 16 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Stage2     = 17 | ARM_MMU_IDX_A,
 
     /* TLBs with 1-1 mapping to the physical address spaces. */
-    ARMMMUIdx_Phys_S     = 12 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_NS    = 13 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_Root  = 14 | ARM_MMU_IDX_A,
-    ARMMMUIdx_Phys_Realm = 15 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_S     = 18 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_NS    = 19 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Root  = 20 | ARM_MMU_IDX_A,
+    ARMMMUIdx_Phys_Realm = 21 | ARM_MMU_IDX_A,
 
     /*
      * These are not allocated TLBs and are used only for AT system
@@ -164,6 +181,8 @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_E0_GCS = 3 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_E1_GCS = 4 | ARM_MMU_IDX_NOTLB,
 
     /*
      * M-profile.
@@ -187,13 +206,19 @@ typedef enum ARMMMUIdx {
 
 typedef enum ARMMMUIdxBit {
     TO_CORE_BIT(E10_0),
-    TO_CORE_BIT(E20_0),
+    TO_CORE_BIT(E10_0_GCS),
     TO_CORE_BIT(E10_1),
     TO_CORE_BIT(E10_1_PAN),
-    TO_CORE_BIT(E2),
+    TO_CORE_BIT(E10_1_GCS),
+    TO_CORE_BIT(E20_0),
+    TO_CORE_BIT(E20_0_GCS),
     TO_CORE_BIT(E20_2),
     TO_CORE_BIT(E20_2_PAN),
+    TO_CORE_BIT(E20_2_GCS),
+    TO_CORE_BIT(E2),
+    TO_CORE_BIT(E2_GCS),
     TO_CORE_BIT(E3),
+    TO_CORE_BIT(E3_GCS),
     TO_CORE_BIT(E30_0),
     TO_CORE_BIT(E30_3_PAN),
     TO_CORE_BIT(Stage2),
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index d6d4bf3b23..6c52ed1ad0 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -169,6 +169,10 @@ ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
         return ARMMMUIdx_Stage1_E1;
     case ARMMMUIdx_E10_1_PAN:
         return ARMMMUIdx_Stage1_E1_PAN;
+    case ARMMMUIdx_E10_0_GCS:
+        return ARMMMUIdx_Stage1_E0_GCS;
+    case ARMMMUIdx_E10_1_GCS:
+        return ARMMMUIdx_Stage1_E1_GCS;
     default:
         return mmu_idx;
     }
@@ -276,8 +280,10 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
 
     case ARMMMUIdx_E10_0:
+    case ARMMMUIdx_E10_0_GCS:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
+    case ARMMMUIdx_E10_1_GCS:
         /* TGE means that EL0/1 act as if SCTLR_EL1.M is zero */
         hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
         if (hcr_el2 & HCR_TGE) {
@@ -286,8 +292,10 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
         break;
 
     case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E0_GCS:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_E1_GCS:
         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
         hcr_el2 = arm_hcr_el2_eff_secstate(env, space);
         if (hcr_el2 & HCR_DC) {
@@ -296,10 +304,14 @@ static bool regime_translation_disabled(CPUARMState *env, ARMMMUIdx mmu_idx,
         break;
 
     case ARMMMUIdx_E20_0:
+    case ARMMMUIdx_E20_0_GCS:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_E20_2_GCS:
     case ARMMMUIdx_E2:
+    case ARMMMUIdx_E2_GCS:
     case ARMMMUIdx_E3:
+    case ARMMMUIdx_E3_GCS:
     case ARMMMUIdx_E30_0:
     case ARMMMUIdx_E30_3_PAN:
         break;
@@ -3799,15 +3811,22 @@ arm_mmu_idx_to_security_space(CPUARMState *env, ARMMMUIdx mmu_idx)
 
     switch (mmu_idx) {
     case ARMMMUIdx_E10_0:
+    case ARMMMUIdx_E10_0_GCS:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
+    case ARMMMUIdx_E10_1_GCS:
     case ARMMMUIdx_E20_0:
+    case ARMMMUIdx_E20_0_GCS:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_E20_2_GCS:
     case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E0_GCS:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_E1_GCS:
     case ARMMMUIdx_E2:
+    case ARMMMUIdx_E2_GCS:
         ss = arm_security_space_below_el3(env);
         break;
     case ARMMMUIdx_Stage2:
@@ -3836,6 +3855,7 @@ arm_mmu_idx_to_security_space(CPUARMState *env, ARMMMUIdx mmu_idx)
         ss = ARMSS_Secure;
         break;
     case ARMMMUIdx_E3:
+    case ARMMMUIdx_E3_GCS:
     case ARMMMUIdx_E30_0:
     case ARMMMUIdx_E30_3_PAN:
         if (arm_feature(env, ARM_FEATURE_AARCH64) &&
diff --git a/target/arm/tcg/tlb-insns.c b/target/arm/tcg/tlb-insns.c
index 95c26c6d46..1a0a332583 100644
--- a/target/arm/tcg/tlb-insns.c
+++ b/target/arm/tcg/tlb-insns.c
@@ -149,7 +149,8 @@ static void tlbimva_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = env_cpu(env);
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E2);
+    tlb_flush_page_by_mmuidx(cs, pageaddr,
+                             ARMMMUIdxBit_E2 | ARMMMUIdxBit_E2_GCS);
 }
 
 static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -159,7 +160,8 @@ static void tlbimva_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     uint64_t pageaddr = value & ~MAKE_64BIT_MASK(0, 12);
 
     tlb_flush_page_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                             ARMMMUIdxBit_E2);
+                                             ARMMMUIdxBit_E2 |
+                                             ARMMMUIdxBit_E2_GCS);
 }
 
 static void tlbiipas2_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -202,7 +204,7 @@ static void tlbiall_hyp_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
 
-    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2);
+    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E2 | ARMMMUIdxBit_E2_GCS);
 }
 
 static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -210,7 +212,8 @@ static void tlbiall_hyp_is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2);
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E2 |
+                                            ARMMMUIdxBit_E2_GCS);
 }
 
 /*
@@ -228,12 +231,16 @@ static int vae1_tlbmask(CPUARMState *env)
     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
         mask = ARMMMUIdxBit_E20_2 |
                ARMMMUIdxBit_E20_2_PAN |
-               ARMMMUIdxBit_E20_0;
+               ARMMMUIdxBit_E20_2_GCS |
+               ARMMMUIdxBit_E20_0 |
+               ARMMMUIdxBit_E20_0_GCS;
     } else {
         /* This is AArch64 only, so we don't need to touch the EL30_x TLBs */
         mask = ARMMMUIdxBit_E10_1 |
                ARMMMUIdxBit_E10_1_PAN |
-               ARMMMUIdxBit_E10_0;
+               ARMMMUIdxBit_E10_1_GCS |
+               ARMMMUIdxBit_E10_0 |
+               ARMMMUIdxBit_E10_0_GCS;
     }
     return mask;
 }
@@ -246,13 +253,20 @@ static int vae2_tlbmask(CPUARMState *env)
     if (hcr & HCR_E2H) {
         mask = ARMMMUIdxBit_E20_2 |
                ARMMMUIdxBit_E20_2_PAN |
-               ARMMMUIdxBit_E20_0;
+               ARMMMUIdxBit_E20_2_GCS |
+               ARMMMUIdxBit_E20_0 |
+               ARMMMUIdxBit_E20_0_GCS;
     } else {
-        mask = ARMMMUIdxBit_E2;
+        mask = ARMMMUIdxBit_E2 | ARMMMUIdxBit_E2_GCS;
     }
     return mask;
 }
 
+static int vae3_tlbmask(void)
+{
+    return ARMMMUIdxBit_E3 | ARMMMUIdxBit_E3_GCS;
+}
+
 /* Return 56 if TBI is enabled, 64 otherwise. */
 static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
                        uint64_t addr)
@@ -325,9 +339,12 @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static int e2_tlbmask(CPUARMState *env)
 {
     return (ARMMMUIdxBit_E20_0 |
+            ARMMMUIdxBit_E20_0_GCS |
             ARMMMUIdxBit_E20_2 |
             ARMMMUIdxBit_E20_2_PAN |
-            ARMMMUIdxBit_E2);
+            ARMMMUIdxBit_E20_2_GCS |
+            ARMMMUIdxBit_E2 |
+            ARMMMUIdxBit_E2_GCS);
 }
 
 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -354,7 +371,7 @@ static void tlbi_aa64_alle3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = env_archcpu(env);
     CPUState *cs = CPU(cpu);
 
-    tlb_flush_by_mmuidx(cs, ARMMMUIdxBit_E3);
+    tlb_flush_by_mmuidx(cs, vae3_tlbmask());
 }
 
 static void tlbi_aa64_alle1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -380,7 +397,7 @@ static void tlbi_aa64_alle3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
 
-    tlb_flush_by_mmuidx_all_cpus_synced(cs, ARMMMUIdxBit_E3);
+    tlb_flush_by_mmuidx_all_cpus_synced(cs, vae3_tlbmask());
 }
 
 static void tlbi_aa64_vae2_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -411,7 +428,7 @@ static void tlbi_aa64_vae3_write(CPUARMState *env, const ARMCPRegInfo *ri,
     CPUState *cs = CPU(cpu);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
 
-    tlb_flush_page_by_mmuidx(cs, pageaddr, ARMMMUIdxBit_E3);
+    tlb_flush_page_by_mmuidx(cs, pageaddr, vae3_tlbmask());
 }
 
 static void tlbi_aa64_vae1is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -465,7 +482,7 @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
     int bits = tlbbits_for_regime(env, ARMMMUIdx_E3, pageaddr);
 
     tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                  ARMMMUIdxBit_E3, bits);
+                                                  vae3_tlbmask(), bits);
 }
 
 static int ipas2e1_tlbmask(CPUARMState *env, int64_t value)
@@ -963,7 +980,7 @@ static void tlbi_aa64_rvae3_write(CPUARMState *env,
      * flush-last-level-only.
      */
 
-    do_rvae_write(env, value, ARMMMUIdxBit_E3, tlb_force_broadcast(env));
+    do_rvae_write(env, value, vae3_tlbmask(), tlb_force_broadcast(env));
 }
 
 static void tlbi_aa64_rvae3is_write(CPUARMState *env,
@@ -977,7 +994,7 @@ static void tlbi_aa64_rvae3is_write(CPUARMState *env,
      * flush-last-level-only or inner/outer specific flushes.
      */
 
-    do_rvae_write(env, value, ARMMMUIdxBit_E3, true);
+    do_rvae_write(env, value, vae3_tlbmask(), true);
 }
 
 static void tlbi_aa64_ripas2e1_write(CPUARMState *env, const ARMCPRegInfo *ri,

From 0fe292fadb4d1886ad57bb14abcfb4130901b0f6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:28 -0700
Subject: [PATCH 1212/2396] target/arm: Introduce regime_to_gcs

Add a lookup from any a64 mmu index to the gcs mmu index
within the same translation regime.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-29-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/mmuidx-internal.h | 10 ++++++++++
 target/arm/mmuidx.c          | 24 +++++++++++++-----------
 2 files changed, 23 insertions(+), 11 deletions(-)

diff --git a/target/arm/mmuidx-internal.h b/target/arm/mmuidx-internal.h
index f494ec348d..962b053852 100644
--- a/target/arm/mmuidx-internal.h
+++ b/target/arm/mmuidx-internal.h
@@ -21,6 +21,7 @@ FIELD(MMUIDXINFO, USER, 8, 1)
 FIELD(MMUIDXINFO, STAGE1, 9, 1)
 FIELD(MMUIDXINFO, STAGE2, 10, 1)
 FIELD(MMUIDXINFO, GCS, 11, 1)
+FIELD(MMUIDXINFO, TG, 12, 5)
 
 extern const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8];
 
@@ -100,4 +101,13 @@ static inline bool regime_is_gcs(ARMMMUIdx idx)
     return FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, GCS);
 }
 
+/* Return the GCS MMUIdx for a given regime. */
+static inline ARMMMUIdx regime_to_gcs(ARMMMUIdx idx)
+{
+    tcg_debug_assert(arm_mmuidx_is_valid(idx));
+    uint32_t core = FIELD_EX32(arm_mmuidx_table[idx], MMUIDXINFO, TG);
+    tcg_debug_assert(core != 0); /* core 0 is E10_0, not a GCS index */
+    return core | ARM_MMU_IDX_A;
+}
+
 #endif /* TARGET_ARM_MMUIDX_INTERNAL_H */
diff --git a/target/arm/mmuidx.c b/target/arm/mmuidx.c
index 42b003db9c..a4663c8d87 100644
--- a/target/arm/mmuidx.c
+++ b/target/arm/mmuidx.c
@@ -16,27 +16,29 @@
 #define S1     R_MMUIDXINFO_STAGE1_MASK
 #define S2     R_MMUIDXINFO_STAGE2_MASK
 #define GCS    R_MMUIDXINFO_GCS_MASK
+#define TG(X)  \
+    ((ARMMMUIdx_##X##_GCS & ARM_MMU_IDX_COREIDX_MASK) << R_MMUIDXINFO_TG_SHIFT)
 
 const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     /*
      * A-profile.
      */
-    [ARMMMUIdx_E10_0]           = EL(0) | REL(1) | R2,
+    [ARMMMUIdx_E10_0]           = EL(0) | REL(1) | R2 | TG(E10_0),
     [ARMMMUIdx_E10_0_GCS]       = EL(0) | REL(1) | R2 | GCS,
-    [ARMMMUIdx_E10_1]           = EL(1) | REL(1) | R2,
-    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2 | PAN,
+    [ARMMMUIdx_E10_1]           = EL(1) | REL(1) | R2 | TG(E10_1),
+    [ARMMMUIdx_E10_1_PAN]       = EL(1) | REL(1) | R2 | TG(E10_1) | PAN,
     [ARMMMUIdx_E10_1_GCS]       = EL(1) | REL(1) | R2 | GCS,
 
-    [ARMMMUIdx_E20_0]           = EL(0) | REL(2) | R2,
+    [ARMMMUIdx_E20_0]           = EL(0) | REL(2) | R2 | TG(E20_0),
     [ARMMMUIdx_E20_0_GCS]       = EL(0) | REL(2) | R2 | GCS,
-    [ARMMMUIdx_E20_2]           = EL(2) | REL(2) | R2,
-    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2 | PAN,
+    [ARMMMUIdx_E20_2]           = EL(2) | REL(2) | R2 | TG(E20_2),
+    [ARMMMUIdx_E20_2_PAN]       = EL(2) | REL(2) | R2 | TG(E20_2) | PAN,
     [ARMMMUIdx_E20_2_GCS]       = EL(2) | REL(2) | R2 | GCS,
 
-    [ARMMMUIdx_E2]              = EL(2) | REL(2),
+    [ARMMMUIdx_E2]              = EL(2) | REL(2) | TG(E2),
     [ARMMMUIdx_E2_GCS]          = EL(2) | REL(2) | GCS,
 
-    [ARMMMUIdx_E3]              = EL(3) | REL(3),
+    [ARMMMUIdx_E3]              = EL(3) | REL(3) | TG(E3),
     [ARMMMUIdx_E3_GCS]          = EL(3) | REL(3) | GCS,
     [ARMMMUIdx_E30_0]           = EL(0) | REL(3),
     [ARMMMUIdx_E30_3_PAN]       = EL(3) | REL(3) | PAN,
@@ -44,10 +46,10 @@ const uint32_t arm_mmuidx_table[ARM_MMU_IDX_M + 8] = {
     [ARMMMUIdx_Stage2_S]        = REL(2) | S2,
     [ARMMMUIdx_Stage2]          = REL(2) | S2,
 
-    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | S1 | USER,
+    [ARMMMUIdx_Stage1_E0]       = REL(1) | R2 | S1 | USER | TG(Stage1_E0),
     [ARMMMUIdx_Stage1_E0_GCS]   = REL(1) | R2 | S1 | USER | GCS,
-    [ARMMMUIdx_Stage1_E1]       = REL(1) | R2 | S1,
-    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | S1 | PAN,
+    [ARMMMUIdx_Stage1_E1]       = REL(1) | R2 | S1 | TG(Stage1_E1),
+    [ARMMMUIdx_Stage1_E1_PAN]   = REL(1) | R2 | S1 | TG(Stage1_E1) | PAN,
     [ARMMMUIdx_Stage1_E1_GCS]   = REL(1) | R2 | S1 | GCS,
 
     /*

From 4c14265b8092a250edaef62891ee2d55fcfac92d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:29 -0700
Subject: [PATCH 1213/2396] target/arm: Support page protections for GCS mmu
 indexes

Take read and write from the s1perms.gcs bit computed
by the Arm pseudocode.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-30-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 6c52ed1ad0..d4386ede73 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -1619,12 +1619,16 @@ static int get_S1prot_indirect(CPUARMState *env, S1Translate *ptw,
         }
     }
 
-    if (perm & PAGE_WXN) {
+    if (regime_is_gcs(mmu_idx)) {
+        /*
+         * Note that the one s1perms.gcs bit controls both read and write
+         * access via AccessType_GCS.  See AArch64.S1CheckPermissions.
+         */
+        perm = (perm & PAGE_GCS ? PAGE_READ | PAGE_WRITE : 0);
+    } else if (perm & PAGE_WXN) {
         perm &= ~PAGE_EXEC;
     }
 
-    /* TODO: FEAT_GCS */
-
     return perm & PAGE_RWX;
 }
 
@@ -2277,6 +2281,13 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
              */
             prot = get_S1prot_indirect(env, ptw, mmu_idx, pi, po,
                                        result->f.attrs.space, out_space);
+        } else if (regime_is_gcs(mmu_idx)) {
+            /*
+             * While one must use indirect permissions to successfully
+             * use GCS instructions, AArch64.S1DirectBasePermissions
+             * faithfully supplies s1perms.gcs = 0, Just In Case.
+             */
+            prot = 0;
         } else {
             int xn = extract64(attrs, 54, 1);
             int pxn = extract64(attrs, 53, 1);

From 8a0dda3e6b2394d0e96c16b80f44db97f9cc3e6e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:30 -0700
Subject: [PATCH 1214/2396] target/arm: Implement gcs bit for data abort

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-31-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/tlb_helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index ae2acd6727..f1983a5732 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -28,7 +28,7 @@ static inline uint64_t merge_syn_data_abort(uint32_t template_syn,
                                             ARMMMUFaultInfo *fi,
                                             unsigned int target_el,
                                             bool same_el, bool is_write,
-                                            int fsc)
+                                            int fsc, bool gcs)
 {
     uint64_t syn;
 
@@ -78,6 +78,7 @@ static inline uint64_t merge_syn_data_abort(uint32_t template_syn,
 
     /* Form ISS2 at the top of the syndrome. */
     syn |= (uint64_t)fi->dirtybit << 37;
+    syn |= (uint64_t)gcs << 40;
 
     return syn;
 }
@@ -252,9 +253,10 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
         exc = EXCP_PREFETCH_ABORT;
     } else {
+        bool gcs = regime_is_gcs(core_to_arm_mmu_idx(env, mmu_idx));
         syn = merge_syn_data_abort(env->exception.syndrome, fi, target_el,
                                    same_el, access_type == MMU_DATA_STORE,
-                                   fsc);
+                                   fsc, gcs);
         if (access_type == MMU_DATA_STORE
             && arm_feature(env, ARM_FEATURE_V6)) {
             fsr |= (1 << 11);

From d8bf1761efa7aa0cbda765c153357079b1e0bd3f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:31 -0700
Subject: [PATCH 1215/2396] target/arm: Add GCS cpregs

Add isar_feature_aa64_gcs.
Enable SCR_GCSEN in scr_write.
Enable HCRX_GCSEN in hcrx_write.
Default HCRX_GCSEN on if EL2 disabled.
Add the GCSCR* and GCSPR* registers.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-32-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c   | 95 +++++++++++++++++++++++++++++++++++++++
 target/arm/cpregs.h       |  2 +
 target/arm/cpu-features.h |  5 +++
 target/arm/cpu.c          |  3 ++
 target/arm/cpu.h          | 12 +++++
 target/arm/helper.c       | 10 +++++
 target/arm/internals.h    |  3 ++
 target/arm/meson.build    |  2 +
 8 files changed, 132 insertions(+)
 create mode 100644 target/arm/cpregs-gcs.c

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
new file mode 100644
index 0000000000..1ff041811d
--- /dev/null
+++ b/target/arm/cpregs-gcs.c
@@ -0,0 +1,95 @@
+/*
+ * QEMU ARM CP Register GCS regiters and instructions
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/timer.h"
+#include "exec/icount.h"
+#include "hw/irq.h"
+#include "cpu.h"
+#include "cpu-features.h"
+#include "cpregs.h"
+#include "internals.h"
+
+
+static CPAccessResult access_gcs(CPUARMState *env, const ARMCPRegInfo *ri,
+                                 bool isread)
+{
+    if (arm_current_el(env) < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_GCSEN)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_gcs_el0(CPUARMState *env, const ARMCPRegInfo *ri,
+                                     bool isread)
+{
+    if (arm_current_el(env) == 0 && !(env->cp15.gcscr_el[0] & GCSCRE0_NTR)) {
+        return CP_ACCESS_TRAP_EL1;
+    }
+    return access_gcs(env, ri, isread);
+}
+
+static void gcspr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    /*
+     * Bits [2:0] are RES0, so we might as well clear them now,
+     * rather than upon each usage a-la GetCurrentGCSPointer.
+     */
+    raw_write(env, ri, value & ~7);
+}
+
+static const ARMCPRegInfo gcs_reginfo[] = {
+    { .name = "GCSCRE0_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 2,
+      .access = PL1_RW, .accessfn = access_gcs, .fgt = FGT_NGCS_EL0,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcscr_el[0]) },
+    { .name = "GCSCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 0,
+      .access = PL1_RW, .accessfn = access_gcs, .fgt = FGT_NGCS_EL1,
+      .nv2_redirect_offset = 0x8d0 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 5, 0),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 5, 0),
+      .fieldoffset = offsetof(CPUARMState, cp15.gcscr_el[1]) },
+    { .name = "GCSCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 5, .opc2 = 0,
+      .access = PL2_RW, .accessfn = access_gcs,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcscr_el[2]) },
+    { .name = "GCSCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 5, .opc2 = 0,
+      .access = PL3_RW,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcscr_el[3]) },
+
+    { .name = "GCSPR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 2, .crm = 5, .opc2 = 1,
+      .access = PL0_R | PL1_W, .accessfn = access_gcs_el0,
+      .fgt = FGT_NGCS_EL0, .writefn = gcspr_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcspr_el[0]) },
+    { .name = "GCSPR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 1,
+      .access = PL1_RW, .accessfn = access_gcs,
+      .fgt = FGT_NGCS_EL1, .writefn = gcspr_write,
+      .nv2_redirect_offset = 0x8c0 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 2, 5, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 2, 5, 1),
+      .fieldoffset = offsetof(CPUARMState, cp15.gcspr_el[1]) },
+    { .name = "GCSPR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 5, .opc2 = 1,
+      .access = PL2_RW, .accessfn = access_gcs, .writefn = gcspr_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcspr_el[2]) },
+    { .name = "GCSPR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 5, .opc2 = 1,
+      .access = PL3_RW, .writefn = gcspr_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.gcspr_el[2]) },
+};
+
+void define_gcs_cpregs(ARMCPU *cpu)
+{
+    if (cpu_isar_feature(aa64_gcs, cpu)) {
+        define_arm_cp_regs(cpu, gcs_reginfo);
+    }
+}
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index f48c4df30f..bd2121a336 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -779,6 +779,8 @@ typedef enum FGTBit {
     DO_BIT(HFGRTR, VBAR_EL1),
     DO_BIT(HFGRTR, ICC_IGRPENN_EL1),
     DO_BIT(HFGRTR, ERRIDR_EL1),
+    DO_REV_BIT(HFGRTR, NGCS_EL0),
+    DO_REV_BIT(HFGRTR, NGCS_EL1),
     DO_REV_BIT(HFGRTR, NSMPRI_EL1),
     DO_REV_BIT(HFGRTR, NTPIDR2_EL0),
     DO_REV_BIT(HFGRTR, NPIRE0_EL1),
diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index f3e90408f7..0f0a112c21 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -1149,6 +1149,11 @@ static inline bool isar_feature_aa64_nmi(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64PFR1, NMI) != 0;
 }
 
+static inline bool isar_feature_aa64_gcs(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64PFR1, GCS) != 0;
+}
+
 static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)
 {
     return FIELD_SEX64_IDREG(id, ID_AA64MMFR0, TGRAN4) >= 1;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 9bca1b8eae..192acac1f5 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -635,6 +635,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
             if (cpu_isar_feature(aa64_fgt, cpu)) {
                 env->cp15.scr_el3 |= SCR_FGTEN;
             }
+            if (cpu_isar_feature(aa64_gcs, cpu)) {
+                env->cp15.scr_el3 |= SCR_GCSEN;
+            }
             if (cpu_isar_feature(aa64_tcr2, cpu)) {
                 env->cp15.scr_el3 |= SCR_TCR2EN;
             }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 6773676973..e55524ae10 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -580,6 +580,9 @@ typedef struct CPUArchState {
 
         /* NV2 register */
         uint64_t vncr_el2;
+
+        uint64_t gcscr_el[4];   /* GCSCRE0_EL1, GCSCR_EL[123] */
+        uint64_t gcspr_el[4];   /* GCSPR_EL[0123] */
     } cp15;
 
     struct {
@@ -1717,6 +1720,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_ENAS0             (1ULL << 36)
 #define SCR_ADEN              (1ULL << 37)
 #define SCR_HXEN              (1ULL << 38)
+#define SCR_GCSEN             (1ULL << 39)
 #define SCR_TRNDR             (1ULL << 40)
 #define SCR_ENTP2             (1ULL << 41)
 #define SCR_TCR2EN            (1ULL << 43)
@@ -1725,6 +1729,14 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_NSE               (1ULL << 62)
 
+/* GCSCR_ELx fields */
+#define GCSCR_PCRSEL    (1ULL << 0)
+#define GCSCR_RVCHKEN   (1ULL << 5)
+#define GCSCR_EXLOCKEN  (1ULL << 6)
+#define GCSCR_PUSHMEN   (1ULL << 8)
+#define GCSCR_STREN     (1ULL << 9)
+#define GCSCRE0_NTR     (1ULL << 10)
+
 /* Return the current FPSCR value.  */
 uint32_t vfp_get_fpscr(CPUARMState *env);
 void vfp_set_fpscr(CPUARMState *env, uint32_t val);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 6642cae0cc..64b6c21aef 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -766,6 +766,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_ecv, cpu)) {
             valid_mask |= SCR_ECVEN;
         }
+        if (cpu_isar_feature(aa64_gcs, cpu)) {
+            valid_mask |= SCR_GCSEN;
+        }
         if (cpu_isar_feature(aa64_tcr2, cpu)) {
             valid_mask |= SCR_TCR2EN;
         }
@@ -3953,6 +3956,9 @@ static void hcrx_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_sctlr2, cpu)) {
         valid_mask |= HCRX_SCTLR2EN;
     }
+    if (cpu_isar_feature(aa64_gcs, cpu)) {
+        valid_mask |= HCRX_GCSEN;
+    }
 
     /* Clear RES0 bits.  */
     env->cp15.hcrx_el2 = value & valid_mask;
@@ -4023,6 +4029,9 @@ uint64_t arm_hcrx_el2_eff(CPUARMState *env)
         if (cpu_isar_feature(aa64_sctlr2, cpu)) {
             hcrx |= HCRX_SCTLR2EN;
         }
+        if (cpu_isar_feature(aa64_gcs, cpu)) {
+            hcrx |= HCRX_GCSEN;
+        }
         return hcrx;
     }
     if (arm_feature(env, ARM_FEATURE_EL3) && !(env->cp15.scr_el3 & SCR_HXEN)) {
@@ -7260,6 +7269,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     define_pm_cpregs(cpu);
+    define_gcs_cpregs(cpu);
 }
 
 /*
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 591b509e68..109aa104bf 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -251,6 +251,7 @@ FIELD(VSTCR, SA, 30, 1)
 #define HCRX_MSCEN    (1ULL << 11)
 #define HCRX_TCR2EN   (1ULL << 14)
 #define HCRX_SCTLR2EN (1ULL << 15)
+#define HCRX_GCSEN    (1ULL << 22)
 
 #define HPFAR_NS      (1ULL << 63)
 
@@ -1783,6 +1784,8 @@ void define_tlb_insn_regs(ARMCPU *cpu);
 void define_at_insn_regs(ARMCPU *cpu);
 /* Add the cpreg definitions for PM cpregs */
 void define_pm_cpregs(ARMCPU *cpu);
+/* Add the cpreg definitions for GCS cpregs */
+void define_gcs_cpregs(ARMCPU *cpu);
 
 /* Effective value of MDCR_EL2 */
 static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
diff --git a/target/arm/meson.build b/target/arm/meson.build
index f9f0beef05..3df7e03654 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -27,6 +27,7 @@ arm_user_ss.add(when: 'TARGET_AARCH64', if_false: files(
   'cpu32-stubs.c',
 ))
 arm_user_ss.add(files(
+  'cpregs-gcs.c',
   'cpregs-pmu.c',
   'debug_helper.c',
   'helper.c',
@@ -47,6 +48,7 @@ arm_common_system_ss.add(files(
   'arch_dump.c',
   'arm-powerctl.c',
   'cortex-regs.c',
+  'cpregs-gcs.c',
   'cpregs-pmu.c',
   'cpu-irq.c',
   'debug_helper.c',

From e5c79193ec92dca13e6eccc60c2a6a77bb8f2fb9 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:32 -0700
Subject: [PATCH 1216/2396] target/arm: Add GCS enable and trap levels to
 DisasContext

Pipe GCSEnabled, GCSReturnValueCheckEnabled, and CheckGCSSTREnabled
through hflags to the translator.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-33-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h               |  3 +++
 target/arm/tcg/hflags.c        | 38 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-a64.c |  3 +++
 target/arm/tcg/translate.h     |  6 ++++++
 4 files changed, 50 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index e55524ae10..775219364f 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2475,6 +2475,9 @@ FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
 FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
 FIELD(TBFLAG_A64, NEP, 38, 1)   /* FPCR.NEP */
 FIELD(TBFLAG_A64, ZT0EXC_EL, 39, 2)
+FIELD(TBFLAG_A64, GCS_EN, 41, 1)
+FIELD(TBFLAG_A64, GCS_RVCEN, 42, 1)
+FIELD(TBFLAG_A64, GCSSTR_EL, 43, 2)
 
 /*
  * Helpers for using the above. Note that only the A64 accessors use
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index 17f83f13a4..5c9b9bec3b 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -451,6 +451,44 @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
     }
 
+    if (cpu_isar_feature(aa64_gcs, env_archcpu(env))) {
+        /* C.f. GCSEnabled */
+        if (env->cp15.gcscr_el[el] & GCSCR_PCRSEL) {
+            switch (el) {
+            default:
+                if (!el_is_in_host(env, el)
+                    && !(arm_hcrx_el2_eff(env) & HCRX_GCSEN)) {
+                    break;
+                }
+                /* fall through */
+            case 2:
+                if (arm_feature(env, ARM_FEATURE_EL3)
+                    && !(env->cp15.scr_el3 & SCR_GCSEN)) {
+                    break;
+                }
+                /* fall through */
+            case 3:
+                DP_TBFLAG_A64(flags, GCS_EN, 1);
+                break;
+            }
+        }
+
+        /* C.f. GCSReturnValueCheckEnabled */
+        if (env->cp15.gcscr_el[el] & GCSCR_RVCHKEN) {
+            DP_TBFLAG_A64(flags, GCS_RVCEN, 1);
+        }
+
+        /* C.f. CheckGCSSTREnabled */
+        if (!(env->cp15.gcscr_el[el] & GCSCR_STREN)) {
+            DP_TBFLAG_A64(flags, GCSSTR_EL, el ? el : 1);
+        } else if (el == 1
+                   && EX_TBFLAG_ANY(flags, FGT_ACTIVE)
+                   && !FIELD_EX64(env->cp15.fgt_exec[FGTREG_HFGITR],
+                                  HFGITR_EL2, NGCSSTR_EL1)) {
+            DP_TBFLAG_A64(flags, GCSSTR_EL, 2);
+        }
+    }
+
     if (env->vfp.fpcr & FPCR_AH) {
         DP_TBFLAG_A64(flags, AH, 1);
     }
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index a0e3300231..693eab1c01 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10344,6 +10344,9 @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
     dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
     dc->fpcr_nep = EX_TBFLAG_A64(tb_flags, NEP);
+    dc->gcs_en = EX_TBFLAG_A64(tb_flags, GCS_EN);
+    dc->gcs_rvcen = EX_TBFLAG_A64(tb_flags, GCS_RVCEN);
+    dc->gcsstr_el = EX_TBFLAG_A64(tb_flags, GCSSTR_EL);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index f1a6e5e2b6..761edded52 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -166,6 +166,12 @@ typedef struct DisasContext {
     bool fpcr_ah;
     /* True if FPCR.NEP is 1 (FEAT_AFP scalar upper-element result handling) */
     bool fpcr_nep;
+    /* True if GCSEnabled. */
+    bool gcs_en;
+    /* True if GCSReturnValueCheckEnabled. */
+    bool gcs_rvcen;
+    /* GCSSTR exception EL or 0 if enabled */
+    uint8_t gcsstr_el;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.

From 2b6c55fb032967629d07f2ba096f66d3b83a14bd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:33 -0700
Subject: [PATCH 1217/2396] target/arm: Implement FEAT_CHK

This feature contains only the CHKFEAT instruction.  It has
no ID enable, being back-allocated into the hint nop space.

Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-34-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst  |  1 +
 target/arm/tcg/a64.decode      |  1 +
 target/arm/tcg/translate-a64.c | 14 ++++++++++++++
 3 files changed, 16 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index c779a50570..68d9a4e734 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -28,6 +28,7 @@ the following architecture extensions:
 - FEAT_BF16 (AArch64 BFloat16 instructions)
 - FEAT_BTI (Branch Target Identification)
 - FEAT_CCIDX (Extended cache index)
+- FEAT_CHK (Check Feature Status)
 - FEAT_CMOW (Control for cache maintenance permission)
 - FEAT_CRC32 (CRC32 instructions)
 - FEAT_Crypto (Cryptographic Extension)
diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 55ff6c504f..8283a9c83d 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -256,6 +256,7 @@ ERETA           1101011 0100 11111 00001 m:1 11111 11111 &reta  # ERETAA, ERETAB
     AUTIASP     1101 0101 0000 0011 0010 0011 101 11111
     AUTIBZ      1101 0101 0000 0011 0010 0011 110 11111
     AUTIBSP     1101 0101 0000 0011 0010 0011 111 11111
+    CHKFEAT     1101 0101 0000 0011 0010 0101 000 11111
   ]
   # The canonical NOP has CRm == op2 == 0, but all of the space
   # that isn't specifically allocated to an instruction must NOP
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 693eab1c01..78b2881a15 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2124,6 +2124,20 @@ static bool trans_AUTIBSP(DisasContext *s, arg_AUTIBSP *a)
     return true;
 }
 
+static bool trans_CHKFEAT(DisasContext *s, arg_CHKFEAT *a)
+{
+    uint64_t feat_en = 0;
+
+    if (s->gcs_en) {
+        feat_en |= 1 << 0;
+    }
+    if (feat_en) {
+        TCGv_i64 x16 = cpu_reg(s, 16);
+        tcg_gen_andi_i64(x16, x16, ~feat_en);
+    }
+    return true;
+}
+
 static bool trans_CLREX(DisasContext *s, arg_CLREX *a)
 {
     tcg_gen_movi_i64(cpu_exclusive_addr, -1);

From 3476d935c3f17f937c7939d91f79cd3bdffc6209 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:34 -0700
Subject: [PATCH 1218/2396] target/arm: Make helper_exception_return
 system-only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-35-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-a64.c    | 2 ++
 target/arm/tcg/helper-a64.h    | 5 ++++-
 target/arm/tcg/translate-a64.c | 8 ++++++++
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 71c6c44ee8..6d77fd0113 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -576,6 +576,7 @@ uint32_t HELPER(advsimd_rinth)(uint32_t x, float_status *fp_status)
     return ret;
 }
 
+#ifndef CONFIG_USER_ONLY
 static int el_from_spsr(uint32_t spsr)
 {
     /* Return the exception level that this SPSR is requesting a return to,
@@ -787,6 +788,7 @@ illegal_return:
     qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                   "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
 }
+#endif /* !CONFIG_USER_ONLY */
 
 void HELPER(dc_zva)(CPUARMState *env, uint64_t vaddr_in)
 {
diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index 85023465b7..b6008b5a3a 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -80,7 +80,6 @@ DEF_HELPER_3(vfp_ah_maxh, f16, f16, f16, fpst)
 DEF_HELPER_3(vfp_ah_maxs, f32, f32, f32, fpst)
 DEF_HELPER_3(vfp_ah_maxd, f64, f64, f64, fpst)
 
-DEF_HELPER_2(exception_return, void, env, i64)
 DEF_HELPER_FLAGS_2(dc_zva, TCG_CALL_NO_WG, void, env, i64)
 
 DEF_HELPER_FLAGS_3(pacia, TCG_CALL_NO_WG, i64, env, i64, i64)
@@ -145,3 +144,7 @@ DEF_HELPER_FLAGS_5(gvec_fmulx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32
 DEF_HELPER_FLAGS_5(gvec_fmulx_idx_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmulx_idx_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_5(gvec_fmulx_idx_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+
+#ifndef CONFIG_USER_ONLY
+DEF_HELPER_2(exception_return, void, env, i64)
+#endif
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 78b2881a15..43c9bfef93 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1870,6 +1870,9 @@ static bool trans_BLRA(DisasContext *s, arg_bra *a)
 
 static bool trans_ERET(DisasContext *s, arg_ERET *a)
 {
+#ifdef CONFIG_USER_ONLY
+    return false;
+#else
     TCGv_i64 dst;
 
     if (s->current_el == 0) {
@@ -1889,10 +1892,14 @@ static bool trans_ERET(DisasContext *s, arg_ERET *a)
     /* Must exit loop to check un-masked IRQs */
     s->base.is_jmp = DISAS_EXIT;
     return true;
+#endif
 }
 
 static bool trans_ERETA(DisasContext *s, arg_reta *a)
 {
+#ifdef CONFIG_USER_ONLY
+    return false;
+#else
     TCGv_i64 dst;
 
     if (!dc_isar_feature(aa64_pauth, s)) {
@@ -1918,6 +1925,7 @@ static bool trans_ERETA(DisasContext *s, arg_reta *a)
     /* Must exit loop to check un-masked IRQs */
     s->base.is_jmp = DISAS_EXIT;
     return true;
+#endif
 }
 
 static bool trans_NOP(DisasContext *s, arg_NOP *a)

From 38f8b024d80d276429dad0adadc67789aa89730a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:35 -0700
Subject: [PATCH 1219/2396] target/arm: Export cpsr_{read_for,
 write_from}_spsr_elx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move cpsr_write_from_spsr_elx from tcg/helper-a64.c to
helper.c, so that it's present with --disable-tcg.
Declare both in internals.h.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-36-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c         | 20 +++++++++++++++++++-
 target/arm/internals.h      |  2 ++
 target/arm/tcg/helper-a64.c | 20 --------------------
 3 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 64b6c21aef..def4edf808 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8896,7 +8896,7 @@ static int aarch64_regnum(CPUARMState *env, int aarch32_reg)
     }
 }
 
-static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env)
+uint32_t cpsr_read_for_spsr_elx(CPUARMState *env)
 {
     uint32_t ret = cpsr_read(env);
 
@@ -8911,6 +8911,24 @@ static uint32_t cpsr_read_for_spsr_elx(CPUARMState *env)
     return ret;
 }
 
+void cpsr_write_from_spsr_elx(CPUARMState *env, uint32_t val)
+{
+    uint32_t mask;
+
+    /* Save SPSR_ELx.SS into PSTATE. */
+    env->pstate = (env->pstate & ~PSTATE_SS) | (val & PSTATE_SS);
+    val &= ~PSTATE_SS;
+
+    /* Move DIT to the correct location for CPSR */
+    if (val & PSTATE_DIT) {
+        val &= ~PSTATE_DIT;
+        val |= CPSR_DIT;
+    }
+
+    mask = aarch32_cpsr_valid_mask(env->features, &env_archcpu(env)->isar);
+    cpsr_write(env, val, mask, CPSRWriteRaw);
+}
+
 static bool syndrome_is_sync_extabt(uint32_t syndrome)
 {
     /* Return true if this syndrome value is a synchronous external abort */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 109aa104bf..2a85ab762d 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1897,6 +1897,8 @@ void vfp_clear_float_status_exc_flags(CPUARMState *env);
  */
 void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask);
 bool arm_pan_enabled(CPUARMState *env);
+uint32_t cpsr_read_for_spsr_elx(CPUARMState *env);
+void cpsr_write_from_spsr_elx(CPUARMState *env, uint32_t val);
 
 /* Compare uint64_t for qsort and bsearch. */
 int compare_u64(const void *a, const void *b);
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 6d77fd0113..eaea7859d3 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -615,26 +615,6 @@ static int el_from_spsr(uint32_t spsr)
     }
 }
 
-static void cpsr_write_from_spsr_elx(CPUARMState *env,
-                                     uint32_t val)
-{
-    uint32_t mask;
-
-    /* Save SPSR_ELx.SS into PSTATE. */
-    env->pstate = (env->pstate & ~PSTATE_SS) | (val & PSTATE_SS);
-    val &= ~PSTATE_SS;
-
-    /* Move DIT to the correct location for CPSR */
-    if (val & PSTATE_DIT) {
-        val &= ~PSTATE_DIT;
-        val |= CPSR_DIT;
-    }
-
-    mask = aarch32_cpsr_valid_mask(env->features, \
-        &env_archcpu(env)->isar);
-    cpsr_write(env, val, mask, CPSRWriteRaw);
-}
-
 void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
 {
     ARMCPU *cpu = env_archcpu(env);

From de83d60a84f25b9518a91bcb996f60a911d03e48 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:36 -0700
Subject: [PATCH 1220/2396] target/arm: Expand pstate to 64 bits

The ARM now defines 36 bits in SPSR_ELx in aarch64 mode, so
it's time to bite the bullet and extend PSTATE to match.

Most changes are straightforward, adjusting printf formats,
changing local variable types.  More complex is migration,
where to maintain backward compatibility a new pstate64
record is introduced, and only when one of the extensions
that sets bits 32-35 are active.

The fate of gdbstub is left undecided for the moment.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-37-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c            |  6 +--
 target/arm/cpu.h            |  8 ++--
 target/arm/gdbstub64.c      |  2 +
 target/arm/helper.c         | 11 ++---
 target/arm/machine.c        | 81 +++++++++++++++++++++++++++++++++++++
 target/arm/tcg/helper-a64.c |  2 +-
 target/arm/tcg/translate.h  | 20 ++++-----
 7 files changed, 107 insertions(+), 23 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 192acac1f5..cbb00c3db3 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -826,7 +826,7 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
-    uint32_t psr = pstate_read(env);
+    uint64_t psr = pstate_read(env);
     int i, j;
     int el = arm_current_el(env);
     uint64_t hcr = arm_hcr_el2_eff(env);
@@ -848,7 +848,7 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     } else {
         ns_status = "";
     }
-    qemu_fprintf(f, "PSTATE=%08x %c%c%c%c %sEL%d%c",
+    qemu_fprintf(f, "PSTATE=%016" PRIx64 " %c%c%c%c %sEL%d%c",
                  psr,
                  psr & PSTATE_N ? 'N' : '-',
                  psr & PSTATE_Z ? 'Z' : '-',
@@ -865,7 +865,7 @@ static void aarch64_cpu_dump_state(CPUState *cs, FILE *f, int flags)
                      (FIELD_EX64(env->svcr, SVCR, SM) ? 'S' : '-'));
     }
     if (cpu_isar_feature(aa64_bti, cpu)) {
-        qemu_fprintf(f, "  BTYPE=%d", (psr & PSTATE_BTYPE) >> 10);
+        qemu_fprintf(f, "  BTYPE=%d", (int)(psr & PSTATE_BTYPE) >> 10);
     }
     qemu_fprintf(f, "%s%s%s",
                  (hcr & HCR_NV) ? " NV" : "",
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 775219364f..b8abfd8276 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -268,7 +268,7 @@ typedef struct CPUArchState {
     uint64_t xregs[32];
     uint64_t pc;
     /* PSTATE isn't an architectural register for ARMv8. However, it is
-     * convenient for us to assemble the underlying state into a 32 bit format
+     * convenient for us to assemble the underlying state into a 64 bit format
      * identical to the architectural format used for the SPSR. (This is also
      * what the Linux kernel's 'pstate' field in signal handlers and KVM's
      * 'pstate' register are.) Of the PSTATE bits:
@@ -280,7 +280,7 @@ typedef struct CPUArchState {
      *  SM and ZA are kept in env->svcr
      *  all other bits are stored in their correct places in env->pstate
      */
-    uint32_t pstate;
+    uint64_t pstate;
     bool aarch64; /* True if CPU is in aarch64 state; inverse of PSTATE.nRW */
     bool thumb;   /* True if CPU is in thumb mode; cpsr[5] */
 
@@ -1538,7 +1538,7 @@ static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler)
  * interprocessing, so we don't attempt to sync with the cpsr state used by
  * the 32 bit decoder.
  */
-static inline uint32_t pstate_read(CPUARMState *env)
+static inline uint64_t pstate_read(CPUARMState *env)
 {
     int ZF;
 
@@ -1548,7 +1548,7 @@ static inline uint32_t pstate_read(CPUARMState *env)
         | env->pstate | env->daif | (env->btype << 10);
 }
 
-static inline void pstate_write(CPUARMState *env, uint32_t val)
+static inline void pstate_write(CPUARMState *env, uint64_t val)
 {
     env->ZF = (~val) & PSTATE_Z;
     env->NF = val;
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 3bccde2bf2..65d6bbe65f 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -47,6 +47,7 @@ int aarch64_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
     case 32:
         return gdb_get_reg64(mem_buf, env->pc);
     case 33:
+        /* pstate is now a 64-bit value; can we simply adjust the xml? */
         return gdb_get_reg32(mem_buf, pstate_read(env));
     }
     /* Unknown register.  */
@@ -75,6 +76,7 @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
         return 8;
     case 33:
         /* CPSR */
+        /* pstate is now a 64-bit value; can we simply adjust the xml? */
         pstate_write(env, tmp);
         return 4;
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index def4edf808..8e342b0811 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -8961,8 +8961,8 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     CPUARMState *env = &cpu->env;
     unsigned int new_el = env->exception.target_el;
     vaddr addr = env->cp15.vbar_el[new_el];
-    unsigned int new_mode = aarch64_pstate_mode(new_el, true);
-    unsigned int old_mode;
+    uint64_t new_mode = aarch64_pstate_mode(new_el, true);
+    uint64_t old_mode;
     unsigned int cur_el = arm_current_el(env);
     int rt;
 
@@ -9110,7 +9110,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
                  * If NV2 is disabled, change SPSR when NV,NV1 == 1,0 (I_ZJRNN)
                  * If NV2 is enabled, change SPSR when NV is 1 (I_DBTLM)
                  */
-                old_mode = deposit32(old_mode, 2, 2, 2);
+                old_mode = deposit64(old_mode, 2, 2, 2);
             }
         }
     } else {
@@ -9123,7 +9123,7 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     }
     env->banked_spsr[aarch64_banked_spsr_index(new_el)] = old_mode;
 
-    qemu_log_mask(CPU_LOG_INT, "...with SPSR 0x%x\n", old_mode);
+    qemu_log_mask(CPU_LOG_INT, "...with SPSR 0x%" PRIx64 "\n", old_mode);
     qemu_log_mask(CPU_LOG_INT, "...with ELR 0x%" PRIx64 "\n",
                   env->elr_el[new_el]);
 
@@ -9177,7 +9177,8 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
 
     env->pc = addr;
 
-    qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64 " PSTATE 0x%x\n",
+    qemu_log_mask(CPU_LOG_INT, "...to EL%d PC 0x%" PRIx64
+                  " PSTATE 0x%" PRIx64 "\n",
                   new_el, env->pc, pstate_read(env));
 }
 
diff --git a/target/arm/machine.c b/target/arm/machine.c
index ce20b46f50..44a0cf844b 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -816,6 +816,80 @@ static const VMStateInfo vmstate_cpsr = {
     .put = put_cpsr,
 };
 
+static int get_pstate64(QEMUFile *f, void *opaque, size_t size,
+                        const VMStateField *field)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+    uint64_t val = qemu_get_be64(f);
+
+    env->aarch64 = ((val & PSTATE_nRW) == 0);
+    if (is_a64(env)) {
+        pstate_write(env, val);
+    } else {
+        cpsr_write_from_spsr_elx(env, val);
+    }
+    return 0;
+}
+
+static int put_pstate64(QEMUFile *f, void *opaque, size_t size,
+                        const VMStateField *field, JSONWriter *vmdesc)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+    uint64_t val;
+
+    if (is_a64(env)) {
+        val = pstate_read(env);
+    } else {
+        val = cpsr_read_for_spsr_elx(env);
+    }
+    qemu_put_be64(f, val);
+    return 0;
+}
+
+static bool pstate64_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+    uint64_t val;
+
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return false;
+    }
+    if (is_a64(env)) {
+        val = pstate_read(env);
+    } else {
+        val = cpsr_read_for_spsr_elx(env);
+        if (val & PSTATE_SS) {
+            return true;
+        }
+    }
+    return val > UINT32_MAX;
+}
+
+static const VMStateDescription vmstate_pstate64 = {
+    .name = "cpu/pstate64",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = pstate64_needed,
+    .fields = (const VMStateField[]) {
+        {
+            .name = "pstate64",
+            .version_id = 0,
+            .size = sizeof(uint64_t),
+            .info = &(const VMStateInfo) {
+                .name = "pstate64",
+                .get = get_pstate64,
+                .put = put_pstate64,
+            },
+            .flags = VMS_SINGLE,
+            .offset = 0,
+        },
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static int get_power(QEMUFile *f, void *opaque, size_t size,
                     const VMStateField *field)
 {
@@ -1052,6 +1126,12 @@ const VMStateDescription vmstate_arm_cpu = {
         VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
         VMSTATE_UINT64_ARRAY(env.xregs, ARMCPU, 32),
         VMSTATE_UINT64(env.pc, ARMCPU),
+        /*
+         * If any bits are set in the upper 32 bits of cpsr/pstate,
+         * or if the cpu is in aa32 mode and PSTATE.SS is set, then
+         * the cpu/pstate64 subsection will override this with the
+         * full 64 bit state.
+         */
         {
             .name = "cpsr",
             .version_id = 0,
@@ -1128,6 +1208,7 @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_irq_line_state,
         &vmstate_wfxt_timer,
         &vmstate_syndrome64,
+        &vmstate_pstate64,
         NULL
     }
 };
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index eaea7859d3..08b7db7c46 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -620,7 +620,7 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     ARMCPU *cpu = env_archcpu(env);
     int cur_el = arm_current_el(env);
     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
-    uint32_t spsr = env->banked_spsr[spsr_idx];
+    uint64_t spsr = env->banked_spsr[spsr_idx];
     int new_el;
     bool return_to_aa64 = (spsr & PSTATE_nRW) == 0;
 
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 761edded52..943dfd45fe 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -378,27 +378,27 @@ static inline TCGv_i32 get_ahp_flag(void)
 }
 
 /* Set bits within PSTATE.  */
-static inline void set_pstate_bits(uint32_t bits)
+static inline void set_pstate_bits(uint64_t bits)
 {
-    TCGv_i32 p = tcg_temp_new_i32();
+    TCGv_i64 p = tcg_temp_new_i64();
 
     tcg_debug_assert(!(bits & CACHED_PSTATE_BITS));
 
-    tcg_gen_ld_i32(p, tcg_env, offsetof(CPUARMState, pstate));
-    tcg_gen_ori_i32(p, p, bits);
-    tcg_gen_st_i32(p, tcg_env, offsetof(CPUARMState, pstate));
+    tcg_gen_ld_i64(p, tcg_env, offsetof(CPUARMState, pstate));
+    tcg_gen_ori_i64(p, p, bits);
+    tcg_gen_st_i64(p, tcg_env, offsetof(CPUARMState, pstate));
 }
 
 /* Clear bits within PSTATE.  */
-static inline void clear_pstate_bits(uint32_t bits)
+static inline void clear_pstate_bits(uint64_t bits)
 {
-    TCGv_i32 p = tcg_temp_new_i32();
+    TCGv_i64 p = tcg_temp_new_i64();
 
     tcg_debug_assert(!(bits & CACHED_PSTATE_BITS));
 
-    tcg_gen_ld_i32(p, tcg_env, offsetof(CPUARMState, pstate));
-    tcg_gen_andi_i32(p, p, ~bits);
-    tcg_gen_st_i32(p, tcg_env, offsetof(CPUARMState, pstate));
+    tcg_gen_ld_i64(p, tcg_env, offsetof(CPUARMState, pstate));
+    tcg_gen_andi_i64(p, p, ~bits);
+    tcg_gen_st_i64(p, tcg_env, offsetof(CPUARMState, pstate));
 }
 
 /* If the singlestep state is Active-not-pending, advance to Active-pending. */

From f0fdbfae973de21344706c5fdd9588b24e2395b7 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:37 -0700
Subject: [PATCH 1221/2396] target/arm: Add syndrome data for EC_GCS

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-38-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h | 35 +++++++++++++++++++++++++++++++++++
 1 file changed, 35 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index c48d3b8587..bff61f052c 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -63,6 +63,7 @@ enum arm_exception_class {
     EC_MOP                    = 0x27,
     EC_AA32_FPTRAP            = 0x28,
     EC_AA64_FPTRAP            = 0x2c,
+    EC_GCS                    = 0x2d,
     EC_SERROR                 = 0x2f,
     EC_BREAKPOINT             = 0x30,
     EC_BREAKPOINT_SAME_EL     = 0x31,
@@ -83,6 +84,23 @@ typedef enum {
     SME_ET_InaccessibleZT0,
 } SMEExceptionType;
 
+typedef enum {
+    GCS_ET_DataCheck,
+    GCS_ET_EXLOCK,
+    GCS_ET_GCSSTR_GCSSTTR,
+} GCSExceptionType;
+
+typedef enum {
+    GCS_IT_RET_nPauth = 0,
+    GCS_IT_GCSPOPM = 1,
+    GCS_IT_RET_PauthA = 2,
+    GCS_IT_RET_PauthB = 3,
+    GCS_IT_GCSSS1 = 4,
+    GCS_IT_GCSSS2 = 5,
+    GCS_IT_GCSPOPCX = 8,
+    GCS_IT_GCSPOPX = 9,
+} GCSInstructionType;
+
 #define ARM_EL_EC_LENGTH 6
 #define ARM_EL_EC_SHIFT 26
 #define ARM_EL_IL_SHIFT 25
@@ -351,6 +369,23 @@ static inline uint32_t syn_pcalignment(void)
     return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;
 }
 
+static inline uint32_t syn_gcs_data_check(GCSInstructionType it, int rn)
+{
+    return ((EC_GCS << ARM_EL_EC_SHIFT) | ARM_EL_IL |
+            (GCS_ET_DataCheck << 20) | (rn << 5) | it);
+}
+
+static inline uint32_t syn_gcs_exlock(void)
+{
+    return (EC_GCS << ARM_EL_EC_SHIFT) | ARM_EL_IL | (GCS_ET_EXLOCK << 20);
+}
+
+static inline uint32_t syn_gcs_gcsstr(int ra, int rn)
+{
+    return ((EC_GCS << ARM_EL_EC_SHIFT) | ARM_EL_IL |
+            (GCS_ET_GCSSTR_GCSSTTR << 20) | (ra << 10) | (rn << 5));
+}
+
 static inline uint32_t syn_serror(uint32_t extra)
 {
     return (EC_SERROR << ARM_EL_EC_SHIFT) | ARM_EL_IL | extra;

From 9e703a01f00a156f7944b8150bfb787ce273a4a0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:38 -0700
Subject: [PATCH 1222/2396] target/arm: Add arm_hcr_el2_nvx_eff
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement the pseudocode function EffectiveHCR_EL2_NVx.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-39-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 10 ++++++++++
 2 files changed, 11 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index b8abfd8276..54f3d7b1cc 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2235,6 +2235,7 @@ static inline bool arm_is_el2_enabled(CPUARMState *env)
  */
 uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
 uint64_t arm_hcr_el2_eff(CPUARMState *env);
+uint64_t arm_hcr_el2_nvx_eff(CPUARMState *env);
 uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 
 /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8e342b0811..e397fe75bd 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3904,6 +3904,16 @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
     return arm_hcr_el2_eff_secstate(env, arm_security_space_below_el3(env));
 }
 
+uint64_t arm_hcr_el2_nvx_eff(CPUARMState *env)
+{
+    uint64_t hcr = arm_hcr_el2_eff(env);
+
+    if (!(hcr & HCR_NV)) {
+        return 0; /* CONSTRAINED UNPREDICTABLE wrt NV1 */
+    }
+    return hcr & (HCR_NV2 | HCR_NV1 | HCR_NV);
+}
+
 /*
  * Corresponds to ARM pseudocode function ELIsInHost().
  */

From 3a6a957b89ffcdeed3a39ae9eb268dfbda926a63 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:39 -0700
Subject: [PATCH 1223/2396] target/arm: Use arm_hcr_el2_nvx_eff in access_nv1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-40-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index e397fe75bd..2875f0ddd2 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3427,7 +3427,7 @@ static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri,
                                  bool isread)
 {
     if (arm_current_el(env) == 1) {
-        uint64_t hcr_nv = arm_hcr_el2_eff(env) & (HCR_NV | HCR_NV1 | HCR_NV2);
+        uint64_t hcr_nv = arm_hcr_el2_nvx_eff(env);
 
         if (hcr_nv == (HCR_NV | HCR_NV1)) {
             return CP_ACCESS_TRAP_EL2;

From 399d40b985032ec1364f9906ef6596264a53f2db Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:40 -0700
Subject: [PATCH 1224/2396] target/arm: Split out access_nv1_with_nvx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-41-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2875f0ddd2..5d40266d96 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3423,15 +3423,16 @@ static void mdcr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 }
 
+static CPAccessResult access_nv1_with_nvx(uint64_t hcr_nv)
+{
+    return hcr_nv == (HCR_NV | HCR_NV1) ? CP_ACCESS_TRAP_EL2 : CP_ACCESS_OK;
+}
+
 static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri,
                                  bool isread)
 {
     if (arm_current_el(env) == 1) {
-        uint64_t hcr_nv = arm_hcr_el2_nvx_eff(env);
-
-        if (hcr_nv == (HCR_NV | HCR_NV1)) {
-            return CP_ACCESS_TRAP_EL2;
-        }
+        return access_nv1_with_nvx(arm_hcr_el2_nvx_eff(env));
     }
     return CP_ACCESS_OK;
 }

From 766c99beabd5a15ec2f4d2b1372926d8e1b03717 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:41 -0700
Subject: [PATCH 1225/2396] target/arm: Implement EXLOCKException for ELR_ELx
 and SPSR_ELx

If PSTATE.EXLOCK is set, and the GCS EXLOCK enable bit is set,
and nested virt is in the appropriate state, then we need to
raise an EXLOCK exception.

Since PSTATE.EXLOCK cannot be set without GCS being present
and enabled, no explicit check for GCS is required.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-42-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h        |  8 +++++
 target/arm/cpu.h           |  1 +
 target/arm/helper.c        | 67 ++++++++++++++++++++++++++++++++++----
 target/arm/tcg/op_helper.c |  7 ++++
 4 files changed, 77 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index bd2121a336..a79f00351c 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -351,6 +351,14 @@ typedef enum CPAccessResult {
      * specified target EL.
      */
     CP_ACCESS_UNDEFINED = (2 << 2),
+
+    /*
+     * Access fails with EXLOCK, a GCS exception syndrome.
+     * These traps are always to the current execution EL,
+     * which is the same as the usual target EL because
+     * they cannot occur from EL0.
+     */
+    CP_ACCESS_EXLOCK = (3 << 2),
 } CPAccessResult;
 
 /* Indexes into fgt_read[] */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 54f3d7b1cc..91a851dac1 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -1502,6 +1502,7 @@ void pmu_init(ARMCPU *cpu);
 #define PSTATE_C (1U << 29)
 #define PSTATE_Z (1U << 30)
 #define PSTATE_N (1U << 31)
+#define PSTATE_EXLOCK (1ULL << 34)
 #define PSTATE_NZCV (PSTATE_N | PSTATE_Z | PSTATE_C | PSTATE_V)
 #define PSTATE_DAIF (PSTATE_D | PSTATE_A | PSTATE_I | PSTATE_F)
 #define CACHED_PSTATE_BITS (PSTATE_NZCV | PSTATE_DAIF | PSTATE_BTYPE)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 5d40266d96..1aa0a157b7 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -3437,6 +3437,61 @@ static CPAccessResult access_nv1(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_nv1_or_exlock_el1(CPUARMState *env,
+                                               const ARMCPRegInfo *ri,
+                                               bool isread)
+{
+    if (arm_current_el(env) == 1) {
+        uint64_t nvx = arm_hcr_el2_nvx_eff(env);
+
+        if (!isread &&
+            (env->pstate & PSTATE_EXLOCK) &&
+            (env->cp15.gcscr_el[1] & GCSCR_EXLOCKEN) &&
+            !(nvx & HCR_NV1)) {
+            return CP_ACCESS_EXLOCK;
+        }
+        return access_nv1_with_nvx(nvx);
+    }
+
+    /*
+     * At EL2, since VHE redirection is done at translation time,
+     * el_is_in_host is always false here, so EXLOCK does not apply.
+     */
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_exlock_el2(CPUARMState *env,
+                                        const ARMCPRegInfo *ri, bool isread)
+{
+    int el = arm_current_el(env);
+
+    if (el == 3) {
+        return CP_ACCESS_OK;
+    }
+
+    /*
+     * Access to the EL2 register from EL1 means NV is set, and
+     * EXLOCK has priority over an NV1 trap to EL2.
+     */
+    if (!isread &&
+        (env->pstate & PSTATE_EXLOCK) &&
+        (env->cp15.gcscr_el[el] & GCSCR_EXLOCKEN)) {
+        return CP_ACCESS_EXLOCK;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_exlock_el3(CPUARMState *env,
+                                        const ARMCPRegInfo *ri, bool isread)
+{
+    if (!isread &&
+        (env->pstate & PSTATE_EXLOCK) &&
+        (env->cp15.gcscr_el[3] & GCSCR_EXLOCKEN)) {
+        return CP_ACCESS_EXLOCK;
+    }
+    return CP_ACCESS_OK;
+}
+
 #ifdef CONFIG_USER_ONLY
 /*
  * `IC IVAU` is handled to improve compatibility with JITs that dual-map their
@@ -3608,7 +3663,7 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
     { .name = "ELR_EL1", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 1,
-      .access = PL1_RW, .accessfn = access_nv1,
+      .access = PL1_RW, .accessfn = access_nv1_or_exlock_el1,
       .nv2_redirect_offset = 0x230 | NV2_REDIR_NV1,
       .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 1),
       .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 1),
@@ -3616,7 +3671,7 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
     { .name = "SPSR_EL1", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 0, .crn = 4, .crm = 0, .opc2 = 0,
-      .access = PL1_RW, .accessfn = access_nv1,
+      .access = PL1_RW, .accessfn = access_nv1_or_exlock_el1,
       .nv2_redirect_offset = 0x160 | NV2_REDIR_NV1,
       .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 4, 0, 0),
       .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 4, 0, 0),
@@ -4100,7 +4155,7 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT,
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
-      .access = PL2_RW,
+      .access = PL2_RW, .accessfn = access_exlock_el2,
       .fieldoffset = offsetof(CPUARMState, elr_el[2]) },
     { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
       .type = ARM_CP_NV2_REDIRECT,
@@ -4118,7 +4173,7 @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "SPSR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS | ARM_CP_NV2_REDIRECT,
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 0,
-      .access = PL2_RW,
+      .access = PL2_RW, .accessfn = access_exlock_el2,
       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_HYP]) },
     { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
@@ -4400,7 +4455,7 @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
     { .name = "ELR_EL3", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 1,
-      .access = PL3_RW,
+      .access = PL3_RW, .accessfn = access_exlock_el3,
       .fieldoffset = offsetof(CPUARMState, elr_el[3]) },
     { .name = "ESR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 5, .crm = 2, .opc2 = 0,
@@ -4411,7 +4466,7 @@ static const ARMCPRegInfo el3_cp_reginfo[] = {
     { .name = "SPSR_EL3", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 6, .crn = 4, .crm = 0, .opc2 = 0,
-      .access = PL3_RW,
+      .access = PL3_RW, .accessfn = access_exlock_el3,
       .fieldoffset = offsetof(CPUARMState, banked_spsr[BANK_MON]) },
     { .name = "VBAR_EL3", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 6, .crn = 12, .crm = 0, .opc2 = 0,
diff --git a/target/arm/tcg/op_helper.c b/target/arm/tcg/op_helper.c
index dd3700dc6f..4fbd219555 100644
--- a/target/arm/tcg/op_helper.c
+++ b/target/arm/tcg/op_helper.c
@@ -881,6 +881,13 @@ const void *HELPER(access_check_cp_reg)(CPUARMState *env, uint32_t key,
         }
         syndrome = syn_uncategorized();
         break;
+    case CP_ACCESS_EXLOCK:
+        /*
+         * CP_ACCESS_EXLOCK is always directed to the current EL,
+         * which is going to be the same as the usual target EL.
+         */
+        syndrome = syn_gcs_exlock();
+        break;
     default:
         g_assert_not_reached();
     }

From 49b49214f346da81a79961e7f89225200da274e6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:42 -0700
Subject: [PATCH 1226/2396] target/arm: Split {full,core}_a64_user_mem_index
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Separate get_a64_user_mem_index into two separate functions, one which
returns the full ARMMMUIdx and one which returns the core mmu_idx.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-43-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 24 +++++++++++++++---------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 43c9bfef93..1337e16a96 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -93,7 +93,7 @@ void a64_translate_init(void)
 }
 
 /*
- * Return the core mmu_idx to use for A64 load/store insns which
+ * Return the full arm mmu_idx to use for A64 load/store insns which
  * have a "unprivileged load/store" variant. Those insns access
  * EL0 if executed from an EL which has control over EL0 (usually
  * EL1) but behave like normal loads and stores if executed from
@@ -103,7 +103,7 @@ void a64_translate_init(void)
  *           normal encoding (in which case we will return the same
  *           thing as get_mem_index().
  */
-static int get_a64_user_mem_index(DisasContext *s, bool unpriv)
+static ARMMMUIdx full_a64_user_mem_index(DisasContext *s, bool unpriv)
 {
     /*
      * If AccType_UNPRIV is not used, the insn uses AccType_NORMAL,
@@ -130,7 +130,13 @@ static int get_a64_user_mem_index(DisasContext *s, bool unpriv)
             g_assert_not_reached();
         }
     }
-    return arm_to_core_mmu_idx(useridx);
+    return useridx;
+}
+
+/* Return the core mmu_idx per above. */
+static int core_a64_user_mem_index(DisasContext *s, bool unpriv)
+{
+    return arm_to_core_mmu_idx(full_a64_user_mem_index(s, unpriv));
 }
 
 static void set_btype_raw(int val)
@@ -3577,7 +3583,7 @@ static void op_addr_ldst_imm_pre(DisasContext *s, arg_ldst_imm *a,
     if (!a->p) {
         tcg_gen_addi_i64(*dirty_addr, *dirty_addr, offset);
     }
-    memidx = get_a64_user_mem_index(s, a->unpriv);
+    memidx = core_a64_user_mem_index(s, a->unpriv);
     *clean_addr = gen_mte_check1_mmuidx(s, *dirty_addr, is_store,
                                         a->w || a->rn != 31,
                                         mop, a->unpriv, memidx);
@@ -3598,7 +3604,7 @@ static bool trans_STR_i(DisasContext *s, arg_ldst_imm *a)
 {
     bool iss_sf, iss_valid = !a->w;
     TCGv_i64 clean_addr, dirty_addr, tcg_rt;
-    int memidx = get_a64_user_mem_index(s, a->unpriv);
+    int memidx = core_a64_user_mem_index(s, a->unpriv);
     MemOp mop = finalize_memop(s, a->sz + a->sign * MO_SIGN);
 
     op_addr_ldst_imm_pre(s, a, &clean_addr, &dirty_addr, a->imm, true, mop);
@@ -3616,7 +3622,7 @@ static bool trans_LDR_i(DisasContext *s, arg_ldst_imm *a)
 {
     bool iss_sf, iss_valid = !a->w;
     TCGv_i64 clean_addr, dirty_addr, tcg_rt;
-    int memidx = get_a64_user_mem_index(s, a->unpriv);
+    int memidx = core_a64_user_mem_index(s, a->unpriv);
     MemOp mop = finalize_memop(s, a->sz + a->sign * MO_SIGN);
 
     op_addr_ldst_imm_pre(s, a, &clean_addr, &dirty_addr, a->imm, false, mop);
@@ -4514,7 +4520,7 @@ static bool do_SET(DisasContext *s, arg_set *a, bool is_epilogue,
         return false;
     }
 
-    memidx = get_a64_user_mem_index(s, a->unpriv);
+    memidx = core_a64_user_mem_index(s, a->unpriv);
 
     /*
      * We pass option_a == true, matching our implementation;
@@ -4568,8 +4574,8 @@ static bool do_CPY(DisasContext *s, arg_cpy *a, bool is_epilogue, CpyFn fn)
         return false;
     }
 
-    rmemidx = get_a64_user_mem_index(s, runpriv);
-    wmemidx = get_a64_user_mem_index(s, wunpriv);
+    rmemidx = core_a64_user_mem_index(s, runpriv);
+    wmemidx = core_a64_user_mem_index(s, wunpriv);
 
     /*
      * We pass option_a == true, matching our implementation;

From 609f5d7692d97ea260eee9236d5741c46d07ff8d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:43 -0700
Subject: [PATCH 1227/2396] target/arm: Introduce delay_exception{_el}

Add infrastructure to raise an exception out of line.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-44-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c |  2 ++
 target/arm/tcg/translate.c     | 53 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate.h     | 20 +++++++++++++
 3 files changed, 75 insertions(+)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 1337e16a96..c037119cdf 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -10601,6 +10601,8 @@ static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             break;
         }
     }
+
+    emit_delayed_exceptions(dc);
 }
 
 const TranslatorOps aarch64_translator_ops = {
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index e62dcc5d85..78d26aac04 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -1088,6 +1088,57 @@ void gen_exception_insn(DisasContext *s, target_long pc_diff,
     s->base.is_jmp = DISAS_NORETURN;
 }
 
+TCGLabel *delay_exception_el(DisasContext *s, int excp,
+                             uint32_t syn, uint32_t target_el)
+{
+    /* Use tcg_malloc for automatic release on longjmp out of translation. */
+    DisasDelayException *e = tcg_malloc(sizeof(DisasDelayException));
+
+    memset(e, 0, sizeof(*e));
+
+    /* Save enough of the current state to satisfy gen_exception_insn. */
+    e->pc_curr = s->pc_curr;
+    e->pc_save = s->pc_save;
+    if (!s->aarch64) {
+        e->condexec_cond = s->condexec_cond;
+        e->condexec_mask = s->condexec_mask;
+    }
+
+    e->excp = excp;
+    e->syn = syn;
+    e->target_el = target_el;
+
+    e->next = s->delay_excp_list;
+    s->delay_excp_list = e;
+
+    e->lab = gen_new_label();
+    return e->lab;
+}
+
+TCGLabel *delay_exception(DisasContext *s, int excp, uint32_t syn)
+{
+    return delay_exception_el(s, excp, syn, 0);
+}
+
+void emit_delayed_exceptions(DisasContext *s)
+{
+    for (DisasDelayException *e = s->delay_excp_list; e ; e = e->next) {
+        gen_set_label(e->lab);
+
+        /* Restore the insn state to satisfy gen_exception_insn. */
+        s->pc_curr = e->pc_curr;
+        s->pc_save = e->pc_save;
+        s->condexec_cond = e->condexec_cond;
+        s->condexec_mask = e->condexec_mask;
+
+        if (e->target_el) {
+            gen_exception_insn_el(s, 0, e->excp, e->syn, e->target_el);
+        } else {
+            gen_exception_insn(s, 0, e->excp, e->syn);
+        }
+    }
+}
+
 static void gen_exception_bkpt_insn(DisasContext *s, uint32_t syn)
 {
     gen_set_condexec(s);
@@ -6791,6 +6842,8 @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             gen_goto_tb(dc, 1, curr_insn_len(dc));
         }
     }
+
+    emit_delayed_exceptions(dc);
 }
 
 static const TranslatorOps arm_translator_ops = {
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 943dfd45fe..9a85ea74db 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -21,9 +21,25 @@ typedef struct DisasLabel {
     target_ulong pc_save;
 } DisasLabel;
 
+/*
+ * Emit an exception call out of line.
+ */
+typedef struct DisasDelayException {
+    struct DisasDelayException *next;
+    TCGLabel *lab;
+    target_long pc_curr;
+    target_long pc_save;
+    int condexec_mask;
+    int condexec_cond;
+    uint32_t excp;
+    uint32_t syn;
+    uint32_t target_el;
+} DisasDelayException;
+
 typedef struct DisasContext {
     DisasContextBase base;
     const ARMISARegisters *isar;
+    DisasDelayException *delay_excp_list;
 
     /* The address of the current instruction being translated. */
     target_ulong pc_curr;
@@ -365,6 +381,10 @@ void gen_exception_insn_el(DisasContext *s, target_long pc_diff, int excp,
                            uint32_t syn, uint32_t target_el);
 void gen_exception_insn(DisasContext *s, target_long pc_diff,
                         int excp, uint32_t syn);
+TCGLabel *delay_exception_el(DisasContext *s, int excp,
+                             uint32_t syn, uint32_t target_el);
+TCGLabel *delay_exception(DisasContext *s, int excp, uint32_t syn);
+void emit_delayed_exceptions(DisasContext *s);
 
 /* Return state of Alternate Half-precision flag, caller frees result */
 static inline TCGv_i32 get_ahp_flag(void)

From 923e7c432ec0fdee97b746f529f238dde2ba78f0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:44 -0700
Subject: [PATCH 1228/2396] target/arm: Emit HSTR trap exception out of line

Use delay_exception_el to move the exception out of line.
Use TCG_COND_TSTNE instead of separate AND+NE.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-45-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 18 ++++--------------
 1 file changed, 4 insertions(+), 14 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 78d26aac04..57bc8ea4c5 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -1774,21 +1774,11 @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
 
         if (maskbit != 4 && maskbit != 14) {
             /* T4 and T14 are RES0 so never cause traps */
-            TCGv_i32 t;
-            DisasLabel over = gen_disas_label(s);
+            TCGLabel *fail = delay_exception_el(s, EXCP_UDEF, syndrome, 2);
+            TCGv_i32 t =
+                load_cpu_offset(offsetoflow32(CPUARMState, cp15.hstr_el2));
 
-            t = load_cpu_offset(offsetoflow32(CPUARMState, cp15.hstr_el2));
-            tcg_gen_andi_i32(t, t, 1u << maskbit);
-            tcg_gen_brcondi_i32(TCG_COND_EQ, t, 0, over.label);
-
-            gen_exception_insn_el(s, 0, EXCP_UDEF, syndrome, 2);
-            /*
-             * gen_exception_insn() will set is_jmp to DISAS_NORETURN,
-             * but since we're conditionally branching over it, we want
-             * to assume continue-to-next-instruction.
-             */
-            s->base.is_jmp = DISAS_NEXT;
-            set_disas_label(s, over);
+            tcg_gen_brcondi_i32(TCG_COND_TSTNE, t, 1u << maskbit, fail);
         }
     }
 

From 0e15a9a53c56f8ddd6a8c6f691a0507429387d91 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:45 -0700
Subject: [PATCH 1229/2396] target/arm: Emit v7m LTPSIZE exception out of line

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-46-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 57bc8ea4c5..3df0bbcb7f 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -5598,11 +5598,10 @@ static bool trans_LE(DisasContext *s, arg_LE *a)
 
     if (!a->tp && dc_isar_feature(aa32_mve, s) && fpu_active) {
         /* Need to do a runtime check for LTPSIZE != 4 */
-        DisasLabel skipexc = gen_disas_label(s);
+        TCGLabel *fail = delay_exception(s, EXCP_INVSTATE, syn_uncategorized());
+
         tmp = load_cpu_field(v7m.ltpsize);
-        tcg_gen_brcondi_i32(TCG_COND_EQ, tmp, 4, skipexc.label);
-        gen_exception_insn(s, 0, EXCP_INVSTATE, syn_uncategorized());
-        set_disas_label(s, skipexc);
+        tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 4, fail);
     }
 
     if (a->f) {

From 6a5596bad37e62800e9d8ed8d35cb6a1af1030ba Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:46 -0700
Subject: [PATCH 1230/2396] target/arm: Implement GCSSTR, GCSSTTR

Note that CreateAccDescGCS() does not enable tagchecked,
and Data Aborts from GCS instructions do not set iss.isv.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-47-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/a64.decode      |  3 +++
 target/arm/tcg/translate-a64.c | 42 ++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 8283a9c83d..2ae73f443a 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -571,6 +571,9 @@ LDAPR_i         10 011001 10 0 ......... 00 ..... ..... @ldapr_stlr_i sign=1 ext
 LDAPR_i         00 011001 11 0 ......... 00 ..... ..... @ldapr_stlr_i sign=1 ext=1 sz=0
 LDAPR_i         01 011001 11 0 ......... 00 ..... ..... @ldapr_stlr_i sign=1 ext=1 sz=1
 
+# GCSSTR, GCSSTTR
+GCSSTR          11011001 000 11111 000 unpriv:1 11 rn:5 rt:5
+
 # Load/store multiple structures
 # The 4-bit opcode in [15:12] encodes repeat count and structure elements
 &ldst_mult      rm rn rt sz q p rpt selem
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index c037119cdf..b72aa968cd 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -139,6 +139,12 @@ static int core_a64_user_mem_index(DisasContext *s, bool unpriv)
     return arm_to_core_mmu_idx(full_a64_user_mem_index(s, unpriv));
 }
 
+/* For a given translation regime, return the core mmu_idx for gcs access. */
+static int core_gcs_mem_index(ARMMMUIdx armidx)
+{
+    return arm_to_core_mmu_idx(regime_to_gcs(armidx));
+}
+
 static void set_btype_raw(int val)
 {
     tcg_gen_st_i32(tcg_constant_i32(val), tcg_env,
@@ -3989,6 +3995,42 @@ static bool trans_STLR_i(DisasContext *s, arg_ldapr_stlr_i *a)
     return true;
 }
 
+static bool trans_GCSSTR(DisasContext *s, arg_GCSSTR *a)
+{
+    ARMMMUIdx armidx;
+
+    if (!dc_isar_feature(aa64_gcs, s)) {
+        return false;
+    }
+
+    /*
+     * The pseudocode for GCSSTTR is
+     *
+     *   effective_el = AArch64.IsUnprivAccessPriv() ? PSTATE.EL : EL0;
+     *   if (effective_el == PSTATE.EL) CheckGCSSTREnabled();
+     *
+     * We have cached the result of IsUnprivAccessPriv in DisasContext,
+     * but since we need the result of full_a64_user_mem_index anyway,
+     * use the mmu_idx test as a proxy for the effective_el test.
+     */
+    armidx = full_a64_user_mem_index(s, a->unpriv);
+    if (armidx == s->mmu_idx && s->gcsstr_el != 0) {
+        gen_exception_insn_el(s, 0, EXCP_UDEF,
+                              syn_gcs_gcsstr(a->rn, a->rt),
+                              s->gcsstr_el);
+        return true;
+    }
+
+    if (a->rn == 31) {
+        gen_check_sp_alignment(s);
+    }
+    tcg_gen_qemu_st_i64(cpu_reg(s, a->rt),
+                        clean_data_tbi(s, cpu_reg_sp(s, a->rn)),
+                        core_gcs_mem_index(armidx),
+                        finalize_memop(s, MO_64 | MO_ALIGN));
+    return true;
+}
+
 static bool trans_LD_mult(DisasContext *s, arg_ldst_mult *a)
 {
     TCGv_i64 clean_addr, tcg_rn, tcg_ebytes;

From d383c43d6d510638adc69043a92572bec3840515 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:47 -0700
Subject: [PATCH 1231/2396] target/arm: Implement GCSB

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-48-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/a64.decode      | 1 +
 target/arm/tcg/translate-a64.c | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 2ae73f443a..01b1b3e38b 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -248,6 +248,7 @@ ERETA           1101011 0100 11111 00001 m:1 11111 11111 &reta  # ERETAA, ERETAB
     AUTIA1716   1101 0101 0000 0011 0010 0001 100 11111
     AUTIB1716   1101 0101 0000 0011 0010 0001 110 11111
     ESB         1101 0101 0000 0011 0010 0010 000 11111
+    GCSB        1101 0101 0000 0011 0010 0010 011 11111
     PACIAZ      1101 0101 0000 0011 0010 0011 000 11111
     PACIASP     1101 0101 0000 0011 0010 0011 001 11111
     PACIBZ      1101 0101 0000 0011 0010 0011 010 11111
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index b72aa968cd..38a1f51ed5 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2080,6 +2080,14 @@ static bool trans_ESB(DisasContext *s, arg_ESB *a)
     return true;
 }
 
+static bool trans_GCSB(DisasContext *s, arg_GCSB *a)
+{
+    if (dc_isar_feature(aa64_gcs, s)) {
+        tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
+    }
+    return true;
+}
+
 static bool trans_PACIAZ(DisasContext *s, arg_PACIAZ *a)
 {
     if (s->pauth_active) {

From 3afe6037e728f74be092027b4d24201a6ddc092f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:48 -0700
Subject: [PATCH 1232/2396] target/arm: Implement GCSPUSHM

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-49-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        | 15 +++++++++++++++
 target/arm/cpregs.h            |  3 +++
 target/arm/tcg/translate-a64.c | 29 +++++++++++++++++++++++++++++
 3 files changed, 47 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index 1ff041811d..cc5a0b86e4 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -43,6 +43,16 @@ static void gcspr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     raw_write(env, ri, value & ~7);
 }
 
+static CPAccessResult access_gcspushm(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    int el = arm_current_el(env);
+    if (!(env->cp15.gcscr_el[el] & GCSCR_PUSHMEN)) {
+        return CP_ACCESS_TRAP_BIT | (el ? el : 1);
+    }
+    return CP_ACCESS_OK;
+}
+
 static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSCRE0_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 2,
@@ -85,6 +95,11 @@ static const ARMCPRegInfo gcs_reginfo[] = {
       .opc0 = 3, .opc1 = 6, .crn = 2, .crm = 5, .opc2 = 1,
       .access = PL3_RW, .writefn = gcspr_write,
       .fieldoffset = offsetof(CPUARMState, cp15.gcspr_el[2]) },
+
+    { .name = "GCSPUSHM", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 0,
+      .access = PL0_W, .accessfn = access_gcspushm,
+      .fgt = FGT_NGCSPUSHM_EL1, .type = ARM_CP_GCSPUSHM },
 };
 
 void define_gcs_cpregs(ARMCPU *cpu)
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index a79f00351c..d22ae383cd 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -47,6 +47,8 @@ enum {
     ARM_CP_DC_ZVA                = 0x0005,
     ARM_CP_DC_GVA                = 0x0006,
     ARM_CP_DC_GZVA               = 0x0007,
+    /* Special: gcs instructions */
+    ARM_CP_GCSPUSHM              = 0x0008,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
@@ -871,6 +873,7 @@ typedef enum FGTBit {
     DO_BIT(HFGITR, DVPRCTX),
     DO_BIT(HFGITR, CPPRCTX),
     DO_BIT(HFGITR, DCCVAC),
+    DO_REV_BIT(HFGITR, NGCSPUSHM_EL1),
     DO_BIT(HFGITR, ATS1E1A),
 } FGTBit;
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 38a1f51ed5..625563d95b 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -26,6 +26,7 @@
 #include "cpregs.h"
 
 static TCGv_i64 cpu_X[32];
+static TCGv_i64 cpu_gcspr[4];
 static TCGv_i64 cpu_pc;
 
 /* Load/store exclusive handling */
@@ -77,6 +78,10 @@ static int scale_by_log2_tag_granule(DisasContext *s, int x)
 /* initialize TCG globals.  */
 void a64_translate_init(void)
 {
+    static const char gcspr_names[4][12] = {
+        "gcspr_el0", "gcspr_el1", "gcspr_el2", "gcspr_el3"
+    };
+
     int i;
 
     cpu_pc = tcg_global_mem_new_i64(tcg_env,
@@ -90,6 +95,13 @@ void a64_translate_init(void)
 
     cpu_exclusive_high = tcg_global_mem_new_i64(tcg_env,
         offsetof(CPUARMState, exclusive_high), "exclusive_high");
+
+    for (i = 0; i < 4; i++) {
+        cpu_gcspr[i] =
+            tcg_global_mem_new_i64(tcg_env,
+                                   offsetof(CPUARMState, cp15.gcspr_el[i]),
+                                   gcspr_names[i]);
+    }
 }
 
 /*
@@ -420,6 +432,18 @@ static MemOp check_ordered_align(DisasContext *s, int rn, int imm,
     return finalize_memop(s, mop);
 }
 
+static void gen_add_gcs_record(DisasContext *s, TCGv_i64 value)
+{
+    TCGv_i64 addr = tcg_temp_new_i64();
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+
+    tcg_gen_addi_i64(addr, gcspr, -8);
+    tcg_gen_qemu_st_i64(value, clean_data_tbi(s, addr), mmuidx, mop);
+    tcg_gen_mov_i64(gcspr, addr);
+}
+
 typedef struct DisasCompare64 {
     TCGCond cond;
     TCGv_i64 value;
@@ -2803,6 +2827,11 @@ static void handle_sys(DisasContext *s, bool isread,
             }
         }
         return;
+    case ARM_CP_GCSPUSHM:
+        if (s->gcs_en) {
+            gen_add_gcs_record(s, cpu_reg(s, rt));
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From 0982f58db61277ff3babf1ac36c5eaceaadcb598 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:49 -0700
Subject: [PATCH 1233/2396] target/arm: Implement GCSPOPM

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-50-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        |  3 +++
 target/arm/cpregs.h            |  1 +
 target/arm/tcg/translate-a64.c | 24 ++++++++++++++++++++++++
 3 files changed, 28 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index cc5a0b86e4..15d383b2a4 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -100,6 +100,9 @@ static const ARMCPRegInfo gcs_reginfo[] = {
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 0,
       .access = PL0_W, .accessfn = access_gcspushm,
       .fgt = FGT_NGCSPUSHM_EL1, .type = ARM_CP_GCSPUSHM },
+    { .name = "GCSPOPM", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 1,
+      .access = PL0_R, .type = ARM_CP_GCSPOPM },
 };
 
 void define_gcs_cpregs(ARMCPU *cpu)
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index d22ae383cd..81d8f0e32b 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -49,6 +49,7 @@ enum {
     ARM_CP_DC_GZVA               = 0x0007,
     /* Special: gcs instructions */
     ARM_CP_GCSPUSHM              = 0x0008,
+    ARM_CP_GCSPOPM               = 0x0009,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 625563d95b..7783273cc1 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2521,6 +2521,24 @@ static void gen_sysreg_undef(DisasContext *s, bool isread,
     gen_exception_insn(s, 0, EXCP_UDEF, syndrome);
 }
 
+static void gen_gcspopm(DisasContext *s, int rt)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 value = tcg_temp_new_i64();
+    TCGLabel *fail_label =
+        delay_exception(s, EXCP_UDEF, syn_gcs_data_check(GCS_IT_GCSPOPM, rt));
+
+    /* The value at top-of-stack must have low 2 bits clear. */
+    tcg_gen_qemu_ld_i64(value, clean_data_tbi(s, gcspr), mmuidx, mop);
+    tcg_gen_brcondi_i64(TCG_COND_TSTNE, value, 3, fail_label);
+
+    /* Complete the pop and return the value. */
+    tcg_gen_addi_i64(gcspr, gcspr, 8);
+    tcg_gen_mov_i64(cpu_reg(s, rt), value);
+}
+
 /*
  * Look up @key, returning the cpreg, which must exist.
  * Additionally, the new cpreg must also be accessible.
@@ -2832,6 +2850,12 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_add_gcs_record(s, cpu_reg(s, rt));
         }
         return;
+    case ARM_CP_GCSPOPM:
+        /* Note that X[rt] is unchanged if !GCSEnabled. */
+        if (s->gcs_en) {
+            gen_gcspopm(s, rt);
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From 6fb1678f90d028b0252699c66e99d6f6ff8127c8 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:50 -0700
Subject: [PATCH 1234/2396] target/arm: Implement GCSPUSHX

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-51-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        | 17 ++++++++++++++++
 target/arm/cpregs.h            |  2 ++
 target/arm/tcg/translate-a64.c | 37 ++++++++++++++++++++++++++++++++++
 3 files changed, 56 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index 15d383b2a4..e6c7025d02 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -53,6 +53,19 @@ static CPAccessResult access_gcspushm(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_gcspushx(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    /* Trap if lock taken, and enabled. */
+    if (!(env->pstate & PSTATE_EXLOCK)) {
+        int el = arm_current_el(env);
+        if (env->cp15.gcscr_el[el] & GCSCR_EXLOCKEN) {
+            return CP_ACCESS_EXLOCK;
+        }
+    }
+    return CP_ACCESS_OK;
+}
+
 static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSCRE0_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 2,
@@ -103,6 +116,10 @@ static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSPOPM", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 1,
       .access = PL0_R, .type = ARM_CP_GCSPOPM },
+    { .name = "GCSPUSHX", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 4,
+      .access = PL1_W, .accessfn = access_gcspushx, .fgt = FGT_NGCSEPP,
+      .type = ARM_CP_GCSPUSHX },
 };
 
 void define_gcs_cpregs(ARMCPU *cpu)
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 81d8f0e32b..909916b7fd 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -50,6 +50,7 @@ enum {
     /* Special: gcs instructions */
     ARM_CP_GCSPUSHM              = 0x0008,
     ARM_CP_GCSPOPM               = 0x0009,
+    ARM_CP_GCSPUSHX              = 0x000a,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
@@ -875,6 +876,7 @@ typedef enum FGTBit {
     DO_BIT(HFGITR, CPPRCTX),
     DO_BIT(HFGITR, DCCVAC),
     DO_REV_BIT(HFGITR, NGCSPUSHM_EL1),
+    DO_REV_BIT(HFGITR, NGCSEPP),
     DO_BIT(HFGITR, ATS1E1A),
 } FGTBit;
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 7783273cc1..0df1916d28 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2539,6 +2539,35 @@ static void gen_gcspopm(DisasContext *s, int rt)
     tcg_gen_mov_i64(cpu_reg(s, rt), value);
 }
 
+static void gen_gcspushx(DisasContext *s)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int spsr_idx = aarch64_banked_spsr_index(s->current_el);
+    int spsr_off = offsetof(CPUARMState, banked_spsr[spsr_idx]);
+    int elr_off = offsetof(CPUARMState, elr_el[s->current_el]);
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 addr = tcg_temp_new_i64();
+    TCGv_i64 tmp = tcg_temp_new_i64();
+
+    tcg_gen_addi_i64(addr, gcspr, -8);
+    tcg_gen_qemu_st_i64(cpu_reg(s, 30), addr, mmuidx, mop);
+
+    tcg_gen_ld_i64(tmp, tcg_env, spsr_off);
+    tcg_gen_addi_i64(addr, addr, -8);
+    tcg_gen_qemu_st_i64(tmp, addr, mmuidx, mop);
+
+    tcg_gen_ld_i64(tmp, tcg_env, elr_off);
+    tcg_gen_addi_i64(addr, addr, -8);
+    tcg_gen_qemu_st_i64(tmp, addr, mmuidx, mop);
+
+    tcg_gen_addi_i64(addr, addr, -8);
+    tcg_gen_qemu_st_i64(tcg_constant_i64(0b1001), addr, mmuidx, mop);
+
+    tcg_gen_mov_i64(gcspr, addr);
+    clear_pstate_bits(PSTATE_EXLOCK);
+}
+
 /*
  * Look up @key, returning the cpreg, which must exist.
  * Additionally, the new cpreg must also be accessible.
@@ -2856,6 +2885,14 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_gcspopm(s, rt);
         }
         return;
+    case ARM_CP_GCSPUSHX:
+        /* Choose the CONSTRAINED UNPREDICTABLE for UNDEF. */
+        if (rt != 31) {
+            unallocated_encoding(s);
+        } else if (s->gcs_en) {
+            gen_gcspushx(s);
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From 75c8d645b970ab083ce2ee06aa31c90028441983 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:51 -0700
Subject: [PATCH 1235/2396] target/arm: Implement GCSPOPX

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-52-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        |  3 +++
 target/arm/cpregs.h            |  1 +
 target/arm/tcg/translate-a64.c | 35 ++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index e6c7025d02..5b5b895a09 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -120,6 +120,9 @@ static const ARMCPRegInfo gcs_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 4,
       .access = PL1_W, .accessfn = access_gcspushx, .fgt = FGT_NGCSEPP,
       .type = ARM_CP_GCSPUSHX },
+    { .name = "GCSPOPX", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 6,
+      .access = PL1_W, .type = ARM_CP_GCSPOPX },
 };
 
 void define_gcs_cpregs(ARMCPU *cpu)
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 909916b7fd..ccf45fd136 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -51,6 +51,7 @@ enum {
     ARM_CP_GCSPUSHM              = 0x0008,
     ARM_CP_GCSPOPM               = 0x0009,
     ARM_CP_GCSPUSHX              = 0x000a,
+    ARM_CP_GCSPOPX               = 0x000b,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 0df1916d28..72b912a605 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2568,6 +2568,33 @@ static void gen_gcspushx(DisasContext *s)
     clear_pstate_bits(PSTATE_EXLOCK);
 }
 
+static void gen_gcspopx(DisasContext *s)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 addr = tcg_temp_new_i64();
+    TCGv_i64 tmp = tcg_temp_new_i64();
+    TCGLabel *fail_label =
+        delay_exception(s, EXCP_UDEF, syn_gcs_data_check(GCS_IT_GCSPOPX, 31));
+
+    /* The value at top-of-stack must be an exception token. */
+    tcg_gen_qemu_ld_i64(tmp, gcspr, mmuidx, mop);
+    tcg_gen_brcondi_i64(TCG_COND_NE, tmp, 0b1001, fail_label);
+
+    /*
+     * The other three values in the exception return record
+     * are ignored, but are loaded anyway to raise faults.
+     */
+    tcg_gen_addi_i64(addr, gcspr, 8);
+    tcg_gen_qemu_ld_i64(tmp, addr, mmuidx, mop);
+    tcg_gen_addi_i64(addr, addr, 8);
+    tcg_gen_qemu_ld_i64(tmp, addr, mmuidx, mop);
+    tcg_gen_addi_i64(addr, addr, 8);
+    tcg_gen_qemu_ld_i64(tmp, addr, mmuidx, mop);
+    tcg_gen_addi_i64(gcspr, addr, 8);
+}
+
 /*
  * Look up @key, returning the cpreg, which must exist.
  * Additionally, the new cpreg must also be accessible.
@@ -2893,6 +2920,14 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_gcspushx(s);
         }
         return;
+    case ARM_CP_GCSPOPX:
+        /* Choose the CONSTRAINED UNPREDICTABLE for UNDEF. */
+        if (rt != 31) {
+            unallocated_encoding(s);
+        } else if (s->gcs_en) {
+            gen_gcspopx(s);
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From a94b6aab8e522825b745dfedc4f4b641d7f22be0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:52 -0700
Subject: [PATCH 1236/2396] target/arm: Implement GCSPOPCX

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-53-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        | 17 +++++++++++
 target/arm/cpregs.h            |  1 +
 target/arm/tcg/translate-a64.c | 56 ++++++++++++++++++++++++++++++++++
 3 files changed, 74 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index 5b5b895a09..3795bf7f36 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -66,6 +66,19 @@ static CPAccessResult access_gcspushx(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_gcspopcx(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    /* Trap if lock not taken, and enabled. */
+    if (env->pstate & PSTATE_EXLOCK) {
+        int el = arm_current_el(env);
+        if (env->cp15.gcscr_el[el] & GCSCR_EXLOCKEN) {
+            return CP_ACCESS_EXLOCK;
+        }
+    }
+    return CP_ACCESS_OK;
+}
+
 static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSCRE0_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 0, .crn = 2, .crm = 5, .opc2 = 2,
@@ -120,6 +133,10 @@ static const ARMCPRegInfo gcs_reginfo[] = {
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 4,
       .access = PL1_W, .accessfn = access_gcspushx, .fgt = FGT_NGCSEPP,
       .type = ARM_CP_GCSPUSHX },
+    { .name = "GCSPOPCX", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 5,
+      .access = PL1_W, .accessfn = access_gcspopcx, .fgt = FGT_NGCSEPP,
+      .type = ARM_CP_GCSPOPCX },
     { .name = "GCSPOPX", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 6,
       .access = PL1_W, .type = ARM_CP_GCSPOPX },
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index ccf45fd136..6d9145109f 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -52,6 +52,7 @@ enum {
     ARM_CP_GCSPOPM               = 0x0009,
     ARM_CP_GCSPUSHX              = 0x000a,
     ARM_CP_GCSPOPX               = 0x000b,
+    ARM_CP_GCSPOPCX              = 0x000c,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 72b912a605..bb8ffba586 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2568,6 +2568,54 @@ static void gen_gcspushx(DisasContext *s)
     clear_pstate_bits(PSTATE_EXLOCK);
 }
 
+static void gen_gcspopcx(DisasContext *s)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int spsr_idx = aarch64_banked_spsr_index(s->current_el);
+    int spsr_off = offsetof(CPUARMState, banked_spsr[spsr_idx]);
+    int elr_off = offsetof(CPUARMState, elr_el[s->current_el]);
+    int gcscr_off = offsetof(CPUARMState, cp15.gcscr_el[s->current_el]);
+    int pstate_off = offsetof(CPUARMState, pstate);
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 addr = tcg_temp_new_i64();
+    TCGv_i64 tmp1 = tcg_temp_new_i64();
+    TCGv_i64 tmp2 = tcg_temp_new_i64();
+    TCGLabel *fail_label =
+        delay_exception(s, EXCP_UDEF, syn_gcs_data_check(GCS_IT_GCSPOPCX, 31));
+
+    /* The value at top-of-stack must be an exception token. */
+    tcg_gen_qemu_ld_i64(tmp1, gcspr, mmuidx, mop);
+    tcg_gen_brcondi_i64(TCG_COND_NE, tmp1, 0b1001, fail_label);
+
+    /* Validate in turn, ELR ... */
+    tcg_gen_addi_i64(addr, gcspr, 8);
+    tcg_gen_qemu_ld_i64(tmp1, addr, mmuidx, mop);
+    tcg_gen_ld_i64(tmp2, tcg_env, elr_off);
+    tcg_gen_brcond_i64(TCG_COND_NE, tmp1, tmp2, fail_label);
+
+    /* ... SPSR ... */
+    tcg_gen_addi_i64(addr, addr, 8);
+    tcg_gen_qemu_ld_i64(tmp1, addr, mmuidx, mop);
+    tcg_gen_ld_i64(tmp2, tcg_env, spsr_off);
+    tcg_gen_brcond_i64(TCG_COND_NE, tmp1, tmp2, fail_label);
+
+    /* ... and LR. */
+    tcg_gen_addi_i64(addr, addr, 8);
+    tcg_gen_qemu_ld_i64(tmp1, addr, mmuidx, mop);
+    tcg_gen_brcond_i64(TCG_COND_NE, tmp1, cpu_reg(s, 30), fail_label);
+
+    /* Writeback stack pointer after pop. */
+    tcg_gen_addi_i64(gcspr, addr, 8);
+
+    /* PSTATE.EXLOCK = GetCurrentEXLOCKEN(). */
+    tcg_gen_ld_i64(tmp1, tcg_env, gcscr_off);
+    tcg_gen_ld_i64(tmp2, tcg_env, pstate_off);
+    tcg_gen_shri_i64(tmp1, tmp1, ctz64(GCSCR_EXLOCKEN));
+    tcg_gen_deposit_i64(tmp2, tmp2, tmp1, ctz64(PSTATE_EXLOCK), 1);
+    tcg_gen_st_i64(tmp2, tcg_env, pstate_off);
+}
+
 static void gen_gcspopx(DisasContext *s)
 {
     TCGv_i64 gcspr = cpu_gcspr[s->current_el];
@@ -2920,6 +2968,14 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_gcspushx(s);
         }
         return;
+    case ARM_CP_GCSPOPCX:
+        /* Choose the CONSTRAINED UNPREDICTABLE for UNDEF. */
+        if (rt != 31) {
+            unallocated_encoding(s);
+        } else if (s->gcs_en) {
+            gen_gcspopcx(s);
+        }
+        return;
     case ARM_CP_GCSPOPX:
         /* Choose the CONSTRAINED UNPREDICTABLE for UNDEF. */
         if (rt != 31) {

From 22d20e38044bdebd217ad0339d3765933ef16143 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:53 -0700
Subject: [PATCH 1237/2396] target/arm: Implement GCSSS1

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-54-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        |  3 +++
 target/arm/cpregs.h            |  1 +
 target/arm/tcg/translate-a64.c | 30 ++++++++++++++++++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index 3795bf7f36..eda5c498d7 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -129,6 +129,9 @@ static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSPOPM", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 1,
       .access = PL0_R, .type = ARM_CP_GCSPOPM },
+    { .name = "GCSSS1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 2,
+      .access = PL0_W, .type = ARM_CP_GCSSS1 },
     { .name = "GCSPUSHX", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 4,
       .access = PL1_W, .accessfn = access_gcspushx, .fgt = FGT_NGCSEPP,
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 6d9145109f..e7e7050880 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -53,6 +53,7 @@ enum {
     ARM_CP_GCSPUSHX              = 0x000a,
     ARM_CP_GCSPOPX               = 0x000b,
     ARM_CP_GCSPOPCX              = 0x000c,
+    ARM_CP_GCSSS1                = 0x000d,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index bb8ffba586..82ddf4e1dc 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2643,6 +2643,31 @@ static void gen_gcspopx(DisasContext *s)
     tcg_gen_addi_i64(gcspr, addr, 8);
 }
 
+static void gen_gcsss1(DisasContext *s, int rt)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 inptr = cpu_reg(s, rt);
+    TCGv_i64 cmp = tcg_temp_new_i64();
+    TCGv_i64 new = tcg_temp_new_i64();
+    TCGv_i64 old = tcg_temp_new_i64();
+    TCGLabel *fail_label =
+        delay_exception(s, EXCP_UDEF, syn_gcs_data_check(GCS_IT_GCSSS1, rt));
+
+    /* Compute the valid cap entry that the new stack must have. */
+    tcg_gen_deposit_i64(cmp, inptr, tcg_constant_i64(1), 0, 12);
+    /* Compute the in-progress cap entry for the old stack. */
+    tcg_gen_deposit_i64(new, gcspr, tcg_constant_i64(5), 0, 3);
+
+    /* Swap the valid cap the with the in-progress cap. */
+    tcg_gen_atomic_cmpxchg_i64(old, inptr, cmp, new, mmuidx, mop);
+    tcg_gen_brcond_i64(TCG_COND_NE, old, cmp, fail_label);
+
+    /* The new stack had a valid cap: change gcspr. */
+    tcg_gen_andi_i64(gcspr, inptr, ~7);
+}
+
 /*
  * Look up @key, returning the cpreg, which must exist.
  * Additionally, the new cpreg must also be accessible.
@@ -2984,6 +3009,11 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_gcspopx(s);
         }
         return;
+    case ARM_CP_GCSSS1:
+        if (s->gcs_en) {
+            gen_gcsss1(s, rt);
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From e85fc2c62321201222d3e30191f376760978ccca Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:54 -0700
Subject: [PATCH 1238/2396] target/arm: Implement GCSSS2

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-55-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs-gcs.c        |  3 +++
 target/arm/cpregs.h            |  1 +
 target/arm/tcg/translate-a64.c | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 38 insertions(+)

diff --git a/target/arm/cpregs-gcs.c b/target/arm/cpregs-gcs.c
index eda5c498d7..1ed52a211a 100644
--- a/target/arm/cpregs-gcs.c
+++ b/target/arm/cpregs-gcs.c
@@ -132,6 +132,9 @@ static const ARMCPRegInfo gcs_reginfo[] = {
     { .name = "GCSSS1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 2,
       .access = PL0_W, .type = ARM_CP_GCSSS1 },
+    { .name = "GCSSS2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 3, .crn = 7, .crm = 7, .opc2 = 3,
+      .access = PL0_R, .type = ARM_CP_GCSSS2 },
     { .name = "GCSPUSHX", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 7, .crm = 7, .opc2 = 4,
       .access = PL1_W, .accessfn = access_gcspushx, .fgt = FGT_NGCSEPP,
diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index e7e7050880..732c07506d 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -54,6 +54,7 @@ enum {
     ARM_CP_GCSPOPX               = 0x000b,
     ARM_CP_GCSPOPCX              = 0x000c,
     ARM_CP_GCSSS1                = 0x000d,
+    ARM_CP_GCSSS2                = 0x000e,
 
     /* Flag: reads produce resetvalue; writes ignored. */
     ARM_CP_CONST                 = 1 << 4,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 82ddf4e1dc..d58257be40 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -2668,6 +2668,35 @@ static void gen_gcsss1(DisasContext *s, int rt)
     tcg_gen_andi_i64(gcspr, inptr, ~7);
 }
 
+static void gen_gcsss2(DisasContext *s, int rt)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 outptr = tcg_temp_new_i64();
+    TCGv_i64 tmp = tcg_temp_new_i64();
+    TCGLabel *fail_label =
+        delay_exception(s, EXCP_UDEF, syn_gcs_data_check(GCS_IT_GCSSS2, rt));
+
+    /* Validate that the new stack has an in-progress cap. */
+    tcg_gen_qemu_ld_i64(outptr, gcspr, mmuidx, mop);
+    tcg_gen_andi_i64(tmp, outptr, 7);
+    tcg_gen_brcondi_i64(TCG_COND_NE, tmp, 5, fail_label);
+
+    /* Push a valid cap to the old stack. */
+    tcg_gen_andi_i64(outptr, outptr, ~7);
+    tcg_gen_addi_i64(outptr, outptr, -8);
+    tcg_gen_deposit_i64(tmp, outptr, tcg_constant_i64(1), 0, 12);
+    tcg_gen_qemu_st_i64(tmp, outptr, mmuidx, mop);
+    tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
+
+    /* Pop the in-progress cap from the new stack. */
+    tcg_gen_addi_i64(gcspr, gcspr, 8);
+
+    /* Return a pointer to the old stack cap. */
+    tcg_gen_mov_i64(cpu_reg(s, rt), outptr);
+}
+
 /*
  * Look up @key, returning the cpreg, which must exist.
  * Additionally, the new cpreg must also be accessible.
@@ -3014,6 +3043,11 @@ static void handle_sys(DisasContext *s, bool isread,
             gen_gcsss1(s, rt);
         }
         return;
+    case ARM_CP_GCSSS2:
+        if (s->gcs_en) {
+            gen_gcsss2(s, rt);
+        }
+        return;
     default:
         g_assert_not_reached();
     }

From a664ba1fc65ee84c9353cb2f0d2187f580b8e6bb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:55 -0700
Subject: [PATCH 1239/2396] target/arm: Add gcs record for BL

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-56-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index d58257be40..9a564339fa 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1678,7 +1678,14 @@ static bool trans_B(DisasContext *s, arg_i *a)
 
 static bool trans_BL(DisasContext *s, arg_i *a)
 {
-    gen_pc_plus_diff(s, cpu_reg(s, 30), curr_insn_len(s));
+    TCGv_i64 link = tcg_temp_new_i64();
+
+    gen_pc_plus_diff(s, link, 4);
+    if (s->gcs_en) {
+        gen_add_gcs_record(s, link);
+    }
+    tcg_gen_mov_i64(cpu_reg(s, 30), link);
+
     reset_btype(s);
     gen_goto_tb(s, 0, a->imm);
     return true;

From 978bad65f84aa4780ed586ef588ddb68a5d0532f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:56 -0700
Subject: [PATCH 1240/2396] target/arm: Add gcs record for BLR

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-57-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 9a564339fa..fcfa4223f5 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1782,15 +1782,15 @@ static bool trans_BR(DisasContext *s, arg_r *a)
 
 static bool trans_BLR(DisasContext *s, arg_r *a)
 {
-    TCGv_i64 dst = cpu_reg(s, a->rn);
-    TCGv_i64 lr = cpu_reg(s, 30);
-    if (dst == lr) {
-        TCGv_i64 tmp = tcg_temp_new_i64();
-        tcg_gen_mov_i64(tmp, dst);
-        dst = tmp;
+    TCGv_i64 link = tcg_temp_new_i64();
+
+    gen_pc_plus_diff(s, link, 4);
+    if (s->gcs_en) {
+        gen_add_gcs_record(s, link);
     }
-    gen_pc_plus_diff(s, lr, curr_insn_len(s));
-    gen_a64_set_pc(s, dst);
+    gen_a64_set_pc(s, cpu_reg(s, a->rn));
+    tcg_gen_mov_i64(cpu_reg(s, 30), link);
+
     set_btype_for_blr(s);
     s->base.is_jmp = DISAS_JUMP;
     return true;

From d28bb06dc8ad5667c26d00765c442ca9cf7f1aa1 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:57 -0700
Subject: [PATCH 1241/2396] target/arm: Add gcs record for BLR with PAuth

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-58-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 31 ++++++++++++++++---------------
 1 file changed, 16 insertions(+), 15 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index fcfa4223f5..9c3de0cf71 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1842,21 +1842,21 @@ static bool trans_BRAZ(DisasContext *s, arg_braz *a)
 
 static bool trans_BLRAZ(DisasContext *s, arg_braz *a)
 {
-    TCGv_i64 dst, lr;
+    TCGv_i64 dst, link;
 
     if (!dc_isar_feature(aa64_pauth, s)) {
         return false;
     }
-
     dst = auth_branch_target(s, cpu_reg(s, a->rn), tcg_constant_i64(0), !a->m);
-    lr = cpu_reg(s, 30);
-    if (dst == lr) {
-        TCGv_i64 tmp = tcg_temp_new_i64();
-        tcg_gen_mov_i64(tmp, dst);
-        dst = tmp;
+
+    link = tcg_temp_new_i64();
+    gen_pc_plus_diff(s, link, 4);
+    if (s->gcs_en) {
+        gen_add_gcs_record(s, link);
     }
-    gen_pc_plus_diff(s, lr, curr_insn_len(s));
     gen_a64_set_pc(s, dst);
+    tcg_gen_mov_i64(cpu_reg(s, 30), link);
+
     set_btype_for_blr(s);
     s->base.is_jmp = DISAS_JUMP;
     return true;
@@ -1892,20 +1892,21 @@ static bool trans_BRA(DisasContext *s, arg_bra *a)
 
 static bool trans_BLRA(DisasContext *s, arg_bra *a)
 {
-    TCGv_i64 dst, lr;
+    TCGv_i64 dst, link;
 
     if (!dc_isar_feature(aa64_pauth, s)) {
         return false;
     }
     dst = auth_branch_target(s, cpu_reg(s, a->rn), cpu_reg_sp(s, a->rm), !a->m);
-    lr = cpu_reg(s, 30);
-    if (dst == lr) {
-        TCGv_i64 tmp = tcg_temp_new_i64();
-        tcg_gen_mov_i64(tmp, dst);
-        dst = tmp;
+
+    link = tcg_temp_new_i64();
+    gen_pc_plus_diff(s, link, 4);
+    if (s->gcs_en) {
+        gen_add_gcs_record(s, link);
     }
-    gen_pc_plus_diff(s, lr, curr_insn_len(s));
     gen_a64_set_pc(s, dst);
+    tcg_gen_mov_i64(cpu_reg(s, 30), link);
+
     set_btype_for_blr(s);
     s->base.is_jmp = DISAS_JUMP;
     return true;

From 488fab6fc9470515309ca405ece3c8ae4bf8c37c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:58 -0700
Subject: [PATCH 1242/2396] target/arm: Load gcs record for RET

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-59-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 29 ++++++++++++++++++++++++++++-
 1 file changed, 28 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 9c3de0cf71..dfd5b17831 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -444,6 +444,27 @@ static void gen_add_gcs_record(DisasContext *s, TCGv_i64 value)
     tcg_gen_mov_i64(gcspr, addr);
 }
 
+static void gen_load_check_gcs_record(DisasContext *s, TCGv_i64 target,
+                                      GCSInstructionType it, int rt)
+{
+    TCGv_i64 gcspr = cpu_gcspr[s->current_el];
+    int mmuidx = core_gcs_mem_index(s->mmu_idx);
+    MemOp mop = finalize_memop(s, MO_64 | MO_ALIGN);
+    TCGv_i64 rec_va = tcg_temp_new_i64();
+
+    tcg_gen_qemu_ld_i64(rec_va, clean_data_tbi(s, gcspr), mmuidx, mop);
+
+    if (s->gcs_rvcen) {
+        TCGLabel *fail_label =
+            delay_exception(s, EXCP_UDEF, syn_gcs_data_check(it, rt));
+
+        tcg_gen_brcond_i64(TCG_COND_NE, rec_va, target, fail_label);
+    }
+
+    gen_a64_set_pc(s, rec_va);
+    tcg_gen_addi_i64(gcspr, gcspr, 8);
+}
+
 typedef struct DisasCompare64 {
     TCGCond cond;
     TCGv_i64 value;
@@ -1798,7 +1819,13 @@ static bool trans_BLR(DisasContext *s, arg_r *a)
 
 static bool trans_RET(DisasContext *s, arg_r *a)
 {
-    gen_a64_set_pc(s, cpu_reg(s, a->rn));
+    TCGv_i64 target = cpu_reg(s, a->rn);
+
+    if (s->gcs_en) {
+        gen_load_check_gcs_record(s, target, GCS_IT_RET_nPauth, a->rn);
+    } else {
+        gen_a64_set_pc(s, target);
+    }
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }

From 3d366bb67ff2eab40052bc09983328b06c394e12 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:55:59 -0700
Subject: [PATCH 1243/2396] target/arm: Load gcs record for RET with PAuth

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-60-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index dfd5b17831..918d5ed112 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1898,7 +1898,12 @@ static bool trans_RETA(DisasContext *s, arg_reta *a)
     }
 
     dst = auth_branch_target(s, cpu_reg(s, 30), cpu_X[31], !a->m);
-    gen_a64_set_pc(s, dst);
+    if (s->gcs_en) {
+        GCSInstructionType it = a->m ? GCS_IT_RET_PauthB : GCS_IT_RET_PauthA;
+        gen_load_check_gcs_record(s, dst, it, 30);
+    } else {
+        gen_a64_set_pc(s, dst);
+    }
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }

From d77ed960164490d4daeaa3e1a3532ea53477538a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:00 -0700
Subject: [PATCH 1244/2396] target/arm: Copy EXLOCKEn to EXLOCK on exception to
 the same EL

Per R_WTXBY, PSTATE.EXLOCK is 0 on an exception to a higher EL,
and copied from EXLOCKEn otherwise.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-61-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 1aa0a157b7..0077788e1e 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -9071,8 +9071,13 @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
         } else {
             addr += 0x600;
         }
-    } else if (pstate_read(env) & PSTATE_SP) {
-        addr += 0x200;
+    } else {
+        if (pstate_read(env) & PSTATE_SP) {
+            addr += 0x200;
+        }
+        if (is_a64(env) && (env->cp15.gcscr_el[new_el] & GCSCR_EXLOCKEN)) {
+            new_mode |= PSTATE_EXLOCK;
+        }
     }
 
     switch (cs->exception_index) {

From 70440a58589baa9d77428573f146a0ceaa5aa3ef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:01 -0700
Subject: [PATCH 1245/2396] target/arm: Implement EXLOCK check during exception
 return

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-62-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/helper-a64.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index 08b7db7c46..ba1d775d81 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -675,6 +675,17 @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         goto illegal_return;
     }
 
+    /*
+     * If GetCurrentEXLOCKEN, the exception return path must use GCSPOPCX,
+     * which will set PSTATE.EXLOCK.  We need not explicitly check FEAT_GCS,
+     * because GCSCR_ELx cannot be set without it.
+     */
+    if (new_el == cur_el &&
+        (env->cp15.gcscr_el[cur_el] & GCSCR_EXLOCKEN) &&
+        !(env->pstate & PSTATE_EXLOCK)) {
+        goto illegal_return;
+    }
+
     bql_lock();
     arm_call_pre_el_change_hook(cpu);
     bql_unlock();

From 9c5dfe8b568b1b5265044f9f1dbc57345656e342 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:02 -0700
Subject: [PATCH 1246/2396] target/arm: Enable FEAT_GCS with -cpu max
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Tested-by: Thiago Jung Bauermann <thiago.bauermann@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251008215613.300150-63-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 68d9a4e734..4496178c48 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -73,6 +73,7 @@ the following architecture extensions:
 - FEAT_FRINTTS (Floating-point to integer instructions)
 - FEAT_FlagM (Flag manipulation instructions v2)
 - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
+- FEAT_GCS (Guarded Control Stack Extension)
 - FEAT_GTG (Guest translation granule size)
 - FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
 - FEAT_HBC (Hinted conditional branches)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index f024db1d29..cc42dfdf56 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1280,6 +1280,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64PFR1, SME, 2);       /* FEAT_SME2 */
     t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_3 */
     t = FIELD_DP64(t, ID_AA64PFR1, NMI, 1);       /* FEAT_NMI */
+    t = FIELD_DP64(t, ID_AA64PFR1, GCS, 1);       /* FEAT_GCS */
     SET_IDREG(isar, ID_AA64PFR1, t);
 
     t = GET_IDREG(isar, ID_AA64MMFR0);

From d0e16dcad9b7a95367be91ddd2e74779c47ebf8a Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:03 -0700
Subject: [PATCH 1247/2396] linux-user/aarch64: Implement prctls for GCS

This is PR_GET_SHADOW_STACK_STATUS, PR_SET_SHADOW_STACK_STATUS,
and PR_LOCK_SHADOW_STACK_STATUS.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-64-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/gcs-internal.h | 38 ++++++++++++
 linux-user/aarch64/target_prctl.h | 96 +++++++++++++++++++++++++++++++
 linux-user/qemu.h                 |  5 ++
 linux-user/syscall.c              | 29 ++++++++++
 4 files changed, 168 insertions(+)
 create mode 100644 linux-user/aarch64/gcs-internal.h

diff --git a/linux-user/aarch64/gcs-internal.h b/linux-user/aarch64/gcs-internal.h
new file mode 100644
index 0000000000..e586c7e80e
--- /dev/null
+++ b/linux-user/aarch64/gcs-internal.h
@@ -0,0 +1,38 @@
+/*
+ * AArch64 gcs functions for linux-user
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef AARCH64_GCS_INTERNAL_H
+#define AARCH64_GCS_INTERNAL_H
+
+#ifndef PR_SHADOW_STACK_ENABLE
+# define PR_SHADOW_STACK_ENABLE  (1U << 0)
+# define PR_SHADOW_STACK_WRITE   (1U << 1)
+# define PR_SHADOW_STACK_PUSH    (1U << 2)
+#endif
+
+static inline uint64_t gcs_get_el0_mode(CPUArchState *env)
+{
+    uint64_t cr = env->cp15.gcscr_el[0];
+    abi_ulong flags = 0;
+
+    flags |= cr & GCSCR_PCRSEL ? PR_SHADOW_STACK_ENABLE : 0;
+    flags |= cr & GCSCR_STREN ? PR_SHADOW_STACK_WRITE : 0;
+    flags |= cr & GCSCR_PUSHMEN ? PR_SHADOW_STACK_PUSH : 0;
+
+    return flags;
+}
+
+static inline void gcs_set_el0_mode(CPUArchState *env, uint64_t flags)
+{
+    uint64_t cr = GCSCRE0_NTR;
+
+    cr |= flags & PR_SHADOW_STACK_ENABLE ? GCSCR_RVCHKEN | GCSCR_PCRSEL : 0;
+    cr |= flags & PR_SHADOW_STACK_WRITE ? GCSCR_STREN : 0;
+    cr |= flags & PR_SHADOW_STACK_PUSH ? GCSCR_PUSHMEN : 0;
+
+    env->cp15.gcscr_el[0] = cr;
+}
+
+#endif
diff --git a/linux-user/aarch64/target_prctl.h b/linux-user/aarch64/target_prctl.h
index ed75b9e4b5..621be5727f 100644
--- a/linux-user/aarch64/target_prctl.h
+++ b/linux-user/aarch64/target_prctl.h
@@ -6,8 +6,10 @@
 #ifndef AARCH64_TARGET_PRCTL_H
 #define AARCH64_TARGET_PRCTL_H
 
+#include "qemu/units.h"
 #include "target/arm/cpu-features.h"
 #include "mte_user_helper.h"
+#include "gcs-internal.h"
 
 static abi_long do_prctl_sve_get_vl(CPUArchState *env)
 {
@@ -206,4 +208,98 @@ static abi_long do_prctl_get_tagged_addr_ctrl(CPUArchState *env)
 }
 #define do_prctl_get_tagged_addr_ctrl do_prctl_get_tagged_addr_ctrl
 
+static abi_long do_prctl_get_shadow_stack_status(CPUArchState *env,
+                                                 abi_long arg2)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    if (!cpu_isar_feature(aa64_gcs, cpu)) {
+        return -TARGET_EINVAL;
+    }
+    return put_user_ual(gcs_get_el0_mode(env), arg2);
+}
+#define do_prctl_get_shadow_stack_status do_prctl_get_shadow_stack_status
+
+static abi_long gcs_alloc(abi_ulong hint, abi_ulong size)
+{
+    /*
+     * Without softmmu, we cannot protect GCS memory properly.
+     * Make do with normal read/write permissions.  This at least allows
+     * emulation of correct programs which don't access the gcs stack
+     * with normal instructions.
+     */
+    return target_mmap(hint, size, PROT_READ | PROT_WRITE,
+                       MAP_PRIVATE | MAP_ANONYMOUS |
+                       (hint ? MAP_FIXED_NOREPLACE : 0), -1, 0);
+}
+
+static abi_ulong gcs_new_stack(TaskState *ts)
+{
+    /* Use guest_stack_size as a proxy for RLIMIT_STACK. */
+    abi_ulong size = MIN(MAX(guest_stack_size / 2, TARGET_PAGE_SIZE), 2 * GiB);
+    abi_ulong base = gcs_alloc(0, size);
+
+    if (base == -1) {
+        return -1;
+    }
+
+    ts->gcs_base = base;
+    ts->gcs_size = size;
+    return base + size - 8;
+}
+
+static abi_long do_prctl_set_shadow_stack_status(CPUArchState *env,
+                                                 abi_long new_mode)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    TaskState *ts = get_task_state(env_cpu(env));
+    abi_long cur_mode;
+
+    if (!cpu_isar_feature(aa64_gcs, cpu)) {
+        return -TARGET_EINVAL;
+    }
+    if (new_mode & ~(PR_SHADOW_STACK_ENABLE |
+                     PR_SHADOW_STACK_WRITE |
+                     PR_SHADOW_STACK_PUSH)) {
+        return -TARGET_EINVAL;
+    }
+
+    cur_mode = gcs_get_el0_mode(env);
+    if ((new_mode ^ cur_mode) & ts->gcs_el0_locked) {
+        return -TARGET_EBUSY;
+    }
+
+    if (new_mode & ~cur_mode & PR_SHADOW_STACK_ENABLE) {
+        abi_long gcspr;
+
+        if (ts->gcs_base || env->cp15.gcspr_el[0]) {
+            return -EINVAL;
+        }
+        gcspr = gcs_new_stack(ts);
+        if (gcspr == -1) {
+            return -TARGET_ENOMEM;
+        }
+        env->cp15.gcspr_el[0] = gcspr;
+    }
+
+    gcs_set_el0_mode(env, new_mode);
+    arm_rebuild_hflags(env);
+    return 0;
+}
+#define do_prctl_set_shadow_stack_status do_prctl_set_shadow_stack_status
+
+static abi_long do_prctl_lock_shadow_stack_status(CPUArchState *env,
+                                                  abi_long arg2)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    TaskState *ts = get_task_state(env_cpu(env));
+
+    if (!cpu_isar_feature(aa64_gcs, cpu)) {
+        return -EINVAL;
+    }
+    ts->gcs_el0_locked |= arg2;
+    return 0;
+}
+#define do_prctl_lock_shadow_stack_status do_prctl_lock_shadow_stack_status
+
 #endif /* AARCH64_TARGET_PRCTL_H */
diff --git a/linux-user/qemu.h b/linux-user/qemu.h
index cabb7bd6a8..85e68eff7b 100644
--- a/linux-user/qemu.h
+++ b/linux-user/qemu.h
@@ -121,6 +121,11 @@ struct TaskState {
     abi_ulong child_tidptr;
 #ifdef TARGET_M68K
     abi_ulong tp_value;
+#endif
+#if defined(TARGET_AARCH64)
+    vaddr gcs_base;
+    abi_ulong gcs_size;
+    abi_ulong gcs_el0_locked;
 #endif
     int used; /* non zero if used */
     struct image_info *info;
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index d78b2029fa..56695de680 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6353,6 +6353,11 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
 # define PR_SME_VL_LEN_MASK  0xffff
 # define PR_SME_VL_INHERIT   (1 << 17)
 #endif
+#ifndef PR_GET_SHADOW_STACK_STATUS
+# define PR_GET_SHADOW_STACK_STATUS  74
+# define PR_SET_SHADOW_STACK_STATUS  75
+# define PR_LOCK_SHADOW_STACK_STATUS 76
+#endif
 
 #include "target_prctl.h"
 
@@ -6399,6 +6404,15 @@ static abi_long do_prctl_inval1(CPUArchState *env, abi_long arg2)
 #ifndef do_prctl_sme_set_vl
 #define do_prctl_sme_set_vl do_prctl_inval1
 #endif
+#ifndef do_prctl_get_shadow_stack_status
+#define do_prctl_get_shadow_stack_status do_prctl_inval1
+#endif
+#ifndef do_prctl_set_shadow_stack_status
+#define do_prctl_set_shadow_stack_status do_prctl_inval1
+#endif
+#ifndef do_prctl_lock_shadow_stack_status
+#define do_prctl_lock_shadow_stack_status do_prctl_inval1
+#endif
 
 static abi_long do_prctl_syscall_user_dispatch(CPUArchState *env,
                                                abi_ulong arg2, abi_ulong arg3,
@@ -6499,6 +6513,21 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
             return -TARGET_EINVAL;
         }
         return do_prctl_get_tagged_addr_ctrl(env);
+    case PR_GET_SHADOW_STACK_STATUS:
+        if (arg3 || arg4 || arg5) {
+            return -TARGET_EINVAL;
+        }
+        return do_prctl_get_shadow_stack_status(env, arg2);
+    case PR_SET_SHADOW_STACK_STATUS:
+        if (arg3 || arg4 || arg5) {
+            return -TARGET_EINVAL;
+        }
+        return do_prctl_set_shadow_stack_status(env, arg2);
+    case PR_LOCK_SHADOW_STACK_STATUS:
+        if (arg3 || arg4 || arg5) {
+            return -TARGET_EINVAL;
+        }
+        return do_prctl_lock_shadow_stack_status(env, arg2);
 
     case PR_GET_UNALIGN:
         return do_prctl_get_unalign(env, arg2);

From f57359b3f0c85482c35f6668b0815c350ff5d451 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:04 -0700
Subject: [PATCH 1248/2396] linux-user/aarch64: Allocate new gcs stack on clone

Allocate the new stack early, so that error reporting need
not clean up other objects.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-65-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/syscall.c | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 56695de680..dffe6c2016 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6686,6 +6686,21 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
         ts = g_new0(TaskState, 1);
         init_task_state(ts);
 
+#ifdef TARGET_AARCH64
+        /*
+         * If GCS is enabled in the parent thread, it is also enabled
+         * in the child thread, but with a newly allocated stack.
+         */
+        abi_long new_gcspr = 0;
+        if (env->cp15.gcscr_el[0] & GCSCR_PCRSEL) {
+            new_gcspr = gcs_new_stack(ts);
+            if (new_gcspr == -1) {
+                g_free(ts);
+                return -TARGET_ENOMEM;
+            }
+        }
+#endif
+
         /* Grab a mutex so that thread setup appears atomic.  */
         pthread_mutex_lock(&clone_lock);
 
@@ -6707,6 +6722,11 @@ static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
         ts->info = parent_ts->info;
         ts->signal_mask = parent_ts->signal_mask;
 
+#ifdef TARGET_AARCH64
+        ts->gcs_el0_locked = parent_ts->gcs_el0_locked;
+        new_env->cp15.gcspr_el[0] = new_gcspr;
+#endif
+
         if (flags & CLONE_CHILD_CLEARTID) {
             ts->child_tidptr = child_tidptr;
         }

From 1c9448037758277eb3dae71f98be3bbfdc91f467 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:05 -0700
Subject: [PATCH 1249/2396] linux-user/aarch64: Release gcs stack on thread
 exit

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-66-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/syscall.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index dffe6c2016..47a6b58cf5 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -9429,6 +9429,12 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
                              FUTEX_WAKE, INT_MAX, NULL, NULL, 0);
             }
 
+#ifdef TARGET_AARCH64
+            if (ts->gcs_base) {
+                target_munmap(ts->gcs_base, ts->gcs_size);
+            }
+#endif
+
             object_unparent(OBJECT(cpu));
             object_unref(OBJECT(cpu));
             /*

From ad1afe433fa18691306451cf0f79bd2568ef9709 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:06 -0700
Subject: [PATCH 1250/2396] linux-user/aarch64: Implement map_shadow_stack
 syscall

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-67-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/syscall.c | 59 ++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 59 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 47a6b58cf5..8546f48a05 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6358,6 +6358,12 @@ abi_long do_arch_prctl(CPUX86State *env, int code, abi_ulong addr)
 # define PR_SET_SHADOW_STACK_STATUS  75
 # define PR_LOCK_SHADOW_STACK_STATUS 76
 #endif
+#ifndef SHADOW_STACK_SET_TOKEN
+# define SHADOW_STACK_SET_TOKEN  (1u << 0)
+#endif
+#ifndef SHADOW_STACK_SET_MARKER
+# define SHADOW_STACK_SET_MARKER (1u << 1)
+#endif
 
 #include "target_prctl.h"
 
@@ -6605,6 +6611,54 @@ static abi_long do_prctl(CPUArchState *env, abi_long option, abi_long arg2,
     }
 }
 
+#ifdef TARGET_AARCH64
+static abi_long do_map_shadow_stack(CPUArchState *env, abi_ulong addr,
+                                    abi_ulong size, abi_int flags)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    abi_ulong alloc_size;
+
+    if (!cpu_isar_feature(aa64_gcs, cpu)) {
+        return -TARGET_EOPNOTSUPP;
+    }
+    if (flags & ~(SHADOW_STACK_SET_TOKEN | SHADOW_STACK_SET_MARKER)) {
+        return -TARGET_EINVAL;
+    }
+    if (addr & ~TARGET_PAGE_MASK) {
+        return -TARGET_EINVAL;
+    }
+    if (size == 8 || !QEMU_IS_ALIGNED(size, 8)) {
+        return -TARGET_EINVAL;
+    }
+
+    alloc_size = TARGET_PAGE_ALIGN(size);
+    if (alloc_size < size) {
+        return -TARGET_EOVERFLOW;
+    }
+
+    mmap_lock();
+    addr = gcs_alloc(addr, alloc_size);
+    if (addr != -1) {
+        if (flags & SHADOW_STACK_SET_TOKEN) {
+            abi_ptr cap_ptr = addr + size - 8;
+            uint64_t cap_val;
+
+            if (flags & SHADOW_STACK_SET_MARKER) {
+                /* Leave an extra empty frame at top-of-stack. */
+                cap_ptr -= 8;
+            }
+            cap_val = (cap_ptr & TARGET_PAGE_MASK) | 1;
+            if (put_user_u64(cap_val, cap_ptr)) {
+                /* Allocation succeeded above. */
+                g_assert_not_reached();
+            }
+        }
+    }
+    mmap_unlock();
+    return get_errno(addr);
+}
+#endif
+
 #define NEW_STACK_SIZE 0x40000
 
 
@@ -14065,6 +14119,11 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
         return do_riscv_hwprobe(cpu_env, arg1, arg2, arg3, arg4, arg5);
 #endif
 
+#ifdef TARGET_AARCH64
+    case TARGET_NR_map_shadow_stack:
+        return do_map_shadow_stack(cpu_env, arg1, arg2, arg3);
+#endif
+
     default:
         qemu_log_mask(LOG_UNIMP, "Unsupported syscall: %d\n", num);
         return -TARGET_ENOSYS;

From 5149287e10c903f2c629f127ec90415b2d1703d5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:07 -0700
Subject: [PATCH 1251/2396] target/arm: Enable GCSPR_EL0 for read in user-mode

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-68-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index cbb00c3db3..11e7c10cef 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -311,6 +311,10 @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
         env->cp15.mdscr_el1 |= 1 << 12;
         /* Enable FEAT_MOPS */
         env->cp15.sctlr_el[1] |= SCTLR_MSCEN;
+        /* For Linux, GCSPR_EL0 is always readable. */
+        if (cpu_isar_feature(aa64_gcs, cpu)) {
+            env->cp15.gcscr_el[0] = GCSCRE0_NTR;
+        }
 #else
         /* Reset into the highest available EL */
         if (arm_feature(env, ARM_FEATURE_EL3)) {

From 37897b29b3a55fd60bb75ab12ff52d0b1bf72bef Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:08 -0700
Subject: [PATCH 1252/2396] linux-user/aarch64: Inject SIGSEGV for GCS faults

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-69-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/cpu_loop.c      | 5 +++++
 linux-user/aarch64/target_signal.h | 1 +
 2 files changed, 6 insertions(+)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index 50a4c99535..7f66a879ea 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -89,6 +89,11 @@ static void signal_for_exception(CPUARMState *env, vaddr addr)
         si_code = TARGET_ILL_ILLOPN;
         break;
 
+    case EC_GCS:
+        si_signo = TARGET_SIGSEGV;
+        si_code = TARGET_SEGV_CPERR;
+        break;
+
     case EC_MOP:
         /*
          * FIXME: The kernel fixes up wrong-option exceptions.
diff --git a/linux-user/aarch64/target_signal.h b/linux-user/aarch64/target_signal.h
index 6f66a50bfd..e509ac1032 100644
--- a/linux-user/aarch64/target_signal.h
+++ b/linux-user/aarch64/target_signal.h
@@ -7,6 +7,7 @@
 
 #define TARGET_SEGV_MTEAERR  8  /* Asynchronous ARM MTE error */
 #define TARGET_SEGV_MTESERR  9  /* Synchronous ARM MTE exception */
+#define TARGET_SEGV_CPERR   10  /* Control protection fault */
 
 #define TARGET_ARCH_HAS_SETUP_FRAME
 #define TARGET_ARCH_HAS_SIGTRAMP_PAGE 1

From ef110c3070aff0994c3c5601a6e37c43ac793834 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:09 -0700
Subject: [PATCH 1253/2396] linux-user/aarch64: Generate GCS signal records

Here we must push and pop a cap on the GCS stack as
well as the gcs record on the normal stack.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-70-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/signal.c | 138 ++++++++++++++++++++++++++++++++++--
 1 file changed, 132 insertions(+), 6 deletions(-)

diff --git a/linux-user/aarch64/signal.c b/linux-user/aarch64/signal.c
index ef97be3ac7..f7edfa249e 100644
--- a/linux-user/aarch64/signal.c
+++ b/linux-user/aarch64/signal.c
@@ -22,6 +22,7 @@
 #include "signal-common.h"
 #include "linux-user/trace.h"
 #include "target/arm/cpu-features.h"
+#include "gcs-internal.h"
 
 struct target_sigcontext {
     uint64_t fault_address;
@@ -152,6 +153,16 @@ struct target_zt_context {
 QEMU_BUILD_BUG_ON(TARGET_ZT_SIG_REG_BYTES != \
                   sizeof_field(CPUARMState, za_state.zt0));
 
+#define TARGET_GCS_MAGIC       0x47435300
+#define GCS_SIGNAL_CAP(X)      ((X) & TARGET_PAGE_MASK)
+
+struct target_gcs_context {
+    struct target_aarch64_ctx head;
+    uint64_t gcspr;
+    uint64_t features_enabled;
+    uint64_t reserved;
+};
+
 struct target_rt_sigframe {
     struct target_siginfo info;
     struct target_ucontext uc;
@@ -322,6 +333,35 @@ static void target_setup_zt_record(struct target_zt_context *zt,
     }
 }
 
+static bool target_setup_gcs_record(struct target_gcs_context *ctx,
+                                    CPUARMState *env, uint64_t return_addr)
+{
+    uint64_t mode = gcs_get_el0_mode(env);
+    uint64_t gcspr = env->cp15.gcspr_el[0];
+
+    if (mode & PR_SHADOW_STACK_ENABLE) {
+        /* Push a cap for the signal frame. */
+        gcspr -= 8;
+        if (put_user_u64(GCS_SIGNAL_CAP(gcspr), gcspr)) {
+            return false;
+        }
+
+        /* Push a gcs entry for the trampoline. */
+        if (put_user_u64(return_addr, gcspr - 8)) {
+            return false;
+        }
+        env->cp15.gcspr_el[0] = gcspr - 8;
+    }
+
+    __put_user(TARGET_GCS_MAGIC, &ctx->head.magic);
+    __put_user(sizeof(*ctx), &ctx->head.size);
+    __put_user(gcspr, &ctx->gcspr);
+    __put_user(mode, &ctx->features_enabled);
+    __put_user(0, &ctx->reserved);
+
+    return true;
+}
+
 static void target_restore_general_frame(CPUARMState *env,
                                          struct target_rt_sigframe *sf)
 {
@@ -502,6 +542,64 @@ static bool target_restore_zt_record(CPUARMState *env,
     return true;
 }
 
+static bool target_restore_gcs_record(CPUARMState *env,
+                                      struct target_gcs_context *ctx,
+                                      bool *rebuild_hflags)
+{
+    TaskState *ts = get_task_state(env_cpu(env));
+    uint64_t cur_mode = gcs_get_el0_mode(env);
+    uint64_t new_mode, gcspr;
+
+    __get_user(new_mode, &ctx->features_enabled);
+    __get_user(gcspr, &ctx->gcspr);
+
+    /*
+     * The kernel pushes the value through the hw register:
+     * write_sysreg_s(gcspr, SYS_GCSPR_EL0) in restore_gcs_context,
+     * then read_sysreg_s(SYS_GCSPR_EL0) in gcs_restore_signal.
+     * Since the bottom 3 bits are RES0, this can (CONSTRAINED UNPREDICTABLE)
+     * force align the value.  Mirror the choice from gcspr_write().
+     */
+    gcspr &= ~7;
+
+    if (new_mode & ~(PR_SHADOW_STACK_ENABLE |
+                     PR_SHADOW_STACK_WRITE |
+                     PR_SHADOW_STACK_PUSH)) {
+        return false;
+    }
+    if ((new_mode ^ cur_mode) & ts->gcs_el0_locked) {
+        return false;
+    }
+    if (new_mode & ~cur_mode & PR_SHADOW_STACK_ENABLE) {
+        return false;
+    }
+
+    if (new_mode & PR_SHADOW_STACK_ENABLE) {
+        uint64_t cap;
+
+        /* Pop and clear the signal cap. */
+        if (get_user_u64(cap, gcspr)) {
+            return false;
+        }
+        if (cap != GCS_SIGNAL_CAP(gcspr)) {
+            return false;
+        }
+        if (put_user_u64(0, gcspr)) {
+            return false;
+        }
+        gcspr += 8;
+    } else {
+        new_mode = 0;
+    }
+
+    env->cp15.gcspr_el[0] = gcspr;
+    if (new_mode != cur_mode) {
+        *rebuild_hflags = true;
+        gcs_set_el0_mode(env, new_mode);
+    }
+    return true;
+}
+
 static int target_restore_sigframe(CPUARMState *env,
                                    struct target_rt_sigframe *sf)
 {
@@ -511,8 +609,10 @@ static int target_restore_sigframe(CPUARMState *env,
     struct target_za_context *za = NULL;
     struct target_tpidr2_context *tpidr2 = NULL;
     struct target_zt_context *zt = NULL;
+    struct target_gcs_context *gcs = NULL;
     uint64_t extra_datap = 0;
     bool used_extra = false;
+    bool rebuild_hflags = false;
     int sve_size = 0;
     int za_size = 0;
     int zt_size = 0;
@@ -582,6 +682,15 @@ static int target_restore_sigframe(CPUARMState *env,
             zt_size = size;
             break;
 
+        case TARGET_GCS_MAGIC:
+            if (gcs
+                || size != sizeof(struct target_gcs_context)
+                || !cpu_isar_feature(aa64_gcs, env_archcpu(env))) {
+                goto err;
+            }
+            gcs = (struct target_gcs_context *)ctx;
+            break;
+
         case TARGET_EXTRA_MAGIC:
             if (extra || size != sizeof(struct target_extra_context)) {
                 goto err;
@@ -612,6 +721,10 @@ static int target_restore_sigframe(CPUARMState *env,
         goto err;
     }
 
+    if (gcs && !target_restore_gcs_record(env, gcs, &rebuild_hflags)) {
+        goto err;
+    }
+
     /* SVE data, if present, overwrites FPSIMD data.  */
     if (sve && !target_restore_sve_record(env, sve, sve_size, &svcr)) {
         goto err;
@@ -631,6 +744,9 @@ static int target_restore_sigframe(CPUARMState *env,
     }
     if (env->svcr != svcr) {
         env->svcr = svcr;
+        rebuild_hflags = true;
+    }
+    if (rebuild_hflags) {
         arm_rebuild_hflags(env);
     }
     unlock_user(extra, extra_datap, 0);
@@ -701,7 +817,7 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
                                uc.tuc_mcontext.__reserved),
     };
     int fpsimd_ofs, fr_ofs, sve_ofs = 0, za_ofs = 0, tpidr2_ofs = 0;
-    int zt_ofs = 0, esr_ofs = 0;
+    int zt_ofs = 0, esr_ofs = 0, gcs_ofs = 0;
     int sve_size = 0, za_size = 0, tpidr2_size = 0, zt_size = 0;
     struct target_rt_sigframe *frame;
     struct target_rt_frame_record *fr;
@@ -720,6 +836,11 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
                                        &layout);
     }
 
+    if (env->cp15.gcspr_el[0]) {
+        gcs_ofs = alloc_sigframe_space(sizeof(struct target_gcs_context),
+                                       &layout);
+    }
+
     /* SVE state needs saving only if it exists.  */
     if (cpu_isar_feature(aa64_sve, env_archcpu(env)) ||
         cpu_isar_feature(aa64_sme, env_archcpu(env))) {
@@ -779,6 +900,12 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         goto give_sigsegv;
     }
 
+    if (ka->sa_flags & TARGET_SA_RESTORER) {
+        return_addr = ka->sa_restorer;
+    } else {
+        return_addr = default_rt_sigreturn;
+    }
+
     target_setup_general_frame(frame, env, set);
     target_setup_fpsimd_record((void *)frame + fpsimd_ofs, env);
     if (esr_ofs) {
@@ -786,6 +913,10 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
         /* Leave ESR_EL1 clear while it's not relevant. */
         env->cp15.esr_el[1] = 0;
     }
+    if (gcs_ofs &&
+        !target_setup_gcs_record((void *)frame + gcs_ofs, env, return_addr)) {
+        goto give_sigsegv;
+    }
     target_setup_end_record((void *)frame + layout.std_end_ofs);
     if (layout.extra_ofs) {
         target_setup_extra_record((void *)frame + layout.extra_ofs,
@@ -811,11 +942,6 @@ static void target_setup_frame(int usig, struct target_sigaction *ka,
     __put_user(env->xregs[29], &fr->fp);
     __put_user(env->xregs[30], &fr->lr);
 
-    if (ka->sa_flags & TARGET_SA_RESTORER) {
-        return_addr = ka->sa_restorer;
-    } else {
-        return_addr = default_rt_sigreturn;
-    }
     env->xregs[0] = usig;
     env->xregs[29] = frame_addr + fr_ofs;
     env->xregs[30] = return_addr;

From d2687ad312f4ec776398d4badad287b421c8fbc0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:10 -0700
Subject: [PATCH 1254/2396] linux-user/aarch64: Enable GCS in HWCAP

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-71-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/aarch64/elfload.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/linux-user/aarch64/elfload.c b/linux-user/aarch64/elfload.c
index 77d03b50e1..3af5a37776 100644
--- a/linux-user/aarch64/elfload.c
+++ b/linux-user/aarch64/elfload.c
@@ -169,6 +169,7 @@ abi_ulong get_elf_hwcap(CPUState *cs)
     GET_FEATURE_ID(aa64_dcpop, ARM_HWCAP_A64_DCPOP);
     GET_FEATURE_ID(aa64_rcpc_8_3, ARM_HWCAP_A64_LRCPC);
     GET_FEATURE_ID(aa64_rcpc_8_4, ARM_HWCAP_A64_ILRCPC);
+    GET_FEATURE_ID(aa64_gcs, ARM_HWCAP_A64_GCS);
 
     return hwcaps;
 }

From 3f3cc39b7d263faf453b6a165f56425e46a2f44e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:11 -0700
Subject: [PATCH 1255/2396] tests/tcg/aarch64: Add gcsstr

Add some infrastructure for testing gcs in userspace.
Validate successful and trapped executions of GCSSTR.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-72-richard.henderson@linaro.org
[PMM: fixed hardcoded tabs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  5 +++
 tests/tcg/aarch64/gcs.h           | 71 +++++++++++++++++++++++++++++++
 tests/tcg/aarch64/gcsstr.c        | 48 +++++++++++++++++++++
 3 files changed, 124 insertions(+)
 create mode 100644 tests/tcg/aarch64/gcs.h
 create mode 100644 tests/tcg/aarch64/gcsstr.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 1755874bee..5e1b3a3385 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -75,6 +75,11 @@ AARCH64_TESTS += $(SME_TESTS)
 $(SME_TESTS): CFLAGS += $(CROSS_AS_HAS_ARMV9_SME)
 endif
 
+# GCS Tests
+GCS_TESTS += gcsstr
+AARCH64_TESTS += $(GCS_TESTS)
+$(GCS_TESTS): gcs.h
+
 # System Registers Tests
 AARCH64_TESTS += sysregs
 
diff --git a/tests/tcg/aarch64/gcs.h b/tests/tcg/aarch64/gcs.h
new file mode 100644
index 0000000000..770cde6a85
--- /dev/null
+++ b/tests/tcg/aarch64/gcs.h
@@ -0,0 +1,71 @@
+/*
+ * Linux kernel fallback API definitions for GCS and test helpers.
+ *
+ * Copyright (c) 2025 Linaro Ltd
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <assert.h>
+#include <string.h>
+#include <stdlib.h>
+#include <stdio.h>
+#include <stdint.h>
+#include <unistd.h>
+#include <errno.h>
+#include <signal.h>
+#include <sys/mman.h>
+#include <sys/prctl.h>
+#include <sys/syscall.h>
+
+#ifndef PR_GET_SHADOW_STACK_STATUS
+#define PR_GET_SHADOW_STACK_STATUS      74
+#endif
+#ifndef PR_SET_SHADOW_STACK_STATUS
+#define PR_SET_SHADOW_STACK_STATUS      75
+#endif
+#ifndef PR_LOCK_SHADOW_STACK_STATUS
+#define PR_LOCK_SHADOW_STACK_STATUS     76
+#endif
+#ifndef PR_SHADOW_STACK_ENABLE
+# define PR_SHADOW_STACK_ENABLE         (1 << 0)
+# define PR_SHADOW_STACK_WRITE          (1 << 1)
+# define PR_SHADOW_STACK_PUSH           (1 << 2)
+#endif
+#ifndef SHADOW_STACK_SET_TOKEN
+#define SHADOW_STACK_SET_TOKEN          (1 << 0)
+#endif
+#ifndef SHADOW_STACK_SET_MARKER
+#define SHADOW_STACK_SET_MARKER         (1 << 1)
+#endif
+#ifndef SEGV_CPERR
+#define SEGV_CPERR  10
+#endif
+#ifndef __NR_map_shadow_stack
+#define __NR_map_shadow_stack  453
+#endif
+
+/*
+ * Macros, and implement the syscall inline, lest we fail
+ * the checked return from any function call.
+ */
+#define enable_gcs(flags) \
+    do {                                                                     \
+        register long num  __asm__ ("x8") = __NR_prctl;                      \
+        register long arg1 __asm__ ("x0") = PR_SET_SHADOW_STACK_STATUS;      \
+        register long arg2 __asm__ ("x1") = PR_SHADOW_STACK_ENABLE | flags;  \
+        register long arg3 __asm__ ("x2") = 0;                               \
+        register long arg4 __asm__ ("x3") = 0;                               \
+        register long arg5 __asm__ ("x4") = 0;                               \
+        asm volatile("svc #0"                                                \
+                     : "+r"(arg1)                                            \
+                     : "r"(arg2), "r"(arg3), "r"(arg4), "r"(arg5), "r"(num)  \
+                     : "memory", "cc");                                      \
+        if (arg1) {                                                          \
+            errno = -arg1;                                                   \
+            perror("PR_SET_SHADOW_STACK_STATUS");                            \
+            exit(2);                                                         \
+        }                                                                    \
+    } while (0)
+
+#define gcspr() \
+    ({ uint64_t *r; asm volatile("mrs %0, s3_3_c2_c5_1" : "=r"(r)); r; })
diff --git a/tests/tcg/aarch64/gcsstr.c b/tests/tcg/aarch64/gcsstr.c
new file mode 100644
index 0000000000..b045aee925
--- /dev/null
+++ b/tests/tcg/aarch64/gcsstr.c
@@ -0,0 +1,48 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "gcs.h"
+
+/*
+ * A single garbage store to the gcs stack.
+ * The asm inside must be unique, so disallow inlining.
+ */
+void __attribute__((noinline))
+test_gcsstr(void)
+{
+    register uint64_t *ptr __asm__("x0") = gcspr();
+    /* GCSSTR x1, x0 */
+    __asm__("inst_gcsstr: .inst 0xd91f1c01" : : "r"(--ptr));
+}
+
+static void test_sigsegv(int sig, siginfo_t *info, void *vuc)
+{
+    ucontext_t *uc = vuc;
+    uint64_t inst_gcsstr;
+
+    __asm__("adr %0, inst_gcsstr" : "=r"(inst_gcsstr));
+    assert(uc->uc_mcontext.pc == inst_gcsstr);
+    assert(info->si_code == SEGV_CPERR);
+    /* TODO: Dig for ESR and verify syndrome. */
+    exit(0);
+}
+
+int main()
+{
+    struct sigaction sa = {
+        .sa_sigaction = test_sigsegv,
+        .sa_flags = SA_SIGINFO,
+    };
+
+    /* Enable GCSSTR and test the store succeeds. */
+    enable_gcs(PR_SHADOW_STACK_WRITE);
+    test_gcsstr();
+
+    /* Disable GCSSTR and test the resulting sigsegv. */
+    enable_gcs(0);
+    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
+        perror("sigaction");
+        exit(1);
+    }
+    test_gcsstr();
+    abort();
+}

From 8f278acdce11cce89e5599bde0de76692ae1b1d6 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:12 -0700
Subject: [PATCH 1256/2396] tests/tcg/aarch64: Add gcspushm

Validate successful and trapped executions of GCSPUSHM, GCSPOPM.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-73-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  2 +-
 tests/tcg/aarch64/gcspushm.c      | 71 +++++++++++++++++++++++++++++++
 2 files changed, 72 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/aarch64/gcspushm.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 5e1b3a3385..fddb7bc9cd 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -76,7 +76,7 @@ $(SME_TESTS): CFLAGS += $(CROSS_AS_HAS_ARMV9_SME)
 endif
 
 # GCS Tests
-GCS_TESTS += gcsstr
+GCS_TESTS += gcsstr gcspushm
 AARCH64_TESTS += $(GCS_TESTS)
 $(GCS_TESTS): gcs.h
 
diff --git a/tests/tcg/aarch64/gcspushm.c b/tests/tcg/aarch64/gcspushm.c
new file mode 100644
index 0000000000..c330417a2f
--- /dev/null
+++ b/tests/tcg/aarch64/gcspushm.c
@@ -0,0 +1,71 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "gcs.h"
+
+
+#define GCSPUSHM  "sys #3, c7, c7, #0, %[push]"
+#define GCSPOPM   "sysl %[pop], #3, c7, c7, #1"
+
+static void test_sigsegv(int sig, siginfo_t *info, void *vuc)
+{
+    ucontext_t *uc = vuc;
+    uint64_t inst_sigsegv;
+
+    __asm__("adr %0, inst_sigsegv" : "=r"(inst_sigsegv));
+    assert(uc->uc_mcontext.pc == inst_sigsegv);
+    assert(info->si_code == SEGV_CPERR);
+    /* TODO: Dig for ESR and verify syndrome. */
+    uc->uc_mcontext.pc += 4;
+}
+
+static void test_sigill(int sig, siginfo_t *info, void *vuc)
+{
+    ucontext_t *uc = vuc;
+    uint64_t inst_sigill;
+
+    __asm__("adr %0, inst_sigill" : "=r"(inst_sigill));
+    assert(uc->uc_mcontext.pc == inst_sigill);
+    assert(info->si_code == ILL_ILLOPC);
+    uc->uc_mcontext.pc += 4;
+}
+
+int main()
+{
+    struct sigaction sa = { .sa_flags = SA_SIGINFO };
+    uint64_t old, new;
+
+    sa.sa_sigaction = test_sigsegv;
+    if (sigaction(SIGSEGV, &sa, NULL) < 0) {
+        perror("sigaction");
+        exit(1);
+    }
+
+    sa.sa_sigaction = test_sigill;
+    if (sigaction(SIGILL, &sa, NULL) < 0) {
+        perror("sigaction");
+        exit(1);
+    }
+
+    /* Pushm is disabled -- SIGILL via EC_SYSTEMREGISTERTRAP */
+    asm volatile("inst_sigill:\t" GCSPUSHM
+                 : : [push] "r" (1));
+
+    enable_gcs(PR_SHADOW_STACK_PUSH);
+
+    /* Valid value -- low 2 bits clear */
+    old = 0xdeadbeeffeedcaec;
+    asm volatile(GCSPUSHM "\n\t" GCSPOPM
+                 : [pop] "=r" (new)
+                 : [push] "r" (old)
+                 : "memory");
+    assert(old == new);
+
+    /* Invalid value -- SIGSEGV via EC_GCS */
+    asm volatile(GCSPUSHM "\n"
+                 "inst_sigsegv:\t" GCSPOPM
+                 : [pop] "=r" (new)
+                 : [push] "r" (1)
+                 : "memory");
+
+    exit(0);
+}

From af0bd678df72f6c5a00484ed6acccfcfc91577d4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 8 Oct 2025 14:56:13 -0700
Subject: [PATCH 1257/2396] tests/tcg/aarch64: Add gcsss

Validate stack switching and recursion depth.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251008215613.300150-74-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  2 +-
 tests/tcg/aarch64/gcs.h           |  9 ++++
 tests/tcg/aarch64/gcsss.c         | 74 +++++++++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/aarch64/gcsss.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index fddb7bc9cd..55ce34e45e 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -76,7 +76,7 @@ $(SME_TESTS): CFLAGS += $(CROSS_AS_HAS_ARMV9_SME)
 endif
 
 # GCS Tests
-GCS_TESTS += gcsstr gcspushm
+GCS_TESTS += gcsstr gcspushm gcsss
 AARCH64_TESTS += $(GCS_TESTS)
 $(GCS_TESTS): gcs.h
 
diff --git a/tests/tcg/aarch64/gcs.h b/tests/tcg/aarch64/gcs.h
index 770cde6a85..6f013d0f1e 100644
--- a/tests/tcg/aarch64/gcs.h
+++ b/tests/tcg/aarch64/gcs.h
@@ -69,3 +69,12 @@
 
 #define gcspr() \
     ({ uint64_t *r; asm volatile("mrs %0, s3_3_c2_c5_1" : "=r"(r)); r; })
+
+#define gcsss1(val) \
+    do {                                                                     \
+        asm volatile("sys #3, c7, c7, #2, %0" : : "r"(val) : "memory");      \
+    } while (0)
+
+#define gcsss2() \
+    ({ uint64_t *r;                                                          \
+       asm volatile("sysl %0, #3, c7, c7, #3" : "=r"(r) : : "memory"); r; })
diff --git a/tests/tcg/aarch64/gcsss.c b/tests/tcg/aarch64/gcsss.c
new file mode 100644
index 0000000000..9550c68e7e
--- /dev/null
+++ b/tests/tcg/aarch64/gcsss.c
@@ -0,0 +1,74 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+#include "gcs.h"
+
+#define IN_PROGRESS(X)  ((uint64_t)(X) | 5)
+#define CAP(X)          (((uint64_t)(X) & ~0xfff) + 1)
+
+static uint64_t * __attribute__((noinline)) recurse(size_t index)
+{
+    if (index == 0) {
+        return gcspr();
+    }
+    return recurse(index - 1);
+}
+
+int main()
+{
+    void *tmp;
+    uint64_t *alt_stack, *alt_cap;
+    uint64_t *orig_pr, *orig_cap;
+    uint64_t *bottom;
+    size_t pagesize = getpagesize();
+    size_t words;
+
+    enable_gcs(0);
+    orig_pr = gcspr();
+
+    /* Allocate a guard page before and after. */
+    tmp = mmap(0, 3 * pagesize, PROT_NONE, MAP_ANON | MAP_PRIVATE, -1, 0);
+    assert(tmp != MAP_FAILED);
+
+    /* map_shadow_stack won't replace existing mappings */
+    munmap(tmp + pagesize, pagesize);
+
+    /* Allocate a new stack between the guards. */
+    alt_stack = (uint64_t *)
+        syscall(__NR_map_shadow_stack, tmp + pagesize, pagesize,
+                SHADOW_STACK_SET_TOKEN);
+    assert(alt_stack == tmp + pagesize);
+
+    words = pagesize / 8;
+    alt_cap = alt_stack + words - 1;
+
+    /* SHADOW_STACK_SET_TOKEN set the cap. */
+    assert(*alt_cap == CAP(alt_cap));
+
+    /* Swap to the alt stack, one step at a time. */
+    gcsss1(alt_cap);
+
+    assert(gcspr() == alt_cap);
+    assert(*alt_cap == IN_PROGRESS(orig_pr));
+
+    orig_cap = gcsss2();
+
+    assert(orig_cap == orig_pr - 1);
+    assert(*orig_cap == CAP(orig_cap));
+    assert(gcspr() == alt_stack + words);
+
+    /* We should be able to use the whole stack. */
+    bottom = recurse(words - 1);
+    assert(bottom == alt_stack);
+
+    /* We should be back where we started. */
+    assert(gcspr() == alt_stack + words);
+
+    /* Swap back to the original stack. */
+    gcsss1(orig_cap);
+    tmp = gcsss2();
+
+    assert(gcspr() == orig_pr);
+    assert(tmp == alt_cap);
+
+    exit(0);
+}

From 8f6dd8f78aa961dbc9a02b01b6abe316f37d2766 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 6 Oct 2025 00:10:16 +0000
Subject: [PATCH 1258/2396] target/arm: Add a cpreg flag to indicate no trap in
 NV

Add a new flag, ARM_CP_NV_NO_TRAP, to indicate that a CP register, even
though it has opc1 == 4 or 5, does not trap when nested virtualization
is enabled (FEAT_NV/FEAT_NV2).

Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20251006001018.219756-2-gustavo.romero@linaro.org
[PMM: tweaked comment text]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 20 +++++++++++++++-----
 1 file changed, 15 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 732c07506d..763de5e051 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -144,6 +144,11 @@ enum {
      * identically to the normal one, other than FGT trapping handling.)
      */
     ARM_CP_ADD_TLBI_NXS          = 1 << 21,
+    /*
+     * Flag: even though this sysreg has opc1 == 4 or 5, it
+     * should not trap to EL2 when HCR_EL2.NV is set.
+     */
+    ARM_CP_NV_NO_TRAP            = 1 << 22,
 };
 
 /*
@@ -1178,12 +1183,17 @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
      * fragile to future new sysregs, but this seems the least likely
      * to break.
      *
-     * In particular, note that the released sysreg XML defines that
-     * the FEAT_MEC sysregs and instructions do not follow this FEAT_NV
-     * trapping rule, so we will need to add an ARM_CP_* flag to indicate
-     * "register does not trap on NV" to handle those if/when we implement
-     * FEAT_MEC.
+     * In particular, note that the FEAT_MEC sysregs and instructions
+     * are exceptions to this trapping rule, so they are marked as
+     * ARM_CP_NV_NO_TRAP to indicate that they should not be trapped
+     * to EL2. (They are an exception because the FEAT_MEC sysregs UNDEF
+     * unless in Realm, and Realm is not expected to be virtualized.)
      */
+
+    if (ri->type & ARM_CP_NV_NO_TRAP) {
+        return false;
+    }
+
     return ri->opc1 == 4 || ri->opc1 == 5;
 }
 

From 700f08d5829f3736fdfafe92d8223254ffc9c495 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 6 Oct 2025 00:10:17 +0000
Subject: [PATCH 1259/2396] target/arm: Implement FEAT_MEC registers

Add all FEAT_MEC registers.  Enable access to the registers via the
SCTLR2 and TCR2 control bits.  Add the two new cache management
instructions, which are nops in QEMU because we do not model caches.

Message-ID: <20250711140828.1714666-3-gustavo.romero@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20251006001018.219756-3-gustavo.romero@linaro.org
[rth: Squash 3 patches to add all registers at once.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h |   5 ++
 target/arm/cpu.c          |   3 ++
 target/arm/cpu.h          |  10 ++++
 target/arm/helper.c       | 108 ++++++++++++++++++++++++++++++++++++++
 target/arm/internals.h    |   3 ++
 5 files changed, 129 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 0f0a112c21..37f1eca3af 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -1364,6 +1364,11 @@ static inline bool isar_feature_aa64_s2pie(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64MMFR3, S2PIE) != 0;
 }
 
+static inline bool isar_feature_aa64_mec(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, MEC) != 0;
+}
+
 static inline bool isar_feature_aa64_pmuv3p1(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64DFR0, PMUVER) >= 4 &&
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 11e7c10cef..3b556f1404 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -652,6 +652,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
                 cpu_isar_feature(aa64_s2pie, cpu)) {
                 env->cp15.scr_el3 |= SCR_PIEN;
             }
+            if (cpu_isar_feature(aa64_mec, cpu)) {
+                env->cp15.scr_el3 |= SCR_MECEN;
+            }
         }
 
         if (target_el == 2) {
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 91a851dac1..1d4e13320c 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -583,6 +583,15 @@ typedef struct CPUArchState {
 
         uint64_t gcscr_el[4];   /* GCSCRE0_EL1, GCSCR_EL[123] */
         uint64_t gcspr_el[4];   /* GCSPR_EL[0123] */
+
+        /* MEC registers */
+        uint64_t mecid_p0_el2;
+        uint64_t mecid_a0_el2;
+        uint64_t mecid_p1_el2;
+        uint64_t mecid_a1_el2;
+        uint64_t mecid_rl_a_el3;
+        uint64_t vmecid_p_el2;
+        uint64_t vmecid_a_el2;
     } cp15;
 
     struct {
@@ -1728,6 +1737,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_SCTLR2EN          (1ULL << 44)
 #define SCR_PIEN              (1ULL << 45)
 #define SCR_GPF               (1ULL << 48)
+#define SCR_MECEN             (1ULL << 49)
 #define SCR_NSE               (1ULL << 62)
 
 /* GCSCR_ELx fields */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 0077788e1e..167f2909b3 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -779,6 +779,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             cpu_isar_feature(aa64_s2pie, cpu)) {
             valid_mask |= SCR_PIEN;
         }
+        if (cpu_isar_feature(aa64_mec, cpu)) {
+            valid_mask |= SCR_MECEN;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -5088,6 +5091,96 @@ static const ARMCPRegInfo nmi_reginfo[] = {
       .resetfn = arm_cp_reset_ignore },
 };
 
+static CPAccessResult mecid_access(CPUARMState *env,
+                                   const ARMCPRegInfo *ri, bool isread)
+{
+    int el = arm_current_el(env);
+
+    if (el == 2) {
+        if (arm_security_space(env) != ARMSS_Realm) {
+            return CP_ACCESS_UNDEFINED;
+        }
+
+        if (!(env->cp15.scr_el3 & SCR_MECEN)) {
+            return CP_ACCESS_TRAP_EL3;
+        }
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static void mecid_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    value = extract64(value, 0, MECID_WIDTH);
+    raw_write(env, ri, value);
+}
+
+static CPAccessResult cipae_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                   bool isread)
+{
+    switch (arm_security_space(env)) {
+    case ARMSS_Root:  /* EL3 */
+    case ARMSS_Realm: /* Realm EL2 */
+        return CP_ACCESS_OK;
+    default:
+        return CP_ACCESS_UNDEFINED;
+    }
+}
+
+static const ARMCPRegInfo mec_reginfo[] = {
+    { .name = "MECIDR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 7, .crn = 10, .crm = 8,
+      .access = PL2_R, .type = ARM_CP_CONST | ARM_CP_NV_NO_TRAP,
+      .resetvalue = MECID_WIDTH - 1 },
+    { .name = "MECID_P0_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 0, .crn = 10, .crm = 8,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.mecid_p0_el2) },
+    { .name = "MECID_A0_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 1, .crn = 10, .crm = 8,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.mecid_a0_el2) },
+    { .name = "MECID_P1_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 2, .crn = 10, .crm = 8,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.mecid_p1_el2) },
+    { .name = "MECID_A1_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 3, .crn = 10, .crm = 8,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.mecid_a1_el2) },
+    { .name = "MECID_RL_A_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .opc2 = 1, .crn = 10, .crm = 10,
+      .access = PL3_RW, .accessfn = mecid_access,
+      .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.mecid_rl_a_el3) },
+    { .name = "VMECID_P_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 0, .crn = 10, .crm = 9,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.vmecid_p_el2) },
+    { .name = "VMECID_A_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .opc2 = 1, .crn = 10, .crm = 9,
+      .access = PL2_RW, .type = ARM_CP_NV_NO_TRAP,
+      .accessfn = mecid_access, .writefn = mecid_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.vmecid_a_el2) },
+    { .name = "DC_CIPAE", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 14, .opc2 = 0,
+      .access = PL2_W, .type = ARM_CP_NOP | ARM_CP_NV_NO_TRAP,
+      .accessfn = cipae_access },
+};
+
+static const ARMCPRegInfo mec_mte_reginfo[] = {
+    { .name = "DC_CIGDPAE", .state = ARM_CP_STATE_AA64,
+      .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 14, .opc2 = 7,
+      .access = PL2_W, .type = ARM_CP_NOP | ARM_CP_NV_NO_TRAP,
+      .accessfn = cipae_access },
+};
+
 #ifndef CONFIG_USER_ONLY
 /*
  * We don't know until after realize whether there's a GICv3
@@ -5930,6 +6023,9 @@ static void sctlr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     uint64_t valid_mask = 0;
 
+    if (cpu_isar_feature(aa64_mec, env_archcpu(env))) {
+        valid_mask |= SCTLR2_EMEC;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }
@@ -5939,6 +6035,9 @@ static void sctlr2_el3_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     uint64_t valid_mask = 0;
 
+    if (cpu_isar_feature(aa64_mec, env_archcpu(env))) {
+        valid_mask |= SCTLR2_EMEC;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }
@@ -6009,6 +6108,9 @@ static void tcr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_s1pie, cpu)) {
         valid_mask |= TCR2_PIE;
     }
+    if (cpu_isar_feature(aa64_mec, env_archcpu(env))) {
+        valid_mask |= TCR2_AMEC0 | TCR2_AMEC1;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }
@@ -7325,6 +7427,12 @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_s2pie, cpu)) {
         define_arm_cp_regs(cpu, s2pie_reginfo);
     }
+    if (cpu_isar_feature(aa64_mec, cpu)) {
+        define_arm_cp_regs(cpu, mec_reginfo);
+        if (cpu_isar_feature(aa64_mte, cpu)) {
+            define_arm_cp_regs(cpu, mec_mte_reginfo);
+        }
+    }
 
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 2a85ab762d..f539bbe58e 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1903,4 +1903,7 @@ void cpsr_write_from_spsr_elx(CPUARMState *env, uint32_t val);
 /* Compare uint64_t for qsort and bsearch. */
 int compare_u64(const void *a, const void *b);
 
+/* Used in FEAT_MEC to set the MECIDWidthm1 field in the MECIDR_EL2 register. */
+#define MECID_WIDTH 16
+
 #endif

From 00936783abf77ebb47a78312a2e6500c6a13d938 Mon Sep 17 00:00:00 2001
From: Gustavo Romero <gustavo.romero@linaro.org>
Date: Mon, 6 Oct 2025 00:10:18 +0000
Subject: [PATCH 1260/2396] target/arm: Enable FEAT_MEC in -cpu max

Advertise FEAT_MEC in AA64MMFR3 ID register for the Arm64 cpu max as a
first step to fully support FEAT_MEC.

The FEAT_MEC is an extension to FEAT_RME that implements multiple
Memory Encryption Contexts (MEC) so the memory in a realm can be
encrypted and accessing it from the wrong encryption context is not
possible. An encryption context allow the selection of a memory
encryption engine.

At this point, no real memory encryption is supported, but software
stacks that rely on FEAT_MEC should work properly.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Message-id: 20251006001018.219756-4-gustavo.romero@linaro.org
Message-ID: <20250711140828.1714666-7-gustavo.romero@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Gustavo Romero <gustavo.romero@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 3 +++
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 4 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index 4496178c48..bf81da124a 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -94,6 +94,9 @@ the following architecture extensions:
 - FEAT_LSE2 (Large System Extensions v2)
 - FEAT_LSE128 (128-bit Atomics)
 - FEAT_LVA (Large Virtual Address space)
+- FEAT_MEC (Memory Encryption Contexts)
+
+  * This is a register-only implementation without encryption.
 - FEAT_MixedEnd (Mixed-endian support)
 - FEAT_MixedEndEL0 (Mixed-endian support at EL0)
 - FEAT_MOPS (Standardization of memory operations)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index cc42dfdf56..1bffe66e81 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1327,6 +1327,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = GET_IDREG(isar, ID_AA64MMFR3);
     t = FIELD_DP64(t, ID_AA64MMFR3, TCRX, 1);       /* FEAT_TCR2 */
     t = FIELD_DP64(t, ID_AA64MMFR3, SCTLRX, 1);     /* FEAT_SCTLR2 */
+    t = FIELD_DP64(t, ID_AA64MMFR3, MEC, 1);        /* FEAT_MEC */
     t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
     t = FIELD_DP64(t, ID_AA64MMFR3, S1PIE, 1);    /* FEAT_S1PIE */
     t = FIELD_DP64(t, ID_AA64MMFR3, S2PIE, 1);    /* FEAT_S2PIE */

From ed26056d90ddff21351f3efd2cb47fea4f0e1d45 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 9 Oct 2025 15:08:31 +0100
Subject: [PATCH 1261/2396] block/curl.c: Use explicit long constants in
 curl_easy_setopt calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

curl_easy_setopt takes a variable argument that depends on what
CURLOPT you are setting.  Some require a long constant.  Passing a
plain int constant is potentially wrong on some platforms.

With warnings enabled, multiple warnings like this were printed:

../block/curl.c: In function ‘curl_init_state’:
../block/curl.c:474:13: warning: call to ‘_curl_easy_setopt_err_long’ declared with attribute warning: curl_easy_setopt expects a long argument [-Wattribute-warning]
  474 |             curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1) ||
      |             ^

Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Chenxi Mao <maochenxi@bosc.ac.cn>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009141026.4042021-2-rjones@redhat.com>
---
 block/curl.c               | 10 +++++-----
 contrib/elf2dmp/download.c |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index e0f98e035a..68cf83ce55 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -471,11 +471,11 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
                              (void *)curl_read_cb) ||
             curl_easy_setopt(state->curl, CURLOPT_WRITEDATA, (void *)state) ||
             curl_easy_setopt(state->curl, CURLOPT_PRIVATE, (void *)state) ||
-            curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1) ||
-            curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1) ||
-            curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1) ||
+            curl_easy_setopt(state->curl, CURLOPT_AUTOREFERER, 1L) ||
+            curl_easy_setopt(state->curl, CURLOPT_FOLLOWLOCATION, 1L) ||
+            curl_easy_setopt(state->curl, CURLOPT_NOSIGNAL, 1L) ||
             curl_easy_setopt(state->curl, CURLOPT_ERRORBUFFER, state->errmsg) ||
-            curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1)) {
+            curl_easy_setopt(state->curl, CURLOPT_FAILONERROR, 1L)) {
             goto err;
         }
         if (s->username) {
@@ -800,7 +800,7 @@ static int curl_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     s->accept_range = false;
-    if (curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1) ||
+    if (curl_easy_setopt(state->curl, CURLOPT_NOBODY, 1L) ||
         curl_easy_setopt(state->curl, CURLOPT_HEADERFUNCTION, curl_header_cb) ||
         curl_easy_setopt(state->curl, CURLOPT_HEADERDATA, s)) {
         pstrcpy(state->errmsg, CURL_ERROR_SIZE,
diff --git a/contrib/elf2dmp/download.c b/contrib/elf2dmp/download.c
index 21306b3fd4..fa8da0f9a2 100644
--- a/contrib/elf2dmp/download.c
+++ b/contrib/elf2dmp/download.c
@@ -27,8 +27,8 @@ bool download_url(const char *name, const char *url)
     if (curl_easy_setopt(curl, CURLOPT_URL, url) != CURLE_OK
             || curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, NULL) != CURLE_OK
             || curl_easy_setopt(curl, CURLOPT_WRITEDATA, file) != CURLE_OK
-            || curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1) != CURLE_OK
-            || curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_FOLLOWLOCATION, 1L) != CURLE_OK
+            || curl_easy_setopt(curl, CURLOPT_NOPROGRESS, 0L) != CURLE_OK
             || curl_easy_perform(curl) != CURLE_OK) {
         unlink(name);
         fclose(file);

From 2dc5298d31d7ee86b9204de0b3b9c9fda294c3ae Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 19 Sep 2025 17:30:13 +0800
Subject: [PATCH 1262/2396] tests/functional/aarch64/aspeed_ast2700: Add PCIe
 and network tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extend the AST2700 and AST2700fc functional tests with PCIe and network
checks.

This patch introduces a helper "do_ast2700_pcie_test()" that runs "lspci"
on the emulated system and verifies the expected PCIe devices:

- 0002:00:00.0 PCI bridge: ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge
- 0002:01:00.0 Ethernet controller: Intel Corporation 82574L Gigabit Network Connection

Additional changes:
- Add `-device e1000e,netdev=net1,bus=pcie.2 -netdev user,id=net1` to the
  AST2700 and AST2700fc test machines.
- In the AST2700 vbootrom test, assign an IP address to the e1000e
  interface and verify it using `ip addr`.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250919093017.338309-15-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 .../functional/aarch64/test_aspeed_ast2700.py | 21 +++++++++++++++++++
 .../aarch64/test_aspeed_ast2700fc.py          | 13 ++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index a3db267294..0973fce0e9 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -69,6 +69,16 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self,
             'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '18000')
 
+    def do_ast2700_pcie_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 0002:00:00.0',
+            '0002:00:00.0 PCI bridge: '
+            'ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 0002:01:00.0',
+            '0002:01:00.0 Ethernet controller: '
+            'Intel Corporation 82574L Gigabit Network Connection')
+
     def start_ast2700_test(self, name):
         num_cpu = 4
         uboot_size = os.path.getsize(self.scratch_file(name,
@@ -125,20 +135,31 @@ class AST2x00MachineSDK(QemuSystemTest):
 
     def test_aarch64_ast2700a1_evb_sdk_v09_06(self):
         self.set_machine('ast2700a1-evb')
+        self.require_netdev('user')
 
         self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
+        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
+        self.vm.add_args('-netdev', 'user,id=net1')
         self.start_ast2700_test('ast2700-default')
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
+        self.do_ast2700_pcie_test()
 
     def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_07(self):
         self.set_machine('ast2700a1-evb')
+        self.require_netdev('user')
 
         self.archive_extract(self.ASSET_SDK_V907_AST2700A1_VBOOROM)
+        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
+        self.vm.add_args('-netdev', 'user,id=net1')
         self.start_ast2700_test_vbootrom('ast2700-default')
         self.verify_vbootrom_firmware_flow()
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
+        self.do_ast2700_pcie_test()
+        exec_command_and_wait_for_pattern(self,
+            'ip addr show dev eth2',
+            'inet 10.0.2.15/24')
 
 if __name__ == '__main__':
     QemuSystemTest.main()
diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index b85370e182..28b66614d9 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -20,6 +20,8 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.vm.set_console()
         self.vm.add_args('-device',
                          'tmp105,bus=aspeed.i2c.bus.1,address=0x4d,id=tmp-test')
+        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
+        self.vm.add_args('-netdev', 'user,id=net1')
         self.vm.add_args('-drive', 'file=' + image + ',if=mtd,format=raw',
                          '-net', 'nic', '-net', 'user', '-snapshot')
 
@@ -49,6 +51,16 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self,
             'cat /sys/bus/i2c/devices/1-004d/hwmon/hwmon*/temp1_input', '18000')
 
+    def do_ast2700_pcie_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 0002:00:00.0',
+            '0002:00:00.0 PCI bridge: '
+            'ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 0002:01:00.0',
+            '0002:01:00.0 Ethernet controller: '
+            'Intel Corporation 82574L Gigabit Network Connection')
+
     def do_ast2700fc_ssp_test(self):
         self.vm.shutdown()
         self.vm.set_console(console_index=1)
@@ -128,6 +140,7 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.start_ast2700fc_test('ast2700-default')
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
+        self.do_ast2700_pcie_test()
         self.do_ast2700fc_ssp_test()
         self.do_ast2700fc_tsp_test()
 

From 4fcb15ebc262b767743ca97e42cc4041b00b9193 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Fri, 3 Oct 2025 12:30:24 +0200
Subject: [PATCH 1263/2396] aspeed: Don't set 'auto_create_sdcard'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Aspeed machines inherited from a 'no_sdcard' attribute when first
introduced in QEMU. This attribute was later renamed to
'auto_create_sdcard' by commit cdc8d7cadaac ("hw/boards: Rename
no_sdcard -> auto_create_sdcard") and set to 'true'. This has the
indesirable efect to automatically create SD cards at init time.

Remove 'auto_create_sdcard' to avoid creating a SD card device.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251003103024.1863551-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 6046ec0bb2..58cfbc7137 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1418,7 +1418,6 @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635f";
     amc->num_cs    = 1;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 256 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1436,7 +1435,6 @@ static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 1;
     amc->i2c_init  = quanta_q71l_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 128 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1455,7 +1453,6 @@ static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
     amc->num_cs    = 1;
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 256 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1474,7 +1471,6 @@ static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
     amc->num_cs    = 1;
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1492,7 +1488,6 @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635f";
     amc->num_cs    = 1;
     amc->i2c_init  = ast2500_evb_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1511,7 +1506,6 @@ static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 2;
     amc->i2c_init  = yosemitev2_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1529,7 +1523,6 @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = romulus_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1548,7 +1541,6 @@ static void aspeed_machine_tiogapass_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 2;
     amc->i2c_init  = tiogapass_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1566,7 +1558,6 @@ static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = sonorapass_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1584,7 +1575,6 @@ static void aspeed_machine_witherspoon_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = witherspoon_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1606,7 +1596,6 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                      ASPEED_MAC3_ON;
     amc->sdhci_wp_inverted = true;
     amc->i2c_init  = ast2600_evb_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1625,7 +1614,6 @@ static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = g220a_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1024 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1644,7 +1632,6 @@ static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = fp5280g2_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1663,7 +1650,6 @@ static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = rainier_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1686,7 +1672,6 @@ static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
     amc->macs_mask = ASPEED_MAC3_ON;
     amc->i2c_init = fuji_bmc_i2c_init;
     amc->uart_default = ASPEED_DEV_UART1;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = FUJI_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1708,7 +1693,6 @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON;
     amc->i2c_init  = bletchley_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = BLETCHLEY_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1728,7 +1712,6 @@ static void aspeed_machine_catalina_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON;
     amc->i2c_init  = catalina_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = CATALINA_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1796,7 +1779,6 @@ static void aspeed_machine_fby35_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC3_ON;
     amc->i2c_init  = fby35_i2c_init;
-    mc->auto_create_sdcard = true;
     /* FIXME: Replace this macro with something more general */
     mc->default_ram_size = FUJI_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
@@ -1909,7 +1891,6 @@ static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
     amc->vbootrom = true;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1932,7 +1913,6 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
     amc->vbootrom = true;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1953,7 +1933,6 @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1973,7 +1952,6 @@ static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };

From c0c05762804f33f3c5edbde77ecadbc315dfee3a Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 3 Oct 2025 15:21:02 +0800
Subject: [PATCH 1264/2396] tests/functional/arm/test_aspeed_ast1030: Update
 test ASPEED SDK v03.03
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251003072107.3530642-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast1030.py | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1030.py b/tests/functional/arm/test_aspeed_ast1030.py
index e47b597d0b..60e2b0251c 100755
--- a/tests/functional/arm/test_aspeed_ast1030.py
+++ b/tests/functional/arm/test_aspeed_ast1030.py
@@ -13,17 +13,17 @@ from qemu_test import exec_command_and_wait_for_pattern
 
 class AST1030Machine(AspeedTest):
 
-    ASSET_ZEPHYR_3_02 = Asset(
+    ASSET_ZEPHYR_3_03 = Asset(
         ('https://github.com/AspeedTech-BMC'
-         '/zephyr/releases/download/v00.03.02/ast1030-evb-demo.zip'),
-        '1ec83caab3ddd5d09481772801be7210e222cb015ce22ec6fffb8a76956dcd4f')
+         '/zephyr/releases/download/v00.03.03/ast1030-evb-demo.zip'),
+         '27cd73cdee6374bceb4ee58b3ace87989fa3f0684f4e612510804b588b24d4e0')
 
-    def test_arm_ast1030_zephyros_3_02(self):
+    def test_arm_ast1030_zephyros_3_03(self):
         self.set_machine('ast1030-evb')
 
-        kernel_name = "ast1030-evb-demo-3/zephyr.elf"
+        kernel_name = "ast1030-evb-demo/zephyr.elf"
         kernel_file = self.archive_extract(
-            self.ASSET_ZEPHYR_3_02, member=kernel_name)
+            self.ASSET_ZEPHYR_3_03, member=kernel_name)
 
         self.vm.set_console()
         self.vm.add_args('-kernel', kernel_file, '-nographic')
@@ -72,8 +72,9 @@ class AST1030Machine(AspeedTest):
     def test_arm_ast1030_otp_blockdev_device(self):
         self.vm.set_machine("ast1030-evb")
 
-        kernel_name = "ast1030-evb-demo-3/zephyr.elf"
-        kernel_file = self.archive_extract(self.ASSET_ZEPHYR_3_02, member=kernel_name)
+        kernel_name = "ast1030-evb-demo/zephyr.elf"
+        kernel_file = self.archive_extract(self.ASSET_ZEPHYR_3_03,
+                                           member=kernel_name)
         otp_img = self.generate_otpmem_image()
 
         self.vm.set_console()

From 47105ec4dca077d0c535a02adb40645205106da5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 3 Oct 2025 15:21:03 +0800
Subject: [PATCH 1265/2396] tests/functional/arm/test_aspeed_ast2500: Update
 test ASPEED SDK v09.08
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251003072107.3530642-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2500.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast2500.py b/tests/functional/arm/test_aspeed_ast2500.py
index 4fdd81e2f9..5efd104c2b 100755
--- a/tests/functional/arm/test_aspeed_ast2500.py
+++ b/tests/functional/arm/test_aspeed_ast2500.py
@@ -37,14 +37,14 @@ class AST2500Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V907_AST2500 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2500-default-obmc.tar.gz',
-        'd52bcc279a37c8d7679b3e4ef22cc77c36f0f6624c687b37334f798828afb077')
+    ASSET_SDK_V908_AST2500 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2500-default-obmc.tar.gz',
+        'c0a2ba169efd19be5eb77c50ec2a6afd9d826e196a0be3432f969fc72d4b7c0e')
 
     def test_arm_ast2500_evb_sdk(self):
         self.set_machine('ast2500-evb')
 
-        self.archive_extract(self.ASSET_SDK_V907_AST2500)
+        self.archive_extract(self.ASSET_SDK_V908_AST2500)
 
         self.do_test_arm_aspeed_sdk_start(
             self.scratch_file("ast2500-default", "image-bmc"))

From c4a9ecac40b360d1ebfc381981052d9e5024df16 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 3 Oct 2025 15:21:04 +0800
Subject: [PATCH 1266/2396] tests/functional/arm/test_aspeed_ast2600: Update
 test ASPEED SDK v09.08
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251003072107.3530642-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/test_aspeed_ast2600.py | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600.py
index f655c0ba0c..0127913cfb 100755
--- a/tests/functional/arm/test_aspeed_ast2600.py
+++ b/tests/functional/arm/test_aspeed_ast2600.py
@@ -97,9 +97,9 @@ class AST2600Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V907_AST2600 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2600-default-obmc.tar.gz',
-        'cb6c08595bcbba1672ce716b068ba4e48eda1ed9abe78a07b30392ba2278feba')
+    ASSET_SDK_V908_AST2600 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2600-default-obmc.tar.gz',
+        'a0414f14ad696550efe083c2156dbeda855c08cc9ae7f40fe1b41bf292295f82')
 
     def do_ast2600_pcie_test(self):
         exec_command_and_wait_for_pattern(self,
@@ -122,7 +122,7 @@ class AST2600Machine(AspeedTest):
         self.set_machine('ast2600-evb')
         self.require_netdev('user')
 
-        self.archive_extract(self.ASSET_SDK_V907_AST2600)
+        self.archive_extract(self.ASSET_SDK_V908_AST2600)
 
         self.vm.add_args('-device',
             'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
@@ -160,7 +160,7 @@ class AST2600Machine(AspeedTest):
     def test_arm_ast2600_otp_blockdev_device(self):
         self.vm.set_machine("ast2600-evb")
 
-        image_path = self.archive_extract(self.ASSET_SDK_V907_AST2600)
+        image_path = self.archive_extract(self.ASSET_SDK_V908_AST2600)
         otp_img = self.generate_otpmem_image()
 
         self.vm.set_console()

From fecf7b8e4cb6c23f5c7f1a12d511c26fb61756bf Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 3 Oct 2025 15:21:05 +0800
Subject: [PATCH 1267/2396] tests/functional/aarch64/test_aspeed_ast2700:
 Update test ASPEED SDK v09.08 for A1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Support for AST2700 A0 was dropped starting from SDK v09.07.
The new SDK v09.08 only updates support for AST2700 A1.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251003072107.3530642-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 .../functional/aarch64/test_aspeed_ast2700.py  | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index 0973fce0e9..0e9f10d991 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -50,13 +50,9 @@ class AST2x00MachineSDK(QemuSystemTest):
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-a0-default-obmc.tar.gz',
             '7247b6f19dbfb700686f8d9f723ac23f3eb229226c0589cb9b06b80d1b61f3cb')
 
-    ASSET_SDK_V906_AST2700A1 = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-default-obmc.tar.gz',
-            'f1d53e0be8a404ecce3e105f72bc50fa4e090ad13160ffa91b10a6e0233a9dc6')
-
-    ASSET_SDK_V907_AST2700A1_VBOOROM = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.07/ast2700-default-obmc.tar.gz',
-            '6e9e0c4b13e0f26040eca3f4a7f17cf09fc0f5c37c820500ff79370cc3c44add')
+    ASSET_SDK_V908_AST2700A1 = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
+            'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
 
     def do_ast2700_i2c_test(self):
         exec_command_and_wait_for_pattern(self,
@@ -133,11 +129,11 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.verify_openbmc_boot_and_login('ast2700-a0-default')
         self.do_ast2700_i2c_test()
 
-    def test_aarch64_ast2700a1_evb_sdk_v09_06(self):
+    def test_aarch64_ast2700a1_evb_sdk_v09_08(self):
         self.set_machine('ast2700a1-evb')
         self.require_netdev('user')
 
-        self.archive_extract(self.ASSET_SDK_V906_AST2700A1)
+        self.archive_extract(self.ASSET_SDK_V908_AST2700A1)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
         self.start_ast2700_test('ast2700-default')
@@ -145,11 +141,11 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_ast2700_i2c_test()
         self.do_ast2700_pcie_test()
 
-    def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_07(self):
+    def test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_08(self):
         self.set_machine('ast2700a1-evb')
         self.require_netdev('user')
 
-        self.archive_extract(self.ASSET_SDK_V907_AST2700A1_VBOOROM)
+        self.archive_extract(self.ASSET_SDK_V908_AST2700A1)
         self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.2')
         self.vm.add_args('-netdev', 'user,id=net1')
         self.start_ast2700_test_vbootrom('ast2700-default')

From 783559aece0c0e59c35a8c63954f841d89a661b5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 3 Oct 2025 15:21:06 +0800
Subject: [PATCH 1268/2396] tests/functional/aarch64/test_aspeed_ast2700: Move
 eth2 IP check into common function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The eth2 IP address check was previously only performed in
test_aarch64_ast2700a1_evb_sdk_vbootrom_v09_08. This patch moves the
check into do_ast2700_pcie_test(), ensuring it is executed consistently
across all AST2700 PCIe test runs. This avoids code duplication.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251003072107.3530642-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index 0e9f10d991..ef7ed522af 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -74,6 +74,9 @@ class AST2x00MachineSDK(QemuSystemTest):
             'lspci -s 0002:01:00.0',
             '0002:01:00.0 Ethernet controller: '
             'Intel Corporation 82574L Gigabit Network Connection')
+        exec_command_and_wait_for_pattern(self,
+            'ip addr show dev eth2',
+            'inet 10.0.2.15/24')
 
     def start_ast2700_test(self, name):
         num_cpu = 4
@@ -153,9 +156,6 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()
         self.do_ast2700_pcie_test()
-        exec_command_and_wait_for_pattern(self,
-            'ip addr show dev eth2',
-            'inet 10.0.2.15/24')
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From 511ea9a865f7da820bea5dc22c9340e5d4fc32f5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 11:00:31 +0200
Subject: [PATCH 1269/2396] tests/functional/arm: Split the ast2600 tests in
 two files
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ast2600 test file currently includes tests for both the Buildroot
and SDK images. Since the SDK image tests can take long to run, split
them into a separate file to clearly distinguish the two sets of
tests, improve parallelism and allow for different CI timeouts.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20251007090031.679003-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/arm/meson.build              |  6 +-
 ...00.py => test_aspeed_ast2600_buildroot.py} | 74 ---------------
 .../functional/arm/test_aspeed_ast2600_sdk.py | 94 +++++++++++++++++++
 3 files changed, 98 insertions(+), 76 deletions(-)
 rename tests/functional/arm/{test_aspeed_ast2600.py => test_aspeed_ast2600_buildroot.py} (57%)
 create mode 100755 tests/functional/arm/test_aspeed_ast2600_sdk.py

diff --git a/tests/functional/arm/meson.build b/tests/functional/arm/meson.build
index e4e7dba8d0..d1ed076a6a 100644
--- a/tests/functional/arm/meson.build
+++ b/tests/functional/arm/meson.build
@@ -5,7 +5,8 @@ test_arm_timeouts = {
   'aspeed_romulus' : 120,
   'aspeed_witherspoon' : 120,
   'aspeed_ast2500' : 720,
-  'aspeed_ast2600' : 1200,
+  'aspeed_ast2600_buildroot' : 720,
+  'aspeed_ast2600_sdk' : 1200,
   'aspeed_bletchley' : 480,
   'aspeed_catalina' : 480,
   'aspeed_gb200nvl_bmc' : 480,
@@ -31,7 +32,8 @@ tests_arm_system_thorough = [
   'aspeed_romulus',
   'aspeed_witherspoon',
   'aspeed_ast2500',
-  'aspeed_ast2600',
+  'aspeed_ast2600_buildroot',
+  'aspeed_ast2600_sdk',
   'aspeed_bletchley',
   'aspeed_catalina',
   'aspeed_gb200nvl_bmc',
diff --git a/tests/functional/arm/test_aspeed_ast2600.py b/tests/functional/arm/test_aspeed_ast2600_buildroot.py
similarity index 57%
rename from tests/functional/arm/test_aspeed_ast2600.py
rename to tests/functional/arm/test_aspeed_ast2600_buildroot.py
index 0127913cfb..51f2676c90 100755
--- a/tests/functional/arm/test_aspeed_ast2600.py
+++ b/tests/functional/arm/test_aspeed_ast2600_buildroot.py
@@ -97,80 +97,6 @@ class AST2600Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
-    ASSET_SDK_V908_AST2600 = Asset(
-        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2600-default-obmc.tar.gz',
-        'a0414f14ad696550efe083c2156dbeda855c08cc9ae7f40fe1b41bf292295f82')
-
-    def do_ast2600_pcie_test(self):
-        exec_command_and_wait_for_pattern(self,
-            'lspci -s 80:00.0',
-            '80:00.0 Host bridge: '
-            'ASPEED Technology, Inc. Device 2600')
-        exec_command_and_wait_for_pattern(self,
-            'lspci -s 80:08.0',
-            '80:08.0 PCI bridge: '
-            'ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge')
-        exec_command_and_wait_for_pattern(self,
-            'lspci -s 81:00.0',
-            '81:00.0 Ethernet controller: '
-            'Intel Corporation 82574L Gigabit Network Connection')
-        exec_command_and_wait_for_pattern(self,
-            'ip addr show dev eth4',
-            'inet 10.0.2.15/24')
-
-    def test_arm_ast2600_evb_sdk(self):
-        self.set_machine('ast2600-evb')
-        self.require_netdev('user')
-
-        self.archive_extract(self.ASSET_SDK_V908_AST2600)
-
-        self.vm.add_args('-device',
-            'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
-        self.vm.add_args('-device',
-            'ds1338,bus=aspeed.i2c.bus.5,address=0x32')
-        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.0')
-        self.vm.add_args('-netdev', 'user,id=net1')
-        self.do_test_arm_aspeed_sdk_start(
-            self.scratch_file("ast2600-default", "image-bmc"))
-
-        self.wait_for_console_pattern('ast2600-default login:')
-
-        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
-        exec_command_and_wait_for_pattern(self, '0penBmc',
-                                          'root@ast2600-default:~#')
-
-        exec_command_and_wait_for_pattern(self,
-            'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',
-            'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d')
-        exec_command_and_wait_for_pattern(self,
-             'cat /sys/class/hwmon/hwmon19/temp1_input', '0')
-        self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
-                    property='temperature', value=18000)
-        exec_command_and_wait_for_pattern(self,
-             'cat /sys/class/hwmon/hwmon19/temp1_input', '18000')
-
-        exec_command_and_wait_for_pattern(self,
-             'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-5/device/new_device',
-             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32')
-        year = time.strftime("%Y")
-        exec_command_and_wait_for_pattern(self,
-             '/sbin/hwclock -f /dev/rtc1', year)
-        self.do_ast2600_pcie_test()
-
-    def test_arm_ast2600_otp_blockdev_device(self):
-        self.vm.set_machine("ast2600-evb")
-
-        image_path = self.archive_extract(self.ASSET_SDK_V908_AST2600)
-        otp_img = self.generate_otpmem_image()
-
-        self.vm.set_console()
-        self.vm.add_args(
-            "-blockdev", f"driver=file,filename={otp_img},node-name=otp",
-            "-global", "aspeed-otp.drive=otp",
-        )
-        self.do_test_arm_aspeed_sdk_start(
-            self.scratch_file("ast2600-default", "image-bmc"))
-        self.wait_for_console_pattern("ast2600-default login:")
 
 if __name__ == '__main__':
     AspeedTest.main()
diff --git a/tests/functional/arm/test_aspeed_ast2600_sdk.py b/tests/functional/arm/test_aspeed_ast2600_sdk.py
new file mode 100755
index 0000000000..e3d4ed09e2
--- /dev/null
+++ b/tests/functional/arm/test_aspeed_ast2600_sdk.py
@@ -0,0 +1,94 @@
+#!/usr/bin/env python3
+#
+# Functional test that boots the ASPEED machines
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+import time
+
+from qemu_test import Asset
+from aspeed import AspeedTest
+from qemu_test import exec_command_and_wait_for_pattern
+
+
+class AST2600Machine(AspeedTest):
+
+    ASSET_SDK_V908_AST2600 = Asset(
+        'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2600-default-obmc.tar.gz',
+        'a0414f14ad696550efe083c2156dbeda855c08cc9ae7f40fe1b41bf292295f82')
+
+    def do_ast2600_pcie_test(self):
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 80:00.0',
+            '80:00.0 Host bridge: '
+            'ASPEED Technology, Inc. Device 2600')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 80:08.0',
+            '80:08.0 PCI bridge: '
+            'ASPEED Technology, Inc. AST1150 PCI-to-PCI Bridge')
+        exec_command_and_wait_for_pattern(self,
+            'lspci -s 81:00.0',
+            '81:00.0 Ethernet controller: '
+            'Intel Corporation 82574L Gigabit Network Connection')
+        exec_command_and_wait_for_pattern(self,
+            'ip addr show dev eth4',
+            'inet 10.0.2.15/24')
+
+    def test_arm_ast2600_evb_sdk(self):
+        self.set_machine('ast2600-evb')
+        self.require_netdev('user')
+
+        self.archive_extract(self.ASSET_SDK_V908_AST2600)
+
+        self.vm.add_args('-device',
+            'tmp105,bus=aspeed.i2c.bus.5,address=0x4d,id=tmp-test')
+        self.vm.add_args('-device',
+            'ds1338,bus=aspeed.i2c.bus.5,address=0x32')
+        self.vm.add_args('-device', 'e1000e,netdev=net1,bus=pcie.0')
+        self.vm.add_args('-netdev', 'user,id=net1')
+        self.do_test_arm_aspeed_sdk_start(
+            self.scratch_file("ast2600-default", "image-bmc"))
+
+        self.wait_for_console_pattern('ast2600-default login:')
+
+        exec_command_and_wait_for_pattern(self, 'root', 'Password:')
+        exec_command_and_wait_for_pattern(self, '0penBmc',
+                                          'root@ast2600-default:~#')
+
+        exec_command_and_wait_for_pattern(self,
+            'echo lm75 0x4d > /sys/class/i2c-dev/i2c-5/device/new_device',
+            'i2c i2c-5: new_device: Instantiated device lm75 at 0x4d')
+        exec_command_and_wait_for_pattern(self,
+             'cat /sys/class/hwmon/hwmon19/temp1_input', '0')
+        self.vm.cmd('qom-set', path='/machine/peripheral/tmp-test',
+                    property='temperature', value=18000)
+        exec_command_and_wait_for_pattern(self,
+             'cat /sys/class/hwmon/hwmon19/temp1_input', '18000')
+
+        exec_command_and_wait_for_pattern(self,
+             'echo ds1307 0x32 > /sys/class/i2c-dev/i2c-5/device/new_device',
+             'i2c i2c-5: new_device: Instantiated device ds1307 at 0x32')
+        year = time.strftime("%Y")
+        exec_command_and_wait_for_pattern(self,
+             '/sbin/hwclock -f /dev/rtc1', year)
+        self.do_ast2600_pcie_test()
+
+    def test_arm_ast2600_otp_blockdev_device(self):
+        self.vm.set_machine("ast2600-evb")
+
+        image_path = self.archive_extract(self.ASSET_SDK_V908_AST2600)
+        otp_img = self.generate_otpmem_image()
+
+        self.vm.set_console()
+        self.vm.add_args(
+            "-blockdev", f"driver=file,filename={otp_img},node-name=otp",
+            "-global", "aspeed-otp.drive=otp",
+        )
+        self.do_test_arm_aspeed_sdk_start(
+            self.scratch_file("ast2600-default", "image-bmc"))
+        self.wait_for_console_pattern("ast2600-default login:")
+
+
+if __name__ == '__main__':
+    AspeedTest.main()

From acd290b01726294d12f93d64e9ff1dd14f524d61 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 16:16:00 +0200
Subject: [PATCH 1270/2396] aspeed: Deprecate the sonorapass-bmc machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'sonorapass-bmc' machine represents a lab server that never
entered production. There are no functional tests for this machine
which makes harder to determine when something becomes deprecated or
unused.

Since the machine does not rely on any specific device models, it can
be replaced by the 'ast2500-evb' machine using the 'fmc-model' option
to specify the flash type. The I2C devices connected to the board can
be defined via the QEMU command line.

Cc: Patrick Williams <patrick@stwcx.xyz>
Link: https://lore.kernel.org/qemu-devel/20251007141604.761686-2-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst | 9 +++++++++
 hw/arm/aspeed.c           | 1 +
 2 files changed, 10 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 67e527740c..ce8fe9ac1b 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -285,6 +285,15 @@ and serves as the initial engineering sample rather than a production version.
 A newer revision, A1, is now supported, and the ``ast2700a1-evb`` should
 replace the older A0 version.
 
+Arm ``sonorapass-bmc`` machine (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''
+
+The ``sonorapass-bmc`` machine represents a lab server that never
+entered production. Since it does not rely on any specific device
+models, it can be replaced by the ``ast2500-evb`` machine using the
+``fmc-model`` option to specify the flash type. The I2C devices
+connected to the board can be defined via the QEMU command line.
+
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 58cfbc7137..d3a0c81f45 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1552,6 +1552,7 @@ static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
     mc->desc       = "OCP SonoraPass BMC (ARM1176)";
+    mc->deprecation_reason = "use 'ast2500-evb' instead";
     amc->soc_name  = "ast2500-a1";
     amc->hw_strap1 = SONORAPASS_BMC_HW_STRAP1;
     amc->fmc_model = "mx66l1g45g";

From b3b3b5be9cca7741bdf195d6ea7d39e5926b8c5c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 16:16:01 +0200
Subject: [PATCH 1271/2396] aspeed: Deprecate the qcom-dc-scm-v1-bmc and
 qcom-firework-bmc machines
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are no functional tests for the 'qcom-dc-scm-v1-bmc' and
'qcom-firework-bmc' machines which makes harder to determine when
something becomes deprecated or unused.

Since the machines do not rely on any specific device models, they can
be replaced by the 'ast2600-evb' machine using the 'fmc-model' option
to specify the flash type. The I2C devices connected to the board can
be defined via the QEMU command line.

Cc: Jae Hyun Yoo <quic_jaehyoo@quicinc.com>
Link: https://lore.kernel.org/qemu-devel/20251007141604.761686-3-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst | 10 ++++++++++
 hw/arm/aspeed.c           |  2 ++
 2 files changed, 12 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index ce8fe9ac1b..f6410037ea 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -294,6 +294,16 @@ models, it can be replaced by the ``ast2500-evb`` machine using the
 ``fmc-model`` option to specify the flash type. The I2C devices
 connected to the board can be defined via the QEMU command line.
 
+Arm ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` machine (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``qcom-dc-scm-v1-bmc`` and ``qcom-firework-bmc`` represent lab
+servers that never entered production. Since they do not rely on any
+specific device models, they can be replaced by the ``ast2600-evb``
+machine using the ``fmc-model`` option to specify the flash type. The
+I2C devices connected to the board can be defined via the QEMU command
+line.
+
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index d3a0c81f45..0707a760fd 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1926,6 +1926,7 @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
     mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
+    mc->deprecation_reason = "use 'ast2600-evb' instead";
     amc->soc_name  = "ast2600-a3";
     amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
     amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
@@ -1945,6 +1946,7 @@ static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
     mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
+    mc->deprecation_reason = "use 'ast2600-evb' instead";
     amc->soc_name  = "ast2600-a3";
     amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
     amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;

From a7fd1fd7b3b19fb1a597d62d9c01edfc5ff483aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 16:16:02 +0200
Subject: [PATCH 1272/2396] aspeed: Deprecate the fp5280g2-bmc machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are no functional tests for the 'fp5280g2-bmc' machine which
makes harder to determine when something becomes deprecated or unused.

Since the machine does not rely on any specific device models, it can
be replaced by the 'ast2500-evb' machine using the 'fmc-model' option
to specify the flash type. The I2C devices connected to the board can
be defined via the QEMU command line.

Cc: John Wang <wangzq.jn@gmail.com>
Link: https://lore.kernel.org/qemu-devel/20251007141604.761686-4-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/about/deprecated.rst | 8 ++++++++
 hw/arm/aspeed.c           | 1 +
 2 files changed, 9 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index f6410037ea..98361f5832 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -304,6 +304,14 @@ machine using the ``fmc-model`` option to specify the flash type. The
 I2C devices connected to the board can be defined via the QEMU command
 line.
 
+Arm ``fp5280g2-bmc`` machine (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''
+
+The ``fp5280g2-bmc`` machine does not rely on any specific device
+models, it can be replaced by the ``ast2500-evb`` machine using the
+``fmc-model`` option to specify the flash type. The I2C devices
+connected to the board can be defined via the QEMU command line.
+
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 0707a760fd..e73185eeb3 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1626,6 +1626,7 @@ static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
 
     mc->desc       = "Inspur FP5280G2 BMC (ARM1176)";
+    mc->deprecation_reason = "use 'ast2500-evb' instead";
     amc->soc_name  = "ast2500-a1";
     amc->hw_strap1 = FP5280G2_BMC_HW_STRAP1;
     amc->fmc_model = "n25q512a";

From 3c17823e2940c0a7756246eb57b5971ecfe197b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 16:16:03 +0200
Subject: [PATCH 1273/2396] test/functional/aarch64: Remove test for the
 ast2700a0-evb machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ast2700a0-evb' machine was deprecated in commit 6888a4a9c860 and
removal is scheduled in the QEMU 11.0 release. This change removes
the corresponding tests ahead of time to save CI resources.

Cc: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20251007141604.761686-5-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700.py | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index ef7ed522af..a60dc1259f 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -46,10 +46,6 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
         exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
 
-    ASSET_SDK_V906_AST2700 = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-a0-default-obmc.tar.gz',
-            '7247b6f19dbfb700686f8d9f723ac23f3eb229226c0589cb9b06b80d1b61f3cb')
-
     ASSET_SDK_V908_AST2700A1 = Asset(
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
             'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
@@ -124,14 +120,6 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
                 self.scratch_file(name, 'image-bmc'))
 
-    def test_aarch64_ast2700a0_evb_sdk_v09_06(self):
-        self.set_machine('ast2700a0-evb')
-
-        self.archive_extract(self.ASSET_SDK_V906_AST2700)
-        self.start_ast2700_test('ast2700-a0-default')
-        self.verify_openbmc_boot_and_login('ast2700-a0-default')
-        self.do_ast2700_i2c_test()
-
     def test_aarch64_ast2700a1_evb_sdk_v09_08(self):
         self.set_machine('ast2700a1-evb')
         self.require_netdev('user')

From 1f993447cf432cf1d2bf12284e80b395518ea0bc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 7 Oct 2025 16:16:04 +0200
Subject: [PATCH 1274/2396] test/functional/aarch64: Split the ast2700a1-evb
 OpenBMC boot test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'ast2700a1-evb' machine has two functional tests: one loading
firmware components into memory and another using a vbootrom
image. Both tests perform a full OpenBMC boot and run checks on I2C
and PCIe devices, which is redundant and time-consuming.

To save CI resources, the vbootrom test is refactored to focus on the
firmware boot process only. The OpenBMC boot verification logic is
split and a new verify_openbmc_boot_start() helper is introduced to
only wait for the kernel to start.

The vbootrom test now uses this function and the less essential I2C
and PCIe checks have been removed from this test case.

Cc: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20251007141604.761686-6-clg@redhat.com
[ clg: Changed pattern from 'Starting kernel ...' to 'Linux version ' ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700.py | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700.py b/tests/functional/aarch64/test_aspeed_ast2700.py
index a60dc1259f..0ced1a2502 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700.py
@@ -37,10 +37,13 @@ class AST2x00MachineSDK(QemuSystemTest):
         wait_for_console_pattern(self, 'done')
         wait_for_console_pattern(self, 'Jumping to BL31 (Trusted Firmware-A)')
 
-    def verify_openbmc_boot_and_login(self, name):
+    def verify_openbmc_boot_start(self):
         wait_for_console_pattern(self, 'U-Boot 2023.10')
         wait_for_console_pattern(self, '## Loading kernel from FIT Image')
-        wait_for_console_pattern(self, 'Starting kernel ...')
+        wait_for_console_pattern(self, 'Linux version ')
+
+    def verify_openbmc_boot_and_login(self, name):
+        self.verify_openbmc_boot_start()
 
         wait_for_console_pattern(self, f'{name} login:')
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
@@ -141,9 +144,7 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.vm.add_args('-netdev', 'user,id=net1')
         self.start_ast2700_test_vbootrom('ast2700-default')
         self.verify_vbootrom_firmware_flow()
-        self.verify_openbmc_boot_and_login('ast2700-default')
-        self.do_ast2700_i2c_test()
-        self.do_ast2700_pcie_test()
+        self.verify_openbmc_boot_start()
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From 03c9c22f9019a98973227bc49db8819a35e78680 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:13 +0800
Subject: [PATCH 1275/2396] hw/arm/aspeed: Remove AspeedSoCState dependency
 from aspeed_uart_first() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the aspeed_uart_first() helper to remove its dependency on
AspeedSoCState and make the UART helper APIs more generic.

The function now takes uarts_base as an integer parameter instead of
requiring a full SoC class instance. Corresponding call sites in
aspeed.c and aspeed_soc_common.c are updated accordingly.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 2 +-
 hw/arm/aspeed_soc_common.c  | 2 +-
 include/hw/arm/aspeed_soc.h | 6 +++---
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index e73185eeb3..49d8debf99 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1310,7 +1310,7 @@ static void aspeed_set_bmc_console(Object *obj, const char *value, Error **errp)
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(object_class_by_name(amc->soc_name));
     int val;
-    int uart_first = aspeed_uart_first(sc);
+    int uart_first = aspeed_uart_first(sc->uarts_base);
     int uart_last = aspeed_uart_last(sc);
 
     if (sscanf(value, "uart%u", &val) != 1) {
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index bc70e864fb..a4e74acdce 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -62,7 +62,7 @@ bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
 void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
 {
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    int uart_first = aspeed_uart_first(sc);
+    int uart_first = aspeed_uart_first(sc->uarts_base);
     int uart_index = aspeed_uart_index(dev);
     int i = uart_index - uart_first;
 
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index ed32efb543..5786fbbcbb 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -326,14 +326,14 @@ static inline int aspeed_uart_index(int uart_dev)
     return uart_dev - ASPEED_DEV_UART0;
 }
 
-static inline int aspeed_uart_first(AspeedSoCClass *sc)
+static inline int aspeed_uart_first(int uarts_base)
 {
-    return aspeed_uart_index(sc->uarts_base);
+    return aspeed_uart_index(uarts_base);
 }
 
 static inline int aspeed_uart_last(AspeedSoCClass *sc)
 {
-    return aspeed_uart_first(sc) + sc->uarts_num - 1;
+    return aspeed_uart_first(sc->uarts_base) + sc->uarts_num - 1;
 }
 
 #endif /* ASPEED_SOC_H */

From 37d2e4b5339ac3d584f8c9b0396c9060f52f12a0 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:14 +0800
Subject: [PATCH 1276/2396] hw/arm/aspeed: Remove AspeedSoCClass dependency
 from aspeed_uart_last() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the aspeed_uart_last() helper to remove its dependency on
AspeedSoCClass and make the UART helper APIs more generic.

The function now takes uarts_base and uarts_num as integer
parameters instead of requiring a full SoC class instance.
All related call sites in aspeed.c are updated accordingly.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 2 +-
 include/hw/arm/aspeed_soc.h | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 49d8debf99..ad17471c8d 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1311,7 +1311,7 @@ static void aspeed_set_bmc_console(Object *obj, const char *value, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(object_class_by_name(amc->soc_name));
     int val;
     int uart_first = aspeed_uart_first(sc->uarts_base);
-    int uart_last = aspeed_uart_last(sc);
+    int uart_last = aspeed_uart_last(sc->uarts_base, sc->uarts_num);
 
     if (sscanf(value, "uart%u", &val) != 1) {
         error_setg(errp, "Bad value for \"uart\" property");
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 5786fbbcbb..0162738f88 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -331,9 +331,9 @@ static inline int aspeed_uart_first(int uarts_base)
     return aspeed_uart_index(uarts_base);
 }
 
-static inline int aspeed_uart_last(AspeedSoCClass *sc)
+static inline int aspeed_uart_last(int uarts_base, int uarts_num)
 {
-    return aspeed_uart_first(sc->uarts_base) + sc->uarts_num - 1;
+    return aspeed_uart_first(uarts_base) + uarts_num - 1;
 }
 
 #endif /* ASPEED_SOC_H */

From 8f1ceec735cb3b44b68ee7dd129d8844f81e39c3 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:15 +0800
Subject: [PATCH 1277/2396] hw/arm/aspeed: Remove AspeedSoCState dependency
 from aspeed_soc_uart_set_chr() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the aspeed_soc_uart_set_chr() helper to remove its dependency
on AspeedSoCState and make the UART character device binding more
generic.

The function now takes SerialMM *uart, uarts_base, and uarts_num
as arguments instead of relying on AspeedSoCState. All affected call
sites in aspeed.c, aspeed_ast27x0-fc.c, and fby35.c are updated
to use the new parameter format.

This improves API flexibility and enables reuse across different Aspeed
SoC variants without requiring access to internal SoC state.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             |  6 ++++--
 hw/arm/aspeed_ast27x0-fc.c  | 13 ++++++++++---
 hw/arm/aspeed_soc_common.c  | 10 +++++-----
 hw/arm/fby35.c              | 10 ++++++++--
 include/hw/arm/aspeed_soc.h |  3 ++-
 5 files changed, 29 insertions(+), 13 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ad17471c8d..21ee62f750 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -299,12 +299,14 @@ static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     int uart_chosen = bmc->uart_chosen ? bmc->uart_chosen : amc->uart_default;
 
-    aspeed_soc_uart_set_chr(s, uart_chosen, serial_hd(0));
+    aspeed_soc_uart_set_chr(s->uart, uart_chosen, sc->uarts_base,
+                            sc->uarts_num, serial_hd(0));
     for (int i = 1, uart = sc->uarts_base; i < sc->uarts_num; uart++) {
         if (uart == uart_chosen) {
             continue;
         }
-        aspeed_soc_uart_set_chr(s, uart, serial_hd(i++));
+        aspeed_soc_uart_set_chr(s->uart, uart, sc->uarts_base, sc->uarts_num,
+                                serial_hd(i++));
     }
 }
 
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 2e16a0340a..e598f57ca2 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -91,7 +91,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
                             AST2700FC_HW_STRAP1, &error_abort);
     object_property_set_int(OBJECT(&s->ca35), "hw-strap2",
                             AST2700FC_HW_STRAP2, &error_abort);
-    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART12, serial_hd(0));
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART12, sc->uarts_base,
+                            sc->uarts_num, serial_hd(0));
     if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
         return false;
     }
@@ -115,6 +116,7 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
 static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 {
     AspeedSoCState *soc;
+    AspeedSoCClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     s->ssp_sysclk = clock_new(OBJECT(s), "SSP_SYSCLK");
     clock_set_hz(s->ssp_sysclk, 200000000ULL);
@@ -128,7 +130,9 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
                              OBJECT(&s->ssp_memory), &error_abort);
 
     soc = ASPEED_SOC(&s->ssp);
-    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART4, serial_hd(1));
+    sc = ASPEED_SOC_GET_CLASS(soc);
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART4, sc->uarts_base,
+                            sc->uarts_num, serial_hd(1));
     if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
         return false;
     }
@@ -139,6 +143,7 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
 {
     AspeedSoCState *soc;
+    AspeedSoCClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     s->tsp_sysclk = clock_new(OBJECT(s), "TSP_SYSCLK");
     clock_set_hz(s->tsp_sysclk, 200000000ULL);
@@ -152,7 +157,9 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
                              OBJECT(&s->tsp_memory), &error_abort);
 
     soc = ASPEED_SOC(&s->tsp);
-    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART7, serial_hd(2));
+    sc = ASPEED_SOC_GET_CLASS(soc);
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
+                            sc->uarts_num, serial_hd(2));
     if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
         return false;
     }
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index a4e74acdce..ddcbba0020 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -59,15 +59,15 @@ bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
     return true;
 }
 
-void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr)
+void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
+                             int uarts_num, Chardev *chr)
 {
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    int uart_first = aspeed_uart_first(sc->uarts_base);
+    int uart_first = aspeed_uart_first(uarts_base);
     int uart_index = aspeed_uart_index(dev);
     int i = uart_index - uart_first;
 
-    g_assert(0 <= i && i < ARRAY_SIZE(s->uart) && i < sc->uarts_num);
-    qdev_prop_set_chr(DEVICE(&s->uart[i]), "chardev", chr);
+    g_assert(0 <= i && i < ASPEED_UARTS_NUM && i < uarts_num);
+    qdev_prop_set_chr(DEVICE(&uart[i]), "chardev", chr);
 }
 
 /*
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index c14fc2efe9..5a94c847d3 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -71,9 +71,11 @@ static void fby35_bmc_write_boot_rom(DriveInfo *dinfo, MemoryRegion *mr,
 static void fby35_bmc_init(Fby35State *s)
 {
     AspeedSoCState *soc;
+    AspeedSoCClass *sc;
 
     object_initialize_child(OBJECT(s), "bmc", &s->bmc, "ast2600-a3");
     soc = ASPEED_SOC(&s->bmc);
+    sc = ASPEED_SOC_GET_CLASS(soc);
 
     memory_region_init(&s->bmc_memory, OBJECT(&s->bmc), "bmc-memory",
                        UINT64_MAX);
@@ -91,7 +93,8 @@ static void fby35_bmc_init(Fby35State *s)
                             &error_abort);
     object_property_set_int(OBJECT(&s->bmc), "hw-strap2", 0x00000003,
                             &error_abort);
-    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(0));
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base,
+                            sc->uarts_num, serial_hd(0));
     qdev_realize(DEVICE(&s->bmc), NULL, &error_abort);
 
     aspeed_board_init_flashes(&soc->fmc, "n25q00", 2, 0);
@@ -118,12 +121,14 @@ static void fby35_bmc_init(Fby35State *s)
 static void fby35_bic_init(Fby35State *s)
 {
     AspeedSoCState *soc;
+    AspeedSoCClass *sc;
 
     s->bic_sysclk = clock_new(OBJECT(s), "SYSCLK");
     clock_set_hz(s->bic_sysclk, 200000000ULL);
 
     object_initialize_child(OBJECT(s), "bic", &s->bic, "ast1030-a1");
     soc = ASPEED_SOC(&s->bic);
+    sc = ASPEED_SOC_GET_CLASS(soc);
 
     memory_region_init(&s->bic_memory, OBJECT(&s->bic), "bic-memory",
                        UINT64_MAX);
@@ -131,7 +136,8 @@ static void fby35_bic_init(Fby35State *s)
     qdev_connect_clock_in(DEVICE(&s->bic), "sysclk", s->bic_sysclk);
     object_property_set_link(OBJECT(&s->bic), "memory", OBJECT(&s->bic_memory),
                              &error_abort);
-    aspeed_soc_uart_set_chr(soc, ASPEED_DEV_UART5, serial_hd(1));
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART5, sc->uarts_base,
+                            sc->uarts_num, serial_hd(1));
     qdev_realize(DEVICE(&s->bic), NULL, &error_abort);
 
     aspeed_board_init_flashes(&soc->fmc, "sst25vf032b", 2, 2);
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 0162738f88..c870bf5586 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -306,7 +306,8 @@ enum {
 
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
-void aspeed_soc_uart_set_chr(AspeedSoCState *s, int dev, Chardev *chr);
+void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
+                             int uarts_num, Chardev *chr);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
 void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,

From bb3219345aa195b1ac3d0c91ab30d90d2fc85c16 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:16 +0800
Subject: [PATCH 1278/2396] hw/arm/aspeed: Remove AspeedSoCClass dependency
 from aspeed_soc_cpu_type() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the aspeed_soc_cpu_type() helper to remove its dependency on
AspeedSoCClass and make CPU type retrieval more generic.

The function now takes valid_cpu_types as a const char * const *
parameter instead of requiring a full AspeedSoCClass instance.
All corresponding call sites in various Aspeed SoC initialization files
(aspeed_ast10x0.c, aspeed_ast2400.c, aspeed_ast2600.c,
aspeed_ast27x0.c, and related variants) are updated accordingly.

This change simplifies the API, eliminates unnecessary type coupling,
and improves code reusability across different SoC families.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c     |  3 ++-
 hw/arm/aspeed_ast2400.c     |  2 +-
 hw/arm/aspeed_ast2600.c     |  2 +-
 hw/arm/aspeed_ast27x0-ssp.c |  3 ++-
 hw/arm/aspeed_ast27x0-tsp.c |  3 ++-
 hw/arm/aspeed_ast27x0.c     |  2 +-
 hw/arm/aspeed_soc_common.c  | 10 +++++-----
 include/hw/arm/aspeed_soc.h |  3 +--
 8 files changed, 15 insertions(+), 13 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index c446e70b24..dab012aa95 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -211,7 +211,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     /* AST1030 CPU Core */
     armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
-    qdev_prop_set_string(armv7m, "cpu-type", aspeed_soc_cpu_type(sc));
+    qdev_prop_set_string(armv7m, "cpu-type",
+                         aspeed_soc_cpu_type(sc->valid_cpu_types));
     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
     object_property_set_link(OBJECT(&a->armv7m), "memory",
                              OBJECT(s->memory), &error_abort);
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index c7b0f21887..53c2a5156d 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -157,7 +157,7 @@ static void aspeed_ast2400_soc_init(Object *obj)
 
     for (i = 0; i < sc->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", &a->cpu[i],
-                                aspeed_soc_cpu_type(sc));
+                                aspeed_soc_cpu_type(sc->valid_cpu_types));
     }
 
     snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 03e5df96bb..0299d97929 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -167,7 +167,7 @@ static void aspeed_soc_ast2600_init(Object *obj)
 
     for (i = 0; i < sc->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", &a->cpu[i],
-                                aspeed_soc_cpu_type(sc));
+                                aspeed_soc_cpu_type(sc->valid_cpu_types));
     }
 
     snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 80ec5996c1..490e98b924 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -174,7 +174,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     /* AST27X0 SSP Core */
     armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
-    qdev_prop_set_string(armv7m, "cpu-type", aspeed_soc_cpu_type(sc));
+    qdev_prop_set_string(armv7m, "cpu-type",
+                         aspeed_soc_cpu_type(sc->valid_cpu_types));
     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
     object_property_set_link(OBJECT(&a->armv7m), "memory",
                              OBJECT(s->memory), &error_abort);
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 4e0efaef07..d83f90ef00 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -174,7 +174,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     /* AST27X0 TSP Core */
     armv7m = DEVICE(&a->armv7m);
     qdev_prop_set_uint32(armv7m, "num-irq", 256);
-    qdev_prop_set_string(armv7m, "cpu-type", aspeed_soc_cpu_type(sc));
+    qdev_prop_set_string(armv7m, "cpu-type",
+                         aspeed_soc_cpu_type(sc->valid_cpu_types));
     qdev_connect_clock_in(armv7m, "cpuclk", s->sysclk);
     object_property_set_link(OBJECT(&a->armv7m), "memory",
                              OBJECT(s->memory), &error_abort);
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 853339119f..2f018e9e58 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -436,7 +436,7 @@ static void aspeed_soc_ast2700_init(Object *obj)
 
     for (i = 0; i < sc->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", &a->cpu[i],
-                                aspeed_soc_cpu_type(sc));
+                                aspeed_soc_cpu_type(sc->valid_cpu_types));
     }
 
     object_initialize_child(obj, "gic", &a->gic, gicv3_class_name());
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index ddcbba0020..16c7c4bb78 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -22,12 +22,12 @@
 #include "qemu/datadir.h"
 
 
-const char *aspeed_soc_cpu_type(AspeedSoCClass *sc)
+const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types)
 {
-    assert(sc->valid_cpu_types);
-    assert(sc->valid_cpu_types[0]);
-    assert(!sc->valid_cpu_types[1]);
-    return sc->valid_cpu_types[0];
+    assert(valid_cpu_types);
+    assert(valid_cpu_types[0]);
+    assert(!valid_cpu_types[1]);
+    return valid_cpu_types[0];
 }
 
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index c870bf5586..385b657b50 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -202,8 +202,6 @@ struct AspeedSoCClass {
     bool (*boot_from_emmc)(AspeedSoCState *s);
 };
 
-const char *aspeed_soc_cpu_type(AspeedSoCClass *sc);
-
 enum {
     ASPEED_DEV_VBOOTROM,
     ASPEED_DEV_SPI_BOOT,
@@ -304,6 +302,7 @@ enum {
     ASPEED_DEV_IPC1,
 };
 
+const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
 void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,

From 448c4502a50bc4fc056726d5953eb873a2794486 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:17 +0800
Subject: [PATCH 1279/2396] hw/arm/aspeed: Remove AspeedSoCState dependency
 from aspeed_mmio_map() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor aspeed_mmio_map() to take MemoryRegion * instead of
AspeedSoCState *, making the MMIO mapping helper more generic and
decoupled from SoC state.

Update all call sites to pass s->memory (or equivalent) explicitly.
Touched files include: headers, aspeed_soc_common.c, and SoC realize
paths in AST10x0/2400/2600/27x0 (SSP/TSP) and AST2700.

This reduces coupling, improves reuse across variants, and clarifies the
API boundary between SoC state and memory mapping.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c     | 37 ++++++++++++---------
 hw/arm/aspeed_ast2400.c     | 47 +++++++++++++++------------
 hw/arm/aspeed_ast2600.c     | 65 +++++++++++++++++++++----------------
 hw/arm/aspeed_ast27x0-ssp.c |  7 ++--
 hw/arm/aspeed_ast27x0-tsp.c |  7 ++--
 hw/arm/aspeed_ast27x0.c     | 60 +++++++++++++++++++---------------
 hw/arm/aspeed_soc_common.c  |  8 ++---
 include/hw/arm/aspeed_soc.h |  3 +-
 8 files changed, 133 insertions(+), 101 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index dab012aa95..caa9feb667 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -242,7 +242,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* I2C */
 
@@ -251,7 +252,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
+                    sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
         qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                         sc->irqmap[ASPEED_DEV_I2C] + i);
@@ -263,7 +265,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i3c), 0,
+                    sc->memmap[ASPEED_DEV_I3C]);
     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
         qemu_irq irq = qdev_get_gpio_in(DEVICE(&a->armv7m),
                                         sc->irqmap[ASPEED_DEV_I3C] + i);
@@ -275,7 +278,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
@@ -284,7 +287,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->lpc), 0,
+                    sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -320,7 +324,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -331,7 +335,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
+                    sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -341,8 +346,9 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -354,9 +360,9 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -364,7 +370,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sbc), 0,
+                    sc->memmap[ASPEED_DEV_SBC]);
 
     /* HACE */
     object_property_set_link(OBJECT(&s->hace), "dram", OBJECT(&s->sram),
@@ -372,7 +379,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
@@ -387,14 +394,14 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
     /* GPIO */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index 53c2a5156d..6690752215 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -289,13 +289,15 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* VIC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&a->vic), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->vic), 0, sc->memmap[ASPEED_DEV_VIC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->vic), 0,
+                    sc->memmap[ASPEED_DEV_VIC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&a->vic), 0,
                        qdev_get_gpio_in(DEVICE(&a->cpu), ARM_CPU_IRQ));
     sysbus_connect_irq(SYS_BUS_DEVICE(&a->vic), 1,
@@ -305,7 +307,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
+                    sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
 
@@ -315,7 +318,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -326,7 +329,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
+                    sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -341,7 +345,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
+                    sc->memmap[ASPEED_DEV_I2C]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
 
@@ -349,7 +354,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
@@ -360,8 +365,9 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -377,9 +383,9 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -388,7 +394,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
@@ -398,7 +404,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
                     sc->memmap[ASPEED_DEV_SDMC]);
 
     /* Watch dog */
@@ -411,7 +417,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
     /* RAM  */
@@ -426,7 +432,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
@@ -436,7 +442,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
@@ -445,7 +451,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
@@ -454,7 +460,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
@@ -463,7 +469,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->lpc), 0,
+                    sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the VIC */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -496,7 +503,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 0299d97929..bf0ecde051 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -324,7 +324,7 @@ static bool aspeed_soc_ast2600_pcie_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie_phy[0]), errp)) {
         return false;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie_phy[0]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->pcie_phy[0]), 0,
                     sc->memmap[ASPEED_DEV_PCIE_PHY1]);
 
     object_property_set_int(OBJECT(&s->pcie[0]), "dram-base",
@@ -335,7 +335,7 @@ static bool aspeed_soc_ast2600_pcie_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie[0]), errp)) {
         return false;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie[0]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->pcie[0]), 0,
                     sc->memmap[ASPEED_DEV_PCIE0]);
 
     irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
@@ -414,7 +414,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                             &error_abort);
 
     sysbus_realize(SYS_BUS_DEVICE(&a->a7mpcore), &error_abort);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->a7mpcore), 0, ASPEED_A7MPCORE_ADDR);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->a7mpcore), 0,
+                    ASPEED_A7MPCORE_ADDR);
 
     for (i = 0; i < sc->num_cpus; i++) {
         SysBusDevice *sbd = SYS_BUS_DEVICE(&a->a7mpcore);
@@ -448,13 +449,15 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* RTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
+                    sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
 
@@ -464,7 +467,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -475,7 +478,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
+                    sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -490,7 +494,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
+                    sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
         irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                sc->irqmap[ASPEED_DEV_I2C] + i);
@@ -502,7 +507,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->peci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
@@ -518,8 +523,9 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -537,9 +543,9 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -548,7 +554,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
@@ -558,7 +564,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
                     sc->memmap[ASPEED_DEV_SDMC]);
 
     /* Watch dog */
@@ -571,7 +577,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
     /* RAM */
@@ -586,7 +592,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
@@ -597,7 +603,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
             return;
         }
 
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->mii[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->mii[i]), 0,
                         sc->memmap[ASPEED_DEV_MII1 + i]);
     }
 
@@ -605,7 +611,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->xdma), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->xdma), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
@@ -614,7 +620,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
@@ -622,7 +628,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio_1_8v), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
                     sc->memmap[ASPEED_DEV_GPIO_1_8V]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO_1_8V));
@@ -631,7 +637,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
@@ -640,7 +646,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->emmc), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->emmc), 0,
                     sc->memmap[ASPEED_DEV_EMMC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
@@ -649,7 +655,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->lpc), 0, sc->memmap[ASPEED_DEV_LPC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->lpc), 0,
+                    sc->memmap[ASPEED_DEV_LPC]);
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
@@ -685,7 +692,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
@@ -694,7 +701,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i3c), 0, sc->memmap[ASPEED_DEV_I3C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i3c), 0,
+                    sc->memmap[ASPEED_DEV_I3C]);
     for (i = 0; i < ASPEED_I3C_NR_DEVICES; i++) {
         irq = qdev_get_gpio_in(DEVICE(&a->a7mpcore),
                                sc->irqmap[ASPEED_DEV_I3C] + i);
@@ -706,14 +714,15 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sbc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sbc), 0, sc->memmap[ASPEED_DEV_SBC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sbc), 0,
+                    sc->memmap[ASPEED_DEV_SBC]);
 
     /* FSI */
     for (i = 0; i < ASPEED_FSI_NUM; i++) {
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->fsi[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fsi[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fsi[i]), 0,
                         sc->memmap[ASPEED_DEV_FSI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->fsi[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_FSI1 + i));
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 490e98b924..83cf3c14b6 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -196,14 +196,15 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* INTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[0]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[0]), 0,
                     sc->memmap[ASPEED_DEV_INTC]);
 
     /* INTCIO */
@@ -211,7 +212,7 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[1]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[1]), 0,
                     sc->memmap[ASPEED_DEV_INTCIO]);
 
     /* irq source orgates -> INTC0 */
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index d83f90ef00..86aa565608 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -196,14 +196,15 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* INTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[0]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[0]), 0,
                     sc->memmap[ASPEED_DEV_INTC]);
 
     /* INTCIO */
@@ -211,7 +212,7 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[1]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[1]), 0,
                     sc->memmap[ASPEED_DEV_INTCIO]);
 
     /* irq source orgates -> INTC */
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 2f018e9e58..8db67dc806 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -589,9 +589,9 @@ static bool aspeed_soc_ast2700_gic_realize(DeviceState *dev, Error **errp)
         return false;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->gic), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->gic), 0,
                     sc->memmap[ASPEED_GIC_DIST]);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->gic), 1,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->gic), 1,
                     sc->memmap[ASPEED_GIC_REDIST]);
 
     for (i = 0; i < sc->num_cpus; i++) {
@@ -647,7 +647,7 @@ static bool aspeed_soc_ast2700_pcie_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie_phy[i]), errp)) {
             return false;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie_phy[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->pcie_phy[i]), 0,
                         sc->memmap[ASPEED_DEV_PCIE_PHY0 + i]);
 
         object_property_set_int(OBJECT(&s->pcie[i]), "dram-base",
@@ -658,7 +658,7 @@ static bool aspeed_soc_ast2700_pcie_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->pcie[i]), errp)) {
             return false;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->pcie[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->pcie[i]), 0,
                         sc->memmap[ASPEED_DEV_PCIE0 + i]);
         irq = aspeed_soc_get_irq(s, ASPEED_DEV_PCIE0 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie[i].rc), 0, irq);
@@ -719,7 +719,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[0]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[0]), 0,
                     sc->memmap[ASPEED_DEV_INTC]);
 
     /* INTCIO */
@@ -727,7 +727,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&a->intc[1]), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&a->intc[1]), 0,
                     sc->memmap[ASPEED_DEV_INTCIO]);
 
     /* irq sources -> orgates -> INTC */
@@ -777,13 +777,14 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scu), 0, sc->memmap[ASPEED_DEV_SCU]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
+                    sc->memmap[ASPEED_DEV_SCU]);
 
     /* SCU1 */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scuio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->scuio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scuio), 0,
                     sc->memmap[ASPEED_DEV_SCUIO]);
 
     /* UART */
@@ -800,8 +801,9 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->fmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 0, sc->memmap[ASPEED_DEV_FMC]);
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->fmc), 1,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 0,
+                    sc->memmap[ASPEED_DEV_FMC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
@@ -819,9 +821,9 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->spi[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 0,
                         sc->memmap[ASPEED_DEV_SPI0 + i]);
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->spi[i]), 1,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
     }
 
@@ -830,7 +832,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ehci[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ehci[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
@@ -848,7 +850,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdmc), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdmc), 0,
                     sc->memmap[ASPEED_DEV_SDMC]);
 
     /* RAM */
@@ -865,7 +867,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->ftgmac100[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                            aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
@@ -876,7 +878,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
             return;
         }
 
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->mii[i]), 0,
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->mii[i]), 0,
                         sc->memmap[ASPEED_DEV_MII1 + i]);
     }
 
@@ -890,26 +892,28 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         if (!sysbus_realize(SYS_BUS_DEVICE(&s->wdt[i]), errp)) {
             return;
         }
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->wdt[i]), 0, wdt_offset);
     }
 
     /* SLI */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sli), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sli), 0, sc->memmap[ASPEED_DEV_SLI]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sli), 0,
+                    sc->memmap[ASPEED_DEV_SLI]);
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sliio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sliio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sliio), 0,
                     sc->memmap[ASPEED_DEV_SLIIO]);
 
     /* ADC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->adc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->adc), 0, sc->memmap[ASPEED_DEV_ADC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
+                    sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
@@ -919,7 +923,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i2c), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->i2c), 0, sc->memmap[ASPEED_DEV_I2C]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
+                    sc->memmap[ASPEED_DEV_I2C]);
     for (i = 0; i < ASPEED_I2C_GET_CLASS(&s->i2c)->num_busses; i++) {
         /*
          * The AST2700 I2C controller has one source INTC per bus.
@@ -948,7 +953,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->gpio), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
@@ -957,7 +962,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->rtc), 0, sc->memmap[ASPEED_DEV_RTC]);
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
+                    sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
 
@@ -965,7 +971,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->sdhci), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
@@ -974,7 +980,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->emmc), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->emmc), 0,
                     sc->memmap[ASPEED_DEV_EMMC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
@@ -985,7 +991,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->timerctrl), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->timerctrl), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
         irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
@@ -998,7 +1004,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->hace), errp)) {
         return;
     }
-    aspeed_mmio_map(s, SYS_BUS_DEVICE(&s->hace), 0,
+    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index 16c7c4bb78..ca4e589dce 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -53,7 +53,7 @@ bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
         }
 
         sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
-        aspeed_mmio_map(s, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
+        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
     }
 
     return true;
@@ -111,10 +111,10 @@ bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp)
     return true;
 }
 
-void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr)
+void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
+                     hwaddr addr)
 {
-    memory_region_add_subregion(s->memory, addr,
-                                sysbus_mmio_get_region(dev, n));
+    memory_region_add_subregion(memory, addr, sysbus_mmio_get_region(dev, n));
 }
 
 void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 385b657b50..606cf6bb61 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -308,7 +308,8 @@ bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
 void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
                              int uarts_num, Chardev *chr);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
-void aspeed_mmio_map(AspeedSoCState *s, SysBusDevice *dev, int n, hwaddr addr);
+void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
+                     hwaddr addr);
 void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
                                    const char *name, hwaddr addr,
                                    uint64_t size);

From 68f915b91cbf697b5f65a6aca72f260c6c29d00f Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:18 +0800
Subject: [PATCH 1280/2396] hw/arm/aspeed: Remove AspeedSoCState dependency
 from aspeed_mmio_map_unimplemented() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor aspeed_mmio_map_unimplemented() to take MemoryRegion *
instead of AspeedSoCState *, removing its dependency on SoC state and
aligning it with the updated aspeed_mmio_map() interface.

All related call sites are updated to explicitly pass s->memory.
Affected files include headers, aspeed_soc_common.c, and SoC realize
functions in AST10x0, AST2400, AST2600, AST27x0 (SSP/TSP), and AST2700.

This change simplifies the MMIO mapping helpers, improves API
consistency, and reduces coupling between SoC logic and memory
operations.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c     | 24 ++++++++++++++++--------
 hw/arm/aspeed_ast2400.c     |  6 ++++--
 hw/arm/aspeed_ast2600.c     | 12 ++++++++----
 hw/arm/aspeed_ast27x0-ssp.c |  8 ++++----
 hw/arm/aspeed_ast27x0-tsp.c |  8 ++++----
 hw/arm/aspeed_ast27x0.c     | 10 +++++-----
 hw/arm/aspeed_soc_common.c  |  4 ++--
 include/hw/arm/aspeed_soc.h |  2 +-
 8 files changed, 44 insertions(+), 30 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index caa9feb667..e861b6dad6 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -201,10 +201,12 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     }
 
     /* General I/O memory space to catch all unimplemented device */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
+                                  "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
                                   ASPEED_SOC_IOMEM_SIZE);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->sbc_unimplemented),
+    aspeed_mmio_map_unimplemented(s->memory,
+                                  SYS_BUS_DEVICE(&s->sbc_unimplemented),
                                   "aspeed.sbc", sc->memmap[ASPEED_DEV_SBC],
                                   0x40000);
 
@@ -406,20 +408,26 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
                        aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->pwm), "aspeed.pwm",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->pwm),
+                                  "aspeed.pwm",
                                   sc->memmap[ASPEED_DEV_PWM], 0x100);
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->espi), "aspeed.espi",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->espi),
+                                  "aspeed.espi",
                                   sc->memmap[ASPEED_DEV_ESPI], 0x800);
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->udc), "aspeed.udc",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->udc),
+                                  "aspeed.udc",
                                   sc->memmap[ASPEED_DEV_UDC], 0x1000);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->sgpiom), "aspeed.sgpiom",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->sgpiom),
+                                  "aspeed.sgpiom",
                                   sc->memmap[ASPEED_DEV_SGPIOM], 0x100);
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->jtag[0]), "aspeed.jtag",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[0]),
+                                  "aspeed.jtag",
                                   sc->memmap[ASPEED_DEV_JTAG0], 0x20);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->jtag[1]), "aspeed.jtag",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->jtag[1]),
+                                  "aspeed.jtag",
                                   sc->memmap[ASPEED_DEV_JTAG1], 0x20);
 }
 
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index 6690752215..e0604851a5 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -259,12 +259,14 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
                                 &s->spi_boot_container);
 
     /* IO space */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
+                                  "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
                                   ASPEED_SOC_IOMEM_SIZE);
 
     /* Video engine stub */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->video),
+                                  "aspeed.video",
                                   sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
 
     /* CPU */
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index bf0ecde051..ed0985a16e 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -370,16 +370,19 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                                 &s->spi_boot_container);
 
     /* IO space */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem), "aspeed.io",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
+                                  "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
                                   ASPEED_SOC_IOMEM_SIZE);
 
     /* Video engine stub */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->video), "aspeed.video",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->video),
+                                  "aspeed.video",
                                   sc->memmap[ASPEED_DEV_VIDEO], 0x1000);
 
     /* eMMC Boot Controller stub */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->emmc_boot_controller),
+    aspeed_mmio_map_unimplemented(s->memory,
+                                  SYS_BUS_DEVICE(&s->emmc_boot_controller),
                                   "aspeed.emmc-boot-controller",
                                   sc->memmap[ASPEED_DEV_EMMC_BC], 0x1000);
 
@@ -441,7 +444,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                                 sc->memmap[ASPEED_DEV_SRAM], &s->sram);
 
     /* DPMCU */
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu), "aspeed.dpmcu",
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->dpmcu),
+                                  "aspeed.dpmcu",
                                   sc->memmap[ASPEED_DEV_DPMCU],
                                   ASPEED_SOC_DPMCU_SIZE);
 
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 83cf3c14b6..99a3de15b5 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -241,16 +241,16 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->timerctrl),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
                                   "aspeed.timerctrl",
                                   sc->memmap[ASPEED_DEV_TIMER1], 0x200);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[0]),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[0]),
                                   "aspeed.ipc0",
                                   sc->memmap[ASPEED_DEV_IPC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[1]),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
                                   "aspeed.ipc1",
                                   sc->memmap[ASPEED_DEV_IPC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->scuio),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
                                   "aspeed.scuio",
                                   sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
 }
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 86aa565608..568d7555e2 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -241,16 +241,16 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
         return;
     }
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->timerctrl),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
                                   "aspeed.timerctrl",
                                   sc->memmap[ASPEED_DEV_TIMER1], 0x200);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[0]),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[0]),
                                   "aspeed.ipc0",
                                   sc->memmap[ASPEED_DEV_IPC0], 0x1000);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->ipc[1]),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->ipc[1]),
                                   "aspeed.ipc1",
                                   sc->memmap[ASPEED_DEV_IPC1], 0x1000);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&a->scuio),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&a->scuio),
                                   "aspeed.scuio",
                                   sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
 }
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 8db67dc806..9b645c6c55 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -1014,23 +1014,23 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->dpmcu),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->dpmcu),
                                   "aspeed.dpmcu",
                                   sc->memmap[ASPEED_DEV_DPMCU],
                                   AST2700_SOC_DPMCU_SIZE);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->ltpi),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->ltpi),
                                   "aspeed.ltpi",
                                   sc->memmap[ASPEED_DEV_LTPI],
                                   AST2700_SOC_LTPI_SIZE);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem),
                                   "aspeed.io",
                                   sc->memmap[ASPEED_DEV_IOMEM],
                                   AST2700_SOC_IO_SIZE);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem0),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem0),
                                   "aspeed.iomem0",
                                   sc->memmap[ASPEED_DEV_IOMEM0],
                                   AST2700_SOC_IOMEM_SIZE);
-    aspeed_mmio_map_unimplemented(s, SYS_BUS_DEVICE(&s->iomem1),
+    aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->iomem1),
                                   "aspeed.iomem1",
                                   sc->memmap[ASPEED_DEV_IOMEM1],
                                   AST2700_SOC_IOMEM_SIZE);
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index ca4e589dce..e7d0a9c290 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -117,14 +117,14 @@ void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
     memory_region_add_subregion(memory, addr, sysbus_mmio_get_region(dev, n));
 }
 
-void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+void aspeed_mmio_map_unimplemented(MemoryRegion *memory, SysBusDevice *dev,
                                    const char *name, hwaddr addr, uint64_t size)
 {
     qdev_prop_set_string(DEVICE(dev), "name", name);
     qdev_prop_set_uint64(DEVICE(dev), "size", size);
     sysbus_realize(dev, &error_abort);
 
-    memory_region_add_subregion_overlap(s->memory, addr,
+    memory_region_add_subregion_overlap(memory, addr,
                                         sysbus_mmio_get_region(dev, 0), -1000);
 }
 
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 606cf6bb61..957362b88d 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -310,7 +310,7 @@ void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);
 void aspeed_mmio_map(MemoryRegion *memory, SysBusDevice *dev, int n,
                      hwaddr addr);
-void aspeed_mmio_map_unimplemented(AspeedSoCState *s, SysBusDevice *dev,
+void aspeed_mmio_map_unimplemented(MemoryRegion *memory, SysBusDevice *dev,
                                    const char *name, hwaddr addr,
                                    uint64_t size);
 void aspeed_board_init_flashes(AspeedSMCState *s, const char *flashtype,

From 15f26071bf424a564e177ab1ac746b85feda5286 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:19 +0800
Subject: [PATCH 1281/2396] hw/arm/aspeed: Remove AspeedSoCState dependency
 from aspeed_soc_uart_realize() API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor aspeed_soc_uart_realize() to take MemoryRegion *, SerialMM *,
and MMIO base addr instead of AspeedSoCState *, decoupling the helper
from SoC state and making it reusable per-UART.

The helper now realizes a single UART instance and maps its MMIO.
IRQ wiring and iteration over all UARTs are moved to callers.

Update call sites in AST1030, AST2400, AST2600, AST27x0 SSP/TSP, and
AST2700 to loop over UARTs, call the new helper, and connect IRQ via
aspeed_soc_get_irq().

This simplifies the UART realize path and reduces cross-module coupling.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c     | 10 ++++++++--
 hw/arm/aspeed_ast2400.c     | 10 ++++++++--
 hw/arm/aspeed_ast2600.c     | 10 ++++++++--
 hw/arm/aspeed_ast27x0-ssp.c | 10 ++++++++--
 hw/arm/aspeed_ast27x0-tsp.c | 10 ++++++++--
 hw/arm/aspeed_ast27x0.c     | 10 ++++++++--
 hw/arm/aspeed_soc_common.c  | 28 ++++++++++------------------
 include/hw/arm/aspeed_soc.h |  3 ++-
 8 files changed, 60 insertions(+), 31 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index e861b6dad6..ff781379c1 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -192,6 +192,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     DeviceState *armv7m;
     Error *err = NULL;
+    int uart;
     int i;
     g_autofree char *sram_name = NULL;
 
@@ -316,8 +317,13 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                                 sc->irqmap[ASPEED_DEV_KCS] + aspeed_lpc_kcs_4));
 
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     /* Timer */
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index e0604851a5..8d4d6564c7 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -251,6 +251,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     AspeedSoCState *s = ASPEED_SOC(dev);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     g_autofree char *sram_name = NULL;
+    int uart;
 
     /* Default boot region (SPI memory or ROMs) */
     memory_region_init(&s->spi_boot_container, OBJECT(s),
@@ -337,8 +338,13 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     /* I2C */
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index ed0985a16e..f508bf53e7 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -362,6 +362,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     qemu_irq irq;
     g_autofree char *sram_name = NULL;
+    int uart;
 
     /* Default boot region (SPI memory or ROMs) */
     memory_region_init(&s->spi_boot_container, OBJECT(s),
@@ -488,8 +489,13 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                        aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     /* I2C */
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 99a3de15b5..7420ae04ac 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -164,6 +164,7 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sram_name = NULL;
+    int uart;
     int i;
 
     if (!clock_has_source(s->sysclk)) {
@@ -237,8 +238,13 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
                         qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
     }
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 568d7555e2..b764147a33 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -164,6 +164,7 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sram_name = NULL;
+    int uart;
     int i;
 
     if (!clock_has_source(s->sysclk)) {
@@ -237,8 +238,13 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
                         qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
     }
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 9b645c6c55..96882b8755 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -687,6 +687,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     AspeedINTCClass *icio = ASPEED_INTC_GET_CLASS(&a->intc[1]);
     g_autofree char *name = NULL;
     qemu_irq irq;
+    int uart;
 
     /* Default boot region (SPI memory or ROMs) */
     memory_region_init(&s->spi_boot_container, OBJECT(s),
@@ -788,8 +789,13 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
                     sc->memmap[ASPEED_DEV_SCUIO]);
 
     /* UART */
-    if (!aspeed_soc_uart_realize(s, errp)) {
-        return;
+    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
+        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
+                                     sc->memmap[uart], errp)) {
+            return;
+        }
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
+                           aspeed_soc_get_irq(s, uart));
     }
 
     /* FMC, The number of CS is set at the board level */
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index e7d0a9c290..a785a50609 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -35,27 +35,19 @@ qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
     return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
 }
 
-bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp)
+bool aspeed_soc_uart_realize(MemoryRegion *memory, SerialMM *smm,
+                             const hwaddr addr, Error **errp)
 {
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
-    SerialMM *smm;
-
-    for (int i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
-        smm = &s->uart[i];
-
-        /* Chardev property is set by the machine. */
-        qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
-        qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
-        qdev_set_legacy_instance_id(DEVICE(smm), sc->memmap[uart], 2);
-        qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
-        if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
-            return false;
-        }
-
-        sysbus_connect_irq(SYS_BUS_DEVICE(smm), 0, aspeed_soc_get_irq(s, uart));
-        aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(smm), 0, sc->memmap[uart]);
+    /* Chardev property is set by the machine. */
+    qdev_prop_set_uint8(DEVICE(smm), "regshift", 2);
+    qdev_prop_set_uint32(DEVICE(smm), "baudbase", 38400);
+    qdev_set_legacy_instance_id(DEVICE(smm), addr, 2);
+    qdev_prop_set_uint8(DEVICE(smm), "endianness", DEVICE_LITTLE_ENDIAN);
+    if (!sysbus_realize(SYS_BUS_DEVICE(smm), errp)) {
+        return false;
     }
 
+    aspeed_mmio_map(memory, SYS_BUS_DEVICE(smm), 0, addr);
     return true;
 }
 
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 957362b88d..47341ea2fd 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -304,7 +304,8 @@ enum {
 
 const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
 qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
-bool aspeed_soc_uart_realize(AspeedSoCState *s, Error **errp);
+bool aspeed_soc_uart_realize(MemoryRegion *memory, SerialMM *smm,
+                             const hwaddr addr, Error **errp);
 void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,
                              int uarts_num, Chardev *chr);
 bool aspeed_soc_dram_init(AspeedSoCState *s, Error **errp);

From 21b3898a6984d0bc08c5a8b3f498ddfe4ff95e44 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:20 +0800
Subject: [PATCH 1282/2396] hw/arm/aspeed: Remove the aspeed_soc_get_irq and
 class get_irq hook
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the the common aspeed_soc_get_irq. Call sites are updated to use the
SoC-specific get_irq helpers directly (aspeed_soc_ast1030_get_irq(),
_aspeed2400_get_irq(), _ast2600_get_irq(), _ast27x0ssp_get_irq(),
_ast27x0tsp_get_irq(), and _ast2700_get_irq())

This makes the IRQ lookup explicit per-SoC and drops the exported
API that depended on AspeedSoCState, reducing cross-module coupling
in the common layer.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c     | 17 ++++++++---------
 hw/arm/aspeed_ast2400.c     | 31 +++++++++++++++----------------
 hw/arm/aspeed_ast2600.c     | 34 +++++++++++++++++-----------------
 hw/arm/aspeed_ast27x0-ssp.c |  3 +--
 hw/arm/aspeed_ast27x0-tsp.c |  3 +--
 hw/arm/aspeed_ast27x0.c     | 27 +++++++++++++--------------
 hw/arm/aspeed_soc_common.c  |  5 -----
 include/hw/arm/aspeed_soc.h |  2 --
 8 files changed, 55 insertions(+), 67 deletions(-)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index ff781379c1..7f49c13391 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -284,7 +284,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_PECI));
 
     /* LPC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
@@ -295,7 +295,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_LPC));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_LPC));
 
     /*
      * On the AST1030 LPC subdevice IRQs are connected straight to the GIC.
@@ -323,7 +323,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast1030_get_irq(s, uart));
     }
 
     /* Timer */
@@ -335,7 +335,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-        qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
+        qemu_irq irq = aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_TIMER1 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
     }
 
@@ -346,7 +346,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
                     sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_ADC));
 
     /* FMC, The number of CS is set at the board level */
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(&s->sram),
@@ -359,7 +359,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_FMC));
 
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
@@ -390,7 +390,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_HACE));
 
     /* Watch dog */
     for (i = 0; i < sc->wdts_num; i++) {
@@ -412,7 +412,7 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
+                       aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_GPIO));
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->pwm),
                                   "aspeed.pwm",
@@ -463,7 +463,6 @@ static void aspeed_soc_ast1030_class_init(ObjectClass *klass, const void *data)
     sc->irqmap = aspeed_soc_ast1030_irqmap;
     sc->memmap = aspeed_soc_ast1030_memmap;
     sc->num_cpus = 1;
-    sc->get_irq = aspeed_soc_ast1030_get_irq;
 }
 
 static const TypeInfo aspeed_soc_ast10x0_types[] = {
diff --git a/hw/arm/aspeed_ast2400.c b/hw/arm/aspeed_ast2400.c
index 8d4d6564c7..b1b826b7e0 100644
--- a/hw/arm/aspeed_ast2400.c
+++ b/hw/arm/aspeed_ast2400.c
@@ -313,7 +313,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
                     sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_RTC));
 
     /* Timer */
     object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
@@ -324,7 +324,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-        qemu_irq irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
+        qemu_irq irq = aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_TIMER1 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
     }
 
@@ -335,7 +335,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
                     sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
     for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
@@ -344,7 +344,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast2400_get_irq(s, uart));
     }
 
     /* I2C */
@@ -356,7 +356,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->i2c), 0,
                     sc->memmap[ASPEED_DEV_I2C]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_I2C));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_I2C));
 
     /* PECI */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->peci), errp)) {
@@ -365,7 +365,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_PECI));
 
     /* FMC, The number of CS is set at the board level */
     object_property_set_link(OBJECT(&s->fmc), "dram", OBJECT(s->dram_mr),
@@ -378,7 +378,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_FMC));
 
     /* Set up an alias on the FMC CE0 region (boot default) */
     MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
@@ -405,7 +405,8 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
+                           aspeed_soc_ast2400_get_irq(s,
+                                                      ASPEED_DEV_EHCI1 + i));
     }
 
     /* SDMC - SDRAM Memory Controller */
@@ -443,7 +444,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
+                           aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_ETH1 + i));
     }
 
     /* XDMA */
@@ -453,7 +454,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_XDMA));
 
     /* GPIO */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -462,7 +463,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_GPIO));
 
     /* SDHCI */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
@@ -471,7 +472,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_SDHCI));
 
     /* LPC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
@@ -482,7 +483,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
 
     /* Connect the LPC IRQ to the VIC */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_LPC));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_LPC));
 
     /*
      * On the AST2400 and AST2500 the one LPC IRQ is shared between all of the
@@ -514,7 +515,7 @@ static void aspeed_ast2400_soc_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
+                       aspeed_soc_ast2400_get_irq(s, ASPEED_DEV_HACE));
 }
 
 static void aspeed_soc_ast2400_class_init(ObjectClass *oc, const void *data)
@@ -542,7 +543,6 @@ static void aspeed_soc_ast2400_class_init(ObjectClass *oc, const void *data)
     sc->irqmap       = aspeed_soc_ast2400_irqmap;
     sc->memmap       = aspeed_soc_ast2400_memmap;
     sc->num_cpus     = 1;
-    sc->get_irq      = aspeed_soc_ast2400_get_irq;
 }
 
 static void aspeed_soc_ast2500_class_init(ObjectClass *oc, const void *data)
@@ -570,7 +570,6 @@ static void aspeed_soc_ast2500_class_init(ObjectClass *oc, const void *data)
     sc->irqmap       = aspeed_soc_ast2500_irqmap;
     sc->memmap       = aspeed_soc_ast2500_memmap;
     sc->num_cpus     = 1;
-    sc->get_irq      = aspeed_soc_ast2400_get_irq;
 }
 
 static const TypeInfo aspeed_soc_ast2400_types[] = {
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index f508bf53e7..498d1ecc07 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -464,7 +464,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
                     sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_RTC));
 
     /* Timer */
     object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
@@ -475,7 +475,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-        irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
+        irq = aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_TIMER1 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
     }
 
@@ -486,7 +486,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
                     sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_ADC));
 
     /* UART */
     for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
@@ -495,7 +495,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast2600_get_irq(s, uart));
     }
 
     /* I2C */
@@ -520,7 +520,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->peci), 0,
                     sc->memmap[ASPEED_DEV_PECI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_PECI));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_PECI));
 
     /* PCIe Root Complex (RC) */
     if (!aspeed_soc_ast2600_pcie_realize(dev, errp)) {
@@ -538,7 +538,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_FMC));
 
     /* Set up an alias on the FMC CE0 region (boot default) */
     MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
@@ -567,7 +567,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
+                           aspeed_soc_ast2600_get_irq(s,
+                                                      ASPEED_DEV_EHCI1 + i));
     }
 
     /* SDMC - SDRAM Memory Controller */
@@ -605,7 +606,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
+                           aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_ETH1 + i));
 
         object_property_set_link(OBJECT(&s->mii[i]), "nic",
                                  OBJECT(&s->ftgmac100[i]), &error_abort);
@@ -624,7 +625,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->xdma), 0,
                     sc->memmap[ASPEED_DEV_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_XDMA));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_XDMA));
 
     /* GPIO */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio), errp)) {
@@ -633,7 +634,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_GPIO));
 
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->gpio_1_8v), errp)) {
         return;
@@ -641,7 +642,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
                     sc->memmap[ASPEED_DEV_GPIO_1_8V]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio_1_8v), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_GPIO_1_8V));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_GPIO_1_8V));
 
     /* SDHCI */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
@@ -650,7 +651,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_SDHCI));
 
     /* eMMC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
@@ -659,7 +660,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->emmc), 0,
                     sc->memmap[ASPEED_DEV_EMMC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_EMMC));
 
     /* LPC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->lpc), errp)) {
@@ -670,7 +671,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 
     /* Connect the LPC IRQ to the GIC. It is otherwise unused. */
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->lpc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_LPC));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_LPC));
 
     /*
      * On the AST2600 LPC subdevice IRQs are connected straight to the GIC.
@@ -705,7 +706,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
+                       aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_HACE));
 
     /* I3C */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->i3c), errp)) {
@@ -735,7 +736,7 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fsi[i]), 0,
                         sc->memmap[ASPEED_DEV_FSI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->fsi[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_FSI1 + i));
+                           aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_FSI1 + i));
     }
 }
 
@@ -771,7 +772,6 @@ static void aspeed_soc_ast2600_class_init(ObjectClass *oc, const void *data)
     sc->irqmap       = aspeed_soc_ast2600_irqmap;
     sc->memmap       = aspeed_soc_ast2600_memmap;
     sc->num_cpus     = 2;
-    sc->get_irq      = aspeed_soc_ast2600_get_irq;
     sc->boot_from_emmc = aspeed_soc_ast2600_boot_from_emmc;
 }
 
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 7420ae04ac..f90d144372 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -244,7 +244,7 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast27x0ssp_get_irq(s, uart));
     }
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
@@ -286,7 +286,6 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass, const void *dat
     sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
     sc->memmap = aspeed_soc_ast27x0ssp_memmap;
     sc->num_cpus = 1;
-    sc->get_irq = aspeed_soc_ast27x0ssp_get_irq;
 }
 
 static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index b764147a33..8643f82683 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -244,7 +244,7 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast27x0tsp_get_irq(s, uart));
     }
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
@@ -286,7 +286,6 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass, const void *dat
     sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
     sc->memmap = aspeed_soc_ast27x0tsp_memmap;
     sc->num_cpus = 1;
-    sc->get_irq = aspeed_soc_ast27x0tsp_get_irq;
 }
 
 static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 96882b8755..c484bcd4e2 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -660,7 +660,7 @@ static bool aspeed_soc_ast2700_pcie_realize(DeviceState *dev, Error **errp)
         }
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->pcie[i]), 0,
                         sc->memmap[ASPEED_DEV_PCIE0 + i]);
-        irq = aspeed_soc_get_irq(s, ASPEED_DEV_PCIE0 + i);
+        irq = aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_PCIE0 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie[i].rc), 0, irq);
 
         mmio_mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pcie[i].rc), 1);
@@ -795,7 +795,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
             return;
         }
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_get_irq(s, uart));
+                           aspeed_soc_ast2700_get_irq(s, uart));
     }
 
     /* FMC, The number of CS is set at the board level */
@@ -812,7 +812,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->fmc), 1,
                     ASPEED_SMC_GET_CLASS(&s->fmc)->flash_window_base);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->fmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_FMC));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_FMC));
 
     /* Set up an alias on the FMC CE0 region (boot default) */
     MemoryRegion *fmc0_mmio = &s->fmc.flashes[0].mmio;
@@ -841,7 +841,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ehci[i]), 0,
                         sc->memmap[ASPEED_DEV_EHCI1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ehci[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_EHCI1 + i));
+                           aspeed_soc_ast2700_get_irq(s,
+                                                      ASPEED_DEV_EHCI1 + i));
     }
 
     /*
@@ -876,7 +877,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
                         sc->memmap[ASPEED_DEV_ETH1 + i]);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100[i]), 0,
-                           aspeed_soc_get_irq(s, ASPEED_DEV_ETH1 + i));
+                           aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_ETH1 + i));
 
         object_property_set_link(OBJECT(&s->mii[i]), "nic",
                                  OBJECT(&s->ftgmac100[i]), &error_abort);
@@ -921,7 +922,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->adc), 0,
                     sc->memmap[ASPEED_DEV_ADC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->adc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_ADC));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_ADC));
 
     /* I2C */
     object_property_set_link(OBJECT(&s->i2c), "dram", OBJECT(s->dram_mr),
@@ -962,7 +963,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->gpio), 0,
                     sc->memmap[ASPEED_DEV_GPIO]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_GPIO));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_GPIO));
 
     /* RTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->rtc), errp)) {
@@ -971,7 +972,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->rtc), 0,
                     sc->memmap[ASPEED_DEV_RTC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rtc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_RTC));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_RTC));
 
     /* SDHCI */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->sdhci), errp)) {
@@ -980,7 +981,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->sdhci), 0,
                     sc->memmap[ASPEED_DEV_SDHCI]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->sdhci), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_SDHCI));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_SDHCI));
 
     /* eMMC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->emmc), errp)) {
@@ -989,7 +990,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->emmc), 0,
                     sc->memmap[ASPEED_DEV_EMMC]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->emmc), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_EMMC));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_EMMC));
 
     /* Timer */
     object_property_set_link(OBJECT(&s->timerctrl), "scu", OBJECT(&s->scu),
@@ -1000,7 +1001,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->timerctrl), 0,
                     sc->memmap[ASPEED_DEV_TIMER1]);
     for (i = 0; i < ASPEED_TIMER_NR_TIMERS; i++) {
-        irq = aspeed_soc_get_irq(s, ASPEED_DEV_TIMER1 + i);
+        irq = aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_TIMER1 + i);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timerctrl), i, irq);
     }
 
@@ -1013,7 +1014,7 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
     aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->hace), 0,
                     sc->memmap[ASPEED_DEV_HACE]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->hace), 0,
-                       aspeed_soc_get_irq(s, ASPEED_DEV_HACE));
+                       aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_HACE));
 
     /* PCIe Root Complex (RC) */
     if (!aspeed_soc_ast2700_pcie_realize(dev, errp)) {
@@ -1068,7 +1069,6 @@ static void aspeed_soc_ast2700a0_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART0;
     sc->irqmap       = aspeed_soc_ast2700a0_irqmap;
     sc->memmap       = aspeed_soc_ast2700_memmap;
-    sc->get_irq      = aspeed_soc_ast2700_get_irq;
 }
 
 static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
@@ -1097,7 +1097,6 @@ static void aspeed_soc_ast2700a1_class_init(ObjectClass *oc, const void *data)
     sc->uarts_base   = ASPEED_DEV_UART0;
     sc->irqmap       = aspeed_soc_ast2700a1_irqmap;
     sc->memmap       = aspeed_soc_ast2700_memmap;
-    sc->get_irq      = aspeed_soc_ast2700_get_irq;
 }
 
 static const TypeInfo aspeed_soc_ast27x0_types[] = {
diff --git a/hw/arm/aspeed_soc_common.c b/hw/arm/aspeed_soc_common.c
index a785a50609..78b6ae18f8 100644
--- a/hw/arm/aspeed_soc_common.c
+++ b/hw/arm/aspeed_soc_common.c
@@ -30,11 +30,6 @@ const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types)
     return valid_cpu_types[0];
 }
 
-qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev)
-{
-    return ASPEED_SOC_GET_CLASS(s)->get_irq(s, dev);
-}
-
 bool aspeed_soc_uart_realize(MemoryRegion *memory, SerialMM *smm,
                              const hwaddr addr, Error **errp)
 {
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 47341ea2fd..0e07c079f0 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -198,7 +198,6 @@ struct AspeedSoCClass {
     const int *irqmap;
     const hwaddr *memmap;
     uint32_t num_cpus;
-    qemu_irq (*get_irq)(AspeedSoCState *s, int dev);
     bool (*boot_from_emmc)(AspeedSoCState *s);
 };
 
@@ -303,7 +302,6 @@ enum {
 };
 
 const char *aspeed_soc_cpu_type(const char * const *valid_cpu_types);
-qemu_irq aspeed_soc_get_irq(AspeedSoCState *s, int dev);
 bool aspeed_soc_uart_realize(MemoryRegion *memory, SerialMM *smm,
                              const hwaddr addr, Error **errp);
 void aspeed_soc_uart_set_chr(SerialMM *uart, int dev, int uarts_base,

From d183ef19a80867b6a1906417eda00f4ef17ffb77 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:21 +0800
Subject: [PATCH 1283/2396] hw/arm/aspeed: Introduce AspeedCoprocessor class
 and base implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a new AspeedCoprocessor class that defines the foundational structure for
ASPEED coprocessor models. This class encapsulates a base DeviceState with
links to system memory, clock, and peripheral components such as SCU, SCUIO,
Timer Controller, and UARTs.

Introduce the corresponding implementation file
aspeed_coprocessor_common.c, which provides the aspeed_coprocessor_realize()
method, property registration, and QOM type registration. The class is marked
as abstract and intended to serve as a common base for specific coprocessor
variants (e.g. SSP/TSP subsystems).

This establishes a reusable and extensible framework for modeling ASPEED
coprocessor devices.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_coprocessor_common.c  | 49 +++++++++++++++++++++++++++++
 hw/arm/meson.build                  |  3 +-
 include/hw/arm/aspeed_coprocessor.h | 44 ++++++++++++++++++++++++++
 3 files changed, 95 insertions(+), 1 deletion(-)
 create mode 100644 hw/arm/aspeed_coprocessor_common.c
 create mode 100644 include/hw/arm/aspeed_coprocessor.h

diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
new file mode 100644
index 0000000000..8a94b44f07
--- /dev/null
+++ b/hw/arm/aspeed_coprocessor_common.c
@@ -0,0 +1,49 @@
+/*
+ * ASPEED Coprocessor
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "system/memory.h"
+#include "hw/qdev-properties.h"
+#include "hw/arm/aspeed_coprocessor.h"
+
+static void aspeed_coprocessor_realize(DeviceState *dev, Error **errp)
+{
+    AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev);
+
+    if (!s->memory) {
+        error_setg(errp, "'memory' link is not set");
+        return;
+    }
+}
+
+static const Property aspeed_coprocessor_properties[] = {
+    DEFINE_PROP_LINK("memory", AspeedCoprocessorState, memory,
+                     TYPE_MEMORY_REGION, MemoryRegion *),
+};
+
+static void aspeed_coprocessor_class_init(ObjectClass *oc, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = aspeed_coprocessor_realize;
+    device_class_set_props(dc, aspeed_coprocessor_properties);
+}
+
+static const TypeInfo aspeed_coprocessor_types[] = {
+    {
+        .name           = TYPE_ASPEED_COPROCESSOR,
+        .parent         = TYPE_DEVICE,
+        .instance_size  = sizeof(AspeedCoprocessorState),
+        .class_size     = sizeof(AspeedCoprocessorClass),
+        .class_init     = aspeed_coprocessor_class_init,
+        .abstract       = true,
+    },
+};
+
+DEFINE_TYPES(aspeed_coprocessor_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index dc68391305..56bdb88b11 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -52,7 +52,8 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'fby35.c'))
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',
-  'aspeed_ast27x0-fc.c',))
+  'aspeed_ast27x0-fc.c',
+  'aspeed_coprocessor_common.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
 arm_common_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-soc.c'))
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
new file mode 100644
index 0000000000..793c7b1f8b
--- /dev/null
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -0,0 +1,44 @@
+/*
+ * ASPEED Coprocessor
+ *
+ * Copyright (C) 2025 ASPEED Technology Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef ASPEED_COPROCESSOR_H
+#define ASPEED_COPROCESSOR_H
+
+#include "qom/object.h"
+#include "hw/arm/aspeed_soc.h"
+
+struct AspeedCoprocessorState {
+    DeviceState parent;
+
+    MemoryRegion *memory;
+    MemoryRegion sram;
+    Clock *sysclk;
+
+    AspeedSCUState scu;
+    AspeedSCUState scuio;
+    AspeedTimerCtrlState timerctrl;
+    SerialMM uart[ASPEED_UARTS_NUM];
+};
+
+#define TYPE_ASPEED_COPROCESSOR "aspeed-coprocessor"
+OBJECT_DECLARE_TYPE(AspeedCoprocessorState, AspeedCoprocessorClass,
+                    ASPEED_COPROCESSOR)
+
+struct AspeedCoprocessorClass {
+    DeviceClass parent_class;
+
+    /** valid_cpu_types: NULL terminated array of a single CPU type. */
+    const char * const *valid_cpu_types;
+    uint32_t silicon_rev;
+    const hwaddr *memmap;
+    const int *irqmap;
+    int uarts_base;
+    int uarts_num;
+};
+
+#endif /* ASPEED_COPROCESSOR_H */

From 860204de8a49bc687b11b98fff460a984d9321ce Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:22 +0800
Subject: [PATCH 1284/2396] hw/arm/aspeed_ast27x0-ssp: Make AST27x0 SSP inherit
 from AspeedCoprocessor instead of AspeedSoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the AST27x0 SSP implementation to derive from the newly introduced
AspeedCoprocessor base class rather than AspeedSoC. The AspeedSoC class
contains many SoC-level fields and behaviors that are not applicable to
coprocessor subsystems like SSP, leading to unnecessary coupling and code size.

This change moves the Aspeed27x0SSPSoCState structure definition into
aspeed_coprocessor.h and updates related references in
aspeed_ast27x0-ssp.c and aspeed_ast27x0-fc.c to use
AspeedCoprocessorState and AspeedCoprocessorClass.

Key updates include:

- Replace inheritance from AspeedSoC -> AspeedCoprocessor.
- Replace type casts and class access macros (ASPEED_SOC_*) with
ASPEED_COPROCESSOR_*.

This refactor improves modularity, reduces memory footprint, and prepares
for future coprocessor variants to share a lighter-weight common base.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          | 10 +++++-----
 hw/arm/aspeed_ast27x0-ssp.c         | 30 +++++++++++++----------------
 hw/arm/meson.build                  |  2 +-
 include/hw/arm/aspeed_coprocessor.h | 12 ++++++++++++
 include/hw/arm/aspeed_soc.h         | 12 ------------
 5 files changed, 31 insertions(+), 35 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index e598f57ca2..4315e8da98 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -21,7 +21,7 @@
 #include "hw/loader.h"
 #include "hw/arm/boot.h"
 #include "hw/block/flash.h"
-
+#include "hw/arm/aspeed_coprocessor.h"
 
 #define TYPE_AST2700A1FC MACHINE_TYPE_NAME("ast2700fc")
 OBJECT_DECLARE_SIMPLE_TYPE(Ast2700FCState, AST2700A1FC);
@@ -115,8 +115,8 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
 
 static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 {
-    AspeedSoCState *soc;
-    AspeedSoCClass *sc;
+    AspeedCoprocessorState *soc;
+    AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     s->ssp_sysclk = clock_new(OBJECT(s), "SSP_SYSCLK");
     clock_set_hz(s->ssp_sysclk, 200000000ULL);
@@ -129,8 +129,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
     object_property_set_link(OBJECT(&s->ssp), "memory",
                              OBJECT(&s->ssp_memory), &error_abort);
 
-    soc = ASPEED_SOC(&s->ssp);
-    sc = ASPEED_SOC_GET_CLASS(soc);
+    soc = ASPEED_COPROCESSOR(&s->ssp);
+    sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
     aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART4, sc->uarts_base,
                             sc->uarts_num, serial_hd(1));
     if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index f90d144372..1ebf06299e 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -14,6 +14,7 @@
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
+#include "hw/arm/aspeed_coprocessor.h"
 
 #define AST2700_SSP_RAM_SIZE (32 * MiB)
 
@@ -104,10 +105,11 @@ static struct nvic_intc_irq_info ast2700_ssp_intcmap[] = {
     {136, 0, 9, NULL},
 };
 
-static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedSoCState *s, int dev)
+static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
+                                              int dev)
 {
     Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(s);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
     int idx;
@@ -129,8 +131,8 @@ static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedSoCState *s, int dev)
 static void aspeed_soc_ast27x0ssp_init(Object *obj)
 {
     Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(obj);
-    AspeedSoCState *s = ASPEED_SOC(obj);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
@@ -160,8 +162,8 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
 static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
 {
     Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(dev_soc);
-    AspeedSoCState *s = ASPEED_SOC(dev_soc);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sram_name = NULL;
     int uart;
@@ -185,8 +187,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     sram_name = g_strdup_printf("aspeed.dram.%d",
                                 CPU(a->armv7m.cpu)->cpu_index);
 
-    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size,
-                                errp)) {
+    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name,
+                                AST2700_SSP_RAM_SIZE, errp)) {
         return;
     }
     memory_region_add_subregion(s->memory,
@@ -268,30 +270,24 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass, const void *dat
         NULL
     };
     DeviceClass *dc = DEVICE_CLASS(klass);
-    AspeedSoCClass *sc = ASPEED_SOC_CLASS(dc);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_CLASS(dc);
 
-    /* Reason: The Aspeed SoC can only be instantiated from a board */
+    /* Reason: The Aspeed Coprocessor can only be instantiated from a board */
     dc->user_creatable = false;
     dc->realize = aspeed_soc_ast27x0ssp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
     sc->silicon_rev = AST2700_A1_SILICON_REV;
-    sc->sram_size = AST2700_SSP_RAM_SIZE;
-    sc->spis_num = 0;
-    sc->ehcis_num = 0;
-    sc->wdts_num = 0;
-    sc->macs_num = 0;
     sc->uarts_num = 13;
     sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
     sc->memmap = aspeed_soc_ast27x0ssp_memmap;
-    sc->num_cpus = 1;
 }
 
 static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
     {
         .name           = TYPE_ASPEED27X0SSP_SOC,
-        .parent         = TYPE_ASPEED_SOC,
+        .parent         = TYPE_ASPEED_COPROCESSOR,
         .instance_size  = sizeof(Aspeed27x0SSPSoCState),
         .instance_init  = aspeed_soc_ast27x0ssp_init,
         .class_init     = aspeed_soc_ast27x0ssp_class_init,
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 56bdb88b11..b9e02ace7f 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -45,7 +45,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
   'aspeed_ast2600.c',
-  'aspeed_ast27x0-ssp.c',
   'aspeed_ast27x0-tsp.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
@@ -53,6 +52,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',
   'aspeed_ast27x0-fc.c',
+  'aspeed_ast27x0-ssp.c',
   'aspeed_coprocessor_common.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 793c7b1f8b..901b8d8e24 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -41,4 +41,16 @@ struct AspeedCoprocessorClass {
     int uarts_num;
 };
 
+struct Aspeed27x0SSPSoCState {
+    AspeedCoprocessorState parent;
+    AspeedINTCState intc[2];
+    UnimplementedDeviceState ipc[2];
+    UnimplementedDeviceState scuio;
+
+    ARMv7MState armv7m;
+};
+
+#define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
+
 #endif /* ASPEED_COPROCESSOR_H */
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index 0e07c079f0..a34ab986a9 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -153,18 +153,6 @@ struct Aspeed10x0SoCState {
     ARMv7MState armv7m;
 };
 
-struct Aspeed27x0SSPSoCState {
-    AspeedSoCState parent;
-    AspeedINTCState intc[2];
-    UnimplementedDeviceState ipc[2];
-    UnimplementedDeviceState scuio;
-
-    ARMv7MState armv7m;
-};
-
-#define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
-OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
-
 struct Aspeed27x0TSPSoCState {
     AspeedSoCState parent;
     AspeedINTCState intc[2];

From bbdd4167fa7ab8b27527e00214c3b903cf30a737 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:23 +0800
Subject: [PATCH 1285/2396] hw/arm/aspeed_ast27x0-tsp: Make AST27x0 TSP inherit
 from AspeedCoprocessor instead of AspeedSoC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the AST27x0 TSP implementation to derive from the newly introduced
AspeedCoprocessor base class rather than AspeedSoC. The AspeedSoC class
includes SoC-level infrastructure and peripheral definitions that are not
applicable to lightweight coprocessor subsystems such as TSP, resulting in
unnecessary coupling and complexity.

This change moves the Aspeed27x0TSPSoCState structure definition into
aspeed_coprocessor.h and updates all related references in
aspeed_ast27x0-tsp.c and aspeed_ast27x0-fc.c to use
AspeedCoprocessorState and AspeedCoprocessorClass.

Key updates include:

- Replace inheritance from AspeedSoC -> AspeedCoprocessor.
- Update type casts and macros from ASPEED_SOC_* to ASPEED_COPROCESSOR_*

This refactor improves modularity, reduces memory footprint, and prepares
for future coprocessor variants to share a lighter-weight common base.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          |  8 ++++----
 hw/arm/aspeed_ast27x0-tsp.c         | 30 +++++++++++++----------------
 hw/arm/meson.build                  |  2 +-
 include/hw/arm/aspeed_coprocessor.h | 12 ++++++++++++
 include/hw/arm/aspeed_soc.h         | 12 ------------
 5 files changed, 30 insertions(+), 34 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 4315e8da98..b34cd54e4e 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -142,8 +142,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 
 static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
 {
-    AspeedSoCState *soc;
-    AspeedSoCClass *sc;
+    AspeedCoprocessorState *soc;
+    AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     s->tsp_sysclk = clock_new(OBJECT(s), "TSP_SYSCLK");
     clock_set_hz(s->tsp_sysclk, 200000000ULL);
@@ -156,8 +156,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
     object_property_set_link(OBJECT(&s->tsp), "memory",
                              OBJECT(&s->tsp_memory), &error_abort);
 
-    soc = ASPEED_SOC(&s->tsp);
-    sc = ASPEED_SOC_GET_CLASS(soc);
+    soc = ASPEED_COPROCESSOR(&s->tsp);
+    sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
     aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
                             sc->uarts_num, serial_hd(2));
     if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 8643f82683..b77c5291a6 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -14,6 +14,7 @@
 #include "hw/qdev-clock.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/aspeed_soc.h"
+#include "hw/arm/aspeed_coprocessor.h"
 
 #define AST2700_TSP_RAM_SIZE (32 * MiB)
 
@@ -104,10 +105,11 @@ static struct nvic_intc_irq_info ast2700_tsp_intcmap[] = {
     {136, 0, 9, NULL},
 };
 
-static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedSoCState *s, int dev)
+static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
+                                              int dev)
 {
     Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(s);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
     int idx;
@@ -129,8 +131,8 @@ static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedSoCState *s, int dev)
 static void aspeed_soc_ast27x0tsp_init(Object *obj)
 {
     Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(obj);
-    AspeedSoCState *s = ASPEED_SOC(obj);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
@@ -160,8 +162,8 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
 static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
 {
     Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(dev_soc);
-    AspeedSoCState *s = ASPEED_SOC(dev_soc);
-    AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
+    AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sram_name = NULL;
     int uart;
@@ -185,8 +187,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     sram_name = g_strdup_printf("aspeed.dram.%d",
                                 CPU(a->armv7m.cpu)->cpu_index);
 
-    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name, sc->sram_size,
-                                errp)) {
+    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name,
+                                AST2700_TSP_RAM_SIZE, errp)) {
         return;
     }
     memory_region_add_subregion(s->memory,
@@ -268,30 +270,24 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass, const void *dat
         NULL
     };
     DeviceClass *dc = DEVICE_CLASS(klass);
-    AspeedSoCClass *sc = ASPEED_SOC_CLASS(dc);
+    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_CLASS(dc);
 
-    /* Reason: The Aspeed SoC can only be instantiated from a board */
+    /* Reason: The Aspeed Coprocessor can only be instantiated from a board */
     dc->user_creatable = false;
     dc->realize = aspeed_soc_ast27x0tsp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
     sc->silicon_rev = AST2700_A1_SILICON_REV;
-    sc->sram_size = AST2700_TSP_RAM_SIZE;
-    sc->spis_num = 0;
-    sc->ehcis_num = 0;
-    sc->wdts_num = 0;
-    sc->macs_num = 0;
     sc->uarts_num = 13;
     sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
     sc->memmap = aspeed_soc_ast27x0tsp_memmap;
-    sc->num_cpus = 1;
 }
 
 static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
     {
         .name           = TYPE_ASPEED27X0TSP_SOC,
-        .parent         = TYPE_ASPEED_SOC,
+        .parent         = TYPE_ASPEED_COPROCESSOR,
         .instance_size  = sizeof(Aspeed27x0TSPSoCState),
         .instance_init  = aspeed_soc_ast27x0tsp_init,
         .class_init     = aspeed_soc_ast27x0tsp_class_init,
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index b9e02ace7f..b88b5b06d7 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -45,7 +45,6 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
   'aspeed_ast2600.c',
-  'aspeed_ast27x0-tsp.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))
@@ -53,6 +52,7 @@ arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',
   'aspeed_ast27x0-fc.c',
   'aspeed_ast27x0-ssp.c',
+  'aspeed_ast27x0-tsp.c',
   'aspeed_coprocessor_common.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2.c'))
 arm_common_ss.add(when: 'CONFIG_MPS2', if_true: files('mps2-tz.c'))
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 901b8d8e24..f09c2ed267 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -53,4 +53,16 @@ struct Aspeed27x0SSPSoCState {
 #define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
 
+struct Aspeed27x0TSPSoCState {
+    AspeedCoprocessorState parent;
+    AspeedINTCState intc[2];
+    UnimplementedDeviceState ipc[2];
+    UnimplementedDeviceState scuio;
+
+    ARMv7MState armv7m;
+};
+
+#define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0TSPSoCState, ASPEED27X0TSP_SOC)
+
 #endif /* ASPEED_COPROCESSOR_H */
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index a34ab986a9..4b8e599f1a 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -153,18 +153,6 @@ struct Aspeed10x0SoCState {
     ARMv7MState armv7m;
 };
 
-struct Aspeed27x0TSPSoCState {
-    AspeedSoCState parent;
-    AspeedINTCState intc[2];
-    UnimplementedDeviceState ipc[2];
-    UnimplementedDeviceState scuio;
-
-    ARMv7MState armv7m;
-};
-
-#define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
-OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0TSPSoCState, ASPEED27X0TSP_SOC)
-
 #define TYPE_ASPEED10X0_SOC "aspeed10x0-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed10x0SoCState, ASPEED10X0_SOC)
 

From 9a255419e90c4ba4d68fd45ff4e962197a94304c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:24 +0800
Subject: [PATCH 1286/2396] hw/arm/aspeed_ast27x0-ssp: Change to use
 Aspeed27x0CoprocessorState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the AST27x0 SSP implementation to use the unified
Aspeed27x0CoprocessorState structure shared between SSP and TSP.
Previously, SSP and TSP each defined separate state structures
(Aspeed27x0SSPSoCState and Aspeed27x0TSPSoCState), which contained
identical members and caused unnecessary code duplication.

This change removes Aspeed27x0SSPSoCState and replaces it with
Aspeed27x0CoprocessorState, consolidating shared coprocessor state fields
into a single definition in aspeed_coprocessor.h.

This refactor unifies SSP and TSP under the same coprocessor state type,
improving code maintainability and consistency across Aspeed coprocessor
implementations.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          | 2 +-
 hw/arm/aspeed_ast27x0-ssp.c         | 8 ++++----
 include/hw/arm/aspeed_coprocessor.h | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index b34cd54e4e..cd09a2dcf0 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -42,7 +42,7 @@ struct Ast2700FCState {
     Clock *tsp_sysclk;
 
     Aspeed27x0SoCState ca35;
-    Aspeed27x0SSPSoCState ssp;
+    Aspeed27x0CoprocessorState ssp;
     Aspeed27x0TSPSoCState tsp;
 
     bool mmio_exec;
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 1ebf06299e..f8319c95fd 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -108,7 +108,7 @@ static struct nvic_intc_irq_info ast2700_ssp_intcmap[] = {
 static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
-    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(s);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(s);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
@@ -130,7 +130,7 @@ static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
 
 static void aspeed_soc_ast27x0ssp_init(Object *obj)
 {
-    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(obj);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
@@ -161,7 +161,7 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
 
 static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
 {
-    Aspeed27x0SSPSoCState *a = ASPEED27X0SSP_SOC(dev_soc);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(dev_soc);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
@@ -288,7 +288,7 @@ static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
     {
         .name           = TYPE_ASPEED27X0SSP_SOC,
         .parent         = TYPE_ASPEED_COPROCESSOR,
-        .instance_size  = sizeof(Aspeed27x0SSPSoCState),
+        .instance_size  = sizeof(Aspeed27x0CoprocessorState),
         .instance_init  = aspeed_soc_ast27x0ssp_init,
         .class_init     = aspeed_soc_ast27x0ssp_class_init,
     },
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index f09c2ed267..d799726635 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -41,7 +41,7 @@ struct AspeedCoprocessorClass {
     int uarts_num;
 };
 
-struct Aspeed27x0SSPSoCState {
+struct Aspeed27x0CoprocessorState {
     AspeedCoprocessorState parent;
     AspeedINTCState intc[2];
     UnimplementedDeviceState ipc[2];
@@ -51,7 +51,7 @@ struct Aspeed27x0SSPSoCState {
 };
 
 #define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
-OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0SSPSoCState, ASPEED27X0SSP_SOC)
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0CoprocessorState, ASPEED27X0SSP_SOC)
 
 struct Aspeed27x0TSPSoCState {
     AspeedCoprocessorState parent;

From 012d952c20b254bad8cac51fb6b7f8d2af0c56db Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:25 +0800
Subject: [PATCH 1287/2396] hw/arm/aspeed_ast27x0-tsp: Change to use
 Aspeed27x0CoprocessorState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refactor the AST27x0 TSP implementation to use the unified
Aspeed27x0CoprocessorState, matching the prior SSP change and removing the
duplicated Aspeed27x0TSPSoCState.

Key updates:
- Delete Aspeed27x0TSPSoCState and reuse Aspeed27x0CoprocessorState.

Update Ast2700FCState to declare tsp as Aspeed27x0CoprocessorState.
This aligns TSP with SSP on a single coprocessor state type, reducing code
duplication and simplifying maintenance.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-14-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          |  2 +-
 hw/arm/aspeed_ast27x0-tsp.c         |  8 ++++----
 include/hw/arm/aspeed_coprocessor.h | 12 ++----------
 3 files changed, 7 insertions(+), 15 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index cd09a2dcf0..c2fa8df33c 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -43,7 +43,7 @@ struct Ast2700FCState {
 
     Aspeed27x0SoCState ca35;
     Aspeed27x0CoprocessorState ssp;
-    Aspeed27x0TSPSoCState tsp;
+    Aspeed27x0CoprocessorState tsp;
 
     bool mmio_exec;
 };
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index b77c5291a6..e18c624361 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -108,7 +108,7 @@ static struct nvic_intc_irq_info ast2700_tsp_intcmap[] = {
 static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
-    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(s);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(s);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
@@ -130,7 +130,7 @@ static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
 
 static void aspeed_soc_ast27x0tsp_init(Object *obj)
 {
-    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(obj);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
@@ -161,7 +161,7 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
 
 static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
 {
-    Aspeed27x0TSPSoCState *a = ASPEED27X0TSP_SOC(dev_soc);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(dev_soc);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
@@ -288,7 +288,7 @@ static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
     {
         .name           = TYPE_ASPEED27X0TSP_SOC,
         .parent         = TYPE_ASPEED_COPROCESSOR,
-        .instance_size  = sizeof(Aspeed27x0TSPSoCState),
+        .instance_size  = sizeof(Aspeed27x0CoprocessorState),
         .instance_init  = aspeed_soc_ast27x0tsp_init,
         .class_init     = aspeed_soc_ast27x0tsp_class_init,
     },
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index d799726635..110e776c62 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -53,16 +53,8 @@ struct Aspeed27x0CoprocessorState {
 #define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0CoprocessorState, ASPEED27X0SSP_SOC)
 
-struct Aspeed27x0TSPSoCState {
-    AspeedCoprocessorState parent;
-    AspeedINTCState intc[2];
-    UnimplementedDeviceState ipc[2];
-    UnimplementedDeviceState scuio;
-
-    ARMv7MState armv7m;
-};
-
 #define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
-OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0TSPSoCState, ASPEED27X0TSP_SOC)
+DECLARE_OBJ_CHECKERS(Aspeed27x0CoprocessorState, AspeedCoprocessorClass,
+                     ASPEED27X0TSP_SOC, TYPE_ASPEED27X0TSP_SOC)
 
 #endif /* ASPEED_COPROCESSOR_H */

From f063ec2a5f8d89099b8b8d084b32020e9cda9280 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:26 +0800
Subject: [PATCH 1288/2396] hw/arm/aspeed_ast27x0-ssp: Rename type to
 TYPE_ASPEED27X0SSP_COPROCESSOR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the AST27x0 SSP type from TYPE_ASPEED27X0SSP_SOC to
TYPE_ASPEED27X0SSP_COPROCESSOR to better reflect its role as a coprocessor
rather than a standalone SoC. This aligns naming conventions with the
coprocessor-based design introduced in earlier refactors.

This change improves naming consistency across SSP and TSP coprocessor
implementations and clarifies their relationship to the unified
Aspeed27x0CoprocessorState.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-15-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          |  3 ++-
 hw/arm/aspeed_ast27x0-ssp.c         | 10 +++++-----
 include/hw/arm/aspeed_coprocessor.h |  5 +++--
 3 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index c2fa8df33c..67982d2fa0 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -121,7 +121,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
     s->ssp_sysclk = clock_new(OBJECT(s), "SSP_SYSCLK");
     clock_set_hz(s->ssp_sysclk, 200000000ULL);
 
-    object_initialize_child(OBJECT(s), "ssp", &s->ssp, TYPE_ASPEED27X0SSP_SOC);
+    object_initialize_child(OBJECT(s), "ssp", &s->ssp,
+                            TYPE_ASPEED27X0SSP_COPROCESSOR);
     memory_region_init(&s->ssp_memory, OBJECT(&s->ssp), "ssp-memory",
                        UINT64_MAX);
 
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index f8319c95fd..d27be8b925 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -1,5 +1,5 @@
 /*
- * ASPEED Ast27x0 SSP SoC
+ * ASPEED Ast27x0 SSP Coprocessor
  *
  * Copyright (C) 2025 ASPEED Technology Inc.
  *
@@ -108,7 +108,7 @@ static struct nvic_intc_irq_info ast2700_ssp_intcmap[] = {
 static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(s);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_COPROCESSOR(s);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
@@ -130,7 +130,7 @@ static qemu_irq aspeed_soc_ast27x0ssp_get_irq(AspeedCoprocessorState *s,
 
 static void aspeed_soc_ast27x0ssp_init(Object *obj)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(obj);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_COPROCESSOR(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
@@ -161,7 +161,7 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
 
 static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_SOC(dev_soc);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_COPROCESSOR(dev_soc);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
@@ -286,7 +286,7 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass, const void *dat
 
 static const TypeInfo aspeed_soc_ast27x0ssp_types[] = {
     {
-        .name           = TYPE_ASPEED27X0SSP_SOC,
+        .name           = TYPE_ASPEED27X0SSP_COPROCESSOR,
         .parent         = TYPE_ASPEED_COPROCESSOR,
         .instance_size  = sizeof(Aspeed27x0CoprocessorState),
         .instance_init  = aspeed_soc_ast27x0ssp_init,
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 110e776c62..1c201a15c6 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -50,8 +50,9 @@ struct Aspeed27x0CoprocessorState {
     ARMv7MState armv7m;
 };
 
-#define TYPE_ASPEED27X0SSP_SOC "aspeed27x0ssp-soc"
-OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0CoprocessorState, ASPEED27X0SSP_SOC)
+#define TYPE_ASPEED27X0SSP_COPROCESSOR "aspeed27x0ssp-coprocessor"
+OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0CoprocessorState,
+                           ASPEED27X0SSP_COPROCESSOR)
 
 #define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
 DECLARE_OBJ_CHECKERS(Aspeed27x0CoprocessorState, AspeedCoprocessorClass,

From a6366527e35ad3125fc9fcf7f7d88b19e221b695 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:27 +0800
Subject: [PATCH 1289/2396] hw/arm/aspeed_ast27x0-tsp: Rename type to
 TYPE_ASPEED27X0TSP_COPROCESSOR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename the AST27x0 TSP type from TYPE_ASPEED27X0TSP_SOC to
TYPE_ASPEED27X0TSP_COPROCESSOR to align with the naming convention used
for the SSP coprocessor (TYPE_ASPEED27X0SSP_COPROCESSOR).
This change clarifies that TSP is implemented as a coprocessor rather than
a full SoC.

This ensures consistent terminology between SSP and TSP components and
improves clarity within the coprocessor subsystem code.

No functional change.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-16-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          |  3 ++-
 hw/arm/aspeed_ast27x0-tsp.c         | 10 +++++-----
 include/hw/arm/aspeed_coprocessor.h |  4 ++--
 3 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 67982d2fa0..a61ecff390 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -149,7 +149,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
     s->tsp_sysclk = clock_new(OBJECT(s), "TSP_SYSCLK");
     clock_set_hz(s->tsp_sysclk, 200000000ULL);
 
-    object_initialize_child(OBJECT(s), "tsp", &s->tsp, TYPE_ASPEED27X0TSP_SOC);
+    object_initialize_child(OBJECT(s), "tsp", &s->tsp,
+                            TYPE_ASPEED27X0TSP_COPROCESSOR);
     memory_region_init(&s->tsp_memory, OBJECT(&s->tsp), "tsp-memory",
                        UINT64_MAX);
 
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index e18c624361..7f109101fe 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -1,5 +1,5 @@
 /*
- * ASPEED Ast27x0 TSP SoC
+ * ASPEED Ast27x0 TSP Coprocessor
  *
  * Copyright (C) 2025 ASPEED Technology Inc.
  *
@@ -108,7 +108,7 @@ static struct nvic_intc_irq_info ast2700_tsp_intcmap[] = {
 static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
                                               int dev)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(s);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_COPROCESSOR(s);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
 
     int or_idx;
@@ -130,7 +130,7 @@ static qemu_irq aspeed_soc_ast27x0tsp_get_irq(AspeedCoprocessorState *s,
 
 static void aspeed_soc_ast27x0tsp_init(Object *obj)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(obj);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_COPROCESSOR(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     int i;
@@ -161,7 +161,7 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
 
 static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
 {
-    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_SOC(dev_soc);
+    Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_COPROCESSOR(dev_soc);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
@@ -286,7 +286,7 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass, const void *dat
 
 static const TypeInfo aspeed_soc_ast27x0tsp_types[] = {
     {
-        .name           = TYPE_ASPEED27X0TSP_SOC,
+        .name           = TYPE_ASPEED27X0TSP_COPROCESSOR,
         .parent         = TYPE_ASPEED_COPROCESSOR,
         .instance_size  = sizeof(Aspeed27x0CoprocessorState),
         .instance_init  = aspeed_soc_ast27x0tsp_init,
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 1c201a15c6..d77655d659 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -54,8 +54,8 @@ struct Aspeed27x0CoprocessorState {
 OBJECT_DECLARE_SIMPLE_TYPE(Aspeed27x0CoprocessorState,
                            ASPEED27X0SSP_COPROCESSOR)
 
-#define TYPE_ASPEED27X0TSP_SOC "aspeed27x0tsp-soc"
+#define TYPE_ASPEED27X0TSP_COPROCESSOR "aspeed27x0tsp-coprocessor"
 DECLARE_OBJ_CHECKERS(Aspeed27x0CoprocessorState, AspeedCoprocessorClass,
-                     ASPEED27X0TSP_SOC, TYPE_ASPEED27X0TSP_SOC)
+                     ASPEED27X0TSP_COPROCESSOR, TYPE_ASPEED27X0TSP_COPROCESSOR)
 
 #endif /* ASPEED_COPROCESSOR_H */

From 0cf9761b0ae6dd04815b54eb785301f35015246d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Mon, 13 Oct 2025 13:43:28 +0800
Subject: [PATCH 1290/2396] hw/arm/aspeed_ast27x0-{ssp,tsp}: Fix coding style
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix coding style warnings in aspeed_ast27x0-ssp.c and aspeed_ast27x0-tsp.c
reported by checkpatch.pl regarding line length exceeding 80 characters.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013054334.955331-17-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-ssp.c | 3 ++-
 hw/arm/aspeed_ast27x0-tsp.c | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index d27be8b925..936c7c72e8 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -263,7 +263,8 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
                                   sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
 }
 
-static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass, const void *data)
+static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO: cortex-m4f */
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 7f109101fe..9318f8c86c 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -263,7 +263,8 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
                                   sc->memmap[ASPEED_DEV_SCUIO], 0x1000);
 }
 
-static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass, const void *data)
+static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
+                                             const void *data)
 {
     static const char * const valid_cpu_types[] = {
         ARM_CPU_TYPE_NAME("cortex-m4"), /* TODO cortex-m4f */

From 6a9d1ccd39bf0305c94691ce0ca228599d4719f3 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 29 Jul 2025 13:12:26 +0200
Subject: [PATCH 1291/2396] hw/display/xenfb: Replace unreachable code by
 g_assert_not_reached()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

xenfb_mouse_event() has a switch statement whose controlling
expression move->axis is an enum InputAxis.  The enum values are
INPUT_AXIS_X and INPUT_AXIS_Y, encoded as 0 and 1.  The switch has a
case for both axes.  In addition, it has an unreachable default label.
This convinces Coverity that move->axis can be greater than 1.  It
duly reports a buffer overrun when it is used to subscript an array
with two elements.

Replace the unreachable code by g_assert_not_reached().

Resolves: Coverity CID 1613906
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250729111226.3627499-1-armbru@redhat.com>
[PMD: s/abort/g_assert_not_reached/]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/display/xenfb.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/display/xenfb.c b/hw/display/xenfb.c
index 22822fecea..164fd0b248 100644
--- a/hw/display/xenfb.c
+++ b/hw/display/xenfb.c
@@ -283,8 +283,7 @@ static void xenfb_mouse_event(DeviceState *dev, QemuConsole *src,
                 scale = surface_height(surface) - 1;
                 break;
             default:
-                scale = 0x8000;
-                break;
+                g_assert_not_reached();
             }
             xenfb->axis[move->axis] = move->value * scale / 0x7fff;
         }

From 9df035ecf735a41a0dd7686bf1d81e1b2f30eff8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 25 Aug 2025 17:21:13 +0200
Subject: [PATCH 1292/2396] hw/ppc: Do not open-code cpu_resume() in
 spin_kick()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to make the code easier to follow / review,
use the cpu_resume() helper instead of open-coding it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250924173028.53658-2-philmd@linaro.org>
---
 hw/ppc/ppce500_spin.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/ppc/ppce500_spin.c b/hw/ppc/ppce500_spin.c
index 2310f62a91..bc70e50e92 100644
--- a/hw/ppc/ppce500_spin.c
+++ b/hw/ppc/ppce500_spin.c
@@ -99,8 +99,7 @@ static void spin_kick(CPUState *cs, run_on_cpu_data data)
 
     cs->halted = 0;
     cs->exception_index = -1;
-    cs->stopped = false;
-    qemu_cpu_kick(cs);
+    cpu_resume(cs);
 }
 
 static void spin_write(void *opaque, hwaddr addr, uint64_t value,

From 18727804c06575e6a69566c593e79bfa4a197adb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 26 Aug 2025 16:16:30 +0200
Subject: [PATCH 1293/2396] hw/xtensa/xtfpga: Have xtfpga_init() only
 initialize MMU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_reset() should not be used with an unrealized CPU.
Here we simply want to initialize the MMU, not the CPU,
so just call reset_mmu().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Message-Id: <20250925013513.67780-1-philmd@linaro.org>
---
 hw/xtensa/xtfpga.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 6efffae466..55de1a7a07 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -268,7 +268,7 @@ static void xtfpga_init(const XtfpgaBoardDesc *board, MachineState *machine)
         /* Need MMU initialized prior to ELF loading,
          * so that ELF gets loaded into virtual addresses
          */
-        cpu_reset(CPU(cpu));
+        reset_mmu(cenv);
     }
     if (smp_cpus > 1) {
         extints = xtensa_mx_pic_get_extints(mx_pic);

From 525e1c9908704377007e1cef2bbc4e2bef7e5197 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 04:26:32 +0200
Subject: [PATCH 1294/2396] hw/sparc/leon3: Remove unnecessary CPU() QOM cast
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

env_cpu() already returns a CPUState type, no need to cast.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Clément Chigot <chigot@adacore.com>
Message-Id: <20251002033623.26800-1-philmd@linaro.org>
---
 hw/sparc/leon3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index 0aeaad3bec..09d2cec488 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -192,7 +192,7 @@ static void leon3_cache_control_int(CPUSPARCState *env)
 
 static void leon3_irq_ack(CPUSPARCState *env, int intno)
 {
-    CPUState *cpu = CPU(env_cpu(env));
+    CPUState *cpu = env_cpu(env);
     grlib_irqmp_ack(env->irq_manager, cpu->cpu_index, intno);
 }
 

From 1b2a50cc003962f42ce0bc91fbd4b8b380036ac2 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Thu, 2 Oct 2025 09:34:14 +0200
Subject: [PATCH 1295/2396] hw/net/can/xlnx-versal-canfd: remove unused include
 directives
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop unecessary include directives in xlnx-versal-canfd.c.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251002073418.109375-6-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/can/xlnx-versal-canfd.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index 3eb111949f..343348660b 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -35,12 +35,8 @@
 #include "hw/irq.h"
 #include "hw/register.h"
 #include "qapi/error.h"
-#include "qemu/bitops.h"
 #include "qemu/log.h"
-#include "qemu/cutils.h"
-#include "qemu/event_notifier.h"
 #include "hw/qdev-properties.h"
-#include "qom/object_interfaces.h"
 #include "migration/vmstate.h"
 #include "hw/net/xlnx-versal-canfd.h"
 #include "trace.h"

From fc08d5f699c53ad46a3d8b8e5159e3ab6a1124ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Fri, 3 Oct 2025 12:30:24 +0200
Subject: [PATCH 1296/2396] hw/arm/aspeed: Don't set 'auto_create_sdcard'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Aspeed machines inherited from a 'no_sdcard' attribute when first
introduced in QEMU. This attribute was later renamed to
'auto_create_sdcard' by commit cdc8d7cadaac ("hw/boards: Rename
no_sdcard -> auto_create_sdcard") and set to 'true'. This has the
indesirable efect to automatically create SD cards at init time.

Remove 'auto_create_sdcard' to avoid creating a SD card device.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251003103024.1863551-1-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/arm/aspeed.c | 22 ----------------------
 1 file changed, 22 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 6046ec0bb2..58cfbc7137 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1418,7 +1418,6 @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635f";
     amc->num_cs    = 1;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 256 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1436,7 +1435,6 @@ static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 1;
     amc->i2c_init  = quanta_q71l_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 128 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1455,7 +1453,6 @@ static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
     amc->num_cs    = 1;
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 256 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1474,7 +1471,6 @@ static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
     amc->num_cs    = 1;
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1492,7 +1488,6 @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635f";
     amc->num_cs    = 1;
     amc->i2c_init  = ast2500_evb_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1511,7 +1506,6 @@ static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 2;
     amc->i2c_init  = yosemitev2_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1529,7 +1523,6 @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = romulus_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1548,7 +1541,6 @@ static void aspeed_machine_tiogapass_class_init(ObjectClass *oc,
     amc->spi_model = "mx25l25635e";
     amc->num_cs    = 2;
     amc->i2c_init  = tiogapass_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1566,7 +1558,6 @@ static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = sonorapass_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size       = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1584,7 +1575,6 @@ static void aspeed_machine_witherspoon_class_init(ObjectClass *oc,
     amc->spi_model = "mx66l1g45g";
     amc->num_cs    = 2;
     amc->i2c_init  = witherspoon_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1606,7 +1596,6 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                      ASPEED_MAC3_ON;
     amc->sdhci_wp_inverted = true;
     amc->i2c_init  = ast2600_evb_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1625,7 +1614,6 @@ static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = g220a_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1024 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1644,7 +1632,6 @@ static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
     amc->i2c_init  = fp5280g2_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 512 * MiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1663,7 +1650,6 @@ static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask  = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = rainier_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1686,7 +1672,6 @@ static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
     amc->macs_mask = ASPEED_MAC3_ON;
     amc->i2c_init = fuji_bmc_i2c_init;
     amc->uart_default = ASPEED_DEV_UART1;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = FUJI_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1708,7 +1693,6 @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON;
     amc->i2c_init  = bletchley_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = BLETCHLEY_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1728,7 +1712,6 @@ static void aspeed_machine_catalina_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON;
     amc->i2c_init  = catalina_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = CATALINA_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
     aspeed_machine_ast2600_class_emmc_init(oc);
@@ -1796,7 +1779,6 @@ static void aspeed_machine_fby35_class_init(ObjectClass *oc, const void *data)
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC3_ON;
     amc->i2c_init  = fby35_i2c_init;
-    mc->auto_create_sdcard = true;
     /* FIXME: Replace this macro with something more general */
     mc->default_ram_size = FUJI_BMC_RAM_SIZE;
     aspeed_machine_class_init_cpus_defaults(mc);
@@ -1909,7 +1891,6 @@ static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
     amc->vbootrom = true;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1932,7 +1913,6 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
     amc->uart_default = ASPEED_DEV_UART12;
     amc->i2c_init  = ast2700_evb_i2c_init;
     amc->vbootrom = true;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 }
@@ -1953,7 +1933,6 @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };
@@ -1973,7 +1952,6 @@ static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
     amc->num_cs    = 2;
     amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
     amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
-    mc->auto_create_sdcard = true;
     mc->default_ram_size = 1 * GiB;
     aspeed_machine_class_init_cpus_defaults(mc);
 };

From d39ac36fe298400eac7e9272c950bedca29490c0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 7 Oct 2025 03:55:08 +0200
Subject: [PATCH 1297/2396] hw/s390x/sclp: Do not ignore
 address_space_read/write() errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If address_space_read() fails, return PGM_ADDRESSING. In the
unlikely case address_space_write() fails (we already checked
the address is readable), return PGM_PROTECTION.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Jason J. Herne <jjherne@linux.ibm.com>
Message-Id: <20251007015802.24748-1-philmd@linaro.org>
---
 hw/s390x/sclp.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 51e88ba8f1..8602a566a4 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -306,6 +306,7 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
     g_autofree SCCB *work_sccb = NULL;
     AddressSpace *as = CPU(cpu)->as;
     const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
+    MemTxResult ret;
 
     /* first some basic checks on program checks */
     if (env->psw.mask & PSW_MASK_PSTATE) {
@@ -320,7 +321,10 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
     }
 
     /* the header contains the actual length of the sccb */
-    address_space_read(as, sccb, attrs, &header, sizeof(SCCBHeader));
+    ret = address_space_read(as, sccb, attrs, &header, sizeof(SCCBHeader));
+    if (ret != MEMTX_OK) {
+        return -PGM_ADDRESSING;
+    }
 
     /* Valid sccb sizes */
     if (be16_to_cpu(header.length) < sizeof(SCCBHeader)) {
@@ -333,7 +337,11 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
      * the host has checked the values
      */
     work_sccb = g_malloc0(be16_to_cpu(header.length));
-    address_space_read(as, sccb, attrs, work_sccb, be16_to_cpu(header.length));
+    ret = address_space_read(as, sccb, attrs,
+                            work_sccb, be16_to_cpu(header.length));
+    if (ret != MEMTX_OK) {
+        return -PGM_ADDRESSING;
+    }
 
     if (!sclp_command_code_valid(code)) {
         work_sccb->h.response_code = cpu_to_be16(SCLP_RC_INVALID_SCLP_COMMAND);
@@ -347,7 +355,11 @@ int sclp_service_call(S390CPU *cpu, uint64_t sccb, uint32_t code)
 
     sclp_c->execute(sclp, work_sccb, code);
 out_write:
-    address_space_write(as, sccb, attrs, work_sccb, be16_to_cpu(header.length));
+    ret = address_space_write(as, sccb, attrs,
+                              work_sccb, be16_to_cpu(header.length));
+    if (ret != MEMTX_OK) {
+        return -PGM_PROTECTION;
+    }
 
     sclp_c->service_interrupt(sclp, sccb);
 

From fe5d03c4a3ec7edfe0a9bf4d232b04aca4d72fc9 Mon Sep 17 00:00:00 2001
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Date: Tue, 7 Oct 2025 22:31:50 +0200
Subject: [PATCH 1298/2396] hw/vmapple: include missing headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Disablement by default led to:

../hw/vmapple/vmapple.c:276:39: error: use of undeclared identifier 'GTIMER_VIRT'
  276 |         qdev_connect_gpio_out(cpudev, GTIMER_VIRT,
      |                                       ^
../hw/vmapple/vmapple.c:479:54: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
  479 |         object_property_set_int(cpu, "psci-conduit", QEMU_PSCI_CONDUIT_HVC,
      |                                                      ^
../hw/vmapple/vmapple.c:556:13: error: call to undeclared function 'arm_build_mp_affinity'; ISO C99 and later do not support implicit function declarations [-Wimplicit-function-declaration]
  556 |             arm_build_mp_affinity(n, GICV3_TARGETLIST_BITS);
      |             ^
3 errors generated.

pretty quickly.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251007203153.30136-2-mohamed@unpredictable.fr>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/vmapple/vmapple.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
index 16e6110b68..1e4365f32c 100644
--- a/hw/vmapple/vmapple.c
+++ b/hw/vmapple/vmapple.c
@@ -51,6 +51,8 @@
 #include "system/reset.h"
 #include "system/runstate.h"
 #include "system/system.h"
+#include "target/arm/gtimer.h"
+#include "target/arm/cpu.h"
 
 struct VMAppleMachineState {
     MachineState parent;

From faf1fae7645303180b1404716cb2e9d740f0eb2e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:14:37 +0200
Subject: [PATCH 1299/2396] hw/loongarch/boot: Remove unnecessary cast to
 target_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reduce initrd_size scope. It is already of signed type (ssize_t),
no need to cast to unsigned for the comparison.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009201947.34643-2-philmd@linaro.org>
---
 hw/loongarch/boot.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index a516415822..3dd48cb8aa 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -306,7 +306,7 @@ static ram_addr_t alloc_initrd_memory(struct loongarch_boot_info *info,
 static int64_t load_kernel_info(struct loongarch_boot_info *info)
 {
     uint64_t kernel_entry, kernel_low, kernel_high, initrd_offset = 0;
-    ssize_t kernel_size, initrd_size;
+    ssize_t kernel_size;
 
     kernel_size = load_elf(info->kernel_filename, NULL,
                            cpu_loongarch_virt_to_phys, NULL,
@@ -328,7 +328,8 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
     }
 
     if (info->initrd_filename) {
-        initrd_size = get_image_size(info->initrd_filename);
+        ssize_t initrd_size = get_image_size(info->initrd_filename);
+
         if (initrd_size > 0) {
             initrd_offset = ROUND_UP(kernel_high + 4 * kernel_size, 64 * KiB);
             initrd_offset = alloc_initrd_memory(info, initrd_offset,
@@ -337,7 +338,7 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
                                               initrd_offset, initrd_size);
         }
 
-        if (initrd_size == (target_ulong)-1) {
+        if (initrd_size == -1) {
             error_report("could not load initial ram disk '%s'",
                          info->initrd_filename);
             exit(1);

From b73cf656b7222971de75172ee6e037c98f05bec4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 16:38:34 +0200
Subject: [PATCH 1300/2396] hw/hppa: Convert type_init() -> DEFINE_TYPES()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer DEFINE_TYPES() macro over type_init() to register
multiple QOM types.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009143106.22724-3-philmd@linaro.org>
---
 hw/hppa/machine.c | 42 ++++++++++++++++++------------------------
 1 file changed, 18 insertions(+), 24 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index dacedc5409..2ab5fcb471 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -709,16 +709,6 @@ static void HP_B160L_machine_init_class_init(ObjectClass *oc, const void *data)
     nc->nmi_monitor_handler = hppa_nmi;
 }
 
-static const TypeInfo HP_B160L_machine_init_typeinfo = {
-    .name = MACHINE_TYPE_NAME("B160L"),
-    .parent = TYPE_MACHINE,
-    .class_init = HP_B160L_machine_init_class_init,
-    .interfaces = (const InterfaceInfo[]) {
-        { TYPE_NMI },
-        { }
-    },
-};
-
 static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
@@ -745,20 +735,24 @@ static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
     nc->nmi_monitor_handler = hppa_nmi;
 }
 
-static const TypeInfo HP_C3700_machine_init_typeinfo = {
-    .name = MACHINE_TYPE_NAME("C3700"),
-    .parent = TYPE_MACHINE,
-    .class_init = HP_C3700_machine_init_class_init,
-    .interfaces = (const InterfaceInfo[]) {
-        { TYPE_NMI },
-        { }
+static const TypeInfo hppa_machine_types[] = {
+    {
+        .name = MACHINE_TYPE_NAME("B160L"),
+        .parent = TYPE_MACHINE,
+        .class_init = HP_B160L_machine_init_class_init,
+        .interfaces = (const InterfaceInfo[]) {
+            { TYPE_NMI },
+            { }
+        },
+    }, {
+        .name = MACHINE_TYPE_NAME("C3700"),
+        .parent = TYPE_MACHINE,
+        .class_init = HP_C3700_machine_init_class_init,
+        .interfaces = (const InterfaceInfo[]) {
+            { TYPE_NMI },
+            { }
+        },
     },
 };
 
-static void hppa_machine_init_register_types(void)
-{
-    type_register_static(&HP_B160L_machine_init_typeinfo);
-    type_register_static(&HP_C3700_machine_init_typeinfo);
-}
-
-type_init(hppa_machine_init_register_types)
+DEFINE_TYPES(hppa_machine_types)

From 9ccf5f38114d397802452cdf2e794fa26ed457f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 16:42:02 +0200
Subject: [PATCH 1301/2396] hw/hppa: Factor QOM HPPA_COMMON_MACHINE out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

B160L and C3700 share a lot of common code. Factor it out
as an abstract HPPA_COMMON_MACHINE QOM parent.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009143106.22724-4-philmd@linaro.org>
---
 hw/hppa/machine.c | 61 +++++++++++++++++++++++++----------------------
 1 file changed, 33 insertions(+), 28 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 2ab5fcb471..c8da159a11 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -36,6 +36,13 @@
 #include "net/net.h"
 #include "qemu/log.h"
 
+#define TYPE_HPPA_COMMON_MACHINE  MACHINE_TYPE_NAME("hppa-common")
+OBJECT_DECLARE_SIMPLE_TYPE(HppaMachineState, HPPA_COMMON_MACHINE)
+
+struct HppaMachineState {
+    MachineState parent_obj;
+};
+
 #define MIN_SEABIOS_HPPA_VERSION 12 /* require at least this fw version */
 
 #define HPA_POWER_BUTTON        (FIRMWARE_END - 0x10)
@@ -683,6 +690,22 @@ static void hppa_nmi(NMIState *n, int cpu_index, Error **errp)
     }
 }
 
+static void hppa_machine_common_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    NMIClass *nc = NMI_CLASS(oc);
+
+    mc->reset = hppa_machine_reset;
+    mc->block_default_type = IF_SCSI;
+    mc->default_cpus = 1;
+    mc->max_cpus = HPPA_MAX_CPUS;
+    mc->default_boot_order = "cd";
+    mc->default_ram_id = "ram";
+    mc->default_nic = "tulip";
+
+    nc->nmi_monitor_handler = hppa_nmi;
+}
+
 static void HP_B160L_machine_init_class_init(ObjectClass *oc, const void *data)
 {
     static const char * const valid_cpu_types[] = {
@@ -690,23 +713,13 @@ static void HP_B160L_machine_init_class_init(ObjectClass *oc, const void *data)
         NULL
     };
     MachineClass *mc = MACHINE_CLASS(oc);
-    NMIClass *nc = NMI_CLASS(oc);
 
     mc->desc = "HP B160L workstation";
     mc->default_cpu_type = TYPE_HPPA_CPU;
     mc->valid_cpu_types = valid_cpu_types;
     mc->init = machine_HP_B160L_init;
-    mc->reset = hppa_machine_reset;
-    mc->block_default_type = IF_SCSI;
-    mc->max_cpus = HPPA_MAX_CPUS;
-    mc->default_cpus = 1;
     mc->is_default = true;
     mc->default_ram_size = 512 * MiB;
-    mc->default_boot_order = "cd";
-    mc->default_ram_id = "ram";
-    mc->default_nic = "tulip";
-
-    nc->nmi_monitor_handler = hppa_nmi;
 }
 
 static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
@@ -716,42 +729,34 @@ static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
         NULL
     };
     MachineClass *mc = MACHINE_CLASS(oc);
-    NMIClass *nc = NMI_CLASS(oc);
 
     mc->desc = "HP C3700 workstation";
     mc->default_cpu_type = TYPE_HPPA64_CPU;
     mc->valid_cpu_types = valid_cpu_types;
     mc->init = machine_HP_C3700_init;
-    mc->reset = hppa_machine_reset;
-    mc->block_default_type = IF_SCSI;
     mc->max_cpus = HPPA_MAX_CPUS;
-    mc->default_cpus = 1;
-    mc->is_default = false;
     mc->default_ram_size = 1024 * MiB;
-    mc->default_boot_order = "cd";
-    mc->default_ram_id = "ram";
-    mc->default_nic = "tulip";
-
-    nc->nmi_monitor_handler = hppa_nmi;
 }
 
 static const TypeInfo hppa_machine_types[] = {
     {
-        .name = MACHINE_TYPE_NAME("B160L"),
-        .parent = TYPE_MACHINE,
-        .class_init = HP_B160L_machine_init_class_init,
+        .name           = TYPE_HPPA_COMMON_MACHINE,
+        .parent         = TYPE_MACHINE,
+        .instance_size  = sizeof(HppaMachineState),
+        .class_init     = hppa_machine_common_class_init,
+        .abstract       = true,
         .interfaces = (const InterfaceInfo[]) {
             { TYPE_NMI },
             { }
         },
+    }, {
+        .name = MACHINE_TYPE_NAME("B160L"),
+        .parent = TYPE_HPPA_COMMON_MACHINE,
+        .class_init = HP_B160L_machine_init_class_init,
     }, {
         .name = MACHINE_TYPE_NAME("C3700"),
-        .parent = TYPE_MACHINE,
+        .parent = TYPE_HPPA_COMMON_MACHINE,
         .class_init = HP_C3700_machine_init_class_init,
-        .interfaces = (const InterfaceInfo[]) {
-            { TYPE_NMI },
-            { }
-        },
     },
 };
 

From 9fedc11ff127636900cc7a0a3e7214e5cb60a313 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 07:58:16 +0200
Subject: [PATCH 1302/2396] hw/hppa: Reduce variables scope in common_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010061836.45739-4-philmd@linaro.org>
---
 hw/hppa/machine.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index c8da159a11..cddca69b93 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -352,16 +352,11 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
                                         TranslateFn *translate)
 {
     const char *kernel_filename = machine->kernel_filename;
-    const char *kernel_cmdline = machine->kernel_cmdline;
-    const char *initrd_filename = machine->initrd_filename;
-    const char *firmware = machine->firmware;
     MachineClass *mc = MACHINE_GET_CLASS(machine);
     DeviceState *dev;
     PCIDevice *pci_dev;
-    char *firmware_filename;
-    uint64_t firmware_low, firmware_high;
     long size;
-    uint64_t kernel_entry = 0, kernel_low, kernel_high;
+    uint64_t kernel_entry = 0;
     MemoryRegion *addr_space = get_system_memory();
     MemoryRegion *rom_region;
     SysBusDevice *s;
@@ -431,6 +426,10 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
        firmware on 64-bit machines by default if not specified
        on command line. */
     if (!qtest_enabled()) {
+        const char *firmware = machine->firmware;
+        uint64_t firmware_low, firmware_high;
+        char *firmware_filename;
+
         if (!firmware) {
             firmware = lasi_dev ? "hppa-firmware.img" : "hppa-firmware64.img";
         }
@@ -467,6 +466,10 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
 
     /* Load kernel */
     if (kernel_filename) {
+        const char *kernel_cmdline = machine->kernel_cmdline;
+        const char *initrd_filename = machine->initrd_filename;
+        uint64_t kernel_low, kernel_high;
+
         size = load_elf(kernel_filename, NULL, linux_kernel_virt_to_phys,
                         NULL, &kernel_entry, &kernel_low, &kernel_high, NULL,
                         ELFDATA2MSB, EM_PARISC, 0, 0);

From 194dfadd6625504438107e3e740cd9dde158b335 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 10 Oct 2025 16:57:56 +0200
Subject: [PATCH 1303/2396] rust: bits: disable double_parens check

It is showing in the output of the bits! macro when using the nightly
toolchain, though it's not clear if it is intentional or a bug.
Shut it up for now.

Link: https://github.com/rust-lang/rust-clippy/issues/15852
Reported-by: Richard Henderson <richard.henderson@linaro.org>
Suggested-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/20251010145756.787800-1-pbonzini@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/qemu-macros/src/lib.rs | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 3e21b67b47..3bf315c4c0 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -401,7 +401,14 @@ pub fn bits_const_internal(ts: TokenStream) -> TokenStream {
     let ts = proc_macro2::TokenStream::from(ts);
     let mut it = ts.into_iter();
 
-    BitsConstInternal::parse(&mut it)
-        .unwrap_or_else(syn::Error::into_compile_error)
-        .into()
+    let out = BitsConstInternal::parse(&mut it).unwrap_or_else(syn::Error::into_compile_error);
+
+    // https://github.com/rust-lang/rust-clippy/issues/15852
+    quote! {
+        {
+            #[allow(clippy::double_parens)]
+            #out
+        }
+    }
+    .into()
 }

From ceda1563d6d347647419f61508856e5236069e02 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 16:01:55 +0200
Subject: [PATCH 1304/2396] rust: migration: hide more warnings from
 call_func_with_field!

The call_func_with_field! macro uses dead code willingly to infer
the appropriate type.  This has started adding a new warning:

error: unused variable: `value__`
 79 |             break phantom__(&{ let value__: $typ; value__.$($field).+ })

So shut it up together with the existing unreachable_code warning.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 1 +
 1 file changed, 1 insertion(+)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index e04b19b3c9..5f5708ad39 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -72,6 +72,7 @@ macro_rules! call_func_with_field {
     ($func:expr, $typ:ty, $($field:tt).+) => {
         $func(loop {
             #![allow(unreachable_code)]
+            #![allow(unused_variables)]
             const fn phantom__<T>(_: &T) -> ::core::marker::PhantomData<T> { ::core::marker::PhantomData }
             // Unreachable code is exempt from checks on uninitialized values.
             // Use that trick to infer the type of this PhantomData.

From 414ac7e057047706914232142d7a7d38440b3f9b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 16:49:12 +0200
Subject: [PATCH 1305/2396] rust: hpet: fix fw_cfg handling

HPET ids for fw_cfg are not assigned correctly, because there
is a read but no write.  This is caught by nightly Rust as
an unused-assignments warning, so fix it.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/fw_cfg.rs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index e569b57b93..bb4ea8909a 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -40,7 +40,7 @@ impl HPETFwConfig {
         assert!(bql::is_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
-        let mut fw_cfg = unsafe { *addr_of_mut!(hpet_fw_cfg) };
+        let fw_cfg = unsafe { &mut *addr_of_mut!(hpet_fw_cfg) };
 
         if fw_cfg.count == u8::MAX {
             // first instance
@@ -60,7 +60,7 @@ impl HPETFwConfig {
         assert!(bql::is_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
-        let mut fw_cfg = unsafe { *addr_of_mut!(hpet_fw_cfg) };
+        let fw_cfg = unsafe { &mut *addr_of_mut!(hpet_fw_cfg) };
 
         fw_cfg.hpet[hpet_id].event_timer_block_id = timer_block_id;
         fw_cfg.hpet[hpet_id].address = address;

From c79a35acadee784610aed40134a12738381b4fba Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 10 Jul 2025 14:46:10 -0500
Subject: [PATCH 1306/2396] target/i386: Add TSA attack variants TSA-SQ and
 TSA-L1

Transient Scheduler Attacks (TSA) are new speculative side channel attacks
related to the execution timing of instructions under specific
microarchitectural conditions. In some cases, an attacker may be able to
use this timing information to infer data from other contexts, resulting in
information leakage.

AMD has identified two sub-variants two variants of TSA.
CPUID Fn8000_0021 ECX[1] (TSA_SQ_NO).
	If this bit is 1, the CPU is not vulnerable to TSA-SQ.

CPUID Fn8000_0021 ECX[2] (TSA_L1_NO).
	If this bit is 1, the CPU is not vulnerable to TSA-L1.

Add the new feature word FEAT_8000_0021_ECX and corresponding bits to
detect TSA variants.

Link: https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf
Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/12881b2c03fa351316057ddc5f39c011074b4549.1752176771.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 17 +++++++++++++++++
 target/i386/cpu.h |  6 ++++++
 2 files changed, 23 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index ab18de894e..339881b40f 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1415,6 +1415,22 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .tcg_features = 0,
         .unmigratable_flags = 0,
     },
+    [FEAT_8000_0021_ECX] = {
+        .type = CPUID_FEATURE_WORD,
+        .feat_names = {
+            NULL, "tsa-sq-no", "tsa-l1-no", NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+            NULL, NULL, NULL, NULL,
+        },
+        .cpuid = { .eax = 0x80000021, .reg = R_ECX, },
+        .tcg_features = 0,
+        .unmigratable_flags = 0,
+    },
     [FEAT_8000_0022_EAX] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
@@ -8526,6 +8542,7 @@ void cpu_x86_cpuid(CPUX86State *env, uint32_t index, uint32_t count,
         *eax = *ebx = *ecx = *edx = 0;
         *eax = env->features[FEAT_8000_0021_EAX];
         *ebx = env->features[FEAT_8000_0021_EBX];
+        *ecx = env->features[FEAT_8000_0021_ECX];
         break;
     case 0x80000022:
         *eax = *ebx = *ecx = *edx = 0;
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 8b7c173838..f74f13534e 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -643,6 +643,7 @@ typedef enum FeatureWord {
     FEAT_8000_0008_EBX, /* CPUID[8000_0008].EBX */
     FEAT_8000_0021_EAX, /* CPUID[8000_0021].EAX */
     FEAT_8000_0021_EBX, /* CPUID[8000_0021].EBX */
+    FEAT_8000_0021_ECX, /* CPUID[8000_0021].ECX */
     FEAT_8000_0022_EAX, /* CPUID[8000_0022].EAX */
     FEAT_C000_0001_EDX, /* CPUID[C000_0001].EDX */
     FEAT_KVM,           /* CPUID[4000_0001].EAX (KVM_CPUID_FEATURES) */
@@ -1126,6 +1127,11 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
  */
 #define CPUID_8000_0021_EBX_RAPSIZE    (8U << 16)
 
+/* CPU is not vulnerable TSA SA-SQ attack */
+#define CPUID_8000_0021_ECX_TSA_SQ_NO  (1U << 1)
+/* CPU is not vulnerable TSA SA-L1 attack */
+#define CPUID_8000_0021_ECX_TSA_L1_NO  (1U << 2)
+
 /* Performance Monitoring Version 2 */
 #define CPUID_8000_0022_EAX_PERFMON_V2  (1U << 0)
 

From d8ec0baf4a15082cdc4abe1de28face9a26f0dc9 Mon Sep 17 00:00:00 2001
From: Babu Moger <babu.moger@amd.com>
Date: Thu, 10 Jul 2025 14:46:11 -0500
Subject: [PATCH 1307/2396] target/i386: Add TSA feature flag verw-clear

Transient Scheduler Attacks (TSA) are new speculative side channel attacks
related to the execution timing of instructions under specific
microarchitectural conditions. In some cases, an attacker may be able to
use this timing information to infer data from other contexts, resulting in
information leakage

CPUID Fn8000_0021 EAX[5] (VERW_CLEAR). If this bit is 1, the memory form of
the VERW instruction may be used to help mitigate TSA.

Link: https://www.amd.com/content/dam/amd/en/documents/resources/bulletin/technical-guidance-for-mitigating-transient-scheduler-attacks.pdf
Co-developed-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Borislav Petkov (AMD) <bp@alien8.de>
Signed-off-by: Babu Moger <babu.moger@amd.com>
Reviewed-by: Xiaoyao Li <xiaoyao.li@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Link: https://lore.kernel.org/r/e6362672e3a67a9df661a8f46598335a1a2d2754.1752176771.git.babu.moger@amd.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 2 +-
 target/i386/cpu.h | 2 ++
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 339881b40f..4f99cbc5c0 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -1397,7 +1397,7 @@ FeatureWordInfo feature_word_info[FEATURE_WORDS] = {
         .type = CPUID_FEATURE_WORD,
         .feat_names = {
             "no-nested-data-bp", "fs-gs-base-ns", "lfence-always-serializing", NULL,
-            NULL, NULL, "null-sel-clr-base", NULL,
+            NULL, "verw-clear", "null-sel-clr-base", NULL,
             "auto-ibrs", NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
             NULL, NULL, NULL, NULL,
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index f74f13534e..ce948861a7 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -1104,6 +1104,8 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w);
 #define CPUID_8000_0021_EAX_FS_GS_BASE_NS                (1U << 1)
 /* LFENCE is always serializing */
 #define CPUID_8000_0021_EAX_LFENCE_ALWAYS_SERIALIZING    (1U << 2)
+/* Memory form of VERW mitigates TSA */
+#define CPUID_8000_0021_EAX_VERW_CLEAR                   (1U << 5)
 /* Null Selector Clears Base */
 #define CPUID_8000_0021_EAX_NULL_SEL_CLR_BASE            (1U << 6)
 /* Automatic IBRS */

From df9a3372ddebfcfc135861fa2d53cef6f98065f9 Mon Sep 17 00:00:00 2001
From: Mathias Krause <minipli@grsecurity.net>
Date: Thu, 12 Jun 2025 16:21:55 +0200
Subject: [PATCH 1308/2396] target/i386: Fix CR2 handling for non-canonical
 addresses

Commit 3563362ddfae ("target/i386: Introduce structures for mmu_translate")
accidentally modified CR2 for non-canonical address exceptions while these
should lead to a #GP / #SS instead -- without changing CR2.

Fix that.

A KUT test for this was submitted as [1].

[1] https://lore.kernel.org/kvm/20250612141637.131314-1-minipli@grsecurity.net/

Fixes: 3563362ddfae ("target/i386: Introduce structures for mmu_translate")
Signed-off-by: Mathias Krause <minipli@grsecurity.net>
Link: https://lore.kernel.org/r/20250612142155.132175-1-minipli@grsecurity.net
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/system/excp_helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/i386/tcg/system/excp_helper.c b/target/i386/tcg/system/excp_helper.c
index 50040f6fca..f622b5d588 100644
--- a/target/i386/tcg/system/excp_helper.c
+++ b/target/i386/tcg/system/excp_helper.c
@@ -592,7 +592,8 @@ static bool get_physical_address(CPUX86State *env, vaddr addr,
                 if (sext != 0 && sext != -1) {
                     *err = (TranslateFault){
                         .exception_index = EXCP0D_GPF,
-                        .cr2 = addr,
+                        /* non-canonical #GP doesn't change CR2 */
+                        .cr2 = env->cr[2],
                     };
                     return false;
                 }

From 00001a22d183ce96c110690987bf9dd6a8548552 Mon Sep 17 00:00:00 2001
From: Jon Kohler <jon@nutanix.com>
Date: Wed, 8 Oct 2025 13:25:57 -0700
Subject: [PATCH 1309/2396] i386/kvm: Expose ARCH_CAP_FB_CLEAR when
 invulnerable to MDS

Newer Intel hardware (Sapphire Rapids and higher) sets multiple MDS
immunity bits in MSR_IA32_ARCH_CAPABILITIES but lacks the hardware-level
MSR_ARCH_CAP_FB_CLEAR (bit 17):
    ARCH_CAP_MDS_NO
    ARCH_CAP_TAA_NO
    ARCH_CAP_PSDP_NO
    ARCH_CAP_FBSDP_NO
    ARCH_CAP_SBDR_SSDP_NO

This prevents VMs with fb-clear=on from migrating from older hardware
(Cascade Lake, Ice Lake) to newer hardware, limiting live migration
capabilities. Note fb-clear was first introduced in v8.1.0 [1].

Expose MSR_ARCH_CAP_FB_CLEAR for MDS-invulnerable systems to enable
seamless migration between hardware generations.

Note: There is no impact when a guest migrates to newer hardware as
the existing bit combinations already mark the host as MMIO-immune and
disable FB_CLEAR operations in the kernel (see Linux's
arch_cap_mmio_immune() and vmx_update_fb_clear_dis()). See kernel side
discussion for [2] for additional context.

[1] 22e1094ca82 ("target/i386: add support for FB_CLEAR feature")
[2] https://patchwork.kernel.org/project/kvm/patch/20250401044931.793203-1-jon@nutanix.com/

Cc: Pawan Gupta <pawan.kumar.gupta@linux.intel.com>
Suggested-by: Sean Christopherson <seanjc@google.com>
Signed-off-by: Jon Kohler <jon@nutanix.com>
Link: https://lore.kernel.org/r/20251008202557.4141285-1-jon@nutanix.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/kvm/kvm.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index db40caa341..e40e374b04 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -653,6 +653,23 @@ uint64_t kvm_arch_get_supported_msr_feature(KVMState *s, uint32_t index)
         must_be_one = (uint32_t)value;
         can_be_one = (uint32_t)(value >> 32);
         return can_be_one & ~must_be_one;
+    case MSR_IA32_ARCH_CAPABILITIES:
+        /*
+         * Special handling for fb-clear bit in ARCH_CAPABILITIES MSR.
+         * KVM will only report the bit if it is enabled in the host,
+         * but, for live migration capability purposes, we want to
+         * expose the bit to the guest even if it is disabled in the
+         * host, as long as the host itself is not vulnerable to
+         * the issue that the fb-clear bit is meant to mitigate.
+         */
+        if ((value & MSR_ARCH_CAP_MDS_NO) &&
+            (value & MSR_ARCH_CAP_TAA_NO) &&
+            (value & MSR_ARCH_CAP_SBDR_SSDP_NO) &&
+            (value & MSR_ARCH_CAP_FBSDP_NO) &&
+            (value & MSR_ARCH_CAP_PSDP_NO)) {
+                value |= MSR_ARCH_CAP_FB_CLEAR;
+        }
+        return value;
 
     default:
         return value;

From df32e5c568c9cf68c15a9bbd98d0c3aff19eab63 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 11 Oct 2025 09:13:29 +0200
Subject: [PATCH 1310/2396] i386/cpu: Prevent delivering SIPI during SMM in TCG
 mode

[commit message by YiFei Zhu]

A malicious kernel may control the instruction pointer in SMM in a
multi-processor VM by sending a sequence of IPIs via APIC:

CPU0			CPU1
IPI(CPU1, MODE_INIT)
			x86_cpu_exec_reset()
			apic_init_reset()
			s->wait_for_sipi = true
IPI(CPU1, MODE_SMI)
			do_smm_enter()
			env->hflags |= HF_SMM_MASK;
IPI(CPU1, MODE_STARTUP, vector)
			do_cpu_sipi()
			apic_sipi()
			/* s->wait_for_sipi check passes */
			cpu_x86_load_seg_cache_sipi(vector)

A different sequence, SMI INIT SIPI, is also buggy in TCG because
INIT is not blocked or latched during SMM. However, it is not
vulnerable to an instruction pointer control in the same way because
x86_cpu_exec_reset clears env->hflags, exiting SMM.

Fixes: a9bad65d2c1f ("target-i386: wake up processors that receive an SMI")
Analyzed-by: YiFei Zhu <zhuyifei@google.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/intc/apic.c                      | 2 --
 target/i386/helper.c                | 4 ++++
 target/i386/tcg/system/seg_helper.c | 1 +
 3 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 6d7859640c..c768033856 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -646,8 +646,6 @@ void apic_sipi(DeviceState *dev)
 {
     APICCommonState *s = APIC(dev);
 
-    cpu_reset_interrupt(CPU(s->cpu), CPU_INTERRUPT_SIPI);
-
     if (!s->wait_for_sipi)
         return;
     cpu_x86_load_seg_cache_sipi(s->cpu, s->sipi_vector);
diff --git a/target/i386/helper.c b/target/i386/helper.c
index 651041ccfa..72b2e195a3 100644
--- a/target/i386/helper.c
+++ b/target/i386/helper.c
@@ -621,6 +621,10 @@ void do_cpu_init(X86CPU *cpu)
 
 void do_cpu_sipi(X86CPU *cpu)
 {
+    CPUX86State *env = &cpu->env;
+    if (env->hflags & HF_SMM_MASK) {
+        return;
+    }
     apic_sipi(cpu->apic_state);
 }
 
diff --git a/target/i386/tcg/system/seg_helper.c b/target/i386/tcg/system/seg_helper.c
index 38072e51d7..8c7856be81 100644
--- a/target/i386/tcg/system/seg_helper.c
+++ b/target/i386/tcg/system/seg_helper.c
@@ -182,6 +182,7 @@ bool x86_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
         apic_poll_irq(cpu->apic_state);
         break;
     case CPU_INTERRUPT_SIPI:
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_SIPI);
         do_cpu_sipi(cpu);
         break;
     case CPU_INTERRUPT_SMI:

From cdba90ac1b0ac789b10c0b5f6ef7e9558237ec66 Mon Sep 17 00:00:00 2001
From: YiFei Zhu <zhuyifei@google.com>
Date: Thu, 25 Sep 2025 10:30:57 +0000
Subject: [PATCH 1311/2396] i386/tcg/smm_helper: Properly apply DR values on
 SMM entry / exit

do_smm_enter and helper_rsm sets the env->dr, but does not sync the
values with cpu_x86_update_dr7. A malicious kernel may control the
instruction pointer in SMM by setting a breakpoint on the SMI
entry point, and after do_smm_enter cpu->breakpoints contains the
stale breakpoint; and because IDT is not reloaded upon SMI entry,
the debug exception handler controlled by the malicious kernel
is invoked.

Fixes: 01df040b5247 ("x86: Debug register emulation (Jan Kiszka)")
Reported-by: unvariant.winter@gmail.com
Signed-off-by: YiFei Zhu <zhuyifei@google.com>
Link: https://lore.kernel.org/r/2bacb9b24e9d337dbe48791aa25d349eb9c52c3a.1758794468.git.zhuyifei@google.com
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/system/smm_helper.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/i386/tcg/system/smm_helper.c b/target/i386/tcg/system/smm_helper.c
index 251eb7856c..fb028a8272 100644
--- a/target/i386/tcg/system/smm_helper.c
+++ b/target/i386/tcg/system/smm_helper.c
@@ -168,7 +168,7 @@ void do_smm_enter(X86CPU *cpu)
                        env->cr[0] & ~(CR0_PE_MASK | CR0_EM_MASK | CR0_TS_MASK |
                                       CR0_PG_MASK));
     cpu_x86_update_cr4(env, 0);
-    env->dr[7] = 0x00000400;
+    helper_set_dr(env, 7, 0x00000400);
 
     cpu_x86_load_seg_cache(env, R_CS, (env->smbase >> 4) & 0xffff, env->smbase,
                            0xffffffff,
@@ -233,8 +233,8 @@ void helper_rsm(CPUX86State *env)
     env->eip = x86_ldq_phys(cs, sm_state + 0x7f78);
     cpu_load_eflags(env, x86_ldl_phys(cs, sm_state + 0x7f70),
                     ~(CC_O | CC_S | CC_Z | CC_A | CC_P | CC_C | DF_MASK));
-    env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7f68);
-    env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7f60);
+    helper_set_dr(env, 6, x86_ldl_phys(cs, sm_state + 0x7f68));
+    helper_set_dr(env, 7, x86_ldl_phys(cs, sm_state + 0x7f60));
 
     cpu_x86_update_cr4(env, x86_ldl_phys(cs, sm_state + 0x7f48));
     cpu_x86_update_cr3(env, x86_ldq_phys(cs, sm_state + 0x7f50));
@@ -268,8 +268,8 @@ void helper_rsm(CPUX86State *env)
     env->regs[R_EDX] = x86_ldl_phys(cs, sm_state + 0x7fd8);
     env->regs[R_ECX] = x86_ldl_phys(cs, sm_state + 0x7fd4);
     env->regs[R_EAX] = x86_ldl_phys(cs, sm_state + 0x7fd0);
-    env->dr[6] = x86_ldl_phys(cs, sm_state + 0x7fcc);
-    env->dr[7] = x86_ldl_phys(cs, sm_state + 0x7fc8);
+    helper_set_dr(env, 6, x86_ldl_phys(cs, sm_state + 0x7fcc));
+    helper_set_dr(env, 7, x86_ldl_phys(cs, sm_state + 0x7fc8));
 
     env->tr.selector = x86_ldl_phys(cs, sm_state + 0x7fc4) & 0xffff;
     env->tr.base = x86_ldl_phys(cs, sm_state + 0x7f64);

From 5a2faa0a0a2cbdad4a108a0e122b0e51b9bc94fd Mon Sep 17 00:00:00 2001
From: Thomas Ogrisegg <tom-bugs-qemu@fnord.at>
Date: Tue, 15 Jul 2025 23:03:07 +0200
Subject: [PATCH 1312/2396] target/i386: fix x86_64 pushw op

For x86_64 a 16 bit push op (pushw) of a memory address would generate
a 64 bit store on the stack instead of a 16 bit store.

For example:
        pushw (%rax)

behaves like
        pushq (%rax)

which is incorrect.

This patch fixes that.

Signed-off-by: Thomas Ogrisegg <tom-bugs-qemu@fnord.at>
Link: https://lore.kernel.org/r/20250715210307.GA1115@x1.fnord.at
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 51038657f0..a50f57dbaa 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -1541,7 +1541,7 @@ static void decode_group4_5(DisasContext *s, CPUX86State *env, X86OpEntry *entry
         [0x0b] = X86_OP_ENTRYr(CALLF_m, M,p),
         [0x0c] = X86_OP_ENTRYr(JMP_m,   E,f64,                         zextT0),
         [0x0d] = X86_OP_ENTRYr(JMPF_m,  M,p),
-        [0x0e] = X86_OP_ENTRYr(PUSH,    E,f64),
+        [0x0e] = X86_OP_ENTRYr(PUSH,    E,d64),
     };
 
     int w = (*b & 1);

From 0d22b621b7969eefde3535a0805977a334936fd7 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 18:08:12 +0200
Subject: [PATCH 1313/2396] target/i386: fix access to the T bit of the TSS

The T bit is bit 0 of the 16-bit word at offset 100 of the TSS.  However,
accessing it with a 32-bit word is not really correct, because bytes
102-103 contain the I/O map base address (relative to the base of the
TSS) and bits 1-15 are reserved.  In particular, any task switch to a TSS that
has a nonzero I/O map base address is broken.

This fixes the eventinj and taskswitch tests in kvm-unit-tests.

Cc: qemu-stable@nongnu.org
Fixes: ad441b8b791 ("target/i386: implement TSS trap bit", 2025-05-12)
Reported-by: Thomas Huth <thuth@redhat.com>
Closes: https://gitlab.com/qemu-project/qemu/-/issues/3101
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/seg_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 071f3fbd83..f49fe851cd 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -456,7 +456,7 @@ static void switch_tss_ra(CPUX86State *env, int tss_selector,
             new_segs[i] = access_ldw(&new, tss_base + (0x48 + i * 4));
         }
         new_ldt = access_ldw(&new, tss_base + 0x60);
-        new_trap = access_ldl(&new, tss_base + 0x64);
+        new_trap = access_ldw(&new, tss_base + 0x64) & 1;
     } else {
         /* 16 bit */
         new_cr3 = 0;

From 5142397c79330aab9bef3230991c8ac0c251110f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 18:24:54 +0200
Subject: [PATCH 1314/2396] async: access bottom half flags with qatomic_read

Running test-aio-multithread under TSAN reveals data races on bh->flags.
Because bottom halves may be scheduled or canceled asynchronously,
without taking a lock, adjust aio_compute_bh_timeout() and aio_ctx_check()
to use a relaxed read to access the flags.

Use an acquire load to ensure that anything that was written prior to
qemu_bh_schedule() is visible.

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2749
Closes: https://gitlab.com/qemu-project/qemu/-/issues/851
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 util/async.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/util/async.c b/util/async.c
index 2719c629ae..a736d2cd0d 100644
--- a/util/async.c
+++ b/util/async.c
@@ -256,8 +256,9 @@ static int64_t aio_compute_bh_timeout(BHList *head, int timeout)
     QEMUBH *bh;
 
     QSLIST_FOREACH_RCU(bh, head, next) {
-        if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
-            if (bh->flags & BH_IDLE) {
+        int flags = qatomic_load_acquire(&bh->flags);
+        if ((flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
+            if (flags & BH_IDLE) {
                 /* idle bottom halves will be polled at least
                  * every 10ms */
                 timeout = 10000000;
@@ -335,14 +336,16 @@ aio_ctx_check(GSource *source)
     aio_notify_accept(ctx);
 
     QSLIST_FOREACH_RCU(bh, &ctx->bh_list, next) {
-        if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
+        int flags = qatomic_load_acquire(&bh->flags);
+        if ((flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
             return true;
         }
     }
 
     QSIMPLEQ_FOREACH(s, &ctx->bh_slice_list, next) {
         QSLIST_FOREACH_RCU(bh, &s->bh_list, next) {
-            if ((bh->flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
+            int flags = qatomic_load_acquire(&bh->flags);
+            if ((flags & (BH_SCHEDULED | BH_DELETED)) == BH_SCHEDULED) {
                 return true;
             }
         }

From 58aa1d08bbc406ba3982f32ffb1bef0ff4f8f369 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 18:34:28 +0200
Subject: [PATCH 1315/2396] target/i386: user: do not set up a valid LDT on
 reset

In user-mode emulation, QEMU uses the default setting of the LDT base
and limit, which places it at the bottom 64K of virtual address space.
However, by default there is no LDT at all in Linux processes, and
therefore the limit should be 0.

This is visible as a NULL pointer dereference in LSL and LAR instructions
when they try to read the LDT at an unmapped address.

Resolves: #1376
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 4f99cbc5c0..455caff6b2 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8649,7 +8649,11 @@ static void x86_cpu_reset_hold(Object *obj, ResetType type)
 
     env->idt.limit = 0xffff;
     env->gdt.limit = 0xffff;
+#if defined(CONFIG_USER_ONLY)
+    env->ldt.limit = 0;
+#else
     env->ldt.limit = 0xffff;
+#endif
     env->ldt.flags = DESC_P_MASK | (2 << DESC_TYPE_SHIFT);
     env->tr.limit = 0xffff;
     env->tr.flags = DESC_P_MASK | (11 << DESC_TYPE_SHIFT);

From 2808652b4fae100dd1a46344c686db6e6136784e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 12:59:28 +0200
Subject: [PATCH 1316/2396] monitor: clarify "info accel" help message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation for adding "info accelerators", explain that this command
is about runtime statistics.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hmp-commands-info.hx | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index eaaa880c1b..c2aa40056b 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -271,12 +271,12 @@ ERST
         .name       = "accel",
         .args_type  = "",
         .params     = "",
-        .help       = "show accelerator info",
+        .help       = "show accelerator statistics",
     },
 
 SRST
   ``info accel``
-    Show accelerator info.
+    Show accelerator statistics.
 ERST
 
 SRST

From 71d5babbd6fffc7def1ecbf29f9753e3a2807761 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 13 Oct 2025 12:49:04 +0200
Subject: [PATCH 1317/2396] monitor: generalize query-mshv/"info mshv" to
 query-accelerators/"info accelerators"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The recently-introduced query-mshv command is a duplicate of query-kvm,
and neither provides a full view of which accelerators are supported
by a particular binary of QEMU and which is in use.

KVM was the first accelerator added to QEMU, predating QOM and TYPE_ACCEL,
so it got a pass.  But now, instead of adding a badly designed copy, solve
the problem completely for all accelerators with a command that provides
the whole picture:

    >> {"execute": "query-accelerators"}
    << {"return": {"enabled": "tcg", "present": ["kvm", "mshv", "qtest", "tcg", "xen"]}}

Cc: Praveen K Paladugu <prapal@microsoft.com>
Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Suggested-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hmp-commands-info.hx       | 15 ++++++++----
 hw/core/machine-hmp-cmds.c | 21 +++++++++--------
 hw/core/machine-qmp-cmds.c | 20 ++++++++++++----
 include/monitor/hmp.h      |  2 +-
 qapi/accelerator.json      | 47 +++++++++++++++++++++++++++++---------
 5 files changed, 74 insertions(+), 31 deletions(-)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index c2aa40056b..25b4aed51f 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -308,16 +308,21 @@ SRST
 ERST
 
     {
-        .name       = "mshv",
+        .name       = "accelerators",
         .args_type  = "",
         .params     = "",
-        .help       = "show MSHV information",
-        .cmd        = hmp_info_mshv,
+        .help       = "show present and enabled information",
+        .cmd        = hmp_info_accelerators,
     },
 
 SRST
-  ``info mshv``
-    Show MSHV information.
+  ``info accelerators``
+    Show which accelerators are compiled into a QEMU binary, and what accelerator
+    is in use. For example::
+
+        kvm qtest [tcg]
+
+    indicates that TCG in use, and that KVM and qtest are also available.
 ERST
 
     {
diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
index 682ed9f49b..74a56600be 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -163,19 +163,22 @@ void hmp_info_kvm(Monitor *mon, const QDict *qdict)
     qapi_free_KvmInfo(info);
 }
 
-void hmp_info_mshv(Monitor *mon, const QDict *qdict)
+void hmp_info_accelerators(Monitor *mon, const QDict *qdict)
 {
-    MshvInfo *info;
+    AcceleratorInfo *info;
+    AcceleratorList *accel;
 
-    info = qmp_query_mshv(NULL);
-    monitor_printf(mon, "mshv support: ");
-    if (info->present) {
-        monitor_printf(mon, "%s\n", info->enabled ? "enabled" : "disabled");
-    } else {
-        monitor_printf(mon, "not compiled\n");
+    info = qmp_query_accelerators(NULL);
+    for (accel = info->present; accel; accel = accel->next) {
+        char trail = accel->next ? ' ' : '\n';
+        if (info->enabled == accel->value) {
+            monitor_printf(mon, "[%s]%c", Accelerator_str(accel->value), trail);
+        } else {
+            monitor_printf(mon, "%s%c", Accelerator_str(accel->value), trail);
+        }
     }
 
-    qapi_free_MshvInfo(info);
+    qapi_free_AcceleratorInfo(info);
 }
 
 void hmp_info_uuid(Monitor *mon, const QDict *qdict)
diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index e24bf0d97b..51d5c230f7 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -31,15 +31,25 @@
 #include <sys/stat.h>
 
 /*
- * QMP query for MSHV
+ * QMP query for enabled and present accelerators
  */
-MshvInfo *qmp_query_mshv(Error **errp)
+AcceleratorInfo *qmp_query_accelerators(Error **errp)
 {
-    MshvInfo *info = g_malloc0(sizeof(*info));
+    AcceleratorInfo *info = g_malloc0(sizeof(*info));
+    AccelClass *current_class = ACCEL_GET_CLASS(current_accel());
+    int i;
 
-    info->enabled = mshv_enabled();
-    info->present = accel_find("mshv");
+    for (i = ACCELERATOR__MAX; i-- > 0; ) {
+        const char *s = Accelerator_str(i);
+        AccelClass *this_class = accel_find(s);
 
+        if (this_class) {
+            QAPI_LIST_PREPEND(info->present, i);
+            if (this_class == current_class) {
+                info->enabled = i;
+            }
+        }
+    }
     return info;
 }
 
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 31bd812e5f..897dfaa2b6 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -24,7 +24,7 @@ strList *hmp_split_at_comma(const char *str);
 void hmp_info_name(Monitor *mon, const QDict *qdict);
 void hmp_info_version(Monitor *mon, const QDict *qdict);
 void hmp_info_kvm(Monitor *mon, const QDict *qdict);
-void hmp_info_mshv(Monitor *mon, const QDict *qdict);
+void hmp_info_accelerators(Monitor *mon, const QDict *qdict);
 void hmp_info_status(Monitor *mon, const QDict *qdict);
 void hmp_info_uuid(Monitor *mon, const QDict *qdict);
 void hmp_info_chardev(Monitor *mon, const QDict *qdict);
diff --git a/qapi/accelerator.json b/qapi/accelerator.json
index 664e027246..2b92060884 100644
--- a/qapi/accelerator.json
+++ b/qapi/accelerator.json
@@ -56,30 +56,55 @@
   'features': [ 'unstable' ] }
 
 ##
-# @MshvInfo:
+# @Accelerator:
 #
 # Information about support for MSHV acceleration
 #
-# @enabled: true if MSHV acceleration is active
+# @hvf: Apple Hypervisor.framework
 #
-# @present: true if MSHV acceleration is built into this executable
+# @kvm: KVM
+#
+# @mshv: Hyper-V
+#
+# @nvmm: NetBSD NVMM
+#
+# @qtest: QTest (dummy accelerator)
+#
+# @tcg: TCG (dynamic translation)
+#
+# @whpx: Windows Hypervisor Platform
+#
+# @xen: Xen
 #
 # Since: 10.2.0
 ##
-{ 'struct': 'MshvInfo', 'data': {'enabled': 'bool', 'present': 'bool'} }
+{ 'enum': 'Accelerator', 'data': ['hvf', 'kvm', 'mshv', 'nvmm', 'qtest', 'tcg', 'whpx', 'xen'] }
 
 ##
-# @query-mshv:
+# @AcceleratorInfo:
 #
-# Return information about MSHV acceleration
+# Information about support for various accelerators
 #
-# Returns: @MshvInfo
+# @enabled: the accelerator that is in use
 #
-# Since: 10.0.92
+# @present: the list of accelerators that are built into this executable
+#
+# Since: 10.2.0
+##
+{ 'struct': 'AcceleratorInfo', 'data': {'enabled': 'Accelerator', 'present': ['Accelerator']} }
+
+##
+# @query-accelerators:
+#
+# Return information about accelerators
+#
+# Returns: @AcceleratorInfo
+#
+# Since: 10.2.0
 #
 # .. qmp-example::
 #
-#     -> { "execute": "query-mshv" }
-#     <- { "return": { "enabled": true, "present": true } }
+#     -> { "execute": "query-accelerators" }
+#     <- { "return": { "enabled": "mshv", "present": ["kvm", "mshv", "qtest", "tcg"] } }
 ##
-{ 'command': 'query-mshv', 'returns': 'MshvInfo' }
+{ 'command': 'query-accelerators', 'returns': 'AcceleratorInfo' }

From 665a8035b7e65f5dcb5cdacb3a31c9087cff8684 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:07:13 +0200
Subject: [PATCH 1318/2396] accel/kvm: Introduce KvmPutState enum
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Join the 3 KVM_PUT_*_STATE definitions in a single enum.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251008040715.81513-3-philmd@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/system/kvm.h       | 16 +++++++++-------
 target/arm/kvm.c           |  2 +-
 target/i386/kvm/kvm.c      |  6 +++---
 target/loongarch/kvm/kvm.c |  4 ++--
 target/mips/kvm.c          |  6 +++---
 target/ppc/kvm.c           |  2 +-
 target/riscv/kvm/kvm-cpu.c |  2 +-
 target/s390x/kvm/kvm.c     |  2 +-
 8 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/include/system/kvm.h b/include/system/kvm.h
index 4fc09e3891..8f9eecf044 100644
--- a/include/system/kvm.h
+++ b/include/system/kvm.h
@@ -340,14 +340,16 @@ int kvm_arch_process_async_events(CPUState *cpu);
 
 int kvm_arch_get_registers(CPUState *cpu, Error **errp);
 
-/* state subset only touched by the VCPU itself during runtime */
-#define KVM_PUT_RUNTIME_STATE   1
-/* state subset modified during VCPU reset */
-#define KVM_PUT_RESET_STATE     2
-/* full state set, modified during initialization or on vmload */
-#define KVM_PUT_FULL_STATE      3
+typedef enum kvm_put_state {
+    /* state subset only touched by the VCPU itself during runtime */
+    KVM_PUT_RUNTIME_STATE = 1,
+    /* state subset modified during VCPU reset */
+    KVM_PUT_RESET_STATE = 2,
+    /* full state set, modified during initialization or on vmload */
+    KVM_PUT_FULL_STATE = 3,
+} KvmPutState;
 
-int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp);
+int kvm_arch_put_registers(CPUState *cpu, KvmPutState level, Error **errp);
 
 int kvm_arch_get_default_type(MachineState *ms);
 
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index 4f769d69b3..0d57081e69 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -2123,7 +2123,7 @@ static int kvm_arch_put_sve(CPUState *cs)
     return 0;
 }
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     uint64_t val;
     uint32_t fpr;
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index e40e374b04..309f043373 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -3924,7 +3924,7 @@ static void kvm_init_msrs(X86CPU *cpu)
     assert(kvm_buf_set_msrs(cpu) == 0);
 }
 
-static int kvm_put_msrs(X86CPU *cpu, int level)
+static int kvm_put_msrs(X86CPU *cpu, KvmPutState level)
 {
     CPUX86State *env = &cpu->env;
     int i;
@@ -5044,7 +5044,7 @@ static int kvm_get_apic(X86CPU *cpu)
     return 0;
 }
 
-static int kvm_put_vcpu_events(X86CPU *cpu, int level)
+static int kvm_put_vcpu_events(X86CPU *cpu, KvmPutState level)
 {
     CPUState *cs = CPU(cpu);
     CPUX86State *env = &cpu->env;
@@ -5287,7 +5287,7 @@ static int kvm_get_nested_state(X86CPU *cpu)
     return ret;
 }
 
-int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cpu, KvmPutState level, Error **errp)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     int ret;
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index e5ea2dba9d..4e4f4e79f6 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -325,7 +325,7 @@ static int kvm_loongarch_get_csr(CPUState *cs)
     return ret;
 }
 
-static int kvm_loongarch_put_csr(CPUState *cs, int level)
+static int kvm_loongarch_put_csr(CPUState *cs, KvmPutState level)
 {
     int ret = 0;
     CPULoongArchState *env = cpu_env(cs);
@@ -763,7 +763,7 @@ int kvm_arch_get_registers(CPUState *cs, Error **errp)
     return ret;
 }
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     int ret;
     static int once;
diff --git a/target/mips/kvm.c b/target/mips/kvm.c
index 450947c3fa..912cd5dfa0 100644
--- a/target/mips/kvm.c
+++ b/target/mips/kvm.c
@@ -590,7 +590,7 @@ static void kvm_mips_update_state(void *opaque, bool running, RunState state)
     }
 }
 
-static int kvm_mips_put_fpu_registers(CPUState *cs, int level)
+static int kvm_mips_put_fpu_registers(CPUState *cs, KvmPutState level)
 {
     CPUMIPSState *env = cpu_env(cs);
     int err, ret = 0;
@@ -749,7 +749,7 @@ static int kvm_mips_get_fpu_registers(CPUState *cs)
 }
 
 
-static int kvm_mips_put_cp0_registers(CPUState *cs, int level)
+static int kvm_mips_put_cp0_registers(CPUState *cs, KvmPutState level)
 {
     CPUMIPSState *env = cpu_env(cs);
     int err, ret = 0;
@@ -1177,7 +1177,7 @@ static int kvm_mips_get_cp0_registers(CPUState *cs)
     return ret;
 }
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     CPUMIPSState *env = cpu_env(cs);
     struct kvm_regs regs;
diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index 2521ff65c6..cd60893a17 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -907,7 +907,7 @@ int kvmppc_put_books_sregs(PowerPCCPU *cpu)
     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS, &sregs);
 }
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     PowerPCCPU *cpu = POWERPC_CPU(cs);
     CPUPPCState *env = &cpu->env;
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 187c2c9501..75ca3fb9fd 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1369,7 +1369,7 @@ int kvm_riscv_sync_mpstate_to_kvm(RISCVCPU *cpu, int state)
     return 0;
 }
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     int ret = 0;
 
diff --git a/target/s390x/kvm/kvm.c b/target/s390x/kvm/kvm.c
index 491cc5f975..916dac1f14 100644
--- a/target/s390x/kvm/kvm.c
+++ b/target/s390x/kvm/kvm.c
@@ -468,7 +468,7 @@ static int can_sync_regs(CPUState *cs, int regs)
 #define KVM_SYNC_REQUIRED_REGS (KVM_SYNC_GPRS | KVM_SYNC_ACRS | \
                                 KVM_SYNC_CRS | KVM_SYNC_PREFIX)
 
-int kvm_arch_put_registers(CPUState *cs, int level, Error **errp)
+int kvm_arch_put_registers(CPUState *cs, KvmPutState level, Error **errp)
 {
     CPUS390XState *env = cpu_env(cs);
     struct kvm_fpu fpu = {};

From 0de36ecb2b0e21a4bf610c2934b250a577490c38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:07:14 +0200
Subject: [PATCH 1319/2396] accel/kvm: Factor kvm_cpu_synchronize_put() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The same code is duplicated 3 times: factor a common method.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Link: https://lore.kernel.org/r/20251008040715.81513-4-philmd@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/kvm/kvm-all.c | 47 ++++++++++++++++++---------------------------
 1 file changed, 19 insertions(+), 28 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 58802f7c3c..56031925c4 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -2937,22 +2937,32 @@ void kvm_cpu_synchronize_state(CPUState *cpu)
     }
 }
 
-static void do_kvm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
+static bool kvm_cpu_synchronize_put(CPUState *cpu, KvmPutState state,
+                                    const char *desc)
 {
     Error *err = NULL;
-    int ret = kvm_arch_put_registers(cpu, KVM_PUT_RESET_STATE, &err);
+    int ret = kvm_arch_put_registers(cpu, state, &err);
     if (ret) {
         if (err) {
-            error_reportf_err(err, "Restoring resisters after reset: ");
+            error_reportf_err(err, "Restoring resisters %s: ", desc);
         } else {
-            error_report("Failed to put registers after reset: %s",
+            error_report("Failed to put registers %s: %s", desc,
                          strerror(-ret));
         }
-        cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
-        vm_stop(RUN_STATE_INTERNAL_ERROR);
+        return false;
     }
 
     cpu->vcpu_dirty = false;
+
+    return true;
+}
+
+static void do_kvm_cpu_synchronize_post_reset(CPUState *cpu, run_on_cpu_data arg)
+{
+    if (!kvm_cpu_synchronize_put(cpu, KVM_PUT_RESET_STATE, "after reset")) {
+        cpu_dump_state(cpu, stderr, CPU_DUMP_CODE);
+        vm_stop(RUN_STATE_INTERNAL_ERROR);
+    }
 }
 
 void kvm_cpu_synchronize_post_reset(CPUState *cpu)
@@ -2966,19 +2976,9 @@ void kvm_cpu_synchronize_post_reset(CPUState *cpu)
 
 static void do_kvm_cpu_synchronize_post_init(CPUState *cpu, run_on_cpu_data arg)
 {
-    Error *err = NULL;
-    int ret = kvm_arch_put_registers(cpu, KVM_PUT_FULL_STATE, &err);
-    if (ret) {
-        if (err) {
-            error_reportf_err(err, "Putting registers after init: ");
-        } else {
-            error_report("Failed to put registers after init: %s",
-                         strerror(-ret));
-        }
+    if (!kvm_cpu_synchronize_put(cpu, KVM_PUT_FULL_STATE, "after init")) {
         exit(1);
     }
-
-    cpu->vcpu_dirty = false;
 }
 
 void kvm_cpu_synchronize_post_init(CPUState *cpu)
@@ -3168,20 +3168,11 @@ int kvm_cpu_exec(CPUState *cpu)
         MemTxAttrs attrs;
 
         if (cpu->vcpu_dirty) {
-            Error *err = NULL;
-            ret = kvm_arch_put_registers(cpu, KVM_PUT_RUNTIME_STATE, &err);
-            if (ret) {
-                if (err) {
-                    error_reportf_err(err, "Putting registers after init: ");
-                } else {
-                    error_report("Failed to put registers after init: %s",
-                                 strerror(-ret));
-                }
+            if (!kvm_cpu_synchronize_put(cpu, KVM_PUT_RUNTIME_STATE,
+                                         "at runtime")) {
                 ret = -1;
                 break;
             }
-
-            cpu->vcpu_dirty = false;
         }
 
         kvm_arch_pre_run(cpu, run);

From 818231bc6d24859fde179d1ab022bd932f409d10 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 17 Sep 2025 12:10:45 +0200
Subject: [PATCH 1320/2396] rust: bql: add BqlRefCell::get_mut()

This method is rarely useful in QEMU due to the pervasiveness of
shared references, but add it for when a &mut BqlRefCell<> is used.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/bql/src/cell.rs | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/rust/bql/src/cell.rs b/rust/bql/src/cell.rs
index 24ab294b60..54cfe6145c 100644
--- a/rust/bql/src/cell.rs
+++ b/rust/bql/src/cell.rs
@@ -580,6 +580,23 @@ impl<T> BqlRefCell<T> {
         }
     }
 
+    /// Returns a mutable reference to the underlying data in this cell,
+    /// while the owner already has a mutable reference to the cell.
+    ///
+    /// # Examples
+    ///
+    /// ```
+    /// use bql::BqlRefCell;
+    ///
+    /// let mut c = BqlRefCell::new(5);
+    ///
+    /// *c.get_mut() = 10;
+    /// ```
+    #[inline]
+    pub const fn get_mut(&mut self) -> &mut T {
+        self.value.get_mut()
+    }
+
     /// Returns a raw pointer to the underlying data in this cell.
     ///
     /// # Examples

From 5c776a767703f9f6cd6ee87752e794d2cbab1165 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 25 Sep 2025 10:13:29 +0200
Subject: [PATCH 1321/2396] rust: migration: do not pass raw pointer to
 VMStateDescription::fields

Pass a slice instead; a function that accepts a raw pointer should
arguably be declared as unsafe.

But since it is now much easier to forget vmstate_fields!, validate the
value (at least to some extent) before passing it to C.  (Unfortunately,
doing the same for subsections would require const ptr::is_null(), which
is only stable in Rust 1.84).

Suggested-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 5f5708ad39..2e320262f0 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -425,7 +425,7 @@ macro_rules! vmstate_fields {
                 ..::common::zeroable::Zeroable::ZERO
             }
         ];
-        _FIELDS.as_ptr()
+        _FIELDS
     }}
 }
 
@@ -677,8 +677,11 @@ impl<T> VMStateDescriptionBuilder<T> {
     }
 
     #[must_use]
-    pub const fn fields(mut self, fields: *const VMStateField) -> Self {
-        self.0.fields = fields;
+    pub const fn fields(mut self, fields: &'static [VMStateField]) -> Self {
+        if fields[fields.len() - 1].flags.0 != VMStateFlags::VMS_END.0 {
+            panic!("fields are not terminated, use vmstate_fields!");
+        }
+        self.0.fields = fields.as_ptr();
         self
     }
 

From 64bce66d6f142272415de5807f38c2b8a884c4c2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 25 Sep 2025 10:32:23 +0200
Subject: [PATCH 1322/2396] rust: migration: do not store raw pointers into
 VMStateSubsectionsWrapper

Raw pointers were used to insert a NULL one at the end of the array.
However, Option<&...> has the same layout and does not remove Sync
from the type of the array.

As an extra benefit, this enables validation of the terminator of the
subsection array, because is_null() in const context would not be stable
until Rust 1.84.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 29 +++++++++--------------------
 1 file changed, 9 insertions(+), 20 deletions(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 2e320262f0..a6ee7e9385 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -470,33 +470,21 @@ macro_rules! impl_vmstate_struct {
     };
 }
 
-/// A transparent wrapper type for the `subsections` field of
-/// [`VMStateDescription`].
-///
-/// This is necessary to be able to declare subsection descriptions as statics,
-/// because the only way to implement `Sync` for a foreign type (and `*const`
-/// pointers are foreign types in Rust) is to create a wrapper struct and
-/// `unsafe impl Sync` for it.
-///
-/// This struct is used in the
-/// [`vm_state_subsections`](crate::vmstate_subsections) macro implementation.
-#[repr(transparent)]
-pub struct VMStateSubsectionsWrapper(pub &'static [*const crate::bindings::VMStateDescription]);
-
-unsafe impl Sync for VMStateSubsectionsWrapper {}
+/// The type returned by [`vmstate_subsections!`](crate::vmstate_subsections).
+pub type VMStateSubsections = &'static [Option<&'static crate::bindings::VMStateDescription>];
 
 /// Helper macro to declare a list of subsections ([`VMStateDescription`])
 /// into a static and return a pointer to the array of pointers it created.
 #[macro_export]
 macro_rules! vmstate_subsections {
     ($($subsection:expr),*$(,)*) => {{
-        static _SUBSECTIONS: $crate::vmstate::VMStateSubsectionsWrapper = $crate::vmstate::VMStateSubsectionsWrapper(&[
+        static _SUBSECTIONS: $crate::vmstate::VMStateSubsections = &[
             $({
                 static _SUBSECTION: $crate::bindings::VMStateDescription = $subsection.get();
-                ::core::ptr::addr_of!(_SUBSECTION)
+                Some(&_SUBSECTION)
             }),*,
-            ::core::ptr::null()
-        ]);
+            None,
+        ];
         &_SUBSECTIONS
     }}
 }
@@ -686,8 +674,9 @@ impl<T> VMStateDescriptionBuilder<T> {
     }
 
     #[must_use]
-    pub const fn subsections(mut self, subs: &'static VMStateSubsectionsWrapper) -> Self {
-        self.0.subsections = subs.0.as_ptr();
+    pub const fn subsections(mut self, subs: &'static VMStateSubsections) -> Self {
+        let subs: *const Option<&bindings::VMStateDescription> = subs.as_ptr();
+        self.0.subsections = subs.cast::<*const bindings::VMStateDescription>();
         self
     }
 

From 5b4fa9780728ba526f0529199ef90d6132a3faf2 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 25 Sep 2025 10:41:12 +0200
Subject: [PATCH 1323/2396] rust: migration: validate termination of subsection
 arrays

For consistency with fields(), validate the value (at least to some extent)
before passing it to C.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index a6ee7e9385..6b0f96c4da 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -675,6 +675,9 @@ impl<T> VMStateDescriptionBuilder<T> {
 
     #[must_use]
     pub const fn subsections(mut self, subs: &'static VMStateSubsections) -> Self {
+        if subs[subs.len() - 1].is_some() {
+            panic!("subsections are not terminated, use vmstate_subsections!");
+        }
         let subs: *const Option<&bindings::VMStateDescription> = subs.as_ptr();
         self.0.subsections = subs.cast::<*const bindings::VMStateDescription>();
         self

From 8999ca00a4b69b0b7332bf3ae2fc17d473923793 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 17 Sep 2025 12:37:59 +0200
Subject: [PATCH 1324/2396] rust: migration: extract vmstate_fields_ref

This is useful when building a VMState for generic structs, because you have
to avoid nested statics.  Using vmstate_fields! will fail in the likely case
where the _FIELDS static uses Self from an outer item, because that is
forbidden.

The separate macros are needed because you cannot just do

                 .fields(vmstate_fields_ref! {
                      vmstate_of!(PL011State, clock),
                 })

The value returned by vmstate_fields_ref! is not promoted to static, which is
unfortunate but intentional (https://github.com/rust-lang/rust/issues/60502):

error[E0716]: temporary value dropped while borrowed
   --> rust/hw/char/pl011/libpl011.rlib.p/structured/device.rs:743:17
    |
738 | /      VMStateDescriptionBuilder::<PL011State>::new()
739 | |          .name(c"pl011/clock")
740 | |          .version_id(1)
741 | |          .minimum_version_id(1)
742 | |          .needed(&PL011State::clock_needed)
743 | |          .fields(vmstate_fields_ref! {
    | | _________________^
744 | ||              vmstate_of!(PL011State, clock),
745 | ||         })
    | ||_________^- argument requires that borrow lasts for `'static`
    |  |_________|
    |            creates a temporary value which is freed while still in use
746 |            .build();
    |                   - temporary value is freed at the end of this statement

Thus it is necessary to use the "static", whether explicitly or hidden by
vmstate_fields.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 6b0f96c4da..59e665f6c3 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -412,19 +412,30 @@ macro_rules! vmstate_exist_fn {
     }};
 }
 
+/// Add a terminator to the fields in the arguments, and return
+/// a reference to the resulting array of values.
+#[macro_export]
+macro_rules! vmstate_fields_ref {
+    ($($field:expr),*$(,)*) => {
+        &[
+            $($field),*,
+            $crate::bindings::VMStateField {
+                flags: $crate::bindings::VMStateFlags::VMS_END,
+                ..::common::zeroable::Zeroable::ZERO
+            }
+        ]
+    }
+}
+
 /// Helper macro to declare a list of
 /// ([`VMStateField`](`crate::bindings::VMStateField`)) into a static and return
 /// a pointer to the array of values it created.
 #[macro_export]
 macro_rules! vmstate_fields {
     ($($field:expr),*$(,)*) => {{
-        static _FIELDS: &[$crate::bindings::VMStateField] = &[
+        static _FIELDS: &[$crate::bindings::VMStateField] = $crate::vmstate_fields_ref!(
             $($field),*,
-            $crate::bindings::VMStateField {
-                flags: $crate::bindings::VMStateFlags::VMS_END,
-                ..::common::zeroable::Zeroable::ZERO
-            }
-        ];
+        );
         _FIELDS
     }}
 }

From 4526418affcd536748a344bdba9a6913a5f7e135 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 9 Oct 2025 10:24:54 +0200
Subject: [PATCH 1325/2396] rust: move VMState from bql to migration

The high-level wrapper Migratable<T> will contain a BqlCell,
which would introduce a circular dependency betwen the bql and
migration crates.  Move the implementation of VMState for cells
to "migration", together with the implementation for std types.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock               | 2 +-
 rust/bql/Cargo.toml           | 1 -
 rust/bql/meson.build          | 1 -
 rust/bql/src/cell.rs          | 6 ------
 rust/meson.build              | 2 +-
 rust/migration/Cargo.toml     | 1 +
 rust/migration/meson.build    | 4 ++--
 rust/migration/src/vmstate.rs | 2 ++
 8 files changed, 7 insertions(+), 12 deletions(-)

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 1108513349..5c2f8ea924 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -59,7 +59,6 @@ name = "bql"
 version = "0.1.0"
 dependencies = [
  "glib-sys",
- "migration",
 ]
 
 [[package]]
@@ -198,6 +197,7 @@ checksum = "f52b00d39961fc5b2736ea853c9cc86238e165017a493d1d5c8eac6bdc4cc273"
 name = "migration"
 version = "0.1.0"
 dependencies = [
+ "bql",
  "common",
  "glib-sys",
  "util",
diff --git a/rust/bql/Cargo.toml b/rust/bql/Cargo.toml
index d5177e5f8e..8fd8131102 100644
--- a/rust/bql/Cargo.toml
+++ b/rust/bql/Cargo.toml
@@ -13,7 +13,6 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
-migration = { path = "../migration" }
 glib-sys.workspace = true
 
 [features]
diff --git a/rust/bql/meson.build b/rust/bql/meson.build
index 22d7c9b877..091372dd7b 100644
--- a/rust/bql/meson.build
+++ b/rust/bql/meson.build
@@ -37,7 +37,6 @@ _bql_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   rust_args: _bql_cfg,
-  link_with: [_migration_rs],
   dependencies: [glib_sys_rs],
 )
 
diff --git a/rust/bql/src/cell.rs b/rust/bql/src/cell.rs
index 54cfe6145c..8ade7db629 100644
--- a/rust/bql/src/cell.rs
+++ b/rust/bql/src/cell.rs
@@ -151,8 +151,6 @@ use std::{
     ptr::NonNull,
 };
 
-use migration::impl_vmstate_transparent;
-
 /// A mutable memory location that is protected by the Big QEMU Lock.
 ///
 /// # Memory layout
@@ -364,8 +362,6 @@ impl<T: Default> BqlCell<T> {
     }
 }
 
-impl_vmstate_transparent!(crate::cell::BqlCell<T> where T: VMState);
-
 /// A mutable memory location with dynamically checked borrow rules,
 /// protected by the Big QEMU Lock.
 ///
@@ -691,8 +687,6 @@ impl<T> From<T> for BqlRefCell<T> {
     }
 }
 
-impl_vmstate_transparent!(crate::cell::BqlRefCell<T> where T: VMState);
-
 struct BorrowRef<'b> {
     borrow: &'b Cell<BorrowFlag>,
 }
diff --git a/rust/meson.build b/rust/meson.build
index 6ba075c8c7..76e10699b3 100644
--- a/rust/meson.build
+++ b/rust/meson.build
@@ -29,8 +29,8 @@ subdir('qemu-macros')
 subdir('common')
 subdir('bits')
 subdir('util')
-subdir('migration')
 subdir('bql')
+subdir('migration')
 subdir('qom')
 subdir('system')
 subdir('chardev')
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
index 94504f3625..b995c4c8c8 100644
--- a/rust/migration/Cargo.toml
+++ b/rust/migration/Cargo.toml
@@ -13,6 +13,7 @@ repository.workspace = true
 rust-version.workspace = true
 
 [dependencies]
+bql = { path = "../bql" }
 common = { path = "../common" }
 util = { path = "../util" }
 glib-sys.workspace = true
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index 18be65c92c..845136239e 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -37,12 +37,12 @@ _migration_rs = static_library(
   ),
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
-  link_with: [_util_rs],
+  link_with: [_util_rs, _bql_rs],
   dependencies: [common_rs, glib_sys_rs],
 )
 
 migration_rs = declare_dependency(link_with: [_migration_rs],
-  dependencies: [migration, qemuutil])
+  dependencies: [bql_rs, migration, qemuutil])
 
 # Doctests are essentially integration tests, so they need the same dependencies.
 # Note that running them requires the object files for C code, so place them
diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 59e665f6c3..445fe7fbc0 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -276,6 +276,8 @@ macro_rules! impl_vmstate_transparent {
     };
 }
 
+impl_vmstate_transparent!(bql::BqlCell<T> where T: VMState);
+impl_vmstate_transparent!(bql::BqlRefCell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::Cell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::UnsafeCell<T> where T: VMState);
 impl_vmstate_transparent!(std::pin::Pin<T> where T: VMState);

From 44a9d1b86c06ea955e4720ae5de8c130ff5719bc Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 15 Sep 2025 11:34:36 +0200
Subject: [PATCH 1326/2396] rust: migration: add high-level migration wrappers

Instead of dealing with pre/post callbacks, allow devices to
implement a snapshot/restore mechanism; this has two main
advantages:

- it can be easily implemented via procedural macros

- there can be generic implementations to deal with various
  kinds of interior-mutable containers, from BqlRefCell to Mutex,
  so that C code does not see Rust concepts such as Mutex<>.

Using it is easy; you can implement the snapshot/restore trait
ToMigrationState and declare your state like:

     regs: Migratable<Mutex<MyDeviceRegisters>>

Migratable<> allows dereferencing to the underlying object with
no run-time cost.

Note that Migratable<> actually does not accept ToMigrationState,
only the similar ToMigrationStateShared trait that the user will mostly
not care about.  This is required by the fact that pre/post callbacks
take a &self, and ensures that the argument is a Mutex or BqlRefCell
(including an array or Arc<> thereof).

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/devel/rust.rst              |   1 +
 rust/migration/meson.build       |   1 +
 rust/migration/src/lib.rs        |   3 +
 rust/migration/src/migratable.rs | 434 +++++++++++++++++++++++++++++++
 4 files changed, 439 insertions(+)
 create mode 100644 rust/migration/src/migratable.rs

diff --git a/docs/devel/rust.rst b/docs/devel/rust.rst
index 2f0ab2e282..79c26d9d16 100644
--- a/docs/devel/rust.rst
+++ b/docs/devel/rust.rst
@@ -155,6 +155,7 @@ module                     status
 ``hwcore::irq``            complete
 ``hwcore::qdev``           stable
 ``hwcore::sysbus``         stable
+``migration::migratable``  proof of concept
 ``migration::vmstate``     stable
 ``qom``                    stable
 ``system::memory``         stable
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index 845136239e..0d25455baa 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -31,6 +31,7 @@ _migration_rs = static_library(
     [
       'src/lib.rs',
       'src/bindings.rs',
+      'src/migratable.rs',
       'src/vmstate.rs',
     ],
     {'.' : _migration_bindings_inc_rs},
diff --git a/rust/migration/src/lib.rs b/rust/migration/src/lib.rs
index 5f51dde440..efe9896b61 100644
--- a/rust/migration/src/lib.rs
+++ b/rust/migration/src/lib.rs
@@ -2,5 +2,8 @@
 
 pub mod bindings;
 
+pub mod migratable;
+pub use migratable::*;
+
 pub mod vmstate;
 pub use vmstate::*;
diff --git a/rust/migration/src/migratable.rs b/rust/migration/src/migratable.rs
new file mode 100644
index 0000000000..46e533c16d
--- /dev/null
+++ b/rust/migration/src/migratable.rs
@@ -0,0 +1,434 @@
+// Copyright 2025 Red Hat, Inc.
+// Author(s): Paolo Bonzini <pbonzini@redhat.com>
+// SPDX-License-Identifier: GPL-2.0-or-later
+
+use std::{
+    fmt,
+    mem::size_of,
+    ptr::{self, addr_of, NonNull},
+    sync::{Arc, Mutex},
+};
+
+use bql::{BqlCell, BqlRefCell};
+use common::Zeroable;
+
+use crate::{
+    bindings, vmstate_fields_ref, vmstate_of, InvalidError, VMState, VMStateDescriptionBuilder,
+};
+
+/// Enables QEMU migration support even when a type is wrapped with
+/// synchronization primitives (like `Mutex`) that the C migration
+/// code cannot directly handle. The trait provides methods to
+/// extract essential state for migration and restore it after
+/// migration completes.
+///
+/// On top of extracting data from synchronization wrappers during save
+/// and restoring it during load, it's also possible to use `ToMigrationState`
+/// to convert runtime representations to migration-safe formats.
+///
+/// # Examples
+///
+/// ```
+/// use bql::BqlCell;
+/// use migration::{InvalidError, ToMigrationState, VMState};
+/// # use migration::VMStateField;
+///
+/// # #[derive(Debug, PartialEq, Eq)]
+/// struct DeviceState {
+///     counter: BqlCell<u32>,
+///     enabled: bool,
+/// }
+///
+/// # #[derive(Debug)]
+/// #[derive(Default)]
+/// struct DeviceMigrationState {
+///     counter: u32,
+///     enabled: bool,
+/// }
+///
+/// # unsafe impl VMState for DeviceMigrationState {
+/// #     const BASE: VMStateField = ::common::Zeroable::ZERO;
+/// # }
+/// impl ToMigrationState for DeviceState {
+///     type Migrated = DeviceMigrationState;
+///
+///     fn snapshot_migration_state(
+///         &self,
+///         target: &mut Self::Migrated,
+///     ) -> Result<(), InvalidError> {
+///         target.counter = self.counter.get();
+///         target.enabled = self.enabled;
+///         Ok(())
+///     }
+///
+///     fn restore_migrated_state_mut(
+///         &mut self,
+///         source: Self::Migrated,
+///         _version_id: u8,
+///     ) -> Result<(), InvalidError> {
+///         self.counter.set(source.counter);
+///         self.enabled = source.enabled;
+///         Ok(())
+///     }
+/// }
+/// # bql::start_test();
+/// # let dev = DeviceState { counter: 10.into(), enabled: true };
+/// # let mig = dev.to_migration_state().unwrap();
+/// # assert!(matches!(*mig, DeviceMigrationState { counter: 10, enabled: true }));
+/// # let mut dev2 = DeviceState { counter: 42.into(), enabled: false };
+/// # dev2.restore_migrated_state_mut(*mig, 1).unwrap();
+/// # assert_eq!(dev2, dev);
+/// ```
+pub trait ToMigrationState {
+    /// The type used to represent the migrated state.
+    type Migrated: Default + VMState;
+
+    /// Capture the current state into a migration-safe format, failing
+    /// if the state cannot be migrated.
+    fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), InvalidError>;
+
+    /// Restores state from a migrated representation, failing if the
+    /// state cannot be restored.
+    fn restore_migrated_state_mut(
+        &mut self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError>;
+
+    /// Convenience method to combine allocation and state capture
+    /// into a single operation.
+    fn to_migration_state(&self) -> Result<Box<Self::Migrated>, InvalidError> {
+        let mut migrated = Box::<Self::Migrated>::default();
+        self.snapshot_migration_state(&mut migrated)?;
+        Ok(migrated)
+    }
+}
+
+// Implementations for primitive types.  Do not use a blanket implementation
+// for all Copy types, because [T; N] is Copy if T is Copy; that would conflict
+// with the below implementation for arrays.
+macro_rules! impl_for_primitive {
+    ($($t:ty),*) => {
+        $(
+            impl ToMigrationState for $t {
+                type Migrated = Self;
+
+                fn snapshot_migration_state(
+                    &self,
+                    target: &mut Self::Migrated,
+                ) -> Result<(), InvalidError> {
+                    *target = *self;
+                    Ok(())
+                }
+
+                fn restore_migrated_state_mut(
+                    &mut self,
+                    source: Self::Migrated,
+                    _version_id: u8,
+                ) -> Result<(), InvalidError> {
+                    *self = source;
+                    Ok(())
+                }
+            }
+        )*
+    };
+}
+
+impl_for_primitive!(u8, u16, u32, u64, i8, i16, i32, i64, bool);
+
+impl<T: ToMigrationState, const N: usize> ToMigrationState for [T; N]
+where
+    [T::Migrated; N]: Default,
+{
+    type Migrated = [T::Migrated; N];
+
+    fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), InvalidError> {
+        for (item, target_item) in self.iter().zip(target.iter_mut()) {
+            item.snapshot_migration_state(target_item)?;
+        }
+        Ok(())
+    }
+
+    fn restore_migrated_state_mut(
+        &mut self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        for (item, source_item) in self.iter_mut().zip(source) {
+            item.restore_migrated_state_mut(source_item, version_id)?;
+        }
+        Ok(())
+    }
+}
+
+impl<T: ToMigrationState> ToMigrationState for Mutex<T> {
+    type Migrated = T::Migrated;
+
+    fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), InvalidError> {
+        self.lock().unwrap().snapshot_migration_state(target)
+    }
+
+    fn restore_migrated_state_mut(
+        &mut self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        self.get_mut()
+            .unwrap()
+            .restore_migrated_state_mut(source, version_id)
+    }
+}
+
+impl<T: ToMigrationState> ToMigrationState for BqlRefCell<T> {
+    type Migrated = T::Migrated;
+
+    fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), InvalidError> {
+        self.borrow().snapshot_migration_state(target)
+    }
+
+    fn restore_migrated_state_mut(
+        &mut self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        self.get_mut()
+            .restore_migrated_state_mut(source, version_id)
+    }
+}
+
+/// Extension trait for types that support migration state restoration
+/// through interior mutability.
+///
+/// This trait extends [`ToMigrationState`] for types that can restore
+/// their state without requiring mutable access. While user structs
+/// will generally use `ToMigrationState`, the device will have multiple
+/// references and therefore the device struct has to employ an interior
+/// mutability wrapper like [`Mutex`] or [`BqlRefCell`].
+///
+/// Anything that implements this trait can in turn be used within
+/// [`Migratable<T>`], which makes no assumptions on how to achieve mutable
+/// access to the runtime state.
+///
+/// # Examples
+///
+/// ```
+/// use std::sync::Mutex;
+///
+/// use migration::ToMigrationStateShared;
+///
+/// let device_state = Mutex::new(42);
+/// // Can restore without &mut access
+/// device_state.restore_migrated_state(100, 1).unwrap();
+/// assert_eq!(*device_state.lock().unwrap(), 100);
+/// ```
+pub trait ToMigrationStateShared: ToMigrationState {
+    /// Restores state from a migrated representation to an interior-mutable
+    /// object.  Similar to `restore_migrated_state_mut`, but requires a
+    /// shared reference; therefore it can be used to restore a device's
+    /// state even though devices have multiple references to them.
+    fn restore_migrated_state(
+        &self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError>;
+}
+
+impl<T: ToMigrationStateShared, const N: usize> ToMigrationStateShared for [T; N]
+where
+    [T::Migrated; N]: Default,
+{
+    fn restore_migrated_state(
+        &self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        for (item, source_item) in self.iter().zip(source) {
+            item.restore_migrated_state(source_item, version_id)?;
+        }
+        Ok(())
+    }
+}
+
+// Arc requires the contained object to be interior-mutable
+impl<T: ToMigrationStateShared> ToMigrationState for Arc<T> {
+    type Migrated = T::Migrated;
+
+    fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), InvalidError> {
+        (**self).snapshot_migration_state(target)
+    }
+
+    fn restore_migrated_state_mut(
+        &mut self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        (**self).restore_migrated_state(source, version_id)
+    }
+}
+
+impl<T: ToMigrationStateShared> ToMigrationStateShared for Arc<T> {
+    fn restore_migrated_state(
+        &self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        (**self).restore_migrated_state(source, version_id)
+    }
+}
+
+// Interior-mutable types.  Note how they only require ToMigrationState for
+// the inner type!
+
+impl<T: ToMigrationState> ToMigrationStateShared for Mutex<T> {
+    fn restore_migrated_state(
+        &self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        self.lock()
+            .unwrap()
+            .restore_migrated_state_mut(source, version_id)
+    }
+}
+
+impl<T: ToMigrationState> ToMigrationStateShared for BqlRefCell<T> {
+    fn restore_migrated_state(
+        &self,
+        source: Self::Migrated,
+        version_id: u8,
+    ) -> Result<(), InvalidError> {
+        self.borrow_mut()
+            .restore_migrated_state_mut(source, version_id)
+    }
+}
+
+/// A wrapper that enables QEMU migration for types with shared state.
+///
+/// `Migratable<T>` provides a bridge between Rust types that use interior
+/// mutability (like `Mutex<T>`) and QEMU's C-based migration infrastructure.
+/// It manages the lifecycle of migration state and provides automatic
+/// conversion between runtime and migration representations.
+///
+/// ```ignore
+/// # use std::sync::Mutex;
+/// # use migration::Migratable;
+///
+/// pub struct DeviceRegs {
+///     status: u32,
+/// }
+///
+/// pub struct SomeDevice {
+///     // ...
+///     registers: Migratable<Mutex<DeviceRegs>>,
+/// }
+/// ```
+#[repr(C)]
+pub struct Migratable<T: ToMigrationStateShared> {
+    /// Pointer to migration state, valid only during migration operations.
+    /// C vmstate does not support NULL pointers, so no `Option<Box<>>`.
+    migration_state: BqlCell<*mut T::Migrated>,
+
+    /// The runtime state that can be accessed during normal operation
+    runtime_state: T,
+}
+
+impl<T: ToMigrationStateShared> std::ops::Deref for Migratable<T> {
+    type Target = T;
+
+    fn deref(&self) -> &Self::Target {
+        &self.runtime_state
+    }
+}
+
+impl<T: ToMigrationStateShared> std::ops::DerefMut for Migratable<T> {
+    fn deref_mut(&mut self) -> &mut Self::Target {
+        &mut self.runtime_state
+    }
+}
+
+impl<T: ToMigrationStateShared> Migratable<T> {
+    /// Creates a new `Migratable` wrapper around the given runtime state.
+    ///
+    /// # Returns
+    /// A new `Migratable` instance ready for use and migration
+    pub fn new(runtime_state: T) -> Self {
+        Self {
+            migration_state: BqlCell::new(ptr::null_mut()),
+            runtime_state,
+        }
+    }
+
+    fn pre_save(&self) -> Result<(), InvalidError> {
+        let state = self.runtime_state.to_migration_state()?;
+        self.migration_state.set(Box::into_raw(state));
+        Ok(())
+    }
+
+    fn post_save(&self) -> Result<(), InvalidError> {
+        let state = unsafe { Box::from_raw(self.migration_state.replace(ptr::null_mut())) };
+        drop(state);
+        Ok(())
+    }
+
+    fn pre_load(&self) -> Result<(), InvalidError> {
+        self.migration_state
+            .set(Box::into_raw(Box::<T::Migrated>::default()));
+        Ok(())
+    }
+
+    fn post_load(&self, version_id: u8) -> Result<(), InvalidError> {
+        let state = unsafe { Box::from_raw(self.migration_state.replace(ptr::null_mut())) };
+        self.runtime_state
+            .restore_migrated_state(*state, version_id)
+    }
+}
+
+impl<T: ToMigrationStateShared + fmt::Debug> fmt::Debug for Migratable<T>
+where
+    T::Migrated: fmt::Debug,
+{
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        let mut struct_f = f.debug_struct("Migratable");
+        struct_f.field("runtime_state", &self.runtime_state);
+
+        let state = NonNull::new(self.migration_state.get()).map(|x| unsafe { x.as_ref() });
+        struct_f.field("migration_state", &state);
+        struct_f.finish()
+    }
+}
+
+impl<T: ToMigrationStateShared + Default> Default for Migratable<T> {
+    fn default() -> Self {
+        Self::new(T::default())
+    }
+}
+
+impl<T: 'static + ToMigrationStateShared> Migratable<T> {
+    const FIELD: bindings::VMStateField = vmstate_of!(Self, migration_state);
+
+    const FIELDS: &[bindings::VMStateField] = vmstate_fields_ref! {
+        Migratable::<T>::FIELD
+    };
+
+    const VMSD: &'static bindings::VMStateDescription = VMStateDescriptionBuilder::<Self>::new()
+        .version_id(1)
+        .minimum_version_id(1)
+        .pre_save(&Self::pre_save)
+        .pre_load(&Self::pre_load)
+        .post_save(&Self::post_save)
+        .post_load(&Self::post_load)
+        .fields(Self::FIELDS)
+        .build()
+        .as_ref();
+}
+
+unsafe impl<T: 'static + ToMigrationStateShared> VMState for Migratable<T> {
+    const BASE: bindings::VMStateField = {
+        bindings::VMStateField {
+            vmsd: addr_of!(*Self::VMSD),
+            size: size_of::<Self>(),
+            flags: bindings::VMStateFlags::VMS_STRUCT,
+            ..Zeroable::ZERO
+        }
+    };
+}

From 29cf500e3b489021219dfdb90c2abc6f275c5775 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 9 Oct 2025 10:25:07 +0200
Subject: [PATCH 1327/2396] rust: qemu-macros: add ToMigrationState derive
 macro

Add a macro that recursively builds the "migrated" version
of a struct.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.lock                         |   1 +
 rust/migration/Cargo.toml               |   1 +
 rust/migration/meson.build              |   2 +-
 rust/migration/src/lib.rs               |   2 +
 rust/migration/src/migratable.rs        |  12 +-
 rust/qemu-macros/src/lib.rs             |  88 +++++++
 rust/qemu-macros/src/migration_state.rs | 298 ++++++++++++++++++++++++
 rust/qemu-macros/src/tests.rs           | 113 ++++++++-
 8 files changed, 512 insertions(+), 5 deletions(-)
 create mode 100644 rust/qemu-macros/src/migration_state.rs

diff --git a/rust/Cargo.lock b/rust/Cargo.lock
index 5c2f8ea924..0c1df625df 100644
--- a/rust/Cargo.lock
+++ b/rust/Cargo.lock
@@ -200,6 +200,7 @@ dependencies = [
  "bql",
  "common",
  "glib-sys",
+ "qemu_macros",
  "util",
 ]
 
diff --git a/rust/migration/Cargo.toml b/rust/migration/Cargo.toml
index b995c4c8c8..415457496d 100644
--- a/rust/migration/Cargo.toml
+++ b/rust/migration/Cargo.toml
@@ -15,6 +15,7 @@ rust-version.workspace = true
 [dependencies]
 bql = { path = "../bql" }
 common = { path = "../common" }
+qemu_macros = { path = "../qemu-macros" }
 util = { path = "../util" }
 glib-sys.workspace = true
 
diff --git a/rust/migration/meson.build b/rust/migration/meson.build
index 0d25455baa..444494700a 100644
--- a/rust/migration/meson.build
+++ b/rust/migration/meson.build
@@ -39,7 +39,7 @@ _migration_rs = static_library(
   override_options: ['rust_std=2021', 'build.rust_std=2021'],
   rust_abi: 'rust',
   link_with: [_util_rs, _bql_rs],
-  dependencies: [common_rs, glib_sys_rs],
+  dependencies: [common_rs, glib_sys_rs, qemu_macros],
 )
 
 migration_rs = declare_dependency(link_with: [_migration_rs],
diff --git a/rust/migration/src/lib.rs b/rust/migration/src/lib.rs
index efe9896b61..c9bdf0d413 100644
--- a/rust/migration/src/lib.rs
+++ b/rust/migration/src/lib.rs
@@ -2,6 +2,8 @@
 
 pub mod bindings;
 
+pub use qemu_macros::ToMigrationState;
+
 pub mod migratable;
 pub use migratable::*;
 
diff --git a/rust/migration/src/migratable.rs b/rust/migration/src/migratable.rs
index 46e533c16d..ded6fe8f4a 100644
--- a/rust/migration/src/migratable.rs
+++ b/rust/migration/src/migratable.rs
@@ -79,6 +79,10 @@ use crate::{
 /// # dev2.restore_migrated_state_mut(*mig, 1).unwrap();
 /// # assert_eq!(dev2, dev);
 /// ```
+///
+/// More commonly, the trait is derived through the
+/// [`derive(ToMigrationState)`](qemu_macros::ToMigrationState) procedural
+/// macro.
 pub trait ToMigrationState {
     /// The type used to represent the migrated state.
     type Migrated: Default + VMState;
@@ -309,13 +313,17 @@ impl<T: ToMigrationState> ToMigrationStateShared for BqlRefCell<T> {
 /// It manages the lifecycle of migration state and provides automatic
 /// conversion between runtime and migration representations.
 ///
-/// ```ignore
+/// ```
 /// # use std::sync::Mutex;
-/// # use migration::Migratable;
+/// # use migration::{Migratable, ToMigrationState, VMState, VMStateField};
 ///
+/// #[derive(ToMigrationState)]
 /// pub struct DeviceRegs {
 ///     status: u32,
 /// }
+/// # unsafe impl VMState for DeviceRegsMigration {
+/// #     const BASE: VMStateField = ::common::Zeroable::ZERO;
+/// # }
 ///
 /// pub struct SomeDevice {
 ///     // ...
diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 3bf315c4c0..50239f228b 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -13,9 +13,13 @@ use syn::{
     Attribute, Data, DeriveInput, Error, Field, Fields, FieldsUnnamed, Ident, Meta, Path, Token,
     Variant,
 };
+
 mod bits;
 use bits::BitsConstInternal;
 
+mod migration_state;
+use migration_state::MigrationStateDerive;
+
 #[cfg(test)]
 mod tests;
 
@@ -412,3 +416,87 @@ pub fn bits_const_internal(ts: TokenStream) -> TokenStream {
     }
     .into()
 }
+
+/// Derive macro for generating migration state structures and trait
+/// implementations.
+///
+/// This macro generates a migration state struct and implements the
+/// `ToMigrationState` trait for the annotated struct, enabling state
+/// serialization and restoration.  Note that defining a `VMStateDescription`
+/// for the migration state struct is left to the user.
+///
+/// # Container attributes
+///
+/// The following attributes can be applied to the struct:
+///
+/// - `#[migration_state(rename = CustomName)]` - Customizes the name of the
+///   generated migration struct. By default, the generated struct is named
+///   `{OriginalName}Migration`.
+///
+/// # Field attributes
+///
+/// The following attributes can be applied to individual fields:
+///
+/// - `#[migration_state(omit)]` - Excludes the field from the migration state
+///   entirely.
+///
+/// - `#[migration_state(into(Type))]` - Converts the field using `.into()`
+///   during both serialization and restoration.
+///
+/// - `#[migration_state(try_into(Type))]` - Converts the field using
+///   `.try_into()` during both serialization and restoration. Returns
+///   `InvalidError` on conversion failure.
+///
+/// - `#[migration_state(clone)]` - Clones the field value.
+///
+/// Fields without any attributes use `ToMigrationState` recursively; note that
+/// this is a simple copy for types that implement `Copy`.
+///
+/// # Attribute compatibility
+///
+/// - `omit` cannot be used with any other attributes
+/// - only one of `into(Type)`, `try_into(Type)` can be used, but they can be
+///   coupled with `clone`.
+///
+/// # Examples
+///
+/// Basic usage:
+/// ```ignore
+/// #[derive(ToMigrationState)]
+/// struct MyStruct {
+///     field1: u32,
+///     field2: Timer,
+/// }
+/// ```
+///
+/// With attributes:
+/// ```ignore
+/// #[derive(ToMigrationState)]
+/// #[migration_state(rename = CustomMigration)]
+/// struct MyStruct {
+///     #[migration_state(omit)]
+///     runtime_field: u32,
+///
+///     #[migration_state(clone)]
+///     shared_data: String,
+///
+///     #[migration_state(into(Cow<'static, str>), clone)]
+///     converted_field: String,
+///
+///     #[migration_state(try_into(i8))]
+///     fallible_field: u32,
+///
+///     // Default: use ToMigrationState trait recursively
+///     nested_field: NestedStruct,
+///
+///     // Primitive types have a default implementation of ToMigrationState
+///     simple_field: u32,
+/// }
+/// ```
+#[proc_macro_derive(ToMigrationState, attributes(migration_state))]
+pub fn derive_to_migration_state(input: TokenStream) -> TokenStream {
+    let input = parse_macro_input!(input as DeriveInput);
+    MigrationStateDerive::expand(input)
+        .unwrap_or_else(syn::Error::into_compile_error)
+        .into()
+}
diff --git a/rust/qemu-macros/src/migration_state.rs b/rust/qemu-macros/src/migration_state.rs
new file mode 100644
index 0000000000..5edf0efe68
--- /dev/null
+++ b/rust/qemu-macros/src/migration_state.rs
@@ -0,0 +1,298 @@
+use std::borrow::Cow;
+
+use proc_macro2::TokenStream;
+use quote::{format_ident, quote, ToTokens};
+use syn::{spanned::Spanned, DeriveInput, Error, Field, Ident, Result, Type};
+
+use crate::get_fields;
+
+#[derive(Debug, Default)]
+enum ConversionMode {
+    #[default]
+    None,
+    Omit,
+    Into(Type),
+    TryInto(Type),
+    ToMigrationState,
+}
+
+impl ConversionMode {
+    fn target_type(&self, original_type: &Type) -> TokenStream {
+        match self {
+            ConversionMode::Into(ty) | ConversionMode::TryInto(ty) => ty.to_token_stream(),
+            ConversionMode::ToMigrationState => {
+                quote! { <#original_type as ToMigrationState>::Migrated }
+            }
+            _ => original_type.to_token_stream(),
+        }
+    }
+}
+
+#[derive(Debug, Default)]
+struct ContainerAttrs {
+    rename: Option<Ident>,
+}
+
+impl ContainerAttrs {
+    fn parse_from(&mut self, attrs: &[syn::Attribute]) -> Result<()> {
+        use attrs::{set, with, Attrs};
+        Attrs::new()
+            .once("rename", with::eq(set::parse(&mut self.rename)))
+            .parse_attrs("migration_state", attrs)?;
+        Ok(())
+    }
+
+    fn parse(attrs: &[syn::Attribute]) -> Result<Self> {
+        let mut container_attrs = Self::default();
+        container_attrs.parse_from(attrs)?;
+        Ok(container_attrs)
+    }
+}
+
+#[derive(Debug, Default)]
+struct FieldAttrs {
+    conversion: ConversionMode,
+    clone: bool,
+}
+
+impl FieldAttrs {
+    fn parse_from(&mut self, attrs: &[syn::Attribute]) -> Result<()> {
+        let mut omit_flag = false;
+        let mut into_type: Option<Type> = None;
+        let mut try_into_type: Option<Type> = None;
+
+        use attrs::{set, with, Attrs};
+        Attrs::new()
+            .once("omit", set::flag(&mut omit_flag))
+            .once("into", with::paren(set::parse(&mut into_type)))
+            .once("try_into", with::paren(set::parse(&mut try_into_type)))
+            .once("clone", set::flag(&mut self.clone))
+            .parse_attrs("migration_state", attrs)?;
+
+        self.conversion = match (omit_flag, into_type, try_into_type, self.clone) {
+            // Valid combinations of attributes first...
+            (true, None, None, false) => ConversionMode::Omit,
+            (false, Some(ty), None, _) => ConversionMode::Into(ty),
+            (false, None, Some(ty), _) => ConversionMode::TryInto(ty),
+            (false, None, None, true) => ConversionMode::None, // clone without conversion
+            (false, None, None, false) => ConversionMode::ToMigrationState, // default behavior
+
+            // ... then the error cases
+            (true, _, _, _) => {
+                return Err(Error::new(
+                    attrs[0].span(),
+                    "ToMigrationState: omit cannot be used with other attributes",
+                ));
+            }
+            (_, Some(_), Some(_), _) => {
+                return Err(Error::new(
+                    attrs[0].span(),
+                    "ToMigrationState: into and try_into attributes cannot be used together",
+                ));
+            }
+        };
+
+        Ok(())
+    }
+
+    fn parse(attrs: &[syn::Attribute]) -> Result<Self> {
+        let mut field_attrs = Self::default();
+        field_attrs.parse_from(attrs)?;
+        Ok(field_attrs)
+    }
+}
+
+#[derive(Debug)]
+struct MigrationStateField {
+    name: Ident,
+    original_type: Type,
+    attrs: FieldAttrs,
+}
+
+impl MigrationStateField {
+    fn maybe_clone(&self, mut value: TokenStream) -> TokenStream {
+        if self.attrs.clone {
+            value = quote! { #value.clone() };
+        }
+        value
+    }
+
+    fn generate_migration_state_field(&self) -> TokenStream {
+        let name = &self.name;
+        let field_type = self.attrs.conversion.target_type(&self.original_type);
+
+        quote! {
+            pub #name: #field_type,
+        }
+    }
+
+    fn generate_snapshot_field(&self) -> TokenStream {
+        let name = &self.name;
+        let value = self.maybe_clone(quote! { self.#name });
+
+        match &self.attrs.conversion {
+            ConversionMode::Omit => {
+                unreachable!("Omitted fields are filtered out during processing")
+            }
+            ConversionMode::None => quote! {
+                target.#name = #value;
+            },
+            ConversionMode::Into(_) => quote! {
+                target.#name = #value.into();
+            },
+            ConversionMode::TryInto(_) => quote! {
+                target.#name = #value.try_into().map_err(|_| migration::InvalidError)?;
+            },
+            ConversionMode::ToMigrationState => quote! {
+                self.#name.snapshot_migration_state(&mut target.#name)?;
+            },
+        }
+    }
+
+    fn generate_restore_field(&self) -> TokenStream {
+        let name = &self.name;
+
+        match &self.attrs.conversion {
+            ConversionMode::Omit => {
+                unreachable!("Omitted fields are filtered out during processing")
+            }
+            ConversionMode::None => quote! {
+                self.#name = #name;
+            },
+            ConversionMode::Into(_) => quote! {
+                self.#name = #name.into();
+            },
+            ConversionMode::TryInto(_) => quote! {
+                self.#name = #name.try_into().map_err(|_| migration::InvalidError)?;
+            },
+            ConversionMode::ToMigrationState => quote! {
+                self.#name.restore_migrated_state_mut(#name, _version_id)?;
+            },
+        }
+    }
+}
+
+#[derive(Debug)]
+pub struct MigrationStateDerive {
+    input: DeriveInput,
+    fields: Vec<MigrationStateField>,
+    container_attrs: ContainerAttrs,
+}
+
+impl MigrationStateDerive {
+    fn parse(input: DeriveInput) -> Result<Self> {
+        let container_attrs = ContainerAttrs::parse(&input.attrs)?;
+        let fields = get_fields(&input, "ToMigrationState")?;
+        let fields = Self::process_fields(fields)?;
+
+        Ok(Self {
+            input,
+            fields,
+            container_attrs,
+        })
+    }
+
+    fn process_fields(
+        fields: &syn::punctuated::Punctuated<Field, syn::token::Comma>,
+    ) -> Result<Vec<MigrationStateField>> {
+        let processed = fields
+            .iter()
+            .map(|field| {
+                let attrs = FieldAttrs::parse(&field.attrs)?;
+                Ok((field, attrs))
+            })
+            .collect::<Result<Vec<_>>>()?
+            .into_iter()
+            .filter(|(_, attrs)| !matches!(attrs.conversion, ConversionMode::Omit))
+            .map(|(field, attrs)| MigrationStateField {
+                name: field.ident.as_ref().unwrap().clone(),
+                original_type: field.ty.clone(),
+                attrs,
+            })
+            .collect();
+
+        Ok(processed)
+    }
+
+    fn migration_state_name(&self) -> Cow<'_, Ident> {
+        match &self.container_attrs.rename {
+            Some(rename) => Cow::Borrowed(rename),
+            None => Cow::Owned(format_ident!("{}Migration", &self.input.ident)),
+        }
+    }
+
+    fn generate_migration_state_struct(&self) -> TokenStream {
+        let name = self.migration_state_name();
+        let fields = self
+            .fields
+            .iter()
+            .map(MigrationStateField::generate_migration_state_field);
+
+        quote! {
+            #[derive(Default)]
+            pub struct #name {
+                #(#fields)*
+            }
+        }
+    }
+
+    fn generate_snapshot_migration_state(&self) -> TokenStream {
+        let fields = self
+            .fields
+            .iter()
+            .map(MigrationStateField::generate_snapshot_field);
+
+        quote! {
+            fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), migration::InvalidError> {
+                #(#fields)*
+                Ok(())
+            }
+        }
+    }
+
+    fn generate_restore_migrated_state(&self) -> TokenStream {
+        let names: Vec<_> = self.fields.iter().map(|f| &f.name).collect();
+        let fields = self
+            .fields
+            .iter()
+            .map(MigrationStateField::generate_restore_field);
+
+        // version_id could be used or not depending on conversion attributes
+        quote! {
+            #[allow(clippy::used_underscore_binding)]
+            fn restore_migrated_state_mut(&mut self, source: Self::Migrated, _version_id: u8) -> Result<(), migration::InvalidError> {
+                let Self::Migrated { #(#names),* } = source;
+                #(#fields)*
+                Ok(())
+            }
+        }
+    }
+
+    fn generate(&self) -> TokenStream {
+        let struct_name = &self.input.ident;
+        let generics = &self.input.generics;
+
+        let (impl_generics, ty_generics, where_clause) = generics.split_for_impl();
+        let name = self.migration_state_name();
+        let migration_state_struct = self.generate_migration_state_struct();
+        let snapshot_impl = self.generate_snapshot_migration_state();
+        let restore_impl = self.generate_restore_migrated_state();
+
+        quote! {
+            #migration_state_struct
+
+            impl #impl_generics ToMigrationState for #struct_name #ty_generics #where_clause {
+                type Migrated = #name;
+
+                #snapshot_impl
+
+                #restore_impl
+            }
+        }
+    }
+
+    pub fn expand(input: DeriveInput) -> Result<TokenStream> {
+        let tokens = Self::parse(input)?.generate();
+        Ok(tokens)
+    }
+}
diff --git a/rust/qemu-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
index ac998d20e3..65691412ff 100644
--- a/rust/qemu-macros/src/tests.rs
+++ b/rust/qemu-macros/src/tests.rs
@@ -7,7 +7,7 @@ use quote::quote;
 use super::*;
 
 macro_rules! derive_compile_fail {
-    ($derive_fn:ident, $input:expr, $($error_msg:expr),+ $(,)?) => {{
+    ($derive_fn:path, $input:expr, $($error_msg:expr),+ $(,)?) => {{
         let input: proc_macro2::TokenStream = $input;
         let error_msg = &[$( quote! { ::core::compile_error! { $error_msg } } ),*];
         let derive_fn: fn(input: syn::DeriveInput) -> Result<proc_macro2::TokenStream, syn::Error> =
@@ -24,7 +24,7 @@ macro_rules! derive_compile_fail {
 }
 
 macro_rules! derive_compile {
-    ($derive_fn:ident, $input:expr, $($expected:tt)*) => {{
+    ($derive_fn:path, $input:expr, $($expected:tt)*) => {{
         let input: proc_macro2::TokenStream = $input;
         let expected: proc_macro2::TokenStream = $($expected)*;
         let derive_fn: fn(input: syn::DeriveInput) -> Result<proc_macro2::TokenStream, syn::Error> =
@@ -345,3 +345,112 @@ fn test_derive_tryinto() {
         }
     );
 }
+
+#[test]
+fn test_derive_to_migration_state() {
+    derive_compile_fail!(
+        MigrationStateDerive::expand,
+        quote! {
+            struct MyStruct {
+                #[migration_state(omit, clone)]
+                bad: u32,
+            }
+        },
+        "ToMigrationState: omit cannot be used with other attributes"
+    );
+    derive_compile_fail!(
+        MigrationStateDerive::expand,
+        quote! {
+            struct MyStruct {
+                #[migration_state(into)]
+                bad: u32,
+            }
+        },
+        "unexpected end of input, expected parentheses"
+    );
+    derive_compile_fail!(
+        MigrationStateDerive::expand,
+        quote! {
+            struct MyStruct {
+                #[migration_state(into(String), try_into(String))]
+                bad: &'static str,
+            }
+        },
+        "ToMigrationState: into and try_into attributes cannot be used together"
+    );
+    derive_compile!(
+        MigrationStateDerive::expand,
+        quote! {
+            #[migration_state(rename = CustomMigration)]
+            struct MyStruct {
+                #[migration_state(omit)]
+                runtime_field: u32,
+
+                #[migration_state(clone)]
+                shared_data: String,
+
+                #[migration_state(into(Cow<'static, str>), clone)]
+                converted_field: String,
+
+                #[migration_state(try_into(i8))]
+                fallible_field: u32,
+
+                nested_field: NestedStruct,
+                simple_field: u32,
+            }
+        },
+        quote! {
+            #[derive(Default)]
+            pub struct CustomMigration {
+                pub shared_data: String,
+                pub converted_field: Cow<'static, str>,
+                pub fallible_field: i8,
+                pub nested_field: <NestedStruct as ToMigrationState>::Migrated,
+                pub simple_field: <u32 as ToMigrationState>::Migrated,
+            }
+            impl ToMigrationState for MyStruct {
+                type Migrated = CustomMigration;
+                fn snapshot_migration_state(
+                    &self,
+                    target: &mut Self::Migrated
+                ) -> Result<(), migration::InvalidError> {
+                    target.shared_data = self.shared_data.clone();
+                    target.converted_field = self.converted_field.clone().into();
+                    target.fallible_field = self
+                        .fallible_field
+                        .try_into()
+                        .map_err(|_| migration::InvalidError)?;
+                    self.nested_field
+                        .snapshot_migration_state(&mut target.nested_field)?;
+                    self.simple_field
+                        .snapshot_migration_state(&mut target.simple_field)?;
+                    Ok(())
+                }
+                #[allow(clippy::used_underscore_binding)]
+                fn restore_migrated_state_mut(
+                    &mut self,
+                    source: Self::Migrated,
+                    _version_id: u8
+                ) -> Result<(), migration::InvalidError> {
+                    let Self::Migrated {
+                        shared_data,
+                        converted_field,
+                        fallible_field,
+                        nested_field,
+                        simple_field
+                    } = source;
+                    self.shared_data = shared_data;
+                    self.converted_field = converted_field.into();
+                    self.fallible_field = fallible_field
+                        .try_into()
+                        .map_err(|_| migration::InvalidError)?;
+                    self.nested_field
+                        .restore_migrated_state_mut(nested_field, _version_id)?;
+                    self.simple_field
+                        .restore_migrated_state_mut(simple_field, _version_id)?;
+                    Ok(())
+                }
+            }
+        }
+    );
+}

From 67913e95bf7e9fb3c9e904055d7021b243ff1674 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 30 Sep 2025 10:56:26 +0200
Subject: [PATCH 1328/2396] timer: constify some functions

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qemu/timer.h | 6 +++---
 util/qemu-timer.c    | 8 ++++----
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index abd2204f3b..aec730ac25 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -699,7 +699,7 @@ void timer_mod_anticipate(QEMUTimer *ts, int64_t expire_time);
  *
  * Returns: true if the timer is pending
  */
-bool timer_pending(QEMUTimer *ts);
+bool timer_pending(const QEMUTimer *ts);
 
 /**
  * timer_expired:
@@ -710,7 +710,7 @@ bool timer_pending(QEMUTimer *ts);
  *
  * Returns: true if the timer has expired
  */
-bool timer_expired(QEMUTimer *timer_head, int64_t current_time);
+bool timer_expired(const QEMUTimer *timer_head, int64_t current_time);
 
 /**
  * timer_expire_time_ns:
@@ -720,7 +720,7 @@ bool timer_expired(QEMUTimer *timer_head, int64_t current_time);
  *
  * Returns: the expiry time in nanoseconds
  */
-uint64_t timer_expire_time_ns(QEMUTimer *ts);
+uint64_t timer_expire_time_ns(const QEMUTimer *ts);
 
 /**
  * timer_get:
diff --git a/util/qemu-timer.c b/util/qemu-timer.c
index 1fb48be281..56f11b6a64 100644
--- a/util/qemu-timer.c
+++ b/util/qemu-timer.c
@@ -89,7 +89,7 @@ static inline QEMUClock *qemu_clock_ptr(QEMUClockType type)
     return &qemu_clocks[type];
 }
 
-static bool timer_expired_ns(QEMUTimer *timer_head, int64_t current_time)
+static bool timer_expired_ns(const QEMUTimer *timer_head, int64_t current_time)
 {
     return timer_head && (timer_head->expire_time <= current_time);
 }
@@ -475,12 +475,12 @@ void timer_mod_anticipate(QEMUTimer *ts, int64_t expire_time)
     timer_mod_anticipate_ns(ts, expire_time * ts->scale);
 }
 
-bool timer_pending(QEMUTimer *ts)
+bool timer_pending(const QEMUTimer *ts)
 {
     return ts->expire_time >= 0;
 }
 
-bool timer_expired(QEMUTimer *timer_head, int64_t current_time)
+bool timer_expired(const QEMUTimer *timer_head, int64_t current_time)
 {
     return timer_expired_ns(timer_head, current_time * timer_head->scale);
 }
@@ -649,7 +649,7 @@ void init_clocks(QEMUTimerListNotifyCB *notify_cb)
 #endif
 }
 
-uint64_t timer_expire_time_ns(QEMUTimer *ts)
+uint64_t timer_expire_time_ns(const QEMUTimer *ts)
 {
     return timer_pending(ts) ? ts->expire_time : -1;
 }

From 7ee5875d423598ac55a0b55881d9a1ee5c3c7daf Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 11:18:44 +0200
Subject: [PATCH 1329/2396] rust: migration: implement ToMigrationState as part
 of impl_vmstate_bitsized

This is most likely desirable, and is the easiest way to migrate
a bit-sized value without peeking at the innards of the bilge crate.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 445fe7fbc0..42e5df8d81 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -296,6 +296,25 @@ macro_rules! impl_vmstate_bitsized {
                                           as ::bilge::prelude::Number>::UnderlyingType
                                          as $crate::vmstate::VMState>::VARRAY_FLAG;
         }
+
+        impl $crate::migratable::ToMigrationState for $type {
+            type Migrated = <<$type as ::bilge::prelude::Bitsized>::ArbitraryInt
+                                          as ::bilge::prelude::Number>::UnderlyingType;
+
+            fn snapshot_migration_state(&self, target: &mut Self::Migrated) -> Result<(), $crate::InvalidError> {
+                *target = Self::Migrated::from(*self);
+                Ok(())
+            }
+
+            fn restore_migrated_state_mut(
+                &mut self,
+                source: Self::Migrated,
+                version_id: u8,
+            ) -> Result<(), $crate::InvalidError> {
+                *self = Self::from(source);
+                Ok(())
+            }
+        }
     };
 }
 

From f55fc1c0929d0ecdaad089f40e087f2c81ed6614 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Sep 2025 18:16:58 -0700
Subject: [PATCH 1330/2396] accel/tcg: Add clear_flags argument to
 page_set_flags

Expand the interface of page_set_flags to separate the
set of flags to be set and the set of flags to be cleared.

This allows us to replace PAGE_RESET with the PAGE_VALID
bit within clear_flags.

Replace PAGE_TARGET_STICKY with TARGET_PAGE_NOTSTICKY;
aarch64-linux-user is the only user.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/user-exec.c          | 114 +++++++++------------------------
 bsd-user/bsd-mem.h             |   7 +-
 bsd-user/mmap.c                |   6 +-
 include/exec/page-protection.h |  13 ++--
 include/user/page-protection.h |   9 ++-
 linux-user/arm/elfload.c       |   2 +-
 linux-user/hppa/elfload.c      |   2 +-
 linux-user/mmap.c              |  32 +++++----
 linux-user/x86_64/elfload.c    |   2 +-
 target/arm/cpu.h               |   1 -
 10 files changed, 71 insertions(+), 117 deletions(-)

diff --git a/accel/tcg/user-exec.c b/accel/tcg/user-exec.c
index 916f18754f..1800dffa63 100644
--- a/accel/tcg/user-exec.c
+++ b/accel/tcg/user-exec.c
@@ -269,48 +269,6 @@ static void pageflags_create(vaddr start, vaddr last, int flags)
     interval_tree_insert(&p->itree, &pageflags_root);
 }
 
-/* A subroutine of page_set_flags: remove everything in [start,last]. */
-static bool pageflags_unset(vaddr start, vaddr last)
-{
-    bool inval_tb = false;
-
-    while (true) {
-        PageFlagsNode *p = pageflags_find(start, last);
-        vaddr p_last;
-
-        if (!p) {
-            break;
-        }
-
-        if (p->flags & PAGE_EXEC) {
-            inval_tb = true;
-        }
-
-        interval_tree_remove(&p->itree, &pageflags_root);
-        p_last = p->itree.last;
-
-        if (p->itree.start < start) {
-            /* Truncate the node from the end, or split out the middle. */
-            p->itree.last = start - 1;
-            interval_tree_insert(&p->itree, &pageflags_root);
-            if (last < p_last) {
-                pageflags_create(last + 1, p_last, p->flags);
-                break;
-            }
-        } else if (p_last <= last) {
-            /* Range completely covers node -- remove it. */
-            g_free_rcu(p, rcu);
-        } else {
-            /* Truncate the node from the start. */
-            p->itree.start = last + 1;
-            interval_tree_insert(&p->itree, &pageflags_root);
-            break;
-        }
-    }
-
-    return inval_tb;
-}
-
 /*
  * A subroutine of page_set_flags: nothing overlaps [start,last],
  * but check adjacent mappings and maybe merge into a single range.
@@ -356,15 +314,6 @@ static void pageflags_create_merge(vaddr start, vaddr last, int flags)
     }
 }
 
-/*
- * Allow the target to decide if PAGE_TARGET_[12] may be reset.
- * By default, they are not kept.
- */
-#ifndef PAGE_TARGET_STICKY
-#define PAGE_TARGET_STICKY  0
-#endif
-#define PAGE_STICKY  (PAGE_ANON | PAGE_PASSTHROUGH | PAGE_TARGET_STICKY)
-
 /* A subroutine of page_set_flags: add flags to [start,last]. */
 static bool pageflags_set_clear(vaddr start, vaddr last,
                                 int set_flags, int clear_flags)
@@ -377,7 +326,7 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
  restart:
     p = pageflags_find(start, last);
     if (!p) {
-        if (set_flags) {
+        if (set_flags & PAGE_VALID) {
             pageflags_create_merge(start, last, set_flags);
         }
         goto done;
@@ -391,11 +340,12 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
 
     /*
      * Need to flush if an overlapping executable region
-     * removes exec, or adds write.
+     * removes exec, adds write, or is a new mapping.
      */
     if ((p_flags & PAGE_EXEC)
         && (!(merge_flags & PAGE_EXEC)
-            || (merge_flags & ~p_flags & PAGE_WRITE))) {
+            || (merge_flags & ~p_flags & PAGE_WRITE)
+            || (clear_flags & PAGE_VALID))) {
         inval_tb = true;
     }
 
@@ -404,7 +354,7 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
      * attempting to merge with adjacent regions.
      */
     if (start == p_start && last == p_last) {
-        if (merge_flags) {
+        if (merge_flags & PAGE_VALID) {
             p->flags = merge_flags;
         } else {
             interval_tree_remove(&p->itree, &pageflags_root);
@@ -424,12 +374,12 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
             interval_tree_insert(&p->itree, &pageflags_root);
 
             if (last < p_last) {
-                if (merge_flags) {
+                if (merge_flags & PAGE_VALID) {
                     pageflags_create(start, last, merge_flags);
                 }
                 pageflags_create(last + 1, p_last, p_flags);
             } else {
-                if (merge_flags) {
+                if (merge_flags & PAGE_VALID) {
                     pageflags_create(start, p_last, merge_flags);
                 }
                 if (p_last < last) {
@@ -438,18 +388,18 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
                 }
             }
         } else {
-            if (start < p_start && set_flags) {
+            if (start < p_start && (set_flags & PAGE_VALID)) {
                 pageflags_create(start, p_start - 1, set_flags);
             }
             if (last < p_last) {
                 interval_tree_remove(&p->itree, &pageflags_root);
                 p->itree.start = last + 1;
                 interval_tree_insert(&p->itree, &pageflags_root);
-                if (merge_flags) {
+                if (merge_flags & PAGE_VALID) {
                     pageflags_create(start, last, merge_flags);
                 }
             } else {
-                if (merge_flags) {
+                if (merge_flags & PAGE_VALID) {
                     p->flags = merge_flags;
                 } else {
                     interval_tree_remove(&p->itree, &pageflags_root);
@@ -497,7 +447,7 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
         g_free_rcu(p, rcu);
         goto restart;
     }
-    if (set_flags) {
+    if (set_flags & PAGE_VALID) {
         pageflags_create(start, last, set_flags);
     }
 
@@ -505,42 +455,36 @@ static bool pageflags_set_clear(vaddr start, vaddr last,
     return inval_tb;
 }
 
-void page_set_flags(vaddr start, vaddr last, int flags)
+void page_set_flags(vaddr start, vaddr last, int set_flags, int clear_flags)
 {
-    bool reset = false;
-    bool inval_tb = false;
-
-    /* This function should never be called with addresses outside the
-       guest address space.  If this assert fires, it probably indicates
-       a missing call to h2g_valid.  */
+    /*
+     * This function should never be called with addresses outside the
+     * guest address space.  If this assert fires, it probably indicates
+     * a missing call to h2g_valid.
+     */
     assert(start <= last);
     assert(last <= guest_addr_max);
-    /* Only set PAGE_ANON with new mappings. */
-    assert(!(flags & PAGE_ANON) || (flags & PAGE_RESET));
     assert_memory_lock();
 
     start &= TARGET_PAGE_MASK;
     last |= ~TARGET_PAGE_MASK;
 
-    if (!(flags & PAGE_VALID)) {
-        flags = 0;
-    } else {
-        reset = flags & PAGE_RESET;
-        flags &= ~PAGE_RESET;
-        if (flags & PAGE_WRITE) {
-            flags |= PAGE_WRITE_ORG;
-        }
+    if (set_flags & PAGE_WRITE) {
+        set_flags |= PAGE_WRITE_ORG;
+    }
+    if (clear_flags & PAGE_WRITE) {
+        clear_flags |= PAGE_WRITE_ORG;
     }
 
-    if (!flags || reset) {
+    if (clear_flags & PAGE_VALID) {
         page_reset_target_data(start, last);
-        inval_tb |= pageflags_unset(start, last);
+        clear_flags = -1;
+    } else {
+        /* Only set PAGE_ANON with new mappings. */
+        assert(!(set_flags & PAGE_ANON));
     }
-    if (flags) {
-        inval_tb |= pageflags_set_clear(start, last, flags,
-                                        ~(reset ? 0 : PAGE_STICKY));
-    }
-    if (inval_tb) {
+
+    if (pageflags_set_clear(start, last, set_flags, clear_flags)) {
         tb_invalidate_phys_range(NULL, start, last);
     }
 }
diff --git a/bsd-user/bsd-mem.h b/bsd-user/bsd-mem.h
index 1be906c591..416d0f8c23 100644
--- a/bsd-user/bsd-mem.h
+++ b/bsd-user/bsd-mem.h
@@ -390,8 +390,9 @@ static inline abi_long do_bsd_shmat(int shmid, abi_ulong shmaddr, int shmflg)
         raddr = h2g(host_raddr);
 
         page_set_flags(raddr, raddr + shm_info.shm_segsz - 1,
-                       PAGE_VALID | PAGE_RESET | PAGE_READ |
-                       (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE));
+                       PAGE_VALID | PAGE_READ |
+                       (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE),
+                       PAGE_VALID);
 
         for (int i = 0; i < N_BSD_SHM_REGIONS; i++) {
             if (bsd_shm_regions[i].start == 0) {
@@ -428,7 +429,7 @@ static inline abi_long do_bsd_shmdt(abi_ulong shmaddr)
             abi_ulong size = bsd_shm_regions[i].size;
 
             bsd_shm_regions[i].start = 0;
-            page_set_flags(shmaddr, shmaddr + size - 1, 0);
+            page_set_flags(shmaddr, shmaddr + size - 1, 0, PAGE_VALID);
             mmap_reserve(shmaddr, size);
         }
     }
diff --git a/bsd-user/mmap.c b/bsd-user/mmap.c
index 47e317517c..24ba1728eb 100644
--- a/bsd-user/mmap.c
+++ b/bsd-user/mmap.c
@@ -122,7 +122,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int prot)
         if (ret != 0)
             goto error;
     }
-    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
+    page_set_flags(start, start + len - 1, prot, PAGE_RWX);
     mmap_unlock();
     return 0;
 error:
@@ -652,7 +652,7 @@ abi_long target_mmap(abi_ulong start, abi_ulong len, int prot,
         }
     }
  the_end1:
-    page_set_flags(start, start + len - 1, prot | PAGE_VALID);
+    page_set_flags(start, start + len - 1, prot | PAGE_VALID, PAGE_VALID);
  the_end:
 #ifdef DEBUG_MMAP
     printf("ret=0x" TARGET_ABI_FMT_lx "\n", start);
@@ -763,7 +763,7 @@ int target_munmap(abi_ulong start, abi_ulong len)
     }
 
     if (ret == 0) {
-        page_set_flags(start, start + len - 1, 0);
+        page_set_flags(start, start + len - 1, 0, PAGE_VALID);
     }
     mmap_unlock();
     return ret;
diff --git a/include/exec/page-protection.h b/include/exec/page-protection.h
index c43231af8b..5a18f98a3a 100644
--- a/include/exec/page-protection.h
+++ b/include/exec/page-protection.h
@@ -23,8 +23,11 @@
  * Low-Address-Protection. Used with PAGE_WRITE in tlb_set_page_with_attrs()
  */
 #define PAGE_WRITE_INV 0x0020
-/* For use with page_set_flags: page is being replaced; target_data cleared. */
-#define PAGE_RESET     0x0040
+/*
+ * For linux-user, indicates that the page is mapped with the same semantics
+ * in both guest and host.
+ */
+#define PAGE_PASSTHROUGH 0x40
 /* For linux-user, indicates that the page is MAP_ANON. */
 #define PAGE_ANON      0x0080
 
@@ -32,10 +35,4 @@
 #define PAGE_TARGET_1  0x0200
 #define PAGE_TARGET_2  0x0400
 
-/*
- * For linux-user, indicates that the page is mapped with the same semantics
- * in both guest and host.
- */
-#define PAGE_PASSTHROUGH 0x0800
-
 #endif
diff --git a/include/user/page-protection.h b/include/user/page-protection.h
index 4bde664e4a..41b23e72fc 100644
--- a/include/user/page-protection.h
+++ b/include/user/page-protection.h
@@ -23,14 +23,19 @@ int page_get_flags(vaddr address);
  * page_set_flags:
  * @start: first byte of range
  * @last: last byte of range
- * @flags: flags to set
+ * @set_flags: flags to set
+ * @clr_flags: flags to clear
  * Context: holding mmap lock
  *
  * Modify the flags of a page and invalidate the code if necessary.
  * The flag PAGE_WRITE_ORG is positioned automatically depending
  * on PAGE_WRITE.  The mmap_lock should already be held.
+ *
+ * For each page, flags = (flags & ~clr_flags) | set_flags.
+ * If clr_flags includes PAGE_VALID, this indicates a new mapping
+ * and page_reset_target_data will be called as well.
  */
-void page_set_flags(vaddr start, vaddr last, int flags);
+void page_set_flags(vaddr start, vaddr last, int set_flags, int clr_flags);
 
 void page_reset_target_data(vaddr start, vaddr last);
 
diff --git a/linux-user/arm/elfload.c b/linux-user/arm/elfload.c
index b1a4db4466..fef61022a3 100644
--- a/linux-user/arm/elfload.c
+++ b/linux-user/arm/elfload.c
@@ -243,7 +243,7 @@ bool init_guest_commpage(void)
     }
 
     page_set_flags(commpage, commpage | (host_page_size - 1),
-                   PAGE_READ | PAGE_EXEC | PAGE_VALID);
+                   PAGE_READ | PAGE_EXEC | PAGE_VALID, PAGE_VALID);
     return true;
 }
 
diff --git a/linux-user/hppa/elfload.c b/linux-user/hppa/elfload.c
index 018034f244..4600708702 100644
--- a/linux-user/hppa/elfload.c
+++ b/linux-user/hppa/elfload.c
@@ -42,6 +42,6 @@ bool init_guest_commpage(void)
      * Special case the entry points during translation (see do_page_zero).
      */
     page_set_flags(LO_COMMPAGE, LO_COMMPAGE | ~TARGET_PAGE_MASK,
-                   PAGE_EXEC | PAGE_VALID);
+                   PAGE_EXEC | PAGE_VALID, PAGE_VALID);
     return true;
 }
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 847092a28a..527ca5f211 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -165,6 +165,13 @@ static int target_to_host_prot(int prot)
            (prot & PROT_EXEC ? PROT_READ : 0);
 }
 
+/* Target bits to be cleared by mprotect if not present in target_prot. */
+#ifdef TARGET_AARCH64
+#define TARGET_PAGE_NOTSTICKY  PAGE_BTI
+#else
+#define TARGET_PAGE_NOTSTICKY  0
+#endif
+
 /* NOTE: all the constants are the HOST ones, but addresses are target. */
 int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
 {
@@ -262,7 +269,7 @@ int target_mprotect(abi_ulong start, abi_ulong len, int target_prot)
         }
     }
 
-    page_set_flags(start, last, page_flags);
+    page_set_flags(start, last, page_flags, PAGE_RWX | TARGET_PAGE_NOTSTICKY);
     ret = 0;
 
  error:
@@ -561,17 +568,17 @@ static abi_long mmap_end(abi_ulong start, abi_ulong last,
     if (flags & MAP_ANONYMOUS) {
         page_flags |= PAGE_ANON;
     }
-    page_flags |= PAGE_RESET;
     if (passthrough_start > passthrough_last) {
-        page_set_flags(start, last, page_flags);
+        page_set_flags(start, last, page_flags, PAGE_VALID);
     } else {
         if (start < passthrough_start) {
-            page_set_flags(start, passthrough_start - 1, page_flags);
+            page_set_flags(start, passthrough_start - 1,
+                           page_flags, PAGE_VALID);
         }
         page_set_flags(passthrough_start, passthrough_last,
-                       page_flags | PAGE_PASSTHROUGH);
+                       page_flags | PAGE_PASSTHROUGH, PAGE_VALID);
         if (passthrough_last < last) {
-            page_set_flags(passthrough_last + 1, last, page_flags);
+            page_set_flags(passthrough_last + 1, last, page_flags, PAGE_VALID);
         }
     }
     shm_region_rm_complete(start, last);
@@ -1088,7 +1095,7 @@ int target_munmap(abi_ulong start, abi_ulong len)
     mmap_lock();
     ret = mmap_reserve_or_unmap(start, len);
     if (likely(ret == 0)) {
-        page_set_flags(start, start + len - 1, 0);
+        page_set_flags(start, start + len - 1, 0, PAGE_VALID);
         shm_region_rm_complete(start, start + len - 1);
     }
     mmap_unlock();
@@ -1179,10 +1186,10 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     } else {
         new_addr = h2g(host_addr);
         prot = page_get_flags(old_addr);
-        page_set_flags(old_addr, old_addr + old_size - 1, 0);
+        page_set_flags(old_addr, old_addr + old_size - 1, 0, PAGE_VALID);
         shm_region_rm_complete(old_addr, old_addr + old_size - 1);
         page_set_flags(new_addr, new_addr + new_size - 1,
-                       prot | PAGE_VALID | PAGE_RESET);
+                       prot | PAGE_VALID, PAGE_VALID);
         shm_region_rm_complete(new_addr, new_addr + new_size - 1);
     }
     mmap_unlock();
@@ -1428,9 +1435,10 @@ abi_ulong target_shmat(CPUArchState *cpu_env, int shmid,
 
         last = shmaddr + m_len - 1;
         page_set_flags(shmaddr, last,
-                       PAGE_VALID | PAGE_RESET | PAGE_READ |
+                       PAGE_VALID | PAGE_READ |
                        (shmflg & SHM_RDONLY ? 0 : PAGE_WRITE) |
-                       (shmflg & SHM_EXEC ? PAGE_EXEC : 0));
+                       (shmflg & SHM_EXEC ? PAGE_EXEC : 0),
+                       PAGE_VALID);
 
         shm_region_rm_complete(shmaddr, last);
         shm_region_add(shmaddr, last);
@@ -1471,7 +1479,7 @@ abi_long target_shmdt(abi_ulong shmaddr)
         if (rv == 0) {
             abi_ulong size = last - shmaddr + 1;
 
-            page_set_flags(shmaddr, last, 0);
+            page_set_flags(shmaddr, last, 0, PAGE_VALID);
             shm_region_rm_complete(shmaddr, last);
             mmap_reserve_or_unmap(shmaddr, size);
         }
diff --git a/linux-user/x86_64/elfload.c b/linux-user/x86_64/elfload.c
index 1e7000c6bc..5914f76e83 100644
--- a/linux-user/x86_64/elfload.c
+++ b/linux-user/x86_64/elfload.c
@@ -37,7 +37,7 @@ bool init_guest_commpage(void)
     }
     page_set_flags(TARGET_VSYSCALL_PAGE,
                    TARGET_VSYSCALL_PAGE | ~TARGET_PAGE_MASK,
-                   PAGE_EXEC | PAGE_VALID);
+                   PAGE_EXEC | PAGE_VALID, PAGE_VALID);
     return true;
 }
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 1d4e13320c..bf221e6f97 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -2642,7 +2642,6 @@ extern const uint64_t pred_esz_masks[5];
  */
 #define PAGE_BTI            PAGE_TARGET_1
 #define PAGE_MTE            PAGE_TARGET_2
-#define PAGE_TARGET_STICKY  PAGE_MTE
 
 /* We associate one allocation tag per 16 bytes, the minimum.  */
 #define LOG2_TAG_GRANULE 4

From a79fbb6988f6aad36a64ef9fd1a5fc226a8e4130 Mon Sep 17 00:00:00 2001
From: Jon Wilson <jonwilson030981@gmail.com>
Date: Tue, 23 Sep 2025 18:52:28 -0700
Subject: [PATCH 1331/2396] linux-user: Support MADV_DONTDUMP, MADV_DODUMP

Set and clear PAGE_DONTDUMP, and honor that in vma_dump_size.

Signed-off-by: Jon Wilson <jonwilson030981@gmail.com>
[rth: Use new page_set_flags semantics; also handle DODUMP]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/exec/page-protection.h | 6 +++++-
 linux-user/elfload.c           | 4 ++--
 linux-user/mmap.c              | 6 ++++++
 3 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/include/exec/page-protection.h b/include/exec/page-protection.h
index 5a18f98a3a..c50ce57d15 100644
--- a/include/exec/page-protection.h
+++ b/include/exec/page-protection.h
@@ -30,7 +30,11 @@
 #define PAGE_PASSTHROUGH 0x40
 /* For linux-user, indicates that the page is MAP_ANON. */
 #define PAGE_ANON      0x0080
-
+/*
+ * For linux-user, indicates that the page should not be
+ * included in a core dump.
+ */
+#define PAGE_DONTDUMP  0x0100
 /* Target-specific bits that will be used via page_get_flags().  */
 #define PAGE_TARGET_1  0x0200
 #define PAGE_TARGET_2  0x0400
diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 1370ec59be..0002d5be2f 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -2127,8 +2127,8 @@ static void bswap_note(struct elf_note *en)
  */
 static size_t vma_dump_size(vaddr start, vaddr end, int flags)
 {
-    /* The area must be readable. */
-    if (!(flags & PAGE_READ)) {
+    /* The area must be readable and dumpable. */
+    if (!(flags & PAGE_READ) || (flags & PAGE_DONTDUMP)) {
         return 0;
     }
 
diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 527ca5f211..423c77856a 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -1248,6 +1248,12 @@ abi_long target_madvise(abi_ulong start, abi_ulong len_in, int advice)
      */
     mmap_lock();
     switch (advice) {
+    case MADV_DONTDUMP:
+        page_set_flags(start, start + len - 1, PAGE_DONTDUMP, 0);
+        break;
+    case MADV_DODUMP:
+        page_set_flags(start, start + len - 1, 0, PAGE_DONTDUMP);
+        break;
     case MADV_WIPEONFORK:
     case MADV_KEEPONFORK:
         ret = -EINVAL;

From ec03dd9723781c7e9d4b4f70c7f54d12da9459d5 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sat, 4 Oct 2025 12:10:52 -0700
Subject: [PATCH 1332/2396] accel/tcg: Hoist first page lookup above
 pointer_wrap
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For strict alignment targets we registered cpu_pointer_wrap_notreached,
but generic code used it before recognizing the alignment exception.
Hoist the first page lookup, so that the alignment exception happens first.

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.debian.org/1112285
Fixes: a4027ed7d4be ("target: Use cpu_pointer_wrap_notreached for strict align targets")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/tcg/cputlb.c | 23 +++++++++++++----------
 1 file changed, 13 insertions(+), 10 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 3010dd4f5d..631f1fe135 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1742,6 +1742,7 @@ static bool mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
                        uintptr_t ra, MMUAccessType type, MMULookupLocals *l)
 {
     bool crosspage;
+    vaddr last;
     int flags;
 
     l->memop = get_memop(oi);
@@ -1751,13 +1752,15 @@ static bool mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
 
     l->page[0].addr = addr;
     l->page[0].size = memop_size(l->memop);
-    l->page[1].addr = (addr + l->page[0].size - 1) & TARGET_PAGE_MASK;
+    l->page[1].addr = 0;
     l->page[1].size = 0;
-    crosspage = (addr ^ l->page[1].addr) & TARGET_PAGE_MASK;
 
+    /* Lookup and recognize exceptions from the first page. */
+    mmu_lookup1(cpu, &l->page[0], l->memop, l->mmu_idx, type, ra);
+
+    last = addr + l->page[0].size - 1;
+    crosspage = (addr ^ last) & TARGET_PAGE_MASK;
     if (likely(!crosspage)) {
-        mmu_lookup1(cpu, &l->page[0], l->memop, l->mmu_idx, type, ra);
-
         flags = l->page[0].flags;
         if (unlikely(flags & (TLB_WATCHPOINT | TLB_NOTDIRTY))) {
             mmu_watch_or_dirty(cpu, &l->page[0], type, ra);
@@ -1767,18 +1770,18 @@ static bool mmu_lookup(CPUState *cpu, vaddr addr, MemOpIdx oi,
         }
     } else {
         /* Finish compute of page crossing. */
-        int size0 = l->page[1].addr - addr;
+        vaddr addr1 = last & TARGET_PAGE_MASK;
+        int size0 = addr1 - addr;
         l->page[1].size = l->page[0].size - size0;
         l->page[0].size = size0;
-
         l->page[1].addr = cpu->cc->tcg_ops->pointer_wrap(cpu, l->mmu_idx,
-                                                         l->page[1].addr, addr);
+                                                         addr1, addr);
 
         /*
-         * Lookup both pages, recognizing exceptions from either.  If the
-         * second lookup potentially resized, refresh first CPUTLBEntryFull.
+         * Lookup and recognize exceptions from the second page.
+         * If the lookup potentially resized the table, refresh the
+         * first CPUTLBEntryFull pointer.
          */
-        mmu_lookup1(cpu, &l->page[0], l->memop, l->mmu_idx, type, ra);
         if (mmu_lookup1(cpu, &l->page[1], 0, l->mmu_idx, type, ra)) {
             uintptr_t index = tlb_index(cpu, l->mmu_idx, addr);
             l->page[0].full = &cpu->neg.tlb.d[l->mmu_idx].fulltlb[index];

From 2e9ff01a912997c4af066aab5e43a52db6c68aaf Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Oct 2025 10:59:31 +0800
Subject: [PATCH 1333/2396] target/loongarch: Add missing TLB flush with
 different asid

If asid is changed in function helper_csrwr_asid(), qemu TLB is flushed,
however loongArch TLB is still valid. So loongArch TLB need be invalidated
in function invalidate_tlb() with different asid and bit effective need
be cleared.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 8cfce48a29..f8fada5b9a 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -117,13 +117,7 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
     uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
-    uint8_t tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
 
-    if (!tlb_e) {
-        return;
-    }
-
-    tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
     mask = MAKE_64BIT_MASK(0, tlb_ps + 1);
@@ -145,11 +139,19 @@ static void invalidate_tlb(CPULoongArchState *env, int index)
 {
     LoongArchTLB *tlb;
     uint16_t csr_asid, tlb_asid, tlb_g;
+    uint8_t tlb_e;
 
     csr_asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
     tlb = &env->tlb[index];
+    tlb_e = FIELD_EX64(tlb->tlb_misc, TLB_MISC, E);
+    if (!tlb_e) {
+        return;
+    }
+
+    tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, E, 0);
     tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
     tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+    /* QEMU TLB is flushed when asid is changed */
     if (tlb_g == 0 && tlb_asid != csr_asid) {
         return;
     }

From f72848e31fbe30377ce8ed3b1ce9be7346933d34 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Oct 2025 10:59:32 +0800
Subject: [PATCH 1334/2396] target/loongarch: Skip global TLB when calculating
 replaced TLB

When new TLB entry is added, TLB index is calculated from invalid
entry at first and then from different ASID, and randomly at last.

With different ASID, global TLB should be skipped since ASID is not
useful when global TLB is added.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index f8fada5b9a..f1d183cb64 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -371,7 +371,7 @@ void helper_tlbfill(CPULoongArchState *env)
     uint16_t pagesize, stlb_ps;
     uint16_t asid, tlb_asid;
     LoongArchTLB *tlb;
-    uint8_t tlb_e;
+    uint8_t tlb_e, tlb_g;
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
         entryhi = env->CSR_TLBREHI;
@@ -400,7 +400,8 @@ void helper_tlbfill(CPULoongArchState *env)
             }
 
             tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-            if (asid != tlb_asid) {
+            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+            if (tlb_g == 0 && asid != tlb_asid) {
                 set = i;
             }
         }
@@ -423,7 +424,8 @@ void helper_tlbfill(CPULoongArchState *env)
             }
 
             tlb_asid = FIELD_EX64(tlb->tlb_misc, TLB_MISC, ASID);
-            if (asid != tlb_asid) {
+            tlb_g = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, G);
+            if (tlb_g == 0 && asid != tlb_asid) {
                 index = i;
             }
         }

From 52d90741637e498042269f17925b500f4ffe3ef8 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 13 Oct 2025 14:35:15 +0800
Subject: [PATCH 1335/2396] hw/loongarch/virt: Remove header file ls7a.h

LoongArch virt machine uses GPEX PCIE host bridge rather than 7A host
bridge. Remove header file ls7a.h and put hardware information to file
include/hw/loongarch/virt.h

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 MAINTAINERS                            |  1 -
 hw/intc/loongarch_pic_kvm.c            |  1 -
 hw/loongarch/virt-acpi-build.c         |  1 -
 hw/loongarch/virt-fdt-build.c          |  1 -
 hw/loongarch/virt.c                    |  1 -
 include/hw/intc/loongarch_pic_common.h |  2 +-
 include/hw/loongarch/virt.h            | 39 ++++++++++++++++++++++++++
 include/hw/pci-host/ls7a.h             | 39 --------------------------
 8 files changed, 40 insertions(+), 45 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 84cfd85e1f..0c766961f3 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1308,7 +1308,6 @@ F: include/hw/intc/loongarch_*.h
 F: include/hw/intc/loongson_ipi_common.h
 F: hw/intc/loongarch_*.c
 F: hw/intc/loongson_ipi_common.c
-F: include/hw/pci-host/ls7a.h
 F: hw/rtc/ls7a_rtc.c
 F: gdb-xml/loongarch*.xml
 
diff --git a/hw/intc/loongarch_pic_kvm.c b/hw/intc/loongarch_pic_kvm.c
index dd504ec6a6..6cfddf4520 100644
--- a/hw/intc/loongarch_pic_kvm.c
+++ b/hw/intc/loongarch_pic_kvm.c
@@ -10,7 +10,6 @@
 #include "hw/boards.h"
 #include "hw/intc/loongarch_pch_pic.h"
 #include "hw/loongarch/virt.h"
-#include "hw/pci-host/ls7a.h"
 #include "system/kvm.h"
 
 static void kvm_pch_pic_access_reg(int fd, uint64_t addr, void *val, bool write)
diff --git a/hw/loongarch/virt-acpi-build.c b/hw/loongarch/virt-acpi-build.c
index 8c2228a772..3694c9827f 100644
--- a/hw/loongarch/virt-acpi-build.c
+++ b/hw/loongarch/virt-acpi-build.c
@@ -21,7 +21,6 @@
 #include "system/reset.h"
 
 /* Supported chipsets: */
-#include "hw/pci-host/ls7a.h"
 #include "hw/loongarch/virt.h"
 
 #include "hw/acpi/utils.h"
diff --git a/hw/loongarch/virt-fdt-build.c b/hw/loongarch/virt-fdt-build.c
index 728ce46699..1f0ba01f71 100644
--- a/hw/loongarch/virt-fdt-build.c
+++ b/hw/loongarch/virt-fdt-build.c
@@ -12,7 +12,6 @@
 #include "hw/loader.h"
 #include "hw/loongarch/virt.h"
 #include "hw/pci-host/gpex.h"
-#include "hw/pci-host/ls7a.h"
 #include "system/device_tree.h"
 #include "system/reset.h"
 #include "target/loongarch/cpu.h"
diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index c1760423ee..efd1f9ac49 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -29,7 +29,6 @@
 #include "hw/intc/loongarch_pch_pic.h"
 #include "hw/intc/loongarch_pch_msi.h"
 #include "hw/intc/loongarch_dintc.h"
-#include "hw/pci-host/ls7a.h"
 #include "hw/pci-host/gpex.h"
 #include "hw/misc/unimp.h"
 #include "hw/loongarch/fw_cfg.h"
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index f774c975d4..675ba96e64 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -7,7 +7,7 @@
 #ifndef HW_LOONGARCH_PIC_COMMON_H
 #define HW_LOONGARCH_PIC_COMMON_H
 
-#include "hw/pci-host/ls7a.h"
+#include "hw/loongarch/virt.h"
 #include "hw/sysbus.h"
 
 #define PCH_PIC_INT_ID                  0x00
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 76fa57cd07..0cc1b499a7 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -25,6 +25,7 @@
 #define IOCSRF_VM               11
 #define IOCSRF_DMSI             15
 
+/* IOCSR region */
 #define VERSION_REG             0x0
 #define FEATURE_REG             0x8
 #define VENDOR_REG              0x10
@@ -36,6 +37,18 @@
 
 #define LOONGARCH_MAX_CPUS      256
 
+/* MMIO memory region */
+#define VIRT_PCH_REG_BASE       0x10000000UL
+#define VIRT_PCH_REG_SIZE       0x400
+#define VIRT_IOAPIC_REG_BASE    (VIRT_PCH_REG_BASE)
+#define VIRT_MISC_REG_BASE      (VIRT_PCH_REG_BASE + 0x00080000)
+#define VIRT_RTC_REG_BASE       (VIRT_MISC_REG_BASE + 0x00050100)
+#define VIRT_RTC_LEN            0x100
+#define VIRT_PLATFORM_BUS_BASEADDRESS   0x16000000UL
+#define VIRT_PLATFORM_BUS_SIZE          0x02000000
+#define VIRT_PCI_IO_BASE        0x18004000UL
+#define VIRT_PCI_IO_OFFSET      0x4000
+#define VIRT_PCI_IO_SIZE        0xC000
 #define VIRT_FWCFG_BASE         0x1e020000UL
 #define VIRT_BIOS_BASE          0x1c000000UL
 #define VIRT_BIOS_SIZE          (16 * MiB)
@@ -44,6 +57,16 @@
 #define VIRT_FLASH0_SIZE        VIRT_BIOS_SIZE
 #define VIRT_FLASH1_BASE        0x1d000000UL
 #define VIRT_FLASH1_SIZE        (16 * MiB)
+#define VIRT_UART_BASE          0x1fe001e0UL
+#define VIRT_UART_SIZE          0x100
+#define VIRT_PCI_CFG_BASE       0x20000000UL
+#define VIRT_PCI_CFG_SIZE       0x08000000UL
+#define VIRT_DINTC_BASE         0x2FE00000UL
+#define VIRT_DINTC_SIZE         0x00100000UL
+#define VIRT_PCH_MSI_ADDR_LOW   0x2FF00000UL
+#define VIRT_PCH_MSI_SIZE       0x8
+#define VIRT_PCI_MEM_BASE       0x40000000UL
+#define VIRT_PCI_MEM_SIZE       0x40000000UL
 
 #define VIRT_LOWMEM_BASE        0
 #define VIRT_LOWMEM_SIZE        0x10000000
@@ -53,6 +76,22 @@
 #define VIRT_GED_REG_ADDR       QEMU_ALIGN_UP(VIRT_GED_MEM_ADDR + MEMORY_HOTPLUG_IO_LEN, 4)
 #define VIRT_GED_CPUHP_ADDR     QEMU_ALIGN_UP(VIRT_GED_REG_ADDR + ACPI_GED_REG_COUNT, 4)
 
+/*
+ * GSI_BASE is hard-coded with 64 in linux kernel, else kernel fails to boot
+ * 0  - 15  GSI for ISA devices even if there is no ISA devices
+ * 16 - 63  GSI for CPU devices such as timers/perf monitor etc
+ * 64 -     GSI for external devices
+ */
+#define VIRT_PCH_PIC_IRQ_NUM     32
+#define VIRT_GSI_BASE            64
+#define VIRT_DEVICE_IRQS         16
+#define VIRT_UART_IRQ            (VIRT_GSI_BASE + 2)
+#define VIRT_UART_COUNT          4
+#define VIRT_RTC_IRQ             (VIRT_GSI_BASE + 6)
+#define VIRT_SCI_IRQ             (VIRT_GSI_BASE + 7)
+#define VIRT_PLATFORM_BUS_IRQ    (VIRT_GSI_BASE + 8)
+#define VIRT_PLATFORM_BUS_NUM_IRQS      2
+
 #define COMMAND_LINE_SIZE       512
 
 #define FDT_BASE                0x100000
diff --git a/include/hw/pci-host/ls7a.h b/include/hw/pci-host/ls7a.h
index bfdbfe3614..33e7942de9 100644
--- a/include/hw/pci-host/ls7a.h
+++ b/include/hw/pci-host/ls7a.h
@@ -13,43 +13,4 @@
 #include "qemu/range.h"
 #include "qom/object.h"
 
-#define VIRT_PCI_MEM_BASE        0x40000000UL
-#define VIRT_PCI_MEM_SIZE        0x40000000UL
-#define VIRT_PCI_IO_OFFSET       0x4000
-#define VIRT_PCI_CFG_BASE        0x20000000
-#define VIRT_PCI_CFG_SIZE        0x08000000
-#define VIRT_PCI_IO_BASE         0x18004000UL
-#define VIRT_PCI_IO_SIZE         0xC000
-
-#define VIRT_PCH_REG_BASE        0x10000000UL
-#define VIRT_IOAPIC_REG_BASE     (VIRT_PCH_REG_BASE)
-#define VIRT_PCH_MSI_ADDR_LOW    0x2FF00000UL
-#define VIRT_DINTC_SIZE          0x100000UL
-#define VIRT_DINTC_BASE          0x2FE00000UL
-#define VIRT_PCH_REG_SIZE        0x400
-#define VIRT_PCH_MSI_SIZE        0x8
-
-/*
- * GSI_BASE is hard-coded with 64 in linux kernel, else kernel fails to boot
- * 0  - 15  GSI for ISA devices even if there is no ISA devices
- * 16 - 63  GSI for CPU devices such as timers/perf monitor etc
- * 64 -     GSI for external devices
- */
-#define VIRT_PCH_PIC_IRQ_NUM     32
-#define VIRT_GSI_BASE            64
-#define VIRT_DEVICE_IRQS         16
-#define VIRT_UART_COUNT          4
-#define VIRT_UART_IRQ            (VIRT_GSI_BASE + 2)
-#define VIRT_UART_BASE           0x1fe001e0
-#define VIRT_UART_SIZE           0x100
-#define VIRT_RTC_IRQ             (VIRT_GSI_BASE + 6)
-#define VIRT_MISC_REG_BASE       (VIRT_PCH_REG_BASE + 0x00080000)
-#define VIRT_RTC_REG_BASE        (VIRT_MISC_REG_BASE + 0x00050100)
-#define VIRT_RTC_LEN             0x100
-#define VIRT_SCI_IRQ             (VIRT_GSI_BASE + 7)
-
-#define VIRT_PLATFORM_BUS_BASEADDRESS   0x16000000
-#define VIRT_PLATFORM_BUS_SIZE          0x2000000
-#define VIRT_PLATFORM_BUS_NUM_IRQS      2
-#define VIRT_PLATFORM_BUS_IRQ           (VIRT_GSI_BASE + 8)
 #endif

From a9c5e0ed9b63becde7a6188bf71f95e31a132b19 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 13 Oct 2025 14:35:16 +0800
Subject: [PATCH 1336/2396] hw/loongarch/virt: Sort order by hardware device
 base address

With header file include/hw/loongarch/virt.h, hardware device definition
order is sorted by its base address. Add remove unused macro
VIRT_IOAPIC_REG_BASE and VIRT_MISC_REG_BASE.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 hw/loongarch/virt.c         |  2 +-
 include/hw/loongarch/virt.h | 42 +++++++++++++++++--------------------
 2 files changed, 20 insertions(+), 24 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index efd1f9ac49..49434ad182 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -520,7 +520,7 @@ static void virt_irq_init(LoongArchVirtMachineState *lvms)
         }
 
         /* PCH_PIC memory region */
-        memory_region_add_subregion(get_system_memory(), VIRT_IOAPIC_REG_BASE,
+        memory_region_add_subregion(get_system_memory(), VIRT_PCH_REG_BASE,
                     sysbus_mmio_get_region(SYS_BUS_DEVICE(pch_pic), 0));
 
         /* Connect pch_pic irqs to extioi */
diff --git a/include/hw/loongarch/virt.h b/include/hw/loongarch/virt.h
index 0cc1b499a7..27b1755802 100644
--- a/include/hw/loongarch/virt.h
+++ b/include/hw/loongarch/virt.h
@@ -13,50 +13,47 @@
 #include "hw/block/flash.h"
 #include "hw/loongarch/boot.h"
 
-#define IOCSRF_TEMP             0
-#define IOCSRF_NODECNT          1
-#define IOCSRF_MSI              2
-#define IOCSRF_EXTIOI           3
-#define IOCSRF_CSRIPI           4
-#define IOCSRF_FREQCSR          5
-#define IOCSRF_FREQSCALE        6
-#define IOCSRF_DVFSV1           7
-#define IOCSRF_GMOD             9
-#define IOCSRF_VM               11
-#define IOCSRF_DMSI             15
-
 /* IOCSR region */
 #define VERSION_REG             0x0
 #define FEATURE_REG             0x8
+#define  IOCSRF_TEMP             0
+#define  IOCSRF_NODECNT          1
+#define  IOCSRF_MSI              2
+#define  IOCSRF_EXTIOI           3
+#define  IOCSRF_CSRIPI           4
+#define  IOCSRF_FREQCSR          5
+#define  IOCSRF_FREQSCALE        6
+#define  IOCSRF_DVFSV1           7
+#define  IOCSRF_GMOD             9
+#define  IOCSRF_VM               11
+#define  IOCSRF_DMSI             15
 #define VENDOR_REG              0x10
 #define CPUNAME_REG             0x20
 #define MISC_FUNC_REG           0x420
-#define IOCSRM_EXTIOI_EN        48
-#define IOCSRM_EXTIOI_INT_ENCODE 49
-#define IOCSRM_DMSI_EN          51
+#define  IOCSRM_EXTIOI_EN         48
+#define  IOCSRM_EXTIOI_INT_ENCODE 49
+#define  IOCSRM_DMSI_EN           51
 
 #define LOONGARCH_MAX_CPUS      256
 
 /* MMIO memory region */
 #define VIRT_PCH_REG_BASE       0x10000000UL
 #define VIRT_PCH_REG_SIZE       0x400
-#define VIRT_IOAPIC_REG_BASE    (VIRT_PCH_REG_BASE)
-#define VIRT_MISC_REG_BASE      (VIRT_PCH_REG_BASE + 0x00080000)
-#define VIRT_RTC_REG_BASE       (VIRT_MISC_REG_BASE + 0x00050100)
+#define VIRT_RTC_REG_BASE       0x100d0100UL
 #define VIRT_RTC_LEN            0x100
 #define VIRT_PLATFORM_BUS_BASEADDRESS   0x16000000UL
 #define VIRT_PLATFORM_BUS_SIZE          0x02000000
 #define VIRT_PCI_IO_BASE        0x18004000UL
 #define VIRT_PCI_IO_OFFSET      0x4000
 #define VIRT_PCI_IO_SIZE        0xC000
-#define VIRT_FWCFG_BASE         0x1e020000UL
 #define VIRT_BIOS_BASE          0x1c000000UL
-#define VIRT_BIOS_SIZE          (16 * MiB)
+#define VIRT_BIOS_SIZE          0x01000000UL
 #define VIRT_FLASH_SECTOR_SIZE  (256 * KiB)
 #define VIRT_FLASH0_BASE        VIRT_BIOS_BASE
 #define VIRT_FLASH0_SIZE        VIRT_BIOS_SIZE
 #define VIRT_FLASH1_BASE        0x1d000000UL
-#define VIRT_FLASH1_SIZE        (16 * MiB)
+#define VIRT_FLASH1_SIZE        0x01000000UL
+#define VIRT_FWCFG_BASE         0x1e020000UL
 #define VIRT_UART_BASE          0x1fe001e0UL
 #define VIRT_UART_SIZE          0x100
 #define VIRT_PCI_CFG_BASE       0x20000000UL
@@ -70,6 +67,7 @@
 
 #define VIRT_LOWMEM_BASE        0
 #define VIRT_LOWMEM_SIZE        0x10000000
+#define FDT_BASE                0x100000
 #define VIRT_HIGHMEM_BASE       0x80000000
 #define VIRT_GED_EVT_ADDR       0x100e0000
 #define VIRT_GED_MEM_ADDR       QEMU_ALIGN_UP(VIRT_GED_EVT_ADDR + ACPI_GED_EVT_SEL_LEN, 4)
@@ -94,8 +92,6 @@
 
 #define COMMAND_LINE_SIZE       512
 
-#define FDT_BASE                0x100000
-
 struct LoongArchVirtMachineState {
     /*< private >*/
     MachineState parent_obj;

From 482869ca84a33c4d407f580400033fa5f146c1a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:12:51 +0200
Subject: [PATCH 1337/2396] accel/tcg: Name gen_goto_tb()'s TB slot index as
 @tb_slot_idx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tcg_gen_goto_tb() takes an unsigned index to the TB slot (0 or 1).
Declare the argument as unsigned and rename it as @tb_slot_idx
(which is more descriptive than @n) on all targets.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251010031745.37528-1-philmd@linaro.org>
---
 target/alpha/translate.c         | 8 ++++----
 target/arm/tcg/translate-a64.c   | 8 ++++----
 target/arm/tcg/translate.c       | 8 ++++----
 target/avr/translate.c           | 7 ++++---
 target/hexagon/translate.c       | 8 ++++----
 target/loongarch/tcg/translate.c | 7 ++++---
 target/microblaze/translate.c    | 7 ++++---
 target/mips/tcg/translate.c      | 7 ++++---
 target/ppc/translate.c           | 7 ++++---
 target/riscv/translate.c         | 9 +++++----
 target/rx/translate.c            | 7 ++++---
 target/sh4/translate.c           | 7 ++++---
 target/sparc/translate.c         | 6 +++---
 target/tricore/translate.c       | 7 ++++---
 14 files changed, 56 insertions(+), 47 deletions(-)

diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index f11b382438..a492520075 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -436,18 +436,18 @@ static DisasJumpType gen_store_conditional(DisasContext *ctx, int ra, int rb,
     return DISAS_NEXT;
 }
 
-static void gen_goto_tb(DisasContext *ctx, int idx, int32_t disp)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx, int32_t disp)
 {
     if (translator_use_goto_tb(&ctx->base, ctx->base.pc_next + disp)) {
         /* With PCREL, PC must always be up-to-date. */
         if (ctx->pcrel) {
             gen_pc_disp(ctx, cpu_pc, disp);
-            tcg_gen_goto_tb(idx);
+            tcg_gen_goto_tb(tb_slot_idx);
         } else {
-            tcg_gen_goto_tb(idx);
+            tcg_gen_goto_tb(tb_slot_idx);
             gen_pc_disp(ctx, cpu_pc, disp);
         }
-        tcg_gen_exit_tb(ctx->base.tb, idx);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         gen_pc_disp(ctx, cpu_pc, disp);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 918d5ed112..3292d7cbfd 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -528,7 +528,7 @@ static inline bool use_goto_tb(DisasContext *s, uint64_t dest)
     return translator_use_goto_tb(&s->base, dest);
 }
 
-static void gen_goto_tb(DisasContext *s, int n, int64_t diff)
+static void gen_goto_tb(DisasContext *s, unsigned tb_slot_idx, int64_t diff)
 {
     if (use_goto_tb(s, s->pc_curr + diff)) {
         /*
@@ -541,12 +541,12 @@ static void gen_goto_tb(DisasContext *s, int n, int64_t diff)
          */
         if (tb_cflags(s->base.tb) & CF_PCREL) {
             gen_a64_update_pc(s, diff);
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
         } else {
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
             gen_a64_update_pc(s, diff);
         }
-        tcg_gen_exit_tb(s->base.tb, n);
+        tcg_gen_exit_tb(s->base.tb, tb_slot_idx);
         s->base.is_jmp = DISAS_NORETURN;
     } else {
         gen_a64_update_pc(s, diff);
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 3df0bbcb7f..5f64fed220 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -1310,7 +1310,7 @@ static void gen_goto_ptr(void)
  * cpu_loop_exec. Any live exit_requests will be processed as we
  * enter the next TB.
  */
-static void gen_goto_tb(DisasContext *s, int n, target_long diff)
+static void gen_goto_tb(DisasContext *s, unsigned tb_slot_idx, target_long diff)
 {
     if (translator_use_goto_tb(&s->base, s->pc_curr + diff)) {
         /*
@@ -1323,12 +1323,12 @@ static void gen_goto_tb(DisasContext *s, int n, target_long diff)
          */
         if (tb_cflags(s->base.tb) & CF_PCREL) {
             gen_update_pc(s, diff);
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
         } else {
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
             gen_update_pc(s, diff);
         }
-        tcg_gen_exit_tb(s->base.tb, n);
+        tcg_gen_exit_tb(s->base.tb, tb_slot_idx);
     } else {
         gen_update_pc(s, diff);
         gen_goto_ptr();
diff --git a/target/avr/translate.c b/target/avr/translate.c
index 804b0b21db..ef6f655a45 100644
--- a/target/avr/translate.c
+++ b/target/avr/translate.c
@@ -981,14 +981,15 @@ static void gen_pop_ret(DisasContext *ctx, TCGv ret)
     }
 }
 
-static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     const TranslationBlock *tb = ctx->base.tb;
 
     if (translator_use_goto_tb(&ctx->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_i32(cpu_pc, dest);
-        tcg_gen_exit_tb(tb, n);
+        tcg_gen_exit_tb(tb, tb_slot_idx);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index 02fd40c160..50766eafe2 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -133,15 +133,15 @@ static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
     return translator_use_goto_tb(&ctx->base, dest);
 }
 
-static void gen_goto_tb(DisasContext *ctx, int idx, target_ulong dest, bool
-                        move_to_pc)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest, bool move_to_pc)
 {
     if (use_goto_tb(ctx, dest)) {
-        tcg_gen_goto_tb(idx);
+        tcg_gen_goto_tb(tb_slot_idx);
         if (move_to_pc) {
             tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], dest);
         }
-        tcg_gen_exit_tb(ctx->base.tb, idx);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         if (move_to_pc) {
             tcg_gen_movi_tl(hex_gpr[HEX_REG_PC], dest);
diff --git a/target/loongarch/tcg/translate.c b/target/loongarch/tcg/translate.c
index 53a0b4c3ce..57c3b8c4bb 100644
--- a/target/loongarch/tcg/translate.c
+++ b/target/loongarch/tcg/translate.c
@@ -99,16 +99,17 @@ void generate_exception(DisasContext *ctx, int excp)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static inline void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (ctx->va32) {
         dest = (uint32_t) dest;
     }
 
     if (translator_use_goto_tb(&ctx->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_tl(cpu_pc, dest);
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         tcg_gen_movi_tl(cpu_pc, dest);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 5098a1db4d..3dd74b021e 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -116,12 +116,13 @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
     gen_raise_exception_sync(dc, EXCP_HW_EXCP);
 }
 
-static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (translator_use_goto_tb(&dc->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_i32(cpu_pc, dest);
-        tcg_gen_exit_tb(dc->base.tb, n);
+        tcg_gen_exit_tb(dc->base.tb, tb_slot_idx);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/mips/tcg/translate.c b/target/mips/tcg/translate.c
index d91d6efe02..54849e9ff1 100644
--- a/target/mips/tcg/translate.c
+++ b/target/mips/tcg/translate.c
@@ -4362,12 +4362,13 @@ static void gen_trap(DisasContext *ctx, uint32_t opc,
     }
 }
 
-static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         gen_save_pc(dest);
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         gen_save_pc(dest);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/ppc/translate.c b/target/ppc/translate.c
index d422789a1d..17e6d07c8c 100644
--- a/target/ppc/translate.c
+++ b/target/ppc/translate.c
@@ -3668,16 +3668,17 @@ static void gen_lookup_and_goto_ptr(DisasContext *ctx)
 }
 
 /***                                Branch                                 ***/
-static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (NARROW_MODE(ctx)) {
         dest = (uint32_t) dest;
     }
     if (use_goto_tb(ctx, dest)) {
         pmu_count_insns(ctx);
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_tl(cpu_nip, dest & ~3);
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         tcg_gen_movi_tl(cpu_nip, dest & ~3);
         gen_lookup_and_goto_ptr(ctx);
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 6fc06c71f5..9a53aecbfe 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -286,7 +286,8 @@ static void exit_tb(DisasContext *ctx)
     tcg_gen_exit_tb(NULL, 0);
 }
 
-static void gen_goto_tb(DisasContext *ctx, int n, target_long diff)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_long diff)
 {
     target_ulong dest = ctx->base.pc_next + diff;
 
@@ -305,12 +306,12 @@ static void gen_goto_tb(DisasContext *ctx, int n, target_long diff)
          */
         if (tb_cflags(ctx->base.tb) & CF_PCREL) {
             gen_update_pc(ctx, diff);
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
         } else {
-            tcg_gen_goto_tb(n);
+            tcg_gen_goto_tb(tb_slot_idx);
             gen_update_pc(ctx, diff);
         }
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         gen_update_pc(ctx, diff);
         lookup_and_goto_ptr(ctx);
diff --git a/target/rx/translate.c b/target/rx/translate.c
index 19a9584a82..5fc589c706 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -147,12 +147,13 @@ void rx_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 }
 
-static void gen_goto_tb(DisasContext *dc, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (translator_use_goto_tb(&dc->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_i32(cpu_pc, dest);
-        tcg_gen_exit_tb(dc->base.tb, n);
+        tcg_gen_exit_tb(dc->base.tb, tb_slot_idx);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
         tcg_gen_lookup_and_goto_ptr();
diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 70fd13aa3f..137b75a4fb 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -231,12 +231,13 @@ static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
     return translator_use_goto_tb(&ctx->base, dest);
 }
 
-static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
+                        target_ulong dest)
 {
     if (use_goto_tb(ctx, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_i32(cpu_pc, dest);
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_idx);
     } else {
         tcg_gen_movi_i32(cpu_pc, dest);
         if (use_exit_tb(ctx)) {
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index 810e2491a6..d6b599b71f 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -363,15 +363,15 @@ static bool use_goto_tb(DisasContext *s, target_ulong pc, target_ulong npc)
            translator_use_goto_tb(&s->base, npc);
 }
 
-static void gen_goto_tb(DisasContext *s, int tb_num,
+static void gen_goto_tb(DisasContext *s, unsigned tb_slot_idx,
                         target_ulong pc, target_ulong npc)
 {
     if (use_goto_tb(s, pc, npc))  {
         /* jump to same page: we can use a direct jump */
-        tcg_gen_goto_tb(tb_num);
+        tcg_gen_goto_tb(tb_slot_idx);
         tcg_gen_movi_tl(cpu_pc, pc);
         tcg_gen_movi_tl(cpu_npc, npc);
-        tcg_gen_exit_tb(s->base.tb, tb_num);
+        tcg_gen_exit_tb(s->base.tb, tb_slot_idx);
     } else {
         /* jump to another page: we can use an indirect jump */
         tcg_gen_movi_tl(cpu_pc, pc);
diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 3d0e7a10bd..7c6e309597 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -2816,12 +2816,13 @@ static inline void gen_save_pc(target_ulong pc)
     tcg_gen_movi_tl(cpu_PC, pc);
 }
 
-static void gen_goto_tb(DisasContext *ctx, int n, target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_index,
+                        target_ulong dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
-        tcg_gen_goto_tb(n);
+        tcg_gen_goto_tb(tb_slot_index);
         gen_save_pc(dest);
-        tcg_gen_exit_tb(ctx->base.tb, n);
+        tcg_gen_exit_tb(ctx->base.tb, tb_slot_index);
     } else {
         gen_save_pc(dest);
         tcg_gen_lookup_and_goto_ptr();

From a6a5f0b4644ed41878936d264bc23dd72532771f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 27 Aug 2025 14:07:26 +0200
Subject: [PATCH 1338/2396] target/alpha: Access CPUState::cpu_index via helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPUState::cpu_index is a target agnostic field, meant
for common code (i.e. accel/ and system/ folders).

Target specific code should use the CPUClass::get_arch_id()
helper, even if there is a 1:1 mapping.

In preparation of generic changes around CPU indexing,
introduce the whoami helper to access the generic
CPUState::cpu_index field.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250925010438.59755-1-philmd@linaro.org>
---
 target/alpha/helper.h     | 1 +
 target/alpha/sys_helper.c | 5 +++++
 target/alpha/translate.c  | 3 +--
 3 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/target/alpha/helper.h b/target/alpha/helper.h
index 788d2fbf28..954a5c8294 100644
--- a/target/alpha/helper.h
+++ b/target/alpha/helper.h
@@ -92,6 +92,7 @@ DEF_HELPER_FLAGS_1(tbia, TCG_CALL_NO_RWG, void, env)
 DEF_HELPER_FLAGS_2(tbis, TCG_CALL_NO_RWG, void, env, i64)
 
 DEF_HELPER_1(halt, void, i64)
+DEF_HELPER_1(whami, i64, env)
 
 DEF_HELPER_FLAGS_0(get_vmtime, TCG_CALL_NO_RWG, i64)
 DEF_HELPER_FLAGS_0(get_walltime, TCG_CALL_NO_RWG, i64)
diff --git a/target/alpha/sys_helper.c b/target/alpha/sys_helper.c
index 87e37605c1..0e0a619975 100644
--- a/target/alpha/sys_helper.c
+++ b/target/alpha/sys_helper.c
@@ -67,3 +67,8 @@ void helper_set_alarm(CPUAlphaState *env, uint64_t expire)
         timer_del(cpu->alarm_timer);
     }
 }
+
+uint64_t HELPER(whami)(CPUAlphaState *env)
+{
+    return env_cpu(env)->cpu_index;
+}
diff --git a/target/alpha/translate.c b/target/alpha/translate.c
index a492520075..b1d8a4eb80 100644
--- a/target/alpha/translate.c
+++ b/target/alpha/translate.c
@@ -1126,8 +1126,7 @@ static DisasJumpType gen_call_pal(DisasContext *ctx, int palcode)
             break;
         case 0x3C:
             /* WHAMI */
-            tcg_gen_ld32s_i64(ctx->ir[IR_V0], tcg_env,
-                -offsetof(AlphaCPU, env) + offsetof(CPUState, cpu_index));
+            gen_helper_whami(ctx->ir[IR_V0], tcg_env);
             break;
 
         case 0x3E:

From 5940712ed0f770cae4d5e5999dc46b6675db8120 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 02:31:34 +0200
Subject: [PATCH 1339/2396] target/alpha: Replace VMSTATE_UINTTL() ->
 VMSTATE_UINT64()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All these CPUAlphaState fields are of uint64_t type (except
the @fir[] array which uses float64, expanded to the same
type definition). Use the appropriate VMSTATE_UINT64() macro.

There is no functional change (the migration stream is not
modified), because the Alpha targets are only built as 64-bit:

  $ git grep TARGET_LONG_BITS configs/targets/alpha*
  configs/targets/alpha-linux-user.mak:4:TARGET_LONG_BITS=64
  configs/targets/alpha-softmmu.mak:2:TARGET_LONG_BITS=64

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20250925005137.59378-1-philmd@linaro.org>
---
 target/alpha/machine.c | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/target/alpha/machine.c b/target/alpha/machine.c
index 5f302b166d..6828b123ca 100644
--- a/target/alpha/machine.c
+++ b/target/alpha/machine.c
@@ -25,8 +25,8 @@ static const VMStateInfo vmstate_fpcr = {
 };
 
 static const VMStateField vmstate_env_fields[] = {
-    VMSTATE_UINTTL_ARRAY(ir, CPUAlphaState, 31),
-    VMSTATE_UINTTL_ARRAY(fir, CPUAlphaState, 31),
+    VMSTATE_UINT64_ARRAY(ir, CPUAlphaState, 31),
+    VMSTATE_UINT64_ARRAY(fir, CPUAlphaState, 31),
     /* Save the architecture value of the fpcr, not the internally
        expanded version.  Since this architecture value does not
        exist in memory to be stored, this requires a but of hoop
@@ -41,27 +41,27 @@ static const VMStateField vmstate_env_fields[] = {
         .flags = VMS_SINGLE,
         .offset = 0
     },
-    VMSTATE_UINTTL(pc, CPUAlphaState),
-    VMSTATE_UINTTL(unique, CPUAlphaState),
-    VMSTATE_UINTTL(lock_addr, CPUAlphaState),
-    VMSTATE_UINTTL(lock_value, CPUAlphaState),
+    VMSTATE_UINT64(pc, CPUAlphaState),
+    VMSTATE_UINT64(unique, CPUAlphaState),
+    VMSTATE_UINT64(lock_addr, CPUAlphaState),
+    VMSTATE_UINT64(lock_value, CPUAlphaState),
 
     VMSTATE_UINT32(flags, CPUAlphaState),
     VMSTATE_UINT32(pcc_ofs, CPUAlphaState),
 
-    VMSTATE_UINTTL(trap_arg0, CPUAlphaState),
-    VMSTATE_UINTTL(trap_arg1, CPUAlphaState),
-    VMSTATE_UINTTL(trap_arg2, CPUAlphaState),
+    VMSTATE_UINT64(trap_arg0, CPUAlphaState),
+    VMSTATE_UINT64(trap_arg1, CPUAlphaState),
+    VMSTATE_UINT64(trap_arg2, CPUAlphaState),
 
-    VMSTATE_UINTTL(exc_addr, CPUAlphaState),
-    VMSTATE_UINTTL(palbr, CPUAlphaState),
-    VMSTATE_UINTTL(ptbr, CPUAlphaState),
-    VMSTATE_UINTTL(vptptr, CPUAlphaState),
-    VMSTATE_UINTTL(sysval, CPUAlphaState),
-    VMSTATE_UINTTL(usp, CPUAlphaState),
+    VMSTATE_UINT64(exc_addr, CPUAlphaState),
+    VMSTATE_UINT64(palbr, CPUAlphaState),
+    VMSTATE_UINT64(ptbr, CPUAlphaState),
+    VMSTATE_UINT64(vptptr, CPUAlphaState),
+    VMSTATE_UINT64(sysval, CPUAlphaState),
+    VMSTATE_UINT64(usp, CPUAlphaState),
 
-    VMSTATE_UINTTL_ARRAY(shadow, CPUAlphaState, 8),
-    VMSTATE_UINTTL_ARRAY(scratch, CPUAlphaState, 24),
+    VMSTATE_UINT64_ARRAY(shadow, CPUAlphaState, 8),
+    VMSTATE_UINT64_ARRAY(scratch, CPUAlphaState, 24),
 
     VMSTATE_END_OF_LIST()
 };

From 152820a991e6b0b4cbbdb594f87e43252626c0da Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 16:40:37 +0200
Subject: [PATCH 1340/2396] target/i386/monitor: Propagate CPU address space to
 'info mem' handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We want to replace the cpu_physical_memory_read() calls by
address_space_read() equivalents. Since the latter requires
an address space, and these commands are run in the context
of a vCPU, propagate its first address space. Next commit
will do the replacements.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20251002145742.75624-2-philmd@linaro.org>
---
 target/i386/monitor.c | 38 +++++++++++++++++++++-----------------
 1 file changed, 21 insertions(+), 17 deletions(-)

diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 3c9b6ca62f..7e7854e6c1 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -68,7 +68,7 @@ static void print_pte(Monitor *mon, CPUArchState *env, hwaddr addr,
                    pte & PG_RW_MASK ? 'W' : '-');
 }
 
-static void tlb_info_32(Monitor *mon, CPUArchState *env)
+static void tlb_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     unsigned int l1, l2;
     uint32_t pgd, pde, pte;
@@ -96,7 +96,7 @@ static void tlb_info_32(Monitor *mon, CPUArchState *env)
     }
 }
 
-static void tlb_info_pae32(Monitor *mon, CPUArchState *env)
+static void tlb_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     unsigned int l1, l2, l3;
     uint64_t pdpe, pde, pte;
@@ -136,7 +136,7 @@ static void tlb_info_pae32(Monitor *mon, CPUArchState *env)
 }
 
 #ifdef TARGET_X86_64
-static void tlb_info_la48(Monitor *mon, CPUArchState *env,
+static void tlb_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as,
         uint64_t l0, uint64_t pml4_addr)
 {
     uint64_t l1, l2, l3, l4;
@@ -197,7 +197,7 @@ static void tlb_info_la48(Monitor *mon, CPUArchState *env,
     }
 }
 
-static void tlb_info_la57(Monitor *mon, CPUArchState *env)
+static void tlb_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     uint64_t l0;
     uint64_t pml5e;
@@ -208,7 +208,7 @@ static void tlb_info_la57(Monitor *mon, CPUArchState *env)
         cpu_physical_memory_read(pml5_addr + l0 * 8, &pml5e, 8);
         pml5e = le64_to_cpu(pml5e);
         if (pml5e & PG_PRESENT_MASK) {
-            tlb_info_la48(mon, env, l0, pml5e & 0x3fffffffff000ULL);
+            tlb_info_la48(mon, env, as, l0, pml5e & 0x3fffffffff000ULL);
         }
     }
 }
@@ -217,6 +217,7 @@ static void tlb_info_la57(Monitor *mon, CPUArchState *env)
 void hmp_info_tlb(Monitor *mon, const QDict *qdict)
 {
     CPUArchState *env;
+    AddressSpace *as;
 
     env = mon_get_cpu_env(mon);
     if (!env) {
@@ -228,21 +229,22 @@ void hmp_info_tlb(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "PG disabled\n");
         return;
     }
+    as = cpu_get_address_space(env_cpu(env), X86ASIdx_MEM);
     if (env->cr[4] & CR4_PAE_MASK) {
 #ifdef TARGET_X86_64
         if (env->hflags & HF_LMA_MASK) {
             if (env->cr[4] & CR4_LA57_MASK) {
-                tlb_info_la57(mon, env);
+                tlb_info_la57(mon, env, as);
             } else {
-                tlb_info_la48(mon, env, 0, env->cr[3] & 0x3fffffffff000ULL);
+                tlb_info_la48(mon, env, as, 0, env->cr[3] & 0x3fffffffff000ULL);
             }
         } else
 #endif
         {
-            tlb_info_pae32(mon, env);
+            tlb_info_pae32(mon, env, as);
         }
     } else {
-        tlb_info_32(mon, env);
+        tlb_info_32(mon, env, as);
     }
 }
 
@@ -271,7 +273,7 @@ static void mem_print(Monitor *mon, CPUArchState *env,
     }
 }
 
-static void mem_info_32(Monitor *mon, CPUArchState *env)
+static void mem_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     unsigned int l1, l2;
     int prot, last_prot;
@@ -312,7 +314,7 @@ static void mem_info_32(Monitor *mon, CPUArchState *env)
     mem_print(mon, env, &start, &last_prot, (hwaddr)1 << 32, 0);
 }
 
-static void mem_info_pae32(Monitor *mon, CPUArchState *env)
+static void mem_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     unsigned int l1, l2, l3;
     int prot, last_prot;
@@ -369,7 +371,7 @@ static void mem_info_pae32(Monitor *mon, CPUArchState *env)
 
 
 #ifdef TARGET_X86_64
-static void mem_info_la48(Monitor *mon, CPUArchState *env)
+static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     int prot, last_prot;
     uint64_t l1, l2, l3, l4;
@@ -449,7 +451,7 @@ static void mem_info_la48(Monitor *mon, CPUArchState *env)
     mem_print(mon, env, &start, &last_prot, (hwaddr)1 << 48, 0);
 }
 
-static void mem_info_la57(Monitor *mon, CPUArchState *env)
+static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
     int prot, last_prot;
     uint64_t l0, l1, l2, l3, l4;
@@ -545,6 +547,7 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env)
 void hmp_info_mem(Monitor *mon, const QDict *qdict)
 {
     CPUArchState *env;
+    AddressSpace *as;
 
     env = mon_get_cpu_env(mon);
     if (!env) {
@@ -556,21 +559,22 @@ void hmp_info_mem(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "PG disabled\n");
         return;
     }
+    as = cpu_get_address_space(env_cpu(env), X86ASIdx_MEM);
     if (env->cr[4] & CR4_PAE_MASK) {
 #ifdef TARGET_X86_64
         if (env->hflags & HF_LMA_MASK) {
             if (env->cr[4] & CR4_LA57_MASK) {
-                mem_info_la57(mon, env);
+                mem_info_la57(mon, env, as);
             } else {
-                mem_info_la48(mon, env);
+                mem_info_la48(mon, env, as);
             }
         } else
 #endif
         {
-            mem_info_pae32(mon, env);
+            mem_info_pae32(mon, env, as);
         }
     } else {
-        mem_info_32(mon, env);
+        mem_info_32(mon, env, as);
     }
 }
 

From 17db4d61d148aa87b84907e3aa6bee95d29955a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 05:02:10 +0200
Subject: [PATCH 1341/2396] target/i386/monitor: Replace legacy
 cpu_physical_memory_read() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Replace:

 - cpu_physical_memory_read(len=4) -> address_space_ldl()
 - cpu_physical_memory_read(len=8) -> address_space_ldq()

inlining the little endianness conversion via the '_le' suffix.
As with the previous implementation, ignore whether the memory
read succeeded or failed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20251002145742.75624-3-philmd@linaro.org>
---
 target/i386/monitor.c | 96 ++++++++++++++++++++-----------------------
 1 file changed, 44 insertions(+), 52 deletions(-)

diff --git a/target/i386/monitor.c b/target/i386/monitor.c
index 7e7854e6c1..d2bb873d49 100644
--- a/target/i386/monitor.c
+++ b/target/i386/monitor.c
@@ -30,6 +30,7 @@
 #include "qobject/qdict.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-misc.h"
+#include "system/memory.h"
 
 /* Perform linear address sign extension */
 static hwaddr addr_canonical(CPUArchState *env, hwaddr addr)
@@ -70,21 +71,21 @@ static void print_pte(Monitor *mon, CPUArchState *env, hwaddr addr,
 
 static void tlb_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     unsigned int l1, l2;
     uint32_t pgd, pde, pte;
 
     pgd = env->cr[3] & ~0xfff;
     for(l1 = 0; l1 < 1024; l1++) {
-        cpu_physical_memory_read(pgd + l1 * 4, &pde, 4);
-        pde = le32_to_cpu(pde);
+        pde = address_space_ldl_le(as, pgd + l1 * 4, attrs, NULL);
         if (pde & PG_PRESENT_MASK) {
             if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
                 /* 4M pages */
                 print_pte(mon, env, (l1 << 22), pde, ~((1 << 21) - 1));
             } else {
                 for(l2 = 0; l2 < 1024; l2++) {
-                    cpu_physical_memory_read((pde & ~0xfff) + l2 * 4, &pte, 4);
-                    pte = le32_to_cpu(pte);
+                    pte = address_space_ldl_le(as, (pde & ~0xfff) + l2 * 4,
+                                               attrs, NULL);
                     if (pte & PG_PRESENT_MASK) {
                         print_pte(mon, env, (l1 << 22) + (l2 << 12),
                                   pte & ~PG_PSE_MASK,
@@ -98,19 +99,18 @@ static void tlb_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
 static void tlb_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     unsigned int l1, l2, l3;
     uint64_t pdpe, pde, pte;
     uint64_t pdp_addr, pd_addr, pt_addr;
 
     pdp_addr = env->cr[3] & ~0x1f;
     for (l1 = 0; l1 < 4; l1++) {
-        cpu_physical_memory_read(pdp_addr + l1 * 8, &pdpe, 8);
-        pdpe = le64_to_cpu(pdpe);
+        pdpe = address_space_ldq_le(as, pdp_addr + l1 * 8, attrs, NULL);
         if (pdpe & PG_PRESENT_MASK) {
             pd_addr = pdpe & 0x3fffffffff000ULL;
             for (l2 = 0; l2 < 512; l2++) {
-                cpu_physical_memory_read(pd_addr + l2 * 8, &pde, 8);
-                pde = le64_to_cpu(pde);
+                pde = address_space_ldq_le(as, pd_addr + l2 * 8, attrs, NULL);
                 if (pde & PG_PRESENT_MASK) {
                     if (pde & PG_PSE_MASK) {
                         /* 2M pages with PAE, CR4.PSE is ignored */
@@ -119,8 +119,8 @@ static void tlb_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
                     } else {
                         pt_addr = pde & 0x3fffffffff000ULL;
                         for (l3 = 0; l3 < 512; l3++) {
-                            cpu_physical_memory_read(pt_addr + l3 * 8, &pte, 8);
-                            pte = le64_to_cpu(pte);
+                            pte = address_space_ldq_le(as, pt_addr + l3 * 8,
+                                                       attrs, NULL);
                             if (pte & PG_PRESENT_MASK) {
                                 print_pte(mon, env, (l1 << 30) + (l2 << 21)
                                           + (l3 << 12),
@@ -139,21 +139,20 @@ static void tlb_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 static void tlb_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as,
         uint64_t l0, uint64_t pml4_addr)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     uint64_t l1, l2, l3, l4;
     uint64_t pml4e, pdpe, pde, pte;
     uint64_t pdp_addr, pd_addr, pt_addr;
 
     for (l1 = 0; l1 < 512; l1++) {
-        cpu_physical_memory_read(pml4_addr + l1 * 8, &pml4e, 8);
-        pml4e = le64_to_cpu(pml4e);
+        pml4e = address_space_ldq_le(as, pml4_addr + l1 * 8, attrs, NULL);
         if (!(pml4e & PG_PRESENT_MASK)) {
             continue;
         }
 
         pdp_addr = pml4e & 0x3fffffffff000ULL;
         for (l2 = 0; l2 < 512; l2++) {
-            cpu_physical_memory_read(pdp_addr + l2 * 8, &pdpe, 8);
-            pdpe = le64_to_cpu(pdpe);
+            pdpe = address_space_ldq_le(as, pdp_addr + l2 * 8, attrs, NULL);
             if (!(pdpe & PG_PRESENT_MASK)) {
                 continue;
             }
@@ -167,8 +166,7 @@ static void tlb_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as,
 
             pd_addr = pdpe & 0x3fffffffff000ULL;
             for (l3 = 0; l3 < 512; l3++) {
-                cpu_physical_memory_read(pd_addr + l3 * 8, &pde, 8);
-                pde = le64_to_cpu(pde);
+                pde = address_space_ldq_le(as, pd_addr + l3 * 8, attrs, NULL);
                 if (!(pde & PG_PRESENT_MASK)) {
                     continue;
                 }
@@ -182,10 +180,8 @@ static void tlb_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as,
 
                 pt_addr = pde & 0x3fffffffff000ULL;
                 for (l4 = 0; l4 < 512; l4++) {
-                    cpu_physical_memory_read(pt_addr
-                            + l4 * 8,
-                            &pte, 8);
-                    pte = le64_to_cpu(pte);
+                    pte = address_space_ldq_le(as, pt_addr + l4 * 8,
+                                               attrs, NULL);
                     if (pte & PG_PRESENT_MASK) {
                         print_pte(mon, env, (l0 << 48) + (l1 << 39) +
                                 (l2 << 30) + (l3 << 21) + (l4 << 12),
@@ -199,14 +195,14 @@ static void tlb_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as,
 
 static void tlb_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     uint64_t l0;
     uint64_t pml5e;
     uint64_t pml5_addr;
 
     pml5_addr = env->cr[3] & 0x3fffffffff000ULL;
     for (l0 = 0; l0 < 512; l0++) {
-        cpu_physical_memory_read(pml5_addr + l0 * 8, &pml5e, 8);
-        pml5e = le64_to_cpu(pml5e);
+        pml5e = address_space_ldq_le(as, pml5_addr + l0 * 8, attrs, NULL);
         if (pml5e & PG_PRESENT_MASK) {
             tlb_info_la48(mon, env, as, l0, pml5e & 0x3fffffffff000ULL);
         }
@@ -275,6 +271,7 @@ static void mem_print(Monitor *mon, CPUArchState *env,
 
 static void mem_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     unsigned int l1, l2;
     int prot, last_prot;
     uint32_t pgd, pde, pte;
@@ -284,8 +281,7 @@ static void mem_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
     last_prot = 0;
     start = -1;
     for(l1 = 0; l1 < 1024; l1++) {
-        cpu_physical_memory_read(pgd + l1 * 4, &pde, 4);
-        pde = le32_to_cpu(pde);
+        pde = address_space_ldl_le(as, pgd + l1 * 4, attrs, NULL);
         end = l1 << 22;
         if (pde & PG_PRESENT_MASK) {
             if ((pde & PG_PSE_MASK) && (env->cr[4] & CR4_PSE_MASK)) {
@@ -293,8 +289,8 @@ static void mem_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
                 mem_print(mon, env, &start, &last_prot, end, prot);
             } else {
                 for(l2 = 0; l2 < 1024; l2++) {
-                    cpu_physical_memory_read((pde & ~0xfff) + l2 * 4, &pte, 4);
-                    pte = le32_to_cpu(pte);
+                    pte = address_space_ldl_le(as, (pde & ~0xfff) + l2 * 4,
+                                               attrs, NULL);
                     end = (l1 << 22) + (l2 << 12);
                     if (pte & PG_PRESENT_MASK) {
                         prot = pte & pde &
@@ -316,6 +312,7 @@ static void mem_info_32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
 static void mem_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     unsigned int l1, l2, l3;
     int prot, last_prot;
     uint64_t pdpe, pde, pte;
@@ -326,14 +323,12 @@ static void mem_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
     last_prot = 0;
     start = -1;
     for (l1 = 0; l1 < 4; l1++) {
-        cpu_physical_memory_read(pdp_addr + l1 * 8, &pdpe, 8);
-        pdpe = le64_to_cpu(pdpe);
+        pdpe = address_space_ldq_le(as, pdp_addr + l1 * 8, attrs, NULL);
         end = l1 << 30;
         if (pdpe & PG_PRESENT_MASK) {
             pd_addr = pdpe & 0x3fffffffff000ULL;
             for (l2 = 0; l2 < 512; l2++) {
-                cpu_physical_memory_read(pd_addr + l2 * 8, &pde, 8);
-                pde = le64_to_cpu(pde);
+                pde = address_space_ldq_le(as, pd_addr + l2 * 8, attrs, NULL);
                 end = (l1 << 30) + (l2 << 21);
                 if (pde & PG_PRESENT_MASK) {
                     if (pde & PG_PSE_MASK) {
@@ -343,8 +338,8 @@ static void mem_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
                     } else {
                         pt_addr = pde & 0x3fffffffff000ULL;
                         for (l3 = 0; l3 < 512; l3++) {
-                            cpu_physical_memory_read(pt_addr + l3 * 8, &pte, 8);
-                            pte = le64_to_cpu(pte);
+                            pte = address_space_ldq_le(as, pt_addr + l3 * 8,
+                                                       attrs, NULL);
                             end = (l1 << 30) + (l2 << 21) + (l3 << 12);
                             if (pte & PG_PRESENT_MASK) {
                                 prot = pte & pde & (PG_USER_MASK | PG_RW_MASK |
@@ -373,6 +368,7 @@ static void mem_info_pae32(Monitor *mon, CPUArchState *env, AddressSpace *as)
 #ifdef TARGET_X86_64
 static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     int prot, last_prot;
     uint64_t l1, l2, l3, l4;
     uint64_t pml4e, pdpe, pde, pte;
@@ -382,14 +378,12 @@ static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
     last_prot = 0;
     start = -1;
     for (l1 = 0; l1 < 512; l1++) {
-        cpu_physical_memory_read(pml4_addr + l1 * 8, &pml4e, 8);
-        pml4e = le64_to_cpu(pml4e);
+        pml4e = address_space_ldq_le(as, pml4_addr + l1 * 8, attrs, NULL);
         end = l1 << 39;
         if (pml4e & PG_PRESENT_MASK) {
             pdp_addr = pml4e & 0x3fffffffff000ULL;
             for (l2 = 0; l2 < 512; l2++) {
-                cpu_physical_memory_read(pdp_addr + l2 * 8, &pdpe, 8);
-                pdpe = le64_to_cpu(pdpe);
+                pdpe = address_space_ldq_le(as, pdp_addr + l2 * 8, attrs, NULL);
                 end = (l1 << 39) + (l2 << 30);
                 if (pdpe & PG_PRESENT_MASK) {
                     if (pdpe & PG_PSE_MASK) {
@@ -400,8 +394,8 @@ static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
                     } else {
                         pd_addr = pdpe & 0x3fffffffff000ULL;
                         for (l3 = 0; l3 < 512; l3++) {
-                            cpu_physical_memory_read(pd_addr + l3 * 8, &pde, 8);
-                            pde = le64_to_cpu(pde);
+                            pde = address_space_ldq_le(as, pd_addr + l3 * 8,
+                                                       attrs, NULL);
                             end = (l1 << 39) + (l2 << 30) + (l3 << 21);
                             if (pde & PG_PRESENT_MASK) {
                                 if (pde & PG_PSE_MASK) {
@@ -413,10 +407,10 @@ static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
                                 } else {
                                     pt_addr = pde & 0x3fffffffff000ULL;
                                     for (l4 = 0; l4 < 512; l4++) {
-                                        cpu_physical_memory_read(pt_addr
-                                                                 + l4 * 8,
-                                                                 &pte, 8);
-                                        pte = le64_to_cpu(pte);
+                                        pte = address_space_ldq_le(as,
+                                                                   pt_addr
+                                                                   + l4 * 8,
+                                                                   attrs, NULL);
                                         end = (l1 << 39) + (l2 << 30) +
                                             (l3 << 21) + (l4 << 12);
                                         if (pte & PG_PRESENT_MASK) {
@@ -453,6 +447,7 @@ static void mem_info_la48(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
 static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     int prot, last_prot;
     uint64_t l0, l1, l2, l3, l4;
     uint64_t pml5e, pml4e, pdpe, pde, pte;
@@ -462,8 +457,7 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
     last_prot = 0;
     start = -1;
     for (l0 = 0; l0 < 512; l0++) {
-        cpu_physical_memory_read(pml5_addr + l0 * 8, &pml5e, 8);
-        pml5e = le64_to_cpu(pml5e);
+        pml5e = address_space_ldq_le(as, pml5_addr + l0 * 8, attrs, NULL);
         end = l0 << 48;
         if (!(pml5e & PG_PRESENT_MASK)) {
             prot = 0;
@@ -473,8 +467,7 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
         pml4_addr = pml5e & 0x3fffffffff000ULL;
         for (l1 = 0; l1 < 512; l1++) {
-            cpu_physical_memory_read(pml4_addr + l1 * 8, &pml4e, 8);
-            pml4e = le64_to_cpu(pml4e);
+            pml4e = address_space_ldq_le(as, pml4_addr + l1 * 8, attrs, NULL);
             end = (l0 << 48) + (l1 << 39);
             if (!(pml4e & PG_PRESENT_MASK)) {
                 prot = 0;
@@ -484,8 +477,7 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
             pdp_addr = pml4e & 0x3fffffffff000ULL;
             for (l2 = 0; l2 < 512; l2++) {
-                cpu_physical_memory_read(pdp_addr + l2 * 8, &pdpe, 8);
-                pdpe = le64_to_cpu(pdpe);
+                pdpe = address_space_ldq_le(as, pdp_addr + l2 * 8, attrs, NULL);
                 end = (l0 << 48) + (l1 << 39) + (l2 << 30);
                 if (pdpe & PG_PRESENT_MASK) {
                     prot = 0;
@@ -503,8 +495,8 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
                 pd_addr = pdpe & 0x3fffffffff000ULL;
                 for (l3 = 0; l3 < 512; l3++) {
-                    cpu_physical_memory_read(pd_addr + l3 * 8, &pde, 8);
-                    pde = le64_to_cpu(pde);
+                    pde = address_space_ldq_le(as, pd_addr + l3 * 8,
+                                               attrs, NULL);
                     end = (l0 << 48) + (l1 << 39) + (l2 << 30) + (l3 << 21);
                     if (pde & PG_PRESENT_MASK) {
                         prot = 0;
@@ -522,8 +514,8 @@ static void mem_info_la57(Monitor *mon, CPUArchState *env, AddressSpace *as)
 
                     pt_addr = pde & 0x3fffffffff000ULL;
                     for (l4 = 0; l4 < 512; l4++) {
-                        cpu_physical_memory_read(pt_addr + l4 * 8, &pte, 8);
-                        pte = le64_to_cpu(pte);
+                        pte = address_space_ldq_le(as, pt_addr + l4 * 8,
+                                                   attrs, NULL);
                         end = (l0 << 48) + (l1 << 39) + (l2 << 30) +
                             (l3 << 21) + (l4 << 12);
                         if (pte & PG_PRESENT_MASK) {

From e9f173cd51b8b0a877553ab77bed879f09afd61e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 12:59:15 +0200
Subject: [PATCH 1342/2396] target/hppa: Use hwaddr type for HPPATLBEntry::pa
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

HPPATLBEntry::@pa is a physical address, use the appropriate type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-2-philmd@linaro.org>
---
 target/hppa/cpu.h        | 2 +-
 target/hppa/trace-events | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 672ab3750c..869a75876e 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -187,7 +187,7 @@ typedef struct HPPATLBEntry {
         struct HPPATLBEntry *unused_next;
     };
 
-    target_ulong pa;
+    hwaddr pa;
 
     unsigned entry_valid : 1;
 
diff --git a/target/hppa/trace-events b/target/hppa/trace-events
index a10ba73d5d..01761a4559 100644
--- a/target/hppa/trace-events
+++ b/target/hppa/trace-events
@@ -1,13 +1,13 @@
 # See docs/devel/tracing.rst for syntax documentation.
 
 # mem_helper.c
-disable hppa_tlb_flush_ent(void *env, void *ent, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p va_b=0x%lx va_e=0x%lx pa=0x%lx"
-disable hppa_tlb_find_entry(void *env, void *ent, int valid, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p valid=%d va_b=0x%lx va_e=0x%lx pa=0x%lx"
+disable hppa_tlb_flush_ent(void *env, void *ent, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p va_b=0x%lx va_e=0x%lx pa=0x%" PRIx64
+disable hppa_tlb_find_entry(void *env, void *ent, int valid, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p valid=%d va_b=0x%lx va_e=0x%lx pa=0x%" PRIx64
 disable hppa_tlb_find_entry_not_found(void *env, uint64_t addr) "env=%p addr=%08lx"
 disable hppa_tlb_get_physical_address(void *env, int ret, int prot, uint64_t addr, uint64_t phys) "env=%p ret=%d prot=%d addr=0x%lx phys=0x%lx"
 disable hppa_tlb_fill_excp(void *env, uint64_t addr, int size, int type, int mmu_idx) "env=%p addr=0x%lx size=%d type=%d mmu_idx=%d"
 disable hppa_tlb_fill_success(void *env, uint64_t addr, uint64_t phys, int size, int type, int mmu_idx) "env=%p addr=0x%lx phys=0x%lx size=%d type=%d mmu_idx=%d"
-disable hppa_tlb_itlba(void *env, void *ent, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p va_b=0x%lx va_e=0x%lx pa=0x%lx"
+disable hppa_tlb_itlba(void *env, void *ent, uint64_t va_b, uint64_t va_e, uint64_t pa) "env=%p ent=%p va_b=0x%lx va_e=0x%lx pa=0x%" PRIx64
 disable hppa_tlb_itlbp(void *env, void *ent, int access_id, int u, int pl2, int pl1, int type, int b, int d, int t) "env=%p ent=%p access_id=%x u=%d pl2=%d pl1=%d type=%d b=%d d=%d t=%d"
 disable hppa_tlb_ptlb(void *env) "env=%p"
 disable hppa_tlb_ptlb_local(void *env) "env=%p"

From 4fe2763a904a16197b5de5375e6779b81d363d03 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 15:30:56 +0200
Subject: [PATCH 1343/2396] target/hppa: Have hppa_form_gva*() return vaddr
 type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Return a 'vaddr' type for "guest virtual address".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-3-philmd@linaro.org>
---
 target/hppa/cpu.h        | 8 ++++----
 target/hppa/helper.c     | 4 ++--
 target/hppa/mem_helper.c | 2 +-
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/hppa/cpu.h b/target/hppa/cpu.h
index 869a75876e..c652ef945a 100644
--- a/target/hppa/cpu.h
+++ b/target/hppa/cpu.h
@@ -320,8 +320,8 @@ void hppa_translate_code(CPUState *cs, TranslationBlock *tb,
 
 #define CPU_RESOLVING_TYPE TYPE_HPPA_CPU
 
-static inline target_ulong hppa_form_gva_mask(uint64_t gva_offset_mask,
-                                        uint64_t spc, target_ulong off)
+static inline vaddr hppa_form_gva_mask(uint64_t gva_offset_mask,
+                                       uint64_t spc, target_ulong off)
 {
 #ifdef CONFIG_USER_ONLY
     return off & gva_offset_mask;
@@ -330,8 +330,8 @@ static inline target_ulong hppa_form_gva_mask(uint64_t gva_offset_mask,
 #endif
 }
 
-static inline target_ulong hppa_form_gva(CPUHPPAState *env, uint64_t spc,
-                                         target_ulong off)
+static inline vaddr hppa_form_gva(CPUHPPAState *env, uint64_t spc,
+                                  target_ulong off)
 {
     return hppa_form_gva_mask(env->gva_offset_mask, spc, off);
 }
diff --git a/target/hppa/helper.c b/target/hppa/helper.c
index d7f8495d98..edcd2bf27c 100644
--- a/target/hppa/helper.c
+++ b/target/hppa/helper.c
@@ -148,8 +148,8 @@ void hppa_cpu_dump_state(CPUState *cs, FILE *f, int flags)
         m = UINT32_MAX;
     }
 
-    qemu_fprintf(f, "IA_F %08" PRIx64 ":%0*" PRIx64 " (" TARGET_FMT_lx ")\n"
-                    "IA_B %08" PRIx64 ":%0*" PRIx64 " (" TARGET_FMT_lx ")\n",
+    qemu_fprintf(f, "IA_F %08" PRIx64 ":%0*" PRIx64 " (0x%" VADDR_PRIx ")\n"
+                    "IA_B %08" PRIx64 ":%0*" PRIx64 " (0x%" VADDR_PRIx ")\n",
                  env->iasq_f >> 32, w, m & env->iaoq_f,
                  hppa_form_gva_mask(env->gva_offset_mask, env->iasq_f,
 				    env->iaoq_f),
diff --git a/target/hppa/mem_helper.c b/target/hppa/mem_helper.c
index 9bdd0a6f23..cce82e6599 100644
--- a/target/hppa/mem_helper.c
+++ b/target/hppa/mem_helper.c
@@ -803,7 +803,7 @@ void HELPER(diag_btlb)(CPUHPPAState *env)
 
 uint64_t HELPER(b_gate_priv)(CPUHPPAState *env, uint64_t iaoq_f)
 {
-    uint64_t gva = hppa_form_gva(env, env->iasq_f, iaoq_f);
+    vaddr gva = hppa_form_gva(env, env->iasq_f, iaoq_f);
     HPPATLBEntry *ent = hppa_find_tlb(env, gva);
 
     if (ent == NULL) {

From 714dd08fed17b4c091bd59d46b61e923552a7358 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:25:06 +0200
Subject: [PATCH 1344/2396] target/hppa: Explode MO_TExx -> MO_TE | MO_xx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the implicit MO_TE definition in order to replace
it in a commits.

Mechanical change using:

  $ for n in UW UL UQ UO SW SL SQ; do \
      sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
           $(git grep -l MO_TE$n target/openrisc); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-4-philmd@linaro.org>
---
 target/hppa/translate.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 7a81cfcb88..859c6cf5f9 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1691,7 +1691,7 @@ static bool do_floadw(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = tcg_temp_new_i32();
-    do_load_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TEUL);
+    do_load_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UL);
     save_frw_i32(rt, tmp);
 
     if (rt == 0) {
@@ -1716,7 +1716,7 @@ static bool do_floadd(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = tcg_temp_new_i64();
-    do_load_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TEUQ);
+    do_load_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UQ);
     save_frd(rt, tmp);
 
     if (rt == 0) {
@@ -1750,7 +1750,7 @@ static bool do_fstorew(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = load_frw_i32(rt);
-    do_store_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TEUL);
+    do_store_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UL);
 
     return nullify_end(ctx);
 }
@@ -1770,7 +1770,7 @@ static bool do_fstored(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = load_frd(rt);
-    do_store_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TEUQ);
+    do_store_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UQ);
 
     return nullify_end(ctx);
 }

From 4eef4dab502f555c4609bcd3606ea076544d5c90 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:31:19 +0200
Subject: [PATCH 1345/2396] target/hppa: Conceal MO_TE within do_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-5-philmd@linaro.org>
---
 target/hppa/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 859c6cf5f9..ee0c874342 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1676,7 +1676,7 @@ static bool do_load(DisasContext *ctx, unsigned rt, unsigned rb,
         /* Make sure if RT == RB, we see the result of the load.  */
         dest = tcg_temp_new_i64();
     }
-    do_load_64(ctx, dest, rb, rx, scale, disp, sp, modify, mop);
+    do_load_64(ctx, dest, rb, rx, scale, disp, sp, modify, MO_TE | mop);
     save_gpr(ctx, rt, dest);
 
     return nullify_end(ctx);
@@ -3302,7 +3302,7 @@ static bool trans_ld(DisasContext *ctx, arg_ldst *a)
         return gen_illegal(ctx);
     }
     return do_load(ctx, a->t, a->b, a->x, a->scale ? a->size : 0,
-                   a->disp, a->sp, a->m, a->size | MO_TE);
+                   a->disp, a->sp, a->m, a->size);
 }
 
 static bool trans_st(DisasContext *ctx, arg_ldst *a)

From e3da43671179afb09e55b4ba3d0352b4276dc4cb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:32:21 +0200
Subject: [PATCH 1346/2396] target/hppa: Conceal MO_TE within do_load_32/64()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-6-philmd@linaro.org>
---
 target/hppa/translate.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index ee0c874342..4680d82634 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1599,6 +1599,7 @@ static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
+    mop |= MO_TE;
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_ld_i32(dest, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1617,6 +1618,7 @@ static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
+    mop |= MO_TE;
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_ld_i64(dest, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1676,7 +1678,7 @@ static bool do_load(DisasContext *ctx, unsigned rt, unsigned rb,
         /* Make sure if RT == RB, we see the result of the load.  */
         dest = tcg_temp_new_i64();
     }
-    do_load_64(ctx, dest, rb, rx, scale, disp, sp, modify, MO_TE | mop);
+    do_load_64(ctx, dest, rb, rx, scale, disp, sp, modify, mop);
     save_gpr(ctx, rt, dest);
 
     return nullify_end(ctx);
@@ -1691,7 +1693,7 @@ static bool do_floadw(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = tcg_temp_new_i32();
-    do_load_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UL);
+    do_load_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_UL);
     save_frw_i32(rt, tmp);
 
     if (rt == 0) {
@@ -1716,7 +1718,7 @@ static bool do_floadd(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = tcg_temp_new_i64();
-    do_load_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UQ);
+    do_load_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_UQ);
     save_frd(rt, tmp);
 
     if (rt == 0) {

From 0807994a0cca7ee512975523ecaef4926a5632f9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:28:14 +0200
Subject: [PATCH 1347/2396] target/hppa: Conceal MO_TE within do_store()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-7-philmd@linaro.org>
---
 target/hppa/translate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 4680d82634..3f78bb2a76 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1739,7 +1739,7 @@ static bool do_store(DisasContext *ctx, unsigned rt, unsigned rb,
                      int modify, MemOp mop)
 {
     nullify_over(ctx);
-    do_store_64(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, mop);
+    do_store_64(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, MO_TE | mop);
     return nullify_end(ctx);
 }
 
@@ -3313,7 +3313,7 @@ static bool trans_st(DisasContext *ctx, arg_ldst *a)
     if (!ctx->is_pa20 && a->size > MO_32) {
         return gen_illegal(ctx);
     }
-    return do_store(ctx, a->t, a->b, a->disp, a->sp, a->m, a->size | MO_TE);
+    return do_store(ctx, a->t, a->b, a->disp, a->sp, a->m, a->size);
 }
 
 static bool trans_ldc(DisasContext *ctx, arg_ldst *a)

From 64d1c178513c77172d4917fa03e3a9c332050c73 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:30:04 +0200
Subject: [PATCH 1348/2396] target/hppa: Conceal MO_TE within do_store_32/64()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-8-philmd@linaro.org>
---
 target/hppa/translate.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 3f78bb2a76..92071affe4 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -1637,6 +1637,7 @@ static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
+    mop |= MO_TE;
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_st_i32(src, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1655,6 +1656,7 @@ static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
+    mop |= MO_TE;
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_st_i64(src, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1739,7 +1741,7 @@ static bool do_store(DisasContext *ctx, unsigned rt, unsigned rb,
                      int modify, MemOp mop)
 {
     nullify_over(ctx);
-    do_store_64(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, MO_TE | mop);
+    do_store_64(ctx, load_gpr(ctx, rt), rb, 0, 0, disp, sp, modify, mop);
     return nullify_end(ctx);
 }
 
@@ -1752,7 +1754,7 @@ static bool do_fstorew(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = load_frw_i32(rt);
-    do_store_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UL);
+    do_store_32(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_UL);
 
     return nullify_end(ctx);
 }
@@ -1772,7 +1774,7 @@ static bool do_fstored(DisasContext *ctx, unsigned rt, unsigned rb,
     nullify_over(ctx);
 
     tmp = load_frd(rt);
-    do_store_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_TE | MO_UQ);
+    do_store_64(ctx, tmp, rb, rx, scale, disp, sp, modify, MO_UQ);
 
     return nullify_end(ctx);
 }

From 6c1c734f786f8279c3b0c4bf57063bc79cc5c828 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 11:45:27 +0200
Subject: [PATCH 1349/2396] target/hppa: Introduce mo_endian() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mo_endian() returns the target endianness.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-9-philmd@linaro.org>
---
 target/hppa/translate.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 92071affe4..6fec63cb43 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -104,6 +104,11 @@ typedef struct DisasContext {
 #define MMU_DISABLED(C)  MMU_IDX_MMU_DISABLED((C)->mmu_idx)
 #endif
 
+static inline MemOp mo_endian(DisasContext *ctx)
+{
+    return MO_TE;
+}
+
 /* Note that ssm/rsm instructions number PSW_W and PSW_E differently.  */
 static int expand_sm_imm(DisasContext *ctx, int val)
 {
@@ -1599,7 +1604,7 @@ static void do_load_32(DisasContext *ctx, TCGv_i32 dest, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_ld_i32(dest, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1618,7 +1623,7 @@ static void do_load_64(DisasContext *ctx, TCGv_i64 dest, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_ld_i64(dest, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1637,7 +1642,7 @@ static void do_store_32(DisasContext *ctx, TCGv_i32 src, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_st_i32(src, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -1656,7 +1661,7 @@ static void do_store_64(DisasContext *ctx, TCGv_i64 src, unsigned rb,
     /* Caller uses nullify_over/nullify_end.  */
     assert(ctx->null_cond.c == TCG_COND_NEVER);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     form_gva(ctx, &addr, &ofs, rb, rx, scale, disp, sp, modify,
              MMU_DISABLED(ctx));
     tcg_gen_qemu_st_i64(src, addr, ctx->mmu_idx, mop | UNALIGN(ctx));
@@ -3320,7 +3325,7 @@ static bool trans_st(DisasContext *ctx, arg_ldst *a)
 
 static bool trans_ldc(DisasContext *ctx, arg_ldst *a)
 {
-    MemOp mop = MO_TE | MO_ALIGN | a->size;
+    MemOp mop = mo_endian(ctx) | MO_ALIGN | a->size;
     TCGv_i64 dest, ofs;
     TCGv_i64 addr;
 

From 7307ff955818d9e4eec2b155e501e360acf6eaf9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Mar 2025 14:31:49 +0100
Subject: [PATCH 1350/2396] target/hppa: Replace MO_TE -> MO_BE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only build the PA-RISC targets using big endianness order:

  $ git grep TARGET_BIG_ENDIAN configs/targets/hppa-*
  configs/targets/hppa-linux-user.mak:5:TARGET_BIG_ENDIAN=y
  configs/targets/hppa-softmmu.mak:2:TARGET_BIG_ENDIAN=y

Therefore the MO_TE definition always expands to MO_BE. Use the
latter to simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009101040.18378-10-philmd@linaro.org>
---
 target/hppa/translate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/hppa/translate.c b/target/hppa/translate.c
index 6fec63cb43..853cba2ba4 100644
--- a/target/hppa/translate.c
+++ b/target/hppa/translate.c
@@ -106,7 +106,8 @@ typedef struct DisasContext {
 
 static inline MemOp mo_endian(DisasContext *ctx)
 {
-    return MO_TE;
+   /* The PSW_E bit sets the (little) endianness, but we don't implement it. */
+   return MO_BE;
 }
 
 /* Note that ssm/rsm instructions number PSW_W and PSW_E differently.  */

From cea82f8cdd07697a48ae1c4e026707463f432a45 Mon Sep 17 00:00:00 2001
From: Gabriel Brookman <brookmangabriel@gmail.com>
Date: Thu, 9 Oct 2025 16:51:11 -0400
Subject: [PATCH 1351/2396] target/hppa: correct size bit parity for fmpyadd
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For the fmpyadd instruction on the hppa architecture, there is a bit
used to specify whether the instruction is operating on a 32 bit or
64 bit floating point register. For most instructions, such a bit is 0
when operating on the smaller register and 1 when operating on the
larger register. However, according to page 6-57 of the PA-RISC 1.1
Architecture and Instruction Set Reference Manual, this convention is
reversed for the fmpyadd instruction specifically, meaning the bit is
1 for operations on 32 bit registers and 0 for 64 bit registers. See
also page 6-18 (fig. 6-8) and 6-19 (table 6-16), where the f field
for FMPYADD and FMPYSUB is documented. Previously, QEMU decoded this
operation as operating on the other size of register, leading to bugs
when translating the fmpyadd instruction. This patch fixes that issue.

Reported-by: Andreas Hüttel <andreas.huettel@ur.de>
Signed-off-by: Gabriel Brookman <brookmangabriel@gmail.com>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3096
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Helge Deller <deller@gmx.de>
Message-ID: <20251009-hppa-correct-fmpyadd-size-bit-decoding-v1-1-f63bb6c3290c@gmail.com>
[PMD: Add documentation refs mentioned by Andreas K. Huettel]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/insns.decode | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/hppa/insns.decode b/target/hppa/insns.decode
index 4eaac750ea..13c6a55bf2 100644
--- a/target/hppa/insns.decode
+++ b/target/hppa/insns.decode
@@ -365,10 +365,10 @@ fstd            011100 ..... ..... .. ............1.    @ldstim11
 &mpyadd         rm1 rm2 ta ra tm
 @mpyadd         ...... rm1:5 rm2:5 ta:5 ra:5 . tm:5     &mpyadd
 
-fmpyadd_f       000110 ..... ..... ..... ..... 0 .....  @mpyadd
-fmpyadd_d       000110 ..... ..... ..... ..... 1 .....  @mpyadd
-fmpysub_f       100110 ..... ..... ..... ..... 0 .....  @mpyadd
-fmpysub_d       100110 ..... ..... ..... ..... 1 .....  @mpyadd
+fmpyadd_f       000110 ..... ..... ..... ..... 1 .....  @mpyadd
+fmpyadd_d       000110 ..... ..... ..... ..... 0 .....  @mpyadd
+fmpysub_f       100110 ..... ..... ..... ..... 1 .....  @mpyadd
+fmpysub_d       100110 ..... ..... ..... ..... 0 .....  @mpyadd
 
 ####
 # Conditional Branches

From 108773e700075a6dab8e4ae8d1330f6dfccba1d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 02:39:45 +0200
Subject: [PATCH 1352/2396] target/loongarch: Replace VMSTATE_UINTTL() ->
 VMSTATE_UINT64()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All LoongArchCPU::pc and LoongArchCPU::gpr[] fields are of
uint64_t type. Use the appropriate VMSTATE_UINT64() macro.

There is no functional change (the migration stream is not
modified), because the LoongArch targets are only built as 64-bit:

  $ git grep TARGET_LONG_BITS configs/targets/loongarch64*
  configs/targets/loongarch64-linux-user.mak:7:TARGET_LONG_BITS=64
  configs/targets/loongarch64-softmmu.mak:7:TARGET_LONG_BITS=64

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20250925004327.58764-1-philmd@linaro.org>
---
 target/loongarch/machine.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/machine.c b/target/loongarch/machine.c
index 73190fb367..0366a50763 100644
--- a/target/loongarch/machine.c
+++ b/target/loongarch/machine.c
@@ -191,8 +191,8 @@ const VMStateDescription vmstate_loongarch_cpu = {
     .version_id = 4,
     .minimum_version_id = 4,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINTTL_ARRAY(env.gpr, LoongArchCPU, 32),
-        VMSTATE_UINTTL(env.pc, LoongArchCPU),
+        VMSTATE_UINT64_ARRAY(env.gpr, LoongArchCPU, 32),
+        VMSTATE_UINT64(env.pc, LoongArchCPU),
 
         /* Remaining CSRs */
         VMSTATE_UINT64(env.CSR_CRMD, LoongArchCPU),

From 656940971f253412a565da9f21cf6f05a284c3d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:14:50 +0200
Subject: [PATCH 1353/2396] target/loongarch: Remove target_ulong use in
 gen_goto_tb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

translator_use_goto_tb() expects a vaddr type since commit
b1c09220b4c ("accel/tcg: Replace target_ulong with vaddr in
translator*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20251009201947.34643-3-philmd@linaro.org>
---
 target/loongarch/tcg/translate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/translate.c b/target/loongarch/tcg/translate.c
index 57c3b8c4bb..055f6fb604 100644
--- a/target/loongarch/tcg/translate.c
+++ b/target/loongarch/tcg/translate.c
@@ -99,8 +99,7 @@ void generate_exception(DisasContext *ctx, int excp)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
-                        target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx, vaddr dest)
 {
     if (ctx->va32) {
         dest = (uint32_t) dest;

From 7f306758fb83f1b64d02647171d5f65fc157ac25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:15:23 +0200
Subject: [PATCH 1354/2396] target/loongarch: Remove target_ulong use in
 gdb_write_register handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ldq_le_p() returns a uint64_t type, big enough to also hold
ldl_le_p() return value. If we were building for a 32-bit
LoongArch target, ldq_le_p() would not fit in target_ulong.
Better stick to plain uint64_t.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20251009201947.34643-4-philmd@linaro.org>
---
 target/loongarch/gdbstub.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/loongarch/gdbstub.c b/target/loongarch/gdbstub.c
index 471eda28c7..23a5eecc20 100644
--- a/target/loongarch/gdbstub.c
+++ b/target/loongarch/gdbstub.c
@@ -62,7 +62,7 @@ int loongarch_cpu_gdb_read_register(CPUState *cs, GByteArray *mem_buf, int n)
 int loongarch_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 {
     CPULoongArchState *env = cpu_env(cs);
-    target_ulong tmp;
+    uint64_t tmp;
     int length = 0;
 
     if (n < 0 || n > 34) {

From f756b7745a16a20815449099004076e3587e0448 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:15:13 +0200
Subject: [PATCH 1355/2396] target/loongarch: Do not use target_ulong type for
 LDDIR level
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The LDDIR level page table is a 5-bit immediate. Using the
uint32_t type for it is sufficient. Avoid the target_ulong type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-Id: <20251009201947.34643-5-philmd@linaro.org>
---
 target/loongarch/cpu-mmu.h                             | 2 +-
 target/loongarch/cpu_helper.c                          | 2 +-
 target/loongarch/tcg/helper.h                          | 2 +-
 target/loongarch/tcg/insn_trans/trans_privileged.c.inc | 2 +-
 target/loongarch/tcg/tlb_helper.c                      | 4 ++--
 5 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index 0068d22efc..dbc69c7c0f 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -34,7 +34,7 @@ TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug);
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
-                               uint64_t *dir_width, target_ulong level);
+                        uint64_t *dir_width, unsigned int level);
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
 
 #endif  /* LOONGARCH_CPU_MMU_H */
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 4a9db3ea4c..867e7c8867 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -17,7 +17,7 @@
 #include "tcg/tcg_loongarch.h"
 
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
-                        uint64_t *dir_width, target_ulong level)
+                        uint64_t *dir_width, unsigned int level)
 {
     switch (level) {
     case 1:
diff --git a/target/loongarch/tcg/helper.h b/target/loongarch/tcg/helper.h
index db57dbfc16..7e508c5a7b 100644
--- a/target/loongarch/tcg/helper.h
+++ b/target/loongarch/tcg/helper.h
@@ -129,7 +129,7 @@ DEF_HELPER_2(invtlb_all_asid, void, env, tl)
 DEF_HELPER_3(invtlb_page_asid, void, env, tl, tl)
 DEF_HELPER_3(invtlb_page_asid_or_g, void, env, tl, tl)
 
-DEF_HELPER_4(lddir, tl, env, tl, tl, i32)
+DEF_HELPER_4(lddir, tl, env, tl, i32, i32)
 DEF_HELPER_4(ldpte, void, env, tl, tl, i32)
 DEF_HELPER_1(ertn, void, env)
 DEF_HELPER_1(idle, void, env)
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index a407ab51b7..64e53a4460 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -380,7 +380,7 @@ static bool trans_lddir(DisasContext *ctx, arg_lddir *a)
     if (check_plv(ctx)) {
         return false;
     }
-    gen_helper_lddir(dest, tcg_env, src, tcg_constant_tl(a->imm), mem_idx);
+    gen_helper_lddir(dest, tcg_env, src, tcg_constant_i32(a->imm), mem_idx);
     return true;
 }
 
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index f1d183cb64..e119f78d92 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -599,7 +599,7 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 }
 
 target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
-                          target_ulong level, uint32_t mem_idx)
+                          uint32_t level, uint32_t mem_idx)
 {
     CPUState *cs = env_cpu(env);
     target_ulong badvaddr, index, phys;
@@ -607,7 +607,7 @@ target_ulong helper_lddir(CPULoongArchState *env, target_ulong base,
 
     if (unlikely((level == 0) || (level > 4))) {
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "Attepted LDDIR with level %"PRId64"\n", level);
+                      "Attepted LDDIR with level %u\n", level);
         return base;
     }
 

From eefee97c4ca386ff82691417846fd252d90d978e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 26 Aug 2025 06:43:19 +0200
Subject: [PATCH 1356/2396] target/m68k: Remove unused @cpu_exception_index
 TCGv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When moving the @exception_index from each target ArchCPU
to the global CPUState in commit 27103424c40 ("cpu: Move
exception_index field from CPU_COMMON to CPUState"), the
@cpu_exception_index TCGv has been created for m68k target.

For years, no code ever used this register. Simply remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250924171308.53036-1-philmd@linaro.org>
---
 target/m68k/translate.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index 97afceb129..0cee54f490 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -45,7 +45,6 @@
 #undef DEFO64
 
 static TCGv_i32 cpu_halted;
-static TCGv_i32 cpu_exception_index;
 
 static char cpu_reg_names[2 * 8 * 3 + 5 * 4];
 static TCGv cpu_dregs[8];
@@ -81,11 +80,6 @@ void m68k_tcg_init(void)
     cpu_halted = tcg_global_mem_new_i32(tcg_env,
                                         -offsetof(M68kCPU, env) +
                                         offsetof(CPUState, halted), "HALTED");
-    cpu_exception_index = tcg_global_mem_new_i32(tcg_env,
-                                                 -offsetof(M68kCPU, env) +
-                                                 offsetof(CPUState, exception_index),
-                                                 "EXCEPTION");
-
     p = cpu_reg_names;
     for (i = 0; i < 8; i++) {
         sprintf(p, "D%d", i);

From cb4ca3b358660646db62c256f360598e92c65b97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 26 Aug 2025 06:42:05 +0200
Subject: [PATCH 1357/2396] target/m68k: Remove pointless @cpu_halted TCGv
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoid registering a TCGv to write the generic CPUState::halted
field. Access it directly via @env in both STOP / HALT opcodes.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250925012454.60602-1-philmd@linaro.org>
---
 target/m68k/translate.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/m68k/translate.c b/target/m68k/translate.c
index 0cee54f490..eb1ba15074 100644
--- a/target/m68k/translate.c
+++ b/target/m68k/translate.c
@@ -44,8 +44,6 @@
 #undef DEFO32
 #undef DEFO64
 
-static TCGv_i32 cpu_halted;
-
 static char cpu_reg_names[2 * 8 * 3 + 5 * 4];
 static TCGv cpu_dregs[8];
 static TCGv cpu_aregs[8];
@@ -77,9 +75,6 @@ void m68k_tcg_init(void)
 #undef DEFO32
 #undef DEFO64
 
-    cpu_halted = tcg_global_mem_new_i32(tcg_env,
-                                        -offsetof(M68kCPU, env) +
-                                        offsetof(CPUState, halted), "HALTED");
     p = cpu_reg_names;
     for (i = 0; i < 8; i++) {
         sprintf(p, "D%d", i);
@@ -4506,7 +4501,8 @@ DISAS_INSN(halt)
         gen_exception(s, s->pc, EXCP_SEMIHOSTING);
         return;
     }
-    tcg_gen_movi_i32(cpu_halted, 1);
+    tcg_gen_st_i32(tcg_constant_i32(1), tcg_env,
+                   offsetof(CPUState, halted) - offsetof(M68kCPU, env));
     gen_exception(s, s->pc, EXCP_HLT);
 }
 
@@ -4522,7 +4518,8 @@ DISAS_INSN(stop)
     ext = read_im16(env, s);
 
     gen_set_sr_im(s, ext, 0);
-    tcg_gen_movi_i32(cpu_halted, 1);
+    tcg_gen_st_i32(tcg_constant_i32(1), tcg_env,
+                   offsetof(CPUState, halted) - offsetof(M68kCPU, env));
     gen_exception(s, s->pc, EXCP_HLT);
 }
 

From 1f097e46a38ed3b699dcac56c8adf6113c9278b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:35:19 +0200
Subject: [PATCH 1358/2396] target/microblaze: Remove target_ulong use in
 cpu_handle_mmu_fault()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_handle_mmu_fault() -- renamed in commit f429d607c71 -- expects
a vaddr type for its address argument since commit 7510454e3e7
("cpu: Turn cpu_handle_mmu_fault() into a CPUClass hook").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-2-philmd@linaro.org>
---
 target/microblaze/mmu.c | 4 ++--
 target/microblaze/mmu.h | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/microblaze/mmu.c b/target/microblaze/mmu.c
index 8703ff5c65..db24cb399c 100644
--- a/target/microblaze/mmu.c
+++ b/target/microblaze/mmu.c
@@ -78,7 +78,7 @@ static void mmu_change_pid(CPUMBState *env, unsigned int newpid)
 
 /* rw - 0 = read, 1 = write, 2 = fetch.  */
 unsigned int mmu_translate(MicroBlazeCPU *cpu, MicroBlazeMMULookup *lu,
-                           target_ulong vaddr, MMUAccessType rw, int mmu_idx)
+                           vaddr vaddr, MMUAccessType rw, int mmu_idx)
 {
     MicroBlazeMMU *mmu = &cpu->env.mmu;
     unsigned int i, hit = 0;
@@ -172,7 +172,7 @@ unsigned int mmu_translate(MicroBlazeCPU *cpu, MicroBlazeMMULookup *lu,
     }
 done:
     qemu_log_mask(CPU_LOG_MMU,
-                  "MMU vaddr=0x" TARGET_FMT_lx
+                  "MMU vaddr=0x%" VADDR_PRIx
                   " rw=%d tlb_wr=%d tlb_ex=%d hit=%d\n",
                   vaddr, rw, tlb_wr, tlb_ex, hit);
     return hit;
diff --git a/target/microblaze/mmu.h b/target/microblaze/mmu.h
index 1068bd2d52..2aca39c923 100644
--- a/target/microblaze/mmu.h
+++ b/target/microblaze/mmu.h
@@ -86,7 +86,7 @@ typedef struct {
 } MicroBlazeMMULookup;
 
 unsigned int mmu_translate(MicroBlazeCPU *cpu, MicroBlazeMMULookup *lu,
-                           target_ulong vaddr, MMUAccessType rw, int mmu_idx);
+                           vaddr vaddr, MMUAccessType rw, int mmu_idx);
 uint32_t mmu_read(CPUMBState *env, bool ea, uint32_t rn);
 void mmu_write(CPUMBState *env, bool ea, uint32_t rn, uint32_t v);
 void mmu_init(MicroBlazeMMU *mmu);

From 0651ea17e89903789d11dc601dc5ecd7c8e810c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:36:32 +0200
Subject: [PATCH 1359/2396] target/microblaze: Remove target_ulong uses in
 get_phys_page_attrs_debug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CPUClass::get_phys_page_debug() handler takes a 'vaddr' address
and return a 'hwaddr' type since commit 00b941e581b ("cpu: Turn
cpu_get_phys_page_debug() into a CPUClass hook").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-3-philmd@linaro.org>
---
 target/microblaze/helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index ef0e2f973f..cf577a7226 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -274,7 +274,8 @@ hwaddr mb_cpu_get_phys_page_attrs_debug(CPUState *cs, vaddr addr,
                                         MemTxAttrs *attrs)
 {
     MicroBlazeCPU *cpu = MICROBLAZE_CPU(cs);
-    target_ulong vaddr, paddr = 0;
+    vaddr vaddr;
+    hwaddr paddr = 0;
     MicroBlazeMMULookup lu;
     int mmu_idx = cpu_mmu_index(cs, false);
     unsigned int hit;

From dc693a4a88a4c02b490378a7dc05c8e83f59cf97 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:42:24 +0200
Subject: [PATCH 1360/2396] target/microblaze: Remove target_ulong use in
 gen_goto_tb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

translator_use_goto_tb() expects a vaddr type since commit
b1c09220b4c ("accel/tcg: Replace target_ulong with vaddr in
translator_*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-4-philmd@linaro.org>
---
 target/microblaze/translate.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 3dd74b021e..b93a40fedb 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -116,8 +116,7 @@ static void gen_raise_hw_excp(DisasContext *dc, uint32_t esr_ec)
     gen_raise_exception_sync(dc, EXCP_HW_EXCP);
 }
 
-static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx,
-                        target_ulong dest)
+static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 {
     if (translator_use_goto_tb(&dc->base, dest)) {
         tcg_gen_goto_tb(tb_slot_idx);

From 92035b7b0dd9fd40527a58479c9865a6dce104b9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:56:49 +0200
Subject: [PATCH 1361/2396] target/microblaze: Remove target_ulong use in
 helper_stackprot()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 36a9529e60e ("target/microblaze: Simplify
compute_ldst_addr_type{a,b}"), helper_stackprot() takes
a TCGv_i32 argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-5-philmd@linaro.org>
---
 target/microblaze/helper.h    | 2 +-
 target/microblaze/op_helper.c | 4 ++--
 target/microblaze/translate.c | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/microblaze/helper.h b/target/microblaze/helper.h
index ef4fad9b91..01eba592b2 100644
--- a/target/microblaze/helper.h
+++ b/target/microblaze/helper.h
@@ -20,7 +20,7 @@ DEF_HELPER_FLAGS_3(fcmp_ne, TCG_CALL_NO_WG, i32, env, i32, i32)
 DEF_HELPER_FLAGS_3(fcmp_ge, TCG_CALL_NO_WG, i32, env, i32, i32)
 
 DEF_HELPER_FLAGS_2(pcmpbf, TCG_CALL_NO_RWG_SE, i32, i32, i32)
-DEF_HELPER_FLAGS_2(stackprot, TCG_CALL_NO_WG, void, env, tl)
+DEF_HELPER_FLAGS_2(stackprot, TCG_CALL_NO_WG, void, env, i32)
 DEF_HELPER_FLAGS_2(get, TCG_CALL_NO_RWG, i32, i32, i32)
 DEF_HELPER_FLAGS_3(put, TCG_CALL_NO_RWG, void, i32, i32, i32)
 
diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index b8365b3b1d..df93c4229d 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -365,13 +365,13 @@ uint32_t helper_pcmpbf(uint32_t a, uint32_t b)
     return 0;
 }
 
-void helper_stackprot(CPUMBState *env, target_ulong addr)
+void helper_stackprot(CPUMBState *env, uint32_t addr)
 {
     if (addr < env->slr || addr > env->shr) {
         CPUState *cs = env_cpu(env);
 
         qemu_log_mask(CPU_LOG_INT, "Stack protector violation at "
-                      TARGET_FMT_lx " %x %x\n",
+                                   "0x%x 0x%x 0x%x\n",
                       addr, env->slr, env->shr);
 
         env->ear = addr;
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index b93a40fedb..994e1d5cef 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -606,7 +606,7 @@ DO_TYPEBI(xori, false, tcg_gen_xori_i32)
 
 static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
 {
-    TCGv ret;
+    TCGv_i32 ret;
 
     /* If any of the regs is r0, set t to the value of the other reg.  */
     if (ra && rb) {
@@ -628,7 +628,7 @@ static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
 
 static TCGv compute_ldst_addr_typeb(DisasContext *dc, int ra, int imm)
 {
-    TCGv ret;
+    TCGv_i32 ret;
 
     /* If any of the regs is r0, set t to the value of the other reg.  */
     if (ra && imm) {

From 1bf79694bc09995e805bb017515ef3cd5720fd04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 15 Oct 2025 19:33:39 +0200
Subject: [PATCH 1362/2396] target/microblaze: Have compute_ldst_addr_type[ab]
 return TCGv_i32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both compute_ldst_addr_typea() and compute_ldst_addr_typeb()
bodies use a TCGv_i32, so return the same type.

Suggested-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-6-philmd@linaro.org>
---
 target/microblaze/translate.c | 48 +++++++++++++++++------------------
 1 file changed, 24 insertions(+), 24 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 994e1d5cef..1554b9e67b 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -604,7 +604,7 @@ static bool trans_wdic(DisasContext *dc, arg_wdic *a)
 DO_TYPEA(xor, false, tcg_gen_xor_i32)
 DO_TYPEBI(xori, false, tcg_gen_xori_i32)
 
-static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
+static TCGv_i32 compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
 {
     TCGv_i32 ret;
 
@@ -626,7 +626,7 @@ static TCGv compute_ldst_addr_typea(DisasContext *dc, int ra, int rb)
     return ret;
 }
 
-static TCGv compute_ldst_addr_typeb(DisasContext *dc, int ra, int imm)
+static TCGv_i32 compute_ldst_addr_typeb(DisasContext *dc, int ra, int imm)
 {
     TCGv_i32 ret;
 
@@ -750,13 +750,13 @@ static bool do_load(DisasContext *dc, int rd, TCGv addr, MemOp mop,
 
 static bool trans_lbu(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UB, dc->mem_index, false);
 }
 
 static bool trans_lbur(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UB, dc->mem_index, true);
 }
 
@@ -776,19 +776,19 @@ static bool trans_lbuea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_lbui(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_load(dc, arg->rd, addr, MO_UB, dc->mem_index, false);
 }
 
 static bool trans_lhu(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UW, dc->mem_index, false);
 }
 
 static bool trans_lhur(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UW, dc->mem_index, true);
 }
 
@@ -810,19 +810,19 @@ static bool trans_lhuea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_lhui(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_load(dc, arg->rd, addr, MO_UW, dc->mem_index, false);
 }
 
 static bool trans_lw(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UL, dc->mem_index, false);
 }
 
 static bool trans_lwr(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_load(dc, arg->rd, addr, MO_UL, dc->mem_index, true);
 }
 
@@ -844,16 +844,16 @@ static bool trans_lwea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_lwi(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_load(dc, arg->rd, addr, MO_UL, dc->mem_index, false);
 }
 
 static bool trans_lwx(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
 
     /* lwx does not throw unaligned access errors, so force alignment */
-    tcg_gen_andi_tl(addr, addr, ~3);
+    tcg_gen_andi_i32(addr, addr, ~3);
 
     tcg_gen_qemu_ld_i32(cpu_res_val, addr, dc->mem_index,
                         mo_endian(dc) | MO_UL);
@@ -910,13 +910,13 @@ static bool do_store(DisasContext *dc, int rd, TCGv addr, MemOp mop,
 
 static bool trans_sb(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UB, dc->mem_index, false);
 }
 
 static bool trans_sbr(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UB, dc->mem_index, true);
 }
 
@@ -936,19 +936,19 @@ static bool trans_sbea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_sbi(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_store(dc, arg->rd, addr, MO_UB, dc->mem_index, false);
 }
 
 static bool trans_sh(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UW, dc->mem_index, false);
 }
 
 static bool trans_shr(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UW, dc->mem_index, true);
 }
 
@@ -970,19 +970,19 @@ static bool trans_shea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_shi(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_store(dc, arg->rd, addr, MO_UW, dc->mem_index, false);
 }
 
 static bool trans_sw(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UL, dc->mem_index, false);
 }
 
 static bool trans_swr(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     return do_store(dc, arg->rd, addr, MO_UL, dc->mem_index, true);
 }
 
@@ -1004,19 +1004,19 @@ static bool trans_swea(DisasContext *dc, arg_typea *arg)
 
 static bool trans_swi(DisasContext *dc, arg_typeb *arg)
 {
-    TCGv addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
+    TCGv_i32 addr = compute_ldst_addr_typeb(dc, arg->ra, arg->imm);
     return do_store(dc, arg->rd, addr, MO_UL, dc->mem_index, false);
 }
 
 static bool trans_swx(DisasContext *dc, arg_typea *arg)
 {
-    TCGv addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
+    TCGv_i32 addr = compute_ldst_addr_typea(dc, arg->ra, arg->rb);
     TCGLabel *swx_done = gen_new_label();
     TCGLabel *swx_fail = gen_new_label();
     TCGv_i32 tval;
 
     /* swx does not throw unaligned access errors, so force alignment */
-    tcg_gen_andi_tl(addr, addr, ~3);
+    tcg_gen_andi_i32(addr, addr, ~3);
 
     /*
      * Compare the address vs the one we used during lwx.

From 2c12ba4d8bdd309359d1072594f5a317e09da78b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 15 Oct 2025 19:34:49 +0200
Subject: [PATCH 1363/2396] target/microblaze: Have do_load/store() take a
 TCGv_i32 address argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of do_load() and do_store() pass a TCGv_i32 address
type, have both functions take a TCGv_i32.

Suggested-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-7-philmd@linaro.org>
---
 target/microblaze/translate.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 1554b9e67b..ed53848bad 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -708,7 +708,7 @@ static inline MemOp mo_endian(DisasContext *dc)
     return dc->cfg->endi ? MO_LE : MO_BE;
 }
 
-static bool do_load(DisasContext *dc, int rd, TCGv addr, MemOp mop,
+static bool do_load(DisasContext *dc, int rd, TCGv_i32 addr, MemOp mop,
                     int mem_index, bool rev)
 {
     MemOp size = mop & MO_SIZE;
@@ -726,7 +726,7 @@ static bool do_load(DisasContext *dc, int rd, TCGv addr, MemOp mop,
             mop ^= MO_BSWAP;
         }
         if (size < MO_32) {
-            tcg_gen_xori_tl(addr, addr, 3 - size);
+            tcg_gen_xori_i32(addr, addr, 3 - size);
         }
     }
 
@@ -868,7 +868,7 @@ static bool trans_lwx(DisasContext *dc, arg_typea *arg)
     return true;
 }
 
-static bool do_store(DisasContext *dc, int rd, TCGv addr, MemOp mop,
+static bool do_store(DisasContext *dc, int rd, TCGv_i32 addr, MemOp mop,
                      int mem_index, bool rev)
 {
     MemOp size = mop & MO_SIZE;
@@ -886,7 +886,7 @@ static bool do_store(DisasContext *dc, int rd, TCGv addr, MemOp mop,
             mop ^= MO_BSWAP;
         }
         if (size < MO_32) {
-            tcg_gen_xori_tl(addr, addr, 3 - size);
+            tcg_gen_xori_i32(addr, addr, 3 - size);
         }
     }
 

From 5dfe024f9e2d97bb5b2e8f7bd520e8a55e39a725 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:58:51 +0200
Subject: [PATCH 1364/2396] target/microblaze: Convert CPUMBState::res_addr
 field to uint32_t type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPUMBState::@res_addr field is used as u32 since commit
cfeea807e5a ("target-microblaze: Tighten up TCGv_i32 vs
TCGv type usage"). Convert it as such, bumping the migration
version. Use the RES_ADDR_NONE definition when appropriate.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251015180115.97493-8-philmd@linaro.org>
---
 target/microblaze/cpu.h       |  2 +-
 target/microblaze/machine.c   |  6 +++---
 target/microblaze/translate.c | 17 +++++++++--------
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 3ce28b302f..14b107876a 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -259,7 +259,7 @@ struct CPUArchState {
 
     /* lwx/swx reserved address */
 #define RES_ADDR_NONE 0xffffffff /* Use 0xffffffff to indicate no reservation */
-    target_ulong res_addr;
+    uint32_t res_addr;
     uint32_t res_val;
 
     /* Internal flags.  */
diff --git a/target/microblaze/machine.c b/target/microblaze/machine.c
index a4cf38dc89..48efa546d3 100644
--- a/target/microblaze/machine.c
+++ b/target/microblaze/machine.c
@@ -78,7 +78,7 @@ static const VMStateField vmstate_env_fields[] = {
     VMSTATE_UINT32(iflags, CPUMBState),
 
     VMSTATE_UINT32(res_val, CPUMBState),
-    VMSTATE_UINTTL(res_addr, CPUMBState),
+    VMSTATE_UINT32(res_addr, CPUMBState),
 
     VMSTATE_STRUCT(mmu, CPUMBState, 0, vmstate_mmu, MicroBlazeMMU),
 
@@ -87,8 +87,8 @@ static const VMStateField vmstate_env_fields[] = {
 
 static const VMStateDescription vmstate_env = {
     .name = "env",
-    .version_id = 0,
-    .minimum_version_id = 0,
+    .version_id = 1,
+    .minimum_version_id = 1,
     .fields = vmstate_env_fields,
 };
 
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index ed53848bad..6442a250c5 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -55,7 +55,7 @@ static TCGv_i32 cpu_imm;
 static TCGv_i32 cpu_bvalue;
 static TCGv_i32 cpu_btarget;
 static TCGv_i32 cpu_iflags;
-static TCGv cpu_res_addr;
+static TCGv_i32 cpu_res_addr;
 static TCGv_i32 cpu_res_val;
 
 /* This is the state at translation time.  */
@@ -857,7 +857,7 @@ static bool trans_lwx(DisasContext *dc, arg_typea *arg)
 
     tcg_gen_qemu_ld_i32(cpu_res_val, addr, dc->mem_index,
                         mo_endian(dc) | MO_UL);
-    tcg_gen_mov_tl(cpu_res_addr, addr);
+    tcg_gen_mov_i32(cpu_res_addr, addr);
 
     if (arg->rd) {
         tcg_gen_mov_i32(cpu_R[arg->rd], cpu_res_val);
@@ -1024,7 +1024,7 @@ static bool trans_swx(DisasContext *dc, arg_typea *arg)
      * branch, but we know we can use the equal version in the global.
      * In either case, addr is no longer needed.
      */
-    tcg_gen_brcond_tl(TCG_COND_NE, cpu_res_addr, addr, swx_fail);
+    tcg_gen_brcond_i32(TCG_COND_NE, cpu_res_addr, addr, swx_fail);
 
     /*
      * Compare the value loaded during lwx with current contents of
@@ -1052,7 +1052,7 @@ static bool trans_swx(DisasContext *dc, arg_typea *arg)
      * Prevent the saved address from working again without another ldx.
      * Akin to the pseudocode setting reservation = 0.
      */
-    tcg_gen_movi_tl(cpu_res_addr, -1);
+    tcg_gen_movi_i32(cpu_res_addr, RES_ADDR_NONE);
     return true;
 }
 
@@ -1173,7 +1173,7 @@ static bool trans_brk(DisasContext *dc, arg_typea_br *arg)
         tcg_gen_movi_i32(cpu_R[arg->rd], dc->base.pc_next);
     }
     tcg_gen_ori_i32(cpu_msr, cpu_msr, MSR_BIP);
-    tcg_gen_movi_tl(cpu_res_addr, -1);
+    tcg_gen_movi_i32(cpu_res_addr, RES_ADDR_NONE);
 
     dc->base.is_jmp = DISAS_EXIT;
     return true;
@@ -1194,7 +1194,7 @@ static bool trans_brki(DisasContext *dc, arg_typeb_br *arg)
     if (arg->rd) {
         tcg_gen_movi_i32(cpu_R[arg->rd], dc->base.pc_next);
     }
-    tcg_gen_movi_tl(cpu_res_addr, -1);
+    tcg_gen_movi_i32(cpu_res_addr, RES_ADDR_NONE);
 
 #ifdef CONFIG_USER_ONLY
     switch (imm) {
@@ -1885,6 +1885,7 @@ void mb_tcg_init(void)
           tcg_global_mem_new_i32(tcg_env, i32s[i].ofs, i32s[i].name);
     }
 
-    cpu_res_addr =
-        tcg_global_mem_new(tcg_env, offsetof(CPUMBState, res_addr), "res_addr");
+    cpu_res_addr = tcg_global_mem_new_i32(tcg_env,
+                                          offsetof(CPUMBState, res_addr),
+                                          "res_addr");
 }

From 2795bc52af4949aa7c7d900f897e5fc81c6c9b24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 02:46:47 +0200
Subject: [PATCH 1365/2396] target/openrisc: Replace VMSTATE_UINTTL() ->
 VMSTATE_UINT32()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both OpenRISCTLBEntry fields are of uint32_t type. Use the
appropriate VMSTATE_UINT32() macro.

There is no functional change (the migration stream is not
modified), because the OpenRISC targets are only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/or1k-*
  configs/targets/or1k-linux-user.mak:5:TARGET_LONG_BITS=32
  configs/targets/or1k-softmmu.mak:5:TARGET_LONG_BITS=32

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-2-philmd@linaro.org>
---
 target/openrisc/machine.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/openrisc/machine.c b/target/openrisc/machine.c
index 081c706d02..fa054e528b 100644
--- a/target/openrisc/machine.c
+++ b/target/openrisc/machine.c
@@ -26,8 +26,8 @@ static const VMStateDescription vmstate_tlb_entry = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINTTL(mr, OpenRISCTLBEntry),
-        VMSTATE_UINTTL(tr, OpenRISCTLBEntry),
+        VMSTATE_UINT32(mr, OpenRISCTLBEntry),
+        VMSTATE_UINT32(tr, OpenRISCTLBEntry),
         VMSTATE_END_OF_LIST()
     }
 };

From a3c4facd395b9d39996ed60d42b1f448d3f727cc Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 09:14:15 +0200
Subject: [PATCH 1366/2396] target/openrisc: Do not use target_ulong for @mr in
 MTSPR helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

OpenRISCTLBEntry::@mr field is a uint32_t type since its
introduction in commit 726fe045720 ("target-or32: Add MMU support").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-3-philmd@linaro.org>
---
 target/openrisc/sys_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index b091a9c668..ad59939db3 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -45,7 +45,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
     OpenRISCCPU *cpu = env_archcpu(env);
 #ifndef CONFIG_USER_ONLY
     CPUState *cs = env_cpu(env);
-    target_ulong mr;
+    uint32_t mr;
     int idx;
 #endif
 

From 1843e89bec5f8551a9a554aca9f51d76e6ae9493 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 09:06:05 +0200
Subject: [PATCH 1367/2396] target/openrisc: Remove unused
 cpu_openrisc_map_address_*() handlers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 23d45ebdb19 ("target/openrisc: Remove indirect
function calls for mmu") removed the last uses of both
cpu_openrisc_map_address_code() and
cpu_openrisc_map_address_data() helpers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-4-philmd@linaro.org>
---
 target/openrisc/cpu.h | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index f4bcf00b07..87201365a9 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -220,15 +220,6 @@ typedef struct OpenRISCTLBEntry {
 typedef struct CPUOpenRISCTLBContext {
     OpenRISCTLBEntry itlb[TLB_SIZE];
     OpenRISCTLBEntry dtlb[TLB_SIZE];
-
-    int (*cpu_openrisc_map_address_code)(OpenRISCCPU *cpu,
-                                         hwaddr *physical,
-                                         int *prot,
-                                         target_ulong address, int rw);
-    int (*cpu_openrisc_map_address_data)(OpenRISCCPU *cpu,
-                                         hwaddr *physical,
-                                         int *prot,
-                                         target_ulong address, int rw);
 } CPUOpenRISCTLBContext;
 #endif
 

From 2367c94cbb1876b789ff91f78fd7daf2c1d6fb93 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 09:06:25 +0200
Subject: [PATCH 1368/2396] target/openrisc: Remove target_ulong use in
 raise_mmu_exception()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TCGCPUOps::tlb_fill() handler provides a vaddr type (since commit
7510454e3e7 "cpu: Turn cpu_handle_mmu_fault() into a CPUClass hook").

Do not inline get_phys_nommu(), rely on the linker to optimize at
linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-5-philmd@linaro.org>
---
 target/openrisc/mmu.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/openrisc/mmu.c b/target/openrisc/mmu.c
index acea50c41e..ffb732e0d1 100644
--- a/target/openrisc/mmu.c
+++ b/target/openrisc/mmu.c
@@ -28,15 +28,14 @@
 #include "qemu/host-utils.h"
 #include "hw/loader.h"
 
-static inline void get_phys_nommu(hwaddr *phys_addr, int *prot,
-                                  target_ulong address)
+static void get_phys_nommu(hwaddr *phys_addr, int *prot, vaddr address)
 {
     *phys_addr = address;
     *prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
 }
 
 static int get_phys_mmu(OpenRISCCPU *cpu, hwaddr *phys_addr, int *prot,
-                        target_ulong addr, int need, bool super)
+                        vaddr addr, int need, bool super)
 {
     int idx = (addr >> TARGET_PAGE_BITS) & TLB_MASK;
     uint32_t imr = cpu->env.tlb.itlb[idx].mr;
@@ -95,7 +94,7 @@ static int get_phys_mmu(OpenRISCCPU *cpu, hwaddr *phys_addr, int *prot,
     }
 }
 
-static void raise_mmu_exception(OpenRISCCPU *cpu, target_ulong address,
+static void raise_mmu_exception(OpenRISCCPU *cpu, vaddr address,
                                 int exception)
 {
     CPUState *cs = CPU(cpu);

From 9dc4862dc4ae95f4f5b94052b95699a83e1d197c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 09:06:52 +0200
Subject: [PATCH 1369/2396] target/openrisc: Use vaddr type for $pc jumps
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

translator_use_goto_tb() expects a vaddr type since commit
b1c09220b4c ("accel/tcg: Replace target_ulong with vaddr in
translator_*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-6-philmd@linaro.org>
---
 target/openrisc/translate.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 5ab3bc7021..9f61f917b3 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -51,7 +51,7 @@ typedef struct DisasContext {
     uint32_t avr;
 
     /* If not -1, jmp_pc contains this value and so is a direct jump.  */
-    target_ulong jmp_pc_imm;
+    vaddr jmp_pc_imm;
 
     /* The temporary corresponding to register 0 for this compilation.  */
     TCGv R0;
@@ -580,7 +580,7 @@ static bool trans_l_muldu(DisasContext *dc, arg_ab *a)
 
 static bool trans_l_j(DisasContext *dc, arg_l_j *a)
 {
-    target_ulong tmp_pc = dc->base.pc_next + a->n * 4;
+    vaddr tmp_pc = dc->base.pc_next + a->n * 4;
 
     tcg_gen_movi_tl(jmp_pc, tmp_pc);
     dc->jmp_pc_imm = tmp_pc;
@@ -590,8 +590,8 @@ static bool trans_l_j(DisasContext *dc, arg_l_j *a)
 
 static bool trans_l_jal(DisasContext *dc, arg_l_jal *a)
 {
-    target_ulong tmp_pc = dc->base.pc_next + a->n * 4;
-    target_ulong ret_pc = dc->base.pc_next + 8;
+    vaddr tmp_pc = dc->base.pc_next + a->n * 4;
+    vaddr ret_pc = dc->base.pc_next + 8;
 
     tcg_gen_movi_tl(cpu_regs[9], ret_pc);
     /* Optimize jal being used to load the PC for PIC.  */
@@ -605,7 +605,7 @@ static bool trans_l_jal(DisasContext *dc, arg_l_jal *a)
 
 static void do_bf(DisasContext *dc, arg_l_bf *a, TCGCond cond)
 {
-    target_ulong tmp_pc = dc->base.pc_next + a->n * 4;
+    vaddr tmp_pc = dc->base.pc_next + a->n * 4;
     TCGv t_next = tcg_constant_tl(dc->base.pc_next + 8);
     TCGv t_true = tcg_constant_tl(tmp_pc);
 
@@ -1586,7 +1586,7 @@ static void openrisc_tr_translate_insn(DisasContextBase *dcbase, CPUState *cs)
 static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
-    target_ulong jmp_dest;
+    vaddr jmp_dest;
 
     /* If we have already exited the TB, nothing following has effect.  */
     if (dc->base.is_jmp == DISAS_NORETURN) {

From 81e2fb236b702c7e172b64be4fd11aacebe50e4c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 10:11:59 +0200
Subject: [PATCH 1370/2396] target/openrisc: Remove 'TARGET_LONG_BITS != 32'
 dead code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OpenRISC targets are only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/or1k-*
  configs/targets/or1k-linux-user.mak:5:TARGET_LONG_BITS=32
  configs/targets/or1k-softmmu.mak:5:TARGET_LONG_BITS=32

Remove the dead code guarded within TARGET_LONG_BITS != 32.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-7-philmd@linaro.org>
---
 target/openrisc/translate.c | 33 ++++-----------------------------
 1 file changed, 4 insertions(+), 29 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 9f61f917b3..29e6b51a93 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -298,19 +298,8 @@ static void gen_muld(DisasContext *dc, TCGv srca, TCGv srcb)
 
     tcg_gen_ext_tl_i64(t1, srca);
     tcg_gen_ext_tl_i64(t2, srcb);
-    if (TARGET_LONG_BITS == 32) {
-        tcg_gen_mul_i64(cpu_mac, t1, t2);
-        tcg_gen_movi_tl(cpu_sr_ov, 0);
-    } else {
-        TCGv_i64 high = tcg_temp_new_i64();
-
-        tcg_gen_muls2_i64(cpu_mac, high, t1, t2);
-        tcg_gen_sari_i64(t1, cpu_mac, 63);
-        tcg_gen_negsetcond_i64(TCG_COND_NE, t1, t1, high);
-        tcg_gen_trunc_i64_tl(cpu_sr_ov, t1);
-
-        gen_ove_ov(dc);
-    }
+    tcg_gen_mul_i64(cpu_mac, t1, t2);
+    tcg_gen_movi_tl(cpu_sr_ov, 0);
 }
 
 static void gen_muldu(DisasContext *dc, TCGv srca, TCGv srcb)
@@ -320,18 +309,8 @@ static void gen_muldu(DisasContext *dc, TCGv srca, TCGv srcb)
 
     tcg_gen_extu_tl_i64(t1, srca);
     tcg_gen_extu_tl_i64(t2, srcb);
-    if (TARGET_LONG_BITS == 32) {
-        tcg_gen_mul_i64(cpu_mac, t1, t2);
-        tcg_gen_movi_tl(cpu_sr_cy, 0);
-    } else {
-        TCGv_i64 high = tcg_temp_new_i64();
-
-        tcg_gen_mulu2_i64(cpu_mac, high, t1, t2);
-        tcg_gen_setcondi_i64(TCG_COND_NE, high, high, 0);
-        tcg_gen_trunc_i64_tl(cpu_sr_cy, high);
-
-        gen_ove_cy(dc);
-    }
+    tcg_gen_mul_i64(cpu_mac, t1, t2);
+    tcg_gen_movi_tl(cpu_sr_cy, 0);
 }
 
 static void gen_mac(DisasContext *dc, TCGv srca, TCGv srcb)
@@ -349,11 +328,7 @@ static void gen_mac(DisasContext *dc, TCGv srca, TCGv srcb)
     tcg_gen_xor_i64(t1, t1, cpu_mac);
     tcg_gen_andc_i64(t1, t1, t2);
 
-#if TARGET_LONG_BITS == 32
     tcg_gen_extrh_i64_i32(cpu_sr_ov, t1);
-#else
-    tcg_gen_mov_i64(cpu_sr_ov, t1);
-#endif
 
     gen_ove_ov(dc);
 }

From ef797ac00257ed31f534058fc43b8ae7c0019ea0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:19:50 +0100
Subject: [PATCH 1371/2396] target/openrisc: Explode MO_TExx -> MO_TE | MO_xx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the implicit MO_TE definition in order to replace
it in the next commit.

Mechanical change using:

  $ for n in UW UL UQ UO SW SL SQ; do \
      sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
           $(git grep -l MO_TE$n target/openrisc); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-8-philmd@linaro.org>
---
 target/openrisc/translate.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 29e6b51a93..52d51313f7 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -622,7 +622,7 @@ static bool trans_l_lwa(DisasContext *dc, arg_load *a)
     check_r0_write(dc, a->d);
     ea = tcg_temp_new();
     tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
-    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx, MO_TEUL);
+    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx, MO_TE | MO_UL);
     tcg_gen_mov_tl(cpu_lock_addr, ea);
     tcg_gen_mov_tl(cpu_lock_value, cpu_R(dc, a->d));
     return true;
@@ -640,13 +640,13 @@ static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 
 static bool trans_l_lwz(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TEUL);
+    do_load(dc, a, MO_TE | MO_UL);
     return true;
 }
 
 static bool trans_l_lws(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TESL);
+    do_load(dc, a, MO_TE | MO_SL);
     return true;
 }
 
@@ -664,13 +664,13 @@ static bool trans_l_lbs(DisasContext *dc, arg_load *a)
 
 static bool trans_l_lhz(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TEUW);
+    do_load(dc, a, MO_TE | MO_UW);
     return true;
 }
 
 static bool trans_l_lhs(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TESW);
+    do_load(dc, a, MO_TE | MO_SW);
     return true;
 }
 
@@ -688,7 +688,7 @@ static bool trans_l_swa(DisasContext *dc, arg_store *a)
 
     val = tcg_temp_new();
     tcg_gen_atomic_cmpxchg_tl(val, cpu_lock_addr, cpu_lock_value,
-                              cpu_R(dc, a->b), dc->mem_idx, MO_TEUL);
+                              cpu_R(dc, a->b), dc->mem_idx, MO_TE | MO_UL);
     tcg_gen_setcond_tl(TCG_COND_EQ, cpu_sr_f, val, cpu_lock_value);
 
     tcg_gen_br(lab_done);
@@ -710,7 +710,7 @@ static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
 
 static bool trans_l_sw(DisasContext *dc, arg_store *a)
 {
-    do_store(dc, a, MO_TEUL);
+    do_store(dc, a, MO_TE | MO_UL);
     return true;
 }
 
@@ -722,7 +722,7 @@ static bool trans_l_sb(DisasContext *dc, arg_store *a)
 
 static bool trans_l_sh(DisasContext *dc, arg_store *a)
 {
-    do_store(dc, a, MO_TEUW);
+    do_store(dc, a, MO_TE | MO_UW);
     return true;
 }
 

From 22c36c0a20ce7bccbfe61ff7ee676c7a0e6b7c51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:23:46 +0100
Subject: [PATCH 1372/2396] target/openrisc: Conceal MO_TE within do_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-9-philmd@linaro.org>
---
 target/openrisc/translate.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 52d51313f7..a6ba1747ec 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -632,6 +632,8 @@ static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 {
     TCGv ea;
 
+    mop |= MO_TE;
+
     check_r0_write(dc, a->d);
     ea = tcg_temp_new();
     tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
@@ -640,13 +642,13 @@ static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 
 static bool trans_l_lwz(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TE | MO_UL);
+    do_load(dc, a, MO_UL);
     return true;
 }
 
 static bool trans_l_lws(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TE | MO_SL);
+    do_load(dc, a, MO_SL);
     return true;
 }
 
@@ -664,13 +666,13 @@ static bool trans_l_lbs(DisasContext *dc, arg_load *a)
 
 static bool trans_l_lhz(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TE | MO_UW);
+    do_load(dc, a, MO_UW);
     return true;
 }
 
 static bool trans_l_lhs(DisasContext *dc, arg_load *a)
 {
-    do_load(dc, a, MO_TE | MO_SW);
+    do_load(dc, a, MO_SW);
     return true;
 }
 

From 2f737e19a4dbb72596c29656cec07f26198161d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:23:46 +0100
Subject: [PATCH 1373/2396] target/openrisc: Conceal MO_TE within do_store()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-10-philmd@linaro.org>
---
 target/openrisc/translate.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index a6ba1747ec..623513bb15 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -706,13 +706,16 @@ static bool trans_l_swa(DisasContext *dc, arg_store *a)
 static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
 {
     TCGv t0 = tcg_temp_new();
+
+    mop |= MO_TE;
+
     tcg_gen_addi_tl(t0, cpu_R(dc, a->a), a->i);
     tcg_gen_qemu_st_tl(cpu_R(dc, a->b), t0, dc->mem_idx, mop);
 }
 
 static bool trans_l_sw(DisasContext *dc, arg_store *a)
 {
-    do_store(dc, a, MO_TE | MO_UL);
+    do_store(dc, a, MO_UL);
     return true;
 }
 
@@ -724,7 +727,7 @@ static bool trans_l_sb(DisasContext *dc, arg_store *a)
 
 static bool trans_l_sh(DisasContext *dc, arg_store *a)
 {
-    do_store(dc, a, MO_TE | MO_UW);
+    do_store(dc, a, MO_UW);
     return true;
 }
 

From 73cd283e58d4a8f03ed8786e148ceedf676bee40 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:25:49 +0100
Subject: [PATCH 1374/2396] target/openrisc: Introduce mo_endian() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mo_endian() returns the target endianness.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-11-philmd@linaro.org>
---
 target/openrisc/translate.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 623513bb15..1a43e5ab6f 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -59,6 +59,11 @@ typedef struct DisasContext {
     TCGv zero;
 } DisasContext;
 
+static inline MemOp mo_endian(DisasContext *dc)
+{
+    return MO_TE;
+}
+
 static inline bool is_user(DisasContext *dc)
 {
 #ifdef CONFIG_USER_ONLY
@@ -622,7 +627,8 @@ static bool trans_l_lwa(DisasContext *dc, arg_load *a)
     check_r0_write(dc, a->d);
     ea = tcg_temp_new();
     tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
-    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx, MO_TE | MO_UL);
+    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx,
+                       mo_endian(dc) | MO_UL);
     tcg_gen_mov_tl(cpu_lock_addr, ea);
     tcg_gen_mov_tl(cpu_lock_value, cpu_R(dc, a->d));
     return true;
@@ -632,7 +638,7 @@ static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 {
     TCGv ea;
 
-    mop |= MO_TE;
+    mop |= mo_endian(dc);
 
     check_r0_write(dc, a->d);
     ea = tcg_temp_new();
@@ -690,7 +696,8 @@ static bool trans_l_swa(DisasContext *dc, arg_store *a)
 
     val = tcg_temp_new();
     tcg_gen_atomic_cmpxchg_tl(val, cpu_lock_addr, cpu_lock_value,
-                              cpu_R(dc, a->b), dc->mem_idx, MO_TE | MO_UL);
+                              cpu_R(dc, a->b), dc->mem_idx,
+                              mo_endian(dc) | MO_UL);
     tcg_gen_setcond_tl(TCG_COND_EQ, cpu_sr_f, val, cpu_lock_value);
 
     tcg_gen_br(lab_done);
@@ -707,7 +714,7 @@ static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
 {
     TCGv t0 = tcg_temp_new();
 
-    mop |= MO_TE;
+    mop |= mo_endian(dc);
 
     tcg_gen_addi_tl(t0, cpu_R(dc, a->a), a->i);
     tcg_gen_qemu_st_tl(cpu_R(dc, a->b), t0, dc->mem_idx, mop);

From 4f6c60683f2033dd9177ca0bf1299ffea1c07dd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Mar 2025 10:27:08 +0100
Subject: [PATCH 1375/2396] target/openrisc: Replace MO_TE -> MO_BE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only build the OpenRISC targets using big endianness order:

  $ git grep TARGET_BIG_ENDIAN configs/targets/or1k-*
  configs/targets/or1k-linux-user.mak:2:TARGET_BIG_ENDIAN=y
  configs/targets/or1k-softmmu.mak:2:TARGET_BIG_ENDIAN=y

Therefore the MO_TE definition always expands to MO_BE. Use the
latter to simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-12-philmd@linaro.org>
---
 target/openrisc/translate.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 1a43e5ab6f..3d9dfd663a 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -61,7 +61,8 @@ typedef struct DisasContext {
 
 static inline MemOp mo_endian(DisasContext *dc)
 {
-    return MO_TE;
+    /* The SR_LEE bit sets the (little) endianness, but we don't implement it. */
+    return MO_BE;
 }
 
 static inline bool is_user(DisasContext *dc)

From 500708331e3f0c856270c14d836c79fcc65bdfde Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 09:32:05 +0200
Subject: [PATCH 1376/2396] target/openrisc: Inline tcg_gen_trunc_i64_tl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OpenRISC targets are only built as 32-bit, so tcg_gen_trunc_i64_tl
expands to tcg_gen_extrl_i64_i32(). Use the latter to simplify the
next commit mechanical change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-13-philmd@linaro.org>
---
 target/openrisc/translate.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index 3d9dfd663a..beb4a546fd 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -351,7 +351,7 @@ static void gen_macu(DisasContext *dc, TCGv srca, TCGv srcb)
     /* Note that overflow is only computed during addition stage.  */
     tcg_gen_add_i64(cpu_mac, cpu_mac, t1);
     tcg_gen_setcond_i64(TCG_COND_LTU, t1, cpu_mac, t1);
-    tcg_gen_trunc_i64_tl(cpu_sr_cy, t1);
+    tcg_gen_extrl_i64_i32(cpu_sr_cy, t1);
 
     gen_ove_cy(dc);
 }
@@ -392,7 +392,7 @@ static void gen_msbu(DisasContext *dc, TCGv srca, TCGv srcb)
     /* Note that overflow is only computed during subtraction stage.  */
     tcg_gen_setcond_i64(TCG_COND_LTU, t2, cpu_mac, t1);
     tcg_gen_sub_i64(cpu_mac, cpu_mac, t1);
-    tcg_gen_trunc_i64_tl(cpu_sr_cy, t2);
+    tcg_gen_extrl_i64_i32(cpu_sr_cy, t2);
 
     gen_ove_cy(dc);
 }
@@ -917,7 +917,7 @@ static bool trans_l_movhi(DisasContext *dc, arg_l_movhi *a)
 static bool trans_l_macrc(DisasContext *dc, arg_l_macrc *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_trunc_i64_tl(cpu_R(dc, a->d), cpu_mac);
+    tcg_gen_extrl_i64_i32(cpu_R(dc, a->d), cpu_mac);
     tcg_gen_movi_i64(cpu_mac, 0);
     return true;
 }

From 5b67dbf1dc3caa6992576725a0783fa68fe6990c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 09:59:05 +0200
Subject: [PATCH 1377/2396] target/openrisc: Replace target_ulong -> uint32_t
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The OpenRISC targets are only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/or1k-*
  configs/targets/or1k-linux-user.mak:5:TARGET_LONG_BITS=32
  configs/targets/or1k-softmmu.mak:5:TARGET_LONG_BITS=32

Therefore target_ulong always expands to uint32_t. Replace and
adapt the API uses mechanically:

  target_ulong -> uint32_t
  target_long -> int32_t
  tl -> i32
  TCGv -> TCGv_i32
  tcg_temp_new -> tcg_temp_new_i32
  tcg_global_mem_new -> tcg_global_mem_new_i32
  VMSTATE_UINTTL -> VMSTATE_UINT32

There is no functional change (the migration stream is not modified).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010070702.51484-14-philmd@linaro.org>
---
 target/openrisc/cpu.h        |  22 +-
 target/openrisc/fpu_helper.c |   8 +-
 target/openrisc/helper.h     |   8 +-
 target/openrisc/machine.c    |  16 +-
 target/openrisc/sys_helper.c |   5 +-
 target/openrisc/translate.c  | 391 ++++++++++++++++++-----------------
 6 files changed, 228 insertions(+), 222 deletions(-)

diff --git a/target/openrisc/cpu.h b/target/openrisc/cpu.h
index 87201365a9..c8e2827930 100644
--- a/target/openrisc/cpu.h
+++ b/target/openrisc/cpu.h
@@ -224,20 +224,20 @@ typedef struct CPUOpenRISCTLBContext {
 #endif
 
 typedef struct CPUArchState {
-    target_ulong shadow_gpr[16][32]; /* Shadow registers */
+    uint32_t shadow_gpr[16][32]; /* Shadow registers */
 
-    target_ulong pc;          /* Program counter */
-    target_ulong ppc;         /* Prev PC */
-    target_ulong jmp_pc;      /* Jump PC */
+    uint32_t pc;              /* Program counter */
+    uint32_t ppc;             /* Prev PC */
+    uint32_t jmp_pc;          /* Jump PC */
 
     uint64_t mac;             /* Multiply registers MACHI:MACLO */
 
-    target_ulong epcr;        /* Exception PC register */
-    target_ulong eear;        /* Exception EA register */
+    uint32_t epcr;            /* Exception PC register */
+    uint32_t eear;            /* Exception EA register */
 
-    target_ulong sr_f;        /* the SR_F bit, values 0, 1.  */
-    target_ulong sr_cy;       /* the SR_CY bit, values 0, 1.  */
-    target_long  sr_ov;       /* the SR_OV bit (in the sign bit only) */
+    uint32_t sr_f;            /* the SR_F bit, values 0, 1.  */
+    uint32_t sr_cy;           /* the SR_CY bit, values 0, 1.  */
+    int32_t  sr_ov;           /* the SR_OV bit (in the sign bit only) */
     uint32_t sr;              /* Supervisor register, without SR_{F,CY,OV} */
     uint32_t esr;             /* Exception supervisor register */
     uint32_t evbar;           /* Exception vector base address register */
@@ -245,8 +245,8 @@ typedef struct CPUArchState {
     uint32_t fpcsr;           /* Float register */
     float_status fp_status;
 
-    target_ulong lock_addr;
-    target_ulong lock_value;
+    uint32_t lock_addr;
+    uint32_t lock_value;
 
     uint32_t dflag;           /* In delay slot (boolean) */
 
diff --git a/target/openrisc/fpu_helper.c b/target/openrisc/fpu_helper.c
index dba997255c..39b6195dd7 100644
--- a/target/openrisc/fpu_helper.c
+++ b/target/openrisc/fpu_helper.c
@@ -146,10 +146,10 @@ uint32_t helper_float_madd_s(CPUOpenRISCState *env, uint32_t a,
 
 
 #define FLOAT_CMP(name, impl)                                             \
-target_ulong helper_float_ ## name ## _d(CPUOpenRISCState *env,           \
+uint32_t helper_float_ ## name ## _d(CPUOpenRISCState *env,               \
                                          uint64_t fdt0, uint64_t fdt1)    \
 { return float64_ ## impl(fdt0, fdt1, &env->fp_status); }                 \
-target_ulong helper_float_ ## name ## _s(CPUOpenRISCState *env,           \
+uint32_t helper_float_ ## name ## _s(CPUOpenRISCState *env,               \
                                          uint32_t fdt0, uint32_t fdt1)    \
 { return float32_ ## impl(fdt0, fdt1, &env->fp_status); }
 
@@ -160,13 +160,13 @@ FLOAT_CMP(un, unordered_quiet)
 #undef FLOAT_CMP
 
 #define FLOAT_UCMP(name, expr) \
-target_ulong helper_float_ ## name ## _d(CPUOpenRISCState *env,           \
+uint32_t helper_float_ ## name ## _d(CPUOpenRISCState *env,               \
                                          uint64_t fdt0, uint64_t fdt1)    \
 {                                                                         \
     FloatRelation r = float64_compare_quiet(fdt0, fdt1, &env->fp_status); \
     return expr;                                                          \
 }                                                                         \
-target_ulong helper_float_ ## name ## _s(CPUOpenRISCState *env,           \
+uint32_t helper_float_ ## name ## _s(CPUOpenRISCState *env,               \
                                          uint32_t fdt0, uint32_t fdt1)    \
 {                                                                         \
     FloatRelation r = float32_compare_quiet(fdt0, fdt1, &env->fp_status); \
diff --git a/target/openrisc/helper.h b/target/openrisc/helper.h
index d847814a28..e0a8d40227 100644
--- a/target/openrisc/helper.h
+++ b/target/openrisc/helper.h
@@ -47,8 +47,8 @@ FOP_CALC(rem)
 #undef FOP_CALC
 
 #define FOP_CMP(op)                                              \
-DEF_HELPER_FLAGS_3(float_ ## op ## _s, TCG_CALL_NO_RWG, tl, env, i32, i32) \
-DEF_HELPER_FLAGS_3(float_ ## op ## _d, TCG_CALL_NO_RWG, tl, env, i64, i64)
+DEF_HELPER_FLAGS_3(float_ ## op ## _s, TCG_CALL_NO_RWG, i32, env, i32, i32) \
+DEF_HELPER_FLAGS_3(float_ ## op ## _d, TCG_CALL_NO_RWG, i32, env, i64, i64)
 FOP_CMP(eq)
 FOP_CMP(lt)
 FOP_CMP(le)
@@ -62,5 +62,5 @@ FOP_CMP(ult)
 DEF_HELPER_FLAGS_1(rfe, 0, void, env)
 
 /* sys */
-DEF_HELPER_FLAGS_3(mtspr, 0, void, env, tl, tl)
-DEF_HELPER_FLAGS_3(mfspr, TCG_CALL_NO_WG, tl, env, tl, tl)
+DEF_HELPER_FLAGS_3(mtspr, 0, void, env, i32, i32)
+DEF_HELPER_FLAGS_3(mfspr, TCG_CALL_NO_WG, i32, env, i32, i32)
diff --git a/target/openrisc/machine.c b/target/openrisc/machine.c
index fa054e528b..f2853674f0 100644
--- a/target/openrisc/machine.c
+++ b/target/openrisc/machine.c
@@ -72,14 +72,14 @@ static const VMStateDescription vmstate_env = {
     .version_id = 6,
     .minimum_version_id = 6,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINTTL_2DARRAY(shadow_gpr, CPUOpenRISCState, 16, 32),
-        VMSTATE_UINTTL(pc, CPUOpenRISCState),
-        VMSTATE_UINTTL(ppc, CPUOpenRISCState),
-        VMSTATE_UINTTL(jmp_pc, CPUOpenRISCState),
-        VMSTATE_UINTTL(lock_addr, CPUOpenRISCState),
-        VMSTATE_UINTTL(lock_value, CPUOpenRISCState),
-        VMSTATE_UINTTL(epcr, CPUOpenRISCState),
-        VMSTATE_UINTTL(eear, CPUOpenRISCState),
+        VMSTATE_UINT32_2DARRAY(shadow_gpr, CPUOpenRISCState, 16, 32),
+        VMSTATE_UINT32(pc, CPUOpenRISCState),
+        VMSTATE_UINT32(ppc, CPUOpenRISCState),
+        VMSTATE_UINT32(jmp_pc, CPUOpenRISCState),
+        VMSTATE_UINT32(lock_addr, CPUOpenRISCState),
+        VMSTATE_UINT32(lock_value, CPUOpenRISCState),
+        VMSTATE_UINT32(epcr, CPUOpenRISCState),
+        VMSTATE_UINT32(eear, CPUOpenRISCState),
 
         /* Save the architecture value of the SR, not the internally
            expanded version.  Since this architecture value does not
diff --git a/target/openrisc/sys_helper.c b/target/openrisc/sys_helper.c
index ad59939db3..7ad908b632 100644
--- a/target/openrisc/sys_helper.c
+++ b/target/openrisc/sys_helper.c
@@ -40,7 +40,7 @@ static inline bool is_user(CPUOpenRISCState *env)
 #endif
 }
 
-void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
+void HELPER(mtspr)(CPUOpenRISCState *env, uint32_t spr, uint32_t rb)
 {
     OpenRISCCPU *cpu = env_archcpu(env);
 #ifndef CONFIG_USER_ONLY
@@ -213,8 +213,7 @@ void HELPER(mtspr)(CPUOpenRISCState *env, target_ulong spr, target_ulong rb)
 #endif
 }
 
-target_ulong HELPER(mfspr)(CPUOpenRISCState *env, target_ulong rd,
-                           target_ulong spr)
+uint32_t HELPER(mfspr)(CPUOpenRISCState *env, uint32_t rd, uint32_t spr)
 {
     OpenRISCCPU *cpu = env_archcpu(env);
 #ifndef CONFIG_USER_ONLY
diff --git a/target/openrisc/translate.c b/target/openrisc/translate.c
index beb4a546fd..6fa4d6cfa7 100644
--- a/target/openrisc/translate.c
+++ b/target/openrisc/translate.c
@@ -54,9 +54,9 @@ typedef struct DisasContext {
     vaddr jmp_pc_imm;
 
     /* The temporary corresponding to register 0 for this compilation.  */
-    TCGv R0;
+    TCGv_i32 R0;
     /* The constant zero. */
-    TCGv zero;
+    TCGv_i32 zero;
 } DisasContext;
 
 static inline MemOp mo_endian(DisasContext *dc)
@@ -77,16 +77,16 @@ static inline bool is_user(DisasContext *dc)
 /* Include the auto-generated decoder.  */
 #include "decode-insns.c.inc"
 
-static TCGv cpu_sr;
-static TCGv cpu_regs[32];
-static TCGv cpu_pc;
-static TCGv jmp_pc;            /* l.jr/l.jalr temp pc */
-static TCGv cpu_ppc;
-static TCGv cpu_sr_f;           /* bf/bnf, F flag taken */
-static TCGv cpu_sr_cy;          /* carry (unsigned overflow) */
-static TCGv cpu_sr_ov;          /* signed overflow */
-static TCGv cpu_lock_addr;
-static TCGv cpu_lock_value;
+static TCGv_i32 cpu_sr;
+static TCGv_i32 cpu_regs[32];
+static TCGv_i32 cpu_pc;
+static TCGv_i32 jmp_pc;         /* l.jr/l.jalr temp pc */
+static TCGv_i32 cpu_ppc;
+static TCGv_i32 cpu_sr_f;       /* bf/bnf, F flag taken */
+static TCGv_i32 cpu_sr_cy;      /* carry (unsigned overflow) */
+static TCGv_i32 cpu_sr_ov;      /* signed overflow */
+static TCGv_i32 cpu_lock_addr;
+static TCGv_i32 cpu_lock_value;
 static TCGv_i32 fpcsr;
 static TCGv_i64 cpu_mac;        /* MACHI:MACLO */
 static TCGv_i32 cpu_dflag;
@@ -101,27 +101,27 @@ void openrisc_translate_init(void)
     };
     int i;
 
-    cpu_sr = tcg_global_mem_new(tcg_env,
+    cpu_sr = tcg_global_mem_new_i32(tcg_env,
                                 offsetof(CPUOpenRISCState, sr), "sr");
     cpu_dflag = tcg_global_mem_new_i32(tcg_env,
                                        offsetof(CPUOpenRISCState, dflag),
                                        "dflag");
-    cpu_pc = tcg_global_mem_new(tcg_env,
+    cpu_pc = tcg_global_mem_new_i32(tcg_env,
                                 offsetof(CPUOpenRISCState, pc), "pc");
-    cpu_ppc = tcg_global_mem_new(tcg_env,
+    cpu_ppc = tcg_global_mem_new_i32(tcg_env,
                                  offsetof(CPUOpenRISCState, ppc), "ppc");
-    jmp_pc = tcg_global_mem_new(tcg_env,
+    jmp_pc = tcg_global_mem_new_i32(tcg_env,
                                 offsetof(CPUOpenRISCState, jmp_pc), "jmp_pc");
-    cpu_sr_f = tcg_global_mem_new(tcg_env,
+    cpu_sr_f = tcg_global_mem_new_i32(tcg_env,
                                   offsetof(CPUOpenRISCState, sr_f), "sr_f");
-    cpu_sr_cy = tcg_global_mem_new(tcg_env,
+    cpu_sr_cy = tcg_global_mem_new_i32(tcg_env,
                                    offsetof(CPUOpenRISCState, sr_cy), "sr_cy");
-    cpu_sr_ov = tcg_global_mem_new(tcg_env,
+    cpu_sr_ov = tcg_global_mem_new_i32(tcg_env,
                                    offsetof(CPUOpenRISCState, sr_ov), "sr_ov");
-    cpu_lock_addr = tcg_global_mem_new(tcg_env,
+    cpu_lock_addr = tcg_global_mem_new_i32(tcg_env,
                                        offsetof(CPUOpenRISCState, lock_addr),
                                        "lock_addr");
-    cpu_lock_value = tcg_global_mem_new(tcg_env,
+    cpu_lock_value = tcg_global_mem_new_i32(tcg_env,
                                         offsetof(CPUOpenRISCState, lock_value),
                                         "lock_value");
     fpcsr = tcg_global_mem_new_i32(tcg_env,
@@ -131,7 +131,7 @@ void openrisc_translate_init(void)
                                      offsetof(CPUOpenRISCState, mac),
                                      "mac");
     for (i = 0; i < 32; i++) {
-        cpu_regs[i] = tcg_global_mem_new(tcg_env,
+        cpu_regs[i] = tcg_global_mem_new_i32(tcg_env,
                                          offsetof(CPUOpenRISCState,
                                                   shadow_gpr[0][i]),
                                          regnames[i]);
@@ -145,7 +145,7 @@ static void gen_exception(DisasContext *dc, unsigned int excp)
 
 static void gen_illegal_exception(DisasContext *dc)
 {
-    tcg_gen_movi_tl(cpu_pc, dc->base.pc_next);
+    tcg_gen_movi_i32(cpu_pc, dc->base.pc_next);
     gen_exception(dc, EXCP_ILLEGAL);
     dc->base.is_jmp = DISAS_NORETURN;
 }
@@ -165,7 +165,7 @@ static bool check_of64a32s(DisasContext *dc)
     return dc->cpucfgr & CPUCFGR_OF64A32S;
 }
 
-static TCGv cpu_R(DisasContext *dc, int reg)
+static TCGv_i32 cpu_R(DisasContext *dc, int reg)
 {
     if (reg == 0) {
         return dc->R0;
@@ -206,126 +206,133 @@ static void gen_ove_cyov(DisasContext *dc)
     }
 }
 
-static void gen_add(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_add(DisasContext *dc, TCGv_i32 dest,
+                    TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv t0 = tcg_temp_new();
-    TCGv res = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 res = tcg_temp_new_i32();
 
-    tcg_gen_add2_tl(res, cpu_sr_cy, srca, dc->zero, srcb, dc->zero);
-    tcg_gen_xor_tl(cpu_sr_ov, srca, srcb);
-    tcg_gen_xor_tl(t0, res, srcb);
-    tcg_gen_andc_tl(cpu_sr_ov, t0, cpu_sr_ov);
+    tcg_gen_add2_i32(res, cpu_sr_cy, srca, dc->zero, srcb, dc->zero);
+    tcg_gen_xor_i32(cpu_sr_ov, srca, srcb);
+    tcg_gen_xor_i32(t0, res, srcb);
+    tcg_gen_andc_i32(cpu_sr_ov, t0, cpu_sr_ov);
 
-    tcg_gen_mov_tl(dest, res);
+    tcg_gen_mov_i32(dest, res);
 
     gen_ove_cyov(dc);
 }
 
-static void gen_addc(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_addc(DisasContext *dc, TCGv_i32 dest,
+                     TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv t0 = tcg_temp_new();
-    TCGv res = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 res = tcg_temp_new_i32();
 
-    tcg_gen_addcio_tl(res, cpu_sr_cy, srca, srcb, cpu_sr_cy);
-    tcg_gen_xor_tl(cpu_sr_ov, srca, srcb);
-    tcg_gen_xor_tl(t0, res, srcb);
-    tcg_gen_andc_tl(cpu_sr_ov, t0, cpu_sr_ov);
+    tcg_gen_addcio_i32(res, cpu_sr_cy, srca, srcb, cpu_sr_cy);
+    tcg_gen_xor_i32(cpu_sr_ov, srca, srcb);
+    tcg_gen_xor_i32(t0, res, srcb);
+    tcg_gen_andc_i32(cpu_sr_ov, t0, cpu_sr_ov);
 
-    tcg_gen_mov_tl(dest, res);
+    tcg_gen_mov_i32(dest, res);
 
     gen_ove_cyov(dc);
 }
 
-static void gen_sub(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_sub(DisasContext *dc, TCGv_i32 dest,
+                    TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv res = tcg_temp_new();
+    TCGv_i32 res = tcg_temp_new_i32();
 
-    tcg_gen_sub_tl(res, srca, srcb);
-    tcg_gen_xor_tl(cpu_sr_cy, srca, srcb);
-    tcg_gen_xor_tl(cpu_sr_ov, res, srcb);
-    tcg_gen_and_tl(cpu_sr_ov, cpu_sr_ov, cpu_sr_cy);
-    tcg_gen_setcond_tl(TCG_COND_LTU, cpu_sr_cy, srca, srcb);
+    tcg_gen_sub_i32(res, srca, srcb);
+    tcg_gen_xor_i32(cpu_sr_cy, srca, srcb);
+    tcg_gen_xor_i32(cpu_sr_ov, res, srcb);
+    tcg_gen_and_i32(cpu_sr_ov, cpu_sr_ov, cpu_sr_cy);
+    tcg_gen_setcond_i32(TCG_COND_LTU, cpu_sr_cy, srca, srcb);
 
-    tcg_gen_mov_tl(dest, res);
+    tcg_gen_mov_i32(dest, res);
 
     gen_ove_cyov(dc);
 }
 
-static void gen_mul(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_mul(DisasContext *dc, TCGv_i32 dest,
+                    TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
 
-    tcg_gen_muls2_tl(dest, cpu_sr_ov, srca, srcb);
-    tcg_gen_sari_tl(t0, dest, TARGET_LONG_BITS - 1);
-    tcg_gen_negsetcond_tl(TCG_COND_NE, cpu_sr_ov, cpu_sr_ov, t0);
+    tcg_gen_muls2_i32(dest, cpu_sr_ov, srca, srcb);
+    tcg_gen_sari_i32(t0, dest, TARGET_LONG_BITS - 1);
+    tcg_gen_negsetcond_i32(TCG_COND_NE, cpu_sr_ov, cpu_sr_ov, t0);
 
     gen_ove_ov(dc);
 }
 
-static void gen_mulu(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_mulu(DisasContext *dc, TCGv_i32 dest,
+                     TCGv_i32 srca, TCGv_i32 srcb)
 {
-    tcg_gen_muls2_tl(dest, cpu_sr_cy, srca, srcb);
-    tcg_gen_setcondi_tl(TCG_COND_NE, cpu_sr_cy, cpu_sr_cy, 0);
+    tcg_gen_muls2_i32(dest, cpu_sr_cy, srca, srcb);
+    tcg_gen_setcondi_i32(TCG_COND_NE, cpu_sr_cy, cpu_sr_cy, 0);
 
     gen_ove_cy(dc);
 }
 
-static void gen_div(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_div(DisasContext *dc, TCGv_i32 dest,
+                    TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
 
-    tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_sr_ov, srcb, 0);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_ov, srcb, 0);
     /* The result of divide-by-zero is undefined.
        Suppress the host-side exception by dividing by 1. */
-    tcg_gen_or_tl(t0, srcb, cpu_sr_ov);
-    tcg_gen_div_tl(dest, srca, t0);
+    tcg_gen_or_i32(t0, srcb, cpu_sr_ov);
+    tcg_gen_div_i32(dest, srca, t0);
 
-    tcg_gen_neg_tl(cpu_sr_ov, cpu_sr_ov);
+    tcg_gen_neg_i32(cpu_sr_ov, cpu_sr_ov);
     gen_ove_ov(dc);
 }
 
-static void gen_divu(DisasContext *dc, TCGv dest, TCGv srca, TCGv srcb)
+static void gen_divu(DisasContext *dc, TCGv_i32 dest,
+                     TCGv_i32 srca, TCGv_i32 srcb)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
 
-    tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_sr_cy, srcb, 0);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_cy, srcb, 0);
     /* The result of divide-by-zero is undefined.
        Suppress the host-side exception by dividing by 1. */
-    tcg_gen_or_tl(t0, srcb, cpu_sr_cy);
-    tcg_gen_divu_tl(dest, srca, t0);
+    tcg_gen_or_i32(t0, srcb, cpu_sr_cy);
+    tcg_gen_divu_i32(dest, srca, t0);
 
     gen_ove_cy(dc);
 }
 
-static void gen_muld(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_muld(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_ext_tl_i64(t1, srca);
-    tcg_gen_ext_tl_i64(t2, srcb);
+    tcg_gen_ext_i32_i64(t1, srca);
+    tcg_gen_ext_i32_i64(t2, srcb);
     tcg_gen_mul_i64(cpu_mac, t1, t2);
-    tcg_gen_movi_tl(cpu_sr_ov, 0);
+    tcg_gen_movi_i32(cpu_sr_ov, 0);
 }
 
-static void gen_muldu(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_muldu(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_extu_tl_i64(t1, srca);
-    tcg_gen_extu_tl_i64(t2, srcb);
+    tcg_gen_extu_i32_i64(t1, srca);
+    tcg_gen_extu_i32_i64(t2, srcb);
     tcg_gen_mul_i64(cpu_mac, t1, t2);
-    tcg_gen_movi_tl(cpu_sr_cy, 0);
+    tcg_gen_movi_i32(cpu_sr_cy, 0);
 }
 
-static void gen_mac(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_mac(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_ext_tl_i64(t1, srca);
-    tcg_gen_ext_tl_i64(t2, srcb);
+    tcg_gen_ext_i32_i64(t1, srca);
+    tcg_gen_ext_i32_i64(t2, srcb);
     tcg_gen_mul_i64(t1, t1, t2);
 
     /* Note that overflow is only computed during addition stage.  */
@@ -339,13 +346,13 @@ static void gen_mac(DisasContext *dc, TCGv srca, TCGv srcb)
     gen_ove_ov(dc);
 }
 
-static void gen_macu(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_macu(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_extu_tl_i64(t1, srca);
-    tcg_gen_extu_tl_i64(t2, srcb);
+    tcg_gen_extu_i32_i64(t1, srca);
+    tcg_gen_extu_i32_i64(t2, srcb);
     tcg_gen_mul_i64(t1, t1, t2);
 
     /* Note that overflow is only computed during addition stage.  */
@@ -356,13 +363,13 @@ static void gen_macu(DisasContext *dc, TCGv srca, TCGv srcb)
     gen_ove_cy(dc);
 }
 
-static void gen_msb(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_msb(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_ext_tl_i64(t1, srca);
-    tcg_gen_ext_tl_i64(t2, srcb);
+    tcg_gen_ext_i32_i64(t1, srca);
+    tcg_gen_ext_i32_i64(t2, srcb);
     tcg_gen_mul_i64(t1, t1, t2);
 
     /* Note that overflow is only computed during subtraction stage.  */
@@ -380,13 +387,13 @@ static void gen_msb(DisasContext *dc, TCGv srca, TCGv srcb)
     gen_ove_ov(dc);
 }
 
-static void gen_msbu(DisasContext *dc, TCGv srca, TCGv srcb)
+static void gen_msbu(DisasContext *dc, TCGv_i32 srca, TCGv_i32 srcb)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
-    tcg_gen_extu_tl_i64(t1, srca);
-    tcg_gen_extu_tl_i64(t2, srcb);
+    tcg_gen_extu_i32_i64(t1, srca);
+    tcg_gen_extu_i32_i64(t2, srcb);
     tcg_gen_mul_i64(t1, t1, t2);
 
     /* Note that overflow is only computed during subtraction stage.  */
@@ -421,84 +428,84 @@ static bool trans_l_sub(DisasContext *dc, arg_dab *a)
 static bool trans_l_and(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_and_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_and_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_or(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_or_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_or_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_xor(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_xor_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_xor_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sll(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_shl_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_shl_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_srl(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_shr_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_shr_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sra(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_sar_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_sar_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_ror(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_rotr_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
+    tcg_gen_rotr_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_exths(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ext16s_tl(cpu_R(dc, a->d), cpu_R(dc, a->a));
+    tcg_gen_ext16s_i32(cpu_R(dc, a->d), cpu_R(dc, a->a));
     return true;
 }
 
 static bool trans_l_extbs(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ext8s_tl(cpu_R(dc, a->d), cpu_R(dc, a->a));
+    tcg_gen_ext8s_i32(cpu_R(dc, a->d), cpu_R(dc, a->a));
     return true;
 }
 
 static bool trans_l_exthz(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ext16u_tl(cpu_R(dc, a->d), cpu_R(dc, a->a));
+    tcg_gen_ext16u_i32(cpu_R(dc, a->d), cpu_R(dc, a->a));
     return true;
 }
 
 static bool trans_l_extbz(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ext8u_tl(cpu_R(dc, a->d), cpu_R(dc, a->a));
+    tcg_gen_ext8u_i32(cpu_R(dc, a->d), cpu_R(dc, a->a));
     return true;
 }
 
 static bool trans_l_cmov(DisasContext *dc, arg_dab *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_movcond_tl(TCG_COND_NE, cpu_R(dc, a->d), cpu_sr_f, dc->zero,
+    tcg_gen_movcond_i32(TCG_COND_NE, cpu_R(dc, a->d), cpu_sr_f, dc->zero,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
@@ -506,16 +513,16 @@ static bool trans_l_cmov(DisasContext *dc, arg_dab *a)
 static bool trans_l_ff1(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ctzi_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), -1);
-    tcg_gen_addi_tl(cpu_R(dc, a->d), cpu_R(dc, a->d), 1);
+    tcg_gen_ctzi_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), -1);
+    tcg_gen_addi_i32(cpu_R(dc, a->d), cpu_R(dc, a->d), 1);
     return true;
 }
 
 static bool trans_l_fl1(DisasContext *dc, arg_da *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_clzi_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), TARGET_LONG_BITS);
-    tcg_gen_subfi_tl(cpu_R(dc, a->d), TARGET_LONG_BITS, cpu_R(dc, a->d));
+    tcg_gen_clzi_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), TARGET_LONG_BITS);
+    tcg_gen_subfi_i32(cpu_R(dc, a->d), TARGET_LONG_BITS, cpu_R(dc, a->d));
     return true;
 }
 
@@ -563,7 +570,7 @@ static bool trans_l_j(DisasContext *dc, arg_l_j *a)
 {
     vaddr tmp_pc = dc->base.pc_next + a->n * 4;
 
-    tcg_gen_movi_tl(jmp_pc, tmp_pc);
+    tcg_gen_movi_i32(jmp_pc, tmp_pc);
     dc->jmp_pc_imm = tmp_pc;
     dc->delayed_branch = 2;
     return true;
@@ -574,10 +581,10 @@ static bool trans_l_jal(DisasContext *dc, arg_l_jal *a)
     vaddr tmp_pc = dc->base.pc_next + a->n * 4;
     vaddr ret_pc = dc->base.pc_next + 8;
 
-    tcg_gen_movi_tl(cpu_regs[9], ret_pc);
+    tcg_gen_movi_i32(cpu_regs[9], ret_pc);
     /* Optimize jal being used to load the PC for PIC.  */
     if (tmp_pc != ret_pc) {
-        tcg_gen_movi_tl(jmp_pc, tmp_pc);
+        tcg_gen_movi_i32(jmp_pc, tmp_pc);
         dc->jmp_pc_imm = tmp_pc;
         dc->delayed_branch = 2;
     }
@@ -587,10 +594,10 @@ static bool trans_l_jal(DisasContext *dc, arg_l_jal *a)
 static void do_bf(DisasContext *dc, arg_l_bf *a, TCGCond cond)
 {
     vaddr tmp_pc = dc->base.pc_next + a->n * 4;
-    TCGv t_next = tcg_constant_tl(dc->base.pc_next + 8);
-    TCGv t_true = tcg_constant_tl(tmp_pc);
+    TCGv_i32 t_next = tcg_constant_i32(dc->base.pc_next + 8);
+    TCGv_i32 t_true = tcg_constant_i32(tmp_pc);
 
-    tcg_gen_movcond_tl(cond, jmp_pc, cpu_sr_f, dc->zero, t_true, t_next);
+    tcg_gen_movcond_i32(cond, jmp_pc, cpu_sr_f, dc->zero, t_true, t_next);
     dc->delayed_branch = 2;
 }
 
@@ -608,43 +615,43 @@ static bool trans_l_bnf(DisasContext *dc, arg_l_bf *a)
 
 static bool trans_l_jr(DisasContext *dc, arg_l_jr *a)
 {
-    tcg_gen_mov_tl(jmp_pc, cpu_R(dc, a->b));
+    tcg_gen_mov_i32(jmp_pc, cpu_R(dc, a->b));
     dc->delayed_branch = 2;
     return true;
 }
 
 static bool trans_l_jalr(DisasContext *dc, arg_l_jalr *a)
 {
-    tcg_gen_mov_tl(jmp_pc, cpu_R(dc, a->b));
-    tcg_gen_movi_tl(cpu_regs[9], dc->base.pc_next + 8);
+    tcg_gen_mov_i32(jmp_pc, cpu_R(dc, a->b));
+    tcg_gen_movi_i32(cpu_regs[9], dc->base.pc_next + 8);
     dc->delayed_branch = 2;
     return true;
 }
 
 static bool trans_l_lwa(DisasContext *dc, arg_load *a)
 {
-    TCGv ea;
+    TCGv_i32 ea;
 
     check_r0_write(dc, a->d);
-    ea = tcg_temp_new();
-    tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
-    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx,
-                       mo_endian(dc) | MO_UL);
-    tcg_gen_mov_tl(cpu_lock_addr, ea);
-    tcg_gen_mov_tl(cpu_lock_value, cpu_R(dc, a->d));
+    ea = tcg_temp_new_i32();
+    tcg_gen_addi_i32(ea, cpu_R(dc, a->a), a->i);
+    tcg_gen_qemu_ld_i32(cpu_R(dc, a->d), ea, dc->mem_idx,
+                        mo_endian(dc) | MO_UL);
+    tcg_gen_mov_i32(cpu_lock_addr, ea);
+    tcg_gen_mov_i32(cpu_lock_value, cpu_R(dc, a->d));
     return true;
 }
 
 static void do_load(DisasContext *dc, arg_load *a, MemOp mop)
 {
-    TCGv ea;
+    TCGv_i32 ea;
 
     mop |= mo_endian(dc);
 
     check_r0_write(dc, a->d);
-    ea = tcg_temp_new();
-    tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
-    tcg_gen_qemu_ld_tl(cpu_R(dc, a->d), ea, dc->mem_idx, mop);
+    ea = tcg_temp_new_i32();
+    tcg_gen_addi_i32(ea, cpu_R(dc, a->a), a->i);
+    tcg_gen_qemu_ld_i32(cpu_R(dc, a->d), ea, dc->mem_idx, mop);
 }
 
 static bool trans_l_lwz(DisasContext *dc, arg_load *a)
@@ -685,40 +692,40 @@ static bool trans_l_lhs(DisasContext *dc, arg_load *a)
 
 static bool trans_l_swa(DisasContext *dc, arg_store *a)
 {
-    TCGv ea, val;
+    TCGv_i32 ea, val;
     TCGLabel *lab_fail, *lab_done;
 
-    ea = tcg_temp_new();
-    tcg_gen_addi_tl(ea, cpu_R(dc, a->a), a->i);
+    ea = tcg_temp_new_i32();
+    tcg_gen_addi_i32(ea, cpu_R(dc, a->a), a->i);
 
     lab_fail = gen_new_label();
     lab_done = gen_new_label();
-    tcg_gen_brcond_tl(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
+    tcg_gen_brcond_i32(TCG_COND_NE, ea, cpu_lock_addr, lab_fail);
 
-    val = tcg_temp_new();
-    tcg_gen_atomic_cmpxchg_tl(val, cpu_lock_addr, cpu_lock_value,
+    val = tcg_temp_new_i32();
+    tcg_gen_atomic_cmpxchg_i32(val, cpu_lock_addr, cpu_lock_value,
                               cpu_R(dc, a->b), dc->mem_idx,
                               mo_endian(dc) | MO_UL);
-    tcg_gen_setcond_tl(TCG_COND_EQ, cpu_sr_f, val, cpu_lock_value);
+    tcg_gen_setcond_i32(TCG_COND_EQ, cpu_sr_f, val, cpu_lock_value);
 
     tcg_gen_br(lab_done);
 
     gen_set_label(lab_fail);
-    tcg_gen_movi_tl(cpu_sr_f, 0);
+    tcg_gen_movi_i32(cpu_sr_f, 0);
 
     gen_set_label(lab_done);
-    tcg_gen_movi_tl(cpu_lock_addr, -1);
+    tcg_gen_movi_i32(cpu_lock_addr, -1);
     return true;
 }
 
 static void do_store(DisasContext *dc, arg_store *a, MemOp mop)
 {
-    TCGv t0 = tcg_temp_new();
+    TCGv_i32 t0 = tcg_temp_new_i32();
 
     mop |= mo_endian(dc);
 
-    tcg_gen_addi_tl(t0, cpu_R(dc, a->a), a->i);
-    tcg_gen_qemu_st_tl(cpu_R(dc, a->b), t0, dc->mem_idx, mop);
+    tcg_gen_addi_i32(t0, cpu_R(dc, a->a), a->i);
+    tcg_gen_qemu_st_i32(cpu_R(dc, a->b), t0, dc->mem_idx, mop);
 }
 
 static bool trans_l_sw(DisasContext *dc, arg_store *a)
@@ -760,75 +767,75 @@ static bool trans_l_adrp(DisasContext *dc, arg_l_adrp *a)
 static bool trans_l_addi(DisasContext *dc, arg_rri *a)
 {
     check_r0_write(dc, a->d);
-    gen_add(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_tl(a->i));
+    gen_add(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_i32(a->i));
     return true;
 }
 
 static bool trans_l_addic(DisasContext *dc, arg_rri *a)
 {
     check_r0_write(dc, a->d);
-    gen_addc(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_tl(a->i));
+    gen_addc(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_i32(a->i));
     return true;
 }
 
 static bool trans_l_muli(DisasContext *dc, arg_rri *a)
 {
     check_r0_write(dc, a->d);
-    gen_mul(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_tl(a->i));
+    gen_mul(dc, cpu_R(dc, a->d), cpu_R(dc, a->a), tcg_constant_i32(a->i));
     return true;
 }
 
 static bool trans_l_maci(DisasContext *dc, arg_l_maci *a)
 {
-    gen_mac(dc, cpu_R(dc, a->a), tcg_constant_tl(a->i));
+    gen_mac(dc, cpu_R(dc, a->a), tcg_constant_i32(a->i));
     return true;
 }
 
 static bool trans_l_andi(DisasContext *dc, arg_rrk *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_andi_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), a->k);
+    tcg_gen_andi_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), a->k);
     return true;
 }
 
 static bool trans_l_ori(DisasContext *dc, arg_rrk *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_ori_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), a->k);
+    tcg_gen_ori_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), a->k);
     return true;
 }
 
 static bool trans_l_xori(DisasContext *dc, arg_rri *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_xori_tl(cpu_R(dc, a->d), cpu_R(dc, a->a), a->i);
+    tcg_gen_xori_i32(cpu_R(dc, a->d), cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_mfspr(DisasContext *dc, arg_l_mfspr *a)
 {
-    TCGv spr = tcg_temp_new();
+    TCGv_i32 spr = tcg_temp_new_i32();
 
     check_r0_write(dc, a->d);
 
     if (translator_io_start(&dc->base)) {
         if (dc->delayed_branch) {
-            tcg_gen_mov_tl(cpu_pc, jmp_pc);
-            tcg_gen_discard_tl(jmp_pc);
+            tcg_gen_mov_i32(cpu_pc, jmp_pc);
+            tcg_gen_discard_i32(jmp_pc);
         } else {
-            tcg_gen_movi_tl(cpu_pc, dc->base.pc_next + 4);
+            tcg_gen_movi_i32(cpu_pc, dc->base.pc_next + 4);
         }
         dc->base.is_jmp = DISAS_EXIT;
     }
 
-    tcg_gen_ori_tl(spr, cpu_R(dc, a->a), a->k);
+    tcg_gen_ori_i32(spr, cpu_R(dc, a->a), a->k);
     gen_helper_mfspr(cpu_R(dc, a->d), tcg_env, cpu_R(dc, a->d), spr);
     return true;
 }
 
 static bool trans_l_mtspr(DisasContext *dc, arg_l_mtspr *a)
 {
-    TCGv spr = tcg_temp_new();
+    TCGv_i32 spr = tcg_temp_new_i32();
 
     translator_io_start(&dc->base);
 
@@ -839,14 +846,14 @@ static bool trans_l_mtspr(DisasContext *dc, arg_l_mtspr *a)
      * of the cpu state first, allowing it to be overwritten.
      */
     if (dc->delayed_branch) {
-        tcg_gen_mov_tl(cpu_pc, jmp_pc);
-        tcg_gen_discard_tl(jmp_pc);
+        tcg_gen_mov_i32(cpu_pc, jmp_pc);
+        tcg_gen_discard_i32(jmp_pc);
     } else {
-        tcg_gen_movi_tl(cpu_pc, dc->base.pc_next + 4);
+        tcg_gen_movi_i32(cpu_pc, dc->base.pc_next + 4);
     }
     dc->base.is_jmp = DISAS_EXIT;
 
-    tcg_gen_ori_tl(spr, cpu_R(dc, a->a), a->k);
+    tcg_gen_ori_i32(spr, cpu_R(dc, a->a), a->k);
     gen_helper_mtspr(tcg_env, spr, cpu_R(dc, a->b));
     return true;
 }
@@ -878,7 +885,7 @@ static bool trans_l_msbu(DisasContext *dc, arg_ab *a)
 static bool trans_l_slli(DisasContext *dc, arg_dal *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_shli_tl(cpu_R(dc, a->d), cpu_R(dc, a->a),
+    tcg_gen_shli_i32(cpu_R(dc, a->d), cpu_R(dc, a->a),
                     a->l & (TARGET_LONG_BITS - 1));
     return true;
 }
@@ -886,7 +893,7 @@ static bool trans_l_slli(DisasContext *dc, arg_dal *a)
 static bool trans_l_srli(DisasContext *dc, arg_dal *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_shri_tl(cpu_R(dc, a->d), cpu_R(dc, a->a),
+    tcg_gen_shri_i32(cpu_R(dc, a->d), cpu_R(dc, a->a),
                     a->l & (TARGET_LONG_BITS - 1));
     return true;
 }
@@ -894,7 +901,7 @@ static bool trans_l_srli(DisasContext *dc, arg_dal *a)
 static bool trans_l_srai(DisasContext *dc, arg_dal *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_sari_tl(cpu_R(dc, a->d), cpu_R(dc, a->a),
+    tcg_gen_sari_i32(cpu_R(dc, a->d), cpu_R(dc, a->a),
                     a->l & (TARGET_LONG_BITS - 1));
     return true;
 }
@@ -902,7 +909,7 @@ static bool trans_l_srai(DisasContext *dc, arg_dal *a)
 static bool trans_l_rori(DisasContext *dc, arg_dal *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_rotri_tl(cpu_R(dc, a->d), cpu_R(dc, a->a),
+    tcg_gen_rotri_i32(cpu_R(dc, a->d), cpu_R(dc, a->a),
                      a->l & (TARGET_LONG_BITS - 1));
     return true;
 }
@@ -910,7 +917,7 @@ static bool trans_l_rori(DisasContext *dc, arg_dal *a)
 static bool trans_l_movhi(DisasContext *dc, arg_l_movhi *a)
 {
     check_r0_write(dc, a->d);
-    tcg_gen_movi_tl(cpu_R(dc, a->d), a->k << 16);
+    tcg_gen_movi_i32(cpu_R(dc, a->d), a->k << 16);
     return true;
 }
 
@@ -924,137 +931,137 @@ static bool trans_l_macrc(DisasContext *dc, arg_l_macrc *a)
 
 static bool trans_l_sfeq(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_EQ, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_EQ, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfne(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_NE, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_NE, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfgtu(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_GTU, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_GTU, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfgeu(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_GEU, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_GEU, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfltu(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_LTU, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_LTU, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfleu(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_LEU, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_LEU, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfgts(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_GT, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_GT, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfges(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_GE, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_GE, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sflts(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_LT, cpu_sr_f,
+    tcg_gen_setcond_i32(TCG_COND_LT, cpu_sr_f,
                        cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfles(DisasContext *dc, arg_ab *a)
 {
-    tcg_gen_setcond_tl(TCG_COND_LE,
+    tcg_gen_setcond_i32(TCG_COND_LE,
                        cpu_sr_f, cpu_R(dc, a->a), cpu_R(dc, a->b));
     return true;
 }
 
 static bool trans_l_sfeqi(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfnei(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_NE, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_NE, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfgtui(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_GTU, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_GTU, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfgeui(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_GEU, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_GEU, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfltui(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_LTU, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_LTU, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfleui(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_LEU, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_LEU, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfgtsi(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_GT, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_GT, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfgesi(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_GE, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_GE, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sfltsi(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_LT, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_LT, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sflesi(DisasContext *dc, arg_ai *a)
 {
-    tcg_gen_setcondi_tl(TCG_COND_LE, cpu_sr_f, cpu_R(dc, a->a), a->i);
+    tcg_gen_setcondi_i32(TCG_COND_LE, cpu_sr_f, cpu_R(dc, a->a), a->i);
     return true;
 }
 
 static bool trans_l_sys(DisasContext *dc, arg_l_sys *a)
 {
-    tcg_gen_movi_tl(cpu_pc, dc->base.pc_next);
+    tcg_gen_movi_i32(cpu_pc, dc->base.pc_next);
     gen_exception(dc, EXCP_SYSCALL);
     dc->base.is_jmp = DISAS_NORETURN;
     return true;
@@ -1062,7 +1069,7 @@ static bool trans_l_sys(DisasContext *dc, arg_l_sys *a)
 
 static bool trans_l_trap(DisasContext *dc, arg_l_trap *a)
 {
-    tcg_gen_movi_tl(cpu_pc, dc->base.pc_next);
+    tcg_gen_movi_i32(cpu_pc, dc->base.pc_next);
     gen_exception(dc, EXCP_TRAP);
     dc->base.is_jmp = DISAS_NORETURN;
     return true;
@@ -1096,7 +1103,7 @@ static bool trans_l_rfe(DisasContext *dc, arg_l_rfe *a)
 }
 
 static bool do_fp2(DisasContext *dc, arg_da *a,
-                   void (*fn)(TCGv, TCGv_env, TCGv))
+                   void (*fn)(TCGv_i32, TCGv_env, TCGv_i32))
 {
     if (!check_of32s(dc)) {
         return false;
@@ -1108,7 +1115,7 @@ static bool do_fp2(DisasContext *dc, arg_da *a,
 }
 
 static bool do_fp3(DisasContext *dc, arg_dab *a,
-                   void (*fn)(TCGv, TCGv_env, TCGv, TCGv))
+                   void (*fn)(TCGv_i32, TCGv_env, TCGv_i32, TCGv_i32))
 {
     if (!check_of32s(dc)) {
         return false;
@@ -1120,7 +1127,7 @@ static bool do_fp3(DisasContext *dc, arg_dab *a,
 }
 
 static bool do_fpcmp(DisasContext *dc, arg_ab *a,
-                     void (*fn)(TCGv, TCGv_env, TCGv, TCGv),
+                     void (*fn)(TCGv_i32, TCGv_env, TCGv_i32, TCGv_i32),
                      bool inv, bool swap)
 {
     if (!check_of32s(dc)) {
@@ -1132,7 +1139,7 @@ static bool do_fpcmp(DisasContext *dc, arg_ab *a,
         fn(cpu_sr_f, tcg_env, cpu_R(dc, a->a), cpu_R(dc, a->b));
     }
     if (inv) {
-        tcg_gen_xori_tl(cpu_sr_f, cpu_sr_f, 1);
+        tcg_gen_xori_i32(cpu_sr_f, cpu_sr_f, 1);
     }
     gen_helper_update_fpcsr(tcg_env);
     return true;
@@ -1325,7 +1332,7 @@ static bool do_dp2(DisasContext *dc, arg_da_pair *a,
 }
 
 static bool do_dpcmp(DisasContext *dc, arg_ab_pair *a,
-                     void (*fn)(TCGv, TCGv_env, TCGv_i64, TCGv_i64),
+                     void (*fn)(TCGv_i32, TCGv_env, TCGv_i64, TCGv_i64),
                      bool inv, bool swap)
 {
     TCGv_i64 t0, t1;
@@ -1347,7 +1354,7 @@ static bool do_dpcmp(DisasContext *dc, arg_ab_pair *a,
     }
 
     if (inv) {
-        tcg_gen_xori_tl(cpu_sr_f, cpu_sr_f, 1);
+        tcg_gen_xori_i32(cpu_sr_f, cpu_sr_f, 1);
     }
     gen_helper_update_fpcsr(tcg_env);
     return true;
@@ -1532,7 +1539,7 @@ static void openrisc_tr_tb_start(DisasContextBase *db, CPUState *cs)
 
     /* Allow the TCG optimizer to see that R0 == 0,
        when it's true, which is the common case.  */
-    dc->zero = tcg_constant_tl(0);
+    dc->zero = tcg_constant_i32(0);
     if (dc->tb_flags & TB_FLAGS_R0_0) {
         dc->R0 = dc->zero;
     } else {
@@ -1588,32 +1595,32 @@ static void openrisc_tr_tb_stop(DisasContextBase *dcbase, CPUState *cs)
 
     /* For DISAS_TOO_MANY, jump to the next insn.  */
     jmp_dest = dc->base.pc_next;
-    tcg_gen_movi_tl(cpu_ppc, jmp_dest - 4);
+    tcg_gen_movi_i32(cpu_ppc, jmp_dest - 4);
 
     switch (dc->base.is_jmp) {
     case DISAS_JUMP:
         jmp_dest = dc->jmp_pc_imm;
         if (jmp_dest == -1) {
             /* The jump destination is indirect/computed; use jmp_pc.  */
-            tcg_gen_mov_tl(cpu_pc, jmp_pc);
-            tcg_gen_discard_tl(jmp_pc);
+            tcg_gen_mov_i32(cpu_pc, jmp_pc);
+            tcg_gen_discard_i32(jmp_pc);
             tcg_gen_lookup_and_goto_ptr();
             break;
         }
         /* The jump destination is direct; use jmp_pc_imm.
            However, we will have stored into jmp_pc as well;
            we know now that it wasn't needed.  */
-        tcg_gen_discard_tl(jmp_pc);
+        tcg_gen_discard_i32(jmp_pc);
         /* fallthru */
 
     case DISAS_TOO_MANY:
         if (translator_use_goto_tb(&dc->base, jmp_dest)) {
             tcg_gen_goto_tb(0);
-            tcg_gen_movi_tl(cpu_pc, jmp_dest);
+            tcg_gen_movi_i32(cpu_pc, jmp_dest);
             tcg_gen_exit_tb(dc->base.tb, 0);
             break;
         }
-        tcg_gen_movi_tl(cpu_pc, jmp_dest);
+        tcg_gen_movi_i32(cpu_pc, jmp_dest);
         tcg_gen_lookup_and_goto_ptr();
         break;
 

From b4c93258a9d4e567d6e74d47cfcbbac0ff542bfa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 10:53:07 +0200
Subject: [PATCH 1378/2396] target/riscv/kvm: Replace legacy
 cpu_physical_memory_read/write() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Since the SBI DBCN is handled within a vCPU context, use its
default address space. Replace using the address space API.
As with the previous implementation, ignore whether the memory
accesses succeeded or failed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20251002145742.75624-4-philmd@linaro.org>
---
 target/riscv/kvm/kvm-cpu.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 75ca3fb9fd..0dd0d59d41 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -36,6 +36,7 @@
 #include "hw/pci/pci.h"
 #include "exec/memattrs.h"
 #include "system/address-spaces.h"
+#include "system/memory.h"
 #include "hw/boards.h"
 #include "hw/irq.h"
 #include "hw/intc/riscv_imsic.h"
@@ -1564,6 +1565,7 @@ bool kvm_arch_stop_on_emulation_error(CPUState *cs)
 
 static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     g_autofree uint8_t *buf = NULL;
     RISCVCPU *cpu = RISCV_CPU(cs);
     target_ulong num_bytes;
@@ -1602,9 +1604,9 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
                 exit(1);
             }
 
-            cpu_physical_memory_write(addr, buf, ret);
+            address_space_write(cs->as, addr, attrs, buf, ret);
         } else {
-            cpu_physical_memory_read(addr, buf, num_bytes);
+            address_space_read(cs->as, addr, attrs, buf, num_bytes);
 
             ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
             if (ret < 0) {

From d936261844f68a07a3c51db08278eda273457d94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 2 Oct 2025 05:09:23 +0200
Subject: [PATCH 1379/2396] target/riscv/monitor: Replace legacy
 cpu_physical_memory_read() call
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Propagate the address space to walk_pte(), then replace the
cpu_physical_memory_read() by address_space_read(). Since the
monitor command are run with a vCPU context, use its default
address space. As with the previous implementation, ignore
whether the memory read succeeded or failed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20251002145742.75624-5-philmd@linaro.org>
---
 target/riscv/monitor.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/riscv/monitor.c b/target/riscv/monitor.c
index 100005ea4e..8a77476db9 100644
--- a/target/riscv/monitor.c
+++ b/target/riscv/monitor.c
@@ -23,6 +23,7 @@
 #include "cpu_bits.h"
 #include "monitor/monitor.h"
 #include "monitor/hmp-target.h"
+#include "system/memory.h"
 
 #ifdef TARGET_RISCV64
 #define PTE_HEADER_FIELDS       "vaddr            paddr            "\
@@ -77,11 +78,13 @@ static void print_pte(Monitor *mon, int va_bits, target_ulong vaddr,
                    attr & PTE_D ? 'd' : '-');
 }
 
-static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
+static void walk_pte(Monitor *mon, AddressSpace *as,
+                     hwaddr base, target_ulong start,
                      int level, int ptidxbits, int ptesize, int va_bits,
                      target_ulong *vbase, hwaddr *pbase, hwaddr *last_paddr,
                      target_ulong *last_size, int *last_attr)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     hwaddr pte_addr;
     hwaddr paddr;
     target_ulong last_start = -1;
@@ -100,7 +103,7 @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
 
     for (idx = 0; idx < (1UL << ptidxbits); idx++) {
         pte_addr = base + idx * ptesize;
-        cpu_physical_memory_read(pte_addr, &pte, ptesize);
+        address_space_read(as, pte_addr, attrs, &pte, ptesize);
 
         paddr = (hwaddr)(pte >> PTE_PPN_SHIFT) << PGSHIFT;
         attr = pte & 0xff;
@@ -132,7 +135,7 @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
                 *last_size = pgsize;
             } else {
                 /* pointer to the next level of the page table */
-                walk_pte(mon, paddr, start, level - 1, ptidxbits, ptesize,
+                walk_pte(mon, as, paddr, start, level - 1, ptidxbits, ptesize,
                          va_bits, vbase, pbase, last_paddr,
                          last_size, last_attr);
             }
@@ -145,6 +148,7 @@ static void walk_pte(Monitor *mon, hwaddr base, target_ulong start,
 
 static void mem_info_svxx(Monitor *mon, CPUArchState *env)
 {
+    AddressSpace *as = env_cpu(env)->as;
     int levels, ptidxbits, ptesize, vm, va_bits;
     hwaddr base;
     target_ulong vbase;
@@ -199,7 +203,7 @@ static void mem_info_svxx(Monitor *mon, CPUArchState *env)
     last_attr = 0;
 
     /* walk page tables, starting from address 0 */
-    walk_pte(mon, base, 0, levels - 1, ptidxbits, ptesize, va_bits,
+    walk_pte(mon, as, base, 0, levels - 1, ptidxbits, ptesize, va_bits,
              &vbase, &pbase, &last_paddr, &last_size, &last_attr);
 
     /* don't forget the last one */

From 89e1cd7363e0a066a6b7a6059998efa3a89cc1b9 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 1 Oct 2025 09:32:34 +0200
Subject: [PATCH 1380/2396] target/riscv: Use 32 bits for misa extensions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

uint32_t is already in use in most places storing misa extensions such
as CPUArchState::misa_exts, RISCVCPUProfile::misa_exts,
RISCVImpliedExtsRule::implied_misa_exts.  Additionally. the field is
already migrated as uint32_t.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251001073306.28573-2-anjo@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/riscv/cpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 2c2266415e..4c13012442 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -50,7 +50,7 @@ typedef struct CPUArchState CPURISCVState;
  */
 #define RISCV_UW2_ALWAYS_STORE_AMO 1
 
-#define RV(x) ((target_ulong)1 << (x - 'A'))
+#define RV(x) BIT(x - 'A')
 
 /*
  * Update misa_bits[], misa_ext_info_arr[] and misa_ext_cfgs[]
@@ -582,7 +582,7 @@ struct RISCVCPUClass {
     RISCVCPUDef *def;
 };
 
-static inline int riscv_has_ext(CPURISCVState *env, target_ulong ext)
+static inline int riscv_has_ext(CPURISCVState *env, uint32_t ext)
 {
     return (env->misa_ext & ext) != 0;
 }

From 886b0cea411691d6fd75fae97ab40ff833fdb9ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 14:46:36 +0200
Subject: [PATCH 1381/2396] target/riscv: Replace HOST_BIG_ENDIAN #ifdef with
 if() check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace preprocessor-time #ifdef with a compile-time check
to ensure all code paths are built and tested. This reduces
build-time configuration complexity and simplifies code
maintainability.

No functional change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-Id: <20251010134226.72221-14-philmd@linaro.org>
---
 target/riscv/insn_trans/trans_rvv.c.inc | 16 ++++++-------
 target/riscv/vector_helper.c            | 32 ++++++++++++-------------
 2 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvv.c.inc b/target/riscv/insn_trans/trans_rvv.c.inc
index f4b5460340..2a487179f6 100644
--- a/target/riscv/insn_trans/trans_rvv.c.inc
+++ b/target/riscv/insn_trans/trans_rvv.c.inc
@@ -3351,19 +3351,19 @@ static void load_element(TCGv_i64 dest, TCGv_ptr base,
 /* offset of the idx element with base register r */
 static uint32_t endian_ofs(DisasContext *s, int r, int idx)
 {
-#if HOST_BIG_ENDIAN
-    return vreg_ofs(s, r) + ((idx ^ (7 >> s->sew)) << s->sew);
-#else
-    return vreg_ofs(s, r) + (idx << s->sew);
-#endif
+    if (HOST_BIG_ENDIAN) {
+        return vreg_ofs(s, r) + ((idx ^ (7 >> s->sew)) << s->sew);
+    } else {
+        return vreg_ofs(s, r) + (idx << s->sew);
+    }
 }
 
 /* adjust the index according to the endian */
 static void endian_adjust(TCGv_i32 ofs, int sew)
 {
-#if HOST_BIG_ENDIAN
-    tcg_gen_xori_i32(ofs, ofs, 7 >> sew);
-#endif
+    if (HOST_BIG_ENDIAN) {
+        tcg_gen_xori_i32(ofs, ofs, 7 >> sew);
+    }
 }
 
 /* Load idx >= VLMAX ? 0 : vreg[idx] */
diff --git a/target/riscv/vector_helper.c b/target/riscv/vector_helper.c
index 41ea223106..2de3358ee8 100644
--- a/target/riscv/vector_helper.c
+++ b/target/riscv/vector_helper.c
@@ -235,26 +235,26 @@ vext_continuous_ldst_host(CPURISCVState *env, vext_ldst_elem_fn_host *ldst_host,
                         void *vd, uint32_t evl, uint32_t reg_start, void *host,
                         uint32_t esz, bool is_load)
 {
-#if HOST_BIG_ENDIAN
-    for (; reg_start < evl; reg_start++, host += esz) {
-        ldst_host(vd, reg_start, host);
-    }
-#else
-    if (esz == 1) {
-        uint32_t byte_offset = reg_start * esz;
-        uint32_t size = (evl - reg_start) * esz;
-
-        if (is_load) {
-            memcpy(vd + byte_offset, host, size);
-        } else {
-            memcpy(host, vd + byte_offset, size);
-        }
-    } else {
+    if (HOST_BIG_ENDIAN) {
         for (; reg_start < evl; reg_start++, host += esz) {
             ldst_host(vd, reg_start, host);
         }
+    } else {
+        if (esz == 1) {
+            uint32_t byte_offset = reg_start * esz;
+            uint32_t size = (evl - reg_start) * esz;
+
+            if (is_load) {
+                memcpy(vd + byte_offset, host, size);
+            } else {
+                memcpy(host, vd + byte_offset, size);
+            }
+        } else {
+            for (; reg_start < evl; reg_start++, host += esz) {
+                ldst_host(vd, reg_start, host);
+            }
+        }
     }
-#endif
 }
 
 static void vext_set_tail_elems_1s(target_ulong vl, void *vd,

From 2982b948a9faa8edd0c8a9366fab77cc1094e0a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:58:54 +0200
Subject: [PATCH 1382/2396] target/rx: Replace target_ulong -> vaddr for
 translator API uses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit b1c09220b4c ("accel/tcg: Replace target_ulong with
vaddr in translator_*()") the API takes vaddr argument, not
target_ulong. Update the 2 callers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-2-philmd@linaro.org>
---
 target/rx/translate.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 5fc589c706..1c911cd9a6 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -85,7 +85,7 @@ static uint32_t decode_load_bytes(DisasContext *ctx, uint32_t insn,
 
 static uint32_t li(DisasContext *ctx, int sz)
 {
-    target_ulong addr;
+    vaddr addr;
     uint32_t tmp;
     CPURXState *env = ctx->env;
     addr = ctx->base.pc_next;
@@ -147,8 +147,7 @@ void rx_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     }
 }
 
-static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx,
-                        target_ulong dest)
+static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 {
     if (translator_use_goto_tb(&dc->base, dest)) {
         tcg_gen_goto_tb(tb_slot_idx);

From 0f4af4e2672040e505c7b337d48ec7cf2c1687bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:54:35 +0200
Subject: [PATCH 1383/2396] target/rx: Use MemOp type in gen_ld[u]() and
 gen_st()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The @size argument is of MemOp type. All callers respect that.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-3-philmd@linaro.org>
---
 target/rx/translate.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 1c911cd9a6..744edd56af 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -161,19 +161,19 @@ static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 }
 
 /* generic load wrapper */
-static inline void rx_gen_ld(unsigned int size, TCGv reg, TCGv mem)
+static inline void rx_gen_ld(MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | MO_TE);
 }
 
 /* unsigned load wrapper */
-static inline void rx_gen_ldu(unsigned int size, TCGv reg, TCGv mem)
+static inline void rx_gen_ldu(MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_TE);
 }
 
 /* generic store wrapper */
-static inline void rx_gen_st(unsigned int size, TCGv reg, TCGv mem)
+static inline void rx_gen_st(MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_st_i32(reg, mem, 0, size | MO_TE);
 }

From 2062fa663c00927b4bfe63bd1d3f4614af3f0b9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:52:39 +0200
Subject: [PATCH 1384/2396] target/rx: Propagate DisasContext to generated
 helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-4-philmd@linaro.org>
---
 target/rx/translate.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 744edd56af..b314d94b01 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -1894,7 +1894,7 @@ static bool trans_ITOF(DisasContext *ctx, arg_ITOF * a)
     return true;
 }
 
-static void rx_bsetm(TCGv mem, TCGv mask)
+static void rx_bsetm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
@@ -1903,7 +1903,7 @@ static void rx_bsetm(TCGv mem, TCGv mask)
     rx_gen_st(MO_8, val, mem);
 }
 
-static void rx_bclrm(TCGv mem, TCGv mask)
+static void rx_bclrm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
@@ -1912,7 +1912,7 @@ static void rx_bclrm(TCGv mem, TCGv mask)
     rx_gen_st(MO_8, val, mem);
 }
 
-static void rx_btstm(TCGv mem, TCGv mask)
+static void rx_btstm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
@@ -1922,7 +1922,7 @@ static void rx_btstm(TCGv mem, TCGv mask)
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
 }
 
-static void rx_bnotm(TCGv mem, TCGv mask)
+static void rx_bnotm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
@@ -1931,17 +1931,17 @@ static void rx_bnotm(TCGv mem, TCGv mask)
     rx_gen_st(MO_8, val, mem);
 }
 
-static void rx_bsetr(TCGv reg, TCGv mask)
+static void rx_bsetr(DisasContext *ctx, TCGv reg, TCGv mask)
 {
     tcg_gen_or_i32(reg, reg, mask);
 }
 
-static void rx_bclrr(TCGv reg, TCGv mask)
+static void rx_bclrr(DisasContext *ctx, TCGv reg, TCGv mask)
 {
     tcg_gen_andc_i32(reg, reg, mask);
 }
 
-static inline void rx_btstr(TCGv reg, TCGv mask)
+static inline void rx_btstr(DisasContext *ctx, TCGv reg, TCGv mask)
 {
     TCGv t0;
     t0 = tcg_temp_new();
@@ -1950,7 +1950,7 @@ static inline void rx_btstr(TCGv reg, TCGv mask)
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
 }
 
-static inline void rx_bnotr(TCGv reg, TCGv mask)
+static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
 {
     tcg_gen_xor_i32(reg, reg, mask);
 }
@@ -1963,7 +1963,7 @@ static inline void rx_bnotr(TCGv reg, TCGv mask)
         mem = tcg_temp_new();                                           \
         mask = tcg_constant_i32(1 << a->imm);                           \
         addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rs);             \
-        cat3(rx_, op, m)(addr, mask);                                   \
+        cat3(rx_, op, m)(ctx, addr, mask);                              \
         return true;                                                    \
     }                                                                   \
     static bool cat3(trans_, name, _ir)(DisasContext *ctx,              \
@@ -1971,7 +1971,7 @@ static inline void rx_bnotr(TCGv reg, TCGv mask)
     {                                                                   \
         TCGv mask;                                                      \
         mask = tcg_constant_i32(1 << a->imm);                           \
-        cat3(rx_, op, r)(cpu_regs[a->rd], mask);                        \
+        cat3(rx_, op, r)(ctx, cpu_regs[a->rd], mask);                   \
         return true;                                                    \
     }                                                                   \
     static bool cat3(trans_, name, _rr)(DisasContext *ctx,              \
@@ -1982,7 +1982,7 @@ static inline void rx_bnotr(TCGv reg, TCGv mask)
         b = tcg_temp_new();                                             \
         tcg_gen_andi_i32(b, cpu_regs[a->rs], 31);                       \
         tcg_gen_shl_i32(mask, tcg_constant_i32(1), b);                  \
-        cat3(rx_, op, r)(cpu_regs[a->rd], mask);                        \
+        cat3(rx_, op, r)(ctx, cpu_regs[a->rd], mask);                   \
         return true;                                                    \
     }                                                                   \
     static bool cat3(trans_, name, _rm)(DisasContext *ctx,              \
@@ -1995,7 +1995,7 @@ static inline void rx_bnotr(TCGv reg, TCGv mask)
         tcg_gen_shl_i32(mask, tcg_constant_i32(1), b);                  \
         mem = tcg_temp_new();                                           \
         addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rs);             \
-        cat3(rx_, op, m)(addr, mask);                                   \
+        cat3(rx_, op, m)(ctx, addr, mask);                              \
         return true;                                                    \
     }
 

From 8b71fd6ffec8787f0685ccce5f4dd9db50fea792 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:53:50 +0200
Subject: [PATCH 1385/2396] target/rx: Propagate DisasContext to push() / pop()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-5-philmd@linaro.org>
---
 target/rx/translate.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index b314d94b01..912daaf9fb 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -414,13 +414,13 @@ static void move_to_cr(DisasContext *ctx, TCGv val, int cr)
     }
 }
 
-static void push(TCGv val)
+static void push(DisasContext *ctx, TCGv val)
 {
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
     rx_gen_st(MO_32, val, cpu_sp);
 }
 
-static void pop(TCGv ret)
+static void pop(DisasContext *ctx, TCGv ret)
 {
     rx_gen_ld(MO_32, ret, cpu_sp);
     tcg_gen_addi_i32(cpu_sp, cpu_sp, 4);
@@ -619,7 +619,7 @@ static bool trans_POPC(DisasContext *ctx, arg_POPC *a)
 {
     TCGv val;
     val = tcg_temp_new();
-    pop(val);
+    pop(ctx, val);
     move_to_cr(ctx, val, a->cr);
     return true;
 }
@@ -634,7 +634,7 @@ static bool trans_POPM(DisasContext *ctx, arg_POPM *a)
     }
     r = a->rd;
     while (r <= a->rd2 && r < 16) {
-        pop(cpu_regs[r++]);
+        pop(ctx, cpu_regs[r++]);
     }
     return true;
 }
@@ -670,7 +670,7 @@ static bool trans_PUSHC(DisasContext *ctx, arg_PUSHC *a)
     TCGv val;
     val = tcg_temp_new();
     move_from_cr(ctx, val, a->cr, ctx->pc);
-    push(val);
+    push(ctx, val);
     return true;
 }
 
@@ -685,7 +685,7 @@ static bool trans_PUSHM(DisasContext *ctx, arg_PUSHM *a)
     }
     r = a->rs2;
     while (r >= a->rs && r >= 0) {
-        push(cpu_regs[r--]);
+        push(ctx, cpu_regs[r--]);
     }
     return true;
 }
@@ -772,7 +772,7 @@ static bool trans_SCCnd(DisasContext *ctx, arg_SCCnd *a)
 static bool trans_RTSD_i(DisasContext *ctx, arg_RTSD_i *a)
 {
     tcg_gen_addi_i32(cpu_sp, cpu_sp, a->imm  << 2);
-    pop(cpu_pc);
+    pop(ctx, cpu_pc);
     ctx->base.is_jmp = DISAS_JUMP;
     return true;
 }
@@ -792,9 +792,9 @@ static bool trans_RTSD_irr(DisasContext *ctx, arg_RTSD_irr *a)
     tcg_gen_addi_i32(cpu_sp, cpu_sp, adj << 2);
     dst = a->rd;
     while (dst <= a->rd2 && dst < 16) {
-        pop(cpu_regs[dst++]);
+        pop(ctx, cpu_regs[dst++]);
     }
-    pop(cpu_pc);
+    pop(ctx, cpu_pc);
     ctx->base.is_jmp = DISAS_JUMP;
     return true;
 }
@@ -1585,7 +1585,7 @@ static bool trans_BRA_l(DisasContext *ctx, arg_BRA_l *a)
 static inline void rx_save_pc(DisasContext *ctx)
 {
     TCGv pc = tcg_constant_i32(ctx->base.pc_next);
-    push(pc);
+    push(ctx, pc);
 }
 
 /* jmp rs */
@@ -1626,7 +1626,7 @@ static bool trans_BSR_l(DisasContext *ctx, arg_BSR_l *a)
 /* rts */
 static bool trans_RTS(DisasContext *ctx, arg_RTS *a)
 {
-    pop(cpu_pc);
+    pop(ctx, cpu_pc);
     ctx->base.is_jmp = DISAS_JUMP;
     return true;
 }
@@ -2154,8 +2154,8 @@ static bool trans_RTE(DisasContext *ctx, arg_RTE *a)
     TCGv psw;
     if (is_privileged(ctx, 1)) {
         psw = tcg_temp_new();
-        pop(cpu_pc);
-        pop(psw);
+        pop(ctx, cpu_pc);
+        pop(ctx, psw);
         gen_helper_set_psw_rte(tcg_env, psw);
         ctx->base.is_jmp = DISAS_EXIT;
     }

From 363fff6d1b1f71b4f41c490076127ce3021bffc0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:55:19 +0200
Subject: [PATCH 1386/2396] target/rx: Propagate DisasContext to gen_ld[u]()
 and gen_st()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-6-philmd@linaro.org>
---
 target/rx/translate.c | 64 +++++++++++++++++++++----------------------
 1 file changed, 32 insertions(+), 32 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 912daaf9fb..3c7bcc9933 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -161,19 +161,19 @@ static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 }
 
 /* generic load wrapper */
-static inline void rx_gen_ld(MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_ld(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | MO_TE);
 }
 
 /* unsigned load wrapper */
-static inline void rx_gen_ldu(MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_ldu(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_TE);
 }
 
 /* generic store wrapper */
-static inline void rx_gen_st(MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_st(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
     tcg_gen_qemu_st_i32(reg, mem, 0, size | MO_TE);
 }
@@ -417,12 +417,12 @@ static void move_to_cr(DisasContext *ctx, TCGv val, int cr)
 static void push(DisasContext *ctx, TCGv val)
 {
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
-    rx_gen_st(MO_32, val, cpu_sp);
+    rx_gen_st(ctx, MO_32, val, cpu_sp);
 }
 
 static void pop(DisasContext *ctx, TCGv ret)
 {
-    rx_gen_ld(MO_32, ret, cpu_sp);
+    rx_gen_ld(ctx, MO_32, ret, cpu_sp);
     tcg_gen_addi_i32(cpu_sp, cpu_sp, 4);
 }
 
@@ -432,7 +432,7 @@ static bool trans_MOV_rm(DisasContext *ctx, arg_MOV_rm *a)
     TCGv mem;
     mem = tcg_temp_new();
     tcg_gen_addi_i32(mem, cpu_regs[a->rd], a->dsp << a->sz);
-    rx_gen_st(a->sz, cpu_regs[a->rs], mem);
+    rx_gen_st(ctx, a->sz, cpu_regs[a->rs], mem);
     return true;
 }
 
@@ -442,7 +442,7 @@ static bool trans_MOV_mr(DisasContext *ctx, arg_MOV_mr *a)
     TCGv mem;
     mem = tcg_temp_new();
     tcg_gen_addi_i32(mem, cpu_regs[a->rs], a->dsp << a->sz);
-    rx_gen_ld(a->sz, cpu_regs[a->rd], mem);
+    rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
 }
 
@@ -463,7 +463,7 @@ static bool trans_MOV_im(DisasContext *ctx, arg_MOV_im *a)
     imm = tcg_constant_i32(a->imm);
     mem = tcg_temp_new();
     tcg_gen_addi_i32(mem, cpu_regs[a->rd], a->dsp << a->sz);
-    rx_gen_st(a->sz, imm, mem);
+    rx_gen_st(ctx, a->sz, imm, mem);
     return true;
 }
 
@@ -473,7 +473,7 @@ static bool trans_MOV_ar(DisasContext *ctx, arg_MOV_ar *a)
     TCGv mem;
     mem = tcg_temp_new();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
-    rx_gen_ld(a->sz, cpu_regs[a->rd], mem);
+    rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
 }
 
@@ -483,7 +483,7 @@ static bool trans_MOV_ra(DisasContext *ctx, arg_MOV_ra *a)
     TCGv mem;
     mem = tcg_temp_new();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
-    rx_gen_st(a->sz, cpu_regs[a->rs], mem);
+    rx_gen_st(ctx, a->sz, cpu_regs[a->rs], mem);
     return true;
 }
 
@@ -505,18 +505,18 @@ static bool trans_MOV_mm(DisasContext *ctx, arg_MOV_mm *a)
     if (a->lds == 3) {
         /* mov.<bwl> rs,dsp[rd] */
         addr = rx_index_addr(ctx, mem, a->ldd, a->sz, a->rs);
-        rx_gen_st(a->sz, cpu_regs[a->rd], addr);
+        rx_gen_st(ctx, a->sz, cpu_regs[a->rd], addr);
     } else if (a->ldd == 3) {
         /* mov.<bwl> dsp[rs],rd */
         addr = rx_index_addr(ctx, mem, a->lds, a->sz, a->rs);
-        rx_gen_ld(a->sz, cpu_regs[a->rd], addr);
+        rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], addr);
     } else {
         /* mov.<bwl> dsp[rs],dsp[rd] */
         tmp = tcg_temp_new();
         addr = rx_index_addr(ctx, mem, a->lds, a->sz, a->rs);
-        rx_gen_ld(a->sz, tmp, addr);
+        rx_gen_ld(ctx, a->sz, tmp, addr);
         addr = rx_index_addr(ctx, mem, a->ldd, a->sz, a->rd);
-        rx_gen_st(a->sz, tmp, addr);
+        rx_gen_st(ctx, a->sz, tmp, addr);
     }
     return true;
 }
@@ -531,7 +531,7 @@ static bool trans_MOV_rp(DisasContext *ctx, arg_MOV_rp *a)
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
-    rx_gen_st(a->sz, val, cpu_regs[a->rd]);
+    rx_gen_st(ctx, a->sz, val, cpu_regs[a->rd]);
     if (a->ad == 0) {
         tcg_gen_addi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
@@ -547,7 +547,7 @@ static bool trans_MOV_pr(DisasContext *ctx, arg_MOV_pr *a)
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
-    rx_gen_ld(a->sz, val, cpu_regs[a->rd]);
+    rx_gen_ld(ctx, a->sz, val, cpu_regs[a->rd]);
     if (a->ad == 0) {
         tcg_gen_addi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
@@ -562,7 +562,7 @@ static bool trans_MOVU_mr(DisasContext *ctx, arg_MOVU_mr *a)
     TCGv mem;
     mem = tcg_temp_new();
     tcg_gen_addi_i32(mem, cpu_regs[a->rs], a->dsp << a->sz);
-    rx_gen_ldu(a->sz, cpu_regs[a->rd], mem);
+    rx_gen_ldu(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
 }
 
@@ -579,7 +579,7 @@ static bool trans_MOVU_ar(DisasContext *ctx, arg_MOVU_ar *a)
     TCGv mem;
     mem = tcg_temp_new();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
-    rx_gen_ldu(a->sz, cpu_regs[a->rd], mem);
+    rx_gen_ldu(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
 }
 
@@ -592,7 +592,7 @@ static bool trans_MOVU_pr(DisasContext *ctx, arg_MOVU_pr *a)
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
-    rx_gen_ldu(a->sz, val, cpu_regs[a->rd]);
+    rx_gen_ldu(ctx, a->sz, val, cpu_regs[a->rd]);
     if (a->ad == 0) {
         tcg_gen_addi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
@@ -647,7 +647,7 @@ static bool trans_PUSH_r(DisasContext *ctx, arg_PUSH_r *a)
     val = tcg_temp_new();
     tcg_gen_mov_i32(val, cpu_regs[a->rs]);
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
-    rx_gen_st(a->sz, val, cpu_sp);
+    rx_gen_st(ctx, a->sz, val, cpu_sp);
     return true;
 }
 
@@ -658,9 +658,9 @@ static bool trans_PUSH_m(DisasContext *ctx, arg_PUSH_m *a)
     mem = tcg_temp_new();
     val = tcg_temp_new();
     addr = rx_index_addr(ctx, mem, a->ld, a->sz, a->rs);
-    rx_gen_ld(a->sz, val, addr);
+    rx_gen_ld(ctx, a->sz, val, addr);
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
-    rx_gen_st(a->sz, val, cpu_sp);
+    rx_gen_st(ctx, a->sz, val, cpu_sp);
     return true;
 }
 
@@ -761,7 +761,7 @@ static bool trans_SCCnd(DisasContext *ctx, arg_SCCnd *a)
         mem = tcg_temp_new();
         tcg_gen_setcondi_i32(dc.cond, val, dc.value, 0);
         addr = rx_index_addr(ctx, mem, a->sz, a->ld, a->rd);
-        rx_gen_st(a->sz, val, addr);
+        rx_gen_st(ctx, a->sz, val, addr);
     } else {
         tcg_gen_setcondi_i32(dc.cond, cpu_regs[a->rd], dc.value, 0);
     }
@@ -1898,25 +1898,25 @@ static void rx_bsetm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
-    rx_gen_ld(MO_8, val, mem);
+    rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_or_i32(val, val, mask);
-    rx_gen_st(MO_8, val, mem);
+    rx_gen_st(ctx, MO_8, val, mem);
 }
 
 static void rx_bclrm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
-    rx_gen_ld(MO_8, val, mem);
+    rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_andc_i32(val, val, mask);
-    rx_gen_st(MO_8, val, mem);
+    rx_gen_st(ctx, MO_8, val, mem);
 }
 
 static void rx_btstm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
-    rx_gen_ld(MO_8, val, mem);
+    rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_and_i32(val, val, mask);
     tcg_gen_setcondi_i32(TCG_COND_NE, cpu_psw_c, val, 0);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
@@ -1926,9 +1926,9 @@ static void rx_bnotm(DisasContext *ctx, TCGv mem, TCGv mask)
 {
     TCGv val;
     val = tcg_temp_new();
-    rx_gen_ld(MO_8, val, mem);
+    rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_xor_i32(val, val, mask);
-    rx_gen_st(MO_8, val, mem);
+    rx_gen_st(ctx, MO_8, val, mem);
 }
 
 static void rx_bsetr(DisasContext *ctx, TCGv reg, TCGv mask)
@@ -2023,9 +2023,9 @@ static bool trans_BMCnd_im(DisasContext *ctx, arg_BMCnd_im *a)
     val = tcg_temp_new();
     mem = tcg_temp_new();
     addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rd);
-    rx_gen_ld(MO_8, val, addr);
+    rx_gen_ld(ctx, MO_8, val, addr);
     bmcnd_op(val, a->cd, a->imm);
-    rx_gen_st(MO_8, val, addr);
+    rx_gen_st(ctx, MO_8, val, addr);
     return true;
 }
 

From cb8e4556d584c89e58fcff1757df7e2bf2553a3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:55:33 +0200
Subject: [PATCH 1387/2396] target/rx: Factor mo_endian() helper out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-7-philmd@linaro.org>
---
 target/rx/translate.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 3c7bcc9933..6ed7ef629f 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -72,6 +72,11 @@ static TCGv_i64 cpu_acc;
 
 #define cpu_sp cpu_regs[0]
 
+static inline MemOp mo_endian(DisasContext *dc)
+{
+    return MO_TE;
+}
+
 /* decoder helper */
 static uint32_t decode_load_bytes(DisasContext *ctx, uint32_t insn,
                                   int i, int n)
@@ -163,19 +168,19 @@ static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 /* generic load wrapper */
 static inline void rx_gen_ld(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
-    tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | MO_TE);
+    tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | mo_endian(ctx));
 }
 
 /* unsigned load wrapper */
 static inline void rx_gen_ldu(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
-    tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_TE);
+    tcg_gen_qemu_ld_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* generic store wrapper */
 static inline void rx_gen_st(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
 {
-    tcg_gen_qemu_st_i32(reg, mem, 0, size | MO_TE);
+    tcg_gen_qemu_st_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* [ri, rb] */
@@ -226,7 +231,7 @@ static inline TCGv rx_load_source(DisasContext *ctx, TCGv mem,
     if (ld < 3) {
         mop = mi_to_mop(mi);
         addr = rx_index_addr(ctx, mem, ld, mop & MO_SIZE, rs);
-        tcg_gen_qemu_ld_i32(mem, addr, 0, mop | MO_TE);
+        tcg_gen_qemu_ld_i32(mem, addr, 0, mop | mo_endian(ctx));
         return mem;
     } else {
         return cpu_regs[rs];

From f9903a8a23ec14a8bef1d9af908e505c44b977af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:55:50 +0200
Subject: [PATCH 1388/2396] target/rx: Replace MO_TE -> MO_LE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We only build the RX targets using little endianness order:

  $ git grep TARGET_BIG_ENDIAN configs/targets/rx-*
  $

Therefore the MO_TE definition always expands to MO_LE.
Use the latter to simplify.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-8-philmd@linaro.org>
---
 target/rx/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 6ed7ef629f..f2168243c8 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -74,7 +74,7 @@ static TCGv_i64 cpu_acc;
 
 static inline MemOp mo_endian(DisasContext *dc)
 {
-    return MO_TE;
+    return MO_LE;
 }
 
 /* decoder helper */

From 86114e43ffda717c0ed4225e5d5ddf315e930835 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 16:57:11 +0200
Subject: [PATCH 1389/2396] target/rx: Expand TCG register definitions for
 32-bit target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The RX target is only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/rx-*
  configs/targets/rx-softmmu.mak:5:TARGET_LONG_BITS=32

Therefore target_ulong always expands to uint32_t.

Replace and adapt the API uses mechanically:

  TCGv -> TCGv_i32
  tcg_temp_new -> tcg_temp_new_i32

There is no functional change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009151607.26278-9-philmd@linaro.org>
---
 target/rx/translate.c | 326 +++++++++++++++++++++---------------------
 1 file changed, 165 insertions(+), 161 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index f2168243c8..55285d8166 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -40,8 +40,8 @@ typedef struct DisasContext {
 } DisasContext;
 
 typedef struct DisasCompare {
-    TCGv value;
-    TCGv temp;
+    TCGv_i32 value;
+    TCGv_i32 temp;
     TCGCond cond;
 } DisasCompare;
 
@@ -63,11 +63,11 @@ const char *rx_crname(uint8_t cr)
 #define DISAS_EXIT    DISAS_TARGET_2
 
 /* global register indexes */
-static TCGv cpu_regs[16];
-static TCGv cpu_psw_o, cpu_psw_s, cpu_psw_z, cpu_psw_c;
-static TCGv cpu_psw_i, cpu_psw_pm, cpu_psw_u, cpu_psw_ipl;
-static TCGv cpu_usp, cpu_fpsw, cpu_bpsw, cpu_bpc, cpu_isp;
-static TCGv cpu_fintv, cpu_intb, cpu_pc;
+static TCGv_i32 cpu_regs[16];
+static TCGv_i32 cpu_psw_o, cpu_psw_s, cpu_psw_z, cpu_psw_c;
+static TCGv_i32 cpu_psw_i, cpu_psw_pm, cpu_psw_u, cpu_psw_ipl;
+static TCGv_i32 cpu_usp, cpu_fpsw, cpu_bpsw, cpu_bpc, cpu_isp;
+static TCGv_i32 cpu_fintv, cpu_intb, cpu_pc;
 static TCGv_i64 cpu_acc;
 
 #define cpu_sp cpu_regs[0]
@@ -166,25 +166,28 @@ static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 }
 
 /* generic load wrapper */
-static inline void rx_gen_ld(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_ld(DisasContext *ctx, MemOp size,
+                             TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | mo_endian(ctx));
 }
 
 /* unsigned load wrapper */
-static inline void rx_gen_ldu(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_ldu(DisasContext *ctx, MemOp size,
+                              TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* generic store wrapper */
-static inline void rx_gen_st(DisasContext *ctx, MemOp size, TCGv reg, TCGv mem)
+static inline void rx_gen_st(DisasContext *ctx, MemOp size,
+                             TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_st_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* [ri, rb] */
-static inline void rx_gen_regindex(DisasContext *ctx, TCGv mem,
+static inline void rx_gen_regindex(DisasContext *ctx, TCGv_i32 mem,
                                    int size, int ri, int rb)
 {
     tcg_gen_shli_i32(mem, cpu_regs[ri], size);
@@ -192,7 +195,7 @@ static inline void rx_gen_regindex(DisasContext *ctx, TCGv mem,
 }
 
 /* dsp[reg] */
-static inline TCGv rx_index_addr(DisasContext *ctx, TCGv mem,
+static inline TCGv_i32 rx_index_addr(DisasContext *ctx, TCGv_i32 mem,
                                  int ld, int size, int reg)
 {
     uint32_t dsp;
@@ -223,10 +226,10 @@ static inline MemOp mi_to_mop(unsigned mi)
 }
 
 /* load source operand */
-static inline TCGv rx_load_source(DisasContext *ctx, TCGv mem,
+static inline TCGv_i32 rx_load_source(DisasContext *ctx, TCGv_i32 mem,
                                   int ld, int mi, int rs)
 {
-    TCGv addr;
+    TCGv_i32 addr;
     MemOp mop;
     if (ld < 3) {
         mop = mi_to_mop(mi);
@@ -320,7 +323,7 @@ static void psw_cond(DisasCompare *dc, uint32_t cond)
     }
 }
 
-static void move_from_cr(DisasContext *ctx, TCGv ret, int cr, uint32_t pc)
+static void move_from_cr(DisasContext *ctx, TCGv_i32 ret, int cr, uint32_t pc)
 {
     switch (cr) {
     case 0:     /* PSW */
@@ -366,7 +369,7 @@ static void move_from_cr(DisasContext *ctx, TCGv ret, int cr, uint32_t pc)
     }
 }
 
-static void move_to_cr(DisasContext *ctx, TCGv val, int cr)
+static void move_to_cr(DisasContext *ctx, TCGv_i32 val, int cr)
 {
     if (cr >= 8 && !is_privileged(ctx, 0)) {
         /* Some control registers can only be written in privileged mode. */
@@ -419,13 +422,13 @@ static void move_to_cr(DisasContext *ctx, TCGv val, int cr)
     }
 }
 
-static void push(DisasContext *ctx, TCGv val)
+static void push(DisasContext *ctx, TCGv_i32 val)
 {
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
     rx_gen_st(ctx, MO_32, val, cpu_sp);
 }
 
-static void pop(DisasContext *ctx, TCGv ret)
+static void pop(DisasContext *ctx, TCGv_i32 ret)
 {
     rx_gen_ld(ctx, MO_32, ret, cpu_sp);
     tcg_gen_addi_i32(cpu_sp, cpu_sp, 4);
@@ -434,8 +437,8 @@ static void pop(DisasContext *ctx, TCGv ret)
 /* mov.<bwl> rs,dsp5[rd] */
 static bool trans_MOV_rm(DisasContext *ctx, arg_MOV_rm *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     tcg_gen_addi_i32(mem, cpu_regs[a->rd], a->dsp << a->sz);
     rx_gen_st(ctx, a->sz, cpu_regs[a->rs], mem);
     return true;
@@ -444,8 +447,8 @@ static bool trans_MOV_rm(DisasContext *ctx, arg_MOV_rm *a)
 /* mov.<bwl> dsp5[rs],rd */
 static bool trans_MOV_mr(DisasContext *ctx, arg_MOV_mr *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     tcg_gen_addi_i32(mem, cpu_regs[a->rs], a->dsp << a->sz);
     rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
@@ -464,9 +467,9 @@ static bool trans_MOV_ir(DisasContext *ctx, arg_MOV_ir *a)
 /* mov.<bwl> #imm, dsp[rd] */
 static bool trans_MOV_im(DisasContext *ctx, arg_MOV_im *a)
 {
-    TCGv imm, mem;
+    TCGv_i32 imm, mem;
     imm = tcg_constant_i32(a->imm);
-    mem = tcg_temp_new();
+    mem = tcg_temp_new_i32();
     tcg_gen_addi_i32(mem, cpu_regs[a->rd], a->dsp << a->sz);
     rx_gen_st(ctx, a->sz, imm, mem);
     return true;
@@ -475,8 +478,8 @@ static bool trans_MOV_im(DisasContext *ctx, arg_MOV_im *a)
 /* mov.<bwl> [ri,rb],rd */
 static bool trans_MOV_ar(DisasContext *ctx, arg_MOV_ar *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
     rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
@@ -485,8 +488,8 @@ static bool trans_MOV_ar(DisasContext *ctx, arg_MOV_ar *a)
 /* mov.<bwl> rd,[ri,rb] */
 static bool trans_MOV_ra(DisasContext *ctx, arg_MOV_ra *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
     rx_gen_st(ctx, a->sz, cpu_regs[a->rs], mem);
     return true;
@@ -498,7 +501,7 @@ static bool trans_MOV_ra(DisasContext *ctx, arg_MOV_ra *a)
 /* mov.<bwl> rs,rd */
 static bool trans_MOV_mm(DisasContext *ctx, arg_MOV_mm *a)
 {
-    TCGv tmp, mem, addr;
+    TCGv_i32 tmp, mem, addr;
 
     if (a->lds == 3 && a->ldd == 3) {
         /* mov.<bwl> rs,rd */
@@ -506,7 +509,7 @@ static bool trans_MOV_mm(DisasContext *ctx, arg_MOV_mm *a)
         return true;
     }
 
-    mem = tcg_temp_new();
+    mem = tcg_temp_new_i32();
     if (a->lds == 3) {
         /* mov.<bwl> rs,dsp[rd] */
         addr = rx_index_addr(ctx, mem, a->ldd, a->sz, a->rs);
@@ -517,7 +520,7 @@ static bool trans_MOV_mm(DisasContext *ctx, arg_MOV_mm *a)
         rx_gen_ld(ctx, a->sz, cpu_regs[a->rd], addr);
     } else {
         /* mov.<bwl> dsp[rs],dsp[rd] */
-        tmp = tcg_temp_new();
+        tmp = tcg_temp_new_i32();
         addr = rx_index_addr(ctx, mem, a->lds, a->sz, a->rs);
         rx_gen_ld(ctx, a->sz, tmp, addr);
         addr = rx_index_addr(ctx, mem, a->ldd, a->sz, a->rd);
@@ -530,8 +533,8 @@ static bool trans_MOV_mm(DisasContext *ctx, arg_MOV_mm *a)
 /* mov.<bwl> rs,[-rd] */
 static bool trans_MOV_rp(DisasContext *ctx, arg_MOV_rp *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     tcg_gen_mov_i32(val, cpu_regs[a->rs]);
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
@@ -547,8 +550,8 @@ static bool trans_MOV_rp(DisasContext *ctx, arg_MOV_rp *a)
 /* mov.<bwl> [-rd],rs */
 static bool trans_MOV_pr(DisasContext *ctx, arg_MOV_pr *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
@@ -564,8 +567,8 @@ static bool trans_MOV_pr(DisasContext *ctx, arg_MOV_pr *a)
 /* movu.<bw> dsp[rs],rd */
 static bool trans_MOVU_mr(DisasContext *ctx, arg_MOVU_mr *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     tcg_gen_addi_i32(mem, cpu_regs[a->rs], a->dsp << a->sz);
     rx_gen_ldu(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
@@ -581,8 +584,8 @@ static bool trans_MOVU_rr(DisasContext *ctx, arg_MOVU_rr *a)
 /* movu.<bw> [ri,rb],rd */
 static bool trans_MOVU_ar(DisasContext *ctx, arg_MOVU_ar *a)
 {
-    TCGv mem;
-    mem = tcg_temp_new();
+    TCGv_i32 mem;
+    mem = tcg_temp_new_i32();
     rx_gen_regindex(ctx, mem, a->sz, a->ri, a->rb);
     rx_gen_ldu(ctx, a->sz, cpu_regs[a->rd], mem);
     return true;
@@ -592,8 +595,8 @@ static bool trans_MOVU_ar(DisasContext *ctx, arg_MOVU_ar *a)
 /* mov.<bw> [-rd],rs */
 static bool trans_MOVU_pr(DisasContext *ctx, arg_MOVU_pr *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     if (a->ad == 1) {
         tcg_gen_subi_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1 << a->sz);
     }
@@ -622,8 +625,8 @@ static bool trans_POP(DisasContext *ctx, arg_POP *a)
 /* popc cr */
 static bool trans_POPC(DisasContext *ctx, arg_POPC *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     pop(ctx, val);
     move_to_cr(ctx, val, a->cr);
     return true;
@@ -648,8 +651,8 @@ static bool trans_POPM(DisasContext *ctx, arg_POPM *a)
 /* push.<bwl> rs */
 static bool trans_PUSH_r(DisasContext *ctx, arg_PUSH_r *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     tcg_gen_mov_i32(val, cpu_regs[a->rs]);
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
     rx_gen_st(ctx, a->sz, val, cpu_sp);
@@ -659,9 +662,9 @@ static bool trans_PUSH_r(DisasContext *ctx, arg_PUSH_r *a)
 /* push.<bwl> dsp[rs] */
 static bool trans_PUSH_m(DisasContext *ctx, arg_PUSH_m *a)
 {
-    TCGv mem, val, addr;
-    mem = tcg_temp_new();
-    val = tcg_temp_new();
+    TCGv_i32 mem, val, addr;
+    mem = tcg_temp_new_i32();
+    val = tcg_temp_new_i32();
     addr = rx_index_addr(ctx, mem, a->ld, a->sz, a->rs);
     rx_gen_ld(ctx, a->sz, val, addr);
     tcg_gen_subi_i32(cpu_sp, cpu_sp, 4);
@@ -672,8 +675,8 @@ static bool trans_PUSH_m(DisasContext *ctx, arg_PUSH_m *a)
 /* pushc rx */
 static bool trans_PUSHC(DisasContext *ctx, arg_PUSHC *a)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     move_from_cr(ctx, val, a->cr, ctx->pc);
     push(ctx, val);
     return true;
@@ -698,8 +701,8 @@ static bool trans_PUSHM(DisasContext *ctx, arg_PUSHM *a)
 /* xchg rs,rd */
 static bool trans_XCHG_rr(DisasContext *ctx, arg_XCHG_rr *a)
 {
-    TCGv tmp;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp;
+    tmp = tcg_temp_new_i32();
     tcg_gen_mov_i32(tmp, cpu_regs[a->rs]);
     tcg_gen_mov_i32(cpu_regs[a->rs], cpu_regs[a->rd]);
     tcg_gen_mov_i32(cpu_regs[a->rd], tmp);
@@ -709,8 +712,8 @@ static bool trans_XCHG_rr(DisasContext *ctx, arg_XCHG_rr *a)
 /* xchg dsp[rs].<mi>,rd */
 static bool trans_XCHG_mr(DisasContext *ctx, arg_XCHG_mr *a)
 {
-    TCGv mem, addr;
-    mem = tcg_temp_new();
+    TCGv_i32 mem, addr;
+    mem = tcg_temp_new_i32();
     switch (a->mi) {
     case 0: /* dsp[rs].b */
     case 1: /* dsp[rs].w */
@@ -731,8 +734,8 @@ static bool trans_XCHG_mr(DisasContext *ctx, arg_XCHG_mr *a)
 
 static inline void stcond(TCGCond cond, int rd, int imm)
 {
-    TCGv z;
-    TCGv _imm;
+    TCGv_i32 z;
+    TCGv_i32 _imm;
     z = tcg_constant_i32(0);
     _imm = tcg_constant_i32(imm);
     tcg_gen_movcond_i32(cond, cpu_regs[rd], cpu_psw_z, z,
@@ -758,12 +761,12 @@ static bool trans_STNZ(DisasContext *ctx, arg_STNZ *a)
 static bool trans_SCCnd(DisasContext *ctx, arg_SCCnd *a)
 {
     DisasCompare dc;
-    TCGv val, mem, addr;
-    dc.temp = tcg_temp_new();
+    TCGv_i32 val, mem, addr;
+    dc.temp = tcg_temp_new_i32();
     psw_cond(&dc, a->cd);
     if (a->ld < 3) {
-        val = tcg_temp_new();
-        mem = tcg_temp_new();
+        val = tcg_temp_new_i32();
+        mem = tcg_temp_new_i32();
         tcg_gen_setcondi_i32(dc.cond, val, dc.value, 0);
         addr = rx_index_addr(ctx, mem, a->sz, a->ld, a->rd);
         rx_gen_st(ctx, a->sz, val, addr);
@@ -804,8 +807,8 @@ static bool trans_RTSD_irr(DisasContext *ctx, arg_RTSD_irr *a)
     return true;
 }
 
-typedef void (*op2fn)(TCGv ret, TCGv arg1);
-typedef void (*op3fn)(TCGv ret, TCGv arg1, TCGv arg2);
+typedef void (*op2fn)(TCGv_i32 ret, TCGv_i32 arg1);
+typedef void (*op3fn)(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2);
 
 static inline void rx_gen_op_rr(op2fn opr, int dst, int src)
 {
@@ -819,20 +822,20 @@ static inline void rx_gen_op_rrr(op3fn opr, int dst, int src, int src2)
 
 static inline void rx_gen_op_irr(op3fn opr, int dst, int src, uint32_t src2)
 {
-    TCGv imm = tcg_constant_i32(src2);
+    TCGv_i32 imm = tcg_constant_i32(src2);
     opr(cpu_regs[dst], cpu_regs[src], imm);
 }
 
 static inline void rx_gen_op_mr(op3fn opr, DisasContext *ctx,
                                 int dst, int src, int ld, int mi)
 {
-    TCGv val, mem;
-    mem = tcg_temp_new();
+    TCGv_i32 val, mem;
+    mem = tcg_temp_new_i32();
     val = rx_load_source(ctx, mem, ld, mi, src);
     opr(cpu_regs[dst], cpu_regs[dst], val);
 }
 
-static void rx_and(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_and(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     tcg_gen_and_i32(cpu_psw_s, arg1, arg2);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_s);
@@ -862,7 +865,7 @@ static bool trans_AND_rrr(DisasContext *ctx, arg_AND_rrr *a)
     return true;
 }
 
-static void rx_or(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_or(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     tcg_gen_or_i32(cpu_psw_s, arg1, arg2);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_s);
@@ -892,7 +895,7 @@ static bool trans_OR_rrr(DisasContext *ctx, arg_OR_rrr *a)
     return true;
 }
 
-static void rx_xor(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_xor(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     tcg_gen_xor_i32(cpu_psw_s, arg1, arg2);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_s);
@@ -914,7 +917,7 @@ static bool trans_XOR_mr(DisasContext *ctx, arg_XOR_mr *a)
     return true;
 }
 
-static void rx_tst(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_tst(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     tcg_gen_and_i32(cpu_psw_s, arg1, arg2);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_s);
@@ -935,7 +938,7 @@ static bool trans_TST_mr(DisasContext *ctx, arg_TST_mr *a)
     return true;
 }
 
-static void rx_not(TCGv ret, TCGv arg1)
+static void rx_not(TCGv_i32 ret, TCGv_i32 arg1)
 {
     tcg_gen_not_i32(ret, arg1);
     tcg_gen_mov_i32(cpu_psw_z, ret);
@@ -950,7 +953,7 @@ static bool trans_NOT_rr(DisasContext *ctx, arg_NOT_rr *a)
     return true;
 }
 
-static void rx_neg(TCGv ret, TCGv arg1)
+static void rx_neg(TCGv_i32 ret, TCGv_i32 arg1)
 {
     tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_psw_o, arg1, 0x80000000);
     tcg_gen_neg_i32(ret, arg1);
@@ -969,9 +972,9 @@ static bool trans_NEG_rr(DisasContext *ctx, arg_NEG_rr *a)
 }
 
 /* ret = arg1 + arg2 + psw_c */
-static void rx_adc(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_adc(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    TCGv z = tcg_constant_i32(0);
+    TCGv_i32 z = tcg_constant_i32(0);
     tcg_gen_add2_i32(cpu_psw_s, cpu_psw_c, arg1, z, cpu_psw_c, z);
     tcg_gen_add2_i32(cpu_psw_s, cpu_psw_c, cpu_psw_s, cpu_psw_c, arg2, z);
     tcg_gen_xor_i32(cpu_psw_o, cpu_psw_s, arg1);
@@ -1007,9 +1010,9 @@ static bool trans_ADC_mr(DisasContext *ctx, arg_ADC_mr *a)
 }
 
 /* ret = arg1 + arg2 */
-static void rx_add(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_add(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    TCGv z = tcg_constant_i32(0);
+    TCGv_i32 z = tcg_constant_i32(0);
     tcg_gen_add2_i32(cpu_psw_s, cpu_psw_c, arg1, z, arg2, z);
     tcg_gen_xor_i32(cpu_psw_o, cpu_psw_s, arg1);
     tcg_gen_xor_i32(cpu_psw_z, arg1, arg2);
@@ -1042,7 +1045,7 @@ static bool trans_ADD_rrr(DisasContext *ctx, arg_ADD_rrr *a)
 }
 
 /* ret = arg1 - arg2 */
-static void rx_sub(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_sub(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     tcg_gen_sub_i32(cpu_psw_s, arg1, arg2);
     tcg_gen_setcond_i32(TCG_COND_GEU, cpu_psw_c, arg1, arg2);
@@ -1056,17 +1059,17 @@ static void rx_sub(TCGv ret, TCGv arg1, TCGv arg2)
     }
 }
 
-static void rx_cmp(TCGv dummy, TCGv arg1, TCGv arg2)
+static void rx_cmp(TCGv_i32 dummy, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     rx_sub(NULL, arg1, arg2);
 }
 
 /* ret = arg1 - arg2 - !psw_c */
 /* -> ret = arg1 + ~arg2 + psw_c */
-static void rx_sbb(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_sbb(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
-    TCGv temp;
-    temp = tcg_temp_new();
+    TCGv_i32 temp;
+    temp = tcg_temp_new_i32();
     tcg_gen_not_i32(temp, arg2);
     rx_adc(ret, arg1, temp);
 }
@@ -1192,7 +1195,7 @@ static bool trans_MUL_rrr(DisasContext *ctx, arg_MUL_rrr *a)
 /* emul #imm, rd */
 static bool trans_EMUL_ir(DisasContext *ctx, arg_EMUL_ir *a)
 {
-    TCGv imm = tcg_constant_i32(a->imm);
+    TCGv_i32 imm = tcg_constant_i32(a->imm);
     if (a->rd > 14) {
         qemu_log_mask(LOG_GUEST_ERROR, "rd too large %d", a->rd);
     }
@@ -1205,11 +1208,11 @@ static bool trans_EMUL_ir(DisasContext *ctx, arg_EMUL_ir *a)
 /* emul dsp[rs], rd */
 static bool trans_EMUL_mr(DisasContext *ctx, arg_EMUL_mr *a)
 {
-    TCGv val, mem;
+    TCGv_i32 val, mem;
     if (a->rd > 14) {
         qemu_log_mask(LOG_GUEST_ERROR, "rd too large %d", a->rd);
     }
-    mem = tcg_temp_new();
+    mem = tcg_temp_new_i32();
     val = rx_load_source(ctx, mem, a->ld, a->mi, a->rs);
     tcg_gen_muls2_i32(cpu_regs[a->rd], cpu_regs[(a->rd + 1) & 15],
                       cpu_regs[a->rd], val);
@@ -1219,7 +1222,7 @@ static bool trans_EMUL_mr(DisasContext *ctx, arg_EMUL_mr *a)
 /* emulu #imm, rd */
 static bool trans_EMULU_ir(DisasContext *ctx, arg_EMULU_ir *a)
 {
-    TCGv imm = tcg_constant_i32(a->imm);
+    TCGv_i32 imm = tcg_constant_i32(a->imm);
     if (a->rd > 14) {
         qemu_log_mask(LOG_GUEST_ERROR, "rd too large %d", a->rd);
     }
@@ -1232,23 +1235,23 @@ static bool trans_EMULU_ir(DisasContext *ctx, arg_EMULU_ir *a)
 /* emulu dsp[rs], rd */
 static bool trans_EMULU_mr(DisasContext *ctx, arg_EMULU_mr *a)
 {
-    TCGv val, mem;
+    TCGv_i32 val, mem;
     if (a->rd > 14) {
         qemu_log_mask(LOG_GUEST_ERROR, "rd too large %d", a->rd);
     }
-    mem = tcg_temp_new();
+    mem = tcg_temp_new_i32();
     val = rx_load_source(ctx, mem, a->ld, a->mi, a->rs);
     tcg_gen_mulu2_i32(cpu_regs[a->rd], cpu_regs[(a->rd + 1) & 15],
                       cpu_regs[a->rd], val);
     return true;
 }
 
-static void rx_div(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_div(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     gen_helper_div(ret, tcg_env, arg1, arg2);
 }
 
-static void rx_divu(TCGv ret, TCGv arg1, TCGv arg2)
+static void rx_divu(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2)
 {
     gen_helper_divu(ret, tcg_env, arg1, arg2);
 }
@@ -1288,8 +1291,8 @@ static bool trans_DIVU_mr(DisasContext *ctx, arg_DIVU_mr *a)
 /* shll #imm:5, rs2, rd */
 static bool trans_SHLL_irr(DisasContext *ctx, arg_SHLL_irr *a)
 {
-    TCGv tmp;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp;
+    tmp = tcg_temp_new_i32();
     if (a->imm) {
         tcg_gen_sari_i32(cpu_psw_c, cpu_regs[a->rs2], 32 - a->imm);
         tcg_gen_shli_i32(cpu_regs[a->rd], cpu_regs[a->rs2], a->imm);
@@ -1311,14 +1314,14 @@ static bool trans_SHLL_irr(DisasContext *ctx, arg_SHLL_irr *a)
 static bool trans_SHLL_rr(DisasContext *ctx, arg_SHLL_rr *a)
 {
     TCGLabel *noshift, *done;
-    TCGv count, tmp;
+    TCGv_i32 count, tmp;
 
     noshift = gen_new_label();
     done = gen_new_label();
     /* if (cpu_regs[a->rs]) { */
     tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_regs[a->rs], 0, noshift);
-    count = tcg_temp_new();
-    tmp = tcg_temp_new();
+    count = tcg_temp_new_i32();
+    tmp = tcg_temp_new_i32();
     tcg_gen_andi_i32(tmp, cpu_regs[a->rs], 31);
     tcg_gen_sub_i32(count, tcg_constant_i32(32), tmp);
     tcg_gen_sar_i32(cpu_psw_c, cpu_regs[a->rd], count);
@@ -1342,7 +1345,7 @@ static bool trans_SHLL_rr(DisasContext *ctx, arg_SHLL_rr *a)
 static inline void shiftr_imm(uint32_t rd, uint32_t rs, uint32_t imm,
                               unsigned int alith)
 {
-    static void (* const gen_sXri[])(TCGv ret, TCGv arg1, int arg2) = {
+    static void (* const gen_sXri[])(TCGv_i32 ret, TCGv_i32 arg1, int arg2) = {
         tcg_gen_shri_i32, tcg_gen_sari_i32,
     };
     tcg_debug_assert(alith < 2);
@@ -1362,17 +1365,18 @@ static inline void shiftr_imm(uint32_t rd, uint32_t rs, uint32_t imm,
 static inline void shiftr_reg(uint32_t rd, uint32_t rs, unsigned int alith)
 {
     TCGLabel *noshift, *done;
-    TCGv count;
-    static void (* const gen_sXri[])(TCGv ret, TCGv arg1, int arg2) = {
+    TCGv_i32 count;
+    static void (* const gen_sXri[])(TCGv_i32 ret, TCGv_i32 arg1, int arg2) = {
         tcg_gen_shri_i32, tcg_gen_sari_i32,
     };
-    static void (* const gen_sXr[])(TCGv ret, TCGv arg1, TCGv arg2) = {
+    static void (* const gen_sXr[])(TCGv_i32 ret,
+                                    TCGv_i32 arg1, TCGv_i32 arg2) = {
         tcg_gen_shr_i32, tcg_gen_sar_i32,
     };
     tcg_debug_assert(alith < 2);
     noshift = gen_new_label();
     done = gen_new_label();
-    count = tcg_temp_new();
+    count = tcg_temp_new_i32();
     /* if (cpu_regs[rs]) { */
     tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_regs[rs], 0, noshift);
     tcg_gen_andi_i32(count, cpu_regs[rs], 31);
@@ -1424,8 +1428,8 @@ static bool trans_SHLR_rr(DisasContext *ctx, arg_SHLR_rr *a)
 /* rolc rd */
 static bool trans_ROLC(DisasContext *ctx, arg_ROLC *a)
 {
-    TCGv tmp;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp;
+    tmp = tcg_temp_new_i32();
     tcg_gen_shri_i32(tmp, cpu_regs[a->rd], 31);
     tcg_gen_shli_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1);
     tcg_gen_or_i32(cpu_regs[a->rd], cpu_regs[a->rd], cpu_psw_c);
@@ -1438,8 +1442,8 @@ static bool trans_ROLC(DisasContext *ctx, arg_ROLC *a)
 /* rorc rd */
 static bool trans_RORC(DisasContext *ctx, arg_RORC *a)
 {
-    TCGv tmp;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp;
+    tmp = tcg_temp_new_i32();
     tcg_gen_andi_i32(tmp, cpu_regs[a->rd], 0x00000001);
     tcg_gen_shri_i32(cpu_regs[a->rd], cpu_regs[a->rd], 1);
     tcg_gen_shli_i32(cpu_psw_c, cpu_psw_c, 31);
@@ -1514,8 +1518,8 @@ static bool trans_REVL(DisasContext *ctx, arg_REVL *a)
 /* revw rs, rd */
 static bool trans_REVW(DisasContext *ctx, arg_REVW *a)
 {
-    TCGv tmp;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp;
+    tmp = tcg_temp_new_i32();
     tcg_gen_andi_i32(tmp, cpu_regs[a->rs], 0x00ff00ff);
     tcg_gen_shli_i32(tmp, tmp, 8);
     tcg_gen_shri_i32(cpu_regs[a->rd], cpu_regs[a->rs], 8);
@@ -1532,7 +1536,7 @@ static void rx_bcnd_main(DisasContext *ctx, int cd, int dst)
 
     switch (cd) {
     case 0 ... 13:
-        dc.temp = tcg_temp_new();
+        dc.temp = tcg_temp_new_i32();
         psw_cond(&dc, cd);
         t = gen_new_label();
         done = gen_new_label();
@@ -1589,7 +1593,7 @@ static bool trans_BRA_l(DisasContext *ctx, arg_BRA_l *a)
 
 static inline void rx_save_pc(DisasContext *ctx)
 {
-    TCGv pc = tcg_constant_i32(ctx->base.pc_next);
+    TCGv_i32 pc = tcg_constant_i32(ctx->base.pc_next);
     push(ctx, pc);
 }
 
@@ -1672,7 +1676,7 @@ static bool trans_SMOVB(DisasContext *ctx, arg_SMOVB *a)
 
 #define STRING(op)                              \
     do {                                        \
-        TCGv size = tcg_constant_i32(a->sz);    \
+        TCGv_i32 size = tcg_constant_i32(a->sz);    \
         gen_helper_##op(tcg_env, size);         \
     } while (0)
 
@@ -1803,7 +1807,7 @@ static bool trans_MVTACLO(DisasContext *ctx, arg_MVTACLO *a)
 /* racw #imm */
 static bool trans_RACW(DisasContext *ctx, arg_RACW *a)
 {
-    TCGv imm = tcg_constant_i32(a->imm + 1);
+    TCGv_i32 imm = tcg_constant_i32(a->imm + 1);
     gen_helper_racw(tcg_env, imm);
     return true;
 }
@@ -1811,8 +1815,8 @@ static bool trans_RACW(DisasContext *ctx, arg_RACW *a)
 /* sat rd */
 static bool trans_SAT(DisasContext *ctx, arg_SAT *a)
 {
-    TCGv tmp, z;
-    tmp = tcg_temp_new();
+    TCGv_i32 tmp, z;
+    tmp = tcg_temp_new_i32();
     z = tcg_constant_i32(0);
     /* S == 1 -> 0xffffffff / S == 0 -> 0x00000000 */
     tcg_gen_sari_i32(tmp, cpu_psw_s, 31);
@@ -1835,7 +1839,7 @@ static bool trans_SATR(DisasContext *ctx, arg_SATR *a)
     static bool cat3(trans_, name, _ir)(DisasContext *ctx,              \
                                         cat3(arg_, name, _ir) * a)      \
     {                                                                   \
-        TCGv imm = tcg_constant_i32(li(ctx, 0));                        \
+        TCGv_i32 imm = tcg_constant_i32(li(ctx, 0));                    \
         gen_helper_##op(cpu_regs[a->rd], tcg_env,                       \
                         cpu_regs[a->rd], imm);                          \
         return true;                                                    \
@@ -1843,8 +1847,8 @@ static bool trans_SATR(DisasContext *ctx, arg_SATR *a)
     static bool cat3(trans_, name, _mr)(DisasContext *ctx,              \
                                         cat3(arg_, name, _mr) * a)      \
     {                                                                   \
-        TCGv val, mem;                                                  \
-        mem = tcg_temp_new();                                           \
+        TCGv_i32 val, mem;                                              \
+        mem = tcg_temp_new_i32();                                       \
         val = rx_load_source(ctx, mem, a->ld, MO_32, a->rs);            \
         gen_helper_##op(cpu_regs[a->rd], tcg_env,                       \
                         cpu_regs[a->rd], val);                          \
@@ -1854,8 +1858,8 @@ static bool trans_SATR(DisasContext *ctx, arg_SATR *a)
 #define FCONVOP(name, op)                                       \
     static bool trans_##name(DisasContext *ctx, arg_##name * a) \
     {                                                           \
-        TCGv val, mem;                                          \
-        mem = tcg_temp_new();                                   \
+        TCGv_i32 val, mem;                                      \
+        mem = tcg_temp_new_i32();                               \
         val = rx_load_source(ctx, mem, a->ld, MO_32, a->rs);    \
         gen_helper_##op(cpu_regs[a->rd], tcg_env, val);         \
         return true;                                            \
@@ -1869,7 +1873,7 @@ FOP(FDIV, fdiv)
 /* fcmp #imm, rd */
 static bool trans_FCMP_ir(DisasContext *ctx, arg_FCMP_ir * a)
 {
-    TCGv imm = tcg_constant_i32(li(ctx, 0));
+    TCGv_i32 imm = tcg_constant_i32(li(ctx, 0));
     gen_helper_fcmp(tcg_env, cpu_regs[a->rd], imm);
     return true;
 }
@@ -1878,8 +1882,8 @@ static bool trans_FCMP_ir(DisasContext *ctx, arg_FCMP_ir * a)
 /* fcmp rs, rd */
 static bool trans_FCMP_mr(DisasContext *ctx, arg_FCMP_mr *a)
 {
-    TCGv val, mem;
-    mem = tcg_temp_new();
+    TCGv_i32 val, mem;
+    mem = tcg_temp_new_i32();
     val = rx_load_source(ctx, mem, a->ld, MO_32, a->rs);
     gen_helper_fcmp(tcg_env, cpu_regs[a->rd], val);
     return true;
@@ -1892,70 +1896,70 @@ FCONVOP(ROUND, round)
 /* itof dsp[rs], rd */
 static bool trans_ITOF(DisasContext *ctx, arg_ITOF * a)
 {
-    TCGv val, mem;
-    mem = tcg_temp_new();
+    TCGv_i32 val, mem;
+    mem = tcg_temp_new_i32();
     val = rx_load_source(ctx, mem, a->ld, a->mi, a->rs);
     gen_helper_itof(cpu_regs[a->rd], tcg_env, val);
     return true;
 }
 
-static void rx_bsetm(DisasContext *ctx, TCGv mem, TCGv mask)
+static void rx_bsetm(DisasContext *ctx, TCGv_i32 mem, TCGv_i32 mask)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_or_i32(val, val, mask);
     rx_gen_st(ctx, MO_8, val, mem);
 }
 
-static void rx_bclrm(DisasContext *ctx, TCGv mem, TCGv mask)
+static void rx_bclrm(DisasContext *ctx, TCGv_i32 mem, TCGv_i32 mask)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_andc_i32(val, val, mask);
     rx_gen_st(ctx, MO_8, val, mem);
 }
 
-static void rx_btstm(DisasContext *ctx, TCGv mem, TCGv mask)
+static void rx_btstm(DisasContext *ctx, TCGv_i32 mem, TCGv_i32 mask)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_and_i32(val, val, mask);
     tcg_gen_setcondi_i32(TCG_COND_NE, cpu_psw_c, val, 0);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
 }
 
-static void rx_bnotm(DisasContext *ctx, TCGv mem, TCGv mask)
+static void rx_bnotm(DisasContext *ctx, TCGv_i32 mem, TCGv_i32 mask)
 {
-    TCGv val;
-    val = tcg_temp_new();
+    TCGv_i32 val;
+    val = tcg_temp_new_i32();
     rx_gen_ld(ctx, MO_8, val, mem);
     tcg_gen_xor_i32(val, val, mask);
     rx_gen_st(ctx, MO_8, val, mem);
 }
 
-static void rx_bsetr(DisasContext *ctx, TCGv reg, TCGv mask)
+static void rx_bsetr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
     tcg_gen_or_i32(reg, reg, mask);
 }
 
-static void rx_bclrr(DisasContext *ctx, TCGv reg, TCGv mask)
+static void rx_bclrr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
     tcg_gen_andc_i32(reg, reg, mask);
 }
 
-static inline void rx_btstr(DisasContext *ctx, TCGv reg, TCGv mask)
+static inline void rx_btstr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
-    TCGv t0;
-    t0 = tcg_temp_new();
+    TCGv_i32 t0;
+    t0 = tcg_temp_new_i32();
     tcg_gen_and_i32(t0, reg, mask);
     tcg_gen_setcondi_i32(TCG_COND_NE, cpu_psw_c, t0, 0);
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
 }
 
-static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
+static inline void rx_bnotr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
     tcg_gen_xor_i32(reg, reg, mask);
 }
@@ -1964,8 +1968,8 @@ static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
     static bool cat3(trans_, name, _im)(DisasContext *ctx,              \
                                         cat3(arg_, name, _im) * a)      \
     {                                                                   \
-        TCGv mask, mem, addr;                                           \
-        mem = tcg_temp_new();                                           \
+        TCGv_i32 mask, mem, addr;                                       \
+        mem = tcg_temp_new_i32();                                       \
         mask = tcg_constant_i32(1 << a->imm);                           \
         addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rs);             \
         cat3(rx_, op, m)(ctx, addr, mask);                              \
@@ -1974,7 +1978,7 @@ static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
     static bool cat3(trans_, name, _ir)(DisasContext *ctx,              \
                                         cat3(arg_, name, _ir) * a)      \
     {                                                                   \
-        TCGv mask;                                                      \
+        TCGv_i32 mask;                                                  \
         mask = tcg_constant_i32(1 << a->imm);                           \
         cat3(rx_, op, r)(ctx, cpu_regs[a->rd], mask);                   \
         return true;                                                    \
@@ -1982,9 +1986,9 @@ static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
     static bool cat3(trans_, name, _rr)(DisasContext *ctx,              \
                                         cat3(arg_, name, _rr) * a)      \
     {                                                                   \
-        TCGv mask, b;                                                   \
-        mask = tcg_temp_new();                                          \
-        b = tcg_temp_new();                                             \
+        TCGv_i32 mask, b;                                               \
+        mask = tcg_temp_new_i32();                                      \
+        b = tcg_temp_new_i32();                                         \
         tcg_gen_andi_i32(b, cpu_regs[a->rs], 31);                       \
         tcg_gen_shl_i32(mask, tcg_constant_i32(1), b);                  \
         cat3(rx_, op, r)(ctx, cpu_regs[a->rd], mask);                   \
@@ -1993,12 +1997,12 @@ static inline void rx_bnotr(DisasContext *ctx, TCGv reg, TCGv mask)
     static bool cat3(trans_, name, _rm)(DisasContext *ctx,              \
                                         cat3(arg_, name, _rm) * a)      \
     {                                                                   \
-        TCGv mask, mem, addr, b;                                        \
-        mask = tcg_temp_new();                                          \
-        b = tcg_temp_new();                                             \
+        TCGv_i32 mask, mem, addr, b;                                    \
+        mask = tcg_temp_new_i32();                                      \
+        b = tcg_temp_new_i32();                                         \
         tcg_gen_andi_i32(b, cpu_regs[a->rd], 7);                        \
         tcg_gen_shl_i32(mask, tcg_constant_i32(1), b);                  \
-        mem = tcg_temp_new();                                           \
+        mem = tcg_temp_new_i32();                                       \
         addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rs);             \
         cat3(rx_, op, m)(ctx, addr, mask);                              \
         return true;                                                    \
@@ -2009,12 +2013,12 @@ BITOP(BCLR, bclr)
 BITOP(BTST, btst)
 BITOP(BNOT, bnot)
 
-static inline void bmcnd_op(TCGv val, TCGCond cond, int pos)
+static inline void bmcnd_op(TCGv_i32 val, TCGCond cond, int pos)
 {
-    TCGv bit;
+    TCGv_i32 bit;
     DisasCompare dc;
-    dc.temp = tcg_temp_new();
-    bit = tcg_temp_new();
+    dc.temp = tcg_temp_new_i32();
+    bit = tcg_temp_new_i32();
     psw_cond(&dc, cond);
     tcg_gen_andi_i32(val, val, ~(1 << pos));
     tcg_gen_setcondi_i32(dc.cond, bit, dc.value, 0);
@@ -2024,9 +2028,9 @@ static inline void bmcnd_op(TCGv val, TCGCond cond, int pos)
 /* bmcnd #imm, dsp[rd] */
 static bool trans_BMCnd_im(DisasContext *ctx, arg_BMCnd_im *a)
 {
-    TCGv val, mem, addr;
-    val = tcg_temp_new();
-    mem = tcg_temp_new();
+    TCGv_i32 val, mem, addr;
+    val = tcg_temp_new_i32();
+    mem = tcg_temp_new_i32();
     addr = rx_index_addr(ctx, mem, a->ld, MO_8, a->rd);
     rx_gen_ld(ctx, MO_8, val, addr);
     bmcnd_op(val, a->cd, a->imm);
@@ -2118,7 +2122,7 @@ static bool trans_MVTIPL(DisasContext *ctx, arg_MVTIPL *a)
 /* mvtc #imm, rd */
 static bool trans_MVTC_i(DisasContext *ctx, arg_MVTC_i *a)
 {
-    TCGv imm;
+    TCGv_i32 imm;
 
     imm = tcg_constant_i32(a->imm);
     move_to_cr(ctx, imm, a->cr);
@@ -2142,9 +2146,9 @@ static bool trans_MVFC(DisasContext *ctx, arg_MVFC *a)
 /* rtfi */
 static bool trans_RTFI(DisasContext *ctx, arg_RTFI *a)
 {
-    TCGv psw;
+    TCGv_i32 psw;
     if (is_privileged(ctx, 1)) {
-        psw = tcg_temp_new();
+        psw = tcg_temp_new_i32();
         tcg_gen_mov_i32(cpu_pc, cpu_bpc);
         tcg_gen_mov_i32(psw, cpu_bpsw);
         gen_helper_set_psw_rte(tcg_env, psw);
@@ -2156,9 +2160,9 @@ static bool trans_RTFI(DisasContext *ctx, arg_RTFI *a)
 /* rte */
 static bool trans_RTE(DisasContext *ctx, arg_RTE *a)
 {
-    TCGv psw;
+    TCGv_i32 psw;
     if (is_privileged(ctx, 1)) {
-        psw = tcg_temp_new();
+        psw = tcg_temp_new_i32();
         pop(ctx, cpu_pc);
         pop(ctx, psw);
         gen_helper_set_psw_rte(tcg_env, psw);
@@ -2179,7 +2183,7 @@ static bool trans_BRK(DisasContext *ctx, arg_BRK *a)
 /* int #imm */
 static bool trans_INT(DisasContext *ctx, arg_INT *a)
 {
-    TCGv vec;
+    TCGv_i32 vec;
 
     tcg_debug_assert(a->imm < 0x100);
     vec = tcg_constant_i32(a->imm);

From bec018f122677a2e53b7f914c20663986faf2cf0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:56:54 +0200
Subject: [PATCH 1390/2396] target/rx: Un-inline various helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rely on the linker to optimize at linking time.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251009200012.33650-1-philmd@linaro.org>
---
 target/rx/translate.c | 51 ++++++++++++++++++++-----------------------
 1 file changed, 24 insertions(+), 27 deletions(-)

diff --git a/target/rx/translate.c b/target/rx/translate.c
index 55285d8166..ef865f14bf 100644
--- a/target/rx/translate.c
+++ b/target/rx/translate.c
@@ -166,37 +166,34 @@ static void gen_goto_tb(DisasContext *dc, unsigned tb_slot_idx, vaddr dest)
 }
 
 /* generic load wrapper */
-static inline void rx_gen_ld(DisasContext *ctx, MemOp size,
-                             TCGv_i32 reg, TCGv_i32 mem)
+static void rx_gen_ld(DisasContext *ctx, MemOp size, TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | MO_SIGN | mo_endian(ctx));
 }
 
 /* unsigned load wrapper */
-static inline void rx_gen_ldu(DisasContext *ctx, MemOp size,
-                              TCGv_i32 reg, TCGv_i32 mem)
+static void rx_gen_ldu(DisasContext *ctx, MemOp size, TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_ld_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* generic store wrapper */
-static inline void rx_gen_st(DisasContext *ctx, MemOp size,
-                             TCGv_i32 reg, TCGv_i32 mem)
+static void rx_gen_st(DisasContext *ctx, MemOp size, TCGv_i32 reg, TCGv_i32 mem)
 {
     tcg_gen_qemu_st_i32(reg, mem, 0, size | mo_endian(ctx));
 }
 
 /* [ri, rb] */
-static inline void rx_gen_regindex(DisasContext *ctx, TCGv_i32 mem,
-                                   int size, int ri, int rb)
+static void rx_gen_regindex(DisasContext *ctx, TCGv_i32 mem,
+                            int size, int ri, int rb)
 {
     tcg_gen_shli_i32(mem, cpu_regs[ri], size);
     tcg_gen_add_i32(mem, mem, cpu_regs[rb]);
 }
 
 /* dsp[reg] */
-static inline TCGv_i32 rx_index_addr(DisasContext *ctx, TCGv_i32 mem,
-                                 int ld, int size, int reg)
+static TCGv_i32 rx_index_addr(DisasContext *ctx, TCGv_i32 mem,
+                              int ld, int size, int reg)
 {
     uint32_t dsp;
 
@@ -226,8 +223,8 @@ static inline MemOp mi_to_mop(unsigned mi)
 }
 
 /* load source operand */
-static inline TCGv_i32 rx_load_source(DisasContext *ctx, TCGv_i32 mem,
-                                  int ld, int mi, int rs)
+static TCGv_i32 rx_load_source(DisasContext *ctx, TCGv_i32 mem,
+                               int ld, int mi, int rs)
 {
     TCGv_i32 addr;
     MemOp mop;
@@ -732,7 +729,7 @@ static bool trans_XCHG_mr(DisasContext *ctx, arg_XCHG_mr *a)
     return true;
 }
 
-static inline void stcond(TCGCond cond, int rd, int imm)
+static void stcond(TCGCond cond, int rd, int imm)
 {
     TCGv_i32 z;
     TCGv_i32 _imm;
@@ -810,24 +807,24 @@ static bool trans_RTSD_irr(DisasContext *ctx, arg_RTSD_irr *a)
 typedef void (*op2fn)(TCGv_i32 ret, TCGv_i32 arg1);
 typedef void (*op3fn)(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2);
 
-static inline void rx_gen_op_rr(op2fn opr, int dst, int src)
+static void rx_gen_op_rr(op2fn opr, int dst, int src)
 {
     opr(cpu_regs[dst], cpu_regs[src]);
 }
 
-static inline void rx_gen_op_rrr(op3fn opr, int dst, int src, int src2)
+static void rx_gen_op_rrr(op3fn opr, int dst, int src, int src2)
 {
     opr(cpu_regs[dst], cpu_regs[src], cpu_regs[src2]);
 }
 
-static inline void rx_gen_op_irr(op3fn opr, int dst, int src, uint32_t src2)
+static void rx_gen_op_irr(op3fn opr, int dst, int src, uint32_t src2)
 {
     TCGv_i32 imm = tcg_constant_i32(src2);
     opr(cpu_regs[dst], cpu_regs[src], imm);
 }
 
-static inline void rx_gen_op_mr(op3fn opr, DisasContext *ctx,
-                                int dst, int src, int ld, int mi)
+static void rx_gen_op_mr(op3fn opr, DisasContext *ctx,
+                         int dst, int src, int ld, int mi)
 {
     TCGv_i32 val, mem;
     mem = tcg_temp_new_i32();
@@ -1342,8 +1339,8 @@ static bool trans_SHLL_rr(DisasContext *ctx, arg_SHLL_rr *a)
     return true;
 }
 
-static inline void shiftr_imm(uint32_t rd, uint32_t rs, uint32_t imm,
-                              unsigned int alith)
+static void shiftr_imm(uint32_t rd, uint32_t rs, uint32_t imm,
+                       unsigned int alith)
 {
     static void (* const gen_sXri[])(TCGv_i32 ret, TCGv_i32 arg1, int arg2) = {
         tcg_gen_shri_i32, tcg_gen_sari_i32,
@@ -1362,7 +1359,7 @@ static inline void shiftr_imm(uint32_t rd, uint32_t rs, uint32_t imm,
     tcg_gen_mov_i32(cpu_psw_s, cpu_regs[rd]);
 }
 
-static inline void shiftr_reg(uint32_t rd, uint32_t rs, unsigned int alith)
+static void shiftr_reg(uint32_t rd, uint32_t rs, unsigned int alith)
 {
     TCGLabel *noshift, *done;
     TCGv_i32 count;
@@ -1456,7 +1453,7 @@ static bool trans_RORC(DisasContext *ctx, arg_RORC *a)
 
 enum {ROTR = 0, ROTL = 1};
 enum {ROT_IMM = 0, ROT_REG = 1};
-static inline void rx_rot(int ir, int dir, int rd, int src)
+static void rx_rot(int ir, int dir, int rd, int src)
 {
     switch (dir) {
     case ROTL:
@@ -1591,7 +1588,7 @@ static bool trans_BRA_l(DisasContext *ctx, arg_BRA_l *a)
     return true;
 }
 
-static inline void rx_save_pc(DisasContext *ctx)
+static void rx_save_pc(DisasContext *ctx)
 {
     TCGv_i32 pc = tcg_constant_i32(ctx->base.pc_next);
     push(ctx, pc);
@@ -1950,7 +1947,7 @@ static void rx_bclrr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
     tcg_gen_andc_i32(reg, reg, mask);
 }
 
-static inline void rx_btstr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
+static void rx_btstr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
     TCGv_i32 t0;
     t0 = tcg_temp_new_i32();
@@ -1959,7 +1956,7 @@ static inline void rx_btstr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
     tcg_gen_mov_i32(cpu_psw_z, cpu_psw_c);
 }
 
-static inline void rx_bnotr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
+static void rx_bnotr(DisasContext *ctx, TCGv_i32 reg, TCGv_i32 mask)
 {
     tcg_gen_xor_i32(reg, reg, mask);
 }
@@ -2013,7 +2010,7 @@ BITOP(BCLR, bclr)
 BITOP(BTST, btst)
 BITOP(BNOT, bnot)
 
-static inline void bmcnd_op(TCGv_i32 val, TCGCond cond, int pos)
+static void bmcnd_op(TCGv_i32 val, TCGCond cond, int pos)
 {
     TCGv_i32 bit;
     DisasCompare dc;
@@ -2054,7 +2051,7 @@ enum {
     PSW_U = 9,
 };
 
-static inline void clrsetpsw(DisasContext *ctx, int cb, int val)
+static void clrsetpsw(DisasContext *ctx, int cb, int val)
 {
     if (cb < 8) {
         switch (cb) {

From 6d9dad71265cda5888d4779681977c5b389730a2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 14:46:49 +0200
Subject: [PATCH 1391/2396] target/s390x: Replace HOST_BIG_ENDIAN #ifdef with
 if() check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace preprocessor-time #ifdef with a compile-time check
to ensure all code paths are built and tested. This reduces
build-time configuration complexity and simplifies code
maintainability.

No functional change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-Id: <20251010134226.72221-15-philmd@linaro.org>
---
 target/s390x/tcg/translate.c        | 6 +++---
 target/s390x/tcg/translate_vx.c.inc | 6 +++---
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index c7e8574438..ec9e5a0751 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -258,9 +258,9 @@ static inline int vec_reg_offset(uint8_t reg, uint8_t enr, MemOp es)
      * 16 byte operations to handle it in a special way.
      */
     g_assert(es <= MO_64);
-#if !HOST_BIG_ENDIAN
-    offs ^= (8 - bytes);
-#endif
+    if (!HOST_BIG_ENDIAN) {
+        offs ^= (8 - bytes);
+    }
     return offs + vec_full_reg_offset(reg);
 }
 
diff --git a/target/s390x/tcg/translate_vx.c.inc b/target/s390x/tcg/translate_vx.c.inc
index e073e5ad3a..f3b4b48ab7 100644
--- a/target/s390x/tcg/translate_vx.c.inc
+++ b/target/s390x/tcg/translate_vx.c.inc
@@ -175,9 +175,9 @@ static void get_vec_element_ptr_i64(TCGv_ptr ptr, uint8_t reg, TCGv_i64 enr,
 
     /* convert it to an element offset relative to tcg_env (vec_reg_offset() */
     tcg_gen_shli_i64(tmp, tmp, es);
-#if !HOST_BIG_ENDIAN
-    tcg_gen_xori_i64(tmp, tmp, 8 - NUM_VEC_ELEMENT_BYTES(es));
-#endif
+    if (!HOST_BIG_ENDIAN) {
+        tcg_gen_xori_i64(tmp, tmp, 8 - NUM_VEC_ELEMENT_BYTES(es));
+    }
     tcg_gen_addi_i64(tmp, tmp, vec_full_reg_offset(reg));
 
     /* generate the final ptr by adding tcg_env */

From 82a1e739010b3134862b27123684c26cd3b471e7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:34:14 +0200
Subject: [PATCH 1392/2396] target/sh4: Convert CPUSH4State::sr register to
 uint32_t type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since its introduction in commit fdf9b3e831e the %SR register
is a uint32_t type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-2-philmd@linaro.org>
---
 target/sh4/cpu.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index c41ab70dd7..db27a693f1 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -365,14 +365,14 @@ static inline int cpu_ptel_pr (uint32_t ptel)
 #define PTEA_TC        (1 << 3)
 #define cpu_ptea_tc(ptea) (((ptea) & PTEA_TC) >> 3)
 
-static inline target_ulong cpu_read_sr(CPUSH4State *env)
+static inline uint32_t cpu_read_sr(CPUSH4State *env)
 {
     return env->sr | (env->sr_m << SR_M) |
                      (env->sr_q << SR_Q) |
                      (env->sr_t << SR_T);
 }
 
-static inline void cpu_write_sr(CPUSH4State *env, target_ulong sr)
+static inline void cpu_write_sr(CPUSH4State *env, uint32_t sr)
 {
     env->sr_m = (sr >> SR_M) & 1;
     env->sr_q = (sr >> SR_Q) & 1;

From c954994968f8bb38087dcc6401560100ee3fc78c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:24:13 +0200
Subject: [PATCH 1393/2396] target/sh4: Remove target_ulong use in
 cpu_sh4_is_cached()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 852d481faf7 ("SH: Improve movca.l/ocbi emulation")
helper_movcal() pass a uint32_t type to cpu_sh4_is_cached().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-3-philmd@linaro.org>
---
 target/sh4/cpu.h    | 2 +-
 target/sh4/helper.c | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/sh4/cpu.h b/target/sh4/cpu.h
index db27a693f1..b0759010c4 100644
--- a/target/sh4/cpu.h
+++ b/target/sh4/cpu.h
@@ -277,7 +277,7 @@ void cpu_sh4_write_mmaped_utlb_data(CPUSH4State *s, hwaddr addr,
                                     uint32_t mem_value);
 #endif
 
-int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr);
+int cpu_sh4_is_cached(CPUSH4State *env, uint32_t addr);
 
 void cpu_load_tlb(CPUSH4State * env);
 
diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 1744ef0e6d..4f1e207229 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -47,7 +47,7 @@
 
 #if defined(CONFIG_USER_ONLY)
 
-int cpu_sh4_is_cached(CPUSH4State *env, target_ulong addr)
+int cpu_sh4_is_cached(CPUSH4State *env, uint32_t addr)
 {
     /* For user mode, only U0 area is cacheable. */
     return !(addr & 0x80000000);
@@ -735,7 +735,7 @@ void cpu_sh4_write_mmaped_utlb_data(CPUSH4State *s, hwaddr addr,
     }
 }
 
-int cpu_sh4_is_cached(CPUSH4State * env, target_ulong addr)
+int cpu_sh4_is_cached(CPUSH4State *env, uint32_t addr)
 {
     int n;
     int use_asid = !(env->mmucr & MMUCR_SV) || !(env->sr & (1u << SR_MD));

From b0469ec667cf8d507dd4b23b6ed9e7e7082abbeb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:28:13 +0200
Subject: [PATCH 1394/2396] target/sh4: Use hwaddr type for hardware addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CPUClass::get_phys_page_debug() handler returns a 'hwaddr' type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-4-philmd@linaro.org>
---
 target/sh4/helper.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 4f1e207229..55ab1dc994 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -325,7 +325,7 @@ static int find_utlb_entry(CPUSH4State * env, target_ulong address, int use_asid
    MMU_ITLB_MULTIPLE, MMU_ITLB_VIOLATION,
    MMU_IADDR_ERROR, MMU_DADDR_ERROR_READ, MMU_DADDR_ERROR_WRITE.
 */
-static int get_mmu_address(CPUSH4State * env, target_ulong * physical,
+static int get_mmu_address(CPUSH4State *env, hwaddr *physical,
                            int *prot, target_ulong address,
                            MMUAccessType access_type)
 {
@@ -392,7 +392,7 @@ static int get_mmu_address(CPUSH4State * env, target_ulong * physical,
     return n;
 }
 
-static int get_physical_address(CPUSH4State * env, target_ulong * physical,
+static int get_physical_address(CPUSH4State *env, hwaddr* physical,
                                 int *prot, target_ulong address,
                                 MMUAccessType access_type)
 {
@@ -433,7 +433,7 @@ static int get_physical_address(CPUSH4State * env, target_ulong * physical,
 
 hwaddr superh_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 {
-    target_ulong physical;
+    hwaddr physical;
     int prot;
 
     if (get_physical_address(cpu_env(cs), &physical, &prot, addr, MMU_DATA_LOAD)
@@ -800,7 +800,7 @@ bool superh_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     CPUSH4State *env = cpu_env(cs);
     int ret;
 
-    target_ulong physical;
+    hwaddr physical;
     int prot;
 
     ret = get_physical_address(env, &physical, &prot, address, access_type);

From 0edd1789c738af6ce825106d7f331fedf546ee77 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:32:47 +0200
Subject: [PATCH 1395/2396] target/sh4: Remove target_ulong uses in
 superh_cpu_get_phys_page_debug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CPUClass::get_phys_page_debug() handler takes a 'vaddr' address
type since commit 00b941e581b ("cpu: Turn cpu_get_phys_page_debug()
into a CPUClass hook").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-5-philmd@linaro.org>
---
 target/sh4/helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 55ab1dc994..f5c37c2d80 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -231,11 +231,11 @@ static int itlb_replacement(CPUSH4State * env)
 /* Find the corresponding entry in the right TLB
    Return entry, MMU_DTLB_MISS or MMU_DTLB_MULTIPLE
 */
-static int find_tlb_entry(CPUSH4State * env, target_ulong address,
+static int find_tlb_entry(CPUSH4State *env, vaddr address,
                           tlb_t * entries, uint8_t nbtlb, int use_asid)
 {
     int match = MMU_DTLB_MISS;
-    uint32_t start, end;
+    vaddr start, end;
     uint8_t asid;
     int i;
 
@@ -291,7 +291,7 @@ static int copy_utlb_entry_itlb(CPUSH4State *env, int utlb)
 /* Find itlb entry
    Return entry, MMU_ITLB_MISS, MMU_ITLB_MULTIPLE or MMU_DTLB_MULTIPLE
 */
-static int find_itlb_entry(CPUSH4State * env, target_ulong address,
+static int find_itlb_entry(CPUSH4State *env, vaddr address,
                            int use_asid)
 {
     int e;
@@ -309,7 +309,7 @@ static int find_itlb_entry(CPUSH4State * env, target_ulong address,
 
 /* Find utlb entry
    Return entry, MMU_DTLB_MISS, MMU_DTLB_MULTIPLE */
-static int find_utlb_entry(CPUSH4State * env, target_ulong address, int use_asid)
+static int find_utlb_entry(CPUSH4State *env, vaddr address, int use_asid)
 {
     /* per utlb access */
     increment_urc(env);
@@ -326,7 +326,7 @@ static int find_utlb_entry(CPUSH4State * env, target_ulong address, int use_asid
    MMU_IADDR_ERROR, MMU_DADDR_ERROR_READ, MMU_DADDR_ERROR_WRITE.
 */
 static int get_mmu_address(CPUSH4State *env, hwaddr *physical,
-                           int *prot, target_ulong address,
+                           int *prot, vaddr address,
                            MMUAccessType access_type)
 {
     int use_asid, n;
@@ -393,7 +393,7 @@ static int get_mmu_address(CPUSH4State *env, hwaddr *physical,
 }
 
 static int get_physical_address(CPUSH4State *env, hwaddr* physical,
-                                int *prot, target_ulong address,
+                                int *prot, vaddr address,
                                 MMUAccessType access_type)
 {
     /* P1, P2 and P4 areas do not use translation */

From 42c90609b8fd405b34e1d05fb8495068521759b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:30:09 +0200
Subject: [PATCH 1396/2396] target/sh4: Use vaddr type for TLB virtual
 addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tlb_flush_page() expects a vaddr type since commit 732d548732e
("accel: Replace target_ulong in tlb_*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-6-philmd@linaro.org>
---
 target/sh4/helper.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index f5c37c2d80..3b18a320b8 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -452,7 +452,7 @@ void cpu_load_tlb(CPUSH4State * env)
 
     if (entry->v) {
         /* Overwriting valid entry in utlb. */
-        target_ulong address = entry->vpn << 10;
+        vaddr address = entry->vpn << 10;
         tlb_flush_page(cs, address);
     }
 
@@ -528,7 +528,7 @@ void cpu_sh4_write_mmaped_itlb_addr(CPUSH4State *s, hwaddr addr,
     tlb_t * entry = &s->itlb[index];
     if (entry->v) {
         /* Overwriting valid entry in itlb. */
-        target_ulong address = entry->vpn << 10;
+        vaddr address = entry->vpn << 10;
         tlb_flush_page(env_cpu(s), address);
     }
     entry->asid = asid;
@@ -570,7 +570,7 @@ void cpu_sh4_write_mmaped_itlb_data(CPUSH4State *s, hwaddr addr,
         /* ITLB Data Array 1 */
         if (entry->v) {
             /* Overwriting valid entry in utlb. */
-            target_ulong address = entry->vpn << 10;
+            vaddr address = entry->vpn << 10;
             tlb_flush_page(env_cpu(s), address);
         }
         entry->ppn = (mem_value & 0x1ffffc00) >> 10;
@@ -665,7 +665,7 @@ void cpu_sh4_write_mmaped_utlb_addr(CPUSH4State *s, hwaddr addr,
             CPUState *cs = env_cpu(s);
 
             /* Overwriting valid entry in utlb. */
-            target_ulong address = entry->vpn << 10;
+            vaddr address = entry->vpn << 10;
             tlb_flush_page(cs, address);
         }
         entry->asid = asid;
@@ -716,7 +716,7 @@ void cpu_sh4_write_mmaped_utlb_data(CPUSH4State *s, hwaddr addr,
         /* UTLB Data Array 1 */
         if (entry->v) {
             /* Overwriting valid entry in utlb. */
-            target_ulong address = entry->vpn << 10;
+            vaddr address = entry->vpn << 10;
             tlb_flush_page(env_cpu(s), address);
         }
         entry->ppn = (mem_value & 0x1ffffc00) >> 10;

From 90470a5fcc57b29703fbab5e3ff9c05d420e39f0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 08:22:58 +0200
Subject: [PATCH 1397/2396] target/sh4: Remove target_ulong use in
 gen_goto_tb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

translator_use_goto_tb() expects a vaddr type since commit
b1c09220b4c ("accel/tcg: Replace target_ulong with vaddr in
translator_*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008064814.90520-7-philmd@linaro.org>
---
 target/sh4/translate.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/sh4/translate.c b/target/sh4/translate.c
index 137b75a4fb..b3ae0a3814 100644
--- a/target/sh4/translate.c
+++ b/target/sh4/translate.c
@@ -223,7 +223,7 @@ static inline bool use_exit_tb(DisasContext *ctx)
     return (ctx->tbflags & TB_FLAG_GUSA_EXCLUSIVE) != 0;
 }
 
-static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
+static bool use_goto_tb(DisasContext *ctx, vaddr dest)
 {
     if (use_exit_tb(ctx)) {
         return false;
@@ -231,8 +231,7 @@ static bool use_goto_tb(DisasContext *ctx, target_ulong dest)
     return translator_use_goto_tb(&ctx->base, dest);
 }
 
-static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx,
-                        target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_idx, vaddr dest)
 {
     if (use_goto_tb(ctx, dest)) {
         tcg_gen_goto_tb(tb_slot_idx);
@@ -268,7 +267,7 @@ static void gen_jump(DisasContext * ctx)
 }
 
 /* Immediate conditional jump (bt or bf) */
-static void gen_conditional_jump(DisasContext *ctx, target_ulong dest,
+static void gen_conditional_jump(DisasContext *ctx, vaddr dest,
                                  bool jump_if_true)
 {
     TCGLabel *l1 = gen_new_label();

From 7b2325470ebf9f1414ef4782f7560156e8241f7d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 16:13:32 +0200
Subject: [PATCH 1398/2396] target/sparc: Reduce inclusions of
 'exec/cpu-common.h'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only 2 files require declarations from "exec/cpu-common.h".
Include it there once, instead than polluting all files
including "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20251002145742.75624-7-philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 target/sparc/cpu.h          | 1 -
 target/sparc/helper.c       | 1 +
 target/sparc/int64_helper.c | 1 +
 3 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/sparc/cpu.h b/target/sparc/cpu.h
index 31cb3d97eb..7169a50243 100644
--- a/target/sparc/cpu.h
+++ b/target/sparc/cpu.h
@@ -3,7 +3,6 @@
 
 #include "qemu/bswap.h"
 #include "cpu-qom.h"
-#include "exec/cpu-common.h"
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "qemu/cpu-float.h"
diff --git a/target/sparc/helper.c b/target/sparc/helper.c
index 9163b9d46a..c5d88de37c 100644
--- a/target/sparc/helper.c
+++ b/target/sparc/helper.c
@@ -21,6 +21,7 @@
 #include "cpu.h"
 #include "qemu/timer.h"
 #include "qemu/host-utils.h"
+#include "exec/cpu-common.h"
 #include "exec/helper-proto.h"
 
 void cpu_raise_exception_ra(CPUSPARCState *env, int tt, uintptr_t ra)
diff --git a/target/sparc/int64_helper.c b/target/sparc/int64_helper.c
index 23adda4cad..96ef81c26c 100644
--- a/target/sparc/int64_helper.c
+++ b/target/sparc/int64_helper.c
@@ -20,6 +20,7 @@
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
 #include "cpu.h"
+#include "exec/cpu-common.h"
 #include "exec/helper-proto.h"
 #include "exec/log.h"
 #include "trace.h"

From 809b460f30501fac008c13f23e6c0c127b8260bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:19:33 +0200
Subject: [PATCH 1399/2396] target/tricore: Remove target_ulong use in
 gen_goto_tb()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

translator_use_goto_tb() expects a vaddr type since commit
b1c09220b4c ("accel/tcg: Replace target_ulong with vaddr in
translator_*()").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-2-philmd@linaro.org>
---
 target/tricore/translate.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 7c6e309597..dd09f0651f 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -72,7 +72,8 @@ static const char *regnames_d[] = {
 
 typedef struct DisasContext {
     DisasContextBase base;
-    target_ulong pc_succ_insn;
+
+    vaddr pc_succ_insn;
     uint32_t opcode;
     /* Routine used to access memory */
     int mem_idx;
@@ -2811,13 +2812,12 @@ static void gen_calc_usb_mulr_h(TCGv arg)
 
 /* helpers for generating program flow micro-ops */
 
-static inline void gen_save_pc(target_ulong pc)
+static inline void gen_save_pc(vaddr pc)
 {
     tcg_gen_movi_tl(cpu_PC, pc);
 }
 
-static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_index,
-                        target_ulong dest)
+static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_index, vaddr dest)
 {
     if (translator_use_goto_tb(&ctx->base, dest)) {
         tcg_gen_goto_tb(tb_slot_index);

From 0d5f95425614ba5281177f76ab438756d8213317 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:23:57 +0200
Subject: [PATCH 1400/2396] target/tricore: Replace target_ulong -> vaddr with
 tlb_fill() callees
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

tlb_fill() provides a vaddr type since commit 68d6eee73c
("target/tricore: Convert to CPUClass::tlb_fill").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-3-philmd@linaro.org>
---
 target/tricore/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index e4c53d453d..7574111c87 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -35,7 +35,7 @@ enum {
 };
 
 static int get_physical_address(CPUTriCoreState *env, hwaddr *physical,
-                                int *prot, target_ulong address,
+                                int *prot, vaddr address,
                                 MMUAccessType access_type, int mmu_idx)
 {
     int ret = TLBRET_MATCH;
@@ -61,7 +61,7 @@ hwaddr tricore_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)
 }
 
 /* TODO: Add exception support */
-static void raise_mmu_exception(CPUTriCoreState *env, target_ulong address,
+static void raise_mmu_exception(CPUTriCoreState *env, vaddr address,
                                 int rw, int tlb_error)
 {
 }

From a15e899626893b5201b7b307090148ca7ff25e66 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:44:01 +0200
Subject: [PATCH 1401/2396] target/tricore: Remove target_ulong use in
 translate_insn() handler
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 85c19af63e7 ("include/exec: Use vaddr in DisasContextBase
for virtual addresses") the DisasContextBase::pc_first field is a
vaddr type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-4-philmd@linaro.org>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index dd09f0651f..4b769b204a 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -8414,7 +8414,7 @@ static void tricore_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     ctx->base.pc_next = ctx->pc_succ_insn;
 
     if (ctx->base.is_jmp == DISAS_NEXT) {
-        target_ulong page_start;
+        vaddr page_start;
 
         page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
         if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE

From 44e2b68d275340c23f21f37f7c44e25c1b7543c9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:47:05 +0200
Subject: [PATCH 1402/2396] target/tricore: Remove target_ulong use in
 gen_addi_d()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Callers pass either int32_t or int16_t.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-5-philmd@linaro.org>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 4b769b204a..116f45135b 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -1308,7 +1308,7 @@ gen_msubui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_msubu64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void gen_addi_d(TCGv ret, TCGv r1, target_ulong r2)
+static inline void gen_addi_d(TCGv ret, TCGv r1, int32_t r2)
 {
     TCGv temp = tcg_constant_i32(r2);
     gen_add_d(ret, r1, temp);

From 30257dcd2b0b8aeefc0c4b8ee10524037111a0f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:48:50 +0200
Subject: [PATCH 1403/2396] target/tricore: Remove unnecessary cast to
 target_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-6-philmd@linaro.org>
---
 target/tricore/cpu.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/cpu.c b/target/tricore/cpu.c
index 4f035b6f76..04319e107b 100644
--- a/target/tricore/cpu.c
+++ b/target/tricore/cpu.c
@@ -37,7 +37,7 @@ static const gchar *tricore_gdb_arch_name(CPUState *cs)
 
 static void tricore_cpu_set_pc(CPUState *cs, vaddr value)
 {
-    cpu_env(cs)->PC = value & ~(target_ulong)1;
+    cpu_env(cs)->PC = value & ~1;
 }
 
 static vaddr tricore_cpu_get_pc(CPUState *cs)

From c558aa942119afb0c1a852a85be81b8f6e2c8b5b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:55:41 +0200
Subject: [PATCH 1404/2396] target/tricore: Replace target_ulong -> uint32_t in
 op_helper.c
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TriCore target is only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/tricore-*
  configs/targets/tricore-softmmu.mak:2:TARGET_LONG_BITS=32

Therefore target_ulong type always expands to uint32_t.

This is a mechanical replacement.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-7-philmd@linaro.org>
---
 target/tricore/op_helper.c | 219 +++++++++++++++++--------------------
 1 file changed, 103 insertions(+), 116 deletions(-)

diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 9910c13f4b..610f148a23 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -149,15 +149,15 @@ static uint32_t ssov32(CPUTriCoreState *env, int64_t arg)
     if (arg > max_pos) {
         env->PSW_USB_V = (1 << 31);
         env->PSW_USB_SV = (1 << 31);
-        ret = (target_ulong)max_pos;
+        ret = (uint32_t)max_pos;
     } else {
         if (arg < max_neg) {
             env->PSW_USB_V = (1 << 31);
             env->PSW_USB_SV = (1 << 31);
-            ret = (target_ulong)max_neg;
+            ret = (uint32_t)max_neg;
         } else {
             env->PSW_USB_V = 0;
-            ret = (target_ulong)arg;
+            ret = (uint32_t)arg;
         }
     }
     env->PSW_USB_AV = arg ^ arg * 2u;
@@ -172,10 +172,10 @@ static uint32_t suov32_pos(CPUTriCoreState *env, uint64_t arg)
     if (arg > max_pos) {
         env->PSW_USB_V = (1 << 31);
         env->PSW_USB_SV = (1 << 31);
-        ret = (target_ulong)max_pos;
+        ret = (uint32_t)max_pos;
     } else {
         env->PSW_USB_V = 0;
-        ret = (target_ulong)arg;
+        ret = (uint32_t)arg;
      }
     env->PSW_USB_AV = arg ^ arg * 2u;
     env->PSW_USB_SAV |= env->PSW_USB_AV;
@@ -192,7 +192,7 @@ static uint32_t suov32_neg(CPUTriCoreState *env, int64_t arg)
         ret = 0;
     } else {
         env->PSW_USB_V = 0;
-        ret = (target_ulong)arg;
+        ret = (uint32_t)arg;
     }
     env->PSW_USB_AV = arg ^ arg * 2u;
     env->PSW_USB_SAV |= env->PSW_USB_AV;
@@ -260,8 +260,7 @@ static uint32_t suov16(CPUTriCoreState *env, int32_t hw0, int32_t hw1)
     return (hw0 & 0xffff) | (hw1 << 16);
 }
 
-target_ulong helper_add_ssov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_add_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -294,8 +293,7 @@ uint64_t helper_add64_ssov(CPUTriCoreState *env, uint64_t r1, uint64_t r2)
     return result;
 }
 
-target_ulong helper_add_h_ssov(CPUTriCoreState *env, target_ulong r1,
-                               target_ulong r2)
+uint32_t helper_add_h_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t ret_hw0, ret_hw1;
 
@@ -397,8 +395,7 @@ uint32_t helper_addsur_h_ssov(CPUTriCoreState *env, uint64_t r1, uint32_t r2_l,
 }
 
 
-target_ulong helper_add_suov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_add_suov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = extract64(r1, 0, 32);
     int64_t t2 = extract64(r2, 0, 32);
@@ -406,8 +403,7 @@ target_ulong helper_add_suov(CPUTriCoreState *env, target_ulong r1,
     return suov32_pos(env, result);
 }
 
-target_ulong helper_add_h_suov(CPUTriCoreState *env, target_ulong r1,
-                               target_ulong r2)
+uint32_t helper_add_h_suov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t ret_hw0, ret_hw1;
 
@@ -416,8 +412,7 @@ target_ulong helper_add_h_suov(CPUTriCoreState *env, target_ulong r1,
     return suov16(env, ret_hw0, ret_hw1);
 }
 
-target_ulong helper_sub_ssov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_sub_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -450,8 +445,7 @@ uint64_t helper_sub64_ssov(CPUTriCoreState *env, uint64_t r1, uint64_t r2)
     return result;
 }
 
-target_ulong helper_sub_h_ssov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_sub_h_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t ret_hw0, ret_hw1;
 
@@ -552,8 +546,7 @@ uint32_t helper_subadr_h_ssov(CPUTriCoreState *env, uint64_t r1, uint32_t r2_l,
     return (result1 & 0xffff0000ULL) | ((result0 >> 16) & 0xffffULL);
 }
 
-target_ulong helper_sub_suov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_sub_suov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = extract64(r1, 0, 32);
     int64_t t2 = extract64(r2, 0, 32);
@@ -561,8 +554,7 @@ target_ulong helper_sub_suov(CPUTriCoreState *env, target_ulong r1,
     return suov32_neg(env, result);
 }
 
-target_ulong helper_sub_h_suov(CPUTriCoreState *env, target_ulong r1,
-                               target_ulong r2)
+uint32_t helper_sub_h_suov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t ret_hw0, ret_hw1;
 
@@ -571,8 +563,7 @@ target_ulong helper_sub_h_suov(CPUTriCoreState *env, target_ulong r1,
     return suov16(env, ret_hw0, ret_hw1);
 }
 
-target_ulong helper_mul_ssov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_mul_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -580,8 +571,7 @@ target_ulong helper_mul_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov32(env, result);
 }
 
-target_ulong helper_mul_suov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_mul_suov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = extract64(r1, 0, 32);
     int64_t t2 = extract64(r2, 0, 32);
@@ -590,8 +580,7 @@ target_ulong helper_mul_suov(CPUTriCoreState *env, target_ulong r1,
     return suov32_pos(env, result);
 }
 
-target_ulong helper_sha_ssov(CPUTriCoreState *env, target_ulong r1,
-                             target_ulong r2)
+uint32_t helper_sha_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int32_t t2 = sextract64(r2, 0, 6);
@@ -606,14 +595,14 @@ target_ulong helper_sha_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov32(env, result);
 }
 
-uint32_t helper_abs_ssov(CPUTriCoreState *env, target_ulong r1)
+uint32_t helper_abs_ssov(CPUTriCoreState *env, uint32_t r1)
 {
-    target_ulong result;
+    uint32_t result;
     result = ((int32_t)r1 >= 0) ? r1 : (0 - r1);
     return ssov32(env, result);
 }
 
-uint32_t helper_abs_h_ssov(CPUTriCoreState *env, target_ulong r1)
+uint32_t helper_abs_h_ssov(CPUTriCoreState *env, uint32_t r1)
 {
     int32_t ret_h0, ret_h1;
 
@@ -626,8 +615,7 @@ uint32_t helper_abs_h_ssov(CPUTriCoreState *env, target_ulong r1)
     return ssov16(env, ret_h0, ret_h1);
 }
 
-target_ulong helper_absdif_ssov(CPUTriCoreState *env, target_ulong r1,
-                                target_ulong r2)
+uint32_t helper_absdif_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -641,8 +629,7 @@ target_ulong helper_absdif_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov32(env, result);
 }
 
-uint32_t helper_absdif_h_ssov(CPUTriCoreState *env, target_ulong r1,
-                              target_ulong r2)
+uint32_t helper_absdif_h_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t t1, t2;
     int32_t ret_h0, ret_h1;
@@ -666,8 +653,8 @@ uint32_t helper_absdif_h_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov16(env, ret_h0, ret_h1);
 }
 
-target_ulong helper_madd32_ssov(CPUTriCoreState *env, target_ulong r1,
-                                target_ulong r2, target_ulong r3)
+uint32_t helper_madd32_ssov(CPUTriCoreState *env, uint32_t r1,
+                            uint32_t r2, uint32_t r3)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -678,8 +665,8 @@ target_ulong helper_madd32_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov32(env, result);
 }
 
-target_ulong helper_madd32_suov(CPUTriCoreState *env, target_ulong r1,
-                                target_ulong r2, target_ulong r3)
+uint32_t helper_madd32_suov(CPUTriCoreState *env, uint32_t r1,
+                            uint32_t r2, uint32_t r3)
 {
     uint64_t t1 = extract64(r1, 0, 32);
     uint64_t t2 = extract64(r2, 0, 32);
@@ -690,8 +677,8 @@ target_ulong helper_madd32_suov(CPUTriCoreState *env, target_ulong r1,
     return suov32_pos(env, result);
 }
 
-uint64_t helper_madd64_ssov(CPUTriCoreState *env, target_ulong r1,
-                            uint64_t r2, target_ulong r3)
+uint64_t helper_madd64_ssov(CPUTriCoreState *env, uint32_t r1,
+                            uint64_t r2, uint32_t r3)
 {
     uint64_t ret, ovf;
     int64_t t1 = sextract64(r1, 0, 32);
@@ -848,8 +835,8 @@ uint32_t helper_maddr_q_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2,
     return ret & 0xffff0000ll;
 }
 
-uint64_t helper_madd64_suov(CPUTriCoreState *env, target_ulong r1,
-                            uint64_t r2, target_ulong r3)
+uint64_t helper_madd64_suov(CPUTriCoreState *env, uint32_t r1,
+                            uint64_t r2, uint32_t r3)
 {
     uint64_t ret, mul;
     uint64_t t1 = extract64(r1, 0, 32);
@@ -873,8 +860,8 @@ uint64_t helper_madd64_suov(CPUTriCoreState *env, target_ulong r1,
     return ret;
 }
 
-target_ulong helper_msub32_ssov(CPUTriCoreState *env, target_ulong r1,
-                                target_ulong r2, target_ulong r3)
+uint32_t helper_msub32_ssov(CPUTriCoreState *env, uint32_t r1,
+                            uint32_t r2, uint32_t r3)
 {
     int64_t t1 = sextract64(r1, 0, 32);
     int64_t t2 = sextract64(r2, 0, 32);
@@ -885,8 +872,8 @@ target_ulong helper_msub32_ssov(CPUTriCoreState *env, target_ulong r1,
     return ssov32(env, result);
 }
 
-target_ulong helper_msub32_suov(CPUTriCoreState *env, target_ulong r1,
-                                target_ulong r2, target_ulong r3)
+uint32_t helper_msub32_suov(CPUTriCoreState *env, uint32_t r1,
+                            uint32_t r2, uint32_t r3)
 {
     uint64_t t1 = extract64(r1, 0, 32);
     uint64_t t2 = extract64(r2, 0, 32);
@@ -912,8 +899,8 @@ target_ulong helper_msub32_suov(CPUTriCoreState *env, target_ulong r1,
     return result;
 }
 
-uint64_t helper_msub64_ssov(CPUTriCoreState *env, target_ulong r1,
-                            uint64_t r2, target_ulong r3)
+uint64_t helper_msub64_ssov(CPUTriCoreState *env, uint32_t r1,
+                            uint64_t r2, uint32_t r3)
 {
     uint64_t ret, ovf;
     int64_t t1 = sextract64(r1, 0, 32);
@@ -944,8 +931,8 @@ uint64_t helper_msub64_ssov(CPUTriCoreState *env, target_ulong r1,
     return ret;
 }
 
-uint64_t helper_msub64_suov(CPUTriCoreState *env, target_ulong r1,
-                            uint64_t r2, target_ulong r3)
+uint64_t helper_msub64_suov(CPUTriCoreState *env, uint32_t r1,
+                            uint64_t r2, uint32_t r3)
 {
     uint64_t ret, mul;
     uint64_t t1 = extract64(r1, 0, 32);
@@ -1097,7 +1084,7 @@ uint32_t helper_msubr_q_ssov(CPUTriCoreState *env, uint32_t r1, uint32_t r2,
     return ret & 0xffff0000ll;
 }
 
-uint32_t helper_abs_b(CPUTriCoreState *env, target_ulong arg)
+uint32_t helper_abs_b(CPUTriCoreState *env, uint32_t arg)
 {
     int32_t b, i;
     int32_t ovf = 0;
@@ -1120,7 +1107,7 @@ uint32_t helper_abs_b(CPUTriCoreState *env, target_ulong arg)
     return ret;
 }
 
-uint32_t helper_abs_h(CPUTriCoreState *env, target_ulong arg)
+uint32_t helper_abs_h(CPUTriCoreState *env, uint32_t arg)
 {
     int32_t h, i;
     int32_t ovf = 0;
@@ -1143,7 +1130,7 @@ uint32_t helper_abs_h(CPUTriCoreState *env, target_ulong arg)
     return ret;
 }
 
-uint32_t helper_absdif_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_absdif_b(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t b, i;
     int32_t extr_r2;
@@ -1167,7 +1154,7 @@ uint32_t helper_absdif_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_absdif_h(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_absdif_h(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t h, i;
     int32_t extr_r2;
@@ -1296,7 +1283,7 @@ uint32_t helper_maddr_q(CPUTriCoreState *env, uint32_t r1, uint32_t r2,
     return ret & 0xffff0000ll;
 }
 
-uint32_t helper_add_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_add_b(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t b, i;
     int32_t extr_r1, extr_r2;
@@ -1322,7 +1309,7 @@ uint32_t helper_add_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_add_h(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_add_h(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t h, i;
     int32_t extr_r1, extr_r2;
@@ -1451,7 +1438,7 @@ uint32_t helper_msubr_q(CPUTriCoreState *env, uint32_t r1, uint32_t r2,
     return ret & 0xffff0000ll;
 }
 
-uint32_t helper_sub_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_sub_b(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t b, i;
     int32_t extr_r1, extr_r2;
@@ -1477,7 +1464,7 @@ uint32_t helper_sub_b(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_sub_h(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_sub_h(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t h, i;
     int32_t extr_r1, extr_r2;
@@ -1502,7 +1489,7 @@ uint32_t helper_sub_h(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_eq_b(target_ulong r1, target_ulong r2)
+uint32_t helper_eq_b(uint32_t r1, uint32_t r2)
 {
     uint32_t ret, msk;
     int32_t i;
@@ -1519,7 +1506,7 @@ uint32_t helper_eq_b(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_eq_h(target_ulong r1, target_ulong r2)
+uint32_t helper_eq_h(uint32_t r1, uint32_t r2)
 {
     int32_t ret = 0;
 
@@ -1534,7 +1521,7 @@ uint32_t helper_eq_h(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_eqany_b(target_ulong r1, target_ulong r2)
+uint32_t helper_eqany_b(uint32_t r1, uint32_t r2)
 {
     int32_t i;
     uint32_t ret = 0;
@@ -1546,7 +1533,7 @@ uint32_t helper_eqany_b(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_eqany_h(target_ulong r1, target_ulong r2)
+uint32_t helper_eqany_h(uint32_t r1, uint32_t r2)
 {
     uint32_t ret;
 
@@ -1556,7 +1543,7 @@ uint32_t helper_eqany_h(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_lt_b(target_ulong r1, target_ulong r2)
+uint32_t helper_lt_b(uint32_t r1, uint32_t r2)
 {
     int32_t i;
     uint32_t ret = 0;
@@ -1570,7 +1557,7 @@ uint32_t helper_lt_b(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_lt_bu(target_ulong r1, target_ulong r2)
+uint32_t helper_lt_bu(uint32_t r1, uint32_t r2)
 {
     int32_t i;
     uint32_t ret = 0;
@@ -1584,7 +1571,7 @@ uint32_t helper_lt_bu(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_lt_h(target_ulong r1, target_ulong r2)
+uint32_t helper_lt_h(uint32_t r1, uint32_t r2)
 {
     uint32_t ret = 0;
 
@@ -1599,7 +1586,7 @@ uint32_t helper_lt_h(target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_lt_hu(target_ulong r1, target_ulong r2)
+uint32_t helper_lt_hu(uint32_t r1, uint32_t r2)
 {
     uint32_t ret = 0;
 
@@ -1615,7 +1602,7 @@ uint32_t helper_lt_hu(target_ulong r1, target_ulong r2)
 }
 
 #define EXTREMA_H_B(name, op)                                 \
-uint32_t helper_##name ##_b(target_ulong r1, target_ulong r2) \
+uint32_t helper_##name ##_b(uint32_t r1, uint32_t r2)         \
 {                                                             \
     int32_t i, extr_r1, extr_r2;                              \
     uint32_t ret = 0;                                         \
@@ -1629,7 +1616,7 @@ uint32_t helper_##name ##_b(target_ulong r1, target_ulong r2) \
     return ret;                                               \
 }                                                             \
                                                               \
-uint32_t helper_##name ##_bu(target_ulong r1, target_ulong r2)\
+uint32_t helper_##name ##_bu(uint32_t r1, uint32_t r2)        \
 {                                                             \
     int32_t i;                                                \
     uint32_t extr_r1, extr_r2;                                \
@@ -1644,7 +1631,7 @@ uint32_t helper_##name ##_bu(target_ulong r1, target_ulong r2)\
     return ret;                                               \
 }                                                             \
                                                               \
-uint32_t helper_##name ##_h(target_ulong r1, target_ulong r2) \
+uint32_t helper_##name ##_h(uint32_t r1, uint32_t r2)         \
 {                                                             \
     int32_t extr_r1, extr_r2;                                 \
     uint32_t ret = 0;                                         \
@@ -1662,7 +1649,7 @@ uint32_t helper_##name ##_h(target_ulong r1, target_ulong r2) \
     return ret;                                               \
 }                                                             \
                                                               \
-uint32_t helper_##name ##_hu(target_ulong r1, target_ulong r2)\
+uint32_t helper_##name ##_hu(uint32_t r1, uint32_t r2)        \
 {                                                             \
     uint32_t extr_r1, extr_r2;                                \
     uint32_t ret = 0;                                         \
@@ -1729,7 +1716,7 @@ EXTREMA_H_B(min, <)
 
 #undef EXTREMA_H_B
 
-uint32_t helper_clo_h(target_ulong r1)
+uint32_t helper_clo_h(uint32_t r1)
 {
     uint32_t ret_hw0 = extract32(r1, 0, 16);
     uint32_t ret_hw1 = extract32(r1, 16, 16);
@@ -1747,7 +1734,7 @@ uint32_t helper_clo_h(target_ulong r1)
     return ret_hw0 | (ret_hw1 << 16);
 }
 
-uint32_t helper_clz_h(target_ulong r1)
+uint32_t helper_clz_h(uint32_t r1)
 {
     uint32_t ret_hw0 = extract32(r1, 0, 16);
     uint32_t ret_hw1 = extract32(r1, 16, 16);
@@ -1765,7 +1752,7 @@ uint32_t helper_clz_h(target_ulong r1)
     return ret_hw0 | (ret_hw1 << 16);
 }
 
-uint32_t helper_cls_h(target_ulong r1)
+uint32_t helper_cls_h(uint32_t r1)
 {
     uint32_t ret_hw0 = extract32(r1, 0, 16);
     uint32_t ret_hw1 = extract32(r1, 16, 16);
@@ -1783,7 +1770,7 @@ uint32_t helper_cls_h(target_ulong r1)
     return ret_hw0 | (ret_hw1 << 16);
 }
 
-uint32_t helper_sh(target_ulong r1, target_ulong r2)
+uint32_t helper_sh(uint32_t r1, uint32_t r2)
 {
     int32_t shift_count = sextract32(r2, 0, 6);
 
@@ -1796,7 +1783,7 @@ uint32_t helper_sh(target_ulong r1, target_ulong r2)
     }
 }
 
-uint32_t helper_sh_h(target_ulong r1, target_ulong r2)
+uint32_t helper_sh_h(uint32_t r1, uint32_t r2)
 {
     int32_t ret_hw0, ret_hw1;
     int32_t shift_count;
@@ -1816,7 +1803,7 @@ uint32_t helper_sh_h(target_ulong r1, target_ulong r2)
     }
 }
 
-uint32_t helper_sha(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
+uint32_t helper_sha(CPUTriCoreState *env, uint32_t r1, uint32_t r2)
 {
     int32_t shift_count;
     int64_t result, t1;
@@ -1854,7 +1841,7 @@ uint32_t helper_sha(CPUTriCoreState *env, target_ulong r1, target_ulong r2)
     return ret;
 }
 
-uint32_t helper_sha_h(target_ulong r1, target_ulong r2)
+uint32_t helper_sha_h(uint32_t r1, uint32_t r2)
 {
     int32_t shift_count;
     int32_t ret_hw0, ret_hw1;
@@ -1874,7 +1861,7 @@ uint32_t helper_sha_h(target_ulong r1, target_ulong r2)
     }
 }
 
-uint32_t helper_bmerge(target_ulong r1, target_ulong r2)
+uint32_t helper_bmerge(uint32_t r1, uint32_t r2)
 {
     uint32_t i, ret;
 
@@ -1905,7 +1892,7 @@ uint64_t helper_bsplit(uint32_t r1)
     return ret;
 }
 
-uint32_t helper_parity(target_ulong r1)
+uint32_t helper_parity(uint32_t r1)
 {
     uint32_t ret;
     uint32_t nOnes, i;
@@ -1942,7 +1929,7 @@ uint32_t helper_parity(target_ulong r1)
 }
 
 uint32_t helper_pack(uint32_t carry, uint32_t r1_low, uint32_t r1_high,
-                     target_ulong r2)
+                     uint32_t r2)
 {
     uint32_t ret;
     int32_t fp_exp, fp_frac, temp_exp, fp_exp_frac;
@@ -1983,7 +1970,7 @@ uint32_t helper_pack(uint32_t carry, uint32_t r1_low, uint32_t r1_high,
     return ret;
 }
 
-uint64_t helper_unpack(target_ulong arg1)
+uint64_t helper_unpack(uint32_t arg1)
 {
     int32_t fp_exp  = extract32(arg1, 23, 8);
     int32_t fp_frac = extract32(arg1, 0, 23);
@@ -2408,7 +2395,7 @@ uint32_t helper_shuffle(uint32_t arg0, uint32_t arg1)
 
 /* context save area (CSA) related helpers */
 
-static int cdc_increment(target_ulong *psw)
+static int cdc_increment(uint32_t *psw)
 {
     if ((*psw & MASK_PSW_CDC) == 0x7f) {
         return 0;
@@ -2426,7 +2413,7 @@ static int cdc_increment(target_ulong *psw)
     return 0;
 }
 
-static int cdc_decrement(target_ulong *psw)
+static int cdc_decrement(uint32_t *psw)
 {
     if ((*psw & MASK_PSW_CDC) == 0x7f) {
         return 0;
@@ -2442,7 +2429,7 @@ static int cdc_decrement(target_ulong *psw)
     return 0;
 }
 
-static bool cdc_zero(target_ulong *psw)
+static bool cdc_zero(uint32_t *psw)
 {
     int cdc = *psw & MASK_PSW_CDC;
     /* Returns TRUE if PSW.CDC.COUNT == 0 or if PSW.CDC ==
@@ -2457,7 +2444,7 @@ static bool cdc_zero(target_ulong *psw)
     return count == 0;
 }
 
-static void save_context_upper(CPUTriCoreState *env, target_ulong ea)
+static void save_context_upper(CPUTriCoreState *env, uint32_t ea)
 {
     cpu_stl_data(env, ea, env->PCXI);
     cpu_stl_data(env, ea+4, psw_read(env));
@@ -2477,7 +2464,7 @@ static void save_context_upper(CPUTriCoreState *env, target_ulong ea)
     cpu_stl_data(env, ea+60, env->gpr_d[15]);
 }
 
-static void save_context_lower(CPUTriCoreState *env, target_ulong ea)
+static void save_context_lower(CPUTriCoreState *env, uint32_t ea)
 {
     cpu_stl_data(env, ea, env->PCXI);
     cpu_stl_data(env, ea+4, env->gpr_a[11]);
@@ -2497,8 +2484,8 @@ static void save_context_lower(CPUTriCoreState *env, target_ulong ea)
     cpu_stl_data(env, ea+60, env->gpr_d[7]);
 }
 
-static void restore_context_upper(CPUTriCoreState *env, target_ulong ea,
-                                  target_ulong *new_PCXI, target_ulong *new_PSW)
+static void restore_context_upper(CPUTriCoreState *env, uint32_t ea,
+                                  uint32_t *new_PCXI, uint32_t *new_PSW)
 {
     *new_PCXI = cpu_ldl_data(env, ea);
     *new_PSW = cpu_ldl_data(env, ea+4);
@@ -2518,8 +2505,8 @@ static void restore_context_upper(CPUTriCoreState *env, target_ulong ea,
     env->gpr_d[15] = cpu_ldl_data(env, ea+60);
 }
 
-static void restore_context_lower(CPUTriCoreState *env, target_ulong ea,
-                                  target_ulong *ra, target_ulong *pcxi)
+static void restore_context_lower(CPUTriCoreState *env, uint32_t ea,
+                                  uint32_t *ra, uint32_t *pcxi)
 {
     *pcxi = cpu_ldl_data(env, ea);
     *ra = cpu_ldl_data(env, ea+4);
@@ -2541,10 +2528,10 @@ static void restore_context_lower(CPUTriCoreState *env, target_ulong ea,
 
 void helper_call(CPUTriCoreState *env, uint32_t next_pc)
 {
-    target_ulong tmp_FCX;
-    target_ulong ea;
-    target_ulong new_FCX;
-    target_ulong psw;
+    uint32_t tmp_FCX;
+    uint32_t ea;
+    uint32_t new_FCX;
+    uint32_t psw;
 
     psw = psw_read(env);
     /* if (FCX == 0) trap(FCU); */
@@ -2604,9 +2591,9 @@ void helper_call(CPUTriCoreState *env, uint32_t next_pc)
 
 void helper_ret(CPUTriCoreState *env)
 {
-    target_ulong ea;
-    target_ulong new_PCXI;
-    target_ulong new_PSW, psw;
+    uint32_t ea;
+    uint32_t new_PCXI;
+    uint32_t new_PSW, psw;
 
     psw = psw_read(env);
      /* if (PSW.CDE) then if (cdc_decrement()) then trap(CDU);*/
@@ -2657,9 +2644,9 @@ void helper_ret(CPUTriCoreState *env)
 
 void helper_bisr(CPUTriCoreState *env, uint32_t const9)
 {
-    target_ulong tmp_FCX;
-    target_ulong ea;
-    target_ulong new_FCX;
+    uint32_t tmp_FCX;
+    uint32_t ea;
+    uint32_t new_FCX;
 
     if (env->FCX == 0) {
         /* FCU trap */
@@ -2701,9 +2688,9 @@ void helper_bisr(CPUTriCoreState *env, uint32_t const9)
 
 void helper_rfe(CPUTriCoreState *env)
 {
-    target_ulong ea;
-    target_ulong new_PCXI;
-    target_ulong new_PSW;
+    uint32_t ea;
+    uint32_t new_PCXI;
+    uint32_t new_PSW;
     /* if (PCXI[19: 0] == 0) then trap(CSU); */
     if ((env->PCXI & 0xfffff) == 0) {
         /* raise csu trap */
@@ -2762,35 +2749,35 @@ void helper_rfm(CPUTriCoreState *env)
     }
 }
 
-void helper_ldlcx(CPUTriCoreState *env, target_ulong ea)
+void helper_ldlcx(CPUTriCoreState *env, uint32_t ea)
 {
     uint32_t dummy;
     /* insn doesn't load PCXI and RA */
     restore_context_lower(env, ea, &dummy, &dummy);
 }
 
-void helper_lducx(CPUTriCoreState *env, target_ulong ea)
+void helper_lducx(CPUTriCoreState *env, uint32_t ea)
 {
     uint32_t dummy;
     /* insn doesn't load PCXI and PSW */
     restore_context_upper(env, ea, &dummy, &dummy);
 }
 
-void helper_stlcx(CPUTriCoreState *env, target_ulong ea)
+void helper_stlcx(CPUTriCoreState *env, uint32_t ea)
 {
     save_context_lower(env, ea);
 }
 
-void helper_stucx(CPUTriCoreState *env, target_ulong ea)
+void helper_stucx(CPUTriCoreState *env, uint32_t ea)
 {
     save_context_upper(env, ea);
 }
 
 void helper_svlcx(CPUTriCoreState *env)
 {
-    target_ulong tmp_FCX;
-    target_ulong ea;
-    target_ulong new_FCX;
+    uint32_t tmp_FCX;
+    uint32_t ea;
+    uint32_t new_FCX;
 
     if (env->FCX == 0) {
         /* FCU trap */
@@ -2831,9 +2818,9 @@ void helper_svlcx(CPUTriCoreState *env)
 
 void helper_svucx(CPUTriCoreState *env)
 {
-    target_ulong tmp_FCX;
-    target_ulong ea;
-    target_ulong new_FCX;
+    uint32_t tmp_FCX;
+    uint32_t ea;
+    uint32_t new_FCX;
 
     if (env->FCX == 0) {
         /* FCU trap */
@@ -2874,8 +2861,8 @@ void helper_svucx(CPUTriCoreState *env)
 
 void helper_rslcx(CPUTriCoreState *env)
 {
-    target_ulong ea;
-    target_ulong new_PCXI;
+    uint32_t ea;
+    uint32_t new_PCXI;
     /*   if (PCXI[19: 0] == 0) then trap(CSU); */
     if ((env->PCXI & 0xfffff) == 0) {
         /* CSU trap */

From 6b2e4fcb836cdd4b770086db03e07d0ff93f9612 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:26:56 +0200
Subject: [PATCH 1405/2396] target/tricore: Declare registers as TCGv_i32
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

CPUTriCoreState register are declared as uint32_t since the
target introduction in commit 48e06fe0ed8 ("target-tricore:
Add target stubs and qom-cpu").

Mechanical replacement of:

  TCGv -> TCGv_i32
  tcg_temp_new -> tcg_temp_new_i32

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-8-philmd@linaro.org>
---
 target/tricore/translate.c | 82 +++++++++++++++++++-------------------
 1 file changed, 42 insertions(+), 40 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 116f45135b..112a1b9a12 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -44,19 +44,19 @@
 /*
  * TCG registers
  */
-static TCGv cpu_PC;
-static TCGv cpu_PCXI;
-static TCGv cpu_PSW;
-static TCGv cpu_ICR;
+static TCGv_i32 cpu_PC;
+static TCGv_i32 cpu_PCXI;
+static TCGv_i32 cpu_PSW;
+static TCGv_i32 cpu_ICR;
 /* GPR registers */
-static TCGv cpu_gpr_a[16];
-static TCGv cpu_gpr_d[16];
+static TCGv_i32 cpu_gpr_a[16];
+static TCGv_i32 cpu_gpr_d[16];
 /* PSW Flag cache */
-static TCGv cpu_PSW_C;
-static TCGv cpu_PSW_V;
-static TCGv cpu_PSW_SV;
-static TCGv cpu_PSW_AV;
-static TCGv cpu_PSW_SAV;
+static TCGv_i32 cpu_PSW_C;
+static TCGv_i32 cpu_PSW_V;
+static TCGv_i32 cpu_PSW_SV;
+static TCGv_i32 cpu_PSW_AV;
+static TCGv_i32 cpu_PSW_SAV;
 
 static const char *regnames_a[] = {
       "a0"  , "a1"  , "a2"  , "a3" , "a4"  , "a5" ,
@@ -8480,14 +8480,14 @@ void cpu_state_reset(CPUTriCoreState *env)
 
 static void tricore_tcg_init_csfr(void)
 {
-    cpu_PCXI = tcg_global_mem_new(tcg_env,
-                          offsetof(CPUTriCoreState, PCXI), "PCXI");
-    cpu_PSW = tcg_global_mem_new(tcg_env,
-                          offsetof(CPUTriCoreState, PSW), "PSW");
-    cpu_PC = tcg_global_mem_new(tcg_env,
-                          offsetof(CPUTriCoreState, PC), "PC");
-    cpu_ICR = tcg_global_mem_new(tcg_env,
-                          offsetof(CPUTriCoreState, ICR), "ICR");
+    cpu_PCXI = tcg_global_mem_new_i32(tcg_env,
+                                      offsetof(CPUTriCoreState, PCXI), "PCXI");
+    cpu_PSW = tcg_global_mem_new_i32(tcg_env,
+                                     offsetof(CPUTriCoreState, PSW), "PSW");
+    cpu_PC = tcg_global_mem_new_i32(tcg_env,
+                                    offsetof(CPUTriCoreState, PC), "PC");
+    cpu_ICR = tcg_global_mem_new_i32(tcg_env,
+                                     offsetof(CPUTriCoreState, ICR), "ICR");
 }
 
 void tricore_tcg_init(void)
@@ -8496,30 +8496,32 @@ void tricore_tcg_init(void)
 
     /* reg init */
     for (i = 0 ; i < 16 ; i++) {
-        cpu_gpr_a[i] = tcg_global_mem_new(tcg_env,
-                                          offsetof(CPUTriCoreState, gpr_a[i]),
-                                          regnames_a[i]);
+        cpu_gpr_a[i] = tcg_global_mem_new_i32(tcg_env,
+                                              offsetof(CPUTriCoreState,
+                                                       gpr_a[i]),
+                                              regnames_a[i]);
     }
     for (i = 0 ; i < 16 ; i++) {
-        cpu_gpr_d[i] = tcg_global_mem_new(tcg_env,
-                                  offsetof(CPUTriCoreState, gpr_d[i]),
-                                           regnames_d[i]);
+        cpu_gpr_d[i] = tcg_global_mem_new_i32(tcg_env,
+                                              offsetof(CPUTriCoreState,
+                                                       gpr_d[i]),
+                                              regnames_d[i]);
     }
     tricore_tcg_init_csfr();
     /* init PSW flag cache */
-    cpu_PSW_C = tcg_global_mem_new(tcg_env,
-                                   offsetof(CPUTriCoreState, PSW_USB_C),
-                                   "PSW_C");
-    cpu_PSW_V = tcg_global_mem_new(tcg_env,
-                                   offsetof(CPUTriCoreState, PSW_USB_V),
-                                   "PSW_V");
-    cpu_PSW_SV = tcg_global_mem_new(tcg_env,
-                                    offsetof(CPUTriCoreState, PSW_USB_SV),
-                                    "PSW_SV");
-    cpu_PSW_AV = tcg_global_mem_new(tcg_env,
-                                    offsetof(CPUTriCoreState, PSW_USB_AV),
-                                    "PSW_AV");
-    cpu_PSW_SAV = tcg_global_mem_new(tcg_env,
-                                     offsetof(CPUTriCoreState, PSW_USB_SAV),
-                                     "PSW_SAV");
+    cpu_PSW_C = tcg_global_mem_new_i32(tcg_env,
+                                       offsetof(CPUTriCoreState, PSW_USB_C),
+                                       "PSW_C");
+    cpu_PSW_V = tcg_global_mem_new_i32(tcg_env,
+                                       offsetof(CPUTriCoreState, PSW_USB_V),
+                                       "PSW_V");
+    cpu_PSW_SV = tcg_global_mem_new_i32(tcg_env,
+                                        offsetof(CPUTriCoreState, PSW_USB_SV),
+                                        "PSW_SV");
+    cpu_PSW_AV = tcg_global_mem_new_i32(tcg_env,
+                                        offsetof(CPUTriCoreState, PSW_USB_AV),
+                                        "PSW_AV");
+    cpu_PSW_SAV = tcg_global_mem_new_i32(tcg_env,
+                                         offsetof(CPUTriCoreState, PSW_USB_SAV),
+                                         "PSW_SAV");
 }

From f30c8aa229da11b40eb3a2e696e7e79d639c21fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:27:59 +0200
Subject: [PATCH 1406/2396] target/tricore: Inline tcg_gen_ld32u_tl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TriCore target is only built as 32-bit, so tcg_gen_ld32u_tl()
expands to tcg_gen_ld_i32(). Use the latter to simplify the next
commit mechanical change.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-9-philmd@linaro.org>
---
 target/tricore/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 112a1b9a12..2cfd2e5b8d 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -7959,7 +7959,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
             tmp = tcg_temp_new();
             l1 = gen_new_label();
 
-            tcg_gen_ld32u_tl(tmp, tcg_env, offsetof(CPUTriCoreState, DBGSR));
+            tcg_gen_ld_i32(tmp, tcg_env, offsetof(CPUTriCoreState, DBGSR));
             tcg_gen_andi_tl(tmp, tmp, MASK_DBGSR_DE);
             tcg_gen_brcondi_tl(TCG_COND_NE, tmp, 1, l1);
             gen_helper_rfm(tcg_env);

From 4f08815467e5cfbd3f117f34b11da1beb613b775 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:29:17 +0200
Subject: [PATCH 1407/2396] target/tricore: Expand TCG helpers for 32-bit
 target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TriCore target is only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/tricore-*
  configs/targets/tricore-softmmu.mak:2:TARGET_LONG_BITS=32

Therefore tcg_FOO_tl() always expands to tcg_FOO_i32().

This is a mechanical replacement.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-10-philmd@linaro.org>
---
 target/tricore/translate.c | 2595 ++++++++++++++++++------------------
 1 file changed, 1298 insertions(+), 1297 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 2cfd2e5b8d..ef3653b882 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -139,9 +139,9 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     TCGv arg00 = tcg_temp_new();                             \
     TCGv arg01 = tcg_temp_new();                             \
     TCGv arg11 = tcg_temp_new();                             \
-    tcg_gen_sari_tl(arg00, arg0, 16);                        \
-    tcg_gen_ext16s_tl(arg01, arg0);                          \
-    tcg_gen_ext16s_tl(arg11, arg1);                          \
+    tcg_gen_sari_i32(arg00, arg0, 16);                       \
+    tcg_gen_ext16s_i32(arg01, arg0);                         \
+    tcg_gen_ext16s_i32(arg11, arg1);                         \
     gen_helper_##name(ret, arg00, arg01, arg11, arg11, n);   \
 } while (0)
 
@@ -150,10 +150,10 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     TCGv arg01 = tcg_temp_new();                             \
     TCGv arg10 = tcg_temp_new();                             \
     TCGv arg11 = tcg_temp_new();                             \
-    tcg_gen_sari_tl(arg00, arg0, 16);                        \
-    tcg_gen_ext16s_tl(arg01, arg0);                          \
-    tcg_gen_sari_tl(arg11, arg1, 16);                        \
-    tcg_gen_ext16s_tl(arg10, arg1);                          \
+    tcg_gen_sari_i32(arg00, arg0, 16);                       \
+    tcg_gen_ext16s_i32(arg01, arg0);                         \
+    tcg_gen_sari_i32(arg11, arg1, 16);                       \
+    tcg_gen_ext16s_i32(arg10, arg1);                         \
     gen_helper_##name(ret, arg00, arg01, arg10, arg11, n);   \
 } while (0)
 
@@ -162,10 +162,10 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     TCGv arg01 = tcg_temp_new();                             \
     TCGv arg10 = tcg_temp_new();                             \
     TCGv arg11 = tcg_temp_new();                             \
-    tcg_gen_sari_tl(arg00, arg0, 16);                        \
-    tcg_gen_ext16s_tl(arg01, arg0);                          \
-    tcg_gen_sari_tl(arg10, arg1, 16);                        \
-    tcg_gen_ext16s_tl(arg11, arg1);                          \
+    tcg_gen_sari_i32(arg00, arg0, 16);                       \
+    tcg_gen_ext16s_i32(arg01, arg0);                         \
+    tcg_gen_sari_i32(arg10, arg1, 16);                       \
+    tcg_gen_ext16s_i32(arg11, arg1);                         \
     gen_helper_##name(ret, arg00, arg01, arg10, arg11, n);   \
 } while (0)
 
@@ -173,9 +173,9 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     TCGv arg00 = tcg_temp_new();                             \
     TCGv arg01 = tcg_temp_new();                             \
     TCGv arg11 = tcg_temp_new();                             \
-    tcg_gen_sari_tl(arg01, arg0, 16);                        \
-    tcg_gen_ext16s_tl(arg00, arg0);                          \
-    tcg_gen_sari_tl(arg11, arg1, 16);                        \
+    tcg_gen_sari_i32(arg01, arg0, 16);                       \
+    tcg_gen_ext16s_i32(arg00, arg0);                         \
+    tcg_gen_sari_i32(arg11, arg1, 16);                       \
     gen_helper_##name(ret, arg00, arg01, arg11, arg11, n);   \
 } while (0)
 
@@ -214,16 +214,16 @@ static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
                                  int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, r2, con);
-    tcg_gen_qemu_ld_tl(r1, temp, ctx->mem_idx, mop);
+    tcg_gen_addi_i32(temp, r2, con);
+    tcg_gen_qemu_ld_i32(r1, temp, ctx->mem_idx, mop);
 }
 
 static inline void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
                                  int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, r2, con);
-    tcg_gen_qemu_st_tl(r1, temp, ctx->mem_idx, mop);
+    tcg_gen_addi_i32(temp, r2, con);
+    tcg_gen_qemu_st_i32(r1, temp, ctx->mem_idx, mop);
 }
 
 static void gen_st_2regs_64(TCGv rh, TCGv rl, TCGv address, DisasContext *ctx)
@@ -238,7 +238,7 @@ static void gen_offset_st_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
                                 DisasContext *ctx)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, base, con);
+    tcg_gen_addi_i32(temp, base, con);
     gen_st_2regs_64(rh, rl, temp, ctx);
 }
 
@@ -255,7 +255,7 @@ static void gen_offset_ld_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
                                 DisasContext *ctx)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, base, con);
+    tcg_gen_addi_i32(temp, base, con);
     gen_ld_2regs_64(rh, rl, temp, ctx);
 }
 
@@ -263,18 +263,18 @@ static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
                            MemOp mop)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, r2, off);
-    tcg_gen_qemu_st_tl(r1, temp, ctx->mem_idx, mop);
-    tcg_gen_mov_tl(r2, temp);
+    tcg_gen_addi_i32(temp, r2, off);
+    tcg_gen_qemu_st_i32(r1, temp, ctx->mem_idx, mop);
+    tcg_gen_mov_i32(r2, temp);
 }
 
 static void gen_ld_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
                            MemOp mop)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_addi_tl(temp, r2, off);
-    tcg_gen_qemu_ld_tl(r1, temp, ctx->mem_idx, mop);
-    tcg_gen_mov_tl(r2, temp);
+    tcg_gen_addi_i32(temp, r2, off);
+    tcg_gen_qemu_ld_i32(r1, temp, ctx->mem_idx, mop);
+    tcg_gen_mov_i32(r2, temp);
 }
 
 /* M(EA, word) = (M(EA, word) & ~E[a][63:32]) | (E[a][31:0] & E[a][63:32]); */
@@ -285,15 +285,15 @@ static void gen_ldmst(DisasContext *ctx, int ereg, TCGv ea)
 
     CHECK_REG_PAIR(ereg);
     /* temp = (M(EA, word) */
-    tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
     /* temp = temp & ~E[a][63:32]) */
-    tcg_gen_andc_tl(temp, temp, cpu_gpr_d[ereg+1]);
+    tcg_gen_andc_i32(temp, temp, cpu_gpr_d[ereg + 1]);
     /* temp2 = (E[a][31:0] & E[a][63:32]); */
-    tcg_gen_and_tl(temp2, cpu_gpr_d[ereg], cpu_gpr_d[ereg+1]);
+    tcg_gen_and_i32(temp2, cpu_gpr_d[ereg], cpu_gpr_d[ereg + 1]);
     /* temp = temp | temp2; */
-    tcg_gen_or_tl(temp, temp, temp2);
+    tcg_gen_or_i32(temp, temp, temp2);
     /* M(EA, word) = temp; */
-    tcg_gen_qemu_st_tl(temp, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_qemu_st_i32(temp, ea, ctx->mem_idx, MO_LEUL);
 }
 
 /* tmp = M(EA, word);
@@ -303,9 +303,9 @@ static void gen_swap(DisasContext *ctx, int reg, TCGv ea)
 {
     TCGv temp = tcg_temp_new();
 
-    tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_qemu_st_tl(cpu_gpr_d[reg], ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_mov_tl(cpu_gpr_d[reg], temp);
+    tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_qemu_st_i32(cpu_gpr_d[reg], ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_mov_i32(cpu_gpr_d[reg], temp);
 }
 
 static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
@@ -313,11 +313,11 @@ static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     CHECK_REG_PAIR(reg);
-    tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_movcond_tl(TCG_COND_EQ, temp2, cpu_gpr_d[reg+1], temp,
+    tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_movcond_i32(TCG_COND_EQ, temp2, cpu_gpr_d[reg + 1], temp,
                        cpu_gpr_d[reg], temp);
-    tcg_gen_qemu_st_tl(temp2, ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_mov_tl(cpu_gpr_d[reg], temp);
+    tcg_gen_qemu_st_i32(temp2, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_mov_i32(cpu_gpr_d[reg], temp);
 }
 
 static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
@@ -326,12 +326,12 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
     TCGv temp2 = tcg_temp_new();
     TCGv temp3 = tcg_temp_new();
     CHECK_REG_PAIR(reg);
-    tcg_gen_qemu_ld_tl(temp, ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_and_tl(temp2, cpu_gpr_d[reg], cpu_gpr_d[reg+1]);
-    tcg_gen_andc_tl(temp3, temp, cpu_gpr_d[reg+1]);
-    tcg_gen_or_tl(temp2, temp2, temp3);
-    tcg_gen_qemu_st_tl(temp2, ea, ctx->mem_idx, MO_LEUL);
-    tcg_gen_mov_tl(cpu_gpr_d[reg], temp);
+    tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_and_i32(temp2, cpu_gpr_d[reg], cpu_gpr_d[reg + 1]);
+    tcg_gen_andc_i32(temp3, temp, cpu_gpr_d[reg + 1]);
+    tcg_gen_or_i32(temp2, temp2, temp3);
+    tcg_gen_qemu_st_i32(temp2, ea, ctx->mem_idx, MO_LEUL);
+    tcg_gen_mov_i32(cpu_gpr_d[reg], temp);
 }
 
 /* We generate loads and store to core special function register (csfr) through
@@ -341,7 +341,7 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
 #define R(ADDRESS, REG, FEATURE)                                         \
     case ADDRESS:                                                        \
         if (has_feature(ctx, FEATURE)) {                             \
-            tcg_gen_ld_tl(ret, tcg_env, offsetof(CPUTriCoreState, REG)); \
+            tcg_gen_ld_i32(ret, tcg_env, offsetof(CPUTriCoreState, REG)); \
         }                                                                \
         break;
 #define A(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)
@@ -366,7 +366,7 @@ static inline void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
 #define A(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)                \
     case ADDRESS:                                                        \
         if (has_feature(ctx, FEATURE)) {                             \
-            tcg_gen_st_tl(r1, tcg_env, offsetof(CPUTriCoreState, REG));  \
+            tcg_gen_st_i32(r1, tcg_env, offsetof(CPUTriCoreState, REG)); \
         }                                                                \
         break;
 /* Endinit protected registers
@@ -399,20 +399,20 @@ static inline void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
     TCGv t0 = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
     /* Addition and set V/SV bits */
-    tcg_gen_add_tl(result, r1, r2);
+    tcg_gen_add_i32(result, r1, r2);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(t0, r1, r2);
-    tcg_gen_andc_tl(cpu_PSW_V, cpu_PSW_V, t0);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(t0, r1, r2);
+    tcg_gen_andc_i32(cpu_PSW_V, cpu_PSW_V, t0);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void
@@ -430,13 +430,13 @@ gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_andc_i64(t1, t1, t0);
     tcg_gen_extrh_i64_i32(cpu_PSW_V, t1);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* calc AV/SAV bits */
     tcg_gen_extrh_i64_i32(temp, result);
-    tcg_gen_add_tl(cpu_PSW_AV, temp, temp);
-    tcg_gen_xor_tl(cpu_PSW_AV, temp, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, temp, temp);
+    tcg_gen_xor_i32(cpu_PSW_AV, temp, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
     tcg_gen_mov_i64(ret, result);
 }
@@ -453,38 +453,38 @@ gen_addsub64_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
 
     (*op1)(temp, r1_low, r2);
     /* calc V0 bit */
-    tcg_gen_xor_tl(temp2, temp, r1_low);
-    tcg_gen_xor_tl(temp3, r1_low, r2);
+    tcg_gen_xor_i32(temp2, temp, r1_low);
+    tcg_gen_xor_i32(temp3, r1_low, r2);
     if (op1 == tcg_gen_add_tl) {
-        tcg_gen_andc_tl(temp2, temp2, temp3);
+        tcg_gen_andc_i32(temp2, temp2, temp3);
     } else {
-        tcg_gen_and_tl(temp2, temp2, temp3);
+        tcg_gen_and_i32(temp2, temp2, temp3);
     }
 
     (*op2)(temp3, r1_high, r3);
     /* calc V1 bit */
-    tcg_gen_xor_tl(cpu_PSW_V, temp3, r1_high);
-    tcg_gen_xor_tl(temp4, r1_high, r3);
+    tcg_gen_xor_i32(cpu_PSW_V, temp3, r1_high);
+    tcg_gen_xor_i32(temp4, r1_high, r3);
     if (op2 == tcg_gen_add_tl) {
-        tcg_gen_andc_tl(cpu_PSW_V, cpu_PSW_V, temp4);
+        tcg_gen_andc_i32(cpu_PSW_V, cpu_PSW_V, temp4);
     } else {
-        tcg_gen_and_tl(cpu_PSW_V, cpu_PSW_V, temp4);
+        tcg_gen_and_i32(cpu_PSW_V, cpu_PSW_V, temp4);
     }
     /* combine V0/V1 bits */
-    tcg_gen_or_tl(cpu_PSW_V, cpu_PSW_V, temp2);
+    tcg_gen_or_i32(cpu_PSW_V, cpu_PSW_V, temp2);
     /* calc sv bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* write result */
-    tcg_gen_mov_tl(ret_low, temp);
-    tcg_gen_mov_tl(ret_high, temp3);
+    tcg_gen_mov_i32(ret_low, temp);
+    tcg_gen_mov_i32(ret_high, temp3);
     /* calc AV bit */
-    tcg_gen_add_tl(temp, ret_low, ret_low);
-    tcg_gen_xor_tl(temp, temp, ret_low);
-    tcg_gen_add_tl(cpu_PSW_AV, ret_high, ret_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, cpu_PSW_AV, ret_high);
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp);
+    tcg_gen_add_i32(temp, ret_low, ret_low);
+    tcg_gen_xor_i32(temp, temp, ret_low);
+    tcg_gen_add_i32(cpu_PSW_AV, ret_high, ret_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, cpu_PSW_AV, ret_high);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 /* ret = r2 + (r1 * r3); */
@@ -509,14 +509,14 @@ static inline void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_setcondi_i64(TCG_COND_LT, t2, t1, -0x80000000LL);
     tcg_gen_or_i64(t2, t2, t3);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t2);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_maddi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
@@ -534,23 +534,23 @@ gen_madd64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     TCGv t3 = tcg_temp_new();
     TCGv t4 = tcg_temp_new();
 
-    tcg_gen_muls2_tl(t1, t2, r1, r3);
+    tcg_gen_muls2_i32(t1, t2, r1, r3);
     /* only the add can overflow */
-    tcg_gen_add2_tl(t3, t4, r2_low, r2_high, t1, t2);
+    tcg_gen_add2_i32(t3, t4, r2_low, r2_high, t1, t2);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, t4, r2_high);
-    tcg_gen_xor_tl(t1, r2_high, t2);
-    tcg_gen_andc_tl(cpu_PSW_V, cpu_PSW_V, t1);
+    tcg_gen_xor_i32(cpu_PSW_V, t4, r2_high);
+    tcg_gen_xor_i32(t1, r2_high, t2);
+    tcg_gen_andc_i32(cpu_PSW_V, cpu_PSW_V, t1);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, t4, t4);
-    tcg_gen_xor_tl(cpu_PSW_AV, t4, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, t4, t4);
+    tcg_gen_xor_i32(cpu_PSW_AV, t4, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back the result */
-    tcg_gen_mov_tl(ret_low, t3);
-    tcg_gen_mov_tl(ret_high, t4);
+    tcg_gen_mov_i32(ret_low, t3);
+    tcg_gen_mov_i32(ret_high, t4);
 }
 
 static inline void
@@ -573,14 +573,14 @@ gen_maddu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
        calc V bit */
     tcg_gen_setcond_i64(TCG_COND_LTU, t2, t2, t1);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t2);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, ret_high, ret_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret_high, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret_high, ret_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret_high, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void
@@ -714,13 +714,13 @@ gen_madds_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     }
     tcg_gen_extr_i64_i32(temp, temp2, temp64);
     gen_adds(ret_low, r1_low, temp);
-    tcg_gen_mov_tl(temp, cpu_PSW_V);
-    tcg_gen_mov_tl(temp3, cpu_PSW_AV);
+    tcg_gen_mov_i32(temp, cpu_PSW_V);
+    tcg_gen_mov_i32(temp3, cpu_PSW_AV);
     gen_adds(ret_high, r1_high, temp2);
     /* combine v bits */
-    tcg_gen_or_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_or_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* combine av bits */
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp3);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
 static inline void gen_subs(TCGv ret, TCGv r1, TCGv r2);
@@ -751,13 +751,13 @@ gen_maddsus_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     }
     tcg_gen_extr_i64_i32(temp, temp2, temp64);
     gen_subs(ret_low, r1_low, temp);
-    tcg_gen_mov_tl(temp, cpu_PSW_V);
-    tcg_gen_mov_tl(temp3, cpu_PSW_AV);
+    tcg_gen_mov_i32(temp, cpu_PSW_V);
+    tcg_gen_mov_i32(temp3, cpu_PSW_AV);
     gen_adds(ret_high, r1_high, temp2);
     /* combine v bits */
-    tcg_gen_or_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_or_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* combine av bits */
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp3);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
 static inline void
@@ -876,8 +876,8 @@ gen_maddr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_maddr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
@@ -902,8 +902,8 @@ gen_maddsur32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
         GEN_HELPER_UU(mul_h, temp64, r2, r3, t_n);
         break;
     }
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_helper_addsur_h(ret, tcg_env, temp64, temp, temp2);
 }
 
@@ -937,8 +937,8 @@ gen_maddr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_maddr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
@@ -963,8 +963,8 @@ gen_maddsur32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
         GEN_HELPER_UU(mul_h, temp64, r2, r3, t_n);
         break;
     }
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_helper_addsur_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
@@ -1009,27 +1009,27 @@ gen_madd32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_setcondi_i64(TCG_COND_LT, t2, t3, -0x80000000LL);
     tcg_gen_or_i64(t1, t1, t2);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t1);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* We produce an overflow on the host if the mul before was
        (0x80000000 * 0x80000000) << 1). If this is the
        case, we negate the ovf. */
     if (n == 1) {
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, arg2, 0x80000000);
-        tcg_gen_setcond_tl(TCG_COND_EQ, temp2, arg2, arg3);
-        tcg_gen_and_tl(temp, temp, temp2);
-        tcg_gen_shli_tl(temp, temp, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, arg2, 0x80000000);
+        tcg_gen_setcond_i32(TCG_COND_EQ, temp2, arg2, arg3);
+        tcg_gen_and_i32(temp, temp, temp2);
+        tcg_gen_shli_i32(temp, temp, 31);
         /* negate v bit, if special condition */
-        tcg_gen_xor_tl(cpu_PSW_V, cpu_PSW_V, temp);
+        tcg_gen_xor_i32(cpu_PSW_V, cpu_PSW_V, temp);
     }
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, temp3, temp3);
-    tcg_gen_xor_tl(cpu_PSW_AV, temp3, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, temp3, temp3);
+    tcg_gen_xor_i32(cpu_PSW_AV, temp3, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, temp3);
+    tcg_gen_mov_i32(ret, temp3);
 }
 
 static inline void
@@ -1038,13 +1038,13 @@ gen_m16add32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     gen_add_d(ret, arg1, temp);
 }
@@ -1055,13 +1055,13 @@ gen_m16adds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     gen_adds(ret, arg1, temp);
 }
@@ -1077,13 +1077,13 @@ gen_m16add64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     TCGv_i64 t3 = tcg_temp_new_i64();
 
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     tcg_gen_ext_i32_i64(t2, temp);
     tcg_gen_shli_i64(t2, t2, 16);
@@ -1103,13 +1103,13 @@ gen_m16adds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     TCGv_i64 t2 = tcg_temp_new_i64();
 
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     tcg_gen_ext_i32_i64(t2, temp);
     tcg_gen_shli_i64(t2, t2, 16);
@@ -1149,22 +1149,22 @@ gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     if (n == 1) {
         temp = tcg_temp_new();
         temp2 = tcg_temp_new();
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, arg2, 0x80000000);
-        tcg_gen_setcond_tl(TCG_COND_EQ, temp2, arg2, arg3);
-        tcg_gen_and_tl(temp, temp, temp2);
-        tcg_gen_shli_tl(temp, temp, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, arg2, 0x80000000);
+        tcg_gen_setcond_i32(TCG_COND_EQ, temp2, arg2, arg3);
+        tcg_gen_and_i32(temp, temp, temp2);
+        tcg_gen_shli_i32(temp, temp, 31);
         /* negate v bit, if special condition */
-        tcg_gen_xor_tl(cpu_PSW_V, cpu_PSW_V, temp);
+        tcg_gen_xor_i32(cpu_PSW_V, cpu_PSW_V, temp);
     }
     /* write back result */
     tcg_gen_extr_i64_i32(rl, rh, t4);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, rh, rh);
-    tcg_gen_xor_tl(cpu_PSW_AV, rh, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, rh, rh);
+    tcg_gen_xor_i32(cpu_PSW_AV, rh, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void
@@ -1219,15 +1219,15 @@ static inline void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_setcondi_i64(TCG_COND_LT, t2, t1, -0x80000000LL);
     tcg_gen_or_i64(t2, t2, t3);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t2);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
 
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_msubi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
@@ -1245,23 +1245,23 @@ gen_msub64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     TCGv t3 = tcg_temp_new();
     TCGv t4 = tcg_temp_new();
 
-    tcg_gen_muls2_tl(t1, t2, r1, r3);
+    tcg_gen_muls2_i32(t1, t2, r1, r3);
     /* only the sub can overflow */
-    tcg_gen_sub2_tl(t3, t4, r2_low, r2_high, t1, t2);
+    tcg_gen_sub2_i32(t3, t4, r2_low, r2_high, t1, t2);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, t4, r2_high);
-    tcg_gen_xor_tl(t1, r2_high, t2);
-    tcg_gen_and_tl(cpu_PSW_V, cpu_PSW_V, t1);
+    tcg_gen_xor_i32(cpu_PSW_V, t4, r2_high);
+    tcg_gen_xor_i32(t1, r2_high, t2);
+    tcg_gen_and_i32(cpu_PSW_V, cpu_PSW_V, t1);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, t4, t4);
-    tcg_gen_xor_tl(cpu_PSW_AV, t4, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, t4, t4);
+    tcg_gen_xor_i32(cpu_PSW_AV, t4, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back the result */
-    tcg_gen_mov_tl(ret_low, t3);
-    tcg_gen_mov_tl(ret_high, t4);
+    tcg_gen_mov_i32(ret_low, t3);
+    tcg_gen_mov_i32(ret_high, t4);
 }
 
 static inline void
@@ -1290,14 +1290,14 @@ gen_msubu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     /* calc V bit, only the sub can overflow, if t1 > t2 */
     tcg_gen_setcond_i64(TCG_COND_GTU, t1, t1, t2);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t1);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, ret_high, ret_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret_high, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret_high, ret_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret_high, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void
@@ -1320,22 +1320,22 @@ static inline void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
     TCGv t0    = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
 
-    tcg_gen_movi_tl(t0, 0);
+    tcg_gen_movi_i32(t0, 0);
     /* Addition and set C/V/SV bits */
     tcg_gen_add2_i32(result, cpu_PSW_C, r1, t0, r2, t0);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(t0, r1, r2);
-    tcg_gen_andc_tl(cpu_PSW_V, cpu_PSW_V, t0);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(t0, r1, r2);
+    tcg_gen_andc_i32(cpu_PSW_V, cpu_PSW_V, t0);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void gen_addi_CC(TCGv ret, TCGv r1, int32_t con)
@@ -1352,18 +1352,18 @@ static inline void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
     /* Addition, carry and set C/V/SV bits */
     tcg_gen_addcio_i32(result, cpu_PSW_C, r1, r2, cpu_PSW_C);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(t0, r1, r2);
-    tcg_gen_andc_tl(cpu_PSW_V, cpu_PSW_V, t0);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(t0, r1, r2);
+    tcg_gen_andc_i32(cpu_PSW_V, cpu_PSW_V, t0);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void gen_addci_CC(TCGv ret, TCGv r1, int32_t con)
@@ -1382,27 +1382,27 @@ static inline void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
     TCGv t0 = tcg_constant_i32(0);
 
     /* create mask for sticky bits */
-    tcg_gen_setcond_tl(cond, mask, r4, t0);
-    tcg_gen_shli_tl(mask, mask, 31);
+    tcg_gen_setcond_i32(cond, mask, r4, t0);
+    tcg_gen_shli_i32(mask, mask, 31);
 
-    tcg_gen_add_tl(result, r1, r2);
+    tcg_gen_add_i32(result, r1, r2);
     /* Calc PSW_V */
-    tcg_gen_xor_tl(temp, result, r1);
-    tcg_gen_xor_tl(temp2, r1, r2);
-    tcg_gen_andc_tl(temp, temp, temp2);
-    tcg_gen_movcond_tl(cond, cpu_PSW_V, r4, t0, temp, cpu_PSW_V);
+    tcg_gen_xor_i32(temp, result, r1);
+    tcg_gen_xor_i32(temp2, r1, r2);
+    tcg_gen_andc_i32(temp, temp, temp2);
+    tcg_gen_movcond_i32(cond, cpu_PSW_V, r4, t0, temp, cpu_PSW_V);
     /* Set PSW_SV */
-    tcg_gen_and_tl(temp, temp, mask);
-    tcg_gen_or_tl(cpu_PSW_SV, temp, cpu_PSW_SV);
+    tcg_gen_and_i32(temp, temp, mask);
+    tcg_gen_or_i32(cpu_PSW_SV, temp, cpu_PSW_SV);
     /* calc AV bit */
-    tcg_gen_add_tl(temp, result, result);
-    tcg_gen_xor_tl(temp, temp, result);
-    tcg_gen_movcond_tl(cond, cpu_PSW_AV, r4, t0, temp, cpu_PSW_AV);
+    tcg_gen_add_i32(temp, result, result);
+    tcg_gen_xor_i32(temp, temp, result);
+    tcg_gen_movcond_i32(cond, cpu_PSW_AV, r4, t0, temp, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_and_tl(temp, temp, mask);
-    tcg_gen_or_tl(cpu_PSW_SAV, temp, cpu_PSW_SAV);
+    tcg_gen_and_i32(temp, temp, mask);
+    tcg_gen_or_i32(cpu_PSW_SAV, temp, cpu_PSW_SAV);
     /* write back result */
-    tcg_gen_movcond_tl(cond, r3, r4, t0, result, r1);
+    tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
 static inline void gen_condi_add(TCGCond cond, TCGv r1, int32_t r2,
@@ -1417,20 +1417,20 @@ static inline void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
     TCGv temp = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
 
-    tcg_gen_sub_tl(result, r1, r2);
+    tcg_gen_sub_i32(result, r1, r2);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(temp, r1, r2);
-    tcg_gen_and_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(temp, r1, r2);
+    tcg_gen_and_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void
@@ -1448,13 +1448,13 @@ gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_and_i64(t1, t1, t0);
     tcg_gen_extrh_i64_i32(cpu_PSW_V, t1);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* calc AV/SAV bits */
     tcg_gen_extrh_i64_i32(temp, result);
-    tcg_gen_add_tl(cpu_PSW_AV, temp, temp);
-    tcg_gen_xor_tl(cpu_PSW_AV, temp, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, temp, temp);
+    tcg_gen_xor_i32(cpu_PSW_AV, temp, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
     tcg_gen_mov_i64(ret, result);
 }
@@ -1464,28 +1464,28 @@ static inline void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
     TCGv result = tcg_temp_new();
     TCGv temp = tcg_temp_new();
 
-    tcg_gen_sub_tl(result, r1, r2);
+    tcg_gen_sub_i32(result, r1, r2);
     /* calc C bit */
-    tcg_gen_setcond_tl(TCG_COND_GEU, cpu_PSW_C, r1, r2);
+    tcg_gen_setcond_i32(TCG_COND_GEU, cpu_PSW_C, r1, r2);
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(temp, r1, r2);
-    tcg_gen_and_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(temp, r1, r2);
+    tcg_gen_and_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void gen_subc_CC(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv temp = tcg_temp_new();
-    tcg_gen_not_tl(temp, r2);
+    tcg_gen_not_i32(temp, r2);
     gen_addc_CC(ret, r1, temp);
 }
 
@@ -1499,27 +1499,27 @@ static inline void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
     TCGv t0 = tcg_constant_i32(0);
 
     /* create mask for sticky bits */
-    tcg_gen_setcond_tl(cond, mask, r4, t0);
-    tcg_gen_shli_tl(mask, mask, 31);
+    tcg_gen_setcond_i32(cond, mask, r4, t0);
+    tcg_gen_shli_i32(mask, mask, 31);
 
-    tcg_gen_sub_tl(result, r1, r2);
+    tcg_gen_sub_i32(result, r1, r2);
     /* Calc PSW_V */
-    tcg_gen_xor_tl(temp, result, r1);
-    tcg_gen_xor_tl(temp2, r1, r2);
-    tcg_gen_and_tl(temp, temp, temp2);
-    tcg_gen_movcond_tl(cond, cpu_PSW_V, r4, t0, temp, cpu_PSW_V);
+    tcg_gen_xor_i32(temp, result, r1);
+    tcg_gen_xor_i32(temp2, r1, r2);
+    tcg_gen_and_i32(temp, temp, temp2);
+    tcg_gen_movcond_i32(cond, cpu_PSW_V, r4, t0, temp, cpu_PSW_V);
     /* Set PSW_SV */
-    tcg_gen_and_tl(temp, temp, mask);
-    tcg_gen_or_tl(cpu_PSW_SV, temp, cpu_PSW_SV);
+    tcg_gen_and_i32(temp, temp, mask);
+    tcg_gen_or_i32(cpu_PSW_SV, temp, cpu_PSW_SV);
     /* calc AV bit */
-    tcg_gen_add_tl(temp, result, result);
-    tcg_gen_xor_tl(temp, temp, result);
-    tcg_gen_movcond_tl(cond, cpu_PSW_AV, r4, t0, temp, cpu_PSW_AV);
+    tcg_gen_add_i32(temp, result, result);
+    tcg_gen_xor_i32(temp, temp, result);
+    tcg_gen_movcond_i32(cond, cpu_PSW_AV, r4, t0, temp, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_and_tl(temp, temp, mask);
-    tcg_gen_or_tl(cpu_PSW_SAV, temp, cpu_PSW_SAV);
+    tcg_gen_and_i32(temp, temp, mask);
+    tcg_gen_or_i32(cpu_PSW_SAV, temp, cpu_PSW_SAV);
     /* write back result */
-    tcg_gen_movcond_tl(cond, r3, r4, t0, result, r1);
+    tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
 static inline void
@@ -1575,13 +1575,13 @@ gen_msubs_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     }
     tcg_gen_extr_i64_i32(temp, temp2, temp64);
     gen_subs(ret_low, r1_low, temp);
-    tcg_gen_mov_tl(temp, cpu_PSW_V);
-    tcg_gen_mov_tl(temp3, cpu_PSW_AV);
+    tcg_gen_mov_i32(temp, cpu_PSW_V);
+    tcg_gen_mov_i32(temp3, cpu_PSW_AV);
     gen_subs(ret_high, r1_high, temp2);
     /* combine v bits */
-    tcg_gen_or_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_or_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* combine av bits */
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp3);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
 static inline void
@@ -1667,8 +1667,8 @@ gen_msubr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_msubr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
@@ -1701,8 +1701,8 @@ gen_msubr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_msubr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
@@ -1749,16 +1749,16 @@ gen_msub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_setcondi_i64(TCG_COND_LT, t2, t3, -0x80000000LL);
     tcg_gen_or_i64(t1, t1, t2);
     tcg_gen_extrl_i64_i32(cpu_PSW_V, t1);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, temp3, temp3);
-    tcg_gen_xor_tl(cpu_PSW_AV, temp3, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, temp3, temp3);
+    tcg_gen_xor_i32(cpu_PSW_AV, temp3, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, temp3);
+    tcg_gen_mov_i32(ret, temp3);
 }
 
 static inline void
@@ -1767,13 +1767,13 @@ gen_m16sub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     gen_sub_d(ret, arg1, temp);
 }
@@ -1784,13 +1784,13 @@ gen_m16subs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     gen_subs(ret, arg1, temp);
 }
@@ -1806,13 +1806,13 @@ gen_m16sub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     TCGv_i64 t3 = tcg_temp_new_i64();
 
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     tcg_gen_ext_i32_i64(t2, temp);
     tcg_gen_shli_i64(t2, t2, 16);
@@ -1832,13 +1832,13 @@ gen_m16subs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     TCGv_i64 t2 = tcg_temp_new_i64();
 
     if (n == 0) {
-        tcg_gen_mul_tl(temp, arg2, arg3);
+        tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(temp, arg2, arg3);
-        tcg_gen_shli_tl(temp, temp, 1);
+        tcg_gen_mul_i32(temp, arg2, arg3);
+        tcg_gen_shli_i32(temp, temp, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, temp, 0x80000000);
-        tcg_gen_sub_tl(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, temp, 0x80000000);
+        tcg_gen_sub_i32(temp, temp, temp2);
     }
     tcg_gen_ext_i32_i64(t2, temp);
     tcg_gen_shli_i64(t2, t2, 16);
@@ -1878,22 +1878,22 @@ gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     if (n == 1) {
         temp = tcg_temp_new();
         temp2 = tcg_temp_new();
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, arg2, 0x80000000);
-        tcg_gen_setcond_tl(TCG_COND_EQ, temp2, arg2, arg3);
-        tcg_gen_and_tl(temp, temp, temp2);
-        tcg_gen_shli_tl(temp, temp, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, arg2, 0x80000000);
+        tcg_gen_setcond_i32(TCG_COND_EQ, temp2, arg2, arg3);
+        tcg_gen_and_i32(temp, temp, temp2);
+        tcg_gen_shli_i32(temp, temp, 31);
         /* negate v bit, if special condition */
-        tcg_gen_xor_tl(cpu_PSW_V, cpu_PSW_V, temp);
+        tcg_gen_xor_i32(cpu_PSW_V, cpu_PSW_V, temp);
     }
     /* write back result */
     tcg_gen_extr_i64_i32(rl, rh, t4);
     /* Calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV/SAV bits */
-    tcg_gen_add_tl(cpu_PSW_AV, rh, rh);
-    tcg_gen_xor_tl(cpu_PSW_AV, rh, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, rh, rh);
+    tcg_gen_xor_i32(cpu_PSW_AV, rh, cpu_PSW_AV);
     /* calc SAV */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void
@@ -2012,8 +2012,8 @@ gen_msubadr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
         GEN_HELPER_UU(mul_h, temp64, r2, r3, t_n);
         break;
     }
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_helper_subadr_h(ret, tcg_env, temp64, temp, temp2);
 }
 
@@ -2043,13 +2043,13 @@ gen_msubads_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     }
     tcg_gen_extr_i64_i32(temp, temp2, temp64);
     gen_adds(ret_low, r1_low, temp);
-    tcg_gen_mov_tl(temp, cpu_PSW_V);
-    tcg_gen_mov_tl(temp3, cpu_PSW_AV);
+    tcg_gen_mov_i32(temp, cpu_PSW_V);
+    tcg_gen_mov_i32(temp3, cpu_PSW_AV);
     gen_subs(ret_high, r1_high, temp2);
     /* combine v bits */
-    tcg_gen_or_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_or_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* combine av bits */
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp3);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
 static inline void
@@ -2105,24 +2105,24 @@ gen_msubadr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
         GEN_HELPER_UU(mul_h, temp64, r2, r3, t_n);
         break;
     }
-    tcg_gen_andi_tl(temp2, r1, 0xffff0000);
-    tcg_gen_shli_tl(temp, r1, 16);
+    tcg_gen_andi_i32(temp2, r1, 0xffff0000);
+    tcg_gen_shli_i32(temp, r1, 16);
     gen_helper_subadr_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
 static inline void gen_abs(TCGv ret, TCGv r1)
 {
-    tcg_gen_abs_tl(ret, r1);
+    tcg_gen_abs_i32(ret, r1);
     /* overflow can only happen, if r1 = 0x80000000 */
-    tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, r1, 0x80000000);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, r1, 0x80000000);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
@@ -2130,25 +2130,25 @@ static inline void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
     TCGv temp = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
 
-    tcg_gen_sub_tl(result, r1, r2);
-    tcg_gen_sub_tl(temp, r2, r1);
-    tcg_gen_movcond_tl(TCG_COND_GT, result, r1, r2, result, temp);
+    tcg_gen_sub_i32(result, r1, r2);
+    tcg_gen_sub_i32(temp, r2, r1);
+    tcg_gen_movcond_i32(TCG_COND_GT, result, r1, r2, result, temp);
 
     /* calc V bit */
-    tcg_gen_xor_tl(cpu_PSW_V, result, r1);
-    tcg_gen_xor_tl(temp, result, r2);
-    tcg_gen_movcond_tl(TCG_COND_GT, cpu_PSW_V, r1, r2, cpu_PSW_V, temp);
-    tcg_gen_xor_tl(temp, r1, r2);
-    tcg_gen_and_tl(cpu_PSW_V, cpu_PSW_V, temp);
+    tcg_gen_xor_i32(cpu_PSW_V, result, r1);
+    tcg_gen_xor_i32(temp, result, r2);
+    tcg_gen_movcond_i32(TCG_COND_GT, cpu_PSW_V, r1, r2, cpu_PSW_V, temp);
+    tcg_gen_xor_i32(temp, r1, r2);
+    tcg_gen_and_i32(cpu_PSW_V, cpu_PSW_V, temp);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, result, result);
-    tcg_gen_xor_tl(cpu_PSW_AV, result, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, result, result);
+    tcg_gen_xor_i32(cpu_PSW_AV, result, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* write back result */
-    tcg_gen_mov_tl(ret, result);
+    tcg_gen_mov_i32(ret, result);
 }
 
 static inline void gen_absdifi(TCGv ret, TCGv r1, int32_t con)
@@ -2168,19 +2168,19 @@ static inline void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
     TCGv high = tcg_temp_new();
     TCGv low = tcg_temp_new();
 
-    tcg_gen_muls2_tl(low, high, r1, r2);
-    tcg_gen_mov_tl(ret, low);
+    tcg_gen_muls2_i32(low, high, r1, r2);
+    tcg_gen_mov_i32(ret, low);
     /* calc V bit */
-    tcg_gen_sari_tl(low, low, 31);
-    tcg_gen_setcond_tl(TCG_COND_NE, cpu_PSW_V, high, low);
-    tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+    tcg_gen_sari_i32(low, low, 31);
+    tcg_gen_setcond_i32(TCG_COND_NE, cpu_PSW_V, high, low);
+    tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_muli_i32s(TCGv ret, TCGv r1, int32_t con)
@@ -2191,16 +2191,16 @@ static inline void gen_muli_i32s(TCGv ret, TCGv r1, int32_t con)
 
 static inline void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
 {
-    tcg_gen_muls2_tl(ret_low, ret_high, r1, r2);
+    tcg_gen_muls2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret_high, ret_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret_high, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret_high, ret_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret_high, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_muli_i64s(TCGv ret_low, TCGv ret_high, TCGv r1,
@@ -2212,16 +2212,16 @@ static inline void gen_muli_i64s(TCGv ret_low, TCGv ret_high, TCGv r1,
 
 static inline void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
 {
-    tcg_gen_mulu2_tl(ret_low, ret_high, r1, r2);
+    tcg_gen_mulu2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
     /* calc SV bit */
-    tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+    tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     /* Calc AV bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret_high, ret_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret_high, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret_high, ret_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret_high, cpu_PSW_AV);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static inline void gen_muli_i64u(TCGv ret_low, TCGv ret_high, TCGv r1,
@@ -2264,7 +2264,7 @@ gen_mul_q(TCGv rl, TCGv rh, TCGv arg1, TCGv arg2, uint32_t n, uint32_t up_shift)
 
     if (n == 0) {
         if (up_shift == 32) {
-            tcg_gen_muls2_tl(rh, rl, arg1, arg2);
+            tcg_gen_muls2_i32(rh, rl, arg1, arg2);
         } else if (up_shift == 16) {
             tcg_gen_ext_i32_i64(temp_64, arg1);
             tcg_gen_ext_i32_i64(temp2_64, arg2);
@@ -2273,10 +2273,10 @@ gen_mul_q(TCGv rl, TCGv rh, TCGv arg1, TCGv arg2, uint32_t n, uint32_t up_shift)
             tcg_gen_shri_i64(temp_64, temp_64, up_shift);
             tcg_gen_extr_i64_i32(rl, rh, temp_64);
         } else {
-            tcg_gen_muls2_tl(rl, rh, arg1, arg2);
+            tcg_gen_muls2_i32(rl, rh, arg1, arg2);
         }
         /* reset v bit */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
     } else { /* n is expected to be 1 */
         tcg_gen_ext_i32_i64(temp_64, arg1);
         tcg_gen_ext_i32_i64(temp2_64, arg2);
@@ -2291,26 +2291,26 @@ gen_mul_q(TCGv rl, TCGv rh, TCGv arg1, TCGv arg2, uint32_t n, uint32_t up_shift)
         tcg_gen_extr_i64_i32(rl, rh, temp_64);
         /* overflow only occurs if r1 = r2 = 0x8000 */
         if (up_shift == 0) {/* result is 64 bit */
-            tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, rh,
+            tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, rh,
                                 0x80000000);
         } else { /* result is 32 bit */
-            tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, rl,
+            tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, rl,
                                 0x80000000);
         }
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* calc sv overflow bit */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
     }
     /* calc av overflow bit */
     if (up_shift == 0) {
-        tcg_gen_add_tl(cpu_PSW_AV, rh, rh);
-        tcg_gen_xor_tl(cpu_PSW_AV, rh, cpu_PSW_AV);
+        tcg_gen_add_i32(cpu_PSW_AV, rh, rh);
+        tcg_gen_xor_i32(cpu_PSW_AV, rh, cpu_PSW_AV);
     } else {
-        tcg_gen_add_tl(cpu_PSW_AV, rl, rl);
-        tcg_gen_xor_tl(cpu_PSW_AV, rl, cpu_PSW_AV);
+        tcg_gen_add_i32(cpu_PSW_AV, rl, rl);
+        tcg_gen_xor_i32(cpu_PSW_AV, rl, cpu_PSW_AV);
     }
     /* calc sav overflow bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static void
@@ -2318,47 +2318,47 @@ gen_mul_q_16(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(ret, arg1, arg2);
+        tcg_gen_mul_i32(ret, arg1, arg2);
     } else { /* n is expected to be 1 */
-        tcg_gen_mul_tl(ret, arg1, arg2);
-        tcg_gen_shli_tl(ret, ret, 1);
+        tcg_gen_mul_i32(ret, arg1, arg2);
+        tcg_gen_shli_i32(ret, ret, 1);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, ret, 0x80000000);
-        tcg_gen_sub_tl(ret, ret, temp);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, ret, 0x80000000);
+        tcg_gen_sub_i32(ret, ret, temp);
     }
     /* reset v bit */
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
     /* calc av overflow bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc sav overflow bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static void gen_mulr_q(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
     if (n == 0) {
-        tcg_gen_mul_tl(ret, arg1, arg2);
-        tcg_gen_addi_tl(ret, ret, 0x8000);
+        tcg_gen_mul_i32(ret, arg1, arg2);
+        tcg_gen_addi_i32(ret, ret, 0x8000);
     } else {
-        tcg_gen_mul_tl(ret, arg1, arg2);
-        tcg_gen_shli_tl(ret, ret, 1);
-        tcg_gen_addi_tl(ret, ret, 0x8000);
+        tcg_gen_mul_i32(ret, arg1, arg2);
+        tcg_gen_shli_i32(ret, ret, 1);
+        tcg_gen_addi_i32(ret, ret, 0x8000);
         /* catch special case r1 = r2 = 0x8000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, ret, 0x80008000);
-        tcg_gen_muli_tl(temp, temp, 0x8001);
-        tcg_gen_sub_tl(ret, ret, temp);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, ret, 0x80008000);
+        tcg_gen_muli_i32(temp, temp, 0x8001);
+        tcg_gen_sub_i32(ret, ret, temp);
     }
     /* reset v bit */
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
     /* calc av overflow bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc sav overflow bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* cut halfword off */
-    tcg_gen_andi_tl(ret, ret, 0xffff0000);
+    tcg_gen_andi_i32(ret, ret, 0xffff0000);
 }
 
 static inline void
@@ -2447,23 +2447,23 @@ gen_msubsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
 
 static void gen_saturate(TCGv ret, TCGv arg, int32_t up, int32_t low)
 {
-    tcg_gen_smax_tl(ret, arg, tcg_constant_i32(low));
-    tcg_gen_smin_tl(ret, ret, tcg_constant_i32(up));
+    tcg_gen_smax_i32(ret, arg, tcg_constant_i32(low));
+    tcg_gen_smin_i32(ret, ret, tcg_constant_i32(up));
 }
 
 static void gen_saturate_u(TCGv ret, TCGv arg, int32_t up)
 {
-    tcg_gen_umin_tl(ret, arg, tcg_constant_i32(up));
+    tcg_gen_umin_i32(ret, arg, tcg_constant_i32(up));
 }
 
 static void gen_shi(TCGv ret, TCGv r1, int32_t shift_count)
 {
     if (shift_count == -32) {
-        tcg_gen_movi_tl(ret, 0);
+        tcg_gen_movi_i32(ret, 0);
     } else if (shift_count >= 0) {
-        tcg_gen_shli_tl(ret, r1, shift_count);
+        tcg_gen_shli_i32(ret, r1, shift_count);
     } else {
-        tcg_gen_shri_tl(ret, r1, -shift_count);
+        tcg_gen_shri_i32(ret, r1, -shift_count);
     }
 }
 
@@ -2472,16 +2472,16 @@ static void gen_sh_hi(TCGv ret, TCGv r1, int32_t shiftcount)
     TCGv temp_low, temp_high;
 
     if (shiftcount == -16) {
-        tcg_gen_movi_tl(ret, 0);
+        tcg_gen_movi_i32(ret, 0);
     } else {
         temp_high = tcg_temp_new();
         temp_low = tcg_temp_new();
 
-        tcg_gen_andi_tl(temp_low, r1, 0xffff);
-        tcg_gen_andi_tl(temp_high, r1, 0xffff0000);
+        tcg_gen_andi_i32(temp_low, r1, 0xffff);
+        tcg_gen_andi_i32(temp_high, r1, 0xffff0000);
         gen_shi(temp_low, temp_low, shiftcount);
         gen_shi(ret, temp_high, shiftcount);
-        tcg_gen_deposit_tl(ret, ret, temp_low, 0, 16);
+        tcg_gen_deposit_i32(ret, ret, temp_low, 0, 16);
     }
 }
 
@@ -2493,16 +2493,16 @@ static void gen_shaci(TCGv ret, TCGv r1, int32_t shift_count)
 
     if (shift_count == 0) {
         /* Clear PSW.C and PSW.V */
-        tcg_gen_movi_tl(cpu_PSW_C, 0);
-        tcg_gen_mov_tl(cpu_PSW_V, cpu_PSW_C);
-        tcg_gen_mov_tl(ret, r1);
+        tcg_gen_movi_i32(cpu_PSW_C, 0);
+        tcg_gen_mov_i32(cpu_PSW_V, cpu_PSW_C);
+        tcg_gen_mov_i32(ret, r1);
     } else if (shift_count == -32) {
         /* set PSW.C */
-        tcg_gen_mov_tl(cpu_PSW_C, r1);
+        tcg_gen_mov_i32(cpu_PSW_C, r1);
         /* fill ret completely with sign bit */
-        tcg_gen_sari_tl(ret, r1, 31);
+        tcg_gen_sari_i32(ret, r1, 31);
         /* clear PSW.V */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
     } else if (shift_count > 0) {
         TCGv t_max = tcg_constant_i32(0x7FFFFFFF >> shift_count);
         TCGv t_min = tcg_constant_i32(((int32_t) -0x80000000) >> shift_count);
@@ -2510,30 +2510,30 @@ static void gen_shaci(TCGv ret, TCGv r1, int32_t shift_count)
         /* calc carry */
         msk_start = 32 - shift_count;
         msk = ((1 << shift_count) - 1) << msk_start;
-        tcg_gen_andi_tl(cpu_PSW_C, r1, msk);
+        tcg_gen_andi_i32(cpu_PSW_C, r1, msk);
         /* calc v/sv bits */
-        tcg_gen_setcond_tl(TCG_COND_GT, temp, r1, t_max);
-        tcg_gen_setcond_tl(TCG_COND_LT, temp2, r1, t_min);
-        tcg_gen_or_tl(cpu_PSW_V, temp, temp2);
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_setcond_i32(TCG_COND_GT, temp, r1, t_max);
+        tcg_gen_setcond_i32(TCG_COND_LT, temp2, r1, t_min);
+        tcg_gen_or_i32(cpu_PSW_V, temp, temp2);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* calc sv */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_V, cpu_PSW_SV);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_V, cpu_PSW_SV);
         /* do shift */
-        tcg_gen_shli_tl(ret, r1, shift_count);
+        tcg_gen_shli_i32(ret, r1, shift_count);
     } else {
         /* clear PSW.V */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
         /* calc carry */
         msk = (1 << -shift_count) - 1;
-        tcg_gen_andi_tl(cpu_PSW_C, r1, msk);
+        tcg_gen_andi_i32(cpu_PSW_C, r1, msk);
         /* do shift */
-        tcg_gen_sari_tl(ret, r1, -shift_count);
+        tcg_gen_sari_i32(ret, r1, -shift_count);
     }
     /* calc av overflow bit */
-    tcg_gen_add_tl(cpu_PSW_AV, ret, ret);
-    tcg_gen_xor_tl(cpu_PSW_AV, ret, cpu_PSW_AV);
+    tcg_gen_add_i32(cpu_PSW_AV, ret, ret);
+    tcg_gen_xor_i32(cpu_PSW_AV, ret, cpu_PSW_AV);
     /* calc sav overflow bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
 static void gen_shas(TCGv ret, TCGv r1, TCGv r2)
@@ -2552,23 +2552,23 @@ static void gen_sha_hi(TCGv ret, TCGv r1, int32_t shift_count)
     TCGv low, high;
 
     if (shift_count == 0) {
-        tcg_gen_mov_tl(ret, r1);
+        tcg_gen_mov_i32(ret, r1);
     } else if (shift_count > 0) {
         low = tcg_temp_new();
         high = tcg_temp_new();
 
-        tcg_gen_andi_tl(high, r1, 0xffff0000);
-        tcg_gen_shli_tl(low, r1, shift_count);
-        tcg_gen_shli_tl(ret, high, shift_count);
-        tcg_gen_deposit_tl(ret, ret, low, 0, 16);
+        tcg_gen_andi_i32(high, r1, 0xffff0000);
+        tcg_gen_shli_i32(low, r1, shift_count);
+        tcg_gen_shli_i32(ret, high, shift_count);
+        tcg_gen_deposit_i32(ret, ret, low, 0, 16);
     } else {
         low = tcg_temp_new();
         high = tcg_temp_new();
 
-        tcg_gen_ext16s_tl(low, r1);
-        tcg_gen_sari_tl(low, low, -shift_count);
-        tcg_gen_sari_tl(ret, r1, -shift_count);
-        tcg_gen_deposit_tl(ret, ret, low, 0, 16);
+        tcg_gen_ext16s_i32(low, r1);
+        tcg_gen_sari_i32(low, low, -shift_count);
+        tcg_gen_sari_i32(ret, r1, -shift_count);
+        tcg_gen_deposit_i32(ret, ret, low, 0, 16);
     }
 }
 
@@ -2578,9 +2578,9 @@ static void gen_sh_cond(int cond, TCGv ret, TCGv r1, TCGv r2)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_shli_tl(temp, ret, 1);
-    tcg_gen_setcond_tl(cond, temp2, r1, r2);
-    tcg_gen_or_tl(ret, temp, temp2);
+    tcg_gen_shli_i32(temp, ret, 1);
+    tcg_gen_setcond_i32(cond, temp2, r1, r2);
+    tcg_gen_or_i32(ret, temp, temp2);
 }
 
 static void gen_sh_condi(int cond, TCGv ret, TCGv r1, int32_t con)
@@ -2626,13 +2626,13 @@ static inline void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
     temp1 = tcg_temp_new();
     temp2 = tcg_temp_new();
 
-    tcg_gen_shri_tl(temp2, r2, pos2);
-    tcg_gen_shri_tl(temp1, r1, pos1);
+    tcg_gen_shri_i32(temp2, r2, pos2);
+    tcg_gen_shri_i32(temp1, r1, pos1);
 
     (*op1)(temp1, temp1, temp2);
     (*op2)(temp1 , ret, temp1);
 
-    tcg_gen_deposit_tl(ret, ret, temp1, 0, 1);
+    tcg_gen_deposit_i32(ret, ret, temp1, 0, 1);
 }
 
 /* ret = r1[pos1] op1 r2[pos2]; */
@@ -2645,12 +2645,12 @@ static inline void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
     temp1 = tcg_temp_new();
     temp2 = tcg_temp_new();
 
-    tcg_gen_shri_tl(temp2, r2, pos2);
-    tcg_gen_shri_tl(temp1, r1, pos1);
+    tcg_gen_shri_i32(temp2, r2, pos2);
+    tcg_gen_shri_i32(temp1, r1, pos1);
 
     (*op1)(ret, temp1, temp2);
 
-    tcg_gen_andi_tl(ret, ret, 0x1);
+    tcg_gen_andi_i32(ret, ret, 0x1);
 }
 
 static inline void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
@@ -2659,13 +2659,13 @@ static inline void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
     /* temp = (arg1 cond arg2 )*/
-    tcg_gen_setcond_tl(cond, temp, r1, r2);
+    tcg_gen_setcond_i32(cond, temp, r1, r2);
     /* temp2 = ret[0]*/
-    tcg_gen_andi_tl(temp2, ret, 0x1);
+    tcg_gen_andi_i32(temp2, ret, 0x1);
     /* temp = temp insn temp2 */
     (*op)(temp, temp, temp2);
     /* ret = {ret[31:1], temp} */
-    tcg_gen_deposit_tl(ret, ret, temp, 0, 1);
+    tcg_gen_deposit_i32(ret, ret, temp, 0, 1);
 }
 
 static inline void
@@ -2684,25 +2684,25 @@ static inline void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
     TCGv b3 = tcg_temp_new();
 
     /* byte 0 */
-    tcg_gen_andi_tl(b0, r1, 0xff);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, b0, b0, con & 0xff);
+    tcg_gen_andi_i32(b0, r1, 0xff);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, b0, b0, con & 0xff);
 
     /* byte 1 */
-    tcg_gen_andi_tl(b1, r1, 0xff00);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, b1, b1, con & 0xff00);
+    tcg_gen_andi_i32(b1, r1, 0xff00);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, b1, b1, con & 0xff00);
 
     /* byte 2 */
-    tcg_gen_andi_tl(b2, r1, 0xff0000);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, b2, b2, con & 0xff0000);
+    tcg_gen_andi_i32(b2, r1, 0xff0000);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, b2, b2, con & 0xff0000);
 
     /* byte 3 */
-    tcg_gen_andi_tl(b3, r1, 0xff000000);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, b3, b3, con & 0xff000000);
+    tcg_gen_andi_i32(b3, r1, 0xff000000);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, b3, b3, con & 0xff000000);
 
     /* combine them */
-    tcg_gen_or_tl(ret, b0, b1);
-    tcg_gen_or_tl(ret, ret, b2);
-    tcg_gen_or_tl(ret, ret, b3);
+    tcg_gen_or_i32(ret, b0, b1);
+    tcg_gen_or_i32(ret, ret, b2);
+    tcg_gen_or_i32(ret, ret, b3);
 }
 
 static inline void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
@@ -2711,15 +2711,15 @@ static inline void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
     TCGv h1 = tcg_temp_new();
 
     /* halfword 0 */
-    tcg_gen_andi_tl(h0, r1, 0xffff);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, h0, h0, con & 0xffff);
+    tcg_gen_andi_i32(h0, r1, 0xffff);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, h0, h0, con & 0xffff);
 
     /* halfword 1 */
-    tcg_gen_andi_tl(h1, r1, 0xffff0000);
-    tcg_gen_setcondi_tl(TCG_COND_EQ, h1, h1, con & 0xffff0000);
+    tcg_gen_andi_i32(h1, r1, 0xffff0000);
+    tcg_gen_setcondi_i32(TCG_COND_EQ, h1, h1, con & 0xffff0000);
 
     /* combine them */
-    tcg_gen_or_tl(ret, h0, h1);
+    tcg_gen_or_i32(ret, h0, h1);
 }
 
 /* mask = ((1 << width) -1) << pos;
@@ -2730,14 +2730,14 @@ static inline void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
 
-    tcg_gen_shl_tl(mask, tcg_constant_tl(1), width);
-    tcg_gen_subi_tl(mask, mask, 1);
-    tcg_gen_shl_tl(mask, mask, pos);
+    tcg_gen_shl_i32(mask, tcg_constant_i32(1), width);
+    tcg_gen_subi_i32(mask, mask, 1);
+    tcg_gen_shl_i32(mask, mask, pos);
 
-    tcg_gen_shl_tl(temp, r2, pos);
-    tcg_gen_and_tl(temp, temp, mask);
-    tcg_gen_andc_tl(temp2, r1, mask);
-    tcg_gen_or_tl(ret, temp, temp2);
+    tcg_gen_shl_i32(temp, r2, pos);
+    tcg_gen_and_i32(temp, temp, mask);
+    tcg_gen_andc_i32(temp2, r1, mask);
+    tcg_gen_or_i32(ret, temp, temp2);
 }
 
 static inline void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
@@ -2786,35 +2786,35 @@ static void gen_calc_usb_mul_h(TCGv arg_low, TCGv arg_high)
 {
     TCGv temp = tcg_temp_new();
     /* calc AV bit */
-    tcg_gen_add_tl(temp, arg_low, arg_low);
-    tcg_gen_xor_tl(temp, temp, arg_low);
-    tcg_gen_add_tl(cpu_PSW_AV, arg_high, arg_high);
-    tcg_gen_xor_tl(cpu_PSW_AV, cpu_PSW_AV, arg_high);
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp);
+    tcg_gen_add_i32(temp, arg_low, arg_low);
+    tcg_gen_xor_i32(temp, temp, arg_low);
+    tcg_gen_add_i32(cpu_PSW_AV, arg_high, arg_high);
+    tcg_gen_xor_i32(cpu_PSW_AV, cpu_PSW_AV, arg_high);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
 }
 
 static void gen_calc_usb_mulr_h(TCGv arg)
 {
     TCGv temp = tcg_temp_new();
     /* calc AV bit */
-    tcg_gen_add_tl(temp, arg, arg);
-    tcg_gen_xor_tl(temp, temp, arg);
-    tcg_gen_shli_tl(cpu_PSW_AV, temp, 16);
-    tcg_gen_or_tl(cpu_PSW_AV, cpu_PSW_AV, temp);
+    tcg_gen_add_i32(temp, arg, arg);
+    tcg_gen_xor_i32(temp, temp, arg);
+    tcg_gen_shli_i32(cpu_PSW_AV, temp, 16);
+    tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp);
     /* calc SAV bit */
-    tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+    tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
     /* clear V bit */
-    tcg_gen_movi_tl(cpu_PSW_V, 0);
+    tcg_gen_movi_i32(cpu_PSW_V, 0);
 }
 
 /* helpers for generating program flow micro-ops */
 
 static inline void gen_save_pc(vaddr pc)
 {
-    tcg_gen_movi_tl(cpu_PC, pc);
+    tcg_gen_movi_i32(cpu_PC, pc);
 }
 
 static void gen_goto_tb(DisasContext *ctx, unsigned tb_slot_index, vaddr dest)
@@ -2844,7 +2844,7 @@ static inline void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
                                    TCGv r2, int16_t address)
 {
     TCGLabel *jumpLabel = gen_new_label();
-    tcg_gen_brcond_tl(cond, r1, r2, jumpLabel);
+    tcg_gen_brcond_i32(cond, r1, r2, jumpLabel);
 
     gen_goto_tb(ctx, 1, ctx->pc_succ_insn);
 
@@ -2863,8 +2863,8 @@ static void gen_loop(DisasContext *ctx, int r1, int32_t offset)
 {
     TCGLabel *l1 = gen_new_label();
 
-    tcg_gen_subi_tl(cpu_gpr_a[r1], cpu_gpr_a[r1], 1);
-    tcg_gen_brcondi_tl(TCG_COND_EQ, cpu_gpr_a[r1], -1, l1);
+    tcg_gen_subi_i32(cpu_gpr_a[r1], cpu_gpr_a[r1], 1);
+    tcg_gen_brcondi_i32(TCG_COND_EQ, cpu_gpr_a[r1], -1, l1);
     gen_goto_tb(ctx, 1, ctx->base.pc_next + offset);
     gen_set_label(l1);
     gen_goto_tb(ctx, 0, ctx->pc_succ_insn);
@@ -2874,20 +2874,20 @@ static void gen_fcall_save_ctx(DisasContext *ctx)
 {
     TCGv temp = tcg_temp_new();
 
-    tcg_gen_addi_tl(temp, cpu_gpr_a[10], -4);
-    tcg_gen_qemu_st_tl(cpu_gpr_a[11], temp, ctx->mem_idx, MO_LESL);
-    tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
-    tcg_gen_mov_tl(cpu_gpr_a[10], temp);
+    tcg_gen_addi_i32(temp, cpu_gpr_a[10], -4);
+    tcg_gen_qemu_st_i32(cpu_gpr_a[11], temp, ctx->mem_idx, MO_LESL);
+    tcg_gen_movi_i32(cpu_gpr_a[11], ctx->pc_succ_insn);
+    tcg_gen_mov_i32(cpu_gpr_a[10], temp);
 }
 
 static void gen_fret(DisasContext *ctx)
 {
     TCGv temp = tcg_temp_new();
 
-    tcg_gen_andi_tl(temp, cpu_gpr_a[11], ~0x1);
-    tcg_gen_qemu_ld_tl(cpu_gpr_a[11], cpu_gpr_a[10], ctx->mem_idx, MO_LESL);
-    tcg_gen_addi_tl(cpu_gpr_a[10], cpu_gpr_a[10], 4);
-    tcg_gen_mov_tl(cpu_PC, temp);
+    tcg_gen_andi_i32(temp, cpu_gpr_a[11], ~0x1);
+    tcg_gen_qemu_ld_i32(cpu_gpr_a[11], cpu_gpr_a[10], ctx->mem_idx, MO_LESL);
+    tcg_gen_addi_i32(cpu_gpr_a[10], cpu_gpr_a[10], 4);
+    tcg_gen_mov_i32(cpu_PC, temp);
     ctx->base.is_jmp = DISAS_EXIT;
 }
 
@@ -2932,12 +2932,12 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
 /* SBRN-format jumps */
     case OPC1_16_SBRN_JZ_T:
         temp = tcg_temp_new();
-        tcg_gen_andi_tl(temp, cpu_gpr_d[15], 0x1u << constant);
+        tcg_gen_andi_i32(temp, cpu_gpr_d[15], 0x1u << constant);
         gen_branch_condi(ctx, TCG_COND_EQ, temp, 0, offset);
         break;
     case OPC1_16_SBRN_JNZ_T:
         temp = tcg_temp_new();
-        tcg_gen_andi_tl(temp, cpu_gpr_d[15], 0x1u << constant);
+        tcg_gen_andi_i32(temp, cpu_gpr_d[15], 0x1u << constant);
         gen_branch_condi(ctx, TCG_COND_NE, temp, 0, offset);
         break;
 /* SBR-format jumps */
@@ -2986,7 +2986,7 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         break;
 /* SR-format jumps */
     case OPC1_16_SR_JI:
-        tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], 0xfffffffe);
+        tcg_gen_andi_i32(cpu_PC, cpu_gpr_a[r1], 0xfffffffe);
         ctx->base.is_jmp = DISAS_EXIT;
         break;
     case OPC2_32_SYS_RET:
@@ -3008,13 +3008,13 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         gen_goto_tb(ctx, 0, EA_B_ABSOLUT(offset));
         break;
     case OPC1_32_B_JLA:
-        tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
+        tcg_gen_movi_i32(cpu_gpr_a[11], ctx->pc_succ_insn);
         /* fall through */
     case OPC1_32_B_JA:
         gen_goto_tb(ctx, 0, EA_B_ABSOLUT(offset));
         break;
     case OPC1_32_B_JL:
-        tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
+        tcg_gen_movi_i32(cpu_gpr_a[11], ctx->pc_succ_insn);
         gen_goto_tb(ctx, 0, ctx->base.pc_next + offset * 2);
         break;
 /* BOL format */
@@ -3046,14 +3046,14 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
     case OPCM_32_BRC_JNE:
         temp = tcg_temp_new();
         if (MASK_OP_BRC_OP2(ctx->opcode) == OPC2_32_BRC_JNED) {
-            tcg_gen_mov_tl(temp, cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* subi is unconditional */
-            tcg_gen_subi_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
+            tcg_gen_subi_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
             gen_branch_condi(ctx, TCG_COND_NE, temp, constant, offset);
         } else {
-            tcg_gen_mov_tl(temp, cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* addi is unconditional */
-            tcg_gen_addi_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
+            tcg_gen_addi_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
             gen_branch_condi(ctx, TCG_COND_NE, temp, constant, offset);
         }
         break;
@@ -3062,7 +3062,7 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         n = MASK_OP_BRN_N(ctx->opcode);
 
         temp = tcg_temp_new();
-        tcg_gen_andi_tl(temp, cpu_gpr_d[r1], (1 << n));
+        tcg_gen_andi_i32(temp, cpu_gpr_d[r1], (1 << n));
 
         if (MASK_OP_BRN_OP2(ctx->opcode) == OPC2_32_BRN_JNZ_T) {
             gen_branch_condi(ctx, TCG_COND_NE, temp, 0, offset);
@@ -3119,18 +3119,18 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         temp = tcg_temp_new();
         temp2 = tcg_temp_new();
         if (MASK_OP_BRC_OP2(ctx->opcode) == OPC2_32_BRR_JNED) {
-            tcg_gen_mov_tl(temp, cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* also save r2, in case of r1 == r2, so r2 is not decremented */
-            tcg_gen_mov_tl(temp2, cpu_gpr_d[r2]);
+            tcg_gen_mov_i32(temp2, cpu_gpr_d[r2]);
             /* subi is unconditional */
-            tcg_gen_subi_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
+            tcg_gen_subi_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
             gen_branch_cond(ctx, TCG_COND_NE, temp, temp2, offset);
         } else {
-            tcg_gen_mov_tl(temp, cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* also save r2, in case of r1 == r2, so r2 is not decremented */
-            tcg_gen_mov_tl(temp2, cpu_gpr_d[r2]);
+            tcg_gen_mov_i32(temp2, cpu_gpr_d[r2]);
             /* addi is unconditional */
-            tcg_gen_addi_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
+            tcg_gen_addi_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 1);
             gen_branch_cond(ctx, TCG_COND_NE, temp, temp2, offset);
         }
         break;
@@ -3171,7 +3171,7 @@ static void decode_src_opc(DisasContext *ctx, int op1)
         gen_addi_d(cpu_gpr_d[15], cpu_gpr_d[r1], const4);
         break;
     case OPC1_16_SRC_ADD_A:
-        tcg_gen_addi_tl(cpu_gpr_a[r1], cpu_gpr_a[r1], const4);
+        tcg_gen_addi_i32(cpu_gpr_a[r1], cpu_gpr_a[r1], const4);
         break;
     case OPC1_16_SRC_CADD:
         gen_condi_add(TCG_COND_NE, cpu_gpr_d[r1], const4, cpu_gpr_d[r1],
@@ -3182,37 +3182,37 @@ static void decode_src_opc(DisasContext *ctx, int op1)
                       cpu_gpr_d[15]);
         break;
     case OPC1_16_SRC_CMOV:
-        temp = tcg_constant_tl(0);
-        temp2 = tcg_constant_tl(const4);
-        tcg_gen_movcond_tl(TCG_COND_NE, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
+        temp = tcg_constant_i32(0);
+        temp2 = tcg_constant_i32(const4);
+        tcg_gen_movcond_i32(TCG_COND_NE, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
                            temp2, cpu_gpr_d[r1]);
         break;
     case OPC1_16_SRC_CMOVN:
-        temp = tcg_constant_tl(0);
-        temp2 = tcg_constant_tl(const4);
-        tcg_gen_movcond_tl(TCG_COND_EQ, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
+        temp = tcg_constant_i32(0);
+        temp2 = tcg_constant_i32(const4);
+        tcg_gen_movcond_i32(TCG_COND_EQ, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
                            temp2, cpu_gpr_d[r1]);
         break;
     case OPC1_16_SRC_EQ:
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_gpr_d[15], cpu_gpr_d[r1],
+        tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_gpr_d[15], cpu_gpr_d[r1],
                             const4);
         break;
     case OPC1_16_SRC_LT:
-        tcg_gen_setcondi_tl(TCG_COND_LT, cpu_gpr_d[15], cpu_gpr_d[r1],
+        tcg_gen_setcondi_i32(TCG_COND_LT, cpu_gpr_d[15], cpu_gpr_d[r1],
                             const4);
         break;
     case OPC1_16_SRC_MOV:
-        tcg_gen_movi_tl(cpu_gpr_d[r1], const4);
+        tcg_gen_movi_i32(cpu_gpr_d[r1], const4);
         break;
     case OPC1_16_SRC_MOV_A:
         const4 = MASK_OP_SRC_CONST4(ctx->opcode);
-        tcg_gen_movi_tl(cpu_gpr_a[r1], const4);
+        tcg_gen_movi_i32(cpu_gpr_a[r1], const4);
         break;
     case OPC1_16_SRC_MOV_E:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             CHECK_REG_PAIR(r1);
-            tcg_gen_movi_tl(cpu_gpr_d[r1], const4);
-            tcg_gen_sari_tl(cpu_gpr_d[r1+1], cpu_gpr_d[r1], 31);
+            tcg_gen_movi_i32(cpu_gpr_d[r1], const4);
+            tcg_gen_sari_i32(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], 31);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
@@ -3247,49 +3247,49 @@ static void decode_srr_opc(DisasContext *ctx, int op1)
         gen_add_d(cpu_gpr_d[15], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_ADD_A:
-        tcg_gen_add_tl(cpu_gpr_a[r1], cpu_gpr_a[r1], cpu_gpr_a[r2]);
+        tcg_gen_add_i32(cpu_gpr_a[r1], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         break;
     case OPC1_16_SRR_ADDS:
         gen_adds(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_AND:
-        tcg_gen_and_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_and_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_CMOV:
-        temp = tcg_constant_tl(0);
-        tcg_gen_movcond_tl(TCG_COND_NE, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
+        temp = tcg_constant_i32(0);
+        tcg_gen_movcond_i32(TCG_COND_NE, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
                            cpu_gpr_d[r2], cpu_gpr_d[r1]);
         break;
     case OPC1_16_SRR_CMOVN:
-        temp = tcg_constant_tl(0);
-        tcg_gen_movcond_tl(TCG_COND_EQ, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
+        temp = tcg_constant_i32(0);
+        tcg_gen_movcond_i32(TCG_COND_EQ, cpu_gpr_d[r1], cpu_gpr_d[15], temp,
                            cpu_gpr_d[r2], cpu_gpr_d[r1]);
         break;
     case OPC1_16_SRR_EQ:
-        tcg_gen_setcond_tl(TCG_COND_EQ, cpu_gpr_d[15], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_EQ, cpu_gpr_d[15], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_LT:
-        tcg_gen_setcond_tl(TCG_COND_LT, cpu_gpr_d[15], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_LT, cpu_gpr_d[15], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_MOV:
-        tcg_gen_mov_tl(cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_mov_i32(cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_MOV_A:
-        tcg_gen_mov_tl(cpu_gpr_a[r1], cpu_gpr_d[r2]);
+        tcg_gen_mov_i32(cpu_gpr_a[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_MOV_AA:
-        tcg_gen_mov_tl(cpu_gpr_a[r1], cpu_gpr_a[r2]);
+        tcg_gen_mov_i32(cpu_gpr_a[r1], cpu_gpr_a[r2]);
         break;
     case OPC1_16_SRR_MOV_D:
-        tcg_gen_mov_tl(cpu_gpr_d[r1], cpu_gpr_a[r2]);
+        tcg_gen_mov_i32(cpu_gpr_d[r1], cpu_gpr_a[r2]);
         break;
     case OPC1_16_SRR_MUL:
         gen_mul_i32s(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_OR:
-        tcg_gen_or_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_or_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_SUB:
         gen_sub_d(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
@@ -3304,7 +3304,7 @@ static void decode_srr_opc(DisasContext *ctx, int op1)
         gen_subs(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC1_16_SRR_XOR:
-        tcg_gen_xor_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_xor_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3320,32 +3320,32 @@ static void decode_ssr_opc(DisasContext *ctx, int op1)
 
     switch (op1) {
     case OPC1_16_SSR_ST_A:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
         break;
     case OPC1_16_SSR_ST_A_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
         break;
     case OPC1_16_SSR_ST_B:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
         break;
     case OPC1_16_SSR_ST_B_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 1);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 1);
         break;
     case OPC1_16_SSR_ST_H:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUW);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUW);
         break;
     case OPC1_16_SSR_ST_H_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 2);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUW);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 2);
         break;
     case OPC1_16_SSR_ST_W:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
         break;
     case OPC1_16_SSR_ST_W_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LEUL);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3360,7 +3360,7 @@ static void decode_sc_opc(DisasContext *ctx, int op1)
 
     switch (op1) {
     case OPC1_16_SC_AND:
-        tcg_gen_andi_tl(cpu_gpr_d[15], cpu_gpr_d[15], const16);
+        tcg_gen_andi_i32(cpu_gpr_d[15], cpu_gpr_d[15], const16);
         break;
     case OPC1_16_SC_BISR:
         if (ctx->priv == TRICORE_PRIV_SM) {
@@ -3376,10 +3376,10 @@ static void decode_sc_opc(DisasContext *ctx, int op1)
         gen_offset_ld(ctx, cpu_gpr_d[15], cpu_gpr_a[10], const16 * 4, MO_LESL);
         break;
     case OPC1_16_SC_MOV:
-        tcg_gen_movi_tl(cpu_gpr_d[15], const16);
+        tcg_gen_movi_i32(cpu_gpr_d[15], const16);
         break;
     case OPC1_16_SC_OR:
-        tcg_gen_ori_tl(cpu_gpr_d[15], cpu_gpr_d[15], const16);
+        tcg_gen_ori_i32(cpu_gpr_d[15], cpu_gpr_d[15], const16);
         break;
     case OPC1_16_SC_ST_A:
         gen_offset_st(ctx, cpu_gpr_a[15], cpu_gpr_a[10], const16 * 4, MO_LESL);
@@ -3388,7 +3388,7 @@ static void decode_sc_opc(DisasContext *ctx, int op1)
         gen_offset_st(ctx, cpu_gpr_d[15], cpu_gpr_a[10], const16 * 4, MO_LESL);
         break;
     case OPC1_16_SC_SUB_A:
-        tcg_gen_subi_tl(cpu_gpr_a[10], cpu_gpr_a[10], const16);
+        tcg_gen_subi_i32(cpu_gpr_a[10], cpu_gpr_a[10], const16);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3405,32 +3405,32 @@ static void decode_slr_opc(DisasContext *ctx, int op1)
     switch (op1) {
 /* SLR-format */
     case OPC1_16_SLR_LD_A:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
         break;
     case OPC1_16_SLR_LD_A_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
         break;
     case OPC1_16_SLR_LD_BU:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
         break;
     case OPC1_16_SLR_LD_BU_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 1);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_UB);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 1);
         break;
     case OPC1_16_SLR_LD_H:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESW);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESW);
         break;
     case OPC1_16_SLR_LD_H_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 2);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESW);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 2);
         break;
     case OPC1_16_SLR_LD_W:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
         break;
     case OPC1_16_SLR_LD_W_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx, MO_LESL);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], 4);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3513,17 +3513,18 @@ static void decode_sr_accu(DisasContext *ctx)
     switch (op2) {
     case OPC2_16_SR_RSUB:
         /* calc V bit -- overflow only if r1 = -0x80000000 */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r1], -0x80000000);
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V,
+                             cpu_gpr_d[r1], -0x80000000);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* calc SV bit */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
         /* sub */
-        tcg_gen_neg_tl(cpu_gpr_d[r1], cpu_gpr_d[r1]);
+        tcg_gen_neg_i32(cpu_gpr_d[r1], cpu_gpr_d[r1]);
         /* calc av */
-        tcg_gen_add_tl(cpu_PSW_AV, cpu_gpr_d[r1], cpu_gpr_d[r1]);
-        tcg_gen_xor_tl(cpu_PSW_AV, cpu_gpr_d[r1], cpu_PSW_AV);
+        tcg_gen_add_i32(cpu_PSW_AV, cpu_gpr_d[r1], cpu_gpr_d[r1]);
+        tcg_gen_xor_i32(cpu_PSW_AV, cpu_gpr_d[r1], cpu_PSW_AV);
         /* calc sav */
-        tcg_gen_or_tl(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
+        tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
         break;
     case OPC2_16_SR_SAT_B:
         gen_saturate(cpu_gpr_d[r1], cpu_gpr_d[r1], 0x7f, -0x80);
@@ -3616,8 +3617,8 @@ static void decode_16Bit_opc(DisasContext *ctx)
         r1 = MASK_OP_SRRS_S1D(ctx->opcode);
         const16 = MASK_OP_SRRS_N(ctx->opcode);
         temp = tcg_temp_new();
-        tcg_gen_shli_tl(temp, cpu_gpr_d[15], const16);
-        tcg_gen_add_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], temp);
+        tcg_gen_shli_i32(temp, cpu_gpr_d[15], const16);
+        tcg_gen_add_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], temp);
         break;
 /* SLRO-format */
     case OPC1_16_SLRO_LD_A:
@@ -3766,7 +3767,7 @@ static void decode_16Bit_opc(DisasContext *ctx)
         break;
     case OPC1_16_SR_NOT:
         r1 = MASK_OP_SR_S1D(ctx->opcode);
-        tcg_gen_not_tl(cpu_gpr_d[r1], cpu_gpr_d[r1]);
+        tcg_gen_not_i32(cpu_gpr_d[r1], cpu_gpr_d[r1]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3793,18 +3794,18 @@ static void decode_abs_ldw(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_ABS_LD_A:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LESL);
         break;
     case OPC2_32_ABS_LD_D:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp, ctx);
+        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
         break;
     case OPC2_32_ABS_LD_DA:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp, ctx);
+        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
         break;
     case OPC2_32_ABS_LD_W:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3826,16 +3827,16 @@ static void decode_abs_ldb(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_ABS_LD_B:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_SB);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_SB);
         break;
     case OPC2_32_ABS_LD_BU:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_UB);
         break;
     case OPC2_32_ABS_LD_H:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESW);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESW);
         break;
     case OPC2_32_ABS_LD_HU:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3908,18 +3909,18 @@ static void decode_abs_store(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_ABS_ST_A:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LESL);
         break;
     case OPC2_32_ABS_ST_D:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp, ctx);
+        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
         break;
     case OPC2_32_ABS_ST_DA:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp, ctx);
+        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
         break;
     case OPC2_32_ABS_ST_W:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -3941,10 +3942,10 @@ static void decode_abs_storeb_h(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_ABS_ST_B:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_UB);
         break;
     case OPC2_32_ABS_ST_H:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -4043,11 +4044,11 @@ static void decode_bit_insert(DisasContext *ctx)
 
     temp = tcg_temp_new();
 
-    tcg_gen_shri_tl(temp, cpu_gpr_d[r2], pos2);
+    tcg_gen_shri_i32(temp, cpu_gpr_d[r2], pos2);
     if (op2 == OPC2_32_BIT_INSN_T) {
-        tcg_gen_not_tl(temp, temp);
+        tcg_gen_not_i32(temp, temp);
     }
-    tcg_gen_deposit_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], temp, pos1, 1);
+    tcg_gen_deposit_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], temp, pos1, 1);
 }
 
 static void decode_bit_logical_t2(DisasContext *ctx)
@@ -4163,8 +4164,8 @@ static void decode_bit_sh_logic1(DisasContext *ctx)
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
     }
-    tcg_gen_shli_tl(cpu_gpr_d[r3], cpu_gpr_d[r3], 1);
-    tcg_gen_add_tl(cpu_gpr_d[r3], cpu_gpr_d[r3], temp);
+    tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r3], 1);
+    tcg_gen_add_i32(cpu_gpr_d[r3], cpu_gpr_d[r3], temp);
 }
 
 static void decode_bit_sh_logic2(DisasContext *ctx)
@@ -4203,8 +4204,8 @@ static void decode_bit_sh_logic2(DisasContext *ctx)
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
     }
-    tcg_gen_shli_tl(cpu_gpr_d[r3], cpu_gpr_d[r3], 1);
-    tcg_gen_add_tl(cpu_gpr_d[r3], cpu_gpr_d[r3], temp);
+    tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r3], 1);
+    tcg_gen_add_i32(cpu_gpr_d[r3], cpu_gpr_d[r3], temp);
 }
 
 /* BO-format */
@@ -4233,14 +4234,14 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
     case OPC2_32_BO_CACHEA_I_POSTINC:
         /* instruction to access the cache, but we still need to handle
            the addressing mode */
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_CACHEA_WI_PREINC:
     case OPC2_32_BO_CACHEA_W_PREINC:
     case OPC2_32_BO_CACHEA_I_PREINC:
         /* instruction to access the cache, but we still need to handle
            the addressing mode */
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_CACHEI_WI_SHORTOFF:
     case OPC2_32_BO_CACHEI_W_SHORTOFF:
@@ -4251,7 +4252,7 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
     case OPC2_32_BO_CACHEI_W_POSTINC:
     case OPC2_32_BO_CACHEI_WI_POSTINC:
         if (has_feature(ctx, TRICORE_FEATURE_131)) {
-            tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+            tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
@@ -4259,7 +4260,7 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
     case OPC2_32_BO_CACHEI_W_PREINC:
     case OPC2_32_BO_CACHEI_WI_PREINC:
         if (has_feature(ctx, TRICORE_FEATURE_131)) {
-            tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+            tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
@@ -4268,9 +4269,9 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         gen_offset_st(ctx, cpu_gpr_a[r1], cpu_gpr_a[r2], off10, MO_LESL);
         break;
     case OPC2_32_BO_ST_A_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LESL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_A_PREINC:
         gen_st_preincr(ctx, cpu_gpr_a[r1], cpu_gpr_a[r2], off10, MO_LESL);
@@ -4279,82 +4280,82 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_UB);
         break;
     case OPC2_32_BO_ST_B_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_UB);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_B_PREINC:
         gen_st_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_UB);
         break;
     case OPC2_32_BO_ST_D_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_st_2regs(cpu_gpr_d[r1+1], cpu_gpr_d[r1], cpu_gpr_a[r2],
+        gen_offset_st_2regs(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
                             off10, ctx);
         break;
     case OPC2_32_BO_ST_D_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_D_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
-        gen_st_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp, ctx);
-        tcg_gen_mov_tl(cpu_gpr_a[r2], temp);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
+        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_ST_DA_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_st_2regs(cpu_gpr_a[r1+1], cpu_gpr_a[r1], cpu_gpr_a[r2],
+        gen_offset_st_2regs(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
                             off10, ctx);
         break;
     case OPC2_32_BO_ST_DA_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_DA_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
-        gen_st_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp, ctx);
-        tcg_gen_mov_tl(cpu_gpr_a[r2], temp);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
+        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_ST_H_SHORTOFF:
         gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_H_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_H_PREINC:
         gen_st_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_Q_SHORTOFF:
         temp = tcg_temp_new();
-        tcg_gen_shri_tl(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
         gen_offset_st(ctx, temp, cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_Q_POSTINC:
         temp = tcg_temp_new();
-        tcg_gen_shri_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_qemu_st_tl(temp, cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_qemu_st_i32(temp, cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_Q_PREINC:
         temp = tcg_temp_new();
-        tcg_gen_shri_tl(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
         gen_st_preincr(ctx, temp, cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_W_SHORTOFF:
         gen_offset_st(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUL);
         break;
     case OPC2_32_BO_ST_W_POSTINC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_W_PREINC:
         gen_st_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUL);
@@ -4380,91 +4381,91 @@ static void decode_bo_addrmode_bitreverse_circular(DisasContext *ctx)
     temp2 = tcg_temp_new();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
-    tcg_gen_ext16u_tl(temp, cpu_gpr_a[r2+1]);
-    tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
+    tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
+    tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
 
     switch (op2) {
     case OPC2_32_BO_CACHEA_WI_BR:
     case OPC2_32_BO_CACHEA_W_BR:
     case OPC2_32_BO_CACHEA_I_BR:
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_CACHEA_WI_CIRC:
     case OPC2_32_BO_CACHEA_W_CIRC:
     case OPC2_32_BO_CACHEA_I_CIRC:
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_A_BR:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_A_CIRC:
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_B_BR:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_B_CIRC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_D_BR:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp2, ctx);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2, ctx);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_D_CIRC:
         CHECK_REG_PAIR(r1);
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        tcg_gen_shri_tl(temp2, cpu_gpr_a[r2+1], 16);
-        tcg_gen_addi_tl(temp, temp, 4);
-        tcg_gen_rem_tl(temp, temp, temp2);
-        tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1+1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        tcg_gen_shri_i32(temp2, cpu_gpr_a[r2 + 1], 16);
+        tcg_gen_addi_i32(temp, temp, 4);
+        tcg_gen_rem_i32(temp, temp, temp2);
+        tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1 + 1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_DA_BR:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp2, ctx);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2, ctx);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_DA_CIRC:
         CHECK_REG_PAIR(r1);
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        tcg_gen_shri_tl(temp2, cpu_gpr_a[r2+1], 16);
-        tcg_gen_addi_tl(temp, temp, 4);
-        tcg_gen_rem_tl(temp, temp, temp2);
-        tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
-        tcg_gen_qemu_st_tl(cpu_gpr_a[r1+1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        tcg_gen_shri_i32(temp2, cpu_gpr_a[r2 + 1], 16);
+        tcg_gen_addi_i32(temp, temp, 4);
+        tcg_gen_rem_i32(temp, temp, temp2);
+        tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
+        tcg_gen_qemu_st_i32(cpu_gpr_a[r1 + 1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_H_BR:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_H_CIRC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_Q_BR:
-        tcg_gen_shri_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_qemu_st_tl(temp, temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_qemu_st_i32(temp, temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_Q_CIRC:
-        tcg_gen_shri_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_qemu_st_tl(temp, temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_qemu_st_i32(temp, temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_ST_W_BR:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_W_CIRC:
-        tcg_gen_qemu_st_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -4488,9 +4489,9 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         gen_offset_ld(ctx, cpu_gpr_a[r1], cpu_gpr_a[r2], off10, MO_LEUL);
         break;
     case OPC2_32_BO_LD_A_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_A_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_a[r1], cpu_gpr_a[r2], off10, MO_LEUL);
@@ -4499,9 +4500,9 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_SB);
         break;
     case OPC2_32_BO_LD_B_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_SB);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_B_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_SB);
@@ -4510,54 +4511,54 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_UB);
         break;
     case OPC2_32_BO_LD_BU_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_UB);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_BU_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_UB);
         break;
     case OPC2_32_BO_LD_D_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_ld_2regs(cpu_gpr_d[r1+1], cpu_gpr_d[r1], cpu_gpr_a[r2],
+        gen_offset_ld_2regs(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
                             off10, ctx);
         break;
     case OPC2_32_BO_LD_D_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_D_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
-        gen_ld_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp, ctx);
-        tcg_gen_mov_tl(cpu_gpr_a[r2], temp);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
+        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_LD_DA_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_ld_2regs(cpu_gpr_a[r1+1], cpu_gpr_a[r1], cpu_gpr_a[r2],
+        gen_offset_ld_2regs(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
                             off10, ctx);
         break;
     case OPC2_32_BO_LD_DA_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_DA_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
-        gen_ld_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp, ctx);
-        tcg_gen_mov_tl(cpu_gpr_a[r2], temp);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
+        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_LD_H_SHORTOFF:
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LESW);
         break;
     case OPC2_32_BO_LD_H_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LESW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_H_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LESW);
@@ -4566,34 +4567,34 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_LD_HU_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUW);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_HU_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_LD_Q_SHORTOFF:
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
         break;
     case OPC2_32_BO_LD_Q_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_Q_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
         break;
     case OPC2_32_BO_LD_W_SHORTOFF:
         gen_offset_ld(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUL);
         break;
     case OPC2_32_BO_LD_W_POSTINC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUL);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_W_PREINC:
         gen_ld_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUL);
@@ -4619,98 +4620,98 @@ static void decode_bo_addrmode_ld_bitreverse_circular(DisasContext *ctx)
     temp2 = tcg_temp_new();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
-    tcg_gen_ext16u_tl(temp, cpu_gpr_a[r2+1]);
-    tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
+    tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
+    tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
 
 
     switch (op2) {
     case OPC2_32_BO_LD_A_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_A_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_B_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_SB);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_SB);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_B_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_SB);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_SB);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_BU_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_BU_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_UB);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_D_BR:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1+1], cpu_gpr_d[r1], temp2, ctx);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2, ctx);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_D_CIRC:
         CHECK_REG_PAIR(r1);
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        tcg_gen_shri_tl(temp2, cpu_gpr_a[r2+1], 16);
-        tcg_gen_addi_tl(temp, temp, 4);
-        tcg_gen_rem_tl(temp, temp, temp2);
-        tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1+1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        tcg_gen_shri_i32(temp2, cpu_gpr_a[r2 + 1], 16);
+        tcg_gen_addi_i32(temp, temp, 4);
+        tcg_gen_rem_i32(temp, temp, temp2);
+        tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1 + 1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_DA_BR:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1+1], cpu_gpr_a[r1], temp2, ctx);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2, ctx);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_DA_CIRC:
         CHECK_REG_PAIR(r1);
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
-        tcg_gen_shri_tl(temp2, cpu_gpr_a[r2+1], 16);
-        tcg_gen_addi_tl(temp, temp, 4);
-        tcg_gen_rem_tl(temp, temp, temp2);
-        tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1+1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp2, ctx->mem_idx, MO_LEUL);
+        tcg_gen_shri_i32(temp2, cpu_gpr_a[r2 + 1], 16);
+        tcg_gen_addi_i32(temp, temp, 4);
+        tcg_gen_rem_i32(temp, temp, temp2);
+        tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1 + 1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_H_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LESW);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LESW);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_H_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LESW);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LESW);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_HU_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_HU_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_Q_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_Q_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUW);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_LD_W_BR:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_W_CIRC:
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp2, ctx->mem_idx, MO_LEUL);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -4735,70 +4736,70 @@ static void decode_bo_addrmode_stctx_post_pre_base(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_BO_LDLCX_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_helper_ldlcx(tcg_env, temp);
         break;
     case OPC2_32_BO_LDMST_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_ldmst(ctx, r1, temp);
         break;
     case OPC2_32_BO_LDMST_POSTINC:
         gen_ldmst(ctx, r1, cpu_gpr_a[r2]);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LDMST_PREINC:
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         gen_ldmst(ctx, r1, cpu_gpr_a[r2]);
         break;
     case OPC2_32_BO_LDUCX_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_helper_lducx(tcg_env, temp);
         break;
     case OPC2_32_BO_LEA_SHORTOFF:
-        tcg_gen_addi_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_STLCX_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_helper_stlcx(tcg_env, temp);
         break;
     case OPC2_32_BO_STUCX_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_helper_stucx(tcg_env, temp);
         break;
     case OPC2_32_BO_SWAP_W_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_swap(ctx, r1, temp);
         break;
     case OPC2_32_BO_SWAP_W_POSTINC:
         gen_swap(ctx, r1, cpu_gpr_a[r2]);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_SWAP_W_PREINC:
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         gen_swap(ctx, r1, cpu_gpr_a[r2]);
         break;
     case OPC2_32_BO_CMPSWAP_W_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_cmpswap(ctx, r1, temp);
         break;
     case OPC2_32_BO_CMPSWAP_W_POSTINC:
         gen_cmpswap(ctx, r1, cpu_gpr_a[r2]);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_CMPSWAP_W_PREINC:
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         gen_cmpswap(ctx, r1, cpu_gpr_a[r2]);
         break;
     case OPC2_32_BO_SWAPMSK_W_SHORTOFF:
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_swapmsk(ctx, r1, temp);
         break;
     case OPC2_32_BO_SWAPMSK_W_POSTINC:
         gen_swapmsk(ctx, r1, cpu_gpr_a[r2]);
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_SWAPMSK_W_PREINC:
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         gen_swapmsk(ctx, r1, cpu_gpr_a[r2]);
         break;
     default:
@@ -4822,41 +4823,41 @@ static void decode_bo_addrmode_ldmst_bitreverse_circular(DisasContext *ctx)
     temp2 = tcg_temp_new();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
-    tcg_gen_ext16u_tl(temp, cpu_gpr_a[r2+1]);
-    tcg_gen_add_tl(temp2, cpu_gpr_a[r2], temp);
+    tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
+    tcg_gen_add_i32(temp2, cpu_gpr_a[r2], temp);
 
     switch (op2) {
     case OPC2_32_BO_LDMST_BR:
         gen_ldmst(ctx, r1, temp2);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LDMST_CIRC:
         gen_ldmst(ctx, r1, temp2);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_SWAP_W_BR:
         gen_swap(ctx, r1, temp2);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_SWAP_W_CIRC:
         gen_swap(ctx, r1, temp2);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_CMPSWAP_W_BR:
         gen_cmpswap(ctx, r1, temp2);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_CMPSWAP_W_CIRC:
         gen_cmpswap(ctx, r1, temp2);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     case OPC2_32_BO_SWAPMSK_W_BR:
         gen_swapmsk(ctx, r1, temp2);
-        gen_helper_br_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1]);
+        gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_SWAPMSK_W_CIRC:
         gen_swapmsk(ctx, r1, temp2);
-        gen_helper_circ_update(cpu_gpr_a[r2+1], cpu_gpr_a[r2+1], t_off10);
+        gen_helper_circ_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1], t_off10);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -4876,16 +4877,16 @@ static void decode_bol_opc(DisasContext *ctx, int32_t op1)
     switch (op1) {
     case OPC1_32_BOL_LD_A_LONGOFF:
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], address);
-        tcg_gen_qemu_ld_tl(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LEUL);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], address);
+        tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LEUL);
         break;
     case OPC1_32_BOL_LD_W_LONGOFF:
         temp = tcg_temp_new();
-        tcg_gen_addi_tl(temp, cpu_gpr_a[r2], address);
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUL);
+        tcg_gen_addi_i32(temp, cpu_gpr_a[r2], address);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUL);
         break;
     case OPC1_32_BOL_LEA_LONGOFF:
-        tcg_gen_addi_tl(cpu_gpr_a[r1], cpu_gpr_a[r2], address);
+        tcg_gen_addi_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], address);
         break;
     case OPC1_32_BOL_ST_A_LONGOFF:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
@@ -4959,26 +4960,26 @@ static void decode_rc_logical_shift(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RC_AND:
-        tcg_gen_andi_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_andi_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_ANDN:
-        tcg_gen_andi_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], ~const9);
+        tcg_gen_andi_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], ~const9);
         break;
     case OPC2_32_RC_NAND:
         temp = tcg_temp_new();
-        tcg_gen_movi_tl(temp, const9);
-        tcg_gen_nand_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
+        tcg_gen_movi_i32(temp, const9);
+        tcg_gen_nand_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_NOR:
         temp = tcg_temp_new();
-        tcg_gen_movi_tl(temp, const9);
-        tcg_gen_nor_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
+        tcg_gen_movi_i32(temp, const9);
+        tcg_gen_nor_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_OR:
-        tcg_gen_ori_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_ori_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_ORN:
-        tcg_gen_ori_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], ~const9);
+        tcg_gen_ori_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], ~const9);
         break;
     case OPC2_32_RC_SH:
         const9 = sextract32(const9, 0, 6);
@@ -5000,11 +5001,11 @@ static void decode_rc_logical_shift(DisasContext *ctx)
         gen_shasi(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_XNOR:
-        tcg_gen_xori_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
-        tcg_gen_not_tl(cpu_gpr_d[r2], cpu_gpr_d[r2]);
+        tcg_gen_xori_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_not_i32(cpu_gpr_d[r2], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RC_XOR:
-        tcg_gen_xori_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_xori_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_SHUFFLE:
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
@@ -5084,7 +5085,7 @@ static void decode_rc_accumulator(DisasContext *ctx)
                                const9, &tcg_gen_and_tl);
         break;
     case OPC2_32_RC_EQ:
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_EQANY_B:
         gen_eqany_bi(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
@@ -5093,41 +5094,41 @@ static void decode_rc_accumulator(DisasContext *ctx)
         gen_eqany_hi(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_GE:
-        tcg_gen_setcondi_tl(TCG_COND_GE, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_GE, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_GE_U:
         const9 = MASK_OP_RC_CONST9(ctx->opcode);
-        tcg_gen_setcondi_tl(TCG_COND_GEU, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_GEU, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_LT:
-        tcg_gen_setcondi_tl(TCG_COND_LT, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_LT, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_LT_U:
         const9 = MASK_OP_RC_CONST9(ctx->opcode);
-        tcg_gen_setcondi_tl(TCG_COND_LTU, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_LTU, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_MAX:
-        tcg_gen_movi_tl(temp, const9);
-        tcg_gen_movcond_tl(TCG_COND_GT, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
+        tcg_gen_movi_i32(temp, const9);
+        tcg_gen_movcond_i32(TCG_COND_GT, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
                            cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_MAX_U:
-        tcg_gen_movi_tl(temp, MASK_OP_RC_CONST9(ctx->opcode));
-        tcg_gen_movcond_tl(TCG_COND_GTU, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
+        tcg_gen_movi_i32(temp, MASK_OP_RC_CONST9(ctx->opcode));
+        tcg_gen_movcond_i32(TCG_COND_GTU, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
                            cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_MIN:
-        tcg_gen_movi_tl(temp, const9);
-        tcg_gen_movcond_tl(TCG_COND_LT, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
+        tcg_gen_movi_i32(temp, const9);
+        tcg_gen_movcond_i32(TCG_COND_LT, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
                            cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_MIN_U:
-        tcg_gen_movi_tl(temp, MASK_OP_RC_CONST9(ctx->opcode));
-        tcg_gen_movcond_tl(TCG_COND_LTU, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
+        tcg_gen_movi_i32(temp, MASK_OP_RC_CONST9(ctx->opcode));
+        tcg_gen_movcond_i32(TCG_COND_LTU, cpu_gpr_d[r2], cpu_gpr_d[r1], temp,
                            cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_NE:
-        tcg_gen_setcondi_tl(TCG_COND_NE, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
+        tcg_gen_setcondi_i32(TCG_COND_NE, cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_OR_EQ:
         gen_accumulating_condi(TCG_COND_EQ, cpu_gpr_d[r2], cpu_gpr_d[r1],
@@ -5156,15 +5157,15 @@ static void decode_rc_accumulator(DisasContext *ctx)
                                const9, &tcg_gen_or_tl);
         break;
     case OPC2_32_RC_RSUB:
-        tcg_gen_movi_tl(temp, const9);
+        tcg_gen_movi_i32(temp, const9);
         gen_sub_d(cpu_gpr_d[r2], temp, cpu_gpr_d[r1]);
         break;
     case OPC2_32_RC_RSUBS:
-        tcg_gen_movi_tl(temp, const9);
+        tcg_gen_movi_i32(temp, const9);
         gen_subs(cpu_gpr_d[r2], temp, cpu_gpr_d[r1]);
         break;
     case OPC2_32_RC_RSUBS_U:
-        tcg_gen_movi_tl(temp, const9);
+        tcg_gen_movi_i32(temp, const9);
         gen_subsu(cpu_gpr_d[r2], temp, cpu_gpr_d[r1]);
         break;
     case OPC2_32_RC_SH_EQ:
@@ -5260,7 +5261,7 @@ static void decode_rc_mul(DisasContext *ctx)
         break;
     case OPC2_32_RC_MUL_64:
         CHECK_REG_PAIR(r2);
-        gen_muli_i64s(cpu_gpr_d[r2], cpu_gpr_d[r2+1], cpu_gpr_d[r1], const9);
+        gen_muli_i64s(cpu_gpr_d[r2], cpu_gpr_d[r2 + 1], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_MULS_32:
         gen_mulsi_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], const9);
@@ -5268,7 +5269,7 @@ static void decode_rc_mul(DisasContext *ctx)
     case OPC2_32_RC_MUL_U_64:
         const9 = MASK_OP_RC_CONST9(ctx->opcode);
         CHECK_REG_PAIR(r2);
-        gen_muli_i64u(cpu_gpr_d[r2], cpu_gpr_d[r2+1], cpu_gpr_d[r1], const9);
+        gen_muli_i64u(cpu_gpr_d[r2], cpu_gpr_d[r2 + 1], cpu_gpr_d[r1], const9);
         break;
     case OPC2_32_RC_MULS_U_32:
         const9 = MASK_OP_RC_CONST9(ctx->opcode);
@@ -5300,18 +5301,18 @@ static void decode_rcpw_insert(DisasContext *ctx)
         CHECK_REG_PAIR(r2);
         /* if pos + width > 32 undefined result */
         if (pos + width <= 32) {
-            tcg_gen_movi_tl(cpu_gpr_d[r2+1], ((1u << width) - 1) << pos);
-            tcg_gen_movi_tl(cpu_gpr_d[r2], (const4 << pos));
+            tcg_gen_movi_i32(cpu_gpr_d[r2 + 1], ((1u << width) - 1) << pos);
+            tcg_gen_movi_i32(cpu_gpr_d[r2], (const4 << pos));
         }
         break;
     case OPC2_32_RCPW_INSERT:
-        /* tcg_gen_deposit_tl() does not handle the case of width = 0 */
+        /* tcg_gen_deposit_i32() does not handle the case of width = 0 */
         if (width == 0) {
-            tcg_gen_mov_tl(cpu_gpr_d[r2], cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(cpu_gpr_d[r2], cpu_gpr_d[r1]);
         /* if pos + width > 32 undefined result */
         } else if (pos + width <= 32) {
             temp = tcg_constant_i32(const4);
-            tcg_gen_deposit_tl(cpu_gpr_d[r2], cpu_gpr_d[r1], temp, pos, width);
+            tcg_gen_deposit_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], temp, pos, width);
         }
         break;
     default:
@@ -5342,18 +5343,18 @@ static void decode_rcrw_insert(DisasContext *ctx)
     switch (op2) {
     case OPC2_32_RCRW_IMASK:
         CHECK_REG_PAIR(r4);
-        tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
-        tcg_gen_movi_tl(temp2, (1 << width) - 1);
-        tcg_gen_shl_tl(cpu_gpr_d[r4 + 1], temp2, temp);
-        tcg_gen_movi_tl(temp2, const4);
-        tcg_gen_shl_tl(cpu_gpr_d[r4], temp2, temp);
+        tcg_gen_andi_i32(temp, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_movi_i32(temp2, (1 << width) - 1);
+        tcg_gen_shl_i32(cpu_gpr_d[r4 + 1], temp2, temp);
+        tcg_gen_movi_i32(temp2, const4);
+        tcg_gen_shl_i32(cpu_gpr_d[r4], temp2, temp);
         break;
     case OPC2_32_RCRW_INSERT:
         temp3 = tcg_temp_new();
 
-        tcg_gen_movi_tl(temp, width);
-        tcg_gen_movi_tl(temp2, const4);
-        tcg_gen_andi_tl(temp3, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_movi_i32(temp, width);
+        tcg_gen_movi_i32(temp2, const4);
+        tcg_gen_andi_i32(temp3, cpu_gpr_d[r3], 0x1f);
         gen_insert(cpu_gpr_d[r4], cpu_gpr_d[r1], temp2, temp, temp3);
         break;
     default:
@@ -5389,13 +5390,13 @@ static void decode_rcr_cond_select(DisasContext *ctx)
     case OPC2_32_RCR_SEL:
         temp = tcg_constant_i32(0);
         temp2 = tcg_constant_i32(const9);
-        tcg_gen_movcond_tl(TCG_COND_NE, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
+        tcg_gen_movcond_i32(TCG_COND_NE, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
                            cpu_gpr_d[r1], temp2);
         break;
     case OPC2_32_RCR_SELN:
         temp = tcg_constant_i32(0);
         temp2 = tcg_constant_i32(const9);
-        tcg_gen_movcond_tl(TCG_COND_EQ, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
+        tcg_gen_movcond_i32(TCG_COND_EQ, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
                            cpu_gpr_d[r1], temp2);
         break;
     default:
@@ -5423,8 +5424,8 @@ static void decode_rcr_madd(DisasContext *ctx)
     case OPC2_32_RCR_MADD_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddi64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_maddi64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MADDS_32:
         gen_maddsi_32(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r3], const9);
@@ -5432,15 +5433,15 @@ static void decode_rcr_madd(DisasContext *ctx)
     case OPC2_32_RCR_MADDS_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsi_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_maddsi_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MADD_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
-        gen_maddui64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                       cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_maddui64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                       cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MADDS_U_32:
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
@@ -5450,8 +5451,8 @@ static void decode_rcr_madd(DisasContext *ctx)
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
-        gen_maddsui_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                       cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_maddsui_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                       cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -5478,8 +5479,8 @@ static void decode_rcr_msub(DisasContext *ctx)
     case OPC2_32_RCR_MSUB_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubi64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_msubi64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MSUBS_32:
         gen_msubsi_32(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r3], const9);
@@ -5487,15 +5488,15 @@ static void decode_rcr_msub(DisasContext *ctx)
     case OPC2_32_RCR_MSUBS_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubsi_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_msubsi_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MSUB_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
-        gen_msubui64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                       cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_msubui64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                       cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     case OPC2_32_RCR_MSUBS_U_32:
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
@@ -5505,8 +5506,8 @@ static void decode_rcr_msub(DisasContext *ctx)
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
         const9 = MASK_OP_RCR_CONST9(ctx->opcode);
-        gen_msubsui_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                       cpu_gpr_d[r3], cpu_gpr_d[r3+1], const9);
+        gen_msubsui_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                       cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], const9);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -5533,33 +5534,33 @@ static void decode_rlc_opc(DisasContext *ctx,
         gen_addi_d(cpu_gpr_d[r2], cpu_gpr_d[r1], const16 << 16);
         break;
     case OPC1_32_RLC_ADDIH_A:
-        tcg_gen_addi_tl(cpu_gpr_a[r2], cpu_gpr_a[r1], const16 << 16);
+        tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r1], const16 << 16);
         break;
     case OPC1_32_RLC_MFCR:
         const16 = MASK_OP_RLC_CONST16(ctx->opcode);
         gen_mfcr(ctx, cpu_gpr_d[r2], const16);
         break;
     case OPC1_32_RLC_MOV:
-        tcg_gen_movi_tl(cpu_gpr_d[r2], const16);
+        tcg_gen_movi_i32(cpu_gpr_d[r2], const16);
         break;
     case OPC1_32_RLC_MOV_64:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             CHECK_REG_PAIR(r2);
-            tcg_gen_movi_tl(cpu_gpr_d[r2], const16);
-            tcg_gen_movi_tl(cpu_gpr_d[r2+1], const16 >> 15);
+            tcg_gen_movi_i32(cpu_gpr_d[r2], const16);
+            tcg_gen_movi_i32(cpu_gpr_d[r2 + 1], const16 >> 15);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
         break;
     case OPC1_32_RLC_MOV_U:
         const16 = MASK_OP_RLC_CONST16(ctx->opcode);
-        tcg_gen_movi_tl(cpu_gpr_d[r2], const16);
+        tcg_gen_movi_i32(cpu_gpr_d[r2], const16);
         break;
     case OPC1_32_RLC_MOV_H:
-        tcg_gen_movi_tl(cpu_gpr_d[r2], const16 << 16);
+        tcg_gen_movi_i32(cpu_gpr_d[r2], const16 << 16);
         break;
     case OPC1_32_RLC_MOVH_A:
-        tcg_gen_movi_tl(cpu_gpr_a[r2], const16 << 16);
+        tcg_gen_movi_i32(cpu_gpr_a[r2], const16 << 16);
         break;
     case OPC1_32_RLC_MTCR:
         const16 = MASK_OP_RLC_CONST16(ctx->opcode);
@@ -5673,7 +5674,7 @@ static void decode_rr_accumulator(DisasContext *ctx)
                               cpu_gpr_d[r2], &tcg_gen_and_tl);
         break;
     case OPC2_32_RR_EQ:
-        tcg_gen_setcond_tl(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_EQ_B:
@@ -5683,7 +5684,7 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_eq_h(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_EQ_W:
-        tcg_gen_negsetcond_tl(TCG_COND_EQ, cpu_gpr_d[r3],
+        tcg_gen_negsetcond_i32(TCG_COND_EQ, cpu_gpr_d[r3],
                               cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_EQANY_B:
@@ -5693,19 +5694,19 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_eqany_h(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_GE:
-        tcg_gen_setcond_tl(TCG_COND_GE, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_GE, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_GE_U:
-        tcg_gen_setcond_tl(TCG_COND_GEU, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_GEU, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT:
-        tcg_gen_setcond_tl(TCG_COND_LT, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_LT, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_U:
-        tcg_gen_setcond_tl(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_B:
@@ -5721,19 +5722,19 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_lt_hu(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_W:
-        tcg_gen_negsetcond_tl(TCG_COND_LT, cpu_gpr_d[r3],
+        tcg_gen_negsetcond_i32(TCG_COND_LT, cpu_gpr_d[r3],
                               cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_LT_WU:
-        tcg_gen_negsetcond_tl(TCG_COND_LTU, cpu_gpr_d[r3],
+        tcg_gen_negsetcond_i32(TCG_COND_LTU, cpu_gpr_d[r3],
                               cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MAX:
-        tcg_gen_movcond_tl(TCG_COND_GT, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_movcond_i32(TCG_COND_GT, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MAX_U:
-        tcg_gen_movcond_tl(TCG_COND_GTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_movcond_i32(TCG_COND_GTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MAX_B:
@@ -5749,11 +5750,11 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_max_hu(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MIN:
-        tcg_gen_movcond_tl(TCG_COND_LT, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_movcond_i32(TCG_COND_LT, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MIN_U:
-        tcg_gen_movcond_tl(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_movcond_i32(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MIN_B:
@@ -5769,16 +5770,16 @@ static void decode_rr_accumulator(DisasContext *ctx)
         gen_helper_min_hu(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MOV:
-        tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r2]);
+        tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MOV_64:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             temp = tcg_temp_new();
 
             CHECK_REG_PAIR(r3);
-            tcg_gen_mov_tl(temp, cpu_gpr_d[r1]);
-            tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r2]);
-            tcg_gen_mov_tl(cpu_gpr_d[r3 + 1], temp);
+            tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r2]);
+            tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
@@ -5786,14 +5787,14 @@ static void decode_rr_accumulator(DisasContext *ctx)
     case OPC2_32_RR_MOVS_64:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             CHECK_REG_PAIR(r3);
-            tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r2]);
-            tcg_gen_sari_tl(cpu_gpr_d[r3 + 1], cpu_gpr_d[r2], 31);
+            tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r2]);
+            tcg_gen_sari_i32(cpu_gpr_d[r3 + 1], cpu_gpr_d[r2], 31);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
         break;
     case OPC2_32_RR_NE:
-        tcg_gen_setcond_tl(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_d[r1],
+        tcg_gen_setcond_i32(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_d[r1],
                            cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_OR_EQ:
@@ -5926,41 +5927,41 @@ static void decode_rr_logical_shift(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RR_AND:
-        tcg_gen_and_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_and_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_ANDN:
-        tcg_gen_andc_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_andc_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_CLO:
-        tcg_gen_not_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
-        tcg_gen_clzi_tl(cpu_gpr_d[r3], cpu_gpr_d[r3], TARGET_LONG_BITS);
+        tcg_gen_not_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+        tcg_gen_clzi_i32(cpu_gpr_d[r3], cpu_gpr_d[r3], TARGET_LONG_BITS);
         break;
     case OPC2_32_RR_CLO_H:
         gen_helper_clo_h(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_CLS:
-        tcg_gen_clrsb_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+        tcg_gen_clrsb_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_CLS_H:
         gen_helper_cls_h(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_CLZ:
-        tcg_gen_clzi_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], TARGET_LONG_BITS);
+        tcg_gen_clzi_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], TARGET_LONG_BITS);
         break;
     case OPC2_32_RR_CLZ_H:
         gen_helper_clz_h(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_NAND:
-        tcg_gen_nand_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_nand_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_NOR:
-        tcg_gen_nor_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_nor_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_OR:
-        tcg_gen_or_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_or_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_ORN:
-        tcg_gen_orc_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_orc_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_SH:
         gen_helper_sh(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
@@ -5978,10 +5979,10 @@ static void decode_rr_logical_shift(DisasContext *ctx)
         gen_shas(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_XNOR:
-        tcg_gen_eqv_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_eqv_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_XOR:
-        tcg_gen_xor_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
+        tcg_gen_xor_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6002,52 +6003,52 @@ static void decode_rr_address(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RR_ADD_A:
-        tcg_gen_add_tl(cpu_gpr_a[r3], cpu_gpr_a[r1], cpu_gpr_a[r2]);
+        tcg_gen_add_i32(cpu_gpr_a[r3], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_ADDSC_A:
         temp = tcg_temp_new();
-        tcg_gen_shli_tl(temp, cpu_gpr_d[r1], n);
-        tcg_gen_add_tl(cpu_gpr_a[r3], cpu_gpr_a[r2], temp);
+        tcg_gen_shli_i32(temp, cpu_gpr_d[r1], n);
+        tcg_gen_add_i32(cpu_gpr_a[r3], cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_RR_ADDSC_AT:
         temp = tcg_temp_new();
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 3);
-        tcg_gen_add_tl(temp, cpu_gpr_a[r2], temp);
-        tcg_gen_andi_tl(cpu_gpr_a[r3], temp, 0xFFFFFFFC);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 3);
+        tcg_gen_add_i32(temp, cpu_gpr_a[r2], temp);
+        tcg_gen_andi_i32(cpu_gpr_a[r3], temp, 0xFFFFFFFC);
         break;
     case OPC2_32_RR_EQ_A:
-        tcg_gen_setcond_tl(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_a[r1],
+        tcg_gen_setcond_i32(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_a[r1],
                            cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_EQZ:
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_a[r1], 0);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_gpr_d[r3], cpu_gpr_a[r1], 0);
         break;
     case OPC2_32_RR_GE_A:
-        tcg_gen_setcond_tl(TCG_COND_GEU, cpu_gpr_d[r3], cpu_gpr_a[r1],
+        tcg_gen_setcond_i32(TCG_COND_GEU, cpu_gpr_d[r3], cpu_gpr_a[r1],
                            cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_LT_A:
-        tcg_gen_setcond_tl(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_a[r1],
+        tcg_gen_setcond_i32(TCG_COND_LTU, cpu_gpr_d[r3], cpu_gpr_a[r1],
                            cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_MOV_A:
-        tcg_gen_mov_tl(cpu_gpr_a[r3], cpu_gpr_d[r2]);
+        tcg_gen_mov_i32(cpu_gpr_a[r3], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_MOV_AA:
-        tcg_gen_mov_tl(cpu_gpr_a[r3], cpu_gpr_a[r2]);
+        tcg_gen_mov_i32(cpu_gpr_a[r3], cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_MOV_D:
-        tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_a[r2]);
+        tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_NE_A:
-        tcg_gen_setcond_tl(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_a[r1],
+        tcg_gen_setcond_i32(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_a[r1],
                            cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_NEZ_A:
-        tcg_gen_setcondi_tl(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_a[r1], 0);
+        tcg_gen_setcondi_i32(TCG_COND_NE, cpu_gpr_d[r3], cpu_gpr_a[r1], 0);
         break;
     case OPC2_32_RR_SUB_A:
-        tcg_gen_sub_tl(cpu_gpr_a[r3], cpu_gpr_a[r1], cpu_gpr_a[r2]);
+        tcg_gen_sub_i32(cpu_gpr_a[r3], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6064,19 +6065,19 @@ static void decode_rr_idirect(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RR_JI:
-        tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
+        tcg_gen_andi_i32(cpu_PC, cpu_gpr_a[r1], ~0x1);
         break;
     case OPC2_32_RR_JLI:
-        tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
-        tcg_gen_movi_tl(cpu_gpr_a[11], ctx->pc_succ_insn);
+        tcg_gen_andi_i32(cpu_PC, cpu_gpr_a[r1], ~0x1);
+        tcg_gen_movi_i32(cpu_gpr_a[11], ctx->pc_succ_insn);
         break;
     case OPC2_32_RR_CALLI:
         gen_helper_1arg(call, ctx->pc_succ_insn);
-        tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
+        tcg_gen_andi_i32(cpu_PC, cpu_gpr_a[r1], ~0x1);
         break;
     case OPC2_32_RR_FCALLI:
         gen_fcall_save_ctx(ctx);
-        tcg_gen_andi_tl(cpu_PC, cpu_gpr_a[r1], ~0x1);
+        tcg_gen_andi_i32(cpu_PC, cpu_gpr_a[r1], ~0x1);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6103,11 +6104,11 @@ static void decode_rr_divide(DisasContext *ctx)
         break;
     case OPC2_32_RR_BSPLIT:
         CHECK_REG_PAIR(r3);
-        gen_bsplit(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1]);
+        gen_bsplit(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_DVINIT_B:
         CHECK_REG_PAIR(r3);
-        gen_dvinit_b(ctx, cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
+        gen_dvinit_b(ctx, cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1],
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_DVINIT_BU:
@@ -6115,28 +6116,28 @@ static void decode_rr_divide(DisasContext *ctx)
         temp2 = tcg_temp_new();
         temp3 = tcg_temp_new();
         CHECK_REG_PAIR(r3);
-        tcg_gen_shri_tl(temp3, cpu_gpr_d[r1], 8);
+        tcg_gen_shri_i32(temp3, cpu_gpr_d[r1], 8);
         /* reset av */
-        tcg_gen_movi_tl(cpu_PSW_AV, 0);
+        tcg_gen_movi_i32(cpu_PSW_AV, 0);
         if (!has_feature(ctx, TRICORE_FEATURE_131)) {
-            /* overflow = (abs(D[r3+1]) >= abs(D[r2])) */
-            tcg_gen_abs_tl(temp, temp3);
-            tcg_gen_abs_tl(temp2, cpu_gpr_d[r2]);
-            tcg_gen_setcond_tl(TCG_COND_GE, cpu_PSW_V, temp, temp2);
+            /* overflow = (abs(D[r3 + 1]) >= abs(D[r2])) */
+            tcg_gen_abs_i32(temp, temp3);
+            tcg_gen_abs_i32(temp2, cpu_gpr_d[r2]);
+            tcg_gen_setcond_i32(TCG_COND_GE, cpu_PSW_V, temp, temp2);
         } else {
             /* overflow = (D[b] == 0) */
-            tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
+            tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
         }
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* sv */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
         /* write result */
-        tcg_gen_shli_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], 24);
-        tcg_gen_mov_tl(cpu_gpr_d[r3+1], temp3);
+        tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], 24);
+        tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp3);
         break;
     case OPC2_32_RR_DVINIT_H:
         CHECK_REG_PAIR(r3);
-        gen_dvinit_h(ctx, cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
+        gen_dvinit_h(ctx, cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1],
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_DVINIT_HU:
@@ -6144,24 +6145,24 @@ static void decode_rr_divide(DisasContext *ctx)
         temp2 = tcg_temp_new();
         temp3 = tcg_temp_new();
         CHECK_REG_PAIR(r3);
-        tcg_gen_shri_tl(temp3, cpu_gpr_d[r1], 16);
+        tcg_gen_shri_i32(temp3, cpu_gpr_d[r1], 16);
         /* reset av */
-        tcg_gen_movi_tl(cpu_PSW_AV, 0);
+        tcg_gen_movi_i32(cpu_PSW_AV, 0);
         if (!has_feature(ctx, TRICORE_FEATURE_131)) {
-            /* overflow = (abs(D[r3+1]) >= abs(D[r2])) */
-            tcg_gen_abs_tl(temp, temp3);
-            tcg_gen_abs_tl(temp2, cpu_gpr_d[r2]);
-            tcg_gen_setcond_tl(TCG_COND_GE, cpu_PSW_V, temp, temp2);
+            /* overflow = (abs(D[r3 + 1]) >= abs(D[r2])) */
+            tcg_gen_abs_i32(temp, temp3);
+            tcg_gen_abs_i32(temp2, cpu_gpr_d[r2]);
+            tcg_gen_setcond_i32(TCG_COND_GE, cpu_PSW_V, temp, temp2);
         } else {
             /* overflow = (D[b] == 0) */
-            tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
+            tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
         }
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* sv */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
         /* write result */
-        tcg_gen_shli_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], 16);
-        tcg_gen_mov_tl(cpu_gpr_d[r3+1], temp3);
+        tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], 16);
+        tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp3);
         break;
     case OPC2_32_RR_DVINIT:
         temp = tcg_temp_new();
@@ -6169,41 +6170,41 @@ static void decode_rr_divide(DisasContext *ctx)
         CHECK_REG_PAIR(r3);
         /* overflow = ((D[b] == 0) ||
                       ((D[b] == 0xFFFFFFFF) && (D[a] == 0x80000000))) */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp, cpu_gpr_d[r2], 0xffffffff);
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, cpu_gpr_d[r1], 0x80000000);
-        tcg_gen_and_tl(temp, temp, temp2);
-        tcg_gen_setcondi_tl(TCG_COND_EQ, temp2, cpu_gpr_d[r2], 0);
-        tcg_gen_or_tl(cpu_PSW_V, temp, temp2);
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp, cpu_gpr_d[r2], 0xffffffff);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, cpu_gpr_d[r1], 0x80000000);
+        tcg_gen_and_i32(temp, temp, temp2);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, temp2, cpu_gpr_d[r2], 0);
+        tcg_gen_or_i32(cpu_PSW_V, temp, temp2);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* sv */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
         /* reset av */
-       tcg_gen_movi_tl(cpu_PSW_AV, 0);
+       tcg_gen_movi_i32(cpu_PSW_AV, 0);
         /* write result */
-        tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+        tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         /* sign extend to high reg */
-        tcg_gen_sari_tl(cpu_gpr_d[r3+1], cpu_gpr_d[r1], 31);
+        tcg_gen_sari_i32(cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], 31);
         break;
     case OPC2_32_RR_DVINIT_U:
         CHECK_REG_PAIR(r3);
         /* overflow = (D[b] == 0) */
-        tcg_gen_setcondi_tl(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
-        tcg_gen_shli_tl(cpu_PSW_V, cpu_PSW_V, 31);
+        tcg_gen_setcondi_i32(TCG_COND_EQ, cpu_PSW_V, cpu_gpr_d[r2], 0);
+        tcg_gen_shli_i32(cpu_PSW_V, cpu_PSW_V, 31);
         /* sv */
-        tcg_gen_or_tl(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_or_i32(cpu_PSW_SV, cpu_PSW_SV, cpu_PSW_V);
         /* reset av */
-        tcg_gen_movi_tl(cpu_PSW_AV, 0);
+        tcg_gen_movi_i32(cpu_PSW_AV, 0);
         /* write result */
-        tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+        tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         /* zero extend to high reg*/
-        tcg_gen_movi_tl(cpu_gpr_d[r3+1], 0);
+        tcg_gen_movi_i32(cpu_gpr_d[r3 + 1], 0);
         break;
     case OPC2_32_RR_PARITY:
         gen_helper_parity(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_UNPACK:
         CHECK_REG_PAIR(r3);
-        gen_unpack(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1]);
+        gen_unpack(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RR_CRC32_B:
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
@@ -6229,7 +6230,7 @@ static void decode_rr_divide(DisasContext *ctx)
 
     case OPC2_32_RR_POPCNT_W:
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
-            tcg_gen_ctpop_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+            tcg_gen_ctpop_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
         }
@@ -6237,7 +6238,7 @@ static void decode_rr_divide(DisasContext *ctx)
     case OPC2_32_RR_DIV:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             CHECK_REG_PAIR(r3);
-            GEN_HELPER_RR(divide, cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
+            GEN_HELPER_RR(divide, cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1],
                           cpu_gpr_d[r2]);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6246,7 +6247,7 @@ static void decode_rr_divide(DisasContext *ctx)
     case OPC2_32_RR_DIV_U:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             CHECK_REG_PAIR(r3);
-            GEN_HELPER_RR(divide_u, cpu_gpr_d[r3], cpu_gpr_d[r3+1],
+            GEN_HELPER_RR(divide_u, cpu_gpr_d[r3], cpu_gpr_d[r3 + 1],
                           cpu_gpr_d[r1], cpu_gpr_d[r2]);
         } else {
             generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6328,69 +6329,69 @@ static void decode_rr1_mul(DisasContext *ctx)
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_LL(mul_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
-        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3+1]);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
+        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1]);
         break;
     case OPC2_32_RR1_MUL_H_32_LU:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_LU(mul_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
-        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3+1]);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
+        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1]);
         break;
     case OPC2_32_RR1_MUL_H_32_UL:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_UL(mul_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
-        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3+1]);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
+        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1]);
         break;
     case OPC2_32_RR1_MUL_H_32_UU:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_UU(mul_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
-        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3+1]);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
+        gen_calc_usb_mul_h(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1]);
         break;
     case OPC2_32_RR1_MULM_H_64_LL:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_LL(mulm_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
         /* reset V bit */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
         /* reset AV bit */
-        tcg_gen_mov_tl(cpu_PSW_AV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_AV, cpu_PSW_V);
         break;
     case OPC2_32_RR1_MULM_H_64_LU:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_LU(mulm_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
         /* reset V bit */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
         /* reset AV bit */
-        tcg_gen_mov_tl(cpu_PSW_AV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_AV, cpu_PSW_V);
         break;
     case OPC2_32_RR1_MULM_H_64_UL:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_UL(mulm_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
         /* reset V bit */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
         /* reset AV bit */
-        tcg_gen_mov_tl(cpu_PSW_AV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_AV, cpu_PSW_V);
         break;
     case OPC2_32_RR1_MULM_H_64_UU:
         temp64 = tcg_temp_new_i64();
         CHECK_REG_PAIR(r3);
         GEN_HELPER_UU(mulm_h, temp64, cpu_gpr_d[r1], cpu_gpr_d[r2], n);
-        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3+1], temp64);
+        tcg_gen_extr_i64_i32(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], temp64);
         /* reset V bit */
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
         /* reset AV bit */
-        tcg_gen_mov_tl(cpu_PSW_AV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_AV, cpu_PSW_V);
         break;
     case OPC2_32_RR1_MULR_H_16_LL:
         GEN_HELPER_LL(mulr_h, cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2], n);
@@ -6436,45 +6437,45 @@ static void decode_rr1_mulq(DisasContext *ctx)
         break;
     case OPC2_32_RR1_MUL_Q_64:
         CHECK_REG_PAIR(r3);
-        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                   n, 0);
         break;
     case OPC2_32_RR1_MUL_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
         gen_mul_q(cpu_gpr_d[r3], temp, cpu_gpr_d[r1], temp, n, 16);
         break;
     case OPC2_32_RR1_MUL_Q_64_L:
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
-        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp, n, 0);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
+        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp, n, 0);
         break;
     case OPC2_32_RR1_MUL_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
         gen_mul_q(cpu_gpr_d[r3], temp, cpu_gpr_d[r1], temp, n, 16);
         break;
     case OPC2_32_RR1_MUL_Q_64_U:
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
-        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp, n, 0);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
+        gen_mul_q(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp, n, 0);
         break;
     case OPC2_32_RR1_MUL_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_mul_q_16(cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RR1_MUL_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_mul_q_16(cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RR1_MULR_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_mulr_q(cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RR1_MULR_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_mulr_q(cpu_gpr_d[r3], temp, temp2, n);
         break;
     default:
@@ -6498,7 +6499,7 @@ static void decode_rr2_mul(DisasContext *ctx)
         break;
     case OPC2_32_RR2_MUL_64:
         CHECK_REG_PAIR(r3);
-        gen_mul_i64s(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
+        gen_mul_i64s(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1],
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR2_MULS_32:
@@ -6507,7 +6508,7 @@ static void decode_rr2_mul(DisasContext *ctx)
         break;
     case OPC2_32_RR2_MUL_U_64:
         CHECK_REG_PAIR(r3);
-        gen_mul_i64u(cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r1],
+        gen_mul_i64u(cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r1],
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR2_MULS_U_32:
@@ -6537,16 +6538,16 @@ static void decode_rrpw_extract_insert(DisasContext *ctx)
     switch (op2) {
     case OPC2_32_RRPW_EXTR:
         if (width == 0) {
-            tcg_gen_movi_tl(cpu_gpr_d[r3], 0);
+            tcg_gen_movi_i32(cpu_gpr_d[r3], 0);
         } else if (pos + width <= 32) {
-            tcg_gen_sextract_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], pos, width);
+            tcg_gen_sextract_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], pos, width);
         }
         break;
     case OPC2_32_RRPW_EXTR_U:
         if (width == 0) {
-            tcg_gen_movi_tl(cpu_gpr_d[r3], 0);
+            tcg_gen_movi_i32(cpu_gpr_d[r3], 0);
         } else {
-            tcg_gen_extract_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], pos, width);
+            tcg_gen_extract_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], pos, width);
         }
         break;
     case OPC2_32_RRPW_IMASK:
@@ -6554,18 +6555,18 @@ static void decode_rrpw_extract_insert(DisasContext *ctx)
 
         if (pos + width <= 32) {
             temp = tcg_temp_new();
-            tcg_gen_movi_tl(temp, ((1u << width) - 1) << pos);
-            tcg_gen_shli_tl(cpu_gpr_d[r3], cpu_gpr_d[r2], pos);
-            tcg_gen_mov_tl(cpu_gpr_d[r3 + 1], temp);
+            tcg_gen_movi_i32(temp, ((1u << width) - 1) << pos);
+            tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r2], pos);
+            tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp);
         }
 
         break;
     case OPC2_32_RRPW_INSERT:
-        /* tcg_gen_deposit_tl() does not handle the case of width = 0 */
+        /* tcg_gen_deposit_i32() does not handle the case of width = 0 */
         if (width == 0) {
-            tcg_gen_mov_tl(cpu_gpr_d[r3], cpu_gpr_d[r1]);
+            tcg_gen_mov_i32(cpu_gpr_d[r3], cpu_gpr_d[r1]);
         } else if (pos + width <= 32) {
-            tcg_gen_deposit_tl(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2],
+            tcg_gen_deposit_i32(cpu_gpr_d[r3], cpu_gpr_d[r1], cpu_gpr_d[r2],
                                pos, width);
         }
         break;
@@ -6606,12 +6607,12 @@ static void decode_rrr_cond_select(DisasContext *ctx)
         break;
     case OPC2_32_RRR_SEL:
         temp = tcg_constant_i32(0);
-        tcg_gen_movcond_tl(TCG_COND_NE, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
+        tcg_gen_movcond_i32(TCG_COND_NE, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
                            cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_SELN:
         temp = tcg_constant_i32(0);
-        tcg_gen_movcond_tl(TCG_COND_EQ, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
+        tcg_gen_movcond_i32(TCG_COND_EQ, cpu_gpr_d[r4], cpu_gpr_d[r3], temp,
                            cpu_gpr_d[r1], cpu_gpr_d[r2]);
         break;
     default:
@@ -6635,49 +6636,49 @@ static void decode_rrr_divide(DisasContext *ctx)
     case OPC2_32_RRR_DVADJ:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(dvadj, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(dvadj, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_DVSTEP:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(dvstep, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(dvstep, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_DVSTEP_U:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(dvstep_u, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(dvstep_u, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_IXMAX:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(ixmax, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(ixmax, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_IXMAX_U:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(ixmax_u, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(ixmax_u, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_IXMIN:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(ixmin, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(ixmin, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_IXMIN_U:
         CHECK_REG_PAIR(r3);
         CHECK_REG_PAIR(r4);
-        GEN_HELPER_RRR(ixmin_u, cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        GEN_HELPER_RRR(ixmin_u, cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR_PACK:
         CHECK_REG_PAIR(r3);
         gen_helper_pack(cpu_gpr_d[r4], cpu_PSW_C, cpu_gpr_d[r3],
-                        cpu_gpr_d[r3+1], cpu_gpr_d[r1]);
+                        cpu_gpr_d[r3 + 1], cpu_gpr_d[r1]);
         break;
     case OPC2_32_RRR_CRCN:
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
@@ -6725,8 +6726,8 @@ static void decode_rrr2_madd(DisasContext *ctx)
     case OPC2_32_RRR2_MADD_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                     cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_madd64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                     cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MADDS_32:
         gen_helper_madd32_ssov(cpu_gpr_d[r4], tcg_env, cpu_gpr_d[r1],
@@ -6735,14 +6736,14 @@ static void decode_rrr2_madd(DisasContext *ctx)
     case OPC2_32_RRR2_MADDS_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                     cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_madds_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                     cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MADD_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_maddu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MADDS_U_32:
         gen_helper_madd32_suov(cpu_gpr_d[r4], tcg_env, cpu_gpr_d[r1],
@@ -6751,8 +6752,8 @@ static void decode_rrr2_madd(DisasContext *ctx)
     case OPC2_32_RRR2_MADDS_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsu_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_maddsu_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6778,8 +6779,8 @@ static void decode_rrr2_msub(DisasContext *ctx)
     case OPC2_32_RRR2_MSUB_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                     cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_msub64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                     cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MSUBS_32:
         gen_helper_msub32_ssov(cpu_gpr_d[r4], tcg_env, cpu_gpr_d[r1],
@@ -6788,14 +6789,14 @@ static void decode_rrr2_msub(DisasContext *ctx)
     case OPC2_32_RRR2_MSUBS_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                     cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_msubs_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                     cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MSUB_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_msubu64_d(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     case OPC2_32_RRR2_MSUBS_U_32:
         gen_helper_msub32_suov(cpu_gpr_d[r4], tcg_env, cpu_gpr_d[r1],
@@ -6804,8 +6805,8 @@ static void decode_rrr2_msub(DisasContext *ctx)
     case OPC2_32_RRR2_MSUBS_U_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubsu_64(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r1],
-                      cpu_gpr_d[r3], cpu_gpr_d[r3+1], cpu_gpr_d[r2]);
+        gen_msubsu_64(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r1],
+                      cpu_gpr_d[r3], cpu_gpr_d[r3 + 1], cpu_gpr_d[r2]);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);
@@ -6829,98 +6830,98 @@ static void decode_rrr1_madd(DisasContext *ctx)
     case OPC2_32_RRR1_MADD_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADD_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADD_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADD_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_madd_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDS_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDS_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDS_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDS_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_madds_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDM_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDM_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDM_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDM_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_maddm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDMS_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDMS_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDMS_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDMS_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_maddms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDR_H_LL:
         gen_maddr32_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
@@ -6983,61 +6984,61 @@ static void decode_rrr1_maddq_h(DisasContext *ctx)
     case OPC2_32_RRR1_MADD_Q_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                      n);
         break;
     case OPC2_32_RRR1_MADD_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
         gen_madd32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                      temp, n, 16);
         break;
     case OPC2_32_RRR1_MADD_Q_64_L:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
-        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
+        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                      n);
         break;
     case OPC2_32_RRR1_MADD_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
         gen_madd32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                      temp, n, 16);
         break;
     case OPC2_32_RRR1_MADD_Q_64_U:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
-        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
+        gen_madd64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                      n);
         break;
     case OPC2_32_RRR1_MADD_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_m16add32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADD_Q_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
-        gen_m16add64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
+        gen_m16add64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADD_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_m16add32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADD_Q_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
-        gen_m16add64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
+        gen_m16add64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDS_Q_32:
         gen_madds32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
@@ -7046,90 +7047,90 @@ static void decode_rrr1_maddq_h(DisasContext *ctx)
     case OPC2_32_RRR1_MADDS_Q_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n);
         break;
     case OPC2_32_RRR1_MADDS_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
         gen_madds32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                       temp, n, 16);
         break;
     case OPC2_32_RRR1_MADDS_Q_64_L:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
-        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
+        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                       n);
         break;
     case OPC2_32_RRR1_MADDS_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
         gen_madds32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                       temp, n, 16);
         break;
     case OPC2_32_RRR1_MADDS_Q_64_U:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
-        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
+        gen_madds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                       n);
         break;
     case OPC2_32_RRR1_MADDS_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_m16adds32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDS_Q_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
-        gen_m16adds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                        cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
+        gen_m16adds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                        cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDS_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_m16adds32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDS_Q_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
-        gen_m16adds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                        cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
+        gen_m16adds64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                        cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDR_H_64_UL:
         CHECK_REG_PAIR(r3);
-        gen_maddr64_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3+1],
+        gen_maddr64_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3 + 1],
                       cpu_gpr_d[r1], cpu_gpr_d[r2], n, 2);
         break;
     case OPC2_32_RRR1_MADDRS_H_64_UL:
         CHECK_REG_PAIR(r3);
-        gen_maddr64s_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3+1],
+        gen_maddr64s_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3 + 1],
                        cpu_gpr_d[r1], cpu_gpr_d[r2], n, 2);
         break;
     case OPC2_32_RRR1_MADDR_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_maddr_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDR_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_maddr_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDRS_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_maddrs_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MADDRS_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_maddrs_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     default:
@@ -7153,109 +7154,109 @@ static void decode_rrr1_maddsu_h(DisasContext *ctx)
     case OPC2_32_RRR1_MADDSU_H_32_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDSU_H_32_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDSU_H_32_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDSU_H_32_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_maddsu_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDSUS_H_32_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDSUS_H_32_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDSUS_H_32_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDSUS_H_32_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsus_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDSUM_H_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDSUM_H_64_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDSUM_H_64_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDSUM_H_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsum_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDSUMS_H_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_LL);
         break;
     case OPC2_32_RRR1_MADDSUMS_H_64_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_LU);
         break;
     case OPC2_32_RRR1_MADDSUMS_H_64_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_UL);
         break;
     case OPC2_32_RRR1_MADDSUMS_H_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_maddsums_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_UU);
         break;
     case OPC2_32_RRR1_MADDSUR_H_16_LL:
@@ -7311,98 +7312,98 @@ static void decode_rrr1_msub(DisasContext *ctx)
     case OPC2_32_RRR1_MSUB_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUB_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUB_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUB_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                   cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_msub_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                   cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBS_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBS_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBS_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBS_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_msubs_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBM_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBM_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBM_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBM_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                    cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_msubm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                    cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBMS_H_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBMS_H_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBMS_H_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBMS_H_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_msubms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBR_H_LL:
         gen_msubr32_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
@@ -7465,61 +7466,61 @@ static void decode_rrr1_msubq_h(DisasContext *ctx)
     case OPC2_32_RRR1_MSUB_Q_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                      n);
         break;
     case OPC2_32_RRR1_MSUB_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
         gen_msub32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                      temp, n, 16);
         break;
     case OPC2_32_RRR1_MSUB_Q_64_L:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
-        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
+        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                      n);
         break;
     case OPC2_32_RRR1_MSUB_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
         gen_msub32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                      temp, n, 16);
         break;
     case OPC2_32_RRR1_MSUB_Q_64_U:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
-        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
+        gen_msub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                      n);
         break;
     case OPC2_32_RRR1_MSUB_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_m16sub32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUB_Q_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
-        gen_m16sub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
+        gen_m16sub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUB_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_m16sub32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUB_Q_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
-        gen_m16sub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
+        gen_m16sub64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_32:
         gen_msubs32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
@@ -7528,90 +7529,90 @@ static void decode_rrr1_msubq_h(DisasContext *ctx)
     case OPC2_32_RRR1_MSUBS_Q_64:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_32_L:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
         gen_msubs32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                       temp, n, 16);
         break;
     case OPC2_32_RRR1_MSUBS_Q_64_L:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r2]);
-        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r2]);
+        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                       n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_32_U:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
         gen_msubs32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r1],
                       temp, n, 16);
         break;
     case OPC2_32_RRR1_MSUBS_Q_64_U:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r2], 16);
-        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], temp,
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r2], 16);
+        gen_msubs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], temp,
                       n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_m16subs32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
-        gen_m16subs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                        cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
+        gen_m16subs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                        cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_m16subs32_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBS_Q_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
-        gen_m16subs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                        cpu_gpr_d[r3+1], temp, temp2, n);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
+        gen_m16subs64_q(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                        cpu_gpr_d[r3 + 1], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBR_H_64_UL:
         CHECK_REG_PAIR(r3);
-        gen_msubr64_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3+1],
+        gen_msubr64_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3 + 1],
                       cpu_gpr_d[r1], cpu_gpr_d[r2], n, 2);
         break;
     case OPC2_32_RRR1_MSUBRS_H_64_UL:
         CHECK_REG_PAIR(r3);
-        gen_msubr64s_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3+1],
+        gen_msubr64s_h(cpu_gpr_d[r4], cpu_gpr_d[r3], cpu_gpr_d[r3 + 1],
                        cpu_gpr_d[r1], cpu_gpr_d[r2], n, 2);
         break;
     case OPC2_32_RRR1_MSUBR_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_msubr_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBR_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_msubr_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBRS_Q_32_LL:
-        tcg_gen_ext16s_tl(temp, cpu_gpr_d[r1]);
-        tcg_gen_ext16s_tl(temp2, cpu_gpr_d[r2]);
+        tcg_gen_ext16s_i32(temp, cpu_gpr_d[r1]);
+        tcg_gen_ext16s_i32(temp2, cpu_gpr_d[r2]);
         gen_msubrs_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     case OPC2_32_RRR1_MSUBRS_Q_32_UU:
-        tcg_gen_sari_tl(temp, cpu_gpr_d[r1], 16);
-        tcg_gen_sari_tl(temp2, cpu_gpr_d[r2], 16);
+        tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 16);
+        tcg_gen_sari_i32(temp2, cpu_gpr_d[r2], 16);
         gen_msubrs_q(cpu_gpr_d[r4], cpu_gpr_d[r3], temp, temp2, n);
         break;
     default:
@@ -7635,109 +7636,109 @@ static void decode_rrr1_msubad_h(DisasContext *ctx)
     case OPC2_32_RRR1_MSUBAD_H_32_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
+        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBAD_H_32_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
+        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBAD_H_32_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
+        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBAD_H_32_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                     cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
+        gen_msubad_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                     cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2], n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBADS_H_32_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBADS_H_32_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBADS_H_32_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBADS_H_32_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubads_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBADM_H_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBADM_H_64_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBADM_H_64_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBADM_H_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                      cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadm_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                      cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                       n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBADMS_H_64_LL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_LL);
         break;
     case OPC2_32_RRR1_MSUBADMS_H_64_LU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_LU);
         break;
     case OPC2_32_RRR1_MSUBADMS_H_64_UL:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_UL);
         break;
     case OPC2_32_RRR1_MSUBADMS_H_64_UU:
         CHECK_REG_PAIR(r4);
         CHECK_REG_PAIR(r3);
-        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4+1], cpu_gpr_d[r3],
-                       cpu_gpr_d[r3+1], cpu_gpr_d[r1], cpu_gpr_d[r2],
+        gen_msubadms_h(cpu_gpr_d[r4], cpu_gpr_d[r4 + 1], cpu_gpr_d[r3],
+                       cpu_gpr_d[r3 + 1], cpu_gpr_d[r1], cpu_gpr_d[r2],
                        n, MODE_UU);
         break;
     case OPC2_32_RRR1_MSUBADR_H_16_LL:
@@ -7795,43 +7796,43 @@ static void decode_rrrr_extract_insert(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RRRR_DEXTR:
-        tcg_gen_andi_tl(tmp_pos, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_andi_i32(tmp_pos, cpu_gpr_d[r3], 0x1f);
         if (r1 == r2) {
-            tcg_gen_rotl_tl(cpu_gpr_d[r4], cpu_gpr_d[r1], tmp_pos);
+            tcg_gen_rotl_i32(cpu_gpr_d[r4], cpu_gpr_d[r1], tmp_pos);
         } else {
             TCGv msw = tcg_temp_new();
-            TCGv zero = tcg_constant_tl(0);
-            tcg_gen_shl_tl(tmp_width, cpu_gpr_d[r1], tmp_pos);
-            tcg_gen_subfi_tl(msw, 32, tmp_pos);
-            tcg_gen_shr_tl(msw, cpu_gpr_d[r2], msw);
+            TCGv zero = tcg_constant_i32(0);
+            tcg_gen_shl_i32(tmp_width, cpu_gpr_d[r1], tmp_pos);
+            tcg_gen_subfi_i32(msw, 32, tmp_pos);
+            tcg_gen_shr_i32(msw, cpu_gpr_d[r2], msw);
             /*
              * if pos == 0, then we do cpu_gpr_d[r2] << 32, which is undefined
              * behaviour. So check that case here and set the low bits to zero
              * which effectivly returns cpu_gpr_d[r1]
              */
-            tcg_gen_movcond_tl(TCG_COND_EQ, msw, tmp_pos, zero, zero, msw);
-            tcg_gen_or_tl(cpu_gpr_d[r4], tmp_width, msw);
+            tcg_gen_movcond_i32(TCG_COND_EQ, msw, tmp_pos, zero, zero, msw);
+            tcg_gen_or_i32(cpu_gpr_d[r4], tmp_width, msw);
         }
         break;
     case OPC2_32_RRRR_EXTR:
     case OPC2_32_RRRR_EXTR_U:
         CHECK_REG_PAIR(r3);
-        tcg_gen_andi_tl(tmp_width, cpu_gpr_d[r3+1], 0x1f);
-        tcg_gen_andi_tl(tmp_pos, cpu_gpr_d[r3], 0x1f);
-        tcg_gen_add_tl(tmp_pos, tmp_pos, tmp_width);
-        tcg_gen_subfi_tl(tmp_pos, 32, tmp_pos);
-        tcg_gen_shl_tl(cpu_gpr_d[r4], cpu_gpr_d[r1], tmp_pos);
-        tcg_gen_subfi_tl(tmp_width, 32, tmp_width);
+        tcg_gen_andi_i32(tmp_width, cpu_gpr_d[r3 + 1], 0x1f);
+        tcg_gen_andi_i32(tmp_pos, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_add_i32(tmp_pos, tmp_pos, tmp_width);
+        tcg_gen_subfi_i32(tmp_pos, 32, tmp_pos);
+        tcg_gen_shl_i32(cpu_gpr_d[r4], cpu_gpr_d[r1], tmp_pos);
+        tcg_gen_subfi_i32(tmp_width, 32, tmp_width);
         if (op2 == OPC2_32_RRRR_EXTR) {
-            tcg_gen_sar_tl(cpu_gpr_d[r4], cpu_gpr_d[r4], tmp_width);
+            tcg_gen_sar_i32(cpu_gpr_d[r4], cpu_gpr_d[r4], tmp_width);
         } else {
-            tcg_gen_shr_tl(cpu_gpr_d[r4], cpu_gpr_d[r4], tmp_width);
+            tcg_gen_shr_i32(cpu_gpr_d[r4], cpu_gpr_d[r4], tmp_width);
         }
         break;
     case OPC2_32_RRRR_INSERT:
         CHECK_REG_PAIR(r3);
-        tcg_gen_andi_tl(tmp_width, cpu_gpr_d[r3+1], 0x1f);
-        tcg_gen_andi_tl(tmp_pos, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_andi_i32(tmp_width, cpu_gpr_d[r3 + 1], 0x1f);
+        tcg_gen_andi_i32(tmp_pos, cpu_gpr_d[r3], 0x1f);
         gen_insert(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r2], tmp_width,
                    tmp_pos);
         break;
@@ -7860,35 +7861,35 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
 
     switch (op2) {
     case OPC2_32_RRRW_EXTR:
-        tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
-        tcg_gen_addi_tl(temp, temp, width);
-        tcg_gen_subfi_tl(temp, 32, temp);
-        tcg_gen_shl_tl(cpu_gpr_d[r4], cpu_gpr_d[r1], temp);
-        tcg_gen_sari_tl(cpu_gpr_d[r4], cpu_gpr_d[r4], 32 - width);
+        tcg_gen_andi_i32(temp, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_addi_i32(temp, temp, width);
+        tcg_gen_subfi_i32(temp, 32, temp);
+        tcg_gen_shl_i32(cpu_gpr_d[r4], cpu_gpr_d[r1], temp);
+        tcg_gen_sari_i32(cpu_gpr_d[r4], cpu_gpr_d[r4], 32 - width);
         break;
     case OPC2_32_RRRW_EXTR_U:
         if (width == 0) {
-            tcg_gen_movi_tl(cpu_gpr_d[r4], 0);
+            tcg_gen_movi_i32(cpu_gpr_d[r4], 0);
         } else {
-            tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
-            tcg_gen_shr_tl(cpu_gpr_d[r4], cpu_gpr_d[r1], temp);
-            tcg_gen_andi_tl(cpu_gpr_d[r4], cpu_gpr_d[r4], ~0u >> (32-width));
+            tcg_gen_andi_i32(temp, cpu_gpr_d[r3], 0x1f);
+            tcg_gen_shr_i32(cpu_gpr_d[r4], cpu_gpr_d[r1], temp);
+            tcg_gen_andi_i32(cpu_gpr_d[r4], cpu_gpr_d[r4], ~0u >> (32 - width));
         }
         break;
     case OPC2_32_RRRW_IMASK:
         temp2 = tcg_temp_new();
         CHECK_REG_PAIR(r4);
-        tcg_gen_andi_tl(temp, cpu_gpr_d[r3], 0x1f);
-        tcg_gen_movi_tl(temp2, (1 << width) - 1);
-        tcg_gen_shl_tl(temp2, temp2, temp);
-        tcg_gen_shl_tl(cpu_gpr_d[r4], cpu_gpr_d[r2], temp);
-        tcg_gen_mov_tl(cpu_gpr_d[r4+1], temp2);
+        tcg_gen_andi_i32(temp, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_movi_i32(temp2, (1 << width) - 1);
+        tcg_gen_shl_i32(temp2, temp2, temp);
+        tcg_gen_shl_i32(cpu_gpr_d[r4], cpu_gpr_d[r2], temp);
+        tcg_gen_mov_i32(cpu_gpr_d[r4 + 1], temp2);
         break;
     case OPC2_32_RRRW_INSERT:
         temp2 = tcg_temp_new();
 
-        tcg_gen_movi_tl(temp, width);
-        tcg_gen_andi_tl(temp2, cpu_gpr_d[r3], 0x1f);
+        tcg_gen_movi_i32(temp, width);
+        tcg_gen_andi_i32(temp2, cpu_gpr_d[r3], 0x1f);
         gen_insert(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r2], temp, temp2);
         break;
     default:
@@ -7913,7 +7914,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_DISABLE:
         if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
-            tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+            tcg_gen_andi_i32(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
         } else {
             generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
         }
@@ -7921,9 +7922,9 @@ static void decode_sys_interrupts(DisasContext *ctx)
     case OPC2_32_SYS_DISABLE_D:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
-                tcg_gen_extract_tl(cpu_gpr_d[r1], cpu_ICR,
+                tcg_gen_extract_i32(cpu_gpr_d[r1], cpu_ICR,
                         ctx->icr_ie_offset, 1);
-                tcg_gen_andi_tl(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
+                tcg_gen_andi_i32(cpu_ICR, cpu_ICR, ~ctx->icr_ie_mask);
             } else {
                 generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
             }
@@ -7934,7 +7935,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_ENABLE:
         if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
-            tcg_gen_ori_tl(cpu_ICR, cpu_ICR, ctx->icr_ie_mask);
+            tcg_gen_ori_i32(cpu_ICR, cpu_ICR, ctx->icr_ie_mask);
             ctx->base.is_jmp = DISAS_EXIT_UPDATE;
         } else {
             generate_trap(ctx, TRAPC_PROT, TIN1_PRIV);
@@ -7960,8 +7961,8 @@ static void decode_sys_interrupts(DisasContext *ctx)
             l1 = gen_new_label();
 
             tcg_gen_ld_i32(tmp, tcg_env, offsetof(CPUTriCoreState, DBGSR));
-            tcg_gen_andi_tl(tmp, tmp, MASK_DBGSR_DE);
-            tcg_gen_brcondi_tl(TCG_COND_NE, tmp, 1, l1);
+            tcg_gen_andi_i32(tmp, tmp, MASK_DBGSR_DE);
+            tcg_gen_brcondi_i32(TCG_COND_NE, tmp, 1, l1);
             gen_helper_rfm(tcg_env);
             gen_set_label(l1);
             ctx->base.is_jmp = DISAS_EXIT;
@@ -7978,7 +7979,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
     case OPC2_32_SYS_RESTORE:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
             if (ctx->priv == TRICORE_PRIV_SM || ctx->priv == TRICORE_PRIV_UM1) {
-                tcg_gen_deposit_tl(cpu_ICR, cpu_ICR, cpu_gpr_d[r1],
+                tcg_gen_deposit_i32(cpu_ICR, cpu_ICR, cpu_gpr_d[r1],
                         ctx->icr_ie_offset, 1);
                 ctx->base.is_jmp = DISAS_EXIT_UPDATE;
             } else {
@@ -7990,13 +7991,13 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_TRAPSV:
         l1 = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_GE, cpu_PSW_SV, 0, l1);
+        tcg_gen_brcondi_i32(TCG_COND_GE, cpu_PSW_SV, 0, l1);
         generate_trap(ctx, TRAPC_ASSERT, TIN5_SOVF);
         gen_set_label(l1);
         break;
     case OPC2_32_SYS_TRAPV:
         l1 = gen_new_label();
-        tcg_gen_brcondi_tl(TCG_COND_GE, cpu_PSW_V, 0, l1);
+        tcg_gen_brcondi_i32(TCG_COND_GE, cpu_PSW_V, 0, l1);
         generate_trap(ctx, TRAPC_ASSERT, TIN5_OVF);
         gen_set_label(l1);
         break;
@@ -8047,16 +8048,16 @@ static void decode_32Bit_opc(DisasContext *ctx)
         temp = tcg_constant_i32(EA_ABS_FORMAT(address));
         temp2 = tcg_temp_new();
 
-        tcg_gen_shri_tl(temp2, cpu_gpr_d[r1], 16);
-        tcg_gen_qemu_st_tl(temp2, temp, ctx->mem_idx, MO_LEUW);
+        tcg_gen_shri_i32(temp2, cpu_gpr_d[r1], 16);
+        tcg_gen_qemu_st_i32(temp2, temp, ctx->mem_idx, MO_LEUW);
         break;
     case OPC1_32_ABS_LD_Q:
         address = MASK_OP_ABS_OFF18(ctx->opcode);
         r1 = MASK_OP_ABS_S1D(ctx->opcode);
         temp = tcg_constant_i32(EA_ABS_FORMAT(address));
 
-        tcg_gen_qemu_ld_tl(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
-        tcg_gen_shli_tl(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
+        tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUW);
+        tcg_gen_shli_i32(cpu_gpr_d[r1], cpu_gpr_d[r1], 16);
         break;
     case OPCM_32_ABS_LEA_LHA:
         address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -8065,13 +8066,13 @@ static void decode_32Bit_opc(DisasContext *ctx)
         if (has_feature(ctx, TRICORE_FEATURE_162)) {
             op2 = MASK_OP_ABS_OP2(ctx->opcode);
             if (op2 == OPC2_32_ABS_LHA) {
-                tcg_gen_movi_tl(cpu_gpr_a[r1], address << 14);
+                tcg_gen_movi_i32(cpu_gpr_a[r1], address << 14);
                 break;
             }
             /* otherwise translate regular LEA */
         }
 
-        tcg_gen_movi_tl(cpu_gpr_a[r1], EA_ABS_FORMAT(address));
+        tcg_gen_movi_i32(cpu_gpr_a[r1], EA_ABS_FORMAT(address));
         break;
 /* ABSB-format */
     case OPC1_32_ABSB_ST_T:
@@ -8082,10 +8083,10 @@ static void decode_32Bit_opc(DisasContext *ctx)
         temp = tcg_constant_i32(EA_ABS_FORMAT(address));
         temp2 = tcg_temp_new();
 
-        tcg_gen_qemu_ld_tl(temp2, temp, ctx->mem_idx, MO_UB);
-        tcg_gen_andi_tl(temp2, temp2, ~(0x1u << bpos));
-        tcg_gen_ori_tl(temp2, temp2, (b << bpos));
-        tcg_gen_qemu_st_tl(temp2, temp, ctx->mem_idx, MO_UB);
+        tcg_gen_qemu_ld_i32(temp2, temp, ctx->mem_idx, MO_UB);
+        tcg_gen_andi_i32(temp2, temp2, ~(0x1u << bpos));
+        tcg_gen_ori_i32(temp2, temp2, (b << bpos));
+        tcg_gen_qemu_st_i32(temp2, temp, ctx->mem_idx, MO_UB);
         break;
 /* B-format */
     case OPC1_32_B_CALL:
@@ -8212,8 +8213,8 @@ static void decode_32Bit_opc(DisasContext *ctx)
 
         CHECK_REG_PAIR(r2);
 
-        tcg_gen_andi_tl(temp2, cpu_gpr_d[r2 + 1], 0x1f);
-        tcg_gen_andi_tl(temp3, cpu_gpr_d[r2], 0x1f);
+        tcg_gen_andi_i32(temp2, cpu_gpr_d[r2 + 1], 0x1f);
+        tcg_gen_andi_i32(temp3, cpu_gpr_d[r2], 0x1f);
 
         gen_insert(cpu_gpr_d[r3], cpu_gpr_d[r1], temp, temp2, temp3);
         break;
@@ -8281,7 +8282,7 @@ static void decode_32Bit_opc(DisasContext *ctx)
         r3 = MASK_OP_RRPW_D(ctx->opcode);
         const16 = MASK_OP_RRPW_POS(ctx->opcode);
 
-        tcg_gen_extract2_tl(cpu_gpr_d[r3], cpu_gpr_d[r2], cpu_gpr_d[r1],
+        tcg_gen_extract2_i32(cpu_gpr_d[r3], cpu_gpr_d[r2], cpu_gpr_d[r1],
                             32 - const16);
         break;
 /* RRR Format */
@@ -8330,10 +8331,10 @@ static void decode_32Bit_opc(DisasContext *ctx)
         decode_sys_interrupts(ctx);
         break;
     case OPC1_32_SYS_RSTV:
-        tcg_gen_movi_tl(cpu_PSW_V, 0);
-        tcg_gen_mov_tl(cpu_PSW_SV, cpu_PSW_V);
-        tcg_gen_mov_tl(cpu_PSW_AV, cpu_PSW_V);
-        tcg_gen_mov_tl(cpu_PSW_SAV, cpu_PSW_V);
+        tcg_gen_movi_i32(cpu_PSW_V, 0);
+        tcg_gen_mov_i32(cpu_PSW_SV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_AV, cpu_PSW_V);
+        tcg_gen_mov_i32(cpu_PSW_SAV, cpu_PSW_V);
         break;
     default:
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_IOPC);

From e843ef2bbace2cac9e9b92869c4b69c175d6ca72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 06:01:38 +0200
Subject: [PATCH 1408/2396] target/tricore: Pass DisasContext as first argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unify style, always pass DisasContext as the first argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-11-philmd@linaro.org>
---
 target/tricore/translate.c | 72 ++++++++++++++++++++------------------
 1 file changed, 38 insertions(+), 34 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index ef3653b882..62a2d80726 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -226,7 +226,7 @@ static inline void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
     tcg_gen_qemu_st_i32(r1, temp, ctx->mem_idx, mop);
 }
 
-static void gen_st_2regs_64(TCGv rh, TCGv rl, TCGv address, DisasContext *ctx)
+static void gen_st_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -234,15 +234,15 @@ static void gen_st_2regs_64(TCGv rh, TCGv rl, TCGv address, DisasContext *ctx)
     tcg_gen_qemu_st_i64(temp, address, ctx->mem_idx, MO_LEUQ);
 }
 
-static void gen_offset_st_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
-                                DisasContext *ctx)
+static void gen_offset_st_2regs(DisasContext *ctx,
+                                TCGv rh, TCGv rl, TCGv base, int16_t con)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_i32(temp, base, con);
-    gen_st_2regs_64(rh, rl, temp, ctx);
+    gen_st_2regs_64(ctx, rh, rl, temp);
 }
 
-static void gen_ld_2regs_64(TCGv rh, TCGv rl, TCGv address, DisasContext *ctx)
+static void gen_ld_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -251,12 +251,12 @@ static void gen_ld_2regs_64(TCGv rh, TCGv rl, TCGv address, DisasContext *ctx)
     tcg_gen_extr_i64_i32(rl, rh, temp);
 }
 
-static void gen_offset_ld_2regs(TCGv rh, TCGv rl, TCGv base, int16_t con,
-                                DisasContext *ctx)
+static void gen_offset_ld_2regs(DisasContext *ctx,
+                                TCGv rh, TCGv rl, TCGv base, int16_t con)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_i32(temp, base, con);
-    gen_ld_2regs_64(rh, rl, temp, ctx);
+    gen_ld_2regs_64(ctx, rh, rl, temp);
 }
 
 static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
@@ -3798,11 +3798,11 @@ static void decode_abs_ldw(DisasContext *ctx)
         break;
     case OPC2_32_ABS_LD_D:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_ABS_LD_DA:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         break;
     case OPC2_32_ABS_LD_W:
         tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
@@ -3913,11 +3913,11 @@ static void decode_abs_store(DisasContext *ctx)
         break;
     case OPC2_32_ABS_ST_D:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_ABS_ST_DA:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         break;
     case OPC2_32_ABS_ST_W:
         tcg_gen_qemu_st_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LESL);
@@ -4289,36 +4289,38 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_ST_D_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_st_2regs(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
-                            off10, ctx);
+        gen_offset_st_2regs(ctx,
+                            cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
+                            off10);
         break;
     case OPC2_32_BO_ST_D_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2]);
         tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_D_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
-        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_ST_DA_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_st_2regs(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
-                            off10, ctx);
+        gen_offset_st_2regs(ctx,
+                            cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
+                            off10);
         break;
     case OPC2_32_BO_ST_DA_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_DA_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
-        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_ST_H_SHORTOFF:
@@ -4413,7 +4415,7 @@ static void decode_bo_addrmode_bitreverse_circular(DisasContext *ctx)
         break;
     case OPC2_32_BO_ST_D_BR:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2);
         gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_D_CIRC:
@@ -4428,7 +4430,7 @@ static void decode_bo_addrmode_bitreverse_circular(DisasContext *ctx)
         break;
     case OPC2_32_BO_ST_DA_BR:
         CHECK_REG_PAIR(r1);
-        gen_st_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2, ctx);
+        gen_st_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2);
         gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_ST_DA_CIRC:
@@ -4520,36 +4522,38 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_LD_D_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_ld_2regs(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
-                            off10, ctx);
+        gen_offset_ld_2regs(ctx,
+                            cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2],
+                            off10);
         break;
     case OPC2_32_BO_LD_D_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2], ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], cpu_gpr_a[r2]);
         tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_D_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
-        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_LD_DA_SHORTOFF:
         CHECK_REG_PAIR(r1);
-        gen_offset_ld_2regs(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
-                            off10, ctx);
+        gen_offset_ld_2regs(ctx,
+                            cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2],
+                            off10);
         break;
     case OPC2_32_BO_LD_DA_POSTINC:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2], ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_LD_DA_PREINC:
         CHECK_REG_PAIR(r1);
         temp = tcg_temp_new();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
-        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_BO_LD_H_SHORTOFF:
@@ -4651,7 +4655,7 @@ static void decode_bo_addrmode_ld_bitreverse_circular(DisasContext *ctx)
         break;
     case OPC2_32_BO_LD_D_BR:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp2);
         gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_D_CIRC:
@@ -4666,7 +4670,7 @@ static void decode_bo_addrmode_ld_bitreverse_circular(DisasContext *ctx)
         break;
     case OPC2_32_BO_LD_DA_BR:
         CHECK_REG_PAIR(r1);
-        gen_ld_2regs_64(cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2, ctx);
+        gen_ld_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp2);
         gen_helper_br_update(cpu_gpr_a[r2 + 1], cpu_gpr_a[r2 + 1]);
         break;
     case OPC2_32_BO_LD_DA_CIRC:
@@ -8377,7 +8381,7 @@ static void tricore_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
     tcg_gen_insn_start(ctx->base.pc_next);
 }
 
-static bool insn_crosses_page(CPUTriCoreState *env, DisasContext *ctx)
+static bool insn_crosses_page(DisasContext *ctx, CPUTriCoreState *env)
 {
     /*
      * Return true if the insn at ctx->base.pc_next might cross a page boundary.
@@ -8420,7 +8424,7 @@ static void tricore_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         page_start = ctx->base.pc_first & TARGET_PAGE_MASK;
         if (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE
             || (ctx->base.pc_next - page_start >= TARGET_PAGE_SIZE - 3
-                && insn_crosses_page(env, ctx))) {
+                && insn_crosses_page(ctx, env))) {
             ctx->base.is_jmp = DISAS_TOO_MANY;
         }
     }

From 8a2235dd077b4715b635628a0cdde835a732ea51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 06:15:47 +0200
Subject: [PATCH 1409/2396] target/tricore: Un-inline various helpers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rely on the linker to optimize at linking time.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-12-philmd@linaro.org>
---
 target/tricore/translate.c | 274 ++++++++++++++++++-------------------
 1 file changed, 135 insertions(+), 139 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 62a2d80726..787c77292f 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -201,7 +201,7 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 
 /* For two 32-bit registers used a 64-bit register, the first
    registernumber needs to be even. Otherwise we trap. */
-static inline void generate_trap(DisasContext *ctx, int class, int tin);
+static void generate_trap(DisasContext *ctx, int class, int tin);
 #define CHECK_REG_PAIR(reg) do {                      \
     if (reg & 0x1) {                                  \
         generate_trap(ctx, TRAPC_INSN_ERR, TIN2_OPD); \
@@ -210,16 +210,16 @@ static inline void generate_trap(DisasContext *ctx, int class, int tin);
 
 /* Functions for load/save to/from memory */
 
-static inline void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
-                                 int16_t con, MemOp mop)
+static void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
+                          int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_i32(temp, r2, con);
     tcg_gen_qemu_ld_i32(r1, temp, ctx->mem_idx, mop);
 }
 
-static inline void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
-                                 int16_t con, MemOp mop)
+static void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
+                          int16_t con, MemOp mop)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_addi_i32(temp, r2, con);
@@ -346,7 +346,7 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
         break;
 #define A(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)
 #define E(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)
-static inline void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
+static void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
 {
     /* since we're caching PSW make this a special case */
     if (offset == 0xfe04) {
@@ -374,8 +374,7 @@ static inline void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
          watchdog device, we handle endinit protected registers like
          all-access registers for now. */
 #define E(ADDRESS, REG, FEATURE) A(ADDRESS, REG, FEATURE)
-static inline void gen_mtcr(DisasContext *ctx, TCGv r1,
-                            int32_t offset)
+static void gen_mtcr(DisasContext *ctx, TCGv r1, int32_t offset)
 {
     if (ctx->priv == TRICORE_PRIV_SM) {
         /* since we're caching PSW make this a special case */
@@ -394,7 +393,7 @@ static inline void gen_mtcr(DisasContext *ctx, TCGv r1,
 
 /* Functions for arithmetic instructions  */
 
-static inline void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
+static void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv t0 = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
@@ -415,7 +414,7 @@ static inline void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void
+static void
 gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
 {
     TCGv temp = tcg_temp_new();
@@ -441,7 +440,7 @@ gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_mov_i64(ret, result);
 }
 
-static inline void
+static void
 gen_addsub64_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                TCGv r3, void(*op1)(TCGv, TCGv, TCGv),
                void(*op2)(TCGv, TCGv, TCGv))
@@ -488,7 +487,7 @@ gen_addsub64_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
 }
 
 /* ret = r2 + (r1 * r3); */
-static inline void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
+static void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -519,13 +518,13 @@ static inline void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_maddi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_madd32_d(ret, r1, r2, temp);
 }
 
-static inline void
+static void
 gen_madd64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -553,7 +552,7 @@ gen_madd64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_mov_i32(ret_high, t4);
 }
 
-static inline void
+static void
 gen_maddu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               TCGv r3)
 {
@@ -583,7 +582,7 @@ gen_maddu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void
+static void
 gen_maddi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               int32_t con)
 {
@@ -591,7 +590,7 @@ gen_maddi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_madd64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void
+static void
 gen_maddui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
                int32_t con)
 {
@@ -599,7 +598,7 @@ gen_maddui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_maddu64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void
+static void
 gen_madd_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
            TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -626,7 +625,7 @@ gen_madd_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_add_tl, tcg_gen_add_tl);
 }
 
-static inline void
+static void
 gen_maddsu_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
              TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -653,7 +652,7 @@ gen_maddsu_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_sub_tl, tcg_gen_add_tl);
 }
 
-static inline void
+static void
 gen_maddsum_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
               TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -686,9 +685,9 @@ gen_maddsum_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_2);
 }
 
-static inline void gen_adds(TCGv ret, TCGv r1, TCGv r2);
+static void gen_adds(TCGv ret, TCGv r1, TCGv r2);
 
-static inline void
+static void
 gen_madds_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
            TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -723,9 +722,9 @@ gen_madds_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static inline void gen_subs(TCGv ret, TCGv r1, TCGv r2);
+static void gen_subs(TCGv ret, TCGv r1, TCGv r2);
 
-static inline void
+static void
 gen_maddsus_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
               TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -760,7 +759,7 @@ gen_maddsus_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static inline void
+static void
 gen_maddsums_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -793,7 +792,7 @@ gen_maddsums_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
 }
 
 
-static inline void
+static void
 gen_maddm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
            TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -821,7 +820,7 @@ gen_maddm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_3);
 }
 
-static inline void
+static void
 gen_maddms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
            TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -847,7 +846,7 @@ gen_maddms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_maddr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
               uint32_t mode)
 {
@@ -870,7 +869,7 @@ gen_maddr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
     gen_helper_addr_h(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static inline void
+static void
 gen_maddr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv temp = tcg_temp_new();
@@ -881,7 +880,7 @@ gen_maddr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_maddr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static inline void
+static void
 gen_maddsur32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv t_n = tcg_constant_i32(n);
@@ -908,7 +907,7 @@ gen_maddsur32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 }
 
 
-static inline void
+static void
 gen_maddr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
                uint32_t n, uint32_t mode)
 {
@@ -931,7 +930,7 @@ gen_maddr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
     gen_helper_addr_h_ssov(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static inline void
+static void
 gen_maddr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv temp = tcg_temp_new();
@@ -942,7 +941,7 @@ gen_maddr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_maddr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static inline void
+static void
 gen_maddsur32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv t_n = tcg_constant_i32(n);
@@ -968,21 +967,21 @@ gen_maddsur32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_addsur_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
-static inline void
+static void
 gen_maddr_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
 {
     TCGv t_n = tcg_constant_i32(n);
     gen_helper_maddr_q(ret, tcg_env, r1, r2, r3, t_n);
 }
 
-static inline void
+static void
 gen_maddrs_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
 {
     TCGv t_n = tcg_constant_i32(n);
     gen_helper_maddr_q_ssov(ret, tcg_env, r1, r2, r3, t_n);
 }
 
-static inline void
+static void
 gen_madd32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
              uint32_t up_shift)
 {
@@ -1032,7 +1031,7 @@ gen_madd32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_mov_i32(ret, temp3);
 }
 
-static inline void
+static void
 gen_m16add32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
@@ -1049,7 +1048,7 @@ gen_m16add32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_add_d(ret, arg1, temp);
 }
 
-static inline void
+static void
 gen_m16adds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
@@ -1066,7 +1065,7 @@ gen_m16adds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_adds(ret, arg1, temp);
 }
 
-static inline void
+static void
 gen_m16add64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
                TCGv arg3, uint32_t n)
 {
@@ -1093,7 +1092,7 @@ gen_m16add64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t3);
 }
 
-static inline void
+static void
 gen_m16adds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
                TCGv arg3, uint32_t n)
 {
@@ -1119,7 +1118,7 @@ gen_m16adds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t1);
 }
 
-static inline void
+static void
 gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
              TCGv arg3, uint32_t n)
 {
@@ -1167,7 +1166,7 @@ gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void
+static void
 gen_madds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
               uint32_t up_shift)
 {
@@ -1185,7 +1184,7 @@ gen_madds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     gen_helper_madd32_q_add_ssov(ret, tcg_env, t1, t2);
 }
 
-static inline void
+static void
 gen_madds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
              TCGv arg3, uint32_t n)
 {
@@ -1198,7 +1197,7 @@ gen_madds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
 }
 
 /* ret = r2 - (r1 * r3); */
-static inline void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
+static void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -1230,13 +1229,13 @@ static inline void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_msubi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_msub32_d(ret, r1, r2, temp);
 }
 
-static inline void
+static void
 gen_msub64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -1264,7 +1263,7 @@ gen_msub64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_mov_i32(ret_high, t4);
 }
 
-static inline void
+static void
 gen_msubi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               int32_t con)
 {
@@ -1272,7 +1271,7 @@ gen_msubi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_msub64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void
+static void
 gen_msubu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               TCGv r3)
 {
@@ -1300,7 +1299,7 @@ gen_msubu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void
+static void
 gen_msubui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
                int32_t con)
 {
@@ -1308,14 +1307,14 @@ gen_msubui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_msubu64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void gen_addi_d(TCGv ret, TCGv r1, int32_t r2)
+static void gen_addi_d(TCGv ret, TCGv r1, int32_t r2)
 {
     TCGv temp = tcg_constant_i32(r2);
     gen_add_d(ret, r1, temp);
 }
 
 /* calculate the carry bit too */
-static inline void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv t0    = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
@@ -1338,13 +1337,13 @@ static inline void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void gen_addi_CC(TCGv ret, TCGv r1, int32_t con)
+static void gen_addi_CC(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_add_CC(ret, r1, temp);
 }
 
-static inline void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv t0     = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
@@ -1366,14 +1365,13 @@ static inline void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void gen_addci_CC(TCGv ret, TCGv r1, int32_t con)
+static void gen_addci_CC(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_addc_CC(ret, r1, temp);
 }
 
-static inline void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
-                                TCGv r4)
+static void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
 {
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
@@ -1405,14 +1403,13 @@ static inline void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
     tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
-static inline void gen_condi_add(TCGCond cond, TCGv r1, int32_t r2,
-                                 TCGv r3, TCGv r4)
+static void gen_condi_add(TCGCond cond, TCGv r1, int32_t r2, TCGv r3, TCGv r4)
 {
     TCGv temp = tcg_constant_i32(r2);
     gen_cond_add(cond, r1, temp, r3, r4);
 }
 
-static inline void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
+static void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv temp = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
@@ -1433,7 +1430,7 @@ static inline void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void
+static void
 gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
 {
     TCGv temp = tcg_temp_new();
@@ -1459,7 +1456,7 @@ gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_mov_i64(ret, result);
 }
 
-static inline void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv result = tcg_temp_new();
     TCGv temp = tcg_temp_new();
@@ -1482,15 +1479,14 @@ static inline void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void gen_subc_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subc_CC(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv temp = tcg_temp_new();
     tcg_gen_not_i32(temp, r2);
     gen_addc_CC(ret, r1, temp);
 }
 
-static inline void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
-                                TCGv r4)
+static void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
 {
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
@@ -1522,7 +1518,7 @@ static inline void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3,
     tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
-static inline void
+static void
 gen_msub_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
            TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1549,7 +1545,7 @@ gen_msub_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_sub_tl, tcg_gen_sub_tl);
 }
 
-static inline void
+static void
 gen_msubs_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
             TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1584,7 +1580,7 @@ gen_msubs_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static inline void
+static void
 gen_msubm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
             TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1612,7 +1608,7 @@ gen_msubm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_3);
 }
 
-static inline void
+static void
 gen_msubms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
              TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1638,7 +1634,7 @@ gen_msubms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_msubr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
               uint32_t mode)
 {
@@ -1661,7 +1657,7 @@ gen_msubr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
     gen_helper_subr_h(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static inline void
+static void
 gen_msubr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv temp = tcg_temp_new();
@@ -1672,7 +1668,7 @@ gen_msubr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_msubr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static inline void
+static void
 gen_msubr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
                uint32_t n, uint32_t mode)
 {
@@ -1695,7 +1691,7 @@ gen_msubr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
     gen_helper_subr_h_ssov(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static inline void
+static void
 gen_msubr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv temp = tcg_temp_new();
@@ -1706,21 +1702,21 @@ gen_msubr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_msubr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static inline void
+static void
 gen_msubr_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
 {
     TCGv temp = tcg_constant_i32(n);
     gen_helper_msubr_q(ret, tcg_env, r1, r2, r3, temp);
 }
 
-static inline void
+static void
 gen_msubrs_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
 {
     TCGv temp = tcg_constant_i32(n);
     gen_helper_msubr_q_ssov(ret, tcg_env, r1, r2, r3, temp);
 }
 
-static inline void
+static void
 gen_msub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
              uint32_t up_shift)
 {
@@ -1761,7 +1757,7 @@ gen_msub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_mov_i32(ret, temp3);
 }
 
-static inline void
+static void
 gen_m16sub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
@@ -1778,7 +1774,7 @@ gen_m16sub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_sub_d(ret, arg1, temp);
 }
 
-static inline void
+static void
 gen_m16subs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
 {
     TCGv temp = tcg_temp_new();
@@ -1795,7 +1791,7 @@ gen_m16subs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_subs(ret, arg1, temp);
 }
 
-static inline void
+static void
 gen_m16sub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
                TCGv arg3, uint32_t n)
 {
@@ -1822,7 +1818,7 @@ gen_m16sub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t3);
 }
 
-static inline void
+static void
 gen_m16subs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
                TCGv arg3, uint32_t n)
 {
@@ -1848,7 +1844,7 @@ gen_m16subs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t1);
 }
 
-static inline void
+static void
 gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
              TCGv arg3, uint32_t n)
 {
@@ -1896,7 +1892,7 @@ gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void
+static void
 gen_msubs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
               uint32_t up_shift)
 {
@@ -1919,7 +1915,7 @@ gen_msubs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     gen_helper_msub32_q_sub_ssov(ret, tcg_env, t1, t3);
 }
 
-static inline void
+static void
 gen_msubs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
              TCGv arg3, uint32_t n)
 {
@@ -1931,7 +1927,7 @@ gen_msubs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, r1);
 }
 
-static inline void
+static void
 gen_msubad_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
              TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1958,7 +1954,7 @@ gen_msubad_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_add_tl, tcg_gen_sub_tl);
 }
 
-static inline void
+static void
 gen_msubadm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
               TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -1991,7 +1987,7 @@ gen_msubadm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_2);
 }
 
-static inline void
+static void
 gen_msubadr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv t_n = tcg_constant_i32(n);
@@ -2017,7 +2013,7 @@ gen_msubadr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_subadr_h(ret, tcg_env, temp64, temp, temp2);
 }
 
-static inline void
+static void
 gen_msubads_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
               TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -2052,7 +2048,7 @@ gen_msubads_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static inline void
+static void
 gen_msubadms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                TCGv r3, uint32_t n, uint32_t mode)
 {
@@ -2084,7 +2080,7 @@ gen_msubadms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_msubadr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 {
     TCGv t_n = tcg_constant_i32(n);
@@ -2110,7 +2106,7 @@ gen_msubadr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_subadr_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
-static inline void gen_abs(TCGv ret, TCGv r1)
+static void gen_abs(TCGv ret, TCGv r1)
 {
     tcg_gen_abs_i32(ret, r1);
     /* overflow can only happen, if r1 = 0x80000000 */
@@ -2125,7 +2121,7 @@ static inline void gen_abs(TCGv ret, TCGv r1)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
+static void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv temp = tcg_temp_new_i32();
     TCGv result = tcg_temp_new_i32();
@@ -2151,19 +2147,19 @@ static inline void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static inline void gen_absdifi(TCGv ret, TCGv r1, int32_t con)
+static void gen_absdifi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_absdif(ret, r1, temp);
 }
 
-static inline void gen_absdifsi(TCGv ret, TCGv r1, int32_t con)
+static void gen_absdifsi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_absdif_ssov(ret, tcg_env, r1, temp);
 }
 
-static inline void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
+static void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
 {
     TCGv high = tcg_temp_new();
     TCGv low = tcg_temp_new();
@@ -2183,13 +2179,13 @@ static inline void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_muli_i32s(TCGv ret, TCGv r1, int32_t con)
+static void gen_muli_i32s(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_mul_i32s(ret, r1, temp);
 }
 
-static inline void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
+static void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
 {
     tcg_gen_muls2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
@@ -2203,14 +2199,14 @@ static inline void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_muli_i64s(TCGv ret_low, TCGv ret_high, TCGv r1,
+static void gen_muli_i64s(TCGv ret_low, TCGv ret_high, TCGv r1,
                                 int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_mul_i64s(ret_low, ret_high, r1, temp);
 }
 
-static inline void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
+static void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
 {
     tcg_gen_mulu2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
@@ -2224,33 +2220,33 @@ static inline void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static inline void gen_muli_i64u(TCGv ret_low, TCGv ret_high, TCGv r1,
+static void gen_muli_i64u(TCGv ret_low, TCGv ret_high, TCGv r1,
                                 int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_mul_i64u(ret_low, ret_high, r1, temp);
 }
 
-static inline void gen_mulsi_i32(TCGv ret, TCGv r1, int32_t con)
+static void gen_mulsi_i32(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_mul_ssov(ret, tcg_env, r1, temp);
 }
 
-static inline void gen_mulsui_i32(TCGv ret, TCGv r1, int32_t con)
+static void gen_mulsui_i32(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_mul_suov(ret, tcg_env, r1, temp);
 }
 
 /* gen_maddsi_32(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r3], const9); */
-static inline void gen_maddsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_madd32_ssov(ret, tcg_env, r1, r2, temp);
 }
 
-static inline void gen_maddsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_madd32_suov(ret, tcg_env, r1, r2, temp);
@@ -2361,7 +2357,7 @@ static void gen_mulr_q(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
     tcg_gen_andi_i32(ret, ret, 0xffff0000);
 }
 
-static inline void
+static void
 gen_madds_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -2371,7 +2367,7 @@ gen_madds_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_maddsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               int32_t con)
 {
@@ -2379,7 +2375,7 @@ gen_maddsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_madds_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void
+static void
 gen_maddsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -2389,7 +2385,7 @@ gen_maddsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_maddsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
                int32_t con)
 {
@@ -2397,19 +2393,19 @@ gen_maddsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_maddsu_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void gen_msubsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_msub32_ssov(ret, tcg_env, r1, r2, temp);
 }
 
-static inline void gen_msubsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_msub32_suov(ret, tcg_env, r1, r2, temp);
 }
 
-static inline void
+static void
 gen_msubs_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -2419,7 +2415,7 @@ gen_msubs_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_msubsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
               int32_t con)
 {
@@ -2427,7 +2423,7 @@ gen_msubsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     gen_msubs_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static inline void
+static void
 gen_msubsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
              TCGv r3)
 {
@@ -2437,7 +2433,7 @@ gen_msubsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static inline void
+static void
 gen_msubsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
                int32_t con)
 {
@@ -2589,37 +2585,37 @@ static void gen_sh_condi(int cond, TCGv ret, TCGv r1, int32_t con)
     gen_sh_cond(cond, ret, r1, temp);
 }
 
-static inline void gen_adds(TCGv ret, TCGv r1, TCGv r2)
+static void gen_adds(TCGv ret, TCGv r1, TCGv r2)
 {
     gen_helper_add_ssov(ret, tcg_env, r1, r2);
 }
 
-static inline void gen_addsi(TCGv ret, TCGv r1, int32_t con)
+static void gen_addsi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_add_ssov(ret, tcg_env, r1, temp);
 }
 
-static inline void gen_addsui(TCGv ret, TCGv r1, int32_t con)
+static void gen_addsui(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv temp = tcg_constant_i32(con);
     gen_helper_add_suov(ret, tcg_env, r1, temp);
 }
 
-static inline void gen_subs(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subs(TCGv ret, TCGv r1, TCGv r2)
 {
     gen_helper_sub_ssov(ret, tcg_env, r1, r2);
 }
 
-static inline void gen_subsu(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subsu(TCGv ret, TCGv r1, TCGv r2)
 {
     gen_helper_sub_suov(ret, tcg_env, r1, r2);
 }
 
-static inline void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
-                               int pos1, int pos2,
-                               void(*op1)(TCGv, TCGv, TCGv),
-                               void(*op2)(TCGv, TCGv, TCGv))
+static void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
+                        int pos1, int pos2,
+                        void(*op1)(TCGv, TCGv, TCGv),
+                        void(*op2)(TCGv, TCGv, TCGv))
 {
     TCGv temp1, temp2;
 
@@ -2636,9 +2632,9 @@ static inline void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
 }
 
 /* ret = r1[pos1] op1 r2[pos2]; */
-static inline void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
-                               int pos1, int pos2,
-                               void(*op1)(TCGv, TCGv, TCGv))
+static void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
+                        int pos1, int pos2,
+                        void(*op1)(TCGv, TCGv, TCGv))
 {
     TCGv temp1, temp2;
 
@@ -2653,8 +2649,8 @@ static inline void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
     tcg_gen_andi_i32(ret, ret, 0x1);
 }
 
-static inline void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
-                                         void(*op)(TCGv, TCGv, TCGv))
+static void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
+                                  void(*op)(TCGv, TCGv, TCGv))
 {
     TCGv temp = tcg_temp_new();
     TCGv temp2 = tcg_temp_new();
@@ -2668,7 +2664,7 @@ static inline void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
     tcg_gen_deposit_i32(ret, ret, temp, 0, 1);
 }
 
-static inline void
+static void
 gen_accumulating_condi(int cond, TCGv ret, TCGv r1, int32_t con,
                        void(*op)(TCGv, TCGv, TCGv))
 {
@@ -2676,7 +2672,7 @@ gen_accumulating_condi(int cond, TCGv ret, TCGv r1, int32_t con,
     gen_accumulating_cond(cond, ret, r1, temp, op);
 }
 
-static inline void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
+static void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv b0 = tcg_temp_new();
     TCGv b1 = tcg_temp_new();
@@ -2705,7 +2701,7 @@ static inline void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
     tcg_gen_or_i32(ret, ret, b3);
 }
 
-static inline void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
+static void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
 {
     TCGv h0 = tcg_temp_new();
     TCGv h1 = tcg_temp_new();
@@ -2724,7 +2720,7 @@ static inline void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
 
 /* mask = ((1 << width) -1) << pos;
    ret = (r1 & ~mask) | (r2 << pos) & mask); */
-static inline void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
+static void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
 {
     TCGv mask = tcg_temp_new();
     TCGv temp = tcg_temp_new();
@@ -2740,7 +2736,7 @@ static inline void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
     tcg_gen_or_i32(ret, temp, temp2);
 }
 
-static inline void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
+static void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -2748,7 +2744,7 @@ static inline void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
     tcg_gen_extr_i64_i32(rl, rh, temp);
 }
 
-static inline void gen_unpack(TCGv rl, TCGv rh, TCGv r1)
+static void gen_unpack(TCGv rl, TCGv rh, TCGv r1)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -2756,7 +2752,7 @@ static inline void gen_unpack(TCGv rl, TCGv rh, TCGv r1)
     tcg_gen_extr_i64_i32(rl, rh, temp);
 }
 
-static inline void
+static void
 gen_dvinit_b(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
 {
     TCGv_i64 ret = tcg_temp_new_i64();
@@ -2769,7 +2765,7 @@ gen_dvinit_b(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
     tcg_gen_extr_i64_i32(rl, rh, ret);
 }
 
-static inline void
+static void
 gen_dvinit_h(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
 {
     TCGv_i64 ret = tcg_temp_new_i64();
@@ -2812,7 +2808,7 @@ static void gen_calc_usb_mulr_h(TCGv arg)
 
 /* helpers for generating program flow micro-ops */
 
-static inline void gen_save_pc(vaddr pc)
+static void gen_save_pc(vaddr pc)
 {
     tcg_gen_movi_i32(cpu_PC, pc);
 }
@@ -2840,8 +2836,8 @@ static void generate_trap(DisasContext *ctx, int class, int tin)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static inline void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
-                                   TCGv r2, int16_t address)
+static void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
+                            TCGv r2, int16_t address)
 {
     TCGLabel *jumpLabel = gen_new_label();
     tcg_gen_brcond_i32(cond, r1, r2, jumpLabel);
@@ -2852,8 +2848,8 @@ static inline void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
     gen_goto_tb(ctx, 0, ctx->base.pc_next + address * 2);
 }
 
-static inline void gen_branch_condi(DisasContext *ctx, TCGCond cond, TCGv r1,
-                                    int r2, int16_t address)
+static void gen_branch_condi(DisasContext *ctx, TCGCond cond, TCGv r1,
+                             int r2, int16_t address)
 {
     TCGv temp = tcg_constant_i32(r2);
     gen_branch_cond(ctx, cond, r1, temp, address);

From cd08bcaa36b4c0437b2d61f9906bf78b99aa3684 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 05:59:37 +0200
Subject: [PATCH 1410/2396] target/tricore: Expand TCGv type for 32-bit target
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The TriCore target is only built as 32-bit:

  $ git grep TARGET_LONG_BITS configs/targets/tricore-*
  configs/targets/tricore-softmmu.mak:2:TARGET_LONG_BITS=32

Replace:

  TCGv -> TCGv_i32
  tcg_temp_new -> tcg_temp_new_i32

This is a mechanical replacement, adapting style to pass
the checkpatch.pl script.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251010052141.42460-13-philmd@linaro.org>
---
 target/tricore/translate.c | 1248 +++++++++++++++++++-----------------
 1 file changed, 642 insertions(+), 606 deletions(-)

diff --git a/target/tricore/translate.c b/target/tricore/translate.c
index 787c77292f..fbe05a93a8 100644
--- a/target/tricore/translate.c
+++ b/target/tricore/translate.c
@@ -136,9 +136,9 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
     } while (0)
 
 #define GEN_HELPER_LL(name, ret, arg0, arg1, n) do {         \
-    TCGv arg00 = tcg_temp_new();                             \
-    TCGv arg01 = tcg_temp_new();                             \
-    TCGv arg11 = tcg_temp_new();                             \
+    TCGv_i32 arg00 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg01 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg11 = tcg_temp_new_i32();                     \
     tcg_gen_sari_i32(arg00, arg0, 16);                       \
     tcg_gen_ext16s_i32(arg01, arg0);                         \
     tcg_gen_ext16s_i32(arg11, arg1);                         \
@@ -146,10 +146,10 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 } while (0)
 
 #define GEN_HELPER_LU(name, ret, arg0, arg1, n) do {         \
-    TCGv arg00 = tcg_temp_new();                             \
-    TCGv arg01 = tcg_temp_new();                             \
-    TCGv arg10 = tcg_temp_new();                             \
-    TCGv arg11 = tcg_temp_new();                             \
+    TCGv_i32 arg00 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg01 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg10 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg11 = tcg_temp_new_i32();                     \
     tcg_gen_sari_i32(arg00, arg0, 16);                       \
     tcg_gen_ext16s_i32(arg01, arg0);                         \
     tcg_gen_sari_i32(arg11, arg1, 16);                       \
@@ -158,10 +158,10 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 } while (0)
 
 #define GEN_HELPER_UL(name, ret, arg0, arg1, n) do {         \
-    TCGv arg00 = tcg_temp_new();                             \
-    TCGv arg01 = tcg_temp_new();                             \
-    TCGv arg10 = tcg_temp_new();                             \
-    TCGv arg11 = tcg_temp_new();                             \
+    TCGv_i32 arg00 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg01 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg10 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg11 = tcg_temp_new_i32();                     \
     tcg_gen_sari_i32(arg00, arg0, 16);                       \
     tcg_gen_ext16s_i32(arg01, arg0);                         \
     tcg_gen_sari_i32(arg10, arg1, 16);                       \
@@ -170,9 +170,9 @@ void tricore_cpu_dump_state(CPUState *cs, FILE *f, int flags)
 } while (0)
 
 #define GEN_HELPER_UU(name, ret, arg0, arg1, n) do {         \
-    TCGv arg00 = tcg_temp_new();                             \
-    TCGv arg01 = tcg_temp_new();                             \
-    TCGv arg11 = tcg_temp_new();                             \
+    TCGv_i32 arg00 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg01 = tcg_temp_new_i32();                     \
+    TCGv_i32 arg11 = tcg_temp_new_i32();                     \
     tcg_gen_sari_i32(arg01, arg0, 16);                       \
     tcg_gen_ext16s_i32(arg00, arg0);                         \
     tcg_gen_sari_i32(arg11, arg1, 16);                       \
@@ -210,23 +210,24 @@ static void generate_trap(DisasContext *ctx, int class, int tin);
 
 /* Functions for load/save to/from memory */
 
-static void gen_offset_ld(DisasContext *ctx, TCGv r1, TCGv r2,
+static void gen_offset_ld(DisasContext *ctx, TCGv_i32 r1, TCGv_i32 r2,
                           int16_t con, MemOp mop)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, r2, con);
     tcg_gen_qemu_ld_i32(r1, temp, ctx->mem_idx, mop);
 }
 
-static void gen_offset_st(DisasContext *ctx, TCGv r1, TCGv r2,
+static void gen_offset_st(DisasContext *ctx, TCGv_i32 r1, TCGv_i32 r2,
                           int16_t con, MemOp mop)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, r2, con);
     tcg_gen_qemu_st_i32(r1, temp, ctx->mem_idx, mop);
 }
 
-static void gen_st_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
+static void gen_st_2regs_64(DisasContext *ctx, TCGv_i32 rh, TCGv_i32 rl,
+                            TCGv_i32 address)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -235,14 +236,16 @@ static void gen_st_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
 }
 
 static void gen_offset_st_2regs(DisasContext *ctx,
-                                TCGv rh, TCGv rl, TCGv base, int16_t con)
+                                TCGv_i32 rh, TCGv_i32 rl,
+                                TCGv_i32 base, int16_t con)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, base, con);
     gen_st_2regs_64(ctx, rh, rl, temp);
 }
 
-static void gen_ld_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
+static void gen_ld_2regs_64(DisasContext *ctx, TCGv_i32 rh, TCGv_i32 rl,
+                            TCGv_i32 address)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -252,36 +255,37 @@ static void gen_ld_2regs_64(DisasContext *ctx, TCGv rh, TCGv rl, TCGv address)
 }
 
 static void gen_offset_ld_2regs(DisasContext *ctx,
-                                TCGv rh, TCGv rl, TCGv base, int16_t con)
+                                TCGv_i32 rh, TCGv_i32 rl,
+                                TCGv_i32 base, int16_t con)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, base, con);
     gen_ld_2regs_64(ctx, rh, rl, temp);
 }
 
-static void gen_st_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
-                           MemOp mop)
+static void gen_st_preincr(DisasContext *ctx, TCGv_i32 r1, TCGv_i32 r2,
+                           int16_t off, MemOp mop)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, r2, off);
     tcg_gen_qemu_st_i32(r1, temp, ctx->mem_idx, mop);
     tcg_gen_mov_i32(r2, temp);
 }
 
-static void gen_ld_preincr(DisasContext *ctx, TCGv r1, TCGv r2, int16_t off,
-                           MemOp mop)
+static void gen_ld_preincr(DisasContext *ctx, TCGv_i32 r1, TCGv_i32 r2,
+                           int16_t off, MemOp mop)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_addi_i32(temp, r2, off);
     tcg_gen_qemu_ld_i32(r1, temp, ctx->mem_idx, mop);
     tcg_gen_mov_i32(r2, temp);
 }
 
 /* M(EA, word) = (M(EA, word) & ~E[a][63:32]) | (E[a][31:0] & E[a][63:32]); */
-static void gen_ldmst(DisasContext *ctx, int ereg, TCGv ea)
+static void gen_ldmst(DisasContext *ctx, int ereg, TCGv_i32 ea)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     CHECK_REG_PAIR(ereg);
     /* temp = (M(EA, word) */
@@ -299,19 +303,19 @@ static void gen_ldmst(DisasContext *ctx, int ereg, TCGv ea)
 /* tmp = M(EA, word);
    M(EA, word) = D[a];
    D[a] = tmp[31:0];*/
-static void gen_swap(DisasContext *ctx, int reg, TCGv ea)
+static void gen_swap(DisasContext *ctx, int reg, TCGv_i32 ea)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
 
     tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_qemu_st_i32(cpu_gpr_d[reg], ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_mov_i32(cpu_gpr_d[reg], temp);
 }
 
-static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
+static void gen_cmpswap(DisasContext *ctx, int reg, TCGv_i32 ea)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     CHECK_REG_PAIR(reg);
     tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_movcond_i32(TCG_COND_EQ, temp2, cpu_gpr_d[reg + 1], temp,
@@ -320,11 +324,11 @@ static void gen_cmpswap(DisasContext *ctx, int reg, TCGv ea)
     tcg_gen_mov_i32(cpu_gpr_d[reg], temp);
 }
 
-static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
+static void gen_swapmsk(DisasContext *ctx, int reg, TCGv_i32 ea)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     CHECK_REG_PAIR(reg);
     tcg_gen_qemu_ld_i32(temp, ea, ctx->mem_idx, MO_LEUL);
     tcg_gen_and_i32(temp2, cpu_gpr_d[reg], cpu_gpr_d[reg + 1]);
@@ -346,7 +350,7 @@ static void gen_swapmsk(DisasContext *ctx, int reg, TCGv ea)
         break;
 #define A(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)
 #define E(ADDRESS, REG, FEATURE) R(ADDRESS, REG, FEATURE)
-static void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
+static void gen_mfcr(DisasContext *ctx, TCGv_i32 ret, int32_t offset)
 {
     /* since we're caching PSW make this a special case */
     if (offset == 0xfe04) {
@@ -374,7 +378,7 @@ static void gen_mfcr(DisasContext *ctx, TCGv ret, int32_t offset)
          watchdog device, we handle endinit protected registers like
          all-access registers for now. */
 #define E(ADDRESS, REG, FEATURE) A(ADDRESS, REG, FEATURE)
-static void gen_mtcr(DisasContext *ctx, TCGv r1, int32_t offset)
+static void gen_mtcr(DisasContext *ctx, TCGv_i32 r1, int32_t offset)
 {
     if (ctx->priv == TRICORE_PRIV_SM) {
         /* since we're caching PSW make this a special case */
@@ -393,10 +397,10 @@ static void gen_mtcr(DisasContext *ctx, TCGv r1, int32_t offset)
 
 /* Functions for arithmetic instructions  */
 
-static void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
+static void gen_add_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv t0 = tcg_temp_new_i32();
-    TCGv result = tcg_temp_new_i32();
+    TCGv_i32 t0 = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
     /* Addition and set V/SV bits */
     tcg_gen_add_i32(result, r1, r2);
     /* calc V bit */
@@ -414,10 +418,9 @@ static void gen_add_d(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void
-gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
+static void gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     TCGv_i64 t0 = tcg_temp_new_i64();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 result = tcg_temp_new_i64();
@@ -440,15 +443,16 @@ gen_add64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_mov_i64(ret, result);
 }
 
-static void
-gen_addsub64_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-               TCGv r3, void(*op1)(TCGv, TCGv, TCGv),
-               void(*op2)(TCGv, TCGv, TCGv))
+static void gen_addsub64_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                           TCGv_i32 r1_low, TCGv_i32 r1_high,
+                           TCGv_i32 r2, TCGv_i32 r3,
+                           void(*op1)(TCGv_i32, TCGv_i32, TCGv_i32),
+                           void(*op2)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
-    TCGv temp4 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
+    TCGv_i32 temp4 = tcg_temp_new_i32();
 
     (*op1)(temp, r1_low, r2);
     /* calc V0 bit */
@@ -487,7 +491,7 @@ gen_addsub64_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
 }
 
 /* ret = r2 + (r1 * r3); */
-static void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
+static void gen_madd32_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -518,20 +522,19 @@ static void gen_madd32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_maddi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddi32_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_madd32_d(ret, r1, r2, temp);
 }
 
-static void
-gen_madd64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_madd64_d(TCGv_i32 ret_low, TCGv_i32 ret_high, TCGv_i32 r1,
+                         TCGv_i32 r2_low, TCGv_i32 r2_high, TCGv_i32 r3)
 {
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t4 = tcg_temp_new();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t4 = tcg_temp_new_i32();
 
     tcg_gen_muls2_i32(t1, t2, r1, r3);
     /* only the add can overflow */
@@ -552,9 +555,8 @@ gen_madd64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_mov_i32(ret_high, t4);
 }
 
-static void
-gen_maddu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              TCGv r3)
+static void gen_maddu64_d(TCGv_i32 ret_low, TCGv_i32 ret_high, TCGv_i32 r1,
+                          TCGv_i32 r2_low, TCGv_i32 r2_high, TCGv_i32 r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -582,29 +584,28 @@ gen_maddu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void
-gen_maddi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              int32_t con)
+static void gen_maddi64_d(TCGv_i32 ret_low, TCGv_i32 ret_high, TCGv_i32 r1,
+                          TCGv_i32 r2_low, TCGv_i32 r2_high, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_madd64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void
-gen_maddui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-               int32_t con)
+static void gen_maddui64_d(TCGv_i32 ret_low, TCGv_i32 ret_high, TCGv_i32 r1,
+                           TCGv_i32 r2_low, TCGv_i32 r2_high, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_maddu64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void
-gen_madd_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-           TCGv r3, uint32_t n, uint32_t mode)
+static void gen_madd_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                       TCGv_i32 r1_low, TCGv_i32 r1_high,
+                       TCGv_i32 r2, TCGv_i32 r3,
+                       uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -625,13 +626,14 @@ gen_madd_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_add_tl, tcg_gen_add_tl);
 }
 
-static void
-gen_maddsu_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-             TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsu_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1_low, TCGv_i32 r1_high,
+                         TCGv_i32 r2, TCGv_i32 r3,
+                         uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -652,11 +654,12 @@ gen_maddsu_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_sub_tl, tcg_gen_add_tl);
 }
 
-static void
-gen_maddsum_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-              TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsum_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     TCGv_i64 temp64_3 = tcg_temp_new_i64();
@@ -685,16 +688,17 @@ gen_maddsum_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_2);
 }
 
-static void gen_adds(TCGv ret, TCGv r1, TCGv r2);
+static void gen_adds(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2);
 
-static void
-gen_madds_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-           TCGv r3, uint32_t n, uint32_t mode)
+static void gen_madds_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                        TCGv_i32 r1_low, TCGv_i32 r1_high,
+                        TCGv_i32 r2, TCGv_i32 r3,
+                        uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
 
     switch (mode) {
@@ -722,16 +726,17 @@ gen_madds_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static void gen_subs(TCGv ret, TCGv r1, TCGv r2);
+static void gen_subs(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2);
 
-static void
-gen_maddsus_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-              TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsus_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
 
     switch (mode) {
@@ -759,11 +764,12 @@ gen_maddsus_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static void
-gen_maddsums_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-               TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsums_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                           TCGv_i32 r1_low, TCGv_i32 r1_high,
+                           TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
 
@@ -792,11 +798,12 @@ gen_maddsums_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
 }
 
 
-static void
-gen_maddm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-           TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddm_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                        TCGv_i32 r1_low, TCGv_i32 r1_high,
+                        TCGv_i32 r2, TCGv_i32 r3,
+                        uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     TCGv_i64 temp64_3 = tcg_temp_new_i64();
@@ -820,11 +827,12 @@ gen_maddm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_3);
 }
 
-static void
-gen_maddms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-           TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddms_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1_low, TCGv_i32 r1_high,
+                         TCGv_i32 r2, TCGv_i32 r3,
+                         uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     switch (mode) {
@@ -846,11 +854,11 @@ gen_maddms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_maddr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
-              uint32_t mode)
+static void gen_maddr64_h(TCGv_i32 ret, TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -869,23 +877,25 @@ gen_maddr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
     gen_helper_addr_h(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static void
-gen_maddr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddr32_h(TCGv_i32 ret,
+                          TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_andi_i32(temp2, r1, 0xffff0000);
     tcg_gen_shli_i32(temp, r1, 16);
     gen_maddr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static void
-gen_maddsur32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsur32_h(TCGv_i32 ret,
+                            TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                            uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -907,11 +917,11 @@ gen_maddsur32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
 }
 
 
-static void
-gen_maddr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
-               uint32_t n, uint32_t mode)
+static void gen_maddr64s_h(TCGv_i32 ret, TCGv_i32 r1_low, TCGv_i32 r1_high,
+                           TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -930,23 +940,25 @@ gen_maddr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
     gen_helper_addr_h_ssov(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static void
-gen_maddr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddr32s_h(TCGv_i32 ret,
+                           TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_andi_i32(temp2, r1, 0xffff0000);
     tcg_gen_shli_i32(temp, r1, 16);
     gen_maddr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static void
-gen_maddsur32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_maddsur32s_h(TCGv_i32 ret,
+                             TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                             uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -967,27 +979,27 @@ gen_maddsur32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_addsur_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
-static void
-gen_maddr_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
+static void gen_maddr_q(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                        uint32_t n)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     gen_helper_maddr_q(ret, tcg_env, r1, r2, r3, t_n);
 }
 
-static void
-gen_maddrs_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
+static void gen_maddrs_q(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                         uint32_t n)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     gen_helper_maddr_q_ssov(ret, tcg_env, r1, r2, r3, t_n);
 }
 
-static void
-gen_madd32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
-             uint32_t up_shift)
+static void gen_madd32_q(TCGv_i32 ret,
+                         TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                         uint32_t n, uint32_t up_shift)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
@@ -1031,11 +1043,12 @@ gen_madd32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_mov_i32(ret, temp3);
 }
 
-static void
-gen_m16add32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
+static void gen_m16add32_q(TCGv_i32 ret,
+                           TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                           uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
@@ -1048,11 +1061,12 @@ gen_m16add32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_add_d(ret, arg1, temp);
 }
 
-static void
-gen_m16adds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
+static void gen_m16adds32_q(TCGv_i32 ret,
+                            TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                            uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
@@ -1065,12 +1079,12 @@ gen_m16adds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_adds(ret, arg1, temp);
 }
 
-static void
-gen_m16add64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-               TCGv arg3, uint32_t n)
+static void gen_m16add64_q(TCGv_i32 rl, TCGv_i32 rh,
+                           TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                           TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
@@ -1092,12 +1106,12 @@ gen_m16add64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t3);
 }
 
-static void
-gen_m16adds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-               TCGv arg3, uint32_t n)
+static void gen_m16adds64_q(TCGv_i32 rl, TCGv_i32 rh,
+                            TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                            TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
@@ -1118,15 +1132,15 @@ gen_m16adds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t1);
 }
 
-static void
-gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-             TCGv arg3, uint32_t n)
+static void gen_madd64_q(TCGv_i32 rl, TCGv_i32 rh,
+                         TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                         TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
     TCGv_i64 t4 = tcg_temp_new_i64();
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     tcg_gen_concat_i32_i64(t1, arg1_low, arg1_high);
     tcg_gen_ext_i32_i64(t2, arg2);
@@ -1146,8 +1160,8 @@ gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
        (0x80000000 * 0x80000000) << 1). If this is the
        case, we negate the ovf. */
     if (n == 1) {
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
         tcg_gen_setcondi_i32(TCG_COND_EQ, temp, arg2, 0x80000000);
         tcg_gen_setcond_i32(TCG_COND_EQ, temp2, arg2, arg3);
         tcg_gen_and_i32(temp, temp, temp2);
@@ -1166,9 +1180,9 @@ gen_madd64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void
-gen_madds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
-              uint32_t up_shift)
+static void gen_madds32_q(TCGv_i32 ret,
+                          TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                          uint32_t n, uint32_t up_shift)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -1184,12 +1198,12 @@ gen_madds32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     gen_helper_madd32_q_add_ssov(ret, tcg_env, t1, t2);
 }
 
-static void
-gen_madds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-             TCGv arg3, uint32_t n)
+static void gen_madds64_q(TCGv_i32 rl, TCGv_i32 rh,
+                          TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                          TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
     TCGv_i64 r1 = tcg_temp_new_i64();
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
 
     tcg_gen_concat_i32_i64(r1, arg1_low, arg1_high);
     gen_helper_madd64_q_ssov(r1, tcg_env, r1, arg2, arg3, t_n);
@@ -1197,7 +1211,7 @@ gen_madds64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
 }
 
 /* ret = r2 - (r1 * r3); */
-static void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
+static void gen_msub32_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -1229,20 +1243,20 @@ static void gen_msub32_d(TCGv ret, TCGv r1, TCGv r2, TCGv r3)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_msubi32_d(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubi32_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_msub32_d(ret, r1, r2, temp);
 }
 
-static void
-gen_msub64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_msub64_d(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                         TCGv_i32 r3)
 {
-    TCGv t1 = tcg_temp_new();
-    TCGv t2 = tcg_temp_new();
-    TCGv t3 = tcg_temp_new();
-    TCGv t4 = tcg_temp_new();
+    TCGv_i32 t1 = tcg_temp_new_i32();
+    TCGv_i32 t2 = tcg_temp_new_i32();
+    TCGv_i32 t3 = tcg_temp_new_i32();
+    TCGv_i32 t4 = tcg_temp_new_i32();
 
     tcg_gen_muls2_i32(t1, t2, r1, r3);
     /* only the sub can overflow */
@@ -1263,17 +1277,16 @@ gen_msub64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_mov_i32(ret_high, t4);
 }
 
-static void
-gen_msubi64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              int32_t con)
+static void gen_msubi64_d(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                          int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_msub64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void
-gen_msubu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              TCGv r3)
+static void gen_msubu64_d(TCGv_i32 ret_low, TCGv_i32 ret_high, TCGv_i32 r1,
+                          TCGv_i32 r2_low, TCGv_i32 r2_high, TCGv_i32 r3)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -1299,25 +1312,25 @@ gen_msubu64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void
-gen_msubui64_d(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-               int32_t con)
+static void gen_msubui64_d(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                           TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                           int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_msubu64_d(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void gen_addi_d(TCGv ret, TCGv r1, int32_t r2)
+static void gen_addi_d(TCGv_i32 ret, TCGv_i32 r1, int32_t r2)
 {
-    TCGv temp = tcg_constant_i32(r2);
+    TCGv_i32 temp = tcg_constant_i32(r2);
     gen_add_d(ret, r1, temp);
 }
 
 /* calculate the carry bit too */
-static void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_add_CC(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv t0    = tcg_temp_new_i32();
-    TCGv result = tcg_temp_new_i32();
+    TCGv_i32 t0    = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
 
     tcg_gen_movi_i32(t0, 0);
     /* Addition and set C/V/SV bits */
@@ -1337,16 +1350,16 @@ static void gen_add_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void gen_addi_CC(TCGv ret, TCGv r1, int32_t con)
+static void gen_addi_CC(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_add_CC(ret, r1, temp);
 }
 
-static void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_addc_CC(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv t0     = tcg_temp_new_i32();
-    TCGv result = tcg_temp_new_i32();
+    TCGv_i32 t0     = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
 
     /* Addition, carry and set C/V/SV bits */
     tcg_gen_addcio_i32(result, cpu_PSW_C, r1, r2, cpu_PSW_C);
@@ -1365,19 +1378,20 @@ static void gen_addc_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void gen_addci_CC(TCGv ret, TCGv r1, int32_t con)
+static void gen_addci_CC(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_addc_CC(ret, r1, temp);
 }
 
-static void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
+static void gen_cond_add(TCGCond cond,
+                         TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3, TCGv_i32 r4)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv result = tcg_temp_new();
-    TCGv mask = tcg_temp_new();
-    TCGv t0 = tcg_constant_i32(0);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
+    TCGv_i32 mask = tcg_temp_new_i32();
+    TCGv_i32 t0 = tcg_constant_i32(0);
 
     /* create mask for sticky bits */
     tcg_gen_setcond_i32(cond, mask, r4, t0);
@@ -1403,16 +1417,17 @@ static void gen_cond_add(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
     tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
-static void gen_condi_add(TCGCond cond, TCGv r1, int32_t r2, TCGv r3, TCGv r4)
+static void gen_condi_add(TCGCond cond,
+                          TCGv_i32 r1, int32_t r2, TCGv_i32 r3, TCGv_i32 r4)
 {
-    TCGv temp = tcg_constant_i32(r2);
+    TCGv_i32 temp = tcg_constant_i32(r2);
     gen_cond_add(cond, r1, temp, r3, r4);
 }
 
-static void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
+static void gen_sub_d(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv temp = tcg_temp_new_i32();
-    TCGv result = tcg_temp_new_i32();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
 
     tcg_gen_sub_i32(result, r1, r2);
     /* calc V bit */
@@ -1430,10 +1445,9 @@ static void gen_sub_d(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void
-gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
+static void gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     TCGv_i64 t0 = tcg_temp_new_i64();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 result = tcg_temp_new_i64();
@@ -1456,10 +1470,10 @@ gen_sub64_d(TCGv_i64 ret, TCGv_i64 r1, TCGv_i64 r2)
     tcg_gen_mov_i64(ret, result);
 }
 
-static void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_sub_CC(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv result = tcg_temp_new();
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 result = tcg_temp_new_i32();
+    TCGv_i32 temp = tcg_temp_new_i32();
 
     tcg_gen_sub_i32(result, r1, r2);
     /* calc C bit */
@@ -1479,20 +1493,21 @@ static void gen_sub_CC(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void gen_subc_CC(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subc_CC(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     tcg_gen_not_i32(temp, r2);
     gen_addc_CC(ret, r1, temp);
 }
 
-static void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
+static void gen_cond_sub(TCGCond cond,
+                         TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3, TCGv_i32 r4)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv result = tcg_temp_new();
-    TCGv mask = tcg_temp_new();
-    TCGv t0 = tcg_constant_i32(0);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
+    TCGv_i32 mask = tcg_temp_new_i32();
+    TCGv_i32 t0 = tcg_constant_i32(0);
 
     /* create mask for sticky bits */
     tcg_gen_setcond_i32(cond, mask, r4, t0);
@@ -1518,13 +1533,14 @@ static void gen_cond_sub(TCGCond cond, TCGv r1, TCGv r2, TCGv r3, TCGv r4)
     tcg_gen_movcond_i32(cond, r3, r4, t0, result, r1);
 }
 
-static void
-gen_msub_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-           TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msub_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                       TCGv_i32 r1_low, TCGv_i32 r1_high,
+                       TCGv_i32 r2, TCGv_i32 r3,
+                       uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -1545,14 +1561,15 @@ gen_msub_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_sub_tl, tcg_gen_sub_tl);
 }
 
-static void
-gen_msubs_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-            TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubs_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                        TCGv_i32 r1_low, TCGv_i32 r1_high,
+                        TCGv_i32 r2, TCGv_i32 r3,
+                        uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
 
     switch (mode) {
@@ -1580,11 +1597,12 @@ gen_msubs_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static void
-gen_msubm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-            TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubm_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                        TCGv_i32 r1_low, TCGv_i32 r1_high,
+                        TCGv_i32 r2, TCGv_i32 r3,
+                        uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     TCGv_i64 temp64_3 = tcg_temp_new_i64();
@@ -1608,11 +1626,12 @@ gen_msubm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_3);
 }
 
-static void
-gen_msubms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-             TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubms_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1_low, TCGv_i32 r1_high,
+                         TCGv_i32 r2, TCGv_i32 r3,
+                         uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     switch (mode) {
@@ -1634,11 +1653,12 @@ gen_msubms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_msubr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
-              uint32_t mode)
+static void gen_msubr64_h(TCGv_i32 ret,
+                          TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -1657,22 +1677,24 @@ gen_msubr64_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3, uint32_t n,
     gen_helper_subr_h(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static void
-gen_msubr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubr32_h(TCGv_i32 ret,
+                          TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_andi_i32(temp2, r1, 0xffff0000);
     tcg_gen_shli_i32(temp, r1, 16);
     gen_msubr64_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static void
-gen_msubr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
-               uint32_t n, uint32_t mode)
+static void gen_msubr64s_h(TCGv_i32 ret,
+                           TCGv_i32 r1_low, TCGv_i32 r1_high,
+                           TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -1691,36 +1713,37 @@ gen_msubr64s_h(TCGv ret, TCGv r1_low, TCGv r1_high, TCGv r2, TCGv r3,
     gen_helper_subr_h_ssov(ret, tcg_env, temp64, r1_low, r1_high);
 }
 
-static void
-gen_msubr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubr32s_h(TCGv_i32 ret,
+                           TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_andi_i32(temp2, r1, 0xffff0000);
     tcg_gen_shli_i32(temp, r1, 16);
     gen_msubr64s_h(ret, temp, temp2, r2, r3, n, mode);
 }
 
-static void
-gen_msubr_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
+static void gen_msubr_q(TCGv_i32 ret,
+                        TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3, uint32_t n)
 {
-    TCGv temp = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_constant_i32(n);
     gen_helper_msubr_q(ret, tcg_env, r1, r2, r3, temp);
 }
 
-static void
-gen_msubrs_q(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n)
+static void gen_msubrs_q(TCGv_i32 ret,
+                         TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3, uint32_t n)
 {
-    TCGv temp = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_constant_i32(n);
     gen_helper_msubr_q_ssov(ret, tcg_env, r1, r2, r3, temp);
 }
 
-static void
-gen_msub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
-             uint32_t up_shift)
+static void gen_msub32_q(TCGv_i32 ret,
+                         TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                         uint32_t n, uint32_t up_shift)
 {
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
@@ -1757,11 +1780,12 @@ gen_msub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     tcg_gen_mov_i32(ret, temp3);
 }
 
-static void
-gen_m16sub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
+static void gen_m16sub32_q(TCGv_i32 ret,
+                           TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                           uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
@@ -1774,11 +1798,12 @@ gen_m16sub32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_sub_d(ret, arg1, temp);
 }
 
-static void
-gen_m16subs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
+static void gen_m16subs32_q(TCGv_i32 ret,
+                            TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                            uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(temp, arg2, arg3);
     } else { /* n is expected to be 1 */
@@ -1791,12 +1816,12 @@ gen_m16subs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n)
     gen_subs(ret, arg1, temp);
 }
 
-static void
-gen_m16sub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-               TCGv arg3, uint32_t n)
+static void gen_m16sub64_q(TCGv_i32 rl, TCGv_i32 rh,
+                           TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                           TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
@@ -1818,12 +1843,12 @@ gen_m16sub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t3);
 }
 
-static void
-gen_m16subs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-               TCGv arg3, uint32_t n)
+static void gen_m16subs64_q(TCGv_i32 rl, TCGv_i32 rh,
+                            TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                            TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
 
@@ -1844,15 +1869,15 @@ gen_m16subs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_extr_i64_i32(rl, rh, t1);
 }
 
-static void
-gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-             TCGv arg3, uint32_t n)
+static void gen_msub64_q(TCGv_i32 rl, TCGv_i32 rh,
+                         TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                         TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
     TCGv_i64 t3 = tcg_temp_new_i64();
     TCGv_i64 t4 = tcg_temp_new_i64();
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     tcg_gen_concat_i32_i64(t1, arg1_low, arg1_high);
     tcg_gen_ext_i32_i64(t2, arg2);
@@ -1872,8 +1897,8 @@ gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
        (0x80000000 * 0x80000000) << 1). If this is the
        case, we negate the ovf. */
     if (n == 1) {
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
         tcg_gen_setcondi_i32(TCG_COND_EQ, temp, arg2, 0x80000000);
         tcg_gen_setcond_i32(TCG_COND_EQ, temp2, arg2, arg3);
         tcg_gen_and_i32(temp, temp, temp2);
@@ -1892,9 +1917,9 @@ gen_msub64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void
-gen_msubs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
-              uint32_t up_shift)
+static void gen_msubs32_q(TCGv_i32 ret,
+                          TCGv_i32 arg1, TCGv_i32 arg2, TCGv_i32 arg3,
+                          uint32_t n, uint32_t up_shift)
 {
     TCGv_i64 t1 = tcg_temp_new_i64();
     TCGv_i64 t2 = tcg_temp_new_i64();
@@ -1915,25 +1940,26 @@ gen_msubs32_q(TCGv ret, TCGv arg1, TCGv arg2, TCGv arg3, uint32_t n,
     gen_helper_msub32_q_sub_ssov(ret, tcg_env, t1, t3);
 }
 
-static void
-gen_msubs64_q(TCGv rl, TCGv rh, TCGv arg1_low, TCGv arg1_high, TCGv arg2,
-             TCGv arg3, uint32_t n)
+static void gen_msubs64_q(TCGv_i32 rl, TCGv_i32 rh,
+                          TCGv_i32 arg1_low, TCGv_i32 arg1_high,
+                          TCGv_i32 arg2, TCGv_i32 arg3, uint32_t n)
 {
     TCGv_i64 r1 = tcg_temp_new_i64();
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
 
     tcg_gen_concat_i32_i64(r1, arg1_low, arg1_high);
     gen_helper_msub64_q_ssov(r1, tcg_env, r1, arg2, arg3, t_n);
     tcg_gen_extr_i64_i32(rl, rh, r1);
 }
 
-static void
-gen_msubad_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-             TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubad_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1_low, TCGv_i32 r1_high,
+                         TCGv_i32 r2, TCGv_i32 r3,
+                         uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -1954,11 +1980,12 @@ gen_msubad_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
                    tcg_gen_add_tl, tcg_gen_sub_tl);
 }
 
-static void
-gen_msubadm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-              TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubadm_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
     TCGv_i64 temp64_3 = tcg_temp_new_i64();
@@ -1987,12 +2014,13 @@ gen_msubadm_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64_2);
 }
 
-static void
-gen_msubadr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubadr32_h(TCGv_i32 ret,
+                            TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                            uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -2013,14 +2041,15 @@ gen_msubadr32_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_subadr_h(ret, tcg_env, temp64, temp, temp2);
 }
 
-static void
-gen_msubads_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-              TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubads_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1_low, TCGv_i32 r1_high,
+                          TCGv_i32 r2, TCGv_i32 r3,
+                          uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
-    TCGv temp3 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
+    TCGv_i32 temp3 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
 
     switch (mode) {
@@ -2048,11 +2077,12 @@ gen_msubads_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_or_i32(cpu_PSW_AV, cpu_PSW_AV, temp3);
 }
 
-static void
-gen_msubadms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
-               TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubadms_h(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                           TCGv_i32 r1_low, TCGv_i32 r1_high,
+                           TCGv_i32 r2, TCGv_i32 r3,
+                           uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
+    TCGv_i32 t_n = tcg_constant_i32(n);
     TCGv_i64 temp64 = tcg_temp_new_i64();
     TCGv_i64 temp64_2 = tcg_temp_new_i64();
 
@@ -2080,12 +2110,13 @@ gen_msubadms_h(TCGv ret_low, TCGv ret_high, TCGv r1_low, TCGv r1_high, TCGv r2,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_msubadr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
+static void gen_msubadr32s_h(TCGv_i32 ret,
+                             TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 r3,
+                             uint32_t n, uint32_t mode)
 {
-    TCGv t_n = tcg_constant_i32(n);
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 t_n = tcg_constant_i32(n);
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     TCGv_i64 temp64 = tcg_temp_new_i64();
     switch (mode) {
     case MODE_LL:
@@ -2106,7 +2137,7 @@ gen_msubadr32s_h(TCGv ret, TCGv r1, TCGv r2, TCGv r3, uint32_t n, uint32_t mode)
     gen_helper_subadr_h_ssov(ret, tcg_env, temp64, temp, temp2);
 }
 
-static void gen_abs(TCGv ret, TCGv r1)
+static void gen_abs(TCGv_i32 ret, TCGv_i32 r1)
 {
     tcg_gen_abs_i32(ret, r1);
     /* overflow can only happen, if r1 = 0x80000000 */
@@ -2121,10 +2152,10 @@ static void gen_abs(TCGv ret, TCGv r1)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
+static void gen_absdif(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv temp = tcg_temp_new_i32();
-    TCGv result = tcg_temp_new_i32();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 result = tcg_temp_new_i32();
 
     tcg_gen_sub_i32(result, r1, r2);
     tcg_gen_sub_i32(temp, r2, r1);
@@ -2147,22 +2178,22 @@ static void gen_absdif(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_mov_i32(ret, result);
 }
 
-static void gen_absdifi(TCGv ret, TCGv r1, int32_t con)
+static void gen_absdifi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_absdif(ret, r1, temp);
 }
 
-static void gen_absdifsi(TCGv ret, TCGv r1, int32_t con)
+static void gen_absdifsi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_absdif_ssov(ret, tcg_env, r1, temp);
 }
 
-static void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
+static void gen_mul_i32s(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv high = tcg_temp_new();
-    TCGv low = tcg_temp_new();
+    TCGv_i32 high = tcg_temp_new_i32();
+    TCGv_i32 low = tcg_temp_new_i32();
 
     tcg_gen_muls2_i32(low, high, r1, r2);
     tcg_gen_mov_i32(ret, low);
@@ -2179,13 +2210,14 @@ static void gen_mul_i32s(TCGv ret, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_muli_i32s(TCGv ret, TCGv r1, int32_t con)
+static void gen_muli_i32s(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_mul_i32s(ret, r1, temp);
 }
 
-static void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
+static void gen_mul_i64s(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1, TCGv_i32 r2)
 {
     tcg_gen_muls2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
@@ -2199,14 +2231,15 @@ static void gen_mul_i64s(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_muli_i64s(TCGv ret_low, TCGv ret_high, TCGv r1,
-                                int32_t con)
+static void gen_muli_i64s(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_mul_i64s(ret_low, ret_high, r1, temp);
 }
 
-static void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
+static void gen_mul_i64u(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1, TCGv_i32 r2)
 {
     tcg_gen_mulu2_i32(ret_low, ret_high, r1, r2);
     /* clear V bit */
@@ -2220,40 +2253,40 @@ static void gen_mul_i64u(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_muli_i64u(TCGv ret_low, TCGv ret_high, TCGv r1,
-                                int32_t con)
+static void gen_muli_i64u(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_mul_i64u(ret_low, ret_high, r1, temp);
 }
 
-static void gen_mulsi_i32(TCGv ret, TCGv r1, int32_t con)
+static void gen_mulsi_i32(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_mul_ssov(ret, tcg_env, r1, temp);
 }
 
-static void gen_mulsui_i32(TCGv ret, TCGv r1, int32_t con)
+static void gen_mulsui_i32(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_mul_suov(ret, tcg_env, r1, temp);
 }
 
 /* gen_maddsi_32(cpu_gpr_d[r4], cpu_gpr_d[r1], cpu_gpr_d[r3], const9); */
-static void gen_maddsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddsi_32(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_madd32_ssov(ret, tcg_env, r1, r2, temp);
 }
 
-static void gen_maddsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_maddsui_32(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_madd32_suov(ret, tcg_env, r1, r2, temp);
 }
 
-static void
-gen_mul_q(TCGv rl, TCGv rh, TCGv arg1, TCGv arg2, uint32_t n, uint32_t up_shift)
+static void gen_mul_q(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 arg1, TCGv_i32 arg2,
+                      uint32_t n, uint32_t up_shift)
 {
     TCGv_i64 temp_64 = tcg_temp_new_i64();
     TCGv_i64 temp2_64 = tcg_temp_new_i64();
@@ -2309,10 +2342,9 @@ gen_mul_q(TCGv rl, TCGv rh, TCGv arg1, TCGv arg2, uint32_t n, uint32_t up_shift)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void
-gen_mul_q_16(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
+static void gen_mul_q_16(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(ret, arg1, arg2);
     } else { /* n is expected to be 1 */
@@ -2331,9 +2363,9 @@ gen_mul_q_16(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_mulr_q(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
+static void gen_mulr_q(TCGv_i32 ret, TCGv_i32 arg1, TCGv_i32 arg2, uint32_t n)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     if (n == 0) {
         tcg_gen_mul_i32(ret, arg1, arg2);
         tcg_gen_addi_i32(ret, ret, 0x8000);
@@ -2357,9 +2389,9 @@ static void gen_mulr_q(TCGv ret, TCGv arg1, TCGv arg2, uint32_t n)
     tcg_gen_andi_i32(ret, ret, 0xffff0000);
 }
 
-static void
-gen_madds_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_madds_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                         TCGv_i32 r3)
 {
     TCGv_i64 temp64 = tcg_temp_new_i64();
     tcg_gen_concat_i32_i64(temp64, r2_low, r2_high);
@@ -2367,17 +2399,17 @@ gen_madds_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_maddsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              int32_t con)
+static void gen_maddsi_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                          int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_madds_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void
-gen_maddsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_maddsu_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                          TCGv_i32 r3)
 {
     TCGv_i64 temp64 = tcg_temp_new_i64();
     tcg_gen_concat_i32_i64(temp64, r2_low, r2_high);
@@ -2385,29 +2417,29 @@ gen_maddsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_maddsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-               int32_t con)
+static void gen_maddsui_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low,
+                          TCGv_i32 r2_high, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_maddsu_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void gen_msubsi_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubsi_32(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_msub32_ssov(ret, tcg_env, r1, r2, temp);
 }
 
-static void gen_msubsui_32(TCGv ret, TCGv r1, TCGv r2, int32_t con)
+static void gen_msubsui_32(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_msub32_suov(ret, tcg_env, r1, r2, temp);
 }
 
-static void
-gen_msubs_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_msubs_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                         TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                         TCGv_i32 r3)
 {
     TCGv_i64 temp64 = tcg_temp_new_i64();
     tcg_gen_concat_i32_i64(temp64, r2_low, r2_high);
@@ -2415,17 +2447,17 @@ gen_msubs_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_msubsi_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-              int32_t con)
+static void gen_msubsi_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                          int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_msubs_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void
-gen_msubsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-             TCGv r3)
+static void gen_msubsu_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                          TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                          TCGv_i32 r3)
 {
     TCGv_i64 temp64 = tcg_temp_new_i64();
     tcg_gen_concat_i32_i64(temp64, r2_low, r2_high);
@@ -2433,26 +2465,26 @@ gen_msubsu_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
     tcg_gen_extr_i64_i32(ret_low, ret_high, temp64);
 }
 
-static void
-gen_msubsui_64(TCGv ret_low, TCGv ret_high, TCGv r1, TCGv r2_low, TCGv r2_high,
-               int32_t con)
+static void gen_msubsui_64(TCGv_i32 ret_low, TCGv_i32 ret_high,
+                           TCGv_i32 r1, TCGv_i32 r2_low, TCGv_i32 r2_high,
+                           int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_msubsu_64(ret_low, ret_high, r1, r2_low, r2_high, temp);
 }
 
-static void gen_saturate(TCGv ret, TCGv arg, int32_t up, int32_t low)
+static void gen_saturate(TCGv_i32 ret, TCGv_i32 arg, int32_t up, int32_t low)
 {
     tcg_gen_smax_i32(ret, arg, tcg_constant_i32(low));
     tcg_gen_smin_i32(ret, ret, tcg_constant_i32(up));
 }
 
-static void gen_saturate_u(TCGv ret, TCGv arg, int32_t up)
+static void gen_saturate_u(TCGv_i32 ret, TCGv_i32 arg, int32_t up)
 {
     tcg_gen_umin_i32(ret, arg, tcg_constant_i32(up));
 }
 
-static void gen_shi(TCGv ret, TCGv r1, int32_t shift_count)
+static void gen_shi(TCGv_i32 ret, TCGv_i32 r1, int32_t shift_count)
 {
     if (shift_count == -32) {
         tcg_gen_movi_i32(ret, 0);
@@ -2463,15 +2495,15 @@ static void gen_shi(TCGv ret, TCGv r1, int32_t shift_count)
     }
 }
 
-static void gen_sh_hi(TCGv ret, TCGv r1, int32_t shiftcount)
+static void gen_sh_hi(TCGv_i32 ret, TCGv_i32 r1, int32_t shiftcount)
 {
-    TCGv temp_low, temp_high;
+    TCGv_i32 temp_low, temp_high;
 
     if (shiftcount == -16) {
         tcg_gen_movi_i32(ret, 0);
     } else {
-        temp_high = tcg_temp_new();
-        temp_low = tcg_temp_new();
+        temp_high = tcg_temp_new_i32();
+        temp_low = tcg_temp_new_i32();
 
         tcg_gen_andi_i32(temp_low, r1, 0xffff);
         tcg_gen_andi_i32(temp_high, r1, 0xffff0000);
@@ -2481,11 +2513,11 @@ static void gen_sh_hi(TCGv ret, TCGv r1, int32_t shiftcount)
     }
 }
 
-static void gen_shaci(TCGv ret, TCGv r1, int32_t shift_count)
+static void gen_shaci(TCGv_i32 ret, TCGv_i32 r1, int32_t shift_count)
 {
     uint32_t msk, msk_start;
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     if (shift_count == 0) {
         /* Clear PSW.C and PSW.V */
@@ -2500,8 +2532,8 @@ static void gen_shaci(TCGv ret, TCGv r1, int32_t shift_count)
         /* clear PSW.V */
         tcg_gen_movi_i32(cpu_PSW_V, 0);
     } else if (shift_count > 0) {
-        TCGv t_max = tcg_constant_i32(0x7FFFFFFF >> shift_count);
-        TCGv t_min = tcg_constant_i32(((int32_t) -0x80000000) >> shift_count);
+        TCGv_i32 t_max = tcg_constant_i32(0x7FFFFFFF >> shift_count);
+        TCGv_i32 t_min = tcg_constant_i32(((int32_t) -0x80000000) >> shift_count);
 
         /* calc carry */
         msk_start = 32 - shift_count;
@@ -2532,34 +2564,34 @@ static void gen_shaci(TCGv ret, TCGv r1, int32_t shift_count)
     tcg_gen_or_i32(cpu_PSW_SAV, cpu_PSW_SAV, cpu_PSW_AV);
 }
 
-static void gen_shas(TCGv ret, TCGv r1, TCGv r2)
+static void gen_shas(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
     gen_helper_sha_ssov(ret, tcg_env, r1, r2);
 }
 
-static void gen_shasi(TCGv ret, TCGv r1, int32_t con)
+static void gen_shasi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_shas(ret, r1, temp);
 }
 
-static void gen_sha_hi(TCGv ret, TCGv r1, int32_t shift_count)
+static void gen_sha_hi(TCGv_i32 ret, TCGv_i32 r1, int32_t shift_count)
 {
-    TCGv low, high;
+    TCGv_i32 low, high;
 
     if (shift_count == 0) {
         tcg_gen_mov_i32(ret, r1);
     } else if (shift_count > 0) {
-        low = tcg_temp_new();
-        high = tcg_temp_new();
+        low = tcg_temp_new_i32();
+        high = tcg_temp_new_i32();
 
         tcg_gen_andi_i32(high, r1, 0xffff0000);
         tcg_gen_shli_i32(low, r1, shift_count);
         tcg_gen_shli_i32(ret, high, shift_count);
         tcg_gen_deposit_i32(ret, ret, low, 0, 16);
     } else {
-        low = tcg_temp_new();
-        high = tcg_temp_new();
+        low = tcg_temp_new_i32();
+        high = tcg_temp_new_i32();
 
         tcg_gen_ext16s_i32(low, r1);
         tcg_gen_sari_i32(low, low, -shift_count);
@@ -2569,58 +2601,58 @@ static void gen_sha_hi(TCGv ret, TCGv r1, int32_t shift_count)
 }
 
 /* ret = {ret[30:0], (r1 cond r2)}; */
-static void gen_sh_cond(int cond, TCGv ret, TCGv r1, TCGv r2)
+static void gen_sh_cond(int cond, TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_shli_i32(temp, ret, 1);
     tcg_gen_setcond_i32(cond, temp2, r1, r2);
     tcg_gen_or_i32(ret, temp, temp2);
 }
 
-static void gen_sh_condi(int cond, TCGv ret, TCGv r1, int32_t con)
+static void gen_sh_condi(int cond, TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_sh_cond(cond, ret, r1, temp);
 }
 
-static void gen_adds(TCGv ret, TCGv r1, TCGv r2)
+static void gen_adds(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
     gen_helper_add_ssov(ret, tcg_env, r1, r2);
 }
 
-static void gen_addsi(TCGv ret, TCGv r1, int32_t con)
+static void gen_addsi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_add_ssov(ret, tcg_env, r1, temp);
 }
 
-static void gen_addsui(TCGv ret, TCGv r1, int32_t con)
+static void gen_addsui(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_helper_add_suov(ret, tcg_env, r1, temp);
 }
 
-static void gen_subs(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subs(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
     gen_helper_sub_ssov(ret, tcg_env, r1, r2);
 }
 
-static void gen_subsu(TCGv ret, TCGv r1, TCGv r2)
+static void gen_subsu(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2)
 {
     gen_helper_sub_suov(ret, tcg_env, r1, r2);
 }
 
-static void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
+static void gen_bit_2op(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2,
                         int pos1, int pos2,
-                        void(*op1)(TCGv, TCGv, TCGv),
-                        void(*op2)(TCGv, TCGv, TCGv))
+                        void(*op1)(TCGv_i32, TCGv_i32, TCGv_i32),
+                        void(*op2)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
-    TCGv temp1, temp2;
+    TCGv_i32 temp1, temp2;
 
-    temp1 = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp1 = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     tcg_gen_shri_i32(temp2, r2, pos2);
     tcg_gen_shri_i32(temp1, r1, pos1);
@@ -2632,14 +2664,14 @@ static void gen_bit_2op(TCGv ret, TCGv r1, TCGv r2,
 }
 
 /* ret = r1[pos1] op1 r2[pos2]; */
-static void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
+static void gen_bit_1op(TCGv_i32 ret, TCGv_i32 r1, TCGv_i32 r2,
                         int pos1, int pos2,
-                        void(*op1)(TCGv, TCGv, TCGv))
+                        void(*op1)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
-    TCGv temp1, temp2;
+    TCGv_i32 temp1, temp2;
 
-    temp1 = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp1 = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     tcg_gen_shri_i32(temp2, r2, pos2);
     tcg_gen_shri_i32(temp1, r1, pos1);
@@ -2649,11 +2681,12 @@ static void gen_bit_1op(TCGv ret, TCGv r1, TCGv r2,
     tcg_gen_andi_i32(ret, ret, 0x1);
 }
 
-static void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
-                                  void(*op)(TCGv, TCGv, TCGv))
+static void gen_accumulating_cond(int cond, TCGv_i32 ret,
+                                  TCGv_i32 r1, TCGv_i32 r2,
+                                  void(*op)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
     /* temp = (arg1 cond arg2 )*/
     tcg_gen_setcond_i32(cond, temp, r1, r2);
     /* temp2 = ret[0]*/
@@ -2664,20 +2697,20 @@ static void gen_accumulating_cond(int cond, TCGv ret, TCGv r1, TCGv r2,
     tcg_gen_deposit_i32(ret, ret, temp, 0, 1);
 }
 
-static void
-gen_accumulating_condi(int cond, TCGv ret, TCGv r1, int32_t con,
-                       void(*op)(TCGv, TCGv, TCGv))
+static void gen_accumulating_condi(int cond, TCGv_i32 ret, TCGv_i32 r1,
+                                   int32_t con,
+                                   void(*op)(TCGv_i32, TCGv_i32, TCGv_i32))
 {
-    TCGv temp = tcg_constant_i32(con);
+    TCGv_i32 temp = tcg_constant_i32(con);
     gen_accumulating_cond(cond, ret, r1, temp, op);
 }
 
-static void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
+static void gen_eqany_bi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv b0 = tcg_temp_new();
-    TCGv b1 = tcg_temp_new();
-    TCGv b2 = tcg_temp_new();
-    TCGv b3 = tcg_temp_new();
+    TCGv_i32 b0 = tcg_temp_new_i32();
+    TCGv_i32 b1 = tcg_temp_new_i32();
+    TCGv_i32 b2 = tcg_temp_new_i32();
+    TCGv_i32 b3 = tcg_temp_new_i32();
 
     /* byte 0 */
     tcg_gen_andi_i32(b0, r1, 0xff);
@@ -2701,10 +2734,10 @@ static void gen_eqany_bi(TCGv ret, TCGv r1, int32_t con)
     tcg_gen_or_i32(ret, ret, b3);
 }
 
-static void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
+static void gen_eqany_hi(TCGv_i32 ret, TCGv_i32 r1, int32_t con)
 {
-    TCGv h0 = tcg_temp_new();
-    TCGv h1 = tcg_temp_new();
+    TCGv_i32 h0 = tcg_temp_new_i32();
+    TCGv_i32 h1 = tcg_temp_new_i32();
 
     /* halfword 0 */
     tcg_gen_andi_i32(h0, r1, 0xffff);
@@ -2720,11 +2753,12 @@ static void gen_eqany_hi(TCGv ret, TCGv r1, int32_t con)
 
 /* mask = ((1 << width) -1) << pos;
    ret = (r1 & ~mask) | (r2 << pos) & mask); */
-static void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
+static void gen_insert(TCGv_i32 ret,
+                       TCGv_i32 r1, TCGv_i32 r2, TCGv_i32 width, TCGv_i32 pos)
 {
-    TCGv mask = tcg_temp_new();
-    TCGv temp = tcg_temp_new();
-    TCGv temp2 = tcg_temp_new();
+    TCGv_i32 mask = tcg_temp_new_i32();
+    TCGv_i32 temp = tcg_temp_new_i32();
+    TCGv_i32 temp2 = tcg_temp_new_i32();
 
     tcg_gen_shl_i32(mask, tcg_constant_i32(1), width);
     tcg_gen_subi_i32(mask, mask, 1);
@@ -2736,7 +2770,7 @@ static void gen_insert(TCGv ret, TCGv r1, TCGv r2, TCGv width, TCGv pos)
     tcg_gen_or_i32(ret, temp, temp2);
 }
 
-static void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
+static void gen_bsplit(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 r1)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -2744,7 +2778,7 @@ static void gen_bsplit(TCGv rl, TCGv rh, TCGv r1)
     tcg_gen_extr_i64_i32(rl, rh, temp);
 }
 
-static void gen_unpack(TCGv rl, TCGv rh, TCGv r1)
+static void gen_unpack(TCGv_i32 rl, TCGv_i32 rh, TCGv_i32 r1)
 {
     TCGv_i64 temp = tcg_temp_new_i64();
 
@@ -2752,8 +2786,9 @@ static void gen_unpack(TCGv rl, TCGv rh, TCGv r1)
     tcg_gen_extr_i64_i32(rl, rh, temp);
 }
 
-static void
-gen_dvinit_b(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
+static void gen_dvinit_b(DisasContext *ctx,
+                         TCGv_i32 rl, TCGv_i32 rh,
+                         TCGv_i32 r1, TCGv_i32 r2)
 {
     TCGv_i64 ret = tcg_temp_new_i64();
 
@@ -2765,8 +2800,9 @@ gen_dvinit_b(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
     tcg_gen_extr_i64_i32(rl, rh, ret);
 }
 
-static void
-gen_dvinit_h(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
+static void gen_dvinit_h(DisasContext *ctx,
+                         TCGv_i32 rl, TCGv_i32 rh,
+                         TCGv_i32 r1, TCGv_i32 r2)
 {
     TCGv_i64 ret = tcg_temp_new_i64();
 
@@ -2778,9 +2814,9 @@ gen_dvinit_h(DisasContext *ctx, TCGv rl, TCGv rh, TCGv r1, TCGv r2)
     tcg_gen_extr_i64_i32(rl, rh, ret);
 }
 
-static void gen_calc_usb_mul_h(TCGv arg_low, TCGv arg_high)
+static void gen_calc_usb_mul_h(TCGv_i32 arg_low, TCGv_i32 arg_high)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     /* calc AV bit */
     tcg_gen_add_i32(temp, arg_low, arg_low);
     tcg_gen_xor_i32(temp, temp, arg_low);
@@ -2792,9 +2828,9 @@ static void gen_calc_usb_mul_h(TCGv arg_low, TCGv arg_high)
     tcg_gen_movi_i32(cpu_PSW_V, 0);
 }
 
-static void gen_calc_usb_mulr_h(TCGv arg)
+static void gen_calc_usb_mulr_h(TCGv_i32 arg)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
     /* calc AV bit */
     tcg_gen_add_i32(temp, arg, arg);
     tcg_gen_xor_i32(temp, temp, arg);
@@ -2836,8 +2872,8 @@ static void generate_trap(DisasContext *ctx, int class, int tin)
     ctx->base.is_jmp = DISAS_NORETURN;
 }
 
-static void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
-                            TCGv r2, int16_t address)
+static void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv_i32 r1,
+                            TCGv_i32 r2, int16_t address)
 {
     TCGLabel *jumpLabel = gen_new_label();
     tcg_gen_brcond_i32(cond, r1, r2, jumpLabel);
@@ -2848,10 +2884,10 @@ static void gen_branch_cond(DisasContext *ctx, TCGCond cond, TCGv r1,
     gen_goto_tb(ctx, 0, ctx->base.pc_next + address * 2);
 }
 
-static void gen_branch_condi(DisasContext *ctx, TCGCond cond, TCGv r1,
+static void gen_branch_condi(DisasContext *ctx, TCGCond cond, TCGv_i32 r1,
                              int r2, int16_t address)
 {
-    TCGv temp = tcg_constant_i32(r2);
+    TCGv_i32 temp = tcg_constant_i32(r2);
     gen_branch_cond(ctx, cond, r1, temp, address);
 }
 
@@ -2868,7 +2904,7 @@ static void gen_loop(DisasContext *ctx, int r1, int32_t offset)
 
 static void gen_fcall_save_ctx(DisasContext *ctx)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
 
     tcg_gen_addi_i32(temp, cpu_gpr_a[10], -4);
     tcg_gen_qemu_st_i32(cpu_gpr_a[11], temp, ctx->mem_idx, MO_LESL);
@@ -2878,7 +2914,7 @@ static void gen_fcall_save_ctx(DisasContext *ctx)
 
 static void gen_fret(DisasContext *ctx)
 {
-    TCGv temp = tcg_temp_new();
+    TCGv_i32 temp = tcg_temp_new_i32();
 
     tcg_gen_andi_i32(temp, cpu_gpr_a[11], ~0x1);
     tcg_gen_qemu_ld_i32(cpu_gpr_a[11], cpu_gpr_a[10], ctx->mem_idx, MO_LESL);
@@ -2890,7 +2926,7 @@ static void gen_fret(DisasContext *ctx)
 static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
                                int r2 , int32_t constant , int32_t offset)
 {
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
     int n;
 
     switch (opc) {
@@ -2927,12 +2963,12 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         break;
 /* SBRN-format jumps */
     case OPC1_16_SBRN_JZ_T:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_andi_i32(temp, cpu_gpr_d[15], 0x1u << constant);
         gen_branch_condi(ctx, TCG_COND_EQ, temp, 0, offset);
         break;
     case OPC1_16_SBRN_JNZ_T:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_andi_i32(temp, cpu_gpr_d[15], 0x1u << constant);
         gen_branch_condi(ctx, TCG_COND_NE, temp, 0, offset);
         break;
@@ -3040,7 +3076,7 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
          }
          break;
     case OPCM_32_BRC_JNE:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         if (MASK_OP_BRC_OP2(ctx->opcode) == OPC2_32_BRC_JNED) {
             tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* subi is unconditional */
@@ -3057,7 +3093,7 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
     case OPCM_32_BRN_JTT:
         n = MASK_OP_BRN_N(ctx->opcode);
 
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_andi_i32(temp, cpu_gpr_d[r1], (1 << n));
 
         if (MASK_OP_BRN_OP2(ctx->opcode) == OPC2_32_BRN_JNZ_T) {
@@ -3112,8 +3148,8 @@ static void gen_compute_branch(DisasContext *ctx, uint32_t opc, int r1,
         }
         break;
     case OPCM_32_BRR_JNE:
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
         if (MASK_OP_BRC_OP2(ctx->opcode) == OPC2_32_BRR_JNED) {
             tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
             /* also save r2, in case of r1 == r2, so r2 is not decremented */
@@ -3151,7 +3187,7 @@ static void decode_src_opc(DisasContext *ctx, int op1)
 {
     int r1;
     int32_t const4;
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     r1 = MASK_OP_SRC_S1D(ctx->opcode);
     const4 = MASK_OP_SRC_CONST4_SEXT(ctx->opcode);
@@ -3227,7 +3263,7 @@ static void decode_src_opc(DisasContext *ctx, int op1)
 static void decode_srr_opc(DisasContext *ctx, int op1)
 {
     int r1, r2;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_SRR_S1D(ctx->opcode);
     r2 = MASK_OP_SRR_S2(ctx->opcode);
@@ -3545,7 +3581,7 @@ static void decode_16Bit_opc(DisasContext *ctx)
     int r1, r2;
     int32_t const16;
     int32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op1 = MASK_OP_MAJOR(ctx->opcode);
 
@@ -3612,7 +3648,7 @@ static void decode_16Bit_opc(DisasContext *ctx)
         r2 = MASK_OP_SRRS_S2(ctx->opcode);
         r1 = MASK_OP_SRRS_S1D(ctx->opcode);
         const16 = MASK_OP_SRRS_N(ctx->opcode);
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_shli_i32(temp, cpu_gpr_d[15], const16);
         tcg_gen_add_i32(cpu_gpr_a[r1], cpu_gpr_a[r2], temp);
         break;
@@ -3780,7 +3816,7 @@ static void decode_abs_ldw(DisasContext *ctx)
     int32_t op2;
     int32_t r1;
     uint32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_ABS_S1D(ctx->opcode);
     address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -3813,7 +3849,7 @@ static void decode_abs_ldb(DisasContext *ctx)
     int32_t op2;
     int32_t r1;
     uint32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_ABS_S1D(ctx->opcode);
     address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -3844,7 +3880,7 @@ static void decode_abs_ldst_swap(DisasContext *ctx)
     int32_t op2;
     int32_t r1;
     uint32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_ABS_S1D(ctx->opcode);
     address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -3895,7 +3931,7 @@ static void decode_abs_store(DisasContext *ctx)
     int32_t op2;
     int32_t r1;
     uint32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_ABS_S1D(ctx->opcode);
     address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -3928,7 +3964,7 @@ static void decode_abs_storeb_h(DisasContext *ctx)
     int32_t op2;
     int32_t r1;
     uint32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_ABS_S1D(ctx->opcode);
     address = MASK_OP_ABS_OFF18(ctx->opcode);
@@ -4030,7 +4066,7 @@ static void decode_bit_insert(DisasContext *ctx)
     uint32_t op2;
     int r1, r2, r3;
     int pos1, pos2;
-    TCGv temp;
+    TCGv_i32 temp;
     op2 = MASK_OP_BIT_OP2(ctx->opcode);
     r1 = MASK_OP_BIT_S1(ctx->opcode);
     r2 = MASK_OP_BIT_S2(ctx->opcode);
@@ -4038,7 +4074,7 @@ static void decode_bit_insert(DisasContext *ctx)
     pos1 = MASK_OP_BIT_POS1(ctx->opcode);
     pos2 = MASK_OP_BIT_POS2(ctx->opcode);
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     tcg_gen_shri_i32(temp, cpu_gpr_d[r2], pos2);
     if (op2 == OPC2_32_BIT_INSN_T) {
@@ -4129,7 +4165,7 @@ static void decode_bit_sh_logic1(DisasContext *ctx)
     uint32_t op2;
     int r1, r2, r3;
     int pos1, pos2;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2 = MASK_OP_BIT_OP2(ctx->opcode);
     r1 = MASK_OP_BIT_S1(ctx->opcode);
@@ -4138,7 +4174,7 @@ static void decode_bit_sh_logic1(DisasContext *ctx)
     pos1 = MASK_OP_BIT_POS1(ctx->opcode);
     pos2 = MASK_OP_BIT_POS2(ctx->opcode);
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_BIT_SH_AND_T:
@@ -4169,7 +4205,7 @@ static void decode_bit_sh_logic2(DisasContext *ctx)
     uint32_t op2;
     int r1, r2, r3;
     int pos1, pos2;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2 = MASK_OP_BIT_OP2(ctx->opcode);
     r1 = MASK_OP_BIT_S1(ctx->opcode);
@@ -4178,7 +4214,7 @@ static void decode_bit_sh_logic2(DisasContext *ctx)
     pos1 = MASK_OP_BIT_POS1(ctx->opcode);
     pos2 = MASK_OP_BIT_POS2(ctx->opcode);
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_BIT_SH_NAND_T:
@@ -4212,7 +4248,7 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
     uint32_t op2;
     uint32_t off10;
     int32_t r1, r2;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2  = MASK_OP_BO_S2(ctx->opcode);
@@ -4296,7 +4332,7 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_ST_D_PREINC:
         CHECK_REG_PAIR(r1);
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_st_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
@@ -4314,7 +4350,7 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_ST_DA_PREINC:
         CHECK_REG_PAIR(r1);
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_st_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
@@ -4331,19 +4367,19 @@ static void decode_bo_addrmode_post_pre_base(DisasContext *ctx)
         gen_st_preincr(ctx, cpu_gpr_d[r1], cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_Q_SHORTOFF:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
         gen_offset_st(ctx, temp, cpu_gpr_a[r2], off10, MO_LEUW);
         break;
     case OPC2_32_BO_ST_Q_POSTINC:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
         tcg_gen_qemu_st_i32(temp, cpu_gpr_a[r2], ctx->mem_idx,
                            MO_LEUW);
         tcg_gen_addi_i32(cpu_gpr_a[r2], cpu_gpr_a[r2], off10);
         break;
     case OPC2_32_BO_ST_Q_PREINC:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_shri_i32(temp, cpu_gpr_d[r1], 16);
         gen_st_preincr(ctx, temp, cpu_gpr_a[r2], off10, MO_LEUW);
         break;
@@ -4368,15 +4404,15 @@ static void decode_bo_addrmode_bitreverse_circular(DisasContext *ctx)
     uint32_t op2;
     uint32_t off10;
     int32_t r1, r2;
-    TCGv temp, temp2, t_off10;
+    TCGv_i32 temp, temp2, t_off10;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2  = MASK_OP_BO_S2(ctx->opcode);
     off10 = MASK_OP_BO_OFF10_SEXT(ctx->opcode);
     op2 = MASK_OP_BO_OP2(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
     tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
@@ -4475,7 +4511,7 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
     uint32_t op2;
     uint32_t off10;
     int32_t r1, r2;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2  = MASK_OP_BO_S2(ctx->opcode);
@@ -4529,7 +4565,7 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_LD_D_PREINC:
         CHECK_REG_PAIR(r1);
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_ld_2regs_64(ctx, cpu_gpr_d[r1 + 1], cpu_gpr_d[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
@@ -4547,7 +4583,7 @@ static void decode_bo_addrmode_ld_post_pre_base(DisasContext *ctx)
         break;
     case OPC2_32_BO_LD_DA_PREINC:
         CHECK_REG_PAIR(r1);
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], off10);
         gen_ld_2regs_64(ctx, cpu_gpr_a[r1 + 1], cpu_gpr_a[r1], temp);
         tcg_gen_mov_i32(cpu_gpr_a[r2], temp);
@@ -4609,15 +4645,15 @@ static void decode_bo_addrmode_ld_bitreverse_circular(DisasContext *ctx)
     uint32_t op2;
     uint32_t off10;
     int r1, r2;
-    TCGv temp, temp2, t_off10;
+    TCGv_i32 temp, temp2, t_off10;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2 = MASK_OP_BO_S2(ctx->opcode);
     off10 = MASK_OP_BO_OFF10_SEXT(ctx->opcode);
     op2 = MASK_OP_BO_OP2(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
     tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
@@ -4724,7 +4760,7 @@ static void decode_bo_addrmode_stctx_post_pre_base(DisasContext *ctx)
     uint32_t off10;
     int r1, r2;
 
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2 = MASK_OP_BO_S2(ctx->opcode);
@@ -4732,7 +4768,7 @@ static void decode_bo_addrmode_stctx_post_pre_base(DisasContext *ctx)
     op2 = MASK_OP_BO_OP2(ctx->opcode);
 
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_BO_LDLCX_SHORTOFF:
@@ -4812,15 +4848,15 @@ static void decode_bo_addrmode_ldmst_bitreverse_circular(DisasContext *ctx)
     uint32_t op2;
     uint32_t off10;
     int r1, r2;
-    TCGv temp, temp2, t_off10;
+    TCGv_i32 temp, temp2, t_off10;
 
     r1 = MASK_OP_BO_S1D(ctx->opcode);
     r2 = MASK_OP_BO_S2(ctx->opcode);
     off10 = MASK_OP_BO_OFF10_SEXT(ctx->opcode);
     op2 = MASK_OP_BO_OP2(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
     t_off10 = tcg_constant_i32(off10);
     CHECK_REG_PAIR(r2);
     tcg_gen_ext16u_i32(temp, cpu_gpr_a[r2 + 1]);
@@ -4868,7 +4904,7 @@ static void decode_bol_opc(DisasContext *ctx, int32_t op1)
 {
     int r1, r2;
     int32_t address;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r1 = MASK_OP_BOL_S1D(ctx->opcode);
     r2 = MASK_OP_BOL_S2(ctx->opcode);
@@ -4876,12 +4912,12 @@ static void decode_bol_opc(DisasContext *ctx, int32_t op1)
 
     switch (op1) {
     case OPC1_32_BOL_LD_A_LONGOFF:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], address);
         tcg_gen_qemu_ld_i32(cpu_gpr_a[r1], temp, ctx->mem_idx, MO_LEUL);
         break;
     case OPC1_32_BOL_LD_W_LONGOFF:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_addi_i32(temp, cpu_gpr_a[r2], address);
         tcg_gen_qemu_ld_i32(cpu_gpr_d[r1], temp, ctx->mem_idx, MO_LEUL);
         break;
@@ -4951,7 +4987,7 @@ static void decode_rc_logical_shift(DisasContext *ctx)
     uint32_t op2;
     int r1, r2;
     int32_t const9;
-    TCGv temp;
+    TCGv_i32 temp;
 
     r2 = MASK_OP_RC_D(ctx->opcode);
     r1 = MASK_OP_RC_S1(ctx->opcode);
@@ -4966,12 +5002,12 @@ static void decode_rc_logical_shift(DisasContext *ctx)
         tcg_gen_andi_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], ~const9);
         break;
     case OPC2_32_RC_NAND:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_movi_i32(temp, const9);
         tcg_gen_nand_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
         break;
     case OPC2_32_RC_NOR:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_movi_i32(temp, const9);
         tcg_gen_nor_i32(cpu_gpr_d[r2], cpu_gpr_d[r1], temp);
         break;
@@ -5026,7 +5062,7 @@ static void decode_rc_accumulator(DisasContext *ctx)
     int r1, r2;
     int16_t const9;
 
-    TCGv temp;
+    TCGv_i32 temp;
 
     r2 = MASK_OP_RC_D(ctx->opcode);
     r1 = MASK_OP_RC_S1(ctx->opcode);
@@ -5034,7 +5070,7 @@ static void decode_rc_accumulator(DisasContext *ctx)
 
     op2 = MASK_OP_RC_OP2(ctx->opcode);
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RC_ABSDIF:
@@ -5287,7 +5323,7 @@ static void decode_rcpw_insert(DisasContext *ctx)
     int r1, r2;
     int32_t pos, width, const4;
 
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2    = MASK_OP_RCPW_OP2(ctx->opcode);
     r1     = MASK_OP_RCPW_S1(ctx->opcode);
@@ -5328,7 +5364,7 @@ static void decode_rcrw_insert(DisasContext *ctx)
     int r1, r3, r4;
     int32_t width, const4;
 
-    TCGv temp, temp2, temp3;
+    TCGv_i32 temp, temp2, temp3;
 
     op2    = MASK_OP_RCRW_OP2(ctx->opcode);
     r1     = MASK_OP_RCRW_S1(ctx->opcode);
@@ -5337,8 +5373,8 @@ static void decode_rcrw_insert(DisasContext *ctx)
     width  = MASK_OP_RCRW_WIDTH(ctx->opcode);
     const4 = MASK_OP_RCRW_CONST4(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RCRW_IMASK:
@@ -5350,7 +5386,7 @@ static void decode_rcrw_insert(DisasContext *ctx)
         tcg_gen_shl_i32(cpu_gpr_d[r4], temp2, temp);
         break;
     case OPC2_32_RCRW_INSERT:
-        temp3 = tcg_temp_new();
+        temp3 = tcg_temp_new_i32();
 
         tcg_gen_movi_i32(temp, width);
         tcg_gen_movi_i32(temp2, const4);
@@ -5370,7 +5406,7 @@ static void decode_rcr_cond_select(DisasContext *ctx)
     int r1, r3, r4;
     int32_t const9;
 
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     op2 = MASK_OP_RCR_OP2(ctx->opcode);
     r1 = MASK_OP_RCR_S1(ctx->opcode);
@@ -5577,7 +5613,7 @@ static void decode_rr_accumulator(DisasContext *ctx)
     uint32_t op2;
     int r3, r2, r1;
 
-    TCGv temp;
+    TCGv_i32 temp;
 
     r3 = MASK_OP_RR_D(ctx->opcode);
     r2 = MASK_OP_RR_S2(ctx->opcode);
@@ -5774,7 +5810,7 @@ static void decode_rr_accumulator(DisasContext *ctx)
         break;
     case OPC2_32_RR_MOV_64:
         if (has_feature(ctx, TRICORE_FEATURE_16)) {
-            temp = tcg_temp_new();
+            temp = tcg_temp_new_i32();
 
             CHECK_REG_PAIR(r3);
             tcg_gen_mov_i32(temp, cpu_gpr_d[r1]);
@@ -5993,7 +6029,7 @@ static void decode_rr_address(DisasContext *ctx)
 {
     uint32_t op2, n;
     int r1, r2, r3;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2 = MASK_OP_RR_OP2(ctx->opcode);
     r3 = MASK_OP_RR_D(ctx->opcode);
@@ -6006,12 +6042,12 @@ static void decode_rr_address(DisasContext *ctx)
         tcg_gen_add_i32(cpu_gpr_a[r3], cpu_gpr_a[r1], cpu_gpr_a[r2]);
         break;
     case OPC2_32_RR_ADDSC_A:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_shli_i32(temp, cpu_gpr_d[r1], n);
         tcg_gen_add_i32(cpu_gpr_a[r3], cpu_gpr_a[r2], temp);
         break;
     case OPC2_32_RR_ADDSC_AT:
-        temp = tcg_temp_new();
+        temp = tcg_temp_new_i32();
         tcg_gen_sari_i32(temp, cpu_gpr_d[r1], 3);
         tcg_gen_add_i32(temp, cpu_gpr_a[r2], temp);
         tcg_gen_andi_i32(cpu_gpr_a[r3], temp, 0xFFFFFFFC);
@@ -6091,7 +6127,7 @@ static void decode_rr_divide(DisasContext *ctx)
     uint32_t op2;
     int r1, r2, r3;
 
-    TCGv temp, temp2, temp3;
+    TCGv_i32 temp, temp2, temp3;
 
     op2 = MASK_OP_RR_OP2(ctx->opcode);
     r3 = MASK_OP_RR_D(ctx->opcode);
@@ -6112,9 +6148,9 @@ static void decode_rr_divide(DisasContext *ctx)
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_DVINIT_BU:
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
-        temp3 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
+        temp3 = tcg_temp_new_i32();
         CHECK_REG_PAIR(r3);
         tcg_gen_shri_i32(temp3, cpu_gpr_d[r1], 8);
         /* reset av */
@@ -6141,9 +6177,9 @@ static void decode_rr_divide(DisasContext *ctx)
                      cpu_gpr_d[r2]);
         break;
     case OPC2_32_RR_DVINIT_HU:
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
-        temp3 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
+        temp3 = tcg_temp_new_i32();
         CHECK_REG_PAIR(r3);
         tcg_gen_shri_i32(temp3, cpu_gpr_d[r1], 16);
         /* reset av */
@@ -6165,8 +6201,8 @@ static void decode_rr_divide(DisasContext *ctx)
         tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp3);
         break;
     case OPC2_32_RR_DVINIT:
-        temp = tcg_temp_new();
-        temp2 = tcg_temp_new();
+        temp = tcg_temp_new_i32();
+        temp2 = tcg_temp_new_i32();
         CHECK_REG_PAIR(r3);
         /* overflow = ((D[b] == 0) ||
                       ((D[b] == 0xFFFFFFFF) && (D[a] == 0x80000000))) */
@@ -6315,7 +6351,7 @@ static void decode_rr1_mul(DisasContext *ctx)
     uint32_t op2;
 
     int r1, r2, r3;
-    TCGv n;
+    TCGv_i32 n;
     TCGv_i64 temp64;
 
     r1 = MASK_OP_RR1_S1(ctx->opcode);
@@ -6420,7 +6456,7 @@ static void decode_rr1_mulq(DisasContext *ctx)
     int r1, r2, r3;
     uint32_t n;
 
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     r1 = MASK_OP_RR1_S1(ctx->opcode);
     r2 = MASK_OP_RR1_S2(ctx->opcode);
@@ -6428,8 +6464,8 @@ static void decode_rr1_mulq(DisasContext *ctx)
     n  = MASK_OP_RR1_N(ctx->opcode);
     op2 = MASK_OP_RR1_OP2(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RR1_MUL_Q_32:
@@ -6526,7 +6562,7 @@ static void decode_rrpw_extract_insert(DisasContext *ctx)
     uint32_t op2;
     int r1, r2, r3;
     int32_t pos, width;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2 = MASK_OP_RRPW_OP2(ctx->opcode);
     r1 = MASK_OP_RRPW_S1(ctx->opcode);
@@ -6554,7 +6590,7 @@ static void decode_rrpw_extract_insert(DisasContext *ctx)
         CHECK_REG_PAIR(r3);
 
         if (pos + width <= 32) {
-            temp = tcg_temp_new();
+            temp = tcg_temp_new_i32();
             tcg_gen_movi_i32(temp, ((1u << width) - 1) << pos);
             tcg_gen_shli_i32(cpu_gpr_d[r3], cpu_gpr_d[r2], pos);
             tcg_gen_mov_i32(cpu_gpr_d[r3 + 1], temp);
@@ -6580,7 +6616,7 @@ static void decode_rrr_cond_select(DisasContext *ctx)
 {
     uint32_t op2;
     int r1, r2, r3, r4;
-    TCGv temp;
+    TCGv_i32 temp;
 
     op2 = MASK_OP_RRR_OP2(ctx->opcode);
     r1  = MASK_OP_RRR_S1(ctx->opcode);
@@ -6964,7 +7000,7 @@ static void decode_rrr1_maddq_h(DisasContext *ctx)
 {
     uint32_t op2;
     uint32_t r1, r2, r3, r4, n;
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     op2 = MASK_OP_RRR1_OP2(ctx->opcode);
     r1 = MASK_OP_RRR1_S1(ctx->opcode);
@@ -6973,8 +7009,8 @@ static void decode_rrr1_maddq_h(DisasContext *ctx)
     r4 = MASK_OP_RRR1_D(ctx->opcode);
     n = MASK_OP_RRR1_N(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RRR1_MADD_Q_32:
@@ -7446,7 +7482,7 @@ static void decode_rrr1_msubq_h(DisasContext *ctx)
 {
     uint32_t op2;
     uint32_t r1, r2, r3, r4, n;
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     op2 = MASK_OP_RRR1_OP2(ctx->opcode);
     r1 = MASK_OP_RRR1_S1(ctx->opcode);
@@ -7455,8 +7491,8 @@ static void decode_rrr1_msubq_h(DisasContext *ctx)
     r4 = MASK_OP_RRR1_D(ctx->opcode);
     n = MASK_OP_RRR1_N(ctx->opcode);
 
-    temp = tcg_temp_new();
-    temp2 = tcg_temp_new();
+    temp = tcg_temp_new_i32();
+    temp2 = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RRR1_MSUB_Q_32:
@@ -7783,7 +7819,7 @@ static void decode_rrrr_extract_insert(DisasContext *ctx)
 {
     uint32_t op2;
     int r1, r2, r3, r4;
-    TCGv tmp_width, tmp_pos;
+    TCGv_i32 tmp_width, tmp_pos;
 
     r1 = MASK_OP_RRRR_S1(ctx->opcode);
     r2 = MASK_OP_RRRR_S2(ctx->opcode);
@@ -7791,8 +7827,8 @@ static void decode_rrrr_extract_insert(DisasContext *ctx)
     r4 = MASK_OP_RRRR_D(ctx->opcode);
     op2 = MASK_OP_RRRR_OP2(ctx->opcode);
 
-    tmp_pos = tcg_temp_new();
-    tmp_width = tcg_temp_new();
+    tmp_pos = tcg_temp_new_i32();
+    tmp_width = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RRRR_DEXTR:
@@ -7800,8 +7836,8 @@ static void decode_rrrr_extract_insert(DisasContext *ctx)
         if (r1 == r2) {
             tcg_gen_rotl_i32(cpu_gpr_d[r4], cpu_gpr_d[r1], tmp_pos);
         } else {
-            TCGv msw = tcg_temp_new();
-            TCGv zero = tcg_constant_i32(0);
+            TCGv_i32 msw = tcg_temp_new_i32();
+            TCGv_i32 zero = tcg_constant_i32(0);
             tcg_gen_shl_i32(tmp_width, cpu_gpr_d[r1], tmp_pos);
             tcg_gen_subfi_i32(msw, 32, tmp_pos);
             tcg_gen_shr_i32(msw, cpu_gpr_d[r2], msw);
@@ -7848,7 +7884,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
     int r1, r2, r3, r4;
     int32_t width;
 
-    TCGv temp, temp2;
+    TCGv_i32 temp, temp2;
 
     op2 = MASK_OP_RRRW_OP2(ctx->opcode);
     r1  = MASK_OP_RRRW_S1(ctx->opcode);
@@ -7857,7 +7893,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
     r4  = MASK_OP_RRRW_D(ctx->opcode);
     width = MASK_OP_RRRW_WIDTH(ctx->opcode);
 
-    temp = tcg_temp_new();
+    temp = tcg_temp_new_i32();
 
     switch (op2) {
     case OPC2_32_RRRW_EXTR:
@@ -7877,7 +7913,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
         }
         break;
     case OPC2_32_RRRW_IMASK:
-        temp2 = tcg_temp_new();
+        temp2 = tcg_temp_new_i32();
         CHECK_REG_PAIR(r4);
         tcg_gen_andi_i32(temp, cpu_gpr_d[r3], 0x1f);
         tcg_gen_movi_i32(temp2, (1 << width) - 1);
@@ -7886,7 +7922,7 @@ static void decode_rrrw_extract_insert(DisasContext *ctx)
         tcg_gen_mov_i32(cpu_gpr_d[r4 + 1], temp2);
         break;
     case OPC2_32_RRRW_INSERT:
-        temp2 = tcg_temp_new();
+        temp2 = tcg_temp_new_i32();
 
         tcg_gen_movi_i32(temp, width);
         tcg_gen_andi_i32(temp2, cpu_gpr_d[r3], 0x1f);
@@ -7903,7 +7939,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
     uint32_t op2;
     uint32_t r1;
     TCGLabel *l1;
-    TCGv tmp;
+    TCGv_i32 tmp;
 
     op2 = MASK_OP_SYS_OP2(ctx->opcode);
     r1  = MASK_OP_SYS_S1D(ctx->opcode);
@@ -7957,7 +7993,7 @@ static void decode_sys_interrupts(DisasContext *ctx)
         break;
     case OPC2_32_SYS_RFM:
         if (ctx->priv  == TRICORE_PRIV_SM) {
-            tmp = tcg_temp_new();
+            tmp = tcg_temp_new_i32();
             l1 = gen_new_label();
 
             tcg_gen_ld_i32(tmp, tcg_env, offsetof(CPUTriCoreState, DBGSR));
@@ -8013,7 +8049,7 @@ static void decode_32Bit_opc(DisasContext *ctx)
     int32_t address, const16;
     int8_t b, const4;
     int32_t bpos;
-    TCGv temp, temp2, temp3;
+    TCGv_i32 temp, temp2, temp3;
 
     op1 = MASK_OP_MAJOR(ctx->opcode);
 
@@ -8046,7 +8082,7 @@ static void decode_32Bit_opc(DisasContext *ctx)
         address = MASK_OP_ABS_OFF18(ctx->opcode);
         r1 = MASK_OP_ABS_S1D(ctx->opcode);
         temp = tcg_constant_i32(EA_ABS_FORMAT(address));
-        temp2 = tcg_temp_new();
+        temp2 = tcg_temp_new_i32();
 
         tcg_gen_shri_i32(temp2, cpu_gpr_d[r1], 16);
         tcg_gen_qemu_st_i32(temp2, temp, ctx->mem_idx, MO_LEUW);
@@ -8081,7 +8117,7 @@ static void decode_32Bit_opc(DisasContext *ctx)
         bpos = MASK_OP_ABSB_BPOS(ctx->opcode);
 
         temp = tcg_constant_i32(EA_ABS_FORMAT(address));
-        temp2 = tcg_temp_new();
+        temp2 = tcg_temp_new_i32();
 
         tcg_gen_qemu_ld_i32(temp2, temp, ctx->mem_idx, MO_UB);
         tcg_gen_andi_i32(temp2, temp2, ~(0x1u << bpos));
@@ -8208,8 +8244,8 @@ static void decode_32Bit_opc(DisasContext *ctx)
         r3 = MASK_OP_RCRR_D(ctx->opcode);
         const16 = MASK_OP_RCRR_CONST4(ctx->opcode);
         temp = tcg_constant_i32(const16);
-        temp2 = tcg_temp_new(); /* width*/
-        temp3 = tcg_temp_new(); /* pos */
+        temp2 = tcg_temp_new_i32(); /* width*/
+        temp3 = tcg_temp_new_i32(); /* pos */
 
         CHECK_REG_PAIR(r2);
 

From 2b6cea17be35d46021ecd9b9dcceaed7b6200dbe Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 12:08:31 +0200
Subject: [PATCH 1411/2396] target/xtensa: Replace legacy
 cpu_physical_memory_[un]map() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit b7ecba0f6f6 ("docs/devel/loads-stores.rst: Document our
various load and store APIs") mentioned cpu_physical_memory_*()
methods are legacy, the replacement being address_space_*().

Replace the *_map() / *_unmap() methods in the SIMCALL helper,
using the vCPU default address space. No behavioral change expected.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20251002145742.75624-6-philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 target/xtensa/xtensa-semi.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/xtensa/xtensa-semi.c b/target/xtensa/xtensa-semi.c
index 636f421da2..431c263dc5 100644
--- a/target/xtensa/xtensa-semi.c
+++ b/target/xtensa/xtensa-semi.c
@@ -32,6 +32,7 @@
 #include "exec/target_page.h"
 #include "semihosting/semihost.h"
 #include "semihosting/uaccess.h"
+#include "system/memory.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
 
@@ -192,7 +193,9 @@ void xtensa_sim_open_console(Chardev *chr)
 
 void HELPER(simcall)(CPUXtensaState *env)
 {
+    const MemTxAttrs attrs = MEMTXATTRS_UNSPECIFIED;
     CPUState *cs = env_cpu(env);
+    AddressSpace *as = cs->as;
     uint32_t *regs = env->regs;
 
     switch (regs[2]) {
@@ -215,7 +218,7 @@ void HELPER(simcall)(CPUXtensaState *env)
                     TARGET_PAGE_SIZE - (vaddr & (TARGET_PAGE_SIZE - 1));
                 uint32_t io_sz = page_left < len ? page_left : len;
                 hwaddr sz = io_sz;
-                void *buf = cpu_physical_memory_map(paddr, &sz, !is_write);
+                void *buf = address_space_map(as, paddr, &sz, !is_write, attrs);
                 uint32_t io_done;
                 bool error = false;
 
@@ -261,7 +264,7 @@ void HELPER(simcall)(CPUXtensaState *env)
                         error = true;
                         io_done = 0;
                     }
-                    cpu_physical_memory_unmap(buf, sz, !is_write, io_done);
+                    address_space_unmap(as, buf, sz, !is_write, io_done);
                 } else {
                     error = true;
                     regs[3] = TARGET_EINVAL;
@@ -408,11 +411,11 @@ void HELPER(simcall)(CPUXtensaState *env)
 
             while (sz) {
                 hwaddr len = sz;
-                void *buf = cpu_physical_memory_map(base, &len, 1);
+                void *buf = address_space_map(as, base, &len, true, attrs);
 
                 if (buf && len) {
                     memset(buf, regs[4], len);
-                    cpu_physical_memory_unmap(buf, len, 1, len);
+                    address_space_unmap(as, buf, len, true, len);
                 } else {
                     len = 1;
                 }

From fead65d20513f005fcc589eab744f6aa88c60f37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:28:10 +0200
Subject: [PATCH 1412/2396] target/xtensa: Remove target_ulong use in
 xtensa_tr_translate_insn()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit 85c19af63e7 ("include/exec: Use vaddr in DisasContextBase
for virtual addresses") the DisasContextBase::pc_first field is a
vaddr type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008051529.86378-2-philmd@linaro.org>
---
 target/xtensa/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/xtensa/translate.c b/target/xtensa/translate.c
index 34ae2f4e16..bb8d2ed86c 100644
--- a/target/xtensa/translate.c
+++ b/target/xtensa/translate.c
@@ -1166,7 +1166,7 @@ static void xtensa_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUXtensaState *env = cpu_env(cpu);
-    target_ulong page_start;
+    vaddr page_start;
 
     /* These two conditions only apply to the first insn in the TB,
        but this is the first TranslateOps hook that allows exiting.  */

From 91edb16601da768dc443a46fb8bcb77900f18864 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 06:26:50 +0200
Subject: [PATCH 1413/2396] target/xtensa: Remove target_ulong use in
 xtensa_get_tb_cpu_state()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit bb5de52524c ("target: Widen pc/cs_base in
cpu_get_tb_cpu_state"), cpu_get_tb_cpu_state() expects
a uint64_t type for cs_base.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-Id: <20251008051529.86378-3-philmd@linaro.org>
---
 target/xtensa/cpu.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index ea9b6df3aa..1eeed44e33 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -59,13 +59,13 @@ static TCGTBCPUState xtensa_get_tb_cpu_state(CPUState *cs)
 {
     CPUXtensaState *env = cpu_env(cs);
     uint32_t flags = 0;
-    target_ulong cs_base = 0;
+    uint64_t cs_base = 0;
 
     flags |= xtensa_get_ring(env);
     if (env->sregs[PS] & PS_EXCM) {
         flags |= XTENSA_TBFLAG_EXCM;
     } else if (xtensa_option_enabled(env->config, XTENSA_OPTION_LOOP)) {
-        target_ulong lend_dist =
+        uint64_t lend_dist =
             env->sregs[LEND] - (env->pc & -(1u << TARGET_PAGE_BITS));
 
         /*
@@ -83,7 +83,7 @@ static TCGTBCPUState xtensa_get_tb_cpu_state(CPUState *cs)
          * for the TB that contains this instruction.
          */
         if (lend_dist < (1u << TARGET_PAGE_BITS) + env->config->max_insn_size) {
-            target_ulong lbeg_off = env->sregs[LEND] - env->sregs[LBEG];
+            uint64_t lbeg_off = env->sregs[LEND] - env->sregs[LBEG];
 
             cs_base = lend_dist;
             if (lbeg_off < 256) {

From 91fc6d8101de97c588e0a4263cf4f6148b3e702a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 6 Oct 2025 17:36:31 +0200
Subject: [PATCH 1414/2396] linux-user/microblaze: Fix little-endianness binary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MicroBlaze CPU model has a "little-endian" property, pointing to
the @endi internal field. Commit c36ec3a9655 ("hw/microblaze:
Explicit CPU endianness") took care of having all MicroBlaze
boards with an explicit default endianness, so later commit
415aae543ed ("target/microblaze: Consider endianness while
translating code") could infer the endianness at runtime from
the @endi field, and not a compile time via the TARGET_BIG_ENDIAN
definition. Doing so, we forgot to make the endianness explicit
on user emulation, so there all CPUs are started with the default
"little-endian=off" value, leading to breaking support for little
endian binaries:

  $ readelf -h ./hello-world-mbel
  ELF Header:
    Magic:   7f 45 4c 46 01 01 01 00 00 00 00 00 00 00 00 00
    Class:                             ELF32
    Data:                              2's complement, little endian

  $ qemu-microblazeel ./hello-world-mbel
  qemu: uncaught target signal 11 (Segmentation fault) - core dumped
  Segmentation fault (core dumped)

Fix by restoring the previous behavior of starting with the
builtin endianness of the binary:

  $ qemu-microblazeel ./hello-world-mbel
  Hello World

Cc: qemu-stable@nongnu.org
Fixes: 415aae543ed ("target/microblaze: Consider endianness while translating code")
Reported-by: Edgar E. Iglesias <edgar.iglesias@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251006173350.17455-1-philmd@linaro.org>
---
 linux-user/microblaze/elfload.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/linux-user/microblaze/elfload.c b/linux-user/microblaze/elfload.c
index 7eb1b26d17..bdc0a953d5 100644
--- a/linux-user/microblaze/elfload.c
+++ b/linux-user/microblaze/elfload.c
@@ -8,7 +8,8 @@
 
 const char *get_elf_cpu_model(uint32_t eflags)
 {
-    return "any";
+    return TARGET_BIG_ENDIAN ? "any,little-endian=off"
+                             : "any,little-endian=on";
 }
 
 void elf_core_copy_regs(target_elf_gregset_t *r, const CPUMBState *env)

From 8dd133fa85bb49e2e61c489a566ab8460478dc24 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 12:38:19 +0200
Subject: [PATCH 1415/2396] =?UTF-8?q?mailmap:=20Unify=20Cl=C3=A9ment=20Mat?=
 =?UTF-8?q?hieu--Drif=20emails?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not let git-shortlog make distinction between:

 . Clément Mathieu--Drif
 . Clement Mathieu--Drif
 . CLEMENT MATHIEU--DRIF

as this is the same person.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-Id: <20251009070512.8736-3-philmd@linaro.org>
---
 .mailmap | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.mailmap b/.mailmap
index e7271852dc..15bec72470 100644
--- a/.mailmap
+++ b/.mailmap
@@ -136,6 +136,7 @@ Chen Gang <gang.chen.5i5j@gmail.com>
 Chen Gang <gang.chen@sunrus.com.cn>
 Chen Wei-Ren <chenwj@iis.sinica.edu.tw>
 Christophe Lyon <christophe.lyon@st.com>
+Clément Mathieu--Drif <clement.mathieu--drif@eviden.com>
 Collin L. Walling <walling@linux.ibm.com>
 Daniel P. Berrangé <berrange@redhat.com>
 Eduardo Otubo <otubo@redhat.com>

From 9b03e9cf06b33192d550564169f36eee07cf9fd0 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 8 Oct 2025 15:19:36 +0200
Subject: [PATCH 1416/2396] python/qemu: Replace some remaining "avocados" with
 "functional tests"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The avocado tests have been replaced by the new functional tests,
so also update this in the README.rst files in the python directory
accordingly.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251008131936.71160-1-thuth@redhat.com>
---
 python/qemu/machine/README.rst | 2 +-
 python/qemu/utils/README.rst   | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/python/qemu/machine/README.rst b/python/qemu/machine/README.rst
index 8de2c3d772..6554c69320 100644
--- a/python/qemu/machine/README.rst
+++ b/python/qemu/machine/README.rst
@@ -2,7 +2,7 @@ qemu.machine package
 ====================
 
 This package provides core utilities used for testing and debugging
-QEMU. It is used by the iotests, vm tests, avocado tests, and several
+QEMU. It is used by the iotests, vm tests, functional tests, and several
 other utilities in the ./scripts directory. It is not a fully-fledged
 SDK and it is subject to change at any time.
 
diff --git a/python/qemu/utils/README.rst b/python/qemu/utils/README.rst
index d5f2da1454..5027f0b5f1 100644
--- a/python/qemu/utils/README.rst
+++ b/python/qemu/utils/README.rst
@@ -2,6 +2,6 @@ qemu.utils package
 ==================
 
 This package provides miscellaneous utilities used for testing and
-debugging QEMU. It is used primarily by the vm and avocado tests.
+debugging QEMU. It is used primarily by the vm and functional tests.
 
 See the documentation in ``__init__.py`` for more information.

From dadd7419d361f8f9f012cbc1413993132cd55b7a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 6 Oct 2025 18:18:50 +0200
Subject: [PATCH 1417/2396] tests/functional/aarch64: Drop some sbsaref_alpine
 tests
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_sbsaref_alpine is one of the longest running test in our testsuite,
because it does a full Linux boot a couple of times, for various different
CPU configurations. That's quite a lot of testing each time, for a rather
small additional test coverage. Thus let's drop some of the tests that don't
provide much in addition to the other ones.

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251006161850.181998-1-thuth@redhat.com>
---
 tests/functional/aarch64/test_sbsaref_alpine.py | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tests/functional/aarch64/test_sbsaref_alpine.py b/tests/functional/aarch64/test_sbsaref_alpine.py
index abb8f5114b..be84b7adb0 100755
--- a/tests/functional/aarch64/test_sbsaref_alpine.py
+++ b/tests/functional/aarch64/test_sbsaref_alpine.py
@@ -41,15 +41,9 @@ class Aarch64SbsarefAlpine(QemuSystemTest):
         self.vm.launch()
         wait_for_console_pattern(self, "Welcome to Alpine Linux 3.17")
 
-    def test_sbsaref_alpine_linux_cortex_a57(self):
-        self.boot_alpine_linux("cortex-a57")
-
     def test_sbsaref_alpine_linux_default_cpu(self):
         self.boot_alpine_linux()
 
-    def test_sbsaref_alpine_linux_max_pauth_off(self):
-        self.boot_alpine_linux("max,pauth=off")
-
     def test_sbsaref_alpine_linux_max_pauth_impdef(self):
         self.boot_alpine_linux("max,pauth-impdef=on")
 

From 1d7fdee97b8959871d4093d89a79192155ca674f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 10 Oct 2025 17:05:45 +0100
Subject: [PATCH 1418/2396] gitlab: purge msys pacman cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For the Windows msys2 CI job we install many packages using pacman
and use the GitLab cache to preserve the pacman cache across CI
runs. While metadata still needs downloading, this avoids pacman
re-downloading packages from msys2 if they have not changed.

The problem is that pacman never automatically purges anything
from its package cache. Thus the GitLab cache is growing without
bound and packing/unpacking the cache is consuming an increasing
amount of time in the CI job.

If we run 'pacman -Sc' /after/ installing our desired package set,
it will purge any cached downloaded packages that are not matching
any installed package.

This will (currently) cap the pacman download cache at approx
256 MB.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Yonggang Luo <luoyonggang@gmail.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20251010160545.144760-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 1e6a01bd9a..6e1135d8b8 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -87,6 +87,7 @@ msys2-64bit:
       mingw-w64-x86_64-pkgconf
       mingw-w64-x86_64-python
       mingw-w64-x86_64-zstd"
+  - .\msys64\usr\bin\bash -lc "pacman -Sc --noconfirm"
   - Write-Output "Running build at $(Get-Date -Format u)"
   - $env:JOBS = $(.\msys64\usr\bin\bash -lc nproc)
   - $env:CHERE_INVOKING = 'yes'  # Preserve the current working directory

From cb1379ce646e9f41b096c4d7590e558393e6e960 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Oct 2025 10:34:23 +0200
Subject: [PATCH 1419/2396] tests/functional: Set current time stamp of assets
 when using them
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are going to remove obsolete assets from the cache, so keep
the time stamps of the assets that we use up-to-date to have a way
to detect stale assets later.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251014083424.103202-2-thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index f666125bfa..ab3a7bb591 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -10,6 +10,7 @@ import logging
 import os
 import stat
 import sys
+import time
 import unittest
 import urllib.request
 from time import sleep
@@ -113,6 +114,16 @@ class Asset:
         self.log.debug("Time out while waiting for %s!", tmp_cache_file)
         raise
 
+    def _save_time_stamp(self):
+        '''
+        Update the time stamp of the asset in the cache. Unfortunately, we
+        cannot use the modification or access time of the asset file itself,
+        since e.g. the functional jobs in the gitlab CI reload the files
+        from the gitlab cache and thus always have recent file time stamps,
+        so we have to save our asset time stamp to a separate file instead.
+        '''
+        self.cache_file.with_suffix(".stamp").write_text(f"{int(time.time())}")
+
     def fetch(self):
         if not self.cache_dir.exists():
             self.cache_dir.mkdir(parents=True, exist_ok=True)
@@ -120,6 +131,7 @@ class Asset:
         if self.valid():
             self.log.debug("Using cached asset %s for %s",
                            self.cache_file, self.url)
+            self._save_time_stamp()
             return str(self.cache_file)
 
         if not self.fetchable():
@@ -208,6 +220,7 @@ class Asset:
             tmp_cache_file.unlink()
             raise AssetError(self, "Hash does not match %s" % self.hash)
         tmp_cache_file.replace(self.cache_file)
+        self._save_time_stamp()
         # Remove write perms to stop tests accidentally modifying them
         os.chmod(self.cache_file, stat.S_IRUSR | stat.S_IRGRP)
 

From dd10dbe61751dc85a4d84ffde73f341ab027eb73 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Oct 2025 10:34:24 +0200
Subject: [PATCH 1420/2396] tests: Evict stale files in the functional download
 cache after a while
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The download cache of the functional tests is currently only growing.
But sometimes tests get removed or changed to use different assets,
thus we should clean up the stale old assets after a while when they
are not in use anymore. So add a script that looks at the time stamps
of the assets and removes them if they haven't been touched for more
than half of a year. Since there might also be some assets around that
have been added to the cache before we added the time stamp files,
assume a default time stamp that is close to the creation date of this
patch, so that we don't delete these files too early (so we still have
all assets around in case we have to bisect an issue in the recent past
of QEMU).

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251014083424.103202-3-thuth@redhat.com>
---
 MAINTAINERS                       |  1 +
 scripts/clean_functional_cache.py | 45 +++++++++++++++++++++++++++++++
 tests/Makefile.include            |  1 +
 3 files changed, 47 insertions(+)
 create mode 100755 scripts/clean_functional_cache.py

diff --git a/MAINTAINERS b/MAINTAINERS
index 0c766961f3..667acd933c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4397,6 +4397,7 @@ M: Thomas Huth <thuth@redhat.com>
 R: Philippe Mathieu-Daudé <philmd@linaro.org>
 R: Daniel P. Berrange <berrange@redhat.com>
 F: docs/devel/testing/functional.rst
+F: scripts/clean_functional_cache.py
 F: tests/functional/qemu_test/
 
 Windows Hosted Continuous Integration
diff --git a/scripts/clean_functional_cache.py b/scripts/clean_functional_cache.py
new file mode 100755
index 0000000000..c3370ffbb8
--- /dev/null
+++ b/scripts/clean_functional_cache.py
@@ -0,0 +1,45 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+"""Delete stale assets from the download cache of the functional tests"""
+
+import os
+import stat
+import sys
+import time
+from pathlib import Path
+
+
+cache_dir_env = os.getenv('QEMU_TEST_CACHE_DIR')
+if cache_dir_env:
+    cache_dir = Path(cache_dir_env, "download")
+else:
+    cache_dir = Path(Path("~").expanduser(), ".cache", "qemu", "download")
+
+if not cache_dir.exists():
+    print(f"Cache dir {cache_dir} does not exist!", file=sys.stderr)
+    sys.exit(1)
+
+os.chdir(cache_dir)
+
+for file in cache_dir.iterdir():
+    # Only consider the files that use a sha256 as filename:
+    if len(file.name) != 64:
+        continue
+
+    try:
+        timestamp = int(file.with_suffix(".stamp").read_text())
+    except FileNotFoundError:
+        # Assume it's an old file that was already in the cache before we
+        # added the code for evicting stale assets. Use the release date
+        # of QEMU v10.1 as a default timestamp.
+        timestamp = time.mktime((2025, 8, 26, 0, 0, 0, 0, 0, 0))
+
+    age = time.time() - timestamp
+
+    # Delete files older than half of a year (183 days * 24h * 60m * 60s)
+    if age > 15811200:
+        print(f"Removing {cache_dir}/{file.name}.")
+        file.chmod(stat.S_IWRITE)
+        file.unlink()
diff --git a/tests/Makefile.include b/tests/Makefile.include
index e47ef4d45c..d4dfbf3716 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -111,6 +111,7 @@ $(FUNCTIONAL_TARGETS): check-venv
 .PHONY: check-functional
 check-functional: check-venv
 	@$(NINJA) precache-functional
+	@$(PYTHON) $(SRC_PATH)/scripts/clean_functional_cache.py
 	@QEMU_TEST_NO_DOWNLOAD=1 $(MAKE) SPEED=thorough check-func check-func-quick
 
 .PHONY: check-func check-func-quick

From 420f6c041705ebc9a7faf3cc0fd6deba865694ae Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 10 Oct 2025 16:45:25 +0200
Subject: [PATCH 1421/2396] tests/functional/alpha: Remove superfluous fetch()
 line from the clipper test

The kernel asset is retrieved automatically via the uncompress()
line below the fetch(), so the fetch() is simply not necessary here.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251010144525.842462-1-thuth@redhat.com>
---
 tests/functional/alpha/test_clipper.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/functional/alpha/test_clipper.py b/tests/functional/alpha/test_clipper.py
index c5d7181953..d2a4c2a4ed 100755
--- a/tests/functional/alpha/test_clipper.py
+++ b/tests/functional/alpha/test_clipper.py
@@ -17,7 +17,6 @@ class AlphaClipperTest(LinuxKernelTest):
 
     def test_alpha_clipper(self):
         self.set_machine('clipper')
-        kernel_path = self.ASSET_KERNEL.fetch()
 
         uncompressed_kernel = self.uncompress(self.ASSET_KERNEL, format="gz")
 

From 5c2a4b59fad21a3e71b7a8c155d374af952b585f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 14 Oct 2025 15:00:46 +0100
Subject: [PATCH 1422/2396] tests/functional: remove use of getLogger in
 reverse debuging
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes the gap left by

  commit 8a44d8c2ac0921c8064fbfd00ef28e3a2588918e
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Fri Sep 12 19:22:00 2025 +0100

    tests/functional: use self.log for all logging

ensuring that log message from the reverse debugging test actually
make it into the logfile on disk.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251014140047.385347-2-berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/reverse_debugging.py | 49 ++++++++++++---------------
 1 file changed, 22 insertions(+), 27 deletions(-)

diff --git a/tests/functional/reverse_debugging.py b/tests/functional/reverse_debugging.py
index 68cfcb3985..2c37a62cd0 100644
--- a/tests/functional/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -36,14 +36,13 @@ class ReverseDebugging(LinuxKernelTest):
     STEPS = 10
 
     def run_vm(self, record, shift, args, replay_path, image_path, port):
-        logger = logging.getLogger('replay')
         vm = self.get_vm(name='record' if record else 'replay')
         vm.set_console()
         if record:
-            logger.info('recording the execution...')
+            self.log.info('recording the execution...')
             mode = 'record'
         else:
-            logger.info('replaying the execution...')
+            self.log.info('replaying the execution...')
             mode = 'replay'
             vm.add_args('-gdb', 'tcp::%d' % port, '-S')
         vm.add_args('-icount', 'shift=%s,rr=%s,rrfile=%s,rrsnapshot=init' %
@@ -68,10 +67,8 @@ class ReverseDebugging(LinuxKernelTest):
     def reverse_debugging(self, gdb_arch, shift=7, args=None):
         from qemu_test import GDB
 
-        logger = logging.getLogger('replay')
-
         # create qcow2 for snapshots
-        logger.info('creating qcow2 image for VM snapshots')
+        self.log.info('creating qcow2 image for VM snapshots')
         image_path = os.path.join(self.workdir, 'disk.qcow2')
         qemu_img = get_qemu_img(self)
         if qemu_img is None:
@@ -79,7 +76,7 @@ class ReverseDebugging(LinuxKernelTest):
                           'create the temporary qcow2 image')
         out = check_output([qemu_img, 'create', '-f', 'qcow2', image_path, '128M'],
                            encoding='utf8')
-        logger.info("qemu-img: %s" % out)
+        self.log.info("qemu-img: %s" % out)
 
         replay_path = os.path.join(self.workdir, 'replay.bin')
 
@@ -90,7 +87,7 @@ class ReverseDebugging(LinuxKernelTest):
         last_icount = self.vm_get_icount(vm)
         vm.shutdown()
 
-        logger.info("recorded log with %s+ steps" % last_icount)
+        self.log.info("recorded log with %s+ steps" % last_icount)
 
         # replay and run debug commands
         with Ports() as ports:
@@ -98,9 +95,9 @@ class ReverseDebugging(LinuxKernelTest):
             vm = self.run_vm(False, shift, args, replay_path, image_path, port)
 
         try:
-            logger.info('Connecting to gdbstub...')
+            self.log.info('Connecting to gdbstub...')
             self.reverse_debugging_run(vm, port, gdb_arch, last_icount)
-            logger.info('Test passed.')
+            self.log.info('Test passed.')
         except GDB.TimeoutError:
             # Convert a GDB timeout exception into a unittest failure exception.
             raise self.failureException("Timeout while connecting to or "
@@ -111,8 +108,6 @@ class ReverseDebugging(LinuxKernelTest):
             raise
 
     def reverse_debugging_run(self, vm, port, gdb_arch, last_icount):
-        logger = logging.getLogger('replay')
-
         gdb_cmd = os.getenv('QEMU_TEST_GDB')
         gdb = GDB(gdb_cmd)
 
@@ -135,43 +130,43 @@ class ReverseDebugging(LinuxKernelTest):
 
         gdb.cli("set debug remote 0")
 
-        logger.info('stepping forward')
+        self.log.info('stepping forward')
         steps = []
         # record first instruction addresses
         for _ in range(self.STEPS):
             pc = self.get_pc(gdb)
-            logger.info('saving position %x' % pc)
+            self.log.info('saving position %x' % pc)
             steps.append(pc)
             gdb.cli("stepi")
 
         # visit the recorded instruction in reverse order
-        logger.info('stepping backward')
+        self.log.info('stepping backward')
         for addr in steps[::-1]:
-            logger.info('found position %x' % addr)
+            self.log.info('found position %x' % addr)
             gdb.cli("reverse-stepi")
             pc = self.get_pc(gdb)
             if pc != addr:
-                logger.info('Invalid PC (read %x instead of %x)' % (pc, addr))
+                self.log.info('Invalid PC (read %x instead of %x)' % (pc, addr))
                 self.fail('Reverse stepping failed!')
 
         # visit the recorded instruction in forward order
-        logger.info('stepping forward')
+        self.log.info('stepping forward')
         for addr in steps:
-            logger.info('found position %x' % addr)
+            self.log.info('found position %x' % addr)
             pc = self.get_pc(gdb)
             if pc != addr:
-                logger.info('Invalid PC (read %x instead of %x)' % (pc, addr))
+                self.log.info('Invalid PC (read %x instead of %x)' % (pc, addr))
                 self.fail('Forward stepping failed!')
             gdb.cli("stepi")
 
         # set breakpoints for the instructions just stepped over
-        logger.info('setting breakpoints')
+        self.log.info('setting breakpoints')
         for addr in steps:
             gdb.cli(f"break *{hex(addr)}")
 
         # this may hit a breakpoint if first instructions are executed
         # again
-        logger.info('continuing execution')
+        self.log.info('continuing execution')
         vm.qmp('replay-break', icount=last_icount - 1)
         # continue - will return after pausing
         # This can stop at the end of the replay-break and gdb gets a SIGINT,
@@ -180,12 +175,12 @@ class ReverseDebugging(LinuxKernelTest):
         gdb.cli("continue")
 
         if self.vm_get_icount(vm) == last_icount - 1:
-            logger.info('reached the end (icount %s)' % (last_icount - 1))
+            self.log.info('reached the end (icount %s)' % (last_icount - 1))
         else:
-            logger.info('hit a breakpoint again at %x (icount %s)' %
+            self.log.info('hit a breakpoint again at %x (icount %s)' %
                         (self.get_pc(gdb), self.vm_get_icount(vm)))
 
-        logger.info('running reverse continue to reach %x' % steps[-1])
+        self.log.info('running reverse continue to reach %x' % steps[-1])
         # reverse continue - will return after stopping at the breakpoint
         gdb.cli("reverse-continue")
 
@@ -195,8 +190,8 @@ class ReverseDebugging(LinuxKernelTest):
         if pc != steps[-1]:
             self.fail("'reverse-continue' did not hit the first PC in reverse order!")
 
-        logger.info('successfully reached %x' % steps[-1])
+        self.log.info('successfully reached %x' % steps[-1])
 
-        logger.info('exiting gdb and qemu')
+        self.log.info('exiting gdb and qemu')
         gdb.exit()
         vm.shutdown()

From 03ec40942d678ef1e98439508d1cdb2c05ff3e72 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 14 Oct 2025 15:00:47 +0100
Subject: [PATCH 1423/2396] tests/functional: ensure GDB client is stopped on
 error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the reverse_debugging_run method fails, the GDB client will not
be closed resulting in python complaining about resource leaks.
Hoisting the GDB client creation into the caller allows this to
be cleaned up easily. While doing this, also move the VM shutdown
call to match.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251014140047.385347-3-berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/reverse_debugging.py | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/tests/functional/reverse_debugging.py b/tests/functional/reverse_debugging.py
index 2c37a62cd0..86fca8d81f 100644
--- a/tests/functional/reverse_debugging.py
+++ b/tests/functional/reverse_debugging.py
@@ -96,7 +96,14 @@ class ReverseDebugging(LinuxKernelTest):
 
         try:
             self.log.info('Connecting to gdbstub...')
-            self.reverse_debugging_run(vm, port, gdb_arch, last_icount)
+            gdb_cmd = os.getenv('QEMU_TEST_GDB')
+            gdb = GDB(gdb_cmd)
+            try:
+                self.reverse_debugging_run(gdb, vm, port, gdb_arch, last_icount)
+            finally:
+                self.log.info('exiting gdb and qemu')
+                gdb.exit()
+                vm.shutdown()
             self.log.info('Test passed.')
         except GDB.TimeoutError:
             # Convert a GDB timeout exception into a unittest failure exception.
@@ -107,10 +114,7 @@ class ReverseDebugging(LinuxKernelTest):
             # skipTest(), etc.
             raise
 
-    def reverse_debugging_run(self, vm, port, gdb_arch, last_icount):
-        gdb_cmd = os.getenv('QEMU_TEST_GDB')
-        gdb = GDB(gdb_cmd)
-
+    def reverse_debugging_run(self, gdb, vm, port, gdb_arch, last_icount):
         r = gdb.cli("set architecture").get_log()
         if gdb_arch not in r:
             self.skipTest(f"GDB does not support arch '{gdb_arch}'")
@@ -191,7 +195,3 @@ class ReverseDebugging(LinuxKernelTest):
             self.fail("'reverse-continue' did not hit the first PC in reverse order!")
 
         self.log.info('successfully reached %x' % steps[-1])
-
-        self.log.info('exiting gdb and qemu')
-        gdb.exit()
-        vm.shutdown()

From 02cf15e9bbe902523f5a1deb1dd48aef50e26e41 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 16:14:08 +0200
Subject: [PATCH 1424/2396] target/s390x/mmu_helper: Simplify
 s390_cpu_virt_mem_rw() logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to simplify the next commit, move the
trigger_access_exception() call after the address_space_rw()
calls. No logical change intended.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251008141410.99865-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/mmu_helper.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 487c41bf93..22d3d4a97d 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -541,9 +541,7 @@ int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
     pages = g_malloc(nr_pages * sizeof(*pages));
 
     ret = translate_pages(cpu, laddr, nr_pages, pages, is_write, &tec);
-    if (ret) {
-        trigger_access_exception(&cpu->env, ret, tec);
-    } else if (hostbuf != NULL) {
+    if (ret == 0 && hostbuf != NULL) {
         AddressSpace *as = CPU(cpu)->as;
 
         /* Copy data by stepping through the area page by page */
@@ -556,6 +554,9 @@ int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
             len -= currlen;
         }
     }
+    if (ret) {
+        trigger_access_exception(&cpu->env, ret, tec);
+    }
 
     g_free(pages);
     return ret;

From d6f7f9254e333c56226bb7051e74ea57daea2fff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 8 Oct 2025 16:14:09 +0200
Subject: [PATCH 1425/2396] target/s390x/mmu_helper: Do not ignore
 address_space_rw() errors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If a address_space_rw() call ever fails, break the loop and
return the PGM_ADDRESSING error (after triggering an access
exception).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251008141410.99865-3-philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/mmu_helper.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/target/s390x/mmu_helper.c b/target/s390x/mmu_helper.c
index 22d3d4a97d..3b1e75f783 100644
--- a/target/s390x/mmu_helper.c
+++ b/target/s390x/mmu_helper.c
@@ -546,9 +546,15 @@ int s390_cpu_virt_mem_rw(S390CPU *cpu, vaddr laddr, uint8_t ar, void *hostbuf,
 
         /* Copy data by stepping through the area page by page */
         for (i = 0; i < nr_pages; i++) {
+            MemTxResult res;
+
             currlen = MIN(len, TARGET_PAGE_SIZE - (laddr % TARGET_PAGE_SIZE));
-            address_space_rw(as, pages[i] | (laddr & ~TARGET_PAGE_MASK),
-                             attrs, hostbuf, currlen, is_write);
+            res = address_space_rw(as, pages[i] | (laddr & ~TARGET_PAGE_MASK),
+                                   attrs, hostbuf, currlen, is_write);
+            if (res != MEMTX_OK) {
+                ret = PGM_ADDRESSING;
+                break;
+            }
             laddr += currlen;
             hostbuf += currlen;
             len -= currlen;

From 3bf9701ccd4c8a078c7ef016e87240f11a4754d3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:52:05 +0200
Subject: [PATCH 1426/2396] gitlab: Stop cross-testing for 32-bit MIPS hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

32-bit host support is deprecated since commit 6d701c9bac1
("meson: Deprecate 32-bit host support"). Next commits will
remove support for 32-bit MIPS hosts. Stop cross-building
QEMU on our CI.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009195210.33161-3-philmd@linaro.org>
---
 .gitlab-ci.d/container-cross.yml |  6 ------
 .gitlab-ci.d/crossbuilds.yml     | 14 --------------
 2 files changed, 20 deletions(-)

diff --git a/.gitlab-ci.d/container-cross.yml b/.gitlab-ci.d/container-cross.yml
index 8d3be53b75..0fd7341afa 100644
--- a/.gitlab-ci.d/container-cross.yml
+++ b/.gitlab-ci.d/container-cross.yml
@@ -52,12 +52,6 @@ mips64el-debian-cross-container:
   variables:
     NAME: debian-mips64el-cross
 
-mipsel-debian-cross-container:
-  extends: .container_job_template
-  stage: containers
-  variables:
-    NAME: debian-mipsel-cross
-
 ppc64el-debian-cross-container:
   extends: .container_job_template
   stage: containers
diff --git a/.gitlab-ci.d/crossbuilds.yml b/.gitlab-ci.d/crossbuilds.yml
index 8ff0c27f74..99dfa7eea6 100644
--- a/.gitlab-ci.d/crossbuilds.yml
+++ b/.gitlab-ci.d/crossbuilds.yml
@@ -68,20 +68,6 @@ cross-i686-tci:
     # would otherwise be using a parallelism of 9.
     MAKE_CHECK_ARGS: check check-tcg -j2
 
-cross-mipsel-system:
-  extends: .cross_system_build_job
-  needs:
-    - job: mipsel-debian-cross-container
-  variables:
-    IMAGE: debian-mipsel-cross
-
-cross-mipsel-user:
-  extends: .cross_user_build_job
-  needs:
-    - job: mipsel-debian-cross-container
-  variables:
-    IMAGE: debian-mipsel-cross
-
 cross-mips64el-system:
   extends: .cross_system_build_job
   needs:

From 269ffaabc84e5c03226d7845318ca28eb3f180be Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:52:10 +0200
Subject: [PATCH 1427/2396] buildsys: Remove support for 32-bit MIPS hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stop detecting 32-bit MIPS host as supported, update the
deprecation document. See previous commit for rationale.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009195210.33161-8-philmd@linaro.org>
---
 configure                       |  7 -------
 docs/about/deprecated.rst       | 13 +++++--------
 docs/about/removed-features.rst |  6 ++++++
 3 files changed, 11 insertions(+), 15 deletions(-)

diff --git a/configure b/configure
index 461b53dd60..8263f81370 100755
--- a/configure
+++ b/configure
@@ -404,8 +404,6 @@ elif check_define _ARCH_PPC ; then
 elif check_define __mips__ ; then
   if check_define __mips64 ; then
     cpu="mips64"
-  else
-    cpu="mips"
   fi
 elif check_define __s390__ ; then
   if check_define __s390x__ ; then
@@ -473,11 +471,6 @@ case "$cpu" in
     host_arch=mips
     linux_arch=mips
     ;;
-  mips*)
-    cpu=mips
-    host_arch=mips
-    linux_arch=mips
-    ;;
 
   ppc)
     host_arch=ppc
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 98361f5832..dacf2882e4 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -172,17 +172,14 @@ This argument has always been ignored.
 Host Architectures
 ------------------
 
-Big endian MIPS since 7.2; 32-bit little endian MIPS since 9.2, MIPS since 11.0
-'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+MIPS (since 11.0)
+'''''''''''''''''
 
-As Debian 10 ("Buster") moved into LTS the big endian 32 bit version of
-MIPS moved out of support making it hard to maintain our
-cross-compilation CI tests of the architecture. As we no longer have
-CI coverage support may bitrot away before the deprecation process
+MIPS is not supported by Debian 13 ("Trixie") and newer, making it hard to
+maintain our cross-compilation CI tests of the architecture. As we no longer
+have CI coverage support may bitrot away before the deprecation process
 completes.
 
-Likewise, MIPS is not supported by Debian 13 ("Trixie") and newer.
-
 System emulation on 32-bit x86 hosts (since 8.0)
 ''''''''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index a5338e44c2..53829f59e6 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -896,6 +896,12 @@ work around the atomicity issues in system mode by running all vCPUs
 in a single thread context; in user mode atomicity was simply broken.
 From 10.0, QEMU has disabled configuration of 64-bit guests on 32-bit hosts.
 
+32-bit MIPS (since 11.0)
+''''''''''''''''''''''''
+
+Debian 12 "Bookworm" removed support for 32-bit MIPS, making it hard to
+maintain our cross-compilation CI tests of the architecture.
+
 Guest Emulator ISAs
 -------------------
 

From 4384542a575a87d31405ec2f4ee1bbab2b77a0bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:52:09 +0200
Subject: [PATCH 1428/2396] kvm/mips: Remove support for 32-bit hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See previous commit for rationale.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009195210.33161-7-philmd@linaro.org>
---
 meson.build | 2 --
 1 file changed, 2 deletions(-)

diff --git a/meson.build b/meson.build
index afaefa0172..c5710a6a47 100644
--- a/meson.build
+++ b/meson.build
@@ -295,8 +295,6 @@ elif cpu == 'ppc'
   kvm_targets = ['ppc-softmmu']
 elif cpu == 'ppc64'
   kvm_targets = ['ppc-softmmu', 'ppc64-softmmu']
-elif cpu == 'mips'
-  kvm_targets = ['mips-softmmu', 'mipsel-softmmu']
 elif cpu == 'mips64'
   kvm_targets = ['mips-softmmu', 'mipsel-softmmu', 'mips64-softmmu', 'mips64el-softmmu']
 elif cpu == 'riscv32'

From affedc6787a99f9d4f62da2a2cb80658615755b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:52:07 +0200
Subject: [PATCH 1429/2396] tcg/mips: Remove support for O32 and N32 ABIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See previous commit for rationale.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009195210.33161-5-philmd@linaro.org>
---
 common-user/host/mips/safe-syscall.inc.S | 35 ------------------------
 tcg/mips/tcg-target-reg-bits.h           |  8 ++----
 tcg/mips/tcg-target.c.inc                | 26 ++++--------------
 3 files changed, 9 insertions(+), 60 deletions(-)

diff --git a/common-user/host/mips/safe-syscall.inc.S b/common-user/host/mips/safe-syscall.inc.S
index 6a44614970..3b196cc634 100644
--- a/common-user/host/mips/safe-syscall.inc.S
+++ b/common-user/host/mips/safe-syscall.inc.S
@@ -30,15 +30,9 @@
          * arguments being syscall arguments (also 'long').
          */
 
-#if _MIPS_SIM == _ABIO32
-/* 8 * 4 = 32 for outgoing parameters; 1 * 4 for s0 save; 1 * 4 for align. */
-#define FRAME    40
-#define OFS_S0   32
-#else
 /* 1 * 8 for s0 save; 1 * 8 for align. */
 #define FRAME    16
 #define OFS_S0   0
-#endif
 
 
 NESTED(safe_syscall_base, FRAME, ra)
@@ -47,34 +41,6 @@ NESTED(safe_syscall_base, FRAME, ra)
         .cfi_adjust_cfa_offset FRAME
         REG_S   s0, OFS_S0(sp)
         .cfi_rel_offset s0, OFS_S0
-#if _MIPS_SIM == _ABIO32
-        /*
-         * The syscall calling convention is nearly the same as C:
-         * we enter with a0 == &signal_pending
-         *               a1 == syscall number
-         *               a2, a3, stack == syscall arguments
-         *               and return the result in a0
-         * and the syscall instruction needs
-         *               v0 == syscall number
-         *               a0 ... a3, stack == syscall arguments
-         *               and returns the result in v0
-         * Shuffle everything around appropriately.
-         */
-        move    s0, a0          /* signal_pending pointer */
-        move    v0, a1          /* syscall number */
-        move    a0, a2          /* syscall arguments */
-        move    a1, a3
-        lw      a2, FRAME+16(sp)
-        lw      a3, FRAME+20(sp)
-        lw      t4, FRAME+24(sp)
-        lw      t5, FRAME+28(sp)
-        lw      t6, FRAME+32(sp)
-        lw      t7, FRAME+40(sp)
-        sw      t4, 16(sp)
-        sw      t5, 20(sp)
-        sw      t6, 24(sp)
-        sw      t7, 28(sp)
-#else
         /*
          * The syscall calling convention is nearly the same as C:
          * we enter with a0 == &signal_pending
@@ -95,7 +61,6 @@ NESTED(safe_syscall_base, FRAME, ra)
         move    a3, a5
         move    a4, a6
         move    a5, a7
-#endif
 
         /*
          * This next sequence of code works in conjunction with the
diff --git a/tcg/mips/tcg-target-reg-bits.h b/tcg/mips/tcg-target-reg-bits.h
index 56fe0a725e..ee346a3f25 100644
--- a/tcg/mips/tcg-target-reg-bits.h
+++ b/tcg/mips/tcg-target-reg-bits.h
@@ -7,12 +7,10 @@
 #ifndef TCG_TARGET_REG_BITS_H
 #define TCG_TARGET_REG_BITS_H
 
-#if _MIPS_SIM == _ABIO32
-# define TCG_TARGET_REG_BITS 32
-#elif _MIPS_SIM == _ABIN32 || _MIPS_SIM == _ABI64
-# define TCG_TARGET_REG_BITS 64
-#else
+#if !defined(_MIPS_SIM) || _MIPS_SIM != _ABI64
 # error "Unknown ABI"
 #endif
 
+#define TCG_TARGET_REG_BITS 64
+
 #endif
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 400eafbab4..4d9d029844 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -26,16 +26,10 @@
 
 /* used for function call generation */
 #define TCG_TARGET_STACK_ALIGN        16
-#if _MIPS_SIM == _ABIO32
-# define TCG_TARGET_CALL_STACK_OFFSET 16
-# define TCG_TARGET_CALL_ARG_I64      TCG_CALL_ARG_EVEN
-# define TCG_TARGET_CALL_RET_I128     TCG_CALL_RET_BY_REF
-#else
-# define TCG_TARGET_CALL_STACK_OFFSET 0
-# define TCG_TARGET_CALL_ARG_I64      TCG_CALL_ARG_NORMAL
-# define TCG_TARGET_CALL_RET_I128     TCG_CALL_RET_NORMAL
-#endif
+#define TCG_TARGET_CALL_STACK_OFFSET  0
 #define TCG_TARGET_CALL_ARG_I32       TCG_CALL_ARG_NORMAL
+#define TCG_TARGET_CALL_ARG_I64       TCG_CALL_ARG_NORMAL
+#define TCG_TARGET_CALL_RET_I128      TCG_CALL_RET_NORMAL
 #define TCG_TARGET_CALL_ARG_I128      TCG_CALL_ARG_EVEN
 
 #if TCG_TARGET_REG_BITS == 32
@@ -135,12 +129,10 @@ static const TCGReg tcg_target_call_iarg_regs[] = {
     TCG_REG_A1,
     TCG_REG_A2,
     TCG_REG_A3,
-#if _MIPS_SIM == _ABIN32 || _MIPS_SIM == _ABI64
     TCG_REG_T0,
     TCG_REG_T1,
     TCG_REG_T2,
     TCG_REG_T3,
-#endif
 };
 
 static TCGReg tcg_target_call_oarg_reg(TCGCallReturnKind kind, int slot)
@@ -1053,17 +1045,11 @@ static void tcg_out_call_int(TCGContext *s, const tcg_insn_unit *arg, bool tail)
      * Note that __mips_abicalls requires the called function's address
      * to be loaded into $25 (t9), even if a direct branch is in range.
      *
-     * For n64, always drop the pointer into the constant pool.
-     * We can re-use helper addresses often and do not want any
-     * of the longer sequences tcg_out_movi may try.
+     * We can re-use helper addresses often; always drop the pointer
+     * into the constant pool.
      */
-    if (sizeof(uintptr_t) == 8) {
-        tcg_out_movi_pool(s, TCG_REG_T9, (uintptr_t)arg, TCG_REG_TB);
-    } else {
-        tcg_out_movi(s, TCG_TYPE_PTR, TCG_REG_T9, (uintptr_t)arg);
-    }
+    tcg_out_movi_pool(s, TCG_REG_T9, (uintptr_t)arg, TCG_REG_TB);
 
-    /* But do try a direct branch, allowing the cpu better insn prefetch.  */
     if (tail) {
         if (!tcg_out_opc_jmp(s, OPC_J, arg)) {
             tcg_out_opc_reg(s, OPC_JR, 0, TCG_REG_T9, 0);

From f032bff1aec890e93264ec7c90773fa790540bc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 9 Oct 2025 21:52:08 +0200
Subject: [PATCH 1430/2396] tcg/mips: Remove support for 32-bit hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

32-bit host support is deprecated since commit 6d701c9bac1
("meson: Deprecate 32-bit host support"), released as v10.0.
The next release being v10.2, we can remove the TCG backend
for 32-bit MIPS hosts.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251009195210.33161-6-philmd@linaro.org>
---
 tcg/mips/tcg-target-has.h |   2 -
 tcg/mips/tcg-target.c.inc | 285 +++++---------------------------------
 2 files changed, 38 insertions(+), 249 deletions(-)

diff --git a/tcg/mips/tcg-target-has.h b/tcg/mips/tcg-target-has.h
index b9eb338528..88f0145efb 100644
--- a/tcg/mips/tcg-target-has.h
+++ b/tcg/mips/tcg-target-has.h
@@ -39,11 +39,9 @@ extern bool use_mips32r2_instructions;
 #endif
 
 /* optional instructions */
-#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     1
 #define TCG_TARGET_HAS_ext32s_i64       1
 #define TCG_TARGET_HAS_ext32u_i64       1
-#endif
 
 /* optional instructions detected at runtime */
 #define TCG_TARGET_HAS_qemu_ldst_i128   0
diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 4d9d029844..51a15705cb 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -32,15 +32,6 @@
 #define TCG_TARGET_CALL_RET_I128      TCG_CALL_RET_NORMAL
 #define TCG_TARGET_CALL_ARG_I128      TCG_CALL_ARG_EVEN
 
-#if TCG_TARGET_REG_BITS == 32
-# define LO_OFF  (HOST_BIG_ENDIAN * 4)
-# define HI_OFF  (4 - LO_OFF)
-#else
-/* Assert at compile-time that these values are never used for 64-bit. */
-# define LO_OFF  ({ qemu_build_not_reached(); 0; })
-# define HI_OFF  ({ qemu_build_not_reached(); 0; })
-#endif
-
 #ifdef CONFIG_DEBUG_TCG
 static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
     "zero",
@@ -84,11 +75,7 @@ static const char * const tcg_target_reg_names[TCG_TARGET_NB_REGS] = {
 #define TCG_TMP3  TCG_REG_T7
 
 #define TCG_GUEST_BASE_REG TCG_REG_S7
-#if TCG_TARGET_REG_BITS == 64
 #define TCG_REG_TB         TCG_REG_S6
-#else
-#define TCG_REG_TB         ({ qemu_build_not_reached(); TCG_REG_ZERO; })
-#endif
 
 /* check if we really need so many registers :P */
 static const int tcg_target_reg_alloc_order[] = {
@@ -559,7 +546,7 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     tcg_target_long tmp;
     int sh, lo;
 
-    if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
+    if (type == TCG_TYPE_I32) {
         arg = (int32_t)arg;
     }
 
@@ -567,7 +554,6 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     if (tcg_out_movi_two(s, ret, arg)) {
         return;
     }
-    assert(TCG_TARGET_REG_BITS == 64);
 
     /* Load addresses within 2GB of TB with 1 or 3 insns. */
     tmp = tcg_tbrel_diff(s, (void *)arg);
@@ -630,8 +616,7 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
 static void tcg_out_movi(TCGContext *s, TCGType type,
                          TCGReg ret, tcg_target_long arg)
 {
-    TCGReg tbreg = TCG_TARGET_REG_BITS == 64 ? TCG_REG_TB : 0;
-    tcg_out_movi_int(s, type, ret, arg, tbreg);
+    tcg_out_movi_int(s, type, ret, arg, TCG_REG_TB);
 }
 
 static void tcg_out_ext8s(TCGContext *s, TCGType type, TCGReg rd, TCGReg rs)
@@ -658,7 +643,6 @@ static void tcg_out_ext16u(TCGContext *s, TCGReg rd, TCGReg rs)
 
 static void tcg_out_ext32s(TCGContext *s, TCGReg rd, TCGReg rs)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out_opc_sa(s, OPC_SLL, rd, rs, 0);
 }
 
@@ -701,7 +685,6 @@ static void tcg_out_bswap_subr(TCGContext *s, const tcg_insn_unit *sub)
 
 static void tcg_out_ext32u(TCGContext *s, TCGReg ret, TCGReg arg)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     if (use_mips32r2_instructions) {
         tcg_out_opc_bf(s, OPC_DEXT, ret, arg, 31, 0);
     } else {
@@ -727,20 +710,14 @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
 static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg arg,
                        TCGReg arg1, intptr_t arg2)
 {
-    MIPSInsn opc = OPC_LD;
-    if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
-        opc = OPC_LW;
-    }
+    MIPSInsn opc = type == TCG_TYPE_I32 ? OPC_LW : OPC_LD;
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
 static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
                        TCGReg arg1, intptr_t arg2)
 {
-    MIPSInsn opc = OPC_SD;
-    if (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I32) {
-        opc = OPC_SW;
-    }
+    MIPSInsn opc = type == TCG_TYPE_I32 ? OPC_SW : OPC_SD;
     tcg_out_ldst(s, opc, arg, arg1, arg2);
 }
 
@@ -918,72 +895,6 @@ void tcg_out_br(TCGContext *s, TCGLabel *l)
     tgen_brcond(s, TCG_TYPE_I32, TCG_COND_EQ, TCG_REG_ZERO, TCG_REG_ZERO, l);
 }
 
-static int tcg_out_setcond2_int(TCGContext *s, TCGCond cond, TCGReg ret,
-                                TCGReg al, TCGReg ah, TCGReg bl, TCGReg bh)
-{
-    int flags = 0;
-
-    switch (cond) {
-    case TCG_COND_EQ:
-        flags |= SETCOND_INV;
-        /* fall through */
-    case TCG_COND_NE:
-        flags |= SETCOND_NEZ;
-        tcg_out_opc_reg(s, OPC_XOR, TCG_TMP0, al, bl);
-        tcg_out_opc_reg(s, OPC_XOR, TCG_TMP1, ah, bh);
-        tcg_out_opc_reg(s, OPC_OR, ret, TCG_TMP0, TCG_TMP1);
-        break;
-
-    default:
-        tgen_setcond(s, TCG_TYPE_I32, TCG_COND_EQ, TCG_TMP0, ah, bh);
-        tgen_setcond(s, TCG_TYPE_I32, tcg_unsigned_cond(cond),
-                     TCG_TMP1, al, bl);
-        tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, TCG_TMP0);
-        tgen_setcond(s, TCG_TYPE_I32, tcg_high_cond(cond), TCG_TMP0, ah, bh);
-        tcg_out_opc_reg(s, OPC_OR, ret, TCG_TMP0, TCG_TMP1);
-        break;
-    }
-    return ret | flags;
-}
-
-static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
-                          TCGReg al, TCGReg ah,
-                          TCGArg bl, bool const_bl,
-                          TCGArg bh, bool const_bh)
-{
-    int tmpflags = tcg_out_setcond2_int(s, cond, ret, al, ah, bl, bh);
-    tcg_out_setcond_end(s, ret, tmpflags);
-}
-
-#if TCG_TARGET_REG_BITS != 32
-__attribute__((unused))
-#endif
-static const TCGOutOpSetcond2 outop_setcond2 = {
-    .base.static_constraint = C_O1_I4(r, r, r, rz, rz),
-    .out = tgen_setcond2,
-};
-
-static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
-                         TCGArg bl, bool const_bl,
-                         TCGArg bh, bool const_bh, TCGLabel *l)
-{
-    int tmpflags = tcg_out_setcond2_int(s, cond, TCG_TMP0, al, ah, bl, bh);
-    TCGReg tmp = tmpflags & ~SETCOND_FLAGS;
-    MIPSInsn b_opc = tmpflags & SETCOND_INV ? OPC_BEQ : OPC_BNE;
-
-    tcg_out_reloc(s, s->code_ptr, R_MIPS_PC16, l, 0);
-    tcg_out_opc_br(s, b_opc, tmp, TCG_REG_ZERO);
-    tcg_out_nop(s);
-}
-
-#if TCG_TARGET_REG_BITS != 32
-__attribute__((unused))
-#endif
-static const TCGOutOpBrcond2 outop_brcond2 = {
-    .base.static_constraint = C_O0_I4(r, r, rz, rz),
-    .out = tgen_brcond2,
-};
-
 static void tgen_movcond(TCGContext *s, TCGType type, TCGCond cond,
                          TCGReg ret, TCGReg c1, TCGArg c2, bool const_c2,
                          TCGArg v1, bool const_v1, TCGArg v2, bool const_v2)
@@ -1183,7 +1094,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_TMP1, TCG_AREG0, table_off);
 
         /* Extract the TLB index from the address into TMP3.  */
-        if (TCG_TARGET_REG_BITS == 32 || addr_type == TCG_TYPE_I32) {
+        if (addr_type == TCG_TYPE_I32) {
             tcg_out_opc_sa(s, OPC_SRL, TCG_TMP3, addr,
                            TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         } else {
@@ -1195,7 +1106,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         tcg_out_opc_reg(s, ALIAS_PADD, TCG_TMP3, TCG_TMP3, TCG_TMP1);
 
         /* Load the tlb comparator.  */
-        if (TCG_TARGET_REG_BITS == 64 && addr_type == TCG_TYPE_I32) {
+        if (addr_type == TCG_TYPE_I32) {
             tcg_out_ld(s, TCG_TYPE_I32, TCG_TMP0, TCG_TMP3,
                        cmp_off + HOST_BIG_ENDIAN * 4);
         } else {
@@ -1212,8 +1123,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          */
         tcg_out_movi(s, addr_type, TCG_TMP1, TARGET_PAGE_MASK | a_mask);
         if (a_mask < s_mask) {
-            tcg_out_opc_imm(s, (TCG_TARGET_REG_BITS == 32
-                                || addr_type == TCG_TYPE_I32
+            tcg_out_opc_imm(s, (addr_type == TCG_TYPE_I32
                                 ? OPC_ADDIU : OPC_DADDIU),
                             TCG_TMP2, addr, s_mask - a_mask);
             tcg_out_opc_reg(s, OPC_AND, TCG_TMP1, TCG_TMP1, TCG_TMP2);
@@ -1222,7 +1132,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         }
 
         /* Zero extend a 32-bit guest address for a 64-bit host. */
-        if (TCG_TARGET_REG_BITS == 64 && addr_type == TCG_TYPE_I32) {
+        if (addr_type == TCG_TYPE_I32) {
             tcg_out_ext32u(s, TCG_TMP2, addr);
             addr = TCG_TMP2;
         }
@@ -1255,7 +1165,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         }
 
         base = addr;
-        if (TCG_TARGET_REG_BITS == 64 && addr_type == TCG_TYPE_I32) {
+        if (addr_type == TCG_TYPE_I32) {
             tcg_out_ext32u(s, TCG_REG_A0, base);
             base = TCG_REG_A0;
         }
@@ -1291,7 +1201,7 @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         tcg_out_opc_imm(s, OPC_LH, lo, base, 0);
         break;
     case MO_UL:
-        if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I64) {
+        if (type == TCG_TYPE_I64) {
             tcg_out_opc_imm(s, OPC_LWU, lo, base, 0);
             break;
         }
@@ -1300,16 +1210,7 @@ static void tcg_out_qemu_ld_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         tcg_out_opc_imm(s, OPC_LW, lo, base, 0);
         break;
     case MO_UQ:
-        /* Prefer to load from offset 0 first, but allow for overlap.  */
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_opc_imm(s, OPC_LD, lo, base, 0);
-        } else if (HOST_BIG_ENDIAN ? hi != base : lo == base) {
-            tcg_out_opc_imm(s, OPC_LW, hi, base, HI_OFF);
-            tcg_out_opc_imm(s, OPC_LW, lo, base, LO_OFF);
-        } else {
-            tcg_out_opc_imm(s, OPC_LW, lo, base, LO_OFF);
-            tcg_out_opc_imm(s, OPC_LW, hi, base, HI_OFF);
-        }
+        tcg_out_opc_imm(s, OPC_LD, lo, base, 0);
         break;
     default:
         g_assert_not_reached();
@@ -1351,21 +1252,14 @@ static void tcg_out_qemu_ld_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
     case MO_32:
         tcg_out_opc_imm(s, lw1, lo, base, 0);
         tcg_out_opc_imm(s, lw2, lo, base, 3);
-        if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I64 && !sgn) {
+        if (type == TCG_TYPE_I64 && !sgn) {
             tcg_out_ext32u(s, lo, lo);
         }
         break;
 
     case MO_64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_opc_imm(s, ld1, lo, base, 0);
-            tcg_out_opc_imm(s, ld2, lo, base, 7);
-        } else {
-            tcg_out_opc_imm(s, lw1, HOST_BIG_ENDIAN ? hi : lo, base, 0 + 0);
-            tcg_out_opc_imm(s, lw2, HOST_BIG_ENDIAN ? hi : lo, base, 0 + 3);
-            tcg_out_opc_imm(s, lw1, HOST_BIG_ENDIAN ? lo : hi, base, 4 + 0);
-            tcg_out_opc_imm(s, lw2, HOST_BIG_ENDIAN ? lo : hi, base, 4 + 3);
-        }
+        tcg_out_opc_imm(s, ld1, lo, base, 0);
+        tcg_out_opc_imm(s, ld2, lo, base, 7);
         break;
 
     default:
@@ -1401,36 +1295,8 @@ static const TCGOutOpQemuLdSt outop_qemu_ld = {
     .out = tgen_qemu_ld,
 };
 
-static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
-                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
-{
-    MemOp opc = get_memop(oi);
-    TCGLabelQemuLdst *ldst;
-    HostAddress h;
-
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
-    ldst = prepare_host_addr(s, &h, addr, oi, true);
-
-    if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
-        tcg_out_qemu_ld_direct(s, datalo, datahi, h.base, opc, type);
-    } else {
-        tcg_out_qemu_ld_unalign(s, datalo, datahi, h.base, opc, type);
-    }
-
-    if (ldst) {
-        ldst->type = type;
-        ldst->datalo_reg = datalo;
-        ldst->datahi_reg = datahi;
-        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
-    }
-}
-
 static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
-    /* Ensure that the mips32 code is compiled but discarded for mips64. */
-    .base.static_constraint =
-        TCG_TARGET_REG_BITS == 32 ? C_O2_I1(r, r, r) : C_NotImplemented,
-    .out =
-        TCG_TARGET_REG_BITS == 32 ? tgen_qemu_ld2 : NULL,
+    .base.static_constraint = C_NotImplemented,
 };
 
 static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
@@ -1447,12 +1313,7 @@ static void tcg_out_qemu_st_direct(TCGContext *s, TCGReg lo, TCGReg hi,
         tcg_out_opc_imm(s, OPC_SW, lo, base, 0);
         break;
     case MO_64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_opc_imm(s, OPC_SD, lo, base, 0);
-        } else {
-            tcg_out_opc_imm(s, OPC_SW, HOST_BIG_ENDIAN ? hi : lo, base, 0);
-            tcg_out_opc_imm(s, OPC_SW, HOST_BIG_ENDIAN ? lo : hi, base, 4);
-        }
+        tcg_out_opc_imm(s, OPC_SD, lo, base, 0);
         break;
     default:
         g_assert_not_reached();
@@ -1480,15 +1341,8 @@ static void tcg_out_qemu_st_unalign(TCGContext *s, TCGReg lo, TCGReg hi,
         break;
 
     case MO_64:
-        if (TCG_TARGET_REG_BITS == 64) {
-            tcg_out_opc_imm(s, sd1, lo, base, 0);
-            tcg_out_opc_imm(s, sd2, lo, base, 7);
-        } else {
-            tcg_out_opc_imm(s, sw1, HOST_BIG_ENDIAN ? hi : lo, base, 0 + 0);
-            tcg_out_opc_imm(s, sw2, HOST_BIG_ENDIAN ? hi : lo, base, 0 + 3);
-            tcg_out_opc_imm(s, sw1, HOST_BIG_ENDIAN ? lo : hi, base, 4 + 0);
-            tcg_out_opc_imm(s, sw2, HOST_BIG_ENDIAN ? lo : hi, base, 4 + 3);
-        }
+        tcg_out_opc_imm(s, sd1, lo, base, 0);
+        tcg_out_opc_imm(s, sd2, lo, base, 7);
         break;
 
     default:
@@ -1524,36 +1378,8 @@ static const TCGOutOpQemuLdSt outop_qemu_st = {
     .out = tgen_qemu_st,
 };
 
-static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
-                          TCGReg datahi, TCGReg addr, MemOpIdx oi)
-{
-    MemOp opc = get_memop(oi);
-    TCGLabelQemuLdst *ldst;
-    HostAddress h;
-
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
-    ldst = prepare_host_addr(s, &h, addr, oi, false);
-
-    if (use_mips32r6_instructions || h.aa.align >= (opc & MO_SIZE)) {
-        tcg_out_qemu_st_direct(s, datalo, datahi, h.base, opc);
-    } else {
-        tcg_out_qemu_st_unalign(s, datalo, datahi, h.base, opc);
-    }
-
-    if (ldst) {
-        ldst->type = type;
-        ldst->datalo_reg = datalo;
-        ldst->datahi_reg = datahi;
-        ldst->raddr = tcg_splitwx_to_rx(s->code_ptr);
-    }
-}
-
 static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
-    /* Ensure that the mips32 code is compiled but discarded for mips64. */
-    .base.static_constraint =
-        TCG_TARGET_REG_BITS == 32 ? C_O0_I3(rz, rz, r) : C_NotImplemented,
-    .out =
-        TCG_TARGET_REG_BITS == 32 ? tgen_qemu_st2 : NULL,
+    .base.static_constraint = C_NotImplemented,
 };
 
 static void tcg_out_mb(TCGContext *s, unsigned a0)
@@ -1578,22 +1404,14 @@ static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
     int16_t lo = 0;
 
     if (a0) {
-        intptr_t ofs;
-        if (TCG_TARGET_REG_BITS == 64) {
-            ofs = tcg_tbrel_diff(s, (void *)a0);
-            lo = ofs;
-            if (ofs == lo) {
-                base = TCG_REG_TB;
-            } else {
-                base = TCG_REG_V0;
-                tcg_out_movi(s, TCG_TYPE_PTR, base, ofs - lo);
-                tcg_out_opc_reg(s, ALIAS_PADD, base, base, TCG_REG_TB);
-            }
+        intptr_t ofs = tcg_tbrel_diff(s, (void *)a0);
+        lo = ofs;
+        if (ofs == lo) {
+            base = TCG_REG_TB;
         } else {
-            ofs = a0;
-            lo = ofs;
             base = TCG_REG_V0;
             tcg_out_movi(s, TCG_TYPE_PTR, base, ofs - lo);
+            tcg_out_opc_reg(s, ALIAS_PADD, base, base, TCG_REG_TB);
         }
     }
     if (!tcg_out_opc_jmp(s, OPC_J, tb_ret_addr)) {
@@ -1610,35 +1428,24 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
     TCGReg base, dest;
 
     /* indirect jump method */
-    if (TCG_TARGET_REG_BITS == 64) {
-        dest = TCG_REG_TB;
-        base = TCG_REG_TB;
-        ofs = tcg_tbrel_diff(s, (void *)ofs);
-    } else {
-        dest = TCG_TMP0;
-        base = TCG_REG_ZERO;
-    }
+    dest = TCG_REG_TB;
+    base = TCG_REG_TB;
+    ofs = tcg_tbrel_diff(s, (void *)ofs);
     tcg_out_ld(s, TCG_TYPE_PTR, dest, base, ofs);
     tcg_out_opc_reg(s, OPC_JR, 0, dest, 0);
     /* delay slot */
     tcg_out_nop(s);
 
     set_jmp_reset_offset(s, which);
-    if (TCG_TARGET_REG_BITS == 64) {
-        /* For the unlinked case, need to reset TCG_REG_TB. */
-        tcg_out_ldst(s, ALIAS_PADDI, TCG_REG_TB, TCG_REG_TB,
-                     -tcg_current_code_size(s));
-    }
+    /* For the unlinked case, need to reset TCG_REG_TB. */
+    tcg_out_ldst(s, ALIAS_PADDI, TCG_REG_TB, TCG_REG_TB,
+                 -tcg_current_code_size(s));
 }
 
 static void tcg_out_goto_ptr(TCGContext *s, TCGReg a0)
 {
     tcg_out_opc_reg(s, OPC_JR, 0, a0, 0);
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, a0);
-    } else {
-        tcg_out_nop(s);
-    }
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, a0);
 }
 
 void tb_target_set_jmp_target(const TranslationBlock *tb, int n,
@@ -1833,7 +1640,6 @@ static const TCGOutOpBinary outop_eqv = {
     .base.static_constraint = C_NotImplemented,
 };
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
 {
     tcg_out_dsra(s, a0, a1, 32);
@@ -1843,7 +1649,6 @@ static const TCGOutOpUnary outop_extrh_i64_i32 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_extrh_i64_i32,
 };
-#endif
 
 static void tgen_mul(TCGContext *s, TCGType type,
                      TCGReg a0, TCGReg a1, TCGReg a2)
@@ -2232,7 +2037,6 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 {
     if (use_mips32r2_instructions) {
@@ -2250,7 +2054,6 @@ static const TCGOutOpUnary outop_bswap64 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_bswap64,
 };
-#endif /* TCG_TARGET_REG_BITS == 64 */
 
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
@@ -2378,7 +2181,6 @@ static const TCGOutOpLoad outop_ld16s = {
     .out = tgen_ld16s,
 };
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
@@ -2400,7 +2202,6 @@ static const TCGOutOpLoad outop_ld32s = {
     .base.static_constraint = C_O1_I1(r, r),
     .out = tgen_ld32s,
 };
-#endif
 
 static void tgen_st8_r(TCGContext *s, TCGType type, TCGReg data,
                        TCGReg base, ptrdiff_t offset)
@@ -2539,7 +2340,7 @@ static tcg_insn_unit *align_code_ptr(TCGContext *s)
 }
 
 /* Stack frame parameters.  */
-#define REG_SIZE   (TCG_TARGET_REG_BITS / 8)
+#define REG_SIZE   8
 #define SAVE_SIZE  ((int)ARRAY_SIZE(tcg_target_callee_save_regs) * REG_SIZE)
 #define TEMP_SIZE  (CPU_TEMP_BUF_NLONGS * (int)sizeof(long))
 
@@ -2571,17 +2372,15 @@ static void tcg_target_qemu_prologue(TCGContext *s)
          * with the address of the prologue, so we can use that instead
          * of TCG_REG_TB.
          */
-#if TCG_TARGET_REG_BITS == 64 && !defined(__mips_abicalls)
+#if !defined(__mips_abicalls)
 # error "Unknown mips abi"
 #endif
         tcg_out_movi_int(s, TCG_TYPE_PTR, TCG_GUEST_BASE_REG, guest_base,
-                         TCG_TARGET_REG_BITS == 64 ? TCG_REG_T9 : 0);
+                         TCG_REG_T9);
         tcg_regset_set_reg(s->reserved_regs, TCG_GUEST_BASE_REG);
     }
 
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, tcg_target_call_iarg_regs[1]);
-    }
+    tcg_out_mov(s, TCG_TYPE_PTR, TCG_REG_TB, tcg_target_call_iarg_regs[1]);
 
     /* Call generated code */
     tcg_out_opc_reg(s, OPC_JR, 0, tcg_target_call_iarg_regs[1], 0);
@@ -2637,10 +2436,6 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     /* t3 = dcba -- delay slot */
     tcg_out_opc_reg(s, OPC_OR, TCG_TMP3, TCG_TMP3, TCG_TMP1);
 
-    if (TCG_TARGET_REG_BITS == 32) {
-        return;
-    }
-
     /*
      * bswap32u -- unsigned 32-bit swap.  a0 = ....abcd.
      */
@@ -2735,9 +2530,7 @@ static void tcg_target_init(TCGContext *s)
 {
     tcg_target_detect_isa();
     tcg_target_available_regs[TCG_TYPE_I32] = 0xffffffff;
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_target_available_regs[TCG_TYPE_I64] = 0xffffffff;
-    }
+    tcg_target_available_regs[TCG_TYPE_I64] = 0xffffffff;
 
     tcg_target_call_clobber_regs = 0;
     tcg_regset_set_reg(tcg_target_call_clobber_regs, TCG_REG_V0);
@@ -2768,9 +2561,7 @@ static void tcg_target_init(TCGContext *s)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_RA);   /* return address */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_SP);   /* stack pointer */
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_GP);   /* global pointer */
-    if (TCG_TARGET_REG_BITS == 64) {
-        tcg_regset_set_reg(s->reserved_regs, TCG_REG_TB); /* tc->tc_ptr */
-    }
+    tcg_regset_set_reg(s->reserved_regs, TCG_REG_TB);   /* tc->tc_ptr */
 }
 
 typedef struct {
@@ -2788,7 +2579,7 @@ static const DebugFrame debug_frame = {
     .h.cie.id = -1,
     .h.cie.version = 1,
     .h.cie.code_align = 1,
-    .h.cie.data_align = -(TCG_TARGET_REG_BITS / 8) & 0x7f, /* sleb128 */
+    .h.cie.data_align = -REG_SIZE & 0x7f, /* sleb128 */
     .h.cie.return_column = TCG_REG_RA,
 
     /* Total FDE size does not include the "len" member.  */

From 72258b05fd425936ceec80284eeb14ca29419beb Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Oct 2025 11:43:55 -0700
Subject: [PATCH 1431/2396] tcg/mips: Remove ALIAS_PADD, ALIAS_PADDI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These aliases existed to simplify code for O32 and N32.
Now that the 64-bit abi is the only one supported, we
can use the DADD* instructions directly.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/mips/tcg-target.c.inc | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/tcg/mips/tcg-target.c.inc b/tcg/mips/tcg-target.c.inc
index 51a15705cb..60c703a093 100644
--- a/tcg/mips/tcg-target.c.inc
+++ b/tcg/mips/tcg-target.c.inc
@@ -340,10 +340,6 @@ typedef enum {
     OPC_SYNC_ACQUIRE = OPC_SYNC | 0x11 << 6,
     OPC_SYNC_RELEASE = OPC_SYNC | 0x12 << 6,
     OPC_SYNC_RMB     = OPC_SYNC | 0x13 << 6,
-
-    /* Aliases for convenience.  */
-    ALIAS_PADD     = sizeof(void *) == 4 ? OPC_ADDU : OPC_DADDU,
-    ALIAS_PADDI    = sizeof(void *) == 4 ? OPC_ADDIU : OPC_DADDIU,
 } MIPSInsn;
 
 /*
@@ -700,7 +696,7 @@ static void tcg_out_ldst(TCGContext *s, MIPSInsn opc, TCGReg data,
     if (ofs != lo) {
         tcg_out_movi(s, TCG_TYPE_PTR, TCG_TMP0, ofs - lo);
         if (addr != TCG_REG_ZERO) {
-            tcg_out_opc_reg(s, ALIAS_PADD, TCG_TMP0, TCG_TMP0, addr);
+            tcg_out_opc_reg(s, OPC_DADDU, TCG_TMP0, TCG_TMP0, addr);
         }
         addr = TCG_TMP0;
     }
@@ -1103,7 +1099,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         tcg_out_opc_reg(s, OPC_AND, TCG_TMP3, TCG_TMP3, TCG_TMP0);
 
         /* Add the tlb_table pointer, creating the CPUTLBEntry address.  */
-        tcg_out_opc_reg(s, ALIAS_PADD, TCG_TMP3, TCG_TMP3, TCG_TMP1);
+        tcg_out_opc_reg(s, OPC_DADDU, TCG_TMP3, TCG_TMP3, TCG_TMP1);
 
         /* Load the tlb comparator.  */
         if (addr_type == TCG_TYPE_I32) {
@@ -1142,7 +1138,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
 
         /* delay slot */
         base = TCG_TMP3;
-        tcg_out_opc_reg(s, ALIAS_PADD, base, TCG_TMP3, addr);
+        tcg_out_opc_reg(s, OPC_DADDU, base, TCG_TMP3, addr);
     } else {
         if (a_mask && (use_mips32r6_instructions || a_bits != s_bits)) {
             ldst = new_ldst_label(s);
@@ -1171,9 +1167,9 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         }
         if (guest_base) {
             if (guest_base == (int16_t)guest_base) {
-                tcg_out_opc_imm(s, ALIAS_PADDI, TCG_REG_A0, base, guest_base);
+                tcg_out_opc_imm(s, OPC_DADDIU, TCG_REG_A0, base, guest_base);
             } else {
-                tcg_out_opc_reg(s, ALIAS_PADD, TCG_REG_A0, base,
+                tcg_out_opc_reg(s, OPC_DADDU, TCG_REG_A0, base,
                                 TCG_GUEST_BASE_REG);
             }
             base = TCG_REG_A0;
@@ -1411,7 +1407,7 @@ static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
         } else {
             base = TCG_REG_V0;
             tcg_out_movi(s, TCG_TYPE_PTR, base, ofs - lo);
-            tcg_out_opc_reg(s, ALIAS_PADD, base, base, TCG_REG_TB);
+            tcg_out_opc_reg(s, OPC_DADDU, base, base, TCG_REG_TB);
         }
     }
     if (!tcg_out_opc_jmp(s, OPC_J, tb_ret_addr)) {
@@ -1419,7 +1415,7 @@ static void tcg_out_exit_tb(TCGContext *s, uintptr_t a0)
         tcg_out_opc_reg(s, OPC_JR, 0, TCG_TMP0, 0);
     }
     /* delay slot */
-    tcg_out_opc_imm(s, ALIAS_PADDI, TCG_REG_V0, base, lo);
+    tcg_out_opc_imm(s, OPC_DADDIU, TCG_REG_V0, base, lo);
 }
 
 static void tcg_out_goto_tb(TCGContext *s, int which)
@@ -1438,7 +1434,7 @@ static void tcg_out_goto_tb(TCGContext *s, int which)
 
     set_jmp_reset_offset(s, which);
     /* For the unlinked case, need to reset TCG_REG_TB. */
-    tcg_out_ldst(s, ALIAS_PADDI, TCG_REG_TB, TCG_REG_TB,
+    tcg_out_ldst(s, OPC_DADDIU, TCG_REG_TB, TCG_REG_TB,
                  -tcg_current_code_size(s));
 }
 
@@ -2360,7 +2356,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
     tcg_set_frame(s, TCG_REG_SP, TCG_STATIC_CALL_ARGS_SIZE, TEMP_SIZE);
 
     /* TB prologue */
-    tcg_out_opc_imm(s, ALIAS_PADDI, TCG_REG_SP, TCG_REG_SP, -FRAME_SIZE);
+    tcg_out_opc_imm(s, OPC_DADDIU, TCG_REG_SP, TCG_REG_SP, -FRAME_SIZE);
     for (i = 0; i < ARRAY_SIZE(tcg_target_callee_save_regs); i++) {
         tcg_out_st(s, TCG_TYPE_REG, tcg_target_callee_save_regs[i],
                    TCG_REG_SP, SAVE_OFS + i * REG_SIZE);
@@ -2403,7 +2399,7 @@ static void tcg_target_qemu_prologue(TCGContext *s)
 
     tcg_out_opc_reg(s, OPC_JR, 0, TCG_REG_RA, 0);
     /* delay slot */
-    tcg_out_opc_imm(s, ALIAS_PADDI, TCG_REG_SP, TCG_REG_SP, FRAME_SIZE);
+    tcg_out_opc_imm(s, OPC_DADDIU, TCG_REG_SP, TCG_REG_SP, FRAME_SIZE);
 
     if (use_mips32r2_instructions) {
         return;

From 2ff8c9a2984bb20e350ae52152812c5370b02e32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 14 Oct 2025 19:38:59 +0200
Subject: [PATCH 1432/2396] buildsys: Remove support for 32-bit PPC hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stop detecting 32-bit PPC host as supported.
See previous commit for rationale.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[rth: Retain _ARCH_PPC64 check in udiv_qrnnd]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251014173900.87497-4-philmd@linaro.org>
---
 configure            | 19 +++++--------------
 disas/disas-host.c   |  4 +---
 include/qemu/timer.h | 13 +------------
 util/cacheflush.c    |  4 ++--
 4 files changed, 9 insertions(+), 31 deletions(-)

diff --git a/configure b/configure
index 8263f81370..a2f66f7ff9 100755
--- a/configure
+++ b/configure
@@ -391,15 +391,11 @@ elif check_define __sparc__ ; then
   else
     cpu="sparc"
   fi
-elif check_define _ARCH_PPC ; then
-  if check_define _ARCH_PPC64 ; then
-    if check_define _LITTLE_ENDIAN ; then
-      cpu="ppc64le"
-    else
-      cpu="ppc64"
-    fi
+elif check_define _ARCH_PPC64 ; then
+  if check_define _LITTLE_ENDIAN ; then
+    cpu="ppc64le"
   else
-    cpu="ppc"
+    cpu="ppc64"
   fi
 elif check_define __mips__ ; then
   if check_define __mips64 ; then
@@ -472,11 +468,6 @@ case "$cpu" in
     linux_arch=mips
     ;;
 
-  ppc)
-    host_arch=ppc
-    linux_arch=powerpc
-    CPU_CFLAGS="-m32"
-    ;;
   ppc64)
     host_arch=ppc64
     linux_arch=powerpc
@@ -1471,7 +1462,7 @@ probe_target_compiler() {
         container_image=debian-all-test-cross
         container_cross_prefix=mips64-linux-gnuabi64-
         ;;
-      ppc|ppc64|ppc64le)
+      ppc64|ppc64le)
         container_image=debian-all-test-cross
         container_cross_prefix=powerpc${target_arch#ppc}-linux-gnu-
         ;;
diff --git a/disas/disas-host.c b/disas/disas-host.c
index 8146fafe80..4b06f41fa6 100644
--- a/disas/disas-host.c
+++ b/disas/disas-host.c
@@ -56,11 +56,9 @@ static void initialize_debug_host(CPUDebug *s)
     s->info.cap_mode = CS_MODE_64;
     s->info.cap_insn_unit = 1;
     s->info.cap_insn_split = 8;
-#elif defined(_ARCH_PPC)
+#elif defined(_ARCH_PPC64)
     s->info.cap_arch = CS_ARCH_PPC;
-# ifdef _ARCH_PPC64
     s->info.cap_mode = CS_MODE_64;
-# endif
 #elif defined(__riscv)
 #if defined(_ILP32) || (__riscv_xlen == 32)
     s->info.print_insn = print_insn_riscv32;
diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index aec730ac25..406d741120 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -850,12 +850,11 @@ static inline int64_t get_clock(void)
 /*******************************************/
 /* host CPU ticks (if available) */
 
-#if defined(_ARCH_PPC)
+#if defined(_ARCH_PPC64)
 
 static inline int64_t cpu_get_host_ticks(void)
 {
     int64_t retval;
-#ifdef _ARCH_PPC64
     /* This reads timebase in one 64bit go and includes Cell workaround from:
        http://ozlabs.org/pipermail/linuxppc-dev/2006-October/027052.html
     */
@@ -863,16 +862,6 @@ static inline int64_t cpu_get_host_ticks(void)
                           "cmpwi   %0,0\n\t"
                           "beq-    $-8"
                           : "=r" (retval));
-#else
-    /* http://ozlabs.org/pipermail/linuxppc-dev/1999-October/003889.html */
-    unsigned long junk;
-    __asm__ __volatile__ ("mfspr   %1,269\n\t"  /* mftbu */
-                          "mfspr   %L0,268\n\t" /* mftb */
-                          "mfspr   %0,269\n\t"  /* mftbu */
-                          "cmpw    %0,%1\n\t"
-                          "bne     $-16"
-                          : "=r" (retval), "=r" (junk));
-#endif
     return retval;
 }
 
diff --git a/util/cacheflush.c b/util/cacheflush.c
index 17c58918de..69c9614e2c 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -153,7 +153,7 @@ static void arch_cache_info(int *isize, int *dsize)
     }
 }
 
-#elif defined(_ARCH_PPC) && defined(__linux__)
+#elif defined(_ARCH_PPC64) && defined(__linux__)
 # include "elf.h"
 
 static void arch_cache_info(int *isize, int *dsize)
@@ -187,7 +187,7 @@ static void fallback_cache_info(int *isize, int *dsize)
     } else if (*dsize) {
         *isize = *dsize;
     } else {
-#if defined(_ARCH_PPC)
+#if defined(_ARCH_PPC64)
         /*
          * For PPC, we're going to use the cache sizes computed for
          * flush_idcache_range.  Which means that we must use the

From bfceae8d3545cb04e1bedbff589db68b54e7c1f0 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Fri, 17 Oct 2025 21:43:46 +0200
Subject: [PATCH 1433/2396] target/hppa: Update SeaBIOS-hppa to version 19

This is SeaBIOS for the hppa architecture v19.
It's required to support the new 715 machine,
which uses a LASI NCR710 SCSI controller.

New:
- Added new 715 machine (Snake machine, no PCI bus)
- Added driver for NCR710 SCSI on LASI (Soumyajyotii Ssarkar)

Fixes & cleanups:
- Fix memory size detection on NetBSD
- Snake machines do not support the PDC_SYSTEM_MAP call
- Always return the HPA in pdc_mem_map() PDC call
- Add LMMIO range for internal artist graphic card
- various coding style cleanups

Signed-off-by: Helge Deller <deller@gmx.de>
---
 pc-bios/hppa-firmware.img   | Bin 167644 -> 630056 bytes
 pc-bios/hppa-firmware64.img | Bin 206104 -> 699872 bytes
 roms/seabios-hppa           |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/hppa-firmware.img b/pc-bios/hppa-firmware.img
index d5f6f2fcaf5cc7e16565cf174dbaee6aa75303fc..74044a20ca1205c8463af66e6c8f0e48fd09ff36 100644
GIT binary patch
literal 630056
zcmb<-^>JflVq|830VW211_lPk4-5<q3=9k=44g9<7#Nti8B7=y7?>C|7!(;4K=KR>
z3=JO`7#Kj9fhqJ41G8`}0|Ns)NIa$FX&}rvG#Vr?fGqZcfqBvk28LGwj=Djf!Or>~
z0RfH*0WQu8Zka{7<%vb93Wk;n8o{ZFPM-e33TgR8*_sR)B_##LR{HwsnI##eNqWio
zx%wF?sW~~RMf%05iAkCH#kv^<1&IvE9NjWQOI-uq^b~^>V^d2@Be)wF`4Sj7coUcy
z_!1ZxBor7JA`}=HW+*T)+)!X(uux!Ns8C>F*rC9{@I!&&0ms4?1qBTb1||oF2OLWk
zEc*YOC^9fKs48Z?U|>*Ucq-w55L5U7RkxFYkuQPqfrNvC{r~?aiv0hW9!fYcJ>Xct
z1QJu=V>D6ZY+yVn;h><vzz8yr@u7qR10!$33wimkoL)>`aQzB$j3$bV2S93-odg)n
zqZk-Gm>Cor672Osb}2aUF`76rGQ3DQz@(tSz+j@tBamaoz>#Cgz>#CYz>#Clz>#Cd
zz>#Chz>#CZz>#Cjz@cEG$7rI+(qLl8(4br>$7o*7P@qtx$7qtw!=NxjkI|%sZC69{
z{O>sl3>*qb_A6xYF`6WEE_jh}fPsU7$;tbm{md5%2bdIv<QPpkxF+y2h@Na!uzw43
z7sCUNl@~RnY7~q??&mCMWl#_><*@&6qR6u0g}nS-4o0Q`P}qBMFh%q-s9fS;VDiY(
zVBp|jgwjk<ni)#7KxtMe%?72}p)?1S=7iE*P?{S`^FV1{D9s0@`JuD`loo{2LQq;5
zN{c{gQ7A12rNyDN1eBJ9(o#@b8cNGRX;~;O2c_j9Gy?<23XuO96ri*Nlum%s4N!Uk
zls*8ZA3$hEsD4JMenzN%MyP&9sD4JMenzN%MyP%!sD37>ekQ1XCa8WUsD37>ekQ1X
zCa8X9sD5UserBkCW~hE<sD5UserBkCW~hD!1{R3_8C;-r3zR+rrB$GG3Y1;~rJsQ5
zED0uuEJ-F04gsd9|9@Xy;&&A4$o61x$o6FL$PQp=$PQ%a$c|t*kR8cz0+!~LujnzF
z-(zWb;V$vS{2oJtf*U9=@xFN7aDWM3R$yT$fb%bt#|s5;K5#%+GAa)$-$uh{G<^(@
z`~fNpO*t4im^>sLU^D{*52y}wP-F+!eHySb<t4)bCKC<@hE^u~UQj*wLSBBWi4<xH
zVZy<{)XHS<3zaW5kzzn8Z%jBCSX!Cvd7<*ACQ=M6$R?O@FtD{U*`0;R%Y8MGVqim)
z=V)cJgW4|#vY!J@o~xC~4r;#~$bK#~d7f4#JE;9~Ap3dH<oQ~eY@zncg6!u*lNV@Z
zvW40&3$h=j{b$0#Ak@la3$<SsWWNxaevwutTd4iAAp1qo<i%Q<Y@qhbfb17Tlb2{^
zvVqz!1F~NNO<t;%$p&h_49I?z7&75tkZEPIf!Z$vvR?*Gzg#PmHPn7-ko|IK@(Qg?
z)=>MULH2{%&u}Fs91KdWOx95Qr9t*9!6iWra1I8QRwiqx{n8-&RnX+sTA8e%_Dg~6
zS3{H6Xl1g3+AjsNUjt2EtCh(LYQGf7el0Y4omM6*sQpqP`*qOd^;(%Mq4rCH?AJq+
zH)v(DgxW6&vfltr-l&zy5^BFB$bLlI9O8eIRwhfR{gNR2P0;k4wK7>i?Uw-AZ-yps
z(aK~2wO;~czXh7SRV$MP)P4z&{Z?r5Hmyt+Q2Ql7_S>Mz+qE*8L+uv_*>8s|&%wYH
z#lgT7BO=4baNSL&?uEkv2JRRpne0RMH?wcsAI!dGzcc%${l@GY_A9fm+b=Y~W#4Eb
z$-o3FLlm3@7)+cPIuz7F?R2&ZP(KA!mw?(R=J)Iyy${*n^uBF>@P)$xCWsow0tIzY
zJDY0-gwMhNr9Bi>L1u7gK=~6OH0uYLdVFqzyT?I}(Zq?n0f!qHK<-2KKOy$zD9%6E
z=kQ5fp2hVC<OdEZrWg)Mrr67KI6q%2=99Qo!}aI#UMRbk>n}(R$eouh<$r*}fZsu2
z+Oq=+3>@-IPTq&?BSGN{3Kx(X^Lva9*+=aja)>jzW*@P8$sxhyl6~0jqxoUGyV<ww
zERzq|-8T_uU@(zj5aD2DihSWIEWyFT6lK1bA)#l1f&fpg5W|Fq2B8-W3{D_<kQ_|?
z3s1HVlVtn<95PI<FXZKOIb@k!dJ+`46!JlRCk6(d1OZ8q8~YU$47_jIS$ZF`i}XHf
z_t5)@-AnJob{`?`v}=43FBfZ)%)s<QUVbh}56Imdl1wrElNuz<Eg2Hp85B6oXELla
zpUIF1it88hvVTEkJqUx;<{x8Z@IGcYGyAALCx-;cpZ0<rQXqfYOZHrFFz`NXH__yn
z{YMUQrikpr_7k&@+0T3tFW(CG$1(f=EoT}OIGC9tl>7A<&F3%(@V6<<0kwHA?3Ac^
z5ifTa<Y$olg`E<AUc}4oMerp-@^g{+Ao*GZUkW52i^K=X+ambVAbD9N{vYo{b~n92
z{$OE>@;+=Y>3zgr@P)kWRsUo5j3EE=dkD<o4-lB#Jb8f>|4bnU5Z`<b0~3FYPzNYo
zfYJ_sgMe^fg8h4tI4F#{V_0NNWEdFCE$#nz%P4Sx*e@6utoUa!h=A1a&twp8nrwd*
zWWI?E0~6Qe6%8gb_WwcVfz<NPVi4w^$sls6SpLVQDe^y>N))8P>Pj-;>iQDw*MiIf
z_hp5dVnFVg%%H&Vf`NevWRAIn{eNy5F5wsQ@@M%fg&08cATbkR28N~z1qH4eE)l*;
z2GL8~<bO;$0M^F^aywsx5Ch*-A%++7@@vhC8JNKFeVC!)MZBCUhZK{ui3o#(`5gQI
z+|67v-OUS>Kz;|gv#Z2G0VED`69+R>%nJqv0gzgdIs6SmOfYqA2?`RRJkwPYe;uS2
z#0J^xf7rf}KR`g(M1(=1sieUG<X`0u1_s7r2?z5zj7gUp7-YB`IOklRBMl2D1??oz
zcmvz51RF*Z6B!1Z1O*0@1RDmk1RDmc1RF+BxYr~oFjyogFmfa)F!F%xNw8t$1M4$p
zyX92FVBl23Xm)vybnT_7(tn$$DrjgY3NUz>GE4L=P!PD*AS25)hbbnhhS3ZZreJ-F
zY_}YY8T1@%7!0lzb8=j^l>Wd~!xVE_Li$I$gMx*FF{25$4TB`NFoW=A8>trwmJ9|7
zHVk@TyNwx5xc)HB;TC2JejzWvm)nLZ@^X~ak9M~P4N&|mPtapj$~gbud=5tg|15<$
zTs2%WAbUaK(w3qC4iiwAc9kedfYOP341>btISLG*umY)LV&K>VieIlvc8S+7q+Wp1
zm$DKA1BWbAl({9J;_Fvz3Lr7=xm>a!wcLAHWcnN8pMu1&=+6L&gY>?B#SI=;0{MY^
zE*H2S$v@1{07?%abND?3CUez*%yO{ecMzD|mH=_9S+V_p{$Qbo7xD70CQ|Gdcxr??
zK<-A4b5Q!?kYWlp4`Xb|Kg-CFea4<M`?S4a_9=VG?34D2*(dBZvya;wW*@V+%sy)G
zn0>_FGyAZ8pjQb)!KEpj^Dj-|yu+6vF!j<Dsa4#6nC9>$2+Zf2!!*aMgu#RR3zx{H
zt(^P0=5Wbe+R80*X{&TI_ZOxqTw9o?fW)$D7#hrq892Ji?9)N!@hb>)@M{RPD;nrA
za<DVS@*4=W@mmPAa<DPQbFeabd8;recq=n#aIi3ia4<7DdMhy)cv~=7a4<22aY!)v
zaBwh%g335kO|}LTZia?SQ@AEyn!;_vAFj~LRl_vr(iD!%Aez@)VKV1tE@4poavfxv
z%r%)wnCmjrWDuVd>{c$HOIx`&b53TOd}%AE4)<RsUJ#r6FOv_~8YUjjHB3Hc-x-)V
zCvypN#&Gd+h%xzq^me^gc)=mh<i*{=#lf|li=AIXsKNV;Jty}vE;jC`T&(=+LLJ_x
z?FBiPaItVTb20O)2~F@mWiQF0#Kpv~Dl~)Z2A704D9l0r1ckdYgN8RK>_Pqng}()Z
z1+=_$^gd$m>3!Hf5R@kT&)PF`FfxU4$TG!qh%h;Fh%&`;@G^zGkeB_+A;T03jpKMw
z-DvK_!jOH*-ZA^4y=V3X`@rn;_L14=>=U!k+Gl2;u`kR%ZC{yv%DyrCq<v@h3HyoJ
z$L(ikAG2SWebjzs_7VGy*@x|SdjDZ~;Qg23#pPCs*vor3n=jAhY~k3;b(H^uz;yl}
z0y8)kGc{jcCK1bVhwB)}5vG>Qd$?^c&yiN+Ud%L&yM<}0_hW_$-cJ~2@IMfk!~a5H
z?qzYVryO(HWI1ZsWiI{TdUjcy`|zb7+()?XvdMDoVVAiq&Mg5l2W0N0@6znt%uG|b
zo-j@3-ohr!J(*o5`wt^S_FqO0^ZyJ2-H+^!gWSh&AkfWkA<*M(%3$Da#$chaL64C`
zl*yMvjL9$iw7p^W8GB1_V+I9p69x?vc?JfPrHl>U+6)QaIt&@vm+cj^uh?svu(2|D
zD>DRmt1v`lpSF9Lea7x32Q!m92Md#jw=qM3w+TZ9zk)zNzlOjB4q+y54iP4w?5p;I
z+1KnPy=@pAylojgIQW@DIRu!(vhUb4X5Y2v^ge0#(EF6#OHi96`-t67@9Xx8-Z$(u
zvoG6S%)VlG)BB*kq4yzs%gcMX3@^{+GP=BnbMfW5oJ%+gnVLB!F|}Nt%XRtk9<D1~
z$xM^ET9~F}U$)!H{fmp4CqtlxCqbY&`-<I0j{RK1d>H~$_!0yrbG5LEa3!+~dmpyj
z=zYX)C&v^v5sqSZVeSUbX6^-?Eu6|sf*gOCm_g=eAGTY_>B7XqDa*vnk;2rReb{d0
zrK=o;-iPfLdLOY{2{VhUhfRbln_ZaeAyW(2LndynB}^=wDNNnjr|k}MGch%DGcmDn
z9cE&_w2h;PqnWAY(l+kZ*+=Y7auzamU%JY@hI0~A&!uhL%$Kfmvv6dC?U~8Z!_<;}
z#BQSZX}gKuXY6Kz;*xU;8w+PKJG1v`yMx|m>`rp^v59cyvI}#zu(5C^vomvuGx>5z
zF!^zCGI?`wG5K&m(`b0Xz{JGG!Y07^n4RDIw7sJD8GB9d!}f;WN9-**o7k8*6WJL#
zrm=}}l(LI@pSJtxea7ym_hEZR?<4k{oO9V^IcwNuU}3~>Dl~!LOlXGpReM42Yxa^{
zH`pY&wzG?88#6d$n=p8IU$%SbeZ}r&whco-wk<;hR|lIcS30|l_f@-#-q-AI^6LvV
z@EZtqc!TnrB7;J<5`%^}DBsyIBxKt%WPsX-T&LJ%xmL2vWScV>WP|cIC{Nlj6lB{n
zRCu4akMurgpXhzoKGXY*eWCYh`%3Rq_Kn^r?K{0s*iZC6Za>renEgWUqxLJkkJxYY
zK5V}eR34b$vuosFXY%CWVDjQ%WD4hCVv699VRGk?W%A$<Wpd;YV{+mEwOK@%VmX+Z
zLOEEN!d}Qr%YxDzs2yq|$`E2A#t_HvARq#6H%yWL(bu4$0cvM(l~^>qU|`^yl%Nm?
zs!Kri7S~izxHCAlCD>0lk78hIDpQc+cM=c*wVk>q+vkJY8877JV?lCVlNAI&^b2`;
zTc~&`$eh!&7HEL#PLTWgjfEOOa$K9aLd`bYFXV3!5V<r}{)gEV`-PXLNdM@YG=D!=
zG1uh21@`kn>R!mp_iLvMFo4Rr{9_Ca9%^hB+KCJd*+=Xrny@f1WFNMl>7mShBKxR)
zXZ9_7%Z4Kk4jjx(t|qJu3>>UXF`)X;`>1`V_YwPv-iPgHg52PL%)XH)L15;Kc-gDo
zx9lzZ8|>GE)S4tSD7=uDFEwdlV1nCul%XN}h<&Gr3Y!7g-oy42Jyf|5m@qRifbDB`
z5CEC+f`LK9gxUT-&te6TxvHQ(KzoDzUT{6n40Xp5`%dq}_7lNwIBMSr@{@J~1A~VR
z>jF@n-#=GDfrF9BS=nEY@kPAcSMw+akBl1D1(W9#fZHJ;zku}~wr}irQ3wFJ(Zh!2
zhWTU$rVL}28~qImN+2;4VFoo18<q#%lN%gBa-ewZcd|bVk^^B68<q>)G2r&=)C^;m
z3mL{N4?yB3iYzZUY`6~cSP3<}keBb}u@ve6xiKFa2B7}NiCqdaI3$@|CMz2-m@qRi
zwJRu8a7Z#myol#q%fZYP2?`?<8}5P(748E5R-q35R-qZ$%?t|s%|a7EZC8*VywSn|
z)Q$$V(fA#N7{Kn3vH$O3%(9~`K{0?|0U~Br!@%KT!g4^n{{DZi$y_4*Edt_ZUm4iA
z_Hc=IO<nK{l$JqlM*b!Nc@r~k1+IFgcn&e9SWvp-J0K9zEw3;E)aC}Yo4AU(g1I+y
z&E;PrAk6O|AjWl>Da?Eh0~>#s5QB*r14Gxh1}(lj4D#&{?4O%mV_@P}5Rl=X%oNOT
z3~sx#a)>g;^cC3qnq6a%0H+sW22lJkfWjH%eg_+t6O$VZm|ie22(`B;1c34YSS}Hw
z&cT>FtEtBRDoCw|4a)|2J5yeMJt+KM$je`Ku;I=Eg*~|a7Q)1ke}<7E`?Ni0_9=V8
z?34DA*(dB3vya<rW*@UR%sy&wnSI3GG5fH+r&lS1gI5hh2G<^@IiU6zsQm_F^HmB=
z1<{x1aL9C(*ssm10oQMh{2Br?Ohg$N6bkeh`3(f7^IHha<q&5I;gDqt_O@qG;E-Sn
z<B(@^;b3HPGGSv-Ght`&GvQz;;}B)?G)ZQRFkxj_(6p@4gR6vT4ydf=y2B&`YKQTM
zD)d}%;^^Y+;^N}&;*#OXR_HR@%D}`K!zFX+8uu!WIb1TJwq4g!g$*3SOfDP|ToRn&
zT;lu|LLH!X5O*UNBiCFmS$;*K2Jh4MoLu!>^8DuDHkBa1t<Vf_P#D-VD0rW+SM)w^
zujzfv-q8D~y`}dNdq?lX_MYH;a>kyKLxd@qLx#!eg}mHa4lbsUrsWM1T+^85m~eyo
z=yGd8Zf#o8puttb6vI`*#07G{2{!}F3wgOx&KRZ`s9Lrc@^Yadwc3dc440#%KX}-1
zCz#K%|Jgqi+6Q$wz~nxeL8Gb49@6HQm*30ZAutEz4p97`j#AWe4hHpWxFwup7>usZ
z;SvD#ZJdJ{OhD<@IfOw6l*X=2;pA|RVK9Tr>2XbF3T{_WSin`oC2VfOz|mE*paEna
zzmkBA`5Xoo?wMRN&65`t@y{0!>1(im4k|PG=YrYiL2UCWAUzF6{7nKPTywZYxJo*}
z`a$Wjd-DFHAbC(f7i6Y(q5*@44O<6@b}(k!(UzcKajjlLpm}nGhEf9mT~Ista<J5o
zYgN1w{F8+oKxQZ<@G+WCQD8JHmjBN+xdU8(@Xr!*cp)#pUn!yge^w2{iOVrkKd#T>
zl}M{$xB)89Az{M!52T;pK_CXizdT2J9>0S?@TD557nh2q=YiY~66dPn0*?`Z+-D-o
zz%(hr0MrlX;!6~m!<Q*A7i>m=z+|XAgITftK@$=CgUSya7`RF_K<)we+4%|trt(z?
zOq;X-+#i?Xx<3OX$Hl#kO_qBqyNp*c1IW!&LHhXv1m>7qG6<N@u|H@cW`EE`UV^Q8
zn!+saDGUZ}4GI<BlNlWN8w94fO<~Yzny(P$J(a<OZ?jNCTY>_I`4k2RzEYtMeg%Q4
z*)thD+7>8qWKU&q;M*e9!EYkez#+mE392v6Y9M2LpgeAVkC6d6ADg={IDqo9xif<T
zET6xKmwn5@%oGJ4UjdC##mk=MkY#e?ZUy_ph`SZ+S1#^lV7?HjtmR-~a^{d>a(NLi
zyA`ZghRGGA=S941D2NYA%O2|70v;ON5*#O3L^zhS3Ue=Dk>ze+1(kQK+*_E~cv6KL
zc+!MAUc}4lg6z(|V=tI}*Ix2Pyv$h;-}|z?p!XGfNtiyaHWoInR905*RwiMd$wCd>
z%a}xXrU-R_?K0(70F}*6n?ZeY2Bxmf3POA*1g3Ir0lS$A6o*ae4H_n*3`|_<5dUy>
zK;=Xk7`XO;>QTF!m*>d;$CvNT@7Xhg(vFD?1Iy(o=^x4s{<p73arS`5!?<U0fyaCJ
zV}wBEHLTnQ)1bHjxf7(v!G_BKRPRB?8tpqlbsnhx>z}7!kbT2m6I5SetIN3OaK(Vk
zxITxY#YCCQg1ecE*`tiX05+!C-(cSl(#z8#Aai{Vw**g{fbg|qE&)*9=ji~6adPl<
z2}pwSKPY@X$`~BDXEH@1>E{RO_b6isK#18r2Z?##vX}HIV~9W!Uke)N^uA@U=~2eu
z0TVwlXJ0!=J<kGxIsKF7<%8HBWegTD`4{qXt{f~(F(xvMO`tFVrO)&`_JSrd3_9s|
z>?KWP7*3_%u~)ntBl#iyj=idh3<F2{9ecyeHj*DeV+b7L;PJ{p4hbgb^jr3tpgFSi
zoA#FGH|+(puiHDCU$=KmKVUDKe!yNf{eZo0`W<`I7x6NGvk%zM<d9(s?n_We0J+Kg
zvb|$hih>tUj({*vo`B4?Vr~goxye%i3O7y;aJUr-fa;tWP`!cNcLt>cko!%<8RS5I
zFp*?Z%06swXnq4crt1769z6fWb$ZSM4d=`Dx;(`~4PY}4+Z%$?4@f_#E(W>9T!KO5
zvW(;hka?iKHpm=M{hfZtUKHf-%g)k2((l;Ig6jVC1NMUHH|!<TZ`v!iHz}M*zizME
z-lA|pdCvL&CK3z{CXx&cpfvO%Ufj|Amfb|}J9d)h*X=d4@7T{YzhO5K6izSVrS5|A
zC^S42KyGlqY&X~aj@?2~dI6;mP#*)-|ADyGt`QVpFXZJ-L2>m$Uj8Yl3^kGAu>h4-
zpuE*RMM1!PvV9`REKs?5t(dc?IT%r2fz*S_evn#F`QKFo8nZKCP)Y%{QQ0<t%75-z
z7IR=@VyB}NB0%cFZCGQD31+3d6ZjGYrZmk`m;vg8v^6LQnH4h>bd}m)2Z@8!g4$yq
zCTt2|wj$#J4o0S!rpXSV@kCI$uH|FOP|&r@{yM0wc5O08GFJ(UF!yAxJ0SN$!X7kU
zD$fdPSD&7vpyfT8A)+lo!N{$KLF4iqsTY&y7_fod2g;j}aItT^Rxhaws*6FGtA<JD
zTDhbZ_hhI)<mK0b)M_V!$NCsd6xltl)o?iRB{EEz)Bve#x@Osf$5Xiyxfp$H7&s<3
zfa?%&y~3j)FbC9r<*^Z(2{HrZMiVP$4^VsFM1q9@)SiD4FI)(Ub5OXOBr<#O*a-0@
z*f5*}jh80aF#4IuFvum?Fzf@l1LS7Vcr7S=KxXBiU}VTXZqI4L&cKp=44iJ=vX9zJ
zny9jE$Ub7P$iWECYnlov3=Ae23=*I`%`3w&hvN^EOn-yI0*^Ut8%&ZJI5=v!WI$^8
z+k_ZQ(je-1?l6GIeA^oo3SjDZY8Yg|dEmG`r}r^?LGPpBaeGDY!}gkBx1F$Od=W2t
z(?p6v<b}MvD#*SU@uEAS{7?`d<Zh7rJ#5%E<R4*Z$Ubb}+1{XV0_0YZ8$fOWjal+H
z2r;~f7j-mAW)J|`4;B|@U^0<n{>MKVBqs}AZ}uWy_O6K(<Et0(vS&@C6d$~Zm)#4R
zSAP*NyVgXC@rCzc`%ZA!$qP059|6yyMS{e@?mYtOXMyIHx~&#ya7ZwPzHnv$P18Go
z^*9`00L?F%i`oANrA@9|TrylYxkR`bSj4)@6a=_xxa42R%P-~H!y?01!XOLkKfI8a
zKg$1Chyhg2gZ%1Y!F_`}iYo>*2XK83M{<S*_YKh84tE5Lg!xPcaKDjTf-Azriu=KJ
z365lLD=tY;J@i6e4m?i*O3NT~KxGuz%;VrP){cXb$vyj+y&{JM6DZC#Jyf}GWFN6N
z%sy;y*|5jq0%%@{qm@MltmnGDAgJy!QRaRC>VsdG;Yj9=;)=Q+#gS|tX@8O1nM;aW
znM)EJmP;9!GM;kZ@V;X=(fh95Oz-RVf*dVeE*vRb2YGCSCh&mT*LUnXdCY|xc+`YC
zGHe(WplL$V`<T6=_fdOI?<4kx-iPfiL17FkCn4@<X3(y?|3CY<eWHmXgMtY=LtXYU
z`%Dfgu=@)^ee&!h_Lb&G>;*Ykm_oA;+c$DZGC618uvuv$!(hOpA+VW8LtqQvW}y}9
zC&u69+ak1rV=;?Nb9-Y1$1*O-3#rn-Kz&ROR;GyS3NljWw`>JpILpl7R^yU1zicbW
zv6)N8MA)7Yly*2+ncPie7-~B9G-_N)=1AsXVTybaFL)88$3%jm0+b(L#Pc|U_}Pc;
zBSG@n2kZmA@7M==-?fj-zGK^%eb=`0MZ91pNDWBdM1sNLg|qYy?^`x2y^q@`dLOgT
z^gd(*n&T?;K4M?#eb~Mc5+1gUpmH9h?}f8;gvnBd29W+2@d9A`L4663zs&F03Ysis
zV4CuSp$_66Zbgng;Py#g!=HJexwyy|@^WWE?t_Fc8>lRhG+}4>2Tm7~;BeLCkOI#W
z8bZfIEJ5{d_6d7Ij%IM!C2+KHNnS{iX1`D)5qo_Jrxz#;ue5MHzpfx7$<fThV#3bA
za3NXxCkG2t#8qaFWKei=%Cd2A{9$K*;VgN>{FarV`DH6Xj>(AdHIZTX(^1p#!TgSu
zAgGP;B3|erNS%oUBLl=QoSh(k_Hk>*>=V|UP&G3_V%{h01-*~kOL`x&yoo(MSuujl
z0jYiAEOEo6g%LEC6Zs-uND?e2FXs#L8)%$nN(I9|h<zL@Ip%=F?p{O9yt`og<mLW@
z!VQ!rL3ztWks$%phBH5GF9;eN%f4Z^5;S&UBEwLCHSI}((u^!CxE^L^iZqd6NO<8a
zzQg;L-Ad3n4k%AR;@h4P&7KFO+aqI&WKY8jXR#N!>;csyp!x+gN90k=$k9~Mpui!?
z6vZLT6!F4Ytiq#`QNp8!kpot~f$9^G`#@m;E-Ma0+OH<c+y$VzB>RZHB2NWqZb?xB
z6ec_w0&~osGDvusau;x`a<Ou3<`Uta!XnbOWx)-Q-R3F`0@<K4Ly8HMZz5hei-N|;
zqrm0J94@I#e<Xf@+Six<NP=i4&|J0mO}mws{z(1c4;NxHk7D3>;Vi1bA0s5oQz0-X
zqlQ6&V-J@MPmRzFo&te6pmqpPjnD*8I|LNQ=yedHykTKbnsfd?s66C%0JWXDCCsKU
zu<$#9+J=xeHNOi;oRb68UgCEX5Kg~hBM53UUY-MLyV`)-u0kdv%q;1bZ8X#G*cd7$
zF))DAMEV^YOHexkR6eC&wlOu2WDqdFW#gWH#YWL2nZYdmfQ@YW0UO=)12(qFcWfM!
z57;=ra29SzK49Z|p$2TWsQGn!LlYSWk@UkhlIAz;#k23&8=Bv=5d^h|U&OP^BDHr5
zK;i0r+1{|PL?OcYvc0nN9eY*e_OA0~dv(w_0m$vnckDGm{(+1e+5h)GWPKA+7TbW+
zBB+fDYM+AIquGb;CEJ@63``^#G}>Dfo4|H~)-N2kmxQEWNZT>}j@?Ai*zUC{TmmLC
z3@+(+>}JBkm3s<PNcs)Ch4Ap4!xY2sCLjV52Z!YqyOp3YN<UyX)%=#-+Vlf<b4{2T
zY+g7EMx@`dTWWsYUNHNxy`cFGyQ?67o8PpX_#&QF6ciSaHm==Ou)8kX3w9;j?RCFw
z_t5>0-BVaw7v|R&@^Zc4b}!8R^3qSiW8w@<4v;j?+>m|TUJ+XNXmUWxNJD5DX$dVO
z9YJLzs0?XtZ-kYPYS&vhHKAqWF;M*iDjPv%A$JScaZuU#!kPbo`7N7?=9g_IBA101
zlBIuv>zbNI0rNXH6TxLqyhJ5PExfLYlg|b5IoO$^Uc^bB1(jK_zBEXE_8nWs?7Oy{
zFXAOQLF&AZ+ben>v)A-KWE1Iq6f(!*ec0X+5??lrkov`D;tOZK873_Z4IndK#EVY^
z>3xA(K0@l2IJsPC`Iy&GGjA_gy}aC0kb6MkhA1N$L1m;RmNHTTTNw!w1J&0Y;IdNY
zD^eMz@xqxm0a}KE*2~<4xE)$nrVB8D(q{ezMuzMY_MrIi$UbiG$sx()o_*LpGyA+f
zXZAUJ!R)j4lG$hM6|+y<Yi6IaH_Se1Z<&3}J}~>JePs3#`^5Gpg&Cl7u)RfL2PnOR
z(-3Ig$$5KD?{oHo-e>J4z0cSydY`t}^gd;8=zY@O())zHqxW%pPw!*)f!;^$BfXE<
zCwd>Y&jh*8|AIZEc?5$12M4(9KMD$;7xMC<CNc~f9%?K*S`OHoaxgM^f$Z|IVL4!O
znSle;uHkOuV&h<C@-vTNkTCaVdf*wxvV-q{fXKBe+!B0;1VpcG<r3hU$`s0X1SH1E
z!L@}cgzuPuDA!b`kj5(ul=xBvM9exF*f@>3I5|%40F6xrbzHWKy|7v02T!q(0H}?8
zVYB29o>U<=o?;=U3!9}t;-GO#S&kYOnYIQ+Bfc~Nk+ud!CB6iR9ehawyx{TjUM61?
z6>bGk`xZ36&etFi+O<~U1*ne&YR_^Na|Lru=9<ixCctCb!@$Bhhl{7Ndv5B*%~CJ;
zdxe<H`x#h3Z7P!q3<r1`1Y){-6^wW$2uy1`pwPg<&lCX)D^NJW#t%$d7$iC-*slkv
z1+{NDc$i{L&w<8UWzTYOG6nY)*nKsd!XWWNUS=sMzIfUMBupe3|GkKlROR4jih3b0
zUkfq=lrGKhF@yRKji5LN)p6NJ?F%_1m_Tt~$&&yo+qorpk`U!RPYOs3Qr`2V39y(5
zGw5-*Fu62LZUl{c8clY9^yyy2OYxdiFbJ4PFg*a}#TRiBx}dz1eZ*!WPlkXDPnLi%
zXnY1#{(#C{o*X1|^8|#sCo{!l-?5nqDpO4=83bN9vv-)^vRUYT$40WhLE(mpB!dQ$
zTmVSUp@zW%WTrzggB8qNhZ+W(>vK3c9LgE&KxMi~1%m_kbf$2S{ul8Ay&yM1%033B
z>vK31q2&Qud()=zMZ5?vNNszAy(q|DP@ly_hQS0>-<#NQS$LRmS@3rVOrA7VfdMqW
z23ikeK8MqSYmNrEKhL#?NoH~bIBcw-VWedu!yv=&Bw)(#Bw)rjRY+<5-1xhE(}a{j
zdMA}AFqnuiFqzNcRN$(CnlT5-3<a=RATvbxl>|)ql>|)rN}y(x3MnD_^Nb9j_6KAw
zpFOB8>zobhb6PPtyoi@K%)V(aczTY)3GbWsg8VZCT0!kLP&?d2h9Q7oLtryMdVc}5
z?$4Q}08|cv`r}}=R?Hq85OD_%$oL-vu66~eZwIdTrI=!n*DS)^%kLmC3)Hs*t^Ee|
z+dvqcPAwU<z~jdE7#h51F=)Jqm!HcW$pumyc^R^<3f#{GtCe74;13X(b={KVImj$-
zNiIolD=sO}*bT@$5C*9Ok3UL++xDHHzMis!|7}pa@<qJdQ}ZZ>j?2x`|639ij6m~n
zpz&T%dk=kX4b&g+@0!0Kqy|)Gf%;t@mMoz5Vi;)Lj_;6wG2bBp6TZ#RxY;74#M2@$
zqn~SjI7kmjzqus?kI5_s9&VW(4IDB|5j;DD8eTXvt}vId|N25+o)=^{*u94t8Wa-z
zZ@-9_U20OrkZ^g9^q<KM3UV(P7=m8J%hsAyF=!|y@G*eKV3ZQr7@8+5aDc{WLE#N@
zJGlG>&22W=-v^0-##KP_FtcH0z>9bp@VqKd4QRX$vPKlOjcdT*V8gZpl#ZZlC>5dO
zx0>w@3Lh>zOMiF~C%hMwM%w2qECA;bVa6XGR-6|=buw29lQ4G-m(+!1=^s~;IXSqJ
zL3M%L+w1o7pfLg#kb3Vs_JUj~Oe`M8oF}+axLCMbxL7Xik@|7Hl~;mij*tVc^kpK$
z_=9^U6S&U~GTXzL^8$A>lQYPlSL)^ebI)XA;Y${30NDXD`?8GGkLxpdLGz5hAbUVz
zq0GVn>SHy4`T+b60-$kBa32LK-U13skl(;-EkS*3c-x4P0W>ayCv0v&!bT93&!XDr
zD}cxCO$dgK%vMm?fZPlU7m&Lzv`GI0xfc{JJgq`F^BYJHC``cNFq26J6egEdr2m1!
z1SAIv6Av5C6QD48Aupc_G7l66Fn@sZ2xxvD8ov|U8x&qZ{J{Sg6b7L6ye<0`W?Y{y
zApkNDY?l@11@0Cm8E#iZ9CJ5=;#gW0<PT6>fYfrgFtLE_2HDB8gaI@+_2c?vUWv<d
zq(6Yd7(K6n%qBW+Z8%SW+7<jQ48a8aa{}TYKG1rOD5!rbOk^1Uf!qkP6O?YT`$w`B
z<R6eakUv0i0`-dwHur<nfz1P@Ny2ea%HP5OS+95;Jb%S`Sxx$fi6jG0_7Qu@%P!I%
zK=T*bhwT-!kJ<~qh?nWT%q;!ma>M<4(E4i=W(EdOxdF~6$Lu-1kJ<}*AF-G8K5VZD
zE(ea=Gxj7XaF|pwFqud)WPr>9mn*Cc3?}SM3>-2{&MgV{<sfq!mfM5ECh|qRY$`}y
zbDO;@NFRv(B3{-O)CK{q#|G&Eh4tka>A&dd1~gU*Dql<_8Dw6>%UlJ`@m`)I|D(Sl
zp$OFWy0TkB;6jbmkM0(Q1aNyHUh3_ID(MfPb-AGQ(B0Z#aiK=~FK8_ZXzd5cK9If_
z^75@9K4@(S#J}M7CdN7tkeQ&dQc$>o#!FwsOM&OxOoYvHnkOq5m`F0Pfcy$K<FI`v
zIGm2yH@=9MybAJb`wRsMkedD``|TigAU0^Nw}~W!(2IDPr64sYYV31ODjC>b#7pyn
z`29`xpmH$6q>_Q<MZDBgkeG=ugI)9F`T8I;UdYRfg3JMho4F0Rj+<;E$-?AS#h?MM
zyJEOzy^t5#3aYa}7_9CdQaJ;P|0DL2?F|YCK<OA%pTCIXI10*}pgO&MzM=qVjuMpa
zK<N*hmS-|aa=ReqO=VEt6b6^Sp!5M!2TC^{R-7k5>Okq{g}lIC(6|6d4qRT@a9-f5
zWRe7xC)~<R&Y*IHzZq0t*xdxF0qFtd36OdG4Fa=X$P0*q^n=U=$$`W{;R_N2`6>St
zBSZE{drlKh9uDx>8fZVN6jLO491b+TdBooE$}CQf3oX(gK;sc6E%u;sP|570_L{J;
z2Bp82goF+gNd^%PHt^U<)Qfnjs~|H$Yq(k-BwV=g6jZj@-Sj?b&j}wV!!qXTe+oPf
z{}hx4yE_#uOe7dV<6uTF;zd+JVkQ#cI>O{dya+3Z4+`%W@sfW*_P&spdkb<4$Q>`@
zMPoTwnWDNo6+!9R;6=O`XzVPixlKXCM3TXXgN-S|M3TYaMZ9n+NF7M*MZDNl5Sy1l
zfCV%LccDf4N5dQi1zr{*22ej4qDEL0q{c*&!Q@4}m?@Yo!T1kqugQyep{pP<P~YK2
zysRlG-SILAa5XwBSb);(i+IViAo<gC7DSlOWZ>Z7VshqX76O$SAoqauhl1om{f-y$
z621_B$(Dk`@kPAUTaaA)eEVJw7N+3K&C)+OQn+L;&yoJYmE6(5!ORrQ4cZsL%)r3Q
zARxoh%q84a6YmZ-KZT1KG_L`w`$6#z88d^nCl1>yg3>T(E+hMfy<qlDd&w7Z%(|ek
zZJ)2m;eFFy5|s8p=_~t=y(B0tgVG>!TY?*$mia<K<uWLZfz*0K)SdvT1LX-&8hjzo
z#|uh(AbF6P9yXj8yl>eHg3Los(=Xz=mV(kXNFAu&<pZ~g>_Fo|;BpjX2FM>K5)48n
zk_;7~G6qz>@H+^&yol!q&*6jgg2LZLncKlck^vMx5ijCp|6Z4ukq3#JNH8$Hi03ag
zkz@qLZ<I*|6N8B)qr!`L*{vWo5VIMVfYiQ-=LfBQ;{cfns$(*gxjm5QVnE^`_qbSq
z?Q#IMVa!48VFv+ckXbL{WkK!9D3F~Xw}8w5h3^Y_zEV&d54ns1<vmdT;*ex=y|O??
z4m39cDnCK)0Odi@*xieGF;F^-1hwl-mN9UE<X*&!tp%kQP#j&Tl>TRa89cYm#BIza
zW+KXv#yyP-yqBcE&;BXjR3Qd#V=ftfV+LUpW(EbWWF}@4VTJ@yf7lx|j|}Qp#7l$A
zR_`13k|1+m#7nn=?CD8R@BqancyEIh#}^Q-tib=@#De1!Xb$Lw6SoRzjtHa%`#3mc
ztOPW71zP6_N_*h2i07Z0ebauT_f7kW$7>t{Kw_Z%KHk$9e<(Nb|L2~@B?jw@gVsEP
z!Vp@Pf%cby=Ei2ekeAH`&3mDQ=V5zGkR7ma1%)RA0}E(8)D_ew1BEfjE^uEeUPKiX
zo}h4r_*n$p1_gyFEIc_TbBUUWFeq_P<q`&s>4L+vM2G<-4;epWPym?)3(FVrlA<8<
zVe?BMbHV%@pt%A&$Xo$v&PiV4C@5XS+|I8cFbAHlCkV8F>hWwB1_g&X3<}9H3>y3_
z0>YPyrT-)cGiW)RF&JGd=6IeQ#-QVD!(fmc!=T5{0UDp-<bd_F`MCr{K;tvl=WwpQ
zG*#-ywJp37>7fh;9HLAiTz8ma_}K(RL4Ea0Tc!UchccL4D*><Nih2>x+<QG<_CBaz
z;xUIoBcleirr#bE-tf8_l=eaO<_kH&gCO^VFsv=x-k_iXYNs~aG)O2n@ZaU0$tB5e
z1zxAZq};&AXl|^)Xg){&e^br;vmBC4!O9K&|F0#;$YoDvIC0rh`X9FqmrU|3@EWV>
zAbUV%SN2hRMf0Qfg4svxH5Dd+&i~-<0IgjB*Xg(HC6f=>3nm}17v@P}khm-({df8t
z2D{6`^39Aj5)NFcTq4(-1Q_^I8H7Rp<(nhKU{c9&090Oq+B7fX*?svN1fqH}?At;5
zoo|8Kd2+EPlAH^?kJ>AGAF<aok>p(De9K-KoW?=xD&*y4VR47-Z}VUUMzG&w8Vo>w
z=byzO13H5R?C&}9|GR1$1VC#cLF3V&zBtV9m!qWrf&BkMUVf_i9EKYpf15}$JOJgH
z>+v$rLG3@#dL9!ghDYFhATJLpR~y0M4&CGAV9fBq!G_@x@_4(0F~bwsc)NoQ!?Sh=
zg$z&_fX2|kdw`w^JprX@@E)EQEIA<alocA7xaV?7nOia@ynZGi0utkpWdf~l1Ml?$
zx#>l`JTFKbR2G<k_B)v{Ja8~(cmx_J1dR!S*873XaWG+c0x}1*9+0bqDa65;;TcGd
z+n7t3doqiZa>D_J*U$KU%;zwy>)zAA0UAepAus<O>__OFHYhBV8~7PPWo&nhf&nOB
zC^z)8gT{fBC-CktpToe@RHM)UDmz}p$=ZVQ8gy+#){8jlryzcRgF*%<o=lPjKx+dV
zI%*UWK<drsFh#)Z0+q`z<mK<0&tYN!$$`dD%;zvkK-p`}=P(68*;CEuFe&i+35f9P
z2?&GMkb~BpcTHB<z#+jDV<ODJ#8<^2%2&xCa%n4Me_q!Xg$mF(WnZ5Cd5~OtgMtSr
z4$Pw%1VC%__=6Ru@*68m>Dr>80alk|e;*_UN+U1i<=;Zb5$>AEFo4&PgVw5m+Hxjb
z40fP)oQDR-gzV$?k{lAyxpq)n?x;Oz-oO=9{(<KUPTF&V>k|$pPY!mb2wn++Suf({
zazW+Oi5i6hP#Xx;-kY#Mfq`d<Py+`iWStr@ZMcpudtXxyh5}F+duTw{#i%eI=*UPA
z0NM3IUOv`@lL1ukdh*Nw*(+NMvbViK!N8=2p}?fYeqzf4dwGzZCdmwTFXZL^@+=0g
z-!28^QCNNJVb6U7TpmEj&^Z{HJi&4&>>W)MxgT&yFhR!O8JWB|#KB<^2%Wc&1l6yg
zv3Bnxb~8a^^Wd@rIwsFip8*=HUez*R0X*gb?u)ZBg@f9S*~jfCW}mR1`65mZoVLJa
z010F9pmKsoL0~G6hQKr)1A#d_76Nm*?y`w+?O_+@*bH75D8;cEyiQPw;|h4~sgQ{x
zg8^vH9OQRSHa1y~r|dEfTN^YulDXnLwkjlWBy;(6Tx*E9n#`dH661{Ly6^p+L4oTD
z*c>aayDS`Bdsx{yM44PU#F*Sb>OpE>FfcZ7`f#1$I>sW#wUkwq|Etgh{%=Avnra#p
zKz4Q2*slet?V3A(DM&r{78Vii$*jWJ*X=twWSGJ^WSJsBbtP!+WcFqIiP={`;UWWW
z>wv~gKy6O%yY`a24FZ#SI|QaQ)yxeAl@nYwV0Upf&7Ers;`2@rn94gtU>esnHW98;
zc44j>a5!Wk)HOtKWOIpv>;mQA7jaT+L3V=d0GaP;%zdMyxLy}z)(d%=evn$uP_C<d
zdxRSJ_6l`yZ()(;p3Ex4w?}9K-(H~^UYi*dIwsrLg4Dy;1jI>!>-rb+GW?)2hFhE|
zroBNy09>!hON)Zkg7P0o4xHwW+e?}sw-*GpD-<s1F`66$*Fl!xbad2S6O_+D?NNAL
zl*Yh%VGpD(y095q7o|h%qI5`I1geKX^$}<-$cuO>OHg~uq>|wRh!0}Fh?f!s#Y<0y
zeL7DX11qF%5>y4%O`!VdMZ6#{sBQw~0g!s+wlAa|%KjI;Zi<B|3bYpCMZ6?v4Oa(9
zt%)S#17$w`+b`nTx0*{ZFoDL4KzkFFnZSK624z2xoFr@Z9s8N!bq>eu6+!lZ(m%L8
zd=%IE8Sq%RC3GyyG5e^!A%B2?OnX~{1E}n7Z)$+d6NBcrj-t;A+B2F6GdOflw%-q`
z3%ny4G+sD~C4k%usvBKEbL=djxkt80&{zYgO<*DcZhu9+h+{JZiFp(=Xz&yW$e4&Q
zgiLNQU@;M42uQzdFUeCP5R-hxUhq<h<cG_XrCuc8u~$sLVlSF}*<KzrN5Hd4z?f%|
zfC<lJ$QUxu6d@(h8iE({a!cLkFt~vH&K<=S44Q|yR?N`?TFcItAuy${0kVfh>4F}k
z*;P&juWOtN8D=aICMGNqd@BT|@s$X5@NE#7$~R4@gKw(P1n7FE7XBE9$)Gi&pz&;_
z0?-)<EEZ<PoE996O!3??Tr&KPLJcM&3<7)^0$ceq1h(;i6<V=wV*FkHZ$c{&>5`!V
zv@RGl|IFVYB=90$ZY?O?g6a!cy#{I@gVHdl{)CKc^M5p{VgS!GX4tT3yol$&Xi~+n
z0pyMh8y15X@%$T2su(Un`3f)M`6rrGF`Rf24?af)luj66W`pWXkl7%$p!EhGHY^4p
zd%9;X2mp<{gT<woB0a2FG+sCfT>!ZaG&c>J0|4cl7x988&7&A*fW~Mr%uF<30IlBy
znb($}-~rm74qnG^++YN1TfK<qv*e!1#SChvBI^aO<u`$><?ou@Afb@Z|DWFmT$gMG
zspF7gipr=2`G<EW$UPa5_58IUIgnpKV`e5I439u<agd$RIi1ey4KntizF7AZ1&hm*
zr9YTkGIqR(ms<)7dy`5=(Aub|7Yqy@*W+d6CPx`)f!6l*J1Bt8OK32W;ZW+Tu?L@1
zaAB5o^YwTc`4{nW;POk^gMr~i9IK;wl*mDz7SR57#(&T?|5{889Gkf(vk3Pk#6$LD
zFff4E&`wHFh?-PvzyNA%nAL#RPGGjr!DZGhd(G?v_KKiBKB%t`s-Mko*$aADvVqsa
zn_DtSfXdYVrUnjBz6Q0upnWXZ`U}wBG)2%@=;@gX4WRrBic=3`mV&kf1<>3e3rHV)
ztVv#;6;$7W?BSlp#o}Si)&bhTlYQA<kRt_L2PmPahqUn+L1o;Fc+OPN*Z^qGkEcdR
z9uya#wkBx5U-m8giAeSufaXp?Yp6kIWPsw0TZSp(g}fZNO?-J4XkJA6W%dpGncg?;
zXL{eVp9oR|TCWDm3!pfMn9T^@rv>VJgW5$N$}AP2vK>^8_arFX;9z8Oh15OLfeQV4
zj37UO#&kFsncPfTm^wUev2|qM0PP`Q2kmj=0QH;sSr~*tZNcuz3JK;C3{3qT_S-?~
zKzRWa?iq_&Dqh6Pfy|8rh5PY42RK0f%1~x00I7lG185%+NBIgW<3Q_TvX9yaW*@PS
z%sy<N_#&Pk)V_(jRxJVA@9`frmfJkJVTQ849wTVX^+i0tBsiT)GDN(H=VyenV?g6r
zFXH(gg89OxFFJ}9G)#n*7`i7bNPx;a4;yZa>+@ygGi<mmKxSnhuopD9WSWtEz#hEj
zJNtmWXZ8WRiP;D2W@aC-TlgYYYH#uZyOsS7DEi|;`oUu&3``FF4GJGjBp5he#Ixy|
zNHJuXNHJu+h-VW8xdk+@e4Uv~fO`g0L_dRqhjIgh!i#v;yCzZ$2_{kuNiX7Ak3!UO
z1zl(6^a80<ZeU>Ip1~yn4o3?X(0VH-P(20;Cy>8h#0%Jh>aZ6KjG*;EETC~c^IP_g
zFXE+5LG5DiJNAwZbN1Z@jnjbU(?M(5L4E~|2bo(kZFmtYvDEyQ-NF+!`<H^+$nLl7
zW;Vyz)q>K|i#Tyf?;~~-LG=@8eDU=Q<^>?}?7Q}kAorN4urz>ZP+9`n(^0b^1EdaK
z*D^SO=D-+~9nSxM5znOya;NuE`#|p__L1QAL7=z==Mm7EED~2iX~_GIz2RiYzPzCR
z7JGkC-T~`_?$ZX3z1;$(OFroNLGrA4)PUEZ!}h;;U$s~CzGkn<HH}S{tCU@4QUZ95
zxKa0H1p$x!EEBr-&&vmy#dU>C=7qexYsMay2`0k!|4l>~7+`zdc^W`xJ*)t=r<J;D
z?D#?Ic{&6pH`VU_4rb30YT%hG)B&2;1Mwkw5xl;7=4mU1383)uuweoBB|!ZH(AslQ
zdI7~HC?A8yf?mjrnS$~%==>CqDz*;LIMR!F2GD#mX#8?wzk>aFkQ`h+I1C|cs6p)t
zaM>;iUUS~*9SmN3XaOqQyki&@`WqA+ydxPU!0Qm>#omJA7Pbx%c?|GHoUr0$E9nm}
z;^j&`su&eKDj7Lm#EXK)YC&s1=7RKq{01sFKy#HKzd*+Z6hQSC|11X3y!y=-@(e3M
zX$Cw-5DXg|X;1)-4P?(^IN=Q$3jwX~zsc_)FbCW|bvVET>H~U!_A8Wt_bW_oTcDr;
z+OObM$`H`EKtaf>lp%v_7kDqU6nOtaiT!rI1c9lbJ|wLDpv=G^Xd=m=!0#Xs1vXb+
zcqYg#APjOls1AX-A2bG&eav1GGzJ42d+Bcg*U7GkIU#VlB?%idLG0<UXH;n5zYVVM
z<K+ID%wl5zttDu0P*6}x;0KreEgAN?CM}>okNkE}n;)d+N;0=4S27p#i+ILHP@4gi
zu3yA6W}3`mQ!tsuCcv?PMe;>Fqvv&d`D&0nNY9ISM$PN?GV(9v<v{yRVnBW{kzmjP
z`2$oQfYu<th!uRAeamjAi8zA?Xb+8vB$L34IPsMxQVbj?Y8E(v)!($&ec{Ad;C;((
zC%jBP44I<`)o<WAeP(;`x?GUi*@x{NLFwm3yu2tVkM=hxbU5F!7lp1xG3o)GcOuDf
z56LX(8aR8#DU}QlK;;!^Jt1g~>5Djtl^o*W^+R((WgTb_vkBZTNIrQH%kK-?w+$+z
zLE|?b%G?*S@7Pc5Nl?)6zF|KRVh^}Y0NyJO$}1+73>+_F`FTP6yxSY>_k+}c+SK4P
z84lUs1pDK<y&_~!kGw1>4V;cqm<7ropf*N(Uqb_E%|m~KLV<|{1E?%zFp*_o0L2%$
zZx+TV0NV2d8?)_iNPw)jziBTB+SBzyUc3_&cHVdF6}|6*)&$yNtfd3xOAi$m0npff
zPlJL3IPXg`Ja`c=ZfPRLC}$$c@aRRnxFRS|g4(zlH7ub18phZpsLcr4%k&~%0<@<C
zROYjoNHOkv5ihoqJBCRLlonpZi%m3<Vhni^FHs08TTFx*LpWrZLb@hH_Bw;dwu%`z
zK;v5+#$3UCH9`!0HA0~FuLegV7h{4A!w--fKxGW5%>-);!{%f`Yg|rLEikyOA`Map
zZZl)dwM&8KD@7YY^Sm$O#S=}c7?}E7?3aV{XuP;1cQcpN<vG&7`djSlL1GYfqKY8*
zg59Ucc8f!WE9OG6)C>M*AtulmG-$0ZM<d96jG!}`ctLIi?b!nDvjyb`P&|Y7R+-2!
zIHZI3!7(|3)(eC7!kNf0NSI%@&rH7qT3gK^WPZaw5VR)_6tC%b?7?e^lkeC&UXGFY
zk$lJA{c?;Xi1q~SjZMB|?+vm$`;L7k$j<c3_NwWZ?M;(!+53Xri?UblfW2+<0ek1<
z1NN@T2kiY{#PM~4>M+O}S_KDC8SQ=9KC`bxLBsvBeXRQ(`$X`#VhvNwWbk=Lpf)dN
z`T?)SJj~DlUMDQhz|h{J5CO^~pg2lU;Ld`_6KIc~ICxI**^4;AlhFLO7Nk}ofrH^i
zyzEqyDh9C^@v^O;IC&8-TWV4TTI(mD3Q_|JM`rN)7VsYTBld-$wN2TF?JGfjgzOtO
zpfx%(vaj1H!q?`-a(p$vWiv7Ru+2=+`aBbH1}5(tHi96r7jfLN-ZyO|Pt-UVfXcEL
zajbtq;-~&7Sb)@k_V|JFBY5515&J^#!}gURznI^%X$0we5yy2Gq~80wjiUDr8}Rzy
z7jcYpL1Lgh4$=p4Gb012>;tVqd=blb6f}<wn*RZn9iZ_Y6G;XxP`epqAE@jDwbdc^
zz~*om!TkZy{0gXT4ATE1PAV1D4hFS<L1Lh`IH;_?ECHPZK5Vb}LQc#Vl=ne?0J#H{
zN1)?z;5A{Oyz(NRkrPx8fyz8k{QxaHL2K`@=AGk<9STf#GH_f;kdaYJVBk=0V9?-7
z2F=mf|L>}q-)kbl0Lu3qFXH7|c^U+wKxr~#4ub_~ED~Jy#WQGv#M>L}>p^C`keAm5
z<uS1Pj)2duasib?FXH6yg4_jNrxpZq-}U(thF20~<V=d~|2Ne%1VHEcI6!;3KxV@1
z0@(vfdnoM&dHJ)Tx)5X!s9gi<%Ye!&Nc|zJ3$hEWzXmez0t$b4*#g~%2GY;L%;W;9
z1F~=08-mJ1@0<3P-q-96L2Xo684L=;Ey)Z_Jrf{(Pi*c1`5Bb&xQ)U6Gw^;uzA6S0
z&^R>r6mUE5C}__4^ehDjaNEq7MZ&Du{y%sOUx7uE+n5P_PF02t3#iQmpC<sdD<EwO
z`BqT8gD}X?pg!G;c=@fMJ{_o^01ls9_7g$%9H^cG`4>ck)Pl}R;SdM!4+8C7290G;
zg!ad0g8cp>UOv=Bic#Z4jY5Zs1S4p!pW#I;lPV}3g2uZ*Ve%rD$<?Hafg>Z0kpnb-
z?>&d<1Sk(@)G!KUq%ul)*l=ISNMTd}jU!|zb6)_v2g_M2VD})MA@U+#;3~*Z95PC-
zFBlj=>lZ=u`jE3)(9Q<&Si;EB(qO+A6mQ^tf3p~vPSn^>1+6mx<#&&5i~^v!eptNq
zH`K>+G;^_l)>iQ}2!Y4^A>k(X7Sz@~Jx9R<G;jKXfk6UPmx0;<T$NnGW|iQxXuy5Y
zz6AU8+?HH3LH%ctpOC{9e1@G33wYkTzX5Vy3utYViIf1t={X8Y88s{ppmYJ#2TFgS
zxe-vg3<?L3TR`sM0IeOl1v<M?dM~J-4KfR)2iEU?Aurtvic4g>LG=%)&kfqk06HTE
z)ZYg6zhA`jnVLs2T>!O(K<hq0>uEspFXH+3nnyAHfVDGP8Wa|J%wXhbXHb~LA;A=t
zeZyYyMZDBr6G;Vz6E%tr-Z$(OL17BY6CTqT1rTAH7yvHM;yBNO(}yJE570W$7jd#%
zc@_vnfyyj!J0+gY5)!XW;oRH7W5PE;=V<aQ5C}GrVNmF*Q8)lHC;Pg+qOt;LO@ZW5
z(EJ%F4T8?f0`=`c@d~QXKymXTUf2?3--|d7P@6Q$8@lHZWGBde6G?_0AoD=;#V_P!
z=7P#e7$2q<8h+q0nS9t@11TmC@csdOdkl`-dxG~F9I;OX&3S<O5Bw7ZIvs5o6xv%9
zCV<wJg3=_UT(G<8O~HPHb_E3~&>S{@gTQ3a`AGaTg&JBG*t>$v=UFDe0$R7%)23zt
zn&WYlVK8WKQK{frBfv5NvR=CiROVf1*!kf~OP9d*ISdLH8g~4+($dMXeGY@bg@zq9
zS6Vt+w$EYUxX`e}?n+CC)Al(GEEgIq<hRdZU;?ETo)rSZJgY$a>mlprO?Vi%Or#hz
zI9n<}V{<;2d!>F{-NP#}bq<3aXkHkUzOOn7FnG^omtf41aCrTkMd#vL=?^AS3=!tb
z?EiDRak0IK7fZcxfPu~AJlGEB7x7}Q*ZnzKICz<&IQW?&Uq6*d;gDhSdl4@t3Q7Z@
zbvqLeC@@T@F#w&#z|`Mh>kjfi#~+Js&{-`Fe{5wzX~9H-A%cUODe^_E#7WZ)_W!}-
z{Txh@AURNd!@<Yonvu`o!IK~`=X!(OeGWdRC~*0d&fvho&E#RiulV3a9E)v69z($8
z$&kGj*WEZ;E>D&O?WYjp_T!SeJXz`oPmPe+i#X=DJjFsHP<0$&H8nzfJjFs>U^T@;
zJe_Qb4IJ!DQJz)|8ZY9Qx0**WfZ8EZFXEU>Ib@hTFLy}%xZE!J;c}bQi=GC>6_;D3
zfAA^@fX{y5RYL4r;8g*MadPmg2}ptFnP0>)edV6T6vaP7K$w4)fCy-A8niD9G#AW2
z2c(aa12i9esZ`<z|2zQ^o>CzRo)RIsOQn)OE)`4t;3*Z7;wcuA;qMTV;BOa_;%^g@
z;cpd^dm%416?D$kga!u=6BY)J7xL17O<L@K@~jtXcoE0M3z}r&*(20pvWr3CMI0k&
zotPib9-#@KaC{NRc$RZH7rV()u-sPe37|FWvR`@j2+f?@!{7i)3!wD^oHkrj`4$O?
zfcDXY+{~BBAPjOp$nAVf5N_vNCLjWGKgiu6_oKVrM1;Za!gJ{#7mi8);I!eI%$Fg=
z06IU2FI|X<FHMN0drJISzEmN$7xEHsL4M*@5NK{mP)On_5fJW5QLy4k5SR=~AN-Sr
z8o=w!;-u%ARM|g#Aull%ly5;8)W!q#<2srZR)Es)i+F*rpfaqz!NL~QUIC>ya9I>9
z{1P<&4KfdE7I+S<r$HgW(}qFAyoJHRdk%vGXb<CyIQdF&dX$%y<(UIIqf-Djp5$-d
z!VvHRbmqVuh5*odN=Tgm-s2D2v!;-J%wF@#9S*1LBleb{c_2_*0M<u_&Ih%6>|)RW
z#RYc^*DTPu;)_^NACKV#XzdL|PHrK`EiNgJKTN{V^KzVC#DdP6uondNUqNcX`;p^#
ze8KJn)rB(l|1VFL{@0ggfA{hnsr%q^^f+`68kV^xh`SjYUc||Q<{?1mr*eSy^uLG|
zQv|h%L1p-hSg}a+TlN#%8|<Hg>NaRu3_kY^yszi1J*VPA2GF@ypz}yIvrpI?g65%3
zB$ynskAwa14hsA1WA={b$86SLIUpmGebnBQL!8Og<TR5*_7VF)lOqfYps@*18!-C}
z_-s?f7qJ2pIoOz@cnSnOO=K9KaBzU;y<`G;?g%yT+z|rL;k}5HG2~QW;pDj^G~q>@
zjHIa)10T;Fp&8yMY$PxIk(O6VXkg%E<pQ7epp?J>T7Q!W+4E!1$gu)6M#uE4p?gu4
zvIAf8ga--?$_{;rFXE&-L1~AlL8!xI7ATKMXM*CNr$J~2Pocmp(AsUDIUxI_LHiI{
zIOZ@(y@-=m<haEY#gi)3$x|aVktY#aZm}>$^3(`5@>B@SdJ!l45wzX`bPkG%B>M#u
z8Act@_@ar7`VCN;eEnP!e1}o?UAvDUK1j{$r`+K6Cof`!8KLE?3s0ed3{SCu2xzPr
zlrMQo1%yHSH$m%Mc*+H&K;_AcI4MT1DyAr&YylCFd%@~51!Q<~Vf&#tIe78~q(J&W
z>OpJ5Uc^bx1nFtmqga)F#O~*dSfNbwTXr8ody%}4*!={xeRvWDCSR+UyWifRAi+~C
z)c7J^x)kI$kQ}Iw<$czk)BB9Qp!aEeN$*qkiry#fHN8*R8+sqNxAZ<{@92Hh-qZVt
zeV{jdEXk&^p?iPrg+0<=I99N5ard&waCc=iaCb6sy@->j^uA@!2nu^p+weu4L?ovx
z7c0*kSiDGBnzS$|@XQgK_##e1(PWqX{}=KyzC3e;W`gD{LG>FbeRD`Kg@f8_{2l_r
zeJP-^4g3H63IZbhI*>99G;hbR2RVBNv^El)=HsPoxlNcP(bN0&nH<l->l_0FW^v1K
z$#94>MS|M+;Bz44qzpmn282QOg4=nZGa%UQ?}FNU3d=xem@+7V+Iyff0o3LLr}ty_
ziZ5dM9ZjT|Ux3<pCK3z=kbEr;>c>WL>|qiH&;R{l5{Juy&H!g-iUOT23>v$JoGly=
z>hl>u+mE0#cq3oL%k_fF2Jjp)=<I|zG0<3I)TuuT;I<&h9*{g}ejB958-0y3WKM|@
zB#$8n8B+$g$sp}%9*g|bkTNj)ls#wmNqfQU6ZVpzvJh0}fyzQq83-EpyzDOj1Ei<t
zmqG$)j4MNddj`0yIt4m^)n3s1guNtu?<`um<$v0qvFC$=h6x+!JR9yA{SEQ0p!NGN
z<mF2<Y`ABD%=I|J!{O1v06K@!laqyu12k3)+V9!(MM=O!l}*Fbn0rD-8utuPA1~9G
zdjiiIftbs4<UfG&9WR%F2<UvT*UxziKylesTXz=ZHjueII|PDFl(|pvln8n76bprL
z&0&!Nne8!+VFpi{5a@h8cMevjaGo?FA5a_I<QMA+o;0BVt|MGxJT*cQ9yY8euD9{;
z&#+-V0Wyz+k;&V{f_n$7jSez{mrFnx<Q`C*g3RDqArJyOy9;C%*z6ji0FZsA72G?(
z=9UPB@DvM0c>G~KalJ`?f5soy6L9m^2t@I62}oX!lK=4fIX8Iz*?cc3pUBE)+Hz0e
zSs@U`%K?|4;8DXp10>(P$3eoQl6%IBco|#JnJ^$W$e-pm3``j{+%rs!SwZuIAs%xW
z6g;LeOyF+elHu<Vkjk3FdgJv|78}!WHVwX7p#V=y?g{)|0#dJ^vWS4(3i7jw1@{NO
zTA>h-d3@<Y9vs3<ktSBGKVWWtAus(F6yBgbq|D%eIzBJQ5(|nG5C+Mc-(v&MFM-BS
zJd{~>fX078bq%CEvILEbPK4A~mW?J7%u+96nO~aUvYe>g%#~+8hwGT~sum9Oy&MkN
zcPuAn-?f~nJlSKN`5dl0$_w?{%=fY}WZ$t|n0?oBC8$r6e8+M(xc_g;av=GR<zACw
z1`e*pT%yT$Ece6qu!8pK@+5)w?Q#i#%2xP3);UZuJZS>rCX&n&;C-Po44}O)Ax+a2
zl=xBv<jub^uyI}H664wi-ZMO@tJJR4{Icc5>^qhRuheijfzHn}zh$#Jxq-m~G@kY%
zmI=K6!$gLG&7_>cD*2AhPV*a<6T$mUW2M)E)Pn9L@IGW2+5SM`5MP>reES21O?(Lg
zve)-=a_}Vy$b;73aqnk}H?ieb0Ih4{Umy_G9j^d7@0$rUzF{_(LE!pc4yWdwb7Mh!
zi@Altdy8d3_Lxs*-~siy!D9779(=VzK4w!udxPadImDQP`wHx1&G&-F3uWGd;sO#^
zj0~W8^h-~qf567zK>Lb7Wf;gU;PseK<qv@7=~2#Pf6ny-6yMx)xtL$X@l=Ax<!;yu
za?fA_?*-s)0nhPxfy@Ezq3&;pUk@?^)Sm*SBlz4rw7de(UC1zi&;9YR;j#d^O)0_u
zHh+V_Owbxr&>3@lRSYs*Rp52c4%}0~XE13gH~HUIy03qme~J);`5Xnt?rD%Sw?Juw
zZ;ucIUloHeXiOP2N6_8?Dqrnyg4U*(&tWhC)ej~z3=JmY3=N<&H9&O+c&<ZU7JPOP
zY(5H9XMxVI2aSiBPnK%DR?OMMmmna_Rl>yFlc1ml3iJLh`|}_<(7YR{>;|=eVf7Sf
zoC4$@P<@wu6ErR%51J>Ls02DYZw_Y<Y+S-@Dg$`^CFtB$vndP)Ch`ml{0aioxGsa&
z-&yf35Rm1n;t~Uuk9>E982IKeh;iL#66-r)za69w)V~F}6=pAJj00jXBLk?egN|()
zg4Se$*A#%(d&kR}n!DKlXJX*k0vdk;#kq$mmjx)^ug~G^;oBiF>-AIV102Fk&ZzOv
z29AHOxm@fZf0(r~c!1o@afgcybQWgz6?;L@ykC2RLKkR0l_!NknCCJmj_kqf06=4a
zFBlkBb)?!K2gyU+ZFdu2o%SM*eI;lu#^pIuANm{Y!$JDM>FW>Z4FCAOpm_pNeFI8g
z9jW%<Ipi1e^1dLmm2Dar%q^7@LE&K{&d3062OP1N1f_LwoX1Pv1+D)%ZKGhJ(BOX?
z+&^Z9t~Ev4I|mvEfs8M+O*EM$$6zvxA>l<FTcvrk{r?Hc?Y}|mB`!~v{?k@xUke($
zX-l%t2bpy&=6*bgei6qh2-2gh(7^B_j^ihY4I1MGr5BLflvNlQK<)#jH4_O&1#?TS
z#24`rOF?b}weLWFfyFN<U4g`3#IaVIM=>No>{SQ=t*2^BQV>u!U|=|AbAK*K&x<$?
zMUyIq1gO27AT~(di#S$BlPZP-{SEg1Aax#<3>Q4A7;e0XV+5D!ljlIj3_yF;K=y*%
z2udfQwCrKSH3PJFf`5X*9FSR{yLe2hK>ZeWPf$Mv#0Ir{Kx2X+y`b@E$UM0?Xgy9N
zsQiGL2U6!@!?ggUhJTjAOi*3~`3<xV>xI17Qjl5@2B`<x{UTlhoJT=!xgNvW<6+EY
z!IvR06Hnfb1jn<y7<fGnnpxmAPav~E=77xOD-f6oiU&{`1aiAsF@pg}KUWo~UoP4T
z%3G*rh%W_=9fQUjq2@U7RVmB_nT6&i2NQ7y1!#E#b(6?bn0cV|49bI`{P+5)2)Jzk
z>SMfq&K3c(57!+Spm0%YVgRRWvnl+H_|7r*c4kQMj$x?qc4H{;4ra*kc427XpCaVo
zeZ_93*%bT#+0z*rvZpXgD0MI}v@0lZWH&H!m`!15xGur5lxqf41Yd$shlvOS7nofm
zG=Z-|2sD-jI>SkUFF|O=i#Uddpfd2(9|Z|e`xVrleG$*G6eI?kUow$kD1eI9g2b*z
zOG>_ok;paSWMBcewK*6;_Y5h3)x<G)g4CSYqx1mO&O$N|JVwB&$|Td?pw#4WnZboq
z7*r?NgWB5)CL)Z7K=)Iah%huXl_<@Cwb4Oly@-`xs<4CsWQPH0ehFmHwFjWJZ|tDG
zuAu!<khXrTJoqeEjy+&=uY$|~ol^x;{~}f%HfELpGvh@(8+a@g?#5WTt04Qpe9$^&
zP+LEq4KzLivcmyl4zw>I%m_NOSf;%}VFE}TG&b@gRt{`Ghz;s5!tA;BALLdxu>W7g
zOHT!@>4Sz%1W50TcvkROGKdYb|3$3qQK;Jy{so)C3J(7l3=9#V_P~Xu(*GOwC<r-R
zW@vdKFPjPqPf&V9^krf|VE|t12P$Jh=R|wsIU^ceRvxmy2|7;)cGe<?Bol1hK@hqI
z9<+8tG5fH+CclS3hqp6>g0~BUh9@gS#funz&{;ZBJXZu_OoSQ#HBWA^0L_Ji@(1ir
zg}wv@fot^=EM1cuJxqidCxF(_@@y88x&Rt~+$<z;p+))yXdaqpv5*j`{N>p!Bw`}W
z;KlJ+qrpU&A&Y0T5NItf(}iZv&pca%*e*14ec@ndisacNByoKXrzU93pJ#~>2WXsw
zXNwRQ&t@T>3zH@OT&tJ4&$C&G57IA{_{(!ZU^*yFCeJbd52}Z}@tpAp8q+WlW}Nau
zUY-?XKPc~l>!TC)fgF-d9-#T!>{IrR*(dEivya<@_Q57*AGOcSK4M?U?;y}}VUG0w
z{sx5zP(Kx9r}rs)NAHvNp57<y1HF&iM|vN#PxL-&pXm*ola-fw3yKTyIJ<|yTu>eZ
zt&IS;`$2oY*%&})X3XJ_0Lv+6gVsTKGAMX^F=%+GgXdhBvQOF@W}mXR%sy@}*sq{i
z0XmzOr$iw5!X4=kT{Vprpm94+H#S*LRdyNBSzOt7?JZx#OaFzgJK1&J4HT9v3|o#d
zFmbT5vx36-g@g1R&>rI#^76SLvp{Eha;tDjzHpFU0~+^*nFp#@U}nPfzlfK11(`h=
zGENVgN0lHdETHX8kbNMxH`UDNy{^Wo2|gD`2C|O@G{2V(y7S<O{X|gx_99LUv^KE-
zH2>S)pa9-~nW4bF<3*h4MH4B8DibM&f){b3JHca`!gAm?Ea;44P@5C9hQX|uPd>w#
zdj$t0QwT>56Zi~c6ETJh8OGcjOoSOuU7jlar)`OX!sR*ADSgWnq(I`Jd#FI|ysXLG
zD?oHtnf+FfI#4~S%r3xSF2QmDJP#Eoxz;?2Spn1s0`W6!*)(3nv!67NV)i&uqc8&`
z4k{lqtk?`d>-|9cb3yCkIHZ_D`4R+VK>P3^`;r)~n&v1*W$a=zcoEOK@Ol)76Q~}`
zu;D(?-=GM}cP<%w*bG2+yohJ#G>>9VI8mdp0LgsN8gbAX(qJ6s8#T>Q49eKWW^p}=
zqvb_B%S{tD1_!7eC;A%{LF2p}8GG0)K=m!QdnNj(*i8k61?UXU7xHqopgn^x<mKjq
z{KwNQ)Bx)5f&A0opkM`xix)BMZ+RL7W`V}4dJ^onnzVq%<mGBXerTVf*aT`nLdU3O
z`lr~<MKZe;YW7m7*)x&Mo&++RXQsd`(0)0neO;h2iWe~wpgZ6qO=dE1yoiwitqF}X
znaKd!gCF%GMgp`>Q=uopKAoo-JQijO@@M-Lg(#>yY(aK3w<!og{3q`UGQZsca^ESx
z1NeRfQ;-}_0*Ed56{HW!2JH)m?t^1w$UbXtX~N6km3_wE(S(N~Ci}F#rwKR1iR@GM
zfhJrGH?mLKN1AXlBxE18uLR9^W*-5c6$)Ng06M!Z`+~h<_IZ2F>~r>p*(dB1vya<n
zW*@UJ<Y^F)xja+;N4tXB4^Up~)>WJU8Ur+$!oXz0&)@(mm-!k5WXz}9FTAu>`bXQQ
zh6Ip$(0D57?h|fJaGy{KbO#CdWUd(V$@U9D;ScJga&R*FzmS)|3o@fyOF@A{gvpJs
z31VNfmV$#>8v|3fHt6hX1_qO4`=3`5WaL2eP#iK$9-#e0m)m9J`C1_AO=K8OG}|az
zn6)vmfcl%<+7Y02pNF`0K=!jVHS0JynaD7Baod3S3`HiA3|=6AyoiyV$-%<p_Cj7x
z)#L~RlZgn!hGr9GArl#fW8F6P+d=A(?4Aj_v+zZXtRYyhyzE|(9&;0WMbKR<Z4>5$
z&YAK8@!KZMw+HD}TCc}www1YoZ;QgzR|^g>nIzkPypkXz%ab6`&XXa~(efZc!9<cF
zij#qbgW~}!`->QvN|4zc>`dVt983`}Vq_MA_%GyTo`URZZ%|M|GGjXE+$5e1ff-0{
zoB>+Da9LbN9wf$dNI)1AZYDAe3%Y6)LH91U@H7ZSfXbB15>hX+57<vM;bUL{+Yuu>
zG5ehTOcP0lk{2=3nIJKQTIty!wIDH&niny$mL|u*XNknTh>-@JSsDdaE5pD9QU@|0
zR8L-(kpBB3M&=<%-wS!^Sdbq~BpDK3#7M0KiJ3?;e0UKf1v=v|3an3tLEyr48F`Ri
z&{-d#`RmCl1{+LR7?>daN_hB92l*R(w+3jhBOe3P<tf}Xm!?Rka8F?h?OR}fA9O|<
z=VcawHU<X=&>Sh~jvLT=OpyCQVFL;mo&*6<c;$k^3w#DAD^t{q7|BA=IwCUx`~RS|
zMBx7Ab$dZjSenQ%JnO2lJPY;*B2BjRG$;sw!UMEE-=u|sfu}(Le7|M8f@L{KEy%Ag
zVk8cN*2KJ!mp=-UM{)xwPGIWAk<=$5tM|TOujqZ=Ueo)Wy`lG6drR*#_Kx1C?LECu
z*#~-`w2$;YVV~%I+&<I$n0=x5QTs}7(Amw<b4@^P0Z5yJp#ijB0JOFev|b0acE$XL
zy(Oq!09r#~V#RvlMZCCg_6_J>1xVcqo?|kRU<d)XS&rCeg2v53<9peM?F+%{8)IZV
zL3MLWgF*(VPw76H`Ol?d=?}_n3=HOTL{>M|D1gg-P&o`LN6e#GJiL$CXL=vDF9e<2
z400c+UU0DC&T0pp_a?*0&`_iBL0Mmq(cF^x1ZYj{i#Xv{@cp4xEE8VDNJW~kFc*O0
z)TDxC0;rt~TDNK<$sqM2PVg*9JxJ|~7%5JZDwY}9N9<>s2s1#`UACWSQo%9<d^Sy-
zAm~n8E|8nx?t%E35o9;0y=HF7!T||8@VJ>LbbVdmi&(~+p!NGFY7`8-@7Ozn+S5>T
zJYo0Ef&A6ppr8fvw|NxHix=@SkTbaD<w1R;m=|&EM?vA%-(X)0TBi%z_Xko7+IwOi
z#R{5>1C>wVCZK(Bpf#tl;5Eomr|0a~1=-copa9+v0dlLkCA57IFQaN6#R}So0_vN@
zfX3O(Em<zW{czacF#EdQLeSZ?**EPrLdO7u&9B(41hp?g>%dMGD}c`TW8kXd5{9f*
zVx5qE%U%-Hj^q$wiU7G8bobkfc%iSL``<u&*u5{?D{|FzG=SFVg3co6s9}MeeGb~E
z4h>U~8?HOZ$SXJS|I9zk(9j&CGy}B0yg5c`fpX*e|IIN<E0o*%LG%XY8DM&ciHrhc
zbBxjf<pw{+<`|_DpmpG&v(TGoDV<PCQeXh>e`~5zI-!)zfW$@;Pec+=LSm<Y*&<D|
zlunoxGa>Y*g2iP(=7aWoH^(SlP;TJA-5jHIL%D<hw)q?u1~7XDSnPrFOfdaIc@CKV
zpga#u|3JDcfT?@Rf(+1I0WV@1G&vZU98S+sx&X>^-qRT(K=Urj{NVjD5++vM3qWTJ
znM-g8fc9{i)Nn5VjXib;+n0mJ9NQ;3aF|bK$TOeJkN_IDH?d*u;GZl6UV980Uk8s5
z_3JT$?pZLO!#V>LccA+_&F8RgfU=jG&tW|QW%ruTVSNB)mzvLE{Q+gin$KYqfU;f9
z=dfu&*}CR)*c_m2QS&)$;CpdFd!)_huvI|B<(`_)VT0N$ch-Ck+YYGsR`WS*H=yjf
z=5yGfcFDDx&tZq|ZI{b6pTlkeRTFAHhaI}lUC!2g4toYvT-AIIJ7kYNXijVnJJc@O
zujX^up?;LTYd(h^>POk5=5yGgew1BnK8O7WC=G(jF%uac(7iB<{0#zgj^8<O0+jZ>
zBN!~QZ`y<QuY=AKnhP4g_9$jh$i58OcMQs#pnaX$m+dE-M{y{46f+or)~$lhs(BGF
zYMOo79@K7}15yX7!_1>N7Vu;UOy?;OnDHWB<SS2wz)VoS1)Ws`iZ4+40C5i!1M;0U
zp!;fG#0i7<1-3V+ukb!(d(%Xmfd$kz1(jPM^Ub3;e!Pg|+Y27o5NBWl%k5-ffyi+x
zyolq2l$RiVRh%9m`4@3~u_lrXp!MrgptbX$eEcF#2z=H#sLqC{VR&l-Q7>?%mLnNd
zrgAVdg@ep}5yyMiJc=^|bk?W$b$dyW+_mo<$sjrND9#Bl;&?&l6ocFeYEyvLE9kz6
z6D;IlW^!}CW3SsWCozJ9jVTgzZvl8+Y$XGe`7L{06IKS67jc4$pnXs#Y>W(`b}m#s
zsGR08kzn9}?w3-05hrjF)UOBKO9xuR-%+y&w3n#?<c1e<ay!kVm^PfKSqvKg;Q)=T
zLi{L@X>Q5D2HNY^-=MSsRM&v^lpWu5Xa#8A0OWW0e&e|Q|1aVgK<h4MzF=U=dJ)I>
z(fpP@Xsv%ZXkOa<mYpCdznV*MZg>$d>T8nBzyjKj=YHK@5p@0vNd83}cQ3f^juZEE
zzh$rJe#c%Be8*@FXzqkB5M&<cOlr_MY0lT})!pydYl6%Krx^*(3!pH15ibHd`&kfV
zuE`Dt9<%TEp!0wuU&L`;1=#^I*F4Jp>x($CMvz@lJ9@cWxmZE<9mqV8Ipz|aKVHNO
z{{`#0Zm(#vgMkfn_Mh2z``<6(cr8KV-q-CwZMX>cn|6}sx9k*O#BuS0;^2k6tSu;v
zU&Qge1gpDaXXt(1PSN{@9r%6~@0)gl-nZ-|U&Jvrg4Bb;x4C)#T+rUK7qQ~CCQ=OB
zOr#igyoeP~1@)m!q!@O+h!yv}GKU+yPtL@cr6I$Hr2(|pjsrB#SRvE_+Di(m&p~4V
zp!NDM;uueY@)ab0rGA=6aVdc6Nl+Y`$nY?v*l;_fAFvYyrzc4Uju&w}6G3iuzhfuZ
z-k@jz$~y|{^%!5oNi~}6;_~QkP~-rKLCuRakK)QWac98;kQlgbQD$p+5y!q2)P^`Q
zM`0DHpZOw=eX5BRqXKAcC1{Ku6s|8~xDr8QZJ_nNCOf%2Uc_)Ug4g$^FoNzp=E$gF
z1dkhl$}R6XToXX+e8FpcmAOIp3par5!*<V_`8_-ETz>vhMg|TE@Oh=2&^Cu4zl6Yy
zb_RtHpn4lr=f8-TUutg21zNY_%(Fls=5nj_-^+8PXM10_+X!}B3lnHx%uJ3H7D-Tg
zcoEP4)?9*{p=E&r_%0=oI7l66ED<Wd)?9+?2k4$9(EJ3rtU6-P>3!H<5L90IAGHVX
zKLzb0Yo4Ldq4Zvl5roaYbIkzhH<4swFqh!^@FJdH7PRh_XNiD#+XK6!+$~(pAbUV+
zrq5(zcoENc7i16U{Be+7ps^UU?_4_|Wg#<YZ9k|Cc0MhoFbOpG0=oMF;$PXL=9b)`
zeK|8h{cq42`5-ev`$EhmxFuf1^XYQWWRV2*NkDqMLH9`<hMmi93$7PI?KHSOpu01`
z_ukt}a)>iIpO#u+kbTo;BS;Nc?-6@JZzTO7Ga>Gf*$Q^Y5%3*LQQp^WHln(NR~F(9
zNlB2N({t?OL1u!^is301a^asKFqwabz#N`pAqSosA&(dG^0J_IGt6D5r4+hQ{VjbJ
zY#(U9hzt|>ZU7|vEMCO(*h1}71lb32J1D-)?}7b%7i2fYY;YSEe77Nb8_@iQ-9}KK
z0F>5V#4&EozF}|aeZ$@obS8`UO?yK~I_3tQXD$g^6Ao$%g34CVdBZQ_<sO3i6j<AV
zh&eS!*j<9KdJi;4ZGMlvA^U{gPtduR;JG;|Cg<!^b}zF}+I`GEZqJx~%$^f8U+wM2
z&;ZJJ-tG(uFJc8i_g;g>)IsCh9-#69BzNt<%={N|;#)b`LFY^`7=XmUY;gva7jfdP
zTrZfyU&OFig4R-i#@9_G7y>|QUc~Yzg4A7Zk^bA#rqBQy^9PNCb3pDL-wIL(3PbNh
z7LlMkiM>zSee^zI_tX2hJ)`$A%=0$Q?^!fL%;nn%G8Z~8k^mNq6DtLYLFPc%5>2=m
zLE}Z9ptF_1^09oNb8(_LW0+W57AP2i!U*IRP8;x?C&(=hFXZK(g4_dA4>HR{oI&kH
zoaj-I|2#4nDnR4!pz-S$F^rO+I>|)F-kDcMh{gQ6#Y7Vh7SR145!ol~XM*Hj#B+no
zvF=u7(D}hk88r+Y?w2hlW~4C~T&j_lPpDyV@Tg(v=x<PMG7)B2z*8*5U?R-IkW$Rx
z;(pm;YDzJKkNahdxhcgA9`2VdR;Cm)1h`+eynAf(p&#B?EE~NqTPb>9vC_;aW>B~^
znXC0usZ@900tJbT5(bTH`y~WAwl)Zua4^ieG?~-YgoB~aBa@-Q{JzCs6Jdq`^Q(3f
z`R6l)aZlwExpY<P$F*&|5}^HK-IMK)@=X<TNIqcq@I?#*BWSO*`xVQJpu3-@PiC-V
zES7M%G+Bh<QnB>^z61p!(7L4V$@XVKa@j}iCz@Zko5;b*6k#I8ups+{eJ3bSgX>;P
z?u-}ll1oik?f+-gFiZf2?~8bevpf$3W@Xec%y7SInR<NdfdKbAmLD%qk^X5S!@vVF
z6WPAD1VssueW3RG<yQG0$FCmRVZvem-~End@8!wTf2Tm#eP5~(f$cxNVbWs%A5@3G
zU|_g#p+)|OM<z55S(zd;QW-j4M9cPaa56=i$k^ZHwSmMVH2xwWamaoXRKE7lx9J7N
z-3xgs@LBLL<Yjq5dusaU+ieB8^95)>stl8B&wRVDAa}Umv7C7PjsqzCIY49G<{b<y
zFuOth`xntNbD{R$2ie=QU(vv$hM|IkmC5DGe3|<u!VGNuEkY8Y_7nePAvVx_DX88C
z^~GPrvw`a%o(JGMYY}J<7$}@y#0%LXmt`DmOyQ8S%x<E&1h>VDc&4S0vW#ybNDt^<
zGHAK!fmCj~@YD$TypWf;3Mw~2^#}(ClS@OZg3y)uGW)@276~)3^|Him1+^(baxdiN
z=3bdE1KPj1h^Iz~!9+%YA*F`F1(c6WWWn*RkWtH^VIpJ4z&)8s*hGelp{vG%*Zi8r
zUyl@q2GAMl=2z?{@@!)W<=Da{d})i+k84wTB}|qwuypLPKgw4EO^?x1Pf1CS;IzoX
z1Uk=XCMZ2Z!boJUxh3}jL>d%63QB`7<Yi+)=@3+wn@DglnBU_B@7vElXD?~OXa7I@
zj6LXH2g~de_MYY^%mqPZK=yI_!0co8k)U;Y9BfQp*+;>5*n{qX0NwxKn0>@P6Eu$V
zB3j}o2OE<QC@w+$07(0Y<Dz*Kk3jZadqHq}OPxCbOsjH7fX*^+?sE_TwfVZ+95TEQ
zncW19xn1|;<lx|AiUgfsa&;Yt(~DUCmF7|Q|3P~rS{f2MKxZv?-mz~7=?CfYK4&lK
zebydw|M+QpL+?}emfk1r9lcN3dwL(Y5A;4}54y7>5p{gVobg4RNT!Jtg9G>sUI_*V
z4j$;fg=le8lS~E<o(BSRc+!O?faY&_YJ@uYJB2!UUJ5nvu3(r0o&Q+G>8H^E8n@$F
zATXIL4|MhxV-^P+Q!ob~lNV315X*&j=?`FY*_onvQiL2{#0p#ltw~R*VNd|w(_$jY
z06JGJ>P4);!ju{Ym5dq&(B7}A7qMI~LFIBn4TA}&zxE=Q>m-zKaCwgOPf+;)+RN77
z)Brkv)#ybmS0_lmyU#%(p@zYTS4IJJo(~774A*4PS=}J_aZiqD;MoJ7caH*v?~7QT
zpB$V_?l0tJeL-RSLSC+wXC3H#8M#*e76D;U8UdZn#v#e%1v+cj`=s4W&>3x@HQ}K3
zK;FmgCW6)kc^|Xu1g#bFK5EwpUK1+?K99iiMVugLFM7a<8buCp{U^!5@FH3SJb%oS
zCDh=3$F4A=hQYx5j$P%o8jcpw`HVanLLFu`3<98ah@i0NO5tMRnIJHkCsSxfMk<3s
zMjC@gTY`cW=nh4`MuDjfTN@PkIt8Y2Yz6Q6o5XPqyzZ$fqlUr5q=dl%bO&rkF@po>
z>>~atLZGu$A@@=eah@;NQm~m;UB?uRyr$Y;>{`A*9As|Sas?r;srEO!R_-?k@i|18
zVnF2uUxUD8P?&+n20(Mupz#0`DF%yd$X;~G7jgWZpf(w3Zxv`<`1Blw6`=J#pz~t+
zX9~^ed!Qh|KSK!ICN}%d1G!gyI)j3TG4}!!MeYS{2?|m?3IbF3CJIdD+UWtBpYY0V
zWH2zF0uB?7?8yuoAb;|hK+aW$-4O_CD|PKmr~<jUX>t5~kRGnZV7~>mq&awj!jYdr
zK%Q@bfLQmp{qZ3A?r#cG-eL>}URxOqx~}dw2Z?crFgb$GDhBxz)XxF=)x(MneD3{=
zIA+kAMFx;KsGsIx#a8hmjyaP<hA9%XzZ=v>2kk$1FlJD2uwhUFt#JqKtGV7FYkMV`
zQxkN)e1bBA(uEqS7YX3|?I33qfX1UhXBUCzc!U)=xN5jWKx^#yDj7u0ib3lX<<El7
zgax?;wCA2bL;yS|^}>~F2Pphc&rwhS&6$DbZn;t{8h8?fLO^`veXJn8;B#m$+C4N8
zWMIg?VE58QfT1M&yxm6=eg>87b9O&X_!yY7&)PGZ@G_`mpRwo6K5Z|^A;{#Neac?a
z{FL3+?34D2CY%fo*(dBZIRu$JvX9wYnjf>9n0?gV(S((Ojf0iR2Xq%}_F;R_IeyOB
zm+Wq4AGbGr5iRu8L`oghesck}(KzO?$h0>&`~dBj0IdOe5zQwHnkP>_Z8wo8Q%C?*
zM}z#plOWUp$_p>z<ycb^7!*#=QJBHO1#Yt{yol!A3f6PRZfo*cJJ5OJQ6RlMc|xG|
z#|;@-p!+anr>5jHDD*ej^E%(LTiHE9VUx*H`~N))?7-v8pgIkFZp$URo8A}g9(rG}
zd+B}N?xXiPyPw`??HRq#*mHWHwion1WiRP{(q7T~guSNsaeG7WWA>KbN9`R^?|rpv
z?C-F%b-rY`y3ffDyl$#b!47;bgR%<)1BVb(;EQO1tL9N!i7(`3L3^BBKyd;Z-!#7`
z$Y7$#>XCiY-V?NEG5eT(q6z5yMbNpBp!E(X>;u8;9iVF+vJcx=@@OhdZn&%<Wva=*
z)M;b?9K<)_v<Kbw3Ocu);YBoeDX8DkYOi_$bPh<%0o4N_{)>3&rzWfnOzB6#cj&T!
z&Q&u%tPi?p7j!-Z=&o8p*qQ>UdR`M22DbhNWd`Rv`hxupN*_RbxIp!<`7M3n7tvg%
z=9WAKr{^pcaK5ZR-}#FELeRb|&>jxZ-Ye(J`invN0Awa;?}qag{iR$bOu-=gvoC|z
zLP+_7>^U)K$pWzXO)4N-xW7SVf%9d3&>F>6T{S8*oG<J9o5(PRbk(RdIA7KeG?8Hx
z=&Dhv0M)b5`H&*eSOnNzmOL9?#4#3v$1|ciLQQt@ya26NFcB62tz!-cjZ2#B;CTV5
zbL2tydUAo{Aw!M%gZmx*(EbJm4(C()!6q{N4WM;1?nm`wLGsxL><vwnnL+#Xq%Q1{
zdcjjHB*9Z7B;$QYKM`fW9&E2(s*s$?QU<mQOQjd_6btcqTxKx1R3d#4)ZXT)5dy7|
zu>`ftcoKv}coKxfcuIuWcoKvJc#4IDdKM@&fclP|u8I;MyG?EE5AxIqv4HMK_CBO{
zli=DG2hbg(`i!8p1fcNcI9dU^ugmR4ym)T<F?-ei1|<OwHYQM?&>eI}k@sDDOYRkH
zvfS<LG8{))K<5Y=g4U{BImVd{YP(!mD*XXe{&U>nlJT%%e$n2bxByh<wYoKI0F`+>
zsX{EEat{>Opt28C?wJTPG;!511%vL$O)zFq0+o3t!VD^{E()NrpLxA*3LGZF400yI
z3?2zJ3@V^G>4ahirGy#=1<+hGPZsF>4tqwBza4BCK7slQ2{sI$9QH7`fz&wcVeUw%
zVNi0|!`ua$F9(_NLS7csmSuV&FT2!)g@NmZyzEpH76!f-^0KWaEDQoK<Yh}uSQvyr
z>$pr<K=;YYhMKT2h`o@Pbv0oDtpS$>oiil`%A24*B{*+_?oNi4X-DlrZ9&f$(JWg*
z;R?bp;ze!2_uVxpIDp1zq2sPG;CR9)C-fOXac&~ZpajYjpfCo_+a@2iR|Mt5^dt7F
z5Hm$&L3h{nH`vF5^F@QbFF0+3^Bl7;D9`mbK-5CbQvjI(GZSRai+JIw5Hswqn%~e*
zG?8Mk0h#e4UQW~8k_)td#Q8-u^HtCo5vbh{8p{It8&tQ0@)c<87c`~->hnPN@q_NP
zaR!}-n+-m9Sr&YL;i*3g8lbUVklCQN`HOhjOmj<K4p1H0(vScu&%?pysc>%qt-S-!
z1st-wX(GkI24C+k&+iMW!$I>tFgKXrv3CZQh0yhInV@nDwAKq${+S3fNbxraDXpuG
ze+#1dLHq7++JVNT96@KEK*Izyt_NPXrQE>607^gEkoh@9^E>vAp!}Q-Iwxf@0~6@J
z)(gqfAJRedaItdWHH4?<EO0VmvHuUrbKvumP}h%v^O!wj`T=`z8J2$7KJZ1nz*<ng
zJuzp0KS(cVOc1ml<MJHo=8ir4)j{Ja95q}=8&d7VLFR(ax#TGjhytCD*WZv}z#YRB
z1?o?GU$ff?+hYP+%eAEi+z#jk-R}VjA12TqMn@BF28ZlZ_MRqO3{0Rqa5)g`2s6!(
z*+oL{E^`H?W$@j%pmC$K_J-MK>@BlT+6QKz0N-g>nH<g#;eE$;W^xQe)Qf1jpP;^3
z_F=o3h&o#CBB-yMeA;fIi422E@*TTKkQx&i29M-Bc8TV9>;$v#*i8iS(@)tg%|2$g
z^F=)0)bu-c8&Awx7y&+??WUcg`7L|q7twN+<|ph9LfIG1Pui=RNH8dw-?TG)5iREk
z>W{sMmRks-O(Yn&%x~HSzKE6+1og3BM9UR|Xy?mzp!3z)6N(ueobT8PUY;ZUyT413
z3D#c)ons8D-%<LkpmB_opm7a*X3)3*D80Ujmk>0!<dp#Lv6TVc`5_6KKZpXw4S4MN
zti7T48GB3b)Ao+ur|dnwPud51pRkXF-^F{>9_?N<J4R4^f!6ha*6)GRz>9bu(7eLL
z{s#N2u<!)sgBQ^<n&xNiMWJEpWx~TC018)7_<_PU`z)yM0SZSR*7P%W8&A(!bO|(n
z0UB58o@{Rm>X*A;wik83VlN3gZwKUNt`er$?R!D{-`QnAcbtOy>L7oD!_ktd<3+So
zA}HMZ8x%Ky#LdszJqESGKzrn0L`!pm+?9OB?x~3k!<OVbc8@{s0NvS@e8=v&i422T
z@)5g_$#?8NgWL>qXEvz)cNXMEuDzhR?r%_J0GaE2$1WF?rkyX_<%8-3(0z8!ckBv5
z^+J1t!Vc%lcE!+r!izjg7!>*%6ef6-GJwuR1Kl?i`TDUW52!5Q5M_$ukYx(tkY$Q|
z{a7pnB-XzGGM^8Y69Mh(XAw!MVekQst)<j51c2<%Mv7-pS}?cd4R{eRVhJjrdiE=T
z+M<v$NtJsAsO*A_53#wLfX;Z5mth5k<qLUfcsng0dfyQEZqFn3lA!Tl*jVg~SW(dW
zh=vn2ijzE!G9-8$XUG7JErRlk!!d?}7ts>nvjR+Hz;zkJg&ER6lp7d0Kz%`zat0RA
zoCGM(C!{bGf!4r)`imK<3<(Ko3<WRZ1zu*PGh{f_FcdkIGZcW_5AvT!1w(?lC2z%x
zc%g})F*%0{h9Xe^)}a!lhkv6-6+?nUF+>mO+zL><g64-_#EXObrpV_qVH=zEKW-12
z2iObBLy+<YJSGmhE6)YgzXP=?!Dq~Y%S&OH{}+Jzdd}ty1>UL*37{|lwdK9l7(jE6
z3@@U^JVEP+Ol0gq=fE<6<|RP+PPv1D0UQ=m3=2SEkx<T10P>@`CGQMSm|SR){s9Y<
zj5LOf7x4lsL34MYumk(Kf}sfFZ@!6Of5Z8_3&DJ>;UJm|avNGWU_B2Hv^D?{4xFGn
zc|iN*JxwGT3P5LifY%Db?g~9&@0g8tj>n5wk+&vNOrY~lPMAn=2!PUs`7Lw77ttb`
z=10syb8-bBu@})IoFF$PB!JG1W#9sjzlkugf$RpgflP!Mz+=y#wj(Iby6ghCnUoSr
z7z{x7B7)jNCNc~H9Gpy%2{jCQ2_+0h7p6%3NT^|myHF$XBcX&L;KCG1Q2SNjLX9Md
zA9P^~_}mF0&^=QL2@Dzu2@F~Z#SA(L2@EC)2@GZlB@7`6DGXr=2@DYl2@FvQ#SAe#
zH9{gUVg-KkBnye1xU)b5G(Kg*ZO`g`$6S!R4SY6u6iAHN`%lg9nKSat5RhqaP)y>P
zAi&NuNr2-;EFWln5-3kufYK2pd<0K|!iOhYhyj#NKxqOrmj+sA?6QYJB_W-mB&CL-
zAR&XH>_sf^*NjYt3{Y8<QNxe`PAeQt5#aUJ@m!9ed<Lomz-tIuA!FR2H1{H&`=hxf
z?~d#{_KKjjg%I_epn2aYxOy3;2=AMqb8G~__Z5J~#z6ZQLHoNwV*{Z4Vq(K~!TcT*
zgLbC;|Lk*i7qgGsbDAhJ-7pbWV9Y)W8i!=!$-ZQ_G5ez3&g=_z2eZ%Hoy<OKcQgBp
z-NWqDb}zF}*?r7DY4<bx1bA)-be9HrFF<x9;{$M8N|hV57uh|1GUE%ArS?B3EKvXX
zf`K*aMKp`435Np1i)a>A6HW#dkH_2z9E-V_dn&byKx~CW4B&O5CL9VbCdU{Ydn$EK
zcs$`wPz-2F;7H+OF%jZWGT~*|XX?ekWWvXwWx}rz&@)r_fr+pJ14uu}Y>s9wW)m)k
zgq}*H3Xp$2l-V}4Bq(11)tAc73=A(~B@?-wxuld57#5fnGqQ9~R-OTpQ)ppeFp*+t
zFll9SeGwz}m18lNq{%Giz!%X%iY8r5_8|U?7_p<E`E1a5!Ha0Yk0$L*pgp~OCNr7%
zxs|yjU&M&DnzS)lgVoGr;)ROEnzS;3%Jv46nM{Q*V#I7A;u5l)&RkL)kGZ5?#7MAm
z$T0bH90sw)LFIY?$6_%1D(FlYPG>Gj4jCrj7crtB`&Bp|gX|Jr3p(?b<1m;F+E20u
z;zm)>oc)IvG2*cx^Cx#2sF-jvFujNow*}cXxx*mCgagc%1=$C+2V}oD)E*!3owG3_
zZ#gxXI3RY3T;&j8ih|fBvKMsr3B)durJ%ZbVzI#*(40S~FcWBh{SQ!hPMl-#0n}$|
zZ&0{p(!#`O!fwwEiW^1HIw=+g(ESar94t(rHN2p<n&69QZqWQ$fhQZEK=N@r!R(`U
zj-Yx6v<@Koh+Sp!DZA<y@f?4%58D;CgWBzEpfhjSQbF>dd6%9(`&>{x39{S!lHEq{
zi*`G`FW4RQK5uu@`<&fH@3VF{z0cS^^geC(()*O%NAHt%KfO=bgZATddLOeF^akCr
zdc<B4F=l7S=(2}FgS!vB-dKodg+S{Id8t%TdUn{upwr)Ee;+Is%LyK@X`gSu)kKoP
z<3%hJ_@1s4HTLr%@@$~`N8`jC`%=(-Q=qe&cv^)TKx6qYV&oKgnuWmYv3ceQalD9S
zNj2eOSimzuV3s-PPWTv6Lr^~$#0QPzfyA!c%m057BmU8Zn}gv+jL1ij9M2q~86et(
zlZnARia`R@R(la6veQI>K`CPng92!s_mn#fb{>-%6hP+{fzG4>?Q?*%1(~c~#InYM
z#;#7(C@FAoLGCYp5zPTUGa)05p#gNhkckur!;4sssTnB@2^lpE85}Z9fuOSdMJz`y
zsQ$>PVJP5`VG4qZxq`$dIVdnpGKQQj-j|@5kx|1?(L7lZbY2noj^r27?1>zLOi`eD
zJkWUAi)eO7k1B=&B)+0Y6+?wbIYS1xyaUI%bS-FIf=4++0S6BgcrDV4Sm{uZ7|#rW
zIqeMz9vmD@p!Jp<p!D-1RvNsH0V*Z|5tI4~QV*(sU&KnAdQ>tryoiU)Jxp#;|Nnx4
z!3r!EEA<zo22_T2oVTq7g(0Zj1&LRtqo6Q5Wn;e-9A?a*_POXnkbk@^85&;1O0{}f
zF(iP(?nNw<C@B20Y#1^?;R6br7qN_Qv+vlg%(4N8n=?rKMJ(e{kX)7xLxuNsyOk3X
z6c{EwHedklPwh#t`wntPbF<xDP*_0hkW2;H;bjg93#gbaNDS1c0`p@84MBVmn@a{9
zE(R}RCBA~i%o!$lnJ{#8H7huHSu)IMR!$J$5M%<MbLnBpz2Zf@U?il?Df<^>H|Ts1
zkpDpEBZJQCcp)!)79<Y3OQE?#L5L?qp!tQoNGxbwv`Y<xN_VIIeUO-mB!j|>SXuD=
z=7~M_+d*QWy7EP=Tq9_1&txZq2B_@iU}5rq5ySo0gxj7`u>pKHS%BhtJx0*lZ%{se
z5zWj9s&A7|+X;Fu<Nd*tAP|#%#?BKIry%+4J9dts@*(+%U1RbEyXF`140E%O+EpUT
z3pvm{vmms*2nCt@LSAkv$UUfj5N3t@p$*v&GJzm>qxwPSC)5uTps?a#Ve)$s!&Pd+
zYtO9M0WRmf75(+V?gr2KL^D=`+?ssWP7vmPF#m{Mqh}-^1ITS~f1C#SK^{~VR`yJ=
zuLb%2g}mHeuzTk)C~!{(mrY#U{h+x7rXZI&3@Rof3_n133UHNx+B!^5O}R}>=5y@5
zL3a*-&T<E>y8^B4;>rW*VSM!>MrtGYoJmOrg~<&Q*g$eGVx<~E`QyYM#T6j>MXa=;
z2`7h=O9z9>L<R*dPELzXP@U4Mpul0Wi!s4u7lXlzSgwtrG7U7YVzQYr!DI`ALH1?4
zg;x?}SUA|2ytA*^%~Wh)V^m_`U{q4zVc^IHyZu!|jxq<R+~&vuxtEcvp-|C4xq*qX
zp+?cbRL0(0*@J=MMKtqF^C*#npgufkjNbdQ-9*rt9+Mja7+x?iRkbQ8C3)YnoB1M^
zb0r5e6UeVD4K?=Q{l}ntWI%2L-Qxu+`wno$iGuvd(;?9ELY}`Cbk^6k1R49TBK!Lg
zG1;pi`Gx|86`*sp8*1#=L&W9Yg4|-l#vlN47bq-Egc%H)CpQ>exi2$cDS<%)WQSQX
z0~gpHVF$3kOm;Fjyoix{3+h|Hke5pZnPJKXKHt{h!ZGO&4R;z2fX*A8a+$%-d=3K_
zXdS`<nFBLGVPYc1!1p3Xs`SbM8T*z43Ia+Q3=A*iWv`mBG4PqCi5z?p%YG8nRs@ZK
zwKv#<+6Edg;@EDQ9JBx5bHE;aCp36Wk&S^5;tomB`S+mlMqiK_pz%lVTXqXy$jhz;
zjjz3kXU_%4x4i68ke@+$qPs&W3zU~ZY07+#edP59nRt-jq3KA0D+`p4n3P_`ib;a=
z#vCOs5d9)n?4(IM1L(e$$QLmZZ<QT57))j|WW0!xxN0KBAOvo^#z=t1w?S<Ikea2+
z0Ui#Z@njRw{zf&%7be^c20Y6cW`X*LFJdH8O_nlnbgZ_&4-x~bVPgQD%@g$^mUSn1
z4u6^bQ;_?iX0w9YVQ}+iGIW?&F@eTXd|$+fpEY5(=j32z@>9&$W8~mvg0w-Rq(Ea)
z4WRaiXBr;|D1U;=mh3xrpgRf#!DY))yT;^mpnNI*F#8B{*&^x*%EzF)b$iy?$AZiR
z<<l4PTu(t|38>wTzn?A!I*S?9r)a|3PmhuW-;HD<W6ufddx84tpne9Z?*QtDg4_v8
z3!r`nynh}ixE6Q+oKNCKoNy>c|2$5h6jbM7@1IM6&!3z;M}Yy<?*p$b#Ikk@y?>s6
z41AUaC-f`}&>mtJ(3td#Sn!xf!HF70CXZ#{K6!z|QfPlXN*sKTXhs5qfr*Sg_l4=w
zpuQn^-4ke>At99^BO!$$3)C+%x8$>U5hu7eBMm&RkmXPg8sh-3SBQj+D~N&nW+?7H
zYR~D7v^LQH7<f$KD9B%+xB{&$2c1~}T3Ze}!-0c|DH5`tLgJ-)6yFRe`=WUi---W!
zUtIv*cLLIve-6Btk5h4h0|V&%H4`5DgV`tTL1Po3^D`a6V>GAjC9_Z2D}v5<%RX*z
z2|B|Kbaor)+%|p#fj-l7_6Hl!D6as8FYg6`IlMOn=Jq!z2zZ`maNu4Go?q8`5zFWa
zI%A-JzET8eoB@136$6t4&jEpEo)ZEs+)LPGxtrN#z-PSO73$zUAuzMwUP*xWfIx?%
zFoV(c$sEa`GSu@jg9WDz*PUy{94%ZmTr%Lf@D`yCn7!P4n1b69l$3ZG1YEc8W&h71
z!z#nQgpGr{nVsG94ueI1gF?fF8B(Bot}R}~uzG^hAZYCgWRDorM-cy_1X$kcMGPw_
z&w<wbf!4gFyoh1i2$Bbz)1+W=VTR-f6G>2c$<zoEzbFCbyS#{DN(Ax2>RJ>zpz1tc
z#4v&P@j=!3yog}}_k}^@4<?cf0WV^N!28lT*um#>N4#KQ0L?Q+y^xo^3z`S%SEvKe
zg|_P`%<w$UU|?>^z;R_KhZAVe8mRnz5hEnX%ODWd@<2fWZ01e|4iNuEjNn7iSfA$|
z1_#f}3?88MDWH31`6ml?ypWe^HO;d>2s)S4gq0xyv{nRk$A$?jL%|Dqd0&v(q@L~O
ze-5-}7qZV;*@1x()OXK5YWLDZmGeUOCA-G#i*}va7wjfxpSPQtea>!S_F21?*=OuF
zW}mj(nSILcVD?G7li4Rg{d~Kd*~jca<<`gS!*)Mk#PEXl>PNnak+ubeuTla7WA|j;
zL!h(`TSN3BmLU+dekl2Xo#5rA(m%{^+6lgh;r<9JTU!<=NSUxQ{&T)%C)n+(r~sCW
z6LSTHjW+1cB~`W^7nXv~Cu3mXU}OpgjSX-xLiSSkEKvBs!N}xiBFey^bb!w>tCU+I
ztBhL%w9Y`Of&XLnWNv}%DclkY2m1djE1dstatqXF<%u=7WN<LK$x!ejhR4-Jijl$O
zCc}XjF+950<0X_p>syst85q3h@H@O<U|5lT#V!)G_ZD;((Tf<a&g5Hmf}r#4K<<Uw
z+lXo}-$a<bpmAlTL<WWo8}0~DT>~;Z`?6i6_Z)ukx{wSTt{>i4>>@#aGO^)i;GZJY
z;dzHU0yK}4p~}s0<qk(OcN+`ai&(CO*WEahPwdeaxXuRNivcRbqFzMt=9&ocfY+CM
zsBtHl9JBw~b5qg7^9(m=J)r-UGaSh#Tnr4HZ7ggY%eanB1h;iqxn4x`Sc2oKk%2)e
zMS;Qls$C@47K;WGVFd;b86{`X`8-^;;4)$sWS&WZ0kr0bXRlDli)dc3-u4E)4p5sF
zG^YVN*EIXEo#TsW9?k5-c8Vsu7#v<i^9X|DGMeWm$Sz1fkvoWikuTvzyePO`;c|yT
zqkEEqlEY<0S;Dc0>rQqXLjunMffy5R1_sdF>a`k<WbVl<GGMtoc7afR3Z^yof7{y{
zgiN!+b4OP};;lJK87Axu38v``99N!mIPn}1@PO3iteK$smfjq2Sr=#`VE|e?90?M8
z5yN%TM8JU2golC2gqMK<s-6=h2kOg!$5q&wB45OCRf5D?7bs<L@G^Ot`~>ayX4wf6
zGm!w-6<!cAE={l)L>{aM+`p57>EV0{lFvSAm&nD>#GifMF4Oy}U846jyG*VFEL>a*
zSUEX8nPMPe#xQGQg8{<}1_rHO1qB7roh_U(pmr_;7ibNIq6Y(L-*+JgH&cZ7ExW+%
zGxn9)C+!=vPuX{Z<_NM+f$l^U2DKd{+Z)s-aIWU!28CB|PHZ_Sym(Fsw1LjW2BjT`
zI}G4;Y2dPk9aPrHwt~VB)HVd&S!%+=z;H=NdcKJ;1CMDB0~1#v6R(MY{lkfC4LD4A
zL3@wv|3ku#1MGj$eaIlbiGcl2&=@lZ50fv*zc1wFY&jpWaCzKeNC2I=4hkF79?&^>
zQd>=q*-zwe5OBZnN9x5@8IEM`4i*lM6<jAgWf(wrsVjiOgoBmI<3+UWTF_cK5PlKE
z02<p00G$mCGP8|Ak%PZMAnHZ5l&_g21B;0mgVg28@+p_+Nd4!!%p^Ri*Z?#y&%`~M
zNhbS_U80E)1B1s!h6D~FCSMb7P`iY|f=@vJJWm6<1O7#{glhI3yF%}qc7-pZrCmXC
z{S69LW<d;0ZEkk`Ah-9q=s1DR;9~MsOke<=m0k*(D+KxNMYK$)i6nyr_XLeOpz$ow
znMxpgCn|vBHLJ}<`G=_`gNCUkg8<ks>`YOnmJAZ$@ey{Ws29=lUpWMsT>9s$fW}9h
zxokk~WtJ#V{R7H_pgn@uj5u0eM9VJ)g-82*Z3|F+4we^!q-l_wKx#NHatXeOX8sB4
zgM-!tcL*y;faae%Ya6&Yc$tDZxS2w-FWVJ@<X=QHzs$a3SLuD(u8?~VQ&`^t1rKi!
z|EgUg*EVq9ON%QE<Q4`lE+G)j`3iLQ7l#N_EC=KcO(_oWU7MVbIOc-N6V6L*4vHEa
zLQG*>=Cc3iU}lwp-P6R?z#_qwz$(u5hl#n*Md1dwEE9{zX>go-@FoaEf!y>WTJ|Z-
zJty}pr~tVIG+qXhSLWdV|00Ij(p<v+AxI3gRvIJ@3V+bJCy4zbhUq6r4x|s{r;BT)
z|4dw9!1RKF@e&6YQ<%q1Q2WvTfA%%|!t6`-mD!i=8?&$2cY@9{1kK01h~td~<=g%S
z8-7sSL&pgly)W8zdS9@c=zZR9ruR9!h2CfFR(hYY+vt7TZm0JtyMx{*?M`~1u)FAe
z-0r6LF}sJ}N9|sEAF=!B4XQuEbL@7EFQR31L2+kl$zTAYUqs7*)@%o6-?0lcwPdh(
z5iR`|B<_9JE)digZL?Rf0G$KRy@yGrf4+hcD1E$;moWv!d7r&C_>3%$W+s{Li8kV(
zcz+=;J^zKg^jC0Nzrzq<KF9u`iJ1Mt=4p1kCSnXs-qRQi+78(M2ZaGBuY%59ei0@A
z*8G;8A;><ET`!{K&w~0VFQVjYq2i$Sqt}Zl`B;!RtiI=vVRGk?W%2;E0baxi#F|I(
zgVst!g4&udVmQEeI%%ha*D8g27_&5Zn6Pwk$TEe2@&@P*AFjD<vRpOnGF*GW<(w4P
z9#Gn1km9-vN<$1>9HLAy9AZqdTSM6Yb8xZ>!_p9^0}B_Y0xKt|{=YU~f{D|HNt82|
zNsQ|Xn=IF6b{X*g5Lu=Ojt(|ij&ydJ>kKkXu=Z&7bvwiC8+Ml5JJ@8or?bm|>NVJT
z3><%$L^)*<=49Wo69nBseZ4`32~@Yei0A0dzGEi|uJ7VGO2J|b3?87oY5I&I0d#IC
zSS+5y7Ida|$6<TWp6p1_IF0Fhh5}HX-!UhCIR`(JGpH@#q0F5C>hFQhujF84a_^~B
z*kK~cPz91RVP#_g%X2UYfYeM#0L_aqdA*2|%r%i>V>nS`brqB@c@hLbZDh6=F``RN
zBpEn(DnRFWTTKP+_cW1YsCf}1S_)DFIyW0c^CSqkyoeU;1@(PT+d%f|gZkheW?VmD
z>oh=P&zEON|9BD22bw>QGWo;t0(8E9UxI=X{|tdCU6U0QOeC1tUNA760NFVy!5lOW
zD&$hapwLxfzubHdg9c~~e_Oo*NKB=x#J(OZHbG#DOEH56*JLKpeyAy+^Sk;I?A<|f
z-qRQqnl3AV@09?#2ksULCeSz&$BP(YaDUyQ23&XjZ*KsfJqEgKrRGJ9@LG_6Abn`r
zTu^wq)G%mtw<;Kc+z0YE*e}dXE|=#>|C`)k0CKw(RJ|)m{flV+RM6NKrwr)4G5hl%
zIi48;Ej^&I5>PnGi+=@$H%Bv5On-xUDX1I)je~HoFvV`0!Tz5^m{puxmQ9xH54+3@
zc`^N71(UU=mJA9e&~o{OyhtvnYzFoFK<!;nf6>E+Eup;uygqskwC+^^=cQPgTJtD=
zj~DUG;JbrCYhYi1%MbfT?-+)N_67wh_c;t2ljj(L&-(|hvE}y=n8V*D06LrV_vASS
zBA`6>LSFtjRJ{>My@@a%18i)Md$I+jj&eA_L_japE)#-wf&2zqa|P<tf!0)m<_EJu
z^CYb74IMia94<S{{{Y3U2m>P{sK1Iik7CaVI*;H*47;R>6uSe5j8Y7E{YgBdE~ua2
z-NKLny0^h(i2y@SiGqa590o4Xo$w}73{oJr2`j?^(3+(eF^oGw=SYIib?a`m2cOw<
zp-LKjrVWan((<*iwOXL|FUbAgli3?U=KyroC^%e>lK+8z=X+NT^sZ)Eo{wNR9kRdq
zLS7Dh7A1%eG6Qth0m!ct5)?!r?w1G6{YioR4vtHCd0FsUX$B?-kowD3@;|)6=E#HZ
zcLbROa}OvyLF@LxV*y9(4MFQQK=(_4*6@SQvVIXIxzoEDbe1k?&xQd5Xs;%y?ev0y
z(db2#Ja}B>^qd6_CgL0w$^zhX2h_|Z7#SexOnj|*6#tGF@p73UJH4A35=@F2xIlfF
z?929&4a*i3aIiAPyoi>U1>I2sN~552q(T085iR!>G=9Z1M+iI)4H;{-7X*zHfX;>n
z=>x|x`q|cybj%1EYc)w00N*i#ef-3Z@kOjyu6Yy#gR(!E9cmuMVDTbevJ~W2Q22o6
z5wj<=YyAKF>LP4R1+<nEygvM_-A5B%28HZ1c0Wyc7_zcY+cTPQGb{t0k!`}o&;vUs
z+k}I`D*L!SXg#1i=*(<|BMb~CCmAHNkJ=lW9An@BuZcKp?`WdTb}Rdcy=C?RyO*H+
z3p$g6*M<R>Z)bt*1*!4AWA~D~9kjQE{T7G~UYC8=?xXh^yPw{t?HRp^IBVPdo?Roz
ze4abtGXO%sYX+hO6Txek<}f%w_mUVmR4|%MXfZqhT6YPmV>o6oxq!y}6H*vWE(=Tl
zYfDhDxG+chXLpB!z-3|3-Z;BnklQ&Vn1Zh*$jBuWGnzDaHG$4{jJob1BiY>3WB}^_
zHg_m1m<Th3G*4FAU?R!D0@|b2(@@82J{f%H=DJJ8(m$F?=Dr1wmx?p6m?*OT;QGNN
z-u6Htfy0LD;N-~$7NEG91i8mkYVu@*EC?Um4wf<zX0Yg<tkMD2ugLnsp@c!tp_swo
z+7wO>6EOw>(E4hw%S>Wz2UMbXbOb`%9;hmqPqr@x**hs=g2W33R;IQCDi6%(Ff6#X
zhm*shhQZ|e98M005(YES`OgkD3>IL1F@qIoy_Q2gBac}P1IzXQoE#2ijC`OmY3^@K
zVNG`$q#Vi^IUH&jxvpK~<lwr)6w@@v#vK$!e5FDTpf%G8H4IiS<Yhz?iWw}-C)-bL
z%ANZh6dp?bc8q3I7&h=tR+#dt;Q&)}w-RVC`-<kt)<;45LF45hb)d6{LFFOnY~2@8
z0t-QD_l3N4El3Tw1(SH+1M5@}8`Ks9@23-IU;%|?-vet?kT^&TbT$%bpB?B-2#{Rc
z0|hB)8;k=yP9(tuJ!e$j)I^er14*3_NFAu|2ek(vX34!Zkz^6LEFt~BpTQ~@WQU13
z189%wUS&lFP#Mp{J%dT2ok3v-=p0j!A6go!WI^g2N*K8uY8W{{Vaq)Qx*ocO!3=a(
z5NPicD2y*pk$M3NGte3_P`XVhVXy$DTfPJ#hZj-YHxp_YUcHc)1p6O6KOw2WaQwz?
zdyqXZ<RyK<_7sEH0ZD+`2VEuBtRT6bhDuS89B9pELJh+k6B*F@De>Bb8iseEbo4@A
zI@d&z^~Ukd2LvwFO8*1(b$K)dLU|MfLXHO?P`ETz`h)p=`{K+0rGHF*&>#WoXCF5{
z;9xez-rhu*!3cDw7uRG+JG6g+wJ0>6Sb0<gLi-n3eFxDm<fWcpTOcFxLS9<*+J2e6
zZ41obg52~%Ug|F>4ZeutDFo?rC}l8lC}uFbww05EYco@@LkWY0Lk)u!D1CFyVTx(0
zF$cHXUqtZ;g4Gu@n1I$6I@B<jfz}m*)fYq6Pi6{ko^1csM3nIXe}h2qr4s2MT~ieV
zOhg&~b(J=3x|SdV-XrT!%E;qT!pH}*6O_KWwlIY>&1sNwD1oN$DV!W2yP@%8cBw}C
zM|*?W)`SuU6Hqw?D$7CRQ9PT4<g@SCy?h}rmJYgWmqUap7*t1r>!H*3iYD9)cG;)w
zHBGn}v_NM@ns74w%RT`fmkxxE*++uvDA4`Tpgv0W8GFg><Mxi($Lu{{#BzboE%or^
z;c$2nB{-LZhbgMPK>^f;WO@-VQVUuy4ywD7@7N1E-?10GJWKw^WCsPQ7YvM69g7ns
zI8wNnLFeIt)-;0amNWK}-ly#qy-(R|dY`m6^gdy4>3!VZ(fgRaC;UER_+7^Kj4z@D
zc|mrbj!|$h5$9BT5zh-Ap8~ffB|&#;3G#y6@IqehJxE?zKn`?|wVJsEUjd}P<n)Eq
zmjaxic;i^Y#R}SE%d<d;VX}jP0I06#_5}A~qFNH{^g;eNkzx>d5zl|tB-#G|i+KLM
zpgoLGG3cD5>{C#9aC<@Y^&}_=@ic?Z|C3#dq~8~+AJmR;coEMJy2D!Fg}nUyj>WO*
zApPCmvEd+^BZW&CbT-Eed3jUN-Jzhk1NFf?tk^U_?UMd@MGo*8MBqA=eXV&EqlHH@
zo5qW10q|M0;Cf7v?UsWH!vhCnhDX<?a7$b(<^q?=$_fok4kipw%q<xcz-hUJDa65;
z;TfpB2H(p!nMLaLBZfJkuxY7RXi#oA09vcQu6fV=uaG*N?W}ne<B1pX0=ytK;Ja3y
za83ZRLGqxru`goTTFs*vGhWEcT?M;KUj94C51{l1_J<A21K1wc=2;E`*Jp7g!|t>P
z$(ty$yx?zSnA6^-sK8;xb*sJ2A;CnLkpVQ;^@4$+s=Y<w0I0kIl}#_An0A8V8@AUJ
zl%}BVY{urviW@*~G7)Bc&^_6HE=bP{d3kk^*o#<JTk|N$`ZdtlwudG6ju)}4y&!*p
z@(f5VL><dp^C%|JI!UG%^730jW6=B_0?kmlt>#fo9xviV!S@}3&J_do`#^n2sC=n;
z6jKFg3>st}WN(mNFNlq@KPX1hP@&(B@kJDapvf$z2ax?iEQtL<GngKL&h2>-BMv$T
zfdkZ51)1?8mU*jr6f<a!_$i1F3uDk8IB-5b4Bh*7#NP8o4EPKi!4q>9d~&{HFA2({
zpmi_DA3K1~QHJc%#MmEV&**&1UbNrAelIA$g3dI{zGXj?o0)0)izs%`y!n&UbN2Uw
z!kl9<6LU*~eK|-S#P3YC=26TBFJd`onn>|4coEMH-k$+(Gs?j3KW1vkzGOEu`=Z^#
z><e})v(MXY%sywgGyAOF!R#}3C$mr6UCcgZcQgB>-NWn?b}zG!+kMPFW(PWVf-(Du
zJ!dxPjFVWNyP!A&mEk6eY!^&S1VD2SF`)Se{sy52^EnIxU32W8@;3-YnwT&&faW8z
z8yMi?=?x4O5HWU8ItQywZ(#e8p}?SEV#837qQIb$p}-K3qQDT5p}@$HqQJ<Jp};7R
zqQEGTp}?q+qQIz;p}=U6qQGd8p}^>nqQK~pp}-iBqQD4JpOB)!n318tSdgN?SdpQ?
z*pQ;Y*pZ>YI3Y!WaYlv$<AM|g#uXU~EDR|MEF2jMYz!uf3<4cC_D@q3Sbu=>aaIER
z1QQjuTP9X)x6%^WXP8JZNxX=Z0fjvSNZv$|<J%Pl88H(@3&smJk{>Q8O8nrNBP4fu
zvXtKCInow9jY2XBlNr=NdBsG6$qRgcYottQ!W_`PdGL9VpmmT8JTgKIpmv6`Km)k_
z@FJSG6*O1;B34im6uvJaWzT|Wa5{`;0j)n|Fp*^3@*<iAwEhspUh^WFCDlZVvB5-=
zam9;h7VzD@FXFip!TQ7*KxcVF`T;TAo#s)@2f*nhhHIyJ6!QlV8?+zgMGV(W^C%XL
zmIbPyI~JYW8&qF;>|g|~HMZ-PQN08joAKDjC}4imb|P$i!6TKC!~Kr!UJmfs6KmIt
z7;*4fm?!?I7J$aILF>9b${0a=f1+S|vX9#yoKR^1nwMmH5hb?M{Fd!R(3~r1-5vOD
zOjZUaegy&6o&}I~749c(_qHrhxWK{5<OXu<i%5yR=20vO$^m+epfR@>krH#wqc|Rb
z<Uo6G&7)WfUPMZinj|w=T&tH5;BMxU;WTCuzC1<xL(^p61Kgcl!s(Z7_g+eq{@{Mu
zb|F{EiiY$%whP_w*q#K{;pum5PnyWEZ0NYtTLE565+iyL6prl;$|pefwJcDw$i8EH
z5VY6GycINO&S1ckAjG1`Z^vjV#gf2NBgFI~QoNKWL5R(~je)7>kOSzBG6qoiaj-E(
zm`buFfbJXMILgHe8fV~;VRGZC5#mq`&|`cNDb8vd#qq$rgMq1+$-x5DPXp`YV2Ut}
z<aqERj(sC&9T+Do7b^!F6KD-Kmx+x1MMZx*(Ed0cQ?TE~YIzcb_^_M7Qt%><T@%d=
z0h1~Q5l|bKCqYQ)MWi?{D9t7$fY+4^fYy0~=IFrd!fP1RK=bzC_2D%PI-vFCCW{%E
zdJZTEfa-CcWkO6Qiy2tJ>k65fqF%(Y1%lE6cwJhIP$wv^osZhicD`&olY26Yu*pvQ
zhsl?1XTFFL3N*iEyV3cw?QW2G@?~4dy)`y0Gx{48K=<}ID|elK;eFY5qWK)PeO)yQ
zpuUv?Xnq)EW`Bdi1Z90Y(AqC9b4!+v7m*@MLFV;0C?tUFco8Ew5yXd_Wx!zdB1Q;w
z)=Si>8U+RC8@97SY5GMR%TEqrrl^b>mKiUi8Dc@_-ayVT&TInJQ!k<!OwCW)P6Vwz
zdlAhb3(7N~y5vPP187aJ^X19X6_@8o|AC#~3)<%o^2>!9>52=<(to(;aLwVU;d16E
z=4!sMN4ny=Ge-+ptcpeI!cyr!p!N#K9xhjpN_Gj3U0kzXKN1!&VPnwa-pe(MI|_oY
zM{y*-e!|iKN{^uS1Zb=n)Sh_#NI(N5mN1v$+2uVFKN99JJTQ@BNV&X662yLVd5_eO
z7twMX6Xq~H0k!u*byk86a|Nird=V+E3))MiY@o*o%0uRs91mW^iheYYVga9z4N~Kw
z$};0c6hC-v05}gMDDDEC$K2nf0opec$&(}?)7{oF$^53BHislrFlaB4i421bUxJX*
z`nmCMLG+7A!CI3l27&elMJJv$0>V5+0wN&$cuE8$+EN-69BLT!`cl-Tc-9FBPfBRu
zdcnZX1nR5vlnH>&(zLuZUHXSZ4TDZL=q_^!Fk378j=iTt4TDDZ9s59s8V0rOJNA(d
zH4G}*ckB}#YQTFdGaYIe6teHw7xL5yfX-g8<f#MGp!@AW{7#-KFn=OX0hpfoB3AgP
zc@)bDP?>BZ!EgfP#uqV+lIBsY1)w$(2P2bjhAkWTj8+c~?gUc~`=1jTK;z47n_fi8
zfycF8#K}YG7$!$h+5v^xix?(N4jHB>hsg{|pmNG#4uit=Ih^1-H?Jgfo&%i=06r6-
znL#OG4ugU=XkOojZ3i^Xa=nO^dkTtUP+J=6Hl`QR@^3+B8*<1R#lB!*NSeGrf#n5*
zB-4v1_M0HJ{S6i`K<y$A8}0?|4HlO`Yi#-(EDnMF6f2}@9>ofdW6&M!kT#yQQ+tc`
z0&rfEV&E{hWSj6JhV7-o20cbl`ZQr<;4oRrSYaa0zyTV^%06a4G5aX^Y@`VAI@K6f
zO;G!}r@($cNDcU0*(jz!lPU&}_W24*Cglv^vlYQ*eXMk;i4?RQ$ZmhrLzR1h2?rw+
zIDIa)ziFbz>S4mk&}4E7H1@>!&*Y4KW5;qk&>7GSFQS-Unn*$F&=*lmpmXL~Kyl+>
z!{z~PUoCnO!wbF>adHEAe7)&K440va6a(m7_AIa+5)26$%FLks-wZDzc_H^t%P=&6
z)_j@BuwXs!24sf`3j<4r3X6cU1_Q&37><X^5eLBS0S9A_AE5l6V9fCY9Ola020aN0
zUZ6E~7m}qvfaZfhVP+z%lGi+00dz*=CKE|Ug%{C+FG1qohioIgFWJrXzG%15`-0s{
z@AGyWz0cY0^ge5M(EE(tN$=Bk7rjr}-Sj?b_t5)<-AnJ|b|1Zu+5PlBYR~8mJ9my*
z#=!iZZQ~1hp;FK|<ck;%Pf$8|Aum+_B9i~9i4=nzI4wqtfzHnn0hMp<4Q1}2GzuDn
z<fs9kn+5LIy^t3Z1&M?6U;!i#UKR)EJ8&MnGy}{gEe}HSUL`ayHbV1WCr<@9?@i<>
z6Oef!FYy)J{)u7(uT6R(FAgeeogIZ4bX;W^G(h7gpnkqm!T|=eVm5{D$rj&vIRrW&
zbqo`DzvziQ7Uw}?FJjm{O{5qMPShxa?t6!vi4e&NzI&7>Lui7D4CpX%rYO)p@)t2I
zmKmuG8Xi@kb7}1Vzlak5YaWHdzYAXTFUiF4B8C;TzAVZ_ib3H;3~M8Y43k%@gHi{m
zE}z_LzyR8#+}@y+VIsi<s`n#bL~^8p*06)x6DAT23NIo#TtVxec#eY3R$^%2IVuEN
zyBo!GM~LY~l<-%cqe5&PtW0i~=S%#!JWcY)<*8CXKzD3`;)2taYcgNG5Cdq;fv-%6
ziLX?MrDKczS-u(}Hjvw2L<!F|k7CFGu|ajzizwk*(0&FJVHO6E7*`DwJBa@xO3W5i
zH-p4pL<xh=&gXa$BWMb$H$Z6tH0I`Ui(SIpl1~v-|6GsaP<;JZ&<B*BKzg|6a&d#k
z)m}u2t~HNh5CDn2h!R=~VxPF9&;VK|2{MNhlBSMA<x@d+gV-jLETBCU9513ob-8Vr
zBtc>?qJ&gI@-O5?eL?XD5fgc99>w4QG7ri>YaYcA018jgILL)n(w{)$;4&pjWGd($
zWYZ|SSnepUD2SUSzi=$zYz3*gZp$SA3Y#knWEeSJnOr$`GDW_K646zhpvTDR#dYiT
zW6?7vd<<M5wc!4Al<-&cD24_QAMCCufv2WDJTpLi6G_HAkQlc*$PD47CISpRAaRh`
ziztDqCV~u1Q2vA$Q39nVLIU9M2c;Eo*%2jdYaYe0K-uE_e~`KtQNpsI`<yODN&I*b
z!>0;zyNLvY2gu)``uRm9^WBSH(m%2f+b#r`Uy95M*{5tzdhTL#$UbO0@kJzuYW6AH
zgV}d%H+Gy-knp}^d$7GhJHq?8EqHwYMGOO|{IfW*M+tP^s|Bcy_ac(n6x6=tSt-=O
zvrK4$_Z?f%{k4%G`}i9Kror0m?F|m#{U4CJh=~aluilq!H-hFXAZx=JZ@q}&*$djQ
z1U>`)j_pLSS)5E!{2d5$PW*A~N?6Wd06NdgM1<iF{{(?<#~KEu<|&O@p!U{_7#`CL
z&!vB4AFzw$ZC99lsYdF@^~t;v$p`FG)9=_Nn%}Sk-y!${y8aQgua9SsP)G6sJ8jT7
zF{u5Ke9lhSv6w*#bY>2yzP(f;_2U}E4C70arCuaou`^7*Y^R@mz|J)JfSvh^7*WCG
z19p}t{wP%OtPq&luAm?QGV4VQ3%L9N`-6=M5+*YcegTCq=xi!bU*LtjtSG2W{UU~I
zE2w=4@)M{pkyyi^1afo29tI<j*)L+4!Rx%*8|-~S?lxhxXH33e7j1sSPCNOaU8MO<
zyGW3m(=Xb^rXROUd=VpjGyRfXYI}o1hx27SeUKRl_c4R_FZMi8u<*WPdl8R2FLM0h
zk^$|%$i8EH(fNv<A!xi5bS}%K$x=VAmGDZKh_L<xok8DK(xBjc$IcS8z8<u;9<+Z6
zG#=XDH=h?|H|Xy1Yc;$Q*$3<zlMmSSn%}SkhY_f4lYZH*6Xd7%1~t%~Pu`$0?BqLk
zg&_Zf&i+fjV^?f`)2<Ly=BD4VE9Kw@ozW-6kbc0f@<oggXZjtx+WrPRQ}-)&v6p5^
z{kR^&E0KN0ZsLn*siT*pq(7YeWBb?pirvKYD|WRU{7exbvtGmq&IFm$-(Y(l<UZaf
z(7Vi^35bB^GTiUj#dc4z?d9(0k}-YFAjJDZK-5H@VS$M(!;!WHw&`F!2?8Qq-CQEw
zQ}()p`AGs|eJ2!W@n#8#O*&v8^n!uGsPBSe6mOn@7}tI9dLE&!yNU^BTkZdwZDn9G
zkzo+xeI+2mvqE4NDBUFAv5USmN9xD*Dd2Pqj??rzcCqOPK=CPHnSQ`7_4J%Q`5?P^
z)(g$ZSk0io`$Rw#H1^E<Oh5!Q_RQ7KCCpjOB9gI%L4!9-K%{Mw4L?YI-vosw-aG+e
z6A^|5O(n_=CL#<+no6v%gXAW+8!(u#gVy*-Zw2xDjwuN7<_L(j9kSaGawEvSFXZKT
zIYgMed2<A0`kSm{P4gLqy7Fg-gVggr5|C-{u(k)W`@0m3Kw$}KA0$ZeJ_FB<!{+{l
zcprf3Y57*}elGsj2UcMFdGkPKDrSJf0aQMDSTIZUGgwUp-51OI0va!`1cX6zO0axw
zKF9teD1Eh0nB{6B%mBJ~L@fETU1auUyNRH@01C_W8+NhjH$Y*>docZmU21=W<y+9c
z6cZT+aF~PCfWjTL=NY6Iqz@6^ypf>r2BjBpc^55n7gXM5)-X#<ZdZVYmt-i|&n=d=
zV0YUv3-mWwsuFPbZ?L<&W?VIqVQ>Q32|BaEM20~u{eWF8$UPu;LE@Yz5afo_Hao!S
z_C>VxRgfEA$jg1rtYH=atz!oDsb9!T*qX50L+b(-QBXYsYEPKRFeGrdf!0+h7=h{u
zP<;TBdlAL9_qu}2ycaR77eV44*$f({Squ&@qL@p09Ry~b*rQP8v4=sSxmh8KXNQ0c
z&o0<K+FSylIN;d>i4#y;if11<UO@LB)bhrF&c&0@HCe?V0cxYXh+=(fTE*Z2vIEKo
z)xQy7K4_m{6f3Cy=jeH0(94qw(kq|~k^}D{lY-7aM~gf)k78W_>$iZ~px{18G+VBD
z6zhea1O)*OSteJ7d^<*yWabV~pA*#2c@ZP=)I5so14N&22UHKMc@*o97tu_Pp#E>q
zezjU~yIcyie~C#_;R2)|3%WDUJc>;L)D~BGZ^!7N%)J2ACN@d7ziGl{f767U!Nuel
zPk_mDwg3+B-WrBmFCuw!LG7FN1_dFoT`}TM&7;^7UPLoY1l=+3FoofP!(=Su`cu%x
z^(Ui_>x0JfUq2LhVm^mqUH6{(UqN<&=G+@r+l!h=FwEjv#=zlG32GOLfcAPuU6hmu
zjlqHTsYktt5xWa&>v<$IXn@DFlkIPU{Oe)EvZ1{}Wi6<$mVLl}rinO%2IyRGWd#oK
zxZ;aQ=~i<~(Ah>TsUS5bGE6-Rch3I@jdhtEW?(X5Wza}JYzsQ8MIilv?bP(6wlmWY
z*v?JAW4n}zfnzxn1IMlxk-V9pd;?ko30nUM8jk|C%{kbaV!5}liEvM57tX$HyV69M
zK_vT%?MCzK;Jh0Ns?WgtEF;BSLG_vUal6Q#FG`>~%p7zsnDZ4o%WG4(1e|Z#*@EgJ
z=gW51;5unCQ!wa0ckWqCQT+}|8YVJK-_j4;MVfFiNTlDgi#1_pa4_LuU`jt_muP<7
z4s-@gMEWheR8am)zhjq~e$*}(w0G!5q-ZE;pFU{)Vpp=_4EM{nbKMWyE(FiTBr`dK
z`r17SiW#8sN%NbwE6s1&X}^eN0PVeGNk43R&_sqIDgBP^Or<2yoGw!kD9k`=LFH)r
zW!t5oc1HST+pXreY)_{jw%wb2*!F1pG24mhhi#{(AGV#Fe#&-b`eEC(>33{5rr)vM
znS8?bVDe$x<1b<vOp}k=o&>o)`#7X-1i2FuR>E(={lLq1g<a_i2JTnvQr$1xWrD&9
zJV!K{DYz+F;VdXFUqrKl*SfrrX8^}P&jNv2?QZHfK<Q$#LjY)fmR7ryf(NKPo9tk~
z@`8cU>jeYD15i2F?E$?57<5J@1H%qbd&R+q^+fx;h7+7IT$6cL2uuOBUHD3b8bJMx
z?pX>m5^PvcI80_x0L78R90ny&nPDPqUklpXY$D9ScYVH$Ja}$&4ucXXy(COwPyqGM
z6DBjNy@+I<3QF%DOF`+Eq10rl{Y^}>7~X-}jhr@2F%EqUpIYxVXz;8M=;iF=n#12K
z)Zj1&dhXX8hEKdp1Y(-I8?<=W2!QTVs{!5n3~jp<fW|3#7YKmwH14WVSme2j0kkG#
zk$DtD(TgaFt)TT8o|_pAt`&3GO)G|+eSCQi_-x^SiF+8FT(>fKfZBAfn;CrC+gfh8
zZes{g0F5guvTfk8QD}UjaDd5mBZEhqf})4(1_qxt21N@F0j7va;s&5Gd?we$3;~lQ
zp<~-lydOa8gJE)@{t2kOdf~)-0JO)&b2EcNSIvHY&=_!6je?Np9tMr>x%=LN_$>(v
zT_!Rd3{5f(4xsY@CfPJ7fW+Gy6f`&lnIb3DOsE6#U&zb#UZ2CE2oih!kZX(b1O^7~
zJsyy?Y4UQRpm=;CFXswU>$wMX2BLC+=Pm{f<rxif=5sh0nq!(ROhg#!Oe7iVUOyI{
z0J_ul@)oI8P174ZKxfaI$TKuF&2IqR?HU7G=g>60L4re`DF$>tA=jK44IJW3F(5yI
z{Py~>r~t^U%X_6in8<T5aPQyIz#-2R%ezO&g?F!zN9&<zQQj>=J|^<^|F7h6w4~HC
z^q9yqHYC(Av~lgRXyB@atoxp{V1j^&JmZ9fdWK1t>ZM*J6f?|8sArgUdB4<)gj$A{
zgnEW1(0oBc3Bx?DE8zB6kco`FV@ff@6wnwzLMg)xlPZR$gffP%7tyRs6KWVb9Euqh
zfX8Nv85Z!&5fJ8?Cm;h#%b+nfP+IOipy&Xe!xCm_O0i*)cp)#jH^Z1k0OZfEJqj~8
zgqdPN`$^5C<o|OA?`Qyx6NB2Mpu75BKb8iK)60SVEyBTIBG2%zdrN~9C|*EqgzowC
z?_S<3eGs&Vn?sB#1Y{QI&LYtIT;3G|v7q$)LSA+%?;3#+guHAiNFEfPpm+f75ipVE
zU@#G8Sd?PJlJP=bqBg^rB>^<v)jn^AE5{wweEULPLN>vM%>y(q3A(Eav|f@)fnx`g
z1IKoz1dcsS4IG=97I16<)p4M;+vZVh7qTzgPka%>1v>L@CZ`vZ*9&?1_aOb?^<anX
zUV_dT%|2mwF#EXO$?Rix7qgGr-ON5>_t4ve!Qw@vz*W$i?-P4KYvnkjkk-m+K<aVM
zQ1IM;oPZ#>EJ$H6=xI|F;HeO3e-X#43u+HR`j!k)FCqnHL1sbuR-kcdP`UUbM(D1&
zC8NfK22gp%@M=PX0^17)#w?x;ffk+wfi{pCFXDKn@;no2Xm3!~0IfshU}19RIKssS
zn&UNTVPDaZrfkHMARx)X!W0F$pN<23Hy~)O=Y$5(*eOHPi#Q%$kXcasrCvnx{{^|H
zy}|A+$SolIUPSWEg@`FV;z<yg`65mbd{)8>2Brd@KSB*X4R*btb$Oui*5iBPYC-y5
z#Bu!vncLiA7YpTs+oF*1O6FBPO%34m#xV!9mVvp8CqrOP_8q&4pfn2VGkK`71x#o#
z0QEQ6lJD3p^nmOM<N%+WbcX?y1{FHyC~@#42uyal!{A~f1ztNI`T8;M15o>kLzpS@
z@($?_91=`XuOBkSfaBp7gT>{g(jOrCmlwR205p!vv3ExUs6F<=i6w)lKwuVV4N~?U
zyN%g*?RI7#vzz%MR_JB=QM;w?x9paJ+H&4^>}K{fDE@Gt!QjFn!4&!WAtQJl1J7Tf
zhL!{c4-*;t-=O^$p!Iy6G71{#>q47qY(Q&}ok8sjkQ(n3b_czW+nw}2W_Qv1sNGF(
zP&zwo_Y$(cz^?H{9LG^mShhFV&j;y&!~qX4C|*J5t%2g8EkPj(6b{{!8$f3$HGtYM
zpfGEmya3L>R3rTr68@kwBIQ|4WbEJa6bMYcv`6|Y_?$LjrYM&y3@#j?^Ti%>2Y|v1
zeBPKWlPgpVJn!;CUUn}ij6mW1!ik9i6oxP4W&d8@!!@_1!!8u$Mo^qX(lM_uC>?{&
zwltBk{|m}vAUShOh6|v(RXITCy&~PO>g~c{;qA&`@FIriE`NkT^NUE%zaW2d$QZf2
zU|@XpB90BT*D(s}4<nP!_J7+l8Ztm;EBD(mg6?|apR6$Fb;ALs7jbOh^E>(*?6-o{
zy@+E2g*#{uPjFv?eJjZSpf$GG?iYpWJ+Wt@fOaByPT9c3l5@g~SiVk=TMP=|wtpP!
zRFK<vQiW!K)-3X*3QYjzBTyTGr&y@tg}l5iC@er~Uc|B5g3k5@sRQw0>R!aLwu022
zo}<8}Jb_8Ye2!8Y=p1p-y(c_1LKDF8n*i!($bru7e+wGdFp;qbmsQ|!yvNY+B8Cgp
z_FVu91CW0p>Bb&>Hy@H3TXRbWa5!OAW659vijVBW_A|j{A2d$9T^TIAT|n`{xtBje
zpzTE@8#o_x$QZf4U|=})B90kao`KhE8uc_NH1QM&%;9elYT!8n#vLyhz-s^)Uc^Dh
z-#}@zFToz{ACOzHg?~?zJ!sGLUvM}a0Qp}YtR5--aDdN+ju2?c2Hj;C!%^$)%wW)y
z06J&Y{x9fm9?+V5o@SvAupJ;Z4hI<gk3ho3{2n6%sLaYfZ0`v6?+NhQGeyw4-t43H
zhM@Jkpz;j5j`;&9U7F0X|8FA9=+Qj6@r8E%`Tr)095;Au6k0vf84Nr!7&Lk&C|>YL
z1C5b0#e&AZv+vl0&btT)x1}W+9I}tucY^Dn6W}|-BwobGGG-r#-3w;N2<mH?M{#U`
z-wPHaa}abdn28L73CA4JdPBxpElrIPCNc~L9u*80Ah(#y*#B>yJTn2wJu^KZbAS^;
zc9}<U9`L9E&l%2q5hJ7MQ4X5F7nlQ*gV@JafUr;cA;dl&2aw;}8x$qL>)OOcPQ75@
zR4|v|f1t45j`4-OoT$lC_8Xx5_Cj7x*L)5;=u9T9hB@=DgWLsaLvmf<QGv7}O<L^#
zHq4nfA0fxx0GE?t)M}X10P@qnhB@=|O<L?3O<L?5Tc*r2HId;no6^Ey$Cx7Fa6sms
zJV^fw1}0D%{%<0~=+-gE_B%+-qlUqtzd^}B8#IS#%(mlFvHXv&8YLl+zfD9L_)J6?
zMEIu)f$p{M;GZfqfq#n7jO@t_3ZOm$=xlY6evecJjrJA=3y%~Ah4z+)1E6(a{S6AU
zKxfl~?zAvTWsm@!;eTO<<XxT$p&6jG0}7+#a}ET6_T*fcBmKcdk;CBVlLISwEEHxc
zy|-gD`_BFY7S1nXBsI;WI0bkX2!YObe*h{Mx+mL#?py<{gW&*;C4%?URtU^^5h422
zql!U+r$NXC)RqOE^UE_w$N^;L3wilav+wL5z-w~Y7#bYZIevlMf8n|O4-;0V1deAG
z4JNEC8`_%`5<qEka)SZK3kC+z{UCoq>!-X=*h_jJw^#H&X0Pde)ZWnhh`puvVS7ht
znE{I1y}YbK4Ga%J{b4!qd|LZ_1ql;j9t*w%fyqrZ4HDdQxTb*0PSCj{yfQ)!Ah%pA
z;b<{Y;bh>N%p%<JOhJQVGS_9VVwM%4eLyBM_TNEcaUivz`v<*>nId>91SW&l1AzR=
zu^HUPbcL=VkOAcvjyYUMUc@qQ1kER!$S^c?{8119x$A|zY;8sZ%L-5%F{6Pg0(93Q
z$p0QH95dSc=IMgsQ7PY!(X5!qgRe$m@~eacOc@Cb8lZFPK=;P*w=hiQZsig&pToe>
zJ=y*)-&9c9B6}1RAE5jE+L9D3K>le<QHU@RVQA<}u<bRGvH$5Y2ekK9rWF)NCNd04
z4#ph6CM6hv?*4FiAukgO5(kNa(_V?KDo76~-b`c|99~2Snu5xFkQ(zD3``(Dy@(Ks
z<*5*u^+I0eEZFW61_h7F3=v(EZPuE|fcA+<uLZdq<Q5ZQh6V>4j$feh$?nMtLLPG%
zDnM(PLFQ?L*3HYy9rdu`m;g%up!&tbhHb*-InwvJYMACg#Ozx$Y}jUa%wcE%^<hEr
zc748#Jt*AT8x$NsV=etH*84&A$BPI~$o>?_ewtk`<fZ2F)Ce_z!`YGpG?(%LR3CcS
za309EVfX;5<FjoTEtESCFqm61Ovtuj$jG)~*Z@km*)|LdvTYb%fckd)HbM>AHlXu-
z7{KdcU&u?{1^FAa_Efon@ejx?{S8*zL2h7pz_H{-q+}o{%#hO_7i9ma6QoSyU1To7
zf5AkOK@HO87Rm&-xnm{4`+q=pG4iE=;#N|YuSTfDqmsd(U%~P%=uS3}e_urK%Yxi)
zBE#6g7$X6?YYXg0(0w2vw}b9F^048U;XQ|;;_@7M*B9~<y`Vc+K<;dBYuMnC!l2RK
z)T99l-~I+mTX6V*;?Ra;g85Wl(A^?JpgE<cX?hNz`p$d~LqYdc`?DbRAb)$9g2w6$
z7)%ry4|GpWaDt>4iM^ma+TUTZ925>b4MGh(4MH6+7#J&f8iXdaC@2W=C<shznx;Dg
zwC)hn-<7X5QDi7+?`eNwBEiDIGefAsM40&>PX=i3-3(C^8T+pq404PnmfRdKVq`@@
z?OQP4hHC~W{ejr#QTD%0EVx#1&tQ?@0Jmqke}LM4Ahj=IWY%);;gST^={yYrleucR
zgxMQ}8rU0{Kx-Qnnrh~Q*F~}=2sJP;urR!k7uN;(59D?a8@2+TIYJ#gb3pAFF<zbq
zp&6iiG24<95<q41qy%u^CaW*O>^R83ps?{UVT<5v5SYS0S!f36UJw4sAibhfL1$oq
z<&D`QK>bzFxfq~)?p4Bd!mF6;0RLo2`L0yfUSw7*!T{0-8qYE-Ho5UaUQ`rh9ysng
zralFw4alAho({e_kUbeZ6#_F%L|7QOg}FqVwoC=LHMA2I7)&ggJ-8~lK=ZW<FJh#?
zV>>V8MM^<=6HSjTs7wUu0gY{%STTd{Zkx(g#U=G3Qfwk9JYUF*u!8hK+%e@U$Q_Wn
zk_SHCf@<cJsSq;-7+%QBy*07q_dt^mg~@~L1nnU=vEugtt><_lFRTj+Bke>122i>H
ziNA>8GzE=Uy^t6B3U!ADm@Z~8=u0r(3Ju?a?#Y|BYH;&0nkX_bG}tsqXn@XE1hY4n
zgW^^xfsYw94#hpW13LC1><db_Ab<5Y8S8`M5){Av4aVZ2v3^)x32IBh+U=0~MG(AZ
z1yo0Z`eZL+xE`8Eab~=T7GgD#Vt(-=g8d~V+=N;|_M(@C&6AD7LFRi@F<5}|w?_qo
zhDSMr0#Aj&G*G_=lm|flLy&t!7#Kn8oa0}}3%&)7>441=VPFE4s~)8c29p~MK=Vs%
zZA&Ju2dVE{pdbM9!wY$VxuA5|w@3lJM#;mNZ31Yo$qRXbTu_?hn!_Y>d5ZM^wgv@-
z3>&rykg`c2<%PW1QF96Y0}OX096;qUsC)pG$sVR0GqUzDWW12)e+#<j3?%Mh%rOI0
zj+-cQNOUC{fXaW+y;24(O$r}8(ik*aS`-(6)<pL-7}SEo`9+kVD=6=t*t0+YRGz(%
z7jOmDv5<O&H5b(O1hoO%8x)Lqb_h&15n(Xk%MjSgmm#o?f2z=mbra+7@=p_5!LvbN
z4rs3~&t;(o{tkgTJa>dTKyxTB<oUMp+z|rL<Adtw6MOXALFR+%Y*4)O6bsGp*utRD
zRI(nN{y_GD-4Ve8I*XElr$S&3#~!XZ-g6i<K<5O#h~y6hjoE_wJPM7Vv&MM8@*ENB
zFu!Rp_##SpCdiJ{bM!#<&v(#0Ufy#U6!;PZrtn-5YT(Ndm<)0Y&t;(w?>qK_FXVY^
zdF}|!fTq=iwgf$2a2lv#FlcYEIS-1n{w6(jP#l870A$YfIh^vBrbzz>?P+-t$LR^m
z7cb;_-h$J91%p99gYI5Xxd$rKUqlI2LfoS}ALM6H`0!5<n8O1qUpfTlypZRq1(j)_
zw0^xo*1o?<<2|Si`a+%;l>h&O#QR%%%t2<qkmm)JzkgrE@il_dF<7oa=PAhT4#sRd
z`Vw@mLh`QxgHp2sgNHHO29Ht(1+K|lB3)Z_=7P!+6Ge6p9tD9p{S692Ahj>#c}hWP
zplgo(SrbJD4v>G9S{N9(CUXhDkmv8ss!@=H*rUE5;w~Ouc=*ieehc!W5~O`}1J*tQ
z#T~d@h+qJpU-^Q85j4KS0(Pej+m7}I?OISd@`8bp!^4K(0ZH5!B<^9s?*OWIu1j#V
zfcT)a`9fYm)x?qqyl(IX1H%jt8_pY$ydf0yLSCTPT!J6G?(T&=+gx)?_8Xuy)8Al}
zZ$8KVH&2GZ3=<iK1>G_Y0(=<)GeLDS=sfQiG5k|ObrNW-=!HCIF3%jH22g)6{{kcE
zj%3jNJ8s$M?K!j0*$ZZ$wU^93V-LE^40P`q=sq*h-Di+<s*i%t|4+<5Y@f;SfMfZK
zNRCR-ISQaMfqM?uWD{jhP+8#$;$NT4(Za#V<Oy2)0czh}nZuEMsaXC8M-A5<6H$hS
zu2O{rr3MDZ>?tfOn%fj26#MNMO~gf+z<!lvP&1d{?|`&V7&Rg76L#>qt}o=}=Vnh~
zig*#j@Y8e_>kQCYQlR-pa9P;Q#cm$O8}K5A;h<u^9q3FNFB1+122)**UnT+!4W@a#
zA3$fX@-6_)Q_KJ8o}dC+ALPct&g2HVQ;+9{z#N_v0@FcfpMuQGzGFX;=Yqf-^C;c}
zrW_2Q^F%=R-OL1y4|!Z?FaWJ%F?r6=;BkXN!{a7{f~gnitRDHZp#EVezr8ug9*`SB
zXNj0(Ffo{<Gcthsex~`nA2>R=I5^t5*g<CsneZ_*m`~u70Nu|3(gSX<_9<(C+{MAc
z<i^V&Faz#3E~ZG(SU=2drd|vJrW_0nFQVn{g6xI6jh`vX<T--_%xy2C<>rFqJH74g
zL3X@|ma7H1&C!PA7pR>KwsW#l0LN0UDJFAR7`U6cg!!8pW_r~ySnw4HOb3OBc@&=q
zUxvVp>^t_AUNsB`pnken4FhOhZKoHs@61;rFy}?I>`{<isAel(0GYwDlxxnFJsd6E
ztt_k@sa!`r_AqC7>|~bk*v``7v4dFyqy}`J8_0hidq8WfWpzPjfy6y_GH94b@jZAE
zEemdIgWA)eb~}%Nz?=+YE(Psm0R|6a76wpRn_<iX+K<El8v6x_^(EN91?7M5^Y)zH
z=j;W&&)Q3RpRrdY_S|v*3!wApq_^@q2+VjPFLM`^UQ8x4F<hU*(ZZF?CCoL4MFy0%
zL1XmZGnp7TmU6XTZ{=tK-FM1S!*$rBhH(SPPv%kl3?4O19w0w?R5EsWlruTJh?Y+E
zs9>A`@*_`yz|0r&a;D}{{1zTIEDWHt%s}FxdEgh((xT>3`~ffGSOP)iA_$wv@PO-A
zP<}SQ$J78mZw&d2G0^#9=x354pGS7w?k4E$vg{*v;4{eh8wA=-WOyV%ee}t5z~jhF
z88&PyKxG#PBa=sh0^1Hy+t<W~n*&q_n;3H#fat6mh5!>a_6s0(#vO(L6Fv3<5IYmZ
z)?^m|vuzjxOtjcGWX3QAfXY_T+9AdSkA<K%IjGD4_4y_x7=Y%i8WL<ceu3-+_bF`H
z!1WfWod9YVn27Lz_C71{H3-ZBjob1~76Q$+#DL;I!-j=HDS;1sr?QC*j{wLYpuKq9
zlfixEm<$^>*!t`k&^)M#BAZusBZ~w$Ey*x2WY1v-?LqQZZs`A?VZ(U?ByK*L;Y5Zp
z=LPdQ3>P>UnS4NE88)0JI2f6NOk{XGK<)(DlVQWw!NCYRubc_8t~;6&ycQcY-m5Ip
z|KD7K!9Y2HkMTtm%URIcL{OOzk^`*+$*^U1fXac^CW6+fs&(&d&;W^X$TCHkM=>0D
z5iJhcGt0oR3ncy`N(i)%FX6<T1stIHUUL=x1?HCg3tmJBCxZKc4GI;Y_K~syA0vqW
zB0|{E+>){5^c<ZEP<)t(OEG}TTXPBi2vAuI>Jz?*7W0Lax3b{=CMX=tXEK~HG3Jmk
zpTTfJ=>h+5<wf?tl^^c^uhgXfTj>b@Z>7cjzd`0@7;}L7SK$4{nKL=TVU=OdwgD7A
zX2pyR8MbT<AU3GIm0`~Yc0=YB1_#i&a~Z~<emDbzi52IAtO#h>N-!v7nlLzITw`#^
z3}tXgWMJFzB0?xKvxf5qB;1%7AmPBIYaYco0UR&3oCiR1AbUV^CKhZNFQORVnny7n
zfQe<;vL$dZGPyw3r3!pCk7E3Bdd>o-j5%xx$}I{Eo-^1sfb??D;F2(pV$ygK#h80p
zTt*(GA5`CG*s?`{<X=Py)S5>z1%Sncc^p9PBak?#-pf#6JMkil-_<;dso=yNg)DF!
zurWowh!D^;w`A%7-5Ul<+nF|OClGS{AI&Y9Kzmt0`>9w!av=LaX1<8xUuqu31P;p#
z8@2<Ud%$7s<~@@Enr`@0&7+u3cy8vH;Z?%m&@@LuD659S0TllkHXKm*@~N6fF+DhK
zqX0?oR$L4(BKUWL)*6HIw6c=`gNY^Q2N2uDn0p1cF$@2T7<oz1x+v~`E@99b4R!~i
z26hLg2J<Keg{CUhKCDME8)$BwA$v00g6zp`E3zlEZBR;PV91`#&Y)D$|37;&JBLz|
z07Ld1wjJ4%*#(q}99YbXxgE17v%|;9KxKDZ-K?`F;!?9f^^($RuN<?jOf5>cUTT<K
zV`Jbe6>8us6YB8T%+`@ThhakYWQG}_Iv{&8!vc>vYzd&YGN^w6>i2-$lRcT;AbT>q
z1^Qf4SB?4v?aKH6O_cd3fZDqteJ>bTUV+Z~P<CK&0Qcim7#P5PI8_D)j#d`d3wvbb
zFVB(w!m)=-=JFi5oc0z438id4Mz0bchHG<pgtAI_7(DK<9RQu-(3jQ#F7rTfoB<M>
zWB=d7ly!xPKI;nJKMK<_%ve`&{^6R#!N?Q<8e=uTXgkqEjdca+97Nu)3e)(`2}p8W
z+tI)w#^lC#L?DXqfItlQEEXxy`H8O|aO-4WwW~DW!Jv?R%`Ou(SN9@{<7oB`yFzae
zzG;{FB1U>8D89U}+EsGMFvWA3a?Js)L+o2&Z_7Vlr~zaTpQ*we{yqUo{uY5K{sw_C
zu3IqkxpKhf?`2Q`^-;3#+GT>upcgUHpuKdFATv3?a?Rmy6KVjNX>yFg&ik%iCigNf
zw!RhizE=*&NPEe!uHcx%B9c+Upuqb=U@G@i77_j_LKAp@2u$YvATWh{3X2%%974Wr
zLKBqkod3_k%oNHuM`(h{9`N}WpgUd+lqbkBde32e0lEVcG_C~Ye}M8gK>0tQ{00c0
zi2=%=q1?^KXg-Gr#<wt8YX2Lmh6Ac*0+cTR<u8Ef;XVN6dvGk~VugtDI6%b$K>PKf
z`Xr!YE1-M@D1Qf(uL0#BfbtEX{1;}|ID|m=q&93_xQS<vkQ1o<G%;t>@F-(w0M`qO
zJQ7(C8NhX@i6tAPu2p1{;8zst0LxqOFo5)M9p(}<v0_^QTZ0WsZy@;$8y-+!gdw|`
zhr>|@v_A+m&&1gEB7(CL)NTNk6QF()s9Xl+6%$o<51u^=Q~MU!zXy$v@g;!HWl~&Z
zBFv!IJ-JB%R8N?QvrTv*FTB)Tf?okN?qFifu>jP+P<p_}th~sM8I;bHn)H~Jj_@(R
zkQctHw3v^XZ-Ib3XblDTXQtpw^QHf{KTrtbp3F4IM4mz6@?`lBZ3zh;*NQn5xh^wJ
zzEmUq!Ti7d|NaN|XF+nH@jp=d0-c9#Hidx+v{nMN#~ZX>;zfiAcn#hQdAVGWUz8pA
z8DB&Qu2o23VDM~V+wdYna4JU%my}5r6T^!L!CGz?E-BFb3rH<rhQJiQHUW`KQ>1^l
z&6=lfR?JYKbU}{M>>85=-xY;vuMQkw%38v%aAAt{|Goy>=OB5GJzS9WPA#CZQQ5s9
zF;Mt>*sy}u5qvO_;j!Rv5NOU&VQui7!?vNnLE(T>3IoH72!U2*Cj}5)3cl|oLLgPy
z8O#q=b_C12Dm#H`Q_$U?Ap9aiK-N5pi9y*FEDmn#dY<8!U?Rf6z`?^5%pt-Q`htO>
zLU~93f6%z1SBZk8Qr+>pX2qtpO_S}{g4BZTke9FJj^UDOx^F)NG;Yt|ATYoGfjxNK
z5#)Zp1c7ON2kg&+&Jk+brpRC-&h~?EgTNe6Sq&;fLFoo`rlit~{{NokoHw}sSTrbo
z>Hp8SLtrw<@5(d!|8xCek-0oaDu=H|h)?Op`v2Fba3q@;voL_#!yq-BbGYt+#>2S2
zv51+-GcYyOH-PSubOPO_uqB!OzX>mc16MN_b4RXYgo!x20VtilkmtK=F2VPKLzKzY
zM3y0eXNAB{o)rSScp`;Xtlt=amnTYS1>XjNxm?$|B=~0tHSjMGm}#QO;J{aDw1a<z
zz)TKCCMWa%3`~5LLLK}Y1m=RqkojtbCh+YLn9Elo)Q~;dej(^S2L2TSJNaSe3PQ}i
zbXO{e$5x2X?3w}t=$^yuM*Ec}5)1_#RV-4Vx|nko*R2;3jDn#3YaO}vN3T0`BzxZB
zm;gE_&wL8+1pWqrscj1swD>0oOwFFmkOA6Xklnx#z_&qQYW7qH1&~|1=GbossROqg
zL>L%AW7-^yOm1Ml4dVe&8xyoAhifY6j3WlG7ZE(ICd@nn*XK)s)@{sewrK#@=b(D~
zvZZ9n3wiFN=26U`b2_KB9Z=wc*$c`upm}hRoiC!84MF)HbiW{|-J4;<GQqQk^9E#G
zk@L}uSUzx{!jXe*2dEu&kwg9m=xn@J289Elv)jOBiUL2Vt>z74n@BK&_VN3gSn)W#
z2$%Z`3L8*4qI7^UnS+H1bk0REhYVAQ=|Ua{6L|(Bvug};p!@Zde#qbMt5jM6%GaQ^
z=Ae2vvy|V#M1lo$CMm;<aJg91S&RoV4zMY-GAMxBL7??6BA~L$M4P(-bk--BZNN1F
zOdE0tK+o-aG?77p;ROR*(2E!z@V>?u5j?6Fp2`1s5yPtr^81Sj$(^A4JWkXo1c26n
zy@(RO2%5`KO5nc>I&0fwGebm2vHg3Kr3?ibdl(Wx`%f}s7#uup*iN)Jsh`5qhL{9O
z<Dhjn;I^72hk=O%!+{r(?2Vwa)xdHRj1DH2>=!`yjl76t4^$}NV+4g0s85$Yhd}|f
zxAH}_e4?Vh9U~~*LFa9oSa5;cwdPUG8(u`qYl7yE!EL~3c|r3imJSdbw2$08iY?<s
zwA@S3zU~(c>=Gu)><hT|gVqHx7=ikYp!x318h!^*o-z>^eD^}0L)Tn_?*w0hKn#x=
zc-?06^*J0)P8AF$<`VY*xn-DQcx;6xT%W@&0UGlIk0II!b%4^5i6VmnkGasyOH-u(
zniYf2pq0r5)ip1|<#Iu1|MkyTQ1Cd*reGq@x&&n33wicXa|yl)94t&eCVUJE9DGcX
zFCs;Lg4H%P7=X?JMjF=+>TOWq;^1fUx!NEj54!W-M3}*=^RoR^kUpgY{CBy|fc6mB
zyPAlzZsJ_a6~iUNHRozCM>6Lc7Ez9^Tvz$_2u--&%dwQphD!z%j(mHBW^k_MngSX>
zyEcWRg>Su317`^rU)BN!1rrH|1$^s-Kz%F*&=^kEVupyUJq!Ua!X;C))-q)9o)DOG
zy+KBm_l{79QWI!xuf4I^6axp|J3<1ySA-lu{x*?iV&J_a6ys9PpwabL0d!W72=5&s
z5ff2H4$d_!BAjcv=3Jk{(Zb!$CBr{eh>c?l*Etgj1_|B^0zII-@*-TK7j#YzZ@*9j
z_<pAd=33qcp$^^~0)5x#aIQ6xU~u3CwTD3KZ^I=_LGCn>VBj&4Wc>FcTtd|J76TLS
z0U<8$Yj%me*MvAsH#0DS?nk&hN4h!VGMfVL9U&el|8HNBg8=UxA-)&#GDl6sSwHZA
z?}d@<1?B4(5yBHqr1%(4)L4SfUxAzh8O47Q6i?th5-B(l#0JGxdxHY#oD<OAT8$Tx
zf{8Hk{sx5zkXjQ-29UTRNW6bu185&5L~RuRK~O$BJ!ioN4pydMklGiK0uMpzK<0w`
zLXr$nwE`<aYC(DO1p|WzC||ya6zBx0?VmRvbmo8tSbr2h_<oDibL^gi>;;+YRl*R_
zQDXldRJVchURDi50$+l_oD3WG4IqAo4SN8HejzV@G{c5N08+o1L(e@C?+3*zC?A8=
zfby}4C40e(2>G|jdHIFBM5>7;yTF8o2|_Ozn4DS~lsrr&`8Sws=idQ3OCIF*7t!Je
zL1)E5+XQnu=Ioyf%Cj$`#V49aae(K^L38sC7977WOUVD|mQlO_TB88MX5aa5fYy_O
z#@NgvIUm5rFfPxLECG$TfyNI(>qfHg*mo*V0JU#9EkNT+ps^E>9iVZg7tvw|&7(NL
zW5^yh+zUWs65zT;i~%%O?g8qbn$NMn2@>NFW(xJtVFQ)x9vnPOptYs(CgS!txu=86
zkxiibB-515gF}=lxcz|wSEdM?1BVEc4_|_SjEM*%NAr}17ni5V|LAK-EC8K@3t9`_
z-_%$DD(7A>Fx&v0(F$7kW@^d)0d(K8X*mB0(D;_wcYe@$r*kJS0Iknt(CTYY;NtHP
zm;!1efaX6y`(8k9>|bL49K`QiV1FG%^LGeL1+@V|=j@t@FmiQIvDXFJ1;U{FZk@6i
zBAl`rqD+JtId~fcWSS>86kMJx|D!J<8MJ2mAjEym9-y_J3KRGkUobEPfYvyG^n=z+
znItnXfcBTXke5$2N#_4yBFxCuJ=uOKNUcc=g8=AEbMUx9q+F%vF7^h`T^yi!YQGne
za*?1rMzYV@H-h5MaSlTi2RBnV=*(nLTsh8Rhyd?b3E%^*SDI)Z#p&@PTDTB&7P6-e
zn}>-A!?A`d3ZS!ngFS^o=LQ%sWEisrv^OXifX1(!Co_QWfpVV15M`ps*}!8gG=axP
zXa+Q`GMHF`+PqRzO{CZtfX<Hu)s3L^@FH4hrFj&W1Bh>;$n0Ta!w9Ok<3V@j@V^k)
z!v8{GEB_Rs73&J)?}FyIJZ0D%+8Y$4K=vgVGm3%iOR!;-@TdX1Mag*zLj<U;lU2gL
z0VJ1I!@h%sA;`gmgGYjwL7=6lsbK-cUcsH_QCtUj8H7M<Js7-au`_`DY9hm9z~3M+
z-9&~*gTDbZU%{im-yksaMYsUC{qaIxni&+<FXUxaO<F*6Ub3PlE&M;sFWZ6dKlkor
zXYg3Xy}(3-L4q#<JSPV_H(~{dt;oUvTKmkGeA&*Claq@@v4D>;`-q*P;sicMQ!o3Q
zCcO4HO|!WTOnbO9I(-$2Joa!eFnMlo3`%DvqV_jI{S6Z_h7%_8497tGOHJ<D8+Vl|
zY%meAzu7%SDGSv8e!;-71C(z-?H15kWG|xmUxM})@_Go&@r(r5Eweypjl2lw<#q07
zhydMb1?nTch~}ROD(^kLz-#)LK<OLgrjBchQJ}fDzBa`yP`?CZc18(XfQJp+iuMK-
z@OTf%{R$uW7!?Ef7!@w?F@pSM+QU7;<T<~D2_J)zsTY5M$ua&9rrG=pKz6){<~wM@
z%diAAH}fKzZ)NfU+leNU40<nOnRUT#ixn*d?V~lnY&#K@k0JS2;gj<n+lk<LfL=u@
z=R3BOO@tY`Kz#1Wpt68b>qV?M_^hCg`wBuJH@CIe%?G);<xPVWh<2LJ5YfEd4t(yQ
zS21WGhit7`vHeZZT%cL8{ol5v1|d)$2jzc|KSB8!beB3P{LQD>+h3X@{iCUG-gQu$
z8B~^l&Q^ONFSixMHxXu-&^=kf3E5rElkL<Y{^fZH-sdeZCkyhki7>;A?#T);KP&^S
zqX+o|<e%=z3R+MzHh{#sC)-2!$cPD>2s5;FPX^tg4)*&zsJyND9ovcg4FbZ~5@hy+
z=CJw_?C*p6$RM#xmGVFO6%-WAitQJg6*DA&@(F0&rt?gO2+&!YZAJ6fgVdT^+AjpH
zB?qTD5&N4UKXXq3g)4*9i)ijd&^XHrd6~H&_k+%Lb}D6vXf{<4f`pO$Qjq$LVzz)6
z(cGM%^ahPnrWdjDjgUAMJPC?ZP#l^FGqhcAkl7D%fAeJP?;tbH=h*v$%D(od1_4mm
zgX+2r8@2@?_x3j^C}iKUvs4a{V|)?K<q6vR{z6{(Gsq86F-6cGbdXxmS>-RH#ce_A
z`x}f`g2X^<{ssXVP@F;SxB#ldAZo>)Cf~7h1gSHT5@2wj$>0JiKR|iu^+TQ%kX{om
z1{P30O+IDkn10vJHT$w%An2};7tvz5ATv(<*>qF6g@J*WlOeL%M!^E&CXS!xQ49}W
z$O|og5iK?qqz<$u3S^H*2jc?}4O)8-vhVdn0UglVVvknF7of7iqmA(cNIhuHfA(Fw
zNRS)SkK4Jvh!*Y5K5iEX*2~Hi1rj$|%E0D6hrtCj-T`vs>xcYPt}Kv|1Gy7qK1lra
zL;f6)+d+Ck=7G$95iRnSqm_#lWEQ9_&G-x{FEjqI@9_A;uF>A0kN_I@1z~eb(7XUB
z?AZg&qZkvikAe5;F@WO9!-{PI<V;b~tsJaOk)X5;x^o58&*l(jiUResL49nHJ51ym
z68Jp?w)1-k?BF*STCx6P{9S$vp%qPc6_ofg1g7yF6A-&}P5Sqw0}2eFeIuZD{R?^d
zha56Yq2`MA|2Zs`KzCyZY*tWU;ILwnef{77Q@?_f)^uA22JQtc4%|^}jNA$=u^fu*
zjNG;(kDk0Bfq~nW4ID0@{v@~66j=@_rdUuof%psz3=GYY3nVxgm}0rDm}YTXG0g<g
z%?=3`S1dU!xD`qm8>|wfxE)v|PdhenaoDoSUXSAB0Li^zbYQq_DfOa5(*7<;3}$AB
zr2SUzScIJ&lJ--%cd^0k?2xq2<&I)=eEr}61IWA%N&8UlU2Joa^y_j*u{FZvL25fB
z?RmKuLd<~h?Vf`4ykL;~)gftjm3tT4U4(wSwcJr`2a)tQc1YUwqUlcs>3P8*R|PfC
zmwO?^4IsNaB<)n8@>U>uZbvr97YuR+ATuEHwof?}L1MDMu2^xjbV%Bs1^ET!29Vty
zlD11Ztk@2|V36Gf<s;jFutU-|6=J3=$o|F-Nn14gZB@A)*&1Ik$b#%|gsO$x59M=!
zXps9lByG-eFNA~v#C<kPITS(qWkB{jLd=rc0Cm4(hons^ha$**G9ddw@{TVUWC}oG
z05T6`?h6JP50E~Pc@V$KfbG9x#j&(Q()ua4BMajT25FH0L43IXIi%PQc1T(;1?hdk
zAiWC|KHQFMAhj_24?@h7?f``mBz&xq{SVR)^}jU8{|6!Nkp|ljQV-?B{NLCiX@%y0
zE0FyMUoc34{0|Dh#up4yF#BQr4v;w@|AFWi3{o)vAMB8{Qsn@LpA^`BC|d*M50L#(
zJ_m;tn<FT^IwUQRUQy&|dBGrg3n4Fgg2Rff5oA6@y(G;3gCKvuV36zpg#$=GB&;N1
z_JiW1@dbk<Ec~J2B?<RGNZ$(vNtpjZ>K$J&NPGaL0g(L=|45twse_vDh-@BI{smON
z5k$XWkbv0_<Ad!7#Wy6bCBXJyvEn$^A!!bce{oR!gZOCiZw?KAaZvn&*o-e2#KHat
zr4NXI#lhhZ<vYG$5C_|j#E02`3>1zp7{oQ8;eC*U5tMetIY90L`L{#T3_1Qm>E+-H
z2C)mEJPDGA*e3?IABhjPAIf)p!5{{<ABhjPABleg6mFpO42e%Mu>A<W=m(g6kh~=d
zvmcb+4!&Rzh1n0|!|Vs~8(%Ppg6&86U(^F+4=DXW+%F2YALJgW`5B;afyz6+U=V@D
zKgc`~AEf>uRDI(M1`(M3p!5XdBirxzf<d$a>c6F+aDBlb0<s^JzG3P?=^4xise8d7
z!U1w0$i0yCBMh>CE)pMPe<LXUK;>6};twPb@sBVp{e#k5;|m61u>V2+0h#-PK^PqV
zVEtC0vQ}6FWDb&i2FM&}`fhx|AOy1iE=V3E{(?aWl>R~a50pPZ=7Y@xhldrYY!rII
z?Z^fTAIBFALNNP5{sr+7>cM5b5Xe6;|AXuU`5(jwneX_5LGT5r3;>xAwIAkQP<jNL
z2X#M;?*QdP^$UT*AIZIfpzsH|4<z6Cf<Z6?6z>TC!ug=^b9})d0QW!0+!qW2Aoqgw
zL*)fw{sE<rgD)5az~K)HUr2ll!2AzV-}r(-0AxQX{*FQAVfp`ghon9<|MP?LKZp;{
z|5vOyKzwMP=LhBgW1w>L1p_}g{XygZ;0p$RaQcJt8(%Q+gY8G+gWZe72l)pS-k|sa
zsRxHYRNnCg10UG`NPLj`g9tu9vU!d#82BAP@dOP|5WfMG?vT`1fYLcAJ|X1|-w9AS
zK=b>-7Yuyh{Ev|51=$~q#0S|Ab}uNMy<p%4`yV6^<%9hX<u|@y;0601i4S%!5+B(-
zkop5K_krja3_KwFLFpfwzIZ_DLGcge^McJo#5WHp{z2&tCJ#z~j!5z=K;Z%PZ{rIF
zka;YOAbF7Z3kDvT{~I|NLHUUrY(FUcAoAQG`@!ae((MZdZn*!Ue3<{C>5&`ke~^Aq
zyu4uG2B$x0em?ku0c;*9JYni#{s-|JUodci?T4xd@j><<1iKepesF>P0}W5d7Ytk=
z|AWE@s-GL|e<XR3dJO$g_c^{`;D)6Sn0^qS5n(@f0Vv%=`5^m1;SaM9#0RB65FeVJ
zIl=x1*$)XnPLO(7_%*&@-~{;x<bRlYxc?#H$;AM*4-}t`FBmw$<sZoZpmh6!ffE#-
zVEvHr<p9<H$mTbI%4ev1LHa@J!R~{kFSvQfAms}OIQ~K50pYWQ!ykzcaxXalLF75W
z{sGBD(my*W{2f7js606Qk@%qS1f@q%{qOjKfgN0)g5)9YXFmYa2XZeYyx73@Bk{rZ
zBlzrK`;qvd@Na~g2QnX&|3TpciqC^D7}!Am2bX`KdiDha8{EB+@L&gpHz@p|<t01F
zz2NwVxQ87%{u^QDf$WF4pAA(0gY-kocQ%m!k@+C=KzvYp5u_hvA1FRR?gQ~b@*wwu
z(u3m*1{RqAVSJeXp?p@D|3T^F;0p#8uzx`1A0+*-g6s#G=LqG)&4;*`1(cpZ@*w?<
zFBn*0;SVz(q#opd5Wn#S12afH$o(Myf!xP&MUi7EB7HN%(;p-}SzzH0G9RSA0vf+i
z^H^perEictC_IqO2icFz2ZcY34{{GEK0)CJau0|P3V#qEY9I3skbQ{qj@bc}Z$RM#
z@jo*IC|nToOyKkg@(;*eFBq8N?uGITK<0ts8$`cgU;>3d*glXsFBlkM;SWkbjxQLP
zK;aKgk5KhHK;Z(?56Lf#pzs8RKPdhWzF=Skhd&~JGl1hCi4Ti^kok=-7#KnR2ZaZW
z5Ar`aeS`e@f`I{C{(#!|P(H}LAo=G|KD7Sl<miyJe+U+nm;VpzXLm^2pM;GAbV%AS
z1j!@Gf!xf9#7_j3HAs9%P##0#Yl8Z!p#F4+q&+7n9AI)FeI1f^FA?%~Cqdx_lkbqU
z+X(8%LiE~A1jQXp4yv~hNj?yiS7GuUl6ID$J`_~1Bq-cra-gvi5az!r)Tn+?AdLS8
zm=?3T<~~jTppY2<L4m3KCk3YQ-vWz=@m~kiV0qA5XQ-M+{*wYta5b1_%;7&NFqb2S
zONQ$Xmy9>){x63EOd$Q{_ZS*DB$;BeFWVpFkYaM;kYWlw^?lI-4oRkvZpr2u91@T_
z6fYgH{BY^o%n#;s7!)oYu=;W7+N>X-I}0uyu&%juZFUW4UCpHf*8479o4wC`4g<@j
zYtr|*?y$(THz;^apT=OvSSH~xeGY@ewV4bIp!Lp|9T;RlVq9~WLas|NFkIWkz`!BG
z6m?ll@&kt$Q{-hC=@0yOAbx%QU*aTaTnQu(lDo8*^ULdpY~b@Z`0s+%gj-z?7uP>1
zB+h?OU?%@bfmuzn78ro;Q{)!m65*P)1GHzFi(90l;ROTdB+!{f+#xI?AhSSbzWy)4
zd1<Tk2M`-1c5N<~!0U&s7r3@Cg+k4bu(}a0p?^?F0&f1U1sYsCxJ0>jLCqEgna%OZ
ze6RigYje0jYc&|Sw=l(m&JKX?jc)Av*`UE8&J+T=j}qiIWH}R22Bu35mLD!nnfbwN
zD}%zN2CE;Jrp)?bwv|EPQiFBPr75#(%(gOcTxzi1cWKJ(eP&x3ST0SGzRxw4MYL~$
z%8zN=7#zBOF3>QMWnki#>X-|no2BNPg6sjYU&zbLg4SE~Gbm_qNH9f$&YODukc9&r
zuAuuXLGdiYzyynDvnhypHk-mA0E=g{DGVI2cs82?jpr*YB7F^tC#KD3aNw3<5xFcT
z{ek})I9|jqi%Wv`_A`OQR-7sF^?y<D`WqPk(q7JQuOBjj_lv^9+FHzg21;1p0>@<t
zw-}cg*DYvxi-E$MP04JE{eSK-7BSEnA{=5&QLq1t6oTVYj428vcI_@GE}1O2w!z~v
z-0GYAbd<D$H7;43z;QW+O8`9{r%h$B%f4?vld)970hD$x%SwM>te0?rx?k*a1A`RE
z-yr*6{}%?&=Vjlup9m5MiGlRJe#j_rZ4LtiRFAmTb$4;|JN65`@7vGRZx9j(na3f^
z6n4RZLB{*8{Yua}6p%jeEA|sFPvQL49J|2c+9C!9ZYeG)?pSD;NP)tHCCluZ{eO@i
zkX_unSVTZ!{rbO<BWS%Khz$~lq;Uog(7B&bH(<*{TA2BVc@ijGu216<0Og?<@-nX6
zdzfNCd3oAi2D{4&3?kWg?H4lEN;q8m&cFZ?zs$fO%Jr2g^wM7G4^X?rK<>D-UGf9S
zEwBFzg4ft*-?g9Vecyf|NDl0OP<nYFcLXV%!a?SN@;WG8d*8KRc)@`|9yu;S_HxZ<
ziU-Au_Z9n@(DGFL@)yp(&AS$8aqZ=j<%Z^2uDzh}V!Q<|4`NwFKyCrqefgX8hu8o4
zAA<9S2s9mm%7h29Yq+j3g+Tp)TqaECKPfPyX~qIAt}R?5Tr(i?!L<c!J`*^+=5Psc
zi?E1r?_r9C>JPKJj#|cdO<iCB@;}J$*PR#`xWmBa2!Ze5l3`!~nFGqh$mNFl9{ay9
z<i%n^@$^DooYj1<{a^DfATi0ap#1VeUaAx<wihHO_ZH+n^EqI)C@3sIaxdg%!1~Ru
zfyAX-L1_w0-4Ft<A0)x`!vqdVrm$|w<}3~grWjD!b-BUv!{s@Uvg>k#)sM?_AZ6F(
z2J4#3b7q6fuFDP9`!3IclwF{`tlU#sL{Dv1@R+uT!46a>OxwcXaP1}o17nGV!(|5s
z5s(<y6{avyTwaM{U;yVSXud|RA9%p~fI;~m6o(gLIlsJqAQb|NKWJDZr)_Xu*fe*6
z6W0tb5$-KBrh(Q_aEo-z2d%l_{>CK6b$~^TTZ~DJYZ^!%kuF~U=iYh230hBxGev^)
z&;!X9ju3d7z_5pF?uv#N3~Wr?TUca4`4<#_mlrU|BF7<z6jOZD&-qtDb0{3*OkpNW
zh;rD(2~iH4I3dbm6DLGDY~lnhhYztZ^*E?jObKJK<N67*mt#`5R7V$Rjtg|Q9I~DL
z3<?IIx*c8@JP`i^3NO(5c91wIPT_R{s6K+$`QZ8pTIYl7BWRruu8%-<{#8(%F1#^q
zCxgRfN$C%u`T*Lt5d+ulp!_5Tss}g~!S+G<kT?^20}_MB8KRs<k26SIiF8ai5ociH
z`p+cK{eVTDTb@atYd$p2#F!#MdHMB!j=&2s&^Qx=#hI84O1X!y2ikVnvz$AGMHZYs
zLS}&XsB?>SfYS-r9VQv>1{N7^873L7Ib0$y<Yjz8YNst?u*<$_zmPErsZOXws}rDY
zo7ex@H9`Iam3QDeL5wL9r0?|ukvG@=!0Uu??_2f@L1i6dm4t)$P5YUb8sKFeI6Odl
zu7of!aQ$Zrxik}8Cj@ZsVv*sF;F99rH3JexQkY@H9S@RckpZ=JKzk!z|7YX8G#z}d
zSrjNugT!Ay5Wd3og$Y*HVWjJ(xqH&Nx3GwS!)OcCE*$akLSBX!Ni8@WvE{cH@{(&o
zc@9*@XJ4~lI3<(;QiqgEI9z66kmvf(6n^Qy^auX?khaC8zmgv=D=<ib!Vz@-{OkWL
z;5GfAx)xM7fWj6OZlF5h^#dW3>xlX`99+(pN;rVR_fi9cD5$PQsYmK19Jr@4g?it&
zp9m^{F6{@`9|qT^FfefaMXE#og3I_vpgNa3mPH0+A0$kf6T$5e8Kx+Z*mZFIA*jQ(
zhbac0zR}vO&9fG0asA<v;fA(Xx&DC7b^?|A*RF91aBpLR_Ya`$t1#{u78&%u0*5G5
zeE0kX3ZVPUxu-(bR&Y%N*CkxsVl1*;Us>frX~!hY{y+B?7E$g$tTLAtFo=M{{rVmT
z29O-rT&CE|4Gf^ZLL{vH$}Peo&-I5@^o6{5ET~L@)E9ERpzwgyBXVm&?uXPJOrSML
zhd^g*WuLd#%syvtn0?mXGW(3ZWA<r#&+Jq7f!QbRBePG~CuSeF&&)n%UzmN=zB2oW
zeIvhzKr7Dz@S3#@(Aioh!VLSGCpSDW5oTD>JXtXSbgpCbWTgzy8Q9H}8$kP>?6@KK
zY0i4V!1ls~pMl9ln31h{vf2d`eg=u=$qf}I!VHg^Co6!~Y&~n9thNBM7A~Q|M3~_T
z_hitym~2(eliLa)dKn&cPgaWnu|eZ2Cj1Nx=93v7fY!0}CADdQ_@MQ0&6C>%Kx)kA
z*fX|wwf+FHmGbpKX9qdJ_QvxE2*|XzC`<sYb!~4`XaKF51KsWIecoQv`<%U@_gQ;O
z?=$v}-ly$7y-(Q(dY`n9^gdyq=zZKi)BBixq4!byO7A1~jozU1$HbWTn%}cyBwN3v
zFjzmxO`v`9*BfN)!Ru5SjD$RvFjRon<-UlJGBlaV(9l0$K>&1~HfZfXXf3CS1Ov$J
z3@^eMbwPV5dD?`yK<9|^%mLrU5eZsH!!t*S?ZO?Y7d&%>cz8+#qF(=#e+xQy0+c^_
z5(K7$!r(<Dw=L)_!v6WTuAnmT1p{*jD2^PKF%&qgU??&_Zg&v0o}YuADe^^xBzSFW
z`+U2%95PIvAa{5yVaRw9#(ejxyv+0D6ZWj2HQFG%KxYEK{wL3yeZWpK`?#GY_gtn}
z@EPZK?AbwkY?JTUbDLkbdzyU5o>RGj;Q(kYQuZA?Me{rMtXGb431r`~(^PI?Z~*mh
zv+vj$Do<eec;&wQ{p>q-j-d79N(;CcvhUb=DmO4ZFrUJ}l6~1O5^Tn0yGqa*A?Ane
z1UZ<QKx=k7l@b^dKx?(K@7OIgzhln{KA-)vJ$LpUyOqif&5YT{>;$u~*ac=^wM)!C
zV3(PF#jY^>u3cmHWxJW+b0ZJf?R*i=<qA6U0(3@`$x;T6j^*}OO=dDgyog|X3A$h0
zWF|w@iwL%h7pkOwn9O8|c@e?3^Foy*h#hyKO5%q}JA=fF2)2nP9SkidEevfYoD3W<
zA~+I3YoI{ubzVepc!Ks;fa3B+1cxE$TuRV6&li%VfAl0MB!J?CQ<aIeW3hsS^JRPP
z7h#O9CQ{&YAM>5>*mHvN09OrD3@H6@_iHqO)N}AN#gLsg9S$&n(l$69EN3VJr2+HP
z;4qDP5g`g%>lN8P-|8-h43h^a4S?2(nRGHJfa3i{1j|8_R_OWb5iBb~eOr?*28|aH
zY>lAxa3DXMv@r;P&Vqjt!IF99Imc4xJ9fe#KU|(8{hQ+tQ%v$5J7M0}3{p@vil*-w
zn0kNM-v^6<)*D4I|1^<eXfc_>&|t#Oz>s~#UeJV_fy0D{K>@UP$Api;;6()MLJm%*
zs0j}gK>O{RUPQ2h?dROXB;1v*WWjldNv647NeGl)o81+_=f!ujD`<euSpcnRGLd3X
zdJ(~_X~NFH_Cj7h9+a+L|C3Aw-H#4R`!B*|UvkJYxo6+8SG@2``p1h1ri-9G#20=^
zf!I4uW-@SG_$3KqFEp9SP+&5XVZw_DaYfL5>Yy-q5h2cLGLr#x4vM0Q6ayP*?WTzo
zBioAzCPz@7hq!@J;Y9?Kq6zqJ1iA2@M+!!qbHL~6FYvx;F9^Eh=tTtMLlbremKXAJ
z;w?|?S~+W&WFY%zKxvYBCMa$|_(cRW=&m1Ukhv2Q3>ZM+{UU-f(?p6v<%PWTQc!w%
z5hgPclCEUyU&u?Bn(#A*faCrcEbavbL2=SP-|Q)e43oRZ5(e=87*M)(S;0{7B20o4
zv@gj-hJlS|jt~Q=+yLcwP`Tu=hoOXLju3~#9)>cWIiT{2fr+O?AS_`HgA%B(09u>(
z`k&a+ga!r$P?>dktHh7XTO>auOl8oxyjki+!W0Ir%X_7NBur+|0kzvrW->S=%w^C6
z?b+j=$tBL;#sInxnW=le{awBvLJVyO6pBFiyd}(GNC4gOmN17Q3AE4X@*FA9y>cla
zcEVJKjD$H1X`u2lVG2W5!eoY=gt-iPJadHjF3bVni75bDKku=VA>+avNzfgcLZJM5
zVUE-fo)#go7ZD<bJadFZPX5^`56W{d<RwKx;b?x+?kOnTAo+n0ymz2|zDX^p40l+~
zP~fnNp$Kv&v&g|0VN#l)JY;^tP7oBPp!CSW!4wP%XHb}c))23s82=VTo5(1rq~EcV
zyl_nV!-YT64<Tiy-ND!YL`<{q*kvZ4wi8rt;8NtC%M_D+*Df*pj$I+hpV@cpD$VcM
zIVPX7(>4)ikl<AjDB)ERDCM6bl(Mc8yv91E<$!_)_}ttu2}@A=Zf{Wd0V;z*>kUDE
z2Bk@pHim>35rQ*KI2Z&>ni)Dkcj<8aVUcNX2$wbCXJmL0A@>oK);MM0X>iet2)UCW
z^Fa7Tgxp3B873F+J9df<bIi7a(qKzNLIim4mKBr4iwJ>-p!Mi4<i%=1;i=pJy8q73
zQn`U^A$Kd2>kE0gr`bpC3SWeYJA&?ddLb|O-C-F+25LRU4Ysd+zTsR@`2?~TluloS
ziFHmn#$X4kli>9f2UFzhe}a3nkK1W-gX<{!|H*gkSsBwL9Fp(YJq6t%bA1k%!1ejy
zx<?Qc9?&{T5gM+Rpt{CnCPSQZ149D14!UFK2&%_G^%JOW0M}7-7?`r}*ae#3v3r_*
z$1c*OgTVz{_uR2dH0flJGm+t7%D!u7Xwt<X^CDcz6%?1?dL&#*7h0!8y$F{Qh1Mw%
z;5wz7LFz@g<XiB)c03F$CcF%0CVUJJUW7|;1;rN!CsWjmaA{B&_=C#b7va*a;5vpI
zES?LhV>pg72~SEe0IjcF^del^)npb!n#nANlo#RBx}dabGK(SUMYyymNUg~%hJ+X4
zQh%@P;S#u#%*g=?Lla>RCXPK!F&uZ8VmNA;V!9_A^Mm5;g}l&TP~39%Gx0ZmR#3Q5
z4BG3EZ_9C*Nw_b;=qO0;LbCKv&OJ;roJW~hL3JI+VkYOF1fyQC{xIQ2NI4`I|3Y3U
z)r6mc4b+ZRW?8@hKI;{<|0s;#5VW5ZbRQ(REfdBs2)@(#kloD};QGs+5u^t+rv4&=
z0dht~gb;ZA546{igOLg4tc@2j{Fb2d6uDmx(hoA*M9Thu{s~3~6AqQU?4$OQ3X2#R
zOqL2aW*@OvRA^yf$UbbZnSI=zGy9mm;EQn9xh5@)JfJY^Nl56rkS6^BWX6kd4qZ^*
zxI9_%18D4zyTt<Bm*vU;_X)f}XE&NiGHiMgE>sIr_aZ`WC8$jX+BcS=%x&-@UM?2I
z?@CpW0Hx{n1_dtg9encg(_e(MYz5mPFAt6@kpDsDF3A0$@B*2Ueb~Mb)PB!CW*?b-
z)IJe(m$q{-LjY(Wv~vtY5UBkC+G}tvK}P;kiPVeaV1}UN5QYE;6Yh+*1_cY}U<Qk}
z1cj(%2k?2_PRR}oR>=+wHlR7Kgc=6BNeL79UN8u9DfjC!n$O{jfSuc%kicL8vfsgm
z%OD|v!K#0rf<Qt7gUt(hdC)m<ZYDAeO`tpMKx#neL?zTPD48g7gU)PdOQ-?g<GLaN
ze0M7YQ$h`c5oljyLJflfkA}dU%abL3@DvLPT%IiXgQrGFjHg&g2z1YrgAIcMPmK_V
zgAIccPmK_lgAId9LIQ&wPmK_dgAIck_&(SK2Caky2AzZi20fl)ArYP$AwKX~Jjd)K
zy^q=_!tMqKg{ApDdq#c_$elC%Uf}y?f<f(ez61dg(4BsuJJI=r1Xw|36kn2n3}}29
zbWU6I6a@zp5eAFqDatcU*uZY*0N*vcM~I1Mfe_0J24)SO1ww32HK6-6xh0%R7?ePF
zW`M>+oN5?UKxR9oFsOmdb1Grb;BH}Zxi*Dc!l{Nq3sf#a#dSdTL-pwKRe<heg6@^9
z5)c8I2fCMuuSP(Wr%6BzbXODCRHjhAIsp+-KNcj%(*V`8jVX+$1;pm$;JV5b%F`ww
z#<h(pv}=o9E6Dv0QyDBArZ8At+sZ8gGuL4%gAL3~hbatpAoI+oFgSG0u~P@#X~9<@
zAi`H9AOmtY%*}iyAa`+c@RbQjfZWZO0Sa4g3BD`=QNBC@$!lA=1VH_Lz8nD=6JZ7>
zP&i~?wx0>=ubWI~aNwH36u~`{De^@)ANV}{6L<FdgX}VqfuuE_Jwi;NG{j>dAj7jq
zh{HsJL4(H#%;qwg$sk~|i$Q?L1kC5*F%yvCSti85vrLGEXPFS&izu-~o;^Z*7w$;>
zNT^}3xNt}EM?xBdT|y0m)rC7!KVHa7uT7|7uyLvZ-RB67Gc8b9fc)W9!=M9lt5XVt
z9yD$YkmAe;=6|OW1`}AEy^xog>QuvEhLpY}L4E_JFOXUMK>{owGx!xiVZ_P7uLQXt
z40LX7*PO;CeiH#<elyUW5Zn@A^J|!5_$>s4LHU|{GE*?Wm4FN=Z-eFsyXGh=@oNak
z@N0qYQ{v<R$@ir-{Ngu&#0S5TfDEW?1i9V8gyqDf1_P!S3=Ff{S`<!Pn=c_~R&4(h
zl>f3X+k?*>Grw*xXfgwI*D8a+i!gT39i0rP=PX#@ec4{nteAm=XR?q3=-gva834-r
zFXYANg7Uuk9J_i@8Q9-4KOSnP5$Fsx6JZ7pt~sD{Or$^bH_cZE$-R)5KWZYw0FvJd
z>idD(YM?SG!G=2nUIxiav?e<+*dc`>_^vKc7^3A-a9AScQH$;=%7^gAWfdeYLHGLb
zI|+#Jy9tQ$JAmQ>k_SNX&hG-^b8>*fjju{T1eA6`X@ai;B+d;<<24{QR81W?4r99Z
zD4l}1nOlP23ls-j0$}reAZq#j1Vlk*g31M$nXs|~qz+a_K-H*mPhkR?spM3{U;wJ0
zok|#tK<<F5H36k3r&0zpkb01L&LIp|&M^!YAhj@c&M^!&Aax)$&LIqTAid!HyhX7B
z6c2dwbC!T8NIg71mkCH9=Vegd2AjQyDF$@!lX*BKFTV(9>jb5F&|X{<VFvIS{XCQ5
zd03cdvJeN4kpPJ1;xQ2r2K6m?CJTY`E{M$n8tdShEW`(@4-$$QEI{=^LNS9Cs4jRR
zFSIqGn860*b`xO+7M=zn29Vi24MHrSGo5)FgxL5!Ao+#g3zAnrd#FJ9hrdZc#6*-q
z0d&t(*HrLWml1ylNG-Pne-|XaKyv&&ATdr3{yqUI(0xasd!X7K6h4>;GZ^tt0LgJn
z@J~WgKLsSl$-zHOKoYFJk}0xXK>>7LgAxA>kQ}!J|12c+b3kI89Q^YHWWefcm}2@n
z6bwM-gYJF?g(**wfW(V1xwG6em_Xxd46r;0%5N{^g<KPg8SMB2pymWY{0Yi${0%~&
z^L3f{8-!T+8-&<EeK%140_Ck2@&dM?I^H>k!N56~!3dmAiXnHfIfpQ4Imdv?F)jg+
z{h%_&Iha9%-$OtYbWavn2~!Bamw=>m1cRA#FoO;#JV9=E4q?#aDq#vXzhbXwBE}%W
z*C4cF-NpE~AR2^0Wecc}0;*F$eQl5%&9B=BW?#1V1l0u~|AFfQ(EX?3Op>5B-|0Df
zSV8Rv4`c3z7xL0?Gm05BKy8`JbEIA*$1nt3tCx`n`z4qm2vnbg+D0!N4lsfAfZ9kN
zR@^f{XBdIjVq{ox&v+p%4nE%m)ZPNggVaIWhBq@5K=NWoL2@7rS})RWuaX7Xt7OEm
zU7-Nfo^IM68^FL}#U^`M(elIPy|N!TEJ5@9j597PTK%}ZSMCLv&&U{ZS;4yI@?QBA
z?notu%X{S)f%ZFH-YXB<+rqS6!2x7e5VrygV}qrFlZmbUf9{3g{ZLxm4lJ_GyA-52
zWSOEk7@0tOutY&_=(lTf;&up=oxYcW0i=&ZfyIG)FPkj40*fQ}UUpe-#Suzd1vPLl
zV1e(GdLik+1d2cKzA^?Thu5IJN>WU*FBn**K;kbLSi7J!jQ<J3XUl@noK+B-<rjqJ
zIt8KGoxrrb%vVr6ykKCz1m$0a@VTMpaR`CLLGcK(o7;*Hl$5|26px^E@PdJ%1MEI2
zrdUWil0-{KQfTQ&8k&xzq3K8(oQ^>D^xHW}Ojl%J0H=qjk)0mE;k}n#wqGGp02DSa
zBpnz)G&ro0(gH}`<ydLZIy`XPLivkcFfbW`)W2Y0+61B57J+D}eDezic4!<kfyH0Q
z%Zh@+{RIOHIL*C~m-!0evvYy;y<lL`0@2)7EDRtsI2hPv!3hCMa7aZoY>#4K0?A#D
zl|KmOvqAZbpnN_kzZuGxgYr`vq#Tq$`Y*>y*l|a(&3eJWIDtc!U3PjD0~11wNdP1U
zQU|jCax8}>RILTKExT-kl!MgvNCq};E4HW?42%LGHQWv?QXuu09XMpUqrl=FXl6)4
z#2Gel?*yBnbU8};;PyxcE^aH3I~W>3=1h-bU;&9=cHppu*vaq%WDZCSYCcR{0WJ=8
z3rPRvSdPjIQXHW5hEgE6UXJDXc|nTfA%_(kl+XF|f)pp14+;~Ing%Hc@SaGJ9qXOs
zOF{00xdX%|#Y~WSU~?C+fWir8?xOWhaz{b_nI6T!aXCtQ(F=KbUl1R}hKGT?TrJ2C
z4N?xEv>3bINiG#+H)t<DD1Jcx2klLVs?h@RFFQc|%k9VlIzLR7Ly{E|m#E@XLE<3w
zAiW?nL16^ZBfFJ*Co9OUlR)y99XLRH8g7BZHkM=O1u2e&NMTobL5dR=wvwQIq?aQ#
zey-jL_R|Z{I?C0N@^>#sTKoXHmrSz+E=Ng&%mVG{m0cYve-&gN$Zb%!M{-B8-FhJ}
zw-=g@VBrvXL5jl>;wQOQkbj|WKo)-s5=S-*NslZv9JpS{%RU9A1yC9Qo!<sxL$lu~
zH5vk=Aut*OGz$S{W@csvmKJtx-?zCA3s`2-%pw{Y?Ddtw!0Qi#hEfIt6IUshuvf8?
z0zZRLLtjFIgoy|P6TgDMlt~R6*i1wi*!aE(HJFGAFz|~AbzCZu{KEH5D8fWcf`RXg
zkjJGG=`UQDnS}Yi2>J9SC~)vS5Sm~j!U2+t;dc<2d?_Jj{tE_%RVKpr|Fbr8J9vFz
zFi^^2U@!ySv#^B=)K_ORD`wCD-2(-Z<0|12=1UN2@cPVPkd+|7!1qTW<kA%R4}3oa
zg0B^G34r>eAaz-jML0m_ADw*Q5Qq;lldFVFL}|Ht3COH#^CdX0?UxkDp2{Hs8rQnE
zUs57_Du=?g{SpG%Q#d%3W*m^qp30$NBFgwLdkTjDXkBM^0|!I)R1SmeDI6AFe;5ov
zXND=It6l+}VF~GjGBAL`2+mdzn8vRm5Dc2zyi_dzf$yAv=%xMAe?e!Dw!dl6;5#88
z0vTIph~S?Oxf78?m?`Gcg8TEiCv)97UV4Dz`e%+7?mt{I$3wyFrC_${0f|fd<$qlN
z%yA6F2eI29Bye0S=6DWr6Tg8#{N?}hAFluBaN;)+2nN}Gt(bEy=xkK4{|pA%pE(^s
z;Q?ZsRWT^=>j=nl$8*W^{}pQB*AtL6t7Oms$#L65#LQ|LEWrHzT=L2bSQ5<lvN3?v
zn$5TW4_ZqLlDocNfFb)Yw}V+N0|$uD4OXjq#jKdY0HhWq##PTHY$DIV$5$@|zMF{q
z3zsnWG%m4A#q!M@VoWhycUVN4wm38)hvD_f9LX=_Wv_znci<}KiUFPR1v#Hpb}d&i
z*PIvfvU9Ib=5Tr;FWU>1uf0B*L$NJQ!2opj%cKPG{c1veDGH$TAwhj_DgHJA5&jkd
z`Ro5VIY4WfL1RMTu`<wlyatdsw*=RGrVx;uv%l~-ypWeW3JO<Hnp5s!U@)J;U;w($
z!$idXKj>a+khu921`CjwQUgPR*%USgByj<Vxat-2sSF%2ajwl=!XUQ!R0ai*eh{Bu
zK|lm7Hitn2B*s0NO9nJH47%Tj-$7u`k(dJwptQ`dBM`%HAP@{18wSNKXq+Z%jsOF{
z1thNdO$1^<av*V#IaxI#9LQk`k_V{;se$PSrBe_)YmNX1zY4m30RfPGAbF78Abkk4
z#TZ`5%e#Wi2Vq#+htYg51Y$sWlV3*2gYS(%48O2Y1iy@s&!rmq4}5<Fg87AoVnE}A
z*}@D8*}@DOd=CUBXA3hJm<Su>WD7G?C?#=nnH4jofXvPoX0T97YGX4imT1csW^gbO
zW^-tstdL+L%)!t+S;4|Ym=#1vDNkZkGoNFSm@UKLk<7pl0CS6S6Pwx#dHJ*Eb5t^w
z8`VK;K#qdcypWfFs@#}%j9)=uj@K8^8~{fEXv~^lLtru}Z-eqL$PADhKs1OSz``)0
zfq{X+ff+&@Fhzj*8jKIXGy_8elLNy91{Q{<20kVSMj92<L)qB>0t$={AP+FggGdCf
z|5N{`Kn6bqsX^#KW!e9z|MNla0Urpyd-v`ghz8;J@1CCn(GU1O$kqR`|ADFt!2{|4
z{|^Em_dV`|u>Su8>HA>^;o;K{GO5DmPu)ML86X`X_uBuE|G@u%{Qxs4;eZt3#mo)t
z2lyYze}K6LWFv9<LHhU~Kp@CA>mBufKyCox`ajk?m>ZZIK(e^32g!rXfY^=D`~P3{
z9*A!I`jO3LKEVEf{{sZFKVUw9EQiegj|2Px2O7kHAM$_faVYzbY!)&bWIta4j{%PX
zUje!Hf9(H!{`2{d{lwbO{Ezt`gB*h$Lm9&}#$(KF_7Cbme5iO}fq)+>>Oa^&Kz1iG
z8x-ypHi-0JVFL;TP^>UFfYK3!g*z45|FQpLAp?P6HiHEQ{K4=6*-8|4{lEHu1$+>Q
z%!Y`7NxKg=IGxYHzyNV!@top0);mCHwx*`029%bqcYwqovM5$!a1JnhVEDuEpW*+3
z{~!MU0mu5E{~!Jz_|Nc%;R6HCWP~t>nSr0dp5Z_9fByfFL}UM-|3CA8hW`xq4Ezkt
z2!)s|Sk42vHn|7lS_qlk1M?9mUt#Kmh~O@|P~{;!Oj7=z{lCg{g>YDT&i<VIIYtbK
zsgr>Ll-uMgWGrMD<QVu5@IR3GAOqrA$XLi(@LRBdVE({R!2se_@PA;(7ll|12c-pM
zj714p2z&UUh8-v!gB4>Tu<M7!05XY1D_96w4JsSe4PeE%i31D|7z!9H7-S%RW{_d9
zU?^aCKuqET8OqGS&cFxO1krE7Aj81Nz>YuZfi%K#0Rtw)7jAHkU<O+PUxAE;g-ih-
zIQRT7;IojCvEVCUO8`p~AQ&4M8<-D(N>5OV;{PE3L;eS-ECKliWF7(S3?MZiwIDqp
zy`UO^{Q;;1W<CHin~;7=<Wb`snFlcyCIaE1lE`@%Rfc#T!VFMsA$T$csC;ZDLfi(b
z0jl>D&na#I!RiM45Ar{l_b|@^!Qwg9dl2;jHZ$a9?B`hTu-;++K^~M|A21$ZJODD6
z9h4$}@c)s$BYVg4j|I;55B~xA2Nne|DD!~-0Dpu0Ig57%H88=78vA$h=djrgvImB-
z$rB~^0OVe<YZ>@3AV{3Kff1BDaTo^9Wep%-Gd#eAAaUjfP~OC$9WD&cJmB^kDBeJ&
z65j)v0t*Yc0s;(JIH1<rxa(~K#=)gw<`Uxvh$fKxAuMW;F#B<uB?B(@K&2&S`U97V
zprRCaFoIG)wEbgKP*d=y@J{iZa+x}r8kq`cW`eYcaM{n?z}~>$Am1S00COoOE&o9t
zX9EbyewhM@UkVtYX%bSR7ck%pQG|X5kZu_U8~z{sKNxHvJW#t1zxx?v7;G4782&Kc
zVV=V-!zUvnV*&Ly*j9*{AQDFafK(yZ9Q7aS;kJX^P#{ww11dpqXlIcBVgI87sqO*k
zFF<OK7RcatKiGbVi$M)fkW(Ij!Vi?Ikz)d<{U7XqK;s{53dlB05n|&H9Nseaf8_sw
z{0_x7_CM@##y_&VVD2R(hAfZF#-|@={sm<Zv=j$#JwQr6aJvNA9$aitT)^az*)TC|
zG*-K?xCxtHkQgHUgTfxtYJ$Z*NFH05fW%=K)Y7QnD_|@9SNyNMubdAF&MW>`_^p7U
zg2Dcu{6Cm_bQ;xukQ)kQKz@g?5G1-j7#}UYThxE3|4?9o&{rT+U{n929%uSNvL7iI
zfwBP@%Mi>z2kJi*RG`@i&IwRASQJ#$f2haV2?F~S#pe14^$);y!$m=AVE#p?L2_uS
zG4zAv(e=UjnEo&PQ;0I61Ip33^DoqwNInL;2#F6-0kaRC290gN(ikopqy}9dod1vE
zA4Z26RFYXRKpRCB74{$GarT}HcnV|+ED8z=9uyuZZYXD{W2j-MVW?v$XDDtcJW%kU
zpa2}VJaGHa7@)8vgh3&KrVY*o_0TKiYV7Lj>gvkh6`w0USJ(#<L&tCpXbec`g2)P)
z8kstoa+%^eg?9@66x5*B0%+RcT%`ENh%=C>1k?YA`X8t^LGl}Vn7}PWV-T{xcupmF
zSP9g(L(>Z8qUC>(AHew?JqE#wu@Ff1gY#Pj1E~E@eEkoKTU_ZDSsaViU?E5t<0Fa9
ze->~63Iq@a52`+3KLCPY%dimW=?ug#>;t94@^_##Sz}ir2NJ`g6)XgDImlv|eIUC)
z7-Tm{3?v6q16GWM0Lg*6zM%HIOaVw2NH=oGLD*Qdf`vfg4{axa+OTLXKS(MBs{yOV
zBtU&#%zg{12uKa4PKXGor~x(aKsq439Z-J<+~Wa_NPy~oP!%l$QH@E0&4xG=Cka-A
zsg(iI%PGKVJ{E0c3ZaG~bbN%U(Q#rewEtiaZTrgqvHt__KS0`pI1E7!G%RHSC<%hg
z1032>gyCfYxFmp@OrZS?O?#juAcO2`NV*1*6?ol`>;Sm^GSD^<*d1W~IQ#z${}}%<
zgGUUQ8|;7B|A6EcOcL21Tx`7V2l)_7OB@<XV3*<ue^4CYOrJ29g51R4z>l>Th`0U+
zWk3)H8SsPQ2d=gNs2sAX0F7^h6e2K4D;&#MSXdNTJg_`q-C)mP&tTnPdB6fRx?*90
z)BU*I4D%O=#_N8BQy4(uR}30SngbenN5x3Wa56#q(duGw*n?6bPEAM>$mtKH2ZHg}
zKS<ia?#E(3IR7Ei39=4UHo^1<N`p9Kf`Os<Px&8E`wh8246_&2ChR<@{~5r2mJjmK
zvIxKbL1jJ+gZdsYHWJ;y{D<)mb{kPeA>oZqg7ZHK`avljQkx>`Q+AyF4`dg>Y(`Ca
zkP%E|b-36N{UE#fz^x9*2pmKdmmXwsh)Q%4>VHt&V<~@-^@D3DEUf^rII=<{Hsc58
z59|#{vBhA=V8?*WXK!Hsz=*T|2+H5YU?eM1n05^I4D2YS9^(hb56C96H`p`Sq3D5e
z<Yeq+%I6f{Dg04@(|s_tglJG(g8zZs2b+ot8`yk2Wd8jDA80NbmwsrT0hKf0Islg6
zpftSy4Dk`>C<;g;2!qT=k9i0m8vh^#*f4bL1tf*!7RVR^*hOIdIO|W4zd`8~q@SGj
z2gvOpOtyZ=JQKJbMUMUK2S9CRP<~@zAV)vQ-7pLfKXACgVh~dP;fg=x@Pq3oq5T31
zI}irBfh_$<;YXH!NFpl$*^jF($5($N`=1>B$n9w2^@BnTgc%r+{S5UAB<+Kwkub=A
z2#iQI<mm^^t%61g8Ng%f(3ApAHKdJSA>72kQ1_$$5A!_cKIT6AzWRTk|2=L1!O!RF
z|JmWJ|Lp(O|ND60Arb_YR>=H^2Oj==h;#fAIsUMP1)=c|SP+B!L6&|T=@%B4gzQIl
zKSB>O3tax;3_s-bhpY?1CZHdx5afR-6BZ;;8mb?q{)S2wU{AlO=0M6HkogFV(2uGX
z8xNa)gh>z<q;vztA7UmKG@D!8KxhURG~*6g!vXRj2!ql;h=yVr8E}4t*n>%eTnuWl
zfqVoi$zh`(u)Z9O#?%QB`Oomb;W1L`e+*iKQ}CeR@xRCa9uz=f-2?0m2nGfQ#vjao
zKr_{l5MXWq&9%YU$TTQ4>Kp7KmLii#^)FfV50ZZ3%ReLsAn6CiAM#ujC~OJkA4EyU
zzyMK?PD0Z!l9k9zc?;0&y(PH)MSTAYp$lOfY2&x@59B|9`nvo-<bQzDkA;OiXx@^6
zfdQ0akX?wK4O-y^(FY@8ePiPE!%T&x5fC532DS0P6HuTe4R8N}<OyL=I~}<$A*3E%
z9;6?6JO*7J8y`G<%LbpgeIR=Pyx!oC>_5wMh368$9s!N9VABf{;{z`q<YVAt<KyF#
z;j`carN?v3^Vse9>SW$oo-6*B{13b=0;CuVhJ+bpodJxEjmDxCLx}Ml^Bi^yz5<yC
zmIpxj)$)MM1HJ-w3+6eDSl54`8&KSUtOM0FWVNeSF)&buLqk`sA|L<%ziJgF7+d&K
zOYDCG2$E+SNaufWUl75<W)gI{Cumq61OF=kL3}Fsz-?XR_(W#^{{VvI=|{L4!6L=|
zAea9G7XT0zepiq$i|k)yHpu7yKY*IC<k=6=1=0^S3E6NYHa?f**9kEMTbP2x5TOoX
zK~$4QLUe*mBNP8;2Cdx1YbidHL2D8J<6I$**I2M5L_a<o2*`omk6#VgA{+$7ejJie
zVSJ`T^y5>3M-Jh31PffApz6Vw{`l&_5Tjhds|ThUqL+b>f&V`ULcL2g1=7R+A2gE&
zc0)Z;cEao~;4AnCTEtopvJMi8AQmYYp$lRXsrEx%4XW-TA%WyJWV3L&31L5ig-tE8
zS;%aNt3f&-EMz%kHfm}>@DR2lSRm8TF|t|cZ2UUWO+w`(^g>t&m!Yyyb)oVgI?-K4
zJRgz<QO!i>p}Gc%hsbqc7P>w{d{D{B{2y!{SU;GBCI8|x2jYI>{fn-WnDE2pE{I-`
zEP@5%k%A%h4?Z8_mqQ9eEFlMR3B+~ellWc00A5dz*L2Wc84553T0whi@H!17NyvY=
z<mKPl|EsWptviR&6*l(&<lo`a1KMu|UOxv}tyKV;Lj$k4g7zL^>-WITLQvBR%^*;p
z4<Uz}g{BQF7i<>7UKAEq4GggHPtXz%*h+TLDt6G=D7+sG9wWu2A6Xo<m#6}?nvjI`
zyU6+xV+n8;cujWwo%%V5kU`dg$_Du#l0#6)1B{?~byTHr9!Mo<+yy*thB0pqnL7lj
zfonixfb^n{*_7WYzXNwa!SMr3{Rq9FnMhD1f_Ai_SqtZa#=BrK2N@GV=!dX~89xLW
zXZNH2&+~JjJ*Xi3{9OGXJDjslAoWlT8YZ-0umJ7avG`;0$MTNl9qT#PbL?g8W#oVG
ze}GCu72~4V|H%Kb0WaQ#tab;*wgrO?gZv+MoFl)eX0acT|6o&Lfx2=Q6nIdKsv4aK
zN;xnwTx^&;b{dpMAQ+?{!UB;X)gTcNjSa)bufZ#>AgirFBQTIr90tf@0nolCY<j_B
zX!FGw=7C1k{@CLTMfCAgkejKALE|`B$6djWhY>IvL3~(fA&Y^;31K^#`aRWu3czU=
znT=Z?D8E3HM*(c~5VvY#WFULkAbZb<QIDyH1Yd(D`r%7|Kx3&845_y&ENmdVFn2Kj
zz*YW%#$cgacOe^iEo5+Sl)-Q+Ec8ITEx==r44|?ILm80*pnZGTFp=6RRra4tgi!-z
z2%|8F1YsA36owE69|ji&7X}6fjs_TH2T3Af8wLjk3kDVj7KRF_I)12HBt;Ai4Cv}u
z8JHND7+4uNz;ovawKWV53<V4h3=Rx6VDpGm$KL=l4T2G7fmo>Ku|s{r)xgfcfMT-+
z*rzpM669Y_1}+9Z22Kq3$uTIR!Ni981|A0VCFT_jE({<HA{iLiK_~TrY;52MISL7b
z!WUvID4cQo0~8_<3<?+i1`Y;31`aSpGK_%%?0%4$8Vmvq3=Fu<Lxc<HU<lmif#MBf
zuMNmNaQN|K2^Ww$L^^<lGY2S~Q5=Y_4iaZf4Cv_!5_TY;fYTM&ry&3Gqr@5mG>l>D
zm>Af=>57nfAonpcFfp(&;5Uz-fdS-$1_q3HLv<e`12Y3F11AH21N!kJ==lg&x<U;X
zP;P^yd?u98V_-nU8#o;>a5V5k;{;V9$UH>6aWwEWa5Zp(b0(@fRP#6*cpG>dxUi@L
znTLp9kewh5vK^m!pmYz4H4X-Lw0J|<3rc?=b>JL{5zZic9l+%fDE;A92Z@gg1`lv~
zg<Bmcr9d#Ku*a<q)mONApq!72L25xFAR2*%7$6WKf{P`>0D|>kQiK6UqpJpmsvUzT
zg9n2LgB=4W11EzggB>`RpsF-r@M!R4@MJJzU}4~4;9wADP-#$UaA`n4mO+L=2@FLT
zBp4(ZG#FeMoEn@NoEdD;;*AZQ!&n$NP_4n>f$|o}jRFiX2;#9Ypr>a61`crT0V@YU
z`aq_GN-qpU88{fUpi_iecwGRpi-Vya93F&Rim(L~Yq;%ZU;qzJB9s%s0-1=a3{>jC
z{Kx?g8wCahaD9iW4ph%LG&nXmHMlf*Gz2sxG&nRkG$=C2p(<nG0LK=@zsMx|k^zW$
z3=Iqoj0|iH5>PuG80yjD*N(vvTu*`2@i8z$*^U@%7-1!zAcG=<BSU=yBLfVgI<US0
zQVKaR)WJ<-Xuvd29`2$zhC~LCUqKktzx7}rKtd4`j-VI=`5e_=h<{;bC_+udG!LQ9
zp+T`ht^pK6AitxBAHsCxI7Mb7R6tk=IS>ovN{lq!z|6qIV8GzOV8FlwI;{dNE+FPW
zNLW0<Xox5(i7*FdE~-3;$HySZpaAwIC=5aEHjpTc2C-on5;A@bK~U)1;J|<xejvYr
zN;Xid2o&1&;B*RN!OVfsbqtCO3JoBr$Y6)Wu7gO!Nr<hmGy|ovq<e&UATwcDkpbPj
zdT`!?m;<VFAS?%ryo^g7sCI%oj)8#z)qT!T-(rRfC<I^_5hfrJWYZWJWT0gfC<P;9
zNZ%KsmKiCB!E%}-gA%llj8Ny$;K<;_;KJa+P{5GD5CE<ZofsS$9MIAhEF92j^z`M>
zkO+pLRN&L#1NASaKO7no8WI`;8Uh+T8hjdD8k`!O8XOxO8_?~Ah98nSAhR&TuMX^H
zkQ~TIbx5&@@GFRg%{-q5Wd?ar$pumX#pvdN+6mag1#BMJHU$PbXo-cb+=bOG$Z-Z?
zLoI|-5FenEnEr*S0Ocb^Xj=i4x6u0)Fm)gr6d#~?0mTq{ID^~_F$ZJ{at?($3`#jN
zfFP*u7ePyjPz6v5RPKVxMNpXws<$9@7H0h+2d>j#bv}YdueTf+K=mF-9u#Vz@(0uc
z0HtiGg-}Wk+MWl=B4c#(I2c42lt6VCR3CZNfA~%dh(AGLN32Ppnv;>i9vq&|47O<6
z5cw>IAqlJo6z)k3F=*-#TtrI5R_=mA3W8-Bl;P$nGoT!Ok1z~cayc?U$~nyR#|G-t
zfl~ma6$y$J2u3jkiGyx0$Tf)a2;pB)eGc*~3?mr<WlDf)39#)DJ2^1QHINcE5CLv~
zBBulp8=Jk5QZRra1JstqNExWM!ED8DFW6d!Zw#PzGy+3JF-gMyh3EmbxM5*}a6d#2
znM6-7u#iPo17c%~4^W(d<d8AQeK0dXG_o8r8<d_M80^69I?VPONF^lHkkbn%10;?>
zvgjD*R}hVvKM<-x@{sZfQX(N_P+5qW0I|$aC6RcbS`uOs{t^OYF9d^f5h&ysvDB}i
zUI3(Q5CFGW(fb5!@Kh|pV8DP#Wr%Qrgc@NI;sptC?+8>rvN13-u)%qdJOfdKOj<Pf
zG`J%Rps}?YLK(1QRE3a!Hz<98`rQcEqK}tYz{`73e;PDy0m7iM3smz!{c{jTjE8YB
zfW{-x$9+)E1C23&Fy=S|qz?}w!S=#K9pXMjIgV-`$Za4Db00z-$Za5u-F*mksOEv(
z2Es7+A=H6f7Q&FjkOLl%0NIIsToh&}s67HY(;B1_gt3hig2wbfH6|!z5hHdGAA`g|
z7!q%waa&Nhz}$v8jtNl*kKYE422hxQ%2JRi2n=!`2t&dJ<T40Gk2e>vUqis-kC5?B
z?C}dS3xr|j;TjKvjK|tQ$CW|jb=(bn4VdGJsOoT!|Dmb_nFs0rpoSg;1FAaQ<A12?
zV7+0?@jp~`pjZQ$i8-E#stz<R1&KTKa7I<fkJKAR#2JW%st)8|5GE9UP&HV_J2B1U
zXn>?>kZlNzst)7_5QgOsT<Spng_JSq<Aj*zLDC<3{y<X)A0H<Wzi@TLj}jsL0P3|f
zFo4>Ki1sz2uZK{_!yv>!j5>&UkQN#!XX5IwLd+wq4&*9OeFZWLgmIZC!Jxu`t0#)w
z4^<&j9jtytgaCGy0t00954$Wv6w<aw@Nuyq{>3GW5SL_7LvZl0An^g}X<=gIy)=;c
zz*GYgK~@K{3enD%W8h!_VGafjhKL4rkR%i%Y7wXa4hl5N!vJpkL)uG_90ViLH9=wp
zq8@uY2jmYSjF~KSb0B<h?*u-!2TENI44^)z90O>K7roaC(gW53?pZ_nGYEB%_yCO{
z5FS4OnFLV}YR5wS0U<#$s2G$pK_Va;6@x?(7}UA~@jx`BZ>zwd&>+ZwxKj=!3&IW!
zx(q_#`9C2BU5qgmkP1Zn!eSRQenILWZid7gXe<GQAu$J%MaH050p$}=>s66Kkbw&v
z!szkD#=r$`10lD@K{gv88->JXWRPP}2G`c08H7LvI|c<LSr8MJ>p=Yg-2GYx2ADcf
z{NnCkBGeJ;_rT19gb;)Twa7tkLdLN4OvrsOb%fjp8=)oSKA1X)%OE5+_krS!g@J*A
zkozE|AY^0_U--eyBji4qI*7|4BsTXkfJd1KyAP(0Q1~%`=Z`@32xuGzVlVc7EhyC^
zmqU&WsO|%$cu@L=(4Y}9hX!o*DkL?)(hH)m1<FUr^%h8-T!SJ5XiU-tJf8xZQ31`V
zC^E!>B#|&bcrG6_11G|u&S1k}1I{BZ4DM*-r=U7hg#pwHBNV@|^n%}g2q(xgC^5J)
zcrpYsBr+)B86UD{aA{y^u!p#>!5U!zG+sd^9;ikn6n?PuhueK1Qy}RRRHGqd)Nv$;
zI%IhS8@V0?%|8*-E`fOo((b_RK9D+4t^lPgB?cV^C2$E1^0y^J8b}g~LFtJYe?aP0
z!r=$0hX|{KTF(Gck3YR2&udhG=Sx6y8<_JN3=E(#4G{(=2IO%c)cghsXY4Z!$oT`(
z&LON05-y-}01>Yc7HT?xm`7M0Bs>VKLk&MrOhZZ+(8vz5KR{&$G=3RC<IDKQ??I&%
zC<GzpANFxBh<_nIL?@BcGbr6b$}<oPWGbixf?=5J5j02@L_NeGpwbV0ys3i0fWd&l
zj=_+@puwQQkiibjHvq4)LYTw=9z_R@q${Azs)1^Ah$wok4(W#=n}Cb$#DIWF4Y3U9
zGhy}&RZwWfz=Z@+%|jh8f%GpyJvj7!EwV0r?Oz3k1dyK_6d8&bSQt1Ngc(#BJh801
zK~=}yAmX6V;K;zlfO(b@DE%=q$TKKHYaz5Na^MaFsRNZMAPky)z@-kPfuli?L5abI
zL5V>SV+9#Vo`Iph0T+bGqmnR_Af}?qA@d+<4%U_gm9faOAhtc&=D3E~hUkXy2KR>O
zhS-L<1_EnT|FiKj@`7|Tf*SS{E^L@Efx*MW!^41qp`al_-~oe&M}>z6jMEXI5YWNE
z@S)*B!v_Ww&JP6z1qGN)K}W}m0s)4E2_HbF1tbJ`FfcF}fQ<bEnJ9lS;lYFl3>FRs
z90d#v6Tr%#1~fD@G<;yFa42waU|{Iz2nbMMfXaX@ZGg!XG&D36Fcf$cfQ*JX6l6Z!
z)fNH*0u~Gm4<<~Q@PNU=!NH*d#t|?;$QXEV7$9T{IKa+<=m`j@5D;KsfCdP}3lMuc
z0+4;`QQ%Pk3LTJhJTf9cK?QQ?2ZoLtD>^zrGN3>#fGC5=SU5O1SU`fR0Tu=Y4I3sD
zz&H;kJXkOR#+fi-!h{4E2NY3o3<`0OQ^4gwKtKRof`Ne{;735f4~U3D!HNY18Y>FG
z$~;yC2q-87WJ~}nRtN}CNSHAp1I!UnKokQ43JMMm4hjn3*aFc4AQ7-K289&`1uMXY
zF)%PFDEt6LJ46Od8W;#bCBX}p!D0}?0Ni2W-~gKiozyJon6ctSM+ao*Gbm~x@y5Ww
zP|(34py1E|F{Ge_!+?VWt}I}}4*^i@Fn~g_;R9TzprheK2h6k|92_7=Lp)W`(NO@G
zDd^~^fa_sk0J#f<!L9@`U|s+@KtTXHeDs5X0pb>rG6w|#kR*r+aVV%n2Js4JtXMIj
z0qW3#j*cH49iUVIa%e{f$Zg>BC>RPlK<ON+3?$sq(E*Y9(a`Xrp#kdc9}Nu;Kng)7
zgZ0dSd9DN5=mJPefCM5a<qHT*fZR{gF=4@h1rwky0GR|gx&xd(p)wsOPOMllV@3zm
z9*~<6ZUZ?7(n1D>AS7o){R20;prfGx9-`p<3QCwD<G^MixjG;q0GePxGAnMtTmZ^d
z0dNk82UYe16wt5$DF9_<2M35x8ydh#RDc5%Llzuh02&!*U;r0VAls2KXs3V!Bt;{H
z3pgq|K&wz07(nF?JQf%j7%CbX8Xz(p92^xL9Z+T9l=%ZHW8mT7@W267Qb9}vD+4D}
zsA-T8Wl&&9P*6~SxEi#q3+z--2sbn|fMW=(-9P{gAYNc#V7Rbi#flYR83qQ14JTj;
z3G4z`h(cvRaRgSGF$0{oK_LRt)6f8kIgp-)0uD$LV_*PfT0}^IA_C%523U~`Hj9A)
z<N!z^0+NB0{SYaz9<Wat7#MyCC^&%ghJ=EGf`fvB0;ul<Ns~~LAwfVufI~n)0Fo>j
z7y=eR%mEcuD+0g}BmgPaL6Hn9uN@p59zg2=21t!z;1B_-nLuIw095*e%3eqTNtzyr
z$Dmakq_{2c@Bo<xPI=&3rh<VXp<%;>1du(DS_V|cL*${(0o7;*4A7$90_rw!)#d@I
zF%l*e2qZ8-YbFQ>RLEH{FhDp49s&v=d%((|^$$b_TK_;e6%GZUiW0&xa3}zU0fbWl
z${h&P3=lE~9u^!12pMoC4$%Xxj369nWdz|s!vMko)xmJLfjE$o6ckNhtRTPuE#N@)
zKmamFfB{mBff9v601}4*nWGTE04ce^83UQa0j_tzwlFZj3Scl-0KAt0%w%9-K;|H&
zC<X=v0R~VCh2#>203;5BfQCZF2Ze+s;1mxk6JUl3D1g!$D8Vu?Fo5eYkP#K&L~a0X
z5J6SK3U39lB4|mWAfOPifT06kj)I+o$g~O!AcLVr8i?Znt0Wj0Itl^;3cw|WfQEuX
z1<Y-r_EmvG0Ys01hXTkA0-*S1V31G%i7UWXw18@OaQ&_T%B-*=4Z`VwlvPj;JU~Dh
z9a5x$Jpt1L;Xw63IS@Ty4mdzS_jQ75c$gjsFbAp!%7N$sb6|QHklhC1K=nX55ItZH
zOpk#9a;gFufG9^zJR%}8GCVebBc)=&f)5K8EZ6~RW`bH7Ft>qSjnKouz+mDLkpa;I
zDta_37J$<Ma_R-U8m<Q{18X@TCnNy{)O5{&RK^>4On5M%;{?baP$CC;2UOaFQWYZ0
z1S~-E95}haT+P5x;NkHCQXYZQqJ=;KxDg0WmWV9lpn#Nr1QbA~K^+Q`fm;f(2Py-x
z2gU*EX(#}vaE1VIG(sy0a9#kJ0L_{m;9?J?0uetTZ4VqA3Ooux#WXk?pgb^}fq@|b
zR@#FECQO)cVFkE0s(JAuLqkIYoOvN7IkbQTDTC)ohXW2C0R{yZDg-PT7{DBbf)n7<
zk^vG<puz=IuYo-S<uGUjEC>J_462rXKmf>C28IOz8eq?Zc#u{rR8PT=6*Fe6_yP7Q
zND>wQ=MZ27mqv`BX-P;6Ur0zu2-I6*fHup8gye)k(||C(k_d;064)3}v01@@&bI^A
z|48yON=jNXpz&k|18`?cNJK&eVjhEq3mE(ZI{}m~K-~>K0UjpE;0UA!LzoAt1?2=}
zpsiyU7Yz*o282AwJq`>Ac}VFmBP0X057Hy!LGvFU3kwTm!UR%5fSM_wZZgO{ph}a4
z2SuJoh>1r4Szd+-=3a<?5fM2Suy+}t;R*LI#C|0a4se@}0a_2s2+0UR{0nifkdzoS
zyg~k{U{EsCQi6mxL_b13M4nGTKmg)?5Z{3T5q_XL+X9IX=};o%Ar(A=4~{fs0u&S=
z4BnE(zyM9v2o)+Sbt)=g0wN}05fWe^ArfK%jZl>k4N!kb#mfaEZ{Xn(pb*g2(o+QC
zbAU@Q2pdF#6e}nw2*4^u5Q_ucr2@%<ut11KjYSC5cu?sfAn*^?SpvyJFszFM=AkdF
zhLxfW3=AwRV8az)ZCnWzC#R?=Cnpt96A!eDPXd&dIXE~V@xx%_#KgoSpy1#DH50^_
zVPax(0xdNHna3ld;!?-L0*!x$ItK@b8YFoeCkKZbCnqPE`Z^{is0+X@Wv~HBA<2XI
zc1ZeRP6u`4AUeR^I|jIaLG2}YpAM{|jsbaPxq<)(3sRti+|R-x09%^FVB_Q$6cps+
z0COM6{yLC*oWN!=fZPtkPM|GZpuLe!pe*SCR}Yp0sfWsg{SQ(C4KEPC0>p<lwm{+G
z;0N+F#C(ueWcwh!J$R>?0hCoiq3Z(eML0RRcmx!9xHv)G2R0f+K<#sKN&`iw6HMMI
zDJdw(%gfCTsvhJ&kex99g4|yN(hqkZSk}qQh6TL+2P_|eun**Z8>ILFB}GtvftF7U
z5Zws>H8r__$}9~O`KYKgxcfj!50nU@?gOdU02>GiA8>j>PJfVQmx2N`{lR*Su=HmG
z3M>$Y$_r>fGa|$|WD<1t6)1Hei-FlTOm<FA&`l+vpaF#eEdD_XKw$t2KPDz7kZQPk
zh<qJ9eaI*&fSQ1?-ZMy=!44Eic1%nlC&JB#`k#S8fC1cZgvK`mXfGJZKP)UPpezbf
z@8S`V;R00;%dW8e3bNqMBoF|xAUGxoWFdqNBEe|@WI2e#z`y{O2PFb1-^$I&$qAGR
zq5K>pP@qFOpgiDU1JD1U0;vWRUy%9}tO#TqEc`$MO`sHjD8Lv%uA7ttl7V0+6$uFy
zsDD5r5dDzw0rBfV85o+rc|dk42nYy(?E`U;F$04EsQ6;x-~e@%KzbRBe83cp&<cS;
zu!w~NXy^`P1hjqwck7juL_{DxZb;XPM?ehPJ^(e=3K$Ue5u`qW=m(`Ih&)6;m=7K&
zgy;wJ!RABsgZPksE26ytsjp;&grN1KhlhcH0JwgKxDV1_My}sM?iUi`fu?_mdlBs!
z@SqR_#D0*6q4Mzh8Pcglv=1PBMEwup^9ZqUK<x*2LS>j_pzRfiJfi-G@Z|(h<#_~T
zpy3CVXJUc&2qAnPAs!TY9w9y^aQuSWPaFmeJn;4yL_H+@K>mU75$yp89}#{KKB#?!
z?0yg*DLsM=f?xp-aD@aekU=6GBB*=;4sZnrD$v2{Q9uKg&!B?J7tmmU73h%sjK)W6
z41l`1AZy_mwRg<G0AADumt{at+@QWSIP<{DUjYqxfeg*>JVF9C0yY8#6Z62vfYKnC
z0VN>m0}=lW3`}f%a&~fjY~b2}fk8qA)>44z0F{NHGRetC02-wX3?MNG-^ho-2~z*S
z%6pKL!Q~A!zY8#cG7ktt%meck5cR90l8lm)l9G&)BSfA@NI<|w0PcQ<CKnBX8UauV
z1eTXkP!Iq)k%I*i-VE#<0$^Eq-<pBL&eOxg(+-lq85lrO3@X8)<vp11ROjFT;|pkj
zlK`x|XMhDMOrAr40lB_l0P&IagZZ%d05z}#AW;I-4@z>#_JjDy`oVl8{Q?}Q`WaME
z?FaFZ^@I6H`WaM^^h>BnfGPucdIy!}8j$)2nm=rv+`PPkf|8u}fWw!;-owMA4pi#-
zL--sb9BB4)Kr1kaJczV)@+*Sr2l4GV?L9of{#OBqE!cW!dH`hsaQz3iA0iJ<(%|$9
zbvsA^%;yk5&2J#nQQa@0;^I-@;o_1K0g{77CM-Olkpp%BNZ!Z?;UEy70i4B<;}_Hx
zcm%Q^+TLSeVh6<@w0+AVfSTVG(D+dMK>ES%hea;TJy84M@=*KXd<_9`=CVPwzZpP6
z@cNiT0HhR*!RD(lI68tmU$FicxCjBuL)#w~0s=BZLNeefG>DI30$?7be}yRjA$&yt
z55h;3|B(6*QJ;VfK`LYv5|mUlM07&rp#4uUUqB}aR=<GLk{wd}9h5w6kocTJDjq6A
zoM3Z71nA~GFa~iL7#Kj3LMou?NvHq=IRC?MC8&#v3iAt#iUJqkFePyMg~I`8IR_US
zWsHWvXb4a#1T_3YeS9<-7(OrvuzX<P|MG!>|H%gi{wp6C_>X*G;NS9rfq#jIqfZFP
zx(|#=79SXsD?TtL7kpq$&iKHXobZ7$IphOlvPTx@v-I8R>soE{J{K+Z|7sP;7gRr+
zHKRwq`R3~A2WKTu@17fbkagaTq*<C;W;IvYCq^<x85G<V7uA1r<2zrZWxBCi`u_vm
zhJ9PS+A|_V1#k1{@uvLjU+%uuLw4UU|0N*vKkqro0kWgz)N*T(J^!Zs&<5ERFKhM@
zWZ&9nO&39SYTM<=gY5n7xHlVQw{V?eWxA^}<NLF#J7?^=^H0Dir0npehaWyLIHkA;
zIR<!mItObQYBGemJ2C{j26;OA#2e{Zni&}AS?J~E=cR)D9uRB<lQTq@3v~4j1*!24
z^MxP=28Ps<Wc^eNBhW}W!v}`Y8z6pWdWvp-K~ZXYW<I#B2NO$5DbCd`&a47i1QJWi
z&o9wUOU%sCEl<oWVPF99^NUhaK?7Dvnfb-K>8bg-sU<~~pgCfO2AdBI^$`%<cn3l^
z2ta6%cq5Bbett=2Ub=#lbC^O(YFTD-s)B(*hJuD$PJTf_r6vOwc?*!dhl`6Q$X_6N
z1(17EQ>+y7@=FvF6+li(Ov*`BNXabD=Hg;t@O26TVTAz4pb*axPk+Do5Jx8;SBBI)
zkg^npl+0oXgMop;x3suKAuY40xJ02SH8;O3RUyATFSSUIi-Cb5B*0f87a^aNssJ$o
zB<Yz~T#}fRlUS0OpQn(Y2GOOUS`3o=z#yPwP?46FYybib3?O!z1v1;%05oC+5eKP)
zs!2jpla>ZkV`yLk5%+Nn_Kf!k0Jn9)>`=#`5U2o{AM6ZQ0OtER`az``Ap8KBatPls
z)Wy>uq5>=*5Nzb_<N_9e@qPV65qvinXHXm%R6u+K^+Re3$aw}}KcuD@8W_RFLEeOk
z8yms=lbT`-3Jj=vV~GDl{k;AB!~GOM-V1Q{j8`oPVBqrfcX3uwEmlZQ%*g@8cSb>?
ztwDuqg@T4^v8F<P0Vwbx0*OWGMsSufgvC&lT3nh_0^uYUrJKT8W^k4{n8n2a&LhPc
z`Q^Gvpah?rnpX-D%PcB1(9JJPEh@@Pf#r$Z#0uTyg3@A8Sb*|KUTJP3NI*9?5j?E`
z7t6~}NiAkzNK7us)Gq-gIn@-9p5k0k&e2cHOwCDAP0<AlLdBq}AYveMzyi8C`H7G$
z2XSX=QF4BsZb5!g2}4<WVo`o>v3_xSBFIp^q|7{q4-C2q`l&fZ`IWi_$(b4X#U%_3
z`YD-t`3NpUL2{;UQc-3~dMX2hYB2+Yj%o#izG|_9Y6Sy>76Su=zLtZ5zLtY(1xNzK
zPbtbQOLb7K&<Eu*urg3Nt>ft7?5VGsVg-sO#}G$d)f5Gf#G({km(1d91r60w1=ZwC
zr^=GlVoe4HmoOK7XBUNNG(7>HAYBm2SWx(Y{GD1+Qj`dCuWnI(en~L{XqDy%Mu!O>
z7@cN(V04-Dfzj^92S(Qm9~j+joLvkI3>jU06hi!iJVX2yf&*NgJ>5K=9YJ}YfdO8o
zq!s1oDmc3+1o`_y%N_;>Cx8DC1!u<)M<0LiW?R)_aN>fyRkc{b1>|#(|5S?=REuLl
z;e{r~z`&4GoT;E%5TKx%Vg-)R)ZzjZzHe%JVvwV!i$bttu!2T_vnNPaQ^Cgts^bI0
zl7tToOA|gYY~lF8u$3XVpai4>D$Br-mt16SXaMIjd|>pt^MTQO$p=P1mJf{nIv*JQ
zJw7l7Hhf?V%J{$-v;b63DrDwmmSiTDq^2l<y{=lo#SomD=;Y}itWchqS5mAH92p$q
z>Z<@!tOqJNA!)uSwK%n?EHy<pH#IlEs8TmIFNNU)gM!Tm1_cACek%pv#N>?3yi|pP
z{PNVI)D(sMv^0gX%tQ!Zp}0J=BsoJNskEddKMzzUYPkjl`3Gq!WacSAjnK^~C`i;T
zQ%$krQZ2SpP2pk)at(G3!RBZN2JG$zYtZA;!VN&hIKu~qQ!F1CPW|}6aLVHY!-*Lm
z7*1Y+&>%J;d@APy!>Ja(e585?TyKGV#lV0?TtOiSR3U<Dxy(ET)f9!|)a3lU6mZqR
z5R?ikU^4U4^|(;eC8Pq>(?b^r<t7DCZURf8>Vf1Lu!K{7ehIu@bj~l$Ndec6MX8C<
z$ai)DC3}tJ{FGD$RRfa>O)dsRj`0itje~;B0J$2RSc3e0!3HxhFa)I*mSz@#WD*sM
z!0uNl$yZ2BF3BuQEJ;-;$w*ZQ3Gju42UkE*YH_iGYp}CIT7D5Y%oISSDJXe?@^x-;
zQG8lzVo7OHYJ75jUP)1Y4g*LWTK+*O-Nd})jC@cN1B)EEL<E<;(1gTbV4`nesBdIo
zXu`k{@8atjkCa|C%2JDpL3Olhu_h=nz>;lfsHcm9s)11jGS-E0@GxLXU^KMuC@oIX
zEy>JH)h*6UPb?{60NDld7bv!MK>?tfn_66)2r6#DenN<6r-Ir}sA?f?t>Dz0)Z`LK
z7(&`gR^UvknyjawTFk}3RiXz9cm?PDytK^p(jstUgo}Z}IWZ>(6kDEtAqs|;84Mp7
zUMqZHc(dXI!<&!~3~#pJ%`nhFwNh|NElEuVl^rETi3JMEsyU@P3W+5O1{JC~6;@zU
zN5RuG2vmXQROl#p`Ufc_rlb@>_z(qL3=FEtp!WR7gbxfKe|%v0xCV+}K<j%&P<ao+
zNjZsm*`O9&K~7?&jsgQ0+#SIsiA5y}0WQv}DGCKe`N;~Z#Tu$PDX{uqK{Y2u0a4TE
zR46zGxr18(ITfHnn}LDBG05En;w+FHxETOZ25tvHnBay$P6a617`Osloa3E69D{>B
zgTWOW*ghQv)ncfi0w@%qYT@p54hU6EQAo`zNi8Z?C`!#sNzJP&%P%cf$jQ$y0A~&^
zEiHv`#~?pXKX(N!Eh|_-Xr&OEmzi6TlbQ?CoC5MHA&;s;9Bph1VnF-{VmSu6n}UTL
zgWSzv408|z>@SCW$TZ#uhW{QP7``xI;{OdF82-=r!0>+!MDG6<2#utckwFGUjFG_r
z%K!0!;j7OFhHnfX7`}6SVEEzkf#Ju64-7vIJ}~^O_`vXM#|MVrCLb7n@A<&+#|5ef
z<c1#~82(K8!0-h`e}T{-_Fsn&41Z62VE7MG!|;LO>mG>QcbyLm-wZx5d=L4+@O{k(
zhVK`k_{9f?A0i(Zeg}MD_}%h>;g8G*hVKtPF#KNgf#LU!4-CIS=0nB)XnbH~0J+rw
zViw3eESQmD#Ro=)EpRoA3@INN8ETY4K*2d66jZo-1UM>yas(_k6+---6+r!};*!)N
zg_P3V0tJwAWiAE=_aIdRBT!Qblrj;R0i+)pgCffrhuYvE11n^;*w`Tbo{oWFb$Xz5
zp_)?xrWF(dg2TbWASDbz0UAX{ng~8bPlcXpg@P)WgsHFKLa42Pw;`+)f>Mi9OTgW^
zTxe?`F%9JF5PxS-f_E}BGXT{qpoK)9DLJX2wQY`|S|gQ#A;8f{57Z$Ia5U621m)2X
zM+UcWPzQ#A0YWk`gyv=Em*+7s1pB*z`}`h`LE!0HeNbTuYCY(?q$ZW7`<Ip!l$Hd5
zTEh$sV7au+qTKStqEy}7%sgFa1;D@nFH=DMJ+Qn&X0ZZPT0u2M2h?0a;)7(1z*S#r
zik?D1PHJLtszPZ&N@7VW$ahe?!0v#0pMinF+|U%_hU9`${gRxd_|&|TqD)XP09ie_
z(WDD$9qEEfO@{n}5`7d=NLLeL7TAuWl4OWdh}x9o_!N-u85qF)<ovwi{G3#V;?$zd
z#2f~O^rFOqjLc+kJqa>9EkCaWRL+9fpdLYH3e-J?skx<C!U)m8ONQ1isVNHOnI#zt
zCHeUZIhiFTIjIVe_Mrl(cvSFp($rDN&CJWpEzJdmoN9`KuM?=&N3`7n9Cd>{gPj#r
zQ*@IuOBCFov7`_Nt)dMr6*NHO7Yd-dn#-lMASbl~RJnmXrr_zX;F4MZE>=qvoI$M^
z4N&(`Q=ureEE8PA8(MO4G3Zhia49HgBx@=-=ND8KWu|A8C>R+Sn(G=F7?~<~q~@fj
zD!8QP<fIlU*rb4IhxFVEy_8ftg~YrRczKYLT9%rVUyxc<tj9%F$LWF^0}2WOMfu68
z#l`tW3JMCr1*xeipy_xR4lV(;&|o|TkWb*sp>ocN$r-5%!I@R5TnY+s2O^jX2qs(>
z#K0nqEW`!cEux^Hpjxa7b&-*&fr76`705BF#UK&|yOri8gZlG{Imp5W3f@lOvI^o?
z*WA(^aDN7x;jF-FJpw=#y#_Q{sTOPMz>*lK)ljTj%%z~<SeBTX1L}f96D>riYEG$w
zuM?Mof_r{`3RFe`mglWN#k;Q)$Yurx9R>ejV<V8C0*W$o6N@S#&9Z{Tk_@m>s>OP$
zDSE0YAggjpQj79H;SOr#DL|DVDR745RhSIe51@eJQc&<ttxU>KEJ{I@Q!NHN!Y{uh
z)k?uHU!l0P0Mz+UO;G?9l?u>yG$<kF7eR!;HbdHs3TgSJc`2Y0%dxa1A0z>48~SAC
zl~yQZrxxX<<|veBWF}`QlqZ7PDv2qnDGEuI3ZQZU)Bym;BO>%b`k|fYVk@v5q|^ra
z-arA=TH<1WC36Me#LPSe-_*QPM7jc{98xhC7c__zobz*YL3s<tN2gs<i<65o!Q(=3
zJy6@wmBRT@c@PEH<K&-Tq7WSr<XPkB6H;RXibA_sxDEvcP)`Zcr!Fo?P0mcqOohZ4
z+yD>PoC1Yt8&JdFuEr)A;%p=%Tr!J64PAwd)SLovM+u}-A-_lgsuXSzxQmNqGdeRU
zwHVw!26e)UD~n4~bKzQDBRoUUl_T?AD>6$Iz~yZ!I9p}r=fPr*ivb>WRtm15CN0ci
z3U&&hdO0t@JP#(Mqfh{;8%v5R6%x}EGxH$DK7%JnV`6d%q~7oh@KMl+)KT!$0r}H8
zF)ukaN7LR;0o;cMrDI4Ef+pHTcz%U-BjHsriZ$@&H?$)TO`D+P&cFqVCQxDrcW9B*
zDJWrs>;(-U!)hgP%FfJ9Oi$HQ@bPq0$W2VoOa|3tpb<wMh2jiwr#dNB!Jq;(e5uC;
zHy>mg$SPv$C{trDF4bai0!jsC$`6c*KRz&~a(rM+IPifn`N{{zB$f}1DPKM?rZRkB
zOx^N<G4;j=#y1N-F!JeqVC2*Iz{ux<1%u>Z;vhC0gSs*S{^9X%j-H^V7z2n8?ZtrE
z0iM2K+SlL36{G+x@96B|3R*Ak;tU@91&jFy1o=BNfYpNPT~J#BBp%}L0u~E~46%dR
zeqsJTjv<~tFf$xoT;jtVeLO*pH;^7rzu=G{sQD06A?7;y_&a;YhxmXd`$6hJED-JM
z3UOmVa5&g}$f#AkuVVm2AE<p8AK)ME8U*1x2RR0N#0LbqLgfP-L*kuXeL&s=>j(28
z-Me_uuph_{uvkDST;4Uz)eqF@gvkZCK+N`a^#xlD5_feC2=e!Zi2H>>+!*ZY>Jkqg
z>w<`T`a@`^Ab&>}XUE`>cyNve+XEV&4-Ns3QpSS<2V|zRhpV%9e2}A`yK68kjQzsm
zgI%3NJpKKG!TJJRgWUXsd>#FqUBP^4czF7``GfgEE<s@0(=Q~*(>)Xv4Pbt7h$ol^
zjjwz9xwwKBJ%H>Ca`o|db_{{5^Yrr!@pKIFhsBYPr=K^-E&gd~3~q^~IiQAQNGfPl
znSsF*Jj9p-o-hi|C@o0=x7ZmN!V`<~GV{_If=crk9CLCM{6Xz_4@Xc_pCQ=8(a6+{
z0Yn>Hn1E?hLn8);U|(ZhkVLSDBZL7O#{sdys=(@ub-^k@u3=zEPfoT{&~SHl)>JSw
z)icsFQ~<Ti3@i*R6f}ZTK?Bhx3eH9O#l=u*T|-TUq|Ch1lFXc9D|kcSNYBJX*HAAl
z*~Ex}fuT4RJdO?>oHVr5HPB5@F-S2swX_6DGkjp;4Eeysneu^&v)}_0XT=95&Xx~M
zoD)7UanAU_#JS`H6X%8xOq@GDFmWFFz{Gjw1LN;EV9dn%<O37u2Ppf`2PQ6_4@_Jl
zADFmgJ}_~qd|=`-fyi;WfN7Y%!9+80g?wP*N&&l%iL2rR6ITnEjqXM!t|?f>(bWw#
zJ`>l14@_KZJ}`0Z0Q--L>j0Pr`Gbk;!Ura<8(=;Y*P9Pa+zb#lx5x)3Zj}#A+$JBG
zxLrOlar=B=;*R;i#0?Ec?h>#%kQt<4CT>XBGjUHTNG!@MPL5AcElJKuEMi~)br<6c
zk~8CzN;7j(;vqF^aePi@aS20aesN+!W^z1u6g9p$wWPFw0W$F!4>bm=oPmKMJ2kZ+
zJ~1UFK0P%rwI~zR;RH?Cg8P)<RtHQAtiR2`z)+H(9G{Vxmy(lO#88lu40c9lUP>xx
z-xZi&Tn-k`C`e?0S_l#b^^!rupfIt_{FLN)SHF;;NN9ZkRf{a{8XUraMZL4XpPMIm
zE(cRjFnID5Qyf&{!Oennq2n{b^Ws?4g4ec1HC4{cyZL%yzx19vr;-j{1Kro?)TKY;
zy2d)CLUWgi%I{OpZawh({2O0u{g+#BFKz6+y~i@_Q1oYytrn3V1wU?My&yTszG=yN
zN&nfaW#X>h%59Xm!M<w7VrC{Mq2_2t*Mj_gDu%85{GM#;3FWCheD(j9M@9Q$OFmV1
z<~Q8i_|IBw+Q!*;*p{mv7cxCK`(w%ZOtmRbW@jFp_tERp`+e?h7XGS_`47%L*4=Y;
zs|wG;Gv#aMr0TxZ$&b`#D)lO9S(Uf!NpsAGm3Q_!{=QQ7v*T8?VDQ!%c7Z|f((bQb
zVR$T8cZ-q024?jWGkz=D?~klMzVAKXlVcCKKijV8KXi5ZMEA*D%T?J<B?mrWZps(Y
z)J*5%%PUad&eiI6N&k<Yw4z0f+DSEEo!mcBN3`AsTks0cox1scDpzqx_xj{}Wm#Oi
zZOS*TXgqXM&;9MXXOoI_T1A>ntrzWovC!uubIJ;-H19o528@Tiy9+M-m_G4%PT*p;
zkbMRhC%uro_C84B+DtZ;(A1RzU-(R0!wVI(1hN(s8125eLvqPMu^pE#oRBlm;RtkG
z9jxwA?sLEI^-Plud$vBD?XkjAhG+B9lTpcjH&%H)cI-MGJ?E5vdGh1p488o%*Ea1~
zT+-k4F82MVKNU-p^PR=@6IxDGh%EfDx~S(k6Ngla<(mon{{K==meW`gkn{Rp)83c+
zelGsL=~$)cvBHW^kBfq}PpR9Td!?2*=VIHA<BA6kvA?=id+qFl*K%KL{p;W5U94dH
zkiM!&JbxEga_!MYCuS@Yw4cGU?<em%=|XN(VHtO6joam4m04<Aj83htb~vsw*=F88
zF42?w_BhL?ADJV->*I6u%D&TfPTL~uHRt?Et<#D>oxj@Z+OIb`E|NW7?h)dk^ao0N
zpmYaHbD;DFN^78W21;X~^aV;=pmYUFQ=s$&N=u-01WH4o^aDyepmYODGobVWN-Lmr
z0!kyG^Z`m6pmYIB6QJ|}N(-QL07?U(_y@&3DBeMF4vKG3T!Z2n6vv?W1;s5WUO{mR
zj?bBFDxi1-#UUvEKye3(H&C2`;tLd4pm+ks5h#8@aRZ7MP@I6`0~8macmTx#=;93q
zW(5WY<^~1^<^v2Ln79{wVB%i#fr)#~2PW<<ADFlgd|=`}^MQ%`$_FOy8-(h52Dz37
zMnhc&=E?004BUkqKzuL_Vly<fF)$Q>@0bO(Mm{jOb})d&3I#xA0jij$1VYS*2coV(
zfPsOL5hVVB!7>3NRw#%p29g6|gqVU31A~AF0|SE_=oCJX+y{od7Kj+=wssD%dmv&U
z_Z13*)Ii+gI0a&drU63CNr8buAe(`KL7V|}neG4o|35H<J%NfTp^7!MLG&?0?MMVQ
zA3;W=U@k6hZUz=cP@VVS1B2lf25u&W4@}%IJ}_whVBldf_`t;d;RA!t1O{FXhYw8L
zKRz(%{9q6gQ1}2{($Ao-0AfSdUu!rRd|=`M`Imt~v%%p56Ax%8nZeM=*u>P#+`=+3
zDLExIEj=SMD?2AQFTbF$sJOJOyrQxS>?DvGAnd>ZzN-kdC6JE?BmkCW;1ghA;4?tt
zn=ml&g>ZlZ7L55K7#R3@IGDlL6G<>I@Cz_7@LNFTK{u$`Ffa&caDWbl18vJ;5CFxE
z2f{o79|i`21SEb61B1W}B>o%*27wDm{3{F$0w0k0Ul<q!H4uD39R>!$DIAPo_i!*U
z2+m+&5Ile+e}sWS@DG9y+EOZHg2cCAU=Zp+;`cBx2(3ZlZ(v{$x`M>N!N4F4-RJ@e
zF<}V?24Ne7ys!fUgK!7JJ;FT<45B$4++g<!FffP~Ffd5Y-~b(B$N)NCPjU_egA{Bd
zBLf42ln4WZQ~<&}sSpMRsUy(v<X~WsI>EpotpN>x4h9Bk9R>#J6oh@!84L{4XAt_O
zFEB93SRmBP*f222AcY6$J_T8%_>uKtV351R0Xl3G9Di~T7#QS{(uceN1A{!0|K%kZ
z802>#?33RE8VyA76;v1)6p-QzlvfpWkmL;*7!*M12Nal~GZbt<Czl|}hcGZG6d>_S
z7#I|g;#c7a1A`)xd5Q)M3`#8=pkwO6?pNwyU{LBo=vSJ+z@W4NiNA$`K?%wIN_!X>
zlusbSOZf}~gGvtv6D<BzCNMClT!DtS00V={4F(3)9w=XefkAZw1B2=wg!!rm7#LJv
zAo1TYFsMZ!_-Zi>3~F1T`G<pnL2U;EgW3-y`9BN{>Ml_8IT#q!JwPWuApEDn!oZ+0
z0qQ;u1_q5O3=A3|`#?s3_-_~(G(qVd#Aje&(6nG+(EP%|3iFTV4+aM95Gdb(fk8Wh
zfkCGSYJLI(s7zwe`2w|HfPq2h2Lpp{41%wlz`&r3l>c;RFfiz)K*LXffk7{WfkD3k
zs@{QtLB9pG!VSuoU|=w)VPG)a0JYzO0aP|J7%4#I1sE8NR6xfSaDXm@1jna|4+Dc~
z57c}M1_sj!3=C#S>B~%qfx+wuR9=9A!R!PBgV_zJ=NT9n%<eESn1RX@sF2wg1_pB(
zMEIL4Fff?AK>47VD-Q++^Dj{II2ahre=smu1VG)#!N6b<!oXlrfyA$2V6cpVsuy4Y
z*I|}O;bS?2fx#*PA#at!z+i0v<#RAFSeq~~SieEye_&v+nF9?U0R{$}1q=+fNa}4(
z7#M7?AmZQl1_OgFD1Sr!2ih`XcL6Fdz`$U4g@M801PACKHE?)3oMB*aoB(yd00RT4
zK6H|Ss^?%}0M&&~2~c?uKZSw8*#}x42{14?2QV-=Z$QX9Z((3?$wA1w6fiKjBAMr^
zz`)=Ns$Zb)b2VXLaBYEd7#P6q1vgmvCcwbpro+JCR)dgtYhYk-TLFz94h9CdH4F^y
zNac~c1OtORs5}R0;b35J?_pr@fTbr6&|U`y1`nkA#$yfxgJ%ySJUk~bFnGT~lz-kI
z7#Mswp!P8^Fo4=Az9xwH@U>uI@DqT>mjDBUp9lkk-vW^3kOIwb2?K-Q8K`~^1_r+i
z3=IAni16~)VPNpDLE<+sF!;mr8wUe}{|^R+fIW!#2spsN5D3b=AS(nI7y?-s7y=uh
z@*sW-14G~)gnfYz7#M=4AmSrv1_MKA2GqS03=E+;3=E;L@{EIlA@l|VLzoNHJPrni
zFb@WXFpz&h_AxLpge_rU2zvnKfcQ@s7{X!hVPIegXJKFnht*dC3=H8X7#Jc{p#BqJ
zV2IFQV2D6UZxK@%7$V+4<vAD_B0exMMCL%<FTlVMS-`*$xdY*z$UO`UQ6>oWQ5Fmg
zQD>n3;b35hy1>8?4XVFEP848Zh~B`!5F>+7AEUs)5Ch8(77PqAR~Q&#LG>?GeXIxr
zLu>?8y#ND4YzzZK><@(bv40pC;t~+<iA!N%h=ciugMlG#3Ijvj3nckB3=Hug^C8KB
zAzp-mAs(r{5bwai5D#l#F)%R1M=&tNH$eT*!N3sT!oZLq0F6Hm28IL?28IM!`3K@p
zU|>i9m2V*TgZOtC7!oC*?&n}&NR(k<NQ9XW;zuwrBu#<(M}UDLX$AvBx(1?rP1j*y
zNPmJz-{~(H7%~(P?#WPLV8}WGZO>RRFl3!zV8{mf4{Cq52m?bl$bTR{XtczEfgwi&
zVP1|714CW|2PY`WfX<5mwbS#E(pTOR28IG3sQWV*7zzRy7z!Rh!&88Pq2LJvLm{X=
z05!j`gn^-O2UI-=14H2+28JS7`NF}#P-McuP;7y)zu1O>q4*BMyy6E83?;DoiGzWm
zq=kW@<O0IHk}C`hr69*b?JH$rU?}xLghy!r14HQqB>ofzhEh=e0IBC-U?_dUz)&Uu
z;y@BWnG6F%#Rd*`kdYw&S8QQmsJsHLZv_|_DsM0_R3{+Hqv{j}hB_HU{MRWkFf@4}
z;;YGrfuRXheuAvvU|?wKU|?u&LHMt^gMp#N1Ho_cVPI%E1NEN(14GLN28MQ|`m8;K
zfua2YLcaY814H*0sQn5I4BbB%7<yp!lK=xl&j$vE-VmsI0|tiP2nL4UH&FXP{0|Ha
zeW3Ow$bAM341GQf41G7C@&XJDeRmibrieiOTfx9EMS_80ngs{wDpv-E2@DL=Y#11(
z=RoBJ7#OA(Ffh!3*(bojFe8G2Va5Td{TvJoGmbDY%y<H_3=-ZmUNA7sRDjyY!N4$6
zg@Iw#7DW4d)(!@Sc>xgfL1)~|3t?cG?*YjlApU$G28Q`(p!x+E80KGKU|8@58Xf`+
z3=2LmFf56I<_84^h9wCM3`=7W>1}BO1H-Zug!*L}3=Atepy_`C1H+0Q28J!5o!uZO
zD=;vCnu1&YAoOo#U|`s~0il2E76yi`NbS3=Zx|SMxIn{8fPrC$2Lr?52T=bhFfbf`
z!oY9@DgPc(VPH6d)W0|q!oY9@seOE80t3Slr1tBP0}KpDD<I(kO0P$27#NO%+TS4e
zGB7Y4J;K0n^aCRNkA7ibIEGYT9^+wPIQ9YI{$pPl7>>ir2Mz{?;|>fAXQn{IPlAEr
z%nSyGa{-9@_gn}A!+8;e`R64V7%o&G;^RUM1H(lXg!?XPFfhCYZL0>k55yK>V0a7i
zFNn{<!0<MNf#JgzXnvDmVEC|uf#KsHsQWk=7(OvDFnmG^uTLrr44+`_L6E!$1H&g+
zegN@*Ffe?!fVzi+f#I_a10y2~)O-O3Mn(<>MwT=1{L093fq_w81R6gY42*U$42+%%
z9K7K2K!JhLQ-y)i6INaeFfe*XFfe*fftN3go--I2y?hYndj&8sdV$nKk~^bU1OsDm
z2Gl<S42;1!42;2`@)9Z^T*AN@TmlLVumEFl1p{L+s67M`Vho<cz!(hb4?+0}2N)O=
zzd$$)3=E8kKNuL3z>bCJPhw$UOh)wA8I!LtFs6Xo*I;P|#*{A%j47b@D3qVdz`&Tw
zf-o<YgMl#>(H~<>-NL|_is)}Mrruy+Oa--Pp!(k|U|@U$sxP4Y-~$YdVJt{{SHXLr
z8LNUASXks4rFp<d7=Xki{{PphU|?W^DFun?{Qs}Fg@J(yat;%?J<Q<n|KIl&3=E8*
zX<3jRAax87^O#`ffyQ1W{{QC$9iCOf;3vpb4N?g@vYdgz;QxQF5C#S|83rfe0;mi~
zy~qFm0uc-hY&LLl#xMZ}#s~qJgBTd)B^VeLA`tut1qR0GDG0vd1O`SUP}oC)kI{&Q
zfzbldcVV<pU|_TZ^({g29E=b*jglib1crJNU~~=u@3V^st%?2r|Np-ajCUG7FrH8N
zz_{Gu17o@Z_$WPi{35)IBo4j^9w7r)3}^fVosuWO!0-cl`UPA9jqwL6k7PEQ3angw
zR%6ou%DdRaaf#tOXdas$g64w?H6)FkADC=eJ}}w1SQ;1@=z|vW!X*<HFfgz*!np_r
zs5}MjQvqR+DCArk1_q`Nj2Z=?Vdq5f`H~<h(6u~}A{M7O1A_wtFL;O>tN~OD!5C0B
zD2xfJ0r~3#ll6%YOg0uDm~21?Lm?T1oB2V2f#Cy_wZ{i0>m47MtY_d>i7N9!Ac5fn
zlhuh2Ox6}3n5;>#uK=Xa;{%h`jt@*$B-j_g@PWzl#0MrTiw{gzB-p0_(&zDk$#TaB
zCeZj4sy}e?J_tB4eqgdV@qx+G;scW<3HB`j>GSx&WU=D|lLZO>Yhd`mWPaiUlZC|x
zCJPemYXs@@_`qbo;{%g9(f0jeU|{^fWOm{MlextQCUfHLQvmDp_`qbg;{%f!(e`~%
z5McbkWP0KQlbOW_CNmQ3Qvm7n_`qbk;{%f^(f0lS4NBK0Cq6KlT6|zKCE7mFY}f}T
z6ORu}CObYbnGkIsu5>giJ{kg}Awc^OU|Ar;$iTn}nx_U~qyvV?vl}$;{r~@eeC-b_
zWRpRy1qKF|hX4QnQ`3HY?HM;@`xzA)x)>OG7(k7M$Dcv14P;r;*<k;(;xz}}bpx5s
zsKC(0z)%dfzcC%JK9F*P7-~PrJGj(>*RH}O85N|s85sINVGqL8ihov^`B-RJ9~vyh
z)Bv)70?2L<rk4GnwkFtoEQBYr7*hi%{#(G||8_5x!k-E6b)w+4)i5{E$bN2^`B-Rl
z`?(kxnn7U?!qf?WCh(SSELMYsu-IP>vKxe{Wk0_B4?dR#>=FhB2BwAvE(V4Ykli3m
zE&JJE=3}9Kk;NeKPv!ClbonQ;C8%sH>Awq{@NWr$DOA-Y^1$T}=7s9WruZRqApUOx
z=f4*Vsb)XE@(;Y;73Kz}hK6ni21s}H_fwcC`83%7|Nk@LF#)ao1(iRoVE?~Wqmuvs
z|HtQl&{hSo^B{e9a|?ag=40?p2avuy=rrc?qPYt|-CWS&<O~c9yPz1PmxF<U@dYUR
zFfe#9fE@3L(su_Jzf3sA85k0X=(`hC1G+Kq1Cvk12PU5vADDbjfE-2){{I8i$MOF0
zfypQ11CtL*eT+~4{~rbnADFx=J}`N|_`u{%f_<R%m0mwSFnMQuVDcv3z6&6CdR2U2
z@_O-s$qQs3)Bg(x7(o8U>&^?HKELOW4@_PeADFyIurGn}1CwXP2PV%KADBEr_TjSz
zF8BXJ0pkZIj~^eHJTpEpd6HlsXpF(5;scY%iw{g5Ap4m9Ul3sUe*rYI2R9yr@&5v7
zjKTfK2PTh<4@{tY<uH_B75IMvG*;kV@qx+x#Rn#LkbPLyp$q=M02(WB`|*LvJ>vtD
zJJJ681s*GKtN6g=_TmGR8`1WC0qb-9@qx)L;{%f$(e^>cvRo@ZFuA_?z~oA_eUQGp
zOT`B!mlq$HT!`2ALxAA}lMBZOrevQFOfFd0xT1$8hz}WKaQX3p$u;8xlPl5w1L+;b
zqaiRF0*DY`QfTmEV3>vwpp*q}z~F8^vlYlYg2oFdwFa&qY~O#-k#%q(WCo~gf{y2d
zg##2oSMsuuINbu)ik*Pi4_Xk3RUTAUA=}TG0P3$p+H2_-C~vQUI~{o1YoIb6bl)-D
z4Gtjt%Nf2fFfdThe$dhktlkIP1GOKb0BZj)>e>%(FhVRqB|-Ke+s}Lf)VFLwRYVC7
z6#pEcrE1s>0oDERuxDUkV7>qfe~A5g_{Vv$8;C9nu^;Dn8K}*IV*eFTe-*m20NpHd
z_z?SX_80zN0H1>emuJ2JvLCdonH<Zo=z-XeMFJx9{{nc94`e^MPsMxz)L(-1S8x2H
zQvTx*z}a8_e*t_<Dad}XgCO=dG0bFOWbg%Dtqm5XfPnZP=Xlxw3*ejLkn9JgKgf7N
zGAGsik2C-MzW};h5Y&@{_>uWSgEy?d3=yG_1o{6z{K5+i!~S0Y3xWI(jemv~28PZC
zQ1~BxNhSaP=YY*cgDpcQ{{H}9B?+=0EX)KRuk8V|(>1ANKL_~8R<N1q1gOu6oc}YJ
z8GIQ)MIgFDa`}+($Eh3CS4Or!z<~j0S%uROd=g;$|Kn_MK>NDz@CVhGI2D8KVPyFK
zgCXPp4~7(w+u=hSU^xbc(!A_E(0MG-qs%~}V6#D27=kz;{DHxA!Uu+8n-2`;KRz({
zE&0Gu@Z<wSDa!|jB9jjcg?m0Qlm>iYD4haQ3&K$K4?Zv`b$np(yYPWQX~GAFl9mq)
z{yHBR%soCZC~f(`P;%u118Cn9NC)JK-+$nw#lY}@fdS+#@Yo~hVoZ<<VlXJ^pz6{Y
z7#Px!;|VH0N{xoVhz|iK(56<{%14|v9e6ZTgMkyYgP4JdA%KA&Jg^C3aWXJ4fyT50
z7=%DZfn`+~7?_wD7#TD`OD`EgW1R@SP_gw)s!T%C|8u_abNDmhu=fLl*_RItp#2pL
z3?CRk`?Mgp1ri%+q!h-&#2Pvb)O}z$`sIQC1O2HCOBf#TKHz=8wG8enMrknoz+}jz
z$iPs+z-+|qz|2s|z+%jz%)n5^z-q#(!oX0?z-G#(%D_;=z;4DK$1YdPz+ujz2D%ZG
z(}GirfuWv(%aTijfuVtc+kjgW)F$H5<%#E!Z(`uJ<<$nwsqt~}aq!jiec<QhXPCmU
z^n*a5K%ju20E1w;V7Q>TAcIh<kgE`@5QA`$aFDQ&FoQ^mNQj7t2!m*)Xr!p5D1%t3
zSg4q&7=w7GxTiR$ID<sKguev81cPLOWPqfAB!g76RJD|})CcKU=~`)7=?^lzGQ2We
zGO(-c8RQb>9OW40803rPgXM+g85B|!TohOo7!=bK-4xjr8I;nM+?Cjs7?d-VJ(M|=
z8C0@Vyi~YU7*w-Wy;ZqY8PsyreAIZ<7}TxRtr!^8KWM0HC^0Z-e9%nLtYcu%gxjMX
zqg|sdqy0grN+(K3N{2zWLN`KJLYF}=S<hLIS&u=#Og~ItOrOCZ$-v2g$$-Hy&(P11
z&yc|=*T~n1*NDMb$JmB}!T5uTo{1d;gUJU|eN%e|22;5C=33@j(-_R*d`krgghi+|
zLkL40Lk5ElLnuQ$LnebQLl{E>Ll%P_LpVbsLpFmwLj*$-Lk@!jLnK2oLoS0OLli>_
zLmq<@Lo`DwLq3BuLkvS2Lji*eLo7o&Lm|vqIPK2hZe9+$5sAUWqL+bz!IQz$64V3q
z()H5qWAOUm&ERbUI_SlR!N;^8bWa9@uNkO^<frYYJ%PdRgFl16VJYYgFNOf4i435f
zdV$7eptHgmf(#~s&TV1{)|(8s4Z#SD2?O7a)ymM$(8<uv(8kcg(8U05d&2rFj0T2!
z2H=CD7#OH5#$?LC3NEztSQr_9^YJn;GBSdiN{pZal2IPq8fRc&P-9}0XW|F(3_-Gn
zj0~(ypqOI*%fP6@%*Sy}ky%keMG*p26ctsJ^_7@86_oWARg@H!^%WJB^+9Y!We~$q
zT~SeAMIWMAQAJ<bMBhMBSzk$Ck(o<Dky%nfUr|v>QOQ6NL@6t(D#}v?)hW^~uZXT+
zRZ$t_G(|;4W*!B7eMMz`W}zl#E~Y<>j1VuW>gzLeD}dN;gO_0D^-?rZQe>6}I}{Yu
z`ugB-S5#zv!=PZO4+3V)hZyugegH+FzM_(<qLLyLBLg^vXn_wGQDH$(HN{2A3=GhQ
zw_Y-&Psu2#2U5)ujG;Qew1feqLr))0>SvTQfVujRqlTcIv~rL_{j_oh{nFwh{hZ7s
z{q*EyebCWPx;db;J9X3ZO7#s*^)vI5b4pWE!KzVAC@x6>3&QA(a?oWV5PQqg6G04y
zWYBd0#ztv5i6wgZdL_995HBQEmZX9&`O(V&^#=1xK?f}BC4)RwTmrfX0K!hn$xqIP
zFtd|VAPmqs_!*fX4hsY5k`cXRP%EJzIa4nK!~kna&V|Z@4$LpoOJ-n&oLQxp0b&(r
zBpR8TK};*oNHjGxg0Mm7GeTG;$?4#`P9P4-NHl~97bIsw&aQ&k2~q++<*HaO8B~rG
zBo-x>Wfqk{dC8fe+c6*<(8*X3ua*?##)EG<DFW#Nc_9&Wwid*VIf=!Y1;rreure?d
zmt+>@=Rzbvmn-Eaf&!13fuSfrH!U+K72+mPaO7tsXF{Bm2xk>%B&Ot-Lu@ZCPJ&1m
zl_WzL$%uf>O-)ZMPJ}rozZm3vX3#NppktmPcH}1J<m7{NvNAA0*%^?i0$IxnKGzE3
z^9)cwH?brUVhbpM$`Xt8z=|RFi|7_77lSmhfG;#b;-wZBAn|ewN|1QTDUg6*W?)DI
z-{J%@9u(G@`MOCtpd`Y=zyReVY)H<BTqXetg@RmAU@|i>Bo(Em7egEc3cU(Mn1NNW
zfzP|n%+CW|djko8lw6pPKv%^S<RlhnKqL?;0-X4YOHvYx()BVxty@q=iqA+aN&%e{
zu9pF7B9~Maq=GDFVgTI`m93Wn8j?s#NrW&Ur-EhXL(*|^Nn&y~NHH@51L!<Kh<m}Q
z8^SEeECMG!y$l9!$PGYHW59R+K-ndkpfG?Wdr-81T?tMkU=}pQKp}|C2Ztb70Bj#9
zH-UMei+Ldah9yC8%oc-h3xY_Lr6*?O=VybG6Fd=R=0oBOlnlY<fI>YL6zXsuI1b>v
zjM5}XAb=Et6E|F{6h#}D2hRT>m0%;`yxd|?iUn;kE>6-dg(YxUMgkW*1u4mph^a`;
z)5`#5VaSb7pwtGA8&Hw~Gs==uAt9PokeUwhX%e_BV`gAL&e33ZmL!9c02c#8K^ZtC
z;Z6ei3(U!>%1um31r?1DYjaC;N;1L44>&RrTyVLPTYwbN&?w8z1t%09cxez1xxooy
z9>_mnt?)zw=0Rf(rW7m&H4j|of?W?4fETEFWx1)knRz9U7(rA-%nYE?9-1_H!5mP2
z*UMmla3JY2$<WLo2NKB86SZ}di&8-c+=FvOvaz{=0Yuu|&@|r61i~%@o$;FqDv9{O
z2B(421B3~-Bbfoh0i8JyN@^fp5~x7r0~MPoW$B>o3TNknF3HjZ>q*W@t$-R^T$Y{)
zk;wp=mXx2I0TP0$OM;tGP;3M`3LE16<N_08b4dOxE&<sCPTL@x%9Bfrit|Br4ahO+
ziD{rB7sAXahXe{JBq2EgDU8AC0m=tQ0$2cYOAVylf<-?#x{y*1m|vWdoLB^{?1~a|
zp*a*(tz<%ze?cZFk+U!`<fi6=st|CNO-n2)D1jEtHlRZsOLQ~yAk%p)Ossm~)+iqX
zvmhfYt1v4gn=q>?8?&$%E32@uFsm?g9wRHOm~a9cBbx-PFmo=L=fcLwCJ9o?!pz2e
zl0ku$Rag?FmARaem6e%Oft8WDTmi~*WMfvaff&Zf#;?c99?i-q%gUw9%F3q5$|=k$
z%*Mzn8NtfQrYOwH!^Wt`%B$<e%E@NW%F4^i!zRqi%4WjK$Q;SY$|}Oj!N$nSt<TEC
zz{JAHrpU_3#;oF{r^m?3$;KS3$HvGi$iT$H#HI^Xzz9;HsR!|upaLt0A}bf00V^*X
zNP|9@W@S?bd4rWzUXPWLO%0*6l$DcBpOqi1RFTbwm6gqaO@Wn<E#1}|3|JZ23|RSe
zSQ(Y{Sos7%nwjr1g2I7Si4h!*d~A%Y915(gY<9w6V;F5&SlF09)qvE92(t>Z39|CA
zDYCNKf$isH(_sTS7aSJ?Da;~ZGq^!PqsYp`CeNk^3LvnPc@$VB6<B!`Sb5p>S#`l7
z!3ZK1SQ$;&RM{9|;R^Dmhyp9G0;>pIxiUy0$RZO~PBv*sa5J(oYl6ZK6dgQ_tgHr5
z2g$KYu`w!ug77bc4a8VsR&F*0Rv|V8Hbz!akWqT9LJ*3T%>Wet!mONZ+N^v~eL}FH
zXXV#tWo6T66$dG16K0i^XXOS3jUuZ!*y(I~tc>ogf~u^XY`UyM;4n8}6$AwkBdegE
z9xJ0E3o9G*KSoe80tY55D1~uPU}0lp{#FeNQAS2#VX)zhY~E1X7D_8ZX(b2^B4t4Y
zSX_yfQHhQDI3w7l5a%(na)6|5Sq(sxJSaGYg~2J0mCc@&k-4EBloVOmSs9t1fudSO
zgoO>Fg^hVy9oRph<ih-)fl(CdCXhi2tc;3m%(EbAgcBqJiidDkFjEm^3o9d=04pd#
zf>Jps^$CDOLXj0jv$Cl{^swoJX+c&-B~Y@j(gRC#vVoL=f?t7EfK8Bv0~BwwYC+x-
zX5nNNVvYbOC;>J`1r`ogRyJl0MyQtzSY_E5S(O!7Wfedqqdp548}n6gmIg&6tBL|B
zPwBB5+Ojg*vT(CXurcqb2L(ARBXbETBv=`l3qdps534NmH3krqm4}g0fsK)c8)VbA
zdPY`xHfBynRtW`GRvT7M=JE)zcR{(BiIJ6&xeTm_5nOnPU^PY_<Y(sf^^D-0&7{G~
z$jqt7#w-MNM=;0$bd4<BtWs>u!HlfJ3asijtc<p7%%Y(15M^a#-U*3AR2Q>wg90s+
zQICa(m4{he0hG)kUdUr)1*aA^K~@e>N;ZIp9VnNBQZ|SN`3IDcz)``=%BZHm!pp|I
zzaC_%u&_9@EF&v8JutG0fV?9LvMmBs6ftXF14p7T8*`unD=R1ngqdeBGO}`turaa<
zvk9<rim<A)F|zQoYJqezPp;Qv6=q}hfh(Sisu-+P6BKXE&*~V#*^Wtp)e0=2tH7!P
zW&|TdSa?{~ncp(#vG76_O|DmfiYc)0vTA_UKde(=6$7ypSV6@I+(07*Rz8TZ3<DDj
zGn+ibdyK5CPOR*Zasy6-vJ?{=Gan->J9D7|B-JC-2q@wg(SU^?I~#L3qat&q0xJ(Q
zzXCX;GATkN<-z5oF!Lr@3=1<aLJu5hkb*-=n2q^#9Vq#*F@k-(nGqDspr~YGUQw?H
z@iFrjXm~7P1ce94`^?OD>J%WUk@*aR0;>q~(s~;x|2BgSxb_fcUW0JOassZnfb5EO
zj9`nv!OeWV4iXtF!D7nHm+C-Sl3A5iM4DAjk5w8J>fjs;b~UI}Pz2T7pvr@j4a!u2
zC}U$TQ-FjMsGb(o0~Mx<;3AF{RH5@TS1BmUfiowlw&#~ol!bD{S^4E4Y<@OTRz^iu
zei^8YC@Viif{{&xl^>>An3Z3il~K`4&qhIkg^!JS9XuB(V#x&|;9Q`~VFSwszIveA
zUYI!n5;NckV-;Z)Wn+ZYc+BS+yg)g?1F9|+MIETt1f@u3IYw4d<|GAHNeE95teHsx
zlA!fi9l*kddaR<%8|%HG-17_yU_MOxJcA9ZHdvvT9;*b1p#b6Qv4TouCIzTIGd)N)
z&|`&U16`DCAZ);D3ewBWtH;XDT&$p@ZwwXSRA6OiE>qBgL<>Z|OhI4QfVol+RA~we
zv$C^^X@QuaY@}rbWeMwo7$8YrV^&r+Gl+ghR(3Y#B5-i>>#+(muLCDQR$=BW^bi6S
zE3A<6MU)lH5aopil!zCrD07Y;IGC83Mf6y0z)ruw08QYK0Ayy~P_GB|#03UuUQl3_
zVqRF^#A>VuYIPXffJjkuXuf#Dpuoz>md+~7yaMK|d_2yQ0;K_v3+2E~7!aw)3L-%f
zRHncx$IOMqQh+#KoK=*$5XuIX4PYLq0Apqb1qitKyuy$MYG6V#iI^5BuR_?2@LZw?
z3r<#M!8A}VG0@f5HPY4B)i&@p(AC$6MGh-CpD<T}S~L2rjBKEM!pdmC$}bO&F_5vK
z1~n)%=-YVddFg==t0;3zy&elcD<hi;8zU=^3adD%;FAHhhCvkxD7i8!u=0VMZQ!~>
zkC{u4mC*=P;g=|Ynr-05AE;dbN`s7Etb%N|;M~E<W(=0*1hvO_*ce$wbU@Y2Nd|Bw
z1g*BrAWb!1Hs%UY>p@rnlv#P%6j@~iSjE{GS!F<tO+T<XylncQW(pg#DX6XyhJ*@8
zL>9s{WYtz=Wt3s%QD$Y7wSkDSDYNph8G>>@D7v*FjaE>=+pvP`BsObMasnB`#{3TC
zFcD01?O8Rz=4z<0^2mew3*ed)YBDFA4#-eQl4Arl553q7Sy_ceSQ**)S%sBZ8MRqC
zltIx74im6eP?HSQVGw3x-oX+9YUhJmS)lreQ4d_7ff|==M&J+<QUJBw89~_!RL6i6
z>Ve!3%8xOuYS20j)Hh&d^JW!fV`LEk1@eASh6M$!AS;JAD=S+j8zY-OSh>1Bs~WhJ
z6=qe2>W0zMP(CQG7!~ytSOu8N!M%xQ7EqLdJpgK%bFzuB3MjI2f{alByONd7kX46G
zm{kEJq{s>??pfLFSUH7-Sq<12S@}Vc2<kh43Ijv1GdS72Ss9t<)`Ie!2qdl;S$Wt%
zu>?`b%jOMIr~uN+e4mMtRg#U7Ro;kIQihe2O-UGBIzt-C3aq^PV6GsWKC2QNqk;mf
zAe$m6PMOmgS&hLF%)F@<mW@E6$EL^1BL*&0nAn&fFzK<1urXJFIvC7?jBLyscp+^$
zwp?(}gpqk?Dae`7b{F$eE>OdoDS}m+d3Px&kdAYK90}?MY=<b6W@BU#1VzJ@3Q#ve
zSXfv@4CY609ufsf7K1{AneT)!3lFO>^Bhq7T^Izwn#Gv!)j=C))~xc1puQ6e4=X40
zLPk9W7C~saj!?tM%4!TMlED=rtQEt<CdMiXYM8P!XMqX@MI;rF_KgzERqSlM$}+4x
z>a4=b%B+GitfHXu3Y=J(^N{02pH+|zT%UqEe4NZYpoWSta|^25d6~c0fh0JYI~YNZ
z<z@a+rvPajFo6n0US@t!D*{EDm6J_X7!neHLG5->KnR0Ff|HH;e;uPRxHx2D&VW_f
z;AjN-idh=ebP!gQXJu4j<(F0lw*Wv%UzC+!9@YlHYz{=&fXW-@6j1Ax5nP0Ue8vlE
zXtN5i>4S#?K%Ue9)!+)Of{LtQIW_~Z41~+d&nCzs1d2-yPzDiZ1a+I`SXq@ojUpy+
zDgm(=*+5LtbR1}?fRUBan3a=F23)4Gf>S5B5CW-z=wV}I0lA-98DuCUBbcqq$i{pJ
zR6xPHe+I0ep09j5D9_0&f=E!?Uml!=A$<Z)HbY@nP!E;|6oUrfdQ}!&l!JO`(jfa7
z+4NY=Ku!RaDNHu3;LfNRq(7~|3U-zrs{km@7@39iSb5o)t3bB0vWY;PA;4Uy#{w$q
zm^ndiW#M5JVNM3Iz@-AXJE_O!%?ip7OrSQ>_BwFR5{7mGMcEiZ9UK!-Tr$6B1iMH9
zWFE5&DE+XqF{eSw7fx^~$jN34&4Y}rOl**Hgo(|7g^5*|c|EAf3K}AUbS|MLgKH$_
z@5m;LFtUiUF<$^Xgpm>Cc40Q=H=vLeVPygZwImz!VkVF?!F|<^8c=7I4Xo)0Gb0Np
zt2i5TM-3wjsO$EVS%D3d{8)uq71=;?LTt<r!D9dr4f9#Rg3K?g5r#|$iwUqXKd1&7
zqQty_MS)ci(j#BY1PVK0P=6H^B(P+|3d+c!l)?yV9~gkkVMaqXW$-{2s434T$I5B|
zPHBv+Jc_JfrEK7SD#Yh(jBG~GkrWw7iU7qWxViu<W@6I;B?3_RLsKAltOXpWY$B|(
z;9Mlk$jAn>Lm8}%kqw+)V0M7o{%oKDF!0zJD<_))xCRHOK6@51RvtFyO_iWRmW_{<
zRRq)=0o7)p!39y!P=F|?MRAsmkwuJ^k$HP1xWttJCuc=)=bsfcD2Jp2T-5QvbslD8
zgeU{~gpIiZ<Wz`fz}^B^2V8n=%s(Kb9*k^)tP+u6GeAQf5=yMBY)Y(*Y<#SoMy#r!
z(AQ(-RDiG)z(XobdaM$Kptg}Zs13#nt!_aLUr>oq0**vb7UTwv8-f_1K`#(3%Esu$
zDs00lssQT#gRB90i$ei42EhSozcQAvGPai}FtUiVF)yzIcO)3ugxNrOj#U^`S@5y)
zsDQGH2pjWONcROaBBsY84jR=s%>XKQgxQ#ngOV{Q4GXg|pM|jnS!ESj8RelQM<lC&
zJ}V=$9B3SrjX6b61k`9yVCDB>Wo5GkXIoY_V^9qa3P8ptR#vu1sHh=G6iF3~?~Nu8
z;X?-FKmiFVq>b!A#T}$=VgyR$pfUmEDrtRI#<@1E(u%D7ps`wM@K`OI1}i_CFr<N@
z2o7zqI6pI|7pUE%#0naq6abkGDz_LFSV0uC9xLM%Jq0%AsT?2+K*1ou%CE%AD2Gn6
zvOx++P^$&h#sozPBb%@utAHk`EblD?>1Q=%6JzC*XJwQD4<75W@=3EYYO(UEu(GOx
z*sN@h%$#1rpkXdXR#s?hNRbUR6wA-X=mlxxfqD#LNbY21vxSy9pnSr{oDb>LGlB=#
zRCK{Td`31#7711ZHs+_0Au~v63~HN0TQF>(R<{wT;|r@rKvBiS1}?5a>70%EJ-8qN
zWj_Wc78V5sR#5(Cv;mL4Fxs#(>a#KL1m^=0QE=p`fkvWjST)%gSp`6Yxd!0&6u7I&
zrVY^rt#{d&IYEKV$d<;+X$y)|R$ew+P}QQx%BT!&QGrGQn7|HU04*+2i($SFE}cPz
zEk7%_Avn)~axyF;KxKeBNP`_KE1NZFcnRF>T+LVlZb^f>+MIH%qDriiYzpAg58Nx!
zW94CsVr67=0JqY3ML;=%71VW*ViN?#;|ox$6=Wx<Mg}DVRwXtcup&@Omx2~8sI(GT
zo>8Agl8t$JDX8%VwvSOB++AR_1tnQg2no(qqM*jE9!L$S5y!@S4_tGwazYFTHDDwm
zI+^F!GO}`mk^(3@7=S_!R9mt!?*vDcFpDIpVmV$5s`sRrcQPp`ut<XP_VHRqP&9%E
zyT!rdLc(m!x3Jg(iY!Lv#i+K3fprM6G2eygfCRcC#9fTc3v0nm(5fa@Q8ryxP=8IF
zO&8P?1ocV4C8Q!Nqb_8e(GcO}wJ;~MF<*i@cpcoqmueaH5lUA>l!8JP<R9iMwV;-t
z6!RLm`YW}J`XB(VpICKS8TCPP6Vn+%b3UvfH*n~KdrzPaCL=R9DE~8;+kpC9tlUbh
z?BJ>i-mc|Q02RKV<OEJLZ2F)n9RU_;P;yvP2hP@@t`eg>D?g|tk7NZ66dB30%E+^-
z=z~bmV7?tIE2t0U3=ISYRuOPib0~ra5E$iIMZob79(*-sHDVKHm6K;>RbW+71TiEP
zKx{c1R#pWzA8^sd3aYnw*@Rj7boE$y74=#9KyKC-277@~5i~A45me5C3M@fz;Vcj8
zT|t^I(V$+1iUO-3bBqluBeRMENQzNc0i=$V4KyCW%j^iMDnadKQSc}bs4X4{NrB3&
zoU*K}%B&&|teni1pb}nDL=4h$<79KRWo7k)6zR&W+~8KTk0CU#gVHHD2{TK8supiO
z&@33UryiRgo4ze8sJ+I_53vkfaxn|&u_}Q2ZlJX711eEi_&`CP2kP8HT*k=8T)_y@
z;=;<vT%o`!m;j-{9%XX@Tj|BhY0ApV=EW)mFaFs?ScT+RS(RA1K*45U1S)I5l`kkQ
zbFw*ud?9RL4|O;wLiO}O?Oo<LFNkYFV_jHW%LuC8S=qp@1-VrOp5O$)(TyN=Sy@4y
zC;{etkoTAc)7TW)K;tXkdf=WuIFTY$gCma-w;mQ5Hs;@uqzFpg0-y>?ft6Pg)XfLa
zT=9Y;P*?<P2{_R!DzFH!F@stK!i<cN#(<C!XrMztl~o8-L9q%ML3A6kim-`-;+#W;
zl@l~5swBc{#3lerz#O3TZY<1Z19H0<n=q>^q^m9lie_(CG4Kc;n*y5wD`@^r8RSz%
z=m3E}DEERU4?)?Ql~K`)jk${zoR>fzU}YB6V`T(|jf5&ID>IKCs|0fisLJFifwI_`
zITeIO*h=L=%Jf)SnFSRT735ism04M3*&+?#^&7ttsKy7+<$+S85@@axxe)+vu_%F3
z7b`C)wSem(1y(~)gHI1K4myFA(MS)}*ac4>3$n86gUT;fMOH>oj&NmVWOf5(7I5Q3
z!iZH`ixos#uu7<~N{4`FccnpH99C8}R%y^c8Yiet!YT_Iz(Q+~u(D-fxCE5an4m5J
z4^x73jUFfmiLwf4>p{i@W`PFiK$!yEu)~on6d+lJ4K!NF$mYe$sSe5(Y@*;?pad#{
zINd;vR}tuRAaZsFce_CC4}CTfIW_}Wo(5$N1;}tpGBj&oW@KJaM#jh*pll3Dczi0L
zgohxtKvAy1$_L8OtZZGNMC$`8$@M@<c00K62j>q^6zH<DerDwfU}aRC0Lq|=tc=Xr
zjI6Ap-k??oXvQDZV_;-n1{#kAbq1hw)`qOcY{INU3Xm=?XlhZERS1+oAWU${r6kO1
z%*HIn2$@=7WCIN`gZn0I&|%aypgKf^RSVQf09g(mV*=MDs<6pNV_{ZKP^}@Q1WNpR
ztb%NynG@y^P%{H!3KM9U$C%X))KXz%K40g>$|{09cBQ~-$GjHYA7j1(nvh`wjVpkB
z$H~ULhLKTHm{pC9`Ai+70;@dp7DfeD9*_mbth}PEoS>!+s77FZ1?re0OyvaErQkLe
zs4M`DaDfN3+@S+EpnL#v=M+XpVG(e%jZapA6*Te8#Ks&8>H8?aM!_D`LEDg^u{P$9
zj38e!ABG9Cxq=G9HgLBO6l)4zdaQhktQ-?S!@uD51CVwzCwL$h)OZ6mp5&ugrRK1*
zvZ=5#GB2zEMJTA;Wdn^@urorINwBgxvNAHyM3H>L&IqnN`TJQ}*`h#s3DklF=a@3c
zm<*^I2Q9*25eGSI0k~Bz%E|>Qu-I&&G;(nOZsan7Oo(J<O^1{bkcAJB;sP?`0t$0b
zy`Rn^!N&Yk4AjvV78U_jzRXpO3as2YpxD<3xrY_hKj0Dpjf4xaF|sMKvWl@O%Cn{0
zXRxY)`tz*DU=lJ~Y6BVw%+X_E0>$ymba3$~%pAwa$|@!t1WGW>VxXp-HXHK+NK;Ik
zO^}rnR46Ng>=tI_k=J991$lHsEyzu*@{FKf0V^9wRshuYl~Mq;VMUc#`5`U@^;lTs
z*qF7zcJV-Fu7!n#!HZ*fz*!5__yuJwK50;rD`5mpQE-EL;Gh|BaGvD>mDP;Qpj8>n
zIgFtGBqJO1VrGyFL_s$5vU0|<GD@>@s)EZ|Mm=y>7;J=qo(;$$%*A@pz_OnYt(z60
z0*0*MB_K+ysyeJ(pv<NOZuf#b*$3|1fD##GJ%$sw@6G|rny{5F2B0w&RvtYUP)~=8
z%^cib647Si0ric}GlG3>z$U22%Bl~l&Y(FRGz71xz{0`C`~YDE2e=yGhy)b^ta9Kc
z3nX8GN*s3P6i}T2>R_=kgD3C6-AgHENd@qN2qtDJ1y&tqUl`9AG~45=punnv5Mk42
zWoJ$X8N+JG#w-mkK&6;d6<7_Kr4>L84JqbSJy6S6gpGL{6DZjTgGa57fyTelMy)u&
z>6DTAB&b)f1PV6hDlb+}QC1#iSFjDB&M&xdW46>|m1A~SfDGF)TPm=sfOzW6Rv?y}
z0xOsWRtlbq23r{mvYiz=0>{S4f@B>F6RRlm_If=eF+I>Y7aQ{gaBzbXgaD{1#;5}t
z;{-Q?^jTTuK@r3XUFY$s4%}%1wG0S^I(VT3o>12Yh5DX)SRfx^0EPRWdgOpV!T@T`
zurmjN!-bQLS%;BTiaA7qm6KUVfz=Qi@*xV)klzIfd9bH-n7`FBf>%tjvcbc53#jS=
z_1VE;#(au_kyVFzTRkj*PceX;1mepnu&ObiW&j2A)_Ra2IvZ>NIMBg~iII(244h!W
z;R5MYdBaj8s8#{jN8lkdcIJ&RSMWg7BPhW#KLa~vRy}A|QxarlIxJ+KfkS2%O2|Be
zhRg=AS*+%4%;y*wS;Z7s%@tV1K*1r*#{3H$sgRxmn<6AZ?tvvpe^4?3Ev*8j5Ju*I
z44?)Db5#T+Ax?rAi%5x}0aQ8WDe$0r0}dMy-<tU?m_4~(ffd3=gbg@BZU&hJ$^&34
zSvXi_*_i(@FoF{!XlfF?e5euPR$_v00mwX1B%%c0cX04^VhO(Q;Na^-3BK>p;F}LN
zi&cz``91?9tGON|?1b2u-+@O@pyeF6Kh43)$UGf1%)tf^rADxBHb!Xv1kG#cFgL@)
z=r1@qf%tL?ta{A<z`@j159;ipvk^fC8m$8rpy1>L$&f-mpo&4r07`=DWl-M;Jj^Gc
zU;{2eifq7c1(kQ84zLuc-Qds4FAZ&ctFm%>gUeUYvJFO1f;0g2U7^c!*tA)}D=k1{
zKdh{fHC)F)UImRKfc(9K5xP(f+;ajiS@UM))rTZdMm;ur(AY00D9G4&SvesFY(y9U
zuAZ6CF+x^UF@h=qL$E(VEdbE8A9x7a0X!bR6`>96R_0TTpjMVXq~8x(1;z_%dhmg#
z^vb{$6%V5gXvlviGpJ+&Rf+tpoS-RUJrD(UtRAa?9V;WV47i8EoDOOgftD_UTRZ;X
zfniQiXM_>F!jOs0o0X4EAIt{z^VkeQEd)?M3N$~#!^Q}y#urtCTFq$HIFAx&sGk))
zna-#PFFHXbE+ZSW8K~L?*NM=g6EgB42U^0&17d>){y-x(2CVGNPM|Umz4+t=uf36C
zc7YTSkO*L6zRJMJD#yGUC5c~!CUNlS0l0y3l!1{|0Mw9Y)L@lj-d(T23Lau*wpCzd
z)PQj+KrKp8W@HnA6a|Y>6Zvg$K3fV;<hQ|z9K@Fc*O=gx%zT>xl*T}F;3BMoa-ijd
zD5L-@qk$eM&Q`L3;!GIa0IXzW<zeOoje>xd^MVqvDJvsrP8>Yl;S6HyL8c|tL2LyG
z8`LLbX0riJazUoynAsvg`R4!wXgLsQ%3)`H1U#{U+H$<0Ar6q4tZocUEUb{$H76uZ
zKx3Gdlg$t`jtlB8fYK;b8zZBz4=7L|!nUAk0alm}UN(J3MiG#_IB2vGG<Yfst{?2|
zz~g(6HMGL4pmfB`1|EL}tyW+bRRC!N34_LEML^5&yudzVWn*>%#RbTLf^5ucdf?u=
zARA<!Pn1m`yp~dwO%XhCZV3u61y)4|R#7$saFwJ0o_~-8I}6m(0<FblWMjSp9%n!#
zLhwpukRQRR5X1m^7F3R~GlM6)F_R!<_7hZ3m7^v@B~U7iL$1J;AoVwR?It)43Nf;B
zLgsE5K?amTQZOTEbq%8#xH$$II|6wIRIEXhU>GzjK+={5sM3yr)!7;ftO|;(I?Uk;
zpyfKCCL3spF?jA&4q^<W9XP2S03~W+VOCyd&^jPcZ<iUg0-3o)0W`b;Vd^Qc8I*dn
zTC;%$`PgjPBG{O@L5m_m4GC6Z(D)Q6Nei<v3xblZ2rDmm!MZ4`DyS9D%&owx%3P|z
z$|?^U)Z<}<@$|rxbD)tER!D1{2Q++A!pI^IN~rCi1{Jt}!p|z{3tCPhX~@bbtH3I$
z3>otR1q39L!OJ1QqkQ1BzzJ%e+Y3W-F(a!8Xh@As0o+Ch4YGh%M}jjrC>1e+yu@Y%
z8tGAh7zm1HRyIR#$N(8A!UY%^S%rid^%+^U!JS+IR>n*(1;l8J4J*GQ$VyO2CCSPG
z%9@;P#=^pE3T&VbmzV-b5;VLl%*v_@8sJxjtS=Rj1kqs6mV)|7tjydcEb^dn7-4YQ
zRaRn^l+#nd>RV8&L=oDAu@@E*LGrC6D05dS2#dpg%)|zA6PlkvL&~6DCTN_L2Q;jp
zYzrE|U<D0D+uE?Q3PQVOS3%X6FbgQ^o`C8gQAjaAgOQO%fmN3IMV$gjfO!U^0+bKd
z2jvTZ<U!*#;0`)yQV=xN!UqXy(CoM@t1DEgFkC69<`V>knIgEI)CVeP5$z-eR!uhM
zg^Zxu#+-QuqaKR_t0wb{I*_dpKBzH&ycV>9oQZ`Iv~GljiTQq=0?2u+Y@mgxEVAG=
zge+{#)4`t5WPS<u1ZZI)3-ffaN5EpNLJA<yv9d8wVPs^r2W1;J5r|$zR&iNK8v^7P
z6;O2tS}6w_t6<dE12y8**qDDndSYszX&EK(`a5RO<TNvALeqqe`6xJKA?*{8*`O5z
zpn(M@Hf3=9GlIsxK=l%+RRdWGAi`$B$|MC^AH=Gwz^bOe%EShl6jV`QHBwMuWfTF`
z9)Cb%DZ=2TSbVG!@VY}BTtDcs@~E*gf(H3`RlqR=nXZK{-DL#T>7cnmPBta5HFBU8
zIG`d#0$h+tfEp=w;AMWyY?`3%F=$E(!~`#zVPs`B1tlX9R#qKQUB=2P09w(@#{2`+
zj)soFgZ%2nX3Hi83OeR0*aRD>g7*fe6GnAbAvREvfbgoZ604dV*tgnjj4YtihWRZx
zbRkVaR?uiNE4Lymt0Ehuhs&tQ$|KJLn%QPP!2~LmAjJWjFe}GuRz@}*R#q_<Zsr5E
zj3R7|5M`S|y(AG9ZqR(x>00oFpo$HP5~Tmnyp;(wvdNgn%E-*c$imOYd;~I_!3Zuk
zL9Hv$ifVr5B9N!_SviG8K&CRE0`)6ISouMIW@7}eIbke;a1|gt1r(kaD|pL<0t-Jl
zy)ZIwVNzgGf(SC7sYMnCS)`3-5gQ{5KWMeeRwl@D6;M&m$R-LJ@^J?R0&@;{Ae~u&
zkyVMg0F<W%6d)`f@IpjZ5m57&6|_x*88kn^9Kp)VECg{klP)W-0octfI;<jWI;_HM
z;$SX#H3SDJcsLYT86jfK=AbqNXr!7QB*6(L6hI@w%$vZYqmThIPPPj0;5ujxAQM|E
zq-_Z)mq86tV{qn>HDEOYH3C4pDq!o{JRwuY5T$yoj1r(FiUOc98BkpgUIHKtAEE@U
zZje(24d;LpDR?NCX9{RQ7c}(;O8=nL4x+(LYcG^xM@BYgA;t&=P`YO>^kP*9jk<#d
zufaw^><5#~JRsjPvU!1{T91{7nG2MnK`RMCCWDq9foQM|plLi?a8d^iY)XLIxtwf<
zkXdBrN|13(Y>bfEyQ3ALnFCHnXz~?dWdv2F;IbT4u_E(8O~g`As$k}t2g(+pb_zE$
zH&__jjAa9r`mD@4kfAG3tA>%StOPW4$Q+~xZG?eZsNUdM;bkjj1vM6!z<Ucoy>T5j
zGpI~DsLEs&uwezYyg-dNkWa)xy%7;mMi69UF7*O6uUI8PEl7P~NM*#9&Zaj3G!iKZ
z5#Z4S+2#xGf`L{>f+}BLwhV7JJ<#p~R!(Lf(3BV`9KFFsq98~)ID>-{gaIpPl^1BS
z8Y8nmD0ze0rl94g9LlVW%w{&=_KhCAb0Gl_3vtl&1|ukHctG1&Dil~bL0d``g+;(F
z0j>1}#T96M1SFb?C>4!aC8R-%`Rv$ipv5CIXgn8`8bIs(dGu^SOCUgPBhUblD4Pvi
zj4!Amr3#K{=0BjiRfLgIgslWrgg1eg)QPYPgLbzeHL(;xJA<axdw~aoy}`{@etpo)
zD<iY0mlrE5b2cc1nE7l(Y(aqoYHfhF3yO-da*7DsMzRXCiLi=-;uPH5v=e3%W>p3^
z$Jz80*d~IKqyl8vSsOfTBLf;o2JH*96=qdu%V6b{V*||su(FA=%79WW2Phgq)6$&G
zT#TS$ejip&9kvWmlU4-0PD>Ot+0VQkJhcZg_y~B3BrEeCMm;uRP$B}Y<zYSv-d`cb
zyq!@2<N#JS=96`d;9YQR%&)+6;-Ho(AFG%VWPBUc{?P}gDad*o@X`uUy#-3DpcXBg
zKDfKV%4PsHMH4j72{D8hTmo>wNFFv#R#qutPzdNpft(Inj%muq+ya{D5N0(6?Ko0o
zHPwYQ!xdRY*up`Zfy~$#!85{);Cv4%OSwR07IOu3$N|gJJ$qISHW64w23lYVDq}$-
zw@NI^pw*tBDM${`PRl9<Rsm=&Edb?%rqhK*K&v9b%>mF>NH%>nRvvR!Q#N5%aW7U=
zP!VMS&L*4+pk-Z#;IdrYo|TnN4wQg-g(0hldD-kh+pL%uf*Mw!0tK{T6tv+9bL$wW
zxxxtA^TnbJDS(*oGAOW07_b?ET00<zF#72+vWT!TLk6lq^&mg17-XdjIO~8Dsv=|`
z2AHh`UI@&_2w7qV?YV;HUpa+Yxj}nJLBs!`-XpglD<hjSn-N$Ss8JyZ+C0k2X2i<F
z{1Z~Gf{F|9Kn8Ow6Ug@<Rbs517NGt^r5-CMc(|Vp)Z7wb12uzKg;{wRL2EBTzODeZ
zxtZ9QIU~T!D0mcDxj>l}x~@|Koc?)03q3$yWn^Ps&BO>Q)vwm-LDt1FGOq#coMW?M
z<rD?2!4Y8PR07w3oYD}ASC0)cn+;kU#VH4J)JM<?cTm|Z2r6+H<)I{aO@)yyXsa*C
z37~-;(8LI6b{xFC1>`r-;%-LJPExQ4WETh{q^JSywgm?^BP**BD1``u!b}CUo|%<R
zSr{_;0GVR|$%5L~0?fIf6f35{#=N<v3AEya7qY!q43tGc+vIqelR+wE6<B$hlR=#;
z$lQ=9I9Y=hxkE}wThIiCEo4p|v~L153I~oBPy^l%)Wrue^jSHj7#Tskj9J-0^&&6x
z3~=HT7GaTK1rJ}dim-@)IxZ2QMPTyG8ldH{oXimlEE22|C_F)C4F!-SD`;P#qM{;5
z7jzU3RP^bCd<a_5&&g&B3I)*WVMb92RvzXz%%JWvXiYkJ4h@`cz*!fhjk&)D)Kg?+
z71IZ|X&7z5Q-_T5koiVXR|_&!&C6y8E?C6%q3t(4m_l&6R%8_hsRb<;2i02o>7bRy
ztZdA$nHjyIJ1iJkIc*^upTTW`2=E$gP#2zwpOsS#(t`ypoq=w(W@R&lm<C#qs0?b1
zu*zz&f-@!?a}n4BkfE9;(289#P^*D?3OH~fl?f=RzhnS8hWQtBnm%Ym1vD|k%jQ!G
zsxHC1LEvo;P}`AH4=e$y(@hLO9aaGya3v2KS{7yVX4M4^?1ECGA*&N;bBh<NC|fhw
z*^F$=Ew!Lx7F;iJ*s?-0>s?4@1qV1A^Fk&@R$djzbeaq(PgLo#a!P`BAB(ecYU+V@
zkbu^*fs!yUsKsXuDv|Bkn3doLgO`r5^4dbyei#U|LROA|+lriQcHkbp38*S#WmE(&
zH`LSz?US%$;bGNaV_pkhM#`!IDb>Mi20+uUo}eOK092=e8u+Z7pg|4L+7nP22kCn;
zu{nTyL`-a;?S0^(4^B4F9wcz5Pn|^q)N!~0S|B2VXnM+l2On%;D}%wSL0LK3AT+ow
z30~m>$-SVw4_f5NEUd@Ms0eBX9IXUx`C(;begJMBfJzSL*`Ugl`DvYk9w>j#1M?o$
zDX{XhF+T$h^@@Vp@Vu-X#;p9BtQ`KJ6;q%g-X>Na=5$bX4Ql0p;u6$u0!6X_XlbE7
zxXr=@?~Q?0R)Pv*UN&Yf8(}t4R&j06QUqQ$Wqn%_R%JFhR$e7G18-0b3|ZU?8rft8
z75|WlGVsbJMi2>ELjtN9!IRyf$z||%dmHGg)9Ij9tB`RX8&-bMi3E^>1~dr`3Vcuk
z1yzxtU3si*%w-XvrCZ?Dovf^E(cpSb6ch#`;D)IHbCDhkI9Xi;^~68{CdjI8%PJ1q
zO9xu^0iN>}XU<W8)ZL&NV9>G&P%sO#@_;<RETm@x&Mx_&#p2Mhc~F}bw4;X?+=Vd#
zR}PGzNmw~h!x8Rc(6T%5@(u8r0HC%wXulZ9^WNafn3WB(NEqZfP$>yoGAPK(sBgof
z!p6K8)NX;em=iLg04G8HRS8hHm-#(7GYQ+WfwlB8F@laU09gQ9nI+7k%Emms-iwtL
zREqQKflqh<r7Ar(A6xKf5jYcqS9pV2pt2dXj);+sku4phkd2WIvbvQ~QGt#5IB30=
z2*@m6P)gziEuiKFr8`zO<`O;7q8Cu<4{m#bq6$>@L+Su<fPf7LcW2oc*&@NFgX?!i
zh!v1@bD2#K<XX^%E=FxuHA7Z@X2B9xHPE^$e$Wal7z;G<m=BuZ6qo>-Ifn_`K$Nnw
zG4q!QL*^<#brZ-n;Mo;$`G~q!%7&HEl#SU0)L#IXQ_v+kifqh+UaX*vf`am(iCs=M
z=2E>V16zHNr@^yMtc;+Y?BGPsti=dz1c2r=Z6Ku?C?yzzTC||mMxb>eQfz#zVxU15
z*h+Hn<Pto%IN3mEvx$LvC~P{mtc+EldKjFlU;~PbY-Qj%{b`_WZJ@*{V1roH%?euP
z$;l=NTZOI2%BZgg9=HQ-%~1jEk^moPz@Gt1h@gEu;G`*Fz{<!hq@bq&N;S*{kggyr
zn<+Sbz`8!5hCQ^VceDl98KA*CP?F^Y)jFVj51z&ai3n(cigEDL4^ZkAU={NL`w=wZ
z23|d5#L59G1|f|EP?rrNiZGXvP1uH20MuV%1e?w(3^52atfQmA%BsW$ska#Q6<D}H
ztAm>v^+bh5Siz+f*c(-htm00f<vOgOku6R(Q}EOVDE67H!F!lM$xjcmUY<=Ct`Xcf
zuwewPyln)fbzxRU=3;0wft7<z5HzF&?rVc86;S?X1dpy(fXY$Go_=O|P%8~I0u35h
z=4BIRQ3HhrEWv;ldWpbW?VxNA+MuUy!>S6(9g4!x{9^<vycAd&rC8Kiwb+=8z<pLN
z(D5XSptQ&%uLlz5g9{6S(i%9Efeu9hX$C6;6(!)-_!saP3n+Ovf!61O;trH0SlNth
zy`izG$STGr!Xm>ez<j?3)aDgqUdXHf?P-F9*_a>HFtUiS3NkMMEsFt7l*_O(GT#QZ
zGQb`JRePZ1A_&@w0%~O}VrJA+P+$Zt^!#4~-OC}sDhEjnAnU<1vtkOM#w4gX2JHp`
z832+3g$yWVAY5t;YRG|-5UAY)QDP(lu18rUKq0&s(n1H#j3b4HFmnm0IcES;D6GKB
z3+~&p^6;~Hu`)9AF@laTIhYP_NpON!pEAlrIu?-r62b*WpzacAsD}|WTp(b<qRwg#
z>i7t=nzISAin3{gva30p2rG}A0;@TQ0_8I?a61H46pDhECV^Z6I$(nf)Ojca*JNCb
z;B8e85aqp+H)w&ql0K`bKC2RFNva~akqN5cKwgLTaXH!aS=3oYnR`Hu0kF9?ET9F0
z%wIrL$e{5VHe>Jr2DD+x$p%_8$H=C~<^!tBML~H0G+fEa#w-}Y$|??aDX8he1ghS=
z!Djyl)h}SPy&z^cGJ)32fht5}HU;p$17k=>Sd*2}Q4hj|6t%33;(9C!Y|K{>Z9s|7
ztgL#h0`{zo8lc8~6^9Ubvfu@1s8v)1JgM*lWFcfU5WEZ+)HDIbfe0vBf#xNco0(us
z6~PnJ;Iai2D&XNOX3)_ltfJ5Xc(93&K*1vl9c*T^1#OLmY*NVAV`UN%7G-+^I<*8m
zU(L$KJeiRZ)DBi>6Jh1>0G+MEe5e*Q>d(Qv4>ZCH-DdX`<VyG?1SoP?WLY_x&oJqM
zwd|_}%|CE5A7WB~^1(9);OdU~Fvz!T^1>|K%)4tDMOY=kR?9ITVbTL1mc%H}DyPqC
z1d1I<)Pq)PfiecD8>0@&>5xG%(C!UTK?90QR<=prY&LA5o`DEt9zu>)*aX4?m4G1a
z&<qMXFh~+Ii3D19$6TcVX{CT2r^l+N4|9YtoCOMhP-hLQgq6)l7@~-cA2JL8IvL80
zRU6ccS74Pj0hMLEtg>w4HhQcayx`?LTHxfkmKC%yQ>+Oz^(O}E#e&LlK~_$0HpsqK
z$ka4we20zM4xG+dKxQ#F)#-uOtLcG5m5q5bBc!ke`5ZKm3Mx4u+l#;_jex=lG!4NB
zO2&}Y+n}vD%oY$|tAMxAGP8lsZD9s2?Ewwpih<H254eQ~aTjPGju?2kEUOrsAS-7i
z%!!PU+JX&Kf$BlojNmg`n4uMkB811L3$_TlEf8GFNisqcCL<#xwL=FkKqFP4C<1L1
z2UVe<X+{vu%cc)XS8Sj(&jLEo<ZmsgssU}X1ZRc+pb1D3(D7E_-~~-Fg1R=~SuoIk
z;aWyeGZP$y72s`wpa5iLV{T<)l!9dlum(^w9Gv}G*^In>AyQnrAdSkPK09b)2(&C0
zx^)Lsq=IHP1VH1voNS<hXW02t9pG6QR(VjnSe{iFG|B=wcMQBZN8T2^uNbtN6XZQs
z1vY(Q&=d<JXoP`P1X}wk3X6eR;9?6@XETB_AS)Yl40t*Uw5)(15=o#$30@Rqh$!bk
zacCe6-iyTw+QJ8Ffr2I?jJ*^T*qFf^ltC3CWVs}GVJ6%W(U7Vhyk8$w`|yE=%|IuN
zL0kREZjl4I1u{MiaVO}gFXnShdZ0d|Ix~2-JOMO;%>}Az%D^np40;)8f(3FK8>o5!
zjZc89PdU&8I<q*aYDfW1VG4tKbGZtva%{$|tfJrs5V-ze<^pZEfNiV-^-{qD4WM)k
z8fgG^-k>vRpjc7_l`fDog22m}K%<qA<vS3rurO#e3zT6%`G*A*lhVxKNdrajj0y{A
zcm~wF0<8^!*bf?Whjgwu*^Hoy7+HnAStUUB%L{{SWEIk9HBe=h02MtTgTbTAio&d{
zV&HQS{6J+J<m47csN+B<Xfc6Xgu=p*Vhc1{qYq(%#lfu_Rs}W#aG|~gQ~*nWk}L~1
zs~Gc~deD3>5A!ny1shP6!p8g++zEsvF3_GcRuO1J$6Hv8RfLU~mCs)fnyel&f#MRJ
z<Ur>!F|GkM9KkFF@ca&A6F5VIR;q)F3Q)L$_6fog1*?cLD5Ef+VPJ$f7vyp_NNWsK
zC-JZuurey9DJUpF`jO#~mGq#{Q(zNjRR_08z*Q`G=!a7n9;l$0Wd&IWuKuB?1VQ-V
zNg{C2LinI+l9Npzlp(;a0|8bMW_QqJIB292k|!D21QpnrcYzKH19jn;4>N!!BKCq-
zma;j5VwBmIkyTZZRe;$^541!BQ~=Af3NSk>fX;NX1ucql1}AHKM$mfeba0P}hq(Zf
zX+Z0(LDP%8pgjkWPLUAksGkxARzA>j2xichXFf?*R_033#5A)g$ntDZA{Pbajcia$
zh>iIrcn%!oJU&)lW-icN73g#%$V{~tE58aT&w!681T_UgQ$!#iLy7=lZ}2eoJ5b61
zwLgg&#+HLlt4;tlklD;4L4yfMyQ)B)XnoLb97aVO1y)W_d)iBZkwt@zc{8|s0GU+h
z1<iYdiWq5Dj;YX+6jDC%f{SJF^t1}NUlP9tlw`qOCD4c#WVI7`Y)X&0$c9x4Tq6sD
zW(+{l3YysxhBsQlW*LB&?C9u$ra*PTTPHx{Hqva&UW}}Ypry~eY|Nm=!mQ$AtkP^E
zips3K%ti{V(#!#%>Z1abP?f;jepo?ciqdRipmoeLpnS^8rpPAFDx(Q5>p>Gbpc+OI
zq!y&ffDJS-$!x;ND$U01!pLgIYzJP)#w*9l%Iu@Ss>o~(s+pKUtAZhRi?Xt+gNzfA
z2CW<fZS-Li1MM^d)pMYEBoHkPDl9?AID!goW-CUB=M-42y};`O*-SvSKC6}jtECrc
zbdQNmA9NO?G#m3mP%37=&j7Y_I%o(_M4VNcO_Wti8?>cS3S44{fE>@NqRc8S3rRMh
za*ovx>Ijfxuop!@gN+8D;kD_Y7C0#BfKF&*1rI_oPX(1D%&(!tYoHV0SV1dOAfpwB
zFvjn}JqU2e<}d>&+?e;*d$F>!iLx3qb8!fP#>_w`OR*||x)4H&;A5sh9azxLFk#60
zSkOW;X3=>N4s*5wtAM;Bq#*%5b^z33;bhatx`#&=)-W~(HF7}_2`cm;2N;5CO(|to
zQHYm8!xA>26N02bd}VOi%E`tYo(5)tT1!Zqe0Z1_*Xw~c_1pz5#b;xl4+?xNdvl;$
zeC{wXN`Q(JMm<(F<~jA?DP3mJkTZC^4YbM005aGn2hIn^;B>7BD!{x!#VZ?g5@g03
zzFTKK=x9AqmBGj=z{YG3-JP)noC6`dGg!FUm?hIdRT(3*AE-P+J9rQ>)ws7FG{wWi
ze3(Ij4b(0dVPlS9)MM3yoc+NV0kQ%*+n58c5kPJNmEfS{$^*)f4&V|7vcZ9<vk_Uu
zp#=<R`vYi#nUPrlI@F>I@=Q6Xoy6P<N_WDdprar_g9_l*K_zJYGp7P%<QcqfrJRvf
zkeL&-Xq|(3H6zHOg3MRJ^Q1y-%&Wi!Cur9Ti#TNXiTN`0m_bI+e7Yid;&n18F$;sI
zSwZ?i6Ti%C%&%YyLFWU4)%79NfkK;=jrkLJnpTK;K3E1^h=EEFHt<mm_v;`D4^$ot
zfVWzUurYUm^9I;1P$)3Jfo^%80^0H{4r*?HtphD(1(A^Y0%R)>^QSscrO*eeZ9%qz
zaxQZ(c=}ryGKDMx$qnF;tAbX-&?T^(Z0ewDoP`IpV5k=yswhr{M#hIa$QE2CHfyL^
zpr{8|+a{3NG0?f72f%BTz_G%}#$3tBDqsrU{RyhHxpi3;^jSHjSrt@4dy;sRScTc7
zSvhS%HZxm;_6(rf3tCIY2wJPmuLxc+2Ab*v4WaO`3Nc$^D(7SaZO{ZA>H(fJf$a4H
zB?4hK=6#^?TySCm4T^!rBLuoYePCg5+T0K7?1G9gY}o)5=LT%d(-=X=fJ!qTssjmd
zGVfyq=LRTWj`=W@zqd|-RnG=8{{_z+BFvW=LF-ow^jJlh1weaI3P8iKm7rxE%)AP$
zVxW-X1nq?86=t=DC5D5b!Vr=0ctPG^WEBDx|GaEU;0llvG_A<Utfru+rvRGh0Ub$%
z)Ug9i0)cw4f^7O=k4}Jjl$dH>95Uey*{;CGED2f%0Xnfl6I|SJGRK1im@k7%6fssF
zXcGq1MPURTQO5&0`G+6W4l1+(tu+8O)Inno;F4YnT+nBvf&2qbA;N58tQ;1gs1pH;
zLFQT^c7f)r!6lwCXt2?NjrkKenSyM+4{f=yG0y@GvM@iZ1?7ZUOrVjXXSI-VGSGAx
z$YMtDc{^;(88+bM)u2IcP>%)4CIRRXO`L4T2CS^0!y%y4q9FGhf<{1?qrfQ-(wEQ&
zw?Lt}T?L$<!GQukr3BjlsA6O_fG$JeM9{2CY&QC=Jj~q?=R-p6JChA74|6Bj2j7`M
z0oPdzYCN(rF9!`Dg3_-DD-ZK|@bDpM{BAijBdeYoD-ZMK8c=##%M8*3Vly&tW(I}8
z*&1-WaWh!rYz;X3&jXh+kUD@>0CYH<KDdLyqXa28!I>FUVv4XaKZmRW1J!)k$|F`b
z@EkM`^Cf7)Vq@L_8b$*jk;KTn0bCwksDm_9e}YR}6njCw`3ngF12$%G#~hRy8bKRi
zLDAR>4v^pA0D-X~hIN3(m4s0Y1CPDyf%k2JMh-#iazW)Xn*n$bUkX&}f@ZK$OH@`i
z0k9yb{sV>RbZ{bi3AS-MI0|0YGJ?ma*g!LXpsnGMQ-X;+Etm&!T5t&{4Jm?4Q_z|R
zaK{i-=n#<?A(}wTta$W5-3U<M0NlG3V3h!gRw%$}$udwA2E2j=)K~<qQ$VI6=~fBU
z;S>ZlF<Iq7t8sO}dL+Pyl<R>9*Fa@Es1{LSRbmqWb+<%RSk+|}SVdGole&uFX(CYt
zRuNE3NC`2@jOf6z+D3tfQCLNpCBdUO84BQOMq%*C2<Uu1Xu0GK-fAEM>VoTo4#Z*R
zV`OAx<%67&3L30uGXO2lfw{+yl~at7Q5<YEC!2RBD=%aq4rC&9B9@cQ1STB~W5mE1
z;3*C8kQHbU0bC65+JQ#wdD)aA^;tO)3RyEiM?`xvvI>G%b%G9;hP#s25L}$j1}_l+
zoe>X8K4{G+$hpzrH3s0tKXQ;!Kjy~_daM$l=_3n;2t5TxHf9;{M5r<-Zwj)ouyQg_
zt5;x=V`XH1#h?J?+rR`ES(PK9qd}lG8_Zkk7+EEl&wxrpHbv07xOJe6C@L(%0ve^i
z2I{PeuyTrlmg|7x4ZJ@dbig9)=qMZT8On^%4G*B!nm1@s8n}(A1Uf+z)FlHA+KI3#
zfloRCjU0l`Bawl2z`>)N;6{KGt2mpmJgclKt2n6hqA1KN%O=9g#k`wQfmNLOFlae7
zn<A?sXo{ARl}nygocRb;jEjwVH)wE@`6yHXHnInr(9~666$dZ=XWq%k2wrr;%4P=|
zY-VH=wNU`g5^}OJZ?A)n0)y5$urZ$l4Tgee`dGQvu}XvI;6P1MMmA<eP>(!*0;t0Y
zS*pqD%_?Ti%9+k8timb=a=5;*2zX|W6%?SLS_2$~Y@jU`yxyRi3DoTZudxP4PHVj$
ziyW%}^KWps%7BH1l@YoQk(E=N&4xt|v>fCg1EVl_4K#Rh0K`Dh0wv~hJ+OvONJ8Qi
zXY+z+_{adR=vf6KS%q}LBOIXYBB2i|6a^T)6ue-IS8~9^YiwSuJj}wNb<2#PfnHF8
z5(SNNF|vUcBk;z7%MZ|v1Z=j@=v4$2>7XHV7f{Z!VdYg~1+(Np>yyDd{5-(J!l2=4
z@Q8^rtF|oU@JuilJVpvWFbUKp=LPkPMSWRy7+FPi!OK{5z^N3xB8QC^JT?O={Xu~U
z>QjN{OBmBw`I#rxK?i7{tqdhrM&@o%5*85!=UC7nIw%fULB|n-dKMr75zw5XKC846
zD-UQ51*q=_Dysa!c^kY+9K?keMZ%!M4m9@ynl)r)V}1x~7c)-=S396(9-uJ>*x_Y{
zkn#y+i#Ws<ISgAs&HxV=fy#4aTR=T!PUzvGx0o2cK+W~3b&!E8$bbXP71DyNJfJcc
z)J_5oU4h#+ir}P>0V+x$@dfJ9F|v8F@PiDJWCV{9f&(9vPZdFhE}t+s4W@d5n@NIf
zpk+nifmKja;ACU&t4G)lnh=4wP7cL($l3=^Hi-40t*WddSnOX^&&aC6#t3pFXgL^Y
ztp^rWOY0fIBZi>d1}ct0YY;)D52!!^Wm-OP^ZOVRDA{weF;9So4zkNZN^y8+F_L#=
zLCs)EP=IQI>Htur2!IMJ=5Gvo2muymP^BIT$`Ii3YaZ}cKTumq3zU_@kXby;vLLZ!
z(8g?W5GxbZMBO6{s<%Mn;UGVO+G((P22mqcJ|)ONlRC&oa7JKG2Mw4@fk&i4F$wCq
zgK`+N6ez#jfgA0DY`)-W9|Q1R1)w%MC#XjPIwVHY2;>LI(Z{^dRX-pRP$C5R)fm*>
z<uzs%6b04r&}~iN@ti_0(8>+ad;@3|6G*KR=sX7nRw2;xDo%A!F?52ViA@2#q>qnz
zLOp1=oI0p5W3~VdR5OB%Q3M^o0ZMLeAc>8vg5dn10Fp9<x?LYs&a(>Yvgxz(ikN~<
zRptW^Zm~j2EM7KdbI{?apn4Oelo7Pb%?{1A&fu&npaj~#3GK?Ta5A5-wP9ff?@wf8
zzQd?c3OX;7c}*Qc@G2vCu>#1o%r`*8D$Gm31t)lO?_yA~A<V+ee3y|CvP*asR0I_M
zY|K{~8QJu0!Ae(yB|!dx+jj+KG%xc521Yi}q2;y?*`PT}Sm_H{J^={{M&>54#h?ZY
zn*eCU5p<pmsI?19GIr1bQAJh}&}18^F)G0Pg~0}tfuSS!pg3jjsJCGgWfk-U7qq<K
zZSvs7b3*p4ylnE|<5xk}DY7y$uLQXmGQkVKHbx&b1*ia?Qv@wu1?PM4sWHsg81+CE
z6*$^Jy20n0ieO8~Yzlg;{A_%zte}Y$P|KS68YAN_P!iS#t)pf&Wb**sNCLW|26QBp
z3TU|!*c?VSVbBJi*(~52Rlxf~SlMjB?Qv-ZR#sIuebC^gurMQ|2xN+!6SU9<lzl)e
z#nM=LL7hQHHfGRZE@+n$BQuWz$i2)Z;I@o7XsD3+7--TL)I?qhF03I#G;GXQLBedl
z(AjB0(0s45gD|TGo3H{at1eq5n90g&-2`&s@><Z*Hlm;jYS6+Y76DcP=95g|ZM?HV
z8-&3Fmi%6<NUP?+{Znc1Rz~JD(6BNnH|ewT3WF!@K*fLn8)#n$xKaYOra;vNw3Y&o
zV1ShH3bV2rK@$Sxv?tK=3{G&(#|EmjS-=EnPY;tGq?o!}0uFO0Hdj#D4mw$s7209s
zFkl6xA}h#o!mPdutdgLHx1zAHK4@kdRD*$MJ3!;TAj?^Wp)DnFvIH&R1npi51r>vk
zX#!5riYgUQ*$5il)?fo2qNlH~ZwmwZ`nLM|(1|3_N$k*C8nl83bXqTHhaJq*polF6
z<t0$9#9YD%?h=D{|9}P}K+7{3A+uI2pv=nxDpx=iF(WfCWKx)kjXB>2lIuZ7R)8`q
zc)c542v#0uQ5(>Cwcx`h+e4U7vVyz!pcOHom3s1^rN|r#tZZyLpaY(4^w{>WHL)^^
z=z*5&U#vz1C|4FFb?ULQfp$WG7R@s<L;43|rKQorpj{)NX!2&22VIsV&lc4#EF1}6
z&CJToZ39}hYRk$h56UQ@C8LZ=uux|%fiwj`4G!i*42;5&;DSdKCeP2x3aZy21Mr~5
zEJ%YECc==_l00nAESjvs%&S3z2g0nDY>X_>Ep^OSm_fyn5qQ-zXpDeW1hnco4YWX<
zla2WXGo!FRn=o61KARV4u^qUG0u6REL&o>mK&!b-g+YZNsEV^KV^w1lVda$r-OOYU
z?%Z)IfOcw2f+}o~J|;HM^p^k|XagPSP-wjj@L5jaWk$@_Hp2RBUf^+jW;Sie!f{BU
z_ODJ)pUnn*#62@x7-UrfQn2tqsvk*xTUKFPa9f+v5?nTdj!Iwy4K;#-UojnYG7=l}
zZ}4JncrbzT45YcD4;rckt!n_Qh6Eir&)R^u7&6&_&Wi^xc(!5FX8|qd`UOe_;Dc~M
z1B&4M&&p;5S_B7a%0Xw#VG_2WlaobQ#X#LL&?*Aveo&K%`6FnokIfdOtqWYWfQkT6
zn_p0oRRBCO1CB68=D#f9os%o8OF%Q+;6sObvS9h1myHozY^j5Gje)8<HfAr-dN(#u
z;D~^hT7hDZg&#C~V$29xcf=;h%B2X}VFvb<Jct8ZVG9ZtP|F8=^k^D*i~zLCPytjP
zf)*O`K@OP)?bd^oW_qjwpe3@9qb5L2UeNFwxJ4cTxl}|4ROECsf$|Ngf5vYEy59g?
zjxsX;1{Lz+pb<vUDg2<~1u}%&3_6qJA81$!)VtHyV-*0emHY!9cm$gg0Wt-=B$FFD
zPrzKR2MWrcplTDBkqwNHdjUW;K}v7P>DVAXs4XX~$SMd9dGII!Xb=TdeSsE&FzShj
zh=99R943&SBqL-^F)pjRK%+`v*Ru*(KnnXu4B*0^ncItvxy%c6{u-Mks~~8PIin1#
zAgFkTbS+rf99Y3w$4ZYCbUvsu@kKu)o3Iy)92>I_D7eARUvAJ08hB|5=K@x4byi8x
z&S=n-gs`x%D5SD7VC4oSO+{fg8#Y5>P?m>w#B4$BU{Hz#O<2Gukd43tAs<173aFwc
zVl0aVHhtX7tiUP)8VH%ps1Tt5+Rh2uf(}aetf1{Jkct)3F#{z;R(ps8*}Opx0VPY2
zLqG`(GLsE<$USl#0$Q6X!kiE4G%`!+fjn*io&@D(W8MwA<_<EL@&G=V0_vl)vVlu?
zA<$wTRyO9t%&@VEQgB8GIT+N@Wd)sI$*KamDh`x{K=-788c1wPpg9*vzBK^%#X%!0
zpg|^(R?wvyAR4sr3q*q|O!!SGpfi&}W`lOSf;8|dvU0NN3B&5$NNA%~5j@fc+LQ}A
z$QPVtwuAcMqVQu5Y}lYo@K_G`oPcjt;OY-?!j~5Kwg@KX4XmL3_@c}gsuWldVhZ4c
zmM&B&=&@+Af<_IP*_hX}LigD+va;HN+xehLaz^m6e~fI*nV>`dz(cj5bO$czLF=*D
z1lW`z%aObwTX@-Yp>m)G0eFDPkd2W=4m^~=#0<J*3bfFJc^)e#n;N*w3F3kmuPK2R
z7(f%Kk|C>z9%PpssF@uI?pP`rAp}9DgW6!=l|7*K0P<{*KK0yM(3qPj^CR$_t|BWh
z^Hy-$0uQVq(gJAk2RSWpvN4}z2Co`p1>Fz?DlvG$mr#OYOpuLPLXTAyl!<t>K;w!6
zP@W2#5vwelFk~=J9=uaX1+rusRMZ-SPHqJy1ztAhFQ6L&2qj2PHs&rCMp3Y5A!o;c
zPv=$u?Zwel19k5NAq%t=m@`4=Z;FHJ|43F|&?)_(dJjC5#N1u0APVVnK<l%Qh|&~%
zk~>oI+<~(!RRkvijItCImu$>WA>|_Twt7&Pky#bAi3rq)03CP3DqsLEco7}|txN>9
z8bPg3P_6(aegy3e&H$iBr~@cHuz*uM==d;JM2hEB98#%#Rz2hv7v>Vsrf86_AX9QS
zkb6T8gIXTKp#B;7z93f6xm2K&NEl^VVKYsv_Mk&w6ih&u2Y}D3V9f+IFF|b`R<?9u
zR&h`j$PXDzG=#LNpl8s6k_2Q2J13hWxCO+<$g051X9H<9Fc*PZ^UQ3Zyu-|<$12VS
zx&?~aLQl`j22z&$>VbE9fm#8e1kcN6<jo?+$_To?0n`x&w<bWPIJg)9)xV&q1mzM?
zF$tQ*Wf5ZKWfK6+@qo@@01cCX%mHnY2MzXs4k;1@jfQ|YlGgH|@eNJ|Rw*_SeO58h
z=|`YB3Q$S`IRG>Z0x|$RqzxL*)&mcN@`8G)tP*Sjth{W>U`K(6*FaT~B6w8|Xs(|T
z%mpoD7i85{1RZe?x}yq|_5?ve39=q^)B_{vAa`5vp_PJckQIZX;Gq^?HW5$($H2tG
z${YY{u(Gm&cKd<ua0KOP(AIxR(2XCUmeD@YMjp@*nV`ZoRyEMNCRiiD2y)Z`C~O4T
zMD<x&!8=n0K%H_$NW(#ol~o<I`~kGvjZG2M{|B{4g+(CuiGnO<2K6|ZLDMUoAn!1O
z?p|eO%VYs99A%zY3A#~)mH82y0w|i;m}i3wLceJP9Bbgn5e2m&?}OSjY{Fg<kggn~
zCaVQ#H45aADJHg55QhzP-UcHZb1!&79k{(_!zu?pBpTAZW@YmO*M%UzfvR(Gf{+C_
zEkO-MQ}Fsg7EsHGl}(Y6Q4F+R15|8-d(kL<0);2&{3AAIK0S!9zEp!oLRp!6SfIZ8
z2rfTC=>}_(<7Z`L?qq>f2E~xEQ`m4HCz}Cyfex#bH|X3LUIkV`@KyuRX<tli%q5_l
zz{IA&q6&)04$$5WW==-P-V{dAZH0WyT%bY4GEjlbrJxUKSwb>^EohuXltr5rbea()
zzQEoGxdY@=c}Vvdw9<#s3uFOvg&t_T&0El73(yt2jBLy~;DTFJ0Wu!I10H?{jTwLr
zspn*q1$EF_`Se&=L9PSM4THCFgVvTZvhlLYfM$V}#6jneF|vW?H~B$VIDs0%piqMD
zOaSe;1kHc43F|R}PEY{*QJ9fY0z4B5y7ZJ2dOAA~vkb_qDGIE@;6-PQ;6-Qr%=79&
z!jBk0$KB2Wv!5`4lI-ew&>~;(U9HTsz~Z1|DFvC=fZ10-T_fgIVD>dMHm5qPAo%1+
zM&_ps3O1m7KtRnnP+Jw;9-I#DOA$Fk#|0VCW_}L7-p?3xCL>t8ur0U_1Eo(;zW_vo
zF4ckF90@9vKtfO&UJHT75y3SuC!{wBInWWwET{%n9yW1SLD0+-<hBwdv%rxC&JLi-
zY*4-Zm4OjzCTxsYA2h@URw&8L3EIsnX0r=&&`LQZ{eowkp!XYs244(7<M5#7k)$H4
zFsRrB4dDt4vVc}rFoW)^gx4r6tgJlDOX?LsQp|T46tM8Y6$9vSK(LytP&KQedLVpO
zHs<B^3ZV7cu;C7nV$j{Zj4Z4mPpzp3od^Uz#|>1Pf(J6CAO|wDSwn^ZK)yBvIfRuB
zbTuz%lv)^4UBNO6Xmky<ycLvaIYF0cfvSCeHt-RFATa^(paiH<0a|?tF8Gmq7@%F&
zptKIkGN3tf@Xk)q#I=zqD<>O2D{m&a=;LJLW94@MGkMtrK$l2>%!X(L?a%{dLf8fy
z7;Ojc5rFz}5OogVvCU3S(DVQ+BlACSvl23T#KznJ+F;LS?+YEn)NNuhU}OGR2D!(B
z6|{sA<T_9q0U0I++SmeKt`0hmQbLxMmzht2RRX;CjZL3bf=yIL1#~{RfFi3zD0m?p
z=m2N|(8^V1B~U3QuE;7N%gU<`@`)5^!47Eq5NPW)X!Rb*7RXerA*jFvA7jT0+3E-?
z6hQ~L%7K~*;HA3ykohjBCU6D-4X5&e<_ir#vl5_2EM$BLq)!mEQBhczRZx*tMjv!7
zhA?PNqoOc$))jO^B*<@|bH70}NDE}{N(od#LYA6<#=k%%BWU9$h=vx82B74$j**c?
z8&YDjfmE{?u*xxS1+AtB)gioWp!0C#*ccT-mm0}|rf0!Z)u3jlA}cF1FC#cZfg0|d
zpbfg<#k8E@%c_~!7}@M0%MApW8|zD$ML^eC8W|Xvu!?~0TN7aB1F!xu0QI-QCoh5y
zO=1Nfkpd=dSXouTm$8emva&&@X<*3*JmxG9nmu4nDFMym2<w5i=n6vm;;aIYi}OG+
z!VO-fp#bd+!`lbYL<R~0_^=izQG+Jy!9(PrW)CQNLXOA=mnx79fG|P?blDUun<6-_
zz}I>*&jnS%;1&t1I`|-Lb<lolJ<w)9&{}*@@&L8lK*0rSXn{@OWm5!g;AFm14L%qQ
zJleFDg^^Vlyv$S>)E5Dr$7Bd<lQ8PBG8#Z43v`qx^e7W>-$##y3shNs19ibcOP@fT
zDn?cr=vgkD4xq!QAiM}x88y&A47iER%C-qKfC(BU01cRfw@lfAJH;@Ug4TiAfO`{J
zdXN@1XowMdzzVoC4C#u3QkEVoFQ`wUEDRq11I_2aOaWbw%gE-;%E=s{2Oe-_7K9a6
zp!O9=GaDm#w=5{_v7xI0CwERZW<yZf2Ff7@;93S;*@8yYKr4a4?I%7~MrP14Z=iA+
zv=<pvWB#cH)tD_z3atFhpzTeJ%*~($QO2P2xmcNh)`IHUcDRTzWK9sH!U1h}0G&V!
z?o)%#k7tG~{uc%hOoGxIDEcK>!KDOvd$a&(VntX9dOtFx=?G3g;97~5jkyD{xlmZx
z+typ(8+34xFyssyOHh7-^dmtb2bvTB4Rwft)*XQ|z7IIkIN8cTE1?;gtr;hPid|+8
zNI@e2D&Y*!61y>IY!9;MQ5aMefbNx)XBAe3R-=$22b5QM*hE3)8;A+<ydt=C0yPo9
ztIa^=3oDxmWa}2Fga%FFL;C=rmMkMQd4M$NGctk>>;w(PfGdXx&_p%JA#XwBmLkHD
z;A_XgBZlB*fs(9zpz;Qk!NDV-;P6JYBp`JaWPS$IeVlB}?U24PX!;SHWmv@_lYyX3
zf#RTwToK&Af{KE?2O3;w)B~Nq0y;T?NuJfhfK|<l)dGCTp`kT+SiuTZBeLnTTCoYU
z>ga;*It9(@gUTIoXqTY{l<}EwgT}!{ScRG6!2?2|6DL`j6+j&b$WcvRpcdegI#BDH
zk&XEtBO@rc3NU}KWn=-J(#d=ZJUR=?gP?gVPBtIV;4>o|zaFa`<X|I6&>OLVPLWUm
zb%q$(m@^buL7R6Wy;FTQ&~_IU&|-d8HhnfwGgl6zm=$!~1V89(1JGqKtPn9aMB540
zg#e8j3ot^CHxp<9-vb0)Gz;1T3JLyFNX#>uMz9Jn=jyS5i*L|&8PFUj*yEs+(BynU
z7x&76&VWLcm7oR9tn$n`3ZQ$X8QDMsDXgNP=}~ZU2F1D%8~FZIm=8d!t3^PIfO8aB
zg_J;-0`Y^!9EF$#LF<9RH%GudAq<`TWd%=?fPG{D^??t#tp^&R$L<AXP%)_qs)0bI
zwg9U-Xb+(tt2(F%fVtk-8$5~yX_11Khk3Dp&I|$1iU`5745;}a#wrf#VS+C4flpa*
zvPnYL6i6ts3V{}}K$a45s<BFe+7+O*49eqDimZ}~pv!}#<UpgmQaWH#i&X-2q7BGE
za9spCq*V}fBMs=7I8e(5oVD~=#hCqJhqkgYn}90{HqgE%E=DiV$%4$~UZ62CP@)HQ
z#@#?i<g$TJon{q*?&1I~<ASC!*cl0m;JTa@yaAkt4Rrr4i!!Sa^CCt)MR0EnUTz43
zcX8hY4R=Ax3rO&QZoY>YX&eb|g|o7?KxuDi36&0NSc6VmVPa!e0y!JhBLw%kAS;$x
z3|SeOr+^C#5zv%0q(AnYNrA<Xm6dsBEvSvn$c&p0?!YlWX95j7@-VMqgs8t#2h)Fo
zMUHtAivo)w^Sf#rHf7Lx>8z}*pm8=~@RGt!;B3vvC@cyZXNTUQ0~+=Njpjf%5<^?m
zpaq0C>llTFS&Ud2nL9v%0ofbG%4Pu4%qh$QGWs(kBMYdj)QU^NH%4%gz<eI;Ylzh%
zAS=Oz3B)o8sRy!hB@-hk8-hv_R?tKw$fY3Vth{U@te`Vgd4xfSMSyzUjBMcX86?e(
zOpGj`V++549fNEatBE(Hl>xch6iH7DXt@aJe3E4_O=6(78+g76bjrE{Xt52%I?!@9
zXdr>zdXbTlMTeD<c@0db2>4(p@W~wDLrfs8deF434=BhO!FRfVd;_`wb`e-tBnvm_
zBtTYSHX9ZlHhx<WSC|#bWsHnu^I~JZ4qmY~2izHDWCR^lEWySIsu&eOgI1Uf(8>b|
zP{vhcWE9o6wY7t_tw99<s1g%_Y**C>pG?UJ+OEnf!d#{YF$vTMV>MzGff-<HYikGI
z&j7lXQBI##jG3o|m6O>}0W_+?!z=;XiRhrf$`3go+m;dHQ&7DD>GLr%M}oRK;EI})
zjai+MRg5_jRO3Jno(2^doNUahjI2V;(V&VJUJ8Ora3!#DNF@U&=+JRtR#pShL@xNi
zC1!Bl0PcxGQZXcx++_q!7jUvM&t>F*^n^i?2)*eNoHfA&=;k>#@co3~Bc&LbJwT2X
z2Cc4zwxdCA0$q*<F0fc31%M%Vco0;|L-@w5f@~t7WyB!g@PSKhRyI(73Orz71Zg|M
z0@Q$&hj}OHR$meD&VC-q%>l<)7+HCl_kzXQy!6<Z53_)F`fLLWfQlJC=mO#sEFhOC
zvhpx*g~)-1y#$%3f>*1*23-Keya3F80NOkNUZBf-5~7EZQ54#3W(3_I1R7VBR$x_7
zV3pPb4F-a`T8zv)z!??lL0Bi&$QC*c2pU-wW@TjquP}nR2oyjdVL?!r4&2rOrFhW5
zzaVG`6EYhQN<6G=6}H|!k&u&oIN5ByL1%ZaX98WM%)AGjy1|Dt!tQ4RrB+bGn0aBH
z9_(y&5nIrzHn1q@6hiQ7PBupHVY^Ih%tp{74j||EGqHho)Nryf@2%Hkm4RHa0qWbL
zc6*GWOJ!_@MeKxyAw@rUy%D(R2QA<Q_ePknfma<Vf~$rVpdbRvv&cc>miao97mGS8
z5A(`e1<=G1D;x6-CPuL0<#5Fy!@%JKk^>JSD1%%0p!j6wY_g4l)*{}*pd&On*_aPA
zGJ^6Dt2X$66jsoolb{jGEKm}~-Zldr7!6rMED8@5EiV?(1)a>tYVhR)M$pP%&=?;h
za{|bGa1#VP&jU%~26l{$qHN4gddzkTpp}W>3<p{h3c5p*Uxk$ubfzFUD>5>tfeZl6
z2M2;?`@lIL(x?MXRe~<skz)>3U{wLvx}Yw*HmF?$TAqa2j)NsTP+_1Big$Rf1l=U2
z2P*-Dp!@gXG0z8T&2fTnxB_)fvFCjv{p_sAY>Vb+Cq`C&6;@V|pFtiF1}*qZ$L(v-
z5q1#ovN3CeO1f}Rsi~;|nKT782IZKYA!Q<@S*HkZj6gijrUy|9KD!Va^bkLR#=4b3
zZurjtnnYuSWMp4(Gm)D)WddkoL>+XTLMX_2!jSP{&@h(}8)zdCbk9BLj8{;TiU)e4
zDP*YISb>!T)K3O4jDW5-(qq+NKER+Lrv&NjGCP2F>{u(XYACaEGP^6-u!@3C{?KPO
zXaY~)fhOsBA=~WkfieOpRS>gE0CraD0wz#j$B+?v?kZ@y1hlUJ+SdV1>VOZ_5M!=l
z)MMoaHO8UAA^~b&AYbAQsvMX=YBFqCIl)to!psI<knTG#Xr5k?6?B8GU^eJjSXN=s
zX%xJmORhl+q}$l^z=vb#v5JE&k_4|@Q~|BWW77whKA;t2GN2mG091oR7O@M1_FX8m
zN<t1+kmF_Z0!{jIGBOKCfEGr9#udOldvGDZ%&W%&y8Qs`GEkBgv1Juhv}FbDY+(fL
z9%lvJ*9h(lAmU8efRPb&<vD2dUxdwujait{)}ED-8JrYBd}+|`T@hw`aA$@Glz)U-
z^jTTK!@4}IoS<P{(5c^`h2eUvpsnIO0xY02ftlSw@vaD(CIj92pv%f?1iFX^bnPbd
zqIx~%dkn}Kf}ah%5|@)%6SQ>H1e6)TcV&Vi8+Q=^yK74hbn6zV;^YKp4t`MC0OCUY
ziqag=0QmrW319>(0l)(<kbxv7HfDZsEsr4BK&$<jXM=XXgF1Pj0Tot!-P2qJR+KIt
z=<pp-d5yP63aJsHIT_lo23_<7Y8VjLBQ*o{NOSZ+%}X|Bc~Ezb6|zH!Rhi8j(w7#{
zW0eD)wF0RoS=o%)KsScifC>}Pd=O}bzAdXHn=q@GJgX41Fesbmf{PeX$<8du2<m-;
zf*IjVW`2;*AT>L9<Od>E3K_j&GzQ;OSf~d%I}CKDI;e{&2x>_{j{o9h125WyjC9y3
zvT}o_6d9RUvxC;4f#$eC^VABgJdj~3P&`4Vtk;9GDzsq@J^2R|Va#lxlSd(aVOH>-
zEno1U8EBvp()9x!0n1#a#|AE+SUK4Oz+nwqQ_N-n?(8{(#;2QE8JT@Sg&#9FBWPC=
z$diyj<Fp3Flp&~52U4hS>+Q|T3cIw#))txV?F~6tpN*Lpw6O!UcN%OaNH1t4h>=l(
zm67>0xM*YLVJ-sM2a^Nsh=J^3;$ei$d4lUM=3^X;dZ1Ab(1a`VqcX4-P~RC8E1)TB
z@E{wg_5}@`iGt4Z0!>CR&jd{!fXWQ!B2X|PmvNx6MCOI%daSIHprH*xRy$BAD}stX
z$O3mzMev-1F~Y`%jTv;i7r1)`>H&eS;(7&kJ>=HDUJlTuKCH~2%N0NZ%m_aCT0bQI
z6E;w>1<RBm#ca&o95$@1pq>UJ^LI!i6*99A@ja-s&jIevu|XzBBtU0WFgLT<Ffs~*
z&Z1?023m(CA|lDk%j^IS7H|&$6i1U;d6@&iLXhGCyd{g3mCZ*y(%wN7yd;&Ejrkd4
z1U#uofY$D^G4HO^W90?SZL&i47lVdSAVxs0+GbP*U1`S3rYH(pC(bJ7#wub69*Mld
z3hslrfzIh=UR|ZfYRP<+Re@Cwlyo4;2z34vD-ZJ)aQy~qV>2>>7e+vnG^hqw(gTeQ
zh%@u(*|35xYG7o8E$Rgs!@P_MYzHs%N^mn6v@saO0L?}~8$kN3JfORP7+Lv21CKr+
z-+^?3PWS_ve~$rd063UHQ4XqG^o7|(SY>oT+Y3OKT!YS40ne?0DpY;YDn#amm7tJh
z=7dxdduth4SwvVxm@^nznM6QaBbaZ1jszEG178Ag0n{G>4V1Ilg7*t^viX3Pm@@AI
zUCjy}6=o4-KEn<@{s%Pn2|k%!0o+6bO=Yv`i^F>#ykHIBZY3jV=A03_?1W7aGOY(X
zwE{E^VhEaCX5IwqDuXVu+yhP*$oUEs2+W6A8DZ@uZ(&Gj1zMKQD$EuPI;WYH4OIMr
z3o~0*esHT3v91u*-Q~1p6#<X?gDZK^{aR42Flc~^QIAy#ypdcC6o<TQ%qti{&I8RD
z*@LGkL9+s4>7bEX@CDesYzx4xFJ3l7Hb%(Z(rln31HtFcK^v&drJynoIqQNJ%`!KE
z&M1XtT}4ntg0n8D#9=<h3ffZxZr|~Orj&(2Nr+VnG~*`>n(^ah12I8MUW8;>MODBj
z$nmrJunK`X`=E=l*qG(?KuZl3Si#jO=&W2wsPQQ1u{weZ6gE&-hY8#zHez*VV+6%7
z8}oF~9s$sGeWI+O<KGyWU$8T>f(E%5k>VC|vbVT8XiG3C?7<s{Km~&WbRD7{D-ZKT
zP@)zQVKoO`Ap;6<$Uq=yX$3PkqX_6$q7p_{YgtwW(E0;S(8dr2W*!>_Rvz#y4ruBZ
zx+;*BR~V9wdDxiOfhu!R&=PFs)1ZBmple7$t5diXqCov-8%Qq|)CS@O7kZ#ms+d5%
z7VvluBP*{yXdn7IklRE-hBBXJ&|}^KGL(%u57MRv4H<)HJ9yccZ!_pY5-(`|k1(sK
z0cZrBRmm3ApHTvB!>|R7%6PE~GFLEyrUgaWn6n@^V}sT#fy#GDHhoa-1X(8~0*O^n
z$TNbD3yK1V7cZMP)Di{Ik|S_vN3e>5E?NYw8VBh~2esEhsTX9d3}_*$gdwXKD03^Z
z@-R0+vJ9y9kYN4|-c-ZfUI#iO0#yCMyWo+mpqiA^7PQD5G%dpl*|p69TB1>@2bytU
z{>#XSoUB0;PoOQ7qHN5+YB?YtQvuEQ=)uB4(HeYF9LT3OdaM!(tdiixpE7Lv;PDP;
zJyv<hkjJVzJ<vcPD2YRI0*D1KG{M*3fpQ#ZNe?)6f~PeQRUUZPBy$%tX!RMWUFZ!8
zcTimnS}@HD>Ue-MgM<OA6sQa|0Lg-KlntwvH|#tSE$GQ2p#HI<h%l=b8$T<LR~oB?
zLAtI!tE3OBgbu5u5~~=<0MPbyNl@R$lvR?sQbA9jl{1b_S{T%>5drN?0H-F<?if&~
z1eC^@Jz<FzR1h-hfc*g700usmh>;C6P{OPW8u*z6E{Z|HVFM}|;GqC=u^t=qTQ)|}
z_U>t5RU(XxES9VsY|M*5S8|E6vVtaHSS(q2m{-+-YHL>JYm5pgVaa9+9a?}?Se)RI
z5gyRpwV+ZFyntFCG-=9a%f_4lswcrcc+g@iX!V0AFF`Aq!CM7Dm7@=f5a@OXQ8w^M
zBv`Ek*kVxq16e)@y2OY{53;Biyk^Rsfr*7#9yFaStq&f1Qef3oV08s~6tvYDatEOR
zXxpGZ8|Z9SRyO99OpLzJLf;z{W*`&TK&MqQgHi*8U{hcb0(FDW*Xn_m)3Gt{W&(v0
zBlCPvPJmPjpc6kp9tLG+upc1fzz`R+h=NCmnb<&+U!b@GnGH#oYzi!vAhTD12BJV&
z4%8q6ErZiz;|F`12Ndj#%m+9?*$=#}6_l;SEkOM}9z9UX15aD{D?l=}9H`R{K7sdZ
zCFmk}Rvyp>Q1F31VyqG}tc)rkk^>YZYT!dnne<pewE+_-Lu#{fih<5pGhkz$%mhA9
zP7u<&1Kl$NY9i@_c7K4U)!F31g^3!d&l3acHDIW82Cd+WW@SZI$;=17eH242XzCL*
zS&yQ20t;9%sQU|A!ypgZ0m90r42>-V&<PyOo#0f<2I@F)vN3-HS;@vM&!`8kyOZ_A
zz+)1iu8BV6;9u|<8E7e_J}a6d3_<6dgUU2e1c-sgZ52V?8<6ukLERcqF#wvr25)8s
zt!PrQQDEieV+GCAvkEgmt!5Nu)n#Lz!NLeWE13CZHMrWX07n8SWq_7)!fx&2WMiHQ
zQphIC%E=Epj}USIHzS)PC@8^ajB|hnv_K1}KtsWd;GJF2&3q3*7mW&wfO^27yac+>
ziIGhbev%(A=p?^l1yGPMvN7KP_mIFvF{3=IWCrLqUeFMYB&bwpg&srz%2MEZ160I;
zk_I^OGC`I>rm>3Zfo5C5M~aGxK?Wt2S;b@(ScO1kmOi*=1PV1!vSsCkUiAsy#|}!f
ziVz(jrEJRJrE_n<odF`3&PhO*&Q0O~7hZa-jAD8U3XqLLC3@iHos4YE7eK8WynRMU
zdw`V<(s`6*1?>s~cOF6gbQU(qd<ydpW(5|I+=&_m7B*H^=2OgiVE#5ZA0kgYAFiKO
z%#oE*lT{wF@e;{Kh>8<6pvhZSPy*)$?{o(p3B<<y7qUtQ)cOYX+1MCaB%w{EhFa+H
zuOOF-f?|zX6&yq$7Yee0r`MSUY(VW4Rz}4pP#iPoc!BCk(5YB#%#GlKf55p3YBC#W
zf_Ei&9uIWJgRnQK0ulxlN~~<4)b<Hf+=;SEL6-?ZGK(D~e!wXP+!P0uCZG!o6hYaH
z4K%U@QD_St%mQU3@QI_~&OGQKBv31om6=<Cjrkx$8puJQ3=8f$vw~Leim`$Ckm?0I
zEeG;SGb`wzI`DN;pqfq*vUVJ7WF)A63Ms8vLE{b}>%qr2gY-eJ_5k(sA>Bq5P|{{(
zz7Ot7g63vG0SPw78_7r?VJHW5=!KvfgaewB76k3mQUtjfDpp|wG63XY&|PjIt6A9$
z85O|es*o^JU;{U3LF<%OF*BC1axfoc0Jp*&_1N^(*z~o)F~-Se&&CKUg}_Y_Up56O
zo0rX-O+kW93*3^1OfG?h7{McppnW^wOvuS*2pUrZ?REos6}Dd#<W7*&3?Yt%coXDa
zHqa&-$f0PJ;3`Xz%@$NgF|vs$gXEd36x5{I6huUXL5o7!Kmo~olYtR@E<TGSs~Gcy
z8a);^P(AjOSr5D)57co1cL^0(^+8QbNY4~(CTPnhDB_sdn1w(I7Br*8W(=<EK!X>c
z>zJUI!h+{PSizSB>#_2BLs=jPfodx|P}G5jGkL*{Ku$JYP{@JS)Ppv8u_}R=`FOE_
zHjy&lsb&-r7G_~%Wd!ZkXJr)?Ghh{vVr688-bByH{1244MHoTL5jjEIe84#h)Mm2>
zuM%gJW96}f>=9*TV?GWWOM;j_yN*#5V)zA6?g1GN(ayZD4(w%bR#rAwxX~atgSKyh
zf)UhYRuqOMQ*b{HG(4)$$|@`(CJgF%KsQs$u?pI;f`)HEX$suJ052l~MJMziM^L!v
zfp@VovN6v?b>TwL*?!=pWXH<KCd|q$&&sC=?U{ngP(9Et?yaJrYXK0~T(Js^v+}Wl
zPLtAN*0y2g1C5>vGb@0WnI|Z)$}o$8SXrRy2Cg(#KG2*kD>E19)N@WygK{?HrUnu4
zwa%bBdLZrtRTQA9OCiWv{b1jK#%REC4Ow1%lLs`|1nLBXFPvrtZOj0*w;7q06%^*N
za<MW0E&>e#Ev#k~5kYBvf@(HMX9{E)^9>eIVFNma9b7VjYG81%FqMEBVQk<t@*eUq
zg33fzP}5o-v}2Xc0FkaBOJW4s4A?~2<c0P1S$RQgYIN9`{}q9HZ_J;0Ap43$*bG>C
z%|L+_2I@aCtAOqn18Wel2hUaTvOyN334qp0Du9kK2d#x-V{SrRgCh>Qs|2$8QJ<C7
z5tJWTz%FLKPz62pkI1V@S=pF3vf99W0q!B_fv!7cV?I*_8oLEwLkbpV-UQl|&Ss>~
z$_d(a%g<KM3Tkd}f)<}~gK9_6h!r2JfDvdrA)^c{2k5>W&`vW}<{Uk61744nRe_CJ
zqDj~mv@#lWKMN~!3TPZD!<Nl~O<xB*X8>AZ&nhBf2W}~VEP%$kH!G{5un2h3@(Iu!
zD5#R@1rK#Ws$(|hk04<-`)JsrWfp$s*19H8K~oOuErMs%^+DS<KtiC|0XAk|Miv1!
z=I4-`o<PIGX`m&;Fk3;3xj~&hQ27M9lo8xe%<}@3jI69|u#KSbyO2QQkg9}N7<4Tk
z8}n(<_$z4KN&sZ#HeS$p4QPQE_{f8c#h@I-%E&wq+~o&_9`h~G?oQ@q^&Ftn)j_K>
zAVm&nFb^_(04f5Qk1~L=J@X#Wb~RAi1+|31eG%x@pp2}X{@{i>Bbz+99Asuwfbbbv
zIqe}VOc_=q&|wSEBN+7c4IvY2;KNiQHIh7d6DG(kFrSf?)tHT$6SR*P<OpT~1?EZx
z=5hr#W*yMF&j`?%9_XxmZC1!st~hAyMum-8n$b=eJm(<-x{R9*)PDmfT{cEGq=H`u
zWTuh|o3$`xpn;Xm2YfO>A=Fs52+%!Ce2lDS;1w94u{B1}VITU;7r{re><0%bixn#)
z^I9;|*4~yyh4~zVjWDCIC<`d{n1GBDl@!$nZSLY_h8ztGT8sd?ri4?Nm6chFQIwSv
ze9k%xD3wnFB`}cAO&}A&OT3`h<$-o|fu<@zl>sQdg6l<)&+L7`%V}l7hkt?66R35M
zNMA;g&;<_4pezhtrOU#m2OgSbVPgcJV9o@pK_Puu&{}j*aR@Kj!H3c@vWnTVn#!|^
zDY9zlvAWB%YACYG*|PG=f#zj+L2Fwf$M*2D8MA_JMgSFF>TH6n0-&W4wxA<}RG|Cy
zVMnBZ?;8a#WCr<#mCaZbl(a$ZebBNokl#f?OL;_DxxvSOh=7kUQv`Qg8I@SYv_Vym
z2)Hf-w_?DXqgcU14d7k^8+cTj1I*?CDdPYu1D$^fYBGT)PB}m&4u=98qcBJwG77;A
zYAqod!vQ+ilmisfF#QZnEMPt06{#R&7!_I7pu3h7*%XkB(gW>-L%0a1Q6g-j5dSEH
z4yP1lRRDR|P#8S$tfa(h09vQ41RAdq1|3WXiWktjSOl#EzAlNCO##%*gw!vfy;h(h
zE^yn6m5uon1EaSnXdIo@!4`5-ggmPv()Asn!|E6zE2Kc>j~y!`__#e*=+Yoioo)v)
zos}&LyrUW1VF#&2T7?g~4hwXKF)L^`gcH<72jwq_BJiqO_+&2V)=BUJQt%lKpe+KR
z48)?sysjS9Z~+~S)(%PnpcNq^!k~-HKskkr5xjnd18gb_Xg-j+%m%c59W+D$x}F;3
zLpD(N6STHj5-gezsb4^oqu`-3MmF$Vpa^IpL4c8ko4J?~e4{rT=xllg@YuB=coDIL
z0;@Xc{8|Ojl~-^f9jK53t2v0J2C@~*5@aq=0G*O6F3zIFDk06n%_^YEs!{@SCCItV
zJT`2Zpb8M2V%Ydtg^eIdS%y{E0TLs6EY_^7ax6*^9@uwW3ee*05d$N*Qkum9E>1ut
zn=lJ#O-6qOXp<m|H7g_Y6-axLQCQSgSTqt`mUKhP63}1<D`*QWsQnAN%K$uV0BM+k
zI>fe+ks8SH8=yIOQ2qxG(t>0`!+Zj4&<bCV)dJLdF<@in<=CYMasnIk_d0O-&B(kQ
z9A)6^7e0Y)1|9VPS|SJ9IstBfMt~OCfL0#KvNAGn20IwEL=c=yA;V9gtOm)7P*M+6
z1fQ*A)Yk{^20RC<yg)Z(i9q%nf`+$1sht(HRt~(ckQsb745;)61w3rm475K6&8VQ;
zBpAVkyFDY=Scua>!-6c}`%*!RdstLiIhb=4AfCL!kjBc%e3=2%oE8%WwUwA}gZ3|p
zfUa@{RhW=rX3#biP<aOKbLxS|M43SQGeIK)Rp6=^G-?4l<__dI@BsoUpr#+F<qbNe
zQ=g3yV&BXf(2zGH^IlMxih?8mEF|)oxzoH^8JQvH8w(3VYFhA_R;-+$GtJUiLB3;V
z(}l`_EMkL3)x=8hDt6{8pjMU$q(lIPAjrv}b}*~2Ft|O+$OdZoDzdP$3NwGL0_|#L
zW$t2C04>24X8u+M-*m)$stzKyjS+N|+(pn4hs^6icQW%sk~bT37b~<#1RV$f8s$`B
zWA3hEWC5Lq0iN%K4OjZ0mMey!Wh3CmAINd6Y({LtpzZ-Hn<8vu0ch<8DCEJk7bMv9
z89}upDE+ds*@HL2fQNlRJ#uDKFBW-t2MZL{;D#{hI!QKTRw1N5J*cZ|12OLisGbK6
zFZ|bI0Ug)E{2g-Mm<<bPxgYc88pz?0pfKcwBuG#m12^tLtusbm$eHut@g)`>R$1`0
z4(QN9Mn?2QQz6IYGAgquu}U)+fUFZ_W8T4}$12L4%y9xVxCy$Phm(!DSdYa9G{6UH
zmkNXC+d;D?5(=zxpzBJ&)-%rnkDh{(3FruC5zq__DCdFlA|x~o!CefbHi9iUFhG?G
zcz8vX6?`p&A}E+3+b>xaAlER0n%AKE!4X^%fmi*V0A*xwcZo%oRi1eVc&(KJvJIeC
z3g{|1a3R3P$SMcz!-8r$Md-;KjI5xQW8j@epqi5r+Rn5FHwYOOSvlDhAWSw!ND9}5
za1|juHeGn*6}0et3n<?}7M)5euuAB&N`mJ?!3}<JXH}1tM-?*a0NRhLY76PMDS%H8
zXM@~`3u;u$vN6A703C<U$P8JO%!>U60Z`em2f8l+w98LV0Yb9KvhpxLX0T!5hRpsl
z&#ecSZ=i@`Wn+HKzzEvC3tD)@3ZC?Xl*^oKpmkM@%x^)#3Tg=wlX_$!qh8DtA!{E%
zl`b<l@iK!iEdu)+6y4yizJeZ`KGeUUpk`tN-Aw~3hCo>rQVxUa#~IKwC_&dSvGRa2
zhyt5F=;$uUiX%n^&=x^yHW5}$Jq6GqpL$BHta6~e{QQcnta5Djtf0HNd2B!_1|GbQ
zpdk^ENHo*|pbO$bBjlp2uv=?E%f7)`7j&Mw9V<Vm{i7&s3wHr{(OC*;9)Lv_)Y50+
zW=>Vm1F_{8K_}YigT@a)%|limHeps_(3yFPETAqf^Gha1aFk33tsG_p2{JN20oPQ*
z;N~S{gB&RAl;Mez6SUKj2YmlFhy=~kg3js%m6o8e<YY6l1v?hh+yX891ksGlJHW{g
zR2FfHfO8h?gcRtA7--m;jky(cP5`kntN<SNVPgIXKBWb8Dl;4N0&p3?2EIn`8WT8~
zvN5j)o#G8@vVr^t?h}JJu;nO*pnwKfk)XyE*liq2(B<5S^1&V)$V)&e5WKQa0le`E
zJnJb9I#@)M`F<_vMkN*I1x$LNgGShx+v-65b5_K8I-nY10Vs6YR9G3AH-gLppVI=F
z5IxHXK0_XK2tFk2L1hm=n;5H*7AWpOW-|W*dk@7(CGaikItrjJG`NW(3##oHL77`0
zQUI`lS7L+u9iYkqwxkX+S__Ib*d7LOcY_ghQ?3}B9vky{P{T+#9kP@MQi0flW@JHA
zouGk1aMl11P%=NM1D%r22EA7i68c}k{Y;RJw%|iUML{kCt+Ip&aX@A_n7=VFf^JM_
z?gpn1M$iUa&_R;S9bi5rAcPcIc~l?=G=ul>i9-AZ?(u-<O+cgLplk$6sLY__lVPU6
z1Jzc{OF^j{QmZ1ocLTa_5flQf>ELK*Wn-RL?*$z_w*d$EBUpg@gR&PWU9&*%tz|w7
zPIlg)dPsp)7-ThQ#|0=5!3QI)s|8&q#mdHfg$X=44l<67`4T9BgRVgYb<{y^S<v~|
zAg6#9)x%qbV8cKrff55NBXa{dFd#iXa0>vOEI?ZdKpT3Y!2zl|KwJ?>ds&_pa&#Ox
zy@NGDD>{%vn2&%GAIKfZ{sQ;@nO}p~3qa<4L9I7P)GI<tC+PLd;BAtik`gr625L`%
zdWqm#j`<A(qqwjzs57X*DhWDrjFpYK0z5qhDjmRgCF?=vM<5HJ!TV#O!{oNGV>Q^A
zIU_)O<~r*c6<E2MzcYX)F_~Mz*XV%iRdH4!8E_~!)`2pe81p}{qZNh0o&#^@0eKD)
z$ULA60U^l-6i)E1mmtHyTA9Bvz_TBy*96LP&_tog3hG`ed9hk5fUY9~WlK;4n?r$>
z3pA(*9<zm2RFKIFP_ThQTaY=!i&a!#4^+KzgH8r#0gY5K&tlYLVP|Dz{s>B3(55>F
z=!8U8He+yS!3NZn0QG4=i5j%0lNY298c6z}Q}*mwH6U5995jb13^I?E4Rl=!$XcXJ
z{6MLjk$EvF{fHv<T^+#T1X;T!%nVKgY>X`ItkTTpkfXjly;#^GjR9s0P-+ZhWdt3N
z1-jx%2(qda6bwA@(g_l@U?*V-TYX5-3Nc6Nfud6rR0M!VtAZi^1ewUA0x?1saylY%
zKF1MZYM@RQsP_T67?KaP+W-_^AeV!O%0SDmAjgj}tAQN=YIHHnftk=@6>pFxNXfv;
z1_>0<H87yGgB&Oi86crDzaC^bxV6OmhyfNZ3qYX@zFAisT1bH#7vREJ5p-pg5GbdD
zT6K`{L8Q5x@HA%#j(5<Zk>DBu6rW)I%%Y4epp#UlGU>4jFh_tIysV&dR*zK-w8;=u
zkAZR=sQUwU1?YSa(CPzF`x~4{!Tl)EC@!e%V&wv90N(}&8j}Jg4p629oh}EqKM52c
z;LBAZt!5cUP(zWIZ36gGW>6atG&CR!+Ewrde1surh8|SkgG@ng58HxTOQ0JFIM^6L
zXP86ljAP7@+lQFI0bvMslCUl4*mzKC0#z=o;8nzsd2J?8(~w1h%^P+me<ZkD-v^!u
z1nq9*XJuvnz`_VN1~d)`E-@ii8G>7X5PR%x8AU<!q>%K?rpn4H4ZiF|31mKKtDh39
zsxm|pECN}j$H)fWjSun&CnykMYh1x8ht-soA9SZ0BW(P?7Iq~TWGY<&(!5nb;d!xw
zS4e|8kC5Qq!lb~W1QBFDQwz3R4{|=|1ZGg;W@Tia3yxJ#Q6K`EA7DNOE;3m7!QNwJ
zW8MO8PH3}o3M0#dk6i*?X9~LA9uzm6Y~X^I4ScqM4IAjrEYP?M6KKgSS~FLH1w3p%
z6?|APbipBL+indjCz}>4Bj`#|&{`Gdmyn}NK%F)oR#`UYeN}5fT{|8|Mvw`t%qLhu
z3rl60w?S5ILdC(IPd1Pwq?U4L<yVKWKx;-pYd@GkyOHfcT}wuA=rPHvfbJ6nB@oCc
zt`93TV!-DvFxfyBS%PkLum^2YVq{}(Vg_w>gPpD-A`0$!aXNu6ewPOwddaWBDi5lY
zAT%gTfX=H06-r9r0b$S_70eD(Q1C$Q0FD3Kvq4s_yk}wrwHvpC;{$Z61uHAFKpLwi
zX#9&6wDk<e0$oj70J4KwV2uH&G8RVlP83$}fa+7w`W{e+7j(Tc>?VL&wT$4}i4!!v
z$}9+;XUPW-N^$F%v#_!<GWUbC2e=^x8a)pKWogJj0x03}GEZd%ZINVUV}4%+x_3nw
zbPf<Ga6wDVK?^4#MI~qfDfq+{@B%9Iu_Ne-E8qis9w48%vH*N2059_iHa!;TF)YkG
zDj^o1U;~YeKnl+p)!@_)mSAIk!2;ff3YudCg*J08xM_(Xz#4hjm={*-v2u!loi!WW
zeu2&T3qr<Lz|I0&!p8gr*;#WS&SGOe%?9#3BlAaaq6D9w2Pt*HH!3iK_E50Gsskfv
z^$%L!$jHj02aZEN(Ds(6Aj?6$lz4F9LhrQ$o%9L1_!Sg&pmkAf@C$=|SV6~ISSzqf
zfvRzR@IGN_1y)fI58hV-7m3UgkeePri{v@MBA_cKIYAwAMPXqP=9DyWRD#;Opt)*L
zWiRi^%BjODuf)pf1zs)2n9d3s#%C-6w;e$$!0UEFC;0k+eI#H3+V>=+2io-nJvfw;
zEgO933G~JW(4uirP0Gs020536j}3B|Cx{jXErepT2dyP$6$Y(}fDEQG%R}l_@C7ZB
z&~p$J!K$Ej@Of}sd^fm21DDjSY=*+1BkDwiK||J{;TXt(I~yabpfY4BiZVomxe6Sp
zpb8gq;1Q_fE&;kj9yI8rFU%^+Ccw(drUKCfZjkx2%Cd>F%7Km{0$s@|&MGAh_7>;@
zPZ=2yQxt3~cu57wV0#vASfTo=4s<vb2lF&W&@`z&BRDAuGrs^uJ80uOBn?l84h%9f
zda*IDs%Hf6ngeA^eG$;`F+Z!kFX+xuaT``CHPG0%6q__FuRi1mAzn6RP{&1&m6O>Y
zv<<|}1|kmXD}zcoPBukh(Bd3sFVMv;rmVtBtm2>nALiE#dW;Zz8NqYJyll)%S-rp+
z{~s((gF3B@;KfC-79R^gD=+h0SjK;jn(=wq7$KW_AUlmXML?Gk@w0N;vnjBOFfuBD
zF5p&R)dI0hK?EzC066oqMMDa1*cvBRM&?GyQZ~?fK;em?7Bu)C0MrEloRIlOaPCfH
z6=nm?YO{h@uY=O6o<5{+pvMZz%uIT$9-t{!Q2lGn%Ie3;>jPR&30(=m2-<SY%LZC3
z3O#jJkCk6XfmKumv>+9<F<KO~>_m?>6O=8P3vEDGwSzMQy6L>2buQqdA9NuFsKWzp
ze1TRU=z~XH!8;BOSh<<g^;j(pLHDbI*GIw4VPyl|E(gl7khvIeBSFxQ6?9OD5_H^I
ziB(Asbmj_lfEqme#sacJ1ze(wve|+n4s>dfAe%BwNSrl@jgeJZfmLo2tFj!cD4P;^
z=u(u;mQ|BY1avo-D4Ra0`T=cD6b0RAo2>vc6LfqEs5>dh7Rl-e87KxR)CX<*6l8<g
z$OyWThZVHsKu;8Wa0U;!rv^Gj0~F|Npsc|h!79T17_<<Q`5c1+Xm=R%j`|XC_684K
zg6x6>ktiFpas)Vbpew+j3*EtP1~oV&z-z&w&WCtILIHFsq$ryacqU3t0kmFRl+A$E
z7PNIjfmPF%Rau@@luZ%jK~`}GR**`NQ9+>LYg1?;V&nrZs~ADoenZw5LT*mbV-=1B
zr9p6^2P!c|U`Gi-7OsK&2#}>vpcQ;<M&R}YGg|><LRgO#6veENyQRSAkI3oSD1er{
zFlT^#4Nr2sYz97{K>%>71nt~X)@QW`)noFYJPTuiranRSH1w!5UN&R!_B>GX1?d58
z)nd{EC1@}Ud^8_;4jU;Uf|~4tY)atiWNA=AV+fiL2Hk0urUyQ}26X&8Gz35gb+NK4
zvVo@jgxP$dYgSoVVd9|WvB=`!C6Bm63^G`R8DgL;3)=7jP7t8N3sjpT(V!b}7$M;b
zng<1)N5BF)%0&otWhJP=1v-@&ZioOIBXcp>CnDfYkDzh{bat8+tBw+6RjiT-<V*rk
z&jn@`=y)_?(0&roQFNkujBL!OK~orzfZ#L&9TX;9!OF^}1F6_ST1A-8motLybVy@f
z$HB;|;sb8|GwZM|WMyq-o($SQ#=Nae0jz?RmH9X)BU?)gXqW>$dCkNIx)+4`Q61zs
zTqavqR;Ln$v@{!53FgPupk+^U!Hs9;4-B9y9U;AZVG&kddr+Cr3R-9+&c>(+iet!l
z7-($(D6?Xr!7&U<H_TH&Jr(Bf;Gu6=k_K<hU<EA^=FI?gl0aug$%EDwfTk>X<=Irg
zi@}9JX+;sVlbMlK8oZ-K5p?(yC<_X+3d)201sckMo#GElno!q(cfGZOrpB0GRe@b0
zq6eB^0bR=mO76Cx849pJ!0rUs2TY(S<Yi<2%?|SXbkG<Bs2Y+0txw_vb!9;doY)ju
zIoZTP7f-W-c2S6ckIw>)n((kOD}uHup5XvFnt6Kp1dzW#xz3nX7(7M93O>}14I~6v
zqXJ%$2g;G44X>cJUFzUch?h-^)dl1?aGWvff#!t3D_-<KBcTSM;YTIV*}ul%z*JIX
z<y8PRg+Yrkl|ZJ0_I<JPDu7O11a+td*=#{~5rV8`KFAKbUh^o#YoL=5g%w$Kz{8uM
z`c8zEH&>ihQvnnY;CchJdQBX1ZLTz^0$>#t1NTT|LG5ovRzVTgP*8CJ+64en4{<f9
zm(2q@Etrv&R{=yDfOYYLSNeb=Sd@)9To1g`h>;C4$pJFZ7vy^o!w#w(RM0?=#sEd3
zqBpp1;bjBg>7)k|Vs2t(WYuH@IamY~F1&2a&DEfgWMmZp*Cw_G;2|(@p<~1f+61Di
zpvS5Vs&jZ0Sd~Fj0N`8T1ch07MOg(!S$RRNQ%E9Weh<E&ZY_8l0645cWw9tLFS8D4
zM?9<;1^HQzRa%tQgxMeDCL=ax1x8j)<^%;0PZ2aB!m7!f2uc-@>VTJ74%D?uLK1;i
z6rd;st*!v?>jzgINFss?Y>c2m12*s^DJa=6&#4C8(GHH;1#F<0eGYc3Fle#@bU!3U
zvIDslT783xb@0L(RyJs9!2A$AU&IXVYlBY57Ga)V%gCzDrU43HNSHt>0g%U-`#?9?
zG5>_w$ST5S#mdX3qAv`-KMRz}z!kkX_^e7$)Uv`nV+!&))EB&L%zs!xC&qMw8-eg(
z78Vv3W#!EP*Cf1b%B<qd4<R;*K-Zapy#nfofCt<d!8sT_S!)DY1_fFg1TOYL?KMWw
zR2S%oPOu215eRCSGlK4eXZ{5~BXnXV*jxILeOc%w8Ydg`(Mmn=02s1W8sPL_1+s$)
zoL#}^J}@r=RUe?d$OaiI0+|L{9|Q8Zfwu^&DI0iv%2b|JM-j9Z3v{G6s}7qWE3Yk^
z9V;7iUkPZf3v}SxfR$535i<D!zAXT>UqfGs4P+Mcb8b+Zmw6WG{wZEI5LXmlql<$E
zW<fSXqfP=`)PX&@7aZg#QG#3q6x^U1U0jb<Uy)TDTsnfvOmI|!vMp%)1!!Ij6pvyc
z$FdoNT3;ZCz}gX@852-?M8xhguvHJhR)M0l4BTQ802jmpAgu;$ddv!pCT#kkshe2P
z$?l-c3pzItDs96Ix^FZ~53HaAY#gM=0IHcVjRRji0xC1b!8Hain}HuZNFcs2js#it
z8niK(c{X^^ffdv@WL07n29MZ^uquMP$Drz+mCXRWnhn&4hScETNh%OG8q|#Q0*B`<
zuvweHW`SG<xiOCy+W7=kU7-A`&#EO1zE}>_ngDf=*nGirbF)E<6hSl85}=av86P7e
z^p1cHJ_t5g6x@RbAJY}h%(Vv8b_83#4XkDcWK@fTO$@a9nnRvd7&3M%0$!61s-d9X
z0l6C7%4Y>H0SBFP3TY&P+7}AYQuGA_c(ex8y=0yVx^oY50s$u*xFP}<A>e`=wA#?p
z3v_8`5StQsUSEriku^wxRSUH0gbj27#U=2S&YQu`1JyF(-~_+{s!+=#K;t%`gAXzw
zy+}~X0w0Vb!TgW`l#W2BcCZSHv+|1Cfv2EB$r)0q>4Q7Lylk1^Id?U1dIHIUW^|#a
zOG48<=sG}NSY>R8Vi9;p5okL-=ynp2xx8$4-k=#ER`6Ms`e3JmhaN#84UQI8UeKkU
z;EI;b7VI<;XyeEb>=JP$Ry8?L>V-Q7(q01ZEQVzzkZH_qpfP3U|B!$I?dAPY08VzG
z9jM^W7;_)L9;+~DvQUkcHxS%<)=>Z*m#+iLH~RX_m3p8--Y&2?E#UDyaM5qiX2HtK
zrUvSifts4oKm|D*>>pi4&<YBW^FRj_gJ@XY`JM?<p9p~5=MUQX3^o)rKEQmx3cUNF
zpF@w4QP_x;hj}Jcju(;GL7^gG!>R<%csy*(*GfR=>M(-N_F-f`$Oq~SGao2~9OuN#
z#=MSOkJSp)uj6H7z6+Wr0GF7ttUSzDz-9}JvGSI|N)||^4~{TMykZC##DMZSC}_Y#
z#^6T!4kqvp#(9-C;GNdsk_EKnAGARSd@r&sc%Vm+O<x~;Odv=%^IR5i;s@<mIu4pD
z1*KY0mC6q~(2fn%+Ts5NKB=A)biOegqk$DG=)xLa&~aB@to$Gzq*4NP@by7OB<Lax
zaD@e_C_s%?<`PyxZLpjyn;|Qw2<V<NTi7WAoRIalqKcr!CxWUFVep<H=p_x3Y~G;s
z53)cRd=CZ_TRy9xDw{q;DI0T@4XdCUgahiS2&zF<fjHoHCnGDT8F<|$lqblhst7tg
z*9LU@rJxE#E2Py2DmAfKm<Um$fW=-=)0~M7v{4soI;R<Ao)Ofm2dzS2<z!QS3M#=^
zK_a?rB6_TXI&6#BKwGv9S%uidStT?<LtUV}%P9(;l>!B^1bBoD(rpHH@<ID~7}=P)
zZPGx;6?snpg$anosRw2WvYCMz6gHs!tejqK3T%5=IhjR3DFU1(K?y;ek(E;kbdKUd
zX3(ZoP&9)M5f@Qp1z$WO!=Vc9iGz}ymIA8?sQV5ZYPVzMWxfF#S%WMK0j<^s4c*A;
zv&w^;)ZhUFX+>5!2oJQ7RZ5Xn8o~qZIgwUmm4fi3LB%dB8}l+oMgx6TP$Pu}QO1Jq
zdt_4udkC}>7*t%bvgu2Jid#l#-vqQ48gV)@bXv&(vdmXV9+ZeU6j_DjK|4T%K#ORY
zITgTXT~7m_xC9w;2d{Z!kpPv*A0$9q`h`Ko1ZcdH7d)N|J|6%))+xcpC=VLGG-Q=v
z<7bsr29<V_-~t#l94`)9r>V$hXaLHM;Ds)XX`pl7!J{sq!b}m=s{-Xt$V@#aX!rI$
zMm;vrS)!o3v>^xGK_q!WhdYALbAs&J0EIs@pC0HEK2S7)i%HN>E;An}PeH~PA?+}>
zG*HuwO^;QQIcy%QkOQlX9IKELt2pQ+NKkFT9Hjs{I33Dl6=7CYV3lT$QD7BeR#9MO
z)n}Cf^-)-vL8qND$LO)jDY8m~jtd0sQDOz{V`5_lO#(CPDzHIr`~g?$pbAYNG?fV|
z8U#~WIaOGtLG`c-s~{U6hzFY91XaYK%9d435)?)Xka?6e(EVxP>;lukXa}B0Vg#+4
zGGGOrpbj~w8QLy{)Y_oauh>8l1S(%_Sed~mwKK9Zu_>~`g}vayprK|^JqOw&2fA(?
zx(oo!l>=R;&C2Ej?s|h$l&uK3(g7cx3L6WB#0%K@PT&;I3QghO`mAisZ@~!)<Umjh
zNeM^Gm5sSmf>8`S^a2VGP_72092hMM8uruIXB7vx#)QGmR(LK1WdU8#k`|DE*=$%%
zL8HyWtQL%{tYW3CBB0CML1ux<ECj6&I%ELiG>|3WWW#(#0@Qub2kp%UHG2^*QD)^~
z{sp@63)H)Z&Ym*2fS2_}vPiMAG0z82-h;a+po#?CBy%tT7v?6Q6aZPE#R+OCD1hoW
zRyHw6L~|&BPb-6@a6?vAQ2hZZ0r=SjLFr2n6l{?6&M(I*16n$+DlEk+#U{ln0Ga><
zc?ncJfQD4qAh8TG3^Z^h3aWlU+czM`N(qA|TtMe~fVL5Mvr2(3paWgv2`YF%%Vj__
zsL-?Vz`N}9VAouLOJz{<K^V-)Dh#^INih;MUjZ`DRv3JO3^QmJmQ_?;0nXC{7ha&?
zVde$xVgqG!MR0ds7UDCg<C#Dc!>ml=aLYisSxNysfXT!L@+rDP88%_ik#8V}fz|5a
zRtuVy0iW!~12Ra88FXC>sCYmzm=(0M0dx(pH1o`Q1<;nm=b-iIY)TN<f(jZ%$Ot-w
z3EJo*3t@svc_<SkDhClY1YKMXnsi|P#K6c3l?S!3WFYdO*(P}ila~#&Y78{~0J<4P
z5hADr6_jTN2}1QFX#(BdBn?ptO2c9hCNFafcwP!raY?gDv2rq(DnKWbltB}_pi?Cz
zK)cCa)G@MXu(B~v0`2P;5eKgo;{(+Nu&FLvaPyUwEsD*H%^uY6wqXHld?*R&lYz24
zXht5?RAvSBrFobSWrG{6pu7ey-BqB+?}B<N{E(tw89FtkU<aP103C|L#w-Ym4alYd
z=z<A08x|>$D;J8+0~bGX3atE~+zILSf_eyS`ofTrDA4+NK~~UA11Rr-8*v~hHrT<T
zT2N)+@<9Q-H;ReP0-9RD?JosZV^G}yT7CiYhcxJjGH}=HbDbWm2pjX6Y;a3;n~0t*
z=wv146WKQ4V=S52j6in{fpQRd7P}Q3Vti~GU|JBg_ZXBOWWZ<BGO>YL!>o*~>TCwA
zpn)qk<|QJaBU2uN0}a%s6osr6-~g?nWS%O*$j1COTLIKy0q@iY&&hzoKpz4?XDX_&
zDjKm01b{-S6x2osH)D9&B3U_^_tt~A<Fo04Yk$z$NStiUmlzmXwLqI^K{G>Ipd1LT
zDA_=s2M<+)QW&V{164{~Y@i*ypiw*U6f7vVb@W)R^jH-^T9rZL2|Oi`91dDS3=Uyt
zK`-#057g*nWR+$vvSAe|XBC%bl~-mJft|Zq1@e(1=sa5yHbx^>&`=CB$bllD3;w)W
z<=8}7Wg%0apkpdQZ9Y)y0xh`(tw5Fq>jniZSR)(cC^=>}MphNjrXNl=Ggbl6?sf30
zXg&cpXmP~GtPEO`4jQ_J4&iXJISE6$grK667hD?gv5Bxsf(lT`*fuD=gYJQ50^R!y
zDUHA$2HDIAI<b=nR(yhl!JR}<Rm98%?vzaz23-|x0NN4*IUNMFOBv*Pedd!nUXXDl
zUeL|Cppi#ma03@Smc+(f1+oA>n8eD)ykD46SOj!tAgD04hj!m>p#scz$`n|6nU`>a
z3ULsd2h8SW(`UX2KAI0yFo0UGpoSc@X_hVm-UG=8UgOAIuD~h;>J_l7faekzRap7d
zL6^9Je8t9G0CEi^ZozZP%*#1JiFgJ0FkcbK#$#4CC2$jx4HWCLHn#fEMdfVFiJ<%j
z)eX*5mqbCjZ$tXLAg6JFTfWSTnDq?Vv_(OKt4)x;AM9pV_(n7E@$H}_$qL#Z1iLES
zP?%MW5p-oID4Bq2NARc@_{ud<-}nu5tt=C0#{=_faHS6M*kv)$_(CMOM+_Pr;S}~}
z1KpKi4{4StL00oA*;d#?Pc`0HhFoezuv&Y8_j>ZNF{*+m=ouNsM8WMs0ajfFR%rv!
zFpRW3s~u!f78B&^K_<|)c0N!Qst8&k4B0FXN*0Qc@d4=CraVxngGXZ_1Sn0jG2blK
z6NU^nKyLPd1T3rsWmW?Xsobr#VdVjJ4WLKyf)+-A0u6LXHmDGQ6s6!13sCn*1eB*i
zBcY(?03+lkPf$wYvjJ6u;3)e7ZB>J!5;WW+%E-zIYJY=v3rOnNfm$t6hM?<xrR7+q
zR9U5^LEQ#Wt^##<BtezX`g+iU+H>Ih$rM53>#U&D&p<cpTw(xO0jYsND+fR=XEx?#
zpc+k79~2_OR-gsc;xbT@l}!nxAGFYbRSB}4K#7$Tc1@0=Fq;Bs`va>W^X7U5aJS$r
zxK3wwRAA*~wg+8^&b$w_6jv0s@kkNWVgz4n1WG@g%(i;04xsb_KGvAoTLFA}CM&Zk
zC_Y$0@x*M)$O^8gSy@GGeONg`tq5^8Q1QS5n#t1#oxI2Vgn^M&oEdaioFwxT2GC>!
zhz$x8Q2hWoh=TbM10zTqJQ7(=AlZhAITRe!2!c(4jd{C}9;j7~yd0X5QP>{TI0m_w
zjgi$ERHs4j`&NK#e=tN7<kg2{anLymphgs|+y_sDf_izNl)z{Msj@*sA+Q7F?LZL&
z*%bvUZ3^`u=79E|Ae#fa_(KnrGX+`2K%>-l;Pvw&kQOee{UQ#kM-(ABj16*X4kw!h
zsQ1Fg{GSQ3f3GVQ)TjXMRst1uUXVsew*+WYJue&cXC_E%1hmqPQ!J8M095d@fNLOd
z6%X0qs|T)FnAmh7l@%kTEy4ynYnPRk%>g`&%a*3c%Ige1-iVEv>lzC`Xw^HYXcGk;
zY1RY^Sx`5U5!|JO#1vx_=s1g2;BxFIxGe=Pyjc}kHJCY@z~REg{04lCGpITMMT!v%
zKPwX(^W!W%@TON*1xP*vRp9!pOrR7a2wn!p1il#plH<X#&j#u)fG(baZ0!aQ8S8@@
z8=!7F^THY%Rt*=>SucMjKxG;8&ouD1MDYGMuya7O2%y<(4Lep=D^?8`1y&vAW=YT)
zPT)$0r36%>v4HQ#VbO!I*_b(Pz<GiLl$`BB4Hs5cHYZS2fCr78*ce%L6j+_W^M+2K
z9HGbx5(Awr1a7f_!VJ9lh?UiTK5WDqRF^_-hgM`YgDeYyYXF&{4<2(h0x=cA<GieF
z#-P)|8Cf|%1%$qc0m#?j0U=PS!l}>%+8WHtyeG{@fmOo*G-k0&5;OsJ9yHG&3MpE(
z<XKHY>-1QeZ{;hnNU(}AFBec?H4O*td^ZKRd?i`<Sp}KT<bx6%D8^ZN*+jt#mk59~
zLRL%N2kkp%u7aFQ$H>YHU2qFNy9QFWGlDKv2l*RR<8bSND^~^Rp;;hdMg>JyP|jjj
zVC7L`6$CY=K*DUy6`)v#CM(d{c3@G^nkG)>X##pI{A|n@^7UYC1$}+cFgvIf#0e^m
z7$cx*hPeuq1yE8ADA9qE4rG}OBe?O(sK?3-I@uGHpO_a3KxZ#OJ#5ISXROQ*>TH;=
zg9>S8F$K`cqpYgTzv~phLOdF*oXmVsQ8s2b1@P<~Xp1*1s|fRD1{*dpHd#>vTSH-1
zb~Zs)9#G~F0Po%6fE~68@*60AZP`F8g~7qWJgtC{RSI<4CS+eCcoqy4zo5BWXiZoS
z3L+HGfwGbycw-7HE7(uq1%MFcpfyq`ib1|*W4_9-2d?MAl^^6vT5uuE$^~jt8G{lx
zvNJ*Z;Eh4YjaPw>`GK4S3+iq`j{OCl;0N9@0y)V8$^~r`W?~C~jMy-;^2D+#v4tvt
z8YiF|=Rj33sN)3c4}!+yS;blSnJ?!vg4&0mkYQ7Rq%X**AA|&*vc}2Ayjp<KfVoPK
zg`fFWKIlLYM$m8@*eCjs6aZRigY0Qg>jE<E2s$4fl$==EnAZp}!Z*{|>VsDEg2xW|
z6+k%*G;|57Qz3&spyF8pv<wThmJ>AJ2WnP<x(A$W`k?hqtZd4@AT_Mqpg};`m41-P
zF;GhirbQQYYyc?xg1Ua7t`6+(KvS@8Wo6Kw8D&sL)L{h=`9SIkP_GVTBWUUZM1xu_
zpwb>R908(1E@1^Nz!U{{mB4P+*9T?2Ot1xdtYYG<vY->P#6bJ{WtExpyjVrSOwiRP
zkQIB}Y+|hZp!0TQne!A_#X#9W5i&Cbn&XGov_@ce%7f0M0}nq5uz~LJHU#ys<rP>(
zK*MsNu?=C+9x7Q-Sm;7#$w1YrESn%Ce4ODoe_Ui?1ea}~CK)&zL)H_5C*fK2*g)+L
zCbk056yU=w$oRFq0%+NbJgA~51vlBi86U*;0c9=)CME_(MiwbnMg~@<4~&UFnD2oK
zcTm?7tQr)0jBLWFs*<lTzXGdb6^GtxFTe&`?=Hf|yfxE{6*RO78jWU=0u`$F#6S%h
z$mR|tW#Ex=(10|k*Urkud>^a~G`=PZvKVxFBFHqjG8WM2)k!f079Lh<=IxmZ3J}vD
zfVF|@P!w&TZYgL8hY_mmp%^IHgN}D*WtOmE6=!2k1>Lv?vW0mos6{V~toji|HOMi{
zl3>*-cvL?T1LYQQRshvepe1^)3ZU&$t_rLUpfi9$3pZFrvDwAR#{5i-Q5dv%npFUN
zV5~e?LmbFD<X`~pr9^h&2e1o4B@bxb7bs(Zmh^+Hc2NLbd*`CSY7aIk24oVl)htr1
z&TP!D#X#{T%{(<z4-`V2U=dc(agOE+pzek^8*?;BCr&qTvN68_xg0e7D4@qG2_CNy
zXJd}QtBaBOlo%swT1sMJo+bqvi-k0S*g#wDK=oc4Xs?tM=t@`6ZQN|2HoqunXA<Pd
z90|5gP%{uz!hrHJWMc&=(m~}gq`}6f2XC=~5-~^_q^*owTnb!_LR)$u^C2haK~_xI
zu!8sffg75NBCLvR!mL{0yMsjaSY^Ory&Bvtz!_w$Y|L}T!O3t<J*ezwz5;6EvoWtE
zsBNA&C=0ECs{>^Ma9#uX7&%$Y2P*`hUV)Mw;JFBz*%pX1vYLa|moTra*JCvY*U#dh
zP7^5hkW&jNgMtzWD;x7du-Qw&{VHTX!p+8!Ll=SdEy2(Sce@@WCodLf1WoEN7c;Vo
zFoU-IF&Bf9053QmV9jpOkP$Pt4QP2IXh|Qls~&iKRT(sisSjRg0=g9s)Jz2ROhMfR
z5RJqK)g{bYjKZvvrQpR;lF(&SvY^@>vbGA92^u~UXP$xKe3Tr?$;P~1oDqBg0TVN%
zxdE<!ne>ng*MtMi$011_bhH6@9tJd=1j@yb`EOV{1?>t4)$*X;o)jBszDtc&hz->G
z1TP;{0<T9CQeov#Vig6==z{ct2DCU-Sw*3{C4?apci?N1L2VIe@npa%&J4aH4x=~%
z#R4ZA^JQ>seFjZQqNE^rsg5m{IoX)6fb~I7;6y6s;js)#MVxHRSHbE&VwjH}oY%w|
zg;~|vgjogkK=qdrID@?d?I}lb7K%1jHs;%)xmZw}0n|(cdG;lSO>h@MeSA+GG>$2(
z#45o2q7HPt#!N;9eHle%MHyAlt}M`y0=PB=wJAUm0;9#5AHdCqXGpkvK!&rjF~1N8
zt*t_<K2yFh{{^Q5(BPE-q(A}PyntFTrgAWMNrMVTVG(fCMqG(iR8EmqNRd?(ytZ0M
zkyTQkRYV`OY+BR+v`<z5vYP-@RD#xUfLsm2pv{t%j4G_GY>up)<zNvhHa-njY0yFW
zp!rKdup2=G!kKz7X;w})7tk<?6dONCf?Gig%0qJ`1M@MkBeA%D3-dX!6v&sLkr6os
zRwWzIJ%*s<$_TmygH0Zbwj0bh!P+pT-Yj6gC(S6##0bh%tk4#VT@3RP&=qg6JAzqR
z4M3}<`A>oBBvu9H*a=>sqv$!=m_;VAGBUe^`e|&8X{-XwA~v9YFF&aA22JS0<mQ3=
zs}8zBkCFKvcpMQjg~zG@*=e$YiSZhX4yyojYYijlGD=Q1=Ch2TEi;U4%<DjMa;yU2
z#V4F>potS!Hs(1@Ak$cxJ8Kz5L|K(VGg~4e;F&(qT_J3cp(jv-4>XX;0y=OVyyqR1
zi{wBps3uUSo%uE>wTXbQFSP}E0&;sPSi!z}(1ZrKF{#h$z{b3Y5i~G%50qO#Qy$>O
z60B^@3m6$$9oQII`9S>;@Bu}jTXuMuqd>0bWMlroq{pHQy73Y`v?{{NDGW+}@Ol~4
zx(ByxK{<ex4Qv1_s5LFf2H({OYG`v9fRA8dlmiXxaWZpyvD$)0=RrLIP$dj%-a}}8
zaJz+{k(C3|s0Ix=GCG3C?&VlTqF6cQm}TcFFefW8OL{S<D=>>IfbW`RW0qYb%EH7d
z!kh~Z2O&n#00<8oBP$oE{svv<1gW<{^L#@5Y#>iT&g!$ZWt9gl5s+n-H)iDlP0@oV
zA34FZ!}{Q*XCk2MB|&G)fKn`|IS1-OfKQ2s99YZB$p$%V1H4ljWH#ttN67gdQH%;K
zpsonBF(YK`479pc6~dHe<uQirzPk$A-O9!s${_^4?Q=1SfejiU0mXs{t0bs0R8U|u
zg!D#P71+#J!DkUGfKGB`1<eNYD6#U(fqE5?1tE-}eYNoW)ZhbKtOj<hGT;@*0?gop
zQxy~-w*)ZrfIADI*b!jPR!{}yj1tJ~5+`VBI4I0PJyB3tL6=ms^0GOCS_hy*QH8<l
zg`k6O;$FhutfI`BpiM!N@~onulVcc}9YCW^-nO>3pv}RM^(riBtfFkpR*ay#^VmSe
zI5Q{YxK;3C9Z<(bU&I!)3<6|3Cz~n6scfLpD}B(Q4d_-2HU)iF0XB73UeNM3eO6X+
zR!(j3GD+}R0HD@`z5<ILs|2$lH0f_<)&pOk`W6x!kU47PG!D%RplMrHHboW|P*6lL
zvM4iafYvuELh>bO*SrWQUxEx{Wn<Q1WYiO8WD}EN(-Q`<KpaJRHU(iuHbr@Tc~+is
z&<#?oG9VE~*rH@sPDMuOm3Pov)fHG-4ME3$fpQHen?55OV=2TCVR<$i&}vXt5l|s!
zz{;w_%4q;PYex^%l7g-}0FB8pf{HFq@NuOqpoL2Rz}^%^_og9^EYHf%#=O0r5#&?Q
z*@2+L+92&AP?4Z*!paY6geVEKs<MFwv$a8U=BgU3V48zjB#l)W)R@x-)u+m!86#DB
zkenW?38<l`&0MSpDv_9lKxsn)+=EXCx8p(ij~A4QAo&`U)F4xh>a0p^rr;r0R%K>R
z$mY~aP~rw<M9@xs&}MAt&Qt>DZ0SQrs+nJbMy=S4Kx-_(gOs2`4mv^tnkwftfTStV
zsy@(=G-!i>zAYOlIWlK6g6ErI&f{cb7WV?Dw)vn?0xinbXJbAOIW~%oc~d?3?qW_h
z<`>M6OLXUgV*{<cRY8v&&}LMWa+cE=QqD?)%2``aRzv{{T5~GO$^jaYPy%nXQURYp
z#VOCsm&VGf#LCHBpx^?EBUaFm28hSZWdkasMVO^PYi>ceSc-u6^ntp`qRcYjm@iTg
z(YFQd*ab~^voe<{fNnzuuj`ayWR?bPzhVQOk^wrr6r~gug_NwKu#y!NvY?m+<zMjh
zr7TDWv=<DS0bc1Z3z}NuWit>3%^j$-@yUa>lIlsb>MF7d7=b5eAY}t+o<Sd!ML?}7
z&=wvL&B<mWDh65|!d$}0%%cGE7@I#hUM9ifMF(_oDk#mcG5a%uE-w{ep1=t0psGL{
z7@jK3+rd>f=pcSj=rPK%vMRCJf%Z>(Lk|^ZVg@xy;5s6hH-Jti0F^U>tgQNMhWacf
zpc7BPH8?9L<gCVCMn>@ZxjwKcc=A&ivVIQKRAc_Y7{SWO><X&kz%$E?Y|IvVX!gut
zJ_xo)R9I9Le3;!zuvwy@+e=u$2mT&nWMqLJa>%@|4s>`SBl96fJr;RZappr%{ys(p
zF#jZ!za1<u!h8_Q-w&1t4URH0@2dlkx`MWQK&}G>4Mc%@lAx9`cp?ydTb&P^BpYb)
z6{J)Kw{S&4M;Wp)?*luClX+JiYzeOqcm$G_xdc?#u(Ihv8knZg(Dw>pZUcorxOoRU
z_Zf7cCq#(=Oi2XuH_+}2VNn({(1Cv7bG=zP!KWm$F&_tA{Rj&EDg_oZR$k_v#SyHc
zUS2GqEz`_rc^FyDK-JCWV$g}29L#5V6u{FyjG)sF^udFJoNUZCplxj)daRroEaI$;
z%qPLy&{zaO!${jXAcuM|%CU+YK#CI3W);Z7MbKskaW-LAbtBMi@(@zYTc1_jpp>}^
zv^)~jRA&`u6VU<PbqSiQ6a=jqHC6ykelQ1tIwN1fEl|)BCofh}Hc?Qy2Ff=gpaYM2
zK(|N2S>UaMpiKv&pf<cP^fX6se^(;{yh0fiSKx&wY|K%h2^z+Up!pfl^d%#!P#3F+
zE_iYTv^JEFncE9=dlqP>ncD`!Vr5g50&N6fWaVgLHPF{%)og;?FlNMR2bzG_C}HI)
zVbxFo9kT)<L5IVF>MYREFlazm89E`Z$g0dH4BG9=s?Q24?)6zEbXmo$!0i-aL(oD4
zVdgcUwhEgct1xKEqY)ePI`Fa@WEX=vos1J$MVa4W4I=RAvv)vKx1fb0;L~8dSj}x&
zK}T9JP5{rbf%Z}8vvPv!9%INdL<3eiP=i{DnLh$No5Zh(bX*1K03Fx}wK1zDI8`f(
zvWl_sfm{wckw}=i5$tT{hjpL@!r;Yb0(PLLf`o!F8*?}#8?&e$`0OGcg$U3k0Gw>h
zQy4)9h5rR-T<`=Hc#w*@krA|<>_4~(uLvE`Vr~GNu5ZXH%KQYYr&+m}XEQ3W@-RQG
zQ$S{e)5cU#J`w>PI>5@sCJ0)`%gW{t9j2ZH8VhDsn83;h9?0XE02)_UX<`*rU<F-n
zK7mz0pVe#vtNuJ#l!GQ*RZBoajj9T)7J96z3angdprIPb9g?6%z7m@Vt0*Wq6<L+o
zgh4Y7qG7C{UM#4M4B6nt$_5&m5eA=H#>3oL4_YAzy8jHcmJ*a&K{YQ#jRd$G3YrK9
zoizt46_N7<<X)Y<U=M=CL3j7^c!MW%8RxR{7_iEN$R<{Kkkz1DA((fA0-X6MBWM~M
zd@QmscsP!e%^noGkbWP?Byci11u<9{9Oba1F+qc^ptxcJpZ?9s7RxFM?)I^YuyTXi
zD{RcGnLwM;uGX%B2r#b(-6X+$wN?*_FT}jLK8=-!c~M;x_>`|3Agd(6eJ(y@Rw2-6
zjw&c_z~`<&R_lVY6DU1{y3ydv1UT71x4(f4zjvV1-$hs%1wf0;Kou>cFQl+EhZdH>
zIgm><VRecWw6?Q=$(Mj`i(`dJA7x;Kbhr6o@)gYBgJ;3zF=*bNQI3@pw8Rv&*II;C
z2om4mbM^)G(6r8Bz79IG7Oa(#O#rl%8nh)_5mgtsj$>e8xXHlE!oa}5pvS_<_?wRx
zbju?n0|Nsi1BfNh#K6E{!N9;UkBL#9i66u}1Cl)hnZ^h{z<ijAQAtrz5rh?y0g8Z<
zqLQK#iU_h&QrOH~3Yd1G8KA7F2o4bj28I(9crHwUc^wNQn%Q8k5*Gi0B}gHd1r-z(
z6_p8SQAhY?8U=olmtbDY4)F_BqCrtnMG@{YMs*5Y7NNjAi3{X1HAO{55LQ)GRAlB;
z06P;LIv|@A71cljU_RJtMMaQ0MMY(>5JU+`1f&XvAqth1!3hQ~2+;`A2i67BqzqCC
zV!$Ir1ro!|3Sf7@^s0c8v9hAF5+vS0!eAjqumOrNH$fv6Y`mhPsxpWVO^}TJ6a<w*
z0`puxP*8zA1aYCFiucF{J_IrlZfR(gFic@!W?*0lWI-?e^z`&0C_On@*U(hYNY7B$
z$iT?dz{0>nKPNLOJvo_y0YV$;C4&k~7$*b7VStw8h7*`4urRVRgT{5m7#SHst6N1`
zl^R(YgISeSS;ef_nm~fgBA_$*_*ofMpanDQRNA`Bhy|4KSee1SCoeYU3$+TY%p%}6
zE$Ff?(1sLdHbrJtM)2Mgb~Xd>f+!X?BSuEHC!o6`*+Jv~Y{smhVM#p&P!mQ@ft6cV
zQJ$59O%Z(I9xDr*G9x3S9-9Jq;v6*81nPW1R?&bD-h*sR)dNd2u`#mQfR~Vf=X99C
z3&oh(APc&{$C*R6yK}OE*I#ggRe{&nfC(-=@X9YPurN2s9xes25!`HyY-u2KxxrFA
zY<eILABf-q@1GZ9Qvj_4Vgs-76Ji5x4gz0DC8WU0%*Ncy$OvkXFoJivva>OtuCoD$
z1T!1+Wd<*V6bl>ky*e9^K~LBiL2GM3M^%Bk@Q}q286cG`pv9Cnte}u%gWPFt!^#3$
zk<0c85u%`z|3P{<*c4e=*qDVFLATOKv$BYT5)a7LjBH+DuMWy^WME<u0*A8@C<-7!
z_?Q7H2szl8*Voywa<hrBa>=oBuqlC?#vE+=Y+|h3GN81>CTgPq>i&Wg2crV3pe$rV
z8E6?76KI%?$%|EvA1ubC3_5*_1Jn+LvzU}YmzRJ-4;+f11y-P)&`b(!-~a>>ATemd
zVgfrBUt(imV&P<iBqgLYM^SRqgG8MWBOCKE20c;Gek~DJK{-}#B@iiR!^#a>&7{aC
zp2jL@3HB(XGHNi`u*zwJC73{=0t+c_UeLubpx^)ng1M3$M2RXZw=^pUo4&BH2*~#!
zj4cE}X$x;Y1LrErGaERGD1ei&5GWSd7}-E4GBdK-u-Smvpx|KCgpB7KgDzeN<t9M|
zRzYSVMpkAv(Cr+oknG69z{JAN#yk-`TEY%CQ2?Ch1;DY&&c>_-N-t<K;6M=ooxTo|
z6aZ^u2Wx{VWL{s7MGD-)XJBA0q;0`$p}^e61scs~X0sImU0kKW#(W1y;S5?P&B%&c
zI5Uz~IxDa#;3=NL!2&9o!6hg>vmhlEP(XoufShbzpezr~BOqa7^N0|eo&xBqNJe31
zO-5FBaaI-)&`L^SRz7)F7RWV;tjui8w-`WC&&GTMbjBZ>FsK}5z6|PsvoV4SN@37y
z&QEL@WiJO?kO(U)s7?coaWk_qtD_hL(z>V)WEiNX1C60FDzLJ!`G87tv{IRcjaitH
zm76(N0aQ$ZGzu}=uyU~R5-OZ&7K#i^EZjDbS`%KoF)*?4fU*?>6AQGG1H}b+)2$Gj
z7kGyNXzYoDjk!b*oYlZJHcIgeTBQmrQ&3A^M6m-aco9V~xF}+>VdWOk1%(gZvIczi
z8%os<awKLt;(}Cl5YKTz5-Nm4uD?NL1`iu^G{`<&;lu~3e)vFTF!O5$M(A+_+y<b+
znOg}ocEt@&0c_$W$mKJnKxPCL$dGDEj}@grmP4+`6j-^<mB1wtsHg@N&!Dq6K}9nN
zV=JC9gA5c+n5`i$8*qt+wIPHpy@2vEG@*bD6awoOVpC8Ag^-Xg8#HS&GI}Y%OJ_*o
z44SU+5oYBu1do@3W|c$~SXt%S^o3a!*aTTc6!ckn6`|M1uz`wh31QIMPiX!HO}T%r
zvjH7J397N!L8lvn%X3gE0xQNL>n8Ox@^e%5lgo<r3sZATAw*GrZn1uGYGP7mez9&w
zK|vxzaZ$2<L1Iy6aWX?jYGR6BFoS+lX=YAJN@fv+q3;yx>EoiGT$Ep2tc%pD2dmOY
z5`Z`JLFVe_WagDt=%(kD>Z5TX?R^GFFF{Was|gS_`pNluX_@Kz1&Iu~nK?O`W+r;U
zpg|W!23AJ!=nH62h2aAO1H%<*kT?SagAi!sr2!;f3soe-#=yXkBFoIcEauL@z~BN=
z#AFE?m2qQWU@!*tV=QFAoeyOe7Ip@Pb@N#m*%%nof<VUDvobI+#DHuwW@Y}s#M1)P
zmkrhz2-X)3QWOLtvcZZB7#Ns~!l4dGzQoADaC{cb1p)F97bti`oXnJ7%>lA>YBj{}
zYDNwQhBVJ=CUypfm|!;shDB_)8X)h5Tn2f1RSigp*EU^(fq}t8i-94-!p>HVfq|hI
zqJNea1H;VYc6MMP5c{f~J(%6ZSZcw*DbB#aV5QH%z%U6!ST!*gTQG2mGB7Y~ss{Vn
zyNR*X(2Ri_WV&M$W3izb0}n|1#cC#228PbMCdN`@BL-fOkTJ-F8%>PG#zqW$A`A=+
zU#~E-ux93!Fn}b!P6dVD*CxhNGZO}W83qOh9eoA{Mvf-NVlxv40VxIsM%8K#Rt5&f
z6>ba+at!u@ybKHsHxfAPML>d4B02dC_9CF@yul!nk;z~$0<!Z43&S)<28N)?9QMNO
z3=E7_i3|*k7R6<WISlrqoFMZV+!z?n=GsexJX)N<VXp`hUB$$}U?ys>BmvUGAX1!~
z&S0-B$iTp`lZ7FJ!(IVo<57@NZD9-yA<FiuV7D*`GcfSQa@fmrFfcIQOk!YQT*bhk
z#lWy|KhI-c1_s8bkRS^J`Rl0`1H-17JWoK5EY@OR$hyq)6wFRwF_U6tU|`Y_Ny%gY
zGZ}U=FflMVg+n<^3@{~GObiSwQz62WKx$TAhjJL17#NQALpe-L3=9VZpd4m~45$TN
z#i?)`ZX_}=FmZwi9gykLAP1}!Db8dt12G{EXm|+afE@r5XL`-Vz);x-5e7S;@*b1}
zazJ+olml`=OFWbVb^u5>Gk0+++y<}%x<C$C3vz%AD+2?wo=8#wgBgekaR8?slmm7E
zNSrx`iGe|v6Cw<DfNmO;19E`FMJNa40IR!D4%h);-95#ra2r4lVCGH)SqpN2EXV=t
zMUpBQ%s@<t1D3!zU<ZK2nO}<}<v>LzF^D8(z}O(`m;Ht4odmLeejJnowjQLHg}XQv
zZa&!h9+36xLDtK$GBB{{iKJ98n1PrO>qT}$IbiES;w)JrDLGIjlNdx&GGJ_w_03S_
zVC!pnAbKZ(tq1D`#Xrn^ko7De-?Qj}td|E_zg8r<g24>Lgjj#%B$NZT9wg54QY1MC
zs$>#_NOA^@4YGbJ8$>zS`rf-x4%m8-URKWHRJi$I>p`*40*-x9_F~l$NvvQn12G}i
zw<th4VCzBRtQjJSIZ!2&7(@~?U~G`}JI_LtgRS3`1Lc6N2kY%9PKBEfvYr)``dM{A
zS$NJqEi-Wr1_stoA}PfTW)hsBe9s_~TFhW331%}TF)%P?v4F_e97zle%sD(D^0hz`
z0|QHz2#9<sk;K5jnjyo)z#w$oOi`49f$^vU69Yr}H!~%$85$s)L}rLM$Z{|+usJd@
zFtna^kON79({XgHgFKi6@=IQ)g93=N6O@p26&xVOv54d(B{DdGjAP{B0U4)%R=`0G
zWE?188b5JR2WtWq490I9G{78?2|6_nnjp?37A6LUP6h`pFo#tnv#5~4K^x3rV`5-n
zS>~Vv=CF&T<R&sW=z=*MA_bZG3=Vo=4kr@>L!6X@K8UlEi;00DI@ZAe%;8~TU|6c?
zU<l$&;$vc9P+aX`1m^HFqzgE>b22cng94|f&%r|wTnvLs+)4*eP$4^s1ERqT%;986
zmvHa_Y4BxYV5sSH@D*fWVD|-i%dFDD53EK2qQM``5oCav$iN;8Dp8FY88Rds+*lbH
z*z3a>7@B`Lcylu_u)QuWF*Igy2;c^}1QdE24?-NwI2af>!XS}h4stHI=q+b=umE#F
zp~o}d!4kx|0Sdjc)ecr*4u?o_K?#F{HJAhPJQtUP4X7sJ06FcTyMrxAW~T%b1A{Ds
zgB>_MNQq>pRx&u)gJqPM7#Nf{I5>bflT<)~k?P<G=BR==`3_DX&Q3KZ1_sSg2WL)@
zJ2jXX7}%8^TtJ*O9VP|_4ig7gu%#wR3=HhCHlToDn8d)qkp>P3W;nkL%x4FA+uc*Z
zA(VrGffJNGdFDHWf$af>ZrN&wa1Kz-5At?kg+m0G!wia9PKQV^2NVVe*E&Rj^{_$`
zKr~o}or!^ALxn>Om;;JWo>>mDU}d00Q?|?@4lKjX#K7Ra+aVq-0}8jLd=3d<8EB$O
z1atU7F5PmD+aVR?(!HS6IoBZ#ECq6DxSvBhm;=f!&W;WlU=GOH#U>7!U=G;Xd=6P)
z4#?TldmOUC9FVh*>pSFtIiQ5!qVJFk=79XbdDS5g%mMjfGqXcJm;>^I;BSWlFoz4|
zIEP1k4#gnH{TE3|Dq(Oakpu-P$Z@<H4rO3<AithWb0`OMKz`-Xcc=h!ctIv)JY{xh
z;9y|jGGSt1C|m8&2$lkwz<SxC3Csa`FRRv}8O&h<X-YaH;LrxrG=YhM!Q9QE9V`XX
zB+cW{0dm8Ckfw{j96G@=AfLM)ap(feutG|ZZcyOg0QoPk)1e2<;bF*OU|{~r#Nf~m
zGW-d+7;~5aW;6IQFw`qKOad!p+~Lc>!1&l<3W&FpagQ$pgX3L?X%Y+!TwfXY`7$u%
zPIs6Ak^2WreOzCYLCt8!?H~az69xuuR&a7;26-rLwXnk?4h9D9sgPW_80>72hbAgJ
zECF*s9#S)QSPJHVBDv;*!!j@j6v=_d9F~JD1n19<pB+|!I6FbUn<wnB63hXWR053-
ztH2ykL~wCAtOj%VM3OU#864JtgGT`5KE|UA4BSh>?)wi46wypZ9!D__1_r(_ObiU1
zI~+mP1K$^r1J4CJg6ao;7La8dUpY!ajAUY9NK15-0dqiwK|GrysLW@WB*etPuwTIu
zT<Gr<W@2CnVQ~aC9T_Hxg38q<M+LB_#F!Wu76&<k+NBIT#hDlw_~jgxz%r6d3=E5=
zIVyvVmSSRHuwipl0dqh_>!cr!pvr(>M2?ApLCMik9jwQWiGktd4o3|z$DWCSfjPrb
z3(Ro<W$a&$+F%Z-LTYMr)Zt)Y;8$@1l}%QTx?mYkCI$wsNJnr5u+s}v?y5LKDgYlQ
z28N^<M@R+W$Hc&}(8>{1=JT5bFflN2dpeqc-Il<_z|dpmXbLthiHU(B=!v5lSSA_d
zQwc|NuuLiw0|RTiqXn3g#>BuN<L77zE;rMe7#Q}-Ia+~b@|hSIHkmj=3f=-H28O^)
zM_aH=2@?auj2Dh}U`{C$1A~>QBc!Y?V`5-flI`dKmZ@N3V6dIz=m_RiGBGenMLRly
zIaN#y3}L2@&R|Y8$mr9KF5n8HhKYe8#lX=O%xM6{T)rcyN@Lgw>g`pWaP$ECrwtUr
za~wUv26QknFhsREdVys+nHU%x7dd)^Wx7Gl_!EvkU``Jc14F5fqc51#%f!I2F2m6e
z%;^KgT$H0fnA6Y1z!1B}F#yZ~<^Am+90S3eiJ)jqbqoS?CNVKENc?dO26HBZWcnRJ
zg*`{u6eb3S7$wIrPz1Zo00n%EBc!yS#l*nCv(gb#+RtWUV6gXhj06Y#9FQ00I)Y34
z8%vlN80yp=AqD&jCI$x6m5#9>(^OV6F))NGImUtYYyg!@%#QKkpxOcA)Hs65bpDV%
zpzOu4lYxPs1)RMgwG)UB?ztH=f#oNG5+GP!9?mxb^Vz_Bka`y|pB>BxsSg438R7gC
zFy9}XeG?c}9s5Aed;u<B96{w91Gvd$mg)#9;P_vF$`@5d$BAI~gX-m$F2_mW5Y%E~
zU}%}<I2p{*W@2FQ<aV3_@)@}HU25()4P^2UPyucy<Tz89fkA)+l#`a)InLo=U=WZ<
zguCen*i8yBz5oZ9&jaFfl!26j`EWl7Xn^^LLEXtCYT61Cpb}D;fnjA9hZr}==olsj
z2BSzZ9tj2pfkaSgROu(iqrku*kj4V)UJID;F)%=gL}3Po3o}^6_(9r0NmQCgOaP({
ztTJ1efk7co!G@iKfkDtoBq=40!G;5zYC*;xn{LAi_CBcKU0GnmB@QwdRIQwUW&;`p
z5Oe~Ss7vE)_`rHVC7!y14Iijwwi8t1Mb5F|2g`^sF)*CIZX*CT4OGZ2RkRTRDVqc;
z<Q6Tq5d_PCnoO*!HbP*IB)E}kBMjz%O1xbYZNxyPeU)JVd9YiHfk9%1jf4~fgFv<x
z14CN4jU*3fq(PX0A*f!&Mj7O%bxaHlKKwS|lJW+~Pm8D8sDcauR~eCWY}CLUP$^#h
z-Ui%=z5()6P>ziT4+DeXaRE>`3C1@wGB5}pF#&}Vh&aM<m63&yfkAMy76Zf7Jx)r(
zpuvObj0_A-ue2B#WO&p$<QW(QZ)h<vG_k33XhPZLG3o*!C*A;ioq<7!uaglJ%jK2M
z!rTlDLQGl=3`gpmg{2r6gw*&z%`uRXsXv4n7$mG&oI$0a5UAvJ5p}i#rI8!pA&1B>
zE|yZDnpK#A!6wJR)qsP60km(6;o>h>LvZMUJf0BcY6Rwhl6+U5tFaIRgYs-p%r50~
z1(nu};O495Dpyl*kbvTXrOp*xTHgTGG3#qwA*D5_@u)h{733O*Ns3Gi3<up^!DaGJ
zPzEXpbhQB+4QkjPSnUcalXXOLO7j?8?F2xc(glU7P=po(!|oIpD+vY$VPQT72B8RH
z1_q_294=lU_k(IEuO=67uv-{JQu9(6TtFQIh8rxPro+xV3T~j3A$*q!)b4N-fv96*
zU^uJi1{&;P*a=Fft!Lf9NoFUgt;Z$q2I}fDfV&)xZ`~xo!2xRC@h@`&)#eP~e$C=8
zH*jqZP6r+j-K4=rgVJ_%teXr614CadC^;*xc7s&ypaos6Wo~k!3=Dm_3ZUqmE#VR_
z&A=f1l8=Ew*g=?qK~PP@9pqY(La=MyL9S)w0L6;pYIm?}!ETx+?+$XURy)W|OBLP4
zK{ihUEfEXzaR;?M7;b=^(KE#z?AjY3XT+zugIvqV0gA8A4tKC?CxN0UI@TT35RsEr
z1i8sq)g@AafkC7e<feC83=B5WE>YmLsKvmr&(S3s#NH{)z`zqH?*S@hMB~72_22<H
z0-SXeS9|b+gA5e1JySgRz#LGMI-tk{RKhS!0tIs(mj@)DgPPPwo_Gj?3;;LEwlI1?
zvNotu7PZ3z6eMo)pr-N^HxCgm28NsyApf;6c!+|H1~rZP-g<z-gkdMB)L`%R0Efv9
zkY`sbc!0xXCn#|)74wh;>yZO_Hhi5+qA~-6Xciv>g9vEQb7_oAi3kIOXf+=L1LGTg
z5KD`J;ou*a5_u@wYQ9T952$kr8lQXS(hnMg<j`VZSl{O|0Vck|+hu|bNDV0a&ShW_
zy$H&L#>}APEP7Cjfg#StWuhQRT#JDryUk@OC`>_RK&q|F1_cHN&b?X;3<~F6?t{d?
zUIP^=3tb+{Ffec`FlsR{oOX11#0|<HS_}+oFI_%?Re`#<Zx|TFEIJuM)`;oEgNB@4
z7zKqvf*?+i3!|VMh?CCZ2^vil+v))t(DalBk5lq7crY;3eD{<A^BDO&7#KE*ddfn0
z{2mMpYxz9oAUpvN1_sw7p7Ic$pa%m(&lFDuFpp0NJhW;cz~U*%&%hvdCyaq1PRUb|
zoq<6tJdA<CK)@5+GQ9yBVV&yhslv>_AhuN>q*9oHLFB%GC#ZQU4r))zeD{R3PC?1P
zdyglibqXq!f=+pY$10A33Z*U)Pw-g9OHg8)Q0fUDs{nUgj`@3n$0}}s$3co8*m&x5
zFffQeV`5<N3ikxJNMC}?W)k)U4@n#anZP9H32L4)90jM)&z{DhM0pfc?C1UW1eJaa
zM?r~F^OGmI^g9Zw12lhmf=j=npzi5eMo-Wnf%r2}3S}?%1P>CtG+<(2n6<<cGDrYw
z3h2J{gbWf`fNFP!8w?EM-@u6k-2aZ7&EW}ZiAqX&Ffb&wdV)LsHyA-t6kOp6?)Beb
zWb|NQsABX4b^94^Ffw^CFszv73F`MV++bw(U|`@?@&tAK8E!DLcrY-?vw6CK{Bnbl
z)q{bd*Vhx=Hod{f=E1;F-{}c%oZet$_h4W+H_Ou#qLRadfuWn-6Wlz#!N}>sz;HUr
z6H?MLa(OT?c-nYEidsf)kbUz#eIfdIJQx_J>v{S?c)T7A3<VcG{UJP1!s@i}41n-J
z2`llgXCQ<JN?5B8dImvwf~|}Ni75=A$(kE{pjN^$f6oxG6u4wxQp4d1YMe@fS~+?B
zo)I9aNem(&J)V)A3=EPnpu{4q?g?(2g2%~@`Flo#l-*zfhx#N22FV<7s55}-ir#z<
zPtXX2B&Z$i748WhfB+{E-ItyTP<_G-42K(dJX1Ir7$i?JF)#!Rd!~Y<!0NohJ=4G(
zP*OVP@0kwb+~5EiKH(yVCulf9@;@X>bHP%K3=mJ|fu=3wLGC@~@0kyl0(<fxAB$%Z
z2Lpo?s9kf+-?JDj#Q=8w4F(1&EwJmsz5cRkE}k_Yr4J#lss$+pyNXHJvkt_8CGdJM
z2b#bez#M1-Zv=Co3A_o+fhO=~Fb9;tcZYhmfH*Hf30yhEvlYw%RWV*Mo^4<bsMMX_
z><Joo;1>avx{Vp09Uz$-HlVTjm!6$qjsrtFhbL%kL3&0jV+BJmC=7TQS{W-D`oK({
zR>q7fhJFy6UBZKbA^L~s1h7U%c@G8#(@&lgAv^^S28I+>Pw3!-q6Y&5$A8bs5IH3e
z1_qG;Pw-I04Mt@T1_u5T&#4eO6_6=bp3@*aRY*)s2U*9j=E1-aWa|kYrMSUt>cPOE
zW#>5)tdPS3RCd+A@|?xYz##QdpMgPohA;zzG|K@`P<vjEmx+Pl;xEs+pe{fdsC=2J
z>^Toy<$w~!>aU*j!5mO^XzcH~0Mt2f0mTKEujfKe1_n7^P+YJ!dM*ar1`1?-8P6qP
z4k(b5)_E=kb3lRI!0NdS%mD@Rl1-kFaSc$Vt~|pNGOht?YL#B~1dnUn05!EZ3q8T(
z8aF^Ah4b4z*MJQGjTG)a?YR!j0hLxkr##n#I6Fb5)f92h4PaNBF)=Vq5%$~&=9q)p
z%o?7Xz#I!uPjr>%W)21hIa$!W=>B}qEg%EHaekrKa~qfgYOX~d_S_EUxPXQ<wtDUW
zb3B+B81{Vk+zIA@8n5$pJa>UPppgQu-=4d{oDe1khK3uSd%&CsCI$w>iJp7G98ftR
z-t4&#%mEE3Fzb8n2Xj)G7#QTQdmaFDGC-pxTRjhgIiR_s<RzYmz?=eb>(TQtm;)Lq
zSg^?RC^$+$;{owMJdcBAKz;koHJ&HH98llhbEW4=FbC9~pR(KY6qp0*w97?#o(6M3
zy>Wg`&of{SsCYT{)AKBt1L|g%dwHG%b3mQx6(>B;gE<SB7#NQ1_PhXcf$kDmmY0(S
zXL)!hP)--jhjff@Ffho0=W&hMKxNJWa{<pQpa?k&ineUes~~g1qt{Vvp4Y$}P!-xB
z?s**?hoA&H!`t%)m;*|n2h%-of;pfBdc?r<7MKHSudz#d-Ub-}u4!jDdfoxcfC`J=
z*`9a798gA>8RmHpoWl7)?%A#>;Q0{bp06SqDMbvPk0e3v1?7?Lnx2n^85rcgg2&ew
ztQZ*NS=&H!zs4YaHGu-2FE|(&<nus77uudL!8U{RY1w(c0&&1a+m;8OufaBhTs!}*
z=Nm8w<XVnG&$nP@puELV;rR~C0hM#d{5{`;IFLqy&n6DfPaumnK?>>5U@36DYrVts
z3xvlADJZ^z3JN(;_#N~2{05c+7ul{SIXr)Y%(w+9hkt>jz~%5Uf6w0_&J7j@BL;>!
z4ji703>*v$3XYNBN}iDsEXl|a$-v+%@5#sn;W9>ot8zwW2$w06fx&u*CnF1l%e)+1
zNiwp6TqDE6&%kiZ-;<FIED5&e>{}5}Mo{lu;T%5$!<Gl0j9lPgVc=(AnE%$35!8fd
zn8e7>z@YuilM&pAKgtB+z42t^1sQV`WGF|WCnLD;ew2-$fq|pKlM&osKgz++z|bJ>
z$tVC;$;HpWFvHuE5!{kL$^&(b5J>KZ0LagL_c=TnL2Y)0pZwselTi%RY<vlF49MN$
zARZ)mss%Va8KpQF7!(7c!2|BG+yDnpRHG*&sL#T1gAo)wF>5^;Wx=*EGC{*b4ip};
z%upxDbAilZ0SyN*yfk89ShbSFlMysts@TX6ZkRDDgH^!Xp#tWC!_R`9!;=xz5LH|Q
zbuxI;4DMu2gi?vc9G;Az(NV=`P$z?@$8In(KpmwAa+EwMtU;dDN9c6h&*RAm>UAs0
z^D{7L-SA`tw>!a>WC(dOf*YPUKoJ4bXbRTI0SeH$*Eu{HEjSn$l)Rv>12-|j8bL~}
zz)D#d;u#oD-}hv66lY+NUJ2?dJY`@|O73I?NqCidGCJ`xFert`GcZiB^<;DgbA%Zf
zdPP~7LA@m<P$3nR!z{(az@W650o1=xs%>UuU{G3T0woxqf&y0w)N53l%f`TPporO3
zf`LJ)R*8Wj`4w{xm<?Li60Bgvz+ha#!^{X8t5@ddXJE)$#mu-&6r`BJzPO}_fthhR
zHv@w*KZ`x6H_yztToA<L09nBJG=akv)GJm7)i-C4x{89jSl}W}F4I*E)P+6*T8-f<
zz{<d&99#^V4RsX)t+U`rWMEJh0hJ~th7zuzRIdyg$DEwu%EJvBvH_JQ9B!_>qM%U*
zP(kSF?+WR-g364%PFHY(-^rE4z@Tg)05T`z4Tq~H2LppLXlTLklPkCz0(Odhx+}OF
z0&a7<2e^W}Av;;XO;cBJn%Kz(>V789buEB(<nrrW3qb2-CTTG+Oipwy<N*!s2s1FO
z50miX;9y`-DQ99}Fn;32DF7Nl0=d@sjTaY~19Gj&E-!8{hXXts<^|5klR)LM@m4Qz
zKAr?BkGD+s0%v3J^sByz7uZu@L5&P0BQMZ^pP&;sjBGM3yg<Efl{KJ2>2NO*5zx2`
z$kx@lUZT<r3@U3tjf8XRUZ80YhDj!%$WdVwW?*Pib?^p_5~|J-DN0Re@CLaZGM1V(
z)f-d}F-!tAb3OgNA>|OL0NthG4T=zkNuar!8a{8t=z;KDZ%8D7Y9pN~-iXlybp>z4
z=s{YCH)Oy76jw<(-XNzlOahIL?B3-q0xs`Bh5eHI-k`#VVG?L4fs4x<GRgxABz9+S
z$S4mekP?}^L8+br97w7^y+NfA19*5Pk;5A_u%kK$QcX=_U{GBHu734F34*IZ#2YkM
zqxu^(xnkrE8juxqVgN^oH+ZTBGP}ObTM3-xK#pa5<_+l(gIp0|?hP4$6ktdf@YZH!
zU{C|Kq=Napb-)E9DEu|&dFz5XEFwjz#SGqhU=GNr@^9YyU=Fyy+s4)44Jx+OszuT=
ziy6E%BpDb~HiAr;{m>hfZ23hTASQrjdiX^^4W{Wl-UjRp3~JR4pw@=!Zw3anZbU6?
zp{w9+!ok3x2CCS~zj=c@z~BL&ldaz14lsDEG?>pD)B$Dyw+uArd4oH^H+Ud+fl4Q}
zTaeJZ!N8#Q3LJXOpi%f(QAP%D8x95rbx<wu{?QvWW22r2a&aP)H)wQ_BMj8c)m-9j
z4^mYJYUU<#c!T=M>V2SAYLlZkXvRjp4%Em@<nsp2*l>h_8jQ0ydxK_dIMP53#)U7v
zK{Gb$^FUrs6!8Yl*r=~t0P-?uUR=En>?UbAzYok8hV$ov`P^{+IxycJ&ff>-$AePD
z)TRJ$4-N(f4bXtUW4O1c1S}hgw|jd@f+RrMsCc2bH;ChA0*Nah5Xaj>Bsn*Q!P^(a
z39u0<$SY#-_5&3WH$eWI{m|PV%mFo`SH1HNkOUQyphmPfuXi9w=Bp1VQ>w1v14Sc<
zcm*OXg&7zM8Wnt4K+gIEnoDx_0W}vO!;D8{eb~VjDJVhN2Kj);_`w65Jo9}xK{7i*
zg+<wFA4u*6b<3CX`9N|nXu5LCUmtMM10HkSe%A+*l|g-#X}5hKSs64#IoZz#T=eV&
z^=lWW`GDIGH)KFz=6ciE7gVTd`htgoeL<O&BaJ~MGljtyG>*r}0dkvKoi8Mhf}A7H
z>kG-Ff+ER9c?`bN;2bX`lAMyn;48z$z@X_1jy}ex3=Eo(^&j#es}fJ-_=4tBHFtt0
zO@n>Gc@&(Y!;*YKYiJn2DSGxUUvM4;k4>7p`Ko}82Nfvpn!c)F4yZs`?%)d=yi#As
z!w?Rt6<8HmSeZXC1<QbVFIg2qJZ9k-K~M$5z@YgWoJ^R&BtL^C14G*-RwY3O2F<G=
zT|qG*U0+$1S;4%B5(b7TR;-MR`9TYVz(O9v3=G__1pGi@uhkBkck=h+0XqhiWy-(#
zL4uwUJfH6eF7<DK3fn^oeuz>uuhS14^gBVVWYZQu$n**)xTf+06{%Y7T(E?#H683$
zR#3>Tvl8$FMU2)>h{ce?6KXLeVnC(*p%6b%#BiiBK}-Zi49G-b28R9I9DZ^f3=G;J
zbxZmDz$=@;VSmuw54^GoGJu~ZFW?6%$FyT1HbI5~p*DfaF-U!4s^<r(e?eaCnc@eT
zu?E$Qrv84QHW|YtR)`xwGuGO%kcq-c3=G=2U|(^9e03p1$PY9rqWyu1fx*DQ4>2hs
z(B=nfo<Zy?|K?{54rq{FS*!dYtus*FHBs0PGKCEa&Rsr!kW!IDB(XS|!4EPi0xIWI
zcKU(ZYz*Kk*{s(OR4Ovu0C$lBl2!ab#hXr=NI^;ogCD4LgH)gEYy3c^8^j5wdVZkN
zjo$_2go(m_pwf*2T)UY1`+-U~IayGRxirqtm5YHvCk>Qk)>QbpfjDIXB1NfX41Vq)
zP8)c(5tK1>VC#RN%|o3waKP|`q8}_j4a^5G$XISJ;0KzG*7*;K6v$*WG*Tdw(V%GM
znCb_aj0U+<htm%-%m)gnyiPyxC?71{K_;W2=`MtWfdQII7`I9Lfd=_>LG#CH_I{uV
zXgOJsMY;KYkmW`o;}nkifd~1(*_C6eA7r@^$kRPj{2;T@oFd7UIShWF*=RXgP~I(D
z?FSm{gG7Rtiyvq<T22-;!ezP5547A!PF9eKfuZQOUn02N0}Z}J2>B&}`meHLB1Hwc
z41URA8A%2=28M+9e!2V%47ywS7#MVSm4fCM85nfWnSh%7Cg3a|&cGn#V<0IE&b=m<
z3=A7K8c2al1F(oeI0J()yMeSIn5P43*G^(!&;u`=Hs)t2VPHrP^Jm=7!oZ;W2dqTK
zh=E~66bBol5I+NhUK&3GgZyeXMq#j%Kph#;{cMb&rZU4$P=8MKCmSPp25BdYePT`t
z0~;e`x&)jN^yC>B^dRvc!647Tz}&>fD9#Kr6=YMeNeKhP(o<}V#exhBdh%c)oe~BH
zJ!3Y;GK7$dFav{`NlySf2LprNNAT2h0EajOgWfk#eC^s7z{$nHp!XY;CtJ@3aDm);
z12lZHaasU3Hv@ydN(ZQ8p|_rofkAIQG!g1^gA-jn12jPORZKtzf~Qu&K?|zl^tmk=
z82qCG4M7tjJ3-D1lCorAxTqUw1a4h}MI<d57!KSHG)9O>STZnZ$OoE8g4SVz)d*NJ
zFeqLRbU>)#v1DLy-5KbJ5CPe>>u{hGLWIkbfq{2&pff^*(~^O~b8esuLWF~jfnnL%
zKsQ0qy1Nnv28;4QCQWWwR0jSiVPN164P?@S>j?b1f{`PTNr#Vt!NAzQIJJ-=kVzMu
zVHxamQu7!Bne@0oQ$V0T;VJe&CQxURVJA2;_5U(37&wE&O_YI!fx((Bkja1<WR4{R
zgWy3WInX|YNgxjgekoyK5LZ!Rv;_|zfQ3F-GB6yL4iW>2d<BcVv1DLqJrSgV5P4zA
zz@VlcqycVafYm&)WMG)39JCo>^dn0KhV)rMn?W6Mh-D8;7#I{?gBaNmiXN~rFdS^>
z5CcWr4NC?Fp_z(a2y5;LGcasWRL}(V8Vo_}bI$5%f}0)SYNF$lCaCIzRM8QgnxMK5
z(l&75)CARika=p;Xiadl13VQt)mf7tRB|r|H6+WwX+nAsvfzqA6IA!{yU2kmg05l#
zO-TU;2E)}%3=FD2H9<3{3}9P(rf5ROAwbF4l0_3V3c<+10V)ByiZx}q7#Ix8v=|u5
zlQiYQp3-7q*u$x*0Gk=)Z`4!-iGS5%V9>p;X#|R;;&28A!85@bJm8SLk--we$;!ZB
zBp$}V;Cwa&w3foC0<=ceGlW};fx+l8$bn0EMM6O17e>XPRXU49l*Pa@pmk5LLR3JV
zHA5DWg5*qw5LF4#S_Dv0=(s&Z4czYlRY4bjg@9^RhDo6I(?sqNNVO^m%7I4Wd?4$E
z85q2u@`Ql;Z$|f$7#Iw{g0k_&Um>8dWthYwl3KtJ0uI_qpsFUsHv}BC;Hh2P-VjL8
zg6cu;Ya!qPA#n4lxjY2atYDbL1-7adWL2#&1H*(xG9jQ=pK+W>Mrjg5h`1O7gYg59
zjU}2P5@6qfLfm*(2xLkd<e}r;AyUc=3?|Va4^@<hNUJe0m^=n~=rCspC}J4Cf(mWh
z-Vn$HJg5~K;u`{Lbudhl1O=n7tx5=}abWyFB)@<mL|2l5!Bh)mY0=yeJrGA9WU2Gn
z5Pe|=2BQj)r943)2H@}oS-R3b1Uz*Jo^Cgu6#||*1UG%FIYPigIN)TLxGx0KMgS$d
zYV#0C&q)DPb{WTk76kQihOFWM`2@5gtsn$EJ`Y}hG-G85czhn*XO3_S0gumvhZVF{
zL%`$n;7UJfN5}?Hc?yn+`Ljbdf;pgJP>1Ouo4_1UOc)e~YzA|{V=2Z@g&7!@7juSe
z16lnTV)b^gJSYfetPBAU%!94ox<3Rw77t!Izo0S%JQfe`uIqb+fXCv&?r75q0guIl
z-LbGI1UwcGP7!SRA>gt2Ng#I|RSN-+#ZLme!z4kNfx*5?AjFab6#PsK3=XLwR@@8>
zrXC=71XqMugE^q6&^i-h1LlCDV#}uxTOI}m(>NYbNSeF=rKK0pio(>x1eAc_b%d!2
zXuQfa4o%con1NxN4@XEX$m&f@3=9QvA$6b<0v!6rZXxwx4yZAcr5pmDD+7nV+td*7
zTp4)rNV0PXc&=<G8z@biCJQq#gw_g$fL4^5ftCnb6@>I72P=3I3mmNaZ6V-UE3la!
z#UbEHD{x2}$%cUEtiU0eaUf(W*Z@$Bx_=J=&sc#&((O~obdU@<Z%scE0-mq}uTJsI
z4*}0t?F6OMP@|ApAZ6eY4X>*qv%wtDf)OvNkU3xuDBC1?hRg+X1VNcY%$PmoFb4yJ
z*>y<LI0BXeMahhnA)t8?NK@30Ap|@x0!|tZ(?h`XBH*M^#~1>h7Xb%SMP>+iUStw@
zW@7qmkx)=}H#Y_?`0@({^(7$9TvMe`33!<2q=kaBJ2-seV?rV2Feo9cc@_#Ohd~Kp
z9cL&gyF+(8G}pO=g4T4IA7)};P+<#&45@(Jz57TgVog`QR48IiSKEzH#F{SYb)n!f
zUU05fJsS#MYyi&HE9QlQdl}$d9UU7A8s#%T49eAU6GFkGeBi$MT!&E5D4+Rd7f|CF
zG`Vkn8C236bHMqJQb5a{LBSm3?Gg%VZd!mAw;Dx;f?J#5x~5biGzk>u;8ty^S}3@+
z2_9AvJ`$P&mH|bsQD`W5(i!aBoWr4zNoP>W*J2-<0ahj<l2n?;5Sq!!z+jOIa_;Kt
z&@3>=0Olf#Qm_kI7<Mu;Fr1v>;1Jr)!N6c~4AhPb4F%28LMp(V!=b%kGeNP?VjtQE
z=5RnP03~yaRFI=qSBHX<xkW0te*p>ti|gPO-pv0&o=!B72?NEsWfVC6!$2K-Sp0{9
zqa2(+a?--UQ4Ws()eFKPQ4X?s_3AKCltV_DR&NV~4F7{{Uh^yrym}fO92&>MARS9k
zaIkrVK{}QaASbMNWD^D&`m+2EP9|ZXxP*9d_mMD2T!Ji8)CvQ|CB!0Ar7+MMXE|Pw
zMOxiq;5E+Rl%dQR23}DDP8oh#VUTJ86x61AVW4V3?G|Xf>ZE=cq*?$C`>b*fgH#Kk
z!K>rlVUTLU0_3<=p9R7|#i12w{BN#97-X#oC=D;@4g;^D11E|}1!15KC2+@qH<Uo8
zvZnH}gn{~tRw1Bu$u41#MI+#K4s(qa!a%Extxhp9FdTXq23f-aGMuX?46=j+<nxT3
zVUQIZpe$yp6b4zq0rGjs#xThG4N#%6nkx*_uLA|~l+G}4zYZJ>DbiuV;M4&g*YWaE
z2m_^aYe|vhk_v_}P&$|61=-3c9|lS1Ad6<_hC$Lf$fBMpVUTnVvdB~^47AchN(wwe
zonXWf2HM484H{ZY*%t;%&XDL6*dCS*wiY}cmwH1X475MPx=bV`HHRUr04&8Il9-ah
z5LO80fIMre6jsE^z+hbl&!X0l{x5jABX^xZ7-+wS^$Ad5?h7ji>jSx6V0%~vm;*Az
z+%2pU%mH~s^=DWWm;)Y;?J^e#163?Gpsr`izA*3_3~(+N*d7M1SHKb4dNvGPuYhy8
zsZtoYUV%htWifj=sOe+_TK8^wJRIE716NZsR)&N7dEhK_P%|9d%>x(5J6?rDdU>Eu
z^4h*|@S-?yl@jqZ9Fph2#c|pXfe29!1_m3@n(ehQ5nxSV*O^L1fHi?#x7I2GtO@M8
zBC!Z?M!mrUs`YHrgc%qb7YRgw#=~shGcho%jfsGiub^OZ&5eMRub^P+DU5)Wub^Ox
zd>;WRUwJ@-zyY%u86rUAAGStJ3=A_JA{@9F7;KF|Ml3Lna0GREZh+?Br-?>5fjOWK
zWOQtVGf0_J2dpr&bpjV=@YUhAL12D4C~Hk}pAg~3!N6cw2U_~B7y%jvfg~K&pAjBl
zLqU!#*NX52b3l$vdK}>e=718Vv2}zum;*|bF3%!-z#LHO511d}2j+lUn!>vy{J|Vh
zA+XgiA^^+*6#|}G5rJS1XgP-1+K3=92ecf+FEAn)%mFROXl05B0dqiQg<E7q7?=Yp
zE2MZM!oeKSB-nK4hzKwTw6;e2UqmFB0~#V``X3Pm=75HXh2BTRfH|NcVxgZAv0x5p
zorSqwL>!nC04nR7BI3C~ffE7?OFPK;Hy<c^L_P>GM1r<1*nu`fm%BuQmWEjz1D7gd
z-U5-JT~T&#m>3wC>>?qnm_RXS?iLBjb)ax<v5$o0I#9TF%SIMKx+I{O5e(pnEahNe
zum^=DlU-yPIQxK1klPvw$#Rf&TYniC>{Y-q3SLraFCx#t5V}c$QCbKj0qRDH`N%Uc
zq)k*{yawuR-C$+@z$^?}Hr(m15Cv*?*iRHGEly&H5*Gq>bwE~hZi@n^?VTXY8x}@M
ziZU?RPXtAz$k!+-83qRXY2fALc5nC?80`9l85qu#$V7oU7WOYi3Nsj@<U|-4?B0Nk
z+EW}Q57PY-<V6nsC<Rdl2BTU~(&^k51s-Dt@A*4u90lsaF-(#IHDB#ku`w_#l#7ax
zW?(RRA<V$A@VA64s3qi}1a_*dB;2VBGi9a385kUtL_ivCgM=9va<}Wqg52WJB$ArK
zAPaJfO&Z889Qv{#w;0ue66?ZDSp~30P?FSDkW~bSJt#@$b;^RryT7W4l%y0h$SR96
zFgP@6fXug9tHi*-*&rJYb{Hsd15XGuFmySqM1zV9hZkVyMT^0m$M!5*9AwK2P)IJ!
zjFtd#-hx81;Ab=_SRFor>~|=Q2G{Lh!Tlh!>wF9h=Efl6kuU>8yhuzm$Uly*ps<Yw
z`N#Yb$Ul3EqvgdI7#v+)zz&U;R{(K9X<AnyS^?}IP@3k@j|OdsHL48&dBLKTje)_H
zKUxKp7{0PGFeq+`&INnNl7V5$X?A{)+aH6ycEpl_!DT7C07B$|FarZ?90xmSVApXs
z69Yr|e|FH8P)KtnI+h(Wt_$iS#J018#&toX@xlxYfoquAK^2}OC_}8c#SYrx!Z3+J
zq=JDRG>FJBiBY7IfjtR4<O5m0vy*|r@eep%Co`}yFr1HMU(Un8;P{4(f#KA3_8mM7
z4E!bu9PD2?85o>gAujm_UMLR=8TKgl?_dtpB|ii}qo_;_8650iSQ!|c5)v60oJ7JH
z7<3ibe}QMjL3z$QkAwX)2LppsNfO9V2GB%A^)L3n!XO>s5ZNKjz_7R5AqF(3>IAC)
z9K&M})4}J3Vno5cb5J1_uq{SZ9yAbP0-m~w0aqhm!3`SS1o;?HYIindVql2e7z3VA
z0oO1qHpf6(=%CU;Jt_v$LI-6X)7%))gbD+A8awq=3}nCpG()>RJ_a&i0UEB&GL8Yw
z1L*$Y2YD!B4R4Gd2LppMXk?^QD+ba;0|ij{#~4Tx4P?<WzZggp4P=qlwiw9hJ`Y1W
zODw25a$XFYZ;FMC$AL6Q$Hr=dV~SCvBr%;KRtLn{$pjkrnPn2I%MG$HT_zS}n+qu2
zs~E-_fRunM=n2zf4Z$2x)ErZZg$zrA2E`SPV~xQw%-|4<HQ@#g5VC-0u3}BW1B9S*
z!}?mR88-uii--)kRG!4Z;GzPZm~~@d(Aghr4syWybh%j2RDuhr(>Z%rET|970A7$_
z?iLH`Lo<LI1<|pwpguIe3aC*qc~z_}$N}I!W2r@~9mtw$@RlRcWT;CwI5`S}{CQC#
z)*d8lkj@+nT9E7l$_#7LV!=b9U~7c-#X?3w!QtYr6bl*wb(x;d6AM~;><Stta>$8w
z2iXS>m+0774=@K5E{Q8+JwcqEOpu`Pf&>M~=DNsO(DrPX;~8?X{;UiPuHIn`44(e6
z0aBoV2xDMa?hqRYVt0ozFa(Fk21zk6xUz;ZFt}^R27|<RGo&lUf?Bq&8Q_&?v3?>9
z49<%gk{B3V1zA8=1h&P7a)V43W?(S+=n)H=bZ`YN>~IW^jR1}JM1WF3(cIWb@URdl
zwR`%<MuC$)s7f|>i;YqMC4EqpEFT#gr3vDIs$|Q3u~Eh#jswJBkOjytptRa;BEWTs
zgMq;fv^B)jp9|F6h7>ENN?b?45}=UjnZgC`Zr@-N0WEIkItHB|fld*)>4W14+}cg|
z<={FA(&z=Yj0@D|=KBJ!pCtu3xXyy4>Op%gr*J`59D;lm9m@q-aR|y7-S%7;L>U;|
z>cI_RH+=>Mw|;0+3uj;ueP?Jc2`(0vfC5UE%Mi2)$L$h$i>#qHcs~!wNH!ir$ks(r
z_Bxqn2%0Qnn8XQ6y>4?E7~CF#oy-9$Z3?y-Mu0551UA;ol7XS|kKrN27_o;i14HnB
z9<7-i3=Hm|orAkHv}S=v2tXEbacRv4b3g%A!>0vWf(uFJ!gIAiYj7cpN_3`ZA=cok
zD`+9s;ClLNf!5$cwxle%uLas?%m5x+VRzPoY%~V>A+19Tve6i{s3a*z3$%ENVG^h@
zzk8P!WTP=RXt15dTZ`EYRLy|4ZV9eqU~oSR_9_#ok?g*gg@IwmEG_2G${-101_rGw
z5^<n`YY$MFv3`0SXr&HhCcgD-9B9rKGNOI)R~&e{{04aCg!_F41`h?uj<Di6apIB;
z3?3p{3=DZKaS|Y_zX~%j>?(B71#Nfm0L=_LhU<dIEF&1eW5T+I;4xuP8t&Yt3+kLQ
z+yJHF1FLl*^O_dm#G?yZ?7=X}5|mP--#O@kdXpa4!0UnZoFG{OY@D7ml5u*F4G0k9
z^gv517$!lC(*rfSLB_2Fuj^FS<zry*l+s~fP?^f0!@$sH!>Gf+U=`1#!@wZ5f*Hhq
z&7#A=P!Yqb!@w{*o=t~=At0Pxhk+s5g@YkoMj6y=^#qNXoRn7vo&Er6!|x7I_7h-W
zQ11h!W%n1#;L{(#LjlUSlmkFH=7tD37bypVIT8%%3d*2fswXIEZ7NX?0SkkY*6LE_
zP%sBl94m(jfaYsJiNXDaayVE9)TmLur5pj~$S|afDTAgVJ&!|dh!$XA@I1}{O7x(z
z)blzxC5SR)C@6cgGB9|7N~q)2%0b+qfCyt?5YkkR1hG?#(^K;plw&~b4WQ81YqL-W
zjRtrf0xt<shU};Vxp7gjvNb&Umj)?=*3UqaKjRB!&;lAr@@L{y26d`HqxPWfb;^)g
zWl(v{YorW{S4i^bu2u%kDnpY0Y%^s@T!MV89ir?CZjFO#qw;Uc;LRi8r64IL%HX{t
z;C-As3zQ*SM?mMDcwU!aNEc8}W@TXT1}*bAuv$3<bV$@B25|CHP6cxqML?5V%4r}D
zc$g=5g>pKG10DvQFkLxA6ttoo<kr@+%9)`3w;UXxzKFCN3x_hOedP`6x8!vyCxRD0
zfkH)5QaK6CVG+qmDP~a4VrO9R4geQuUWXVMyc56?VGjygrpFG-py2`UJ>Z0`TmVVf
zObiTqlaveP85q3xK=O$)Xm|jUPd2SqE(Qh0PEc8YV6}1yI0mdBz5;b%7$#YRnw?&(
zpb4zU4*H<BiVvs(?ijAG39$g2bM&>4a*jS^01A?G^g*){u$-e0TCxDjIja~M80Os5
zH(&uB^Z{B<!W8HN+6y^ZLf@31fx+iC69YqgfWA4X5CB)O`Zf9%U=FBstemWG3Fd$r
z9vK((t-u^mBfzvs-x|yTWg7qY`Ziz=D99Zg^g%=HkmO-{Lf;N70~*7xIjC<B;(*5j
zWNq{vKpgO3^Q3ZpM=%G}I1~7)?*!t2vmn!XeP=L7gh7dcL20tS3o`?Qj|#Zp*8!~^
z%n;EBEhX@s4)KUTNHNSK0bmZuBfa+efnW~QBSBye)FZ)Q4%8zdU=GwHp<oVZ2;KCA
zei)bo^+-5~1NO+Ia{UMp2kepZL;8_m4#*=JpY$QyAi--txwH-RV+9x({Gyo{7`E)z
zj{~Wj#315STFjsy59WYeS~*!i0nCBAG!e`Jxpc3yeiE1ia_Lz!{bVo)<kC~-`YB)z
z)TOCl4%DS-AkGaA5uZ>$2K{s%P-794BlBwXGr%$;BF-*O4EmWoprQ&?I!!d!&jQPU
zh8H@7^s~Vn9Z-|!P>z0%Gy{Y0bYTXDDP<h`1t9-`&Jfs{q7Uh!gYr_#R((jy2RD<{
z81;*#85sQ1g&7zMIV^NQ1&JS|nWW<gN!d&c44vC_Aj6HItaD(s4rFx-q*I^+TAji$
z$rQADd4?oMJYz8j1B1UPKj;{wc*YV?55|hYJ}H?Yp0QK_B*SQ*o1elE&sYwU+639q
zzlnjtUlp8*Ss7L{GBD&kQedoNVDR?`t%Ud#&sZ(az~FZmv<RYKF`lu8A0!3N{tU(p
z4F2&*I+q?WV610g@IQ2&F{OYZp0Pm^WHbkZeMUhdLp);>KWLa<!M+&GYXS3A_!$`Z
z=fyL&fq5GCpf*`NBWSY|!$lo_28Q@o@r)gy8o^PI0d#(yf4n}((i@Bn42Kgq7&zh?
zK_lydpru?nh4GBNU}HdTwM>g=><9Bev-;lZ@r)C}JPv*ahO?6KjFZ4T(6V}w`gq1E
zV4eU!149gRJmXY0(25fgeg=k)ckztV*cccB7fbLnFl;Z2XPgdJ337JF_jtw`Ai2#N
zAeEou8E1odhaG|$7~<LD8Rvm`mzh9&?nJJ}GcE)h${Y~Pz_9#kJmVq=Hzb&WAyX)x
zaWRA&5zN3Kv?!i&3D_3qm|zBm9+7y)75oegfsdIJf*BZMd*T^aLS!3)85qQN#xt&l
za9e^I7y@6!Gp>bjJAxS)^4sDW*Fm^F!3+#XV&WM$LAVow85pv5#WQY(*gGYdfx$O7
zo^cCAc1AD*1M|yx#;p+UoHdLL4AUkv?f?Zn^8yf$<r?EoFz*70*OJb-3&djqdG?5F
zJmX%F-#@b$1T!$OFvT+-;Adb6VrB!$woi;_JP0<HjRhoY70-AGBrD7YNmE}L7y>tg
z(-fo|58@vN^I5@lKZp;R|H+5*AA{wC!F*!|hQQBYJ|uO21=$Sd7sKR(gu#4BTf&%u
zAqX_#&tO~&%0({D8u5%5IT#p%_VF_?6zaz_UIJy6Vo;JQ>y2l;4CaB76yuk8#w%bR
zC`pxP#WP+7^FT?euQHzT8kh%4QY$^<8LxwRpd@AeC7$sHm<LKywf*soH^Dp^eg=k<
zU*j2Xfq4qxy&&<7w?R%VRslIpZ5B&BBWMFqa7ZKrgVLpV#>b!oFN;|~dt4f~$1^^G
za9JW57<dZf8J~i=%p8#n45EAD8J~f<Ox%$S3}<5E8J~l>jJ%Ny3`gwa8DD_8Oni|H
z3_E4w8DE0A%mR@N4DrnIjIY34F5yT9hK>K@8DE3B%(5U?WhJx3Grr?sU<f`F$-uz0
zDW37YFzD<{9+0aFC&x2>1}kRb0U5P5p79Hq%LuZFV^TchR|uCsl7T_fKA!O#m<zU-
zWnw(zcQBU~WN+c_c*Y-KE{6oj-WA^};u(K)FffGH^D{75`ouH-1qU1`qC9WMGyW3;
z#UUu7m^tDZ|AXZ~5jA^3JQD+$2a2eZYVk~rU>+!<)*XpwVgmC(5hWTC&%^@efg);&
zM?4eg6s4ejpoofk70<*5mIFo9l*D)@b}$cAE>s!CGjV`<pmM>|C7ubi&48g8RGghT
z6VC+NTEI|jz|X+Y)e_IdBf`KC9Ad)Hz@W|)&%_JXX8|gCm&P;kfq6C{l^5fg_`y5}
zeg=kV=i`|Kz&saz28Q!1<Cz4(JP&>b2F1#FCLu7-ho6B#ZhkzIFqjtr+R~yC&m;=w
zh43>l2rrFi5(C>F0ou1y9nT~VmWu%`eshRtk^u7(_!$_aCdD&>R`4(sr-0mfIG#xg
zESJI0z~JZ<&m;}z<?u5wtm=zrk^%Dy_!$_=6yup>!MqZ1%`%HSfJu>oAuNoafuZME
zJd=_T=<HKaj1}s~Gl7r)v|@x*4@@ecLf;Cs*zV%5cqUaak2#Wo!Otb0Nex_nuqZ?_
zFr0IVXHo}qg;gRM7*@ZCX99&fgE5D>J!oNOJd-BK0ahILDX9ev@l0A^9w$Eo!@f!J
zOxj=`Xs1;?TRf8vm<P%rimT(9bit+yBt(LC<i|7VLAV8w8j49@2;>iN4-!-jhC$AM
z;{&D4^AmaEnW8ut7{ca*_Ty;9GlBXp4B#R}z9XI~24qb!C}pNhjAsHhd>D$s`;Qz9
zIpUc>HF(%5NR7z^uED_?&m_e&fvRwZV#uhyF#|)`El}BD44IeFVPFV@tp7*we}U!M
z8Fn$U#4~LH4RLlfFlH8(F)(cdRm6-SP8tK#b{MCijDcwfl#^am#=x`_%1H)sc0oDC
zAkJ<mrv${=1Lc6~Zl=8;jzj}vNeTngJ`kJnCL`!D*m$P>;1C3bkcSIPJQHYhYxvwG
z28OU-3=DmY3=I1YFdD=&9cEyN5VB7%Vu)ut!q31Ec8bA18N@jX<}}P;EC%t8fh$Bt
zP=zv6AfD+s*l0!tQ0;jpp6LXHs}jt>AbcjC=_G`!5zN4_=y*KSDJceq@D4^Du%!oT
zm?Gkt&N47WbV4jWCkhH#h8c`tThD`ej0{j~L4!GAufSD0$l8mbu9XfGsKOUI6VG%B
z!u5b!dl_sk6R5%mS$hR+EmH_+m?p@W8@vJ#G?&5@s3FY2aGFJd7nJ=Xwuodf@PZ~!
z#Gf&M8kVP7c_o<{7$Rnax<79n_{0Pl7$R<pWH9i7rV=A=f@?9*0mTt7q0#Nez_8&R
zp9DzL0WAgwKAr?lkW8@~14HijgepD;1|85sQ_#RiBxL`qJi~5A&?tzskPrhyBrm87
z;inPKz~G@HEeu{V@28@~z#y?+hEEE#U=%E`02;D-I6($<5@2Kn69dDAt1_8lpw*_J
zhOVxHOcr?lpa;}1%zGh|2wM6Uc?EpBNg`zL14v!#*+lRnMDSRuqj@4|5h6zzs7)Uo
zn+O`qiM#@8tZR2Cf(COKc7j^rEn<nF!5oI2Qs4@G5(7gd_>f;?aA!g&Um_7Sx*i4E
zkd`|=5j>d-9vfd8mk6HB1+Sn{S4ad8sP6=I45l4T1O+Aoc;U~Q#6(c=Lyo2KOGtz)
zzz1~<!cQfF7T`k`IR`FI1TUc23F^;;%}WF?pa6H`Lsulqf_t=}{Tvs6B|?_SfySh!
z3nqfLG(nD^i;hhMFQC{d1`48;+6sxFbvDthkRXDL;)8-{sbV5%8W=p>kebJk2pPo(
zb#D4EB!cIG!G18UNCfqaA?NHUu1*Av;zM?AEuNYPS!V+pV3VJas10@;$k~C@6Lr8G
zP<OgSBoWdz201(DY9eTD1_SuiJpI*)pwTaeNunZ2$z=?Q;DP_0Vj?MJ42j@z|D6&d
zNvUNFiQv&M@Gg`&Qxd^TGr-5hboeKNmuBpg15L!p$y$Q8J~Du&ju!o~l#&Itwb>XL
z<_B9!X@S^#7#SGE6f7B6vEE{2U|>$PWLz!6zz}_qkAWew0yLfFBa#G4O);R|__@=Q
zz^Mrw!)Nu9AgKw|5A2ze1WHW|;2C<w)k&b#1nGKf-ADrMOk_L?N?OseNuYI?Zt~y>
z57in0{%ipTh8WN;_g(w=bHIBiLD7(Hzz;cP0%UfvE`J^<;K1G7a}xZJ=~*67epRjE
zFJK0p{HDafFx!d0NP>YOrU{&5WcWblDlsrf?dC5A^&CMff|-Rwlo%L9-1tFzcw<(B
z6-w}db{{D*FxVyX|3WAP9aBCdlb`W4LI^Z5tMY@N@eE9e$xnoZfuZFFKjQ_kkURs!
zh3))|7r`8`;R5mu3?*#*jF%8XJS+?hz90D+FN1}4F>>%T{$*ugh>c#$2%6wx{KpU4
z(+T3Je_{L&Uf~VmIEFJZNP-vR8!<3AzmVYvH^*W@eU*#9_!<9z0_ZDfRv=abRN1wi
z<Yxl!!u|?sc;&_OGckis?WqPeyjB+QGqHfrITHb`nD<)4&%`Fhz#srVyWNiiw0`{!
z14Ha-P&sC-2pav3-7U|+pe4=Ev{4u&0rHxdh7kjU)l&|B=41{AhB!Wc(9se6%-}UI
zUqOuw^)LL)phYjB)2sv;7-AnYFvQ7$jTB}mcXAD5;AaL6mc{XbX1Imc$TKkX)$=oh
z#{$4nCA31Gfg!enpBXeFzyJ|iBG16E_8&iUCT#gOv(SPP1_q7S{4AdE#n*l;ISdR;
zyBI~1L94IhrNLP|8M0^}l(x?5C3Ay93tTe!%t__}4a|WL&51sl3@-R?fU>KyRWct~
z29!hnbdtfN*x>9|cQqNZ^9VE-JgY5P5UdPzEM>NHvJjX9I@k96xnyB5M-P0EY%*vw
zXS}o-tQd{g1_#Dn(12jhUq+T>aSjHC#AeXxi=4^e<tgBasmA1FNHGW+hcOgM2JJ(F
zjEo*TmkcQeL3w1he=?*P1eLISlas;g$iOA6-uGniIx_GynfS+K(3CzS`0$^;fMm#&
zKB%;G{*erx*aRO!r6raOE)u~t0PmJ$NRbE{2~Ctrh7^gQVD*YghD>aN0%CV)GNee9
z1)Z_@I~h_Wf<h%nEg7_0jbRdKuE?k&8M46%G<VNblnfay1Rb$v7M%<!5<w+RqhT_n
z6jWwnU^sUs8ML>F0eq0KmwvJ#c+?VfkTA1nGGzJ_6yUN!$&g6^b<iFt=48ku0BH1R
z&BbKU95}-yO(q70eX7ZjNpR5dhsULoA(P;s;}7ThB!ea)8E$~qu$ZMLLzb?AMuN=p
zlfg^Zz(<Poc_xEbtL-!cEf>j625s<Um;@S84QNk>3|52IzBOtkgT|N`CRu^Ja5Nb*
zSZ&S3z~H5k3>mBjO|mgNB|`?8Y(a-9dnZE%nLy{7>i<cG%tC<9HC=Nm88Qn2S{}1c
zF4-L%2A~yWsRqg5VeA{Ab4{aTlR=AI5}Vy%=`3+FIGyc<^B05p>Y&;|@|blzxEPwr
zn3=~Qkz&KZki;QUz>s1q0%C!3i)?d>9jN1A3`%9QW~6|R9Q_I!SWgK}0Uz)D6;xXX
z<)nZnQ<G#sm7A_Y3TQG_@CbO72ZI%KVRMoUc=HQrd^w4C8fdL1D@%$OI|D<KM;HS`
zOj-(PCuveo7z4wy))df2(xmC2%&}fbuq6ew#VHANE{W2blmt!&hGZs?<8r%FKx^@m
zg+R-MHj1Yt2{SMxE4BDCFvP7&Nfu&YNH$_@0o&&RI%RPBZ$1Wwq=~`|4C?n}Qb3!%
zl9@zOk{MFKO9H{01R4*d1cCgn2=Z=Cb4oCn1M;p>WD58Qr>{IB$(bn(Dd2;pzY2(C
zlrf})gUXYyA|fS)3@PBloW4qcgZnE3L$VM!xFLNP5MK$*2k%V-9Tt*o1m^z-t2bs~
zNOneAYwG3BlLDF}OfG}i3108~l>uxgc)9ae7O<W3!1jX=Ycjtgk^-6tOg<=*m&}j?
zK8oingGgR6LkjpLp06w-DMgtKDN7+*MDlVOQoslCeB}`-%4J9aA2$3|02J_?!QmPy
zpvC<updBnM>r+6B`%}soLh?&X7*ars`%~K49DErV`2VG><z!$;nZX0%u|}k<2Zb63
zKZuvLDrJKR14D8dzl$#egYK4;je-meDeL$nd>I&mey3~#@%Hg|fK2(HvRRmcA>|zZ
z4_|O{*doEekn%*}M@VKKLkehcEOC7}hcD=yjuh}(|F7W+zMwNaQnrKot6#%az+w26
zfgz<G9EObjaDf>RfqJ+AWal$v3oCg4bFwo7LkeX7Gx+4zq&Xm`fa3<t2gOwiq~*&D
z76t1{0-fLV1<Z%5N`;*NY7d%Iz2K0-1gb|<zHn7#rZc24gZ6`@d;z<cfgx27tdkw2
zviN@rvobFOL#muG0|V1xkyOxLmDDcKiA+|hd=d-{sb@ebo;4zs9~`)#^w}Vu3a*I2
z*>Q$<DtNETS00h1f&zwA@Yy9_!L4+qEi9>e0w5zm=K()Ug_Nuy<JbdJAtftl$bZkq
zR7lARs%lP|q(VwoW>Ee~?doS_VCVw19*xu3*%%m7zv?hB9QFWBe<m@5rau>zf>%x)
ze38ZrDp4kZ)XxIliej9W4!TT6TZe%m-w32W-xZ`jKLRvenx75clxgvW$DNadfgufa
zMzQZ=cW`A5o;^8|?GCQ2!3#v2@3@0^XoLGN(XsB}${M_0-;%{0)JtLH052uzJ6+-q
zS|yzE16=pJ`-0jA;5KW|6etH2d`lG}9Pq)EimRa<&@A~hc`!$-9n^?lv>wdiNCOpZ
zbyvY02Jk9jc_}alvbjIr49sD;0jk(8+;aB=WiaruRUN$UkOjz~s>sFN9bDQ>g48kY
z;04H&beR|!c6PXf7a;EhwHNH|+(A>j3^zcv&xNDz;G$;|Xol_38uw6;(UVL;dmAd;
z!R62-P*r4>?+z}ACYduaFo^QIgG-_tpn568(LEBR2YjH_LQQwjR4)T~y}#Nacj&4P
z(1BLp-DAMYK#S6<*SUiaxW55flooj3Jq|1bny@UCbO)a=cLTIOd-+LsP<hNS33NU|
z;wE=cdCV{=60}sR%pJTodJ<@%Jj)h$@Y?7}pjoF0N8G{f#7UrYuf!VN!Og@;pk30z
zobKQa0h2%{bDCAUgEs_BiU&2ID%`;v0(OFqKG<334%!gFuoHCNw&iMf@Cxdkpk4&e
zRd?_T>Ybpa#=BD8b3m@11Ufh?>4rPFOED>viGjiHs5`hzF$r|%jEt*0xJxl9n~8zJ
zz1bbS;&T${d@ZwPckp!5q+C!<U*Qg(PMQQd<bkQ#9Xydb33On0`8W3xkUcjFK%Gk|
zZ54OWq4=4gwM@Cw-7Aq(AA|!<eP9kO^+7n$)Cc0gQy+)}PkkT`JoSM%@YDz5Fx*f8
zIU)GIiaY4+{VdSt{@m&AO~_7waG*{Ab6`$@aG*{Aao|n>ao|n>ao|n>ao|n>aUdCB
z-E())xqDgMD&Qjb1_MKu6nx)^o}7w1Xd)>Kv=ldYx_d9O^B^3k^S~UK^B^3k^FSQ9
z^FSQ9^FSQ9^FSQ9^FSQ9^FX^lvQ~ke2O7}H+6i~wY-R^{(8<@?poVDfba(L1Bv|nQ
z-kAhmQa)>)J9uXjxLfM9-F-GV34j_y2N$}7YijV!arrlQa8(W7Yq8$m9aL8*P6m&v
zhfX$fX9P7&vv2Z)j`($FG>3!)XvB63j0ft@Emef_CV@uP6<5P}prO@i@(`X@J7{Qi
z(Rv7vBMsEmtGf!}G28%+s>@43cpPD%QT2E;2#?_gXjHv&zB{7@Xf5?l(5U*1AMT8n
zAl?no=<jkjcSg{0OpF{_paI3G<38?;payIXXy`9@x;vu_inAd+n6tq=xU(TVn6p7V
zgtI|BgtI|BgtI|BgtI|BgtI~C1TcV|9Ube=2s$W$VJFDh<|*!spe6E*9H2q!@XPLu
zkTvq4$$-6E+!;ZO<kkB?lK~*_LRQIx2K+(Z1uc_j<N$Ai0-Yd`a|2vcgKHO?b`}rN
z0^eNFa?XptJRl=ZpxU%&iU(xG2~?Z1{PKW|IDwD2++`r)0XlpmcRLdU!>MKuRTTz?
z9B`T{-s=JBQGt^D;TIl|9u;WBsb;YUc(Va`#A)9u4^42BAJi5#u=9ZQs6d&)Z=(mO
zN5zo_s;t`OJU~4veiu-$b>ealNRJBC!P~&#0a{!N84g>d<pF5~fQ}r_tn`310>nXO
z$1Xc*4^Yo357ccr)$CykcWEz+2c+W!a%r-x2c+W!a_Ql>9-!63kO3doUml<pKaiz3
zvBe&sB|o}<K+bkh@qjG(0Szo}t?_^?`2iiOGDp<|vgAjK0n~6P`wkk*PIqEsV92Y{
zVPKf>0Mu|eza7+Y;9Cc3IB>Ip)>)-9fYw<p-~p|(s^AB$vx+qbpF$h%B#{nk-{(DL
zVqlo|COr_mJQEa0(Xr{ERZ9%u1v}Z>(t`yV81i0$e58FTJp`l-oS&PPr-K$%GJp?|
zDQ-;<11kfy0F2_&!@<f#KqDi0HGB*VdGBw7&W{rRCzB4EiO2`t=rHX~I%pLXWD#q0
zY<et656sdyZqOJH)Y5p649wC5Fb7nKnB}J@f;k{di(Au^z<NM2X%v^943+_J26Ix9
zNe5jWlMgy)Lghp{cmxGJbPyez4jwxJ+iH0^9kQANWUKtXbkJ%F^*V5up=Sd}I%xYt
zKB&1g?M-?Cr~wBv0d$%dB(PLYq!)o@Kqi>wr-Mh;z-e>-<n$6A28R3}kV)l93=9SA
z@Y1yB082WkIxGNnc2!QKSAxxeMnx5v18Q%UnWb0rFfbI@KxSM(W_ZKRn8+rRUdO?}
zP;d|uoef}ZP%|3A9FQ5=+tQnakfO60Bm)cC7BB}Cvc{LvTfrP?$hLv?Ktr}2EF%Gm
z+X8Q428M}p9O+#kt3fAYshmjf0m;Jxrx(ltS#5bay${5>!NM?;F(WaPK_Go114AL`
zLXl~2(kFwYV49|YIUr5h+tR0k?FNOY_NDY`AQ`ZGW6q>c2XnwXlnQ>&WGu;K;7Fgv
zz)(0B5(INV(l8_Ef;k`~RZgVO19Lz|n&qd@2XjD!LWv#e3wS{K;gM9h1`@zC8B6jR
zSkf0WFcdxjZ74jE4nEZzX81C&5g@}^kEVlG^%p*X$5G*Xh!LOzFbfpYL7l}SJ0=E(
zrse5tK-$11oblE4wO|g&P4fHF*YPkgsMmoCg!H8J^<Wv$0Fs(q`UV~bh9W!2zRO7r
z3`M?h(-*AdO25Xzz);i#Uc{b$9i$EH!ebffH$WWl2|>pvrQZZ|z<a~AYPixtr+XG{
zhiJMBl7eZv2jYM=85pF4k1M|c*2KxFl>P{0(;M)5>-5LcAcug`TGR6MCtyvWf>wTC
z`ctq!_&|kbg0x&Z=$Ox95s0RjAWcmmP4fHFUxC$uuT?5=5=(!}!N5=)22uA8qz-)d
z*M)EC@8O0|l}`Tv=70twS(l`L1apKyHtAT3rT+n$PzUkTUyu~oPvzgz|AB2{Vz|S|
zz~KFk9kdeJIGqu6v1Rc|9R>!Do1kK}u@Y2_?iK_UqnVDNV$@9oRE#PZfQr%5&!A$o
zzW}scbt@ZqrgSo!N;)H`J6ghI4?6rboskdZ>?Y7CZ|m7~Mt+bJZh#selSR`R1r$Ku
z1JBLwe9oWF2&(l;tf3lJQ8cQ-HQFboGpd7llfW9g!sOB!K{Z@S2~?vtibfrfQm~CY
zf6^Isc^DYfZh<wPFO*7W1XX4wYoQtqQ8XICHJ)!sXEf#k9ZwC`Xx=K4&Ime#y5t#D
zV=YLdFU*g1pvK)!kRMrQq%(rHK!Ubx8!<5Kspd&%1YKuUDhSos4A&T`o6ZP6aC#>f
zsNJ-zR4g65*s9cqpMe1savfk(L3VV@rZa-Bv{J8Q0x3PMr;yIr!@<B%nhrI!7i4M^
zgMCq63PU<$pC|)EsUX<YDr?Sk#)%-MptVOVztS1O`|@vqOs)N%&IsO^zZ29NlP^kV
z1YPgKFo}(yf#F<XIwN>%{!Vs~jU2NK(-~)QFff!cLv5T1vJo5rEZ@=@Ax&LS0GvIT
z&IoDif(HGo9MT!*NP`?I1X{^(G@WrS*lp4vLmk?s(-}c))XO5EhAxB~+O#~KaS_P>
z;CKWXx){uZ8M*{v=)QFDiJN5+@RRMz(jg^-5d*`-0-1Ei6(EQ2f!eVWZU@NWkmI9a
z4hIckG2DRJu?B9(p^fQ`Yr*X+u*3Bkq|+He=SG*qLSrL}q2Pll;0_0$OaV7^3&c>6
z|6QdO(iyjNFff#-LEW|k#Tdwm(J;4xkEwtgvm0Uzs4MV2oe_Lc#SLjtH(^CO<6f{!
z<v~_#doPyGcmQMtEX5y$TcMnu&Imal8f3-Fm~=+S0ns4uFL{y9cmy2aLLg(b?(wHH
z9tRoo1?tihAY;IJJoa!pBWPy^!z7R~AVWcWGZ=1ggAR>SNM}3^)&?2ToW#IT!3>WZ
zX&L2o#&aAD3>7f{p9h%=PgEDc4gi@7ivNpX9>{T^M0E-7|Gdt0#>-$ikpG*`rZa+0
zhUN$Z`(HbaIh_%726P2z{fDJZI^zwH(w(5>Z#N~K5poDLXl08^N;)Ix6zGcikfAz|
zQ`f<rTFlLo&ImgFxdPM|16g?wWDYnRHC;<*yf4qdP;nDn@l~WTFjTyN>&#$dN@x7Y
z!N5={3|bpylg{`Fq!a9dMc>mIL3`9Hg(2(fCNVHnD#3LIuVG1N{07qL%g?|7vhzDg
zC)iH;ed&xp<QNz#eIa(fU|^_>f$Q|u<49*>0_mK}53X&QAZILtd~JL+oe6TpGC0%k
zOJ`yQD}>kkl}q5}Y-wjnX97*{R-Wf)U`S6&XM)b}@-r}~$)z)aCU`5)gIxgH2T*wr
zuG7DoC7nr>hk>CA)S0ubOJ@R~hYa?0;D>Z3@Oj8P!G+njr84PEp!%b#1C)NJr!#@(
zfOY?X9D6J(oe4a%b_3L16*Wv}f}FksS`x-(lg<P>*@$5hXpL<GM>-Q|6FI{qF@6RH
zyYO@-VQ?-G=VxHp(U8srS$Y8K<`z##XOduNV5sT<?>Vcy$G}iE1G*8&h=GB1u1q?U
zA_oIQ)kS^=2Bq8SOyG$xaHxYq06g;rKCxJSUpf<LPamkAY{bA&m!*)-1e)Wj2K6pM
z8X+_NAb)@~f~Wey8lz*=nILoh9QFlii45sX;DZ>z^#{mM&}_eY9S=jgh=39!14A|F
z&YT%P1VG1-LH2?ycN0(-1|6ddYBK4u31|s}4r2o~na)-S=z?WHEm@U30Ru2c0JP3U
z<C=gWGXq1l8fbpj_k$7x!&xnXDZ-$^TJRj}93=*Z8RrG2g6lxA$P6V02F2e3)07z)
zszIlZF$+!MV_>LQm&3r&+rn5N0NRpN{T$p>5tu6tN`a6|Dg;0~lB%D>Q&ja2$oP6X
zsD&~;pGRP+C<8-{I}-y#*Jgobpfn9`p{xlJ08cM~$8YDb3xLo32an(G+9v=y+gY?4
z<lmqSfmJ*V3^h3%pjLSG576;9HAyB63}Axch6yNOK%>$ObM--jd<+aVK7t?%85n9B
z!5wvWkj|PyB?gA+`2wq%LE@l55j`Q#z`(;Oz<dxC29P=B2_*~+%sT~`5&O1$-<B{i
z9L^MAZ38u+z$bwDzS+yjz~Hh$fb9fG=OoZMIZPsgA_5EyH9tf$7z9CUT`W?;YluRb
z1;s!%-Ul6y<t`)uJ~hwx1&9|cBnV#N<NHLIfkEYtLI&vYz*^Atd$Y|lKr8+s8>l88
z%mA(Uhisra`XB?m;vYPiq;xz3yy73c)!YA624uy*7<ki8257~<951+2Xr0iL0XjUe
z4wOnZ^<~6@Tn%oFcbv(H19Lzj?IV@}p8o^)IkHY<fEW3LySz^4GQf-c!M0l0W`Gy@
zL-!wLfY$Zb@qjw<K6x3SrTh%wlMUi7WPm%LH$W#F<ekp|cRp`GPBxgtz)&Xxjv8<p
zDSX|Kk;B2jPzUO8%r?u&1)nkoYA<WEXXJr7pu|4$U`9Te1L~=*P0j%IOd;1m9et1i
z?wNu|+snUYfP1DlRKUAWGeA94-9Mnw_Qcm2pq?pgJ4!|=c;A5~xapix1`3Bsjv`5=
z#S9tcU=C;s^}y<k3NXi+iGhJ}eg?S1Itetx*vXIq>af;5a0L%)g8cLW>?bQwy7!LZ
z$p9V3R1cb%R#MNXlVf10R|WaWc1cFPJOe|$7AVY}G%^}M9DVQ!QnjG*gF4V+m0Hjm
zujytE8KCP>>p|-P9K$nOkTxb{w1P(fKobH7R%f(<3qQ!lgbeTse(;2Vw_HXC$n<6l
zPzI^{02)o{0-g77Y`%bxfuSKshk?OP7t{?1bOdz+1n+>l0j=Lb-GJ@3pl(3BGpHNj
zUIOX{Ebjqz1N>)m=rAyxa^TcqU|6NbrNh8bW6rI^z@V<qqr<?kx0+XnfkFERpAG{<
zyc)j_14B}mfDQx0#8^Qc1_u8$Asq$=Q)Xcu28NlBMRXV#mOd2KVPM#7E~dl4z~(Qm
z!@yv+OG1Z%LGgv84g-VgT+qHcp9|7D3=Dq%WI-xV$?GsM@Kh@3FfgoeSJYu(5I0rQ
zVPMd8R@Px)kO@`+O;t8LXH+l;b@duR_eC_kF~2Ltz|e4(Atbe|gu(ot6a#~G8zbnZ
z*BPJ9?@NKoQbqw^1_rNW^9K-~NJw%qgZV=UN5YqZfhWlPkrV@ikRc<u60vS$U}(4t
zj%@JKr5QV!%%5^FFf@XOzt&GTe+G^YP-N$Inm-3~7(t0*qLYvLE0DSe;IjtIUxUuU
z69=i&-(~&|Y#nIeA;R4JJ(vT^RIO#^AHW<?uh>T0{3D11zVB>(x%nrM$L@mGOH7$$
z{u#^xEs<b*X8ui@fuZq%hDd$^gZXz5`>BpdK@o%b4-os6fk<W%gZWPo`@M-sN)m(l
zFA)0+XnIH_-TW_z^Aj{gV-Rir55)NgT4*58X#O9}0WE#@n`F+&AkDzg#Owh|To#~n
z4=khj7#J+S^D!`3g@6c4J_ZJBNpMO7u}*-Nnr@lPXk*UE%)ro8#LvKByV9JI1?27=
z(0Wo1eRD?8;v=J4@Osje+2)MwAn)E_)Cp!_m{)Ah$N}LR%wPl^1ZB?1DGeGsV>Ah7
zV3@36&d3Fl{>lixi%PVbfuX4h8c8e+4C1HF83jZ@_JSr{|1vN%&4)_rGcYvu?*lDC
z@M4qzi97uN|NlP&1b{YqGBGePFoVR1#UR6Kk1;BOj`093Iffg;z`(%5!oYCyg*oGN
z@WBnBLmYNyP6M;u7#M1dvLwYB7#OVd85o+?-53~nMYE(p>zf?i7#IYKvZTRIc4J^j
z_>%=%?A;97H<x~nCkwRHy17pzCz&Bjn;o>2k3l4-fFVl<%w`cONMgv+1+&3NJf@$|
z0?jKn$AC`G+a{1@CcwbZe29sGA^l30g)jp{a~~*CGTUT<hW(olfzPFDws2!$SiU{W
zhM9q(d6qB(!>I-d6VPg;7Jcx<stI^aCb(MJvfKo`7zsQx669?HUW^2;R!-KNfEOcy
ztCiI^O~8whz}3piFDBp-@*Ch&k(@OpOhD_5T0qly>!+K5PT+x5hplH#Kr1gH)#1fo
zCg4Hw8v>y0)wzbl1T@6mG80^+n}8ZtkQP+ySrgES1`Ib?L~;`g7)%Ug7#Lb+f?F&t
z`V0&$D<CadVFrd($9POYqt`9pA!b090D(fI^{feG2@t5<KDyQfyaWh58x{4*1bliG
z_@MsiP7}~U1TEje=S_pA3tHLWrVG3hFagb#v|2+<hunDvH65}`6=b@=TNBVORnU2y
z!VC=7d;%t*-RZ3b5KWMa%b=P-yN4l1hjJV?@de+H4j#s3-^yVEx+b@EDflW_6Uh8A
zNYn046Y%^oIC9uDOhEI;txLgS0czE^Zh^RVKO+N!wV_F*90Nn^Ay5u)Ens6{kUDF!
zNQ!}>^)ep=LrY2l1A}P3$zom*-D<K})`)?jmO;UU5wwJ<Es~#s!EL7rBg9*vX7O1)
z6Go7~7{JZqWqV8*LB}aD+yKpDr3;!cf;Z#d04-4zmos7X0JRjs9RV{@6GrHET<{hE
z6GqT+J)p*o5d(wEQ3(@9(CB{K9;k(&8FfYu$nml!jNmDCuoV}7nJ|Lq)WKFLt~OzW
z1PZ9H0kQ%TDxkiGy_^YSC>H}m+aB=B9Z)2;orVO95d(vn{u~oV&;icvpsBJ8S4|ir
zA&am185nr`Oc<lY85r6Xdcgf*6UJz8Jv{+5#*<{i2$@j_ZFwvIX2KW)T1$0f1}Jpf
zB8?ar1S(}r7$0*mFtmgEMj-b-0S5vo@TRGmFg^wIKpi=dd!K=Mpuk)F+Jx~rIPQ7C
zhw7Rzz5vUC{8E!(!uS%*1J5!#`^%Uxg02Q?U&_zGP{V4%_*s#Gp?xWMEql8v14H{(
za1jG;yc$_&$AJnTD>nv)v~Ah(k_-$Cpn|9+KRW?bN*TK`FzjN;PLyF_U;yoVZM-Ou
z4QljsfY#iVvS-(eF)*~B1tmJpv)K(`4k&qZR%e46=Iv)et-9#gY)~QHeipohcV=F8
ziw*-rJLpKyu-^jNptej$sYqUFE<<)F*Z`1et!J~lz#OP)pu;^NrU?sY_kd-<rfE&g
z?lWd!=rF#^D3HCFnSr5WNf-meWY_Ga$_xx0>R}8F>$YYu(_&!gC}l|C$Ue);z|a9Y
z8OC5j_IW9o(--{8z5wDJWMN2P%f7_Qz|aX=)S)po`-&texIhl-=*_+g=78q<>LzAi
z19L#5<ihdU*TEdn!g|?`>>FSX$lbR3**C!)R)!3Y?9<E)44o#4ASZ%|6QJ^J?fZ&s
z(5=l~pgdguEgQ6U4-%Y<E@p#HF>gN$GKl*@Ht0lqNB|T@WY2;G0O&x%=Ips(4yeU!
zQjxs?%mFnqcphah1al-rN*S`3gFM~{YGAl6&Rzu;2Q5fhb0>Q>m;-8MG6!damPxgr
z1uZ)%O3q#nmH{;w)V5}C0&_qOhPJ9~Py%W{3u-W=9LwGTmI1Ywv*ojQgE^q}BsqVx
z_kcN|^(1^D*?U2pgP`>!-jlLH3$NM_1~D-(sC8uT2g`sKmqbWq9{_X0m>3w?nz9dp
zI5$BnP3m7|gZ3%5p9L)kS=XF>1SE47RCSd9$vz6^fEIoDm}MUmWngIE3R=yP^)dSt
zn3J0XiqQg4fFETP$o|5?z|i#^bU(Xs_II#WPy|P=%m!U*4GHkm&Dp=fG92KpRyJtA
z8z}vP?qS|OAqRAPa5v~o(hFB}1Rx~?=(a$G96@kV&;#n7t1Zs~4f`^HcA+o}^?*+B
zPRy~91GPoLeen)q28NC*fn3mNOgCsQFL!z_bTEdAfuUR^7rZD6T!i;b$%QPo2j!+^
zM{*&H?Ll+FimP)$11*r_J(gU{1r4-7?u=P-KNsXm$caSJvALjO7CBj7P#DDb>EwdW
z!|DNrW$yG`@Kz0Qt==;w7qV3Yl;}48$^{+j#V`ppo20lp7qV3Yw5orVLar3(fN$_w
z{Swu=(p(G-Jqe%`D7`!v(kuX_w7u53;AX*2P-c>OlM8MZfG<=w{GJPG7J!bGV=c@D
zHw$)xI&iD6<${K47$$)h>qf`sf(~M0n4}Hre}T&Ao&s>u#SQYtq(G5e&_s9-=wgS9
zzj8tI;E*F}y#MBc8VL;GMPv(Z=R)SeL3wprcP?Ze9F$jk<#NHBEx=*Ca!;-yxC{k_
zadd1hXt#wNFZe*jzNZ|ypj8{apxK#=zjDpM&3#asF{sOhOp1dF1)s`X(1Hq(DnSMY
zkZXG(>)*lWGVUnl$OTP?_kxxdUHp{`nF|LQ;{7)lG8YaqWWnuR$ns*4Ys<goLY5bU
zT)VC+7rguya@U0DMvh!i9o!2#<>cb8T*xY7ka4*Ob0MpULB{DP<$^0<@RV@whg`@i
zVo>bb)aHV&dx31=5W1ENT15<rYHRacP+Npy5_o2Pk1Dep8wUeJ??2FzC_6XMk@=8N
zKA`LdzH?<KxZ~5JCg282q<y~N{<Rw<jWUR&q?R$bLDDG5LFF!Pd}0g?eZC<7Wrw*z
z(kLikqhsAbX_R3Scwo8r8t77LaAd<rZ~GwkUw~U(z5f^(`f4B*Ht05jyTW23pb;P6
z2L%iaB89>kl57kNDm#S_t1~d9X|pjfxSSV00-8jh6wbgP(j<HoGA?rm#Oo722I1W}
zz{tQL8Yj#MI_H5|s3nJiVa_^6hCI+-)QO<gU2Z$`Aa~Ay0{X089@zij<P+4K2g$sk
z<P$a}50ZI7qcOV_^T3N3!A)SN*gWteM)2aGjGK9&MU0TOOIb2`ka1B^&T%Wu1F!7_
zk9H)<<bl_Ag4Y%<b<G2xrU||hGy6~;WE2!sl*`=AgJfh-Q9k)>9ylX|56d~nmj~W+
z1zs9>c2OR9vjKQ%VE?8(NRu8^lt<jmgXCRMQJyEC2hO`UKt*}JU>-Q{f|mvg_2hxG
z>kUv*p8q2cyrlrVG_XKCPYIlbKm~T8P#$EM6}0BhMj;P0uF7x&RN|;P<$>Dz3^zcf
zw~|#JsIAX%15|n!P0NF{^+Bcg9`QWLaBBe*14FS-9%Qr?bk}8Zd>(kP^#*8TTuEXc
zc&zmXXjE-UY#yW&06KVc&VoEh_67}4mGb97vN!1B%QE{sQ1)iH0a{>Q9g$}Ob~WhY
z%R}{fkfUuu7hmdp%!AyD0=iSKLO&03R}|>tOS^M<kX{4m;!EWPd5~Vi63_t~Tk^oY
zh8ruG7#I@V^T54^8=$Mn0)OY(f$agE-s6>#2VPiz1GI6pFeML?vv)8tFl2@1fle%A
zxB)ulCG}k%sQ)mr`T*#H&GtM<(;BpF!>KqAoUw2G0Tqp)LyISZnn(=Byr6ATbJpd#
zGcz#sT}^k$2aQxt1T}dsT+Iiad^qt0DDjHR<%@$l$>22MeK;Sy9eI)s$S_dJH4(D@
z$($j*A|DjNlR)c+1l03Edx{|jT)3F8EX2St@dT)SU?!Rm-cfu56j!Zh^Ho7T;z=b8
z=`Q)8_?QH$+b>+rHvnq@S#KtqZwR-3{q%ezFbCAS=$Vpl4CXj6q}SwwLTu7}CI$up
z^?ZA{?h6<59l#ur-8$#;9l;tvcAE+2JApZ%bkce@-x=(X3WkiDd>&Q?hDlGu7#OBr
z%$MY5V3;^PjDbNsIUjV<z{DG23=DGW`JglHCW(bHFsx$A2OS7EDWn**?Ka<?52P0s
zIFr7D%cW{iC3I#+Lq2HIWHKm#JpJ>*i<fVJ_GL|)&%yvXKPumwje%jZ4d~>km7p=W
z3$CCsIG&B5F}U_+a8*GdRbe^|41r7_RiPJ|K$kNaZWmDil}^k;4dDz7hKEIzAiN3?
z@4Sc#h{xo6#gc)cM^8izv@Q=a%w1y1z;G^61iTRzB2rMuz%XT#NVoz6!{iNo3=D>#
zc|cX6DI(x=O(wtNXJEK+RfMqw(w^aGU~tM2VJrnD*{`6U&ZIpejHRHk{W<}pQF@Pr
z2zYvJ3TT74C5s3n=#o`N4p2v?XNm~p9dKs_)OES|ON8+*$Qa1QniEg5iGX`RQ}RG_
zol`^@!95`GM3O4I2qS2ejbRdK0?#l@gb^~%2D%(`ORxwds0YNb6MWg_k|PcxOrV3?
zrfdauyv~X+`GVIkg6wz75n%$KZVR3UkB${#0v~U?6EqFJYo7=c=zQCWCpf_Oznh=p
zkOxg3O}P`sz#t<k4{GIbq=63YJ0%Y~^iz%(bO2D=LV56rGbkjPd@q1TSye(nYt}?n
z*cce5g2pqWCxS*<i{wFZm;WCW!-ZGDRTpTKYN`e}$uNO7;avD9sx1Q21UjT{qNpJx
z22X%^b486HyaS;A_DWG>RuH{a)P&WNfgvkT)RdKhfsq4T&w<Xm^n9!#3Tl5$y$!Br
zMJ>Q*G%<)IB^EJ=f(xjxpsK$0tSG2}f{dq#%ZY*tD9DW?dnHA|1=Ls2FyzHwqP9{D
z3{&2LYM_+`qITddgW&bW20Q|ypzTc4Kn;;#K2cDi1R1L-UMT7UQkM-LlJGifAqr|@
zOw$x8Vi5HZXJDA73CixymZG5h<OH3-XSh$j&A>3t5*i>NZ(kEl;{tg~^hhaqT#I2^
zG-&6L6X;5Wub|*JJ}6qq$G|Wx7o^H}3yA5?#=zhmD7qOma{rZufk8e)l#va_VV)$)
zC<EpQGBALSwwtyBY#lFyJ_EzF8S)GaPB%pv1C$vUrmX-ODYAxzfr0a&C?j|x0A$>>
zDp96X@X>b%L1TQ=H-h%*{jyLJU|^UIzM619lLh!lg&UyKIC-rFr2PBi3tF^h0V@Bd
zA7o?*NlmO^uuuc#nj4H4LQ<1KJdjInFkT5sO#$(wK^+3d8zHGlAf5u4cPAvZxPZYz
zO%=?05R#e%;(@mB-e7zZl3JX}V4<cDmU|JBngZg1Lh1(Nn~>B@kV;Fi+y`F<28oFl
zYIb1W7heX3^XeAr0-%GK7=M7uGSFDi^n)Ph7=MTJFM|2!84faPGBC^p^)W(zS%A)U
zn8^u>$>g;b+F<X1e7c{>0(|+?4e(HV!EFm&0S1Pdl8h|A3=FEJ7J8s&Fb88nND;_Y
zpi4>^IT$NKiVRH|EcE0+DVeb$q{z^O!9q_N%<Bj#GBjqe(9;0(CWI6j8ZlVt>4JGP
zLW&Fx87%aSz`O+^MTQ0p7JBAj-inYSO9l%)8!%@>NRb7Dg`NYLvm>Mk6h8V8mmCNw
z0)-vu5K2Z4#uFh$pm5cf2CKXfQUnTfeFZS@Mo1ATKJ-<=yaypgpt#c40`p#k6oKMV
zUmwi-5K;t+V|^1a4<4>FCBfnN8y2oJHNpIBhI@=m3>FHk3=A`Ui!+Ul7%Vin85pMB
zD$X=BVXy$5!#e#UXo5pYmWjavw77U?QW68hOic!c`-}_>Jkkt|3=9^a<+?MkGBGgZ
z9kehN0~rOH>X@HzVFu<ffp`;oEFkR_77&l!)&ex-IrAzDC~oGSwE&e4j2sOhx$R*V
zpe4IApEYoVBo~x2SXhHi`3D{^0;Q3e&%m?2)d<gg2Mg4GXE?;jz;HJ7B{-{r*p;VV
zDuJ?aAp^s_B?Y3O>gYxR14G2u0x^DJ28IKF6$(Io%2}X>SMKxzNiGJ4Sv{b1)ib34
zG|&vW$W(E40c6`NsEh3zRsd;Lg8P?31&~%HXoSP<QURpx2r9h}F&9AEj^ODVP#b2}
z9B`0>yS!B)4TYet#;hYE1(`(*g#zLX48jf|i(AVILHl`U9RaUG1a&KBT><N3Wk_XU
z(CsS}kz`<)HKzeIRlvx=(7?dKz#yd8&<5h8V2*@)KN9c#NV@kU`Q8r(1_l8*C*j@?
zMg|56hzvv(69a=n^1UArPSQQl(K{M&PV&7UEDQ_=$oj!uNTaD7MW8O$>`w535Jf!j
z8_RSRig>{z58wss!lo=mAkWSQ6<UkriUdHFFL<}3uuGAk0t3VBjo=j?vlAH@W*>wu
zln`cM*ljLR1R58Z0}5&J<RVaa0#eGGi55Y+6C5Jhsg(>x;O+$Y;5nHKMW7lJ5^pOD
zia@7*3z!Ii>bX{lA{p>Db72Ms@oa%&(DjvbK>K_+tBXP1dPWWgk(|^#hGNjk43K*v
z%D)wZmJc$3jW&ub2F(vJ>;$j4w7$nu3|fmZXEJDX<XbUlwIIVz29eB^3Wj3PFaTuH
za>JWq&^W-H$zUHc>||h=vk1~l6lP#hSj|xk>i*9;2|6;l7`*xI2GkMY&2NytHTNo(
zVo-m74yemp{;e2P#lo!uWh1y%meLFibN+#?nzM+3VJ;scFa@p(6odNsa|6Ibo5i-E
zQqvfe;#R#Y234(d13-1N^^;<I2?mC_p`d=F(w|}naR!FDQQ+B_IiOkMIdOap40BGp
zF)(D#E(TSobF)DPSurrotpR634e*V$<{?@N#h_mMT+j*LD=mvbOPS}!gR-~4)nd?M
ziMf0lpsX)#RO|~HzSyZD;>*AgTvrS_#E@a9hL|q{L(jir&?x)dHyWS`QDv^;K#<C>
zS|DEd&SKD91H)G>aQ*@X>|DtC-{4D9az1eshjK75%mWSRa8?(Gae@w60Qt6ON^v--
z5pE1ln)|nklz>iJnzx*Zfg#PX1e`R%Lr=xFC6F#JC{+4)mO#3^pinu-R|4+xf)hpc
zk`i#27kn^?P)`Y{cf$Za7{uJI1e9PICJBjT78fy;fD`N_&_%E63MHTf>mnio>KpCf
zS^_%qWgckp&7??y63{M-`JjE`wv$W1i3+?Aaei6}I8lLzkSt%7fD#qtw9@J4N+5$v
z%;0ub31n~y<Z8Ff5>V=b+-GSfS_0{Pg1pc(r3BLZ1dk`pjS(pU72)#(MUoQ>7)nf~
z85rhm1_jni))GjM6Fk{<@~TJ)XlKRzN{BiuxVjRV63|!@M;KUL@)e5`I{^lU1$9ge
z3{J5nkj^B?yj_YVkj^B?c}X%QkfRPkE^;d@0X5<nz_WBsvrE8JIN)%!^C<y$Gr^~%
z?h!A6>_P{Xw@$?+pvE0!M~TeM63`S41Ni)aI=>R|loj~=fOeJ=@RSw!?1Y|=C7>xQ
z2JlfO;X6yfyCiplP6=2NTLRf72^t-ov!Dbtr^5gq<KVwm0-4eQ4G3~dlmvmwFYq3H
ztKB7#2_4WFhtbax$b60oC|Z-Rl!P)fFwCzMW?+zA!B_%HbPJY3k^*QZ2UL-{fuu?z
znHd-sbY-xVB(X9uEVv)Wz%VJJBpG}PM;HS`!itg<UQmlEjDcat<dRe{8`RV57UC&M
z<X~V}Xp+RhuwWyDNK#4~LkW1p;!YMw1c6TLVVJ}wlAM;#Py)K~g<%pqB#~r+a?&JF
zz`G=uWP>^2Yg|)%T}nV(F&2V$#u>dR$rlDW2^4iglS=ZXK^z{4AM%w!98gWCu27P%
z0pfu2+VWQ=`34{kC`4AWmVoy%g2#4dIh7QGEdq`0*vu~}0&^TeUeQvmFalMu3n9m0
z8p%LborshbG8oCqGB7N>Yamiqz+eO#zFcSmzA$}mjW7ell7I+fkiJEr;d#e!W0*eB
z?S00w;LZog8IIeH<-oNOXdYqLK4W>%SaF#J$arG~u<;%s<Bb)?85kCYfu;uztTqPM
z@jC;+C({~(>-e2PpjoqpCc+F1JGL2!gKDP5pw$;Vf5gSO7#J3_f`aLMgSa@D14`kF
zQR1Ler58(s0@`Y;IH;SySPe7?x0_L1N{E4Bu_35x(|ar~&CS5DSPhh@!*s-DKpa<4
z(C+#!E(_wQfx1BT+r&ZMSR4mRpgFt5<v}v#pg^BAPaJfA!(ug10+o^#2VG9FxLXJ0
zT!tH<)oY8TO+XF=6ClyWT!%sH18(p!Ff3L8F;l;SnA)K3&J6~J#jc?C`y{YRGng3Y
z{<oTRki-qJgcnSr9K0S5VRkZ1qT7UlA@w3yag87Y!=h*ghQ)IrXK!225?7I8U|2i>
zRCzpMU|0;Av|%s?-$}A~g%SfpVV$@RD1df=yF+te%I<@kLf{j@7oS&RVCY>bZVXa(
zAFOPG5(7hWzBuS~UMVT?q(+Jo1H;rs;-DjX)oy`BKnL(_QWpmw%?p_d2~c8SV0$fY
z#|K*10aoL~#=x+<SR8UluMz{p!ujG32w4xPUzX&69mB}*fDz;|CMi&gi~%{sH$<L+
z!Qrzw6XfOquuy<71B3EKi&D^{(WScJ{8<XBIY6zBvSNl(aK!;$u+Xnj3a&W7MWKOA
zDY)XeAs~{R%uoudHyFT!we0Mrka1H`I^pv#1&s|b+yJGMfGMSrK~x2i#KJ^|Qpg~x
zib!H{Awwx>5S5WbLnJY|kf9Vbh|0)ezyLaGb;+azjZ)B{=+bT`28PX#N+G>OP@3L;
zpi~_c0pNjUcJ@*YaPI|_rgdkPYJxeSWSrYj3hIhM*2f**T?*=oF>)v{WH^*6vobI&
zT^7c`FgL7Jg%`w5WMEio4DO8FU|?9f4IGl-g-v_a9ZEs1v8AVy7#NmzGcY6wl!Asp
zmw`6JZhlm126hR^S?uhk=3ovetL+dgwE%IzN6z@3D76H0xWLC&lv;r~pnPZUR%#9A
z@G)cvlp3=#Ff6l$ILm|=w21@ctW%&OiAzbK6x0M;7MR4quuKVj4Zunhj#AL5!?H?|
zl%yPnQqVO@kX)aVQ3|fTc7hufw(0_<pjv7fXvoy)MX9?u1H-aF29e~#REAOyF$RWZ
zdq9C__^A|9N%43vFto;$`tyMXa2N|f8D^QSFayJMX^~P;BWF3N+hO#gG#F}5G02<{
zF$RX^{2U^ncnlY1U|22!@}J?SQt;k-aLsAMR|?)izf%Zg<kD??3=GRa)zON^h*Hq$
z-^=^KM`@QPf=fyUk)qUehSDT?28QMRpdj7oT?*bM4^EUutfgrp3=GQ-f@~3+QJN0o
zRDw#PlV?i7d*Q(+1?Vx9W`kr7f{NN>^GkC;oJ#O=t)-x4!@cJ&l!DF-Uje$y#4)@S
zab~!9dugFK1H%eKP>IbQR|?+U4xTPh{!<DX^<(4!jjqb+mO`#G0@Wg`W|u;45ChE+
zoXRVO+#m*;A?TJYtpOkA1uD%KTb6=0%rJmw2y$CX8^DzTXbgBQXDR5;uoY$zpb%Ov
z2~Nul3@hBg>5&hVK0!UV6=7h$I+*{4fnf#Y{6`tk=*@~S&}n*Nwq-0lAPG=j7byUl
z15(!q))xp?SN9Nf(wSEoD@a`*1H-&?N(>ARH`T!BvlN5N9T(6V-EV5XkTEwOEd~ZZ
zjdJi3+Z$R84ADo+K`U$-!0aXEQJ_vPh<)r-c{GT<6O^zgF)*xzod5BkL5qRGrlcIS
z3v|U7Ee3|<Y2~2ZokC1n3=G>E%R!qvA?)sQ(B4ikdqz+>Xlo~!-7Ht0!p*<{W(VIW
z2d}dQUB25qsT{n_7IaqvM?FsksJpZhwCpkXd<D3-1a7c4h*yA06G+!&hIa*ciUoY+
z)n@(*b#UDen#Y~ArUKN9f^60`;;R6)ej%sY1%Igk&$sLZUw6AQMVNtsC6u)S)Ja+e
zn)EIIRsqVOkhwp;kP65Nbf7ss2hj@f49ZUM*&bWO1S&xT7pp*LnYcZxgiIEJ3XtTj
zm7uv@IayF@mo=&c6*~}zxLa0&d<AicyHO>?TcE+G@{g4eZ-MsUrQE7i<6vOmcL8OJ
z$ySvRZ}BlPFr>0nLcGNfiiM276=8}D46E2dgNwf;v_bL9EaU)<uT@*Y9VZS3h9is&
z3_^UM!P`|!3K$rKq$G4%VTx{n71jS|0G(v7eN;k^kAY#;Ne57Ro8(~0z~EdfVZg`0
zz{ms^v9M%d;PI0%1RY8V86)<1#K;sOVZ_M5u-Yt)fx&OJgs}tzL-^b<28Mu75+)L$
zgE&Fyd$kY)!)i$S=Lg%RD<NUZ4AKQ2=grw+$-oe{LBg61G^Gr(D`#ss1A~}|gctZ!
z{hTd@3=Etu5}+!S@o6CggWO&TA2E>HLIwu?_Y%HfeT57RrKJ+SA|P=~1_u3?6272u
zuBTx0HWxB57$-~kfmK>EFt~|J_=DMC*-e%V3>Kjh{t_U)V3Cc53=FwR5&>W}mJAHB
zY!X4r3=G^$L9*FPK_W~N!7>aCE5Y}qWG^USU=U-I2oWu0U|5(b5z5EFz}ivBz>t_J
z5e5pc;z9-n$2Ah+V0JhIgMfxa1o&q8<OP-t43nNnw1I|^z@eHv$C818DMg|OAu_{~
zfnog~i9R;a!J8l#_=4g>flZ<xAp$yWlkuj+1U8U-@)S!3hPq7>;3LXG<p7hfN;m@p
z<41|f{2+N>1rYDA#1sfmCY*tRAzfk`n3p^Obiw!riJ9Q41Ee|`w6G)0USbwPq{EVd
zp~PBZ4rp1GF<4EDB?E)RD~Y)X5%65jZHf61Q)?_481xQEfEH{sfOYsvfNZUjSOk#=
z&Gj&}Ni2r&O0*al3|2}k;|0YCsLYx!u^h|>m4Z(h7}ib&CtXHxf#msLVg)Y)!`c?m
zr7QC#R)Q63F)-}(lvo93uVZ9jh!K?lpLSaeYNRSLFic^SfSimCc0FiOU>Cc@BhdM)
z#+D2WlN%*oBEmlhls>X0Ua>JStOH*Qo}2*+im!zX3>_&F@4yNz85oSEB)%Y&q{uTc
z7;;K5x=VmgI0W00AkV;1uuy{010fV6&%mHCNrDkHbs!AhRgoM48oD=<VDy#;oqZ3|
z=<{O*qlE+`=t!CM!r+5_B^W^$JVH(cp2aW0m@dY^uwEFnq;7}01Y?FO1H*a=(7e<h
z3kk+dSq6snvY_>dLiZ#X!N<yc1uYg_t|!3=I#*`B5@><l`9~6rIiMXm#TxdYzK#TA
zF1QK@ojH9lPJ%HHEC)JfLd#Bq5q!4HS8%T>w4RTFAuNp#<XBL_@|A&MJ>>i^76#A;
z6Q++6jG*%@*HweoO`r8(KOn(a&cLu9bfWuIGYQ5D0Z^(2O=-C}OE6YSgHBTiIj=Za
zg0TveU%rA4v)*)Bg0ULR11&gWdn5tAMu6cf=xmF`pAw9<pmbLZTG74Yn*?K>1jqu=
zVb-F35{&gA-h~68l8B+0fnogxa1AO8;;%PiU|9bE%$EmE!W>yzC8!Sa4mj9fC^0Y?
zU8)j8M8pXt1_pDUD$rWy(0Z_%3MB@HnOar42wfRU3=AQAs*Di2Jd_w1BKfM!BtU14
zgLHZSP-0-PxL4%~*X0eetK?RdA6%C=$gYYtRY3?{AiL)Ntx84c0@=lTswxYi3uKpO
zVO1Vnmlwz`vn5rHa9v&?y9%AE+TgmpKz5bgs_H`M0@<~3SJhmEE|6WCnpKMsx<Ga*
zH&!i!>+%HICHtysCtQ~&$ga&>s`kNkd4lZPsa$mkp$lY}?YgR~2wfn%cs;9bA#{Q4
zs#d7F2iN5RvTK4w)knB450G8mtySOPx;#L3F(0k^h0s+Y&%j`^q>7Ojp)Et6fgwD%
zictum&qJPpA*QE_Q4Frp{f9gQ18-gxqb6LV`wMvn2D`UajCyd5?x4+B&S_PQMhJ}{
z8;g!sF}fl&f^6JyxQfvWp%G-`)~i*FesGO$ARA@!su&aD8r?uP&ho8dOoMB51KBut
zVijW+LL<mVyMijlT7*WBjeF-+F*YGIf^4j}tYU0~Yjg$Kc<gZ%<4m|lSCEay^Q#!=
z!8N*qY_yzG#kdHe5o9C#^(w}#2#p{cUHYpScOf)_Y;-?S#kdcy(FJ5<z`iQRi*SuD
zARBwGRxw_KYjgqGIB`N1<1K_nkd15SRx!SXYfJ{6Wh?crit!UdBd9Eu>!@P<hS12N
z#K17Av6@kafnhzksbk{;+T&JVqXssK=ideJln1Ca37Q=-xLBhNHcx>8vTXu10}ob#
zPNXt0bX>2|2ip`7p}@eyzyLm|A6*?;{8R>p<*_x+P$ymnn*rL-0dk^<a1AJA{Z*k(
z#OXqiVoA*!ABYnx6c~6J7;q~F+d%@6%D~`PQ<DI5q5?=O%!#?TYEqFykqcA{gA`!k
zR0f9Pyc*D9xS{m{G;m^(Zw(|{@cg?Bp74S>al^zKNalcrB50!|hVwuIsSFHT7t}zq
z4K19=dB0{BEEErbEQC36*4vu-D4__tdIh8a1E(@DEO=bAm}U_j9$vE@;>7>I!Ip#L
zGnIj1^7fiN$W8=bn*mmVPNXt0%$QVj0OG{h0}Kuf3@qRXL03o)Kb3)@y07LI#EJhd
zf&&niqg_7LfHuCvv&(-&TsEXKFl>phc?@wP=K*;~1_sbDJuc;>iL)^<2unhXAteTe
z7S~!6uyaA}0~-q^28MI1Yc0V+2^Nu1VqoxTthE6<1|(t)s@smfto4WMvfiP@z+jS8
z3mPf(R|Ts9ZH8X3qc$9&3sjHBY^%*g=mOcrc(yhVZkIL4uJV@JLbxs~kX>hcYFpsC
ztUz{I+tqf$by<PzvRhZ%gU|)Ct022}K0+7BuJyNSL1$h=TxbQdYja5La=0!_kX@aJ
zYj?qQS%U29{ad>qZkHv<t{SmgL>s~qWY-#lT0|Sd5@eUy%UVPm!V+YcY)tK4xLp<?
zyOhOhKfvv>0NJJ4QTr8cmj%eK<oenl2wkAkcEX2RMs9>Q3wZ{HT}x^iL5HJ5d}bjb
z&%of$UCSs8*Juu^$4uC386i~-D2B{;fcgZFYZ)Px3|I)XcBdqxmQfF(5oDvabS<MJ
z+(vVdjlzFx8QtJ6H3!*Py|WhFnSeA;%|JGqf2?JUfon7a*;tfc%a{n)Xa=&e!mO4t
z1#Y7m$VM^QTE;SjMv#qGs<n*O2#p{c?bU0+4Q_~yrXU*&XVx-KgljYf*?9hKE#ow}
zMpKZDEca^}XTohX1=-lOyOwbcLL<n=X|A=58xa~oHlEY1W!wVSXacfPBfpmMI9#I%
z$i`gxTE;VQjV2%))8%U!&m%N~(oFMVXdVOwy-r671H;i^3C1a63=F%!gN0i7Kn(?X
z28L;WB^alPGcfD{cTsg3K;ocAe(QV*rahp+GD!CwG?WkOR_rkccPltS$I<7WlwjJc
z$-uBj9b{yp#Ck>shR}KjhCR^;H4U;7O#47;yg+JVe+YuQAq)(A>JUnH$Vo8m2Pw$|
zD`@~3<FCrVuxAlM%^rOTrUM`~6G3WXzym_X3=Dff`$rgz#X+u_q$9yBBF4b5XDdia
z^c_&I&5D6x&r4XJTAqPHc8>%rXy4Nw(0m3{<Q>pSA-5%1L3^AaLg657q74iTdqEd~
zGZ=$UC)mqh!oaXnMS^vb2uK2Cya?#hft4R5I9|YmDEtP<#v2R_d!xYajt4nv!*U4@
z&>EY)VDE>48gA)tB)E@(E`W;%8KeU;X!1)5?$Zb%1$hRBmQxbk7vMtLALJPrY|cw?
zgElhxgEeX&kY`|6Fhzp<7D5$hR>$VKh7jCMVW2sjxY-&aatsXO-$3?hcPKG1*e}vh
zP+(vXdkYc?b5UYoD1M-!EW^Mc?g<jn_EBPBSW=^*uEf9~37Q>Z(gvyN&DYSDV_=ZX
z0jsf5VqiGjprJ3%z#usVBoYQHnS3^B7|Ag($b+L&+eC?hp(aqn3?u>?$z#%1QDR_l
zJ*i<W&%hwR39QRNiGg8`gN7YQ1T^o&q%8wF4&$wc6KD*<5v&Fz!gpW8Re^y);T%{*
z1T<puhJj(<F>qM_2aOx=+qQv`fuVJ(x-3YXmH7i>nt~t$gV+lOhJA0r%D}O??=DDL
z1EZ!mNF1z;0VHzX(Lj!YLGCO_<W9pzMh1r1GmQ2yk@E>45k4Cxd6>v@2aw2I1(uC4
zk#vxC`(qdw_Q!y&1E0q%cUGQ(VaiG=9?<rv{XQVqYx4*)Fi0<9VA$URRj1Fuu)jo}
zfuV_Cis!g0NCM=F)CZtl4N6{8JRnaqCNLB-FbHMW$q9mPb}3|F$XHz$3L2%^S;)Y!
zR-+EIyoB*+0RzKIpSoF~<)<qn>Slv(2R-rBp%S!L=|B<_1A{9^CFuNS$YAjHoJ!CV
zXvlUOBfd(|8YReD3H!5^JfK#=PSCnh-j+(xJ`j#D&?IjD{7T4PCD0(R(fdl!dZhzN
zpg~?XiAvBu5cN9HHur@om7o)04iuR)fbzv828IJgVBdmwZGz_X4}h{AgE4sdX@;Lc
zC1{%Xz&$1ghK1KE#Y7nx7>|O6o})@D#lalVM9`wwl@eeMXco<RL!~5`1De<KIanzL
z=71(zqGKyTlieI?8lVZPscJ5jpcNqpPcktuWc;nv0jmR<eSxnMv>@c*Ns!swoGU>K
zLgZvY7Zj|^s01wtfm}n7f36aAP#I)rQ`M46@Pd$?plb-2iYg%^>!4GiZN)2%L9MY#
zpxxU$?pA^piZDz9?Y}NCsRXS`VweP)v6<^$3E74On%J4{Qwd(9G|7mGfnmY<O3)f5
zeivgV28IKhDnTnq7{F&mOtz{7E%ajmA091OSqWM~!T>%z+UjH_XswcZA9!0mC|D2P
z1P8M$$m?qsE7XII6gmXjuyM4ro=u#A;ZO?5>kB{BL-xafM)dXa>mmDLI6y}d)I*X4
zk4ObWJ$O<4PCk)JhI(#LsREuY+jgZMoE*|XCzod1)q}UffY*$;9H{354QGMZjBLG7
z58fBEQw}s`1fG^y)WcE_x;*31a**Mm^@I$Q7(j+gfH(MnrX)C~)`RYOVVJ}O-oIBb
z0Xms{5_o<h$AG0C6t9O~iX<l%G1SX|LmT9q%A@r%pyeLmH9wUH>t#U0dN31YWEmJ3
zASUE4G-<fZ!N71BG(mQOuK{#Am3kh?gl*0ZSHU-)gXV?#LK?1t6F+Ds)nrD)b#RIS
ztsgL%*Kh;O(P02x$Fr)dfrU>Bn!XPQgKHZ0|KQn)l>&_*i@<vtCNVG^E&xmN{%4rQ
z$iT2thLM|r;cz@mXD?WiA1bNA#K*vJxCX4ygjs-rK{5u+b^u)rBN<b`z_8*-lLRP-
zuei`838wEfNrCAXP0}EGB}<bGixC4uPN!QlBWRu25zrpz%{tBC&Dac+K;x1si<%h&
zz#+)U&%ltO)XWH8GzMP3KSjTp5j3C5FbTANf0srxBk1@WhDo5ISl*Uq#t;tB<-n}`
z3=ESFHZy{jk1<RF9WG_`zL_zMgMr~d5*I%M1DixMBj}2I^*UvK28M+x&ESpM2a3!=
z*NOgUW&|H}z7sUoxmLKD5p*6aN0<`>XgsxQE;CCr<9r5&BhNus_t`arkEVmTdwp9o
z<3hN*kMuP&f-X^Dn8akCl9<fU%m}(p{m66XU<QWubDJ3<_o*|3m-B;i#}UZ+M@*1g
z940X^9OVFKm;Io1kAAmW#JCw4j{IO_VDNj~q6ufeX|aK`zqa^;*w5J*7>b^@OyvfJ
z1RDcGMsmwEZjjH}7#I?STV`{EPR?XwV3@?vG9M&f1XBODWg%RBcFQ7=coInbYs+%D
zcyY@Ln0SI#%UZZO94#9`;vjR1nOio))pxaQ0f~dmNw9C(30E)BvKJ%{QlBxYWj}}w
zQd4lU1+<$^y$<9yiIx)}agdslz?M@mGc)hDoCb-5)F)cCT!5K5|5VErkT_U<WXm<U
z`ll_|LE<3wnQvR}z}SgSEe~OO%l@}Kg|V|-TVBG|RJ6Q<iI>c8`2;gF%eUn-TunpE
z511Oh4=sN{;vhE^r?vb8v6GA#7??D5S{Omw9goNJGcdR$w=jasH}K|^tW_<HplDv1
z0@|E%q_2e$QpE9rlS~UEsFV{@0}apj+qW=6>OIix0dGqSBWTl~kQ(T)vi$iijF6fS
zbSAga`xZt}@g}6E08Z*HjGz^fLTaEhxfiCiFoKpu3aM#;D!*e#7#NP{gOeFQ=mH71
zM=gvZvJ4Ez<5?ION*h`j6IB=(4m1feFzmn2z;JvfSfva|<(XYAjL9ICouHCpCj-NA
z$odaPP-;E7uobjs>i9A?28NRQR!JTP20qYC%~qFI&_!Z=;JYh8dLZ{7@__XCvbD<c
zFfbgy1vT#k8`v^IkesY?t1?LL8%z#z|A{zAF780977qi%2_ZHH27`mGpyN1?e*>lZ
zS*@ToL|}2Fm93zQx545Q-?w_f)Q4rag6_)(i|=4-1<l5T)t8&Jf)1_%i*H=n3Oa)d
zEMCdl3OX<fEWSCr6|}JfEFPNJ+5mPR8v}!5Rx9ZEU$A)Tqt<?yxMEu?=xAQBc=_yB
z&;h$(b5uiGK_}&c#rySIL5JLe#iP?&x4_(~Vb==k@PNf@MOqKT#LZW<g6<Imi%<R8
z3c3yKgpe=;!}eZ<*4rEm3@1Um++31dLHnj4he#(MZoLDp20>e8vsSf&P9s{G0;*|k
z-?iQc*DL}epd0C1A8>*6gI2R$nAG|Z%mKA#griy?fjKgus*?e<Ug4w}1H;KJ;Mn2^
z#Yla5>r+_<hLcNJ7#OOqw=(jAIA)*~cLscIEFfonWdh}cHde5GpgJyVRU0U}SEhhZ
zI6Qflf#DP*WRaQM!!}Mu28NTMMGL!cwQ+$b4A~eMTwB{An{hzfa1%Qq9Sb%F23y7s
zVMzvtl__it3~fFgpoR8e_QH1^po0b(ZU{3l<Sf_dSkA$~a9Ry~GD-*d2s!YA;nuSq
zD?yIB0Sb|@zz)z!pO7t1{f9e1m(?(UcicMocYyAyfh^+Ujqg|o)&mNj-Ju=p!8HJ=
zvUYsY0XqJZVG`&ztB#o+8^JQ5b*eg|9h<-$&}~-2*&U#pH5tICGc9xI*aDUToz7%y
z-LVzS0oC^9XF9flIiNOd`MnO%k)RBdR2XJ6GB7NQYi0b;TgJc;{JU<C;A2JxhU_>A
zo=RQ@hSLe4)qcg;2(Zrf(-Q2f1)nf7FtnvhtOjW)uVw-52wOXck%2+yW*%st;pu56
zpjDNi{ZmI6$`}|Xwpnz7Y)ilI!odboS6k<Dh>d~a^gfV1ptJQvt3m2)yj`-u@~fL%
zUV!9pg5)QGq+HZG9oWhk7`R)NezP70-6fju44UJ;!N72a6KoMkDaa^>8w?<MuEkxT
zG0&Y03}@s)Qj-{-GBPj-1lU{f8Za=l&*}iJ;A8m8z;I>)PjXTQL&tM*5SxvGp}Du?
zjSK_B8PFZ!oYftmTkaS+ctH2tbo>PeC<_BabW;Z-BRCdW7#NI9IvBzC-rZnfU|9H}
zgAsZzCLaSsGw1}HQ=z&H3_f2vK#PXXfG#xVtnSz?4%(~33pRB(XefRX2iVlznxJ*R
z9AHCtn?l(OKXmMN1hIKC89MfYto<s$#=vllyW^ZP1H+l$44}Mq@~i;^16OXx0+6@A
zGBBJ4-4}4Qvtxl8xTS2sz|eiGqY)+vTK{{rv!hW7Bndi8^;<_HXge3^&PIKm4$ygU
z43pRx7}(7_K(}TvOcLP9FJS1HEX}}h@FoL;0Rw}Aa7QJ~v<1A$xhV`Cm7q!9ue`;n
z=?oo}iVO@4J2^nt3wBiMfR<T;Gzq`#08j9P+y^?|^=M~Du{y{Jyr3IoJHYAgD@b9&
z>5g2O>7f0WM>{)m!3sf=mOLHlP|0(kPTSGWj&v=ADe2~*?LQ!edZ`_WFomGi^G7>7
z62S^Vk}UBZ(J)C+!|!NkN3;gQlxR@sgWb|Lr6Uxk5VV5%XlF+#SRu$1gM<!$m?Wr>
zINI6auL3fKgMndzTZcbr@cJvncmB38cP+5#@Pui)z`?+9w6nt#Ns}j76N4@TL*9lC
zEk*{0^Tv=s)dH28pg>JM+M%TYDsVX%7+jBZXlaAkYzz!@tvhre=>wEhOhG*fSW+=p
z2PG9y@t52ISvJW4jz?kU4sl_SgBcjkgBFjwBzK6bgB%Jn0km3_0cL^%G_jd6Fs%CB
z&S(Pl!G$WWqSO+Gc1AO>%`6NIfj;ffQ<hj57)qwMLl0Tv0<BhWhn%ql+TU2|+Rg~R
zy5|O0Y92#7Wa-0B76u0AFYS!rOLRaS_n3A@@FhAsxpEoW8S~{q-e6&1*nPj9u>f?k
zk+CQP!v$3q28N|^?Tp?aFN3u8yl!Xo0dc-^fwrQyGx~tKUtbwOib1WF2Jv>rB9J^t
z@eJ>F#$p&}Gk-fH<N!ym+*FX2r68Fb3<6x44DF2dAP&g&HWlrR4ZPrEK|$$2V@o?|
zhZU$qxd6H>{b*<V4^>dGf-_h94<k^JvM?|NpKoUb-TlHai3N0zSUV%QzY22%`22>Q
zTuEsR?cnwrXrnPh%#U_P@K%(aTxAUHjG%5O!z7TM9^2YMB{9g(i`L*Q*!~2xmlKi&
z+n=bwvtauZeNYzU0Y?=0L?=*2&sx>~iVKu-7_1o>VinpiKx6b`B{;dYUjUuB1WImM
ztJ*K9ffVw9BI*(-o_F$OGPK_SvA%+In_X%Lokj<C%3+A^eV}ukpt|=d!*w43=>h9L
z3SxZ~;3;EhKLKs2889$#aJGZi1A$HY4$d3x>%e&yoQc}kfipMQ9pD48cY*?9@tXFf
zP`6(Kt@}IL*}fF42doZUMT6Bb&u<6a0SGetQWC`MX}X|Df|xzc3KU5K;Ih7b7C55W
zKqY$nY%m*~T~57f2Ujd#85l0Dh8WQWHUgpxbi)t$;@gEE+WW!&<Edb1p8#Q1GPF+w
zvp{ZM6x&`8b2I4d|D&Dl_1Xxx)LVev!p6X`?Mizy!v4_T?d33S{~`95gSCOo6ftVg
zf=XTn4cZ*-Y|jFhn&85yJquJ3LJFhyEC-PJAWd`9+Y?}#Vj(7iCW#NFKs13H1mHO4
z%WemkgOeB-E?0s>7Siu!P-S4KSkUe#!oYBO9xrG`al0Ql=|Mu(PZyL7L5alAvfUFj
zp0SgG;qq>XLQl|E&7Gj4F6ctLF(U)R6#+=<F@~j{)T8aj;M4;y>e`L<z$q!0q1_Z*
z5`dQN-)}bq7X+Y6(IvSZvh*7qTaoA5)u4sj70^*NF3Ig`pgqiAd2$)rHINL@1RDTy
zWb~GHInV&nR|bYFpyOhXcDBpugW?5ZlLADc83RMpj#j21Xuw_B1TF(xnZUb&zOsPI
zz*Z*k<zY9##a=5Dc)>JCrqZ>Q349UQPKI0t23gitCO42NlNcDT+~O)@Xk~&NgTqz9
z(8>hbPRB5b;TR(WL-V>;CVP;=ujUL4TvuC}G#MEfu7a8x3o~1pG^IcsP&<INLz01E
zZDT8wGDse@{|h7!8WX?DEW^OC^acaNRR@p?P=}834TuM-RgA&6eq1$>WMDY^pp{7$
zq#1O{8c4IO4A^i<28L4yTA9Q_Qq`QGg_NyK;&7=m-K|W5AgO6kDM5r(T`Lm@NNOKc
ziUTag!oVQe*2=^M8OoDnVCYb7W&8<JcN3zH@h4avgCqk(tA8uwXOPqvsMKeKlx{2I
z8%73(YoJc-!pv4iQ0wg~Gf0=+!d6C5v+o*cRWV5FDMA-_E8|s=F3_GYkknPM6et3~
zN4qmjVlZQ1a6H$_2x_*0N{nluJGqW_wleMpH<~yZ7|Or3GVTVqnpnVIVLT+wz;JDb
z01E?y?u=H(L#hl6*XBYRXJ&j13@gt{GBB)P)yfDe->zNdWMJsYX=PjoI^qsg{^xbJ
zGHwJH4_uiHt&HH(?JL7vMh1qxpIRALFiJ8otYB+p>}6zNxDMKkD88qau~!RZA-Gy;
zWt<CcopR;pF|;y*4$Eek1PTLn`&LF!v+p`+tDLSvD`O+5e>9(yfx&oID`TTJD02#M
zftp{fj4hyYW+wy4=Y3|aj3waY#=vmBSqRj=Yh^3}H}Hf&4ZK#y5^xKT6V$?MWh{X-
z@yr+)s@hr^VXd?4peqDGK?Z4_2|;Xuw9i-=7-D|3GJ><kPLPdz99tQqpf=tBEw~10
zi~<+qP_^J=4R>-S88Ngnf=VieNnA;W46TfD5RWGrGqf^-E^P&gn=rI8f;K!bOyYvr
z3T|n91zD88vz0LbW)bL$L6AiO;1(U!g#qBUAJkUx)<3Wd9hF)c-C-J+aDv)xt&Hwq
zjZn4V^CQ8Ld9sxel6hGe7_!f|GJ@`ggrq4MlU7DMm?@w`NkG=yft!Dvpf+PGqaC>Y
z2X%`bq}6D~z)&F9%4h-AcoWo80BN*9)@T9N$Y9REpwrySsLIH|a5DlLTdJT;4!Zjx
z^=K=jD!A>)32HmGGOB_bkKi;1-pc+Jlzv^3TNyPGsX=>dE29J>s1#&ixCy#m1SAid
zz+eECXp(KMj8fpF4+`GsYpsl+f&i3fZi4RD069|-oM%AgyhK(vDE;4j050ddL8twJ
z`w25@y4T5rno}GM4C|+NuhU^*U;uTB@;bXAbv{UQQ$+WCMh1pkvJlPlLEU>$6JthA
z_k1~o=J}vh4b?o~3|!IaGB8Yk(ha(i_ZDc<B15PfbTTezP?M2?q4rAm1W>?E(q&-S
zZ_(WfvI2B7ik4k>E69pTy!mNq4Bf5rAUE;m=P`7*f||&n4ia}tcLzB6@su%igD!1i
zm;`dDWk`25$dp~6p?JIQYEbBd9F!r{T@CK;u`w`kr*wlZn1ZzBij2GS!A@XcxCOec
zN6W4|A8a*5A*kQMFbQNw3D`D}9cj0_(-;{TZiD7(Vt#akH>iLDL(8r^4OIU^U7e-}
zcXb*lEWoBfc7}pXajfnJRsXj^)qTv5Zt#hlP*V~>hkrm_od7E5z^zW1CEbxwm)`E>
z0OjIt(8;9WNYt|Hjs#l`GC3ut8<fp%gRc0{vg-~2dj}Gdpt)j(N#KwS0EZ;VXONM3
zkWRii-CiJ{y@7<D7gFeXfkO|}Zjs9Ec80p+4rn4!%dXoQYz4>!r`B#OMh1pEph{oM
zuG<PM0kPW(5sOxEyCJ9FfpogDc7u90cR+n1ExT?LB)d)Eb|1Is)`i*K3UQ<^*b0yd
zYUjJvKz6T$*rx`T0Q*%9Jb?pJWBQ<50i@;-2LnTfP`3iu7KRqkR*jf$DX`JH3=BbY
zyM;ljK-WBF2z7%-s-P+MTw6CUSQRMU`krfH5@s}GU}!kf!U)>h3CenR&w>l67RJNM
zpnMCiu38um8-Q{Hv>kBwE=UUt1B2AO7RHm(3=DT4fkrSgTNod5f-)0VCPNG3BXE_(
z!oUC;H3r=)0`9rQ{AghWRmI>AO7Qs>CdfFnC<DXYY2fOwh4G|1xcUQ?CL1hT7%zhR
zN-PWvu~S<ZFM*2|u=&?O%&!7mMd?WlEsQtB85rb1p#+^4zY7|1WH9CjO^e?>%g4ZQ
z?1&@-1CxIX<0eK1hI^o4m!q96jGGidegqYK!d@+m%Ry40P1>Nr^X1^fx;Ysbgriy*
zm#cvM#R4k1TNqb@8y-;agRbSd`v~M%-5D+5H7=m4+nj+RF202kl+EsYvoJ6?&2C}L
z<!4~H?+tc4_y$%`3F!8$g%NV&rYHl$y%{VF4Ep>nj2WPTv7?|a=e^ZXp)9!2eQOrb
zsAdae88`q~7#J3bwlG%8GceqbhB~lH8ssZ*Ke2_e7N%^5cMD@3j1zpmg|QygTm^L}
zjrdx?T~ctN42sikc~G2+GBDiNW?^8Mw5Elz71YuC$^i3cw>CJAz<f|(%?Fvg6MpK-
zeaQM3@YwDC`{oP`CqB0@g4(?I_kgRF7RDfO>xGknA@yhrV-T!m;d-QnF-Qm0PzMJS
zq)`mA6Xd8cu%n=!4~JT4#=szF(ZUF72_H&fV7UL46B0P!T}fZTrhrds23JlXQ$S0z
z?>=GxHKDibwJ<_j#taM(K>KS!DZ(C7;T&gVU|5md%y<`+?9CY%rY~(~yvE4D@W7pu
zf#J}`X2xsEpwf}6jG>wF2Bc&)V_>k@*$i*?J?IqzHGY~IcY}H)U%~!v2DbqjK-H<P
zLNnuTT~Ozmt02Fap_vghS0#7^)bd)D+|0NcWY<=xrp=&}S3#PxRy8wjwq#&<uocu|
zKQcj*fkDr|nQ;Y3@gu0>6`-CxOz{dcuwqFDhVI$TjJ1pm3=fr{>S{r`1*Wdn1|-9k
z$<PeGFASUzVtzC;wt_P8PLO4XL8k#9Ip53}2QnlbYDgR?lfVp#vjiCeZqYO|g8Bdq
zJHaM`&lv!>pja838C^le&sPS9hi%|;rWw3`{!j|21)!GD43Ch9pmyxh&Spk?a61Xy
zsA*=j2RE=lYFn+E87*N(fo@|0skH>F1xX((Z)VhoN<RV}XbF<m2X}a(M(Kk)%23xr
z7Bqk~P7P~j1eL;|qVN%Dqb^9J8dxJ#E%>M&P+N_&x|vZE6hL6V%~oh;l!Ms_+D8M@
zD5nX^iBKEmK(#1XZOy}GMo@PMYzgRoGLTwvuv#uqtFxIAaxe|ZK>=5q;mx8)SD;}g
z2p%E=H~X3y1;JxPP)h_sM`nR7(G+iH<c2!vF=&A+$P#X3joe_3AWI|yn;98FYIia)
zJhp^-6x2s#*vVCvlFHD`2)?ChCs%%14ns2|Xhj92y<*GL{ELx+;W22g+*YRf7brb|
z8!|~Vnm>Xh$~hPqELoaAf>I@D>?r0(^Jh?)f&1<i;>|BXia>YwaC<ht1Sd&0P}89K
zHAImC14HMm=35}AePv*H3~FE;?QFgU_64}w+ZW$_5hS})mw{osY%^#u>4`14mDdb9
zs2SY4(EZrFPZ5;WI6ya7HSYs8Y(OThpWeJ5)H4CGEhL)vgT@p<&6eeI&HF+19jKkw
z@Ua<uE!j>s28QUT&4<DJfq60+n!y*6?F5Zstm$Y5Erfa!!c)f3ydC21c18w<IRVW}
z8Fd*Lv|O4eGcqtdDFapb!OfFFVe}PLneV#X+yj#6=U`yi_^Y`G-U7<M)(jf%egZ04
z)=zH+4RwP(lGoW>42m<*Fj#XL$fmCXJfI4&88k;IC(Fjb;B~mU23j`iGBC_;X-;Nj
zV0a2zS)`iQoU90{#yA)ltgbdE>wwsxaVp8?RB#E##=ubhuo-keD<p2SCpQO!G=ui1
z+b1;#gBv~Ik@@CeaPaVe(`qzWGsr()Tbq4B8bEz1`=n-H&@do4F|g@2JAownAQ9sP
zY7c<|eMU{QlP1U+pa2CQ;{pzs?w`%(Amw`@%FU6Ko5PiZP61;8D_@_|49e<HA8;@*
z6f!mIgQ}KEAQQp4`YSk@ct|#b#yuE7E%gPy&7d)kXP~)qU-@QbaBCIh{!LEJVvGz7
z&p<<9zVgjtVE6Ns88S3O7V3b^1RaXN@D<czXgu1)xC5jdbQH|O%qB+AeR+`agRJ#U
zjG!d(47C3oB()Jd%mQsbJ!@xR$XX8@MtRl_YQq_WcP>9G*JWTZ3uyWaGWHtiz?RIW
zzhJG=3=BuYn;1pGHGC5zE4T>)9y@9RPrEaKT0*HM3{8xjpxFP)z%Y-IfnjTRPqZ!r
zL$h`dsDgY38Wvrc+2f`P9+pvMU{K2KQD<aecn<1h_I&SA2aQpIGHLm@9?0fuHc*SF
zM;B}xPjUf6kAWBi!=X%YUg)s{=LI$fhRUNokh7jaxj`wjhaY6-8Ss!`4?nn{$-%(T
z^Sy^3+|A?#nZxe|HHX`?2eeRt0hGViPw#=;n#Plwm%`8^1kR73`J*0TVbJ^$8v}z8
zUk~`ei?2MH3_ajOExroyWHI!}LVaz<z>uuh%hUntb1r9Kc)>4}T)@!F1X}ZXC=(ob
zy-ZzT?|^3Gp7t_L1P^3$l`-@(f$yT+35wc{6}?PFj0_Af;vm|KKuzIHq2xq{UZx^5
z28Kh+p+=P;8&wMq4^VTZBd(VTJm9~R0c4z?U@ub`$hi4J<(YX5y-c8{%puSSMkjkO
zQ<y0zC^#7yY-M_x!ojl*5Szk5V;IXpErQ<IUM5fmdhrWtfD<TGVFox^fee7?aRy1i
zT;~dN-H!FWOn%_vf&~;?y-c7a%dit<wBfE^CQ$BqnG9}>^)l&${mRL}!1}S5Ngr%9
z)NT46pvDl?=Z45;gO2C~w;6i2^@0yF5j?`ez)&-*m&qDFzOz5PmkCs{3Lar#csUyq
zu4?iim$NW1fE);}S3!+pQ<q*QaJ_m1R5i`p+{*+?P@uI-FYgFdF!VC<gL2GHp-K=F
zTxCGrBnWmBS3W4lMZqZs6#6q)_cDHGWMFt@%*nvuE8oiqIyawT638UR@8Gd0kV%Z+
zH9#X;5R({xB1~fZ3pR;`fnoOPUdUyIUqP)$|8>2Lpb6tc%NZD6foiLxoxO}l6~XmA
zD9te*wT61mR;CwxU8U|H(4;S4FXIVtRDiQ|FXKnBdl}DyZQ%kf>+59%&y;|ILd&?9
z5wu(n+;=*9te5dJxNzgjWawqQ2QGKHvOrAm;z3achF7;)7#Mg;dKn*p+xFo0`F71-
z#y64-pw*<H2v>IPWt_;!!0;L}#L~++5!~VhM+oC2Q1XE!bjC^M(1Z>$U^;lsAH=CM
zz)pqw1=M;0M?J`?kdZ`C7#{0ooC~VwK;4Vkr+XRafxQfN_XaQ%luddRdKou?9V*Je
z@Olc^E8CzQ4KQaHgaaN}6btSJk4G{dWng%HODLJ4m$4C4UV&_gYU^ce1{=%5zyNY?
z3)s0J@3M;aGUhQdFuVaB^8kvXJW%>hf#f5`JX=s4aWXJ;viCCPBY8gG2IP5&e+!ZQ
z3p!qe;Va1GBKBU!Sdht}`5KVPvEYD&WFy8{kO80^%KEXFF%D!WhyzLrao|!AVsrws
z(clwQz*WndIlbTk!#691K#7^rU5<g_%}P)+{NPP<1_p_Hy^OXXo3BEoZDl~x;HF_O
zqpcAr34$Eh^s$$bhmnEdZ5Tuuk2FXbS6UK7FC!ngtYTqc*v#JxUa19+LmBB_$c!N<
z?L|NBWfX=f(^cqY1T`Ym=Yiu8QU-(K5R{=n$Mi6O7BT34>}AvgpGL+2niBC9?*-3o
zPGVqq2Rh<nGk@<7&^*pp4sb^N0qWM=U}IoNE$#gUjy*O8hO&>nzd&d1fvTbO4ZXiW
z>HRBLQ5i!oWZ}eDu5=I^)PZOC%9R9SgWIWJxr!KiA+6M}T<HwGjNny2U%5b@Wdj?|
zmBG*pSrYeEl!4(LD+>cdS$Z!c3#8@%2}wYOSRq0n?}1dXLAW3vg-G^-R=t4EEPwZb
z0~~sfLF=4AKB_$0`xw;K1GO4cOMAh$;edQm_ObUVl8>H(eZ-T&(EA4LES@5U-nS4|
zIz#VU&>+)So+O6ex8SZ056I^qpweXwy&oY=kiWq<w}QQL9u#iry&pgeTfj5b?;b)#
zK0-u5^IK)<y`LaFP$j)Kw-?l#eQ(K|Qe48&dkuU~8E<h>GDGh*HE2uOWpD2_(BK`&
zZ#&laUb6v}{v6<H>KeEv05zGWDEIDTV_<kclLOS1?*;7u7CZtmXrBtmAYRZhnZ5f!
zb9py-(o;$pdO;Jp?`N`sra^j-fxL5r2XxeM?{NsbIFq3lTtMCcw~#m(7~Zc0mG{Q1
zAct>f>s`pm!0`SyFDPSxZfJh965JZ;T?|gDAg}6v?A-`WgsKb-VXu2ZP2dkRc|kgo
zB|v!qJm=aAI(Gp)=NkRAHw~d%p|=NICb2Ov=zi>-4mL@Yf#HKANI;=C7ZjJEIG(q!
zHxE)ifn?($vPB>fP+Ml+zTOfL8yp`WY9X?<NP6oavS0@*^frTdP<<^RHs~HiRR#vZ
zi@l(8SUxI(U2g==!4UtNfnChTz@Qb}3qCCuyxc<fV=w4162T)NH+_cK3OZjAyeMbh
zzFvEX*`f>#9|a+@?nrI|?QvrG$^dm!AXtWh0Tk{#mi2-v?~i5RCV4M-Y;q?g@u(?)
z;~CT!=v4zPLjtwzMb7oAfqE*?!~;Ia8N{}g=~eRrB_xoc`g42b85tNpo`x7I4=Nj=
zhRVw!43$>{4YhDEFo>M%l}AdE^41`OASqJb9mED1YLwXv8vFdD05Mb;)S!YIDl88+
z6r9Y3wLokR1_qbCy~4&I%^cunh%k758)B%i4@ex;hVW=;U;&LRe*$$<7G^fEcu9iV
z(4mld(N7`Zr22+|;S=bnEe2yw(6Hkt7fA+&{W=XSpwZ?}ptGYu8l9y<8lgRbPZL2Z
z;F>3b(>XU-bE6~!Lrq2livc48!zWPb2-0i-*31Q(M{8gKUjqRehtO4MU@-=#1{MYe
znL`aMpsJ2xCl_e=seuKu?*iP|Xkf7ecNrR3EI@e;T#K#uYG45kMSKQbR{*j@9N7+V
z3mard)~W^;DOm=F&vu|vQJ=qoMHVt5396J1+>>Nr5Oir^VPRxo_zapE0~y2uHV9M^
zN%}W1{{u;ZhI|%gHZcE_MGAz^(-;^e{b7Odc^Wtnz^9#mZj)qSh<n+<{0*de8+Zn{
zf%zL)GsxVy+YQX`K~kXcACS54;ZoHZ4b0aW85q8Rnx-JB>tNS#B^NL>FoX7ofO`XZ
zoej*lKtTcWqR;XMX3#wVLTcbfas%@na05#K+$L*az6UN8xRMhY8knC-fLaF(AUCY}
z+rWGPWD)41I*>&Nz!rg|!e=xv?*d8HLS4QK>^x}PgS;I+1Eel}TLUv_yzk3WsJhMQ
z>e9D?)Ftd~U|s_<4>Up#vT6;wx`e%8b?Y0LLCadcfUa2ssapzG2a-zfX<!B|r2Gmx
z0uUrM2Q0-^#?ZhFnfm1_Gh%39o)7jqNJqk~24>Lc#aGb5dLSK>!8*WFJq^sDH7#F3
z>lHv!U0^A&VLf02SQr?R=Ql8eW_uu$$_aH1%sGq<3|~Qm-XJYGU@cH}c`!{gdK;KQ
zN54Td#k^`@1}(??3R?IB(v%3(6!W8j8PsoqbY-f28kj+&i(el=!_gHU75e)dm_b9m
z-$1LTKt|YujX;VD{rw;>?f=-o3~Dlc1C9KF)bW7Ti83&JGvO-EXJ}v+fV89qAUrV$
z52SUUKm#)yBLl-XX!>Vn18W6IZBuGs1|5F>4Rq)n$W#Wn)ZQlzOrQa@Z&M&{X8MJY
zy4Jw-1!UlQsMHsTlsN-~!0`sA+l&kh-zC7~unkPN!9}MKXtuF|={9KG0yHQ)!@Gg$
zHh54;C@F`bf$27=@SG%+0%n5-BSCHF{fioyKzGSAOoHZYru)#GEy=*J_e28|Xtl$4
z(CNDiGaHz$g53a9c^#p$+M$7|2IM5rF@hkKHSoX>(Q05S14)5KlR;8tU_+1sKST=@
zOjVy7m_Q}S_XSW7BTA5}=M9XY6&~L&L!=l%m&0CV2Ioe`zapUA2+rD!pv%q<Wr9pw
z{jY)X6Uf$gP%WR}4yroc!1$Vxf#C;eGJIiX1LJFi)cyv>J0K|)sIEJ3DX)1A;3<F~
zpc8^Yx~`#n!)qSM;;PLJjQc@G^gxZ+4>khg)`LiH1>Fz_D~1>kgNh+=iM+D3fpIHH
z{~4(Mtw{Q}Bk2d7g9_IVif>52q|&m1aV<zcXq*+~&b3JT*Ms$goLQ;c0G{yr3EI2{
zQnnnd3@oMCzzAw({RH*GK~kW07Gz|rsiJ`qG`9H@)MN!owSxmeC?&Iqp@Fd-G(`B7
zt2C#Ap@9)Hsm)cIQwidL##twE<rINsKwWJR2P^{`hX*CZNSg-6Zcr$I3S+l94UFJ5
zaUhOsY6Bx=0UQehgZA16aF-R_VX>8IU<BnHhOb<pk(CBU(CvcYFzIA(V4Mvetb&y0
zjC0^VUm4H<?n(ZF76y!s2%n2KFjg@#F#Lk7e`;U^O{KxtKY^<2N>NY<S*&efEC8ts
zhsIF>*a%1(ECyQ(QdaS^fiV-LtPZLy6G>S%LfP8}Mo=5|*G#CgWUw-j2^`xSz-vx^
zor6jRfTh5*U=5J_LP34C@^1~0>q5aJ|J`>Q7(qo5XnNuII`E8G10x%#vkaOZ1F2;L
z6%infM>`uBIU$1`pf#Qikkz9gnFjF&L|<@*cLO76?GQN7gU>fGiol9$BfbVk@OiYL
z$+iYYaH9m&DfyiWo;hq_REPAQL>U-<SAZuo8yGDi#Rf>I8!BWAx^f3R<@tLaR0wnw
zIO9?95QaW~10$$J2KD_xbKMqa8~%ev_)-iQ7|#A}0A*N^U;l`K7qd3p0W~2Yi&+~$
zJKVuz=ei0Fcff5vHU@^QRSlrKwEu{KTDp884evp21hu}8b~b=!DnL_-d<+bSUaB%M
zux@Jr<)%M{yak}f!&)T<hChY8pk}~Y@JJvV14E=u133Hc6yO1;!sAk)Q3W>8s6xXD
z7`yUl!%1kf0c3QhDg(pDx(3jyls~f|MuS$OK#iUc>clSxHD|ZRHh|W5`~i&yb4+c>
z2Q_Cwy^o`v4W;0C0}abIRDshH8)&Mf0kp)90lWZxp;-fH2KrDY1H+$xpbd*t8^FiQ
zP2#DjWM}}N7zdufNSfaOTA=w?3^X*`5DFT@$^_Y6A=dyJ&;JYB2+Zx-;0p>?@Os$D
z)CTa}+fD|CzcrwRCY}w};G7Fu>)6-;+K&tFaIBx+02vqt59l^HfD;XP6t@9<wmaCc
z9p@Uf!814v41YmeSAx$sXoIRV&`eB&c!M^0h>nASVTN~uHfV7VSkvlr4Kg52Ul|zw
z-U5#_H^_izz1cvW@&?EuoS+V>Twon&B>Z0pcr?9ko&>1n32nFkO93xzt^;KehOe+~
zEm{l=yC>8g19j^sX)!Paxz!y5Ibjk{acM3?-3hQCL>U<Vx$=P4rPqPZGGy2Z?lbB0
z*X@NQZCGpeUkWJ9j5$C}`hOvyf>XJuu8UEXfx)n@4zx_}-|;dA28RQ66@q09419;{
zDnY%nomcCszynxp3=C0s>Z-wPkd-^wKnn!wszDdf9EDj~D+C$a19>yGx-L(Zfq`AG
zE`pJP;om==qSRuBI`I0p8)Xa(zFX=N1wm<EpT7=tf;=cc889%EY1V;;fI*`g|3S-_
zTF=($gGvj~^wZhYI(=|q0a`}uS*H)`;DJUpj^)>Zr&n$W@D$|cGSnGMGcf$`1a(Jm
z)LDRAMQjWV0aNR2U|CCkZk-J%T0z;Y{9BzZSRCR$Ul98Sc)?@zF*^o^lol!8e{2kl
z49YAF4EzVB_!vO0F^&hFpDD%12<n!CN+`WeQhZE8pu+}O7#ODZN%1ksLOHCBQhZFB
zAP!e1gA^ZRfJl^q;r~yrq5=jfJ^^8n;ozdBV6qe+Xl?F(AJBrk8Yw<SkRyv(7#O;A
zrT7#<LsZ3Jmx<jmWnf^NC&l}Smyv;yVWv<~elCL)?;{Nmhbx&uiWhVj7`XG0%PqzG
z1h#BN=(rRwcq|B1lga;<;ssqE3|{`S{(}_nQ_vg-XqsG#_ZcV$edWqxkm7v?>T7%j
zb*-dVK4WBHNSrFgdr$lW<C_Jb8`>G?oM2>N5U=OG37%B_z?gc2fq{X8aZU^agJG`}
z?`iND(g()WEes3{DvWa&7#U5oK*KFkyr*429LB7G%sd7u-ZLPc6=P;VerXAV6z^GA
z21Z7E#*6^a9RO0i=RjN+#&jtLhGkczcrSpDss~*T!@$7619F?<8a@UF#b<mB3`+8R
zprbQD&f@ycdki!t|Mdf7D(K)O4#qhS3=9odq<GswUIht*a?l#Ev$jK>)$Yc?$haNm
ztPT)w58PRu?hK5K2jR}@0y)}+F&*Rr$&-8x43hu(7#O6q92gkpYe?}{f!1Yw{lJ*=
z1>{VSEljddTdF)57@1^Ywp4?7N^o0hJQ*07)Zw<&g4_VLMf@AcmK+c<#esq0LZ=k3
z3#e87^#fzV0R{#}3y>|WXP~yYcp=;3s=&a=gs{a;5ycjFIR-{XL=bzzf*9lnMJWb`
z{-aX7pyjuqoCzvI7<8o>7zO%1FeVx>FoH=21`a9SL{0`qW<_QOMu9mD3=E*n2o@mD
zN(Kf7R|W<KXAox_0|P@a0|P^#GXt}=E?6%!m;{-?bAy$cf!P`~o|3@8zz_%GfQI<;
z7#KhoI*CIqwE*p*WKNXgO#)fi2Qn69VKoB-LnVj<vJiB+Pz#6yvTzy$1H%+QsD&T{
z8JKgWkStroz`(EoX4zT>28PuP3^2<=z?M}?@g{>T`wub_WZ6yz28Qh*4#=`23=9m1
zKpc=|R~Q%=F2Q^k!@%%?F);>|U63t&z`($84`$(O1_p+g3=FU!O<-X9z?cZ~KZg`=
z3MT_2O9{wmkfq;2<3J$JO3<mv3=E76AkH=h22feV$Op4D1#Btk${rRZOF<_RGD<-$
zWdz;BrGc=t2CSt9lz*jo(?FKK1Q|VtfdRBGkI@9g0a@zEz`$q^;(#pmXJBCTg<0AF
zHUV_P8j7V+3=E7BFiSHS7#PzKmQDaCo(Z75EXA9{$-u}O2QnIDX)yx>V<CtGvb2tY
zfw2a}0a@C^z`)oAvvda7(ivc9BjS@0WWp?%rOO!@7?(0I_(2oT15gi`xmAj{loMnm
zNa=P42F9%*4#=`Y3=E71Kpc=|mlzlrFTgB&0k-S~x@C_T7#JVGEPKnqzzB*@2L^_?
zjZ(bA(EORi0x}4cKe<3_d&|E`@d|q}FmlajU|?cqU|{@h0WJtdKw?W67?|uB7?{kU
z#i6J-10&Z;c!?n90ne-3HKlkZz!eVz15+sj15=?wQURz201uaaWnf_HVqjqEkOFPg
zlHvsowSZcuOmi3*n5HOzMjxekr9~JRKs$+;jx#VY9aaEo2H(8^()@vef$5n-C4&?%
zWa}{l1G5_g1G9q^14I2cDP9>+%j7Eq19Lh919P&=2gYPj<ohr%vIi=F24SUm&7k!u
za{~hdbA>Y`0+Nq_Vm%p@WjLgGZDEnXJePric{V8AS28d#uV7$cUIyZ9V_;wg;VsZe
zNIn6I1Q5x9oXnUHGB7ajheiVPc?JgNvkc%Y%(d<VW0C}Dn>MqE6t5yD10#DgGXo>n
z0R{%<I}8lWH$a@T3=GVl7#Nt}!SY}dI9-8AP_d@T%D~9}1LT@H3=AwH3=AwnAkIn#
z1{Qe+1{PTmXBz_pi!K8Li#F7qNpnE%1d%B2WU*jiU@?Qblf{jJfyD*vOi)>xv;kC4
zF{?`P>aa2}a%6&x1z8x#z`)`U;(#oSVPIg10&zeV<}fg@WWg-l0=5uT)glKBOF07r
zODW94Cde6x(2^!;4_M0{NdD6WS$Yp-G|19k1_qXH5C>%G3<d_4X&?^B(iIF0EX!b)
zf@34;1X}UNvYCN_Wh2beeGCjNd*GQq=?tiNOFF~Az#t*TtH;W~$QcYW8f5871_qYn
zAP&gVD+~-Qmp~klrB4_bSRTPFy#aPMsI9?+RJ^f#VPIhS1he!%0|U!nM9_jNVFqSH
zDPDb$g-1Zf&S78x9h<_+3*xL~U|^MEU|^L1akeoquxc<cu&Ti<`~r3|$PDD5Wi@7C
zU^RqV$m+<zz-o`M@CUfou$AI9U}a$BG6We5ve1Wtfz=Dd0a+N%z`z;`;(#nnXJBAW
zg;r6?;G;pAJ&}CJTF$`03X4b9CI$x926&N{EC9AFREpP-6=WR9qDc%4tP?;SkVSJD
z7+Aqs3uMt+1_svEP@jQjp*}EzNCpmM%XTs_ux^L>><9w`>mdek+fzP|kAXp+6+~=O
zVPM$vLW-9K)J**f%0;)qEB~Z;S-|Zpq1@6O1}R<^&`yT0pu;!Se@pQ^2Nj1mJ}@R<
zVPIfX02PM<l91*K&vQ2hMgd7^qlo7Ph$jbY6!E-tXJ8aih82N4ubd%8AT%8(UjfAr
z$V>(aDV{g142<01vI7(j7Z?~=&%wgsHUk6eO%MkZ4zC#)SYN`z;Rz^7B|kwc+F5@v
zFtC1uh65Wj0|RI<17_(Pu%&On>6qs&D+42sG|1>V3=E*F&e`}toRtg=Y|;!2Y?2_(
zHU<VZZ3YH5O_-%Wz?S|1wGWX3pUs+qfz1+TsT%_W8={CvVFAT7(*Y@-cOVNpK*oYB
z3}awm3juLJ7A7(<u*HKoAPWl_7})Zm$tnfZVPRl8gKSwN0|Q$<%(5N^2DUDE8cvY`
zTXsW==RL@>pCBVamVxjr5C>%0as~#rr63N-vh55EY+IqeOHl#&4n(39fNaMZ7}$=&
zEWE_Pz;*#)A!r1Sf$519&j(fpM&2xtu^`JHF)*+_0C7MTzGYxwdkx}%Ed0yB!1fzv
zp#>;HQb1-P=TdeK1_pLEsD<pp3=Hgo2n#{;Y79&tq<B7pEW8aeb`ApryBq@py9|i4
zl7WF;lYxO<9mLtjz`$+^I#B>-p%2(XkQpczx-c-XJHagUXJBCWg%^G)1>is_fRvYC
zI2joE0zgKCERAAdV2=QCK$fO5Ft8_sI3P=l85r0LVU`wvErpr@Z!WXfF)*;#z%1=y
zU|{b;SlR)$v;&g3zkw`03NjjG>2wAL_NgEa$kIg&4D1U)9FV0O7#P^s!7S|oo6rMs
zHp0@~3=Hf$VV0g`U|>Iv2wHGu#`H&u=O-rvBfk;ISdfKR7#P^Wr8>yM`wR^1cR?~B
z3*Ry@u)l_-)D57d$BbMivHxITV29;J4mJh`4i<zD!PQU-s2bvs;`s%#a5>1>ISdRO
zf(#5C{2<Os1_sc!O%5p#XBz_phZX|^hX%}tXTUxL)k?^5$zjUCz+nvaA%`;q1BW96
z1GF8J0xmN^B!hqy&mUMjhQp76fx`!62gt%m1_q9B5C>#oIs*eoD$GJ~V=@KQm_)I#
zh=GBl0A^tW0|Q4LwB)_T$H1WA2qMloFfc^!m*N4>sC@mvm<TRGz=df&v@pHx&A=#7
z4=YUXfOswN!t|~W1EWAEyfD27ZBK&wu?jyyJ?StI(P+xRAaYQO=c+g(1EatZA#h)u
z=c*;B<P|DPO=pnexds|O{|YJfd9Hz06Ww6QW?=BXF6qGbfk6XQiA?}GOYnd!1GA0J
z2L=t01_q`TlCG=_jDp<E49qrG3=ACI3=ABdAdWi&1IIK5297BVFb$wda0aF=lI|c4
zHXt=14T~5UI6&Ps8<2*z3=ABr8CX9sXqYfCmG5L=6bxi!%wpzZegPH?VPF(Iz`!V&
z1{P%e4;GAo3RW>PW-)Pm1&bv>#rnYt1wMcUGoXTt7#Xt|4Z%VMP@!#Ly<ZrLJ}_uB
zFfct&XYglW@N}01-7n7Y^#g-CsGqq9<bR=u8lWj~NmJ0OoSh5|9D5lUIJO%zFk3Tx
zU{G&ifRYR>lIGkDj6%ww=oeyO;CR5mz;TD2ff;m0CumHD;~y+s)Ips=2BtZZmaGhn
zLLty_;pApu;N%2x+!+`+#TXbkMHpbVtO47y29$#(t$7(3g+KvrEyTdUsm#E@DG#&7
znSp`R5v0lL@&^X>17J;{Bf?oEZFv|Nh4wKsFk3xkVBid3VBqv&XJEGa#K6E=z`($n
z2MQbY7myebx(Es`D+cZl4C+5XLJ%&4I|IY&36ch&lQO?DFbadVTzUFSg0^fkfYxNh
z6-gSXF)#?JfkM*xrlb&9;RlA}4h#&e5ulJ1x6(*vkQ9<)U;v$C$63$7z*(u0n^?gh
zDWnMM8Z$6(&SzlYoDNz|o+&9J#K6D`T5+4#DJcpXoMd8}XcEN0AXdu2DDnj~{p_(u
zQdXXUQMl0rG#bkw%fR%+-~+?y0}QMT3}VfapzeZ*H8TU#6I%ub&XWuboX5o(n4Y$M
zU^smOR6vPMWMgC(U|<w6WM*J`I+=li^CklW=XDzfre{;YYFHQ;#3r)sWMyVxdbW^(
zf%7E;1Lt!PXDtH*=T8O(&hH@3P6h@pRt5$xW_AXqXGa+rxC9v(xcEVwiwq203JeTf
za&inz&+dYVmmuP+90SvH&~?aQOPHQ`G3Y^E{(*t*1H<VL3=9l4l4_h#mvb31FmUNk
zWMp7^y5IxDX;5)d!p6u3a`;P62BxQLpEE*T43XNz>Irf$h*%3Ec7mJ&a#tt=1D7v|
z19Ddl0|QqDh;x^LfonDc1J_g#=OqIJ*DeMIu1z4$R|W>I*9;6?FWDjP<@&|I!1aTH
zK?3Xwkh?)a{>b$M!wC@vW(Ee)<C2n`42)uznHiWK1u-yi3o<Zpvx_q@J<9vQa6$#N
zcSKB%jVX+kfl+KeNKFj`19vV119v1l1Jk2U1_th%3=G_RL7Zs}44^COc$`3-#S9EQ
ztqcr2l_1Ur1_qup3=BL+K%Bh{47|b&47|Lq3`~zsePB2NI$=VBfl+ieNcKDf1Ft><
z1FtTFGy~Ifz7Gs1L2V2W$-t1o#^eNYD=2QC%P}zUS}`#2T7W#N#lXPp%D}+u4C0tE
zFz|*jFz^O}I8F=<yvYm<yon%=9|Hq#2?GOf4u})Qz`#3+fq{1d$fn1>9~e$eVPFK4
z3=A=BOpLq?jA9AQ3`~!s85nryGBEIh-1j(xfq{1e0|W0mWd^3lrA!k!xIZwQdcwf0
zA`2>;CUP(`W-?DSVPj;>U;@>4AV1#yz;HT*fq@}_fl;gn<i~pq47~dp7<fUE{OC0U
z1MeFK2Ht0&C_4Fqf$4D*D6UKx7-LEqycw7t#e<`Yfk8l-f$32K#Ksc}IBf)#B%ng>
z_y$l(0wNh$Bqewl7{xiDg&ZFn0|OruwD{puV_@J@VbEh>1{FUi1VEZVBm;}2q$srL
z;WK1l;M0c|J$#M~41D$spjs#Aj7Brt2ZkIS1_mZ@Ss^)9Bbh;?S&D%HbVvkW1Oo$~
zmm+AaT%%PKG*r&Oz&DS9fp3mFXr-=3n-l}1<WvR*zSRs2d@J*c^2-@C+ClB*ub^{+
z!x-|C^K%$9+Cf`kAtEfY42+VGKQQEiCM6g+K55M1Wnh#DV`gBK{KLS&cZh+34>XD-
zB?9AkGB8ShU}j*H;$UFlJIBDlcLu~!U|`_8$-uyO9mLULVBmYoz`*wy#Iayt;QIwS
zND#zvfhl8WV3Z1AVBl9{VBlA(`M{7{!N`~ea-y~jBV#60F#{uG28bIb!pN8o8WUoG
zxf3+Z#=yy_u?XbOe^7Vw+cGflTZ3#6VPJr8klo4e$-uzx4w6=2VBimDVBiP!)unV8
z82HN>82C#;G8POB{2dGo{B0nP3j+iH3<d`NX)t##V_@K41ajvIBHSs}@PQ!@w8@5n
zQ$S-QD+8lst0x1aR4>TnnG6j4dl?w`cY`=f85sD_F);9-0&zAnFz~-%VBmiSvU4{B
z1OHbB2L6vA&T$3?0Uibh0j`=440$y$2beH2W`cr9TLl(Y28@j9U=be%P@R<rN}yKI
zI*X5iLC)5SfnkN2MiCn$1Eb^tUT`8RQU@g>HU@_JXpItX21dzy44^w?zk*mMppkbF
zp#&n-O&Ay%T^RU4dJP#E_I%ce2F=_^#X<~<)&UvB!N8#XOapRe7l{2vBO2890ac3}
zg&HxS1v6lFg+>f$bR5KP5Z8!>iO=xXhy{(egT#52G~&SGY+%b0xEUCws$q_ksx|@j
zvq6L$h){+*PAb-rf#K+X4G*y6u0R~;p$T#vFE~4Rz}8Wk{n79MJAyZvLBqojl)=~-
z7&awoc!8|?#0Jh#{*Vj>4HKzPCZN$y5U~VAtVCFQrGkMW)LVk5R^S68%LN7oDGyLh
zuXjcvlR<)~9z5a3z#yQ{z#t$h#lUdBOM<5!lnad+7zCy=FbGVPVqmz)FTv9Q8iy!m
zU=Y~Kz#y<$ih)64i3CprXa)!*c!+^PV4oBNLtmu?PXlP56-e+31B1XNh2oMT1__=<
z@XebH3<9qi7zFN0F)%cXNbodsfv$&RU;tg&B`BN8z;HZ_fl==cD5>zT5oKVMKF5`k
zTE-y3TPy)Owx27bAdx|W7ql0Lp_swt1EXXH_=qw_85Su9hE<m(_?SU!u8SEM1Opiu
z1pT=`FiPeyFl$FaQzmNyxJP5?^nsDp1vE&?>cYUl;3C1(!OFlWqsz{~Xc)l2AQ;2I
zAQ%N2sf_>ofsu^`q>v5N))tZASr1a^KcA6-F@X!DBHHf*Bc}yO1t+LqtRlf{3sNzO
znSn7nnt?$ulYv1n6~xJ4U=XZhU=XZfXJCvjWnd8OWMB|%XUJz@j5+;*k@F7Nh&!Ox
zqXcglXFdaCgy9E9&L3c5P@{oGf;SGdeB*!L2SzRd&<MNi0SVrCP6kFf9d-tW|Fanw
z1m`g@2u=cVwlXjX*)cE(8Gty47#M^)7#M`AK%Dao3_>7$7{s~5z#y!{z#uFJTAT2H
zg)0NY|K}eVxj?lS4+EpDElAB91_t4J1_t3;&;--}pC1^xKyv{X7#L+ID>E?s|HU+s
zgPnnqft`Utcp?LXa4(1>!oVQBnt?%hp~MG9t~(6O=FT9-8wTdWTihQQxg9_ZQ2kj3
z89`>y_`t~10rt`rDZV&X21Yqy&?-7J1_t2=3=G0|KxR5KFo-ZQFbMwvar_t<M3fj9
zMC3r6Xa)um8wLgu6A&kZfk7mmfk7l1#3^N95b0)M5Ge<7niv>FUNJC;JOFWe85l%W
z7#KvQ7`Q($a;Y#d`}lx5B@V7CP7I9GXEGXq(~0D)4~#rB7?{B%14D=eZvrU1dq73|
zas~!bKL!R-A9e;t$;}K5q6rKPqA@ie7<nE*6PtDitQfR`6@wN?#h^F?V`%3GMqUoE
z$Nxz1=7K!FkDY-rbT$KnXf*?aXeo%Zf`LJF0Rw~RG|+rm$l4E#d_JJ#a^?6Xc=K2p
z7!}l*85l!$Gcbr=Vqg$G!Op-K@{WN4w7F6ACy4W#fk8}{fk8|eWEKYlgIE{?gIExV
zBg()aR>;60mM+J@7^(mg(Pm%}Tg1R1He(_q17qmn4~%@E5m^xl=0aWuMtM(92FB2<
zAjOXuY#A6sBN!M!1)O{eNNXemgV<RH2C<V2tREQpN*EYJ-!U-CSAqhSD}VtkSOXR8
z0}CcV1Y4kji@|~g5Wya(;0~~$0z_~MRPZcV5Y%D$z{ocTD)<O2*Z@(v0xI|&EZE4v
zAn}2bZwE+_`vaqZ2ed84Q(SMXQd}=%tWv|E#K@S*XaH`-SuikcVq{<pF<@YjbKxxj
zg>XD59Gw^##GWxQh}{Em{23U;c^MeQ*+HBr1_p6`1_p6ePy{*r{=g_`0g6(&APL@C
zybO$rLhKBTpfxb!AcdficNAk_5btAP5N`m<C^9gJUt(YoKLg_EF))b#1KnQ%;#e~<
zNGLKeNXUXX9t;c;feZ{1{<aK^jwuWba@h=w3im-WnG6gP@eB+S(V$pyEN5Vlt72eO
z_$0@`=vV_v-hvTOAA?HOun3q}nYkDnz=KI)X&)E`XMlQJa%~d4b2u3om95wr7{f{!
z7$oW$7$hof85qMBGcd@_V_;PJ4U$>Gz#y@Jfk9#(h_jV}L1G;PgTyKj=MV#f!~q5d
ziG83H6#4oCqcCV3%}0Xi20sI%;%QF?#>l_y42)4+3=9%?7#JjOfH-0d3=;1c7$n|!
zGcZOeeqa=?U|?X-0m&#aFi8AlV37FE{ee-qfr07NcTf`yG++Y?>u~E2j3P3io}}D1
z38v4S42(*k*@bWq1_nts1_ntcW(LOaPzDA`Nd^W<aqbU{BJg%}9Rn;Fm^cE!p%BjT
zfl;IdG(RMFLV^i2aH!M@(l5%uAgRK@AgKi6fG!EqXJC-j1#xs47$mJ27$hxNKQM~)
zfWnx8QK<w}uGPRzXS4yufXEyM#_%m5nR-Zx7oPZmQ3N~!CwEJN=_|<PA3;XuF)&EF
zGB8Mj=JCU;85kr37#Jk|K<4j&ntv5!3bN}Jz!sbUNrR;rK_SHPpOG<x(F~mOg+mya
zE<R*%Wnc`u@PQGut(bv@fl*ls6kS&t7$jpE7$hS>h6pZ!8Ujiui4w2?V&-Bp0Edvl
z{|}6Ucfjf7jRfy}P6kF5P$_H3%fKL6!oVO|0IEKv7#Jiw85ks6K^%1k2FY~{43eO9
zVras^Ao-PnLGnH82S!m52F82$85oskfwL$(INyqDFfa#rGcYRe1X*nY@`14v1JiLG
zMgvg!A!-7Oe+EY7GazXPu#gW_=srlu1uT>T75an_s$gKeGn0W)g&Pz=p!RzvBSdWv
zM6HS(NG-&~B@B#r;}{rKj38>kM(%(rbA>45{=g`D24o~e2}F=VoPp`#-4BdnJfLp2
zJc|VHB31@Ql}0%RriZU2J}?TtVPKAz2c=qrlOGrb|A18qN${=&sd~lEz-Vxtfk8@)
zfk8?D#CgKNAZ5(JAO&iY7<^=4kP2mBkn(5!zz7;-0fn5(6>!Kgf|}EeLINOHqc|rY
z(tr?h05u?lKn-063Es7A;tWi3svj7|-hfIdc?AjHtE>!+s%6X!OmapH3{r&*3{tru
zjy(f|)I<gbsa|#lCOIDl2C2;q3{q=t8JOfE85rb^85mWgKr(R*3{s#5<rz@dRW9cP
zqxcd~3kD<wGU^=zgVZZ<+KFcSz$oqkN;~rQ61>+zmV&0sq9qs@q}dr5q!~dW16BkY
zuVs)AhbjVf@W6_U7#O5=K#C0GJ}^q|06RZJf{%}rfl>1jGXtYx0Rw|{Gy{V)Xu8j^
zmVrSUG&~Plo?-}MY-eDQ-V92T(-|0~FETJlp9FE1Ffd4eVPKGcr_8`;xRH6{4F-_t
zJ_ZIEAqEB+J`m?L1A~kf1A~kjh;xI1LB@%JLB>v;fk~F{1Eb^{u#e_TaAyiJFsgSm
zGcd_2FfhnOF)+x4u`@8q>M}6M6f-c$WP><X3=A@h7#L(G*fKE5x-&4yA7WrsTL_Zz
zVPKGX#K0hPj{zhV#lRqck%3X|w=x5hY&_FM4%QEhQX!yLECZw3DNrm|gY%124g<5|
zI|fFzCm=D<SVRUBhc756OVxl>gG9k45mP+_1K8xr3=Hy57#P*XK$gy6V37I4z##Jt
zEVYb*LH+{+qq-qTYBd9ctTF?GtRjOe1Cwm-2SzE-x&sadM)d%YbP)rCtTh9JtSMM}
z=Lbe<P%E5;fl)mlB)yM;K{lL$K{gnaC}cl<V3Y<=Yk;J_Gcd^JF))CZX@M$P!w(D$
z^8dJVL6N8g3gCYX46>~Z46=>N42(wHkftT*9#+|<3=FbU*%=s(K+bx~z##j$k&%JX
z$N)@Qh%+!6P5Zzo^?-qefk8o0f?I}_fl>WG_XkF)7l@DmB}68<DIXYR8bHyeU?9Qm
z&Bef|Q36Wv%NQ7BKQl1Mz6WtOGcd>rGBC*Tf)erp1_n7*1_n7rQ0hO+z@T8yz^D-c
zlDWjdAZN+IAZH5lsN91Oj546L0Sq9irwj~op$rUifsmN`0&)cdqecfPPC)a_9~h+>
z7?|_z7#KAcg2X_vm&xc3DsH4X7#RKg85lJ{6$YafsPQ800vaA-{lF-F18NXx_?M{)
zY`Dw}sMu4GL1hrJBT%uQATdaCk+}k~P*Vsb2C>i(lv-r&fGmV|##uiw%Bny#Yg$4Z
zvK%HLcgb2ng#%#10bpSd2Bsg&85lKFK?Typ8({loOQ3?F;eSxR0;}8r6$Fp}!&IJu
znz{^TY5`d74F;y!QVfimyOB(lQ-B(90Vc@(fl)38BnT4#g%(>51LKN*i4TlyB@9d|
z&saY&vUM;p8C_&x)RKo<!l1#(mOhy!V=@c(640sN3=IE&Gf03eW?KSP>I75j0#nLt
zutEoHJ~(he#$I4x4zyul)XIdZ-QdK)WV{7ZU$MPlU{<-oz^K&*3hxq7lK^zl)&C11
zYuFi}lAv}k6HJnc;Rsj~8Ub4SA?7lEzXPgdoI#ee8!#}&++_X0$bJNp`?X#{6fyZ~
zfNFk_Q5lTjx{Un>#4FnTP!$X(U|wP6Vq{pM1Gei2RFN7?(F2e$hX@0s-a`gPZFn&J
z0XYFQKf}mj0o4)-)xszO))D~KQVJ6WIS3LK90ib&(w+>Hvp@<djuuE@Xm0?8R2ej+
zm>`uj#{#G%sNK(mkn{oDxd&?JOPINk<}Fz64n$6e0VbCM66R!pI7LSeCR~8z6iyLH
zsOo?Qr$Fr>Ukgw>1RS26CZK*R1EWqTD7A5cCiOBvMXLn36UX#C9mKc*n#yDSz{vZ6
z0o(=Bsbyr$VsUU+kq24M`vxjH1!Q>%LotIASojB2cpW2S7Dq8d34@Yy0~08^1$Hnn
zdT@f;4-5>9>z9BS3Ji>`XF-e)Age%(KMc%l>p*RT3<gI19Sn>*|G^GqUI6WX>I8s$
zHVGiBgc=}fbVa~wSisp;2wH^bYJ;4`{DJY;8L-+dki4l2n(hMy2ICD-65~*Sc4vJp
zz^V>FRb@alGckc1S3*~y!u3#LW^gGYW&*Vzl<=9k;BM6ZfN-N&22|@_P<jA0*fN+(
z>OppiH9%!Rtsjt!SY*J$;8LD}QBMqN7mEVa>%JO{Onp8~914s~eI8&9a~PTWTtFG|
z_YX$qzCHDjydvSlz!=`nz^JDQPv#OaP$658r)$9hB{2bFzaFTW4>oQIND|`2DhAMi
za5V$i#u5<az*Gm(_5k8(y&2#@XTAV+o%RHfr=dne>j=H|P(QFLfD(Y@0tSZD7NBx&
z0my2o9LEOm0ep;aK!auAeFvfp`V5SEXJQx_s!Jqz3PB48i$5?VfQF=fK%;&7pmY3o
z?UUdsG=&T<$mK9F$Yp3VFf3P>;3@QEU|=X_V36x%V32Et4%ih#2khjQFfhn10(I#0
zyFV}_fR-J|Nbr;jFfi)pFf%af&t+hc1J#&o*%=u1S1~ZiU0`64I|Ul%O_&49YmAIp
zoQs*4O6jaHUcms%YYaXN3@n@yJZWH;GJ?WK2r^EXCIgy#1Rstj!IJ?Qb97)}h&V36
z;|g9Z|AD~_v^iuB$Xf=hv_Yp4NbtB?GB6r|EdR*BAoo(6fuSQ@f(Nt)+h9EdgS;XG
zgS@0R1H;B>2_AQFcrh@@`!O)cyD5N&7kNBIK*Ng+4DuBW4Dw|P;9*7{FNoy~^34nk
z@{Ljq40|jjc)Vp97}m=&Fv#~aFv$1HKt?PLj({Ebfx#?*fiX;j^#g-h2c)ntXoscY
zOr}!M)BzI*sK>@&wg4m#%I+l$%paH{?|_CN5Gp`R1^f^3F);Xp&b<f4v%wLty9Gh<
zY_P?Yfx-BT1dlc^BLkzsf3AXL&`_?f1OtPh6AJ?aUz!Au9@s}L3=CYKBzW{eliN2K
zOc@w_+$6Yvfpi%<L3DBdLDIzy+F-edAEJx<AK3pa3=H$XNpSy%jMSPkFnE5E;C=u$
zB94WDfx}*c`w>_ng9-z~I$;U!Sa2*cGB6r~_BmYSm*9@ofpQd<NN~rxLOIPM65Mfo
zpz&YuR&@z(@Iiv0?H&hKOK>L&GcX#y2JH&Tk>E}eV_;AYW?^7hD=)!49Xw*q!obiw
zNrHO@jC06Kf_o;I0}4BaV$cZ~#-<DmVto?aq9E5AIf8s*Cc!NZ3Jj1n_30Aa5?l<7
zMvh#`3=-Uu;PlSIz;MJzf?E>ouxJK`?2{7QppHecngq8Tc(cz_21cVmaAb&syzI#!
z!F8Vxlx9IK(rH2^6(t}Md5{Pv1A~B^1lN7gs*JB7OSnMy9x*-z9|S4E1vxmC;Ups{
z!*HF7VPM$wU4knYw1}bj1NaUI<`bY)ZYp6>keSOM!If*nz-TJLz#u=5fkA!-B$;yM
zLx;TO4>K^x@0Vg=*z`q$D<3pzR?NU4e~W=Z{+dE^K`Da-R{?0X@K<n4pF#eOLM2ED
z6l7l+7!;%#7!;Tl3K%4~3MD`h#K53X#lWCYB*nnsw_1X$NC9HA!cqnXh1pUJ3;~}c
zxQao7vJ4E0ybKJAoKg%7xho{NK!<*ZcQ7z0IxsLOT0n;M89ssUvgJP##K0iCg@Ms{
zzCv;lg9KL@IQKI!D3&rXC>DZ>a>f7###m_vM&r$(d;@7JGeYYj<NJ`}57r)nRzv(p
z7#Y)<xwslZ<t5_*X#0o}+ORbK57h*z(-@&ug^3JQ_}>ap30?{=r<oi;Wh?`u3AE+Q
z`0oKovZ4ayGNu%$q%X*2kb<450xFgQH4S13(;cXA9Y|>ds6oS21u^6gRAv%LrXFl7
zGY?d3C5j=;&|1*s095$D3dkAE(7-Uc4iokP`I{N+UDgkbEYP~#1T^{ys^|VUfV8nd
zYiUzHn6?!lZ7gR%Jqu8d37^Zyzz`u6!@!XENrLkbC}O^TVEAmqz`%P3lm;D=EfR~;
z86-Fl=|hr-;v5DB#SU!-27glt&O=U+3Peeefk6qB5;AQhIFCSz1qP)o1_mW3DF%i^
zOC>muLIstT85opdGd>Q*pvsj0gERx9`^ygupG!bf^PfvVD?cSTPjE6Ynx154V08b@
zz@Y5Nz@Tgknt1^!{KCS(@PPqDGDt{pC9*Owntp;Q3<nh%AcYPU9~i#!fK2=fDw!N4
zxa>q27|l$X85kY97#NhZ85oo^*%=rerZX@omoYFXmw-4+7#NgW7#NfrK!XnMb3ZVA
z^#S!7WlAJCFN3si0@<^kfkAmD1A{WCYwEs-fkAl-1A{VXAk_UN1B3E?1_tHZ><o<V
z*BBU-zc4T;e_;K<@D&<=W}pR6p!oUI0ctR?l`wGq{|}muVEFm~G7gssnuQQ&V02gh
z!0-*U6NN#hQG)ZD2m_-zXyKx}DFXv&>$(an$O<P01{FC51{Kh-p1VH-gNhLYgNhzV
zCWe7Q#g&0U#TmrOWMEJUVPH`4193_i7*w(u7*s%>cW-21P^n^IP$_X`V07>M!0-*U
zJ%)vW(HyL=pMgPT2?K-5BG9shZ#kem%Kd@i+Y3k~mI>~`WPm5b#TgjgR()Xj4xZMK
znJmG1Q-p!hf}NRx(QOX{gUUt*29>oS&PfIal@kmMDo5BE7~QThFsOWGU{HAr;yh+x
zP&Hy;P!$7lJ}@w-E@fa)oetvsWnfT!#=xNZ2;_P$1_m`|1_o8oEQh-|1B04B1B03`
z>j#GK8yJ{X4>B;Ce*@*Q63_@4!*_6R36z;ZiAtP-(Q(TMhW}eY!$>k~B)IfJZVX~(
zV01jjz@Qe*z@Qch8d<;0z@V1Kz@V1$0z4nWz#y|<g5#19(mV(#ak#~OVEEwzHtMtl
z=N*typtX^11q=*oWef~zpm9;RS_THSr3?&e^FjXTVqj1^!N8yf_WN`O2DN((3~IL|
zJ}~@9U|=|%1v1oO(+5Td1F)fYB)H5)7#J<NKneB;0|RL1z1lxe8okKCpf1J0pw0#2
z++$!+4`g6a_XnAC02DFY9~c>6WB=e7g3WP2#{FI2e_;4=0c3?NvjpdTkQJb5OVIg|
z>hTN=>Y%}0H$Dai^+E;)^?Z=Kr5PC1YZ(~St3ezM1_t$R1_t$Z5XY2(L47_0gZgY&
z21Ymk4-7xRGnovGmW?3U00sv2%?u3c>p_jeA5TE32O2dXuR05SVEF3*%3QMi5?pK|
z42)LH%nXdqN(>C@#~B#Z53@5cI_onqsDpe6nlNy-VPH`I!@!{a1tjCiz@Q<=z@Q<)
z`hnr62&5>r1dV%uG8dxf%<xkIR5O4I1lJWG7=9WsFo8)11`i3&M<7cxnHd;ecQG(%
zcr!3)xU(}bx*lg>(8yq5&;ZSFxn5yl(5Pi#(5M8-JY-<dn83iG(Z~IP;in5Ezh*(!
zhA?qJgIE6p!_Nw^w{#>ppNcRrT7!l>T^$)1H0CofXv_wg<Hx|Dv5$d4V-tuI&A_1X
zj)6e~G#u=j!N8!&&cL9_2$CsfV9-=#V9=BYahezyH1!x5G_^pSeg+0j7X}7R2M}it
z1A}H11A}ISI0Iwwn-2^>XMkhZQG)HSFax7CXp33!KL!TPECvQmke@=h85lG>85lG{
zu@oY~z@WL7fkAUQXi`g=fkE>q1B2#aPz*);ePH+n$~X+Nz7p&*ybO%i#h^LuXa)w&
ziwq2!=Rq8hgYPgfXx@TOaBIF`V9<O9TD17f0+bpV7_B=P88etcw`WUyVEB~-5|sGB
z$nXQi09oVm^#jAN9pDg)l;C^;3b9+DH~|I2X9fmM(25gR5e5b=76t}Q&^)lKA_Ie#
z5(9&l0$BU*4-CIez}izKIA4n}Fxr47ZCuVWFlZSvFlcGBGcdZ`VqnnnXJF6*#jneA
z1_rG{1_rHci4P3Fw}5)uU~?KjF#O&FHm6jA^Bu^XPG$y1m&ptaT3rkbT5TY67BDbq
zEoNZQ0>z@sS_THK!wd{s`$6W^fV{)~f#Ht@G+BVEws7zW4rqoE?0--ybaDT{@W%y|
z3jcr>Ap}Tpegs(sTC?O5$-tm>m4QL)GRUel1_rH13=CSJnMapm1_rIK3=CSI!A3BB
zVE8iyY{V1>28IL)&hH`&jJBXrZx;~;2GGV3El@$>qRqgd&CS4|&FRX(=wk7K;SYGl
zDFdS|Xxi7sl7T^6oPj}G6tpz1EcOG#AJA$95Xr#6A;G?lmx0kXikX3_EQ^6bTZw@|
zTLI*~2MkPQtHAwP#xJ0WCWb#}KpC6$1H&KaD5WiE^beE^|7-zO8-Lz_E{_Dc+xhAT
zhCiS!KOmBU!AFAgFUZ}yK)L=o1B12!1A{iG?sERZz@Tl-z@TjjiWjG}4-Eeq!12-}
z!NnuOz-TAQ%)sbW!N8#H#=xNM!p^|x)XKo19n8R>?GNHiVqnnDWMI%vg{-mw>1G3)
z0rD5e1TKjW4F7Ey7-PVR+-boFhQBAk8D^FQ7pDjVqdjP9-Dwj8gLVT0gEna4hSPoq
z2JM*)4B8Vx#-Cwe(B8|ypuHW$xyitweT#uX`wEEjjDbP>Hv@zAXJrOPr_W3iIVu?#
zof#MyWI=fgbV!(v1OtPP80!aye+&%FKHLn9cB`Ej7=!&74M0=|c+`yHpA0AkF)-Sl
z29=iJp)YVTo&hRiKzcKvdY^+dq3N9g(QD5J*9)ECZUDu_zYU-nN$w8}|IRQl2KRv~
zM$m|G1|w*VxikZ#6W<4h{~ip?V3L8sLV`;k6d<6L4^9dU3_8jT3_6M+pXxF&=;$#p
z=;(krRtyX}HVh0p79fs01A~q~1A~q)h!f1fpcBo&pc4rS@)(enpmgB)@B_pD8K9Qg
zf6$^59tkdWkS(BnzK)+67<AGY7<5486sU2jQ^>%elMgCRJ}+Qkj51_kw7&-N8d&TE
zq~Lb|4Qqju91qA(;GrsTuR0wRa-gB0a?rqx2U7)za$y1wmot2Zb_yJ{p^f7|5g<dq
zKu5eCpo5@{e?ViS3|}Ikc0tEK8UI><g7p6ua8nv`D+Qwi=x7)QV*yZi-62_pfniC%
z1gAcz{rQ!Vfze@;5Tr4!uL){Qvp|~0hTx_#=vdcq2~HyskPN7UX&frS3BHgXtn)Wi
zCpWTA&<a}y&`Ab7;S!vDV4cv8*XL=V;)nkNsPFGxC&BR=)D?D|1?l^9yao6Dxe6F0
zINotFFf0b0l-Z&s!SNonaUXP2&&Jsj9PdG0L=Y$Cf&|BV(9$jtXP%M-$9wSE;1HV_
z9an*EN)csXbSwv7@FBtRm6d_faXkY_s0&pHbgq={47dt#$NCKeqvI-Y$66Q^Y>u<|
z7#IX%R2Udoq$D^_z{1Y)AtVGiPUwL`2oiQ2r@&zc3NDKj3632w#ZG)s#XFRc6z_s7
zK6*uhV=-KDB2@8WbtJ`0!HQWJ7$!$aa4eHyV0234N&$t~a_~qHWPKXP3h;0Xs3R3N
zUxk4ocCG|RH{9F>P;<Mrkj(9cnadL{!O;hfGm!IB6(u-qU^<-zpgL`kb=o28v<K^C
z0S``bI3PR85$q%u1_muF2@WT)9s#Ip%Vi+LT`CL=A)h2TAh+2uGB7%)LG6<R&4@mO
zhOGivFC<-ZD8lSZ$&lbs0?R-XfO8o*0X%@krE?iLF4;kG=?uDVXq}M+`%}2rwnD68
ze~M%k`*W~?5UbchEdax3pg<`IlVAtkMa=-p0?t>VIxmBDg5+cBB-r=COm<;{%I^bb
z5y;>YJLoJ@hOZ#SnHCc4E8&XWp^8_kfZ_&p^>I7+0%M5Z+1G#_B)|n4u3+B+x)`vS
z0c6N|NeOoF;h`WGximrz=>gja)!GNv%EG{~iB*EVAIt&i3~Q5M&w*RN8>%x0S!W(t
zF*FqN!2u4^88u0Q-5aj+D^#bq8pz>LJAILL`oVQ}`AM)F!gRXoLv<R0!w;&{7+I$Y
zT<0uq3AT4|ohu+Z+1`Nz3!;<l1CmZQP#ebZ85ei}mF*Kurao7K?Gxx+uwqC8Wcv(D
zn;iBMY+u9}7}g7ehR4{xLN?2*Fff?(O0eCATl^ks@ogl}vfYIl&l4`eb`R`i76yit
z3<<XTU>Q)DT~w7|I|ehxEe>kTF(jX}od7F_gf`nrurW~gLkbnHOa=+I)8Iiv)Rg`L
zk}TNHgAD*D3vB@jwobTpOQF_vsv@F@tsATwYF!W5Iu-_oZ3Yr-y)q1pZc9OBNbngI
z1_l>r2{w4nbXSI&B?mT(6Fls~CI?z`3M%(&OC;D71VJPF&`5!wZ37A$C73Nig%WJa
zuz}T%a0xaQungFTp!@V78N@|Sg7q!T6Yg^%7PG!Z3NzOCNS<K*05Jp{=d2&WG9VLK
zKY_!H1#}aK1nXx|En>{Vz;N7Cg7q_Kh|?Gve5_y{;NY9EPJ;Cm+~y}xn@=GX$E;_-
zsv*J0dKPRm3j;&T7YWvLJPeHPPe8%Pa8ZSUVWyM>>vR!NkT8N;_Ck53xeOAl(?N~m
zVun}-2HEWrtS!7B7}WkSFfjOlhPXT&xIZwcOMn_qkahr5BwDjQhJit6t^{i~bad<!
zXko4kSnDas=oo9ZF=*JDfkCI9fkCGlGUmma3wARDgU&1l2AvsF3=BNs60CXPcwk`A
zS<1kmvlyDPAWNSGShznhd=_C~^p`-HJb_Ldf$Gi}1_s`*60E*3mw>jyZ2-B%^BUA8
zz9vwYY-3>1SqB*_X7z`;<N*VN&ONB}0$_q~85ne4LY)@~b)GI01B1>#$TSIS5IEa1
zFz8A$Fz5<H-R$`cRPGDNxO`yv1Uj{dhk?<vL5hLFzCeOC20E6kYsA2ys|RXSeJTNY
zi-FN|E~xbenmGe+6%YVT<S~4z0ZpGUFnVqTNrDGu89wzeFh;y&VDvl+732QE@M#AF
zV+3ei6g=bvZE|@&1J^fVp!&x1S_}h2<|+wRH&_6H_Qk7!0?5l78bEGlkO0zkXJF8E
zhI+;;8tfSpkR>J{mtu_o&~@^lMfnVjUXc5*BtVvWdB-p?^xu|Xb%0q4T22VD^Z?XS
z2Wa}xO<`crO@LYojr9PKr2;rD4Pao1VPIeukYE*on*U)30|O&?F~5%{)O-<Wtn0Qi
zFzD7oV_ggy!Mf`i7<AV{V_h63xQ~HBcLy}qCBPYqfkF2+1B32$Xsk=ZV*N7%gYH|X
zo1w9u!TN#W!xNC385q3_KrsaFr+@=70~FsM-aw+%y9Fd!0vhpV`0xi3rQV?VP$r1j
zM-2wXhyx6a-fIx*K3Xs^Mr1KCdV`}HsxAd82ATqf=>_+>85q4kKy!#MXr_(P17!cl
z4v4uvEJ)^Vfr^2$7sw3m4-6mAfXs!e0R?n$j0DR9Xh6RWVPIfR0i_;)W=KG@EHHwk
z9z9tG20czlK(j1@hN)g31A|@{B%oOq!vvQyFz79W1T@PMX!g?E&A_0y9TLziOQ8X+
zcb$Pj@2mpom_`YfW#CejfdO=Go8Dgq&>`y*EXzRCTVEL%KsVs%3o9fuNU$siPhT-G
z=$kVz=z}i%<<F5|Spl9nV_?v)W?;}yhen;hFgSXq1TiqkWH2!Lnn^J*a4<-)JOCX=
zRm{L(pvb^rATRNO;e7-HbKw(EPc1_51H=0jpuu(!$si-avR{vZ(YK75fiXgvfx$qB
zfx$ovvgVNCJ$Ne`h-6@pU`kL0#lqVLNGkB{0)=n|I2F7F&uB9+`hxcPg8FRG!8+))
zj=&V~v<}N!Q0MCH8qnY!>j#FndmvHgdl_U9q=a~T2Gp5lVDx<s5`!8JO_P4$Xh#$?
zQ$VhH#{n_K4;=pxL*79<dwx0~Lm+AGoexx<14s<24zw&_3j?EH2uKWK*}DP;#t3@`
zMnBLJ2qvgl18Dy(1EU{kR}?6Xv3_89w*->z{U(6)Ld^rE#g`0>eoGKy?+ZX{niv@U
zKnviRCUSt>{Qd*fEoTtwKCmz_1~xJ<`hm6_fb5X?!0@356ldHY7(T24<w}rZWZ%OY
z=l;Ur!cqiOZuv9YF)(=cOR!95V_@`mfYiDy(?LBZ&}}C{IT9?>jX@PDs6nM~Ey2>x
z3!1fMWMK5Kg4FITo!~?YYQnK}fhUS#Nv#W%)c7sn)^>rd<pWz=Rl&fJkS4)W&-Q`g
zDCo2z18@#|VF60c^`LEqPZ<~tY#A5~Oj$oL90e^?d%?iy4+;QATL!NW3`gHEF#5k>
zWX$4)tS_)y!Qi3dp~e8J-bEHmu$1wBU^ogoaSL2V22_9zE(4v*1u{5=fx#d_oPiOP
zwvX0;#+5`DNU&6JGB5`C!P0d-1A{>=G+iH^0!sfNl7R)Bu3s{KU^u#kfl=IwfiWNt
z(-}n{7>*ubU<{}Lx#wtx1dA{42Zke{p*QfR^}t53dwf+ufyuyNFpYu1090mhR!gw>
z3otM+RxvOb+-6`fI1eozqM^lup$G$mp#aj-gQFQi3=E<Z85jc<6mp7-7$jJ7L5-+M
z3=D>93=D=UpwRPSV78scz!=B_8nT<n!3GY$5(Z}5t)McqkAuxr2DIme*-q;N!;vST
zF_|Oa!&)R*LO2;113j4;nC;9N7z_;=7!3763Gyfpco>H<5R~YlD|x^}OpFGg9D5Wz
z+|K=h;iv^D2tdmVZ5cqP)bvzIu$X{SLGcF$aLfD!DAt2*z=2_+%K+YZZs@|mU}&Wc
zo<3(W0bO)g%)nq+!oXmdBgMb~3L!IS2pKM6U@)Ac0J=s>g2fzK)EZuAU@$x{1#Wq=
zSU?4hSQ!`$e?k)`WX4gT!Q}(Pu>b}J1``IxpgL$cTZ8wSF)$dJF)$bzv3_7U76K`~
zf;=GE3FQ4_C6G~|Am~ycv`J}!21w~;0}6{{4WQDC0TfBQ85o0gppoPVjU*!v1_mQH
zX$GcB;SUVQ_JG3v80g3-9tjqAUIxZsHf9E<N@WHHqhJOGqd+|drb+{_I%Y7*z`(+7
zDx}B2Y<C6B2e}udn}u7C$D4uK?kQN5fq_Mif!XdEs6_%&F$a<yf~CR9frkw=GjnVM
zND%5puz&>vQ|Vh!)VYA0=bN8Put<o5h7K4(anH%XaQ=}5i-bLB?w6B+LCa2pMIwTM
z0dy+@L$sj;i$pT$$N)%}j|H?(cMm_PW56N}E-gT%$ueFEX3z~xd-y>ng04xKd|QI~
zrw3?_4a7v|U$Dg^{n8T5zswOPGXDYR2at)(f59el<rOhVF#iPwE4ZiMXeGgX59Zzw
z10iq^h4~)nx@>4il=%U|4A70X3|}E;JcOHZc!C7;4!9W^5YI60LTK9!wi-0dVkg18
z8?H}_NrHI+m<QTTw3d^BLGP0U^8yQ~&p_T>2;+c!wg}Wf1)Z!c!3?@LoZ%~I#BSO*
z31)xLh+Qb?;C-V*63qUfAva@r1_pzj63l_x42+@R&B$67@(c{76C{{}lo=R9D?o*=
zh6M`)gS(>yb1=lM5YLBzGXo0)!<qFG%%CYBhGK94g6=e6_zD^cWDW(pnyZ9Cf;kl2
z{*h;3IJ!fEIRd^}Tk8ij7eN}X{1pO_4l{EHbSa7;14CFE$RVJ7Zp_cHo{@pUUlp|B
z4Jx3*z+k8+!3-Y|4LuAESWwvpNhQpX1E!%iLE7c~6F`Z^W1a-F64;TTY1wzsXjK9&
zvVnL8G%e2X6;$d@QjlO419kFtfcANU3YsvD07yuPfrh$^8M8pUV3{Srk;uScl+3_j
z6bmY*)Ws#3{($5C1A{8)45|XK?lg#Qraz!Nd!V|R{=sxtGcXucf+DW0P=e_QDB{9C
zLxx(Jj)8|-p}q-c2E`D+hbU-g6=YzP=`4J#H0%ObL0Te%1k*WiaDpz`N|s<c2VT(w
zS>45S9#TYs^gl+`59%E1&X9l^2dj9)nZY414XSv<K7$TFoGHPyiH(6V+*$~{dW>n4
z5d(vulTZPJ1k+|+28Q(#LJ&u6hLpZ`3=BtYC75P{v?M~c%+!Z#nI#7r!(p&vU~uM<
zU}^xVYKN+7FoUaVR0Sn}P#i9Hl3)Uza4lNR2x`1R;*cpHv;n%9lY!w#iUd<Wcn377
zDK7U)f+-n#REZksq|X>oTto<3fMb#=89FRy)WN`D)B-8QnNq>2o`Jz=DFcJiLhcU?
zYB``n9Hl$Q09u8pJ70n+7Hl{pXwMAPC9&Yt!~nYV;^0jQrU-Cyb6{ZTkCtEpm)l=I
zFsOp6aviW!vY^Sr5wtD5m@x}va43%i6X^VN@StVHWFhcMLncctQ27}OSvRP62c)oL
zy9ARy+yw`qF3<<N0Fo`3AlU+>IK)DNNe!;}CDc^VZ9IGUp{Du^gB0$nmSB>DDU1|?
zDwIRB-i(2PJ5z%3hX^Q+7#JhhLTqRJ0Xn9m7?O4we}U633j@QN!xD_Y!HHdzfiW@`
zn(|oTDL1l<D>pTlL4t`5oN_@W3llqd(HSUNa#l+)ae@vqE@l8t2}I6C)elkvO1V(u
zKsN$PpOs+z0QLg|W8@jA(>{QvAc{fKYqm)+zJN);hDyHxt&b=Mg+N8S1mk5;30BMq
znlXYTN5;$6Ag^*|<}*kzUImwiAZIdO1A9vV;(qWY<Ddnx4h#&tc1bYK29G0sU}(9(
zz`)c3it(s#ki^G08#188V04&)!DuU}Fo9h2{gr{iSdoFjSQ?TZ8Bajdqp=kOgRz;*
z2ZlD#j&c<S#;8^D3=Fnj5{w5#85pC!feHq#KMXD(7+OI`*n$+ik!N6-UN6CTN|b@2
zCjq1&40H}j>kkHIEobORRT$_f5=Q7oW5zEW44`&L>kUwn2NwZP85pD4z(oKjC}>KS
zOE3oTg4*<q42;ogoD2+(;S!7i8Vn4=!k}A_mVK3Av}9vojP?@(M<}BuD1jUi0{1={
zEg?Z{$H1_OOM+1gqz-f^-}>nij9Rh`49fhR3=BO}Bp9`{85kIKxWH{QMjc51^b{il
zLq7|n^aqBwpabq5K!F)ks?ES~Dno)%8njWZn1R7Kh=IY_2h=}}VPK3t170l1C=ZGu
zkYo`9gK+^Ugx-ScOcn;l=yy;RAQM3<Y8e=etHCNjnTUmfF-8EY0(4+DNJR$&gK-;J
z1!yfXNQDtp1+*|Rp3J~tJQ1t{RONzHgg{k*i+%<M<9Q4W#&baJq_-ZRwjd-X7=LFl
zGG-zcJTowWd>mZC$oGNa7-%~+c&IVvFzW|~<IvSAF|egzpu-S9FdSC^na02vvlD9K
z4;fHo9@hcSRD%|aHncLbf=Z?xP7;g^;F9STV@6I1gTy!K4-8vDn~=Z<RmV!Reqh)N
zU56jb4mIt&56H<|AAl@@38gSFL@+Rz&XBkWHthq0Drn(2xH}dbmIf|mFM`uKW0qnj
zg9PN#N(Khw^$ZNg%R$FbpB9kF2c6v!Tf+fv2ZD-rh8w(~Luw`R<rx?lIY6p5U6;rL
zt2zczl?7^1+~5V>2`7;y1Db#2O--s`kjPSlu#-V-0|+|>#I^#l85S@yFvK5}$N=Yj
z#yAEBf!h-4Y;g<>$=(uaY*q{mTKN*GV0%DUA*^haNL6NFjQs~185T0MVqiFIE0F?{
zj+5nJU|88Gk)jBewqjsdZzPcnmNDmGU@%jY0NtW|l^Nvp11=ItV3|OOOp+Y<JgYbc
z299WnM3CircO()(bfJYrJcwS_EfL2Caw@NtL@XNv1H(>`Q=>H`VnDJ7BqX9iG*h2M
z6k9hV14HH43TIGh^wpYy;q<h=31Bt@W86(%(8*?f6F|ula?wTK1kfdBpsUw(75XOF
zfi5=#U05g?+gAqF6wd^{C!w#*hJoQw3OE+}%0Nr}zk(F<JNM<l6v{&s=71G~Bu&or
zMZhFMmpdHo?27>144VRy^j_5mo?!aQz!+Z$(di4i86$;*fnkALpD$>M!&iuPeqi^4
zH0_P+gLsUAF@6?AlQWVgXRsy)P!R0a?gLMOgMy%Uf1d=*9Ty<FBuqfQ;Q$?P-zVV+
z>IZ;~U!m5=1G>f{g@G~tEe8XGOL89%D1&}wh+|-Ao~ITL3U%kdY5|N^3=GW~YOaio
z42%ilS_}*!$!eaU+F=qXeq$%7S%GB?!Pj1^S@D3w)t!N%q)W{Na{mNlf*(ZE1T>d%
zgTbGHVYR86E+a_g2Znf1;R9|BBwU}w$iUEgR!tY=gBy&X<SZ_yrVA-G8H_J6Fc_cF
zV_;0U4%Wp4CK(ts)bvG|85k3uGcXu~YLCw#&SwS&knP5xQ_&OtGccI&F))~b*83%L
zGccGaGccGaGJsBf3kg+|0=cr7fiV$ug|+u#H7PkLyY;M^6sR1$!NI^FE~h31y56yv
zje$W|K}`na!eUU)5WG>#z_1{%pP7Tvhk=28X+IO_DmHN2B{2bXt7t#dH)RIK#00Lq
zVupUE-!cr0iK&n(yPxT|A_HS$7We>L<zPMrhUHWE7#M_^>=+pA+r*hF85tN87jrT&
z@ca>Hs+0ibVNlnxL7b^l6U5;vNnsFYs+It$0y$+-H0a8vjhW(1pi9X?C;chy0Uf{&
zsw$G2wHX)`7{r-^K`x)fz+hs)z+j?dQIuK;5;SCBOloFe0G&Z+;-$^Nu-8DG33O2(
z=qh59ZUzREM$j1-jN(io>L8mL7)-V?Fqo|4WMJ6mC(abA%D|9%Q333nD2Q_yOztr-
znA}pxEJ|h&XM$X>!N34ogKx@H_klq<fq^k84%B5XVPF99dl(p#^1*#-A2x=X4-Cqn
zVLj%FA#9-KD4?Ty_!t<9d`~knFj&-yGx>s2F(|x+WW|~67#SE+LDR`ehqy8s#F-pG
zsmxda5;{(x@LmiaK#`IZX9BMWx$%La1auTWxSUP~)uA9ya2ta>!N6eZ%D`ai*uz+q
z%)kULXE!r~LXJrgbj6|+14D|5IFk^lO1;6rV4A?dU>fJgz*u+|Y$h861LtLNCK0Yc
z2FAjB41o-cMNEt!k`Kf#d<8mvv+x@OgJ~%PgK4qX2hiC^j79T7)rsJlh6`n&J#&VP
zjOm~i%nWB385kzbVqybTEjK<eD1quH$XyXR+r$~c6OA`MFqp$<uu`P785p`{#Tnnq
zf{!X>FrC1_VA^2;YI}$?zSV+6oar702GcDNKQVrS`pNc)I3wr=MbIq@rcW3cOdqg*
zU@*^MV7A`Cz?i}bcHfbP3uT}h&>Vao4LIu9z@r=Wo5UHxSO48$WME7Q;RIz6amIU^
z3=B2t;D(Pl<2_Kx3%dSRfkB+{8F-NlsIR!|vpC~9sP{@hXGjEql4`0jIPe)SGcYjR
zfI1WuU6Z637<x^`8Lz?u|2G4J=~r=R;BNq}K;t|j&Uk~1fidL|jtFpIW?%$GfSCjX
zgPD-m2ZoX}46q0|0FHo6<~|P4xpa)Mc;NoPP_l-B*#@*Hfw}kqXj1}cwHK%zA$nAt
z@etVk4h#%o8sd!L^)sNj0yP7`6IiJ&kbK9u1Jn(j#K2%?%)nr#?+iJ1RA~ulXcR;;
zaELSR1zj-#I(O8}kAcC=2YOtlStJ94SvWWa7rBTtf>&VN_`u+Ifq{Vm+@DKhX8pk6
z_W%-Esi57@%*A)WGX;Jhpn@ksIjb1F#~4)lf}=I{9$4@NSf#%JROM%|;1dQ=O#4eP
zFcv6-hOrD8z^QT9Uq;ZROzPJU3`*cbd%-uC1pE+ZtOJL_2Zmx$+j|Kp7SksvfU-Vg
z3pBRO(is@clBF0J4j&a~1P^=PU|=w-WMD8W2aimOGtL2Ba0O~5v@kH3H9_OG_yOp|
z2hOeHj4gZ&jA@`<3WfI=7|f<HFqnZ>T^GJW=6quSZ4hHHo5u{wc?=9@>lhf!)_^#C
z3=C$w85qoVa(`eb{sWKm256jfm4eooGI2}*ZAAnvM3!b?w*LQtp(F(~s#pTLutGqb
zagG23V>;+ubsIqj2D1|k3}(mJ8JKP47#Pezp1CIRfuW>?f!Y2(XrQx11`?#{puta8
z!4077!}@`t!~v9+7#P!&L0PES0CW<fgDq%_3PXtxR0@>Tn4nVjDxjz+i2xY}jvG)2
zJ1{WlW{WeXLqok3w2Bp+cQUHA!9_A-I<z!11BK5sNQTM*Whl`3V+`VqxsXiAV9v_G
zV9pFF))@1kab+&Rz+lcN4oRb>pcw`RE(vi)(4jsV>Y!w4#lT=L&A?zT3F5djFqo?`
zFqo@=7Mm7He_$xR0GbrwQW0k?;$&dVDD-4tEYbl*f&~MExiJHSxgn@XbP)iN0Ro^>
z@D3zGG8i2|g`Wes6IQx_fiagER7}L&5N8ArB;5GGPzoA!1}`1R)P(pd7Rgs}Fkjg*
zFqqpw%ZqrJuRIwT%-zKq7{P8#0K1V*oDp<2Or|`@c{&UX=Ftoc=8+%{$gOD%4CX0k
z85tOhT)<=i$gMq4w=!{nhN?kJN<qDh(gc`mOLvMh+Cw9z5Hz4%0m=?pdeFidbgiZk
zD7dN^7|hF{g|j`ha5kULz+gTZ;xEwR<{MHB3}&L@jIJ;*>|kIp-=I)jQp_OE=mrzK
z&cI-P6&kPZun>68z+nCql#0VXFcdL>QgIPz44Xxq(MyVfG4mbhl*<eT2J=r04CWs|
zr(BjYFqr>kU@-s90MjJ^S|MEossmZX8GZN}7_(HMx-2*t7%bSJx-29Z7%ap<flzn`
z76_{D;*3JjKqxW+^<zMRkfW^)sT_pBl>-BVg*pR+g(5T%gus;q1A|2n1A~PZr1Svq
zIlRHZV9~_DU{M7P4e+2NNN_C!gT-<w28N?E#TmgDi+}{rF)&zwu9V|Y5N8BmEV7e<
z!QwjugT-rT5J^LW2sEN(sUgL{AjdAw2)<h61_OhoDFcJ0F?d=;oKY4U!j_&443@4k
zkgJTZIxsM(x{EU~m0tM3P!t17Mx0Z`8D;qy7_%#w8JJ2RFfdrgFfdp~L1!F_Vi;J!
zDnT<2aTd@ShoTtJfw)DWQ8}a;2M8ZN;~)*mf<@rtjzJ^?i#VepF9T!tGEdME)zIu`
zna99jnFCsd4w?xm76HX}F{oM1A<n2Q%D|W-0G$c3tYu)ZtcJR)SOm0A8LSRzCZrg2
zC;<ah6h0FI;lte}@qwWz0u<Mv(v$^OG=XNvK>3whS)7px8u_K5(Hd~qJ(n4huGx|D
zD+eqpIv5x%+d%nMTbvPe<tV5jVmX<C!Ez$36aoz<FmS#QXXIvOV9Z$y^0^fQgXKI1
z2Fp1hjynT`<w^zy%jNJ=$OarWU&I-CxEL67ej=AbmfIK@EVqEl9~TD@8Q=iQ*&gtm
z4JwA1IH2W_2*{(Le*WUa;vb;iDg^E70MCx*maBuBhvJ~~Eg2>;FjyXEV6fZ|I@~(!
z14AL`czQ6&z#{&GkAX2a4Vr^2UokLPK7-~UD@Fze%l{1A9~cT(FfitpgKGu`@YuqR
zgW}+^g&Q9j3PAIU;A6}46V<?WUWB$OtoRrhthf|G^(}Zf?gj&cl@0@gm4;$sax#PX
zb!aGCc``6qx$@*Nh~EGu?62w!46>)iZ-Uq$9kC1yR*|v{%+?@>gS0SkW{KbCW?;;d
zhC13RpMk+D7v|_H1_rAN&^fxG1Jny;K#8sp<RBLD`@9T{c>$nUv0`AbYGq)sY6fxK
z85pc4Ffds4!8PfCHGxKwIK-c@GBD<~g4BUD&1GP)nhoNBG_7D@uv!Mv1a_JUs8}il
zjkB_dKLa^$7tDEE7#OTJ!JN0Bfx&7o>{#+b(AkU(oMqxKI2jo8UV{t<*>Z}3!RiEv
z1G42R1B2CN1{+BIPzbIcIGe;@g09Ob0)^%y1_mq8We-Ib3=CG^7#OU+fa(bs1_o<J
z1_mooN3$pZ#_{^VP*?y-PFW)GNp_C^QZ_0)jN1QS$bb$o;D9GHhA0LG#VGN^ydS`g
zb_Vbs{rnSZ;I7|cIY`Uhnva3Onn#U+;e3PmVST8WBm;xBxME3uF@yLC@Je(B25VIY
z25V)-l+t1b@slty0|o|bJy0Uvb3%L@G!grO4xIw`ybF|}$J+ZX0X4VSj)?DOWne52
z1_g~31B0~<1B0~{h~v({VC}=eVC@A;tbPYz?Lz|w215o0A${?spt+lZSPlk;UDL#u
zg02SqD$2lE;Kv4b^$I?)s|DD={#p;=fgIIgEe=}f3u;)JgVqLu+qDH76hWu?i%*0m
zQ0piL2J0}^4-6I@pc03Hu>jO@Vk$NOxy1t9+5%@B5pc$-s1?tI`m-3+aR)a_3(tZx
zNj}WP0tN=_EOiD3`9$$jm{=zRgLSJqxSa~VC-epbgY{en2J6|f42(sw9~g>lKtaU0
zOgx{Dfw8axlm_w`7_3(?Fj#}`b}6c2V6fi8z+es9=vvgqz+ioZfx#NIHKS+}i~}k)
z6QHSsRS?<+W#wVuF5Cc47x0D!>j#G72@uZ~_JUe}B@J?*wq@}gsNh17k4r%3yfGA?
zfV3V9w?f50wp;;;LHOW?ro9RSgC+xmW2|^GIB-C18&G|yz#yIs%Da<z!9ku38gc=R
zl-ZvUPX?8|pdpZy4Dn=3P=}F&f#JXj@nq2Ml1U)bmM#*HgPR75dj$sZIIw9P3=H-s
z#N$AwK~0DQnKlVxLLAsMkO{H(#3SJ*fNoY-U=WW44LO5U+Mf`Q1dWP8O^5_F6F}kz
zPKZZ>Vs;WJ1sz)|?gTdB1499*i8uw+-YC)60DA|thZ@x8vcAs1V0~T<>?kMDqAgI|
z{%2sY{;399|19nVDv2gBFxV(DFxbecfxYPj8WaPGIWaKU*npFdJ2a`-q%$zsBrAf3
z>BT)@V)YCRHr3Fk!lw`hhGR=zJ}?x3w(00FFc#lbXJE(>5(lqF2N^n%fx)KV7_x$)
zU<;@;EC6@&#RGU57>kcXt8JS(3=B52pw)K47ErYfR)$n<7i<Bg3#cf(+J^Aq)i(DB
zh5~TP0VSo0F>DMBHjrja0q7ty2F@UH4}NG1#%47GgUwPK$eM|Q3~*H%#~o*316eOo
zkO4X}j5Cf~kEar}R)T?nGY)PIXf~5;qA?>EBLibe4+{gsNj_sn9#D-k2|O`o%qRk$
z7!ze+EXf4VWf?Py!so(DYEXqBV`Xp^pc`w;*BCzonf-}_fx&UR@iSS_NFq;JA%pQt
zSq6rMcX`SR7>r+uGcYU)gTw@*-W>*p@-=J>4CZdeAHXh&W?(oHZp_HclgVHV9{Tvo
zQ<7i8VEhY|iooN&r8A8efrbXZGBB2g@`5INjTh;F=D;AfE;0w%$_uh;kw3^PUXTM8
z8-g4FO5dxE7lYC_=rUK=c;jV~3=9h&fiKfFUIj`kU@KOxFs_7IafdgjG>^f!612n{
zl+-yojVtv)^Ga;s0IUYPnvH>B-Vx&(DF(*UJ8YoCRE<IRW;1}Uo1J&kxCbl_^|IqC
z28NX@AT~}1+gK0w@*Gg{t2@KEmJ>eqxbTrG1H-fp#wm;pjAfuJi07R&PSFP00r7UK
zCc@jPpf$Wlz}`;NfO|X51>tSbb*KzGA-+jh0}bGV23m`k8LLCRTK1PWzktD5T?;fU
z3i8oOV{Nd@!SSXGjyG^@g4T#GyvqX`qcql6U|`Syo#4H2u`y_&rDiNoaXN#sp*RC$
z*<UsWhO<YFO~Ah70gZPV+kn_N*ccd?%#A@eXM=-CDc0ByBn}ELmwU$cV74d&W7#{<
zsO}779Y~OX0w^)i*aJKP3qCMt?jHuma$Yge5*;Q`>Rw`Q#K^<Qz*wFIPTfX~eBjst
zr*0!gF<9y@cLyhBBSvv}>MoB$6@sL0xC&6}jtnq51~U6KIGq_ClL4hOaMCq`T&>K;
zz+k6lbV{0mvHUeOvO(+9BLl!`+K7=A6pltW!Qsfpz_4$U(Jk=M3L67MGq=%g7<<cK
zqdPG6s&_{JAoGlT3=9ibxic_Gxf(%6kr@~(ctG)G6s!q~FVHNfNaqB`HEaxw6?=us
z3K%9Zu2Bai1n@lZ1jaR>nH49l<V29nI&iqKFfeorO<-Iv0@A_)nroQAxB<57!c24m
z<3><SfW`-d`6e)K1dX)b-~!#!Hi2;?XhIw$!&yCnaTD0NEDQ`6e@$TA3^rPnfw5vO
z3utNE1jdh|psoc2C`du7e~E(v4m`NN;Jz6H!=42b7%jkaUkr?uCJ>ifD1ltg$-tn@
zHG$CrRLg+we~<q>fzeVEq>2l)`(Xm3HOQ`=TxEp}6BzAeKuH}E?hMb`LFR(PeFEb$
zuCgMA35=D(42+eQpaJ=Xclj6?=JJ^{FwERLfl-W&fw8g}Vy_t3ULml7Vs;<{L9PY`
zg)}JD-CzI(vv2GKMh=jsUWg_RMUZ0|3>X+Zu1)yM0;-A`7%NwT^5TTQ5IJ22h7A!D
zK7cfx1&e=B1L@%a6?_vu=z_HvFfasoPIwB_{}Qb3sR~FPDEWz<op6zjfw4*%EPfH3
z$2mZ$Xu?GUP)D98&46LTWpIS?q!}_yxD0Wy0Rw~HnF-*_y*U^dt3tuL_kt4!SjT>Z
zj{OiFx(p0)6%$H9b{*jbCzn!rPyzuB0g6s2h0VOQo}Ew%uJU=y5{nonl-hzEA<Dp5
zwHP$oUOk}(Vj4(fD@3H19~|+ZY|L3bVID*t6l}%UC&;pbv@<YPn?tOWl|@)73o5KY
zMQ`ib39_J7PLp`RR)Qwb897857^}q~7N|gs1c_)sL@ZIP^n=KQLQ`96Vka8|V|6Vk
zJSKK3gF+cpQB3T#2gN!E14G%yiJk7C`3#=2B8G|G;Kakmz+nAkVvi&P!`x7iDcfgH
zOlD(XtkDH)P1b>GEnYY=MGY(rx}JJsD(I#mW8Ta>hKZ@55HkkP7EeqAZ6E`6Ps=t=
zOarxgzJhJa0Nccq$uKb!6g6LY63ZASf}6~s;?eNa#7xl04~SjqKQR+j_JP=|-c8Js
zU|^UV0C8eA*on~0@Oc^o!}i&rgg^I>0Ruz(|B2qv>{c@c>~L>wki&UF1@uI3ThKlL
zuuFWwE@5L}P}nxnPnLnPW(pevgVLXg{veB@crsHMCI*0<cmrISO$-FF!B>CJS)>cP
zEOnw0C~WS5tuO*x!NI^__-UdMsC8%zw!#Ev#j1A`L6cB(13(@(1J4wJQijsUiONv7
z)(U|QQq~2z72*(8utPvG-8~Vs=7ZrYgDL|<hHh~*BLict4{uo!LvgeeDA)6X%8TM?
z(40Rg^jBIIN85w0vE|8RD9!>EB40taox4+X0cP8AP+w_Z(FG0Aq7pU+2CW-KmsA)S
zYmc*mrb3Ir84VQhW}-#lH8~*mBDtc=p!Gl?wy;al6(t77+B2XkOrhv1Hz@5xB81WN
z83V()I|~_8i;5VE7{Mjsq_2Do46{2`85mCgEt<{Cz*rXyN+manW_yAx<zQeCb}5?U
z4mD6fy=a~|1B2c-HU@?Z7mMaAg4DAyFzB2sS^(NfVa&$BU?y0!5XKfyE?NXGqZfhg
zJj2Asz_47R=ztmnV_gKqQ4A~6Kz4&t$?QasTMnu+FeuI_Y5}?BGQ=${9tgLzx<TD?
z;c8Jk%ziV`q7Imy>!%lWg4y7Tzo-k$h6F}8CukxJ;+E;4OQx6JU|<Yq2H6LSK=FX0
zbY2F=dRvIC=^$T&qC?oFD8m(MtAKh@7R=TQ7mKoCY%|d!&~@hwpb!vGF3Lsnbpy<%
zdS3<x@c{5LqBjhT^}e7yWGn?*Nmy^I%D~`lS!4mS{yfBb3m1f^EuEm&dmk>c76DC1
zgCgK+kqyjxU4<fBa7=@<L=n7IBQ8;74-No`r<37Mxev0ho`GTZs-i@=i|&J6Bo21b
zd0hsE*w7*!HU`E9eMmYq1V@`F17ic|E+pL<MMm&uOoIX_gyABfq81?!T3)cPqDY<*
zlv)@V8$h=>@7h-+uLw%wkQAn11o9wHCPR@DBsbeJFw9>yiSa)p17o8h3j@RY>64h)
zz%7zc@USbR<0=*ghSO&zG4X;lfLa8*LMJitf?La6g$$FJ_`s^U3P4PL&|)g^`l(4w
z{9thw28Jc8CNU|1G=t8ti+VhX39{Ukg@HjNVG<K$8z)yL!z3mRup+K35EI-R5M^L&
z6k=gu2xgkZqy;J4LDlu-ib+h6i=;t3kfa5;=>obRo`GSWcVR4O?L?HoWHHbRiKbI*
z3=GG+C(Fq(FgBfn_=@54G&Tl?+=-L5K~~=20j=VhtStp<#_*&jS1?T026ci#&DecC
zleIyswm@u&Ym*^seAyTn4)ssA1eGh3*ccd`J0{zRGB7rs=K&pCH`&Gj%+6$(3~vC-
zyqW9?vI$gh_`I9!15$m3C#kfUVX}`F17p(_HU<WR>dE0SHPfOeC%{bKQ8_tLf`PH=
zCL05T;K|9^Aoe{r1_sfsle5hj7@O|#fEH>_&VlI-Up6@xGzRU+1L`_W&IdP&*%%n|
zOeS~1)bvc5ybZ?Y7oEIEo`Ip;804sWaPpcAnsI`hgV3~+Cn+V3VR9iT_;>OYWacqU
zE&;K>@?;hjGE6Q7vq8%vn|7n<g(OXwNuXk<dnF$OLr(#SxXH)B&?^Tba&;LP^5qIT
z*ccd_<#;j~3gB+cT2;_32NGptU~s!s&?C;k*sLtTlgdyqNgBii7pt?B`4|}7@9Q!!
z*xxIt1{o60#=wxZs-PC8)i<o5j)#G<IUHnoJ=oJA#|R#=Vqj>{E&wl*YTm#DTGLgK
z0+NQLhJqAOcD?~l4FxHnwHr5hQd24z3Q|C|Iw&>h9xX_fU|@)31R0zLQc(;VQaPPl
z5CcxUj0}t|JmAGp1u>w3n6JEvMd=I$F-D+@0u(w?>kGicH=w00v+jf0r_0$G7)p;J
z*h|=;YzEMxA7_RFbI_u$mLxU?hG4z|OQ?GjD;NquEg=S|+d+#TLF{CZI5?+5+-?aP
z7zDXJcY1*p7XxEU61Yfu%D~uC1TK<zK*e)ka)CB417k}kZwW(zwh1T-Kz%Q+(-w?O
zAWtn}VPH^Kuwdi>*}fCxE`@&<Z$MeC1(em=BP>3`(wyU0i;s$+J}iSS0|VDyi*sxY
zj4i)87#Pkiu{fs$YJ7o4sy17k(*v>DKw~r(7eU6}06AnitHm5f2F6xUnKz@=Vx<I#
z%~PD4%V4nz%mzi|%p_F?hK-#T{UDWIYzz!DS}i7lWg#jjgV_w(3=EYa7WRxE7=uAm
z2rQsss@Ah<$;Av7_MrCGPR1-A(84tfXK=oQ=yd_><ta)nW3Yfs1wxCDXYHa4jIE$?
z4Z~!MaL@_I3ZN{|x{r;4VPU3466iwVXAGc7UYKc7D#*YPagzZQhAK^>EZ;y51r>!p
z>7uM$AalM#YiQ80l}Z!HQ`4AD85nXcMOpTO#&z4;I2jmx(nVSJ8Zj`oe&qs{8=@>P
zK;Z-$<!vitVPM$0U6kdBGy}ub+bj$WhVw*Oj;KI6jY^^{=Rq6bI9M1M_TLs|xd7vw
z*B52E2;)pTBg%3K%mH`gF8&f_c?HSapnVB4y`n73c|S00eZ#=O1Rf>sQrCt!YPku>
zQ49<==NTAmPFfT(h_WpAXJG77XJD}T#=v0nK_QPplx3v^1A{;!1B0z31B0!&6sWx=
z%Cbt1fw4=6fx%Xtfx%Weh=D<<oPn{OM~Z<#cZMj-YDlfeU~9v`U~2{1jU?2}z}Wc(
zylg>~Wevo!47NcG47P6K42)fd9~icQZ(0zVCCaj$lYy}lv{IqVo`J!3CIf@*WM&4&
zE*}O4+no#ywxG)ux*{1EY@abO*n-aI>q=u_u>HrtVEaRyfpKx_2ZrrSKtpXp>qJ?4
zIT;u`Ko>DDE@EJ?b7Nqzb7E#-TwKS%U>C>0U<a1zVqmbVU|_H-0m)2bV6X$>N$d=a
zix)94*sWk-uv;d}z_@rl*jzRS2BBS|QTz;y9gZON2N)RawlXl-Z3J=7FfiDiWni#7
zF2}&Q_=X--6X<4ehV7s+dKpn49+<kP3=DRls{t2-O!&yaVD}zm;|&G|yT1$!cE7=^
zNwyzgV7j0VS<VF-<pw2x)(;HZJ}@wy$zWjY03G-ZK5{6N(T9;SgQJ9j^NR}SAMiHV
z?F<Y|=NK6nJLZ7KvO(toXEJesR%}2HeA+GmHRB*$n$Z_zMg_7N3Q#k^n?9jt7=cz?
zfrrnxTR@~cnc!xCj=yHiU@2j6fH=YfszL=xg%TrU21^A@MFLcX8<GmpU495N3ZN=L
zoBtrbW#UjnF{1$#Obm>j9Y|(qfC8)-yewk-9k9GK1G7cc2L=!iOfoQth_dVerM0Wf
z49phk3=H=C3=H<X><r8ng$xY#G7Jp%QXoz(1B1Of1A{%-OWR^VH+V5HcD{mL-zD*Z
zVOs%s*PY7;hV7v1S{WD^yFeKQIV;#3F)-L0fHNqvFdrzZgNPzi1_q@nQI-}^Y1~x;
z+L3lcl%>TOl+8FngEgWoEq0)eI9F0i8iObcc#3By3j>3Jk0{F|a9bKQku2mR$^u^F
z^7R9QB53dde0^qjt_7szNw<dNczb6C277DJuJL`MESVCJJa3=Rz+j&(#lR4@LX;&7
zCfLTnVBernT$;-u%2Eiihrxac1B3k>DbN~EQI;Z@;8g|&`?IVc7!+d|7$@2>Fn05R
z;-eV6T1qhoDy9GugY0=$oWa02VHN{pw+ToLs%`~T9cT#<6IARDR9y^69pscv#Wx^z
zP(Emv&)PkrEMBnMyL-71#J^rvApf#3FjUMIWeEp+i3{SD2#Bjy7#LD=MVXJlboQD;
z3T);h#vq;G;Ym^Eli*qrbb`IAC^Km5AOooM?*0rOm=t9`1u5=C85n!qAw@j%IZ3eg
zOa@WrE8wyi)ZV@LOO*L0sJ#oSL-tCFGJ^&j89<!Yv!cwmK!;0!N_wpuqRbD~KoJk#
zywU?1|3tAS7u99~u3`pJ=67H_Sr{13KNDsC2;+b({SI~lB;_#w0C7Mm=bW4<^G}e+
zL5FO$=Zi9f2l7FjuBW2Re?ZE<f}AZbC(8T}=D60gqAZ|=os1mNfK-Rc?9&%z(LnMY
ziz$qwbwiZJ0_-7>ak{OdEG*!0M^OL3Ta<-W6qK$R7{E&-H(n5BUI%g%XnAUHK6r#w
zlzE*gs42q9z@QQ#%Dmp3fnmx!kY+wn=8fP=ACv;R?us(^!gbz<qyXk#a2?0VzyR`X
zFKBoJ<U#R6qRjnZogfzpRfsZA0(ln{DyR5GnWun^0jV?Y7iFFX<7D%RGA{%x11~LH
z_e+$ym=P3B9~h?DFfcHhfLbQ~-jJ-uT&xL70SpWd><kPJj257lz9@6CBgh{N3=Rei
z3=SF=Nr^=aqRb_ri!Hx0FgPSIFgSqHB`7tNsDT276P(4EOF%gp)Mx`mW(jz+8Ycq-
zC<T?cf|_5DN}0I~S}8kBU|?|QfHX}Q>+dr#totR!z)<NY%G@l;z#x#uz~Hczfx%(D
zLP0(#-L$~8U1VTzIP3C(VH)U2RR#vezB`cmoVgW}z!@A~F)%nhV-ROxw$S>(FdY<S
z3_RyVnLAk-82dp>9xTim7##jGFgW}M6{(I4431n3433~>PZqum434r4435&ES+{8o
z49sSG85sNZL0OnX12i8!Z3^@_9Pr_$umfZ@z+3E-e~B_D@_t}Y0IjUc0fqB~Sy>DW
z%^jl5iH@Msi!sZhB%eW)ISI^TU~trBU~p6iwO^P)&3;h(#nGRE!O>TWfx-2ND07M|
zBp@8)7#JKQpy8Ja4G6~y1_sBHAO;4e2@H(=521mO1`Pzq9tH--4$yWTMNs#Wfq`)X
z=t@xC8KTT^CG!~=9Or`Cl@r9FITb1et%MZ*fF>>#K#c+cQRW;@2F3|dpb$%EU;s@*
zIj#WJJB17kj$0WR95;hFwG0f72N)O}_c1s_LSK;sw5UT7l!zrnnR7u`#e+iM@iYU2
z<4KTNpwPd@z~FcVq#YFc4;dI7?}L->oFk&lVLYG&_JKhG)T#ilgq&y>07{NwdXNBx
zl=;k{1jz`RS9!<4;P?s}QjyS*a^hoPaN+@lR0{*+L~dwEML|Q#Ns@uVNgNbX3ZPA~
zEDVej_0W~5GcY(Q!>UDQm`(@KS-_&qJ}@_e)}knYqJ82)up500AZ~;@#}DQl8wLg^
zE0+%p3Lp(2`{qII^M^UflYzm>9TYPYH$r0uDg`PCKye7=f=ZOVOrp%@pxh5Cizayp
zfkMaJ8e}uHSh9c>OQ3vd0ouI^D$Kb)i84bb(?DCbZ-_FxfSo7Gz&J@2YNsp2IUpg>
z-f57%P$8Hzpj^-n--akrW?oRUU@||{US3sDF(L#hK6t@BFir-B<_b|}K5+(ybv&F5
z3};nDnfa6%7$<{v$W3MtW#-cd$#CVTfwH^+s0VTbS|JF6I6JxWb5a;YnIY@+Ss<m0
zFh~aEC6NDwK^<ifCnZCaSp-~tg0IdHWd;rKGID@i9<)i6Srb%5f<~KkW{5ItgE`<1
zKO=`J14DqhDANzHUu;<z7#2McW%>n5!Jx9%>#QgfsDsHc3Dj+|F%@N6%J_l7?g|3~
z;}1~OPt${xtV~P61Gx+gPEiaDPC?oX3?Q9LRX_um3=B?P3=B?93gAW(({ix;85o>)
zF)%o7kYZqnoFmG#0wlPTfx+n!1B25&NVkwt?@kZ{18Wuo<5bXG?A~xurahpDpTxl6
z^o4=J>5~)#gORQ%6S$o)iGjhHnSsISuM`7A`btqI@M<%Vpdtf<voy$@N(RO$1yT$Q
z3s^*%u7mohAXz5{24^z`(5#Ip(+!wlHUoomy2}R!2hdu62L{F|@gQvsqD;5JH6#Or
zb1egdb2aw|28RyN-GHFt612AiB;doqI86^G!1{r~ehUNBiMtGpQ#v7np!;R4K&7qy
z5eBB?0St^&79k|SCl=Y?f%F2VAoT(~Kn-WeVWsvjp!#kh^m&2|bl`#N108-1X_GU0
zg7iTeb`BB{eN(~re}VfAj9y@UIuLzR4G{)<f%I|w2TNNpFiy5*V4Ug=k_O!`l?giH
z2ISWqkVcRw)HIN$Vg_*2(q4jr>BxTu#;J`Ud5A8k`%R!SvoT}}AVD=1bnFdVG5A1y
zL~yl$EMs7tdYh3k3rP~}Lx@Z5r$CkbMO6aw45Wi)zW`$QG;xsK;B#@9%D}xkhYFAk
zNVFWZGXf+EYPru{A<9(44VrHJz+eknss~<vHC@vJl9X#eLOU54oO>7;oI&e8gPKK|
zz$+O*f@>KVoL58BRu4EsF)%pqVPJ6H=JJ8T7F75uFfdL#D8;~F`AU=t(!60{aK6mI
z;Czw$1B2}WP=tY;1PQ)kCUD5w`anWy8aV#JQV`GCRzM{{dmli@-7;n}8i8Wab`As6
zF%AaC>EM`$=&*#w708}7X!bBOfC@Ot7otqLpy86~RgeZZ6J+R9l!0-2IHbg60<DXO
zjB8E@tsu~yAqo=$l{-jW(4OP=3Q;CU(1tru`)v9-PSCuND3hZZ^z@MW7EvZg(EeZ0
zAsC`eE}#Md+|uQ&7G?4Vl`h3xpjA+!Og_S(AwRGqb1X!eEWnQZ4&LA{%47jKZ2&Yj
zD9U63YS|qD`DXb?Q6?Rb!Wjxsg*xDB0({t!D3gu@*hmKkhLR7WOsb$#=IaLr1yIXW
z0#wY+I2QmK{S{?W1sl(p6#yE!6=hNdoqh6^F;fBDvtd#PJDP#P`2hoiGpL=`q9qC)
zhG$@KVPjx$VG?IxwsiZzpaAkI15<@4lR7^G<BS!|49u3{3=A$h3=A$>pw@(?23Qdb
zm}FpJ5M|O304cI$U~sWuU~n-5`~SjXQ6^rnw_yI~1+8mwf_jVB9_B6MJ)%tPFmHj@
zuJM4pH8UOREp~8Vz`ex|t~D7mr5G4MJ^-&|{>s4M;=;h-;^fD`40fCWXfYL2jwll+
z++k4+3@#B243Z2C#_XbupyjhOR|<i%3gdlHvur1Lg@Y&~=%^J&P_K&ni6|rZ793F3
zwCJiR<6}?=f^RBfy(P-H0pzurzaZ(4aTB=1C(6J$^ExE`F>Zm^*fU?D3PIB!Oa&+j
zOpg?0Tmdq0mN(SERWJi*X+U*D$H+t(7-w0d3c(D7ssI_NVlT=#32a~^qzS+{2^@@&
z8k}(k$SXU!zzKzMCW!NuVFDuqL#Tr&V>MeW14H~RQATy%4-APB3=E9mjqr0OLAoT2
z>IR^;1OtOh9s`3*3i!x5QATyp$puFk7+h8{Ft{uO4GHWMWz+=EYcepn9AjW`Il{ug
zU?wBVs0D5aK>8XCckhC%3SwYjzresa8+3OMXSFD!9%QDU!Q~1AgUbbJ24=I&4-AQG
zKrP_JH4F?4Jfe(xVhoJ46POv8&8ip}T%Iv7xI6)I+87vIzA!MjeB%DVkhq0`F~JYC
zB$EqNdDeYkNW8+pIJ*p~)B+b;i4Pc<9m*IOXM@jwD+U+2i61~CK%jv%jz0{b;Yjv7
z42*N^A;Xc3pppW#YtxmHfx+c3$bF(87?M;#?n?qCB>_=JM==J*Icy*&sWC9P3NtXc
z3W7LB3=E))0bJ#|KQJU2K-`xFDG!+)98|#WNeW<KG7Vy2oFfIgd<9ZWCPhHpI0syP
z7c+oP$V#e#yD<i=F|mSy$@m`w<D4+iW<ur<j32?L941bH+=(~`bmKYbEW3|2jL;h<
z!PiEDoWcUyQN_rXIhiGEG7IZOj%6G=44_8U1#wYE1>O$~po7&Jz*~amsz8&0f*~Xs
zxau)5xN1R@0jN|0hm1D^gR8qA1LIs3ux4fk2G*ORj4G_m42*L@fsn?);F`kvfx*cI
z<Ov4GxxAogfz)~&3Lx(}#eix|a1=OzMi4=ZMNAnOBFaS>g+K{=t^+jp3W3&J>;$>?
z2%jh;C+`OaN6=oa9#A1N&(Q*0HZpR8kAq=ga4lhAa4mqkmeUGc1TnZyVqkFX^J8F~
z=Lpsea_uQmMjnuB=lL-(xUOSha9zXtfx&SD$W084bD@Vmf?WqX*n-g#RGB%RfqDjX
z<vS!+nLrEBGgyil3>CpDpzWu5j3DoVt2^)>C(z;cAoIb=j)8F=c=!`4J%N!igSEJU
z$xsp0>2+cOIRQ!cB~ajiRzVsvFvx3({sx83yl7r<$@UvG8MPC%@;$9g^egWNhA`0n
z25`S<-g^yj$b1FOQ8_U%xb9(KaNVH+uA9EvLc`@I1B2^T8^{=W*b`8h%APCw0~9Qv
z;c?e*3=FQH0>Q)MppoOnT@4KkpiQ`or!g#M1PzCSHlBqufC2^7RsuyME60D(eUl6z
zH!16gzUTeGkOykXg55N~1>&andXS{$Cd|O##t(7RdrOF$+zc2P+;pIB%4-3+iBm@O
z6U<F+z6=a*o+xf=!E{sJ0%SL_2{trLXaQa99>u^=>MZ(#_XC3^=!zi=P!d|e4{_8B
zXbN)6VqkDfgE;C1Gy%D_GcdR{D}uxP6{s}b$-v;Yh=IXv0qX|_%L>SN^nB2*SCF9!
zNUC7wY5-?s%LyO_;I!lfzJ&yIqj3}i!wh!OTc9Bf(28mBB-R3_G;o~V0>>F+RvI|A
zZh>QqF%uM|R$ijpc|S0KyTRaH2aD`AzynF!!KFU~gWCoM2Ddd3*Kdb3EEwF*F)+BD
z0?+-5?gYDDF_S@b7l`$hfx+zq1B2TOMbHee=q_+A&A{N!&%of$tHi*Nb60dX2Ll7Y
z3)4gnV+O`W_8%C0Hh>bk59lgJ7tu?s42%n%JQ)}l`LKRq@PX!!h2ZgjXz~W73YOv;
zNdEAF=8uI+NGaR})E?w$0HuB(a0Wq=16|F@D%jX?yo`at7*uY4VDJIo-r)l}&qPM_
z3djKmm>HN%;~5y-r5PC9B|)5Q1_pP11_pOs5T~4h!QB~j9+?~ilW8-E=;!{x;LF3n
z?CJq46JdAp{=0a90akjlayc-p(18}xU{6<o@+Jf0!iR7dG8aDpo%hOA3NE32dLRlG
zAp(H8_&KtI1)x(885kFV{Lfy_FoluhzZAF%W4QqK{~C}yBV!i(L{22Ri{QN>SzMyv
zy&;PtA-R7kq+pC<U@&_oI*IoKgDYr5F}RnoSPzn@CxM%c3=HnU3=HnRkYq6l(lBLk
zFJxeF&jlrgDbS?gKAC~Ry&IAgz+Hl`3=Hnu7#Q3)K$5~#SW;m9z~Bm<b6WHf<ox3M
zAW!muZ<RHa0lOR&U~ViR?=Ubf76f^z6xF+49~j(JK=L5DJ~Zz}FfgPn63qgq#}5n&
zpjwv$lv@|4Lb6B}*kg=YY2YSK7PKi0+CkGMDjESAPguMjyzp8yLK{@r@Pda%B0zm6
z&@w*GYS9SrB1jJKxJCqI@gR68BnlK5H$c<>5lcit8I1w7Cx7u%h-p6RAk#P)7$)_L
z`heQ9pk*Kze~E%tfH6!0O^wg=l3&Hhz_<j|<UZ9UzX7tuD5I!=K_0S17c`YD!z#ZI
zJP-m}5RoFk4`k8}Q3l2(CRz*(ZsPL$#J~r03TQDfScJ;&GY9j)>jvgulAjLp-jX;r
z(A2#=Xss9nc;-GzPQDB*GY_2A<sl0sK(=+t$Tz}lTN)?d1Y(2M)T=AVH$iF;P}yRs
zEbqtofx#KHc>;V$=+Y+|pb}5s546-^Cj*1~8wLjVCu$4~%(e1<AbmGL7g#Ycc!(%5
zFa++C4-sWxn6i~=B8Or@VlIO`Xax*t$B2g&1A~XrIz|SD7IS%M=<+i#fCN^ok&gmJ
z?F|Ng1_s4U26^y4<F5=19?c949@Q=%7+gS2I}QfMrJ;(ssksdDi6FOw>|Msd;IW9|
zJR<|M-Dj|)K|R!8@`0?Z9~hk9fJR0b7?(DI@+qXz0m-1wf1onpNl=IkWN5&}0aRr$
zFfIk12n;R7OToprO9n`W5q{FE;|kd50N-NfrII?Jt7SR=NGY>`D?QDd@;0DQ1Z|*6
z0j1bw%ORl%+TzZzlYznG2m^!1K1e9qz(Vm21B1sS@K!B($T~Cz22WuI22Xy_;L$q<
z#$`>4prLtr7pV6=^%)pEb=4Udf^y_t1sE8Y?O<T=v}a)OwA})-d;%-;`wvc_iy<LC
zVV=mr1}>nSGeG@q2F7KG6VSnOMIRWP*Dx?H+sn|*2r><nPj-Tc8w`95jLVjTZuYt^
zFVFaa!3ngF{|(4vD-0kWlUD%mPhjv2W?=C2g?LO}6SV${fx)wifx)u`l01}9lLu(A
z7$|vo&SzlooC%72$eJ+*2G9Ep44&8385puG<#j>1@hby^7Xt%>=RZ*f#^qs<90ERr
z^(km5*%`D#ii3f1c>zSmTnL<7Ts|;3gEmkxFfcCfg5)C$hz!V-IS{oLpi{!0f{H4q
zDUg)09320Ux(kwKoK`?(Kv%y*TYZo;<MacRG8h<_gYH3x%0Toub3kNPfRBKNm<Ac_
zaW(+m(FJM1Gv#ao9e~UH{u79i!Oi@EDQ6>y*dzm<`Vw#uVVVIh0vSQq%Cj&qi0=_$
znkCD?Fc~!4bxcl#X|@Cd!<0N01_q}b5hl>-4-BB*Z0lJOra9p8Lhu>MB205Z!FYo!
zlR<=OE+|Lc0Igu@ED&MJV`E@kaS^Jj3Zg2NL4>Im%w%C;$mbSe>IHFjf_kAKE9+%I
zR)VJu^m|2^g24{_z!3O=fq`KMC}FG&S18U*XAohE0xuh6VDJ)PVDREo0NEZ5G71!*
zDhv!>a^;yR3?fXBrCLlAIaoh11PL%OuB&BWTxkx;x}YubK?b0+VYxpr1SK#quJr^-
zfG&*61kDD6`ohZ}iZBU*O1_m>SQr?VWs5L@Hl2g}_>(?}FoBkygXdIt?Gs^A=VD;c
z`^}Y{SHd6y86DXP4i!+Z6|BfiRD?+j>?KhK#+667Kntx!m~=q-ZYOwF;#9K;lch2P
z!xVM!D2RcQ2;*yz<*PswJ4*XS7{7tM2#N)r86r&V;NCDO=(KK#F#c2oMIFdO#$O;4
zzcMhGF)&zIiZFss<zd*#z_`klg@K`Dp9tewkSX9WpP(ng2wKepDm;!cGBE557GXRJ
zcA*&q!{MJIjJrU4f<Ss_b22boxGKW9O9Qmtn1zAin4AdX9vKG4RkI=eaYoP{m%~3n
z&e5GA!g!FEfpOIW@L2rht$Yj&dLLsM7&HPz7*{fWV2B4b+re9<SFg}!VA!=!gb}px
zN1302!OMYx!OKb;oah)=g4cdAFnA>}FnC32GcZirBf_{6JO#nP;MLB+-~~GOsP(J}
z<4VwtA)vTl$H3sVLW%+GywzamF)(;tW?=9-4|S$PF~}X_3{0ln9~k1lfI0!}%S0Hr
zu`)2O4hJ>qBp4XHo-#0aJqBgn_%)EZ!`0cKq`?6`W<CA@Xzq}KaW%Bl59*(Q7P~NU
zOaZmC;x8~TE4~9MFJ=L?Una(Y&Z_|*L}A9ja9T=)5p)|5!&e5z)xU*`i;@{c7-vg^
zIw;T(o^1pQVNTG=5+aPVK|^&nz{m86FwO>@C3FMo575-zX(><~?}-p$>;=WsR|dv4
zj!+|el|V)cWv5m$h%oko7QBO+=VqcJjJ@Ep7iwfLXuR$QXh_(7s|X`xv)c!T&>IX4
z4B&%d*Zk6E0LOc!8pu@)3|`+D7`)zDq!gDhh%i=yIul127`zo37`#Cjk!Rb8Fjj)5
zjBhY7c>6Fgc)LKOq81tz-gOKN-W8$@jB5^q$Du?R>mUh*^#el~4=4*VFs=bz0SrC%
zJxl|XXC*!`gc&d}uI=Iezz}A`z_|7<D0o40iINNq9&sX!8H^yULP@1*3?hsf;2l{)
zsURlkOwF%Qzh;0sL(oNZ;MD372THA~KSda`K{*C=U=#y`Xq5<KG$_-p?SYyX4UQeK
zdC{O21<X9~HUjWaF35;Dgb|ZAi-6WhF)*%O0ks-5w9D`nG=P{<Ey8FAa_wEH>2_k^
zhys@djCS&%8Fpw4`*$%gWK@Gnp~#0Kpd-i`7}v2ubs2~v=`sK{qQK_@8@h`y$}xUm
z2ml@73LbM=SF6pyV96rFC<oq!$-v+}lYzl|vNi)l&lC|x(6OnYvmCtlF)(=V&}Lu&
z`9uyhbPbBYhYSqfcjXxvB2q*c6~q`A3|BKv<lz3m5b%P5*$!O$OymF$^~^69VU%F}
zz#tDgPbC9XPOnc507ZoasG``(nB~X7Y<uqmgFI+Poq;Jqgi#7~mXhsj1_tkc3=H1C
zm>HODzcVoSh%qqu@EJ2OJ52h(ApZb#_!5X@;Nbah#=y8<ikX4gVKD=Pk0k?xkGUQL
zv*R4FGA1y|z`(&|&cn>W?6{VJ!N-Mx!3Q)61~E$keCCD%xHjiuWY>Th<j=t1;|n!N
z0es#DL=BQbQ49<|5un8fRtyZ4@ggTdNn?E%bSBSn6{rpD!y@t$6#HMnT`3J#k%ORt
zl=Vy47#L)WMGk|DY0%2j!+aw17(Xxs&0t_)x&jKN&7j$A_Fx9a4bF;1#S9|rK&ISa
zVDL$2VDL$1{lE~M!N7E+gn@BAxD~)*0xFV%OQ2%^K$(EU6f8CYBDMiM6~X~tF&8`s
zDy9ZjX9y~rf-ivjxv-8YXb2D71vO+~kY!-p%ma2C69WUgsK^3V2F49f*cli%OENI{
zR5CF5l*=(NZdL|~=rS<)v@kIEG=Vr43=BT~3=BTKpc)oBDYyaD1O%m6&|S|U@hgxi
zoDHD8?+|hD3{KDksQ5Y1DORAfmY6tnK<*6s0Fpom>VbObjGLEzU<ejrU<Z>73=Sd-
zSs55NE&#b=GXsOqECvRj8OjWdoA)zMe8K=?oMxW*0L-|~Jn;mW@tA2Mhb#kQYz^29
zZUzQ+6%jj-DQ(OQjIo^z3_i;k7<`t1I8zxIe6}z!_<#-yh+W9Q;B$n5!3T6uKrASI
zU1DJHxd2kOlYznK0Rw~2J&?PDZ5WtUZh*oY+=>8?nEHSNcZI<RhTsqeRt5%kGm$l1
z42+v5Dl;&yaDqB)g+J3o4t55{6)_A9KHnG^eBOXKnG6iR`V0)d>L8_MAkTnAn;95<
z;}{rxgCssM1jm5dSfG^h0#pJrFm93uZypDY9Atv0Nf{xD<`1aUWMJH633nV5hXW|-
zga|M&t4cC3Zi)uW2!LCS9~eJIK*k0oJ}`vnfXZOj4-6qQpoV}BzydiORP%X&no%KV
zK<Nsk_5+B)pa&v9FoYz4_QHpN#=~Sp_OOC#*LVg7-(Cg=-);~mn}NZ1Ap?W&d=RIc
zfx&kx1B35o&?pLgC?%u<+fd5?KMaVW6bCyM#83*Tn=U?Aq!N?^H@onZF^DvQTRS`{
z3?i)%R&g1F2xzG^!%m*!6b6xYuqa4hdVxqJSl=@6I)9O9@cuLKt`CuD&_-8d@H&5y
zXi(eV7`#?qBwCSyfx(z3x44KwBpS3q5wzndLr5eGWa<qbUymvVkpeIqWCO=J5lgTQ
zA0ReZBiUe$WP>%54c1^AK>JXpi`YO`<AaW0Jr^SaIcA=@g^_`wM^gmSvNUI4u<jRT
zVqj!o+@dA~>evZ0F$jSw3x-+-hUfrc#vhC-3=D1Wg&Eg?+YBIup!pTsv%-w)z>_X4
z3=F;@!i?*|9In&?24Thx@(c_jv$#qO7=#%&N;5ES0qH1>6$WqlWdKco87m1hZUSu%
z0CAc&2s3U5Z|(w_6(-EMSs1inLI$!`2-Hw)dk?C5x7`+IJP#`Kc7hv<xx6Z%Yk-9r
z>%nJ_GBPl31qI{!>B5Zlk{~Z|GB7NS6J~6X2kle>tvk^ZW^4do;ljzlu>XxPV}l1s
zh7086Ca^QXn~a1Ro58&W76t~F3}MKTcc3+uTS5E3Th9tJc0qRgi83&51+9Ms33Wq+
zK&}LFdm&s<*CsYwn9&~Owsl-3NjVI{jE>R_j9b^SFfce@5@vJ)#WlE55L+zF=qd>E
zH>h*9Qkc<AfPq2x55%Y2K^v;}2{WpL4EhX-Cq{Mf1Tfh3+6oK|qM*6wQ$fOvCSVRE
z^cX%(WMG)T4|IGy?*m~*UT{c#V2}rGHvtdNZR^WoV3>bcn2{H>Wig8}OPhhA(qEX7
z7c{DMgn_~LC<BA<eksrvE@4JN@CXtEgYQ!Y2H(31prbN`8HJ#Ne!dJ0ex3>$DMbvz
zjB=_BjNAGc82l0$82n<lGBPkQg+QgmHK9_a3=DpSVE^UZ&}CqlTO|CRk%4jBMK%To
z{jI_um7wg|5yD?Up#<7tVv`^Y+R@E$Ljde;&{&P&5wH<yRjLdO0!xISfQ<MJKKDfU
zi3tPaw%_2Bc!i&UTE>$=yCBlEbr~26*9)I!WMJGb3EBo)EezTn!pH&I%&GoD801=p
z8w`xwoggmR4s(g#ZsA=@AaRf}Sv&n17}zcegHDbVJo14-9@Loy4-9U<2|D;Tce-#F
zs5x_kF^i3XVbXEoevnqsb}QB%;Rzu2Jy8b6?VEVOp*S5p56P3sAUp$<z`qLcfD_9c
zbq2=mj~N&QAgY$aRV_nSwF0UN<gCnUJ_d#?DLw{<j31ygqwfgUu!Hgf1LF=`HgGJ~
zf!0bDLkz5ku)+Dh0n8R<VBDdn#lXPnB3vg89=!mK{K@SV24yM6rwpKRMM($YY(@sg
z9o4*GjoIKPDI2JXC=5P}2Q(0QDoD5poG>8ikP*~6m2?2@CEPhdI0RgjFfi`e1u-E6
z+yv(UErk#c0d3ni<|$wh4wGeI5UGWj8wpMUAj|oqg!LI27<ckPwCan1d<Rl)r~nd$
zD7OGB2aRa17Y1)<0*x`A3KDh#tARL)0d({me-tRtx{Y-i7&?rEB|!%JLkyM_fEg?;
z!N4H=l8u4kRFJR=lAjp<rGRvSwkmDflw%KS>Fr#{lbe*ukmD%Bz_@cAPbNc-FUTcd
zd2;hp7;^kTwr_^E1^v4~ZNY4_oB)vM4mJjcjni@hc|ipLc<XCU5GaaofD?Bo=)B{u
zrF;wwUC#{|7{s4VX@?XrjC*W&%ZeGMv@0_(?g1TCt@C3_hZF<j9!Cxa1{Jv}9a;<w
z%>f(?3_G_>>9AyA+~dZ<z`%WSN+<Y&Q4R(M>kU&tyNAJQ^0KFNnu65u6fjKb=3-!I
zKE%erpcXl$2eg0>v_*W%t0}!43=GZcYzz#Gi>CB})PM$;=T%JU2eWx{k{PB<0G$a3
zN&~qorc8#hrRt_k0V`o+V32B_GDU=ep&6uAs$<F&IT*Wl$`lO{8yo;rro!|x|DH09
zpMi0YHyZ<kf54RKFt)>nDKlVZcKw_(6U-K6VBGbSCzD~yd>)WdYzz#{mQz4i&@{V%
zmR9cO1j#LB26ddkTd7t(n6e6_66DwLpHo(Y*dT{F{+_Z19CxA&jJvDY7#L>Fow5bA
z1`1Ra?9OImV5rfZ0v<X4D!`MJS;8>o5NK5o$lvEJryLdn1s?<0hVzzF&I&-dAhUW|
z7#I$pox%vJW}$An%EG|FvVRJr0w~Hs%NWf>r+~Xq;Blb6)21*gf(;Ph%4C?r2wuPW
zRe&qG0Lp1T#J~U^5Nc_f!srAxLzIDW4-;55_;@3jY7hsc8dOhhw3x!^1$HvT*i`V6
zc&=QK6=`5LNR`{0DU6w75Z8mcHGB*V&BsBT7#D$90U*NIfPuk%!IV5$k_7eg&SX!?
z(`I1Y17aT&nUd!PO_Qx>r{qO~!k&$RAwFzM0mvRJP!??NvtwX5&Thh_#mK<8=Oqhh
z7{P=|58S8#xg*=mgvnR|DrGNc!elB6s=HYj7*@SAVKM`65eBK#ongXcA_y5w0-4)(
z8gyPqtO?_HMh3>cpd-L|`%D<Wt1vLMD{vJgRx+3{{*eO7a22PfGng>`RbpV=+aSON
z8fh_M{0}a0Sr`~nkD4$+Y8%ivM6C%EBPf_bLu>P#OqiI!98m_wy`VZcD940}ON4=O
zZ##nk_}XO?CUH<r@Rb3ancG2o-P={)F!C`l?rpVWV5o{SVO-6~z_^cr3siZUFm8|p
zaX<rzdrTN1CvAXkw!Ub>2)@1<WGl!M2gO02fEFkFL_xlH+iAjh6ug6tg@Ga4%!Kg-
zILN?5hbD~Rvpv3o9nty%v^C-l1LHnXP%F$>2()W_AFCAuLz1D%Ur<rDFN!NUDVM>7
zky)I9q4hFXCW8qh7dS(JhiFY0xxfQ|0$d<9Jc<mA`=Y=mx9ICKFt8ssxy{DFxUY{l
znZe|?Jg6RFV_?|bX#!gE!~m+v%fFdGRy=`<&n3bp%RzSTXXHsv%3v@7wI$C?03UE<
za)k%%jLl$I@MJQWYzI36wDq{tWINamYzz!Ve@%`^F);3DWMg3Hdth=J#AXxV$z?Fv
z33eJA=#&|gUEp{EJF^vZ{$9%pP-(iwWHKWI!<h*TjQdR>_D>ZD@p+Py(ilu;NPxsa
zNvW01fPukS%LLSb7CgehxPKBa*tIPxAl1AjiRla`EuceLZh$LqlQwWG65>#Bui*yB
z`5j>A3qX9;B@GH&22izls@fzE=8T6Npj}lad7uG^8{h*rO!B~kHsD&@1kynO8Ii$Y
zQX~zsosEG(eyIs~+cfADGzNxaZYD9HT6QM`;{gR;&`6g_i~wjKJqPGIIFlIA{@t%U
z1q>!}Tnr2+=ktJe9+`mWyubtUD<r2fDKj!K9spfff8pv>CJk^-1YLgfVJed**bm_4
zV^f(-Vavx3q=WLtjHyg!@bzd1KsO`mB7{I`6p0I359z@^l~DrZQqV&711mvi>`!Hs
zPz4`O<j%kl@hx*6SeAkDpa2I0L($yKdCCk7rl3O&R=vwyBG15J!v#JzA#*9%RXiD`
zNer1QMHv{3LGzNvvoiOA#X+_0X8z2Lpd<h;q@QJOk_8zAzE76h%A92;*q#rJ!Jw0s
z!7aIiTLKCg%vokCGB6lDX3WY09d~QaGE)oGGGGLqb;hA@&N5G&f$`uL(8*Du<}C9i
z7#I)k1m`z%mW3dTZ*YME-<)L;xaGjYz%W_CoCS0Z0K->k*7ffaWnerA+W)LO!<=QF
z90TLQec<98#GNnCz<BU5ILS6~@G&qnvhp!77~KOA#XbxS8#T>YYQXMhWMDj0Cj@eC
z4cNItDVaqK<}5X!gLl3Pfi@wVv(#8JFyw(&jp!<vv($p(?Fc6WgHfV6OD%ZloP~h_
z<fBGpA2mUIl$^|9&e9L^5Q?)8MT6tqoTU-sY*7ZrL!dbzkkgwWP6w5Ng$(8_ZR#Kw
zf_-AT$%lbq%5-xUb4GB;GB6%?-~`33Ig2@HE<>M_fgz~ZoW<M$B+bddpqXXPVqpqW
z#=^kRTyD<d1YStY!oa|N*__20>@29`U6CE{26j9&oDGg}W#%!Mvjj*mFdlXV^;FGS
zLO^UUF0k*yz{ZF&FdjC5ddd~zDM+d{XK{mg2vioBftuOYj-ZoTPuVdrq&_xhn!(7x
zcz7o`Q<yW&1qH4XD7&mOX9CCePA<^u7;~m2k_?Q8_k(Pi2C;={9z44oUWqCMwHT&?
zVLBrN!@3wgkUe$`3`^!_fP0olM8KA2FuH>+1sVMjY)%HF2i)i*ET}>dqv0w*XSy}H
zWn2a)B?iVLD?n$2Wn2blLpBBm-AftQr9i@L3=H0K88_t_80wpOiWxF)$uTh0tFkdL
zOyJ1?9YqE%+s|&z03Aif06O8PkRby!CS0$@Q&e2QkZ}*B6O?z&-7@Zj!W&c<oIRQW
z*>(=fqq;LPZa@xh1BG+FNi73I-6J`s&5WiD4C*)Kn3jSnilgjcFUv8lfO+}I6R`i}
zm{uaZ{2f&Y;$^rB&`5dN5jiICN`<3!;I*rAOrU#F1wj#KJWGzLLXv^;XdM^m{vJ7|
zO0aXe3i65=<d`Z!O`scGxrr4Z4yfk@s+Bvp$uZTz^0|1s98;4d1A~Smq`v_^wXp06
z$XDw7Oc@xudgPeEGY3a^fG=5)V~PfO1~gOxvO5-HcTqBf98(;~>aU<_m$q;@Mo@E=
z;p+#6KG3xQHlTsw^ZeQj492tM7*`p99L&Jr2kLr*R^p4d%Q3D2JA#41Zx;iD-!=uX
z2N*$DF@lEj{Vp;v_??w!U~qAlV_e6@z<8dYd142fJm~HTImY#z3=DJMFiqr802Lr|
zj2l1>xxv8T_ltqS?}-!x!|^gX#tq=GU|{f%XJGJ;RsbDOB*(Y`Tz4@r_!lxT_~$E>
zq%p{W+BFOyJN@ez82qagKwg8K759~a!G8(^gMXg_s530b2)<161_OitRt5(DwUFQg
zFW_wp4`N{8@nK**Da*pZu#``Z5wv3zJiqGoPmb{)xalLsz!0%Xj`2SqsM*25;D3jK
z!T*XB14D*{91{<y!LXcxA%L5K!5_3q#_OIO6E93Kh=C!%LyCc6!Y(-`KA7M{28Mt}
zX$GbVq8}J0fH%y8NCp!*CKfRU#^X1c8JH%RFfasMWMBw558|jZFa$hfU<kMa;y5xe
z1PU-P1oE*nFir4dU<j0DU<i~Jhs-lfWB^@r!IP!MbU==Q@%VA*JVT%+14E#?4P?S%
zA_M4vTAnP#97CWL14Ez%c=7N=4F+b#DDV(&2O9(E$nXhK9~dU;fVSUF1kGP*KwNo3
z2IQ6;28KXy28KXSkXtGl7y=_07y`pUoHhoAz-$JFz+})Z*LR9PFiffd&8C1z1_?RP
z>@?$v)yxcxcR;Hydl(o3yFeTeV>$yv;8Z;ZX64slO-x`CbYZO=Xv#+U2LnUk5(b9A
zMa&G$Dl7~Pf$JF<0zt=ptAGM!Hv>Z;=n98PEubk<(13C!Xxj;B$Ug%#-V9zSGO>bz
zS+jwG@x&dF0*(Oai1XJiptX7+_35Al%gEH{0@{$n`hj6$2Lp4QDg)z*@1TW_WeiRX
zOqwc;;B$p19bjO*Y6>z3yx<0OD@X>&wsb}V@XUq*185n?WY7-1Jq(PevOsCUM~=x8
zlolp2Fa(}rU<f=0O$(F3r-6e=1_L=JKQRWzlTSgRY{I}0_>F-f@C%3oS{K93z!1a;
z;y5xe1er201Q~;Z+>e1F$ccd=$N`!bCQksTg^7@~aPl%VEd+to`9Rac<O$%kFcFa!
zg5nt%f?~mGVe$@aX<_mnP+FJ_nrYL3xbl<+$SpYx3_%493_*Dyw^TAP1l2My1XY7L
zZ43-S6BrnRIzYqylm9>h|5Okt&=7(D02KJ3#U$Xs2hC+n;Q@s@YKVgpB<KwL{u<DN
z^?uMD)Esh*hj<wnPhDY#+~ym!k%1v-J@hc#{u<B(09YN;VYvM@AeTTz;fLWu_;Rq@
ze4+OSPv8LAGy&8);E-dy%FDob+74#Z9tMV>T~M1QaDZ$At3$GB0{D(`s3_bf2p`EN
zMo<o!U;)Y@Ad*2sj`1NY1LNs)piI%gzz}qtfg$K9h||Ns5Oj%wA?N}$hfJ^l#RgcD
zfE+xB1l?y~2)YZ+AwjPg7=m7aI06g|LEjh{g1&HnV3^<n%OMq@90K0g2F)Vk3}E+6
z;sB?gN;$^ooD7U-!a&wHFfar&GcW`*f;c@444_M?f_ZG9xs?N)m|79;2$p7G2nJmO
z0?MhuY77j)pc^7UIW^dbfg#v{`vb!y9+*2oIWH609nuU;T5mouOgaGy7ZAx1A;%QT
z%D{NGhM9p$TZDlj*q(tQ*p``rN$U>-L$EgkL$D`EhJ%42IE;ZII0VE|U|<MNWMBx6
zS7u<+)?uF5!NShKq;0{#5S+)r5S(Moz@&TZ1H+^Xpm3Z7x->_J{}srNEM^8K-Ny_J
z!IcaQ!R5>hOnU4L48iRT48g4+nd=M;!P6NSf+vDF?->|^w=ggSZvt_CGcW}2XJ824
z%g(^0C(OVQe2Re~_yp?*hDkRVn4{M+FrM{-l&_%G8K4=uuN_VdOnQ@<xfsFOZW8qV
z$qcaE9MFw3Wel*wg!==-WCjK%9nc{qAisbMw0;=|##?<1jAy}H|6m*KK=WtdjgS2n
z42(Bh7#PnU0%bWAX-39$mI?+3@cRD#0I0H;IFva-ltq9puV!F8`v){VY6Z?oIS~8L
z$)M?E;?MxgAA!o-V90}Kiu-RsY(57*^8(3%Opux6{wEMC&lQ3Kj;j{p=^s!-Ct?_?
z0J3y~0n|{?u16*$Lm53FzIFzCXF>+30B2x4_Y`CdxDbb?LD1&Qbf$?Mpr8j;1fayK
z15!*#A?&cK^YY-45Dn1o>e}gYjG#3rN9!0F7|*A1LRwd~PN3EmS4nOGgB)mz3Dh=(
zw2K<R?IK7+h0)*$14Hd}Q1i0#u^eLwXaes%XjT!_Kr1l@83D2)sZ@?Jgb~C8S#c6{
znnJrAV~8rK!6*c2qlM^$mM*eDEDr;>2O(B~+d@gDpp7Wqr{owd7(Xy%J1{UXfEPnv
z%+_XL0JZxpz-BQp1m9<12)=9qG1CHUCIbU#m_0;J0o=4@v;sSyfgz-jfgvOl+6c3S
z3C?C<2$_szarY@`VVk`IRM=*(0PT~KV|3+ZV7#yzTG)mhVqge404;2@SAYszusWo|
zHhTpq-l3xK!WP1Z7q+Y)7_v(s$>{=UCk!(e;}@{D4oGska32x9pz0`t5uAszmq1d}
z1@NK=NHRf|J_C`y2wM9NS(gf4Gnv8Y0=lsXoXWHBKy0|^h;D-eXwOg%56B3Vdz7IU
zo<f%4g0iy%_-5rZ_v9Eg!Tl;m2F8nBpaBj!MosV~f}j@tDt|dfP{|Ey(O2GJU|<CA
zCc0c{kq=5`4C>&45QdOz3=AP>v>6zxR?9Imfa35g14F1714Aeeq#X@f-NyhD3t(Uf
z^^sy=m~~K&kwc7uK{=R#A+&&jAv8gXfkDtr4tyaCXtiq?KLbM;=vV}e)pFpGJ+Pn-
z14Ecn5Ca3(1O~=SyQCNx=2*!w3V;Spb}}%8l`}Ae6-qNOD;IoVsCod3{VLE}O944X
zAzlW?OG}s;n3Zc87{V4ZFoewqaXJ|o!qzY_gslQ`rZO;u?PFjF+r#~Vp$dNQ95}DD
zmoZqXlrSiPH>EH!fJ@eD0S3m)pq*r(T+NsXx~9$L149+)GByte#>*j4$4S8)caDJ}
z?36gvac4kb%GDyrD9_8lc-a<YJ;-6785qJof;gQF4B@N{4B^Zm&Qu15Z~+E}a6XX3
zu0U7CBAk>7E{`&pxu6cK+JfRRP-z275>+-(VZ^n!C`kf*k%g<N+*@#B_`p!Hg@J)l
z1=N4Laz_Ic+i&$DksYqWzz{B@29E5v=AhAX28Qqu28M9(l7CjY_u!&{fg!wsfg!v`
z5nKd;4#(37U|<NJ&cF~p8FaCM+$T^5{>s1*zJ`Gzd=)58ofsIe2&*$N=+2OP4@!Vp
z3=H8r85qL1g4Xlg(fYtp@d32Jk;_l+3o8TTl>?w=gE<33_yq=r@G~HeGXq2TO9qB;
z(CJ`z{1_M_SQ!{17}*&Z??f>$M948PL`Z-*X$%aYeGCz<(56Pk2L?6<2Ch;$4Opij
zB8Y(@0(7SgsHqVV%fJv34Q=v7WHK;Bq;r2@sQ3bFYJiG%*qJM!VvhR*L**P;(GF=3
zff7*$=$=J)28NJ3a@U}95m!w?;}~++bU^{j#=s!RDt8+kc;Hj{<nBs<7I%V=o0kKR
zOn>D8bxNOt0}e76A$J=ZP!S9aGkfGRKs|x49~jDH7#Nslfa30EiyGM63|&xJ&cF~+
z!N3p!Iw7ZOwOoc3B=RC=Ffc?+QDb1x&yvdkZ}4DXh}glv5V1uK+|SOG2aPB)FhpEq
zV2HTH!N5?;DVGUagn2^|TtH`o9CU+$0W@<G@kt$Y{I^^-wAT%~KqFEgbkyB_InYcj
zsDmBp&cG1qst&p%RxTT~Mi8Voih&_ANS%Q}b+=qLXypk=Y#IYYWFKfBNxED%s89ik
zZDU}F+@ub!LUN!Z2az`!7$UDj5?U@uEP#O_@+kvD<YUFO%wh()Jdl_-14HBo28PIY
z>I@9U3+3`bVr~o!k$)H%B7Z4@YahtKH3LHwI|D-$EBLAnImpO314EQJ14EP`w3-1;
z&CcwB-lS1c0xD=KK<hVo<YovmFkTmg)-qAX3=C0*&|0RV1XRm_l_AwK6(ykR0xAlx
zWgvXyTBd9b1GrIk-2k(=XZ^rXb^uh|GcaEF$1Z&ZDqVsm&BS2=s!<F<jwpKosmQK_
z&cI-Xwu{Q3?V{@|&~!3_ms^z!Kn*^NAq{G2LYDZK`#|0P23--jGAvJlm~n#}yL1Ue
z_YE!V(i5Q4pk^>~T?uXNl|!rA8(C=DVe(s``a!-%)(`dI38>?6`2Pk}_X!Ns!Oh0<
zFHrdx81g!xFt31y-%SBbc~HBu6uMisLV|&*Y!w6JP3Q%gtREOEbRaIf>4{Y<be~;?
z4a5OA!AAh1wlqM6SO~}vGy@nt!25F!3CMxYjmid%l!13p-s)2WXS+lrP$Q6mA<B_~
zA<9+*oOKdG>sM|tFhs>MFhoUxFT#;abOp5!85p8!85p9<HNZthq90Uj5d%ZiJaq<!
z$@y~0(BdQNFatx>ZdnG#+qoYYvPD2eJ;yn@WDy3&TQ<xLjJN9;7^1}(7@|S<FW>HB
zU;r&vi<W0+V7xtzfgxItfgxH8bfMPm#bDi>3=AB1<x)V~VQ+6>V2Ji*V2Jhv8MB9h
zAv%wNAvz7jIl;gXeVBnEdcW5PhHM+i{YBt=;l;tbl_1xmrB0WN1{JKJ3vfYOcr-u-
z>+M`fXha)8LL>SC14Hy3NN7ZZ3f3D84AFlX7@~hdLL=H4;`10828I|hh|go8K96x_
zV2H7W`rKRr<a6eqa<L)|jJM4|uB>BVh?&8_5Hk(L>0)4rS<Ju?vk>a@m<<dJF>Am+
zzxsi}T!DcTboHNH9O%5v+s_ynV$L%##GD4{{KUWz^MQdO=0(v526GqirB0yTdz%i*
zfw!iBcJJL@%nOdsV9<mM=yn3NQn_GoQO^dBt5ArG4H+0zc;);+eTUmuK^IoH%lUy*
z1$bqXoF6zffLAuj`9V^FCIiF%COPm(71*Bt5M7?&(1YmmgoK(Q1H<g=a`qsz@2K*E
z3vhcQ2F5$89H4tw<m^EU@^^xUsZ}-_GBC&}$SHx97DJROnSqpot5s!VP_@bdZl@@N
zbbaN?NlIjp1MQ~*U3J0W=`W`S8j6_&TFhv(LQV#3&`gLyGR7c-I2b^xWI(znfiAN>
zDk8L!5mXy~V2B0Xrnmr<6z;}>_mB#$1XZ<83=FZJ3=FZ3YM@C{p_R~jE4Gw@AvRYL
zw7F6Uyl~?N14Haw28P&~kU9n2EjudW@_`{1v@>0Rf$^@MIs=2w453Y+1|&%JdIpBr
zwcH;VVqbu^S%HSKK=&Q8eqe~L00}TK-gN>Cf?KDt7Z{iWyg^G^O+amZBPRx?<2s-g
zh(80v`jbLa85tNDt3EKq{$XHX0IzYs`vc;Mso(>$7#Ly?FfhdKfOujmXp;)a3C|fA
zVjn|1F+%`k0s{kR7Bh|k>Iu+xl=UZBKQP1zK%I04wT;RBfg#QY#bt(Ymt`|BNbm{u
zFn(Z&18to%00r$mJBX`#z?T9sFvKY{FvQ7%OsPRJ#RP7O0RzL~WkL<0NOEFeytkA$
zGo_e8sKE%#25l1;Y5;E&2OktJ)C8K-a1v!;yw?JnN17qj44<F52RbcX7cK&6Z^7h2
z=}&N-I|D<Xuuwj<HFxhm#IAfpuw9@H>O!EMc7jgeL$HMkKs(QmfKpN9WT8~B13xgx
zfjTH)uij4wt;=ie6-ot_xH}oM6u~B>gI&nL5a-Ik5a$RwFV2R6@xB$fnJkn6aV<k!
zI0HjmDCl?&CJzS2`w?ie84RExh57)d$AE!Bx?3m`><$LT`{y_q7<~AJB0)<*K$o#C
zo+=axTC2Mg5>VjDA5cKuUkeGS7>L!P42<{pqliGQfy#q+3dH0Hi86j*m?FWzzy$74
zJesD&z;JM{kc0#S<D+Rz6FJmDXDkXyL62CBYi3}Gs|4NV@<2!$RN#DNV2In!z!0}y
z5p;r&5cv93kk}&zhPXSR_MDuM3}}+;D+2>)jX)gev<IJ8LNcJj8YJe-zz`2wUYOS@
zBm>Hiux&G-p^%sy(45Tz2F6FB;A0Df<U#ojq${3*AwC);xt)RWk&Gf}epE<F0ko@`
zfg!$xfg!#?oq^%lbRk_qNHaRVn}H#|RULGQsE{5^-7*G-_(kdr44pDUb|7^(7#QMr
zF)+mM05y|$3OT~WjxsRBA66`55ON1C)SSe?5PyMzA^x1p2ZpIH7#J9I7#JTqtAkEb
z6Y>Nl50HWf3=Hx2xIZvVeFNI63aZ3G-Hc2|Ptf)P@G+B9Z9q-asi4wWLP&#`f$<^e
z%1h8$hw-l&7~)?tGca2?GBCt{V_=B?0zK<6fsuhB{y(U3GF1VxTkPRXkl7sI2F+9p
zP_Ku9@!?L87^FQ>1KQEf1eJ$w4t;nTBoB5EQw?~8ZR#3GiSQ8I3IxkAT7a$D19CnC
z<0CeN77km`nEli<AQ`wQqaE0wDJMXOfH5#WvSVb-;;Lh?P~rOjU&>GhRQA<@%f4v}
zAQd2eph1;PraH)JXHyCwZhr(m_y*E3D+9TmnF};i|AApj3j>qUMMlOf&{*j=4%q1i
z%myn!H?e^up7GH#@G#teP`dW66l`Mrz+ed42M*p}_Bcolv<5@4Nq~W&CW(O|L4biF
zflCdv^i;4(3R3?km@qIT=z%Uu`Yza{23k+az>pBZz>pA>mt0c8AlS~wz)<r8vd7bi
zfr0UH5Ch|5#GDXv=RE_&fsE&Xg3Cw%IyAsMF@y~i8ldROU~~bu=Bnxh!x=v?7}PK@
zFoI9>c=A{SY+txA1LKp&3=9e73=9eRY77jXrv$^5pzdGJz>qK>;{I@G9guL7fg$0%
zI%q?mAavO)L!vkXLn6N-=sFrf@V@n(3=E(aVIt_tW!Yvy@Ltv%3=D~33=D~WdF2d(
zF`NvHPhK!h<j4aJR|<j}LW~^D6HhR)eqb<o0P+U|;}cM07c#iQQOv-3K&lKp00Y`f
z$NGW6kcWZs$qxp`C$^x725(S-ws{R@Ao2VJJOB)q0ZpQ1Fmc#`c6S(RFfco;1DW6g
zHK88Egc7I=mcnH?${0!*lsFuqcd3FBu3-aI|9-eCkPEm!Fc{7Oxd3!p!$goSWe!k1
z4BAx5%3)s&sw=^949WV8Pkw+?lt1WXfjOpvQj8xMWPKPI7{QlHKHHa8&LAiy2)fFY
zF)IxmV^VUU7-P&-%w!M*7lojZUCzLeI9D-|K@hZ~7u3m4yv4wfcu6sdK~NU7Ec6Bg
zLlQFsL*jSEWClT5P!R_bv0z|G(o;-f5R?V2v;>KyFfb&=D5f$9%0isSkkre-kkqJ{
z#vmvQDq=xu_AxLdZBqnCoE)fl28lgkU`V>Bn3+<+APC+@e1m}@S($+$SyG9Cp;1~;
zQH+6M@eWqz4@?4UWEq(4vOh4$Hh|i>OcH`x0t}4Lw3!*0?W!3VlKmMNl6^s(b_Ryz
zOa_MJban=2yU7d;$)yYo$;BYfd<KT(sSFIs{h$kXK}N}OfQ?cSbmC`Vd{ze14KnH;
z14Hs15C>$`O9qDI=OEo6qrNgQB!32R<})y)@Gvl>FfoAcn#}&dAg2SGc49IR^yCHU
ztY%<HabsXeaRG7K85mLm85mOhK{_WhFr>sXFr-9-I3Qzk7#LErz^k>Kdj&W-prdG@
z1Bw~IS5iM`&1YczmH2@{7JPfLtPE(qssJaCz!FBNxC3ZVkcmftlTQG&y@l<c0LK^5
zx)NPg0giK^btTWuSr{0+^#wRCfPx*g61T5Vfa9VN14GS4(4c*4umA_>@G=I_VzuX>
zJ>GME32=a}FJ%B76Pm*yz%dDw*gzcnPXZj%z^z}<!jm;20vt0zeVj>LnG6CPv%pLi
z1_sGx0vsD*ob;0d9GgH%2eiicIcUqPeUbpjd~k)u!oZ-qLV#m|Bxu<yczM{2V*(so
zK#2&nu+)@+VKJ`&hXcqLFZ5X$7(lX+-6bpx3~dhtIGltT7{M|iFFAv~#KORkyF!2i
za>yXqT`r)y59IG?8vzdR<rH5*^CO_`$1m(bJ~L(mO>D4z7GMXj5`9t32{wcMFL*&A
zC)g_XzbfGKTr(L2*#CnA5)^hCX9U<Efg_EPf$_x}h~4Z@!17!LX$%7FPZby#io;kK
z7_83-us;J!fHc<c7hpdF*9a2tD->WqqX3E&P6h_abpq^XK+7(_f*0Egu!GK2WcUiw
z$txqkz8<FYr7l-VQ6Yl>`$lO7hO#|ep!G-s?E9n{7>b%eXUgUautV0`LX82hwFMh<
z=A8ihM7S}1oD2+yHVUv$1Z}_qoo)|uz(nv)U#^m(WCj8D$w~|iW$92079v{!J|g7?
z)B^CbFt7#7W(cq+!7Vt!$-n^eVG^<rlaPG~KBfSyvwxNVyFE<jD^OcblU;z_9+W9S
z8)ZOFvj?vLgodgkI8>nyfFut{*n5M+9u#OZX9}=O!i@xN=vb^Iz%B{$Ey&1OCk5Cg
zLHE&tI3V+-z%o$t!NnykBETgj*qL4(0_^;7GgoplFt~6Eu=9hCvxFJL4_dAQ(+NKI
z7p${#odDYhxXwSE3=Cm90&E{Z`<FmET{s2UK$jvifH;yMwczn`u%FmIf&B#WEZb+W
z&p{qsQ6Ru}6K3RVP$2Yt7ht;yO5HG1Zi0H}Um>R4Mm7b!t_{2r%le=I8~CV%uOApx
zz;hCy?$qm@+Ti5Nc3K*g1sE7o8W|W;D&-j%!h{9b&Z;snlrVvoQx&C_FbJ?gQz}Es
zG6sf}CEOnvR5ma${`<<vn8j!cItze{Q4qAw0#w7MGuksSR4_1bPZD4&WBkDA6~Vy3
zDFU+c!wYTD^)Lc#W$FwJSD6_YQnoWNq^uWbV7AHtt7B$h5IiKnR?W)5_(q(Wf!V5*
zfg$A~14GJv5C`PGHw+9ZuNd+f7?V0aFnZl#0GWRWTzay#@JTZ;evSRW=)D9a><zkP
zTtI+rswM;Dn{Z|Z#;^Gd3@JYt7*f75h%+#Lwf(^8y#-Xt3SJaoo2Jab_@)M=$e)2B
zm6?Gdl@X-q)8-G1-r)He!3P3tQ+OE|-#RigFn&79zyRu*rGmy)K3!s9NcCV~NOfUn
zVElBSfgv@Wfgv>-#CgrYkh*|@A$10b^MipQ^$G(+>IHTN#?Pz_45=>}7*d~uI6@2z
zsb3iwQa^(@@(c`VAld&Nj0}vQbv`iqPGSAP=xf8k_}PVl@vSPTeF199rZbf&fF_U`
zLEE1heJ6lgDImF0Py>Uhgag#mcLA-l0tbm73n)nZKv!=H2(ZmIWng@p1@dh^14G(c
z28OiNpw(2MAn^n3Cuj5nm8}8-Y;!;gCxaCFGccs>U|>kw1`ZaJ4~%{);IR84zy`X^
z@0|iDSlk#G(oQlkq#Xotf*BanJ}@w(f%f};N?>3}=VV|=XO?4N{FKwk$iVoi5)>$n
z3=HW;3=HXN$_$L3`XD=nKh0)fNbg}_NblnQ!02~^fiV#@;0kHBm9T)uk|9&)j7AI$
zp!)KY+6P8|9gu5;cm&uMh(c3=zX!<6{-Bd31O(WYm@zQEiv{^4pMfELIs-%cRFF?V
zUiOaw>y;2-TMAOt1XASBz>vO(fgybXNYTeV9~k`$z>3rb*p`SgFuwcB%)t2Z90No8
zdIpAc&~menw;34Hk1;T$A7W=<{P==_A^jl(L;6h+=L-Wv1}6hU1}n(Jj0_AJ3JeSx
za-it_#P@+Q(1ZH}V;~DCdcn~N>WV{>abN?;1A(A(?*s(cR;e>EzLx{JEuVn_bl^jV
z7RYTN4+MhOV+q*^u&q{PV0`ZkQsmFTkYUcikYNf^^s(y$W8ehvZ9ZNCY^!(~7~j`{
zJTQlWA;X1%A;SU0S;@eVk;TA}ks<McG02C3@zF9^nh44OIV1>lRkwfu+XhVr#`nu%
zcGNL2WYmBZehmG<7*qjP2s$)SM1XC*C<EjByC9>}85lA;85lC!L7ZX+h76F!vp_Bb
zW!Inu;Gm5ZVB2cU!1#d)WHiW+%NZClmVy+0c=3TTSOTmlTYzmVHv{8`7G?&<55E`~
zGPW=<WNZK#%g(@%ah8E0<0Ob9!oZO6n1LbVz9$3YM@5i`9s@%LNc|6G2F8!pkc9Tp
zgMlHFoq-{fmHPu@FgS;SauB!-W16S|jt)Zx(AmCL86OyfLl~IABm;wl0NY;BO#z_d
zDN~4nAro|-u2mxgL#8YPL#DJIq&y1_VPJu2Fw<s)mSCBh3=Em-AWkU*L#8PMLnf$(
zQej{)(Gp+-*Q}s1(T||P)oxh<wj^~>w~&*8A#0TYTQd0MD^5@!Qh+T5#%WqEz?KT*
zRJIAQfv(41%*w*RAXgy3mLbHzQ23q;RNJ$GE{kNi0jgMBYX#Uq!#&_*+CDZ2m1Hsq
zutkb6FoM|mAT}tRT0uiwh5mdD425e{7#LRU7GU!M)ka_!ZWqc(1nKfoU|{?R+Uc_B
zy8xSyCdj#9ZC)x247vsaY$`AvpTs#C7$&j_u&JmsFhV$T0&FT)42+*-AnpU5fDb*2
zNq`M}G&5+=HOLnl!VHX`6r&j!(pUu8oIvIm9OPqQC^!ak+k4Q)R(oavHd(M$Dhv#>
zk_A{_gE^p*22_dnY!G054YC)^IUvCL+J=Gg(>k!dtZz9%{c*06q6`KB)^{=tj7iN<
ztAx2gdu0Szzk^hO9AjG|zy`WPgaO(#VuK#F%*Vix54zs3fE^T-MgpuGVAg*I-G!se
zD8RbGlz|b<aZ(as-KfdH_}L0#J!nHY*xPcR0<2pk7#Kg>voJ6ew+gUs6$I^qU}0b|
ziW6Yn266*v?Y3Nj0PA*efUqzyG%Xik1+B_vxB+o8>qAiJ<UIvBD4maiA@8FD1A|q+
z04r$c5W|fR3?`rsCHMrDueRFYG{QPr9u&F^44G~W44HP?3=CXb1Xw2<f$U~r$Sh%C
z$jk#BtI{pNIvF&neS?7^b0z~rCg`jcH8}y+Dc~*a3=Elj7#K1^ZYft5V4VVPW|rrq
zG6=AOjxes?$25^cih+S`vH<IRkWaocFl63hV930t0B&Khf-e*R3BG4w$b9Safx#41
zjz};teldiqSPbrOFfe5PVqnPp!To{3w1$E4_Ze88%>)f^NHZ|8HGN<(`2ZU2G67v9
zB_O~$UyOnAOA|8#6WbI9hAdVFhAd_fX8{94mKXy=mH_t$29rOq3Ungqpa`a7L<I^q
z(3A&cped;PBOt)KoRxv`%Vm%mAOj5<7_#(19FT!d3=CN|Ah${2Fp%{FgUK3j@yhrW
zbl@#w;08K8E};WD91ql*Dh4m|G}*(zT=<TG@v9=jr=S4@W-i78&{&UY00R?OH$o14
zGH9^^_%O6d*9BO6!6)i~N>$L%%EC+m)?Nc}^Gk(+A)85nwF52>I=>7g-=PndH)mj&
z(<Z<QTKe^M0i<op3Ld`s3QcO&pi={qBL!Gp85tPAUgZSMatN@3&T_6vf|OFMuHXqH
z76t~N1p=(T;H%d`nkH%ru$nP4Fn$A-2@=WztY+W=1*i#TYM?PEs0n7^V;-R<fW}Ql
z!Pd@g6=0PDnE)Di0+|3B7-6^pH9<-R$pk6za23=9C5Ri$85o>|1z0&jCV;w0oYexX
zoHC#k4?fsPfR$4XR3?BftC}mo$|uRdP<0X15ubitfaN2oBd+m7faNBr3;XQ^BxqQ`
zn@XTT!vZ?pd_sW$%Y6<82K73SmxDeEuxtle_ZX^v4<r|W3a`0O1Xxys3XHER3=DmH
z1z2jq97YDl?~+i}jbPP~fM;0@D#P_01z3XN>Kvi!AX|f=>PkWC_B|G0F@>wkg{m_L
zn+NVUu-Jh64WQogRzm?6d62KZgSPyz&J|!$6lP$kn!#0^TEHN{q6$8*0i-aFQGf+}
zeBAe=@(c|8>;fzzq6`e87s10idsrA4WLgARL_v1k0ImJoX(hnI&iH{L<_ZJo9;Z1B
zj6Zy}A&S^RZOt1D3|WZ`3|XL)r+gL&u&`@^#|{{>Y8V)@DilCxNC~iji&~J%=?n~6
zQ&~SS#Jpf&Rz1kT_`{5mF$<B8K$#+z1!M(iRVVnAvP@8v#WFBR>=s~t2XY5!I$#T^
zPxAA!Hn<RFeg_f)nZAO7A!~s)1B2md0p@q$q{G0Fb&Y``>w-1|gPNQG^Lx<w6V(h1
zS$`QAvc76FFswTx!2BLmjo)Bk$W~`y$Oa92acvP`2KDzKS)p5i`2+ZPGH{8={8fs9
z0jWe}{s{`HuM7;?{tOJ+o{;j68PtUYEtJd7U|`5jfsPo(D1g=z$ABEmAi(^I3lt0y
zkOJbT6QU4+7Z4!%5(Xv~eFny#nQ(dLi9T$g1#A;N*cchp8NrJ_Vp>3@DFfrrX1FrY
zVSy4KKoic4KQDt!+5$Cc9b5^LNuY3#Ie}6bfmcyvFoOr7)0roNcIL-2FmSvVU_Q<G
zfgu`n9x`~e{8u9D2Zrbm3`|Uq85n;FgSwTFLz9Xb8PT>qfSkd?!0dm6f$<mQ;CF5(
z2F72HAa`oS@Ia*?OCcCxQrsUHVnjevAcq(8z=Rn<xlh1QfcYpmgQzetOo$d>o(<-J
zhT=d+TumqtV4f`pYS*wZFi58gFwfOwU?^P&88l&Dk2Gk)4B2!9$zjakgKNPf176Ps
zn5$uC{s!Itd_G-(xf(R;2P&{~R|qgygU*te1ZjdW*Qqfulruvu=tZ^wR8+y59?XzE
zj-V_a#38^O2e+UVe3Y61bDSv1(VPqnylVuQ<3PJ|cS6lfkY`{hwP9gkIAA2eoGQ=2
zQ1T2iuEY#kzXkOHxV;GWLA1C4vkTmUGoV8NW(Y95DKIdUtc98xfb7mdP<n<ok(h%(
z9PmiQqCEo47GPsOFzADhN(5g?^k<(1sF}cQp~S%WXCDJYb{hjjc7-;$t-x#n3K&q%
zc*wwzeN~!)@$bVA4Ej4jwXr_vMwSf%%r*iHjDNOxGBE!A%*?>}_df$ejwS;`j;b;P
z<3Apzi5wtWl4+tAh*o2sc!GhQf$^U)14E8014E88XqG_)R97=F{(;n@VvLNL+>4o)
zN`Wh4WoS!)`vZf40a9l)6FeP}!8B2ekue=)D!9L3z`#)Sfx)1Jf$`5_P(!SGp92F!
zxvT)Q7^vy+^#g-m1_J}545;M!dm7?xF@1=)b3zyxa{Qp)76T6sF)-vbGBD(ngVw|L
z3NTB^Fff!cGce@rVPMGF1m5^2z^ux_!1(txXr!j3D3w8gSxuIK@$Vf5hTInn47m@=
z!DENay5PuRp4iPS&%m%ZUw~N;6el;BC(dAo7B--btf0askDq}dkC*iWXyq<*;VlNn
zzY9TGW}-4?pfDAug0j564rZu;Yyt<%3}#rcfQEl3ft;2MI#-Gje9dnevkC*l$~ywg
zOyESp$iVo|Q3#wCm{dT4!U;(OOppOLi2qnXUfB*!bUYx=8)({vT+j|pyL=!Ieg#!k
ziXj3_A3$~5KhTi}=Nkl=K+8>~q*xdjc>V}5ftvPew?Mgw=Zyf<DY!${L*>t?Fff!@
zLri4?A213UbOsr72{cAl0ve2F0%c>!KrXAT02BCZQP8;izps$2$h1odw4oi66`6K{
z+C-2cJ0{SX#>FS0rh^A{!5PK;jsVj#uv0!TD4$_qU^oIwG5-%*fG)lgU;^DG0-D&#
z1GQKrv>6yWl?9lVflfBR!N8Db#lVnfW&w_Pre#hHjQ<ZZFyuusFyw`3GcfS(5MWy7
z4QkskFyu8dFyvLsGcYv92{5gYW?(25VVcMx&%m&|T!0BumN89KfFuwmXmQ4nw}gQq
zZxLt&&;~Q!!R38A(?rP7lmU1Pby1TF1A{`Q026p70Te9%K_i@VehDzm0uA^=iwVd<
zyx`JCCrp3|d?dhEMg}H^yPOORAjL7DkyKFsXVYB)rZ^=Ah6-jQ28Kp<HUXwA9tI|c
z2z~|zOB(^EY*060C+G+ayD0)pIiP$uiHV<qK_x|iDVK+VK~9#LfvcpTm_dLEw55#U
zE;t53qsQPgOxA=5Fcp9&Ls%FX?5_$i6~Z_<3<6ArpmWV8K~f*n1W@XOj>t2CuabrN
zWimMRfo4;>HVZJ7gVO#^5HBS|fT;@9;F-k0z#z!L#30YW#PAk0o@>kuT4K-tRDj76
z8t*coxq48%Gcmr+VqoBZFTe!4zg$QSyuCj)Re;IT2voo`W-1h?g52h)z`(@#mVqH}
zI|D=BS_RMsRRJa^@FrgdhP+1%40#Vg2Szczm11B31&u2>Xc!pselRfPy#d{7bzgwV
z4SbFW14F(h14F*L6axdu1746IWym*YV8}O?VqgFTk~dU)zBdCyzPmyug8-91D0GY&
z81j=C81iHM7?`-MKQPGjfQD|E7zCKSrI{I+xO^BG@@p6v@+;UGn7ASs81g4EFy!|@
zP8_L7Q(<6e$QED{0|x>l0~1p)3uxi70Fwj<h{IJ<l+GZ)B&ou{#FPxpHjt5gP;I6q
zz@!8Uc~B~8JuAQj8Bl;ONZKa~G8#NbGzp{|9P0I;Lb`md3IoG>IRVDMa9csw8Y!m>
zFoGwGK)HKmi~!?b@B!VNpkpZn82^Gw=o>=dY{vLc2b9e~`Fn=|<3CeS_JX>UL79P}
zJdFjCrywm@sIwtQlz?JAF-m~(4%q4s3@V@#YC$JLGqLDvGcYJH2r%9O^^HJ*w1I&k
zA9Sqn@ks)VcR=;|4F-n%dkhTuH?$cTWF-U`?}GgFm4Tsvm4PAuzcvFyT#*3dT~JSE
zCj&!)4g*60C`9)82{7JuVqi$UxPp;Kfbl*n0~2#QKLdkOiU8vSc?O0eUr^=&X?+Ne
zcP@tVqSQhL0mess3{1@Npt=s!=07LE_yN?rnFs0EPZbkj{3rto1_p+LNCt)iUwH-w
zlQ02BP-)9>gL&c=21rT52%5S8RW${j3=9RWtREOu4M20`3`{KG8z4aAZ-_PY+#eWJ
zeV_#mxOB+`*$?U+gVd#ij0M#&pk^rebnT*60mc*1uryL(U|`Z<oC6vY0N1sQCp19S
z3IjvIQU->CnUIkV#uH`?;3XObPZ$^q?r1YG9M=|LJmCV0L<WXJ5e9}r9&H8&m3IP+
zpc{-qE-&<8U?{W!jWw+Mz+iL))EF@Wod7E!z<5@Gfr;f0Xf)se14H2?28O~3AkG;E
zhQhfF4282noSO^`g)0~s3YT$zU@*D>8VdkbvEX$uOrW(W8BE0-3=Dn@Ol;3TFc{qd
zWgq6%0*vPcK$?FtFcfZQU?|+k%)rFX%D_-~gMpzCv`3X4JkrO&Q1}`o1Byq`AtX%f
z3{31g3=BmU3=Bm^AdV#iLs2LLLs1}z<Ho>Hl*PbMlm_AiGcXjjGcXi^HrKKzFfbJD
zV_+!S0g}mOU?{rHz)*Bmj)952s*-_;y_JE1c|S<1je())8v{epClF^c14A(v14A(f
zh_ir!p;&`~p;$?rfr%^m1B3Al&_oUMO##MUQ3fW~AE3gZgn^;hoq?g)8B`cFFfbIy
zGcXiKg8a@o>jQ%^C^IlHzZGCyz{$+O#JPfjp}3lXp%}Dll5;BqLvcR?Low*UP0m9M
z48@BX7>Yp$ZgQSyU?|?sz)-xIoq>t-4g*8+Nd|`E<8>bxOjsD0*ucx5kpsIPyi&--
z0h9<q5m67`x61J!<XTX>fODPz;{kAzVq{=qTL*5SFdi@jr6f)U2JcD%#sl`?6r{qy
zV7Od>aR*%ObBNj<T2QrITLc()%7N5!LQ>gIP|F59A}ha1fUy*&k$o*hV=1!6GGvWq
zV2z-woZksBmVs}7;{w+LjMd;;fQ5m<^1c8g=qg0PBV6FBfUyRAS|<32C;`S=aJ>LN
zAW47`eCq|M&@A03z*rBO#J|B+#vs7BPJw}meJ!ZsvYR5n*a$B0Sr{0W-xgr(1r-fn
z!K$VzGcd7l0@wAGN_-3q6)zkZ7*@6mFv@`a^8wssU|a*rhn$^n85w&87!_F=nAm^Y
zgAS1rU{um%V5s6`urEkVVGv+c=3!vs?37`U2Y0p^RX{1}5~z6#@t!W&dkhT4HyId;
zFGDIVMm?}+7#NDbF)$Q=Qh<0@5A0nAh7xWDh7xuuNU3cAt{xZ|N|YHGN@S%N7(hNY
z0Q;DMp~M~3)RSUhSbIx=F#@FWD+5DGB?CiAsT2c4g|7f3Xhjof^I6Fh28NPJ;J!R#
z9JnvfJaH;>5Ca3JHUkr<Dx`vCGy(@014GFQ28NO)QjmbN1qU1hL&+Wnh7!=WHIQX4
zFu_|43?)}U6=(7XhWt066v*iyz-TK9%_}9p85l~wL-R_hAOk}wH+Ugj-W~7|028Mx
zC;@{?Mo0<D%*EIXTA!4^1S+4#$e0CkDr^-JY!EU30JPr@lLU_<f(%M$Dh3^}4Z2d3
zfr)b#r1f3^YFL}k6kz1$Wn^ID1f7XuX(PbM4H}jJ9mlS#Ai&6N3`^+x0*u_YpyHI1
zfnm{i0Y+|bP`d@x>|*2v?F}*p<+A$e0^r?+qScHHOkAKlbJv6jFoKc+19%|{BNIfa
zCIds)T!Am3q_q>I(wYO@9Qgv82cN`~$sq6zuFiCmzzdMNNg#E}9N^~R3u(~B8z6PB
z;Ob`o6@XN~Aa&gkb$8@p>OdzLF&HyMFfgcz2^4_L`}%=F7gUyA03~VeGBpMUts4Rb
zY79)=Weg0Zx(p1Z>T2MgO9AM9wyz8fr9lh~r9Nul6kR9_8f9c)D6M8-C@ocEV2H{V
zC<L{GLF#5QFqBSJXJBYOD*!pfg@K`TD+5F6W_1RJKt%!2p>Uvff9W9xhSGiN3=FA9
z1)88~zw{0RL+LHW5(a@5Sq3I<km)ZO7)qbAeqhl30q);2ai>6sm?1q|P$gOdF8lO!
zKng(f_!C3eAQ?G^kAb0bi6#Ss)f#~yu%{Urn7HS$F)++A5C~BMu|Z9z?3<bl44Q5N
z&Tu6M*%%m3uM}_vDLDvMq7=cvu%%4E7?c~neqfLW?S%*3KF-9Ws>Z;u+)cn(5tJSv
zecRICY77iBeh8R=798JTU?|gLU?@}L{=gvp2Ub3VH`#&P0vVtMfS|Kbn}bp_S;0$h
znRx1WlX43fQZtnpK<t9dWQNpCGX{nv4h{x}2JzHP@U=%A3=A{8Q?o$r)vp{344e5=
zvp@|h5Ic2SY8I%W_Z8&$RBK%Z2A7c3L^cK{o&yk*6V*W`LrhCF1TCI`n3iY@V)G^y
z6fmSFdV$y=r^#JS^@Tc(R}x}?uL{%vU4>L%3#ij}Ur6<J0(pUrfuS=f6+CDHItz66
zyVOunQ3N`E$WA;JTrAxH862}X)lC#+5Caph84uXc9+F_bDg#69%2aD!1}5IAyrAO&
zQ>`^XA<O|vFsastP<DfOsx@dg1IW`eyi;w!hgfnjFih@EwE;CbLE@>~Qf<K9Rh~?S
zROl@`k_-%+8dF#}co~@Z{DksLOBhmEK)uFwJVKz*PGR9N2Kk8-6x=B+9H4Ft=!)1B
z7D$ViD~ln81#%=GS2l<VT5kyIQ`;(~uyBijw6ZWT2yaVa;g*JSB)+Gx@Nj`b6m;G7
z?GzRsK@f*4xriZ!g%=b$U%8UgL2Ph2%9Wf1VuN~JU%4tlOwdYp@GS++=Tn&9^D;2;
zvqK!t{9Ybp62#%)LEI$J^j?E_3iEro!<j!qtjJ<WVg3kC#UO_>e?)RP^Cu*SGk-#I
zIP+&DhckahIGh=LRxrfj%wG@=XZ`|rIP({{!>4hlFkb^X`~cM9*JO|!e$4<BQjid5
zz6QGZ5FFynpq>lES5SyE-#|G02C~C%B0Kyhvcqp7JNy=s!*4@^0~F%Sw~-uv8{u&9
z#oOQzm%5R{9079pO`$@D6y^vi1}6TO;9l5Q5DU~}F}7#mV_@RHDapXl;FH2^%FDnc
zAO}`$ss#3AaWX>+vnhBakSmiRg&8t=0lIafAut7WJ35m<j8I`_9zzPVwkk9v&Pb&&
zYlCwqSPSG%BydRRf<pqNyM!@?2^6S;K|&zSOxM8ozC!|->6!w_ZcYXU{{JaV*K|M}
zq5QNoh7_i2;5%7_Ku2n&FkN#5Wm?b);welwxFBpph7_h7pz7r-SBVjb4K8Q6N{m5l
zkdMD|m6(9opoQRHxk^kyY;gI*RbmEWgDSJHTqWipHmLjdm8%5AgoFTSwQUO1O)gN7
zf$pohm%;>!#C1F%k22kYL{1h%3ezpHM_Cvc>My1+-3G@q$k)s2QkZgi8JGkg2xXKq
zq%h^`F)$>7PR?zTO<~G42YHl}fnlR?3R9jYC@@(V7=(_eFoCzkeg&m`rUGyR0$W!A
z@fygw0&rsGN?}N0DgceueC4VDF+mmXSFU6b6XL}(5EE3qgVRT_K?;*EF9VZM0VEDU
zg`-e`P)ah$$G*BC*9he?q%iq{F7Nm%1WF1_zHSUmLZzGx3|nreFoAAbTgSr%_DX;x
z$SYunfrp^KauqS8Fa?6c0UU&Z5SQnqGNdpCfs19Xq)a#)RN^PD=VM?<nv=`GP<J?m
zNeZl$fl25-#C1{%V3&d|lL8gppm5vClfoqB2zDvRo6_I~ra~ZNr9lm%uUug3WRa|c
zuo-e07*c#w82>{p5#|6}!uVeeWC>R;LkbfkI5t5FxqqZEK87g_fhc?oaSh0L#>e0`
zgb>I#jE_MjfH7ARLkc5ghd9VA#-|Y7k_-&>DJhJ%c^R05D<S6GRs>lnRKSqJc-sUN
z<)GVl(vPGt_JQ5Zz$5}XVxwbu3S*xNhyy7u8T%|jY9XZ#V;{Kk;sn*JDUAK#q`(QP
zSW_7L!Ew#Wz>vBvg|Q#harp{%4|v23RPgsHr!Y<gI}UVrmP88UL~!-Pm0Q7(!Z;C<
zM{+AcY;Xc%VPGiRox(T~oJm+17)<`8FiwOTn+VbZTIw3O85Ehx2hAB6#Q0MfJJ=YQ
zM9MiC7(kxr&;)q`>h2B`P{cvq-QfV@fP8P~kiw`9^F8QxDv(BPHIPQ|m~INAwl&E2
zptQz_C|npJg$vk!x{$P1l9<ep!l(<$CnYIh4tOD|09OV>3L~WH&s7Fug8Cs}89>%g
zJ(I$yDh9HRfk{-91>$aXDX>5;1A`Y=3Zn!##2A=F?V;Y1Fa$}19V7)wHj)es`nOXU
z`FI(aL{p)v_zd8x1R$!c85mA?ryPeGCnm!Iw(YnMNF4_QL-N;@<KVo<lgp3-I{k&=
zD^CtX%1N+#o=k?6lVE@HWHF?i1bdPvr;s7#Bsc}|6o8oE{J>KJVuF|Z@{}Yqq?`g<
z&Qp@Xka7xKhwzk?Fr=IUS0SK%V@<LtFGU#`l7)D(8B$(?<C+azD!r0tU`SR1pG3QK
zN6LP%GZ>h}{2|WX4~|=&WJ89OgAf~%jTll6f^7gDUR!!L1$tpClUNQ!%Pz1MhByWW
z%}v%n8Lb!?N={fOF)}hRiI;*;<F(EJ4*|0=F!;W(&IFsv#=x*r+8T6;gOD2NfM_{u
z(DHIHyJNX^2{@v_Z8GapaGQ*cfx$V(x=ajeW-g<3xikZlcoqD>&w2)i0)6XuJV`|i
z)(t`o46LA2@|MO~_rQ+kT~lG*3uc3lkhKP-aR$)ounpqYlfYFC8z}2pPXdQK8v{e4
ziZx^unvH>BwV3r*n6sl-SnmOM8Q4I%(|RvVTzR)O=!jJYaI-hAmXCoUUfYU+!C%Q*
z0~{1Hz)sT!I}Nl+w#?013M{da7vyFs8St8s3I+y`GyE*!j2{?-=P)oZD1f?1;twI-
zWcU=~^?@;X2LqFY0(goSyiR!kBz_iOkb2O1AJCpaCJ6<&dWGWDLI!@80I(|=7|Mbf
z7|H^RJ}?H)02u;WS|IeCpGA@J1H*X<1_nmZ<&jKM>DmkoiC+9HijY`mC`(~rD2q|Z
zOl9C_(Gq50l1gV_D4WW_P&TnVsfdA}1+>M0wS#FQhcp9|bi@aS^DjULgMmnf8h#d2
zP6j5)bIc4((rF9~WrrCU$_}zKFi96PFqB<jU?@8S;xsTYls#f#D0=|n^fEA%ePm!L
zdoRbpBs~kX9QEo4h6^&FGaoL1=6pT)ncuN8FiCcT*5tfrU?^u`U?}?s;{0J?DCc2d
zDCYuk9x*V0CjQDn=ahg7pmKc%hH_o#GJp#*pl&_bI0gY$3(zuv3l<EF-;XjdNrJ`z
z7)_vu4}OaPD|7&_lwgts?SlesY5NIYI&>icx=I49oY59^sW$Tm#-9bCAyrThi>c28
za+VD12Zr+>7?`!A7?>m%K)1#HQ~?=%{s#lomvanEl3PGS50IPUF9?8?!j#!SHlQ&u
zh%+!ri+o_XkOLag6x+eiV$I3GB*hI1S|tXCa(f1ba$8WC>2rTzxKMy>L<0k8yViLJ
z1}3Q-kW)%PeL)5$DPxeGpiv6Qa0e5I7T8H^KzbRNq(BEjfPDMo16cbJ1}5q4+#eXu
zUjfO(oW}v~@WwulWnefG#LvRZ_<`YE2z1JgNm>Lvn#2!V%fe6|!@y7;A<n>bo$Uj|
zIq>+T*cyHoaZLs$sjZ$2OxGnqE;v^LvVnm~3bZ;6?1DL9;RXh#>uL;4QlL}TK#MC_
zKQNqo0#*7Q>YyJ_K#o24fq^lm6y#VAkUUIo3;6y-9bbMHW>Dsn2A#04{)L}~8B_$^
z;402%;AdeIWnf@D3L2qt*v8NN6RZx@ZM<-mpZTXO=p=TKoWe|g=KEkd(Be(UaDL|d
zG7JpD!YrUOTlkqF?FJSG1_@<;=GWlzkA;CD{U1N`8&F;Zt%WQ+$Peimfv2|g`T4=!
z6~?1rC!UVrXWjuaUIuhSDaeo=ASZ%~tq5Cw<{jWxA=E_ht=c=eKzWgQFSvkVVPF86
zejRL;C<Bv>1XnIt`m8tulZ*y<QxV9*TM(~;s(P*ok_-$zUi{1}85x*l5;++d)_>z?
zUa1HQ3r>hPz#H%<LF`!rwg<E@OJ*xSXmtjY%s$YJuNpry_=vQxT%a36_?cTJ8JJ}D
zft)ZKd`2%na~o{8Gm{MHZXDeia3Rn@DH0dts@UjQ28Kgw{LDFw9~h)TOQ=CR?3rZw
zvOveY^E2mwizx7np86MlX3#M<f=3uL6_QfR82Fh>poLX=0RuyM9_S2mgWvqjrh=e&
zVq{>F11+#>7U5?$)dw9Q%fi6m+RYE`96_CL1#`YE=>8v&<E-J%m(2y=Nx;u+!v`{p
zL6m_>wgKu%Bvq3!g_c2u+z@7g62wkHer7*#1r9a~v`hqKBa*87m>NGpg~H%w$${1`
zgET^gV8IIIg8Gh(PZ^lxR6#u{V;@i)w%_Mx)?{N~k^`-YDOk(TtZ5GAOf=+Y){+Bp
zpdq3I3lX^-sLi?vo9j`9U^YWlfFe{_*oT4Pz-)eIIdJ2Uk%38`nUjIRkdvQTP8Vbi
zCj-NQ)%?tIpaD-<B2s|c`2cExBErtks6sG1p(;SW6P4j-+RezoqyV}uxpf0S6J((P
z=+>upex`HaRsra=aYufp^Pn69YE!%4=V!VM;(&(rz4iH-K+7}16WqrR@iRe=kb;B=
z(<89!SQr>=uJbcJk_V-C76u0U-TX|D5eiWTCixi<M>0KzyIX!WB=s;ofu|mMP!7_a
z!H=v8bWJXj5Xg6a7x<aJfzv$;1A`_nKhs|@2V~8Eh&9ZdoD7VP>p`hVK?qd{WB@2_
zKvjS@S$c-^Gc5uSKz?8Voh;5!0%~<AoYe+REb}uh0{12u7|Poj7|NU9F)}cKT(ATb
zIA81i7?>2!g0(R*FtA1QGc5s)wJY3bU?^Y0z)-$`oq<W=4Ff~@eg=l}z0hLcT?4c+
zlr5c~X(lfNlfo8eaIw!&eu{yi`~+x8jJpP?oQEz-gbcPafKS+4#mmnGUWg4^*`V-?
z6XL+hklr$A+Jc{HD#%?oKs~<r8h)mBu(ueP6eYmL7E>pr*ve&K@H@uO1X)zZz@%sf
zk*$TunlmscJ?3Z1XJlYf1TE;&Rp4jJ2e0zw1YJVH&y=qYT3!h{$dQ+yDIYROUBSS>
znZVB!%lLs|z7GQfLklPjmD;o!7#zd-nPO!@Wex*F`Ar6fa?p~=RqyzjVhupXFff#V
zXJ9D*2s+D=m!ByXbacyC28IeD28IeAmk$i{!R<N*CM8QL28Nmrex_vb6(|f06~+t<
z6^7Cbj0xf&80OCb&7#f+wHX=snbLR}n3PyN85k45ZH)O13{0PwGB7Dgf~PMy*g%0i
ze+uZpUr+-8e%SA~7SNb>F#~Ad6O-~pu&JzIl7WGPpDB}-fk`Q!nSn`pF#|(|9Rov!
z4T!UWfuX{afuX`3bTr=l6AVns`#`NzW6%Q0KF}TDb_@)HQ~8;~7#Wz9KnH$<0t9sB
zlQ3wO0u&Ho;DCUJXBZ>^%o!NEUHF;&L7F~rLPF7B5fqBhNbolSg&tIsKX?j{!JL6%
z-!*<FcSZ&#Wd|Y9Jum!B?x0T9PNB>K27V@YP_+q~U;)|c4qEU7;)wI|Gr5CzU4n9l
zK0iN`mn^8-V*r_VNRgk(7G&N;sCl*!^T0I>lP$7=wxBipFavEtOJBkFy@3pLfEuX6
zz|bAT&twkHQlP*CU0Km~lAp;OG+zRm*}qWB&twjE45)QJ^DjS>Amayy=>-f73@<=Q
zO68e0xawmP1e?LYP!Y$#P!R@AJ%Zp4A_GH37Xw2DDDi>Pt{~{dmm>@e6)PARDwb$N
z(y*X4DEJr{DvmKQR2))BN@d_@5(SrJ3=9>I7#J!ZK-PUQe4fU@FcWludZiyflM?h?
zk%})23>9w_z;!&6GE`fo6az!0n9B!->7ZrGpc6`_OM#9c<Y!WW6nhMn#taOV`V8U>
z;4?L*gO1~1;JL-mWX#IIq;d^(hK4x<L!}!7LnUaJIOsr)%3#nfb<hJfD$^JkDpNp-
zclrd-ff}G><^%2oZQ9Pyc#ZJ`Lv;!R1JfQ*IH`lq8{wM6z@*wG#lUdtEI;FYP%(Lf
zfuXX9fuXWMA(Mfh@i9o~D+5DiJp)5!waW*FYEX+*fq_Xi5PV=NKjTwSeGJkxnSr5l
zBB&8sT?4*8l}R-foOi$nZ&Xi#idBNez(;OWF93;w`4-@|yVmXx3^f{{wma8Ke#TF%
z3`}Zr><mm=Cm0wi*Dx?t&H-^QGcZ)XXJDv&DbB#Gc=Q89tpZrX5q?HVUIr%Bx6BO8
ziq{z!sz5911woug3=CDa3=CD~Ah*@%Ffa$&Ffgfs4uAu-n?EjbVqh}f!e{_$6W8Q0
zFq^AMd|;?G0UaO?>QCqzePF0*0Tstw7x+Q@Dw)(R*%_F0?HL%VG8q`E!a*EQ28OE5
z3=CCkZ5fz!6Brn{zB4eX3xZ@485pW=GcZ(L1#z+&7^;~W7^=R@LY-a%aymCZ{~}%n
zCbi`t$6jY(s5WF^sMZ8=9x*UfhcYl!`-9FN0Q(iRxt4)jnt!Pb1C!bfkQ$JNQU-?V
zd=LkuVFCj~bq~m^wM!V7bSoK{)ZT!)M<w8C+}aHgF?9y87z-$+)E)qdf%z3+MKwK;
zFjCitb_zajKn|k|pfCbytdT%E!sO!w*byeIT(1&9hnSc#Fqql#Gp+(RV;Gp!K_^ia
z&E;oYr471jMkuE=kAa_Y6=;zYs5!Cf9Y5nnE|4;=0tSA@jiBRN`N0dB_!&V(00VgQ
zJ*Zixz6aba`wyzYoLKl7L05Vz^D{7MFo4I+_!$>~^$LMT&-ob_fQt<w&`mh}j0;Q|
z7>pl)Em#U})PT&;I>FC413Ji~0a{oOa^wshkRw3@WxY@N8GE39&;T7Dw`(6iBj|`I
zQP5=R&LjMcJ)o8OFh5L0_+cX09UwELU+^<Fz|2?<zFvc$u|bc4K@ha%8e~QTayYai
z%xHz1F;A195wz@z;VT1^#t*0&p!r|08OF2t84JMm0%!_cm7lQyw7dxBs49ekRS*Mx
z7#IXt`5BYIj$&kB(zJ(~m}CfbmGM@7#w3`D=hXQbliWaa50Ew)V>Z}Ckl#9A@H2wW
zJ_Wf;6Le3k<92?=2rbaLWssICV+3el!dGa7M}RhX!Q2%CF~x_0q4g3!qYvCMXP}Pp
z0o{@g3Zet6`5Aq{Q;ASxe85MCLLCzfF~*F6!8VGY(HU$E1C!<tP^Gw?pV1j~${6S_
z5l|X)hpSZx;Ab?4s?}0~+Gq~;KGa-0h}swihAL5hMm^Bx=1CtIq(LLWpu0wxw9@1m
z82JA3GlJK5d<AVy(dGcnB>ONhX@M3(fC`uoD&S>f;vD>p;GK$JKQKt0U|?VXk0fdB
z)@EQ3iRNci5r<SZ)vFj7s+WL^Uhw|JuM7;;Cm9&34}y&4U|`a_32vaouz@ek7QM&+
z7t{sTdc&2*z|Y78PSaeVa+?j*$oq;^L5bc2-D{I6$NvE8Wo>6((3xNS55Qr}!N6d=
zmHz=ah&dP-&Z+Z10EaMdaz-%&|3h5{CT(XnaJ~2v94I_V4E(P}85m-~%dC}W`!g_v
zwD6w+oBe^IH-dqIVFu$I1}2?_;4{_u&lrP}6$3-{I|hd8XKLUs%o*_fCj&!`Dg#4}
zv<A39I0M>F{gr{CCV+vV#zO;a`&m7Z?F<YxH4F?jB}!mdTm`#=X(ESW5(EErh(j1^
z7BMi?EHGwZ(v$nZ&^rONkEIt>VjA#YV`X5{0j-nMvu0qZS<Aps13H~sPoIIIW<LW%
z%}&rE`R)u1HFp>oYHoly!3+#F-x(NczJfUM3=Fl*3=Fl5pmXuF85lrgm$f{s9~gS)
zfX~He(#ZqWV&GvSP?Ue|U}OZJmjr2<J0YKu-@Au_S<4wZ4)(PNyoNo34LlrH0y*os
z_XzZqd?wJ1fd&i=8-DWd1qUoh91>}J!I1`uoV~7~;DJQWL2$5uBIht9Od=Q<j#lw+
zW(3952L>t7uoJlNqHClEPI#MTAnC4Fo`IoOTrrb@e;YXEFfi1*Ffi1DHX2H8Ku>nF
z?fBb3$xgSDCyjx>3!LhBG8y>6n@6CDjuCV`-)uVpo)iXt&_OLRO>7Jd7nu1$_qHnY
zgU^3Hwu8Tn5wvXm1A`Q3$+80|!RQ{-NG>g6;4c#d$uKa~g2Fp7Esue}Od5PJQKn)p
z1Ahg`kvA9^YNs$T)b@c6mehN}9}PB)5fuI4Ti*CVCwMCJ^MWgaXmC9M3B4F)P-286
z`4~`c1}#K5r_LV(o_6IaVBk*x`w3*OdkVil+}tvVx&GoHw?WMH2T#C3%neY1ntNb1
ze*n0J$_q}^0ifA3&<%6^A#ih3h4`)E=H7&uYYi@&A?8|x-OItiVC2hh4Q~BI?6CF$
z*#UB+9oQ@$&{1*xpvx>7zVd*A$sMw^B!YoKr<`9AY{dr#$vF%R3>Bd8)dwA>EfUSI
z2su25p>`buL+vV!;*uf;eno9)VgQ}mzYjED(Hw2M95i21_1|<hD8}_2Kr<)${HBY<
zA?<&E1_ra4rfr~3<c$xEUI7dY44~`cnDm=K2MnHZHf<9G-Kht@_;*IRDQGg2VJCQk
z!4x!-!f=CO0wV*%o?DiTZ$L+`vFKVd9%f`<(g)po=~8FOcoY=TU%@wASu$Re0Qp^%
zfl2=uxX*6McpcJg1_|9n6#{isbZ5X-fJQmi`B*aMFfuS1fUX^#|J0JPh!e{32(@G^
z0oil|YEwDbCh+iuC1V>{MwEfcz!qvp1>9PL08F7|R3QPbqWoM2OU4cv28QT^Tm^Xr
z43><2QVdK6b6FS|b{?^0oCa-VgYKc^0EvSeIPna83=C1T-5D6>MOj_}h45DfCWD*c
zWMFwk9uySdqq{A^YcO_#B1XL3@-E0M$i0WIKP=s#+6?)4!H#fK1i1lxr>vzP*jwP+
z4lO}*TMUyxcM2c)VrkFFz+`B|3+fzN+JnYack*TyFj(4y<`j2=)QARHT7cAqLkzV5
zdyF?JC5^!nbkPFCPSEs?sGp@WD9ISEgQ!xL16j=hI?K&c8FZS!PKXX=Q0r+Y57;))
zX{ii5LGwVC8sL!zkf-$dEe-e~sm+Rkq3*3rH`v&>91IM*_Q`b1g7P8<14D+8OgG3_
z&@v`n1({whP-!6pxi?+!4oD-&Roay@)gbLg77*>#l2Gls3NqE;b^`e7WtnR5(T!}N
zn?q%4Wf_=^K%QKBgMkrrjH7lXC~6`DA{ZF<?2rLnRSCMWKsSMbfdO>f9h1>THPD@{
zGI`1j40_)f7;5h`Fx1}ENGUF1kjc{rwTu`T>Od9BUo{4XY#W(8P`Pu1fuT;7fuT-O
z9c*b4*ir_DI&%hwI#W>wCL_>VE!`P1#k}AfUAaFn=(a!>)ny^=Oa-0zDP1iS3OaI?
z;{!tkXoGqKDBl~;Py>fos4OIp*SRn-)H#5b$EnMNsxvS!axgH|WiT+*#i@hc9uB_b
zl7XRaDg#5^M0L>2qzq(lHUmT5at4OFrFo!3mSqw+L3%+IaZzds19(^*w1B;C69Yrt
z2G$P@ksJ(6#{U?Yj6oegkV7GLB17E=hDa9%CgVO(#{*PzW-wZScD6-EFfiNS2ennE
z+>|i`9T<89WB??#%;Z3h2c6BUB4efrnn?#$DpzGJz>Z}DI}$Wu0iL(iRgiH27m?6J
z0IHCt+ys|BGLZ5T6j*aV$mlVGqUi%e#1sYwh8R#_nJj<=mYx*IKF~r928O!bvJ6Zn
zCqIBst7l+f?~pOzVPG=p3uIt2`NY7?z+`fZfuZgh14G>d5a$^KLp>V<L)|}i1}2k#
z3=H*}3=H+k+#eVs?l3T`LWY@QASWlXfX0C)g2sVB(n~-SY4Ap#0Rw~Vbr}t?3qjU%
zFfi!U$Y_AJNmp}#I{q>mRv_1dsw&y5GE!iLj0{Ys+z^#gN+2JAj?ovB0dG?WRdtpA
zGE&|kT|A(wRz?OKdZ5c^wd-XBLAk?Jl>?jz1m!`hKox;&p!8HmT?U4z-_m^`<AXRD
z7}igh?gJND;4CBECj&|eAY)W>qyxalfX;bcKV2GhH8LXyL=|WO4VZoLmvjJVeCY=G
zB3J21a6012WRM0efoAwB%D`m0l_!-!I!2m-v00gofx&O7bS(H%I|c!ecoC9#8AKeE
z!6P`OLD!Ennf?Qr1?oF6d<Cm_K~nDuRUgH`ASWoT!1#ed6O;uHfa2b4vqmO^v;t^U
z<0}J0y$b_Fy`37^vkIUIU=9X``b-9f`c#N_6qG@p<^T;iNh^S={2P$e#_(w($ZW+_
z25BvEkOvqT>N^-1>RY%!Fla7eU{(TMBF0m~Si)$iqGYU63_5KxlMk8i0XqFru!KRO
zltBqXf>nYK*mOHBEzbCXK?AgY8+6_uleq@S(c&;ipJ8CAKjHO(LDK|klPr9<si6v-
zsbs9e{DH|&Ly3_w6Q2SH&{jAG2C=&;jE;;S7(GENlffH^EZD^v7?;F>g+Mn-^r|rW
zvNAB4|7B-jT$0VeQ2&yFq5i2Y1LKl%1_r^^3{2+dKr$5!4E4Vm80vq5I4uke4Qvby
z4J;te1O|o%VFrc<e%23+o-e>>xH6e<0JW__XQyU@cVIJm2{14&eZs(Gegq=HAn}3G
zONN2T;wuA4+Xc{htPD)%&q1=B|H13f8Mr?%dbxlkK!Tv7N<n6UHR>=hS+Ijn6WbuA
z!e{{UUIYUJ1Gp(_@l_ghZ}SI6&jQe~L!O`!Mg|o|GgbyBi#Rz3#(lFv=S=Ne4q~nY
z5xYRd5fE_!MBD)#TNM8ntRLhukbV&rP@j{@qG3KG17iXg=vFw3e;*h<TfjDeb}VzK
zFj|3ZcvQu}WXZ$E{DI-3#{57ACQC5}Wd<foC8&rT1Cymbh_C?>o**I&L?m;6VD#)@
zV6p=3LIIt@E%AZTGXoSlAVvWL<N76_V<xoiRTz~R-!n2W^sQI<56Y}ofxKx9D*r`6
z)f4y(X_fzSAT|pFLr{(iBO?z3lNG3CBfm(65!|~3&HL23s4#-B+W~R1dQ=!Wz$-sM
zN8D~zVdR8yI`^tDg4Y7Q6lGwtY>sDO2$NJ{WD@~RDuU)<ET_dYFeo&tFtX{wg;vHh
zFhqH(FtUSYV4s3j?SZP|L<pUaXJ8OotHLM*DtsWS9>s&MZc||tGKZV>HJ*XN@`nne
z2wasFM?3=q<1ZCP5x6QV>39YPH*pn4F(H^nE4_FIhBRIkMlra%tQ_MR7*1NLFp5K5
zF97w71Ze#FDFZ_@BLkCFtO+RO7^Z^QfqWo=C<caupH+@Bf?|__K^k;B6;tv&Sq7#Q
zDX<U|1B2KRl@qKCOxEu}qFo;tE>?g>9mOuH6tXffS%G#*rA%jFXi#ThXi#PVsZsjC
za47*af++Svr3j?+k}?BRias0j2d3<$^A|HRFr`?7x~wVg3=9p93=9p{V6k9^ZHx@e
zmixiF*}x<N1A~g6iYo(CO8f_gOF5ujAq-5`D)T``q=4))4f?=vX%E=0A1d)6yQVQS
zFqy_PFf?Q^Ff^orIN1yg4K)l54OJjcIRirjC^z@XF)*1ngNT0a4-A*iFfhA%FtTM%
zX33h&0y^s$K4|D-ud+f1)C~rmy2ko};Zg=<1%~xDP?iN9NC#Pg!OX?T0~&n1v;rg#
z8s7$;;{ZOqjhTy46}*h&Vg&=^ihhX?43};&FsVEPF&;25Jx>SuB!%Mx!=(qHBV5H<
zR8F%pFgaTpGcX;F0*kVMNd^W3m0nf`CYySYJ6<p_+iqoGvH=|d0<tEP(H1nidg%*P
z9CQl`Se%LD7D(bU15^Th7zW1yQ2U1C8pz3)c|bBSCo^$eVF2AVv_AC%!({;mRt5%f
z36-g=3`~yZ#te+>yFM^nmSA83lMD<ZBKJTJx+2HGxPChK2ZqZUNJFnbAHYHp6rx~5
zx2Sz!xU9p#&cGn9F7gaysIDIa;}(6eC}>7VU6}C~Cp!b<7ErpF!@$rm3&inbU}#v*
zz|gQ%nSpUjG~^JoE$Ivl4VxJl8a9Gd6f-b19AjW;*aPA;FfcTHXJBY}4dV1NFf{5j
zFf?j{II|cS8oe198r@wP7`JTsz;GFK&p-wPlkEYJ>{bSb#uU(|aMlkDm*0TeI}A*=
zQ=x;+zra_HUH$_VUIP(k5&^F#x*`A)h6pkKvH(rPF>X2ef#C|Mga(lej55NEuZ0+x
z>^+zn7`MD&U}&smU}&rcalSGzH1;ttH1;qvFm7dHU}&7rz|c4sBy*dAp>YEPL*qJj
z2F9)Y3=EBX7#JFNfjCkO42>5U7#fd(IO+@xjlUQe8o$^wFm5$rU=TNBV6tlm$yhQl
zG>I@UGzqbOV7M{?<VFT2yL6a44M4GfWdpRe&QvS`T{`s(bchO583O}@D+A+J_YVwL
z4uHB43`}-+K!*A-Ff_?CFf_@63_SrgbPvQ(Sa`gE84BLB0vdr7DF97Tf~G`4u8d+}
z5O-x@veyL}7|p=Yq{YC{q`~@u;VKWrKzm+@fuPXj{=je*x=|+!e3f7(Xf*4W1<XK@
zybm<nF%@%xt5(qQDUf*By7>dc)eE3W)~lcmI5ooH*%Ak1P-q`uU}&;sU}!Q1IpZt?
zLsJd|LsOC*1LM{k(hQ6souJ(Y9~eL+gMl!kIwJ#<{co7g=?n}_6G4j4g0$aYU})OJ
zz|aKhU0hROU{?Lbz+`_7R7y+)1uRo(0Vo?@GhkpgPheoOe+7~$1@A(-<^l;V(8(I$
znU1SJAle;7K#D-UkW5AgP-I;Lr87_?oe69vI2b@1)<CEHfD)|<1GrP;09*g{^9RVz
z%b*U;KL#d;L|B-LfciO?OBk3O%0V`OBMCID2Qs6Bf!SP*fyn`UCP*m*Smg=^CWqx9
zmEblC<gPW)Io}}lI~W+Zer8~D*bS1O2tK*%N&*A3c`XBz!+DTc8N^RBK%Qh^a(E9C
zLpG-pA`j|d{9<5o<N(RT{0vGF2Oxprs05aPg{8y?hTAgWumsJJU6x>AY&{DqNN*;7
zV7TT3F1JEdW`PP)S#}1dn|TZjO?w#_ns$RYRSXPGHyIe3u7fyj3=B<Q85o*AgE*5I
z7@7qc7@GNI8JG@#1)Idfz#yKXq|VB~<OJHRdxVvNp*e$rp*anD_tk9&P};f;nm^!B
zwBTi6a^i*Febrpdz|dR>z5D96185y2SQ*mYSGOHN5d;;5-+cw)Bj0^>EdVqp$-v|U
zUOx)HBlNZk_^v7@C(v3zMte~5xNQJZ1uDs{K*cT7&5Iuxu7Rsf@iHY1VFo6rbY=#o
zn~xY6n(G)Cnrpz}1yTdbmJH(EN}3=w-7qzs3=GZfa5bRwI2pvJD`^QbFgdM<shPsS
z&^!sGrqb>M!?gy`S)1aEm9#->E`x%>kAb0iJ_AGZT#!GnrGVVWz~uA{<VJ9TdaVE|
z^b;gx1Xcx|r*-B537LRAc3lOe3KahwMhpyk42<7Sd|<e40;-3ugJy9UROYhEF))6+
z3ih^mJy?>DfkAwe$`w`yCKq321}5<yrimP~42)Z|J}_Jl0ks*#Pg<LRWCcLkx152Y
z`85MWGw5X6tt|`;Eldmy&Hq4U)kFpc@w*I6&i6seCNVIy$TKjsh$}NNZk^9O@hZs0
z*FkAll7Y$jG{}j?pp$4pGN3XDoNaITFfeOJ!7^V8IK5v_f#e%!kjEjV8fal8_XmdC
zS3oi#lOXvLw5)^m1H*M2P!Y$#<O06_405+GC>v#f7JqVoV7MNDY>5w~EC-dxpx8+f
z`oM4_0Mu|3f1`4PlYuFGjVuGxwj!`7D+7asq)H<z15?;#aR#P!Y9APG6o6t<!c~Fs
zFGzS3I|I`?V+Mv64+e%7Cszihbq-)P3=A9$OfGvsvaSpaEy)ZFEr|@a3{2~S85krA
z8JJu^Ic!}714By*14ByzgERxP`O^;!x54*P-UeO!A|T6X#>>Fu%D~LPZ2pabp{1RH
zp`{hH4}M+Q2ZlS~+t(%PWf{#unQ9#<UZyZGv`hfmIFW&&Wi<ms%W@EB9s@(mAqIw)
zJs=P4{J?N00~Es&%VimLKpxOzW?))(jDex$9s@(mEs%yw3=Az_85mkVf;jgW7+U!l
z7+OKw_t(8*U})81U})87WMp7k&&<xiw4R%Rq1Bp!p%rv3_<B(WhSn$shSrD<ki6mt
zhPz8ZYCu}j85mkqjTxBDGQloj0h0_2JhGqU7?|8ZN2i)qF)*|iGcdFkGBYrnwZS;t
z9~kZwFfb<gfks%k7(vtE;M<EqakoD11H)Ywuy@YO{^w_4^5|h^U|OHgz|h*vz|dL`
z;#4y*w9a8*Xq^UfNjn2W>mCM%)@>lpWCn)Ty9^AiH$j~F3=FNG85mmMgE%`F7~0qv
z7}{8j8JNmqKQP>N0TpC-K@+qbvU^z>nB0~!Gcc89F)*|VF)*}&PK&(j0lI??lr%y4
zP?mwI^uh;*yFQ?1tHeFo1N;n3?p(|aOr;MP7~13+7}{i^h2LEtP*%MQT3*G%9cQ7(
zz-)H~tdR{&f-dWV7k&^`@WRiPfoc8W4-9uf#g7UDllyFt(~mGPwCOW2v}r=i;JZ`6
zP6rK?amXIyWngj#-6CD7%)rp*&cM*-3UkI3P#Js|qztJHzB>h!hoPbfXMk0~ogwjo
z;cf@`x-bxn2gCv~WIzno4-9urK=-CGFu5NDwX4g)&HcL$Fv%LI<XuqH1bpV)-8)dB
zk0AAs8uIQNh?oZ}R19Rn4+dt3GKmii_c%b3tREQefp2JIVDfNeWXzPPT31)KuFg<J
z$xvm5vH1#P=@kqPDy0nIi<s|4fV40$c_cA1X7X1t7^_q<D6KHI0;>X5n)foG4!qX@
zRoMh8HOd({wkv|=CxGNZV*%?eK&c!wad{VXy10fcBNr<JlgC|9(sN~CXbWOsXbS*E
zOdtb8TRa0pTQtb+D?r*oj6ERZL5ve15zz9Ljm#ey?o9!gF|TA9nFSe`LMAaYFl`iJ
zU}!66U}!64XJFc>z`)Sf%)rprsLa5$Q3qUlgA?k#6QIl>$swD|%E0952TP<g7#P|n
zaerXAcLAD6*{T>kR1H-aK$&P;^#_Lg;L=1=M7ETbfhok1nSp6r2LnUfZU%<7o$L%u
z+om!wv>j()XgdnxEMj12yUxJScF~rBY1=La21x@3rVw+G3`qTV28OoJ;tWjNPJLjw
z?*ev?rvl?EP6nnB(19J>ZZI&k^Dr>9g9?;wPZ=26l^Gb?<w3eXF)*}SF)*~7fjIve
z7}^6F7}|Y7Mag!a4-5|q*cq6%i!d;>=P)p|r+`YJ?TR2FO$LVceg=m2URwsH?Pd%N
zl1U6qUe7=><_rw&a~K%fXF#ufzMliy!~r51coZ1dNiZ;Z%>&iMAQ!A-U}#?h%?$T*
zK=BDyhm;xa=YVo5R1}^WAbfac5Qh{P_Zz?-&r@LB$jQLu1*-2srA7NL28Q+>+#eY3
zw?HF;33U5V%?F12pj{YDkg5yRy%1+$+J5Z=!~Hd&0z|S(fpI@K1Cy@?GXvB17Yq#T
zCm0yokAS@Rm4TuCJ_AGhZDj_g9Zbv<-++dkcJPDhSat@c9Wo3I?LQb8+CND{-330F
z=050P8V&_UT~-Dr?>uNC>ELHz=->sp?F7_qplL*L24;sz9~ka~DkKKUP6b9oX$B_m
z#hwhz4vTFVm>uVU<(L>4Bs-bRc{~}I9oK@ocuc$Jeqgx&1XT3g2X!O`6c|m!8JN65
zlk>aRGB9*VGca^WGBYsk-pRnwp~b+^p#rk`0|V2Z6i^uouHHd?^bC-fKqi8n@c?|}
z?gP-$9|i?R8zBZJA17vzQy3UJ+!+`;T=gJMdcXrJ%^>QS%z2n0&gzI}VCaYh8OF4`
z`~$-S50LX7fR--^C@?y5GBEk<1G%V$fuSRxfuSQ8#F@ar&{4&}&{3hs0MQfxN<t67
zv!)8Uj36Z-^{osH9nByPNIeMmaerWV5Q6L-@CCo15(8ABJOGUzGCTl}9x5=pvNACF
ze1pZqYzBsonIP>Quy`;6H;W$FFfi>}%)sO;z{r>hieOM93fxhBumZ&*NRWY2klP1_
z2U|cziR4rT#^ZtvOu?WcVS5AvL&r)6hK{Am3{2ZoK}La+QV|0~$1w(mj$I&5Jp)6>
zPX>mL&mbi|%o7_x!&2L4f{vAAVCa+vDOtwA&>6tM(CG%^Y-V8SY-M2RtOs!pFfep(
zWnk!B3C^Tvr5TuZ><7Dq7fdoRXecm7@-r~`feM5j7Z?~iUobFqK4WHJ+Hr@0q4PTf
zL+3|OdVT@&2`D6PfP4=2^&9YwTobQ?*Yh$v*nePnXab7HhoH7DhXP|PCj*mT7&8O2
zLjVIqmk0wxmk=~fJTw8N35Yr-2UwcuQe<H0k_WA21ShbEpcNeqlFJnsQ>7W0{APm;
zTFk)ErN_X~r2|dx4@<y#aycSlby+enbeV$_){c}93=b!OT?AUkGC_ecSBHVgzXjyC
zQU-=D7Y2qdCy?J7L4E@<dYLEwU;yRSnG6hFK@1FCejv_L28OOQ28OOAV+M#X&w$MY
zo%_e3@Y|Y!$=@2}HjpPP7#O<BV4ge!_9R#tk|$dk7`mFliRj@0P*5^3`Nx8?Sv9yd
zHSq@|P~U*-=7)Dcy<F}O3=e;Rl%gwRs%HR&7Sj%`4-Ah$>6bxrvjSrqHv?0E6v&e{
z3=Cb97#O-hOLum7f(~Y3VCb3+@@N>y$I$ZR(F|}H?pI(G5Mp2o0NrEm01D?73=Cb%
zpyB*z1~}#JM+)c73=CZx!2<)2RzMt=2{IIt5kPrs(X|f@k99yn^;n02fw4t_aT-4Z
zQ?MB`1Jj~s3=CcS7#O-hZSqB*7#O-PFfeqTU}s=j^pAm|>oWsG*GFRprX9aNFg&&Z
zn*f?%a$ujV$G{W-T6?rpjDex+KLbP8UuFiTok|Q0-P{Ze-Jm4AlZ%0&TY`b1Ta2B7
zX{R0oL$@*mL$@M>F$2?L#}5pTd%(tl&a+#>K3jl+DM*HyfoX9N14B1RtqzD2$H35S
z#lX;Q!Op<6IE#Uy+YPi<Tow}fkLQ4Elhf?(oD58X2GEG_4rE~H_J;=6<2j%njO1xV
zq<6<MFmy+QF8gCzyygSLV{pm;7*z7Bu>12fFa?5I$BR!gFmz`!Fm$Jb9I=;yp}UlU
zp}Sa_fobtoP{?wBV0iolDWt&-hQ;L{7#{xsJLx)mFgF8J;CYblDGUtV4Gaw3bs$a$
z14DN&14DN=$f)^Hqn=1083m0rP`Nty1H%&;1~xFsz#zaL4%%-4swTQ;Ffeq3#;rls
zME7C_hVF&j9~ho!AQyL#L1u8WWUygiS`1R)0e0MD_PGKex5zLsbgyGz=w1WjXfQBz
z?_^-;-VO?A69$IvBMc1PhoAxd1l;+R{J>tw$-ope6Bf|t85p|HLIe6q2sofWAO-Yo
z28QmN@PK|&1B&e@HJ}lC_DX&Rrl7YVdqDyHoPnYHDTo6K=+6uc-Jntq9?(zb;0~P?
zU^7>M*6Og=3V|w`wG0g1{}~v%L5UF*Iz3zr3_YNwj8E1ehfW40U>HF8xdBB2RHlQA
zEO1>2-roA)1p@<vfC3|EQX}{j$d(och8|G{h8|%MX95F5j{*Zjj~pn@Ko#f*a9s#m
zu)u++3wuEK0%*e2n=vr-n1G7#FDRCSrnx}FXZM#dFa?8mKEj(mb)cpm15@xfP{{)q
zt@*(4Py$5+)HAuS0xGK*m_lSg;~_pEU)~2_K?zccXhSgifJ?UfEZ|`wP?uo=sI?91
zGHe00zZsZ9;z6~GgAI6V$-N^`!BR%XOcue0h8mE;_nv?T89)ZZ90eL=<xl~ahU+hV
zV0dx{T&DezWn^JxU<w6=-}?Iu3_Xqv3_bRs9>8k`h8|xAh8}Ma=Q{&KPb33FPq-@s
z(+1`b3{N>27#Lg_m_n1-8JIS(FfjC_F);LiIRXp}Jyi@0J!QrWOuH;UFg%q2HBX;{
zb_g-ZF5zWh3N>J6VA|!$z|hmfz|hkL;)F6V^h{@9=$Xo34B1Tc)CH^w(uG|H(iFiA
z-b=&KvxI@6XA!7Z^OT2y*+B)wdU638Ku^9v!Xgyh|0!eOJTC>7|HHtv!I1R>!_ye3
z{8CWJRI7mcXOMf{pXNYic0$FtKQKH6clSViP#c%^1H+vf$Z%-rT~GvqNBr(A0EIIH
zQ|LdCiB+H)3Oojs!OX=7uEOqYfG7x)1t|beGeZ<W27>RL0rd+ZQV{hV42*YXGBAa?
zg9Jf`DT0QKL6%EEQcoCY{E5*6l%VeDK+UcIsRfN8L5dfstP2C<-5(50VLc#O$kO{e
zArNndEdY6o^FJu5+(`k6LHXe7>P7<6?9Z<qu-P9Ljug<kdszmi2bLcgZcG6cTT*-~
zEvyVo;U(-0Ob^@`7<x7{F!ZdIWni}K{lIWz1*lGxl2QdtE`^&gGca4uVqoaGz`)RR
z4#Zi;z|eD#fuZLPI|H-jCI*I{4-5=F??67gF@u5G?+61^cqk~O4V)O59;7gWsRBk9
zkfU!b0Vx1^te62!7Sv08c=rRt4R8vVQd4OKIdG;N1JlD-5+4|DykKCCmj@+_8$Aq+
z0!KhXQy7@p)`9fNGlLbdGB8LPsXSn1V2T2r3Mmgt)BhP5dj7IAFv-g@Fn|_+^@6&D
z@>&cGpzA4mg+Vgr3=F*r3=F-XO(pU!3=F;63=F-RAelf0hF*IHhF(y=Q$CJ?p*NX<
zp*ImElg+@;o6o?|n=8k_Bwr!Tz--a=f#IeMsH_5!3@rRiM|l~TA|jX>m@Q^AF!a_i
zF!WY2NHZ{rm3&}$`T<nbJ_QwO4E#)2SQ(fiZptw*i8X?VUJwEDx7bn;Ya@u*3nET}
zh^wIHuGlLO^CO7(Bgeob&H*AsK!gH_&;bz^Ai@Pi1b~Pb5Rm~I9F%WmV32ZPV2bzx
z@<<m0LvIfQLvI&YY6b&?ls^Mgq@6MYll)xB4Y1EnFfc2=V_=E|--QY)mok_*d_l4K
z><)Cu6Fei4$yUMOq2i&&05<6&1A|lo15@NGPyk&55%-~69-plMRc=xV{7m0Koil~|
z3=F-X5CVBw;SF@F<FgeE91ILnIgqW6k<%eN+_^t6JWGIXab)IV2Gu043{3K?KQKH4
z^&MFlm?BStJhg#=p?5U{L+^5MqWl5M77R?0pj&@IQ#M~}U|ECNaD@&iN!=7-V0^ZZ
z^#j9A6OfM>n4&;q-ypTW&VY<~It8=|mVqfs9-OYhLJJ_fVWL2Hzk*d>fbE6>l~_9<
zc19(@Mx9@v*a=c{18P+*RLR#0P-ZR$7bj2OK=m(zO8)u-)6dGqc?9C>r(Zy>V*SAI
zj041AV2T3o9|Vu<KNEqPeidrKZvl`;pZS113JS&ukUUHdw498ADTUz!!%Yj&)Qwb~
z$`e)wrer5s2F7oFU{Q7k2B{+|OIR70;)JCc7{5>Zz;H7Gl!|YH);F36urjeSFh!TM
zGcbPN&cM)nf`OrTANL1_n;p=T9+-;jLEZzEq#59nG@Yr80W`4>;xP4jfag1<85qA!
z|G@BE0c7xV1qKGjI|3|!IT@H@&#^Nwep|}G(EEmgq4yQ&60>icJ}|s^qs+kgZ5OC>
zDb2w6yA`aJ8B8)T>=0nN&CkFT)2htC_<K6!JpSKHKx#n(8$r!Qb_T}Z`xqE{e={)j
zewT)fiaz%NWnvJ?z#_oxEy%zWqwLMVZ1?m714Ixy3<Fah0IKqygZk<$0?d9w3`{XW
zFy&xDsB(!949_D#xBhZ}V0b<Qday8P@F5dCAd>-d7bECE|2N=J0kvH~UQ+qM@cae?
z2bg4FC=g(Iz|FuEtHI2`_}iI*p^u+|p^q2DF=JrplV@P)lLYxK0P5LTkRL$;S&;4@
z<L`0?hCUkxhCVCS4-78^K(1h5isb?|OD2Lly<oSbgH(f~26UU^2Zk5W`Oz$h8#9?E
zihx=rrQq%{<FEV=3@<!DJ;E2DQH~`7EKfjAJi^St_^XkDq0gIvq0d#Bf$<mUnmrIb
z8|tcGD?s+JGcf+z%D~W<$-vN;4sz8B$UJ523{WjGQ5EdAtDwFkXu^~G1H+3WAZLRl
z!8Iq?#oz%PaOnL2haMAXLQUcW!;3Erj6W}fvg^$l$RQ=Mpm|^LsUx5~``ZIlj6D}&
zU}Aa<&e@>xR~`oj1};#?!3cCki3=zoK(QeUI^E#|!_6t62AI@!mF27qOi7^9MkbGe
zp|6C2p|6OYfk~#CfuXONfuXO~mVrs8gMmR>oPjAW4kXjdz|c33fuU~>Xd9<o;|GQ}
zUqDr{v>HG2R9*(AxIN4a%yNC8l~)W5eXIQ#nB^{l)o?N}NZYV7inCTRFw5NoE#nEg
zGatl$#m4-BSvY1sNZ&UGhQ1>V41EVcEk$Ozv=0m~ZNR1n@iX`GGBCx@0;wuyVCcKa
zz|eP998%N21dselm#{KwaxyT*%Y$n7Squz)Zx|T*UV%8vU>s;w-}jS&q3=7`0~f(o
zfE?Gv%BaA~z!V<`vf>^CLq7)tLq8jc^NN9?UxI<5Ukt?g#=y|8#lX<7#^49F9lT0O
zdMYcUDrjm3)X3<!WnkzB4LVpZV_@j_Vqoa^fZE(2#=y`Y0`c9P4-7BCW6;ve`I#s3
zGB72XgDhCdz|fz{z|fz}&cH0Uje()Rkb$8;AH+G#z|h~sz|h|y&cH0c{sY6y7obR#
zKF7+)&C0-(XvECGEWd|=p??AcLw^rD1GD@I28RBP3=I8?L7XcL3=`NH82aCWI1d;Y
zCNwcHOvnLo-Y_ssWME*J@D9ZJ!N4#vkbz;MH#-Bf0t*Af#CisXiMg^2%nI^g8$q|Y
zd}S>XV_-^@VrF1gFkoPqc%Ok`;%$(68wQ4nUl|xCegttm7#Jq;FfdHw0C7SX7$zw(
zFiesIaS|99CYdoXOfms+au^sUIWaIyasY8E7#Jq`F)&Q>0a-X1Y#|#1gA502Fed|3
z0_Yx7g(VCOlkyoDCgn1?GB7K&d|-Gb!N9<v!N8Qr4l<#Yfnib=1H+^Wi4P2~z!Scp
z8spUz2Ij&iAfYuN216wSvw{EvgNztRiy#BTq;>{|NzIUW0VRnupthroF)JenC}ayk
z@p6xWVbW3thDnP-oL3ACleRK2Oxg_Md}Cmkbd-T%(qT}NkQeyC@OlBLZ6M>w%E-qG
ziWFG}hDnzg7$$+*o${It43l0mFid(13T;ychDrYz7$*GzaU2;KKxa-(2KhtYmw{oj
z2m`}pA&^WY1H)u_28PM9AWkX+!(=T6hRGTrP9X!sWK#x)$;Kc~Ed#@3CkBSecD4-6
z@|_F}G64)sN%C?G%<_HbL962GKQO#;0sAZfbZZ~?2ZlEipk)!D>B8cJpzZ@BXaRyN
z1Cz|`4-79CFfcH%Ffb*Bf%5$V28PKXn-jt1&>YYnKnA9yTxi|<0o)tBxrKpAc^?B)
zQa`9*<M;q7ehe5H(?Nw4RK*7dCYi$wOi7@1AdH5fnJjQcfAbGi9CQObqY*@00_+Bm
zdSeEr?}t7x++qOLQnx@W_)=6>fvR>;`}X^J28PKs3=ES&QGQE;fmvZA>j#Egp#E+G
z15+|+2@n$pc<}d@1E|XaavQkN1=U*_ASqDsd8+~z5`Olet{F3^hYRWvE^+z5a0@&v
zbqh2sWuo#NWbqVs2F4|U3=EU|7#Jq^fb3hsz;xm+15+~i{wJ{cOpxP&Z|z}VTrv-0
zEBJn!+Z+r`$@3Vp85p=8sB8zV$_1SqU;<j7ox+fpRK%bHImQRvaAoua_tF`dlAnO0
ziK_q{O`x?^EF7ISDxk%`o*po7K^DA#Btg^ppr!2%zf~48g3ipyzN*s2$QZ}K5I<j~
z9z?GZRY_wsWMJ^DRPh2WkxgmfNlHm%Q1O#vU`he4TCV-A0yzZ|ba31&75I_5d_Pp8
z)ft#lT16R{QVO*g81!GNgh1DeYB4b6CaENuf!COV_K|Qe<zryrPcdX*5c{v92(l;j
z3r{A43g{*U@H+UE&1?(|`ur-ObB-8~f>y$&9EFJJfELX|M6N?bK-ca-)x3m=7_x%*
z&VXF<8zN!^7fI!Xh!`V8<RKy^2oXbwh$%t@v=daHU&Ra|5(-fR+D;3xJvAL7Vu4Uo
z2@$bGh;&0ltPmn|AtKfYk@XM}8-xhx{AYcB6<dVJWr!L(gve8f2x$2~<5334E+Q2-
zh&(7&)j#ID&-Q^q=LZ7=1Ngk8w1sL647v(@_r)2&S2awY%fK*sx*F&vRKEM5<0Wq}
zFibwkz%Y5Y8Uw?k?|k=lL1!E@Fid{Rz%coKUUEqV1K&dd28M{2;3UbQYs0{l?#IBC
zhDhs(%`ed1p^`eFdl*4EOV<a~76K(+@I_{spp(%UGnhCW7(kBAd&qYJ<XF%Y0NAnV
zeh|l=fI4;x69dEKKM=>BfI4=H8Uw==1&Cu$Kpi{9i-BQ^3&gRfkQ}RX1>)Fr@QN33
z#>C@TohR5GYXIJwu=Xk6EZz?c+7S#4jNr{s84oqUp)*UFfhpr51H+U|28Jn#Y77jX
zr}$<WK|*`VOa_K26Coa$1v;qY1_Q&C(+mt#4yrRSn2GYu0dG}fU;rImGnG*>uQZo|
zZ!Sn|Cj-M&eFlc9+Ug7pvdw(+K>2}#fnlmU1H)9uymAJ<`J4<)8P7o5lR$^s@-2WV
zC}CijTEzN+LHi2GGYm`_TA<PgTsZJAW?l-pB9pU0stmL-1AGcNNbw&Ari^b4Oc^e4
z#h|t->jwrM9#Hwhz?6{;mw^_Y4WP<EM**r4)CFV$+XB-V0=0iJTq8#rLkWWtM+0d8
z2NMTGe*#qhUbrfde(nzpIyE4R85y(KCxUc=?h=EHF|l&g7c<C!Po9f-3ErgxG6KA@
z(4QfSfnkdVpDphP2GIfr1{NJqxtjAht(<|+R-S=zGCyNh8aU2u^+0jPn5kI8zy~@6
z6m&HF)HVi&sZENB415l-z+A+@Fm;w<5(A$D4`??G1H;t&3=C7RDkd}VIe>QVaWF7U
zQ(<73CZ(9dz~=y3T@MmTXJD8Xub9ff=KxyH4-#3#z%Xr&Vj2UV19Yd&w5tpZ(@ra<
zGw?Y`Lrk77!@w|IL@|Sb&p{3<63M_YJy0>kkb%z;>Y(Wp7#ODaDTWv^@Hs+v`b=NK
zz%YHD5(7h{G@qLo15?gt&{|o61F{TEIX^xyh@Jq|n2g+f*#ZnqS)iL-b3q5TrZ6zf
zNRnk>$~^&A!o<M9D9&fa!@!gk!py*wdy|1-MhOGMj3N-{F$2Sl76yhHO`v%Ls0L7h
zqs(Uox|Im5cme~%j6Rs+1q=)`=7Fa`az#Ech=Rs77#NNCvUM4lvROciR2dj%tYu)B
zu^Q$A@UnGA7d}&v3$B5bfLySbfnmmO5C`OfvkVL~PQzXB0My544B#^bO{Rfe0Mc+B
zruZcT!;I$;7Z`kC5C>nl&KS?vAjH6wy&a^;k%3{xR|bX|pP?=gR{^!!81wi*Ti>!H
zKuT^hFwA6SV3-NI@HY1`1H(*F28Nl!ps_ko7>KJdurV+&R`D4~GcaX$!Zau{FwB$(
zaX=aj85m~j!<;Ox!T^fIHa-I_kUYqATLy-i)*uc@u`dI|OmB#jXMmjyN^z6;8sr(6
zvO&uMa#u1i%#31Sm<e{=W(J0tSquy_GeFw+GBC`nVqlnA0d}0v2L^F)*Mf0AUn3s_
zQ_c#Inpg&gnOzJFGdo}&J^}Xd7Cvnr2BsWOkP?uSW-&0#oB`s1oV1F8Vde_3nJ2(z
zf;@bfPg|OSDF?I_0u<~sw=pox1fAjq4xwWV3^R|wJ$wS};Y)nla1UQ*V3>IkW;)1*
zhYVoV8DQf<9=^xd2u@R#3=A_rFfhz~2U6Y4z%Yw}fnnx95T}=cVU_>`!z@0~Enp0c
zBA^rx&HVZdOgWD=85km)_$-7$c?hIlgtvl$&jNIoAqQwHVc%pvW4N3FNDg#`0wY+?
z#f(o6F6RT1(~}1o1JW0Golg@kmjRN~gv+H~;!}ak%>c=%fcDIA@K!SLsi=TV;H_fd
zQ_%*oKxSqC=97o3KLJuN58A#1Rxc0Ub_Y@q8sUYwOS+U#3a<VgNWB!q{5%FeDbP;C
zNubI!a69ilwhs)NKNuJo6F}u&{sC}h%DWF*na)yUV3;Kbu8Vm0K`YZ)5ey8oK$Y&I
z@4Wk<mFcV*3=Fd-fGbnp1E9)u3-iPdCRqli`~x2tv;shVa^{J=7g-sY@)t2PFy)_R
zV3@U!fnnAz5a%WX!>sEJ46{Jdod1-8Vb)IuhFR~~8JO}vGBC_GWnh@C590h~V3-}j
zz%U!M<O_5<`s^A8hS_Dx3`_;0;E^Au0(s_%E0|b6Fld!P>XE$H@EU@nn1S;EtOA3~
zqG&B(U@CBAV9IBOs{*yaLHaj<>JbK}d=<D1v;wmMRbX0Ipc?Jq(ol`skgF}3^1&-@
zz*QSZ8AB<95{Cn%0s~LOXe&VV*P-a={=lFO>u|771nEMq!0gLG6&Uvi1}*d!2WUG`
z1`~$@18B!*cQx-M&?PYiI=rAti+2(zd~`TK4Gi8%;06W<s2RsQ3EZ$?12rgkr+^v{
zH+Vn|30_d6f&sL-TDF;Y8brLDfp<D515<$^Pf2b81Mdt_k;DONt4C}BZLz!o@(egP
z*@LRmbCtZ7ydM~Zdl(oPpMa87iBVcP1Fxk#Xa_p9D&@7*V_+)K0avBG)?iy07-r9B
zV3<8sF_D26ylMFc1H<eK3=FeRDJC)S+JKfNfkZwqFwB0Tn9RUy13Cr!1_Q$!aR!Dt
z{E8_Iyf&bN)<7ao3=DJ36jK>^Z9s=JgG9<180O?FrZMo^fV%!5k$DUZbEYY#Gw|Ag
zPGkd#9A#jbvsW>Lf!79f>N!Z{0|UdHC!ng77jzsusJ5Rg%fK*K8dR0?+VX;K*kNFp
ztHHo9R}Ea1@;ZqzFqJrgs#0MGSq7#O_YVxh;Hs3tgEv`#fvFIbz)K<+80MNVFw8ZQ
zWni{*0xMx+U|<O6HREAmDg+H{*#$8$%(Z7=m}|?-z-$-Cz%bW~fnlx(184y&L<1{W
z8v_FiubCuB4M;;61H;@95C^0ok%3`uJh)~kN&dhf3^`yenKxOBfvG5%nSrUKgn?mh
zE(62dY?v#qfX0Rxig*oq7?_GwLFRxAtzcl7TL$8Q3~gp$nA^x;19kQlP<6^s$7?77
zk_Rd7XJDAy3*vwj&thPhI|Jf^`VR~u;Dyl)UAz@S3{1srAQwzvV3@m%fnn|vs0&0g
zK(!0QOkN$33qa?8fx}@V1H;_)Fhln+FwETrI{yn4a3UF?>XczAuZ{!*QxWL=FR+Fa
z3=DIR!8BZEV3>Om=46o!Q0>C7kyi)qzxxafbML|wzhYpR`vT(RXJ99TQr%wO3K<5b
zVi%B;zcMh){l>sB_X~*gpMhZ>BLl<S|DdJEoD2-}co-PwaWQ}*e)b0jkp-YKkKrV5
zB_9J*@pq7hH4F^%#2FaoiNZV#9`#|k!K=>0z*IZ~<cc5$22itXo&tyy$G|X8mw{oP
zHr&Gtz#e|Wt1iL7RD2So2Bg7~fngqKBoLHR=D9F1%yWW!cmdeMA9&Sa9-bG#z%b7b
zq!VO%Gy}uDNN{ypvK{PXkca>9R!V@Jdz^t`UOEHAyi^e9A_K#`A_j(e1t89C28MaH
z3=H$C!PP0l6Huy$76AGTOeIE|3=G?M@|p;PatKI$GH(R~uL&euf#f#v>ci#gL2~+V
zxhj8NEx6olken9i4DTDDDzM6nR~0U|9VDj;kz2~>o0!GG3p#t|1_M*cGmw-5IA8Nt
zGVm&Z4zs_(TgAYu06Glj2E$TD=L`m3usj1(DX6aJm6igz6{K1kT*-k{OM`BBxB(gy
zQFzK-$LP<%u<a2y?05@d(6|?Pvw7)qjdBL=JkYB2<qQn-dKehywW%{O%t_z|)lm#D
z85riRV_=xKN|u4C(%=Jwumd=i+i(|)Fff%)1!blyU{O{E1_m2$J)TO?qzi}*ok0Qh
zh=of)t1Cb~V({!A9|ME1gcSor|3_}{x%s6Rc*_~MljIqgN|$pmFvvXPP6FLxasza3
zgxhcK7|^jNH$WzEFfe#EamPT4MSlhcB_Zx`u;d2@VNl7a!8ixBmQ@XGMmXqtgc}SD
z^G+}@%sT>IzAFq~9|2a(!X2p(Dv?0W2k*^<io%!gLijLmfQ~{qdX_tojgf(=tegXM
zKOA=;r2epCV6c78?FW_to${2|$?XS`(Pdx|eZ%d|23oBN(c%q}$Yx+L_vLnH`@m2N
zS_2F2TbJ)t1Dom&QNl3qDFeg2hc*mM6%WD6m>3wi%(y*RnHiWW-Z3!DXJTNO2Re|V
z;uizMd`kv~`R42lOrUX@`7R6$^PND8{0+bwS->P{yMVPI15<er)Yqj?K<lc&_Oo!q
zeGTEmd<_aV;SUUD9H4>7GSE5{4sKh}rV`LDf%*On4D)?KN({hCSimI69#hcDO3-G7
zG7gX(V2wz2K=?2_7{KEqv!8Rjuzg?<0-Z<+-mqVB0umf9(BPOK!@w{<0va4bH^9Zc
z0k<nWI4T(!=7Sc%gM(uW1H*jK_8V|;>}Oz@zZV)DLN`DwwZXQqaD#%QA`u!KLN`E8
zh04H#1Hy+n735dp4-CRApx^+Vea?U!9H$r<=AQs50p$}GkUd}}NbAIfSwMC`Md5Zp
z_%J&d7(l1;l=E^svVo!=l589yfndnMz~0Dh2^v<c6b9X<`k31iEW-vm(}Ek)6yX7#
z49pE}gt#*>h--2igL27NP!8q=OB#bUG4wJrFf6X;)&a@hV033-xbT7-d{Ffb2Byj=
z-rQmaZaL67LExNNSI#W~%H$w9Q2L)*!z}^HiB_Oy47V`YRiO00<}kM~sG!>kDtzWh
za`Q3PGBEi6(qS|Q?YNY@uEVGRR(p+;fk9A4hfx7k_=3(H=-j5m2)U7$E0aNoQ6JQ@
z`pRI+z##uvhY@_1Nfi$#0|Q7I_~cj6SxE<0>o5v}in>WG3=HBuI*cM>3=Dp=K^O2P
zywLdx^4ixA3|m1X0$V`EL-i!^*>pNTLD!7jU|^Vkn}K2eWi<u{j!vDQdY}V$85kCD
zGcYV*R%c+4KdbXwoPnu&5(C2mO9qAoh9I#^I)7kdsSFGY;$<Mm5;?A7U`Ti&1v-~U
zhmi$*Rt*Egf_esq1+`KP4C1^xjI0p<Ff8a|U|7%rzTQ>`a{9to28IRG85kB!6=h(m
zy21uJMONpxG6Q2`7HHc?_4E%6pdHE#41(1<jG!6&YET!tdI<x=0uWxn%)nH=fq`Mc
zHU@?TppI$v9tMU52N@U^><7u5U|?8qhJj(hDeeypTfy7mK+SgWz#z0&U;$peuvG!P
zF_ftqv<aSx!vfS**qQ@6HJO2_x*DVhesc16aBl##iY}eCgn{F~6sVNn+QGmy1$4?N
zbikAIKX|~(Z?+)=gQ}6vJ5ZcgU*%w6kiVq!P6HIG9N@ToX9TLeI6$We>bwJ;gFcBD
zbkLg4JJ7`RBv8#+>!@=C9FdF+Of}*VT}QxmE*q$V*Es<SSkO^X>2*4%I2af>!q^xX
z&VAOo4rYU@k)*#mpi`7U$6D6P@a7jV=!9x9FeWCjF);X*=tP3!lMU<w@Ucjs4uo8$
zPCN$#gYF+T28OdobwEcWflngp+@=FMIF#WAPfBhggH8&}ZgV%CG*AIKiH(6lD^n*O
z#-990CzF$bsaA$3rMQ4W2Xw0t1IVqlnL3cG1L_$Vj)d#%7iD0oIS+~YC{A$HgGRci
zrRp?;S~Vb3kC*DSz}RjcI<0WFzfK#N4bpJIRHs7#8U!2NbU<hNfSUfGWAGVnFfi5X
zfHIpgH>j@_T&Uv#ij-P6NRWC!dLVWT48<q(84Va2m};kik5JQRv;-faCd$B6TMRxA
zO&@fu3G~eM+BQ@n$YE`86`=gfIYFNhd;>)-=x#h+1${<l@X;ht(^<i$gHDlm(`RJk
z0-Z6(0!kYCh~r3_GV~d_WEdEH-g0F!=rd}8Lj5bq6Dc<Oe?faK>XbP^XPfB%1(ivY
zcoU1#8T9{x(#RyR=k))AjuQi)Wp>C^{}agDb&259*YrPu&Wm<}sQQFRi~66yX_1YA
zp|M#1ix>lg_d!shQhh-ma(vqdhAp5d{sAgf8sx!+ivAT);ND<hSa6qtVZl{!p`w39
z8&aq&<Yi!3$g0l3(C@B)O`L(LL7stOp)~`;LSvAakNypqSULm4!bE7H0y^fZ`hq&B
zP|<$`EmIaYGB7NxR|l0T`cEL?z_74~fni~nBIwjEeaKxL3=9jWGcYWix}6b}y!79E
zVA%3Ql!2+<2%N<9uS1fUECW-6$_IumpsdCqn5KW1m4T@qw1Kg~kbz<05(b8apu(lW
zmVsg6HU@@;pu(lWlYwF3K?a6}pu(jgl!0O483u-hpe3yhi3|)2uQM<#yvqH7VGH7H
z0r(6acn*a11H%>_NJ&$_6I`l*2Nkw7FfeI*Ffi3W0*Qf&mQ2u6BgPC!0mI0c&Q#0<
zDw4J=fD}pf|3L~7MG_Ba-h0ay1}4o`ko6ak3!_ZX_y(xU?|smafgxnR{&7$OXvhOC
zdGOIct_q3`NMbl{2Re!mk{CcUG7LAs1(W^>P%9i#FzJJ4U>GKWij}fp{Vm{viGiu%
z0jOBf-=YpJR^&4EcOr@peek6vU%|zV{yuO_gNqye1E2`p$pb3z^uae!fr_5aZTg2m
z;x|AUT6c#2en@12ib9Kieb6zR44@kU8W%&{Sq9FxVC&0tK-TjnrzA1xmkWVrwII$f
z2Xz;Ag3DF?a&S%nox65azuW+PZ*6K`3WGl63RyM=hDa8D&~aog)jJs(7%XcnSoCXn
z7?>KXm>3uqKGd&OWMJ@%W)LY(Pi4@r19AEd7<fQezU$X(GcYv<fE;~vqW)s=2m^?-
zaIyYUNP~j`baG>msxo5@BLh?8XK?mcW^4gxe^Cae#tYz*M47P_ek5b#V^kqX;R06y
zDqK4Gl^HWZ@!4d?37Ym(X3P`;o!A34JsWH~S5jgTgEC_dI9S1ji!x(Am;<^^I7VL?
zdO;c^15?vxA<$X6%8U}$ptQirz>u&)nNb3?JQ~zUF*&Tv2)-~4#NoG8W|RUqkyscQ
ztd}V>f{tioxFNs=3Q=XoU`QBnWico-+JhP#ptF)wT$C9dKpaq0H;REFxJUUj?+1ou
z8K5KNL8VD+J@}Yi<<FplhnyG~7QSF$SolB<R3a*W1{F#-7#J2wFfc3<P-0*R`>gy`
zih;pfifJN;Is=2=B;{}N3=H0T7#J40Ffc4~fEFa6)=6+r5Ca3>0|us+3ksPG%8c9~
z*L`JRSQN>?uqf1zfvL6r1H*FgSPS1<Wkx|kW(KC#2@DL2au^sEWq~+z7#J2+Ffc4C
z194U`Ff3|gU|0m2U}@dLz_17;JA<8psr3K@!=g<L42#x*IA<6b79D3`SacY~0lEA(
z1H&TFzUtN|3=E*1H;bOgGBBG>{=l$81k|YK`=xwOn1Km&N;|XJ5(b7vpBWeyeFW|M
z-oU`Hn2~{D(SPm_3@ap{`@WetEI^CRKnuV@rNi<YkfNnU1YA0Ri<aeYAj6?8pfex9
zjT6YM8mKs8{lKuo1XA*}M1r(HN*>UK?-@*>1>vw_XGH*{*lFnmse%_f-|j#b)q%>V
za`-AXkf|x4l8Aw+WhF>Gs;QvX(ux|C0*Yng1P(S-LqOX`n3Z3DU|4nlw6Jm+=r|bx
z<-e>9Os%@i49v<u7#J4wF)%C!?N?J_VPIG+$-uB!oSA`HMSy`}u_^<@V$cbN%g%s2
z4{`%$i*MNy24+(O2BuaIaNiuffgalMTeb(Jje)5Zbn+MzXowaPX3ShH93bZ}uV7$m
zD+a9%tpu;~10A=Z$-v;eSNSZsKxAZKYW)W;QkBob4$|%1rhFEBsvfvZQa%gXL<K2Q
zmCrhZZVYE*U@#C@J}(W@%Lc0RlrMnmJT_2Wr+g8VUB7~ld{n*&8b19BN!tu}?}97_
z7w-w~3=ASU$_v460J#uUDk?8j1C@$Api)tJDWXtTUIsRije)_=LU|?3R=r8etHC*l
zje%j)YGu$t_Y6CEG8vTDf>nbGG~F4>tDr@41Or1<lyU{A`StY!gFk2q!U<3wZr`T{
z)?NV`kJ-t<u-JrwVX=W4xGbpv2Lc1b;t&Rg#h{4@y-CWI=8#OgxSD}saj7~3gSLq>
z=tz1{+ime828P9R_A@dtST!rxfL+0;&cG0INx2r(0-40Xu=qFw!{Wn=;6ev{D(?*j
zhQ)Uo7#4$8wSx{i1+^ohqCkCM;SUS}9ia3S&;i;qq&!KGfvFudmj~+6FMiL!u=p*s
z3meeEzzkN5(xVUP0A(|<W~3fHgb(k+vVLF)&|zS<V_{%w2hD|p`Wczb#YY%Hb#y=u
zNQV0ZLjYn}=v4v(Xn>_QO79=2B=6t@7v6e|Y~aFMl!2-JHMkzoV`PU{4ekF>g&<V}
zTm`6c=<BBU8f=~yDApD9K!=<Q9^nBM?|N^+MzeuRRlRqhK)u0}$)E>1W}X4uunce3
zdkEIs0Zztx4-w5oy@!ZqqTWMLi41C<Hx}zX7Gq%WXa_YDTWj<nU6v0FOA|noV4y_N
zWe091>K%bL6G5i}EdBv*Ch8r5HWQcVFfc6905u8S^^S=%Fm>56Ff8$6U|8Y?67$hJ
z0Tat&U|5m@$pPTwxm#<%%|ty&mSJF6(!#*7qzT+i)Vl)m-&Y2PCH)KxOM1c0L_Nq2
zPYeu8W-%}<nE`1g>fQdpuq;88fvGbR+)UIv4oT*+3`||l9~hQ`9L&IXLhmdq15@W2
zW(KCN00xF7%NZD!ECz967#No9WMEhVnr`mOU|?8sgn?nnA&^W71H+Pw3=B)of;bHf
z3`?FdFf4h*{efZW8c;cdUOYK~JETinAZ2+cco!H4xGZ1#1yT%mae?$8is3WRVwkDV
z2h`SM{lKt{2U4te$$^U1VkS`1TP6c4l(|1JEVDo<eL-44<%dVRAp?VAy52TW#CP?A
zn}>SaR6(%-Nd(&v%|pFy?(lxA-gZ!oLdr6|?Vv0VZXOyu*Ms#syL~|=kzOdQdFWT7
z2kLcp*@2sZdXQcxxEZJy1BxtAGf*y5FBX(;Aw5vNIFLA~3E8<#FA>BBC)gwq3nZGm
zLN5ti46%W(<kL$A7Y(8eOx-Gws6^^i9xv0Y1Stij+U#$7RbV!#V9V>&>x8vT3>g@@
z^Yp+=<+{7U4NW~SNJBHJG>t*e3)Hu|!JCts$Drp0YEgn3%1z07UZ57`S5RiI*V4TT
z3dip2;0&jG7o6chF4_imk?uWsR_;E5A_8)X?hKebC?iWa>mCA`)dL#!(pAts1nxdU
z%sm1&7o3rGkAgx26fU}utIa@qbyRe>gY^c2<4|`yA|vZ=M`UE(?TC!53);}@VFAj>
zjT3cefoqcw3`;;6nE{lM`}n~bS$7sF+HWv0EM;e4Sn?m7k#%Q5GxAb%28N~jpiJwo
zJ4c*>sgIw5VQDG@!_rugn2+u}nAk)HhNay|8M$#HI3w$>0M~sC3`<utFf3gO&d9o}
zK>qv6z_4^11H;lS;Eb%h8YXs-fnn)>NJiG(_<><*geU`3uM#9==fX2`pU4M>C7`9Q
z4161O7qc=j^-g7GVCqw3U|4#Nfnh1ABiE<Pz_9cI1H;mLAQ?*rhNZ6=7?!>Saa<V~
zmVRSkSPGg#>I-CGSjNb}uoToFTe1XqMqUEV$i3jU5F{fnc>u|ty_Y~48PYxiZ!<yf
z?=5A3<oI6j5om}UzXz0|mx@3$^il)t8QQ{-fniUdZVxB{^u>WQv~G_oC^jI8p$Czn
zb$bvQTDKPzvycp}+Y8UoXFPN*z=?r@sXr8yp>-_~8Cur{9HZb2t!oF06iB~L7rfXC
zlA(1S5E)t*w89BGq@?QtQV$tY(sc#1L3akf)OF`zVBmKFXK7t;aF%9cU`TnP>jM+l
z%GC9RiBEo{>(2>t8hEHl7t+}Q4=?Gqi!w0v>p{|jEhH^~a@p}xUC<S>44{(0@`*0E
z9Rp^6(uI@|kSVeo3{3s0pb#+@WiVi1SfVm59u^FZpkSC54{l+Ba{Z2f(?mgm-Two8
zn)ftm@Ojj13=H;i)8qs}=U1~aFtnbX2D+OEJPx*@dzvE1!(Vwo*K1AF03S0O3LaBs
z_&g2V+?!?qR=~!<;21v5R1`Fx0=^+*niV9A*fB7K%W1I)FfuSr5Ct^@^!c?|WW~Ts
zWkJ_q_RZA--H6Db%nwo##mT_n;;zNC8+=+kC&)EgOuIo#l0oCi-LhItyY)dsP+XY|
zT1?Q}ihLLtmZ@nmtpWQQWXKdw1_qGQHBum@EDQ|CthJcdgPaMv+VZTP7SjfBtbnXP
zwOWhG8>Vw&kWhXBgBFvw2B=NS!oVPxsl^03fLpzf1vJp8#S{!O1=La8;;F?HF2TSw
zF^GkMVRfz+Q=~KlgUT8f1_t9NT1-&_ptV>a&KoVJXfTH>IX8ttiz!xyfx(@P3p5y{
z#gqm%Et-MhNVpbLC-}NnEhg~P9_Uo=iB8})lonIC3S`KUE48SIL5m5JC>TI>qDr|B
z1B2Z?Ehg|Z0chM|;v|R{bd;c806EkU>`+kP>(0<(GK3fhN-W!^YP|$|o`GrNXATC2
zEuLC0RY0EN1-tg8J4hUK>vXQxYq0;=!2Wv!_7RBvM(Zt@4NeMLpOE~+$O>|xJDW8F
zL&ANn)lgd|WkPHLt+bmM1hHkc1HzWIFk8;4YpnxE63CV(TI<2KfU}y`Ca^7R3=E>P
zw6?<3Y^&DV4rYUH2Je}z<pZ;@4Rrg+6D=RmimNKH<RUE-m?UVBCYVplL<$sLAW4pN
zEoG?WWNr=yhLj8~WzfY8lQ<X{%D-tTgN748>|j1EWlfMKkQx&$=+z3KHog}4Y6bY=
z<RJ_U9O<CkZ0@F|4zA0=SNZLJXUKG&k%4Kl8VdtM<RU|+yAa2lGcb5q88V#!NqIpt
z+NTh%w4!1LL#Fc(HD(M9%T^ge(>nvx<P1=Z8#1j?1;schRue)EH^DqH8+>}Y;U-W4
z0jhfqw}3-WfG3&3aGN;jJ{xf3{`5M-$)J*9@>@{`rpdd&i@FV`gH~077rjqD1HL`o
za6ZHbAT{?OB1<76ARp@U8?FT{Fg?lua>R;PhM);;VPR0&&%wZ85M-DK8ff~;!N9Pg
z+b|D&>k7EkFf0X^8jxBRe4P7=R}3)>45#04F@mmDVfgxiVZjFm2Ic}#^*)mqe2*m;
zqoNY1tYKhSCd9z7jLV{!fs0Ym6jX*WFf4OoU|41azK4*DQ4xCi(XuiIhGkjWpos)7
zMnzXppO%4P*-i$AWm~~lU2!ogf_4{9Do@ETVBlg@16>gl%slY~gFI;9ii=TGnt?(4
z1Jgtf@Z=B|Y?zy2*<%KVWtZg{7?#FyG3s(LFwNv;p4iAJ&%m&zf{RgClYwcbEc3(%
z4CO_sWei-5dRz<)IVYGWPGVFjNGW09Vl)Lu2m`}%&=nDKQVb01Yq%Ieqh+Am9hN6C
zFf5OeXJE)`;bQbtWMI&`$vm-(Q3`Z56BlD8q=;o$K97N6`5c!I42wYX>MjgSQ!hhR
z*h4SqT)vWlVfk{_4-AVOAT{<>(DAlRh#I>G)J6x5tfYe+589yz8eswLBCQ1PgkKZ@
zx`7nb8~_bffcBd*Ft~hRSPTl>D-2B2>g5?2gqpb+Gt?OvbpA6<)B#C?4xFoDV45Z@
z#lXNbpNlaYlmKopFf8A}z_5H1gEIru+)A(+Okk3MA%Kf9lb@M^X>Jz-!}7}v49h`%
zlDShE7?yuvU|9Z6nSp8ULgtAd8CX9sEC!EZGcZld0XeD`G>#1(3dw*RC$PAKf$0Zm
zV-F|>AxGcL3;4jWFa|t~HIa)^i=TmM+6!g|rg@1B49ovBFf9KG;^Z(etWaWLSRtj%
zz%;LdX`&A62Zn{v6SAj)&%OmUgdpQB5StdxL9t1ifobmM4-AVofTp1rZ2%oJ%*E)>
z&A>E04CJvR3=AvW85mZ8&T5-`o`GRS8Uw?MB#_5$Lo8ba9o(4?UiuEU4B20co}kz!
z&cLM9_JLuE0cb@K-x4myYE}lO>7XN-lqNGUtf*#SSW(H$z@)T*fnh}(1H%f?fksMe
z85mZ8Wc#HVz*nm-F#ruFECF>6IQW?&Kqi1%nxLyySFB@TSOGeKMR@}Q!-|~@3@f&S
zMwpiPfHqfw_IHA|M}hVmGiHF!`UFMH!VpknlYwalXz3#;^uZgbK-;gtM>Q<m!T{d;
zK0}p}F$<j57&DnB3V`G-!P*ZnFe^qeFwL-n%7X<jKsAAf0YO85nc(w+GZ-Dg(l?-b
zazSYUa=^pF7f>zWLmxl`VVO)5H9*#wg0*~rYFPl%0y(gE(Gmux*-{KlGq!@QJ^}9N
zE;az&BErBl;|5r;krA|^mH7kXN9ZZV+#eX0=z#JR$Q(p|T7fS=fhPPw7c9;MwSyRp
zIpBO<P%&*R0BV>x_Hr?bfadf;wff9PP6md(zFdqVTA)IYlYxOLhKo@IblVlEU6k;J
zi&0dafkAgAxM9J?C=M=DxIi-(T#OPR&J6~C1_s{=T=&36eqfk?fq{Wh0aT#Qx}yd*
z`<@2KXa<HA=NK4P90QGpec`(205X(;VZ}cNh85qyT^g<jAmhF=FsxK#U|6Z34tC08
zkk}0dhLv6n3@csK85pD<aDk`4Kw_y33@ej)G8wp@fJ&zud7z;_uBS2#46b*XCMqa`
zO4}FU!j^$yWeEer$~<)jhJ}l{-YGCJ&AP+DuyO_i!^&xp+JSMOD99HJ8S_g)MJJ!j
z2ZjZE7#J9I7?@^lhkBP2yb)m{BLmZ{hfrxAE=Epa2Buj{JsFs0fzGj*^^bvJ<uV3_
zm5bOJm_SwJ$~_DWD|aw#Vf?_b-~sc*2sY5@DfF<D1tFjdUKyBXLC(Sj7l#WbK(is}
zjA>9q$IVNVfk9_8*JaSEaSlcXrrDw#3=HYMT$eRLY>@XMgF4`r5*KKB1tWN&tDC+*
z14CUi7wC2_P)#=zv_N|bC}QUP*8qjh1VwPY&am<+1H;O@plO6-T%dKbpz2|jFayIX
zUUdeBv%Fk0L2>Yvfnk*y1H&pk@OUHFERfg@28LBJ3=FFxKr;-C3`}$0LLw40=?ONZ
zn1Nwcz7hk&atE$ustgR;xsZb?=ZSp)EqZ5SVBpi^TF%eFG)Ej%LaH+`tZHRoSOq#a
zZ=MkY!>S1k46FJ;#ibq7L@Cw}3^RW~3V=CmpezA72?ms9p(XPy8CcL2Gk_OF&VBoV
zVJ7&>13nL~g~AL>b3ofX=Kf<~ST&o0Vbx5K(VURYUNetCjRu|j4W5F`1XWXvP@`wU
z3P*5R1RYVGxdv1c&s+l<QRSM$%fK|}HuUhwRm&I{RxN>!sLosiS`-9UhO{VX<{HqV
zAgCyOQ4oX=A5rE0z%XkKXbl`AV-_=4sR1~J%v=H&5$<3B<-UzFTpi$M*#`z8P`v<N
z5jR&o4HU^83ZO`4%mPhZ=BaVzg4KblM^F!rD;JyuI6(aou3T-<{26Eyj}ccc_%2fc
z@a1G&#c~V`T5{YU7<?yyR;Yu*9(*dECIiD3Q?4+uiHr<PbJu~53<LL#K^<NNt}ri<
zFvOGyX$A(JX`mFX^B;8YlNFacT;~h0PIquS6Qa}Ije%+I3y4lnkp0s^I<;<UGB6xG
z$_43;GcqvE69emn^v5Bpt>hROv>8FOre{pKK({V|XHDmMgB5DP{Hv?LrQyWDG|wBN
zNeiNh50pkV85qQ`aY?`&H?I|}Qv$RwCjsI(2|EU+d94tgQV5+N+!+`a2FBh1>ttY>
zFT=sWP&7C8hBD|LS~doTit^ZdY77h}k9krH7-FBRGB6%?U}IqL^p6FVQbv!#osig<
zVhjvmwtQslD;V2yU+ilbd)2$xH=LkJUU2s=mQk98fuXS^mQhfgfx)!|Tu#R_f^HpW
z_zH^j%{{TOZu|UZkXK^k!96%O28Ip0VpAj-nC3V0lx8x-rt>f`xMqOYy~KhC5g@ZJ
zvET{QuiycN*cJ5*4AYfk7lT^mx-()^K!K74?l8KRxHB-UQ;FFC_5A`Vu<v6wAbcOQ
z4eWb128Kg=F$ZDZnXeFYPz~y3t%EU#V8OB}D&`274YoPvCg_Htx|p+|a_1{}$Ta30
zn9at(VEroQ9H=k#RRCND#$13-ak?`wY|V{vg1Kli$oDZ$FyD8l#CS?DFfEwOlblq}
z5aTPvz~BTLkvw}e#vf+#$<`R~j^G;*gTVu~kf4Yu=SeOuXNbuVVqkDKgoH<oC$t01
z$H3s!1}b;8BH0-aGMX_k$d$1(f)-wb)*>wcIo#8qoe{LKngMhldR!4Z<2)5moH86|
zWMDXZo}F<j=%!vt1_noVcE%<~2Bw8VEDQ`B`s|Et;D7^nxfR$MyLlKGIMTq8&d%5a
z^|vGggN-mdV+lxG0C;wsov}obfoWj?R|Nw*V+E+Ux16gI#00IISq@r*lf=$g2@;<K
z%4d$deHa+JU$QgCg2RrPfoWkACn%+|Gsc2+z}y_G1a|XjMh1q?o9v9Bt4Y5yOENI%
zWU@0lf^0tyb+jvrqrG@QE3BZ7_C`3muY;Wt)K^?&0(CT_ECbUb6R!N66b5!iHgN_9
zrvw%ThFx>n8M(kQ#Ffdw&d3dBiZU=QQsK%@1^J2>+;!y2Vqj+!fS4`-mC*ppfD^1^
zn<@iC=m+)}j0{YRGB_9*4so-;08KE0dg1O<*k6Fw7Ej{IWMF><wtzvEfkF8w`(2Ro
zrMzH^?t+>fQ01U;ZUzwh5I6f>@XACs28J2O*dKy4?*wU%ZDv0R(tM2rEO8K&VnK^V
z+^4V~1TEBnYCfn9?m)UTFyuM0w}ZnUbci81H?f1xMmE(4mnH1Iu-v4X#XcFFQ$U5@
zp^NMpU`>pmvnC<BGE_k&5C;Q;W)^#<F{s!9Cuer>+K;awUFHVtc5q#wb)H3Y+3mnN
z7oyAF5TOf_IY7Fa9<r;!b*%v{yVGY^lLqBw-rQmab~RN{8U`;CVb_phU@%PvX{u*t
zmxOD21kofZ57q>_jgVauwB8+bzi1%?yEH_X83V&%y=W#-uOF0umUIXeFhn!uDS|YC
zQ%W>b9{9FuaB7QYDi&v8TGGK)lEM(pR3gT};ONT2z|dkJ%~T4C4A2S=?rYIZkU3TG
z1)<SQwICVL@SBlXG*caTG?ImZ!6-7CsR?X=C<D`y3h<~|G*hu01LMJc44`YHmTE;a
z)hol#0dV;4!@#g_b~F=YsE3h(Y3WL^Tb03X6-vo0Vu)r^1|^TLLZE@LXeMP#28KLP
z3e#1HW>Nu7Y8>HYU`S7oW>NtyJ_0$3LqD2H1MDRh1_llDXeM0_kilFfDa8!YOnPAV
zK|HG$1obS)e?}lLfyN~d8b>o3gE%0cryh-F0uNJzI5|AgOm?8OcLOpa#OU7zUc(a2
z1fF2J!IjAn%>-We2pTqAS_usR4M+fpGB7Qj$-=;}EhCx<bR8c9$gzeY(M)czOa~f_
zjAlxOa6x?$hDi)eOLrwRFfbT1?gMp3w!VpGJj4i!NJa*xWuU62Xl^v)A$3rK<z!$8
z>WyYR<N%W91f||+#>1wdgvi3c&|DtP2wL^Y09pa;d^Vc#tOUpa76t~Zf6<H=!Q~Ak
zIWXP^haJ?12B2HS3w}m3z7%C(aQGz3z_bi<|7$ekS$PJ=gNGSFMJtDXG~*R%P$~lP
zbZ0~}UQq%^I=JX?m|4rfV6!utF${F!?VRdpMh}qd&w{6~qZxfbvFHRcc@-qUKv(KP
zmrX9)iz);&-WM_}2D*)1kXM#T9h^fLn3m5LDqxUhQU@m=a8j3LQb#0pStea^kRotW
zkY&;Xd8vtofx+;TER#NrW5XxQWB}vjb;>dsg3`iQaKe{m0;dvC#2H1(G8w~^abJ^V
zvH~k(VPM$4QkKaYmL>SqWtnWi98m_Q<=tT4$TI0dQUoMR$THa?WeN2d(Cw$PjCa9a
z`oNH(!oa|^1k?>#&1F%*Aj^0c>^TO8RofXDR;{-H<q=s%a1jdXb3A8YSash5lviXK
z?}GCR1H)=j28PxA+Mv-hS;l)3pk^xr!)hA_hSi|at@LzR#(UtrBL%84Wf`A<!-#=l
zbt(hH>R5SD9+G8z&cVR6nhP}O2FgaVj4!}mXJA-8mw{pRRE3fh23f`zZVU_#O$-dH
zFEKEzJ|V@xz<o`Y5!Ci#*vY^E8j)Z9M~Z>rps_6DTToctU|?9I!@#gcLyCdHj#-xR
zEvTvl3A!>ctZ|fLU`RbG%Lra-01`}KU|16&#lVomBg^;$oCg^g)^sp1tZ9JuNd3D&
z0SB%nWtrqa7JxG03ds5gS;i-jAP-_-;HYF^T3IRu%80Uz|Dl;}%}EA^HHW1b7z{&X
znHXS#pBNa{d|>^+kktV?6O(~yr8^^I7R$r~Ol+WewX7K+QIPZs5QBkfC3r_D<bao~
zEg&&a<G-{Xbc7JoPU{a0nK7W@A&x1sOmh4TOe>c&GcfJ+W?)$Jmw{o;ZxAP(fnhBN
z1H)Q2(31Am(jOQy3&1)SKy<7E?ND2-%fPT!jDcY-=p5VCmJAGQ^%)q}>asI1t#)Hz
zSnI^Vu+~DHfvI#2ST`tBua#vy%*w#DN`aYysdOg;!`dbWhP4eK&S3_IwG$W^*7iw!
zV91;T>L`IcmU#qpjwwh8bVmf}Wce%(2BuQbA+gL8cQAp6V=_7*J-}69KZA$IKnqwv
zr;I9q#&t60fc($Ev<iF@C}b!oV+~XcJQP#{F=q!<3_Si*!4A@!$pRHS#>ki@!g1b3
zMP9I>VZn_0as~rU4F*OrVX!IzsH$6_P%Z%<0+^`*bGZpflJx^aW(4RgQ3j^f(1A&i
z|FU#Ir?0{a*wxaI0#*;S$T3b&mJzgw2;2)=ohXzFO4$1)8JJdsRuiO{$TIE+O>}+*
zm;17e2Zce~w4f=_xr~7!P7l-|v`O<}U=Y48%Lr=J8a-xYU|Iv3$}5^H%Qyj1R?9L@
zK$O+8j1v)MwJhTdaO0ANfx-E#EaPkmkOAPbT9$D>qO6u>TmjCjQ2Rj_H49&dlxK`v
z!M8z+GBB+Ho$aJMLzZzia(OMwxJVjQ6haDAS;j?3<+c4U6$XYwUt}2rU^UHJ&{|HA
z>jSi)HH~JLEMuSrv~mHtF&O4X>HD&bq2TNXx)bx7EF)+tk>M*>ZZU%_V+>3puTvIu
z);t5a66DaAWsC#+1X40H#)C^2P+_Sc%a{NzJ{K~ACf#HiJGj76k|hd?60S@JS;jn=
znE~@<8Oy~PnAS>xy!{=deTFP!FvQ!U3`}deSQr>i&5&iR0>>w~=Hg0`Wvqv0cRmIN
zoA<E{45uVz8J!qEFt~uOFWmqtde^CGL&`=cB~YL-Fsz-=z_50vHmJiY%jjeS3KRy0
zwZ|A3)*jLZ)x5Hd&PJfXVPIJMjDcb8BPmEkdVvFpfngmB1H(Edkdr_cqJtvG3*t&~
z2Bw`e!8S87FtD-7g0D7M2RiP2=Q0L{b^Htr>p&aJc5Y%|SSQQCunu%4!p?mR4C_Ec
z1nM@B<IY{SfXWOu4TX)Mg^r+u{MVT>Fsw6%p1|$01++VnO#^WP_c})ghIRG~44}N>
z$^gnZpe4wzZ)L&z8`hP9D{5Ir6HwIws;JimL&Me-QVokTFs(~N6@sNJs0z>$WY@*A
zko`&Pc7oRq%Q6ars%FsS>cUJ}MqzOV1_vc*ikAQf6f|9f?lN~>3|gh4zD4#esK>J&
zbeFlVg6vx{P-Vsj4&3)(Eo=-70rO=)fl~n+IJQ57Qwr25P$i+hC7OXDc7iM;H%}&m
z>~C=D0XOhv|AX1El*Y*d+G!}u$P5+*S#RPa`xI<FXpMyPS=py@pnS>3z_59?>~oMR
z@D^6ntFoKHl{e@Pr%N1Q$8DAespJ4VZnHTkiLx;;xP{4X1?z&Cuno)xZ%mT~uXu;e
zT|R4PU@*PPla|RKdkL%t)O|L0lRXSdw>Q8i0tng2P64@W1Lzb0=d-d?R6zEzF)-vW
zk_C@Z-T*HgkevrE6+rrpB4rnVvjH18WiN)52H>?1vWt}%m^SDzfE#Z%E20<}cBIQT
zFn(Z2e*xOF3d#^0nbjB=7G}yeD1su5fni-B1H(FRNZ>ca0>5L8Yzx@Ed7$}N*;a5_
z$uyAz5*G}gr-2MMhSXH)KR{C->7b>dBC_qQ3``rYg6gN83=Hdv85q_Tf;fj67}hl~
zFs!TN{=kp{K8qYY&IdXxm-Pcf`WMiV+YC$_J~1+8aW7_G3b}S&Spqaqk|6-Czre%9
znhXpPI<m>INZM!#iKJvzP@wS?Wh64lW`Z5glTn()AX^~Hz+fB)TIY1oUl!8u`@oP6
z3ZFfou-KHP0aj+G$iQIyfPrD%BnF0cJ!%XL#<OJYv_Q+>7#P-pJhE9GoE99w36+6i
z-5myob+;6YONtp}LC1E1R<W*o$-uDgDI~m{QNxQ7ly(pL2Qe^k<T5aA1Pwsz&X9G0
zlp74|elswv`w6-+0aWj&7l1<(RDKD_f^J9Iqy!4UoeT`1!^PHv&e|zG%)qc-n1Nxv
zAomA`^a@bb52{8vAXmtxLk}O{WCj|4hg>?94!)!c6w-4*fyuzMDHx<<B6z8D`UVE3
zO<5p5Xj&4ol>~I=(o0!0#t#g(pjG_fVb)C_Ac18D3ZDlI4C|E`7}m>yIJ0EU^dW(@
z-jRV}y)`7TETDn4KAC}GeWDB0C<X?mP4__aEHh*+paB57v}}DYgVzTJ+drThAH3e3
ziID*mZ4NQAy5PwEz+m<TG)n=Bw#{u2m*^@%qHTRG1H<}Ch)Z-qg9<ko7}n2WU|2s5
z;u3wBOZG7^tltBPHt>=gkh)V04C_z0K#gZ$VA>2?XR13xRv+fNs|*b5FN4Zga~^Oq
zHDh2%T^_|G4|Wy<(-wK50){9id2rhv+;NFwk_VNJpzarkeiW0cI7ktw+Zx5BCd$BI
z{}Q}PC5lNMoKV3X_9!OMd3oUd7e-=HO#0w@6WlG2Vln~i5oKW7!VfN}qnK174Pr<i
zB#OxZ(Fd`g?Zd#J<`u<w4D32a2Bxi*Am=e213M4gEstV6hUk_@F&+bVH6RXWJPxWS
zAl>pP#^d0w1*jFOAH{eY><e(aAc_$*tOu_C+q$C|AuADC7#Ko)qZluM`~>P`9W;(&
z1Q&TAj)r*@<5dojW5BJ1D8_4GKd~?{EV&TH2%3IlfHcdZ7;l3NxB(vUjbaiPWnkLM
z3h_1LX^5{uLMq_UWPBtE4b6S$qZl7Uid2wvEJXS}SQ^}|h+_Nzk_NfOFeHlc3ycHO
z_#MQ#!5{$E#KeK5i3v0h2AbXh&ACrvVA|RRX>Rg?`tv<eQH<%ZR@OFIPEdm)iZLD0
zMvP)iN3;>67&8!U#3;smL>n=Ru}Fe}X`3v#jTpsPhG-*3G1h?t9l1Z>urP|T7Zi9C
zA=PvgV-Yl+@-Z;j``a-v@K26n1g#X?R>TEb2Oh;J0*X^m-M`Hr8j_;$x_?^|su0Xj
zs0z^K>+*F9jGsZh|8+MN7;iFyZZ{JG6`Bf+Hx)qHkA;CDai0P--ncRu6c{11n@Cl~
zx|<+#i{>gYK9YsBw@eurS{5lVE&^42+ugv4Pl0if6sSqS0t!e4#wC&<m0S>;mWn}b
zGM=Tt2;S8IN+AXM3XEsK(W}6?1C(sOMl&!Rh*4m?2(JDW7>|Pm1)xe+f#Ufq1E{Nz
z`Bi~22$n;(gC-I|jtc^}kXaZQ40bCpMkp~bm~Mw^jRYG6PW%dxhA?QfNi$1<F-3)e
z!K|8vf#G<!0%NW+1A|F43j;$%u>xZ;OwXwW3XCPN3|&#Kz*q_%&IBiM(Co1a1H(jL
z1x8hvdv<^}e}dej3LeY^H>(sFHG~-$j6maZAX^Q<wsIAv7BVO>T7riTp)Lil#rz8L
zW1O!7BRAYk&^BHUeFa8t70?iq5NP~SfstDev^x%J3@_Li(75IC28FkbAfGTYFzwh6
z9=B9@3)aVzoR-d@@E%m`J_V0<DtrX%0=K~wzJq<t1`dng;Glq{0Y*^o=6D0h=<IBT
zhj2H6mN9YYD?C&NIf(-t><`@;n0A0>V+t7*9)pbr^~p@PyE8DXda7`q5!^6m+G!0Q
z?NvAr8@IjqOW{1I2Kvei8dFg?51P~mtr^$MQn&~iFLq~O5dEwG8h-<gtL{vJ`09`X
z)M}$dg+rkF9z2h<bEyJol`&Z1Oo&a}RY0i`JVLCn1Kd4eV_?|1Rspi@5wtFpLrq~N
zC^hdq4KaEp%;=)I3M;J;x>te6m%-Cj(h4)c<p%@PE<SKGMqvg>6KK++xm;leXml8~
zR<&fJ!Ypx+8c^GhLtkNz6v)vGpnx%YY{kH^c(y_>$mU(3wh)KDLN7Qx!7XcriQrTN
zvh6^(LK`^b8JKn@L2LtE#%TnyjYD6d%?xa)0Rw~0XN7v0LeSd2O^+1nLC$&%3EO(m
z<{nVY=_)AHTYxewXpTNzq27ssf#EA?j#l-BLK)bA4-8qL<CVb2u<R}etsd7`DANYp
z!?6A_1H=0J8sHRM=Fh-*sE&bQ0}}(o`aj?U&J@a(Kt?k#Y*1rh*q~s;z_dr~149<*
zs%{33oeGsa%nVF>)EO8ycrY+*0FA8dF=k-ckj%iaArT~F&%m&uhJj%NXdmAmZw7`9
z3m6zS%<^Pl+7r(GfgziPfoVBt%mT-`p^S{_AQ=hBiKpPTeKU*|azSCddoCnBfO5L2
zJ|w1dZNOe~XJFV7p^yrV(cQ-&3R961P8vAjfEM<hid2XIFCt-J+WnY=fnn1lg$Px!
zDFzG-*>4pf^Ti-fLnPh75dfZ&RdCk_g^WNM0|U3NLa+b>C|fPNsbB;Saz@ZqLl8Yi
zU_FpXGXh5%c&Vs@ksW9l9%7cUILItW1cJ`YWB3Ycb9KfmD1g23fgx!I0|N_qCB?x`
zHE_WUI;GWApMhb+IR=IepiN*L`U(p6V7D`Dv|?b`sH6t!MJp(pfb%ND#+wWb8;{#C
zFs)Aez>sVL>fW-yR?q<5PPMv%fnk#!1H&d0W(KC!tqcsCdKefsRe(5?7#KDSFfeRp
z0S%4KXJFVI&A_lZ5X4!-z_7WWfnjqmh_jP{Ve?!DhRriUoMQ|On>RBsY+euIJYZnh
ze42q_^I>TQrd`5dn_0jl1A~Yx<5X4#roEsYpSu(o7&gCVVA%YUoq=hW4g<sHZww5Z
zzc7e1Fs)Jfz>o|+3!eSIEaNNz2Brhq%nVFx%orH9urn}h2AwOl#+iX(iwgt87AtlJ
zrZoW!3|pEQ7`D`bII#>2Tjnw_Y?%t;WHB&oIm5uP1$5=wnsNq)E$<l^w!8+(G&3-O
zhI_U$fjAQwz~^9WH2`tuGB9lQWMJ6p4&tn0VAvYUz_2yA12iDD{R2bl0+8?l28ON4
z3=CW2L7X!T44^Bjx0Zo8*BKbL?qgusx=WmaX=e)9C!pS<uq<P!2m{kT(A}RqOBfio
zUS(j|3Oe>|X9EMn*4GRSTc3mOaqD4V*v87hu=OwK?3gtl7?MjE7$78rgTfva(D_t*
z85p*iGB9j2RAykdI}Vx<6$c%v@_`}w3ut*DhoUTFtRMr^zQdq}B3TR!+kzPwwgrOj
zdIsHGn0y7aMK2k&7nehpF-nwyX}<t71Ni2`ZSf2Y+hU=Y`Xyfh^@bqo5Q84uvKbh*
zWrA;XS@WHNfy0=AX}<@^*MArowv{t5Y%68`z>vxV9t~mI4?YF37(7Cf>H`{MWN-xy
zD1Bf^1$9|l7?}2_vokQQ<z`^m*22KB4Sa@e3J(Lb`78#e{g87(bU=faDWHqxL1Gg@
zBgyp)Cg3yDQ%s;LSAdRAuVtubkOM2ufsC>4KY{32fvz0PVB&xn*1*8DR-S=rKX}&%
zq~ir%;Dc21uzp}jfeud}U<Mge2Of4!xd8Fl0nnf>dl`d?N*#j|sDF~m0P3HBynX<x
z!V;vb9IPu9rpp&3Rw@8;Wa<NOa4;PJF9oWD1koF?UQn_*{edB^26W*KhqEl>d<6!k
z0|%KIn0DS~VAwW~fnnP$5a&4q!?sNf4BOU$lFerZhHWPp7`7d%WMJC)pMilR2$ZWB
z7#OxaWMJ5K7ZPEhHAIOFOb5k55yr^Cu<a)U!?w?^3`}eIJ}{)s03Bq*z;xgjNS2?0
z0d(u_b|KI>K-vOOh=CkmTmb6Xf<p^*urSCcX(u4}Ssl~{DS!lV+8sy~9P|Q-frA)4
z%ngl!v^OC07?=(sb$#Jxg1X8a;DBH{2tEZ8l77-5NdR<!k;wnxDn<sTgKKz`8G@_C
zKog^&W%jdz>jXe++CfJH1@HuCGg>h)q+10?fGUrJ=RkW~OoAaJsUSmEI|uuN40#GN
z#2<8y@KXlR<oo+zCq@RQLmVJsC(tpWpd-RlOoBlzWd`u(GtRHUdLT0oxv?=Y#B&E5
zgF6(Ul`c-f#-MF%pq9fTpI~#Cxc-%3bMPcS_*A4wXHD=qZeN)}XC!6jXsUw_G=lI#
z4{Itzc%Wq*{#U2xgJ|Kk(=)6X7^YsI?h3Yd6X@jXd(&M(c7d7$K{?Z1L96*ehrO$R
zneGK{3o^tpFt`>^w*!R&i@<bEu+9e@3=EYwr)%<oX8$=D7+mb8Yl8O#fI@_?X}UZk
z1Jhv>-u$#QhUxO4#hg2N^Ya*{%Y#<CgLWA$te6fu3kAHV$Dv_5WIqAuK%6Vnl|j2)
zKt3-onyzdHG9P4Sj>vQ|keQ%;L@625#Xy$rWN2Xo-C8l74^(gNjALM!I>X8ebfbzq
zzZGOf6a&-Y-5d-IoYhtmpnwDI|I6#Nl8^$mb2u0n46j*9K&JgcLu6LcAP<9_m$c4G
z2E+!PfwSznl>#^dK+ZU&p%?{n2I%~wyiP^Pc1MuJ8F@utki=Uy(5R&%<dA+)(9MWf
zbYOI6U<i^>ge>o3U^*fM9%WPnts7yu0n(lJSP>LrNBlS#7_{sZ<w3oiN#M{^ln42A
z5-9W(!J#*a2h{FYgoGZb(dyW&C=QB~BP9^c;@~*p1*;MVuL=P*=w#L?@`FNY(gy}N
z(1q(dpfQ*ux75J)@q_JSU;yn3-7d@efx&GG1GDW`2Bsq?85y%c$CE<_^Eew6IsQw5
zGA>5}XsE|+2?Mk3G*HguC<LDfcHkw)XGR95BOiIn7&t&FieVDN0!9Xgq<0)IK(>Dc
z9r3qxJ;xa^=L3TcXpbMbX>yE1BPk_~f#VFw^<NnnK)r?Swi-#L#S9#0KtTW!%VS{J
zo)N^rz$(nZbo7{F83V^Hkjr;6Fl?X5z_7jFn1R{S?E{0&9Z-d1a|cumaa`wRU^?2u
z%)o3J&cLvJ4g<sXSqva`Tpt*089)`7El3#y$9<5xH6V4;3=G?sGcasl3M#Q|-Y_to
z0Nw7#R?NWlAMANh0)v`hvjDWF66^~Gj&qz0Oh@0rOxVQ0uzdsAgcA%*#{(D{vye=%
z122SBj^o(G0!rW?7_31Twt?q5jy-||#3s<Wiy)sJWMJ41x&uJwB*!Lj)?i@R{)~ZP
z`vZ;S!~zD6O`ty0BnE~Z+zbpmSQRrFI3PP)7#Mb_GBE5=R0r*}<p2+K?_^-uVa>p>
z!<_X4gN+QxUkpsg=7ORRa(03ls1&wI06CX|>DWey1X!#ADh6Kp3swwTS<3x^!Db3b
z2BH#_E{Yk!>EK`u$0|k!rsM43yvMOh612OV19Vyf$0}{`-V`ea2KF=#@Yuoe0A6s^
zF9Men5FLv^1;q_;4&Yb>>O_Id4~|8kt*|@6Ie=pcD1+_<rEQBj91~#S2)aiZJS=?T
zE+iZ$fc6T5d>+ieu)|voR2Fbd01b-WU|`tM%)qdt(&Yn#bp!(gLjVKQiS_CX3`dhW
zCWBI3F$2SnO$-b>HpntCUEJ}3!8!-j@MU?xF^!Xf>G%_72BwQA7#Mc!WnkC=It~5e
z6$XYKXBZfEoC2LsdMOI5frWvA<qcTF3DBjmm$Dfcc3fv**m0Gaf$35?1H+Ez3=BJ-
zg2s)(HcSB}NNdn`5eAOwVhl_tykNF`VPM$t0mQk&z_3%9fng`;dR}Jhun!E@OF->9
z5Xr#8F<pRx=|nv<1G9Ao0|V$P-<>+_49wQ03=BK%7#McifMU}+hJoqgLk6Z3lR@!T
z3|^&cJpnps%Ui<0@kgqdLD9im1vDIL!@vag${tXIkmVo89MCE1AaCsSWMJ6o4)w;)
z5C(>wLEuDvdN)Tss9Uu21A|ox0|UbaP(gF*J0vpdr9guf3=BI{85nlPLLvjSAPF?~
zzH=%A!_ID(4-8hILmxsIm`=4qBBKc!89R?KFzh@8jSMUBox&_jI9fRwm`;M`CqR+0
z^E?B?PS9Q%P-N`9$H1`j4lFXP=71(*SvEj4fDXt8`{E@7!_Mb0U;JcX*!dk68CFL?
zkzob8ahQRlO^ku*B<L7>kS(BXVY`^1k+I8^fnk?1s7SGH{=i^$0~8q`l7WSzO@M*v
zR46DirZO<>a$sQCWe19kMGOqP0vH%}`8h-83$5;e3K1)CamB;f3_2<WG-<dint@?g
zB(x1}bqBO68=?l$hTfINz_1Gx$gCe2ta>1^dMXnUt5yea#47Z@U~BLJ{49q!dITAm
zPJs@)1zTLmz_2SHI$LQCK7gO)5R#>B3=F$k7(fTagHndoA8^Vz$I%T-8M|gPFzlKM
z4bxrA7#Maf0jG@p|2gtNDdWZm(DWt)!xd1<IFkWM8F|o@v1=y-!>;v^l#vHIL;VH=
z!>+#!47=Wg%6%mUrZc*bR8a^`6}$Zy7<PL=Q-z%cD2uY1aFlQ|Fr97(MbQZchTWMA
z47))$M1xYr?g|Em-DR*;VP^qK6|4>r4Ld-N&SqfP-ORwSyAi}GXJFVpnSo*VM34qh
z7PSNSCRzPCO2rtMPJ_0agHpuqc?=A@=YXuc!oaY5Ed#^u)u5barvZtR(|@6H!uo;1
zE(R1Q3`}Q~85uK07Beq}T*`u+>54uu*wui#0U%33VQkj`nlfgM=BScqU^){Aau~>!
zI~W*tZv$~at~|`Zu=^kbNb4SOhaj7Q;qWz%Shf!gmZ0|d8Bk!KV}t}YX!9*-QP6IX
zYtKLeI~LRqy1~G(hlPP*_b&}l^MNB4G`2X2fnkp&1H&Femk$h<pxh9^z;yO9BoY#!
zk+3J3fniS~G!iVYfFgk<l_Qyxf$1!0lm`?<d-50<_T)f=XiqHz!=7rG_bjh~B7vn4
zqQMsAqihC-Jsk`Td)h#pat4MyGZ+~5Oao~EMS|rYuni3yDIgp2K!%=RVA!*qfnm==
z5a$X5!=Bp=40~>ZvZamA2L>w<a9$PxRrL@}pc}(%tQZ*fJZE6o^OTu^*~XoLVb3Q9
zhCLrZF=u%K5_4y_Lt~En1B2xcP|PthX5uI#tqj09p`RlYmJ{~;WnkC?T37@s>i2Rm
zFzjUmpCg;{iNlBO1A_(Vl5Oz$?HAM`5#s}`^!G|KFzgkCM2rtKV)lA6FzmI5M2rup
z(%;Fzu(ytZVQ-ns2L_833=9l03{2;@LL$Z=8ZmoUFfi<028|et9pGS-<p|<rU^)jn
zK@Su$dp9#M?A-_rw!McK81^0jg)=DKS?mBuj3z__=>88-nYs5Y1H<0a(1_W4mw{pL
zZIA{~#8^B4+hD-~x*G00JIK%z3=DhUFfi<W2I5>{VA!X?z_3pa95JCE7%cvPBF5qm
zs6z?S)C!7=WCn(PIt&c^v_PB!28Mm+3=I2BLFMHnupSmL$-uzD!&o2-8gp38z_8DW
zfnlEmw7j(V1KO_wF_+04RHQntWnkFn%fPVDn*rRHwpas+;qx;QF>G-MM-0nCYC%f{
za16V1M94ERod@{{6dwB`7#Q|}HZ_7`c^}B>iJ-&59VUHXums=a&JxKHsSk5y9s|R^
z9BAQc=>f{uERjeqtYl!=R}MLCSh9q}n(YIF!x;t!h7+LddvOOOl~_Yl$-X`YhJ8(t
zRALQHCHt;3Fzh=GNhQ{xRC0rXVZS;9!+vQ{`Ps_Abg>kYLhPU^WPbz$!~QU63UOor
z#UJYw4o6M~rVGbGQFelXVSh3M!+y}1EU5h4U&O$$zW@~BpcLZB07@aO3m_VPfD%PE
z1H=AW28R9BAWk_0!~R|dhW*_j4WJa_r~|fPJ%<w~1Jgy&J?o$}xPJx%!~SU?>#i^`
z>|f5nuzx8i7dm`_#L-32O}I>u`)eIFKyk#tbTJuc`RVn6!O;h#3N#7b$H4~PT?KY+
z04Tg!cXPPQGca9T267<CwVN3j_JcA2DE{{EV_?|72h?tNECG!jfR;E+1R3GZz_4u}
zhZ#F)uodJg(02M+9A=;c(Th32jYcz2+p`$dAZ@Vc&;_l{FaE$F1iGJ21r&Riq9C!S
z3(~Tafnon?28R8|l^7T_k8<dXF)-MxfNnJqaZm*JdB9WKUl|zoKVx9n|3nYcu@UM4
zb!@;!vTzvigSr~w3=I3fGcfG`3LZo5)8vo^?HRbi$iQ@|1=6gRl?AoAAkAu7$eHDu
z3=D^!aY%r!YB>T@xelUI0_-w~N(oS-`v!wK1H*pLAkaJ;)1{N(WkW%XL7-uMCy-RY
zvmi#$Ajc)piKz=SgBYEp85piIvoJ864-R7V1U1mVg4Bgo1u+^jGB911<OD5S31T!v
zR%ZcGCkYCUAkY*V(`6H=RjL}G(+wFU85k^!gBYbjMu67ygRGL409gf+Dq0f6C<Kzq
zf|@QQ1(RCC6~xF1l4^xYaYCe285j&&g8qSI=7G;x3Hql1wn-Iq-AT|lki>R~#5ag<
zK}Xen4SEBTxB!uOBM;LdJv#`r#_;k>h{R*KQN>?^&M`7DU18z?d;1*Ra^*)s$3PO&
z5Q$?lU<a!*Fr=Lf+6R&_fk^CwOGHc$+6IyUjeji64B7^lSeO?y9VAfzv3$B5$W=Tk
z3_-KOQ^ugf9MqeFK>ae%T-cRf@OeZ*rEp0#l_1zIyDO_8W`HI}1f4)Sw;TzI2Y1yO
zn6BK1NXA1fC`wId2m;MPfroH{js<1#gSPg7M!pWt2nq(d=m*3P!H|ejWnehEC<ru0
za#au_;R_Frh&@5}j0{Xy{UH+eU<oz`2JQGD`1v!oT|thZGzmLU540*PVh_l^{V72v
zAl;x{F$*(;K!;ddWd=!vn+IuwBpM;cYJ-ghNvv@T0u8rZ1)b!-Ff#~rf%{cv83u->
zHyFUnqSm;9RPA3LBni@f7NT8J78FTHs`f7jrEL~RCB{>X3{2NbAXEGdpF&s|7`&{M
z7%zfHjaV2MHr!NV1T92km=w*xP@u2G_zSd!>4XyF3sB0xA<DpXO@%9|h(U?*h8P0_
zYX|7U#cSp)3=C!IN{lZ-<5pk6LMfp28OlnGuR-1Eqbv*z2PY^ozUKvPY69(RC{bek
z0LuK6z$+_3dcT3zJbVQov=L~k#JCgW%zkiAP-5H(&Vr!)Bl%y6aT7>tJ5*{Dx=$tl
zgM1nos>ImE$iQ@+4XUmSYy>n!K22m`2n+=|s!)j$biz7#t3zI=65}MWFTr!$N{pb(
zR2ja4)?VZVC^5p<fL&J;0*$~aF(!lBXg5IeO8iQUQJ};JD$K5fMond&DKSQYMm53m
zQ}dJ<gW>X^BV<691%tZ#HyA(*fBhYm7#$hS85rEID>3SW96lKyMUdb&6#@r0sN{K~
z#3%()0$Lin$x4Y4GW-Yfw&z79Ms|=CXeG?TOeIEkNl-$78wCo&`R+=L3?MbXph3fc
z9yIgaK}l+pv=V3=`wdxel2ZB#Rt260Y*qTr$^cRlWvldnk%8$3=&<L7nMx19O4t|}
z7RD>R0VgQ1B15J9AVr`dzlE7f`;ioZrmh(#Aw^1*AxKBgY^4Pt9m^m#F97R6Qk63s
zV#hYP9XYj1{U9A@AUgUnbku^(t-r2R2vYSCqN)(A3Sv|%!l)>vct!@Mo1kOS7iKEO
zgB2lL9tAQg$4?1VZrrqi7!?dw#m2xewMGfNp!o(!QRFWrH;_?@5JhfCioo^F4bYJ2
zS|=s&wWc>Of(ns)N|1F~Yzz#^XOuL-sgaF=AtX}?v`7PdzSGniC2g>{C<D{Y4Qvby
zoH<Iykh}yEIRrijM#&0tstafeU!Pye2Am7Q)o#0(5_ppsD5c(f4<33|l7whCXJ8OZ
z3}nh@WMI1G%>o*I3S=q)Sp`~ra*90=vdIg?;k*^d1io|vv_&YdGmxnaG!#0Ct2nig
zA&?1tB>Pvc<cuN^2PE^AA(w&Sm~kLe3dp9f3{1DOplU&RfdMStFe{KL945V32x3$?
zsO1MU3bHDO3v@(YAX6m7TuBB75zRm*UtR{LTcC9{(F}o1pu(ErD_15%AQPwt1}_|w
z;tyo<hnQZ=z~I>w$oQYloPoivEs*gZ$iI-x5Xg8BT%LgPN&LA$#v8m0Ot(QdC@jnj
zWW1pc%1cN|A^sdlot{u2<5`e8(5+A)b!WlqKvIgQ0~wEjq$0psEs*gTTuP!fkZ}V@
z3bbqoq-z6Qiq9aBaWY71HdNPSuoQTWQ6MAaLN1W$?7V@XeW^^hL92m5M)ZKyfuvN{
z1~OKHi~ybS3X-ZsNT~)g7J{TeyKO*Hg>Wg}eSwVGybMft*r66@!=>1c1u~|9q+o%O
zf{@x3$Y=_ZDun7X1xv9oF!)3VGD7BqSQr>wk^>n*OR>R4?fyl9jG)ycU=CM&AfqKH
zHYb6cp6eILs0K1_nGiSuF{*(Fk~tX|Dvt&-s)3f$f(mKYJ%NmBrl0|7kS3=WfsB$M
zO$WJ>^K%#i89|K|2C#X-Hi3*>AgMcCMfv3nfs8zmtUi~Kfx)shkdc*Fm4RVtW#CVc
zn*Tgt?Y|*PR2dj*)dN5AGBDj$;RS2{1X{B*i5INs6KH&Q5-6Wf)(Ct6Qsl`4b}?w@
zCAg(gc{K15Xv`n1NU|^R2uM*L57;Eoat($_5bKV^tt(m|xErKsGQ>L2P&xzDy4{fR
z4OIq)&5Ht8gB0!H1zWcoG(ZfRgW_5f2tHC5yd{>GHE;n)5vXFXJQ}zF)LaI;!?!B1
zi<g1v9s_S$IzwO=sF6L1HwnZ9t=X8w!N4G?64(Xm9)Oi=PYtXEDOZKKs1~%66Y8Q`
z(BU(a7(g3om(L3<;RP|6oC9;fjQr(+X`qm;DG3DS&3p9_$NI{Hq6}1MRR@Ce=1%bR
zQXptAHNy=7o}A($hQLTrKAptC(9OueFt0t(1H}ER%D_;xEl?fgmc0<SsDsUdM20%(
z#LP+Hh3kRfQgbJ$Nf@pXsK^bnkb&vmEr_HtxI6<%F5D0(4U_y1kpwNOWY`I|mn$+*
z3@i(B#Qr&ff?y7)i&3G<2x`LJ2b}@6FjJM$1ha~j_f=)oWn^Hw9}CVBs*Jkeq93W~
zkoN^8+pznpjLIN&kS4z>qcT_>xad`71RqMa6RhsCD!A8hAGG`nWTz0aIuWp!SU}aT
zDx(BEErlId{lLh;^ne*$`>1{ZYXOJ6>L;)caLB8E1F=DKhYRCXe}Xj&@RTvA{s#s6
zBnD7G&AF`l2-J4j$-wjglxY`cs)9DDz+0i9*6ke7Ez_LUs^C`QPEfrzp-J@;Bgp<>
z@GPS$c+u@n(Bh#f-&GHT%>&7Hg8Qbbhe1s#(3b5K6V=0@P9P{D=5?wb1~sE6fu<cj
zrl_s~X;=;M&Kk5(S7l%jJE*!8qym)W7iOw11$!7N%*76ZGV4ND)mb1_-yr790;_@q
z3-}^saPHBJQ*B^mV0vf@QPhB>2((+D0g`G}LD2?FwW{sV5L0DfnEXpM6{H=~<WWsU
z(w+_qZm4!p9}uoR2cezAUllY<{}9sTSM^8I4xX#s398jMi>gL~3YVSWIAUF`>Ie=~
z2BwFgW9b%Vs)DvfqQnvFYKS-8!A=0hk-4&}4k(Tueuu;nC`mJb<LHdKsu<WjMh2!w
zu8=qq1E07DK0HrV3^d#gjUzG8(9I;C%+w+VRXK19;>pY`Vo+5Cvq9tMaTaV$pq9|1
zJR#8Tel{jIP)A{s0H|fl#^ej>NPzbJ#F?=%o&dS%5vV?%ag2@egb*nIvM?~L4P|45
zv=><z7~H3@Ar^aQtzu(R6=Ps}1nR1+^<#r9Z3i_|PO-BwK}rKr2Bt@MSr`~r9%5rW
z2MKA=5@Gw9Y)txKE(-&LrXU-W0hj|`>!>F$$-p2!iH&hLBLmZ8(0%hDTX%z8{uS(S
z#slys`L>g6jO#(ld^sVGTaTn{6GWLQ1H-gzHpV$1?>z>kB9L)&K<OT|N<3^a8{<N7
z#6Zkm0nrr8z_9Qn8)G-)2L>Sv1_p)@(CEw)wk(J(-Jrnv$_P3juWlC`V>c*Lb}}#=
zU}0c5z>vkjQ2mUJu^U`UGiGFgu8(G8>;~QQxsx$nih*IR9~)yY*h&V51F8%R2V_Bl
zp=^wOkceYA;L5;oz#g=5`s6=0#wyT!$W8{PC!paTO+hx$);I=+NnDu>Y>bc%|DYu0
zv4-s%$cIlrCxkD|Wcvorr=W{K6H3{hfV=@3*9PCu_T;BJ14C;T+cTJTX$%YplGGU(
zcviAKhlzDDFdP6Kx_#yf+Y6Z34F-k-SHR~Xv4I*fpat^>zB4c!_^QXi^epQGgOCDf
zpjHS}<?*n+0i8|vteS!0ATtBQLD0=Mpz`XVAOpiee$Xhz!X~f=W-!UXz`zFDBWTFL
zz`d949>^n4K?^DtX0qJ_=R&07gnKV&pO+OU+YPWXD{xW4b_1*oBy-e|?E+XP1R`?*
zA_E#YdBb*`k%8%HE=1xuTw?o0HqeO5Q_%UB3p3gFK_m<r7`7i}+YUBs0YuAoxJ>W@
zwhdsJT@aZK5E)elhV6}Pi$S)$hDa<1ORzC8#1*lD&g|!R0WYFv1FvrX3Ucta7`90u
zqn@!sbW8&40F{}6nrz*S3{1~JxqD$ITQ@|)kbz;F7+W(~3#etcFq5qrBBRQ{u#Jli
zbSKHPK!{m2aEYz|*h)cWWkDoLArhJl46CQG<$#JDP^a_R6wnQ|{%kqmK>-f1qjTgy
zg9jjou2Eq#2if`@w2FCQCYw3f3=Rf{v}<hUps{7pYK~*;*~~!&6KGj>_yacZmV3~0
znS-)y*5E`B+VaQF2JVP~#5D!kKuH$da0^?^20o<$Bz|Zo8~B)pouEa{tP|P5r&~^9
zV0sR^km?jWn<B`GAcbLz*&vMz&?!7S*;HVbgg;;d6&~PAbPvk1fj8lR)MqBKLCPl3
z#mn8B*@PKCFbIO?tZYDe{CU?0#tH^DF|a9epuRmzi9a*wO2p?25#4!n1_qBVf2OC5
z3{1~IfZH1WOi#f%4z7lUfuZS$KNBSLfXckCfBsA#K*iG}5O3WYf2PlhkW=J9w)n~U
zGl33bc>!uwEX?$0x{GQYs5!Fan?KWDMh2!ApljekYW6CDdPbZOoAzphN^D3*0iXT0
z<QsVFfj<*yzcGiKKhs(8*`XlYLA+y<5Zfgg7^ZIYXIcR=7_?pjWbg{`Fc`!v22j48
zx)HJo$)9PJK4=LX1IRs|ss2opLE6qhgJ3e)&72GjAoC~dgUy#@U@-ja&y)*N_XVmh
zR~+hYkh)x5m^$fff2MRs2Bw#w_yIX19of8euz657eF|Y<kj@4<La)Z3DH@~+R7Ha{
zMI&p925SPTGh_8<3IVBWgE}GvoO+>-4KV~c0%rI`1_m=$kS3QRe<nYWrrl6Ye#n~q
z&^5Uffiz9C^k)K{p79cvGCYtqd7x{WW(m@C;JiN*XqfyJsPzf*24t8V>O3cOO$W|{
zHSO_dvSDOkdIj3Q4bo(TY?BR!rad4{hWGrLKqFnRAftT#O!~+HrVkD<SU`j@Fc{tg
zX)<Z{2c6)-^a`}+2V|2vvL<z~Ch+K;KcwP^jlhE9$)p*S<n;OdnKVHwACH35j((9p
zlL8|H(`ycB$SNQkr~oz)WU(%vKO<-i{xzsDSeWV0_zy`P<3F%EB-iTlu`n>qzU0pY
z8h->2K%~d`Gl7;EF-!tg@cvAKkP2Rsfk8jQpAj@z{~EOW7G(4rWTW4p8?7G!a!+WX
zKO-pHzXl!K1=92sDaaY0q6c|sAxM+hLVw0Pj0{X~KqH1AO?Qwr-2rQYxSR1FsNexL
zOwwcg8SjH@UYPeLGBAiO1R2+`!=Ldq$hd4s*fE|)HtsaCaUfU1f`RcIx^WFVz{aid
z2e-A}Kzcd;jJuJI+l_48US!wp!!T|Q$T-6if5wd<*FA!|ZX<HAZUhG_NS(f+KO<-X
z*jv!SSD-)vtpK|U+R4q~=FbQ!W`u=7>Wo|c89^25ThO^KAa$Vof#B*E!_6~P@n@XL
z$iVa#)YJ#5n~7}iOt3mwP=eC63dnHv^ZtyzAWfh?2uM>evZh{iP3qumr*g@kv7C{C
z>75YNhvmqc%F#8cT;fX3C}!|yY!YH%P@c_|my^uk&)5tK%AH(!IT;`h=(H3N2c)bS
z)c4xSm6Mdn;Livutr%{AoGSOgpRoXBE2tj<a%usxtp(_|$~^#SQlIV5m<iGZYAJ#=
zWg=_JMAxJ~8?0%fKO?9}eRmq_Kjb2n5mKabrQ{bd_%p_X4<iNdbM<EgWl;v?oUc9+
zWSoMUKO?B*eGj?>8{~!%WH*GMyFoz>q)F|EKO<-&=sl=!1k&V-tjQN$liClECW!=p
zMo@p}J*bBV(&UD$$qikTL;^^YBELVQFe3xg`}a`a3L|S025W*wpcrxlg3pZw#Th69
z#gQXW92|k*aYKJb(4m2dvGx!K21R~QaoF|GpV0`~=}~21P`&5>osog*!vt{a%>O&s
z37~C9ZvNlFE<j4Ts`q%n>FGDvH9X+t^aq@pc)+RY57;d{c{#-l{(rzu0rxWf|AF%>
z=mvvy|Nme%_#6^{M$poKhDp#EWk-%tUXZb0K}}JG_x_+!jSrwh<QHc8e?W5J2e1P{
zic}B#zXbW>7Q`1XkrcgzD^j@a{|KZA<b;Kp{-C|RSD7JReFRsey3zkKBLmY%J%~w{
zkxaS_R>V`r;19Zkl>t0jrm))|)Uy8w+T^w{)BiY<^5YQY;N*G|>^JbCl>U&C5h+*|
zc7wc-dDb6P*nEU~VX-`@r2=u?VpC8X0o*|LUktkEYbOubRM4hXWzc9#m4^Q^2?nN*
zx1gqi?(@n#3$bn|BqaG57+624GB8BM`ByM9FnyW|@m~dasup5Rg%QG<3effDP-{SY
z55U&sb^6zVqYo05^&pc$4O{mBfAB@DAhzKrf6y_=3_GDtx#|G26OwMakkU;zSTiKu
zfVvk9J0a<&8<uX&-TY^P)O-bvNb#rpXM?*63{0Okf{vc_&jz2x3X+Rd^><?gm2V78
zpFoXX4mW>L?h_W~DM~G7@CV(=syrJsfWms&-w%=S1#|t47#Wy8OF{y|2we4WFfjP0
z`5VEy6du3)jV!?{f>jw9=Cb>%gEWLeG^lGpBS`ImzdC4S7_@xf<Cnj>2S@`O1B1|U
ze@$>`fns+>w?AmQ_VZ+jW=U`}mxF;p?Sa1}Xt*1yS<(uj89Jg38e~ltnW4i7V$_|P
zq0AV=z>qc1fDtsQqs;$-VIJtH$RD6C#Fum6Q}+!RC6z!i$-r<>lY!x&Jov1914hs>
z*2=-m6FUUJXX6_%LM{zqU^tk}z;G~H9&{at0izlR1H)k_rimO<3=FG74H)gAr`I2B
zWMDX0&-#I3UIk>+%NKj_>XQxu)RV*KwLp&N{t^O}1}&ADcLQ{qFay(<Ok}|?49qGw
z7?{4afz~)p<b)pC{SAC=@_ZSnj@d{$=9_?y@Md88vKMryxgS)+*9u0)45o<&pk*=h
z9T=Duqd?|?jxF|QV9<GH&<ajC9~frsU|?XL0}7|_htxn9p%}EvK!a%t1H-|tJW!r8
z=m6(bP$;Q`+H(e-kTl3}@B#zF!87172m?_26*LBM@FN4m!N*GAfCKek!QrL|sy+=s
z{TYTE3=D@<85j;Jt1~c6R5myONev8#EEpIL8K^Tb6e<~jZz<i$z;Gyzf#Fb;Is-#T
zfdTk3W{_Ap1H++wmk$hcK})K97?{3-W|Q(d4X%NP0lzXZ9Gb_#aA+F$2Zp%@pwNPa
z6zItRxu6BR8VpQdUn=A#6)_kva*H!C$!IVz96H3na0s-9j#=T~2L{m5-3$zTaR!|N
z3{2lbm>HNA`4|`uonv4)bOywcVqiFQi-F<L4R!`*MKuP7L(dr)4n4MEU{*Bzz%c6z
zXtfky8LJU5NUb9S!=Yac42OPzIKB)FhuIhy4ufu2VPO2a-~+=P2GAJI9ME8pi@_dN
z2Bz;k%nXcQcQG&=7Gz*J%n#zMWnefg&%kh4mYsp|>v0B#!&(dshc)sU7=I;#4PXY7
z3=9kctnOT_9~kCHFfe{U%E0suv<HsS1ezeeMS#-W90dku)q@O7-|mC9%`tyq{8j==
zA#)rU7=M6vs4<#?60RL1V+Jc&5`3FNF#{u0p9eD+D5hi?m@RuhFwE@$`?A&G6DI@H
zcQ4SgrdbROhpiYG4qJdY%U~RK24>4m3=D_e85j<`f?P0L0+Lg{!%{uSLIcp@_TV%2
zXB$9r%6HKAFHnL5>q!8`Bm>iT(DHY<U;`wleBS^{*~mGC`vb%510WsnxVK_pU^#A(
z1sW~+{t|q1he0v8_YEnJ!3V{#90zR?7F}Qv3C<b}Og~sbWvW4>3g~=mP?_rS-arl}
zw;U`dCkK)PZU5S3pa3=yTn8B_g7XWwo;LuGdVq#sjCLA;X0?UXL>ZWV<bj8s4D`T>
zmW_d-<&}XUq!<Rt_CRFqkz}1AvXBFa4SbPg0w6LBF$@fLk64*Xz)t+YFav({&`&{&
z`~n76rV_Ag85j;nF)$ns0hf2IOjXdVe7K5%;cx}$D2QfOrYg`p<W~lU!>tSqhnu-S
zFwFSF!1PlP6wsg|B!+=ufhsGL3&bWyyBG!rF3@sEX0}L(O)lV5uo)N*?_*#%JVl&=
znJw}Iqdf~K&G0;9Wr`MHU}hC$W?*K^W?(pSkb&XIa&gcV>>n82Z9vO4c|};6ECd*s
zeuI|zgU*FH>c_xv)Qg>gsm6$b;b;y6!_h1d$Bu#FXaxhq(K2NQrW!BMO(h`FFb0OB
z9SjUd+d!No28N?k7#NOD0&(&f7>+JrU^qGtq`r!IViO~X(Z)RS69b4biD@DSNZC9F
zhNJ5k7>=$2aaJ)f96ijyaP(j!=$80xwxH|O85np~8JK>Xg5)nSFdRM4z;N^|h;xU5
z;pklkhNGZ+Xlq_DFdY5Fz;N^(NahOz!!dRShGWdG3{15Q9~eDaK*QJ!Oux3uF)-CK
zf(TyL4~!li49vFE7?^(5fWo@Om;odP+SvsXn*bIw0*ftxs#^jUGi2cY!053CBnIXi
zfY(o!m49IL6aWP}ud~h`P6no5pi4u_S{N9PNii@Sli>cq=qbX$R1Uf>o6!`s#Fo(`
z0AvOO)2}}ubHHa1GJ3>7#C{8a#K8AWFnVM_#Z*9IRSaPJOF&{Eel-IFL(vCD`yC9-
zY%Q!G7~KOHnC7Z8F#V1N$%40pGJ!5^0iAshlFndYn)9E5>31PS8tg#<$ac2heV~G>
zm;t(ptwbLzDFc;U$H<t)QOv;kMTPT^DrhrPi5^&911f(GD*py9uM2jm4M-leow%66
z1ENodfkB#qsW0vWqr(ISMli|1c!ZV7K!Abip8@EKx;zGkV;T$$$5hxEnEEOi7>>Cy
zFdTCMaatJ|js-C=918$(CNeM_OJZO+mY~eQ)HfHJCi_-0FdQplU^rF)QnHnS;aCF$
z!?79==O6>au^9{u$EJbQpM|E$zMISwTS1Al?<q8K_I+fY*a8;$3rVG*>h{<&28Lsc
zKzq~sML#e)%`j$Qwio=s=m^^41|k_4By{sx8JPY&XJ%lw*J5Be2C{7@h$F|qaO@WY
z!?8~i9~d2%fR@cN*fKEn>oG9!`ZF;7ZD(g->epvrI4;4!a9j+;v1VX6uFSx2ToJ@^
zXJ9yPz`$@^N0xyJl**jIm$>jI>NapPF#YvoW?%xPvg1w+496X~KQKC(pr$g%AE1=N
z!1Ol>6ye~F(u__lP_Z(QSOqvmIe`)Zc(WqtIsn!Wj1DUx3F+@LkRptP<Zu9zkpAw1
zNQ2UX;~r34Gcf(Vj+&4_+rb$fPe3KVLlX)jA?boOUxCQ~6Nkzp5|SP$AvwMP$)hAB
zeQ-kR>IKCIC?Pq`U|?YU!^&hNz`)G77<5nRTn2{YK@1GXeb^b8x>hhS94}{JI9>|k
zY++zH-o(IgyaB{Hz`$^P3IoIO3CaviU1uPX-gSe4;rIpyhU1`p-(61_7>@5@U^u=D
zr2GQ|!|@9Y49AawIKLPeK<%aDU)dR$y4e^QPJ}QpoCvZ7-P*~(z?;j!%<vB+qsqW=
zBAJ2VL@bD7$iQ%-fq~&fjVl9Fx9tZ;XV9&zpzE?h=cIPqF)*B%!oYB1k}(5Qx9<l=
z=RFJz5RxH6uS=AHnE|xBsym8-;lz9fh7)s{8JN1$7#L2hVqiG20>mj|U^uazf#Jkf
z5T}lT;lv>Zh7$)^KQKB&<KRE&*i+VWcuohGN6yd)_&);_0p-X!odpy@&JRElz`*o>
z2UH#rK^9>7H=s*_8JPZG1x3=t9!AjZD9k0``*9eZe?TQafRYQSK+0q;IRZ|3E})dR
z6|@+=1av<($eBC9X^WXb45S#m1&`510c1Of&oKd1`jmo>ordHH7tm$Mj4q&kaXfmf
zIT@H4QlPow#90Q06Q{X9FuL@h<_hNsa1LN*00jgSq?~nzl(WnXJs?}EAYn2GWGe$R
z!%|R#-w|pt>jy>`2dKmWkc0svV<yYQ4n{UmIJiK{aAt-pAalyV=D5JjegPE&xv2(Z
z1W3CR)Lf8mrw!n2$IK`TQVGd+;8PVCL6_$;I$Z#1Vqj)82T6kuwuL(1=?+vT0A!>g
z)JWD3j8348GmU|n5quUd#9vN-po%L%>L6}(28S>MGh+`_jQazlvk6EY$SMxFBc&Ob
z+L%8uy37G(ITui?+Ju$KM1X;r36$m9gc%r4++<)lab1~#sZ9=&m)f)#7*0H8U^wxZ
zoq-8-4$p~?3=AjUgE&qM3@83FFr4@e;`lKzoaAO;ILQv;L@_X&RAgW{DJ#psto-@|
zqss|!d!<ErJu3q<Q!X>){`8Y33=AiYKv$--Ffg37XJ9yK3*rbcFr4&eU^wXs3TXKK
z>EOM&&=V3YAQ7_$65LGSNQVSBC{#h!CHDtL*FB&c$U**xoSOhD8~qrV8uC6cx?TV~
zX96pe8R(>!hB^j@lW`0TC&QE(m>N1kRS7!-Q^QmShLa#X5yV-@z;JRo1H;LsAkJC_
zhLf8Z7*1{gadt8=oIK3HaPlCCbCiMM<Shn<lb2)}m>M2@U~~oVA>^H}f0&1XnFVxh
zYr{tdhEtpj45vVo%ME`S7*1I*Fq{HaouI|sr}7yXPJs?`X%t~#IMvR;aH^G=fvHge
zbl@lh!zs{4l13c{hEuB<7)~u`XJBdsY2M4gaB8<Q15=|5s2&9|s+cBn*fKCRwlOg9
zZe(C)*$h$&GVLS-!>QvSnaK<cyr&tMSy(|bQy3UdU14B2b&2%@qZ_EG2xnks22})*
zohgiNZy1<uL1M2#!3oLK?mVDU0aRHqe_#r90i`=on-_8=52M=-2IdbS5_AUWd|n1-
z7SLWc&?V=m?lUl)x(m6I2c!UG<qihqOU^-}>`={!OU^-}3=AyrD|w(*syn1g-LJo%
zlYyB9wD}cOrJj1lz;NmX_XkFISe44eVFWI*+|Gc!0`f)~c()Xz8w2QsN(N>YP&bg7
z>s10MC%a96lwvG*Kq?^~cH02;Fw;a1c!>u}XAeNh5TXtg3ZRR~KuHjEHaFwN><^6g
z8Q|1*ot4QO)S$O#W?;Nn%fN8zKLf+5ub}qd4+h4IT?~E<j92b_V6^`O+R4NFf|bcv
zfSG~u${PlT(<TfIr}fww7_WS1U^pGbz;N1!oq_QxGXulvA_j)jSs)HS1H<X53=F3y
zf;iF)45ybfFq~d0%fNX1{|80~NFaTcd&0`V%qGjsz<7s;f#LKf28PocKpY7MhSPf)
z7*6ljgJf3+&~<SjT?`BYa*nLf?0WhH1H<WKpd8A=z;OC91H<WyAdUb7!|D4B45#mM
ze_(X50rgrzVS$`oLBoNdR*4KKpct6hpnIO6fe7l;+JIUK4mAvnS4}~h!S@k^^E#s;
z1Ncb1Xm(a6C2&8A5!6@)-G|A_qy)P4CP82}BLl+%305Xs0nkQ42G8xROoCvg9~cBd
z8$>||LNK$f3jlZS1i@G3GG;MUFfdq$urmH-{J^lHhk=2+hH(x9v-CT02Byig!9q+7
z4E$`YjQ>GF_NJ17Y4QpN27Wm?2Byht!BKl;?FWXH;7wxux~xo$tPIS&v-}tsk8A@A
z^D;2->&h|hVr6GwJaUAA;q*HOhSRTX85oaTWMJU;W?*Kw1Ib)tU^v6Xz;K3v!IgpW
z$deBYt3hXyu`n>R$AY9^GBBLsXJ9zP4N4tH**`F>25&>;50_(F$H~mVcvO^u;fx9c
z!x<%Z2F9aG3=C%s7#PlglFCti28J`%3=C&1K{7TB3}-wT7|ytWIGzj)XJQx_&P0JY
zVGImsvKbi8q=Pug3=C%)7#PmfNHZ|rzWRY-jR|PjWesR~r+^&O1a1aq4lZT}#@o*r
z7|u*)U^p`o#QDU)aAqC@!<jh}9~jm+fH(Jov@ia^u*L<n{d<iI==^6nrirW!%p74L
z9UB-J&a7f!II{x8*~7qaW-9~3nav>12?mBUhZz{o><5_zIbR)Q7RV_vV6$RC+bQLk
zCJQkzb4&&406FCj1H+kHAP&eW&lwobJOyb_06Rq->XQsm|BgRRj%kW812e}3kZO?D
z&kPJ_K7u$Pt^XJp&inysg=|q4XJ9<v^nqc`60p`%Ii@)R49r~F%nXd@r!X*_<ziqs
z%K_pnWMDWe#=vk^gq?x${5l4PvnmV>XBAjKFsxYtzE+NzQwfx)!L>KT8p!33%$!aj
zF-WBash^<o7Z{jL4H%d?V?gqt)<Y&!HK@8{Sn~ub18(_)N|{VZ^MPT_52y^d=Zh?}
zRsobB8JIc2gFlVnlj<S1LCjoh0F^%lD!Cvs;1(6bS_i1i6AYOU2F9B$49r|CAQyu3
zIryHo3?^_tm|<-OR9*#Lz6R`%wJlJ2Pc(VZ7+gBY5bh5QYiEEIp)0UqWCSZ<5NBXK
z+WdiG?Ho{9$=@o+G@p}!nb#JSBPKF1oV8?NIBN<@(DN7=&IU0sob>{6Rx>c1En#3d
zTL6k!`40?hZ-66qk{nZ-00T2mBPcEn85quXFfg2L0mY>q1H;+53=C&yf;ip`3}-hn
zFq~Z{&A@m*?E}Nw9iRlc7F2cd$T7BZGB9&Xf=mF}aDsv1>@kTC3~LWCFrGgNI#tXp
z^8>>=1_l-|$-uxP$2d`lftfp%nSt4?ih<$mWd??`pwiT=4aVXAz_5;kfib}k6bSHi
zz#z`R3^ofqUco<Kj&YJ812gwpm^lv_7|z}YaX{vPIUsXnVCKNn2HZ^=AYZHlt<&a_
zW1I{!>nBJ%$W8AV7|y;0aX@B)IUutPFwJ89z_9iX1G9Mo12YdV$hnZDy!Hd=mO2Jz
z9$k<aB=La~d<Ih$_$;rre?Xzb`hj6x0w}T>n0dTFgYl45w5|jy76%f8q?~mv42-w>
z7?^nqL3M@)Xhe1$G@WEHdVo8WpsP~XtpSx<>p<55D#$VA@G>y-f>!l`u1h`pmx19d
zXxlpIx>V4@f^%%3yHnRPFq{)*U^pi%4Y@9L-5SttRImw<>r$C{Kv&0tu1h_q#K3S4
zblnB$y3}*}3=HQ$LnRFB4j^5Zn!(fvD)K%stX%^2;o3C}j7N7cF!Snwf&$#0U|4qp
zcHb^k_39T4%nBP>KQOHR!oYZECId5X0!THuGGyWaALq7)1rp4>#h{LY3uw@HjRNSL
z8U|+Gc2Gv;0M(=nYYZ3|@BV;j2923ZGccC(eqdP114@7^LF1qttV}GR8tbGS17o=q
zh)|dKz_3z)fk{h+L7IWFME?WBN)gab^Oc}AryQ(ItRUq-<QN!BY(Ru3NVx=9xi|w;
zclQT|l`;%$3=I6MS((^a8JPKRfjY}G7#PkuFfg360d<y_fYmTCa4<0QS%YL(GBBJA
zVPH5H1UmArd)o(wb)d6?7#NuOqCnES85qu`GBBJ=WYA+^>c0MgVLb~dV%LKX#F?Y}
zh!fO9e!{?Tu8M)-Tm?wO2L^_7Z43<OT0opX3=HR{Ffg2(z|O$b!@<CC4rJR>Sq7#a
z;SUV!T|iAT{(ZU^IT@Jwr!q4z^(ZhfoZG{|aBdffqr<>(?l=R(xuYPC1p~vmOAHL>
zE+{iF^|&xi<d9`x>JtGQ!pgwFe^z%l$iK0m!7oJyhI5Y@7|wz2pX}3RU^vgrz;GVa
z(C@QkU^vgmz;GUPXhfeY1H*Yq28Q#X+cx_G85qv1Ffg1~;{L#}J^)nef+7yw#$>8z
z0HuBo2XMi;zJY;hW+MYLe>p+{=$y?D4C^N_Fb9CIE{13;V{l?%n(4y`?k6#<=V4&H
z8^^%R4;lt!0_DI=aEFv(y#gqiFfj8U0vQNNmFp3`Mh8%WDg{NqI0IArz7Gs5b-<za
zh?R+*m4R7s7CQq|`)LM-^F|B|=k;tEnA&eJFz|n6U>1-B$=qdNIPb>5aNY$JyX~((
zFs$DKN{bB40u~_Y4-5?F!$I4rL6<~#@O@xde*zr4p!QFP9wRp>dOM^U7|!P~Fq{Vs
zV|S=CFr2SoU^ovtL9)Y`f#G}`1H<_yb_S*ndj^K{^BEY<PnTt2>hSu&uz>^QPyt50
zUz`lgf}jHoIzU$KV_-PHhnaz?BbkBW{7D9e^Ppn@I`SD9&R=6-IDbi*fvKY!61`o{
zU_)3L7zBj%o`O7U0~(SFU|={8ayMvvxGRQ%;er4I!v#K&Oa=o3XvOXYNf4)mf#HG%
z1H%Os5T}8G;erhV!v!nu4-6YbP@}gF9=#w*7f|$qVgekAtjr%6mL@<V{sJTd1@l3&
z$PxGi5`luv5D8F;xE?fU2)f>w5pr=eD7T9<Ff}gzz_1dW>IF1dnK)P(m_-6XUB3+s
z3>SPD7%sTEGB7pn1*>6TkYHdIybF>&#K3SNoq^#(D(J}3#?K!>N7XViFbE_oGfv@U
zU=}fDW?*V!WMH^Z!N72#gq?w@iI0KdLO%n;g>Dc>nt|cM3I>J?pgVY*Kp}FSf#JeM
zaR#O)vkwd#&VUYB5SXCMSkB47Ec_T`lm`RDh0hEO7v6(7p$rTcxfmEOvVn|BVqmza
z&A@O`7R1SCV7QpZz;H1E#HnFmxY)tKaIwyofvKsJfk9vg1G6w_W}&Hzf#Kp728N3p
zq#2khg+DNC3;<Pj8$ox#^C&Zh3NkPYgDxxp^-3?EVPLp;3eqbDsbc}FM(&k@MA_h?
zdOY3?%yv&<e0Z<am4T^g`Ui$hpmwSb1G6xwTxy!Zz;N+41H;AZAm=V-V7U03f#KqJ
zX$GdU*bfYw3P8zz6X-?-4rN9+Nd{(N(1AW>Squ!91Q{4E@pFG**i^#6RJICI<b&dP
zQv$3L3mQse{lKu%1Ja2V?gh=|fjY4g9~d?kfK;)5VA#X~>bWv73xkYc0*@FmY;u8$
z9R?X|4$kVJ4l={02_OlCpaQtA-T)Z^VEw?bVF?4%sqYNT!rwqMlHke64Lcy|Q-lkY
z3?a8KZ8!l*nj&&gF_1SlFfcW3hVY>lGI%pEHD36@uo2Wz10AQ^c$I<Sk~{;$C23G6
zi>cP_1H;M;P%BU187mVPD+9Cme0Bz=+F%BTOJ)oVmyB!~m}(Ok7zDmBFpGeS`r1?m
zhD%-y43|7W6BV`7J}_*00S@373=E7S`i%Cx49w!7i;ZiSFfd$-WMH@y4l-{e1H&bd
z&ScOG(>{>MX$FQ%#S9FW@<AduKq5~W7%p`%FkEVpW?-uQ_<><FxIMQSRH*UjGYYaY
zFpD}fGceWuV_>*6n}OjH=%A=NE(V56D;O9qfsW*;6Jubww1t7;(kAW?44c7`0*WpN
zFBMQ|fX1i9p(cY*uM%X?XA}dOIvZx{eg=k1dzl%Sz^0yIV7PP&!~vOlgMs1FHIS(~
z(AZ<;abjZtxA!6DGTXfVz_1y7j*lRZKBE-K+*iyD%(iR{440lWFkE^F;s`S^Tn1s#
zq@&GG28PS>3=EfLLFW2E%!S;)A<n>5r~H9o^Ab=oD=4AQsKd#?EOrOv7y|}|%UTQ!
zmo-2f8wQ5UrVI?1jX@j_28PQH3=Eg;lo^=nLLlXAg9_LbRt5$^b^ULw49sFnm>HNF
z3>g?M2Qn~R_5^Wk85k}XGB8}u2XQ<Z7%tZ^FkG$zaY7jwF1Ir<Tm}u1H6$`HT%N?h
zaCrjAwHr{&*;;rx%ld&~^Bqt*%fKwQ50nzYWi2RAfV92ASB-9Z14-p#UqSkiO5sg^
zAW2=E6Cwd>m2DOQg%<;}IH>E#XbFyA6R?B=RKgmR#Xy74OyG$fhRvX1=5PjPaet60
zkW93>2C6s%Sux0^Ge8o^gKyvwc~EYuE&jl;8FcCpC^ywsFfd$Rz`$^M4g;u~t(^IR
zVPylT5M0>+T2aBu#LWsS8y9_GSh)h+HeA8Lz<5H3(TSCTS^5?;15@P&28PSq85k~u
zMi49aGB8}e%D`~>B0B?9<tYY+%kLN%F24a~2OY2pTws!cp+JXGjg^5}5_AYottA7)
zWl&Q3ZVVpsXIQxhlpj}uE_LV8@n&UUmWYH7`Cs8+V7S7@{efZS5$KRVbIA&42GFr}
zW#u0jR)SAuUI{vtnMcPLq;V2VqZk9j6%mleJ1~u0pewmqKY*@$2c7rHEU_LGtQ?>=
z4Qnw&DT5LyGFC!I<Rw6-KZ3@aGLhsyfQHW*m?c1Co}eN7OwMA45(XtMxt}s1y{kYI
zaa$RfCAnd71C#$H11h6eiGcLOErm&*kOB8os;_=vSS109iB+J3Oh4!_YH%_zOM|MT
z>SqiLSJW67t|+lHFjaqIV7Ow>z;MM@j)AHApBw{I4QTDkD$vaCGzMnLdQciDW~hSr
zXBB8d7bFat3}h{4D2EDz+H@e{wGh>1P+`zK2uSz{L>L+<t3Y$xAdfu&c?>jlz>2T{
zG(Q5810Vaw0bVqNum+TZw=ytGNr8PG23k>5%mA|tH0uqL1W$f&faWd`VZ918oidGq
zSqjwIMY632GSefK3UMIJJD`ajkZRE6KP$q96;Rcn)h|e9LnbzvrNBcVpawN4l3@V`
znN(wzIty}g1E{=23O2~38ne_ZkR+(B2GR-g5BCR#RiI&VP&11ORJed7K*7i0$G}v1
z?E}MV1qM)=X0O9&1Zu}tK4D<E;={mj1$5|T<wpjFE8z?bS3;E;m@5A<P2><~V5*)D
z)&#nTBT$D?6qNly=e<=gVPLqD!N71Ofti7+dIJN)l@11mE1;v}s`oH3T$#+kaAhJ$
z<^%)7m3a&dSLSekU|6k#TKIwbj~PrHkiNj`07&5{y&L2w<ic-t0?xt@l$=+BR#$|B
zW(SKK4uD2i%@`PX->@=12eH30Fv~~@rKY4XurfZEVqjoA3f=+2%J>|-j1_d8LscOw
z<8r84Sxcze<#JH98+NfWE;j}(sAFMZ*y72`xK@IJX<`ry1H<ZER>t+x3=AruYd+7Z
zvodY~Ew2I{Bw_r9m2o3zRnAVX%%VaDRz}d7&)_2hjGwSFZidK!j$dVEgq$18!oa|m
z&dLZ{3k+5kC&kJLIv9pwCs%Q4E(0qgXdNY3#;1}MdSeU=1B1W;R>s?)MRYer8JK0h
zfN!K>Wn2qd?v%wK%D^nk&ceW;I+2xeC#b1C2`nTP&%m%$i<J?yzmM@L_|zJGepbeZ
z;GHCpJxNgBQw9c5@EkhA$_P4RfZ+xMvuvsm#MyH}8#X~pa6!(V3pz$}5=gD{d{#zV
zXi&<5E|LTVyR8y5C^_6%8Ewr$LCML$uw)M_qaCP#0qv(&=VfKI1FaVYoru6;!pdl8
z%)r0^lBwxqWwZmW4ZguuoSM$S%IE+NJr)LrDh*afM+pXIxkMHQhSsyJjNtpkc5;;%
z8Z)pmI>VG*{Kd-X4dP7V$}31_U}f|HadvX$6=X25GWx<e#SE;Beh?05p(87!KPTw;
zT+q=v?yQX9UHzbqxSFA?jMajm#jGq04D8CRjBQ{J=t>dxdOHRNr)8{+GK>t&a-hY+
zj^V6~GLR*!b_@)T0j!{9@yv3doe>}@VL4DxfVLF}MYA$8fpmdRxd2Hqfu*>TQW6<h
z8Cm5Rm{J-*n}x$!86n$n7z`O0>IGOq8&sL)1vnTO#D!SD$uKa<^>ctu!e;%Z4%%YK
z0a^{p`pphx4P==d18DnDy#PqN9WU!iMn(o^`Be~QC#6BkI2ah*!&y&)4paEb16l~r
z3cj%lw1_!_ffamV6^LETzzV*vY9|jkOhJeAfEGG~g7h*t5P9+niWyk1fZ1#e40b}S
z*F->ei83(DgATpX=Vt}ohs$`B0kncypPv=9wTtm6c)v17nIQv%YBy^E$axC#5a$&r
zgPg|(PR>Q(e8$GWP_~*Cd|fwafi};4)-telJjDei46NXzTR`GV`B*E!QOU-@u<9La
zB{;r7mS#L)?cfEaGRSE%@vMQMggc3mfms2xn%Oa&H4wa=kd1-i;xE=vBs=55_OLN9
z@XTjT0J9->f^JI%?~Yu`#|qkZ$p|{aZt4?O&^8W64v?Ly6Iml5SrK%8z{ESOULZTa
zg6!M~@u!yx$e*C|>;jgsnuB&KfBnFa09y6x0Gb6-_@|gun#RCt!wHID28JuE7#Oas
zfJ83%wxEC|+#eVcet@o405#yjD?Z&B7<6~B>VgdeEpY{{)n37>3p&&ZwDa9DoK;r`
zWGhc51FHeZKj6!J)^276-P|rL3|e{&(V_+lFOZg|Kdfq?GoL1bmMk7mW&z)q1X{E$
z2s+jz2jo)4qZS~SvM_Q>GB7CfGca7)$-r=BvjXVQ8x}_BJ_v>@mlznXoKpZDL&d_#
z2VIkW<pl%7l_%UE7z8aqYh6Lr0cif#hk;?;UKU11(4u&LMh0fZcS6MsER2jIpzJ7=
z3}S*dYJjiOS<}Gs4Xo}1sQ<;l0NSU`tQ0hf5p=^c%Qt?IlNhr!ii?sNSiUKO3}9fm
z%D}*I<%b5?f!}l)7#MXJ7_J&KFkIDEOkrU80d?HfWCn(-(Vz&DvSoR~2s)YY1A_+W
z^ymnXx0SAGq%g2N;RlH`FkGF-z;LxsqnLr^i5%$i7zT!`e;639et=l=L<3^UHG2kz
zYo^>E7&O*^hNT%9vp{!QKu&*WWXuF{Am`OGGG>4{643i~bQu^jBUw%{GB7JM^QJJc
zoDu-p%3I99a!MX#8!y-^r$Cwc2FSr|n^{2hoZyiU3^PFcb3rF0GAkFPr5G}>EQg#+
zn3Yxx;(#5?m<e&_a?tGrIt&cgDj68A6@$WJKQt_^Eo5N0HdC>ff#m>9<O&1BwKJgo
z^ZkJ=vl&6tvx_(w7@VfD%oYSWj)Q?A*^XtlGQxSY4Zwk*%fMiv#L@xs3uvFWz8Xsh
zXlpO%B#k|*Svq8)n!T5>bbw|AK;rScSvsr{26cFX4YFcjIP#sPj*Su2)Zi^BDPmv&
zb#4WZ@Pba)WvP<`ZR+I!)fg;wT3{Xi3=Gn7EalLs6aY2iLAQ%Bt0birGq9Ay0w$S(
zr5toy_gBVDjXVaHa(S?3hU?4>4A=gH4)$2JlO+vgE9j;peKnRea23hHz_4dEOB(3d
z!Xv!N3@mA&gLig9VkXT5Y=kZYgQGZ0I7lm~n%7rj2}kmJIN0kTt>NIKVIW$=4Z&Ld
z85nXaSs;bT2L=JqDs*s4SC!NN#iJKEYcMcemu6tNF04^(#J~b7Uqq`J7_R#<FkE*7
zr3x2c78`IW^npPDbgVVRfE=&^HX@+#Wnj48$iQ&D5^R8t3RGwd1H<(-ppdWuZD7`6
zV7UI0f#Lc?&=TzW02V#4k)Z6$!NB0)$)X4L5--SAdf?dSU|?WVV$lQbvEIoGa+#hT
z$Y9<)1{OVVObYO%Ft8YcN}R9YldOy1vM4ixeEoqzzy~ym0m^Qwzd&)M4E85umSO<|
zi#oV~XJEJ?!N71s1mr=*)hx0g*G&4r5ch_Gfk6YLQLQx%Ts+Bw^9*BF8aS`Wf(o@8
zjF~nJ%xbM*<xC6=?6X+pL5JC@O=V!Xp~Jv%LxY)tS#2Q$!wn|}h8uPu&RPbB8(|C#
zH-gw1nALVNFx<#vV7QS6;v8mRxG|A|;YK$DgF6Gm$!-=Quu~YA)h=)_FzkNDA_Pk&
z%^z5V6hX-x62n5EW0G$0WHPXbf{NrDJfMakix{{X0_|_#y^tAnz!|eT=#uS)naoW2
z;Eg++puIQDO!?rQJDdy*9>18G^1)koSU_8Mn3)Q}Ca{1u1TixefsF<k7yFKxDV33d
zSsiq01jx8l*j9M82h2>Vpkf`=90M7b>I5n;p~is@4*)kzebbnkGT_E}iZL@qfs9)W
z-UG<Y6r~K>R>TRhHVSk?(^shLq8vfSf!rXsoS7*IqzPmb$PGc@Gt8ixf<Vb1rYXo8
ztjUgn!TSU=lQ$y+vj%80B*+ooplJb^I&Te_I`yT@OwJ&6pcVWeb<W7@oZ;#OBbb@2
zLFzzlK9D+VQ0o?Ep0ys#JRuHdCPR=q(Aha4#~P|2`Opv)doWFg-~a>pu!@ZtwCkH$
z1F|!inMqv^NfT)66$4C@x((PSa|VW7A!g8>smvOX{glj1^5D&F&|r}V74I-j@>VcS
zyM&pU#2FcwH9@;7LCzD0g(WBo#r0w87B(<5@qyHVHUopC_$0wnk_-&eHq4BFKvJMa
z^1@7J#y{X)fFOT3FfxO>SIn9XLMaT)jL$_uSyu>@g_s$igE}Oj4cB>{%#1HVDdH=r
zl^|Zm4BBJO0BR-lf%5MJP&U+Z)&>>D%#5c6L0OxD;RYxxEw@O^En#40Jgp3N3&V{I
z3=B8UOkq?gE-7MQX1oBcY;JsDV7T!L()eNcm%_jxUMA1L&|AmMcvX^tLFpRPL=Jfd
zhBMC0jNqL`(M%IX6hJKvX2x4k6K=9IFx+Hi{lL&y16dEDWdv$%lz@ku`_?cp>wvFC
z0-dZG!@ywumzi+~DEof>z|aEnLJQanKP({5+93dHRWLBz6k}kxDFF4?4jG8QZrU<1
z+%$#yYX>A1G2F~xV7Qqyg%Rp%&;jJguHFYK{E%FI2<GZe28NsM+#eWPmLOaRZ74w6
z2B4|Ai6IOOu?!6E-OP-u89y)xfU+>SUegZ9VqnNx#mu-`nt?%S9b;BNG6OT?YBkU?
z6pWctkPuue#lWl`z`$^G3IoGU@BtgTGng6IDlsr?hk{$_O4s-p7?fsIFfe2uV`iMn
z_<^Ab6eOTCKbW=mLp?ebTre{*++57SaC0u$qoC-R0reOM_Xmci3aB4I2QddLK)nHL
z{A4gqi~%2|nt7O+v7V8ES^I|&ByH4-gVM$nMixj6_kxWS;7Tq9rI2P>kV>#Sg|t61
zGBDI0U}nq%^(S<+q5AWLA^Jgkhe2*C1RZ}8%>X*!XWDY+&x{`!>J%6lSimc^3~baG
z7<M`_e+CB_1H;YZ3=B69YJeT`8IqM4ZoXk)xcNd2?3&Lu3=9m>3=Fr77#MD`DHby@
ze}&dcw>~m3+<L57n#{lqKCkR61H)}i28P?}TNxP`xYZSt8JK_Yfg*x|;kGXW!);^5
zJO<|fq9CU-Fx=kFz;Jt^6azzpATuKa$irV57(j;|+yNbUw62JmkrAr*P6GqO9ne;w
zy^_p~tk53Eouv#6cjhaAnnBEr(je_G85r)IW?;CpUy6Z&Q=OSnhL?eXQIdfHbnw=l
zKP(IkJ+91*vS8cA8JG=hJ}}g+0gbD37cnz(3NbM2rZY1z8~8FX-1TQ*xa$jA0b&sG
zfuUgrSWz7_qrD&lvtBkxQ7Qw&-Dn1eyOAJHAp^tRGzNydDWJV*ZeR_dD`LBtpNcRr
z>u&J`-x~yy(*VnHFfedWV}1^jy8x22WPsiT)Bs*i(EwUb!NU9!BoEr8XDQ9Va2I4n
zK4>tsp@4ze;64Mho+Kz|mx4CJ`7qUiC=W&hu!0%}W@C^7W2gegOePL1u*@8&R?wbL
zCUmXb9~c@|fV3jCfvy$+1ytP!hDHU@3Lfr7%#6Xj49t38K;G_VV7Ob)z;L%3#F@^(
zaCb5T!`*%mXE6iA-CYa}ch`Y9>lqmCK4W0G`v}C@&A@Q?7X!oHZ|n@r2FDl}?g=q4
z+~WdqE-^6Nb7Nq*=fM4ep|JwhA@vNPp<HI;-5(elSAfQ}8$nkU=rA+J^D;2&TQM^*
z8=qicxEII3a4!bLxx&D3FPnkkUOLFE3kb6yrZjwDXavtxHG(#zsW3ApgG^Zf(%8$u
zaIc<$;a;sL1GDi=b_QnS#S9Gh`WP7Qb$Bx{8?OWFWMGg1$*gB!xVM~v;oeeEu4h2D
z1QgiyDIgIBX8kRY@C1v^fQo?@z=Ce9WBtHT{{<@c2%-)&f58FT>cP;!!oX~FhJjiC
z8$<?VLc<A26dHi%|4PAg)(v+cCK!NMfq}*#!K>9k@%aKI1JMmOw}JsYIB;qLGw5Dl
zhOeL)iQr9UV15h9Q-%x-R@TgqK?REeXbbsHC+5eBph6XVY&Y{`8_>DnpwX5K8q8P0
zsz4`@>~vzjDi2l#&Wl&IK_g8Z3=9q8%vV7R8ozQdFsv(LzUlxf2zWtd#Z_O>-Dx}}
zxdjZ&*I}a>d7aFlh7!Y9P?;6k!+enO0|P&(<oN)qmW&D^W!6DZRk)6U;oc4ghI<>p
zcN8!mR0Y|{z;N#g1H-)sYG9iWf?F&M4ELEC81DTC+j<au8!+n!2L1|2C>q9r!lne2
zd3-<%>zMjHAj_~B_!lrR8x=Az8#X{yFlMrpGWe*1Dk8`g0{k1GDi*_4u$D4#zED9@
zasaC27>bfN$Vx6imAphz@&Q@N1BenM9uy^Ckd=IZD$z$#@&ieU00UG>5Q>sNFeP3e
z7z9*6O3-@i8O(hiY~WhtpcV5LP>g^&KHyr!2z2SoPABFq;J9aCxG%-Pa9<1(BU?cI
zpc@Pf_bnM1?i*`>;(QA@DKIeH4`N`r?^pDJf!_j@Izf?beu#My;|B)52nGg*9iYfI
zZh%BK=pt~Xbqoymiy0X1XG4r$1gh9M7#Qx)WMH^IH4oJ5VP49`z_7xNX(ESW3Ip>p
zXtUz}ZU%<?n`Ifm#RlIQQ2E86!VKCLVGP<90V*->-)CUBe-o7PuP`v&|Ifg1|2y{w
z27VTh!$8AL6JyvI7$iP0@J(P~E>Zw7_AoFPX@PQp>0f5hp=`{?psN9QIx$a@0_T8Y
z2IfiN)(}rwF$41yuu}whk{Ot%L8~%D28QrA%pIW2V+_qa9pW&p9gus?q8J!f2QZg{
zf&>(3;BgI;5J-@ef)z6`JdkH#cp$Bj%)nf#0?Jnm3=eD=7#>)tGcW|@FxT-gFq@<@
zFgyrnV0aK(^MQfS2Q6YVc^5N-t_`wU!Qi3dp~k?_%m~tA0&)tdAODnrkAc}FB#MDS
zqmwzA@dLxrFR)Ik$s>qUlI1{(85kabEJ_49B^i|UpE58!XkuV^P-nxyZ1M=Kk%fUl
zbPaPRXnDKIdj^IFa~T*O%=Y@gaEyb2(Z8ROF$>)>pb!pBWcCLIlgTeo3FQw7zsZaY
z4C#){7L1_f>Z`q&wLvOOH8{ZS8EsjRgFvdaK|>)=8R8fi8dotZGe$5l6rNCb76o-j
zKQJVMTJ+$CotdZ_1B1Anx-+QLaf5;3!EOeI2cV0iTF<IGgVw`?#NIM6Ja`N~Q9#`V
zG;4H(f#IPD1H(fBSq5e^(GLuXpn-k{_O0qJf(*>2=RwOj)fgBag0KpRW5mGl5QGi5
zKQJVkK-Y9KPvih^{F=za2D$}{+06a}L!tvHjj|t6cL#OP%>o!09y&2FJhTBB62rjo
zFrI<oVWigwhD0BjA$<@-`ap(&MqoL0)g8c|1ZlAcjibw{JAg)LKm#$YXVo1*2Q%LQ
zsg&HNZVOkL2~lYaI@1HH(iW8Pz$%6N)j?;L3myTP2^vWjms7U_^<AMVt-xJ#kePZj
z)Xm{$f^I4jms2+fhb(w}O5Ge1q7e)XHh0tw!74v6#Dg+DxI8geQv>y#)Il9j(3uPm
z8yFZKmO%pE2o~_m85kZeX8phrp8~$;mDyYboKHE}Kvzk|S1>S}JA(wk7q(b4FdUht
zt_QXVBmr@S9%#Jn27@&Nga00NZJ1;NL{b~<F_7eTL3It7WGzHe19aX9SZ8Ubx++X^
z7DQ4NA{oKJ(E3JQ2`u@6As)0JLjqKynLmYiP6?D)ZZI%B+|9u7aJ$zBhWHR@WP(OQ
zVci7KszFeQ9`Lh~1`TW9U}j*pU<OyhHqs`rO4#s)m_BGo(n6Itk3mddnSntdkvD@u
zOy81$*+LaGha-?}$iN`@QA`D_EDEGdMGmA4bn~j8n2IR_gFqS^1A|edn3@Dg9GvfZ
z#iYRMyFlut!0I7tWWZ|J7#J%3#6Uw!0%;&eI(dtUfP0Z3M=k?7Ktzp!*<u;k0d1NL
z4CnrGN`ZU<+U9F<l^1k14W|^S`vz(lXn*3A0;Nju>9&H~IK^QqEx8~n#X-ktf8|X{
zEo0ym2UROydDHS3IK@E;^ef2z{E3_*ph2fe%nZzy8sJ-KI7L9g3^sE2FHX>jZVX^q
zH;AktD6YV=O-7s?aJ?xISq_LS=zQsu1=`hM_kb?P6)Vw>WMp7UX$4=EyYZQJC|HWw
zkb!~6O4~&QWc_{)1_oXwZ5NR5cJdadmN00$n1im);Ylq_W6*X54Ih9lR@|?x2QsVy
zr0cF014AsEwy_EW1NTx;;^XO^$pt!WxtM|3@&|7j!%Qv%P|*cCp~jod%!`qM*$Q&|
zgP9ljOm_~@SeTg?_(WNdBKEgtE+9o_pm~l=GZ*mK7f8bPnwc#~0&+=;nXLk7xCSKA
z7-VJ+lE{GQfSlY3N)1M*&9p(O!3uQv?7~blZ84A*4hDvb!)Dr`lU%_E|IB$Y>n1qO
zGca4N;w{c+n03<}G)oFPJ2=6ghjAk)bgV#gX<BwXj2l6N);EMetwkQjjiBLp4h9tl
zh6#Z@jI&^|VGSDp;;iOjoTUL8jNyVPo(&%D11X-ofQNA^C;~uv!&;XUbSnZ6<5W!~
z#nV8ceFNl#h+rPZUXT;4!=MU#RY3s?bpq%ZH-;M^QzwM-Ft);-06KyV<b+o67%|id
zZEz=?KE}h?0CEB-VOwv2n%tm@<OI;PDZ@?%2L^`8OL!Q;Y3arX1~bt77r0ok{;v&j
zcr{oT1H(g5*>DBispWy3-U|}=%)s#QW6=i&vk%~F`BWGfmRa#ImVqvW=3r)Ew$Xvw
zT?RG<>QK;>AtMLK`-dO$FcyKlZv(mm1LUJ3@W?FG`$eD{ViHJU%3mJFJg~w#sEK*V
z3iCkOZzpIJCL)}NF-znFg9YeNBMndiXLB9ulPs_f28KsW3=9wdSU}<pbP_VCOn;=p
z!0<?c`vZeT4rqrzv`qq;4PsybP0P=E%EOo<0%9?%^Drigm@+UJ#_}*mf?Q<_Its~n
z77t@2sKF09Cq!3)hcVKCfnhN#CupLWhcVI$JOygXz+ilzhtUbFE1Z*o0i??b)KG%y
za?%6MI6`$ffsSy#!Ek{wGcSjM(F7EyHyD_0K@+ebjV7QO|0;%0jG1}m3_OhBE3$Wj
zmcT#_R)@%gv?nnzN`li5Xh{-OT2c{w5x6M>L;W8fMsBd1K*u;{2=Op-gW4jXRRSP;
zxb?sa4H+0DIC=hp)Y-9cFfe2Y@%#mq2B1kI<5@g^LGu$;puD-5gXcY1l@>(Rdypzn
zwQM|#=RI7Na5c|euqr3sWCotQpqap@3`-e{@{1UF&VfUV*)E%dfnjbq&pFV9Bgg>J
z{XFMD9Vlb4!W;&kV^D=_z|&4V$G{4Ci}FEI;IbBciWkpuaF%0ZU{LtUa~yPJ3%Chk
zV8OE*9Hz_+%yw6JD;RiIgIx+fQ-)_P8>lk~D#^KC@w9*>ib3i=3-BZtG4Qm3dZxt;
z44{Ue?oXZw5oQppPMXII$`asF5CN6J-6~8mAaB}(Znl{Gh$%)Blq@(H7*4h_#n>}2
zFcgEVn83gk0n0Y_!Mqg=OcBc9&Z8y+!+|s=aFGrwQS9?Ua-pDuyTM-Yf6NpF@&YKU
z+joQHf<SWMvfN<_lRw<d<sdnKxS1uJn0!F`z-Ar>$@zfvfz2!|V)6vZfz7-RlJf+~
z?PQ2xV2H?Oas`|Dfx#72%8G#Un1hN&1p|{S#Bhd3jtmTsY`s1(xEe4pJFH`5%bd)T
zHJODK+^%N;RU@KKOrT5SK`UJx>_O%`fy@WnZC%J@53}1L8YE{Ak^|q)FmDEv4cKl_
z76nP!Ky1`xV3_)r$r7Xu<Q<1eAUR8rHn5R1)S1jcav<+GtOLoJf#ks6IW&g}lxr9{
zJ}~fsI*{NljiXr_sB~abR{+HT)cHJ_3{0Sg7h@DpJ_C~mXc<qGECaKn8CWN1LkbU*
z77qinqXaVpv!go$!=qRRhDXtI49t$fpc@mx3c>fyGDt9K^LT<3K_o%Z-@2bk0^~-J
z`yCU&X_*OpV;$(Ch4gkN8BpFe2B~zN$Rr951dug#5S5~ks!EfA!Eq0h5Zs(O5LqE`
z^BJUfLmCr5NEQ?lj=LbT{2<w#42}%Uj&&bEO(O;d0Z^PeUaewacI;=&0!cZPePA#H
zZOZ^hx07TQ1G7UrV;1N>N;9ww6PRRR5MZ(b^%21S&tPD9lm_*pBdFN<z~BmM9D$Cc
zXLc&CVqmsC%$NmQb9{k;;ZY?6!=plHsInZ;MZ>N+ppG4^U^>je@Mt*$!=t4z4O<u(
z9&KO%xz2Xl2L?A#%LZcdR*(vi(whtnkIwpm%EJ!~ZW*9O+HB@LjFLi7`NuL0438y1
zCNN!B`@rA^8r}pisc?2=W?;H*!NBm?l7Zo|sWSsa{sG8QZVwn37)(Hycfr(zF)%z1
z5@%qlwEMu|_5d^@%jT@a7{|lF>?{XbKI_N8@VJnH;c-4_W#Dx;up(9l1~z|?B9I{w
z3=EI!7#JQ`F@W5{7~cMY!5wt5;tWtUxG*v^Fow@$V0gTjf#ES|hiv#V28PF<85kbF
z7H43L5Ckh`Vqjn^lVB<YS-Ogufe}=8JW*j_c%qQcz!+ipfx&$N$nhYOfklETK^3%p
z5^T{8aImyWFy)IdFgxD?S+<OU;fVzU!xIw_XC?!~lLQ8aCs7Qn9~j*CFffL1VPJOt
z02-`;>=trA!@w8;I?E3<LdD?7z!;M8fx!b*^j3h~U&PG77*fT+@T8T2;Yl@!)6T%~
z<PZbHlO0tIj3HAPGuRmzLl!bHJo(GO@Z{@fMyLs(_)?HyUcloCQUxNaKtwxK^;3BU
zhNrUN01NK>z~BLzlK%p-(A9&PfiZXi1H)4T28O2^AkJC_hNlS(3{N9KoLvkIPbV-i
zJndj-U<^La!0>br1H;p8AkGyAhNrg~7@l4Paqh!7n;01wgZmg5*d{Xn6lY*|HS`1-
z4<gorh+QDX#~B!&u`@6{V+L`qFfcq*WMFtE4&vNrV0ae5!0^n4`vZe#3dn1q@lNm&
z6`)1mpk<XFZ!m=&8JJ9iJ}`JrU|?WM0Qt%-gqeZKG@gOsSr-GtvpNtbn}Olk69$H7
z*E|`ROv~9Bm`s})7@j*aFgyqCtTXLrV0d1_!0<fJmVwE1CIbW80tRN+J0NBA7#N;U
zWng&T4dSd|V0iwXf#LaU?hg#!1`JH5{~%Gz$d*2tC1WxR`%-qDrK~zi3=AN1wlXlV
zZDL?{(*SAR#=!7`kAdL@7l?C!f#HQY1H%hr)(;HcQy7@cHZw50fzAQ~B@2+*FF;}t
zv%#}|UJ{s=F)wA+VFVqZx0D@3yD)(^E<nS=8?-S{1{@aKLEevNV0aPE!0;jv#K~r0
zc+tqf@S++V7IL7l01^FO9~gW%7?@o>P%9yr=Rj4GxDF^0G0j!~z~BpNZQTJ`;SSml
zI2YufwG0d|K$i*6bz)$6ag~AL#YJWYrn!C$3@<)0FuZu?%D^-?>H~u>==2&924;5-
zIR>V=(V*RmU;{yitT6b3(q;iyE@%@V$jp}}3=A)gK*l&RFuZhRV0a0-6?(281H;QW
z28NeW-cU2a+StM7F}!SMV0c;1`hmfB3240y1G78$=o|3XYew+VmA*Sb5}*JEkF<l9
zvO|ub0OiR7<qr&gA`A=+;K^VQ5oQL)0s{tySGo)guQXj57z=DZF!+JWW(@{r_bcoS
zj0KJi46i&H7+$$E=rJ&YwHJU&5I@i+B?IxLyf70Y85mxLdowT=_<dl2NP=|xGcdf$
zWng%f4Jp!6q&_hC!wYDSW6TVUDLM=cuNoN`UV(~)6iWt%S4$ZfUd@+dU`%myW?%&C
z@BrE9?*Up$BF=aZblf9Y*GUG3SBF7HfONfOV0iVM9i)qa;WaM<!)tEV4-Eb>p!Ho0
z%pPmdr#V4`8PHZe_Xh_59LPnwS*(I*8ZMN9b~Ay7f*e6RD?TvzH!v_TfD19ta8Scf
zkb&W~A_K!~aS%tAf#G!w1H<beW2oXKV8?<^g5u$MFT%j=X%A8c(ld>L;Wen2ZwJz|
znStT;dXUvCK#dq^KLawn0?roxZ?K3vGBB>a`+*@4)XHc8rB5$sW(LN!uNfF#UtnN(
zeFDV!!NBl_m4V^)-+Ttf%^yB61j>NsqXI$Acoq>xGfr`+8K99L2DZy0j0TJh%wC}V
z>L7F8STHcWF@l+s%E0g@9#nBEeqaa$^`scs?u#&5a)K&OeFla%lNcD@^nf@v3=D79
zGBCVZ3F3G%FuXa;!0=`-_Xmc+3Q)BR8u0?(FAN$43$$TiT*rpuV`%I^A_TOd+X$2w
z8P|G#U<d@A`WFN8tG6M@S>X%}Z$Msr2jZkKFuYY^V0bG9;^Z?hyp3mIcpJKe5$f|6
za3%a&gfSNEYmjN6cwu1sE&@6poY`9pq%WL-;q4R#hPM+y9FU1C85rI!1#v(oo?u{j
zd#I9uacvC)13Mc#1LN9S28Orq7#Q9@^ZLLLxC81JX2?h<C|SW*1VG1(jaM)@s8}h2
z+Atp&0*^2-uB!#<ya9>_P{4qP0zom`^MN50)YJjDJ-l~-Tri7);hhNs!#mK~rJ%?R
zZ2(1PC@4WPh%g3$y#>-X0aSalCyFroFfuTEuY+mLV_<lf;q`$bbP3d%pwa-mz7dkr
zKtXK+o<IoQ0g5MZBP#p@Ll`Kpfdk!#8x*4%3=Hq4F)+OAkp^ue{J;>F0!ri{l7WQ>
z)E#B^VT7qW#K7?G07KCShA`08(kh@*C)nl#Ll`LJ!Aoj=e5x22gQFR<K=ooN1H-%X
z3=Hp1gE&nL4DTK?Fuc1T$iNt!!2lxtzzJb`)dz-fP@+EqN(jEn%nXdvdl(qreP>{J
z_nMu7ar!a_hW9264DXEs85pO}WT<3doW7BPfxQMKw~2w_y)y&Dds`4^KLf-2BnF1}
zF{~dL!ehY4f-w7R2Sr0k1L)W<hVTiXqJV+f=Mq#9R8K=@)WYXLrJjSOCP37$fe89?
zfCW21gXSEi4Dt@{D)Ne;YCU`pNC8-~0VK&%%wPyg42}$p|JHwC2nV&M!BxBO0cHlq
ze+L;D-ZwHZysuPdVElI*eC`(Gzvm1L@0Tzzyq_1y!1(W+7|87pK&3nbvu`cP<cTpL
zlR=T2!RQ8RpoM>7VEp%$f!P-{`Ns&_o5Re-$N`%91MTxj2OS~6{edBZ15`XB3}Bil
z21*fb;4pvn=L16oXeb(-9R19g85m#lF)+M8%)sz|r!oWMYYm9wUW3B@7X!olFM$k<
zucaATKQKhtFfjWnGcfys4}P1-;RJFuqZ=qRA{rQ&m>z?66M+w~HDF{+XEb1B>hobV
z0NKi9@$~~kB&crj0mZc65oZR7P!A}<MS@zx3M!0BjLr;9NBll8MD~ETO@W0aR2Vf_
znHiXlL^Cja5M*HZ06OR4NIC<<2RR0Y4>GJD7$QO2R<<%Q`>h65jvW1<h~+2%IVuu#
zG$?oj54av>;wS`VCr1XR2f-g0B0;;;z$XIv+cPsTJ*Z(|_@KwY@IfPxf$2ek2#8Dp
z1$iXsG^uF}%>K+E-+_)CWr&2H<>oI2s!<?9pi|toGBEptXF@qvfh54yb|h$z8ECH-
zG$0;+|G*FhYKMSZ|Nb|a8JIxVLw*QhVEEtz;wUgMd}v}|_yF2g{78p^;lo-6h7YUR
z8JHefFfe@B!NBlgTOb3|BN5OZu_(~?Uy!X!!EOWjyqFQ>=%@;CwrBPS9cao_%m|uG
zi~=91%Kd>M3KlG&gp~=B1!d-6hd(exU0`5fcmRr_0B>dn#$Q(%7(N_jVEAxQnSt@w
zd!~sTAo>r}L=9yI#^0Pw6HV9|7=Mc~FnoB-!0_Q=AOqvCN1$+zE@5CyTmf>D0mw<9
zq?y4qQ3G_c%S01!qA&y}isS4b7-B^j7#KXjR$gOfU^*_s!0_P<1H*?mAdUh9!$(;L
zhL4~_6pmXkFnk1I6Ltos<IW5WAHx|KJ_ZIdFdYXSV95|`z`%6kE(3D_c=s`Q?<Q!j
z3sf`3hA=RlV}#E3N$IR`T*1Kg|GyOIa4Kja%`{W@14A5q@p&NVD1e#v3=AI|7#Kc+
zHlogqWMKF>mx1Bqban=&nQ06RA9pb@eB1)!6f-b<yv4xq@j@WzKn4!bTy@+D=7|xY
zs*tIq9%Ku6I@ghb$#}*Gh6Ip@!RapW9y0@z@d^fpPYetUAOEm3Fc}|UVE81@!0-ul
zx`Oc;28K^&3=E$@9yY$g!0^eLf#H)qNZCgQhEJgk44;An8JLW>fFe9Whk?oX9|LpX
zMwAK|ER_J6u?jp2${!_+3^gAZ62Qv~zzs?8X%QK)mbmox4-8Em3=E76pePAG!OXxU
zeUyRWQwjsar#KMj5(C4heg=k5&Fl<J()Sq{K3!m7_;gB{fl2xexZGfp{=vZT=`#bv
zr;n}-OrZSP1Uf%Qf`K^*bjqg;7X!m*Mh1pY|3SwMfNcY%IR@@^{LDKT8JL6CgDg49
z!0?%uf#EYZh;xa7;j=OW!)JLpkc}YX4T$(r2{ImZEt?zzlMI*F2Zp8>49wb~!`(p#
zc7Fo(P{kP-zlncfXnF%`FmRvYXTHM9z#P1WnSt?}Ap^r_2L^`EHXx221H<PC28Pce
zAdU(H!{-tPhR+4;42<8r85lmVU|{$>4|>RW(;Ltp+9uHQX9fXQ8Biu{7GMA!GR_<f
zS_Z=i-T~Y!16r`nz#I(P0StBxcoTiI1?X&X2IgSUf#2ZLo6#0}zW65(aJ~Q)nI53H
zVEw?*>;g3e6jxwFd_bA2IR#`0D0874Q2xmWWB?O*O^F8+hX=T^*|Y{!n}DJnlm}r)
zD{6r<ALGjt9~hcJ-5PM+8`8|o!1(eO1H<R13=E&|Dl;&?{K7O*ft`Wz6(a+~7f}X=
zFPzE@jIa2ZCUOKaFur^ast=kMFfhJ$VqgxD2V0>4DrK5)fFc3p{3npgA_O!q%7mya
zSU)hdh=3{!2Ii1_kUnr$W#RxI_+tnvBfx&}f%Yp~EI{TlGG>88U=7&m{t_P;+Cj}$
zaBn9R)Y|h`WnlQ?#K7<c6rcV^3=Ch=85q7KJ2NnX6@&XW?V$Q6MS^8I8#4nVSVJoV
z!<R-72c%&p1H+f8Ad?#y7^4hXKQOd!09nnz911ErK-PZ|07XFi1&}b*MPEQCO*k?z
zuIT^3(EfyhfdxE(7QI%EfpNtg5U~<OY!Qd3=m3o=GjQJ$Vaj7;V2)m_3{u5BaRMVd
z1LKO73=Cg(F))1D1QOi>-ZRR$GW-KW2M;*){t#g*XJufHP*i4MT$#!|u>+)OWf23z
zm%9uMUv7g$>meod${yy4)4;MIFMVTR`0|XMfpO&$28OTp3=Ch5Z5bF>9${eM5oBNv
zO9JUT3UUJL2Zl~?+m(Si6tw*vBnGO*%s^#G7Xt&cmNNr$m;@-sz=;X8ZV7TW{+AbE
zB@zsbtClh_hk;lALX;FUfRaR)1_R^T9_|keT|OXFu$k}&ns~uy<gMKJfuR%BJ@8;)
z4toW1;5LwBKo0BxHLe+$!={59Hxn2^)eGdXi_Rq=vl*DfKqtO3L9FL!fab0*Hz4T>
z<j&4LP<Mj%K0_6P3c?Iff|K~b(0K&pT9C>P6^P1k&}rY`_^$y42<S=xP|can2(I}%
z9H6Q|yPm<SAP3+wftp<4c90?1un?#+(81qeWlKPY*~3*q49j3(T<gie91hy|42olr
z8c-R*2s*=;p`(I<$><^jbNGB%@>>EM>R>il0j>r+ra<iht^ESqvjt%WC=?)V-i|F$
zWuVo6U}Y!3%D_%N0dYhGsKo<HN}y1N2NCxNhK>&)1>h){29APaMn=XA(7HkfTL#7z
z2N@W6R2Y~e(m@IN5Yt2s)(;F_DUg_p2tY(XhXW`(b=81e0u~j3nIg`>xbn&ehE5&O
zx)dHG5vEpF2IeRpP*QjV3KdXte$T-0HJgFqYi2$J(;>GH44pBcE>tJzR2CKy#{UA+
zkRi6t46rb0v{6QciJ6muIZ_KWq7=`-@U@zO;cF#`12U(df#GW}h*QqM@O3c*!`FqN
z5vFDk(a-&Xp|geoX_$$7i4JHsmf`>J0}QYjVC8aPSOFT=@?kWBq~kvy7`i|utO)~i
zWHHF`kORvZS8*{geBI2z@O3RHWO^VW6A7vmAnB3O1DtKvfP4UokWLdw<sR7ujrNb=
z8!S3~K+(X!90_Xpf`SFq)Zl7h1|=zQHPm&0f$2yI19RklQ1Eg@gUsqW0~Nar7K;Ik
z-GGXLIzUVuv7l(_<^b6a8&-q*7qr>}yl4@$2uhlP$#C5VhVBYb6COk|q=+z0<YZuu
z1|5oIxSN6D>lp@yub}fw439G~e7(cK@D+4onBipxhOaLf7`{F=W?(XW`+=dm1Jv5@
z28C3J%w$#u=4cUS1}4K_3=Cg?GcbGw9m{4U#K7>4n}OjQXsf*u8v_IA7TIs2><mms
zatsWhO@`kzWf_=2d;hw@2mkUo$h3pf%mGl0N-!{dvu9xVW()FccMoKTLKOJ?XO0PA
zu?3)dl7Ttu3n)+^6%u3&mtz7rFgAd8NrL5AKt~=he_;FyUckuF0Ip}d!Mh$nb+QR~
zWo)MeBxa&Pbswng0_81Fc)WCrK;knR)>!!}0Ct51R2O*Y4_t(S8VMPYa;7@~stL4g
z4U}WQs(_uA0uqL%i?5JQe+LT#<BE$6jtoqCWgi&2e=smGfbRccj#Xx6VA5-6VE7iq
z!0^oj#F@{)@U4%5;ad}kvzme7+c5@)Z=l0*^tLlFeEY?~@a+vd1C!oC28QoO3=H3O
zK%BD-4Bzt^7{2FzVPs&^o6HDaMXvFIp~nD}5<nya1HU^z19J>$PnV@71H<=v28Qpo
zV0Bzzb<ALrfq{kJU5|k|CJnS0MVf)(dp85a_fAk)^r$c}N3UgIjsYM14DP;x{hZ?j
zvXYsL5gg7vA&^2p2GY#|pY2e>P|P3$E%(1RFfyitn&Mz1OQ4FMf+G@BaSf<=ge-0D
z*#l7<3qJ1!Y(2<Mn6VY0kngzzQUfy!d`ryN8c_R$Nwf6>Ll0;;I|I~+j#Fi3VA7n<
z!0>%81H*UFz_aEO28Qn^7#O~TQm5ud28Qon85q95Rc2t)+{ZMLLz;m}PwoRlF9#@F
z^n%J61AfL3RtDxcP`=Q!W?=Xs#lY}G0u*KX3=BVX7#M!2fjI6A3_rXX7=E~VGBD`{
zgGAyP7=C0kF#N~_#T$rG#=!8Sg!KbMuLvZ3V}F7?08VS*@a<rPY>kDCBOwBt`vXI-
z3B<n;pZ0)jY|wUMkdzGrlU5qUByb35{P@7o3km`7U{kz2C<M3|7=E-fF#M<oal{!I
zer#f3_^}G)X+v<Ml1USEEFqKbu@4M=3?Q%ffqLr({ERuQ49xMMBiM8wGcf$P$-waA
zI>>MA3=BV>Gcf#k%FMu|d!2#d$9D#XA0I)S_Y4d_#TXcV3V1Rw>4Hu!*Ar%7_-V$#
z@Y4jeMTrOE^*C^5C(7%6I>=t11M)hkJJ0=rq0a=(=MV3GV3+|~S_mFqi3gpj^Y9e|
z!%tTRhM)GJ?H0Ws7-qCEuz^Vi1`}0Vknb8n8DJIz!_OoJhMx%_&N2pup9KsIKl7m1
z2K{VeVEEYpO2;#D7?}O-8JOc|gGv<xC(vL3qZKGc&S(J1fNJYv(CL7WL>R3=vBB7S
z_5;HXP>%p~yA^X@uN(to>n(8xrXwH0;-D??$3$8FaWXI`@Uwnk*s%aK<juew51J}s
zaqw1=2N_ukF6nlFPGA9@5dyC5{TLu-gL-%jLN`QNzJZ#Zt+yB$e$HfI_}MScz&Kgt
z1H+CTpcbsKjVLSV2<3zYatw@<K?gfe)`v6>b{v5;YZ5@m-hz_hHx5{(3TxKvxWT|U
z*_MGh0aW^dT3?w=6FESB-q{0^067q}xlEjaak}OQh8;h^7J7-Yva>QUCxT`jrkndQ
zFit-QmSbaJ5RMaNs$d0;H{M}j_<5Lt;pcu3=Ov6I&A>S0+y{o8;ETg|f)+wVh=NX^
zW=_m!W?-BF(ggD54G;&U3Cv;rz_2p_5_XAJpxjUfY8|l%E@&tKMcmF9s2q4345)FM
z$y8<m_Cy9q22_ai)c^ngkC8ExxePQ94RZ4L4-7kJfZ9RAMWRgBp!33Kure_Ge8#}=
z^9jgyAsB}NbebAt_wo-6yTE&9gzH3E1vnX)GlQ8K7`t~eF#P<%!0__}I|F0)F$RWT
zatsW=BtV?Y3=F^Q85n+<yD~6#KLG1yVBle3PW%IseagV_E0KZWS3Ia`*OSY@AbgmC
zIZce6fw3o#f#FvL1H-R85T}xX;nxxdhF|kQoHhoAUm!d7fjE;H7=FEHVE6@^#pzkV
zzyKOB`YiyGS<Ari+l+zXw*iQ=i-F;H1OvnG0BHthOScaUdqAT=V3L7Bl=-6;19MU@
zC}V^(F#Mj%!0>xAXo|Zx{{zEba4S*xizxFSc?RZWV`c`%-bMz7--{U-e$NMS`WP5~
z?_^;3y_KDTv3E8D!|$^U48Kp?GBEb8U|<koVqi`N-6z(&l7Zp(4F-na*Feg)F);jo
z%)s#bA&7IBf#LTL28Q3?K%5H<41a_e82$)we_+^a0~&JzCB6nGaQ4`Hgn{W8=;(Mx
z8&F#oG~;i}z}Rz~fkA|ifjJe_59>L>!0<<#f#HuL$k$gH82)rJF#M?maUL-+{AFTb
z_yY>~p7#t4e@z$|{(?^W?)k&O@VA74;cpSh1)K~Ff9n|-{?>{!F!q{$VAu<4+%kw5
ziLx*VF)$~;0{PjUf#Git1H<1A5GRCz;qO8QhQD(`x)T`~{%&Dl_`8Yq1H;}H2BtF^
z49v+7K(6KZ4{CPqod7;;78E>U3=ATU49qF3K>EZP82%n)VEDTi#8F{j_<NIq;qPUT
zAs-;81*U+vc!KW^VXEW+CHQ?TP#ITHW`N4@fMs-`GVw?<;6~8?7f_i>BpDHqp8Y?d
zGN8ksz?UXvGF3`|vd;kykPMP~8E{sZc<=+mz7L?RBN8skVk*JFoI0JEfpOwx28MsE
z3=IE3D=#MAV_*PX-26`*B=eeq;h#DK!#`zq2F8g$7#RN9GBErDovuC!q~4!_;h(Q7
z1LGv24-5xD{eBh(=2TEDP7-He_!q^%@Gk<CNhYZ>Fo<L@FsItEGcZolVqo}}!2sG-
z%ld&~KM%;E49uwkpfm$H?{~ir1Jea{2IkZph!`Vd28-Z_|IT19TR_z}K;%H4-R}cZ
z58;Di4V1=MKQQbIVPKqS$H1Hl>I{GmCkBbtFfdM-#lV~jZvQueQ|SI42F6~{m3K^#
zqrf@;Lnh>zbr_lZ_S7>qfv-$p*ed}_$PCPBtngrEbbwk1O86=ajMMZWQlOOsjNP9Z
z7(_}Km@~~mg$5|-Y8e>*fm1ao=q58T{OgBi>|I|#J+fV(T^%f<%;(e@nA5=Rzi<YI
zf6Eyd{w)Pf^YjQXFn|twWb6@SVEDJ0f#KgqP!5q}VEDI>f#KgC5J#JV;onIHhJVLF
z918}9e>WKz{#_SmV4URffnm1}=tN18HKNS7c^Q~9elRmIP6}gS`1g!~;ol<=Cz*la
z-(LoXe?LK-0tSZvA`A@wLB;E&S_X#yrVI@KLGzN6x)>P#hcPhx4+2HzbOwh1<qQn}
zi$R<v3=ID#Ffjb@0&zAnF#KQ3!0>-1h_jD@;r}THhW`gZoYM>p|Nk>E{QnH%fQ}<K
zW?*E{2XUS<Ffv3kFfxRTGcYb*4|Xyu1B1v>QDy;t2IlnB%nXc+4=^w?WHT@_q=Pu1
ztwfCsj10AM42+9!=s|St$pE#wK_r8Os1IloeKAPgR0c+d$skQ26BaTsGR$WOX<}ex
zSi```unOEko%HDg!*0;2oG}c{8KBz%CVggLWZ1{R$N&o8$)Hi-lMIXu$5}rx>|Ov#
zi5Z}=5OC7TWGV;UJH)Vi3n)D@FlQKmk^?AFfn-2Qh4Vis4evex)#-&S4@$|quYhzS
zi-L4P)AMc*sJ2EV1>i>i?i7$V2Ih=~$TA?U4G{SXs7~<tXHW-0WO|@FZ=>sk<c&RG
zub|6u{s(8AJuc9U!#q)g4V3*L9mHx-f7pY0DJQ7s?*OL3`KX40k-2Y2JyR{H5$nys
z*yH|zVGnq40+d>P7#JC@F)%V*0vA-RzdkVR3IH7^CvsVoRfLs+IU6)f+{VGc$nchd
zk>Mpf17n*g10y3710y5o=<e=Zum*N8$-rPE%Ca9+(O(Bu^q}MKco`TOxj`ARhk=n%
zf`O3{R9|<`WME`eWng4f<o>|0D+E+DfV>JiUe=a@u}z7ALF6L?b9R+717n*y(?kgn
zZ2}(CXKZt1U}OYgdpQQiHb0Paq8S(&Ll_tt13;V%21Z6uC#gW1fm!?S2Zmi|z*+nZ
z0|Nt(D9c%12Ij0*W(H;*9tK9nNeqmP6QmiK?I7w{z^WM-SeO|rSs9qKs<$yRFx!KC
zb_Uc)-UTv)g~x&gR5k6o!N3@E6O^cStzls7_hw+u0u6*Qm4fb=Wtu1fme~Q70e1;Y
zLHpoAEk)K347(06Fm{zNFlT`e0)+JQ4nRxDtcReWfS7Qg2NX06%vqpOP^jJmQy`^l
zHn=|sRks8x2EGbvBDlsoZ~)Sh&2|7a=9oV)es4i($x3`+IB<o5+5SH32Zn=77#Q2y
z7?`t@L3V@2*D^tV;QqjHa05sNNt6SeUE9h&FdPKUTFNjmXD<iEL^(+D8C1o^1>oem
zYXZo(5HrAuZ04^I3<tpzAtL`pSwV-+=9;iGFwWv&U}Rjzz{t43m4R`VC|C`+`Ir40
zBrC<h$asK(k#QfWwKdE81H+*dP=zWgDayEplYu!`f|-GFRwM%><3$EW#<L(DX$*{v
zFBupaAA>l>42(=H42(=n;tY)UR()VN1a8TSYKt<?Wo2N_>0)MJytj*ikx7_=kqNZq
z=-wp;MkZqhMkalb%rOQ=CNBm?Cbyao42MDct-y0tnV`D`Kv8`t2i#I&&RGKTCMf-7
zGI7{4)O}z$)WN`<1K$4(8SOkY1=7yR0o{TKnj-;iO}7D=aae(YIl!BNIR_lsU^BpD
zF3env%ub-GMabf-!!{sgNY;P{fsJ4)7`z!6XK8$3I1E~R!vgZSE(0S|JOd+BG$ia-
zeqcDn0jiKhZA4i?2lM9nvokQx+|IxV-a=nw%fLAE2m^ztKLc|vsB)Qkl7W$F1p_0~
zGSD=c!J-cghkd}><3t&^@-i^z-e+cDGT6kx$h4Dzk!dSC1Czl%21cgS42(=CZ5fyh
zPBAcumM}2qo(IW*M6WS0GF{>Rz;L($6lS2}i^C3_P7WtPo3M-~;6yg_`Ui%?potO|
z2Iky<AV=O|U}Sp1z{vCj6kdlk7#Q!}XJF0~0tE&n6CH8@1r7sqo*}41Y62SOGKPf=
z_XmbU5g=)Zm7r3(0@OD>t^?{oOMts$jQ7uhvL_2<TrMvUbOL1=gE4q`YnKdYWDa5%
z$aK)^0v50&xMv%4_yfb?CkzY>;1wu&Z$V3hVorm_m>3vDn<N-HIGq_7LCTJBfa*yQ
z$si!X$jZz5f#C=bXeNh&IS)1n{(T9km^mT=E@nWJ;t?-DFdPBRBpQH5a`HK<7#Jgd
zgO^M*MjZISa0E071>Vq^uMCp91eMDAz;Fb#bO)l#4kT3rkunPWz;I>;0|Vn8kbwoi
znHd<3k{KA8nHd<Fz?=dGMrJ(*MrP1$KSs3-jLg*xjLf<042(t{42;aX7#Nv1h%+$y
zJA7a`^8(b#6`L=?^@f*$xuAiafzdyRfsy$+10(ZeWd=t7c<@*fW5nbS3}+KS1@hSh
z&|)PCmOefP<^mSbGUBBSjLg3o7@2>vGcZPMVqj!pV_;-qVg0~xHidyPOoM?r{}(9i
zYZyS`a<+njG2#Fy6`c71S`*B`TmYU9g52D3mVtp$n2UkAz!0PZJgmY9p7}W2!oV2V
z$iQ3xZU7)lEP(`n0j%5q{SGLKogt%aO#Bw0!8<ONiD0`ofa8Sq1H+joP+e0%_CO9%
zK6?kWotJ^RU^!?E7CcpQ_6bx7+zQ|T&rP2F0up2Wz;I3m#9&}909}9vnOZrg0u=(C
z1<b^u0BWF|(*cP=j0B~IS1Ug-TmYR-u?7@*g`oS0UhQUJWRYfIWC7hz{pth*BTF0u
zBTE=)s`L@0?tJx*fsv($fsv&tkb&{lRYvHU@D~L@F>(>KCxJtNosE})xv&;=)NvLA
zBg=XQMwYeQ9~dr*K+l9{=3>79Zoyob1DRAU1YH7&I;nc$4P;Waa3?sc6@juLXgU?N
zE=e5}X&0fXz3>9GZu&U`6tWi;7#L$p87?w1FtBZAU|?GbI+;hMhk-$*2P7sP$G{*R
zvW$^!9t-F^&t;69^Vo}YQ<F1_8I~~$%;U?*FD}t7E-fg?$xKaQ0O_^;$-rRy6T~X~
z%fL|hcNwGdJjDQKPb-D|(h`OIGzDX$q|6e9#FUhx)Z$`=;)2BFR4z~}i9wNp6?6=Z
zz-~qcM&X$s7=sU-U}0dm=)k~m5p;lrMFVL50jB6YBLkyI*$2ijffn3~9y2m9iaLE@
zl$SWdgwv$&AVqgRFh(f+0G&~Z)jC0LMg~T4_798-2`iM)O=5fwakwDpjLl0vvdj$3
zV(ttKmv})A|G;PnDhf&%7$s(Lvan|6l`t@}urn~Mo6pF?%D}+5mXQNQtzhI}VPLrQ
zo{^D*fg#P4k&%soAuR}^au$T=&B(;cz|dL8$i&XT5EIPIz;N+JGd}|ZgEolyyhV(G
zfx!sG{Lu~)bpSEHgYK(mSi;BwvT-US3&;+3Mh=kFe~67=7zLOa7%n{kUBhsXgNcb5
z6c?XZ7#MVBFflQM&g`mS;Lgb}XJBGt291MNurRPOG4X&7&k$xUW?*9C1MN6D&YF|M
zz{JE4(%i?u!@zLyJrfhiV1`eivv7p@K<SB*NdOdseXt;5oWowq0NVJ{#|GI##9qb#
zTF=@CU7OBSTFSsA1Uk@4fvK#Ffk_y`EN5U6;Rcm9{0s~V_Zb)%7cs@hg9ODuf&w5x
zrug_01||`Zz#;|)Hbw~Z7;Aid8UuvGFcWn1f-8i>c#J`a1H=Rcj{}Ioz`)SV0ODE0
zc%Ws93=Hgykf;_i5@2AsEQB7_MxX<TWf&MGjaVQdE(nQn7D$Y<Kw_K)65}k87-xaR
zI141kAu4A<c-}0K7-xaRI6FMXjX+FDj9Y@3kQjFdF(EOo%>s#P7D!Y>top(NijhkX
zgcukuBBGiTDXQxkgps1Uo`r!A7S&vcsOCaM^;8BC<fs+}MSvJ6(=)Py&*xk4fe{iU
zjB^+mSWNlzK<XJ5Ffg)QW?*DF&Y!{{&%glUv&u6tvPz4C6n$Vc0v%_}pzw*2RfLP1
zfq})Hfsxgdfsxe|#PMffWIf5i$a)aO31?sgE#_eT$;!aMk^myIK|~oN0|QGV10$Oy
z10$O@h||Ns$X3O`$d(1-OlM$ZJH^1rwh6>p#K6ez#K6c7y3d|vEdwL_DF#M%(DBzS
zI~W)_xEUDP|AUkrW?<y-WnkoR2XW3ZFoK!_962D)4F*PztqhDD>p?a@=3!u9dG~?Q
z2(%jBhJk^}3MBfOfrA0my<<=`W?*1i44S-RWnknu%fQHS62uW?VB~njz{qh2#F1rS
z<YZxB<oE^RXfiNznlUhP>VP<=42+za42+zKAdVvgBWD)_BWD|k<IBLvxsZX8b0#S3
zu_=6DGzOJ9Ap3WLwj!y5gju6LFq(ks8wUmkri-i$46N~BXB}f;Q1k_@?*Iv%1`*dm
zMm}a><UG&7$axgRdC$Pe#mK<O`5nah&A`ZI#=yu0auaCfG*>DEBUe1A{t#wh<Z5PM
z<f;Z6oWsDNn8d&U-Z#lw$iT?8nt_oEbZ{zbEdwLhJ_bgvT_EE+85p^4Gca<U2XUq{
zFmj79Fmi(@_!crSa(gf^a)XZ5WL?X^$lc1o$XyRowv&O8dnp4W_iP3U1_m}G1_s5c
zAp6Z37`e|dFmj&)ahw<!xvw!Wa)YiMVDn{QP+ZEuz#<Ql31VR6e#XGaeGkNmV_@VF
zWMJgs263_&7<sH27<u$ToH7PRo)QK|9#EQLYhqyJS;4@_GY2Ho$H2(*l!1}wK8Q1m
zfsvP$fsyAogCqk3+wu>L=Ab5m1Ss4=hea_+F)&<aWn_K~D*6^MGcd6I<IQ6b2PJ#n
z6b8^40}FVI3K;Z263lsd49ri#r5tlg3Ip>q2(ze&f%!SO#A8k|U|@a$DrCEuQw$lH
zLHlzUx|s7oqM(Abi#ZP@3aSaZnDdMnm|uVj@Gj;;0|w@o5N(Bq49qV<J7l|<lNgv^
zK?IX>8JJ&zPBQCaE-z<b*$lRq4U}e?7#J>JV37iqeqEr;zgVL{BBxo@z#<^_F(mdu
zB=#O8HUolv={J<k93P(x69=1|12XLb3#h<gfY@~mByyU?8#D*n1!5mVVjo0e??GZS
zAlR3FL)j3!Am)JVVp9N_cA6ys$rlLrK_u}#NNffK`_gYH8)7m<FW6)wkjWQVioqs>
zMYb{L8Zxj<1l7r1%((^(EE7RBW)~YMwSW|#W|@QJK?M6ClK37ZHUolv={J-OaRx*$
zgETX!`eOl|pUbw5fq{<^!o0-=uKvIrh6OSV43}JCG7PdDASNdR!zBk0gMope3v>>`
zC2JUug@Hj1<fR1+3=HfNkV;S(lvFV*K??;21~wZ8M!D0_N>FGpR)WHKDnStvD?w4@
zN)XiO5Eciuff-rZz?uF7BP2+`m7ouQDXbFY^<iM-wc#&=Rf4=57#MliNR%@$vT|^P
z3J3;9-ZKo0yvHON7+8EhFj|0ia4{&}XJq99*NbrsprgJSc|U@x!ZZd(zKslwe9J+c
zJO)O-uMCWQZ$Y(BIf!Ti5unpVSY|LV^6N4%@~eU>uf+_E{NW6Y{GK4rItE7mMGTDm
z9U#t521WsC21fqBAkGm6Mu9#CMu8R(=R5<Wz)=Q9fx{rqEe1w`D-4VR=RoE^1&O?8
zU=;Yyz$gH=`xg%b11swXMhoznmJAF`uAmBr3tT^d4wPbIU|?DYD$!*a7zO1R7zL$3
z91R9WL1P9+L0u5Xgn?1epMg=(8^m#7U=&PaU=&OMaeNpU1=|=H1?xbZ2nI&M4GfHe
zD?pqS21db)42*(jK@}gH`3FWz&@eZs;yVf|mu*18tc4#Ktw7C9knkOlv&z8Ey34?z
z#LK|I><TjI5d)(j2tNRE-Z3x=eqdk}d<WwEVqg?vVqg^f2dV?u7#M}b85o6xK^!3l
zMj<^0Mj;IlM~;C}$cuqd$OXjFVqg?XV_+0Y09(||z@Q|{z`zXle+L7jP%8tYP&3Hv
zDGZE4{S1skp!i~4z`!Uphk;RO21sTN1EbJJ21cQ^AkGd3Mxhf7j6#P%oFfd3LQfbN
zg+P@W>jefzVO9o4q5lj53=C|Z3=B$+Ap89o7=_gs7==OCEVD&2FbZ2TFbbQ3PLNJv
zU{DHVU|_KVDa&MF6!u|Y6!rjdN*Nf1lNlI=V?mro21em-21emV5T}=cQFt!{qwr=B
zXC?!q@J9wlVNeoaTgt#FqQ}4}0uF(V42&W^42&W!V7KgJU{GoS#le11mk+&eWEaIz
zH?oTkzPeEyRCuG*jfEf)n$(TWAd^w*#=9U9n$(Tv5R)Nw8i;)iTGxTt6xEHMAQMpP
z#<RHV#(f~gG_4!YBI?GEIP1obq|}X!f(!!Uf{a4^%zV;(s(iw%3=9m6Y7C&$HkcS0
zJ%t&C85o!q89ascL8Y_`12?xFH!~jt1FH!GGoO_rqcyjsB9EuAy(AN;T`S0_$|uY{
zfsuP6BOAy-0Z^-v(UXBmqE3Q=fr%HShufOllG{_*f}4SXnU%p%m`QxQ6Q~;nHjvwz
z6(q^P!0N$R%UBP#o((Dk*2ciVZi3Ln!HQ%e0|O_N3pInwgn^mE3T`Af#7G7P9;i6f
zKwegeGANgipMhJE1rz}MQ1^n31G!fK)Z`X~1&a_=A6Oc6iv}YzA2+uZ*ngm46X8WN
z7o=U3n-L@~1`AGcSw=(QAjTa|tfAr&+>xx|+#qQQ4+fCW85kt>7@7GX&R3TN$w)y1
z0&F2P*refR2r>$>Axx10sr3{#k(A+MV336?0$aolu}BUSkPHm+Ae9hnJcU8Ar~nNf
zWNQ?mV&E`>TCD`t2oaNDU{D4b2r@wh+2x+X3SfV!LIt@kxgp+BgT@v_KO_~XqnHU1
z(}0FEvN}y<!(cXOA#1jmw2@?B(1zN9>=zvk24+4PZUzQjJw|&;a1g`Yqz4ZvXmE0e
zb2BjLLo$Q`s(MJ~Fhq6<#HU8Wu#~`R3HG`%7E?hHYQhT6Xr@pjSV18JF~SUP6<82r
zl{u;)$OH>$*dY7Q5;Yh=5n=_`3HB+(4r{2jU?GSNHgJc+5()!@EjOc~aHu%QHaoa6
zU{@(9g3~kT_DXm*1Eq5ZsKH=Gp2DDzbdab5Ct*iDMne<<Cr^e3MqyCt;0(7LqydtW
z85mr+89`i-?XDn)z&LJVC^_F9?lP!vpl<VkW?^vJ;pNWeW?=9H6*>$IUZB#TiBYm%
zn1R6?W-<eV58NQA>mgy~i)@YsD+7Zc+_m74Vg)4=f4E+#BS4OY`8)t6rX&~`0zvKo
zCBq<YMo932&Wna-cu!%FB_Sv!2rC0aC@5+{xtf6?4B15t4B;jW?!u6=2NdBE&?vy-
zkVvRTaFT%pNffebWJgDHK|-0;Qjw8?AqMV0XxJbtjfI*4mO_?@(_=u+WeOmZ;z9m^
zl{t`{njp*wD?B?H!D%It7o0niKolrhC4<XNRtAO?5W^g_bvYGk4mf&2JN43_p$rxP
z1w=Z+SWp_u5J$Hq6J!J^NI|NzSYiI<hLnZba4&;H64_rl;9SlM33HIyxyT^^$xnGG
z#ij%UL%u8nw8#e;1xw@wh{$7LC<HkOVk)R!Wnd@*RS3|OT8x|`7#K>RYQb>{se?;J
z8Pz2rwwIxXJg7V@hdKzX0p#NfxCb#Jt`d|hLd6*vsz50fq_`SU|JQ)B4+BFj+zPOE
zaOBp3q(A{u4^2JX;MCK=2zI;TeFke*OGRc+VQxhhUTz*xG&VAFF&GLnFf=iWfvQYJ
zdq@)jbkZ)!Hz2cG7~wX7V**q^w?a)k$pC7FaC!<uQga(4D19(6v@_~KViT-^fuRFz
ziy$KdLnkB1)-ISl*y*0aV8?gE1i_j>w)8N9!%R^e<ZMn)VHuF#UNmJ2+zbqTjPMk}
zYN^Npa&<o=3nMe1ogzE9MFELakoW|IZ@`u_Fid0w6)1>A0a7&ywD=fQAiz`eWE5*b
zmQG;=4Lwg~GzI6CX^i5qs)rj=^-O0JW?<$6Mg0s&XhEAppyFjF$iW=YTnBOREJkor
zRBU7f`4-#?nvLdGkXdsW;mHOZPB!2SI~V3UsGsH`bb^wAx+DX`d`3_k0c6AiWJzvN
zk_CBZAtM(k1%Mn0Dkl~}xQd@ZG0e@tuo$czRA???gy$qg0lbt^j}hGB<F-^31{<l!
z3<}6)jAjg=^t&7q1d1oYNf4f3Rxm;f321e_l97cGGtO3l(g8d+>?J!Gxj|;G1_dG?
zH+Ki4B8L?;af9Q24ahP+n2@liFh~U`*w;cO_+f3`btopwurV;KX9P7eK^j2L-vE(U
zl!9c74n{=<kj)$6!mO5xa$xhp;+w!pDO5Z{Q3BSc+zeF;PQx6~G`xiolu?^O31}-L
zs19Oa*oFvIXi@~Xf3}070pfK<Mo<RY0ggNy$vi$#UtlLZ2#{L8yBMKGEvqFrv_Rht
zNnGFtGNgFj0~2Aj<Yr*l3(Ec=Yrv%w1H(S3tIa`aQOHvmRKV|th(XN&rGx_rGZbY&
z;c^fZor(=CR*Dwjasd>ChalR(BHSSV*E292W)x)rB@zaPBQPVlEg>!cqsZx7krkv0
zlEjapBymvja2y;I;8rB4mINtfU^oF2RFncmGDr{<o}jh>1H(y(8Hy4hZ}F;2g3Fy#
zFdHGl((01!jFK=tARnBD841Z7AR|E;<_y#@P|SjJ5ljyQ!&yd9xh<pEP|v_{4#H+*
zU^tJ6VsOR*NALwm#!=*fxmE#^aV~-_g~YR!;%r81P}z5h5xtuiDlW(f>gru)<Y(Xp
zcMq>HLaPc628OF(Q3i%<kT`%w9XJDl3WDpP>;P{+b}({->iQdyB*ogn2uf1We0dW^
zB?H4Pn1SH*VlT<SaGMcyi1r;wsmsmH?FniUL3Q7SB}iz=cn`#fR^QMBdLLpd8=|0o
z08Sa8P=O@ahhRQL-cuOVw|azR3@Dx+!y*zCPu%K~kaY6|9FX8t0xmE;g+X3_iYD65
z2=25zLkNRQQbd$K2WM>%KY}|F9CI(gBH)+=w?SWmGc~xi0CLSMh-*N>3$_<6QN4yp
zL-QOcO@YjIkf;Hd=WoCngn{8LC_{ll3L28{P{JK_b<BH&IWTJ=?dA_4rBK^Fg+bZ%
zBSI<IbM1_h5T&0WX%HH0kQU5mu<t-_f;E-CKoT-|m;&3-1+~SX$(WCUfeF$K09B0K
zpp4H9?tv&WK?-FC1{UOYH7E_Ug4;V_|A5r9i8FF5f`S4XilB`?9H0>t#R)8+F%MAD
z#etr)KwbysEKaC9I2ahXz^x3VY{89e56EI3u*={U^Fn&BeDEq89PWsI83O}9sPqRV
z7Xc81fk6=2D+~-mi0TnEIs~f0p+f+mFaeJOfpZ`O12b9}u|S;-888Ah@z@|^Anaf#
zA_9*C($)mIffLzskaxI{{l~z-4Jy^3_Va+Wfx-x+5i*XW$Y`zjm>m?L3=Di|LCz2E
z9e`9!;sU9Fnj(NJ)CHl=2OS!Y9_qr#t^zqz1nebvsEa~ET?|*KgItU`0K~u`0rFC)
zI0J(uhyn5&1A`Q5&jONPq(OsGGRT3&z#xkpQ*xlf7?koDz^x{zXNPQ*wV^~AC~!cb
zB#0~Sgb;Bjj2?HekvVXx1;w2xYTSuI;!Yf2+)03wIyAbWVJiu0!=nu7Q66`oNe2c7
z8PLi}2GIH*2GF8VkRUJUx>67Wghjyes-XE!5EqX3fW?<V#KDK@G73t3U`zz<u;%%|
zn0$qSfl=WDV-gDk1LK7cj0p!A7#J-+Fs6X^y6}8pOa)EzuKB>23Nn!617qqI1_lO|
z4~(gxLs~gLFunmzuCjb!w2NV2;5zYv(G#@t)Z_!BCul#Z!v{uB&?MH54~$-*%|{#`
z7`-AG7&t{fFb0E8m*e=r7z{d2ljQ?ra0SHNV9*JZpfy_{`#>1vZ{}jq8at4`8G{cn
zFff6RgagTeFhm|awa>r+T3W}zzy$FuNEQ-q%*EaiA<(Ki1_nkKh!mKF=r4fDM<_5b
zFoWCzmSlkGp9+&#NMK+P1RX_&D!&UR4_!D1lZEOpT?&&of~>Yeldo9?lZVW@!la9f
zlJyG`i!zIo^)pfvQ}luv^fU5vQ}vU}iuDUqb4wvaQGRZ*esOAIQf7X!Zbm^tB7?hM
zsDfj#f{~ty2?NNCvecsD%=|pPWCo{DPahXgKR17dFxQ}9Pk%qKT4y6;1w&IkBRxX}
zBLgE-0}BHS1&yH86a|mO5(Vd?{NiG$w63A1f^Kd~W^rOtPO5HNK~ZXYv4U=HT4HgD
zZf0IeW>IQ#iEeUYPEN6cZn}c5f3bpYT7GV3iEdg^Vs5H#L4IalNotXTZdzWxZb5Rg
zZgELbX>y5fQEEwPQJ#WsT3S(RYH>+oUP@+OIz&}UYEEiNs%~CsP7X}FZgNIyayH25
zl*E!m-Qv{blFa-(5I-+pH#t8yHy>nFUcPQ_YEgQsZgPGe$jB0?f~3;SoRZ8u-GZXb
zyplACC7A_@y2V9_5Kcj6Duhv7l9-&WTTql=lA2tS4{|j`1Z=%+UOq!vazUvFXmw;x
zeqOo)m;mvTQ<92Oi{o?iQ&QuLQ}c>b<I_{~a~X2;Q{oE}OETg!3KHYf3=9p-3=9ky
zKptZ#PA<-jFD^+eDJ^EmD38xfVTdnE&B;#&k@2Z{DGVivMd_&}Ac_3E;^d;#)V%l#
z1~{{lp|~WaEIkowB?Bl}GV>U6GV`(-ic^b{^Yh|MQj2oqlXFrNi{c^r8FCXVa!T`x
z8H!6X<J0o<N*Iz7^RnX$64O(Q8H!SiQ;W({Q%n*O%p``~lA@yc;?$DT0*2hg>{O6#
znR#jX@o7c*x$y<bnV@S&N|NIX5>pHq%92v!L6QtfxdrhlsmUNGF$9AG!>KeaEw#ua
zGd;sGC8dZVH#I%6II%cBr!+6Vm;sb}<5N=0GLuu|OBiyBOEQX5i!&H9ljD;Ti&GgO
zc_BVCKP5Td)h{F{GTzhAGlZcyw;;YKH;ExFC%-&CxuhtEA+IzypeR477!(E|Kc|C(
ztRTObA*Cp@EVVd3Cp9m<B!eL=Ju%4N7o@SEpfWx;za+mXJ~_V>lt>v05_1h0ijx!b
z;!E=5vr{XR^HWk8Je@r(gL9Kgi=ABD7?SdnGm1gsUYuGIpORTzkds(hT#{H+!VnVR
z8(*GZl%1KE&H#2T$p4UtPfIZ{0!4gTQD$Cxd`fCbVsZvUW^QhLZem4zZfY(=Zc<Tv
zF#{x+7zz?o%nS?|;uA~qOLG_sGC@fKbX7`0N^*QoVjeirWaj6AQbt*NA}Ast5d_v}
z!H|)dmy(kjZ*IU4T#%VpTHu<O!T@q`Qc7ZcF+*|^hz)XlPG(*zG)Q1t%s?q5KB=-K
zwK%?{C^4@%EwzZDBso4YGX<1piWrIuQj;^&Dh(Nua<ai;#*mU+Qp`}08()%J1PWkK
zEI4JB6f-2JfE-p(lv<FKpI^d|o0=OBW}t<Pfe|ER5=%=mAg+L=Yf#z;Ik7miDwQEU
ztpb{olQR;FiW!Pilk@XZ5{oM1LAT|Aav3BJN(yofjpB<^6I0>~Qj2mE^HTFl;?r^x
z(~H3wq<|qiwKBCVHLrxBEHfoFKfWL_hat71qy$v7ft(LYAE1l@3ge;@hKk~p5{A^g
z!qU{zR8VqYC`e8&NiAk5E=_VyEMQ1aEpg7z1t;n9qRf)i_!3aTRaubAP*Pl+Uyxdq
zn3s}YTEb9VP?B7k!%&c%8K0U5wkjnxEwMDGB)%*?ks&v~EEVj@;?$zd#GLrN(%huf
zqIl3HvuQc`pfn1WO-wGyi3gRv48=ypsp$+!`6=)+02Ee<IXNKjq?VMVf|M~7l@#Zv
zr7<`=$NPE)2fMn&2fGG^c{;nsy9NdM2QegPB<AI%<}f6Af)ajOVsdIgQGQ8&a()g2
zxZF+xXW4kr@^^-m%=Faa5>WUsloq5UmZZif7bP>q$3u%%Pzp{isDu?ehM<%VErJXU
z3=A34GV@a66O#)v<H6y~07}Qni3P<B$wf)=$+;;EkXS3u$S;pCDaeh_P0cF>6^6wI
zNJd&P<fT@WKuWDlkaOcpKmnbYlarqea#3nUNl_vw+LA%#AE@kxWNIUZqVyzpP*K28
zlv<FQSOQ75ptwlR&r8cpkIzjk&Ms#FsVIrhDa&Cf$;<@>e@<#@0RyD2DlJNdI2{}u
zsl~+%d1bk&@dZWs$*IM~@%aS|$w{CD4ytwXb5a?S^NUhJi9J3gHK{Z`zM!-u8C(;9
z3P)&xkOm4RkpD{JGxN$4b23xni!*aT2{Sjb0^&r}k|r@ZEx#x?v4kP1w5Yg*p|m(D
zJ|(p{*{C41Ae8|UAfSo{Qt}i)ioE!=99U^!XkuW%P??#UlM-K&pIKDMkXW9W394LD
z8B#!TTLGaeK_vyG5@RUIEy#&aDJlaM0H7)Y6iuMKRT!U<nOc-sl$=osN<`_Ypu7vW
z2Nd~`&;Tc$?6O=?d6$}8!VusZ<Qwni<LDmm=@Jp|;u-Ad<l_o56jZ;&rzK|Qloq8j
zB<Ca+7ssb0<$z_1QVZi#D@s7sAtVzfmL+E9#AjqOlqKevnShFw#GK6Zy!evbf{e`c
z42GlvkYrVUUTRu#YC0%A6qPV!6{LbnT}Xulj+n%hl=$QnhRW2$B8Jl9)S`HBSq*k^
zenxU;yhmx0e*r^oeo-nzW?p7Vd~QKWJgCA3Im*xoobXfPq1gh`0%9o0FDi*o&d+7=
zb@uShO-@S()fUAiMc~YvmYI_SE?3dgL28O|GAP8LSs$8Sic&$Af(ki!-NaCoUs{q{
z1TOBti7&Y@mBF{5B-lCF)6+jFwXig`7*x=tCWk@VeZGlV`9%!rMTrF&naRcAx&mC{
zCFkdW>i@)|5>U+usSQBI2fV0F1o<CSp~e?8Waj3lFqCB$m1O3Fy$_11(gKF$0uy6%
zPz_m{mkF*RGZKq4Kq1JGnVex6pHq+=pIDHa9ABK93)7JU%DjdKhDHqFg4zjGClsZW
z6es88Fcg4lKv0t;wIVsSAU-1{r-&iM**!iuqqHO?zdSFXC>5k0UQjWVWEO+V_)3QO
z<h0VfWMiYWoWzp&3XsbS@^f<HGxJJ{7?Mkiit~#g#Y9mBIP{Ad^1wlnUzC{+DV9Lx
z0JtsV5#Y#BoSq6PG*Hb2l}X?>Y*A@JNj#*MDl#@=fYj!t#i=O_pin3-N`~hGvxo?W
z{L+%(lA_eaT!#Fdl-$IMg2d$PR7g!&T2PQ$#E_hl6kk*h3b%Me0|rnMNdncJpmsz?
zVsU&yMrCnka$-(=0jOz~mz>G~3eTLxN>G)Ok(g6bP?VX^0B+krJPE4QQwvKo3vv;)
zUP*p(d`^CHHmFTknp471oD1qP#HZ$!6jjE9o8}D3$?>4b2h|j=VXl55@jm{+A<$X^
z6!)Nr2Dya+M8qdo=49rjq!tx3WGAJ>=cJ}E1o`{AdHT4<`}jM$xCX^L`}_Jj`nkkA
zy12wUd$>A#2Zw?hTcyPrpeijhB^8tfioqo*G&iNBf?BGXd8zTBqBp;^1XRC+Td*J>
zC6<&FF@$>Nl^B|V)EgN<8Uo;!N=Z>-ayB>|b5ip_)p2}5UO{|*S{kUi1Zow4ibQCM
zn_^%N%4v|sO+jiA#M2-}NX2rBfdxoWacW^Hs1hw^NXtkmVt`g=pr!`{C}+ke=Oz}!
zmsBt$m8OAf#R`xVIHN<A8X6cFf&7Wo_)kl-fMj(@41j7gaGb}drleqL<c7EghcHy6
z=EY}J7Niz|x>w+KIzvioVLWKrFDQwFk`Byqh6V<fpf*}OsM!T>!WbG<7#T1m7nc-+
zTjrorouN22JwGiizL=o^)NqH_FraoUtZkA4ZgFN76@uzTaOKEQo|)$u4{CEjyBz67
zDarBR77sX|1|$|2hh!Axm!@Zg<c9?KGC)!nC^C!UGxGDZK}C2`BDf<3c4AUac5YdG
zerZWT38;ulNsc!(W=Ks+Nn`*e>3C4uW=Jh7i7!qqNGwV$$u9ym))PxW4eP|55>P{|
zATfmjQCdI}Q(kI0sJt&p1=V30<?*0W4dgL+13ft()ZQ<EG(w6~^FSqdaW=U623I=8
zC8<TJ`3wO$i6x-AHmEc&FEcOQKaZglRIotW*x=@CW<JRBoYLaVvefv@qQYVZSW_T3
zy$I|>P$YoULq4P(#eiIU<>W&XGRTFXJ&7gp1<6IAu2?ZcN?~ats9%<!56<54khW7v
zBD8}9O7-Bh2C1&oGILTvX2oX~!@C}!F@pHi#G;(a_*4rc1BUqcwEUvvR8Vryj!!Kr
z$}ftK&(F)LjL*!AH#AGiECFXOV<U#-q_pDrg2c+4{KOPcY=cS>a61FqP69PIiZTm8
z(E)DEfifqkWGVsW6o!J5qIhr(oS6p7bPQlqK+SegT7(pppb|H;I0ICkrREltFeE2|
zoK~J#l)~VVUtHpwmI&`5f-BSXGzM^Gj40AU9YRQC7Zs;~`k2MZFc*PZ0jVjV42jg}
zF)&PoL|$PALwtOBVo@HbYDg{0OUwa>1VcQi3zr>VTvD3E07@&6{wt_@fV9C%atq>1
zic%TijfRXAkh*MeD;tzJb0G~waNE8lKRziXjlnrJucWl7k|8s%q_`-#7~FR$$Vtpg
zECLm=E{-9N@lK&`ZmvPlGBzV8v$zE0D@fH?S^zEvVeT!>%gimvNd-klD!8SbQ4VT&
zCZ#eIlw=f@LdqjhRs+=v;NSv{r^JJrg~ec3fy;Yvsa2Gp4~{F)zzL|$&HzfKpb8LN
zjua$krb4?)prH$}7$nu^<(FipRWbyHIF}ZK3Vu*i7u1H&$ON_0K|>aaNyVV7S5yM3
zW(x8_!ylj;ks&iNzc4-tR7R&1mn0TsCWE?%Ag>lNq~t^TgCIv`lqSU|GQe0#&^{_S
z=|f7bjJ%WzhTO#D3{WNEY;0~|z>t}jmXn#DQ37tcfqVkW3-O>-ms%7LVuM;a-~p2S
zvecrY%oI?kr6d`pa|0P60GD&%%nIwzK-=-45(?461SjsCq{R5#%oK(cP*X224OZW0
zlow<s8#1JVd!3*nqO_<8)RqU28bK;&aMTo~g8M7r*n#>Il#5c}jeAga1j;^;Itx@^
zfT|-@(bN=U1CVHOMrK+G=z4E>F%B}TJTosPznlToV9GB_0ktx~Wg95w7}9g{lNj=f
zKyeQ$Pm19KF|gt*zks1E6*SzCmr})0RuB(PHpSos2ujX|#-LVQF|4)%^=mQ`i{M#`
zA*BM;_y$)D@rgwxnV=SFY6+-n&P~ltj!y=SIDy)EAa}$kr=^4H1xWq`cR4}%fB{^5
zLEFKgep5lNVPZU}GDynF2Du@%C^5MNRPKVZB)F#t8k2xEdNcF#ix_fJjg3H!mgIs`
zhWL0;)mfCE%aD>B4~}F=cOo?<9-J{i$vi%>C>1m`0=63DEb#aNxDsQ4j!S`^mX}(d
zlEILilA2oz%7U=IAE<8t$?Kq|6gXDEJzH@4g*q10NzKVDsRS2`pt$h|$4y=_xR(j)
z%vGeN7C|z8QEG7kq}Bk19JucSt|&m`AfS|hXs#F-8GyQx;6gezF9qD31NRD{g(A4#
zDoFu1j6lUOB(Ff5D3G)X84LlL52}CT!4+~rs$qOmPByq@0}A2zoc#O(hQyTI%)I#I
zLU8#PZ)j{{YG4FP@kymQ*`R@HP)-3QTUeejG>M1+r6EwFOiN8HDJ@DZhRGG=7nh(l
zj|>bAOhBnRvkcTD&MW~{7Af(d_5ed>N^W8S10?5wdwUEyiNz)0z$%IddjnLkdisSq
z`gpp;2Zsc?I{L<Yx<HH9qWoM?aR4hCKs`TjK&2KzY9(-hF;wM2#)iSQcS>#|bVxC$
zG|vFs&@Ct`DNZherB2Y`FaxL#tBfx#%}jx~H8}}d7Zhg{B*!Nw7Jx>}Qd8pd5_40*
zZB$SwXXX`_W)@X4_*CU4x}<^&$@0v+cu+3}9QYYIsi~RqpkZZD|DhaQf<woQl1htn
z6G3ehaBT$Yn1kaK+@FG!skx;ksTH7Z8>q{g0~%gVF3v<APb*7Fg+(8@wFoXBQxai~
zxq_nnl+xr9&|n{A1liEQAeA9C4Lp7p;OyxF9;5}e&P$SWp>;(NBzS{B9Xe1)2^7A$
zsfop<Mc_IMln-<A(-{h~(~}EIiy_q&s9BI-z)(<J9uFM|D+c+t64cBCjdx`v7Nw+Q
z7H30hW9ZO&Q7X7m03N?i%FjuGjC6qWFL-brRxE;BdEf>LsEq(iafSwliJ<hDo|sV%
z>XU-%eZ<f$s1k&>a=@im4g<K67@rPnUFRfLRmMX*l*N^K$qb+{$t%reC`&C$$}dg@
zC4O+y1Pw%hn&+TA4jLOS&Ts@5R}hcqB^Q|+8i2df;Ftv$LEu8R0NUt;yVumhI3j`}
zEw?B&H!%~`4h5Gfpg|i@`2Z@RDjC4Ogt!!x15-gG>$#xeL|C64l#7wdc5s-2O5vh>
z=x79TgC1liXpGDNL>PhyBM@N>s_cpjpdI7lk`z#t9G}kM>*g8n?CTQm;}Q=VgoyX_
zXK>2QFLqDO&rK~Us&od8s53Y_`KIQEfQCH50RS3Z%mc?@QF@Y7PARxAh}uU27igeL
zq9{L?AuSU$)&=%qaeQ78sHqDXfhtHYiU$`6i6yBF;06yU02oqAL9+s>>BS7WX_@gk
zDe<6kJH8los1npSEGf!JPK0HJhzN$F{30_GlvV_2QU{bQz@<2(764a2IiS>2TELJG
z%Kk+Rpn;N<;^NeFPy>wt)ZmT>wTX+$5<&A*3?2cFptgBpaY<2rd~R-LKBWDTT2TPb
z#Gv90(!>W@1@du0YEfo>N@g-RS2INA=cR($#Nfee3x=f1f&zx(#F9i%6S@FA1X2zf
zcV<Wi53hhqT4?p3o1Yh-m{XL?kX4#n04g1W1AII~;zNQQ{em5xLp=Tcprs>fg^~zr
zSQr>E6eJgU=B1=ofD>s^YC34P0o3IM)rpy)@o&h~Q*u!WsIick!jP0)26hvuQU*0+
zL4)MUi3OlxCs4-#T=7C0lf|hypuxc0;?(3~NJkOU(oQZdDvHm|&tpg_C`n~V&MYb_
zEe3bta#M4`+99oNFf+M0wJ_ey#Gt~&!l1$eJYNGE!6;@3N-fB#bOTL027_u#kYHj_
zd{RznDx~fQHO;`4AgH1O&&Pr59BB0fZlHj(251-t+$4e2!w?hFz@w)H`Nf&ws09s;
zWafkBz~VEDi@?bn)CNw<NsTWq$uCMwPX&)8=a-hmCo;r?y5-<%2$Y@*ic-@uE5H>X
zqB2iQflLm9d>CH>*PFtSnOB@zR08SDx#od8bI#z&(9&FnB+%Fn#Bb273^E@yOP9(3
ztx7<>;dpR`Tb!Dc7GDAy?FA2XCZ{BU2Hy*k3sQ^0O^Dq5(qhm6SZ;1&9!Bw+mSzFY
znwce#=0H3sAHc@08B!rV6bAUfD`><PT%$rp^Pw|>pxHEVA!KN5XadU|>98?MXf8`F
z15F=+k{hVW2dax9(;y6q#W|n>)`HBO)FN=o%FL`Vi7&_n#T#fKAJRilDTyyGfDJW4
z2J7Mt%_Abfc_=<Jk0B*9r7SarAs{oeA|MwuNDC?vi&Kk1v*qA$fS3cy83mw{Br&fv
zEioC?eklTVZ;ZfET?|TJd7u$_@IbYZ0m_&#LtbjRV`)hSWDFft;z354OEPmogBVEF
zKs;o!5j@q)P>`PkY9S_<R6-gW&>j!0r;u0%n%My*E<`P!f;Oz~=;Pxb9`Ebu=@;Va
z=ji9`$^goesO1baoJ$IFjSS+!4OGws3Va9x)F?4F0@q5AQV2Q&3o<AkJgvu&S&##Y
zV8j4uJSYLc%2NXahSEIHuxPx234=#sS!z&eUI3`Y2aS3IBZh*^5>WanEr9DW0flW5
zc!(3?J~Vj?kUV&TI^F<2d6y2EID?e9sVVVB3`OOj>WLvZHxpC?yFlh=!S#j#$UtzT
z5j?_}3Q8oPDR{6)b4v3VGD|=shtPU18C<p*8W@>Wn44Kt7@DC}4yi?;1{b95SzMaS
zkO~?gg3K9!8hN0ZR!~bC+R`>OFi3+nBtWB?@u21_s8EIvl{)zcg}Ayvoe8SjAf;qx
zejY<+Q6Z>zUj*vMB!hzov}Pcc0X&loVS?(8lH3AN0L7bGz#36SsmX~snMp<9iU?FP
zffgEM=7FXc8A^%@Gr;2#pem!d9MZ5sFYNR4QX%8Spm_#Qe`n9U%o5l{1E?JmUjiPD
z0_EwF#PlF{r@&B07Y1-?ZfwK=I&do(vbrHTIX*EbGqIQf+}X%X0VhdF04AjsLtEjX
zxt4fPqG3obN-hEqaY8B#&}cJyS!rNs0II4WBb7<8Ne0N2E;#-{ElhCL7!MjPV*rh-
zLktIn6}X5@PAo`F$^`exz$pOS6a#ex(c6`2DF&vXj!AA}1t=n*BYDs?nvuznQjiJi
zDS>8=Gjl;JDL^FysL=(=+1aU;kh#L5)O3d8^c;{%Xfwjl)HKZ$Gy@2p^ab~L89>7e
z-~a@bL!iPLF&P8)O%6k59=K*hq%32|m}yC3aW*Jzfg=&@7qG7&&IAiWt8wtGX+d&P
zFr*&N$xnxLe?e&y8r`5Uf|P;r@wufrDVfIb#vXX-1vqO!q6Og&Ge~O`loi2)Obq!2
zNzl~=&}?sL$`B9+YAOb0=A}F57PzDqCo?2vrn}~)WG3b@fa^3j@Pv18W;z3?J(pSp
zb}hJH4(rAhGo&SgGeZt!`XaT60l7E@`x=y+L32c)F<wvyfdMTy8<{W^fRhQhy_T4g
z!cYWi&liJ7O(2~dA7_tX25=xi7DD8Jvk@rM28Z|u1h~2|fabiwT|21v3=BaL3rcD5
zGR>F))|>;iLqUU=a4Azz41-n*rNFvCpjxb?C_e|3+k)L)K@&8=;E@;5U<RmYhzG?L
zI17O~^kJEaL5aD+1*xei45_)LIf*5yDe>URAW)GJ4;pg=cmF|Q02yz}%P$YehmVSZ
zaz0|*3EZ^;rBP5iiU%ho$ZDRF)FSX?dwyCPblyHWBQ-ub4bpUr2el|t6Dt^?ohNWh
zouMGtFeyGcuLLxR0PB6`W)>$yCKEu7GEf!65DZ?^<d~P@lA2VS4iA}RP(fT=09pK#
zR9YMlp4^6Xu|XX@Xp(kzj&}`+_wx^lcl85JB*VJ<(3WFyd1gs+2Dl*vD)+(bCQ_W8
z!d((e5<{RXTYMnvfk4R}nmNE-I8f+1`nteF7aG5Y1~4ZY8o~x=^YX!+5UBS-%LG8f
ze4q{!XqE*z!VS$Bz<C)|C@`dCrlmnVRFqm=nwuJ523~9i9(zav_uq1hi{jB+rQp;E
zt4Ba1iJ;XZu<1yKl9Xc5SRlA*Y-nU*Pyw#H49y@d30Up{rFBpvz7i61N$3S@T3S+?
zfq_B1xuGcoWX%|4^#XEZxF|Ix9<42mG6D(CSt&`N6a!h<0jd%~Lj#c7Dl@Od&^QG&
zpAOD$!Jw&Y(BvkhIRalW1Pa)4&~lyl#Ny;klu-<L9|w7D9jurxNsdo0E&=D4lH>wV
zPbohs6<iyE=gwgbLKD#7RRL&91Eai$&eMV0f5=Psz%>piPD>dIiqkTS8Ito#azO1+
z=+a2=cs8WZ&ybo^lwS$%WI!e(L0wSr`Z;jX3@Xb(ePZy)X%0h4eo10Zd<B%QWJu1>
zEl4a%1ts3noK$f4n4uChdIlPd1J!56(EdF*yT=zZq@{y%EGTzCi)Bdv3^MCr5)YzN
z!37R@v@9M{h~yThXXY_L#*9kyKphEis1+3##6t>ShLpVIk{pKI(wve^aN`e@+o3Bj
zp-LblUhyRiNzTFH(CQxKgyLkdb)aGeG<F9nXTix1WCN%N5ANC_Rl(3{Y0wlNsK}2u
z0Jqk`E2}^=4ateg8L7~QLUv|yHbatMX)b&{Kry6K4Qf#ofoJ05b4$S`5vWTFst`c=
zvjjABZDzudmIQ9PmlWg{gJ#|05iKpysDBB(p9ab)1<9F^=!4}t&^$G47$`lzBp)<0
zT9jX24DEn}8y4W?4{b6-raVD41*jSV4d+4@t`##B7bVA6fXPbG7;{=4sA>uF^mC67
z^>c9z3JUcDHRqu1U1J8MnF`Rd4cOQoO78)b#n2bMfujvHt^mnhph6$s&IgS;L(&7N
zl>#1<hjvUM!wH}|3zP;^i^1&@@cakVU*LW;WHDxlj}v$)YffpNQK^{;Luq1hd}$`A
zp9bzlrWAu))u1sK*n9$b7zEsp0OuHxKjSSeKrI`{Y6(ccwU{BPz#<1$<eHc<6lCVc
zgH|(uLK2*e3?N-gQ0OA6Mo^Xl1!b_Sv%jB<V^CzglcS$YxTi~q2Xw?EIjKAzY<MYn
z9SNu<ix^P@MGGjJK=Xd!bQ0hh6dwYrUl`&+i-3w?omL;mV9$71&lQ|wi$V2<3uvXO
zCunZEq$m-(0-K=#)E)`&4+@D7boC95cXo4+cMkCZtvdt{`GV|BODtk2Ps+?IOJM*l
zwJC&FuaLGNypd&+240Z}9<eS0&&0+TrIs0iOG!}jF3w3T&H#mtp%JLTUj$mU3mq0H
z26Y}mBfXG97_sgLH0ueUAx{Afx*8grfW|W+OLUWSQ{useKVpOvG`tDwzQH@$;9+P`
ze<v+5xtO6OCkfn+1dS7w6@Z6upfy=B1E};fHUdv8F@Pr9QsTjbS&1bXpq%6cnso*_
zA5=mVLYH~O#~0^=+pnOhRj}j1@dBQq1~+`*NyHd7FO{BJ0xBiJg@h|~TBI1R%oNl<
z0yXy-GC@OW1(|RebA}-38fZg?q~w&)U?)iB37QfDtx-t^FWv#=q2dzIgd!;8LPx>V
z5>rYTDnMiYunNY&&=54{P*9Q@Ukn-!$V@F_NJ&iw`yJE>C<ZkE5_96q5{p19m?1rF
zP}>MLU<JzOh^7fcE+`RY=9T0oBOC=PRvA)@iongO`1rIONC<<<FvyrtPG&A>CI#H6
z&P-uQ&P^$X4JM?P#6#=RB;Uk}fc)~*B2a)Nl@@1$CyWx4LG7l}0!Y~k9S18&%mL4Q
zgU63R1v9u%hg1Tf;VjT-76Z5m0vnw(Gy{o)>o9P2n3kFX9%E#H_rF11CFm;3VsM`%
z9$LtN%Pw#g2T2^DIxaJ*6g0F5OQ(hm*{P`opn^X>JvA@2C^H!}ubG*gT8s!J&;SyA
zEi<U=p96}H;@n)w7(b}Gfu{fy2JmtfP(QB-w6Fu*A_GNuaxOScS27ftnSg4QG*B`{
zTL=gmXiH0q2ese8y-sL<7c%{uSsV@?sfD@Rk^w&L53WiXa=_E$P-*C7TX7*naz-j>
zmYbm@1zheWL3$^_rAf}9X<g6~LC^wd(3-5&Vx*e7G&8TnBEAHaLcx8M!jhDD@QS0H
z{B)2(pfWBu6+Bk}8!7{>KY^qg*hD<2_6Fs+(qi<%570;^YCId6fTp-g(?Cm3^Gb8$
z!IM4UkV`{L0BMj}ZBUsB8tw&mCc({fNOvDJ1OS>v&IPsJbD{kTNYl3nw9%lXh#@aE
zH6^|Tv|=tVB|bSRzPL0AT-}5EUqz6~GKM7BNJUX<SzbQ4>jKJ5pteZ`H0OclJHQKJ
zAbGDCIs*t!!_aszF=7BMKr9AVO!1)bK=TY}wHRn{0JIPmv@9Sq4>BTLoRePyF8V-A
zZFBO|!7VOuQp?OMPGZQ+2el&&p|lamK`G!_A@Fc=GH68%sQC$U3MAJU7#e_vU!h|=
zVDVy52o@wJgH|LKXFzH|@Jd-o^A21Q7MJ7~#Dlve&~-@Q@duF6h(!kADP#i!kjILl
zgI_S;TY$qYIUkfo89=4H0hlxdsRhr?K^&Ks0-d_eht5x?VJ^f1m2A-A0MvF?F{s4=
z&gJpN3|R%~Nd-Be`rFyxFT^z>BtAIAF$A_`J)=A%F*7Fs)L?)%j6kzgkX<YB21X2!
zrNhOExeTD?%Fvb@Xh5Q<EHx$Gz?7k+I2kk_SzK9Ml9~$|+F(e^b#@AO1J7?F6e15b
zT7vuv3M>Y2(uvPci+2tPjR&n3%`eFSjRP8jiUK2pcu+eeF((~l0l0SYO)V}?OizUv
z4o+f_n1EKu;0`gUBLG|ST$Wm#$WTyPQXHR*sH{>WBEXGAsArN=igO`(6uhbdG|>fK
zwFT?m6@!P?5Tm`N#Yy0`e})DoX$Ge7fCJ6&L4pktfS|cPh?p^49e7L@8q}$<naP4&
z$hIbMA_R3g($b(sy0ddUY(x{>l7)?wAbN+OMhK`xNo6R=%&dsdEKZD1D#}br2kn^x
zHCB@Ib4qjb7@#4WjL|iN79G&l(vVUC)Qrte0<{M~Ccw%rkS(Rf47n+(If<3fo&#vc
z23*K6fa))Bos$L|bpa28K`l-)07q#&Xz_V*NoEmv8%Hig3>3@Y86-&YXJ}?%P+@3f
z0GfsZC%>Z9GEgLf%3siCB2ZZyUkXaspx^=-VQ2&{7m)fspzH{eg=8l1b{GQ#NX=6M
z8kmQ!lLRf(2PG`fs-4{Ag35SMn-M&w0B)#5Ydlb28?s)w1Y8C~b2O-h09_>w8n_2l
z-I@6e1)y5LxE$OH1+9=S1y^gJ&1l7-O0F2RgbB2|1+?-Vyio&GghGpCQ0bWjOB03$
z2F9?F9&k&uC>1hI0dfv#W)HL=8Qd{K^=w+21!yf3Wa!Yy0A7hh;|Hm&g3?Sy^rS(q
z0GHvQ_1U1!4#gRcIq9IaKHxPgnb0*q&^!lfK|t57f|fZI<d=iD9WWH<X2u(unx}y~
zGN5RO_4gpt{zd5N5LW7^<$zZ;g9dzyQd3HkQ&Yg*R`9y9B+&3Cbc6|9`a`z$Fys}d
z<}egz7MB<>fF?*m6)}is$N<{+2i^S#E-m0;YnEulP@JCz8dU{VsGu|eDwL4gRIqhG
z1*M>sq?yn*5Cf<R#mHhv)Ar#(o*}LbNl-@yn}Ay9VBdoq{PB>^2ROllM;^hI3#cg$
zTK@-eBB;v=>RE!8LnWm`hsMD*cuqdN6p1%B0j<RcmC2Cp85x-jNvUP=#qd$(0K^i4
z(&8l0(nSVPPrEp^5VS@VvYVtR71EGE<P=C@V8D=^lnk0S2IbU3^nfvhF8T(IZa~|!
zh%xA5(11lMLr$up8K~3-Ef-79E$}PN1r5GtrWX6;ryDVVmy<x67a-q)YpNp1`T|f)
zfETU=gHk|VeqKCikO7*>K`9edC&cHM=cN{bN}TxQlq6_L1m4BM0P<)tD6|+rn`uB@
zIR;oG1ia=5w3xLdF%y)m!8`iE^RuAd3#fAkn#}=CT&7l(n3;fL1+tzEG~59i=!!2&
zO@?Hvl;V^UP?Nei6~YHEs7uZ(VMr`V1p6kwm?6x`H9j>3wC<-U8Po$PDuitmKx}}5
zjtPOLh`~L0Q0EC$N)*IH7YKqU!9d+<SecpwTPzAHo<Xg7hFs97UNUHn47hxQwAE6;
zLq*_mYS3CT24^QwNdbyyc#)C{+I^Fl2U^3NS`3=?F@VgfBp0G|PrwuXh~=E1iaI1B
z1hnWKw9yi+ZUlKE9y*v@lnNR=1?9!Wob>#n%#w^;&lHBD#N1-=_&O+~mgS`sF=V7b
zG6i_@tthpy7@XcfPK6ZSY0ymusTBpO$t9^N3~BL+dC3|1pe+QT6{Dcd!KKNdg@X*G
zkfnbanJFo$dGRTUp#5~Ex%nxe*%nCU1)Bc>Z3>A`ODQOU?5RyGNrbip%D_<vYAHe2
zy@5N3@#$&s%}$_sIZ#U+T;mlpfNCVj+!1JE6udMPvP1{9L<X&g05xc#-B`%b0|Thb
z?VkpnGJ=c_f%fuPfLgFA$>91B5&#C!440Bv84q560=69*%<(z-phO2MEI>g3T6hn#
z9Mrmk=uU%ezsP`W`~f8|P`UxNWg+trpdAyb;2sTl2nt-ig4-alA`n!Rg90wMI32XW
zy#O-r4o#Jyh14aGMa~SceJl*%+7ndafRZ6-C31d2d@(2!XFwK;fjWbrZX?Jf$l^}W
z>Ll=R8EDKUIV~Mr(1M01Qj3%06O)ru3qW%*AbkwQ&^B*MeqKp(Vo@r1M+c~!1(zt$
z5(z#959)#yGi0PzfYvcFK%1#xbIQ^aL74(HK@A#8D+g`G1}zk?EJy{n(Q{LC^NT9u
zL1V4Hi4{(z#h^txhM+AQm7w)V`8lQFH7lU5Ks?Bg(BTZwvO};0cpMPazbOXgF2nph
zPyj%NVIb>e8Ip1xOG=8M{qN+0Qc#JRlxk+e5R{mg4qYG*YKuZgu0XDaZ2o|h`8oNZ
zWkJc=;9(;0cm!ziZ+uEpNqjMA=d?#SWb&#AWNv9O@@O@r*aIyCN-Y65dLRi9)U-hA
zRe%b<Fvv7Y3V6s7)~^LEBuR!%jU^W)#e)+AXs!!wR?q@g+<?2Jkfu4f<pbIcl$uup
z+M5d+xq+@e01b^pM=C%&szJpGLwtO3d18{W5vT+NpFaQ{7zWkbp!frgP?dm}4}tdE
zr+_EKKx=at3UUjQGZ_l<p;Z!OYz)-01!WFUT*T)WfFcSsv;$t)lMh({kepipDT6@j
z;!)=Ti=jgdpoMCc3@MqQUNxk=gHJ6%23$bH<Dm63;2{*qJSVil1oAo9kqjxIjy-q@
z7RVpP44_bjEX#q!8)&IsZaHYyqC63_10FV|m7H7PoS#?hnF3i$2DQH=DF>yA1sO8|
z@7Dw8kOJrqNN__hH$Me74HBOQ-Le4My_B2;TF4Gc_C=5+SXvA!Xc&q!N=rb~ZzY+@
z*~KWkS{OimEO5say+sErc|ZkbejX@Ufm_eukO!Rx0N$GnntlNlKsoSsDroB#cn}yg
z-U!N=u#*iyt6)I`cAzODhTP0NP}P!?Se#i<Y!nZw4Kwq=wGm|a3>2Cb@fF}19!LcV
zO3dH|&*h-pn_9w<S?rUaoSm8i&g=!5xeOqKz?l}(+h-^)%{7cSGXb>@EWnCD(Ub!k
zv`x+}09PKM`~s?}p!F+gYjZrfPYWOYN;NQJ$N+WGK)cdG<!)|qI=F%ZCoXU?o0bMz
z1O^%`0JQ@^4H$3`6%>F*{8K<Xp9?BMeg%~T;9VGyHV3G0T@qiGm;+ko3toW&-o6Go
zQUuM4)D%NdABdr(JTs*vgCQUld@zWshqEWhDoB}x*npg$2c9zr_k+O07NB+)IPZei
zoTTT0X2&gz3_vvr<RF4F@RIKG%slW$*o<;#rvOlq2Q7+Aii<&&4Jb$oKu2Vh=A}S0
zwV4SbQ-h09P~)p8KL@lH4bl;X)Rpnc`8n~R#T4Kc4rtH>)Exj7d!X(oXmB62=m^xc
z1XWXDlOWnNi$MXDnF7w@$oUWK8}Pgqv<C-idt=>B?H}&v8szNb>KMdO3~EIfKqy1d
z7Syy{P$#Jf6bs4VPGDjR=*Sg@bkNpeSdjpZ3{WzG)X1>W+H%Np(7YsYsO5rkKeT4c
zEl7s364Nu2L2D+GbK^7fKt3)?1!rvVFg3J6VPL@kK0O1JJi*)Ml8hNLQ^Hd7Qu2$y
zYaYRCJCZ?*buhaBpg}ND+XOnr1e&!0Z8c&5*Pp5J$>7D1#SEaz2~<9SnoaSb#p<BL
z02ner&0ElM8%YHP(76Y2;SNgMpk`EXh@+1WY>EiFgA2651yqfICs>M7b5cR)kswy?
z2NZ$Mcqjo)bbyzrfaVE6$q$n7(Hbc5oRgYY3aT8ztAW7Hjuh}@GI$goyh9k&n=oJ~
zP5})ABDa;GX#$jwL0g(YRZ)BrxFH8hbNNNE4x<5RbOk&D3+^X?S8IUQe}a|^Acn=k
zsR}x%4INd63@Jk+%FqC2o}n?EWda#*FUiO(2Bi<UxEa#1D4+ra*8PW>WeM5{0&+NL
zrEG3yUM8ri0d6)zx6^=vjUf%(uuBD<M*-<cfopz<GRSgM)Xi|IDWEI~%Ky+I28O)+
z_~eZA_@vZK&=wJJX$v|V2(+9PWP5gMC1@dbb}Don6}0U%DLDl)rp^FbwFfSEp&1#P
zEkWnbfcn3n5jR++1sX^I4~52;=7FalKyy2g6Fop<rQo5Z0`OP>XeAuvJQl-5(2+Kv
z(GzfQ4Z7k4Tmyhtlx8O8WLBj@&bfhzf~JeWWqfX8Q8s9LCK!A`h#&ZT5Y$s{Kn-*T
zkddJMAx;bhMX8`g1PtIE@u>yLB^3;yt|??8KrusJW=aJ^aR#U#p99)qoXHRmYSV)1
zR#3rE3SOHHS-S!0qQO^*!eiXPASogOynw?8yv+-;;GiTwJv|3>2vA9CUNLC96KKE)
zG(nLWPz2su!cdTz51vy7m*oaXCrQ8x@{}yFUqCG;(4ZA;g)!`O3~<jYr8pV9Ppu?B
z8NB#A9;6a|jsjehg0=^Mj_>g)NOp2@V<;#C=XsbR@!)mO*{PMF0*|3MBN5b}DF#i%
zK&G^yl>+KYC{Uxi7(7#12H#8qok`1q9AXs@S_KVTA_U6opskq&#YW&n4@p(vrXA?y
z4$y?X8)*C)Qow@j&P)OC5=$)t?bc-|1J!>i3`MDhXaf_VozNhEL*|#jLpIP^I#3A*
zUWx!6Cj~_Us4xLFMiYx5%X%1+N{d0AgxunEP}G3hXGx{SkQoY4ibwRUpo3lDB|-VA
zxuEh8w1yed4+Xc!L1_nE(Ln}8K&dCOEETrN%Go&{IuIQ1<Lc)g;t>z)v4X~GlfYdS
z$aFL~XuzqXm?0V5tcnNK70LNI`Jk28py_nb@^la{s5qqnygCFlCIiZy@X?7RQ1=G9
z&j>ch$dCq!&tgz91a6Cfb5CAA_zb4vf<(xeIyB#dhMqt%4=q(8DJHc5bXrw0c)<l|
zFb8xeY<w~3PFT<iAaH(-H#7kCY2X{(3qdl_LK~Ev!RJ4KmMnqiP(ckz$m(Sm$XP&6
zu3-V7109lJQ`R8=fzFyKOHWKo0-fNMp93EXGBE&;*+5nfK{|iXHVe2UEe3@ZXwwF0
zI65^Y9yG23D<e~iQp+;IYu&*MZNbYra&k)ZKw}4>?l>qffC~5cwA2)1@Tpa)pd=3(
zGKP2)(sczD6a|^NhKArteei^5Vsc4pQD$*TW^yrT-ZD8Gw7na&TOV5J7C>f?4H%#d
zLm0yd#xMre#J-LZ@vae`A@M$rA+CPTk?|q^{_#GJLGG}5pj5~iN}ygBXf6qK;!a*-
zQBi(5IPEYbg9rN{o5qU@p@(YuWah#OZ%{S_*@IXZ;vWWCaRWMZ#5FB5xF9vzGsU$m
zHLt`GHXH=1lu<Q7j!^<FGzJAZH~^5ww?K;|Kq&__#0Waz4N?by_X!&@Bq5DB`X*LD
z>Yrkib*$jL0I99POM^iTSa9W(Us|G{49fSA#-LulUP*3&UNX2&0SzpG7Z`v>06}RT
zROx}5fu)GC)?nWN&`d4pusYaYMCjtHT+oRz@z9h5&LD|J;4>$RL1WX!hLFwp8Oh0s
z49P{QpqYuJ{L;MS)cB;*GzL%#0~K?qDG0ip5Z18<<pO9?32PaEM%@cCb3q4H6eWRL
zJ4vbN2a15UG&sjc`TM!Xdw9BgFy!Q?gR2Ob5oQLa@M_7_0-S_`L!F&ngM%4z(vm=n
z1K>>~LsJVg=(@&aXloPHga<XJ7!nOK;)^rW^T0b*L6eg4rJ2wkbV_Ot19WdBxQPOu
z=>c`8!3`Af=su|SFfuiR&G|57f^MPCDJX$$H~@9f3_u;U^nz3a@WNP7?OTwN3_V;6
zoW2lMGV&1-(CH`8>^J!IEl}wT>t{leNeJk~DxbvS5{8Vb_)_rMGN4`rcws>*bc-x#
zn*ylWo&g&Q0S)Yf#(zNL^q`~2AXx~Uj-b8t%oK)Fa2K!C%p|_l*eJdf7Lf(1IpASd
za3hi-1GF167j$|AVjdFgJJ9qJqGbpkXoIx-!6Pi7#xJOR0~O&Af24rgw8fxB3-P&0
z4Cw`+eaN6DcWO~lUOp%h!p<516+S5?kWxDZyo)wIH@Otl)(0OO1D>|YNdxV^0jmLp
zJ7{4uX!r%R4jJ4uhb&+7^oM0TXuSa1SqvJJj|a7p;K2+U1Av^z2v2HehR|t3=rK@b
zi8-aI#gGBc%zXF)IPfY9Pyz}|PXskVia^8hpmnE+1zd*UPFhh3bm+_wR6wSHkB><O
zFU5uqx`8q?q%MS<;sSSxfuTV}1cQrf7-*{@w9bb_At)$8!3-;y3c!sbhWON^;$nu3
z{8H#CKA?#PaHkSBz6k34$LAzx6hk&Af(kOw&`M@<Dg%5z5L6n0>O_XrqT-UIMDUIc
zQ0@nHs37%6S{k_R09tkg>4`v=KqrDuf&gW8*dQ>dYAGl#2c3Hu59;5=gIZ$ophhdy
zPkE^&po0}*PJrz50L?Rkt0IO>U*s)Xpw><icv&@Q#IXoG_W_FZw9F##02OrN7Phm;
z0#t8igZHyXM1Y2Xp|&6`vSR=*Bu0%hBZf?PJqn&A0F7HFm*jv;rXtwMF`)H+c#1Q(
zU{`lg!IGStp8{Hg37;qjMKx#;3fi;IPXz5HgB1GUU<ajt&`>70=L>4%g6cHTmS)5e
z3GtZ)ISk;$20FGW6LgLgC?$Y0Tv2LqW=d&d4kRQj3=Aqjv)J&1BS9Nez(YuRW%;0O
z4>_seMrb~G&mHKDI?%C4pwkM#Ne0~APRazWCIb!E<b#ff1?^jcmCm5EIuL9_c%n5o
zFaqyDN={E?fNs=9TEB#Ar7<{rK?;jx@Ngk$^fbOGznq~gGcg|Iasxx~_-JN)aYlX-
z<V3X0v`TPp0+0N`k|t<1H)tFS)F6YM&zc5Z$O3COf?Ip>X!+j2&?q8;p&&C4R01*t
z`+_z-gPLm4+0Q)iVJV=D1YM5;8Tl?MiO)?f$;eNE1s<ru3R)>p%#h+793GMgI?xd`
z+LW80l9`qXnmGea0>pzx^r77f@JbHw5Ds`p26&hav=0=#tOUF`3EJ!`&P-=04*@MI
zhfeLL7ejaW=P)EC7H2{xDT<33a#GDq!0EQ26moJ~G3b<2=oyue)iRm6ptE^%3qWhD
zQggr|Y-|dyB$5(~7?O)YYiScxvY-oxVUb{H0qTN+7qNqj5>S}{4IfZrsgfbdqcq7G
z)a7%Ao|FRW5P@6n;G<?CC+LFO72u*8(HVgiDe0*t;2k>P)4ZTdy;4&c@{+)-vElj8
zJIoi{w~mL7y@B?_g9qwC84Q|$iZc>HlPI}H;4LelP%X|(&rJl6rWTZzWI%U8gF95<
zik~43G6@JO>_8bY#n~x57~XIIb%sDquGIM4^xP6e?FZJM3!0Qe87pGQD0gyYaCULc
zErn-|L<0lR@I?u<O$j-$3e+Qk9l{H4=Yi^8&?W*TZJ^;>@Jz8`qJcTAz671x0om6A
ztIg6fi&DYMIlwI!@RBg_$bL#?USe)$GN@n$9S>R*4_$i*DxZrXMJ?zU8OQ_*tX~@+
zp8@U`Fo2HCN-P1*e1Uh-ftLlKmzjB~<)8&|MTxnf3O)sK!Y}9~$_m)_dC;ICxLAaY
zqr@lWgLcw_cdLRX`JwG0&`EEg!jPdj6+C?onm_?f?SKkW*dmAEkO25ZHaKB{DtXXq
zFxZYT_(mBEhJu{39HaQ0#1e)IP|*w8C<PiPC}s$7_KXj5bqDR44~YzL1s!w%nlDG{
zaWiBV$HU8Ra2$gaz?b-d1_(2Y<Dol~!1AEQJm9`FsHg#TzCc?DKnGuf4l)FfZNL_%
z#HWFhq<el&N@|`jc$N<~cm+B94i>54C9dG9B~Xrr<TCJ#d|?IyxF}R8%>y-WQ&SW`
zM;oMMl!A72C1-*v;-pk)r3X3}E;$}Njv8N*16rquGP?^aA3?jhAuS0|Hv+UY2W{Bc
z0D90hd^SBZ1-{rGl$pT?p28EZfuWJ10Ry~E2wF!AS<C=Z3R##19^X&PEC#LIhaJES
z9b|+yEkJ!YXVAu(<Pwj>;tZesbXV|#6>v8WJ~otA9uFC%1#P<m)%>6{Kp<zhfHo?7
zxPT_d!D$aPRtTCti3go70qUQEYj$u}0IkIVFP#Dz06IJjbcQ!<C^83h3P*lXDrln_
zcnSbCss<h%F{>~%hKB-pp12saEeO;p0#)s>kuK247^u?%nb<*`fmh4`nF0jO9D)yI
z0A(%)P>PRF1x->EKu@CurGHQx2z)Lb#Bk6tx22Gcz_1oPWQGyak}60nO3Y=5FDrnq
zjRMatl@#TG*S13^2SGzSVDEsk99W{5At$FS5qy{^Xr?5u1T+?!TL#Tpu=U>-47tVW
zuo*yDJHWsYRKy|k3>gZb1u$sOe=_($aqy%C#BJb&4DN~)WP*3%gSz72HHNURJIdJr
z@RnIYZZ4>vO)UaNX@LPlMshLOz+%Wg3XGN!s9GpWERP38eo0Y&Hn_P9Dr7;i3z{MY
zcTPYDm4l9`0Z(^A8Y3mi@fl?d#o#Orj*^0+RM5ODY|H`NLI>5|Iq{k4DbTV!IVT=c
zp%lcI6+-GM$fy^np$0lUDA~2BD6u3FG{KP*Zvb9s8V}l@1)Y)yp9pPW0vY8^Ni73)
zu%K$qK*PJBy-f_|MY+XAkOjuj`C9NGA9Us#G{cdR2w9$zlbQlQpb50P!x%9GU|?uu
zY>1p+jg1&G^TEzU#G;Y035pU^=<+>Kpdxmfg4g+groNDO?ZT!@LA~G*P=_=gyf78C
zpFg!Y-WV)m!T>sMxCopLlL|nmpMXwMN`?3ye4I2SJW`-R0NQe22s$(dT#A5tbKs69
zcuOs~_JaliXc!4}04-Rzp&>*!D5t`Y@XpKwr+iRd580m#SvUjgQO1`fri1po!rKm@
zhB%~o0Bv%B`%a*#DzKfPNrcp*`0Ugo(AnF`DWJu7uwE&sY=Kmzpc7zSLW3N^=d^(9
z9A8%#&rn~~sX9>ff{s#wpEeCULkOC@Kzrnz!AD#}^FC<XAmq?<&~e_NBkMu?&2uwT
zj36B|klP`r>VS(CP#z0&i+2r*cMJ9LffXF!5(VD$hO|?_2?5leOUq1$+7$-s4TF3J
zS?&;D%#c!AQW+1K(*;fbg4#%>kP`|Eit>|E<3R@o!206gK!X)%pp&99ljBqKGmSvm
z7<57v_)IO(NHnOfNJ|2rgac_U6@%6(ltbIS;0_9C<P4k@LD3INXppUE$%!S2po6JE
zqR>OA;!{d7mU<dMPZ|IX!sh3dSTN**)_s5)d8H+pIpFgcKx3@1c165Fg@FlpnL#e7
zsh69XR|?v%0!<5`Vi`0am7fQyg`fjbpz&6QlFS^)`S74Qocz4_+|2YM&<LBE38-rY
zN)@0+L~2nA=y>b&3~1LPy(ksDTNFOX1nQiF4xCBJ&o4?!&B+1pI0Cf=pfgC&(P;4b
zt>Eqp$VK4RBzT?)-U<Nu4^(e~3VYCKH>f@Wow}cs4>}wyr8GCU61-CZWt&4{adIK}
z7*NpIXCmlI08q&ZT9E)UHxFq+s6mB6GN@k21fSat?oA|v6Dp(v0v*N<S&9w{PSDt5
zW=;y&K5#z*luw{*qd>i*g3JoYh;MFU1-L>6?@$64^N>-0BT$WMWB}eR2udV*>8X(U
ztW?kjP{^9ABJjR_Xjuko+CtYZm4OZ!1>H=6ltVz_nZp3yTn`y!1|2pH?udZy900FT
z1Pva5_QX1c`-J*2_$FqVK}+e(JkYQPcv=opaex|7$p-Oh<_w@~FA`J0eN@n%uK3i7
z%o11|9uyCtc1}?VXzUiWMi)G15AG&G_BO+}*uhR-F<^kV_dttN7(ko6oIRaNiy06{
zM1v{}XkDIIP>_=vpPQHrTA=`LDuc>~ocwYl@R$fFNI;{bi6tcr!5N7u`Q@Ootkj$m
z&|=B_c=WADpar!^Jw_AIah=JalX1ZZ&VgHc;N%Ala6>aQ=uxk!Dc}=@VJ$e&5IlIH
z47f=OF8VP#gh(6K!PBGAL-)aJvmpz*K?`x5U4rs+!6#uuw`GB91+anHWx0^_0}5mY
z(9y4%d5JmkC8@auDAk!U18Bo>4)jPF&lJ!l5TL2eB;=$6t~bpfYcN4;h8W_VLF)yO
zRtkVJ255y6XkQVyeF>Vv08hVyddgtWf~H#_-6zPs3*eDO$lyqPN^T+pIQv4D?m$l9
z0lOTuya+V70jiFY;$bIdLRxsBE*<Q+4A31QMJ36g_5?U042&U7Zvzv^bOWe;4C-5^
zLWRwsv^iSK&d`j(6?Er9a7kivc5rGscpR{}iUGQq0DhZ<TWKEnt{!kDZfF78vR1+X
zoeKkvFcvd-`aApNr+en5f!7F@WF~`;Lj)~%O9Y?K0zN!6F$El3pg=+znFMVgg${Ls
ziUm-Wfp#ELkgKChK&X?eH$!GV$e@Bs22j+-gBMoA2MQum^B7WdlTuSs5Q_>xD|>Q5
z2a1AL=7X1hK#Ot6npTh}K({nOX6zxO$<F?MZl3N8@$o6(v#-)Xdwf&#KxTrLg%*Qu
zya0uK3N%PzL7WC{WP=Wn01bpdeFR&-4?0gDQCb)#Gn7MWSI__ixaxIw3U_t_EmsEB
zb>Lka;FvWugxF(f3~CL6E?`M4P6bU{fPxCNO*c6WT=r(>g9dNGcMc_2=737?<V4Ul
zABo^aN1(1MXni7No*7bk=BB1(CPIoT(BwF1dr?FLWHJ@hIRZrzLvn6GKv8}QXl5CF
z!w<N10jh66IS*tnXo>*Trb6mSL+r@R18rnTDorysVgT1L;5HlRfW6cd@E{m;=@rBQ
zImwkd#SF>dEs3D}jZ*VKXY+x&wcwTlXsd2sI>ekjP!W_^1Uf++-2MW$Ou=Vbf{n6(
zEa?EJGvCAta4XL_AQUtb04}#6t0m(hSqik58ax^go+1OE1_Sa~K?!K8x;Wk_nISPf
zF*6UeD8n#`0p2u2>o<U68&QckXPB8VKn?_lR7)TeK|ut%0|<5^J0x#{0uR*0$YDqZ
z9g$vA1Zr!6hPgo!phN*}1j0(#M9{b>WD?Ra(ZGlyBRLZ`(+AoL13E)DGZ8+$Y?x?Z
z!T>5X!a#RMcqA63fciS{;xN$w)V7E03x}*ZU;vFqgDOT)OP2w(Gy%NZ6x5CYbukz~
zeGX8{OU+3x0*@^tE$W2si2zkb;MfIu3mhMyUOUM5@z5e2d`dSc(Sw=+prS554LZRH
zUYr0*Ti~_~XqpR>g-~aNKrR7wc0kKBKzpu1doUS5js~BH4q6ZiS}U0XI<T;ysK5|(
z#Rw=mlM710x3j>e20`KC<l+cwz(RW;B}GY)$x(0@6?9@3Xk9iW)hENY;~=fm1uvz9
z&8`=Nw_Jdiy{3Z7Q)slrm%v7@AY~9#7+i{)fX+ND&IGM9%K>*QGK&fg;z6^RMWFi?
zK#3{?<YaI?4ss4?eh_k68R*=2@R{kLF?!Gq6`56_i+?~<F{vpG;33)k9LPW%q#KhA
zX_$cylmta0WZ^8RL0SoET|ql}px6UXzZWxr&igJc0CnKf4UIv~JhX)?#Tkjl7U07+
zp%au0ptU66!+<~+oTa5fR;a{RGUVl_r&U0FoXh~4;Hv}&6KG!sXsHxzm2ik>aD0fT
zud9D(NIbZ=<j8;_<b)~Yj49;8;Oqj<_TZY?&;WEwC8(&1PfAGx4XdT)F@W}Mf)<Y>
zFBSo{{!2isYbr`W*$&(UgihV0fDb<_f%TpWQj0+2q@a@{DnYXgpu-|dbHRrKf?9&6
zCK#iQ0YR>AzOKIDP%yQCS^_G#pcCmS`FW|JIu(2!7N~g(J|z{@L<H?K1f57wkemS-
z*8`2{!S+RmfKn(ZFM+xrki2AI2s!8sTFZgP${~>tE*8NN45~R{1r4Z>j|UZJDVfE|
z43Lg7xDGE!Oo=x%Fo1NV4a^yeQcDsu^Wrl>SGj>?Ou&PMh&&8h)(KV*I#@TpFatE$
zmYD+T3WBB=<3ZzH#qp-e(D~q;Y;YS1v;YfKBQRvZG6v{EI7lrC@)p8)*zQ!Ydm+UF
za&?%K51zp)$&UxE$^ehg!McN>MlX2hM@e#gaR%7cNTCJ0xD0f!738`n&_zkbMPTP;
z7JyO^c-S4h+X;OP+1WqTF9hj0w4l^N(0)ON`1sP4%rej(Ake}R&_FmiN<lXS`lVKs
zxVm7Z4^Y~GcI!Z^62V<zaA^!~6oP^R;pWs7W6+E&<jxrA6)YeXh`<7^yar9df_lY}
zAwtOPHaPj2fe-ZoEv*IZvH@+FG&F$?a6u<i3i3fq;~-~yBkTpOt_Q_%aY<@HJg8sG
z0Nz+&U<jp+p|lA@auR5tA4C>>-AfLrj|Ls-02NuFmDQkDH@I>&V#omv?}1Kp0c~AR
zNkttXfutOB6L5tCOD3RfW^Ms#7@0XjiZf6(3&{hpLK%8Y0;u?h1ORAcsu)r(f^q`%
z04C_3edx$*KIrs(&_ZVL$ONb_4j#vVBudcmDyXgj4<&(j4}o?L6_*r&hW8;OgP`e4
zhQ!3ol;jcy=%O$W7x0=eP{|A0Jq4=bK<#sogBem%)4=r&c-cF6(-Lfo8#2rS?(L+e
zK*JVBr-Gx>9P8q0P#h&gh9Jv87t?{q_~Q$}BjB0&;6VV0X@<s-Gz1=pLF6A$do34s
zQZ#gx7AV_655+=FYVf_kpw(gE-aWXj2P)b?b3`SHkb{~)@nr#?PE5<JfP__AKIo{u
zw0!WSZYp>{ssyy31a$2LIAkE3%R!s%z%?M~3>#2wU0Tdg2%g3QUj@kk-HZrc00%vV
z1=QMrH19x_JiNyQ)`Sw}poJ>1iQ&A`T*sXBVsOy`ieYdQC_X+jJ<kwyBoJt1fB{^6
zCgnha5PU!i_;@zx(W0nJ`2##6gFT%cec}UxT!UTxoL%F6Jl$MD6<oZJzq2>!bUE<m
zW^n9)28lpB@=FSG^9w)=u)yJ!%m5l_G&BS4WiT{Atl0qdk06t3pgu}wS!OY4*?0ly
zn6%_f*a^1a25~X?=xheqLPBt=1=R+y%?zNSb8z)t47<`JHH9HJ2UL@%mOutepsjRJ
zHwuyk(7W!?V*}E`9q7y=(0a*YNUdQA8Zb!9FJ{Pt?B56325QtoM{=O!-=O1cpeKxi
z4upm+WH2-XEndq8wf#!sVF$NBLf$7eJu$g5C@~k5oxue)XpLq;X0lO!9#U@>y;Oir
zXQ4)%kqHB+jD^iDgY!Cga@o`08M^Eb)Gz=|H-h(2ftD(OG9TnX1<?2hcySWAMFAa!
zLGB7cCtpGHS|P!~um%J;wL^wqArsf2__oB%&7g&w1_scD8=z_#>|@xxsEf0&3-snk
z&~^~et|!PTi=b08!NalORu3pIf{$PaA6*^~S^<&|8e%KRgbdW7hZ8JIgYM>p?_dVq
zvjj~R@C7CC6S8656VNr02(}UG$`m7{c?APxHe$Zpz`z{dJ25b@U;r<S1&!(#6o7_j
zp+*<yW<tg|;N3Au!UQ*%OCc93LY8GQq^4AWk3}fXw8&v_&PdG6^M~9j2G<Iix`C{c
zhpoc_U0(^>CkkG+#SrZ48{i9B+zA>j12xhaiZd-rA=v}mABJrz0Zl?ccke;AKEQ7)
zf=rcyCzzpELV<d;$>7n4#9Z)%Qwr#6mC`)$p@&BCptVBa;WF@&Ll9xeP>@*!Ypv%)
z+A8tj9a^CD3tEVr13rffw3`jQ^eQDE+Rg-}Hqi7g{D3e}vFPIH4DR?AGh`N*gAX-=
z2Ct!kK_XHtAfFBazW*{c9&#!tsDpr{4t}x-_?+Z|T+r^J%o6B$D5&!dxh5I1Z?_mD
z%|W+Zr=*raIxKL<Anjl=Ff@cNKLKx>1|2VqaDbsPsG|uQKLFnm0t((d@G&l+d2&#l
zg=omY_NGBbfIufXfQGqqK}XDIqdN?CJOR8N0GfLM4MmnE<`{vtNyR5+mKZ`u@<F8m
z184<jXs{D#0vCFr0OaI7(1;9L*=YdYBWJ*nn^=;Z;Z#|Y3Yx45_VEwFaw00I6Aqq$
zhHT0L4G@6pQA9X_Hf@2|O~N|J8KsHIprNaxM9>04&~zuLg$O=~23!h*d)eU070`9Y
zAR$nt0(CP3^xzv%Uoy3#1T?e-+M)xh1|VaW(AFxbZ~-l}fOeFMD~loBaB#u|HS0hJ
zrhzUL%E*L{Jfa+H3hjS^mwG}QpWxN8si2Mn=#mY{7H81JE!29%kz<ft4<2`cq#4kV
zLk_srR#Kb{YW5d_`f+JRsf7#$`JmyVN|Zbcu6Y?i6UCtB256OgZX)OgudLEyP`=Cq
zZG!_H902Mvg2wt`g*T{y4h{oID;?G-08ixS<>w_s_5+lIhU(!v!60WtfbS0iok#{+
z<OiNs0S)1TXPUt?^U!^Sc`1;ienIOAz?~0hss|5gLAT9;r!B#2lOUHFgH{TsRxp5f
z%Yq!7TMQXBhu^V@Tq!}$p+r0V71S!tC`g2*X#?o2Q!?n7cksNOA$UX%J}VDi%mIl5
z(BL=9nVX;%3)mpg73|>Kh(Xx~oNGZ75ulkvPz{s~8Y4%Xf(dTsp=A-+Nd}-n-`oOl
zK?%wU;3BU$wFErK2wiat$__}Yb3n(P6{Ir28nEE~Owg7GXwfw2kS9=}g8~b(9K0wA
ze3COLF+kP98d{(>epP0=5n?JK5p+^cMxv>q5z5gO1)$@KLAzs<z)daaG$6RE0SRr$
z%qe_K3FKMuU<l%RNJxl6PM(EUxW&ndIjNxj1gPB$uF}C-7nJot%lAN&44^}IK&QqO
zK}H-wBdDc$(Cr)GMJ~nV@kym6CHZ-v5na%dJZQTP)Kdp{J-}B%!4F3^F$Hz&Altz}
z)dwhRfxVQOR|v|CX$-~So#>!^5f55m1-ZilREWUV41&50pm0PxpcOQVofw~;5315Y
zJHJ7#JkUMwp!0~q2^_q{4je*|Zhm|c_y}Hbaw;x`9J^6cl%5PaPS6otMMGCsgSNjI
zpv@bAchUxXcm^=QlNl%_f(meOW-CcyfNac20^Ors1iJbQQtM`vrXcQtH84qoOx%F{
z6rTv1n=P))P0G)KR>#m=eN$4)z)SHVqbM%^LExKT+(5G`pfn3ED8RWMv}y~KTET~}
zfciC{bBICt4>~{v>KYe;#UMM~VCgU)bd@!D5F0dZ4eF(Ujv0p^>R*sk3A)KBGYvE-
z1=<k-TVqy~T2fjBxp5wJnpSaU1vm~f(?M6nfQvF%mkQBhC@lch9gr-GdCV@PS)Q4a
zlM22pBpz}<BJ>XB)QS?YK4|iV_Sp@=Ep@O2c)mX$bQf$Q=rUXA%>|%o59mSIpx#bu
zUMZ*!1$A4&qtKw`YT(H@P}>52z%;b`2OC68EdX`0AvZaIk0S&fH2^w2APIJb1?c_*
zSf>$g3bfb&PoG2Xzst#o-&6=XMLRh^$H>Ug(9kd*bcaN0dM0RxCaCHMEfEGC830;*
z4?4=LAR|9DFS7zXZCV7LU;*8;4qD&~+PYDYR{#x^L{OawZqb4I%M9s>1@WL1QIwwx
z8XI9K$<I#BLmR6C4f+_sPW1-mzKl%J@D%7I0;JRlIw1yp);#DKiky7VAP#7gKd7h!
zo%jc1LneelYjwdbSV*Y@TJ7cpzA+xO6gsuI*eAanYz3%*haB?@9npX!amc7fMrJXj
z{)M(N!2`%S44@%RPy+y(q(F1376$M(8gySFq<@+WzW4~N0(7%9IE8~sH^h1)Bo(F%
z1sS02Bt?nk;PL`|nhUh&1q#bzL<<3y)xnK?&^{R09pRvptct*+6_7Hf7__*u9PC5z
z0t4u20meoQVVQ|;PGEaLc^`2mAGn_g(F{vXpa!0^bG(zIlar5Yyo+myt25|25O6&S
z%H)t`GN95lGaq!>DrjdPxWG&TO-X|f=!fjxhV}1!T;f6Vo(#@TpiTv-{fg9nfy7vG
z5$JTP3{V3OQqe)L<$&Ix39i_3^2@<{8=zzSpnyecvEjP+*~iD<*)hZwd@n^2XcMrf
zi*F+699c+t0m_n~q3=9UBc&KN$pPOv1g^><?dx1naRWUXKPfrIC<%0GMrM97ct{j!
zvmt2LC1}5KejfCaZ)fNDkRT`MX8!Pud~nXqEKUS15e9hzyjB*pwIM$b(jNp3lY^ri
z)PIkM6h^5j@sM*xKxHUsf*u+Qkl@4NdGL{H@d5sz>vw`ct&7y6c+kK!sJw&Rn*^?;
zK#dU4aWc>)XrKfFIYtF`8w$vkpt=@xco#!(YF=?FBzO7bmxD4GQqHgh&C(WB#usFQ
z&QAcJs}Aag#zV_a&>onQ%;cif;{4L0<W$fNX}OiKrj38FnF&K)66i?xe9)O@(3R$C
zIr-qrmO&@WgYMFTO!38o>RC`f1u|*@x|b4Ucu@(seF!@j8+H3pQEDM<?I)<g0^Z6G
z8)$_b0}PscEJ#cNjZ{DveL@znfa+*)<^cs&JamyWcsL`q47BnB6l0)`6NrWPpb@Xs
zB5+Ow9e57v(}UOO6oXGc0d?;(QWGI(je#yt0Bt1$51+!9<AZDh<>sOi@Cs?jAQNag
z0IUp#c3jFp%h$oHX+fvcK{ww*PIP5RNzExqL@Rw^eKnAaKxe;z2MZu4CZUxIkkkhr
ze*-PRFD?eH8V9W-1NB7WK_lZO1-UNJ6?Whm9B{u5Toi!YQ=rtAnht6x$Ag#5Lg#(*
z!50U|gNBMgXJdozF3-$O1y5~&HhD1wrskG9r=`2(COSe|NtvL-%JR~X3Jpka3e+k?
zI_eZuHGo>d&{i>;zthr^QbBVGkh8)e1wFW_Qd%6JkzZ1fQ<@$Rn(PK`(+LT3a&`v!
zG&Q#rQqe<?a>y&G0BvLiM|W-_Xsc-&=uX@GyfV<8XeIgapvzvNi=x2w5%_jNaE1b9
zXvmURNRu-sA2ehRu6ZDKfOb5C*55-)<lIE)9?tlbe6UYIeO^dnO-ljKi@>^Zu!ZNK
z1HwQjbb^Pvz^Ny#C^I!LC8rXc3Xwt&G!6*5?;14B11iSBjbd1O0IdiFolpTyULg6z
zoSb;*CTUQ453Wf;eo8GWf=<Ter9w+C&@H;){m?1UbE&}REEXpgrGv+S!7hOw^8wBd
zC}|&byc|PDIcRDr#05672hGBndGJLIpaur$ej~_eY<wcP-<g+R5}#CD$xu*IQj!Up
zRtEKeQ;NX+eE75+v`PmJqacMR<dzYJq{O1k6lfO}QVB7Xfjd#TNE`aV-Ez>#1h^Ul
zohuFBYXj=3gPPPy;Jv&cRx)h#0lESdVrqO+DtL)x5xDu71UXqAT#G=4mq2j`J+h`4
zYzt`m3v{Xgc%B<{+Zm+HE6qzuEdtem;GtZQBG^=63N%v|gKPk$i_{XZ&mqSYf-2Ku
z&{+Wt$)Ls?==@8R``tnEkaK@f!wFV$fN~Akjj(1za%ph|LuNi`Kt3}ayaE8y%mEG0
zfwFl?eo-o{djy()C<d=g1Wj6iTn}2<keLFSIRJYWyg)xCm7%yCG#KvW8U~pGhmH?{
zTGHSRQQ+Onp!HVZRSL-v|K%_grGiUR=z(339wm5a2y}FOVoC{UDI|EoL4FbFgiAw)
z<fPmr@QehguYx#U5<JHOOK9+kth7YX)?|oNilDvHoW#o1BG3sBCAr0rfnvnKkOf0Z
zVlueiD9J6zi3fG;K$#~QbX;x@td0WT-H@GHnUoJYXq(XFi$^&0h9OYl2fA1xwFGje
zXMAQ}aY<rM4nq!jRv{kJXemg`W2gYd0qo2@P<sd3bca^=;HnU^U@SPm5uA1*ryd!_
z=N2=74%Gt{s-WXYLB~Xa(jaK@FDPk%;tRD%O3nqfhYCuer?rCGDWCxz=wi{#;^Y(t
z(C$A_k1q-20Z{3knOX$eF$G#qpO>Br8ZQQS&_M%(;Hm_)Z5`6e0gcp_7Q`nSAx?~r
zHw0BLkc1cysb7*a5<yiJLn-K}eQ?nR+vE<4Pq5jblnQNWgC;Z}(<9&;zraN;!e5}p
z0H8`EBPTTzbiEwdL5V3T;GIpN1xh)o`3&IR5y&^7Ssmz=grFV>G}D6$R&aF)KHdd1
zk_S=;I<W&ZN*dr8<ml@f;u-{PAA*uBc)3J!4rn78Xj39+1q|r^t$5Ic0XVimr4lsY
zp=B3z1u}R%1#)r%Y%Cw7)+ZI(vV@+k0BU-q7D1Nkf~s6_#g~(rngSi#gl(5GGJ&k_
zG%$qHFuoa-4_ZzEUKRlAp2mZ3KL8IBA+HbvMK)wTQW5BcaL@oWC^13Tb$|*JP<5J{
znhOqGP_3Dh3BUTn2;O^jGBh*r0j*yHbvHnF9fQ_*fr@^R2O-lE$&gVgcoV8PJF@^h
zLu>%vddvVGg9P=?(?CO8h*f={1&E-YA?WB1(3xBy=Yg6=peAoYX0e$GIC7ENE1+X?
zpy?;6G!3*rAGYuSJOB(`><c=23e+YkW`K>ffX?2F2Q6s^ozM%~ik}F&co%kR1!%7T
z=mKAG9SbhBK-&^wqh5LW1q_J76I5`<7Z)YNvlDE_89IIq%AUwITq3A_3$5Eg^J}?@
z70{iEpmqP51tp+z3Dg4zXIW6?4xf=QF)#!#<^+{vpp}`R;S|t`9^ga+YAu0=Gz%)@
z!86z3Z7YzT6|{%#5)k5wI*I@}gBDbgg3gXeNd~i0QbA`n7DIQL`WBR+T{_1A-faNt
znwAzP8AG<&pf(=z^Gd*J54M6DGLi?m00W$~U}Y?1P#V_71NAUL&2i9hUs+~;X)$>I
z0@A<)9aIcTkdTTpCm&*MN)kg!QE>*S-S3=O5Dbb-$Sgf*&<wIv5R{@oMNdv~NfCJG
zGPrXOOTF;*SD=0sbg%&&-=N(IpjHH={EY_>f+MxtiovZd$jup`!VOX?B3Jw+`Op*0
z42?~a7{E8#`InXyl$Hd5A_~+=g6^n+wnQ?(8(<4yT`tgBb?`<kWYI2YFFx!<dDz$y
zct`|1-3}f}2VLcop9?zX9ej>YZej)KXldABY^nkJ3M+U^JRfwv6sVTZ1g(bvw_CyK
zKdC4+F&jKS44>Wv9nqOwPzuUU;FJo=t_;xgy^=CZ7?R2giZb&`(omK~fEy{GA=0wU
zlEfTPIRU!N4|EtOc&#P4H~_8Mf{lG;!taQL9u)|!AtBWZ=zPGG641p9naPPI`9+Y%
zRB<8XkV?qrhvZyP0#1jW?3GiR2kN!v!VX){&jX!$2Wg6d3O;ag4R$5W3Q*q#l<E?5
zQ%gY23XrOl)H2A*7SOt!q9pKnLZC4=aGwgi)ePEJhej$SF@lmj=oaC;bcW27fFj6w
zXQ0(O;DJR@qJfVZLbW62gCO&$sd>rqpb=hB*n`f`PfSmZ&rE?`jsRL~2U>;;KKLEB
z=mvCnIjBMgZ&QWjGej#Dx`Y6_cgfHMG-e8#H-aQ%r~LeqAkbCqpyOj05{uFe!6(*%
zXG%ap1iB)pthl@cePS~$4N|rxfmW<Rrpv*7QE-(D%DkXmIiR*CXn+S)kb{ojOa{%U
zfo}c=RVJW<jRBnIz-2l^Drk2esJ#u^IUWx>A27Ex7u0qDbviN=iwomH4H57%E>Ke$
zw1~n0n#d6?2iVa7nRzA9!F6!81exxJXt4l|=N88omFC44BvyjTA*A6?Sd{@EoR5dE
zV}V?V4Vmf(-@gs%L4ex&X-SZ!5b*_>6{$I(u4*3m00;(9K*U44QidozBTy^E&p$rE
z)6YFV$Tc{?-!B+;v=yix05$k3K`j=rhe6E`(9$AMB;}WufI}KI>Id710v3Qy?Lk`^
zppjZoSy%)a2S(IN;CKUF?+)5&UXoFiUz(l)YHEVgCTOx7bfgaS;!V&=Z=j>+@{7Qg
zMP52XPHI{S17z|7yfhr-LeRlVkhS6QpuOdgqm#gMmH7p*K_>8U2dJ}=m{yWn1iA?w
zbT)NvL3}x=ACQlH{zhtwF=*DD0d$WTM!z8-vj{x&1<gC4ZZfD&hE~6zNh#25GbmC)
zCvv!_=I4UaHfS6P(s_f-)Wh!_a0K1C%#e~=2&qQ1!R@|0P-C$aK34*2NFgov2bGzr
zphFx%O9a5xXHF{kjK1QOB+#4-NWQc<zOXbg2YiGFXeCHRei1`*3g~2gP}d1m0DzWS
z6l5}#LRL0`<|aUgH5Ng(w}2X>kQq5}xda(`180|lTu40y$-8NZxtTeYpr`?7Fwn?_
zA!Oe^xVfE_lbu@z&RfNxC1~-GVIs)bPEl$uXkP;SyaG^_2wh7IF5e&)fRaS9aeNWv
zARW;71$Z5kVKTHy1Ddl2E$D|fD#0UHpvlf8aFY{Mh(f0@L6aAt(>e-Dz_C}9T98v2
z4?0*l*wx+N%`HB}Ki<v9F(e=)2(<Jovn(|pG7%XMn(5AtFG>aND@Wb{0-6v5?M(#x
z$<VCA*a*@{$OP?TPR#>nwc=#(swxK1x-rN_vMJ^HMW7LqqLR#f@bEn(o5q7$!r&p<
zM9?~3_%1q-_d(-FNy%mC#UDHqC4&~==cRzc2t2k5Vu03mfy{(mEe$FH!TA|937MP=
zTRjId9^C#YEr8E!fLwvr8A^j*MG8p<@FmaSOK~B?^@st)G|)*6kfB4+jvY|x37RB=
zbgLn8nhBav%>-45kS$O}sp*iwNi6`KIhk3KT9lX*kYDVZSey-OUKbbSWR`#m6GVjr
z+RK=l2Ra`+GX<g_RKY+u;X;Z*aOWFz(lSGOa<Y|zhP$(~rh=iVo{^rRf{}rdsey%o
zg@Q&<YKnqKVu^xtQGRhTR9e?iQy~eoYc?~d*h&F9h^=6xXJVpjsF#*(Vg&9;fKJW?
zrGsM7IYA|<#U+p>3!u^ywki`cW)N?f7!kn$x_{o;vnU_byM_+HfUa}^^~|BW6^sz0
zX~p16=)l<s)FTG10Rb<r%*<oRMA=Rao4SB@{~=)vzAgmP>4WyzQW(Ien1fp$paKPS
zT@3?dG`^T2DII#sWNt3#sGow=6!4*Cpq>wCcm&i}2JMA(%*kPhPX@JiA*cR<b~k~x
zY{cgm#2Z5w62#}_LuV+Eax_w53ECb4s+CdC49+Xdg|#n|9CJ!ii}DgnQiD@VN<cjY
zP#so~3(8EO&13nX0l)nG5^!B=0zUi<+;4`~I-rUQX@DPgtr)!MFiK+pwLZ&02ic;Y
zFbXgBktQ2pqo1Iz6Lhs%Sz?YMWZSJrX_9{dXrE&uc;7wf$Ow?1q04|k7bn7E-^9Qe
z+&ThPkdO!}OU$u=#0<Ek0-aa{ktoPaHU!;S4BKr4I;t2kzXrc?57Y?;ukcN+C;>O@
z5VnG%5;SHSp9osg3~pV6YAJ9N8r(z#Z%T$F)y#Z`Qc#`Y?1WT_fd($Xiwi*Kf~4n_
zCdZd0LgqQkz*^(e8S+3qr(%XQP?dsp!y@<)N7ztAeohML-brv%8C)X3OMQ^TkZi_0
zalpsl&mA<`S)5-43Q%b89MT7Y#5iQL9;l%JDP%xrycFa@CgW1T#RaHB1YIQx+IS1P
zUoyY61iG#abo6U6_)KEZ=48+`IH<m32sRD^S2$tmiJ*L*1FGB%jUW@N;1G-l9cBS-
zb;BDLNvUa|@y>!G(1>4Z9s_856{L9&X~l!w4vGW=aFl>ph79=yCGc?p(0n&&93Ncn
zL26l0Mupt3SCW~O134ZCGIs>36+kNsz&&4haDtK_V$K<~iWXFy!?u}&TSTClP^e%*
zW_(d`N&)zoUq~~mC_g0;+V)5Sl~4@e_2ZDKcF;wCkX9^cBn8wm2aOJZdwZa%Nzl?e
z(9VNQaMcFdwF61d;8me{@ctR3X9O9e1Xtdm=@8I$ub@=}py5K$g+ib*6=VTqFdP(>
zkTz&uW=STv2L?Sr8Dayd^9mXlDoRbwD*-oBQoz@p=EEkG+%j`g8A?(>=?7Y~8Ztl`
z;G-N0Qj1C|ArnK;3=1twL7szD-ms1`q)3fVN(R-p(DQ5KVH^2Ci^0Hm#u-9xa5I7p
z$wH2{2hE5;+JMeZkTxxN2^naqS!z*HX+cRmC{4g>Jn(=LsJ~GR9<hhaAjN}+9Kpeq
z3Tll*&cG@zfy~T<E0T2ZA%!Un1y!Kq4nRjGW~Wwyf)F(O0&e(%%J2AiQ0w0{%+)U>
z9(;fe=xhz>NF>xM<Ol&Lm<-SYeQ1JCs)Tg^K&{DC(00M(68KavDA5)&ATB`yg*#}D
z6f`s%1U~aG6@1DmXr>h8LD0(mL`d+1+MP-9Mv$d@p!y2b4F#<(%}6eQrb|fo2bSVM
zZ9S-aVM6)fwhTBOfVPu@M*Cr5nhfd^f=V~==`Y}ES5TV*H0}mo4+9!u03CP708ad%
z6Z3L&LA$Q=lffMaNFxh8sR3&BfvreMO#>}m2W3Z4#~VBa2sRU3*ntj-1)m%Rin1ce
z%oOP8L(nK4qRW_?0=j+909-?WyZYdR^+34;(yawWRgi12e`t_1tb+z!b_zZtIxio*
z)33ZJu>iWy-vxXYX%T36I~7zvfw$p<Mh-wDcJT!nV3&itrJ!*ENMdII*A}1!ZQ!B+
z8rslxMUVy4kns!XjR26m2RVBjoIF6j1~*qgLp1r|<JU7wKu!nUB<|+v=jsAYU!d9_
z<ayXUCd4F2yh6*=l7d{wC<|y<2)sw67~BSD$ji?IogmMU2->6vD*M0#Iz{=ppmEI<
zXD9FphM+PWG~5NsSqz!Epy7+sJkVBuu+JDE%Lt1h&GmfHk%F0^te0O<Pzf$(z_+|Z
zhV!7UbI`~U`1<*R98f(5s{6o$N}$2_#1aP35pZBWxD^8~+ZZ6@h@g!;#pR%uIDAyq
zz`zuAd<?kEVMqZj>xbOHn+KY9h891D1_qW4xuqqb^|0Xc=D_1J@u+7)2bUC;CYPX$
zdx26RXxIx{xPglkNPPu~z|>-pjiu1)46?ESv@;g8VJEW)I$i-PCyGEbJ>^BPok!r#
z8~iY;__WfT9MAw@W(p{Jp~tAl2Zsc?I{HF(zCsSAPDxHmOoW~k171V~Do?>{j=}zc
z#XoEw8?+=4QdP%;_W+e-=D`~t(7Ti%r9^IONg^n`A%!WZvH)v?)E1yTT%1~BXa*iY
z0$t9Nn3)HeVuKua1omGg1892*ILCn#FDSD?5<~%L=VWpQ=)`wu9)KP!3m)bMhbB0s
zLx%Q17qP-84~t<_*N`=Rpi&34x(2d76Et<qPzJhKG!^D?&>miJaDY}>fDb+g7aE||
z1)x4HtUv>w?hL+Z2h@UqP1D2A5Hmy^CkEP24?S7T7(DHsS`-hikU&F3@u2hgL9Ip5
z3Qou_Y*42dwzUd$vlFN!j?c}{Lpp!UAO(IcrGXJ-I3HX(fvRWFutjNVX)5TPGPEwE
zfg$8BURZ)QHBXC(05wW8V9S;nQa}X~D8+)Bv7if7AXyH2z%^(ad`WUaC1_$7bm#@j
z*a6g3(B9Pi0!Xx_W)>%Arog6FA!S)+KB(san}ANtDae4Hun)dC23%ZcBqtYuj-7*S
zAA?Q}AbH;q)Icc6VMqdPS}w>*%u59w&6u14o{R^Z02&Z0iucIR&yI&Q8W}RmJyH`>
z0-y)LLrS+a(A^3K3}DKTA*0;W&&{6!9NXaG2+)*JepxDLAO$qg3QlT}sdUhq!iWfl
zq=51w|2(6B@*?;A{1mjnPD=w_%4`72r7lI8WvSp1bZ|!x6ie}-MlQID%g-y0&&+3l
z9JdLs1B$^bz`-j`N^?pw!5vp{(F{6;&<%PDVSZ5wczrM|b%RxbFQEcerMbnh8`{Bh
zAE~+EDiG8L02O<Q$)NTo<itSGXbB`Vz=Ir+mIMQ6XF6ows30)~)Cvc8&%i+oUeN^|
zbb!q8<>cq3D}V|3sY0Lu!{n6I+|u~;GzL&Vyf`%(lz5Ueia=vz;4O*}A47-eK#oq$
zE6q&>?*NAM86Xqmu#zD;6B=Cc&;#ZnLnoknP(bYw(6BhDp#mNtgP*Qh$&i*<1ZvV4
znk8kXgF2^Wpi!6<#H}?3hDqRagF%;c=cVR=?gT=tPlt9iK_wFC3gq1UGEg>UC`io#
z2Sq`0W^QV(nF*vF!2s@xLboF`K<jAmym35eRTyLt0Xk>_P7Kg$6|_362%LBjgR!vf
z_KC^KrMci0&c&(epy^Y{?bP681UdQv)|*So2VLXCP*4Uruc!>v{swhdp!pYay8@_>
zm|70bTOb!e91p4v%fJmekUu~z{dn+Ab%ti3<=l{)>cGpcKwQvv8Sp|%hBR;o7u04#
zI2*Qy9A0fPfR>mhmZU<@l?SB;R2{J0-=G0O(Bfxj@ahjpe*|>Yx2d5K_^@wq@&-?i
zgKGxR7$P*Of+8Ps)FkNcEa=7*Nb!ScQ0A59x?~omCYLy6mJ~Cj6c-dTz>YzKW^d4P
zMNnrBlITE{aYlJOcr9pdW(laIh7ab0vqN!iZajEFO(N);`TT-PhRl4(<uI9fC7F59
znR^T9@!5uE;P?e)V(3DF6v%N3Ab&tFxz0!|h9+=OkrAH?x^W29cY$~_9@J_E?IXx2
z1I@-5F@R^aAww$QrV+d;lbDpm02+q?uMGyxhJsQ-Q9QVkP6eHD16~IW>f)o^50zh9
z0<LaB6?bV~L2elXcrAHGCZs?FSAU@65MZ;8prNIr)I!iy7Un5Fpd%bXUdv2DnnM8<
zdq~r#CHe8-b|k2P0-vJ7P*PNo2)_3gH1!S|8Y%%zt})~n$Cu<MLznP_#&JtZav)2#
z7*bLTN-{tzmJH26c@%W01$eFt)CL7FHGp1X=j<Hs>F4b48{in?30XxQ<_T}LV~$Ok
zf)<%TE`Wr^ppgkEfs{ZFZicj2LBmF{)<Av%=n}P}a>Q;q(EMk7X-S#|IOY*qBrV0j
z3}igWNx}Zk9`R10Zf>qY@vyT>lT*qKASZI7_3R+UF}To!v;aYUD9Bwc;PwyrTr6-7
z2JJ9|R3YHmNpR5*Y8`?0Ar+^_r>ExUG9*HBbb1;Ccn1+Q)uROkY)2z_L^`!39ySXH
z${k=%Nl{`Z=uF$hlElmuNS*`t-=Jea-~|$(LN`9qf*~ZaC_S~r(*=~e-JHPl^w2&c
z<etym#EJrjG}w?Qc%%!oj{tOlNPb=(=qyX{@C7JE6Izw!?CXNGEGr&5Jdm53SX^3^
z3eB3JGYmlMcfnIT;FBUiqwugn8PKQzI7J~vaB+4i=yt*+&^p?ZB8K8}=-?iBdk5q|
zUi9ezSb11vW&-NNL3dSynrhH{x{8aEK_v%hcplVg2Mtc8!HPuigbT`|3TO)pbgw)-
zyPFvpBC(C&Yy(3>BV+h-9dHo=sR}^lia~{i3D|p}99WcE2s$tjuG0+E%}E3eALJE-
z*3;(aq<}ip`8g>m8Q_8tw8h2*&N72kpSdaVd7xuvN)o|`^kMB4LAIZPn}482b8%%c
zXaKzcG&x$#P+|ZcgoKt>pk>vNvl+p|$dHxEu!$2;6BE>P1f41X-fkJ61}Z6`<Jq8D
zK5)Ynbn-S-EEm*|b9Rmo4R(qT33Bucc60`xp9<*`fexjy0PPG<0w0zJT`5)qnIX?L
z1RuE#E`l<V0x1zz#e>X_hpo*AHJy`6)4;_Ts5is_Ssn?Y3>or@GgA;|7#bq6jlg4C
z;JX;W*)~44q5v`!m0DDk4=TXHw^@R+8*0&H!BAWX9eM?g1%b+4P#p`ZY#6||wq_=S
zugZc96hId+fp!$amJFpr2QPELi#0*hC*a%%TFq6GnVb!-ku$-oLqJ`Tq|_q+H2Bp=
zpc9>nKqKQIYe7jE)DDAO$7^T?t6D+j2e`a}>_UKz&4M~ZpmqJ}sgOQnK~ZLIVo@b{
z?JYw&=n{a8#3H1v9Pp7%NPD%YG_L?UUY?hdS^=sYlZ!DIBtXkskQ+de1F}3n50X(K
zg(<YLnU@M}X@YNDgQfvc6vkJ8?y~^(i$JHq8-uzU48_Tr;BgGl&@Q;$3>vZprC-pZ
z1W;QRBvFuBl$oExkO{t7I{<PHOe%;EYEvbrLMqstd{E7iSyTv`kON0!D(sLZ@O}-@
zTom}0c<@q8@OTHfEd<(-1-hUCG!B!RRGJQQJZMuic$N=-VJEcc12xs+4PbLpV4flP
z4C&0Y%w*6?N>EIdCc`ex0UgE*tr0-`8zHSR=yfZwr6-VP31qbmG;R}9z@xdK#D}Qw
z;A=Ju5+MWb&_OcLja;C?Ojx%Y)F1&3B0(mq!Ob1WJUOT>1M0X`f?GA9a0NvrtR0P7
z6}Y&9@^zRaXoD1F5Dc1B@^eAML-B~g6Hss!RWjrz<ySByWtKqJK!Zyn=#nk4pFr(Z
zi2cQ&o9wGnVeQ#?NZHQ-UQP?G?ZACE$W@e}ncaBQ`zS#trh<Bq;9+~v*l;Oq*BB)6
zgNHV9lk-7GHGp>gfeJKe{Rqy4p!@~h#|b)Q33^P4e_3jgi92i~K4`$Dv>4R2&W4or
z;3fn}CoE2&dxJosh_ccRKI{k{0|K2L2g;M6E72K1<Ja*e;7uZs`*qV(LCxZn{9MH5
zS5VUqbRHLIi3_-WURDUY6gshpp(s5m2(*wjKd-n1JgNdV8$3!5(gd2|2G4afz}FLi
zr=T+-*DU9j=70w;Aq666X)CDP5)bbFK%32=jzfN4Ja}CwcvL0cED177SzHJ{&Zq#=
zR|O4?fn&(o#R;0ZOL7b1!O;xbjRu-gg(MkJ;6T?rfCfQexf*m;p@)A^NPK{!v$tyq
zsQLtJ2CZ{0$_Jm-4GU#R8y~jE9PGb%$OSKu#bn4s8HPs4C#f46A*uvW4Q>RhWT1UT
zL$hqq@o;&iIf>xibFdZxNUaGd;z4_!A!90_0e;xdF3>PiW`15`4&=t=f?UYdd`W(M
z2?J=&7ihI$Y97i$NYHvihWL0;-`Us*6iwg^1gcw8i@+B@fhO@XQ(z@cF=TTrqQ?b}
zBWULo)J*{oqku<pK{aVXW^TNpAvkT7Ko%>2+SKu&6%~*n=fvV-&>kMp8Vzuj2ytO@
zD)>-s@bGeSN)l)$98@$Q#xy{a@}O9b&qg|6Bq9P<$bi<=fsfk(wO%qnqeGDL0bKBa
zy7ZuF0MM*2=(H^ZBZg%3E8@%{9T-rv37nb{hhkblci0r=mm{Lr)D$$p23-aN%7@TV
z{qoGb)Vz}T+$1vt6Z3e88;VPFK~s2X&=D%=c@;<zY-|8d{K=3r7eW5cVE|v;4%)Dr
z4_em+&QVF3C7=lvP|^j}StUj3piW;VxTFG2kRV1xAjah+78e&3<%0)DQcKbjGjkY{
zQbAjN^FgaPAp6+CZ3$3E4HkDs(0P$!M0X3iIun$8z<Z`j!0ml#sDMt}0gp2q8k?jV
z7&4?*6o6Xv2qDlZZ{TA_APF7pG|0RrsFjcdP8k)cpe0y|;FJY+5vZ>U3J&NPGbE!!
z4)0C!ODY1bvMq)#O9kJil$n>FlM1@CCn+Zzlu97$;6c3%aBmZADJT^{7WRUwNpPpH
zv=}r(2$qGoE<QIGWG!f;dr1*^L>rc77(j=&CFX!nR|73!PR`FQNX;uw1f5q5x>YqL
zwX7K29|NsR0o4$YLa~w|v8W`oxCE2{ia{AMB)~T;wFtU^H!}|$vCd8fpkw(#7iP!j
zfd`C=A*m76poT0o%mEJ-L9$Y68AE0sxHkq`;}4D!&>RnJ2~1`|4zvy|N-Zu*ElW*_
zHvo-s!PsV?GXR2}gFQX{p;suym%x^Hfrc}SK!f3+H5>35M#!j<nF#}AU=dQ(q(HB6
zhsI56UJ65M3etJ)ptcftC>@#$GIJC27+}E*@<<URk|51|&<P)qb*!17sU>i&1>2(^
z=I#g@@AUwmV_O7X`3UYoflqP)X@tz(K%xe7NkcHGY-gxSEy@S?{Xhy3vwrY1xj`uo
z6dAC!TA&ssxML2U*@Co*Ak)6!Y7ndxBFX?eI@X8*e418f3aD{kl9-na85xEoC`dFW
zF@V!Jw2cF5n?VK-L3s;08V(-a2OVW+5?_!D4LeYhjt7NHW?2bzl`FUh4&L7d9<@pa
zpH*3qm||iK+Oz{Y*#X>`1n2t9++0w_1zKBCPzqYelMbGK1s_KM8R!L{<{gj^IXW@T
z0yGW^+Vjf*nOOmyWeIBGfCoH4`4ePXd|Dc4)h2jdX?#&;aRoR|iy=$+VZ}0dAPuxJ
z4z$n$sW}Qd@*3nR=<E?_SP0Po235A;aUM{)3d@(NxuBy<GC^x#!8_j({VPk*-j!_V
z724qaF$Kw)pq5lJ<dQMa@%9;+d8y#@W?_Ts&?UN{nK*Db!3Q82%5w8lQsdJZz-#3}
z=jP|7K(=thN&-Vm@P=g2v1ln345i>KoC&_gJB1-B9aIr9<QC_orWSzf#N1Ty5--SD
z8)$zJ$ajb^gsqnXB|p%V73iSi<RqvQ3X1Xzib2!(427UN8hj-~a!L}c-2zI8#i@m$
zUOF^EF=Q4bXJmt>nbJy2Kw(?}Iw3kIu>^GbEaa?!lKc`-<x!BE3o0|<@swHuT6hV%
z775&_fmA;^`3#`R3{V3KbhTw6_<j)3P^JZFZ%QiYgmX}M7N^FS8iOLC0z69*=Hwb*
zo|%WznkmUGC_qa+(9<axU<bs2lMiI2HguIXH1R|B<wJ(xK>-Jz)&h6mKpue(1AxyC
z1=XCO&A#B>gW%*9AMY0G2N@8EXUHqf$q50CYh~u82ZL96q=4Gh3@M;NO;8Sm<Y&-e
zcv@yULw->T=t=+vcfU{tXCq_iN<|_TGV10+%SPQa(6xxg3c9&ziNz(lnRyVe=z^MF
z#R|IV3cCKq3c6|extS%p;K>(V=qVQpx@md&x&_I}x{%3EUC4nf3c6{aHAtXNW=dvW
zIz&}UYEEiNsxHWLFzveFfh&;FpkUGkEvCuL&ja!E@^wKIn)!JUy}7AH>8ZM)1q3CD
zc_mN<paWn_GV^pH8$BQjGYb-Ri;EH=oPx|$2&1?pF*#cobYxR%a!G!Xf^Hf_1Z=%+
zUcQ2ET6so(PAW)AI_R<~$Z%!>Xa*259Rteh;1P^s2GEFqNm5P$187GXXw(UmH^CD#
z`30b!7ifkF(vgDBb%XXPK~{`FE<gs=Lg2G2;=u(0Xm0}SOdC*_6x3Wzgd9Z+if?F@
z4(gCWh6=!iDrCPYsL=*Gp9Ngg6qckgfKP!0k1bY|#HXZy%5Knl0BBDxH@^hDW*&4W
z7(*WDSXxkb52<|!TKNH5bqsP+Jg8xkUr-EMXa~9#sFESEI5{&Dv?f10wG!-6aLo^H
zr+`OnKm+(j;3^-~sE0PbAzd)Yl_{W=0e=4RptInDq3b^KQp-U-1yDU~Yy`Sb2CN^v
zwH90wgLavMGYP01iBC>~4N;`!Bo=2dWEQ7nre}h-;gl4CZW@EuVxRy94F+M{=8Bj;
zO*8_xRq~5cQi~XTq4!#b<Oe4w=7IP6qpqII1f3FF2`O|y(?Uk3X5eWd@C8<&Lo^^2
zBq;b0Jy_5%HK@x99!G&*3<z5O58he|D*loa3!u}FpcDiu+Oip-M++pSmM|br&jPhP
zVTEUMZVG5^B=~H2aC(4m>jv#Ggf5!^-wF#$Q;_yOsG5QX52yqxXUGHZo+wQQtrIKC
zPmj+`1NU`7BhH}4I%H@I+QkGPd;+Wbp`9>@N1<f_Lm{Y=0!4diaVm733v`DGxV;HV
z$l#f6(Ckq$qUR2>4Z27$IXS)@bgoZPYJ5R@F=#19L2*!OF=SOOI8`9Uo&j_u0W=ey
zXo%iFgbb_|gSv>Y-CW3-8XRm4prao^qxm_hDd07Bu+}VOpe#PW033e?knJ>}EgVJp
zpdIDl>+K3kz?-~5OP$lfdv`%cg_PtcgUb2>aB>AT;9yaPd`3!Y9%zUzH!&Gh*+WK2
zf_;5GgB=lPae^8#pbiTtcY(SC@g;~AW8l#cu=mg^Dg#3UbI`mFq=yIH?+xD5209uI
z+|&jw-vN!{fk!jIjs)d8Nb46gELoO{9H^iLDVgz*%^Hxy89^iW;HDBRk%1RAf#xI_
za*9)v!R^jeP+yp#I47|z6*9&ND%+tAG3b#S@U<nN_CpSMOGJE5K?x!Ufi^Qj8dNC^
z1?7;vC&d|wpgae5I;=SWyXYH~oMHK<q=Es|;!jBf2M=Nx5L%Ce?_vODpG44x{}k|1
z3E&fU)6y`~P(^BTX$fcuClR!hAQ`d+5wyJlbRb$Ds2EI20p0(Ulbx9dZbX3^<B+Y#
zpaFfuGz;h!V{lx8hG;TDBOHjHaJ)r@p&3I4xcu}^twbt(GGM#lK}is_bptfB2pWk+
z9OVF-U(cul+Y4H725G;6Dkw;r$}9mTd{FTZx^w}yR3Gi)Nzn3W*ujTjrFrQLpeZ2G
z-MD$6tcbk-$pCt$Jm^{+@TEV+44?#IP+?+;d_OO=uqiDmC`v6UsRZ?QLDSvfIs0M;
z&~bz4cTPL|`}#Wixx_oVxWEr5f)B2Mr-mRChp;viXj=)mqyqPDz$bz;Kvv6v20|H9
zGV}65lU?AJ8nkf+-F)l}Ij|f&U=B%O;A2C<tycJ{4xq6W=z){q+8K0?Lt=qrQEDQ5
z!)|3kDr77<vmggjCxGT+OEaPF1PxSVfRCI6k0^k5sW23lCZ-fH=;`T0P<nE*t|55O
zi7sr<iGEIIQhIW-KBSP=FG$qS&CJQkG&9i)X3z&UcT!R^iy#brr%+EH7yV?=-V|LV
zqrj^4kp$pogGOR?b29TvD|FNIO7+pW5StlX!XXVghR|S7aH@0(FU<oTY#-_Z;e&<~
za#AZ4z=tpq<r#>{MtaE%@$uybAi@w#lpB!IVoe9PMnMfyBL!W5C{9bQNKP#P4RC;3
zhTss$%uCmWSd6O$7~tuwpqmC-s-2Vxy2i;iBQqr>H4nV19^}E4{L-YHR0i;(A}BjP
zz6j+0B9Qw*_aNlvr=(<>P|X)4IUL2ydHH$Zwz@8gD5l@y;|oC^C<J*R1;k1Lu}X3a
z7~GwmLHnTmLW$o8#Q+8z3=9k$3=E76?v5&q#)*au3~~(0U<?+=kkew2W6*-=!H}bc
zJ{1Nz1{ECkX*0+%XycFr>C?a=r^X=1phkwAI)fa8Is+rib_P}!aNsd9Ffg!vU`*Y@
z!XUxaF2W+A!k7Xw_XA_Xi8)M+IZ*Z$8^&Y?Mh1=#jEM#ujOlPD3m5Bx`EVXH=l}T(
z%urP<tqZsjJg^iKSjs|%F`WU%WaD9AY!H|a=QA13hgg~D!2@$iq6ZI17@{SF2d+DW
z2drBJraOd($pEH1hJ`U1YETRdNEo6!0pxfXlZA_e0j4*B1Eh!n?7$QjmS&KfU_69O
z4M;mgxQ2s;i;D$jT@44^x&{`OmKG71L<7hjkbs*Y01vnc0xTXjDzJc?Ai&0Bz2E}_
zOwSAsxX)*Bz@#8%JV2Q7KmhD}7MLj@z8;b(FF0Vam-vE%jRz(Lj&)F!C$X?FtYBo!
zVp+j>go$f0^HM3D6~-$V=Cd4O`oqMS#qx*g0yB~@L?0xzfVA#mWXxpQ1Jx>ttThv^
z6)FtY%JzXViGzh<2@_))%K@ezOpIxe=t+{;!_1h<zz9|ZPK!wrEDUp)7*km0Fl}IB
znH0e|pJfBn3y{DIrajDH0kCqAi8UZUaI`V>FeoVt%x77_xPg%k%$v`^%7|uW0%I~u
z!U{&tPL?T54k`|6VC76gi<y@~+^Gx~2V0lS0<sQ^G{~iljNl-&VPSZ|$e6?Og7FI@
zb5Fs1mM@Gy7$M08?3H8#76u8%WR`#>jEu<)pu7gs%=UpXxq*d2fyrP#i-Hbg3X6^f
zV?K*T2xAH)CnX;NB{Oh@Cm-Qp;bK#O#xY0&nmdzEu(0$m;DIKY<P$86DGY4T*pXmi
zP+?4l1X?nRC`T)UxfI8LDM*OIdC-`c0kRgHx|3#buyC;~fSR5(1D?8*=76l_gh|W+
zrEZ9h4G7H}IKU}W0H$gK2V*YOiY+XR`3NRVbPp(1LyXx2N!76Yle9+wuJ;5&?+F&h
zTu70TbVdSJ9weQS0NX1A&C_7MG6OR#UnSk(fm?oqhm8kW>I(~FI@DcXSXjV?8pJ(c
z5H@`Qd7T?(IFiH<gcE*1oWKH81>);15P&%$nFa2IWELJ!rUXfW%cEogP$0mVV2?;Z
zO-U9IU^0gWX0il4E|MiUK*A6$SKw|)z5;OrT=x|TaN!H~Px2Fl_9q-*aftpm2>ov$
z`eDJC4B|5*f-(6A53H<9{=vh>1CauolEMNvC4~iI3J25=U_MevqzJ%GNfAH|i4+-l
z5uYLhDdJ(_3Faf4q5@BVDJm?m@C5rb#R49sDHbf?@Ps8ukW>mJ`GA<9jLGqV5yXUM
zt`r}HULS~FSb_ve!SwpDFy=sw@d4#Oh`j{}y#*|gDh4hAQ(nNr(gLbsAfZ+OG6$lj
z1D=agI*==vln!`lp3=j@(hRR)QhE@YH-N$oV$KF07A_80?Ub^C2ky`fJS;6Ou=*Av
z0nu>+Ve<(N7A_7BXo5>Qfw1`u3rlkcJQU9$Y<_~!{DgyriyM~SQ=T9+zW~*$VlY!*
zz%(;xXu#Bfn2^Gg;{$_+1IW=Jw}F_T`X5wuf=X2ebq^K>3&t!Kiv-3nmV`ZwT#(Ak
zaRt~~1}3%-4C*Z`3@mIt3>6GY^I2F}xR^gMB~M@j@faAGI6g3_cQ8O}M+WsdaQi{b
zFpxE1Bi0ZwVgtkoh<yhjii=U~1M#5t9RVu_S4nIi7>+xzFk~=hv1IIFWDI3F!+3*>
zF_eJ;EDQD_L_U)xV+$i=ILj8sGhjbLs;T)9_2CSxAdj3rV8FJ3fl>Ga12`ozoIare
z<Fhbue89#B1u;wx6t3J*b*#)En6mdX@E~&!GO#g$U3B^b3quXmWR?YtD;S|{23Amb
zfh!({GZHKeCJ<9tOk5aqSbRblb66@G7$IWNnh2~c1T1tAE_o2@d$tb@XH-}iM3{OQ
zSVTM+lUZ^~n0i2Rkh&Zu&6vz0BEi(d$Rgn(QY<xvk>kIVg-WqBn4vg@X+BsRBLmo%
zXDq;O%F$$C1^Eod)n;H~XGggGga`|R0AmP?fCg6y1IK?UE`J8a`79P4jL6&`<`!0D
z{vFm1HY7d+Cj$dBGsLA(lfhwkLIu<c2w~CCU<_f=n83uC!}5n|4>My9%O2)4%xonL
z9Q9K3S<Wy&VPVW+dBW1e%G_)=pXChe6$s-BYYQ7=4$Bm_Iqcvx3pE;M4~&My!3hl(
z1{qM`=Ge2ys4!-*sQ5s6K3kX>GgwYAUjb2fm_LB1AIv>0j2SFbSZ08z1uPpt)DD(C
zAnFLq2@rLM<q3$oz}nBon87lEZ3a7I2DBx^_JQGq4+}#8X9)vm1Eg7Th3O0n5_bvf
z1y%$X>Tn1J(tLo0!Gtl8#l(WUhrw8d`2$n1iPC%)iwBI1fh<2*{;)6xvixCbVMUQ`
zVQpYz3<M<!usLiW7*6uAFz_%Yv+%Sq3Kffk(}0Cau>_c*IG<$)%Lf+5WR?#sTUfD3
zGcba49mp6776t{zRF*9)dsvtXSy*~lSFkdsf*S=4CmdK9Lm(OKq(uf}DkNo{w1@zQ
zEi`4pxZwWW2Zoa#5#VM#*qIC<3nEw;L_jH5g)xUkMTfbWX+DdN2V)Mn(Z_Hy0@lT1
zI5h<+3?U9UwZR-z>B8K4I)a74fW4Q&LB&9CK8t|`gsC~7#lZ){)SHj+7)Y@NV=9Y<
z15+U*i-Ql?Q{YnT_y$O+Rf$q+fq0No>-ZLMsRb%$P6&XC(=rC7`4FiSA`FZn@K}KR
zF-M1m!Gkf2#iImTC|iMg6eSlx{frBY6POsoStc;;f%PlEl6#mBFf(Sc9ALh|!Wa$-
z;~X6pW-c}sa95HcM~8)%i;aa1gp~!@lpt+khFqB#P(cQ+AaZ4*!9mUO0bQ8AnE~9?
zhd2-v3%N2Z3<7LD3@r>Y^H~HO7;{)0qWPIWFlh%tdIcbHuxhps47nyO3<_)|3~iwB
zQE+BVgG5#C1Pg@KFg7@+=T2Z@&|u7A(J+S@$@TxgR5ODNq}pT1onX%10(TL}xf9IU
znnC3aT!96sNCr6oWd9Nt1`e409Lmrx6GNUtG$`GHYbvm{c?zHwe<q7cG$->1rZ5&Z
zLzsnm3Neh~(B2Y5o(T(s1I#!FcersT?#Sf|1867(<N!o{#K<}Wlv9&gCNM2wV$5aP
zz_c4gHL&)uGUl+%V1L8O7|(J*;Ee!?k~$#;>ey^hJfp}M!g5COvLa&!%VotYip(YT
z^I5Ja{!n2IVQElZqRJS;(xWj!1Dvry-e45i!@{7z!NuIe#*rd7pT))*&ITt7M!A9r
z#xMp(78X$7ORj*0fq^lEg&_h|b%Ofs91oPy`~fzV?Fy)P$YJ5JVGLo3*}=pZ!m@yQ
zGpO|4%>0L$F^pvc%VAK#`-Nu?FDOZay$&MSJ}|PXurRc+Fov`Auzb;A3}<Q3{GiDg
z&ay=7jTVS9{$dOcU5*cok{JeI%^V*XS$%B4nHp?6rv(cG2Md=6!+aJF6~-)Z0%GK}
zP+^P*XKY4J8wF6t2H6L~j9^V%KA;LChecuwGhZo#zZw_+f2mRiB^$N*EL)ggF!Pl%
zL&ccEVlSAFut+g~U`&u;Q)Yz7z<6N!BP?g|$}eI2!-hvc$XyJ~AOKDoY#$i8R<JOb
zGp4a*%m#IS&oJHqQ8yUhFfyjHykTqrb=4b~J}`q4skR8q3DyN{5GL3p1||k3R=7zG
zpp=`+l911s!}0^9HI=1<X$r`MDNHAr8IxH~FwbBC>y}{oz<L5=kOZ`FgCtdugBGwb
za4?3kaEOSNF$g($t0=WGh>3t`T@40CG2!_vA~}p<EN2)$fL!{4@dw0hJS-PjS3r#9
z0cR2hCQu)pkqHdIH3QUe&=3*}i#=m1OF{-?DoaKVD2eAR26^}Z;}sBfh4BHX=g;zh
z@e3o9A!sC^fr-gzK1&1B4`wFg`Cyxvj3I>=BUcCy8}kRoG)RLLl$^OPurTm5X0Rj_
zgL<~$avtO&whxTl9H1gKjKw2>ql{tV7X~(^`78kuoIMO|P)@`IP%3`Ga)6aFjDZP~
zf_OSWr5q>~FwAFp!FYfPWL*Nod{7$<p@IV{%EBSQm<m?Ln92ZZz_5K_1e?GZ3K0!u
z0A)6)gFrH%(K3)O(9lN%s6n%WX$xqykOg7501I~u2gGtP3t|KV0}~S?BNG$IEO3hj
zY!S@3WR@48C`xAe0!j+WEDcQH*3tx~2~6zG42CL(it||}FwJ0M?}2h=Fs*>wp3Jg^
z=>W(POz?V%?E@ok2MYrv_9R#x`ay-hgbb@Am?5J96)|yuFrc9WN~X{dfH^FM<ptv!
zP^w(Rw1tVerG7rdt`u-XfRSfL2s9)?T0zmtvxJ4gfUOu(a~N1NrhyVXWYCCL1k}z*
zX8FLlfeAcHvxAAb*#nd?K*^br0aP<Hf)qjQHet+R`M|gY<jW;YYnYgO80WLBVcG%m
zCu9T{WF^}NMm`@F1_5R+HW?NH2~g`<;s_ICFv|m`7tD;oEPoWvC^80vM!P|(K@J2d
zUja_AD;QreGp4fqQ8=K;n96bhRBVGreZdMLF~s);)Nn}yHMyG^SY&b-(^#&^cPKEX
zv2-XbQDABYxf@(=@w>1v#4x6_WPD%*4|RegnVA`6AAbxBg9<2LsJJlZvjj|FWXxxo
zz<7a?xxaos%LPyg0vZ<rRXL#cEZYZ00TWPzJeWm5g1NYUK8u6`V=&7N**mh#EsXP7
z?#Moo1&@|Nti8j+;KG=};t~OJ3rIf*gUm<(l`c6fDlW`D9`jjhCV+DP1jZSRATG#*
zkkl#=!omO=I%bJTU`%1@U|hloZcTu^1<HsZgJ3Fn6d03P6m*z+OjvXh7?UB2lR-%v
zWE{w&f-x)%8lY;}_XV4Y%zPFN8^&ao7Er4@ndJ@h7iRD{Is*d(3ky3t$aJ_KHc-_a
z0oD-6(!#ujnK6)M3-cCc=0X-wv44Y^xsYQ%%MIoS%*=&6^I0B%%nF2dzt}!73R<u*
z_<%~K8_ah=mD?TWAI#j%3{#juEf8bX`B0VMaZ9*bACQMvFgLJ({0-^^q=1#NeP9$8
zU}0e4X_lJ8XeiUeV5FirpM^z41j0v{3KC~v1697l0uG=y5i=ykfC9k=RBHRaU}<6g
z0xoTRUx2a~RDKOwAQ><Qvn*l0!^Rj4sTPIzTwwxNk>Cgxj(}9*5(=<!4B-HF0Z^ab
zgN?&Nj`;&qq6Da63W-kP3Q!{~hDFDPF$QW{g$rXGl-Xjz7!UKLhztt@J5#F;3wsP>
zFt~fjC?XRBQ!3J;19J|D2{jAEjAvkC<oLiSvcZKh7{QEVfcjpP1ytk|v#_x6Fc*Ud
zVHg<MJ}`<(urLTS=CBBVVPp&jWeu?44Nwyt?1T9%EG9^!#NY(Q0MV%fnw>EKmHUi2
zEHw?FWZb~m!N}Ir(9pm+ADjw7QNM)o1W4)xs48kUV0pm!fRQl=T33P`pu@rt0m_3B
z9pIeb!MFxgRe>yG2A4WQETBp#hlL*$9Wyv)aDd#&#KZ)Vlwo0D0435yiTR-BNhnJL
zM*|1A@dc{V**-7|iLfxpFy^qxC@_^8uyk;M$E-jVD%%G}u{SIXF(BQ^G4oj#Fg{>}
zvKcVsBaq}HK+R&1``A7(iu15A*f8d>G%(Hqd2$Kk0g&fF!w)dyK?%-}18h2k2{T-L
z2`EB(L_iVJ1D-B|nd!m8paW8y9K+JWI0HOTksQNvf$;^D2~r11vf?jT7!1HlBUn7Z
z{l4S~mOacDz-c=<0#b6Zuzg^Z+`+=|fekb~B7KK}<qO*k4j6k5#|};?8>{k<NXkDl
zu)vjn1XUj3i~uq_2GoZF6`0`=VMwBv^#Qeja#%7-7;{)kT0p}_GvJCC8Nd#E!@{tK
zjWLAf0NWFG#t@bl>@A#(A)tf^DuZPAurLTSmwaGk(MShTu&{%Qe}Ra9VT2`esQ3?v
z_zy;yddWAS+!xLgvxJc`98@qegPaKpmp3d7GN4o{1M2_AWHaWl<Sc=uKWI3Eid+yA
zr2G#kF-5V+fGR)}P$6pL0~%85U}TJ9>0z7#qNad~>SUG^Odmis=?|tU%#1k<pg|pw
z{x_idBZ@@;JR0K10dgNCsH6l~7%V_B>Bqs+z&HUM(|#N*TbMe)ap}haX{1ZX@Nkte
zc&K=&aioLC!l4e6Y5*msDiIbI4#p@J4guyW5zsUzIDVuvKyuCCgw_mAXlx%CrF%fa
zi1Y^y5t#-S25H7j78Q5KOmH-SQU%Bs21anUm*!z%U}2ufF`tD6G@sK0@$C}EHH^&7
z_48TQFm7OEOlDcbbOY2lc);`pM9pBH0SW~0<dMt+9j1vK49pCSppph;n+Q19CCq10
zae%TIn2=;aZgF7D1jPbaM-L=TNtiI^Ft8!1g9e_81BAiA4C#`|Y++$wVCoTJVc=i}
zWiyah*gh~MOaPTCSuFfM&@lnfEF(w`)E$RNW<n*QBb?x(njv9<0Hi+$ZZ|O`fCeiV
zbHI7Hem)D23`mlZ5i&dpl4M}aWMN=n?PRc$151Pa0k#HYkC_gr)s@Af(8I_W3{F2t
zj$xSsDpNpJ4<rWIJ}`jPt21V@sB3`KLEXio5yF@WQH)`@I%5WldIuw82ula!6!37Z
z1awjqY<LL7Pi7%Hj5*+%24n+Mrvg+s!2?u~GD9m6Mh;MeCX2=84<ln3%OA!Q>>x)#
z=V!qwh3x|)qYn$i6i_~&!Z@E1Iwr^Vfsy$J3quNH4$Bo#?uRtwK#EgX7?!XwhO*pX
z?O<aJ1)BkmW+WCUtUyZNKr0)G0LBQGfN;i4mhc+pii-IxH64tM5iAoJw}5MpEsQTf
zdGH0}XV6UWXT~W^%vBZhS*9?pVPTA7xxjLRg)xHV2Fnvx#wd`<V2jv3FfvK7Fic@$
z3}czXbQzRum#`dQVGLtAz;XdHl>=4_DRLQGSQv~Mb6AXR#7h~BR7x3?OjMu@8DkaD
z;5v(qH)9TqcMA(n1v^+@u;P-0ISFJ>3kz>40~b>Ss4<bVLuoz>NF%Bc13O3qI59GU
zVyJ<U!*KpwMuxfa3@jat>lv9+KCtXy+`-6U02AH8cpM}O_7W&$(P9h|0bp5hOAy3j
z`@rzohJ_)4F^eUkft4|srGd4B6)E;vI#|Deguk%PVM7+4!`8#a7|hbcHH8~lcnWt5
z4`VP(3(p=NWZ^wLXQaVx8<3Ttk_&8UI%6hF`X2CF09b<G!*qp-F_YyA(-~=yeyA`+
z7cvQIa6|YY78o-!fNC9v&pF^^8p6^88aoPMS;BOHiKV20aX!ldrX!%im?KPgn3zkL
z=Cj-Zm0%$(Uzi%0SxOEt%x9Ux{D7G;gyjMA3udr_DXd3W!HhSoGuXh41#D{|j5+Kp
z*uf$<IL~l_8F#q8Kp023C-8tp&hY&Z0W+qE-w_8h?ufq;hqz^m#1Tm_3lzoR)CYFB
z0aKR*i-9>)u>{!pOvMslc~B&kfZ9MIEG?iODkyV<L-7j>NHl}xfaDoT#td*h!tj;H
zfiV~|l=+oM17rlK-^TWV;VTadg9cNv2#baTs96iHoEX0PurL%b2D4Ob0W}gKK?)*4
z>H|Q7a5*d{2_W~BKwE(=j3C|;#tk4ERIz|cyRRXj`K3^nf;EiL%ns5Y0;*9%SPB*}
z!mE9TZwxF9pw?bQ2NN_wuzg_oCIBidb67m0L1io?IKD}MycWUY@PUyr0^+l8DeR0{
zAjd(R{w)WjB8No*JoOU;*2?jL;oB7xP}v4j2Xfjs1yH>l%3`qvH1!24L<G4Q4Y-&h
z${ETS^dO@(kU|k+JSZ)(ePH;`!NPC@RCGUJ+yinciZD{rWC6(|@xj)D2#^`zo_7d~
z0=VANX<>0V11hhtfI8xkb`VG*HVoAaYPdLn=Cne<QIL@XYQr>u0-mLTu?5sB1vMf;
z@i7BbCg*_G$ACnSFrEP`0*w(d=CC|qY+wQ@YGCRCRoOjE8$eu80|hjH1hpS-Whje^
z4qGW`h0A;v9q?)q0}e1(nPonUfdfnm<d;wuuwO!<Z8V1OA}kDNK*0<Z1_c@ew31=?
zt^=y4O9bY#aPWZot2!-gpd~asB0S6=m~>j$pi62*B#`(b^I0S`koeGvWQOkspuq}A
zs`$Sp1D4+ZZvll9r~?8?AwOJL7+4sCSy*7R1E7`wOABKUxW0tdZ;$|B`@rzSgM~pH
zG@1@-_S-mcFNUpAQU(nGf-@XQ2`IaOdPAVT7`VR#(FpUC$9xuz0t5%_NJa*ODWLoX
zs&66IK}fa_j0^@W4BDXBF#+4^17d>bF+);7%!(RN4-As&T0pJP9LNw5*g!}k0=fJG
z3xfq?FiSuJEGT|l5Qk)ajt>lAwg{{w`SAeMU=Cq%2mlWtL%j6@k^wD1(?cMqfy_i!
z2kA92{B>Yqa9|8(@#p~g2BZ+I{civ$Q>U_6<S?eP<P?A`1`lRJaxzF(0#xou7%=9r
zSb)7*z*H;((GJR^e<MInN?|duU`%1LC=fL?X8ypGvlTp}#^C_Vq)<2fGyrAjU={%n
zP_~0bBD9PHOM=2pK%6lX+U;h53W~4@cz`;Xpjp|U9tO-D2S95@z#jNn!NPC=G=6o1
zuY(_2E<v3Ka^KGyNbo3tk{3%t1!$Ie0XT<&hR8sTAHM&5U|&Og3{t-bRM%YLYvG56
zGQ^%4poUfoOH2<VV+zX-zQ=svkspo^48J1888bi?G|0YR0w6CYvmD@k%?lo_XM&3|
zHM4+)nVMOkDeDglQ!%Iu0n*I&f#E02iVCm|J3uyo@*xO=q!)n3)^b=x6hLEAEFl?;
zfh-vX%!MAX0UMB-87vH-{KW!Jk}(yq7Ua(vAW=wR`Kv?)R^a|BQDG_pg%-#gH8S8K
z1rT#b4N^$5ePH;t2b6e{SsXk-5#-^+n9Smn0SPsb@;xAXKyeHXsoy5h6b;I472xCs
zieiv8Y#$iFvLI6eVi<E+Vn8X5rJ^3}PGl9Jm2d@&$sj4vq8o_8dsr9}7=u}IFwES;
z!e9e3)5e1_hs6UN)j2RTL3V;QCbQ(!!+iM1B>?I}whs({0zhL%$t*lBa4-D{08Pw*
z*4!}snF7k0-~|DHrhw{qNGSd}0;<tKohODrcQ{zM7{7p$B*zDaKVN*nMss{%_-g@L
zF9I3>V))MhO2D9@agGlR{~7F=iX}h{574YBXo>^G0f~x$7#<9uJO+*Szb8NmFPOz=
z2dFZG6+>(v7(f!%AYWU%Fov-Bd;wKZe;7ftRt%8vMyL^Cv36k$0~-OE3IvVqG5k}3
z<_#UDVgZ%~jH?-$iUmNC03H-)`@ryz1=6b%NMH<Q$p9B;2SBX^@J#Bz3!pw1XbCUF
ze-8`jpcun{4{+fHSzpNTA5<)Z$`5f1#t;T}Q1%5Y0NDcaXadLxa2WodAp$G^{?8Br
z#RJG8Y#$gt{a|5`XUt-ecR?;Qz%KYKpaLos7&$&LfS8b`6-=843xhsm7K{D_P)h(b
zkc*_9Wd^7}4C=&jd|>#LBLi)8fNU!Ob%{b)3P9a6a1ReEn86qZ7K8*JI5~c50CiS#
zSoi}NLqR1AxU0knQV*J9Vk+if;ef15f~Zyj4e4dE2&*7D1msvy`S6JWha|YM&-Q`g
z!w#r-7J#~WphY!Erm(DFJi){Wav8@5h7WgSkc+Jk4<OAu(C7tt{m=|1L^BU0Spn)e
zFfIV4EwF1q&iU{G>a!Ha5SD@oOdtc{D_|h1KqT7-hPNT0;y;T;;|M62k1)PLuAW)m
zFs=aA;VW3Kupm443TT-{Fv|y)87SSA8LS)F7=u|hupL3^t{h=|0vYQC2jkls7KSUJ
z?&1fQJ#3)XB|AIF#UNn@Pz#)a9h7!J>vce`s{xHNbn$?OZi{(9PKIKTTni{&<*>-_
zU}g+u0e3A!SzfTbVPy<unZmXO)bj-?X8XYKzJ`TChcTF?gJ}*dl-NEnykh`0k;7P4
zFdtzChdns8fV4m=lDB_A6AB?LDxfB_fdz9h<9rqi7sg<gf(f9Ex`z1#sKfGsc?xK`
z2vi#i1+wD_3qu6^WR|eWERzLTB2suDOs3q)Op|$7QVL-FP%yus0+nCU!U)$3YHXs)
zg0cYLWR{6MlUXJ+O%wu~u!gCJ8Lp*=c>y!3mIchKK_WRI9a$g^kdpAdhcI;EEyMd2
zGK>-6(gWlbwhs(PkAUi|EEW+J#$Xl|ZN@AXZ3Adh0Ilc%sRBjc(Ha&8bH*$db6CRw
zED0`tkJfN7b1@$PtAr739~h1t07Xg`i;fLrFpCYWYyfFvaq$4HD%k)^kQ*4`Oa4Go
z5dEM$1@4+N9JvGPhJ><6XfSsiU}w<)Wn|ENQwYlh#wm<!6FJySW#+R?VO+q-)(2*T
z4FGvd0Fprjv|%;r(E!jYMQ~Ae<Ov6)uLD*MPPNB)KqYM!i^2*<#t`t*bLJAzT6M-N
zApQf;@CZuj1yZlin8~7l29({;Fg^fhD`=OR1*{&F-62Vi?E}Lx6BY)jhc_^?P2>T)
zdjsPRMz%f(dk1I;98};Tv^YS@c8(>COcOa+KtqL0eH<)nKtnbY!Hp6|q=w)z2Ns3^
z(1>h64r3@wP6cym{d|^+IiL>19L6=Ejtf{Lcuxhy#}Sb1r2!hm0+-gu7Jx$tR9YX~
z!vY#@1h*JK1*X~#=&TwKXhn>L1uRh2OkgV>*gi0*#el**i-kW1nt(t(0$49rEeF)>
z%3;wk0P6*ZJSd(ad9mdJ$gf!}9POap3hhi=n0VnG1kQg_pc&d5AekFXPtawaF#TX*
z%wqY$(!z?W2W$ms?3JPQ1ju1IEH<D9O->Hf0c;-_T5qs0D1+u?nLy*M5DlQz{#FE3
zG-R=;m@{Uwm^+|&2UJDARZ#~wC^<ebywy;Kt~O_Qt0NCK8YF5U4Q^Y4m?q+kDd0{V
zC}!C{FsM#|g{1^&egzbu8V1Zg^@!;ahIkQBvd?6Z&|v9gke|<@p#yRPG<89SAL2zc
zKy!5992hU6!I%Z^a<Y9u*9&gQGQ=A|R%nA`UTF_BXHEbQ4@v2)Kx92gbU;*Ovgm-b
zE!18Xmk*%4@PQGc4Jrx^G!Vu1fdQg1gGI-NX<`VAjSEv>2#ZTHV+Kp|1SY15C^-nC
zG#ykvghI;)ap)kc%LJq<P?-TVdD+9jVE`J=^9=#50hSkG{=noL0O`ZP#X)X>W3~?r
z$_k)XV-AZ$Fk=o&2zZX78I%!P7@>2=Yd~WsARTNU7)q`{3jkQ@2Tr`;MrFwr7Va(v
zBhZ>g-wrk<@Ej>fJ&GX67!YRrz+mnHioGlr3D6=X8(4t}GLOY$1I$V!waSc{EXody
zp)3wywa|bCs|^Jy1Eomw6QIg012i310?w6?h$>mZ!obd$!@{lrDk2ngnEJp415|PY
zXz+I;2aAL}V<wBd3P=)U9w?qbX^=6Cg$LHwfu;bC4-866AcZ4@iL`*NgaMRCb67;+
zsk}r1vPg^L14Bs(2V2f$mfXqEg?_~kKs#a}NwxTa0t;8E0cc`{;{!wS0|jQz3CNrV
zXuG^5MSxB4MZ<+MP)-1unZwSOIhiGEGQ6=|It7%Gvsm~8K=}dIJp~tDrAs7WnXhz<
zHhA8H;{!wK5gu?!4`DKMC_t?$y}%DwlAsToR|RG3(gb}DP{ImfQwB{jfi!_7!I=z2
z5*mz!pm{dNEEeGkRQG_h8ALJ@DhZ8MNW&jexq%db79X-$1b{kIA>fIikP282s7Qo`
ztqo~8Vc`W(Uxg90fU}5!1+?%J%w%BzEiwW#!OJ>Z;LAFTL>NG8RX}b9C7~h{76x_3
zEEe?xjNrQM0AmL%|AW#dSQ&_5`@jHEn#rOLUedk?W6634D1Rb#bU^CYfF}|_tFl0~
z&<DmJj7&E3S$;5fFoDV`coc$^Hh`5jFoK(;XBfewm7uv_aIk?Cpqd3U1Jq>!IS_=Q
zj)a*s1(dI6K<YWr5;l+%ZZJLpiGp;)Qbth>D3O5M07Wqou(*b_J3%JSU||Sg3}?vz
zPj`Z2y(q>8SsBL%hN1&3tR)P^3`z`)pqjE+1hmo>k_1IWU>23CsKe8j0U`++@Gx^Y
zz>=U1C<%i4o1hg`Y#$g3OIR2LKn@oGR|y*6)j=BO%sr5WWuR>gg`l}d#$*;27Pg)P
zQJ_tS;0+Lk6Bxj?4LJM?o`6b<EEbsw;3f&IbO*&2+Xn`aY!5j2dl)A$f|jc)NP!##
z)>>!*YUCw@hLJ$~Ex}?1KUf&b88cZbYCs-h;rPH%$icvv%D@C;LYF)j%77aWplnnq
z!vfA};BYR~;Q;Rl1ZmXaU^1G|zywOGg(mP6TxbDtJxE0eJgf>skix1kK>(V;z~vM;
zW(pHP;Rj_3fWs9W3#Jo7U|HUD!VE@`t3i%3o#O!;4l-TP0ouU_?il+m5n&VT0GBy1
zJ}9|Dlb8i)(v~rYMFc!Q2@(Wlq~a7vL8t<10J^{iV%R<~6i;Dc;AYHW;T8dPCLlF$
z@d{8G2{yaf23%#s*lauu+=Uxp1)+@wGiL*+-~+W1AR!+BtwvfHnI?jkH1ses^~Hdv
zJDDbe7O;Ta1B%iBP!BH?)UwKAF@Q{0!b%$?B_50!EFKV936vTiYJ>-4I*UgGsD^KV
z&UuPMmBEru01HC}XvGO=!X7D*3TA-Tas;!uz(-XI7Jy4CQ1&R;!U7&^fjJ}t)C$aG
z5s+ZaVvzt>wa88d`+Msf76u>2EEb<VER2yXdsyxucTGX&Kx#LLvP>4A6QC)_6HsL^
z)4*wOo5K}m#%Ko6P$k<3hHVxs3_F+^<5&(bcd#(VK_+guzF}eN1Wl_$4ThM#&4GnM
zo~ew1MM0mvhhc^B3Z3~Z1|A>*k1I@U!IN1+CbO_yVY&lay9klJ!*qoiDgm1ChZ?hk
zh2ah(V;sv9#wAQ3i<#~)F~*_GL$!ew!Pp0w?!fE;*BBt@?_goDW~yLdvAzQt;Q_fA
zBz}N}K}2LJv(8c(9i=5Y9RHy}X+DdH0tZxlK8u2}SRKbQ4xOdUXsTf5Z(joPa~%Uq
zNC8tF16ULs9UyTY#!MC-d8RrRmXHF*Ot2i=2L_Og0nEiA1yB}>EMquGM>wP#x_yfR
zV<>pt7*w+W6WlsT*$x#4TPFaw4jh-;f5<SIf$|5(2L=$kjsd)m9K`0R0PPQ{2bW_Y
z**hZ4bqX-04?qK0;DTZM6HptN1ymSp|G)uC7l{6cq5-t^m%v<HFrOtM1-t<`<pxFt
z$@YOk(F2q|L%?Ho;0_xkvK0eBBe20N4xkw`mo?xa8Bi2K>UzZ`EDRcKq2S>G78h@5
zTZzT{4!Cc3hw%v`taS#`1F~fe3xf<ynT#>(QW+ij`7ACWFrknNh!99Q!~xT6K>09>
z#RfDo#?ryK1>Nyr@3MVh04a25%w%!@0h;p%Ez|}TuF#yr(g0fg8wE8MoB|-~Gg#c8
zfR+qAVQc^!3|kQaRv&?)z6CT^mct?p?eOjZRl_?#E6RfzSiy}~kRz^uT${s^0j|2i
z%PJtfB#_)476uvSmW25%2~!wBG^}qk4J5&s0uqK5=F=Gjz)Y}9r-PcPOvNhT)y$AY
zH=Tn8wCN1uKDG}G3P(VNcP0ym2y<rzXel|8-ytQo!UG>rZ3<pJ4$^Rjg&~A7lO-gA
zsgr>vA_Y{TFoSJVxB!yLVTnm#%mH`spsGO|5LkGax}a@HMHSdKT?U0epmPww6#$3{
zT5HPj0W6vdNzIBJ5{!@?sSF?{XkiM+2L?qR5m1c_iDm`RWHr}3&_NksPq9b@K+^=o
z!wM}HjLDF~O`#+J;tGg!cYqcyH7kG?-84gYp))8%$S^l2Kr@R%1ZaW*Y%0VqyDOlH
zf-Dw`7SJdMXow0FTF`bk%M8XJ(1A6u7Pb!zAoVhgnJh9jj1ep~Gr$cHSh@nMMx+z4
zlk62hZIxiqy0CB-pBB)7P!HoB(8i)COlz1KLFEQST?r&bxdg)+SoSBxK};4<yOQk#
zgZ&%OC{_-ONDHU}o5A=1(#?X(I;eoW5zJ!Y!x+qxPy!l~2D=zSuzg@~@Bj@!Rxq%z
zi!es9h)94&tO6LLSOUQF!$>u}LjWlC<gl1ngKP&CB@R810tRFj+Xn_)@Ji<_76A*!
z5EhFi;1H0~SpnV7%JG50wg%EjgsGnZst|)&1mqcWSmZ%75a6=P_6SH7D6fFh6lfrb
zvzfs{6}0?!J`0BkcNfDHCMXwHpele=aWyj-tNKH>?{SFmfRw@b4B)1sf&&9n7icjD
zDBVHXAa5ub@Sv&&x9=1Tz^XxRg<!T142j^KZ&@rN3z!%~Sr#y@0G9@^G_itd14wuS
z(*a~*ux6-UaBmkP3r!l3beq@#YJ7lHf?B$XJ3!0na#*Boz_G>gfgy1X4+|G)hdsDD
zNL<4W9)STTk0cXFN1w+4rZ`DOfW^T9dMF1&l8OLmfE<#hofM!&J$P&b>TZy=pr##2
zQh+g&MF1=bb00XvIw^2~LJp*o?E{136lmiNbGjQU3$DZ<vMA;_PGLbZC+rC*{<ByF
z6p(Tj$PSQeK$2i%z>+Xips4~RDZq$BXI={)V?mNQjRi^KG}bZ!l+ChOL@cnl79<Ha
z7A%QyEyo82%LIs@nZR?cK0Ki8n8jkT1~rW!%Vxr4Vdj83NuZ`N+Xn_87to}E!F<T9
zn~M*4Pk~PbxSh%Ifx*Y)0jPll?iu)ek%1PK|1KVYwipm%3=9qkF;Le8yq^UW@~$1A
zN%t%kgBgrW6M0x>FfL(a>f>PmZ7E{=zyOiWWHEr`Z!Au9-2ro=31cvei4E9^HlVc>
z;J5`_u?N)I%3v`M;RSam4Q0T?S@T&!QuvA)m_IOy9#(>gK(s(ouk#kD!=QERcF<<b
z?TA5iXh8$c79h1IjF~JZkRf)MGr`6|S|u(5phbD9EXFn*6B$Yvl$1H<v)F_P!cS2#
zmYN6=3`sy1>;nsen$@r-1;`-C#vBgNNG5n*jfF=B#D*=6Z~-kPW$h8SSDDYkA;H=s
zX0HOOc0jIS`@rBF08Lq-2^g0YX!3&l2BZq&rvOm7kjWzL0UGe~2mp<U2Sk9_5h<`1
z6v#NxXfs<6c=UwD#2Lzh)bGv}8f?t(KRBg;`n?<<7?AjIYn)P`1Hhn)gyjKZ)(pu-
zY#$gv%5)erS#)X`gIQ`IQ)@`U3<+eX11t>IjA<;^9gN6<2o2c|#tA6G(6EJVdjeSk
zI*tG|F2I5uwi4j51y>eMPg2;5!Cr-UFi0c;w1erR3#e}i8h>Z|zz_u55)U#&K%Oy!
z#l#;{ctRW)-vae)2e_jNauHJ>QU?<xug#drqTK+RO#sbPf}#h>pOB;pQI^4?4X%Sh
zgRCHB&}JeiWD&M$Gp4g>cYxXyAj?3?phLePWuVLvzX4L=3xoD@fOB&E7tjU<usp=N
z&>PU408TN;%aK`p3P5E6E9B51whs&-r3#Fhpv7z<EG}TBP}hT$qKry|lo~K*uo!?<
zK^@QH6U>;w5?lasC{zgC%K@jz&>zsER)#T{MF+NM0W1}809w^(Gffm>(FWHk$Q2G;
zkqT(Bwl=7wfhdBy4(waD4-6o4v>7v?Ccs<(l4bkAAb$kZ{m)|2i2)CLfJDLOg2cfa
zI5b#6n`>%VbRrmYSR!IrS{h)TBl!m$;CTa%4-60{xN21p0f~a^JO~qHB-;mu;1<x}
zYX*w}B=K;3U<ld)>gO}Cf|zeKKw%DQN(6lY4YDzSdjG*X;1Lh-p%lR)5-bj0D)Sj&
zJkaimjY}Bde3pq%7!a~76Ca@PPB6>|9mxRQYzT5r2z0ot1GFH|0CbYZZASJk21py}
z17i<p+>zw~(+p6#1l0--m|$!gK_$p-#vh<&BXm0>D`-R#WX~H=M<s+MA_J6tGD;YO
zSyq7Bm%-p!K5)VQg0X=awl*Rp0aoMu|HHrl830F!fs+k5XhRZYz%>pia6u_vUIMh;
zE|Vn&JU0RE4?z}uLn}RbA5a0A!y*!+)+Gt97aUZ&K>gnTQXVRbU9fXA6uY1YXUu0w
zNFZ8e2Dmi~4juUrP^Tstw0#aV1_;{k#~?oe)Y!=Zok0N_?E^=xe2fWWCMe;oVF2}r
z*x()bzB{1s%3`qrukgG9of(BDd(etbE^tBtTh=eZ!q5X+_P&I%feXC*8ZJBmR62l#
z!(h|Z;K~NH5(~8M2BJ^{G=2)&P{vxp;Gj64g-4h%okds#$`esxtzd9coX?^HE^tzy
zyeW)77@^D`j4e#86%5Xb^I2M$x|tZ$S-P1fKt*6N(_a9};5jTl;owl>_`uMALKw`1
zxZw{(TE!eB26h_T2Zjkbkd8tR^J35jz9Y<6Ks!0WMna0O{shn@Tqt<8S}02o;|wOo
zNR}C_b66Q88JM6x1(|b$g+YRu!*@Q5gbXu>`+OFe1x$<)EFYM9m_chRAO?c>;DQ}9
zaRLj23+N;$7MBFZ5SAT`Cm6xJ6QIpxAuJ#YymS8qXt!nw!+e$*%nO)7D!@H#P*OuP
z25!Oy#ygBmCi7XqLlwqI8bPCj;79>=m_fVBJ}`h>Ap$a$MFhOzCxbB*yqKOb2TXx#
zE{M~580NE_VB7-gG0Xt1(g=l&sZaP}!pxxoZ5@EZ0yG6Z;Rg!?56i?3Ht>FsR2CT>
z2uH`5F^k361k7OoCryy{i5#HHkK+TwgdgB_b&Q}wY9a#z`$W*<TV*>2W^@7YX#PYU
z4bUDPh&dAtRG25O0B?o@hcMd*hKUBCKD7OO78Y>P3U1)A$f!Wa=s7+xOsbGzjD&P(
zCRIo<bH0Z*GA30BfFc%DK2E9tjq*eK`;#glBiEp0!}ft;atR9q2QR3n=Pv~+$4oWn
zvv9ccPvijg_TWO0K$_fRfEh@WLA!jwLBRqVNdQeCgF{RMywb`5ECcZzNIN``Cij2~
zNpK)do&XA@QU)bhAR!BY18MReq(GW{03(nlgBvW^0|{(Ee+>(0i4&-Xn83jT3$F<l
z5}>6ipdgxHA;HYK5E^t7ECd)MAi*`k0ugi*EMP$g3U&@q@PezaNgM*qoNu79KZ%2b
zF%nV;PvQV41aRRyiGu??VE}f`q!SU4(QJ@8Cxk&QBaq7`od6wB0ZvepPDC&lGl9}0
z#|MVVETFDAGg!$59TqM|hWQLI9>^RfP{jdCu#+yZFfg!8>|mJ>nia@m;RYpG=;3D!
zlP-Yzui%A;lP>6hmnVU&zXO?Dg=A|G$@YOE+W}NkWU=U+0F95FU_1|M@}FnC02^BX
zP2RCw08MrUvphkxR6)WZ6W|zX6nII)5zsKn5s*=tEHI;>jSiLzpxP}2-spu2!wO+g
zU6tJf?Qcu7^)PV0lbX*G0-ac20NN`KE=C}Yz3duL0S~HN!IK7k94u29SAd5+L8m){
z8tmXG$X)?nZUT2I$dbw%EDY(4SuE)ppk^1W{>XR(T1otd=?ik#k>v}hIE0PGf=pri
zzyQ&o3Dpnv1xv;aQ1N*Ksvjl_)(;t*V*9{QwF9y;CI(h5f=q-gwFj4uRV^$GJRFk+
zA}6y%O=e-?QQ?^^u#{70DXWgs{K*_FD#jd>1t4?bEXE$FavmWPlLeNt>MZ3%8-<_D
z!4lHJh^n}QaRwu9<tG?#psI&;v_Q_=0IF0$TZbWIXrLhjNVQWnfrY__qm02)r37>i
zj*SOLSv`~;P=gS!>0v}j>|s2^2$uqf1tb_AfYN0ci;j)RQdS-0nFsK27fVhJ=ztec
zcCLCL0Iu9QJ}^{05I`6O&aYJu1X#G3Aak6ccn7<XF^t6~0IRW(E>6`M9=QA9B5*s-
z@IX!E<ODmH?E^!_7HF%a0kmDMfoTd#`k4aS&IDesg{)qJF_T5&4=5!6FhbPB(hFEU
z{3xD^C*WzG2$m;|UqJh5KxTlf{J_F+0@P!=0a`r<TFJrjfuV8%(uz}bji6|PYFvV(
zkqPV#s00IJ77N1?P~!+}Y#6xWhRT7aty#drpv}6_I;G+R3quHWZiXdd2_uXNQU_&2
z>Z{5S(EJGK004%H51_r^Fea!}gR#NICIfhjC_|YHD04Grfm$!f>qJ5R2gM{vz6G?O
zu!Rw_juaYv$nqJC87vtPS+sr)NcUt$#&nj+P~FH~M6eNHg6#uCc>r{4i4J29i%U3T
z4ogNgV-9$tlre{81E@F)W%<C^4mxIokpaB0x?BO&noedp1KJV?YUgr%U?_K(0qQb<
zO$8Bb9~jC&+k?3}7)(`K7!*xG$0i7Xy6_N}!UaXZN3-dJ&Z_|F15E{h^g_F^KFN$Z
zEXf6op)4Cf=RkxqFfoHi!9Y%6;3!iDx8>)9UBX#*m;u6t#7LRX1IX+t#|MV8fOt^*
z5|o|FLe8+jYK*doaL{B0SUBbkbfqe!>@9l%+Mtue!g7QeQ~)1gKEn(za4SmS1um#s
z01Xa+h7!Tc%%DXr*eg&;a83YAB1a*(6v!3<)dd+WJnAeR4R!Nb)WOOiAq1*1;fmB5
z)1i{Ehy-o!2H66&gonG6!Ca+-K}orRX+8^&1P7EmpG88QA3h`nRspg`5=m$=^HPY7
zV7&}X>>M8$vPD206F4)2frXV7Dh{r+AxglOfGh;{5J8C+<R9?(C)gjbuz-{!aKBK`
zsUU-){>Ka;XyBNG*Rf@>@PM~3!<>X92_CTqOJYP1NG}It1`CHWBzly=${>L?AH2OD
z$s7)p7~l{92Tlj5o)A#Rhyi5{LNQ>j0FMC>6CMNR3JkCqFjrszTY?+|ASd&H)~11-
z3iB=~plIS$kf9*V_JJWb2Gq~RzHkq`&l23vfmEa*wcurSSQhRr0F6Jx%xr*6aj8IN
zkvKju#J)ky7=cq%EVu`m#Uc>F7{U^ffZW_k$Usb7fRu?dX0nKb8$?Jk4cU(u2hPMf
zECQerXO95pW=2T%16vW70xIvaSVS}!gIP4d>n>mc3mT+g`@kUg0n%aR0S(@OC&}d=
zfRD)VeZjy4KK6$}o`VH+BmiW~3AnWZ8V?7XKcxgTy$xDB_hLSa#spBE2_7T~2R9>`
z${ASRFrHurxAZ~b0@2e0>Nw}J2y`$qPwe1e0SyH*_jPcvOkmu=3=#oXZ3v~{4y8a0
zV;ookV;n>p)awKr$@YO^3dlszD2+f4V-(8-#yg<-?K_}DsNz^YFfL$bjAB{9yaKcY
zWCimEX2vLp37}k$&{@M61~DJf8~~Ym0p!jQ7N0k;IeoSd3{zDgb&mK9Ch*7)$O$0f
z3{W_Sv54q1CbNKcih|2&upg#IurSzzwzGj+>Y$+=jt>k|XMhLLK&AK84g9cWh*PhC
zj%Ng&BMRxNP5l7c4hC*4O|=1aFX2qk1S!ZE2T+#;<OHxyhFd^~jAgNS_%mj*_=86+
zks=$Cd?9KwL25FfYLHSCLJhcT%K$Cr%_v~%Lm4VHsDTc^g4Uz3+(GSmu)G27a{@Jb
z;Ld`m&tx&U0&2ZnfvShv3Q-RUb2J?pECxu!>(HW$<qhZn%3ziWOgq3WIjAsli3YY0
zlo|{i7(-azfZApuEMFKWFfo@n%m)pNgCgGG2WZJ(Fv}FiJ)m8epnZQJ>)Adqz_r(0
z043)OjBgk<;PnigVWw)PB4ezA#J5yY0-bBNgNZSm0lFBMmltFe=u{UICWrYfEub!t
z0qDef_+fL*t@ZO+9xzS;ou1FYz`z4qlF0UfL3RUZjw_JGrG_zxr3QN5-3BJcAdnlm
zxj`f(s${o-7N2CWI8-pEu~bZ9WDH`N0!sdA;PD#9AeJYf6VE`W^fQ1Pli+kB3qG<n
zoy8=FF$Hvd3+SW=P-7{I<pF5BQ3}X-aP|VZ<OnFTb6E^B7?W8tu7Gw}USXWW1UUc;
zG(-bZ4EE&(&}2eBi%JaWghsIHEuhZk7SR5NWR?S<XhTUxavY%Sl>^@2z?j2w05npS
z135(uJlF{JU;_(-fIzbeTeAY2dNT)`dNTu?`g|4v6@g|0wq_YN^=1|}_2wFo*cy=I
zAzDGLJ#c#uWJv&HGz+Lp#TX5?3$&6AWEtpOKhT+Fp!58gI5<8q$Tl!wSi}I60j-B-
zg{l%lbB>`3_((n^2cxU-SDnuyAR^doz}CtDcQHs%L`4YAAO5QIA(qN<FfazenM|hh
z8Nl|-aWJqJF_?m^gm3%;72_N%3@WTe4Bo1sb75GE7>rcsvp94xvbKR)pfVOJ2-<N6
z5oKWJ<oLiKrvq9o3}Z6+&1YbP3bVE`_^E&z3t&|&P)*<nhxk=x0;rD5VvzxDleR$K
zF2UjeUeW*>EK%74>-m6mvVCCmiU958%VJ3ZA8vPq=?pj{LrW@_GfY#2z$GgONTmZ~
z7I+kg(JKOcG#RJ_Wb|Gl03J%__`vABMFPwO84XI?jNWHJPD*AmxdJ+u1hiC7sF(%Z
zwzg0yW(6}8=d-+E-T^+S1bprcSkDP&&@qW1VaUdNuz}zT7Ay@u^T^~2sGk5n+X8fi
z6=<JW7|RLf6U?B(24p0t!vtD-0@BR(0iuzSShqkd^U+~pcmdkwyoLD&Gq?@F@qy7N
zq6c(L7HHIn(WhYwtU3aF*rx%MK~q=^7BH$c^MXC-pwi3(W_YM5HuHg57AlI({9u+M
z=wz-Hj9D0=q72iFDFZhRQwnZ8rWDLRa6g^Vj|CoSej*SiD44*0@Ka%7SODrUE?`{F
z2wt8A+E~Sy$?^hpf@CJN%w_~B+XE_7z)QzN7??r*X3()$Ac-yD#myjn;MjmJKZjTW
zA=y4K`b_~<)1ZyoLY*Ao;IL5X<ODMm=Y!XCu_WYRlY*QWFo6+^9C&>Vqu&`&DhDS|
ze-DWFI6g4?N5GON+XqJf0v3kppwm#lF#iCZAP8Cy3Ka%LHOm*!^3)JeFB0Zqkd7JP
z)HMT?8gf`}Fy8=kK_-9_8))(cYD5P!Q!@h#SORpGBj`9k{}uO{V5ijvHh>+)%<+LS
zZ~_B3gMouSZ~_Yh_$anHjQbg}WEDv63!Jc@k+YZsat<NrluM2ej6oS-6G3O_1yzV}
z7PG))8K6SYW({M|0>}~#uzkUx1G?Ed8CpRnvnxOr%flsjm?mnl@TfDj!y^o&T!O8G
zp$DW~0=D^zF<8QexfphvLom1%1ez>n3=RRg3C0AM*`R<34iNycL9JV;5{LyLiy2J7
z6Kq*5B1=FcjG(gzkQ?G_K<C@QMi|*XfK`K6x+ODau_Qz8+<`V_pd+PFMKO#SEHTN9
znJ`7Lh6>1LsFGyHbeJrxYYZK`F=b$3NMLfA&r&ggk;w(rp6B?$U>X8%G@3SmnBXB)
zlMe#mnG29k@TNBtP=lVim}5Q*2R~yb3%>w}4VgMH<v~+x$^$w+1YIr2iQu4#xdN)9
zL5tcz3(+kcV5<YzJ}`i!z?~9ssSghUP>VL^jWl?~0%42-=**ie78B4yFO~+>lR{W}
z7(wj>h+<GfA_lBFlf@(fv}kV&c(fZ~K13bJ0ScgUFN4JZv`RjN1$6!hXww<UG_(z8
zAOo!#(^;%RDg&S@1Hkq&O$-1T2rhaVVk$uM+&L`#pi@dsKnoB+av-ZZAQCG2;2nP;
zQ5a_Xz@QIXMPY)RZcJK0qxCI}lOg5VWX308kHBiVCybv#@}C)hAPd7x1=Db&Gg(x?
zMneOE#iWKYlcfe?9!v~uUM367Jg6|ZuLd$_2dHC^3EEi(awAL@yokiW0yO#uwh<Ki
zdKoMX6^vOd6|*4@pUpT2xq61E1CwkY7(j|k7&Ad<E`j%|&t_!IV3`d%M65U!bch&4
zE6h4@X^pJaL5RD7Y5rs;gZYzLxEPz}PiC1c$l?&AjV_uznZ<JcWELI=1_sXglUWSr
zPi8WlKba9kv&2*cpeyfU1Q+NIDqWC4HPAFU6IjSXMX`$+%u<|>$IOb^j2MP?R)Y08
zsB~6<86GN%omF6#g^FTlHJF9hP*6Z>p*t0~BOqN=$bg>S3KoVMP$p-oX$RGk?Tl9#
z!Q3m1cNm%bpqIQb=$pV|60`^M3}~@>7K_gjj06Ui1+Q&}$iiX>966v=pnQgfp_nm)
zr5MyXV%ft8QHETEfy)PwGSE@MF*`uD@(!pnSXl;6UMemyM?uC=*gi1G#DES9$ze&T
zVeYA&&(Z@rwl9Ze4&xj~Fn<o?0#IWItXl@ON*uH<8sak01QW=B3>JnErXD8H((Imk
zmWT$>XfbGc5=d+U;{*^Fv`w6;2bAPEJ}}6XbTESU%|TkNGCiPWi1{orIpCY5K-Cq4
z%my9CWRS`qpgl<-ZQ!z020Wu_FrS4*gE5W8!UBAG0NCpwLsS@{hCteUAeVurVL|N=
z4jIN|mY5XK5G^CPWCn$*$_>yGi!7FqIiLx>IgF51gwTyzEK3-7Fv3^zuzg?vsSaSw
z1YJ9ZlxZQ#K<mRnK>}3<y4!=rhq<F{K8w!|aC~D#709$`#&niwh^69?rO6P}(%}ma
zpaHB38h8Y!FdkvhE=LtGTScESgGE0C%npfxraN$8sDe&bW=v+0&_F8qq3$zM0j+Pz
z0yVCJSrQh2T?Z=#7l6hJf?0MjU14IWo=`iV<q8w%SPGC%FlPI}0MVYw64L?djCU|X
z41gwBmIa_=EI@-HVCA4NhN#bAiD?1tS!jW(hXw~kJ!HNQq66%Fh@Nzo7>MD}^vkk<
zaXly{t!IP;DNJ|=XdEY<<q6{o7EruEg&`HJ(GgJl16(hInBfRf&}nNRD?whm!@|%2
zN&%q#RuF&BVf+9ZP6DMAr~>ezkYHi>bd%8?@F9E=EMQ?Y19ceFS#%(~yr3=uD?@f6
zsAUOW)?@SqlmU}jT0r|IlfgIiK}YD=J}?-&fW`wOSxh>Z5Q0X3SQtte!&quAKu$AZ
z0I!IJ`p1}sg#mPkTFD*IevdnhJxt8?b@N$zKsNxyuuK6h49{WNz;psE3@O(@F$K~F
zT7AI6lEWCsQgQ;aLkh`Em}Dqe5`2aWSf34O{Z}&+i%kksGic2g#|H-EEi3}f3^t&R
z;-aTvt7qZ4(s&DK!ZL?NCk5=V2GH5z^>y%}AmbUJE@LdDAc_Tr5~Mu<5(l3s&I8KK
z;9?3iV+2kz#y3D^NGwZC31ckC$zX?p#lk^ikR%BTO|V!5NDPwf;9~J0v3PLvn!)%6
zc!>h2qySG5<r_dEXbz}INM->aPY52v0a=q@0g9kBmXI5ajA`KDWc$DX(oxQs$}$Hu
z1_HX-2IMHHIAp7FIp{7%kSt`k4M-lE+d+CEYCuPhrsOb9RA89{S`r7k%%Oz|ylSU~
zX#vtKT0UsJm1Cj;n~{n#_yQK@Vp(V-HGcwVNpUfQk}`M^J~*)QK?|vvnweN)D&R3z
zz#@Pn#z4CO3P5ActSuZy;5EaHxhxU}5FWH=#E=g<-;^<*B_xG09}#09QBX*N*1#l#
z<RI|{c7*N>XgLIKlcOx60EY!!Q3PWqOT-RF=8}r}EIXj9EuiHMszPuJ{{$mwj1;u2
z3N}j0_JILp7r1c`u?CtUA#;1WS870OU?5eI?iCgW4$fwVQU;|S(5(g>>fi(MIX*Dx
zJ`o319uQ@EETFNqEEW}Q=B^r0KtmkD_JKkA0t@6Yr5MIgmKfObY0wf7mXsXO;Ypx0
z1u+DqRD&^-MFTwB09Fe17Dy>*XpZ9pV{ivQybc0~$azqIjWLTw0eMmey5;l<O3M&h
zc%27rN8#=QUj@Z1v_@$@3&$QNA^4#lpc|sV!jRB7|3U^je#7>G;rt)y*g9w#FQ_Zc
za6v{Mw1_px46+Oe#&rN~_xiwaK?Zd237id?`v-OMK>E0uKQINEf!k$}4lBb28w1et
z=${2JehxcmQWsJgLEN=L2^_L)9~jQHfX0V&z{kyiD>aS}4AMI!pto4Td;kt2cL^2-
ze#R^oe&hoYK^YUY7zi#2p1gtB1&TqA4-D=aE};Emp!I0(8lcn0;4P&2KA`3KSuDmC
zpb6ZH7DmwgE!btC0stbL$zogqI%2dQ-X~%EzyOiTU@-<Q0!(NDSGLf)4-($<8$jEq
zSV7&i`Ex*<V_-~BF#CZH|AJdHy#O>;lEor|<D9M+pmB4MYPJsyAhqEAJukpkLemvU
z669crYzB)mL>A#7aPUE7(_ykGnPvKvBcQe*XqW?J7|15jHa^g?*M6W5F6iPhmmbhf
zW1wY5(BoD>szBETF}LK*XEAAE1ks@A06PUF!I%OP2Jar^_`opz1@cD17ob!6dL%#_
z2?HTPHvIz&Qz6K9jt>mgCqNs~K+Qw84-C~;Kqq^1q|RqyaR=vBkb*n*kcK8BY~2t8
zBO|Cps{wB`&0$dpVGL%u0GgT#X88a*LbQZ|r2%|=70Vo^HB3w;3@lHWpD@E{@V+LH
z<!m1qYAis<dKk=SkpNvcRSYUGPB1=UWNT&su|a)3P-X`ux?1q@tidcgpeaG<CX_Fr
zc@Xf81(4%4!D^VS=7WxGu>#$6^M#Sg3Y0QI^McT|ouCm7u;V9y*0blZC}c1Ovz!5M
z=wx}r_=l0Hq=w}WBXk(|3KNKXh3N-q8081k4=@)*qxfM4%n#O3ce5M;-6H_?11My{
ziK4aww4Sx3W<HBc40B1&e3qCwjLap7vJd1_P<+-d0G)%9#liu)lR*S@q)$i;BdD>-
z+{HK_bj=UwvL;YH2X4;S)_}${f<bGXgIN+Xz-zdB7(s`LgF+7)E+93aaEZtOksxVk
zxIj8%wcw3=Su7BHQkc7-=l8IEU;s;jPC#G@NdZxyc!QL^QYRp5^)+HZ11T{npn()v
z7_)s~084|q4H}>$$t=JJXMuM&K}`S$NpA!w60%qnz}u{#B?*g#J7WfmJ7mWtR1BmE
z96m_eGFcQ1m?lQB7+5g%MX*>nFlMqifVMb68YLhdY#$gPHe`UVGY(<V0b2vjt1K2X
zKr7@y>OdH-Hl0NQ<YEJ`T4>G%s|AgiaeQFtJpr0k2CtIronQc-{0HYmaBTEW0OcR>
z$@t*n(|{SYE)}!^24p_?y!i|kev~<D&<Hp~?*x!nz*lyF*w8_8hTa9pYbZgX8Ukwe
zWwGe^fCAko1ayc(ND1f&1#r+qqEiZ_2o&@>9*iL@Avug8EIB2hrP3gOg3>=!8E6v|
zV-^dC2>4V8aGOX5eCVnJhz;@-q|qn^QV24SLx3@vMaBVCFhGouoCCV%EQ=+g0$#(i
zeP95If;Z2Bj&U_909Q32t3j=Z1W;<tVi7<DF;Wae5|(ZPC{bjxD1Z-m0Y?M8@MUEM
z<q(hx8O9728FfbJwqxBIP$vayNyG<GotwoX-T*GSkt{$YA+Q>@^vNt4lUZ2AQ<x?S
zu%zTL^$D=#RDjqO4U9~Ekg9|214ASSXkAba3y(E)=$Ro>z!($?pgJeg1yub&>N#-g
zjF<x2?~}zMYypZR@CYM|11OV#f*#_<h#jD-L?_0uh{%9qPzIzDbi^{)eQX~XK=KTX
zIbcN`U_~4(AVr{E*dUvrN<<ig!N+;9$QVFd9AF1%T7c^LES3Q1=A{GZ!2k+FkfMB8
z0OTKFWLwO<R9pwtjDVQ21~f-m!dSv+sG<aFNHF;cD9vXP&{2Xndz2ZGn8>O?(EzeS
z;|+9-6ukck9u43P=Zu~=K!Z8Kpd%F^8H>^L4R`<;G`J06g3Mw2!07n_bg)@6iw$UX
z7$*bx(4dPIB1{JJIX*C4vSDE6NC2&_23=jm_JQFNIMgiXgAM`AVNpo|-Nuu%nfnie
z6c-DFjDsr3hai1>M4+1~LAHRWa~Lim#JE7A42s=Ldqf~xTR1*2Tz0SkH9tYZmqCYL
zLEO!7d5<w@*9h1g5W)6=;qo0824SX&axB6TjA1MhA3%qHY~b6$#~8-4gYO6*co{cH
zDFlNwc(5=`0NpvlG66Jn6v{G(v4sgVtJ?zVYKF2L;XlI<;-2BZ!4Gx=NGC{N4`>Tv
z4vX{wR?sbg{8RWLi)2B;e<gthbX|Qg%No#$a3IG*HC=(7#HzuV!t#Rm125>5caX2H
z6wCqN$M(wr6rda*7@z`7A_b@djK3_P;drH>2h__4uSAEkLAF4S)@J*_aHRs220}rb
z%(GamZJ3KC=CjzefHq0AfcnzG43NFBP?a{IQpUys<Wr9d&}0yJ#O%rp74Xs%kb^F$
zz}D4Y6#+3B!C3}mCEEvvtDyOMP>BoLB$LIWT>xemfR6kr2M;!aoCQ(~$%R)RurP>#
zm54|)X0b>ofY}M)+Xiw#Y=qKlGAs<x5hL*KK}fj{cHK1-&;}aN{0zgjoDiW>1`}0|
z|58?Rr406<z3WQQkh@l)Ayf>LD@K!R;1KG8$@ReH!0S}6HE{T1$Z^=nVVI@FVIzlO
zxf1BoN;xj(7ji3%tyUOILvEtx_`q;m2Xu!NcvR=M19)L3=p>_SISioG1!h)&X4Js@
z?5{O|TJkJx93L32H840(<eC?9koFkc2Zrl8EDTRTV@7Y--+=Z*LOWX^;RWnW9`jk=
zu&>Z&f?YrdiL&b*@W~zUF})`kK{G)t7uZj5fEb_%gKXQmQ3D!Lh+uibc7Y3Y-3Qkc
zDaHr}PEabpQNRJ}8Th_{UJt`?_Y7z)SOutm4%&yr3<{nH3?L@N(mM<+3}=`bBUr95
zPY?ztKX4IwhX>S0%3<Mefi01P2+M$qf6$2`pbPGHFn<9}{X_kBCxeCI38*dkhG_*z
z7*uJqePBQr26+QwRs{>g8YadlmOD&;K-3?mW@d0r%khEXPD2RjT1AjrNM(HI1PcS`
zpgK@nCzM6U1bk|yNdUNK&hdfa-jqMQ@GSM@%n?TLEl41PG6W#47)D5I@h%H^<{H$b
zp8(nl2y#2vHBgBtNLxRO<pbk)l+oS0kR5QLEPFsx+@UNDOf#5RN*TaAG{LQ-yE>qW
zm~fUAj4wbdia=#7+XsfbC7@ZaXqJQpOpMWx(Zzc_pxcxnrSe@D4rUI}QCpz6yX&I?
zZMj0-3fsLQ!5GHk(E%FC1E=Y`Q&<?IAsy_yOEjRBBgn2bEDSvCJq%n-3{v17cAx`*
zz=5-a2i&FyvDcWeS21vZ`!5A5<3Qod_JQHv2^Izx_9_MsRYR5eEG*oNSuET<Fh0bg
z_Zd!bgG+Xf4-8;-6ay3NOpp6KEDRr*7{gdTF#TX+E~}r<@`Gs)HzQ<?7~2Pi`x?+h
zvw#~EU*I(y4EJ4F7<Pb)$^%R-AYstj0FYWVVHOnCkt|@<k>Jy55URr<!e9%TK}|c5
z)Dmd3Mge@6`xZv<s>BIQOSs_a<iQgcM1^uc2Go1bVKD(8nF?A5b3ccLX`%$w`wbkR
z1wEkd4#?~^EDUQP>;Az9>_LO^{tj^3ie@>(_=gd6Y!OHtR9QW60JYh2Si~h5!&zKP
zVA~(=AK?JSH+bOW{u2RE*uZq$f5O7R!ZPs<!+aJNe#Q(IegQCt0le|+0S^OLwIFz;
zM453uWP==<7}(4Q9uPA*J}^A+0G+`GF47+afVK=kne5;@us{l0z(>A;hG5w~FgySs
zUJ%MsG6kX*>?|+=lDq>deR5cQK--irFwX&<qBDnO33&8(3Ck7`_X5im&>?eR9iRYs
zXaYJT3A)Q)MuT(W9mq`Id=?FVPzxG-I|eu#K2l&|n8Cyt&oYB)4Kq_I56c3UCoCX(
z2I~S=M$qsp=pYD?!E7HGK#Dmy>LJU8=7WX+QdtDL8NqAxJ}|a0ff+5J`#z9HSV5X%
zK<DK*F!D}(#{gLbQ4d->4cdwfat+9I&{dI;0`idx3qu1FXh|B=8xZw|X$3P=sQ?Se
z%b*o%EDu;f+$o?Pq0tPypp5)ri#lTt125PdP=IX#Z-~6gFrS47d|{Oa%fzb;^C6M>
z(1d|`;&lc{EW$VpEF2#g9+rS=Ch+kt5GFWMA5NG6OIvIo7#<#hG?6SoBU2#zKw=Ld
zV$u$b@lZR?FfdPi2eSjp0jGdRE$Xl$7sO0qU;<Tyk7h71rZ9l(L<kdX^JASJX2wv+
z!cEA&lE*rrg<;VwDGM0EK>!*SiDsF@bc2bh6x6@q_`vYE;s6t4JfyICY~cW2y9WxQ
z#}*FE91Wl{2&Bluff2Nd3(Aa#l#`EpKznPD*pSPc86Lj?uiOC*!#$qEz*Nry2|Fko
z+*WyfL<N+~A<jOc4BI>Z_=gHJha$|<A0TmXGvtX3D5Joc@sK?K#G?S5B{@DYfS6F*
zpDX|`{{`9pBm`kQlnu81Ne#mGCp8>QrJ%*CAX8R=aue85PgZb%FWLm<ycZzL!Ljk+
z1tOP%H}*h8KY(&6xF`MO4CI0$Q1SHS#tKGI84F@R<){GN_r<~j8ccdB0Lh;mVCO?(
z>Zt^1|8)*%YgH)ZM98NSpe7JFbv>0}VD153Dg#P&PhCK*B*=~rwhs(9rohfXhV;kS
zdO#;?&WDWQ-dLf+!hL`N&g0+!%i4j~I)Wnk#tIcsV<dYkWMJ;bA92{}=1(_3)>(0U
zV0gL*Jnjur|MUYpT)~eo;1U}&R{-u>vVCB9CIPz5)?hx13h3$t@B&nDGvEa1>~GKt
zW{wXG&vbTxhB?85%FiUOfYz8nEWatk0v&~f91HwR0_-+F(2;^5eJglaxR_snyaFzV
zo;?8VA1(&pDOfBrA9REYD0@K~BR3OZfr2=TT?afk1scGEgw69CQ$ULkL7G6p`h1QJ
zV-Cj$hUYgJKq(X4R(pP<0JK&JazGdxNREXe16(w)WaKkuvE&zkIS}{15HSV~K7-5y
zm8dT~SQsG12#W@If@BFJvf>k<h3Meab8`W-2M;ODZe9SjM?zWF$X$_V3}v|^e?$$I
z^=|F}U&;x-i4hzIZ@z%W{z_R`Bor7^VB2m`1tAwFGrY8csdRyziuQ7i2s4KxC_Fhn
zFuYtN0!;{DkH55$0mVg74Ctf?kTirJECb?$twtCq1DjxZnV<kR5S)KrCMbXwh=F@%
zFB24?hC`%ItYKq}g+%hp6KmK&Hf1jbHOxUaoms&K+K>Pl`+4~Se9&Yp%Nv$Itc<bH
zF-33?LqhA71GEtVIpg&K;~8+jbqdQ27Vx33UszgLL3{06SbJE(0#jI*u!0;0GXuQu
z0@B8W3bB1)c;x|V%hsx}++b{BVoYTLcY{+{HZWZPUrfa^gN3P9g=GfI9u_A1`7B3R
z&OoZv8zAZd%Nwxl8<sCDjHxVNSpKju)iSaCVd-H7Y3c#hLa7j|7{SA+5H^?uSq(a>
zl&MyY<pStJuVj`zAUkteT39BqfJ7&-Y+(^^W)K2xY3F|bUrYqVfL-Rk2Xt9rF6eSW
zu-YdqFIX6pSzfSwVPUFeVF3q4tr|-U>l9YVVsp@y;~;yXomhnJ8Y~w;IW~>u3gaFo
zW)A!LEPI$vfUfy&0oC=j8Z1v(-moyHv4H%@RLcf6S_5n}NI9s52Z_K}5bp?py~9*1
zz|z7pg_WsR090y#I?qg?!AVH)!>u=%54IlE83)<Vwt#`TXdVMg3rh>Q1=GT^g#|3O
zoPp&D$UO%0S)Q<bfrxEpfH=lrKG-o}b@Lb)Aos5`fRa-LV=PMpXq7}P$d#a+`ig^v
zL7u6WfhD1zk*O9GAm9}KDhG7qRjmq(_7+CQL~zmrIT0eN1{O_#RGY7Iw3%u(AQR7E
zwg9Ard6lCr-pH`RafMC;n3Sv4n8F0&%7Iq5gA)4-1<+(SsDgN<0UFnZ_DNoQfc7Bd
zvN*W#){3yLFm7RhcAmkd=F2mX%sB^^cOm>7IRu{(Jn0Vd-0KA_3|kl(V_A-X_Gh9C
z$3cWa2dQ#=V0gWvm@yaPrPnJ!cS?hEFGv(}p*vUs^gu+AXeuNRgP3XHRtFo%3{cCP
zy^g^|McEOQZq6{lIG{KOIqBsBP{~~iF1bs=OHRSzeM<w{DgvET2QC?Jtw1Rmb$)<C
zC5y$u9dzO*+Uy@F+SooYK-6S{)MT)@gVn%CZ$U~x_Jh=bH{&FLCYlp6VAITCSLjS2
z!V<6=0+vhwO)zJ$s9;zEwnjSwG%%ILVgfo~jpYI32joFgmJgux392u_P6oLdqCS(w
z<PK=Z4`?G67kty^e298*=L(_$p(BIEB!w}UB?V$WZ0_L$;}p;^z!cm&e!%vDa-a$5
zz9rBR<cuLKKNzQg?x+M!&p>jw_8!oMJHad)K&3@6_(UFr?~n#KSt_nDvV~7(iI~j7
z0<sj!hP2{z1Y}@*&`qLj9~eXnKo@X0%x77{yalv48{{c)8O8R2LF@_(LjYU+WR`@<
zEGz+EnAlP$v!qRCVfn(e1a@jL%LLXFtZa~@g+bXC(RTrBX6oc%33$WA7C4zDXfg}S
z8>TJHFheG=9$<yB4}c7Tr~wrepn?ig<v<M)02=}w!hgfGh8bqy1lA3#F!lzJArLj-
zHWJ7uAWwj{xihiFPG*Ul%mN-=fenTKVY<Kq6K`PM!3t%A^g(U^!@_Wc33^N^%Mp;h
z$&*=9CbO`-U|GP*24RDgBYX|IAzT6)9xM_|n4qD}vV>_0Gt8hHEDfwMb_44KR;U`t
z_$b6?kTFY`*q}!>EMYpp0#(FvgXII9{efiyD^v|=H9p8CpwuWX11g5tq9?P&fYZPV
z7N{bY6D$|t><b`QK-56mRN^Npkh}zOhlBwOLxjarQ5~NZIwB(S$_^^xs)|cRbvTre
z`05}5b!35w3d=Zjlt9;?JYgbV_Y<Z!OcqNSQSD|#x0_Li1Do9p44_@pq9+)jAq{Eg
zW8pJ7&u3skQw!rWbJ)&@8uWkxnrxs3Ve&yO9f(GR9E{Hd8bs&j_`o2p0(TJjC?70*
zCOha}DI_^o(B3U^6$U1!`3xLr=D_&O9GdePxcN{mf%73H0zw{=v=|t{hMi!5=0r&6
zQ5=)c<O6dQLJs1n6Aa88N-$R;Bq6Q>NvcCnM-x9`0J8;rmKul;&GT?REc<f6y8)U%
zp!1GDK!x!S=q)bL877tqOb<W<feaiR;4%wbAVPFxvP4V)jW|z%>VVcvEE7QIL<h5M
zVR`^w{sR?eU_iGqgC(K^boUEO2h#*5(9(R6RiLH$(A&PX0$3QpCsywOT?7%rz{tS?
z8Jq)2fKR&s9~20d4Fk!7uL%b`5TYUz)cp(w9ea&jyX*jMe+*{11HI$|<~(?Cfb<H0
z&!vL)`tC3?mxA_%f|r&-j0X>thO+SZFouJcjDm*dRxq9c4Fa=rAh{mY^#WPX2(gYa
z7;?EZxa?&6z#t4-XAIi+c?5KXmI3Gptv#TV#`Z9sVPbBt2Oa(Jgc*7Dj))9snlFOI
zXAdJ|D$5?mE1)HJu;mzR9~eXwK+E{ULCg3Vb6GZku9iz>IRS2RgGw%Np$}4~0}7Zh
z7MmrEjQOAyzD$g{EIUB^Sn@&2pz#d$sfYn+8Dl7m#RAZd=>?#>_wpeJXMpyCE@1-c
zXF9+H8Vmqwg%oKbHlTU+5YTc{#uOG%@?eZ*nE^@_;H8k@q8#K52hf^_U=|JN`kWP@
zCOP<+V9>%Ea8CwQ){6LmR$m6O$TToArm-}D>iR$y@Hs1Kpz08eL3V>o1U1hYGgu@-
z7-Lv!CV<pW04)}eVOap``J}OcS1E!Hu;lo_AhG~F@(LOU5IM61bngSWJQF?v8jAvt
zQ=l@LK%GlaDFzV+mpj5I7(j&^MB^3s?H9r*OeS+^@dpuxXuJY0XuxHINCwD8a9M@Q
z1RZP73M!T$!Z0S2HMA^%2!o3OkqibVPiWZ$5e64aAZ8$>L;^9>Acc|00+34~7NRgg
zld}+8z``&llP%0burS2J1q@7XFbl!L5DOQ8E}elh^TA0SoRWkcKm!3;ECv{-a)M$I
zG>#+;IzpShhoOswO$I!;3fc<~(JKKOD+e7?0LsYFk_i;&p!8At1S$z$+yIk=j+}!f
z1wiw5T?~j>I~EZOagZ2%${isE8U8DM0qQS+TkT~WBA{Lbs8dtM!2%vG0=r4*2Gm;c
z{w6eQ!IDBCE5O!rsS7}QJS-v(k|0rJi{X+GtA*}B*2r^wU=U`3TP@52vl`@Wwhs(j
z8K5UpfR3MFS-`jkrNs@p(G9%p1*976T#$P30z4DOP!<!2YG~01zBmp%@`z9^0GdI`
zWD!<j3}sQ712!9`dJZFam=vK_1=`U8FIfleBL>e9aeQFdS^(PT1s){XTA%`&4}mm;
zw)TM5CV&h8dBg;C2wDycw+UREi3w<&5tK2vnm}$92N`B!g6g9!9MBM00@_=$1f$OZ
zKC%;J2?(=&U;wFCXUt?#cVG+y-ER&`N-#fxdjw&iga}d$N>y7VKvO80EaC=?VJrp@
zP(lE4i65lA+hV}N06wMt0H`_yE%k+YWy=}^u%kIXFl^ZY3Jh?P+HwWzf6&soEua(T
zK^Jv_{STTf-r@oFG>jPz-apC!5)DHzLCbN$ZUs4ZSq7+x%wmx_1DfDE!*mB+@j}xi
z%N?dApi}iAs=<i?q+WzElSO0?=xoV7Q1!6D0ILTbRR~eL0u&HAEaDG9<D4Kv*gh~U
z?*NTcg@G3zKpnOG3TTE3;y^GPYy!xK%dddW&@bU&VP6BPAwgRMKt@1BIl-dfRc2td
zcR&d*hedb^)HaadiU{c3um<zQ37~qK;{(Hr3{YnpJp8@<&JysjE10uF1azS<19Y9h
z3K0%w4p74ol$e$s04-|*C&y(6z{dr`*kCnKulfIgmQyFdagI2mA4NWs#Q+@HpmPF{
z5)w!aWXKj|j5%Wli}?Xi>VzqS_E<p)4WcXnJind6B0LAA43xD%roog!XS4%qK*PT!
zOe`uUOwc>tKxh9}fL3<puxNm)G4MQXKnG$H3><e$VGG2dYnLGRbHLI?15*cVqd40K
z29R2C_JG{|1x*a#PB3m+kbfaIb%3rA%VAN!0LlWOvt40XU>So8EDJ1CfM<baHqa~p
zO1?{{KuZwFmP(Ef3`=K3fR;{xVr}UXA8=^^v1SQqtfkWeG-sR+wjAWPC7>~m5Ecj6
z$|&$vP+(a|{#=p(Eh#|P`mwA*-BQT{y5<DzLWmBw4-6pn;Gh7P6p#&=(C~n$Mky(l
z6o4`atfYXfV1}uF0b0ik8_58f+yN~qz$Z3>4wrxh(^4LINwHJ{9!yJ3puq&n21~$8
zS#wy}!6Qnb;$g`G8&EL8n9z~}Bnr)xAZ7^iR-6SNKpRK0SQ2J{)>DAacm<_5Sc+J{
z`~h}fFDNkBJ}`jPgU_JuU}g+w>0n;K3{nsC9#}niD+_X)5v0e0F@we838*xB!UWL+
zP17t3m@lv~hO%5>djY;G7$*FJ?E})iy&xmf8Pi$PKY$g%?wbOQCxRRXquD+%EL;Ez
z{Tvo?&>mqHa5)~r0!i5{9Zd5<1Ki*Sa1P5G(5CtvmL04ISV5DnP#3d(U|7V#!oUGN
z2%d$*nrkA*6h`Px8KBw>CNqO^J|mP3%D<4L1=4HHGm&!&qlb!tF2{eV`QX!vP(?sG
zQA8ls;1UDKdQ^@N42xVqlY9`bv3+1zJO@;~=CJUHFebBzlz>;1fh0jvHY^M(EE7*K
z%x6*YXUt;p4*+u@!<>t40${6HK>2E63=4w-Seiw_nK6sS*#*o2jsJj5gDKGgt<C~1
z1<zqIac1gbU~zT<i9nTs0%!wx?gwP2hB@e}UkijeP-za9iJ<k=92VeN4UP{COAHiX
zOF$t01dWP=a)1G7&1xw0S_^3GL&lny7=R`w!Gp9*3<N+^EPkNVZop0jxpn>p7KQ@G
zES7>fpnmEc#tpCn8oZlj18D0KEUSSF3yAtmmIBbZq7mS$dqHcPK?<2Bg3gTvnGD(!
zaRIbk5Y#+j*}(V&JPXM31Y{cYs0Fy)pp|r>E1*Nc>OeUUR6s3Q0h%5LnFY3WK?Dl}
z2P^2JWf2w)Ybe7ehHWCpWR}SykTJpq3q(Md=rS-fvw-s09u@|0PmzHKG{Au@iahAZ
zzym&D0W{zanp}cgI8z0*^)8F0<PK;M^bQlsrW=+gOjDS_7rcY=4BH0=km?RbCSy=K
zy#mRf;8}La4hry*I8Y@9ASFwf7!z5ZFtso<CbIM}Phn<E1ltQTXblU)1yH30+Rq0m
zKS7Q7nJ*v}xP=2a)pC4bnE3&;o)%m=gP5SQ6C}C^v}6uE$vkrn_;f<>>K<?qW~e|1
zBo2VCAV0uz0=$nBR!E&-S;7h~HNh?cMGi>40b?eM!3Gw_aFz{F^{_$;tR7rQL9#4J
zHF&&y0cZp00>&la6DnaT5yen&5d<9tfGC45VP{}OaxLhla^|jr`78`Cn8BBXy<q;p
z%mZ)YJIKsu`M`XJ1tbNUGXNJnY#$ghYFHTVFf)d+++lvf%r;S+^Me%V+?fx|Y<&<m
zNE2fi12Z!-6BDQ<0194^CKtvq78mGk)GHX7O9VjXuV4Y)PR+81g}I~vC3$3k*2#lz
zwC9&#jAW76!^~0%x;Xd_^9~j;i-8exh8swo0ceQaU<V6}hbw4v9<qeVd=`TpET9e|
zXvq#}O$^8j2SBw+D9akqA?BehSD0@zgDzZVZh*Eo;a<JK!q5O(^Vh&Ug_&=n4`g}t
z3gZ=^RWMVS=P>j2p^D7`mDS)zAtcVSYM?DZ39ed(QU)&m|57sZStR7SY8kqqJV?&U
zs&QeAf-o~<L|`RQW{e2aL?3X}vVCC4EMQ?+!3c^DmJ3Wbm_Q6jft*<YT1EpZsK81=
zNh=d{x)k?hmL3K!<`=T_C$q2!h_g-x-Db-o)5FLLx$m!saR!WefawGiL=-Y-mRX>~
zGI0kJbSevC0o-tx0{AhhD?rUA(8<T3>J^&O!RpvPFo2Xz25sw~3@!4YDH}~bg9RoJ
zOUvMG6|NkhU0mSo=TgwZ$lL{5cmXQ6Ks?4wNW}qWXF$TuWs43|2lTRDC>uT&lMdSb
z1lr}m&)k(UpM~EB*}347JN*ZE5iq1gPyZpp!X?}ROOI?H7}CK*PgyKBpmilITM*aN
zfXZ;NhrlHONEvu5BIs6R7T8trFn@!a?dd5c;1U?3z6Vn37?^;nc98EN(hw&VKn^v5
zb2w5UE&|=k1?$Bl?_NZ>!}bQKw#sA?P-gDQp3ed~BNOHf@a(1S4HnQ%YGAXWY>;-g
z4-95spaTRb=Y@hK!A=HAb1-JIa7Z(EX3uAl2CG6b+UyJ1XmFR&TmaM%1ls}^1{;%g
z0(5v_7K=Ts@rxReAZZiEOcoP+#tf($m>qDJfYfL(X0T}3Gp0k;z)}!&6a}Qho)O&=
zaGJ_G!NT3iFolt`0kl3F)a?S9%l3f*q=%r*7eHN@3>F1*#&i~Q@GU4Xn?a@^W3~?r
zNi(3QBSbJputY!xC7@Y_We#Hp3u6RJ2g?L-gApb?fo%aBV+6|rwkPaJDV603`xH*-
z(qm*hU~ITunV^#xKpLT8#xjTT1`}f@%MB)oH85eYHJNa0V8Tz>TR<_~!ZC#d*^nt5
z>p{ZnIsTvs|KVunWXxn~=A6Qbq#EWXBpU9#43>}x#!y&LKtqmY4&xKhQDsk<Uo$gi
zu)Jo5I29%fc4{cxsW4%1h=6y{gQ6T#=q8)6FuVaBivEV_4N46RT6)14!P3Hd0wu6d
zu>D|%tn-GNfp9b12L_O7dqAbw9!7|1uuuY<mI*fvCVYbJ1smvqFSZ|GOJKr3*e0_x
zX0l9Xe*lhAnD7Jk=OE$d>_3o&A?<XiYoKm80c!M|U^>sln89)$>M>X-fSnQwcM41x
z?6FYz1O_<YC4-uIj3F!>+ZowQnWr!sOU-Aw!190v&RN2?gq<;jWe@uqcE%7$Wsp|0
zfsrv1>?pPm3~4h!<wG!w!W8i61t_pUq9;H@{K25>B%ymTA(4^xfrWvGxkq6>3y%t8
z2#bLUm~CPMGdtNt1h%v`*#^`gg;ir9Zzr%Y8~{b+0j2{e5qW~;1}N9uV3`9BV`#1c
zI}qd?h({qCUqV^tFf9g!*<z>}@W26?5y}EH11bz&zXr8>1v6tL%L$elpbJcpU9|<2
z`9oL~-Y_%9u(Yt8U}215Il*#*mA8aJ$W%-Ox(o>H5Rge<SQyqYv)4ke@j1fW!3yJm
z9Sm2(7{vmTM4ggI5dpRF8RJ<dFivL#-2*zEv4e@ZjB!5866Pn&AO_5y6bTlF4p8TK
z0rL~^Rt`{Yk^&m-iG#EfQb2VV{LGD%B`geoK$Z6trW>G!HaM{{g4Y5;4iry$0vfzA
zn9ssv0NV7xcmvexya74`qoN*q21W$S3#JCpWiTDgGhmm&uzg@i<zQi$!N?fN@`3RS
z=%@`g$SQ^81W+*;!2*dq1{Bdyh-fGS2V$}cq&|Q#ge4$^qm*q5Be;(Wnx$q8VY$F^
zg9R=K3II?OGr5F?!G^5_d~FzujRQg+JSUR;g#pwE1XsbyR}?^NO~JJilnt(|QUe0O
z)i5~yq_KdUo5K=P!EWeZ!yuzFpMeA7k+d4nsAVLJfem9Ms#pj}EQEmz><Lh&r~w^V
z9tpWy#lQyKvw#@h09psw!@#0r0J_T+(uo0Sn8CsTZg7JJin3Th*KQYp)>LwUvK^>d
z2x`%=ePD2F04-C^VqwtXg|yeLRxofjD1w^@j36~&TWl797QbY%s91om|14k(W+|uu
zufD8+9Ni2GIkpcB5M`MxD&R@W4(MIk&=Lxgc5FU?M(DsZFE)2T>tPu|`(tbwKumD(
z+ALrIuaAZrY5f6|N3vKHz!3=V@S@%|2T}wc&Gi6n+khyNgx=5%G6(DjkRtH$JRm>B
zfbIwcOM#r71M*!ciwby;3tUtIvZz<b85EV^hCIX^6OigG7L@?TV3vRmSQi}RB9;!&
zQMp-Q6CecJ2L@{s76$MpFYv}$h<a#{uz(KhVGLne0MeET89BC2aRJRlfI`JOhXFJO
z;H$s@4kT;vZYpNba&hY%2H3TBFg{}ltPrpUEg<G8VK9~g9Xc(;rZk_0M?e_9x(Fc*
zY3*810S!8UcV<~HVPPu)owP9@>XsGo_3+kv;4uVZhCrvaz#(D<yAco^BJhpY;1HR?
zcmc7g2NWi39~eOD5g`Im4-1hQpr8n0*#pv+$-n^etko0`Scq87K?xD7IiQu(;1IBy
zgBl_rDR_uj9bsYM;VEG-LJAQPM2H}SAt7RQL<H2Z2HSlD5h7sz9q{2-2qt*Rz7<#$
zTq0Pj2yk~IEQ0g`&;`K>-RciKL_ti%bOty~?HG_#8GPq4I7}NrXWnG7>|nftocKV2
zi-bW}4l_Vg9(aQ|EQAd_7&BQsASS}Z8W<;l8YUAMA$xma!Uq_yFv9nuf($eO&8~;A
zfX>Hd3}FFX{Ruk35|mc$EKp*`&Vqq4gaI5gb{42H1Cq*wq-eVYh$b007o-Wa(BG~B
z6gc2w0>lKJZwje6**-8>&HzoWXR+vj&WQ+tBp)g0VO=voYY@;fAV|G2V<wAn31bLL
z2}C{2hciI)`5`PDK-yp@hJnK$qA7#LxC6Ab0dzJps7WdTDO6a%)?`3RG|Mykut2c9
z0`U(t!&+VeWgl=LSYAO51dtRYc|vUa!@?kdnq>u$5-1|ef-YbN=>uIH`$qyiga%sc
zZY2T=Ztxx!5EHuLz{&s=h>*l)09Jq~#Vl%&0}*oK87vT&fR67%3q+85L?A-c!vb*$
z=v?X$7SKr>@YDkK7DQ79i}4gtAWngv<|YA+E3h@tK(yEZ4@8R{D1m6P10IMLJ5U1=
zBn1i#P^xG9z+mwJ5{QWG%pxFxEtj)M$bd^r4v-!ha3F%3I2M06z@vB|;Xj~#BjD~W
zNHi3(E*8QBho_|iJZM485Xi0{OAiLd49M~(2ovNo7zW*?eFiyGL(ZOo1$qnP6wq;(
zQ$YK*gIVS<Vobh4;|?6K4rib_8@bQSq65y^5MyC+1G<=;F_UEm)I6v#%uQe#>M-yv
znl+%)bZWq->9Djgt_B@extj3+BS;i9g9kZehvNf-!w=Bj2ynIJ$bb@Gjtubla%4b_
zFOU>8=R4{^G(mH|qYeYpL>@@UIR=1&7M%4#Oh~R|`@kU718M?gv9PFsaw0U?AX!jo
zf&%PzOGtq$)WZU8M1V9}fRcJ9i%tkgqa-Btfqf1lKng&&UNYve2!ID%K&MO?Silo9
zNIrsv0X!O?W6vU>!kEmWVgjm{bL>I-L1Sb>BA|9$4vUNeZ!_fHNzT72hM=<nn3=)D
zq##2?SQsS0+8kIUBsg0bIDbe%j_j4;WB$OD<1mF0CL*ICfe=A9P;owZ3n<*Q76x;v
z`79C&Tu|laQlNGl#|H)>9ncwHklIX00dzU|Tj(AvAq5_`1q@72Aq_>a2f!(6UI@qw
zSu8T(lT~6sAqDLWvBZE6QG!eYLd78ZAdT30pgq)#IiLftazIDE<gm<OTn{>u2;35$
zZv&cg1|6mV88v15z%XkE^q8?ZER10+b6Bn*cfDAyu=TJrhOzXp&jI&iku7BVz%U!M
z@fFmYn!s{`4RrV(BLgEN#AHY>adrx%)s~O}y6flz=$P;e%uhgFizm!Ipuus->=(-e
z))$~jFmRncyT_b);&}$pkT$rIVf(-^#|O0Xj%lJMq=^>Aa)I#x=#GpZ%pEMyeicYn
z0H|j(QHzBKv|<I8K|vB%K=ZAkplX&elw}Hd^*750P!|V0!T=6Fwhs(*Wmp&l*h`@u
zIsx#ob_inx3wQ|_bedr92N}@zC9p$h-7x@lJ-`7w>y80q7VLuiS$9Ca0MNNd2B51H
zK~=&mXg3AQ1_^@-xj76jEL<F*t&mV2Y=n4@j0WiFuWu#Lgfh1SviS$xx0%}k+wcQ+
zIw;N0cmbMr%wiFT9H4}hU?6#NCIfgw6lm4Zj4vAOB@j<Sv=c?LePFbUVPQA}DizNl
znmVA-J(eq=QK(>+8%&_nyIJl-*I7c-3d;i~=-lpn&|v(0=#(u?b^-Gm(4@*5mMthF
z0b5vpurda-{9xS!9+QHp-ow$s!x+rc!Lx=3$%`y&c<u;*)-($25kwZ=BX~uSF_`6w
z-~$xl2ZB$87=u}!2ptebR((M9geZ6(2Xq$$wlDz&!3og#YZi-52<XJ&1)zTR3FaP<
zOM6&*kaGyj1@<}IjKM5(xDRlnSi=2*pD~!_1OEj9WZ??}FF+o6A@Bu7_=~^~kOzJU
zUJ*f34W0;P`@raK!@|%4azYE^1MoCBG?W<FL8q*^+e}~rwVOd_o4Y%xu$6&3(BRa-
z=pF)^Yl5;<cEFGAckk$CWXy&3To^rgK<gNSSsW%Xf#+XA6)>ZR1L%ZFh*pn?7Dn(c
zPEeV}=#c`t0wk2BWDe}a1hx;19tEJ%KA0t=1G;_&bo#wV1!QzQp#@Yhf$|cgrvP|=
zIVi)kePDE$z`}3@<g+7;M^JnQ+M>$nFadN~9mEL^Q)=Ko1Nqcph6-B+l20AhoB$0~
zfT9y*?j9C~EucbZ3)2i{mXf`otrn~t9~d2;>_PIk;{wnKK`=|m7Vx3PpzFB6{VTQ)
zj36lnW{!yYEDQo16B$YwWRw%;vk1W0Df3wbB;eu<kP9|JbC?i~jKQGP6UrhWz+74b
zQVNP6P+U1NXuz2~prZ<)?sXCY9gdU3qM-w7(}GnRz{3d~=uR`hr&k2CoMHZe98xSF
zm|H-jMc@E)ngL$G1=c?&0v=xABAU@@0SiL}TRAw)SR&%ty1*<*=sInA0lK^wRKhVj
z9k>HZCy*0epz-7^0-Gu3V2o$s5MZvapU)!j1hjqq3#fPnZ6pTG^FnhJBZOxA!02qj
z!T>5rS!8q=!&!7ZK=XVa5uo|(h#b&daLxztaXFy#=0GRkfYxIh&1YG_bb$%9+YmIT
z3@U}e?s7>{0q0tfJs^`~ATx8IGKw(=a+yvJblir~IR~<i0bHVkR&#QEV07M+0X_r)
z#M~1BZE`X??}=cZ*aPw=R2(#63ub~AMu3y7O9wP6I6g4C%-I4uC<o%84GTc$Uw}$#
zMwcBkz?l#f^e%hg_h7JnV01YFT7*_=!NT6b#25h@o@8SC!02iNT2BNzz8SRM6Eva0
z=yC$o4u&y7-iEQktHi+LdytrPy}-f%I^&S#1>*^n1$QSvOXh=F9x%N@76zp;P;PX6
z0y<DCj3pq2F%#TgV|0B3nabk$!07tn3=>;5Qj&1}a)ODi3MK$H18m4276$N57ke1z
zFtHTxsh`g>2eiOCgk=lU0f+#&*aB$)`I9W=!7L!tkxD{{9iXNC2T*(l3KXa<9iRcr
z4#opaEE7LLSK%?b{y6~m6gV)!0#HvO>9t@CW3li7w>>#NFuL(<0L3dfj@>SR#?2ti
z7odewps7tpw;e3dqb(TS4PfV*fP4&1oA%&4w}M$hKnM7-^e|2aRi=}n<8si#n`H{9
z=MfB=n1{rw{U1mPY68}@KnQ%a3~13IIR8UrLs>wwp)6q8Q1DJ=khN?d7(w#NOr<s~
z$~uf8U{xVtRZOKeAQhmfa{!O5g|P@^fY-HwibKd{4WLBpU;y$RIK6|IVUPskU;vuK
z1*dQa1Mtd47#niyCfMZ+E5T>(gtF{leE>S(L=e=(S;+vJiid<T!)nm6D@>&<EG#_C
zr7X~v&gus(;DuM9MPzH|fI1(bU}jhYK8Ou^)BTzjST=b8x?d7hF)^%ZdBDQt4{C9P
z0)}Dr4@fz{4>}AK>Q#m{9MFY*cUWOv&NU_=uYf$ru*O7y$pkcG$nk+;jf(_h2xKmL
zjf(_C7;Nqu7f{jP!{FepBCj}~ML--jWxXZ_mQNYh#30)HYcfCvLCnvPV6uVwa?KL(
za$tx!hz(gO#P)$<%^FDMDEt9bV={AqZCyJDvNgd5ln5AD+1SA2>1-buU=kV{pdu73
z&C&qcOblNavvvcd39bR|(larEhSb;I0Cg{dS!9lYw%$TgC&StYP>c6~1tIG}*L8pf
zq;pspgjstS9Kk&vjt>lL!RP6KgMA$X4+|FytOdJHKmu~w5GY$Qtkd9u@W9?&w?+cI
z&zIu^!@4!%%#9~Nr810jh5?+i7}l*3U~WX>fVybVRaa~u7*?u){1VJ^fV+j4F_;08
zqGVtPK0z=4TlWD}DHVefA9FD*Rjp?MFW?0wQwAs-lqlFfFsuhJEze;Qo&jpMKvU*=
z3s6@AG)YnbO9ty*0vLlKDFVa{MKD7^r8melP|&Uiokk97F0pWc&xizHKn_|Ho5jEi
zYJIPFu>dW9f-yr8q9Jf5sE`Ml2lBBAsL2q_@`Yy!A7e1&bd{Al;O;Nty2JHbu=)4|
zIORip3}HjfTz>@`(cq)4Kt2Y|EP#UI56ssVj3F!*KA=-2S$tw(A+UkN0Tu!vCMX2J
ziE{%7sDuh((QyE2Kn@I$3<pwRD1g}t7L3rq*uVh~3=lIEq!$#3Abp_nO2-0XA}F*r
zaDa~d26+Kmx`4Oggs}ART@YXlVYwmjL5MK~8bB^GpmgK=0@{*g*suUxGlsCtV44G3
z+XY&^#P$J07}9fvN^pP<DdP|kaqs|Vb|sz$1_ovw4F*Or;rT2g(%@PF<QkCjJ<zh|
z3}|5O4<mTF5y&u*+!<)a_=fQTsQrX09LfR~290RJkKcuOZv*H$3{al-nZd{y%`yXY
z=S(nofeK?Z%NxcE%#6`27eIF`1+&~>e!z@;+R{cA&;q<*mJ(3&nq>>)3eY?tc!UAm
zCx$x82W<Er(9*>>pp98!pp99~Oy=`hE`ZE~mq!}|SQsprC!Szn0j=W)F(3z-ZVX@n
za~PPJL5qPmfsT)2=X#Y;20G?fM24N~RXm6Z3L;PkbyErp0}E>pgQ3)X78cN%df+l)
zQvnC)1Q1XfWc$Fd5j0E2R06IKN?71U`N|Sdt1X!2gisHtgT@E0M>1e}0AkJy(2i?J
z5wZ!w23gGZfnn1JXx#LG)|Nvp+B^qzXtKe47LEkQP{>^PW(FQ`-32bxHZy=bIWRV?
zuGp-?!_46XEx|Xd@PPJ1fvw-H!ULZ7hL)t8L2F7u$8H4bfLi&Sr3}m;m;yn&V<i-z
z91SJt^xtL!0m#8x93L1qgDYEb(Ybkv4=k^Nn9!;S!~|y&kmo=dW%ClyiFu$CX;DfW
z6Ice@yacq116=Tcn9w2y#Do?+o0ph?N*ic~*!%}nuNH$N0915B6YI(qpex>3iyICw
z&S!bSbb^_sxS<Yo#sWC|!(|UaWx>sHjt>m0L9>JmT;S+hQNUW<aEK8ab}RSruy7@=
zfbp*IKvrczV`r5F3&Rgah<cVEpuLu$eTp0(7*<K#U;^(-1x<0RR&W6oq%dX(12-s8
z7{Eu-tp+t|z-0|2SfGbH>M&+8aD&Q{)e4}+o^WOeToe=*;JLSiKcMwZ5EI!xFbL{^
zQc)HQzXxM5i$@M<3KEh{1#LhzQVt6T59s(4uzHYk4^aJ@!=eJ}w}BD`s3XDlfkEI4
zC?#jI@aV90GBh(N&1cau;Am#(WKdFOoX=ul!3JhS5<Zd^4$!s8Jj@-8ph<hS4u)n>
z7BjHm0JA_Rpn=ZzgQ@=ka!?ivhXz|SLl?*j4IK_J3uJ|k2~-s9QX~SDm^7w9$B-nD
zo7gG_j9DxO7K}M877lDZ5LY{Ra5powGAMO1C>hGkXYmMtNdyFNfR%t8g=9LYfPk2u
z$s!Im9Xj&Oq5@u$Wx<%jViCaB0x>-xfCJ1z7y|Vh#E1;25zv(#pjq%#7K;E5u!}&>
z35Z|=vq9kq)j0!n2s<bgW!Re;6u=in%cwv@668);!8ildB4x~CVG&^Kf;dJ%0ug!=
z3b4>a3UG*)Opq36oPxDL;}oo=lR*jO7I1D6xB^;blffdQz?cEH8FWYuC~3@rj;G78
zbusjS<4pt3GT;D<8Onf-0S&T(ic|rxmP{5F8MaQi78uKb1I&VI0oerB0v?aeV&MS!
z4{VDF+&&o{6kAZWWU_!S+3ta)R1q17>7XPf14_#vqre(K1jsjFdon=wfUd%mna?63
z1HKebW<HCI4hL8a6ur!l{3_rB^}GP+h$qNEcHA4#ttkfcSwuihTLva1QAW_tOVF8S
z$YPnGE2A?(=cIt*9OPM$3802J=v=&H&{4|CEHWC*&Gq1t3!xRJBnM;wXixy^hdv+Z
zod)2w4ijLLyPy$IkP46u5G9!`#t>O(q6W)?BfGBw)OyQd5dhDP#(;_qQ1R2Z1>{eN
zGPVy4Ek2+Qcos_l`0`-Lgb}ni2vGwmYCy_#7&BRPEEtnnETTb&qenv&W7rE)>cg19
z;uFo7$pTdb%`V`99fp=QpnI6X^_zf>0(5c)?BpgNP){R^MMIx4lSLn8JuSpBY#$iv
z6hO<Yvse=5a4?3l%;8vrJVpyv1y_{Gk^qrKbt702hyZ6i5Cc|9LfK#nZb}AA!W+<V
z;2XvdjG#6>%LmXIqrogMnBFjf`Jhuq7=u~1Fz;XnofONm1GHW{nB@oa9|->sXtp7k
zrH5q#3t0UGmIa_u=LIY)Ap8|9UqFMnUs!*zg7yDk-NVKh%(92=02^5S0k#Hq(1mgA
zE$m=^3;O{O{{Z_D2>%HC63`*H42+<~>tMG-;;gO#ym%{wrGvQxw6wkhbOmb&OABic
zD`N;t58Dbh#t@b}pp}IoEIlAILF*1UJ}@-$fNmay8H9xf1x*LElJQ{7VetT8jt08a
zD5roilck`7F^8pM251$*4A2y24(Og85N`o!vn=Qe;|(C*2`2FJ(H8b2?4Yy>9_55s
z29Fmo17zD0&^o{r79StRFczN}&<Zt{7|<2uH4Thl4tN<v7|RjHCrpfCEN_^;fc*P~
zc>xRfK-3MO1IEHw{;>XG1@r%~?qCCJ+X3=Cq_GLH8I%yf?RI9Uts0EUpygM|EG|13
z8IxJgfX<~&W@%u$47xA(4buW<#$=WUEDKl}lUcT~o&ZrVSl@uC9c)L~z~{JwjRfV_
zx+S242I9dc#j~6NIW?Z;4buxY@F+H@++h2_P|pB5oy=f9i-HAcK=K0P1JGC`?6eh-
zB9KvVRT?p%hIBy>Xwf9g62=bDp?543m`;G{7M311aGL@aw2a{PNj+$89Co~mfCTGO
zb{%=p%ppujK^=PX2+IMcCrmJQ4|5MQl+6I1_O4sQz|;cT`oQslp<#v&BdA9PWrjf3
za5Su8U@8Iiv%z`0Q2}yzf)D7xLC|0<D5WW=K+Obka^OdvfND6{;bCka7(iOVbFC_j
z2`nlW%nkMPK}jK*#U}yGPRL<Q0LL0stp#H|i%$;d{7pzk0O<#HDt&T5Yf3;d4G9U5
zI1khTEIa~iDU(@pCbO`JsK8i0K2R2T=O^47pq)u9JQj>`AX}j4Yc;Nb40A&ifeztk
z3}F#b0e2z6&Gg0>D&VvJpxxcZ7oe&*ghfOKq=ZFA1v>c4(D*?Z-n|1G#%}{%)cypt
z!RQI&YtX>mYt$XyAU}Z;21u<1%tsa<;79L+5+U0M2L24tTx1xF#13$_f$I_g?N`lW
zQ3o#}KrQ`2x&%P2x=a=h8O9vY#R%|ecz&?H45&Ut84qezfSt}40WHrLFoG^DSOB`w
zy)TAk1>+77A7nkK=?7K?bF_v7TPS!V2}l;4aM?aE@PYQMGEdZ-&ms}Q2wD!zT+BG1
zC8Y#3VF@cE_|C8}=zwg|F#%nCVB!M0x&oYGAcILDc@D;479JhOU=|bbOr;BG-6Gf?
zkR2w_1}JPz0dif-2bRoa5eG}c))Rt<H~36gn7Y7*fFj`N7f@Jbv2cJJn#e)P_JIK;
zDa@G3A`F&<nF6i|kA6WB1Dgl(850u&+Xse38Bk)$0{8q`q;;4k^00t>$-`n|0%Duk
zF!g~q2cqf_V9aC@&;hO204e4GE9PJUDTa;UG9+4nJe>nNV-nQ(;P}9hsKNtUegPi#
zOjKcEn#ch?*&gH!&}CI13!zu#f@}pX?ghtnB1Dn{I`kv}SswyU3Xlkh2X9=@V&MlZ
zvtf}@Vd~>xQBeUoPeli+806RZ49EbHhzz7w0E;<*#Im3PhZd@4;1iKCgPh|7gV_^q
z<mQD1cyUJ-ivZ}#T9hlgz~K#AHxvR2k4zSE@D3Q{W&_&?23G|Z27b28$t+ouSy=c*
zK>M~Nb>=g$fLc|20wUlxA;{7b0&q*gA>#@<f0;3pMFy65Kq-qw1-wEBwhjd(1Zf?)
z=14%bgRIN}wc#>Z1YoHHq7D?#U?+pkchdpY#aU4Ep`ionnPjn8Ah)4dY&;mVSUkX1
zLREnc0WJN_0QC*CSa`tppi8a+&8=p!xa1&p&EPsgwFzSuival2U6@XA4dM0xw0sxZ
zjdug7!#sOLzy#;nBVZfA1ltD&_a4wNUlxl_0BEHxvO`#MK*Q23plxR?#SN(2{Xn|F
zE7ianpwY>aQ^J^uw)hV`J%nUU4!CH6)E@4jT~Q#P!}L3V_vS!(U<ZPu0i+Jpu454a
zyMx8S1x!N~fGD;P3?3?=Ws_Mf9x2RS74unAz^52OLyaW^yrH)OWEWHjqzj6nntd2E
zS$tB!x4uI(L)`(=3~G9TG(&|zr6=r^BM%1_1_@C2gGEAuF_}dI+!bN*2>}T~(w#?v
z1gyOR@wdku&<uPQi$eowm=1LNCdh24!&s((F33VOoj|SwtIuR{0FCUjfYz{q)I;3@
zQIB%$A;kO)7Ka+faF!a#Wt`AD1fn_|)OLVuyYzSfS}hmB5)i-`!4i<c7zwJ7L0wTu
z`3N=&)Dm*YU<`pwVnHZy-8zL4bkqSj7}-8Bc*cNIQV3{^H~3HvkT}E?PY+Pp9n2yC
zS`}{Lz+9X-pT)s}F_^`{171;pDpJraG{_*3a^_<B`78n!V9Ell)&b0Ra9}Q0m=D$|
z59v39t0G9qdQM<r$bc0j2N-uS!Pq;P4!{pRyuh@W8797%c>^=FxMA7A{D1{iMTSiV
z<t&ivVHo5lu*r~9%~&#4zz=3Tz_<e5l3T&Fg9&7qxXyeQu!WGL+E^|yK`a4@gDruG
zLrn)6euITUfnzDV&Qey;aAL&=Mg*sW=>-#<2hL64JOR3jM*<Wv5}=I&6*EAq0zknB
z4n|PP?iIkoV8UI@-~qaf)K5ccK8uMBcX2&}Ytz7pA`Lpi3PoT6;|E4$9boseePHm)
z00lDS%tV%o6^yX62BG78-VQ7b2`B~?Y(TLIW{!6O3xhgTGmAqClm(Urd(j(oB@`^8
z#3eu>E2%S|MM4HDhOQDCIS`egu$GX4wtb)~!KV6x7b<44=z!PYfeRd1&U3i~nwtYD
zX8XVZQJ2Z$0@{5J5`$y7WCn{4SU)UpxkNK&utbAzw1f$z<TGZl<lh00GC;*3g@W%K
z(B+aKGeO490o`01!je;fl(9i_posLH13I}VgM}L`i7*7*0Dvpn!@?jURLU@!aWdmX
zuE{Ku87J~jW}3{-A|fJ~f+;8?02WL}QYfQ>Bv#A?)~uqT#G%EZQOp6}&ts$qnI-`l
z2i6Hyr4gWvLshW|$O4Emm`nXcKt0YZ79Ysq3N-8?hf?{OfR@KG3xPJyg6e+10`Q`G
zm>Tdle!l_(Hs%k^LLuPH56SlaI?&cIcyt4!8V1KZNDcUi5%BgDuo`Fy3U(Q|1LyAn
zt*pUqNpMRAW;a+7s7(!01KL-~A<US;A`DgoGY9NGe-H4$7Fa!)VEe$}-vC-koW-Jz
z+Gt2%%wkE%X3Sy9#$7W(v}Uqs8?Y5OG&FF|XE6X90=1LHCYv!6svjx@w{!{QN<wzz
zHFc<xnJnx)P-DRo&>mDE3k!oaBk1ZUP;!KZ0E-Q{fdJXk02Ra3l*wX^>OAnx;Sf!5
z_ra>pKnGCc8+08SvONaiJO#G_RdFVZhzv+E)GQW=Vki%K0u9>-hQJWe{B|;EI%pyX
zi;MxNu?=!8R0`Bvfn2`^KJfr5%D|Y(!oUGKQ2}BeXwX^40EG`S1ByYKT38q$2bF+Y
z+!i*BSu8dIpk{YK46NA=Q4CcJ-aVzln8Tt1K0^*-%X}6KXT}^BXYguZs1QUKn1pHt
zZ=5z~%w#bKYlW5qAgvittxzGjrX`^Eb{31c1k5QQlR)PhG3KzafE%NzmO-V#lM>>L
zumOFTsi3kQWHeM23wsZPgNl{nd=?e~KKQ05h=_nVBWNriO&FvZia{&q7(#PEjfE^0
z9cxBdnt?_+i;V+wXZ?H@2Y=9|^Pm$=*bu|rY#$gxCx99gSu7j~S3-3{%?D9z9~i<w
z$I*js3`XvIgO=}Sv3LY9_dH=>35Wsr2RJ@3gr$I%vV$5DAdMS9O`>EL6$8c`$Sh*m
z67a+!$Y5Bh%l3gGoCR9y=rD$|_<)v2vVcz3;w)v5cW?(UBUu7k+@Hy^n(+uDLKIT|
zhev>pD*?5`z@<}o0%)i_hebw*6{L4Qi%te;q7d920a+CR8eRxtkx*eS$(YZg0$RQR
zb`7Nb3qJu`0F%Wc9RTX42Sk9n=@AK_ZaSzr0I}c)sH2y|A`H6kLIdP8n0~Nyga)WP
z1iRxAIR~=1#4rZ4#DLrR@Nfo&6sT^B0Ci0nb68w_7=u}SLSW$)*(1Ts**_mLaU0nK
zYNtSL16|Cx2U^IMFb1=f)PQoc6lBK_R1MfcQJ_m^8M9a<G#G<fG?1$S7K0hEY8s+}
z?E?cubta1hXw$L^ST%GIfW-hj6$QOEl;Z<KR1IjUAGjAD)dN}X1+nk~c-d_hOA909
z7(TdXK{K7vH9V+o_*fB8*_Fj20&Yftk3I5$dIhw74CFFM=NzO^o-va}-Ud`M*mxji
zM~GAgi#%8-bjJ>;ZvoY50xHCESQunDCh|>T0`FsxQRe7_vJqCqO@Ve(5z&t>naLs(
z0Ge6=rHu$s6CaXrz&b&#NEvY99s!O(kY3Qx1ltD&ggkiNhB0Fni?I#3>2DJN9##Vf
zU4jU-tbs))q%RFNhwTGHf(|Id=72`ILRnN&KucmltH2UMU?(kt)TDq?a1M(!Xa*M?
zISCCYvnfp-&@HOq)CfOe4&@9skcDg?7(hxT7&Ad5S|KbE;N}>#sAEZ)02=9=!1x8+
zAcKj10bP9t8d`-e%W9efS`p8}#eQHu%NfQq;341#jBgmhA`DERqf(nQ7+AP!VC$or
zc7Uhb!K0B)7r+%1EJ=fM3dl_tK=~_#MF1=bwHUk_5G47Ag`ox%3lkXUfGk512j3<R
zzF`u~0`~x5dJwyb!P~7t+EInTs^J4kO`wH9p#29QpUh|B0TrJT4j}F)kNGSPIbfF0
ze3k~r9!3!R;}cj53mnPK9UvcoO9;@uX=qvp#Wah}5u{6bK^_Jb4b9Mt%0P4SEH;qS
zSQ&FzN~SY1=0FZJ291kBqpUpyT9ks;lY@^oLoy$v24o^g5x9W|X*t3I5hTs_fuX$s
zTCAji7b<|=3=#u3<&YBrICP<!I%PmBBR~stK{wtUVS=7*1)6>WEg}cy{EixF(7~+W
zkOb+1V73no9cMr(GK56~a-5M3V+hL*(3R97EN?)Y{!8lTvvhzaVnSGMfabG6{5POe
zvO>Ve!-Infk_kZufp)ut!WUH5F&TjxdEld=J3wb`b%1n%I`|wP7`i@4gN{MZm<+vp
zsWU?YdU)6W-v>ao3C9Npgct*Z140b4sRdMjv3+3Z>HrmA!7L&gpbj{T253DA_;APW
ziWE@fe^miRKF0@!?h4QWYoKa`?E^!118BWO4huhM@fc`rEJJrk2uwMQ4_#FWYAbhl
zfSRB=EbJkW!U8Nd0a_7(SHgf=`P~;_YvbWz+x>%uL7y>;Mc;=p1k_VtDQT#i56%Qg
z>4IerBY3qX$Z<%)3DOJRV>X2mRN{g5`hm`4n*-YOoXN6>@dH>Ge1solyd7jK$a6nf
z7{C`4+c1W**g(#Gfi{02Hi710Kx$zast4>&6VNi;DWJ(rkbR7xiMcbNqUH=Ec<DCS
zHqdGxkY2VA3_S)c3@kjQ3{#klRiS49vT$(qFu-{n;60TP>k*0=7(n6GV-mqu3SFuV
zDoA?_7??_-^F=)dEFd<>8W09q^#SCqEYS2q28((Ea`+`=Ko%>2RDv>C5BL}W&?U~y
z6FZooilNyIbcZ=gaDfy{fDXY1&l`Zvg*X>{-FYwrI63rkU|hD%0Xi}Pw6uu@ypR%d
zDJ!^n2}&KkAZgG_4e;%N;EEhp4}*JGy&RBc6X;HF3COvIVAq43-}?cSrn6W?<QX$q
z<iR~Ws9w;HIq<R!uv*Zq-XB2isZ16Ld9Y6*ieWwti2<#c2ZeMW1JwCo&-5{Xayq0S
z0J*h~0k2oU(%8KMuHgCvK<;M(cUss!Fw6j5s}8CJzy+p`3G7BP&{hwI87(?2Tzm|m
zB@P@P7-qC^KyD<n1f6mLDx_w#fbX~h-$(}bBV--KE)Gz|oWmkMfg5xw7Iz2e!1+4@
zM}$E0`@(mGq1WEAePGz}1H2W_U_Q$N#xLMHhzXRmb}E3@6EZ;9Gju?6o=7=umjdVv
z+fbGrj6b*-Ls^b+-{4^kWoZ#U0x}rv3{bS}(g780VW8umSs24u_OPsBg`XY?E~R&w
zfKq4-%M#WnT#PX+8@P|~FvhTa5ZWNj7{kB;^4=~59;B6@aFh3dkIf2W5s+XmvzX5!
zaex)Hr;%*|Xlvsc-X1>i!gr8rwhs(@Sy&jRurfxlJYf9-KC6lM0WTxybVhK}1G#f=
z0_f^)gZV5rF^owpCm3IV=7(9{@U-xPj!T3n1G{&x2nz!{bD04f3wsOb2ImW`PuLj4
zStjsa;013vf!V0Q!tjHIF@fa>>kT%>1eO-wBfN|WAW2BEzgLHa;SK1L=^d<R*cc;O
ze(>zz1#PxOQjx&I5W_Li7(DtipQU043xd<aI)e?tJHpe#3+F+OmDuxzfvE>n`a|5T
z1G+gUjAa67#1^#a5lJ)wA_{UE#|MVJCm>7YKuib72|o}fcMo`Xp^2Kk6m&KHUI!il
zn4m4_TrLw$Xq$hp1Ng#LMg}R+k#tB&1{}!H8jFEJfPuv&2F6ohU;u|YGJgWod?x6)
zAUGzF<iOL?pxO))Uf@pU-Wx0oDKIsl?XW2m;Md#quv}n4mI5701H0bk2Fni=xgVfQ
zVIWuGu$<xk!VOdRg}a9b$qb0iptQ5EfrTLkR59mHW?@;vwSx;u70V8;6I@U^h@)XT
zW-#$KFc|1HF&JoqLJzb=_XjhY&=RgQT&O~j{^R}(b;dL(a{?sBz!RE#!ShXtEH)ub
zWd@)#utAoA1wmztO$cKWMAP09&}v<f57<61>@xrrhdC@qm}jssg0~nz%8z{<EDQoL
z&-bt_V1cn$u$+Lg!CnHH@d0#Ca3aeCrVh~Yo#3|cz7O&sSAgOlt|AGd0^|&E8r&}c
zJ*(IUbg36;-RFS_(4}7BDc}PE8cbyx4A3nA2MRz7;(I`=KtVH@kSic}3qX5GCzzQg
zYQV0C28)7x%y0s<h#I_ye%BWUrZNV|GUwf2Vi;o}brgsh3#nOme~E!!umj=m@c@M^
z=pqTW4-C6?SQt)#CT#XFtziZqm<e`2R5+RiEF2A9?+sTCx=AfvlmRRUWn)pGkEB4K
z0gD19Bn3(gpgk3!Slw;I!mxvpF`VTH(;Q~Ta8Sj>3~`bT3j;q>83POd4$vu3VCe|B
zE+5dbl#GciTbOzv5d}&FAPjP~59}(+6`<SCwlLiRuXnivx{N-S<qJ~}_+lwWuvs82
z5bMC24Ck|`tYBn}VcEh2xlQm4NK*_8XvZLE!A%2m4>My7c)bnCBG68FXeRmp{|5uh
z4yG$iaQ^=fkVLxY4ES27_{l7wEd*dcLo1U#pnKWEP(?vea0PrFHK@+mlOX|G$PKP)
z_hd+bs~nCG40|#pILbiB2h_v1@$X*a0p4uR@quCY84d6jZm_rZ#DMw+W#CoQWh|g|
z-C*He0ic?aF_dKm&m4YGUlwH9!9Ae;RP3N_;JX4qhh=jjn4ofq?E}NE2o?q%XfeQ|
zV*<)ax!{Q=jt>k6I@U0O1VX?9U~3L60G%WTO^qxQ7^g6?F6GpL%y@wU;=m42YJ{yU
zI>Gpd5whF}avZ^~GoS+qn2T;fA_+XWeeegU9u8*7IRolcTmc1OFyzRMgKxmsSVA^d
zfZ9EWQb02y93L1C`+#<8K{gq%ePB40!otAKRLsD_eFxOIeF19RLYKB3Du5i64{D5q
zRL)>wU;(X_7g;l(g{7J?hh+<Bt3wVbk%DcQ0qXEVY=E{Zpu&v75K%_RW;wPG42K;+
z5rJ5~4)GIg(<#Ft(EfhLU={%h#vB$2@ER1*a_$YFz87eBB<Pei@ZM>LLmV)FGD8kc
zI}A#>jKM4h9^n27$l?^pkPwL3!U8*o8@i7EZ~-=lfTQco3>F6PIoW$a0ka2mR!a`c
z3C2C3y&(|yLP)j`3=pN6EdCQf+e#)dLe3z8H9k);&H<eqIEQHoc<UofcnQ-UW^iHy
zg)gW)1!1-i3}-<HUV!}V!<fY~hw%ugbA5#I1|yTje3loWQ{i*Km(hT@3qTj><bVz{
zfCL>V6@lCm04gQ}z*GGvKqtTjv;1M&0y>#)3-cak=3;O^80^QhETA5C4oeGT2W*2k
z!`TE0M(9O1XEPuJYY>luNVX3Q7ivH?OBRa+c$h2%x%UwQzR05idR`5zrM?8zKnVuv
z24koZ;44L37(-cHz(&AAB?NL81bCDbq#UGr0d%lQ0(5*Kc#Us9V-8CL$jzW*Y&bqJ
zTomA7;bOl4?%)<Oup&+NLJeYJn8OI2V`Q1b_yIhpE2%x7<pa|n_{8xa<})1N8A<K=
zEN3`6IAQ8LIOp&{#X&9tEjolwLb518WW=>WHiN5XP|X5X1tM5PAhv?8*8`nm0a_pj
zVmB~1fNce_!D|ImAXo79Fn@uIe_=ku0#kp6<qZp{oB^rd!8U~*#)i2PB;LV!fD<YX
zI>Qg#xMdOPVT3sqY(I29wTHQf1txxm;|T|p4XOi}7??pBnnmOZxS9az0wty%<~5+@
zkt{pdc5s9EN4V#J$Im%Hom7xl!8D7=1klMhAWe)JEIptzKQdT4SbA6(b6HNXJ>X=_
zV0pv2gBwI~&*5RrVBiE>2GI{9LDn*+Lr(liXX#;n!NQo%vV-jb8)G^P$e|!PjtSh1
zsi2+-H)A@>8}1e!M(8cFU?+e~fmEj;7K_9LM#dnP381YhsSsm>K*lmN2C;l$e#62T
z#PWva3M*qO$Ybn`K`cAi&u}oNvYg>~!^s%La)kQ=$gUgQPe4=)&m53lkg+$A9n9cB
z2H69%nhD%=VqjpA=mD+T?Ewu?q_FG(W#TM|^(ic%2xkOQFPIrKSwPXun8I=fbQWd~
z=qyZD#uOG%95d#yY+!%G&X~h;gyRecNC`&==#*DbJcG8&b1vax%xC$*wS${6h2;k*
z81h*rfLsV0g9EvX<pSFsHntvyeg@U~EO*%6urX$_ykYyo#@@p)DFP(+g{_61F^i>z
zeF{5!55q(rHdRnZfDx1gz&VHI2Gav34$#a{FM}fJknu0fpqhUP+X^<076u0uu;>r2
z4cwqx!??F_GxyfdXW7ENgPSpzfeqX;V7b8rNlG_B_W>Ku2YZL34XPL9NN~P^Fjx+N
z+?dbuhV2g<(*y;UKWt|>Kx^pEaLnOiOoMncjirTW0%+YG#Jk{&$3PWwN(o~QBpg8j
z_=k-#1(co{SZ07052ryA45)bx8Z2a40Xioyhvfp}6DFn!Ibcbq382#lK!q^KEg&gS
z$@_%y4<mC={d|@`j1NFpLLA{f!42l0;J(2PYO;cZ3Djv}SpvETEtlm8=wxtEFn~PH
zn9Fj3`vN3bE^y!AW|`y(E`1@^uxtUPj9ivGpc*2D1yn;YX0d>*0689XLJ#=1vRsxu
zAfutloSA`v<qqglvMiPsraep?6Y?grOvs<i!m@|y2@_cR4e&xfh{Hf3Glz8pC{=;(
z;AC#8pU-lFbp;z^3d;@dJKSLY9qu>WAPXTn7#SH@KCn(;W6Wilz_x@99HUFv)`0j=
zxSv40@`U>hH_Ie<uvZ`*QU(SV&~=$0O{{ZR*;*Ld8D!_PtN@)Bl*aOc^#dzo7T7{?
z4+pelndJdUFqfr+Z3!D=DhtSHSVji<a0TlHkd_Oq9c&yE3MR8mD4fi~(gAV?$ecGI
zAA+`+Lo#eS3pj74gK9zsun;IxL1Lgtg<U@gj@BKZ74&H=N7(PMGq=^xXSoB)@Q@_M
zn8q@JX9^EkcnT;drGX}HK)OJI*uk-agE5z71;-u^aFFZ)<;q-^7M>0sFu#Lm0uN&@
zXjcnV2Ls3@d)OIMSoW~L0A;cl><yrN+`!Sn!I%ZMiZP1?WD#!<gM%t4Hz|VlJAs-5
zAPax6cYrKh0J0|qY!CEmbBOsYJJ=tvGv=~9U|+z&G*N^FtS$?jH^8RP0l9{OiDd%!
z25!bw21Y0gaz8Q12$naT7q}SHSuSu*;AU-Qa8RAk@`n2dj0rAL(m^!|$SrR;Te!hN
z$~}Rby%juY08-t;0}5X*NV)-;$-wf4^9Ltm4$BYD9xiY;>EZgo1uCw%e{h3@x&J_N
z&mT~Mg_7TPaNXcy%w@U3^@a-^o^QB*fcS5?KR}Y)2apN5@Dme2wz0h7{J_bW!t#N0
z0!Zlut_@s_DJ&bfc5s3265##=DwIGL@%F>Qw-vI#3v|&U%L<UXT$T%v5)@<)V+v$z
zBDh#*dBZscWX=?>3tSwNTo@*~Gsw+{sLlWf6k`UYJOUl~$8Lkt=m0qmidh&Iz#AS5
z7~jAf9&ec5fUA1Y^4K@bf8Y&|KO9@&4Ua9HQ(z4bmMJ_-cwh~ZB|Ljz;$T}?7+^aC
zSX3Y~;-CfzX!@Cr<pI+J_$|3tn6H4Z_yrAVbntZWfZ7Y79t+sRusRHEB#dC;fwW-2
z&ScsF)(vWH>|nkCW`pkAy#O*b6LR<N1Li#}po>I7YWA?)fVWyUux()j*#;8d!nOq5
zf&uCM18QfbLiBcULc9(V-@^F-+?oNgL0JT3CWt);8Vo6uSwLwM>TpoI1KNgRdBb!C
zw)cYN0rMX?`wvGCCrk}EFd=Orkgu6Qv!^T~512sx`8qBJh#3nQm_h6Z%pKs47l=It
z6z~vn1`Z|$xIR#WhUp6E&~%V$#tasaLQwMtWI7}$Sr`~tL}oC8nk*od=`0VJZ-5#%
z8`!>p8aE)<F{ZQ3;OyXGOowPs2Wy1-5LzgJ910R<k$@h0IE9HZh~*0C)R<hBH%vP~
z?HW+jFs86PVBW&U7{s!LZ3CzX+Q5E=gE5HZ561^kbKwJb2M=Q^xa?s}VF86H=r&HC
zJv@k70Avda26>l(fkg&-;OPg@6`60CE-*8uvVbC;F_mQx%NZ7M75s&TF@@y|%O4iT
zES3$R!^}ZVnLi+BfTEi*l?4>jjF~K;NM_7onZWgei!qgD4aiYBEK_(kfLd7yyID@K
zT>-UWIzjD~D{N2L7_(TOu)RUFVL*)q#w?aUY)jZdZ5RPi8-|eqoMS-4yr8ZTBO?na
zm4aHXpq3V>3G;xv1Kfgzwmv}dlktEF)Di?;NfN}ehvg5bCHMz)j#&^SMuHeXqZ2GM
zK)0u+vs~f$!vVQsm6d^kWewv4P;=n{;}vj&0wf748^H|&(7-ceF3Sth9AYn|&IDDm
z8^G7AvRvV~0xIW0IzR;<$m8Gwm1PI0%bCk^g7E<(TN|W4eZYvg>J(J&FhX3kfN2Bh
zBGwb20e}=1@Hjv&%N33<9H96FxenwkMv%}S4sgSa<p#?JHr5VMq0hk10OqlGK#Fy6
zoyYQrWezK2F3TL&J**H%fgJpVwFT4)Xkl9cZWTb&B+DC6Oy{ypVZ8%tW!zzX!U|r4
z18OI;TmkWNS^hv;94pv1utD#^WME*K0@?$X%W{JC11q8t^M`c<8)#2F0}D9GrZKQV
zSfIcJRpcxi*!O^{y*=y?*by#+SI%d^l{2&!X4$~Lg&ma6*q?yv-zV$~Kx2R40A^r;
zR<9i#3qUt`wSihI3qUcE0<B_LHh^^HvOHm*!hvueSV=C(2o{zD+z&wA0#HI?%m+98
zAwp>^55RQ~13M^DP2lPPH&#J~HfXa52LmV*vrOPx0IpFNaCh*qw?l%S1*~R54g;b_
zWtqSQZu!pP+QJ2Hm~7#i!p)e*vV>;^q@l6`lxv|46>y`H<qp>$P;K~!YXYR=oWOkm
zR1t3A*#c>(Yys&&t4JqsO#$^Lra-F19b8vHb@mmmJD>^>WEH64!?S^h7t~DXXK+wa
zY=>5)pm;n3QkTo}h3f;TiU--lm;<RuA^zV3GG!0f3ob-3e&OoiVax*i7o1iU&co_Y
z)(;GP0xS$HEF2;XAhrmIEg%DCpJ8E;VKK1*u|e0Qvao1?*`WJj8CZA(K;ptDSQt21
zctltvz*<0DkXc}<D<J1c$gn6FAh-%D2sT8ENCrq5$PfvT6okvdfnYPRAlL$6M?%!7
zfQ=Pd0M;(RA_CD4=0dfD*--6ZHpI;kEdnAe5@5%Of=(`Ek+1;S0%9|;u<*dxEG#?%
zEHV&f4?q?fn6TJ*umog)6@Wz?JP>S<tOJNEt^!ibpu=JT4lyVf>?sJF0~~q~wuAyg
zOF{=Dn6m~H4Kgw;HV!N<9xOf;Xo6tw36LEcIxHq&r;CHRHZCwJ1r`+z79DUH$z-rF
zRDj2CK%<~w3uJmgm(#_hfK<zxfa4JCB3aNe`z(-HlH&kb00~Pu6_A5Cz&?<B0A_;&
zN$w4ZEd!2x`4|=k6PADgkeTvFKo`;J#DLfe1|V}F@u1*<#4Z8pg~W-%5fGaLY^M4g
zkQ#`+8X8D!&>$uYSPf$e3kw4@&KXl6=@+Dz5p;V5G%YixXs|Hwuz-^cV~PzDdjrT!
zs5waNBp#3(cnnzfFnwWSVEw?Dv;eFLl&~0+z#fHYN&*c7LlPWgG7Cr(L_8TZ^UlHn
zRu9^|2F(?Wi5>_wiJ%Srkj%!I2##eFaFl6*Ef)}BaXG`t@`rH-6UzdoGay$m7~KKg
z2?9EUhKc0{(+jYeG1yiM50;WCAcZTKST-;nfXK`MN2Uymj0#H+;}mdY8{c4IuwaSF
z0Y!$n0?6|$9H4{^$ubZT4jvW>kS35CiyaU(Fg7?Bh=5Zm=<I3+7O-NFtR-k731SqB
z3|N7s2S_g@d0T=@07yiF*huDB{sAdt;edo9gB3W5fLsL%Gids=0;dCT&@w>SAO!*}
z5SLip0Y#1nIQLoo0ec#hAfV2$&H<SZ(F<WC>$L{m<HrILL9))~1}K(TELa@C5n`vn
z!T`y9AuJIIAkW%aAj|}@k-TG<0Fr_vWjk;d0vQg@74~aDCw8*jV4MMt9|sQ>1_>6M
z8jyhwZ@^YWut4&mBe<f17y@Fmu)xbGM;(OujsYMx3kQn;IKUmJfVn&@A|)U*ofJU6
z;1FODF<>#VV6gxfN1)RkSy*_$<(M<*NGxb5f$l2<71v;kOjs;@SVCf05(-#KDp+b-
zz)8miqFRMTLkDEK8)#b*v_J=Knqy#L0DBU`mN5aTahCu&hyz?ix@&-a=))2c0ha0k
zNr8d}Y#L}&ng}$wJwc0ASrj~=<p+4{4U0<yBg+KF4`7#gT>!;#!39Q^2aF5ALFu;y
zWEuxFi!*?h!ppE2fD7Ef5RhUS4UnaQEg)s!Vt^qKbSe-iy$XObDLOZ321q3f2a5za
zdV)b`c!E<2C}Dw&3I^@bWa(h+VPZMJ^n;0|f%yV6%MIok;2J781ysuZVf+JjE_jJG
z3&fhRCt!00SVX{q6&}IDAi|<j05UOR1vt8RSOg?kbii>1I-3KQ#^b>yEe}j%BDhuo
z1s}K?1aE3(fn+sMQR2Z811@iqR6yC?0Th`aE5O$|v4WORu(Ld1|G*9w1Kl&k!g7LT
z0xQc5);Vl2u@Dx}T{U1H=)4ye8AvSxj@MLhnZqK%qA&;SL(ru#;Oqkl@-)zi9xNgf
z&^jk=0@!0<4}<QAV}Vvv8K7lbEEYB_phaFR3mCUBvg~2$U<Fy337Rd06paj-pvBxQ
z0z1GqK{?=<&AI>$OBn?g4ILH(aNU;;i78l0fN(*<CIRw+0yr7uf?GBmA}kW%N-wtp
z<UUXa1J_r1U|Ak;oaBKM3=1sO^CLhiB{Wz{?l6KUgg|c1e*zNZP+&2zfacx;a65(t
zT;W35;M%efw8V)8QgarDfOUatDuzO^u^ixn7?MniApQsWf<*%C*<#QcN}%KlNy)|F
z1_uidH0PIW0F{6sFMtbz5^!k?$_^5s!e0fP#Y(}!4JijpO~AGz*;ooLwm2kMWHeYb
zz%DOEs)tL#NdVb}rC?txfRjT7xMYAdFe-L{OcoGf(J^7M*ucoLg>eTX%K^qCj4US@
z?=Z4VV1i^=xH3qoRCNHPiwB$&s~&&~iX3pht4;w$vB&~&+}A+LvlNyGpw+{F7`HI7
zd}02<42pwV1yCD62ke@f78ZsSmK%&u7+JnBo?rrB7s>K~=>-#L#)*lgg}DQwrGkaQ
zhb1P3C8va?rUO*CKx)X^8jw+tV!n0)h#dmXN_9FQCxXHhoYECkKt~_5>;XCD3*#Op
zmLp7em|31Mcd)QbV7b7`a)WgV8_OED9c(NI*lw_~JYZYF&a#310XWOmfpa<wxTt6d
zVPSA#aRH|`5SxX?1zhJeG=Qv=0EY<Z{09RTA8=xAx&RXA;DHt(=v>g+XL!r5gNKFT
z05i)8<|QmFYgo>(uv}sJ!ou>0<pS6hAlW~REI*i#m4E`X19Ub3%L9m~o`B0&@XB76
zBTP`94husB%N?c%;DGD~#~q}fFkuP{!xJW!HOy<6SwIt>EJv6(u&~TwJpj(t6T!6_
zywI8msj9){0+bCd%qC9&MLJyB6!1mHIbWDq{xJOk#a|29+9_abW3Di<ykUC7#PS8w
zP-B?(0~|i!aGMS;Ga-#IJ8;w9CWED70VDXpWANx4%L(Qlc9sk5XSi9ea6b@Wc_DBG
z<OD|hEuc!Hq=cn||Ai2!{pbDxWGs&WsAc5h!4eR|60?GdWd+k3Q1CE%f=-@*Hb))7
zmhy<Oh(xeNfKm>llL5#uaK;0l>CD2yu>(|VfYat3umLW6KuUPPc7skRzQF`Oh!|wE
zD>ybdwlJ~mVLAa;>;_IgJOV5N1*{(!-H}Xp+X8Z>1}LF0g3r-q2?>EU{lKT(>VQtS
z1)1t#0P4^|x??jfK)T>58{Ag_H5ecrj(`xBk`_=d`T??>VJ5WY4QeN-Xs~$ruxwy_
z0M4E>!DSYx43c3{P+>{v0gKMsgJQUX0*eK>l!c31fQ#+9pbZJo#@+(Z0ehf^rHleg
z!V<74OAJ7lVna&rB~!p*CBvcs>ePT83U2u=g*10nSTqb+Ol-h?C2&h)c?&2LJ9L1Z
z58|+}1VAe0<=_Me>2s|BUDW}yR6qn&WG1Ar6o4C1AaMqeXCZCc72puI@nG?ZVCi6+
z!N#(HZ4MX960Q~Cf_w$&zCTDegJJap7KRVZpwpGWX@5-yEF8c|b4?DEYq0_BF7Oex
zEH;pa``R6#(p=#Q*z4;AK+cD>&sTyLXRw^$zQWCNhr5Lrlv&q<izOZj771`G3(6H?
zkpNYQEDqqXUa13WX#U~p;ANS>yMzy<4I~6=?t$3rA!%EJMZ$r_1sr5h5fK&%6Hxu^
z0x`t})K8qkcZQGU4&NRDmMa1`1X#WZv<R~F2+k2?*&}#DkmZ8l2SJt}f;~bkQ-p2^
zvAhua0Lne!GejRSvdmzD_D;Zwo8=4B6lRt=%o~_lb};{8X6a#>0xl6jhk9-S<<UQk
zEG<k^m>`E^pMVtLEzB%E%oo4~zy{Dcfh+<lEIK`mEJqlxFtXeM6~;YG;11IPCYBRS
zcbHh7Fs%TqUI{u<hUJRT3{jAmK|B^nhGp2S0t#(NqY!i`B?}7&xW3#BZnl6jGPubP
z<qEKfpeDQ3ke(j6*(L$X?+g$T0SOif4Nxrz>4$HD)ZgH&0qUrO8+cp6k;efR1Xo^+
zo{)AYq~Zs+xJ-H&S*9><0Hp;+PjJo$wdf^SENWOl7v+F5vsVPDz*KO6w4WKh!D$qf
zpFv5D(HmSNgK7*17LPm3EPt4ffWn#4PX%=7D$5zh2cWi011K3Xg0}TS!-dfw(kcOY
z3}lHvID3PPdBe=o!7>MIMj*JTUc(4(oH2rUYZzH}FdhNBHV8b>qGJF`LM5PK3&x-?
zplqxH4$rM`K#q3t0Y%4FaG~ung_&gu^ABd028ihl+jg)pTw!E+!ng!fT!KqVhV4sO
z7z|iK!1X1FEdXWjfOf1w%}$8yjvXuv2SCk^8=!u|8y1!?EZ{o0frF)kqlbfK3dal%
zmIWMtI9Xb_W^l1A;CjKu@`39CFUuOf3H&TG_;>KL9N_;W$kHOTM3`lbaE~a<6wy7R
zEJsA2h_bv9T_Of@ILHnQmJ^IOKpqA!`)*(aulZ*A!w3#htYSMscjB_dfP(?N>YHT;
zV+#{Y57PlqJA4K!%L3LVtSoC-H?XqoV4cFwGKYNwJIfAsu)}|Fu^i!E!NanF=K>E)
zi|`&{kTZ6HhcxD}u3%-^!uo@arGXu+>j^u{8}>U~EGxKscvz<JY~f*fA+!Lj0km4$
zgk=IFq;v)GSXg+#tv=9_VjC8h5S9vX*zI6pX<>cA3Z9i_Il}V?T+D$Mz%sCK=&(SN
z_TC4ePKHMYOAE^j7M3sEf4D(z+V=rmOjocxU}^y8zyshGFJydZ*9}nPE2M>)Wdid9
zW|kMsZ<yh2InZKL5f+&PpdpSG%q$z2w=lEpVLkvh1F}4nWe-yiGs_g_8O$sTn3upM
z1Xw`p7(sSJRu!_W;CaHw@`i5?Kg$aK4g4%81kQj5wsy^7VX$Gj!#x9B5*~a5%KjoU
zEEQ`QSvD|&Yu*Q-%m7}WXTo9uZtA}PNAMv??yLbXzXMrxh=YY8gyjgN0Wt;b5|9um
z3qh-aL*T(24j%9!Wh@_<CO{N{`xq~n{(vny4CxetTH_!?kAh>9M+G|GdK7e3Jqrgo
zc0eaHfr@Pwa8rTdSPR(g;5>BP1yrNJdpar_ECwbl5iu+m7&};5Ca~^cWjVllg_Y$F
z>jzerAFO{^Sz6epu(8ZxTfoM$0@6%f!_KmWeGfa!5%wSKEDaogz<m~6#y+6XSa9pD
zf#U)v$j8T_ybTa5!MqL*2=B}b76u)biWA@nIM>3$;K33S0@8FL2b91decp@Uu|ba=
z;K03D0S=Wbj4U@mU5+P=kjT3P8Ez9`5rK?nT-pHA&jao-U3$R6aE62B0>>2&mMsDw
zz{%vY01Lw&HkKBF2@tLh3&R37mKXeA_(8T`X#nfCV6g$0<X2#A79KG7nhy)Z15nBJ
zf|2D4XA2id2S`i=!2^#<Ik<pYPyr#3mLkKo3Q(B{X_Z|Aj~y|9?S`;HioxaHbx5_b
zgo$Mh#~e<UC7f%(p?E!ng#lD&a(v-n`NPoy5$gagY-PE?egGV_Hv&Mn)3Qup|HH-7
z!o5a-WsATCL6#eWS43Ivh(3^D`62N~lBGrJfE38VAjKxcsx1HwWPD(|!^QH1t4Dxk
ziogazmK}myL|OKT9*|(UA#q2N<%#41h`HeY_7$!x;9$AKz`}5bndJ)e9}bol&IMd7
zE4Y^Mv8>_SAjon;@Qe`46`={>BI`~DxNGr-X$l9+9F85FEC)FE@Uk4?Jt4sIK;VfW
z%NxNJ;I_tH7SOyu%LPVAPP^*^u5!Tr{(Dnc7+x^5d|>WjWtqY{fs<th=NulEEj(Mm
zrP@94s5xZ7{~owP;sCccR<N*aU|GY#vV~&@xL~`lz`_7-STwM(bg;B=u=H?DfJnHo
zFn}BO;Evz}c9s|HZ@^x>?*i`QfwSp-aJqq{+WTu*7}kJNDWq+B{|Y!sfgST;3#gha
z`M|>RgXIsnyY>)tS}cnII6XY70ILLdcOUhD*<f9d!Na7GA%w@^Rvn}%^8|F(Hj6|9
zI1fDmo#p@?j(P&_*R!-Rvh+aeaE2RGK!rJEuHwcDP>W9m9CkO(fRZK)xU+WS1q(v}
z%L>Uq(x7DWOafH!fSMbi?hC^+84y=Qfn^4y8Nl!?22|GjfE$+2Qb4BLxUjgmu=s#m
zl{YO|7_Km}Y>|E-&GJI}g*?j#`9Jb3EedZGSiUH9D6&jYe4xzoLivRn%LlbDYAk=$
zrl_;bQD36YvPON2I?EpQE9xLOfJ}*j8FEA(EHs6MA&2FKT#r1<6!``6EGy(ED6q^>
zSfjwQMWIERrAN6(jb)133^kSoYCF_e4yc__W4WMqLyhHu+7C6bet5G9)QV!b2@WX^
z9+ovA<$KhQKonsY1xMryxi4}oKjgN^v+R)HBhPX`{)jxw4f!_^$6Wyh5}XGfZhj*7
zL5}5%Tmx9aOVCMzkP$2BDB4ZX@o_9~<o77C98o%=%5p~af-1`m)eovHKU5pkSUS`u
zKwNYOWO9!JM42+n4;2ixVBbNNJyBrkQQV`1EVKq(BED8(VaQ<F0O@gefa>W5pt=}R
z!rlb;ao@;yK$I?EVc5dRas)a_@kRqw6hP|vx8Tt@$T;?U9#E=*45obbVPPl$)wm#w
zzcGL&iz2||M36?)cMcYYIgBhz7{N_9aMNfDxTgI60F>CT@XrunSs<_loEQE>>u-=r
zKfqlSof4K7Mo1a|V+W}7^n-5+Kg$~aJ^U<3_+Rj|eBl4W&+>=AMS$gmzy+`wKQ4fh
zWdOKA_LBqDS=zzzfP>`)#}5vc2F@9rEDJbyfQ!?g6)X%fEGZ={HK67RUkA7<_&EdA
zo`?apa2bA;fU^v^1MzDIDBJsh2eN*ffNdyXsesJt{muc|5&+J4E5PjzaNhh2E*%<}
zPk<}3zbC*3>;QZHFX+Bi7Ks)RhmjFH9|xYDVB`{DVd!9GdBC=Won;OC22f$a$UOxV
zP68q<8KAwh3qTfZ0S$+>FtOZWUckb#f@KZ3{m#n)a@HTnP|p#t(R@CjAQJ)gE*3Dd
ztbjI%Ky9=R7M4E>M-)Mw0sb|hO4+~$bm$t0FA&1QkigObX-_f=LS_g-^AIe1m~Sw%
zJYZe|whk@<?({PXgX=Ny+%Kcx43J+z3ustwFh5~qdBgSrG!)G!xC1m$F$2;|Ji^9u
zhV2YkTm(D>%^|=dk-(Ay>Zvn|fbJV-;Q-A~uo!@fMn(}xcL_Wk-~cLp83n<aXbal~
zc9t9LD>zs-KpGj0f=@u<wSr>@sFq|D`~wP=1sn^&Jh3;RI0xN#%>vpB0P-$K2s#<e
zDDDA@aZp!`<pQJ=3LXw&6n_Dl_VkE=wOtt{cYwCKuuNdQ04nmqjaqQffIB>USXhp*
ztN}IO!7Z~T94u=%z)6l#5<Cp6p~GSTijpIYEN4KCng(WY)A$T1oxqf6uz;t386~0f
zlPn@KEHU6gO-3mJaOn;9j}$o6H!$r1N4L}#(9ReZ&{|uT7SJtJCz!w;a&YB#0~~80
zB`lzRl@4gAhEb*gl)qI>AT1v-7u4QmVE@3t$1r0N3;PGg#2-BD9~hIbEMQ{)z?j5x
zftmdSW5R(QAYRHBkW?zi8b<aHjHwJ9AaaWeh`a$}zgYm%Zx?eyl>Gyvr-})PjBo&v
zGj@P<cm;q|c|}YSV*kJxoCD$nmw>bcSAYx&o}&O-Ai@t@(g5<cOA1KnC0t1431}p^
zftdxgu%2ZH+Yt_yGaNg(!E1lPD~7>~Wx=arSwKq@S$=T;;RY`P1uq<BV3`2Q6E{GE
z3lEr{Fd_7T7W2GdVR^%{h7Dl^1Ir1vGi)pu*nY6F{9&8I&N7324m-;N_9g5rE7-v;
z?j4}M-4PCC8_sZS;YQfa!194(3b?TXDu}jlvh3hIz{zrg^9m=+1I{O$pmm>INU9ka
z7<M2$`vBzGE1)d6f{kSZ+Zhg)D;yo5-XORSxrK*;WeVdJCh&?X29_f%Cs@GixLIzn
ztYBkcIly*=jpYQ}2R0VaVs(}d_8xYY3822^43PUbu%F>zVEF?w4zy5(1+@Hxfn^5B
zaYs1MaI#$Be89=_g7Xb0%LmQ|E|w0i9xj#%Tr;>?R&cN31}~$5Y2jYM&9a930OWEC
zp8x;<|7T=iVPWEt1H~Np#8^<;VgPM%Wnh5u1sE6@R2Uc-L_mr@Fz}gx_|C!wf=tyQ
z5e69$`GJ8i0u&%l!U2Lz)sC$^PA$An&3qs!kbZ^_4E!Kk#}T3noO(Vm@PqFC`rss-
zAjnkR#^BV-=+wgG)C}6U!~nNnK!<^W0i+)49swT)1_lWvc~G*mK;q9~U|>MzUqRFV
z1u75qk08kW94D}UnnCV`+9NoFfq?-e2jd@MU|;~b7s?j`sYS9!2*d_$D}%}RfWisk
zE};z!3=A4b{2L4mpo1=8;VcaD6G$HFE@1}-1_mD_cY)l(@PR=Xv_1NX3pmVr8N7NJ
zyP3L}J6Sqd+u7RKTRB=do4G(PV_*Qq6T=4v(E<hr79D4ByaY~?m?$|xs$aTKrdPH{
zu3NrKp;NI#sa?5ErB$^>tyvwU6Y73RP&if~+$#lg7sySZxM29eAO-Sk2_zk~F*t)G
z&Z!l=K8pdCCZtX<FfgP*)U+}<wlF$3Ll%32%wqV!APw@9jSEKDOM{L*0AXm_lD@#e
zzyOV-RtBdQMyN5cu#*AB3n+e|ZkGl51C&lc;mPoULDq+XfpH2X%z79+yBWKfI+;6I
z+F9G!TG?ATnmIx0p?c*WFfcHH_8>#~@}P7JIv^Rw2gTD8M7YTBVPIeYxfLp}0Lm*!
z>J>nK1nt&>$-~Ts@j-3}nF-^A!W9(8Fn$RG14979J_V3JK^tH|_Aq>4P&8m*V2ps|
zA!mqxoSHeELB0d|3Z9RYIzYQq5#}gOKuw=YTcGmLFjv~cz`!Wr3XU6am^(oO9pqMq
z4-Cp@7#J9iID^xncMGQzIN3qvR6u5XK;)d7!5c9ld6wY=g9<3!?{ER9N5^I{6gR4Z
z^ufZ1;RA!}0n|LG`i6mlp#V`9sev}}#X#~1*dS<_sqJ83U~oZF_Xm`hkkT16?9@FN
z7#Q|I+}Xk4*v{zG#^lt>?9{^I)C}5s0WN14J}`hrJs2iH^tUiLHiJ_+#4g6fAJ8y`
z@{_MHFfbzGk1+|f(HoS0q4Ei!18+cO1(crxDvv;H5N7zmm<mceYoKO=_#lsg#9;EE
zcmlZ}#s`HblKh(mpaqKvziUikU|@(q3L{W@2KfmTmOf4><*_EnT?e3Psh!!Wjm4>z
z)wzYOnH`!|7(Os){$OBWOmGrjP%p?-?cDC;)aL8d>gUwr@7xSZrI0d{;RAzq1Oo%3
zg_H1sI#7kszL?ReZ3&}O>rzIimSv1i&C3~`Iu?P$5t?RnKyjY|i3_J@aOnz9GdiF!
zMwf$@A-bRwAS@td47mJ;re9r9`F#QEmu6PyR%Xx|18CjB@PR=ugMooj#!0vV<PWE2
z$WnBuTl8BP7#My)>N4kMVNeV}>Oh7M3<fn2e@y`Cb8HWBY72F04RdM<cWMUJfN(b(
zg5s$F<{wZ1GQi7ZBNYY)CJjh=G=agfgTtwv)2ErYpRtdrm$`?fo3)Frlf8|rmAeHT
z$?)>j1XPZ>I0-}SZccD*jcbVqxel!C1A{3j3_;~KGz`o@WzQT)7&w9xwNop&c7>`p
z1C`I9aD=7_vpb;hf!5I=afS~JW}x(`14;WJs~Dha%|U5g1F9BkpE)Q$ZGfaTaG8Nt
z-kXEs5t?7YaRs%*0#xQ{K=gsdq2^iCFfcGYfw<opIbTBcS%Tvp;x=S`mY}#lgGC?I
zTq{tU;Q~Y-xL$&lZBTh@P~Eu)i#*8B3?CS*K|B37K+JDvaBO3AZeez5W@!aiZcsC9
zK>2VABweD|0Zn7JAUl>o<Xae=AY}?PY;8e#8Wy%t^>(1ZzXGw-rJ1D#9FNfY%??!N
z{D8=HF*tTII(0BPx3M_2u(>s}w==gQmt_v1a{B~Ct#dP|VgkiE$nXygj-axl2jXvd
zIR_1ECy?J=AoT$_tU-K+4-8JAuzUkC&#8?CTwXYX3k-z0&Y+SZ1rooGu=X7^oSZ@V
zWDi8YV>7!8$cPqDl>zm)3#h!`01GE**$WLPSCAV-plJ}Ard>hd3QA8<^Ibvp-V&(!
ztt?J0tj>@c398-=lt)17q5gDh0M$7V`#_-rYh$>9%4ATz3svV1a$gC=PhfR0aZtN&
z21GwNoS^o2fXZx8dkPw79-w^s1yVkAF*tQFIl&5CrxrHnPDXGLg6cws4-B3Y7#Nrm
zAmxP<sBCcQ;Bao|bZX;rYUOrn;c;r_bp{n1V0S>n#v7DIWuRdL3MYmS3_d&z42(L^
zumD@<+|2IW$_fr|Xn6U8>VP{?H7)GU%^a<u*nqbq{6PK$l`|lk;RAyos4b*}84iA+
zIuA=;_XmeJQaXZ~;|~h=3P{=mhZ`t-89p%hgUXB(5b+iUXGlJQ>Ind~4_qK_1^XSU
zClHjZ8zACNu)G4*69_8Xq3#0ff%-cT)b85>(c|38+RX0U#)2F!K{FT_n65zD(ax<>
zEz-?kjqvh56qGigZB%#~hq@;el%ESAX#zd3hk?q>7-&2}(@Gd9OhIjJXk3Op0rg>^
zYQWZl&T$2`zaZ{)Yh`I;ZefL_Yp9*!pt3yylD?dpAzeOLdnN*u26G^K9h*Uo2Si?t
z0F?pI@PYdS8g>z&GzAS;aM(fZiUj3RA2k0#^+bZ&$2E}j0ghLw`=dbVYz9OeTvtGw
zm#}_j6e#^XfTVe_T~PC)LH(!#NP0jvF9wvxw?OMg=ax99W^m02@3+Q)`hgA*KZDJK
zx;++Tt_MWi5mp{T-53jMUoJp$Bdnf)=>@ebGa&Ntcm<iq@PQ!?R4y7Ixf7}<4ivu7
z_87d3g~odvs7(fn8z?^>WELpDK+{1yC{0K}(*a11;R8cFsMUd-|3KjY5(lO82@tno
z^sS-(O8}VxjT>xnkO0c(&^{<Q%s}cHJ}@MJ+6fLweuIi9g3Psn*a=n-;xl|;NCdS7
zp<(aX%IX4bQ9}Az3?CShW`OoeLE-@19`bGFMr{nWbGC7{@HF!x+M(&7aDlen9ot!)
z+E|^yrIi!3xPqml^cSFhJCd6~^#j8Ph73>}YzZ{IIQ9m*bO(2ac7!>%hdZ}LIJZVR
zw?sKLM?3cfb%81eM0+|5l&_#^9qdPF++>5o05-k>D(e|OFl2+`3tBfiwlhN-(@xFo
zPHmt93OXLZ@PQ#mhk=190+QCd89drqx)?i|I+)v7TiIIJVfhnkPaY^<6`*MVnx^uW
zFfcH#aT4ADYHK?+A3|<d7l7*CDUh&r1UFNl<2wu=7z#k;$^>Uf9{}Wjh7Sydp#G)@
zX51En@^J-HI6~7|kqPM3DX96atgbC=?aXZ~;MxmbHWq{WxJz8YeMP4hW=JlB+E)xJ
zcb6d92lZ14$e#g_G6g;+1Py}{P+m5Gh5^)^Qc#d$NvowG|GOZ$8>SwV4+D_Ip?R(p
z6eggu2^xoGG7Jn%Ga%)t2j-{&ykAhUg@J)l1)>hzmvnApashQZAU#RAy2=|242(U{
z@ao|5Xy)(Y=;UnYZsTd?Z2=9KLGw&?3IhYv9*Fze7@S)fTbLj%Cy?71K=&Sk#&w|P
z^s+nka5!~yI(2b5b#gnk@;kK%I5i8pPhjb1?PKfUY3FSN84b%5O`x$6<a`PZ^QI04
z21W*m9~@hFoxuZmP`PGMJL(A3KD7RR3&^|{s2rpgf|t837Z@0rS}^0c9h9vmK=e34
zQUtu8)Bc2kfknhg*g=q~+NDjcRlP-{Sre4mpkdPuY7;=)yWnyQtz7N_)l(VJKB{B0
zGe|3JOsW@DUe18YwKzFJrD0*y3(^|{l?Q2r`o9n4N0@tIV@A;SS>GK7238wq;R&Gp
z=iG6gvGo#T^A$$7uCt7t=NQ{BFt%M}Y`F~1m5?z+h7Sx=Bp4W&RGft$)Cw|HJM}d)
zx%9L$b+t2fbTYZLcQLhfGkLW3F!i=Db+<8fb}+T{GBx*s`xl^ckKqHuG#ds6MiWT*
zbul=B+x*B)NGE6(gw^@eL3Q*Ch<Zm@nuO+s8K5x9L5d@2UYG$IYXap1h(8(aVi*{>
zPC(+tui3C)wNI^Ay+@;4vrDT}yF;g4w@t5AzXhxqp7&=UmA~*h5>zfSd|;TV0veZt
z^s^l&@;FW4b?WDH>f?9n6>#nm>=ttB5_akoaq19tY7=*Am2hd1Y?gAK#N7@aH3D1n
zfnnAT1_tIi&cY9>L5ZcalclYP#iOf(rK5|by_==Am!+kTrMVweIDpzvpa}iIFb|aW
zen9m&HFvQ%w|20!bV3wC<9j|RzM*N_rG*)iM4@Hg{0pEl9!OX^wedK$@;bNhHS>cE
zhu3KfJ}@va7eK<wv0KBbOVg=c$GJ_{sa4Op*}$z=tw+66t3$g*AEXOv?veyh{)3nc
z?pHdsFgv$0L2?H)?JotX;ee=dY+-e6V{T;uXE|uSwk!jbuACt0%CWPZ$+@+g$)mfK
zsjH2tql2lvlc}wXsilXhxfh(8;A0XidKehEYh1v2&aF?XU9nZ!Z<5$V@d*<BlD*PB
zGTpLWa-H%W3T;X)D$S~hu-pP_K0@;%hMS@O+6waH7KoeM7#vZ@`5|eL(G!%;Odw?s
zNI5h=GJ1m2rURrL1dD^zF??Y31oiQEK<dm62B%hL=N1;1X4ZDbHmJWKX_(OqRQ`k9
z2njz%uLuSPP7#P(oSOMu+PGVJT0rdzsQO?~J07GS#s}4hpp*e|C&N}ye-%331a=QJ
z9d3QYz`zs(F}IJwv6s=Qhsmjv)v1lcqno*lrGu@Vy_K_t3(^vY#?=lF1_tgqkT7>_
zl?|9AFi~)VP`_}WNUvy*ShskWM5knjRJ(MWOp9EzJfaP97*t0&K<Y-Y8z63FI06bA
zkb7W!P&x<Iy)ZtgJqMD9gayM9Q2z<q_jYM!1=Uty<6vVvM?vE+9?&sDsQ-_G$^-*Q
ze1O~E&^q}jXq*VvHigFfF_674AaUvl9*=MV^{gOvK+QV_(udrhf`-j;2L=Y#2uOd+
zv6s)Ohu^7Nz^O~nxl^b^*r{E_sZG?SRm`bb!l^|ZY#_*A44{MR7#J9#esb()aq41q
z>SS~7U~lDeYT<Tj=5gs^Zs%wNkNCsusB@rjI)YUGLCb*i5)2HCDUdjIY2gJ|htRNL
z46XpRMWJB>2?NGpP@f*wHiL%o1yC5Sftcag%Hh<^<<tVU9qP}E8Vn55Z=8fTfW{L8
zCMi!;nV{OQ)~DX9(WBX|)ur93)1lk0*QVcU&|=tZgh&H#LE(p-2B2a7HiUtJIR#p#
zHuJi5aDdv*(4j=An?CGdU|@u{@!A+%5N!*PnG7EoK7j&M1u1>O#6jr`SsZHKCr}@D
z10?*~7#y3K!Oay!pYju^zIK7g!|MR3dq3MSFz`ah>YSQ6+&Y-sSs)Ex=sXO=2S!E?
z1_oy6nAHRZ$2Kls)ZPKek02j{`v;J4Wn{U)z#!$}0u9$bl`f4=%?_<Lok<E46(=b5
zEBC7QsCBEiYq#pQ=rw~2VUVYhF{mK`;xmH^Wd;U@572XvnW0CXd|-sAU<Mz;#lY}^
zNet9q1RuTy()WQ$9UMN);1euB^6KEao0$Q8h!evHCUwxb07yM}c=!X8I;gG$@j>Me
zNFEe!AU-(3d|=W5i!(DYfT#FAFlm6(DKi7)D1r}68lb)-NIfXuF??Xs0JjyH85npW
z?g<9PA4neD82rE#408{->iWPG3=TVH$owzE2PVjUe#{IEf*}1c%*?<59iE4XFf%Yf
zhsfc4aC(98z=0zQV}odB1_m(@4a3X~43HcQ6<~(89iUv0dnI9P5Y5cMAO)gfn3;h=
z8pa0E%+Piuhz-Kb3=E(NL1^;}bT-BRkD$3ONbG@BfKRp%{s58!bHRN14-BC5cfbN5
zy=osA7(ipEAOR5H<^yN}0Eh=kAHg3O7(ruLAQ6y!)&~YgP~8RNSAAe$1g8h+p(33h
z7#P9v0p-v5z`zI^_kpPg^?$&5gn<F<-bEi6ctPbgOdd2I31Ty_K;*Z9IpE13u=-Q5
zxqQ&g$qWn(cR<HZfXXZgpKmT~E+4{YcnX`thw|UT=Io*TU$FUl2%nMh0|R7k9?IwX
zzyO(>hw=qKFbIIgKrEnqi4P0{pz;yMm;b;Z0P4pnK;_jwFbII^0+_ts2L{O8JXGG{
z0|R7E9?B2?z#s^!i)^6$m=BO-3DckYfdMin50x+az#s$~n^l4G>pw7wfZCw~kb{94
zr+#37%+W*T7kyw50_9H!2%mHE2L{L-J%rD=@&f~8jvmV22Ai9Q@(+Jt0?C8U<^d&P
z#<Q@wc&PlX4@?3F7#Nrup!PrczyO(ZhsuBWzyO(Zhw^{H=G-BCCe9Dc!k~JKg%O-T
znWR53`GL|Gh|dd}U;4lRnSY0>H~PRV3~CF3<OLZRm>fSa`GLw05Fe!88#W&gRUh|(
zNgGt&z~r+(FhJ(zq4LEan1w*;6(kQbukHi0&<arUgSw~v1G5ll4g@AY=>xM6D9tW_
z%1`^i0GZc^nz#G|17sc_%0KXdSqRiehv~oafmsOD=7aIyeqa&>jm0ED!jI|i2XHoL
z@PX)O=KsJf1WIp=5c`;=KQIe{+CNbJ%%-q)0Z{c0AD9F{?t`WWX0HznkhK6%`N$7U
zzM%3Mq@Nd5$9`adtPOz5mwaH52ZiSnD8JzYgFI-=Bm>Hy@PR2A)D{5g7i3^yUi5(}
z8RS2h`__D5fUF&Wsz3aJ0kU=g%D?)7K>^gp;eqmBe_&7mwe2Jzd={n;3<{w10L@P<
z!XFqEKyB9msJzk#2FTh0DBl^jb^yvx`oQE1DqlDl!Sw}8?gu7cQ24_5RUa52YY3p~
z`#vy0)(}AXvp+CE)(}AXYd<hR)(}AXdp<Dvg3=$zzq||#EEhg7`GVXFia!wl4s1;U
zRQ<;f43KpM5I!p#Z0!J)FZzK2vR(knSA(q=fby+BFeM|!H>=AB2FUsWsC>u=resjN
z1sWf$sUMhhK;<`x&&$BTTJnJ@5!6RFfTSPR)(;Gj^#)M=b3QOY))_$gD?Ttq-(g^2
z0QpCdfq`|?2L?6J_%Jj*vTpyt6nO{Kbby+7>;nU2{Q*?}HP|`>DE|p)eIIBY0O+y}
z1_sv8pp|~0ekYXw7qsM$fr0S?gwMtUTKfl@n}+hGKQKbp7C`x$u(btHz8Pp;AgCUM
z@?AeLrh@u5pz@K4fq^aT17j+v{NsSiCx2jstSx}@vp+CE))qkA%U1k>K?5{?4fQWu
z{RalfdIG3?H*D<yls^f!MgYp6^ML`f1^~)m{DA>7?+@j#`oI90>xc4pePDph@k9A1
zU~~FV{?!i*ka>J4{{d|79?F05fdMi{59Po8zyO(-hw}e@V1UfGL-_1`u=#Z;U-|=+
z2&jC4mKW>>ADBcy>5T_c9<jT9V1UfOL)AxoV1UfGL-{GFe2%Ff7$EcSQ27Gb+&h%t
z@PPp`=MLph_`m>}Z-?^deqa_tO3&=eJ}^M$+adBCdp<Bg=Gh^9_FW$sAoJ@`{+SO<
zzM%F7H2t&R`@rOjRG+Ya{J;R2Z-=PoVEDiQnP-Rcg+4Gq=GCEm<qr&yd2}e>1U7FD
z<$HW!fXtCY`GFr8AamkSe%S{G$UHcd-}Qk3G6xRj&;GywnfHeBH-2D%%xy#Yhhg*C
zQ2wP4OunG>%mgXlIPQO7fXrz_<v+mYvLSp<?hi~kn?P+dNPgv%`M{L35y9v9^nt+{
zRGy_k)oXuXfXrn>`7R$AAamDHelY09cu@Zh%8&oR0GX?X@>4!AK<28U{HhO3qM-H-
zC_b1O7&x0hFhJ(2q4Mn?7$9@iQ2vAu43If$D1Y7u2FM&Wl)naaYdQl1!we{Y&j+St
zP#+d#z90hw=PA%_<O~c96;Szm9~dBW)KLC+*gQ0Z&&B?M0W!x7<qN>(m!W)B&~3z^
zb|;i?{DA>7cMRn_d|(y=wGTo0MUa7kD*$voE@*B765d?#u(@TZ`iu_@kU3>2zwiUI
z5NM1J>VB@u56nWK_<-@-J}^M$nxX0^e_(*jF+=$?U~|h*{>l#wkojaNfBy#t$UHKX
zfA#~j5NHe)X8zp|43N2GsQkwd43Ifw2%nqr1G5mQ{)MXN=Ka6`nL~!iE7g2p7J}6`
zf(#7YQXiOwK=A>pZ$W&G4-AkwWr%uivkwfAd1NTx6LeW90|P@0l<)h20Wxn4<rjZo
zfXo|1`K_=yV<>;s2L{L-F_eGt149I;|Cj^izx%)dnG1&Ue}7=|Ln<G5*gr5p=7S;f
zJmMc1AoIXbzRm|`AyE4o>VF=K4-AmGV5odB=mJbcdgRIdzyO)^h00I(zyO)+h4L4C
zV1Uf=LixKtFhJ&Xq5M-H7$9@GQ2z4|43PO-DF5dNhFDO23~i6`a>3?kA@aQPpo=3x
zYvrJPhYt*p`B*65^8*89J{HOk|G+E+T4M<HA8*132FUy@R6ZMxUxmi+K;utA<1c{C
z?Ly64{edAK)F+$(<?s2x0GYpq@^5}%fXvrI`JZ9)v=BZY>jwtN{4A6&1e=$I@|9ro
zuu#772L{L-E0pi_fdMj?3grjD=1`&h_zw(_xlt&;;sXO@P87=Tgw2OS`7>ejo>2ax
z4@_a8_8>Go`PO}43ImP1!uVUE;}J0ao)1jgp!{zGDbM*%eqag%)mI{r@`LZ@2PSP0
zAC#YX85sCpeqag%jZ1*|f(#6NzdkT&gZkf~`kR-5fuHjOQy8dy4VCAY{J^9Q8V>>S
zLGl_O7$9@65cl$%ePDphyF&Tl9~dBWtx$d<Y<?BW&x6gaLiz0<7$9@1Q2vw;43N20
zD1YGx2FScAl)w4|17xlg%HR5d0WwDl<?sK%0GSts@-Kd1fXs<P`L{nXK;}ZB{I?$%
zN<sY(X#ar!{|5%h+$Tg{fb9bVWbPBn7yiHind5}=^*=B`<}#st=MM~!IZG(t_X88S
zya&Y>F9U->%m*ev(6|(gpY?&s4>WEH<5zrO76!#9h%d;%AkYSz<Aj=b>H`C0-V)01
z|G*TCR2~V;0^Oks8j69+FZsX#nX`oQPkdm2%u_=77e6pS<|d*1TOXLhK>b~4eI)Se
z1Cti0yx@YQFM+Qg7$9?&5cPu09~dC>lu*9l2L{NzB$Ti7fdMiP3FW(eV1Ud$Livdw
z7<xfNP|)&Qu<Zi_WR4Lk-~WLDGOq~b&xg$!LirnEbAV9($qx+ELG{xMDF6BgCO?pW
zK;g;Dz##YlbXy;29X(Y3%Lk@pr22``;{yX^t_~tE#Pk6=KL_Otz~<VZd}-J`8kDc|
zfdMjS2IX6PV1Ue%LHXVv7$9?EP=3q@2FQFDl%M;70W!A*<=1^+fXrn<`I9~{K<1jD
z{KX#_AoEI4{`L<HkU1<U|L_N<<OQH1JV<#UboK*NAZWZ(0urA>_dhT|#@?aoUwmNl
z1+6)PhL_N%4-Akw9f-Uz=LZJJd<}%peCq>~FQ~r+RWB_3fyo!N?i^ZP2rGSH5?RB*
zzzDJrG(>9nf#EQC-Ugyy*zE&TGHBlbNWUNhgK*FX===>-KH~$!5m0#u9p4hJ{lIVp
z)W0x*%1{0Poxg$dmwsS?%-2Bqdp|Hh=4zn)Gancrb2L!?jSmcv`57qx<p(AKP<uoW
z(ti>D`GEm42Lq88;ed<}Go4@rj}MDTK*x_k{^e(25K;TU1Rh@o@%b1SL`-0FF;M;9
zADH+-<I(&O^F^XRFhJ&Apz^677$Ea4P<}4x9v%h;hBZ)r&j+TQ&4~85$ovmXBB1mx
z3pH=~2WBBq{Rj<Dkxd_%g+b%5F#e$rOah?s7!aSCfkEW*2WDZ=cs*!5LXd$$<n{-q
z98i41_%A*%iGj)^Q2hW>|MLS=AZR=U#OGyT5M}wmBnE0PDM9QP<@>-S04h&Kp?tXy
zOv#}2$sqd#85l%0KQIY^;#(XlZ~1}A2Q<E~07;LcK_8d|K<!sCsC?1~CIL|WBMIdf
zeP9v*)n_pMO&^#*yA2s&>L-0*;#tDLz%&J_e%=Qreo*-WjZe{aADBcy=7a2GW?&HA
z`hh72l!2iB6+QfcNe32wApc$dz+~gXz`%Y0>b{2`n0!IwTOj{{<llZ^;s=d~f#Mrv
z-ro;Q$)NZE$qO<th;e;jN(Qy>VSJ$vOyNl5A7UyWnD{|!f1vusOg=D$gZgJM^===S
z!a(cBK;xqz^8!9F`GV?ekUTE~gIL4|CVo(U<%9TFEaL+cKd8S1D!)Nf3>6=kCV|o$
zNIgh@#|Nfl(D*NmKm7xf4k$c8<2xYpR(@d80o5lk{;m&9+Mw`*@lSkU(gux>!T47{
zFlmGHBP4vp9)Doc=|F^+*!vGm{GjnfX#9x%|G?x6N-xm#BhK@IDLDr*UMeo}fhid@
zo&a^9xXK5nWTf#<aorD0;I+9h{Z`QVC{X+`F))a`e_#aP{Q`<#5I_6_lQyWng{e>Y
zz?cdOZ<u`E2gWo7P<_b=8kAxXulT?e25QfO)C)2&h<AQq(guw$g5rmlfkAx62PSQh
zJdD5k15+3%d_mz2Qos8HlQw9L5KR8m2PS?{_(0RI_^l62TA=g}@*l{&*B_X)K>9)M
z2l2l_=BvQ>3-K~ANHBh2;s^DIpy4MW_<<?*2Ll5$$o+y03=;Amm|{WYRRyGcmoWUm
z6a%_A+5yUU{=mc!N`IjCAZSV{_yZF^XnaHll3pZ|KQJYO@;}HuAoD6dFeM|E7ZP0`
zn36&Mfyqz*z<8&Dfk6NiK1>V@5-UG2o=;$4;Dzybe_&khz`&pZ<DdJ$n6ALU-~i)4
z{J>-lDn9}s=|$qt2PPYk|3Tr$%fKKh_JPR;l)pg!1Mv+$Fj<4#3so=a{(;FFRKLK~
z$9`b42Bi;}`r;2vR!HVcc70&7MmB%J2PSJ|^S6CqvO+fh><1<*Wb+??V6s9s|K|rL
zOC<B91U@iXA(=0w_JPR?$$TlB4@{Ow=1T>CV6sFqUn=th6L|ax>VB#E4@?%w=1=>;
zWQlD4nh#8t$mSpVz+{1J{>=|e7Rctm|G;E{<bG+^4@~Ar=1a?bV6s3mU)tyclLeCb
z(jFg}z~gHHkoc00|G;F9WWIFi2PSi5^SeJVfyeh?>KA=rGDkLl#|I{JWb@B`U@}8;
zzx2}&OlHXD|Ng*ahGf2s;0GpCB=^f`d|)y|GGE5-1Ctq&`7$9Nm`st(m&yLXWQt_I
zOydV8Q)Kg}e_%2}Hh<j*CR1edk9=S<MK=G|2PP9_^S^#zGC?w5mj45j36lA;nje^a
zK=~OOKC%uUn0!F>2Q)p)hJ9f20oe~t53)HQn7l#d1x$VO2PPj-{RvY)^8=F)$bOjm
z^&gnLk<CB$fyo=${5v0*yphfS^nu9>$$UA^4@}-j=F7={VDd&XU(WOclNXZtay}oJ
zypYV7OZvd%g=D^5#Rn!&Wb^w!FnJ-Hzw`r>7qa=gKQMVBn}6v8lP9wIFFr7NBAfs3
z1Cs}m`SPM4m^_ipm)HKl<cVayyyFKZ4<z&DBR(*BAek?p_kqa+$$a^i4@~aJ=Fk4X
z<biDd#t%#$$mSpaz~qi>{=E-O?#SkU`M~6kWWEB|2PQWp^A!|7Fu5a{uVDUx$sNgj
z1>X-$Zb;@Uq<mm<Lo#2X>I0J-viTD}Fu5X|zx)G}8?yO(KQOr=n}7KOlPj|MuRbuj
zBAKtq@PWw{$$Ukz4@@pd>J@cAFu5SBcmBZSf~-FB1CtA=KL$<DiUl8-l0ofDP<j?*
zU{GxPz~lm|f1v4Ean1)O7bN#9ZvMdJisXL9lOLE|k=(C%A9em;@%jJ%|3ULH3=H7)
z0g4~~{|Dbt3*-Mpl~;l;n*%L^0IeS&SwDD93djwR^#~;Ehp#CiQ@=dOZV)C@KX~&y
zLcbCrzTpSxT0kLCBZ@)E^aBF}sC@-mAjZhRpyc_1$rlv<jEdm-RHcLuOhKUdhw*bh
zF!_S|gDip&`LYj8zM%8~<F|ZZj0BBGG01|OL`r=hm;yoR3no9~1Ct+kd<<&-(hp2Q
z+@Ssul)v=@17zJ5)P1KvFh+ygLooBMd|-?K^-o~@yC0YWLG5Rl`L91PK-P&t^eZ!c
zU<w5J2P&^D`hkH1$-l~49~gr{>lr*C?o~GW09`K()$i~Dx+V+C5BtCv4eD<|?N?6t
zz!(i$F8~cc<@67X5g`A<<O@D9aDevy$OwSLTe<xMqe21$gP;b~K2Z38+Se=)|MS^=
zV1TSGgxWXb1CuYPJud>0S6=jifuRAk4i0MGst*j1_0CZB8$k!7fcES{`MW<b1%cuN
zYQFN>4@}u0_p%Ct*Iy_<_`tvm@=pNNyw@L?f<Wt(n4tE3hpkzKn5V-0fdR7i4ayh!
zz!V5tPr(OC56TxmFl8@gU|{5dn6Cl~Ur_u&!$ZaJ19WXGRKLv!#t2Y<1}5+JfyozC
zK0xD3#s32X%K-)k4h4w&RKh<nS|~6uu-OQK)0ax(2gWE+dl;ra`vap93j+h23{<}K
z15+TVe&>MrN2TEdQxHh~0f>7+{c#?U|7Ago8yFZ=+CDG^g8Oq2d6j7&7$ZR82Qz>E
z2c{rU|5g}k-qH`u!m*(I2lemj56s~8Iw1E8GBBv@{J<Ct9<PG>_s9pPKu~`K8Xqd>
zJ}^dr`hzg@uYX{S2DMjU{0ASH0zvDGp!rYb1#JDE0C<U-%7+h(QK0k#Q~&D&QxIs~
z8C1P0`v;~VQ27jU4=)3Qs^|x%Ku~&u+OMhx?T>-dFB1cUs_6$NKMj!45dW*%e_#p%
zjdyZD`QaZJqmjZxHQ@u(BnMEEg!o@I_X7hjXnhpOJVpiv)kf&}H)t`QAOnMH+Xv`c
zW=MFb&ilX=1nTd>+`Ik*123pNv4F(4>VXf?^{G(xr#>)-2{14)u|V>V>ctOCzM%CB
zF#p~Ez!U^ZKLU{WQGNY^0kXCfqF;^S15*$ve4+NK@qJ(l0@VR9zT5}KDA0HXG(6Qb
zK!F8{Ux<6u^gb}~fa<ppDBl{={{t^B<Yiz`bNRr;0}7uYNP1H9LsK93fhiEAAL>4}
z)DMhNpz;uAU;YQCKraRchA2pQtAW<vf$C!psD14pm;%2d%1gBgNa=xzfkAEV2Zm3e
z@dg#Bf46;L3VaAs4>j-T2gV4{cmd2l(0CvyzM$c!_T~e0jWAUIH;8)X3P^aX{r|v}
zvx9*_wE+^}>O3D9I6&(QMIi1|SNOmf0UED>ny;?;fhh<yehD>S-Qojd1gN}#$vb{v
z-~pA#5>WkYu<#TB*DvZJADDtb>qw#Tqn_}AF%o1SOn=q~#z;_n!uZ7>m;xUm{Hxyb
zfhiE2J|O8qz4rr?A1Hia?wJ8wHw^Kw`nnH{5uo`$n0ebjFh+seOECU{4@|+J^uY)T
zPxUh&n1VojXnd;QfQ~1E(myW)gZljs(7gaq^PhcS3Ph?u)jxe;0?)rf&C_569b5%k
z-vUvuA@G5L7c`y<GLMmgK|>q1t{5tB{(;dDG+t2xDep8KJ}~)$!V~I04UZ2@zHdR{
z0r9^EX#Egq`~f5{$iSeH_<=DJR6ardr;+`EF%q2QA@QwI`hkHFv={0MBz`oSKQMyU
zi!r)D<-0yGMuW_Q>7Vj}0kXy$>b}(<7$EDcq5MN1n1#UO6Oi<yap40~GN}B8xd#+J
zpz$gYpO=9_<0EW+GNioI`1OG)5R|_m=^-OEF-0$*A)_ESIX*S7q^OdiD784X1j^1$
zEXqzTVo)hANh~TUEr?GmN-fTaPs-0PNlihBW|bC~#22N)gfoldbMx~Oi;^?qlM70r
z5)3M+!VD_Kxdri=DLJX}Ir;eo5N>KkW(ky=R9p;U>1F1pB*zz}mN1m178Pga=jkOg
zBq!&mq#7Hg<s_Eq<?EH?7U(52#K#wxCngyi#V6<I6_+IDl|V(zOc)AEOG-2IN<egR
zW?p(uYDQ`Why$gP<BLm*7>Y}Za#Hgca#M4Ya|=K`5S5#nTbx<~;*}&9R5Ik1=H!GF
zC1&Pi=A{Q0Bqpaaq@<=Lmgbbi7Zl|urxq8-=NB+!C#A$^=4F;JfPyh6HKiCV0^+3Q
zB&IW@<`m^u#^<M{feeOlG71u*0>yfU29^xP$;FxRnZ@x%sfj5Jr75X7iIof`nYpP&
z@yQvf$=OB>#Tki4re^U;Ir+)iAWnRCzMh2zh-GSMgeGjxke-vD6kkx3nwD9?P>@(u
zoEl$hY{USHt@xbejN<sT%)Ar^r_B6f_tgB{)RLk~=ls&V5)=^zkec{{qRe~-r~Leq
z{Gyc9BB&}Dmm#wloG?I&KmnSWT*3fmXC&s7=vf#sB&MXqC#9A#cqEpkdbog$VQ_K{
zgO~ymbAyX9loaH~g90okKRrINC^ZozU}O-Vo>~%LTv||25?_#9l$4m4T?~~dNG^&m
zPR&V8F3HT#!zLDAoLQC1kdauN5nqs4l$e`Zl3E1T9G{$+7hjx_Uml;EnpesY65tyT
zO=e(rMq+V%K}Kb9W^!T<C<u#F^O93R;cSQ+%I0Pa1<9G<kc>~xNh~gA2ypgvNiEAv
zPA!InU1D-UW_(FvQcfyEac)v(esO$WYDEb{VQOw^d~#Yk)cFhn{y`z}fv&!x@y>4U
z@y;PWAV<e17MB#|Go+N}=2pgo>?zL4F9C-}W>FzSaY=qrVtQ(PW=bk3&`Jv!QZn=M
zG1Y+$!4w9WSCpEbnV%P*n3I{F2lfb5ptv*_nVXxLUX)mp8gFKjlnE&zGE<Ae3cwx$
zCHnZH{CrSZ05Y#QJ~tJtKQ}cuJ~b}|q!Ppg7bXnJMM+>UfZ`e!<RG!c<dV#?#FA97
zg7U=7l9a@f#InSk%oI?>W|YU56eZ>r=Vq3GBFG~=KBXwLEVU@UBtO2iI2EJ>DgusP
zLnE*q$%zGtNtrpBC6yorhDP9=6%UHs{PMiiB9LHwab|8oPHKE|ZVE$YUP@|3e12NI
zb3kakM}Q-PM}Q+JKl(TZd&Xy{Rwm^q7Ns!cBo=4JXA~qt;un;MQ@|0<kX%|+1P*5i
zzZjJ1GK-VrVcd*@f<zQ~sPXAVi3J&%$;D8G3`MEA`DLl`X+`<D@!6@V1@SqV#U%{j
zP%Z|iq<Co5gPl@P3@Z9^a}z-UU2Ig4UsM834#g#z@x>*eh|5jS1r=tQ@kt<)89)+g
z`FSPrrFjLpWneDYbg)Cf+~U-nwD^+LVu-HHyh2dvng*6itw>HSh|fsL0TrE@Agkh&
zLD3AVLO=$m<R-=^mlWkd6z8RYN>;F~P;aGL7#T2R<`t(FmBfSDkU|ZVxj=<jN<N5X
zY+(YTObv|~z{NTw;?gp6ATbRpA5zOw^GZN5Xk-wdT2TT@XP_hnWfo^78pcD+G6X4#
zPb$sKNr_L%Ob2-iTp)lAfoKGkIiP|zzqF*7p(GO&6OiH^Ay|+b4=eLiN{bRf1x_(T
zK~ZW!Vo@r%{EIJ0EXiO1ReUA+@j0o+MhqYVls=OSN*VGqk~8BoN|WMKQcF^kOBfPC
zd~jTW3i}*zq6e{xQi}_qoZ<qoQ$U3u$YZd)0?N0^`FUxX>G9=7nI);^43KmMig&PF
zZVH+RC?hcxWM)<%6%}BWNTwu#GATHcGt<F=U5+jQQ30+Gkg^rX9B_dKVt^%!Qj7CT
zi;`30LG6j6vebAa)re5YEKbhP%L9c3NF&rgpa94L+lweyl1f4KVKP`0stoMy9I%f}
z;vqFgX#oScpe@LaPf9FKWynm<u#7Lx1!*o$Eh#Nvh>y=r%ubC5n+wtpDv;wd^GZ^4
z7!Yj=P;MzIK^6d|DuhOm`||U0Dxn&|zDY?fPBtpYEJ$U@Ni{QpM|WvS64-(9nZ=3m
zNky3{>99f?<loGq!eWNZyd;LA5>OK-F@+(ss1TIaisF+KbCMZAah{!82`c@wQyCCN
zOnhEqZYl#f*%YT1WhUmt8!{y4=YrE<ZhlH>PAVi7f+GT)EFfi1d{QMu0+iw66H`+3
z3KEM-^b8nae1_cQ3{0nj+aqb2IXTeMF|#Bd<jDL|aK1y%58x~Y%O55A;Die*Qou<W
z&H$CMprSrGHw98LgE+;hc`4u&nqOLy!;qVro>-g+YMT^6%4B#&2`X2>RX|#55u*A8
zMF|6_9tBCK=7FL$1yvT>qD7bk$$%g|DC!G}Qo#-lO3V$;tV;DSOD!^SM;KL{omqh3
zfvk-O7e|?SIk1YLAQ4)EgMu4em*{~DuY#id0zCtU!~#$~lbe{FnGY&8K}j|xB|axN
zH#0vzC9^0sxg<3uz9=y-JrzY;NkJ~G;wnfj%1z8m%`1rqwJ3|RD1-PYzN8=*MY1SA
z7vxxQJB1+#!U@XHFJXX5<m4x&fLh9+ybzyT3aMpaAp&Zo1(oIn<QJDPK#DI=V+xcC
zQ7nN<K@uj4Oi4kmkwJV$W@-_rb5NO_pI1_ppM$Oh6e#g&iJ3X2MUYY+)NssAO)M@g
zO3ej%8dR?4r-PFkND9<o$cHprpany2VsUmkim{-~1`U(k)ZC=RB5*kZ70Jv;6G$p8
z&P^;XNiBl3#EVl4OH=boK-sJ~IWZ5#U~q#R+)PR=0@d-ki8(p>$qdCMiOJaoB}EJn
zetb@TIgDA7Tab~No`J+gl1wX3O^3;#se&XrSVSeJq@Y9^C|Xe*22%)%(c+S#%)E3^
znFNm8qEt{@ASu5zFF7?nsWc5#GlQFc@g=zh4B)~rJ~KT96c42Z45h_Mpo#$Gt$1+x
z1}^SERT!vXFM-r(pmthGW^y)!2g=G2wII!49;{4&#yL{G2P%bAbC3ie#)6s<1*IjR
zpv;ViL{thxa(<4Up)o^Iez~5Z5x8Li?%O1%rGq(1IoY{o@tJv`fCuS^@WFWmNj|@{
z1f~Go_(7-#bJ3+C+6yw1<1>@My^_)bP|`CpfK<Eju4$RU1*yrNDXyS~NN`C}X>thz
zC_LheQqwKKB_Jq;f}6CUCIz@m28)1tzR8J@Rw=Z%2d?%(sz8ATE)7APf};E+NP8H;
z0+l?K44{G&WEV&uL<FQB!2-#FjDfbFGmGOvA_&#Fkj^Ez6_T6}X*_~CDVfFDplDA4
zM-QZDkeULCB~&>`M-p6QI)i$rZaMh{1(m^>=?pHAzOjc(0I1&x<vBxmpzdD~sIM84
znVZUxR8~-wnOBm=P@G(pnwpoHmzEDP7GxDDv<;0wsWBehT93~J_3v{~%Z=hZs0pA-
z5>h)RXM&1ha8;>iY{md;%ZEgS=oy<cfJYQS&A#NsoE%8L0#yTGKS0`tpz;FLjzh^(
zpdK^0M+=TZaHR;TRv~VM_od^}r4X7DOJH>aipf<l*Mq|zRHA~sTUr1vrND6x@(Q>!
z333^<ca{vv$dFMRkmJBCP_+*3r2Bw+3y@M6Vj8Tnhnf#=HyA;RIB4>#WJpc{^)^6;
zL7BO!DVd4!h!_EtxXCFHT}7ZiNoihjJg8WN2!VTJ5bGFniZdZW0n(FGn#Yh@T!1P7
ztK~uZ<4Y2Y(o;(qatlgO73C!tnHw6Qih)Nypw?uTl|Vbzz6B+o{?49xnI%D>BD=VR
zAvZBI4;-z*8Hp+R<xVbc;2?ztU~XaoxK#k_#X_2hpb*Z?2Nl_{PAfF<<4clq7{CR7
zd_jJBYEf}{d{Svi38?OYazW*ai)$FDuL$j$LA5f#L?Nv;XtIF{=B1XD=NDzelomj0
z5@^hU8d*>gP;r=%SOji$7Ud=8!1|R?acJg=2XSFiP(w2F7~<pILj9aWJpKLR<MoV9
z;9W+@XcYq_2J%6@TTtE4keyly>P>-yC$$L9E6zzQ&R|H*D*<)5Q!7eP5;2Mmh9;0q
z0jkFtQu4t)BWOkjmwlib2)%WZmYJ8B6JM5Cl#^c$ZGwln1_gWi`!NLjg2tyDQ&Nh+
z^%1D`8DE^4o>)@CkXi=n=YmFcO7e^J%*`2`T_9shARXWm2~<577o?`9fNH?xk{s|@
z5V#ieC{6M&U;vH$BxfWR6{7``DZ~rlB#kCz%#fR(0&Ysjr{<RCB!Zf3V0Gwb7@=u2
zMB^Kv@{KGRoP)zdoIUi642><&<SZD9D?$BuaOV;<0#lxuQj!54ZU8llaubs?GV@Xy
zpme;Gp_zdXLrG2&C=!c6X&fbnjLaE|5_7@rZ%|qXcR@huH?J%|C$S_mClx-rfU3=m
zA+rdY;ot_tMZmcWG$w+o#}v&cCJcF{x$*gVIhlE>pfTcN2JjFZsMvvw!-0m0KyBuD
za5WBUp@Kv}X%$5PtOTSB)P#u#Ny9lH1|-$N!o%DU-5JJ^vLC8|0hX!r@(UOWQj$Tv
z;NpDHcwI?mJg8{^Q4Q;VgB$`H^^Gse&jq(GpoI!}kOrh2%mAs%&Ci1tP^HDGMe(5e
z7_0%@c1f)$0geBG1wbVgQu77D1!YBq3ZxbaSP7(sf*RsR45i?LFEcSGvnn-3&&Uvz
zVnM~Yo}nd(39j7?(UX_~bjTn%Gagh)B6y(W4$_S(0x|?OY7NcN_-3%82pl09iA5<X
znZ?N{g5Wv_-0mz&OfHGfEP#v|fhr<UIL2F47@C274;L}3Ff>LLF*K+!GC&hDt1vc#
z)b*es2MyK5r&$<)K|Cli!2E<=2IMzP8BnNzV-O-`U<fu26rkWb5>pgm3`{Mi5oQJk
z2AD>`MNy0Zi((pKj@1abD2fqaQA{IDu^IsvMKJ;_ifM!qRwLk|C`N!qF^w?6Y6M&q
z#R#w{rV)u)jev`y7y%Z=Gy;@NFk=KRiedy<6pImt*do;eCW>kVNEFS8WN^wtPZ!9d
z2qR#kXhs--!Wh#PNTLWMU}`aq03~tsurLBAX0RxV5n#2LMu2PtD+U!I&^%%Uwh=6f
zVgy(%nh|MfNvW8TiY$sS0w#)SM4Ewt0hWxPmX?GfgJKk12HiMFkb|9%@KhR-D3UQy
zQFJ39g%P?DNTNtaKt(Z)Fvb=x7I0A%Bfz4VMu41$=?b_giV<K@bR$y0Nfq4)BvB+I
zprV*YfQuB=A~`L^04|DR1XvW)2yoemVFX+h#R#w{rV-$>5yJ?$D2fqaQA{Ji2^hl&
zxG0JdU{OpXzy%wI5pYoyBfz4VMu1Bt3?ty8C`N!qu^0g=l`xHfiJ}?-5=AotRJLNK
zPGnJp5in6SBS4<RGy+)^VFXMR%?Oa^FpWSKMHm4SMKc0gLZBybNVx$PMHm57i(v$)
z<VP>f)6x*4$VNa!F^m9}u9!w3M3Ievh{mU6mU-&sGZYyc#)Bq}8H$SxAdK9i0tf@7
zBvdb-A-*Uz7fh#QmVukTB_P4v(j1WfoXn*3<YXhgWQL5K5@-hyb^Qit<{UJ1Sd^BS
zoEl%8QCgCcU!KQMoLZEepBJB4Qc}d=n^+Ox?CDfm%;1xno|s$-9bsosQAx=x3yn84
zU<k`hbaMiC&p_it!Jtk&c)lHCNOFEod`@C<39Ru54j)&)kf6x;5FaO)F_sX9XS^|}
z+X|klg^Wc)d(lX`JpDXF7{c5gJ@WIjJreU$a#D*zDhpB>(lU#3%R%#buu;p*vJ!}?
z`JN1*Ha}#gN4zm;3^K8(1T+i|8vKRngQyLSH#A|0Pb~pW^Mk$U8E?h_nNBQ9Eh#O^
z19wLgb8<inY*au2%>Wt<EAjz(5j4{W>g%O~hLS-`Z$Ld9&=M5z<T)sG7*IQ&@#$#{
zW$B5KnJsX87rbx+>|5}-5G*P{qdyE8VBf|UfQIs+;R5RMKoo)o-BL?RKyyf-9wK-W
zzzE_ePq@z9T&PIAp&3I-esVlyEedE&PZ?<GO=)g^N=l|NL{VrwxL;73l34~41NksC
z*eN@;lEKr(H?e@hB{iuu-M_S?ptK|)zX%%Ep7ACO&MvOGr3~?@NyWvWR993P51Nop
zO{{>qqc}H{p(wQ=r!qdbI2~r0DU4yx;GCLQQd(5W5MPuJ3KWQhC&)R_lv!MmlUc%m
z7z~e3%K?pzKxVk03vL*|-B3{P104F0*)mA?4w5p9Qb7Y3>51`>a4mvaV+l*D;Q0V>
zrxF~*knSLOcqty_HBfAWGfz=zK?%$dQ0jsh56V4|l#hr`h!L=0FodT1P}uaRVPbr8
zUI}an)+Hds73LJM5s+Nt=?_a3kO6iWuPDD9VjVcyhQ@<B&fsJWPa~kDuLA17Cg!Lx
zIE8xpxOn=x`J;P~p{N2pzW_GI6J!izaM%+xz6%b@`0Ui8ywn`9!pf4=Vnj%TW?Z2u
z6UoKS{(f$r?hKxw30s%U;)0ySO3xHXXoHr&BvnF6F3{?)fSkmVwEUvnpwhg&%)E5}
zJa|}HKs0#98!;4Q=Ej2(FF0*L@+N3ZI37JG8#5%QfL7{&$9O<l4eBLRhT<a7I+6^~
z{0bxxQ(&P88d8GUWC+baq48!Yjt3VvK_Skdfq`O3x=IEwzQXi+aDXGsG`I)M86W`)
z8Srv;3Chm}=fh%#_*Af$Qu4uBJS;O2RM>*Xz!-vaGeN}%H1rrMAPW$3azMk1MUd_?
zavIIgO9c<}RDv@(EPcnv=a%MxvT{IX5qMM%RQ!VmF*Ebh848NaVROR8Fee)tKv<#i
zhDKnM5{qGrMO0KkH4jAE6I5ox0zV!SAuu~JgCxW?I0U&^NUA^--Q}RMF>qj{rZD8@
zmlmf&YJvDvXh{GGIT!yR1_r(2%G{E~BnG|Wk|GG50b_xay<TxiCW9VSpI(4tkY}*7
zUTI!AXx*G%YDRn-Xhj)=9yrAHK*Jk}MJak^iA9EHdV2cBMalZvNhx~CddB7^40xpt
z@ktw*TQcZ@3Jblw{E}1#y%bQH84nskLuP|k-of~wehG}7n3PnMS_bEVr<aRi+~SfV
z20hU94`?NgUV2`s9(Wc+4^-}CCY6HnCCs|~WKg*W*IAU8j>3n81Zc50@fdW5E9l%*
zcJQKE&_a0Veh{b;;I**~3=E2(HMk5644}Ji85kH78W<Qr%XXovAa{j=IBHOJOyG6h
zj2{{p7{KTEf#g6Kv=;|N>p|5yf!D_}iQQpf0G-PTk^-Lt3tCeS!bs}WWf+*$=YY<t
z0;>Y=M_~Y|0byIHc}yRe)O8q`)Ioc|K^UqOtPaFRHtz-llLlyS0cd{!NDdSZAhSRi
zS=|c;CJoRYFhc5nFfeI=)>;!#r@_I%qybt(Oh}ys1Cs`5FDD^&8VpPtpff<RsdI;h
z3p03KI+Ml@1_mwAej<>6K^PVvz6f=}Dhy1)pf&C=IgmQoJ~hzZc~CepgU_L03I>HS
zHg(-d=9w@s1#e+sU;^y}0GS2CF!NS{)`~MQFffDnSulmwFfi-|??(YCg5K2%Vy*|J
zJrDzo!Ri>m`>Mcv(Dpe91AMjugvr3bz!dg?fl&p#9v&(Nayy855b8eAUIzvS=4#NM
zf@>fNC<dtm;fqjp5Mk!(Zw$=M#~>Uq2~q=M+(l8x_J0opgXlt#1Qf&6y+%>TE(*F=
z0JNV1stkVi@h_-4i2K;ZBN!MiV{soN=#n{**-&+_LFpE>zXxU>NRE+#ff01}H2A!0
zumt<-6b1%HWObl453&-pw*aIEtc-#E%?t)c@Od8)J|xe9)PeLO)NwL$Ffb_f!xVuO
zK-i3+y+TOplxHw7$imVoND0(laGr;y2?hpEhZPJAx*&OZ1_mb3O(Gz5Abp^{6yQtv
nK#~lcxhohLG(mD;F2Y{Wb{)|9zffV$X`nM<0--z*1$Gkv8X_I)

delta 82565
zcmZ3nOYP2Ft_h0TOx-yQ3{2b%CJYJ;Obi+fVho}T3=E763=9n)7#J8pn1QJyhJo32
z;Y6QsMvI9{-1$s(&CPYw4U<g`&5}$kHvZ&btT*FhG*RSaFtKB3P%e^VG_U4kP$-dO
zG)ZP;P?*KXXwt&%)X+Ttdrkrahk}9}qlqHp0mg$84horkj3&ukCtf5RVBlb2a`HZC
zKl6pc0VYLZJ4RCueh*#-(UYwT_HQ{Dm>d`$aICzjAyuPbV#jEr$UC8xK|#Qj!~VaC
zBFl!&4NQ$p@=%MFukkUO-{WL>;UW3P{2oJtf}0(qi4(((%?hl#Ec_gDjHVpia93`Q
z;k0EDgX&ap5@0ZKV(3uN&|@@FWS_jASI!>HWLlu00dh4D14N2d0!k++sDXUWy#mUI
z(rh1K>L>H?$+AO@pKQR_Qm>uFz~ErR>(Snz;Bh%h`os145(3RO4Hn7`e2mHs{CBx$
za!Fo}k@|6c7Ow=qjgZ3&hXYI?IdfwLM)NuH|GR1$1e6>4|MOc3IlPdU-=95`;l$-&
zsUO#>cqP&&Gu(I~FF!r|kp0cemhwM9zUOxknD*>|0t1IUlau!$`^o3|gz8V&J<L9C
z_tJ!&fx(1>K_vT_-A4{7Cb#UPc0W19nOw7v*fVlSFu7zOw&yfIY<D;LfZcr#cBXI+
z4yFhWR;I`oUV;W3EKE`6dl?d7;ykrN3=lb%7a+L_3ltb$FfedUXlM|6!N4G8l5GE<
zLx#!qg}i)f0EaA-OHYCVmqLLaqe(IY15bj0B*?w}3JM+^Y)nz!hwLJ~PuM;5K5qBY
z`<UHF@1u4<y^q*4dLOpueBp3_!Tg?G<BNDXQIli_rWf+^t&@BB)$6x{5(x-{e9s}y
z6qA39k-__z-OTKx_MF~F?Iva)u@{7TOS0#Jg8_#Wle5V&`;Xa2?I)UuGcaTyv!D4Q
zUcQz?hAG12nEn5jGYtwCW=hm3PtapDpTi))-=;9<b;AKB4pyd!7x8jeIhdKEK<o=M
zCH}mKub1135Rj~S5id6tiT~$Cyj&@QF9nhhMdE|xO%Z%)kh~}o|Bv?}yPMue?KweW
z-bd^Oy${<<zL1wa>wnCi5#(upeh+~;`~d=!n<p<&0EOk`9Rj9|GbX<i@Zhrl&s9><
zU?Ri7G}%G0Lx8(^N5cySh9C}RrWg|u28YRC1XaZw1cWaY%l~L9iSIR^WB>n!ynHTy
zgAmhX2_d6;0R|IA-mC;0MiUbm1_l#h2Ac#M29pFE28#q6Mvep<MjjIxhMELp2D1cX
z2CD>PMlMh!CD<_XX(tIVm>BbBIn^*2IF&G(U7jOddugil-{z?b8rq2p3?8Oj9(@ZG
z1g<s6$a2kLib<+rGy^4gus%iJEC*u-J%`Chg@kz=j2TVZ9TY4seV6_)`GJrn_e48J
zrHu3c&F3(En5-gfQtuwZ=x}MW9DiSef`^F=gPe&BgG_sag2D9340epg5)PLpi!fX&
zmj2(CpdesA)&BqGInqBsR=tpyU&|rN6a!*2F>vhRp2Z~vrej!S`Wxb(f&v#L2TD~S
z?|aW=mw5eBBEkER{Y?&8rYL141_pCWzIw&iubC}Cia~;)R1Rh{Fgc)V6#oFz`1&=c
z1XztMQ`8H2c~&r+fyn`6xrs0XgI6WUBJl}eaapFQ*RMHtfY_k0<(|tW12Q-NFhc_<
z88b0VJ|}#c$<S`{Vi9{Lh7X&ch@>*g@8NK}JeR}u@*d9S%X2wf_&*3t=l>xvgX0KO
z3&&!n=E((O`Ha^mKM)gT+&KB0m;w{`hshG+OO^L<UAa7$>oQjh(-f{`rpeh?>^5@$
z;$r5>5NP2^5NOW6Y`1gr192S{4rZnxjz3JyoJLH79ED8HoGwf(*@x{Ga>_C>bEGge
zXCJm(IoUwM()%h$AxAS)%cX4`McGH}PF}joz2?$3?$w-=n0h!1nYu4s<z~6GjhmUH
zhpB}lo2fbbh~32O!*(;hPuorOK4UkNa|#;^XE8go`F{q1%^M`r85u<<OGv4(OiD0d
znCu{B&nPsxK`P8ffdL#M#~B$s)Oo?FEBmOuAcqvVJd-qGVPMEUY_I5{%=9Dsm_291
z69*3tW+pciHU<U`w#n;k<m!161ZHxuGDW?Jm)&cU%%ITUU_aHQ1zf`9Yo|kvKgQ6I
zebm0wLzPznlz_93*iZCOWBR}$1uiaUnlLjkG%R)y02P5R7#K86nC<`b99Ee5B3>3;
zTD3RW?*&C7DDQb6vXAsWYTxO7#D1dpVf)GQ(wvjmNK4iS=rO*CmwRd+#o&=q!@9tu
zhIIi*>Et;D44^y=ihuvZ_Kp263K1Y@dDw8DFrUo8lwr($VsZnx)KvnBn+P+gdDw7Y
z=$_nQ0g?wL;(jOlqaZmC8}0*OF?so^8OGcPGK{$|fW%D{xo_}r*l-=>u@Y){Aum65
zvX6|O5JxQsGgBnUyCybF3o=xg7EJDuG1F6EFp;tU?_tcn0u=CV35pT?3PKDZW6Ww8
zI6O?aH<(B;FmO%g649=||9|oe895OS2CjOhcn&e9SWpV*J0RfH5kFZ<HmaUOf+-lB
zyAIjk1UVFBih~XJj>!!MOrYwcy+t7c>;M@C2C#f0$aV$>2V<sLO*QscLFzqhxED;G
z0~QC>3hQ6U%inddVVVVU9fuTCuz3g*L;iV2hU|0poY`mX1+&lCOJ<+8SIj<TFRPh-
z(%vxpguP|<aeK$?WA>ieN9_Z%kJv|MAGS}NBxlK3IN3^0FUf?Hfz5=AfyIQIfr&$u
z$;Tv_`-BNA!-A$|jR{;OOmjGRnEbfzFv)P$FwNl)Rp`Iq#L>(7mW!9WmrI5xPodXr
zD+3ef9xj<n*SObm%;A#ZU}6gETB>k@Lzu~hBZ5nUbNl3da^lkG>^ZsWx#aoHg(i5P
zwHM^K6`J7<a;!ar!sIPyH4^;K+cR>AFa>kSFgd-Dmz&DL%M{YIyg`C%8q*vOZYDpF
z7|01tD;l)8N|<7}N|<;-&f?$#%f)i;VTu8(<plF>L25yv3u=#e*f33)oFjih0~Bna
z#tK-_l2-v#ZoQC~;shsO1}0F$guz6H@!#eR3M`EE`KK5`6{uqNQG3noBld>oE({LY
zhwUxRof#CePug>4pRgCqK5j4hB3||>s15^V5O8}SUiK)5ER!2|>kLq(q}AQ3AOOl7
z+{?gxE)EtZXAT)AmlyG}kopx=>4Mr3@v@;HeIRFhs57xTcxW(rOtw(caN&?)^5l?Z
z^5S%3VdGR~WqlDZvlnC=_W~AK?gmyF?p7vY?qy6OJd=eQc%}$-fJ^}8D-TnqfTqn2
z8YX5;0h8A#*-q~DRG!SCY^A5ba5+l)hl34cME)^`1`Y{OL&?4q+EAL9eb|0x|2zc?
z4oM~#P=1&!AT6Q7J%=j>WbXAj94#iwj0xP$T+AM23<j`<Sbu|k>*OWM_VuhFEgoeI
z0SFnpyC5;|TlSJ3WegEW;%h<Tpf(n$iR4kn-~p36F=t;XNRDTLz?}X`^Ws5lk1_@e
znEVTQIa3Z6rWg}p#wJj#n%`q&NWW|^Xd;}#pu-`>6qA10UeZLE;gpFK14u&g@?^;m
z>38fkO=K82((l+CUbd0^kbT77lS3R_$^~*rFgd4RwpUHRX>VzM(_S$9y1k?Mb$iG3
zTlS*qx9nxpZ`tdn-?2A+5ifH$`_|-rDus-?lMPhuoD>++@7RlijJxbC{UiO3y(}n`
zrysBvOuu0-nSRq=vAs#*MEZ4m)yWM8EH4-sPMJtBG?+*-Fl67b*L)E#W;l6+sx;%?
z$!An;>Xql52enh~n$KZiGLhl2xVBwl0)K<R6i_+RJw-u)YY&$&C@4VX#kFG2p5|bC
zNNp}JzZazEbd-VzD1mDyFfe!+a~hbH@=oAO5SY?5OJN0vFjGulgMx=yF+%}J4XC*C
zFyXlXW-D?Oa4<5d#xzZK&;nWZf`P%StJJ<9r1^!s{8Er2A5(^cu3h%qC!bK0W0Lzi
z`Gs1bd;$Zg0B0~!<d|@+hQo<3kzoqgEDKPw=jv;)zdAWWT}{mZT#K1laUB5F?Isc|
z3>=J1&M)GHW`aTi<Q<blt^<>osH=p4q7sxMP1qPjKy{J{D+3FtK2m7m{|!o&mz||Q
z@XQdH!?A}+roTa<=t8pe51wWr4uur{-zF>!B0LoWb1u)3{y(|F0Mu0X;>i$@0j1vh
z7x7}6pfvVEUOxOqyqF*;_q>poF9%zAn4tk|fE4=$o&+I=7xAJOK_vnx2boAQ|Kq6<
z5_l0WHy0%KB3`c7M2hj%i+H(O6Dh?9FXH8LO{5r@Uc}4Ann*Fe0M%+Q<b@(ZwHZh~
z$b9pA4D}7&Rtq#h>GFlMcne4ZtPtGpw{J8Twg1n}z#`1Gi%X1aCzptcC<8;+W(5JR
zZCvu8zz4Nn`L-~~nr#KQVvq9w6=DEoMUdeh7R(&nQCu<R688VE&*4bUuwdo@6>HoP
zEE48384N(`xFy)QB22891tu@hl<@$Gn8+~L<)2^#MTAH8aeGb<aVGcdW8l7oTlP_V
zNe@+Kj_f1$irI(lH5>Lg900WiI9gd`Kzcz1fr&D+z+@IJ6@yGxW)AN=b`!nt+Rfx>
z;d0?f;X24;BQ$}>R%ix~x=@4n9lK5*HKC3S8wLeXdw;UR8i~mX8Y}@Ix0~N%X3(xX
z|3CYreWHmX(*zSvhKB4D_L(Le40YMZ?F%_1z^<x<bmZ(C%|VSHR;JMGBlex3vMKwp
z{X`RHa0)b-yg*m9K7~c5xudaxBaKV)LbJ3Q2Mbf=Rc21j>k2YbSCTo7ajS7ja-^^@
zo8Ph(<X~osc;PI(=R%A0FZ0W`f*i$MGA6?IjQo>@7^ci%sB33%wBTgsI>7<z9L5Xn
z1nDu6V5k5k*%$FVf*^kO3HwNpeD(qRK<_*Df%V>Z?IW}A*fwV0we5TnFBAw;1X94k
z&J^{+S?Gz01cQV3N&7_a6ZV<jhiq<oAGa^`K4xF(ebm0u`-pv~_hI{qptg|tJzGW&
zPLKnIYG7u7=oj&VD@~Fa8eYiD>2jp7$e7=;6$Et{A&%nGc*#-2C1oPRkk>G0-c*pq
zFXZKpf?Np+Z8io_m1V-gIQhP|XuSz50|Tg91H~<<S_74U9E(|Gn%f&aIF@lqUMQAk
zzfdC)dwnyf*M(H+pP&X4sBd^(K}PZ_D@QV@s|^ZKPFXe%jz8?|FPsHg%x_r<nqRgO
z<k$=e%_%z={<SkWd;o<iC^lZi3tt4OF_B=DWq`PvGZ7?^ecYNc`-C+oR8i;T1v(n_
zpw9UVX8{qA0+0lVei1LsX|j}&;f1_hD#*3wcdP_Wb}=wP4C83zjsb_jy@oyW?t=8Z
zkeB-p@;xY>fhq|TMWzd&62<(8y&$MW;b3731^L`WhM|B*LtrzHhQJoS%|a{IPmG_u
zUY9Lgk|}~iiYf9%yeu!M%m5h)s_S1k^MPVB0ou@=2};|Ln6qa@wT?Len{|`t=t`=?
z&6d$cGn)leN5IUUd_`BeUV}rDDT-ToM+1j2C|&TjcvLb<c+@b0GJ7P*W>AR(wi(=v
zwEv%foRI;XfsWWqny4@>0QD3=y#!DXf@g-n<hBGw4i0f9XPyp$IcCooBs@%+7I3R^
zv2k4H65*c0BGR>G!3j{=Y_7^6z#$dK1WM@<FPwR%a0oL+aqQuex=<tWgFi-y;X;ih
zh-L!is0%exKlq)6*f`jkBKc#4SY9~un3zW~aDd9}j5!Pn9Cx^6c;*Pr;F%yW2UK72
z%n_OZs%|E4u#o|`&dl$zFeuGA|3CYPy`|X{1{MxUrikpr_Ky4x0y5X<a7%!)`(ze<
z=X#g)J2sY}652eHK_LCIjj8!98+Vfy2D9`lHj3$oZDi9A+vuhrwy{mVW8;{7*v9#V
zGgnFSVH?*Ab3hFN8&UJ?_J$@h3?k`AY$VNZ*o$Z1u{SioX#*-4qF%(aF9jzK8K&T_
zWQ77yICx*SH|#4>h;Y7auk3th@+p0#5bkD;Ibf+n);GP6*jsuZws!<Yh50=ja3V0j
z$JhXB#e*6I*+=XpK~d1&q~HMZM0<<k4A7VmM8936_Yr$Z@5A<rlMM`XnGf4dot$7G
zQ*R={paJ&Z4ZDTrx9rxYAGVuo!opzl!kI%Q{f^yI^XvA4pdldh8+KPg?lr$@H}OS0
zD`Zp#>~_1OU<)qW3wEX0t#!X__t5>0-P3EuTmoD*OffJIypWfx1vv)hh!^tGYt8T3
z)i;7_Do~;_zsC$JnH5bq7#gyV+iRMzGt^}tvp3|B1h*V5p=F69v@G!i<tR|@Y;JFK
z0GB1H(!Y?(4=M9oHWObsv&{jOALf^BCc?@KP&qMW2e|Z=xRUJ0kqpXjFXAOVK^ox2
zZ=Bp$5FeZm<0MQ$SwH)ZJ*ZBP%)V<c36jgcW6Ss=UgBo<U0Y7?6ZVSUhioDzzfqE^
zw`qiwDy%giWgz20^ow|jNRy@Df;AW9Zu2`f6XB&woa|d@sgl>QXWn*@o)_|RcR|*J
z!Uj>YFoQ}KOK8dBh*Yvjz)P0ND|NXi7Z`EYBl7-V)V$AP0*ZB5a>6KA(iIp$$tnL5
zBd9P3HCsUycqE4;lY91I`^xN#_MF)l>;<#W+e>DjvscVMYp<Do#@;adw7q5aDSOB4
zllGq3$LtervX9zlW*@OHY;RIn0UB;;Z&5e_N~_@H0vedRXwT_=!Cuh&yuGCNIeSI#
zv-X<aXY38VPup8go>8S3?Qnp>|B^kUc?5$12M4%-oC>by<mFvWWEeC&)VNo)9I#jA
zU}W+Fnd@Q0y}{%%0|zLjaJO->f%?zpF$@wMtV{tMj7;9<K1>fxcp3kBhH<Z$++(aE
z(<HJ$i7!P!#H^EnjnkNmlj9_0h_B<ao$2HY#!B_FUpZ=6WZD`OwfNEmMA{k@rT7vA
zM6ONY<lsvZ;5SX-VBqR!@&~nYIaruN_!<O4yVfhbFe_$YGAp+K&sEG7%rTj3GGCei
zpXoUU7S20de2r)3x?cP&^@6`&h{=2+0}CiMnoMFiz|$ZQ)7`IN#4|x)TH67I1`a`{
z2o7Hkrbv*7VLcL)76yrqN%reOicOX>FmdoP#h3|zhFWB=a&R&Q_Z8TEHJid9@j_mv
z6%@!kZ2}S;yiAcV;v`Zz1ScOdiIZt}P!KRlWe|7~FL@SJ)0#*yJpd){7jfdblWj~b
zRKQibvz&tYEt`ejcWfm48x(GsNHS=EQVc{+_Qm8Grsj;YlP{QR1qts3rS0|xdr^=A
zP)pK8hQS2XhBL8YOz<#aOyKVjm^^8!0)vSt1C#PZJ4W+4%qzI&fJ!w6Cayh9pwUJT
zkoaT=aC_QlvX7Z0|3o{+NhJylCL#<>=5v@QOfE6AsRuRMK@D~e3Gmp|L}>GDCMapW
zh?lqYwqkHNJxAdH2QyPB{|tdPP)o=}h9Q8bLtryc2fWI?%eO^n1qT~b<O^qMP@g$U
zJJEmvtk#O_07P8s0mm+I70&=_LPH0eCQD26PIfTA$ECmk%61->+yav|ES#7mJSOK@
zOo2~OfLwW*O&ZkkgS!yq>h=bO7oe`ii#TCkP_}NLuP_7DlLrTt4C4<ED~2E3Ele`p
zu3S=}F2|K*P7dy7P@<Q6d);3CKS-U24Z{Z$VFnhi6eeNr$y~yqBJILusUO$Ucv&U*
zCkr`%`XMeRGK@dCXEK2s(jZejj2V7#H#0e#$S|;6sh9uHmn_u4J(GzAY@#v42d)$@
zmJ4^Jeq3+km3Sd9@5?hs$YJsWOB-}A{QxyGV1W+x(glc@1i+*E?ei5Hi1U)nR+yJA
zv`GI0d5gP+i-lte7Yk3D5G>Fqi%SbSfE)?(5ZDtlnPfm7x~wAo59A?`9LPf;{UA@h
zke5#dnFB5{q4PzPKUhh7LZ%F4m|R=-E6f1R9D#I#O~o1L(z+lQf`SaBmb-<C1!T+Q
z5NjhY1qP5KJd7EBOrBsZCZ)gtl6fI7AIjgt5R78?0c$BIUdZ?h#PSNz$PdUs{FY1h
zf-DEA0~tM8#zsjEG(N}p17s;EYC#Ub77CM7Y?=fa|8dALIkzO(mxCGs4a?&vf44EJ
z2aUiUu}4Xg{SA<E*+h~-=0&{BS<sNx<vH>{`Wq6eOp+M{K;`I_+Y$nx7FTzRLIODZ
z$4lM4P$m5V)L*<jNBTo|TZ6@g8tK3N4fg9n-GmqN@^e9YU&zbXg7~13T+qN2C}kRe
z0tZys<R4{d0Clh~yGVZkb+BH<OMzRyCc<Vp&65=@Oe7gtKyIHrM@F(fUUDs{_G+J@
z0B)J}H`%WR83>X$VPy~kH3=aOlPLwMJ5ggFYf{O;_99*i)HsjoZ?fMDQe#rd!15wq
zYAZ;Mi7<m*^W^!mAag)-2q3dSZZo%G&;m^cnMkrQc~voJfI7L83+&iAdqIs95T3jy
z-8Md6_%C-1*R1RV_JS|sIM13$F`UT0V=w8ki$UW>yuekCTU=5cf0%^Z5)?cxPnQ1o
zB98N_`7L|F_6Ga?AT{91Jzj1ps1$g?z#srBsr%CGpI)9Lbstn0PcAqiRS#|ALsKy<
zz@WKrVta$a21w3h0}V1qwa-@+0OdSTvH~X?NV;Z0E=)MUg^5rsC~3huf*`e^BF@8#
z;R8tR3weHB|D*Pe+V-FpzA)nt4;zLbT$M~LpajR!%;XHpZv4$c4IoWm%}4AzL1`4!
ztK@GGnDs)QuN7p#<OQ}8_4(%*8M4pXbDHonm}H-^7c}8vV8}jgFKNQfV3d8zUeSb$
z@n7~ydrcEg9**o2;Fg{Ts3Vkp+}_fJ9W=pe4{GhXWgoE*yfTZE<3bBKxkQ?@*#FNy
zYVY|XUJ}x&0Vnr_6BkmYKY$8wa1?VgsEWLZmw0Q!#lvC3&0xSG!{lzl!(aq*Ov{5r
zh6_)nKY&AfN0vdo|2ca`P=De@yzpMoTt;`Nf(IyiIJlT1IJiNDu;5>iI0p|?1h_(t
z7rYDRGlS+m#Lt3keIYM57nJchI6>-#bwTpoU5W*u3LIjF$WoA4bDM$&2M<#u2OCp_
zi6n!;i+Dj^SC9lq@I|~x?BomwrFwy<AR!Y;29p=@!eF~iBp?|ZA|?Pf3(_i*nF{hT
zFM|MI<6#90P-1@(FTNI}pF>6|<^^cZl8?!mmsyAbBnNT7fGSuXG-wbnCJJ%CtSu;z
z%x5xiyx@+P@&zeqpKsqfS-?@d-X5$yg^T%xyu2)^egfqe(1@Lb4X+2N&I1qdq7^Xh
z4GIS!$&>*+OWQtQk%PEo$|DL*rl2XFnc9g#3Jf4Og3>7{>4DNJs9Js@&wbSYn0+HC
zDVm@sR|%#lSdx7a&k+kswjgyL#ta|$YJ?g<B~m@e7bX%6LMD<775PUP8nO@Dck(+3
zxV(tx1(zlu4WPhvQD!PIkz{B91>lQ#*}K=}W#mEPCK8}=IbK;4Nk&ksAj+hIiNQpY
zQQ<|r>{O5%h}n!wKx$va^PDwFX5avs3GzgSGLvV8_hI`^P=C(<2*ej42f0{)Epq@3
zWtvMcG4MMGID-s(5ij!=lqx}%f*b=f1jK(K&m%kej+42lD5xL=byG~1F>pYv6n#5c
z!`a`m6~yztVJ`^^#TW6?sUUt&f`SJq3xKDMt@v9&w6X&Ke-jJ-CT=S($rn!YIg>Xy
ztJH%+23quVg5xuu7aX6UlI(bmLjcGTpy__^X^cOV8~FcoPva7UwOK(P1UVGuNe~+(
z_Cj7Z7vyPBsS5HmXy61iR0ORPEIA~ZoU@PFgJwqTH5nLK7&s)ETtTkBvOq@eMZ9n>
zx?dqa6SlpOEd38u9GioN>SY+1IEp9txk%fC$KDteK)OI}ZtolRf}r97WTN*`drj}d
z_Ld+M!2BEblAv($K4!1zeZ=1Ig}lVv$uC?=ST1dm{xCVgRgQ^KcXETPmKtv-$n_u$
z%L(lb3KpPg4^Shc*``4Qv;<}H30KehWA>8f$Ls~OkJ>9LY_wxES;`7(PH93rvxcA=
zDEWZBVDbTbVV+b5iOVw5f2Yr3u;XbEh`KB+-^^Ge;lP!~C33w<fPpWKK^WAtHmPJd
zz&8gpmdtV&RMqxm*!P3<I^P0$P0rUul5>IgF?&hxqxOpKCX$?soNw6+gZ*^`>|etd
z@^Y-^_aF-)kURi(G}r?%4F;gKHT<&}WL_{ZD47Q<Oup>qP_GK|p@|g3BT!tvkeBB*
zzh@8c#)CRypz^?kjqx9-k;uUaX|0>PFz|uK4?sSB0jm92n4&IEmjBU~kl+An%z?_3
zhBO5YP@N2#%lFvKYrs_lUQ93-R6~O70%dvcBa@}1`8Ysn6|}r!vWdHC{c~O(&`1wx
z3Bl`^at5FXQC4VR;-1STWp2rs@cKEI4M>bb7P4Lep4?8@XM)CnP1qSivX9wUf+n@I
zkJ>jXEI7bmvXo&RsEMM`(7*&~qR4GEX<<wN*~=lr<YA)Bn*~ZQpo+czMI7Ho4tAyp
zhhl~Y*NV9%97-4-f%3++DO>^$RSeI#N|-_%iW#0<E9T_jn#>f;RmBv=F^fxzQ;J3E
z^>a=ZkmH({&QApy2=S}kP4M_F&aqoa^8mC^=|#L8Z!E}w({mh{F3*vBG0DTYegY^r
zzKD|quZ8JvP-p=0VNu-Qpdg^!!vDLWMj-(tuH2;myQ4-S0?Y<4+F=p^g*G_H9=30M
zAuoT|d=3+6+0<F{IZO;Mz!O1C9H1p2=5v@L`27S#`1J&YFHMpE0a^^xHQ7&L1&0J^
z;*5cbuZlsGuaZIJ(pLE&AO&4p6pBFo<Gwum^B}qQ1_dV*VFm%viW<HuhG~423{$(V
zDrlJ%GjMd3*xv_<P3G`ajXY`3>7mJK02y6oU;s^uf`=ZD*(-v_?vH@m4=&(|R8U^#
zWO4;X39p5~Ebt;CHm1lEH3|i$91KjL<!=)j6c~6qgc>+lC%1WO)pv5)`<iM(CapX)
z5EE7%83_U)V_wM1$AX%}pw!F*Hd3|~6kF{L3JN9*846k&>}5@o8SFs0fu|X~2%r^|
zCqZRBD7kr<GIM~NLuc#-K}{gga0FNm)C^K&t{32tVDbXBg*X_Qd^p6JJi+ZDDJIas
z3#cdr&73%b+B}>dY;2tB?5v<Rk@pe1nc0W!BSBdT)Xw54%>d1cZEBgX-~h_!p!CZD
zU4WK-(tcw0Df^i(;v{`R#WhIY`>Z{u_ZfRZ@6(eHWvPK1K|BfqlX)}*rtlaD%;B*R
zn9DVnO_r;MU54WicwSkG<BtZ&3MEe24iGJ5qR3zXng9U#wc&Gv21hbiXvb%T2##bf
zzfO^cfUAo+6hUH~Q@O5sZDUaAI-+0!lH+P);o?eV<>U}%a_10X^0>N~qh9d^1EU9L
zAJ;jq4i*uvbXH-$%|a9Swg}B=Zf#HiS<u~TzZRsqd)fTuV1w_n$a3sqmC3$l-^szs
z6b@=pW#6%%n0*)IPjOq2KVQhpyMpxa9uSzrdqQAtbL-q%P;TLF1$%_6dD&cW?%};q
zFEE++hQJi=Eo`#fli6jUGwWUmg$))Qxm?08;zYlK4EC&H=IE%Y_XQdDLSE)NNR9*Q
zAkN8Lm-$kK8u-$LI{0dYCh*k?&G0H_Q0SO!(+X108Oz4SX~WL>B2F|GWY!CLnec4q
zL-seh#hGG2Ny_`O{mksk_A@~pkQegOphW8cW;+~U0wpJKWqI6Q()_r+AgGd5xM;^{
za*XxI<P|=C^<tW!O3b8^;R0xY2gH66F9upL$kdZzpU#uUzzV4$_)9@G1gKJY5zikB
zsvtlq5~LovwF7B*u&J6PLz)yO5{#hP%S01Nh7OQg6G_Gg%6$B{U&OQCHJ4yuGMQZJ
zD<&zMeaC*L_i=kkP#p>~7L?vHl$k0f?{Suzyw6vWv1sxGU%fbvFCa5OOJ-bZ7!<(l
zIL3*fJ|bu$&O`!SVMo1)W6T7J@e~LMo5(PPOiD0d0gdb=-?10;sA156PP|K|U$z(J
zDG`XdJXz{R@*R7{$vJ*n^$HB!QCuOQ(Wq-vI9j;oaEb7B2u$r;pb&AbibD}pT`7OG
zV>JK9Ji+@v^Mnk0ZVwYvZV$c_0`vK%3U%;Z5SYfdU#Np`o6rRAU@qZn#T+esH4Ibw
z8Wa*hdX*-Emeq1=m`!0`!NJHB%T>cA!`~>>U?R#Oz}F$LjgPlOU_bvhp%v>k#^2@N
zKUvOSmT~E18-JyG?wcl63_Cz(WY};^yol%CX;Q_o0m@f+5zjr-q>2H&yePwlTi``J
zccn=c!-*I1vTs3?!Jrup<U$&hDnNQclNla1+zOz!WB1Gj0Vd20Oki;-rbrJfZiyF8
ztTCV@$idId6shdse;ZVIyol%BIQfmgq&ld(Y0T>Z(%hDy5CED?zE&?G&}`h`pp?J|
zUTFIwo=bAFMu3V8hYV8`zYVyk+X`}tLPG!lj7pFTIcHAJ2ykYcJ9$ljw(NdTq+XaM
z-F!V>M*c;-oGQq6We*017jcY@lfML{@+UDcfND_>OI}d3S#@$oph60$1p#V3fQFnv
zt%egb6=rZqF}Z@g;-So)(2}5F0jkeTBp6sgmP1+w;00kbU&zb71$7EM)OZz4jxlh&
zh-d!`nwRHD<q`%JBONLBSNUp$7~mZMP&LXS$rJ;!2xI|hK+(gPJE1K>!Gc4ADf0Rp
zE&&q>1`)7DhwW!_%P>W}keB@nYW7^7CH>(=oW#WJ8}<`HS=sxh{Y03$7xHqpAT=N#
zgW?C2YeD9Nax7>z)I*uOJ_A&dfh(;e_J%zP3KuvSncP4Iy@(Tksjxwh5#&n_W+oR7
zMkaTYrA!?jzd*snW(uD2YGnW~Kkc5ZkO5k9*VAEt6eJIdbPg7#h>XMB8K5bV7x8ks
zpdj|XV=s98&H)aPBQlh^6HJ)d7(jDsF_ROD6((PBW|=G#%o%>dJ}~>ZeI#fIA2xyy
z8uot?&-D{DL3piNLI5`U(>%Fh1}G(h25er$bL|AJgfWq1h<FjtwGhgV0riPr#B()H
zE(jK@2Mv}nWn7;xBcEZzlmXJJY@o*o8cE4MVDD&d$uz_Kmfghc1NNTTckCu+-?5vS
zeaCL$i&)X6$#?8l_BSX<fC>{28?YJiATwUX%Yc`sfCjTnBtWsv;%XwrkYOUlko6*-
zMHgiKb!ILB(99lp{S2mv$qb;ye$2aG#4~?2kzz<Nkzz=C5zl-VtZ)uj(3NCPFHnP2
zxq*S{1p{*hcQcoSi6n!O`7L|L7xB`zphy8Ni!@<lXfR=C5HeZHw88t1y<@|i{j8uS
z!HamwuOLr=nhl`d#*0|c7`ffT6Ez9~A?~;AW`c*vS{Rtx9qg8RAF-SGB2IXx2^#}=
zZ8&H^;PnfcDc~e?*WM8nQzk0h1z?)p{=W$a1A~bwcLT`6j+zAxAPXly2oZPW1sAv{
z>;t`z+ed=u*^b#KdLOmV^gd!==zZ9}64aW5EC8373QY@!&}D)_{Vn$9lLJDfxOl-q
z3CchqZapt}Jqjq*c;B^`^uBDb=zYar6S`W`iF*s1824m$QP4_co&^H)yY9~m2jwrW
zxm+@!YL{n^Py?(s<!KO@%)Nq5mb;x@hO1@;sO_NCRb%@dq@JfkU~*IK-uqzo9H9oD
zxk4Q;<Yo7o)F(4ADK{`EaL?e900)2!15<_tcLT_)py~jW!d}Glgo0L~zmS)$1&!8%
z@)@YR3hKz8wt_G9Oy~!d*GUYZUZgVzBa@5AEM5iB;`$fyawkDqsVBkyK1d9jcfoyf
z1yKJKl%_xy!6oEHZ9(Fo7@8arX3Xe2xhG7@kKgjLmGlQtOVgu@QNg2<k>f?Y$Xig^
z2a0acBs$1tpv(*!FadQF5j`wO!OB02VHUWKmy>=v`9qi$6Q{vsop8T;LHN=^kO?Ld
z3_7541mu6%LdzGiyiY+LNfU7f5Az%Lf+mto0x#l3HkwE=aGa=F-~rZi(_Z(5lgJ5>
zi$Gm0P<`xu#6HsduzeyVY1lKqke5Gd!fX#-%K)+iG%3!(E(KagCC@r}PlOYb=*CHr
z5*o14NN~R>mfIFwFefT7n71%6c_=e8^du;N5_81lIWiIfCY1~vFJigCLs;z%_FF-g
zzmS*j1+R%dWPcNE(Ghz^=ps4I7xD7EpsC%{F$$}^V;DKiC)@vT%WIgxJ()?kFF~PU
z@`6b9dIPZYZ`uoj*86!Mu~+myY_Iu3UaS(_on>K);b3Np1*?I{L6$**r_4b~36w-U
zRJcKFn>%|N6dXXS#Y`j_9=wPblQfZHlrxcJcm!%Sfr1OP0wAM?8!{~c9<G@@%av=g
zLll>qI4F!+K&79F6yv@Z@uHpFF-%gRxOovTT4*B081f=sJackElo*!)gGn(12e`{R
zA<96<+?9a|)IPtgBK-qYN`S%=RPVfq7wI&S0u5D*HG&7=S`;)UUx<<btuC`PsbXNc
zJV*Lhe~bNgP}vF6_#$3}5tKeb9aE6$94cHf7m}qv@HY!FT_~1%0UGQ8twG>u<YG*)
z0WE5gw*~n~spkBDvtkAoP@)3G0c2$(g9BtyBa;)T?oYpLuV^C7AfeR6P!C$+sA(e1
zAOx~3{j$BG`E~nD^BeYo>6h&-O@tYkKr0%PFWWm_o-FYr`LezH<;jvilJD62CSSJq
zygXUz2gniGckDAkmM34f_lB=}ykf5kUio;%-ZcG|y>0R>d*|d^_O8jd?EPQFaT|hi
zJBQ5VU(q)8(0S>@3=Qo~3I?ET-`=7S1*#E1xidk5X%;9cgIB2>u%F2x4jy2A_9BjN
zB8ND5x4>GET7?7-h8OX&y(U!*VlU!lYfY*^V|cQ;CRL!BQ~6Yo8c3)xH-OmS#n8v>
z3pwh+n|<snIUt*T8lk&lI@=o*W`KsP;B%?5EOSA#qS=RSW@aC=0qv4u^1fjs2oie{
z$3E5jrj6u@8V3V#)f~qp3KBo{N5KQ62G&9XEhg|jW?$%i)V|XDh<zhy$ZWcRGb3BQ
zO(RJEi#T>xkUns~hlMEuVwP+pNDQ>M2c#e52~a`@l?|Yp8&oE~h-C@|xfRsb0S#ty
z$S{S2`b;L03|ye01W<wp*#!zva9|#>Zv>eGN)F(5QoSTo6n}%j<h}$2CH@%#poXv#
zXw2dT1H%E3rb!9r|6edL2)TzaD0G$BFE^jVpaGf!ZmU-SiK%pz*w=%_CJ0P+k7Ur`
zs$`nUKSN+LS0$5Vzk<CxNX~m2gF@Q@1qo0Zhm9kG*dX&gK&}F{sz9y+37T6n<bWEi
zCc+G$)sN2nHVPq^rb_*|wuM)MqlPO4G&0mZ+5RlwR3V3i1crbYu}t7$k;xzYMO;8d
z*=1H~&}=PyxgU6hGfw0zs1*hp#o^e)6algsG-(17yDTC70W{z7LQY^Wc&_6{tSob!
ztmxz)vEhuhlLO*Jx#MI^K_hqV4feH@3*zLMq@PZn5U0(!bn>1!dq&mCf8u2Qk1;e{
zR+Ih#YUEyamHu%(T2d0$*aa1TFJhTN0|<POMcmvgK^AlDVG?diQvgj%MKUpPZ04BE
zBHWh{zZVqzpvJ5MC`dS@z^NWoTHQ2}0_AtPub{dLgeT|3>#->?co=hYOkNN##>CAr
zc}Kj;<TK_1lRw0=Imu5okzyz~QKOJyBEbL}?q+xqEBz2;v&UqHgp6W_1cx~c83{EE
z8GJPYpb6-hj2Z?5o&^Fim*+^!C)6-FOrB#aQxA%a7x8juLB$!U#RdvHkRdPR<(7i-
zCMW_yG|08!6=YIO?j}-<8laV99OB@`K7t&Q;88>Ha;6vY^1h&~cA`e1!$g8n16;hu
zN;QJa1ocM26F0F^3r(sRI5N^0RXIQdS>AJ)PJl9RMh&AtMk=F(hYd4BMhc?>PmNGR
zhB7k)Xf>D!*agtJNKgU%BA(ZD@`?mACYhs?A0(JqKz;HSlwnTKQSbuyl^7Tl_!|U-
zLCK0MnJd^V*?u924;uOEORzuBk<8UR`GY^CsmomeGNQjhK><|3yoi^cY9b}TaC(k{
zQbrAT0Vwr?0tXf#pn*0}T!Ni-gaNcg3AC9IlrWt^^I|XJr9e}eQT+{&Gyn<!Pyz+z
z*BA0qt)ONJm<?JtQxDC!pe4AV<+q@vx1eRWpyjrpm{AVUV+1X~eG$)<YaYdP0aTiT
zHlA?EFu8%`Uc__#HIHKY!6CyG2^v^^5zpiZN<*M2qLu>+D>!7CTs=-Oa<noi%-~qg
z6k{T(!0;kovX+B`DeA-=#R%}qN|5V3t}zOLx?ix2+~1I>0jio`#4&;AtxO~tL6$_k
zh?CgLlOPZUGOWEp;Q>euPl5nwe~Us_jluzC1yC_90iK^bF-HN^?_dFqZh`9uR!E|M
z5iei}D#2dFF`9yBf4z^}b9x`M7X%v&+Mp=OumfbU_fdOEc)LMP{HXs4dq$8rZ0)cK
zI1WGypw8NZ2I+mly&?34PiTvtCMV1mvEg?Rn8QCopwrQYL7}}xVF74f43us_?H-T~
z-UJps)q^7Ml09R)f`Sykg1{V5S<7!M)WAPesG;S6y(!2no?`+mpoJ4XZE7<(IGKVS
z_b?c=x2SmVoDpE1umHS_rV3QeURbd6!<D670^8>>C|p>u<HwbyogCZeFbG^&u%qV6
z(vFtxa~L=-EZAXpWod`g_BjkJ7ZzB^*KeQ0zyzA4<2fN9%yUXW20Un8!xUq}&A??M
z#h}5NTG7D4%H(~yN9xDbIlK~6YZ&Z6(-WZ7eAP*S0kqSPF<Zjn^$RJ1i#^gGOr#hh
z%$M8$=XB>{e-SS#d*J~CyUBa79nM$JbF{pO7x~J;#}viE!xY8A&r~1z`WfF6NU<jZ
z+T#)h8g2&-*G{N00Br<d>Tj^s2Zh2!0RsjT0S2a423uB8RxpuZh~N-lihL0(aMDDO
zK>;)z2%78!$-Rh^`pO}|<d%`o;K7q1Fz0%M+<j0&0T%}u3=SL|O#UW9_77jg>B)S|
zNMQ&7wPJXRg#=7***^reWO#~&gt%R}q(Chho*E%B(?0wEFXCioP7X*_sP8zQ=wQ;z
zpx|l6pz$J3Ceb{K!Jub>k_RX+@i#zLmGT@C5C*M@<etnF%yR@J#>v5ROh5`Wlk*}@
z`Xcu%rYQbd0wVl#1cX7p=btAa!!tubl&3^Uil<aaf~QzWhNnhI?nRt*CCEoSbA;r;
zj+`u1F9CMpWFd&_CJV{DkeAvD+KV?~fdgnY9LEcJ8C{d5_CGoJnWA_m2r-x(V_@Q$
zAjHJk&&AI(QHbS5oYY00NkVL(puRju;s?(hA&!eOk|3IkgO@4lqKwoJo(>_t7jaUJ
zJadG2pcV^&GW+Gp^^!k$CJPCHgJzD9*o!zROP<L>A}`{kG`ah@q>x;S#i6pT9K1{}
zQ?nTyK#Ar`lK=yE3)dX}CIJ!t76IXFOE{eP+XQ6zmN8%n3CT=QNSM@%FxXw5FY)8@
zG|3;Ar%L?*?NQ}8!Zn$%UWkFyg^Pu+Oo)lEREVWxO8i;A8X>k9@)Dr6DGIy_0?jQ6
z3Q0UA0wP^43KpP*0h$?xC7c&=VzDMw_77jkOQ?dfF9$PIFleZfLx#z@r$J!_C}qEh
z=l9hBm5c2S=4U|?pi~H{p|~f4hR6_xi5{JtlP*;+eiP*A7xFT_JadE^Uc~b)1!;dF
zFYj;O!VmzORPmm}5CGbJ11^IufOp=3c3}HupRot+x-(RC=m+g*u*^PT@2JSY$7sqS
z|3CY<z2}wx5(3%B>;s`IW+N}NO2~7wa<OI~w$Hq<RQ@2S*w3y%58lQH+QO%qeZ)Qy
zv;o?C4nqQeh=4DDgFp*^hd?(63zN@<PU(N9F$_2O9R&J0+B@1!*cq6vHps|vcXDy|
z98g$bBEY}^>dtboF@-o7^Lm&}RbZS{tN_~Q%%pUH|1QU8CgFxH3K^zV4B#!NFBlk=
z_>M5d2VDLm_2c?{UWpeBj1r&~M4&q2MJ&@s&_c$J4fgkWKPW_jG`)xuJIi^Vi~mJD
zcP%KZo}P2ygXvoP|E6mhn0QJAf;l&{2=f#Rg-owuVRWeHS^=JrPy#KD<ov=FZ#D(A
zEK;tO|BsMErVqmjUIl^p7xHrbtqVZ&O^iZZHB2(?6KugvBhZjB=N=YN_6m6+FZa|$
z#{O&10R;{dVa6a6VTjuP2D|MhGWMTe$jhw-72}||xjvKQIe30PKw$FXY+*C8ji8tW
zVUVm+69a?U6n;kV7C)q|eBjYP=ypHQDB$E1Wl8nIlAuI!>W_j1c+8sxw1h+sJU3t>
z&cFm}j)8+IUJg9(4r(mEh~;K9;b2ez?W+XU$tIkP44`GlV0Cdq;4<RG9;FZ94g%-|
z0<f8o-GH2~pk<dzlN>HHxNsUX$@JGZ*!O}on}{$T;+o7PY$C$Y&{U$d0_0N@3GmQV
zB*=j;;sj5EhN{3~GECth%dS0;kq67g%luVX0@@bL6af-{5hqv(5{K-gvcC$-2qqE?
z2~aspkQ|sV!xUZ*7L1nxFJ^*=K%Brws3HYWHwCH&90H*AnqYpM0Jv#vBFqR{Z4O#Y
zIsqgO%7riD1i%geu|X9Y%#3UQK?Bj!OF?G8h~<zpkz%L^olX!ARtOFz>0FQ`$RH5?
zB98wd$j2azW{50Uo`E3%)NZ@5RQi9*0tF$5%M2|q<YhxaK?|D7=J*4e#*R4)4q+Ml
z|DaIyK4}kHG%g64BbhwQQ*5$HrEPsIqb8`=&vQipwC(U;^W=sA&}0UO3{wbbl`&Tf
zn+R7jJ7^$80VIB{UV^1-a$|&vFyjOepJ%g>6liDHg~<{>cs2_OfCd0~HVcVdm@NH*
zXR(kFc*CqHle391gBQnFjRq58hAf`VLM)(lwilW?KTm#8X)Sn`=YYU;kQ*n@NdQ&2
z60k<mWREII{Ui2?p#CJNOaYZYpmGOP=42nWkK}g{XuYsU`hS0ef(NL{3^rqfmt?)X
z%v;dF47h3JAut!TLIt#l9@IYP4-lBc9|0Cq%)V={=^ewM;2jHI+g$+KE|GoL9=rtu
z)O_t%P@Iu|$6l2~lF8kKgN1=-ia<<vbE5*d0}wBx3L4ftJ!c^oC<H-a4H_JM;mC5Q
z9yGG(eaGI=8)Vp07KZJ6LCp_#8JGp2g`=P`6Hqhtg(FK1c<2_q;9R;EV(5YdWHZq9
zn=EBv0O<!gsJVGQcxei#IRpv-?-TZuH+#v}gIX*m>@1+!^I8)Q2Jkc<sBLb-VSg9Y
zJ~v@!FaUW{;TQv`dR79r)j{K8lHkpwphl?ki&(}=6Dj5w;MB|x%VwO6phU=V2fX6Y
zfm4P_9PEB@LKXq%7A6LcxXm1!!M#P$3i=3WV_yT5!e7J-!&Vi6Cg37p#Bn5o3_SHm
zApqn7kQxvl)RYEgO;B?hrTHu`oa;YXc8xS>&mCkzl?(%evPy#xsPE%Fhh2hu4%ZwI
z2Gu|2mbwhrV>nt~zhEi=m6R`H<d%ZE7hoF>*+;&Rm+1s`4ncCDQWP}i0PX-XFgcu_
z<DhVPvh@GH1O=_jbEM}_o&#zS+JA@jq0H~u*MnCpn8?`w1ZmDc$p{+Z18pI3&OTw!
znGKmPmCQbBub2&51QWxM;Oxeb!QUXz`XXK$e2l^AIZj+WSpqU9EDZBN%YIE{>>W*(
zGw@6}09t};pU44PG8f0z%H6``a-l^U)OB$KRZrkV7+25Y3pyv_c#30!iLm`$o*V%g
zla&lipxVY{1p|x8at1cg+AI@c29NH^3Kb?x7`VXe1>>0S^5h9faexwC9P?400s$$A
zfy`@piUg#<DLIaLDo=@k6evDk#4*?MlnF>d^``P9K=szgG5hi)!8M!mq`)=H@}$8v
zv+`sJNSW+p;Cm6r^p+<_K<Whpg90eUz5tcMtV~g-=iF-rc>t6EyieG3dLOqJgsmm=
z28G;VdqZ%y^(15^3MeImQg1!9?I8&o69#uRC77H+$s5$w<o6J0H<4lx@%Y04+7-}Z
z(!#(3@eSis{sw^#@EBISOfM*iPt+_30L#Toe+9KNPt+^`jVVWhxAuY-@5gg(1?O`a
zCTFm^IL25LDF$8vP%;H2QBZ?z@&!E+M5>fvkN^#IW*@WH1i2E_NXtHIZwPkj5qnF}
zXt%dBgMzmUgT{*(k+YzT&$9*8|785vRMQY}sYdDrhcHttD44jHu*q^av&(>b_8{@=
z^Ceii_cUsl$S^p7_@K#W6A=c63v(nuW1yMJ7iz#W(&`uHNWVxvY_AGx;d6+9*W`O}
zT+slXGLw;f$6oeAGv^=B5PtGyd*KVsT%SP^pM1w&^1>X6KiB8W+)qAY4_f3Gm3-M=
z9JCxT`HsEx={X8aCNc~XptzbGkReeINvaG9FXZJ-L56~|0@&wA?IWSSO#}_7fWi_~
zj)Tf-P-wh}5dx1dfP4<B>t4hN%>{{riXu>V5>)nrX2C!qU?R%^S{Ee<D?&{q7$jcA
z2-%uQGSo99AF=l}zhUnP()=PGQiggTwFhlLO9Z*n`>=f`DD{9U1(4&wsRvZnfsO+?
zZqEryNgzu>3CJ6iN8KTL)I^FwhQC9g*(8~P<wcw<s0k7IB1TNrM2dk6oOt471x=*t
z8AM*hh~+{?(S>({Qb~V9!Um9nmIn$iOqMb5fE!RTVyz||j0vE|6DWm&dUK%Qei1Kb
z3)KT!104AxPOcDCF>rT)_nbF@N8Ubz%hKr}eIRp9q!<Li9s><GOjcbZP%kI_5;Ud&
zHZV^5qKOov15X2Z^@2lJjeR><6KFjtE9g)p!A8*V><fAMP>?t%L_m8|JZzXZ<ez2)
zEp<}7>@E))Dl{|!ZKyqE&zXJFUNHNFy(B0xgZ43k60gS+9**W#1qF`|1_c3-0X@GI
z5<ufl8LG@2lfUE`)N`_Mad_A;bM!aFw}Pf{U&zasX4o)ufE05uGI@fw^n*52^?Xs1
zFi~UE@HA#-$Vg@804><cG-hVtIRhH%lm7tf*YI))h;WE7MZSJ6xCT^Mch%NC1qA`f
zES?(z!6wSg4m>479w0M8&2+9gEcG%T(->y(qzXYMv$a@H@T3a)aIi6jgS^d?DipxM
z#T3PLgiDO4MkvC=hV{htR{s4NHmoN=hJuz%nOHEx4}$=i!^<Tg4004#4T}uej1vMO
zJgGt*Aag+G^3(_gfb2A_U^d`7GFdB6KKhJ66fc*6<mD*&53ipKfS2Bx?*;97m(|U*
zWoF<xArQsO0h8xH0`i(i4KoKwP4gZH36Dx<ju-JVy5MrGl9>bKJ#!ldri>b9j>!x1
zWR;(B954-M)8MNW3h=aKX5jA<kb3=$V+P1qAYYhRFlS7DkSEXhbyB{R9PdPs`5+96
zbn|;`;Juunp-2y9?iG_Q@)en5xJ)O<<lBLUZB4m1OkR*5AGxWk)UNbO4Tn?q9m|8}
zmn|o9)o{%*zh$#Jxq-m~Gzsw{hGQux?}0LE@*SJaCgluP$#-nFn%}Slt*y~WzGDNL
zKVk#vc@fK`ntaD*=L>n+yOTW%)R;IJCKnWl)Ppv!aSL<JFq_OEaIKibsi|_VE<c-q
ztodXH9*{Yp@lS4Ha3|Y?uU5zh+Tk+g5CiQ)vyV033z|)lISXnSLp;aO@FG_DE@*57
zbU=oQ6#Io2F+5X2lMkRFycaP%pdxo-dxQN`??d*JXJ-hBpR;FFJjlQR+B*Q+F92E}
zr>M}tFnLdgZv7c12hbWglOqfYpfzxywgqSn+=K@T42lX2OrS+}FJf3hEAyjx3Ix1N
zWEh`-a_fs&Ay=L|LJd53guu&}Uc?HiayqbZ@!S!b@FG@-*Hnsu&-;XpB+nh88Jw(K
z9Lf!RiQJt`o*XMclh({k4LyshlpXkzWk41wJM<;Kh!q5P;CUK^I!tCUD7=UjY@IwI
zQ`9(CFw}&FfrVoZlhlh?L0gVnOi?_kLY+J{LKArsAtO*c6#}zBl^0KqP~(eO5#Gr+
zGUe)da=_`~uH8paHZzfAzwr90+!m17ix|#YP+KYcj@?h5LeLNrw**fy(y&q~NQ{$%
zryM%06e}PL8dd^THawXiIc^D_Y$Wx$0x~@L0#euKaB_f#p{_K@$h~ln<=+a@)G$W@
zRGl%rh~ao@e#`D-dxO0^$Wl;z@+1mOzE&@Hzr8^LG%nQ$D&s+Z0m*?Tp1jZ5Gfv)-
zWm?~}zx2W$=`S2BSh%_SSY)`nGa9(Nn7BDOnWA3A^0k7-%s_)6pyKvLEMF>TDi<ry
z9HEXEv3$N9yi8F%b3l>8XKJ#`{y%6-_X~L$ThM3`C_QmVG6nPHfIP*?!LJ}7$(JV}
z0y;K;dkRwssL{wF!4zK4?;#+1*;4vP-xAPdlKubeE1<LLq-;SO+>u(1;2AE^lA}w{
zpffV8(xBzp6G1&4P|*yUEd%xBKz%Uq0b@^P!6gIe6f;nam|OBGzJAUz2NX-(bGevb
z#PWRQU}2Jt;%;S<X>L;hx2-@1a6ncx?*&z-pedU)kXMuv{BMK$LLN4Z381Cb{0#y#
zuSaqA@KrI0a8+@Mf?5^aQ<y|1L5`_%Qfl(Q%{NDgL8&nxN<;Y#5I$&e6KE|2-yR_b
zzA6S86XD6b3Jo2>C;h?3l|V%U$X-wz9kllL+8)jxzETEeu4X3Yo&*IgQ1<TcvcC!v
ze-SSSs+gicGiDjE3B_#COnAJ!E2!}RGRUli0d(w(!Sy+uGfc!76hI5@K#So(LB^9H
zFqLaFc!0)=uR%bbD}_rGRHyLm7h>RV5D?|M$|Tyiz<xVO9Z#_ks5Qhed4j7*J-A^2
zIx_^a2V4@?k_0sjK#Q6{tr-p(reG!pjxC@N1o_Itlrh13Cc6aR4uM&(pGxkzR?ImA
z6i48=l3{Xz#1%`A$x{3OTywcNlp6eRo3%4|m`!0Y;P}kN&NZ2fxxGQ5%cO-tlZmI5
zL73;W5Cf>T1PxX}4}DqH(Pn=XwBib6A*j}ac9B`@V>v)Wg;AI1NPXyUunz~R0mVC~
z3}^@dG*t&G73E7odOF(d!Kc@~keBxbnFC4+CgO|?$~FxQpm|Bq{I$8Ia$@!o`%X}m
z0NSz(TCsOxkAj6l17zhMsFe#!$e_7N(46GtH8PyuvFxHIv*Z{|W-%nZh-Le0-faJW
zLUQ|W(5kS@lcoQ()!Fxh^tB~Hb_gDext|W|oq|^r#B%n6^eHPeFuaK6ES(%uqRu#V
za!rXWb1duE$#Y5+jbl0Hnp80)KvZzFg4hZP{<mMmvVvyP5A-+K`-6PrQOR(@ql)3i
zi#Qg;$sbCj>J=D3y-p7s#uK3ZEBvz*z^hw99x{(&nDIhh9K6aEl!HJq>0!fo030Ba
z3{0RT2TE=rYxpM!w7iIA2Tj&Dm{c(|fXoC3z+wANkh!4Z^o6|GT+mz?$SjZ<pyJ?#
zaJ<A>kO0W=>oJ@&Jd7C=CNC&euLo^`fbU)aD~*=`I|ZZ?q>8UVU?wPDz^S~L!2qNi
z6gMy8MSHobxTHYVPlg?!23cnUDNqhGG`xrxp9`v*KxTpTc^ETh@FgqERBrIUZ9a#=
zfO}Rwc%!j{i8zA-=%kAm@gh$_hNBw_>Jx+f0xG3IbH=c_;umqu4?(lGm*+_TZ*Ncl
zZ!XGEV0!T)jv2Hzr3xhXB93_`XlVLc4M&TKj2r`KDGkU$9K}pAO7%$$3}(fA@*Ipz
zAsNO@H%!DBE`TI6jF}#Q4!62IRr*ic5(S0JbEH%HmMKVq#6i0jLHRdpGSdwZ-Bo74
z6{HRn8OrPe4CWFn2f%ZPaU8kkQOpXU6*nM$hApqei#RD&^C)JI6EzAeK;reFqA<gT
z7c@ia%E8PO0vf;KkYNhrgPyH9DFL)zkMY)|1quuqdw3N*cJV4)kK%B85hwN)v||J8
zSR1Af-EE3HKs6mm4al+=agw3tQOpS^YLqNM7D4UN04?E1vZo&1qD@eXG(2|kYP^UO
z)4d+W(E_#PM|*?f4D%KS4v@trtPBo3%|bJI5(H!*+h!GKaj-Et^UM^O1v*OvDmDpJ
zjlYOtT?$H?CZNrAF|55HF_W1L0vs~+Oi?dlSaVHU7!-OE?9)L8zF=T@0E+*<5?j!A
zekM>^3~HWnh%tqNHWwf)RImbB_##G#lczyo7N{!iNwD8)(!#(2TAvCEh4v{5A54lt
zW8w0>9KuY_eI<6Xpr#tcOgUB#b}^>Vj6J*>pxUUueTqT^M75kQNOg0of{=L>NVl9V
z$V=@GcCMgI#P1*kIvqzBBnLjuN?!IYNIirtw-v+&rB=}CB-!WfcAD@rIAou*J7~hk
z;FW#W?xYDXLrnG=yNf0~3@5Tr+ubzbX1I}k%C7#Q2^T{`_DQ>!CY%fmpaW<@1w82V
z5$NtSNzl@W>`QhFvoG4M%)Vf^G5dtw$L!;FKeLb7Gx9VD$XuQ&|D#<&odL80vRhAa
z2B>9WGKGPOgP$n~G*imgARuEt)qdfnt<pc*HZ>%G)I$;&0~fbeJ-COb#8u2SnR_x<
zjQM2yg`oK!P<U~0F$KMlm%j@#q+44-fkTAJjjst}VY9Y^lUW-BQ@4&n0tY8kj7hTn
z&npQsa-jJn(2Uv(2F8lZ?K1LwEfDo4G7Kl0Z4?d6+898~*qOL>B0viw4{_V;f*ioo
z)U4~^VIsn?!9<3^i`xby#*k$q$>0U@&5IcJlN>BeZZG8JWKE7RFg2Sf3z^6;9P75R
z-#e*6OoKfWtO~S#@(2Tyxrx2vr76-s+9u2o1+m*E%=ZVGq_knOQ-gsN8@P82nnmZ}
zV2XGV!}buOS?2BJo(AW74xR*o381yEd<+7hG5v5*sdHIE>V=6Q155Trd+>nSix>`0
z(0rnaBtyxI7*?<tO#NjE>DeGXU{hn*cY^eoNHWB{h+*{viGkFC@+DXe3wR~c%*zte
ze_zC~CvvcYvWC2LEXbE8k_-tiVpzb=Gm&KY@FIrgB*=j51NIY5WEcc4iOa}?dlB;T
ztsDYO5tCI6Hkhz5Fo7%bWc!a-5@cj~5(K96WC%>)5N8VE5MYWi5oBPxJcYaF(iG_w
z?kP;6eGBaGn;9}NaT&7+w<S0@a5xJwMS@%gs-VFxN5ty{&`G~wOE23^1UckI4D-tD
z>vl7}FWXJ@zHSFv<XdW1Z2x~UPm_E-m%;=+Mw1o>2A&21*on<TpfGzOFPRJS9>fHu
zkD%tl3wimiAazKos0G9aole}YV9Af9ej-%;QINd%CA)>*7wuMhU$EQgeco=T_c^<R
z-e>JjdY{p=yXbw|?xy!CyNBK<?OuAHu>0tJ-0r9MF?&YP*~s3obCJPymtEuJGfi@Q
z3JjnXCni?B3@_rvMJNAgGOA}g2pSklJ`5U=X91l^m}nxy-;jRC9@Ic(Nxoz64T{R-
zJNBL}4GIOxckCTO?Ev@5%zrKwOMg&qV_-0!BeJ@wMge@N1E_EUwSvr}SUkLs*k^hl
zwl91kFINg069SdCpjCJ6ptDD07#SLB6h0|S8|X2bTQZ*jt!jM{$0Vu%It9CmWx|UX
zmd43*nx#A#Y(Y{W;TJJ1h9*@kGqR7^&omKcm;joz$-Znq(WHW92KcapIC)T|$px|>
zZa3KX_KeB~lm9i#Gsp0XPF849uh#&%(>#jh#fx|u@M>t#5htM5(~CIKhoJE2Z?La*
zzGE-i4%$@*I)heTeyMpBs{*LYz`?=<np6TE9QNo%3=ep4?ev`ex*&U78Wb#)4fGg6
z*xV9YU&c#cHIHJAfFAu5^Fn^|u@-y933`m)b66*2-?EnkO`ULvFhziD&c1A~_#$2?
zH~Y$Dy?*h@wyomz$_@NK^A9sLG{-0<flfPbj#0`|Ze0JrIYy~Sxvd{WS1Hc`(@iEa
z3XIJ$N?pngeu~X8N|Tfu_<uLYD9r+G2W*Z}TBO_z=C4w2)(44iQf>tEcPTf4=|i9`
zgv~KZr$Ac*n`4wNDL3%fgABZ-+`xakIY#M`atHry^EoUGVD=2K*em6kVEU8t95DS$
zc^-&XMn8y>se8(T4A4Q8FJib$K^4yFIZ78m!zbR;86rSKTFL@?j3$x{5}*?YU&PD&
zHJ9KJc)_5=5MWZnEO4!uv!^@Qz8qA?wNG+zxI9_<hgmU00%(cW<T-5;^`IS$X2lG7
zpoL<fMbGAQSZ6@lYt84du7I+qn$KZ90A<&j&tZK4Wv80YVPk-@ea+{v2|(GV=5yFI
zpln(5IcyG4Hmms@Ht_CB(87B2Ic)V65DB@f=5yF~K-qiE=deK?A-B|g4*LhFc(3^!
z_6tyUsrelC4N!Kh`5bo0HcxpuSMxdSFf(<{=dcGr)rgwUVYh&=W&fJbVOM~#>t&ys
z&tV5IlLMWFZa#+%YMJa-^EqrcKoz%%439(pQAW_=eVov`SCGF!V9xP72X=tkv)--@
z7BAwZzJdxak75Re?929@pj-ypapqCXpaIHlp!N<Z_jnXD7??+KD7=UlwFPZz<B?Ag
zm;;gk71-uc91D0d1g7&82+Vj9FY=eCLSW{kUJ>v-lKDL*27Ct$zldW7uZ?eSQ2*e4
z$o8g*I0NWVI|fh|2bpgk#qr}s9K%-7tTc2Qoxx-$0}DisQ{hD%LoKMd0PCyb1g(>2
zcoD}C3L3)(tpJxYkzf!2<uuU#GldI!jG*={XpP*9IQ~czhz5ZxwH(PNk_=KD%uL}R
zgI~nSUo?;6%rL275b(ZkFA0*n_MIacBxfGQIpIZ|Jm^44kV9EOJudTG_PQ_P7*>L+
zSq^3<cavkB8%#Lr85!K~*z0!8Nt^(h2U193U;u4(GO1)>0%-s_=0zNXqrwM0M$q}C
zAk8M63_K>sIDeRMFfxE9D@~qrUVxgh05nfzBEi4`-N&N%B3Aw^sLN-<0zT5f)%%XU
zVn@xQ3|N%CsE^~hX&%M2;Y7{i6(E;`G%Kq>Hfp_yl@B$yWMBjB3+ZoA1t0ba+L3d7
z&!GjNVFyqsDKjyEqJcp<uK)jwSbkAZRKH+gN_r71d)NGyy&|Y&1T6>vPk6<Px|-jz
z1D!I-;(py;5wt8h02DMY;$$5`5-;M|9=hMMS9HH)uL!B}WRG&xfJRwlT|tI9-?3Ni
zZ%|m^eBEB%{f@onrSH-|KvSR~OCc7Bv`%j5604VK1Q`c1$~?;c>x(!xL6C7EV_(S2
zwsN;}v4XX-F-3rC4v1Faw_rWj?G;USFtCAUip{>;|9%lGqYD!EzHTQ7O7reF?Ig`_
z*(tt=limpm{1@`FwxB?L5i5NctnQATq4#9bZjt&}L0^ypP~bH;&z}nl@fWcyM@^&{
zwwXvV?06B&vKG`=Gm&E0^&*yKDyT;T>b-z6SB5!vfr$-w0cbnZl@@LZju}i5{4<0)
zK-I2^Bm)y@W&Vp;fnJcmL6P<%j#JP)ic0}hHG!&B6B!<c`V<?cg7gD+g5cyN3EG<h
znxC-~biZRK*xsP10m?{_<i#=5<QA7le}f_eNDN{iN1=HXSH_7w3vPhKUc^aeg6iB8
za}+ixH`)I-kz!PM5hv*g>WDyB>w*tlco8iEUD?5C$zXDm%i~3~2xt(2BO`?ow8)zy
zqlOXOa|M-8-gCGnfL85#fL81(Gc$me=z%PoyyvV^y&dBVd0Af*76t=QDV2YW5wxKP
zbet?F^i(j=ft!;25&|>Y85DkihVMZ2>x+2#x#pH!H$VXkUas6K{rB=5>Di!w0!=)d
zv@n5=7YXM`VUYyYEHC2u*P2UkGqfyFumGJw4H5^b<EUq43WqAlHJ9M}0hVNDiUC#V
z=uIjAWA@<9dk&CWOFEQ3=rMw@*>|oPATvxPnHbC^xIVmy=er7;K;~H@Al~-CZZCHW
z7c<B*kecZ;nHXNg^GyZW^+H~*wH{<4=x8Og?_4`TAz*%w8B|7tmWP3s3QL}rf^0=F
zzhx^3@wx0;b4zXkaC(+uiUOBX0(y*~%^KzsplzqTce!V>NWO?+V+85(2Avp-(jK%0
zZ3}{p;@96KY@y6qJQiBKi0AnWv5-}f2n!+hfzIRwANrPMFA1%U6i-VnumGJc3LSF>
z-SQ#m4L#uU1-LC|3-%Et6r`7e9d*<mG!PO6Dt$n~iwFhos}M&qbAlXodX9bgWS>6y
zdQi(2e6lpy+i+))>k6q<Jg%^K5zjRh;tIx-5LYlkoWTlq#^eo(B0<@Q?LD)v+bzt#
zVYf2-rrpNuTXs9mkJ)VmrSunZf-^zu=1<fpR6sHkcS81Idr6LFE*5aRkqvSW4QMJJ
zT&u;)G-e;0tk*9;`J<Bf<d}XgA=ZZM6LvpMI2Z!5kJ^Kd{gj+s&@WN%?ZyD!Y3S_^
z>V-*s<zQ!u0!<Ku*P(!xfw3_~Ui&XI|3w^&DqM~Ya(1DKID^WIIOeZhPnp7BL<@jU
z%Mt+<YM>4$cy=^KA{3<O@*L^E?QIGTpe148DOSklhOHbNOdJuANVb|RJVCwQsu7}1
zd?`p9bje%-SS*g|DM$=FyBp2F)r5<|!Gx1h0MrKupX9{G6!{`X+!UmS(}szqr9r^}
z<PDH@oWkH4-K`*XpyoHoMv$2xwI<>WYA@oLbU|M5s84060G*r*YWci~=JW*>;3hKm
z&OCdBSj?|mO*CO;0i6UCkqt^~pfxygknJY@4az4#1$9OZLx=kvtBDzD3<j4cOUow|
zGdOq@Gj#MNs7x>sW>{n*!?1v-Mu@@vvh`gP85V|=8U`2lJ62OuY8ZUn?^w;PPpM(>
zaKB@<GNlHz>WqT{w6+9P!h2t~ZuGumqv(CvMl+*^LE%yjSL@{|Qr&$G3KAK`3>w$w
zO9*sqX%H~sV3>8OhSSxAgQ3s-rqx7`OooORajZAZZ`n;WzhyP?MKt$TPy}TkwVw#e
zD4;{4vrpKAcBL)IzGGiM6O^OOEx9vZ#7n+4VYUCCQNu6+)G7i6*Nb?uRGtR{vodNJ
zX1HIrPCdT)K!*Dj>yMYFNdLSvM_vuIG|YsRfyYFKfvbJKlE?I^40epA5)PN9iZEQ-
zD*eB0fs%mvH2eRTTjhU%XU`^sRy8Scm~hztcfVuZdwFub^xsP*@{9T!6f`as%OC7Z
zP>=w1^g-jFlUocJOjy7QCmz4!0P-mZNZh=GfyE;e5^bPq(HGIIPeD^qCNlQ-d2NJP
zTJ|eOcoZ{KaIiAPfEHO?ZjlD<R%7E!5t0BkW<YC(L1VI@IySrh0O)WDImpVwa!7*{
z<l`6dVpG8(ATN~*>i2qNKr95MkBk(Cju+7^e?b$FCNlOnd1WAJ1)4@cLo1Ol;$%;P
ziv9M6>hqxV@j_k_e51h&dD*obVoWjM0YDih*Lv`&)ErDME%OzGuFRL&5874(T8Pxk
z5;qmp4!kNa15#6akwy9kPq7e#iLd}eN-=|riLm{D6A}CW8O00=86^xFCc<{$v|}R7
z#n3(3;x9NYq=M1{sQ7`U1@@)jv~b6MCO9pyGDSw1NHHt`rGXdmqF>D|xeuVmzfdkX
zG~{KEg3<t}jxv$pU;te#1`7J@6ZVPbC(J>2T4ZJ)voFlPWG|R~(Oxq9g1zGOH+GD&
z^+)Y1vq4)|K+{XnOu67769>0`8Nf}DSg~I7C>{Y&dxk@n$=$<-siVCiK>)OEzJGzk
z4evu{H$kBQmS<t|GU2uVZ=%XH!GxQ^0ko{ygr7miM1aA_M3C_xXeIG=Urr9tCIQgd
zhu3^LoXlUuNS-y10^hpjJRzX~bj1Im#*GRJ9(R~JntS8tf;4rs*Mm<41X<>N$zIU=
zqW$FVCi{AG#uss{h8)~XQ77-%`*LtIMS#w918r`25zUZldXj+ybk_v$QK1Q-p?cms
zLLK~_LLEFSg&O!g80J9sRWq*Q^wnqpwM#v&GIemR1s&<aSOhw8l!KSai}$J!3;38j
z&;fF+Oi{dtg&bbQ$b|CV5t@-&e}_Tg@*K$zCXx&S;NmGpMm6;ggG%Nd2GFLdsuwXL
zXF=kLcNk1K_(5f%2>6t^#5)WIm*+_Tgidn(Xm4r&9UBk@-b@iAk_yt(-Rq!`c!$A=
zS4Lr4-vI><P8qJLeCvc7JT5bJa8HhC$hgDQQ4dPLpul_)BL+H;*7b$FEGwwZ^+H~*
zHsdT)2Z-ix5fBBX3ed_H@6&cOvrpNBdYGWYZ$PaW(7`v7-Y4uPW*@g#^geFa30mRe
zeax;Av{cLcs2wPASb}Oh(2AEAaZHgWQVannY7~B$NHEj~fRfmYXxWJ%hh(HOSa{#D
zE4;FlqXo22&15r!08f@s16K-{FbC+Q(Fp=`crt}Lcrt`0@MH_k$Vg*Q$Vg|<Xm3z3
z;%^j~(r~3gfxlB=DrkAu3kHT+9ACi`m|Ypg3?3#W3=W_u%&1{-;GZJY!B-*#IvS2C
zX7ZODoqDb|@Yym}UCR}Wyr<Y-?CRL>57O1up&;Zv#r|ej_kMj4A2f6MLSF7HsACNd
z66AYQARFMoGteed3>Ki_q!)1vhM*?T={X9k_*;Y;_*;c$^du+<@V5zdfcvq@JQmuC
z3aSj*%?t`2#!MF`%y(cjk!N569Z27npdiFoC@_Vq)dMux95p#%hSX#sX|ejQ)`Tjr
z68oD?E%E)?jSL2pAAmOy1$DJ3c=06)OyM~oAja1qAlh|xzduO6>#Bm3$5jRcuPF=$
zU0e36gTy$5nH)hY=lK!@CWB6X0{MnRk|`XtpB<bNrI;c-ESYYYNHMTXZYW>?Z7O>q
zFME`OfyveZG`<7U0E#@&;MI#*fm&rJ``^lr`$2c#IlqV%h`l^h8r0a90qt@IO^ui+
z@@9cj)?|U1G6JBbw+YG&N}xq{2{sH0lWk_&F$pZ0Tr;zl{kXlM2|I(r<R3FtB3?wx
z%rucw2ek)WK$Ef@b68~B8ytRsR(FB=i!Y+Zc7i&6$*1im@?;7LfKm}pf=~!gf>1+7
z8t8CO*}o|X3<{^`D9iw_Fk)wlco8iYIJsh$GGp)LIkWowq&m%`v=U!{rbA?yTtL18
zdEfk=AcKh_Pet}g`#=*J28HZn_L-m=4)DQMr|liHPuYXgePs4=`^4;{_J!F;>?^Ym
z+c!=wnXM!x!U<}uwc4wKF5r@EIiUIq#D5VleRcAN*?L-1e@$2z*!mlkIh^n43-&iC
zf$B{TQ2A_rOJDd!w9rX&OP+w!bCz06=9pt%Zwu0VV$PBiVAV}3AX>P;LFI(=Wqr^r
z^s25Jl>^R~_5Dp`7(=>hR8}}&)(<q1VHD`9QCR@;3v^r-yfYfq_XFEx$ur?aEMG3@
zXp9%p0uN1g@tgo9SWwl&0oq^;8hhQrbHYTjo<ZhCEDva(DHq7F3^i^A_sjaBeF+L2
z&ZqQ)O@#RyE|o~Va6hUa3z9cc=GNdT7LvNKS?UE(i4dr-$iP!9B;$QqKk-tD#1Ebl
zA&yHWk|3JvQi;?Lo>U<@lcfx77nVvd;wcg0@wmcZaA~Ua!An!5|MS!ciSSt02#N6&
z3-R%k3bFAd2nq0%2nl6hwzmW=W9(U=&;e>E_c|zo??E%Qu|LRDBLrHa8smLP@8;wu
zi?r(X8BN$296*7{aTL4{&h5f!(76xduIZ;iqYz4<ZD$_v#pdh`46tJ_I8#};LDqm)
zv|l;KnGG5NxR@&a;f1{1UXD9lG9EVE673C&8$e0C)ve(GD2el=3b8mCGbn)e;5pbZ
zC~<LvHsT4}*Mb^-lO^WaGqO&Om}l+?s`!~eV;CkZ3|uedWlK$182Dbu%ch#JFbIIQ
zBABo+2)&S(bp>5u^Fm(M)P#jW?1j9nstF5dJ%X(0<O}oE_;?jT{sQ3_@uIAgS>^{R
z2|vv~Y%kc~U>^%kFAes-;P?ioEbg74lr_0xzH)smM3voD^Bek!CQ=MGAXP8o<s8i|
zxj?H0onJ)rID+OpU&zbN1&yA=at3JJ2-HLauXljlIoAnVnhIL)0J`cEw7TR)yzE*~
z8FA_l_;kPsklCO%$cuQ{MsrJ^7oa&*XHaSZb#6T@nZR?W6F{X53lr#ki;1Ac5uiaD
z6DiOD4&PkRrfracAV+|<)|lU80}obZpS1gF!pXpteZrm*w9-W3NrRBdb6p0|a#T=O
z1r6kYmZgFgVREoCd4N`-WS_OWnO%Rz?qT+6yO-Ig>^_2eS1+PDcXF_T&abp9<T)VF
z@*+k8yoIU1A<4jmo6*6fi-8Ap)29hHV*&>ks3I0M1+^MHW!Mpm<=L4c!3*V|308m{
z`y!fmC1@GTix}~zpy7i4hD1;y6!{`XWN$r4GpIy*5hJ$Nq=$h8-0YBH@-mTPSoI=C
zq}HUDfelhIi=={2rHB!W1@E`y1<gK-xpK%b`Alvw44F7bVHK#80%?jc+~UmA096*J
zK($QrQM<|)ablXFP%x2TbTYqbCHNvv<f8d4yL!R)289J+ff&)XCbJm$+8Y!SK<iCF
z$CQFjB6<<anF?A+)!&eyVIskJ1FSYqBobs;dxO#m5FezzXMvK1_aV!hFXUx=IXIbI
zU&L~OR-Xx;sIdnf`R@ek8JXX*YjntA$S{!+0QZi}Z`NB0g8FMFvf$2$LPjlvhWi~W
z!OLAzKd#2`N_f;TB=FA>;C>Oyvh|{u)Nk+|FVS3}0c)3DFU12&1$vAiY*x$zTJ<%P
zgNG>`)OZ68YQqv6Xqn=Rc!`zfmb?<ZUJ9Ud&Rsy}I#e)Z@Yl~0kbDs@D(F3nL4!kv
z$qOc7QqI7_50(@A36=vLCk*Nn#!In+Di`<5)~!7Y6u^gcU8<4#aeXqcgi;;oTn@WK
zpd7B0#J~Vrb!1k|(9}KIIu{fopwRI?Yj@N8jNL=;({?YtPuYE(EU`wZ-iq;syqv39
zF)zo9SPt-j>WLa#S<u=sP@uVAwi1PPCt+5(U$&A3bt{qhnxNh#j1THzx?i@Ah4D><
zIY4ViSSEmPzG7VEebaiO_buy{FJky(IqDgh96${k&>@?kF2?1_TwRw+pxw_JNcXcd
zq(Q)hn_<@F$(&v$+zfr7a010V{~Q4xP^`X)Wwdq3WypX;5W66_>v77ylY^HDH1!OM
zn27At_Kl$24~iH_q=<T&Tk<B<gA{`d1jh(C&;@sb108FG2rmT7!6O8+Z0m)*%u-OK
zyoljj>3z!@6r!M$a>1v%gN`cjJ`O%{Q4ur+Vj>0Jumftmf(9T1L9JKN9l(+=Vp(ND
zr`ep2QCI<*v*LFXlJc-&)&Sic$sZ#m14^nH#>^Tm2?`wiu0j$#2?8<MF$@aX&I}s-
zE<z3b?m`{>4nh+qZ?F+%mlsR*KW@(mI<5dbCjvgG_!xL%20YXWatUamgtHri&Wjk)
zgZvHxpbgV57w&-919g~4Fvyrlf|jK+fR5gY0$t?*8n$^6%K*M;w`G9>c;i5Sg9503
z6oG3b(?o{7{)GuE^8@ghDJxSrsI>+<Jq47Gk1sm_8UX;!nHao?l?NXgVIs+30kKH_
zAV^Ki0()PO;q49fwxALL$sDE^(1VRZXR(9Sn8>ib08N9NurfUW71E&13+8vM>_Iz8
z5;;KEkQ}qm1eM63#*zsu_#_>0gULjgL5jaYNNHVd{96#s-yp;Qnl_!>vp})_fW2Y%
z9eYLdJNAy*ckC@q7BetiN#;lfwI0(!+gW0nK<kg9`WqAiK+OOX7W@C8>;FIw@;+{#
z=zYvS)BC7>q4yE{N^j7ys1BeTmF*eR57_%c>P(iU>4)tDPt4ih>U|h|<iMQEbEKO)
z_Us33_i*LlsNp)=kZK=0*<zs#=;VU1$q@?`Se)<J&YxVdPyuuTs2gZB3gjpAqjr&#
zS1eSJNseKNdJ!eP6f`&ky4)4i6$5R;dJ!dEJNd;z-T0$+J72^zO-;XJxADZBg`f$X
z7|@y1<~Qv?l{xc^C}~;q6Lz4Pdl0+S{G`3Ai3Ed^`As{+7g17ALEY;YQPQp;+C+kZ
z%lxKY;EO1!t)StN7g5rplM5DkiW`7#R^^E_x8&Ucp0kkw?M~%WoqS<YkQ@W}th3W|
z_WOhKAIy26L5~+v5=ST7ELM~TJ5l~)`Wd^8r{^r%1e$I!5oTfNo@{SAxni-Vwt*fa
z*lJ6rju%m4f6Z^%Gxs+rZUD8&&Cl9B26>kQR8K{TFP(g5v7tEVPU^EDZ_BL&c^foA
z0a80zWQk(^6}#d|;L?d<5olVnFF|2~M=65_hX@lWS46&kBK!bUnR19SMRCY71#`$U
zMZSI_2;RUw8FKZu5vW82%L_9_zJ4m#l2XFpky6VL0I~ygimLf_d*<vD_A_CH(2IDE
zN^?tI(8===ph76}MZEM*P>O#cFCz;|KriHFK)qmaZva$?fQD8%q?kab)PZh60PW%6
z1YO(oB39xiXmtBTjp8JaHiiU`b_UQvEZ}<_9a<O)UPOt453Vthv1bGo>7YPXZeZZZ
zs9~@G)igW@1Oj6&?2!JEkit*^>eGOFy%}i?2??nTMK9u6HfE$VWH{6?6giYL6u?~X
zQNfU4ZpkO{BA)FdC`&q2Fcg7e(xH-};6*%B=j1udq?p8eCkJdbtv}8PT9XAon+4np
zKV}bgyVy+=DTW5H+m|sUcq~V9`%;kGg<)=I2D=?Jk<!7y0CGDhP4OHMh)GCcC;~YP
zG?)c)I;ey<x8$>cdZEAo<o*}&te|spW`aBnc4q}c5!9`j9#sqpAooM~3?R2lGxkp2
zu+&V9vmyJW-9rvZCQlPdhJx&)_Kctyn7rkpV*Lrbm)XbdK4u@Y`<Z<N>>I%sv67l5
zQcMgdYLqxkBsc^>Wu5sgvxzUF1df^?F`Ec#G=julL<xX*5htWDgn>phK|V7PWncr9
z@SvW9i7<l_s5zBT%3xq3%D}`^Bg6+98#EDN;BeW+ppsC-pa2>)i2%*dCe$!!B-Aiy
zC6qE4U6?BIBcX=DB%y}EETM)WBB6#M3Un7*LMcPQg{hK1K-Wcr?nFx{W>5m1o}5t1
z5OiUx6i8eMbX!M434=~TF@s)0DMLs?2}4XmF+&`v|MMb7D3vE!NbJO&1qt4V%pw&7
z^mG|bxWS|QJ|?{OtR{R+3?}>x1*Tqn5hel*3%u``P2_F^pZ(hf(lFWMwrxGQ;4^FF
znIRz4-k=!8GeLlzXOaNNi&(*hpoZv)8bt$8^NE9pDe^@W?^jS>;K>zY0L{FC;+2Ds
zDH3!Lh07iWm4tMLl9U>Tf`kl)GSIml8JP?jpvx^XY8Vp0QOv;<0h$1R5hq&<DqKJr
zuO7T!jg=_^+;onUKg%J&6a}76kYNghD3%6~S%DOT)ygnMa0r45ErDE+V<0Q9WUqqO
zT!N|>{F#y;bn2zci5kTwXr`=3%auIfJ+>w?_MD*j2jxmoY6iI;lo3H05+gIlNk0W8
zW*nJu#)~*PRgBCSC%G4#z>6m@S|-B8w|DY}r3T<DdO%(<vEfYsEtfD6RseNfKqvc1
zYG>;IH&Nu`0F^DEDUs|;b}O?l+HK6fV7D{-yxqa<b9N`Q&)QwgK4W(?`?TG|>{E6x
zvrpQ61Wf^f&SC<UQ`wD-4_-v^&rP4q_yRNyongZZzV6dQg=qo@BU8P5OM`-kNwfV=
z?fU!wO;k8JS}GN0a4>@oVPWe8byIjU1e#yS%bx|UW;2mte_<jHX+nV7C7_^s5zh{q
zLWu%Z`6l8_;O2#i1Ouok!So`YT@+*ns7GufW8diUlxaeO4PTteQv07Kd`vtO7SyZ%
ze8Ir@=tY#=R7D0Rh8IzCttMOy3?7e}CV(t7<zP@T;bu?(UHWOlW6!9#fPn*anX}>t
zJ;t6&^(v4$g-c8<;8Qh|?SGmaV{kO#gq*1W$`vL&_RNYa7(nML_(Ak&M0h-5nxGia
zlwi_g|I;Lxk71vw7Xy<CKZBNufI>jeOicw7Mg@oiI20H_j({4N&{L^912m8AeaUX6
z_eHyn-WTk4dY`vD=zY%ar1x37i{5AKZhD`#dpKESf?B;Dqstx!jqX0>Uk-a1bS5__
zfQ}-4^dgoo5mbHkHzc1hk!0|A5z7i*5y>HA<otqxdC`kl&X1rYdQQwy?f^9uc@_vn
z@w5sxfL1HNh?ZW;(=0Rrl#4*eyS#{HuQcIeSimzuU>4{A%oou@dpX#cJV1Po$tTzF
za7T;Qns9S4yoeU6o%~>pB!9G!s|hcI0qBlJ69ERL$t-J?>N$6Ux}7I#loUV{XQ08e
z7f~$W9G{WK&;Yvj#6*gN;YBPjV@3)?LPiZk1_vmUg04u3<+%weV>4<P3OHoIt8*h?
z#PVzeiA{1)V3=fV06t5kFF`RQqlTfPy+ILl6-xxv4qXmGrYMejP9~TDuSXR_0cfrY
zqJa6WM-@YbM>#_VxMTp${Kd*tf>M)5IYR;X9v6sMAV>^!cVv4*f(Hi&c)=bAcp@iO
zMiL|k6_bF7Nq+>1fimKYShlP69+jX86EX1J+@OKY7YqzeV6j-XxgbTLqNd}#ZS9mh
z40b##1X^FnOFji9-xslLhM<r;Wn(`V9CDy66VJI5<SQ>r&`vovSuZPw1W*XRh-GaA
zg<_TsLk6g#0EN(tSk}nwJ9hO8vuwb@=M0i~5zA@_lFYJUsPMjSw{X$}1%?U91`Obi
zb%Nb{kYm~#?5=`B1Y(I)B*+pkb4Z9l#SB4W9K1{sV16{;S{R>8hAA8@7AyG@B<5vP
z&(Psz!7u~lYS2k<UX~0KKn)3yMK9##_+P|}CPLV<-#uy=6uLVUB_KXx^aK^eC*~;p
z0MRdE8GnKXRZM1rwqElDf?A)T!W}d^@FI#K78I??XY2&QJ*BgDo*?n;J9dtq^*{M`
zWFNLGOg?JYn0(Hz`9(aVZ}t(p%Jzl?BT%9T6};v*?F3)MbD4r1(sRN7E=UY?d0x*t
zds~ntkP=GV6qHxNj%-u70SQe8@WBcv<|yodIFex_)R7V|Vz@a$(FYoMfhItCL6ED^
zT?ulS=TE)^APYe*20Iq)Q2C!AhxTl+uLaeW5J!kj1v$cH4ub-BBY4#}7xx6v01T6t
z%Nzz36JdrQ&6ArvOc*(on){j<%qQDBdS6SBu?H=$ZA(x9HB$_@`#~BQU%iNynhQFD
z5Y+dZ+%SO+bg=M?7&%aHHtNJ4#TB4b{31qPbh5`r#rhcDqoB|-*$mzd?VNqtZl=j*
z27~O&b`!58$gps*G5IJiU}IEL;9yj8;9=m%0XyzhL#`6|>{5<gPy>OHtD#8IK)Hd5
zv7tuMz*NTGTN!l9cNCMad6dXO4jCqI(3m@C4S3Am0W=8Ms-VE(eamhpkM}LRiO}`2
zK9j#})RGZ#1r@K?8)WRe8}0A&bO?aXQ@INALqp+Yt4%)jvVovz1Wkp4EHPyRuRS)n
za7_9`!<~i;$_)$}Q!X>una^S1Vl0+$I3ROi1!zH;i4+6hix`=kR}RS7w;WIqP|RRp
zcp)!))r5_K&xDOZ!!%pu;ENcptDrIxG%DHNU^^cq2evCpzR@(>{(o<R{Z{Z`2Y7fD
zq;V$$XbR2{Y`DCvEl9(Qcn)x_1~MGvdeGta-5p9@F2xKgW;OPa*BfNwK?6IWd3#V=
z;{uPfF?qd+kpef9Ps~vQoemoHB1Y=yg;r_MAwH2WVx%*b9XJ?FW-??ryoiwwG?9WF
z#%j{ekN|G>#7Jv`Z@L0qCmka#s2tz{UTF<Zv}&9ZJj)osyG>ujNZp)#X0v2{498uQ
zr3@?`%k04;iV!oTDnZN0K*OnEeKQ$4OsqIPOn4X?Uc^W_a<DS_ny}k*a<DS_DHiB4
zf(8{q>HbBO_(M>kntU9ROFb+3PJqPWX&#<IC2oS!Jt%|LgVG!*XrVcDDV7}S3bFu_
zIrx`?G6%S^Bg5kW+NcGZHv?@!<zQlp1kVk}@duhm@e4rNmgZ6X4*&nYy6{3?{yRt?
zXc!^;qP?PtAVWm<1^ar<?6dZciVGY-8;m^_8~7cwPumBYaN8dQUltD9fpP*o%mBKC
zqYymoaLHaW`@Fqj_BrrPr=TO!D?t~=z;@{I8wgA`E3iM<#H~^R8aCj0AkfV7LZF3D
zK%kXRLZGc@fr5Y+7lQ-GS<qBsJwue@1OD44d<+bxpV$~)L^J7f2r)%L5}s0$={W|b
z-V^pmP2Yp=2$SOlRs0-B*km~tv&-=O5o+N1E7ZZqAkfCgAuzMwUTFo-0f8uoD-1^0
zr*I^5&0&%85@E35l;OGqz4br_bpI89i%<ujfWRC+34yuX^?R5?+8UI0Tn>`{uzfH4
ze-0T|8SW))Y~0Q4tX?t<7NC1$F3gbn0UF795zUqhavZ262Jgj)W)TJPFWdmjTfK;8
z13MlnpYkG_`6@^rY)+Gc#f2H*X=#TS(acLh;umg6eyBH*WN>*A&D;tS04r=!TmV(*
z@gkZz6eJE(Xd=nr^CFtr6vPKD4mFWv2zU`K`WDOw^#ed{dj>`c5Fa#h1ER02<F@2%
z<zjsi%~T4?`k-9)BAO}I^cS0g=`S_`jsq<9lGp9!t6xMjnR2i)xquZ3F-5(IW)i(_
zFC!0{o&l}m1kEz`E7VQ}1%JDa!VE7V1_N_T297H`Ih;V_SRj2bqD8KP77(;KC@6p(
zxRZec6df<3MZkN*y<`|1yo4D%KvTw`1LpWA3w6AZ=aAlN8eo6W;m+i$9n$re>?OS~
z+ADfru-EiHZ*S;*&fe1dti7Z68GBFf)AoVhr|cu)*Sa6ab)~yKBPip7(z>z(10$$I
zkbT&m(?glzNA@MViP;zJW@cZoTbO;`Ze{j4yN%gr?RI9Lu{)T3+U{h1_9?rI*(dF8
zW}mQon0?&tW%e<<kJ(4TePYHJF+zsmMtuwe_)IdT1O~?L$=bg_84a{R2DJL;MGOls
zXkkY30XsnsSte&trUsQHFQR$xUPzYy(UPDbWx~w(&-s>}V7IfP259Tpi#Q%zP`GL*
zG1N0SnDBy^5_2#z1%rIS!N?Q?qWc;Y88{f30zmr$l@9PZW|cApWR)>RfHoE@HSmAT
zp3LNsJ%z~wbpM31!ukIupyQll1TLCeGB}ukMloUpc7hJV1znf*B1T~0^>_&-(DFF2
zc}E!-vai}DW?!qf%Y4DWu)%u{{|=DLLEErjMDye(-?9?~%~^q54c2gguMyP&d=p^~
z0G(=(VZ+n`c32|=L-u96#Oy0}nIOx&=kRX;dB*#yU846jyUYw5CIt}RONOZfv`rzS
z-jvB8!;Hz|${dbl?iLo7D=i$!FJc6bg6ioLHJYH4nn1S&GQ5c5`3Y)`fHZS3GWmfz
zVxYRRXQpC-i7*d`7Z+0pXlnUN7e_J&CzC&?3kwTJ3fGZ|4gm}=7+9TNMDc*ffng4T
z4%vs)gT^dOWEB{>?y|{p?O~VUo(!tg8Kk%;gBlbJi@3Ld$}EOS;PDGt1@N+5o?4-f
z7g4;uAP2QK=v@GfDw<R=C}bb7b9@oS)0%z2PSK=_!Qn*|PcA4_UqnIfjf3o>=KjUN
z$d~XUUIdf|>K$C>Flcm7R#0-7%wTkVGDkA_Oph9_JJ~G^37}K`O!z^QAyO}{)o>(p
zPiB$f0Lk643k2yi5#izJo}!>&`p5onds~B$>3h(gMfs~Bxz;yI6(+0<38qgOIIb+^
zaN=nYaD!x8c2Q96)B8p#12l!`Z6aa72$BE^zKG@(HQ_N}G~s1n0tF{X{6#d|R*)R1
zy#|`)fr#-O1&OsPC{=K9f^O(w0CgUsAaZP>oLx*jCKBM)MD7qV9?&gcFnO>8Km&^$
z^)gHzPz9<W1G7)q6=t8YtMtBXSLl7ku9B;Pg@Y@Bm7SBFDFzaJ467zWj(XMVd7z*G
zx=nyn1{`HvChQChiX04}y%U8T{7ezvx9kG5&)QdJAGdD=t>nu-Za)z;Hu55l3)H`k
zY;RDhs0VdTCn_i~fPxN$d*8%{gM#mcytFH*3F9yavPcMYXM_nWLjh=(85ESD>Z-p%
zA?aeS^n4Rh1|HD*D6Z8^oF+W>4<~9GaDXOM!65)@l|*ypf;<OmI)OZE!pp#5!ejsQ
zg}i+IRt{b!PtGnTt{3uhrkoBe93FERK({tXfT|QzFVG1sQne;6_7nLV1l%s%k$Q1e
zh9jA~gN1`5gX@H+3_}8>rE37X<I>|rwCqBVMIihlngMhPh&P7}lY47|vIWRoQ_y9w
z(Nd254FXXnA`DWOC)dlTT%IHKpKCIc@T6h`4$y)2+>@DPz-=HN1%~W9c7>p}Ps;+O
zAE3jqTb3w&Fp**K0G$Hzf`PfnM38~OM2Lam+ER`dj;UOt*;nlvUqrF41q~#7U$tul
zWwQ=p1qBXSrjX9L4H6)64qm2U4j!fu5Iej6vR&tkDAwNWD|U_Em+e4vlVRRh>>9bZ
zfi@;8IDnP_dSA6GoCJw;rHKikRXQv}JquL0Kv|N5pDC8h1|0uVTsELA%lwHe7L;X~
zA3=`<w%QiU{+~mTRR(q`2Ui1&7*_(TDAyh)!FsN{OhPS7ls9<vFn~9)ddy@<0L5GO
z9s9y;(4xG{_Kn$B>^rkB+E2{B1X=^hx)d~P(BGgK0P5X<(vSBgyNTWx?Phvkuv_ST
z-fpG$IlGPCXYF=+pRqgWecJA%_bI!J-X}qK+u1$zK5qBY`<UHF@1u4<y^q+}GkPDk
z=Y%ZWwqpdvIcR&=i)blHP#jI313G*Sl&58$f}=!+!GaHTR<sOLWcFpdPSD+`FQP>y
zv+vk7dV??|1S4NWODKZW^*7jnmk@v)%E8Ix+q29jSFwSC<%PU-C@5{UEUH&%F!{-#
z(6U5ffyqw>4U?Y?0xzQF9)c23_8q%Ulb;L{FQVlRg80zr3GAP5qsk%76x3I5BMXZ6
z7xL2IUqs7Qg4DFnw+3A(6ZAq}`YtGKyoi?b1c^h<GI$X!rwQdZn*3z2cu^lM#|aVu
z#W`q*1Y}8Dy@CaY2vZQ(9449m`3j)Z8$kxza&R&Q_SIX<f~rogK#-g@)B#f8IfR*F
zI7FCYU&u>8-!_f?KZh`@D6B|-Aul7(3rg{l3?86Rdl4<G2upAEC-*F<09g(iR{|+g
z=HUPTBAQv&T*Ce#NbE(l%t??qC~7!ln0!I(7tu_2L2@8{AO~MuEB&W;ku_-MKE`7X
zLxA}l`-3K8_6NJCDS-AUGrf?Pjs>MF@2Lz1Z40dJL7Sza2j12@yoi#YX@1Mj5Y%k|
zPaH<cS8~WQxxI*z2dz1PiF>|?lIP@*W%7bGJV5!HLzc+{)EIdYBdlm1#SfaDj|4B4
z02Me4Ob(!-OHdXBWj_xa?g9^6?h4R=yoneC1NSyIS?;L{pnGYc*{24SeHf&;=7O>h
z0~aJnCr>+QsvgQA%M`|Of=!lVIlIiY12Rmoc60VsJHza2c9sysCVx7pT@St*m@PH?
zj-4d9?u%ywU%Usp%L$Z(K{bEJ9!K!nU(dr#6TkzgpfN}`hAI<wh6)o^))OWiOl&5c
z3>=^{UQM_eYI-UaBS6DYAoV7!Y>?qaHU<t8c7_@g4hDe<383*%CZ-ork|*m;q}Uiv
z)L7`6NHBnU|De6xQQ+l3F;Xi{SQ%<e*cjMM*cmu@DnO?on}d!^j{p_QFJh!J!N;Y8
zwhOR>7N<ygg7~0_0;zow&jQ}aYBG~S;YB<Pcml*^CIhHP9|g)^FXCBhO<EZ03qaRj
zfqco6AmH*MTA&crlsRn!+5HP@F?g6UDZmbe2lYKK&yfD{BAN$0zy@h;ii5XSbAaXm
zKqH1Rl9nJd9BRNd5$L!J3Gmn%=z``LNk)(yq^l^q)+AZX{-;X~gGP6&f&nPVz&?oP
zJvsToVR6o0P*3tjG{5GgBNCw5gvb~2qH{q77^vk8I@B1{yY#T(<pAAI3F>7+D>(zu
z(nD}Mixr$|9>ss)MLgqMP%Z?CL&`45Z5bf_r=u1)n20lfQ5FPmRaG&U;GUrzV8{3(
zR#4VF3e=}#1Z{1tckqs3h-hz6&~l%{pfP!l5$MQOCS(KoJp|@}&cMDrNBYm?IR+e{
z8KoEU@_RvQKn_M&#=?SRSq8*10au7+4B*|%P`jK!c9{tCF<ft${Okx{J;*4S`_Zfu
z!DF2kl64jk>-a+<*2%8~hYO0=OmKP4Q3mQa49h@03-FOAhwW!(AGPlUZO8X!WpC)%
zq2O@YSspxkD8j(VI9Whiq8@Zt+ly!}Qxhq62k6b$pgT<p!7gcGNC2%{F<BzO&{Luy
zVbaFH1-fd;M2bNQ#5Q4NH~=c{KxHuK#NzH&dr*#uyig_m0~9(a7tBdBfNz}!nG33W
zL6P7+nSC<*F$F^j(2~~|vMeV-l3=zxwCm2m<N#6#THy+EImi*9TrfG}m<{BdqvMc+
z4?$;Bf)<g1rdL6O`JfeNpp|AXA|?KMH*+|E(kH0Q1MMq=v;-NoUPQ@34v?+^r8y1}
zM7(f4fW!-TEF@l}!Dm!^B{L*|3L%pW2Cjx>3v4q$TOVFTGk|Yz03~+NC6pl7y@+NA
z1!ZcUIYJDeHR+%sJjijz@x35Dpiz#=3Tq@LCup!T%ggIdE;ueL4Nl}-s^(D)6%fn0
zc+I02HoS<J;GMkUxLmye1NdB!b9Nt1_!tjlpSAmG!poqLea4>Agohz3`?Ni$2{*&C
z>{IrFCR_|X*(dEKO*k1svQOA6ns6{!WgoZKRCvPwJNp>;##hkV8_<GqSJ2id(5<}L
zN9-N557@or`5`a|<Q34)Q1A?rGH;gm9lMv@%59)E_3X1i9MCx--skK-dY`rX>3znY
z(fhPLr}rs)!N~%ZN<wyxJTC-5w>vR_D!mtx{BtKSI3ZHc(Pz;D+HwL44~`j3E}$jc
z2`P*wmxZPOfvya^Fh}}lcZY(&Wns`!wRYf<0}ctM;A;soatXzZCe2+<GeBk4bq5*A
z=AI@GP+zmTLs`N^m?5NjveFI{Nd}e+E%HBl8tP<0w_llvFs!>&Ed8UYWbR+>M1^_=
z6Ilip6GdJP?j20B?F$qVIBd8MPM&OF0cy1NB`7GE2s2nro@|f>;<rKh-IG-^Kz&9K
zHc{l2a42EWb0}soxHg5819Vp<7wB5z%}k<g3skgtbOb`$7pOcipKM<YvUpO$1c?_6
zEQi__sI0iwP%k54K8Ile=+L;!Q=~sQ6f<&wm#5Y+a)Az!b0}r7a42Rlxwe%PB3{N|
z=1|MX!&Sx<c6~1=heI)gl|wxvAJ=B4VD9})@n)qAESI)Qf8hQ)qk%(|DW>U;4fymW
zz7in^(2>>&H4IiS<YjmhiWw}-C)-bLO3$5p9uz!E6YLnxrZ8&oO;(uls^I`rbGK4}
zi7>;8=E>GuLGmx;W$R7E89*D#7(i!#y@=!k9{}}2Ub>vyf=RsZfpscqSI-N1`QxA+
z;9NhzVzyARxs&IdlIBeXl_^jW-^oW#DVfT%nn<z;T$Ygj-_KxGYa-6z0NO65tjGW=
z+*r70FiEsCC~N>7=LB*@OGA~Zi6p~h`O}j1pb34m8t@HXA1+UkdI9noXe~!V3Fy>D
zh7iyiAHGT<hZm7tstGj=uU^PYP6r+11G-t|_>J4)AoE_xOXh>3%|wJj0@PRODzR1t
ziT5;Af^PLvNvL6XV<N+l@giP)Z9)yhyBG4(b4?U^IgW2WP%m()Ui#k)dFj188Ui85
zgAXY1C<ug@PqQz+bWQrlqyr5SFBllKjvF6vFq>>|Zz9HE1d4mEGDxGS|A961s#|GW
z9u<L*{s-3jAo_*8wEPQs>C|iUW%jl;Sb(GMg}k&cC|SIS<O0`@4y6nx4#kuG&d6|C
zKu$c1<m#PVa>l$~!bFtuUsq|vscQ)`5};`ehf+ok^EnJGpw#0~!pH?0B<I?~6yi|E
z$m3AT$an1;CkNM6rckauGeC_z(BcNOOLM?sX>zGX`bT?%*<EnSd&ll2sN4dLt?+CX
zlFz<l_wt3jSU>1UTn-T?@Pa<`d-dQ2Euf)Y(89e+P>Bm#b`RPapM3#5)T@|%&K@*O
zY?yt<-ZC4uRR5%XVD<@n$a4K-_L)2>3^Jgr%=;4TpM&;xcceN9a4g{x=3r%V2A#zR
z%Iq&<<q|>D%%IZSgpGlTgOSNoQQw9Cw+TA~XicPp2@k_R6J7=_6FvqzM;l)7zH3h@
z4u@_p1<=x>$QSV<qLUlWN~=b7EKYRbSi;51k;26cI&cZJ#t2jndtb1Z^geH|=zY#!
zbMl=<M)mfLFQWLtwcqI&1qTyxjsq{^dBEp4fk(|j^Plko-~-NI$jcoE$s_6wjsQr}
zEmH`oH+aAm8tAHLo&`b-lN}5MUNA6lar=Oq%26!|cKo1F1MQZ45zp@mzFDz8o*%rb
z87c_wuDp<!Jqq$&x35Bm2|t5?i2#E`PlAFFPc!I1DcM%AA^c2HFXH+3f(?o1TMJs=
z@gkmYE@;ij3winZ9gAb_!Djfy>Vs&G6v(}<FXZKQLBS2GWkC&o0}m@+2~c(0AFuEN
zd}s)`Vv@RO9>uu9Bbis?MYIqnsFDNM4vM^4lQ+0q)W3ctQv*st$_)n?%;zwyn~<Om
zy3foDG>HH{jPnUA==gRAQ1F13kG+VMJZT=q_~3=S+*gpH&3oog1<AdLm7HlF#pLiJ
zo*#VWEyzre%RrM5AlG@=a9_wiVxO6P*uJoNmV?0cSsckP;^peW!30uZqR4%NzmZ{1
zdz+#HhZWbY_BMwM6JbUM&;ZN}28O2g7KIZai%cXKLcoiWA{juZA%HePgAdaIB?)Mo
zj<I>N;tH@@Va5mDlkMk%^t_Olmj{Wxh?Vd(k79}d*9=ni3=AHYOfO!<O3Vbg7<7*(
zSaGZbqj?k)XjK6dsO<?FQ04a!XoeUde$qUO>A;IPu1rvHo~Tg(uMq*Y;i2-K=21+b
zjSg!;W<hq4*i8qqQFf3-OY17wPq1Tr5h=USWEOJ-WD5xkXtz)}=s*#Z8O)$DP^lNu
zlA$1tFXZKTL594D6+3Aj#a!`1UiR(e9~Tt4qxnIHObDKsv*6Wam5XjpY=tJ03{Ota
z+26{sn2EV1!M+@nXCQ79ooOD$yy8V9Q>cj)|AH6s+@er_>w-o^Au-0xFnPm8CqDU~
zASrMTR^&~XbV-M)d&*?JOAE9F7_t)BLF-{$Ossgb(h}Hbm`E^zE{$b)5h;~u(!!es
zNn-qMlfPUtVv>9~S>v)&JwJHC-HTXeu(2;9r2|36gU$<i5zT4|8ap?UWZd#1npF|X
zUh^WFmD5CuvB5-=am9;h7SLJ`h8OW1o?w0OO_FwuFQR#M&7)W#P4Z}-Q1d7jaBl$I
zt&Zj~HIHIh&{DrZjRQ2fF}dA<0d%=bdxPpLj~$Gl?uA{qj4J5z@F<UMi~{C2Z3SW7
zG>=q94);5@wj6sv`JT1wMYQx>&}8X}JF1`+hmoLN79M4c;GI)2J=w=>9YNi@7m=b@
z&2QNX_BSX9fcAe)cDW*A(y~C|g!@TbTX0-Nig}txvD{D&v||K0>_w!Qrg;=IxFF(g
z=3)k)!W1dSIC;Vqv3kD@?oKY@^vkxk?w4&9xk^?vq~EbsbiZTk2`ci_@7Q{}-?Fte
zkzv`u9Rupd^GUskmSP13RC|Lm_#lXu1xgOtcWfO&YlO|a7z|8g7z{vdVxAfyCPe`|
zM$q0HQz@1kFCs;L@}vr}nYS}A^*nMg;9zA6=BVdliUN(>no6?Vco8eh%JGVe3)I}=
z5N2}aDHh^T6a*z>kxo-7<^ZTh3s6@9v}gdLk2&B)tjttU9R<>RVUILu@gA3njQvH>
z@GVb`5RYPk9iwR#%ZnG0!asS^h4{=n7?^sQ91K8a=zu!Krj;x&Uc}1qf(+s0;^Mln
zT>1x3x{!cL6@v)q=o+2`A)yzMA`>T{xvEod>de3dnt$YV5MtnU6=E`VW?%s|YdJvG
zK&&)m4I5~oc(mA2P&7Fovz2zfY%9q<nMK&-sQts_%eIo>;elweR`Xl7hR&C5twD0h
zmu;;<#g&H*cSnDN!VPdi+jaVd_hnl_^Eqn!x@r_QfDY7Aco8io3NpCAL1BWjfgN<s
zFDt`~NFmTk5Qd-|dLb5wf*fE7-GgHFB3jHB)GIqxqX61l6#+_*FJdLHatJd;Wz=wY
zyohGx1f9kWI&N`tLjuDK1}>o&(F~viz8FCJ4PQhvoCJ;UgVx(}yohGl2ufR^!Jx}?
zq$@zzQd}yQ{=-$n6?}a%M+;XCi|~aSi1>wM=|3DbT+SEvK=>TRT+J7jO8>d;%+bQJ
zhs%|tibV<>r@OdjfexH~{fO@jD1mYB<(kDE1;N*&IFesKk-xzq%)sQJtkA#&8kI7)
zWK4Mdi2KRphU<#;QSz|~a~Ph0N?&EKV;%`MTq|Bg@@+Mbf*g-|dd`XspuNq?P8?b<
zBKca)qu5qJ`nJ5FBN(71zknwwWR(r=7(p4y+!B<yIA)qhu{wAh<pven44_>4B9c$k
zgpEND6aXy=iibewNY?i^8C?LC)I3Q7GTm*Hc7T>!gM4Ko%K#en7R<hD2O3sY%)V=<
zX%1RS6UjHxq>4eHy+P55XN`a`PmzEK$WopX0g1Mh1_g&22ED!%Lo1$j0>YCL8n|9C
z2r7Xt<l-q4kOVEezcgL?heHj6PWByp$IBAZlk;yxXR(2tS^yo;16OJ<qM2OHqu9XL
zK65ZK`DEDgT7ZJcLxX98DTn>fi435TE`dugB4t2>C=M^;m>`Y&Xy&P)(h}sw7tzeM
zmuErtjXF$bPy&ffHn=HTpDg_Wyj8TBK`CJlg94~PcL2Az6eJ*nJHp^b5{M0T6Vr=m
zMpn>qQm6MSRDe?Z<OK>WFBq8Ky@+Jf1;u%PgVGhS`)rslv^Oa20}UEM5-`&;Q0Tmf
zW!Y#R#ReXTG;y%u-qGG<Ap$a}y~QHMM24wH*^m!(jW36}C4<3>XbxY6je3lr#*hhU
zcyB59i^*?pO4diS<$~ImJq7lAO~e^EKzn{)L^7nBR55s*ws8P&S~MwVfSh9$%kOI<
z#rOd1C{?BlCLH!RL2Q$y_BTz`cq&Xd8JWQRQ}&D|>O4P8xEcSMoUw1@SOF^8rOrTF
z6pXAUQVgKu>lj`{GQ4#GWhaoM9c*|(+n+ap*e{}mz)hC^hJ*<aJ}>Buj|9*)qF@Uo
z7!op+xuLZo7w6;yx76Yk7(j<RWT<d6C~Gh<yolzhRgO5o0IDP%jQKl2#Y%!Pe+Njr
zhcZ(_PeOtRXssw{r^bsYSwT=E!$epmuX(Zp=tQecCX$Q_FQNp&i|{}P*i3f0?Nl!|
z#r&Qv;|qDgqo6|lMKm|`YIDKsCQ=M?FCuwwny@l}P9kxB5hb=3ls!NNNP9ymc*Y)d
zBnU?__(+hwp!j_uFIvvuAt21(B_MLGm|No76fOa-5~dLT9?)^>oE)I;Gk>3e2v-SH
zu!#u6w66M+Y2QJ4)_Dp;gY#sDrfXBUC9V~734jzjPhn^Q^}C&?GE4#);yjsQ0?1J3
znG9{$wsHw@l`@4oPiC0nJd0r(sA~=CDs#<bihL0%`;)7RDXPE0%ob!eD11y*854MR
z2uy?3wxB3zZ%}cl2X!z&9S%+oF6S%B94#EFT+AM23>t8Si3$uJWelKWcij^-7$acf
ziJ-*UU^*9+Tfi2`Ffg?wDZfatVVc#GVp<Ana4D4>U@|M_1kG?uW?!~bRGQPkU^YcL
zG5fNuq*4XwJYlK&hV09>ib^RUjuuEl)8R8?1XnRv@U>!&7EnRLmCD7MeZ@|YXM?~r
zQ0bL@1<}sPK43o+l=V2o!ABNFyolueYa+?iaXMxxsF(oVJOaMn`9&n}SrbX7w$m|7
z9hB#s{|~AA?F3C^>KSy>@7PJ2ure~3$S{3LzhkFpe%;O!v`Rnyj-96Y4O>CbxuNN|
z>_kD1Nxx+$n|{kqHT{;IZu%`d!}MErrs;R=EVGZ=dA^9`Set#zerA7zN`?DjTT$;j
zwvv~dIUhHqwnSW?!zBP}fN)O+P0NA~DrPb2scX?NsZX|lJRzZh=LG|c(2Hocub?yw
zikl1@?iK9~%AhNpK!-6!yolw>HNR=A50+Er-tZzuA`_h87?>wHPhs$Jp3LBfmUaT5
zX(x`Wgek;%GD8eB?F1pEorHSlSqw?2iAS;%lz7@3tmlH_^@Y6PQ&3!bY-6Z^#r^3y
z3xq)N|3Y36+){rbFWn02?0`yCP?T^mgO|s$yols_Y9h&KbUJ2Hgdzh6Xp0pnx&%OH
zioJ;BT5BrFP%qNnpl|}@s~6G2fuQ*9Z&29be8*N9RR25Qu~l@wY^%yu!{iKF9MY4Z
z&;S}r0T}>l^_xmEh`fm80^hC%;+u#wfDMO;bG`+ICg|=R6LAI`kR6~g>I@t11t2~+
zY9;HLv|dEA*Me?_>2FXJFcD`kF~4CaXd=nv@FJ4k7bJe7X2ApGM9G!PC2W4vPM5C$
zoFH{!p#nP74&-ytihS_u9!Z7;FCsa>#m%Wd3nG*iI2f|8L+%?lw`33lr5BTWDF(LF
za}+$xZ`dkMo}*9&av@~2mI2g%0XOwu$n$}t0Hg*qKnS|Thc7{B#rlcyZ$UH&o5(O|
zfY$G3-?5d<K5Q%KafiF3y+L7<^JE4CaJ)}t&;bpWI8R|Pf)z^6lNn4xz;QpBDcE@?
zgP!v&1~aampxqb@3qfhX{EDrhi8zBr_7(e?+1KqSf=(1Qk!0X`5iJQ`@(OOAfi9ts
zmdZ4@WEFTJ&pQ>ARwm!LT_nVJ6%-IJBBeo#0Ha>W^L(8gb4RXT?>aAs0H~><@FH6J
zA!ug!#2&r%Ah8$G@}QoI!HF8>0MG_EaMcna1Kw;0I(!2hz8p+ZpxrPpqGc;HQW-Qn
zsz67U*#CbK#l6xz3WeWk9>pL5Iy~(~wA@S3o?;Uz289>((ej!cGEAPW3Q8TIYgZ??
z8Zdx%2DUdSWtd1Xf!aTjpk>7`BBVn(See{G%^YxRGeX)F)Vkz3Dg+w9Yv4I51X}MJ
z#dAl9=|vR#OrE1cY@quQ(C-)JR0Uss!T@S}gYFldTya;Zp54<tiXj8!cF_8e7g6k*
zpq2HY&2Atut{Nsb5dTFK=Sxtl8zlB3itQm-EJ7ZXCR0G;>!86(k6-K(po<DX?a1p<
z9Ez`>Fe!kF1&|)@xm>KEqljKaaYmX)F$jRfUPQ44n%74$2%Pw%&;aUffehl<1HN?N
zC{%$U$RZHiM3RL8#C{RQag*DINfIRXB8v4QSWKQ<7Zhm_F;E+l!2x6*lwWBc#Sj1v
z$0%0Mi>}h2K;od@+>0m<$9m9E5yw)lC{72?$sku>OORnSk22GI{e)`=$7ZHrkmBpM
zTmqm_;;ICtNA{bFg?5Y_OSx{ne!{lEgqMK}qy{{$62-pIJc^+K#0NVpie;i{HanPa
zBFUHs6600_n-OTjZ_nsa#ZV7gRL1clip9}HfPn|9al(rz7SM`MCJ-N#LO?AJ^C*S|
zprAJq5@1laIR76c_achzpm`L-jEhzhKVC%0n1VcDBEjGR@;#{hdJ!RZ_M)crkL<&?
zil742M3E~X`=qU>=PX`}?1Q#~FCyw?bhA&|I%eOoHSAPZknp}^>j=s6+)|*?qZiSV
z7fqxXEKclE0&UB+faC))RZ!c5XSvV>P_E?JBGll0$5s$#DSrc^YHx3F0PltBZ&3UJ
zG8+`d-j{6+K?|iOHv}-esAph2^dds)D0sJ|ynHFhAP@$*p1%WO(1|;aMG4EmH@D9*
zk!AS9KS7|&F@`~@d2XWss3-LzLdy2SG3g)K2kbm~(-bDd_J1cIumk0tsPsE_f#x^t
zJYPgJ@Pa(SvquP2Cd~ltevC>6oh>QPzy+GQOTKR>3^Ev0ErV)V&<(-YYIr5m57<ej
zU$zr{5hJuQ{eYe9i8~5aJSzldwks%rig|_?(ej|7geZ{X;UO^t;Q^5EL5CHAy6@mq
zES@tky@-&gzY1!g!Yl-JIuc_Tlt96ou!q42;$pd#Ad4U_wzuVwVTwvVZ|4cB8q9Cn
zc_v@5^G?5L=bL`aF7QQ+U}gFxyU_Lqg%0;CcA_AC2nWi6I>S*t2NW#4@7M-H99qv5
z2@Yyhmj;3k_jn;MH#Pf?ZQ!NJQa`Sh@Jg77u>J#$cXyREC^+A-lb=2Za*6i!CIRq{
z|Ng%DvLFj#A(nl>t}yw4U9I^I@H(WZ7tyky5UhlFL@j_rhRM&QUdEm=`Ho#8$fqVU
z3_Qtq?2^rI+9iSt*z`Mgsi1?XOk{)@(ht~WzKG#Jn107Dx4*&8*Zs1c@1-iKAJ>C<
zB|vNbUqp*^f|j$MjIk31ooAkY*)A6}(GD`}MGSu+$ejKL+vgw$^148-;Nf)>5UvN^
zZS8)?&bNEA?NaV8E*aAh1|eP#0Z|iqh6N_F3`g1)*w%wI@ihntbCqxjcTe6M59T)s
zi1nRN?BeSZ5Sw(sKnOGu(RV@7i?2^WjO#vlvjJDvUBv*it@i&-WEg~ay#$1LRtU@j
zr?ESB-p~YEFOhx4ZX!4y57>F8-?8&eKLCnH-jC@A>_Sh^*;DI%#cm?cDxnz}TNo60
zT?9lyH7CgB;1+fk7Z+C-i*Uwf1`WP00pYeH8+DN5`U(_^`1%Aucj7K+Dp4*l5n(ve
zRAT)eB=<sI`l@*w15@8I1tGqkdI7PvLw3hOE(Ez0bV5IeFjEL$kAO^nlXa_EAA?Y*
zUqcq}Apx1m4F()97#M>3yA+Igk3jB^Xm3c6;yngpOaGhPV8Hf*fkBG*fPl;kdHG)M
zJ}y4cLh;rER$oCr=j#KRsaOCih&(K~Jo*`|j&js9GI{ZyfX2ru0TIwuNSEeF{kT4b
zSHgUb{YTJbO8bOar6!^bP9`!8V#!zSJhQJtL+p;7clr%G-}D=x5aXVhe#0*G)SO+i
z-dF7=n#eGSfGkbEW9JQSD#$Phfb@bwI{k`WVEPriP*BL%zlh;h1O+=Nm^t{EB0%@U
zy@(dS2+D$)F<c&#+Y}f;lOHeSB}+lU*WY3ZKIX^6g3F<w!O|6U_Z%J%{04iVYsOa-
z83rei<;i!zEqXDK!;|mWIf8r;_#%c&66E^RHanJr9PuJr4D5gx@^XJOW4Ih%$jeLx
z4eh>=mq;~Xvj>;`-p6eNUqp((ogDB~Q94p;>U9N~c`ss^XM*Ylk4y#)Q!NIE7m?z=
zlY5@})<;SnHML^!0Lg({5RsBg&7&A1z<khPTBKwvsB-FgV6c@ZRjA>Gyg(>O4%C}}
z5e3;A-ri9E6g(^t%|FvTip>Mm*8$&NBg5nj7LStcHIHJe=t)oz0IhXWD6nHRNoE19
zZH%l3jZ3_UVXQTe;`#v5DBJ<nq-q|;w%|pS)JM=TQ)i4#C%AFU%)sy>N(y?qAk^X*
zhQH=fY$rhJN8zF!qlYrn1<;@;2P2caNwPhtZ_HrAZGY2*hrz|<7~268UWQqw9Be;0
zvNh@(UNA5%dJ)OE5Y!-PZ%_~dTOPv@YaYeUF)_-3$wZ2Khay7*(~BtaM#VroM$n=+
z#e@S4CU2Q8n0m1tFy&xOFwJII_aaI{5_An5sH<rr!(`S`qm<<^hvC8XIouKslNla?
z`pcjq#bFM^6VP<C!z_kpTs8GfF`zAep!H_lvzVedrMRTHs#v66KVn<~a!~W?`H+dq
zNQT4<1#&My-HQpu1}{LPvy;G!CYglV8<aQ{F4%#N&SrQKBlpte7MsJ1D2Yx`It4`y
zDAXKuxOcQRDJGZ*F(~!6D6RsH#wt#*V^pl)V8>{h&9}m|hwp^xTAl+Y0_+z|1Q~2z
z#K=X0wm-j!k@Ezdt@9#A&JtV`M~UAAO<}dqw+9bFw6|!i0Ch#%+q4<XZ`w6O=5v^T
zy^xnLZ&+gsy7(-DXBh*hM<s*8iwM?QP?d5~Q~n1BXcsdlQ)E4;ZT%ufwh`3y^hjpV
zcp)!y6%=PJ33br93t4|il*n3|N3mOgF6(#^CDsdCSO;m3FwBC;%ltHt;;?9AvQPw#
z`0*|fXax@si88pDh}hq3o@xUg`)Jq#Sv<+##UOmCSib&8L$Q99$5I9jP_+(P6$aAu
zB9f=j{Fa?(e}lcN^HDod=R0<i6P7~S;2=w{?3c0kzGLUv-k@aRe8*0lgO$nc%6*x5
zkV7t<m;V1EM*5+76h}qt10@NN7zmq3aU6INBfXJJjft=IfZ`93m~ue99iw>^#|O~5
zxEC?fm7Ho!oUICq7a)=#IZlfgG1A~Uk(On!#3`)_I=336=0%LOpm`KGN9zNnA_!mV
zqj?m!gNY1-L+b%0f$TfBf>7~;=26@QCNd0h$J-7@fI47c@%k94iRMw<prg)>OjsG%
zvhUa`nnN{lw{o?bNAVosSpeE}3%cM?%F=`rv;bcCCa9MIO9RcFPN204G0l@47no1B
zzuVtr54oK!jvqXn+1_A#78F7+<Yo6>xeq$eQ}(TS6vqwFj90yR6sN$87|BlaD9(c8
zZ3iIPPhL*cJc@Gz*oE@4f6b$~7{KfpNlWu6ZqQm~JD6iz73`M69Q-0i;-`5O54i1V
zBFqrO)yg#ol&)UL%Z2h!7HWW)A+gasiU%}*VPnF|P|pIoHWVHlF%p&LQ9KzYG7Ku9
z{?-e5d0S8rw$;o7Cr0Ise2nIM83On>E6jbp-~bZ`50k6;Wm`eM1c51SAYU>tIdsjj
zziU>^z+tk-{(t*~S>Tnr${+a{&Hpo;;QymA|Mi0dOwE%OKs!F-nkU!W*P5_`FE|PZ
zoyHFG73k(v6IRd(XY#HltPBD#<mF9GSV7Bs<yB2s8Mr`$m@lFPQ$giJdxPbBaE@SL
z0IeX10Nwup8s7l*s6f5R7xAFA^Gpse<mH!x#9qkDgPN5LFCy7?f^txMeS?C7_Z`p}
z6L?uac+Dgvn8Y&8qxdpj$V=*iEC7v9fW*zCcspLih#7*!UdT&)e-R}Bn!RKKPe+3C
zH0U^$IC;?JB_Od-@PT=t^Hyb;K(n2@UPQ7*g4(I4=YY?ViKqt|3i7de6ffv96s8w3
z5{@9By^xo4e<3e_7wj7u28;ANwxGN1LE~S3pvf_XCh!^+5ff$xq4Zm}q6&M?|4+YV
zD+}5Kn0~}o)r5mV0yGhre$-ab{Dz%i`UzW2&}2*cEnD66!?uR$M{G^g58KvTrr)x)
zO+Iexn0(9DIr)~YYw|5y_v|~Mfii}Tpn)>)%XXf9C5jsEm+fTTZ`mn=%5l)J1E{#}
zcTfPGt!oBy9H<mDkzw)yISyo@i3|f1*z%jUf*=Qi90zh3$RP+v)Pr4t;fNOz@_Ru8
z6A;T44BW5S$+};*Qv?r+OlArOjnK6>n1GI)bO5buH<4uE0*7RbFe4<|MEYMu2$h1)
zp>jTI*Q{t@#|T=JtMI{&5mYlO2G}v0YVtFf)T?kXm^|mtFgeHOV9LSYVCuy`!-Svx
z0=QQkBa~?(#K6QM#N_OJ$F7lsg(;Z3nF+M4k%2EoK(uR%!V6HT3F^FX&*6&Un8P)P
zze8X~KZC*z4k4z<E6E&+W<d;0eL?oMpo;57jNnPobYIH?1p$a-1y|OaNAdr75ykBZ
zS`RU~A%N!v1LLgrCWj5qm+czc=i7sQ2rp1#1U<pEo4nBV{t0$p&5A+i{mGkxEP4?m
z2<m4>aV%y6wMRiG-EzH%5qJryUj%M)@G(Wbke9m)QVVi0s6#b<4nw^IV~vEvr5X`X
zN9BKegWXe5r-i$fY0e9I*{_#drGNBKP}~5vh=K9NwJ98m=67uc%_SI^xc6|yq)%pK
zNS?;X!m))(cv7(fgNd;Hf6zLk<jIU|$&(p5KzC&&PiExmo@fVNOVqN!PSyO5tthDV
zWFpL9#otgbl(Mc8e7sW%XzCU^?8}mV2Q;F~6b4F6pmWnegK6n^Kq=S`bj6%d`W;(C
z^ILX>>33``K?%)7h(RFzu&r$RWn0zs!?wEVmu*d7MDW!n-?4RczG??L-#NlWgn`LK
zjDd}73zJNHgMt?*I!)?j7(j6;-~Gi-9~76Mc)UJ`!->CzA-FHWPL*4ND+c6ivmpEb
zeGc}mpzF6T%Yg0yw{-`1f@LIsB;T<0HNR!+pM1yG^RkT84{iyrh~zuA-d8F(6ko*1
ztOX4-f;L&0Bs17usFD1Te#aJc2E0i6VOz<1^Xqnr+0bqtD1W|)kOc3w>~FBX>VDZS
z)cuZKBsj~}FvavYSg+*}VhRTvCc(gBBFWVCB0}~oXp3ZjgEhFac_A;X-m*ZK6_UVs
zK7!_{JoYeXcx+)XFxd<~5SN2*j!*;Wpj(eWO!XId76{GASj%7l+Rm7<hd~3foss=w
z#%HDr9yZ(y+8fkAgXXh9L&hfJ3>u(OUC<yYs9<^#A#>H-l0oE!Jo`$J8c@7~qD<k=
z`Tr)Y3>xW&ZADE^GJq~L7f3&8E0})NRuUXdcWhOe7&w+QG1PPHdJ)0X37WG64GnX!
zGlg(4GX-<aWs~KqVVB7U#rbhi@ysBSeb?3yRLFn|C(x`rB(%iAcTsqsu=DH{QJR3Q
zkm`0;N-&XO`j&pu&eMd8K_dN@ov#Tq=rDN(ru6z#c7dQM0F5)J-?9q@bwtwd*hQuv
zwTsO@Y?t^VLTqpLNqf*uV2NGHiWl53+se8hwuO{}$xP1N%}mZc35p9i*qOr2@7QXZ
z2s23VcL;3Z?-1C^cSUH$y2ALod{>25fW$!j^uxBGi?otJB_=3g*PF;N1%ZMLwAcdF
z*94_t&?pHg1)JZp^)@-iz><F0);9UDt!w%*TR~8ef`jmsttL37-?23W<$~mswvNe%
zZQWnQh+j=UYU>H|RQ3tT@BzpJkkAqZ-)HK5*)FlKM8U%Sid}uE`(?XG<YKkIL4oUq
zJc}SGK3_y}fmd0)kZ1k~;`1yJnAPs4;Q?w=Pj(0Zb!xRHI~Xv54$7G9V8HT%fpO9c
z28I_rD+FeCdqP^spfRNv3=9WAqd7be1Z3LhHE3|ga82e}Auz>!jt~PA=(uH`KSB&3
z$^IsVS(6{UlmH(-cp0=5a1MjQwR#zO6B!1+gvp>OUPd*LiQq;+1j}DgRS9anzL00$
z32M3aH_bl|lArwGrF4B0R}E7zNEgf`(A{q)G7Rq=`WQa7-fK|cSs~EN*~c}9zgMWi
z^bP}4!W@QAyh{XPn!6jcc-IKTm<Th}Knu$c-IE&%Ok^22co)DfeplG!xr@Qza+LHU
z^C*U*7m?CWL5qJqH-pCVIqaqt*E86G&MUY)SA^m6Ug>{{dl{Tuw=#HuE+2Q@!r<e&
zjUm8u4}(JcvX&p7n;A3|4EY#M6d470Y!w<`C>&sN-N@k4rl9EHx`DxG62Ae12|oi<
z8-t<(2R~Cd=)iB+#S8(UuE+}~9`HV8u(%8pWUGu5_YV$bL8b`L%?t`%HT&63WEq&c
zY7~S#K?l*y-S-s4Z%I(-m>lq0w!U^k9f%LQljQnd4n@%EO0OSsyiuOOz`(u7V=h$A
z*L*K%&z77mh~M9!+@w6CLC$;*2SZa$a|USrhKVFY-RsA~-~&#Te;nWgbz9B<oBwaB
zZ^$r_Vf?53fPn+b_b`!RWKe#>zyjjeH`O<QZl`Wgeg-Zo6hMMp^)o;>2ZItq<m<;m
z7eEnhBFs>Cd9U;b6L}5>-aSGt-1~PlaL6;o@@^LLX+0FRmUpj^hl#xX|0{VMEh+U3
zJtp#u4VR`%y+|lwm@{d?1OXFy#t8}K46_pI875ucFZIHtilHf?p24<>YmY?(*JX{F
zpeABMEkjE}4MSVMf`ULoF~dBrx!@ryFB2Ji$CMI=DJGH(3JIkQGZM-ex?V)_=uV#T
zMizAKDrmWM?*T;*6Gh$x6Jds?6dM+a7xI#!8OAIECNc~PU3(N3fcA2Mj<_(7lK;;g
zvZH}RgeeL%HV3+t^z~zj4`5HqFvx*DDa^rOBG2%zdvk-tbsG-F%Qn&<y64ZodwH+)
zLD0fW4l$-+ka?gh?CL>lt$9}n#DWqp=(JVdH3Gp11+uvyc~Iz?$Z~+r$nXV42k3r^
z6dRU|7xEIk8OAIL;B^4=W}F9QUXDAk3<}AgFXY9SCfM+T_dI~E5(Mp1VN&4O!Q{ZP
zohgB1^6Ix-^?`hhpe=>wQH%zl^?fg*<wHSDI8HAnuNU(2?;(rt7#p$=+dTxIb9vnE
zVD>S)li5e@E@mIGyXo!DVBzh;V89<C(DouiFqVUzDeA-?@D7L{h?T6|9N>yAT5c|A
zdg4Va-&atWy@=y|Sr6*(Lsn_9YQ2aMJPR@a%IA6!#{(WVYHv``P&U+K>}dd9A<p9f
zTG?^AA%6c02F4=LG~|mI_K)V4+#D?}DhEI-NqX88op>??T0my=BnULWh~t&yIV{uw
zI#v?A>ac;IvEz>dsKZpxpxn^U&fg(0S$P8Q4)Zw-JY6*kpl%lE0+ATd@?M3Be2gY7
zOdQ?K3LfUI;G_<|+SL2F-9hhTb|<}$+FkSpg~VaIhmf_Nc8&bdJ0@R5%k1S~VTuA>
z7X;d>@ghzLba5z%pUZPcsNqFiJ+~mpm7wnV3kIfFJxvYZWXCZFv;>6d6i<f09FUK)
z@7PWBFyRGFkFjK5v70%e!2nb}vnAiLTj(_hd`^Ubi7<nLat8xL)*J?lj>(D+psP>a
zCNsF0NC_}-fDTf8%-sMAcF<JO<sH%=I3$>&Ue`Zlhye*+-Xr}X{f^yIuUQNhP{rUA
z8M)`qXh^?nw-hwU#Zw?K>xC0j1cx{is5caxec5g!Xu<r87|y@hckOn%->?JSRN>sy
zps3(|$8M(kEC!d$lF}buKa`&UvV-TYP(w?CZLNun{qGm@vbCU%AN8QYE08O>YGyR>
z6bm(ge8ZC<Fd59R5o+K`5SVp2So&*U0;u_A|CXmfVCtpKAim9CkO6LU7+gR;di|L5
z1jrJQV?n!lp<)X_j(j06w-w}2kS8unNPhr1?1dA<2@Y|l`p6gZa%V5^;hNjhVG|A-
zf&nEoNTOm61SP5$@-nI>GWLI4+N{$-iK?f?>MAHoV9S+2VxW5%8~)h1^CSq&d=bY1
zzE`!q!FnsmJct+%_}nYdWIia~LAeTKkGW+%*9OquD(FF~;JsC#7L~UPgN3&%gTad!
zCQtqdf#w$xTw6g2>BJmG0}~nhw=d$@R)YAT6m7EE{_l%8_CzS(0K(@m1o1&@?Aj6(
zPJr})#M?3&Hh?^%Jduyld=8TUzy4%}Ij<WIFujOlzX;NBV$VV?(10X(lGu`A!;2U;
zR*zc@3gA)HIJTLSIX=mNF3e?s?Dhhs?Kn0`(CPf3!99=(pv-F`%)s{|j_oE-u~5h9
zISO3L6PQ%Y=P0G|)CkQ0b(?u=gh02qx`On9Mk`EY?7<}sI85$=j=5prG`Hkx067)3
z^9z!%Ap82@YNF-qkD6O@dEiuJ$t3{_TTpm{i!RvSHCITH^&(o{6;f=mgV!FN*rQMZ
z3a1xw%nKoT610|tLFq*t3wS0B8kXSj?`cp7;wcakm;<^4g6D`(1J4og9dO`anVj&M
zTX8MV0igy&JafLtKf=(!A0f~Jx<&m(w4ChZDW9WFe}E#|WRCrR6JbV==E;p86gKiP
zYS*9tZ=%Sm!DFM)>XFW1;E}<g(KA8ughv{K!i#7L-^mJJB*EqO3HyoWQA`ytqJ@@b
zAGZfxf;~qWRG#0l2Q8=;fZypDEtCqn)6qnR!K7hM;|voSMy-~n#sJW2TaO9`3y|IB
zGWP$QC(q14vU?`zBreeL&LA_*qgWI?Y8W&?b;FBj!K3va<qQU(5(Xp*5;Tuuxqz@x
zuoYq<q^xdlP~-qt2I3+SFBmuj%q2JvfM#Y)mNHp@QX=TM0rNRbAO~qR%$au|<S0nH
ziq(Ke1=6lEX|ey?FlXL!sGK9Ci6ZL*m}JA8h8ZR@4F4MD%r7@-v1c@Cv2SddGSAgS
zhR<wD3xgeF3g`f;d-@>Fpm_(-y8KDGGCJn>>={jD7~MMN*d7PTfv(ByOHeWZ`4pVT
zjd?vT70dtVOHksNyyB~7eF}p{dy9gBM=FCtdrQLs&|ZN428CG}DGUlGDGU-BH4GY{
zP`f-s@-9z>&<qn{9tY5U9LFag2mlRam?*Le9Q|`(1CNEmOr?)}jAq}NB0v)=ut0nf
z%{SLPin)NN0W@bJX9_Amx+mL#P7nvJvSX;{nIqHzy4jDXLSV*=aM80KRSXI|3xr%i
zy=l-j**trM96$zxn#^Y3nF2t|`Aj$%8XVO4yF6+b3@#j#|6#()l)!PqqQQifWkY+D
zf`Ugng9daiObUFnpN#!q&_oT-Q=tZi2cVvwd?%=6Jw3;vUcy9}2ej*da#Kx%1lVv;
zVI(iNl;@97!?hX?CleL^3EY#pM6XTdXyMwzBGPd}L4#uo*A=fREGzmN6qHP4?7xG~
zNC&A04eNPLVT$0M%q7fIAut8B_!s0M&}2Ht9IhiATfl8CSJ1k{7ctVB9IW+B5hgMW
z4IOtB1VFBPAuqc%qk(0`3whb484XMk+6fE{AYXc@a9XtY%}e!2WzbM6<YP1|W?R8m
zqcHhZ!T~0*qeU1R9E|z9KvCONq96b|gj74hfWbtCKO!T6LBm9tA%MSyVJgQSE)nxN
z3>@8)?eFqU6>4}<FE0%m17HB1YuuKkU;#3$Ekyw|NYT)jU<JA?>ZivXhJqLJGOav&
zgg{MUC6Gmv5)43W(7abDNE{>vvb?Lrs?<aVeE7yx(BSura6ws6846NkK7)Y??DKFT
zSDp%iSuf<JWI>}S3?3y63LcXgBDyA9{xy-YzxhI5dM(J+Ajg;pGc-8Z@OOdMQFc#O
z5b~JAQ1L=uIu~Rh$cLcKLmoE#8$gL0RA779@M>J1BYmH%h6&uxFcG$I1)VSIF^8c6
zboxE$bhqpCW$Zzrs-3_P$N-w`Xm3z(@UY~x=x?zAIpFV$aCYz{1!PS$!>SkZQoW!X
zBSH0uhYiDvY#W9TCK3!EvTYbGlsgYFm|HST$hKj~0M)XSWq!)m$B2Wc3SP)d=z>x_
zXv2$g1LGf%rTq<7YdumJG#DOmEPfFo6$sLEdX57;9fFz(pnfc*c;U4(m*4~~bytD3
zH`(t(+M5!Fpajg*49ZoKs-R5dQORJ?uVDEVWOluY1S7+XaDHA;(3{9GHZaCWIDm2)
zC_RA`gK}5K9EJ`L8%_)FISdt-=g7Ohke8U6F^6FS$dT=B4I4lPwKp{xfI_yv!O|6^
z7aUVIoCfAoc|o^L34vCUG)>b}0M#Vsa~KM`r`n$dpSuL|wTCIs1(0SFMUH~*sR>Sy
zbRi}RDy#ZCO#g$bIZ(O4(;(FGf`PGtr$J~!i-Lj>kAlForfIqrpfj65V_~4Srimg$
zf%zQ!-|ao^2TUYb7<gs~HJAu9|KrIJn9?<QYO0Bh{Z|bJIYtvpZjKi*Od^4kcl=W0
z;{q>l0=M#FgkMg6^Gi=aq!#2fkhLB*yb?SOleK=U@R^8%+yahW6NU$qV}483D=>H%
zGdy@9FS(bmMyLUj=U5f^5(K95We7~;pDNVAKTW7ZsjR)otXPDBf3na7r6ka@RFfMo
z<VAV;CkxF0hhxXoyP%tkl`irznq6ai!FNYt+N%Qxm_VhSi3ke=w=kDz)0RnZLAA7Y
zq5*@6CD#G2N-jx{_$mek@Hj04XwpC=7nB{)G_}Gsf#&o~thf$<ic794E~yt0u+%5~
z7o-p3kSS+D4uMoc>;jVm{)p921ZD5HAbUY~NSj!)9YD2W;#_1aUdYRfnpm+N0A2X-
zLS9%E6fPjWpy&XJzX<0P1r2$;kQaIjwN?X67c&_2B^a*-B?S*-UWx9>o7QUZ@G+V=
zD>5*2H!e_6O5hXJ0A0Ne=1<rTiXhM}_uP{^=719F3weR5pfm&WM}Lz6sC@Ygs?Yix
z3_>UC{FQW$5CRwHpgITCNCs^$H;-aI@gkg;*F=i>#fxw@@c#4{^88mpW}_D?&6D+)
zPwx0@<iu~wA<q;8mKI@P0u^Z<r3?n(qE3W?t!>G~r66nj7AOdS{PIFxU@rd@p@zOi
z3ZV7Q!5+rE8k7J0m8$2}faF~Ph8OZ;N6jTT7cktBZ~$c=uNqzr4^vJHPyv;-hauyI
zJpWtJt$7|P3<fPt3O_v37&Ka16gPlo?Ry$@zk*UFxTK5}yPAE=Uhu@81p?r#Ezi3b
zRPR7aQ`TD0EFh?s2Hi5oGkN7dGts*|cZ4Q@s-72-qJJS;b-qvj@K4Nd%~4RKf=mHN
zRyYe-H&2DY9F9F)bG+v;Xn@-DFCqjCL8EM-wy#1X=s-(8QBaEzbh+t^NQsFcqfgJ#
z(VrahUtM)B&mEx|pdbOokcTlZM_YpST8|RYAg^vZ-(;bN{wD3|lNbD#tdHdcXQvnP
zyu9F~k;0(iQNdu)&!Br1Wa5iR@j?y>rpVKCwE02)<DVcf$3&Qchrda{guh9^lxGU~
z7KXb#Q-zdX$a5V9#U{wk>kYE@{Y@I+7S9WLuBo6F5lFnhrN<s*&kK33Tu@lnzlaq8
z@4^5}Ht4(sIoiRP*P|~%3$!!uEvOn)YS#bVRiecUiZByJjtM*p0(1HsKxfU^zkMOk
z`4p5CyC>V9HBn^X0A(pqSLua3|JLlu3X%|W)whG1UN7W1L0R-aNUVKMkEllqLp`+e
zX19P<-iUZ$WCa!0FBljNKr5@j4zuC)Xm8M73d&?J7#JBmY}j@niI;-JJuKLEfXc$_
z5*#fcJ~*|=3;3E?GVcJDXD=8SCV1E|GC)#fl;DFG@&a4UB{&;E!>BLh*`}IXGFgBk
zzrVq#moGzLCQpXIWYBG)plXPx26T~~z>F6$?2Mp76x4TrA<sD%RFi-@0{NF18?ujq
zhf&-nKiQ#Mf7I?}_7S^}*@x|ZGCbf|`67aICTIc+l%qhq1h4$za02a(GEwHAaAgih
z3rHMvEFGwRzskaq3|grJI#v!;*PDniG;~i<NC2G*m@%1UMMIlHgd%8lg}BHBuxBJ0
zRLmtf!8;INM2l?%Rg3j6V%foWx4)2=pPMn633QKIqv<U+2k@3OR;EZ$384t;C`Pew
zco8k;sko63bij)@=rA@@fBr5LA%+Ii9u5W54IBX`f(#D44+LaDj_IDH0y;F=je~{B
zji*6i2G0$FIoWsYCxXs@1g*;8xd7(Z&otF!0JXguUPOyd<T)WQ-Qx~}1!!y()SocT
zW^nMh&S2nigF)j(v}mBmO$LQdLwkFWB_KzdvM@22axyZ2Zq`*2<YRmhEy@YHT#{3n
z3v_e^1ITe^0vr{lYtbF2Y{9|F<i^2M&*a97>^g3yNRZ`F*UdD|W)Lv#VQ6>}EfNWL
z94}K8*m0W3juVjtJFXDoxEImFKS2(3jN$JBHOIgqGFd5sV>y?wDF+J!Co>ldFEhhT
zkNP<b7TI^~D?!0*9>uZ3V-ABs_8t31k2wsWZdRwq90mnYuz?Q723g88L16leXkka5
z4uKh{hAUnGnZdD~i}iXdXkQ!)D@Q8VVUHT-43K`08kQL#d5{^P{Zk&5%n}~uEFA$a
zqJ>s^R4{9RBt0q_G|Zzo9bQBWHG<kopxgjzAo2(Z%*ilj^w3TQRq<RCKs8N<G1mmh
zfE8nwhcVZLz6ATXprM$_3I`nO{V&-yzL1w*%9|iC<AuD;SzZN!8K8zexKUrjb?1e=
z>{RcWplKv7_Ur8&EgXNq#|R$wsA1dya;<q3XM#r!lLyGP9+iw89_369p!@7RDi|k#
z9LiH5FcaKgjN+W(VZ#M#S8;&EA**`@>L-GhV7!QB18;}|`NTwq2fV!ulm*T2F@Y|j
zIGBCh?qc>ayPMgU>?*S_+BIfhu<Oh|Z#OafoZZaqvvv!!&)BWZK5e%#`;^_z>=WS8
z&WG7Y>|SOcw)@E6Akb<e!y^G2gq%DFJPgN_VZ#eK6Na&#$umKL*8|+Rvf<_cm5LcQ
z91T!f0YsaqvlnFiVF&=T)z}3x?m*ZXHtY<bq8K!_%b4J?5Y(Up<#|xYU{ZoX9jND%
zV8h=9D%3y~J*b@yVrSU!YB1c9a4?bKu`sC@W>Da75SYR>c}4?h@dzm1KrYR&;hLb7
zzz4n!-9&~*03^o2$mF8L(Ep!%@{R@$VWyZ28(!FEzZlS5k%=O&Q+6Xa2RJRrFfe4#
zVQ<JVU<926>ID)r<7YSl-WaIQ@B_@}W4KVCp~vungOSO@M25!$WC_TH9E?o988*D2
z!3%KH<3*G_xLyH`$0<wn|2LOlFaXD4B*$CxD6R^SVIVos+R_YLt^%msR`Vz>aO1vv
zXM+ZZEK>wX+&qfw#fxa3m7u78!N6L73MBX<Qp(mmin{|8#3yPNIB+mBd4sw?3Wa=(
znE{LpCW`zPnf(kuOp>`6G7~v1GWi%jfQoof@8U(cu%@{s_lDDR7Jz01n6wiV7!r+n
zJxmlib|_Ww-v+5SD`9BJ3}$37D`uFGIfdazrZB^Yj6Vzx8F%U#91sQx%`~^<K5%-@
z0&veX(T3Lp<RBA8PKV4GMuyBe3_mhu7(OUB=`n*0g&4p9Zu)rEa9V&u(R>bLLxv3}
zd@sL=6(h%saG{x?trL(CVq$=Jn61`4iu;6ieWC(GhAqPjkR&MRL6RmGyaF#G*+3!k
z116SX%gX^?Xei0R^deH?u6Y!X!Ra{*m@@wGa+rwQ|5s+w{|(anB9is2c@$3qI7%cL
zKxRLHh)a~3NAYxk%ma^d)Ce_z#6f%B+%gn+BVI&`+nPu5tT<7lP=E*#fl6~ro&)_2
z3ZO0SOc{50Baq}A%`JH@fX=W7HMKz1I!GSG1{wS!Qhcg;6weEgg&8)y0niZg@t(=x
z0F@6lkK(Oo@GR!E@G4<&XquxSlvM)?P6LJv8~zH2A~8|(C|-%vHVP78A6YSKya*Qn
z?Sod(V31=}N)li&vE=-~A<Ps7;+rUQui#c@VSW)UwiUD<0JH@jv<`^fL8yV<fvLef
zib0{FYCib56P5&_1_lN;76y;Wyb{wNa5B2+^wl+ZfT{p+4J<CjWG=x8J`cb|l0oG~
zG#hBMhrx>&aq#Zd=>}Yk5*nVHc@?tfFigmv%rFB~{AN#PSm5!8mjl$W1Z8J%6Aom4
z0T-imy@ht=`~N1&OrSvzh5iPW3*e4|3IhYUf1u95z|qdae&LUd{N*{)UpW47$y}Zz
zm($*&Afc4Q$LLkU<8W;bk5E<#kAvqN-T=^yX@6UT062-tFfe7#;SB(Zo9MEx@Gxdw
z0g~t4qcA1Igmney9<DhYjP*=@U^fXdFnH**t}wq~JMmf(hZA2e!$dwk0ZBd;fhax&
zff(*tEK;D8hF?G6YymB-$-ZotX}*R*;YB3>R8VsObY?kd^72KrFzAx5DDTU5nOp^2
z!kiy>G;jzq`S*F)`+|B;9Q;hdpmQ9re&lfC{lGAXzrIgElD|bDioZc1gbQv7#~#kN
zT>PLI1X%*<;Ruz2EaCkl)L>@Fz+~RfV8_|d#Sb#DPs2X;T7rzU=N;A+9CKKNLD%Lf
z-8uiCcZI-Y?#V17{8NM`m|f!#;@u!Hg?kE%C|{}21l}EBIhlICIYJXSn3+ON{(vt%
zG%yiiU{IbY$LKwW#{zV*E$E(kDBl6f-vH%%K=}<&egKp|L%9buGS353Z(;J>{x?)j
z1XRrgD8D`dDzE^mi2=&@;CRf%4i#&FiUn|pFa<+3W<bSOK=}nw{thU=0?I!C<-^Q)
z!6CvF)9`g+188F#&mS=%CvajhXVdT~V`u<1s7(}^CrsDjWt3twU@);@u9)t_%P3V3
z%7DxpKxsF-nTG>(UJSJP5cDFPb0VnZ_AKGF0GVYrg|Pv2cC(2N#{}NV3RC+Q*uOU`
z2Co2WGLdI!;A;?Q>1j~(Fp*(U>#Au|0M&Vr+{NbbLSAC6xdbNz-vR-7?$1oYm*z|V
zZ-1bWaH+mn`UCf5ra30^3<{Sg%YSG~NC>z-hePpNF^3}8Wv0oOYNS7y|F{3&|G@q@
zNFFpiW40AEYc6}$Yzl~$-wPV0eGx7S&Z?l>-a!t25iayp*@2(&MYzyaWf%V6Ap9a+
zXs>w`6T=I6xmb`Iz7Byo^`Mgjxu=0Aq&IO-n*qAcGi!3g1gRGc3|5mHCWwKK@#*ig
zb2pp9P{28vYYxcAFBljEK$8p2^X>0~#9qkDv4Z5y=h$b1E@c3%1nY0Gy$=!t4P`*o
z$k%2qVF$M|_!|V;J#1JTCO0T>GQ415<nol^G?;!vfKjKudy4&b{sw`mprRC%WI-cO
zpmVIjd>f7e(D4x*GE5#^Q$dHcu`s;|7YsFF=MlI*UxI_@fxygWn-&33X$q=@E?Y{L
zypZQ#YaYexkfFlb;Hb>&aUog$M^A!+lyU?AZ|^w_3ZTO41p`CUi*Ny3Whedm-!H-i
zbd{a;e=9rkgV^9js-E1O1}5?h3>@4{!JyRvFBljKly3C@2lW@dCo4!Q&pUqCe2!^t
zQ;q$4klGjW@~t2<nx@)1fW~M+9_m|Q4=#$$iWv$(i(C5|?9X!WFvYYlP)aZnXPd#l
zL141-jQalnpyH$_L4iZ*MgM=#a7G6H9Ria<$&c#~i_GOYQaMU9)`QgWaeZMCxjvsG
z*~FNIf%^}O3`h-U4c8qL&{1Qe3{0REb`4(}CYUHPIDl4BaXi*&FnMhMpZhTvGpO0t
zP~!-?BHP`Bi=n`Thk>CX-Dc_adS{Mg&{iJM*%hGsxj3u1ZoLR+%mf`P@IqdGJBJLD
z6X^7I6ETJao(zGVJQ)JJcp`;Xth*S0mnTYS1^)(tX<XB}B=~0tHSiq}n90G&<iuAg
z)WCN_U?wQpf<_kkDup`uE(lEHs}O47D-)W)ze8YJ_GJ5oplQ8&z7qmF`A$F#T`veR
z^wKn`93C?vKC>wbptS3o-DtnkM4asmD097#7u;(u!EpgJeA#wDfh&75Lk1{`Lh^?6
zR*;1+B00c&rg<I+%+XF)V92oHZg>&H&kD-ij@rE7Q{^va%l~LiP^iBEYIuN3iwp&}
z9iUz;h;1Ul3~E?<npiRKco8Na3aa-#zA{Y!l^RM3jLBwO?SFExFvWAoFol^aGVd^v
zWiT=;W{?9nRwU$agBF4G?Nkyl|Ife#%FLidml@Bt!$g7wbSyQ4Nfk%Ii!iyRCcO0w
z0+|PRE_i%ln$Vh{z+pDY9(4Ah2sriYGl2(iFRqpUk$u)K(Zqn!0qi&(z5{)cN*11n
zc`iUsedcI-5iY&aM2e5$M2%X43G{r|7m+dxL8qL8R-3$tkSYYRFV6wp0;*a75;Kux
z(0EZFA>{~@=x<N}EihI9OGHS4Zr6$GpVwdjR~#ub6Vxa@J!h!{2M1FyNc=^F<Uu6;
zpot-f{z%zIkXoe#{<|+2SZ;9DaLI801+61sFaj+T1Wos4#<1<E2gRw0xM0l-c|K8d
z362$f3j|_#jD;FNH)VoWQ95m5Ffp5A|DS6PQw)!}&;-z45Ux8+F?=fort;Vbb(mcP
zU1!grz+)ja^U^ixzo4jjAur3yA;}c;B1}G(&p{xnf4+i*i8yN*$gUUiysqXF90eRK
zOr9p}4D|}2m2xj4BrL%Sn;Hy2hb=>bNg?6dVGgHW1qCh+K_<_u3NrF0&%sMBygL5a
zPX*~yTEKsoYbBRpn}WToi8yNtNIj@22O74ymdugNk<8T&IyK_TbB-2HVXn)Z&$-z7
z3WXZ@(uF!WlDXoqD%W!?<&x)`pOwI%z}d;g%U3T1x;S+KD8cdN3e5m5K)LG7p_o;~
z5Rp~G5RjG3kdb}OuJA>elxg;TyG-RK1_tvv1`a%bgdE($88moa2+X<OAfpOuuJQa4
z>fre-6k{S|Z)_sV#Nd6+u8`-Ckbw7nyUeb?3IZlFj3PYspM^wBWEeR(%DBX?UE^rs
zI?pA>A<q=WcSnfLM1n!$MVMqN$T1vQT%b^h0&R)o4HRksmk;5rqPz}59k9c=ug~FJ
z%NqmsfCEU+i!h0|9K1|XrdAA0CK3!hCX$T*UW7>;<@Vu{$~??-fm4TzGmg(eAjbQy
zUE<}*(#^cKLL8UpNdM(k5aQxB7UJnCauDFP5#oCxFVkxx&bo-tLtx4ac`05{E_o3l
zaubyB`sdB61tnN;VvH0|1SPuDbF4sFR)d3MdXyNWR(*yIhro*%o}Hll{~}ye5p*Zk
zi5f^^e-SDE5u^u{P(g{*Q<x#5quBnvDF;JArVK*@sFdYp5SWu;!}h`B4sS$zlVS(v
zDjh}8R3H;bExfB>$zfn3!EoS31XDdH=m1)<qy(dbi6#35(Cu9>A{cKfeB@&Ul_{VJ
zqU<>g3g%IueMfv-L0v;oIx>-Da4@l8)Bsg*=25&aUPSTLDqQ4a1o2-)@uiwa@f}bO
zlw(vB<YR<vVdk?{G?ZgBdCnAIlFTJxa*RvBl%t+Y;{^l54pU9W8!tdx@xk*FviCt9
z8i=D94wzW77rcmI*oo}W7xHpzO)S|3S|&9}fD$`si+W3g0tW{NQ#k1O1Mp=hoJ>(K
zqIg3=N1uY4KcG%_$DI9BL5_M6#j9!_#Z;hO59-LsFf=$=@ONF7kpIywqrw527Y1Ro
z?_8h-PN1=+O0bWi!vUA)NS1)cpFlJ6pxOBBJNBKR2B7&I<^s^jjEM|`gNY?02WVsl
zVi}JwX!!xi3=bP7P^s<)E<{Bc80tMtcz%F--R5)bZ-N9lM47@ojCnvq11=`A_BXlb
zf(j<4Pm>lXFl3hS{Frn=fgxiu&j--KTcD!c;}?6wiwM?M&rF^l9vwU%JbrP278N?b
zh+qY+F^hB*XNYjLV2A=a#5{_*!O@Z-0_5NetK@%VAGWWb=qSSw^&*O!7vx$K8HQt>
zF$x?Wb9g>@*6@Hk!5KEZ3?O!UgMtC5!Q(uc0et+P^BjgK6GesvJjOy3cx;4bK%<Mn
z#FA~pi*VUg6Djrupp$t))dI-!7g1cU=20viAijwr*8vk7&;ZHwHc3V)8IXPL4GK~q
zvlEON#Xx2!*f2_X)bKJ)-y_K=E6L6y!Sg_%rKhQp3t|{&sCg7C2hW4)pClR8>%#=0
zyGoeEU&u@UHT%v58dI4+`GEp>5pQ3D0vBlMnu!<#6KE>pg}lsGP=NP8v40NY_chpG
z2hsc;piC^k6?ELX`DHuM+It4?4t55QlS~&tr<j5cxmbsE;Dy2y2GG5KeD%qf?HoB?
zaIq*B$}wgiu`^VhD9323X@Ap%*Z!tyHfx0mAHyuu9@Y&e{0vN;x(Y=ecbG1iEVVZV
zIl@HL{wAm;Z6d~S!bG0o*oCFiKTKoojk`(}Hh{Labx%=h0<}It`2>_gKovHqA^akW
zofou+k5@yWevYRlg92y+srfD2i7&$VmO4*hh~N+aFF%WT5yiF_)PMBUWYFN?XNm!x
z{s?khXP9CUxb@ej*u<A1Fa>0IMhP#22l&J!74Y0QD90)W$}uWzlw$;W&Qy~#!GxE=
z$kdB-hDi=DgUM1Z3)Ad+&KICqF^^)s@gj;9ymJsVK>s3&^=$G1+leNU40<nO*%HBy
zi;)0r`Vld|Y&(%JK|tp66!{;04T_+$^@sBv+leN^3`-y*!HS@>fhRcMv7Kxp%mAIJ
z2j7ARx@io&1FbV&K?vl5Hsuz(c90KR)-*_gXs7865zX7}(m_7*DhBO3lue!fL7Gv#
zUKS(-is~2gvbvzqH=kl}58Cz6)H`oKsI6u`$NnJbV9pova&tla?#T*9$Zlw!Y{w7s
zE2x_R+U;T@%rK*SvVs&;&9WEr@>@af2f4X>vVs;=d;>_Vdvd+)T#%+0@-nMUgc(}8
zC)?*j70iPuu#E-Do8PeoT^%BPEkS1gCGfHu`}?3NYu*Nd$xf9F5&R7T!k0?qf3!6y
zXqXk-FT7MN{iCgD{#lS3vnloqFU^$y0Zw8f_BTPE<ema5L>Q!A)JHLaj>3)t-5n2#
zAyB4pDrJahHdPRUgo^x9kOtn#LJcpXm`p+G3mSt=FJhSvLSj%9wEs&48e47G8)Wu_
z9N#?I`aj4_^EvkZpiWnNQ-cC11A{^wIt*)34-x=vHp{+aX9*6*D8^j#D6SnZ<fXcu
zXEH=U#au!Ag+XdTmn^)97SIH#?{Bbj1c`yz{0#y!ps0dc^a`{D8KRc|B4~FtNS%q4
z0O(XWOZS-!F0UVQKQZBEsAoyPYv&58*1$)`9kDY^K5gfiea9{^`>tK&i)j8xkRd1T
z>?~AnVPNp+WPIS!#rT5f1w&-Bje>(mE8_=<0~uJ&qqq%T$V)1}i001(>3Jb9FAK61
zgh3X9LIUK_*AMx7K&$*fC4~8{dOJhVX}BQE(vR7>zKG_l%syrp2+{<KcaR2m*gDOJ
z{4$`T1ms|lVW0t;*AMx=fE|3yE)Z;KH1AK4Ss?wOvePt*f$h43j9kWL_6?viG~*8Y
z4v#zR8tn}V2^_PySd{Ax`54VDxuC%;S7{!_y&?OkJ?KCr22ebCSn*mwPLLJ_uO<Qw
zI=+yXpKET(l>zGCfkul!{X0<K4&)%NX%?W3iLoZ43<>-m0^9jL1a|P73$0kUG5#*U
zh0ux@@=U4Vj)tQBe-29}hV2XF84HE#ZwWQ39~2PdzYeCut*(cQ>mL*n=RYVgmH(u`
zH2#}l@d*AKU|QT-+<k`rK_LnLg90=8PYTSky6!Fk<<H?iDKMAo4wnpQ<s)|tmken3
z0@S|dkYaKIEo$VDVhZJuWD0>D$PZfN$aCuZq8-_n?GJWKHlLWj!iX`)<g$$P2M!UY
zDE>QOE5$C0Nq*oEV~TwJU*aLCX$F!5@h|P={POxCn+Hg2dXE{Sw5tJ!EK>}(2$x9H
ztOWw*`|baCi*&9q-(&w5H0jSB!Xg6F2Gaiezl0*_@Nf_tBzA2sm%!_XtQ}lim_k8D
zNlx!IWn@=q+O<Hye2e}6ZqWt~^S$<eL5tw8&EW#Ac4pw-!W0WyPs-Qzv%!HwoGAp9
ziaBH_^GQq9gAQK0)L{AH(v+DWOp+NCE;U&FxHM(f50hjDflCe6HJ7H$t}#hw;JDOa
zz3<YL+51eA8CWh&k-pE>%);E0pz>i#DT71T&jlKw?GM~i9pG&d%~JDaLEZz2y^xn@
z1!bIm1_ce!WIAYz%Ik;B;04PZvP{$aO&DERA53dzu$z9vgi*O(5)?#Wzlt+OUfRp~
z?e#+@@Um+DyWk)WxBBKj9UAN4SZ%ts02G!X++ti}O}C(7Dc1VId<!@%L%73O#K0@6
z#h9XA{}+h_hou-(6iDpaT~Jsu9^l%>6bdnadX*`olngj9w;=_l7*i~0HxMi!>lu?J
z9HvcWaJVkPz`$54;c!_@`UC$pumi;|H!z4?7MBF43y>uswXgpROJ147zyS7`EK>+b
z{PjbI29REe#RA~ue8GW13>0!u54Q536leqK=a|M6cIgV|uV%Le2G<rb*fVfTaY;41
zL8Dx%`2{%Th%m))++q;{84j}O^?xD5OV=O?6eI>tIS=ILa9x?+WyYvf4^DX?Uy3vb
zfRl_EQ!MDPH&E((Aur?0y@x3V<iIJ(40e|l7(_r0x%M6EVFm^kt|v?`7p5UR4zlyY
zbjc4OyI%hnWCW=PiGePZxd!sQI8)^72XZMOGx_fd)q^rK%-8Zrz6M7tNHf=brufU>
zIR7^9T3~Q(2Ll7gTrSyWP&%Jt|G#5y;|=pU;B+3t9gFbv<!{m-UjG*WPrQRI7iWru
zcwDxG>k3l{BD9U*rN?yslL9lEW-QR+n8GE}G-H8)`8NCi9a9>9z(R%pDkN&Be=uhh
zHNNIPP5+>f7_8Xonz}#(<l5^_3=GX-3lu=9oogz%=HvqHY69^=xv&0(yjUnG$AkKN
zpwtS=8Xy~A$jgX=;`4>PoGQqRFXUy`g47|ENg>cO$%#XfDGXF5aY!<Sf-VXHl}o3-
zFWLYtmKJeHFvWnHtCt%rKU|(O^Mlzn28GKFRzEJ!nN|P8>>7i><p%4T%X4Pem|bJw
zxZGg9@A914`^>I^Pwc<XJ&i@|)HQ_&P^mWU4&=0+X;&B=uI*%CU@Vbvxa`0n0-8Mq
z6+NJoe<g~60i+g`+F>Oicy9nGqW|+81ZQPYNLITL%f<QS^#ds#kl^$SmW&cMO>-A0
zf&AGtcYy%62$v|gNC)V8gb?m6i0FL%pGWY56M7n!teJksl2Jwjp9zd*peb7hhD!|$
zvY_D4;E-a9Z~8fZFNYLUEQdH#D7fTXVEN(FR%pq$!0N}Pt<aKhfpyKLt<aKhf%U#i
zTcIW2R_Xg(i@_z|hAF8Gc3eMKG`wJ7-_<SEzKKJODF!sM3bL%epFzQZLxL$3UgSLx
zp9AtaXj&B{4vM2oP|HDabO~xXD2gsYEeA!>C8*_~D7pl)d>bf=7S5P<n8ATthDGGE
zsN@Gw6u^UDgei(clu0u3^?y!Hu!RtT$P2Nc;1`=RUBa4C-V!<7<-y@D&jbl~QKm>x
zwt4-Zqw+!wG~7jDSxEHB^ag82`TFUgA_5$Bv%pa&12#g2DddH`Oe{!l+93uz#v}<y
z`Is!>a9LjZ1OI(UCc50fAP#ai_~1)XP+iGh2vQ3!A3=v<$})v>fW#k&Tmj`PM2-y?
zztq4WuYWKBT<3%9aInS@1_qA#Od*%1bN*_MU0}eyi$w;MpPFMA2yjbr$#Y9}G=K(x
zK;oCCOMd{(FoG@k&jwzL0pf#-2(Z`#;Wu1grk}H9l&Wu<yXQJ6ErLA?Nu%(vdLb_}
z7bM4+D&a6Cg~0(_E~ZF0TxMWk;(Em7bRi5;E?!n(5WV0g`2n0Y*q9<gdS3r$O}q{&
z6G7Pn<Y6{Y*(h`dw2~g`;d*e{c&ULw6jXphYXnHym@47GJ(VdGlm{<uhnA017#KKW
zA?2gl9sB<su}u<Y*X;j-#&fx2S!6&%9Uzas{?Aeft^#G4qCjHTLCuK=f_J#~FvUPE
z2HUHDa5|SABcB9E43|tZsEM-G{yzu!m~loY4pFAq=>~R;77pE06~JX5*R&m=Sr;L0
zF&0^lP*!<Ryn!|baBpD|<^IDeb7=vC2*_*K_b@Pk<hbTC#a?b;kOAivZV?uFu0O0|
zFXSamL750t>VigUKvutymwgKI7N{%)tu8SUW;m36*j_RFlHJPei*_5cFWBwOK5ut0
z`<&g$?6Y<kv(MPw%sy@RF#D9<%j}bOAG1%`{medY&zOD8o-_NXy<qkcdr5u|fmWUc
z0y52$8x=UDnChKPgc<fVPwoIMM_AB2S>*$04`B0THPG=T4&9R#gZKjkWZK&lK%>S?
zpo_*|FtB$)X4u$Y^|z>iZnI(VK4cr|eaUX6_eHyn-WTk4dY`vD=zY%ar1x37i{5AK
zZhD`#d+2@2?xpuhyN}){?0$M5w`cS|X3yz;bh6e2?s^G<rRMi+8%=~6*_tOSRG0`c
zNHkAw1l`g2sClwFs7w2-d9s2B<O+^75dQ)9WYCNk+pFfuZ4M^F3{Omi8JwCYtKEPe
z&JaV2izdrVkgK<CG@s1y0Mse$OPcQvy6VwHgps3rioGt#Nb{3+sh}CD7vYRgK`YHp
z+;Qr1Si(@?u!^AwvU^kH;EPbsy&lUMGR#ldP6REn<0%n{0u8HQxG4=fo<#vP5CS{-
z(?mu=CH;==Or-=a#S43+A7&fhv0ZrKnDhtpJ9dt*|1&&HK4LpD`;P5P&@LFRTBhLa
zJGMW~@7Ny9zH9q1`?BrF<Wsh*r@wJyl&%N0|6E>#vVrexYi}^vpxnTqpxnR!I{SX7
z$xns`&~XnYoD2dl!ddQ`ykJN$dCt&b!o~nPigGi@W)|VLgjjnMA<!aqp{pRZoHk6t
zkb{&2oL+<rtp$x)gYb)Rp{X1)OfKGcY!^1nvAGTkqn3uSeDLxd6Dv-S7vU_jpn*kD
z@c@cLaLQ>>0IjM4U24Jhf`QQpG&D<0+)Ngkpr|d%G#8XEh*e)N!DtIo|3Y3q7BtKU
zvLCci9X6xc-k|5@v5cVtJPsZ%yVK+*L&J$VaiEB80FQ5nGO&V{@A4cG;xdu3cjUPv
z!~$B@3+jmT+!12CFh}YK&mAEiP{h9eC(8<28k~I>yftb%NPqo{2nq0ocI^#S`k>Hx
zAulBh3JCK#cK_R(ngz^H*g2Y?ww<U{pvP!d%;NxCdD=YL@;pc#Xo)*0wShKUc2Bmo
z2L+bL9)<+|27y^G!g)XkrSgH6d|Ypkkpgw%n<rbwL+p|CH4$R04|x&6vlO(u417e5
z5Ca2G0l3Hi8xaCJULfC_-?Vdl5e_-3?8KZHPzXqXE$R?x1Nj6rWC5DveGw}A(Bv2c
zOY#xh=@;h6y-2=eI}=oHf<gy;kYqS#W%3={x#l-*C%%ZNX8|8|c`9bX4v?Z35zM`y
zbaN_Z!3+@J{HUFy`3bv7o&^F?;A9dib`o?nO~(rR`yjCw;as3&Q=?vl%g=@Ab5OVx
zDgD1)LBYf17X#CaaITdmLiT?_X1xgK=roaH5NLBSPvsB-4bO@Dn$!z1NVGKA@8@7)
z3Id(|%smNos)zkt6CwNGpuz1I5rUDRAO#(7#392J<gkpPz+ojr5hP<vE(D!AcH&Qz
zFG!8Y5{8Tyq4F!Q+RHpoK55sAm=oca0L6dy0o$1%Pnch}OMU%M;%oM0+ne>-mu-K7
zwwH3xWr_tkAo-46J802e@*TVGE62D5lJD4cDmO4301Y{1-?3e2e#fr$%6<9!*>`ML
zf^w`mcu}V9M&$_%AC(qxF=XGdJqVguGd~P23{EOHFg!4y!oUL7f7y;xDS;s&`;MI=
zXw1$0j$M6c_GLTJ;pwjCm+iW<@7QT7H#9S5AG4j9eZqEU_7&TU*;j2JW*@M9nSI6f
zWA<G;#_Y@Bv;PgV57=402xHp{T4oN~&115Zfum!E{Z*5h3=uEFS$Bdi$upVB5cMLQ
zb>W37sUIdY8Dd_9vvyvnk_55iE>ubUFln!6ka!W!nrPC&&|=cU&;~ld%Y==A>qR&_
z=zb7TSs3*qoE>zEFKC<u#1;gd3<o+d19TQnPlDxAPE{t>o&^dL&UfrOUxdnnuVZ~7
zFJJC_*{&Ou(z$AwVn8XMdy+;2B*zGYuC0%8Sk6%3P`?Himtuk(+)R-t?u6|HB_vQ>
znshQKfC}yx;Vg<K?F`@vkQd=BoS+`LNf(30i*VMTpwT4In6F6(g8(Qkya;DLd9{aQ
zDR{I|2y{8M^l#2NOfkuKY$x-1Ge|+zG=kP0^+nj<uLlc)Zqy8Cjx>>CXfa`BU@)1?
z&;UAf(}bIW!-R)H!GxEA#e|Q6&4i!9!9;+;fa9pfL=!<!>Sp=L!O0XgVSxf@MMcw#
zaF&}O2XX#k66tHOaOIML9pb|z)ux~z07``Y4hkBe+yF|5CQ=ObN-x5hGCBB|Twln`
z$Ac2$>wm&$voG7t1f}Q~p;D3@vP`bockC8k*d_hrML3fnsC2uqOX|mqaK@h|GZ{E8
z?2-hrADYZ$C@`7HFyTeGgrxT^yP4oJC0v5hWF|w0_Z_>1CQ=M+pdob=DMq#z;f#$Y
zGZ`8<*z1`hO{5qVUW79yLQV>k3-4K^V8l5GlnoU&c;B>}2tFYuoKca37vxAe@s=fa
zpfVz|XPH6)XAR7UpoGQ*K4KbFAH4`?ItfZA9PCVy6F?j3gculJgfq-Ekz!DJA<th5
z&i|p3g`gw3xn9W2=0ozc5Ht-09R>N`V+r^IY0$>|D3|371usHH98Dw`K&QX4@yroo
z00ko`tMbedVgXIII_zO6;h7`E;jo9HjAxDz7f*>m7>5{B6sSM@`k$aG=m-(e-4fts
zKU*b!@XQzDak#ui^26oLQZEvwGH6`hEBzy33WFBt=G27A3_2i%33D0rxMy;S^LI0V
zuGnMho^OAb?}rdW+X01!3v(oXOuymE7+TNH6a}tnT7<-2go{@4%n=ef6|<HdlH7Uz
zg1no3$9AW31J^?C7SQd4{I=OgY(KsT6}t$ky<W)khrf{LS!yE0zy@kKDzhvAUB}1(
zD%W3x3hq>PR$wrJT`3hRIMe)=y&z~G1!yo3v}M%*qzQDG!;5gXtDsKQi*U({AR4st
zf`gF>W%cfhXc67%9A1p7?8ognLDOr~b-WlQ<&W75z6j$uYtq8V1B$txgoLgOY0@7+
zG58{k=kN3kFGkh)FbQ6;d&615=eB`n`ZAQ65?;j1g@UZ>N>u<~Gt}Q;zZ84{L>T*9
zumSS&vLHi2?ghmd#JP+NApH)eOfx|DZGonKroZrFRH(n+AR~Wyvh)YgaWBci3_-~;
z3;|7B6dasm7%ZBnfKO>)NDg5D%~?7nhcH+rhcMW@U|^h(P{Uw1xnTm|3kJa;NOjG3
z0ajgu(m+BD1NgoY2V=&Fgc=5`zB&bggc=4L@CG><1~<@g9|^?_t_mP$nFup1NGN7d
zGErn&U?R-WmQc)~Vj|42BB7W;4V2gtiW!Vdgc(>smL?Q47$np%Xe87yXeHDz=p@uI
z=uO|^&1k^GQ!FF`x;DtchCyvQiw|SCx`&Af$QQ~BOxPHVK&~<oX5ir2BgDY7S%`^e
zj}XfX24)SOJ=5!a7?(2EPFL||G-d^D_hpzK<I5N;51IgEVTw9&XD?)QUk2hOo;^ZL
zAeT<R;mc^s94VkWUBHh~o^k1P13$)Y#!1un_%Z6+f&$ElUqe8KUrRt3bap4`9M8VA
zMkam(0g-D{I63%@1Y|%d2DHw@!GwFqqz3SrK#SU16fR6x@n=-D4&^ol6$hv1ELi1z
z*<KKIKp^PEWS+@F4m=G)E(r+?76}QUyCKDE6A~C~%;(tEgBHs5x6BWpUgOUwZ76S6
z4Bp)e+IwUKnnMEBm7vC2f(;XB$2LQ941+~-49Ezvv&k_GHq%e|Gn%vBFp*&}nijxV
z4PkAs31DPpln&#Z$UT!O^7Nbqn@ofm1VGWoGZ`8Xa{?Kim0J^v8EimW!Al557+82F
z3o-Ca5n|$*ECf0+v6pA^^nZbjXQCK8xo0qe&N5_xc>(177xF@)3B?R{phhVuy!eB_
zCk}If!VMI4d?i9mpgA<Y8X*?G8X-2A+d=MrA<zHUM23NFx<WAH%=$1^K~SDOJ!kj-
z%abL*t#1!wrVTITrLSfbGiZPo+g~b{dXXH=5O96Ij66tlatuQdEWf;PH~_vF29$3+
zte8%KR?mX&vCXhzI`KkU8hq$0DF1=vL7@POBe1*zSUynzBniR{P_W%5gwcg(`UNef
zhV2arj3SIYpx%Rt2nPe-1EC4q7bG%rGBQrszAA~4i?JRw_|A2QMWktqLlZxPPy@tO
z3=G#Nb0oizmpu#G$-!036$9FR4O&JC+I`Jc%mq4nZtC^P98NFfWm}>0rPn8OD7K|3
zfI2`SlM)O-=Pe8Mr6@RX$TG!)&Q|7c6A<BV5s<(BpOXVLn#$iKuw6fe(U56!GM~)y
zgfzyk=?xzkxoszWU=V2dz#vfYfk7bQ1A{=o2L=I$4-5hZ9*#aCAWwc^Y_j;k*j)30
zvAN^}V{^_2#^#g{jLi`r7@K{jpZLJIjn$<l%-wPN@{f$N-0ne+0Un;t!5W5|)B8U%
zN=`rWkx_{$Qf2y!kBm`D-3=cYx|Tq2uLgwf4uQ}h@gAS)DW4dh2k&qXc8>Q5aAa`t
z^z#QZ7#JYzP{*JUr~p_l*g4n}%6AS31+#ozef@(X!Au5(^z?b38BOW~V44|x9D_aM
zeH{HD>KGV8{k;AB!~GOMwz~QR`9~&0WWa0-B(@O}+W^9L3=RqMk4LtbfdL{0GK~RZ
zm%Cd;ycvWK5eNu2^7V%}8SI#VU?XoQ7qE$7zGJA1C&csH+rKb6GcxIkOh5CLF`aS8
zbdzt4d2Fcy9~jdmrtkR17-ho1;F4OFnVibN;1cGd@9d%womi5nnxd<kVx^#3tl${p
z7~rX^nxddu9LvDK0Fj$+`HfL+I?s2;0-M}|5(U+Q00q?)E7cSR28Is|+opVA*goY0
z!)}%jj9CUB7_<I-V9ZVUz?e7T17qHr4~zvLJ}?&E_`p~sGX2bV#vnFDj}HurHq%vp
zFm7|YUGah8PQnL<+dDom+~WDba614(gV==d?K>YBZhzP=^OJESqew|&QHg?oK}lwQ
zo<fknuR?HgV&3$VzZn15hh(HGgcOw)m!zgB1mq-^q~#aoD){E7l;)%=XoLj#YAR$F
zD<mppBo?KVCl;kDq<}+5Au~^*BqOs}AvZBOBQq~mkIS<}AvrNmAtN=XK%p$PC^M~6
zp(G<!Av3QeHN7aaq*5V2O`*85xFj`Kp*TOS1Z0*T7Z*c4Lr8!x$cnuD5{2^oqU_AP
zbcN*nqN3E~lAKCCE(QiJkPDMbi;7b7N)(Dq5=&A+MuE(R=(OTuU{FwS%}Y$mNd<+t
zf`UtCF_fc_n3tlEm|T)smdXXnfM9+~Dp(}3BsB$OKZAmTe|cVNQE^6QfkH-Nu|iU6
zYMw$#Vs>gC7ls_jm8kNL3Z=!VMPR>!^eE)R&B{*$hd@YxFUXvbM6lP;rRx<yzJObs
z0(CmrwOoGrC8<^lA^8fqiP@<jdq6%<%*jzmE6qy=#bshnW=W+E%o>H<(&7?@q*R4e
zNML|{3-)U&C?FZQ9Lo|jb3j3(kPl7@#R`e_MX8_wWMEK8(SrpX%sj9o6w34zT;L&w
zkWwhnQwS(ZEd#|$W?pegVopvX$Vp%)=0So1WPn1ko`PdePJX!pR#o+RsYP523W<6O
zj-Y4)#V#~z!J1R`pfQVNak8F*b53ev5yTEqw1Jc|aCxRF<mD?QXC&sOr-D*cN@{Ut
zQEG}pevv{ZC@MgyH8rnPp**ozp(r&mIU_YiA*sGnAvd!a6mvQX1x2aF#R{&$&I%>@
zTt%r#`S~SaYvE~}0i0M<@>7cyKnWouu`E>~5$acP2s40Fl0tE5a&l^Maaw6kPNhOJ
z$gQa<dR&qDr3&SlIXMb>si`RnCHdfJs?SN)2S*W-&lM8W6EpKbxr2ehzd!+0@;K%x
zq!tzB7b)Z?gR?@4m4ZQqY6TaAAuKS!$&7))NKe5T5&~dTQxyW7gA|ey^RkP%7`Q_6
z)6;WOp&0@qQxB3-NUDT*9+dg=N^_G^ixjd`E4e`7ssOfMwHTazG@vO<lYxQDHQ3oo
zp(wSav?vecnS!F!vdsL_Vuf6A7-yDb<d>E}W22ahfx%Hh!3ttC$fw1rIjP_jTo1B?
z!8tJ}2V}RWUx<RCWd_3sM#i2Gj0`Q<G2;VFamE`T7#UxDU}XI8fsu*f10$2n2Sz59
z4~$F}9~hZjJ}~^}0Aog`8y^^%UVLEW-tvKwH{b&!JI{{~jJz>i(?9-Z6rT2nk!9K+
z#z<jC!3Q50g<3u^3OPV=&Gwu>jJ1sQjPh4LFp9KbVg-p0j0y%H7!_O~atb~W8d<Hv
z5>zpT9T2`~$p=Q!7athK=6qlj@A$wd@!$iaWX=ah$rB$Kr35}ON{4)4l)mzTQ6{GT
z1Eb6nh$fK1AdRvn9~i;(1PBdg-}%5Om-2y8z6YXKECM1YzUBj?*qINE;vYURN_c!=
zl*obNmJf^)8$K{ffB3*Cqw;}KX3qykiJA|LGCm&|Why=}%FKX@If4XFd|*_#0x<|=
z7%r@6@PSd$2BA*j%?CzBmhBq<8ABMS&R|-@>TGOoV6fehk;#FP(PDZN6O$dI#q@(r
zOj(R3+jW?k1en;|!a>cB>2|D4@=*5ncvdDEW+u1r>D3%emW&M3H*+u@R%`t6fw7h6
z17pL14~)$>J}@@1d|+$=iLrcOY~AsJvGvXeCY}S^uW&NGU{WyFGtx6uFfuSQHZV7`
zP|yfUO;PYjEKzVS$}cWfFf^WihlfeF-ayw_FD=>Fl7WGtI5jaTGrw3jqo5#Bx6IH~
z*W6q;-7wkI&@9Qs0#wH{>A8Gh(hK>(q?ho4NiX9AlU~UOCcTCaOnMz3nDnN6VA5Og
zfk|)02PVBOADHxxd|*<PfndEWADHwWK-q6TFzNmIz@*Refk~gI{sWV~$Ok5U6^Nw1
z3514eq&Zy=bs;ep>AQSj(hq?+P(R}XlYR+=jjmU}1-m%9IuO4eL<}IVhsO~yj?ka*
zfk}VP2PXX$5FhGqfY2bl`UgHR>7Rh`_3wOO(*FQq8?by}G7$N|WT5ha$-v|TlYz|#
zCIg=jOa|bPbosz!kOEN%GK3Ut01bYFmhC(EnMxSNU0lQBGmGQ%QcFM$toRgg3yy(d
zdVe;%m;|Uh0Ff^)$uCMwPld{F*A!%0$!u*f;RBPwln+b>b3QN`Ecw7>u;Bxf!JZFH
z21h<H8JxhIGp6&3G8xvpuVG+lXk%a~6!`!D|9?;|@__*+rYV6C^JjplD-d8{U}OY|
ze_*ikfru3fB8!3KKo}vG4cdn$!oa}b#=yYA0FwK_Q2l{{K|q9|o&jVjvLM(o!XQNu
z$2dbBsA+%@bFpAx5Xfd=U=U|u_zyJ@)HMK$DWQrrv_bSSL)E380GSKJlXLkv61cdy
zxfxg(L6Lpo1A|cu12>bx2PT6X9~iVc7<gC=J}?<P_`slR!obVn@PWzT#Rmr6B@99W
zAT=Mr2B|B6*gwE*4F`h{Ool9Awq}FF2PQ*-=}W|zG&DfY0AWP9Y!qQ&5MW|paGnSe
z2X#k;*Gx|26Q6!wjL9T+3J2H}5WzQtfq`!a2Ppi&m~RgQ1OF5bHU^Lq2?hrK84L{k
z2cYr{3=I577#IY$aIk>o1sE6vb}%pq+yE&Cna02%aA$ghIFoXH0zybIg@Hk^0g2zj
zz#s^+5~71aa1R56kOBuI*hmfr1|by&1|c7WdZ7RY2B97#{saaFp(9BA6ATQ(G6=q~
z0s}+6umh5S3j>321`<DqfkAi$5`PT?gYX(8{ssmH;S)&wGYkwOAlE^KL|7OYL<|sN
zB4Wb8AQAzUWME(riD9T`5Ltrok;n=L2C)tfZjc!a0t^gdJq!#|8#n~Od<g~ysVxi)
z(i#W@q;(h=q>&sfox{K&{eXiNtX_bDLHY>;gNzR}5;zzbWC9o%WO@+x$xNtcV37HO
zFi_?P1A}Y=2Q%0J4h9C<6b1%4Bp=9`Ffho~Ak@n>Ffb^XaPWfF3otM!Sb#bT2ziAJ
z1_p&3Bz^${gQ5U}uUId_z@Ug^fuacmgQ5kJ0viSfMHeK#2Lpp*3=%(qfk6?;L5d9w
z42oxv<S#HVC?T1rWW&Iq+{3{Eb8x-#1O^6Wq;#%4gMmRADbXqKVPH@OrE6#+R6fGM
zpmGNhq$&>>7*v;VFu@E|UBSSh`UV=r0t^hQ9~c<aRzUd@3=C>(7#P&<z#Ul6p!R@)
zK|KU6z@Q$%z@WYXnrJu}7}U2gFsLI%k@^n?1`P+OfgB7B8ZHbB8b=Tg(m27ups9k8
z*VJHO&;*4L$O;Yy2F(Tr22D_+1@Rf`85lIrFfeGfKy$JH1E|Ph&|%<U2m8o?fkB6b
zfkD>*DxbgrDux(z7a)AByM%#3PXNK!6JcP`^FcU3FMxqTUjdOQ^;H-c3_PIf>m3*v
z415?E3<ID75)2H6Aq)&g4Nwa$7(nGAgV7JDyZ{4((H{l|QwwOW5MW?1wP9c|tAQq3
z3kC+W1_lOm39$FTk!CK#z+k=s5klr$7#Pf<<w8A3h4~2v26IrHK=qhEU|_J|KtzEB
z4+Db*QX;i5VPLR$0JV^Vfx+Sl1B0av!pD{l3=EbjNc;>21}hJQ13=Z5RRdVQ9$c7O
zwJ<PPBPp=<VPLS4Kv-ZS!@yv31&M!yfx)%~5u~;q3=DQE2n*~q7#Qr3)Z5))V6giG
z^$-ICgFOgu0qF<%Ux0zZeg^}CLkq$JhYkh?rwbfB;4~n>z~FR+fx&qN!U9m8=wbqm
z5)K9iP<`l90rnBtLoPK846Z3q^#TkGt{Dsrt|t)cUC%HuxOH%_Fw}#BT!4YWt%rfZ
z-2$P&-G+g|9aOf1<QW(k+yfXG+>wf6Pz%8$0AYbg2m^!15~yMZ1_qB63=AF@pg!hc
zVDPxYz~JcuRnNh|;OW7@;JJYVl>R{}fPukt3j>2!2{h3OFfe#kFfe${Kp5aPhk?Oc
z2jN3+0|o}~1qchhmoPB+AQdb=6Bro$t{_6t?*;>dA5s*6nlk|!9QE+BIzWekA&><c
z1p*8VfgB7BfglG!+{X|&hk+pwlxjhCg5*vxFa#mhhCwO}3_&Fb2L@FzFa&)-;(uXa
z2;PAR;ov<C48eau;SVxUfPn!t0v%F=2%?Y%28NI)2m?Z1FffEJ03{j*22kY`x`crt
zVhc3HBp4VXb}%qRDj+O~RAFF<oPfli!oU#u0UDwV3=EN97#O1JLD>rGLr?=MDgdD%
zDujU{3g%(~28O6T3=Gk*l1+etAzFihAsQ*sMt3kU#7ICb6kuS8kzrtnNrCb?7#LzQ
z7#Lz6AUqWFgn^+x7FKX@Ffhb6Ffhb{8YIvViA!N%h`WH$5O;-vA$|%pge({s;%6{0
z#NR<!5dVOIA)x^30S*R+gc1gZgaZiu2}c+h5_zCe%)!8rD8Nw9khlg(U;_g~k_f`U
zBnbwFBo~AMNgfOgNk}DG(iR4WBv>kEU|>kP!oZO91LS&0kS6_MU`SR$@RKzd7?N$E
z4rE|pNOq`aU`XD8a6s}F28QH22n&-RFfgQ)AmTiwf`K9B144bu7Y2q@q>?Yyfq@~l
z2BAN-fq^0Q2*N|4wr{!sG|dPwFr<U(|LiA-vK-V>&whb$arPSqhTJ_Ie6WHj_W%P!
zE=V4#B=-#iLqP|kJ}>BDU?|*!u%Pe&14FR|f?sUIz)+%s;MbREFff!9AY5Eh!oW}h
zYU6<{;9y`V*}%Y1CIYPu1sE90Bp4XVjvx#uJHfzEeg&E)1Q-~~Z!j=a6hK2rfPtZ+
zgn^;52cf=l0s}+!8xBsWhw8!okQyFDoYV*~Fw~xaIw*sIq4o>|LmdlLo`Zp*j)Q@r
zVF|Qgv0z|mSi!*10BRpV9o+DPfuXSh>L3mVhQ<~Kh9(85eg+1HCKU#TrVOb09Q6zg
zO*sq<O-~SU)bxUZq4@>E#m#RR7+QLuKH^|tXqmvk&}slPfPtaagn^+ImTMRo7+O;p
z7+TjL%xm4iz|aaxlu!q@{$XHf12ySDd{Ft*=E1<wHUnW`+Z+al&JctTIwKeudgnmX
zhy(*e?*ayfUQky8WB>;PL+>31hJFU9g#ru={VWU&{jfv_;-3H=hzK=bfPrCx4+F!b
z1rUBcC>|y)VPKeS0`;K)1H)ts28QW9&^T9MV3<CEfni1u)IkCa3^PFdKTrz|7#L<U
zFfh!_LE;xMFwBDGa{~s3Spp0UvtZdA#NWWcFdI_c*Mp1F****m^DjVCaRdXy{3{F$
zi%g(Cp1{Dc$bx}kaSlAuFf1-$U|13Zbr1&w!;%CBh9wgaalB*-1H+O(5Fdg(xRil`
zVJRpLK#B#1r78>zOJhI|2G#!@3=B&X7#Nm)fm$fRz_9EG1H-Bn5DOUv7#LQqVPIIj
z01`qV{^}(R3~N*%e2@ieG#D5*q(D0^2@DJyG8h;(3Lwf2P)BnU3)H~^3=Eq%7#KEd
zaInJb|IIoK4BI9^4NzcU*fxcMVfzGx0o$iAFzi6$@0h~Cu$zH{A7nYh3<ieXEDQ|0
ze<0NF{=>j<^a9jF3JeTKuP`tiLu%3;<6&Sp$-p51j(<>Xc9MmG;mQ((hAS%=7_Pty
z8V&}AD{mMWu7aBB&_s7Nf`Q>GsG|YnUtnOk2I^=)`PXb17_NPQ`j~@(;o27lhU+kS
z1_p-fHVh2cGdSwuz1izI3=G#ny<d<4AO$T93^y`3ARTN028J6s3=B86K;xK$f#Jpu
z28O#|pyhxB1H;`P3=9th5GCaU5e9|_NJaUB2Mi3496)gnslFe%FfcrNQ4ftn0S1Og
zZx|SP_dr9yfPs<s00Sd0ti{5?z{tnIz$oYg4PprfM!^6EMj=oe4&-1C21cPC21X%7
z$;l|Rfq@ZpcMdp;K=M}@7==sVA;KtJ!N4e753Aof7#M~3Ffb~1z<tc9*u%i6ngDf>
z1OuaL3In6v5h!1Sfibp+fiWWo!OtjQV9WqD$v_SgU|`Hx!oZmE03KqD8BZ7(GiM;o
z&z!@+Sf2^f0Ld1NnM)WLiylB-D8Rs2^n`)22$Tk(@<neL7>nM3Oa}`v7JXn~EC%&v
zAwrDBA`Fbhpau<;-*A9|u@O`>gOxKdHvV8>Yyt-dSb(vKg`u9Y`3gie0|NtN^9=^Z
z79<TVKNuKWku<cjFfg`)QZZOR17j->17j;FO~Cj&7#LeYB_oV~hk>yb6ao-F6VCw#
zCLTm*ma*7@g@LiOW%?3zCbfE17X}6<4~R-oj$qLF|6jd<fq@A!lmsrQ7##lp`>=$8
zfzbs?9Rp)k5CaPf6QeYb97tGzfq_Bd|9_@03=9l0AOQvj1_cHNka^5D3=C`>3{HYf
z)lR|%Z49ohj4e#f%pgUekq8C`hJgS7ITaWfSYI%>2p0%4Rkty?LDevpPGDdxp8#_q
z1Ebvu21W-C1iyR%17o!af*<I>z=+g>W(=Iez!<&&8oeA0jNwZd7-QiHc=`ctCWY+=
zhD^^Hr`zi=8GzQAOqgD+%_PkKXTb-?_YEHyk0*R!Y<FmwzD|oteEJq`rW)q|KMqV^
zuf?P*@c%*p$P+NkG5uj4qXP5)3jxz>g22)ZFewlXk)HlRhe<&8{|^HOknaB%3K;%h
zP+$NJ;{CtS!0`V<Bg6mc0@E24rY96I3Uhp5%8&WLls9KOhc44GuA~Pan34lNFeMvI
z4=iBRn5M_X#+8)tfhp<22d1PAU@?IY0tpNsm=Yg+U`h)3z?1}0IlTa+G%?`=Q{sgW
zOo?!%0Sq6Q5*~bDN(}hGln7P&0Hib_;R92`g%3;#aHS3mADH4Fd|*ll_`s9^Q7Z63
zU;#)p;R93rg%3>eaJ3B#ADH4Ed|-+X_`nnoQ9J#BJ`)>PT*3#YxC<Yc;-E_ZfaghK
zAADen3;4hk2T>~UL4kqc15<3m2d3ByADCjHYCk9lFnnN&dGLWLHsAwOEL^PuNHpOC
zQ_O`AOfgWk|9?MV_`nqX-~&@kzz3!nsM`O(KY&CNJ}^aJ_`npsVY{Ls({g4G29^af
zj0_B%)6bhSd0Id@42%p6439rEFo9wYG_on^ogE|SCHsPbfx!wY2Bs1gfGC!R=@(3y
zJQSe3MqIk5?=WRbn0~^PNt}}(X5w@UGp2;;9%fA93UDz71_oD<xiHMAAjQqV&^P_O
zIg_V3lmm9++r3zw2+OHp{Y(uY%@e?y6`&lPny2qD2f5IkNt_qiH9ph#m@~ypKVgpM
zN*}NdP=cwUfs28m861%2P!8B4907?%b2YN&YJ8fVp_YOvh-D>U%?eNsPR-LTtUv*7
zg%SxnKw>9Q#Vo8r>a0=Kfy7Rridooz)Y&kJ*CPj65ZGl53=EbA1_t`(7N+{(sZEe*
z>;VP_mPQbZfq{Xkyl8ca00RSPP#;t)Y+_(w0AWT324+SE1}4yq1N#RC1_=fp28M|Z
z3JlN~cVGYsFfcGONH8#L1c@_<f{k=wU`PNlK#A}J1Ftfuu#%WQUzdr4@xycnTP6j8
ze-}VGEKlJBQ{IFROnC+1qJ#h6Wsqp@f)7l20w0)irwdMJl%HI{$0hLZGANVfDtutd
zo$!Gv7p@$X&vO=hV9FKvz?6fm`~brTrW}P2OgR%iFy%m$3;est#PESBTj2v!_Jj{i
z*$`1sX~@F!fvNn$2c`;#4@?yb5U2eA4RT8Mf)7kN0w0*N!DfSs=^4x*avLK%=K*;~
zP@X-g#pE@8Lnb5J^b!*mNpX-R4B){iPyjG6#2#R9U|?XGE;x_TdU63DKSb$8V;0Hj
zFI<@frf)Q237Eb<laY;yi*0fupM=1_%LhO@VcDJmp@NZXx?vELxDW%wzsulq9gCXj
z&kb3mz`+HISCBy<j4)%miy@1YI4GQv<s%e85y?Fr?5qn~Ook9wx)`!Za)4qA<e}*Y
zY?w}Q)m`|&RPXSCsU8wc0{?%2f~hXx15@3B4@`9nz=0<Ks$4!W)n53(ROj%4sSd6d
z6f3m>ADC(nd|;}Ds1^SYP6;&^J}}ifd|;{t)!0n`FC3U2c$iTUT)%x_stNeORCC}1
zQw>Cm!2b)N8m9Wf2c{Z_4@@;M<1Z92d|;{$_`p<s-~&@NM6EQaZu`Jgb>Rb3wZjLd
zYN+u74F4|}OitvJ75IMvRIgM8d|;|N@PVlcqDuf&6MkT-yzqgk%Hac372JkKh7U}Y
z0Uwwu4}4&%gsS}ou0kp<d|;|{_`p;NRSRl`d|;{w_`p<g-~&?yL@kcQHeJAwiH)o5
z!Uv{uhYw8UP!s<D097|-2_KlI=6ql(gI6q|051>tz*K(V15^0|P!(dsyuHJPNr032
z|Ah(Dr~5Lw$C)*JU}%2xfx+U*2Zq2o9~c^2J}|Uy_`uNg;sZld&Ig9pKOY#{;7yhf
z3?TI_6Fx8~Px!zPc;W+t@{A7*ttlTEf>b^*SeSfZP~P)_q1EIA18AOvfnmFaACnM^
zkokiT;2~X5!2ufTWnr2=aT}w~^!YkWI@7lVF}-8Dp0j;PFp~|liMzA2m4b%5U#O;n
zA)$2+pk)xchMEl18(y=EvUA!oGH}{4LO9%dj11g*P!5qYTzrfSTzpVHC<cIJxM4C}
zdW;NQFr%?@_DthkHht4{PPyrmwlQkgbAwvW3=9mQf)SL*8W<SCsSCsgVQ>y*U|<l0
zt7B|nU|?)$U|^U4l80eXiUhI6pz4@DFbOa)FbOm;Flb)@NkB2EU<NTkZCyqNhI$64
z4@}k<7?^B8(~lqt5C#>vpms9|LluJ5`CedP@&mOLL2YDob-D<PeIGC|`GHFAJs?F;
z3^EJEL^98B4nsYYzYL^D2a*HVbRdNwjI3}C1CzfF5$g6ZF!|dMq3#R=lRv1^766SP
zfNaL$W4}8LO#Yx=05%^ZJMawylYb5li_M`S!~B8CpMinNzkz|ltOaB#11S7Kg(8$=
zi%{6w!obu93I$kvft0`sYLJ6K4rczq)Y`+q)W(Bk2C}+pB=e>)Ftv#=Ffbuc-!nn&
zXP5;wfcXPcM*{;>#~lWSy^0`{px6OQ&j%$`D4PMIjv)okXJ7z17{mpQ*nk{p0OBw(
zb%OMpfY}fNBnQIl7=#%Z*dbz|ilnoIfq~Iv`hq!};)>vI6<CU?YXt)X!x1nWLV)x#
F002<c@iPDb

diff --git a/pc-bios/hppa-firmware64.img b/pc-bios/hppa-firmware64.img
index 577b0a1b3f9239d0e5b1fa6b4397a023297fe3bc..630edc35796c5aa6e36f4f5ad8e7ab3795d59cd4 100644
GIT binary patch
literal 699872
zcmb<-^>JfjVq|7yfC454eg*~xM*IK&KYU<dXn=}3fN8G92@IS}A`A`;77VNm4h&ih
znhXpKYzzzxEMR#C28cQ+2SG7PK-e&vfrEj8ff=rkss04mKBhVk7!6U+0M!SlLC$1k
zU}0c~$TK#8)iW?Kz-X{I)2SI?nt9S*Fb(ks6V$B?3`{2s!0MTfZGh1bb&LY2Gy_LU
z$<sgv2AF*iSt3ZNIfPZdU|`wxf`Q>xfTM1ZXRx!rM?iq1LV%02f?H-$Zh2x+s)C`V
zf<|y^qLZh8utHjXQMM*SMoCFQv6a4ldS*#RX_8)Yey)B-N@`9{YLR|%YGP7mez9&w
zK|vw|GDo+}&{EexH$BB5#n{x+(g^M{M!p0F4&DS4M*IJai4qQs2_6eg6zvc9C@3)f
z|NH8KVgetdX*T1IuL(R1UlVy4m=q)&z}Q>D!8DtJgUMUMLD7Mc!PJXE;Hv`<1Jfx9
z2L=Wn1`Y-$2L=WS1qOx)1qOy03JeT46c`vR6c`vP6c`wGC@?VmP+)k#v9Lu!K?AJz
z0mo7Wi~j#6iVO@5s)~nRFfeFcSbF~f!&3<dBykI<+MNuHd<l#XBpej%|Nl2p<p1|Y
zfro+Vp@aj|1C9kuAaMmgMiWJ@178$*7#I&qI4CGEFoMhmsbhR7;lRMioA5$j{wt>!
zlNa191vy3&MP>(>9%Uy12J<KehVKqM3?9r33M&{MaCtB?1bj&3VQ5IOdk=Dpf&(9;
zi4!Bk7e^k37YPTL6ciX3OcZ$pK=$xh34P$P6#BqpA@qUAT<8Ojna~FwQ=tz$CPE*0
zjD<cZSm=T5V*uG_V#mm!TqMV6Ud`h0J&}h&p-hg^B$>703y3{OkI|%swdzYF4?{!q
z{O>#oLLU^++^UcTQqRT!QvV|104V&OUL82Vz{J3ppeSm`Xv)E5@RgB=ftNw_WUGSx
zTaeos9&oI@s3BFOU=H#(`vZ_WS{W1sOgZfTn<%nucp)!;mxGZh02Gg294sq(8B`u|
zFfe)WXb64aV1&|4P?{M^vp{K9D9r|?*`YKCl;(ueTu_=DO7lQzUMS56rTL+>0F)Ml
z(n3&L7)pykX;COG2BpQJv;>rvgwj$_S{h2rKxtVhEeECLAv6O6#|n`D85E$j1C&mH
z(hX300hB%fr5`|OMyP&9sD4JMenzN%MyP&9sD4JMenzN%Ca8WUsD37>ekQ1XCa8WU
zsD37>ekQ1XW~hE<sD5UserBkCW~hE<sD5UserBkC1_l<0{~27MbPJR|0;N@;bPAMS
z0;QjT=^_c1h9XIp2^<1UQUCwGy2S4&bfMUTp`qB5VM1{LBSUc@qd;*4V?%Ky;{?V8
zj}^rpOdF8%h4KwOM)P~j4Brp(FudSe%3*$wkwL-Tj?u)4sQ{D*UpE{8mGki8O#xgE
zFmr&?_6r4YzCfv?M&&`}<Y@SerVk#5;gUZ<Wuhqu0|%3bgaeF*wMi5?<rqylI6r{u
zLgaGgB?D@?0V_aEI2agOne0PB_2mnB`C1bxm<)tA;b35DWwIBA%G;VqF`$$`CL9bb
ztxR@TA@Xv6O{Cy$Wv~Gz91Lu&Om<VD@_S9B!0l<U9EdRCVBlzFvV+<$2eKd3b_Pj-
zu?YtQS1Xep)P6aT{aj!PC}G0Ez|+cP3$<SsWIqp73QU=BFz~f9*+T7?1=-IBmVgo_
z91H@jOtw(_WkL3%v~5i|7=&7xY@zncg6tQ9Y6Vj!91J3@Og2#aWkB|efF+=W2?v8%
zE0Yb>ei@McVo)hCWx~NA(aK~4wO<BgKdesxlb32`vVqz!1F|0_hD<mZWLlZ5q4rCI
z?3V#+gc2qk405eZ)=>MULH5f*rNER42ZKT@lQq<SX^{O2U<oK;!oi@_%47|-Um9e;
z5>yIInQ$<uv@%&i?Uw@CuL72U5+)oBYOPFGQ2V7o_Nzgqz?2CGgGMWp71Vwyko_89
z2`FL0!JyU3WCgWf3S_?)R0>R)a4_h!GFd|Hmjv0b1D1diCL9cUtxT3s`z1m4>p`W!
zlnDoeK`WCb)P6~j{RUtOC}G0EVARTF3AJAmWIv*B!N9;^!ogtD%47kxUjk&m2~;bX
zGT~q_Yh|*4+AjgJ-wZ4PB}_ONELxc?p!Q3E?6-hQfhiLX2CG&k3#k1PAp5Pr5>Uc~
zgTbbi$sB6GILLk*s1%qo;b5?9Wip4_FAlQb4lDsBI2f3sI2f2>L>xHwe0O5Cf8lU|
zfjfptW(C6oDM%ZfcLucXU{X*LU@%c+2mrPHL1ifu18>6j13V009C#SMC-8v#5#JSf
z7``*`FnoK!!@wcO<Y<16iGlx+(81!{_7{t9*&i&vX}_`fhW*0g>-G~ptn6ok`X0r%
z>>E9->?cCmg&tP+olth7hn0OJlpSb(%RbOVl7R`iTvN~l^)WaNKyFlU5@0ZKVw?bS
z56FF>wv+iidq)0)0*8Wc+g}X6VZYG)o*iQ|gF;Y)jDv>>;{=8d3kR+j^77w7eL)jO
z1_urarf_}%fuDIl88}Q7?f-W$?!OP}W4v%UzyvZ6mtTsn**6wnwJ$8bVxL%i*&gOr
zls?Z3&eh=d9I~50;SJ(L{J{hcTLn!}e}$_66wVNFHgJCn%7%!mgW5Hm50KPcK(IL)
zAZ&y=D;OSVfy!V7m_9{teaQ5Jfl*2MkpP4Fe-?)C4|o_}KLGWqpz*56!;pQ*{$}=V
z`-9oH?0070wBMM0!+vG<b^C?px9l5H;sG4?EFFljXJP<_wf7<Wo8GtW4}$y&3P+GU
zwzTr?01v~r1w0Jj8h9AKCGg-(GuXlz#T^cMp#CZc$R2EI0Ok&8@~1g<Ig0bo^*MYJ
zmuGSPdEsz@;r1Nv2Ovv1q?lrEM=?LRJcslD_5XYlm;Z46xjmozfr$(Q!{_-t440#z
z;=j0l-HzgZ0Mh$;77I9B_#Fi9T(*?|QGA4v!~CxO!r&$bg%=JV7=mXr7z7`(dk9h+
ze8ip?WDh94n%`qwP<+(xBZnlDYw=-wLG#0Qdy9|TT`WFk_ptbgJ!A1LyMxIG?Dlg=
zGr5>ZGKhf8e8Ig`fP<AO%6tw(0#A()!<$VF9vm!8(I7F9I<Ok9?K&X!U~w5H*BA2g
zr6$St|Mw&)aA+q8Fa#(wEZ|8Hki2cl|6{*`f&)lj@F6?L;Nx}|gOAxg3_fc2G5Cl*
zWAI^nL6Dox@7X1S%zgcTpKkCiyMrKeA!af#f&6jXhWi1?&+SGH7Plq%ADCM*BtX>f
zJqt?P$bO&CV1LwnCd0ZH^732FXENl0^cNpz^tjE=|DgDo-9-*@Cb#0Fb`LqEz+u8z
ze8lc!zkq`Uha{7;xrF^kkXtz<nA{=e@2|aW$@~E19+T(x|6ATP6oBM!Jm-JFz#y{6
zd=7&Ff4jo`+yD6=aR1?wfBgX5*1E&Mz;J+pfnf;)149P`149l21496)%D7M|QNzK;
z6ag`NpDQ>_L18P+<N^}EP$}^TD#wc{Cs_lL+j|v@98}-lxtMZNFny_5<Y4-AG3BJ8
z`u2Q<%ds&<T&R?W>e+J?Bp!Us?qcv!yNAJt>=p(evHKW&*q#v-r@_bV&VtinfWV#L
zcm{>}^A||*&lF<d4-mLxK8JycKSt=n3x^9#p!~q!ARyoW!2Uf*oI8d^2BaUBUv5i4
z^2Yud3Ig1-xa40jFnECS3P>&g0|8;~nOySx{{`fm>g~6J(n3@H0uB=y1|}03`~M*G
z`5gr0`4t3&Z~y22ajTgB2lr=-h8GMBQr({uI6!JZYC-DeKTr@bk78hYAum7G+!9Qm
z<&bBJ0l5$425tt81uqyFm_TaHCG7u$#bmhTU&zZJ<^L(f08+;x#T0KYZ2!M4K|$kI
z1@{Axy|+sEf9z{ekTCzxz-0a(>?Q{O2SN-`JLd9#7Lo^t6R56)=4()1ef@v$Q4T34
zXA@xthuib{AAt07KjxC(|9F8C{{sP;%X8#^bWe6r0EvUl=3r)udBMOS08;-#UVbhA
z10g0*xZeK4|Ksxi`#+}tXJFudz#@NK{(uB1zjRHG-wz5y5F3^cL1l+?JcELXFoQz#
z=LQ2%*eG`}Ffi6jIGE32OuF2_B*WdnIp_8qZgALw+-)MyprD<gzz|@=bRl^@ql<|=
zgH3V+gGusy2D9Y(3|7hW8Kq3*8ETRn7%Y+-7$uS$7{T$IJf9KV9tG<)X1d^1&tP!-
zKX<KD4WrxTDbjzNzbF`h<xH3w_!<PR>}yaExZWTm%l(HbCaH$e4HOR``@w2#m@YU^
zX3+aoEXd(JpTXd^CHDuedZu{i$&4=T4hj~xCAfcZ+cQXV3o{5`wwHR5Jd?p7c|L<4
zD4iuwW_02D&orM~m?`*$y!>8nd!|T`xtF7)et^<PyIX_7?Rf4F+6fE{0XA$8_~$Fk
zQGRj$KldLlncH*tLFF^JUjz!b_9qGspfCf)LHB0`4Ny9Dk6|#lJm>z0>2nwuxEokx
zZqMP82f3a9kkCOU29C`jH5^h*k>0b|C0=l^1dkct-pl=fdoS0V&vOKpa_?c0;hw{F
zhkFlK4EG+cIUxLbj=(Xf_?*vw1X{S~v&cZ@@7~_S<jYmVCBwwPv7dWBi+uls_@|(D
z5XerDzo7Q+N40kac>Eb^ZwyHNry7A4kU5`f1UVqIkN}A0-orKb_8#VDi2uR$6WISC
zb3tV^DD8sMEfWLB9)1sj`P_e4WcnK%ocJ9C=C?mkumFV*IL+R*U&tRX)bRTMzN;ou
z>=$@yggQWOLQjt%bHVv4l(C`sETcy8Nqa>ODJIY2Gj<<~PunvVpRyM$K4EWIeB9o#
z_?UfQ@lpH4;v@Ej#fR-1y+1P)Tq@?AcBz>24*v^*DVK_+R&m{7n#2D<U>a8q(;V;5
z3?5vUxr8rG;oJuD+odVo!k4B<H*;NPn#?tsX);JG`wv5d`F{qE{a@|VLFVx*2z2mk
z2()u>FokfiGllaT2(<BA2()srF@<rkGI@EcFerE{GiY$IFa>ikGevnTF&KE;GFWgh
zF@<u-GR2!nFff?#GBI2#=IXvw%x%M2!!+koF~@0cPA(o0o3}xr2b|Uv**<VsaB=e{
z2y}CHb8%mq!sWwR!zIJDi>aF{n~9riHB&c;4~hq_>rC=o*O|Pzx|z7SUo&}Mn!>%G
zb3W7jOH(*?Ks5J!E_rha1`f^`E*b9ET-+RDOkVqW6<%<NGR1RdaB*<8bFuSl2sH$s
zvHQsNjEjxyC>JZgx==^(X?sTQ7A_X9WG-fYHK7T?r|bo}ow%6zRfT47?d6gUK54I*
zt-_!Xe8S!^TbV&4__)1ewi1Iu@G<+qY+DA4;6ru?gOA!L1|P963_fh%2+D84XYJl{
zNHK+Sh%<$82s1@-h%klUp3ME=g}m(5n<d;25b@2zKx%vke`a`ashB0~QZerw{tp6I
zZWT+bLF4-xD87R~GfaTQH{Ul<++Lc(fBDuFX?EoJF8;&FVE&&$02JRK^Y|46PVgHD
z9EZktSg;y{La-`>0S6mXC@8*zRTvzCl^FtH@g1zhkPvLaP{6^&6w4vO6mKF9if>ki
zOU1maxn6Sd@HPmXxm3&tjd!-wkho@N0L49rIXJ#ggW{Vzn284zzg)Ep+??G^-Iu1Y
zuL1GF@x6^no@*OZH#EMxFHPa82gUQHDeOET8Wi7V-x&np@h!^awePLM3sCw)ithv9
z_&&zP#<dh2-xrYMyBOq8XnYr|G8l00;F18vcQMGnp!}xH5CDqrVvv79`Obo&08f0!
za)>d7LgPD(Lk3jV%3kH*W(whuWQs8nV+b)3XNco>5D)>?S+}Nu>&%4PU-^Gr{(S$(
zv|<JZvts-I$AujXOoSQYxIZ(^ht+AIvgGoEczICS0V?CTrfGoc_aZcX4&2{S^&FRX
zkm7d|kiYz2{zvy$dv;J=_(ERpE2s_7HPt>HWFCn9LSF7HNX|r_fnk5Vf(59a2c=_v
zd!YvI|6KCs|Lqro<hj3aiQJmc{eZtgKp0f#n-$wHyi_dxqpxWGdhY*R^Y=B__k+~E
zke9CqmBZk8w_z6mrFZjtj0qq<sO&UhW?+D~(U01F1hv!o8wA<|Y}gfwZ`p0+ZxA?Y
ze#d@c@g2K^4UZiHK<!ZzHU<U`Hl~>1Lw1dL+Sm(u76{x7zGb&D_^#c-*Z=pja<DSF
z?QgJe1-EaL8JJ9#G8nv&m-oGq%>Mx7o&Xzm12p$Bg57t_?jooS4Qe~{Hwd%^*swcb
zxb3im0LX3N_8PPOe^k5o@R}quFoEm^*)_kxey+(<1_4kT2J8n|n-Zx#X@1XcAt>BH
z?g6<CR@Ve5vj^}b2+Z&Qt6*^Z56ImD44`&$fEB}r*Z=qBg4%>UH9`%O=M*r2>K;)2
za(fQ<f8;g~$lQJx1#lb$7_%qvB?!zhpTfY@-=JW?S0dB^vd=`6K`p?Ty#OTFJ+;B%
z_7r|_-QVwIe-tDS!U4wY4Iud!^75_RF<c^`_y&pd)d)2N*sxFFp2Bs9f0j@KNS=SD
z5U6he?$;F`W7Gik({8JBKLDixP@K<qP&fgqM>!S*#emul=5y@-_ctUgxZEZo4+>Wf
zR#-n`)m9ERrbtj&Lfb+U_?v|;@V5#z6gM*%6gMz9WVbOWfYLK0f1>uif{)p~1+`&8
zZ5>cJ@H+@GfZQBl!@huDL5P9BLE!%U2Z{+Gd62mI9|n#9WA+Vv2?CQre6D&fVg42Y
z33Cw!Hm*5bBKt}fg4>;+{|j>PHwlPwe`5*@Fl9dg%0C>UOyPVB1Y*0lDRgoF=Zfe0
z&vl*eiGV1mjn1{7DV{%GhykRoTfV^x)TZVB!zIRdL_n<VfIWDei(f%NhHDQ~48M&K
z!wY$NUJena81ugjOlDgd4Ei_NyWZXpsz>BwO+*<$am@fK4?u1VuwlQz-yk3}xxs+x
z1p|Xndy7H^C_EtY3Jd`@EC!%*r~QHbRggGT4=69s;ckG0Kd9|?d5#3Az26IJ_d&uM
ztWW0hocljOaRgEW%0IW~aLa?zDY)Gd%*0T9hLNNAu>C|(d={U!7c4$yuULH2-mv(D
zy<_ol`@rI3_KC$u?F);K*f)BAVQ}#N!;rx>hiML|-2rO1fY|&$1*U-L%X2tn_J6it
zoBfBOf?q*k7QcqTToVxn1`b)KP<{h}8T=Lk(>WxVf;q&Q;=Ron6gZ@qoH)doTufLQ
z)J)hI{7l#x$~Z)rJWO~P7R+mHjNtyvG>3zO$%|_blMMGCra3$%3XK<>I665rxi~@L
zz}?9u6QIccfk#WB(`*U@6Q>QA%%!c|D>>$H$$;84`+5{MaL6;caKv)Sa$0an@Y@P?
zfbtmkEG{XoaxQUxE1`zq)AoYg-?+s1Ex>IEMSgRk8Nny*4YSR_Z3oBT<Mx5U$Lte>
zkJ=XoAF*!?K5Rb`RK^CMvFGIwW{SVv1d3O=xi^iuAIxiOkl-q1nq$HR>Z8fc1-W@%
zdxHk|XQmkL&rF;kf0%GFu)L6$OXaj-ih-(Sdm%693Q`O5)9onk4*@nDptOC*e2)Fc
z_Y)Uzf#MyM9^B_Mcr^dAe+nu$K>Y#!2?C)0JSZ)J)6{$iMF~(H;2h6j@cF;6gmVmo
z(dRir0-%10b3B6yDBU{;Gw5*7XNm{+M`9SvpmKVkKFNFqg$1Co0&`;qj{Tn(G=S{o
zR}zphpToeyJ(Ejj{`>_+{PP8b`x5M*gUS#7xnTBr5Zin*NKb<if0KYPR}Ggi_velU
zApIbB@1MW_C`cZ(wgDst@@IezhX9zi=TP8(0IKUy`hgz&4FY$*|7Q@GKfl4?`+KIX
zpti;3c&Q)PfALCupU=a<KVQh<1p|YT^8dU4%_l1`n*Znj_x%A616O?qs4vXLKTF5~
zWViBz{{QCx8BT!Y`2PqsC^z)~hnZtOhvCKxdHK}u4Up*>P`sMRF#ZGSgOoP{F_-5{
zy|_F_dLB5>&*z#0QUl6kVEF)0`J=!AD!cg~3fzI~3lO*u@~8QK`;8_d_8XNJI52R3
zLG;msKQkzBm3Axuwey1iGX#L*5~LP9{$R-<U_Qrwqlu{fMiVg!w)s;PW_eF$aA-?V
zs0g0V5WwFcaM`Vx!K0~6Au4zZLjvD?p#$?DC~%lhW(eT_B6NXYLEuX9OooJc4GJ8^
zQy2pHCJSBQHx@d;A<Pu{LS8=B{Ez)cxI01p`s0iqpgIXO{$%dP-~g&S&0QH3K;tK%
zI<)w(J>%>D`&7Z@I%qsdhRGSk2I+bIfA3cgHm0aOH47v_WjqHfQw#?ilPiY|lN(4s
zRLxzGdZ>I9hz%95<p7z*!W7Njz#;=p3kD#0{s#ibLFR(gaip^_b2l?Fzy811muIoi
z0kAnTOs*hxAo<t-_q+wE<yg!j4>E^)K9fApeTX`+nZ_Ird<g=V_kV_sy)ZEB`M-d}
zM3{leM3{krs|MUQS$KO6|9|*+5mMa_8Y=?Dxrqz|%jFp9AIcB>Z(pCo*#l~agVH2u
zEXYKjfr)><5Ii43)r0F#So<l!h9dwJ#<!!mf56B2Kx3ar>^_3R7*q!o->^H_KTpA-
z_?q2DP@RUay#ewY_Z+U60A-E@P+uGr9^B1b%%Cs{s9{Jz9)I26U>^$#H=ZQ|GN0!N
zOYkfckpKK&NB~q0@T>rd33BkP5|9Ly1t4<*>KPiiXEH^?;xPCTbS(EbgTej=yQ3hp
z!0Kuk7J%$SwaX6NW`oLa@V;fY6N?&KBr_&}+6bVrRdjVAHTxTEpK{1Bx$+zknA1OL
z?pctUfEtDZWIJET%Ps|_JriNZCQ!Wws^382o_^VGqlqws4yYZUe%Ws4<tWJyCc+G-
z((l`yylg4?!9<>c1Jt%L5o2HgwQX)a<$k~+!Q`BN%kHT8b-RZgVoXu#_w6o%>`cFD
zch&r+-9}LRC;fok*7O5*d($u59ZWx9cQ*Zw-Obnk_sC|0#%^Vp;`cvL$N<Hk_kFvE
z-A@&Qcya{fdGZ8gKxHzlJmx6?#epCPI1Y*gK=oS;s9XWZIp!ENynSgR&LC%gkI}(I
zl1T~V7V{f+7mIJ%eFV7?lpjr`7`XN~C>S{3w|g6W+3q7>y-)*W{1Y<vX@1Y{;0t;A
zt04D*!UY^w5)2~d_ZS~smY4hhN{gT}02Dr;GzKaIZaZ`TNWWuu5Y$#lKLBp$%cS48
z+nRpEZfE*UyS?pA3O~}X+Z}ChQDjh_bN;`H1Ve*~Bm+bC4ZD-(x9ki-ZY#cKck%WA
zZ4*K10u-;o*X%BuU$;AHe#6cX6s{mOumA6y3L2N#-=LuI{XYYP`yD%5_xpB^;4qud
z6c1`c2OqLy1dr(=<x%r{c8Vr4j7=}(<yq73*lm0vFaH!&Cz;6bB!J3GP+7dMMnS-Q
zzJ1~g22gv`{{QFyf<61=?ZI^yDBMA1BFMi1HXI6|_E!G`g#eH~keKol(D)ih0jN#_
z<$3NHCQ#d}2Gp(swS8~TVE~VtwL2(8+ztV?^TFyHK<!iWuc86`4+JjHD^b`18nd03
zpde)apJBuPulCnL;vn+_Y&a%>+Lrtc0#m_!V~zzJ!b~wu`yC|AiWxST725~CU|;}^
zPca0Q*$3{sqM!k)k3juP?*Ckqxj%EobI<1j*FP`h<$FP6{^0rvRK7#UZD0T2w-?lI
znBSn_!6CyGA3TSlVSa;xm-`$B4-<I?w###*UVz#lApcyRBP9<C6Hr?TRF;9pUim)=
z+`0Z=QkTC&U=H^mCYkHsC9PoUU&zbP1+_mxZU==~fISDO-4(*uAaHfw0tE^4$qY>U
zb}2ZRO<@o)n_~Zw`w!QhTgBWDxIc5<2gMIp0=RAz0>uHy{kLlPAArKfd=7&E|74+y
zpfO`mc?&WhlwM6FSQtQkEKnK)r5jM*4N&Gd@cRG8i=gxaO4~d&LVO7|4CfMR82J)v
z82wCS7~~Ra81{kugx<e0kzts^9W!IW3kGJU{SFGCvE@nH2?7kDG3x*uh65mWfDHq9
zPQX0M{{Q@#`A0!w-Lv*z2g%=#LYi}#g+AxP{Dy&nQG)@zM1_fmfq_Yafq_Ydfq}_@
zfq}_}fq}_`fq^N6fq^N3fq^OK|Ns9xK$wAnse*xlsRhcOz`(#Xhk=1<1p@=q76t~U
z0}KpIXP|O7K=fe53=GUO7#NtBfZWEwz`TKhfq4&zjgA=@m`{Mh^M$;uX@CvG1M?_*
zMiUtZulX@^zJkQNXYFMt9L`J?|NsAsVPIga`Tzf400RSK2Z#n?1_s6{3=E75pzJja
z42(OV>>~^ej29Rf81FDJFuq`5VEh7$Cx|?g1c)XTgW?yY2Na(m_rH*rZVj+u_yA?+
z2G}q%K-r-IHjDyLwrzk7qXLwz8eqd{0A=$A*f2Uk*iv5uY#0Ne?7IOrps^VNh8OZu
zM+0ma3!vg_18f)@pzNsuHjERX?Aibu#syGzYJd&n1}NJ%z=jc=#$U)wnFiP}UVw_r
z2G}q@fU;QwY#5>LmwX#w!vuA|<kbKhCaC)*_XgN7LESI8G{A-l>VC=I02?N#`z1>Q
zY?z?#my8XtVM>6QFX<X!!vuA|q;7x>6V&~Zq5(EcQ1?sx4X|N?x?kdHfDIGW{Ss#b
zY?z?#m)HuL>w%alF*m@53F>}{)&LtOsQV>y18kU~?w1G+uwjO}U&1!Ph8gO93Dp1_
zW~lomcmr&hq3##|8eqc=b-(!C02^kg`^Aq2*f2xgFTOUwh8etv15{Rl$}CV@r1*s0
zLGakval4Bq><lcRd2S9V@O<yb09B3xP#LC>!oXmX!5{&u*NgAiZRA-XaEDWdONPHe
zU=GJ0CYk;Qg#)1a6C`eu%)r4>!zBaK!`~*vV3Nil0TSo915tl@j`aWb289lodQjVt
zCqqC6+`c$rcM#uLT<~4Hjj#W&erY1bAo4<9?k%Xk29>j~|F1p>5tCO1iNX9ApvX}G
zDvv>a;875`GrvJG0OT%^`#|$2AUE(g2!Y4GUjJWhX_Cw!0MZW%8<1X*9<W+@1}3oD
z`7pJ6OHHJh|AEw+NHM;GxM8m^NDV|x@c~o}-ai4Y1%!z0`3qAA;)B?)|L?hKBE|Ru
zq!%Ri`v3BcpgIw~P5}9fLy{>J<fr{s3k+@xbA#=9!Lq-BLzpQ7q#jl;noHRK2i4u+
zIaetz8LoORk-i26A+8!08Bo0iQp^2=ON47Gmk3{jfEf25E)jFkT&ukNQod=BWqTm|
zpkp=+pt=NPFNn|IATR@DKK~4%2JR@Xn9p+rlDQ*TB+O?r7z9``7l8c0ZN(+YEx{E5
z8q;|Fe_!i$365ltoiO*o+5w<62r@H3kp(=4Ya+v7ck4O#15o?-wkvr30c739VS7Oy
z1%bBWn|22q?l{~izG1f!q>p16i$s7jGkA>wXzUqeC&;ZJ`?#aHqCjr>93_x!9%+A(
z+nGy>TbWDp_5Z!8CdVLSsUR}~Y*-lh+k_f8mU6iUAGABjk;-*A7?jQvg%0r42wliX
zXHWpAPuy!U!0lk=3B3;Hb9l~!!p;01^MmX=c81FH+;h$6$Z}`jv9na3alFTTj@r}g
zJ9duB4J@n8=V+B?-?8&lo^(pVe2&V$>^pXW%014B=5qukv+vkND$is7U_Qq<toW4O
z#Ny+22Tiyb>Nq5s+(G>{XdZoN!V2yqFq$8>G0eVWm#EyvU1L5+%Bc9H-NND%pnief
z$Ko4yjoEkXGC7vB$TW8~?%-I)C3)eGwAz(DoSN6?a2&hwjQbZT9dfs`uye36MS$8W
zpm2M^vg-oJa;~Eshq+`-<n0+jeaRb3!D|a@I_@+s0Hs%uKJ%N9w)E@&%Nap>LE<J7
z3>6?bSX=1zzx`)na>YmO3PE~6{NkfF3qf|h{=cjfq#ml*A^4VEBS`!O%gz%ZwZW(C
zCI+9hTNr%EhB5er-NxYKb_cQbi_P!ZD1yuZwe_L;JwWz=%mtYPk^}KUa<Bg{U1+kD
zp#dcKLSA++$ZsHdlUoc-Q*JQSA>6(%6qI&MWEk=q?#vT~sFy1R`2&%T*&0A$Zo<j%
z4-{7%QjmB8%`<@dE#^lpCxZGgpne=YUT)e=48CJGk>d`RB*$SEndZ($@Z7|WG;a1A
z$=p9-{oEHU+YfLsGevNuBI4o0F+neoJ4|F4{&dtd25=naItFq(2Rl<F#Ba+_g7kyc
zNH8*h<PiSZvlS*+e9Wp5Nlzk3930M|Fg|3Nh&!Au8%-n_!DZ(QmTe6neIUC)W`XPi
z@geS5w$tPoBLhh8g}j{Xjbq#oK=LM43`|oh82%yLw7Zwvl}pM*hT&dA&Ae2o`lBHC
zf$Gfw8|De1ehw&af%xEcT6gRU18kVVbuY*+kbLnSyT$+;<_#b=NL}$AyNLld%;0($
zBvyRKZef58GiYr44pe?)fDJRaK8DI446tGT0AfSsF9v|hhX#Q=p!yHwc2Ip{e%P+C
z_y%~LSOjP-Lh&8Dhp+$dehNxkAh&ZcGerhN`@b((wm6tbFeJd%Z-LfzfyzP98ZJ=!
z0ofB^!y*8(6Vrbz;JP2xf8a56nENLN*sy@x0U-Sl|FM9^<6!a|18i8p?E$F#!2lbU
z0uUQyZ}A;FkpDn^LL&UPOBK8SHZ_3q8!rEW`~>Rzfa(uW*n!6MJ?a?+y5$!ba7Z#m
zamYjFWnQps{18ydXy8%9C;;o{A@_+u=D_L;P#JjJlK;W2XZ)b~A4ZV*0m@7hKzR?8
z-$3I70rd<9^B*W0fa(gK0)aawM;Rn|5(K7jt8%e|^ZI@+VeZK+!d;UWya4GpS7#6a
zg)=BVIoO#ZIOLh4Ua)L90g7{uKU`85?nwOLj}c-BzG=7d!W~Hv8$2I(;f~Y~em5aD
zP}#{JBg6tS;|0rx2=gcgj({2lgMu0c2aY{lG6gjZ1|BsG3ZOB7j2cjXpMe2duiz-l
z5c7BD_gEa1YR>-$r9rb|2CyBVu;h0DjgtvW+*am)0GgYHji2$mfW!qkKx1e8ZUXY@
zm#r^?#&mAa;e3#O$NH&>41<t~Ff&W~ee0L$cdS1uKVo12l`-jetbc;Wjm;w&1k&$Y
ze>J~l!w&L)`eo~fCdmwD=?ARurXR3=n|{FhZ}J@*#^eJw%r98hH6$OfVZBfz`62y|
z^;OWgm5B_4Ncv&xo1naqeaG&j`C+^3=GW~$g6uHAX$>B`di{SJcq|Ll@8ADGp#u~L
z-uLZ3_J2_*aK3N%*!hm#Q{=HJ=lgcgKmUh}O*!AOdkOLz>RgiybbP>iAuKII@|pEP
zP(FjEp9A3boeld1SULff%b;=2_9g`n6A1>5_7=q(pg07%C-{(^B9?I-N6@%V`W?GK
zekTFpPsKt4CNc~z>38fRLE&a1!=RCV$1V{TH{6q%g3}M!g~H+lG`7p{CLnx!3g-jv
z$xJcnSL{;FZ`tL7>`Xsk7Yh#WJ9e2bSXN&!VP&w%K5BOn6sDlCG(T)N)%?00Xgndp
z{H9$XNYCs4TLM92f{<{un+kHb_kFvI-B0am-S68ibiZS_6r3*pFvXyU*9&<$Q&3)e
z{eQPEsLcr~qd|TKg%>28I6z}nSNJCgT!!*5a8F^H!_^Q}4_+VF5Ck4?0<Dt+jdS1r
z&ma#PcLI&YOl~j$ja682J6M3`KD10^7-aaJ1nl{p1Wftn3n{Ii8-JH?s*n=YTu@ld
z;YuLETm`tfBK%4M_WVi$CVcf!b4!GjK;t$be?a5i0TfoC{>^PR(ArpgMo>6|@(`#z
z0<|~2tr#3$|KB;Y_@>=OP*{V)Gx(<6#rY2uKx>Ve_!R{11V3dkFp*$z0F{G0H9`mY
z4Fv9h%mtYRYAXiYFent%Fen7ufb+dUunmI)DE|lBFa&V0GDW^%S)ox-177<Q4feMc
z#{sZ;tdM&91<Udm9Jj#rAgF9uh-2+9I6Wh+m;MDx=eJ`Z>!m^d1(mh@4g#}4ZhQTI
z|58xgVrzfjw&Vt_4b}pw4~}6_0I3h2#SrlN|NdO=NUm8RJ)pUNkolnTHc)t)OE589
zx8!&ZvWHueOA=%TSbr2m|LgzzzH(b}NrCht>jS9=jS++FfaN_<xPkH?C=Qez{BMK8
z-aLw-1GEkSw3h)C54T&n|Ib;V-~fsX6IKQ$(3m=S>=?9$7InP!AisjZoc^x)+d=BU
z;cLSIs>|<#)_;Q5X7fK1km0EjV&Z=Srdjx(foV4W7hsx${}q_#;z<FUqYg5MUqN7o
zNfiSR$lcsBI~q7-m?HQsgc{5x?7y1-WZ-$hvZMjj&jPJ`0l5w2Pmo{CqZkrE;R5mp
zNbl?adyazq3-Z(DInsan=P49`*0F=t-nCz79>t*X`v0C<kb30@d<>vDBjpA*hUP!u
zxjYt7xr`j9`ybeY=JP=7Z_k3}fk5_}-(yq&)e(rX_uXqjb!_l`yN{rGM(}!uBk(cz
zhoJa`>T`gGmjWn{a7aSN05~MTYrX|RW`fJe21SS4&fFhB{s8;w-x^*}UU)xW;ReWG
zCi09wIPNpagUq^6DgEQRB_{{>Po~HKdrk)a2LiW1`nY4bq(JQsu>Sx1dav8d{|D&}
zzGHV0q%XjpQ@})$frbBpz<rLJOyKmz{gX?QdnT9Ug*{R~uD9|^@Y@JEfYSi>webhR
z=Gbt8=Bw{tN#^7*kzxG7ZNmhf&*N@pat^TJ1h==Y)XV<|+x1we0cO_=d3jxsU7&DL
zW?^73kz{B9#Use=AUA``41Naz=hy%Dwu1Z)#w<+HAhjU**Z=p1nn*IVfZ8s|@dYvu
zl>Q-Z<A8*-1T>sMb8d(2k;7R5HJn%4g6w%eUttF*tia*CpOkRky%$?J-&o514;0Sa
zPq|pRTe(<ymI>i4cOY)Z4A<ML-2Xt~3X%tfDL8x|3xV5}p!FRfvqAm`$%E!HVC#2a
z`z&y$ujRfVe}nuCn!kN>U*W>{`3wS}_~h6FiBEVso5>Uz0Eu&OIs^F^5+6H{a=UR!
zfy@BKHOLJdJDDWGZfp>^11i5j@y&6QOOjtfApY_nsUO$p^Ge*F!~FrAU(n{gK<j@%
zW<c#CK7H+krsbJjlAtsOvI~~~Am)M61Y}(kmT-|kO%F?D(ZXegi45aE(!yo?R9Lt`
z?1$tDP?`Y67spX9R-OgmvAKij`%g#>15o<le=O7hGWUhNd??6VP<kjn$(R9(BT&2j
zwmSC@6G;XhP~C9bmHPvz4+(0=gYsSRVS7e!zxfzwzHWEwZD#Ht$7>uSz;Vh9Zo5L(
z@`3uTIK~EoPui^o?YA+hWMDFpWXJ%S3$g=bKWM%l)K>?Y2b%vk;bdaCP=i>bbX?}X
zIcObUqnbS^+#^AHq55h;X3TH5`wG$vG8;(_v0p`o$r<Et(6|%G-=K2fa*Xs}P`l%{
zD!30L2r73$`Jlf+;RUEZ1es$Z$shx<XZPC6QPLl7&yi-|-=MGpY*#Xa0BGzMv>p&t
zo?f{vA#kBa>PL4gWPBCWw+_Aw3a_247pkN`K<3b-KXkV>fY#ndU#OA(+uxv|1RD1Q
zt*--_19oFFXq}M!RnU4v6K4DW9L$il2)NoJApd~u0_ACtTfu&U$DchTsJwjre>-^G
z(?s4Zr}>Y91K9nDc*B~$p#BH<bzcA94i0A%c?JpY`QUY_AHeO;2Q2c(<PTVY&68(f
z;-1em2YK(nF`0N%P`rUKsP6$aQwZeF*Z+6H_vy@Uu)7P2caXgKOa?ZH{EnlbxP9NW
zAG~(Jq!QBadi{ULRFJrdJcC{LpMCY9@Byuz0@(q}&!95J+=c<tt^(~3kz`>4nHl^G
z)VA8Nlsg8}w!+pvg5*UG1#p@_3fgyO_Yqq6g6jlO8wu>ryY>rT|J%!nR1Ua;+DLEq
zD=hdvAGDqiQRiJqmi_^%2f3ROWhBTwpfMMaS+D=EuLYHtpm2oP4=xLCfz-VIzd978
z4qV@2X>&o<6IIuO%mbAJum7*A<!=y}1xjxqb7A3De1@?Dq^9_^-9!^^9**LZb{jb)
znLI)B6t_M2A8>FmMS}8)`7!&2pmcU+7bnMsrP3cj`Nm|a{eO^OK<Tacl-)wmn&8*}
zcglj|3gj<P{I(<{YyhbNnFF%t_5U4rk>uUYPuVX7+1v6U5w-^}G5ECI#NbnQ3xiME
zZ4AaUM-hC+t{1$=kBuqz_5V$>pgh-Eqfh|08?;|gf)O;{WyArNUw;=Q50V4zZveT;
zM3TV-Dz_9S2aa3FUbooS|F^e-+zrwLN^c<lTzDq^0c<B1$j*(XpfyLGHA<kp6wy#K
z4LHDZn{`2Q%^eEhyaJNr;9!a{kz_D{gu}YMAbF74AUP9B1|x{RO<-|e1p!u*r3_3r
zmU92#RTW~Gvj@o>R<JonP;<ccAemzV5#NLm2d%F{ga=f9E!ZBgK29d2@^$xFQ2g*J
z2=FvEL&^=1`ygg+X9c-=KWIJ)v<8fa$(dJK2t3va%Io0p1p9q0SRL4Gb|&yzFNoi^
zJVk`3j3|c;lRMb#nGE2)qObq&xC%1AeZIXbNbl`t?jIbiO!1&`*voUIe{etUXy9OG
ziszocq5+imITmxt@G1z%ch8Ue4t7T>7xN2wxvMvlxqraYH>li)<QEPFP(252UxW8l
zLi4x=sGdj7<69lU>41eP8r1#+<#AB^kJ}#F{)6T1$B1?|C@-V7vzPA$`3>X`<aRcw
zPYP<6L&9@;DM$|}KVlj4KxtEh%mTGFKy7MJxxyjA6a{Mkfy@E5|6c!Jv=@}mLH2?D
zYtJbFYG=NXm$wD=Ltx=yBEcYJBFRuue3VfGq!+oq=XVfref@uBFDU-u=Gbt8*1<S~
z#6apn?tsR1!|VThO|Q$#$b-}(%bQ3rFunf2;;)G$WE>hru7ZidM3PYfr0@0rJzK%^
zmn=-tAa{YxHj!jp0<!1z{}tf+2V^#6&WL#de=~Ru(?OIyoJZ~6g8d6}=OLkkCXx&e
z*!m8j_~dU8h%lF6VtD<3_fe4jATf~nAooJ-Ts{@l_rTGQ0Pp7owVOa=p`iZSl>;(z
zpfm+)Yk}6T!NStyI0I-cH6tipz5c&h7i3TN9lMPnyI|w>5c@WLh05&&$${1nn%}Y8
zXd=Rp#<8CZynYt6zUTeB{df6FgcvyXfZNM5Caeq!+^tNkCNc~OpmpZnH|#co!VcsH
zh`GC1LFR(Y^uA%Y6D$Xxr`QRe7uvHx!2=`@4m&GOgYWiCQ$TFcJYs+aCwT1U1@qD^
zpm|0@W2T_?2q-;)+Rz~TVc`I(Pa$EjQWWH#<24Q)5IY4x>)Ao`3->|!LAik+)aHo-
zt*HX(2d$+<Ue^ci6CjN{1Ru3~3(^Nt`}+T$y&$ted#OR{VCft*ZVihoP#l5W1ac4P
zxI|ERfZPR&Ly%rjJc7&u#pCP$>(7G15f)#dxCE&O#T!V?>;LO}L3*<9*rCUn5{@{N
z0qs8p&E<jP3A7J_nF%~k`uhL2tzff3WhpyTBq**Rc5DOpbK!GApgl8~?SO@#a0iW%
zfx;f759B{kI~L^E;8q5OVpj$Qhdm4q$uSHD{44_UxBqkhNsebQayDg%y8fTzd2%R&
ziL(tuL~;y+89xVTTvd>RpG!c5tAr^8wqM}VWT_w5N_ZvGgBdLN*#tzc6>|w(nj-x#
zIfTK6yMaaOa+I|E^(fA@T)UW}xPLK4aaA!zz5c&*;q`dg`=C870ect%z~gbCeRgPZ
z2y#CtuY%nE`tN>T^f5C~dIa@dLFF{eJ)kkq<1z;fKz-8rHVq2j`<b?a`jX%6c^LSu
zz-w=rl;_|5Z*H%^Xg-JkA81YY{6F)Lg4TPR&tW(L;&Vtc#oxB%{&)R>j2!=b$XamF
z8gP)@3wilmka@6l1agD<J;nx5S^~BG&5zqn1m%AdHii?RbQPe=82}1*6J~}3pl~m~
zWw$W-fZfF819p?4Yd0h=%S->gEhF6=eAjLxcRQC1W4*)y&>pPoj|3P%>+L~lBlwQp
zLeLx*e}h2O>;L;2LFvMz1~O+3Y6o<;*{6cqAI`VzCW68XB>(#V-mNB*oZxw36G_fR
zAo17#_x3v9vYU*Qb`r7FEsY@mf&2yw-}VLt3-fpdMsT>sGzfshbrzS@_jn!#(6~Bi
zY!@7^h%h~i5~fm2@wcOJhG{8iT>>b+O(Yo}T#uJ|4vP27QPMvkZr%f5w*lerJ8B}u
z@CbP<2jpImesEo2%yi*)B=-ZSdWH{9H4LAS=PaD+8NR^gESzc>zO_3j8i3|4Kx;F+
zf3Zuv;9S1~G#>=rM;!mDUZ91mo=g5yy&wmK77_r_-21ua-rmpL%srn=_VRw|l-vKg
zAAr_aex5AI!9AHv_*1b!GWTZ|;m?x=T0ng6&s>*bV%(p(Kx;AY-~P|!%l)4#2DDBb
zRJL*d;hMw!hb#X2e~uRJzbvx1_i#S|?PCUoEzEzQaDj$_EGUj4<)s2cfC<wDr^yT-
zJ{1c~IL!z78RSl;c&Et>UqE{}xIZ%mJI!bK21-v#2@OnU#f%AHf6Ql*xjY}?{!fzy
zIk=GA|7o&73y6=${lV9YIeWN2a|uKJ1#$l$78&IS2SEE!*LBZt0H0F;I;#db&Oq_?
zeLizF$WNd?!u}Wq15o*-+|bX?-ytwxc>?ba^EnJW&3_bjfaXR){ssH}-zwPp-x(nP
zBg9u61(m(~8x+862teuABpFnfaDwJc?(C^i$N-rWV8gNj<PK0h4(soM);b5+uz=^T
zLHjHMY*@f^)Gy@amj>9dK-ap-_XgOoJmB{e5a!ntkiS$c{{yu5va4R<z-<}+2cY_y
z`xlo8_fIZiz6Jpiz61f`OH<^3fYfzOR;Ym1)%!teK<jJG;~50ZLHjtO7##Q?2u$Hu
z5SZLG8N6nfWB)JvtLByr9H6*=Aus<HG}er^FQx$$e&BicQ+5+gxESm}>m4{Gm^?w{
z52)?}l|SJ1D4=yG$L$V+%b&ycjQkA($3bOP@h!W?;yZSQpz!11WQqvBY1bHh*RJsO
z|9z$bzZeWS*qOj>fcXsy1)#Ep<ABBjo})qsI5@!L503CPAb7@jKy&J#@@da1dtH;~
z3>!dk0$Rrm+7Ak5t8y&pNKb(5vy_*21)b>zb4$Q3SYK$bC<iN($NUBb15kX=Ibio6
z<OY*u20O?YiQHA5!$JqZ<0DHMHh}uDAaPJx01BhxQ;Zn_S}Y78KB)g1V9#7|o0Izi
zs1M5_$>ag*mvYE6xr6$z9FQ|r1VQ}=P`?(`kL7g`n9Na}0os$>)oQN*+7sT$!O0X3
z>aW4u8UMD{g3=ziEkvkaddhAs{{w+L{2v5vaLaH>?Ag&E1#-Lje+JOrRaKDN_v~q~
z;8?-M#*xew&+(t@zV~+qg|3$h8lZI=+-)ozpuG+p$y}iGGFEW>;X2OU$|A%6N9e+w
z8~e}RcIF4K>EO7*A_2)STU<eH7SOpMpzzys2fC;9gTQ@IxwGfa0&w3Nq88E~1*zk8
z5SY{496z7ufxw*?@^b7PcUWY2o(UcB_|Krw{nGX+&mW-+ptQr?!3F7`{oAw^6b3Kk
zW!HlAgTwv^BgcFN1@JsRXk8t89S$qkKxqM7kDjtyXbxImb<%F52`9q|P}~Hla|VFo
z#)OsO04UC2@d7F{K;!<f`jqE^0NaK8(tmH<k!}Xnq1;{IHIBl_^(ZL5KyC)D4FI_n
z?C1aMADTRe)}=ccz-bXA50zU9QfIOUBH!I<uL}x$)OvQ^Q&>F<s#`(&Kz6+TzYbLY
zE&_!G$bSK#K1hRrE66;U8qgkCP@m%U|3!DfeGX7t58D0%nE_hU^ZNg~g(i{=;I=Wc
zUK2^i2g-c>x6Q%*sYS6SOBpyoc9}>puz>U`D=~oA11bCQ-+ujn=Uvb|7DyhH4?yd5
zK>KTh57{LWGnQh0&#n;^pP+U#==>s3*#c_MgW5Kr@&;74IL9z3w1dVnrI?)Cn;O7-
zJ3w>a;5>n2KeUNFgG2Xx`?a9(2##cMc)`4u1JoY`t?zfKVK4x(L2|GEZpsDu3FLkg
z2?hnw_@?<WyNyse@HmS@4TC~|ivnoRR)~o(LjY*KiAxQGO7dm9jh8=5en`J>xAXRV
zt_R6?><*@1w%eL~-wt$!hz!pm0ehZ90>(W1A#>F{n}w7>>r-CH%eA`CVQ>MhUj)aW
zJx2m`edSW_`CKxfIrx1E3ISj_W6lEp$wC*vY!i+Ld<_Cq`AUTv_&Nlp@=Xw!!dEKP
z!B-+Q0kj74bCkeR?szVFP#Lhl0lH_~hO>eHj}T-ngfYhjz660O{8NM)_%gtB2Va4}
z6ut_9$^27<Ch$)dngOa8K=A>pJCz&!Z-e$gfZC^^GcXZrX!o^(@*Ak`0M&P}x(=id
zJjWTuumhwYlrF&G_<zwtSQvx-Vb3`M<R*|DNF1tX!|VTx0zrB}aRF7g05pbxrtZS)
z|BDz=)p2~lV%~|@{}*nAsRNnu`u|>0(E41^9uahRgY3I)!Tlh>hI0YP?cg$?L10d^
zO+$qVGXoPyKEQ@^0%*+;e}e#cyz~Y0iUg4RLG5Rdo5B8o%<s+smGiIvFIfn-A2P1~
z5V>7|Tt0!?!bo<a?3q3;b07h9))}~cY}4QYY9E9A!ab9V`Srj3N59nbFo60yApann
z4{kFf^+opoX#khmpgqT+wg*T(ayy!TrclG{fBRKI@e19udIPp+^@Y5=D@Z*kenIoj
zpgq2z@VVX~V-H^Ec*LF&G>2v)&+w>wzCuRvO}meva51-J>;R=3kb7VM-zR(9lKVmM
z9lMX9uri;?*Z|^#%AFSs3?0|wW#r5)85&IF8ML^6G0nOhb^pWkC<X@5ewSlX4i+G_
zCh{CgpgljZaevS}$1$1v;QH}Gm2~s<co}(!U3<a%GePz!dqB#n*MB$Inn#Ho<Vg{b
zHxXw1*Zo-mbY4aj@>xJ2zrSE$hyax>m;XTKgg|z1)ia@-slh#;DdzGVX?c(wXiW{M
z|Bt#3$qqi>4vITam=zzf7c9PI&zODF?q~K5yN{6c#35jQ3q0n36XNdOpthNW_Z_>B
z{Y?!VAalWO+avI^;Na$(-(z$D#Q~`P0<|UDL1)QHF*!rb<piyZoYUT*-~kFZh}rw@
zg352`m>>EXbI>tA4)9#L`5XogZYwTU&{{`ud+v_i#W|_=t)Ms!zGe3iGS{>u7u2@k
zsSyJ0``-%+Ygqb#xdG%pSo#3%A!u(<hyblu0IeCjF3AP1ySZmDMZEsMcPS_jf&7ae
zj+d>ZKY-o;ZwY+eFi0&}?El`UptYBvG99EBYCrg_3Q)KNsB#_vxdB$M^DGdU)8C-z
zal0APjsctTZ}Ck~8Z<v>zYyeyV$iy9W~K;Gd!B=l$qnomMGkP?&7&Z23v@n6@eR;i
z+oD|Xy1)A@AA)b#UF7}&E_Wekru<O=*QucT^F7D@T96r_G6WQUJd1@uW6999yL+da
z-?H22eaCL&@jC~=dze9L18g`qfW{obdLU&-BaS(_g|Ko2TyNcDasaIX0o9oxzk%BA
z;JH*#8y$8o33xyC0`RyUDE(glEg^7uj`WA-`Hc!7|AX8JnmY&SfBk<!A}IfY#7!g_
zB0zFbaYL9mxcv?q<CkQJ0n7c{4?1s^!9?El1qUSGAkE)F=W*qgKx<ym=I<OJXQkOQ
zU*LZrFz5Pw8F^6I4~_?ECYS63c7XwwtPI%)>>AB)*@D*<W*@NY%syayG5dh+&FllV
z4`2UX6q<a%_T~Nt1@OEGxIKa}FCJtb*p2^pF9rE!e}f`;y)uXm5#PViM2aB;<X@P-
zpyGulQVdzw=Wt70SLPA`?M()qySTqW1#AzJenk^0h6GIg`#zdTF(h4|!xeO0nG?L8
z8)U`{2IdXQ4Uj!2CK3!Bpt%@x=z93q|98fM>JX4wpfD&tXgAUOj$LDS^SrsBb{)db
z?RP=p5q!{YB1kQ0JUhUW6`WqdZvVS~rTHz}hakE64GI#VHYO<Fg7)IyNalXve#`de
z{21G>-iIM!`ugu)$oxSv*Zj}(LFcD&$$y?N2yXv@&Q1cQ&(HIP1VDE|!1x^XT=C|2
z>;iB9XHEgF!{%URa?ZYQ*Jys!e&Lt<3=CiXb1-l)GI@gB-`v~)*)Jf$z@n_+0B%RV
z{=YQzdpuK6FlgOBsLyxEb|HKm31j@x7BtolYQM$4{=fC9`7OIZ?;Cc7?Mw>bx$b@z
z1r1Qx1mCm+t#OZi{eSt~;9GWqApb-BE%z4WZ!|TbAT`1F?E-_Z*d>D0&VSZm!8M;t
zCeWDk0bhc^)OmaMw}bR^&F2D@cd4L#&4Kcq7dZZK$?!iAxIBOIe0xwE<b}MvDM+1i
z1L*8O1_scWUVshf15h~(vJ+I#BF6ofrGoO&3whbQAUmPu7ie9VV7r6DiQAE|y}Xd}
zyuU%A0aQ*EAB5B&=9c#V0~9#~g74aW1g((<l}{i$if@9>OxURjDxZRH+B5D~u%8Pu
z{{;hs2B@3_r8RKc_`hi@$bOJmFj5@@a|fs%1eKqlu@g`o;~fuP%k2TG-@RiPE&3Z2
zBD^CR4PfiKU;p3y6;vK0t?NFBvpoO1<1NUoAa{9GF<L;}v-c}ptdbF2KY->}L1u#b
z-XL>f<sB#;!rDz(#%Tk<?WLFo2T*$nGzJJAPlT+K{I?czwlo6+Xl>a;a9b%JF>cHK
z2YiNy6u*PO98kLl*1kn)FU>+7zlF|myMp`yavP}L53u0?t&6&E{u#Un`^r2}xg^gN
z6a0mtU|)lRkoOmc1zfWrXKsS`WPi5b&i_E*3aEVwYlkZ{FbJARGAMxBhaj_G|6gv&
z?;sF`>@H}0f$KeRn1If(g`STEia${J^fxGYfX<;pTIYeYP63rS0XD1(pz;U#Of68{
zfa<^3|5me_>|$ep?(qYUoq)!SL1$#Oci5YP%1%%l6Qut8f97h?niY_Gko!SmH<I~(
zen=L!<bDil!>)@3)#spe;C<8XrpYcg@Y>YZ|JLb()PnYBf#kRwSR_q$v4PVBNc{D`
zwQsN6%U8qnUbly~{r;`p3$hEe-WjxB1D0M)Bp7r+;{c#~5>`Kg%mMW?U;o{fSbWP4
zTt=FRGkAc+&2QLEG?8Qi+xPnK9#<17NFR8AgF*zze_-=&+JXC*FPJujfZ9bM`@sEP
zr1=I=|MrEv{83Q2L*ofN#|6qyAbUXZ0~%L({eRzD^ILWo_cthj$JL$h*j<IKtKO5K
zU|}N3a1Uz!LbN<}a7rb^1JJs0aQKQbg>#58MZEsI*A}!^9Mm=fxfgto0ki#oSa^Wi
zk0AA+b`r8%UjN<9S$qq!F50{m-tPgetvw8F3qAz72jq6Rd(hU+fzEgUjXwn6vbz|3
z*Y4r#znd1CR5A$6Z?K;Vic8S>#XJcDhoRvCj&D%=7-S~soB&Yy1*^k@@7Ob<mrvf4
z83oMh?f<vGo4=Q<o(Xh5?phNG$oNX}0lSaE^BEP)L46PzCh&Y0^7$eC4fUZQH-P;9
z`v2;O(6YrAWCzGSpu8KP$OYct4~iQe1%c+C1ceHadXW1-^9Zm1uij`P#V7|d$3&9h
z5l9>)|N8&xMo?Q4EG`2LJ9{n$P`d+^Uy=J~uy_FFYnXnJeW0^0UjJXa5p-t+*c?g7
zm<z~!6Dh`hum7*w$sNN4TjK~`0|AnI{eM-bi4<c9SdSF6&+~t+BFJoz7-)^Vi7;bG
zSG@xGj9^IHi0K0NW3FJn8X*C`8X+Ojeg=+uF8Sm?jNmhc(A^9QAJEz_P@1`|%KZc6
zUQpWE?*Kmg&lyy1fx;2n8bb3(NIM7O)|H_4BMZn~pm9ft*y@uYx4v)Lp9>NPv7zEK
zxtqD9F3*wv)!$-o3X=n^zk|rHm<g)GK;mFO*)Uz;Zsm#x?Ze@JEW~u9nCl1sXYko+
zBFXa^1zyO@Z3T^6fWjYiRtV^9DUiQF<4>ToJ4|F49MbRD?KF{Lasus@0i8QyBEtYW
z*D5&uj@?P{ei|_brt~|Y^F!=8&2QL!1f9PEG81%;Nb()KhnHg{!1GJVckG^Dj*<KU
zIxjc*j@?U8zbE~^-O=>>c2|>c*}Vq28<g(h=edB+ayejkH~E0w<KzQ&Pm?d(y-hw~
z_x|<Y4XN38>^VVkxc`9yxPR(>-=4Goi-LpueY?NzckCH)?fZcCPaBcyckuizIGuy`
z#vB2kza|K(Bf$G&#26UbTND};5;(x)+K}_#z-xt3#xG1H8J=-K%NkHQ1CEQoTS7tc
z23lhXiVu*ONfm?G>;HRILE<1WM0_LmN1IeJfX61l<G9jHE}(N%Kx!fJ!omO=TQ}ik
zr~{4JLibxf<bbZH2G2u)&u_O81dri@&ThYHw-7w9xra-VV;OkA<qVMh7w$`|U7ydX
zdHp}fu^UIZe{nx!VFQ&@+-+RPKyH1(wB!gl|1L)CzXa`LG?8Jb>Dbc<p8Elr1D})s
zyC@Z`9<q)E(yo<+=Doiwcf#aAYl}eUzy7<(5Tqa6Mh1<?vNJ^%-?0Jje|`OTA$WZR
zeC^pG>xaQO_aWObg7)Eo%zVMLI0kMHJ7hf-h!2u`{db`%(!STL;Jt95zS=GZrYSp+
z_PzdHkqF=Sx@R6ZkG+tWn+kF_IG=R+yfB}`#texM#sttB1?9f8Kh5We3xn1pfb3G9
z)+}y5$MR419lL|dlbG1d=V-jizGHV%c?L(d`5fklpgI>+*Mj_Se%Nkf@eR9&9Fj~C
zpz*ZqJD~pb9?*K*C{VnE>U2<j3NrTv)51BRy;`ufH=r?JP<sq?<|V{Epfevp=iRVh
zC_ZCX$RWYx10F*L&9_{#6D+=Hr&xT!&an8ron!GiyTIbJc8SHO?Ha**tzmnoVf|yI
zv#{Em6gCv!v}0^<QMduhE1<S;@FClS!I$g=gD=`C24Ao<3_fq?7<|qyF!-!pV(=Ne
z!r;?(jl|7e**-LnU=ZNof$RkWt!E0pWyc8aJIF9-1Zc4@;B^o<KIefwFW7DY28IB8
z_6__G1m>IkVc-CX6(6+y$o-s)-8_Opf<u5Qh(mzM*W8ck0k4C=6}|@0*-pX|d`+OW
z6+!}_Ia<CJkeDC`Xr7j@O+c9YGgEw1`~oHZ76Ezlmkey2He8$>FL!|UZ$<6-V<&q_
zM&bw09w7mfr3?a>WF$dsrb{wXKX^6>vGME?V&T{UI$uEcDyV#!|3J}+zfC~C{ehwp
z=<FiUJUD-ofFK7iQw;Y<roiBXwjTr3*bi{9F~##g5D4xnRAd639ma8o>kfaL0Ea0D
z0}H1F7sp(_xw^M(xE}Be3Ne{8GqCW>2r-zPXKdg(AQ00%Q6VVc4uit{28A7<bzq>d
z1BDqVjeyb=^12;R8ZtS?V6f-BeLqOAnE(S5Xim*6h=GZNlPLx?k8~@D`vK@&Akf@c
zUxD4(TQ#6_6lF|7@yv5fK*B_l@gE`|Edtl0p#2RXvmxmYwAU7LJ|<|5#%*_Q$Q=rz
zOyD~dz~_}BrKjQ>b_<KI+f8h5Q1}2kUk&7D^TXB~O(d8efZC)Wf4u&?Fc4&C_EBr_
z8lUXr*5Gj(&^}ZXaRw&D+!11(RewW50H{w7GLJ(Bnx6ix1?|6#nh$ELvM@!1&Hldy
zy3WNKbPg_#eW=z8L3V)b1GxjF4`lA^|2tJVWSGK1e)qm^H#7K#-9pfO7fAl~zZEk<
zYC&NWe8{>HR9-;BhY_V+2O9SSjZMA&v(FdQz5|&Re8ZlRLxw5T`<C5L4hbgE*~j5v
zGym^3HIZcC0@Ycd_5?J)KZKae0zM<~)=}_UdPY#+6l5-FoQp$(DH0SHuz4e%1km1C
zVF{ijP}+x{H<tnugY1{(NfTf<k!R53ZfA0D_}}=#M25j=zJr1S$j=aWY-2U4fSeTq
z5<`irKYRb0-?F}#ecbvY=v)(?ECG4Y*>>Q1cs^4+PY#kjc>?mFG2`qzkbSbC@(gTV
zC1fA+3#RQC%x_sg+_OLtJe~xS2ep?$Vjy?CVA?(bq~4*1!2)E5Lp_5P%pQjt2Aj`w
z1UVea8SFsoO+ewwJ)J4sq=Lc0M3Mo#*7EhgrGX%~qV5TmkmsHQI;WreLGU5#h4{}}
zus#T~A7S1~Ly&p%8|;>X>;tvuO=K8MAo0Tp?cYG=06=9vc+DF#Qxs^e>+65pcY@1)
z7N+Q6P#pj|2mYqrP0%<n$gi*eZCZI*Liz(zdA|@E{|8ab2c2~XD&vnJ>;d(QU;kTZ
z3$h2)=YjT5!Rw%*ZPSHV)+8M~zSyAxv{v>?f{cvv0|pM|1_lk#eG;JY(e6L<TS4RI
zCX%qV!uxc276?Rv+Ity$7$QLF{zeVttOIk{dg6ZzOhIbqH`s&w8ld(J$bOLfi;psD
zfYt(l{0gcQLE#Dtqu2lTp9Hxd6rPvoOaE_wppXFSe}nw-eLjQXmjo6$lY0CA^Zzs?
zfX0sy?%B%=vJ2)OXrJsLEc`%W2U@oX>4SoDCj<CgNYEG%IKM#8X9Kn6L3!!*|2?@N
zcYw{SVE~^sgWhiet!V;}XUQ|gG}||DaR1^G28~yM)}esbrf^T@0-Zf`^!6Ocdg$Bn
z+z;9v6g)uZ&w=W$0Anrzz68)+C-(ojZMbB(6<8!e>x)6-iG1}!2S8?lTnY{^sQW<s
zR6*k)pgsxMPe<%|LGqxv6-Zb@_W8d4zrPn$*6at3b;8TO{i&cb22_@S`pzKz=J)KN
z<q0EveeJF1;B#m$-d5uWolEoZHY@)F<TwJ2pS=FRpVvf+5xlQueuKgVQ2c=6&_n`s
zCL*-$_h;)-4jCqJTLv`G4lYlnnOs2beEnzZU6U#XfsAxU=ov(ybwsS7GnVgw!ls~x
zQ6a#F^Fu}&BS`FiMk=EPPrc9q{$`;AptcY0aZx*PyB^-J2aN%N+QOi5pu_fpum3OL
z1-TQHzV<`T;By0~FUb4?&i%*UGZ+QtGuST$hs6!Miy$+={`kLVugNaR+67P;%x|!d
z1<iv5++kGUU}lO0wH-m~kn83ChI&zs#ayhQ^Qn0j2!YcfJpOJ%&T|Lt2L{c<&2LZ$
z2)=3e5qw@Es7(z$OCEH#AoowMNKiWibZ^c62lmIgExBfLNP^c69Yl{`P@fRg#|EYE
z0A*&-dFXdQ=Tm~*_WJ*BQxhox22j6h{sRR8aNS=obO4lBLFo)V-GkB_DF5Deg`CHP
zoHjsrB!TM0*Z+5c+p(ZCBtc;f5`);a^DU^Jgrq^FyMVy!$OT|wkpODDg4Bb`hyW{A
z2ap}0@&Qz*z5c%kygn0TE_jU2iWPj03@H3TdS3tE3%U!A0kr;ePJ$vheR))X;!oiR
zXx%>Od{;#L?Ko>9sQ{V(kYRG0-=KIQ_=X+0oDZmBQ~<5(0l61sE@~Vm!uvrWx!3;|
z?F7X&$W5UA(x9>kZpXj94^1Q)e}Ls+>Hpt~zo2vWL1Obk``=`k+;|oU#GA-4D0Kf(
zxByDyApOb;4B&lKuR;64*dTdnK4|}k43jgcJO;V%_AE#|y#BZSDo78=OqiQr|67Qd
zFO*@50J#g|-aR`_BpG&q?7@Dn5F{TJUt)YweAcdzLyE~4+^@W7XIOl}&awEsU10G!
zyTsx%c8$fS?IwcvADy(@SPZ*643ytM`R=g2Am~oA;4TIQ#~22O_7;T&91=_(NO_Ji
z_@bR*@C7@^;PZBY!RPD}gU{L(2A{EOBzhmxB|F{u3JOx7wb-DuKKbp14)D(uIxv^P
z9=sQhmrVe4{>i_dW$GOqTud>%JOVO~`xzqIpQuLMZsmV4XMsY82_FL&Xz%;whMga-
z&*>7_vXnvLa>I@v*XML{Y+1@6aJgYe&Gk7QEnAi{a9nQKVRwB_htrm&3@n!$EabO<
z_X+Vo0GYwdAt2Ao1v+C^kc0DR1?Ze0KgK+X1E4m^)g%E16DbA_6Ltm$kDu%kFF3ae
zFy=`>)`qRL|9`n(>c`bTyb>l-3=N<-;>_gYeEom(--`+ioS-;0)q#v1A=3Hgqt|^n
zT0nh(oA0?laPTuly<p$*2Ba3WcbG$#DGFrH>;Ice!Rg`v<g5t}8KwZx*=HOHkh3g6
zXIOyhc<4D6G5rlT;CbwM>^5sb`apebP+uROrv9uFH4##L0JevNDT0F+(%%N#^$*g2
zFDPIDl`(U!H^|)wsROOe0GS2KBN;gi;JT(DjiKQ6-#xyjAMOA1)Ch@Po-gr(r(Ou0
zUoX#>1hIucdM?kG`e8cD{y$H>kjUpKffleme|O&n?d9dE5#odD1JBJt^>Kmp@YD<O
zbi7Oi?|%!7VhDihn`<7$03NG{?|%aAEBw0~yx$z;*2`TIKQ4Dlez@Er^<vKgC578<
z+&_38fZDOb5<HKP+R#rxVuBnz&jh4E@e473*IMpbOi}zZ1myW=2?&GMMuW~v0rfrk
z=YaG=`kuGHa6I6jCm_sIA|%06EF^dNi{y{X|D}HLln6=j)C<Y*cL_=GcM3`IcL>Sw
zw+YF;ke8fmlFXnmVSxjO2`dA~3wdc#lcn}QL3fGsToMAOm)C!HZZ$c>pulrS2t4o3
zA;SbYqmKug4*u>e1+By5xg#_I<WCM>xHx>B2=_!TDTqIIg4aLu+z|q=0lx8^{{a_2
zm%s~o*-#E1Cby~Q7#u)p_j;261E}xI@rP>)sJ{*BYa{y^y}u3eE6DF4f1~@^M3}*j
z;}6$-{#QZ_{4a%=_+JRI@IMn`<L>5?@BSQr6m;(J3wiNgP&n{92ppc1ppeB=BOu@X
zRKbZSLEt{9Z_7Vl=m01^g8lGs&qk9f`-d;&#X)<3K;uI(pm_k$m^&<w?OCkw0+hyH
z|6dC}4+a!2^Bc_eg7O$h9F+Fq{n9^6K>a^(dj@0|NFHI=Zt(gEkp4Xj6cPes7y`^&
z863RlFgWnk2+aVy=kK;sP#$_AFB8kN2XwF18dp#q|3Y3Ke8!r2D+A~Z`nle7z;^+{
z>OyebLdTjPnCxND0*?bqGANjEGAMw`<c~4}PN4B;kb6M&JE;8%D~E&K859CQdvO2m
zoD156n|%N}KQ6^^0_>(gE5PxbeaCJl$nEBL>?VTG)cVB$u2aEk{%$qpl;V=&?qre&
zwZ}o~Kz4!U{;cpdzhyTOHm3ov=l?A~3HB=kg9NBOae2P<zy4?TcW=+(x(}WkBCv)R
zG+zX2XMoyqFu#HA`@2OJlz&ZRAoEb5F*Af)mbHS;xy-&}chme1WbUT;j@?Jtd<{q)
zcpm1@GSGba#rX~PS3!OOuLVM!5d!UBu|WE77wjCB7#SEq^&QuBE`Cs5cw3hrJXQg#
z_smaOKLo`Ihd5;4E-36dB$(VyB$ymPYi@43LC$wHISQJ;gtX6L@dPRlVfE<iKl>9+
zjxjm#R0w#O$S^(uxh><4?LiLc9!`k=H@@X$VByZVV|x-Lk66FC5xia@<Bl!(EFY6!
z417@ay&!*Q+_AlRagVh8O?7T?xvi+sz%aQ%fk9D$fl0Z6FOj>G$&=&#iiQ^qEM9Y#
zE#3i&v$+dY1C$;3l9e6$5<%<tAm(iV&sXy-fRr&NyBHKeX&EX9-cQA|08(av>L8v%
zfmu9zgeE}cA@vYwoR}3dpTphC1TAki*m6cOMe(Ewb%OlGQzJByCs6=ge*{!9fX5<u
zYJ?iiqab4ium5iT3rcHXwIu>F?F|YXCQ^(#CQ|A*xTC=L;ynl56UiOJb%%Qn*BtH`
zFuwEok3cf_d=~l7{{>n=YeYZK7jOdIKX-c$vl{69O0Zgx`Z-*4uFv5}28A8i?SB@Y
z<(|a?o^RriVe;T91eN8&5<JC-u|=LzkeDC`Pq}~;XnYZ__wTw^(B3SbOpv^=1Wz`S
zo?MWaAO}xAR1au89JVhPTraKT1?j!=Kt`_Nj}o}Qm3_j_5^naNg`oUr=zYS@a(;u|
zSx|U@;*KX#VE*<0a`)#qC@ApM3qi)#|L+V1g(XNn7&O*FL7U6`p7p^w%l4;U_#^#=
z<2{Q!_XHN1=J^R69P&&a+}%tZAop=_!s?ebttM+A=>+6HP<jT3>EAWrc@myIkhH`B
zucy|4=Se{62CV)CmlVi6(AXkG-|DBJ^^iP!AnELdyi_X(59p3rsjZ)Vc^F>E%l-xR
zT|ngr_|E140eMj0r~e7)EP4C?{5k?M{0g9PDnSm=*gL<TfEdVJ(0*C&X-r|S|8M`w
zZO<eL>idBD$SCJP&4iu<B?B2V0+|~e#h}0;4jps+yY4J#odvR9kUKzg?jSorYtc+N
z?eBv6F$%{R7)*{aD1rJq;I-aJV>sY49J;UM^`AW#O{AD#fWiViX9AkLkN~gUhOD3a
zy9&H7fV&M`K10@RNi(@{cQT2aAglYo4_yC%%mLlK7<}JuA}H<mH^j$+!WV?WchN~O
zXn^t-$i1)s?*pHA1kwXq7Y<Sbm;1XCydP*jbl(VQY!s{pdbZc=|9ipvh@j>DLi}TE
zkoE7NzJGuXmjY-{38-!Zm8+og6jY9a>OfFk04h77>nIg&d+`4N>FJeHhzL;SGT>PN
z-lN<IpFhGecNBceZf&oCf(A%0WIbejFQ^R+S|0!^&p>VT04**DkH<XVc?Qs0sQ@*u
zfG_ntEgqQ+3cVsq4xGwdoV*SK^LdsFf$o1~;*A$-;5j1@b9s*Z2hg|&ua<x?_`Vm8
zoohh#eDnUev!MPK$WG9?!~v>Y2|PChLO^_;%|adl8e9b&Y)s)iTZF)39`y_}Kw-_Z
zT*xKBf~x^E7RSNC6veY#$OjZRpt#^!E)>ACM<{}qL151HcK-dmGC~c=^ZXz;@SG8d
z=c;D`?-S=aArJyG4`e6Q><*6_h8ZApL1yyo7YYE|)yyRWa|_RAu=(?^Ka$_iD=*Z5
z+z;kCBM`-_B_Me@O8&zOj_r3q{xsif|Nn)&%v;`Ap$4840#UpgaQQi)um;ID?{NT^
z=^#5_|KG!EBE=vAN@F|=1ZJAsK-LU^;=!YaVS-0Jg96C!ptH02UkFGA*l<mF!M<Mt
z<UU>pftmbsg#!3r2}r$Q-}iyPL&yW<w*U*S1^jb`LO^o?AU<fHX@C{i29SLLNsxO~
z0;)m#fuxs$;siF%rp(}gy3XkDKJYjoW`1T@0GSKA0}U-*9tN!oF_B=Ff|Ros7-zkh
z-?MlKatA2>%#T`p1hp?;|5=|2s>?xP03Oq@VNC$_WkGfn-?#V(x?>8IH$n4X#dj=0
z=kl{~h%-eb-?5Yi?QH|8<7(y-Nxow#%OTDbYr@1Vk$lHeo+klRzX(g1)G%=HBnb%f
zqzOpD`Xit<;Gj7wP+bM8W16KDAoE~98Q8dOxFoq|g6F{w?VkcVuhE7(`?{s#r|$wz
zW{(*xZq)EU;BE!&|ACwl4)P0VUf}hgwKqZj0gWY@$S|<+{}JK?`N^ale2yLH{0+!h
z{NHVs;PXc1W%mXjvN$;Zfx;ok+?m2A(3lp;U7$OxK>elw8}<XBdnrM4B>W8mVO^IM
zy3A!5m_Yl~KhF_xGM~d>(cCmw7JOgae(+qHyxAWH4zuqJOdNZ-=G^+u{eXY6Pz3*c
zp%}2f8K5~XIa$zHnfW&cCeR(-eHZLqZ`}up%Ye_5grx`2dI(VYeCsLq5BM0=ExV1d
zdwIck^0Mz@0Hu5Ao>p@1<b|y%I(Q?Q$rp5&DrjvrC``fY%>M2(1dSDe#ud3|Fv)<<
z;%IJF0G|Z~D#tl$K=<dy&j;xNjaP%xGnVoFh2XJo8OXRdD7^&Oa3p~C0E6l<(D}I6
zqd0r`8w6&8_PcP;g4A!IxG)i6aNzy|T3@7KrTobMHh4e87a<0vdi~qx{}mX&CGarp
z{|vc*&qSVq1+<?Ur0;nA0r1@|AoD<B45}AF>j6z<7#d8(85%%m%YyO&cwK}z>Ur+4
z@CVi7Ap1dX{QO6-M=8PoHpo8E-dg?#0#e)|Oj7L*3L2n2#h~&VlqQh#>ie$!Q$hM5
z_UvN?#S`eP0+6}TdKof5cN2WqJ?Jh?!Po!ygViZDK<=0VtsMoek20GKzN3W!bg!D(
z6b1v(-6>pixMWO385BVF@+$~T;hNt8+Q;a`mmnYp+J|cXpMeQ<zWnX~;CnwsxTZ3R
z^flP82dM?!4+?SzWGoc1w*l%dSikQfYz`Ha9^mtOhe2yw_iin|1?kT*F>q`J$EiI>
z0_fZk(4AWRKLloZRkBOGVBc~8v<DiRKIeb_FR+w*KZ`u~f3Ex7`?=z|_jAn$;m`jC
zjzPuef0{4Q!u^Fs9x8trbl;ZwGX@XPJTb=|E;i7<Mv$M2@7QewrCIYU_6v)z*e&E*
z%*6~^D+0PVheMdjeSU)i<UC<^rg)Rj3{1gS>?Yny=YGKb1+q_o=e`hw`F#8TxBqZ|
zxcvV<c#S-0Z0hoZd!T#VH+7}j_j7>s%7D)f#&bS5cyH~(*MGNz?=QVQhwH=s276vm
z*@Kivwu8bDbk`hcEmK#j9r!LD(7ql}Jb=R8M4XX9*`|R3w7v^ezM5MqCxXg%*q$a(
z`vcS$0<}S2|KASo?||%>-=N?Cntw(b*Tg9IL1)N;><6VqWrz6N=23hMpJR9!UjN-z
zsBpmlHpm?FX2_XNCbuACWUv2jv;6GJ!!RMa{Wo|Y1PfF2<@wTo+W*<>g4!hQkL=|^
zb{>nl&kv$Obvnp=kUbzXUjN;>5~Lr*2AQv{&;VI${&#03Nc@Go+)~h789cv<GcuS+
zfX>up<WN>&0I#b9`PJM~D-jk3um5j73JQbypmn^Uz8oZOP}W6(>{m$ezYTJWNfkrF
z>%Uu8g8T|`y8?LpY4QW`U7K9TZ0^^B!XKnZ*?<A;K8T(jh9G-j?gq(&#6f1h{=5Ar
zOb#RtbDMb-!-3a-H(!Lw?QgIHkL5tipbMXyc|hlOf%mPw{=4%ls66;q&%m&Mas!76
z=-vxvruY}~a<RAnK<=3a=P4VG1QSUHCeWM*$Zk+Q0J0M_9}zr<;Q+{=CRGd#{1XIP
zU;o{95@t83z6Q-vg5m@u57PVk|7Ks1JZxSPl=s1XjH7mMLFo@<AE=B3mCc|sFL(~a
z1(-SfvlM26%mDi}iebj<|C_dg%{pZF5NyT~dtO*Pg7kvazW%=zzOVCo3@7;Ba8OtT
zK+6eGxy=7UU?%RedE;A9K0q#0LGDDDzXd!-42mOM=7aJS{|AU2AhRIu+Gq>%CpL3I
zVGB|NN_VgSZ+?5*88T*pVg3h!`(XD!RzP;YgNZnU0-|o&kPEUCG>3(37c87W>#jh1
z-$3aPQkSpF0Hq0NSs6pj9rqyp-1AxF`ya$VML$mhbbf$R5(5Khot0TJKcm?-`~RRm
zU@^3B2kHlc+83ZS1x`=S3<<$83=@Lg7#f1(84A2z85ZzQ7IIL^U|`6e&d8A6z{t_A
zpumwmjS+MwS;KV+j-^}`OcDGKggQ)w8MwggKSC4ue+V^z!V%OT<9{Fo?ni*a^!49$
zk)UxoaCrq9YXF_KCc_jCQU^+>U^V|2A<n%A^)<yAm`o%X3J~%OpMuN)$9c4*Bv{Yy
z{orvX@OcNIGJ%VM#e@@j4}%2w9!qFnbuH9>74SY4P@fTWhXKs3NOpkd4}<U6HF9@>
z`nAd@K=wJ@VQ}HJ0kuW!{lR+V84sBVGc<7jVUlnDtb79$k6>|VzZc|Au>1b5$y7MP
z0GsCv2dTOCKt>+5f4smHq#k4sNFGJ*@9LKzIqo*l{Xh2L`4Om^1h||3t_GbU0~sF%
ztrG%;odg3y{{Q|$kQpHJ!Ql-Gdstuj?`ln$94JhnW`pkkgoNAweLrFH;PbOl^sd?n
zk~5KK6abx}-2On}1IP}j84(Egtx5!`1Ix)Uxq<94kzk0p_FqOGqz0rO99IALDZ<o&
z_6bA8cFqOKgY~j8fx{1^7o-m&zjr504@eBe28o08y#Bkg5FD1E^ae?51~5B8YF_`}
z>j+X0-*Y-g`hW9$1tEt!3@tC@WmG}&4XVR~@7onZ#w()1<3^DFl^xONWPr*o(0G3F
z2}a0WtH<pw-d2Z><sP$p2)<+H2y}cFG=B-2y9^LG5$w!h5Xj0f;q~t=s-Qla%QXfS
z(Al$1cN!pj1<SZ(zW--n*+0KA!bFB~!lgS>FL?F{N!_S{tR1{j!~B3}kC4!f8m1RF
zlDR>0A|^5nUK1W@Fqp_NWP#QZ-l&m!0jhs^_6Tv^sFC~tIwO&1zYrUE-VM~}-zEfJ
z8+`2=rzX#0A&v{l5`V7L%iQPLBgDhAScvcS|Lw9o2L!Hz`d#h+!RKd7fbs%(Y#Y}Y
z$O*f%5H~PR0o`j4atEwjG{47q0MzaQ&A)@nVemN23A=;vv6v(FjQkD)$1dEF{@>rA
zka1g?AAC2{>;HSf^C+M*^$Cr^nBTK=1l_e;e8(;kv_1iJ9y_S~2##TJ0F85j?)VD!
zU;wTEI9`0ht`XF?DL!r&xF<m|BK?kCDQK@9Xs*I#KZDAJ8tD(+e;SiGGPq<wX%1AT
zfcl}3^tFc-v_Ectg97->?$6GGnjkeM5-bd$@CB)P!MN%MXg(3NXAQK+3Y5-2D+_9Z
z)NreDfy=lTjH@Pq#xB8jurNh~>;Ri137ezeZ3?mnq!-jSf|w->x_d$b<W^Ao4B5TS
zf99Kl^uLgooePR9aQc*DC@6;A1q@m@iM(I+?;7y<IdnZ2(mq+P1N;q;@*d=u*MHZj
znn*EJf!qO`$AXBj{%Rt{P+%f22QCM%&*5kRwKoDxxGsS1F95CcH~-HEKFgeMzEDGe
zDc1vz8m1V&{Xz{UVhk5d<QYy~o-F;REk!}$@*L@uzBC0XkR0fKM)S`MOdvfVx~t57
z?X7yyo;?9@`!T?Z6?{jQvIYag>wmi>%`HU^g4_nS+nx(_W&!w~xd1CxaG&S(za3zI
zg4BTf4>FMb+@SamP-8dXxg*p7DwjZKQG)t898ydnp!4o;&*A^U-2l47l5y9(8pTIE
zw~)f*-`3pgQ5?x2Ga>e}JAn2n?r%_B0BW~`%mk0SSg}IpD*kPUx0~iSC_Dg#BglTR
zUNv?Bka`YgreKg5_-=I>rck~F&>3(1Ke!)&-Ox2}zTzg3I_^1;@oP{U3lt9^cf9_$
z#n*(L0X&`$Hq)M60qULz^Hv71`QW^Z<y?>8<928Jr`U;t`j((Oz&J#hf?vqXeg&PQ
z@j_k>e6|DVj%LuhPf(cbZ%_yVxu0hN<h+L0zgMS%(jCtp$o<TF671)K);EL3%|T(%
zK1J~qB<;%Ag3RduV&`gB3?3(8;t*vDc_A;S3Yzl;-IosXKhI*Jiy(DSyDow4+9+@f
zbZ!|`>=bA`6jU#O{Qvs*&ZQvxL2+TSlL0(e02MC<s{^$kVCTd@_b$Euz0(%7uWnC*
zy(~!I3whb2pzvv*q7VgftK46Z8=Bh{gg{{eT5AZhf4+k~=xn1%eg`3j7xHp{L2^6^
zVD?s!J_uX(D2NTpf1vw!i$UvMB$<3c^Lr-T3<;pMEhbzHUZ672gp(l#G%jtz0XaLz
zgq`6Aaybd!=MP&K16_N@yFftlwk7|M`3mZwbv=yTT8iL3<fh9Qm`r#W96;*`c@78&
zo7LDa1dZ*qPipA6RmuOO|AB%Aw>J2E=O3^;ZZ9|72lb1Mxc_s_0j*mF-Cb@z$A01M
z`TP$+XXk;=+cx20NO&PHe-~tKx4ME9&mjSs+cWupG^;Dj0?Bi0fc9E4UTW5G_+V~h
zuh^`qy23<;;aRh$LxqV9!v;{@)NG>&KGVZQlEDicSFF&voZtI3Ie3}eUNAt`{_z|U
zkTE&N!16*~-WP0#jWX!&kYn98_N}10k|#r8=4DHH@IIi|zxRRHalc?-1g|Lo`*p&6
zQ;-|lC(PFe*#$~h3=ATh&59We_-YiU+?vAwfNL_B$g73}ObiSRpgT-U{{R19!oa}P
z0HGN`ce6sp80SFJ(cXt3yCLaB=C8?F1}2jn1_98#|D1#b3y^<IBpD!UV}9@LgsJ67
zU||Nyf!6Io&DjW(dm%5M%E80r%#$E+6C?(ehn(%j!W8{NUS1V+t~k#j0eKS{h6UY!
z6a#n?1kOPFZY;bF0^l=#Z(B;efau-N2{H%dMiWVf60p7SFy500iYKs~I0FMnFL<pN
zq|FC*_hn1z*{^@^YrJjA{Tr-Kk|73U2E^>$VE=>kf#t**7(o5d+m_s*Ia9Fy*T461
zg4Bb~-~p)tu}vhQV-CM}gZ7Mr+p#8+42Zige(yGfyBT7p0=TZ^VTv>nXV}1#AaIV`
zoN2mAE`tCEA5+Yw@ArR9`wp?&?7RK{OW&pCZ_klV+23IQ-duu#iCdmU9y&K~c>6K`
zgO&sbaNKb4LFdwb?>Pvw?}fZfDhDr<bMbY%K+t-p;JbE)#W(C6LGrJE?_xAbw*L=0
z*9+vA;2U<1pnd(p*X;s9@zMRq;wy3**pr|j0197FSr?$puz)84mOpL4du>5xLc(!p
zAgEjbjTeH<g{2{cdh4^Ga6_oy@ex@)IcwQKcW6V)A@KYHXuPR-mwjXLPWy?VzG{FK
zH$(9b`-SE^>?am)x8GR2&HiBVR{M+mTZ9hsZx#Zd2l4v<wp7qvZJ;%vu<-@hI$skB
zh7|LAObnntr}<s`h2XRJkJy3dAV7Wr^+CaVFMsdzG{0q6I%ff7tOnFRai7op=kkB)
z56W!}4CZr0RyY3vovoz6018KtSpin83ts=<R}1Pt2OqM1h-D0#5!B9u?4<+E*((N^
z$S^WA)F@Vf%m}b#1+Uctnf3bL-b&bBW3Zeu>j9Aaz;eHLgYJWh;$UV1kAa(rG8cgM
z{et^5k__OvVz9b@yEdYk0X|O+Ecbi2C#cT>j#p6z@V){QF=o&?eBmH-O<?yB{M)4o
zy2~A`PJ$r?-lqJ$htvF)o!|?3IbD!nL2i5@FIO92$@%~qf8aH4pt=Ecuc!Gf(7E=|
zy8-?zhL;=j8x$-+^(C|~(}=!j6tus~`;Ohi_67y;J-7i@tdMhH{_kE33TM!ICeZjD
zJZ%0g(FC2PvLCwU-uaH**7gPk=-s;VtpQeS3?Q`}%uHb%tl)k>=x&Hd;4t~K=piUf
z_BYr)1^IW*9t97Ozd$&^k_~<@Uw{>x!R!CKp!Uo4g6s#M>1fF&fYg6TFyCvx5uBdv
zxgUV%vq9-hhJm4Ym;FWlok9oscL-hN-!623f1A*S;;jq{#akE*+7%QQ6mMp5;QqxW
z54P8a%>gtwQGCnpAb6cV=p1KRrikMEb{C89+JWcMUjN_F3i5OC9lL|U_w6o%&Mh$i
zWB(s?P8UZFiwvkv0ndq`?nei&6aVhOBCp)Q{}VKxH9tmK0(7>){1{~g<;L~@=f@~(
zD7W>4XanULVA{e&MuBmDjIx7rgP-F37-h&@qYdOvdQji%`+pvW`M;D6lpiTDaR1?w
zhw?R)A2T5H6_g*N$V(_cM3EN&wZ)P2b0|Ln%L{+2=V6#vrOaUdp9#r4r60;q!SXWS
z=kqYkpQZFcxq+W?evHx&<p%!S^JA15lsouuo6lik0JCR+#W<8_f@uNeIbd2sc^;Tn
zFp=Q_%{^WQwe9v#UNFIYzI`GjeJpeYrJeZ=O5pJYaQs-Xf!B!zPiJTVw_~liA!h~r
z-~HA^k^$aFdBMQo5n#hD@cF-B&;EFOf6#nQ`y>Yr^Z5*U=JOe#XEtyv@Xr?#Kpv+9
z*#S8_lq~_u-Wy=U2EF4Mbap5kxbFbU2LU#0&^xN-O9O1!U}ufS2H3Dc@2Hk{4X|N5
z05wN9z=jQW?x<*h4ch~VxZK|W8#d@2)pAb*Y}mo&8|bd902_8_K9buSU;~=}6#%s<
z=LXoYgYzb+E)B3@cYvCc8(_m80A+^;*sw$0FJ~KI!wz-7oN9m#JJkJhya6`sQ1{Dz
z1<fl%^vd21uwjR~U-l?yE)*)hHo%7c0#bf+Fp=Q_-CqqmTmR1SI|sn|&O3s^0u*o1
zweQe6V&~uDn|9!{9zf=Kl!5LtW(W0i!a?(l!8aj!3#8AZghAo;|4nB-N*TcWvOwy2
z5(K94WC%>>DG&g!Z49tt|M2?%rdFN`ftjFoIc$6zG%gJ~2La(urURg~1g_W6*N!8P
zFF?m%UjJPc3v$E!2JHq=nFO*M#1F9IU@#G9U;&MjfXsXSZ&xO$%!a86u!5Xb1==qN
zQlrQMnO6YyKTRbWSm5fEITS$VfXY3PxgfO=^LCyzkz|0JZ2&z}!9<b)x>jukyq^!(
z2iltfUaz$$)`Shod@BwEQ2BoC4`eMF=zIpK`J5p0VD9j~ZWkF~#Q|OmZc@R(bnQDw
zGU!fch}s<+VQS&+Kn`dd>F;t`&|Qikb3l8*LE&S5$}X|^pk1N)VcS3sHYOkUJ9fFv
zt&ZSzuAnhclbhi2T*y5$f0xaL=?Ccr=`-PGU;(i~=9!<cUueR^2wJDa#KFkq4l&CK
z+<)QVVu}Lop8}uP1orzfR*)W$TR2#myu9z&B{sJ<gYP~EnHONi3Mm`@?qmgpHAvn5
z22~GG{~N>ynFX420*#@7{rz`os<|ZtoA-UY!2Sp7FF@+S?FYzNR`ZYVKYRnKj|FrV
zr*d5Xe~7+K2f=e&49wtu2B^IV5nntN<mTXmc7-6b0xUQJKy@J43`xk{zOVmpss+a>
zs1JIKfyMp0T_OkQj%ZNZn}Z2Fb`3V`-_}mhxw{~9+;7<>g3JJm|6NymV=4aw_dAgD
zlU~Tn`~}UIg6?_Z;9!b<{dZ9>$PFNU&Ufrm`x_J<IA6C*5BR|WzSG<Nnq4Nyy<oNf
zH-h)ogWbTw6m9n1{;O#P0}se9(7q3_ntxj=VeW;w11$b`ZLWEg{a27XVD99s;o^QF
zFH;I~A2<x8nOp)aI6&jmVF)`nfc=kT=Wo#ZWYY=;Hqd!n5I-(N+;4E*HW1_<_nWqn
z99&Eh=C^Dib;ZBUo-lh~$V)#3?YW2Fz4CVf_<Vg(7<k{X1-FHQZ$kC`-Q*d3%Qn#D
z4`ff(?RNeLp!jcoKED=Z4+ultuq@I<ieVeb4A44LBymuCZ3jr)M2cY-LVW4ZD|@&l
zKF{HRjD4wb34rP=j-5=Apgnw`bI1a0IKk~h(B2VHe+gpGM$PX|95NvDAZeHbGDh`x
zGuS<#^_37g1_l#(9tQ9kwDX0)`8fT6Z6GMW!uKft-G2}iSMGOg1KS%Q`zJtVg4`IO
z#sL|3`nw5q|3MUZT#AJ$8YCZJ#jyb5mQ7PZYC-nxZ%|C&kYREM`60lD6WmwlZxA>P
zR`+lHMOeFce!HRoD1U*@(F5s)%1?yv-D^kPy9XN&ef@ixCwwdhdY?8Z&4Km*UX}>j
zyH}9PXaHM>ol(OGt{VevI5vRVYan;Q_V9t$F@g5&f%fkOAF@>>Wp9u9JzK{Y^3tGt
ztK6aOY6s9-K-jq#;PGkbKBHg>27~zwiUy#4ui$XA<N((-umA4{pV<fsH&9s&lH)lb
z5C)2iV9?#N(o8P5j&c7Du;930vXqJ8(lzPXV1NE!mCBLIA_>wr=YWC(X#E*TFGwuF
zg5v>5KUAG4Xe}B@9@G{F*ME5LY2*Oi=>l4_46fG$%sIgA4N&|9Sa33!NHT%vz+eAg
znF{J#g6!uxA|O8Rfn6(iD;G1^4a`hYU^l?_ll@=GJAEb-IBkQ@d;+-zqz<&UA;6py
zsa?(tIvX(@Hs3hkLE!|b?*UQ^w%?Ld0kkjK{IJbM4k@OH;_G(M_QIaOApe5g0#X}%
z&F&#M?4aXw0T!GFApPbyL1$Pj|H?fR5^mt|`MnuDFBW{rW+7_3zy^G;D<oc-!RL5#
zh%-4CgX;bx_KcwObU<+lavxalQM-@eKJ8)HS{a*zAh&?*4S>1(uKhxgyI=p`J=gq}
z4R|d)NDaun-q-DJg3>g|O{nf&HWk&q8yP`*=Qr5%gY4#?ATXb&UdV-ihQNI9ISdLs
z^+KRM9Uh=IA*f#rb-x10UU0kSu)W}X2L<pNdXU{9_kqre1G&-su+2x1{jdM;0-g5-
z9%BKi3BGRkF~EWow1xycJ_FJN>eGVGZvveQi0(d6Tm&Do0q^q!&22;4SvJV$qBely
z7-SB(59ZAM05paG9XnVE9#g<EegIlW_WIv)Pgwg9)E=DQpfCZ{CIq=Pz@9Szw8n^|
zhKsrQzTHI7{tu9!Kyw?QGtP<++iiUPe`{p%4RC*KVen<Ujq~aoI6!;LLFZNRKLDSj
zlZcuYAnSiY^MvO2I2b@<tY9;b+g${ODbyc=;C>|XenZe0>ruOppm}o8_;Ro(L&EDn
z8zzF*o`cdVsEh=S3xM=r`!6#eWIjk8$n4kumW0C8fyF^}JS$TqNDL%zBF>=l`ri^>
zj_*w1Gao=}R6*jee=h`&V?xabpOa=H!2oJYK;~-ytcTlwd5-ko_BMqMP#p!D!{n3!
zuhj$3rGnB{@FDYu#O`x6zh?oy!`TFRPWjKeognvOna>B+>k#++Tht0t19q=8lgoAZ
zoc#ht6K=@<YYrJEFX&htxIPBWF@x?Z0EN}-KWjgN^mBJJakMfhfcMUU{SpKA%W@9z
zSw(WGApd~a;IKpuN43}g7S@8oF(91*y!M9!x~By+9}5oCUpsR_caxdO*gJ#V$@51D
ze8#$o7z=~>aSK84ek*qHod8fj?FH}G+uxuHF7rTr)r=a374G*f1T#_@3@-nXmQSc*
zaPX*MSkd30rU4q01>J{iBE!OvQp4cle#b&IrG~-B{f>ofN)3aD`yC6-lp2Nr_dAxc
z$Mzf*3ch2x5OlBg?Wt1T-~TfR?AzZUV8X>P>-JR1P!leOK96jM1)#ide!@=BM4lml
zyMs&E<r_ne`5Xq8OIM_RT${!#!B-;Wuz$Y&QIqEkEX7ytAbXZMpyTMjcElzhfV2_a
zFIxth$S}wSU$tvwtdVfIl)xZ=`#<;p{SOorIAoZ@K<nfBAJ`uStw{p$L3t1q&H<L3
z2^?HZAsie`;T+sd5hhX$kaoiV?O#pU?f)0lFl+#YB`6Mg6`*rJ|F?nDUPcYW0r$%m
zPmgat0G@+#zhhZw!p^{Rdp`G1#&n4Tm;Z=B&oxx$y78R<$MMUDJxn<4|GVF@<h?zg
z`!8b}vKpmVH;(cDaKB?Ic>IoofC&c!2j~uM^9}}<fGp_Pngj#*yn0AnZw0r*O=Rrv
z^Tr5)`(iEsm1YFgFo5P)-M-vsxo;xRzy=yS=btac2J$O^n~(&kJOr)f0j<RXoAYlc
ze7y#*g20XW44^ZLpmUCvoZxkxum7*_HNRye2nq*KxM3?}L45%8n|6Y)|L<x<EoYZ}
z1nHgMprFMMsRKNa>Hrs>8X=z-@)D(>bb##7j0}bqptKBj<FCzoLG67L8T*?cH-P;M
zS{EV)o_mJeaRKYg{o4-SFVR2W3Vin43wiOqpgi?LUh1hgXwCN@`~Us(Z9wbU++WDc
zTm{9k$sMp5=q^vU7xFS+P1rzd?`3&8IGEfTjw=X#xzDoyg}iJkC_H;vVtv7PzH%_R
zy^xnR{c@kB-b99B5hPy-fb#{&K2W+hk+EX{%?X>xb1`(!H(LtwqelkA0`p_g^xnoL
z?D7?w-nU5oxHc6vy@TQml)fQhu&EWa&kf{%SXw7BorCv9fXV={dH*+=g3>zn^u6IO
z$Zk;jejzUn-VX(;pG_nL7|ibpf$p|u0G)#cG6#GP))~7(^D}yapuI<+^RPI0n7onK
zXMy&CaIiD^!Rk^Db|&zBQ{eNoKxb)z&d~zhrvaU(fBkFyUC<eqAisjsn-wQ`9Tv#G
z*MIjYg2s=F@7O`pBLhQ#CiHwc4W<Op9**W_2L+QX2BzRUc7omQ4jsXVbRUBFAU|FA
z;^g4qVu}RaiwiOjv<K?-pN*C`LHChB*4DVS97tFJQVUw2(ivkPYMRX;05XH}v%2&c
zL3Y0WyImG`w)6Z3dshw_CUE}`Tqg-IMZ(%wuYavQYo^N}z^fo|r%00lyiR6*g8~Pi
zjnD=DUZD%Tx<Utd69n!+=Ifc98V@UQnLKA;0_`*AWe}Lp{TOr~3=<P*?Joy2lOLbG
z5X*&=(%`u$4v;;ZOi_GlLf}1`um5aLEV5xRNV8#ZxI9M^JT{qT!{7oA2TACD!9SZN
zL3LP`4FmYj9TQ20Dv&(bPk&Zj1j!}YFob~O4LptnYghkSH4`cqaCwgOPtY23@VsSH
z19&_NWCncv<IgHbsM;WqIo-_;3ZQve&iPz-_!|T+b0t_T;GZaT02I&M^D`PiduhP=
z0&dq@P&+viq!-j)0PPdz;AQfBAus!umszL*M1#&L1Epv4dyL?IC}?i_HW&W`(A@N`
zPJYOpJL1qgcf^?7!F?quCO6Q!4^X@M)>6<}F3>ejpz~1vZmuo930Xr9U*{mfPykA&
z;IR3%$`%x-8L12&!FTK?epo8d!c!x3fG106g2^5R0q!;~nSu-k1&(E0Y&;hP?iZvp
z7-VEJILv>bAO-R>U!uSju6FP~lCFXph6IyhhJg7G6gUd%83On}3tix!EOY?cXG$dY
zo|Jv<3PM38_80ec?2iYT30i9o8l&J#5V(&RXM~==bky!6WR45r=iAQw55VDZ-R|P+
zzZ+{o{T)!4gZeX|^(LV6m_YsI>{bSYeGe1__-BCb9T8v%Fz1|5Je|P-)VDPeVPFcd
z=Qij`bKu~AAaEJ92ISUM?jQ3K6r}hc2wdT76qv?!)C05^AgXviLxTAfhJbkq3LM3g
z83Oo9gf8%Z0iR<7I)@3ZPh)qm>u5ri*EIW$O^4(AL3+6kYk<rNnzul~D`=YiL4F1S
zNxlOD;@#%^{Xz2G<_c2Y;tU2}*BA`CzU@~BiE)U4*D>GaYY?~$axZ9%0F-V(@d}#j
z0Hs?{{DRhYz5cr`5OkLZC=4L|V+Mu*8*T^CJUB=kr0(_KZQ%K0kQzweQi0)0GN)#M
zJ<|o}&kPFAe;AZL6$^53)iA|eZ;-VG-Hn?3m_g}6jns?eKMV?>F@0D+1-73ObbrQe
z32xB6UJUzxC~$!8^#YxF#Fro-!u^L!7_`0xv}c8{L<khE;QjERHQ4U13@RWuf%-L|
za`^?@)&x+$05lc@n(uU}XHemOYSECAz@P%+Blj~vXF!3%!TcT*xa=stWT$8%#K2H|
z(az9Bkf8*0wuy-Vg9>QBw+TN3Q}H>wL=!#+70{ZH;xl%Q=4WibLf3^jfbt%P5R(_U
zuX4inB4}-#2|EL5&7LnPuVM6CK<A?zvwQgZ*Gf|pDRuBU7of2jP+OW~4~tBDgCqE^
zUhvvbF6j8~uf?{Yy?Mz8Ap5!#vLSn+L4M<a-ebg*AatN0gTVoGA7M%Yg8}$FCQy9<
zYG+6=D1hn=P<XxmwP-1*o=ZM!3%<KO`J65Ij&iV>P_t6<8B};OgbozsfXx$4DPS<z
z-(a^D6z|S=Y+rUyRM=z!YKJt~^@7IcK<$NK&^h&&>=Y?I$Hn}f?ZN&I+q=$pY+v^`
z*`5W>Z|-xj1@CKDc7cxH|5~=!JW30EHa#fpUdYSVng}s~)`o!72WWiQ{GQ;002`(c
zpm;G6W>5g#c?OCb@R_Mt`i`J@0_B6?`AiIR{wpY$%7fQB33Pw9zk2%x{{v9F7nEN>
zeLPV9frRA(Uh`XahQ-J299!kpz-Lv@d7uWKM+S+5)%@SBYQo0Alzz-E)I^4XCHW5Y
z{Cyb)C6IZbb&uwU^$bDkix1lwLiFs?HDP67+uxwP0uttWhW!o76F_HvfZ7uveF2u7
zkaqsBeU0X~^o&93_BSYdn6NT%Ip5LS?|fhHAn1I&&;KE3{W;&!I}AD-59AKeIVH~b
z^^Sth;RD$ZG7n<!PFs*WAZDq8#|)kC=o$7msd6~q(KGIEP~~vGua|2g!?3FRk1B)n
zeZ71W8OD(AKPoSr@9Pzs$S?|Y|514W3jY8b7SNha(D)YoUcmrMPVnB#*MIk(gpEyt
z{1c$YiI~^_wMP+LAA-i-MIr5Y@H{nWEj1hX&TSd6TmSB6gw4rA>|<KM-!62({f=Jg
z{ssjO=aYKHCNlgDpu4EtkLlHd)hIIy@YD!N-MGW`fTu=C#`}(5<K@W`KX{6TI4)0?
z1kqfVCrka{sTY#CJ)iplPq7dW=xiB}KMV$!Crcj$t-0h$6OuDI#=v&tm^7%(3_2&8
zq4>UCqWOLMg**vDB0LE~Vm!q{Y&;1<0>$_38uuJf=qSEpXSi2Q5qzhIsf_(Wo*E$*
z4pyd^;6r+h#P|F4z~^p))(ZyTwQJ;fR?)!0#^er)uN$xVAH4p*^=SHOyU_g&ir}_S
z@EyBE&KfQm&NLP_P#j-*&Y2y2$IcMcwz_eQ`@;))xuc-_8Uk#XLFbv@nctu|0Tf29
zY7H9#Y?v<aqzSP&&u35o?ZI@O%%B9?gJ~kq&;;5idik@|i{$wXO39NM6inn9R9aOO
zK<kX>^{Od=_Rq+f$TN5()PUAUGcYC8Gbkn0Ferf5B=TemF`3BQGxF4f%w}W)mF>y%
z8JQgJFt>r!INV|GNT^{@a=63X1-eHMWX215*`=T}nO?}tPBmd=;Cmr2+iJqf06K%F
z)P$8m2;8q>We@?KNn^swAofCD*42cSK?2mbF=1tp;s@PFEx{0Aeot@#DBr@?ynyNq
z(6})u?StwN^TT$9uzhu}f9(Lz@qqF{@liW)pB<d${%;1Ya{!$s3f{K>TFVP*x9B<I
zK8sE-(FBp#7n-m$uz<>g<l}Y|(~sFrH9x8c-VXpVf0J$TQM<zZpf)uNQ?&CPy~6$m
zdtFc-0l5>A=eNx?zol2azrhY%hJ(%v1IdHT1dYGJ>I9Jaum5kH3Nh0TeD4LwERbCR
zmYm=<Am%sp4!-`s9dvHE4amQsx*sI}`qy?vP@C_Cyc}qZB?c6Z=JyyKKxrhvhWP?0
z%x*J-+L7Qpo92M>Mtg%o2k5+f(3m0EjQ@ypt)XYwJp|bgI&UGs5;D&M8kd8p-8K=_
zpM$y~vLzuwf<uxi9MW##dcfZx&<q-b1hq#X>eqn!e{8UN9W>q!8UM6H8c$|?V1CE0
z8C33r>@{I$V1l)ULG=Qxeg>8MCh`nY{0%}%>;J~T1<{~&BgHrE7MjS|J0{<;Yc#)a
zX9&8x1T?Qve9O+U_>Ntm`5n8);sbVxp!Mp-_wB&rfhLb3>%gxhb0ptL=Khd=*e>z)
z-#y@c5&Ihyz~?f6`-YIS1{s4-*d4@uwzZw&3we28(D-HgVY`W-I0ohS^aFOikT6(#
z7gV-@!fbzoJxHB%@KHNMo&^H)FaMWr?)bmI7Cc_GhwJ#9<@TVxG%-9|1Y&qL2t-|<
z!zBP(6T=<D6m@$J^8>KkKx3b5Op(F&?G}Q}M?OOUWC!fbR7n3vLLM~s3tDdny5AnO
zb{Nz^gQOE?@VHCyIlDj;J_ZNSInyS*3{0T?PoRDZs1617ugy=|c7pOFI4?>wxq#9X
zs0{}`pZbhlA*e5oyhkcIoFO7Pj3LVWmd(fFn|6k;e{BTKpEDF6wq*pl58P$~wRd3i
z@V_>k1og#|&)Eu^$S|lR-?8lktCL~yNWNnW3C}yWj>UIuKw~@~O=K86($Ct8g8W{5
z($?_x|JAbTcWf0wdcftX43jJ9P9gJ~koiuKy4Sxp1e)Kn1KSUxp<*jRaRt(6BEg_!
ze$y5)H~ee;NAp{@`$2Lb8mitCNj(>cZGO`ha$d`?^`NnJWr%t^Wr+IqFF|UY@7p?G
z{x8j*P|x7te8<-D_8jit{aw&=b7cg;YgRzxoWVEj3_)$Q087pfpgaZ|+X0yaGQ<3;
zowE5g+x@Tqub*gs9pVqr94-g!{N(>TAoIN7`pV`Y`R9DwJe=R40KSXqg}i*M39CJ1
zp8o%er=a-U-(U|OrvbSM9FIt2$FF~_wKP9wCk%~8@SRcMxRhpc0mYXIKZ8K=F-RPO
z`~``-<xA7g+bZsFPzL8Y=lgbw&UftOKhJ@jcWffh!q7e6?kOmIobTHSJKwPr1)W*;
zd5(|(sC@(~FP!h&i3eD+d;ryf-1C{@o$uI5g5*H!mOx<$bt@Oh&ey+IeFVk-{szSh
zptu6bnIE%#2=fa>&FYn)woUSR+s7s{3|o@#K<=Uf&7UUUv3&~CV<N*~mVDIqJt$0)
z@7RLpi9r4a`Lp<>&Bx+npme$PEht^?Z&3IFvdj67?OafPcD`>r|N4JU4v1TA7lPc{
z-T=AR+4-{V;&}-Q3%<=~U<jyZP?-Ovp@T!1DGC(NFIabUfZExhvluvJnL;>ZnId1X
zZoL2!>tCQ?0SXJSoCs6o3$`s=Kx5`9#S9)PwG803O(1uJ(pZ2c7XvIkfzlG#&;M6F
z1f{v&cm?=6umF25(7k3|pt7F>w0;xT&-uTg7j)Oh3wdc(Q2XeGyfiPUeGe;Fijnqg
zf!gt)^V`7Xxg?Vtto;ru(_jDHI1}V1P}qR#vpETh7r^QNC_{qB2?p>Q3(%Z{!!d>m
zP@4ek&R;9Q^{|PIJtJr=6r@+Vfq^5VhQR_f|H`vK0KB%kAeAA(q@01}!Vl>mpt<mj
z8p!?0326)!3F!<~um3Mg%*bFU0O<#Xn?o5xRe&XzfI~S$1;|YS70~t7|5t$4rGonm
zAU`@(FjP5IGE@Xq!Q_{~?+FE&0oE_WgxJUTe=B%@Cag^6ZeWqQJV!<zRHlRKLR@u9
z@Cm!Ku<$g$#|T-Uddv<q&kGtK0?!wM%HiUh;B!0=g39ODf7ks4xgF#uP<RI4wA(l*
zLGcDCOr6acDuPuRz-tdcVd|~UPylLwAi{O&!Q$(78%<>FnPK4?eBExNat8yrd;*1U
zfF+j#D10wmll}p^g8~%BAo~)^87e?&2NXY`a85`Ahp%HsIwX8S@c;`qka|!!g4DkL
zzc>;Ujv)8K<U!&fvDg0>egvy!VT#5cuA9K;BjE^FJm<yR!S5e5zsCvQ2M4b2w75a%
z#1(+rmXI{d!~m-Az+ns;H-^=7u=^KaW5|Cug73!w`C)#8k_IT;&5xRa#Y`kP1Q6l7
zm=TmdLF&N!b5ZKQMd0)I5)v2`Ok^0iK;ds9%)kbUH&7qMM4kbBw+*O|1JdvEi@^od
zR!t~oFfb8jU;?$pO=K9rWp+XhgB~oeCKNLmUDyn{*CnBbA?`wr#E*nxhJXv3C4cbL
z2nk%Mkp%IBE^L+p@r5qbNc~7iV9-cNV9-jaXV6JVU@%EYU@%K4W(Y}0We7`1V2DUa
zV2DbnXNcjc5fXX*XR9SovXB_aO`!9ML1$Qk@{$RUJ!|nnyFl+dW`^9oGeF~ES;2?Q
z7)if#!c3882WaiN64-A%8w5CbHVJTo(#Y$-D?#@bg2#2|gUWIlCTCE30i|t3m@kk7
zwT*dlgcx`p2*iNWCdjRzH5)E}AY;xcHQ=;ckdVPp12Q)ulcDbQ-{n6uvKR_L<CXIp
z6v5>o*z9r!7SMg{@cE*Dd+&ngMuQL9f$!=Iu;en};A9E|&+&oUXzWZ8ATwY8UjSO?
zw4nHoog>J8uo)nE_*~K+S&%tUxv=1ycHp(UU~^<(W~>3vH-Xfcu4P~{Sqkc_$(r6=
z%l`mYP7q)2E`zswK<RZ(g5m*CS_{Be?*81{3N9~X>^VW{6XXt1SpZJc(o8O(vH+CN
zLFFwtoY^2_V({|z-|ki{<*fs_yacUngO#`c_Fe^*B_Q)b<piu;0F?>gu>804C@3yK
z^4QCTRp2|tag+<7I~p%yyO$JJ-h%ouptf;<J$HclJtpuN38;JsFlIWS+`<39_>!F<
zXdf5&Je7-fiXipom+cn@XmNn&s=#ex*qtrtWd`idmZNqLVPy;G&J>g9_8*J?FdqP|
zS1-P7`!W3w^MyAb7j7_-XW{|-`PW)_e1Z5N|G)mVw$X%BfdO>3D#(6Nc!2bBJmz9H
z;bu^IQ@A<`B&TqQfx#r%{-X(xf{V#92FEvrYiIE~2pk2i73E0fVm0Ao&@$my2zaw`
zeT0cH#5_<Q=2*<d3^Lz@iy?r6k;(f_;noSkhin<CbeD{x%O3_0?)jj-Z45#@9|Vqr
z#vMT6;P8jRr@zVmK1eM1uI<Oyf0u&KZ*QM(zZT?2kl#%t8NhqOU;o)_3(Gh28|-sI
zX&EFB3ZvJ57l7I`;Q8|T4dDCz+)N}Pb$f9$g96V30r1)#&{)*#-`g}n<BmLcAm<r_
z%mkb9XFvS>`G8xHv0SkD?^T(gdn&>1kztAi$z8XX{|~qO_c}?KJV*{9zVfFD55t9w
zJCHMt(c})AM=?lb++hIU{a}9BejzArad0qsn(#3Qm<Tc`aWFCknFugAFlI;`@VL)l
z0XokYH1FHqpbTDH%fZYP`})s*Q_#3E$ZhjM<B~E=t{gl}kTt-Z;5D(auYYcR3n~{g
zRxp6uH71fA3<b*=5<qv7fX(>37<>+S!5&Ec4Jy|`egKu5P<c-iDJF)3Jq+OT7bISM
z#}2&S1uD-8m7frN-;R-UK~TxGDGUtU4<Kh+n@zF*4>~vK))dg%2?lwt`AqTs50t=T
zHS-&k9Kd!-a4>Md-MgiigBNn1x`_l6L%=Qu@H{QpuAf^#>w>`Za8Nn$xGq#q7HkF!
zQ?$o+NZf<VUdY<u*w=q|gWLI_u=3c>0ABmd!N(K<D&N8S|L)EN^#eTaFc`EqB!K-2
zavKLHcrOkIk~&F{I*>UaIglC?2?hy-{H~jDd1)pWkDUw)pyo>k?1J9C%gO}WBNhAl
z-&R+U{{H!pGs8e?!D>Kp`*+t)kQ~S!QyB)P?g`dUZ+C#sL6fWn<rlCVNZp@ZZ((Tw
ze5St)lP}C1(7sbp8U~%u22u~&L&~#3;4{w#fiHZUg+8orjK9mbMd$-a48-@`33Kbt
zgMm=Dg3=2}FW3)%b}j{_n?h(>fu{vYsDJ+K1n*xiL`o~%4MC|>mO{=e0_laC13Dx7
zf8id63BlLx7;h|Pkmq_3R6MPifx)cU{{O9F26>LnOu>B#cB~-(&u_4W+`G!j6oGK#
z4o;XGJ)!XlmIK8pC|v$-KM9iut$PB=f%zc0-;2THhaj`LCo+Y@<Us1c?)$qPJa_K7
zgW&*3P2hHh4W4^I>y;D&Kzp5<WfHi8Vz@5wHwet+;03SmVFBy=zYN?Kd?7CbzDE*t
z_9!?lgY5jj1Kj@s&mFTcMZ456IB<7D%fteK!!P7TazSOcOAUidcenk0o&tfxpl}D@
zDFP}R|7_U{s*^$P0iWp%J&P7328!d?f426T@GwBuT>WIw0O<v-p9ahQUOpAnF9Yf2
z;9&yq9Wy^_YiNGVexV7UJ)`0S1`ZBJrT`8erXY|$P`e78p4pgUU;kX23##{%&)FLC
zBnZT0-?4?v@vt&Q1<7!M`xx2hZ9#b_w)n8^ME(YWo5^QvS0<mZUH$t14#Di>whQ|k
z62SXYOy@8#_4k3xXCF`<0QRF0lP@@oKy4(Deg7Bxg4RWu?t!c`@1I}~T36!>y0Z_Y
z9~^Ey$l)fW3lFz8)Nlj){m&*}P#A&yjy>Eq%fj|XnEYgr0QnygZc9PuHGtPaaj-IZ
zgX&5XL3?H;4hGPD(U5a)Bp4bvxFPMI*FRT_n%}ZDOumR3Rv@v!KU@XLM{U7%JIGzx
z7i=>@VFe1a<kO(A+PV`IRwf94gXZ^LU&zaug2KsV4}$|&4b%L~(6iXMAF#+DlRu!r
z`3JlY{R3zpI=H{ta8LdP1GACKeg+p4Mus1t^V^ymn>9>?8Mbgw2DQ(b4t4h_eK3(^
z0Iv%M?@9Q*K@fER1SpL9+ZsUkd@G>H|5<+&lm<ZZ^Ba^ZKx3a^K74(|hN&iO3|cO$
zL46etC63cfZQR{Vb3p1Z&$$nF+l6EIKTJ6W+MjCw-{hG6f9^IWw;RW}<mVhv;4t~c
zm|*e?;vUf1Q=ss9{by~a2`2-?^#&Q1+s)h$O#Uz?fZJhrY(Ij`HTlB;YJdAc#U3gy
zU}IEb;9yiz;9=m%0i_Q{t%h7>@V)_#T#&yRgBl7IE0i0U7(x45L1U1hxK{RHVBi4l
z|M<Dq);tPw{so5&QxItGmn()vW^zLS11LP_98i`DzGeFmtoF|ua6SjQ1MI#z+z%RR
zlumFkGlA0eUr^h`{J*`of&z~QW4*)y6B`Dv?=3tG2V`nRLE*}?LEz{Md7if>OYJ{i
zZ;-J!5#~_po@{>|A}(_lq^6-j;ec`jA7ev}{c?!79QbSo6HW#JklRgb?7gqY%gnz$
zhx>zxJcB{={07jyO`ggR7&I7bBo3JWXW%*@pCAC*H(>IU!2yw`cYyC60G%lTa=&S&
zy|;-BgTYNr?hlPNjSQf>r5H0M4w%nj;5s1l-~lL%KxTmB<o9+^d!6s9f{cBuf&zG+
z{Dr)1t_ddtpP~i>gQ=zn_<k0!+CM8_g4$M)IS5314lMU~1!$f?!_>z9KgbRJ4fega
zJ3)1u%vF$CAUi>BHj#p!mHvC%Q;_>#$jd{|n2-UL3C=I%W$p&wvi<l%UKVr~atz#^
z{}+JHmWX;GFRKbNA5>;^cPg&}m95}28Rl?*Xzpt63asY}0EHE3&GZ5J$5~)|B^kiu
z<gfp%yo)F|ltFvNz;!i94D5$LtJaz<hu7!eGX#_!I3W82es68P@f>nCnu!zx_^u3)
z9+RC68LxkD^#%C_<SvkVL3V=VUjN<-TE7J@zd_|6LVU|x<p2+G+ZNPD3{c}vFgd|s
zz;i%g7Dx?9Ekys8xhBULIQE>dKMFD%w4TuXjO|7f4oF=9R`X{WWZ(W7E_wbxLJpww
zA@-bro|y%`n-i?=_ZC*r-LD{Xz;jDh%;2)ZWG6!hM1J#8kRL#HfYflXG5LbZM)Tvg
zhM>NN37<VD2P2a|2OE41S_9}l25{c_x!^1)U0~EF>`YOCf4IPHJy4klQk#6tb|t8c
zOg;-LA6Hjq9|hMX;C0R>cffTCsEl+2m5(pv*?K|s0EZxx54b%9s!u@q`v1bYpl}A&
z9U!+t>k}W)dD0*=VEt+E9?c_+9H6-*@VVJcOpzcz1z2%G_y6n%ugL(J0TKs=Lx2_6
zg4cidgV#g+|NH8~3winPF!R9YG@Z6<R7`LHpD|~`We>W8=OBk9lRIdf3Do8X&B1`~
z1O?5zfag@8<4mCbBENya8Pgv7jm5X@0_S$AL<P=bP}uL?;1Sr#5CCp#{8<X0pLjoi
z0VsX?g531_|Grqz7%|TSfwP>uxTJV~2_4{_Akf;gUug$#gTM(#d4{0R^97PY=XC|&
zw+rO{!*$1VK7$AN-2FdXGW@+l2Ljs|6y_XI=Hg`#a0Qjso*fJxy$lKuIG1sO*Zf}G
zA@##VlEDJ(j$hkj!F2&>T?^>W8OT^y0z__0C`|6c4XGcX^lBo>U<Hxe_7)}wT0aVv
zOM%F3ehQQGoWtPJ-=qK@AHKLl5>#)2)<4C*{<V27OwENGlHm1+CXx&;Q2p@zIbi)Q
zipcssplW2X==XuhZGzi>a|bhMtPr$^0Mcgvy|NPIR!};)aRV$D@q&S20?4eM1-1R4
zu=8wVaA;YhaNx!<{s$&Y891&i<!}P);bj7y2M#r7#Y<4$opV3|+y?~Pvy*{?mq7p~
z4{j@f><OI15D++@Apx{b6Lc04|9qhfpf$9nI`$hKWf;KgAN!l^O-)$A=gX*?urd^Y
z&-o(x-d8(EQ2GUzGd7&ybvw!q42<UYn80Jup!5au2WVUbyv`Q=-dflg2x#3cZ0r<y
z9OSS)BWN$&>))$E<2K-a9K1aJy%&5=q4EO;#_m7*6(E0u@)^j!04q-Ln#$LImRtml
z_az^&od}W#)w3XZ^Ha8<d1?mudaB<G3NIu}|7b~2PynejVP^d2e9LxXx3h8pT+P2_
zNckDGt`5BSOBn2Tdk*kg!T=i%15o+bmY}Q<pv?r{3;(T}Ig0<Y&;jKKd=tUvEzbwv
z$Hu{1Bh(OJ!wudu9$?P}x(oL{$SlykHvu->6O<n^Fo4*+2?8_BB^a2vCAea^Ww^k7
z^(#9#l0jkn`p^D}pmYRs^ZW)~(3uy`ps{z5A3^>GtNFPNzW)zoet<3q1MdQXqoB6L
zn~e)Un8@&O@Foa!a4<6k-sIqa@L`2OGAAnwD@Q8V(N+dG@O%fvoGoubVGptkY>qwm
z1W-L_{$GJ{{`>_GOk@<mYY{+eN+IgEg6qTi4F=$Kx*#{1-?ZIWe8BdgNfiU6&iuJ$
zYw-cwg&;FQ;S5#-+JF3WORGs0<V-D)olx^^LGmEAP``RIF!F)tK3@OdaurmDf#gBw
zLfwwyhMZIMYtPZ-TecHneW-86%$A_I0Ie_i{-5c)%YFur?mr4j4*L;h97he;o#Ix8
z1km`U2_FN)?Kx5}zR5EPfbJVH5oF-tp3fo!R&&Spqstx!4--Znj_yVU1=BnBf7{y{
z1WfNUFoD)O-hRjbp!JN>4bx)`99NEUIPokHfRw+`vCr4PcJ_kWWg!3bo>AHXYD0qD
zZz5s92%3`u$$|a-d%;f=9s}^)G-w^82|KiJ3^!-TUyxdmIUF)f;5|$nLQD}LGobn_
zLGp7RD1rN?U^{LyaDe50?Lh1&l3@xmk$|3A43q!8fDxn@WVXpor1QOg?GOctgU5A1
z<v7SbP&p3M_iO)DkbE#`+=qoJ8njoJQ-&#qa}JXXcLR&qyaNgyrgs>a<~~pW_n+on
zXy8&h0reL<QwXSy#=*}N3cin>4?4#EZz-t!j-2114jz}{JkG@jGNZpI=I!l1(3x3M
zp`doJ!yZ`qW-DsK1}fiVSxwj&3PA13{sx5wCj6lNy$k|e@u2fR6*x@z8CbyK%E-WD
z!ejrC%aMtlOP#6R<hlL-3(qCwL2IqRVFn5tc$n|K3i96zc^UBeDkePkKVQhpujSxp
za_8(|65~3+A_h87=GHat2LXE+5<ufDpz{b!Iqd(NEVZBbLSE7pl-Kwh1UzrrNWJ(t
zM<AKIhlPhDhwDt>90t%C#o+ugxxs<~)JJ&zYdtu;LGb{x7vvsD{A~iAv*r#Kmtpb)
z*)`{ZVgi4I0C@c=M9r#Nlb;MMCc+F-m*>l;fYfr;Gs%O}wTUnT2Uk7Qe9(B?<^R(1
zpz*>B&+q@3@|=O87}Rfiz`|~R-hN^6aodZabhqb$B2&O7h6ED<1qKr~$XOI75{&=&
z90Z~`_?co~|60Bjl<q)wfM|sHYH(j<e}e*eEhK1vz?*0L!R?M0^0HS!;R5m#2W(E{
z*ILkh$r2!QF3-9D1J+l4AuqT0_8e~cH&51F0=Ywp0d!uO+*=bi29LQ16dr)q|Gs&m
z3~o1=-h}QK__b*-ILtulR0c9$VS1ARd<N(1Uz_0R|I;512Ci_Xpm*^LB0fJCXnDcF
z-~cku^d_{d`n5?HWKR2h?H3?-f$}TJevn#@{ao_J$88^i=hs2)NKjb(Toqe<AG#Jp
zhRF?dw>LP9enQT{;JDDSfJ1=EZ9nL|anRkt_iaCN|FHnwSFW_@kAgt(ecOx2<-Klz
z)}wQ<F~#hQ>AGQZ-Twca2Z|mX>`WnM;r9PIu5*cV9AJ@o^JJj}_jD$qfDO<&T-X@+
zuMJ1}7zCpBHz<JfK8OtpXV4fqDDQ&OhcXBM|JT2En3_x2gU=8F$$`{?<X->U0O`Z9
zFhzUcu;T=YgY?7nzW%lSC`dghJV1H<@*L?ulN&&1fipe=yIY#c#rvx5OAa=suz;Nm
z2^>P8u~GZ~;Bff2_a~^`y}!ZwE?EB|+e9kOA2gcYgx(YVYu!;$oPo>-?ZW`M-Sj48
zuK)F~b@1{R6qisr3y8nhfyRx&dwN0Xg5v<^oc0FmqtNsr#KFcC^g>>S7ZmsX4c6a5
z>EwmHbbG)ah5++9_8UzY?KjSEwEYX(Ti`vP!J++u?bF*|KxLHt-rzY5;B$7s_WWGt
zYJSUhBh-E1u!f3@g7%t$#6j{9v8CYk(;zWeIS&<wpF;s^{{&cZ9RQEFa6-qJes6-D
zZ3apI;CYSLpz;}%PQm9AFfatzbAr}#T>k!uLx%e^mptg)CD0j2rZV>bztuA^f$lNp
zWMJXoc*-TiDbFMiT06#7&n3_CfQ9}00~V&@`?ecF_Xu$OVUhvOe|>LYVJe2L&AMs3
z5$w+Y%RqPcfx{G~uK&Ljz90Ps149C6Y|TuAApul=fZ_zAcPaQ@B$Hzd3VYe0{ne!m
zOlF1*1)wu9coPKXG`H6Ga|klIf!Zd#3j_{xFfw_7`gb6{`BD3Y9E?m}ZweQH`U6!U
zc@uUv@Z1-8Op}X2;7#FTaGw=y-_QMxCQ@wRzV-YDtD~THBToXPOf`{UU<0f9vmA8q
zDn~#vgTb5xt6Ffpfa*XA@cD$0aQ?Hr&_t4<2Gn;1$@3%#xPkn{!3ruX7uIqh?tyK%
zJ(C|ib`mJV-2iIyfcljnb;x)0fXui&LmFJZf#<8h=InvrR~s0^y@0<#VE+CG3QGJl
z1Sa=^+OwcNy$lR5OeC1tCO<I$|AK)*$fcOUp{w40Irz-=4uSdY{}n)DE?xEZ^<c3H
z0+U_p89YFB1IQduebN8G-W?<tJcmI6eAXGruaXR)`Y8&VJ3;;g*$Fx`10?_Y&r<Lm
z$__Q)`uTr5=)5#gngp36!N39vC#X73Shzs?=`!Gcx=Rg%M|ZmdxL*V^6C59Gpl}4Q
z%XGawNBUoTn*w;A2&yj>6#rmz!Rq$S1dUm8cQMJdH`s&sK?E#iFxa!eemlsmFXYAk
z1|PCb+!tcj%OS)R11f7@$cx%?Pv;Wfd%zfcSKbSG;j^GJA2bIHN>>3k+#5i9a6oZ2
zzd<32zd-=JhPJ;!0ep58D4hgYab0-*cmG3>9iaFFiM<A$AI`w!5R7)-e{c*#!~6yX
zC-*s^`$<6Of+5CgL3!@-94UFw9ps?BHT(ercTD6NMEKhTWG>H<{>}Y|X^#0E#($vm
z+dy?Bs9y#(&kJH6A82gU9;6O7#!9N0Q1hVfV*%|eokOl!Aoqd75wv~@)K>wYpMTh%
z@wPMn572rg(3pm|4SPd>gM!EHHg5149U=^jjNtR%u$-j}I$sYQ#*)zX;;;RGO{CZz
zQ14CO(+KJ(1h+Cw;8<X>z~ra^Lr;l<fyo{Q$a+ms-{b$jvnEmu;QIkV;-GWbitpGR
zG+|>n0Nqy)ULzcQ*KXtMUprWXZ`mE>Zex<^ZiB9UWMzuHP$doRe{5y_ZV$T0PHrm5
z-5~#h_TS!);{O3kH{SEv8$jo~b^lQSuLV(V=x68e5SXt#fp>@b90nflKj8ghO0WMc
z4F$U!DZRY@zZZNyBj`*uP&$HzC&*mTT4+!>_LL}q?`Q&r%j^I9{=)nPNrU^q{WH*B
zE|7lEy6a%9_fG8hy=*1_16d8sAE3R9ptu5=2U>>@iZjr?$RPVbV^*N`QlNPCp2Oh)
z8k2whW8YQKdhFsmkbR1fJOu7X%d|HrBKD8`TmoLN3SQ3)tD`Kq!DqmL>Nt@30ajcO
zOvE`VUjN;xX(Gv>hR9nxc7nrd4#NcV`3zj3vKw@EA870mw7&aGJr4tDZS<V`3ub`K
z0lEG4uPvpZdznCegm!3q3?v6ChoSPOpmRof_6ULN1kia%pz(g>d-p(Qg4$`|JMxa(
z9mH`LcO&?$ks1L|bb-f9@Qfou&WHTFJrnE}a5xBn$BRK{hra&1-4Z4acH{qT;BiGz
z`U0IlpFN*l<Nx1R7eQl;pl}Ao8ECH@bU&N|bU$1cXg{0@FT*m>o;VX8h91zKIM9AL
z&_2}Lnvi{{CL9b_p!N6W$89fy)@lZ*aTI{YIY4VaKx;J>mM}1wtYVM=r90606?pwO
z=x*^N_KevF>@0Z>2;AX}0o^eMFCTY6^}BoDv9s*%%mnvGL2S?-H1PUIite<uJqWUs
zV-MI)0nk~gps)g!GvKiLu|*X$rW{zqbiqs>GR|=Mzx0pxM-3LvGZ<Y=gc%QX34`~+
zFoEvD;{E~NgPEH=pV8&Au=KyS1O<;<^4veUUocGu%|9O(J|J*eSo(iof}K9tUJ0h)
zYY8%P$&(pfn%^`VfbMp_?jR%C{I1CXbWd0F3*{Ro!VDqJpOrIABpFyP3CREGW2jwg
z{@MP&i3r2GOU2SZno8#Og5u3Yn1Ln0g!=+l1(U>l289By`CL~_gc&TjKf~;HP%sf@
z$b#`NCB%cyl~w|&>He%505SuF15CI-I8SEKbDqjz0NUSaBF-SdRmv2~^_59{-UC%3
zz8-<#`3$Nz%)i(dUz#HQV^YHei5Cp4yXHMmonii;VZpU}P7de!3?`s;)Xq~G%(%ZY
zg*wk?umJO?Fj#SaVG41c&M0FxpMmAmcR>#4X^e8W|8sxf`o<L2biYB$c^adH^L$3B
zPuB!Fxb8E>H|@8+4hk#2$wCgdKXW}up3h+QLSA}l@?-`J^UwBEoAT#g2ZhV6V$d2k
zku9Kmy7(q5Oue<0{{hz)F40#D4uJLwPGDeQ>|tPFxbpx1zY`1$3^5>@7|g)H@PmPY
zQK0#)(gG7<h84}9t+s>Q1M1U*>;>Ix2I{ke&ZC2*nN8sFzZddSv7oYsTarn<?}3#+
zM34Md@Oc*E3@qH@U~zenI7kfC_5+=B0XmxyB-i#pK?-yphKU5|?r(Wl(E0$VI$aY<
zCJrQZLLhaZaRty>gAg@xPfa9Q1TITR|L<q83<ud^BF^COLSAmGvLbj~gN0k3Nur%W
z;e?4eg96AOZ48y{Aa%}D7^R%&GfIHsi~9>x@a_Lx50a-an1S*}@_Yspvw8-W%U`5^
zfa1YK-kuSZSCXeNSb*{g$p3r^kh9QU|5&>=c|OCh7xEImpm2C0FT2-7Qi0+4ja%g)
z`(DUPs6y-muRoRGn#?5JS7BuflIvqAe-Dxa?KexF&+rFiu8BND#_RuEpC->|`1e9y
zYHNTA_k-hG4+z}a#SP+L<?9d#=4%iLJ05yK;nrpD59UAZi!WPB|Cp@MAn}5MLF>5b
z0SB{d_Vy;C3`Uo(N&n!w3YxoRklOEH1sz|I^5tt02;T2tWe=iX$V=&8OOTNO#pAVl
znZ5H8%#MTH^g>?B6_mbT|5yjU2Pxnw(*=hu3?>fy8O%OS5#(^#%wXZLhrtSzcR*{B
zK>MSc|CoW-ZGimo`o}u(_@u*rNFH(6!(avqAJF=Ju-^Spz4c7-&GYTQng}z3_Cv*A
z{v!ROYqElXi7?~8?#~UIzCU1*0G&PKu!T{^VKbu~$ZpV_E!SkG;HH`eDTmFB5)OM9
zrNHi}VT!ptS?Wc?9tN|^f24o3H<*?tY-TV4m7}2Zt3i7lc<P1Zv+vkhzK|DH2c02i
zBF_jr*BG+C`GTFJi2&qYY!iM4J7~S21+5qUf$9Mc0VYpS`ESAw+M{9j@U|NN15mjS
zsq+#0@j-P6y#6?0ckuP!l^;R#R-kb3)PS6cd6NU&mWzG;bMsEne(3oPiX0$$X!*><
z0bcvEX)0)s6iA%A!D2!39Xmtk`*w!6fARmA?4Tg^f`Rc+$A!cNT&!FId<;SipnV3x
zhwK=GDXKH<z<V>n_W#_>2yvSNcn<)`ZD8^LD?>qR<B-p20_AOp+}g7+H@}dV>jl+e
z;Bwc32V7^Pwp%!rUjJPV>OUg2Tb6r*+ASPMx!7LF%Z2hB5Mtnd4sQR0$G<>r_2V)Q
z8r*MD#V$91%lldL7;McsIGMm>3!pp;antInW&)5oa}y~B$UNBp)!_7fOMoAIe>jp_
z@HvPt<YktE!`%<u_FT1(0WwC*vjKG1f=n*R4ihQp*xLWqqR8fh^TGdB;Jy;b41~H>
z;B~nmJHhA7voJ+>T!_98N)z4w(dR)l7b};HnE(S5=+4O(@^V)}YC&xlP#D76v;oRo
zA9xZ3ru5BM{BdhCKlq$qkevZm+ybxvE|mnw6AM!`Pl7-*hz*i^{c90u&m4H%0o3LQ
zFk!mjG@0SUr($6Vr}+$@Kzpk}`(d3XGkgK%DbOBSr}+%uKw?S>4NPXmj0vEz4$!#&
z<@wSnxBqiL;Qr4w`O{=U4z9^u!k>x-lDR*#2!EO^&;sIff9ARj6XX8OHJSS}*Ztf7
znS8nba|K^3=Ir7A%q0vJkH7w(qot)@Q35o#s{G&pgZY1kb<OkVe+8u#klO>SxD{Ui
zT?}vkfy7?_U)>8zCm=NeR@??$#awePO_7oRJV)R;R}Bkj`~`eZI#&(X9IhHJ*gfeo
zpXUg)fW~G(W_-300QaLoXC&RWWLJCrchN$wnJki^eYv1`1GO1J4OCG0gYG>8#X*2Q
zdjV{J4*vsz`Q7me61QVucLnWP3UL!?EQx&r_aCnN{0{`?w6`f1fcE50ZU|s|!N8E!
z-lPED@7~^`2;MgWYF~ruACQ|~|5)%BROi6X1q?o9=LqVPnBTKYG?8ayXr8YGKJOV+
zes#~c2k+qp-3<cL3k{2e*MAoZg5n+I2he&1u)A$Qcj^d$@7sI*cOiHkA4nfaO@I|Q
z`0R++e;2^_>45U{3wimuCQ^)GH}by_m>*!p4W17M+4cJG0?*?6b`L@NgKt63R(}0=
zAN)K|aM>Wk6b5n=XkS)<6*qJ)azFSyqZjgWydb^cv}gn0Uw;7<4j?_n*X%xm_Sl2`
z0k-e=zMm-j?5(&V>kEGD1+O82m?gjv4AN)8J;6kjg#olD3v|vfNFT(EJ@EBMAbUXJ
z3<`U&+>d?W^FTmrV?bts!~(3i1782x2Q3fe!F3!`dH~P4fy#eSdH}f-)b0nh`9Wv5
zzy7^!Cur|5$gKShiV>i7`p$Rkb|R1CAD21c;C#()>+#192GFt_>v{Qo2kb%X$YMZe
zxPt8As9>6IBFXRs<i^)Omr8PoF-7ffum_L51>doI$lc7u+>&4)4>A)JmH}4W;Pm$T
z&mQo;Jdm3}dO>Er{<FW+M2a6gmjn`f{eQ__P#S(AFL&2O#{NITzs#U|5_A@KVDTl}
z!s3gzjl~yiCl;T#U08h1c4P5b+k?etY%dm{wtZN9%JyUNNjt{k6Lx~d$L$o0kJ%X(
zAGLEV2JatU30^l1aswn?atD}CQ2@nNJckTZF#iJ~&>Ad-ee>;~@;?v?G@rr<mMeb1
z2r3uA;^_|<K=+Zy7eC-b665_)+`!;qKA+)1dILj1aRbAG^ah3v#SKgh=?zQ*#SKgf
z=?zQ<#SKgj=?zQ)#SKge=?zQ;#SKgi=?zR1iW`^~q&F~u)E`K1V7gG;!1N%!f$2kW
z12aQ<1G7MJ1G7SU1G7PK1G7VV19L!e0|!HT1BXCy0}q4w90rB`^X;FeH*kLdrRSmq
zeuV&4Ch!`%v;=+w6A2~{P+Bv;YtQ)l$4*PwTs6f1JObYvSj5cdSTNq6&-vl<9El%1
z`-S9q_6W&b{v)k+dA=0*oa==B3~DA4Oi>_nKzSNs){cb<dl)o8X9a@J<>iqPVo)|{
zU;xR3!WXRO*FMO6D+^OJnEz)5d>kCi|FH|6e?WN!lqSI9zczyQ(L?(Al8jrB#4};$
zn@BRQK@zt#kzxd||2C0iTme!8H3yup;O_ai7hLax_|UYu0pusJTBP;GP&v?82jlDC
ziy(V_pnd-UD{gSuLi8-+1kY)(Fh$Qfpb-EX=a}E1;pB0HQNToo!LD0ILo478qXKv=
z6}0a1gbnCi5>UG)5_wG7{g_RxM-8Ju#~pR>y^L^w{oXedte1r;dVYiY1P&P{$UPgN
z{WvvXb0a|O=Rs~UKWxv4Y-aXJ8}OQ6kpJN3{n!`_YEyyy4=NY;E0_d;&QNeaWfME+
zfT9Ek7w8OR0fqo8Zg75k{bMtD{WC~CIK5c$!0wr6eEnl{BFMiGIk27&ptFn+c5PNP
zNoKIP{$E0XyO~So_GIo4obfF3-JgrW^I+UvT=MDnZDMaf=l<Y+-^P*q^NNP_J2sB)
zcWg32ZRYelHkl?eEE_;=Bar_({!9k1TYmj}Pa&v`0NFdgK{W&9hB*h6C9?0>B!bQw
z0L7ho8-qcBHaF<*B=CF!PmK^0Pl6B&2R9RFPJr?CkBu*R5`@@5W`OMKZwfkbyPf+1
zIIKZ)GVDwd(DlKLum7%f<#@&gRtrk&pl|^BF+hh$fu}}@12oSAa^LG88y!J&X)rTE
z_eJ$LIYiv<MlzS1DFSphI9UDPHB&)zus5DV+JKyCT%fa#;z8~=k+HwXQ!m67pu-Jb
zBgIoA!~-%LtnbH$LY@R6@ICM#w-dH!HR#Mt@L6ymx54b;sTUG3sbUZT`GqGzNC?!w
zg_;k(za}98eC`P7oEH(0KG5E3@ZQ531~pLG4BmrS!=MA&&uDU(foabJ1p!cdndi6=
zlgVKQ7VzG8W+w0)I4q66{<~_e`C%LIUOdnmd63;;JAZHg2}+mF$8D^g@7q{{?tcZ@
znS9>{Jicb~(;jp;3FGVE+gF0>Oy~PH(I7R+_ids<>OgT4pvD7QUwLPLgQAmi*XbAD
z_iYT#=cw)L{-X#!9|&Y0)GkGkUHcm#_j-cD8|01vOCHd@PF!F$Kh}cpCxy+GgX9rz
z*akXR4m6)z0J0k-2iEg@yCW#Ag4-U@IThy{HrAju`C$3KE4G6AEj)K1_r$^V{aT#}
zIt%yq9BKCb4Z86Bk0`@dE1I9OF$CKMx@QzLS0lv$x^IB-^{-VgP1qUqpmN~-m0-Jm
zt=b7{cU+z?T>+X8=Kjw$pL;%6{Dm6n3hp^vb1o!H|Ka}670*$_6$O&Ja0em|I){Zj
zo@<szCA$Q76j#)RW72=Pqqt^q+~IQLxWzT=1@kVj`?&XV&4uDQ*XM8~gVu9%&*6&y
zR4>p1YNvmy7vzA@LINO~dp_5k+mo4_Z_i<7=bpng|I>Uy4zBrJ@}K_;B!l7+bU!+X
z&pn^(K1_^zKG@B7ZqH%z1(|*QKW7hU4iqXL1G;aKdoqj6<@pjn681BExIAAHM1KN>
z>*e`UKTM<;QWEwve1U|=ikS&}7`}nR2~<Z0*fWFfD+I+iXze1n4g#zDvFaym&KI1f
zEP259^aNP(fbLpgeEny2EXaI_IiU4tJfO3gj)Bfn0f|G*ST+@0j)2mD43qPm1jR?7
zyY%{-w5xcM1Z29~yEDvh+MMQ)WQqsr0iA1LBEulV|3FA-{oMGsAR1!Miie<c;pc<S
zria!&JZA)ic`5`%d8!1&cnSpMd5Q!icuE9hdCCMN9cmc#+EN-60<3rx`cgD6@thM7
zo|MqQ^@4$O7wC*do;m^H>^t_Im$pd%aHwI>$-ZM>dFiV3kIUj<zE<`f`^?MVq<>uA
z0p@FD-?5Jbjqy0tFsNnUvG;VSVNl7wV{hqD!=RLX$6nK+hCw0wj=dyLjetz{9edE8
zU&hyeR?33>1PLF=nNtB)JO*I@{MrIqrvOer;IK90ap1cn1it6S{ER(gfDH%eF7Xql
z9QGgI3a$jTZy8_zTyPU+9@vb3tKs|S5&2`AC`=8gE&#E?YJY8g3d(N|`xz8K_0s46
zf*cNe7?eO`L6_%9f4Y*)c@A{0UczF?xq1nEAm?g=-DU%s59x1E0Nqi-`1<bxUXZz{
z{sONXXMFu@GiZMRQ+osCZm<3p<tt$Of9wU%H|}px-U87FN-x}?^m1o@gK{5ezH)zq
zat)~b39#Y;^??{)|5*k;PZ*(|9kgFb2C|-mec9v&1C|#I9AY3nAom1V@&thG`n?pK
z-$D97c^K>mHJ$(yaRv@hc?nW$BFex4S_1;Qe*>atu^?!#lSvJH&(2&>_`%IqX4n8$
z_hTFQo`v@L3gGqZAhS4_L2F1DKy72t`O%D^eR?KRjNq{hu-!J?2Ij{g>qbF*(7Zn=
z-<c%aZv@?YV#3YH1m^QHG;uI8`IzuA{xjj{U;yo%G!e7kxTj331Y{4W?E-NF_*^9>
zu>T|>Yt*3Pp!OgONE~EOfDQPrCD2)EpgZXqU;o|!Zojn8R{-B(0WuS;@AvALh;vsJ
z8X*2wU;v%r1yTdLU%^BIyao(3Zp8Td2W0=hi3~#nY;QH}>}yb62s*<AVm}vn{iO*j
z0}JSWR{mBYP`{J$_3u@d$`J>^?OCuoW1a%g{idL@kFQ>c0W4<2T>v_psV5<!3be);
z<c<r;(xCY##@9dhBJQh}SIKMsqrhPz$*{>pk`d7!`?-B7IIf{>?H4R-4}jW9!Ix|c
zgD=`P1|PCv48CAHG5Eag!r*hZ8-vf<9t=KXdolR5?Ze<xwjYB}+JVkc5)3|Wrx<+9
z&M^3>on!D3yTIVXc8QQN02@Vq1p!dlg4<N!v8^9_z~hIY@P8rC9Sdqxf@sh@-wS!3
zS`hvE_ew#KJ6_21fX~f(A<qjw;~C^Xa9sRY3Oc_7d^Zp%9^m3X_k#ADh=A(F`3;6w
zL3V)V`#5UA=cI21se2(WxD`|mfXlZUX!&*pTz-Mex65YIKQ3(r^C9KicIh9NCBS@0
z`Sugc#$UeG3CO&V7qbPGaj50|u7j|0{)N1VF39bU@(ez%G7KKq=Wud>${EOb5}QKz
zd^PYIOHdnxgNG^h_3y=;pf(7|PxBj8LH9&K)}(;tmVv?}0V=lwWG*Z%g8U2)v+sM?
zg37jnG=>1sS%@IDp!3;5@*s1;YJM-d2tG@eg(*6q3bNkGL=t>f5aa8gTR{7t!Tb9#
z<u*SA?Q;g13EC?PG81CnQbF)uP)NN7-j4(o4>Xa2l$~=IsDSPta^r3YssXJR1dW&8
zp2Hx&zd=RfayxX*j06+xo@mC`-}lIZ_Ys25D3pNg-v;gb0Gs=L_ft^#@*Edp0OdQ7
zdwA{$F@fB}b6ki8BnMXab6q0OaY$R<M3{l$@^pzGm#0boxI9(rhlvP-1LtP0`TXC7
z82G;lG4X#DV&VTI#Aa5{z|{T4{^;$`{0~6>H@^!RKR1tJ$awv8?MD-C7I0ogmIJl(
zU;kXY6Si-hyPJs{BoFH+fZX-^=SKLxbC4X&+}A(XdcyR9+9e?I*T46|$E%naIQE0)
zjJ?~~B{+_8wSn|<9OGiUag6%`$1$!spXUfH<+#Hl!##)V4#yp?7>+w!b3pj>9D!p{
z@j0Jr1X@7tA+S8C4|9j>7-$^r#xW*e^C<9GG2`o>8#KA0eHpMF(o8O3xBOhg2~q<J
z<M|B=H$eSNa9+Cu&TH#oYC$wa{pyu4|A53meh2YEawd{246lE#kK~@o1itG9E)N=i
z__^8=qz+^cuYkab7xDtCp!yzEZh*`HsRfzw`sccv=24J2VNl-zBo2}{k79t-cR$z7
zyzor=6UZD;`hn<K1>XM)76a}1ho*V+DDYZC#@9dB8FD<}Y&W@M7t1||D+XjH=+58U
z^SMD|$(KJ(7B~hUJDx1~9?G77`#<vo(Ae<hInoC~>+3GhkzNEkBMM{>D7}E)b=RKp
z$^#ijj^j*`uYayh<hEgo<T%E43>1GLdpM49#eDuF&;ru``48yaEH0VPe?aGBae?nb
z;<&@r1~TWyP3C6vC<aKK@pH{Z69EP;kUd~C;BmELBP<Nz;!)tW<cubgjCrqru1Vz9
zW&-cifXjo!euX23K8U!Wc@*>>2^l6|m>y*f21woab2aGP1MnD~vc>uTFnRMR2GCt~
zjIV#LZZtn_^AqIGi@PMi>*B6QaVUc0<oEWo7uQOI&(;E!VIV((;u9?QeTyontz8W5
z4?^ldo`&qRHjQAmA`keS0UiZ`S;coC<0h}a?~KhpYf}lb%lw+n>Fhf;nIN^r*K7?z
zXD@W>DuC-l?>jb??G1XMeQ%7QaddE*`)dzqe;l-2RR-Nt4lZ*+?gF(lK;<b|-S<sj
zZ|ZSB;5h~9r)8XDPzb(b10K5twb?-T>4Mx1Qj0v^(%#?zHXC{d`zcWV@xE`92}(Qd
z4Nl;5<Ux8~|K7S3v=-q7=sZHunq!#R69n$S%m#%Ive_X2_BSMf?yqo9xWf<unkzMt
zXZRD`&!FJ=hry|Nej|7t4X7Up();@Nmb*8ebN}E?5NZgD;hDgjAjAVQ19Yzif4jo`
z%YUSPT%XS?k$%S(d?p0Q{}6qPR)We^o;yMp=0p3($p>ssgW?S|51)L&=B(p?1}D&Y
zqo6*_<<C+-uGRBOBp<N3e5qdQNAhKxi=c2!zHf6LWM1+Co2$tOY_7lly}dH|fDQQ0
zhWVg%&@xQ!JQoCR&R0+X?|BEA4O0L5_d>A!Ah*K8Ja`U+0lshn#Wkp&$-ZM#X{rg@
z_aXiErY2+^C&bK6M?q(yfx-ziUXu8S!3ku3!W{<4*aSCI1jsEAwF|)ZgZ<wQJrk7C
zp3y{%fhYN(%}>yp9ur0ZhU9BDzd>P=e&6P=`3;-X>BnsuLG?iTL0eXcIa_Cf!eM?p
zWX(6od<?(-+J6-k)*!d+d7u#CeaEJg1V49j{Na)T?FY`jW7Fw;-{!pYWt)qjJ`QN^
z3=|jFKl4hM2($hJ-7(z#xk1ADj?GQbzFE+jB%rzM{=RwFLGA+em9PKdmB>C|s|ezo
z->?PG!KUB0)daZ@?4MuzYWW$2ctGI-a_{^Gb<p}|f6y6k$#-l8&98yah2%-TV=D{_
z7f_od{f@0DD7~4;2r;A|um#N%M5f=dmF3`vj=}xj99VqK)^UG>?Ou?X?w4)AYdeZB
z+XjN{yi_Ii<9aZ!#Oq&Mre2Pc2A{>tA;T0nzri*(_%h_&$n?v$vK%r@5#~2-1wndV
z|K79`Wd8mJTTzgid@2IMp!q~TH31pWS^<z9T{Sj$xhHaonCUYJ@o5N%nus$jFp*$5
zGH-#+c98#h9|(wXo#ztUH*L>!F#nN&On-;sFWy%IpnjMTXb!D^g5oaTcLFk8f0!m;
zD!%_?8uSc|<H8OG+%l+h!^dR~c9?Co|8KUHfyqRML5NRFK$z!(z%5WXCEv06eW^z3
z$MwnJJoFQk55Vc@j?G_?f6@=wGQR%3kum*%E$jXUYw$fL1s53%3eGb)@TmxhfYv4O
zsR;;!)+KNia>;Z4XOX}CpZ`I|eTD$uR|3LqMb`WvKlBwS%;J3~Aa5efu%P*~iiL?V
z!;$9CR^a%Dox=pmLzm}B$iI-6ntQvQ|3QD7f)MW;0h#tDyQv^|gZ#iD#^et=NBGuO
z?gt>b{w6C|(~k^7-0!*M=h^Qv2ie7^Bp}n?VI>b@_jf56@u`5;#>)R_Z%B{=#RF)K
z@Z<&q&|IVtp8}|DE#JyLkxOu%f+ZyU-wDX{Hz^(fg%PNa7@)}1z@s2=V?TpsImk>t
z4FMU@*^_))0`j2q8DV9a`5gO?m*+@-XrC}s)<lLu3>Lm7{0vU%H*Efb!ZrE4%};Q+
z-T;N`y1?`spm4PSr#}-J1`&{*pf~~P1)bLhiVv`!n^1jsZ2m&xWbI8*oPg38halwa
z9(Wo0YlkW*-+<)6?l)s<;JYJqfV&|m9kizhv|j&(y!h1{&l%+VTg;Dw)#$S%@IDZ@
zv%kT7Jpn)d2K%vVdZ>vEgH!Sy8}N7t$iL|aZ2p4Xd&lOtIn2G_^s}ZB<ktNSW^X}m
z0{IQ>X2`jujIV!fI|_0y?;oK9FXZLGXE=fOse<~oFXY8qLHFW->U{5$Hl443Y~KrR
zL&z|>o5(OEaQp$S<A$8Y3o;j^4ivs%HSA20uYc_Jy{;fL4`eS)?)C3Q;BgVKSRO-w
z=~)JFJrC0N`p34jybA<of#l{lfcxcc;I;0}3Q;^a1Y~$_3CMq*BP;=0F93>ro;#4V
z0P1V;+ykeF7|@xhyn8_Rd&v8moMn)JwJjm$@6t8B1-Y{X<Q|ZlL3<n^ay!48M=^l!
zK!?k*GeO2Te(VJMn<q`^z+N@2R*?H%$a8|{l0jyG_5WNX3hIl3<UnI60aiSaF|1!}
zOF?Ro#KH5}pne@#->-EOLG5&q{GJ2_&{^?rVExKG;C-ney#ZF7kha*LMWFMv!EHOR
z8Y`X&AbF@cj3$!89UyZ+bq`qV=K}CLke>V2U_BtUAU8tgwu1WSAoWnQK=ZVWum3Cr
zpXUn^hmTnu2DP)G<2ODgoc0?*dQ7+(TsRn+{5Uc-7QA3!+yplF`*!fTKj8iN&~eKE
zD;~&P+8?y>yq|ktnn<x<aM%o43*xXJu@=N(Gh!`>!+!d$1p&3!ApLfRb=~vle}#-)
z$bX-6+RoNQf?-zR9G(TBds+f2A?cRCL4Y099)$RP-$~FKWl-3G>ZQP2JR3k^4wn19
z@9Bk~@;?HS8NmA^UdYRW_Ec;Hg=>HfJ7^u+oc0C_$aytl3=GN&;5(T$Ky$0+mJA}G
zd3LZlKVat-iN6HdV<N-Uqwweaf6&~S$r}bH6HW$=^fNYwpz<sIfQ@PTNgK=b12(ql
zcWhjl7&sO)F>vexoAZ4u_}mZh+}wQT2ibRQK=-DB=X$d5+jxTS2a{%U$-ZOr)BL*4
zPf$Atv}XvScmG?Ed%REE{Om1(++Xf|-{v~#++XL*Ha9;N3kf*ivbhUti#Xr6xeaQU
zfY$PG|6+>bp2ZZ^@1WFSBE$3z6gKH+Y<{NSviWPm%OGLG%;1oI))v&>VluyOE0})E
zmK8LQ1S-$c@7RLJnA1<%^1lAQ?``&BTS4#pwu0S{A?NhF-?y=KKWyU&E*l;*IfKS_
zdlD4Ech;InFld<HwDB~*Wpf(r{y$sig6@$^KWqa!Q$8vEj*TVgj(8IprXWx_Lc*0n
zDE*ENxKEjW$0iaq_Xjd3{l1MWsO@Wh%O*ShzD+2|y!691vB`&RQqzyy7^WY#F-<>g
zW1D`~#xwn}jc@WDo5bY9HtDbbY}uN8(k2sRcJ^so@EREtF$S<d&2QL%<{cnq&G)_F
zd)UB!dkr~f!2Pl<tNVRhPEfdl!*M=SeDh=DkDxpVvj6q3HQ;*Sg}m@Vkoi0b0<$JN
zfa+Mzq{$B8bw65@9YA{m8Js3NfX0v+vtBSTeBdb%xY_M({}hzQLG{-Q28I)$wsPQP
z76HBl0h#uB4Uc#V1g-@9XZiqIPXuZ|gYMb^?SJW>rLcmpMu@>-4}*fkeg-8_oeV0I
zO=RqAL3>zD<Qe#`&zF&hu8mXznV+zkLBT|dfhl1>qZtQiKhXEp;PMHPCxm~3${5g?
zJt)n<#_LVw8Q#5+mrv#HWr}fF$;iZ0AaJqOuEF4@2LFSAKTIFEJGt%@Ph@0p*u%&K
za$~|CMkYQLftcpL1}#1vfnXC6h8oZs@k_<hAG%5!8bEWIpteW%1cgstR**A{E=Nf(
z0)?e{6hqPLpIa<JYs9^b8Nlb3Tq>6S$5qTF%vdaO;PM<1hTC(v|0UTlIJucHc!1hX
zZpI8g?QLxaZl(+Ypf!gK3?kdit}z(!-BFkiYL9V$<C1^<0K8WE1p@=q0|o}B0tN=A
zHz56&pl2<C%sD3GSm0*L;B#pY<oqS5n3tOoLjZ>;QzVB7Q&jO4+rZ+h;QO5!Uob5N
zk1K-WoI{8SK9BW+X~_#v9RLy!GG<T+zG54=uV%rH;H$QYmxAwqfVEdI6-&wYB`9>6
z$Z#+;?P+iT-G9(Dr@_cXgrTk}qyc=UEr&2u3}~DLboLi0-Z?~>qBumDB9#gl7+x?f
zS_5k9cW;h;4hoMK^0H?^`9$ePgItgegM!&L4u<*DT0nQg*WI4Z{ovDefn!|XxWqn-
z3HES{afyAp2H|sk<C=c!JM#msKcKUhr4Mrb;gT^CXJoiMOWO7F94Y?h=?wuUVvPSx
z#2Ffzr#D!bh%tiht9NLg-k@M2#?Sy-XWc!$fx|?M0mOIU5Mzpb!Myj2i8w>u?Y-O|
zxYzG!0PT0>GZS**vla4aWr~vJGZ*p!wQ)Xa3bdrzFwE(j0P-(mgNY2|gd`h=MYn3W
z9wgZ^Oi8j~Sao@i)C=y-OmmZL7$#kY#!ZqL!!*#@U0hd~rX?9OthsdU{)cJT7#KkN
z&bg;Cg&h-fFi0|ISjY91Y5Jw__diVg&cML+fJOY$gE-LMfGp5`2%z#W&6r_Hk_p2K
z(Acn<6~m+?Q-)cfbolz$&WlMl3^SbUA@@##<_ePR88-0jfwXye_6f*?>JCtz+smL>
z5MaX{U?R*gDSbYN!3%kb*y70?ptFh<y5=Zc;1FhtRbIisV7^!WKlkPx4IuvIz0x19
z@8xK@y_fsJ=eYtc+<UlWKHU-I;JO2%g#<vfi5P<%_a3ghxA!tn0HqNVafW~0dm5y;
zu5pRoy2kyX>-zk=xA#gP1l<wBA<7gEGWUhN{8A1PrZ7GYfml8jfiTdW?R+`{;Rtz|
zyC8W`e1h*?l;vPB5oXwwKA+>l3wg1(#gjP>1P1dYK+2!#>p^7{dKpywg^A&XyjUry
z`~j_x<d9;DEIz`>!KA>kgUNwoJ5vJ3Hl_xStxO9zwm{3sg#lJP7heBf4_;r!>BZ#r
zLSFtoVtpASsO_^5w66wzJstRd3(&o}pnGxM87x5SHC}(;c@{L+56WNQ{ZTTIJ+A>4
zJfJzVg&;dYaSPcW#ToVb_qw+z`=kD@1MeI2NM$g1vut4jPlW*ZY)kMOxPR*>g7WTu
zQ2Q4&)-DYmqh0v=`z}_Ho%<Ug`zt|l54OV+V(07MyIMi>KP^iX!DrJ<SfIf6f`Rc7
zPlf>azHab(TsCmud*SPU>rR61z?<Ko0G<N?x%Wmg{{s$2CbvBa$}2$b0F6h3)_)SX
zS0nMwk_Cu8WB=BH&vOQ!HI3r-9lap8&u_5n1%(;N-5_^??0Nlt+g6C2GI$L-PXctE
z=)bMtb5&l*%RS|l5o*}8z)lpjPYW~#cYIGAE6o33GybjV1odI&x7xz*K7fjY_q)z-
zP(A>%w`Wm<1V|sKoa5L7T3gLLDZqy30DptPah?o;IiUMTK;_wl1s0&bI$QD`yNMou
z7%ci56a-A<85BTgt!MmUu-LO-Nq{FoV2;aY1{V`40R|3XP<gWzyp{$OcenR*f8da3
zihRMeBLh^odi-Lr0I9jXjQhh2<}F7+VxW8nQp0g~#{v#nCO43KUoh^h;VFRhf6Q;$
zf$t6m-9uA++^!KM|N768UeH}MAise65AL_@rUu`!YuvLy@rL_M2A3C1+rjq_+}^|e
z02F3(5^Qo!WbA*xkeA5?#U;-I0r2|l%a-y#0&ej<c>R0jUXx_||KPZ1VTyhsFZ~y^
zuMQMHVEg{9ssx8C^n3tB+^qWvT1WUoUV1Iap7{+5NiP2xT)O`>aPia&HGu9)@%YbR
z(fnrtn9m{46mxmL^w-G`3>aQ8FmSz)mv%Lgv46``ATaq-z4X`q2liJ%;RZ4T6ecg2
zH`Rc`hy!%5f-I98R4fD}_Cj9vD9C>x_q|};E&~yhlf6BMtKrQGE6`X4WIh$1FSdk&
z@&#zGiHVH;Ur_vm%8UR@o(sjt89hK}$%D)S?VAMo8?;vvw4V~RchcLH!NS{(!Ql1p
z&1d-|1e!tNeq$GOz4iBv;Pvz%G0^(jISUjvfcyk917zOof6Eg=VKl!1GWTq9-~Mm=
zi-ru48$fLW1_qJMX2lE!eDw-*Ky3!@$y_q88^CRZ5(Wka5e5cOP=PR`iHVH;d+=QZ
zSoYioAGZUqsf5}o39@s4gFX1nJtVhug2bV2jo<&k4z#}ZEodJA$Xq0K@b#gfb&Y!t
z*z<zy289{uoYeqJo(CSk7!=Gc!ShKAU;o(;USA377lX`(xM7(f$gYAk1_RJ|X+au;
z0(YCn0#JL9ryg_$7U*tk2GD*H&{{muU0(-Y|62+^Hw&a5WX|LU4F;HcsF|D~Gv_xb
za4An<QZb*SlvYr~U;ygtgXZ2rW9guK`#|M6$gR-${Q#;H!1{l0@CBt4P}n2yp+!~C
z%Yab7{w)#e1wiQsWIiapa7Zz^qNJh2_Ke={3>Mzbp!Boemp?+F4dk~QzhLQSE%>Yn
zkQiugan1vU8K~)J(L+eN2<ZdtNl=)?vq4}EXl(+|VW9?|!$KV|7#Ivd<uu3*um3Gp
z1gYncVT#}Xz<w^sEKuBH+XD+qGjEdi?*)Yi=)7T`1CVt%kZ|Kw0No48A0f~RG8dc=
zoEZ#2etZ3U?Oss0>`4IKQ)d5{XR%NN=-w`##X=p}?uG<~FUU;L{smCkU3}c`BJ?ah
z$ldd2>>A;Fl|c77p0GOzu7i)-eFW9Rpt2rx_cdq@RIn=pc)x3a4T}S4kN@#I4jd+I
z3=Jl1kbXGGt*^hY;{~OYfGmcDfNV%Vn?r`l^Ua1u5&;=V>V7Yq3z{c~hJ7%o{sZNK
z04tsk92`s`9NbKy99&Fc9IQ;?9Gpzxec`Wv?@t7c6@m1C)bk_=T;nMaxDM7=0Xd&0
zz>1gQ_3!<H0hN$`gNY1-4#%Du3tliVd%ao2WMLx1pb?PDPyo^caqpV7Aos$|3@BxA
z2(aP>jRAq%@&RQG0RiREdrW@s1C=M>@hLp^E4==_4{Sduyg}hNzd;pzo*F1$n23v<
zdcnXmBfx^!0A$7sc{$bqV_r}i(wehp-g%JQx?A_{2hpH2J>X?js=}08Q}`cnP397L
z1umobCI0{aZ-b5*82CdN82ED-82B4NatsXoJs=txGcX9Spz*<GF)%Q>m@KvbJ7>>a
zu>IYwd)FhmV-M)u3;tGUf9emcKgDRlz`*#2fr04)0|Uzn1_o9a1_ssx3=C{C3=HfY
zpi^QQ7&s0vFmM+9|Nn0b2s1D+?qOiyHi6I}HVAX?U|`@`z`(#OV<N+-HD^yF=pMd*
zbN0+VZnD&#(PXLpWfK{Ov^jg`)Pln8#!~JF0rtEOptIK)QzZ^uZxRNb!ywQ705lH9
z<kYf6NeZ%$-9{D^?w~U&_!|W7&wrrA6;Q*F0NPLYf<e0Lebb^z9yJUe{0{^sU!TJ%
zf2mmdKWLr;oHqXMGUfjx)bN6Vv7sOVw9bRkZO<O-c2JlE)H5XPf1m_z%LLfK)~YG~
z3aDWSFcD$kGZAJG;h!ROfPb>kh2kj;3dNHd42tJ7IJ{tBcu_o`ApqotfHa1H_bmz*
z0jUfQ?^_s7fcE$7Z%|lNkjCJ^!N%ljlEz?AP{R;#V+ZHmf(lSM!vk8Mbm#b-0}&uU
zUDzi5A;5;$;po!?1^hD<Zi2!kz?>I+j}gfI0am;TuYd3O2`Vpm4hS81!N70;R94NO
zub=@M3wXi6umIHm0_l4pFW(zr4o-(0pgAVc8d;DT9u*80ufJ`-8c@aHz_UOIbf*gF
zT(?x7Jwgs3KfG^JXaM<Ra)SlO3kHTJP<aMw=LDazYb5?YNV`PPI&;weU68#D55VJN
z3txX<s0zxb?ei7D`Nu?_Cjk`S`{yqZ0FBv$?o|Ypv7q&|;JN+zEHVMA%nvyBa2@s7
z!?L2i!9LVP#{PRiIs<5b4d@;n&>Fvm6CUi@V8YI_;q{*l6G3Nf@f-(@yUXs)SirIZ
z6s`d_yaD_T0!P9An<f_u@?ZP3d7!zrzo2#kJWtl3=Sc>G|NsB9FfcF_FfcI8U|?W4
z1I14m7#QAw<Y1VAfic2l4}$_YT`grez`@28Kj(ph1%HFUWuD7I4WKh=&F3%(>~FOP
zpJ(twUe*^BcaU@Y<d2&FXAlUeXK;A`$hOx+hQZ<e6B~O_*zJE{^VdYi{-?(th669;
zWkW&k1(k20xP1L>Gb<=OLFz!|o%sv~rhqE&+Kh#-zik1XM;iG;UZxggPe3t)L%@E9
z3H$18VohZ1Z@!S1t_8UjRL^_tVK@N_f6%=;0ro5bAU3Q{xI9PtK35IX98kXT*vxPN
z6rQ(g_(6FU6nFEF-#-A_?_z(gUdA3Ie)+TXe^7ndmY^W;{Q-+Si2eOPi~RQoEHN+S
zrKa-S7dikkBfy3?0aWKe^0c)sXg(~Uf<a-wOam9F{Q(;51*PKvOWp#AUpMUq`R#?g
zv~NHSg90cn=Qk*LfX2Drx9r*uN~aKYi^1UwSu?<J>4m)HTF}{z+6ka>cW^qmX(GY+
z0LlmDzd7cX3?GVZ7(n-YM-|&J1}JwPU?{d>xKM1vm;f4kDYjvBD7Im|0P3&v+Xx*f
zwt?0ke^ze<<;55Bl3PJx{6bz{R=I)k56Er%8!Y=lZen=A0X`!R?6&W_6+v-_p8mP#
zuK=BomIQK>i8$|~01IC5JOxM(sJ{z}<JZ5z_X#5Q)&AWu6J&P)=$`VYp!6<&m;aB@
zg@8(ig#8K@;4?%)VFS7!0%XqXZ|mXbT$;!*HZaCWIKaY%r$*=k$e#r@i~`WSa>siP
z!->mt<Xu7O?S;I!YC#PnILzO-F`NiUWe9lR#8d%t@BRk!tsokdzCdRh1lVvifXZd_
zFQTA()P?vT2wa_4YEl8}ubBU5*s%YL{aLVj8;%K}eHQ!;0#l&;1>Ii~oIq*)g}k^d
zsLXlav7H?hhCB;|4)81xy6}R5aYw-d1_k~GkeS98z-uPvFl+#wi4SW3zkkE4U?Rc7
zz_UZ>fQdZwKb``C%lqo5)tboIe+8v!P&fuyGJ(evUjJEP8BoQb5CFOx9z3U_z!0Fu
zq5w)`AhqUE_P+zvnZbJ!Ii9gdzF^z~-nRwHXB^L1B)HqTB*EeOXZcD{y9ab{9nS)R
zJK%Nu^SNZ$9~d>TKVWJw|IeT>fBt;%7zulWQ3C@53&RU}QP5l?1IS+iHoOx+Z3><}
zLKh15fbKUE@hw=uU;wI*-ak?(0M$S5pD1*I^1}WHCeK0P0S+%?-UWOK0+;y`1SS{H
zXD|STeerw-1<-x<FXV-fg3iVTtFz}_04if&$V-TV@^FAXZv%)AI)hdDTYHiDe-Q?d
zKG0ab`G1oeFXV-NLFR$d@cRzozo7Kh-ZA+*$X-xdz*AO&`d2;-42(Sg|Nq{=z`#%v
z0IK7JSs1wGxkTnoo($?YzXiL=lH&mPPcBJN9Rvx(rHY`m{6bzR6jUam>YD^A{~-FT
zI1Yg3h(L84_b)EcI`W0DzweNQ=oP#R)?34n@V-N+7vk<o?L@lUgn@w}<p2L)KNuJo
z5>V}*2)7@!|2@ExcLSO{sLc;{ALty%04v@NpmoeI<OTME&L{@?7nCMJ;$XjiTX7d$
zSIY~4%U@7h1BG>fJqxJqGynK~2abR&hJc%1{15gw82knK31kK=oy_l=zzf!6!<?`;
zW`TzC|9^~7{(-$Q6PAO@A&{8)fBt`<b9wj1PXLwwOke6581_2%gV#rb-SK_XOVAt}
zC_V3Q&`;%%0p05WDkH&dANlqN2E3p$frE=FM)?7Q3h2D3Z}kiU+<!oE*~szvF%Rgh
zOeXGETwEacf$l*Lfb2Io%yE>d6?8_~jiuZ_%#YhIG~r+fP*h@IcvGlQWWobolgh&s
z$-&MP`})UPP0*QVm*-3WZ-1ZwUK97dfklqH3)JpoST*N>!V1$l;5GN&oC%0EurK8K
z&Vts#DnDRs;QqrUto;9fG|11NU-K}`tM3DiSula`k>+M{``*AJ12vCp&jR~=4rV5A
zkeS^bcA)(XKA>{JM3Nx^;+{2}Aoqaltp_Zkpfi^C#xDS$*~w|oCBHX*-+PdL$XRT1
z;Ir63@%O%I?RrpJ1LfEK4Z71o?J!t>0n*=6$N+^qqAj!@+|LJvKPYbpSn<N<ofp3T
zz0?pq#|~L{4&KB4`q%QiCQ{7cGde-$y#BgZ6_W0G_JZOZ?1nDI8KAg$-vur|0w8T-
zMy>a4Ysx|Hc_Gg|mH&az0TW?HhW(RuK<%IZ0c8vZ^A6~kg4$gHH4F|Wq6|zRGx)y>
z9SAVyy#Oj>CM9SvY}+Eh#39NQ0+#zCbRob5RBj0!;A;@La%+lI4u6BtjCl!KSNW$1
zO_+C8dpgKXCL#<hpt-GE#Zoz-GZ?cWZDxfR@?5Ri4Gb2b`~j-7ivNJ_0JQ&K{D;9H
zz=jtzc6jH7JeO_p9|i}HdIk@W*b8~Ssh~0|pqL@yT?*G#SXj?XP|z@uXJ7;6fp<v@
z6kz%2_J7bhE1X+FdM;0v{>T4Wr~%T}P*Av4!VRwfO~eIKUdRio23YVuV7MXyJ?k3W
zMz{>x=MQT8fXee1^1O44Y8W;Iq%tJDS)^zHYCpbNq6C^pX4<nr6O{kK>#V@>@^iVT
zM-}8gtNpFuwFmAm<T*=0?N(4-4BCePR`+eeS<pBjD9k};;|2U@FyMb6a2Zs7^M3%-
z7lJ>7`xy$s|G|9?gMdHay6--y4aGk};0~x=@9~Gh0aPx(kY~SJa0imNz~=v4X6aD{
zS(h;%bQiY_lY2ltg8}GF+=6-r1MkTU4xl<?{^u38ptuLQ1*8w07bKV%UVq!)2`Z-o
zY8VVS{&3Clp2Oe)vImr2LG4YD+SlJ#H}X6XxCLr!DJ*1Qcp=YrmFK9?1@oJBg<$y~
zi<W}Q`1uX$p!D}Wcs_%I_Z*0OL4M`AEOdbXgTQ@|yLs*lT?oEoSNKAn&9~qVXdFtW
z7L=DD?HRSV;Cs1K!E2QlzW%ZBE5uy2<DhT_wKsz2Fevcs7dik6mlyJ^M?v)|C{KKE
zV6}hWw0}3KkM}~JEftgxK;rLPTI)e&>kD}{kpDqz!xp~&yQ~$Ir$F-i8`Qw#;n2RI
zeE$R0x1ewWrT+jMjsm4*1<>BA`vD~k4qWwI!uuwxu0@jHz~3NnWnY7W5J>EWJZmke
zJ+rUG{w$~u5Kznzpxgqw14cm-wEymfJjY#7KLBE{T{6V2te|ni{~)pVb6DPj+Fb2(
zTEO)`C>|IXME0A5(##))$)I=yx#3j;c&yXr|Nl<`_%H(l!wv=ph7&L~3=9kr3=9l4
zp!5lfb8y^!+YKJye8Iq&0UE!D`Ww{tl4);HhPL5&KY-fsFBljVKyE@)(+c5()qu;T
z+cNwQ0xbC$c=iY#xGurb0%~i$kmpRjEde_71XTC%3A|un=m52cKzdEYg@Rtlb3P5Q
z;8Osl-Te=A%+3GX|K^_{aFeG%;D(6|!-D-X4WNC53qfsIP@m!T?=8Kcb{$WFz?~QJ
zj9Wo=fyT><&oHhiK5X|9be==;X}iMWQ+AETC+#K{pRik4eB5qh@i9BleX<vekJvqA
zc)+n7ln>1B+Bd%bzIZ2S3=p)(5|s8qXVikq8c@IV^L)_ya~2uUS^XdG2qbgt;kq-Y
zMj<16KD6Iy!Dj$61600)%mcOMO~gf+UjN!ziZplC`1;RIR#3V_r~~g^Ykd7{rz+^~
zACSEuxd1EP1)%;d$Sjb#uYc`$3fc<`lILJ%ayQ{-0H4np@Rh+J;2VPiXk9qZ2Z8H6
z4+L(2)Pvd}uYc_TpML?;12*#;LqWiIhJ=703;_W@89@E%#sDkc1FwJW&;{9JYQq4&
z--bhm$+NrL-qz$f1GsMjk_&+Bv1@$&Yx`9b(E074JttgHH<U6N1e7r;fcBmQlrsqg
zR4{?oTY=2J@cP$w)b(3sOa%euObG!MOaTFvOh|6n4jwNs`2%-@dv}+;tw}OAH*7o0
z$-&j}xkI3ZQ-%e+2f*Y$3;3)P?x$Sx0am;Zf<H4PfW{Jn|1cB;e}#-)27hBP2>uQp
zYi#8IAaEo23qwHh9s9=DzqaWH>|_D&SpkRBR_25ND_-#4@qleC69TrgG=Rf&2eZQK
zUt6yR>|_Rq6Iks|2894CKCpjZ|Jn-Pf5;;sFdr1=pguMz{ebF6NSVt00CbK#XuVy4
zJ<|hFJq1ep0rq^L_8|BiK9CrsE@#LBjcfHK*uMppC&8!f3WHDCH3pxwn;3k;4s_4w
z#^7Ui2ZN8=T?{^A_b~Xd-AB+qv*0s!xuE*2y+MHk<UY{)eX!fD_yk`6+5+Ey3le+%
zcTXiKErKw}9VRk71_8!=0iZkt;+x-NZUE(<0BsJ1;!Adnp!o%me~K^K2^L?lQ!GAj
zXIOmB&awEcU10GUyF`5X43r=F8w5_8$nb#5l{=s_TzTt-7`V~)I`M(;lwjHbvOmC>
z4}AYbRt-ZyfH7YINDRsb?|X%^Cm@M00J#q=Zo?A5KOZzMufPBv-<U7dz;Iu}!9<uR
z0W=rMmmqLw|NI6nzIvepp#Cbz3~)UB5o$0I<`Gby|Mx#gj4wgpzWE&ff8QH;80P<J
zvItP+odBwPKym>#Tmq2&q6!QF_RI>P_Q&`6OvM?=>|pl==<$K?^#!Try(4r$xuO4m
zfEFj{%#jnHn|T;`V<6)rU~zR$0rNQw7eL}Xe<0!}GCZLE^_>6%4gpY`92{rA_O<fK
zK=xLE_@KP``qzTFCL9dl@d8ks2Uzie_i=#al`Z=Jn_Ds%y#BGr^|LY$G>wDZ%K$PH
zq#o2Z3$Wq??@I*fdHrKIX#4=Y=CM&`!Gzm0Ky4@i(4AqC0akqAJp20BdieYuSkIsJ
zp`dj1{U7rjkbgm86kq~wQ{Dls349?hJC$z^$X}qdF8Bh#dVcPN-}eY|M}Q?C_>2nB
z+!<K@+uEC;c}-AW+TWla0GhJ}nGNcz1ZeOE@YcZge)4VLl@U5%K8NW7*c^Ml0#Lsf
zv^N~Y=e;j<Ai$ol0W|*r;)CRP<AuQU?g93E;Pe9$1KAm%13DL!fq~~gNDn7C{qa8r
zvAH2_Mq@s3+-4;+I0P6&^g`K?^a&Q{0IT7v5jqfH#diRt|Mj=Eg1pU;cmug1z>04H
zDDFUZzW%Y37ra*xJT?J3e~PyN)PD#0HNcV&>?e@A04u%?uYc?S@7)B230Pi@djqJA
z1~L<59>_kB+SfmKB!bq(wl}DP*E4|C>hglamv@1{Opy8jE4~X*wVbyt`5)Y#&;Q`^
z9O-}k4GQ431dz720E2Ri0z-fm-vi$LLg2fqcpC(6g7k6E<dS^-WBXK)UbuVgc^9Ci
zD{wgqQvdqrc1uv31Flw!?}3RtPXWj+kTl2--v0|xyS0(mK?r;%&HM%h(0(I#kUFp*
zE%`z1fX3I~R)Y75>~By2m&c%V!5ah0^U%HXmi(YQC_w5wLG?P4Iu;alR{Y?)`}NPQ
zKT+JL&i8@m55zoP27x<ZyRG;k>Hp`}g~2l!5_lN|?t|)@c{Px6?&3cT;4~9p&(8p1
zgVH-cG`(*I@5hIoaRG`GsF?zwv<mk3w-pCr{XtM!7GTKSpzI{T0AhpHS~7#iv>Le$
zSp;txazA+edr>QRJvs|hG-w|HD8H~f7&WjvFg2J*F(}Nlf{aJ8DHwsrqfBJjDtHzM
z+y{l_?axv<{F8-1>-iY6=d&%yp3k--dp_HS0DJxfkUS_)WY1ySQ9PfWA;6v=oTrNC
zvkSn+@<IKJ_x~C?K>jchmzot|!LRUwfdO=nq8e0;0VD=$w}8w8`47}Cdi`s;FUT)1
z<i(+D!KL={9EO$+_S_FZ{RI<wh6YeOnU6u>e(`(;(D)%!_I!o~puJn5J_x962i2<}
zzhuv6H^`pPZlR2J_H_3j4RBb2+!CP5Z{V?qL7~4vjRRyi$StpbtXZq<0NE!A3f};G
z<^y0_jX8niJ`2C;ANhY1A5<`K@H55So+Fpj-lCuYHp`gbfiFQ|%C$K>LVP7c4LlD7
zCWF@bf!0X&rNP(8FoDtzC{2RaAqE)n2k<!vTn4qB`C=5V@P!B+;ELh8V}8MABB&o|
zBF5mr=OAz#v<H`~2z=)66}~<JNxl|=D82@P817jtQlNW*UNCL~ulEPtg?)Pm_XG1?
z3<|~9Y#(xb*|C5_gvq`5itR<P-+r!HSbW14yq+}}L`yTd1mCp1Xf6S1|A6K>L1`uU
zvh7FEUAbHZTr&Jqg$|e%GYAA<vwgU)%nrQY!Thp)Bj_HC;>)%hO#~SnxF&$zc89+~
zAeg^TK$5>jAd0IB=C+OCum!o{_Gaz}X2lE&!FO#pg51g>%oG92gRg(@RRpE);48Kl
zxh8SRfbORTl?Nuz8SFrAF`L35z?II$zHg$v>X!#B(tHjAcR22_2xn|&0G}no7a(w%
zdol}Xer|&4fBXMIAq)!KQ&>d#N`)qHFf)Y(1v40c_VMz~5dz&$78+o~53WN&`+PxZ
zFk=rxM}Q6g1Q7f7XKv8Cagg~k8G9Hum=)Xq4Y1({-9G>p1F6Z_!_W|5!w+tcD9t(l
zAJks~nU%4JVFp(!mvDd$zXOO5RcjGo!w(+QKoXk}V8aidOEH_mA%vuVL4XZ^0!UrP
zeg*?jy2{uC8vo!g0Et1(3ka|Q^_K)d>p4JuP_Vl)_Asmnu;B;w$H070n$6h5up_{R
z0bEWX*>NDihCu*{{{qz3nOC}S6JL#x6Ufd0b1v|Cn;v^W?QBrp!{3ngp8+%v1KCGv
z$v=U+l}iS!)}DU>zr7GRzXw=A!X&_o{{Z@4OR!oSE(K6~5tdK0TX{g|V>j|92!PH>
z2iHTdzb&{4YBPZ1A5@Nl^{H}fF#peVfrFJP7_>G5lpgsC1+H*4fW`<J7x6z3II)*O
zag~WYgI@RirX3(XAZ#MeHUV`1L4XDS1HJ_U;@AIka&Y};iobMS`hVL4g&^+vOmjf%
zTyM|k|Iq#*!Grrh7wBH@`JlUE&Hmf}?|)!_^!9gd&{+cUW?LDUUdYR?HM_>Z1X;T)
zzZJCS@AbEBwjlSuke36W#Q-WtzQ;3Hzy7vL7j%9&Z-c-wkY6~Kfyb*s^$vKf2qb2*
z3(_azcH@$I{cR<9%@OPzMbMh-7xHqdpt1op9>kX>AbhD<`gdE^JbBPO3aHP|z#y{K
zY%7BS-)4nrx32L&;JV5s_UZs+41j@w!2;T^2lefdu?><qhz-YC9qbA>g}MLlORx<G
z*<n7JfeF;7<?j$W0Gita-6IMT2c=!meH`r%RFa_O{xSXzp$6Utf&2R(D1zGq;PU3%
z3RPt%1#tUP*_i>-ANsZ&?tf)x1(?`XP`H7@MA;FpZY^BQ2`&a+cL`SK0vCh#UzA<o
z=a@9U{<d7#Jc<cow<}yNc)k>*ACx{gn3+NX6gfb9;VzqqGJw_`hP_~5^!P5$B!DzN
zBLkYlRi69(uK66+n$I0P4D)L2!DAaB_k+$J=8or*+W%c)2WV`EYYNvK4lyPtt~p#W
zTs2&GIAoY&O~e@{@B|3_<OvY?#lKVN!@7s@clmb-eE^Ap`15}#DDhnoxX=GgK>qT7
z>EDwdC@^q{GR2rpVPFE4!!H;ZBtUCL_!|VS?|Wbm9``l7#;}3!04Tie&vURc#mw8U
z!eAoK_9JKygM#vp{{NtU2Pj|lHz-Ja7iJRRJs@y{o55nicW%b_LC~`0`*bFO0CWBi
z+%haOx93RZ@c$9w1C=o#KLpq_Fo67^Y_a}7$RFI2ERvvo1`W3wKX8aLxpN!{iUFNR
z0V@ANYqmlA9J$+AWVq&V$=vSYe$YJ8>Bj8|{0}&LxaM%q;qu|i;X2bLs02Re4;uC{
z(6GO6{#7)9|AD~ec?k*;-|Bf7Ky^H5?2|7+;L5l8JPdp#LI<+{Ff0J&2~d70e!x%=
zRLr1|{h7f5lpgo(w{HjOhngE7pu;hN7dEeG%&~w&n8~gCOA_eLh{o677K85_GGXNr
z;8`GW^ZR@Tj`=oC(Dtwb1E|dvV8x(t+fuRwoQ8jG1F!FVA<q^HN;e!bOs*zk3=?=h
z2t4BXAn=4|k<f>A2jlPZED`zu7F#6rA!r+e0=EU1EdN}g17_bD4EPQR9O8Q<bb#-I
zz#;Sh3=W_=o9~g(g`jH;3b&*9ADGW!*iiJ1K_O@xg8|=Pp##O!?F;!12;AlW3)Tao
zF9h9XP$>S(pb&J8!JzmXgTZYxsT^}l1<)BBd@tl>&KA$NZ!{5Shps{56%DXp5CENT
zXClD>JCCvP_1Dc$%>*E46M@bl2CWr0?P1u!mmqL;-U0=otQtfZgXUJvia~R$vaO)G
zRd87RSO;D|3knBN8w(WP0XCcuK;=2_0f9U78+5^S#Opsh!ROKPCJ1nY)ZWbF{{c}8
zK9B0?+ye?HK=(9)#q@bUm`E@)@IC;wsUi6{K%I{P)aC};`E^q*sEq(>11T+FOa__9
z!O9d5YFlv#GliIlF&LR`WsoxwxBss!A%FY*$0Z78l?+Uv_8{+PNZ-Unf(>+cDWt6V
zy74Y(tedw%sNrJv{U1}aA$P@dCa`cH=RN@1p8+~&QUsI_iVxaOG~ox$hX^nfAGB=*
zi`}sWowpPSay#gJgf|<Pfcw>Z4`_hacsIWOy$Za}4CGF*`@gM(mv<mOs7!nPd#mV8
zb$-Yh4pNXh;PtmP@N+%qHz;&~(iuoCXb%HO-|HXS&T_~wMJYevzY8)OG;Rz!vpL`n
zL&Kgu_U}!OF>C;}gF)^pxX&;lz?g4ARt<v#uY<sx_9m?&%yzJr6-X^;Y!}qW2K9YR
zBpAT`U$A}O7pw%`GXt{AM1m30&$Z+Oud_3e0-w{>`1<>TL=#p9hK!|<vuZ%$gBTNB
z4_<!?(hssHz=9vV#>YgGp&`Huyhf$*^{@4bAU{IXfcle=@yFM{)`QQ6KoW=am42-U
zpRE897XaNo?*VG(fY#VUX@3xH!pD;UJ0I%>1E&M%K96oQ1&iCp+z;kAD1hSFfEU__
zGZ7bj_d=d+Yk&m<s0@nX`3jyVYQ8>)!^!z4Lx{Ph{eNy7rWl^@LKCjf;g;Z<!xRIW
zv*7t7)B!4=O`bC-@ca;(d20&yU-SR=A798zeFeAg@7g!M{<`5S=x(O>^A|wYJBhO{
z0fo^EdDg1|77Piz4FcVuw)D*c{s+aEZ5MKIFol}1Gbn)cfWoEts_ntxyS58of8PXJ
zw+bG60iCJ)zNx_=_^R!}%hRO)w;fObuMgX|Kml|oOz5`-Eb=CQ7?@1N7`(ct*@NbF
z-M_qN+RE{jOBiH#fFgqehcJ^nmjG8NmjLKQ7Ot32#R4rH#$3X|2W=YzOc)HfrgB~3
zxWjcP$dthWwASs@1c9YoTew6(Yu~>7=V2(G!e9^-!Y2S;OD@gi0-6H^wb?;swTT47
zg5oI*1+e^^-N4{b+{)09-OaGz_19HTLG6A}n_g)V0|Q@%z#Ox!1`gL7WK{V|g&a)8
z?2Y+qguwf4`O1U@Oyrpu`0|BfT=p<{bkA21FcD!C;ma2iF%e<p0J$CJA1-08_|KCC
zS~%`=-RExPlHs2s#1{O4K>@VB8sv`R`?lbHnV>U5z-jyI%B!Z?3`~6Nkg*p~`NGE_
z1R3}EwiVnT558}E@betOwZYG!>rN#g<HbcX;Jz%hELrIa(hEwDCK3!hpg1#;Wc&xU
zgV*F20~5~!A+F%dwi|gq3xUT^K=-d+o+I7N+bz_<^GApW%KzJ2<RHNFM~Lr*y!2KR
zan=t!8w8HNkQcWFm6NZ(EfF-4;sdv3<~Nx8g31Pd=v|m5kbB!2U;kL+Ya+=2wgXgV
zfYK1y9pBf1&sm4eeJaAwn=_FF-zC`i`ujRfkXn#@e*@xP0EGP7mmvB6c@5w?65>aw
z-XCjJLF<|JHz<PL2C^3<53zS`B}gAAY@lX?&Q}AC1Axyb0jv437Oej}D1CzVN-!`K
zfX?#)nE^5jtmgX~sQvSLL1v-I{a6jwKfl2aQa7_P#Rq?8XxOva{ynH&Q2d7hHjZ}(
zG}f2>hXGQK+4D_6Vi&xS7g-A8L)uFwQz7knk#tZ#29=AT@(WZp23YbTwQaZMqL+^^
z<VE)eSn^Gnuwa7F3kIgDISZ5;0)H|T1YBoGfZbmlSj7NZQ`GqS*V0Vzz7Q6sXwceM
zQ2n`Q&;C|W`4wQr0NOhRQUg9Wgm;0!oa1*6g6j*gyeY#5P?)wiD82yY0kD_}19+Um
zM21Hoz?=be#^GhKyJZ*@0xbCsfX=A|sRQlp3$S8%z#+yIajO{C##sX1lM4!8ke&c7
zZUbHifjc0xLH+yy4Tb_<27#*}KIk6E09A$to&^GDIYgO)Ie3}k!F$gn>^E}H0QJWh
zF3oFD;Nle)I=~^!6guyK0vBl9mqVV(mv4c9jEOuWNAvtfj?44qfAl{{>@c5We-L!m
zTz^wz2grRO3|dngpu@-jI=4SilGoscylib?IH)fwzyMxfZ3+^TlMOK81)cpkebNKa
zzAOf<{SOql_$LV52kij{-A4(!Zvo`qz9;t2LHvCQ_SZo){{(@{FXZL7g6^?2k!R%U
zo^Q_!vNu47QNU>(Lj=f;ybA<mn&&qZIIU-hg19yL0m7}#4?yZc_yq%lM}QjWOnn80
z7xMD80XmEdp!NR&It(A6X0HXQ3s7SeFyV%@Z#=8m8$jc*ko3Lq?d>RT@HvkhGE4!U
zRgn8cKxb<}<=4XGLFPDaVTf|v$`HXJz!VIcrvl}N04qiV@Hv$HOyL}mdxaZc|5~sT
zbS^S@j1n|2C(LlH;j;qhY~^@(+f9w<0O(8sp8G-voF_AY*C0F3VTcN_=K;+_P2m3{
z1fI7A+hNHEI@1MG?tR-(Y9htH0Hha^W<Yf}BXkUOKe&Aj5eLoba)8D@?ibHzWB|oY
z@q9+mg-i;?^BEO_=Y!TYFdBf|Gyj2tl=EkXh~&wPV$S~=qLSw`N`Trkpf!T?=PO8o
z+?V~CeFMmS*?-t~urLHUm~ikY@G=M-eY2?H0w`<(tQaBfgrEDs<Kesv;5*3~yl1gP
z$|o5f&^qAj9IQ-XCNew@pm61H0L>$V&zuF1U%&pc13ZWELY}V>;s;Q?%CrWkf#OxB
zG(e5v189s9WS@5{JLo>)K;<XkdxagjpK`JCItZKq<>%r%wuu~!Ouof;YzskZO=KAO
zijUeFnsV50G~uz|n0&`J(EPN0BL^c>z+N7OB2a!a)wDMTrB@RX`;DOWM<${SCrrc`
zj$PE0{$cXn-gy5Pg%2je_8a$4R$c{a55Hhw_yJl&u?Kn|CI>fD?CYO<_6F`^1fQG5
zD<E(uP!dvafzDZQZe{?T!5#bh>mEh(TQ-op<C&QvgQOV2?K;r>In)eO6J`dcKn}=$
z570Vpkh?p+Dn)_kAJdew_&<QxHAC0(@`1v2PJ4q|1<0?U_7;d%_`th^gOSP8<T(Qm
zh;PEhU<5jw6vPInDJ#Ye;57bocc}Sc`$kB3Gl1H4zF;+sOtAKyA1KU|57<mZx?2!@
zCpffSJEyx{!2ooACdk~^KX+{ntb&|f58{KwU;o_I8)(Hi0c3}XB!eDE-2A-FM6leS
z^{t>Yj=*wK3?dM*{qXf!9Q;i2{0{_VZcpa_u`fa4m-8K)i6-(4OK#8M|Is~PQOfy_
z&14gKhOWzV<UxGMyuqJ^Z$b4)$2SGg8raEgDYo-LVb-eCAO)hGDi|V~e%RK7;xG6=
zL%<7p8C&!J_8a*d1m>InxBuJzs6hx)PRW{r)yx5_VFjfR^U3!1;Jeha=A8%i(?I1C
z{~ypjHgao0d=q(w3ElG*f{@+SJl|Fn6sCc*7#D#3_j5-sC=5V%#)JJW&oHAKl+Pf3
zS@uF+ek#a6Ab)kwS1^K_wE-m7J>R|@WX=nD4$#^AjVAI8E#33&U7>2`LDlGk)PTmx
z`5Oe}uRoC4fB8SC%(uS}>c@k`ZvW)}v0p(!!Ti7dLi7I&384J`f`LK9c_u>y_};ot
z^Vfsanp@g0ylu(<BXAG50Vw_RHwfGTg~R^I3R;0ujG%Sfv9Et_gN~m`gYWqPl{L;^
z7$TZxDhPqfe9+w|AU&Y64&-l07;H-oyv29{l&-*GAjtqe3ll5{I+vQC34Fhf2|P{g
z0-v)3ivQ~kGW$*B8QMT;pn1L(_`D<YIrjdbx~#nkG~N#$pJfWLVVD5wAA|h1zd<3Q
z_>Qe3C>}uRKER6c!Rwz}!Q)pi<XOS_5md(p*fUH3g+FAzPk{jx9syR2NONXezM3Dm
zH3XRnayQ6Kke@(izW%lDEvQYpzd_|ANDib1B+uU<AOlJ#5cf5L$6ZZi7(nYYqCjQQ
z>tE}@>q0>4LHlpPdtVuM)_}|a=}*6F8w#?+go}X%RE~k{0NIy($~N%zuXU`&2W-K2
zBkXTbVFay_;aMOM2^vFdwo!;c_?L;{_0P><dtS&hL+*!WXNr3LYaRH!Y0&*OAp1R5
zGCly&pgXQ1?%2x$+PmnnnDGT@k8kpQ$XR6`s~JBO-?dGIxdr4-j@4Y;uYaw1ntsAI
z6l?}FQxsU7g(=#74ucD5o&n^K7mRyiK>h&xi<2n|B>sYNj|s>>AUi;2g3Jc_@%67Y
zt|rM0d?53j=QBiHNss~W1<jO))JHdxxgTW8u<!7cVb^GHP-x&-%*71ybATlixX&A4
z#RQpi{J9Z6ehIn*4;0rN+)QEMG}0h23vw5p5O|&)q#xX#uw*j093uVUvc2?&>?`&g
z<FDCo&c1KIG5&`A=F29MAFOVK&jO3zwBKxXGkn_R7|9Ry*X%cY-?!hGeaC)d{B`@y
zRzJdLSp5v2S$xZWbMRIBjm0<YHwRy_-^eweOXkvk$q&Uh?KcNsw%-UEQ|OxCzyaEm
z%~iuCeA|Tm0od&8_M30Vus^u`Me;-TEr{J*C0xQ*Kf<Sh)>3BQgxCYN@0R`MOIxKs
zSciwty8fR_0Bq+?`;A=tx#U4*_~$7+3}E+NvETT4J_`faOfE^TN-lZOI+f4!c|hA6
z!S{#WHsyW*vh%hv`vdcP3=Ov}nIGH^;eN1RLFodhZtU9AEWjbk6b4#PbLoKPhfCLH
zegMraT{>X(<I=TRKR|N?mkwChT)H;9#;llu<I(}^eV4Ay-e*?Kz;fxD^nI?&EW&LG
z3K7%F80;9!Bpjv{GdNt^%D})_Ea7l#EBAv-4Gi)i@#}LK7_NsfFmTUjisz7G3gM7v
zin_E-@&o8Rj7yuPKV)Bq#K{YW9V<ZPJy?D&=O2*#3&!nJK>hXXyO8j)x*k5ALzXF`
z_`3b(;Oq7qo2M@@;E-U7=bp+X)AgrY0Hn5QPdAhKe*3>%d$@$TKC?)H&0*O7;nEc8
z4>11qxm*G-7`NR4*#|cJhW%!%8{soJWSPRiaeLW*Bi9_JsOI1W8XRIw;oPBIQe0IX
z4KEnDqMCMf1(<KQ{|jnAfZ_)fC!jfz&y#r=K;wL%I0-&v4?UmSzOk#O=>vx_Q<#Z7
z0|SRVQ!q$9NG-a$eG3!}!2JPHrby5@@e9VSb3pF9y_Nd`NE|fpb1A{{!=>VxA3%E|
zE+ts~xKupr2Wa2Zr3CAmOU1Km%>OfRTuQLscd2;xKJ)(!ESHL<?{n3&$oD@`S~2}Q
zgWavo+#k61u*ei&w%-_h&3^N(?UElr@edjo1D(76f??|dkex98rMaAcUNCOy;gDep
z1BVkRFMI>XK_oa1ZrE>Zp0U6HbZ-DC4!UI;KyeVpwFeYd97g8$_W!xXSfn6kZ+QWV
z0~r50I1V;n0oeyO`-c5yYcX&fgoESY8Z-{V7HEL-H8>7#fy`w$YTDJVVZOuuFD(4I
z<(c9^VTvvM!Qlo?-{5eArf+b#LDM%l+@R?j9B!cWeIFcdJEnhUaNw$0(EvIlplQpT
za!@>i%zPm)lL|@$jO7vz)Bi)#{-qs~9~kQ;96)z>UT$Cz2957r+9v%W`x-2bZ+eh@
z)qW;eyn#WULzXERq#vaI1>?p&pu7SO3s5*;51+;%%j5*gJH^-RHwWJZl`l;3puAOl
z4HAEsKXd*8=P3!Ma1JJ>;O4mtEI{QjI4<_Ig3i5;Y}(Um;eE?~rb)2<U+!64lH5C4
zWI^_2-?g83dl&Zuu-mTNZ+^kBamD37(jP!_*Z*<}c;B+0_=0i66i~hey9ty>et_d1
zlK-yRZv?4r{<gpaH2>*+$9^XFA1?W>`z;w@{!ROt&Gs!p-Z$)Ln(ws#%l(5(=2|hA
z02k=YXk(_}7xL1)pgA~@|EGUru)7Q`FRm3cFo47^Entw~s$hz^EG!8sBW8lig<F-}
z4=xKMml+!zKxGU_4iuK&H|=MF!te#-dKHivV0S~pa{8qP25}BqrYLZ_y=lJ@q>p<#
zQ#h#1x&#Tw_~w}l3_xWF_Y5wXZkwhbAa=7%(<@MU!aajanA?~|7-R=1{$4Pw_qg<3
z8kD!AKw^;eyv~H{4^s@Xy`VUR*$Iv#h#gT-I}|{9ty!i?$b7T?U+x)PQkN>EKU~@)
z{UQ4XB+Y>9gzKO>LGpvu_3)Y5S0VL>)s66Jp!5%}dv4fo1f9VJt{1M_Z@m0j^222r
zaJX%ZziGeO+B|%^wMF<0usg2XZ{+&QB@E7ESM4`~?*8lg(;&cY#UiPc!N9<^nM?HY
zWXTVgC8R%q&Xnfb%q84yyr6<xhD!z%W}x)Q9kT<RAGnPzK(rGm-@T9*a|Pvx7xEHk
z&3@Sbe<3gO*IXV%i!L?0ZvP*&t_315`W2)e6s9la#rJaU;SzfxFLl-=7^GHutGOhI
zmVFE1%Zi%E+y4ixodk_N-;QU0aN87IpDjSD&l*7Kt*gE{12kR&8oRi(!1BYTtusHE
zU1LzVw7}}erLD7mm|bHKxU|5!=F-;LHD=csI4&))-gjy1?0sg}7+5ZCmA=oljYX{Q
zfZB;$SGhs+)lrwqpmkKa^oQ*0khplkusQ)$UV-B5(p=8}9H29u7+3j#?1#tsxA5uU
zaK3B5vH9-;2ky^Y^4<GeL497Prux<kCgKcCTz{BkF3*t%?W>jnjn{GSVUYou1v2*q
z!>SpeauUP_i9yoU$`-CUOd;6pXqvmggF}QV2DA^pdrQj;P}$T}(sBYc_QpLQVGn3t
z5o8Zzsf5Gj1_qhibGRP_AF_wurD&hnw156x4k@M>(7Y)q3@<lWez-hmCO8Z)H(33+
zJO>hnmm92WF3*94;pGPFeV6Az!Vt9AgL@h%3{@5|mPs7o+7B%=OXll>%;hR!k>T3U
zDi4}-0onceKL=<m>MQqrrkH&R3L2oZXdw08@-?6^2Ca1g$EOSf6D&SK_sYTI6Es&0
zi%;`8i1-BEkqeH`J)m>q6(Vj=<$iFhlKTUw9xT2IDK~F{;#Qt1iUSmX49j<b?0X?E
z6ACIvrcZ;kXQt0#aJVkaz`$4|;c!`85|jpJUVgwJeCsFo14#Z~?s2JsK_>gIeIbYs
zDg!|I;|1d~9q()QGhuOcSzP+V_5TbEur$Q|hsnw6diXT&JNAXJa{WRK=l^R{7#MB~
zb3Z7)4sm1iUr4#i{R5PK+Cb-^F*VD#fyRHCxNRWu$}PhLPd^vpr9Xh&0Ji74{bo@5
zdBL!Z0pvFj8zcuwOH1B>)=Goj2QAa#=@pcgWSHW)XK;ykZ*Q#trJ-i=)(B9V;{L-V
zfBC=se{Ojud9MFl@-O6NOS$*6$iI-62JJltuchfKnJo&^^Fm&l71YjoAupv0YNvzP
zUG=kgL23VmyyRby*tF{mcAzqP+BF6TaG75w;c%-M+-{TsiG#un6ecg^CGLXUd)<_Q
zVcJy&2T=OGl)xatZNU_ASyuYP<p<z60JrNw{=6(H`62tJ{X|e2e8I4U0b~wH-20~e
zL=IV|7?A!KjEkOJYG4orhXJ&H0I5f=A3*n*gWPp#4<v3tX}J040s{_trf_ha*f;$E
zv76<aUYYL!*Kgw7<}Bi1d&HTdUN9`?xU^sT1BW;hsD7AuZ7-<Jx$q0fTx5GWWSJms
zsay6NIV73Fn|3V#wFBe1c5sPyhc+p2h%&`Di#7>?+MHZFxa2Q=mHu$4Qu+h99su=a
zpnV6c>)|sll}dg9m+N=!H-gG;uo_St-w2-us+Yj&?WX<4%X1_@fa{fO_M1U%YEau3
zoCdDjZ@j!!@&ngTE=jOCckDNEn{tVEeQglnj%SfqdcnZJJ)KMD(ss!YptIUQ>}y-O
z1a8mde!#tzOSJpX0)<=KxgT`@QLq5z1+J;!dP0e-ltr9dhE)cn?$&qi2Ov36n&A4v
zBFt^iDsOhh{{Q6%45ExB5)PlI@_^$Eq~=lrgD|LGgSM67Wz`FL*|+BA;Ce#TJO)Hd
zUIoolA@-3=%>}j7UdT&<_HHtmE873(uv7vaTqLkrL4kq8ib?i`!vUs#1t+cPwhRp1
z3s@Yuqu3a^6<A_96xkWMZATtGc|igLw=EkuTtH<8x78F`4k@NsP&k43ppIp8<N^r}
z2BuhUE2df8R!lQNbhAT(#T82q3vPuH#s;edDQ*WA$<vMvTpYG+ve%<HIY4qR7#$cc
zTS~p?khH%G5`&r9A!)yrI~HMQhot>f?p<tfJ3A!pbGf6~9A7vbU;vrdA!#4Vy^C!w
zl73z8D7HqJJV<Saq&+Y9LWmg<zTH!>9tOEz9g=oexp%SMMd-I%%N@mb5J`VyhooIE
zn*LO<9tOE8sCmBJ3n6X*+1(*&rwWy~0?BhbvN^tBkTU?80g<<T%Ap7nll^tYile1N
z()KLKFCaI7?Cy}XUCLp_cJKv*>@FxD+5UqalD4T3Gi5>cH+D$cqS<e&%I(P3_<}(e
zWPc-6E!=)6p94gL+}9y#bC!D{Bn%+#vsuca2+}VDvfmM6mdpmI`yD$ZZBjWDLGF_Q
z*$<L;e8C`7015+;c_4FNFvxg-^nuKS_*DjM{}n5ar5%#iPq`gg7+)|*gZvNT!~M@8
z#dfem(t0UK?+XU$U7+ycc4Pyoh1q`)VxDvdD2yQCV~y;8kbbEDr9u8b2yu@z*nW_D
zC?Dqk#tum<H2+(H>_7N|K?>x5Q1~^zV32~@594=$%mMiiM89B=g8BbohoqG%2RQts
z!1hDg8X$jw?1%C>IIP$lLE+UQX?gUDB1g*$2FY6pdC3zTR&0$R^C9XbVfG&c`TGTf
zWCti5K>8tJB?+@16d#Q*7$jlg4-GF#xc@==UNA_){0~y^_<}*=11JrE?1%VA;si(?
z)O<%|^PuuCpz@6%`UQgo%zhXjY(FTzA#p7Mw*QJ1$FUAcb7=gFgW?~=M~i=RX!whR
z;vd9je8C_N_CF|nK>RBX4u2@$@dbl8*nT8F%>HAbaD2fat^p12gB*;Yv@6a5au>+I
z9g=3q@efKb2VXFVT>#}tkUYdbF|hqee6amczT*o9F|hqee6amU{1c#X1Ept3e2RhX
zNAN{I!0dzMEm4^Lp!9a|1%oKeei$ESKZxJ>f<Y8)Kf?c_9w2)_=?CI|QLz0W_dw0h
z0EG)w-th&42rT|V=7IPi^#`Hq8(%Pp!0ZR5ClDXme#aLKq76|0Ed_<^3kDI8{h;&>
zQx8hdU_MCQ3kDGmko!RHg`^*0ko|L!_#pcmLFor7zXBA0AbE&?gkk9)l-?R&FbISF
z5AqMl+!qYO;P40Qw*r;5!WtlRkmNH!=0MYT;|m5Mko|W-@*wdS3__sv56XX_`~fl_
zY#ul~tUzU>&<k!yHdy#LzF-i7*$?tBh>uVYF6)Ir{(<=)WFN@?AU?=^#}^EOFF<7g
z$b6{%F!zGeBiKBs`(b<sC?Bd{2o(NE?iB=uKgfL``NkIvf*GKANB9@c2Zf*G3kCtW
z|3T)yU=RSg7o;C5F9`DwD197!!5{z*e^B^B;#&abe~|jd7YqU*`$6${3@Q)H|Ia%l
z^`ZHnAC&(=e0cu9V#NXCL-Ra8DE}V=m76aZ_`&H98vh4hFz|!ZAC%wtf`K1wKN278
zUL-!qKcMgi#Sch5IQ*gVjxQMa!2U<#gVY~H@cEI=b9}+T?*NJ?Xn2D74WM*~q`m@_
z&Oz}BDR1~rfWiTq-w(cE-~;D>ggh_E{#YbF$bPVULFw!T125SBAbBVs?0+b~@dX1f
z*#Ag;uzQjC$mW66AAq?JM89C*0oe~q|IqZs15yu)e<+_9Y#t)Mc|h?GN^dZEQ2KL3
zl3xJ|52$||Uoe2oV_^izgT!Aj@WA}v$iWE8PuyVpLE#6H=LXpiHXoF3UoddP{SW2C
z{0~i!++hEM^n>E%1p_xY{Xz5d!50i*^FZMVQxEe$h~M~vfeUOuR6U3fvi~61z2NeL
z3+x|gcsjmd-~#y{6h2V>++hDB$%E8m=!d$`@dX1nEPcTAgZPXH`?(81=^n}l*#`=L
zn0+8VDE)!>(Dcj+_CLseNceGr)WgEB@dX1X$Uh+e!_>q54+&2$2B>|Y_-uT^zyU7*
zK>i1%+ZPO+pzs9ihlDQ&sQyPbzX4P}L){C~4^j_yA0&Oj%{vAuUpT<=4+;+mpB)_j
zNPLic!TAp&&jI!iNFI{@*+Jp&2;xKK!Qqd@2ZbjnJ%Z|g#}^Fj;PMnC4{<;H0gyhB
zdm-V)2DTrG54In{X9wGl#0Q0cBh);Q`Jns{3Lj8>9(=*T2J%0+`~%gqFBsV1?uCR0
zJ1D$C;Rh`**+K3F$3Mh9?8x!o2s004Kg9iPpz<H2A6mY%f&7om2bl-rgW8KA{UG~5
z@d0ulh!2tnxfhfk9A7Z7!2A#6!~75Bv%>rjN*@PbFtC9A11kR@>4z0$Kgc{sC?9S<
z#Jwz_^aPRz>2G|&zyb?@nE4>}Ape8-jV~COLFz&72l)@=K8`Dj97_@Dn;D+|AmPaZ
z3xAOLAoUf{_=TFsG6N}ngXBTsfowj=eq=r<{9$~MdqD9C3O|s0Kzva6gZNPUn0J8e
zLzH*S4xoGk3Ll97nHfOgf{<qdr$>-~K<;|MzzlaUlwSZc4;0@Z`UL|MDEz_pfy{Zq
zzz7R}Q2KFv!N3Fxe{gz)s^0+$7m$8PeqjWKCn)?u@qh3I10y*65&4?|9REmsSp0*`
zZv^e(0i{cjc_8`)10%@);Pegh=L^s}(}iqvLG61eALL$;{BtNDTK{u$bV%Ai1dGYb
z|A+OnJ0$H-!o~qQB<&Z1<q>^+keeBi)Fy(;8YI3WIFBLJYl8Z!p#F4+q&+7n9AIie
z`Z^@-ULxe}PJ+V=uGelOs2>Z_Yc~-bcThQ~-a;h#KyX+<<vS$pEJ1xJs9s5MxI^VY
zV<jLAnzt~&$E;u?%%}u9vluisT71b)u=t{#V(|q#!{YOHj>YHf0*lYuB^IBtD=a>3
z*I0bYZesCCyM@Ik>^2r32cJEB5p<R_=&WP@0D)sX2L$AsKQ{(|&S5c;Vc6IFrvY@|
z?t<n&3ZS!07d8J;+yJ_VtNBlJkckX~9rvFZ4KEm&9)Z?`g6uc{WA6yMGXu0f0(AFY
zfDMxaXg$zXCSeBd4knrX4N6_g4Gj$6C-8vy9CI0zDolhKxn3|ZWSGb>NI1tZD73dI
zSb)ac+S|bArZSn|wO{!9%lb~xI1y;Ca_}LWgJ7{AyTRwuf%w6f>;!`^+9?KKurmxk
zZ|4|%&Mq+ctX*R88N0&Z({_!)r|c#MpR`*Te8O&H@Nv6?!C1}}H@|1|5M;mk9Q)tb
z8)WP+&zJtu{=nYWM23Ma;3xz5{4Wy;1_`j;-*!rx>|_A%b?=`KJ4Z?md>^%m1VaPJ
z{h+niV6|V?fcH!AEEnPe-GRZgM~DS<?g}Wpc=kZ<@xAef>j%#sAs&}129?+UcRn<c
zU|`}&5V#InGXOFRY|fAM7eRYt+UMJegTe~5))q9*+5CAfcu&LSKk`5N8xlNBgc+VR
zf3`gjQq%l-F6jI*CKF+X2hE@Dr-JN!Aul@@6lUiC?HSu&%>|8NGJ)pI7;vA@F2TUS
zRKdW&dgA~8e<}<N>>LaX95+DgbR3Q|R5+Yus4_ocyAZTD3+&Es+a7}UkAv1Gwa>Q&
z?ThgOok#C+6ud_ja$ee(b&*%?Wu7OWw0#QNw*m4u=&q&L|F^%)K49}R`-H6|_gtn}
z(49`ncWgoDD*aEsWBc0tzU|TEJGL*C8yF6N)}CeGv1K&BWBc^Vb1s4GJGPw44Ga#T
zd7SJ!wt~tN7(QP4FMmJ#j;*4J41<AE0~bT~9a~N128IXblNngD@7r2}%mBGF`@U@?
z59r*G!!{o|n3>$N@7rc7KVV1zt=G%GW7}wc$M$9RecM9w`?jyM@7Q)KH#9S5AGi6K
zec9G9`--h&_5oYZ?8~-+*>`Odv+vthX5X=$n0>%@CeHx@(A_2rUw_^86BJ%NcOYlY
z?m1z96l5<*%w#7+#Dyy9AGa;JA3(xyVWY`%2Jo47COaW_b|T4nUZ|1+uQfN>$q)n5
zk0d8}p-K`a7l$gh;O2!Yi615_7+OH~nk;2#yYZa+!A%bC2cY$^Cfp3*ec%xL7dwL1
zSAo=l&dvmx0~HtKkYVx!i_0)MBg7Xy1f_NEW+vwg$<jZ15-egtYB;r-I6IXg_nm_E
ze_3_WM2dmyg}l5fNZ$Fr?Q7>dwl6{RFQB~E|G@k$C_RJjasj1JkomCm1x{OMY(9d`
z`L;<Bw00U~M*DnAUJe;1Ur^ctyIGpa#bgzDzx=|RUfd5}f8F;Ml&(N(!C?xLmtp{y
zDIouY^5N^R`<9xlW&qy{0x}<D@6BxP2OQi?QLn!()V#3_y8auq4h^J#Dda8yP`H84
zi+lZbpXyajj-}3bY(9hRxjaYuH>V9#O!6I@&zwA5G9dH#8w4QdVSe3v7Np0NgMsO-
z#D4I)M36kl9U!}3f8E<_BE`_cxgf}6DhC6D$sL9UP6ieZ(46K)4hi|<JGS6;gEu+2
zf0*zvFqogTUueR|z+uAApkN}v;9w%i06r6jgOe%t_1FDdL1#$rZBW_(au?Vhh<Gc=
zZ`>1@<oh2e?*PehPh^s5p08X4%7>R@Aa^lwH?YWDZUEoi!?l-3!GVJpa^Dijtq}9~
zfbOeT0_lGtFVAbj!@vfz<Msayi987cmpEjZe87JCvaAu5|BLU~F@n@yoFxsuGZ`%R
zb@y7(87~lVDY&@FO$LtFUw4;+(l$g+5?QX`_1E3DFgXq(Ch)zsAoEOaGE8{=ZSzIA
z91n_I$LnvKXM*H{p>6@`0lC@aCPRaX6ayRh9tJ5!w%1>G)q>Q4><0T66z@`upml<v
zyzFYi1Kw{APRG4X3SQj(;Cms#ZVbL@`w?{KAS8@-zBS=tU;*s`1)0^_Vq41H2UZI^
zOJ?EguX|EK`3EG=0m@gb&^v3s?lA?q4J^(MzL#;~>#sX~O{5r9K>38DMq>e}jDI07
z_!pL6z;=FF!U)M{(oaEpU&sq?HIZQq0htBPN1*!j+v=I-H*LUaseQgtD`-t<z)^+-
zP+bFZi_1xd3Ru{@{=9Fii3CFds2=3mBLqHE2y{*#xE^C+igvieP{XrFh{I$XLxRH{
zhB}@-pn8sh$)%J*C1DSP66pRc&|22l|JN8MEMQOo)pM7(Nc_0GS@J`|76y&W`=wqa
zY-Z2`xhG*igO14_28V>b40`+u0^<DBg+OO7G3~o!f7jfSfoa|Xg)E)~fjgI{O8iLJ
z%8+n*s^pJ^Jq&3HTN#orPnG%ss^1c}GNdGIVaQ0>%#f9^pCKn<FGC*B9wEL9dn7=0
ztN>`QkH<}hf(v^jL3|+&PNt{}d!&BwEEN(1`T6y?4I6p(2#M@(&<EZ5De*#{-xe0W
z=BI3rBEoQ`AgpX@pRfNHbf<;G8HNgn(+pK0b3ow@DwmW!7#LoES$NVsO5|Yi0h^D-
z2W-J>a7|<sR6zNy_<*e-D2<t)wE38R$L8ln8R>_hc!Sn$3t#_VdGNw>=?~d=Y(145
zxD>hPGQ}jHvH6&N$2JfY7TI@fBhByFDrVocbxb~O%WWdhAi?V*P|WKhP{Kc1C}sW6
z_`Cd5gi=}_C^&%b-2u4^<i6LR_k-_=nctvT0J0BMcV^$Q1@ET@w{19?qCj~7toGYl
zO_Sve2_}mf!2AC|WvBTu`-LW43<99_wV=DdLFc-)H#k~=%m?3f_ieu+s7&VW0;l&I
zAUhCp`+kDT1hAM46XaeH(EWJd_MHTYd*88TY;M&v1<AK8NJs#+Cj+dQL2LIHzW%mG
zkb{{i@`XGPXdQrrasz_`$lb~fTno9|nA~2-%avvygRDUYyW{iTrzTPiDTupXxu=@Q
zFoMr5ayZVAf!cOinu%z;=!AmmJCCCb2_QFt+zt+l&wHMltYVPLK4HrVZ@X|ZMZW&O
ztPs?8;Rd%`>_P37r;O<m2a@mD9tGV&eSHp>!1ei{_K3|#P*_9TDU8rKlr#smJy@8c
zl^YlmK<yGxy9Ly?0kv5`c7xk3a~PPi@7Nle-?2TKeaF@k)NTN`Mef)-n(SnVGm+t7
z%D!tW2#PmQdI7ul>xQQ$%NbliVF_+KK=0QAwI5!8-LMv<79xjK#_nW@di`|+y!-{V
zQ9y10sfC(p3vExxnXF_0pXUcl6QDN5O-=3xp!yfot}x+cU@_riFf-w2cmOg394F9y
z;~;xsZ49WmFX+x|u(%9U0FruH4p99Ix?>AeMoKfeK-6yp)$dVU+)VQA4-~;|CXgPG
z8%=gGq`m&S5xzeQls}Q=QeJ=ESPI%>1hvZ<qz5E#vWp?<_1BHIFu5ytxCBggF@Wy2
zT?i6;{dFVjm1Iti>wmZ<IPNpWaQtD4=cs3jF_GtB>YlH5A5tc>f$jxl;L>FhY_eC-
zxKIz;TagAj|5<_~8&vPA^@Gar3(3+yLG=L_Ka&8c{lvx0<lK{>3b|(&lpj9t$c2>U
zvfy)<VEsO2mIVyv_ZY$b4A8wXFt@+{yg3$h?ghwCCK3!Opz<6f_xkf@UGrOZ6N8V~
zGX@{BgRUR8YlN8xzX#~sf?7}*fb@g)eOr4H#s}{`wBdrRnYU+F0M&6|HNUq_1f6FQ
ze8}!0Xq|ZQ5qn;kxgh&Zr0o9}pJD``uWZ7lk_Wo)M&S?xgUK=B#^R%P9~JhT|8KIC
zkq6|D;=}fW#jtyEj@w;){dF_A-3)RMsBY{@NC5A%xR5UW0c1AV{;%6X`>(-!LAYC)
z=7ZK3at1Tax%~hBhw1-8=eR=F2VVX!CEwnV&~f`e_mBAx6e>(488(6Z1~FqPcwYv{
z9x(sgKJdO=5Fg@i?gIX1p$4$r|GiT|ebKHo1qD#KF#mx9_)bdDeVrzfjNtPI!0Ntk
zY6Q6vWX215xmJ+-LE!=lqwn(>7$E(3M)3KEp#D3k&yC(EcaCRB`21gx!#Rc_3Diyo
zt*yWQKt}%ZXQ>y-@eE1H!3+rj#!LZx2?8Q*4GI>{@eCI8A1JI!c3=SAz2lVZz+jc^
zz+m%&f$>2?4TIg}2NU>SFbKb5U=Z12Hif}}Z$9)ct|{=lxD*%|7(OsCFu!47V3lBC
zU^QW2V86k@!10BFfm0_Tfx!Y29vlG)2@F=CeJlO*6a*3y7;Ik1%Y)WxxtYi?G$qu4
z&VEv02(V|G06GUYp@u=pM24X)p$6P`S&>k~pa!n1YZ#0`XB;HdFc|QE5V&)BvcwOb
zVj+RclO=!f)Ch_36blJmo-Fkv_z#1_<@pjnc<O~XF3*?zk&wV($5SuFb$PxNh^>*3
zz@U|ozyNZe9#6552v5Bb4^NE{ANU+joc(>fM1Bv*-IDxX;JdWr`2z%G_#X%egYI_y
zR4mBBA0)sAs#EwM3CMu%sWA~|aA=;a;9w%m;L$u;rND$8?0ycO140ZucZ8UD4hXTl
zU|?b3IUvO5{D(o~^Biso=g$mUpNhEzxF<6OJO5$O`8<b{!}%$L8OS{6&kTB>ia8jd
zat5HgzM<kqpu2CO;wB*XK*cS%TbW!x6$?u^|6#EDJV!_XDsBUEFI2sq^A`q%Pg8^?
zpmItev$#O^e_>GJStKC(X^J2RR|!*y^JfONPg{iqKyo|_1Vq4krZR={ECI0vIk>hk
zh43sB5apW66w)=>P8H-|hb;^i4x1UQKx$#;I&5LEftl&BnZXWZo>?)2!~V&($3b_`
z^8XMJ=Km!i19CUa&HR4^gh6iRe<dISayS1AP+V|J@c$E#_%ww}fO`s42>%-a8UAkq
zlAtgHpY8At<Sq^du-pfbdSS?!51&BdLJ&P)K;nWNAoZa94O(w%vYo*JwBDP0CbS*>
zZRJ}~I~SBU_cz#-g6amIJ3<U5GNAOW0FKK58>R^+5)2w9I~fFcjtjAv+=BG`c#aFP
zInQTM;JGiv;XI!~iRZo$m-BoE6`uP-JkE0%)L#Ewbdcwc5Z{GA5<e1Z7%VRQk^GU6
z&R~~N!(esckJJy)dgO!}1{>!;3<l8jVT6=EOhA5he#&46jXN`>^kIRNKCD1t4+=Nu
zKMXcV>B9jjeK^6w+W9ks3n;8X>R-r9?{)se;D(g;B|+f=O8X#l_=5ykL1yqPK*Et<
zNkAB+&qRhnsjH^3i{C^*p5IJB=JS7H36S}qa*5wUKps?1f!6c$TM5X3#6W9k_thwB
z@oNak@N0qYu@~e3$@f2NWa2k~#=VgM_?$A3UjvNULFd^EPf7sa+dQi+Md8G?dI>@E
z|Movk#6aUUc7^8G?FvnHFmS-{<NLB=C#W9U-=MI-`@UTvXs-p&ej)JPNuaU{R7Sm!
z7ySz=pUmgj)nA??{h_~QemvMr83rTJzC#mv1`g0Vb+BC1e07lA3wimYCJ=eh-7%p1
z!k9p1D(L=Ic$q3MZkz1DV22cr@*w|#!V#?ufrKZb4DslmtTGF4{Qn{^{y}$*^E(L$
z^ScR%@H>FwPgnw$PWW9wd_fLSSUZ1aPy*#4keu@$1_e;M0>!cO9|jdr8i1-%<DSeE
z(=|ug3F1d#34Sk7ya|EJGJYS3dHj9?B2e{ONM>pvnW=+hrXIvhC6NCeKx&*nGdO|V
z0kz)+q}KThgB!?9ka^C*3|7uD4B)g6R~Lhn=7SmRKzc#t&A!QsptbNu16<xPn1@5k
z8*n?|+d@%L{@M?_7gL@=0Mw5L^=Wwa3o(J}NKjuIG#2dqnL&YPvk(U;et0$uaXEix
zP~q7u#N+&*L5*j>5Fe-xOsHqD0M~)_3|64}?}fa8Z9+YR4Jf^u$TP6;ED&M<nai_4
zhy}Dym1ltv8@~r6fAV`l@+N41FDSqAHwg%vh%jh??yc`CQQTo7&tSyg0aD8?!QTan
zYc2th9Dff;jFW?Znt&8&%`AT(NRER6EH?opCoBOLp9B&Yg6Nq75*OqEiF5yAikk1B
z@B?iA43N061ph1~wR1pXf*kzw1SG-ge=<eRS5TM%QV%L?L1m5eWCn0O2C@@W-h$i@
zDsRE+|1ib$cPLnZ)bkWT(j`xk0CcQ=D<k&|CeS)_23VN@Di2=B^Y2ZlXRzZBfZ81d
z2^&y(z~3Omz&~GziN8UJg}*_F4K(%v%KxCe|3aQO7SyJ4j$trxj%P3erQy&2g#<u(
z-#M5;%Q=R@1e8ue=@?WFI>$3;@Oub|fcyY*JHMBJq;mv=nR7gY4#*E6_d5qO=y88$
ziqF1pR|u*{L4Ek_`*xM!`b(aHqxgVbBd8uLK43S|{JPynkbkld*e&D&)n~WtAon?Z
z+vAvh-)`mp2J5w;dJUAmKxxbSKj_{f>DG*T1`Y82^z)@&B*!o$y^!bKn;g%O0BVnd
z#&cdcTwnsVPeJWcuwEOc0#LtzzX39a4LTR?^{*X!`DY0=Ah-3A)q~1nkREWl|Ft8P
zzX4S($b1-Xw^u2GterMu*sf3jT0h;iJvM-W!-`GzvZCdO%X?)%a9D!&D>BZwtZ4P)
z@?N<YU_K*b$YllVn#+6TQ@A6Q7%uOXUj$lzeR;1uXss>Nb_EBJSwY+iEQ}473Qi`r
z_W!vTg4btjaXYZcHt$l90<Fd8U<8dJ$cuv9&~Mk|#O)9!JAE$$14ti-0*eFpUN%{7
z1r|r{z3j5wiX)V^3Toh9zye>l{aJyB;f16F6R7_KUhB@l<N%%z1+C>~U=;$1zhGc(
zg3>VlD+r%02|{xgL1>mw5Sr@{gl4w_)ABNJL2>bdf&CPee-^^$hMLF01ri6vCCF}W
zD?V_N0>vXJ9f0nr0J}|!DHf8BB+=556k0lxhNdHFXgZPxrz4OZ{dP_g(-j#Q!091s
zWTyvkSnp+*1*L(0g+u{R_`HyGU;xqJ@J3Dx4hI-6$4Z0N20-E#!e8`)fk_Lb{sjZm
zDhSOs3rs`gn_n=nL*tkUA}%k>3kv%e49vg4>f~kKLip_9H28vnMF}L%ZN<U>avui+
zyDT^{FfcH1NJTVkk78f~iC>PDKM3WsLHUcId_E|@8OoP~@>3e59F#!%FULyQaYwPu
zdcnXrfkT#Ec6t;86GDth03-%d2eSKeEQcjjtp&F&yKIA$gVgp&1~zUhwx|~ji~=Av
z+zu>KAoZ6WIApn_z~UWfW=KNB88&e51e>9BIZFEA_DBXUZYz*G7#cw4Opjt<0f}FB
z;IM_*$?yYY4oD1YK1^HzE)I1INdM(nj>-#C9H8|NQXscpj^+4yL5kxchZP%?&-wF$
z6epMu3KNi;1}O*d9u1Hk>z(9FLGFaP1H>l9OptkCa~H6H!U<;XqV-O4M?wCX9>u_M
zIZApF=nhN}AH;@-fxKKT$PW!t4g#P(BkP^yQbBgVkeB-kiXV{wU&zauLe*%2_?I0Z
z{^fRLk$NF7C(9wp3W-Zp@u?tjkb00_keQ$`g6NUm%Ds~n<km?b`O6L*pf#4az+oH9
zvGaly$3mpAtGpn^2@6}$9eA;qBQ<`m-U;^83(&fb)sgadFGpJZ0J)b;vji?jNrTJ+
z?J<&F9VvemWFE+EP`5{NN3q=k-FpX3N3d{+ydcHl2=S9#E6Bf4Hz13@1&Je@g``Io
z8V+19<Yk|N(gG+AypWg61+iiIkJdCZGcz*-OAEWU@7r951uQdZZ6CGG_xj9W;Pr<=
zL-_>*llgxo1<+nz&^iqM2Lki?8H5`8A0#M%&OqZ=5SZGxtbya!7XAk&A`EPNUxXS=
zL<Jc5MT9yof06tG+VjfyMabj!7w#{7Uxgw}L?sxwzcR`5eG&5Mf1tp@_dsZZi3kS+
z-xr}6eg}d1N9G@RVOGoyzF*8l-u^#dy-<Tv4g-VNe+C1y5(WjX`CRfKcYy3RD`wE(
z|02`?lH;m}i1R;y@Xh}VfX}1=@%jD;#9#g||AFs^Krm<@KB%1w(qsN#gac$2=#Cta
z-ACsixCIgi*#|l+7-ptYyLt)8p6mZ5IIhi?6v&>!AptrU<l1~miR>vH3fJaK2xQOa
z;86Z?KrVX<hlYs=<G<|r90DM>W;bv!WKZER$ezz(;q`~X0MwTUnXUX>^$O^0A4vO_
zfdLezFg7SI`4t4_@M{RfgU+A0{h$BCxBEOTpfP#Aa{?llrb_=c+iL&6ZB0W3-w6TX
zTU+@bFffShGLK>~;17k4na+ZbnaVIQF!nGoFg7qSFjg=yFcvT{FeWfCFoMn_iMiEq
zem?hnt~<v|4scxC&(Q)pKjC-?n7tItHaQ@1X{!8>Yx_Blf%qVH+kym+>;E~PbI<3J
z;WrQny|h*S!?mp(PW&bU@t}DlP*{Wfc>O=;TJC9FGF<za;=R5y7?^G4bO5=PZ@*B3
z@*4&QkeK-|1_gc{0Wt1SE>W=DHlYT7JpnQEp9~rxdC(qAn7H{j1`CiF*HwsGr2{Mp
zX4lvl__hf(n3dZ92kmbK$zQuKz+kqO8)DZsp$7AB3>+YFgg(_Pp!?52`at5`Um<D7
zM3jM#|Eo}gSv~m9Zid_cxo3g)W;acCn1mcZ*XMI2gU%NO-9y9up9{PX`Gve}>h(Ds
zilBRzx&L#`0iBI?eLja1NdASqtS)G;`wMwl+0XL@6x*LE1aL?)MNNKS0J<kzs{e_?
z1P)22&=(90An`D>QU*4VpSkvMiSjKFkTNS}U_s)GUAxA~!5zi~QpbcOE(+R@%5{|~
zl&gkIjPHPe*tKii5?tGu!a#mB+sXqEj~DWCq1>OjghA;Hl-`wl7#PeaGZ?_qyNR&<
ze^8zP$(c`Puz-mxB`_qI6|;fP*aqi0^T`YX2sza&=2I9rVERC5AC|Ywr!Xjh%mRt=
zD+ma~#pf_+fW*P+NJ&5#lx9Hphk)|pk@y1(K>3AVM<AZxKp+@&-ovG0`48rE1Q<Yl
zQn1?jLJj;T0x_VuOMVMT9_RkU6c5s8K1YNDrUsO6KzR!khoCgdZ-HVScnkohmS004
z=JFi*5Bw?u@gO@v{bq=H0s?R~I#4?eQ0;snFE467M+_9K82K4wKgb<?F9c%veh9?#
z%LsY!y%C7vmlulQml5*0{fGYpsGQ=L7m6{FXAsDiXHdwNXVBn#ATU2$p25IG-XJGi
zo}ohd5hs`Vf2I_WU$W&HER-L$v6=suXv>yoa4?Z)b7-EgkYFOu!O%P(G~U1pqN9{2
zv8kEQF-XjoVem+1U<iP@MY)Mh?S;JjS@St6naYjoY@l&PkeV0r@=ui;(~f~W0;&V}
z6$Ivk{C@jC_XmCrfyvzSx#oc5i9x6VW)_SF=>g#Y7KRB83=9ko%n;guDFV#bV0-|k
z85kOv92h1rurM?=@G&_sg7l1Hlo0qYpup$=5@D1FkqBJ>r~XfY41NewgV2G>vj0*4
z=Y!k>J`jBO?%g{O4Z`o=JwFGcAMkyUtN&vUy3ZI@Ba{cy|NkEZKJI(m2VwpH2h#V$
z4#LByA7o60&7Zn|P%}U}K<>5wA^(B@0s8@FP{IKz!i$+3*bneOkpBR44ai2~^n>*A
zKY&1xZPq*L|A5>8!u5ZwcQ7|FH-KbuSr3v2nE|mIq4)p4>OBzM`1K>3%Y1<S0sjXG
zWPiYX09g*1{T~PT0}eEZ0YBvb*yB+4AK5HqHpqUy0v-b%1HJ-s?f=;S`TXbeANz^5
zpZOp2KL$AlJBBibXN<>~+w33IfA~=Gzybk3RMda4e}L>xWHu<=D{K(yzrqF-2%uPD
zZUCht2n%;Avj1cM$3g}I!E6Q#4EO^y&5Ud*61)Ci{l5Y}2t;N>M8Kro2OFHuXJBA}
zxUhIm@f_<Npfp=kQ&R&<%ho$UVh~v*3$ZW{FnnP6!|<Qs|AGG>{{I2T`k((F{vY_y
z@Q2|81I}cGFo~IgpTVBtKl6Y7|Bysu|DXRq^M8i_4E7BC49p0Hm@HV%1GzT22jW@?
zncM^O5h!0_>V$~kF1k?VAv{b{{-6E7%5#NqSb5I=ocuXP42Y?dfdQ1;<SJw=WEkWa
z_z&<ukoh13;#tU8$XW1Puzz6wz)-;e;#Kf}V8<7QSPTcH1!Rmx30Mew_@Ra!C>?_p
zV<E8Xhr|FfiA5_|2w4p(8`TY9#kh$B3=bFz7%UiMAbw_$VX$B*V0b`G;sY7V%)rjT
z2i649Z^0nLz{kLjKk0!q!f^ouCd3zRaE)LFTLNE!jD>|v0UtQ`{4e0Mkdd+AD_~0i
zOA{a%8yFjy4}eNfP>SOJApb-D2dFFo`2}Pi0qqPRH6XPhJs`cH8i4%)s03y{05Y49
zeoEv~;~bd>F%>2P;h~bqc^6fNcpkzGP;4Q1G6kr7Y$ih72C4z7_Y}`5ZUDjR2Kx{4
zKbZG0&jG>WIn{d*^#L|B<YnyVSnsgjVgErMlwKb&9$-8GGM62cB7gAzk-Z~($MTN_
z&h`)g0r>|O1u!V{0CYo}{5gwv1vN0iiW>WO^5?MG4YCJ@vB?u9_5kEwuxlCkFd#^r
zxq%UsJ8>8W&SecCUo$+wgdlO|22kF_p&c#^&OG4u8YtdCr4ru*nF0&Y-C=Mw_!zKo
zK&`cL*W38aLY9M>ON<{N`atf7u&6=8?8j-A47k_>m6n+44_qdKic;Lc2ul6X_K!_L
zO~IeSJH>O#W$I*VWGbMU3DP3MWj}KRdjo%ie1m)g%%zyL{0I3Dxb!30FH->VO92Bk
zO+rfa0tS2`iqOvh(k;Va!~cW-2ZIfS2Wr>hcRzy+gAGFs!ym>w%yZaf_+(^cETH}d
z+X^ugMB?xONELF;QU9SHZac^g1u_*fpb`X!b_V$$_CG3+>K>5(0;Kk6fee24gYAd7
z7}W3tIpqN;{6M)HIVN!0|H1wTH2%S+fNaAQAvXTN;VonTNB$4U?@(-G|HB?<{3E*y
z=3YW#$nwZ+eEM<bUr_cyOL6el1Ek~ww@Z-i!Nmr}1xyZ^4HLsgW3>y5o3QBxi6PQI
zDC{AvCRp5q<gtYbNF0ViEsYAk0=B|`#sA9t%K4DsyyAa_-wGHi80`Pa|AVPVr%~+(
zxuHM?<aY=QL89w}@zK(|Mg52R4+RzoeFZWFHuXR1ai$+6`;l@HC>wyW48i<!p#DQa
z1)7cEoB(x$ML|XVhkBfyAh2IiY_5M${{U<^Toj}R=3jIgB!{LNLqA9!T_22(>Hoq%
zg(xFBpd5`m|3ZC<<YTalkoXW4F#FJH(AWknjp3p}YS8t;`TrRHVRV>5C7A^Sv{6)1
zVgErMXYZ+ir$DB_qM)GQLE(YohH{2Fh8l(%hB}6FhT?|80|gHX3czv81Gf*20Sa3}
z7!)FC+TdJJ54}RJ#;&feuCDxD@wwu2g?%6~bPU&k#(;z_h^&yQk*Sj@mnoi8c&Fe`
zK@DmxfTj)3MT&onI0KnVF#Uh1|AA@~B)_4D3EV<71|j>4=Tw4+l|X$vG_7DRTK)(5
z0i55_V-Tzu3xQ-mIKNdefZFfG*Z-in#g%T6#j#io7J`H^K9bn{X8{MGKmcLzpy~tm
z10V>t3=4st&OrRaK2SO=e+NpFHFgzpATcaj!9pOHgDi&G2eJ!<L3V@0Kyn~8V8vJn
zkQ}J%3u?d16o7PrbR&lxgpEZjSO^sU&~^f-4U5+DgQP;R8n9|i0@T;V?6;tbfYe~>
zgouEO8c_2Nqyy610rhvlJs!}A1gP!@RnamK)tDsMY=|>)l3+EMS{V?%oC2KYW6?&Y
z5Naqw$47`79Vga8`w#Zewy*pj`#<ph1Ef8O!w}>^!%`N2k|4M|z@Z&Q7+w~DO9H6L
z1lrHgv<FH8GRUrmq-zjaf!F=W4uIP)18oC=-2v8*v;WWVkMSQfc*KCY!TyK+4@hpo
zB$4gG#m4J?kPor6#G#=Cb}5eV2gL!-^a*n*$W5Tz>|uOl8gKm%%77pYGT;Zp4_s{l
zP&s5%0UF;1DMVn9RydZiu&^kwcwl+Jy1|~op251o@_+?sbj88~r~7fanP~SToWcMK
zzhclx(j3spJ1Ry}hLZ`>k5(6h!yc3hacV-6Ku&)kJrIn){z1|Xc0U&T!TAr7PLOq=
zvI(X?P#VM;6ATQ+f6D)W+Hc7HVVJ$BHeu&M{m%gIvwV<;mPPpe4=VFv7}WQGv61Ko
z=0A*ou-k|#3JGs?5}f}@&<{%KklGYcpR(iZe;~U6W;1HagN$GztHZ^H=m*)&2X1vh
zM&KZ#xbz^4LsX)ZQ2&GC9!vRytRGxMVQB?`#gP>vu^B%we_(GwiY*2^20I31K6?Z6
z2S%LzN925tkBwv{3e%3ko`D@@?2GXO;|FAu*c<E_>`?T;IC3)fGUaoM?-c$h!0A4i
zT0%6aEy4dl?t@K5g$-;z9y0&_fDbemjY~f?&w$Dqa2){4Z%`WEe}?!7a}))n5rjeJ
zqsKgi4~>720&EyM_5zYZatmY(0qi2Mew_6u$lsuJ3erzb`vc^55GGqcWS$A!jv~i?
z_5+|cGbq0?Fp#4k<Zc*-haWiHU@-_O|8T`0a`?gZlhA$vg&hck+(4For0^q4KO~VA
zfb7Rrm*Z=HAp4&j{mAWT;`M_<41^gNko^qx3MB1=q>(Vle+Z07HRS0B&8>n)2^qj+
z>(G<}O*N#AUm@JYz)<(2{txp!=04^=`@Z^rpZ`5>0Kw1a>i^l{tpDu))&Ki=;2{zO
zl~&07hX)@1dx&%V5jp;_g$1GU4_FX`{6Us}9O)MpmxSy`c0WQ7G7DV(;S4|I^oOhq
z!6u*|su1LVC=(VWP#UTqrT&IW6<|-lsOCV*ACUP7jL?s&78?(neuPO77Nm3o#UElO
z7c`q&+(2js7c}DzS;GPHAP9rfKZu5685wYXgxG^gf?N!0v4MO9D#>A^AF#e0jK<Un
z5&6&Xzu_@b>VFJcgH!OJ;PJo5{~i=TVci4l4G0DX2F4%Ee?T+UkPu*Q0L`_**vK>}
zH0m4dA(kSONcAsS^$(JM;>$lI2O#MO#UJuq6ew&7<sU>z#=rnkk4{3<FOrqWOnD2?
z?7bzp{Y8BL3!w{P8)@UW@(<)cfcm=pKjeRa(vO9OJZRpMfq?;(Vvt>koef&y1<?m1
zVSQub^utVrr4bMx!UnbRz!OlQBn@x>f#eBcP&*yDE+M2IT^^(#c{~PP9vdG#eai-)
zxP2gd0KDGdkL*9obA{&;z#ajOv0&2+65|6e9^_--W8>rFli{=A1Et4v%=6go`08Zd
zS)MEYm;4XBECQq$3x<RlWSs$wjg7{l6+?*e9P=D@3%&xG2bKpw`PK4(%mcmxb_?b?
zj9Axypc_!!fUE=6G-S1_RxvP8hC@SFts)=)|G#P#B^X=yQcLWA0|=658c64Va9<F?
z!e$b5xhH5?9s~a?06}~z_`q#l<oHBp|Nj7j<mpGa8o?sP{UDeB0~Y`g7JgTdFN^G7
zWH!j>|3845vE<ng(FM{EH3`{pBsM;m<JSo>1Y4Mb#1NqlVL?=rMnZIgOd}KjX9lg@
z#cL@(lR;|{|KnUCj@MYQBt$<x8wkjO-H%@l*diPR#C{x-P+@$gL-gZQfkzJEb_5Gt
zo}lW%m;U(b!4RWd!K(+R8lsnhkAeR`2tvI}GzHSb{~t7y26jU|QFg-YF5oNp2U^5h
z53&vtiXav#7@-Sd5~=n>T@9-4At8a}He|DKxd~xEf`v^jvRTM%h^s+5AS`4#WHxGQ
zK=2T@B3K~P&@r-E=xqEt(M>|-BlJR82$!L<P<5g5AUe@qMLZvp22ssK=b^d=iHFE_
zU>3SQLVQrk$^0K|9#}t^g(d&uGY8^+;{A)Rl9=$r<t~U`kSu});*o+O^$$KD;+I1T
zLo6W&aS6nA<dgVazyMxPkJoh2UKt871zJISYVbM@BuU7Bxa8&E+5fAsfvr1-(G@oK
z|K#7{(gWIW1ztY~S*=w7nnMGxxPtZ`Ve9w6%|cMq3e6x;pAR92n}wzgD;I1Q!d?^>
zRt*fW@lVha57<g}&?<J&*eJXo3?3uJr5{-ww3ny?w3?8F^}ERW5n~B(7I;l|{hj(b
zh>$_nfyxH?ACf~*$ODX^d398!a2`k{Xxs%nZiX>$4VgOxsex-iV}SIcj@gvoDZc}E
zKf&<>O#KMGpqWTeB!YIdp;-&(g2uaGF$WnFLFk9Dh#5Zw8E5yS{?GGspgpJ{{QO+~
zA3L10P9XJA3>qf1V6Xt~+Oha!@yGIx<sIue)^qG->}BMC@PB|xLlxtq*#F4?u>mjM
zg{*c5#kK{54TJn2cAO)>sAjPrkpEy)VS&1G78H0;jH())2TD0GF<fkzJa!tCMj#lZ
zAHo8WAk`od5RDDP#;?IEt{|(eKqD}aQ5*)yVgb;;CTx1aVrcWl80LXS)c)Ax3`O+u
zQ;?gfi9zEySjSz#j)xI28$o<nXd#P%#0g<Lnfg7|e+s~97MYD(A1J>-lSct;^bogd
zVq_qD*dTk)h*6KJh6G=OCi>w^e?ViY5DcleDlBXuyD)b!|G-uLfyQ8=TX!KFcr9db
zZ<N7sDlGIsyDh+Djtro(2tyf>0-$|+*f5dWDOL8LON3DaWC$bpBo7eFg&~C@gu#cw
zg~0`M##jRf6taUPk+2Pe1A_$v3j+&71ymhBR3(xk1_lOnb*v0b3``8H3>@IObA;L&
z1_y=$1_uTQh8nPW#Hr(N0GS5C2(v&eRP)#wApYQLU}s=JvDpIb(;6_zz`)VK$-u?H
z$H0l<J~;+OG?>^>-@wCwzQnwO!G!^YK_mkMJLn`ckc|!eAV(o#Q20V@1%)$ie}F;+
zf<fWJ-@w7Z$G`!GNQN;mfZY!=Q-eW(fq?<Hd5CZU9SninJW#wr?6m=z2M#}eEa3uD
zhe!voaOMDoGl~Pz)j{Hni2*%bLBbB?6L7i$`xN9~ew0{afQB(l9TNi^I9(Ak59B^Z
z1||j;2K?snGcbUB(7=EZZ>a8LWMF1sW#DAsZ$LkO1U(<&N>`}i0!pQjln*|t6e$D|
z@di!@3>*#o&^SR-1kG=Vc;jf`Y2a$$1m{dtb*ScXH1Ia?HgI84hw46%ogfUd9iMri
zbPtL(4hD9#cth9=N`D}A;2en&&LDdoz~vAq{oz&ziH`~f4{&*fTOBB+KrpDV$E^<4
zSGWNv=c8hfT962cMqnWZ2t<hBVu>(-U_F==VSv%-szIS@$Kc7}!QjDQ$H2+J$>7Og
z2hJs^Dh(Js8ax?18H_-u^)qlV2s5ZOs5H1VpdZU1!=MC)A`B7?5)2v)E(}f$&J4~B
zHfZt22F_tD3>>J|VDLbB3*<%t1{ehKSQyaLvj77Jxb}dR10a1M(?O*dhM^1`3|i1B
zLM^;50NKUCP!A3dLM}zv0*W=<b~7-52PYBAiC}?DL{$bVbzpwv0EdkNg95m|LsbW=
zXB-+F8=M+k8ax^T8WI{D8XOuF8RSrvF>rum3*uj75`D=4#5{%uh6Y9kHU<f(oem83
zXz^>u;0Ug#K<fAy7@=%Oj5Um~5>Jppk-?FnzJZYe22mYY-vB9v92n~0rZF^NnkNr;
zQ5-`e1IVu+jOpKcun!=i2nk0}jDdWPYA?jUFf$aPCSsb0Q0LH~*dW&c3L%i+(Zdg6
zI&z#Mvk@vFEQB101#%@unr>ib;9)Rea9}WC-~pXhffg4Kb08!vo?tXY6qQ7n12Y#@
z9>n8g5M)pQ`w|p}pmrNb6h?#CFboM9zlI<v^lflpzzjc--#{fBs8s|C?Rs!J1+ie}
zK<GLKMFxci5L9HaLt@uKq~RpQR#=*W(pb_x!aR_fFs#UcZeBe&Z$Zof)j1HB14drP
zr4Cd(!5zoIz<}yLXQ*#6!vz!qFpLNjkO;DA3=A^RG76M}kujw2i%`pql*3>-&5=O~
z+DAsHb7*j6aAI&_@L(ulNMHy6*N09FjtmZHX$uw(=rnrza%e~dLr^O4Y4Cyi7t<dO
z4G9ei4FL@S4IT|X4K58%4NeV?4UP@y_CmuC$sCYbnBi9kb~8v0<fA&ISVZ_0#KLBt
zPlGapJgDRXDS%>h^FZwcY~cbn4{VzPgB-NP!dC9W>K5cUgRr3%LMez3&`C`H!c>6r
zks`FM0LokF{R)^m5DkhCP`rR*2tAxZZibixG6gw@LLCOB92r0mRQHRZr9`L#C<Q8a
zLFFQ-%mvk3kU9&q{*VLLX|OsUL8I4O4h*1r4<ru?HBk8jY5{;!Hq=5WB?oQKgJh90
zx_KN7A`D8Px(lk0JnBDurv=2Hps*v>Bv8%C$Y2i+PiF>OG;N4{7Q>JPRs#z6B!(C?
zbqFpZC1NXgK_LafvJA>_^OPCj$ATjag0ev7IWj=XIn4CO2I|v+QvjqD35pd6hHA&4
z(Cr1e22ma%{0pkjL4Ji{41*XXz(NvW+aY#xV3cbhC2Sx9-2OyP2_QB$dm*J@07C|-
zEsK#dP;G<RirrqYwG7`FK<#J*hKOR4g#8QA18Q-@!UW-dh#WGBo?c)fi>wC3#ugu-
zI04BaW03n`W`Jm9Ib=2{Jv%Vif!lSM?KO}}NT?yF7fuF99D!ufG0d+Z8Z&<&RD<Lp
z<q@PrLdc-95HSH_nW0J|@j$gC#3cMB1jt?p2IV49$T4E6UqQV9NZB9&Zn2{G3E1GN
zSc1WT0g=iO;Q|RY!X(5C65!qusC;B&U}j*0^B{Q!q6V3?Xz*!pM;1V1Yc+&2V8^Hm
zA^mPp`T+I25w1laFR_4^_n`hXXxsvXL1P!F=7IX>AdDCf<6r=dN1%`Upqd97V*p{y
zaRx{q9z=reg@-!CeTZ@#)jW{fKp5seggTJhKp4CG5b99P1Gx=^VeUhy1Gy}OA%`Ic
zJRSkE6Z^O*%uY~y1ax*cNF@kk8z%&f>49oYP{<-i>>xe{iGeUA-azBFpm2e?4Rah5
zq7ELv4IB-iFaedNAX5++<USCFgbT=J5R4vgE?~cgfX5#p<DJ;!7i1O)!_31q9tIhY
zwSkT+gU0K)8~7S9#}iT2;U51(RR=N;(*HpXJq89;b-2g>P}RYD!<gfLsOmtm1~L<K
zJP}nLXj}>scj)1as*WG2H;jlg5DQfu$iE;=DEy#mu#9(Nn#a)qNzowN5ExY*$PXY4
z%OAMZf&2?8W6;M5G0lUdKlJ>8rVc(nP9T2a>WCjDLihpHYiD2pwGk2RYeZiUp^k?^
zh=CY&5c41{G*HgO)nA2}M_3)mRiOF`WEKeHGEag*g#lMj6uBR&LZmua{fGzw>?{Qa
z$mkz-S%fI0ZI9sNVnO_iOBNw6$)JYd;9)`H1Ju*P#K?PTAn}2z1|)*44rCRgoh`?}
z!2rS>3>pj(4eB6CC`QyGPyrkiXq1Nm-1djGmmoO^Mxtwi#0o?`_I3`)A3_*2S?K0K
z_@Lf|1AJ@`l)4-kKz&X*2GAHUdao6v2do3!vxf9%5b7ZD0UALdJbnN&38Eg<j)nLG
zLV{#aF(_w(L_jnu28kjtsC5P6foMqIR)ImGL68A*-xf#)h8-Go8HB*|e?knp7-K3R
zRfzb7#V%(2g499W42d_;SON$`Vh$vWj6tyi$|s=Kt0IFS0~a`i(c_7YfeYLQLT-(N
zY&JkP3W?3gAjhB#uB|~c2!RZC44?~<krXh%avi82fV*GI09OZ!U)=pmggQd~9+<t5
z5Q31P7CExpKx|lgCgeVtIzsM)jnEQuA50y@We^gZ`#^EV!oa{l$bFDf5HhleFZ^KU
z5po|)9mHi25}W%Nz@tor-3L=gDEt_}^GBe11T+o<u@`&47L@9d%OOVwRQG{WJScrb
zXwZn5Lj$&Y6_g4P=?c-;0_7v*dJCjZu0fFjG$!c+o=*YIsDS2F6dB?`l1P{zJeLoe
zffHd+XRu+g0p}4H26wdaQ&63$0v@>_6u+?ag5P}zC&)4=F}N~#G6XUtGAQ90AF^g}
zX<%uvhq$l78esr5UO^=us753dez5e1+kGHYAn6lSqakC|aU_U3WO)P|xgG?~KM~U|
zfq4ni?!fInkUCJV0HrG>1|0?^a0w0aw<SXwND_)c>4_MBK<ZV(;RmUQ2&;oy&j3-6
zKfNH&YgB;eOF(lQnDZJ844^R$5e6m(<Z&O={00eU>@y6=`2*6<A*>D(E}(J%5w8#y
zYC3?JM_3&sJP4~p4L?v!LrNFW$PThUKxGCrei=aH%lO9cL8TQa1R>=g_HizVe<40Z
zCy~=LDBVHIGY|`8DyRg4VVLU?G)NUhJ;WcN(hq&Sse-|P!GOVz!H~hA!JxsA!4Awf
z0I#w_n8W}cMF)+fE1=A(fogMzD0;09>4zYjfQ#+KfPhI2u?*-lVfGAFP-w-#g#=N}
zLme-H^e;g@IP`ukvMzk>Uj>E)ke?eA8HyNK7&sY(8B`fOv8=m6Rma^R;-Jvr$iT#a
zd6p6={V_7gGblo9A+#%U;0^<+1C=Qt44Qqwr4FQlqd|~CiNS?Ii9rx!1sO=5fuX(u
z7lg>8k}#7XrlQIr^B`#s)|Ld7vB<I@wmsP9xQ5t<=!WnH_lD?(*oL?U0&7(Nv+*+W
zf^;*28uk+|Y?v^C!NbGD!+?RIpdmrv0fUD}g@*@>(-EK$(80j)q2WQp2L=?*4+RAU
z1(-}hN5_f+0fvMLA3&xBBm{UcFfbT^jQs<dD1R{F!Gs4477hj+1q=)mz{;QoG&D3c
zd|;?>C~$CKVCd)w2vA^v%783wfXNgzG&B@26nGSXjD|QAWIo*076JkS77PpzCQO*{
zfWg7R!Jz`i5imf=7<h0PAY=+Sz|Mi_2?(eV5MW?{1_;Cp5PLcTkbUY=;86ey9guT8
zG9o}h1#;*IhK?I6Iyyiypg=5uD1*pYI5;?1K!U0P76t_k8zvOMI1eT~STF&`nJ{6(
zgajA|6j5*t3UQEAz~w+dKmc5Vfq^05M?k<2h=@YLiUkE4D+<8MJXQn<C@2JEOaLoZ
z2nbL}m@y#(%n?vP6axYZ3Jwkq3JT!Z0?`5>5wJ1_g%t$_E5L>^Ffb@6`~XEeL<US6
z7zjWm!3&nbVi3Xr++pG10GkD!)GX+jvEoEW2W00nC~6?_#=yW((7_>~;Lrduq@aVt
zfP(|BEMUS90Z{BPfI_k116-z{qv1mb%(NdI93V$SJXO%qQ2>`I=;)|`>tSF3xeJ8B
zt^_e)UH~~jK>#{@^n-x`;uerH2L%C;B!~%dD5yjR@d{?FSTUgi>d=CYjvpNzpi}^I
zXh#RgZQ%1L7z#Q-=^UyIB;3)_0g?I9(D0$50qX4^4Gj-K3PC1=^~`{It^?WV0!T`L
z1R^Nq3kXbr+)vUmVZng~6QC{tnFKew1DrmgG94#QtXMH)MhDa$ked;1133rMLI#B(
zBxghY12?*$qoDvEqTu`rN|+$yz-A%2Iv^kbnqWXOD{jDC0LoPXa1MwERrUiE(69h0
z0A*zd2Z&D_8o)_ZfCCgm793yz8X0F`02fjq+mSJ7r+@<_MI(d@I4U|ot56vjK;;fR
z78n>9DjFIZATk^r92FfMP-Wnh`2#9r;Njr#zyVZJK}-ZI11D3cX^;?QP+&+<P*8xl
z8nmnn>{L()H#9VWV+gF>KmZINUSMEgxUgcyiWOiP1_p)=CtwK)>;hPbLS;a41Xh_b
z1Dv)&Ap+9V&;W@!ke-GD4oDJXU;t%WL`Z-l0^(B!Sdj}hi-7^;07xMMl7W={5Gk-8
zuumBn7=8#SIDqqpgo1*CgMxwrXa)<CCZQxlf`EVkhk$?pBv~>r1T27<11hRk1b`t(
z08*@jA{kU(J2*HzfYt#FkQ&3lAp%r0fx`R&sPqSwy^sQuG(8ZHL8~@Maa-Ww0WuAo
z^1!uB1p`Au!-fe7AbTLS45*BU$U~h2s?iJ>phdj})NSCZ%>z<nBupp}NML~0Ob`yJ
zkh5T5fN%^v1QbB_fR#b(ABYUJ{(*2R911`cC4^((Pyh-82&V#+I}oNBAY=?YEI14h
zGT=%aq6b<TK{(LL2*QDe0fYmpgW+xiaUdlrD4M`nL4W~Tz=7(40A!8;1Ed%OB?^TA
zBn|^IM<IX#QgVSa1~P{OT<?HwVPJq2z+kQbcrOE($-uyX%t1;~3=9ea44@PW$t4N_
zNE`+M4TXvi3JFWVDIQcNzzh>m0Hrlhf@NS}0M}t4BPzg&+yLAlf~tfS-U?tv(2_zy
zKp|iOLkGMZ1v>|kX%!ei21AQ95XS*lNiZ;U6a)kmfJ+Ji4F!b?nA<?@s{(}rh#mtE
z1&|vAK=I4KAfW&fSAeZ(0oCx}`dtB(Sz$#Qgwp{jtDqcsfPgYOq(}pM0;UJTf$D*B
zAbP+YaDagB>jc&CFg*@n4pa}61JMKK!1OR6yA8sD>Va|~dcYi*9s>j9R0T2sQI48;
zL_}m{cx(ViO2vW&9~LZFumjZ01hq0?ZUeg-p@)Hi!NemX1EL31^k`Hp0H*`w)C+bs
zTn|_V)^b2jNCFC|>6!tlj5qL@@L)p636MRYL=N%}sI&*ADnynESb*d?aB_jUnt`Ff
z!{Y^{JOZUf3xNV~BM_V{5n0AT0V)3oD1c0ZIus-Ww-jOzR0d)Xj04isPykNh3<2P1
zgjN#ZyZ|x*nl(GX#U4lnB7Q*H9ymA@cocw&X>c?^d0;jJ149C=v<C@Hm@whO3UF;y
z^WsH@hK2?>^Fm5;XaNaQ2G5ZW2OK;C3<@q(2v{&MfH?{UC%~m810<Y4g$t-&1A7L_
zVbBOz5CAq9R4x600Fbc^3=0A@z@7*3AgxxYo`N4MX3SXe1ME|fBr5*TA;1VOjTk}G
zl8_d@kdTlNsJFxbZI%lO$q9j`0bzV45e^Y0urZ)wvw{JgZwIRXk>q8Rl(b|(<H-yL
z;Letih=d5lJO&FFF!%>{0w`U8x*L1~JWP<m5l9V&Fb`4-$_dCoTgNUg8X5u&2ziiu
z92gMtkkVg9NCs*jq({bs=083b78b~a38aDmHB&&{WRQD6l_m=hiad`H6ORD0ybKe}
zy%7B(B62KX?=nEc6YgJ#{YoMn;5Hotv>uibk`aRV7vf$aDKThxgZxv$pk$_{1PO15
zeuR36JfDDo0L1+uz5@dy{6KZK1ri_9p+v|-DtH7R9BIe|C@4S}yd{f)0h+22DpXYJ
zR8+tOL`=XUB)~vIB*X$5p(-I7p#G4GmkUJRz{4XzA)u?JrwGF50GD78Hi!f%R!~q7
zfK`eh76-UX1(F3}fe?!tix8;spwdG?;2*5B1d@kfSQiJ(Ltj`8D@7R?7+6@qhAY6@
zxDqN(PEk=#PAZ@#9%vVz1Sl<YaBx84hrz~)iHS!*!NCD)CWtS?#KhzTT51F`k4Hqs
zrH+LK8vhJ+4h{}ANb)vL4h}U=PEIiObxcf97l2*LU;~muk_Ykako3cx4(i51bbz~e
z3~>K~+Dq_09au#j1M<pp1py8gq(BF`pM^sJwls&q#>p=zD9FbF=01@9bs+aRfz4t7
zxgCU^KwG##d$pWES<(Tn9xMk^50wY|AEX2tULbx2h!1USfx^SV59Dcx`5>*x_Cb1k
z@J=%WD64`(*9F>(aB_0-2q^Gyae}%JY&3{~+UMky28vE6n7mU`Qc#eWmzx_@J;;9`
zJ7N9>xxWUaAMQS|tdo}w3wZkvSUvz@AISYSNbv(oilF=gEuR=5x)J_sYH|UUSsEzv
zQBi4d_kofgC=o*42U4#AHV_g%;Pir={vgdR1qEpOgY_6;>CXlfSRf3Q7tnxaM2K<7
zB<SobQ0hPy1G8<I?3|pSn@T`I0}2CJ{DTyL!T=V2OiWB5)o}F?`8s&|kWo?qH34D0
zXOJ|59Vn3On3zCLgqsibKLdjR1GwJ^jc*3fUNDe<SXfv<Srnw+#UmiY1*#sFU19kZ
zWWk$BAOK=Pa7+@&LI@i~g3|!VauA1sfdMQJN(4~8m79~36DSix`8h_QK!<WbdBDL2
zp8r7wQVl4+AoV9$5y&=J_<;nPKq&xGfH8nvHz@}s1Hn!z5)vv<|A0gw`XS*1;@5#P
zFf@Jhfb3Eb5D);{2jU=O1_lFA@x{Wy0qQD&^fDOvfGHTE6#|1`5eo;<&>hGKX#EE6
z)+;HAh(LPWkggSvfEcuW0BWoiFd*t9NPPm)4@yrEd5C^6A3RP7(GTW>&4=g*@ge<I
zM0*2LU&#mwLF-2k4+8-KaQzN(AEdvGT)%_dFC@eRP5%)0BHA<HK_Lc+{U8rR<>B=+
zq*IA#A3*qs`X9pQ5n|zh+7Ir8$}q`5+ba-xMEwup%L$;$^9aa5!w)LY!~*RRLijvF
zJSg%!LVQf%_yx6}I1Ctg;O#MpdPw+z`~%@5+5-?iBK#nHQ2Pkk{UAP4dIT8+!2%rM
z3JF{wgG4w)Q27EJ;0g{@po7z+fCeg`K?RjBpuqqu&>{I5jgQtC0CjUg*1|Dr@0fuB
zyr>H<%YdG^L49j*=7E*J0vhlF8JgdDgam8^Yy=7>=7Eg?r9m(QN<h*FBK{c|nArH_
z?Bw{^z_kGbgM<pKr2x?ZDhoknl9P=9G)fs5Kw=QSkq?6tr2c`G_aG;O%NuBZ7hnKo
z9uS6@2j(jv>Q_f486_npB^f10h&+#wfPjqv-2DtqE*b(g0-zEIEH9&=AOLbA2MZ*;
z8Q3`lz_ReZH3Ns8r-z599VCA<Fo2>MRDwgxdobUr&cOl37tjDF0a$s@01Hx>Jcj@S
za(%%7;v?$^^I`D;YG4UKq6DTNl;n`@2l0{hgZW7M1vpUkGpL~258@;12lJ8iGpHcx
zmr#)aRR-|%4l2zxAoUM4f7m*?d3gl|B{}T@hcAP@hlfWUsMPa^@Hs>{(Cp`cR$vf$
z5NYe=R|L}!;@ffBdw7EVuL2HRu=UXN0LlX3`VVYBL>`=^!RZ(3c8~y=&mn-C-$16L
zx?e)Y#iPK(#U&*IBnOL3Sa?7q2kZclypa#WK_ET@IEx|2FQ_f>2xLFBy~n`B4vIZ!
z`<6ohHNPvM@uBvC^n=|Gi(Hs{p!UP%q4vZ18Uo<VWrJvcGk}EP^)ZJ4NGTYD%~xS?
zbOd+4VEr#}5dxNnwm&Qc1Z0GSWWZBs5Ff(?z&uF*3Q_(;_=x@=gpVlyA@v`kJ^>qo
zRLCeKD5+?O=!D2Y`=4OGfKCvsegUT?JEZnID0$i-@i~Q5JXC}@!RCSp(9L;Z4B{{_
zFn}b5R6x^{Pyq&T{)gX6P!|;y<`)(f1uni}O5pShhYQeh4lXpx7!3ikL%{z3{|_G+
zL^!}SlNWfr4cRcTID?7=n8q!yKtNstzr30O0eK4o@(Fn588_iKpK;3y0{R{B%WpV<
zUw#_{0eSr4%eYN|fc_H%<Uin*XR^ibeg<O#^5*#6&tU!oul)=bH}K2bOu#R1S3p4i
z0e*RV{NcyoNWgw~0{VUMhd+Za0sVdi@=p+f{1=&l-~TZS2*?wNpI8FnlSaV&3<CZu
z*nr=CHTd%fLo<Q!=^^0${tEo|PiVj|KaoKGm_)$-$pqx55D4F?1j1)(1b+8V-GN_z
z8Ugb!5QyK41j6?!0sno!fZu&j@aI2969VPCA%6EW_7W)Hz46O4{3KAn9m21laTfma
zm2o!y@MAQYfj9gZ=irZj#u5+w`g8HeFXQq6{QBqMuYVYqci`8ri$8oBjS0vv$DcnK
zjq$gi7-tg*pXCJP3Dhr)IRyN#Lm+(^<E$T$+k&I)(GVC70qTYTq}-~7majEXx(ZSr
zF;Ch8kv{+_pP45?+d&7Q?SUzfb|dp77O*<zNsw}gc@m_)V4lPS5uXUD|ClF2%Yprn
z@`8EdAE^8bFwIm2Z71!Ame;qS_S}NnyB}Ik?T41vd!g$0LhHv{(0<f3h<llCLFKPO
z^<RM2L+7A$?H7o>wGjK6CqnJp1K~66fwtTCL;H8HUqRHrehH!LApT{#1@jLiyqG60
z0n0N_gt&uwBE&xCiI94PdEybMJT&|!Lfa1qVCo?4Ip&EFbD2&<+i#~J`j}2Z%wd`e
z_1`I|JEuUxndua?y*vdP-lw4coC<aC0jRkLAoegFXo0wA(i$+$bPO7fry%ZQngUH1
z2Vn66)prZ(j>8atGwp}gQ~M$5hiN~wU9%S&p0}XkSP6CKaj3tKL(Mr3wXXsi53gTC
z+*1n?XPyZ07xN^jd#WJ)YUW9MAnIPffzU^w?x=&hqYm0Wtb+Rg7Bu}-Ld;{@1NCnu
z)E$+Ocwnl8hEpZ9e^&`LcN&a_s@nr`AJZPFd6iJ}Z^6O~s{Ra2J=EW~VCF*8^_e*k
z_n(%5(0icaR0;J*B_y3Q3qtkXf}}I1X%KOysnGbI3U$v^Ncv-%3awwKLH)T0s_qt4
z{1!AkZ$aa68C3sXXn0jZ!jEwSBwsUbho-wJ5PvXkhlxYu`!rM^tld8qmVP1mooQ+e
z#D7zu`LY7)&&iPZWSR)2E1=<d8JZq0LBsDNG#yny<EsKHehV6ox1jF01r?8hhJOrH
zUkudWvC!~|fyPq|G`?e?_QCq4F;I8LK*K2p8a^>l_r*Z-UkubAv5@d!iiLz5Q!F&R
zVxj(ug}N^m>fTsrdWnU)GZyAPsJmjJ@fHhpM=aFeu~2u!LhX-*#%mnZ-Z-eeaZr2X
zp!UW=?Tv%l7Y7ZOIB2?xgXZrzXgI_{!!Zu(|2U|<aZvxqLGyPkH2mVA?udt`gLtTW
z;-Tpv9_p@mXu6Gux-TA@&f}r(jEA~29vVLJQ1`||-5U=Lr+BEl<Duad4|V?pX#B=Q
z-4zcFw|JO1)Iaf1|HVW76Aul~cxZekK;v@)R9ynpUkOluBtYGr0CjHy)O`t1cO^jW
zO@O*90UBNjF!Q12CPK|ig!(@b8g7YD`x2q%PJpI|WT?9mq2?w+<0}zn9yGlqLhVn4
z<X5IdsQ(h7_9sEjNrKv!1a(IeG+vUR?n#2iLlV>-Nl^bKLG4e1+MfiqKM87o64d@A
zsQpP$`;(ydCqw<03=O|zXgnrE%}a*)7aCv5P;-)@=A^*%L(NNpx<3UPFDX!SCqUhk
z0(EZ+)SW5N^pFDeR|?eL6sZ4Fp!TQ0^h5nK0qUL<Xu3&-x+4`DZmCdvQ=#cL73!~4
zsC}tWb5o(_rb5k2g_#HSPZ~6S(xCB^1~oqo8ZQ%I?t$jZ3DEFKgW8`4_16TbxoJ@U
zr$OD322&5sx9QM)nhte$Iy9Wpq2ZAZwI>5=emd0s>CkkY0d;Q%H2gE5_GduVWx(`9
z)n`J(Efea$OlbUNLd%Cts6R8I?#+anlLa+D6B=%rP=91V<1Z6xeiqa{Sx|pvLCw#C
zx<3o5KMNW@*-(44q3+CqsfUJh4on|ZJ{uZN+0b$(2bxc^q3+Fr%I84cl>?3U9GH1f
zdvl@g%!S&Y3-w<v)P1=yb<lXqgSsOR8ouRFemT_sa;Uv|&~h>l8t-|~_{@Wvn+Nqr
z9yCAYLDOA6)IIso_{oQcUp~}*`B3+j!|aFJGXZMO1ZenAfSNY}>h6h9b0<R0od}J0
z*f`}xXn0SA*#q@YJ~Z44pzbJy>d%GRn+tVEE;OAMLe&>S?S+j4<wC=u2<na^m^sk+
z%Y}wdE;Rmfq48D(l`n>>FNTJ9G1R<bsJ>DtzZ9AtOQHTRhK6?;G(DF={ZR&0Uk24*
z22B^aQ1_QZ-I)tb_o>kE*bmjWAL`!&Q2Gc|{s7c{M<DUQz+VGtcOB7z(65d{=)F*P
z9EFDa5okGe1mbSyNqZsc4xfS0N1)+y6rvB-E@V0YaUX*KM4o{k8h`s!!1@??q5gM(
z`e#419rzkz57QB7x;X&#_c2I#Fz}mz^)u~ngwVGj<}=-bwwI51X!wQt_-HaPcsTlm
zfO^QGe%^lm;eLuBHV6l}ILAACI0grM27|Z^Abx<SFPQfAcX5TSfdh#<J34!~f>kkq
z<vju%!L+k~K#;#PL;|GF)87TkgQyGfcLA#l4smqyff@i(=NIPh;~3%z76S1dU0mYB
z9DO`N>n=fjPru-hAc(PG{Rmqi<~sTKJA226_<$CGfYgInAllaz;{Jf(aIn7M$lwrH
z-*{ig0EoU|f47kM0RM2;APC<%$T8R>J|M^yD(?$Z4B8js;vDbl8W7~~3vmd@e7`V=
z`N6KPF7d8GLH<y4JpCc&IR*JUx;Q%qhr|cD2D^fT9qbMtN5A;s5XTTtf4_LJC!yv$
zd$>A##|Jt3xw}Fl0V?hn79Z^D3{oBp)*s*+<mMmb>*(j~3g$!o<>}|<59SBC1c7N!
zzmOnL_fT+1gWMY&;t3WHaQ2M%^mB0qEocFW2f6zAJ3EHJ)p`1PhIl%LfV=}y?-&yA
z?CJwf0wDDPAU-6m#QXR|&Yy&f2ZVwH2*!5}bM*uH9L5g-MJm)^KAwKwV8u{=fPZ+r
zo1-V#p3}SM#vWvycOz+*rj}XFRrZOIj8O&!cg02Z-`x1l7ipPptd{=&0JmY^7O(b<
z2vNb?JbJt-Kl_)vZ}pJf_sf4t7U#3{&wEaC>`q_T+Hz{SwN2jVqJL9<XfO5uY85YQ
z_A!tzsDACUri-&#GkUb`a^&TkZ?69BxHmic!C6V+I>k!&Ajbd?Pv>9_Lrt&~!`vau
z$AVphJRN=Fjr1(d3=H%v^z!oaQb7s=f{j2F161A+T|Us&7aTC&VZIOqR?WbWT9T}v
zYGDN0p#&9S`2X($L_9M+MK`~oC^bDZAF|et0U@50Qk<(>oLL37oPmKMxF9uI!P7;-
zwJbHS#K0JAZc=`JiEdhAW{z%oVrB`%c#v3rQA#RwGXX<VW`415dTM@dYDrNg0|SFo
zett=2Ub=#lbC^O(YFTD-s)B(*hJuD$PJTf_r6x9c3y{2riwiiQK>8IxcBZCSDdgps
zC?qO?tV~SGNmWS6EY9ZQg1E!i36i6Ioq`ks9D_nULCHHFQ81+DfwZJBq+}LD7!Yj?
zzNN(_3Tc@|#U%<wsk!-OsS5e!d8tKuP-7WF0(=#65o(fB6(A<T6nN$pmn7!oB$j06
z=PBf;L3Asq7Q^HXD$>%D4L|^5A&8%5fzCHJfbAxL$b)nssZT;vpO%KK-q64VA@AcD
z>=_R#Kq1;0!2D3hpb)4am>=v6R|MvR3J|Cs2tNR(9HQSb)Wy>uVgOh^AlS&;$ptI`
z<NNxDBKU5Ia@wE*;#(yDrKW(K3r(R06=|s{h6Y9`@}S^AmNzy+_HSy6F(?2b9t7(*
zMuZo%9#VjMhXGVJsTKq<aDgfh1=V7O<iwmDP+H0;NVGMmP_0nVP%YL}$S(jzAVeUs
zDBTFoGKR1iic*V9b4nnb#G-UlILi#qG6%Du2?vx9i!<`eb(27uCO0*&6yjcxcxF+d
zfo^_TYEe;U3M{{Y#B&oXbdw88i$N+u{JhfKM38`PZX$f^7+gFrKP9!8fgv%uAXC2t
zl%!QtK>CVvK{-%AEi*MIMKwhiBFMnN02PO-M2LgT0}JZr<R>DsF*v^$rxqpW=jj&Y
z7nLxSr6(5U=N9W1rze6e&`ZjM6e0SlIYs%Ex&_IZ8TrK}3=H}ynR)pLE<-_brfyPE
zW=cBLqpD!vF)-+;f_FtS=&KexfS6h!$1^Z6=xaF`=xaHsRzMZ#rxazDr8=lq=!0@Q
zSSeVgqldGnzG{jUC`uhe9CcMw6g(1(QgmH1i?bCpR7(|9lQW$vOHzx$r3eFqOPGtk
zvx`DBn!W%}kWPqXEXZI`c%)X86eWWEpj(umUjlJ3{KOv6)i+EG%+4+b28N8TJ_;fJ
zL7pN03c&%c&Yo_b&fr=YsoYB|%Fk7Bc2NlO_l1^!AX^w1oc#Sm6r3GH9HAASYB4w=
zg3i$cUjhYjl0vj<v4RUI1VH{&Emlx12D_4h0Ye;OEJIFlrh;lgfP!j@6*%rwiwjWr
zzNzVnL5`j-3c-%S3K{{<o*-FG1s@lvj@*J0kO-6qG8DWwkrC9+Q^?HAEXhnPNlj4z
zdrP%|iy=5Q(aF<4SfM;IucTN3(sED$Db|CO%%JcrN-a(;Doah#%}veCFRIi{%}asl
zvr_O)OwP#6OI0YyFHbE>O;N~COH(MzOoZ?iipw)gk~0*NN=r)e^FU>)7PwucrI4AY
z0JT~-qo5#Bw@fv~ic7WFN;L(N0l_UKYz_u_2~@vfb2nI%9+wtw05P0_fx#~ysU8B?
zYarKQ6<1IQ0#$~fS}-$DK{Z98I5jyxF9lLX1f_xsh|Iinh<12=2o7LKC8?*U$Au~m
zO6dxqln#~x`^X7e&w}+q5)W7sBo41Xo%2g`QoyxnQEDPI5}jQ@NmC;^KP6Q`)xe}e
z6XHcg%JvKZHK0J|fP4TpKgiz~Y&Zi0Lr`jAX=V{fCQ+dX>=%WSe1*j1lFYKil2nC~
zj8uh?0AHx*7#JA10*X?LixpghofXpZi@;&104g1!$%O%wUUG|z;?q(SOG=AU<CF9A
zN{aGxz~ay{3_|H9<|Sw3!<rpf<iVvHB=aKTo58?D-@s7c$iUD99Bd5nF20`e2zdpK
zvecqtP+hKC3=Roc@(d02bWu<>FseYtx-bqN222Tzh6FFzy`{xTx+R&psk+6P>4_zf
z1{G8qEDuT<x}d<(%}p&XP6QXBpzuM6XQzVNSRkLEiX+-*!Kpc^$t93*hP1z|z!_6D
zSx-T=n2Uj{L=O}}3eNd?X_@JzMc{@E7XyQHVonYyRz3Yf6bvmh81QBaXil_Ja7ism
zO$L<@B}It^3d*WEr8)|UB?<-=syP)_U{XiH(=!NEQRY<WD0un@DI}((6hZh91<(Lc
zO$PZ2fs=9)^RhuLzJi>@N*x6TF1Ve+C5c5P3IQ(8swoNuMfu4Js>K?rIVrF@T|qS`
zMFCNJ=Ts;-2DyW4^_&V&p$fIaG05En;tY^HxO#^u1=sHoCb)vnsQ|l>3)BIDc5uO!
z5ZF!~1=V7xpaRI(5VasH!a<!*M@XLs#7DT_IUrOuMIkk>B(<nmp(r&kB{i?AEWfl^
zAtyh-0G@HUw6qk$9fSNl{oEC_w5(u-pOr#rUS@7VPHHa5fD}+L5DElUh-Zv#K@0}4
zzd<a=Aa_%+kYkX$8H`~LVu1b2zz4n~fx{smvMo~?1QeVDLO}(ZM}VUOD28FKQV8*P
zRsi)gic3<96jDla3lu=gmAM!g+=EmNj6l^kDD)AS0i+)pLo8)raK@oNILN>XSv@v3
z$P7=%K(IPJkRMfZD!{aYLO^ghSQw-P6depf0UAX{ng}s?@(M~VPAvg<VRE50Rbm>*
zS0Vn+pvZwOp!Q73Nd=vw;Rq`EQW+R@6#RpYjUcp{2?K*;2&BK~77l8BGcZ6%28PhQ
z?ELaP1_sdB0mva9jzQoatv)D2gK9Q?m(--vbpO(lg3^)zP)iJ?ih%(vpO#saTb@{y
zs+*gcrwc8(Aky&s0qWa;)hJ{ZD?pVfsHW(Es#GLCNVW)El&7ZXDFo!CCKjhEloq5U
zmZXAw3AGRG9%wK??Qu3X2RGfp?ny2v)i23OicifeDar)3PLcJ2D|lT<O|A>d^<We7
z3rh4+WFXxu29UUaFev1}${_v)+h0_YjL;5NSCEn%p8^Uc1_m%cIX|yBKL^s_EKV)T
zOw3_mNH0n($jD5F*9Rc;)AI8mg)USds0Et|Zbd`gU6`6%iX&VR4VPqS$(fp>P@Y+m
zp-_^auaJ{jQj(LZ0BP?ifQkkMUnfl+h1|@%%-qskP-v^BDEK<TYCQ&6dq^R`Q8&ml
z*jYg}MK>w4M8ORj!wO;0YRS-2K?BtHR{+&dTrQ;rIjI$(!W-ma1y6qkm(&7q5mKVy
z464yJK;0fqg`(85OmMAcXbCR;85ne_3b+&$G?FzHobwARi!#$QN)(I?49#_o42(<_
zJW_MgQx#lNb8=FP6l_w!v_pDsg<eXkokC(>3cSonNi9pw$uCGPD%Rtos^fG)URF>D
zD9TSxEiTS4QczF`E=WyH0c|0M;ouTbYX!zr0Qm&294hCWn4FQS5S&?+%B7$HcOZhP
zfMCL9K@2Ry$U@K(2yC@#u`1M6My3V|z8+N|QPpA)iGtlq^O8aR)x;cRVFLwkC#Y!*
z3?M&)a!!Dwkshckt)SqVTbcuIyF)Xu6<DuF0H_kwfF?K9Voe=b(gW3~#j3?z3JQ*8
ziJ3W|E+#ZVLv*U<lq&c-aVaRc=jW$DWfWj#h!v<>@O6T@0(6RBKv8CHVo@ceDN>MF
zk^weGwOCIzMNc&aWKB*<YEd329zYEo1*j4v1<sIs4U+-8UjfvLQBd$stxU>KEJ{I@
zQ!R!&z%Rcf)k?uHU!l0P0MwyPO;G?9!3xm!B`9&`7eR!;wnN%V3TgSJc`2Y0(6O{6
zA0z>46ZvH3l~yQZrxxX<<|veBWF}`QlqZ7f>%^4Q6osTp1yH#GY9Mog{EY}bkbY<<
zu-FP3Qwj=@8UYjv1`42-1VjRs1r&S}GxHRDQ}ap@X%3XCNX1-S(BM*V&d<#S<vSQ3
zopwnrPA<v>kB7kZKy5=;3g<)RK@?n%lYf4RLUcfoXN{vzNR16BI_+ZNIusN@Jqk!a
zvbZ2MIWsLY6%u=J13X-F3KXJkKn-BK8k=N@vyqH&$t(sn1{E?=a|*zn36M&K{2~RY
zQn*3jZXJ@%=**zhVsIN0)LAL6EG|jSg==+<@C-p$j?8zh$ShF+m&d8#?3J0H2a7o_
zQ1)Yhw%M!{LW7+UsT4GjS(#d*kcP;}nR$?$0rmvAA~7=oR{^j}UJ+~{JULh?xPqFD
zFwZL3L0TfAdD(gS<#{k+9fbl&U0zaDsgRhSn3)Hyay&tr6O&6Ib(Uv<kAg;|j)I>K
zDEyog^O93@H0?n~`sIT&1tfVwGesi2Jb-oK;7tZ}Yhd*nIO`#$e^8bJhYuGh8Gtes
zxMPW&7eE;Z)Sm_o`NC>NunC#DiRr0&3O=503b~2tnaQBq6f}~jqfndy?%*b+Di~CN
zh6wez7+~guOaoa(OdV-z%*CZz3{Ie_;LHzpDZ~GNm%$7W4Qd2~Xb%R41cv{=LE;_^
z3~H(i{L|7v90s?<(i~9ZA|w?wD#pOz2_8Dhfe)|;XOxztfLnfG<qYA8MR}Qd=?p=o
zka0D~oE!yzP`l8>(Ga8}*u&At)Qo{4*u&A-!URm48X7S$1p6B6f+RrVU<ODrs6XrB
zXsioX2@wFxgLOdo>B-4f3L5Ut&YB8_rg}zth6<qC+Q7oVLO~-a6*QPuqTpPVUtA28
z)-}{rNXpDBEy>I&wt_btjr2@RbPe^=l1(796$}i;so?QJ=%9?DrLKW)dWu1cv8kmc
zSV=)*QD$*+e0pk0az<hi0|Tf@7hjN^8J|>|nUfL^NnyqDIhl}PW5~=ePAtewjtBSV
z<BL;EN+Cm`kiq(RsButj3=9m}si_6=i76@Z>8W|CMVX+6A!yP8-tGhEbeJ|+)?#2_
zD9KNb&q&Nm$$`#ffZCKGXJzK4q=H5&!TjQK1`wT5kjMbF7{mp&c46Icn0RJ>N^-ob
zUr10SbRH3^9$DNqID`R<dS`z>H&4hU80hRVNO&RX3l0GFBrweb&9cGGgEV{Np@Xzo
z%>m6SGB89nRnE-2`Fdf$^qxDXk`7+`|NlRDbF@>J{*3Dy>y!%3T_!5OPd&T!!0+>K
ze696gZoR#<vGevG%dkVypFOr(M1B<fxQ+FK<Rts1CF>>qXRnrtyLv0PQQ`*ssu_!!
znVf{0qZwTb^7pA2w(j$LvZ*JOr}psG|63jv?Tan>RNa~1aBt&3Yq4n?XWwC4u6kU^
z^x*7|CFe8MraYOQd2rrGuS@Uuxwl#Pt3KvGIQLk0&(*CeJPXg1ubGpo`%))AQk$vN
ztE6RB-m)jnF&kFi+3WcGO4-kjTg`&OTW8n>2E9wWzj}q?v0U9PMgkj{)lba$t!TeL
zvi|tK_k2%|J>dRqyQ2Tl)#Vf2Cvz=VWjmD|_<*@7Uqn+gor^E8Kz%z`tJ@|0KYG%N
z7BOlk)qHhw|3n?pdK+xPD?E4V=KHB!#Ub76lkb&faqYG#-?XCf&`CY_x9grwD$;2c
zX)?85wEx9IpO4HbE2PrA_c$3a9`f!kxbS28#N#=Ei`hc<8C;z7Lh{=CAc<=;*;GPP
zR|<ULGi?noRL~O0T2NrL`{EACB?rZJT)J>V&OC=B&~bIJx<|Rs{l3>TO*ZV=`f#?#
z3QHND%|}m0CHvi2<@MOH>vZ&-Q~u@2kBc+(@;_hOv}18ef783z_nZDyEKSaL7S~T`
zIZ+|9@Wbk&p5sg$QYn^iChYtFOF3CiV@W{H>w8UmU+(+4`1__~m7>QAD?U9g3f4ZQ
zZg=jLTH>6GZ99%D9yrAQ>Q?QwvkzX&eXaGcf0uW$g6%{4sv`0HU0lhvM;D!#u}si@
z2Ft#myz8V3xlM&-+@&>cmw#1esckVjwYu8jxXNUkdHc9TPwv~}ESr90jsUNZ&(SOU
zPTM(ci>%k2^Cz`VEB<u;YO8C%-sHGQ_ISBRh=bA}DD8pL9VpF#(i<qPfzlZ$je*h^
zC~bk#6(~)C(i12xfzlBu4S~`RDD8mK4Jgfk(hDf9fYJ#ljeybzC~bh!1t?8`(gP?h
zfYJdd4S?bw6!)Nb2gNxkzCm#fif2$9gW?wyx1e|h#VI&GXR@h);t>>wp!fsD9Vp&F
zaR!PnP+WoH2^2@5_yNTYC|*Eu0*Vh%T!7*M6bGOSy&0Gl7#Nrv7#Nrj5G+?2<XRdS
z4RslqC$}>&a2IX>@xe5R4H|dl;^qdG{DwxxCZ=ZQ7M6)g$tkI6=^2?>**Up+`2~eV
z#ieEC6_r&WRbUJ{j|7Ar7#Nrs^h=A2^m8(k^a~P=4C2j9^iy(D^oo&=Oag1cN`U4w
zKo}+oV#6>@3`z?!Ffa(h4xR(CB^Ve4eL#+YC=d)_U=Xa}U}OLZ2{14SHZU*<xp1(8
z`BDrFLLLkZLM;e+p$_m(7Z7<71_sa>N+K#C%@FfMG#D5}9FX`P3=ASINPLj~BS`!c
z3=AS~koX@M7(_J?d{F}i2GK1XOknp2FffSjU|<k^fF%Edfk8|G!57nDU=T|{;%6{0
zi0we)A7Ee*dx6CNz`!6bgW!uRFffQu-~e4?1NM;k3<d^qkb0;R@ed3P5-te$NO&+X
zNSSbOgWV^@z#wJ8z#yZ7;LB(*Fvy&NY6jivc7cIGRszA7RbXI{-2)A8F$M<N0}Kpu
z0UV%9Y8V*A7#QRt7#QSMAncRdz`!7n<X?FW1_t>JQ1wC#4Dve|7!;7gTcLx2LE#U=
zKG1R^r70Ys%c(%ekTEFDU|>)>fsj|az`&q%1&M!yfkC+j!B=izU{FCyPoR^6RFJ|?
zMS+1q1<8FX8Vn37Na;bvgMmRM0%4v?0t17}6eRu(1_o7dV1k36L6w7nK}`o5J|YYZ
zY6c7pY9<KvY8DI(YB5Os1O^7R6eNBI1B3b%X!wXRFsR>PV9?mW!3?%SjDbO82Lpp9
z3p9O;FfeFxFfeF7fy&D<FlfGDV9*jln5QMdz@Qa^#E)QL&_YU&S}zzFv_qig2{15d
zM=&sGZ$YTn-oe12!-0rT9RUUg1Eln7kio!U=)wWIwiX=!h8_$IMluNXMhXlJMjZ(A
zjV3TK7`;H^e_&uR-T@6SF$M<X0}KqN8#q80QGl*iVKCjnz+f)I!4CF+1_Oh+1OtQl
z2dMc{3=HN!7#J)rAovzH7#J*(?6*{4V6YNEm~SP)z+fE#Rqw*UV4c9gVABB&KN$uF
zn+XgIwgCwL+eR=j*l9rHLxh3B&VYfz4k>-uc`z{8Wgz@xSHQqvw*ZO1f`P&A1`_`P
z1B3k$sC^;~4E84&7#wU6@}M&?9SWd)AqED}%@K}02>Tr;FfcgYfx2ISfx+<s1B25Y
zguK%O1_tL3P`(fYgYypt2A4MozRL#&2G=Lh@DyWUaDBnR;I;)SFT%j!wu6De{Q#6N
z#K7Qwf`P&P2h=?R3=E)CY&?D--0#W2z~FrYnm;8N7`z`aF!;Pc$oqU?VDN?cSBQbZ
z_XGojp9;eLei{r6{;={}jDf-5gMq>S0#v^c1B3q!28IBn@+RN_14Cd9LO!s8fgx}X
z!hL}Y7#M<(%Bvs+28N&?(D;{NU;r(H3(i5rZ*TzvL+}cO{@@J^3?Ute@-$=u14C#G
zLOwKsfgwx;;r=iQ28J-C@*r#m14H;8X!@06U<g0Jzz}Hz<%=;eL^?1qL?$52i_BnP
zh~|OHOE54*3otOmut39KjDZ1ERK(0dxHo1214GOeg#MTt3=FY72!8AY28K8Wg!|$+
z7#QM^>Z7<F3=HuPpz=Zt4Dl}*7!oX?`h^%65*!#960ShQSA>Bf;RXXkVhBQgVgv(2
zk_W<lNdXKDX|VjM!oZLw!N8CPiw_|NhO`9?4CxjK{pk)24C!~E_6aaBq(5L_$Uv%(
zGc*_&GJFv7837ConHdQCG7A_OGQU90lVD)T{K3GGRRQITFfe2_Ffe4ZAl#qL!N8C`
z1!|rU14H%<28JA@@Bt--9Hj8c*}=e&+W@ssh=C!ugMlHh2C83-fg!Jffgv9${pM>h
zFchqS<|hXRhJp<Y427`zR*Zq6(1U@Ycn^mFxcpLLU?@Joz)*4nnjYO47)l;6FqE1=
z%@<-|D79c<D7ykJPhA)o%5E?)l$#*@S8l<;Q2qtszw#dp3>6hnz7Xh~cm{@w9Z>ZG
z3=9<q7#J!*?Ey&j#8B~pfuRzqzN^$=V5oF~+AqMsQ0c+IPzh^42{ABKb}%qhg+Sda
z#=uY&!N5=rOP?YP4AmSA4Am)6{Xz^3)fo&7)f*7@SMOk8sNq4luSS4@p>_^5e8m_T
zY8NmtG)q9kM~;D^S%HC}MFtw45)2G2AU-VqL>L%aW-u^x#BlI|!_$R<p(BBTp#v%Z
zc5Gl^=y(Ekj{pNh#|s9AE*^w=T>=aYJsr^eCdR<fGl7AjXA44o&khELz8O&W7BMjN
zEnr~iFM;yK7#R917#Jo<Ak<G#U|^U4OCO-Sd>R-SCW=7ig%}tnN-!`?>VbwIh&_RU
zVR8r5|3VB5lP54ROqqiSuPF-{7^WhH*Hi%phN%Hi^FZtf28O9f?wz`WfngdCLVlV6
z1H&{}egLr>7#ODAK$K_G9xyP>%7OY{ih*HP0RzMA3DEQ=!oV<l1_Q%fSa``WFw7NT
zU|0ZizX$`vf(Z-^OGP+%z~L{)z_3(;fnjM5)P5lbhNT4z49j5UhXMn`vKtHx%VFiY
z7z4xd8w?C9YM}lVV_*QC*1p;Ss$YPCVYLSX!|E4Mc@YMN)gKrbHt9g?7aazMO$H1M
zn_=aF2m{0B0tSXHu>5SozyNBxY=PA`ApQvkhOGfm^Nbi6wni{8Y~z9QB^VgC2{171
zN#WoG`=^0{VNV7F!+sMEeh{Bgfq`Ma1p~u@0BCqgFfbg5U|=|y0!<Gh3=9V|7#I%z
zfSM=3z;K9xf#DERf8dY-1H&O$`VnGaI8?#FaKr<e-c=YFjs!3;oQQ$g&nU;ha3X<$
z;p7rXdSR4eU^uygf#DR){UQtury>{_PM?6rmmCAb=?e@D7Zf;nLGEQRVqmzS!N72_
z04guSz;LmGf#K2#h<Tv)`K1dC3|D7B+xznv7_Kg0V7T@Gq5j$n28JgupzhOSV0iL@
zf#E5veh^?_c<R8w@cai<zYGJz3kC*;FK?jgH5eGad|+VsiWHw;Js23ig8C=W^5^Re
z28ORs5cS#D7Yq#F3=sTp77PsERiODpjDg|11_Q(Q21NS!-oe1|{RASszh7Wr`2Ge-
z{sRNUPXnlbB^VffS}-vDgw;m^3=BUPFfjaI11&#P7#RL<U|?hlf%4@T7?~m%7@1-1
zNdX2%<{J!*tg!l0ih+^!1p^}+B0V#*-C$tU`2zL79Rs7z4+chE1Gsw_buAbe4OO7w
zE5*QQsKLN!%m8(t2m_-r2Lq!ql6qqc21a8<`+(6ngMrb+2BF@>fq~Iv0yO;zF)*6U
zU|@7V0?i*%42<q47#O|&Ao$)442(G~Q1@9dF!nMqFwXh_<r^_D&icW?I2#sU5)6#9
zJs22g&p^0;_5udRIk5J)7z5*+9Sn?f_Q2zdan1n-#^o+h_en7@F85$yT#o3kGcFHc
zU|f!9Pctr$U|?Jht6u~d7?*c2FfQMKuy4Zw2F6V~2=g}?FfeYiK;k<vFm73Z;BQ&M
zz_|4Xg1?P{fpHrL5?_FUaT}sP#JEj@fpOabB>58zjN1_XdB$xY7#O#Gfy*=59$;Xy
zMN*&B!N8bX0GEfPY7r2{SQW&;!okES!vi_i7u0zMVbFN$|9^L3THb)vLNVw(dmE_y
z4Tu=q1qN5)3PC3DS&$(47>N86@ZBv83~UYzuEJ$V@-<-j|KblI`k6pW^&m{pRk{oe
zb0G3k;Im5^7?@!00I2~T-n|Db|L+y#el`Y1@Y)jw#@q@9#u683y}`l2SmMFJSOw~*
zgY<JTFfKp9z_^M7)EfX9#K5>pfPrz12!dbL!N6F30>NLSz`(eE3Y^ct0Nsz|4B2nQ
z<O1DC2HU6P1l?x^<GVrS-Js%bP<;+iaR=x=CP%2eBXqx)Bh(&8=sqh)sCq}Jen;rO
zFGr|;CkD{K6xdIr#7GW-(PS`iu@4S==K%12l6cVC6_8W@|Njp@F&DBQQ5Twj6(ISY
z@dqSdGwy)i`3TYh!eFC73<mJEKwuVlWF2ol{|UO;M}UFh2lT{lh&D{}50X5R`IrhZ
zMGy|dl*1+hDtEDo;}XMnK`u5u1kH!uWCYX835kdD0w@jLzgiB752kYHzTI-@zR_~%
z{?c;DepRM&=)Tky(0%pGPFNZk80ec@nCin86oPGvh2B5L(g@}v2=JN6<wdJOQ|zFN
zabVXD!u+ubsuV^uGB7YRGB7Y@GcYiK!{$Hu99-}f><kQ$ll>VcHbB-;Fn~=5n*f^U
zXMihUfF>JI&B?&Puo0#ntQ1T@)x&S4g2gk$eZ0zGMOX-!I&>+RIE;px19d05YMA?Q
zi-XMp?FWR!+cIc9xeOXF%O+rIC0+!yJ_2IyQfT}xgYHLO28$Qs4MS4-@3I249$yMg
zFH52Me<_LC4#`jk28Mr^8=&Scfu_%;kp0z6OVE-#sy;%zf0qxy%!Rf)mO%HjFM%vx
zAY=dz`F|Igpyn=y?%!Vw&2Nk02@Z!=yuu*QLgH-;G#zY(x_c{LeS{=I>tZ10E{2u^
zOQ8Gs7lS&EgtU*!kA}c#2#kinXb6mkz-S1Jh5%JUfb)R7BLf2`Rm=h#0v<s74_>1S
z=3^m1?KY?|yd4~SfWd)*frX;>E7VK~1#t&-oDU*|PJ-HFP%&^n0K~3PVBlq7052^E
zaVf`OcW|-cGYHf^hRVZxS~PM8<PKP<W#|;B{SOtRwL9S94Yd!20`+g80<?Aq)Eev*
zsQ(6)fx9C@0n|I@#+$C7dWfUI>El1%1PAJ$LJfoG7s&X4xrM%yp_u`Elsf?05k?&!
z0NsEI(qCRQcL9hNU|@jsn?YAsf&>^Cc0njO4dQYzFffApC2+q(*1Iskd)1EMd%HnO
z;TUE=OaP)68rwvx2W=t%nZOG*4#Y;qP!mxF5iWy{OHj$2{|8{>^LwEEz&+6Z>mG{w
zum69*%-s#`5AK2X2X}+Q9m8|P3jF_J0PPp=hW3khL;J<MDe4#h{{idA?}CnJ?Sh_b
zw+lL7L#zu?)&0K!3x{1$ckhCZqwNA+K+p95!T|<Q9H8nV%=>>K0BYV&=y=>t$T@UO
zJ5LbSja$Y43ki&ne*6yTxp6xo<E>0Pq2pb+_2QHHf1v<oF7!OX9nkX@ckIBYkC5E|
z3$XE`?a+Ch9nkanc7TSHnf_l8VEBIl#3W=As{H>84p8@Qho1Ae9eR%A_7$iqN#p&$
z02_ze20g!UJ9J!bJI(@u7#sdyXoRMRZP0TGw?W6{w#^_$KQ1-D7#N`8uoXIgwhcNi
z2U<^oOBZ4BF9>s?=Ui@uj>~O@&VLd%1Dgt(jc@(`01e;G(DBGE(DG+9tiHkK9D-v1
ze+a<Lg@)@b=s4<TirR~y_8%l4Z-JV(1zHYo0c~+2=&n%(qaiRF0;3@?oI`*~p}~uR
zVH)+k2=4E|yD=E%vK7!|JOX}P9fpMr3=IGO!>cEFzal_^CgTy{JC(7y0VD>hk3ck1
zKZb!ZfuW0mp%vVrNxy(J6AM*HG6fF*|8Rd|(+_GNK*ZtAEk*_hkUPp5zA!K_P|qER
zrD+iRP)U$o5D~aL7+~)BMO}B`9Tx%Fh3*dK3!p)w7Kku4NKm|RAZ^XUVkW5l3KfRO
zAM*uJyg=NM$4aI2!65)%69Bafg95eBp@Il^TxsB9V5o))Q-Okn2i$yYCjP$w?{2}>
zF<$_=1H23Zn-<c=Anw4c57fVcDuB6ziTOf97Xw2VI6`jx0#i^WWKs}!;2lT&e*r!m
z0doff#2rlxGZ`2ed>yIg4pw}=_<sRD%z)$$P&(}amt)DCRC5R3d<*LTL*0qwjs|ZA
z2K41KP*vnmpm_Pufp<I*G`;~f8s-ir<_ioh3=EwOpm;g@l1kz6p98vb2WlG{1scDB
z3c=jLz@z|)7m#?mCY9X5!GOQM{Q)0qfV(4unZcL(<L<cI86f|H#@|3Ra(x@%09g+O
z6{nm6r;q=59fCBr1rHB~|Nrr8Vt}mM133_)2||MS|9>!m*DwG7!2mwJ4dhRhVPXab
zhEnLcIM5^TK-$0t@Pk-bFr=UC1nt+mLdO%Gq5X0fDD4UzA9aKAq2pq%(D55Lm^{4T
zhFOJXKGYrus68%FeGX7@SLis43)EaE=(v^xRNVCe14Ba_1498Q7{TXvK+JbO01+<~
z07VPPZd7qi2{dt-IRXp}jEo>TsCoscIfCfoAT=P2Dh}GmDgas+?*`hM4w8qM1G*9b
zBn~=bgahnWggD6kg~A}UNbXF4*sE!PCf>lnAOKp+C(gj|AITgSn79(Actab+3}$5Y
z(Dj8N8&NUDU9bUv@H7I$Kd5TZVta^L3=A7kwc+NmFoMDZnoi20@#eCCftv~3*n`+t
z4joT)Qefa=0T&ujap<_9lLG@U2RJQ3#i8S+P6-S`0?6iooCtA?I_OkN*m!d}Vw_#W
z0oi;+6IinW$@~hu`50mWDhUf0B++yR1_scfNZ|a2BtFU<4S~@Rz!CyXpaWMppxFgq
zi;syx1GJQZk&%IkA%KA&JW&Z^aWXJ4F@eQ|Kt_RCDhv!v%nXbS8lb&`j7(q_C#ckB
z0GR@s`(#?rq{<{D{Xgd$KZid9K6~N&cbs757`(iJluORwGK7JF1u`Fs#gDjz@OH#-
zX+jbgMq-aLhfWAU(v2ImhGl@<Z_HE&p6|&2|L-eAz7DoNofXQ5&0DZR`LK={Y<&SV
z6ET3#K4M^itoKg<XB0%(B!Dvs3LjcePk_yni6UgdEM|y(Uf?<xEJ7pVf&K&isSHaP
z9`HWkeZaL0ZVRI{7=B<fWKv{cs9<0=Vs>C=sAOO<W>IEfsA6C>VO0T*Pq3M?sWLFs
zFtD4k$Fa-RGH{r4s4+0qF>qRNYB4a>GjLgQX)rJ}FmM}iYl8ZTJi0vbJn~HpytcgB
z3=GW-d>nineD!=E_&NC*rZ6o1AW$d}C?F`nAXqLKE+{U@Ae1WPD#R+pAY3FIBrGJ%
zAW|X{A|fKfAX+IJDJm(-AXX|CDkdt%Af74iDb6X*AdxTOFTpRtAXy+8ASocpAQdfD
zEhR1WK{{5tR$5m2gAA_>uMC$Ae1K9eQO;40QI0{rSUy-@Se`*4MZraZMS(#vP0>w}
zO_4z<UCCXEU5P<CL)k-_LzzJ(OT|ltONBu-Th&{YTa`gAN6kl#M~y+<THT6)LH&b<
zx`q-1gT@EV1kE}I22Hp<+A-QS+A`W7bgFcsbfk0`bSrctbR~2d^pf?Q^_cY-^vm?a
z^u_cU43Z3-444cU4D$^A4EYQhjB<^9jd+b1jCG7{7#NH{nCO|<F))~XFx5A;XJ9ae
zn{TdVt~HIp9L~2?fIwJ;S~G+&#4%(r*f4}L#4}_v*fNAMBrs$#*fE4NBr;?(*fT^h
zBr)VLI50#qBs1hPI5I>rq%h<$I59*sq%!0)I5WgBq%jmQxG=;rq%#!4jD^$g4DROT
z44@S)9u~a}3=EzOo|d3dG%sB*-984d58e#kCZIzSeHeU9`xzJ*d>MSrK%+{2+J4#-
z82mo?Gx!^VuCNJU2r!z+z`zj55NKQmy8nS8$Y2uayh(;&y~%Lf5R9;xuo@7rm7$%X
zlcAfTjiG~~i=hW31RL97G%(aNfG(h;vKZ4!23BwrR*!{|@i!kY10y3Ns7PQ0ReX%{
zu-Yk)iBX=3AH-7w$*M6ja58~2I0FL%^Irx=6=pt;Yl<q0ii(QHwn~c1ii%3M%8D8w
zzM>*XTt!)5NnJ@<Ur|L#QQ1~eQQ216R#8P!8N{$xQUvL+Rk4Msw^eqswNq5KRkBr7
zS7eq^uvJu4QdF{21X0S0s*3UyL3N6B%PXSmS5;ItfVf;;QN`9)QQ4MR$cvea=`SNA
zL|E0<mYF*Z#C99J1T(LfqM@oHGp~XQC?=TY6hLkTg}4%!p#)+o!bl}sTTuLgV+0iG
zU?s|+Xauvsgpw^txuT+)y)6j1*n?tJ6(k5TQBlzr#8FgKR0XRC5il7=MMY+A1(3Xw
zqN*YjBLg^9nh}*)<Kc<b5R_OA85tPmxgk24qp>D)*ce9`0|Nu-t`pD|LZIt4K&SVC
z4lV_aVmC1`Fyt{XFsx=^U|0*f7mk5}VLJl@!&b0uvp_aEfrx#eTyhF@3DRW{aR)>^
z0THiQ7#LWeu`n>OyaY8JzkrDUtPBi{>>z@VnSp^(oSA`vsUE~q01;Xs!jOf5fzg(Y
zfq~HrM1+EfcqRr0#x#&b2}o}(h-e296F@p<frup_+4Ue|8%W1~5bG$2I1Q4$3}W2{
zu|Q5^d<)Y14a5aGh>4Y*fq_YYg@J)d4CEjM5K9k4Sb_)_5aAD!2nVqeKtwKxsAgke
zU}^(N^ni#dAhG!%v85pHCJ=WAhy`*6(?t#j2Buq}cK9n$YyJ}#0|V1f5b>Xdfq|Ke
znSp`jFEaxJvoMH|=4N1ER^wt|VAcf@W~>Yh%nl%RZXm)JL_~pz3>F3kHZ_orVh~Xa
zB0vseo(Phi10oiIh_xVM2Z%TXBF=({8zAB_h<FDget;s1iHU)Mg@==YfklXofq_MW
zi-Cbf1w?3p2m_EK%|V1MNU=9aED*#3xrHSKq@$3Vfq|tK#OegGCi5^buq*^|H-U&9
zAmT8HxB}Al2t>RGB@084p}%+;7+6_A1Rpm81FHxp0|ToJh|mQQrhE(xto9(n9Yh3z
zh!_x&1R}CQL?wu51QER;Vg`s<07`_bm>C#YH-Wf&LBt6VaRFozC=6KdgOt1h5x>|N
z7}%IW1TTn?0)?(Jh|mQQ#vsCynSp`L2}F1^u<F5U1wjU8K}J?qVOB;qTUJ#zW?>sv
zR$*abR$=BmMpjlaVKzOsAT~x;E(RtRMsX0Kz{<*|$STa73ziO&WMyO%W?^DuKFOfR
z$|@`gGKjgHk(HI1Q-PI{xm*v*@@HdK@PZi4$i}b7%5KlfC~L#Yr3^NXQ<znljgeI{
zf|W;sm6J_Tn3ac(k(F1Mm6NTUm6ey3hfSE3mCb~ekvWo)l~sh5gN>1uTc4E&<RCUh
zRz@~v6)!J6MpjNX=2$&eK?WukCQlH-#t4$r1i6frkxfvKl|zx0lTDwMmyMB?l}#1w
zX)ZQ%Fdrn&$jk{-%gQkktdyUPk(E=Cm0up@E;dFRR#rA8HU(Bbw$JIMV8F`A7NwwI
z!^V6YBq_|Q#0U;gJ~l>H4p3m(3A2LCV6<gnW@G+Tqrl24EF#P*$R^0j!=}i}Y6rHQ
z5#%l%uyf&2BjUj<0yc_~O^}sak(Gx{flUwWCUD>=uu3Yh^60VhvgxzxvN3{!LXVYE
zjZGC4o1DU6V?`8Lc@<bi6hOfWQl|`7#{^Qx%E=}T4rNX@17TKH<|;;TD2o_^LQF#s
z96<W4JdCWY2B0Wr<z$m%m11L5PyosQWdJ7=Rz@}fkjsSF6xkG5MZr!05elqA5Q>$}
z4wN8-SvlFXSw+|wS^2=)g+RJN5yHx^&&nvz%CE@E%BIf>PG4-otdjDq+<M@2ArAHy
zn;t8pJFB27D<_*Ss}LwY*bG<&LE*>9DySF1%4o>K!p8iM5tP2bVa*CkdfXFOSlO7r
zRf8gwkx^I}<RUgkHg70x3#ApIv=W2{k+L8HEUv`LsKmy691^h*=P|MxfTTg`K#`RL
z!~_SGqA)m7va;E;GBP*RgHkCA8!IF8Gf-*}5n)whV`O24sAry5rvTCiGJ^R(1EVO^
zX{?O;Y|OJ5LGESc1StR|hj0iJ6hJ7}fo%gNSpjf(D6)cRRyH+=J~n+YEy&8K1j-Xt
zdSGczHjpw<WGJu-unDrTgQ9X)EhsXCSvXjQm?OZ+O@NJ2frXt}6O={d!S=AS8L-N-
zF|sP_>9I2Evv9I8Uj^rOR!|~W0eOZ=kJZqYl`)cqi&cV+c}G1cm9sK3mw>{7m65p+
zM6+<S$}(SL05Ms47#Sf-_ti79aI^9-A7W5oQ(yxLva&I6t7l}DXJh7MWR+0RV`bH2
z<zz1Z1Wpj39M8na%E(*>Hii*g)QF&&3^7L@6a>uc>lwkt1d|3UD08zh3xUIzkvSM-
z0GdV?E>MUBL0qJ#z^1^$#VW-HQYx&V$EptUJgd4qt1igoCRRp8HfB*!;EA#_GVg>$
zIffS**_bmKZNOd>NAh7FBP%$8u?ezr=(B>t7gVHyXg)SZMR~AaL4gbMFDONTV~&@V
zQB9A9hmCoEJ;)Qn!s5)bjI7|)!^kQEa+D~@{Sn}DQ1b~m&V|{S0~J_VK|v(UJcE&u
zl@pW=h1mpHIYn62*%(=PShYYpnJ3rlu?n*>`@j{?MO6$|stGDonV;1$g7Yeq0;?5R
zKv#iP1<VLWh_G<8sx!Z3&|~3&Dw<rc02NbU;bGMPtAALhz$yk}DX=O-D2RbZ3aoq(
zz6=8s3p1NM#Cwp^092@&u(Ct49TF{|2+1V~8A2i&u)t$yV=iY@gz(Hj1wE@U^Cnn~
z3NtT44+>UD0D{9rn2q^#9VjuefzpjS^JYd+pn`qHe5Xzi?B^wnAU~Ufyu`es9^zSM
z<}LLKkhIBshCu;btS~_ZKnX^j`35-jKuLfJtV@J>DO|^G1{-iyAk4f5;m+j*+<5`)
zPF7_$Mo^s~rw56Ubx01rUI!6d33f0jPMDdmgNrL>P}ReHnSl}9IshdZHc*|xtp*A%
zkQg@`BdatxwwTKlAVCRg1_;`KiezY#W@M9O<!7!^P?Q6wa7H!>R(=^pStv)Gm0u3R
z=4TUSWmIJ4mx0QNvhqVD7}-Qv`C*!cLA5fYVjB1s6Bb@J=5_FVp@=14gn;vfE<9iO
zf|5F`FmnPV^1yM*D#9wt#t6yb%;y=vS;7OVE)_)`R237m93!hFC}I^@9Y7Sbp#n5<
z`y+{nGH<NcgDN=Bpuh^^E3j&VHApJ3N`M#&tf11H38u?z5afY%;Izdm%$$YpcTffZ
z*XY7*qO4$sC@-rG$Q#U07@(;b<jpzt3XtGo76EZ{6j)8+ia=!mGxLUeJ*e0Pghqbm
zh4p&S%yFMVfz_CKVLiAZBPtCQ1=#|s|Ad)Wz#N&6$B|N?W+Niuvx<Uh5OBOP^Mf2#
z2#GajW`0n021)GK2W4W{Q&3>xV`J{B2er|7R9MA9rJf8cr!crS26>550o2aoQDBt=
zWm7#!*=d8q^I~OW<^$*G5(RK85Y##pXJcd)uwfO~1CgM#$f(CE$Yu-95u9wsV0D~q
z2H=(@s4W3%hBC4-9|yMuK+Ot4Q2Uyd%?#4!<7H#6&;ut80ew(T1z8~@zzVWO24uA#
z*g#%3eNa1xjoDO>l~qI-QgDDov{|){SQ%wld6ZchWg)`8tlEkoAzmX0pG}vQhs}_c
zQLzM+wY9+x0~MEy5v<^vN*A0~7!@HrHhES?=64{+qFSSYZjC*w1~zLr*>pfQ=&_1=
zL(G+DWi(7<vj;WkSsB^*S%o1kHDu)gc~2i4Zs6KE0$hxVfqbRU#=L_i4b(&jRruhh
zq#n5L1GO>PjKIxX4h2>r1&|?(#;mMt%#{k@MwlKXGFjPTK#fUIn^_IgP5|{TSlMh@
z1=$!`_(2VT{gt3r3AlaDk<O~3$I1a}Y8tZX*{~^s^@3EZL+ejao&fdeV6-$;92~id
zdU~t^piUek8*?)Y*i=yQ2vX0<Cc-MF1L_U2a>BYghO9bl!mJ7qXMuV%+#rjUKxq?X
z94O5guradogZp^k*ym(31iOfn&6bssd2THz2a7-=7t|jCDbxom<Ylu3DFg*9^L-{p
zR!MNP*ACQcgtW^QSb6nX<v}S}0i0-+*cd?!aN=T4XJj=76+3Lqn`-qS#<PL)IU^e=
z^&7E@FyCO(19ch%8QGXO@IqRzY}MdC5+n1@QjoJ)K_LTfv@sv$0!0QBs0N<I%E-JO
zAuqsuoGXn*02B+od5}h$u!tDMM&veHF(|<@^Ia2W;bs+Po&)M62!j9{BZ~m581ub4
zsA6kYc|}%UP$Pnqc_E{o0*e4Eq(y{K!pO>MjMNGOwb~U~+1W&7LFEF71rvd^hLm8A
zVF%UUDxmBotgOr`C<76f1y$$J5Z7lFWCPc+pq$Ie%mZrQ2s5{!I+mCDdmTuElevQt
z<UC&HA9V^g5W|=Y^;mhC`9Vzz6lqpYHdSGW*Z+e010bIZgT2nl#{9pIQJ59fkYHlY
zfYsulq|XLw_c2TBvGTJCE6TGns<84)D}!4FpyEc9m0up#F2HOeL@0m~G8=OWs6uB1
zcbP$6;{|m&SOwVh!J`i#Uuu9xArx2z6<NV@YzAN%2$z+gO^`(p6tx=Qm}LYFF37R6
zDk*@H5)-I#$^>FDf;-uu(Rn5oMo^wNX60m)0f#9oI1yTdNU(A+!N$lU1Ts|_l)o4m
zLB3&DWn^Q%11hRu-AV&i1vW-j`BG5sl2-(gpdK?Qy@NUppt6LM%}^Lze1L~g48R4i
zEVw2B<vVGRRg7$UtY#p~p~)BA(G`Pq+!a{C&I0B4LQqZ+0*x#%SAlG0WfOroLx8zZ
zj|J>L@GuDrH>(J9GAJw{MSvcpuj<7X3Cb%hjI5%}6T$6CY3BEgdMu2f{>An>aOM(*
z^fkdvW^hfz{2es)&%&qxGM`xll%iPKnA0FdAEyFnD20>F8`^0C`vsy>5~PxejX6sJ
zR6MXUvH5`PVO|ev>4HYFz+GAvZgA6zkqu-E*j=4<3ZP5{x0*!+6a!D{Ktl+Oj3ACM
z8}l1b1c<OQfqX2<#(a<o>{UfJMo?#&jrn0U$SZ7&EFx^o^I5=x%rC1!U1*5dbg-BJ
z8}ox|MivoPCFTVz3ao+(tWpZ#uH#}RP<#tBDnOD8goFeFxNI{3*B^|^Y=+=rGf>l>
z4V>CQnSqg&N0Akjni$!@{alznHY4a@jSMU)fKoL`A(H?o;z1z?NvUk$kr;41vWc+D
zg7c0rBO|0(WCRrpAYF`X;4}g=9^AYKjk7@p=s=ADP<0MYarP{ttUPSYn<^PWCi8(R
zb74rb0X5S^L4yh+puvc<Y>X_R9`p7}aH%Q*t#3fRT~^S@A0#b9YEMu_!voiO7&L$c
zQV#M78*>FHvq3xq_7*6sF>~p$G5-Mdm_d;y$jS+>+a(}HA!xKpLJ3}FG0K3XRYAe&
z1s<7U@?w>+1SwSqby-*iBUxG5KrJ9p0Sc;K1zCj^6+q*T!t$U|FJWC!iKNKN%?7d$
zKC0*qiZ?x0VUVN}D=!;AtAsMBG6%JG8NFB;{cRLj#MqdZS9yV&q>OCB&@l;6=z$Wm
z2pjX(dQb~N7&P9d$07!51Ds|66*j`K#ug}&*_h9Q(kH~9vihuyx_Yd#k)Yu;4n<Z0
zeO5+hIR!mX{mY!9Cjx35=&|zafzls8$Yqh>HU%r2G06F#fMjf9Wo2uIiW-7MK|^rf
z=mIc(a22Is72xqckOl`IP(cT2hZuqL3#i&;lxLN;Wo6W5l~&ZV0XdPMnG00NlqrD3
z`I$Kt6j-I1%N1BbOe7W~s4FQAijoBIC@RPXC00<&0+gB=LB$xO0xO6Dwb&V$SXd{3
znp)5ttf$AuJQdXT5e5a404u)|E2A752?`4Xuoqa_48d(vP<hJ8CalLQpb07yddtAR
z0FA*)7_%};v+}8cnxK3}tgNb_0d55akO-?PE1xt-1VpkqGIM$fgBrw)tgMQxoZ$8l
zn}Qdc5-44PqQo0qI)latV18g_vxT}EGJKP-2Oby!)gPQ}D!MQZi#V$R8}rjzkeh@d
z1ve-|z}qyeJZwhb!B$Xvi_uSk4L+KzCBgiP2~;?N;s?~m*8wGb8}L95V+1Q>BpdTi
zMo@t!A_@);HBdX>i&YcSqT*#U01qdDd#r5Q5M7{L2XY{|jmyjliUvlu5>_5I2e=b>
z*}z`aV`Wr^^orTQH9IJ)vN2z;1C@ZF!j_+v+mIF1Dg|YJPy~RS&jD%usk1REc!Nd*
zSlO&WBUXB#SXs?j0&aG5vdOV>8?Z`(hMz%IH^@(*CS40FBiI$vtX!ap1U3U!RW?Re
zDNvoJ2(kP*3#h-r$_Oq~LFs~3iIq`@l~sw&4wUb}1JY8Uuw_$(@?o?Rm=7AP<%|H0
zqA{|CK`K6G2^&^MW(hq7<^Y8Vh!9hND9A~mjxnfMl!XejG3kgwN?JDkK}H)6GWXyJ
zALcA@a$^>=VUYkOh>s<psvF$r5mf}0Fq{UUNCkBR8Nqx}TaYM7PM4KaiItm89#l?)
zn%`{9_aHSps2>BWg4h^YB*0xpM&|jojI7+C7=)A)Jm3b42pjWGNaf8U!79$ie7qJ^
zZc8!mWKvLIkpLCf$7>nEWeGQ%0*Hp#atn(sp!~$hycpFMF|aK{Y|M8dIv|-s5!6DK
zU}a=pSPSkvR85FsWsC*&B*A5qBB*$k&<8b?KqVR6rE8f$nOc}df{pnS)Sc^?^q}s%
zRLkfMDi1&{IX33iOrS6XS34kYFkh(!wcMqc*TDUCrIyh<GBPp}G;s!+&YBLHa{)Pk
z!xlUq37UprWCr*9n9FTI{bg2eC01TJR(4Pbf+qGrB?hB2s3lOP2Z{n#VNgFxA2b6f
zz#;{T%QfI~0UVe7Aa5zK$|!*b5I_Zl5t}}%j67&gfH8y3ALe@zQ1u5Id|;Gk6-ft0
zGzX~CFlLowV`Mc_WR;U=Wd+Zdv4T1Ra(b++u+kV*>VQX1!2L%)a8V6*HK^$UnkHma
z)bj$3xlaUj(1pQ;Afqn0e&vvdv?`fn^jI00RTNkSnPWiXDk=(KX=@u+0gxk@1r=C%
znH@om9Z)|<6rzcdl{KD~i%l3-JBYAyff{$LA~CF7%vGQ|LP-qPdUAyH+*vC?wKAxF
zV-r!3V^d<YVN*seh*{Z~B|z<j$O)j}_0&seQ?SuvQ)D#(wcGevIhh6YSQXe5SUEv)
z5d|vdS$IJKo(FDj2n!2?=MO3vAx?B*Wn`{UU=@VWX%Im+4OS^OVF+87l{1i)Rhd=9
z50vIBy@c6B*c9Ndc1~wytq@l7g*uUykxj%)!3Lak<Mblgyx45P!+y+I-34-$NCYT)
z!3oM56qJneAd;0?(1uljIbVU5k)xQEm01YXj>uC$V<|wCu(B}=DzGtv!hn%2(gr+M
z1BpT^naCo|#{3(RTm?Wa3_Vs}MMyR@5N72C_m)N26xeJb7VGP=@Ut;jfhurDMo@V3
zu?m42sd}se#;ii}ptgmO14O%_2&)Jvg~+mUsIYR%uo^+yu10JEtRjl6kQ6S=W}~3M
zDyz>brpU^w&nhO*%BlluMS}*LKs`h;HhET7MFlnkR?u*vGAQB|!4m)=Nl5)>2Py$r
z85M18*qFOmK~*w1>#;Hmg3@(9C};&06j>RW^AuPmR9P7{K_n|PPYJ68a|y^mW=;iR
z5w=o!eR)L%c~)^{R#sWINND54fR*0}l*Yl;pe!q^9Gj8|v}MGm2x<;_fzvuDEwb{0
z3R-ZnuE1&tYUArcM#v|yGRD}jIe=0FsH9;9XLeRwR>oXbPPRl=MrJoq<^uIOStX2E
zrL|aDO<1Lws}#UI3swmgR%tg@Rwqysvr2)LRShD^$_ARcFa!;xvC6P134<G$tgLJ;
z7;XWNSVP?cs>zwsK-o)=5fq`I_BkUPb6Yhi+(f~x4Nx%!YIU%(DM7ph8XmKOF!ew^
z0kA*8U0Ns$)D&X^wRR#|S<@j33F-k&LPGU0vZb?#voZe^10^b9(CPw4(AbUwE4Lae
zBPblWonSO*I+aZy<U>%z8M1PTfClGS*(6wnKz)5BR#q`KVO@RQX3$y#Hf3<iVAW%b
zVpRh-9gV>xsBy-qsAt2%$g0N1d^H{9byi{KIPi)PDK_Q`Mo>FQ4pb>>voRk4SCy>V
zY=W$ups7w!9RO;A*|Ny6F|V%$RXMEkjG$V9l?~iZS6~$dWg}K8CD2Hrr~-%trB+a*
zoJE$6Sqp3*4`=|NRYX`=m<=?I#KW8oP6T{x%sh;&qVfu?j1r(GIS(j_GJ?urc~F_b
zqX2T62qUNm*3S&GTNGp`FDoawZ4V|DSUFV{yuc}tQ32dBWQ3IH%=`+VkzD3tJx~C$
zva;Df1-IitRRyGuHUu{_S(R8-by&F|ofU0R8&ZJ{n#tIh`@n5?a1H}kZs7FC7QhNB
z6c}0g)IeDu)L{mV>T<G0v4WbbJbDUdpcXJ}sfvg;3pc1AaGntq<E#d3f;OzIifqE*
zNqSHN8x#ThdMxa0%nxe8p#{n}oZx)Jk<JPlY?T8IkAfJW$OQG{*_l&70mud#c4Y=n
zb%Fa?oXp00ta8l03ZQXhPG(~TRw>Y^3}}4<6SEYk<H(f8rpU_9oD9+pZW(hjODnJ%
z>Vaw*Lj_h&Jyt2^R0U8=LWGTZ8@LN13?8F71{&>!kI}F(vWhaYutTTbK&y!umGnS~
zl)1`_l~a_JhuIZm0~;eNctnEPl95%8+1-X!M**tEN{>~A*$vK90P*x#)tRjnAUePc
zc)%9Nf>SYK2#TFmo%tjKbk<J~G88lc9JHXcA;1dj89@363i|SFpe0A%py2%o9x(#P
zCZXU3FF3#q-Xjd4@ZD1n4d5dTpb!pK0Cyjln6;5YI0)o_Xb9^-Ll~qu1QxivAc4yU
z3Pv5~Z?%l9j7p$H$Xpcx3BfJknKF0~o?-xn;kJ5kAgVE+W&nlY)_Mh29p=*vpzuSm
z!C?*#L2#;IWMdXXq$^Mxjg=!3p02>{IdIVdNmv_U*7C5Sq^xIPug`*c{TbNno9khI
zKg*!Nmd?t~yaBA8)trs_90Mb(m;$T00;`w;lwy@)-c%0`0AV)f6W{;<4@QF8@!-hb
z150K8pjd~cGDhZq3^tIkfu^oWU|Zl}^9CF?Qy^g@3tGs)s=_?EUV#<F289i1y@WOM
zTLz5OwHag(C|QFoWMOBuW@G-tz{n~K8UYn$ZmCy*EWBxiG$_G2lTZjQ0GSC|xPcae
z-@zf+2@ApR;1FB{55arT5S$Oz&ML;ne4l|)4-$T?QlKeSP_`6eV?GNBI7lG|?r5;H
zGBQsG4WhC!SEWHxPb1hAcnE<;?&X-9At5Bl{12RZn(9H#;D6xM(^Rj=s>cjsBc&ce
zP|*)fJ&@cb1n#IoNpK%r2weON*}>PvfJd_g6uiI@R^$aPeL+c!pN%n%RSMK<Forfa
z6u^uBK$Qu&!2wE%-r(jucv{el6{-ueT!pO=)X0E1hzC@XvVayr9Rv9q)Yk$9!45`7
zNDTm9r^W%YDw35~A3D+vYEbgBF|rD3u=0YN${MUZil8!!mz5K;qG}_;FmPSZe2x*a
z9*GfD-5Y|2<yb-E+Mwwy@F=PS*bQ3|+Q1HHKE(){wXg-*1s+5#0*z!avN7|4T6Kbq
ztRl>1;Q1>aMlaBC^h|Ko1{qo51kXw$NNrY5Lx`XBSOx4@8JT4iKus{_bT6=Lgritl
z*%ZLj9voh*!uoow9M+&|NboEks8RwA^)a!PvhuO%Lzel4vw}LDoWiW2HYdn4puVRJ
zs0F{M8q~2suibgT(JQFL%Blcfm<U>}rw=MjO+ocBa#;%MQrd$0aC)GKgiHi-ve~h+
zGdqFGLd?Pxv@A`Id3C*l0;`GwD<|_+aE5S!l_)ll0tMU`1C47j+cL6BF+1zAf=3gX
zZ9#=CsOppg^=DwoelcpYzYQ)Jmco)fXp%;Sc?me#-vKB4CG~o&g3KT`YO;q`EUUrO
zsKVl)@Bxj0gOZdfD<f!@mj}9LRsk}y?+g;v10^nSKMXt^uMQDIVnY>!+NjKIUZB|>
zQ0f;<honSM$Bzv>9eIF3&r1Q6=$Lobr-5S{8dad#Fg8#f4l<Or05pio25#VTg2ui<
zI>18&tek9ypb<*Y{4Xb4B)E9zWz%P56lP0fQv#I`Fd5LCERxxbj3UBiteoQDzCI^g
zX&I|HTNEoNc;*$9sP!QUhnLL<)Sd=S;xmgXfHZ;9lL9L*n+RylS_wEzSlO7JK%<VV
zY#=W%tLcHeGJ<ST;C7fOn?AS&B+919Y6%Kg(1@S{gsH$P$`%KnL(@@Ul~7=n1UX#<
z)VhKe$5%j|ZcvE?Zl*HovT}ICDl~BF1FgRW1%d%9J2QB`7c=!Kfok$NSlUwp)y?Iw
zq{j(LThOKwcvU25jtAsMW-dmM6eFmaR0dJa$jk*6vSDSE0vCC(7El;8)q@ijvj!up
zf-S2KbGQPloF1zJvnHro3Rgg4ak7B~K^<Vo;tvH#+vX4>C|e4%@-l-~%z*l!pf)or
zbBO||!v|XO3u!d-fVzGqp#C+KrNCylwv^SH&4!g#fi04)gpHXSG^q!fA7KQ|WC()#
z>>{kZ;ML=ztg4_EJu_%AFLMcK<uJ@1Rz_w}feW%mRiBkr*GPs<g$*=z!o$cS$Hx2{
z)GH7HMFu~sq#<be2Z+>WRaRw{lml~>!3#7bl@%bP3!qR^WR+wSRD|$B&2&XkVMx9P
zEf(NqRaRsb0j(g0tVjXX4$N%2Pz9iP08cL)ftpvK(hw5ctZas$oRI;qa0D0`S%rid
z^%+^U!Sitftc>MedW>vFu)Zljc$5*;um`Pb22};%&K4^tn=xonJ)3|YXz-C&4nb<m
zgO-;wI@*9jQJ0mG%^TFy1+CW<kp!*VlmitMrJ%kPD>HWqD0He6gh9(6yjYbDK*0fC
z{(v3;X`o>uQDG4gq%Z(=m_VVxEC9;X%vE~A;*e|ut_7JZp~WC5e}UFTu(E+7jt4Ti
zrCiF&$QJ3P#|Y}QT>-a^S>#z6nV*0vDp3}2X+MLJkwu<Wmia}U0!V;)2BQM2IH;_L
zirTOWfC2=x1{vg6eem1@AH?O-Y>X^2tgawEEb^?vATvNd0QnO%WyQ*-2yV>vfy!cd
z+lmcjpC<D{Mvz`}<{6A$;JMx7wR$YzNm0;>39u=eVAJhE(ab!JQGrFCRg?Ku9cYye
z$fc}o%u^T{S<Tr*Aq(+X^jO6$SwSfT<WDvgQ2hm(ssoQi>Dw?uy1hRj{WvwyI(|?o
ztIx`4%fiiS!p3|A(y#-KCW96Nfo%0+^9H3X1y&;s(2{Ic(Bvf~QGtg6MA+O|nWVrI
z*t&YGI!dg%a;$0!tW0c5tSX?nWKa_LR|n3tpgNt8m6Ms<i&a7nJpTk)Y60!(^E$FJ
zN-MDPs(}3sYMX#Mr{D=1P~j!cCIcFeX60m40^7!`07{4wa;$RTLJ>lO+DKp>Y{9IY
zs^Hao%xuySYY>UUG~FA#075tow89lJ&lJqS{0+RO1KbRU1%M5kEx4>@<wObqh$W1y
zLTn*O-Zw_}zBU^p3uro-`E4zzWC0Zk;Qko5JZO-YRS8-VG1{^yvN0bAk6(iu5a0?O
z+?a&2IQm%`*>qT0#aOtQ57aV>uracLI&sXKK`mbq7A{r+Hs;f{jC!mpdMt{ppaB_1
z=B-TgprZhwIOIrUWn|`J1g*V00vXa^1ec$n7-8mPWaVcr0;OeJR!(6NklD<qKs^tT
zMSQIM%o~^(Ss;stF4QW37hy2&Vg>I(@M7VEEGJ{$!o&e8xZJUsz{|$Gl?k#K15}7I
zvWbF*eB42uFy<WaI3lwEBdZc~0jRhZPyn&?K-2LR;8`wEyA8C#ff=;mfjNSemsyAr
z;tD2fR$c?JdssYJMc8y$W!S_)bJsEuY4G$v2WZfXLxGi19ITMp71TxmjnlD%Bsjr@
z0%+Wsc@ucT0<u4cldS@j=2;EEjXcmwHzu}JNQ)7Yia>>cF(?=4fogdrQ0)(0rR52k
z?u04>1->3=IEP1`RRA>j!pO#a1w8dF3|}fH2dZc^A!*bBG=?e{3!1CtjR&=t6j*uH
zSwS;}ylf&V;It3Q7~qCA$Yy=8&4O(Dpll|@=w$<HY=V|9se=ke<_gqBNFdiR^MHKM
z$QA+Ou<5b#Fmr)&7iggzFKED)%?r`z05#MRHb{VmT|g@Vm@FWX4%(lg3Yi*Zu4Dww
ze=r{f#TjVx132ljiLf#<mnuMNDo}~c$Xp6aXUtp^K)C_b7U5>*2E{s(BCxwawYLsr
zs0uWo#K@MRrvUa^kQcPc1*!+Yt!j`X6~S!;Ch)p@P~(Kn1lGm_N27oZt00>Js7=Ny
z$fgJ?MHE;?K<QqPjk(kYl(|9skpw|w&!CQ~D4RYTxZPw5TPk7*4ik_|KtoQvYzAyL
zY>I4*pq2M*U}y1wT4lnZF>ug=CD4{HL?h9F4J^S68hK&%2NeaNwkT-PC5Is^BeNN}
z*P{pOKL`thG9<48s|08k3LJFcat5^jqe6j|7djNm$t>W-$_oluPyq=_51`>%uu4YI
zkSJ(b3sNa52Pq%*Kut$ZHscmZN@HU#OJn5(EoA^LyJcnrtyX{-0geDr0%zvYOHXHH
z6alq~KqEk+8_L-xuraGbqWTZ0`V?Vg6k%%ub=#U4QJPa}pq)0;>OsB*6>2uD{E?t(
zEJkM0hzM3z=4|j{NIn}8ThLk`@U(a?Bde$wE2oGsn-`m6I;h1BatJ7NmB2kZP{4u~
zdUCQUvgzruO$4QU1r{+-!q*0MfI-%<$|$mOM1b19!mR3`mc1NX3up|JO_WszlzKTp
zi3K#b$H~maD9ow`QL+HkjTT{3W@Qx?1<fWhZwF6&K+HY@ULnZJyoXVb4Klqb#>&ck
zvd)Hun^lT=JEH=~4XkX;C+isPAWK_bfhQJ0O;bKrF%?!uEf5LrK}SH!22d7I1UFwm
z{ZY_r05)4tq6F_7VJv|(10jk){SsETGN{R#phN;Om>0Z~1442bvGTB)v$9HoCRA+Y
z*%UKC9s;dVG-YFM0oT2(rl28gMFmz<dC;aE&=4r27pn+cIA{@o8EE%|0;`z<c(M()
zssmJEfclaZ&@l^eZ4c@jfvW;GMph;^dvHa}#OA{aT6+j8pBeR78GTrkKr10Zy?X)B
zw#O<3Rsm=gFJJ;1B4%Zi78Vu(tri3g+JLHT3Gl?80;`2BD<^1#(gKu;71-2RdCXZ&
z*hE>yWfc@yO>IF-KTJW<3tBb7$jYeznpE-y&BU;Z`?9jK$$?TouP|h$lb6j7v?q#r
zA*kI2Du_TkJ3(zzS)`3z3gB&9kQUeadPWu{XjyfaL4j4m0Ms@X0VO^?R#gR1!eVr=
zVPp|zV}^`>fif#Us~C8ULIjjpLF+)EJ8{6NP7$(v9n4k&t6*bf1uxpN0e1-*L1XKj
z!mQkaAl)E8v)Qt83$ik@DYN;3b=iVbHF%qq5i1Y#PjIyiD%+rg`^>H2c@&T`2R7zX
zP>$wgWaVQ6Ef5r8W99@U7|`BG1vb!fOC~mGi3#2ktH;U%UWdrWECJ3xJfKN-P-Br1
zG@Z`K%ENrM7SyR)&7=nza{<|6#mXrv!YTy{Y9-K)I&tu<s5YAdXni&#n-3dkxg@Md
z0UB0@bP?oPIc*_PZ^X*W=Euq^!=?!8RDk>q>PQQ-vdVxb%otTzIiU;Jc=bTdXI{uw
z6Gkscof83W(=oB>LP{}6H4AE*8-dajXoQYc1+*ZTl}%X~yqpVUD<`PK4DNWa3NYt_
zW>Lfx*qArhOaM8Q7qTx`43w`xd(wEBlR-6-ENJE%D+|;=fh_R@?~(NZ*A1*}>EJyK
ztl-flMphokP!y=T;P7JQ0S`s7va%V0^EoS<H!G(UX!rqK%yKcZ@-oi=CsSb&7I9WK
zW*tyxnFTc0$Q;4QBF-w$tN~iQ%E=s|z#`5n!K?v_I4Dn$Swj!RWd&{aQ&dz0jj=%o
z{y>E+Xp{pyy~xQH2~JYXcNiE&C0Kcw-!Ox05e8K{peaA_03oP7#0b*H++V{8E~3QJ
z!3`%yFL3*YQ63WRimbe#5p^X{Qe@?2GXxdaUaaE!XlliwIY5C`7`&X|9kX6DXm>BP
z?Zc)6N*17XR^VI@s>#4Dn-b8t4tVB+i67LC0hJDHM&R)hPEaKc-9^pHX3EOVX3NUz
z$p&7@$g0dNtia06oU4Guk_GLN;btxb_ZGOpomU=tR&K~*2~IX)Rsm28#7T`+R)!T^
z4zMv7fk!YP6?;<+Xl4-HwwVHsAy9=E0bc0)k^$Us`o%oY8{D+u1U1NfB0-fqXz30U
zb0sKsGO>Y#L3^{s*rHiYlvsJC*%U!)KwUCWs|2(;RRpw}1iTfRRaSvjkj)V6S0~7>
zAvRm^f*vL|(7ttEHs;^ekS(!-s;t8Dtb&TH0-%NO%51`{f}l82^akxQoeJvzff`wY
ztQ@xBgvY~t7hZZm@-y>7COuYO2T(497{sdpG7;2J0c9j!&`w)VP*uXlTpq#7Dai(!
zfD~tARsxqQpuv9u@c1_`G;70`41gNOtek9i;Bg5jP({tks1GhEG(nYnB&z_M4+}S|
z1{?F*dQdNbRRdf*v1;goRt7*TCt)^EQ01fts<#C|qkoW*%?OC$@Y)CzjEw56Ol%hL
z%7~MV(Thc#Rh*6a7AvR=f!fp-2hA$Wf#%O`V9h(o1Se>87L;GXO=s{j2c-6p0xJ)*
zupTR;BB-r%v=Y3nj*<BRxD5mfX6D(THUsn1I`B9YoWlkh_GV-T?MLMY&GFc<vWkkZ
z^0R>_ZTU4>Is91#K)Xj|6q;ChnA7!GML^}FwlHY*1gKo}1_d5y{7)ZJ?t!)~f?Wk&
z>88Lc!Uob|0$D!KtIR6y4jLO^<z-X0WmRU2WaS0br=WHdFKE?`fgGC>cvT~0mFsQL
zUU*P72JV<L%7Lc~AtY!yp&pwO>dFFEHp3`TBgYH6z;rqXIDEl7i1@*SUHqWhP=S>n
zbT$HH_y{z>&H;)<P^JL2514sDZ5vSYlN-EnoCQ>TXM(G4QBWX?fD07?<{~{7X;AC#
zVi7ovfYO^fcq#)*D(XSnE8sqM7C1)4AtOGZ9T1=;$)F)AW+6TJs#JIZ18zfr7FU9M
zekS1R4`jX^*nBxqS!D}OXW-czUhv8TP}c>v;2Shd%mJOQ1$o8@w6O!UR0Px@2X$CM
z)c~k*1M)l%8>0=2GRP<UkTNA?+6>fhvtnhH01Xr{zX#_};YhYL7G*Z(J|;%cQ463N
z!W$IkEGlfw(?JbtQE+f`8L~2JD}WE709B$kY-OOyacIF0s-nO{Mr@31ksxU{&=DD+
z#LcLv$HsiT4is%5b9h-fvO!B57@2uNtIJr~m`n876xbr6bs204wE;386kUet5K}=U
zcqBlc4bm(Gw`BAo?F>j7y9^p~6$NKbMr~F#LsrH@RyAc-e$WyfHPE^Se$WaBHRgOh
zR53kPkgN@8<(C4h8fb8UAGCamkvT^Jq@R_InZF6L@C6hDO5o@Mx3a<gThvuJpkdKy
z$dV;tHf9re`Nay31y+4FX2A&XyaFR=+J?E*t6DoU60{YH`ENxUD=TQF24sC%Idpv)
zGbgAOQ4X3g<ct6hWqCo?m9c^5L6BCNv9cjAm16}}w5&?7^>VhXT$Z3E{lf6oa-el*
z;FWUFLJ*XmxY-0*S(WA3l<Xlr15lb3@q%=RlcB58;H%_#(O1cV(wzus_)QcXhm2aR
zpyl5|tbCwJKgK#%R?uiRBXbGpuoE88f^d*HE1L#*<rz4$+pzGnF>eQtj(}UE&^1gP
zimW_wtc;3HpapxHtc>7AETU`*3g9wN0CY49sA<p0ybM%tio%A}KsiEyO^nr8mQ_I)
zJklq`28uvP4bBQGaX>{n5A%aM(AL>)pi?`*%R<;d8+pOA2cYf>XxMTMXw{|&s}^W$
z1!y<`Jn#)Ni&>QsoE%u$jD=Y_L47DGB~Ypb%@TqXGKbiJ%NUTkOrX||F{>SDN`(1x
zot^@#9rIf7=pgfX(0(5gXj_Gm)sBsMEu?L9r4F=C8&p1nig!*n<~59rlA!J+^O-tE
zR(a+vj0&tgpq{HSE3YVMlv0un)an6`+p;1I<OH|ISwY(aL0%SQ(`PFKx3ZYfhAct3
z4CGAESg)`Ms7hevlT~2#W?%xHUK0y#W`KAKQ2opg>fr0@LAt>+R?Hv4n_`&{*MXY#
zcUhZ2&0pwg5};(F#mFkn90ropg0}dZK_ivmh9PM6lObp@#Rfd%s=_M8#>XmVgtYI%
z0Nf8_WrOUp0F9L}vN?iAZCKfK*h)ZyA8hGtj$kX<1QCa)fR9iC7qFl)%@#d2=1yi<
zd0e8$%4f^UF#)tC7~Ix|>~`P;ZMy|!X(f<@Smn!DrRK1*vZ;X97gsQ{vWkKZzPP~-
z+QGk~Lcs=<9@&`huror&_CWha7@22+6|(7hu^KTy11p_XF#$5B^Msud>J{+hi5@GX
zZv;5>%OE@OpfiYikfjj+KqFd^DwH4G8ba*U&;jk&U}e(>)u95QnG(>33SH2)3PxK!
z1r|^<j}^AP1ESRqwC<Z<2^t)r>WV{w71YRL7J?Sf1&~28P}3JQNDnF>pvri`O(Iq{
zM@VZFwCW60;B&Hp#&$u&T2Obh3TS~MI~^3rpq7gOs~Ff?G0=1es~C9IjUqJrfHp%g
zg4<+}_A=-I8*oGzAuM5J6ZT>iU@ij>;()7ah^dH`M{)|FtqJ<zMlz$m9%%7(FQnba
z$R-G?aUdluD+ik(r27pzTL`q-mQfP4SP?Yx1zL*^%JOWWrGw0%np>C!bOaJ&DGwW{
zUSJi04=aGm8PFP0MLkw^8&LP171VQp?9?&>HEN|;)L6B^fx{}yss)+~0ZoH|gm}U2
z4UmwaKC2eEi49s838~Kwz$FKxtsZC`;0vNuQ~@^~R7zPH<rP>}6hXxhEEJ7OS;g4W
zSy|;lE)ZiAVUcDPV7^~t!y?Qo#=MYO0m=t;;)I#!GlNPhMUWU9^Me{j7GYLF<^>Qz
zVNipJ`8KFa0`@1U)BvRbLC`icVOB=wMa+zP3JQ9RpryV4Ye1De_?RO(aO#rtK{yKB
zt`P%gW#*g+R#>|R;zdKym>g&{AJ%{~2KB8`n>9uv;KnlxcrCzU$N&PU1tkbxs3!<&
zK|yp2gQ^zrIZdE)m`9OSR33D$6DOM@D-S<--jt6KbOh4Dbl6xSD5o&WgIXovq-GDz
zjF1Kys0$5heSy3!zy=!NW@P46U{PZ=X9Mdu2Sub6tGN;@j~uJH5~%4c3o3I!JMlo?
z7lWp31IQ@~tYBY&W^cI|ZNR%BA3)k@N}wbn&#DBT6IBB5!cel+V-;0oRk8-xS|H!B
zviX9I1J_D=kof^n{i4sJ#wyC(1L_=r&5r=BpWtL;{sLM+10Lov1`is5JG)Jw3080!
z9l=%xTK@o^y#r0paDtm9tm0rhK&^goUF8in{6DCz2sS*81=QnbZe#+jegySMjmw~>
zMS)kQGK$);$g?qD0nJN;a;6}w1ZerS9;<*oE29P|gH>_pvB<D8GQR-LCy9!HCr5vP
z%!d`22EyQ>08o)40!nJ2qfMBbnP8PHq*MmUg3=GT<Od&v#3~A%egvEN2oxNm;G_n!
zpG^VmEs$y@@SYK2Hc%6gNkmwb?FoxKs~j^ABXovyCL<%L!wfQ9U5S;$3beKgJf->+
z<Vg6GDvJ!rGiR6>S=B+^e9#$9%=>B;Smi<E-yoypn2#_)PFQ1<2hX-{u7wDng9+=h
z$|>rx8iB%3o>f{2wD&?<kyYImta?MO0!TS48}k_^Mqw5%=G~CFI2ktPBcQgrI-4-7
zG$e5du`znX8aJSEN>(B8l2Z6|cT_2>09yuRo>rcfRhLZ>!Uhk}D1x?=h_MQ4fzui2
zj1uqxGD;v}M#vg5P)b&WFxdoIg`u8OU=`Mf2+FhSL8ZYgVd&B_aGfa(QNqTLqz^J%
z<IBow#tK^Vs|qTDB3WhG#M2ZMSUGsXOV2>fEKauF;ByMZnn0l{22Sg&Vr+t}oZcYM
zgTf8mr2~zCvoYI&QzQ$h>R@iF(*rGrVv%8$VBW&$1!>93vr2%@j*}M#rwYiHLhv4b
z2{u7iX?+`TpBLQZQe>5869lb;00&_NIJB6&z+3H^LG!|3o5dh}@F4>rr!foIfU+5g
zX$#tY$0{}tY&zJ%=`aT~g0?(BMtm5-$2~E#g@X-(tZiZQ0u6#oGD4FwBO@e#Ku2Oh
zQ!SvPh*KDx7r_Aqs&#qU^dZTynF%z}FT(t{7Bmb5+J6nsJpVyUFhoG-?SYE}Vb~rE
zJr>Xq4l^is^Mm@#pxJiNcrGI-hqAIUw=ywGfrht*Svf!l41y=;48Z9Glsj12j7rNP
zeF-jIP#h{lhZ_|^%}?lVFi^V`)Fco9^_4ln3nlnKRxz?MchrJwK6y|NLlAs;o*XNy
z534X}<yN@@=)6BhIaYaZ@W}(91@9oAvVsm8<6~9^JCHe6flW~uG$qXl8cGFqoW#K0
z4sc25#mWcDK)lR}Ah&6Pdi<hn&?7axLBs5zqy9jrYJgfaP#wH%2EyP03sz9O4OD%D
zCUcFwK>K6CM;So6B(`kApylfzw+Jz(+OWv5s)AN>gX(;UYoZ}zovfgU0<~g5GiD&u
zAl87A55#GTpkv(lnB$>5kV7p&bK0PU1Q~($Vr4X8V?M{^1<I_<T%hK1nF6aiGkA?q
z0%)U#Bxw9N9W;drlVxR#WMqU)dB}kRmzR~5nG4i|EK^|B1f5&S2pY6x1<l5Rw++j&
z8MCsAg4>47WeQ-E6hKQK!E*>ItgOtH3T(=tUAiLh83s^=3JOh7J;4YX-%w-~WfKHt
zFmS#CEgw~61?4LdMMy;j77-Q(4fumpuz(jtal&R5ML@eSz|&PM%mSd?!2%{gJt)vx
z9PkDkPRK|NCz}zdX$J~JP}iG9k5$+fqEnt#LJ90ZRyk0{gJg3dTUH5qRs$2T67Uue
zPEfmuRg4wX<nsd=;{`rcicx_T%!90KVT7Ev#%K$XlLu=D?GFS`B!KHoP!~=gG|LF)
zfr=f)C~(!Y1XNE*fa@C`J5bCrvN3-J4>ds&2WY1xs|d&wtbEr%xk*@zRfLU~mCs)x
zf(4vkA2NYwRzWGo3gp5Qtb7x|g$1J?D`>nBIz0iNi~(&vhAxy%V-+z5B_ZZB42<A1
z3sk=&SCl+#cA(u$dN$xwfSAKU>mERLxDl%Yn=t6SK5*E8@)_tX1jr&)MX=XdKnJ0L
z7BfKN8WM$qpau#!1%P80M+#6?1RbHK3Laes&p?8T1VvCC4?YnSWE2x<z*>ZPZ#}3$
z0?h|ORtzz+2`aEL?*bi>C<^LC9A*He&Ap&S+ib=ntg4VQU!GM}kyU`%NkM^C6;ug;
zn4qom%=V0+JuvCu;TIm}0!Wqw?STO;3*iOz?^#7y`Pd{uZA3<99tBoDaB^g>1Z5~8
zkX3mK3ZOw~W>L^O3h-JbkURK58?_i^Sb5<Y2wY@U>ap^J7F6i5@`JYXv+09M98fcs
zlPw*oxDf{RPQg=!??CB<*r`HUNO8bC0n`UzGiwG9+kmElKqWD#S;NSdo~FmhqRz&=
z88qGoo@ikNjr@Z5p>ec>HsP>xfaf+Kr@Df&Fz7f~(2yT<{5)`a1sMbyjOPJWAK>Di
zRS#5p8<m2pB|$_Z3bf_`JSPJl1p!w?pd~jtdaOnYpp7Oxpt?|>Rho_23pCwi1}dn$
z6j&9REkPzTgEn!nii@#Ivq?#-f`);mWms8NSk*zx0>I^xG<aM{1GHKjl%kb{h1n!n
zWk6%;tZa&G;;b^7;EV&BX9qFBQ%<aGc5F7RX3S=cpe4<`a;&V(J_=y#Oc+@e*+f}+
zLFZ*EutF>rVP(}|l?JWlQ<nvmj|yNjRgr8I7G@J;1v!jO5sN*%Y|K`Suw}B=UZ80W
z(7C&yZM0entd?G&nLyACD60=B6hLRRu`+|sXX6EptAd7)#aWfugjtQ`L8qL6Ds@m&
z0o4=IY>eLE(gflu2k<sMHbr4J5mq(GDN>AVQJ{H&>7Wz|N<W}eCP4>+F|sjF1(h?*
zuOagSa1Llp0<=qkkr6bw2H6z`>OO&HOm#t%VxWFM=o}1i4g;N<na0Y_Cdz8e%r%dd
z9TX`7pm956IT(jmkCmOd7&KzWr2uMeg4OVVqLmr6H-()!4isyk!AWpug-wiA0o=Y6
z5eCn*fyyP&Xc!|~6S$iVDueW~4z0<;TK&eXpgs~PoWwxQ2k^)pXdXut-1h^`5i^2!
zso1khvGIe>WZ`6E4sQbYo<TN&`!bMmH%2z*`JnLt#K;&AG*>_hKIkCZ9R@}Tkg)=+
zJa(*V%ya6&gEB7}pwj@LMe$0I838#~0XPeksf@vmEJe^D2z1OW2{LA;2OBP14?01V
z0d(dOsG0*UAr)X_wuf$zTvBHP+N{CKrYI^5E+;@o8-t?R4^)Doox=)hf=IK0jtCM_
zP+-*q86m=)`-FvyRSz_Q1YYD0wgb9uBnMovfSd*zpOFF8VIY4wfGvV-Oe5-~SQas8
zc_a<mJODbonhiAb3EFrFIu{8tJktv9+=_yZykul!u4H62P-hi10FPg@a;mcmDzS2c
z4%1NrjfF$E*Q^3-0hdLf))X5fix_nF@Nyk!1T=;Pbdu6!P%0M&ua5!w3v_rNGaK_O
z=wYkSBX~f)7ALUsK7?{m0I{+$e*!PF5n`SXmO-(Ojro2ZB+-EiLjiDSQG|`T3)IPg
zSPAkw^Bd@n|0$py|6-u7;MY3PA_fr23T~-@x<Aal;IUm{Heb+c9}!4HAJilR&8&eN
zgU}5PoNVf#mMaT4s}LJ=FW4>=S3yJjLmeY4V*+^WpNS2$vIvy6q5cJx<0g=~MMgH}
zgWzR<NMSDkw#kN7K%EtIYzU~r=hkIa&}Ze8W>ruHZ6sBY1CcyRtfF$P!fdjvoS;>@
zLd@2n-C(GWkpQJ#W+z6_j!ZBc)Qte|Q3f@<K%M|?I%I|P4dC&}$p+ef3>q2%&k%zr
zC)kuglTB>Q`#@7o!XW2@1`R+1EdpkcP4xnhP4%n-E}#figk*{Rpx!<1JOOIlF;4?^
zdh}ShSf!Z{)qz_ddR}_FSj1RGm@hLbu*xwP=&_1`R(Q)X7l5*n9`oKh8x}EE3FgC$
zAU-(nFz>AcwK5q&$qb~Ak(HA<Q$dbZ5S-k_K#3ZBRsgRss}q|7tF;1X^RzW6F^j<B
z0G>>FLEZ$d;RPjR15jT{546sklQ|jO=~D&GEDC#pX4{!l^bmbiP)!P12`<Q{56-6(
zV7@12jgc6*NzBOn4zx8F)Xw5$1C`~VvW}BE9z2YC8QfqHW95Oii5S_K`9W#9P=S?^
znIE)h6E_PqQ(Xud*%OCk8}MMC6uA7)C;^S_v9hw2u?n#XfR?xmtFUr}unL1l@)bnD
zlF+kj!0urKEiD682F7d|a^R%l$Hx2#RLu#4Tz4PZU}9sQ1sZ;0epU-|;4CJP3(?r1
z@kHi@&@m%q7kPo3VytW#=#~pWPq5=;GiC#A(_yWE%prl2dI@OX7U*aa<|uGxfQ*HE
zgFE4%B*V(atOEAD7pR#EYW;zdGKgKp$ZDVl?%P5eG>phJry8j3!wIg{*+54x@Gy5n
z{K&%wUZ}_X4RnMzo3ITVvjJ!X9ok8&Vr12Wu5n{!(_rOcJ`WzGWz}P2Uds$xk5Q$-
z%BjZ6!+g0$Ap%?uZ2}2{ww=5N56p>zav3k^90kx&vjAumQ<>F3j+I9VL~<&C7|^mA
zv_*}ZRfLWCIk-dtr)F#=AS)YqQ4tUGB}nQ7%|nA4jq9N$AoEGk?7uLI%_6Kk%zq&s
z7GPuk$H>Sk#@tk=z-qw!AJhS3Zmd&)aKNKlVjw=K(=G;DO9sv}Es)>=pH_h|nNgEf
zKoxu}5!7dTV4vy9fi_z6z-t|t&kR^W^CD8<x`qe6U}t3$04-jEI1=WkX%K5crGx|<
z^968_f_l549L!t<YTV&C$sMu)5OHoh59r)>1<)BSoXjQjz%5x&tpG9}-0uYyaYSTt
zaP0s-x1C21)aL=s2Y|ct0<03yVpKwdRUR~DRieNuSq8QUw2>0jo<gS~iCYQOeHLT|
zHAtn{K$#iTod;DhiXxz*36v{9<*^E@5}N?1=P07WsxAwfq7wmC>7dnipp&UZv_U37
z$MZp^K!(*pQ)-|*rPu-*ZI57;1r1<>kAY*(P+$e!$RG?V9$9(W(!tY@pcUt`Y|X5K
zYzp9QYoG&?L8se*_9%mT^PJ3ljEsz|e2^ol`9KyKu$r=gyQbhHCqc(`u^F&(iZL>Z
zL#zZ<?);#kM8zgHWmaCuXeY=%P_Gxf?Z*V9kQLN<gQzQEQ^pWcfs259O`!F@;1zJf
zpcWi2o593LR?arK8i+aI;!uK(*^?1ei&W?#`AArpmDdnl#LouJViOtrEV7V!Eat}y
zdaM$l_LYS~i5?>xvka)nU{waSHw0OjSvi@f)hn>bvNAHiVo<=r*MliwgetIsX<${>
zhmOR7Cjhq8F|tZ9p8*G~B529>I#9M36&7J(W@UpddF2#iW7J~-ojeMjmIs}C&H*_9
zpV0==5rB-Ag4&^=2mv+mWk5oT;MP78lUEURmJuf?vcYRUK%-%7PORdflN^*;#bs1j
zWffVun0J9TQZXL{&7^~ra<MV*Wn^R(2hTx+(mEF#^B%Ck5m1!}QliEt%&M!vDh}y!
zi9`Ap%sUwwA&V#2>|k>NJO-?cilFH(P+M<%9dr;JG;hPke2y^!G_VCaHBo2*t2B6O
z6yzV!j2R=dq77()40956F99d`>={mP@Ch_*pb=?kwi09GV-;3q6#+X1G8rNSTD=5W
zC#cKH>kY26K#3G&FfW?{3o|PtGh}5vE2lV{f{hI*`gqxx|1mHMgE!<bF;{_Ol8w2&
zo{>cs)CK;)pa<612}xp{;w-YDM(0O{G;oyngU$#5EBwd+YpkTR3V|j|74=vpgjt1j
zpeq-_LsM*CprvYzEPSBaZZo*`E(%&m2R>JYl^0q|!RY{SQN;+#D7N5EHRxas(8Q@+
zI;#t)Q1Jq7umZCbSb3EoVmcs}wk~MoTw5M=LKbMd0chrc6SRH<G=RhinnMS5^%X&V
z307WE%!>N5>M*j3>Vg+H>VQfP(2@mS@NgC=*@9X@qM&LPQcSS2f(FN!yFtlVL=>E7
zVZ$q|pz~rueI`~mZ}7N_G^m*^2N|RVm4f~tTfJC8t4Bd5v%yO_VNfXwYS4hrCShe`
zeh8`znJ0s56VSpuP|T-8+t!AVG7n;h0;?Qo>KDZh5s+iSBWR!k4%rUS!I7Yi3ZSb0
z787_pmU(I&WONTSk_V9o9q=qI$jSq1Zh)F~@O|it;Pj9I>Rv*k2h?3<WCLxt;$&l%
zWCRuXkYEFk^MQ(UK9I-wS^1PfX@-qC)eGFy7G%=}^(aB{2ucy0Y|MS2v*|$-=xq9+
z2^r858a75&ITTkw)}3*(L7Z_Pv?Wdii#rz8GlKW{F@sVXXwx{Tn+3KCM8I6Tw4M<>
zvI^QdAO_my3hL*A7$B$XgO<~RCOAONALe6Bpp3xD#ykNURLIT;xfF+=79;sd7F1wJ
zf?`+;REdBR3AplL{>Gq(5MW^fxj7PC9D~MPRG7s<%eXQXSb0E`9hIOyv=*o>8-~o{
zVU`7nC4*wSMHo~qf(C>^<qD*+3`!u3tfEG&d`hg~u{d>*ji8E%mpNTQfsI)TlpbJb
z)qp46KtjB1cHl}?1$=ltXjup-D;em4)&heP3n!@e#Sgk%$Ou#vLk_bCO^kr^1Sso4
ztTzVr>v@?^FsuPB;bUVIWCPvY09hl)$|tYD$}bE$D~Okk*}_YhO~H$mli3}V?>T%R
z+nHGT*qA}vv|)t|vyL9CAUF?zGO{w*ji5zJ;I;msnJ->8rF1q%Rw2*;A1@oT4_G;`
zD4PPasu!CgbDW+SNRI+!uLJYydK(rFRsrTEb$SXcOi;l)jEvyJ8<?+yPKgCqN~|K_
zb0ijn^1Uz%6Z2h0Mq9ARDzFF}BMTEKeKB8U1f5$f&b+z~Vcb<l1r`ogkeC<TimQwY
zY#;*!*qGPWMSz4s-Ay({u$ik-&AbBXy4$ewGT&ohWESvZW6srM(_{0_2m~#0XXRC8
z6_sWcQ)1<0Zm$R3y#PA4gcEe30jntUHwI8R>9Yz5v+{yY32p+H=fc9Eo2Wqb1865Y
zn*q4I;#5*#<p#IQSVcf%Z>($vY!RTk0JQ&<k&U^#9+ZML*+e5)1wj*iimbfM{}{X=
z!6^jVjwTOX@e5j5#k>;a3rGb8zgkQmG${+I6hYf1Kug_u*_f{~>VfJkkV8SoqJhtv
z1|4b!K1UFq#W>jv*!1*R`PukbS;5=7K(k!e7#a1N^w^leyRAUCQi0c@vVsnP1D&MD
zsLjf%B45g;pbyR&psUsR*qCRtfal3nK|2~*!RJ(ghtXI;1L2@mIiMZCtg3AK!eGG2
zC<0mSzzJG41xnS7Y|L3Dth~(PjG*-$Y|QbD!Xn^?G_wY%YGY%r^a3q2Wj+R4y8vpQ
ztppe4;E`JJ!Zqfr;PH8TQOMYbAZS`%nazt$MVM8CO_-H66?9<&t32COD8G0fXqW8r
zT1H_JR#DKx16D?6&}lfJ1vlVAN-u(ipH+bQB<LnGkpFBztCzq*0bKzNSqBZ;3k0bV
zz@1%b@R}~>H0Wk3Hd|I+VK&gt15kA<zy{h139i&YEizDr1DZqtEnxz$oCcLJyuz%k
zM&PsqJLU}}%?Yk5*+3&AEMNk(t&>R)QoP+Q0Zr$EDhE(Ih!wUM%NG<|90lM(Co9M?
z6Rf_hlCmIS5DA)4V-r+lvlWI~2bxI)UkC?s2dgl&9R?l&0UZZ!1KQ0S3MxuPSsB^*
zSUFW7i}Ao4#aT7j^dTVK8w&LGZT0o_q0?c;ko_cVpyj8a<F>%fNJzMW(g528@a<8I
zpcyLW5=L<U9=u=@v|<T7@uml!4`cxisj`3yGf=(G$jr+KEnh;wJ6ga?l<7jS@-U0q
zfP0-M5yugNM)l=Ei!(SBSlK|EUPRe!yx2~$HL)^^*nrlNU91Mh6eRe#z!{2b5oDBA
zkCly06Lb$DsOEt5LBuA`UnpD(88s<o6$T|}#j=gU!ljVV;Z*T}USY&0z{<+ZZNsL(
zmJXW#2W|A_0j*-^Rb}Oo0WC}A)lg!tP=Kih?Ve=>E!JjZKE%K%Tnd_B2AwMaNn-r0
zte`_(ATt}#)x4l$7}SzB5r&+k&BNx*qQNT6yc#t4A<SyY23oxaZi6vjVFpE^5qKlb
zS&%e%=V%&akJAliJz+K<IW|SmcAQ4gh$ZM?7SN%Sk>LG+um!*1A!`9P(5gUFVc0P)
zpu06HSb1gGl-NvIIoUG7y*Ew;R!ML0;4Twr<v1rZzXBv7DL@3-K(mj$pxJvPwpLbN
zS<psMW@{VJ+Iw&}h?&h2RN~g@MS?FlVP;DKwRpjIO0mg77O#L(95lFiAT_3BdL-n)
zmI%;xV$dm&jB=ohRlxltIaW?kOesU+O%b%w1~hTz1=<V*+DZHyyqgHRem??S5`#Lv
zoNS<@3P2|tLbn${me+#g#0K2HWl96x9s*u3p2nunA`R-p{;7s+7i(bwEiPnaWBvs?
z?;m`UI%x0-zAzCI{QsF5S)@TDLrpcH<_)CT2|9BcwwM>Ru7p*PEt6GD4!nvH+@1sV
z-asxCVD7KCVHIQk2$~B9HS-ynyTBD6sNexrdxH9`0^lALI5{vf|7Brh6<~f@cLLHy
zIRILx2p%fpW94ZBP11pi8D2I<@B#3q;Dcrr<w2D-8?zVaJYZ0ZgH42$RhWg3m5Ytp
z7}N?7VD`09VBrIK!Why~lvH5l0?ieJoCzvSL56}_Yv2=+!9yLOac&z0(2W3Wpw+9O
zHWweL3}plr8IS@6)I<eu!2u0&ftq5Vr6b@3-2~pO%cKKpMs|bGZUC(T=4a)IX60mV
ztpmHA`5&VKXjSHKP?aPO+ReuZp1uY-iHnU9Jh}vmdeAT%xUREhWBySGTB{E=D-*Kz
zms`OLG|K%QYH9<-)SsX_A7ZK=sLP`WDwmtUERdlMjG(h)K;0QgX$qQR0Id%Jtv&#?
zNQD(a+r>amfi0&5IRUi9h*3{O1hV{tBMvmo3i1MYYYN0NF9mQ_2DT3Fg)Y$WFR1Hn
z3tEwWj{)Qf(25sug&+u;ga^&ubA$FvR89a56vC3A11o5>%gP3nV_210CAE=jA$_bh
z5NLG}$lZ|X3ec)?VbBnp4|x42s4>qCn&xB#9m&rP8eT_Zah9=itFuaiM}0w6ov^Sd
zw4U=8o-8~O+@=QgGdV%)tU#?W(1;i4`UFrK;AArbj|P1N7h#}@Gf*E5eF_k5Q!#9%
zKrgcbs|aW`XfmUMmlvqAVt!Gl2g)X_pt2cK^+P(Ju<<x$u+#WJ<Ab`0{syS`&j@i2
zWN_*pInG%Cat>(CB`X`Vl%6oFG+PV!j9XS-=G|cPzyn7QAiY0MG033A?D{lN2b1|J
zg92z|gO!aLR4EC8I$f-6%!ip7L8*|Hm2D!p4-Lw6pxZM*`I1wCRRz?C0T%_VCZIAM
z)Q^H}+yU*q0}VQWW@|wkB0(BKo7O-yXy-DB2G#7~g~XtQ3feTmDGDj;*+BcfKrsb9
zo)shqO6s7EjG%4`sD}hPmmGX2!gkPj0Q`6*7Fp2Af=BBZSv0|y6EQLG0nN&QDmL&8
z8hDxMw<_=)1LDw4nA#1jpaXS8nJ-i+uxLVu{MNH7fLDuN1dD;zA~G>=VATU3^~cO6
z4^aiWnU+nM%?8@<0$;QV+P451=~aZz$%DKkzy@mUGlI60fREl_(*@U0kZuZi7}%Z-
zG>ilqb75izU6Ke|BgPC`=%@xBAz%V6<Whr7If1GbCD49fP?qOWU{x|?6|sSANVjI?
zWHSYKua%5gMf6~TDr`oqvTVZOGY1*v!KY}bfcvfB8FgdOmMT#6@Uk&~0oO42lMHw)
z6Ov@W`kA{}7(x5=K+|uakpS?iN(!I@rumq~L5G25f|dY@gVxC9gL=N8jbflOoRh7T
zl^1m33#fQw7G`AOWA3h15QTJrSlNs~CDuoz;t^8kAs4wFI7>&!cojzJ2nu92=BLnN
z4m3njug5CSCJfFDb8A6)L6rFscu@nWueKFS24eF9Wg$?00c*mNgE-lkPcnl>LqIX#
z42}(6HfCWjaMx21yiZ?MfK7pwM+;QR3+S;zc+3T$jv=!uWP1wuU^@{|%>jyKC{Gh~
z`!gpSs9g-nW{}h7K-mhK-N21Ua2pL&yR(4v3h0DTR(M{4WDrmjjXv1}T0aq!N0eDX
zl>(0q<S-iid1O{S<bE<{(87CFXddBJh2;=21;{;FhvAnmgZp-@pna{Nx``3oPXdvk
z4VbJ7ai9~2z{?m}m05Y2L6<~>HZ`)AgZfXP_7N+n^(_t>0~1hSm6V4J)fz(Dkg$Wf
zK_`}gqZ{0eQ({X6x9`A9shQclz$<d}SjE}EH{@B^%mWP+_%?yJRDw3ogBn@9Y(^}g
z#r4Ike2OfBth@?rilCc{uv}#Xo@xTk`Gb_P34rGRKnuk{g(b)!(98~K&<u1SA!z9o
z=u{lg(m+O5No#qK#hePPQfwmntYVg|AU#rSBCNb@^59uWR!MzUB}G;#&>*QI<h%ut
z63}D<FI%KAXoOM#v@@AihK&z&v^l8IVgwC)fTpqpSrs71_&`KJwXYznt|Dkc9(0i-
zD4D86vdV%AA@Ev7*qO(ypu?dUK^r}6L8Da=w}X}p@v@147921zv9K}+fCf-m*-BW2
znK>C*MZpv9pn?mu0bi00bj1}T8}mL;FBH_r7i3if@8(gP&&nvzss`Qzq6V76V}mtY
zj3QYD*~D1|q(NOX(1HD+<<XEH1}J>lBv}PP3)w&|d<g|s(D~#bVbGv7h!%m|=nZlc
zGpNPM44Ny0wl~0oM20M&-I~nvDnTw|Wq!n_0E$dD=Gowl=b&LeSd$i1&w(04;0P4~
z)wB0O%`i4$8wCYWvk}}&(PXs%jkN25`@~G(Jyc9=pyo0o8*?vs%{QdMDF+_9kON(B
zufQs&3|>S4^RWYHH4Mn{py4AB4L-3OVk~IAE$B)bP+vw2bf`Hi_&88jP!kNo0+kqS
z%;n&ujO=4j9Dsey%%=zO^OtJSKs76K4-3@KAHfw1PCxUpGBS6vFzSI8O@R*B0yPdm
z`%a-Wc;OGLls9NfiC2MDP@h#)9~unIC7^~rC?Hfot@sX5KZKc+5i%0S2<j5>!Pk?*
zSbD5r7HEV9R1vYVl?n?pGK#Wjv4T!K6c%Pt0S%%SGO}oaEn$RQ$qG6!7Zd{45JAuy
zG)5a1(By9gcsJZzh6wPu2eXI*WNa&ok(HZS47AA<lr=$3chKd*oNTh70YFwh1w9rP
zkdrqvgN6-2!;7q-bC7shWx%K1ii1ux1ub4=1RZ<951Ls3wfaFx2C_jKbT$KMQxqec
zuni;VpeC^2g&7$oAl8?IPK4tGjroDj0EM1D#ltKE>K&#iunL1tUuI<lFP`LQo>vbN
ze#8LE1)v*q8Nrw6vNF%A2N?ibd??7g2CU`^sE5eB3e3KS#s;lEW1a$*dddL4OADmC
zTtN?Xtrn<L;|)5Nm<zOK65P2YvgyqUnYLhl&H!pZ7{j%LW;i0jeOV9-)QkWvn-zoI
z+RVcy$|?YwDF+X7K~g*TG)Yc2W>A9|lDNR_49LmSAX8vF{6M8BBuk333WEC8P@}=?
zEx{28l7*@QSG(Y}`;`H_T?Vup44lOvD}IGRvz;KdlHjh4irxvZ;&RAT5_lpKdId44
zKVbk;4XO4)1M`xMET97hn0-LW1U6#J!U7p`V_sb!!OEimQUN+^n1uyYcr35igA8<n
zD<G)$s|<`RETBo&HT5N|jLhI8U_r$!Xki4S6!^eFCN^t`so**bw0@F@%@AZZWa^pC
zhE>QGbT+dvq~3$50!6DKsJ|7&DkulKTN@;x$jT`US_24LSOcomxs_RYLG#s$pbCKz
zbax$OFag{#0<Dz+C2P>GK=4Q@D64=P(cqz9P%qy|l$Dc>pOwFYl~ab57c?jf=~N>3
zL5;wD70_%W#4Ol;Han=e1B?cbG<R}>x_qpR%>Te`JfxB42JkLT`%J`0vOXL0$1=!u
zN~~<QplNzYQUlo|2HH{$s`waLIh9!@Kz_7kl>iO6aVmi>i;-Zii~y|}5>NykmI|5?
zS7em{t+y5gb#M6<SjA;Qmt^qDvGS|4N`ZI3vKa`A2#bJcalxbP!l20;(85N3W^T}V
z)oh@BC%ljy#Go<~bQzr-C}V&+(aidcX`o1UDgo_R7G>p;1)bsnA`L-o@XRi#Pyw|W
zA?e=$bjK?A$QVII(8+5e3al~;tisT}9-tJ$$_5%@1J(cFt(=bFfCSkLYFTiyDS^sO
z$nqr6U?ZrA1f6vNqQPaP7mGf~MW9RGq2(zXNHvQ-s~q!IP@xLi8NkcN%;N=`%2Wic
zIFN(3JwVL`P}_r*nU@iqhagS{ZAOLIt<M13JkQ8x4_Rm;z}#40!Yrp}WME*zD#EM`
zS~JTBUW*4_<^?{}88o=f3O;uYg#?e+LPd<&zz5o~f>!B(0t-}8fFc__2OtmX?=q)M
z01d_pvqBQKpgd@kxS$-QjDcu@6gu3Xb<_$(By-TpI?x#~U?T-V+f^X_VNfZ<4Z3q4
zG`*|{8%lxf$^~T@@a#1!o4zfm<p~*!n+uvNfwX`?hpgzbs@sAteF5$85ocorjfR2B
zGH`bdv?H{M6|~Pym6ehCN;UXcQt$xWT5zWsv^H88+@WJ-Hq-;v`H=l|daR6gHlRA^
zOAV-00%dc^$^;qc{Dc@Nd2>pG4#Jel0p0x)!78H$8ixWkK1Dza(sDpYbBTa*H*=8!
zXdD?dG9n7P(;2*8Rt%H??ZAB|SXvbUjk-vJR^ADMQUE7-zz@_>2F<;J#vDK;4VVvF
z(_jOsG!$5QL1nG7FnE|1q7rgq1E^Qe$mYz-$sC{uUev)X2r2!*Yq??lV}zd-Aot>c
zOoN<Df=~|%Mo=0z1g$-Sj_H8%6=ND?qyVZF)Nq1?p8|BPF=(`&3Eb3UmI4JNXc!4R
z%>$lf6J-7aUW(bm1gc9xn-3Y8n?bv!z_P5&Kf$u?a1r4aPy&QiPM{P3z7bMLA5uqx
zI@FNOF`$YrQx3dk6;dFB&o|&<6Jr&SRRFE>7nWxQZ&wA6#fY#9KvOoT_5>&Y4(Jk4
zRyG4+;nK*`$Wm5OHXl|oP|+--56Y^LZagUJK$ART;Ia`EM`COupmT%8lvpKnz$c-C
zdRLrm8LVP#0<4@$p!s_n#wVZxme~VR#tDFmSjdDcqNXqgc?Pn*S(q(?RnR~l>_=GJ
z98@90+X0|09uOa}^00|0p!fz<U4pi8g0eSgp9yGX6{Hgh@+YF%3|i`;$jlSLDh)a^
zToJUb3Csd_er&)kb4CRujf{+-lgUAYUEoR#G-jg@a`IcyD6$BsY%T-$jCDbSm(WHz
zC|OECk}0T$;4wk4L8Sl>8@wfgT*82)KurtKdT>w~07{?C?a(0(UN(J5_7#WB6@#|_
zii6r1kZahXq9E<ib05JA-xXNJ^uc%9Fv+u87_h3@uv#d9j)OL|29F(Cv4Q3wbXl#~
zgjscT!H2P`K!y&*!EGK^wgsSqi1{|C1t7vI%p4CMc>`VK$;zyNREmI)7hO^Z>MAg@
zG2dfk)MMdf6=42e%g6#Al0Q`k$`hb+0hA}8{TguZ22}g7f)Y4CtDHTk!2vH2*_d-c
zN70LdOZ^N5R#s6~F*a{#Qda>t(Dm7vML_q?<bX!AML=0A7sL_<End$7k1~O7#09O0
z$b%#TXmEoD<OLY*pnhBj&1aB-WqwdOUkaX`)?;OK*7IV~Wdj{_#0r{52YVlMR4lR=
zU~FX9JAgL~vdS~(C@_nFeUJ(A0h=DHm@U)`LTsX}DzdCX%%Y&f_Ol@l6hin&h#BG|
zJys!RVFl(q1<?I;a-cu~B@j@;1LZC7v9|({2`^SVRv`~iT?fAYfE6@q4qD%f<|7*$
z79}>wK^>rQ7hqKfA4h>gP6FL!2yPv)vKcpnM-d?nYgSG%7A4SXxPJ_3po8utj9JBH
zSfvbE#pJ-FXwCI{3M`;wK$(9tFoHUXoNSV;LZEhmgc4|B94L*0N4(Tnr9fE&#OGua
zXO+-ol~M#vRZGf(E~Jx^1C7i}>3~TsRtZpJRUdr147hxgWD{f+0f~W*JciEE*|73}
zZch{g?YiP&=2d_m=g-Eh&IoG2uz|Msaxq4LHVZJ9r-4RFL74?Kl%dZi%<2Z7Bi;?#
zNhtzaS_w%!kfIM%IfD)ikyC_Rh$qaV209M=ULELsQX%F=jG*%_c$n|ifqV|;g9>km
zqPtK<i$TNOY>E)UJ77V6<|Pn8ka?oaH$elWpwbRxDtL;Lc^P;~1+3@-turcxl#QUq
z6D!*!RvtD1P*|t4@~{cAaw~$aT?XB_13RBk3FLDo@X>Tk3M}AM=t)jK%mw8`q*RQQ
z4?&GLR(L{X1s(V(2TP)C%tGL-2g(<ay)U5g7e+Q_;<BELo)_pKl78?3=`5fY!xV6l
zD*{>t0_ku+XHsA>U}a^VS*rjNU?$AhLsJi4e9OEV+;|NFl^uEzldjf*hLBmAS2Lbq
zF<^dI4N}L+{Dc{ze@=}8n=+^a%)-hF8iW=GuL0f!E+rWmg+;-YKjZ)|@US>I0Wu;;
zJ&?z4)-ehTvw)7A?f^x-2)O6M%H{*o%qa}&|1p1NWMna7Wn^xJD`3%KWn~WXVijUe
zS70$>m1aH;>bSEhA!+)?2rhJ)&x1n?;v5lBA5MskIURHelO$-*rwC;1gAKGbj1k)Z
z1G#D?6C;Z*D<i1rW@QESJw-unZSa*rBCMdLr#!--Wu~ADUKlYnH!^_|FC+68uzQiL
z=4N9CO=B}lC@8R+pxic(WOWN8qcA9yGB1N^7lYW%X2Z%O3>hth-cip6>H#w{UuM+%
z!~!~PlX)&9qz4Xi7ZaN`s51cyZ^)JI;N6RcpehwS(!$8>0qQaeL;8Q<S{;<#4Z&?c
zP@xHFLKuSgt|I2#jadcRL|BD%K}UQFL)-A6nOpGuGdPWd3Kc;%K2}y0wkTE}=AG3b
zYrqF|@F;*fxXi~`7+HCl_d>*ZK;1vp5(PHq!z`f9MB8A(j1iEwCi4jva0$=K!@LzP
z2Ri5jWE!M|I0;d~$S4Z!$%Do$m^W23vMMllgErprv9dBZF)^~pGPl$zfHoj<GMj-$
z8d*U{WwXday8p}v!NW0%U=K?xfbLR~2A{MKs+<{_cYqTTSdx{^2U;tDj#z|^un2)B
zAt3XJpb2?!gB#>uMewR<L48Q;2h=Z8WEBK0IRyt9Xr+oGcoGBDmgi7_Fu}K4f*bVU
zMdDBvXz>Q9am*HzURu@+S>3|PX4}lx#Kydyi4nBWY!7%G3Vf(TI&{(#a$F*)<;u$p
z*%HQPqsPk2{F9MU0X$62#Kx?}2nhqosz@d_(7m>tY@nU?tTK>W%RpUtZcuLvR9AtL
z252D^^uikvW+5+#Wh$&(psrrCut=1!Fr-8WFMWfQ=&%h4*O($eRRHrU(AhPhAqM8_
zOpM?IgjRq88KxK<KFrsd(!h#W!WG|uDqfDP7&O|;$b6FtQVT7w1r=2g18y)yfDQ`-
zD*!bwAiL8+t7bqeB-ofaBhp)-9olqIe-w1;C}?pX=!P&>=52KfY@q!HoNUa885u!E
z0joBf2<RLq&{5u?ao#L&`bKIMf>w<wfbt!rZxjJqPtPpQ$fn1l!^+A0p$2rJJ7gso
zwmiyf0L`8WAafz>DG}MxAOn=WKn`M6V9OAOb?{h0o3TO5F+dkQG6#Vhyef*UoXk23
zES#)-%y&T(<DmWt^Y(hsnyoaD*`V|i2tJt(T(2v!vTB1?%5Z{DdR74)M+j<Sf%<`3
zprO|=P~d^~Auwx#DztD27pX0&4w@i@wnM<(Og->XIm~R#!q6KZ;K_>*)H3E{wgENn
zLAimE6{LYV98{`+S#0vG;7I~dAr8F?U|YQ&3ux6TvjzS_j+g)h4`8DOpaUbbo&u{F
zb1>+nG*(t-9nkT<V7D`ZYYY*1c(K`l+OKlZ00RXVXf_2DAk5$^qe8&tpfEUF@iRlh
z4W*^3&Ip}(XBGk_mOKRoI3F5Pu=D|%fdDn{nEx|?c6>6jnkcaHc(I!3f#%*pr_z9$
zZ`{l&pu?$|)j^}vp`fT01|?)@R7AkmcnKkAU(lE&4;%BU`UqCgVIa)c7;HfGC+J#G
z$l3HFte_3*9H99~18}J)3SE*H!K%T0fC0P?T$I^Ck5z-&PJvZSmQ_|6ymZ?Je7*;#
zKC?j+cvTr>S{%GS<sK-*f<lpqy=pA5L+=+bfx3EzjL-x0L33lWY|t&zUZ9~KP`^cw
zRgAfcQID0IStJ5nr89x%rP1p@5Fex_1GLC|8)$PqvjK=10O~=426#a0GC*^e;%xG)
zg0XA{;2Q)46+qS)fyNjr*z~-?hjNN2=&_1}ZIlGh+JQP^l5F1K;uN&lM+S6vmH`VF
zD;s2|h%k#1s~j8i2SzUzE>>3N33UpfR<a};_`nxAUQomcvVkT6HP{qb1r^fRK)do~
zp=TjU>9OcBJEwtbZXsr$37{b-3s6+MK%*K|-5_dc1K|utMln`K<{XeT=uR<VMpiR6
z@D*dWnXJ&n%$CN+EDgE@ON7}T+@IrNWMc$PmoYD`2MO~q-(~>kPBt%A(D@WR0&F%c
zdXV+8pq7IOcqIyWR2N*bdci6X5jI^`R-;T-Rj`e$Joc=tvY`Dpkg<Ev_yp+kOioZ<
zV}+JfoXonAVoFH?)IjG1H<_WAP=k^SQXvKFe1J+NZBVHc3Tm`~OC>E(sRYSvAX!b2
zEGSPx&d=1qSvVO(vmCg*0Zq1ok_l*QGl&Ki<FMuvxFk&g2MTyx23$~KE3)9_o}eD&
zC_?a52P-IHaDor*;{Z7ryz&>^flrT8WaS1;sxmUKW(O@<22J0ACioRtc_2e$phh!z
zu3rSY&7HMekCl-hoYWcFKy?`-bny+y!OU!+^@GCTdK7#Pz6fZc1!&+IR9b-M(s|jK
zt8Cbmpu>?S;2{9;)Q$mY%$n61H2mJo%E;^sN<z%sjNoZiR(RE~%gO;dN*hv>f>wp4
zu_>08va*(en?;;#w&}?1(o$v-&|!vP!=Nhk85t#58JSOmW~f2idy7C8!Q?<&u|Vfb
zfo`5gtUR+}KE}c5#l|ek2%2_gepCk50ve42xeK&l4_sYA+a@5dfo|vHWMiHQni~N{
zCUX%ebRf|QW`TAgu`w?Mol7AJ8tV{bwF4g*4eBL7=g_l>@M2@O0reF@&3{n49CU-}
zD@f@Dnw)0t<p3SH%F6t?9Ap<Gb1w(z@<R|Gbhsjj50ifax?KTu2RSGzy&%^Hc5~Q(
z)<T0S<nNHCEokDLBOP?o5G$L$2wMajWY$Llw5Jl3(3zWA7#SIbeLz<YJ_9WP6A_VQ
z<z;pN2L*VF36wmWS$UZY!9rqeVyr@-7MVUcib1nUkO~`e?x~0`sNiO0QwBBqK_e`n
z1Ia+EjzP0^tZdBRSV6Y2x`Fm$f$Fqoa161s8I`i~FmC~u=AcG5BO{w0DEB}@7Q}+~
zr9dN0N_wFA9!47lR?v-AjNn}XjG%1B#=MLPY&<XXN^q-{l?S}T1Uxwcnt%h3zVL{G
zH+-n7u=0aO`VH6^nV&L%u4kPM8l_-U1>aY}2HF<`?)<?*7_??cA2d)Z18VgsvI(>4
z*=0i3<A5Rnw7f$fv>$<aA?V6b5oS(MnJ2=$x0aEWMTAuZ)K6m)0q@GW0XjZQn9YU-
zw4#K$jhT^67_|2iwC<LZd3PP?>aPHBSVKx-NI-M4G4E!EG*dw9{y=AlakBY<mJ2iQ
z0-f;-9;IdxVLrpI06D1(G&TgeBTW!8md*%TuOrF~I@B3Fl*zn?Q32eX0(H{a^u^&l
z9bT|m&?_!LeuFOGVH1Ru$c*3{OhAM3ylh6GnRMn&ppGS|qTd5fLEtzAbq|ywgPzQX
zSQ){s6>!%?7&7|92^x46W~&8ljb~*84RAoxQ7Jrsf|3v`CtGPLgb@h}B+vl4G+R1&
zxx6rFEvEqJlvPP3RwZ!u76T<SUN+_xjEta499&d^1Az@Rnd8F>x~zwnZ4z8g0OUYz
zP)=q8okR*gbrIU6WG)4j#*hSvl(m~G^;lWavNk6h^D$P?O{|Qd#j2n{0b3x<Tmq`+
zL2IQzLvup1tWwILgUf_Kix8DTgMH;qtengh3T(`Bdf-7gWd&9ZP(jJOmr)NKU?B4x
z!OjEu0ygBt3Yw^LW&<q<7h+?cUIAGx&LYC91&S@^7wnASkt$g9f-*2<K1*DkRYV)K
z<{ms_%BTmbG(ZckKs6btXFU;|YeZPh*@Rg+K-Dp1Y*5pm)mj#`+=-J-Nrai3QG`{K
z4KzKj02<`i1P%8qF!OkUPC;vB1dSIk|E~k5De!J=@HtG3pfl678CeBoSye%c*g(f`
zgKqKwrFkCabs%d+K||)ur$JkPnYV*;A~Tml8K{W@>$cm2;t<rr2krl5Vs?aHGY^U!
z&`dlyoIq!*u(C1ltcSF1L2Ve&P%V!lxIuQ40W_Kkvkr8rHiI7Xj(SjYkogpY9wglh
zf_7=KiW-3Se6lK~vxb8LHH}qKo>i1h3A7^>ba!wCcy$#o=oESo%NryPy08{h*(rdQ
ze~W+|3%ZYu5i;nI20DZU+=KUE1?_1B+ocDICmU8#Z&swr6x1ODO)G=erhz7vB|vLq
zl~{S0n;`iNR3S+){|1j@GPl=(?k@oiXh611fGW=>=n^eXwsbbo{2{o^2Q6Hw1mEMw
z{FjjtIV*r#exMD)qHN5+YB^wjN{0kMDQf~G0F*%cqZFVX^=4yam0{Bd4Z?tHkyUk|
z>1W80C@4ahP|9rZx<63X1g(JrCuh+4)~I=lla0BH8I~B+!PaoHMS_>jgN{M~<sgYD
zRw+>73yuYlqd=2J-Xg-_tx=#^Yb`}qo(NV614VhzowO3Ntdh#0sWeF?5D7lU6?8s?
zB%7c<=!z{)(99BOCN7;V4YJx8wDtrP51<6b91al!`397{KxHNq8#Eh&ms7%O9&iBY
zf<~Ywfs207n4k%G=M5_}=tdV4&?X!Rlb<;cw5tH*c2JWPOoJ`ZV`F~H#t1sjU>evA
z5k^K93sw#`=0$a&b^t5$J<tto7OectOF*YRseuK-+L^Dx+G*fxf<OrYHa-IybKwVH
z4i7$POdm9d%$(T7%F7Jytur!;feRVP01_xsfy!(XHb%WPR`3E%P=CCPMG$mfmM9w}
z=0Rn&1UPO%r3&QMX>(AF>Ot0|f|s7TgI03Nv#RT}O6x-hy)+eAL03{T>VgtKxI7n7
zU<GZmEnxw#=3B`GI>sgwv~~tsd)R_fF32D@aBm$HO3Yw_4YYEVla2X&tsZDaBOCK>
zCQw*0GS3I)4oKyKXqH4myaE{xg*Y5!Bgn~Yp!qit17s{DF|sMJSb&=PE9&$hi$OuV
zxj}0V^+1bjK#e<4z%w!*-~g8=6Y3zvj3ApCIKlF=G5gzqb2h6SsGki!HT)~6#sIZQ
zLDe*<jVHz`A;ZdO1R}wMq-x-kn3?ogK`lja-&C8GQ!J8|k<E^cc`|57Ntjg-(xU=3
zMnDyWKKL?6#xhn`HhJ)YC2F8~mNw90Hw=}|pxN_QRF%wpC0Nyhreo1fWuCwSxj}(V
z5V~GeAd(f-!h@t31Mo>_o#0f<2I`$~vN3-HS;@vM4?3NKjX7CQ3_N%MYVX-X4kibW
zqk)=iw&*@H1kFc6Ox9=f0^K^tW6LT88UzJz3;{KXU~vLUN|CILCakQ&%ulN!7pzWa
zVFWFv1szVW#Qd@vw6u`9!V7dp1}No%me9iPR|PfWSwJV07_xG*S+g>->4PqH2F=_F
z+JHv)K;<YX1K6@Mve_ztw);FN2c75%9<%}FAJD~`jBJvi$&E_zVV%5;pdF&8*+I>F
zaMw%~+%=N~PXkICD1a_K5CF}t>4Qo&P-rNMuu8J=gVsfXF5zXf1=Sv)vJ#xJ!Ko75
zxMgCS0L};stfDrcxnA%&#$sZu63U>)HaIN7ED2==Rw2;NRLJ5S(3V?J+69FZD9hPE
z4#WkeT+p?Qf{@{3P;ycR52m~UcSDF=aVQR1Ji<JQ1Jq1n)MI57^HKnn37~~1pf#h6
zY|Ixb;X#4DmzrS<ZuYRU*@3&Op#IzMT2N~Sbor?$E2A_ED=RDWDP|iMkkqys1t?#E
zM1BO4dQRruED-%is})$qR9RRdJ5ZT7Ged+=)abE_fzK|LhaMs#WCu>~+@QtnpjN#w
z8}nbt3L;Pk3DieqV`Pzlw!Ru_p$AZd919-EU{(bO5y*5w(9UjFR?vyvpt(jyMOGep
z(A_fN6=^x3ofaVTh1i%IA(w-IG6K|mR?te=mEfr`&^af<5LdG?|E)^{Pw_H0F)Dy6
zG|+Z5@E8DSoZ}OyNQ7<)2kkxLfs})wz6_|aVPs<j-7?C`$_CnO4zdiCW<a?FG<Cqq
zmIX<OtgLLH8!|w9YFU}N6+q|9rGZLmQ1&ncF<4pI{8+`n+jJny3_wk4Mm_LtwTw2b
z;47M-JWvwR2M+{-R`!5SSOc9`3%4f{)M*AKNqtsU&{=RGH-XQo2k8SHegbM%L2e}k
z-GsskS}}4T+|vb3JHd_dhL!rPtZY8QP!4E?pr9Ir1DYcjG(n6%fOIlffEG%F=Z-;_
z_=2ovWiw<{0FN_40uHph7PQ2Nm6drFGb1Yp^FaoVYoH3lQIAbejm=gI)Lv!fWV2^u
zWP?qN`LZcM*}QDtYzh)=T1fL|AR$IJ1B3|3?}qjuV?eWspbL+gK|9YNR{=r-99%bp
zqZqt;kPTFHfe%Aut^`+bifp!^vV)OL1U!txT&19<$)+H}Cdwu+3_9+Bla2W{10(pv
zI~EC6G3E(1dMvCUPyA%o18?^PMLu}Zs{*S&s9_4}W`oUC04E!HaH;`CAQNaVnupC8
z+`9%9nT%`(tRmnGmK7kQMV6qT)dQU&1Yv==pa!=cs3Zer0$$KHH>{j&x*$)3ml1F=
zva%|Hmo|B^NPrx6r<zejSeS*Cl@W9r1}o?SU2x7~V?F>rPKo&tXg8Y_D<ks;P*(z!
z^8bNSz6fNg1ZXQ5L_N5yv}NV7^8)X8W@KYN4r@I@Y?@uiC<?LY0w}AAib2LFK^B2V
zRt_+N$GAX#U}N4_2M!X@x)xXPk_?bNARn=^ff|yqvH_Ni#X-72IZvOJRait!7}Vck
zgrr6}RzXk^16h#(j$Y7425?FQ-FO8Z`_O~Ac^;~p7lK-Z;EiT>tbA<3pi3Y56k(lZ
zKF~o};%v-YMM2l3Anqb%6&43A;Rg+Qf!40_fzH|mAAk&IX)$YqwxorE7Qurr%SupS
zm0=bGiDfCU>M*Y@1~D)5fR+ZqL|K`+B3Qw?K`hXrf}EiC?CfIDSOzF}f*LQNFaQ;H
z`rz?SA+{_~GX#{=Kuu4`EhV6w&U}*xG~)`&>;~YzG-!ws)CFK<R#vzM+7A7@$cvSg
zd0{o^+Gfa(Qb?;8G7G`z1zC#7e1iqlw*}h<vKE|@L9xa(57h8u19i}tAM!AQ`Z3@h
zm^_;xD;Ma%HgL-rG%+Fro*3a}gSo?iO~gh|kyXSUw5&^57_<vc5Y)9Qi~vtgh_D&3
z@|uCFTUI{MM2#RDvx**@h@NdEtB4y!i!iHzA*cnwss*ZwA@_9)D1uJq0`)yW2fu>P
zv}y$1RS#~Du!@5l65{%hMXLI2QQ-QBpN%mBc42)L<SuyR3+q|gm^ZR=c)_w6xc{OD
zy7iuo`AiikF|dJ_m4StsH?e~H4MvfyoXll5tgIYaAYF{0QjisVAsip8fD!11XAUD!
zc9Z~Rg&Z455V3l(F-tTFM}m4ipph(A=9CClPG;dW&^;$?dTh3AexTE@ZP@hKm`^e=
zvMI26+k?jJLA`KU=1ZVu7R>AF6+qVtuz|L5iLimP7^s~G>bygf1{-MP$VgZOyfXa+
z><pA%@OUA3eFwN9&HNEmE3?_Nm9Qy87pJF!k2%>?s{p!koOvs_bO7xTU<1uUF@w(M
zg|1p))6-+&XWj)m0FjM(BWS~k2q^6NS&>dVQDEg)26f-y+oK?rAE+<O2pWzS^#aY#
zGv|SeE>_UFC6JT}8N>$hL5uf6CA>Z>uW$x<GUqgCoLZO-bl3_f8}l|^(6|+IF7zVB
zi^ZT*S6CUD=Ybq9Dhg@>+yZS>W?lx~b#e<FdduoRvDt#630nGr22de`4xmV7KFR<p
zbeQ*mhD1Qw57c9THYdU35sa*y{@|_$Bbz+<TnA=01qh#!mD3)=!jxe(0-bIGIr2nb
zU*8ZmZ_EjuL1vQ&uR8#l1+G6CSy_!i^HI#@3e21e%;kD)%sQYAH4&iF0d(7l7Aqq&
zXo6Z?n2iy1FQhbMhA?PpAZW1+s}T5l5@^GO4V;VFz>Ze}Hx6V}*sMX_E?ZXCa5hB|
z@aY@i;cC#aTV5d3_!wEuz}EzUh8h{Yg@uK^nJ<EmV%iT5S{6%IM&`9(W_o5ii!$>$
zhBRSDVNvi6xF#Ssib{%lgEkTJGDA+Q22c31m4Y$~E3*`%C@bj74OS5rAy!7_Nw5^U
z31lL8;afT@E1L~y1sp3Y8_0S{KNVbGgA$EBt1M_+I%uvAR7^rDdQg`ImI*+M<v{*s
z0Tr1tpbMK=<=GTP!SycafEXrFci9A7s)8mjAo&J#7A0c@tC%9IMhUCCF6am#Id8~0
zc93Zq@C=PH_|h2AP@FpWusv4L;yqqr(C`m9wL^|75>kZS#UjMUh<q1|u_(9+2r9rC
znZcI_i-P*jqL8U16;^K0NHi;(q6j!0u!(~DETH8?jNm>C$g!XW&R`KGHa$?`45{y!
zL9H=X@Q@O?7sSQ}I`jw3<N%9ufYfq;8)h8ffCO2<Va>`3YTU81sR@JRp=N;=ma~HO
zf(Z_`5(Xv~h$#>fWB{^RBCKliU>|URHXm^)urY#62NiH?x?pieMK;Ki46p;3NwolE
zq6jE3K-;gBSq<3ySQTW!D_BK^!8e2`fltH*A2+YXCd{e?>H;f*FM$LF8EBa@X!8XJ
z=xir81yHLQQqh6BUZ6p8aL138jrkM<BU^+XD5Zc#6dfWVw<5`d_P&FcI)PG}B6u_b
zykZSB7G%fD$h-yId}38(V?F`eT*|zoP61T;u(H`ftO6}q0yS{J<t``zgVvZpmj{%9
ziYd?x7-)evToK4*1IR`RHds{+zRX+zdS@Ky*c8xB$&4(@pb=qFVNhKKIz1AyUQR?9
zba|{W=*9%d;R_I}SwPJ%P^Bde8FMHsVFgvbY@psbRHy(Z#Loz>b`_Wl!M7%;fiBDf
zjZdk8X2?Nz+X#S;7A*j?K-=;QKx?{LxLCziSrl1yn7Kj6?g}uMDzGTBnuE@?5@aq=
zP+&D@hH7KsVif?X1RXgKI*J!GS0%v6!o^$+-ZY{JntTMQ0gs)lq=8%xDvz0YCa?-~
zOo1dS8CGExWEPt|sDJ?toq}TvJk-c#11%ySF))HF#918R0t!@G3bQD)vNHEqFp3Ea
zvsi(4tbijDv}CYUShN{jI(0)zC(u|AE8Bcwa7P|=?+a*kJtL%z32K<=gGy9JR?x-U
zpiw(-aM=Pbbis{uPCZs>HU(CJCdfpQ9;*eYm1V%j%*)Z_1#$%&^Y=RNMiEBl<=|ov
zd`HbEu;rjmDrj~Mv^)abG6#)P+kzH&fi7s<40bbkZKWI=_(lh2B?Sd=CmNjDAbFZm
z4^*(9tz)$H2JbOF2dWrB7bA*5wzh(nIDv8lE1NeXWa}z3_*5rQtpW;n*cL2BNE;lI
z+Zn-g=-?{Do)K&;#O<J=Qx@>_3TPoYX!|Sk6h_dBjT_*M0rBq@hBQ`A=F1GAo`aYu
zWQ9NY@_Ep84xqXiGPMON%0cBbxGSXx9%W_%?Ft5sn1CB*pxq8OEPN1mF|TK31fNR*
zK6C+e$ZsU5f&?|8X4Zga3K*I9f`V5RoD|MNk^(b#NhvEMba9@rFr*R(pK!;@smP|s
z3fdLM%+?ROf)K)#hbjRFj2^^06DvUtL`LQ-pvIwyC@5Qj*S>??4(jTG;!GK|4i~ic
zPYAREHV?GOmy`KZl>)1<5$KpA<}OwRkeD#@w<?ffoXp*<3M?$lAFC8tpj+LT&((oc
za58UV1g+P<3JOoqK33*M^$Oq>m0%|^Z-B)-8?%HB^y=vDD)7!t$YeEi)hTFL%?@#Z
zI*4lsK0XDxA_WzNtoooX5~wT{WQznByr5bO6ifObpF+bxpApol11(1tH3ZFGi7JCg
z(C8;<VjX-YDyZ~hHjQABgLgkci3Qvl0L{j;8MDF~v!JtV!3#C)*&-AmVSEJC24S;h
z5dyWV?=W&eW_UqKorTRBJipBX_Be|TtEe5gXCw(e*w71nn>h338a;3e0F>4_A;})x
zaR*Io+kpo4ctJy-#9geR04@j^m01*7rI`!#ScE`_Z|q>wV-;mi=9mB)Wln?K^;WFM
zVhtK{1+~6~K`SdjXBS8)u*!k1oB~_VJPSOG?aj&vKDS;3Jgy1391Pr605yd{TjG)9
zM1U<593gUSputIDR#sIuP0*@S5r5FQ04u8k8)!K`BZ!f~$_SeMV-*nvFY!D9DlWi-
z4JD9UtadO$I&?7Oh4euEAn+msaA5<gaFFjJlv9TE@?}}&K#Nf1gkh~`IZ$uf6Wowx
zRD=kE=57(IYay8@93rK_$_iR_z6F#UMZi5uNrec|&16CftdgKZ(Ln2Vp*?<3L9UAM
z7`UIHz!nMa5`f!Kpe}(78}mB`&_!*G%yS@yGBShq8;YPG#00u)0(KV*iwr9d^J4~3
zT_wUiw_br&4-_q|%#RtafiGv7TMy%dl<0w!fI<zVg-ro;2nndd0nIvs=gT0c&vCLD
zfD#k)TTn=YMpwWi#ptd;I}S<)lAf3+LKdxpaw0Q0xif>-gh1|K038|uYJq?TtOZ$l
z6j@mn(%7I^WGjH0drWMgJH<eKbx>mtHc10I@gI~^^gyWrGzp~uVnFU{2W|F-)S#dy
z9it7av<c|sVQD2+O$AoH6A&rpD$vDptZHnwpqoTk<ydtLLH9@TD1b=TLN;Yq(A~ML
z3T&m2b-W5}v9QQ0hlxai>UVk2v;*@4aJVpn#v(w)0zb%0>EILzb{8vX`VEwT!O;sk
z7gv}?2E15~i#b)n#s<WZV+3Vi*vfCvEmx2e4_V|vCpW!hVg$$QbkK?aY>MET^a;2o
z1&x#ogQv|vt!RGcM|C!kO?J%lz~e{C!mQ?O-~*HRK?@PgnTr$@Ajy@Dc>}m<$EU~2
zBM7>S2}FV>^VPs(NuXe5WaTtsi(nN64behx^#!#uK_{y204GRL;m8T8-Go8?TF7BO
zpjD)xI}W%&4Z&8>m1@MM8F_F<WMcjauIxaEez7qx0GBgt;M-lVF@duK8}sT~M$naQ
ztZd9rKzEXY{SFFs$a!3#@&(jp0+rK@kXj$S&Ke}fp#<8x%?dih1J;za2geI&VwF{x
z4P>ke^F2mAR&zyG6?yRL%0-~nmGa;Xc;HRHZJ_uDUC0XRy@DEJ@~k|}HyA+oil1bJ
zoQrk8R)IyHRfTy0ct`?t2F6B^Cde^R;8KYB40w7BGUx|B%?acSP=&+~T4M!1MgeTw
zFK_^`BF^QKXH{Ze!^8->?u=g<atasNHUZ|fOrWZR5!6@EXXR%Tfy6X;hdXqCC#Wie
z*a52QAZO-5x^8Pghu1^8rHpJktgK>eUJ7i?=Rqw)NK24Yfo&pWbs5AETTpO<mUl2g
z=dzjDKvBT_qz-iX4IA`gU>14MN|&$Db*kNUHVQ2A;8m)^papf{5qNkj5H!jI4i9i)
z@r{8|40OIQ=#XI0C;;dL63}>m2PEl%&TnEB0*{-4JOpl;vO#ZsRbmwa?E(O;dJ%<%
z0Z0)KC`jbMmV&YvxJ?ZTERaI*Tm&=d?0F8*GFet|;mgX%yc9Geg%K_{z!TP>+yJ?)
zjuYhdiQrnFm5q5~y%(z#xNGJGj>1Q<DD(%<<BGB|vdBXwaG1}6le#ykeg)lB3r?7j
z9yKeQ0Vs0WnAg;Tl&dgbVbWt2S7B9=fs-J^*_h9PvKUHoWMc-o4<4?d;8bK4XA=ZX
zY=WAfjLZ$-KokKLAE1N)N-gk(eV_|8z`+R$Ly(LJtk(!VlLB-|H&WO^#wlQ(Izv`3
zHqd!-!feb(KuHSZFtE45o(3(TU}S#H2vQ-+Jhje-MIL;z21pE?c0q21Od^3C$_<K9
zNDP7NNH)kK7x1QHuyPy7KrghcXJuo4!@wvmEDSm{N`X}pv;>=#jk!V(RH=c6=0O`?
z81*1ib&w_U;FU^{xf)(u(7`#92CSl<pd+3{L6;mebJ~E?FX+w!ZszX{;LU!mpyf&6
zi^0WNg=9c+1iBywR8lklV+6ThQ5Y04ko{I5?;{rzp!=l3feY&RgVG)9=5bKF{tE+W
zF$5@Dj6h9MaB>CZHBbr$b^MjQSS=M;K^H}`>4W+Tpu<E#gVvzk{h+)I@+fq+4}9Sj
zI6Vt8XLzxS>VsPY+@QM~K;;uB8}lqiJr*`rM&^&8Bns_5frcqT7tw<285>aNlGPY=
z6e*-P3Nl_yAGGccTF|rd>f3_1m}r1!rNGA_u?d5WWn}|h)&=S?AYE$<av~%1Vo(Bv
zpJf*V4lvLP2~c>!k_#KFG_yG*rFeR=ut7US7N8&wWMyRb0=W!S&4Qu<G=2^aS0&K)
zd@=BWG~flxnBl7r30@)QC_M#MZqVivRyNRBWH7`$(6%cc6<D#sqs$65jFks;Tn?x^
z0*N}%(r3`*EU0Aw+9kurtOn}uf_i_D%ai%QTVZ(E7)w~#AmgK;MTV@POA*0pIoQB8
z0J9v#J&<tm25EwJW<X_%12|+r%|7&ydB^|>n)&sJuz3W!D~SyhI151G3(w!6ga*#v
z;2=^21rc}^FYNdN=)OD1+$J0IO?V141g8PeCPQ%5mBzvb2^eNkP=kySl!$mhJ2Hit
zS22MO6Nvy{kPIsP^*{|5CD5ArIPls`=xF-{u)9D9_<(O_2Bm3GFCDx90#uYLuyTT$
z`mE95>VXRs1fa8Wz+;r41!17n2Ra@T?5-qGjIn{+Mxc0MmSJR-uw~_Cn;^^rI<8|%
zJ$U3r2DHE74FhQLCunsHn-RPx0b{UAfR?l<fLe6dAYKREK>@AXjxj^7xn%;UZiu^t
z(^<jAgCexV2hGGXfrl1Z^w>&8pxHJZJOtARo}UJ7YX$8Z{J_G<D#9iJy73M)5)AGS
zK`b%^H<+2g{XNj;TsHf3Mp4kheKtK-RaI72X$4kQaY*}B8j=-M!6(*$d=8%Jg{)j<
zWCNdm1@a3gsK*E$l><!z=(DosvhuSrFRW*TO&rzQK*n$8u|h{a_`t4UWZuHW0cwDQ
z%QNOXpi`Scb?;no?14s_M8Lyyr@*BK3se&u^A=E}lua9Sl{At(_z*TuHs=4Jwi+Y?
z4MF!<vvTTz?XUs+iYXD)&R2kVO&q*O4m2vv1Ue2IBm+ut&>jG2+>4Wqc`EoQbVgPl
z(0G+CE9VAQM&=k$l3-<IehE3Y2z2okH>)fg^S-JzpuR8<BclQfKPxNq30BZj3t8rE
zkR{7dad3~G4I~L(9RrRAJMfXlki|2y5Mc!s$QCHb_G@r>XMh{wU?v+Q__P!z=(=gp
z>B07ljG~|zX<`O#DTN)X1itP?id7zTNH3=ot2}7nnqLFN*JDMcLD@hJc5#aVq|Rew
zWHkkaiw$HwHmJ{U&t_x8s>!Sk+PD{*2GYd*o(bGV*$$2<$oMO0U7#lDyl_@zmICPf
z(E`wNCIJ|Wjags<n;vMd4QLn_lvN>BeGA+Hp!$>v<^YIeSlO6&FfoE=ULrtaSZvI*
zYC$O;e3Ke48?zvI<}Du-W6a!o=HUJ1{oowJ2wFl4N@SqRIiMvVsHisr=P^-z=vm^R
zasli!HCVA}06t#{y!;P+a1WF(8NDFKdOcu-pI67mya0Tt1~2moHa+-A)Q(EffD=dz
zJR$|kSIjf2!A%RW1RL`U7DhJE8OGpr$(#q8p#Y6^FbgrVL3Up=G3O$ZDQGh_5A(um
zJyuQ;uoGv4x&T<62)2-o`3bTU=Rlmu#(bI$bP%2}8}nE2AQ~@Z5DnD1`d9@TXa-Ga
z3WJ7I8JY9IsUK3|Lc$GnA`GZg$^)sQ_&|F@o`T!~>XU)a9Rbnc{yga1Vg@D_7Lc!4
zK*RM?kPZ^4DFK>$_f`Pi7;FtDb@f@LKnuhbSwR=?NGq_4g1Uc@g*lK5fmqp?B_J30
zfaWQn>4!}mbn7Rm(i9e9PB{S{rvvjqfdZQNvH`V$Ic!+vb#1&rI|IPed+CtDNiXn`
zK;UM&12{>jKpS$PM3Mm(;m`veQ_7*oDxk&6!z`=E3cBc>jhPd4-XNshafEEy*aMjb
zQv`P+pz|fHd~Dz&iCFpA?7)NFFj^SYx={u%RTBmkqmYqvW_d{ZV`Vd7WRwIO1j-?x
zkb<7aa2_<c$GjU{WP;0i(A5{9dp$%zI~Twut0HJ<43yA7jal%R9^|MrQAN=0@uG^X
zyeh1sG9Xe=o0V4?R0l}Fnl{qlCK+fLo)NN55M&1U3W-=&SvFBtX=PS9P>BNa9>`T7
zTAEFaRYnVR^#H3h8|ch91@QDac=?bX*mRI%K-tTXMGI0BfbX|uVPWN9o(8_)NuLp%
zNQIeSfKn0YKn3uM73S%%RVkn?RjcY5AxBd3ve}A&x{v&<^1iJ4;PDlqVpbzXR&fPZ
zDK*e_iBfFRti1Y=<H>m0z}N49;?18?kB!;P1|kk}I;iO31YJiB+TiNN2s+}_3$!wV
zla2W`gC2CZ8feQQAE>%t$_mQ$jLiSQ#XG!cfh2fPYUI#k;bY}xp34f#TdZu%&#M%`
zNeEHSfQB%@D|qEWJLp(BML?@X`B^#b*%UzCQ3Y0c(0+F<5Mc@;SlI+XSqHT83*0$^
ztpj9bWNrj+!UHb~#dcP^FsSvR555{k1T?$^O3>hbFz9}BP=tWXlzFT&Y@nGgRyNQ`
z4k(Z7=|g%lUaX*Uj!BQz12nM@stAl(S+iJqeW0t7K^vllS>@$HlR3Q5Ic9J}&<3>6
zK~|PkRGC$R4KyMv0vf?Q$DqKP2`UMg7uHW;g;`>QW(hAFXs<Eo>;?(YVRYcjlp$?H
z(5f29!OP&ol6+XXnbY-HEe%<<6j=R0-qC{?1s*w<MrxygT&~Y57z3Us2QB#lornaY
z!BZvRh7k+Ma20U-N|enOROo^3b^%=`1sc>BWz!dD4Ps+tRaRhioy4lF1KzXY3hK{`
zvMI7^vWbAMj0BBmX|gdY=qa#@GmA2^Dl%v5fmWk~*y5lI6b0E7Ssfv}vOsF}L7N=~
z*&wzug0F95-cYaS#VW1KDhk>R3cB`Ph|LUK27t$QyjVf51|7~P%Eqjm295^s{Hh*o
zlL**hpj})N3MfLLgI^>RK-VLSvKfJ=E9Jn`l%i|~tf13=wG~)3ZCSNJn^8di0c}1>
z0M8f8gNBq%p~Z|*6sS|e%E)HS$|}qz4mw^=ft3}yoR!rCl`jlhlMKIUURVTF<AYKm
zD=S+j*gWveH)LrbXf-;U5vb~s`edUAY3DFAC+UHA+p~CqqZhOl3N*W(#>xoV*u=}m
zoB`P!1x|8l;N{5TY%Q$3a-fz4Xq%<7EqIM6lRPLtgI0@zSPV=ote{o`^b}-XHe*&v
zHeptA&}1ZNGc+Ts9jL*f2f9)L%z~Uu1knR7zrpr_(u+R0_aMlo1g51y%MT49vptM#
zPM{TNprtRY;6+xfifp!^8#CCVF~sfQ;us+c3t1;f$O?lFWWye!kSRdS5CvstPSBP(
z&>$eFxC3?gk!aAh@37!5hg^5X0$Ot<q^AeE+k=%2beufg5Kz~Yk<Ano`J$i`1|i2b
z>L`J3{biH^9bySukiiPtGsCI^-4Y7we!?sjU=s$lwm|kXvWeO-vN4|q&1HdBL<zET
zf=_}J-p9(yrUMxl18G$SE&2o<5W@(nhFCzYCJ14}s*(Y2)3c|r?PX<M$UK=bf<uID
z5_sJOWGa`5%?7N3jg9$nofj*sQyRw_g$Ry$Y2f{Hc57I9nE!*D^TMEg6dww}jU3QE
zUGN$J=01K<foaIf8^{Ve>Qh|-G&0Hy+Tp4PzC@h)2O}sUF@FGW|AGv32#c`t+Cx$a
zC^^`H#@`e{2Y-Xc$w2E4anj&~12%68Bj|jY?~uk5DCj`-Kd6@p4qV<0P&W{CxSTxb
zdOT3^#4FFH0$yt&1hP{RbN~P&sL~ZsU{wSi69?MTFU%?kT5$piMUXYIAg8hNg3B2Z
z=2p;TEc2@>Jv~+l=7-FT;E_2d=2bNyrJ%to@SaP^v31_8a%{q2KOx-wjveIY>7bDo
z5paD6X?}^YG6}P?ih<7GQuG3ig`D941p@Q*@)MBuHZSBvU=dJJ%F70x(HCZ91TBK%
z1r5=$fmDNTGGc@r{H_PtDheu9L8X=?NZOFq1+?8#08}{IgRYJPmE63FtX9^bLl+=z
zM_x81(COy9;Mr!dmkxj(d=%nfQ1r60fffpY;*X;mTo3TFsj_M+fWjDD-GDk9%y}T2
zL7PfJ!44|JLFXxessPYICxUFM;4lpZl^@{iyC51tRTG;Yt0<c>c*Yn~v`d4WZUPDf
z(1@2PTL!4K1+9UV1eLwaxq2e3yyBpO8l)SPUO{D(AS<sTTLoz4DoBL6iItI6lM&=X
zSok$pGlKjH@((YY33w7!RRL6MnJBQT>ai-@fFhg~G@fRt$f^O3Lsmmj82~Ct^}%g6
zUN%FJQ$Wo;0a<W;16uFG%Vr4K+zB=S<a>}huvU;$j9^I~R6l`=8eTTVNN`~AvN1nl
z16^po7QB@Qo;E~Td6{)UQ3l<}2yWu&u}X`wnlSt8fucx-jah+_Rg*bE0kjYR+>J~C
zr*F^>AXZK0L@)>3^#m<41J&uEg{}}<A1V$SsYMeJRA6Id{=mY>W($gDkjI(lR5L>T
z&b$EZ*ymu!3WMgMc<op*QY5HZ1Sw*`2hf8HBvv+%7g(W14ioc3@R$NKctsd9n+>Z7
z^YmIqR&6#7P<(-g(7~6w!XmB@v<Zy)C(K$_5jHDUUN#jrFE&MCeP}>}DrON@aZsxW
z(wc{P+Y}UBP~Y&fG5=u&<;6~L3l$#T!k~+Kcp=>xK~Tskvx+l6gxDtn8AW6S<!exX
zOAj>o2`K^?LCq*5@YZk8)w@uIpfm|7XF-d+d7$U5fXZgjm0q9=vv@$Q>4}vfhcW9z
zwqJrG2kLLIhd9}ok5=kIXI8*-gAS0*e#}+ib}6`B2I>a0F)w0+Y={G;IZ&q)WE6Oq
zkC)AWEnAvRQH0f$jgeJCpVd^JRYws-f<sq_O^}s0k}Zmrjk&J`)TM>CKkQgJMHC@}
zEZ}2nLA`8!B{op7FhA!8wa1xfl|Tyj=iH2<VCRDD1Yf5N3U#PIBoGDQUT~nFL<w{e
zR^ALy76xs1kd$XtRs>yO0d^Q91A*6QgMtXuUle5JWitk?=@d|46*mCi(g(2xvTg*_
z`B(<F;{n(XVNq6I4$wX?M$j?|aRm?wT1~D4E=idc7){u0L2IL9A&b*MhQifA5*@Pw
z=ypgOHXA)Q=1#E5kWLM_2*hqOD=!=5#wm2;z!DJWDuQwq$S-VZdTh*ZSU_oUHh3Tg
zJar`unRNkm9PRWV$q7`;DzPepYhO@PgO$wybbkXQbY&p8tq58X0q&yvg1M}0Q6L)B
zp#-lGw1LceLHHufSHXv@3yUykGa?Q6fVMF(g3j3HQ&51YXBK2+l>wb!0IBc=L5Ux{
zJ`GgRva+(NF*35+fbW@PWiC}vV6_1)&x12TeZ?x+!Ic7#Q3Uvn1)!lEMmFX=P*MhM
zd;xFY2UX_0Y>}V>oK@VG)mnj7#s}t<sobEg3Cwp(B3N0O3qW)JpmG<yvjo&N5Qqe&
z06tJw5@xkg@Pe%GVguc63*G?&u?OS<kZMq;7CdGM+RCgC9-9DN;{+P30Iketgk1Xw
zn#qUMRe7Ms6}Z5H5Rk0!i62yOgN~<T6#=CR$UVED`*uMywbBZ#0-(}UpH)kk5mYY<
zf(k%JP$nt|&wS4Yt(68XI1vXq{TUx4TLc^PX>fvg1W6E}@BkgP4yp_|o4}cgl@)Y#
z1TW~sQ(^FM1}muU1~oj@v{^w_GU#SKBSltKNaY1uPhkcsj`UbH?ZCqoERgb1lT8>j
zlmyDPpz>c96bK5!kX8g6BdZ{rH@F%E?aF7>V-seTlUI}n@1p=Wq<Gmthm*n*G!`1<
zOITA5oIyb;9z2u-DjuXj<qjKj4+|*#W`LWR@Pb$bG-t>P*{`YxnnDDf@(wwm2DHh9
z1H5NTA9RovsAOP%0Xjnjl&4wQm}l05CW63?2=FQz=)!f7_d#VZ6Pq5Zr57uwh!S``
zZxCoq$(A(;;+D&xQ$CnCqq;>{SX`8q7j!xsxS<73nBWE=1E_Vvyr^D}RZyIjS2PN|
zZUq#Upojp~@u0NH%hn1$R!L0(H0lD91ugM_v=PA)pr8;GX5|GnSV0CFLPlL+IRI2#
zf!45r4juum3=#l&*nm}yEuEFulMQlEGRRa=R}Qoeni14`fd#gqFt|4lIs^;kL=kYF
z0@V*PY>Y|@tZH(|Zjw=C6$hsm@Ch%lCJe|rW`0oS6bHEud`<ula|?Jx8(j6<vstk6
zf(ikcyCE%6kS!oL>B7o$&|n*iq3@X>?Fq1t{8@RJCxQ(H4P7zcuL604xt{}cb)5q%
z5A#f@94};aPym#)?7*HA@M2X07uq~*%-2dF_gL{LfR0r-$Ol>?z<i((v|I^NQLW=<
zWVHgF&&A8ed>1rl29DBLRvzXnU<-uBSa~@XL_zB^Lr8-S6a?Tt3M((0FNTl-xUr!G
zCfSr&?Lj6gusJ}D@CBtiM&@hPUf?q}!1a)b4yz!WGPqSMq5!&72y)VgAe+8E_`p<<
z-<aour>elU>~YX41@Hisum~$Z=rVb5iN=434b%kyUAoK<YTI+NWw0u-iGm6<Ibl!(
z7u4M5WK#vX0MbkV&ygWEG|Sqsa*D8}u_-n~It-xDf*vyi8njXb9kn7Tx)xj<fUbC(
zz$&N)=Ri9AkmY6Ic8M9A7iixZq?`o}c1a4elBC;MlT8uiY*2Z}smv-2Is;Xi?HX8c
z1FHmEF6h1^P}!{x_8s`BX>C?-8_+6pPBze)E+7vWfX90{L5G!s8arUm8-T`4xNRap
znuEdRJP)WS)@K!GWaU(fWMyPN$PC(E4r<AYunDuu$b-&n24A?v551X&-;9+JG*hId
z#wySJunyEqo5`raDsvmWKmb(sX(_Ps8?b80v5J6()|5co?{0twX+=cA%Ms;lL1TcR
zPAX`WNm`Lr4pPU1$_Ob%R%r+iRO3r4g34r&N@+Gm=5>q;%$MpQlep^`Avp$A1cJ&0
zRyJD+&~bv0i<7};i-JZ2AX1<cLqN+I?7&S84n<ZG$TCP!<3Y$1wA6u90X$JV4RnAm
zXo(hRDg(5nfkm8ElKF##9*Zg~AM=EC1r~9T>JJj2EGZ0Xoq^oO3!0EMVU>^u-9ir%
z01XL%7JWkKOmO;_Q~;gz0otao$fjTq$yTgv&EVBAqKY6nP9;`R(3&8KH$Y2iLGI&Z
z12<*Zm`&5bRj&f`3ef$pY>c3TT)=lPD1psa0-Mju20AN|8#JLW4Z6OMn>ime9;YY*
z+lK&dxIo4?L8Dm0@~o2J%W*+NETA$9wDDSm4K#r*$eaS2gp;*ll>xB?A=50Na+ei!
zHIWQ+sscy|G{nR#4QdvpDzFMEv&zV_vNB79j*ZMv069@cniZ5H#o0s@<rP^$5vmW0
zVJSscIdJ64DYA-yTq*}@R)JZp;7y~fimc+y*`Q=956bVXLZIyptir-};EEAEunk)H
zZ3~*g=LB{A8$r!N73fqBWOxg-*n<;NgoB4eCx9m$KnaUSfmPg*Rnh`{bv7u;f*U_2
zkj$^gDyRaPSp*$0rUEMFGQjh#j5?reM8Hif(2^u2R?xB_RyI9oF9EXh2y~_(8z@D9
z@>?1!GaG2-5+nGiK`g?c#YLbx610h#5wsZyJRPG1&Y6m!b2T6}Jt$hVz-0?$?2whs
z4&-s<wMej~@M^-Wa-cm0`rvE@$y`v9&6|~t`7Jn&gPaU%{VL(;*|0HpN-(l=ihx@;
z1`4dAYODsJNgPFpCQz3hbjcMYg+qFmpp-8P8m$JWV{vdU2JJ@{W#eZR0i9!R&#DVr
zb_NO;aNify{s7I{FtIVO&IZLE^Dkl0lnWoYZ3-sXyx5p|OThJmDI553PF7)73r1E}
zu}DzsPY`^oI;e95atsgiDu~}et^y}?<|`7Q6r>M2%mb9VL6eXmNzj5!9_C+};4TEH
z?F&)e0&XQmvPiPBG0z9Dp8@xRK|M$gkoz2bz}2h?Xi^dq*_>>K!l0%XsGJi6<wHHt
zA}CN2fJBWwt16o?D?cbK^ua3)q(OUpzy&2JCrL4jfi^T}fdW-kSPIg;L7cV>9-am5
z#1v#@Vgsc%P^k_Ypb{ySS7hY@9ie3aUcLyvj!ltO3bYSUo(;rc1g~ZTtyzF}njpam
zvWS@rG@AvA1(0!~pi8(oRUlT&vNA!JJ%b8QkiR)gL1*@X7uAAF(F|5jE70i<U|XTx
zc+kE&QFX9=%xoYI)Y+`eypUcvC}Dsmb!0)dD?)5y1P%0Y3bQhav&yqcu=0S?7RYXJ
zs3?Gk@tMFwVo<}FKx;ifs%_ZBK-Z}gqZZU10Iyh=0pF1(1(_W{F_smyH;f0;QkG|a
z$)Lb0Yb&n^x*E|&26XPLv>vM=^Q3yvF0A(q3as+Bpc@e(3Z$7q2ldH=jh5A8<z=1#
zRtCD4TOOSE<P}-v!0P1`SrtK>8D`XjF0KIGjV7Z95|LpB?M`D;0+nx|i~>4|Odga}
z6u|>=^7^2|zF>i;sK~0s+*Pl@D$o2C<V;X{glw3Tg;%Gbi5>|>kQ1dL(x9|12Ce{D
zd6`?l6TqN~9dtz(q%Q#4r6mA5zepUk@#94uBa1pK8}lU4xiTW+;QlwOA*&*Iq+Uu7
zbRVaT94jAmkrt@(mI2wL1ls5fDkZ&Gz{Wh3gp478(hz7=mIu_72F+cA4!Tfb<zYUQ
z4bFIweCrLl51JEtZ8Mv)4|ppH4=AxP3xfKYkdZScHa!+eR!-)HqF&%aNlt;4AC$Qv
z!!qC<r24|(>*g6jJB$R88kV4y<DkR<nV)82(}F4k<pDOx@r_Ju7SKco$|y_<tj3_)
z7Cf}d1)kalRsFnd%%AJP16*u6Y~J#qAxkNcGUhYcC14|&AdO3qvkbwVJ5EpomIKo5
z;bYSP_i_Xk*z~~+1qD_aJy6aD)fSAb>TCwkJ%dX`K&N;;1cwqRafm`z{%|PRuu3ye
z6#+G6nBQhY=7~W?8F(HUWU0P)BnYH~h5}g?{a6KZK+#$XYPEy!H0A{zS;)M%-Uc)+
z2NDJCY5<R9$}4~-0OUbp6Tw|0PzMp*QSbq^gTU9BfhHTlMKP#P!O6yai2>9X(qaRh
z*#PR`Yk{K-a;ZBTDCofR)ryeLC}bX)iw!cU!V6LgKKg@IM~~IYh80||fUcnCDS;Fa
zpf%j!_+b|GVgogOKz8x5MX^E4Gd5;r(D<VwD<_*5WCDW+6atVFUqP)IkYS3TF0B%{
z)dv#d1s5WGpsR%>LAO>xI^>{a3f{U5Iv)*E+<+|xhXCky7u4}e&~OWv9%vEObYVu&
z4Zob=V>VbpMIUIdpcuFb!U1v&cqtob|6vKMG;>$39;?V?R&i-od1Z(fWmrYjAS~u8
zkV6$ggC-zbnL(FGgCxNm(2Sah3ApJZ$0o`u3+fCgf_6oNZ)FmJ^mj_ZJ#NrS6E;Oq
zz5?rHgPaS?%*M#7!ps9Zc^jOv!J`KDY+h`(p!4k^CnlLOLdJ1<L3inb`r*Q$En^Ch
zK~^^ADv+7*vmZeRvkU79gN{jn-G2rdY6CS@KplBbP(=i88Z+N1Q()y`Ucw1#HS059
z1ReGv0xE|<4KG%GP*)qYQl*@g4>bDD%3PwrrYHj5B`*Z>JE)1ksKLsot_E4##K^{6
z0CEbXSO8y>#=M*plw($aPplVV6=Ta_Wwl~cg0$p8SD!P>da?2|@2J;fm1aK4prFqx
z1G<a|9L>yepd1f143xQ<FNuN-yA2-t0Qc*`3zu1$7ctxTvT2Ljv+^=GLAuEByX+y$
z!NE&#AYlmIWyS>>rk7*o0yTdOg;~WISy@5dXJJ?m1RMfv`XJA;F~5PX<!55EW#wUB
z4Q`!4oOoFbG~fU|g;14M614P2g_Tn{oz0$AESi-Q)EZS5NuQDlnc-w&10`c{dB)}i
z-pax#51H5mEnooM4G3zvGjA+IE?py7twD!$fVTgD+69WBqqadSVmaBALC3YQ2`I4Y
zDzHi$u=0VsXm*fQo=nU|ptxWHox=hiV^9Pw<rik<mS^PyWdTJ<^BXj}$;8H-2UZIT
zZ}_kwCmZw4Vm)EVcnl{SB+GzRK)dM7Y6`3d%;7ey{LEc-Am%ql&~Yyywy+E<52&}K
z2tEQN4bo-@+X^b*K#NwuG-$jC)W!ylLxHmkXxtIhG=gksWrWO3fC?ODKJeLBpj6Vz
z#0W7DbdH8JXbMkKj#XM;pH<R|RazO;^^;a)mDGW$f!HbvTJR_Us{KS+Wk7Z7+Imp?
z?lOZOt0bs}16nsEEX*ncS~0~8l9OV-3_d#p#Fk{f2sxM>+`|DW1<wU=g0={Wu(B~P
z1J&Q4xdnX#IVCw(9u?3y3#%-+IR;B~il7S!p`A$BoqXW=U3nW;PUf==jI4spo9h+8
zY|!zbo9iK2A0)%ZybrXYK$KOGtr>g|5vYYN%nIFW0V-5DnQd)Y9Y9Hv8FY{~v#kQF
z2#CeX?5zM^m&(d)3QAI}pwM8pWdt1(4|X(YYLA%@REo36v$8T5>w%792A#eQNga~R
zPZ&U(m_hg1g34*gSdKoZjD5raJ@5dUBtRDgfD;pQC|CqRuqm)HZx@2~#UMM1K<8#L
z3YQBDL-wMvF|s;?>gxz_Z;lCi4V)pGAg?|+uP{bHt7%YA9@-NJT_wrL3Q9hVX^>TE
zp!ywhvkYG>s|YAxDuFs?oS=~#K2R}IsE6G&R?t->!mM0uf~;bo=_JV51gNzq&c+B{
zBMF-10af*o!|6ELK!;Vcf)_7?H-vYkf*MiaJ-!@ljL@c6w*;t~1hrF`K&cR<-GG%-
zteIH=G$6_X&QjoV0en&ghZp!R3ixfZ3aqRS-mH>r;;i7-45J>aqzQOQGz+BgX9dl(
zs<W~(S1PbEb3I|<V`XE$0xEMw!P~D(K)IU{WDzV&fntZT33MFcDsY+l6Wp)_)hev4
z3alE;oK4`sVPbwG0SZ($$R$8bpw*Uapq=MTY|M|d^guNfNWBUu<$+o#`k>AO=#nsS
zN&sI|1SwBI_JMYPF|mQ}H)I4)LxLMI;070H@P>I|jSZ`Y3ut8HuLP)2W&R0TpA6at
z3fjC0aT6<Zxecp^9V@F2Sg8(kvm|I+Ik*C3c>?k!iyo^8GuJ$5;FKwV)^>s>m_TQ)
zftwqwY)(+VKC2TOc#oWuBCC!(s}m@1D1yb{O*fFgN<il!v$AH+M>HSw!QB8*hA@LH
zC4*}KnPCgA@j<enISp1eV`Yd=P!*;Rx|P-kG}^+c0J@`qt%(`Zsb+pv3pzCEQidMb
ze{9UVBtcUS=Rs41qQanQ0Pt$WyZNBzt|{|k0R_;hEvE7i61<iE7F2GT0H_TIPNZNx
zcfjIe%u577i<H5YHuHU`*g~)vEA!2KQ1QSBGF*&#IoJSo7Cu%%<}>-A#0*YGjG!eM
zVC^WI37El?yr7c;nYr~C8CezBB*6(06dR0;3X0%d$*jQ2qsA%-YD|K{l#RIplp>&Y
zJ1E0}MHyMdAqxbVCkud9UvjcBU(VNq6rsFq`re>n4^WtLg3WFMM=}$06=-w@bYwcn
z3<-!JtWgBA1(E{UKqEb%88ucm$W<tedaTTBhHMBs=L>*xB_gtzx7OQ$)<c0hWX#Na
zK{pvP9~OjMU<BcFGT#&gHK2+><u)HE)S2THz|-@f14>v~MOgUQn6DO;fO=ods|EDH
zM;!U-vD&i<v+{xalgxYb7)8Nj7d&iO&mjdhKba4LcBS}4l|~D*va<=Y@_>q^0B|bi
z0}rTz4!{M^?|ZX>f(?{onVF{*FtSR4?hOXrUkA!ipiUTQg$U@(9#CP+#$1jF9x#hd
zft87kSx^t$hGhkZ4|u!_lAA%NTR_4Rsu<)gHs-7Rpf!uolg%OXDxeWBMpn=%eQd^H
zXM!CFauy?KlGm77)QgpsISq0Q7DSE}bRsXPFo$z9kaV&tf*l+Ot{y;(s$yA{*g_RR
z%{I_c=b+h8P+J1j@ddSTS;blSm@nruf?EBMHUy)B0yxcpyMfST2R(~+wE!cV4VxAV
zAM>qz(2x!zXub*3YlWmG&?-S>e}fufhT!fNcp*Ee@M2?LBf!YY2f8H_v<*6)m7mRr
zm6c5%-24FzJn@6$3AF7PJg5aJCd5F?Mp@aI#lh!>g2$dfApjp(?q!Z(V}1`hZ4}fG
zWeZ{zV=D(;ZK4cbM+&NuAY)mGtHH!TeGZTWXwf}*$CMqoslpGQ-~ts%AnV0US(QQO
z7-+L9!wwh%ZBr5fjiHLlfDc&!4>pOhih?&83yXjTCE+o|3R*!V3T_KQI#X=mnuYl>
z6C)dQd#xULlt9dpRTgwSoEWo!0;{YtbDkII7EMt(kR7t1)mM;3%AjTF+={GX5PMkp
z!IvMgg4(0t6M<R9j6j_-F<Dk_@QAN4t09{R=q5I9P`h20RUWhqQ4e(AH7lDg<i-$g
z@W>7*3_yWn#C)5@hE;%hU9}!7H)!7>E1SBoFsl(8^CcG0i4Dwat3lZov|yi;jrk%A
zBS;Pu!Jtgf2p$Y&(E}fI%EVU3#LU3R$Rf$g$iT^D|NsAo4~&}(nD2pVAkbI<xN{D&
zmyu1Fi3wfhmKDsez$#hAnL+&rQIK-b$;fQXTQehASs_#8pn()tHs*U`jI83I3n5rh
zl!2#zK!XA{ERvwvj{9I`ppjMV%2*^>1(;8YDX?&}N;7ZIR8W9udjQr3s_;>?fsWz@
zkHtWhJro1w2CyrbC2Uy5*_cy7H>o1K8*&n_G#evS%Oi*ukc*fl!CF8w6)3i#Yk49D
z3T?>b5Su=Dy_%~6X!ois=*+|v1y%>poQ60XXptCdXrP$H$;SLlj1jbtK$ulR0kqs&
z9<;y$d^Ql+emz)NqiADgWBwopn!f~{F)q&vI=zb%yc-y_@Y+QIbZM^($Q|(ttoF=`
z3ZOuU!5avmy#`{8te_*c_4QcI6<F=SnxfG)p#(N38}l2O<0TbXRTWr4cRjH&N5FJp
zNq7#-)1*LS_TbfV+#0N!pou>i4eGQr=Yr0v5(cMk&|o=eb139sItexob&xP<H9M%h
zfoy354+(*|pdKpdwiNKh47lKdj1UnL2MxG^+PGkSAoC&GAj`6Bpa<fEYFN<Vs3_=c
zOVGHGENG`GCwPMaxU;OpDg#=>&BnYM(&Yi2cFD~u0?H*QVaCeFJXai?K-YjeGR#*P
z!0BxzhAxo5kdyU1aZuh`0apjg9axQ@4^{|1-3gq6U<n947cLNIWHkrXtIR9w^;pfB
zuQPz7d>PyZm_~G$ECgGy6y$vD7U0Ogi@^GpVCaK~5403nEY1imxD`RYeo)cG2^wL8
zM5F-dqy|0Ef^E<s9kZ(*cr}W$0(hY)XowE9um(aywrYSn=@7mxNGYf_%dEvH%qrOo
zo<C961Ff-@WK%@q$%0x2SOh@EXezLR2gQ_F#hGW|_6w+F;bdc8FU|-)WrqpcW&zjZ
zOnT_0?1lr($06AQbTW@1xQPW`)4>Uv2T}r+T}aieAw-G|wD*~jRmu{yPK;HE4Rqu&
zXxkhcWc3Z`S__ClptTA@%B&nptfHDAW5A_8D9ea}=2}558)!LZz$y;8iWMbZ;Uy0!
zen3rIa6Enn&A+3lgVzSw;-8a^`3hJc<m7IUk6`Hw9{<oVy9!qK5yO0Rb=Slhg;~`>
zGqvCiUZDAEHs*JrlNnH)g`$m>jrq1XyyO;Oepd&&^aM1;!pX+04B9sH62o42`iJ`e
zo;YYIT3CryfcZro=oG1$j0*ZPipq*Is-Vd#&^QY?gu%02Y@kUlkcFVxXYg@4*c}Hl
zo0X0Eg*d2G$5Ib(V_^OZP9dOSPSDsBC|h8yvA0PucS(baSYZ)X(Cn!=X!cZ*RY(yu
z?<NjrNb0kS=!2G#h#G+IdlvvLc!MmL2aQgG91p^vZSIwfDy*z*j;x&JU=b-cJ`GlB
z(44p;D=TR2BDCho)PqU0a<aLArk<og$N#f2b1P^;d6-R$Z34{4zzzk~Us$A1FrNcU
zgM19SC09g+RZxaiL<O`YNe)y{>w{7eC_&>e-~;nbumM=5nQRX*-;-t(W?}?oMi!*T
zQ7;4Y5zsZcke#P&0<5gyiw;<oK=&N*KLc&cVO3y`oxrS|#-h#2!~C=68e|`CH#6ue
zRYqpW<&Dry&7dZ80NA0NY$2=yY$7(`oxy8BckF`ZQm)i;fTqh>*qG;lg;<$8YZ*mE
zS(U-l#h~T5jI10stP)n>l?9@pg&3fy2aO=JfaYt#2cCdx8_<v~a}#KAg84Qm4U4ca
zv$BE4%veQ0m$1vS3bQdgq{*>5FfV4*V-*HpKhDg`$$XGO4}5hsXtWM|thg{_eua4f
zBO|K=8zU<pXuc1;{sFY3P=NUo6S&U?nl52vb_aE{*(R_uGFyVi0o=jGE6*nu9acu>
z4)B0CXt^OMIkJkfiNa2=0k!5q2@c#Ffh|k{t-KKgZMK1wT7n>Fa2SA(^kb9*4?Qpo
zc(K}omUV!3-hv7+&|(J&tq+>f0-s3ETnI`Vpix{#NATQ+vNWrR4=bk}s~~e3=w2!=
z1!hqN&^B~V1?CC`=4=IKNgL*L1!i#tB`{UOoCz|4SyoRJv`!4vAYm0@6#`E%gL-US
zp#D1Osz*pe0W@(e#1Fo*7JLRTt14*V7j)DEXrU<RbS!Yqg2Z5zk6~q%VU<^96_Ha^
zWaUu-TUQBQS}DTD7|F^BTCERWoZ$@~`vF}H0vi7VH9XiLXXvwXvKfNcxPlMRV6$P-
z0bN`VI?RlXIf@Z<e=aK<voRxVm=fe<@JLA-B&n`vhTPh{nDi(D%?+}uuu6i?C}UNK
zW@S}qW@E1O5*85^c3~9*jkqc3DX{YELq~l1*#to+nd(F4rC@#pZGi?gyqMX-p%Ne$
zf&z}s0K5#2k&Rg}f>j38sR!>G0>wHnXju;`kCi!2flUdfgP)OA02KYgijbR=n6<&3
zXONHpbGCviD8H3JW;r?8yg`d0!Q%_yFa|9@1eL42Y>uGZ3T{t;#;c+Gen2x#%;H|4
z<1v^s_1M5mwM5xK8w{D9Y*<A>7rQdDF*|^k__IZT8xxRQM4^{^ve}|DK-*CD<=H?3
z1T1Wfte};IpgToD!XQVpq_K*!F<UXRd9mrUfio2+XmvIt#ADzwOOZ&>jx|t<<YY62
zh_iwH1DY@aF(M<qSy{zddDuWRh|HA{;Pe7Mo(9x>@&?@zEWvCD+RV?%#=MzXk41@<
zk@+noMS$01z)!^lWlc_Da4rU|yI^HgWMKvcW&|UP60-(q%3cvt-1viv16EEkHZK+>
z(8a)v#xfw4%)xq~TU=Q|7XU-HEHml}Guj9<vMI{5DS#<`dA13lJFB3{ft6F3Q4ey}
zuOL(ioI*eianP9);6WBnHho4fVMaDV135)DFVGrrRuNELYXBN(<uqVrm1EO`F24t9
z1`p(bc29G%F@IzNUEvBluR;{&UC2%0pz#i<cVX-Opd}Wlrw_Upnv?k?_&^#(Rz~K{
zkX9f_g|-tbKWK)L6|@0Vn@yBeRfAO<)Wd<%%BHOR%*6_<+G?!Ipt(s^c~)h8RudIg
zZRTP<R#j#`@Ibu^n=q?3bFKob1ZePql}!;``hv%Ec|r4kAkTm{Jwa|uVr4UBH3wxK
z1(2Db&KGkzBdfSNtEfJ!1Zd<Ebj}Fqlol>l=sDK#lMz_BS!KbO*|CbSf({BnJLyml
zG9|(M3VhwW5okFQ=oTMvsSO=z0xbyPWy|me<r!8HHqcxoXl=W`HybF8f)3CDjZuIG
zw?H%}8?!j*USBq5(9O22!fakFdTh++A!k9dF>k78)B_KMUtoZy${EahEZVG$%yS{B
z5|k=H+gC-|#94(vb0aFSh=YU>IGsZKexL;eoXngNkO~Aeh9a%VY71JNsRT|upaou%
zY@)0jpo&uoyaiW9fmK9-l~X=|mEVk25EKENsxGXoW~`jd1q#euHms~BU?%9I8_>Ek
z$e|)I7HIdn2%CZ)_<~mvwmeo*P~bC{GlFi52CYCB)n^q2mG_Fwq6*B?py5n5W-m~Q
z2rg$(i+xDrF&!M#pyD5t&B4>?vY-|KC_F)Hb9mWGL46ul&@v2rHW5}?IZ!!e0J?*f
zRh^BORZjtQX_SBwXx%dC&Sdc6*}S0XVQ?!Hyk!7X=y9?+iHd<r3g!|<W**R;1)OaD
z;NoHuC~<@C^wef!HiDi}=+6jgttlflnr8iA-VScDurh*LOyIT>q{YOl#1;iw{R+EC
zfr$mw;6m0r+k<%n=y)AasU*nCs?X-@&0-8XxeMHk0i|5f%x5nnBX~(|A6OJpih$>q
zSwOdG?_>n^l$gyyi-%o7g%EgU1|u7@g$-mB0>#1w%m=|1iVBO0g3q^I2{u#|baNbw
zGH6BfAx1_PIq*0tBlEsG(4n@B%!e5Dki}TVRX}Q)_c1E4$gzqupM)yg4pt_@d=Sdt
z59Wi$qCrN1&IMv-^J3)$-75=f97ck#l`#iRpo5l=fUisy*9VPef=~bPVUzS?Q-mC&
z#|t`Pi<OlPbj+SI8}mM}8#$SG)q$7au=0WiZyA_aSeZ*ebv-M1e3MlH5?Lllku_%r
za~mkKz%5+RRYRat#UaZ0k(C`_{svm)AuP&b3OWNAeBlWzC-^{SHs<3zjI5lH9rrAz
zth~%Si_=&|y}UqY5V0|z<zZwo1=V1ii@`@4F`wlDk0gVtHb&6gfIfH}mJ@PmFtdjq
zE9Vy$&`sPY!JCd*_(4Nf+c_9n#8?%WPnLsDHWFvv4mw2`RQ7>3*g#4e&<+l9HeptE
zBUW)OR<U$_R!IZUIJjgwtGEJa5e#Uv8+hNShz=_+n>T2BSP)cb8-wlwWMd8j_20gN
z*Is~T_CY%wM8T&iv4Jkm)d5YCgn;Ixp)Bwzd7yn_qM-hcFnBXBD=WBq)`)<t&tikk
zt};j2fEpGY-jJ9DO?L}*ftG22hO<G{3Li7K7po9+DQKkww+)2F%BCnK0$Lx%%F)DX
zps&ZO*#v4Tf!eutp!Tpv1ZZSVLxI&!4|Jm{7l%R<E21%M2p(WpHeeM4&Det${Ry+O
zDzb{{fTn{$BpYmDZK)w>p@=Z^8qi6pY<{f5Y<!?2QJL4(>7hFs)N^N?z$(i84r?%Z
zfpQDz7%lJ)EztT74lh=7@T!X@@G(xHa|l6^2EIX&6V#V529IB`8nDWNoT<djp9VVB
z5OiQIC#31m51C-FgO=0Atd@{6U6fUfjStkC1nnOdW^M#Kp7~)Ns4f%+-8d!yIw6}`
zLP3~~Ih>J=SyT_a#fnEE0(7<!CmS>9Xmdv9zu?RcUNHwAQ(|re?KWWk4;ngPgDxj!
zV{QPOu5ZXH%KQYY&sn*cXETCQ$kRFnWHvaFOa<jH(3&L3j64U()&9`w2oCTHI97!T
zpcO5koq!WS$1|!lu?m7mfH^0y3h1+%O<>iZ2a9_PPz$jHG_0$tz-plf8fxVNt-4`@
z-N0f5t|*iYAPfE#S(Vs?LEU{&9S4eNR<>3)&}Ko<A)q|WjrE|pVP<~N0Ue;`k}WH!
z7H4Gx4R1;CgW7eV)f1x3_c6Q;xr$&f*l(cx0_vIac!THv89BmPc??+P=d$t`G_lHq
z_CtV{<1z0B1vc|hMjOx?B+xXEF!L4Ap=)gRppb=hl|e><)6pr2$-?01wgndvtZbk$
zZBRThfiE`UWQ%1Lh3+U~<pw1zHs;k#pgo>fYu7*om{&7_qUCC>9ui-Od2@XlD-Y=2
zQP7o=%r`(*Nq|-kD6sOWf?5-N#$Zxa0Y-riPXr}s&?0Y0FB5XT5g)k03vx6#=bvT(
zm355F??5-+h_EsWuyTrmql3{NQl^?Am8r`;AeXGeswXLEU22Z3CV<%<+}4H^%|{s+
zA%hfr$Z8^(!AIhQi*QhtE2G59sKd$$J_&;pl&=&))u}$D@<Y+t!F(Nbm_A&mkP<7a
zJ}aXvE2}c-v`99H9tH-6PYkRa3=9km#w?7Czxj9>7(r(dF)%PPfLQWO3=C{x3=C}V
zm>A`m_?a0P*q$&#33eeyB&X(dFi&7%WMu{o1c`ynVDw_M@nVZ$1l^fr!>9*3og1>(
z2~=w_E3m4tiGap<xb?w<@658SN=gtG=!{in1y&^y2v?3xff2N1Qxw7l-_EMQDhK6)
z&K_h&aJ9i{fmwl-(-6Ya23=3dBhSjrrXUI*A!1-)i=mFMb1Rr9ae;iz%E)}amXVcN
z1YBi^fQrlIOpL5-%r|QlSee-rS=rb`Ku7E^V^UycW4;9!WCTevt1_~JHhHkK8Gsk9
zu&^0{mi9dXU8&0sI#-O%7+k36frrZFz$6D7`0y=IX~L~9&kEv#rW9G&lo=Tr^}utU
zY<l47WytDcNZ5mFX2>DSpl%YA0-GNA*ei$<X7D;6W;Vz&99BlqX-r@tb|?uF;e^~9
z!wDYa=JEpDzy;=TgAC^a5!|3C<^tKk4YGlOiG>?#C^uLo57;~&s2F&O2}DQ;<Q_Ig
zHb!BvIw8<7fDkB`gRZ(_VPIkrV*XSI;VZBTf@2l3{(_PDA%g-dI~()qIva2hGP5yX
zX7EBt+OV>)G0&>AVFiUJ8|XxEHby-?Ru)jJosCfeDX2l0-?4yadbvS;15m)SfKG^J
z<zRDVWf2D_ZE%4E@jGO?o(be_a1fIox}0n_kbnh|Gzn2qz(E2O6n0M-7+E1<30gSE
z1Kx>%8I~+;%=hYS7#Z1~urY!bc7RTc1D(PE>Hve*^s^ZVgUWdhHfCqg;yDpkE;&{X
z=x!4ZRnUw$hYExQEsoFwr3lcKnzF1M;5#TdKtTvusRNb=acx++<-i-}nUq+$wL!)y
z3JbG=rs$aTz*3;dVpIU9SkQ_d2#bWY%MOYqPH>Wik_u1`DCoiImlNbrE)W6cazPY8
z6F5j1nyeX^Sh(~+B@-lZGcd70QZOh{gOnj9Y60*>y#P1@1VAnj0$VD?rU1!GpjM(F
z^9u$A(1qD?dZM6dF%eclIaY2Z5Gkj}$_-kJqR1u=%2AAIAR|B<;bp;L#Rv*SCOuX;
zOC+uWE4QW+Gyp}wDHh~GNJue)tVM8%&GaB!A(<Y$zKP2Q><MVVfFuz)ACmn+VvsPz
z6;2=(DB%POI7m2w0!LWE2IOHOPf+p&Ut=nyYpYPAz$OTae9&o|5T7wJ>Vb0}_{<^j
zK`Br_DS&qOg33^CHbzazqCR8DP$_6SNJLKooDF!G=hlNPW@ZipQJ@n=*qDDa=z$Ww
zAZW3x5F<n(I~!CbI~(LM1!hf9w1YK)*5HDQOFeK~fPsP4o;vkQi3f8VxPAc*=G;W9
zU}l3Wn5Xc%1YE&@?k-_teg+pLs)Au*W99;#K?q8c@Tvo}j#dkiP#6`!>6nR)ku3rt
z$_%;l45_jJw-Y(pyg;!FNif*TG;j?7sSUXGAO#?VhsZ`C1CWvjc!P)#o0kGO_F37*
zSy@2KFBw@`*!02WJZMm03nL?_7Pt(p1wiGv9;hn)gu4*aW90{xYaDFSBCM<;!k|_u
z3mfy|dOhT-LV=Y9v~`k=n2N%Nm4l5JwWa{&>=I}(sRJt}6<I+gq!ufO3MdIN+OP_0
zBV}PdJ<wG>pkk6qnUxzN17d~Ag6eu<(A_eigb!-0F|j~$HZ<8ot5qCP0tsbs9tP)5
zNP&kXH^X8G659}M1S1DrHiHT@PzA#S+A;!;HXcx1@_<qnGbrhRlL#|NjM)nmG=Yqe
z=8ZmRB><M@4J+uh3U1K(|7^_f89*f@XxNWiNdeTi<OY?SifrPL$_5gOpfV9uz00AN
zk=*8x00s@iGbteI7zR)XiXf^ONT7n!8Oc=)CmVPvA0**}Lzx~WB`9QtQW52(wc-RX
z%wm!eQA|Rbc+B839GYyv(E+LMn89@wvjVj2gq4|~-A>?r#s<P{dZ18O29KhMu!*qp
zDuR~&>4R3xvk8C>qEliOkpmqoAf?C3s|3oK4;UCBr6vz^Kcu_`rFv%O^<WM-Meu+`
z_+UjS!yRZ5s)w&*!Y%{um@qLguzN8=2-xzs<p-D#GchVDDk_4oA~HY`P*PM<R6-F!
zR!Rz617s9_4a$m&;BFoR1H)Mg{kKYhc^wNQHtUqIco~~IykgA!3ZOty#;ZtCQ61r-
zSrmGxs)KngJH$gEn+aG<jI@d(+;xoF6uNGW0;sE}sHmt0#j1*mip+fAKvD#U638}1
zMKzGy!F)xC07#vpqB2+rAp%kb!w`ka%HV_w7gPjm1nC3o0`ZhVDnSfIMTnIkK1c(z
z0@xiOCJ3v5lC-j-vJylYTu2dYfTAMAXo#dD$P7?msw#ubgr-i$$rJ`x^#$g+eBj6g
z*$z#RD&8X-_<+KhEDVko{fzwFRQ=?#V*SF@+)@Zpl%HFyU!0nll$l?wn^91Z$dHkm
zn4%ZVP+XL(UzS=_oSC1em&}k~TB2)aqMw|cpOR{9l$MiNqL;5%l3M_mV$jnsE=q=w
z`WfX=MnPgxW-&}Ot(-x>w75t=Co@SuJvmt)WSg0ZZcb)iX@zcjUa7vJseWc&a!zSV
zDpY%MNeY9Wepz}V$mpcXlGOa7l++@<43KjQN=x*T8H!7aGV{{)k{Ob6@{_amk{Pm-
zQuLA;N{f?pGcrLeuy}GVh*^@En_8ro%mA`iFN2{tBhkpz3}i+|qN$;gUNS>Taylp&
zAVP+E$qWU_nJKAdnaQaj3o`SIOA?cEQj0+niA9NJnMEKM6eMS6=4FCdIhn;JdKnBQ
z1-bDlMVX+mgQ(0bPS#6i$Vn{DEGPz9Q(Tf+l%K1Y%#dnfWRRN(3d5rO+_cObkToEe
z=Vv5m>LoKILa5@5#FYGUh^O?D8H!3krX@qYo12=RSeyuUQhqVW5yh!RnTa`i$qc!P
zIXU?trBFr&Lvabn)B>2(GZ+#}5}_U|O9X{#UUHGSp@D93axq9@PH`rTnOa-`W9Al=
zz?jJ?5O1XA<QEiF>LoLPLL@U^Hz@}c5l{})u;l!r)TI1;kP8cPL4HpvN=+};%K*nz
z1=OQpiTr|+%=|o1veZjvNXZ4eFh9SfxF9F7I0F=*@HheaC?&BdT`vP1rSTbwMJeTp
zMX8`Ts4PeYnVynaoUNC^kd%@Lig0kyWafjIC5g$|AO+y$p_jo>kXZzdT)hm2#N>iZ
zkdj<*S^!y+335G1rUYaRI9f80Jqzc6J(~eZi=Z@@!2pZc42I&=qGWJZDoany$j{FP
z#Tg{BGV`I43ki)>P-sAy;DCWJGfI=7p#@GI5W!M}QZN&e@WBQ^n7QDj2TD_=;6wsT
zaTyE+Dam>n3>B$)pxguta!^3z=IUiIlqG>eF{>aIoVCE&964EMfU*imaT(ah5W7Gw
zOlHWb%1um31r-x|84S6lIVG9kXh&uzGvpS)0vno2a&y7a0u8PBocu&cJ_ork84)?j
zu<(SbfTuZdDFBa$f@Dw(=9T59>SpGF@?=?hVrfZc4#;QeiO_g0O9#bflA)OaNIW+&
zIU_SKRX4dPHL(Qb`D9~r0|ST#X#OrsPfP<vLK)PEWCoB(eqISEDnTIzDvnY>#=;o6
z`6=MyA~`3u0+jTN%hD4eVi^oc`N<g|zFsmzauP&SL9tOmei6vM$pt3H=AcAa0x}Pr
zK#I$gON)y0K?NAd+9XhZOHa%w*UMl4c@)IWEGo&&*9CbVHC&PziXn*^5%MSzmCR6_
zlAKrsDkF;$bHRBA6zHJBqaYKMOmb6mLFH5iLt0`{K?$g+ut_S-%qh{$%(G+A2QgDp
zGK(M#eWy@Q9~b@PqWt1w-Sp&ST|-knBRxZ1uqsfw4-+slFfui;FtEU^2S5chO2v?q
znUtQK%%G>I4?#%A!cBpw0aY&P$;qH%7NS&7538LJ)eI2INH2pZvy=1l(lXQa3lbS}
zGjnn>%}n%yK{Fq!46KacDG){w54?AVfq`L$B8bPpz#zoHz+lk;l52%36k%gvU<i|C
zW?&X`XJBB^g(zfN%f!II;0BsXVFqcD0nMQ>D6?>|Gcc?!VPRxrU`UYz8Dr1Nz`)?g
z0#eAy47QG`q5!5hAFMYJtT!H{&;>-~!xc&}FfcEaggPYo93ulm9Shtg))1HIJcZC8
zlIeLl!~w1h4D;D+G^80A7@W_8{JT64B*bfzF2TUSV6M%;kb2VAR*Zpx!9bgVVLF?w
z9h@y<YY%4Ems&7ziZd`Ubm}uOFjSR;Oi2+1u{-OFEf}~&85kJmmxDbjUSDcx#=s3S
zdSf{gI|D;ha(%I(83PZ<pu^=%tPBk8s`aJDMhv_lky{``PL;EOf~vB<*w~1HPlSPi
z;mrj`7S_zX5(bd;n@OO+dsAO(X2QTP!@$7E4-)+k@m_v?v6%^jfD{7*qhdJ+D+2>#
ziz@?zte%}9F9QR^sW=Wh5s+Y*NKQV3od_sOPcevOWHQ)^fUG~o!Z4YUfgxZWhn+Ax
z0|R4OJOcxxNnTlE4uhR2Cj$e+e+E|uh7;56q(Qznh!e0=<YZuAT*kz}U^2^2NdlyW
zL8Le}oxx67kb!|=83#j(fSm%!#)BZEnt~Y^f*kEs!ERv?W?<kG5wMfzU|?XpngB9~
zfkB&rVcvf3$Gi*-j1M6pD5no%YcnvckL7*>awI5PGE%sog4uB_rc$g73``m#DVYpl
zCc`oYCI$wF8Bh)r158O869dDtaENdfNX@d7P!1y#1H+-eP!1Cl1H+!(P!2Og3e<wO
zyi~Xir{WnHm{>uC2FP@2kONkV6lXG+f|w8o)Yd~eU<ZK2nVvH-FqCCOguxCd+YRM_
z9MEwG$^ki`i66=VI{>7cnLRHRZUfi>Z6F7%1UW#4m4Sg-OC+g)!4$-VIDq3Tlmm7E
zNSrx?iGe};DnuCU039PJ2jl>IAt(pr082Y42kZc_?vA`vxD6l&Ftf*ltOYqh7UY1{
zB1shtrXVK70SjRqumeEi%+E!Va-gDB3?fMxFgD2g#qS|{t3cMzDTQ*t)`Rr2u;-=1
z%?DfG0kVEI$a*<e1_l-_k(3GsQxFqky@)@Q1GXL{&XOjQk^@yz#UPTB0b_%#Z=48G
z4z|AXB$NZT9;_D>|1k4G*0X?o&!PpgULIuqN|EFW22&6dV*SAcC<kmkNSx)VNOBHT
zNfm=gat4eIvVKxDL^;^{?o=oTY&}RXD{EdV+<dV0px9>t$37@~v1*7URxp@?m=Nn5
zUqLxw>p|kIDI$qEP$g9iB8eF=Hpu#IwGicC>(?7VIbiF-dRy{R;pT&^X9cBxRt-=V
zp843wRGfo>f%Tn8N-=|}1gMx;#vqbf%wQ@BW-}!)FfgUDfXL?@2@DL(89X5Jxj+H~
z1526+h<qxMz`($oBE!VMAe3&ZD9XUVcu;|ffuZDvsS?->1CUK3Ix_aM91IL>woD8R
z&9(M&ASrM<j?A@}2XjDv$^K)n0OBkIB_!=P_7LM(L~@c68SKHv{TBflr#Dl;UJYa%
zC|?@&*sFszfeHqrDfSv*4%h?_drc6hiiL@Rp>4Un7MQ~-l37&9V6P44urV<(u$0*A
zfH~|UDY=OZ_PSsWhe$zYK7+j;n8V4$zz`#8uMgrZ<6>f9h|IM&0CRYl7#J1_+Z%#7
zReVeg3<@Xhjldj!hGYSIcTNTdb_pg1hDvXH4^X-KALL4tfA*drP8A14gBO^?$&f5z
z?*r1{3DMvy$iTqv3Dw{SRwDq>;1A{qGJvT63=Hg%;1ZRQAw|O8jg^6cy*ikIq4AKt
zH#Y+V+w;5<Lt_T}0B(>=K%u98D8}B5gMon~2of3QAm@UM-Vz3T3or*1dOTtFmLSe4
zQ0Nsev9|(qI7EsIN*L^|!5on1IS<;~fH?m_PTTv!-WJ4J2J*6utGyjKJxGaUr&co9
z+k<7am>3w84%$0_I8{2J>gSccBbcKL;(W1p0&$k<F)=V`nA<yZg4}5UTElV6-UY--
zG69X0zP5J-Df@4e0P?*HI3TJR7&wx^0l^IC7lHZgAaA=?3)qKpFfed}(kf4weHh39
zu(yks*oT8!Pv9)%KiNJ4%wc9?U|9IuJ`&6Ug~2{Q`zWv;R!9Pf2FtKBF)*yPv5x_B
zK=H{FXdeq!21+!=^X=onGTclI44&WZ<H0hZa9hM+p8%GDCYnSrhacq9jUC+fsUVl`
z1f|Yw`!ui=C>?~x*{6d!pxolvWS;@%fMTn_#Xb|v0XcgSgMAj519JA1)Are54#?Su
z=i29hIiQ5!_|rZY%mMj<v&TLU%mMjf{c-zzFbCuZ!6o(uU=A0^arVl5_QfE_{T4|{
zDq*lMkpu-P$Z<UP?aRRGKz=<k*S;Lg0r{2tnSBMA!wWJYt&G{efrEj83ly!zOY9rL
zQXmspyX>359FX@i`0Sg(943&ag!KaUZ6HlOObiUBr|sLpQXoxIQT81mH~a=^IvZ=>
z36=r*+=bb`3oOG5DM7kHfqx3*zwAHuJzx$GLnZ?Q^I;|i`+kt&55UEk{RA+Z!JC1h
z`jY)5utLTi-V6+kEA6L%c*_{~cr!3K$k|VmU|`_-$hgm&fgzjAeg;JDA1w88eM|(k
zMH#n)1h@<s7`Pe1$&nf4p_Ei%`$ZfK4BQhTxo|Pq*&q+~)!Q!tb3h(a)wf>?=71u(
zve$kYm;;Jr|A+R=K^B7Z=eq6oD?prOAm7cluwM!0fJ!O>3;R`I4k#ix58AH=bNED(
zGm07P*MNgZ0OUT#gA5GZ3&HOD4+<2Kzl<slVjK(%d>@z?7&!ACK-B}^2ap3#1~`D~
z2Yv>SW$V^CNI{HbVqi$ob&vsbK!rgps{^RaXQ&clVqn;P+5ueXFB4{BU<guj05u&M
zszgEMYNLY!*i&Lm3=9i`96;?-hGpVR3=Di%9hAT_l1vN?^QSo|gN>GAVqmZebWj0v
zKzVsWhy$oH;1`f%Vqj2=cTflGv14LjIP%^>1I)2!Vqjp_bI<~F96&|(8wYJL$B~JF
zp&`aWhl7EEU%?4fHhDYff@MI3FqeP>xB^(_1uA!)93T~d4-*4Jg1rNz0`OyEV3=p+
z04nqO4FZ@L7`Pc6Ou%kSU}9kCJmg>sHZ6&XfgzCJ!3->u4DzXjgE?3xm5G6YRnEZz
z%mKA@r6)UBg3HZxCI*I`I~=UQGUZGR4C{V4KnmUpCI$xo76)6fObrtQ!!&gVJ20n~
ziGjhQ#{p8-)`5z!YzGIhOal`GgY|O<M=+<6iGe|KrGpcg)5OHU5EAU*4CXY0jDF_e
z0<Iuhm>3um|2VjUIUS&w>vaHCX$;Fi*|2n}g9q3@eV~T7yMrg#fC)?t3=z{DyudP`
z#BKlB!5b_ynTdg6*)9hkFlP!A14EIjgD;pfm5G62wUdJ%m@^F&a}yo>!JO$#3=Gk$
z9Rk3d8B7ceTNXG3f;lrm(HQO!1m?_QVqlPnbO;7>W`krJ9YBRWN6;K528JjjhcHkC
zJ1hVNe2fF6v|q%;z`&E>04ePkGchpOPH>0>2mBI{7uGs}OZ!t>m>3wUt~x*p_#L1+
zO3xt{WSRn~cn)@Ohy&|604kR{9OA)2b%BY2!Hm%XRHpL>TmfY-hGh&4{0!ji1*x4t
zd;u_@2`pa)N`PR#Je+R;=CgtMAoUJlK0BBXQXc^3Gs5`^V7@;%`+i~6b?5^*^9i_o
zap(sJ4JiAXym9~)aQsg|<%^1u!$h$Am6#Y9nyefqft4A7IBpJ;!5m{I1_pN<hbbVR
zfotDInhw)ICV#PEVqma|b(ks4z#zZ^$}fuy9OiH^FbIfb!rk-*>?Q>mUw{S7=K=9K
zia<)ie7GM3RKWbhpzh>>BU%a)pb}D;fniyUfG9V}=m;hT218X*9tj2pfmo1t%Ctp!
z6c`u;k~lzpYyks41_lTbE6l)fx{*VaAEXVG#-*Y}1t8kMD$|7-802dVtl2pj7zFJ^
zl2XzbtU17`7G&&UR%=eM_dx~kvLtIRage#767SS$YtX2GpdF}@vnart53C2&=v9-k
z<^wg!mVp8@e2q0fSVo13f#Eo#wE);OHBj0VwiW;>t5OG*Ym2P~!7>`4%KnbE5SXJ0
zZlqcZgE^ok({@K|F_39*bQnM$Y}aOB5dUf|A;rKTkgm<ZkfLlY$pad05N2Qqm?dGY
z4D!<|CI$vCZ)<Q#c?#sG1yik6L56^<jPNzqYG4k?PZfu)!HwuspjslJ-CBc(fkE)F
z04SUUqd_A_f(ML2p#&lhFkEEh;A3DAT(8Z*Fj>%1Nf<PEFoltUq2Yiw1A}y+8izas
zgWwfy28Q}OY8;wSc1ft30LY1_z+Puy5aMcM1jTYmk&`et1B2i{Z3c#eqE5n63=Bd_
ze4x=8kdetpgc%sbXRtVdN<kqHCI$wl5GN~88aV|Xa)@AYwv+<ZtilWoR@)6+3^*7V
zg#IxxFr1BbF$9Mm$m4N=E=FJuD9Ly5xEKpDFeuLk#q1&m7jS6}ZoX=ixtM~31QfF@
zJ}%(W`V^>+Srg_0DXl@#tkUZOat%Y3A`=6{-WM+5G8r7_xkp@Vz(#}Oe6NoSq)gTk
z$tlfaaIq5rc}f=)ra~dw3=G@<Ia^6EFbMPWF)#>)2s1D!9_DcN;$UD92IVV{&CcFn
zw=jsL=A|$=gE|Hbr&vHuhiyFyuAr15e3J>(?r;@>sAFPaI1%9r9_(2LYW_6Wx`LC;
zGEiHO^PDTFtH%KDa?~Gol>i3^sCma9>k6vP8NmIT1zoP-+8mq?+=X1F!A65>^T=FR
z84d=92}~lOs_>*Mq-qDPu5MOyl@n!Pm>{G8iq09~&f(Gw48l+OKpp{=43{<BK&}<Z
z1-sS_>{@U)Na3U#*tK9cO)hZ*xmIg7$W4oc-NZpQSMh_YrYtv5+k@d0$QfNSZeZ7*
z0y!f#)eY?0|DgD4*LMTEwh9zQk-2W5hKQV`BFIhNZqAVk3=ATbAUD0zW?-;d<{Sl1
zi`onfyWTiQgV@W285np(<=sK0jA#_tt?oP^M}V`A!bx{taFBsQwoAsH56l5Isr`E0
zK_v`B6)2dqYuzFF9Mq&fSnVzdG638t+pyamlC?pNvWOGzpdfME4QeV+ob4{c#lVnf
z3-Vv%DR)t@(V(VLPrN%QOc<7dnnvs{?%*&v1@i0)R(EiiECVIZMI7#uU_Ejm&xY=E
zPE=-K5KZG_U=W$6&A_n8&$&c|fkCvKkAZ>lg+7R-&A_m4u5*bzlx@l2+z$$Z|Jn=;
z8RgFXQlRldZ3c!l8O{@6;%oVxC&+-rLD{#3fkE^vC=(hmgOao8UTp@37-#2+f*^5i
z28K*==cOQxr?eRuk~y6>C@?T^?$l;rkbmoZA0+<f5+ehHpo{ZE8BpheQJaC`ScUT=
zZczTvW?)c#>ih|;N)Y5=1_m*cHb#&&Vj8iaVP|JXL1B;}h~whSC@2TwB(r#cMia$0
zdV&TtJ*2_olza@H3=EZ9JY>K;Mm|plhIKbRWFb6$PX>mS*FEGQJONJz1{Y=zc?eI?
zlYya2#zO(j;}c>44Xx_kVeydUXJ8P!5zN34qv)Z?&cGlR9L&I=cgF+VGCc(vVV$(d
zLxq`vL2RQwNTo0XgGjM}2dH@}?#jf#AY<bJX`O-!rA`+QNb3|-C<Q$A0FPDd02NB@
zn>@f{6%Rp)t@pVHc&q~4aXGZt13Xr7iU(8>6nwDp(C1)a5P!tPz~Is00dA2#1ewiv
z(*rytu>)iR;}Z{1^ORu+D23*vc^HEd<qlA>pHt)kF8y|Z5~apI4{+(X15^iS9P<E|
zemg+j(-Ybrpg{uhN1znSuIB+BBzOqwzD<AZ0U0C!^~!a&dO!vVEI_q8!zl&^@lW7H
z0`7mu%;N9>wL~SwJQ)}gGCaVY{!@&gDBAne1KjIB#mMN%z)*J21JvzjIK{~1$-uC*
z!voasXE?>k?8(5ubJGLd@ju1L;>o}uXY1hx^2;ekR#1dp^#Hd`PcgE2GBDIwdVm|J
zrx@8i85mAZ_wa<M<nUx*=;-$VH&0J7a(Xf_9GmF@DQOwGJQ*0=b3GtMEhD!l0|RfE
zhc84Qk0%4elw1!#2#?p3fgw-N!ym!}C9Jml9sv*@C}G7P@CbzPKnZKbGLIk#Pq2xx
zATfmjG--2+57aL@wAUj9ECnvv7uIlifEuTgpjJ)}lSc$ds)|7bq{kzYlYv1p0+d*U
zj(dRHrr>e1Lwh}<LCQ|CfJ42Cfk83@9O?|9B+~Vr!viz|Aqi@hdvth!2Oz*nL}#l<
z0#u(c1H%D19*-0b1_sHappJ^2M=D4Ptj?puBMr;}C8a}qJ<>s(Qyd_}`<yvEK*I@=
zzadeY3zlMJfOs+wG;JXda_^zN9{FG?uqXGfXYnZFU|^5}m1>9fdK81D7{IPS#lRq?
z26jET*I(T4;!y)qdKcoVT98t(s~B&3)PXp#1YQs3KofWam;+7VjbIKmfj5CU&;;HL
z=719T_V*qwAkITj0#{1)Xa#dXRg6ckM;n*}Ds`tE@&JuH@C$%S-FiEZ4v@?#P;ITV
z)uR*4abQU1@Boc1NKa{EtYGK`g#iyk6JsSqADGG0#F$aV&<|p>OL#IcL~(db0BdBF
z2bEmq9upxv1y2Ts#E%}(!3RZ81_q989+M$*N}dc1!cRQFLlLJKl|304__aNzLgZ9D
z85oTBdrX7yR3R}j9b_H9nkNH8K!gW)l;RY#sV4)2CYQ%dutE+CP}x;A!($dR1B29E
zeFg^UDZ&g4Qb7kiK<#-sP@Q}>)?+TH3lIb<U#2B_%mY_BphU6amdAWB2UHyzNqZ~+
zbq*Xralysnv5=F2L5>p?7pxW@i@~;m0$KNk#}Y6H6vzn^J(hwwpg^u!?6C~Y0R{5H
zB_5D*4N#@7w9*4It^sOZ7oGC}k87L)HMKZ3Jiy}`r$CM9IrBW$fDHhRF78P6SO?~S
zN~?gU9_vAzWuVe(VvffKu&d3O7#JpIcx(i7%t3AD6pu|{js>VE`p{!D2Lpqgq$Q}6
zE9J2TWB@qMPnUUY19LzF3gMSMwu3n?pdpPd9y`DsP<wUfM30?d4rth5j<d%uFb6bJ
zz_rO^H<%N`#K2Hn=CKFN0cCxISdYD6P7D(RgV<}2eP9k~K!NG2$9^y;g^7Vdp2gz;
zn3KW8z`&p5aS+VO0d?97JPv_51>n}B$6+w1go%M+?oN-R;3xr&A;iA-I1ZKp4GwHD
z^Ed(KfO`Gzw>(aQIiOzuBms|8U=FC)FFVoWG?)V_QTQHsoB?w{-TA}m9%sQEP(QuI
z+2b6T1L}Y;-Q{r}%mH=44+eQ$0J%VO2`tOYNrJOHyb~y=3FbpO#-|t<<SfB_Hc*+f
z=aGQN6;Onn1V!5ckE<Ya!Na%_VjkDP98eWnv(@7|I1WJxbZVE!4KN3kK=*NY+yrw#
z3G~1@k6U04sJ+H^!Q(c_0B}t^wZY>KSO!#BbSrz@1#@^oV=YrX?txP{AILqMZwh!k
z1i9y<NJdH#gU2IDkb6OSWb;jr$HEK@av#CtYYd$X4DyW4pb22`lt?9?fX53C1_t>o
zCI$xa4v&{$n?d?CxjbHhIN+jf<1CNYV4Fd%oy+3!2FwAumP5niEm#>SZ*k~*yaRJU
z<=mmY9`8XMNF%}PGKa?}kVWeth4g2z6u92CV)pm~;W0uAim#x8LJkyuhxU4W151I6
zY!?m=kDnkju0hJ-Umz)PIeciZ$8Qkl6bpkP1H;Tz4i82K4h9AVTR(6m&&UXtWMuGT
zVDNVEU}S=D8U4UjIU_TK%jCzvV8!gg$O7RqF9KJRjG$!$r({_885j=j^<ZQJOM<OA
z$tdE%2<n|HoZ@F-*f`6BkqaCw4EziXb6GqXK}~puDn@<=2CYpVjNnH64ki$9hX*4s
z$e0}<Lpd}&7{Pt_9c=sz3>^9%jNtzI4i0_>hMKJ&i~?YlT>K0SQ@cDE!7ce6JW$67
zf#gmJfc(rijl+Wx)Mi)s%Fn<MXy?Hw25L4w1UUxeZgCI~5<KN^1w0s~I2afdeWAev
z?y;N#2T#OA4@OX*h2az<D0rgwdN9g@ZDC}BhKC#|c4V2MPLSsUnZp4Z4q$j_$iT3C
zwtxpCXuMRhmY;!P`eP49Wv~jEJ5<0t4v>@0>I6I(K@CyG6;LOGC(Yna)<h_kU=Z+N
z1dWa=K7u+KJUw=bkpb!`J&>d1L17K@tUf}g%Rd1RMo_O?Nt&O5L34=*Be>lOwj_12
z2P3%Qc?uK}AdRL7jkEp;crb#7LzUd1t^+qQ!5TqIt)NO{85oXpdN4YQGcZUm1$7l3
zGB7B`w=purGB9{7^I&x1WnfSWj%8rzUGKr@4CV+kFm%o3U;_1)lt3j`Ks%EZ4+DeJ
zdInJcLa7oo(xJ4<n1KOIFg^qYt`ex%s5Fy}fnl#OldA*+gHoju14H6ArW`OEwyfpY
z3PT14BQpsmM$mY@GCw~9LxwdI<1$f@1_p=Xk|G8s#^u}$49ff*4xk=A6XSA05KjPP
z3FE^!0T)ouSQ%93oVe*C3hHKoi#6E=E@HwA41xzhD>7UJSQ!|UgY$Bd5*b{CKq>2g
zJOhI=cviH~QNsn4@|8j3pA(L_@PI~D4uDD&_P;K?qM(rmP*LID-~#Eqf~w){KQ7=z
zzf35BfkD|q0#u@<)pEFKaxgF`gBo21`&__X5wKHiSGa(?BH(tXYm*DOE3%9Q+&pyw
zr;BB5pe|^9gG&LdGnezxr2w>srb?TEVZvUQLLSiYjxYnm8Uqba4h{we70|%8QI995
z0B95m<XWRCo?KuK$hF4yp4?!L0C+^q6P%f=K<xyhVoz{ht^&;tYz*`SXXPr;?11hA
zPq3%nfLaiW0iK{iKS4VMkl(DfICz43-YRRD7#Qqlc#4RC#$G_St_boJm1ba2Sp#Y)
zoV4~71D7ZkpvX~S6lP$k|Lx!f8YxtrBT|%_&fo=dI|FzMJ44M2R2DH*fttGR4PKD4
z2vmq}yWs_j5QZwyd`-n8FT@Cfu&oy)5<oSQc7hjT1VK&43o(L_;^YMxGynxfg1;BY
z=?qn%*4T~^FA=Z{K?VN8i(a4th@lEJoWOa|3o_CJs<_yGc|k^cKowWqQ!h};X8_Mr
zt9<nWl|&5SA(pt;UZBAp)j5!=s)~U@bq%=6)dvL{m$`x$Xud}EH)w(-zzZ}eD`>|6
zju0>KbPad}r#;q737q6W35#v67o<}RimEVoFUTOI3`4Sjmo_T{gBqwc6=><D14_c+
z0TzucFI_N)MWiUTn88aA%mMkk<c60%m;>(fHt%Zi0u^0q)goz`#SC5=k_-$g8$mHR
zQ^5<AZ21KoASQrjd-w%FjixEyUIy$83~JR4pcaSfZw3anZbVINwnV|pgoA-W?G||5
zf)}_G40h9zJzn5WFnGK)(9#Rk31$Gd4m7g7z@6YzJP^A;C6wANNa&qnU{HGn4n1bj
zNPM&iBZHR>2Lpq89uotDo01o3)<!)K<l?xeUZ4>|jv!D%)hO_?2dSz9HFe`&dx84O
z>U}1l`6+QP(5#Jm9jKuh_t6V9Yr_!)YBbLH<OQ0w;Yb2C8t1+A0?pc}&jWcm?z<Og
z)<%8Z0+5#(su&p5>%eZ3hV%Qtd|^0$9+=M!=dT0v?cw}=V17I(MNGP$;pM@>z@Pz|
zKC_?U<tYKnMq=;1yd*&qplnpI(aRgeakGHLl@EyH?I4nzo5JAb3*rQLh!o@%F?jib
ziilI7M)6DqFMlux<iF*Yy#gdbg(S#-Vx?YzAelD_piHT{h7S~tAmSB>uoPxs$i1iF
z%>r`PC(wM7tT(vH03K>Qu-ls*T$zFrl=WP1@Hjtskdr6On-e6n43uh%mv}>RFQ{w2
zh`}3@dqGo{8@GFdiyrW}<Cb1;NLB_V?kQ5<kgN<UhbFA@1{XccK;_VaG;eSl;*<<1
z%v>aleL#hZrZ0Fn*awtJIg%JeGE*3Qz+-v;L2gs6@`2=0kaNUJeIR*MP$ao1kHJS8
zoa2Q=l2eixd}O#77&Lvs(Z~3Zfk87C96j<NtKwJZ_<-hAH9<2}^MifBc@&(YLmGU*
z>uA6!dd5#5a2^GZPnw?gQ2`qdDo|XbeN@35P=T_<$OkllrM`}bAp}$_uqd#=E4>9E
zk(VrrFcIcSdjvrh4FiMbXRv#iz$8C|B?CiC6N{1{1B2#WnC_zrAl+ZV=VCz?ksg&O
zWMG)s&%(HvAGBBqu8>6-G&wEc3yKddQ1#~C;L8JcASfG^-0+1&2P1f%-xpjHoB|cV
z`~LYNO4jT@zToIs25LQ<aQZ@~T{ywDmoKQ8)tb!(OYB;!!R}@Sh30Az0bfvLX}twa
zgf;j=3RI}YkjMg+{QExnf+C9}i3wsND6&8%3NtY5-p1i8$HBm$4I0#4#NZ2F@dS>K
zy)S&hE1n<&`^m2bd_iTKb|J(j$nYT4CQ#W1sbh>c`$FnukQcjTd?7R0ppK656<-~2
zu&_eh0Gi3xE`&@VRxvPWH-de|3G&tHKp|hyWQh()pWYu|#AJzptuLtA2C=K;hOaT$
zM37w>*1nKd8>l|(%lCy$ZG(by+aF&@Ny#CSSe(q@3z;kd)j&zDzM!@oLlvk7G8OU#
zm6Qypz+ET5Iu&0~k*8B7Qjk)@;0r48AXVy`FkeuK2XTV&W?xW=$L|1gLSMcwsKjFc
zujw+r;tMMA<Rn40=%N5$S1twy9dKQ=(%sh$#OV?cDM~G4@O1}qW`SoRL77FT3mg#O
znN%=;7MRZuiheME6_^iRsIf#-z!x-2tqUp!+#7r$lhn{iflN|^qMyUZ7cxl=a;4T)
zU&!zuD4??c_<~3OVCfDrNexYRAsh@0&{V=WN!k}Q_@}!Uw333`7c?;~Cke7B>ya;H
z84}1i`NzKC!9Q>o=J4@_EJFg79bGcMkXdR@k>tu824B!DwVWg<KNm0Y1q}j1BEh57
z7c@&PCkYz)ve5MfEklx%6l7vx$bapd2rdgjgEC=CzDb~dt)!SpQ9&+)Z!%a$5;Ra$
zpY5B=&%mI2l8=Ew_go2R-jRVp_mMHED_{)H{viwuLLT~(!mu2C<bx#x!`f1PDRAik
z7kv@Jz#z=5FD(ccc>rqnRxvQ>>40N^pP`U}A?2$d<8~GX20a<LvI~X`3`>1DSQ&-*
z85s1s_!$`F9<eeCgPjQK@Q4PpGJ=}Z49h_MK9#SmjNqB3Wh@SfIVB9NjF4#+aK_Mc
zW?;~R#D4^XDgy(v2P>mEGssk!ZO1PZGB7OK!^&7J$iSfI3>Q98$iSfUpOvu;Rrr7~
z1B1!V8UCQwqCRMf&`{N%L!5y@UkwzO+avrrxfmGqwLvk~T<gyTa`P$BD9gGie{OCD
z2K|r;pw5WieLe;Tz5CF9jlMNFIO-Xofvq263^EWr9SaV2P?e}}ZOOpkTOD8snmkzs
zbLNp#mJAGM!~%@KEpoW%NlONXy)^;GsG=t<85q>1156}A>p0<RcUUqoD0~fYKvlcN
zl7YebM}Q-$=w?d>hV8KdPN<@rEEyPhy#kz3MK@Y9Fu0!!a6uK_z{bF^cz=MKAZR^b
zAp?Wiy8tFlZj|U>P{_c*%@e?+g{pJrVn&VtCLKNo27`Ww;?zQh047~<#%FNINzG#j
zVAA6PO)-J`oJZ{fm_VIXhGpPHU=Yc`U@#vX#-a=?3=Ed(0ZazWAag7k7zDEv<v@EK
zs^9@KqmY3?tVfa27Cb}&7oK9tz_5R3pcqK>4P11BB?CiqMW6<%XpbcWgQ{|%2Dn87
zSKDF9z%V^2a5JiPZI%oSsoH^?K?48?N3<3)FeoGkGP0p6Zee3!*r&lR21*2=s28$S
z@Itk^0o46^s-OYtwHST_PaA81n?2wvscohPsG4N}moH&6HNf>OxNTzRr2(#I!E@!t
z4>Z8d9`JPJq!}9gpju)os3BW&Lj%%-kp)*m8lZZX-$4#k>2wGRXh;e$Fc@hwF)*ln
z)d0`lf^F@R(SVGFfT|<&Y7Ov6$bSw{Y11L7A<M<UVE9d&fuST?LmuogZ3c!Ni!~HL
zY|yMFzlDY(i2X*Jfk9`nh7mX>Ll_tYPXuM~z(cnpg(H}gm4U%%b}$2j6JIcBO^4AR
z&{|pfU~VY}2IF*)BNy^&1cSy=jJ|_b3oQ;-76Z#LF)*xO7pwy6FzRxM6eMRd1glDb
z)<l3>YW6>Z)xdopP>b+vY%r)6X8_Mc_oW9zs&Pe7t~Q#@2eMw6fx$~rAQ;q#G)_uj
zU@)o#6%A)&gTdij#UYYfzz_@$UT|kGC_5M&yj7sG-1<f^BzQq>Gw$AC@W9kEP*vOL
z8w_g3FjVn@tTJZgV_+}_bzS>J41z%|Pvb`-8Kp@K!Qx^J3??Zc8w)LiCBVJ|6-Gu8
z!H}tSkcSTc43<)6U@*B4@=$3=u(TQjgK0XbYqEcNFgSAFfX3RbZv;aY0)WQagR+A`
ztsI6bT~IK3#~B2J8Y3ntBKZXj!Mc(R45sTqmgesW)&p@igDiF83)UBAU@-avvXqB2
z*Z>^9AWN4S27{+C!Rs%KB7(tFn5RH4D1RCZ9!dfa{l_m1hO|jQ&Z!UyhV<URt7MEH
zftDY*at5#B0Qm&8GVWq9c%A^<Z=d=i7(7n^?ze}91%u}az(X6FAA`a31mH$S!tCG;
zpfb7&)X12#DR?880~(ICyAiwz%mKB4^lgJTgE`<4Ig?Cb28Jc6oWa{TK;Z_l8azP&
zvl=`>0JeHlWiWV70KEKo?u20QoB(*pKu;_fJSPBlNAsOv@SFhH9rJpE!E*xOMF(tZ
z!QeT8Dv&!4?hOXd2~<Jc@kE$`!FIPouqDVH>zEiA?3M*vaWgQOo&iP0-k-tNU=AoM
zG-m|cfH|P3*tjOxmWP4C^pOOpW--kHrKKEb<zsrr7?gnE^^WNd(72f?sQx!eL5N-y
zW?<ON!4X``!N6b!nq<kn7+eP`CBQ*oBotf^=71Vc>05%qb9Ug+cexS_p0filVo6jB
z2G7|oV*{mW)91nr48gO7f<Y_W%>F}ywI3YpAn#0l5e%M80|%>KP%wD*3~Z*`l3?)U
z88{>jUIv5b&cGp=78nekIs=EKn?^8r<_sK?u7<(WK}LhSM^l-D!4qfTRWj}ig2D4<
z;9M6R5IhT{3_Pmh$rd~t%mFQ2@$e3w1LlANG(jhLE|?<-${eB_*@F*rFff=$L;P?A
zECuz$Q7{J-E<TFE;Q1MF(y+S`44$6>CylE0!QlBBa3Gbs1%u~js=zZOQ*McbfU>*!
zb|wafW33^ez6+#TZM-~00v_g>pF_ae9UMNf(IJqs7*zbOTpt1{i$SSk)#DIwcK;6^
zeQ6AF2~p-?V6bp!Vqj1f4}lEpfZV+!E(Ec*tol?4Vr^MVM+jnVnbe;U@K`f=F^|g0
z5b&Z0aHo3dgb;AA23(;;=7xYq8ZF#G6-rEh2zaFN6lnZoR%!@nq|qWAvgrR51A|34
zxU}a0HQqss4lL4=K+CQ{!5kIs5&~-8TD%0W8VmuqZo&0Ukz_~`D44;uT#<YTxOEF2
z+7V6(Nde1%ic~|z5b)$T*tuB&A&|*$Q1iHnGb977OhP27G>su7laqnL;w8wrD-uGo
zz#Id(i++M#$ilFRk%8gJc?XA(ZVm<pOVFZXL&Xr#Y%v4aQCR^Yy<jszvCzaB(g)^n
zKr8?ybBmWCN3BQ*0VQ*bm*D;k$jg?|;Fadg|3RLP7nTVH#ku7@aQugY2N%G3&Ukq!
zILg8KBlB}8ILg8CzoIo166GM9S4;>6M>#k+R?H5COhbTdUb#LLyowtf9O^4VAstyz
zaIpRlg>+=WL&!_7*o1<H->j;^$s`mMmk=-Rhzo_pCCDNLk5EutLWb0gmxqGZTFY^Q
zEYb`Q1+TRRrwk?eQ1HqYaLVxM4n<T8#+ySy)q>hBP_=L*Efi8MfQFuyn}$NF1<(N6
z;h&+9YQX{&KFe<igo27gD^NdcR%$3@%?c<D&s`J>Udsng6#ZvH!5dq^p<ui`)D|2W
z;9M{%nI+VbgMq>71``8Al0YbA@d|jo#jFU0P|#{;Yd<CihW+)SkhLTr!?~P8AxlX>
zK2P%sg{&k2WijLBp^$|nAfE@F4~48F0Tmj{--kl_k)R-+crO&(j|2xp;`7j8u!F#3
zOCGffp`dhbJy#^Tq=F$7l+NWiLALT<3x%X}kVP}rghJ9e$f7QpP)IrlS!BFC6tv<)
zN(?-c5U0rz3ffI#4O$G6)D;R!&XDL6$P3K|Tgw6p$>b#pp`d*t*1tqjQgawW3&2tg
zB8e#}455W!4#=~{%R`Ge85pd8!Lz6h7dS(JhgY%{1wujlMr=Uy<4Iki<zRgvw+rNj
zR)9GmLrhPHR)RSokEnbNtpanv(b0ZYAQV)w*nrldCv}B_*MfjElt5l6xLyHAXmf2S
zxL$!pD7apM%#oG_u!n(~PByPV#j#x&xFZS9GE-lKf%}o*EVK7i7`Ph=E{?a(3WM|_
zL7nnd;bGv#dEhD~>}wb#&w-2MluZKRpwW3-P!nmDYB*RE*mcJ9!@-)su3N<%4%P&A
zUA}ubIHR880o8gouR!w;6$0U)F*(~}CI*I8s^O6G6%<U)Yr-MrD=3&ce}+TKS5Pp8
z{||?hui$Miep?wC!a?ILw%b6n*!AHKTnr4h+dxLl^$K?cb&XDe)&We;3U>l?K<fY^
zbHklM%8qrw3Nzbd;JAaYQn$SZ=9hyKME~Lm;cgrZ4ECTwkVV4bpkWtC!cqAe?g2Iw
z<j4}`a8ED?<j90$;a*@4C{Y@*hkJuLphW4c8twz;fKtETu5dpv2h=tcjt=(+b3o<o
zCXVm`Fb7l!xJQQvf;pgNA!6F$L0}H3ZRk@J9t`Gy;-P6%cnFvSDl1%OgolASpt3?T
zIy@ZA0ZqhBX$p@3b3ki+q@BYf!5mOE#B?+~3d{km_Ymq2j{$Q$K>LSghR1?Ap!95d
zI6Mx_0S#>%`h~}HfdVH47MAux;IQKZ%@c^U2rxu|wousXf#xA>BS1^kEWN;`is(s^
z2+-~<d(b9(CYA`uYAR67nVyb-<T_BeHgQHkavdmKJC;Tifx9H&JR<OyBcc=(GoZB@
zOe_&);Oql3LH11qB+Eh8k9}cauwMao6?kc<{R~wGhTseGjM73N30POE&O()eA;nvs
z@fxVtbqXrXJZXn814G+8he%NS!$DT0v^a?&Qd|hs<pEjM9vcZx<I6ztQEMM5Dayd$
zAPb5Dk<Lgd83qOiCGdoseE}Z>gT0V21H<uo8j+w5hC``HVFp8_oCpJheF4a*oxG9q
zAl;=Pud+XjR1gJqc0j47JvI_N-n|Tz9QIy`1a;*Ys+2&@SbIG-28MZZkrC1i45m54
z3=H#r8_0lKL=Nk~PL+{_J9S>BjFdP7gTp!vkVe~U!VC=AS`IQGw>a{Nq^2;)fZSs9
z3gi~{XEGqS7&C&bpO-140M-byUi*!VA~+5}9?t$F10H*SV<1wJQp_NuEXu&($OrbY
zt)UVF1E;x6G}vL#&}2FiA<V$g{?H=|RD3vAfSnj626rOc+$eEz1_s9pkm2((qa;9_
zT2N@_IYfbi*0BkchV8aRf$RA<4j`YHNAoc-m~ZD}V6aFNW?+aFE{FpA=_)9Eqd<PL
zNCWw4CvTLz7z2ajRS&RZqvRDp98fCOeiNkt_7iAMhW%L-Xp^onBX~~6;wKvegR@_h
z3Mf&$VPjxWxD=HO_L3z7!z2YZej!j#8t%OSO9lp~Cu{<!q8`Ew46LFYY@oqqr(h-q
zhA@6M&~{Zw6E-rJ4KlV2Y92?ov4O^xK{Eov3=ICqnb|;<pcAOvT6%^JwEKpkib14;
zfh`Hr>J_PEU`qlI89|m7En{GCngUMi$qZ}^45#eamh&($IDtk`j`6YW;9+3kH;Ch4
z`^w3{-~^fs594S1242Ju3L$nuw(npL)FnRzKqI+K3@IFJUsxF!oPNYJFgUFVW?;~M
z!}bd_e+h1!dCuox`^>?>;0)SH?R1v`G%-?fj_t27NC!M*9E2GdcA0rZgXVjkK`XuN
zXG9~Ws!x8876td(L2>POF<Mj}6s#8DX{Bgz_4396R2u8($VY=xzw=op28Qs1(aP{V
zzjSFdq~#7OHPphQAuV@MRx<t+4Vvs>r~;M7$<v}C0~w&P`z`#@kbw-)uyOj4XwZCw
zo(y=yYS<p$Xgv-F1{YATr|n`ir0E6<q%g*4NYf2u(PD>aNYf2uk!DjgWR`)4A(<rx
zR86_qgXY3wAY*zU&5^k=+Thq?6e&qeXNb`Oah5TG#)PI9$LMl{EKHV(0omrV0o2fR
ziZK8w0ax68oH2%A4k&sKO^PuBb3pZyLSPJJ)RP$;VlgJ%pn*mf@T^*lDR`g}<asN_
z7&DL+8)U$xbrl1H%YkOd@-0^e2JP+`bC9fevRn*kO2bv0iGg9p&lphO8nTby^mGiU
zZ_NO1EJWtUfcn<_3ZTZqM79`PkZZtw$s)rTJ8lLBS8?!`D9}W$t2#JI3WEH3hB3w-
zWX+jm<`_p#1_sw~CI*I;rZM2*Rq&b&p|}{xs46&ITti|&qp7aO$viP`AoUADUH-K(
z?jZZX;S!k};{oP?!X>^Z#uLO@#smopFGx^;Y_8^v0c{_5O-_-E@n>aVaD5)kz~J5x
z6Cec&h+qbWB}OrUQVa~P>cI>QflV<%Aojvw1_syYm|ze)oFQ2$2GrtpV*#&>i}4d-
zU~sW#NMK-aUCRQp!hc~*D9G!ePQ7tiLJVl~!>y7Dv@jzk0yGX30!jt>J7OZi!$qLf
z?%og+1y1^)lFjsVOq2pB>4Pd{xd|~*njj9S4z@6ji82Op0wDf^ERc=>Wr~hH0-T39
z7#Q4kgXh>dLA`KD(PF%u^9Wc16f#{hoZxQwDK_vRCg(BeJPmYu!tFFTj=-(pls6ol
zCqWvYfi2?%b;bEUfa`6EJPyvY91INZ(o75tT{4`I6_FrcMdorsRz!j_M#pi^3!)%Z
z;0ChWX$A&&ZD>*pVPFt_WneA|FB)_}qh&j|3_u%&+>1m&+jtGU!F!HC#<CtZfNZY>
zWw9f34L}oD3{{+<6zp!xz~J5lb~Xp7)X5VzhyYny1T*^ZB})c|`b!3fP{xxFUl3+s
z2)xUqIg^8d!2?w0Z@Zy63tXOpEaW_>IUCFY1zN=;P0(^-NRk(})dZ~<hAe*3PS8ZG
z7gm$eM64HfZ_os-7lv$~S$I(sv?rPYJpRJ=OB1pw8swK0C(R{bdq9g{68tqmi>w&H
z<Dol3G$EU!xfxg(7+54Vnax1e4``d2;3@_Nk5aIgnLrI`k5m>0hOJ(j%%7D(62c4&
znhPXiK?B?#dzcs)))dBqR}_I)3^doqg6EOJBj0CZW5Lt<r@$*bJlYu;JWfD%uNAC`
z6_;dS@Ytixz>xhtRsv-88({{9?TQXMpsg96`r!1e10L55VE~UC>llK^jX~+TJyr+Q
zfn_)aO3!<JbRcuBHsFM$16q{AP-P2BwUPfEbU{5%PtcZL`x&}Ukn90APS+X9I9(TT
zArCQ57qkR~p$cN0E~sG+GHwZ|5WA(M%g4arc}RzWL3tU24g*8;8%7-l28#nsIt&bw
z-<Wk67%Y8QbQl;)Em?IK7-r04(_vunD`MASV2BLiU`Uox0`+XYKo!H0FeP75wgC5O
zw!c#H6JTIa?*pZ4H%TS%NfqGX0;ShV0bpe!;2fnC2<AvIBr7O^da_=iq_y5cDFiGG
zN?I$TltRHANYShmCIFfP0wo4FNu_YG45%-l^jawb%#mS87E_AiWMJ^hhu9D;0AfQn
z7F01Xc-4bbf+$0Zf|55Y1B2JvU<QW6FO`D0K>-oWz#w=@DUzFk!HYL9JvEO(DF(y_
zml?W27D}KI1Me*G(iJ7h?mv(l=LaiUgOepF`4@RBf!6szl0V}*CD1}2Nb+YquLSCN
zF;uaDV^#?=(+wI>=6R_EidRVT=QdIT&2&SO|BO;4NL+$^tfim?+4lmfnM!Ubfj7E<
zm#ic)D1rC6ECVfB*`}Zb+2#T|o5ibMf+1NzDVddl!TS(sr=pKi3g~>RDh7xnQo$TX
z5zs`LQW}T@9tz5qR!RqPz(b{doJtv@pw;gnw>H-*WrAe>bAb9QQd3wsltAq*?;oJe
za(|Q(L5&=6B2X|_N&<6OL~>G!8I-cv85q2OfD1S8ECvQ24sb-+gAz8=N(Uv-5P}b+
zm7`PuN!Uyb47zbjh4KsxJ}HoVqErM=*z5C^z<WlPfqG?oeUwVTF<=Mr6{wTLP-PEl
z>w2vfW?)#m+(8f2Zt($a-L{{hrwOqDoOATFkaCV5WRMDybM!zn7qFb82U<n}$~j9J
z85m|U>lv_s4kdvtd0{$y2DEo`qlBI*KLdkrI}-y#D}$ans2~7WxOyIX7GMr2iIf%S
zS%NvBhDchXo)wq_Y7`iM*Ruw5KpDqRK+guu0R_8VqaJ7|9+E^%eD&<WGN7^k$~rxJ
z5C=SFAk(Pl0OEiLrTZ`IIf6N$#+twyJtq(coDG?#>N$fsA`D6l42m1|T$mXcd@jH%
zfi1!e3=MW7dZ1+vexOm_Rt7zPkOr7%0>B)QXS$B-1%f$H&jf)vP|pN|IZ)4pfH_dl
zgn~Js2^14wy)ZBb>X~p52ke>t%X$$Y4%jm#OY|ba9FS+yn)M)CHw8e+hx3tvUaSBE
zgFk38Y-6cj97tUigNRdUF@s(_m;-WYS%F>xm;-fbBA5em>CSh0Nnj4hr6&^flEEC1
zOONL1rGPn5m!^U_P?x5GIHx#7d_w&g^wN1i4M<SV%zm$z0hSRFadvTH(97fj6<MHC
zs&BGh7FY(<S!+F{mks9VfSN)3x%6_R85sQBg&7zop61Xi0Qm=WV#PKQJxF&RRMIr1
z>Opb<xap+wSFc!_fx%x~n1LbB-$ENyp!oNKs~T-bND60SU}%rkh73)Dvd~^1ZOF<Q
z6L3b+2CbZ7s4@ku2cH_j5yuER)W!cOKj`SDIK~oC&!&^XAt{+5j<FQvprecqx%nv!
zag604srlfgGYs<?82qn-Gczm0GDZf5tb7H=Dh3As|De?&`{Ed@#Tgj<dqE2_dM3v)
z*6@R*z{LQ=Ee3`Fek7fXHW@J1GcW`cU1m%vV2EREkOUdc!QhZlkjN0n*u>Akz;H{!
zp%~0-0rOP&85sCO;~3k(JPilXCb>99&;~7r!#ey746zU67&|~U!$v&@(7}5FpwspO
z_^&WBFzo-w!N3v62pWYC3g%~E$ov<_*b6oW<W}>$ag6<79%!Y2XG9$1L@*DuG2n!A
z9OEP~kB6UuK}0x?aSE6xz|X)CB^<{%6?CxT8xej6hPJ73jMLZ{7=nT&_!$_ssKqf(
z2de}*yKP<^;|!2ovIa=y%s9r`AYQS9F9Sm?YaHV|5U-hu!IyzSBr}e2A=psn0AB`%
zCCB3!7eTloz6=a$i{ls<L%0#X3=Bd}ag0mAwlK%|GB9+`iDLw<@DG~IoZ!pA5ZxWe
zxDq1U;LE@uW**158p3VyWnc(kj$>R4;db~kFy#D<V_XN}_V_X|9QYN-xCz3Y;LE^}
z;T^}g8Dj4gUj_#6zBtA$5ZM{N3=GWM;~2L>xO0{>GB8ZO#JB?#-^>d@JeDPlJHfmQ
zAYPL=<1P@71?1TSkK-8kg8aUi#Q<c^g*e6o{0t01o7q6Jt&VYw2f@a&vG_7DuyDjN
z9s<c8W`m@uHw+9x$>1~v>E46*#b7=wr~%9X;x~i&`EdSZFh3Z~zs0~1v>42Xq;8P<
z&0u~pT>dba4{1|?)L#bkYeBilsVN|i@gfHULvS8H14CX}9OETWRxto2sp7Uc#>-$H
zC=oI4ietP2=7Ew;Npc+HRWJ{fP`Y2oF<t}n6!;k!mRZL!UI+6)3B}4jj`0SVXTZ<E
zP-Pp(coWRC;AdbssuRa}3(Ru>?_Y^yybX4m2gqrv(>UT7L7SFBg#8#8VsFMVJ_H@o
zX`lewm!tS0j`1;=%c9`Nz);^C$M^)oRRL|&(THPw3g$9v_%Seu2E;Kw19O?Q{TLXI
zx5Y6&2Xh&9{TLVy+>K*=0p>F4`7tnTJrl?H63k^b0NKkF$M_1&<udkTU|4rJj`1~^
z%WMmBWcnA5IL3Dz3=AQ&{1_ORD&iR53xg)|ctDP1PK{&y2v)4X<Hx{|cPozZGnmVy
z12TC_9OD--ml0$yhi4q)R|r?%kAXo$F^=&Ym<x6WOMD#TcQBU~<cz#Gag0B}Tn-D6
zGnT&i5XbnNgMlH;m!E;b{BRuOUvRL3qS1pVj`5!uD274N$aF4_@jqA&6pb_P$1yR0
zd7x-K5*x?F2<CyJarL}7CMGZs6pbQp;+R;#JWw<)^oV0(1)B+q#)w~WOl)8|P&7{5
z7RSU6=6UclFqHGhF>!!-0U(#{j$;CCnqV-9;Adbs{w<D)8!VT=&%n^36vxCP!oUzB
zoWak)p!zS4i5Dza04kRY<Cyrsyb6%Y$T%i`Ft351fnf??9FqW;*TK)gaH=nkNf6AN
zz|X*-Fg=b*2+W(o&%hviEsjYT%v%83q!S#+Bnsw%iW_0qI3_W$?HfQlk#@x~iG$^K
zfR^c%$1zEOd7z9f`5=x7v>u4T-~>MdgWCQ$CMmGo1%3tw`{p<%X)x~wKLf+^hBzh}
zFz*3B14FS?9Fr`V_X1q+O!o?4Qe<EV2bHZ|esN4npyN?HK{1wB7RLlW(6o~gQh6|`
z2!f7(1uY9a8ym-@3g$8UF);X~#xbdZOBZl9IO!P2qz>i^gR;SjvvEwIxMR4*VeSB0
zQX0pk335OuheJwg0Ye;<7MRD$&%m(THjYUf%meKmi)D>t(gE|h{XnM!#xd!FO%+J+
z0}TnpG3i0L1(5oSNnZ%$4{$#dR7r-LfO9b)C}q|z6^LU3wadce`572?-i>4O2N?`5
zVD@c{V+sKCz&pG=uL{I5ffkyEgCa}PAdV>nEC~t{CW|<xP!R7HC=o~I#xa3<Rt&dz
zKz5uelZa!A;$UD1zsS$PkiI*P3Dk>X0NWwAKaME|q|pGRF)22V3DoprFaU3Zvnvva
zV*<4y!v8?(Y$k9U0<7_PPaG4d5y4;pDX4ETFhqcl(KV0<6|9W>3=9!6V1FX`koBMJ
z44WBQ;+Q~ZFhy*v$t)~mVA=+12{6`V7N#*UZHKZ8${3h-K-lR;WeiL^A?#!jdl!UV
z3}WwwuuDMfJrFji)xfkD#FnTjNnv2x2Vyc_Wh_g~VTfbe4~`sAz_^vN#4&+(0!JK6
zU|@*QVPNQHWMJ5x&1ewEbeMr5(%K=th#`*Y2tNZu_#Xy`WDp0`nhO8ZFqN?w#5)G6
zt0psoYO-nmaZJa-Ml&jas_mROCQt@oxW%aA%fKL<6UTHCBCFxcz%c)K9MdT&28M`@
zj5=UT_sTLw#4(*^V2IoVvGklMC_oveGJ<VA59Tp4K&=IhEJetG+Y%saFM>{c;%9Pz
zT6+n?^?+J?8Eh>RsHFk2_6pcqrV!A0QGg#8cnKqHvWMyL24Mz<W7Y~hpxhn#P$Ywa
z2Q<4Q{)hq8sy$}IBgxFb5P1UB2ixetD<;6e5XB~v!N3ce^NeDHRH6SF7^1|)K&3o8
zNYmO)yb>TyZ?zd1cn`;Of@NG87_zhCtN0igbh-o?7(k;hQC?sfd4?^FprIHkAt45a
zC@WYW=D>y!1_qBSQo^iokrhe|3=%xjd{UrQvvAP`!VC<?X$z!5$0$Z^WMW`Ay-zw*
z47BVP)Z*5DBb^1F=$HZOY2-x9B!JfIMT3Ssvbho<n?^wDnrjolt0%z&z4jFepw*Kc
zL7>h>WNrdza4DJ>)N9ZRPXLcDfzQTle2@ShU0Nmu$^f8I-)LE|m%zOmAqj~D(9nPM
z6;RKbD*-$M4enVl3P=FYK!cb4sL3RNNBhAC{7hj<00k@qc(u|>g9K1iK+g2>X-t6Z
zQULW(LT@F2b}2wsg8T1F0I&L32I^Ra>`4Hx`T&nA1RqNPulfLwDx8f?fUN5S&BIO!
zNC52xgPh$LnVSG!^|4G06hzBp6%s&;gJSkUoDG>`00q$^;RMj!HF*3ZHIE?yGQ|Mu
zW%W8GfG4lPelY%<0P3nk4k=PNnE;w%fNXbLFf{?PI0&=?Qto&HxUUX&w*RIC@PZPs
zvkO%cAboYvU`SR{0%$=A1Ng{6z48Rma2!LGs7O+B8AAeiR$`f$NJ<$)0(eqlnS@AE
zY8gWUcsLHceP`y*1n_zi@EJR;-x9#<NtVfhW{PA(EI|8489;Mf^Z!^#$%2-^voSEt
z$+D2r0<pI;GBAkASTL?)y~fDEz^rb;xLSmPA?6n!14GnC(7c<sOd=>X#e&v<WpgEh
zQxiCbPedd_QWK~{+9i_+N=*z^prBGXnFvZvkZ}ObC5fOdos0)TNh>lp5wuv;ZMQfm
z8dNGI__75U7-Hu#F)(b8;L8DTIt4{T#z8*F5gni*r2<>NJn)bTC|R7;;e*U63xKkr
zN(Em5GXq0xv=Rfuj7Gj92?mDP{qS5fgAZi35(9%2CtoqB8w*?N%sgp}5(9(qExw<i
z-q#1Xh6#M2EnG?r3^r@{exYjEpvu57bp;>eX;k4gstgP&oP3ODkcF8Jbg(cmG<EPX
zUH}WLGBBK8z{hwI%z<0hqRPNfD8|Ql301g(g@M6Gh>!6ySa>s|03YLDRtAQ+Eh`v7
zGjxpq_(5B2K^(OYjQ_#Q-$5Mv8B7e4;2jNy3=B@17JT5AVLYhDIvdN!_y-h#Z$MKT
zagCrlv89ra3B1Mq4X6#6eTk2W8FVC4Ij9Y|EQyba1$>B{256gs$6Y=qHt_LnaHm&*
z7W=<oV2IZM7X{!2!|@WT3=A62`ItbdCSC)kwobs1fx*&^gO53xgMlGFpC5GK86Puv
zLC+gdC9n2@j~TS0hXHadOuP#NLp)^sQ<$O1$u*3Dj~O(|7oQI`k$Do2Dg#6JM?Plo
z00tsTIaC=KqRaW1K|>h~2w@gg28LBP_?R=1*RL~A0&Uk&Kg-ABiL&DSKtU!015*Q|
zO%iCyc>?I*h-|JT$j%2)x;zn)#0?5baH;0CH;D&SDIEljyF}hh0vDR6Kxf4$c_;CK
zWk8$je0-C@L-NZ&r{h((CPB7#f!20RKbj;6Rt8!}k#QwS2+RSU2YPCAk}#M9TAUS`
zn*`cHn=l~`Rs<(30Ehcs(CB7X7b8!SI0pkm5@>WYNIeO>9tS+*R&SXEDMCSmN%{|x
zKpVXv!@P%Wk|0GWDDTebOM(=kAb;?AC4m>tflFuI!%5(UbKv<u@!%xT+6BggplsNE
zC<(H50kp2gXmb*H#&#L#TvLrlN#NoXysCjWI|)*pf(}B7`<nzQPL)B2K=md;W^6&r
zU$(zbf)uB!ph-ZRBuH@zI)N~AdlG1Q9s~FULPM7%$PO~l&=iwJ5@hI8lZk=B<Utao
zI0c1q?WH702?|=fe{y${0eI9E6yP2SNrqq!=mckG{v^n}E-3V6rYAvWG(fW;dgqfM
zGa8`LsFkylKok57RfbFq47)BQL1y?t=T08(NP^7pgU+3tRhR^tU1c~0TAE|>DhaYy
z4>U$=@+AqpRu4P~+`T&qygY9iD3+OwlR&#_8LB|jf_{sVAS3UfovO8`lRyJy3{{|m
zUQcdGf{eU7gTgH`2{Q5yTF%4Fkpvkj10UHnAqg^4=ElUppm!n(GNl3<7+pCz2{NSu
znsMB9GRYkr2B2dwll~-u$K+3eR(M9{CV^J<B>nJ%rL$zn`1f8oAG8La!9X2Uvq;KY
zfrl;MOk>Q<W6(&pVPHtE6)9jywiN-fK)FR`W3nBne{%~|ici0u3_k1i4Ji2}DJFx@
z)qVq7h!W7A44NfQo(LL#)P9o;nk5!Ipa2>eXXu2k<W8Ol-a!NsOKt)ka(2XqBiW0c
zfgyQsFatwWSu$w*ZVF>C1H<C-WYF&26!1#2)o%n_l0kdOQb2>Nil>r62T7%rgB+Lj
zHyO0}Fr^(7kZW%zCkZn!q)cz|W?+a}nVc-dz>u<>u?1}3UeNK5Q?2+I7*g1T85q=V
zX(an|FfgQ)i=-qoB!kyLz5$t7KP@>3<o9VH?^Ze_2ZK2v9~!DAgU`--BO#KUnZl3^
zKGFM)j7UZqLvlE%Jb9xaQc}o}3_eBcjS4up-!L$ww1cxbq>BaOPY3h)!SbCT7lQf!
z!Tehc3@JO17T0=I@FasKJX2mn>;y0He!~E^b1v9U7O<W3z-;g-S!R(U$)H)yR5Ovh
zWQJt$8Axv!MDmImlEFtHy<rhaDavF>UJB77l9$VnybR3d5h==LNCuzs{6+v&Dsgg!
z7bJsrGo-#|VqjpYO$O~|NPW%VpI=(SkPO<*kot$s!JC1Be{1quP6mcFULFvSl|Oks
zDAa2CLA(s><P9PW3@NYqJ-ithbQ+R33NkRHDf7p8GcW|IC2s=pjQJ;kOxc#aS(t$#
z%~`;}8=M@rNH8#@MG6}DXXY^^gGTt0Rl-3=PVGttZ*F)Kp5YBTJSBNMs9XIeJO><x
zZx|R-|A51gu^%Ro#tRXshYNtV*)SMD_6ysCL{oM!Fr*oS<ANE?2RY0c!3UkFlLk5Y
zo*66()|I@Mfguglh-WYW>jJB)gvzrpFr3y*W&%y#r)6?gWu`MEGlMc;S|-@Npz&0&
zN_Nmxav^^*vobFOL)v6v1_q{1g%r@{oHWp;gEPu0d=d-{>5icE$;zL?4-Q;V`mEWS
z0<MU_IdE!M3V3tQ8xfJDf&zvV@S!npzzd`mFR`TP34n}XVqlOmNr9BCAmi9MQXnNO
zC~NKXPJxuHpsMC*b_%3qWd`M+wEsPf3=Hky9&IW+8v{dnmJS2M{%4@M-1ujpx!n1s
z;3XmZI#YQ;jh-ry`su--?rmy1Nc{pG28NuaAoV#rK<aZ&gXVs7?tyo`nrHL4fhz0t
z_e=~7-bdWPl{I(@=pd6DxUvSXh;3Zv2HqAA?)yaMx`8We@CF6*YBz8X=RbIjM2~HW
z8)#W{7W5EMUr_r1+}`byaf5I`b><>r2nW1}SK%a-1Df)mTmt53%?5P<=C22HIFdl6
zKy@pa!vJ0uEf)ypKu%PMH3f4Rz?+6nA9jPRxCYgXt$W=dE3QFRo>Q9}xU_-ZM&Jfs
zaa{$f%eGm#fmd9EZzHg+cLU8+Gn@idU#Hi(fs39hP`$L@%Pka?U#m<(tA}s8fy<#P
z(2f_AFK*z1s0wtfn8;!`a7hH7>rcJp20G7=0eq6!JWV&yyfp)OgM;cmH^_1oPzf6I
z%`FCG^eIpsQ_<}PzFFWDXl1GYFSj_b3}{VWUV>XZm;*XAVaaZ{1Q4eRG@~9r)eTf0
zGgL)_)_}FSffs{UfsQw2X>tQE2Co8jLHf+xz-`AW(1By3|J}e%$EsM+X-_6@;2jWE
zai9jlKR56Wh^lzd6$l+};2jXlK<7<t({lsufM8e#I_TU&$t?@yf@PpdU7j8{@RIRm
zX`t?is9O$5rV4aoS;B5NaCf9C6Lk1CyBoMWQUy8>OS;Pq+#RXPW@2D)-Qosb;#vhd
z*vyo}4Lm1S1xiRvc5dJ~u`1BX8cd#U;923Se9-dQ8*U{adrlRAdPI_yDsG_L2(my&
z*=KXPRU)T82nU+_z#LfWgK(g!55$3|J`e|<`am3b>H~4$sSm_qIHdq`Lf~H&H_)XA
z*`O8H*<5Z-$WDN8piTgDU`~K=piTgB;7$N>;7$N>;7$N>;7$N>AQ@owK{wEWhuIB~
zitrQzLv}xWqm0fg6*tgqSPtkw-)t_oUS#J%I8f(-IWXrzI8f(-IB@5IIB@5IIB@5I
zIB@5IIB@5Iw!7rWL!9@Yfgwi^?z|aJ4sM_$$8$i(!Dn;1fwyA8iVyHsEbtoo>2KY@
zTd_`oieiT!Zs4t0;8Q;KIk|yrYVZ_z$qhGfRSn);vPRMkR97c+NPtH9f;SquF@hSV
zxqkehvz6T#%^@Md4;rk6@j%mpi-e)PDp1Ey;UtU)8UdbM0^w=R28{sEUk~ANB!Q+0
zs#_sEhEt#}qFf+^#}On0>NA@{cnqgN9mcX6H%1H4;_+pmVeM(=Zj6>7-YL)^^%4s=
zM$kD}4F9!2&W^b5<HiVTz~<RPoejQo?G&gd*d^n}2;sq;4d%g}4dKC@4dNl34dNl3
z4dNl34dNl34dNl34LXQ{0qpF^TsKD0Nem3jK+ZOO>Bb1&6Yw82mLB@pjS;db05lJ>
zE8dL}v@1Zp&xD_W0pwlCwgAvP2*|tOeF6W$yS_k2H01e$Yie-qVs(kd9khx$4|K}=
z*;seTXcee7?UHeaj8=haQ<jbHkkKme*`nJXNVtPeJjn-jVUF%{S5;wP$nynhDmd#7
z=~01_{DC%iNRJ9M1XG#d4&Ge>9<ACP>JI5qfl`}3mpi0K1<DLQm)t=;Dvl&jWz}-d
z9n_=ZcL0q^^)tIedQ_mHv^7WEL91pVLuvE1+#!tsP)|3V%N^1P01xPFdnfG<>N(}F
zXJTMDy35@Z?$WLvcSy$x<kCb2cSy$x<kAD(?x3a74B%~ztQ*}y%a<VQilU3$LF<?F
zWI)cgOLd2=UjlU!Hkr9Y)-QohvYF}S4q3k>#Q<tJ6n_9U9MYWF7#Q+D>M$_$1%Vn4
zr{;hf4t%Mgh6C4L(4w)FU7$r{bCp4h#!5bd7L7%lfsg+U4N^!0weJf+b<Y&-v_SB>
zQ&4b6=B9y`U@?GKA7#3y1q(7T6vTskq%|)s1f&d{g&S(qK&wR|$AA}1O$!4n1BIiZ
zR$4e%nG9%=U;alv28M!^>!6*_;t48gpvjDaJ4_4=Q?%1SOS&Mdb0c%pVnKRfmd1fc
zdZCuagJfWqCV)AhmWIifv_vomWNE?FG|*CV!2_U>Gt^2;2FrlUdWU40G|-(rg`keR
z^362xhzfY<ATl=%JdOgk)xs+cvLpm#tK8Q#(2@}KI&hbv%Yq{fwBMr;RLf1#PAdR4
z;9w?zj!=UHmh#QCBCrg|1d}gm;L$j6+MKg0t%Qexp)eOR;ZnuGP*?*mO}ji;(m>T=
zA!x{3`DR)r*bHb?RDn65_GYnuS~bXwjgXBYATtiY&FD)~NdxV<Dgrfgrf8=%fVDx*
zXasXWW@NgjH3=a_XER6!7P2j14k%=es?u7)9B9b4f%QN`wjC^^0E*i}(AgS&RUBzu
z91ILapv^GKH`97R^02_^1#>`FTX?1QfjFmF7^X31BxW**q)lXCDB2H636numFilgy
z9FV3=_q3^CyFnqUH7{)%NCxcQsMBfF!5r|V2t@_c7)vr4IMQY@FcgC__7v^3IUs46
zk#oTukdewa)8>IWAR|q_q|FC&K!ZZ@*=Y-SK>Fd4RICUI;AxB{`3x*+iy0V-LqQAM
zZ>E8dQ->M83~U6*aMqeM(3XYbP<R{_r$CGlW?+zAu8;=mEEaDD9U@knwg#jPTx%ND
zrmY2YKyH%znzoJybUqlUKuBdwTMw22jX<eNrELH?a5H41X%z!Q@gcbBa}RK(UE^S2
zDE<y!ou76cqz&xCL)X%7fH>eIn2s={-2`*kK+Pac53V%Ov8p9H5KVVMQZP;TKpe0p
zy+3K-bK*~dHE|qJN_)h?z)+G1UPzwySQ_LIP+DuKO?v{?1S)9dzNS3|`vZKqP@Irl
z8t8o0l1_-Gmmp2wL7L>gro95I1K($ryHzahEy(cG5OwcB>JEX_oxY#;9&Y%gg0v4{
z4rr=`H9GAhm?H%8lQyeZ+8>Y!pCNww3z7o+spLl5Kd?<q3^y1V7`(LDK})M|r7?mo
z7%jEaVPN2x04hf7{Xxa(_SK+bH0=_o7<EYp6{GTgpklP>4X7CHdBm>6z_9TEczSn2
zl1dsQs5@F(?f^P<HjR-F<m~UD`o6g~jgcSZgj1l#$ArQ(Mgau|hLY3ZDdcU_`O_Fd
zwO;84s76&3jcRa>wu{pk)j_-}u*UW;a%qg98m{yuRHHVEMjen+u#G&M(-?JmKm$5p
zji<t-(ilONS(y@4qalh$Be=#>scDSHJfL&I!5YoDMA8^RhkutvLp9cdG#-Na5q$jj
zGLRox($W~gdp`ezr?7X5@}x0>?hz|%gKBJsYYewdV{8F+43=?$+D(ho#nQkl#>zJG
zgDxgaW9$G+g6!y6n#KsaOH93v38eH`szMrL4+jH7*&V2<y&zM+GdL9Gr7)y1_K7ku
zl(m6PEtlX-W1Psrz)-Ht&%nU4F^v&?5COO~R<$&Z5quKCGEi$wZe<!H=w2O$D$o(M
zC-c%6!DkUHV+YyD5onmkI0Ix%1=PlwAREB}z_K=taTds_;2=M7HH{I{*5v~&6Om10
zoFff#DClq`xj$))bHQ$t1{rF1LOP8RwBWw{EY#42a6=nv(-;?_7`hnDgBiL6Vd&R1
z@G+<5XW_>QmfwMt42BF0eP?9S7*}vGFjN>q?N|x71LW{kU{gUc2XZ)Q2#etq%#Jm1
zJNEmhF|Gv<se&D@dqz5q5p-a81uQf+q8JK3i31)Q;G;O;hHilv3i7{mltLQgc97d{
zL*2Fm#Tdv@-7vR-&*gv{vm0Uzs4GyP#t1%{;}qy@+idAH#=T&d%7d)fJYOu0@c;({
zLnSQ5AB0<>RFTFAIhY${#WKG%M##zBAnz}{mBt7@2jY|v$QaF4{ArBGLB?c4U3vm!
z3^<QRA4+2cZ8>460vQ7`6twAt;S@JNXfi8}@ibT)WJI%yfuXVj9yd~1%4v+}K+-V(
zp9h%=PgJ0jxf$TWco7^^Ajg%<rZHZE`#<|n8slZK9LWC-i_;iEM{;unf&H&##GJ+m
zI()kdv<%XGa~k6fkkVzKOl9*njS+JCHfRBka%mbP==kj_5y((o6$3++GTf;J(ky9=
zpkueIz<selX^i(k=76(N!<sb4`|=D7Res=#uktnnLscwXXX<pOG{%n{3=CDEWlSI!
zd;;kNyI}tJG)B+{ys8e!B0-Ry)8RS;PqCyiego+Qtt<q2^E*f<*iN~xX^cPQ7#OM!
zf$gk{Wnief2-oTD&ymK&#KFK&4T_S6+B7D};npBu8`Y*ULC&@YXZo*cOsrsq@Or;m
z5^l~$N0u}u(A03X3qJ!xDq|WGbZ!{5kV`6!2{bue?E-cIXxTt@FkGka9F{aDQ62_{
z>N<V~2J4e)OyGm4!M+aQPGb`1Wnf@f1}@AthsvZef$ERyzu^928WU*#SWgDz*h44M
zn7}h@r$F6Rk)vr$kmH6xk;(ZvjR|y|6GN3KsJr?<jR~}Co}o&NpMk+<Q5q9y(E>x2
zI6ni!R)aJq$g%|qeg=ku1!+tY><kRmf5DsSK-ZJj@IrSu88R@ihRCEbDRM9{)PPQW
zR{WX91fKW;hdL+(z%yUqqoU=$rZIswD}vg|h71hVQVMBIpgFFZ+58L)AdQe!0w8~Y
zG=i52fHg+urZGX*32-<Rq$M(>F@aB>0M{QNLqRJA)a!T{k~R317#SF9o`JT=oAaxH
zRv?0#OiL{I)rCQ47lT?!I+yshz%ro5>xo7Dx?mYldsVrf-vG=}0Iiu(-@$Ll%)n4H
z8#>F%bihN2f#F05Kj?Oa^em_-^Ta<&3=Grw_@{#FLb&J;&;or){%Oh#47GM}(GPr}
zT$0Ja(9OeGzz^DQRht8Dy714H2Bk>IZ6W-i?N+rp@Dx^C3mI=u2enwHtdrnhD$2l6
zdxnXDp(BtVJlg<nv8+_)2TwPE$8%5J;Rj#703OfX9>Kp7JeLjfe?T+;Djo)g+K=GI
zaBXb^BLhS2b7LsMaLO1IP@qw2h8BI0ARhxm?L|S5g$xXJY~YSNJE%Qh`%Q^~VahuG
z)yyDqs27>`cc?NjaPQz}J_rgA_?+{^7ljNA%<cTls2kMwHx@E59AM{XZ38u~;K!rw
zZ`j7jz~J<rpX~(5lq%4{K?))QA_5Eyb-f}P3<98aG!`$xYn6f(1;juuC;^=q<}4@x
zKeljx1xUnSP!PV7Xn%n)1B3Egg>=y3x_VGYc}8hEczXkQ*I2)7I(T~nc-PpW&~)(j
z2JoPh;?s2S_J(DkE{^Z(bjbDwG4M{MbkOz&IZp7*faU6*bkHe|^(#RKjs>O1f?N+y
zfo;X<;O!0Ip)RkWbnrYOc&IBQG9A350o+k><WC3hXaL)4c_KX-Yyf1_RXS)BL;Xrn
zLiJje4%)ZCa0)aa8FM}z+(|tJ+B%)%ln(Bsp6US2x_}Cq`kmk?1E-yQnTB-Goi7cb
zn<i(Jrssl;2m4*~a(W(^14<$Nvg!F?4k(AL(n$yRV8Qov9SThc_h7-J@+CLY!9Cbh
zD&Xz6>7X90o(yPIKK@)fs0YhX1=-h}UJBl1VF_+xr<Z|@u5uJfDlKM6F9&l#Q@VS7
z(ks9m(3CD?bvn3XTLl_NZ(E)Y>ex2ay2AX_&<pmH6(~P=_DZCKPN`}DZIe=TO|O$<
zU}ymM0j%Gr*UK|7G#m%{$ssen0mL~2KC-=Dl8=F*ekUITL)~6s28Jo69_gU_Y8yfO
z{_SU^w;=7pNN)v?E`TNu_WGoQuCaxC3%p&S3UnH_r+<2fJOe|c0(hT(LoaC5rK1)!
z>SDHlkAb0yQ-^`UrUKMm@Q(p?7X({D-G%1mpzgxvx1jDq%V$t`!F4I9yRf7V)Lro1
z!=b~#aI_qxcew<Y4g*8Q7j7K}1~p|K9R`M7YP>oO3|dF{bQl<7Rrz%o7!q;?Kw~>Q
z1$96>nS^v07>qlFbr=|?D~aeZFf6((s>8sr{<oM80|OhIxDEq@sl9{_1A`))qz(gv
z%1kL81_rN>(jdL^vN{Y58(QRb7#MgA6m%FEmRc(6FffSCRnlQ#(BW6sVPKG+p#qxH
ztZijfFavc7n?M8qwOwX+r5G5RvKahR%Ssr`?nyB)*l;m2cr!3eGcvmmx|r+~qkuO9
zgU1xJ2N0f!e{wN{*+U3N!kdAChtup4=n_F)MsQ_g!^ObRR0WP~@MiU?KbXv(axgG7
zf$slYQ)u=K+;RhT__F_)JqL3bL5ZSoUWeH$4p6TEeDH$VYbn?<7J6-F@4(i9(rK8x
z*?TYtG>q7+X7&Nh0Y$Y{nb}7W2Rui#CeZ8?$YbC+qKVJVK7%=+X(6_`X5XYi);NI9
z$us*7VmEn+6cjO-{Q$As14J^57|ecx*gX*<DM<`wzd-DXplKK3-)4V7oN1u>6n%BG
ze<03m(7=eCh1q{F2eiuDXR{e21Bkbv0aPkmM)NT+Sl;7fV6dtN5jQ}@UOol}>$%{R
z#>c>5;{#gWx-p#5!;F!cfuV(;pMk;piy0#e$laWvHLUE<%osrnn2Z_0Ygm)g%^2B1
z-aW-=;LE@;yUUD`1Hv_#$_P3k%Z!mz8nniW(ZZL3VM2`=BNs^e4Wk1nM~ap+FtmUU
zoM15E2hF{T>zXkNh=A+`P0W5_U}&*{#-Kg}LyOLK&^cO-j1nMmhyVZo|7U;z(9TvS
z1_lOZkQlKTWLQ-Rqax^h6VU2rxFHM-3@j`R3`gb77^j0zu>hTDaXn)inC;5IQ1L!f
zQXI6H9OR}Wt_%!3XELQg>!CKfGB5~eW=eyce9M)AA?|)AXzhB-LtzGn)Oemu(8}>v
zZIPU0hD>dC&~iZrk(>gCOdT+rMWi5!AyXI32A_YKnve-vOVjcbbfn-4iA*yA28LG9
z1YBxrriCyAL#s9@@iH@If~E&r<H3bf%T-qfh9xUAZI~GtTFr$S7>;h2Fb1t!Y6VsK
z*<8lpb)VpBWn-c-c+nELS_w!q1}|CyS1U)h8G{!sfvc4j`;5VhmcZ4@vS-HNk@QpG
z<Dwk1B#c4pk=j6m>}v{*)j&;VaFx(pYYbl939b&$#u|eM&rgBZxV8s#7=wnw+swd4
zx-qB$201FIxz-qTqyxh#7LnY<0tRCP83u+nGjL0$^$Y_;n`;tiy)Y<?F5kgp3>xKb
zn*uQdvQ!8Z8qKxFkflPP0j@)O#^9ww;909kCS&liUf_c@BWD_ePGV@A0zUW~G_BCK
z7;d`2LIGpYoJ!jbi0P0^>7b@Vw&sFN7g%Bp-kSR#JaTK9FJKJXn%~X~(c}#Z3vf6$
z*BbkPIUr3ORmPyB5f~tv*mF3HLH8K9gDSD+T4TsOGsvbL%EsV%W^m-N-Zuu#Gq*c|
z!va(>w+BL8yMvK|!E%yuq#Of7dpszIxAU?wFi1%oFOp(lXa}99)5e&?z#y7!yqFh6
zHySUNHDq9@+^b;B2wLjY{*9l3!R3cBBg9*v=JSaNV@9yQz|H5y>x>!Qz^(_)cBPy)
zW^@PhK%3yi+Kd??%bh?S29sIFjL<#E;2jOdjG%LjK#dzi1_oyq31ddkEI>yj)I#vg
z`+vy!yvB^+srOSLE6&CmGlJ*dPl2pZIBCoX2^5$WkWc~jNo*608AG`k7&;;)KqUz%
z5<4;=!D7h3V6tU{F(c?C?T)?tp!MCxjGz@GdiOzI<aIS>j1p&H=-3O|B%%Grm@yh$
zPlI-}Gz%FsLT27UJ6cL^7&FFz)?A%h0}kD9hM>!UWsDggb1*P;s)AQv8Z$lt2MNgJ
z$<@Y;Pr*D;hYu7a&%iv8&lbEkW_%9f{pSInN^H#d0>nE7@=K+xF(c$6DDZ5g;{+LF
z#!nzCocI|SDsCDxepX~)=yU?Fo$olrz|a{4Dq;-4jaWnWtT<5N)9K2<kW!EpFUi2b
z04j)@<g*e$r4*<j+O{DpQHFtmksoxR*m8j^P@|{w2<RqmhAhzP(9SGSqT_7IY7k>!
z=*$A8R8FI;Mlgp1H07V01v){ZGm8hbOnBPbtQH*xhR!Bo28K{>fh<s4rb|d9uQZn-
zs}rmTWLk4=7U;BfxM|&B8IWm0o3nbr9I$Dcu~~h_3=EwYZZZmFEoNq5=yD8ZV3@El
zYpF5=L+6oT28PxBS<AE-7`lWQ;yAL-vNAAqf$mP%kI6bO1#&IOvbn#qE`T_3EDUjM
zS(iX+K&SkvmuFp(1O*pJO`A#9RWJusTva<}T?2DKqv=Bbv#x_VpvC(#+p=zeIiOIm
zuFARz=CCrPaAchZx$a^-$cZ2#6;u|j+EI}Ox>mafl!r@hWPvsoLV|Pt#jI&yZ-NZs
zo}L9-Zq}Iv3V^)%S)hZ*JF`HG_m1t#nhRD2YB3xA%~}BFfO-o&GqV<gIT9kJ3|Y%T
zo{|F%&$~RzS_KvdH9b}?%>vz7(3u5ldN507fo|{U%mOV>$)A$79;^(sY*KY&)+R6q
zw0FKmD{Cv516nDWG%0Hbm;-7rXKcvY4d#H>on&=o?E!N@>rVK%v-W~GaiDc4o`<tQ
zw}N!W1u-!&sJ3M72g`sKp@eB=9RPE}m>3w?EVB-QIAx#}DSi%FpiPvWS)lgI>e#F!
zAepQb(4vidSx3PfP-DicDC?LgD9S*qJ~EoJPJubO2@DKfd%=r34$ctB`oh7$&;#nT
zu)NCp4%P~a;P9PUKfoMNfFIkH^&8CL0C%;rK->2~=@)cS_N4{cpmUXbK$iiX-j@x!
zj$Q9Q$OP>-*@EDrU<Rlcuevzf2DC2*w)2H~;uA{-2KCr%8_<E=2+;?i!_O22azLXu
zy`Uw=*<3l$!5fh8cyqvusK7;emrM?1VLvDtEZ&v_S=bMnJ61TE0~(ltoNco3L=I?R
zh5>xB&%%p2AlE{UW{S+s5dfdg&kIU?vAsGuphLp?KvTcjTsh!vA>dl4OC|@hEd&%6
z>-Ob<PCJ843M-t<foux_?I2h#lp_T?DIHuzir>hQ=3-#zV+Ex|sjoSZ<^d?h?Yx>J
z3o5L@tB_?3bHL35@Xgl-hjSp!1JLp+R*f8R^8kF#+lt*eprIXxD$pY0$lM&ziBt?#
z+OV>^4|J3jg8?_l8~tlVazGR3eV|iL&c^0|=FK5z^LSb2fEo*s3nAv-&VkIEgYxX;
zQ#p`%b5Ne`T9yOe*Z~gXW$SXlJ3GK_naJE6(9RAyPVi}XJ>eWVpj94ypqa6=u{n@Q
zbWqIed*whT(LsfS*VY`+0t}EU(9-;e3=Dmsq|0CcKDctLDn|}z^1L53|93Vv2QqgK
zGQ`U=2QqgKGGy-U9LREHkZVhB<Up1qgIv2hBnP})7jpTBs4GVfs4ngYotb(zHV3lm
z7-U?wNe*PyF~~SQy&P~w44y*HPR@a>ItInA)rlO?ojj1uB0^<3pjF3^sJ5Ju18S2n
zRDoyWckE|&W#eFA=wHmlz`(@f$`0=HfGpZ`&J}zy&N6TZsPTh<D=3lne**WjT_I_d
zK_n%$jKLL>MnMiLv32DWV_@k21oB_Tb5}?j1x=Gh=DLE?C_@!LD6;#jLAQs4>nr$Z
z?*z#Chv3#%|6&G)3DEgZ(6taZg~UYQBSIND3=AT<LK%{53=GPrgbu4SFr+U49X7`&
zbObc<UKPT?AW|oE6fsVd0ut#GI))HQ*vZJiAQ~mar~);XdE$*s28NlJ85wdxTW%+V
zN=}y_xsZ#3K;dyBA{QJU;N%oAFBg)TL0L9rQ!XSkgG%mg7jwajAi+&zhk3c+MUddd
zMQK^N;6;$&wTbC#b0OoZpq%8gAs4(h6g&zN|34SJHWYlI`6BaN@bRPIyG%2Kb0MRs
zpdwyIE*FxqK@Od$nG4R?;Fa+wm2$!Ry}(NgPi)HtZ&m;=E$mgvg*5d+MSR%HTu5F9
z74g}Va>02SytFW<B^R8R!AlE;baKJj7knR6ZgwtsOTsBosh-=F3qHc|6sRE2i_C=#
z(}LCvT4m>g#$_2!fl75%yIgP|;1sA-SB%I7_W@3UO7;AWxsW~ps8rvvF&8pi3+k^H
z#N<LoYeAQk7UbuG2WwA(E-5W6%mt6to~mJDU|1NN3+WtyhOK5E&4pxlP!&+bkqgQ0
zpu04REpkEGo#7Pd#?lJYT=3qlQ=p9}`(<+>X8})PVqnnTn+v(N26QTBsbH=-sBk+q
z2ecefAQ#e`0Nq%sv@sXbn^?lcz_2kd7u=gTwStL(A<ixr+?zNBszL(9a_ztdfDWVc
zn3)S+n12eicQtQyE+nUe4xveZmJ2${jo}pN%&FvExuAZ<WP<}t3=9Y5av@FbA507k
z4qI};8U55BQ0@Vp@;uoAoO^gdZLgV^bKRL47$$TjJLG{zGADzE<4*6(104@JxfYao
z#oF@3L7iuCn(+Le2i|pEWdkw{)JC2R8UHe8NUq2OMeyX)pgUym<$<<NLku{*D^FR7
zfnjnjsNG;PD-XPJ`V=Uxnrrh^K|STF5{6`#JWza00aab6_vIOYHGr%)nU!Y<w|-4w
zo)MS>YIStU<QaoG4h+dPd7u!R0!mx__wwxFx=-)Qa{zNdc5Bbda|CMu*=;f{&k4){
zrIY5`JZG>&Di~5~@_1Mo7^ch$W?-1CmM6*0z%bb-n1Mm;bROtthRMCb3=Fbyd7#7o
zCZ7&wU|9Ag4|G!A6wW-*4&Xd@K9F8m;7kFvs~8NbL6y?+Lk)SLNtY?00CI201229)
z1={m9C4_|ma+p@0HyZ=P6wtb;mPpXp+-W_~*c?v=Xl$-E46Z7Oje%h*X#CAz7Njcp
zJrhF+1A~#dumY@<VxD*bB;qWrgb+Ca67d&Sfr&8fkFjK6=-ei(23nek7#=@j$-r<j
zP8hsN7a@8epMhZ#yKuMy1H)9%O_qiYh71fU$_s=UL7TOwZU^^@gc(a9+g|w@7#!9L
zGnRsq@f%RDXo7?=V<{-S-^>9`N=kD{2!p5WrhWh&K~OEs2);4*Kd95wB_qsu2c+>o
zsGD;(R+#ZFhzGePwO^G@7~ET$W)7M^l@W&YmcWx!DiXqspb<HSD$t~$ftfHPWK0fp
z)9FTDVMuRj8TjVch1(p2nS3}H7^Z>dxSDH)nS8-(B0=^$tQBVR1M$F9>yf#_OyDzu
zmw~3%w?_ywfes0tT+6`#+UH{C&mkwl&cHBjX)ptWbd(&ZCB%^gI^poQ9O$%EIZn{&
zNGZ{B;L&MVXfo}O0FBBjr-DXhMO4@r7^Xc19f-CNG%A}P0E*MxB2didvw^EP(5Tk5
zui#9}1lrtl`nia<2uKs?RKH#kLqv=QfJA1B7$HPFK>hTkBF3yBdZUO5t0e<N`hO8q
zP@MmVR$xr~K?j9;h**e#+APzzfU9N^3-F;<3?fO1MGPX~LhKEw%4)6^0T*K6+grri
zM8Jg@ctn2ZW)W~9_69U`eKuCaR*HdP+HO!oZdsCu9dyg0Fav|$4FM6*mZ|BW)pUWD
zBA|kc0X)uAuu;SXq%Ivi2IBG0LIl(-nZYDd#314!&cHB(2~;FFR*8Tv3KX;hAB;bJ
z3j@OpNc|7a2BMcl(zswAtK)#~P?})@+M#3zx>e#0C`t<7ixl!PFwF3SsoZY?;)3GB
zvq@w#X!QRL3j>4Pd=W-A7>7ARgi!{}5oBNhoe4Mt)H`J`-~~-V&8SpmU~rTYVGK}a
zV3^SfGj{I_76t~+3K2%|gaXLO$vZ`uQk6mH2JQll70#T-#J~_NVXh>=z%X+f$a}lj
znuAZ8I0Y)b6D!Rj<>eo528KL2b5MCXa~UIpe`;a{gSi?gN1bB4;Gdcd;(=1gDaI@Q
zsVN|yH0T;F#vA^rNg$pAn0LoNwYY%6Tul|sd*Gj%1mc0V8lPf(;-6Za$zZOg50-o3
zpPB;VnSgn3{8KYQDlNgh58ez6;_uAW?7+M)-V6+<c+AxWK&MwR{s5JIpfRPH%RtUC
z_zvf91M|-_>|)epV3_p|;%(4z7qi}hyq#ESt_}7M$fvv4n(Kf$;34}w3v*oo28LPx
z7+Jg-7*q<)^+0m}84LW2K&}Ga0>kj1vBJN|(3HVk57e3Z&)DE!WN5-*uBXhv!0?~3
z!@tPTn89361I(M?Uu0;+V6LYN=FRXgGBji`*E0h17Wfw#8ZemanS*&N{EI9Z%=K)*
zoDKd(77XTk4q(m>{~}QM=tEp`z`qC-cKRSM{%1VlUjzzQeNYViXT0EF1PXI~Pz?NM
zyy0I2iVuBI4E$$&;9mraD}7K5{AYaOUj&LreNYViXZ+w_1d3yQPz?M>gzGF&&y&I6
zH!NIdgIdiD2H6a^7?~K%6<8S<W*g;Y8XGZ~Yj86#%-EloX=cJ;4m!|w<~GnoiJ~<V
zgE?q1^KAD71_sbQLbn+i7`QJnFfuThgO&%+-o?bgkYi$QDh4tNG-WcU&D;#kVFK}b
z|CvMDH!L6?+ZS`t(CO@5ETFiV^~oGuQv7cK$!%dX2Q3kveY%0eKe?ck!5nn^*leSJ
z;BhBV8kv0>JeypN@XQ^sK<#&i-HZ$jC+c5<vm1zAw)~|MXox$XfnoOUd{I#Gbt;E}
zAxbG<3^WS0cb-B%s82cvbmd_-SH2_{1H+s`P`c`p$p;NsLvE{8IGGRGX3G!Sj#Qox
zX@!FOrwRFxRw!ts#8ogK($)mcaPC`@4{2+Hr-49io;jeAEKt4|W?(2cY$yPARpzV|
zDab5hC=d{5U=X$eS=_8v0NOu1XC-*mBdA+42QvT3%5aB~fk7v#Ktz&(VNPQMXwHF=
zfuR9(;kl4rLmP;Xf;kfI{Ybp`BkA6c<a<9D7#IZLoP>Kn7#SEOATkhDOrYDm?)`vp
zlJ0?yB+`I$lJEUsVPG&o)(`H38YT)9g8FE4L7QGq?<?ei-!rHErjQprgaIy+g|2cG
zf_ys{w1Hy2Tp?tW8pyXoPYMMU7#QYG2M;RGb!T9hyBxYQ19Xh(MTJ7pz`|V6HDO|>
z3&H&laFK5^s}R!v;1J19tz;+!_dmeL^~s19f~r$U#4SrI1f8QUU?2dh0Gmz}%7FL0
z3o|f?T^1+;T~ay^)EVJ4DguuS{AUo!NzG#@0v#g(xfZ14MiFSeA_LfHL)9YCL<7Sz
z@DfieO_n0i;*WWtGlNTR6oHl}GAsk#s9M2L1R6(xtdg$nDgq58%&UYfnpwucFs}nL
zJ}k_@Ab*mh2sC~$Z$0Sn=_2rMyHij{fOp$LI_KPpEJdIJgLzLtBRMyUK=m!$Do{Rx
zTV*NDz%cI#*s6IQ3=H$WAOcgMN1+HbNHE_FJVsh%3o3(dfg)k~<swi$JKqdcQCsO3
z*-J1m%(n(5ZzZWB2XO|5`3~TFnC3C@F)++?0TJt685q)aia@pNeDG1KoeT`~lfb!9
z1AOnW=}j$*B2c$~{v{>`hGp7C-ogwF^IbvtTcD@NM-b#T4GwPx2C0T3@G-&5G&Ddv
zK<5;Jju>KCrlIA{z|hrJ1RAcNe@R2fn}I<|qbLwGSnx&*#0x!H1e&y9c%ucb&l#36
zFwB1hDo72$C!J^23lxQNFfc3tt<B{$DhlHSodN;!ZI?_@IH=Wr3!F6fB#0FA3otM&
z03BbL{I?jKG{Iw61-`|QJ~C)@qgT5a(nkgb(MhFZa32|*C@LC@!F^=#aUeoE#h~sG
z1Nb-))6>P^1Y0E}l385DPz+A6Rl-aR3~DmPpako(K?Ky9+LKTWI;&;@moNiE|5kxw
z(6)|+ppwS=UNJaPfj2(RsVxR4D)7cfi^O73qJo_DI+eE=GCIW!ZgdqxMyEioc3Dvj
zN?ni}N=;@JL%ORVFLcQiL%OTr0jXJyBE_IGe4)8Wa$*5Pv8glz!-AQhz*_pf7}7-r
z&zc?O5h(_3<yaUGQD+5LSEy4A8jRuy0;@}0U{P!*z`(Ew)B|^zR}ATWg3Q}?u^7_(
z1UWDMf3Xv|jSg~=%Z6fbiw->9*HBmto(lqpqs{bUaK99M8qAK3#gJ|9paR!nOEIXW
z$5188#K0gUR}7l#VOR#*!cz6G7(Dj{KJKPvOEGxv3w*9hS7kAH?hAabO6bXA@U~3w
zAqNX%iy_-GK@HKFM~lIeL*PLX{@!B9+z@EWo#T8lWNHXBC}Js744D}M4T=~ZErv`C
znSi1-aY1n?GXulIcwq(xnQM&2phUN*8<G?vK<T&&JaHm(tvHgIfniZW3P*7gD+9x#
zqrnUe{YQ$E!AF7wGcd%>FHQliojVoGz_8W1I2FtWbqzaa2^52F8CWcpz`(F*I)g}3
zN*Y5kc!%UN4oC!njuv95;u1+tOJ^ts-KoP+#SKX$Szs4{#*ds96=#Dv;IZ7~$cSRl
z-jBtg(F(&Y#reV@CxN0)$f!798pIKR_#s~z!~unsnoM!N28aU+ge7;1^9?{8(2&p4
z@5SKFli;zO>5avOV2eQgZL3$sMPN=S$SWEjCm4ci*u{szhlm==K$fqFloc`<%E~e@
zEIw=?QdYoVC@03iuviLwX~lfd-u{IF8Ac#|OF%t)`x!<seW3dhjby<+5s;hge;CPu
zYa>v9etU$GJZP}F%K>D(kpkHG0Fd!UisB3mOKd=+OM88cz?J;61n_aCM&L?*SrTaa
zZLyRv1H;y|1Tj#}wB$7t0|U=yF)=O%h9$2-!E`EBOdQMsC2EBVG0>UZOTl+@Sc-{(
z#s!x0fSL!}XNyS*F)%C@2L+(+dNFBk28N|Pp!5~uB_;#nXoFn7eWI8wh{FSNc}<!a
z$Qw&tKtY@3E+!9>i3QD(^#2kA-HNf42Q)1rnJoso_G4*b1jxAzr$Ec&mNFWH90(>r
zqDwyP0WCB*#mB&~lnum8&jK+8LH(Xn3=B)PL0z6IkjkYpFfkX<3cEKTiBn(+1DHfC
zc)=aq?4_PCi9%xrhIBWu;v_)^h9!;+3`?6JCzo436;qL7U|0&ey_VrB1H)3t{qNvg
zUzYYMF)-vE71IF)&^%b5sP+q}!U8Eh2`=WrXR0sVsl>q0Z7608QhE}u^o0@wLt>B^
z=zL=-F{mi>M9}#_lfH|A4mwu51s7eS#K5rbwHWx2W5jIA0wo3pwnbuge4s@maJ8UQ
zQ+M!+L5@9EVqlmzU(5kj#RRB7m*s&S$;fb*5#(tmP@-8D2Q`RkuZAiEgT09u6XcEt
zxUhmS1B22dixOcD28QL3!ng!nyZmPmDJy0u0aq^I8HJu%CE&^hTwLnCC;?Y4rvyZj
zlNm}tbqfP{1ek4K31l!9l;rr>N<f1P4B#s*{nnR2MrIX65(^U<N+2V%Dk6!+g$yO&
zk=g$mB8ka`3?<-^+5ZOMLu{ALiPI<njkGSG%EZ91VNMC8D+x;XTMA0lK@kKVt!CR-
zq5<N7S6=9(m1u%FpcX~e=Mr##4czrV5Lp85ul-kGNO34pW@TVlz9E=_VODjC3NMHq
z&%m(U7TjYw#lWx}G@}Pvpd-w{u=Aip38=-k{7M1?!}6&N3~>S_pmEg|pfY*GoDwsT
zec)Q0ZC{Bwm;<VCwj3+50CB+Q;CR0*u>^Ctz-MWcSb;g964CT@i8YwR$B-gWV$90G
zu)-bUEE8VP&JvKbu7HXy&YJ=ypk~^N=mZ9a6*>$cv1MukC7@x770n_kNjVH9pv$Zv
zB}0-)3Alz^25xv*7b%p0YO)o_K$in<DRCEPU|12&Ad*~|%247V#=x-R7%039_LV>@
zGEWAEW}Xs%KG5h7;{{NrS^+w<c}kQ<38*2o60{oBa7#%r)SP0FIU!;U3@arCL_qNv
zF3P~LQVx_54EB|PH~fR=(X1j%z}xzlf$u0<et?gGVMVhr1H;nd4J8R23=Au0f)6V%
zNd%Xs3?fCT=?o=F@*oLN3Ac{F1iW=0Jo{j9u_R4|fnmjIkS$_jCFvkeGpMvW%3K28
zpbs9P*Ev&?4U##X!NkCDn71Sc#A%)Y^3rn9YN7717bT!m*;iSEYl9NRsqA9!OA5sq
z7*<(>%0_O{l45Z40aP|B^Ok^z4gZ5|lT9gsTq*@B8<+Q%K<;q^%^x3KS^~Mp4OCEe
zEG(%3pH2oU@fTQ@fOqkLU6}Qwqyb!EfLyrpQVHnhwp9)VAQ!F#kFxw{U|1CZ&f$EZ
z^a<+Ttx5p%)xrE13=FFZz<lto&{YYbqXNY&OIdh860rPUdjd4E2U0r+tTqrdB($pM
z9_aWsw^CM++Bpmiv!5z4FxX3}LPo2gdYLD7fEEXTQuT!o+U=FmW?=B~ECa9YJ*CaS
z5P7u>w6vE2%-&K4Ik;S#f#I-4Sv07JybP4cs~8woOMz|w&!Ek~V70#tv`uw2mo@`K
zVp17s`>EhRZ3c$ThGn4Lrx3Pv8F=$4NPOzVGSJ>ruz16lvJ_CLfy4v9m4O%dg04hv
z%qRn|?*-jV!C}Tz4(eX5ehfO@;cYp%cLi?X)@&^Yl`N31%+#)O@Ep!EP_|uvxg4?y
z8nkV30!KNh*9F;4Y;da_)LMod*%u^K4xZ3i#svz-)u1)kEXu6qpib2qS#Zax9F$oh
zQ@VWI<&fj`K$D1eVddZ{nq}a_M>bp#r~r+0tN~5FxT;n_W}`r5Tw-GdXfjz&667kG
z@(NH91aXLKb_K{+5Qn&?R6x81nwBWJTmkVG7wEReWfh>k-TV%qVrIg$3W&Ervz18~
zDj?qC2gO2KUwN1!1H&3w(7^0Bacx)}Gf!-Q#@U+l;La8Y1H)cM1_mK6(0bT4`*Ii<
zgv7*kSz(I4fECsMX8_$DpfyokkB@<2&0_~x8WL=<WMFXICvE^LRDQxm3oIEJcv!^^
zL8}hngU@><?lUq)h#N67FszLUW?=9+BW^6gzz}gPn1R8cSKLGbbP6db?XR_9U|5?2
zPEq_|d$pg4n=*rRaX@Wgdi^1Ufk8|_+zWn-!Rt5q3=AB<#eLWq7#JVsGcd@05%&>;
zvh{Y0`@+PF^2B{bK;o7R40>C|eHB1#PG<Z6|37?Sdi^?|fx$>o+z+hUl7Yb`Oxz#L
zhO2mG$-rQCM%-TlMc>PO28OJw;sIc_mJAHhtl~k+3=G^0VftPj1&K0>2g@)ptbPF(
zJ&?n|AjTvfBAU;@FfUU)l#hXdwI!c{A>Kzk3>10>`3wy9Z^gsG><|V90TuBGL747a
z2P_#FCOC+<fkvg^;d~2p-93|*cn_*5=(_tg)5QDOK<ALcOxVj|$-p45BHoW8y5~m-
z0|Vn#@d<1&b+<NHGB8vpiGz=hH-L%m0mTC2Tk*;KaFG`voj=8=AVeO7FfcHLiBE%z
z+*$#;P(DF?CMeCoT2V~5mRK?{gv5%^LKR(L$-q$PEj|adG7O=1jwJ(wguD1$RM8or
ziKb}r`3RdpSJ&(Ih=bOjGr)E4xdC!flK3KoI#5Z-kSD$vA=04Dz@T3$zKj<X%b-$m
zhxl?Z8&uvtWMJ3;J^u+@<aro~ui#~1SpP?xfgwjod?i?+HUq=fpW>^)Y$XPUC{^)W
z;3N$XstZaC3=^ZpZ=;CbssNocxm)}$s%QZl14H{#@kgNROKyQ8{jT^+)acCsCCf+R
zuh<wEHmru(aVr57nr|!_7}~hS-=S#ObHb8=!SI>*7gP-qstgSJSH&6KB|xV}!p#X#
zWnjqtC(h`BD(s=kz#zXtoDnoFB8&(;2UP|JhhlL?Z+Xxq2rxtTtXRw#A<hUonrGt$
z@EObEjA@`<NZ>P;r~8RBri(E!Y`g%PecN(foH0X{fnnoS(1OVwm&6$}Wf>SY-U4mL
z5~>qt1Ru}yMuDG!VTpn`V>TxP!^ZodQ$|i57iY`?n`z+y>cWXL=7L)tphGzJ{ugJ=
z1IvL9BiG~-X9S<o^CkdPDTn#;F))OKjt2F=3M%{FFfeR<4~_#C2GB+vrtRX4pfg1`
zT7cG-pD5zV5N9lBVAuqj#+%eF&R8J;%2uFhJf|jc#!6`hhM>zJrxzrPGgg5z?;Fs$
z=If`6GggCnDf|o!Y%|5dcS<n40iALle@C3L7L=e3K&PB9eId?RCjqjc!k2+TR7sq%
z9>nWo%m9^;3<eAgoBF`clLhfNzGq<A1nK|CgJziy+EfavgZu*z`w2=642JV6#ZY6U
zK#76DbYdlF(RY|HT&)6VH&<q*E~*I}N(>A^w<?WLOxO+TCxy#Znn{4pn}?aOdxjDN
zgL!DBCyEKX8<ZFr3NKgsp_-7O#K2J6Ss8?Cf`AeO!)&F>R1_0-fp(PfHdbb#n6T@H
z5(9%qaAh8f3A;K#e$%XML^T2A<GjwwHdGS=lo%L_FIRS<ng9yPb#;|<QB2qg^05YY
z<suXlcAijTU{IP=xeUdGouJGtD^a-<)dY}_H{@0BLp8xciGgA3<;p`SChYj2#K2(v
zv+^p62|GYO=4Gh7g<`^v9ZC!g<$o*hp_-7P#K6$oRrwLs1dxwAc`Lu6nqZ*Bz`#7Y
z@)wE;+aIVhFc@oAGV-DrvHgT914C$SC8H3E8QWK=GB8BVsbmyGH3U?!@TyiaYN8qf
zDk^OCD;f1r4N(A1YA&y2G(s_C+XYnyhWx9QjIJn#Y}=vAz_7NxlF<vrkZqu=UpMtv
zGWww!0xGnmH&-$yq8ehL%D^zar;;%Z)er$y28LPNDjBm-4B2`>m4U(LWF=!QiXmG;
zp5NtJ$=HNq$X3vX!0MNkjBTiffG(ju99YRX6V(uq=Z#`38RwxI0y=fqg1eG&5sD#O
zKt~X>_f;}(MKNRx$n#F;Dj9d77_y~8m4U(aXC>o4R6{_c34S*#884z50`h!UY$fA0
z6hk(DP-S4~dsE4H3&oJl3qWV;rd2Y&MKR<S$ZRQ_O2$v9hBT-$Fv#w&Wc-F|2q+2m
z->qVlVPM$!7gnGw17$Clebs6xCNJBd#K53Gw^|#;;ANnquC1<GAI02dpzO88zuFnq
z1P#!E&&#VlP)z_8brNmWJ}4$E1!XUvxz!0MCM*RF^JM#0r=pm!6jam|)K!B{7e*AU
zOF@3iud7B)GfO3u7#P-uR--1FC7_~iQ&cr-idh0W2cC0U^(+)OECKm=hEDZ-6gMmZ
z6?JnTS1(5K#S&2A9-3ag9n}Pok0%OO??EwPF{r4Uda?QdiV2HBg?mMI^(_<=7K423
zY*-E2)b4*37H^9|Mcqcp>c^-ifC_h^ooI19ZABpi!@(=!jG!BBcjm#2m<DRRZTzds
zz%a!|oN<~s1H;ZPxE!dy-uPaXfuY%7oM{iJM~Y|#D+q$Ba0Z5*kokX3Q1;2T5og+~
z$-uC48O(@l8&)!csxAhGo%g`?DOg?2ZgHl4Aa!S9>MnzZ<-%t$Fzf=|b;4i(R<`Aw
zIMaTRvac{@mllAG^S{c#uuB(V+>VptOb0X>7<S3P)Ll#fH8Kns7<PdMSQre%L9XlX
z5N8$<V_?|j0#kNj0Z3UV1H-Nwa6gRkKS-U-D{)rPZiijjFm>lZS+8`5I4fv(148%=
zNV{ka1H-OeV8?*>Ebm%X$iT2nOq_L+2uK2E#57O=z3h=V#|xBTJTnL6f>R6(yZ(ZW
zhzB`fZMHZEXoh^(TbS<CGO7#=skP$V$0QjT0^lvdX`sA6(N3KEG>Y)lAF7}|jpE!F
zP=!G?inWwDH)wkU!jP$;qHOMJaqe5FszDW-wUN3IihECka#PGKbrCrR2JufY=S_`K
zVqma+tgfKIz##S#CVCo_>I*)oE6Xr2h`Yi>r-E|G!WwmTB?bmb*w8Q2RFJt{-_^C{
z7#Jio;A%lB`GB0dzB~hi<OG=LDbRL!ugmI2atsXeuubwzQ$e;>@~NAFL>Xafr~FW2
zU~u73x0YvMkY5KAJ@rM2fnjE<x*bUL8ccKws4;MoQQb+NfkD9*CVJ|D5(5L@G<8=6
z1_lM#@H5k?8=#KL3kHTgpdAtn2LC}L8he(mVq{=wc2$=Ji9-!w-0mRAz##U7fnm=B
za1?`6$({=!r8V<4#X;h5r3xU?Q)&is3=DGc!E)UNs~H&>qE9p0Ba13DfJAveGsz=~
zGX6*aiOzCm*@!H<1LTCg$qWp8lfg~^pAai|Qk8*W;y+0q(6H^^V5l3Ird$wYV31zG
zz_7O;s#c$YVQ;-E14I2&NuJ}XAPJ~i#_bHCHPcFNl04^NLK_(J85o2_YUBhN7@}qK
z85q)RYC=Ihqh<LF3@bm@WP`%(U=9Pr>ZF=kpv7ye^J-?Z3NtVqk#VR1?Tpx0%EZ9n
z>|OynT^2GDv_+-@w7`-9Jh5tUs{*v30Wz^_$5+7v8em)oS}xCPT>)Bk&JhIK<d7>=
z0ofS=8sRbAT>)C$u&)#}!ozyL0<`K}y-t~lfni=s1?aqreXZu8W<F@?%Dz^xufco8
z!2GFTK6pep^?pPJXijP0N08QQ6=LAS;z8q15v>*CU=C<Rc>e1O2`~pVbL9B30(93p
z<3Z4XsMn(kDX<J^3^X#g0yHzmkrV(Lm7Y}XQvsSj-Va(lm)2LI16Btz`_%Ue(CqR4
zJ0P<+{jUJc9?MCBwtTL3ssPO%Lk>yLb*um#qr^}JIwZZku>w4MybN?mI+H~OWLOP!
z{;YLU1?0$e(7|k5dn-V*$_(K1XLFZVfR->YRDnioXXR8tHa&p0o=@qn0552$vSMOj
zn0vkgw4j0C0W|izH@E^c-ONyB%f!GiVOj-fSr9`N=#+IqwF=ODGeZ^Vrb0`t3eds^
z^*-=sUQn>^e*+FyS&-LP=4jM{4m>$f&cwiQh^v-OoPps0__XkOA8H}1?Lh<Cy4JOj
z)%HA~jnK7_Bq1PD!B7ica=T1Oq>`bQ8&q0>&rsOhQVUKFNub&0jPteNh4$cSWT*eN
zpd)J-z@zJ%x@y6z?jfV=;4#VhJuJ1Lqx}!;0vQfkeFVBDzLKF<0=$&~G#<&}Q!4@L
z`d2Z5cMa7_h%hiPRDlO4GY_)Vg5veSACct5B8FNS@FXfIBFh%l%7EsE!RfecUabtM
zvkWsqMiy>DwundFWex_0gWgOG45z-=fzHlR&jXpT>3`i-4$w97pe+J?+;!K$i63;z
zzp-rHb#RISO;8#u*WCbfEEqr+jjUNv$HFHCs%NSg7!Ia^YdZG-;9<$tYV{zC!1w5a
zB%8sKy#E=dGcqu&He%#vU^rL=)42dF$q$vZ1FbbV*bi3d#Vo+UAQ=H>hk>rNkc`M-
zU|4mlK?0P+S3PTx1k;}yq`>sQ25AtzTB<>Y#gKs^OU$j25wxh}&|-cDhV>sB!COEX
zszAMc<;{(Z0pJh>-KmkfxsegP!UVh$cw$Q<BWPlUp$fDTc-xIeM$n-f3{{{#mAuxC
zj3FGLdstcd85kzWHZp?NnlMy>&M`II-N+cm!N9Pu6m%31>-k2;a1PM<cA(R^=A|@(
zw}b9$1+7Dl`rgP0K8AT2Xn<qookm8`X^|X3P7I(?it;LEmPW?;3=D^U@iQ<e#595r
z&VsmmO+q8%Lb$sRsx~r$j(BINVsc1HOlD|g1l?SH=ohmu1H+o~Mn=fh)y&{U!Jyo6
zm>V3_Opr6?s~8v#gZGLX><2B9^7-8)#?8QRn467(!Iz~;6VB#s0^K1G5f^Ln=LR_p
zbROr|rm3KN+d-?#Q@=D#;|BShje#MKt7$ej$lq)X4E-@p^FiXRAoYKn7Q)s4X<7sl
zFJ)t3C}3?`4iisfX<7jjk5g<~3pXdFX(LD+WKMx_(`LAO>833pagaH2W=%Wc>T{a*
zg2X}U)0CU`gV-Q7d1_6deLL!PAh(q?odAi0)D$K*or0N}p4W65Bo0y^FWYnhX6BrS
zO;<qTVD*_z*Wl{Qny!PyLF&`%n(n~Z@v2P^VS0;yG(Cl})2}tXgsX{edIu9PoYC|N
zZsxtF&u}%#O+R32_?9>Q0f~d$P*B$N55z7tWME)?@6p5v+FW(Ch@XMMX;Bj+xO`g%
zO6nQbO^l$MA6A1C_d(SrMo1CI2Tn3gjG$6ZNC`CP)w8jQkq4ahLF0A2)=i9{Ek!~~
zpz*p~p(aL1&8NZ7z+kw$i4j!12`L%yGcd58Z(;;3pAu36T_rd#rHK)=eo9CQTq+;A
z&cJXK)V>AH;Ic3<xGFX=ipVlB94%sDU?{3=VoX$FVAwZRkbz<ECkBS2Ys5gi>}5cQ
zF&ux=#Fz|H32w_SV_-N6ng3@5rPd=ink9G`7>@2_V_+z(XqMz*VBq_}#=x-gUo+^6
zB)$)z(gmdFFW5jHkREUKW?7J)w@|rbl3+POkep0Lvoa3@!!b^n9B4T!sDaPMz!0;)
zSqmhm%ErK;-`fm2Ebtg78v{d{b~9+9!7-4yVQDkyeq*qBzjw12OnpdaGw4cUu=tj3
z&7i3`u=*0+X3%jtVDWXi&7hNSz~ZHknnB0ZfW<ecHiMRdgT;gEn?Yxtg2nAuH-io*
z1&bHmZte%!1#*wVl4j7sp<wZn+Gf!4pJ4SW0nJN6YC!JnS<nnRf)gwrS=PJ-Ca!MP
z4C;u1#Vap1ABKsW={AFILjsFW_G<>+V{}Yan1Nx7twHl`4hDwfo0vcet{J=o1ALZK
zVt?};&{!#Wr(lM4GiXSBHTYI<8_VYV;N&GB0=oRW`2iP5KWNJMbanGXFbCAM5&G5q
z2+Yv{jqoynCM%D7GB6xJ4vsB;P;AwxH$RnSU^u>=g@K`bOEV)ch~o)z)&ss477hl6
z6QG*iX;BL+*gjAlmtoxkIss~R75MzM;|~}ZPKZEOq_`@ya4LedXfrVEC~4sW57vV=
z`5kG6EZ=8iU~pQ{2I;V{F)&#Bv<XWxFs!a(V_<0h(<TCA&wJMfItGp5lrRHBmWf8&
zat;QDlaP~x+Q0`|f!8H8*S4($ISRa7A|$^Jd=4RaxkRsN8|W$x$VtO?6WTyGX+TzU
z@QSsq1M2~W)%N#o>%lbusIqp@Yy%xm$WR5E=WKIm+X$8c9RRHLux%5V13Fq=n7a*h
zhaf{0D0~+iwQT{*C^9iHShuxp1#>{PeaX7EZD0<l4O?=c4Rl~3LzN1{3`Pcq#R1KX
z|9MLp7=k2g_6R;;WMIg6FV0iR%fN857_>CV02=|;*;*~mzFP1hBLhQ=xcF+2hOTlB
zRt5&f&Y7S~u$Jb6b}^k?30g*E1KM?QfT5Iuq3@A-C&;$c0%s03kh&@z=R<4^3@0yw
z>^Wu3z#v)<QfD>IISVYmBHj4~NFKaSsR|_Jl-lmVR?5J@ZKL>`bsy-~L@6gw<LVRx
z!zmfCMKGfnPBDPwxuQBiYonGiFq|?1NmVgCVq{<tV7Ig2HDF+9^=bq88g!lSsl`0W
zNf``n&&3%SPJ!-0ZcJ`_Bg4ROY6Tku1E*0N_<pYcJfPb*+WvwAl!bvIa#9;3BRCdW
z7#Iv0+8Dt%cAa8jV3_xzjS+fkA0GolE9l&e6B)V;4Bnz`pr!1mLFF!|QQL0NaSH!=
z!KUs8?GC8o0Gqm76SS{_18nGSQz(1hhqm30AU01XL)%`EwQmI27#I#!ww+UEU^vak
z0Loj(9~dw&aH+H{0D1cj1H)-hOaBm8+X6LkOWA;dp);wi5he*bcli)kTcZ+45_ItF
zjkZS6)&tOObh<y<K&MbKfbs;}yEf37{tQ(DJoyC-ZIh)L81}zm0L^{K8@5%#Oxw(x
zoSVYXRtcIqdBa<rn$FNxsR%kLkOOp<WLu>UX#EvPlW=ESF-#Naz@|f7ZN=&!C-8#q
z%4{nJ?RR(sQW$rrEf=QnCkLp>-<Atj2$D2!ZcB$so&n9?AL43D*Fu<*4%)u~HbvL4
zEfJ;=v}gJdS6d=jA;=UK-L`0$Bxs4{A+EM)4TLGtpwI`K(&Ew<3RBn$aZ4yzA;=Vc
zoi=}%<SvM$zY53{4hDv~v2Ff_pp6R<-}&2u*dR@FgWEh|nn1^Y9O7#8MAGC5*2JL8
zz>uTdrp3s>aMleHs9K;>a~TH%L-NEnEd@}4%fZ0l!rZ2%4Pvt~Fw9D518;hLBLGS&
zrl6h#EUB2QgOUoU_*>KlSw97;oEaE|7Po<JfIm>qz;L#j162OEiK~Mg3Nit_Yz$_C
z0yME%Ffc5C(8_26^})GbuA<ZuhE_&1aLQz1VDL|Gg`Vxg!oW~Cp%r?x3m0f<Yb)er
z7tn5~GNo2V@WmphxKi^NS|JmP%UBo~jMld@g0J`ham>nE8NpY4EaS>$Xl2Zo2YG{q
zfni5wD`NrZJe6Cb3=HQiSQr=<1++4HgS-sV)>Yif=mX-s;R0=9Yi0BSb-&&)fE0sT
zD>YkN8H+&jAjMO=S{aLBob{Jm8B0K2#44`bRFIXWAemDP0$iC4t&H^`4#@RZhg%sN
zc)^Dhf}&J?S}SNf2B<_i&j?Njt)LOM1E53FOK!CO0PQdWX$ySY$_SEYsA2)#a@5KQ
z?ytfe0p1<Hj4LUPp%vU-V*p7+eQ#w1uUlWnRmRZD2<mn+RDtYtd*1p48VTq9z*(^M
z325IDBn!4aQGsW{)+hR)EXV_nDDXKlpp2ej-TDe#IWyQYFht9@USI^pI|IY{9&mDN
zy&wZMAj7)#f*L4^@qi-g5-6UR@nkZzf)8bV1JZ38-U=#p!QQ_H(Y+6JdJHJBW>~lG
zQ-<q40M~sK#CjvZQ^wE=T0#X{{BOX(z<!{09n>8cK#ki&T&?TCc@~_BTGxRyH`pEE
z<9e5Y0%F0MR?ylQknI;h!x)FST9<<LfYpJkXs|lw+}3F@vr8e7G)<R*;XpaW>}ggY
z{|kW2`qo+Ch-L$o=&iHCY;du6OtG~KX2d>-5nW&-AiDa%euC)g2eWx97+NPlSd|Q|
z6TvKyo9D;2*24_?3Nff&8{w9E3$R<*7#KFUv^FE`50PvwhibbBIym(ZS8F*~8^}!I
zW35>*Nzj`5LtL#{;8GJ@7`0}Bi&uzWvp`$fz{T6lp4J4IrUHmV5|A_{fHi^Qm`|w{
zTn<(-FkI{bhb*Mu%b?7_P+HsSC&IvRaU(BiX<@4$IO#!b@&j$PTLv<~C#n_Ht^-B%
z#d8pao}i6g%Roh4!0T3HMh1pU%8=A!3`;%96I+eJsRvxtwHoVzQ&KKNt0}l7U;~!~
zX5fMVR4F<wYK5!;1;<wSy;e10P@pm}Tmp6HoffsKf%e<I;mKua)j%>p6Knv;k&#DQ
z<v_Xr4Fkg^(7?wbu2wmHkP#4@6d(#M7#JG*nwf&20e9&rxD0G&0&g7v<#Ye^W~K~K
zWS;^Td(BMXm6ITuGNooF@HIut7_t}`WW1W0+(4#OF)&<u%T>nE%mg`fgR6p}nF+M_
zhM|gKKO+M}V@orWJxJjja|Q;ko@ORZMh1q<pyk8!GMkw+r9d1|JAk!Cl7V5BS2L3`
zNFKCS6(kQDU%xCS!@#iU6a&NMV2}#XXeQ$e5D!$V81R5br!PB8GBBL@(##|a(p=05
zS`gLDBr5|pT#|v|==WwOagY=!orBC3hf5vb+RP*fk^*Hnkdz=oYDF^>2S^HZ7BonT
z11!bDz#wtInTZQBlqbo+(0a9*@h3>#8;He>Kf&rix2HD!Z)W_=$iQ#~)EAzY+06JE
zA$7Nz@eN2y391X!db=zJ(q;3jneiz|3Usq0NY_(@uHDUyS3y$AP+eESQlJO`A3V)a
z#bCj};K1L^2x_*0N|r02*8L%_X2#v%MiVCkL&=S1#@*mn6T~Zwhol)8uB;YdVPMcn
zX=Xg6%D`}C1Eg{0$;ZI3`mrPf!<v?6Mo{^71$1Ip=a**2b)c3YsF=_G)6BRLlw#g+
zWim7~f=jnI46_&+7<SEVW?aE2$-uDWM>AtDBLl-#(6UN#xn{;*Es%vQ3=Dy9n;GYV
zTc=$4c?`{rprd;ksz70&X5GvPYW7_PEfCgz)6CeY2+Bd63=BpQ&5VuOpdwy?3)K8-
zW^4hKGs_r2KJQ-9%vb_WZVU`prwM`Dcg>6?;0B%$sDanaSORY0ae`WS&5R|GCY}WY
zLwRyDBdm3H^*kr2>DJ5$X`Tr|Y=N}TSQr?hzBe<1v&AxyjXQ2PGe$veyk-H_7zHlI
zp=!a0sV(D5GGb_EjD>hM$&jI$F%HT$W@u&vT`9>>#g$~j(98&0`OHwo1+f*}(s%>1
zC|9SMF#u)}=q4~wqy~UnbWj%tfZKjhTfzH;z%H~;Zf10cY1|HVp*vV3R4w?_I#6Wh
z*fcXjGA|1QLuNuVBk1NjNSczaY-Y5BneqW@iXFK5#|dgPHZ$6R+ka5E*g;y277Prz
z6Pp<=pc=1(mimL-ZGo)O0<4k2oPj~xznM{$k%8fQHZ-<WL75zMNOSVUW=2(T+mRF0
zc5G%;1vehSX%4*c^$jTfIxT8u)I_8Pt;S|X2}V#U$iQ%YIwz==*vtr;z+eECXcG6E
z8KuBU9~8Wi&zc!Q1pz3}T;B%upCCBTfXaFC<DH=NfBiGKobLpkF~$IDB~0DjxlSI`
zoZ?_$SX0=!P6ssB&B4Hs{ihRB=Yupi=ylF#WMH^q0MR@j)V+slo-c>cJRg**K|QMM
zKb`Z<Kou!S^Hk+d(CG6GQ2Cm=xD#|9CqoqjC~s6Xbxr^UY?Uqp!|unOtspBvr($bz
zb+&@6sN&5}OJnG4l?S<rH$RV|vlY}t26d3Qr8_&o$&aUup%Zka3_}&jF7wl!)gV*O
zaxgGxa&=aNLLcOy)Wx0E;O-t90|U2oC#V|+Y0KrObmoJdz`$@5v>8~Ft1};LHAEp~
zn-$2860mI`J5r{0rZF-w+yrevi2B}{2C@Sb7@Az2X`uQS>gqH-xU17ZVNnG#1+t9{
zWQzTsPEhrK6Vy<R`rZjX=MQR10%)T;)YS=~at_?;lz!P633Dmv7Ko_touKm&!I7xR
z)fox48f0>kMkgqn-2@%augTRJ0QL?fBm)p382}DRkeeVQ^B|pk!JS?ppZ$k~o)^ex
zP<MENLl4y0k=)(s40XpX&;*JmSEn=B3Xlm7$2zST85nMXDt%3^PAjkk#BM8u-BxhB
zZQ-Hn;?fD~+1vv4g*3T3O_1z1f!lp}S*I?{ZqW4_np~Z_U@Jg&tDf#u1KGU?VxJmV
z0-S2pz!NwiH72Q@3LrJ0shZTqoeE%Ez-e)XW2Y3@Xk7+|fE}H}AXUFP7#LC)cY;Q$
zpegobb0;rY6{tG!e&56-%xJ;DP@B}mco-!7hJoSs18~-BVmz!2%D3R^s)_Ni0Vp>>
z+X1&ffV8kMFi5^>Vmv9$z;OF3Xapm(iSZ#PC^K<oGBhzh0#`{a3=E)AW6-S!;GRp=
z_a??KAQ@0$7x=abe5U|Il_&$l?Umr_uZi)bI=K1+l_qQcG%;QT_mx-}7^0^%F<t@}
zEnxGnftYUuxQfz~7@8Pwh%+$Aftr4xDc~0j47WdkLdJj})Hu2QfRBOU2<UW0CebFw
zO^gf-cR*XI4skUxZc+gG5mfLAy=r1y4w3@hI0+g&Uk*MZ804Q{O^nM`K>lI@RZ2~a
zE5Qv9sP{pahTQ%Na;#2D6XP0)+d&4##5FO3vf14@76t}~J57wa{0t0t<G^kQ-wz2Y
z0bNy_7$NroiZU?VS<S-0pnJQCF#|L(b`aF%yt5A~lm!>M>&L<X9^Eek2LKBL!+g;u
z#!7hxhP!!C2Ubagd<E_&HZj)1luhkwVyuI40^c?<)`Oa>pzfr>ttN1n6kI5S;<Q^H
z6sMvL40r8V7#JpSG%>b<hQ!}6!2H>*4UQu)9~4;gLFO)lpV4p^vj0s6)UMq7$((`V
zh*lFLsLgx#Jh)nEVhjSeUN}J`5>1Rju$F}ja}#5b4yc&{4kk#W7-T2NQDI<5K|LQ1
zwa|irK{mgM5!4a}jYQl7^@>3basx#_s6o^O8AJeAP9Rf2>kMyyWdJpyH{WYwgtUwq
z818|pFi?uHhg3KR7#SFrhBh+Z1toiP28Jn58X2!KGBDf&?VZ~1-^h3kbVx`QR~bVi
z;|)j|V8Os(ZqNvC_T5_`1Zw;=GVTT?%Qs+uH-g)M44~>%`%NR`Ze394nyVncn4yso
zG*=~f0MznY9@@yb8D!T9sHV-J<4Hi8GOQaJH(N3=+&cjZ*+YvZ85ne>8yQ!C6n}*(
zUIFUK!xXPD11km{AFABQSj))3aNiWFt`=0Lz|_^+fMmEb85$wC8G+I!Xo9j8oK-=V
z9eg7Rn&53@i~|``1vMlNlu2NQ#94w20k>!x8Nt`UE(4ng-job(L9y&;WORj=GxukL
z%b7;-g3trypca5?Od~u(?t^;yhqxLU?ZNFNaHFP?(H`8u0;z3!)yQZGGwKP{C`+(f
zko2Lajg0zG=?9=4jUc1+!5v<xQTpJHGSsz@1q~pLlU6q}f=XdfE93#_+yIb9HLymg
zTJXUhpyG?usF6_<6hL6V&4_Pgl!MvW1a**{CMYLDZIlDmqF}X^^BNgJ-660gpizC0
zCE{SUT%cBGBO~M#3y_2S-Z#RVMGu}s%@tGynG0_AH8Ki<$B3Yo2!amS0b8Q}vyqV-
z>Y#_9BMU&5a3gEv25SUaBEGJXkrAYJ83V&ZAE-yc!_mvQ%2HAp8X3WN$SmW^FUw(Q
zWCX3KfV5Yv!yA7wGB7+$<zQg2PH+4LN)O<MOhR?zN00=lX=7g9_z{#U->`w&?v0;8
zVFvEIm;7ve2~q@_%iv~cd<jmH5Jj&ciVPSS+8rBjft>b+f#Km9@Hj)`EwC@Z)!uHd
z#)}}?Wx5Ouo6k0a29q8IfLnQupyOe|tqYyKjr$ZqSq<DQY}^NG*npZUYYH3pgL)<)
zwpoAUe$bc#sJXC2pm9H_z5}(>YWo|(mnJP^V_=B<+ISeW#q9u3CPO3mx};^GF^nS|
zjT;#m7#^kblrc1dn)eLL7+M$^7-p6>E@jkZV9*q31fBc!2y~;DrhMaMP#C=dRp#4s
z8$oA!JpxVNuiMwy18)K4dNzWFyC1y<w`m(eL)~DHWdCU_2E`d@5UsHc6hdzVct90k
zBWR9L4s=4L$Ct($XxXUCz%b)*V=^NH!($B&1_qU+#$-iMHO9ffU}@HvtOH_$Mw}!Y
zL9quOwy)UQ2)aEI61SNujlm$zksJ&Rwu>8s!Hpj9$b4fkICyx#X*C*B{OK|<csy(L
z1!({^I&Bv>`htc5!HI$ONuv`;Vj(1AoIvd%P@qrU-RPtVat0_s!Dl{z!=<ya(Hx}w
z0z|nvl5%sna`2f!VC8G<8bMk8F{qJ|=h>(as#>Z*CW3SI8*nml^J)Z*doX}n>T^>X
zL1P?GKzYpDp-~y!S_Q?&dbUO}Mh1o_pdm1Chept_2SXK4nIS_XWT6hoOi)?E@CH=D
z*UxTX1RZ|<1az<Uyvznh&~09j@q-M921Zblc+v$PBxqpV2p(pEHlLo%VqnMs&x?bG
zQJ#Q~VP-G@Z(Do<8WJ?Q+VB_TikBRqQIv+iV69OM3<th8Fp7d}_y$H+a1#VPcGLi#
zc4q*!gi=cw8W=f2vHymFVKyTJ!zS0RXk7+|M#e5s1^E;-EIKc<%S{zLEThc8pxE7|
z&d9*<6x0#!s_#+<jZuLzX~~T)$j(a8Y!O$NF4#7n<N}5+12G1M12y2h&}9eC3v3Jw
zWsAB%vm^{vpxmI?-o+0x^FBDMcJYJznH&rZUG-i3;BF=_$Q*tzs5#sWU7&>m450kA
zrmzb%G|5oKlbV;p&?N-UkD&RZE@5HN{1F=igTbvX(9jjb8=g#tF7WR5Hv&9a3|+EN
zUt2IRBnoyjf#&cI>|$VerX-YHz|hSE+E8+!1{`?ZOkH5_fM(;qb~8-`4`g$dF?2Ic
z;slLpfTDJtO*c~!BLl;;LWuSvP*b=@C^?a#o2kf*f#JX|s8J=zM%9AD1Jqn;W9?=F
z5BM)*02$|F)XfwIGH#Pld1f9%HxsBSbD)NkfuU_(H&d7?C@45V<!3ijIC!=JVpBM1
z3}Y9lMbP!Mn+cSGp7TNtZ~}!Y%m61VkO2@q&L9bx>s(>3+Zx}^<OlK{s9rBy)XfAw
z>SP(nXoI$HCQ$Bq4k}KPCw4RGgZ;|Mz`(kqn@JyRG}LYS9-zh$)aQoCW`hs+1DV}r
z*9|_^K=1$y14CtaH<LAdd}j|+HxsC06+FPe@O&L4T-D@3E@xq2067p`uYwFQKH1F#
zu2)Zis;1eex|#SvC43bF!}Iq-6%5@>{Gi6&GNDQk6I^9L-6RNh6IVVc#zny?1{C_!
zUUf5mXJlY_0Xovu+o78gbXqq<704vU@8Gd0kV%Z+LFc@Is`W!$-HbmGCNcg6o5aGv
zFq5kra+TT}Q0vk6d^h7!(9p&%28I{^!1Z!B<55LWy$tpo<56p<=d9Da!I$aj$$-w$
zy4B5i0vr|KEZxoc5$s;ZvtV1eK+F2N8No9pprFwB-^~bGt_SWr9dhqxybLbfxH1{K
z8SjD1U9Kz;6TEm(l!4*JI~E289_?<%2jI3nxP89)W;Y|K@y2+N0Tkg%Vcm=q85tN}
zLWWqn87G2Uybw1}0wo_vLT8+04o&DF1Ez!5{6U;L1MF0&U%+=i!kh{jNd(1)dpF};
zP(26gUd-g`W(3`H&H!qUcQbAP`yP}{I#+ZvZUQ@0l!4*pa<EsnK|2~?&MpWCJg_Kw
zu^T)d3G&9vw?fGb-HeT(@(N@_#I$Zk&;|404h+b-Enw$@yvuT?n=y}(f#DVC(g;x0
z=7G|8IV2x3=GlVc2$B&Q^N~ECZv*l?#J`2e{so^i@CIaZzC|}<EXZWgy_F!7W5EFl
z?$dNL#)1q0<xtiY-HdS{J3$;!QiubWf)Jw<kc|c(r2wv4R;G4?2Mk~B5dtM<Mt3;|
zhF5z)&G7x8QG5yOZbn;>%`YI*wlW}TXcDwF0wqC^0~?NaGx9JpFucx$DC3a^DdS2@
zV(4b%1D91S3=HcpcY{}IfrCyup&K$|2#V0iuicEoFlE|rx*0*slhx;e(;lP@2E`#L
zLxIlgU;r&*(AnF~s0Ti}hygSu;%(6lp4+TqV0Z&su)F?p_Ycsz)HfUq4BigiKS14@
zQ)~<j$&TH>z=?v5fuZ<S_b&lZIm5=lkm}g|3zXj9a21s?bVC+Syx~d*vBB#m-f$&>
z*x+{R8?GXTZb&Qj4OcotHzRn}&l@g~XW77pb7e4eLzcw75oKU_Bf-MJP@K@s$O5T3
zKtkG3Ay$YG$a^3aY!EKUM?vP@k3nV8DF%kO%pBm*dkk9V1oBbYqHfSYJ-8i}?AQ&y
zg9B8V7QgC#isYlGU?1^hFm!`vD;VDJ6ftza1v`)@ouT_JXprd*PZC4-TX0v02jp|m
zU@yZP9+1aBLR5nM4Zc?r?3G8La7*Y0-Ok7G1~hE&2DCG{IH4PK9XZ1r2GIOgaYFYe
z(88BD44_JSm09;SMh1qrKD;T#B@Eryz_%mu78fNmbYD}0wv?UzbYBAv-huqKHNN{A
z=s-&l+d94b8n`9^HJK(>bnjzhV0gO*yttqnv^7oe0K}kuDj<V+L1*f9?*q-{o#IJP
zDPiaaP2|2^!v>lL={^SX&MBVM#0rM);}CXnCPO#4fIJ17Xkz%!!0;Ay0|e;cdu0ZO
z&D**cf*k&i7nCtT_s72418$9UF9s)7kXLo~c7v|e1ywZ43=AQ^yFpFhcWb~pk|jWS
z06gc~4cg7j0E(f=uia^I-P&)u!MA#Y8vi<byQhPbvnT_@yAU?eltp(gC@w*gv#)mN
zLCPnPY!O5jyr3D>mYIFEy96OS0U}$Aq_++t3v#gbo9<>152~*P#D2p7jwr#ZZqT6%
z?@hq2H<AXq9^zj!u#4Fk7&PU(%|Ss2UT&eYw;OccfZzd928Q=+5L-cqv4K<N?5o}O
z5VJwDpmS@r-*mepxyb_}3w2W<SO(&btzq4u%KLpMxJlj(9-CYSNjz!_;CKf01-jKh
z%aA}Vdy%AWHBe6llwh{TcY}|81+lHuyVblv*&CD!^)kEV85tPf--8$`4=Nj=hRVw!
z43$>{4McM=Fo+~|%Oj;od25hC;ErdvygP^uGStwt8#MO$!5CtwFsMNVHB?w0Y$!OH
z3u}Scpmi&Mx`jaty+E$p8s9App5KNTD(nL`)SQ9AZDSn^Xk__AIJiMy$KoXkYC{J=
z=0!iGgOVz!G5-Oy4IZ?^OrL?_L%1XZ!|v;KETGZm4^yBTouxq<p*?{QOF$~%nwNmu
zH3r<EG0P8ABpDbgRqI#`7#SEof|lUU%dBHD0Bhy~&7;+^fDf4mHCVLY)Ug<YQv(YF
zgA98e3*<NxF3|8(9SdaN1-P+M$6^QWGSsnvrpXw<wb&Y!Iu_7S#7EE>cOW~&k?jDt
zut9cYSl6*g$ucl}3<Q;my0`0CWFaGxph{`qM@a?-fsb`8EFi~%X2w7Uv49N%RYVdi
z>X`q5q(DPH^D^t0|H&c+!pD^i3=%6~f$(u9I1s?+BY&JJ$-ofvqK^3+Nb^ZZ2r_>I
zYX+GcbE}T|JxB^P{sS`iJzT27wT}5ZBLl-H&~bktsq0|Za3vQo)G^-#cVbvTb3}E_
zw?KIZ<VCL&b<Cg>#f6kuKwX+TX3#=2hAIJYo2-uc9=M^xm7K^>$NW?R)H(n+r&b=T
zV+IWtegaL}gDg4#wg}|B&=qyeyFhLLE#m-5?E*Uw8uuV?hpqsrOLebf295W9+5z?9
zW^{F_?jUt>Tk4qCfXoAp(1XldgRU-a3s~K<I%d$amQTN-<}C%Q14*UI)-lgvWMKFV
zy43(=#2l~`R~bVcGi2(QtIUX@j(I+~Z3)s5H?fWxG<xwFbj=n>$7HY$uvBv$GiXiA
z=W3`uU0^A&VLf02SQr=*v+J09!5pxb(mLiGko}-WAjq^FuokE~(9wh7mhRLub<ChM
zpdd5RQ7`M5LCf(zgO&|}G$q0`MSZVh2F=4WfV(mknsv;e(Z$c80Va?-S9nzDb=NV2
zhI+q9L!D|5HUcRs^twUr+cT$*8PsI@0vh=P8NmZqC(6L^#ht4-pP`OfK$3xh@gRc$
zgeL~!fwb=0UB}GE$iVOgn*N#Dz*<34o9@*ygN{o6(gU@f0WP(xzm5qsfc6D+_3gaO
zI;LL;sm3~{FCYU!<4+)|FAynn1_pt;IwsHw%wM&^<FIv1x4}iH5NNisj_EdN+yyi!
zJGHBh={9&!Nhm3Yp^oV`sPL>3N&&M$gOQ-N^B&(iCeTgS3{}va&2%4{vn3fAb`{q#
zfmS<w1zr9Ia>G@y8(=E0BUDz%)-lyEGBA7v9r*}SSpyIJAdfnxGLX~^i1(Swz=j|N
zevk(!n948IF@Z{uub>;$K}H}-kn$sS;1wQUL2J<FW!5o*uB5yy2F{I)e?>sK5uCLd
zK?hwQr~#R_;&C10Cq@Q_Z=m(IAT6KZ4k}+!$M_l~1)2;8Nxeo$&8cGqowWQ7RHcHX
z?!cuy&ewsb0KUaTyuo-4-5Va~K^B)!sAB{zy!kdCs%}5n2#8w`BDocGFBN!DBKuDr
z<Suq_iM%YmjuEuA>KkaCJje-Kk@Rmz(hs^a3$7o0c|2HunOGg;T1Ezj@1SNcNdH<S
z{p-Q{LC!4Wssm4WeFxpZ0aCUctPCVo`mc@=)XMq}I+`CO1!`wOMz$LK>KNM@85n*r
zKt0zE4g{f;%p!(5#&*yU;Tx{foC=0IM$pJFLlswPP9=x~8fUHI$|(ZNfV$cs4p;^>
z4i8F*;XZYY-LS&g<#rt-Xsr-<A*1t>I!4F>I2Hy5t;#xZmlfP$u}-gJ1l6nzZ@54s
zD|L*Z!8CA~w5_XSoDD1I%NEr!&Vl=UnNuCOC;0<f7%(;>eEzA9u?plp$oi)`M$l9m
zeEk!sx-R_$3L$fqI>rK!I?!P@pb#nm8v#j!#b9ee%1W=*F=m34fm{z#mWiY+8=>q}
z9V4iX`UAA|AEYc9tPErVM_wIx&B+hY%qmDK04xQb1*?PHQV8m+mE5R<Tv7-g`R`1r
zV+0jNpy`F52f?c@>KNHTon=s$1EiJ>R78L@9^$HF<b(`%fYx}{K~|4~WNNn7A^L(-
zyXqK0QwZQd4}4q4C;~3h!D9e*jG)<6aOb{`5!@&NbxM9#fM*Wt7}X)YCs785pWWce
z%sNI(NU;GDng<mEEwo}h2<p51+z1r{of`})X`x(DjDY(7pmi7KE_MGwLoek93=Ag)
z>p&S6<kw%C;Ki(UcR)=D$YR#IJD?5~s70#%rtS{7&Bw;TkYQa1y21CCCa9&$$6fax
z<VH~I`w&+hXr=-*mB`1yaNv(J0|RSr9Vj>bYT+#aH6GR~F);jU;RQ7V)|!FJ9X1Ar
zaG$!v;Djr{15Sm<r9h(!Y@p%2x)U&V*`m6W&}IY3=o)1PhILMLpj9cq)<TR1twezu
zJs;GG-vw&UZW6Bpt?&2+8V%;~smlj7XF<J>LtJ&G;CKTK%hrMJ7zPi^npf9>YGVfQ
z3e9<Db)XsO12qf`zd>7(IehBChc;F5R8%t5fs!r*cmgA#sSdP2^S35wXtpjCG=^0J
zvb&U_4m6(s+lhmLft#Vu7Zj}E^|0Zkb>O+TWeg0zLC24AGt_~v^Z*6n4(U1@aN=MC
zt;eZ@3=D$@bn6^o;s&?szz0Et4cl5*rw!^;gA6;u0a}t)rwyvkKr=BlTkEvJLv$Pr
z3{$)6v_Xq|z?xQUu9E?2dc(l*`z?5+xlRT=>&*u0l-EH{-~)9~Wjku-F)}dxNe7Rn
z*UXauwLGEi_CMv|h0Qgf890VFux%~c3=BK8YL0=r^;Oyo3;~HX$3RY~;wdi8WvDp;
z_Jb$`!=DHq(7N;*&@p2S%fNkX-P<*LAxRt7n*CD_3Nr%^P?P>oI%rZzskx?$QJI0k
zz^ewdOzzLEQU(Tl#+nMjQU(UTs+vkcHU@@mtu<BP0W3BKhKM&c)nGQr%F}G11p+nI
za*#F%gjXvB=79(Nlih1T<6CS`Ya$pK82$?K6r~n3)PUE&ohoHu@V;7;C<sdPy0>eR
zpe{9FU?^6q0Sy5&oMK@33tGO^Tw9|LDlJZdHc|E0=z|Lj4h9D2jv9SX2M^R|K6JMR
zJiT&CfTtigm!Za38l)N29bHmm0d5tsF);XTsIh@%Ex9W-HlSz)rIC^wHMU@Ji2Hm&
z>{H+ck1_x485oiRBzga_F);iyV_{(6uaM+p0J-K?ECU0RmLwk|s9Opup>*pc`Iv-2
z2M@3?Fid(Z$;TuM<*-^v@-b<GI9!<wl6;T>B2fm0e>_}81q_mW0>U7}!K0(OA0+ue
zYjgJogBINJO7ba!9BIJ9z|ekLl1~vdL}dVWnb-|81_riJN!~}G1vLNG2o>e$GDz}1
z(qLftw}va3L6R5L3juc?vSvu~K7lP;5lWZj1&;-R`WW((lDtnr7JxWwwn*}VPWNO0
zO_NLVf|@oAZ@97;Bzd2K`WkOQT`TFOpz)^o3Q693;*etwZ4W^2d0=6jbC8jNLF_s2
zP4MI@SekL$2dFd$<D5ta27^dR-qWBW@C{V@1XNmsaSj8+|AbV~FpMPcX%`TOF)K7P
zk3o|642YM?m>HU1TEZa7d)AeK;eQrmMrd+cI)fzdIS@CWF<pv*Vev6Z-V5OKt{K2#
z#J~e`v*HRq1_s4Pd<+aq(tHdI;;tZPa;@V%1{$k}xdRl5Ag6FJ&T(X5s4bG@Z3j*F
zz@$OV1(5U_urohFo!Rcj!0`VQ%$Xe^-gme&JKY%={{MkHvkT;je8zN;izJWoF)&E}
z=3`)xQgdWrm}4)=TLoIb0kaKc6A1G#&S79=fCWmG2Z#f+ts2Bb1WJu310w?>P-;PL
zf!Zbx8fcTu09iS~k%8fKktDARs1**iZ38p{84EzRu}p^g&BY7ZHdh4(Mh1j!Zi*<j
zfyRUXBci|)76qWpsVc?5&}%Nq3qB726axe3nlFYRc?L#-Hb@fK=)k}TXMudpz`!HP
zo5;z)$k@Wnz$h?<fq@~Jfq@|r#97F|z)-}%z)%3<tYctcXklPrXmVp<PWlBk!-atX
z!2%n{A<1)tm6?G#8B|nGWnf^K4B~)Rvn^p@U|7V!Adci1AJD!`mJ5=+NgxOO1X%-e
zz*YtZhRq-j$N@(f7#I$LI3NeyU|?Xl7Kr441dydH50EW=!N9=q3})$f1_p+&sFvn{
zE&U+Lo6O0;$W#R~dI|#rBRc~FBP)orkb!|wjDdks1jJd#z`&@*z`&@1?CT1+uPZ>-
zgRW~wasZ<h0|TQ4)B%j13=E9!3=GIoP{Y6k4YV4lb^%G=6ix<4W_FO3Ajd>9FffLL
zI3UMlFfcHtfjA(?R536xRv<g31MZj(sA(+7j_G1xVC;Z7W+npz<8)NVEP!iY0M#xa
z$(sgp%oLE7Ajhm^U|?Jh;(#2pgMoo@8;ApP%qa#2#uLbnSpzq14b(Ig$J}IKV7v}<
z%nJqv#%HKea|F~;W@V7%&EaHVWDx~f19HH31_s8jAkIPt1|~Mp-Ju}PItB(N2?hox
zF=Pjvfji&~)B(r|l1T?ti$EQ~WX-_9WXZq~h)9r|M8FOZkmN1p1X(eKfq}`Nfq}^v
z!~t0z$H2f81LA-zFJfR|DnPOvw4M+Wu^<-MdKAms7#NsZV3tp1U|^cez`)?hz!0-R
zl2;h1jMxMkg=Ao0U`hd%5nOEQkYZZci-C~~<oneO3{1;Sz=gF4NQ|3-f$1~@1Jhw>
zkuB=Yz{n*4FAK#y7#N`C#paumyb|C_lYxQh7Xt&+H@Tz&Q0)aC>U+b$z%0zbz$_>Q
z+GHll3qCR)B&f~6z^o_-8ab8Zl@?)ONUmjIU`}RWV2+mqX$EzqK`n6R76u09D!EDq
zNnXgdX$A)7I}8lWSELvi{Cp&NWk9W}Hw+9ctPBh+j6n<xEPEIj*-Yd>gU6D*X3%y3
ziyi|5i;5c}QnvKKimWX?;6P<y5Rl}xg+&lcC<6maFepwIGBB{DFfgzrfjH|J7+A^}
z7+6Y>B52DDSn2?=z-A#QPnK2&29{=M1hGtEU|^ZV08XD=qR?oK0c|~J376zm<YZuE
z%VK6=<Wgr~U|Gt*z_Jj;F=1d}+0VehvKu+SZx(>r3Sxn66_DiBWMyDv`wns`$fBnV
z3@nd99FQNrFfg!u0&&(cFtD;QFtD;9`C+pR+%!<j3}hU#A6P{h7+8g&eqdE$U|>}O
zdqDtN{%;1Y-C<zKk>u53Wng5l09iAIfq~VSfq~T!#97F|!0N=n!0G_vfE*CUz`z=U
z>;Mb613;a33<sn#Ft8@W98ki*z*>Y-;B0n)YlkLt1`$bKT~-E04shuUa!fM=18XD5
zevo4(F)*-B0C7N$S;oM?x&+xV0dUg-KrTTmidnZZFtBchIpzoh1M4AF$ArL&;?1C=
zg+V6BNb>4|95V@ICCD+C85meEf;b?@JYryAeE{Ns9P^EVf%OZrV^ZLbNdXzf0IFLN
zwILf90|Ofe)G=(53=E*-h>&W-&ER{zSZXAB^;sDhIfX&iOkrSP(`8^_(*|)CGBB{&
zFfg!LfjH|J7})$67}$J}9RRNjHe;&`*kTzN*rH($$YEe$%R)^XJ>Z(LN0Qe7<bV#4
zH6RC6Gcd4Kf;b=tbTKfnfn`7rn8(1tHV3IX-aH57Z<aYo6%gAd1_rhbFiQ_IFtF`M
zDRMWj09(37lGhLx|7=$o7}zeuEPTSi!1f5l0a^Hifr0HCvX8gGgM16fY6b=d<RTYz
z!!$b^)N*!l1_pLeLxc}>x*LdK1QF|07#MaoN%FFQTIO#+x!4K3no^RN1>7bT$}P=d
zkmO|n?GAYZDz4SOOY%Gi71yUArNWjK5Stl8K*hBHC!|To^Bh!!aY7rAJTE{zK3H>=
z=cPLXqku51h~|0a3@M_KS_xZLz>+4+d<Gdwo;R!vjNH1Q(3rx&z^=}~z^)47EM#C{
zH)CL6Hvw_hF)*-uF)*-uAcfPGJ+N>BvB2&{38!cV2KGo;IAt*~uxFs;lPyQ!jsZ2t
zK>B4QdESB?vkPP;$T8In4D7H}!rsNezz$0#?DH5H*ykWS<_g>~S3pLg<rDTz3=HhB
z6vKXyfq{KLN;2K@0F+{wuS@d0V`X6E(T6$UDgy&MEY+|-VPIf~r5g4h3=Hhwkdo;Z
za5sthIZ`s^;9+3k;DUw#hcqY|p<4O}Z0UDNp7$V2H$W}r&}U%a0LRBd1_lm01_llr
zkjy&J`A`fD905qa1|6~iNiZN5*x$$nH%A%+14jzX0i_HK9K|RO*a|M~S=c3cKCm({
z@`B6iDGUr8oeT^d?I1fr4w%8fz%dQP0Xbj|0|Un@WCtj~f_*D!O(n<$C=S@oz`(H+
z=73WS3>+s=9RS+W%fKQo$@3B9fK4E4Kn}Rcz`$`G!~r?r1p@=eGY|*lfIkcj9KVnq
z0IxZ=VyihgxfvKZIiU{Vlwx4ult6U=q^++m$@7JifsxM`WX%)?22M=|22OPlXCVUv
zrv(E8rx}Q|j)8&Gi-Ca?ITvh&7tkOUC;%9cLx3}qfq^p|=70<a2F^5;T(GqU9)Pfh
zJBK9CH;`kRKvserQ_jG^SqkES9Mi_YzzObEfgCe~fq`=xa_?s=I2E#(OY-~y8SxLK
z3uMG{1_sWhhZq?c1r~BMfCNFhw=pnqZb1%9cu~I<TT#z>l!1ZsFw84g7#KJ&p@!uK
zkndUCC3${wGBEPjgRBAB{g{D)^C5@>a{ea<2F?#4&N>DLE*1s`E+%9Lz)Rk(u#y)!
zEI~KgaS1{lz@@~%z@@;z04f8a?U1eThB}A^atwojB+oBcqmIjvfq@I0vllWja5*qA
zaM{5e62!p3g_5ssz+(l}I|Lbp;*dlJ2CjIRLkbuexbh&w74p~kK&Nqnh*ORX4B_V`
zdBD?U(2n{ha6<`HG=WR?a%ic3+na$=pd41J-vRMz;HCOq9|lH&MtG@y58Chs4MHe<
z1r3V?frwf&1_qH(NuI0Xpg7(mlnfeJ;kjxFsse;S8{s8+u7T!A-ax7$o@<~bW2YE0
z7#O^SB^=nmWe9^IXb}#`uQx!>6MQ1gz?{MgmC6B$GjEr0Wo2L#<Y#7JP7!8c;Hqa}
z;Hm|26c`w|`arwE8IU#20Bbrf;SSQ|0#XOkG>?ISYYvD5(zKR=fonAb%$5cQrkRlp
zjDoR@j9JWF%rD>)YZw>>pD-{AmVqT0|HCB?KqdMZ8MBx;zQV<?K*g7XH3)owOT2(e
z>|<oiVl;#c|A7i$1Do@OK?34$BLN0x9uEc|1_t*E3Gj8*kf>xZ$N>3`fq~%xD6E8S
zH9%`4Buqg&bCxkMa2;e|;M#4+z?^gzVvfNEXo6w@vA|kcB+R)P7==J>r=<G~3|x;G
z7`X1SGcYH;VPN29WnkcDMh;5@aMzQ0xr8Mv1EbIcQ1A&eFmQ`7FmMZjI0_65+@LE)
z6d90heE_%h0oYCk1{MixUIs>?i_8qnAX~Xj7#O$>V77)cFmQ*04Ojqm_7AuLpetWN
zX0S-u@-Q$8gDg$j#K6Fv!N9<s0y1Df0|WO21_tgvc$jKHVpCWX6x3D>+z>MjZ9u{h
zAqIB_h83j}2B0HX-!L!=gSHB|H%J(Of)TWQCZ<rrKn=8<9~1*lQW8R7g%ERoLdO=^
z1VAw$!K0DPAR#0LzLt}Ldocq8_gszK#0mxpA<$SmC`^wtFmN9PZBNLQ5D^01tfB;3
zuOT4{8Vdf&G|?uAfkCdCfl;&obTE|LT?tuv21enh#-QPSP)u-qgxLG<3<E0zgIuo!
zsJ|w%o|%D};~xV9_bUbl?ib<=%v|YEWj8>TyWD(MMs@)PMv;Zg49r|53=G^LwSTM_
zn7K>g>cCfgv+e|qaB(*=Fz^U5Fz^U4Gca@aF);9`F);9`fH<=l7<kMW7<f$B8JM}3
zF);ABF);ABfH<2N7<ghC7<i&(8JM~EfrwKe;u?r}!~jdm|1K~vb8<82F)+h?@}GeL
zn)CmIVits3B-B8)CCEoSWef~FMeU3X%v_BO407988QBCF7)2AU8JM~Ho-l%Z02bcF
zYR$mR-2@`~K*TJNlR)m9&%nSl9mD~-?-Bz8&p8lh9|Hr=Uj_!A?;y@81_oXQ1_oXU
z5a${L18*n;18*>h^N4|gH-~|NHw*6m{~TcVgQ9}%A0+I4Enr|~V31uSA<4<WDBjD=
zz|79gz`)zhz`)xm&cMvB4pnvpG`B3r&dL<V%D^Zd0a9nmz`*;Ofr0lXI|DPj69WTZ
z3<Cq71Bm0#z`%Etfr0NLh!exWz^}}}z%L8pWHK=DhcPhl`++!R3=I4W85sCyhcPg-
zH$yGD0186}1_l`hMlp4estyJQ{(}q*{QDW?8JM}>LzMk~0d4s*{05CHg7jptGC6TF
zFpA9u#q@s$2L1~S4E&(*;^Ags;J?qnz<-yWff;lmGXFOQ2L3M~jxqy-051cB05^!E
z&%gjWep)~Z#Ia^z5O85&5O4z7$^nhzzcZji9t?lM<uU^ULkcSsBQFD^I5^5h7#IYC
z85jft*%_EQ6d4!<vKSZyG87q@IrNw&azHch-wzDTUh1GSvYdgDF_UGY%@h_!#tbG7
zBL)UgKum-9@E^EY#lXN2z`!VO3krzo3=9Ib3=9J0AkGp727!$X3<9fRY4gtu24)Ux
zXqo%Zg@G}>gQ1v#nO%Z`K`up+ftg(r;e=mXa6189c0r5WUmCEo3&a8iG6Rc*1P=qF
z_&I3dCvcvDLEto~?0Un%An=KSLEr-@dn7>%zh86U27tSupm6{RNl}pIO$-d6g9QZs
zgEa4FU=S2wU=ZYE0M(~ik?PIR5buIcNifxbN+_v$8p#am%~A{upmlwM+6)YWvI?Ln
zA9c{q{(oy27z8sJ7zEQb85lO-RBw}FV3eB2z#!Pkz#!OOP?TTJpxzEL4}PZosRISc
z`8f>g?V#=_LiC6<1EUnQk^&!?#=zaHK8KfqQPPr`fl->3fkE&n1B2jU5Jwiqv1VYD
z`Uw&dWMB}y%D^B9>hnlzGB5}}VPFsh^?9UC85jh=Ffa&yvSwhEb_A*Qg-NqBFiJ-<
zFbHuoFbHwhLQ+6?3Mi3OfD#E)DFY)T{FL-lHy9bynaUU#80?T73LE`q=!T7c`=~Dh
zIr<&QCRPRpP{}SN0piHQILM9`(qdo`(f~P46QstJfkDWMfkDUu#BpR`5DH{q5b_6c
zd>I&oQW+S8l3|W6Wnd60hB^8OK}Sn7FiLkqya?W1$H2W<eIqLaqf{5ja!@}>dJzMI
zPzwWtP!q_$bqowba~T+fW`a1o7#M^OFfa)116h8AfkEgz1B1|65a$8|gU~$&2BAA^
zATucpJuOVd42+CO2gWlpW<rlGXPWW@IY7U_0u-7@dw3WaC3v6}EFS}doTUu|!%_|P
zA~r?_MyZp$;51jH4w_|TV_>M^RxjaZV3c~!0J>)N4TxpTz{rpQB2qy_mNBRi$-oEF
zYsA2?vsXQumyv-{It^k_v<}E1&^gbW)FCI;f!I6Lqd_BapgNpGLp??xwCojhz_Gr1
z3~Y^U%~thTnE2E#^;qzcR~!rsJU7+jz~XFR%M!R57^Pcaj+1UNW?&TH1QC270<_Tf
ze?G`@(rHEv42N>nJ;08;3vrx>CdhHT;N0T@TRm*rsO|xF1aC5fx`!VqKZ54?)zrN}
zR{aJYbahkRACmu|VIuw87&J}}BDg_>06a{j@0Kwz1ZRr#)Cz!81*12(q+wuC>;PqY
z<JoeV4B|ZXpf<)W1_q(u3=BfAr5G4a<%{#wgEH<d1_og}1_og(DF%kqKg4+&KqE#5
z3=G0)3=G04QVb08hs1drK=Yg+!Ey!$;bJKUhVIwmJfJI6K&MX#_cAaDcgq!*6fubN
zG=eXnWMB|p#K0gtONxP^;gvW~GZ*OIG6n|W^9&5a$I}=X4j*A)G=|>`Rw*FLz$o*W
zD<!pzL7cZ(0(7YcS4Kf1gE%i}HyVQhgEPcyso)MC0|SEt1EVbHoTm*E;(W}Y-3K7I
zePdt{{sKvYjH!DVm;+ZJCEsEXa97dH9Ac6;cvMi6OPr^Jm4Q*#OO}Dr%oWs+&GvyP
z@G$^QnrJGB^Q;Fc$eF{)z?dBg8Uas(8WC^=TAeWlz=n@h#CdH&sy8z;Fs8XMFo>`-
zFo-Z)GccwFvNJHI#W665C@?UH$T8$HFs4Ii8v|Fsj0uDexiPSa^M-NeGB76HhqxsW
zZc`x4CKhqtIM5=ezYC#C?tq<ZAkG`l$-pSz$j-p<cO3(Rh%p0$h%Sh8f`LJ#nt?$i
zAH=!Jz#wvwfkEUbi1UbnK~#=`K~xCDdC$NgI*oxrv;nlF_V4a628O>-cY+Qv0H-Vg
z21dCiklOzY3}PG%3}S2yrl55Q3=Enc42*IQ6d4%)@iI;1U}s?XC&j=ZrozA=CI{lE
zGcbt7GBAh*L#kQEpeqc_@mw&@7Y619bD*&ooCD&3io$a6Tm{2FYlt^PUVyzBDajYd
z%D^a}!py+%&y#^cY#IZD*d&l0VGImnM;I8y_JKHw3=Cp#7#PG}fH-*!44`|g#hE~y
zY6b>zLk0$MP|*DAU|<kWWMB~Y1<6chU=TmVz#zU0#96?=AP$;meGBb6Fb4i$U@ild
zY|IX>DlQC+%h?$Xz@sTri=htu!oUn?frE=7L!38(lYvozk(q%}Y6Am<gcJjVgakVS
zqtqS-1_>hu1_=X5>CYJIfs|mU#vqlqQw122DzHC{jOnnFc&Y+8T_*@bYz=Jy2T->-
zZ!RkXqk=g*10(3@8VOfWD;C57*;mNGAdw16?D3HHDPy<<=wNEi<>I_~tPG5bCz%--
z<4qYDBvvsnNGxJ!V2m$dV34@Mz#wrB#HnRqkQ8KKkYojMx)>NFof#M;?LnOB3=EQq
z3=EQyAkHEN21$@?3y8CpfkE;C1B2v+c18xqgg^!c&1>S!g}e-m3YV-I7!yF1VL|}|
zgOn8mgOmw_DFb8tBL)V|XAF!AZ$a80GcZUsGB8NhLc4a1;Vuk}2{jCiifrKSbpQig
zA_6KQ50*$kNaR2zEWi>42#E%$L?Bo~0U<F3Dv<@2a6m|`fJ!ujB^nSC2cQyjz!Ht1
zKnGpq$ryeGBmqs`QCDE?#~M)UgwX)pevM#Y0EJE5Dh38E265g3Rt82TW_AX~xIGLE
zpmvzlG!W+`1B28x1_r5PAkGyA2I*=B2I)djTzW2pq=4uIPzulz66c-8%fP6#o1KBt
za|;85^lAnM>BS(<K?Vlt=L`(eH$j{;3=E(%gJpC<oSO^`GU*HqGVvhJGX@5kJ_ZJv
zE)eH41B1*F1_qf!rVNZ;!VC;rIt+|T?d%MUUJ?upGS?UwWG;as%}b4eLCc1LQE8Se
z1EZHVEZ0PLz&s3Yvx7a%%*EIMPPvI(P<I~zbyu}~#Chj%GBBztvNJG(u4o1w04?*!
zlz}nPn}I<qgMm>6<nF`(1_oJe1_oJ8kg`|?23cDM23boGCyRkWHkg4yHc*^_G4V0P
z?Dzms`qpX@XZp;^z^Giy%)prVfq_A`iGe{Dw2nRTF9U<@JO&2Y8PF(-4}rQ^xPie)
zrGY`oL<N$qnJ!OIVr0w&dx41~01{^@OBfim){8UU;Adb|zGcn8n6izXfidMU1B2`>
z1_s${AkKLP2H8&x46^Tv85mP;F)(QD2Z`QhV36ZrV31>j+8fuy!1V4GBV#5LsNe%d
zYvKl|7r;wwv@VG=fyRkdKvTnsdl?wyK!*g0g8Xxefk94<fk93M#JS4AAZN<JAZH92
z*J6yn1M&|8qlz7<P;G!GJ4O#!9L4`&U`&bu$%1SaXJAa?gjk#)0gjg!;!IyT85mVg
zGczzIi7_z9xiB!uIe|FJ3=DF?3=DFCP`eUTpmwc>n1%>01(;<C4j?69X-1G|IsP*;
zW-yw;vrC){1Jk!AhA;-k#0sb@U}MuP42-G_pm?qY^~@L;<Pu<pM&E!LS_bzYGZ%9K
zIF*@xftVAc1NO~tao+iy42)`d><o;cn_c8Urd5MD{0t0o6B!ufx<MQn1_rsq3=DFc
zK^#p626;gS26=9nKYJJ$KXWlKs&;}iJ3G7-NZ7!@T%*XqsJaH^brX=+j9nO*UbQkB
zz)Gov6QFozU{pN}QsMv?egPE*B>_ekm~bKoRQMxEH9}a0f$>8R1EU%rC?r9BoJ=G=
z4iG(RsvtdZ8xm6(7(W&>Fsj)?^uVp?fGQ7xD2JxU#3djrAW9(;4B`yTY>-YiC=W3+
zFldX5^Dbg#U{sqU%fQUG7+RmlSTHbmuLGrE(|ypOPXQH7+M43LD_I#B)dkrZ7){SG
zFvy!QFvuH#I5!y><bxR)<b6S$XABJTwG0gM<<QWMDS(8w+IMhhGcv%UJ!S&PM<`B2
zYC6SSfVHk-U_&De;=F6w#2J`O)<WEs^aboLYjNJIAa`wLW?(Ye#lRpxhk-$U28eT<
zfkFNR1B3h#b_OPsD+~<s-xwI=KbSHwnLK1*&<<i?RG$cvdB(t?AkM&`Ak5&wz+?hV
zZ^?TgjQ|D~kdmJa3<{2*@p*8XOofcbFeV3p(xi5hIPZ0k1MYzukBkfq3ULe!3K5_X
zgewFOfofMm6l#FhRe=^mE6ikIP?!u-Xci3dQkn$VOMT*ee4Gr7x-QHNjAp3}3<~EM
z7!=NcI7JK$3Xd5W6hN~gX7vmV3cnZ_6uyB{c@G1Fq8I~%q5z09lYv3egn>cPNRffj
zY#H;!8=#zLwwZxJ(T#yY(FvsF00V<!G6RDmsLn7u%fO)6z`&qbBhJ8N3{50y;QC1W
zkvMmz5Cfy;CuRmF;}r}HigOtl6lbzCFd1)UU{Kt{z@WGZ#5u&kp!kD<LGhU>1C#M1
z1_m8r21ZS1MFuA0=S&khplKm(2dHt+z^KWI)LtrXfTiWMI}FV3FBlj#!NWuoIl$Gc
zFD$*J{Q+r4*0_Ly0c6{G1_m8t21d;|kUOq0Feq6uFeq7oq)en47<Aki7&R+Fk*L7H
zpcKl$pyUsh(qmxI31eW?oC1<EW?)e2VPH_|0!bNvWnj?BU|`f-F3Z4V{EH!sfyu-X
z5<eNRv3nK<M$K~|oo);aN-G!`l$L-KPZd-dY-JEQ@zgUgC>>^CP}&cvbj+SIFz8f>
zbLVn0FzQ5sqT(|HgVH?)2Blky42<Rs;1)QeIWKt6ErZf0b_Pas2?hpbYX$~o%Q^-|
zb5#(bE6%`}v>#$!`V>&A(U~vKtsu?7sMQH7+%GaPD0?$7D0?F1sq`h#VJSus3!J`L
z#F-LQL7gM>Zm3xi3@mUKSP6rSIJXQd1Eba%XxWmUgB}q(K-q%HR0g6ka{?$^=xh?_
z_U2+>)b?d&U^3NXU{FqHU{Fp5aX>zq$iSf7%g(@L>cPOEypn-Id8sJ_lW8aegU&ey
zMr}=yOcVoy@=*o`<-MSwHO+t;4xY^bISiyEmw`d~KLdmEZ+ID=4(>lPFly%@rIb>5
z5=*}TaytW~b~m#01y~A9f5X5$w~~QT8`J}3ss~p`?l4Kv!pF!221f1ukP#ASftdjw
zbcCkxj0aHjUn83jn?qvE+yIf*;X;xwgBS9dPoUDEc@J1ep-ckifGh@x>vY^er6$C6
zhOq3BCBncMnE-JaTtf!byh>#2;DM1f2P!=SS$Y9n_YMYTIVlE4oed!C%Hctr^#Lk=
z0#!U)2P*ymO*{f>&3|NT4#2F*&S7BM<IBLPD~_gZ55zcKeW*Az`Q`9{#Gzu)VPHm|
zH4Kb9?V&N^bAW-#`Ybd?e4a2cd51AD>eeFJp1T8PyRQILdJ(ep4N&8z817?V6NnFV
zk0UGk0a8=}Z~ORqFfeAoN;=;P2IiX042-(JkaXmExG*sJxFcE<zB3q@y<Rae>Vf(^
zOyJfJEY|Z9U@r7afs~4Ro=8UR0b35zk--R0K7I`lzv$&7sm#k@WXxpdVuX9fZw*w{
zY-CjpjEF(PTN!Y>uP`tgZ(v~510{L5(-tr?X2K^x8T}ccYVIMM2M=I>8>n@Ek)=<-
zZ1B&3=+;+6mVN-T0p95Hp8^R?eRpIvAJ78Re+MKm^+7qG3EW|Uxi}y0dH)AcMH3+j
z2+7y^956Qpa6sL(70JGQ2^2R4m_XHBK~|#yHzEV-WaRkIw?K1pKo2Bp4djpv*$b-o
z5Rn?Nhk<#)90o=MP{WUz%L6nb&eRC^P+$QhX&QjK05JciU4Z3_&>GMzG&Em?=`b(~
z?1AQsFb7c2mVwcrAJi`M_f~;9Jq+3rH(15Un8jMgP|BbLmnwkj0p)y-Qid`HCFKSt
zm|c-K7#IV2pvFgWK;88d$!qxmpf<GwOhdE?1LJ|sP{&2vFfdMD4&}snfLsdW#4s@H
zDM8JRWnf@5naaRu7zuJV7c(d=!n{3A1KeVO=bTs-sM;d1S{8Vq#X3M7X9!9KFx{CO
zVBU;Pfl41ncKZrYcIR+F8qe7aPcgAIP#uqubQHh~?${|1X(L7?=|Z^fBn5~&jda28
zMDf$q6R3VlN`M*_glyCbkfPFhm<N(tpo$8S75#uqzky2cL6R=wK*|fC;w6I#<XQN5
zRS^RtV;V?^sm}$GI#V(j7?boF7>zE2atCZt1Y=4ERQNS0(5m49pK<_Vv#|!U%^e^`
zpdpnEraA`Dlmw`1O9PjO$xMhrnp7D`Fc}9!g6RU1gQsSIQWm_#NVS041B!WA1Q&C_
z5?<;L28NT~u=*qfq!!6Npnf#u=w3$S)!;pIq73>BjK;Gg85k-8#d!)r3&#z>%@GFB
z3Cp0y2txwn90o>{40Q&E?GfTUg{I*9pcqu77#LK<)EO9-NQ(0mdO~iiQ88s;P%(rK
zyB9-;-BtV;7*u=?GlC3(8Vz3I#sKP^@RSNLFq(KXGccM|F)*kkGBBt_vokQ7v@<ZM
zG%+x!)Ib{n4Am;2Vh0pFiy5<Eg$;uj0|WDQah^1=yFoTg6@rZUr^$d8J%Eq-6z9o+
z%pW*1Foazf=WzvZ`+~T{HUjKL28JsjPnynGXJAO4D9+<*$-rnjpMgPTDFcHFNU-&v
zI1gxdkm(Wz29*;G3@S&|85q{di}SdHLh%*@gUT}o29*bL;OPP$PZ7{`0Rw|7Cj)~j
zs~mXRfCn^21)7>rm1kg3m6c*(*l|gm$6J<xVdE_Z22~3N230c|$Sj2EPLM+(MFfLw
z2LofmK1dP4VEY16Vw#qK%6QORSSDm5k%<E~kilTb0aC-rn8i~D9rtBAw*WLigir}u
zClye{$G{L!0Zk32J3;<15Co+L)0Jin3`TRrd9*>ZMy6l53X(z7HM$ZE41%D8iuq*4
zdGx?O1T9rtDbAx0+Le2X!Hj{yt4W;u7f6?xIYbxtA0%Depd$o!c0qJ;{{u$~3j@Pk
zUUBaKT;SOlGX@3^RdMbIU?V_V1=+ueb3XzrWKdyXSoKz%I~E*!j0}uspi@Ln{}AVn
z)q!&44~cWfx<WY(uf)0I_&}zD4`UJM1|O9R+R(VyN1QuRn1Rvk0chW&vN$(r>_{18
z+sYT>+|$9cQY;J%-BRM*Ghm#3FT}ZLf;phDV=&-jU|_gq#=s!PBhD=fa;-UN6XhIV
zac*%?V1TTt5f|r{;9_7jH{(iX5a*Tz=LQxAh6As}xh264i(+8Nj1uRTj$&XaFcasN
z18--2$iQe0K33U49OPwpLvgPAe4w<<$iQgcEmTrb!XVBCx<g(WbSotPRdKHS;5BR@
zOSnKc`!PNQA9XCw1vwg=;RquGgB&B*sYnKf^}EHnazV?8AX%Kz{RAZSGh2XCztwb;
zg3Me7ajsk&21cvt3=FE?3=FESkmSpi51rCd&0%0r&5~kZSieJ@D<8C0)_{RQwT^*7
zwMs6zpp-$JtAH0YvB|)oI)#Bjb&^~qNC*^kZx|R<w=giME|M!?5a%kC07Vo7gBk||
zgX%9S1_qxq;#@@v5S!Jq85q>!r5G6edBwSkL4tD_7}QQMFsL1qVqnOY7Uu$8ZxOMP
zfkEvH1B2Qd$n+h<hb6EAu~H+5fkERJ1Ea+Px#S`Sajr6O3BkaiuFk-qt_rIzJUAE_
zGm;n>Ep~wN6QUpB5d$hX85k`-AQhfzpi-I98L5`6)L>*xXXfH+gq6M?1q_IWvIn%P
zvXntG1W^@xEP>cziQM$di2zj?72uW-l5=iAm4e!TFfZmz04c46S3sT&P({f7znm2?
zuX^f0r9o{Um>CGyctU+_c^=8JIR`*iAl%^z^U*tGMF=aPT|g^dBx!^dpt2e?vuLG*
zB%N~u=0Go~1FgJ~q;uik^YVbW-wHJI0ds#YyjAM;0xAs}`GiYbz#_)$4|w?u9|J?g
zF+K){Nb5)jhWM-EoQFWk0<tiK(FD2zNZ0_B8$7v85{uFq#5oV?LlUaGF9U<RsX7CL
zZ<sjeAty+Mr+%A(L4CUv14G(ban2)<f{H<-gMmS#LW+T5zq2^!QJCNr1_q4_kc7(U
zDFt(4WrR2bqqiuyHexgf?Tckl+b+(<Bf`LFJ&&1z(OaE?LE{|*gT^a%21aia&~+6I
z44Nz;jw1tuCg|K_O{AGy^Et5KG>0wE;SlGT0GrV?zrw(n{s}ZF;wcZc@(pY-(j0Ua
z8mK&Q5a+T3S^t)qff01qou)ejgQhEJ%EgX>K{JAZK{Euz@n&GqEM#EN%mt0|1++tq
zvjC4}tDO_)yez`NXp_&(z!)%-fkCr}fkCs4oq;i683Tjn76t~*6(G)L1_sSHpgA=V
z=KuqP7B2&X7CWS_W3+&F;ccRk(nEFxv^~IR0iHepHO&k_Lo|#5yigZ>01eToy%guX
zCc?mI3)-j=AkV;{rN_Xar2(=>hk-%MkAXqU1H`dpV9?5CV9-hjaoiXfv^p6Wv_O+c
z0l^FmTC*4!v_Ml_0dWirS{oP`wAO)?Wiv2n9cEzA+8f5e7yz9Mu!OA=W?^8o<pHUx
zWMI&G!N8#P43-2fLqKH>v}I<w1yV`Fs&7!kOq_wye+tACmf(pebtZAnn<5O1cFfES
zjQ-0Q7_@#eFld4HXZmkuV9*v}V9*8)iTWR4V9+*ZV9?fPXJGU{%fO(W!N8y$2jbjf
zV9;K~z@R+?#CguZpnZvfK^rt->i>m-LHj)egZ4|1TNxP`bVL{!bhw~FZ?%Mh+50gA
zqb;Z~U@C>@L8}9hPMz&@P`LoQ?-Sx&>j@xnq&90dX#Sdk(JL7u@A?BYil?q2&ZQ6X
zP82f(qgN>dgH8hjgH9c2#;%EhL8qUAL8tdAbShTeUYz5S5b`vv&SC}zow?ws_V<7o
zYYomW>i*)KcR<E&2Zd4;1B1>R1_qsHARnhQFzAXfFzE7uI3)}Wx~2>ax`rT5BLjnO
zFav|GH>8!tXuXGl;bbi+C3{9f40me*yE#>y%Upzk(H^w#!84nIL3c3&gYH65`mbPM
z(B00!pt}*oX=Py0y~)6!dmU<?jRq)wp^@#*0GkDZOo)IcSHZ&;Ap88TLhQ4#0NXb~
zobx`&zWvM$jDF7<7<6AVFz7yKXJGXE!oZ-%$iSfcALM>U1_nJr1_nKT5QmR}K~I^1
zK~EmUk!E1fvu0q>GY?~6^tXhX?E=czprv{YjP|QQs;n3o^nw`}^!#Dj$tDDpIzhEy
zDR_AUqc?N}))_nktG+;-i%o=q(E+qu(fc9;gI+cRgB~c?c;91S&}(I2(5nZPNv|0g
z^p-L(=*<UlelRfT9bsV5I{-~qHWMIaw1W{+j)vB%uv}uZ1XP29N+`cRsN=Ul7ltz0
z!1h1Hh;u#yIR+HtehU~F^gwR71q!6K3=Dcd85s1wf;hVv7(fSX=!2r)?>GYk=u{1T
zb!ep6T!2Lis2QDsh!1F4Y%2gNN7VO-b3PSeV04lJ#fLfrgT4&|gT4jGbQ1;!{dfij
z{a_Hsk%2*fDg%T5L=eZ1fkA&01B3n=MFvK{XvQ#*SOx=w{v`$meNg7}D`jBNf5*U}
z{{ke_!~nXko56rroPjYe4dQ286L4a<BhL0$n1Rs|w6!I!f`P$6nSsGT7BtP?%D`aY
z!N6c(2jWa(U@&N8U@#~Kapr<9r)6L;_yI~>uysLp;5`=VZ^YSUco`TSkAtRjTo@P(
zvlti*GeDd`1_r}Q1_r}&=$atIP6h_Uc353v`v8=h85kWOFfwK^b1}gO2JHkGm=`RA
zMz0+>%`-4Mf#?3fZ5Y-vhH?fOSlqhr02?FD!03A$;!nF8a3KE?=X?PQ<alNVM&Gv#
z42Clp7z{xLukSAg2E%m>42H`<A;r$XV0eLn!SEc&YrfD`Mt0!+Vj8^SoUcJftOpsf
znSsIZF$06)U3LaW-vbN`Myw1BhM;`odzOL0NQ;5NNClct?bm<?cEILAmZ&q@Zvi<;
zLs^{jod^S?vl_^}N(KfaF9rr9H;{R43=Br83=BqzAkJh42BRhh2BSKdc?BRZLX((7
z1T=}kD*H2_Asz5MJvb1-*6Kn+!XX80t)n>SM-c`_7f|;1wP#>3n#;goG!tZ#4+DeI
zZUzRUtsqV$1B20B1_q;>;tY(*C!i*L0Hqm?5OMa!oD7UEtC$%WlW#FF82w;iF#5vI
zz?l4;fx%dufx#G5W+Z=MU@&%KU@*23XJAZeft$d}z@U*M&iI#;fzcVX+%;ty1A}n_
z1A}oKXe~twBLjm*4FjX|JJ3P_HU<Xcd<F*NT(Fb~1A|6C1EULQRauH81A}o71A}pk
zECXYTnkfTgiXj7o#wrFz7aNdHBL)WJy$lS-JD~yPm;svU1=T5_DRr3O511eaWIa<#
z3dEU?OJGeFN6<+ZprVaKoQXkzfzhRnnSn8-jDf-U2?K-iBL)u!#uVuEmJ_I_0#XWU
zI;FTVFo34Qj6cGsY#kney4j%euZn>IRQ&k7fY|1w0kh2s)XxGL(IU?IU4((rbu}{s
zqt7n}1`|F81`|-F?<>f_U?RuBU?LO7!00OnH2}8ZnT3JTRUH(2@(c_ndJGIEIt=m*
zOw*S_m9@a_0UiDUvPVRmeH$+WqiZ2E1Jm?P3=Af=3=AgL(BN^Jz`!*96KFhyi}4FQ
zLpmjZig9R$bb=1uxz0r@Z?k8>vZK=y28NTxphW1S2X(_5a3VY^&c!Ukz~~0r3+>~;
zz+mFfz+eKJ0r&A`U@*yKU@(bgXJGV+Vqh>?!oXlM$Af{<2bz1Fo`4+Az`#%fQjx*H
zU~-y)!Q>=}Q_8?#a*u(*<OYb-#K2(khk?Q57q~+A_J`Q-A^=XpH^jL(MHm>}!<ZQu
zy%QN2Ko=#Oa)N4<JO&0+4F(2NB@m~YfdMqdX6gdsbTBZOf|P<><~@~x!L*Kn!L&k=
zfzf*r(?pJ921f7o3=A5e){gfE1_smF3=F0-p~2*0!N6R4n1Rvls0#yQ><LB#5cLQ#
zmEn>A%Ek<gZm&Se12i!KZMA{x445GYAcnYefplXU;tFm9Ffh97!3}{H1dQ;=b5#MY
zcY(&Qs|y2T9BAN@2|QcO2-=$_&%o%l7ZOyi@Z{nOOD;CzT=Jk`1I?y;oo8S$UB$p)
z3TkJ2-C<w=jVYOK2eq|cGBB8)W?(Qq4&r=cU@(2ez+n0S6oyO;45ptL7)(Dv3p3X_
zASZw_gVzM8tv6ta)D^Y`kVl+LU4((rgAdfGTg1R%#>l{63My;8)-y1e2{162@xiJQ
zQw|2kfXfVw9%`U4Kr|~&4Hy_xUNJCwfL8)lz?++<(7|etMx^wcbpupRfMOwosS-S-
z3TjlPF;y`zGNv+BGcYoyFd-Sy18H)2EI=|M8{TU)-2rtGxc`sjBIs<T$6aJ?;PGmN
zA~PPS*?*7}<tV_i7pT#j-T@xddBMQwDFq&26JXG1VD#itVPIGpF3zbB8_V*H6oPa%
z^)*4AO%_Pk(Gc8q1YI@2C(dak0+Im@2~|uJ=j4X#Tn5$2jjWRwStlP@C#2`e@Np%q
zGODxyjo5jv7w32l8o=`MgpAm6yakWgaTPF#bG!qec*MfM(D+51<2~q{p(+*zhIR4c
z9PdE`Iv`Hc9C42Ks-TmjSr`~*yNh$Y2Q@XSAht1jMZ#>WI3UWv=%og}d`_I>D=Pz|
zR~!RK$P!fubmpl}3S0#&_`D*)!6ys~J}=O1tpX7$3=GUK#5qpDLc(hTBqTUa=z&5C
z5{4Y7z##z&HnZE}96R8O_d*r#P(o6?3$FO&3UQ9bFvZ>iP{oVYkrXclD`sI}n6OQp
zW0?#CqqhK83MkZ;gU56sE5|ujfCoxJgNET3RTvne=ZJH3!_D=Fn%k{~WNt6aTpm7g
zjy`bQft;W8R-D5Iu5&+Brwy`BJ7k^qV4W-spkZbX2V^HXf}O;|z@W({&fx^sBLH=6
zxeR3BT7`ijSU{Wua?>&+1EY^5)IK?7B$q0H^+M7oha$|rBolECC9n)M5%_4r5<#U0
zEIxfS!STrsiccR&6$XaYJmTz6VczqZ2(ga+DUx;U&%uU5tYZhY7tL;iQcLYNaSj$8
z21cKWEDQ|da^f7UY7C4%(?I80P7vo{10C81Ia)3pR8NP;t1vL+o)l-l47Y4I)UwN9
z%Rpfr)hEur4=(=#D!&h$!yu!{?4aZI8Qy>tr=1jMUkOv}s|!`UQUw%HGZ+~dTC2s`
zR|`UtBl{Y#9|X8SW0LG!KzCgmFn|m>`A?j^2X06@)Q}#qjZm$9V6CA1cT$|aAIt&i
z3|S)1o&(pp5UMi=S!W(tF*M-v!SMvr8L>#5-5aj+HdLp#8pz>LJAILL`oVR!zY%9Q
zgz5AXh3Yf}haXg@F|tk*xX$Tb;%x8WI{P3x+1`Nz3!;<l1CmZQP-EEaHWzpXh3yke
zrbbqr?GxziIs-_$W%~?E((K>F*}jM|Fl@X48V_gt3OPebg@M6XNSy69+~TWHi*F-&
zmhCRgcpg4+wtHYFvoJ6unTWI92g`uM><phc+cB6i{vJ?cjv@J+?F3jcB(&L1f{lT?
zA5s=^Wip7fod(YmU}lg2NYY?C4>kmxG&JvsvvtC)?1x&}sfvguwr;R$sFginD_IyA
zHoXyN>y=?(^zR21KOwVJ7#N(I#M$7PI)E2ymK@kDP6p7(CYv1S#0b#Aj8#hFYzl&)
z$v$Yrz>jPMg^v=<mVh2{Hf7jsO6xyyHWjc8*q5OBFGwbFiWO&l3-d%kJH%qvw@Bf}
z`X0#>tREnTfa9I@BUlDxA}i!J4)B@s;;f%RmC!8~28P4i#aTat<~43XgO3%g0~~yP
z3gWD%;5MIw+I$MBBxgMXRt*V0*0W%nSr{0amWZ>S<6&S7I0p(ohQp2w4AUaTS*MGD
zf&|<gV$cEYJp>J_fDfbz<T1%B&1Dd0oeny|#(;srOpk%VOpYO%fkEb}IBN@JfRaIb
z2egR{(c}YZ?=fgY$1}6QTihV4xgov8NCpP&OmWt1<e_TNJ~EIo5Hp@YhN@Y!jX|?o
z3=C$K3=C$akO64cT(IvL7|bRyFqln{VqoCm6KBl>#~1^H*+K>ev-!|;XpGqXQ~+@m
zqe%_}W5iQXFJm!d7SaG;WdQ?2Bm)EQ8gW)%BzGCZ77>CEO9+;Ly35xD>aKkZ3})Mk
zAhGHXb{Atf)R_TbE(3$v3kC+WCs1bwLY-+Y%)nsI51CzM4FYF&1_pCG1_pC0sM~`z
zIH9ZID?6OQvBPK#+egg9z!<bbih;p)qd02}blS;0oPohS7}hd1UI6kY17pxxNXr!2
zryX!bTR>ez2F4)J0yvIx1`Y)k4h1#1>=g#a<oOJY!OS2d%HbVL6BY)>WY7r>;N|mz
zppA75jKLb<>Q4+*{RK-zGBBiDi?g~R2P7yLf+AQ4G#3#(8yb*qW{`k1uVi2_FNJv>
z5p4^g(PkV1@(-41TL8X1mhlAxV=!d?Ujpm|(ENX|uQ;m%vJ*h<J-8D><e*M)fTl6?
zDGUte6QE8&N;wB$PEf(&gahD|!*orYRRqa4Luluk@eattp@*Tii9l11`DO+N^VQIl
zBL+??jG@q!BM#;=Fqq$GU@*T4O*s<aY|Ox5A<4jCAqq`7lF*c6;ljXR;Q)0zQp&l(
z3Q0MJ2_UyKFoxWL#3gcafX`PMmOzq22xuJ?M=4rzFq{HO4xvIIBM_YiBMwk<U|<Z@
zLK9bDU`$qEU<`Fa6Ze3MN1=&VfCicv7(?rj9Jgl!XsL(?EJ+&mK<%1_ruP6;d>vFA
z8f8WgKz2dJK-oL6U7TeBQY7g@Qzi2UP$WfMfJ73@0wYMOw8&&&u!w}r7qcva#)`#G
z1_q0bkf>r=3=@3Bz+iC?5>+fqpqbo~kAcCG3ldc<OQBI^X$QJSQx0@$x;P8ywgu4n
zhnDFK43^1qpgWJmS(bt3;@>bZST-{-Sk}rVGl;V+2hX)LFj%f*V6a>y1v;)koMnX=
z1A}rf1B2y11_sL)(8!N?04p}CID!}$)Rr?ahJns3XWuT)@&I&ptpNjr)j<XZtG&=Z
zvHl6rh$k$BbwR7f_AxMq{Q!j;Vxm-c0i<gfZh+J^gpPD0%^z2Bfai}{*24OXx?4b_
z-_TU3dj=9s;h`YI%i!H&-6x=70tUwLT#z`zQau((stun65(kZH!}ms4!53ud89)sM
zO#_2=oI@?s>wt<M0%=BArndlU*)5Pbl4W}s7?a*IFouJMpg=_%%$zHr6H6EvBS6c5
zk*1FH86f!~LJ4FJ!hC%RsJIoH_zTcdSO&(3AdvV(xcdz(AR!xpy#6Z-z9iEi0^*Gb
z&@?cT_Y4Xc7^7!1Fh(o{8CMD)axwS=icV<yH<SSdAV>jv;K8~r5f8xSwg{-ujJROW
zz~FvBoMk#217jq#EyXe&)Sm?1923wk&NAH?)K&ns8}-=5S=xC)t5Fyk7$dzQ4H%YA
za4QhhQf27^FMxrj%E)L~s;rm*vpO;wY&9Rq>PYW028Os;ah7`Mp$gw&M^m|gGG^pH
z6HqRw2c4?$kb%MK0|SHAD@gn>d|$!97`cyuF>)nnJ+&=#`iJ5B4v;X!>kOb4i-@^6
zOBuAq0=}~mR1?I2OpnS0n_i{`@(lxnwEzQyH4kFRKErnn&>*60jW|mMCj(;?=$N*o
ziwq3bnhXrq>WC%#4BtJVOZLGmkns$VCHpX!W`K6=GcZPh=YJP7W^q`ka9F58vkJra
z8V1IwOpsF#z7%Kig*x>cw1i>+mr&8O!A|v6fjZTjfx+4lbl#bfIE%jk0|R3j1A}!1
z1A}!DwA6`)mO9qc7#OT4AuY!`_%eurK{khhF<M71r?`kgoFy03rmSLMuwKK!V7&_J
z=5K!(m{Us`7^6YEK$s^Au))JuhJiVC3TV}7F$2ecDMrRj_EH819~F5;&|ouj8f0S|
z!?zUZ_!@`>4iW|qah4EH2FB<_W(MXoF$M<f-3$!YJD~*-!?zjWAv(tBDo|z5#k>F(
zJl{5eN)kxIX83ji6jqQ32OX@~#U##R0!~ig`i|lI2Z&va;N%m#4IFAFx(p1;{0t1%
zmlznVPpC66@Lv^YF#+9sZNR`_!^Xg14cbc0X(Y}98s!58rHu&#gN=?{YF-M1I18xB
z23qcB6U)G018U@D{}E@gfR_I@OBon!W<pat(qf1Ykfs~M4<Cqw7<?EQV-7$g#~Qo|
zpMk;V9s`5TEog}U2!YhXF`xiog0E|5_|X6<Ct^0?ErBaPKuTa6Sh)R|0tz<<P;Ad(
zV2oV^jcrG0Y}<TcV6gcl&%iVbvJal&#}`<P{rCcPGmkinJ1+xcYzZ?1)2#Ol47SV+
z47QAV3{12BK!W=RY(q9kH$)Q)m#L5*19RGDxC)s6V5YKg>G60lFsB`XtAOg1WnfM_
z3Sz@_9D$_4*j`YQm?!~HgFl{tBw%?QnlygsFfdIw1SJg@aCd3LLU9%eanL9bBPeBY
zGBBJvF3uuh4_fZR30i$3&LRO?GYPuSE7DP%MFMn&`5Q<#oJ9(peLx*G7SN?H4B+vR
zMgPT_K^ML5>;jpX#>v1i(OjJQrw3@^Bg91JU$7N?J-y=0zsy0)#~>y$|ACvx{1;MK
z<`prBGyere2iWx5+v3dk;O<=|1nyff-?Ig|7iz`>gc+dgT^QbQfz5abH{*bwIP(s;
z8IPdab|JLw23rjpG2;?v-VN8MaZa3h0hq_gz!<O2$-tnyPn>yy1=MFCZ!Uy!Kt5Xp
zI?EJvJF7VJ60nJ&0oW;~;>`Y_0oZs@-`22CoY@~Vf(p8OUB6YFIZ&H{G5!;*I+$#r
z%D`YED$X3F%)pqy1QVVJ>aV*Ni!%p9+zbhX5O8K=VPH6ZQ=B;jGF+0$AkGZBWQySp
zXn>bF6zqDg5|Ajkou|scaL7`eIRezNg&&_YWdk&)BAWRXHv}Mq8q6Kgb%BBm4B<0C
zjslk}{0u7@85sPpGB73xLj_bA81#RMGsDNc69S<DZ3uBR$Z3#!ZJ@RV!}~QAA3$}e
z+j((jC9s1*i$rRmQLO~(I2eG^9J2}}P@@?b`fJ3Q#h_J!HYmA*@&|YwbHct*Na%=x
zCR7X<vp`3YFiSvmGT4eTFxU!$ibyqKai%}uGy%zPS};?3Ky_dumkHPuraz$TLk$=h
zZ1orzY_&jUF@Y{A1~pP`eHj>Rok3AtoF&e51Qf-Ivms;bOvk`u>`;FuBK)~Plz}l3
z)H={f5obCJA0$t#;3`N<WDsXM2M%l&28M%A#F@^4rZhn@&nGL+bRJSTg7kMoM$}>Y
zL1Uyy#=+VXiID!EG^jn1INP3qfhk^`X%ic0gSrrS!7tM$BhZ3hp#lbRrp>wx3>&Ws
zK^(CeQU};GFxX~_GtFdUU`*nKYMH4I*D^~EGz!OH&%og5E6&saQl$@7)nEo!)u;-}
zETGt3;3UqJ4<1`#1hqIJvCEVXI-kY>bhnbJI8#3OfErN8L{3qhDVY^iPC#P^*3~Zn
z#ZJ<GXzV0I2Uu-)F)-L}gH$6-so><sz+iiwfx-47v>4R-1FA+q1?FPLECvQI1_qsM
zai&<X6(INAhq@;goZ1*V7#SG$Rf#i2fRm#m14GYQaVBsb0a;7PpasfqphV{Ya!|4Y
zB+)TBg3j<UV9Wwp5UeH6WC^n%*;5F-bezdj3sm+7Ko)`<uLdb>ixX$khbt_Dx<nuB
z5=a(ef@C3(;-D~bCN;R?`A}0q7l!Waf|?rf0Hkocwm6d<T;U0*LOD$9xfR42e~5r$
zjFEvcB?V$V;}6ghegjByX8Z+C&MXWJD|^HlLDwNNyb)z!Oc8-5L{@l0PI2VQP0eKx
zXJP{<WKgbUVh1l52BlI?BXK59=y*Lye+a66kP=Wrh8hR*gtW9c;|G{0Qd*#H`v97c
zG62c1tQTi|0heC_m45-cKMgEjnj+448C38Yfc*9fl0F$PTZ4Sdm6^{V&Uh7Eh=Lr-
zcnw@g2ta(mcmwPM@U;TlL&O<pgOe^KHLd`kFV4WgbOaRnsrMnNk#RP3SkU$#1B2}c
zP+7q^7i=U0gPjipgPjK?fij+eCQ!Q+1_rwXXp3kitR0}jz?fRD%D`YfRh$ttr<Qsj
zRtrqo0X>t5VI}xr1_lNO69&fAi>eF^Q}&57o)TqX=wpQ`K6L_`@>f1!U=9HFmJl+a
zMU^&4-BeH&59$6gtb~k#frhajGBBpT2bb-fpr9^XAkG-T3+nGMGBBor)~4If5N8a~
zU|<mD2i*_9__;WvB^v`{nz;}-2{2lM($oPVa3`M85)vi$3=Heei8E?})a7u3ZnhF<
z)RG0YLpd23x@5!|wX{K3gm8hIn2b7*Za(OG_?|LGX>i~(>VP+-GcYjNfC4|gL!E))
z=zMWTY0!wN0Rw|w0|SFy6{xE}oq;iJuN-J1hEX0A4Is&R3=DR2prOd93mX7qVPH&q
z4pj-d7!0IxEdztyYPd>JF#yW#EDVh4f>4$6pe6_dgWVnm2D@Ewm7t0hrqUX!5?V^x
zon~OLI|)|_vI(X#6{-?i+t}S=V6eLZ?OQPFf)`FBHFL8(K>H%W1sN!8_Woq#1BVU6
zPgw6L0~|J=SfRqujaTVMkqk+L?Wtn;SpjKEr$0fGPM3hSn1A*#fYua)wi(naGqQq;
z#x0-385uxf^5z+1MotNX_%}%8Fg$^FG#Gq94#-G?I^d}U#D)ye?q66sOoN>R!tm4t
zB#mTwS^@(@I0J);toTK+Ef8;L!YTpq`t6LR>EJ5*A~@GEW+`Mch+hK5^BV>RySEGs
zcF!4X7#NPZi|4a3GB9SG<^VTtK{XJ=DPGV;8RGe%82k@XwSKmE7D!bl=x%mRF7Yf-
zES};8-KQ;{CBwk5<TY<<QU!x}mKube3}PEV*eM{k6^P9+myv-X_JDW>q(F*cU=Wxj
zp3WA-z>ugXp2lXwz@TX@o(i_dmxF;}S+RJkG6Q3#FKGHfNY{peVgGIM6tHv-L^?$g
zEN#QUu!cuG87$Mr!N6d$T0B`1d_b!W1B0uVcoJA<0YoNA4lEPHz`!9So(QsBcZGNY
zh|a4Qj|b6<YsKT(Ku+cPC?3nkz`(GKF@}L5(n352B)jLZcr=J+3K5TD>ttkLD7#ed
z3@Rhv*fKC2JKHk>%w}NB(g0r)*fRl?xFMGW_Dld>01de$uxElD=wfKlW$zN(ddgs$
z0>O98^_1B#FdQfc$3jmTXlvOUkV3v+JvlIipgU|2arNYY6@ny<1A8K1lAseF4{`NG
zSb<CdNqRo(0ncQ<VPMQU0I|XsbgN)F2Lr?0*dAYJP)h=0ogdh}AWgeCdmtWTV9Wwt
z3wVgD#~DeJGguP?C<wM6?Ex><00lv}dyfRv9og~_t0YW7?%)93Ez=|62(k)f{8EV?
z9?%tl<qVA3pqu=h7WMFeviBQ?7zT#M64h`}s5{xH1~A$%Ff`h!x-x=JdrQ-1U<hhd
z^#s*fRiLC9-LGl|mTBMs-J7mz#RCpkcLs*SW>phLux*Ulb0Lx@pb4{6pksqqNU7>F
zf>c7XP6aGqnt<|Uj#VEc14DDIsxHVUrx-!WTC7b~7g9zu*z+<l*t6>~Fy>f6b$@}4
z<W#_FDIHaP(5+56UJMNOdJGKqI?N1=IbjS8_I3;m_Mjo5oFoPYdw&K7dvA6I#+*C`
z2Kx*K2KzJy(Ba2H#i~*umm4rJ=74q~dj40Hl7q6FYgMH{Eg#UOd17s<QZ}Gc7JLD_
zstm}r2B6#`c%_1YVQy<LGY2E+eukJ{CeYQ^3~v}27;_E_<rgsYGJR79vAOb!8G4z1
z%P=tJoPabhdYOJJGBD<x1z)tL9L&eSuyP(B1B1{%P;>XV7*i!917j}e%2%GvVoa41
zpnMJLBd3ZnRceAbTqP+CVocQ%AXOlzEOC6!$iT2pSBxnb<RxhHPz^dy2DzLpk6E38
zL0(RbDH!B~Dh3AoN(Kh|Qj?<8LIyFWU_%DRJZ1(4`<V<3_7l|^7<Qf#V+s)iMIHl#
z{V4_p`vd9>45CxTm_k6iF<&z<*#Bl=u>Y*iz_9D57*nV!14FtS1A~J)1A~LC9N2kL
z5a%&CgfK8T1juC;B{PUI#efROQw$6aa~K#LCRIYBR^5hyG50EH%%GHk0VdYKz?ch~
z17n%UGlhi#a!?$DI_O*p(2y5oc@{YQiVq!QWMDA+D#qjsN{FDy5IiQvWXH(Bke<cJ
zz?kR6mB}E+<N!*Rw*(+T=OhCTI#3@>GF^-bywC}9{|CcVP_YZD62Ze%`HD~<avMW^
zc$|U3;jkRoGXgNrJYryQxCgpfR9=or5VTB5ih&`CL5xWVrr;+7gTwbg2F7}5Lu;xG
zXbmDyyBL!Q7c&E6eFy`CqYMLsqZEi!!NB0C!@%IE1>&?I%Oo%`INC5UID)Q>sm}p*
zdKefSq5E(drn)dNHi&}eW(*k_(?Q4cF&t-PVCetG#0ILrpx#r1oevDTtS`%1j1fF#
z4wbfpomTz=lt=R~s53BhEEQvX3p)B$iGjhfjDf*1&ji$*5@UR;1xkwy432Xc7#wFn
zywCUv>U|r2F~(m|?>p{bU~t?5ZQR)lFfb?ALfeJ*;LZ7<m@j4nj||l$i7|q2XFtWr
zz*xY=2`X;H81HE^Fx0*Qx8lSY?|};VQ!L=b%=iq{e5wM)<Mv)L#&bv>odP|ioB`Zh
zEBFhJGRDg=CtYM<a6AijGw9lqDk%nruDxQ6S78cXF)%njlSf3^ln1aexGAtOk`ZIP
z!NtH>@DdbJAq)&oj0_Bp|3RDz1_mcV1_md75T^xMCV_#$Ns)oUNggDV!@%HV#K7QW
z01b{QKOj*EUHZugi%6LC4F=|va8Se9kOAB~6pa*PJOuW$BLhQ-n;0W_=@~RC)nM%~
z(Djgvg*B;=5ZeLj&{r{Lxgo9?P=j5&!~kM}(mn%+7~@{hspz1)2Amuj7@X{(N8LLG
zFfcgzfqNwRrDBZWHAzqlV_>T_cYxAP;d5w&$9w@rIFu7BgUoS3=H!4lP@l%uFfi7F
zW>G*ZQbDPB`*cRov|f4^q{L7Ijb4Eq3Q5KO!eWed;BbIQPo4mhV_;weA5dT12#Na^
zXw*6-F)%pAf$s867Gng@j+|m(Z~{eH8F<)UjByS~<$neSr*;Mgr&e)9BA7e@bnH1#
zp%`Ne9|L32Q&1#=B7PbJgA?e2y?Rje!a1PmUB<xRv;?FKWd05Y1}D&Md-b3sagu?-
z={VHCllMR)o|&r@v~h=tV*+R&KSu+2;6C{V#9LEx;7JgCDFo=ab1}v_0t}4BCZH=Z
zUNJB@-C|&Hy1~xCocx`E!RZ|XgVP&m$WQ5DU{2o$Yfn%9019nr%Xo?kC|xly7Ds`a
z^bWSLqbwMvI6x(e!4mc=Fzr)fK-xjsPRCq~F&!!Br@@NP98e-CnGGpE8PlP~r!yl1
zgVS$Fe1Q6145t_voD~@uoI!il<>kZ}b0Ha;!P$a=!PyK_jxy$f;sd18lYzn6RUDCW
zr-7Hf^PCl91RWb$q6<o-!VC<~sSFIxpj*pQ6c`wsOBfiOi$E*T>nB3Oaasas@`&fI
z7-JD917k_AH3MV)B2XNyV_<M@Wnge_261*VFgQ<PU~mRq9aet~#(_rIv<yguWiUE`
z3R?%*Tpz<U4F<+44p7KMT^C~n58Xhs$5hyooCr|Jl$JmOAr|JfWeg0?pjl*4AjH7}
zVJ`!N^KNL#6c1B*fq}vK6ev+by)*R;*gM<B7(o|*mV)k<tY5^y;KIbf-~zgFrhXj*
zgNrBwgA2Gc+Qq=&;?BU};tKNPF&GEtEe5E!m^d0>2@slork;R#tZ0)MqdiiTPk@d@
zFw6jXtZV_a&aj8p87@%_3@%~NI>R1XXSkFxFt`-GU<B2pj4lwLNii^(%o1aCh42_$
zrZ6zL^vM;M6f=l1y1@iDGBCKT2OZ8VC&uUw4JMbP3=A%Z<r$chl_3#4;SMaLOt=Fn
z2^d(!7`>zz7|Q}c8O4-=!Q~1AgUcmQMsZ?baCywY;PMc3WIx=54{#G;tyUH>Mjw6#
z#<EE;6FxC8xO{+`;L6Cr;PM}qJti!Gg_Vl47^4tUSWScu*)djt!m5%{9a6ywfh#x$
z23Ii#23J04SP6kEItB(;Ck6&r8%S~iZ~Q;Sz~GwBz~Gt)4KeV*GDvVD1A}Y36a&K{
zDKSRy9grZwLktYA`=l5c*sqH*N`ZoL83TjsO9lql+t6T?h6baXIs=0n=*n4HQ!z&H
zEs&=e7~E_a7~D+2V<BRUvLNlJWEdD0onm0P9L&I=;w;X<G+hJ|>J!2Dzw+3KG0O5Y
zFjnw^Hk7C^Fu1icFu2ts%}h=7fgX{@FcCHb$HEn7fiyEU(Fb-t29gStnJI)gd}c}>
zQ7lYif%O$YEN}{75o0vuWnirEum)YA11cv#HyE8@U~oGI+8_g)X`7S*i}y*;)-$Lo
zR2F4mthfiAX>+^Iz~FWj$v=}aphsXZ!1bWbv`vB?2!*Ty#Xkt0aQ{H_-9#5qT7u@!
zNfDrO7c_zlnsNh`GF-RB7@3d~*i_gQ0(c^#iUX2t*ufFUz~J_Rfx!*5?hRDRaKPgI
zKLdl?Ur;HtS&Wers?uG6fx(>zsi>U_y2_V<XSx_8H!A~U<qS{|3NtXct1~dTtAaQR
z3=HmO3=Hlj$VKhc1>mx2xfml47XxGEFXW=u-JOBK9b63UVqkC&V_<L(ftE=S4%E+6
zSHR08P+7~wfhcUJW`M#5G)lAJu-FHrP?!L_5)Bdxy`UpZ<;1>1J?x&(z~G*0hg4p`
zZn0#T02;vqB^Va5AAAgqRrS!!?mm-&!F@V3v%9ZgU~pds&+HWpj8(lLM{F$=0}mBJ
z3;cfAg$heRdA;Vi8n^*=5#0V_U~u2bz~H`B0aO5j$9zvQFt}f3U~s>vkeHmzAa)(*
z*7pny?r#-x7{qRXV&)A4g9j4>gZm#%1_qg*VmCozrx+MK>=_t5ERlTFzXX;8KrE1l
z7+Az^b2Bhj2SR=1k;1^>kp%UTM==9~M<M7A57@O+{d-^;p??opI|BoY*nM6G#%fUc
z2Wl32G%+xEG(cnCV<H2CM?Z=ISKtPK+Sed6IK-Z?GB8$O2I&!IVDMPPz~Hd}#8F^i
z@Yu+};ISTL0IUe^zXRQp%g~P~#Gi39FxH5`yl{|#!DBzn3l|s|JkEjcsDXO{JV?tU
zBld!mfw9IDWD&^L`wR>ocR?JGt?w8ZJl-%^F)+f~1`}Ao306n!C1|e^s2=tB&%ogE
z7nCyBF)(-vGB9|;>QPSx1_n<#kjya#1_%e5W+(7K(rlIpXi3R`DH|0YM(zJEWO)An
z{|{Q20X-WEoR%3P7#I{P#12De5^bPuR|fF7eyy1r0|U=yvBPqZz82`H1W$c628L6q
zVu$siVh#)po^}c)`Na%kC%~I&7#KVQ7#KYL6jDly8N^P)#NrtkJYzu#b!U>;Hl*AV
z1M4b*PiU!Kh;)%y4EUZOj@e?nSs55>LHGQCqTVx~fx$Bu8it<D3=E!)&~ajhm=my;
zy8#0OXm0O@*iz7}WbJJZ28Qi!VoT*fopezK#@aJ%U|)bPm|yamL4XbH&-Hu|KZP?e
zv_298Z9srE`R$>{$S{Cw&N>|h(A{cc6QLQvb1DOa=R|0cY5xRNN<ujf93T$J*QHTn
znMl5#1PkatpzK-i49<%AF!R<kFnF%iWMGh+Ayx_#JHx=>c}kOk;XtxjHB9U_1B2&H
zX$Hpn%aBTN5~PO^Dwfa3z*zSilsKL+FnGRVVDNka;(TCW@chNV;Q0f@`NP2A#mB(l
z#ly_N2pU?0aJZo+9f72wOjaHS?n2O_OUy>uWFC;`pgx_f0pdX0^pi6nP4{|T&`=5d
z6a|LK4Ipt?bDlwqfx&*BSTZ<R7(uy!16)WYg9|BMa1bYhM&v*Ps&<@W$)J80XjCl8
zL@e17)Ya!;VAz`}mJB+nqzYu(qA6l=aMLbBOp61X#=*c~$0-&EG7V}%9LTgPhzW6E
z(?BLf-xZ65na}_l3zwG@iv*35gH+maibaA3PoXA6f|^Jm@x7U1k)Tn!Do{ip78Y{?
zn*a&OK3MVwuNQA()Bt<SNeX<s8H1N91A~{W8rX48pv9P{7#O_#85q30)j<0)#GG_M
z-eh3#%4T5jN>>AW*9kO+TE)QN)ycr%)eKHJ?$89`wT^+oYXuKz?nul7ECy{ZeMo0u
zI4m5*z`(=9z}Q%=$-t1hSPZ-~24v6$1_rNlc8C=}{Vwp*6LzcuhgbkF17l+<v>D=c
zpMk;aE>bh3-v!nT>4#}SYlig0PS9pRQi0M8L5RbfA<)#=uLDY4;Fbpm8v}zCqS@EC
z2h=C#{v+nW4{h;zePCeldV}P&zCEy|WPR|;1hvK2w}*ip8e0ezC{9D@ggXs1@6Y97
z#K^_Sz}OVW!oYCE)rgS?TycWujExvYz;ni;42(_I;AvhXMp0JSrobjYR3XUFEL;VH
zE(1eJpV2dr*+)1S80>!-Jp<j^bbzO<kiqDsECa*h!#rgL3`VcS85ow>Kw_EEcr{2D
z8))~d(Fd?gq8Jzsd^KWZ=E-C*0uPA2;VH>4VKDjyN}+E+gY-p{j23~1Z5bGw)p<e7
zB8(R4fF_3_wk|RUjl%MRtXkv`vWgevfW?L&2Y~X9kI`aK-dV=Rz~DU3XqhAf!{QS>
zpry=4t3c@wY{jx!MwKut*74?)<}nymg0`}NvJr=aQKcSe0+kIMfS|E(hAK7&hS|4`
zYNQw#o7b^1Fo=~J)qxEIi9ayv0gFSu>=nttuxu8@#_3>1RbVgA0Tt;wDMq!N@S*O-
zCzKf&CcigIVPs%z5#nHAnEk*gMH^%X#M`N$d#~&u-cB`vdpk`7?rqTJGK&vGyqzuu
znm2;@29z-wmVw6g3$_`lL%rH^o;SaM!AM;TGzt%Kxi;A4;CRyo#~U~{^&qhc8VWbk
zS72b!_yoGFaIukrA_IeFEKhMdgOQ;)17pj1HU@?hH;qidzT^Rof*RR?*r(VS7#RN=
z*@D<_*cccTtBvenY-d>`doWv+fwAQP8v}z*ijfW^NI(G;Z(`&DUYh{kGco@W17pj5
z@O(EDD0MG1H)P~tWMFKy0jF+5Mm}(w0;g_6Mlo3GZj}TlWkW`Bc<OG|K^20eZnz3i
z>JCpZJO(m*FF3#rkI8@n9Gr9wPk^mqV_>i;G(08Ez}UJM8rcyK7#PA6z-ii$krfn<
zhBv|C$i~31+tv`YV2|NH8v{ebLqpKXd0_U&?S^+iApjCze%bIJWI~;ffno6kcLoN@
z$%c?g3kJs4d!YC-4Aun27ic<PM7ED{4I2YvTfb0Q0Ye|-8qnN>4R`@XALAO(<enW@
zaw14(9oWGv3=AE!`WV-XfV8kMFgPvhW847SU1l<?k8vZ&9iXw}K+8VHji90WQ(T}6
z!TT6DiZd`UfMht0`WQEXl>KL6U^pAw$G916v?v2(TRjT{14#O#C`c^>C`duvU*e#E
z1J6Y)I%>hdu+yrK(E>dE%D~vp264HC5-16CGB7A<^f6k1YOpt)3=FZa`WP)WL8`bw
zo4WcKtwDAz<0>m;=wq~#0p)N=xHCMN1u_>L?tP5QxXOwc`WP#P85rBSLGwS05A!iF
z%===_z%cDkAEOu>17o`@#9lG5y+U9E#q2-^f?N#>3TaTPJH-GBX79Q_Mh=jsc!(y@
z9fV74K<jGV+57&ofa^cT_G(ZO)c02r<PlKvSu4}`0i<a@So{NMRvI+LXnMNugDzN$
z0Rw|yO5anM{@q}8PgP+0#k~72g7kj{i(driaSl)_>bnSP7yRc*Ghpb0jMwv|88Y-;
zhB(-OfkAgh-(FDo{%2t9PzUSY3r-kd9s5CXcM7ayKSYNv14B%CUnv^{W5+aJaB?Y?
z2PF{DT=lHJQrJXab8TNKxH-XFmRQ8lR|;C)`CpWQv7?j?9PKp_(?BBa5RqPfaKwYM
zF{e@AJcv9f*b1Ka$wD32$qBJiRu*9;sI|cWDteo1`(!~Y1gm(!R)SZEfUSH1u|Nf4
zB*@BN5D`lhEBzqypxDrS*5Ap-z}V>z3XlFyWl$)CDvJJ2dr+)%FfbIa>hE+1HNJVu
ziWvI4!HEY{lk4~QNHQ?Yw+5NA#k)TlWXgZA)?^*1)`E@wDQXOio&S0BOG_B~Q$hE-
z-r~*7W9Ux>h1f0dvWEUN(AXB}-nrsc{b`_<)Elr(8DN`uG8y_aK~eLDC$Ws7AKVZJ
z6_p12`ZGa8#vpc?PJbq->;tivU+&M6U|^VU2619G*on~0@Np#r!xnE)!k_=hfPtZP
zeZMy-wBIl=cBO$G?yU`SI4`Jx?)SC@?HdBS#24%mHU<XyEB$`5Ak}OP3`$b{{veAS
zcrsHM`U5~tJO!@I`U64iHy~@~b?7oMFt6%2Vq;+J+5on~2y6uh1B1c7ej`xJ^A^|&
z6POjtFZY{*j5Py!+)M~`k|!u-DDn3z!`%7=Y>=`p$gL2EsDgAjfMVLIUkzfrG6O^E
zzM^PG2F7kV-m)TwqG%~luIB}n7e&#aWhbD}U#49YZO_1vT+5TmP?QBKMBadGJ9)bB
z0@SwdnV|kxMBxPu(CR5R1_sR~g_l$q7`tb(fo9<g!5Iw{@Fueg!Hd;E?D=wqmqAPA
zKy0BWg;$gq7`x|z=fMlFa)Z)7BtjU2H5eF9o}R~;T2#bP$OtY8r>x>*V3?b)%)oG5
zy>K=!17nXWD3vTJob3s+l!Jjm=t<!mcc_8<_X_8UGcf3@u`w{5-c>kX5u_eu(X7G+
zpq*E@*ccd0rWG!PvBgdoE&_$m|M_4$&oHquFf8FJJfOzF*rNq;6vL_lklmo@o9hm8
z%W`D~28C^fEg-ing}9}~1L2ldH>g`q?<;JF*>5tdumfi2n!>_PFdJO)7j}W!AUD1#
z?B)dZB_M8@&IqxeF>y7>J_cn52C*H5>AVb#z5Ebc(?PxlMTgLn!VFiat^D^2vtYKK
z-c^_lW1Gw>%z@b?cDgVZ$=3}qn|kFzcEHx$_R53ukbx9v&22BgG6REWR-pyR`h^hd
zEnE<uwseA8@A<#bS_HKE0TcoI3T<H4YriS91;;cvOBBLeHDV2g_F!j0Je>@8%0`fV
zRSXO>UKS?8U9=JGB5|;b7V0uEM28gWurV<9F+$RzAvoGZ85nyXfZIofM(}1#FQ_G^
zlL8X~6}1Q+sPVj8xlo=Flv)@V`%EB79JJj<6twC_=t-f15y*o)nGA(Wppbh5YE;cR
zIDzp$BLibUGYe?(-vlN$aEl}WJgm*=70JTDaO~RzCSH&RP>WzY>jWlVaBG>XkYNH7
zA6PY40f@;DS~UnB9G}3%4;E)(U|2Y30+RwrGw6Wch|d$4RA3z8FB6y`+ts-;8744k
zfW^78KumCNK$L;8?+FV7L!j;iCeSgJ45z@2j0smJFqwgidQjyJlC%IfT^JZZ%XnrN
z6vTp-??fm}6ay{NnJ|Zqf#LAaiE?rbj1%TSe8uo_B^v`nHp@h9kd>!+KnuwxYJ=L(
zr+8A6D;OqfgF4utX6$bBiQ1qY1R%DA@kGd4c{T=y{kjt^LFEdlXW)2pqKzm6<AjAg
zptE=<+8BV@nG6$cL8gNW3mL<So-npI|3n{<>Sa7hrNs;reY6-DCxALD`tB3MVQMDN
znwS7HeXHigL<t7Q39H!{7zB$ZW`o!p*ccc@Jtt<HF)&Wpzyn&uJP|y52(l}5+r(VZ
zGRBQOpsv%zd~l-}<lE&FyI|&b$xPe^WAmMvxJRCWq2~t3QGwtDHxV>@2stWdLN!lP
zN*cq&LQr@w<0;6@W0+V1V!z?ZEGlG}SPEu?4waeEi=r2jG+`!zik)6RJ_d$9Q4moF
zB0!C_ej!~3hMbA{9c&DY6F%@{GUUVEm|>mY4T`c4Yzz#pg84n-42%=L3h<;d<WG_Y
zF~P;^91cDP29I`K1_nF%{AxA^#)+D23=A38`L!^u-sSmqJRot9;q_oogB&Axz=naL
z=43v2o!-PI9?-JF{1lKhBsJuxfU+|rHROZF_!v&{q^49b<fnjYbx>;1nV6p{!N3ru
z2QoMfw1~(6G+c9RNq!7C@iH<nPP_+RkCz_<8svGy3p#BmKL#`icmNbS5&QGOLqi5^
z3=A{m!0eM<Yzz!V5OFYjAsbYjfdRD8#WCL;w61WH2^#}Lpk=-#)V+xn4Edmz5Xg;5
zAT}uep>DSX=TwN>EkT2gAh&08<y&zvFitW77fBBp7$>=aizFUU@!WkiUz?YKaZ)sI
z2}8cN2`FMf#RONAIU^Gz1LLGJ76t}28FNMsknPJr?oyC3e*?;DlR#OmmBaiaEX_HX
znSWFSb=^UYDXtRpb8HNZlg@H5Fq~XyeohJ0_~Kw-u>E3wP7lOp1C0ThUj!L@3gnQ*
z-_1d{txf`!c~g&=uasb5ob-vOI5(HUd=;1tipbgS$_xzae9ikA85k$aurV-9Jz_oy
zEDKRN8O#RVhh1i9ZV$QBm~nXkX#5>?hy-Y?bMo@^<YESMdr-S;8Dkbta&8KPxidKb
zLCkOgo553*TE<`wnT~}PBTr_DGB8eVV`E@2&^HfP0J#s86(-LB^_MfvlLQ$U#2<mj
za_425mkKg4M6oe|!cuv%2+KE+gU_=tFnBE%VdVmua~@JtGJuB0lqZ8cH~o$o14Gst
z5thB6G2<zq)6~5di?Hl9Vqlzno(oidh_Ji>g%@b)|C9jG`6GoQEJvgn7^ZJwVPG)G
z5@9)_0_D^m7GXIL%B`S|+@3ZOmJ2Y>DG?Eti!jav4H1@0U=FyfJsT^+@(RR#1Ky!3
zeMy96Ido+HDRgd#X%8q6XH=_$y~48G1mrjd25(*l25)wgA_ftb<^BweGpZRFybT!`
zytU=>7(`fBN-!`8#4<2=2Qe^s2S|b1Um`54<QN!dG%zrDr!X*hCj>DtNcu1^PI)H<
z8YB>5Sq-TL8N6#57`&@Ny9Fg<7#L?bfETHVu&e>O@;?KE_hbeJ?{0Ah#u=@U5wvFv
zpv7g9RU$0gIT;wIpJHZUoB>j^i-Ey=3y8CTfdO=&syFD6ycug57<`x*7`*?mGceBB
z#lYaB%D~_wFV4WY8FEb=!*lRxqU0nImR?Q<#%ZAQ@-~Cig)uPr1Tix(Za&7q;8V=N
z;FAmDTw-AGnZ&^0(+A?*V_@)E&A{NZoSlJj^D71hpF<1`J_n>37&m{1IQ6*;XtqUi
zkw_Fj1LHJnW(LMB91ILTml+s*&Vx823=BRW7#MtB$ucl*QP4xuxCS=A^?VI9X$y$>
zfX30ch%hkt@-i^^a)S)uU|{f-Wnl1?W(OI-z~HOPz~HM5J2!*jc?JX1m(7q7a?lkZ
zwG6Ng@C?rk7??gJF)&W6VPwn#-)fM_=)=gE!CK3}`2)T}=9v!z(<c)K#%Z9V-yo`(
zIKV4-Di9`RKutP^Fv%BWQW=U#El`ud2LOVOo6BV4FakLW$)pt!HPc1lCNXg+FfwLv
z)G~0sP~rRmJ9D1l*%7Ep@M(8Y)099e%g|N6fU3+uGE)Vl65Y(_EKrr;t^ZIn)j%rI
z&3vu^3RVWj>3fjO1YIrza_0#Z&KIh%$<yZ@V3qO=%n6Vyc^RHhfKB^7hfUCkh_LM7
zWMG^j$;`l<V8XxvT1xHf$j-o=V8_7V8^XZg8wBEbF);WhGcfoj!Umh4t^i$H%)mIq
z2zFyJbf)C#5eCK#4(KKbhUc&YJ{cGoXJn&gKHnk+2Hyg3(V&xp$di1aLIy;5n=vpb
z&JbZ~0o4aHPJs5BE)ih?-IYG0ffF=tAi~lD+RFBy3)HL-VF6EAEn{I|(3cQlnFK1z
z{)49R1;2{0fR|B0*Y1KkOQ3Yk2wuE5^Pvf(>`S+Xlr_HX3=F=Yt@rz5L|8H<Af=7(
zMg|7owNeZWA;&~mvS5N|7#Mty$rYF8GKjDgLhNJkeZ|1w`wVnPb(;uF5meBRoq@sk
zKXm#?)r5g@ff@tjOweTjh!YkVRDGc0Euff%pRmB7TEM_Kzlecx<{XeX{3H?v)eflo
zEokC9pz6<n#LM6rQuP8zJyZ;|V{cWf2#Xi2eKAW~2oernR-kZTVPGh&5Mc=idzA~~
z#R!ORR2UeNEJc`)z;w=D$q6p4nU5HQbb<#^MVL>5>unYW29`S_%%A}|@RqV!>ENML
z5$02n0$7xRan^1~<->eV60ALwL4^4VsQi5cYLTCf6=A*!YLSB){5v;`FoT9f89<!o
zS`p@3AQ?~{q`5?d`Jo!5#0Qyq4%3>4s6ql<#S9|M@4$AlFfg1tEyDZ}#sOLS9qa^1
z%3}Tj;($`tNh1;FpCFG{u`n>S%8M|Ary4+<j$9GuKOkjbXN$FoF#m%&uDMo(1-y3o
zKQtiKVKTdJiLhvZI3N%0+$_Rk3gc)l5n-_adk7Q?I)NfAEZ~t*P!Fa|goPEv`439P
zDhv$krid`F133z`K7RIN@EEQL^Ey*dV~LZ2K{-=|c|B<SayLk`r3mvzaB~Ed0y<Jf
zn0sM5=LADi0CO+6*5zbi0Qt5TGyntgpty<%b3a%o$VEbmBFvLO-UWrqQ8y9hDIjA&
z>Wq9vn5V%w8S_P$7lM_6m$k0GBEnqE2#O|19kn02j+RjdRPE3G4athk#hRd$z`)>V
z$iU#IZ360(h%gsBg8ak4;1|Kb;1^($lvu<d!dxN?YV0vE__Z)F_|>U{hFe6KOVk(`
z82&Rb_^oDO@LR0TzyOMk67aw$1B2g91_r;2>Y(vw5#|!ehExWBRt5&Y|DdJ$n?;yQ
zTp?!qYcVkRgKkLzC9X1PbHd-Bfx+KX2GXDH-N?YO`ic|-Lz%V+bF(A^gFq4kgMTpt
zgMY4EK|UybwZODZU|{g?fv!;B4?AO*fq`*u1Ef%7ZiQqB2LCk-4E`%XH{!-aEAsu|
zwH5*oMVLET85rjt29?w-3=IB<7#REyfH-^%4E~oH82rzJN@~!ZE3X(B{9nLI>ir!I
z%yC5wjB{^;vOb3e19aAL{|eBlxF9j`VJYClY?(MLz)iEnV<OCn(59IR^i~Z9@T$}K
zMX3x7jd3E(iH@L>kul4pB%eWqISI^TVDSIPz~KJ_)GA{Jb#6edvH&>-h5#8U1_l>q
z5#|(GNFW6mGB5;yI?150O@#(hfIkC60H_hiJe`4Y-b`q~q(K8FAf16BAQ@J%sDJ|n
zlmQqR=N&;;TF1Z;Py=c`&$|xI^-xogDnk|6ExrsYuzNcNM3{3p85rlQfkM@Ufgzxm
zfgzw96smR%3;}Z(7y@R2I9?140jn7p0#-7(F)+hoNd>;7Mg_K{MnZ%+mlI?Z3j;&I
zE(V5x9Uu<q)~1sT3<1YMMoBR+1l(X?2)G8$9y4ExFo%J%&VNYuP=ReI052X{pcV>B
z@?m<AfQQsO%+NxaA>btgL%>r=<Ci%S8lr&=3=9GPf*2T>+Zh<=zlH`=6f{Hw`571j
zdEp@nzZjN*ae)}RQbh)aKv`H-%?vZak%2)iSA^LI+0C$vG(<pIdcjVxn|%x*ZiYI~
z59T~828KWjXs%F!X=GtwTrdr4zdy{W-V6+Zo}d_Auo4=hP$^Jhq?01T4CR7KwViWB
zn9V^>0+ojg9fUxkW^N5~0kmkefEA6Pg5CnugaDPlTq{MGAybZ^gCdrQFuQ=ADaydO
zP!?*ZE5tb<A<({kkiAeLm@}YU(5V46KSY>$K~0xM>`;4oRY66V5Txkh1@}`q85kP<
zM40)+85lOK=44<v0pch#FfIZuE1VD`!px@+lHtlv0~IHbT`|x~Nf1;WFXPJ3NnsFS
zhHQsnVPF8&k-{Juke5LI69x?@fH+AeBFrKnng8Hh)kK)V!{GlxE)O^>!mJ4@ra@zJ
z+9@K;+F%ZNScKuf83Th~kO<QcuwP7B7#QY15MlZSt_oNf7(D)oF#QH|Kxg?_HHa`R
zh4hRWKpX!+Ig|-}B;3+ENa@bB6g=$Bzz`V6zz`Ur4l!Y=3TT*@fg!M!fg!L~4&0z)
zS`KpU8wQ5Jtqcr-tECti!q<o}tpEuwV_*n;$iNVI7t(oVG+rIVz`*vKfpN)fDF%jJ
zOd?EsKnb9Vfg$h*14H09DFz0EpCU})HcJ%)Ll8FuLlCPJ14F8n2orc+AxKb{fgwme
zh=GA!h=Fl2s9c^aEy8pi)RPCvhA=P$dB}n0xI~z4zyw<u7=jw03D_HUj&}e9<6=--
zcdoby(``^ieTso0XchxQ&<tqN>pcZ>GJY0Q83Vj|=54~jxU>#b9)ko~Ativ93j@=e
zYzD@~pcCN1w+?19TER+ouLK6BS1TD97w>}T0_|RbogK&E)d1-kEe4%{4b|y^+U4<@
z0o4yW01v9f6K?nki2fzA2*W)=`VkFKuLltQORNw|ykPph8KC-Okt9L-IsU_yNH8!i
zGG$;~QVmi9>GV`0!XpM`07wROR(K|(7f5q4q7&&E!NBx_hk<d)PLLXiZbWy^vjQr6
z9jojGNU$ye9s9;s%)kX+IfxXro*zJ#GcYcdXJpJmQUDGCgb%!UpvqiPm4Vy}KYyOV
zO9kSVrO6<-fNNXO3FolHPy&(#$$;;L1<8PVEwj#wFx7B_CVL?%!40~_fsqGPt}dHy
z0?8sZpko}CF)#$JWnc(e4ysP(i7<iJlYj)zFfat2f~MIXNFHSfy3N24bQ79p-C^su
zR2UeSf!3#6B#JOWnsN*bL9ZAXf?hzK>AnUO*&t^^g1VRq-U)Ym013@yPH<_2=iL>c
zlJN*hBUlP>FJWMM>B+#jtO+4$35{o%y;BhOGJuLzNiz|qT+k5KvKNr91`}jhT9kot
z*-=P2%>>$e0vU5&b^}!iRNCpJh`>~U4nAnr5Mgoz?Z*Y3A+a1(12or)FgcomHl}hi
zFw~fcFgb#Tr$7h)h%kXSRDj#~oJJx{-k`F~fD5$hO@zru7&LDOcBEyE2$KcKk;_xT
z2XlxpSwPNA0gc;=Fj+W)Rhls{EO{)#qytvi2UVy8uAIQf+=?*iIDi#8GB6ar6k$>Y
zm1)pktO{su9aOr4o6ajjLO~<+B221aYZ$XaL8I#;Ose*vwk%_&9Jp`C1UljfbhJ&-
zZw7{-?^2+1;YFZRB@7I~stgRlisB5+iNcU1rvh4@$G}`J!lcg6z_>z*nSnVGbg;NT
z14FPcsO^*R6|N9+F*^f93&>d_Od0|p4Qvby!SM_X!Li_QIo%_|#0&E7idv|5c|mKD
z?4aJ|wFi4wl7YeSvIrw+N%V^SLg0kXcwYsyA_=@oM1&E13>2u}$30tw5qwP|sN$M`
zRfO>|sCEEfWyv~GgmDANs+9tebi%j^+$9xdU|jJQk|-Fr!0Yps45&iTbOKWWN_bOd
zh%l}I8<+?+a23qJm7r@iby7qaq2r3842&xSp$0;QU<N|DAOn>HL>MQ54V(^XATUk>
z$33KeXPg1@$}%o+L^93<ao#ZWGBPj($B8gjvqdv71pF6aROf|6K@F%zVqjokoB%2w
zR{w`|ni$m$KrIdihTvibhTvTAai1cL>Y(FM4lpnTPh(&Ro&*}yI48oW37#WnU<ls8
zz!1ESg@M6jp$MZE$kzXm-VVd<4<IXp7#O%r85mbxg$$K4>OodbFa(1P+$Yb#90$2J
zg`uVbw#>2ywpd?Agi%k7fpJwIGXry+J_AGWc?O2yvmlN&14Hmb28Q7K&|F{B!N8b3
z7qpa?3*<5A#^stl42-Kl+ms<kEQ4xKXgyhTfq^+Aih*&}0Z>7L81txk0~!MZ4MKAK
zVSu%CYhgPWQWzLlFN696R00Ts{P2l^A^3wl19R*tNXXVI!2AK%Cn3V<D8|6JI)<5n
zIrcUKLkK8V{)0Hr85lsPc7+H+{ZVTG@dv1;2l>XqK?PoH)`l=J`Tk&FTwMurAE=Vc
zV1$>9wHXi(tp;5K4LTMNW?%!{LoslZYHS#od?qq5u0D!%#zq3{$W4Zt7|1o}t6w5Z
zD}b5{2C&{>Edyu^BO_xL^F+`Z)My5V(+nbv3eeQ$3tJ!#-t)0$H8gc87(!B4hzbKk
zhypZqDcFGXFhhtv14D>)AOqu?)sTSnJpo$G%HAx(sKUz3z_?~714Bpz14Bp{G!A|L
zfV{@QxTXsfhmdNL1AZ&6p9rX`MUnyCb`9FX3d%`g?IMgqpq#YkIJCGB0xgnR25ONW
zSR=y73H1kPz#CLJF@TpVuYF+xE;JcA!KYp^Foa|=FodK*{lRGk^+y{6Lr7B~1LN8k
z5P$f50Q)0Tgpmj2kF{SJ7(x~>Foev5`9lKaQU=Dg;UL#SYD*5#aXgHcuzJte1>)7U
zwMa@p9%3nGFjR!AN`M-KJOJJR-h~cV(gHQ;IFdmVKm*{#e;5rFVX^DG0Av!9l1m^{
zKucSV7#QRdMSg?AZXFXZxTyUNnqgc9+B%VWQsgT%<T7B@4S3LW-ChlF$bAJ(K-w`d
zgluA92wA5AuH3%bLc{GW14GD3E5u|+2KZc2PHmANpkM>dbA-HLU<i2vn$0-Iz!1vF
zzz_o3;l24114F1F14AfiFUaP5Fd67P2k1D2P-SRt$Z!C8AC!<mfyc`6-(3YX*&e~b
zpkyoZ9_sWS*jP8%>FX;YPJgclNxPxu3=E;h5U0Plgg8Akh=C#056S606F_q*+?z!{
z!JHnN%fJwt33GZI14Ah2jyJH=r!g>uf;KFJoeq|PIeiraL+A>q(|cARJDp9ip<zM`
zsGN*oU?{Q?c>#61Bh2jqpkjT46vXW>py@Sq4+BH!4v5=dK$C0ebq0pe%L?F_d<81L
zmoYGeeqdk-eFsgRj$0s84eLQ|UuZ!Jx=lTUnX3Wb_;x%4QUppc(0u3wzBmrF8#RJ~
zVXB+REvN%k6u|k3fq@0=z|eGXy0`^S7mQiy;1qESoFW)AK}pJDwa9j;)=20sK*kjy
zt($5zz~g+|!BrpwLl_eSL+C$<-?l?qK@4GX3=CmX5Wnq&`Yp_Yfg#LHA(KI57f9p{
z14Eb(14Edb0%%Er$S!b;iGd+3kAWd9M~Q(UD@$ZI2Ll7Y1JgtfI|jy0HIO_V<pax6
zQLufJIU<)>85lR#S~D<i>V$?}Q~@Z`7#KI2A_Wa7>9Ld|<=dzpP;O&j+!%?Z$_3P{
z<!FHA$fyk<laS;;fHJLMW5e+>1_nD&#Q=5K4%n1U6tn}tpdfMu<goY53`~Bk3=Cm)
z3=Cm4AdVmdL)at+hOh}Bjw}O1*b)YYutl;AOn#am!W5eFqAoBn=RN?{MqCb{dx{y2
z;1x;a8;Hv{2_swvD!?+3s@f<Hs2X!5H5?${A*L*%bQqXZr!X*X0v-L!Ud1ql5prfO
zGZ)JRcnG+F)G#t;u}|bglD`Pv+LS(91iZCr(=<q#v=maDM=&s$W{XUMCZHf#+5?X-
zY|evZj!EDaFatx_4hDv>O^^gM3DVwX2)o6=5OxieSf;=d%MS*IuuqW00`B*`VPF6q
zb{j4MNi0)gi3OShg62SczgZJhX(NuS4FVn7I)#C8voFX;<yd_jbOV=<!x<Qo@<g)0
zi4_v>Dxjqypsd9K${d^5Lh@A>*l&zk>EK3T7PN5>+6&fvR3rj4KC}5dc)7nwgf^&n
z;{^{jMS%K<pv9w{Mj{d5rMDd5aiR#wlGS|B&{7mAJWhcYorG->0gvZ_P6^qf3o*?{
z9b_5@14I975g*V%I%sjw*;tWaNS{)dfni#w+$u%}#w|T;3=BsP%58uwY|AJrV330>
z3<s@Jk@k|?2Od~rV_<MuEVmD2(kW2}#w|74pndFe`@|R+7#}hSXfrUFosrvT4(5SZ
ztIT;RHyz}?Euhs+YBF-*6^h{XA`yCWWnh_S;KfC9kYza_+u9DxHNtFL6d>0GVnekz
zL8>@Vfn+{Q&JQ|X<qtb#1AIWsHhm3HAu8twTIjNjfgxO%fgxO7je&vLS<Vln{}cm5
zcmM-KxQ`M8ga1vr5K#t(X?08!ITQ*Ka~b47>#u~A7#PCy7#PAcPB1bsG%-Q~8N^;X
zFACJ3Ii--vAO}8t0F>-jGcbfNhIY&YV56Y|42)YBD}YYilS>5o0A%YW28Qr+3?~^G
znA0vnl8gThPzA+4Q!bDdnot8IKx0e{j9YIYvMC~i23SC4zaeDdXTviDKwA~tz;oe{
z8UWFz4w!>lbb+ouj$mNWSSn`&3rLvb!Dp>*mxctS4J;tPFffF_g9M}vG$11+85kl2
z!TS#7APXTG7$WQ$7$U5p;o%Re8$tQOfPrz_BOcJ~iku5LJlGf*0@~$V1sE8&>#Tt}
zV1+Q`G7$zp4F?Am_})<H-7KI<S6F%Pp930SU|`(NfCvf1mOlRz42;`Brz=A%%2Eaf
zh6YBERiMS$%Rs~_20jMH?b4tSSS%+Gb$}nVxx}ad%Dy`uKtezsRA4P*V2DU&V2Fr?
zgn+yzc*6rjL>mJ`L=z+_DWN7M(6UBQQi@o@zz{JHlw=^Q8yOfP9y2gR+}31ZNIxZ~
z3(CQ77#Jcs7#JeiL>U;jUxMT+@af(UVVxg;(4GNMKyolJZvO&NVJ-yDX|SLM6+<8u
z3=E7r#2|Um0-{2cfpLchM2`jNAjgNWQ1k;|0Ls9)19Si&G^`M*&94QL+IFNM!Wfa-
z{O*9#69eN8@E{O8wL#Od-w&uPxDgDIg<sCX;I9I@MFXi@^ZFGdBjnbEkMBQ$I2q8C
z!1VehBuOy6ekB7w4~hS~Fw+c>UqRCZJMF=jj|nr)l4W3+x}AlA;ZTn-(`*R_hH2(3
z3=9ryg_*!7*MP<unrnrb=77g_Sr{0y{|GaIPXRr}mB}E?G#AueJq22q)h;f~l*h)v
zxU&(estOcAr?^rXgqdo=Ocn-)oH}8qUJz#)XnX)<WxWi@O7L`$UZgNnFxY{ROr8ik
zf8Yx!QSFkJE6z-35N3)3FOFqkh?HSqh?J58xgr{5Bq%LdGcZIN7iFd}2s1$zBr;9p
zfCg;h1O~?a4GfGsKSLq~wrnKv1n87;Xj>tPhk<dQJxBrQ63a|bM-<fGT5?&KNeEQx
z?wY~Ez_2)0m<fD*1!zQOf{!p0c(Vm)%3*tiFq1kL1B1RcS8`qngD_;QX&E@Az+(#_
zMJBU^nY6&(6lGxC)xibYS|H4%1IpaXz%x!qcL_6DDl;%l{Qw?A(t9V&_!?~aZ59Rw
z#k<0c-$334#f)}}FcWCvgaJIOp}9nu@uwmvIzbjP{sNi!hJnF?fx&EpFym=P(0~#H
z<8DqC28P1z!i;A@rhwz2cY!b?c-`7E28R8N3=F&e2{RrAyU>Dx;lOlZ#$7PIptAe)
zK4HdP8lV;SkW|CCM}~oMcRXa&gb}o>>%eqS?CPWlGalq+VBDPoo>!R)TDYpO7|p<-
z?jy{&5?XLn!Y+ci0E**1E$R#m+arV-K}*~~XZeHL%#lf;li=10Gp+=$dSqaT>|tPt
zY*S}om>?m{xDq_A#J~`_k%1v{HF!o`m~ka&o*k4Pt}!q~UI3k9(j&~c8thC4hRE*>
z43S@<&h?Z6xksFV$#)|p(N!6MY8EaYVa9E&42*l!nHiXT_c1U;u`@74vBI){<pIbX
z^B!<g;aC6{e*&6gW?<Zt1WH2S%nO}oUI1$bRxv=Xp3h<`23?j48h!w^B|*nCSuijh
z3lwIY4GQcx42*lO3l$e7GYB)zmIigxI2jl~AwSy)6!M%53?{RL8E1nQE1Uu!W+u!y
z8&nHHPgG$9?W8;w2#Wh1pM)7f!)Od|7#R1;LXGTI0vRckom$Bt%-9Rs`mqdZWG|@k
z1T(T1G!A?UG(7M6Oqda}?GqAAX|RFxIiPsk`#~Mzx=J;W>lhfKWEdEtL`+hOOBjS1
zD?z=Z0}KpNZVU`jcIpfa8E1tVD?v*UPBAb<6)-SFWk92-78*rSvl$qoriwB!?p+QZ
zRTO5dgCrzqUQW9M%BBpAdqKlrpdf^0=5!8FCWkJ~N|#|^+}8xn+35xhjQcLb2Ye(M
z7~J}W88a9`1_>pVrZEUJW`K7s3Z;UWpc9!Pr^E>}W`M?p-#`-#D1E#2gVMLkS7F9%
zP#!x4&ZeS#!i>?NY`U)rYF;!r-oWNXgIYf@^T1nez(eXFBjON7OyCy=tqWve+&2#z
zr=THrhBpk73=C;J!i;tx*ItI2ZYKtgLU8H9Xa^bwfH^TT8l)UlZiRmo2Bkj+#(jUF
zx(q~-bQyqJC~rW6Mh3#djB?N{84o*_7JOIR{swgh2J>oRMmg|~Wd;UNzbtBtI_P*~
zVMfsL+n{r|qOLM9M4eY>U;z0@4m6bjirQ}s3{js{85qJ!gc%jY7#NJSnI>{T<0Aod
z!N_A!eDwXO124ju(<jU*0d<2isOJr;lc#`^*MX8yQ2a=M>Y!zeS%D19sgPTR8I-}r
z2eY#<qZH_fxztk(4AH_24AH#I49uz57#O0>85p8<r5Ttr${^`h`3T5V=5X%+W(<r6
zG?^KgGujy#qH`G-qO+|Sm@{X?l`%0eFo!dm^Dr|oXRcvjh^}W~h^}Q|2t+dL4`^{L
zb2>L8y9Ugli3|+U{m2IW0S%rprz07(fPo=;9>^6o3=Cy9!Y4s#=D<wo#I9E)s44H|
zAp8=PEZ%@Shw6;N2SEc?2R5@YFvu(vJ`5_j|AUrg?_VQ44;o@g&}G@oCqN-~q%nwr
z0dyzz!8C=UVg})LAk#pBvzdV*dMz{;CC_1CdS1@Jc#suTT5*`bO0ncEP;u~7D2FLr
z{0>wcJQ~1Z02luP6$kYNnK%q#MO_*Xs9z7dsspr&6*P7!&A@o15fZ{l0ibf0W1sK>
zRtCmH((DY3NBS5TqAxKpL|>3)U_3GdB(jKsA^IT$L-c(RXDtIm^alopXxP9`QVV3J
z?cfQh6`6=xxTG~uInWW%j0T_)Gx$(*(h-Q<Ax4-!CJr5#o0GtEdk6_V(C7r?QRs2d
z$vUv31wi{5L2<|sAiNOdf%ohTj7K#X7^43(Fhu`VWMDjM!aVT_1Bl_kJn;dT;ln)f
z1eg)QG?7CZbcQn|D3Wy;xEUBYZV20fOghWVz?gA^fgy&Ufgy$$#CgKN5TnSz5Cb~r
zG2;URLyRc{LyR#<<_`lyj5`BEj4Lw(V<ra!Lrf$CLrgf#FUc_s%wFInz~IIV?40WO
z2Mi3-42(M-Ky9yKU}a$7cqhDui-GY7ry>L6j!#gB?)c9%k%OIqaVHN0LrgIPLrf-!
zBgw!Jvw?vjW`!aH<4!e@=Rl&y3=A=k85m-&Lkr*J7En_Vn$l7<K*cNr<6+RHHy|CL
z2m#G4Gr|*HN&u*QW?(!#gOM?d3G84d4hL8gODSMr_BLi<JPf|=YoY+G(fi>8Q#@!S
ziO~{P1Eeef)c{a?Q+=R@zGGy}Vww1YfemD_2TW~h0Vsh&9h^D^#9`0_k&uu{Wr3Z7
zkqYZXhzRdt1&ubbGBCu7Gcd%8f;fT<46)h_46&LZjw}O1tStjWtTku|3S}HBRRl5)
zmBq^Q{|^HLXh6!r4zxNNG#~{U(-8YFTnWnOM|Sd*F$gz-a``fz6b9i|2&=e^LAVXd
zOkogi2QxwXQu&1=LHdqLgSX-cM+<?rh=Mm}2}gtWqTd2<%o2_Uot<(Eyq!fjS`n-!
zx44KwI2yEm5VS2ab+K?3$kbCjz8+N!!UbS9$Oev9VN0+LsSq2ik!-L=vcVe325Ybl
zpv_ZU!ZutCpbayiL%L5!3PWyGVQyq(VCdW^3~36RGcZ`*5@KRtWMDixTL{$M6=Gr#
z0@YOv6$}iK2||oN7*!Y;TILHet^v1?7#SFkfv)1Vkq}~B2cFAgVPNns6=GZu=5VDJ
zFbFYjkY`{JnZ{LOz#zo9Q5veFC`<^lD<8C!)9{@T<0jDl9T2CXO^9(bc>g8Hta2g7
z&BCBnI!HBt%Y0DHzqwn85xgB_8MtMe*QCP0pm|V;u^xOvHOOW6IYHY2g&6B4L0;fw
zU|19&#MmGY+Aj-Q^b{e)*Z{t2jgx_4&vYTi1`m)77s$y?U}u8&0SYlTgS$GQ(+8Fd
zF@nz=1#MP2wuc3@@KcDf3$h_sl!5UWXfsT6tq@~3L<r<c5Vse?1@+IOvxFG!85tOl
zD|3}3<uC{_I!c2$Aj5@)7@a_I4Q`V}7YQ-C3WEF%>LGFqF}evbFzCsEeVVUh&%iL}
zst}_($e;{JJTa<+*8zZCudTqqAezR)z;Luvh|vVhfrK8zhb17Lpu13brwcLif<p?D
z&6HrnP~dU#6Wpl`40CP?G4g7FjAG1EXJ9DP5n|*84Fw)xV2BN5V2JgWf&{N1c-W1B
zA-0@>AvPC$k(Uso5L6J<u!`f9%Sb6=5Ml&f8GM49fgw(nfgw(D9U}t+voTakT$6zj
zEM?2U06IE|kAWc%w6|l{bfNc*42&oI*cce}8ihV8LD@5=3w;5F7HBh=)oP)yV736*
z`wY;@VLk?i^!LgP3<A+YPe4XgfR8^CdSb%Bc%lM)ZoAMEP}98%v{5O2fi43>-UFf2
zAeGZVJGPC4z#F;#gZ5pkJrUXpO7N!`7*FhnxMVxbCA#fGyFl#yAY*d$d>9zmI)%EB
zgZ2Wrj$&W{kE))G109o|%_Y<YYDk@8%wl6;n4m1wuf)K3GLDUbfz?@P0*IX~%D{Ni
z9DMGO&~&hmcrqD;W`LRyZv=S2iD!;F1LMgI1_l9$s-<vM%aB#AfT{vHFY5yz14DK{
z9|J>Ht^otXf;&Pr?4Z2Cz<BZy8#p%WKnwQ_AO_Y$*x+)Y0n7%uX|py11IKTnI%x*j
zu&L}9Ay5`$e8|9{%fN6bPAHp^f$<arFIZzXxP{CHYN-l=590!j;vVf3Dgq}ENV;SM
zHI@&>G1xLNY;zC-O>BeuNvG@~CWL@{1RUVp76LkH;}%Z=gHV_(1A|B<#N0@5?1L=l
z7ZlP5Sw0z}RUdp?2uQi10t4fz$q?lhVCA6U;CDjc9f+U-+M}I9PGB_<CxK7H<QD`5
zTF(t#1_mV)AxV(IS0DyU3V?zQWU#aZ1B38W&;WF&kP4EY82*%lbb)pkt}n~B2emIx
z8}sBQWin(t$}ljVHs;A>$o2)f<PA@5ehNdjp8^BpX$xozG%_000?jy{9RL!wWn*Ai
z7nL2z3n~!6yVbLUKv8@OTpn~?<YQpyaRL!71`G`19+TQ31rFocgS=(M43pZG85qwV
z1RdsoWKxF|1LN6a91IM~`ja}e7#LdKaxgG#OPSPR$-sCPbe#ov!=z5|{pTDE43@tq
zb*e(uWZ#?AX$n%qQ@}8(n~Q;=HJ*)uK{a$z4<|?k8w0~6`$@eV3=Azt*cccV6iw>m
zVqj=_2s)*we^Nh~&6AVNFlhoiXmJpzMv|U18OD}8GieG~2^#~0<i$x-M4(zFuT7dF
z2V>u!G(`i%1_!{TsW83FCnrtgXJ9;gfsKK|w{X&Q7~AgSq!}<XI~pg=1hYjM7|+!4
zWHL;e&jT`wje&vb|0K|DY%LE#>wM4jf#jAlgPaK7^|<`#q*XjnzlL#6S`E|XU^8hA
zIPO3Og3iI2erM7a(84)T)o=#1<G13~B=EGu8v&lA%o2u4hxkE;f{w_On{-$RWF!OF
zhEsBr&I&-dq6~~@g;*FE4rEVa1Xa5bH=T_F?Puwo#Hav@a>&@#Bydj-yd!0o<0M8!
zumJ*GnGBN{K}*RP-Ux6d7eG0!@eB;$5v?YpNsLZlGe8!#gH?l1IfJPNaX_j;_14-y
zlNi0gPKFqp3f?2al?$>W4a^3qa@C&12s+^dqzhEY@i8#8g7+Oy-~%NJ5OKkPfx-3S
zq&#SnJSWD%z;Jx(q&#f~MlkzO)1*8vXqs%Uos<^|4W`)8Nd+K#Izd^mRok9{;c%%j
zlNKWb<GDN*&^U)NlODK{0dhyiabqT91*nv5f-#e+D5x%HVPIH(*_g=;ysICiPAA2f
z$wUw`8U`}ABLlQWWsWi9cSZ)r^9-B}47{$!jNerl7&`WH6(m+N7&HEn0?BX{r=~L)
zGyYX#U_8$%zy%r-GG_b_E^t{G7?LL%GeK${&_Ic&F%u&wm_cKMv(t^4n7|xS2F7#m
zL2L5cjhVPa7#Pp<FbHsgPW3Wo5(m`;Zy3Otxl@&ofuZBjOGZ8h#`9eE3=HMg#*C{$
zu50B2Rieg>8zdPR&$og`K-U>FLJr3Pt-#JUW;_5&ksw<^o;WBD@&vRvIX?^JdzT-^
zj7LF^0S%dE95-e>0S+?o*rzcg_&A<7U`MpKg05<M!N7Qa7N}KbAOt$-;e3}314Dv{
z@n29;cK$wBa#AjXF(b1$14DZOS0;loBNxbeQ2NaNW6a0}9=R0Y0;%CqWMDjhA8c~#
z8C?bj_A2AsYz&MSgn5%0jBm?>>Jc^uh8@br;1zbD8olI(F=T-qsQ6qcY`h#~=Y=+&
z<fIG+V^G`j)MD_NWX4x`z|PnVb_Gu+gYkB-BS6K=ALH#{H?T1<6!01!kz!!H0NUr=
z6J&fE#O@a0$z?F!33eJAXk(7?E>O@wiqy6nd<+b2uAtIX%y=>*1H-As42&0cLhPR^
z4&w79C#5kM&yWC#gOXC)Vgm*S!*9kd;F_O-@uD~{*tIPxAl1AjiRlc+EueFhPJt_L
z<2G=s65>#BFX9x)`5j>A3qX9;B@GH&22izlbdzx&)EO7kI6&JFjq|{J<iTg+80Ue<
zkifOJF{Hx)G9rV)xJVjgI~xOo+#O@^Ne8FE#vR&X90O|4EMs82xRe((@Mat%06O}D
z12nf_90S^N|Awc4!8neKf#LWj9?(`iW6-cO19+BUDfeV1Wkv?ZOZ?!RIGITUoD)G;
zx$T_HqzU!|c(vkWCeWEVf_9<|j2A&ELnmc2lNl@Qz`l#1bciGbN~1_z&@x#!i^+@<
zAeVxsOD^ewZef|sD4_~IPt2WxA)GB^9$1!v@e*j#Jby>VJY@z3Q_vXA^2-@Z<QW)j
z`oJfhWGn@{iYKEqi6LX9C<BA>BQ^#Gqlk=sU~y1wyZ&;<Mo<y}HBe5S&e$XiGKc}x
zSmyd@#xfIZ54f?+xEwUd3o7rxExOB&p#=<PEHf1u7>v^yvr<7PfSa+*)B?2-7&BQI
z7}%egvCI=^V7%-II`pl_jAgzA1LI{kaK1BRSqO5#DK1bXn6WGZw;)&;7$(%1u`CA3
zyn$xn$Y@ap#><AF0w%?bWu6=Z<7IDfv96P1#xh@?f$?$xIEOVa<zrxITExe|V4TFq
zz+m*<i-BS7TQim#u=^Pq7_V>(ft*_dcCJuLW)XuKOATn|@Qo1Y+yFC{8cPO-0#IaY
zzcFK}1+6v(6)c9jW-PVfv45zK8j*d}1o2UFGJ_dQKc=%^K%LzPaW=>&zo9}+5T}F6
z!a@c!mNs>e3&B1yGxK6#nE1ww#heiwvJ8w@K(i(JJIq+j)j@H?$-oe>!i>e-0VK`I
zz@Xt{#$sU#QpUo-(CBN%;sjnPz{0@5-DSq&40aaO@vg{@cLO^f8qTIWxia$@%vb^>
z7#Ocy0`*|cSVBPT>s(;pg@KI`WnjFr7wQ97h^HW_*Nnvt;vrC(VD_Jnfx-GHi0}iQ
z=Ct07X$B($<5f3s<}hQL3kqD&D&CdFW=!DNUIxCJ(Tr({Bm?7B&?zfdl_9n;&4Xu~
zt7fP|P>W$I7^W~XFswG?1KDHGz_74C9o*x*x)5w>I-@(-Qc(uRt94*=(iuGvMo&Z)
zf*1`~0XmMcK_>k&I4LnOUNhy*FJMT&49<?Avs31!UzY+2voSDu`lsKNXJBYl;3;NE
zza_`O&;aUS^wy<=PZ0!_@h48E-vNas=y0w=hV;Ag3=9p&d5Ve)7}D>7*r4NtO;4wT
zI`Ir(^*7UBfYiSM<yD=O^c#>f7eV3NaIu1cp?Z=m(`H691_rgOvP?@s6~?tGU@yxu
zt$=y?S|QkfvP>)CUcT0XDg^N|Tm@(Vzj&`K6L`7Db#CyIX;~)FHRgh#h%<_iWvY;5
zV7$)F1-kuBmZ=it#8X@ac|{DeOqJjxSh#W%D?l7j4+>N}x5vsd)xq+)*n3%~CP@Yc
z4bXK#i%v0s4;(Gt3-XovJ~IY}4lP+G@Px*7(77GjZ)BOGL7q9l0xG;@nPMS!7bP>u
zGR1+cegm2(YGIdU1T|Y3pv(5Rf#!!97#P^VH&r}*st(r7xXJ+Ja0Z6BI0lBeFwpMt
z_p*#@z>Z;Hi0fcrh-;ApdxUW<$mmlH3~`GY7~<xuGB7x`$uh3vVqkpulzCzYn=0s1
zAz8-toD2-}FELHzkOLJYvWy#Gx{fd~#O;z|U^x6lmT?0(Oc)sA{xLAb{gDHmFeb~m
z0bG|cFvRmRFvN4qm83Dqg4#I@pjnN0IR=J!DbTU^vXJ8*-!L%5TQD%h8-a%!WEsKt
zET3Xvh>vAph!2H!-$3ieTiAmb7zDT&7;k~LVl85jWdv`j{?EV=-@?EU587<ysV~d;
z4^-%b1ZOia#Dg|~h8>b+1m#>%hc<o#14H}@(59`GvP?Xn2E|kchWLjJ4Dq0~=$`zt
zOuSIR1Z4(>1W73dhCUrxCO(*83<E<#kT?U=hE#CX!LS2-$)<pgEE9_u1LMt3W(KAW
zEes3^Jq!#9T_8?514F`m28M*$AkIVvhJ;-V3<=xV8JITAV_-<Q#=wwpK^!srvEvMA
z_Cvr%lj(pQ1LMsSX2?`Z!Y>Afgda#VAUn>0W<UgN5Hlc&Tnr3}9PqW5J3%v|9-vWQ
z(3%%{2Br<GAP(Ni0b2{W6I7alYCQv}<8OeRxQBrObZteV1jvae85k0^85j~ZL7Zz0
z42ez*42f0@@(he0(xAq@fSvQP6E?%8A`6<KXS`L;%)t1en1LZNoq-`S6~w7$U`Q-u
zU`Q;nVqo@!Zu{8z0yJeI;4do&nrrf6Vqi#YXJANdWoBRoowl7gje#L?3Wy`cz>v6%
zfgy1TbgpaXAJDWg$cI&+VP8hjbO>m08@>*4XAA?g|2783TkAlII0BG{w^MF_riZH;
zKv$?#FfcNvFjXP6RWLAjO=e)cbr!TZuav=sfyp6-5x&NKmkR^qiw=;9keO&h&?0C9
z&>b@djErfZTfLwwV0OcH^4(!zyi+N~z|gx-mdO*8j;a_K5_dB&ByI&o3p5?=-U16p
z5DOG53=XnPeqs!ax9@_YrG<eZ@gD<2;vW#FoPhy!l1~yZh%=FaAxVdUAxQ%iNAnmM
zk~|m~lAMsz)b2gtG}Q!2Q@2krL()`I4g*6{7E+qp4L&DYpb3$tl4=+jlB(coYWEuk
zW_NI!0&Ok?IUbs(c7K7Tson6a{~(UPqXTl{9tMV_9tMV_E|3#XGB6~~Wnf5}4dPs5
zU`X1+z>u^CHYc&i1`=s^z&rj>A}tlXJ`@yP=}d@)WP2h&(S;gS$QOoegI^T04R%os
zhb-eEUIxaypyRM-y=P!Zy2-$hbRFq9>}?-la};nrEL^5SNEe`N`v7w=k_wdLuo2?$
z<FMrs$A@o+-`=ntcAPecEaO#>tCm8~4^Mi*z>xF|$yM9;z+45_gXXI3@MFA@RG_#D
zA&%rKcxK-I2ewOP`yX%;WMEK{WqioWz<3Wd83xMCN#7Y5lD<MSb21wPLoy3eX5J2-
znC1V4$jr&&3=GMlp#00nz>uuQz>us0;z%(tB%3iXB%44p^9})6W`^xw1Z7arO(LMU
zbhd*OHoM^Wpn+Im7naB}g|ad*-k-+Iz~r39z>w_Dz>w?;;`lKzB!@FFB!_}HQ49>p
zAlVcUr-*?exs-t+xmb~b$+?bsVh0O51Cw(X14D8f14D9)9Rrh_Db&IUSi;@~TQ=pw
z_X=cR12Y4YTMz?7@>B+f<jEjT83RM|at4NEQ2e>MF)$?WW?)F(3X+LqU`W2hz>s_k
z#K~e{NPf-0ko=OJfyu3jfg$-914Hr;=+xS-3<l<ohYXDOL5sdY4nr=pR=6-Qxic|y
zF~T$Ct|^dPn=@dukSPa1B^qe4HMk^#2JWsU3{0-ppj81AJ3!M9h|+u49dOYQFU$Cx
zlY#L8=t4tKB!gCYrLaRIIYokjAw>)+l6Tz!*FE`&NKVmYU`SC1#Va2JLy83hLy8%Q
zBgMdw;=#a>;s$fa3s@wBOKc`kRt8<P!2mCNx5Y3pzRP7`d;p&Gt^}3q;4_;t7~xxz
zx3w@Zz71tyd{6)?gRv`F0aY>^LkS~eI!ig|f<I`0Z`;GbG~JMa@xdn0>@<8+^tL-t
zcU(g=fr&!{mhrcHK-GXZJ|j7V2{DPkJqO~FhjJL^7{JYGfjHqIXem51S1mj+wy%L$
z@DQ~Aoe9MP1-Rx9Pz&17EMWA2c-0xc5om`4sN!N^e7GH?6kK^hV*nHn=}e%Em&VM+
z1W#SNML-$|DTW=`_wXxtXh{Qfc0!e_EF);u(RFS{2F6FA5lo{9S;kr?Q1g_lB)5P;
z7Bq(kYGgwimY{=}7+{O6Om{LcRJnrM>179G8B0Jjq>n)7Q-F*pF$Ng{vLYcumNA48
z!~<C|pOb+>?7b{wh$^V%Ed*)ghUkM9#X=g^jA7u0wG8;k74Rm+gb2_Qoz5UxMhoa-
zj}B-926Cj+lX`WCnHFF(85mMx85mN+O(14lfX!xLNNHkVNU4zn_Z1kepzY(7<qQld
z3!$x9@R6IR7#LDO7<7a?=xQ!dYqm28sXpkeft9?SHQ;iMfq_Ss(Uq5h@iC|f0o76|
zPZ=0e9wXHUoi(uf0ImnEKIp80r4u9-DD?qC99|zlb4I5QBw0Q_2P!zY7{9=c@_{7F
z#~%?%161N5<<ZU(NUD5-wDcQY2{eyBu|YS*1>BZ`+jazE+Y|84Z%C?z807$4k<s}C
zWE;9M4h*32rV|{pjGEx?Eh7WtlX;-=CRs*J@U6d~j@5EUSw>I^2<uqQh8|M`x&7_g
z7L$BXT4hiNk54hA{AOTC0o|xu-XY7#07?OG7#LEu85mM!A>A49s!@<w4g*6fX!+d?
z23bZ9F$M<ZU<QWNNem3BpgxMgV_8PfEncA2*lAh}3~3sm<&wR!-~m^#pcex}nne%;
z18+D3<J0?63=A{lWf=uP-I`?#3~75A7}B<jGcbErK`N;^3qW4r&5~sl;$>ibdW4yQ
z*|VL2A?+3eL)r}xXEFmr+Dit8wC5nsd<KTJ{|pRif1!o)oGsAB&)@<elf9V1Ql*Rm
zbP^r7EPw^_oGT2B&p>B{F;6rAulF#7?}VKLTF(edv=I!9&p`bxkZYx&u1yzaU`Xee
zM{+HENADa^&jh4TL6%XTmx1wF9msv{3=HY|3=HX@Rb-x%85q)I85q)|K{E3h7}9eX
z7}B#~E}sB(Il|4EOrTOM1J&g@Xf8K^mvFQ1K&8Ny3}j()IOsx3*|*>{0}0<*1t3Q<
zFfgis7J<Fc*8nAoxB8GYk>0|<kY1z4z);>H`_>#Z*TKM$zJY-ueU&BygTNly_uz7e
zfg$}e14H_G1#o%yQG$U%BY=S+{T%~C`YQ!cXa5tZ=y=1xkip5okiiPNgyt^;<MS|0
z&_R>3??LJHECWM^A_GH)ENGe02U)1oHh?-$yu7ksSQ!{!@Ple>Ee3`R8wQ393lPVQ
zfgvN3fgvLp#BpR`$f#ss$S7rJVEo|Az>qPMfgxiuhyzlxoq-`^D^e{#YXbut0|T#}
ztOl%KmT`=MAp?}UK>f0es|*Yom!Y+M##07{jK|PunY9I0%Y*W1CL^L>230US09LPn
zDjsN*fjUm^3=BcPWUoPImR@v#Mx$h}>4E~94IG%a!GQ@r4psIpI1s`2eaM368Q$=K
z0`e(1AR$9avbUiD7tX*i?X+wLsP6?GL74`<BA6Mx)BSCz8rb{{T~LL>z>x8Sfg$4y
zBvLc1Adw217RwY;V_?uTlg$9{d17G5G+|)KG*APNmSoC<#)lagG6NVGGJVt-7>bx=
zGeK*BPcblL7BDbmW+{MciENMqL1Ob67&0enf-a(w&4!MlWZq_A$h@k_z+j^#3z}yK
z4VPpwGB9NR*96@gFPjZoka~)NAxnsXAxl7$fk9=vY&K|}5lBpjfgwu+bU%xTY&NKD
z0*SdXFl0Gtg6pvy=r~YTE(1eWHY6eDg2VzC7_w>^7_zDr(lUz~Wb;5`-V6*`eGCj)
zU78FG1si4aL1G}YmNPJ9EmZ(lfsknl28OI13=COY6hQYW$wKBm7#OlHGcaVGhgP<r
zYbd9kM!Gs_mJY10n*~|}49Z+QvNHr37+)=bc73wmF)(DkL8|Iz>A<QwxE8dkZk7(L
z#z0bmQq>{E(W|=Y6_7gS)nUv^1X>$Tp98967#LqY!>wcwM9FJ@G$l+N7L1JPjD|1=
zPQL)DSzl{_YgR;qZ~702J6?OEnZO8NvNuBkYDpe$B?VAZpqu_7U1QKF1-uPCV+zz1
zP=OBJXamZuNLBcZ4Nz0SN8cdVy9iURK$ZMPa|==fc*YlqO>aO);2_(Cq-Lf7#GE(a
zlV6anf_r<W0o0gOG^-FHGZWe@dDDregoy**TAo<~wP`Je8hG-V361GD7xAdsz`!*9
z69eO$7oc7PJYr{FfVlFl5T;g8zYMXLY33V<L*9ZH{UUqW16JYA;sF_kW)PzX18BS9
zs^hY-gY`N#fbtIm0|WSUw|BW};LM(A1ZoE}Fk~|@Fl7DF0B6`l(Aua|3=G-Q3=G-g
z8lcl=WD`NB6oSMo7#OmRG{6N^q93T)%)pQx&A^ZyuF1eK;k0Zrw9v|~U|`5Dl4f9h
zp8%<VI=~eWce-q{2m|9gNoEGd_k|1$*_#*`vNwP@wG0f|M;I8g53w^azVBpU$iB+J
zkbMz!pX2*!a1%Hg7`UrsQ&>S77Betp|7Bpv{t4o&XJE*YVqnM-0daOSFyw?VFysV5
ztC0@aW$Vm~8PgdUK=;ZeC(A~I3VG<E8+I$8VPgWSxZfv0!Y0}P5;i#*3=BCbkg$mc
z74oMT7;>5!7;@@0z+n^Z3<-yv1q=*1vmoIBy9_$#C<8;zexz`)TLG$wS?y$FMHm?0
zD}vlx$iR^EpMfC<bTj4qS_Xz(K?a6gerP!4DlstR%7Me-1SA~nR)Cf(um;M;feuN2
zf0KbB*NcH6*9~OUQwE0IbOwgpMChtoyE6>T$+ZlijkfDsWx>0<KpSn}PvZs0bTDXI
z4|IKvYN2c}xC#QTNjohY3W-G{1_ot0SwCJz2FCZGd!)qP%ld)S3wS-9tRFa?fY;N>
z`a#l%76Zc`U0LwhCD@)%9N<*u2@Xk!E>B1Z8Zj`;6qB_Fnf*b67hIv(8!<3`kl+Aa
z%q43N+MluvG#R3@(TIUTI#pH)tTYXxRLKma6kP2q8-uES4sg3l8KmnCPfk)IgDhwp
zBlyxP_Xb%t&;WK7Xeq7LXIUArK|K(IWQ;)uaWF8rH^|C>bXPI>FfbfkEx3{qR7*ob
zyd1Qj36w$(fRe|@V(`vy!If&DUCIm$xyu<Ca_6gorsf4#LhIAqiwq38Clx^Zp#{Oq
zg-$Ur<bG#h$o&kd>li_O*MqB}1Hk35YgJ_!7(ZHSGB9YT2yOy3i%&5y<bl>h@<3B^
z`4iC2Mn=X=wuwAbSU?km&|0TF0VKh|_%WD~F_Q%(2`e4S4=^y-D1z2qn}AAoBNqmy
zSFNBnln(>Ln#F=s85tNDp_?<xVTW9{fV}xh9OBKX;8O${81j@E81kec-kb{B^#yXA
zCj&#CE5w^K1VAP+Fyv)2Fytjdy$RaiwPrEYkrmKA!XLkb7GE!B%!IkIA^^pWhHy7#
zFffQ`3-&;}-4(E1DK=pDWkTH718T|GF)-xKXJE*i2@R-<1t=z(z)dt@U^w6+*Z_)L
zI|jy27kD#MiWvkOjKFNr@ezUz;Nv5}H&6&RNr0kQl!5WndeAIqieNK*_VCj|6cI=}
z5+)Byw}PwO85p`-1@ob;)X!WHyYdaec7YDA5G(*K6|e)}t{_-o3QBOG)EB;3Fcs`T
zNa|C9b~PEmh12I*pjD*Jwt}gknX_e#Sqfm2(!nleV949gz>v2abOfg`1LNmhaJN7(
z1LA6iysHchd6z-Q&oe7CFn;bvlYPg)koO9_G)*T3uE&6ZLF%SpB-lL+j9(ZzK=)}1
zMuHYDfo>9AFjX)Tw9<STB*4H^l%Pc)pC3SiCkA4*C<EhX&|L^RDS}WDXn;X^pxrc4
zHG-nhnBD_DtAh!=E%DngB?g9lae@*O42<7?F-_#q1Ra4ZC<Q$MH=mb*A)i?jbWWt8
zG^pTu!@!X5%)pTEr~o>KOb~qkIY=yufgwK#)K1kClmSi2g2cKQ81id085q2|1!WW<
z?f3js3=H|8IqU2{f-<1|{05qsL3uW+1~jucm4Wfw7VyC!g7Tnz3Nq;<14I5>kmObd
z#&5+6pwmSJl@vhfhk>DhgMp!dO_PD)Fsq<0Xl>gY28IF|28IGLP0(4;f_gA@)(i{<
z=4=cMZHEQzK<Yqu)SB4|I)d2@3<bdq3<ZG-WekF#OT8JY7#IqY7#Io?pykLu@a`%G
z1_lQP#;;A9phGAHJweF?q_B*Ep`ZksJ@#Dz?Lr4N8Nh>ujGmw^De$vp_kI8k69`-s
z)Zk@c{0i#FC9p6s6tprh6f`q4FemUaFceH<U?`XbJyNz{EdxWrYFMLn?+ym=0l;7H
zfXqjXaPEBo>g_Qwegp4(Zv>CnHZXt(@8Khy`+Ok9*f*q6&<6N0=e`1{ENFxpGR(<n
z0kd{r56DXljNd>5;t)wD4qI3Wvu_1R7UUp^hwb2o?)3njhsePAZ6+gQ7FQL6g$n3&
zMnf4;V;C`^wO<6J3Zx%&a2BNh4=vU9+<^KEeDVQkrV!GTW#&T6vF`Z-IuZ+M-*_r$
zPZSgAC<8%o3Ss=t1s)UyZ!7a$CC~)T2nDc4+YC^V_kEWdXo-<PlK=xl?Q;f(f&&Z;
z1t7658G$D76+jFO1&<jR3ht^gFwFlh(4+=hHq5|K$i~1>$WV}6Qo$h5&d0z|*NfPf
zT`0l8T(ypY@jJ->kajooV#X}c`8!A@bfE!s1ciB`0%%YNtT2Po1-wD7JX#<ewCduA
z8ZX$2aA5|<AD}AN{kK5463D3>phe&U;ow>WbpO{Z0m#B_9?;!q0^oBhKr69jHVS~Z
zlAq!!XAp?tWMKTE%>x<)767-V{)0-@x?V_DVEkbX4lsXED|cp;fD|;qKxGlAre*{O
z*e`jFas~k@LC8(ig*prjg(~S_H%iHY+{l=zkjWqbE+9@ZFcc;*FcbzUBr*tqx0i!N
zwlXjju2o245Re5e@db%IW?(41u8_<iAPdU)rx+NDWEmKWgcVX41Y|+0W<er;3=BnX
z3aJbNvJl5I6xA>=6cs3>F$l<l3LcP}Ees4rs}#V#lLHl6AhCZ83`IW_GE*uT1i*XR
zPcbkQdonN-+k*mekAR{W1H;mJuo;{x1!)H6G%rXUp=beWRWdym&=O!^{Mo|Hz?>Gv
zz))Ptz))Nc;-oP!6whX0D4xmAz?@dZz)-xJfuVRMh*QVFP<)Yrq4+EVvT-}W#(frW
z;%8v|2^zcs8CN36z)->uHLgT~fuTeWWI_=GLx}+cLx~=UQ^&wi;?2NN;>ciy<hm!I
zc_3zH0Z-7zP_R**3=AdhFr#KLFqBLK=>{3Kf`OrA8HfWiYBvKz$xiS}JjZkVoE%7F
zZ3^J6rwj~`OT>S5<}xtx>p}uUVFhg1KmpdS=iuk$5kOY*0Imc&zQZ8F&&emiP{F{!
zww0gb3!@nWgZ4*$j&q=d{R?!Iy=MYH#|2PKftE9NKj!DSD8#@}mj;?*NS5d4m;iPg
zBLm~_2o?s0S@QfGlfaEm7SP}gKgT3cYOP{nV6Zdh=a>eT0j)P$sm#wY6Vwr@;>u*;
z=a>a%vM?}6{O9M`2;-zi@pFKigP<kmzuj3F7;G2wbIb=V?E#snvV@;wfg}TiXgPRQ
z;51f#jxC^c2U=Hb#=x+EmmhTA76aq&%`6NIAX&&}BNhgRmI?eEPQp+bke8gnUIHB;
zA<fSLIeHZAE*DTG0`hmH4?hQJITFJg&}<H9ug34gAfFkqfu>>DR`Iig7YYCV&I#&1
z^0WU1uO|iV6PUoy{#ONjwsa-~Kl^`hK!U<feH}mhBUsq|0UdLlEzQsV1T4>0kjB8z
z{uGqbPO~sDSc&tqKLbmEG}h$vv!8)$1Z|w_e$3B)MgbHloD2+-?ELJYCC3bJz-z7f
z+0Vgs@?7R;Uk}&0k*lPrkb$3lqcj6Ug&`Mc85%$PK4}Jq;_oaB47;TG*&$1<p~iq#
zL^8YqIpBl@Kl?<OF@HfPV(<6oXP*e#k5>hCz(nxAbFPx2WCnir$w~|i<#(VKEJU^d
ze7w*ps0HBFfM5$2ck#0)!7cFNWMBaKFbUa*NuYJbFdu>@V<ArK<>6<yhwB8*d8xnT
zXSWC6UI2BPJ$T_KG*lhIVFPslBzZu>-WweDAm2{A!Ot!UH}W$l1H%F(es)QaZ$Z~>
z%;4Z>mjs<p1LA<fUJ5J&H6L8U!kh^%T)`gn*vZe%4>R*0=tLPO4}Nxj&>^=lWB5S>
ze=wckBgnxz%ewj5KEQQ?W(7mM_}M;yPO$>%bn@V516^aw0OClp^Rs;b54eN<#P$j7
zCx~a+KpugF+0rC_wwrJxk8v_Ebk*~--2|m>m?<|w-Q_nBQ*I-h0$$DtUVvxC!_Njj
z>H|7_tN}Yl4Sb^Be@}IAGG;q14ay1(3?)|>7)s8lGBAV~^0S>)Wnd^R2d$z5?GE5)
zgQi%9lJ5)*C10UUH;p?COv0d(H5pAoy(lh5K~NJ4v|%@$(Vl?;wA{s$pREj19Wu@V
zFFIpj;ObzU!@$G}I{#>1CO=!5Is?OHF$RWG9tMU|7I6mVB*-!bka}hY28n2XwrW-e
z#{Zj{8JLrt7#K=T7#K>8KpZ~?hEit+hEhj{entkyJPvS)%Q&|L)MAv#<7aE(lV@P!
zyb2MX=K?Kd8Rvm-o&s%0;b)tw394L}8JIYqGcc3}Gcc3}GKe!Uac+fb3IUr{$ImuR
znSqG`w5yl%I0Hjz5(7hN0!Se{<a&9=c{yN(6ZzSu@G>wl{AFffVwYrKC@p1RD9s0P
z)EF2_r!p{<PGo0bVmD@BDBZ@uP`U=hv1ec?eZ{~~`UJ%BVPGiZVqhp^192i57|N6x
z7|IkuoHPc8GGhjYGD8rjn1P|pm4Ttmv6Yd5iM;{h*aZt%p$rEGCiWQ&Obp=j&p|_^
z=}e^xpmkob{rHRv=0Mv}Ol6>>N0>@MtCT=ZD5MZu=l~0`g|N9Y0e-gGrVLDsM$ix|
zYh++3s|PK1frZ$@0JtXTDFh4x{A_bTn$kg<jx#WnO<-Us>jQ-zTL;9!3lqShx0au6
zHZKDc<1c0gCbn4&3}s6h7|P~?ILjFr$}TW4l$~K`U}D?Cz)<#<fuZcVECUnUfjR~z
zwzDANs|*a~QVa~`e2NTAY>&XZ)tT7dGcc4_F))-@KvFE@A`S+|TyD_#CwPLVlm#@x
z2}-bOpq<zKj0{X{koif*MUWUh%Fnhy6e&;^b-?_$2v+F}@Uty3V_;%(2l?+g14DTy
z14DT`$bYavSu_LezpMOgOF;??KnjmDFqF?=U?`skQphF%35Z1-zzSdRvn>&2U}Aa)
z@;j)cUdg~vz7)jKXJ9Bl!oW~|0OVsE28Qy-3=HMBK^zYTh6;WLh6-*FCzOGqLW_Z+
zLIadO*peWIFZluuge7Z0=>wD=3>d(12hAc&VN)E8OF<<asOc)e&$ddPfr(ie<mBfJ
z3>8)k3>6k2C&T=<)CS~aNk)FQ)rt&E%swE6#~BzZJQ)}&+(8Oi??J3zYQw<7z#u8i
z&$fz}fr+`FnSqJ*0|P@v6azy=7>M(ifuW*>fuW)aGG55IOoxH-I~Ul2(CoO(0~Ywp
zV0#|~_}MmSGB7b8f!RBUfuUj+NE7Qyh`q}q;F@5op+xxE){8PQv9N)x-Oa#Iv6_LQ
zVkL+Ja`_<!hKd6qm&1yVWes32s`0aJHD+L9(Fa)t3X6*j3>D`=3R!KSR)H5LN!swU
zZRKWQVmSaZ(T{<l;t>Nw#XS%wnt`F>KLbO>ZxAPgfuT~IfuRy~Z~$v514E@Y14E@I
zNT!K_q0)+hq0&N;fr+&rl9XBJFfdelGcZ(oLSu2c2qYFECnTgZP1FFzs38OBbaGe`
zy4(c15{z*<=qw*ljEeBH?FHS;0xC)?qZk+}BcMfTWhMhdWx5`s{9SIs06E$mNwcXo
zBTRWE14AXKJr6dhlYybKodJBdn9)&wHgHSf6e9x@E9io(j-~u;N$Ly?LZHiXGpza9
zlEFvcfoe4wezp`Cr=gagEfvNoOXg=w16|(!nuUQub~!&=h7bcoaS9ix^}+_euJ{zF
zCE&b=pA9q~!~nMJicm==13z1&2m=%A6`_)R5L=mniS;I^w^nq7kAb0BQH6nF=~{j^
zA5iTI(!|Csl#vM1<)gsB#KsL;JpP@Z%|{dDT(GwNDhv$TfB4x{;5tB)p?yjGY%1yu
zOl)9I6+fGb6$2An0mOaa+eJW&?3-)(*}w<SgN_sc`9edOfr+gYw65<0KbsTSd^0`<
zh9YZ_+fq6h85nF``PpQ_R)KDuT*S}%8q5KeOn*TkX2H+;8e}h+<H67R+J=FNoe69&
z>swIM=@eH<Q3eA)>pK|+#yn=IRl;1LtzZ1Cptdjr$T8OY`PslXk3ySzY@oFr4B%_Y
z3+4D27z%4t7#NJs^0RJ$S<l|d$-tlu5;0|90&^Ua`B^t=GBC0CL97Rzm%sq>wrm4G
z>lO(HCicmov6`v;tXl;^n|W9m7!0-eS;1H4f|V`jXWb4C5Ecf8hFX5s9borEoXq+V
z6gmY_paGscAR^6?fx+SfKPzY>90PQ&q!c<B&bR>7q~P4D4o)kqljT97%)n4NkAb0b
znmPjmS2jQEWFwFp7#J!~F)&mf0UcT-%+ER*RI`Bu-ZC&$K38X8P?h3modQ0ofq|il
zkAb0zOPztCM24Sr3b^^qz)+>bz)+=Dl#|N9&kDM5rPi5gB8L<M1Dh8=E2wb`x?`Zq
zpMjyuTMpcEVg+B?@`iz-DwBbsDjhmHR<;F{7r_~ZiDMyD<zi4T9;C8@fuX7llFb>)
zjxaC@APzzS)zRV%Owy;pB@RO=_}n4RJN&Hk#Tb}4zA-Z}N#A8)sA^|msA>gqUNSIL
z&0%1ung%mY1Xl5bPfh`!JO&;+K{B*V0aV^`zTszG&dR{V=?yXmWaw@NhN_()4#?08
z3=CDLV1}CDFci`tVJKY#F3FiV3qf<oiy1RPt;NNR8KBl;G5oCd(i05K3pOw?aZUw|
zZGkFf*x(go0c`B7tb~C{{wYEpe6(<}0=VFrV9d|j3qI2dR6t+lWMG(=$<Nwr0B&BY
zfL4w0vv$DcL1#69<U91i^5zT-GgtGohA=WPaY;bh<E-HEpEuCtSPeQjBhiMR)fJ=!
zv}K;th@aI}5j3O(%9k?ytghf$E6`Q62l-ij1;M>wdj^KSR(@79kS5TUH1P(0Rx|Lp
z3-}sGepWLzBooZQ$HGEQ01di|mV>OFwThor3S<K4EC`SZpiv}-Q&1D6RFF)N0*`A!
zO;Cck!JL7?A%vfmlaYamn+>Xo6Exx*4?bFqpOq858iR#_fi;Aml~0m^p~ej~_%KzB
zpXDQH@In0+Kg&%<kah=1(6E5_PeFr*<rND9L+>MgmirtG4C-|t2M5aVvup>ckA|w>
z1IpQN7(fNwY)*cb)u2M<jS2%pk3K(3EtmsRJrSz95v&>#@GOf#<-9I0KT9xN-A<@F
z$Sydjx>At3-F^Hlrf_vnq3X=R=7IZ4EH>c25@>{A<7<8vd62Jo_#j?qQ50risNv-*
zPAy>IXHf+oSprfR!@$o1I`WZ;$5EAmfo~r_iwJ0A_gVPp7igqF`XoP#D9D~upcR^1
zU-7fBL;5`oC9qK)(7q=oo-67M3?RkqpmB^-3=CDD85pYGf^Pji$j`#A1x_^#)j|vm
z)qHZG6W#b(z(w;Z28L>F28L=)Se{~FVD^5@z{Ilynx|k{q*R50iRTLVkRzTcETG9Y
zQ}CH;5)%B(@1Ra9hIYlkmk%=Wb*O{OU*>n9SqG3sb_@*F7U~QP2GjYO-+@yU14DH(
z14DHzq=;mG4?2;hoPnXbi-DmUbfoa=W&F(VL49tJ_T3B&)te#3E;Fd>3mPA;e#5{}
z{RC3%GJgQIMouv>)W|Y0)QEx$Q|7Ny3=BwxDf3TIV7_5ssBvdtsBwlAk<5Q!f(Z-^
zH8G&}I&7e=_yDLU$9aaI`4bm3h)QH21qv@>`3rbm7c&=Q0c@zg#D#%L(u;wKPY_h7
zfY&szOzdE00~Jl6;q`RH3Yd}<P)W?d#HR^S3OhQgq=tcsuLEZ17N~hK5JliAP`G)p
zI4ZdSE5^V!f*0~-uuN<K*_+Nf@ek7!7I2(#EaPWB4UMxr*o-6SY#b(jU8se5cNmz&
z-!U-pU555*GMPAvL9?sKyL(`2zc4U^4z=X_1a=&^3j-7XI>bq7`5X{wen?m_!la?4
ze7+1w8myBCCI!yX{4e;KkAgFu3Ijv$S$^i(U=AY#6F;cP>wUz}JX;Rbo?>BOklM`8
zJXe!}p<Ed<_{6*(Y4C{|vR4n1Ynj1^XM;yrJSF&<tKnvT;ACJp<-^Zh4LV^8R0w8E
z^D|d#f$ocfG<}%s)EF2lDxenhB3sZ0N<Yvh4>QPdknxrPWq#&3m<0lX-~$r*nd3x3
zjs_jakj&2<2in}e3~FYAJOe}7MivH!J$Lz;Q$d_)$oL#Hs5!_0vjE&q1^XaUouAnS
zZUN}zSe7(?W;X=}hB76nnE}Y|3`BNk5QqaF(V4%8pV<Oz45a$EPJlEc7<EAHAHl^Y
zpk@iPg%Sgk;9>@bnkEK@ni6$z+l1Ky6hNTtbe@5s=CC{ilMtlW$6&pN0h+?BVRv3%
z;AgfGU|<rQYR$kT^qiT2N$4{J1L)x1T2@5{CSeAqi5wuBmuaFFh?WAK5y#HJB&^QB
zP^-$oP^$<{Z#Lk@1_P5|CMeZR6k}w}WL?adr3@WxfTk-O8>BvYCiuL!4Dg&zI>=m5
zr^bK*me*`r7?=cCfLeyN&W;QWC1U){VxXaE=m?h;XwVIG6_5)kJcRZ`!b40S5+1eo
z3=FlF(C`ogkHRr9)Mha-)Fw$WFbEp(GfT*T#tIl1YG*Mp)J_0zDCK8X<zQeE+7B8E
zD=A84;Ad8oWndDzz`#&<hJm5(ND+9DmRT1Zd(0ENnN`69waj{;NIS(maRxKA=+XxX
zykTId`^~^m_Z=ESR(n7#Ck7^=$>0!DMh+p)#f+I83Mw25YOrF%>I?3Wn!yYWDbR3x
z7088&pj*5cn?Qk8UZKLku<RT^GZQ%RFfuR+n+k!`3X=*bY&aolgbCE`f5QdwCW|x!
zLx~PFaq@sTiO@983-Sppjq`yxZ$Q<gLJ>dH2T*+~90$5pIF+9Xv_4o$jD>-LXEQ$&
zsOzD23sgz-EaqoA1$W3|sQeif28PlNki5@y7Hlfim`k9s$d{nOf2JE?agZS_U-+58
zXA!>v`Q{}g%QEd!0-YZL$+AqlK<zQe5Gm6>&;Xnr)O7G5Iygg_CGs;Z13Lwhq10gq
zkb&-1U=lfC0=o2&p9yqR5@=a#y(j}iJ-<2wL)$5Sre&au8BQ@U)LSqx)Ek+A(*e^m
zCk7^w0}KrHu?!6L;pz+wy!rf0%e*0rvg%tH80zalIpjY-(+W_Kb}~)mP-S4)A;`}J
zDf^fvDnQZ;6SVkas9(vzP`?<OS2QAUr2wXh;1NCp@Sz38pu=P2+xeNmlQ^Id5&^}<
zEO~yWS)j3YXyif8^#&JE+DiOPG2nn;WMC2njUj^+$AIz^sH?VqAwN@`5(7hJg&_mO
zre$pWOj$e(OrqiZ3=HO*`I*3H-!20kK4bHipD72FBdeG|=iQX@Gv)FyFvv+VGjNp@
z6f^KM<*|dz2S+C4ATH2(9m@Pnpk)aRRiH^JF@B~(@T3%Ex{9d~bi!a2Bq1_Q0OvDE
zLSzEpdJgl;WN^{|O=NWh@-vl#vH|!+>m(C?rYcZdtBQevL6Ct-RE~j3^bKez-GCXi
zn}UB1Ka(Zc=a3{I4;v*1t@mIO`;p4Pz`u;2$r4<Hfe+S5HsoirGy>HPjG1!9sW}Y%
zOpXc+OkzJ680wEPFw`FcZ=&I6asqF!XJDwm$G}j32XxRJ(_SeC22c>Wf`f>Gq5cyC
zL;V{m1_p~TekM2YNj?k=4FU`d4SZ4z3?PqqfjWiD7#JFq7#JGlq!<`hD)TdWL$x<p
zFfcTj$z?L|Gx>u;=@tV+gEs?1gKHoIll)YOe-wB?y*Z}K{7l}`%nVHOAhWU=7#h;q
z8JOfZF)%c=GcYvNL(cuFybbD0aPl*Wfdhn*fk_;cmphj7Gf8lOI9w$~=?wf#k}3>L
z;(5^A1es6)RfbpjnLtB4;4y&aT7D+TI0$sb%6U+k$_bvTs{-i;$3Q)(bgEQRVPIJO
zgP-v)+}3xT3=B#Y{EXl^J5U|J%#WY(FZjLy&}`lxe#XC`^81t!IM*@$(*fl=P`1zK
zXZ&Xh%56}WGAJ`JRNQ8PWHCrX8tQDwK|!Dt5O2%Rcn54XB*Zj9sSi}KJ^<Asl3wZz
z4DxdPjCVlYwkigOhII@K4a?LS7>+RTGu{C;3r;aGG=PF0)U=n0<!8JL^4l8*hK9ck
z3=QAa85m*;`58g$AQ+Z0Ff=MLFf_`jGcfG>$<KJ#iGd;Aje()joq?gzaWNwgKjVE?
z1}2F`{0t0=P5g`x<QW)>4}mfk$cTsFw7|tsRFqoCz|Z)IkAX>|3RFp|GBEJB@-uz_
zb-?C9#v>+W^D};w0R;;KLt_yGLt~mM1B1~=enwD1z;KFr;uQu+LBj~@34=y08bOX*
z#0m|A8t_UICP_tb#RQrp0Joi)IN&>&H0MCeB5-A$333Oh)eP#mr-O`V0EKP-0)9r&
ztsk(xN`=sYTc!$7*h-%U*U*e7G(fcw14H9628PC6ke&nM2{TZ?mVp6u`e`HRX0F3C
z`58}uCT~tLFf;`-Ff_TUGcYLs=Vv?#DyH5rFf`3#U})--XJC^44)H}13#@HZ!~%*?
z1_lNZe#Wx`3`|l6%nVGRl-qQTfuZRNh$G6t(Damnq3JP*qr||_^p%03=`*z8EfQg1
z{LTgHYE2XXFFL6KFBdB1038F(Bx3-z4>EER&(C;X0Az|214A?D$Ur6#$B%)bS(|~O
z88pNz6V1TTY{S6NYz30ZU|?tl$$GIfFv*lMFf`{dFf^xuI86);&Aki^&7B}lKLbPa
z5(b9mMIg=`28QN63=GYiK%A8f49%Yy7@FUJINKN)T0|KbTKHudm}CwYGcd`VV_@Jc
z2T7f0U}!O8U}!M{aqciMwD>VFwD^EHFBuqGsu&nrO2iqM<e?{O7lF5)b57-F>=k8T
zk~RUA9_JVsTIMn^w9EvR9=8}6T6Qxqv}|SwWMGo}0ttg+PzA%lxtpJH0VhZY69Yrb
zBL;>R&;YnRKLbO{Zw7{z?;sf&28LEK28LE45J!`Np;e!Op;a4Xuo(kGs~-bHs|)n@
z!{P)6CTY;}cV?8(FNW`lDu!?0fpn-i{)3}ig@J)Hl%MecICC?C(gnEH!+5|Dl-@WQ
z7(7?;Gaj%9r!y4>27_XL#vL%VG6oQ}JG7u`xw82gcglg(axyT0(&A1~a|t{QE%%b2
zu@tWH8$@F%vc@uGjb&hsoRGv@2EK%w3tW#dR)gyi7I1yQ2)YAT@BsMySANDC@Cmr!
zW8U}~Yr!=OXl=wFen#-MKcGswXca$WJ!mDyDXuaGe#UhQ3`{cLKoz3RTYknyaFxNr
zz_8>jKVvVbAbA5;HC35`N#-}W)lfAZG~gNQ$iT3ylAloq>>o&+_CV`I#wVa$EBE*n
zBV#W=qarH<ldO*e=s-ArMkP%KhUz*7hl0cu27X3m9tI}4$1)7644@HJMiq7jCRt@r
z6B^=8U9dM97+TLVFti?rRDX<mU{5hHw7z3tXnh5#LmBnJ-ezEEV`pG!W0nFP493rB
z0IKRwF)*|#GcdHtN`Y1{@iQ8Lea^tp=E=a&W-rCSuxc?sBWMdQsBCMiWMF73m11Bh
z)#3-=MFiTh*fx=Yp{*Z0`oI_m9(`b*IF&hwfr0xN1Cv}8q^f2#0tXxeL)&@=hBnYm
z+@Juo1qUDlL)!@khPGo+%fOfNykTHy`@q1^_6}49Lo-qzI7@Ip;AgZ2P4>v2V_<0K
zWngIM1f}&`3=Hj>3=Hjx@MVC#0+4YFxp|<n7c_qh9|-M*ja&5IfT{uQ{sB1~G|&T@
z(*zH0Kntxt2FNf&CL?&96l795Q!!}yEU2>#%Ce9?LIJ4xZYIai$j!^hz$6b^bYZ@k
zpOG6h9JCBH>i>qHk=q!S^5^n1a)YkY0#(cNzw<M4dxM%npcWk?FCXYAX;AaL#+@I$
zM^&^OWFn{|yi%E;kpZ+747|LEkqM$yi-DoTn*R$Ztt|to1f8F@Qknk?XmvvsPbLHZ
zH@G?zbN&|~byXmBdpW=@&ljNe8OuQGUcuF!y2KBu%|Ys(Le$*>SqxTp527xdfk9P>
zzW`(&wC`vM@-3*;09`S|r0_tEfkAT#e}NhUlfnZAhIT&&hIS7%a6hTQ5VAP8y^w*S
z9ki28Rf@k*7BaigK7)aweUcgjLqs)yAt>74Ffg?5VPI(ArU^PamLGC569Ys0eFlbh
z(Dg<BHvHAl<lMo=z|g^@$-t02k-rI=89GcD7&?p;N*MTCWEq$go-#0WxH2$wI6|vw
z%NdaVqrwr$kUD6sBxoroGyzy%07-+SCUUTWDre9UD4<LZI;^!?Qj3AXl9xXS90-gI
zOp2iEPiKbmhbV#Apq5##pB4jyh6cYgT!}Ut1H-Wg{H`D++8`x4)594UHX867gR%)U
zDCI#O2L&bQ5-cXg*=h_7ODy<}6+!8QfuSRrfuRF*(D*cSeiP6d$x{pr9sLXp9qmw8
z%jbaF9-y=jDa=9Ra2eo>s|*+z8Z}ZfA*<M#6u<B$<rXlcWP%*?g|{FxnIR<;bUsHd
z2LnUR)|5=}C2<@K3{$&OK${O4Ko`NSznqc<YO{gZ$xSI)pf)9V+AD2?E(3$p<dj4<
z1|}slh{=iS3`~k&Af_c6f|kiZOiQ!{v3ZjU3K&uny+CZx`OI=WDZWsrDfL4P@Ku2t
zp#3Jr*Mfl|8RWDbSt-6wpd<uZT>UczJiG&1aynBt1+v+Nje)@?DFs}1odOvgwK>I2
z6l4$slhPU<u%A67!F*)~hN|!sYhDH>Wo};3d7vrQ8lX_-041UnYeOizW^0NyXhR9e
z(^I=rY`~}1axgGVc$s1YYSn_olbcd(z#V3uOokNbMP!l;4C`H!SvWxE9}&tgEn!Gz
z;gARUR|pi^$t)bkAU}bw3g4Q{!U5WY1G*|anFZ3g=E`D7W`Uf+$(0Raf)=HMmhM^S
zCbMvZ&-Z0vU=R*VX5p3wnFCsE7?RAw!v(T|g@IxI?PL}nK@f*4xriZ|1w8QZhATN8
z#0HnZT**lwHmI}rhN}|91Z@TY-;&ZeGnx54F9VZGEyUr>?~xo19;;3U4QbVEO=f-%
zcR2G$P+oikayauxaEb;wocSY?!<j!JIh^?ulEaxlBRQP;Gs5A_;6uV84rl&?a5(c9
zxWk#hz#Tq0A({CaF9VaR8Pws|WI#ax3329Y2B46FggEmx&^@-`5NC#rjDQ_}1L5!+
z$PT}W?C_h&4!?!$@LNa@hs^VUL!9|GlEZH!9DW<_a4EH9<_M6({e=n{l9?l<7?@P!
z!5zLgAQq@oWMI$0$H1iOFUi1A^D3Fy6r_3zShcAV*ptP{49U!<;IT@sOon7;$kYw!
z)|;C5$;{dy^_PSSGxHddnYC4+A#vO#nOPg0JHc8&Yxfu+QK$<J36SnW!DJ>-psJk^
z0%>NtCJwd^oTQnqDS$Yf3=I6+l9{gQfH*?=X=x0}OxG+x`BVsWc3v{mHAfH!bcH}N
z(+w^N+mIod33N;=!yB#=BM=+Z4S&N`Vhmz~eEf#1#010!Es1}_RbmQagUcVT5;G7R
zRMEZRDlrGKLDO(=xJp1wNC<$IWG6G-<N^g53j@PppJXObByLy@@+i|Scv@w;1@<Tl
z14B(?GSh8vJcE3_xFDG+mzRM_JxnO0lp&cZSC4@qg^`niq5g9+Q?5D4qnr#3Yp*9W
z<$<c5S{4Qdq4Z=X@Gj{$pp?&408T()>k1%V%VJ1oDgehhR|<#;?t5`nfS91l_zhPw
zhzapx8Hfog;=wsGFglsZ7v!2}kT?Jpj_S{ZQj$SF1|74%VYN^mLo$;u=+dA!LZGC;
z<m<-3r2d+dfnnp+WG2vklp9uafxQwS3GxcqVc@~?H(W&w$xMOZZ~zBkAjIW4sSL?X
zLEvJUD=8Ds231|jDxiaZ1hW_zs*97Eq`+Dkm^4Bmu9H$=U{Zeu2{$Rw=|G@x+qx&2
zNy-rvZbBe$N`sda3xSN41~nhvaDlCpMY0aUX2@b-NRmuu{13CF4r~eIe>IRLT)7O%
zOd#VK-hdQxuTN%t3{!XtqVO@qH6Y^|AA_pbH$ouaFg^yA0Jpf37?K$whX{boVtfkG
z4a#LA$&9yo8JINQL(I9Y2(nP9fFYUjwh1WzFjz1!q=qIl_JQ5Zz@!OU#nI-M%-E*_
z;y_9r#y(4sT1ctG*axn>I6?JlGGjkDDR43{tiPPh*bk0tP6meLrewx`P%q~V*gfEZ
zI#9viJvEteBG_@D8vwhL87G3PAFkXAhGfQxkUWxG31Wj25DNoC@s?!9iQr7a!oXnM
zn9Mj4YHT7%%Op+)hM;6nWTu*#GcbrQPG;<2V_?z*t%L!2qC*qp38=e4ZK(~bq3-T*
z0L3E6_cq<hjM`A&Yvph<Fn}~_tAR9vN0pNqwXH$E2c<PeMB%~+DO|w*(}kq9lEh?&
zWJX;`J}F57bHGcF1-LR8k{KcW1FkX<6VzFG1HO=NvSKo$su;*N1}3d;7KrugQec5B
z1_lr7WJU>ah%qo}ZH2l{!Vn}4c90af5CCO%z2(V_e7p=yTA)H3<Oe<jxGDjNDq9AI
zV~3KDLygl0?Fwk~OFpgxQpdr-ka#fpI5_X|<T50m1Z&~RVMsm+R?m~kkbDyCPo6A>
z<da}e^5hgUB%cJQ0G<L66PzD-N<d8T0&kv@WQJr=M}grDPe}$t@+oi~!c$VhkbDYU
zg@Cr+)qhTYDayc*($163ko*!H*KFWY>6JVKL&|jUS<#DDCGQ72gMmr=C<i!@_JiY=
zC)to8`5?rt$wmyx2f;RgPOC0DmJGcEn@Rf-M9VI)7KRuG28}wapNuvP421`+l0b77
zI<MJ4$8TF@fX4o+*ccdmIIS|lrm`_GEaSBTt?3t1Vq;*4m9;7c-wOk3y!ly`fFlar
zCbKF9x5?NT7#!zXm5DJhfz8b7vnrQnVAA;jKiRj6fgyL1)jOV~A_l7lAqEE47B&Wk
zMFCblu(P;Vx?A;v+2Avytw3p<0dyR6%~q>Ppxz6JJ+;ef5;)x17#QN&tssNnYzz#`
ze_MeP30QsP4y!%jZUh@BcUtX*c}MAt)e$folyBlc@i8zYEU;l<@O8G*00o6EAJ}Qy
zV5fohDHq#YNr5HQc|mTLk^!%nDPv%8`^(1?4w*b;Tn<|f3!aM9O@?@v;X^v4QO~%1
z2?LWZ=uAt{e%~?%hCQ}?EWR+ku!Wfhpy37Gb#T3M#i@l1d@KPF*D`c$Wnk#o3|$_&
zyaHq(Xt9M*J0FW8)F@`?1P&7q$S8wD>I@9=x_m5(kW|6Yaf^YW<B(itDgz&jmM{a8
z!662Q&PWD^PUoVeA_hJd(54gC7N&_D;tWiN_rZf7j4Ure1L$(^`B+Rj8JP6HGBYq4
zzGYzO>SJK&0-X(M_=|y|Yb66i*HU%{CL?wRhOYe#3|)Ic91#YFu4@boT~}lon2Z$V
z8JM_yA!f3gK#vAtWCbmS0QHqB_?X|ZGBD|bmJxHMGca_4?0C)0z{FL;z|i%VfuReu
zYLqLAfuWn9fuWn1oq>s~k%6IGhk>D63$dLDWFVw-2x5T@W?<mpXSIMXieO|-U|`~L
zWMI+*oqxe-f^<}0Y6Wy~fswTWvbIEDijgsk6MA=Sh6QvQl96=@bcG36JEJWlBm5}8
z3=2laRLDU_@(fHyTcEyO1NSX#idlh=`3uOm3#=KKj1GZ_^NI{iMt9)10y455K<NcS
zN1x#rwllJPU|<eh!N8=yAIXvFFW`P)VPKYgz`&$`6TB4W00SG``5GXNNSZ(!eB~LK
z3?Uc(F|wY4Et+LL0|`F{0X`OMP6j3eFHqdCWMJraV_@iZl4W2r+y+hFtT)gN^?*%U
zGqP|nFc}<&Mhc4u$Xg6d2B7=TAS35+ufde`fXrfGG5~FZgav>42Iw3(Bg+~FCL=qj
zy(~vSYLPsXegZs}7w;0yz;NIL9}6!uV=zJU7-J16V;If`kFW8;mMk%JH#0DFH;OYb
z{oW6WGiD!<-{tP`v50FjFd52NGcf(W2n$@M4v?)3OopJ{uW%Pez@-;3F#W#Iz+@N<
z>BPgtnG>MeijW<=0Om2~5(dWf4yebNF+5hl02-#!mgHk$29-vJpt}#%KJc+HgUZBH
zT*dhed@O9D3=E71LF(+j^D+Mfs{@_geR>}s^G{jOT@)ZW`R#nn_d#+-pnk6X3_j-j
zG7JpDpnC*NPxCQD8d9J$CmZ;fUxO<I76yjYem-W<<{R+x*}PADkgg(lic$AAAGrU<
zco6KwWBq*0JHW<+&Y~7?;A7qaaw2FWR+ujz^A2z`8EWD#P|>!G3sm?p?**5*EDQ`F
z)31XiL>ZWj=5ytOrO%2pFd3}}@2dk@cnjiHP#MnEW5&SHd5MpCCD_)Npc}__@iDJd
z1O)~s0|Uqj;L{+gAQr6wTLfCDC;f{Lw6ccD*bQ_({arq0(Do&UH(a1gllYihB^j8E
zK_d^wpyM5MQuvtLU|Z;!j3MX0!-YWO%t$Ig&WhU-&A_nl2p@9}Bn>ji!FCXrfYPAx
zv{X=)%g3ApE}X$rt7;$km_cVg2_9g~<Vs2{W8h;hffUnT3=I0m`It=wK@r8sz+?it
zdAi{hAG4`G=;{s@1_tL-e9-P9)cIC$=RX3UuFl77jd1=~@U<*_%r<-=vlv7fm`pe@
zRGCO)3h6<G+~8)JfNoUSdXSIV58R{yn-zkoDjid(3Mv$aFsm0;2o|hR6`<ZU<3k1}
zleM6}rGXD94qN;Am^IlLm`uev85r`o_?R`#p`5;6K4vXB5C<9}I<OEi`2w{@7jCmD
zJE{=OW~d5KgbMR}F)-}4;bWEqH<uY1m`uAl85s1h@-fTlf~?_WVA$)!$1DdL9)=|%
z1(=<t8Bhxp5q4Ii3c>7zssQ;;WCI`5Zbk+sv(=!R?h^QzAd5FZchw!^V>$<JCxI?n
z5a(k$56Uv2UWS_hAJb(J2Q(|<nZU;cS_}-nr|7T&9~0!<HAsjsJp#Lqg@M6ZiI3@#
zJSe?`_O$-tV}gv?h%zvlDL@>_^ce1LGh;~VVR`~jJ!YUBq?5vjtSS;!Bgl6?ANiQR
zfzvw+1B3c|KBm854#=8zh-zj|PUzJnOlGrCg+K;?@)%SFcrUVh2OrZS@bE0S+-3-w
z04lc`7#P6I7tBFhEpq<zF)af3vltk<r!X*dPXO&H0J&rdD3IRN2Qo03C&RTfF)(n5
z^D!*}O;wneGB9*+U|{G5ZB;XGVqoY##lX;g0#Q#ege(E=r{>V$W17j!z+?{E|MUAI
z14H*s28QnI&?=W91Y9A2W=|J0W-)-zxLo$1j|se#AGA8fd;%u}1IU?^A)^VYc_|Eh
zOjALwI|b?y$5!((wSzs$z+}D-T!=AsLJF}g1_qz!d`yt#fecLMXCSh*5Lt5u1|>#5
zrhG;QCJRspTl)<kQ$BbNI49^<CO)Qob<l!a&_S%Fd`$U}f&DTD22OE4rdVjHbrQC5
zdkv`6vJ6pYV6dOT#}q3IDv1~vy5BG`bU#yv7#C{*GLC_vM~H!;2efrStdx%_7Iezc
z8wQ3R8wQ3RGw2S0ldyAkTo{-vK1wk#RJ!spC4<(?@G~&<#4<4SM9VWUW<w9GKP3U1
z$UX%MA#fD)F{SY`Fj;J~W?;-NhE}l*Cm%2{OY|`?S)2!j_CyX?tB2tf59o+;P<@Pg
zJoyUn7BH)LNc5kQfEfh0hl7tPla+zV(wLcn$*Pcnp(lrdp(hK(sbgU1sb*m4sf0!I
zDH{eRs~*rgRAbPQ6`;}k4DglQpo}bN!N(NF$iQR?+D8HkK+xTJ!u-&92m=QkG#<hr
z0cOs?&~b*3$seQ%bU_YClfNP;)S;UEO+cXy)#MMJM`bW)VA$Qr$K=k)z+}ZI1iCPb
zkI5a>SzRWSS-`-@<PNHRL6cg`FY__EgO+fCIG|{92k&17<uTpcd`w=lpvsd0WZu60
zd`z|=^WvfA*+R?%*H28g$OhVic8S0Yv<0o4egiYm0cs%VTCXR3Oy=MW2?|E=)peD8
zOy;0DDo_jKbQ&L%IoL6v-pzCyJ|;nEQak`_#0h|sqV-vIa0SXF2sVp>p=TNcL(c?t
z1_qFK1i>9}28N#93=BP>oiU)aF9<rI=l}yl&pif)o?FmFD`*W0Mh1qSUknUA-{g`~
z8Tgn)!Q~<YL$3$}L$45I2@k`^l?)8iZKOaa-taLgL65xY)nZ`iRgwd@7?_k{+9DVj
zdPAT|{lFb?dIb?o)}TpPP%)_jDNGr9OBon?3mL>2;77h3053Zb_{hg(%*w!Iy@Q#7
z8Fc1LZw~`QZx@Ke$H34#mw}-dbbv$x=!$|Z3=F-SV2SWR2Lp2)sDa7EVFBKQyuO-`
z@ftJ$=Yqyv7#J9s8$bbQHyd<ZZ50EPO|KLK!!Z^<#`~bs_!I*}?-2%u-a~Sk41A1_
zK|*gB7<#WWF!Wx8dTB0f|BeC!lZ^-XBxOFvr=aQ|r1=X2L+>Y8Mw)8^z7m_sCIOuJ
z;D^M_je&|+fW>WL?w?x%5(kS}Fo1R!I`cyE<~;C1F5ZcJjGtH;m~1UU$G?Lv`rv0^
z=wk$NR2dlhLKztPyu}%q-673*hWQDg&MWUaK1NAi1}2*y%nZ!#7a17(<}xt!O$Bl8
zFfjBTWnk#r4|DH483yK>%?wPopmT3vZTo}-7X~IDcSZwfTb*HE0RwZ~TM3BE=GTC(
zSOB@zbtXh)-UJ3_1_s`Je2kx28JO%U*cq5ymoYH(eP&?jdko@iU|{HXWMJqwH)UXQ
zJ<h<u`-*|d&IKfMf`OsGoq?gh5yZK~z|g;$fuVo7G?JIVw~g>|@h#$IV6r_0^29|3
zhW-}}4E+y4oI4B*6NDKUCh&qz5rKyTcoPPnG~ZGg1}5A8AaxfR7$#USFibE4aX^|P
z7#Jpmz=C1^9|k7Z2MkPh;-I3e6h1k>Km;nT4;E*EMcV=ckT_VZ0Iql*=;*J_3`}-e
zNFAPp0<^H4&j1Qbm_c)Ypq<Z?-~pPz<$9F>9xgOF%*VJ2-27r-vICVC`8)U+S80Q8
zq7up}&12wWTm@Pg2Wkc_zs$$Dkqe}ZtAK%zaU<wRXMXVNH$FyCc?vl=1Js<f`vY!H
z{s+~y4z7HR3m8GmXc?I79l#@?e2fdgdWCWmD;W3~7k~>YA<!jee2fcB85m4bz!oe8
zH^x9_Xini{oB<uKvybOwU;sICh7QP)pb^*ZTt3Dgs2}V>XH0C5;9~@xohDk&$-uC!
zgpaWYw3P(rhlvP3Oa!|FWQMdZA7cZ|jOXARk@y%J^gt&VLCt7D4u@8R8K5;s%KRWR
zX8Z9m7C_B#uz;EYn%x%!^$U$6_!tYoH4$i2s45?00ch<R%u!Vc1FIm8@?v1%-^0h4
z1U8V7fytpBYGRTh)Kx~se2hsj6Hi+6F($czW|1ImNycoji6D2ixA8GXfQ?~bayZJ#
zz+nG_k1;|EbS4|5h0PcN8Z~+YjqnK2CPtXMVj!kOGB7kZ@iF><O@ZXe&CnB}8K!{B
zKF5D1pu^hu7=4UDu47=BP|m<Gp->&%f@kyr&lWQ<Oqj*MFky-bBw_iugIvqNFkvqP
z!-Vas;1&;KFxWoGh?!e2)TTM0y*T{0_!vW28JHYjf^Lvl#lSG(9s|RKJ0Q+H28Icr
z7#JqJ197%7FihlQV3^1O;v8aNn5f6VFj32zfywP0=(dSl3=9+985kzIvO*2t0KRR4
z$?+_xj0CkYGGV1u$_mI)QCS#wPHet|e&@sn_}a0}Zy1=I)<6scXEE!ge2mWEfMZ~C
z(t-xRGwA3+(1ll^T;&e-G$^X%^Y|FeVQRym5pE8SaA>sJLDWVvFqD1bV+8dc86Zat
zFvvk`bA}L5ggC7MZ7$ow2U*DU2Ii+JCm;hN401hCXToG+62L1g#R~Ws!F!XTi!WrM
zd%Gaf?98jqz##mdk5NS&Qprz@VqlmU0<PJ>JColqFifmtV3-I!A%Q_ofq@BpT@Iw-
zX2ifCTEquBNQcSUjw_9UkC6$S%eg>RBWN=r1N1~XaN|I<2y{7H+IqeR&>(T1$_q|q
z55S3xgMq=QnC}5NZE-L#oV4b908Uc8$r;5Ad=GUQn4G7A#;`B*y#xmuPZ9&)Yf%P<
zSn#dZ%CmhK7=jk@odKH-Neo*+qcfm}1?V(PCYL|pV;K3)7(<fu#6=7Y6KAM_lk^$z
z96tlY#A^%;6VGUXQ}h|oV$?Sb44`?CNemibSDe)Yxq^XVk|_hjBwZzNBEJfD4bwyp
zg(L>P>ktPqOp0V+m=rF}zywS6TSCC8{uSRfRt6>)(6$-3RSXQ1G8h;prGb+6JO+kI
zbqoxXDnOiV3=ESNGB8X6U9jbLh=F0!eg=j~dyy0UqzeoTlg>dC{gwnsqIWq2N~fSD
zwnQZQEj<{Co{=$~bz%>Adl@uYZJ7hTW`$`Y2Lpov1H;<Ae0#wm3=)UL-d=F*L1JmI
zD=2&*v2+j|E}&RC3<;EQ28M&b`8G3xq6`v2vY=^EPy~T@XuHl-1E<E#GLXbL=_v!l
zq`L~441C~C;cpliCi5~dOlF6=O?C--TAWeK*9IEna(%#)#=zGFPKrF441C~yUC@-s
z2s-F<My&u(3IiYLEUH-0UFoOZ@GXUQuEH4@4y*B%fvY%(BV}NBqx*m|qMNBka%m9*
zUzs4d5@Y~v9G|R_p2xsfCJj2gjWJUpmw~SW(m7?AoXEg1ITCcJt?m}SXt1G-pfmx#
z&y+73Ts825>&<9zwFwE)7-dijh2)1A@PsBLKg5978}Jk`@Fjr#1~S)mDxW{x+@}z8
z{l!6UgP7|N3gR~qa|2YM=I-_33jlW^c)=+>05nYux=WQW1a5B9Jw9ugx$Yhib3q5$
zDf2_jwFbMFgMq<NlFu64J%iX`?E|s{<VHKNSv;WQCHX+tHZ#28Ny}s4bJqmd6X6UD
z+Rl86U@M^E44SwGB?j;oM)%2(#GnW{FN|Sw3j@RC294s9A_hK1ZAb!{ypVxm@@&wA
zU8AANa?pfb`5lwlpcLS~9W-^Qd)s7@IHaTI!@yuFXVL~5C4ig`z&HoGYL$Tl6s;bN
zeT)nY$8$~E1VOjSg0H-vy3GXC`(juIo@p}yZwNfa(96icu(QO1@eSw@Bj(>0jE5N+
zm^?tES5A8^7(w+hXoNI5lfi=V8u+MFQ3fUtSMX4c1><!{zXl`(I($th1ui6jsshv}
zUae-qn8V1x<jKRrz%b{J1!EB>l;hTB!B_%LV&K~&Ef~weHi1X2EEwCsG9WwlKn<-x
zSbH8*2r~X@!3b3)z*Ur=%V5FSA;Z8B^NXt>uYkdVu}_MD$y0^})c&$yoCfXmfO<6l
zLE_-{VLWIMF#3u+1H<fkiz}dze#5}z839ff7FR%53E1&~?uxJgFGgAhiXgG~7I#5r
zodVC|x|mzI!L;@Af*s+e2yz4XHgyX>u(!bX{95>fO7<!ST?U4|Q!VU4VYHDK)SI`k
z2aTmK<IOB!u&@VBt}g?r5qV-^0a9}fVyFe!W4uWzX$%&in{XJGf#xwq9$6@Zl8%=y
zM3u4}$Z8G-29sG9%AkWsmO*qVgBqX9c)+%SPi|fYnh>?n01qjFJf(Zv!hj!=>TDPo
zs^>~~gN@DMU|`rDA>Azt%9|Vv45^EyyFtc+?hVy`Bi+jdDm@@wY48P`)pJ3v(sGrq
z25a9A(OxYH)vo<Ux*FW*0PP^Cm97RK|H{U|ka1kPR+fRuYdh2^&{42juAr!i>I`RK
z*cl`Zx}+Jl;lctsA<EzZ$^_nFYM@)or9lTM>#H#^Og_lKFnPB|N^uE;be=w_fyuxy
z`7r~-WYBJvjI+{tpz`Px1H%+%28PL?`y4WkOBaDHXJD8j&A>24Qj~$o+W~yOu5>Xk
z_)c?Z;cdwRS$mqr3_80Lbe6ExN$F5f?Ei<92HBt(29*Y&+bo!TwAH|&7b*+M`BQWl
z7^Y}|R*p(ahk`=!KLf)Q9|ndgE}CE;go7`8W?-07#K15Gw0g;hQyOw$0|Ud94hDuP
zZ3ShCISkSXpfvR#RCgDpmM};sg1B!O7^X~TV3;x$TDxW|FfjQ{WMJ}P0S%gghA5%?
z4zg<)n0#bGojOpJo55%S>;7i<Ffga@12uLg=}DV`R#YDV83BnwGdYkKKxc>hNt<bc
zmYJ}DoooSiGI(u)H0XLM@FczV8)*k{F$#@MP~|mA4_qEeL&{W8(9IT=)?;K~&{u;5
zT^4LFIQS?vUpGk5=}Cd?Wnh@HhJj(q5@`k|-+ZWY@T@DRzqA1l1Cy^oHUpFI3<hQf
zCf^1IhACGV7^a*9ae5dSrhH;xnDT+0fys9X1H)8y28OAO(AdoS!ocip3<@6bO5#k&
z!6D#9xiA$AK$FH$72uYHEUUBz*wG-Da4;}vdq``54pk`UU|=ZIk=C#Rc?eX)$udhz
zffX_`F!^qTsFYFyd4_|5p@?4^e5eIzjcS>Ww3IhU7Z0e0mX-krDCl-}EpKT-P$u#{
z%>fQ-L3xlWP`%+iL24?aE(1d(w^Sd<_#Ye$3~LId`oJX{IA=-qfi{x=2N|Q1Ar$~J
z#;*jTDgad0{D-IlEjVKUvCqaz1%Sp4Pw{|;sih)8De6B@CW93C?ASM=3`~B}JgE#)
zG13f-6TX6?`<PTLs0{qiAOI2v-9!KrFN27K%7HLRDSNQpOF(9U*5EU|0jqaGGRGCF
zK7xTk)?P{hI;v#^9x-EJU^oNH<Nm!GnG8}2AP>G_V3?}Gz%W%o4eV(J(Ae>R28O92
z3=C8K)IbZ;r4&G30f|*GFib5{0}UujDS%oIrx+Nf&S7AfIt`LA89pol*{P7qAf+V^
z@)!fd)cp($Q+Gq7-#CYX*&~FJF-xM95wdI9PzA<PGFB-DUCxv#1rtG+^N?X=%n&SP
zP$*+if{=zPO2#VSdm~)Aq{Lw!g-ve6fIJ!?2J)yl)T7g+85pLCLtSHZ2kIKd#f(`n
z=fIgt#wyT74F@(TF*0TnQglKIJdh|Bt<2~MaS7w>1)!3Pfq_v3<dQ&1aR$aM%fPt}
zB*n(SAR(d5=*!B$6v)laz_?{I1H&{k28L-yrVNZ*_A@X@*fTH%Tmi`(U|^W$&%iLv
z7sNTkz%VV2fniz<h;xI1VOl-|!?bKjDaAO42Ylo-Qvhfc4fx8aO!(OijB^4Q7`N#&
zFa;cAWXuBX0Duh5G0sU~U<y)!4r(#Ze!;->f`@@A0DKD?=YQ~~5$M1Z<D4ZRNsxAM
zry8_Q2WChE15=<R=sd?Y_mmk8U_k)tJ%K_2+<gsFk!N7MAPfzH0_b!F<80WV1A{W7
z87MfKWf>SRDAX}9UeE!tj6sAwi0}jvp&%j=bX9M*58NoI|KUanD1*A(Oo1EcFfuS^
zM}o#3gCNK4GR|%R4R=a#C^K5IGB5>kS~D;OS!Xja1-UZFGB5=Nf`~W}kqsg$KtwBu
zm;^~TjI(<fn1ZK+W-#Dq4lvG+00kj5C}w9cFdo<pIvq!gTbWUb@eLybLyw~Je^Aa1
zZs1L0Q2q~|Ug8Cv->>{%4pgPGFfatPD>E|kFfavAVqsvAyQ$0w?mB~}Cxz!KGlFkm
z1938Bl^Hp}OSVAM@j1$joG?y%iZUa35#K{m2Bx4*u?!3$=E{t0BA~f%(1df)(O3os
z`T5F>Y`Sov8?g)w5s}J_?4Xqb55cNlLsfAig#N`cFbMf7GlB;B8NsT81!EZ)0$r3D
zh0I}Q1*^m|Fj(X(Gm6N-h0J3a7#I&IGm0QodBrj?xP&P)iV4A0#l|u)B;QnK6ob1f
zxFD8+;Ygt}qd3I%0#MILfF?*DGB7kSGB5>$1^@*QFiZlm8~8v15ey9brYIkUCO$T3
zvqnt;l>eHKNi#6D1VK^^+YL}ZT%K9^1S<nmXc$Q55JZOE05mEsFRon3%D@!-ot=TH
z<vat!v>6Nx(^?on>Y^a(I3z%+NZv@f2xNkuA_G%PIv2FWcy)9>=-9ZHV$hI#OFaX_
z^mqn_>5*WuZie-Y49tl=a8uaeEKojSU|>-8Qwd{WYMBld2OakWkzop{pTo$&)G`O;
z4&NV8`3Yd3xGBf8GBAa_VrF3SV`X5NK8b;0`UDV1kbz<PA_j)(pc|<CWEmKyZ((4V
zzDbsW$xjnRm_idZ#|#GM+y~%94H`*yu~%Va%mAHt3C&m>8jvMPp?sjsUkW-6AG{=q
znTt^cRyc5!fYiXufJy6uO0xg|KYU<h*I;1WX%EdL94i=@tk1$YI~bUGJV4%Rae#UY
zd{mEor1EK22Bz3!b_`6<V&O8-BL_KPqgV;by{rsOVeBxsUSMEOox;Erx(V(UTUhDF
z@d7Fbn)?JfF_Veo7EF?p0V??x<VlVLphg|XHJJA}B|x$;Bbhj^fG#0mJWv907N-IO
zD+7aknetRt2Bzq8I|jxBka-S9P6OB(iJY*wlo7rMa&WFJ1LJ{Z&=}x!K^xQ0*Z?Vd
zLD%9Pg|0i}^kHCUV36+<eg?87GmwGt=n|;?KA>B6<okpee{r%iFdp5;z%cy?1H<$~
zAkJY1hUr%s7^YuTWMDjc0en~_<Iy_|4AVa`Fid{~Qt^U;VTL3F!wk?hK1aVYFwF2{
zV3^^=&cJw#iGg882Lr>577&M@fnmmS28J2)!x$KkX+mt~f|c<-3{2sTAXQon3^Oh<
zFw8gujS#K~P_vJLDclWdiX#(ts2d|!2~;{2NxJp~EZn)KfTWS6G6fhwrT;O=-N}sH
zunpWG7C5Ic_6RY)7GhwElxAjNJQmBqFykWw!;H5eP8I{hOgRRInNlE5IRnE?Zw7{$
z?jTM81H;S;28Nj>ARn|aFwC6Hz%a8P#OY^Xn7NICVdg3jXAT3y%(n~-GoP9=FdkdU
zz#zYjfhi&kB(sizVU`2~!z>}Fuel9C?q*<$0AGbw4I4{l<c@)MdYFnOKq(A#1w#g?
zI%WVFxrc#4{tyFG#7dBn2N@V<nKLlVGKLx10yPqRO?wT($Sp7<LHpn`nIId_s~H%;
zMxJM2kiW{n6!8aS<OK$XS^f+Rv%FzOzJVHf8<ge|M)JtuG7_3zd3>O`ovD}$oKQgp
z26#4-@wf&gW$^p}myxf9z%zVNpi7vKn=&xWN@ZY}mCVk-c-)DBVOA*v!>nRi2FByQ
z@(ggDyfM&A;~7CLaHNI^F{(2%FhxFNW?%%H(#pUv3)E6L4oarSeHj>LO<`b|H3{l3
z-W&#I9~B0s$ekd6fm<s~<**~Y7<pS5nB&zMm?FV<p_Rh}l6MKj*O^S9D?DLF=|GH%
zVg?xnzS@xycESN8ZveE@16ijD8+gxD00oCB1H5R70rmYDn4&z95^}}~xO4?nIs;ky
z1p}my$;i2ffhnp9WIH5&D-h=10M83DMa_c9!gO#6Ffc`J0VOZc1tJ-sYvrN7;nHAW
zJf6Y86b1G=#5b@DO&Ga8FfhlvFfc`dPV5GyNvI~C6`*ioV2Wl(7+D2(1kV9T07a{S
z904&BcEcSb&kLv|(j|C^h!ClOxF$LZq7~YCW)xWfjvyG9Q-gtV@^VlG@lOhpws^s}
zc*_4#o&~BP=CU&|{ZnUPn6;RJVb($r$C!a()?o&QSqEhqnEu&=2ybZyrf1MvlXn9H
zF9U-DzoI%T15?aqb_S;B91IMz9y2h^dWg8tkx}Fctc@!21e^#N7&sIxco~>t3ZWM|
z&icf_FzW;2LPwAmNGkxug6KiL&=DjK4OO_IEL_MJI)YR{b)sG9$jG|~H1W^C6ay*%
z7-6@1Gm1bi`(}!n52~K*VI`-?6_9F>kQJz|V*1ww4Lk6C&<cu*prdAEZZk75{hQ6e
z06LLv)_-sqL)C%KJY--{Fjv$RW?+hChN%-^V3^H^qAmsGTm>&hEkOpRSY>OldD09_
zv$-Jl@uh%{bykQ{)CS2rTQe}tmV%{x-a8;SGBCx05&)vF!uta%3_1>!(FmrRPXH<m
z_P+_tqx=dWVNeR<Fk)cPV_@QjHY51q=M(dTW<x>FWKf>VD$Bsc?F$YPov#ol@|%DL
z#}tZ{udp&O#eG*~VA5q`n#du|z<3P0#Gk(aRG2ArTbY1Vfa`)c3=Fds85m~Ef(q83
z3=Fev7#L<-m@+UPXJcScSj@l_R|qQQ*cljR$1*U?4pn4eJTAgK@hZ$W{8vC_2Ln@F
zGRW!0paWDuvY?W~0haOwAj_zsDTcoXl3n8ZK{_CXK{34a5-kDAqR7Clf-WhKI|q`6
z+)@uJ6f>AOjNqY|0a|*EQ~+gaAT9l`Jpm4|7B5JE34m8`C~Q-{!O6f>mLko-bmJLZ
zhLwRq;gND9D+5z$p*RE61vjY74p2H!<dtXq3zG6@XJEPz%)l_ai-BQwizx%sg#-o$
zMGFR|_&ktIDg(ppl?)8CmxDTQ7a*4^GKww%#e$-T45K+O15*j;Fxv}D7#L<BVqloP
z52R}&1H<gw3=Fexf;jsa7-qj^V3_?9<cOOPM~H#X>sKt6Vboz|U@D1ZW?;JTjDcYe
z2Lr<#7LcY-3=DIW85risgE;>f80Oe9FwC)HXJER>#lSEpoPl9ZXdMI7MP-nPHUq<)
zYzBrosUVIi1H+tl28KDUpcB<EIzp_INB~KBF)+-T#lSFUnjHgkoE$_(ECkjr6bk_-
zOa=xSnNM;IObOGN8JOer85rhlVqloF0mQL}aiEp2SPBDU_FT|F8W$s|EzZmZ8Z?z=
zV7gcbF<jgN98R-j{_`_1rEFnlV7l1Pz%b_+1H+s{AkJ(ChB*%z80Opsxo$aVVu68S
z&JPf0GXuk1aR!FD!XVCm28Ou?3=DJiK%5&440Dqh80IF}F)&SE3bhAzcMYRBYzd@@
z%wARorbIVp2Bzto7#QXjGBC`|hq_yQ3+R4PP!a@XRA~mL=^{{b_JF!Eifd&K@G~$a
zo(JhwVPKfs#K17O0jYEq-vbLX@jcKmW8sRk&|_du+YC1d+M_~Jfl|66#NnlD7z5MA
z#}NGzur|5@15?rrkhh;OFwC98z%X|LQpF$vzrsKQc7*|l%rRaDrlc-t#V~g@1H;^v
zNKTgsfNgMrYeB0RBm!W$6-fn((-Gour$c*C5)R;tGod_j9}o}5$pCSn1&DYD19M6^
z15?r|P(@x1@0*D)KvE>30af%4)UY#z6-5#kK*CUiBtC#R3{1(wAcHF5Z2?IZ2Ih<?
z2Bu_fP%PKNEs#_JsfTKo>;Z8Ym{JlL88as`m948QTUTeOqGYIo#N_$^|Nnm}V@x3>
zq7<2d1_v=zDseS1${ArXlS4sO#!wYQJsquAGE#L=DQ8eDV^D;p1Ia7UaH?Zu%;YFz
z;5?zi`C1hgAChm7;!KJMs&pCXe8_4Bj_rytby6xIb)fqWE=E8Tc>-+vk_7a0P=){*
zMlMzcrc_x_>5$66Fn1RN!`vO9^bg9vCm9&#9*3qUi2{&uFwO*!wJ^>KkPN7}zH9`s
zNJ<A>;vbe_WENy#Dk^4XV7lzgz%ch71H;@q><mno{TUeMzGGmR`$mz0>2fr<#)X$H
zQs99)#aA-9Acui2g8-E$^OzYJ<}pHTl$rr5Pe5&v8}FeuJ^&Ydzhp{T8JLQMm>HOE
z{9$02C&9olPmG;`=_csNZw&^9d1@ez7z4vR8wQ4XW~K~GH}x18l%yD#ia?dXO??K2
zdC?3E^CHC=m~KKln$j^Kqm^vs8DDWSFcqF*W?;JM!@w{v7j%j^$hb%bhIt(f4D(t*
zoHPc8d5aks=FJCjiWwN@?PFk=w+mD?+-!h2RR&bv-UMm5&A>44Y8?a9&8Z;8a~T-s
z{bgX7_gkES=@zuQm3{-ZJ3*dtKQ{wY2I%~;TQLj_^Z6JU=5w(#Fx|>zV3@DTz%XA`
zk%8$}8S}(93?N1`s67Fap1{B`--Ur;zJoZT?3Q5xn^`5#sLRU0lm@CxK><8Jnt@?{
zB(%Vm5dZ}+v<WHBz?@MAb-N0vyjJRxXEc;%U`jW(W?;@}w_;$<gbq~5sDL6~sf*E^
z$C`mTa}9Wv>OFp_W^m=CG)tb*M4W*sy@Q#7>7G0T!~ARphWVKwjy40s{3-^9`OpPN
zj4~b!O!uyV3KVdY2Q+Sz!365wBD*L9?3-2cj5b0HOzBsdK`vronBU33FdxNb8K40^
zrB#gPJj@W6&0omCFn>O1Oo8d{OQ;LC!1|vuuvNS=@{Eq03``lh%nVF-zcDb(-^su*
ze>=#vObiV3PcSgdKc>fkFklbd09ZvOBA?3$(|etPVg6N^-e(L9^Pj-N`vkI2Ge86E
zp!@`@Ze<0)p4=tR=*r5#lmWVr1RP~w85rh6kD+6fm4QVWVk4x?0tTkL;tWg~Cm@GS
zGlEX~VKjiX{A5wW7ZS9fEU}7#LFp6&Q|5C}vRuu;uz;O`VF9x|1Jf*MqgZ+Z%$pz<
zxJKrYXIv-2z?3-|S`jXgWnfq!jZ_gzPk<FZa6M=hq4We;EsvxEr6NR#!z)6hge?tj
zBr4sKXWYoiz?69b)SB4Dz_37<fnk9*G@zx|KtqWMG*4O!iFWA*P#S}@j_Vk}Y4+wW
zh?HyuI6=RXXFM**z*GQQuXyte1H%G)28IRJiVRFQZ$h)$&1Vb@3lbR^7KDNV?K1<z
zf*A}93nqbbBLnlq2GEf3EnWtO1;-c|7Jyo;x1<;t7J!t!1?5w928M-l3=9jUKpYbW
zhK2SF3=2)`7?^H3$}=$CHikO}vf!Ih7PdanMxHT}pMfb0)SJ8Q!oaXFkAY!f4l@JO
z?EnUbg|!R}3#%0wm~O{_N(N{U$W8zy3Q+Y89)e<-*ulsK$_30B$`EVhcwpUMInY8~
zQ1o)hGsbc<Fl9S{vKPpGeGCi>d-M<)UycXX%t7d3bbw{Gh4UF07S06)EW9L<ivgLd
z%qY*8D$T%@-3v0foq=KD1_p+O>ySzmxfoE1qs)lNw+r_(Ff7~)axv4b8&DUQz+GGd
zGM0gXVUIjxt_}lJ4ygXP^^$>M;W-9|g=av~@f8#npg>_{p7?`-oq-8-dd<QI3=9iF
zRnu)r28M;-7#J3Qk!C=I2>8ZYWkLDh)(lKJmLRv9Ffc4)WnfsujO^AUV7Ce)JibVb
zfnkvdyp<%k1r+oQOgZtO1XmAg!m~`A0M3=5at&I$$=v}B?m%Npo&%%>Q+XpKo!*)U
z2?2TV{z+v;dB!$w2BuulfsD5{Ffc4qXJA;Q%FMuYYcB)CA~ObtMJAviI0Xs<q(W34
z;&4NGMgbuPrd%nI2iqAK7P&GoEOJKjp!^X~ZcsKvM8={J28KnTbMc_gxC3!*CKEVq
zfyyy?2BssK5LpHI+@At;?vL?`JmWNe2Bw0u%nVFNDj66SB{MKAN@QnXI?~F(u&A7Y
zVNoH7Gm(K|(F_KLMbqpUm~Q7mO{;-Lx<U;!(p}gl>oG9p-UX%qE(V50D;O9SEdz0;
zF)%FJ!N9O+8;DcKz_92f1H+=@ptxVez_92B1H+<g40a4mN3KAPz5+KIwioLR+iU>_
zrhHJPb>t}n!=mR542zzE9Q~1jVbOO6hDBdN?)=NZu$Y~JVKFOG;!yw}5}@qJ=FZ8$
zlvf4{TN4I`#bOK$i$##aR^bJxf>L%wB%Z};3=E4^7(fm?Y7cRkq5#ZciqP#U3>s|y
z{0vNapmR!(#xO7}He+B|42u4v0SpX_-53}ayC^a+9nAp6I5bHqnjj(x+_^sr9k5aK
z097-}fo#Ft3{3gj%nVFN)fpHThcYlM4hC_g85kC)F)%Dn0hwroY+?bzM9?sX0eCb9
zR_`lTFhKieilE_DP+ZBdg^PmfL3sv-#ia}ki$N{Kd)f>Pi(42N7B|7%*@IjuLJm4)
z0;PKfD+Z<`(1fqJ2khoVwz&eJ*jUfNuy`^9!{Uh`&Ta;V#fupj7K26xj~r)USiG5m
zVev+!s8Iy(7f~)^E97KgDiDN4%^?Pc#Rrh0M)3?dYKoAe<`M(L;tQxz^93F?UqD`D
zU|`T;s|2O(5>VKIqUI3;!{P@Z4k&6qF)%Ft018Ots8N!^7m!LCFe{W`%Oxe)YC(-%
zP&;Y~69WTi$0ZXeAeVqH6Xu5oq>>GCKxRO~5Y`BgOF)qX)m7lK71kz_T>z`=K`gM(
zWaJq^6R3ra(00ud1qOyCa-jGGIYFO+VTmqMn@DyA+yMAk0isQ`#EyYsi49DzF9X98
zZ>Xzfx1cx-RF=Soxux$gFcr=Q6^igm8#-hz^M!$_a4U)ow33&7fg%d)Ye}ns3R?!I
z!Y3eU4tU#08a~f~)b`{+O#Mr}U|^aK?;}gufVx1?Zmv`esB^@?RAd2~Q+2R`ud$G-
zfl35{nqz_u4K=Vxkb)ml3-J(S^d4lLI0MtgPms*7lmf0^nq(MRSQ(g#L8Z^d{|pRE
zVi*{fM6ok4UE*e7SdzoQup|q_5ocgnQp3Qoq$-So=@PVNSAsQ4Ll~Hfvq7p<7#NoH
zFfc3uomO(mfPrDj5(b7Pi|iPf?yQAcdIQ#MQ-aQ`Gcd?3;bmYd1|3#>XD<W8lHCjp
zOF)-D-8sp?u;dg2!;%vWcJTeFjLIA^1C(K_`Z#2kfeeUcW&mwZWmxi<fnmu*259Z4
zbb^67g9FY(9>q|a0SUk2$)L_|IRoc;DY&{d3`~~-p%I`A9mpsKU4X+>2M>Q`7pVRV
zpw<uQ4pN98l@mbXATiKY=TJk$Y9MnW#eYEEAo#q7*bdPA7XwoX`1I>qP!$edaFf9d
z8jFMJy#iI_!pNA#1WrH@MTiL`u|J>z6NogteIUAlf$>8R15-&ENCIs}Mf40LrIz%8
zB;hyKGm3tITDB1+4jSEs7L^DkVj>KTpTrrMN=|~5Af}PT3_u=dU@CbC@;v8%SaKBe
z0f|G!7~~n4<2OM<O0)%50*SVOivk7)0U1U!UIwO8ZDt1M_`?hgOMWphEcwCU!N7E(
z7@|o6+%{ogU;uToFH|rvfOdl|WrvSn3oJpK0?(WQvYI0WR5>xTKvTcK2XH|@L%D^O
zfvHS}oq?I<KLf*34F-m#O41C>iO>Zaf)d~+$_f?GRD0<yW(MZObOwf{o(v32-9emU
z28N~43=B&n*%_D<>lql97BVm_&4-l+0)H5oE8Z|LmHr1sx`7J=Gpj5kn9^i)frXBs
z2uKl{9B4-&8+5c<&<31QcPO`loa!mdz|6K7nz{uO7?``)!BVZj4F*PmJy0ou7YxjL
zN}xdv({4z>31%>`GB7BgP=3J5z*Hs5&cI|kgMndb2Lr>>HV|hi1H;nk3=B&_!w06D
z7#Nl=V_;ai1SGScfnn)Z28N}eDK6793=B(;Ffc4V1d_SQz_9cd1H;lQAkH%ehNXWQ
z7?%D7aXvFJEE8j3SSBLNz+?uB^n`GzGvGCVAarRP0}mh5QC<e7as|+)+YAPVW$FwJ
z%Tz&QP1>&@np8MoDMbaA?HTx(K+`PcYh)Riw7<(TFzGOZ2+(2VI?^DPI*2d^5ulkn
z9q&2@CY=NjHyuQP78mQ(fmmH2Vj7581R~afh+QD!7>Kw8BJMGmGBBC(GB7CLVqhu<
zwe-w{7#Nn>GcYW(1xqO~FetxbV5(43WMDE=WtzwV&AO@`49xB?7?{d`fwBsyG|ph+
z@P$Ra>JqfMk}S|%K1VqNhlL7<g&Jt$oyjbcfdO=?b;T@DKt_Rxbi^?VjH)4^#)Jwx
zAJaEUW(FqEF$&AV7#Nm?$TBdQHzAHs04d~PU{H~Q9G_6p3^`^8S~;rh0G*=)o(W(E
zP3wVtYs|o)V#L5yu@+<{Y%?*VU=1jDF)&qtCVpY_)X5c$jG2t^>Pv761LH4wXb1?N
z0Qr%Dsp2p4oX`eX7Ex{iow&ikR4D?^B5>h3kiEf`R>-<`!1l93%~sw6aZF_#vMNw<
z%xDNV=>^38%4Q@rDHA|NLNUCgRAGS{v=T{C<_l1T%f)#FmcLXaKyHQFtzrV=Ffdhu
zb_XJ+994Xv*1bV8DGNS;t<nPu8d#{W0I5Y*rvNIWm|83#iC*vmD8s5aDL-LlU}_GM
z2HmO$mtkjMP-$0Q!pgu@yHK8iiH8p&BLvSVLa>bDz|YDA%JFO28JKvC85ox3Ffc4j
zgStV;1bW04WaR<qpe@imKO<v0h?xeiZBiLcK%H$SZs^FHDtJYP%1nNiznlzAwSnvm
zOx&^z49hwg7?!nx#wNM7AdXT0p~%3*Z3G(AkY`{L2!x2L{(yDvRewNB{XP6FxA_^E
zs(&dmFbO0>ZhaCc0O<n>)Pnj3><ml-T?`D%W-~A>n=X%-s!>ycwFf~guz4)}%-(_w
zOx3j>49saqAeJH|p<_MBMrgp=6l$=BFbhAkpAZ96^#Nof;F3@ype3!E2?KKmY+a{X
z0raj4Mgve11Lt^<KNuO)LB4=qog~h{#Qy>6uq_Ore7TCB<pDPXQ_Uh~1||W128LzZ
z85ovr1#y@d7?z!3U|4nx6cjShu+an=1`;rXjyec9GcYWB$H1`c4K#hKeE>OxfvKhu
zl!_<50pB74a!xu(2gn`pJG#{kK<hF<xqsqSa0_Ij2&miT0*-WkYlu751Hc8%UVfG*
z+zd>$&ddx<{Jsnf%NZFMmi<;_VB(L0IE^3dPmn+f$Rc(ICjLeShULl(49lUnbup@g
z*T*n0)rx`&#fhq52ZC(QK-7xrXF$#e$%C69OdywoyEfo}{J{Y604!%}Fo15xgJpRk
z2FS^CwWXjk1^MK;EcnrKs&7EI*@5Ii@x;pGz`(!-^0W~s<-34PHvs2FBj{MJkO!y|
zRyn5(x~a4YeCFOa28QKE3=GQ+*cq6NnHd<CyD~5=w>M>AG8SN9P!(oiss(LuFcxKC
zSf0YbusjKL^n?rK^czMUa92@PjgNUMF9TCu95Vy6O92DJ@>&Ll<&}X9%r4N0NS!mF
z1$n9tER5o;)eOuo2Vkp1k15Ot@y|f{%#-%a2bpn$fnoVH28QL6Kyk<H;sJ>}4Ic(Z
z1_sqAKIUFt2Bvx+kjhX7hUM!S7?!UVN7$wTUjC<A&BCa_%D_~25~S_`1H<xT3=GSU
zfH-Fu7?$5-U|4<!!~xm$gMnfB7m&wb4JM5<pm0*1z{04>$-q<(8nOemm{#yJFs$H(
zwwNFsXp3ou0t3SeIfg()n@ght?Ak>vjH;mfqruwE85mZW!nAuZFsyKcX^&uFSP=&C
zEp*me1H4H=bq62wL|z7_CQXoAyBQc(6f!WZ$Yp0>cA3Gzu%e5BVMPasvy_2h#bO4A
z6$`}~m|Z7A!b?*C?1>jFjNGgYOpP4O49u?c7#LP;Wnfsbk)46rbrl1{iYp8ZE6#v8
z+ZY&DiZU>)_zmJ5VqjP~g@IvZ9f)&|fnk*x1H&p75a$*H!>VishE=H`&NBvvRdX2_
zR&`4=FuO6rZDnC#P!nb;5@TR$_`uA->?Xv(0J_0+)n9f7W;ZzohSkyx46DUK94!Wh
z)us##tBpY%GX{p$t_%#Tok1KY28Pw43=FG-K^#8@hSjMI46BntoG1o{)ujv!tBXOF
zmclJ%V_;CzWeMhFU}{(hvb2qXVf8EqhSf6|!Wfv{Am;)xYJzq(gGyHu2BwCqAk)$r
z7*?-jU|78zS`2CifR@j|a-`-D2Id9Jpi)|(dnT4K6f-cpeqvxyvj>I1X9kAVyBHW&
zZvzbvz|*_N2L|Zq5hNBF7#I{-7&$<(5DtpR0}KpnJQx_(xPdrl7#P+hFfgnE=bjr3
z3~MSF7}k`5l9CIwm9MP>Dzwy6SQz<OK|203Fsx~3U|7=%icxL`hBY%77}iVyIY*p<
zVa-MchBfO!9AyTEH6WYzfjIgM3~SCaFswNX;#e~<thvX)u;vbk<Icda<{bmWnl~U$
zFayJye+&$3{(v~~3=C@p7#P;_m@+WCW-~CTl`}9k@yaqVyB3@TE!>7~InZGN^)A%P
zS>AHOnuOX{7?^!PE8v(LPlC!~MhEcvOD1Dw1_rfu2Bsz(Sq3I!4R}!(1KO+4z|;iV
z5W|FM&<Hhv4oG5PYAOd6p&TDTMH}dzPGlty7?_N`8JL<tHv%#mf?9C!6?{TJpmOU$
zC8QBV4jP#nJHT>w49v2okTfLB0INSi#{+>92}6VODpm%jW>a<sW?3f&hP93i3~OPF
zwuL1anB68rt0`dv@De?yW^i4A7%&k|0Cht_jt7_jpxQKp2{eKMZMO(7fQ6GEXq9;;
zGiYE0G*GYwx+q?F53I)^3>&5hP<{?_)DF;|mzfL<YXcY<*80KR@qmHpO*R8l^J2K2
zpgm_$+eBCx7`H$#cZIj*L?jrPnvXGLFfedUSKbcI#Is;c8t@M97K?(UA_is1d5ef%
z!E6bT=NOn;BtVreR{=PpL3gUKaCF+hSHjOW0I32w2ec;;)(bac0Bts_ovFN#aRMU)
zLuQ(C7b9Z~14HaQ<$4gk;+Jw7qY(px`zmEG&|Z<29Xv@Xi44kqatur@JJ=W)s#YpP
z&M{|WU|6?K8Gb1Q-+JX}bq1!Ey`l_EEi1Jd81%L(hd?(@XfrTmT~$sp18=qft#RXC
z$j89IpJ2qmAeOGI2(qV5hbNOk8GI2NXlGgr=$K>O+sYc83=E71L0dvv{<1MJ=-yV=
zfs3^ALqzltB8m_ZLsposR%3{W5kkZjB4UgX35ST7AVe}DBBltDYKVv#LZlZWVvZ1*
z4-v6Ih-`$2SRzCYLqx0)B3B_I)(Da35D^=M$WMrfEnK9H8zN$d5Rrw5fHveY9%O)Q
z|5bK_$b(W@&1ByDkdbc&b66_71KO0*c2A9gLHiBweR0suISdSIlNlJ+#;P$ebjk4E
z2OX4tih*Hm7X!oE7BvQj`QLf(>w<3UU|?9gk%3|D>Vo8w3I^VX0t^gMV(=u&V6lXO
zseJ+iQ`>G(0tDwl=EaOzkYi6Wp`{gr1^8A`@VU1q7{IrcfmCLI?rsCQI46Yn1kA;t
z9f6>t0qo-T2@n^bfVuc41H;<O5Eq|-x_BJ}1H;;15Eq|-x_F&B1H(E+h>K65x!C*&
z#KrBo_*`s$2in$UnTYCQ1Mn8WRqJ?XK_*2ROre|l852NZ+^L}f4yRel3{0IG3=Hc6
z85q`isxdIQ|K^=#1PS+b^$ZN_$|1g(1v(_|6a&M$O$-d{R%n8@e)G-&ZQulnJ!4>4
z_dp@9G?#&QE=X({1H*dI(b=FYd1N;7&I5`4XJA;b#=x*%rl6dGcRnWrQ>QLyZ!zei
z2HpiQ1=S1;>q{Xe7=syjtvv%%2WSHX<f3OpY0qF5z`)dL%fQqD>IQ>lGZ8DZ8O*>J
z;V>|DECYodVq*>yM+3B`VK8ff8gK-z1la&^LSSI(cm$KpK-PN$qPLR)CJVM4Qn-Q+
zzGL=MXJpJ`FJ&lZP*P?DS2v7|8LS-j#SAjwQ--6&K$|cBgNy+m5a7=c!N9QL5w9&Y
zvOxDHfKnIZ2T)}7PSGf5;I)-!U|ht`z_9)R1H<|q>EP(I)dNKzW2Qn01Ft<O6i+cQ
ztpCEmu>P4sA_K1jNaQ~Q!-i-Eh7G|ANesLWpebvRNE-vghB}3023`k#1_lO@$VLW+
z4J#E=7<e5(hxCC&9xyO$xT28C!0P}yF#SIR!$xrihK+&>X$-s$pyUq{v1VY{XsnRV
z!0P}y%?~7!#=x*KP9cMV*8y}B0Z3#b1H;Bng%CpqUPq{dHg08L*tl6C#E5~{5xOyV
z;{^tWjfa#N7;5+Mx`{C`^)7*p##C8IGcfh81lP?BQs6l<#?!pn0t`%DpP3n$dUr7}
zY|dq1*qklRz|;qs=m05WVqjpr$7{vIz|;lmclLELFl?@2VAx#6%)rz)g@IvnHv_}w
zPSCn&Bu&t?2eAb-Cd+FDy89EXc{T&X=9w_fs~8wIuK@R`dXGX~1|ITde8-!u%fQqP
zn*8a##=x+7Hv_}woyab00ky@M7<o;37?`^KLFR#6c8Y;v^9c|K<g%L#44bcmrt#n|
zYXOa%FbVRSN`cgXG`wVB*bF)<2key}3=EsUL0t0?;u>l2niwWU-UcBCrXCkiIDKMZ
z0G;}?g$>Cy(gL6cC6hTXXoGt<Xl5AX)h*%-3|l}mkRZdis4*~XQ2`CS!dxRQz`(}9
zz~s(rAkDzk1Daq1YcgYC*aDhb1#5C;VA$e}>;-87P|uGkoYz1L>V++#3=CU9GpAq;
zDGUr-lE7Z*^MreWhk=19owq@rfvKkrq$`SnVM{3k!xqqlXdg&N3j@QJCXh@X1H+cd
z3=CT)f*jiW7it1{Z5mS*ZzCTAQ?DmT9UlY3mPHH<TNWS(LJZhHy}a5W|2zUI>tbNo
zvXOyd%X$!J3IoHI0}KpX_JPcX2SN-u<mU2f^Dr>=ii6aFG+kt1*aBLp3-;3k28J#7
zPy!(a90+T9wc&yAfq`MmJCJUWE&mx9w)_Rp4);mIy}$!!fl34h1_9niaGKO&VAv|a
zz_67Mq}zmnVXHg?!&cBr#XdU*hOK%G3|n<T_x3U{a)ELaw3yLnVCtQs#lR3giPr+u
zy8RDI8Ao|57<er}_0)gRsRBK$yvA_3hafr74P*>pIj2%yJ-FOokenXqv>ULT|0iBe
zm|UMENKO+jmpqSG1uo|al2ZX4v-zL5l7UwRboS?e-YN!O6>V@~q{YCH*~2RjS6>NI
zFAqL!0Hj_Xyz?HUULJJY57=(0!@N>(_47gMr6A_#G4M)()K`HjaQ{m@`=AxLF?63K
zBly<330>d{oM#`j0^jP&z_8U?4b<e|*#`=kQw$7S8yOh3f~v#$-+A^yEAXwm85p*1
z23O!b2Lu=xA|EnO>|l~+V448gEy7@u0P6g+D)3xnWnh{BI?igsbOwg4-xwISK4WHJ
zny{FGVVe&F!!{=nXFUVMwk8IKZB^_HOcQo9Fl++}tOjw8GcasB$-uDfD2Q{JfnnP-
z28L}96d9N%+=mQPO?b&XaRn2!_%fLSY7{Uq^)CR`Pmm@|8EkNv!Q==7(?o6trhd@*
z|Bzu)kfUK0qsaqMGo68{A6)f;G{c(eHZUco3=k70Fv85wL^i=R0%H9Hd6+b~1qF4S
zX$e%b9ZVLY8CrXq&H-5usy&Mt%1~=h`!Z1N2~#HlvIN{z+rR{Bs)1Ypx~Y#tfdO<X
zL?<)PB+#Xd6Tb0+YD%6-$_z{szHxvWI6RZU4IB<|>`nqVY}h~z8lEYj>gf~@s3F5M
z6~qQzE+?~*XBvooil>}`XF4YX(}dqVpjHdd43Ox5Q12n~A*eP#1@ad-o7sbE^OI#f
zmeAT<0=gL#Qkzdr(kN%(v6KfLYQw;=otuGSJ2SX8=dsiSxe;8O^H_sSKgGbX-JXGA
zyP-lN0}uG*6OhO<28QkP6p|QtY(TX+NaPX&!}e1O$qYO;pxPWH@{fUG`!|IY1|Azw
zZGMV@VTTq2!ww~dR0bX!P;Cwp31MK^;ir(sz+(fd%|RlS3=BI8719}aY(TX+NMtDk
z!;ZNM84Nr&pxPWHa*=^y$4O9a&SML8;*M_&3_HGnYI7d&^`55~7<RHVFzjRo*XBG<
zVhl`Ei(s{R%?@b>rm5wSGEJfbT%_ISNfuyWnsktvfoW<71H;Y>3=BKZNi#5~DZ-U8
zF)%QE;xXf4V4Bp-%)p#x$iT4kJ_EzfyC9A&1H;aD3=BKpFo5<vAT&W!9Ml#D1{NMO
zNsxMw=6?(fJO6+<whRorco`UWaf2(Lsgt2rP64@$k%=c+i-Bn}sG6R-gn?m~ECa(X
zX=Im80oCS=qCAE?3`~<{LFO4UFznJ{VA!Pv;(!ddW?<N5$zX-#ohhK&oKcm>Py(a|
zq`{kkVV5U}1JV%1z_2R<;+pjk*GPh|M`kqTsSsjdngXhErygKn*p<b=uqy+}HIfRT
zI*HMPM+fAZ)gbdghF3B$>?#LwK!$fPFzjjrO~=9lS5g5~`!PoF=twXyO$HqV3kuv_
zGZ+|lfwtVFfix{=VA!=3*$a{ipo)w!gGWadWH88<?F<aNwt_ey4aXQ5b{zqGVVW4+
z3p@-Aj1@c;G7L;pLYNttrl~S8?7GIlunV*}Ynna-!>*?c47)&!xTje%Fzoumz_9BR
zsK%Xo8frogs3>LZ;Hl(eV44c5ai`v4VA##fz_6PUIS_Kd{+Z3AF2TSw1+-BJ<e%L_
z3=F#kpw8Q^$iT2$9wiWRz#+GqN1ca(Y06WOIztAA-5{(F;@C1U>~>&a*lmXr2sz+D
z*v+F33xwSP3=F&dU>f2X7<R{kYxAkk;a-5&=8`#}^u@ryAiz^80ZRAZ85nlwGcfE1
zt)!mD$iT3>j)7r!4Jeqn85nl=GBE7!2G`~cS3$W6TFmG(FilO;Vqn;k$zuYl{Z4^Q
zn#^0lz+(c*t{}N29(}mndXStxT&`S)M++`@8YHI$s%1}sS^?$iJgRWH=O8&%h};53
z-^45i9?;==rx=)~iGidPz~u#RB?FHF=o+e1yj2W53ZT>MPBAQCbk1Pl0n0NmO>+UM
zmImEdb_%3g8eF%6R7-<qqfUXwf)tp!>KJ_(7&cGhLOzd696Supz`zgz>Jm+Rtx?Xv
zl_$%<H0?D5!|nwP47+D(GBC_+<pSTq_mF{M_dW)O-Fu`Nm}dQf1ittOP#iO?=PDLq
zV48Lnlp!Ir5)9%WKpB!@KbIa)F=&d7fq~&XbWV%`THQ$KfEF}?hqpj8%6tqA!Xh>d
z486%*;9Ib!i}02+a3#ruoWsGuAfwHd1iF*(6zHHUS1Ya<&_=XVAQLzk7(6y}#XyQ+
z9|i_R1FmqeB-D*FpveM!G|cp+YGAX%L8}>0F)-}D!N9Qlk`<DdW`K$xhI+0@ePr*<
z01d-3^dos^KFm9y!<r8HaRst5GB8cw&jGp?nk!I{fq~%^NXEv9%MUDb6Cwk?m*W(J
zE(3#T1D7`&XmL11!W*I`gMq>H5|=x)Ni_|$XdL8z@F7DpBh|pByF-*R?Eb~Tu=@+h
z@sPDs4Aa1cKhIk(4_45s_+1PPd!!f`_K2}FFwHu~z_7=afnkp`h;xa7VNVDH!=50}
zUNdN9PV0b<(L#*@_0_nn1sRxT90Sz>(1@MZ0bMhXtO|L}Jd!vpgg}e(Aq)8#rk#LW
zasuQp1_lNWE?ZuZYu__4?8#$b*pmZN4s+89xNR`ysB8E^2ExJ$p#s%CaB-M>7#Kh;
z*O_WuE>NxFpqvMCP6;R@%$foTW*2BM?`dRU*i(%Z%;E~*G-AW$%4*HPG;0?qL_xtj
zpMhZyXovVLQ1Gr}VA!(;Ij<;ylaN0+NM|u3CoXVx!4Qv>xbk661%(AP=)@afK_?DN
z705w%f`MTVXlDpKZ#KY!4z3(6=)@bK%VZglRG<VMLLBBE1_n^lEn(wwWMg2OwHA_e
z9U%c_#K6FA!DR^=>Ya6;gMmTqK9?m}h7EM$7Z;@Y1wN>Z3)=8<XJ8PU$Yl)5t#3eC
zkQa1{8J96w6GImx1H*!PE*+5UDMoh&hSL|h<XFM^ifOhQZ*DOImmKKOMR18wt<EI@
zlXK=^V3>4~O9E0N*f226wBZs4xoUPS2Lr>(9xh=}A-oJ!FwV5&;$y5}VDOXHW;6%c
zk?=qpd@kS{2Bta1y!izT+M!wuj5&wd7#Mt}YJ+xZ%_(LB9pbAEKHv}3nw4Fk9nZnQ
zpeMt|z;NQGHu#XgH*5?H?XlX);N~1pN^T;9b_$ry#=u~DT00H2@B(zRpQfpHI*jew
zr=7{kz%-|VC#AT6K^t`ZIKwH>XuP;K<R+vl28IJ)wfBoMFwIc|pK_=j#mT^!a~3=h
zJb8(BGpOwfGWGCd?G_l@rCqxf&hFE01G7OR$EW4AI|LXQID$Zf{9M}LL+DO1fQQoj
zp=A-%oDOiU$jxBSz))~QkI{gUfoaYS@F}2rjF#Y2KtZnA3O?mikI@Q#@aLQps6vqQ
zM&T+z7hiF@>oI~a&zfrtzSdojkr{ki71VTAu<4-tZ`$=3*|<Q*q_Tj*R1a}NRfC-#
zBbN*VgYR6fOa?th(COF=Z$KTDBo4j5pe;~yQ#nA#UFrP=rGzS8&@otge?c{M6$jX;
zzv>JOkmES_UDo>qN+EL>gAWkZ`vkh1!VaS9lMyJ*aeyLS?-S@YAy5$4d+L1=V_@*f
zWC&+qs92&0Ie`>X<6MO<T4Qtpl_v9hH9*JS>RkZ^<tYY+J+~Pc_FPqCVBm1jyQ0m&
zAk5Feuotv{<d-G`L(fjVYvK${^LrT>_9`<l?3D$H?bEvf6LVr<*y{i}1dkDPI%CBW
zP0&e|dXK=zHZm~m4Ps!}8=wigbwlq7D8ap9VAz|;z_2%70d(Y~9^^VP28O)_3=Dho
zHZX!xlpgf3?rTRx8JOlZfK!&<bx6vRW?-5>3F<5Ggo5xHy}PUoO!Iy-GcbYnvhA&B
zVAxv=;;d$1*xSdzu(t=q+0MYQcP<0N-q|3|VFrf1YZw^zt^#q+GcfGk&A_mCC$trC
zjRo2{g>;*tvv>~huJzRmklDZa!l1q_hXbs`e9eV{$$1t7(|iYzICwl7yb>vcwVZ+D
zzZ4^5I#V$dTyYNQ!Wjmp`QU+XjsT?N2GZcyNL=dyop29x)*1$;E%hLy!QFMxL?5VI
z>XT{2z!0=o?>H#2%)i6Iz|gZ#@3<-`#vlpjxE<&~Vo1UPO<gdYf+U<1pf+3;_yA<R
z6QCmvt3d6TVjsONpyKTf1JeROP-&yLMIBn&$S%;^i6~X{c7Y=kTng#!1E&UXDWrD*
zB)*IXoWj62kAh01_E^0`An{Y6e6EwCw;vLjpeCp}n;z)2X$H_uM+*fZ?kofMXTjE&
z>42=~O-@N-&?^@L%>hB2Uk++)E`vC~9Gq)FM~dFmD+ldjUj{DI^(w(uvN14(i|AEz
zFfh1^Z(?L%F#l}9qF2Miz_j2669dD%hkCV&3=IC<3?jwpsSJ8`AdbBO15Z(EA%kAM
zHUraweIQ3464G1D3(9sN&b-BXOCePP1E?Sha8P2bVPs%hm<TQ^lo(sUMTIB>(?UCN
zsiVZ$3NMHj2BHc<3L>})P(jqTO^GoR6rT%0S5RrcQDV##0UebGH9Z?_I#*I+5rYzA
z4%m<2f=G!mAIxD;VPJ@|SAt%Q%gDgAND+MWz7nH^H7G4`GBCu=S7MX^UDyCRSI^i(
ziBSrylZAnS?}HMf6u1&&VPLTQsKh7*N++iTxIh)55@RqV47jowlo;(LK_^+WFfb$u
zC^0&KIH1xxf`K7$mC|SEsK_Pg;o(f+!#9^|gO8wB`fLJn2Lr?23k(c<PpE;4KBdo~
zg6tFn!`?p(412#RF))NOD}9w>VDLV~G?7D-fk8J;>6<(QgHH+r!#-IChJDh|LdPo-
zWML2kgYZNKrX@LYnG8yd+#pxJVPM#2$iT2qJCK2CsWzm@xY7e^Qwc9pViXi)W?))s
z!@#i5pMhbYFNov8z_2f#fni@Ph!euVu&<DTVIQcgwlsl(VP7``!@hQQ2BxJs3=I1g
zGcfD}ZK+vW!N9O@D+9y6jUbs828MlS85s7R25}}ZFzma-z_9O@Gy`)SWK9#pl{cVf
zn($_&d%_G%i<>~_TSPK2?0d_=u<td9lghxb?>_^>zQ52sf8_)8unQ&*@J0&I`g&Li
za%Bpn7+MTI{|HeGU4gF7U%VGyR=|re=vc{B2}nt`_&G>PIcO%I3AEBag9)_h0=byF
z>HsOGmVmCiVL~mY1V96EAkFDu&1p>VqYxObCV&bq2BsxWm=?e~TUT39$}^UU6FAsF
zWhBTUV6#9Y3(TI7Q)(D4gI9wIH!6Y7Pg!!7nSt4hiGg9i00YB*J`jhGfnmQq1H*pM
z=!};X1H*oO28R8*&|tibbzO!9yhOh&!@wMKl!0jpX#FcQ<XjQZ{YcQ@y6gg~5Ez)2
z3V?hAF4(~#%FM;W0rSlj2?nNR^6=G@ph-+n;pX^H=`6T7Wn^Glx(Zw%E1iX%Lf;;%
zbQV<bLJDN1v!K(YAqBG1S!V_Y22ic8_gLw?G)ONSs8&_F0IpTpK((pTMNpP~13n8`
z=^|)I5PHHt!|e|Y437W6l>>)61A_>I(n7EsKrRH8sY(mgKxHZqs7zH_iYU^RKv#2t
zk6pHDR$2+ORX0v)H8|gaCVTUh)_`nX#*@jQv=+pA11b)6Qj}If3-oXXhKMYs3Q(I4
zT8YQOrli4FA1?>ZG_B89ssN1%EMs8U@5aEe-%br&B2|C`gMndxB?H6$Y&CF}uQZ2b
z`TaW?81`@0WMI%@P^t!5e2Rf#|2+nV{Wo?nGB8*?QK|t6zG2j4U<mr4R10pwGB6xq
zWMJ6;R{>mffse93#lUbtnt|bfIJEEpwOAsuKwVB~mnOakx&ntG9$Zv_dV@-n1R0o?
zgSO|-de6Xcz>tCAfIg@f1nm*V_du5hBebA(YvOxgnHFv+>bX})I^o?KXyS|e!N8pQ
zn1N~eL`KFeP_oP9oyaqVMfnIL5BQW2=-M@g_!N*jXo8Qg01ZQc2QokxBiS%8RB`D3
z1Jx)iSiqHtE+ZSb5)ox!TK*7RAL%l(!>g#}kozy;LXav7&IL7Sz0-AHgUxdQ9Z3B~
z7jzMc-~k@cbtbxR!A67o8@lg6(Q=9>lR@_fhy`v8hfdag2-aH%&Jel}5lvg&hlr-F
z?n6+G0LldQp1P047#KYDK~39c9o-|~<P0g%FM{Wa85kJBgDI<$z)f4-BhaSp0T%{_
z1EA!^;h=j2+O$28&cJXW8Pts3se4SEfoW9|1H*x428ILmAhCVAp!*xaVsjZ74$MYM
zD9t+HrmZd{6EZLySj)h0U^TdDt9u3FJB9;$7#I%h0yk}SA@^!BFdR6|z;NIsq-m>r
z8{+IsYeX5CRz`!Hwz|h5nMay|X;nHz`r;LEJ(Z+;mX(2N<uzsord1^j3<qv8FdVo6
z;xsTY9C*pVZ~!zpysC$R;lM8jh6A8uELP26U^pnuz;KWsq-+TT!$B<uhJzZ=baC+s
zs3ZfGV&FC;C^>;=ZD7gs;tEKevhp2B4WdrDWCE!MRw;qSQCh3uHQJy;F^#nh)Xs&O
zbtwW;$*i&hmFmSzu!MT41XMRb9dv05N+kem)OzY0F)%2!>TUxilU1NI&wKXiZc_!t
z6(q@QLo{l2w}EcSfs~=T+d=UTDMNL)gNhh%qgH>jF02c^x)4+X>W0D^wLVjIL0#xo
zN#Mq-E~E<$ZoKNofTDC68v}#v0$ory9on7NjRT28y3@Mg1M|VjI|(M5Ev=gbF8;tB
zYu#jUQ6$R1wAup_*+@O)!%uW8K}tbsJhNT53d{x-sM&vXJ7Mi9BL;?!Z@S=RajVyZ
zo5#9dkmhkxX&QsB7pV7miZ>@Uk3rW9)D8xPM1!TS7pNWl1~lGReM{#mC>&S+24_#5
zyWs2za?vfYi*)Y6GyZCjw{%iqA|R(Ac%W=AzCh;?$gDNy;B2pR2;4!2n0o|lE;!rk
zfUf}og^Ld4+F6iZtq(fe!Fo%<aj3H$k?nQ1BeK2Dc0{(<*(t`r;PC*I?d#KZW+7$!
z3!sr?1_lO3@RG%K@!)K)GYb^`rx+Lx+A=U4Gza%+b!I`c{lO##hJ!JnEWT4`jyMC;
zx_AbLgRKk<2O-&BXC6!plxY?rW&8ScaJJW30j_%)7!Gb>U^uu5ob7d1fn%M4;oxBg
zhJy#e*<NQgOzaW^!@&!XY_GEsny*7d8JO0B1~_z5bmqdd{kjy0^ab!Rny{PBVpayG
zwV(q5))g`^9DK;YaPU4e1Jk-%28M$l7#I$|193VT7!LktU^w^}#F@&#aEOnA;Sdjq
zvyg$|kSqhkA!%qXyU>F_+h2%)Wc#&G!Py($qrGqil7-g^fy6<1JQH`1_QD@X8L`eB
zq!^{CnEC;h`7g>KW&VpcSTnx|=sK*O8ah3o#IkN3xJRqgqY8>KNW$qsWPY6<MCRA&
z1;suj^Xv4&Gym}-9Sd;6VPIOn6qNaOED)Jr#|9kh;LNWBy4H>X(sR`Tud{+=ejQL1
z2hIFC;Kfa#T+$w^;{uB4Q{b^Q9ak`$je%j=Z5?+G1_pl6tskbRb-cmZpN)YbX^V~z
zOkC4c#}_8<+Na~s333{Ej7<m9odb`n>9mV7Fs-kH<WXBlS^?$A!;f{!!6gM71A|4h
z4!EraDnTqVbs(h)WD4mN1JnAgpb#+-1zlXVP-RLyEEq0=f?-NLxD^O0A-1lYA_@xZ
z4WJ_G^u8(5;F}}Z7#M65rpO6`Zkk{N-G(ql9_Gol{!<h|>^D51i%q9!fX`tMU|?8u
zih<$dN^p~OiUC*w8|XUVDW;;JQ6=!TSW~PZ*~p%OAyiM3MSzikX+tWgfuVa_lSNhx
zyo8p)i-DnsUz2G!_;w_a3Q#_CYSU!e4Zi+`6XY6Arrn?=C8szU7&?|}GVRs}4ajk2
zGH5bEZ*TNsU|1}n$+QOSYmgzJ;U|#NHBum@EDQ{XR%$YVE};isT7M!!lW7AuRzTJt
zeWc0c4b!=Ckx+gCgC>)=2B_W40;&--nSwYN7}Wb%KqIW0Ou=B!vM?}gWY%N~mtbJp
zxQK;;VMUN8Q=~KlgUT8f1_q-ZO{ORT1_s755NC=eQ#6>v1-cSQlPOk)fx&$p`1(mr
zrZli=QJ|qPO{Pv3&;YF_Qvp~|l!0j@=#+e&6iudZ706gCS87oagC-LsQGka_Rm!~>
z7;F_ZnZQHUppli0k04&qQG$8_<WNJfLqUNLGR_cU94N7DcGY|d_B;dACeYaRMrO^I
zDj-ksf?fO49VE^M_TX!<|JcC(djs|nh&@H~Etm~X3Ywq5PKWr1krmW2abIW4zz}y$
z6SPr;;SB@RCeX;zMrO^`vItvNJ0NUX3$x{<wI--U0QZfIdNkLAZ2{M`nw!A3urV-*
z>S=BTM<g2q!)9$w(9J;%RSdQa3|-2aJ}_@x16?oHqv@jviV?7+mZk|z@-qhmL!hOm
zi4;tdLrzl}D!DnDgMlH*L{k}b`$-iC14GFTO=Zx435XqNsi~|9(gae&pb5Pz3Dp14
z1mBf(3R15yd`M?t;E)r5I9wf^o57bU@8~dKy3WYJv>B90!Z#T(-35CDwA|D!+koi=
zNNN@|qkTx{N-HX6Fkm_lQDectuy~FEG`%x0ZQcQjaRa6`s-PGL#cG_70ciXS6yBR(
zbAa-Y!6r}v0jj4Bwtz!VfG3&3V4FDT5<3P^$<Ur<Fd0-bY_Sz(VA{e3UhHi!9kRR|
zBm$aYI2&s)AL0X$h#ngQ!`WDar4SL24|Q)FtOZ@DaF7Ayh^2Q7Koh>g{GhU*gMmR`
z&L9solm@!MX05+L9%wNcsC>1bVNeP#HDDpOgn?n{9fn8-hT~$KjG%kdV0Sp3h7K{Y
zfO`PD1l2)B4kx3c5~$2!U^ryNz;H;*q?mz|QPC7smN76KN?>3(6al^onv+oxv`Od<
z1H++y28KhO;2S<U85LbY{ci?_Lz@^F4y^;<@X5)j2s-exih<$KIR=J9r;1YY3m7;V
z)j)UH1v5?LPz5b#=Va8BW?;}^VVY<l2O8eygv|jk9Qwk*aOjyT1H+;KPDWiW2Buwt
z%o8UtsxmOFbmwH$)ns7WrN}(-Jws7ZY8eA3qaGInL!K@3#D$D<1t}#AoQ$U6_+el;
zY{tNF7<8A>nlMgAGnil*1H<70RR)F(QBFobMFs|~x6Bh~GD?B&XXIq8gp{}phj%hC
z9NrGSqxmfC_^bd1rfnWjmG;m}01uyFU^sjX+5<h?1F6`z>0(ywI~W-=SSGFj9p97=
z@(v?o8psojjHw`}!v;srE&*LI57G_lc4RPBF)%PdopBC!qQ(mbrtK1{3=HxDoQxUj
z3=F!$%oDG`RGkM6Rf2j%H4IGKW=b(I@Pu(PW`mN=DF%kaw;31?UuAG(VA>B|cX1AO
zU<U)-_!LgYOi-6-zbpg8;a?04hrcj0Fzwf1U^pVlz;Hxdk%4Ky3FzDxsGrY450u!>
z1adXx^a@b>Cj)+Z1;cp@24*=akTmFONYGJr`ymIZGMw=Ntw9i$=Va94XJFdi3$p18
z1H%y=28JVQAkKdVh9iLt3`aZ_8JG@mgZv4#_6&HSih*f+1;|{`U>syw9>Uf$3y^J<
zXJFb7IboRLoB(Vt_M8AHq!<_&0yr7{xfz&tfc+iLz;L9Bf#C?~B%b|A3=BtRGcX*P
z4)S*%k^{~`FT2<d-ue%A0C?R!lE2TzAiF@Efypui(s(@&KIBQ*jFYjNm4Ru;W@ZK^
z%R~l-BU>04j%)&P@)#J79A;oR0$KuQS<S$3<O&1Bkqhz+Ojhx56CfvuGn@x)=m&X&
zgO4c!WE$v9J*z?nh9hqo7>>MVW?-_aV_-P)hk@b9FIXzOAOPAv1{x&+?frsmz6FoN
z!2;I-)Cy)`+5tXJ5qWzOY-bw7nIn*s4|agO4@u9NOcO0Y8__Ib{n|4(7?|BX7?^f~
zrhh<c;1XXTns-`&23{t<2Mwz-PdotXA2T|_6rJUO>JEe|f=j4Cb(eu97J@buFi*Sy
z)@=$`WC7I;Is_Y>!=QdU$HKt0$CrU==W<ZOnFzaJg5lg5$T{0PFM&;+05TP}NH6{d
z$X}+g;5+{Wl+8ifQQPhyRd}*EgCKZ+71J(7P*q~U0p}Zn`2wKEl>IqQMiJ0lIH)DE
ztCf?1VdoD{MiDJg0nN$4z@)^<C<3~I6V#TgFW_Vp1?B&};KmRqqd2&X;{wemaWYDP
zIHwqV7#O@aa^3?Q2}wGqpv4&@c)i3Pel@Ti_cTCOFfbgIWMDWdsK&rhU%+|Kfq_AH
zF9X9-cLs)|_TVlX=L3+jZx|SkRxmIeEzkrz=`l#`6a&N2<qQl*7iuyvNa=BcT96DN
zu@ejoN00DiGH^ZtWwuiVprKUGr!ou-Zk0?E4HQ5%!wYc5z`$_y2?N8?JDQ*~Q90i!
zFfi@mXJ9xc$-r<-6jHM>o}UHs%{<2ZQcyY12Q3&+Lyw1J2w`B_{Xh=leNNE4#(xHe
zV@3=N#|#cLGBE9doFdHtS1!WI$SKUgwELtr1JfQ=b_S+Bh71hHoEaF7*@HON3=GE-
z85oX5GOU4Y{$n`3f@R_X$Udkt2KbQpsTT~)aYYPFyMKUE1pJ_NhSLtv+|L5qiUe+K
zx;@ikV9>7TybP-H|AXA*!NI_g@`m%WCIizR4^SvUM#8|2LC$NSa0RcZbvy0Dz))?>
z3EC0}tIQ9<hV!m~W~%qKX@G)qf+DyH!*FZ{1H-Wipt+z)oZyAIZx|Sk9b;fPwoj9R
z;e<KoOpwtau`dh^$KHU4eK}`=#7;3V9G7QcI4&K;z#!Dhz_hOb67LH^;rWJv;kXq8
z!*Meu28Ja@oXbEJc_ZXJ-u){fsq1h8Xx>I>Gv{)C2By7npfY?H1H<tE28QE)AkI++
zhU4)J498<Z<>^JHiBhakec*e67?}2g?!ExuO_B*Imk<T|;U&-j1s7G)3{3kWXXG**
z24AxzbdhtRFay)xqabT0GB6y^V_-O*1F~igV&B_gXsNw-11PdU6DXM0gdkgkG~j(0
zb~Y8mVNf#?T;_7l;bmaj7sbrL1RC%@UdzC6yc%i1`!EM=9S>X!+JN_A4%j*#Bo!#@
zco5?70dMGF#Sshm*mbD^?0_VOLx13+!W|5t0$}X}&JJ*s91_%Gu$6-b;Doa+9h7i7
z6hH}wF$*-aojsE?7pxxCP5^a)Idj3uiUZW0<IL3tO|Wt>FidXe%rytiYYKobYvnAK
zV_?uSg1Rlb0=ga@JWvUm;Mwq=GYo7hBLmZZN3gMB;Nb=E_!wuH7f2XlQUs`FxC+$!
z(G}KWU|21}=?>Rf4c6%nZmL6cx`Wy?)exPYAUCWA>C}3w#lWyHjT17W0kU%?SSMsi
z1EShWj)6g26y&($@tmM5Cc#td`|p7jYQX%g{f1M+iGgYVJ%}bPh$cP;2JJ>I1_p5p
zP6?Rf4oHA?N+^TE65==sI|il$5)hqIaGg3V?hFj`0%LA~buus=01a2>?})jf%)nr}
znT>&=G$aPJ>(exyC$)ef=D8{Z<CU{)3=HlKF`&ZII33&_ig_u<zyM~;O^A5~V_TTU
zyoRxtUygah30esN?oq}tO0zI9)O*D+3W_r@xCwx(jTlB@P`-Zyiues~F|d)3gJK}B
z#KeO;!E6i+YwKcCBp8?uit&_YGQ_0wFfh2WfY(gLfX87VlWQ^HS@k#IF`1YZRSXPM
zl42GMfQMybQb2)n7E%lfxHB-U`WFov@B?+R4zA^3V94JQy#e9-=xw0mkwD(ucP9EE
z%sX?;qYtV<y{y?AeFzpT>*b=4fZ1T1qi?b?Fx1LKp9T91JVG6P4$Nj_V6ZZcJ_qWK
zz7YVIvC$Wx<(fMK!zT4;Cun>eQUm!u+6m_SjyKVs5)4d-)OeDU${C`4g%}u|Q^4Mj
z_J^5#WKT4Bv-K&6!Qk<6NKizV^CTCSGel>Aw4H^7N3<t&41te<!C47(Q?#Zk8{<Jn
z3kC++wQP*@U=9Hdo4Yr#G0p?^n?Z3IQ^>|RPX!dG;5oY!kJ%Wff-<2b1B1N>8)FkA
z1Jj|UEDQ|n&)68-zySvuwa|XU#@Nlnz`&6Nj&wH09;m-185peM*ceMd+CcR<NMVU0
z1Jj|$Tonv#j1{1gZYozLhzVMVH5Ig|YcU&RB}lvql+T=ky%-oe3)vWB!A@poU^*<y
z2}-GKjIkgcFgM34f!%zJk%6JToQ)B5o5dSuNd^XOQ#M9NMh2$CQBX&_qBz=%2edj5
z>S%9-qq~2xF@n0=hmV67ps_JB$}%t=KF*b&lfuBp$R^If;PiuqfnmEZ8zUDuhPW~r
z*ciFNOi>1=!`r#CQ$fDs1y#jWTv-fki~<nT1)wq-U>R_Nb&^wNU<l!3djWFiZw>~A
zeQVfWfaZ}w0~xMI*<OG)j8yStGO)b@Tfm^qz@T)E?Jgq&(-8|^utj%4tskgz(6j;r
zh`nzO+g;G;JZMaE8Y|mFkmh9|&CyM42SJ)MIT#qGv9cWmrPyVlWjROL4uV$mKs6r(
z?GFRb+hlKLYX^rv=&Vz4ZenXk<R-RWSZ>nrVVexjDWF1ce?D6VSQE&qD-c~7s-O~x
zgMmTAhb_|>RP2D0GaGn;&>N60)2(cFFkMHvAiC_pc0qL68zOW;G6zUk!*(_`xGsAR
zaQak}2IXbYVo)|URZtoRuOwpAkYQjjeGbx8y_roCuBjBFNm3rH33Mkjn<QvSJ?PH$
zLIyU_A{W!=3>FLw`_Du%fd)=MMawa1p#p{|raVQECU8oLV#?D3Rbb%M7R6L7&cJj`
znyVy*A&RL)jDf-NDhmTc6K51tDJU{PYks(UqnIF5=HN@yqnK(zGH+NI7z`doG1Y+w
zbXgb}3{|6;n!pB#GB6$E2G0~nF%`=(Fkbd%5Qt@9SR@n0RId!~0)X<3W4jjv!)~`I
zCdg<RBLmZM8?alI!EO~w$t+@sVp0Yrk2gY~vBW4QWlIKzf_SJeR6uh`pcQ1PY*9=q
zpp{1;C$T?^V$uM6iG_hd-8hO#mjh%lS4m1SLll!9*nJSs>IFeP3-X^4$V<yu7#Q|m
ziDCjR>0|);Jb7Xi6L_Q_#L1i+#bgIcd#50SYK)Q5;Dt_6OyK#vQ(T!0QB2@9vu{Kh
zn2v)kqSr}@V$y&F07yuOg@K{!Qxp^U?qQH)4HTl7++djwGzJvKlnUX3x<(9D3{1y;
z6B!s73>f!;`bMP^QH+NeK@rKwz;uF%lYt?BM-<~Bbx?xkWMBwb5yg1O0VK@{O1)8x
zhfP5Vk%fVw(Km__G}p&a#lpbg#23YQRsv)IXw_DH6yrs3c>_rfjJLsI2lb)pP8J4+
zJclU8m!b>|j!hsxJch(8<5_tI#>)W=prV!iSrp?HX;3Nx@pMw67_TUSBOP3HIBHff
zFj%uhF@`bPGce3t5XI;La(x1LZ9x>H4=5JxL>ZV)*g{SAg-<b_2tXBr84pzfO6mef
zWSG>!IfQ}fq@GX#gA9{8IQf7Ri42oEBB{$T>579Cfs=v^lOD)Rpu4*a_Q^2m!#Gxv
zGE4?APWB%eCPPrdcmq!OGECr90*W|8RT(DG!B>tT1Gsx-n5@9cSQr?#M9MH(!?FbL
zJsBn&Fh`Vu>7*RkH!@7RkQ4#Q5;9D-h%Di-Ig){)>ah&tU9guRt<@Ij77*qWpw{YH
zA(H|I8OFO{PckqZpTxj$yvqcXS7aE$MJcF@vX6n`_zn|Lo{?d^3(hkP496ccFdV<D
z4jOrsVY~+l^#cqHCqN4!nba8=QrTn}?}76W1H%bz28I*rQlJt_hVcnF%orF>cr!4Z
za8?E7DH+D+91King_tIC$bqtz4C4!Mh%qpn=wx6xQ7KoF!XU%=!i|B!k&l7l#9s!6
z6K|y$7`S_77(sO*!!ibjla34wCvBxb*-eJ=Ehy|xF)*BrVqiEKCdI&D<0r%T7F2bD
z1j`v1P8LfsFeFcuVFa%W0SQiHU^v+)#lVm`SBCKiI8QP#oZQdAaB?TKqZ}Cx3P^CR
zDZ?ZOvH+ARPc4K*0pk-$6o5`*H)UWtZ72oGm@<t2p_%XG3kHUhPox+a3>0LTKzHCV
zykTGfjX0cQWraja`y0@Cv<ytAK+C|8R<m_LFZMaj0_t9s!~4h`G7$BrWkBNa3nUpj
zY(U~5vGRJ*K~YS%p*#HAJYb89+B`rVEzr&|874V?2By=X&F;7NGccS|U|=`}I!F5U
zX$FQ<`V0)GbU{aoo`sxV%+MAAHvu-_!2&Vii~}<R(^*pnhEvWA45#ct97hI*Qwa<V
zr{dTdn9lk!Fq|r7U^tZv+P(xi#t&o~<U&~x3*w*@8OFn`3`}Q0Cy7t{%fN7I69dDk
z4WMfz*clj39bsTNbqI2#5<}YtP>&2YvD*d;I}WH+y9Vg|VrZYK-GhN?nh$vRX$KQL
z>{>-2gK=j->z|p+9@N6l&tT?aRDcb4wOW7zl7Z<=EjTa{nggKXQ$gaT2=NT4_*#&7
zIXld8tvf*C&{%H00^%?*odFGrF_j9y6@39Y8tQ{K0gxi7jy4C-QNRpLXIVh&`$}PF
zDKWH{Ffd&Tgq7-Nl_90N9%%V(jIIphesF$gWMDd*DU=GzJ^Lj=Y)%G-BnBDA{h$fz
zH{i-fh7q)4M;LT@^rBM?j6RwS3^BT(+SKNi7XyQExeWNwB;#~O2BvfB;0i*9aRQ=(
zkYSvFs32q*Cn72c8O9ml7A?4fkYSuH0WttwLC7%9M^q3pj4Qwe0yLYM?gUv1Y6<L<
zVcg0E+QBT!z;uoSn$2b-R}wOei=;v2FQgQgVO)e%NjS8rFfi<&B*Pd0tKQBlL0uo9
z1+CsRd}J5{Eub};6Q2xYFwBjz-ZG4#;5-hx?7LTnF$&D#$}MJ)VFWMD0hQU=e`G+n
zaxgG}IPA}47~{Y`fm8>K@!%qi1yVdFfXnQ8jG)O<8O9DSaFk?;f}(^glR<_t4{SaQ
z1B2f#8OCyP2Bz~$AaDPNdOH~6ZBYiM^Fk~P3`ft)Fjj%%6I@+#Ny{+SLkk){1_s;W
zXa<I(0WyqE&_T8U=s^Sw2SDZh1vhm_LF}Xi3OojeQ`Z?7PF++7)%`MzPBx&xVPH7*
zhk@bL4|PzrFT?0;1PUYuhSO3E45!7UKsCM$qZc@^7#L2QF)*Aq0Xc0g)U{p^*NQVR
z-GMH|4gg;(&Aw6we1Fab3uXqUJ0P=M85mB3&c(c=#=vkooPptVC`iVLf#GyI1H<W5
zEBFl{41qkLt-0*S<Tr{lGcaeEFfg1hXJ9y8int{Jq=cD)f&CcbmVndk3=F4R8Q^&)
zFb0&dK#S&GbY#H0cP>l=w;E&^O+fV*sMT<x80rgCc&p(;8>$d2y+Kug7R@_9l3^4C
zb)GKV1h00NVH5<l6F>{_=Vi(;3X3x^IIM%_1PO4!LDReOY6b@9N1zo-Y8zzUf=sv=
z0UqX%c`F8LQ?r2s`#o3-8#sA@&JjPa#0E|UpTQ{zY80r3Qri&4z!2Rp!^q8($sqF^
zoT|XR4VnL7HY^2lvM?}!k}oq@6lA^8bD5`L>+3kcRz8&j<ySTah7F-I&q1odTXs#N
zWH!S}mW!VtDmTl6RC0hFx7i$&blDgfT&Buw1?z&Cuno)xZ;X%uwXhjrbJ0&`F))}!
z@uX!k$Xo)e0rllgPs<zzrRP)Na~1@j%1i;d>=I}RixZ#B6cvztYzz#!qB7ut*i+zz
zATsm7r3Fa8p{mRRaQ0vWr}V{;QUW|^BC}YDf$5SDWMh}DP6PwPR&kjIXhvy)?R%^M
zWt7WCYM>j&WEvDfk;lMrdNu>Y>8X%NXa;9dHU@^aV3`)My9+?`>@uywpl!QM6FDGp
z!tik=$O35wrfJYxuf+v4J;$vi)6UAkbQ!cO3slja-p#;p8gzvJban=Y(`OhMPM?BS
zU@ak_iVjqPae;OPvqBmREf%2b4j7m&gDQX4#f(|X60n(+mKu1CC&30<vCI%=Ba;k^
zv&$KfI7?Oqg&|K-Mk0euCfNNv8Kp@KG6kXx491T@OWyW=kb(3`AvQKcgNBg-6f{@1
zX@Hg6DKapaq%bg?e#F3V8kC8RB4q49C#IZYU^v6hz;Fh%B-)8j#sQpu85quJFfg1^
zQz$MeW{?4$+6J1=IAg`YaK;Q0e9oxB#|TQ&dq030RZI*_S41=!7<5u(93aID!<hgE
zhBJPk{rj-MZLR?au8@o?D+ALN&`t_a;GRifU^oLBHU|annL-AJGtg@>8Jatwfy)Fs
z>mC}m%>|GO_ev?K!mWfC9?fe&VGdJt0u;&&OjkgcU@%V<V1osJ^8*H^E89RV0MKl6
zCU~eef`MV<Vi_}NB6ElBzcm4c<kbL3NSdiZLh?)t1H+jHH3kNw2pKbd(3T$thBFHp
z7|zVr1ZPVNSV$gZU^ufMI$Z-dl7WHgsud)ZEMTE@k%8gNd6@Iu-+(*^IzE_-iID*m
z&vtWVbit_u63=$9nIDMjenDKPs|0o3V+MvZ_aUy+1&x%PVqiGSz`$?@v{}!IPevc=
zy0Z!l3}@va@eE#y1yX0gz;IR%>SDMxAQ!)ZxL6<R;<NS)3}<a&EhD=LpkN2}%#w>E
zndHGvWnj8CS*U;^l1U!iX#w}lBAGx(^#~pS_c|k)RK-DxK>hMaCN)t828UAcN~TCA
zP#Xr^6>s8<WCESF2<8|(ie%CU*U{i{he#$9upUtcrfbdM!atHp71F|obh09u43Iim
z>Rt>Cs&0{tppiK6c=z?UAm=e213M2q?hwg%3^DEy$#@Lhhk`hq@i?gN0hNlWY>|w|
z!F?u(FBngQeF1KRL^47KTv-?xTC5`(&x0~8sNE5i9m#kB#@Tx%k`Y{tf@IW<BN?x9
zFfd(z3vQ7_GF}7wiG_h-;h{*z8(=-)CSWAvZ4l=actksrNnDhH>3Su^*Nmqjz6J@+
z0EZ^yBS~mz?yibtd<-e3LDCl?((l32;C@mh;|Gv5$Snp6k&Itp9FWHEAkHZU0k9?}
z4kS%X;CaS346vr{^?#72tsiK>qVrKCV>+xwcVi;BMHk7Kj%bfYGNvQiqmhgmi1uhC
zV?Lri8p&8B!N7E5BDg&o$ykPHk47@qfdd_Rz@pYZlCc*Qc(RbHKa#NsnpXK380>G`
zGcfRbMKXd`6W(~n1=@uW$tVJfQ&4;2#$jkkio)9yH?E-y!3>3}V5neVklQNH_!%_3
zv3j#S<4r~erki#`pb}S}@umVOE3z;!#4nVG#v4~AgFGW-78$A9S-lx#ZvGB=#z(S{
zHk}y*LsO7E<04RHdK0vRQu~cO<02_gGlK=x`jcl|A_-E-1+i(V7}O@C2zf^E?i^4G
z$z3GRcm^E3@{Bt`$>vQI1H+!b@{AY3O$vEN(C9J48^}zEJmV@*JilQ8bxYFQ<Qap&
z`IixN!6rEF<Qap&t#K9x2K{z<#t0<_1~Y4@>5*X5!HHiU(&z>ar)l`eGp498Fqnbb
z#)p5(Gv+EYFqqtDVPGf?kY_B0={b5`p0Na$p-V&L8B4+AwcsQ!&o~F<p1zgxjH+<=
zfR2y^1(qs!v=-b{lV{WrW?(S-!vbmr%QG5)ZRG-O&6H=f1dpgfT?$^W`vzoYjE_7c
zH{4869%Fwd&&aI;8bcET4Y0~Ha_fP1SwoHC1sekzm_7VX{w*WOCyWeCw~fIAv+{4j
z`goGl(i!C6gNoox@NlmDN3bq%yH5T)*vD)P42OTp{{{yIBn>cvdQykqfsD@hBmWTQ
zrrV(LZ}w;M50ybq0xf}Smw)Kaz;qjG^kcBmp#GnkwL1gD@>BBX8NrQzrrVGSHTm<f
zf$6ic^5;P{)Ei#VV3GWJ&>{-Z;yDc;`HPSNad!p=(RO*z03&GN`1TEmuMR0dtv1w^
zKLlzlfG5hfh01RSI}+4u01tu7Z&v}OMh<Z3?*Ml}*cceL#ma+{E(3UX0sCF~m7vso
z2QvIEzY=D2{to$-RtVjzzys)@`MCA><!6A)4+f??P2jeW{0z`>UVk`1gPQU)K*Qgl
zxr4$k`B|V2OcSU*$^J}!jugnz;PFS}bQ=bS1+(RQ!8U^?+Ss4T_kzO{+*+5P2u?L1
z+xF_nx4}Gh4PslHJSa&)LZZzKY^VVPgSDM}JyhXcaSjHC^~>bz!G3{+Z9Qmn8fcNC
z_8a+n3s8pT0FAK8*E@m6_(2oWDo^Ag8<`>1ct-+cM1{cz)X2E|QVrA)mM_x=+sAM=
zkb&W>uLd|Jm-#a=Ug2h7IGe}7a5e*cMxA`Q637Y$hO-kG7|wQCF)-chfEt?tGL}0~
zz7n+5|K3anhO-+O7|yN%T_3iTf#K{)28Of8L7a^Y3}>G)Fq{S5wsvnX1H(BE28MG?
z)(lMdPC^^D9dj6%P8x$6wunP=85z@=7c+wFuwh`BS|pzf3gLVFkkkOm=cbz>0hen7
z_J}(J!&VOYRA_wOvw$c}MM^el;A8_@`gwGMd<1yO4g=G@P)G<zsDe!~U|`6slZQ-)
zgS-lnbO#4NxGN^_t`7<ifl>wrt|#)r0^nBl;?wd*;22{B-I4~;V+7U%i83Q_l!2El
z%NyB&W*H!68H<C=f<zzq(8D*NR#-cmyaL!8kZ`Vr9+|*e1B$*UJ!;_MSpigpZDwFN
zXTrd6P6ZOB3ie<>Fr1sjz;Lcg4V+gLO~5&p;XFSB!@2)f3`}S9AjZ~#_px%h%WHr}
z*v>XEFr1HPU^oxzbf4{IU^u^&f#E#p;=Z%97#KjaxEGi~gLlgr7%q4+FkApF;W@j7
zf#E_U1H*-Skjy~_h6|G!7%udKIOiA`F05r>xUdq$dBMPN;S>YIg+uZTOn2JhwzI%l
zpmfB*AR@y!m6d_%K4?AUohb|q7v3>2TzJFIz;tH;1H*;C3=9{3gVr{l(}C&(-*do~
zDZ@BRfPv|;7c&FXIXec1i$V+x7r8(jZw7{ot_%zpZP^)^&P6aVTr6Q=xL5$<q%tsE
zoXo&*u^YrGVqmy<hJoSY2@t2Af#Kq328N68L7Z*|hD!nr43|K6JD;1uz;MZof#H%7
zNM<Pm!zF(PhD*L6&L#$iOYsa0mtsM8x18G#ab2ShNa_Rw!=*w7hD*61&J_lROH&va
zE_Hx7_Zb*2on&CRbX1&y={DrzRED|=&{1MsZ8D6ZA`DCqLBpuGUobFSdcweP36ytk
ze_>#_^pAnz(l1b;FfcG&mSSMIECM=!s2gHy9qcM#1`rDztTys{R6r+$&0%1;Y{$TG
z*+!9pIc*tZDEQ8Y4Cr8P9eBYc*9;lPC{YHchv55PO&Az12Qe^Q4nP`JsRLh&$u$Ep
zs&YArf#Grj$S|haY7j@%gReT_S}nsEE6Bj~5OmAuY%>Oi%S8+fmkU7GJ)Qf{z`(Ve
zf$8Blb_S;NEDQ{nn-~}_H$Zz+4HLlQGE5J_R|FQryIc)7K%=4zVW43zh((Qiz&>PP
zXkcJ^BnvW2n1SK)WCn)I{jhP{dJP8V_(TS#N2Z`&7-Ab?y$e*_A9SQ+4TA~nS~`aM
z9H>kdBV!h8JwpwH9Ne%ykdfj?eIUaiT{_UNbMVGRsO#%*Ffg50XJC4?384mbFI@%`
z{GvC81`dc1ADsfJL7bG?-~bf|ZH8yBsW(w6V^D&1eHto2T_30|jUf<~k9j~QG{A?Q
z8%v<#peqoVY7pW*;ILzQYy(nX3lG!A1z`1{x(#xtDMOPD=sq2;Gct_x6&RQvF98j~
z`7<zF-pIgkc`b+&&A@Q^Bm=``(9xiG(is>oKW1RKe7Bf^=}s{N1J`{}$}C}E0Bst*
z{D%P?+Z+rGT%Q=2p0I(^JtqUh6&VJGD`H^`Oy|TP@z?~NKww~CV0!!%q)MED;fgf_
z!xc+dSG6ex6s#b}7Z-qf;_x7a#ZA)`$bEcIAjbp1H;y%d?{Z{ddg2Jy3|a}xXaG7c
z0Ff4&E`ZEtV0r?Y0Dzpd!UQ)T8sJT!A^9i<rYGR>e?+2e<^ZP_(78_{lY^=l8JM1|
z=S^k^sse2vdI;Ko5)o7f-WdWqQOQp?D4WrSfg$B)Pz0zpdvcKtGz1?68AJvdvO*)s
zA7sc2kRkpO;Mr_t1_ot@ASXr!rl;H>VJBgbFhr*txWNb7AHlgMNDpM@Q%^PqhFGp3
zP^%HVH)SnbkTGbNCa57Z-zNyPT@oy=w;;$|0KB&VbeL3lum<>OzBkMuUfN#`b<jCb
z5MJ;@4P^*#HX{Rr@3*P>AX?aWYK9F1!(^SQu3&pX8(k(FPjv;^1!|oHv`=*fZ9qB5
z#=xNVVX7Czr7;W)&YPy%fkJ`#-c(Jn&c_@K3}xG<YJyf_fL2~O)lSs}Eyt+>g$SSJ
zRCz`Qrf257`DtkkQ{_Qxd6)6#=P^u`2W`**ZH${&F%^89CCG<%2d6@|z_2keoIE^L
z8MHAABwms|RoM*eTU`c*%%xMsKxPJj_Qse@6$4qejG>W{fuVoWR6bBezAT1;VbWVm
zE6_csa&DH86=)1h&-QUJFmM`KN`L|mH07QB$5H}xx**8I28%2~+XfikfJZhhr9mDB
zIWJ+Nr3{D-I<IQ+O-luE#}nkWqwxw+AZJ`>1C75bKz8$jB#wJ3_<|%pKqMgdO@I>6
z)OiXHpp&=)j1?fu=@^)vi-N6FFacWu(w#C_0Tg1-134HNG`SSyL7lEDaOf$>gM3;A
z3OxmI=vDE6x*-aX&;z9+`y&eCpg4J64$&+QjuT$6Dsk{C98mjG`lA9rD3q!o`8OCg
zOk@LUpge!B2DX<UY%c@D6(0tMD<05%6x_qWoH~Vp={ac1i*qq!7H5MZ_(Y;iCXNDF
zW)Ggjz?=%Ye2R&q5PYQC-Y)jfj0{ZA|M8SDuz!Vw-&{rphJ=gkFF@{i13JHP(L(k!
zU=GAluCR6c7eJ1B>8X*FlE%P(2IQYN3=CI5WmK9*QfV;*`x#K6fW)>iFkD#|#K6Ed
zhk@zEcZD(rcF-m9pb6zGR~Z<tT()CiP85ci?&bnJX~7M)A%ubbIxhp$i>07zmQ)xR
zt~_C2xbld>j)6JhI#dtr!fggOSb#CG-v{Zr3A(uP1p~vC&kPJ#KEi^*Ee3R_3L|3{
zTQLLIf6%c_nV{r|WTNW}*iH+$ZyDInaWXKy1l|9c@PdKiDiZ_4Rru0XHw6Z!SD-uk
zkW91#FJV>6XWzsE${rA>y1<sO{s0BuD{DyLZ2}$0xr~9~sssbWRUyz>k$mi%z!{8z
z;i@$Q!&Os_<ir97_D!IUU=;(y)i?%*s}TyB4D66CT?`CYL829!plyWg;28msY26GA
zSKFcK!&L|5X9lL1uRz5$XrD_aqZzD>cWnSUpMmKWcq<HIvek75R9peB3ABV6+P84M
z0+L0NVFahCeX{JU7#WyeC4h4@`zp{T_x~KAqfOXXX@fUs*)TA$%d&$9NM5bv1t%ZS
z4e|`2g<_mW?2ACf&na-eVqXO6DS}HS_C=um<IBMLiXC)j62mf3jxiTzpMVs;&fxRH
z7#JA9;rk{V6222aZUBYIat4O0^VL8l4f_Pp2;eCOhO1W@7_Od$4w$-t0v*)$DPdrG
zW2wo&aPSHHWKb$LU|_iVmx1BxZ)pamZ;{ZrbOBA4v4ycu<78lZ9mveU^evNt;TjJE
z!!=Md`CBOi!!>0FhHHwT!SnCX^zGsTI*^eq4Wg-ynStrM3IoG6BL;?R1|W_B1H&~p
z28L@cAWd+aYQQ#?u}>FcV0yh9W>Yi+!!^*k`(T?6Ffd%(2g()6(59!$6xccf7w{R#
zpp!M(rwcGJy#^hZoNUU#aP2$;!!^+LQOQmW4A<^4FkHI>OA#&x3{2me7?|FGuD?Wz
zbC(k6$hJ@^1IHh!V$f+27AlGk-YTF$Vk-tFxIZ_5meaGfvCokQc?;ynw+sx|K-+r0
zgZ%i1f#KROa1J^4l)WC*Wn2acRi_7_@MmCP6anRscefxhSP!ZTmN76~7i3_#&IyS@
z(3&*R)W&s328QeA&=_<EEq(-<P{Y9V4s;a2!6)oZ&=|a4z`$@l4=Dznb->}uz~0Kq
z!1Pua8m`yt85pjEPL~6P>-A|24A-ZCA_L|#XB}`13P3b@Kz(<8DFegx#UPFW1H<*5
z3=G$|gEYZn&^ZNclLC927z5K=u;G~u4A;*vFkC+dvbL0g;f5Ro!wng53<f}g!WniA
zF@rPsP6}`gwh1sWy_08VU`|eAV7Q^nz;HvGoq;(ypMl|q4FkgsD>uY!t~2~>RcG)K
zt)O7xW^4xCeFvJ_z2VKkaKlrNfjM(F)IRtrs|fXo4#|xu28J7;1|_saah8B2k$2$3
z01(?poWb{kGcsmkO(KYE=^30KfWyRqy+@FN>D>xu$b|EaOa_J<=}288=LewaCN={k
zm$Wc2+-PC|UC02Blr`Yw=D^+!OKvyjGceqk3yqK)>lhertN|ytJ*(LBK*{YC#Lpg}
zKmp-Dpyc);36k9MpvmpVQ3i$^yCKOf4|My$DF%iczZn>Ae1;}B572Z2NP7hX(+7D-
zfl&xeZa38!7;dT{B{z=%u!py@mvAyLy$4-)0V*(VnldolG=?UEn?4K-H@!e92j(-6
z0B~|U3emJ3<RKLXhMUn03^yY|90LZ1oB0e3H*-OnV9Cv+18mb(_EIqhruT0^hG#M`
z+^l0@xCuIn8kDeaPGw-YIT@DUJuD!R`2oEC3DFGqXaMDR=!zMSIiQ{r$R4=kc7TKZ
zDSMSX1Jj2Pkb6LmTf)F_6LeuHD5u}t%)oGSBdoLK@d4al%3xqPP{JMyJqXtkmgT{-
zo}Wx0aRAyb4{9RZJi)+l^8h3cVnM5IPcbmu{Kmj=^PL8$^~4?v8tJWKV7R5iz;H_j
z8ZS;Fph#h0U?^Z<`UJYZ=-?Cf1Zce6@?l`O<%JY4PT*pIbr*XwCj-+*(9JBMc)1nL
zz;Fu`#Guf+Rm8w>s{q;SPT*pI^%O)C=wNwJL4K=|f#Fs?C>#tJ7;a5vV7N6IqzM);
zP8pzhVZFtk0<x(E8ZWn2F)-W$g%`-C+Y$^6x5YrkKngUYIl+qoCs;AS05RYwGXryq
zFayJF4F-nWY9NjR1H)}|28P@4?SxJWkcj<w7gSLra;X#SGI*@H6saJ0S^|n<)>rJA
zu$*<<je+4d=q4Ia^xh6-V7MI&KH4~GAG;4UMjc>Vyd*%m>dR(GjQT*EIk&SI7;b~k
z)#fx}_kqUf?O6;Aw<kbi)CbheS;oL{`#b}~?c>lGbyx$9(Fz8pFQ$;3<`0e0+us=&
zZhu9JQHLYoa86+l;$&d@1WW&S*cce@uz&)+l!4)nECa(GX;9?A60^e*P)=hl0c-lK
z2#Q1%28KI23=DTbx4eLSd&hx+;f@_h6D&p@8NfERu!HWY{2T@{Jd=UpPA~(*9ngV;
zpcuWgl!4*SVsMP=K?)s56<F2m2y1XKKn(Z+ibNX*hC5ps818HaaXc9q?i^uYxN`_p
zu$RI0v%p!<VBuyg03D2%(aykd=Q0Dsor_2XyQ2zhuNJ~SMsrX-khz9|;m#ulhC84v
z2u*JeJ0MBs3-~NNM3Qm%0V)eX1$!Bmx*t@q!<^Ru4wEVDk@^fwUm8ILJIGZZ85r)o
zM=IDI8$bm+>lB1b?lLei-1&!6usiyIliw2d2w3vF%g?}Y7j$+vC_?VaF)-Yf0Vh9+
zv+UN;<mV0Y4d~<`9#Hc8770my*3jg4*OY<bt~R7Vv4$qUyV(p3catH>&l;5cPBAdt
zoyWj%cM3H5`5?6`zVSnnpB*&$-95{|aQ8G)^78=~DD2AYj+_ikU$dc!;_e*=hP$^w
zoKgmcyPp{t?tTQNBv|tE0T(Fj#t=;lpvmtZ69dCN1`x-9f#IGQ1H(NLkS192^8ptq
z?9S{?Ae*j&49{d>xTng%a8DV;DP>@|XT!j7&k9!1`^Z2d_v>3|c>pcjeZb`bv}Nzp
z0*z_#!U}0btIlTuC^p!G+1=$Cn7)C_02Ky?dp-;d_dvtMpcuIq&A@Ok64ur7xd0jm
z16ftdz`)?nz_2-w-HaVHHV<+J=zNX{b~6RgQh5$=W82IG#0E9&Ywoh^f_ADHKoYtb
zY;_&@h{5l|kSNs!X<f#^a4&~};a-Lk1B1pyc6~7h2KyDT9niHq6u^B^@cM{13=H?$
z85r(0>mfRvVh3OyPPi2;><0YM&gQ+<3=H>{gQp_8XS2(K62U1(2Bz<}kZy~tENGSy
z($SHHToj<iz_7oCU4jqfN07>Nh)M~tOCc&HK%JUXpaVa4e+dLl)-ru>5&}(V2QmgJ
zflo~}XJGJW3}gfiO??NQi!(1XkkLt+f#I?k3j@O`i$F$C(4fQ{kP#s>0vQcK7J*hI
zfYccxtFwTplVo7nQxpiAhh_Ty7HXBM2G}Y|1_tw2fsE3O3`{>bI6+IX0vV+xKvpqG
zGB8NY4P+DoNhw36gg_(XVj!s%?*kb*K~kWd79fi`AyUc=4Eh0q|3EU~;KQ5(|0#fN
zQf6S7u{H1;NTL8D0XhO!&<?b3Xu;P&(8lo}oe+sP@-Q7zF9RQgbS#2MJcb)p$P#!C
zB(a+V?B;V)U?+q2FMSR?29f~n3!0Z1cuWQ+k<uKv4<zvxqGKOiB5Zl!Hbw@fpKK6`
zZE%Tsd4bbG5}FXpr^|s{#goDiI2*j~0Cc2`T3ui<cyNS)>8Bg`khH*3xTLB=AZ$PC
z&t!-hp!qdHJCM$eb%C%wi$7;TB;z3#6s4v!1SWw;W7rrN0v-lt@PjtMfx>B@WneJK
zMWFNY=4A#3Ln2C<f#HyHAZTRkCur<!US^;#JUGJ61llt)F#Y0yc+MUy0a~)A9SA?@
z%KB=cBPdP6P8S6&7YsWCvTqN6pb1E~B1AXnw4BRgAc;`-Ky8qO6+}WCY%EA(rDz~%
zkn9(z`#&!;P+k@k{E*3V@H)Mfq99d!f&wK$+S?%7CDB#w2?C{U7JfxWP<H#R3t1<^
z@FAUrfx#nNk?|rpbXXV|*3MOAyaeV%F)-vVQe^za!oXn1smS;Ol=4rBGBEwR%av5b
zpvZVbjDdl*1$5)<uMaE?48;kGj4wf>jc-6gzhzk%7=j!X8DC3+j;CS)ohz)!_@0-6
zK}d;(fnl?XBI5^8=C1-T1qSK;20EJL4fsSK{{ThCos0}jzdgX2M3HePI17R@iKMS0
z<0g<4=xC>TnTm{?(0wZD3-YOdfg)oUNZo#@5nW&-pyBpm2?K+F0mxB8ii{J%z6CD>
zQDmG1_9b|Mgd*c)5a$hO0Z;Z}MMn5)#NYRYQu9(66d992jp9=vc|~1C#wbv-1&1zZ
z(W;ELB4ZS2EE+67>98VWFiidr=uEKeKZ=aOpkb6#44^%qzDbIVj*R9E46b5|jQWfW
zOn-dfQ3MHYQz3A0gG!!$MMf!*5>Vu=`=`hV8MFm?+k;7wksTz}4fQs=Bq+JSjRFPX
zoH#{B29TP~P&EwbK{F=~l%&?(SNsZ623i3yFH`X=SQThCncGJ3H!EnUpCQ6m@c~E)
zXeZ>nOvMLaC2R}~^Wqgj<ID_IAaf!d756hTF#Xj9Cr!ouNQzE_gB~eTA{;?FvNRMI
zfONz|bSwbtKvI>Z0kLBnSUXq;mtsFiM=L}}KZXu2kgA$?#X^v(RS;E$U{w&KKpG*=
z&3vvH4^ngiq9`7$2+8uy=OCjpZ!3bzjlZBV-g%jd!C+Nvpc^X`!7K1jffPk>DY`K-
zF#VH)80Chf2wdNQua;TGtq8tX`Ck{P5Lu-NS=`6Qz>qjYQ4^E^L8I|O?TX-w5kTxo
z7ZtU^;-U;p|3LR2b1EwuL-G<x1akkeq7~%$D9}0(-P?*b;9Ll<c3X}qg11tFQtH1I
z-~n?*Nr-lH1_sgl0ZjRf3{3x7SU{tC0Zb(zt3WH5j@ku4wnBn9oD&0>%D|xy&Nl%}
zWuW2eDz4(xLWTe)@TC`TxRNu9Kpc?F8-^?fhC>Sjm{LGCy<uSbuMAZSIkycYU274*
z6b_S)5rP;M4r&s@jDjq!;sTx98Nd_?F;|j-L3nQflP@m=)Bk=>28Kw1047jj&G3dR
zlOcc!vhS3Ifk84hfXN?XdIbZ6`{n?~|7_+A3^w-z81I4n3&{)tjQ3<g83vS3V$TLJ
z-T)a3T4p#eGl21iI!FpBDa4)ysnfX^z<3s<?i)Bi1u&iks{=_XybNGG#>>FWAPAK@
z2A2|l6u`IvBn7%A8)W(hxD@a60LIB6sSv2H$zUl+NHaq2-vgP>b|e6_dz+a7wAmhH
zL=RXUNJ@EM0AnS{h%TrRl?W-b0LDU))KaKaAzX^LG=MQ1Bn4X42{JGnF2z<Gz?cG(
zf(1qjLaH!;(Ug~gnGuviLAp%AQY;J%Uef~@A+va(g=vcd7(q*2z<V$E_y#aq!qN|y
zSOB9XC^oA=PR}|Rz^Dc?E?x+nfEd+4UAihx28Oal0gP%ops{~W1_svR07f-a5C^2m
zQ8R#15~Qh$D>*-hA%IaDY&b|NFg<{g3nVp_t0=#mA%KwwA_Y1b)%;HYBP*{m1H+>1
zfS({WJ9xm_LFE~wG^l(M@ChVwmlv%06KLUA6)#xPC(!sgxP+U~67YbRftiVk2khcU
zU<=s54t@lgTT*6Vka!+&1f)ov2W-+Yup)?c$H8n+iIKlQU^hsS55zjqNErjvy4{dr
z8D$2B4KV?$L5d1_!Pcz?4ZMS94!M#8z~_rE1DV9LCtv|cQ5R^+a#6qnP;(jVSnt^Z
zT_A~_ylLqS0if$W8LD`bKuplmAJD9(L}Ne~sM`Qmu9X;23sQa$;-Xs6_#D(lwV>m2
zs~B1s85ovK2q@tNF_<_5a=?sSsem+4$W|H#`0_F^Gh09$>kFET06CV^C;*%{A=gd>
z1b~W}Qvy6W#YGGOk)V89#lX<X$iOgrUVsOP`$n08A^%u_I>@Xth+EXbW<erD9dwLu
z6?jKQ0Jzj#25J(9S_CL^gVP8z^JIu5sNKx~mYlaCKpG~w0U{|2a>X*Ry<7qTVqjU2
zBlfrl2!c803=DgeRTxbe8JL+t$8^ujRADs1tYYO_R2X#`8JJnbz<ErCQ5RhFBNZKT
zEugd+@?M2e8Ke%<<X2%-2CD-Xy(*00(+`({)jd`L^%|I2Knq1db_yY@69K!L1yt>-
zFiODFQpk0c4<NJmfNLL>4`3~9pi*50e7Gbe<W)eW7WjsudGRVg!I}kl${1Asg95#Z
z0ThZef2ceHwOy7mFtdO*&&<nIc?52rLj413-Ol_0F&W%STn3t;?fs&1iII_knUx1T
zH>?6$Rm!jow6JrMkIG@Nc_3LQaGzD>FsLa7ny*S?P&o|h1cDM`_8*nQpk_39dfn})
z${LV{6o_}$poO|J1A~~o%2JRDP?DdQsj?L8VW=BHEj}@OP{x?&sxk|t3bZbCUZ%<{
zX;7gKaXk3mc5v>|a8PLgDS8L7tN}?;6F9WNQ`st@W4RchsaB;O8e+-}3={oTQW+VT
z*&t0Gl~g3{=}6kMKx~-y9E5fbHWh!6c1V+7#UDvKc!qr$s8(NpQza5qxGV$55o?l)
zBREVMnAxU59PNl6N35U&yE%<i+(FiY<H&S{iVi4_*fv1o2z+27IF617s)&Kj1G(cL
zB#uB^=omq@eiDO<7-;Yw8b@NF@trE3%+w+V6*+JU;>pY`Vo(9~aTuyV`_^L2S()4z
z8JOACg+OOuurj%UIto<+pq4EwlP{zr0osrjW6H{S0^}lgP<=d&m6h=XXq8443j@O{
zIaWqUdy$2K!SyIBV#h#+H7k><7y~o=W{@&*R>=McP&4JI9V-*0G!SKAW}n8wz_4r!
zE8{sxNQ2gy+umYj(g$-vrzCu4WikMBzzb&eoFy3;#J;dH?gqL1J}1Q1-5{600Xv-W
z0K7@QxssJ}JtG4%2OCrw=#W(gsIpBEWo8TvlUK1a&H;Ik!y2k?4k+D&wi<*SWMy0k
zju?p9D<GPp85riBWM%ATgpS&PR+)kZC_(3TGIJbHg*d7k6i9Cvv(y<Fs<T)byFrly
z8pS!rz;N$SDg#5sE>^~FaB0n$k;=d@`8F$KH|TobWsK=k3=FHpSs8o5Rx>c%d&<CY
z?=DDCj+L<w9GMIZAiv*d25n|JYRbx31)A+y#=y++k&}Tz{WB|QPbULI6;~z$D<kB1
z3{duWyUY3w<Wo*=aB5`z2F|ab`+wtdSf9YW1FB6x-T|%0VCKA~$-vMo#rh0ptqB9e
zeIrc<2A%}g=P)sM28R2fzV-2ctS?|<tqctJ8^NcOv4S_&zhPjwzlMR~{wh5NW^Qk2
z$ierKi@~O-1X$mIhNZY;7#QyFVPLqwi<yC$JA;AY{y7GQ`)AgJj(8D;Yla@O2-nQQ
z3flZ?#K6E^!g>$nQ7%S^NAH1iD^jt;T>{#uXwkrW1FQ_xGMSgjdIPKsBy;ct>jkik
zDa3#a5E*3#hLmNj#~B%zx%?m!$KeuN8d>*&BtW;$&C6un2azxWT>{U#9c)%3M9X%#
zOyEA&4Pcqs5Sa}S8D$2BErzU%L57`yNGt|RurV;i6taRYI^lN!uh?e=Z>0d=MX_0e
zbrRSpP(;nkWSs=o0V-SlU0Az8MuC<m%*$l$hDaDOFl@TS+6>adEeWxt86u<1z_95U
zYYig<Gq({$q6Q(ci?tLa0XhwQUM6cPL_&*!VMQft4yb5)1Cj-u1>@epngbp@-~c;1
zM-DW|01DZaoUG<xTi-(rHwT-+!N8C*fz@0Uv<97nf#I+$t2w9u1ML9_{lE%7zyh=w
zYVST)P$p#nv5(rZf;(&=w)$sQFL1(RV_*n5$O=C51SGycoHZGeiQE|&SUp(5$L&@z
zF!O*;_B(3Fst9r-NMXo9R!Ad+je%i*II9X+6B`3V=m%Cc7<=zNR`8B5kovUGtdKGc
zblqjAHLEZ*^N7OM4S_QcPw`vE3I<kCgM(q29B3?n#mSGEjgf(wrwh^jH)mjQ+wI5n
z6eN5T+&1xJdJ4{&a5XFp3=OmVm>`)8R7Q5R`7wO}m3mbm-s(0#rq7CyBO*bz_}Kd~
z-31x<7i!#HRO3L+mxV9<nD#O<F!P2%)$COQRl1xIoA!cs<W)g34ESKjg)hMSUHq7?
zgZ7jC^<z2<KGYawJNsWhremNkA3p=g;K^)$Oe;VJgNm<tnSM+w(CfU(Y>=IAeoU+M
zL5mT=+T5r4F--<(1Fh@<X`2joGbaNB$o$FrVBbkHFc_TlW6A}oy9;%9t~k`)Aa%LA
zFm+Np{g~1j8JPKmpz6|*%}WQH2k{^H5NoNOAh+v!_%TI;G=Wka$Pv-Vnxes)K<Z4o
z{Fp*O>L9&5Kc*0HDuy~X#1P~NnBhwp7)-iAnw&QJG5LWsffn|F4EICU<cF@wX(LF}
z<UT(p50EBU%J4we<bkefavw<3-U2@+Cq@Qlem<z*A;aoW=Q*Kk+FJnD6zj)i1JdLS
z)ntQglMRNZSdb=zRentRAWaoeP5Q_IrVkD<SU{vRFc_=?X)@;U1D%V*%zqN9NgY{}
zI#?5Uw9gOHP=Jltf({!u<^Ux*-P?XlnxOTq2f=Aa&(4oY0pto$?FR~31!Myizy^XW
z*1qM(_>Yl+S-=NkG2=fZb&UVO>X2NkeT#*GVWyxT6Q}_JKA9oqw;vNbxS#<w2>h4?
zAq@ga1_nJ9KSogDC(sBr`VF$tZ_tg_QvtarxZjTvl<fsTd)nt^`Y}F53UbD$=s_Ob
z57Hzi@5gwDk%3u|6>8HRWKDO#njr3Gyay_}Kn<Cc-+qku!S056ZwUi~m^{e1+Au%H
z(;(v@0~>yfr;&|2jcgp`$UYVZ29R-}Z8!|j5`qELlCKQ|8|UQ*Zkq`%hPrMyvT>k0
z%7yu%uG@?3I?&QsRO7rr#u+&HF>VC8?ljc6jmW{e5ge=_b-I837*~PReTJ$7t;o9!
zDtOsJGH`W9&VG!bid6`-z7`bXi;>M+3|FWB!H;n!BLlM#s1FQMHxpUiOt3mwP^L35
z=zjn?LhZC4V=qV(s0#wp)QhaC7hRLuX^<x6$9|0EAWfhX7C@THku{a0Yf^s9m7Gz`
z;K$e`#K53Dn=3CTnZb{-85ESuxbku`Kpbh%d>vO_4oF!usIRt+D<>(D!H=;Gr0f*P
zRylD$#sWqLW?=(pcoiVqT7Yh=oH$66+H^n0OpvBjsHRM0O_}JL)TV<q_4+Y_id13H
zDo&99kc(7CNRi5wl3&2!#~2SjX&Ah@+K&-jZzJb?wO){M@-BXippsYkCDaWe$ZiNh
zcZ0kONR#RpKSp0h24)dCs3u=zO}^-wRKI{UiSPAe1oe+Zf}xt+kTtoXYZBiJ(xjm4
z$0!W43DmO&`BoTNlQ38lGy=ttBM^KzG%Nzekt0wX9D(3*Mn6W-pfw_wq%$xm=z@yF
zjy69=BWNc{nSnv&mfv?q24+#vF_7~z{l0^p0NU;L*Y7*n1xP7Z<rWV(J^co|h6kLS
z{(zFnG9GYh`U7?g4>&RX0XqfUEA<0)KfxOTY*+Y!T9)7uM1y^Pj11sn1{$O6$T7+b
zGWHFqNvgo>2O0$tod<3L`h7rh;0Le+L5fuN`@IDD0(8ReyiC8BNQz#<70LhfdjwJh
zY8lPT^aE`uzbppv>La)!m9>7C85x+xK)WI5W%^x4GU+l{5l<O|-&L@?K^Dv3^aHi<
z#S$T|JC3CMI7B%(xt;|34SdwAAEabN3Rd}>Ad}ML{6K|`7}N`k<v}eKi0c-cg4zfi
zprbhb7K1KHT*d=76|_@YIhc)sp`6uknFIr~*kP!tpvw@`;~>`UgoGp?0|V<jWd??@
zJiiJ?24?X(h=VJ@Q@aprDvS`;R5*aj1&B3OFvn;A@dIgtMP)t6WKaXwwaE{BH8zNC
zu+I-vt1&EtI^}XO$WBPQ=|W03p!qEZXu1J)Gr;U(2ET4tx-mWN2R_F74QK?5U(PQZ
z++|>37M}$=(A6&+e9AFMF5J}54RmMDYzAg=&@3qXUq4Xp6XxeBN-bva^8i~48gOCl
z^7BI^d_gHcBSr>h2_{HD7=f!E4h9DAc0VIn*TP-f&&U$ILR*=EVU~`cI!FU(&+oiU
zKXnag1gYNfQwNPCgC?5Ywf)pRKpNN>7=+UOG~wxFX|10mNOKLuHc4<ZmxF;p^^Tt;
zXm}i|S<(uj8Pv~YfQ-&2e4nPn2pXNOu9>FH7|Fnpp|8&fngmkjhxBhxK=<7;dN9sm
zV3vFUz79m6Q4)F`$o*Fg4EG;^FYnN21l>2J9LzkiLqM)5wS+;R5pt^$1H%Ia28IWq
zeI*@B^%>Pb%TGd?CUQtIFs!iBXS9djr}4mvf#HDzE7aN<;B9Kmk|v-9E#PfxjF2r)
z@Y@AWY+wK#($6djIt>l9ZW^lfqyXq_ZU$z_6o^*Xa-5SE49s4y7?>qHLE;lRk?x32
zjesjkfofg|QdA7ze0H(}beul}v*c;ejR<~7dQ&EVc4AF5fGxv0IR|v908}?<b&d8W
z{Z?=agZS(S=-Ly|@?rr{fXbSxF)-NA&~KFi<q!sj2aya65Bv*2nNS~eH#;OaH9-wP
z{Z3G>c*DT(pqGK+K__@nLmxD+1zKzKU>yU)gC$C!%bWD4zyeqSRNv}@+WDZh+YfFr
zFg&=S$-vN8uYUlNd>9^lWMFvkQj>upFH;|Uqx3QchKJG&3=cu&eVe%c36PZ_F$)HU
zhX$bI-hVSNOFhs8?e)>W1{!00!@%$`nStS9G;}@FaUW0sf_6bq1l>LlUD9<NwiiQ#
zfmxbcE;p%&L7$OZoPo(`Jp;qTZU%;joea_p%x=(2PLGs;Mt+1|=ywV*FiUqaGcddT
zVPJSTn}OlsOlAgV(2ZaZS2Hj?T*=PB>@LE<@Ngdk!^0hV49xEG&_JF5TlIHj0>~&3
zW-;Og>D6aoczBC};o%Js$C`oR;VTA)hc6fy>=>B1pbNB)-hk;o3cF7wM}H411G7vL
zGXoQs5d*`+p9~BSzk@ic3=EIB85kaMvNJGo*)uSJhQA+4<T5bv>q4Az^agCv6WlNs
zepYubXlgzBgMo?1k%3tTwC9h}1Sw&qR=^VFF%br4@5c<xGG?G;RR-S*bIgW;iRTI^
zL7Fl$W-{7=5@HzxBV!tP17IpM=-^#YuqH-9oN{~)XtAI$zy2pq24<NhpmkU23=EHq
z7#JQIfH=i44m$&LVm$-HBWDJNNASBgjvRnwNtqMS*ag{%mM4!qf#gY<hfp;zFC3Ks
zB?|^-8OT*29RhF(&~3o47?@?{L4HHemC!_WbOJ~>%t+7}BFj|$EYSFkYz+8HH2q@m
zH~^$(U<4hq#4;7MM_$xKKN6hx7?@=%K&88WB<M)(!=TdLT|r+CDkmoemXnhMoyiV9
z$Xs6mY#_Lr(g)qe0j>?R|LB9qVL$^yhOPRb`FJ5EQ3ht&hv0!QeLZlFU}Iotnx$_D
zsSrT2{~@yWNV4F)6IBe51IG1zkz@iO`aoAR*{ZNGm4KZHiN8ajaavGP2A9Qh6HM|8
z7+9D}z^-OscofIL@F)UY^0F|2CPhKz!lN1nhDTLW3=Eb3SeU9nGpTPF7#?*qFg)sn
zhV3CxhMfQk{9*<MkgaoVSeRT8wlemDY-C_y;QazBuyl_?Y;{otg%tzCqkRkvkLHOp
zFzX%#JCd=V1GH{YP>=<5BO9|$2r~n-?sW!+$LS0VkNw3Nm}Wz^?laDC03}92M;0av
z0S0Ep3(O2mv+Ecb9$#Z%czlVSfoXOp1H<D_3=EGyfH+eb7@jaOFg#&UWMG=Tka^+*
z29W4l28Ji%3=B_1L7bfo3{TV<7@mM`>6m?#f#HcI1H%(jkot?v6Pp-8jJwPeKY>kn
z$uyBemVs&ZS9S)bIgAVpPl6d3o&?r0FwNmLWnh}4#=syL%)qP&IxS!h$joF0h9`+2
zwZ;q#Pl_2Bo)m&O_6!V9S{WFgG=ezZ3=B`^GcY`v9mc>kCma$Mvp~BILBZF<z^srh
z%fK`z0z^Ppn={VR0PPWEU{(-eWX$3yHHKb63@I5HXSqOSjli--XtD`V*#NMtAygI;
zsf@E~K(b&N1E>sWDeH8|#(u_G;O!uSIof+T8JHE8fzBg6!@%%lI|IX$tuPZ_Ffh%G
z1eYzaN|15p0g$N-%nJKJ$pwCLE91-?P;u~8K=3`{j59w##liRAR>I0H##tO7agZ6H
ztE-^ioe{ynv~L>&v!ViMZ#3xE4bUw~Fv%JQrhRP;%!;7PfDm;(<4hg!R!nBac+f`o
zV$c>TM#fBzQhlhWq1tD9K$W#YlyUx00V~r(QwF;9c?tuw;##P(4-jR#P-W1dnb`m`
z4YcRJn88C8Y>*CA1?X_ub?YFJ-`@bOMHu_R_mDC$FeR`s83-^is}wRbFs<9i!0_ZG
z1H%*0CiHb6##07{Cy&_~nATloV0iMCf#Jz#5a%HS!&5E>hNm2g3{30ZLR0>_p9~C7
z<ro;A%CIvqt!HImcxu4F@Dy}h!+JpmhNnIZ3{Slj8JO0~LR0>FP3DQMpe(T76q*Ir
zJ2Fpf0gL!DP2>QX63M{uG>(DcX%y%Pi1n!uPfR>u$H1KS0m7NE1iDp|al#T%s%Btd
zP|(R|WnfnNz|6o5n!bEm&%p4s9CTE}Uj~M!dl(p=Zh_RPj1xA1Rwsk@(yy;$U=XZf
zU{+oNvK6G^9s|SEJ0MOs1H;p|3=B_SgE-R}7@q!PV0ijVnt=(Ha3`(-7aCJ_8aNr4
zmE)la_n8O-!!sdh>`dH(nQ$k@fD#-7vvN5o(IFD<#1g1D=mIFv;RY}>Ks$WFn|DD=
zsiBFee-0#pDj&p>K>H6s5~%V`kPYy5BjbcSptQoktik|EQjmSZ9Hp=X12uaB=vwkA
z49qI(5M{6g3QKuVWfMi9rujjYK@%t}9mAY&08)mMKw%jIlt5Q)ghc1W2e9az2wlX_
z?7_lhB*4I|Q2@H``XB?tGYtlYXG-i0Osmc?Fg){SV0h*U;@n_hcoxmT@GKI<dBVW(
zET4hlS*{`j)2a`U#I))U1H-cx28L%%><mn+IT#q8O=DnqHVMQ5#nn~@hG%O*961Jt
zXKxr7p4|X(v=|tk+cGdbw>AY`@65m;xRileeJe=DlY!xR00YBwFAyh`f#G>R1H<#&
zFb1a8i4d<$hHbn2!oaMy1Eea6f#G=_1H<zgX$Gd%g-}&HK&e)6pKg~Z1G8EyGXv9V
zkdi(IhUYyXP8S2i^LY#m&*y+R(-;_@uVY|%4mt{G^&$p_=ld8Kp6`K1#N-p85N2Rj
zy$Fhk8fdx01V09Yaq<(W0?>s|tThbK2rXlQ78Fo(rZ7O1sexKQAZ3sUEweyVCIh;S
zo`G4-1(dp)KnFl@mYrZgQ)B^ElnGK)15tDYrU;rerhuxADWFzn*#Vdov?<0oc?~2D
ztIY)&0N;$lI0aOhOaX~;OaLYQat3f~8I~uf3c$*_si3JKP!LP#uI6N5R{IalpU=-S
zFg!mEb-`2_%=|f71(FZd#X+`I!7H4}Hc)YWka#shyaf_$>Y%P4qa)N&urOT#mCOd!
zUIvVenJg1K7};RHoN@+gW;4i4_y%moDWDiDWnfmH4HbvFcM3Rbf{b#4+5<Cb;vYzX
zpneG?0Sa)W8fy}$ZlA)yto{LH9O#4<&?QnZt&@BpZq(of8EgpBk0_NUWk6i0p$gK9
z@bx56sWgRwS;H2j9^vvyJD`SzLdBsjp9HFwA@K%xx;z8ZQpoY?j8hHZ@dj;IGCHs@
znFug2Yl8MlFWt|;@cb?V!}HsU3`|Q;F@Y<IrPml3p1);acn&I|mp)=(c>b4x;rVZN
z2BxL&7#LpgGBCX02628dFuagwV0a<T&cFm3yLn;D!0^IUnt|E#D<msU1z!OscwT8e
zD+9BpA2S297ZU@+i$Vs57x^F#9|OaS1_p)~bs&xu1H+363=A*&pdOo=1L}!@0td3W
z9?}W1fG3Zs4v>h^%mxJr=xRbx#6UGqi(z0|2Fh+sp!*mzz}s#D8JOnZfjDeh0l4}4
zh=s`vbfnb$Hw+9fmNPKCn6JpdH2*uO@?>XVTENV}@Zt&s!wXPDbpbyE!;8lZ3@;vn
zWTY7wUVLI;cmZm)E>LG+c*)Md@RAiIW6Z$tQi*}#rIa)S(*i%JZ7aa_*;l>8JPgb_
zmdp%H3*s3VUWPI-yaa7&TaeAb@Unw};bj9zri_8%<#q;!m!PX47c?<2yu8f7@bV%^
zrjLQ)<qHOem(M_)Squy>|1vPV1jWjNWeg0jco-O7aVat|E!YHVJ%AW5m?m<VGB7Rp
z!oVQJ&A_bv4CKDA3=FSi7#LnjnKCdfWMp6v(qmxO1~s!6GBGf`(q>?Ir3uYp(?RV(
zGX`d@W1u)dRCd!r2@WKF4=N4~^67s-B@-iK7Hp@`;WMC!0rfW!SEn&f?}2udK`c-y
z!oa|xH=mb*S$it<>a<r@3=FR<5Lc&x6vCX;1JS{NdUYB|1v@0Drz2D#U!4Y00ny3=
zzd8-6!7)Pt6hT6Adh0nEn6*KHJ^c&=!z)h)hF9)T-_6j07HCWypfw**+m<jer-Hld
zpwbfR$Z3!>{+YG^gSxU@uM%Lz!E_f$$*Th{{}3hb^a5zWfzxUxXDOo0hFU(Y1(ei5
zp;^TMx_=ThxGK)T_@o}<jNU6?=R2`5c?&Qw>r7{6V0<!>f#Fpg1H-EbXv?hk3j?$6
z2PmhHgMsnMJcd99#uxe!Bl<!>TL*<gSeSeTm>C#f*fTJ^s%2n!Rmsl4_`-{U;ng$-
zhF6n7oG=E4R~s1^Uabakk{B3XU1VT*br!_QV_<mooPpuhQ)vdq_n)BV&Hy_tRrU!h
z1G8=;GXvxM{|pSTzA-So`ohe>_<@^&;WaA*!)s<MM5)m?1MHSkSw~h-xxmE0@LGg{
z;k6Km!^gnzTA6|2wIYZk#lY~|n1SK7AvBo!)?h0!K!F8~n!W~5I5IHnE`=mr(1F6G
zkjqAGpd)*XeP0+DUvz-vL4z#Nt7Husz(;{binA~&fjiBNpwI-}70tq=1iH@bumI?I
z#<}_|Otu2x{<ZrH7A8TkQgA>ph=N-s3=9l9p#HU<QYg4rF9^O)o-vD|jDf*&J`3Yt
z=+cgB(4`%GEFjg67sMHuHot}#bnOMG=n{U)!uX$+fmtu7n1N~Y4+aJic3B3d&3{41
zn=xLqf+)RS0NQ^mqQJt$$jZQM`ah6?@fvif?s@^}HV+X6S*BgA><o<80vQ-yyD>1l
zb~0sPycWm6AmY!!tal6~lgz;II*x(ibqs?z1LL(R5R-3|fTC3-RhDTTCj+zTEoKJB
zYl|2dUY9a3ye<amTF=1nx|M<9bu);whk@bs6b6RZp!9R?Bm=|il?)887lLH2F)+M7
z&%p2+lzy%~W?*>zfPvxlJ&?=?28P!l{7#&K@%;&itvA72gGD-JnI>>EFzeTYQqxTa
z&;SU->wh55QwD}N{0t0lcp>SW;idq1e?7>EX;33XK%plxQ<iBWD+9Csd62Hf3=E*{
zac^Wnob?P0Z}b=#-spfhyBQeX*fB7?v4NRq0NTb03JAE9EWqZilx3PM#K3GI1kwd^
zQV0XXn;;Me<fLQ<hBt{YBRt?vg82%3h=IsXS*9t%49o_hAYC9MiWwN*6oNP)Bbpc(
z-Za3BNP!vgC<5xMCE(~dBg-^LfPvXamzja_Q5FNkn@J1|Zzg~^<qQmO7BMiqS-{S~
z_^5?};msxnhBq4^xq{*58V1m{rOXEFL8%^b6x+=UpzOrJY;YMQ4z7g3B~%8|acwt0
zFfhj)Wneb=3@+?g7(iKyiv?CmGu#q@$Qyz${^eqX$TK434WRPiBQ>$eH$dEA7y)ua
zEl4}W4a~@v%z-K@2NjXv3ZIz^$&MXR>1o)dZ!j>v4P{_9+y$}%oavds0~1KM+1&a8
zRRgZ`kk!<|y>eRtqQ;0F%^c8pZ#u{@NHN85+X18yU6BnVBUlkAbzK*L#OrMjP)R8A
zK$dAfD4S(5GcaD4V_<l5gn{AB0d@w)>)H$qZ|*ZNytxVDSTHcW`Om=c<~P#)(s#i%
zn<$GcQw}c!voUCww`C#&1L#sA@bN5`c?=A1RTvoFDuFJWu4Z6(Ys$dz))?u2>AMQh
z3Y+0BXbS<T7KPj|&201;bft751H)T428Oqwz008crQe1#FuV<gmZl7MZIJGl&S0u#
z02fdXA?-tk+u(F7Dk;m9CcwaK@*9*?*%=t#7BDcp%>gA<5eA00?F<ZWTR|K}28OpY
z85rJ96=z_4WCIN$@C_ZJR<ew(oD9sytsoP;7#QAeW?*=`5t?6acQ7zMn$IB4z#JzB
z(RGIhR4|Hq$udq9VqiAD&dk6Zr_aFf_7DTZ+XEnuHH-s|vO6*ijM<<L6DZlik~oTq
z8lZAOG)k6nk{|=Ki6+Ppkcn3q7~Wn2aX==5IWQA#;3gt61&WCtU=y=s87G5GtOgkZ
zGVvJ$!`mky4#-3>2WDalHWQ(F{PqS0=6H1mW|PUFbXNmER`CuCC~TmL?yLYMOa^8X
z&<*vV1Pc>C0TsUhntMQ`_&ZM+7~kbGFq=FFHA+0-an1r#4iRFIM~bToXjg>cHuN+L
z1|C_a6i~`GfW_Mn28OraU}u}$jzDtU?HmTi>#hvUrlBAol){D?8SX|fFj+8y#6XD)
z8s#@?7?|BAL!EzP1_R@V9tLJp@Xbe%P8tXN6wMo3AR%K48V+RQfZwBZ;{oU}E(T`P
zqo7iQ!v^NN8$TErKY?3tpf;Ze1LHNwxC6tD7*O5-&G~`quQCP((EgBjptaKS42&)J
zAt~>A1?(E&>##5oU}0imWneb5lVxCRc>^MTLVa<)fq}^>3{)UALE8n_J3!~IidL~O
zv4XS|$}%uE@qq|wn3gF}EljH+9YBWbOTb#XSeV#Y8JI2BgN9A^FfhDRVPJTt02+fi
z!N4H8l7ZQ53rOZH1H(Hz28MT5pn>Gozafsk3qJftbdSy>P6lR+Ze|9iH5?2K?_wAj
z-bJx9Fs%_`V0f3q!0;{$#8F^icvr)~@U9BP(P3bCH;IAaU6(Wi(;9QAX@9^8`<l*0
zkZGnM(_9!B-tA&wcn3Owbxi;R!@J824DZf^WI%SjVPJUoLXm-KO$OwG>2)b^gIF0D
zL|^OdW@TVD2c6%%u8@J@Ju?Htd(Z_X>uMPo-U~4>ya)C0)^##4yjNskcn>=CV%<~*
zhW7>x4Da<oBeV+{7~b16Fub>g=A(N8py~pYpdeKqq%PoaU|=}S$iTGAkbyyrU1uKy
zvxTrV1JkYm5aA3WVr3bac7cLmS2+X2`#=VU_r5R_8yJ|@fCm~O6&Pr^5hmrsz_hCs
zZW*-e#Bf0aUaj1n!NB;jn1R_M2&4)!M-D$T^zIH&Vq{>p0387f8Zn0&d-n=xumGfi
z!vQpOT`mG0MPl$^U|M|(8h)^|{a8RTf1iQjeI^6L`&3W~&9r<AM9p>Zc|>9oEKKaI
z49r%b;k@Ms85rKTFfhDtFlAs`evW}bOrL?-;uAXq)AGv<4DaVKFub1yI{S9{Lx>Ug
zR>1NF1GA+hNZB(6hWA?;7~XGWaAROv0X=x--T_$Ya1VAe#Ti{jZcb(frWJw=4DZh|
zFuXs*&cL)nmVx2@JqCvNcR(CX28Q?V7#QAz4qskj%E0h}iGkt$A87`r6%G*F?}H0w
zF?-!#oD9rX;ULp|85lmuGcbIR1#u!77(VDRFnrJfaZ(u=KG-rae6UtzU|LZKNo}jr
z;RdlXFo*@|J_Q8?DA}$mVPF7V^6~+6Qpc(W28Iu13=AJiK!d713=AJy85lk^gE%u7
z7(Ps4VE8Zz#96|?@L@3n!-s{?n7VHROKqSLj7+9#PzR3*l-ghlDqtxDtN@lmF2W~Z
z817wwq!6nTP=uqUkb55>Da5J=A_*(T?(;xX2%`}=f$+c*2<YJIg@O=2U%vp#s$zL8
zOdPBX%(j==8JHHzF))1C&cN_tBWM6Yn}I=W69cmqXdGmr0RzK_YYYq@u7HhzjM*~W
z2cOq0c1VeF3NHh*?RsVgriJ+o3?JSzFnj<FFD<NLVED+z!0-`t=I+8y28NHS3=AI?
zK{iceVEAaq!0^#ZoPlZK5{Qc)_<(9|u|G<T<(v%6wxHpYh1(byK1MPyd<+GdeVBpa
zV+jMpN6_in3okG*e4Ng}@DX%+_QJai3?HvDFnl}-GW!(+!zU32hEHrDUwmg^5I108
zwgsIOzVHVF!>1qyhEIO-3{112rS?M>=omV~L(tKPp!Ce4#26~bz-;3U9kuwB#lY|>
z12Jj=QVC7ja6PD_79bVS<8_c!AdgyrRDkSaU_gvogfTEJg4Sz~Y#@>hE)2{z=h+#U
z7O^ofe5z((_*4$!2r@8yTExKcX@NKc)AXf~;CmDS>L`e(D>1rBGBDfh0u9}6Vqo~R
zm4V^YW@v(Yl)}I?{S#=!(uDz*S{{L>*3bqz7#{opT|>mcYy&#}ni(|E0j-1{f(Clc
zV4Me_(G8fBp+nrZprJWNb5PA%j<943NF~T(kOW7$0xU^FO?uD)8f}4&rZC+9!oc+I
z76Y?w3TTCb2Tb^Z2qZJu)_~GGeE5{%fe9oZ*n)>j5zU83M;MqEDMHjjodYT(7urDr
z>>+ev6a%P?T<FZe@aZ@M!>7Xx41o+xbD*~iTn8UDE?&;U#044xoHLby;nNcahEMlE
zbHs}v=3Iw%=oxqznC;|1Gs(*t7(O#IFnneN<(4@&Aj%&70msi|Jw|(824=_A%nVF(
zo-r_dmSJG{ECJH>nStT6IRnFIV|E6nxeN>ppF<cJKKp?<ybKJV+ZY%=Hz_hO&6Q%F
zcmg!2H&>m3;qy`khR<{58JOl8Lo9i00BeIhh7Jic$mlT&vNAB+y=7)#n(M&8@cASI
z!)H*9I@gDR;qxs9hR-)ZG7$_6pI<RBe0~8<Dvv>v*N;IxKL;<+Br15ARUFAC@VQmu
z%k&t<SQ(h@LAe!d`cDRi&!BZRAk)8aF))1LfSUeAih<#a1kCga(DcB{<HW`Q?)rgh
zPH_h26zExlk7t0&C-H51j8Y);L2F%7o-#0e(Pv=zq7FLi>k|XRmna5?FA*Tl4F-lU
zSquzcGGOL|M${jJA{}BZ(_F}OD8m!*5n1BL^cZzG8JHcwUN2%`_)^Wl@TDB&(mDo)
zFH;y8zDxjdx)>O~tYu*MvJw>V(;$_`{7I0Ye&WNx%D^CgTkjhy1G7UGGXvB7`3wwS
zjxaEMIRxUYW?=YonStR8XvlH?b_Rwoj~E!ffDX`~f0%*c%SQ%=FYiIh&NDE4Wnf_V
z@(=3rCke1h1JarWH7meJyTh9(;@|atGB7)A12s%=G*P|^F))1PgPC}NfobkyP&NR~
zaAY!p+O{yM8L$cnY#FQqy1D?~M0v~s$#V{0K?a~zK#w&b8P5?k2?A=OK#PLMpgF3?
z49t!Opd4=rs)R~SpgA6<qym%x7?>S>K}tY#JRo<$BtdhoW(>@Z;Iq&X8T|<hR8teO
zCYWD9B@-yYLVdvm9;4<gg-@V?^8TEy(8${WEnh)-f6gujhOb%-3|~QqQduxC@GfRy
zd=4JpV_<gtBb1tw!ob4#T#A8#@gR8X3k&0O@cLcQ!4~CyER4&cYMrH_YM0AF)vm2$
zVO(wuS{TT}z_5{-g>kI}1JlMuEDQ`Qf>;>WOEWO2tYKkbIBCtoxB<MNkA;E3XbKDC
zM)0aVuFRrB1{TImaG4$!M$pz-hGkr!bAVYGK}+Gm`$^d3SQxj$l*LH0Fm8t!P+XeJ
zz`_W+<OaO1+G{Hd^nNB51_pt07RKA4Q{GOAGB7(`1K<C|!nhW+y6P+gNa!UC1A|I0
z3*%16dM1$2pIFch=PZmjq`~{GKx@WzZ?iBy1aF~%Y{r7}9x^b1f@gmc3nS=^Y=%<|
z%+BsY5NFQ??PvvUIRrU-t`v9=e-;CS;{z5(TWC<aI75TdR*3--?6&5hpyXs=Sh$Xb
z(GIjU2XtSt8Yc^*9cZC!6)1LIvoP8jgD$D#WMHWDW?{4gEs8$HRh*j6z{2PN4i*;B
zs%REQM+pXI7iSg*hUQupM)1{t%eYDmjTu-NK|7ZiKzoeO#<DPagY;B!<rO3|urPu)
z{4gxz$}7lVU}5wH$$&V;3@nU(5DsX;CJQ6@^aIdsP<vmnFoL#zfKAgdXJM=s1g+v_
zVPIgp#lqMI=74TCVz0JmU~qWO!YISY!0ZCrvtU1ig;55wM%SK!!G0nOct3zk9VckD
zDGQ^p94IJ2`>zAaSQwc=x<E+-q>BkG#g&wj$iTwLD#yUovV(<z!L^fx5wiaXw0pAp
z01J2ruM23;zgQK^HyH*dQ_#Bh>_05u)IobJIl%UOvjbTJS(OLg-&TD9q}?Wh<s@kF
zo@)<8*-2@TG7hjUCqcRB4G(As01NnjILJzF7V!0OAa*eW3;1@pWjx?81s%l(TH#%g
z!N77E9Ed!51;q?3SHNsG1_qm0mTMvm%&tA649u>zYzz##w^`nDf|3OTXz8}@ZI%xZ
z9w;C=ii{W-RN7ezK+bamZQHe<!BU_MavmEvITwMm2^#}L@e-C&m=!!>EM;IePjNvB
z0}J?!8_=xhA_f-FhBSu%Yzz#`FSAsF;|pYIS|LjZFDR9PkKJkIX9)x)+$u%}W;f8T
zRr?t%f#7|VYzz!%V_86#`+!%*7cXIn2iwEOz`zs6k^p8y>`Vl+*%%lWF|dI5or3I~
zY{>#j3k?53cB=HUL_o44=%9su3l=YsouJKPZj&L=;H3icCuqsC-+mTz(C`FwIc_y<
zYdPrdC1$rb3Q47D3@kRBponH*`0C2Q@YN9#$&8>oy8QM-%hc)~(8Us<MgVvvsyhRN
zP8*9Z*kI67UC@H{6)d`-ldwR?1=!DE(bWODfG3lI1+*cE0ep?tsu~tGMvyRQSv5q9
z8Yt{QS{g2~sDTd3ssgQBJbaNEd{Y^0<+>=W3DW_ZDRJL#0&+DoBex_2gEBt@!`FBQ
zhOd!wpc8|b8KIj(7`|3BFnq0)1D)Z;%*Y2_nEthkf#GWh)K8)=ptZP=+Kd5ozSrvM
z%#4hnT>|`!49xB?go+uM85u=D*;FVQ#02eJc>@a6mHy1%!0I4%hzM*+G<c7$M@Szd
z=mK}<Z~P$VF=lBL7bP<=e^Ue*#K7=%HUq=g=^9|ie$!=OVANn>_`02e;p=*Z6b9xW
zFo)h{VEB3!WS3+&^Akn}2EhXmyFk}CforTBP*8Z>&`4ome!>ruXJGio%fRsUuSPKg
z^AkDHrA`bC-_jWvzC}YUd!hlc?Avw*hHopOVPIs#z`S4%C|<!gU1c&aX3S({%-~$i
zm;tS(L034Wy<$Ga$iVE$%A3N#d`bXh8*ecK^C@|dExcf_oC0O`Qy>SkWif;5L70ON
zfn5um6Z5P}PcdX*UJg0vF)O_o!~r{&F%#m<<(g1u{$*hJ_8k-^`=Md-U5kO?yOKgN
z1M>lxNFoEn_ejtp;-16Ivl*Egm_0#*Ru0#hXA6QH$-%&osK`898R5*?24K^585qoF
zGIxOd^p%5wLH83gXoWlYDE*zT%pI~&&4Q849iYPtKu4Cu?qcq+Mi|uL2{y=vf#F~u
za~)_0wwF3@K}it<a~=3@Wblz&%yn|0I*kKVvoP0bfpz#WFi5RoE=P(|5!j`x8lWik
zDoHP9U@nIRP%;B^xhQB8J7cCs9s_f^JlGJ1@6#9<zE1$f&GOaEX^afaUZ9gsbU!ht
zfvZ#w28Nxk%xR$WAP?{+Gcc!tPBdBuiK#Rbuo1cp4E7Ps;UKNAAVClgTJr<)>P}bY
zaBvWSw1$Jv+<|BfHw0_-VPMF5!we~OAgNLWc2c?n$P3=a8lZUf0%sithVR=M7{0I9
zC^lkX29-;q<qQnpA2Tp~zYR()PCd*v;L;0f5bW3nh(Uc|gKR`V;m*MDgP(!n2Rqmx
z8x^RK8w0}+J5b2jfOdXsFfjb6WnlPG3R*E<!@#TuHX4-8IT#r1x|sFAUgQP2P7j<a
zI2agMZ!+tFHm5J+1-VcUd>tBZ9s{!;IEDpyQW%&GL8a6i@ImMWf0>mTL7@P3FDQ9{
zQn(Dr<31{&xKjrEn=wnFfPq;ZTv0GE{8-1p@M9Io!wM&vWkIfjURF{88wb+?8?ZYa
zT(rr8^B7}RIyi61f(ph{jG0yp%s#sz_Evz?4CfzadC+;pKBpNNejH<9_;HAtf!XIe
z1H+F83=BW+fH;pC7=HX<VEFNcoq^fsJp;o}5e9~zJRr_b28N&33=BU_!6(cfIm9dk
zb`}G(FX%+i9SzJvu%y(ui&;n!lqDdkKnQe3)hV7#24+!ERdtF7)VO2@ZIWZC0v#5x
z!<q?nx*W4F=#0F1nM_Ri;9XFhpp8sSO!?q#P@D`5?%GUD`QUv}ETDZ*OiYE~3Yi78
zyNZda2y8USxahY`OrUdid_lWkK*puQ&J|F-!^D&dIw}m*_yZZ2>I5odp~iuZ%>Xxc
zz1x|XGT_F!yE8FGF)}dw-URQ$WMYa^2JO+}gjgE|Ivxvjya>p+C`XWSAUDX~V`2(o
zWMKA#?0;us3IZP>2h|h=$|5jLLDpbR_6!VOEKE$^AWddab>84(V4z<2)_|!~Tgb%Z
z3{nTWaR=mBXJmEGaCL&LOib1wb)a3hAa&ND7BkFVYdx5Gf*YBb3_<F4Lw#tdg5*O(
zQ0&1p8G-{0<ioPZOyDi_exN24D3sOZkTikzu`$3jsoQ{UGG}1On$N@}&&a^+4?4sO
zq)8sUQxNK1c~F%A(<E;N)3og{6O%Yd6R6b;(j*QGOHi1L>%-K|YhYsH1E~YW9Y~5#
z5-cUjz#!Gd#P|m!1=^-OFO!M!4|q!@$RBo2OrS0sv;Q`s6b2^7=c1r;LI{+Nm>8df
zIys=->)C&p7+-=?#2Zj+L+l<CXu~=KthKQfbX@}|PwxO_$$(CEQ1Q*gcv=vY?HL$;
zMl&${3^hs1En#3{Jgp3N6T{CM28N#%6B*@-ONtnn7%xC8sGrjq7=BKHG^iN<lru1h
zfexAOW@BQ!D#^g0bd6~uhbjZZ@mwZG@D405rilvR77G*OEtm;Q85n*phIWUyE`Utp
z2S5jbVIy~2A22Wnfv*As9djDVz+mOU#JB^LouSRX<*?09D?nZfv@?M?bB6$^g~Gt_
za|Z*%&rMK&?vR1{^ELy+&+AZs?tr8&hM%BP<MTvDRR#u-FZQDOVjrlWMDoQUs4sp=
zFfjZQgSI(V_#j*hnq~#xsu|6|;JSy2aW!-fOaxRGfZ{*_?BIE+3=A38OpL3g85opS
zF=mA(GcYl(Rs;1t88f9IZdohEz#KS_f#H`r1H&&>P>)n6g^6*k5(9JKV(?K<O4s-p
z7?h@zF)*ZuGcitu+O!nZdj#1O0kSDb5bEKn;6j{%;g=Ny!!HxChe6Ra1L{Ezs9%=G
zK>Y$6YdE$7;-xI`8Mo;nOpNu649r1ZLXh-QFAhpC6B$_`vEB<dPJk=96qIV3WkD*z
zZWU60$H>4?mB+-G2kO5B)k5{>2}AUQya#emA?UmrF9y(wOOu~5eTMpJ0d%Jv3%I=;
z9-+p-u=NwuXK>&#F#L*PVE7fL0d~-5NOoiRRnNfit6B~0s?VSyXD<eZU)vcNeoa>>
zW?=dXt;K%ZFfjZ!Q7BDjU;-Z~_lAMtcPazJ@5FVC3=DkQ3dsyiKlnhA!ocu*5d*{T
zI)yw2rvIWKCo?eoab;lmqb|k3P_v$i5wtJ~w5I3JRR)GX`=uBdR{Jn9GD7wKwPaxU
zt0~36uyZpLBQvz8^S6$H;ctZ;=<*6CMrlyEJ!D|`yPSdHFKFO^;~o>E3@-x%qZk9j
z-|Gwvf3LDIFm#?}Vw45jF3!Ll4qZmG5WF~uuZoG0Q;2~%7<3s#cqRkG-)9UAf1iNn
z=EF-MRqSF3(6}RC7ZancAOmyAb7ltS@J0rPzuy=b{(b>*dKno0u`)3HW0ppoi@sO_
zG<Cr@o9U?t19OO!H3M^^3TWS60(3FNVinNXFW+jW=OB3}&{jP*28Mqk3=IE-!0Mov
zb1ep+P|vrI=_N>A7W6`{e<}<N|CC^(;ENd;n8SZFFo%F=eL(Y=8K8NdbVdWX3K<6G
z=rjiAkX4{w4oF2N69@cI`^7F${byjZaQ)EKy*LJ>A10d#S}gz$p;^!n`T|<H!gr2|
zF_@QuIdmE*P?j?={4--<_-6#-Y-V8i=f}YC&kMxa&%p36hk@Z=5{Pq}f#KhD28Mr=
zL7eLh4FA?MF#KE1&cGc0h=JkXIR=J*CqSHc3=IF?GBEsm4lMwes6d<?T8(g29ei$K
zi4UrCYZw?9<QbTwogmI#0$-Z21U4;iz{D62a{3!)2Igpg1_scX&i~m#oM;Ay|56ML
z|6zsJk|hYUA*MnWqcSYn0h`iX0$cs3!Ni!%%fK84ineGG28RDe3=IDbtQnZ271$Y=
zqqP_q{<|_T{I~aDV2(D0x(%imtip_e;eQeX!~X<mJS@3_Y&k4;7w!OwGBAgM20=li
z^3Xt9_ysCH3lc~$^^3r<$-o>2z6%sFn7XI~s{R5*J!r6;Ll>@V2?KMKH3M@Pc;^=+
z4Z+t5Gb}m+kqu{q=!NN8+yIHFaL`^@B)2V|1F<U{eDf#7v}$++F5Uu?g_s0(1t^}h
z7#NNoX9C?n&H#$0@Dko+2Bx==Qo)FU!D0^6V^9$pK8pif$~{&DRT1Em;h7%WfR3IA
zjZ>W#WV#Ag1v>O~>nEnG@?cfq(&Q?r^$$97qGl`8RnU>Bpi`|^`!HQ~02O7tpwjND
zFQ^N~Q<7W2z;qqdZ~%?TWdC6T9m>J*22}cn&tW<UEq#Tcogqfh1<A~jS0JVDK~Pn>
zih<#ODFeg*eDIwaOb0<{2>fSY_&<w*;r|ph28NogOb5a3GX{qL2N@Xt@6-U<eh_?n
zIRnH0=L`)0A3|eU=maE$Bftw@z#++6%)p_b3R=Dc8pKaW>|tRLR$*X{yu!d70p9Kh
zR?J?^!1+SO1gsps*@Z#a0jdym=PMIj;TueaF%X53;OkD{3O`^ftbi)CgvTq$>MxiI
zr$7}Zp(y-;sc-{SVK<7xKbQ*7KoxF;D`Y8VfO{F5xrCp9R3WRdmjZ=h83VXl-Fus9
z3oK$$I;T<Akciy^PD%`n3_J{s3~Z2y-2zHdrx+L+3>X+0G{BL#1)Q=N7#V^X7#aMa
zvz<aYpac&}KW6Ssi=fsBLiZRloB*{*qS+zVERq7HSO!LhLIy^LOo%m$KrQV542%p5
z85kL+7l68sOiQ^K7*+)^P2^BWVPIMYX@4;?ykuZxcq)x33kAP`>LCUl(2hgqC{VtN
z_Ge&ZWMyDv_zx-m7#Y<W7#S6zfh1%Bawuq=Xrcidd|{d39tP$GkDz`Le89lG0DN?y
zNfQ(J=)h>uv9DV{F--zHowt~QX%e^@$x~L$z%&KyGy$Gu2BvAydf$kFA@mPZ2PmIL
zr$KUahd9XBAgvvcTM#1{7*?1vmBNAwdIAFjxc3}=7ZOyZU`-5+jBX5!j7}QK3{0ge
zpsdWm$e75$$QY~1z!1>RRL8@>9Q}@gkrA}qzM>XV4ht55{0JEf<6O*`$zh?wVWGyr
z06Hf&`kgVzF~(q{_!yX@??x~%sAn@JLml(|0;m}Y+DQqDx0rH>W0K`Sniv=vdl(oQ
zJ3x*})&`rv$he$=k#VsV19MC{#PaVKK#d349;Qstn)sL&21Z8Ey7hg~IQag6fiW@x
zwD$tZVW7gzzlO;l6lgL1prX+q5}Fej85mL?fL6^JF)*yqXVM0%*b50(ZCQ|`K&rJt
zqf!qUVi*|e8<><C!x<RzeyTZ(f_nQ9M^(dWCUE;W7BtQ$)~4nRN_nRk7#XiIFfv|H
z1ND&9oIwldL1I4`7#Tl-54BKp;Rcz+z{n)Vz{n&b&A=QBoz<-d_ei*u)LaA^m}85W
z8JJ^lGcYo#GcYnKgE-F_7@2Gt7@4f0p09oYUHAw-5Fry(r7-9*Fvos@y7CRI7Os8+
zjRgTUchJ~K94iAOlMe$U6Q~gqC&<9a6wScM6bUo-2d1&0L3NHNY7XE)0J-H02Lppx
zo0<b?5Djz&OLMK71L#olQy`U+{A#u^m2sehamCuyY(eMKKvmj;@;z9ku)Z4TynaFO
z;#1Ihkz#FXR-mB+s7fpF$Oy<x-4r!*xS61N3b8gdb8v`*hZ5DyAt4>kz+kPeW(ZaZ
z35H6P5-RR3Bw|4Qe}+>Gj7)h9j7%Ajh%tgiOg94~Qzx`esZ0RhTFo2>+WpNkk!K1E
ztcO`y!oVEQ1=@!S76l!;a8OrG4{S9^2I4L~&}i5xkfiTjHEo!rIz&<%>{XED=7VY)
zFi97Pqz0%a1nVqHQd5OVf(}e-u2oZoNQN^oG|y2}0!u=@3$hOs-QZqg{3eKZl|WN~
zAn(p$U}TyBjp#}XXhbtZGB=|Gc*17SduwUXti>s22Ilw+;8ugRv<a-$V6a70A2g~Q
z|A{w`K~!Ivfk7aaH-kY`-;#kj{u5}HNg&;bfkAMVs0v6~f;vc<iX2E8=s<RDQ591L
z1_984%!aC>Y7!uEaDH7ODg{;_4pJ`#R?o)3V5ll816Bh%R9;&YH0mdi1WFDLJ)$Du
z&OE3aPz-W_h#CWPLNV9@O<D{LCm(T0fqbzHq+k&*=;|g8DbT<es3oJdk3$NSTEQni
z3&wMZ!&P2~s1yesE&ql$CAEx!LmX6bz2QyEW8e@6CEPb4`*T@1L_lMKRUqTPf^TNx
z5CH`;*vK7II6$WsGJs?gg(0$npcn(oHgIro!1N{>LS#W>9t@BJ*pDpNss_6Ubj`Qu
zC#^_E2Bwz1;7h;Pt<nkwOEH7?Vtv$d5drm<K=X_|H?>?qzFWpyoLa)5<zfy#hAOo%
zjX}#5)HnlMtZ-LL4`kR5kS@>_y3wp!#wrX9+zUZTkjG^@7w7<T0|w^Aqr7Dd)42@5
z1(h-bgQvNv7b636B4|{6UZ$xR_?`m}&=94m7ib;|d|*EN5>ppO2IeGY&@@)2sS9{W
z5_CeBjiRY7NJ0i8VXFWdMFUCHel|4+NkGp3HHDl~3rY=!(@nKOsUayEqD5N_q=kcl
zp>%<%HfS|I_;9OPyfbcsQ$7Q8QaNvNKEsTg=HQu6GX{n@H*Us_pwLNLzzMqRnwxPW
zXx`zJ5U6>}&A1U%8vSQbVPNPz%*{9p78^;RGsZZLxIt%EFciddK@@`y4rZtVDW33$
zn{g^A0zi2q=@%#HOnGj`shXexHK^igpwK=AI?_8VnVYc}<b-6<skb0gdsRUJ3UvbL
zs6vKQAX9sfb2GNWoRAEf5eF%51rO&#O>F~>{eYct>;pGr1IP)Wgq>UqbwYzGk`o~3
zh%q=aFid3NW(21tXbocrD+^UX)p7C-b%+P5!MYh3nYJ@9GHnKrCvZbfv<4L!7Z@0s
z&OsYAb_w8HH&qxI7VB^`mVw*>Y8$1nLfugYHVNuz@J#W4P*5DG=VmMd1x1P;RACW#
z@EjTxMW9-w3ZyXUBsXIoSYbF+VIH!=JWy6##t_ZG5SGr(m?Z)!@*F@r-9Sa23CLF|
z+n~P60_$X8WO~fN$aL2P5|>#Z6HYNOGBYtSGQpM=IYfX?Z-BING8q^^7i7#(;bu$`
z0kN3gax*51m@zOIXmT?~g4~wMz{$X16v53Hsmj2>2$~z$e#6ZeX~4j+<TWP)L-rqT
z#z-sh{I?kcgHby-qZ3#cXviC+%L&x*g6VS715GnSbvappb)8|%%*$b5Gy#R~DF)_L
z(3}BCqX}raM;XI=#>~8O25v@mko+>xW@@N&)FJX9?MV!blHe2tTI>pymQ)0}78J@g
zv$z?#!EOQ_51P7|n~@td3=CQ#0<wo&53JCLfg$P`_g}EO#~cg{sf)S)g31TbbeK^D
z_g~QDQW+?>F5uvP4^oxJ2~qVPqzY7l8%1!xhpQ5n=DrJ7rO2Diz<n1q&HIpH0b@~q
z5d-%*u)mqpK<7)(s^LBdnpFlFAR5el4%GL%1y-2Dz<ms=up2y=$bAf~khdrwBn2*g
z!DrWT9|vbbHU<U-aqi=wV}Zbp4Sg2w)u1o~W!|*SycG=GtHCY>pI^kimJQUO1(oew
z3%OfB5};F~(k=<`Bo{Gow}Cp>1`G_KCZx_$?g$ZP5Uc7Ww;7bRk6S?mR4R9@VT=KJ
zGaWSf<J!jvx;c8uYYqm6BYPNQ?7?>uYB4bM7BNPEoC3-`=|;R242%(=qwD{Jtl!Jd
z2rlG7&P?|M$%TUCz+UiUVGIK417-g7ERb9fNDf@O+dXCU2g!lWYy-*pgXF+w7OrOW
z0m*^QTm+Ky0m*^Q%-hN636cYwxep}g36fjJ5YE65R?X-NlKT(IX@RhA7`Snf!J$#X
zz~~B6{GWl5S(bs3SrXc`2%N&eoG}TKqq4yFG>BYdbOM=l3UsS9$Py=zKClBU_b}Rn
zq(BbHum{Q6gXEThDy7-$8Ersv|3NtvBxM7V0{dyQ6Qd<a3goAZGLW1lNDge|)HFsj
zkQ~^^Ngz2hkQ~@g`>h~Z2kIw5*kHE>sPxD*1$QGE)j_ok$X6B&jLarHnGB4e<{4v{
zLOuhd253cB7y~17AOj<_zcd4LCUnF~5IoY!z{9A;!@!&=$jrc;>BhjwoW#J$94E`b
zoEgLby0jFg*aF<$lws87sRk)z%z`KZC4uIAMhTGfL0-#@2d8yL@V$?x*ccdce=^E|
z^7bu|O6LoVq9B!^NYAW=s1$`%Zdwcs_J0|LK(b(SW<z9!K(gRKTC2s#50V81Qsz#G
zEa*Z~hGh&+49uCZ?jNXR1!2%N>dcvUK#uKW%mOLNfS$Z&2WkVrm1J2lGcadlGcYpO
zGB7e%f^Lt6dfCnZwwxTUgNM-y)FT0h(=-M~<|)uXZ~_%v&_uTYWHbW<19<ExYfd!-
zbLt|-EM^Ag)b$LE%xf7KnHL8lDF?4SVZR0|;ubM5GT&ohWCl(Bf;GHnU}S#H0CIn7
zDa3|gs09oKpd^s>3S@K}10#z710xF?$Y_{47mz~sXWWdEpiSASAT`bmj4bvb)0lok
z7tIH60I339KnpT08?^i3_eTasmIMYymMAv{gt|8j3{d-F{j(XM%k-ETn850r85mh=
zK}U*l!BsIaFtC49WQ^lsV9o|z20L4dfsthq10%}<(7Np3&=ei~2DJE=gAJsRnStq#
zAOj=IW(G!<^$Z|)GA2Q`zB7cvmUx5b^m59W85ols85mifGcdB;1#$cs7+GZ*7+FQd
z85olwXKR5pF)=W3*oiY0@-Q&x2!qsJWME|VVqj!-%Vl6pf(Alp1<Z3G7C1my#F-LQ
zL7TeZ4gk;da|DVr<%=*d=Xiq50@<0uz{r{a;y5xevbHcVvev<dP($Z1Feb$?Fy|zK
z#-`vW2{43iVPH&p3l(E<VqlDW1PQY+Smtg3#YN6{W(LN%FAR*VYZ(|>7c(<3#xpW7
zvOZ>DWW8C<z!=ZRn8D7#7%$Dh$R^If$j1MH5y_++uqPN8B*d8)@K}RXTZ0S(u^3^x
z92pqdtigdC#{qS~42U*H@Isc{2OtMXF)*?<GBC1Lf;j37jBM)}7}=JCI3^5?Y<C$L
z*{-rPFvdADFtT$pFtRg)IDQO_>^cmL>`EX`B#hGzav%o-14p7b^G|UG=G-G7H%WmA
zbr4|!QVlXEo`I1)8pHvaQ^~-{4%)092Qp^{10(w+XsI3E1M)9uvTmXP8)&?*k^w#r
z9rg!{oD&0+?+=Ja!@-fsz`zI&>AauJ3`~Bk42<jt85r3?cg_0=GBC1#WME`}4U&;%
zVB`>HVC3LsXJGQvWMJg5V_@Vk0C7wi7&%rmFmlW_Wnl8NXJFtcVPMXy1If5BFmgO&
zVB~lJ;`lKza@sR6a>B+!BF-={`7ME@0MIZwXrvNkLNo&dM>_*^9_T0&zZeEa&Ts}s
z&R~!UX$*{<GZ`2;VY?+GelRfk_cAc&?S+^E>*hzAfW)C<Fu@1|RO>*4y&2%$(~!N)
zNC6WGYn_7I-1(Ux@3S&6a_(VZ<lF(`2r@8oUT0wBybR*VGB9#}VqoNaCkqM~5Mc_9
zoX7|U=G+I+Dist*kY#Di;HhFK(D@FKh=>NQ=K&?UAD|>(P{qu^wC@-LBbOipBNu2>
z*}jVmj9lgnj9kVbnY#>(TmcM>Ts~n8O#5C!O@Qr>6JcP^KPAh+wC@#z9+Cy{TjZl*
zx5(FU=7M$}g6+v-VC2dG84a?hnt_oEv~yq|$ew8oj9imEknDkLX9wHC$hDJ!k!vk<
z;3awjXstg3a{=g>KFF{;Bj_j`u!o^x5)D820=zXHEDsvR0B6D4g%Iz=fcj3L0GR;_
zkV4RD2es=M7`bg37`ZLO7#M4JLDhl!&meUg49o>5*%=sX_cJhZhchs8hcf6fFv5+?
zft74Aup+@gY$-1@10&efd<I7DTn`4u+A~m7;fg>eo@HR<Ze(EOu7?!G`4=FHVxg1M
z3?*PE-eG27%zwnd$UT>VksEZXN&b5VMsAR6cFHm^=KpbHV1(=30&`957LeN+7#M8C
z81M1GOnAt^$bB2cdC$NI66F5N4l;p(kw=k%kw+dH*0E<mOCA}R3y(t*Ru*KvV<vRH
zBQ&&Q-+)em0PQ*gjkSSl=*JM}$H78)1IYPBrJ(xr0|O(EF#{uyK8W*&fsrSefsx1C
z4zx!Bs>uQ7@;F!y5#fF>!oXaV4$=bBU&p}60~$g}1?iv3z{oQd>XJAgP;(HP7vMwh
zaSK4ApyGeuWr!UKFq6SiUko}DV&6jsMxI>^j655d85sAyV_@WY!NAD#B$t8lD0CN0
zLJVx&Gy%4=nM0V-j8mS05pM1jnA;OzN3+=oGa4{5Fc;^8jD5(!$jidO2)Z^BYzMC_
z10%1r8v}DHw8l?Z12<p|G}=^z87(<MKIda#<TYeq<kbanq!}1_Js22y-9Q`-21edU
z21edcXfPyz&S?YfuVtPHS_2I$oDwP+829~wlvt4X1g&3XGy>;}efH3x0S`7afQIqs
zFff;_207c8fswbKfswZq#ED{H<Xy+W$h!>0No8Q<z01JJd%2$xDWGnERs(RX6K0GB
z2M*NaL<X4OKrFEDB!t1&6O=T8%<^Sm<l|sq<YNJGq8J$Y<QW+GK)G^XDgz^*Ap;|y
zz6S&2z9NV_5oWM6Fzzd6VB~XPVC1udhCreS)T_)BIoLquK4=q82K!>hOa~P!MFx1%
zNVH&J+}{Ax<O7OHQ0jqef&@(y#L6^SqXE2Bq%;EL&It^Rd~pnnd?82)B~1sGP|{#U
z2Zu0Y5I8JgMm4~~A`RAc5)fweVPs$~^@17O#lXnd26b9m57a-Pq71b17?cwkP2m1W
zgB+d)%6n!I$EL%Q_ySPgD?JQKC+-Z4eCrt)`4-B9HV#776~J7Q4lCYyxItqK%%xjl
zdcH6)^1Xu{LXh489_n#oV2s@cH3E8$B7+CWsxqEx2FBQ{j9KgqjIr+-82P0b82QCO
zoIebV{ALV{{Ce38jIoaxK;#K<055w1F(?B%Ma2kSAzIGB%)q$p7Xu^zN(M&$+3XCA
z%S9L%1sE6@`F~|IFfM0jC}v<>F3-TgX$O*1U|<xGXJ8bN1aWj37zLad7zJ#g1zE-s
z@DVZ0WuW8lm`fXA=i)JB3V_Nk2IjIwpm;BBfF>4L!!lC?D!m&lJprN511bSN^0~AF
zq>pnV2b;WuyNbLbEXQRgfK-9Cf=y;AW-tV$J|_ky;l&U?XTm}qoT$n-GBYp<Z)IQ<
zNMm3Wh*M->5<U+(gHHH11EWA61EWA!HUpFJAu*`OGN(Xl!}2tcEfWnu?f|8c3`RG&
zAGR<s3BP1uE(aZV3_5!ylbMT=1JsNIZJ<tP;!uG*_X?=EM;OF3Q4Dlyg&R1M{xv`y
z`~#eI85mkXv0Y)t%)t0>5(A^a3I;}jMT!iJ|JHyV%=m8y1Eauc21bFS*$j;T<}*Sa
zoF&1)T+YD2Tmd=&hiM{*3&=N&ZZIcgWiT*_gO*P~JYm4dm=0p4F&cmz!4#wdaYQz>
z`OE-b+F$X;jR7IG1D2q(VbgIo%8W{kZVXJ%1EIQi!1|kTB|6HC8m!C=OwZ#O7zLg&
zFbX^Yak3Z~1->&d3Vek+KKlr$KgqycaUN8Pa`b~r7LEd#+p|GC@W9(?L8VP56GtH^
zq?|xEenRZcL8%Wb>zNstSxp%j1-Tg*1zEEhm{~PNK%^`z=5j#0^GX?*E6qV$_l)4e
z4iHyV`hn_Pgm45@7<2+86UQo$B>a5-oE*@AAjlYSKr*v!fI0~lMrS~=Sp^!}Vmrvd
zC}_mMD5%BEz|3}&fl)Ayfl)Aooq?I{DFdTmI|HL&D~R)vfl+W81Eb)SYzAhwvs}<1
z$^~sVoWj6d`4ME95h#R;8DTEZl>oVdfw_tk6n@2wurehVbaZPew5-bw0Qm!?+W@MY
z!HI#1zaQe@T<D4s25>XBY8^8J6aPX6M!}T~jDm|58JPHYGfe~?8q9x!X`%**f0b#X
z2|EK5|04!Q!E+3Zf+w;WnE2Ph;w;aEfiagGZW$;?WH3$C0G&NF(S(sPjnNR4?ijyA
z+k&9w*`P>e1SkF)MP>%Z@5dP!1>Z9;3O)yME;BF+$ucksiGn!y85o5E7#M}z*clkV
zzh+<*YGGg$ssnMpGcXD*VPF&joj>)1nSoL0Fax8|Zbb&hAN*kFGyafdo_K-@8m9Sk
zK>3n^x!MgJY~T|S5Nne1&oD6lux4PchTi-D3N-k!nhg0bAO%EqJ4`R+2sb7U8(6I5
z{{aokF)&xp2Pr`;a4C?08Vv3Epc-5d0Cm)DkS<V)2k*FrI=LVRs`n>M7QBZR8pQ?R
zQj3u>i@lhkltD?E5u8>T88cWp>`NJBKtay*DghGVWv~WG0w{&nfR2HDmCL{g8etIn
z%gn&^s*-_GSe1cM7<7`!tBDMZ!Y&Mq!Vc^VOt0oJFbc;rFbYR!Gcdhsg?YD}fr05w
zHUo3bG`Q1H=5Nat7??gGF5rO3fs&w)HpE3$utm?{W^HXOGXs;4H3Oq?9Rs5<=#&?q
zU<O9vSqzNA)7Tl9d_WG^%)lrNI%vixn}JdIBm<-Haga<41EcT_21em)*$hlR?l9+7
zRWLC5Ok`lL)dLm8iy5=v5+@)t&b8oFP|C;v9f+#}9k$B^?&yHF6N6l81l_H_6k543
zW`M%3{u46;laUVtqws46M&YL*P9y`P2p<EZ2<RwmqcjFa5n~2M5p6{VCZl4eiB{|k
zOh)w#j3P-4j3NnP3`|BnkN{W;Yn#e2FxTD&shY^ZC{n_}C{hGEX&G+&30O(I6ubq4
zfq_AUk9h|p19KhdMhTEhL|PaaMVeqPna02<GDVhw$tVp(6oZI*4<u{hrhsH7LetXH
zI}FT$D?m#<AUBdSC4fd8K$mPlk8D}C0dy@A-%~#3TdWMsb^AfK9b#Y<S<1jDvKYiU
z&%h|MpMg<iFUa3_m?pv&EH49J{QycNpke`*ZH&O@!Eix~qov@*L44o&n6I!hFxOuK
zU5>Gmfl=f#1EUD&z#gt`42&Wl7#Ky~fMn({Fp3H?Fp7ePH@FTnFpAnSFp8SwGQh9R
zSo#HaxY*J!pmK(Rfq{dcRR&hLE>mCtUz<_y0V=UfU@2pn4QSgA19LrS#S176Kr`X8
z6wpl>49xX?VCA4pW(%tKL76oTRIR2mb209Ko6-O^Wf{oJh(WYvD?p}zOhDYX0X6}o
znUOJ-iNgav8nko)sI&p;pJ)ZL4%9IR9}w!q!1&h(l6scGGV~u%qHH+B%)t0Jj)76M
zkAYFNLy>{;Zw1pt1$G9;zpV_6qT3l5MOT9aCoxUr$Yx;tn+<D7Ec?U2`0p44a|8JN
ztBDG*x@5TvC_O+!V0i?jwb9TBb`!j{0h68rYHctuH*5e&gFFSQwLxtjLr@I>8odGC
zDgvu4mLCBbjg-_96F@~3W5iR4&sM{xQI~*x*4WO>z!>p~fl>4&1Ec6;5a&MwqZkhZ
zqZo%9142^<ESIc?Z8$9uXPM3hQvZp8QA~q@QA`EI0cmz%U=*`~&bh8`U|>vn1@+15
z4Irm6FgJn@K7uW<Pv(HReDxKOG?L4cK~8mIVB87qoUI0rjx#W@fj5(NJd|Z%-01@%
zB0)roI6~zb&{_uuelB6AJT?aAj?0Q5mCO?-fCf8vMlvvp#WFC8g@Z&>m?m<FGcfLw
zhJ?-<6HvF1-%yyToRxvO<&z=<<1S6+i5(z~yUZ9E#i|(?#VSFf&X78AR{-<GX<%89
zk<%C$#X8s-7<XkbFpAw|U=%xT%D}j*l!1ZYkAb=AE=XS$$QjT8Syuw;%rP)GRe_=w
zv~DdE>6pfKGZ>fyIvJRoR)b`r5#InB-GCM%$qyh20G2t{9bjPGoyox51aA33G(Zl*
zDuZ{z*4<!W+}Feaa#jZe1AhVobMq9CvpSKT^#kIpX7E~2u(KG=V3w>`fw-#K8sRF?
z@e>*F2>k$8>H%?2Gk6pX;vR%c)+c~m0xcldgZ+xb#1szD#W|q!KA_>YCID*iA>`Cj
z0m{svn|45@Mmi(B&AFxmsv6YVgS!%ZUU~%+C?A0v@P;r~uUP<5-XZ~a4x>F>8N$>(
z42=8i8JJr@;Q&e@AlpGD7o!E-q#F!O-eC;PE#Px7!Tv|A<zLGHwFZ>y;jY?&Y06q1
zs6x<LcW{LlU<z4^8I4t7Hm(H?K7bqrI{Y4#FhR{Ba1vlNf@QO{9UzA@GG@W$89}}?
zVgMzIorMex{7nqZtq!2fQN%Qn0~+M(LEgR0z}yNx`5f#Q(1BO5=z9QiBPhHk3V;gl
zDh5ym#JFn)Bv-9{1DY=6pCZiE%F4jp&JId&%RpfU$|{=~7{vt`7{&Q=8JM1WLNu&1
zfsIbA1LtH01_mBs#{UBH4Dd1gb?~df*MW)&P(>sm%*4#ez}&_T8jNOTU=){UU=#-(
z7zP@@7dK{L6gLFP$TBdByD~6}JA+23H9-Vyn0j3dWSBaWnacsxfCUXZg)uPhg6`E`
z4=sN{XE(JafIM*!(v948j)74;lz~w^7#3Q8AUUWF>HIejSmD1x0^|#Ll>LD;rP}I|
z(sDdJ53N%H#TEl|8)$w26l9=5F|Gz?P?W*z)(s8}OwY?1nA`S%qJSeBX7+{%s5s~*
zDkhE?xOf3n{0&%rEG%hkSOIbwC}}wOsDNxR1Vtm0mo6k$Him#gnSYru(?m`N<_;TX
z1|}~n21fA|21apEW68^nfl<7cfl<7goq@?Kh=Eaj3In6~Bs&HsuN<fe1+aMC2yOK-
zv`9~8Wnk{m02x-vz$m_ifl+)Bh%=FaQG720qxfzRr<H+G92Cf)!{of?GBAqYV_+1&
zBhA3%3%N0aVdE2U!M#hm9hAaOGcz#x?qgsSf6Krq{u<`(jWv+%cI}|UWSBS>z{SB0
z0tV&|@FB2}v<+Hup8-+>P2n5&fQ}FV1y?Z#C{ux&vfwjyVPUs124py>1!4j}V`uFZ
zNaS_Ifiyx2QcqC0B4X|UB=$Q%yZvC9I|Y88<%Ta%1Hio=u**P$BN>RoZKDL#fbAeF
z5EqbbGy#btC8-n-cpb1tgMo2pBd87T25l5<f=+@n+JG7bU6Yv^nB2ZGFiNm6FpB?T
zW?*vXV_=l9V_=jp0&%1m7$vG07$u6>8JOJF7#JniFfdBY191!(7$sgXFiJcEacmeE
zC6yT%B^3`bGBCL_F*4XOFvIpuZGw+2f>@wr#lXPl&d<Qy*#=tQ$Hu@YY0khXX^Omu
zYEuJfdlLUCK6gC^=FWAX#fvW(7$w~q7$sd{QMoCHfw|)$19RscP;h|SMw#$XZEyiO
z1No5QO-mqkS(hM4H8^-#OBsq8WRNP^lm(28>7Wr>xD{uhnq2W{ngObr5xvyS&`Ptb
z5Tpm}ERZ{pt(gEzNSgyd=7ZFM90adcQ)YmgaZC;tkesvy*3akx#aK6Jh{3^&fl)G=
zfl(54rk+DM1EXXe1EXYxA_J2H=vc&T1}29TP}j!|x}ssr6W9pTmM4%HU<lx2%wc6<
z?w$!s06`3llJglDCFg=TWekjx8yOfSL1zKFxiK(G9%f*a1a(u~;ushu?=vt;-n3?5
zaswTu>DI)+DEXIxQSvvmG~CJniInaNn6D6#vVxH@1GIz}5jW5bw^auc42S?Y02=Br
zfH&i}+AuIVt$~;b3L0iM=yBl(VNKL2prGjq0*wPLW?+;OU|^Ku0`2XCuKYN-g@KKM
zL6A|!mX(3IM*@`Y(is?~3>g@uKodWS#SDy6&J2uFj*vU|7^NZ^7^T8t$>3lQ19N3P
z19OiVs3taW0gW#)TEQam;0BN^sGukY)fQ}L8LdEWWSqPl5`FNK<vxJiIHyOJfpPK{
zaR#R6|KReR3=EQ+L|FcDGBEcXf`;S^&^1_(8JK%OZ2=YsZxwln6)<aGfDYdRANdEm
z!6A?VVP6L*h9ysmuzUkGRwr*^V3aCjV3f)eXJA~!1GTdQRD?=7h_HfAp6>;n<-ACW
zfl+Ec1EbVzMFz%2>WJpRi#d>{O|KPF5t9lU3q!PUUL0XyTx80?+#3!m6+v=LRq)sY
zje9Ht_0>RPpoJC7rbAuv0qlw(5mwOQrG3V-42;W`1~M=%haMjN;sYqwq*6qfDp;8r
z7?*o7FiLG_V3gVn;)KIE@(hg2p;KZnC17>VOW53qg9wwg00VRHe~=zfG+$(3lmZ<q
zzr2BgQ3}if-LtSF1mdJu;HyBS%0!rK1(+EaS0phoN<Cy?l)4Y%<ij|SCeJKrN8%+!
zPlpJr04D?Uw5iMtjI(qZ7^S{5FiO2=XJDLV#lR@7$iOHq4dS>nFiLwcFiP8nF)+@8
z+WHc91S<~%bKe}0sz?S#=~4zp>0(ezZPsoE2B`-O%zfKIQU@3qrTZ8drMtjV=?n}~
zpBR`YiGrkZ7#O9OGcZao25~AG7^P1#FiP*0N9=KZbp;kcudaYn2?GNIiwN^Mbq3~s
zVNj+}VPKU0$-pT69W<9QtA&9<S{!6lD+8kpCj+AlJBTxhfl)?+fl&rDhcatE1EY*O
z1EY*8NM;QKql_5?ql}3-1LH#I`L3@eKqa}flL+%|UIylg&zKn)7y2<U%D6Ky$~c2K
z(F}|-NeqlKaUf0x1EWkW1EUOR$;rY}21c1h42&}KKr&4Xj55a=7-bH#GcYdfXJC|h
z!@wx>0>qiaz$nYXz$nWE;;dv~l+|Qllm)qG;Wh?FSx*K=S$mMoVFpIoCI&{?G7#qi
z1EcH#21eO!AkJL|M%k|njI!^=85lQzhopno5}>t7(&-}10{jfj6MC2#7`JdRFv@8#
zFv@{?zgt8Y80DN880A2xLT^#fL+E_d1M5G7Sl~bw5b@yw8357~#lR>BnyCYumc_s*
z2U^OrMS+1)u9AUKuAG4(jDd0CE2tx2<612Y%o80zPJPY5DA&)xDAx<({9s^|o5#Q?
zHwRi`yxzkAK5=uxT~J90I%YqUsf-0yh`qkU!1QG^1M@^iWLZ!Pp7TFk4fM>;iJ;>@
zncyZsi|IEaAQRAaH!;B5K(8$z4wwjT13|STWD`Kz8JH)6=Dc8rgPPvV+&>VC8lXmi
zZ~nzFVgb~Mqe!j*8Nt*9FKym@0jWWk=lqXQkioz>Cm7W7ooE4?o&vAg$Y82t0F52h
zGcYoyfKD-F0Ox>*3=GnsD^_MbVqlcp%D^ZGx>aS?TLwnCrwoj8_d$vN7XzcbFax7J
zX!#RpQcymUfl)q?oq=(-2m_;h69c0>XoMY9sLIb{V3eN$lF?&elt042D8C0OYreIC
zr5g|noNgFIm_KSUFi!%te-c#~7!}wU7!_DRCFpGEiiWq~lfR|ciZK6?XJDQTT8%dQ
zD+8l~1Ouaj2r~oY93}=v1tSJV1wD2K#yR{9j0#>1j0zs642*MR7#O4vF)&XCO$N-7
zWnff@WMEVX2PxBHU{uIpU{pv0am*PQ6&e{B73x787Y0U!`3#H-bD=5X?E=uyHK<-H
zXM%_CyATGZm!6=S(gu{eKqpn2GBD1zW?+!M#K1f)78C$B42%i~7#I~cfjFKFjEdq6
zjEbxvP8b8DVj2UZVgiVh%)qGF#lWc80^$@fFe=_<U{t&f;?y!QD!yT0RD31Qz&Lv)
zB)h!*0P1?mFo>`)2r)2E0i9Vtdp854;$H?v#h=U!jI&QLFe*tfFe-_FOt{LxsAR~%
zsH6|gJ@0rJm_8&iFi(*N`3KVG=lBn+ZQrSYPMe3wfP2rgyBHW`L>ZW;a)1o$W?)ou
zVqjDP&HT=u!N8~#$H1r*0W*04Bu!5NErEb0{5lR;o_hz)wNt<+|3gxI9S>ag1ynD1
zA1qWBer@lEIZ#>fC=gUu1g7`H4yY`6#UWHy0_LL+S3t6ed{QR^>Hsn>*a->D_u!*p
zWwb<COeGkYr!iYIFfKUF%)q$d8Uv$JEd!%cHHh<=fl;ZSfl;ZOoq=(|2L?u^H4KbO
z%RrpJ42(+085ot0g32@K%FvIn`9>B7=Bc2YXBP4^Fe-rzyaKAr7RoX($T%=CPn`!U
z-IN#@m0mC~Dm{UD=RMT3Q@4Sl0dYaV`y-$X&%iwO8bq9tF@r_$!+&SEzB?d~GB8hl
z2a$&b!23TSeNZvDVhIMu1!@e;(?CZKb4)Z~Gf^pJP=a;m-y1M6&M$%{{tp(=a)b#y
zCdS11AJh?O0^j@$N<OJ96HTTdZd!Sp0?HN)%+o-fe@H4|bYNu6V1&<!zO7+kTv`W-
z5l9PT@)byAynFzvjbs8uSVdSFm}jOiGcZnm#K5S`$iS!sS|~O7Jp-e%3<IOGgg67^
zOz64pFG08SGRTyRu<Yk#V4e<|8=U!>fl=9rfl=82RB|yeFe*DTFe-zp$634#jLHEF
zjLLpc-@SYR@+!zNpys711LNdB3=A^u49qjd6d4$&FfvV)0MUGqQIRRq42;V042;UL
zvJ8w<G}sv!r<gJ@Di<;^D(8YYP7I97y$p=Xo$?IKLH-a=y@H?V@CtNR0I0+h5MepX
z%fLMSJ2L}wP#goJ@^S`7<)!ir%xRE&;TT@QuV;YkVPRsdWMyEU{&GDd19RFlxY^L7
zyAkTREm&aj_^N|}F$10hU)eA)&i&26JVO-hT>(&%m?!~D5wAj^vY;Dqn2N#o;==Dn
zWO$Xqz&PUs1M>`TuwHmQ_R$6ud<@Jpl0o7K(>{hk#lfdwAk6ug0ZDf=z@-3^`Ua>t
zcwiVw{Q^j%d<N*?2Uxc^tpVipN_gl0;}!<y^nK7$=#vHmBk11A8NWd;0`)gDnI^(Z
zgHH}1S%eH|R4<HyaY_IrJU>BK!Z4^XFwgV{#c?1soqS3`)d*V93YB^#0SX(4nc%Wz
zCG^^yPd%V^zsyV#R?xB2vq7!Om2wP>%KI4@m3NvlFs{^QV366(z&vv~I|JiN0|rLr
zdkl=qcR&^2%0!5RK5Kx>`g0<TYd9I0XMtujR^~G>Dt~8SRQ?RoRl~rjBF@05A_(Gi
zGBB!GFfgis8m6DFLQMcyoiZOp80WGwFwb&iW?=mElz~wth=EbX2gLcyz^GEiz^DRR
zaQ^8d1Eb0;21b=>&`HiO;PG;BD1w%PK*RX61*n!_V4elK2$=~~2xKyG*fLZ?ZOmX`
zo>dGD515VyNUbw#B1jyn13nY}MT3F4Mv;Me7I?4^EDIhJV&-CGb^*;HBMOf%0U)JF
zhJZ)MjbN%6JQx^PLT6#Wz~+ltKw;y|z^Jl=fl*}(IEq$4*Ux|20BW|&vWc*QPVSxq
zY9y>U%fP5|oq<v1yeR|Yidzf}va$@!v%T0E7+2h9U{v|dz^L*QbXK~jBE-92Qou&&
ziZE{FWni8SI#1ivkbzNEgn?02fSrNK)0TlzRf~a9Rl}5l$<vd8LDrptdG<Pxj28o=
zswD%XsyQ?zeOUntS5V^Su!FZVzBE7^AE0$-VGN8b-a_q#EmCD+V4nRF<h)M|jH><&
zjH=$SJpJhk1LJ2d2Ie{7wlHFG!lxggKxAN^13D}n9MX)&un>eg<+BV(3B)O&=1mm?
zOaZKLdGUgQ@e6EL@FjE{at?SA4B}Y(m*8<oP;^1l5Xdahv<GNeXgcI_K87!_LFf?B
z$iZ9z(4xllUr=9y`_8hF;*1=eZVZetEng*Itw<0HRHia0h%>VCLX+E970|pJ1M^&v
z$Kl1s44BiuT7b(%kQ<WcL+tqq8*vApIy=|6nt?HSBY0a4V{#c(32gCG0N9yfASE48
zB??d_ut5-rDU~24Mi3?DZV)B^q1#cIR)9>IKarV%(L92IQ8kZ&Q8f+3No8PEozB3h
zI+2}$(Y%O(QS}f5qbjHaXI{&|sK&y;sQOKufiaR7Y#bwl3aE^cJ0{NchL?eP-gkBe
z#z=VvMm0wUMm1YS2F6GorimQ#42;Q;X$VG!6VRS9hy@Ne1`TnRK0XHKdGX8)jLFdq
zjB1e#jB213a&iU(qZ$aOL4uW$;R*v|!afG(d4Zr9t$-E4j0|rW7?aDOsg9As0<`;s
zfq5SI{%iRCAdCzl42;5Q49xSuYqcPA`>-i0Mn(<>#^~7$%=5qvKy*n9NOaD7i8M5m
z2A(f+MjCLem;f5r<YJi!jb}ziA8<UwTrUGLWj;U1_3(u}jEr+YhgL8!&j($H4eAp?
z)iZ8@ira(KbHHZ085vK2#9@m5fH(}y^TDft;8~23NdPJizW;$k0ood4WKsc%gA4?9
z7@Qaw|3PLV7+GOS=M5-bESLjY-)GOjsMg59s0La9{LhDhQEd+cquLhGV!t#<d*ojc
z1EbnA21d1epv8WXjPmd+HW=B~z#^Ir*1Z<tXJ_MOU|ygNxo(3|or8f<oeh%V8QFF~
zuiIeeV!r^Z-x=8iAQSluyg*JyEE|OSo~;5hk-s1xTv8N)+IgTUe9(eRby#{}TLKC9
z1)${+u*{f|0E;BHGYpLB9Smm~85r2I7#P?RHiFJAp3A_XJQpM;wT6K~YSBVQws|Z$
zNr?;#89C>%7wM)ZXB0CmWE7akmyuswqFY>AP>_?En!*6mYvaPeVB-Q}<?Asp<m)YD
zRGz08;OuFokY8G&ke{YtY?PE)qL7%9Qj}U;tWaE#n4HQ5$_h-T46KYC3=9Ij><kQN
z=F2iOFpIe}Ft8n9U|<V_WVamfpd)x^Dx=~zMh;d62F6ZC4t55H)g_E9AgU4~*un@p
z|L#mR2McRvUI_yzeKVwpGBUC;Fr>&qC~-z6RtAQ4RYoRu28O6)W(J0{Ce8c|3=Cl)
zrg4iH0|SF2h#B1u5;bNNU}a!9lf)<ha-9()3kw6onJJ7M%nS@?dKfuCyaq-Aka}xI
z1(0AdCj-M7O%5g|W{~gxaxpMyr!X-wgHGgZVBpTlFK1w4Vg~K2Y+zyF;b3Co0i8@P
z%UaC9#0T1jc!@P9hk=P7q<0$VEW9(>OiUo-8UBJ!Z;=I^96gtjNdR=}17wt%5fM0y
za|B8m7?}h>`y!_?W(k&oIG{bv(-;`lH5eGxRai<(8JL7X=T&O4l$9|s34@tJ<)AZI
zxEUB2Wf>SjTc*@4L1(C+Wr>e3XJ8T$14)1dm>3w&_%SdrbTcrjdonPpJA(v3`vyS*
z(-|1mCxQe(4S;S2Mh#yEMh#bxKrBRy#!LoAjp-l(PpH5$21bnqAc0v>fg=oz8v8&3
zpgo2lGhQ<=YCHuAv_n*AaxyS#GJ}#00|R>(B;g2xPOChdgDv6YLfigq7Z@0o-mpLt
z4htmVus{+HM6iVgl5hke35NxgAX7wHAPEOTiL*cw4htmVup<%<hzU(NASN{7fS6Go
zpyXu50!c$GkTk>sNkc4<G{gc)LoA?3K5NYaNkc+NX$Z7O3^@&npr#>FSQ^scfu*6l
zJV<FsjDZ1`h8Q`-K__@hfU+keEBI7j$nGFUL^v_dVPIg{%A3akI%;+y1EZ!Z1EZ!P
zFKE7p0d$&_<~#;Q%~_HlMUcFiTLG#Hb$>Imig0l<Ft8kFVAMRwz^J(v#5vEvsHMQb
zs3ivCTxVd^3T0r_@?~XUV0i!{K$rirfDTM&Wn^H~>SkcnDg|BK$-}^?^_PKB>oJHU
z&cLX>ih)tP2gFfgVAQc>VAK%?ada6Nb>1^D>bwPUEEpJdSs560zJoZ<42-%y42-%S
zAdVjcqi!k#qi!sS6T!f!+r_}B+rrAgz?#g(z`&XZ^~MrNq5_>6&Xf$2Ee0*5V{Kqy
z&{JVxU^)ZR-O9kIyNrQRcOHl{k%3Y7A_JrDX%J^F1EcO|21ebNAkIn#Mm=Q)Mm=c|
zXDb7vo*x6Fo(qU`kbzOJk%3VUbjmmDSq4VE!wigi+ZjOafLzPQ2s-!}>=FkC1}0GW
zu-*r`gUyYBLC=JNf!T$Xfq~5%M1+Hi?qmi=y*~_$dLKZXd<I5+V+KZjZ4jrLfl)t(
zfl)sM#A#<>)Nf>9)UO0_CNnVVZ(v~5Uk0+5Z2`pp1+Z;sHVh2RApf&11=-8`hJiuP
zkAZ<1?EjApjQV#O81=7${PLH9(SV78QU4dnOil(y18oLI14R%=l!4J8mVwbA7{pOz
zU^JM@z-Z78;^;Ck8eC;yG&l+3STZmgN-!`Q@-gr+FtBZ6U;qaT+hztv!$1Z`Ltl`Z
zeGH6-DGZE;2^<UzY$q8Q^qLqLSRz0&=NK3bD;XFKi$R=Q42*`;7#IyFfjG|?7!5Zv
zFdBjmn`isPz-ai8fzj|LNah~{qY)PaqY)D$0|PsVVamX0qz>YUF)$jHF)$kCf!xBb
z%)p?x3?!_=z-Tm$fzfCRh-1LOXtaQV(Fhd#>^2OHMr#-tjaGnUJQx^__A@XV?Pg_Q
zU=INi2_WGd21cVx42(wSKqBChNQ!~soERfBC}A@!WM*JsZ|BZq5NBXuSje5i06J}F
zA$L&$gC0nNIWLca`6;M;Hf2spVPJj+VHOoJFh2(s)f&tx1`NzEKovzdGwA627oZ~^
zx|#DpqM#a}n>o*rf%yff0P1GWGh$$V0jh(#nF|dVm|sG)6&f-yzl3N@Vqks+5lqTu
zV15NUMzx!{yqtk$GuU1>1_ss!CI*JHUMy0eOVGMOb7!o#Kq8?mYG4r%I{=BDj>Jwv
zu+M2Av6Z20=J@zr1}GbB@*9w8UMxmnlR+YEZXl6R7H`lfUpI&yfW%HmVkaTk=QNPm
z%1}1ME{Hi`lR-7m*-(}Muw4+75$tp%@gxNMoCXqG8Ony34ABcVc@xMqFP37k$qf9=
zxrPiZ6G5$tZsuGA29}AS3cs6;fq`8aq%f3a4wB~(>~tjYBn11M1`=Bt%7!=rqL+am
zRB`&T%!QeHCK!nwfy9nQVtXR7XCbj&kl5`|HUk5LG|2FU3=9nHYaz9<unRu}1NPdu
z1lrqUb6{Z9^np~oo%m{Ffx%H53!>D<LMSadVbt1Kgg|X9id-9m8de(Opk^~8D;uaq
z2d#|};RLRYZ}67FYGb3{42(wadCM5&L1hL5qp<-4qp^-eIRhgr2RBs6k%7_J9#lc!
zfRyYd;A^Dyjx(}yfh*`&42;I142;H}pgQ>z1EX;l1EX;pi1Ukq(Relkqw!2o^~Ve%
z_&|gtsI*sMU^L#%z-SCAR9W>I7)?YO7)@9~GFA+XChZK2Cix(aD+8k`0|TSU9S|pg
zfzfmW1Ec9G5GR^}(ex_=qv>Z5Cyjy8jD>;G^dE>*$iQf(%D`v_y8VE)nt{<Qm4VUB
z7i2T&z$ey;P;Zogt3?KI1ziS`od&L;AUn$#OJG}jK$SJPN?yUhXttAq(QG@&jx7v~
zW``IU%?^Mxf(dYic7uV@><j~=*(s3l6A<wMTq$NUFzCHzU|==@)f#yWjAqvu7|pJL
zI8_XcW=|Lx%^ra`Z48WNUl<t8K7lxs7#Pj|F)*6_0deLrFq#W6Fq(s+m2DLRqqz+O
zqdC~LZ48X&i42V9ks#Nz9fo+W6t->Ifq{WJ7*xBT07<j{g-Dmdwl{*Li$Ky$U}y3(
zFz9nJFfiW+St-K6Xx_}gXkHKEC@?UZ&tYIR2UT2bIt+~F2N@X6cY|as7#Pi;F)*6n
z194m!7%fB?7%jL!oB#$!3ugvK3ri3uhJn!{pMlXLok5C$fekXM$ynh7i329k@F?3g
z21bj`42%|QLFykeFj|~tV6-^N#lXP!hJis}lYxN+TsMDYV6=F|z-R$V5^R4N7%dqY
z7%hH->PJonMoUcwMoW1RN0folGLnJO5_C-xXkDje3j?EN6-Y*xfzk391Eb|05XX{%
z(egI~qvb~iX$A&%HwFg%7?7|#1EZB21EUqFmBk*+z-Se~z-Z+Ml8I+vw2EP1v;s96
z*s~cJt@0Qct#Uv$GN=*8-ps&gRl&e$RR&Vq&%kKa!N6$M29ll)@~aGbg}n+_g}rL<
zRoII`wF*jw{TC!ciwc_!RM(tEsjxF4c0npy5SwZh_F<4|G^wz!f=q^2*nGGvY-no)
zQqh7m1wboc5S#1@n~x3^wk)i|W>AGx*dp&485s2-JA4?IA2`Fpz;I5Nf#F;#0|SFa
z1E^YpDimdAWMI_KhZISx1Uhgl6lY{$G=MD8VXW#n!i3XAZIHry5EIuZ{9wbW(4LWj
z(Fi*DT76-K5~@N*K?VVFK}I2dW<F^?RX$->1_lO3H3rauUQCRPp2Cd63=GVQ44%UJ
z+zbpXDh%A*cHGQ-3=FI$49t91ij3CWmWn){!uFC(5)2G%f{dzs!rT)WxhFERG0RKK
z3xFEvjGhck5_J*`3{1QrJ>1sZmfW7g7TgRB%&ZKC!c5}Zox~X!SilByTeE^B85meS
z7;72p!Pc`uWx(1P7}!k^nn1TJ^I1VnWMJTAg;)SJgUf`0nZpWhBsauJ1_mCeIMhI1
zR){hvmye%;Tag140Q^w*f{g>YSAd%lv{(@uEJ9FyU}**hVPQsQK5lM^Ye2y!!i!`s
zNV_OEBS>5f7M$X;jE2HNj60lIL&YPwBU!__LDCW)3?QE~Fi7e#GJ`zFYRRoG36hb5
z1_anbXs}76n!yb*Lk6VMQ`kgOhL3?k78GC%402FkBkPuj>lS1bVn?_^0jd@pBv6|a
zLB@b$SqWq~#G9VNAOU5lL%CrNRe=hCUG6EY0QQ$ER2#&82?ho=Xlx-{q7D^<D1xL6
z4QMzctJ8!UhAgH9wH53Pn628#3hgCrBpDcVG#HrqWVjg^boChRCBZ=q)&dG*J@f$K
z4(DcI(1&CQ161{p%wY(Rc2-NUKaG%`0r9#qD>y@$Ks|!&Ia6*%L*Y<yklkibjo?s&
zXf%i02o?mXvOpDrIKmRum!L?og8KxVxWN9f2IV&f1{=5$V1GlbvW40X7J`^+2R8zm
zI-se`9<CqkDg{MwvUY$bcd+k3$=wlZB3O~9FvtuCi7IePcG6=sL=kZ2W(3KDJm})d
z(7-4RDlc5cAlVrl$qWo`=+0pU#f>}MF;JI7o#O!tSdf_v44%+@3^s?CJDZz<!3(Yn
z>N-ducq6N{U}a$Nfvba>4l)tu3ty;eh>uwr82pe0AQt&ULj`O%$ix6pRDrT414AI(
zL*OU^dnbsS5t14}*MER=KUgCJLx>53yD%ivfnqllB`HZTFoeOp3kt$;Xvkx6a|E&!
zvS%XUK81z|vSbt&BqmrbL8DaBP&2>^k(I^hF(79s1(4!ckbhx?FeC%U2{XdV$xcQ|
zkb~oS!5Jh0M1hh{BDjcTWnf4GG0Z_nVI(6ofpnyZqnnY6Qglc#Fr<NO28A>zz|x@s
z1`bY;KnC2u;7~&LMkY8*vqC}}WLXxnhaq_*8<dqmg-8w}Vi*{5Wf`C)I><aodCI_$
zhnxl&81g~xf*1~}I2jlUP)b_~28KeY3UI=LRINo&HDDo-`-?#l9xBejP$J5xE(vi|
zDQftG3cE76H!)(X98sHBz%_zZfg`RGR9%96Uj>bPZgAvRgFFs$Kn>VeiuV|-SuGWr
zJ%zayS$Mg5Kv7i-(#gP3$HibM%)n4D2C4=X?I6`Y=)541gFyy2GQzC|#{sC$Z2}#7
z#9^g)f&tXB;Pe!RWTR$AP(lEmC87sOiC_&346TeHO9UAi7}^*?R<|>P@)RsPfh_4@
zgz5nM%u^Wbw@#QK*cgz#U1%Z-+zbrejPQiOYN^NpGOdS^g^`)hPLZ8kk;N05A3@^1
z2(N(cVPNP3E#QY|U{HYdGs05`%z>cuV4=<fy98wGL`KjO`ALkX;4CqjQ5>yVF@;f>
zfte2!w^Jcu1#RGf3YTdh7jr-}7sSQW8Nmru@jp18SU`TAf#z6{Su+{o2?gvD8*sjy
z1q&6Zr)DE`f>MLJBm=`7Mo_x|WW-!#Np4V@1bJs3BNr(CL5>6!2lF9Z#gCx)<z`@5
zz^KOvZlrNrDhh-3C^CZrbRnY|11QiILHr0x53H7o@bs{l5n3ETE8QiGER2}3vXl{;
zk-)j$Ub2Ic8)W7(P$=<nb9XQ*a#%qVFgSLXgDm5N2?=`&gH(XRbp=#{57s<g$p~s3
zgQP)@T?Mg6Q4*5II~WxeK=!PL3$t1(%7IM-i?3k>Wsqi2Jg<c+5d&o+4o_hjP$FK(
z2&x1a7}g^a474}_*Ww#MK?q4%ij1J7zY!epHj;UKpqBY2xbKkKqMI3^<t3{nH?+*%
z0!bLq#xuyhTVW!smfQ>s+ZdtMFSy8IVAu|Isu{?sLY~4hTnr35AYxE6K*ixsgc*u5
zAVYV7VoI@r#Y)i}oTEYEwHu-hEW!=)bUg#Z9!60HQ2aA6?1dS@Z3)U`3=I2_)21RT
zNEIY`?ng<Uprm~O92DR-9jLAXDP>?d2oqG41jQdn5EP!EYMg=L5F@BSlVN3GI1Da3
zKr)bm8|2a>5E~T5L7wJSmjss{M`7-P2urI=wlhkC^npwS={g3p5R&Ra7J{<Eaj0RS
z$Oh*Rm>vd(6VMQmgQOrC#fAnO28NS}1OP5Ez|nsSoZ&!WeH!dwsEi^f$mTPU?4$^?
z7;J?CBs-l2y9km*tQ2Q5T7%NrIY#vUTBx`nBdE`Io{^t{8{E&kzzD4+I2af%f<+k^
zE<qd%jdgIg0_Fe9piBbqZ*?$ogKF|CkkrW9!3au?(A;_zMI{5nHJE|mqy`#+z0L@_
zn&SqfwB_dJ2A8!^-8W%rnH$pJz6Ih#YinrQz74UJ4N}X30_G0P3UE;XO1pQ#$qbYr
zAibD-U_L~Lr!c7FbRWrJkQonP@eU1LNFsa)4q9-M1DBkh!l1x-geKa~2=044MhJt8
zR747Rf*hIL3=B^Zd~n0?8N_l>_=2rLOLEU4(x74iY%r|7T>~!1Ux0iM(h3e>P}+G3
z&Tb40uRz%o6nN0UeGO6xHN{gHbp78Ogvl_AA&up?Af+HfAwkN`!0-;C6zqt0MoEa$
z_mE@>4L3+*<pbD*pa6hmH_*TXG_CP5Fff5jZbe3G#VIV7iejFyVFG4wp`^$J$tRFu
z0}jwQ1lVT`46Kk=2@@n<85r0gMJYRaN(b2sO6j0O%|JsM91IMc;MyK3nQ|dF=Rt{?
z8*Dh(7mxuA9z>}MN+7&o$3f*882BLFMt*qB3Jw%l%v4D-FbF_frC`T{N=rc$0Z9K>
z2&L%<5n})s0??j0JgmURfX3cIHLfBfEDTVGZ9r`@HpoZ>JJ`L5z~q3mDM4Q01eJ<V
z^SMC6pa26&aD!b4ikQdjkf9nLaHuH4gB&uR0#Y%F3#0;S3LnT6P=l2pG>RgCD?$XJ
zX#jLP2zrDFqelpAhz0C%Pz;HpMu-^LgYXCuheU`3t_T77PZHFCL>ZJ}V30y>|3lKW
zG^mIK)j2eb3s|6I#0I2~NJ?C^p~VFQ13#`P5I{tMAbJ!Cp+^BIPC$hKJPJfmqd*ij
z3dA5$AdW8zB(NlStkD8WQJ^4VV2}neL5WKSTU5y+q6*t^CzZuOlOG_g16tj~0Gf<~
zA7}~^24Ml%%3Kf!hGoF&H9>>SFd<}`F$XNa2_g?3_+<dyR0}FMqdUNSM%Wnw43O=_
zj9Z}lR~aGuSs6D$XTz9MAnG@Oj=%yLPypd?gINgGzYWwC0g0`F%EQiv=792HJK!~-
zeAvQhh&+=m)O-dOh<q=|ECvP!-Y*dTEZ7;5kRzWMXG5pC8KCZ+4L!P_5pq)t;~dyj
zCB%HjIZ*Stp#EPD(+`zj4%;39wSPHifgQ*V1`zv~!&XPa&R+$|!7wQPm=~T$3U8zZ
zgD^!%G+6x-4rKL+#bHS5U`(+3)zgsGBc`umijZiq`pxdh>X$?P&jg)aL{iPb08w9n
ztbP?V{+J+wD9WMgXF{YP;Zp?-A4brkLR8f-^A91bUjtg5$pAXF6J0R_Og-o-6Igy=
ztcG6iCkVTA46d!XC|SQCu_&`RSwAB+F-0$!K|douH&s8mtXRJ=HMbN(6y@g@>lddc
zCS~Rq>t+-bBr>@Bg(^4(D;VjSm@qhndiuC{`nmZtgt-O<d;0r<Wu1+T6%0-FjPwi@
zj0}uS4J-^S6f}ZTQxrTBOB9@o@{5b1(z=G43c9%|nZ=1oIjOp71x2ap#R|IV3cCKq
z3c6|extS%pX+?>-sk#OEnRz9tMGCrUdHK2p$;rCKB}JvlCAvkaC8b4q3c6`&MX9O9
zC5d?{nR)3DRVk@CsU@kpd8IiyFzvd@8L7$HAfr<fOA>X9Q<F<F^YcLbynNl{{M_7p
zkWqR0y1A)E>8ZNO`FS8COP~spN;7jxGV^o`iZb&`(jb;(79{Ex7bQYC1(~T3MsZ1E
za<*<kQGQ8ka!EeO)esS|^|pEW3}wj$r5>O)z&ZJO=?Y*1#7j;|DoQPm&&^LsjW15k
zD^871PtDI|0C|C-IJr18zPKc@q_mhJqdYz{g(1EuH77qAM8>D)r7)Bv7Nw__fF$zs
zij#{{Q}g007~srGhT@Wxvh+l#;S8Vv$joEN$;``UC{8U(&d-Z4NiE8aPtHkAEQ*Kd
zXUI*g$SKV$W+*Pnj8DtYD`7}V%*&21NK8*HW++N6PAw`+O)*JCFq0T^ONxr(i&INV
z3m9?}vr|E~W#*;j$EOwL=f)Q#XM%2PD@l$oNK7$cC`(F>2T3v{<rc)Jq$Y!$#1IVf
zwo_?ZT56F;W_pHWN=gw!ZfbgBabj_NPHA3zF#{+K#;2r~WhSS_moVfMmt+*B7H2SI
zCdVfw7N;^mQgnP~eoAt@t6xY^WW1-JX9z=aZb5ueZW2RUPJVfOa!FARLtbfaKv8~D
zF(?c`eohAmSwVg=LrPI*S!!{7PHJ9yNd`k$dSZ~jFGyoSL1lbyeo1~&d~$v%C^<3|
zB<3106elO<#h2vAXQx&s=clAHcshGn2InS~7CX7PF+e;U&XAO!oKXx4|Kik=_>|1z
zf}F(4;*!Lo5{8ff-}v(UqU_APbOx}iLE#XeQIHs)mX=~*WME*xP*#+gmmZ&zT9TNY
z!H}7o8=sq45ucly%aEH?6kp5$2`+|$#1u0F1BUp-lKj#fhJs8`(g58wSCEn%pOcse
zPCS|Ud7u<hmYxWT5J*IU^;s}vB<7{$q{f>YFa#H5=9Lz>=A|%z9GsMr7+=hgoCIQn
z9G{b!mkJFUm=-foN{LUZEJ-bnFDXjQD^5!-0{J{KGX<1(iWrIuQj;^&Dh(Nua<ai;
z$B>d-Qp`}08()%J1PW+SY&d0>6f-2JfE-p(lv<FKpI^d|o0=OBW+axDWI(KgC1g-y
z2f3v<vnrJ#J*@(obdxg@i;5YFQ<L-aQWA?Q<3YCy=H{n>d|y<;P*RX<XcS+RnwSz_
zkXn?Rn3tMY5}%fnm|hId5d{p{sg<c^sd*&~Wtl0d`SAsbISi>4B_*Kp3FJ;tf&k?N
zsBsm=DJ2Z4d4;8^rKzC!XDCQcE=etBC@xKMPAp(ZPc3oI&jqL9@}kU=)c6umnN(Sj
z%1}~VoL`Vyl$e*2Us}RYTu_o+nZr<!oEe{*2ev9DH7&6;rzE~CJ&_?dzbqB($>P+a
z%*34dywcpH)S~#}k|J251j{BSm*m8Q3Q&e(qvF(bhNS!yc%}!1RboyK$UCVeC8;1~
z3`Hfy`Dtkk&d%|^p25McF7d&xL1CWGuJNuxLH<Du$r*`xd8s)JNuHpTo|c%L8c>v9
zlAoNP!vHRllfZd29<*bEAtf_CwYUTnJ`AM=DTyVi@ySKW4Ds>M5)+hElM5<g<%}UH
zNkhvVLjwathP2GQl=#Htg3NeuI5U6}Y;s~jF+*}uQhai53N+S=GxE#hOA2!1b5rw5
zL8V`@0g{mx40)*)C6Hn&6Xe|Z5>P-V=H%ojgIttaQBsr$ine4>fd?v<A-ULyp(s7c
z9hCPOic$+w6H6fJ6BHN8`FUxX>G8RV#o6TyAQdI?Ib}HvC7HRP;Lk}-Ent9DL#0Kj
z5T}EKBel4gA+IbqHNK!IKRLCyI6l9CAvp<@l0g+peoiVwa(+=NC{@R&q$ZW7#}|~A
zBr|~0D5x}q=KM5JD1rP}5}%n@mY9>75?`E|14@{=i4_nhq82HM$!YmTxrrqVNu@=_
zB@Cs-N%1ME#mPnmnFXl~kN_!2EXjZrF$It^E<P;>mhBBq3=9}5GgEU?;!E-~iwYSM
z%M&v}wMi;N3Mg(XAXFu&NPyH&3?;b*Iq@k)WuTl6suMub1j<{5@fn$^MTtep8I_<!
zl%5L8yKs9zkq-$CaMH;x%LNr|smUb_0j@#5@oqkj?(v>35%Dgb!H!Not{_7}6-s<s
zVrEWhQ7S`nPGWI!d`eOdSf(hoFg~@S1XTY)GGSs_VrEW!MkYg9Vvd;!sQgIG$xP3S
zFUc*)$V|^*NGbqHR^{iVrWL2AgVIA$2}4#vDyVpc)Ii{fNlZzJPflT|Oie6eC@oGc
ziU$|UU>E0SBxlBZlqUHXFy!VJr7~pZWtPO}7L>$;YG{z742{4EKP4WTEmAUzK;A3J
zFDi*o&d+7=b@uShO-@S(RS(4_Mc~YvmYI_SE<n-JL28O|GAP8LSs$8Sic&$Af(ki!
zWyDaFUs{q{1TOBti7&Y@mBF{5B-lCF)6+jFwXig`7*x=tCWoaK6=&w>`6g!N7crz4
zB^G34CKrP%1#pR%oSy@#@DqzlKvf~6*asCK@S-*m<bO~N8ehzinVX-&P?lL#l9><o
zJ}9P23mB3MOpMJzRbpvgCb&w>NG#3(g&;#_a)xDmPC;^fVnJ?ld~t3rOh*nV^BNi$
z8Zm%tMJG_<UzAc(oSc)xPynjxKy8rJisaOS_>7dCB8CuW_xRw9(vp<?^1OheRFHaj
zLB&v#Sqv`YD;eUG(@OJ_jg8WB5=-JMKrS!H&&i3;%quBkNG>fZ&M$%#6Gau^&@X1l
z0|!NZQD!=%SOS#;;KqwbfFnb3dMc#QKs6UsCV`u$MWqEL@sL`o$k+&4ZI>3OrZ9j)
zp|~g+o(s$(A{g>ZOM**^QWJ9-@^eyh6DtZ5le1GHRbFX9L2400a!OKsQ8_5w;tdTL
zKuIJCR7HXs3>k^V@dX)`#hJ;8Iq?Ocwpd<rDg!7ya}p~-RZ2!;PDw#gW<CSBF$3`=
zsP;}REX^#)MbvsF`N{D)`N`R!MqFu52}5x%sG%R9npaX(84qrCGbAU+gCZYPQ@Dn?
z`h~>%_y>nTYY9-?gCZK_76uRzpIn)fnU|7URLqc_loFqln!*s|@9XC2;~MYd@95$h
z6z}Zs>+9&}67T5Z67THc>g*jH3Tj=I7H5E}w9J%LP!=c#m!#0#l#&W+nr7yu#)FF9
z{L&Io{SI!jf_#)%Qc}ba>X}z!Xa-VmWB_RhfSV*GMTyDT;Bd@I%>z}(@dbGW@%d?K
zpmq_c#03?J&=NPrz#Np*Ag!2!)FOzdL5h%y<rD)8kfP$$!ctHrTFj7^ky69}t;|48
z4+c=qj8D!@EQl|uU`Q%W1J{ZbASrN0hblERFfao7GaktSX%>*I4v7I!Z3d3>_|%jX
zEUnrQ*WeI_iqyRLjLL%4qGU+zo(?Ll3*$knzClSGlyqQ@Gc+);1U1IuLG3GW6UNY>
z!pMLjxwxbl+!P0u>I}uH>G^4C@x=@Upq4tkh5<ELVQrHXaMLogs1Q^yf-6Uc^2|KP
zcu<=I+Q&#QN=c3fw|Kz$G$66KI3%Mezcf7~BtIm;mjRNxK#^G#pOK%R4JyKm62W~W
zuoIJVvUAJg^Giz#N<c+aN^-oRF+*xnN+JU&NymfIHbZJzNqli?L1Iy2Nj|tClvo04
zK_}*vfEr>2i75<-(gKp0@>0t|<$Xyis1D00j|Y`%AdkUY;>r1-27Upg5mKC*2P(mf
zv%%FjxY8*uNi9mvX9&niECJQEL8W<lnR)5{c?_kXf(6o;2Djid^Ffy9lon@}rN(C#
z6&5qVngY4$MPMI-A_1Hp@*(Xg2ISf+Cm))SK`sPsV=aj<NG<~Py^0x93QH3~9kKj;
zaQ2Rew4F*4p*<o{st2bvNOhf-nUe}KD?YOr-p2rS?c-Aui*hRCQ!R`P7~<p8@{5vF
zLCHNkKDDSQzbHOFKQE^;J~J=g&@3sl1f02yjTn-X(u(5?5-W4^6H`F34Jt*z?F?u;
z3Dn#u$}9jy2e>f@%ABB*sRWc$7z#>?;=wg=W*R8XGk{G2HQPaH5mHowO5Dui3{ZKN
znp;r9kemc^T6tno3WG;}afxqQBD_lou1wR@7{HY=qDU_)P62f#i<4pQ0M-4eDWGhK
z)YLIBOoT*PVFp8de0gF~9;iY{Ey_#G0sEgJ9@In2jxR1LO=1A05J)$*B)1^Gq$rgE
z-ayDm0m){AThyS0m<wqHG8BVC2i%%3$&XJ;Nn>zM%_}J_s$|H_D=98YE(Z5j3UU(j
z5{p2Es*7WYW4u$So11G8v{cQ=$t*4bC0a;jSXuxs_+V}=&CAR!$VmkSe=4|boKX&H
zY9^&J6qIBXl|o7&Q04;F1K<Dx4UWWv8iK`OSAk1-a5+_!pAU{5&?pF~mCgW4m!K*S
zTyhj7XQo0sN08*1mtT^ZR>=?);#^t`D&awGT2Ny>BNNmd2MtCfCKZG7SWyY6J}Jlt
z4Pk()K8DQ1{KEJoP+^=>T#{IjnGEXifqYoRkdhDS;ep(eQJNH=$N*y{L3^FxG!7}A
zGV)R?7;+PnGeEV0v$45>0Yhe9T25wqMhUoy2J!$X(Z_?5S87o_hz)AafQLTv%TkMq
zGE+dklageVUJRt~4=&Kaxf0fKfi~DdMG>MY2~Nd1Nr~~fnJEk@pf+7z8mwZ^C@;uN
zHe^TzcP~L@L1|GDsL>7{`GM5J;20@N1$RuqkplH4D7&P<Tk)V!1Gik!YKhboV*_vv
zl#!WMl2n?8I<QclnU|7Z&H!o+<rk%Znh@ZE3lv)n={fmH40%PMXa*G)#qePjSlN_c
zz)+S78Z^jDsbVNAhzF;TVsKgmrCdW}P!p{fRuzFdEg6YL@SMYtQUPjNgG>GR#G;Z+
zP;)c21XS<lrsgKcCxgb1K#e$%JK~em(m{njBpZVJlb|He04|%Lja*Qts36xcF&<RX
zC*@>=+>lz7m|OxXR6%(V+zkYcEWlc{nR)p|3^}RBMxYi+azQCWd_1ULEXvPiNJ)+d
zM=YeTkeU(?&I6!S9-mm03L4-5TMcp+cyIt*Loq-{nZQoVOD#{yU`S3$%`FAxHdx0F
z)bNL7Yfw9>7!)huZYwy=LLCe0f#zhERD#PqP~7-~<0h{d+=T@7)GE?aiy(QtD7Cl%
zQYC;w4%{&T*8-qH4v@;!ycBS&4BWYcmU7_grz8d3z5$h{kemQ*X+TmQWK08O5~v!D
z2iL0wsfO`MIoaR_3Mee&bMo^G7!p%*GxOq;3&BNOyrHp)seutFJtvjsWP^r@LHPjG
zVuGc3Lz9RIP-+1s-?Y@klG38oVwhY(esKvyW*Mjpn^^)X-BaR06*xm?N^W8S10)AP
z5_wKyaS1p8isHcz29=AReqoM2o-XmhAwjN=zVV(e(9*FeKNpm(VObp1RRae}Y7wLw
z0S663RUTxV7F^w?<R(G}{XlKff})b*<RVyF0}atKfU29y_|nqM6o@O6lVC-8MnQ6X
za$*5!1S>TqJ})sh72KQzg=A)4VQFSjC4)~@ZlX&nD8qspLh+yu2RMK;a#B+><3WSF
z;8GVlvXfL=oSO)0Nr3ASQ1=-eW#C>9q(ICqElI5ab*?}i%N)?CZ*p-a@~Br?N-8XN
zz->Bk;g*sJYjPD7<)@S;mw?9JAOpLG1_r4NscGO*t^j9G7x36As103`oC_`AgCJoV
z1nPEyx-+0a%}q@#E-eDrGoTEWlb_B|ke!}fP+APBVnCI5egQ*4ad|v+xT+Y`r>TUE
zN@XM#rKDsQXG3aF=-75qD!A$f4=X3-=cGW!BfuFEJmd*4-*PkK4Nc9{3{7B($<V+s
z5tP)@6En&|y+%+SjTl7*Ra($?2)GE!VE{Md;?rU6-<-s%%6Mp(uedTVnE@0Yd8N4w
zWvN9;`NgTAbPZ06prHa#0~(Z3LBq7g8IIsG2Q<E#QUs1laNz+i9t)stLAWDLEsP@~
z7}9c!QgahCLCr&OX#g5a0p)B^*;2^>ZXH3K2g*^Ypb_p|&?q0QD-Ft(NTo735JBZ<
zQ9g8#0J)tFG7~g(WdI@!L4*;AFa}jk#Rbs*YH>*lr~-{oXYh6NjCb~RiT81d2aOHH
zd-^jtW#$*Vr{?FTmK0SwgGRO)oSl4Ab3;HQk>IEX4f^GQqpT=B$tkB4+(kp}x`2kO
zz*(&*KbIjb6Ep+`_F-{+UJ<AT3K<wGNG^&8XZysGR0eRX1QY-aDW#y%`PB4chTOEw
z_?(n@P>CB~j5>k{>avv-Wh5uU(tbn)Ls5Q_nF&gr51K{+r3G;L3n{<B6-N#z$&?l_
z<b$$$5d&!aBBi)EH67H7VgR*+<3UZ;qOwHLj1YrIfFr2MoLF2^lpmj)o0$*Jte~<B
z(%=T!0P<)-YEfo>N@g-R_cBD~=cR&LsNkVw3x=f1f&zx(#F9i%gSG%XAW;q)1!hPF
z4|aeGOlW<bo1Yh-m{XL?kX4#n04n-|1AII~;zNQQ{em5xLp=TcphX{QZ!{6q5->1e
zC`c~y%u7kF0H@8O)O64wKd1u=s>CuuqtTF=pX8zvQ0<<W!jP0)26hvu76mmiK||Kb
zi3OlRAW$<MTvI|?e8s6bps}mm;?(3~NVg3#_Ly8+R1}|^pU03=P?E}!oLN*<S`6+`
z<)-F>wL{v&U}kc0YGJ&Yi9v;lg+YY{c)A2Mo>0sXlv<Ee=?0qL3kFqhAi>0<_@tcD
zR7hnFtxmvA2XN8{jedX|3y>NTqBIRWXjzb7oC%IP(1=84K4`8fKC`$8oP0qo(xjZ!
z_~MfMqQvx6@BnUpX-Rw{Lp-QA46aN->7}43H7&CO+~7j#@|%GhT$xp%`6g()IzELV
zGp{(cs07l70y`?TqJY6Q58Rn@2G28=<}xIK##SJ{f#z9|MWAW1R0e4M0P2m#gKNs-
z)SR^V63}QXc%U&kB?&b6U65RmS`6-I<>r?bg9e~-a})D03eL1N3veFHEP>SH@t_0`
z8#`u5h4dE~-~*qa5mRsl2^md?PQihuufU~^p|PO}EEmAX2%*_2wG1>*14>|^RvD;j
zP0PtID5zveEY1N9a290dq!xkGQf6j_Nqj*rC;~wP>5v|BN=bZi0c@xTGFTRGXdV#(
z&NcCwc?>C;DP@@{3;~&$6#==RK~hlBSDac58npz61H>FqUMK(+8HstNX^F|8hDQ;o
z*I@*X^I}kn$^(svg9nO@3{b{o8S+xg9ZO3xAY;2FnYo~$1JGP6s3Kx0$j<?_)sjmp
zA&mrRe*@M|Pb>pXpnwt+q8d&?8@+b)@$nCj_jUC23vu;x^mBG)0Od8*0t6bIB?Y-g
z2JzsgB50lh-qQy)D2$E3wG5<qfzE7#42lO&lQCo#<bdK4GCc?yXN(8MGpu|xFkmRn
z1B)7%FnA=Er3RJe1%O&)&=@u_VkpQg0VR{t0=OO%P!JY@M-n0KLzA}v$%7|;;|<_*
zWa*IkDM$&Lni6lsP*e`8ZWw}dGeOm;3uL|%Tn`w43<Njzzyo=yptJy*+6H?xr!<ct
zvjj9i2d%e~!G)HgfssjtxtT?Up&3eHpIQWJF+p04#ih9nsi1Kf$k05ffd-nn1hsUb
zEn!0ggEUxc05oVA4{CIRN?Z7dq?3P8h^q_KnV`A~Qv7A+=P_g!6@s#U5vWIz3=SU9
zTzo16cxD#D1XT(pxdosAiZ`=>wStOLlM{0?lZwC<3#cRlP2gwdfoAa-N{R|Iz=Hvx
zx}dlm(mFve#q;x0A;Ynt;e1bjXV1LM64-b?s9h0X0v_}MW!;j*^dNVqz)(jQ25>QL
zY{URM3N0A2Y9Ki|J~1aVv6une8OTflCrL;ECZ!ca+s>dVjd)O^VMs1YE&`7vLTUog
zpl$^Nc!;bZvj{Q<m;@WXhfJ1&qa4&K1XpwMpm8V$(1<m}JW%j}3%}&Vg2bduaEAyS
z>EPBBs27Ib7EDVqFa;I8xrr5^u!oM3L6c=hCPPX=CaCiQnv>1U1uaSd<#|xM2{a?0
zomvT*g)2%;XDCk30jY$x1Po10(@a5gYvAcraCegd)Sm~38K{H-6}yOO4zO=>7&7y~
zwG<*T8AC=ROA?E-LCFamZ(zTGeFbqQSP)tzgXbd)l8b^Nb!tw2I;8IjN`}xF289u%
zbc>JAEzL>EG={g=z^fR*xd9Rr2zQu48kC^i2Oi8}$S+8OPS8Vhx}hmUKp3dC7nGTo
z?wniTl3JY1kd&G3nwOH9n8yIFt=zz6cyMMq1E@)sS_F12xKj-4Zxu77C4$p`4rF2g
zG{>I_8tckS0T-KSdDX~-p#YpBz^$vqloW;{P?NhDJURjCgZMam1T%pB3t2Xh1I{F%
zEEyc)9}wW`!T_2$0(ZKgJ~1!^#UUtB!AmS-23RW$)M^B;0f8wt1w|%kB~1#fhXSgK
zN{aGxKzS+H-4!&;5ey#T01X;|GJZTLTEH0u)SV8?ObklQ4K7GcO<_pQEzL<RNll3d
z&!~V3gm}<+7P#{b9xMh8urcK2mj~p-N1Q<U8Zo8=?)iX{BPhwlgVPLT4NOUD5qQQr
zKP?S9`JJ4R8lRj7X>rAangywepv(uJj|R7^847X@lj4)}N<dwBSm!V|vp5+tA`fay
zfhrJ&VDL&H$GjAm)TGjMc%UVNirL}<$dZ|)(&BjV3^Anh3+jhKQ?IjgylX(bpMOZa
zs~>1K7S;uaHu#FmGfR>)z^xfjsSaLzkmBqV?vhxN7y?}f;saSl14`M@d;socfkM~O
z*99KB&?qxBfH~375H{YKmk;hTFhII@pt*L?5E`g^1DdKpj&MUW25`0o<$s2h%(OI!
zhl)~*OLJ4>%fO4Vz@3yNaBnNOxF{aIjR{VTuv!8%N(Wkk0h`lfC`l;>jk$qaw1!3&
z1{L6%$<PeaPJm?;P+AAIy(=LxmsG(3Sx*I-=m)nIp$*ug)RcI%_A7kO1(bHc`6nd_
zlrA7ES3uPosDBQraWeBt42@GjQ_tW`6%3l?1<eCOniTLwG@#%s2d!+0Pb^N(L>Wqe
zcR*5*yK~TTw<I|}xfr}=CcY%O0Mw1iPf7*XDBx*kSli76G(c1U8vVy8z@bxGpg1aJ
zC@4<LEM`c~E6D*h4xx+wz+=CVZZ<<|PEmd(Xlx1804Po^0d)YutH{8mDySF+^+>@Z
zjyVh^`6Y=t@fA?Ik|8-iw;-_yyyC1hCl%})hDy*_6liD*R23CNd)MIX8(++jmJZH=
zpwtd6Q6b$V$iTcwJcv#O7a-sfsdz}CkXxLdna2PbqAAS-weG>CMp1D=Jfz%YNXbhs
z$zjMX%_+$QH`PG77rN3Assu8&6ko!S<QyCht(-wlC{6}j2P!5&<71$56P%1dHh}ui
z;2suI?FpT$1<h-LO6zz7a1$E5+z2!(pPZPSkqWKWvon*k8It@;bK#TZ#gGATQ2k#7
zo}P}+Ed`e>pq?S91_R}{63~#ZnF&K$61Y8GQjl8=nu>}?w2MF^<R$Q46e#5vBxgb=
zSfN!EXz~^|@{*okk`EdsE6Oh~hW3NOZ31vYhc<8_^MIg|A5^V?hCv~#xr!Nzi<09j
zz+@$8Y&I<qR8<6d`nku4`nk9U1%>*78eh=XsWAi6s6J>d18gWQ9#lNULzYW|f)-;X
z7&zKM-Frwr0%b&as~j{23rP>41_pR68`^Dz^y)!%5V$}r1~)0da|KX;fu;kXOA<qT
zoWKh@b4v4!O3h3dN)wCYOEW>8Cvev;r5M}>290>Y#^J$(5a3onILCne8E<I;YLq~h
z5I{PU#SBRW7CEpY)WnRTATu`}G{p}JNswQS3?ThIQ0OA6I#8AZ1!b_Sv%jB<V^Czg
zlcS$YxTi~q2Xx>eIjKAzY<MYnaRsQ|i5SlUMGGjJKoex(bQ0hh6dwYrFBsxMD`Sda
zJxL$OV9$71cM_aqi$V2(3uwKiCuqX9q$sfrvOI;M0Mr)<@DB=!4|Menjdyl)k9Q97
z0WHP@53YjjOiL_cC{N1FD@$Pjtv@M*R+o@w95nG68knRpfR^cjM}>>P)06Q<sbxms
z@(`4~i*pi-GeBWuXas7W7lGEULi_5)pspThU=>o_A{N7dCI#Ws#wnmNPD5i8&=4YI
zp=xq&N<6rjM+_>0MifDvEqKotJn9STounlu7c-RPB!QcNpy8Ub0`N!*v}P)10F{2m
zM&Rif2GGP*N<4T>3AC82JTuP;JlP0Jsqvu2P~i2u4Ds>B`QWA}X!a58cyPRcr)|Lv
z8F&&ghRx@sr<Q<9NpK<I3Y}yqhAT4#wRb?xH-=2mh*m)+T*jOs2)Yv3kRd5KB{bLx
zQW=7#Qa}qglEEulKzXRR1T^^u%DB)$=d{F>5{3%U=sK(_F)%a)4FnXFq{bJ6`skUd
zMGPsa$zZ>Oa&0lFLQl+zFH0-}t>cCCi$QH2*tiiWpCg(Y47s30l$lqOn~ZQ2s90r4
zEh+*xkK*Igav&iLD#IWHH948NpxFv=dpI+NAvrgt7}oVqEs2NLm`T2g6#@C>sYRdw
zNh&SQ1W&&tCWG2Rr3H|(6<Wy`B<6sph{1z8pn@4(s6#3N&|nj2tcd~Kq<{^Q8JdB_
z!F3q8I!sGV0T1;tz<bM}UJi6=VKKNn5f3e7z-1S>iUSq1PT*E%W>P6=gb$WZ4H>di
zQwu-^e|&msUTRThGH5<9GdZ;w5lEm>9r#LKP)9un6dlF6xsYLXP;~=O0VWLKH5{NW
zS`lcq1Gt3+ityxIaGI`UC^9nv)hcPwTn0(RkkxUZ(XX_mcu;!`++l?FP9amJnZ@DY
z0aKXEEg9f5<KU{4AqPB_43&mXT@@EHBxj_8W`r3^ARUt=NN*#!G|3q>9ST}E2U-;j
zTBwv-j8s#XX6BVx#Fv0lD7ep2SdtPCUWSvCpAITOL1kQSDtM$GHhu+KlmSUKut{rB
z?G4ItrN!t&6`*lO)Oa>B0Zk^Arh(RB=9T8ggXdPjA(w`h0MbB9gA5EnWhQ9U72FR5
zH@6|3b5MsJH2azhYK`YY8p_a=SOi*uUQ)!6mztUqUjkZ2mX{KroD^SNngp)yLH(&B
z$lMe|5^P+dD77pvADY)d^9$hhAduWv44qd4r&?&pn;0>G*5MU{tD<;N2%tG1v}g*{
zlLxH_%}im)$xjEjrohQ4Gp{&_Au}J;Ml^)dMj)$GAS((%xj7lM1O&9^y#myrgN!zU
z><6t&2Q~YWL96bHGawZjcr_@bwFa)&ic9hf;=w%z=vo`_NI-6WN-=bd3FZk4NZ%_T
zl(!f_#j^pJGz9wvY#per2wIeH0`f~{K6D;04Rcu$s7Qi#!BHDX#h|JloIT@<8L|q}
zlL~S`6|b|uUx;f&NPKXJV+d>kc1C$fVrEVNsHTUuXh4%YkWCly21X2!g|NkmxeTDi
zx6mdRXb_;NEHx$Gz?7k+I2kl=S6o?Kl9~$|PGCsNb#@AO1J45@6e5r4S%UluUY-ML
zk5<Izr^P!5gvNu`KIWHXfQH))L3!B7ARg3!NX$tGSpcpUd{c{y6Vp>6hJ#ZIB+Q{T
zDY$0}YQe)6@Rp?(Co&Y2mK4V)BWjt{hzM}&4(getl;T`S<^oUSgXV|8Ymi|5tYYv8
z7GhAfv^WX8k_}Yn8<@fa4m2?a2{uFkf~LqIV#aWF;Gs`wP^ZEs^a^rwL16-(!-SN@
zY0$FR**P9Ia0qUK!iFpm9XL?y0aO&EG8ANHR>Wr(C&nigWu~NqHur#98OixMrMY<w
z(2z~W=siL6Jap|Zq-P3he`Y78z%qA!ehFyJ49J$!Vusw5)SSdhXp<i_5dtn97(f*d
zxUxut4S#?Ko}d;d8Gxe{+<GW3$t(hIO2~zXfnpi5ngCos8JZawR2Ui=fTnT4$*(B2
z3>1l=f)lhC22@DKmx9tYD7%1+Ff;<UWso{8plqB3niwmAY-dUZEv^BzgFws7K}iX;
zFeNv+pfVoRyaRXV!EI`2<pk;gL)N>NfQw6L9tKtB&{e*m5phs0o0-p00IHyi%fSss
z&<fvDa18|7Jyi^<kBUJnb3h9?Kr6Sw8x6pP4P@0nsMt$_r2<0(17p}A3%F5OlnNRD
z2RR2c7Y15T3+}^!W+gzLho+S@3(#^M$N-&@0ldD2#t2fg0;NTX==6eI0WN$&>x)5)
z^@}qcbJ9V}S-^`mGNH>_pt%gxp@puy1g+#L$S(&kn`bD7PNswV9H5AX4RAmv#f#8W
z9;~=d%K@*-1r4hfrKXf7r>1~=n4lPANCFKaLI-!ig*jwf3PWCTY7RqjW^suD187PS
zRA+*Ch76#MYS8U!;PL?;wq}V&48{3rps`C(-3LkophN|p!h?=Of$BAk?1MCu9UkNv
z;>wT&bxyDesL2fWC%6?J59twr6Ek>t4_rln+Q*;;Y!JtQ235d~=z=29AO|?(fXA)l
zbMoOOM7*&HXw^8VyoGEe$jD?!N-c{ohL6$)AZFD|i<7`3f}rkiacUuGH6vu-Ls4oP
ztkDg!ACwlL**Q5W88oE|%7ulnsYCEyI>hL0F=)IXl_4k9&<s@ef>t>t=N9;t=7PpD
zGgFIw^3#nVqx6v49po=?eNzOPTnB|Nc$r2pC|2|G^Ws5$d}vk$r8ZE>9-m*Hms$iW
zH{z31lAz@YcxMFz$V<hb<^}_3g9oT5#Q<v&fERp&mRgo1W`dF`csm(*&Jxsl0QIdv
zQy-woywr*kGZRqwLzZEIMjJpQO7TUh$&jp)Qk+r(YS9*_LipfyV99wU42dO)VBf?S
zGlV(0#;2x$R=E@<gBsvPg|Nlzh)p@rAsNuLDYyd->brn)enC8RT^o4D2-KT}m5e#C
zb&a4x7Sxz#$OR3bC4*LlfE%`urcw%cqy{|f3tAY(;Oqp-{h*8wFD6n!J3<okK<jE#
zi$U`x29WuP<U*9*0eHF_vGNd9-G)SjfEHqdcKM;za3D{_L-RyYDrhVcl)n;l(({Wl
zOEPjjQy7X8bBn>l)u7B*mX}h*kdXpO{@|IaqSV4-%=!$x@IAGnAT_xpHH9H9J~1yj
zBOkP^9kjR+v=_BB8MNMwp%k)WEh94}B{eTTB@wj8t28%11vF0qse(W=C!mcA@o6aq
zC6JAsi6x29`n(Jrb)fbRbZHm3e-@vf2H$`Kn#2M%gu&Ubm;qF;KxSP)vxwjojga*z
zMTwAx0c1rnYMBdaoPpYB&^{$(9Do7T|MgFUPQ5^eYCyY9EDRY^5-a1ui!Z>ILPHmn
z>%qNj#1<})Euf|mv}A|v1jvBwK>?*IP;vn^IU%F@pvC*C;C=+SI0ujZq(Rr$f)>|<
z3T04m<rb%dmRc7;=Axl#5wyU!1hV*+0k)%p0bCD)iVINU16BL^1@Xn8teXK@5C!Ui
zf%<A7lOQV*;p;6y10Bg}=?tKP6f`D~TAUo8n4Fwi0GiMM>0>B{wpUZ~^GcEvi&DXR
z3qa*4xEz5NQ1Dr5P`{^`AtSW{v~-67+QbB#Q<k0x$_mgST!wPcE@03C=E{OpaQiwp
zH8;PgG9EO*>6=*LR9XyLpkfHxJWvT*f|H+93SPzmYOu$H{0JRG0IjM6OMnO8KwXSt
zP@Xc(&jSSjXmk|55iBX!v81F3+UZR$C<T?1NvUQg3_*!`>Coldpmrp5xCrEG$TkE>
znVypmS`w3-4Qi7>x*DLBs_`jFCGo|e&AJ}pkQtyNkh!JB$V0@C!Va_qCbb0Ie1Rl1
zP$L1UM*u4B!XR@IDd2HFSZ5Nnq#_wMzm!~*6c0`epa~<isWl5&Ap`CQLYmd!HVkNA
zN@`vSXqPBxxCA;u4;qh#4iA7f@q!8w&<Ig^Vv?~DsN4f@a)*w_f@)w;{DEqy67Y%|
z&{pph@T?MOl?p>aZb5P;LqR^YB7*egL9J3y-T=i#e0~8aqCn#*;3Y2kkU8??+yY3+
z15y`{I+<1s?bn0WW>qqzWP-Y~kWvmlKLZ)%0F6n5R+50nEg+MH(54T_=U_)Nq=0(U
z;N?dke-tx-LKPa1kn$%jvnaP5G*wWZ2-<WFn-@yXEpX1yEA~u*tfPY3Uy_uA(pZ8F
zRDgGmfpbU!bT1w_kLTv6z~&y}k+XVo5@^*mDA^Z5l3-~usGMOa&L}Mb&0&>fCTAC;
z?5|(|^^d@v4)nHJ8noa66_fdSpkxJZ2ZKW%v=JS=OBOWe0V;oT;4MzjCL-|2D`=1p
zG_VZYR1aF|2^u8>&C4+4X6At^l$^xk%z|R0cu*afnFp?eAY)eGmP0`)XvG0&UoCiC
z4!n-H9F%ucOBgbXee#pDQ&YfMy&yA}0b~p~%R+kO48^6nhVf=5pca7zSP>|aazNvx
z$+-pK3Imi|z!fQ^P6chTjR*He;R8;o24)Nypw1O&cQmNb%`Hv`S8Cv-1?i-xffhp<
zFo1I;WR*RrB~(xV8e~ra?Z7Rl1o;$H4uCfaK-w9gUU5l$Sz-=oAuD)^26!74<a`P=
zD^gPoLA&!AO3E`+N-`J%Qo(0WxOzByg5m;FA|W=y=I4Q@ox%MX@PGrTtp(1xphX$!
zd7ueq3nK$iH3HfBUY1juX8;<*18>O8D0g-W02O%9g1Dr(7*x}Mf}{X+HbZG%3N%Zb
znIN(>xDW+3xQg;~Kx?ufT}Vic7@wS<6AxN?0B+TQhC4vbdQhPU>NtYN(?P3pz(dNp
zDUf|O5bc@8pa9BD0cUXJ+z0jzcq$3n6N9v@v2N@25BGBoa`tg`3}Pq-wHyo}lp$y<
zWLhq$vr`0$g=BDNE-?jkss}?lXbUT>KmbPuD49U2W7q&`Ib<PZUJ^LeazS|?TCe36
zB*R#V>6yu(We3T*@tJub9~Y&9vo&~R7}{(wuwVcm*8obM;O$#U#tfM$VX1j3`9<Ib
zgy5AB$)GMmGH6`{XoSMh3^cj}n#cjojes`4Fn}w})c9oZI>2HEP;CUN`$4Uvc+d)L
z&^~mA3~(zJyk`kIzz;6WL8%$kSPBkt^znhs!$5Zufp%YjstxcgMp0@`D(L77#6t9d
zBGBmqC7{^^@DdKtU_2<nL6SPSDFW`Rqvn;=yi!nQ2wp7%Zf2x_XKcYk-Qc~cpgw~E
zLvaddJPvsi1T+<ZaxQ3(4XEmgPXagBK&dRh2-ejz0F8uzhdIH$0q_zB(8@>996Ms{
z8Jv!wBgfF8TgbRAG-?bDVCESb!&xSfLG6-^%wkZAfQy?UZIA&K8L*B!%q&aL-UX1u
zL5oFmGxIV*O$+Fd2Y9asDA*X%!0otH&`Ai8{t~2I0fiwb+ohJoqi)JdO#x*>P>zQV
z4lv~9$0ui`$0wy`GQdh#(1A0cg`6PUvr{WUYmKv0Vavu0jX|?1kb!Fk&_Xs)s{vLM
zK{F!gh!aqM7L@j2QlKFK@UUfkX&!itA2fjiIZFaGt_dCnDggK5L5ss6M}8P4f=*8X
zjT(ddWYA?A;1VCamNGLj2ekMVoNOSXpg9?Esh*oylnt5#2?ifc;RimM0`))@P{W%6
zWF%<MgA+qRQ7UMro&mfUJGCIWq=Es|0fo%A7c=B#rc^K#XMp;}IiS6*nGEruHY}*w
z3@Qpr!RwGAOCcZ~G5Eqsc#InuBt=Ak*F*S#_aH%L^-J>8({n)Q&6K3(6@&KTfQEWN
zvjCX^Md0lc3<a6_;E7vs>1}{?h5@YTPRRoM1=K<U4L8Bo*22zZ0Qav_ij%>cs7msa
z!3&+^K`PNF0>B+g&<c3aNijYJ$xbeA3<YK2JP$J@9=zf=JGBy2#4!|SB!Y&<i$Sv;
zka;6$HGsN&2-JuMjeJ3y*x-gcXnqCSJ%G+!<v<QeiU%zPhApuHWqZ(W!GdBVaQcTN
zFmS65bbJKps1!HQurZ``1vvveil3O0S_IlM%1{QX{8AW-QVY>WB0$@5K|uhS&jF9d
zKxf53V}RhPf9UWgC_X^t3aA~LSOi%x!;n;34C)``7N>(^3Dh)8DlG=j8sw+ug33S8
zx?M=`65QSfr4?{h1{vl6rIy69RM_qyXXkk6AZ@&ltDk#_M?9<_3Yxr00(V6qbG%^x
zgHuB>Lo&G86c4HmlJj%&L2HabbJU=P*dSg|aY_Mr$pxr=0m_Z=F^42j_XWCF1~zfW
zkOqmrVo<RIZf$^bOI|+sSfAp8M96qIw2B4|9f4vRT8ctaNNNG-Af#gODhALH4d}w!
z_+rq7wV-7+;QSeHXaMT7z_(Nvf@GkDG${FkPZ|KN_yJE$f*OjD1-vehQ)ir9!va7@
z2PDDffkFNQooZ5+o|u*dIvgrL2R^`KVgMeAfh@;?q&#S=1YB|!gTe~5Apta0oSG63
z8ZCj9i77>?Wtrer-QcyR;I$GtIi-1^5dlzd8<h4zg?W5hYKk%VAf!}S5{GyboWj9}
zUlnBL8XAIU%E7aUiOD6YMVZAVnaRbV$-v}n&_-g=zHn$ETL77oHDG`;3}Fl-7{eG;
z^ZGhQ#Jfg#hQ#|ghPe7UN5+Tv`^Wn@2D!uLXi_1k^?-U+pm`q9*)DmBMMe4L;IzY#
z3|b!)580kvR0ut%$tN=xR#=1b8ps~RY774`$TAkt@fNOWnZX6A$(|{$WvO{3j<7)<
zP$i72336Z$XyGj=$iV@CG-?G}c>qc|pn*fs*<p|}AG}f3h#?7S9MLzi0#e@;Gvp-~
znHw5FCg8w%0a81Im&$^gsNl*7IX4%876O86573YSxL*Jo(F3J&Q1u3C;*}ysNrQa@
zKog&!v(8|f=%8zvazUq(#6!~zIBO&pK@S{@FG?*ogfv7ml9Lk|l8aJ7>*bU3OY@Rb
z<C8#JVM}weL8TaK+DS`GN&}4tA*Fw4NeF8Ln3|`77RrDQLnulDwQG`6(GRTvt><@+
zkMj3(jrZ_$_W;dcf-3`<5oQLa@CwM(0-Sh)L!F&ngM%4z(vm=P?eIpBp{a!#bU|P;
zv?U2@o`V`r42cFA@x__xdEjl7(8eURZ=8~v!vNjc2X2gj=U+e_WpGmjJOU4@CyY$Z
zU^6icnV`$Da|%jetL;IZF9T5LE4?7q0K9G#RL>TqBts8y0;eoQ<%@g_0d!IbG?@%O
z;R#gk!g`R91QG%|70D;DxP&32D!vqaehH|D0G_8$h3@JEt<eWH$unSs9H1e2(8vyG
zgdKF;6(sY3(-E})oteT=3L0}}C^a*QFEuubFNKYL6r|>WhfTrFMTQK}Ucy|^2?dDR
zL9p*YQ$UC|Ab1E3(xwM>GIHWG(_wRI;IR}?vlmp-feLeozfwT0*<#R|fcV@bhV%l^
zrdd#9JGH1NFCR9k0owKsYM-Q(K+5kF@OIGn+~iVFBOiQJ33#d{Ck=FJ5?Bo=9zg4W
zK?5zIWxL?k74*P5e^48-1k|@ki3c@^;2{m_;6oR#!Bd_gbp8&qo&wZ2D@`p14V1@&
zS~RdmCV1TfC=G?BCxY4=MW7LO(3(xek|;xPAFQYZIxc1iDjie6r<9~3FCzivXGlc|
zIV=R8?hOnLA|e=ET*E+H=b*JZBo;xT2MSqOsZ;=N0Wrj<CKVSmWaO7Z4~qfK9f13c
zu)#x6-#$JkIinb|>kd?kfyPZTlT#Vs({`Yu2vi|5q!tyIBqf4(EPx6CQ11y+d8DO*
z=d(Zyc_7^m$RgoH&^ZL4+zuMr1|9MNYC07ZmxK0s#)Arscu=z|9@IjG`YA891awdz
z%n6W951{Ela6QD3>5IG*3Dlk`0xvuU4JQ_Xr!zqD3>$rdtONnC9|rAgu>e(?+2H-w
z5fPyAU8pTc%hnjci*Qln%!nZqUWtOo{Xv70$t5}9!l?*$KnZ9C9i9@+E!fo^RJJ7N
z=BI#GHNt1GK~W7FVS;v?^AkZ^ra;X(=)NRSk_U}bf_u531}&&U1MSO2Y}Sv@EXZL1
zCpOUOK;YwwKq&!~$BI&mGgC?vb08sMVPH@JnqGz<L<riY0UjaBE6WFM49H0ZH#76W
zTgyO4p@B}<0qvUyCmDu((BYw=ojS0L0XiE3!8U{^Q*#3&@SdCG^h5^eR#T)kK)6=x
zf-@APL`VjY{(%NV<BRgk8Okyf<3VmUFa!^GX2ut1<QGAX+R99;1m_>{KpreHf_H6#
zhcA$lXo>-7+5)k@3smU9mZ-u!VPI$!5y4Q9nFlKN7=nF4+jc=MGw8mUJn-QhpsWL3
z8Uh)}E-H!7O)bgDPk{v&sC^2WUoB=xaSjd-Nd%n~2pT@h%}>cp%LGk-fyVUXK?C&A
zt^#;b1*o`$>{0-an}Iesf>(Hem-|3lS;d*@4CNu9h1t-V*z{uPrt}<!q{QM($ecrQ
zF+)zOnF%<h7L-Dc1S<xemkB-m5VCM3GZ%E8Yi<E(eNt);IE0N&!8JotVi7}fF=#z%
zVoDZt@hvP83@t!COz=W*aNz+8Vrck)+D4TONgkz1&Y&KhGxTH*P$vi6PzO)6LQY);
zH73C2F{pzNi#JFilAc-u-n9ZgCJMS-Dm8^6FA2P&8J^?3!+gPA=XmH~8fZs1c-$S7
zrJxC@I3p1>Cz5Lf-o^n6)#A+b+(hv3XhCU726RI&xRV5~?HSS_GkKum4V3j#oSnjh
z;jINw-v`vrN{!D=&n-bzd0_pypqVw4p&*8gawk^?XBXGpQh3%#G%$eFJfJ~hP!S7W
zZx2cJ-~n!M;|^5ef+Uc%fyQIO)4hg?2IjCz5p<3OWUmLT{z}U%N(Ha805?~_>#)EB
z^(mEkiMg4{prRCX?qpFsbp0NvL@tIDuAn1KAoC%xzG{4Y2Dlf%06L2)u>>@c1>Qsk
zp2bHmCG%3tL5CWG<_&X`K+7jU%gsPlFX)KF3fKm4&?q3dAcPE)#3$vKfL8_^8GuG1
zU@K!lM~H!H9fsmm@Eka3J_IyV11dUUYZ8J(0^qaJ;DiP0>wy+#F+its;G0J*7z%RA
za*X105=$5=K!q)6^AKnlpqL@R*)u-K)g83`J0vo|6|_|!H0h1h?q<j=j)#}l;5Y^;
zfUmXzjsIm9$3u7PfaO7}Y`|S*P>&SU*8(lW2c4)0Iw21{bOBp65}yW2lJ5CADXDqB
z;7L2!*c9YcHCUvAmx+RBia<FUlFPu;>V+8$;G$5WG!N9KO-)e%ZO%{0C<X0uO3nmT
zy-BIiY7TVZSaLjglr+912eckAB^f*l2hDxZ@)5L68PawD^&LQKW<Ue=<qYr{@XQqW
z`gBm<1s|LVPp1ZkMur9q@OB<(XauqV0i+bNBnmt}p9b31hR8tBAwy`}0n{^dhAcYt
zNG#6q$xn9$FDC(a(%>UKY31M}ZlDbSkVA74p$CkBcH(-tfF`uTNewje2b%tf2OWn1
z>V1N%Zg9#6t%(6IVS=;`K$*J~v}h4Lm5>8EHX^?$6|~n1JcJJ#BLk0pm{k}W!$Sc)
z%UcZENdxNmgX(VBxD{xe3)C@zOw1t8QY&VFOyGg${lG^FfbtRpD1pbPf+iUXpi|<Y
z<PK`&fX_FB7!KN=Rtnka3Tvf9<_957rGmtw#9W5>vI6KDCGgx(Nl^}XIXHA`4>WKC
z_6{hAfhCF=a&pQN!G}_UW;*gfW32_bWzdWSTQY6IkXxJ%o4-TUn4l63nP<pQ04;Ap
zd)Je}CsBhZ9UyK4r(1A$qaYK!qa4)H2Cwdeb<9!rxWk)X1-ZGPYBjY86r}|Q3>nGA
zU;~RGTMsarKA>8lD6u>q6!|4Z`Ptz1ET~Kc4I6_dIKdqb&<WR|LsY<%m5@@nBso5#
zjG-8ugTYZ!P?QRqHHD2RfSceDZ-p}?=fp$mje_{HLP&K48Os8-z(6P3B)b+BC6*+D
zW+`&w4Zuq~<3T%_Ag3fjg-sx1wJE7(pw1Ii&<r$43)%+6P+pW<Tm)IK3!P;JkIzBp
zn?dsw8HtdkBsr-m@RNZ+YcGru<M;-KM#hH7`PA5mAu}KBOhoJ%86%$sV`OX!T|Ng2
zOvENj@R}UZx(ZNlHU!kMj0Z3K1Z_%BEsi$^i<mHgj;1XFXSJjP(AgZIqkK{!J_R2=
z3_eZSAO-4O(7y3P&`BoXk^<Bv19uR?J4eA48q~X>fgsRfrC{BLh7jGL+z3DJIWrHO
zx<S=9WXCOJK?|rS7+;c@4%*fUZw`Q3(~ue;+KK>ofIxFgU^_v>{;5Ur*{MaKbDEP=
zK+E4iRT`+50V+QrwIk@XP?yjkNAM{k;A+Iz)x|T^7j-%f6qTTZKHw)4!w$9q4L_C^
zfOmyBgBM0Z^EYTW9pr#)(9zGJbId_IsB<$@j3B)$klP_gy?~1jP(BKCi+2r*cMJ9L
zffWwmQUl(ahBQ6Ekq&C2rDdi=?Fvf-9XV3~I#dk2vY?nDrL?3n9y0F=nxKW0jNry0
zc==vDXxBT+AQr690-aZsnH-;*pJ@cjs-Sa{z=t}4#*#txL0S^{oEFF!S}|xPK{>Q3
z3+`or#=gMW4HW&LnRCdFtmMR!M9}d_AW`U1NbxD9MPLK-^GYljazRTlKn=9glFS_N
z=>eeOP*|HF-k`$31U%!P3u>n2X6BWG_G>^R9aP4Gdhz*rpehAAas(P0WhlwafgBnR
znqJAzi_gtWF9HpTnVBSImVhVFKn;M@q7=}X$LSf+Zb5ocDtNafd{hY3l?EM$l9Hca
zl$4s21Kx21s>h*|JJ5kM@S&dIt_R3P;FchG3J6|<gZu}ogg_-XXkZ#txqyyh&&da!
zMU_&Tn_CH9(^;I8Ujkkg3~G@j7AF^i&xQmIQzn8Aga;LapydG|bMuhaUK&&wB!de1
zOz>gO;K)t}r$|U`0y?1^vZ5OloN3UBRFG4_eE?8~fG$%4^=t|<D<Ffjxrr6v+7-M*
z2V7=D2I!4I)gyGb94Iy9rKdusno>a<AR)`2iopBOp#>DESqfc7R0cYO5_CTSQdR(k
zXAT2+vp8ft7<2+LxDx@|eh6M92<qyC_Jlfx`-J*2_$FqVL5tqZJkTHnc*YD;3xFCw
z$p-Oh<_w_A4-!+r{Y%iErufu~%o14p8x#+qMoUo%Xs{Ku92Pu*4({SWcJacun8D5o
zF<^kV)xcc<&?YBmPp8si2E@6+pjrS{F+;{%jKJd+pa1|3UM7~5Fa&2LrsS7{#+g!c
zN<eE9^W)Js+JM%tBK7S|KnFP{gAPXppJoPbq=6F~G<Xfo%%G=zrlx=om4!9FKx5<J
z6)NDyBe+C|k3E47R|l_QhAeyrEpu^p3Chm}pLh)2X#^_K!Md``av@0q6mBSWkud{k
z*K7{-6cf)B(DDADslz1X_y^Z$W{{PPpfxxQ@y?+6c%+$lQ0fM)_yKK|0k`--QwE@p
z1!PAjsJ{xD-hlL9ASddVflEH{UgG$a+(ZU&9)v80fgJh*b}MK?8PrY&RUS$4u;UUT
zZ7xus3U*urXuC{NNiwLW2ZyhLF{CkUU;-K52dxqSb?#E3!e&s~9IdToXvW|QI!!;g
zBr!QVI5izS^j2I2S`rRQ_3(QF+)DGn7p#D*Ttf@czN-=j=-d-%P_LN5)8E-AKixAg
z4ZP;ABr_R&dLF2dPXwP20zNr1F$EkypzuK&3<RytgpMwP@;0b|M>~Tj$kov$Ak@j#
zn;|nFWKcmRLrE&=3|G+dWOz?KA~la8H8&|WB?U2Q4_Yge3pz~_v}PT=v;tZdLzakw
zJOR2k2l<i_XMaC8Pj`m+_!RJ|N@<{ts;PM(GeOHNi$Ql8fI>b68l<owPJ=dkL8lsk
zMk1g-0xi=7t#=2Vl#a;qhRF=&kh%~w0syWkot?s+oj{9zK{XS2KLa>s4Gkgo7#f4x
zX`nka5{pwolLerl0_`<TP6HR9nfajcQt%8~a%B#v2u@A}UEq)iUd99JD}vVhK_+h@
zRb6gsN@gOYya7!<gSOg4L_j7lLERNlBrzoC76cUKr+}tw!I!mw+XA4H7?jsQ_JRiH
zK`kJpo-D+U%)Elq63|?Zu@M8fngF-3Kxee2rhrGGpo^Ix4#-Ka%qeC_2Jfo_T~(8s
z2Rhyj)UO2B>!AIndFc>y@<1g^ViD+UXmD!@+-3xyg9tXt0<vTRoX&g`E5L0s=YUX9
zR~%d%K~^8eL$VZTLoj#%96T`vKB5HVv4RrN)NpaUQ8GhfdSYfCXwidV5(B&;h1QY>
z#WtcQaLzC@VSpU<45?c{CW3+pbd3w_tZhi%1O*<bosh$j3_AR}q=+H0pdcqTJ~uHL
zv}y}H+5jsw6G4NLkO@D-L<1v+jO0w%+!|<u2<Y(C%tZK9u3@5q2?MCW2m{>&;E`CA
z0_u6di^4<$P>UO~u^BRn&j1?y1=VbzHYo#Wt{=Qz64Vd?HT)SsJpoXvOU+3x0uSXP
zEs%unDgf0c;Ftw@2^<%oJ~YVZ@zC2bz^5>SQV+Pv0h&I7WD?Yw6_9<Pjs|E|188e7
zczg%sH1Jv0phbkB^@S;*<LwHH3JgKlLx3VIxu6t$vj%L+4di<#7e`Qo651OmDN2G&
zI)b}}pktswE14nbIyn>6NCEGh1?5OkLjzO}Bj&4%!CMo+3q?~wB_=fR<4a(JLy%Gi
zDhw_sO+Y8)6=#B0YUO~N`I$w92JxWT!6MMv_@HEy0dg`po<Yt5&AUO4zyh854PHeC
z8U_d5E|6ITy0ir}zmb~403P+s&w-3}LAn*mkoFVk_(4!qL6(|=yA6;=5VV5@iX-rZ
zb}<9!2<OrQP=_kr&=}MjLtF1roRMg30X~rtI`PK<TAcwtg9daPRazQkVMlx=LtcJ*
zS_Q<%$qb;0vPy6;f%Y$e78}9V)rNQm$A@_Oy84HP#DjY;jtm$=PMAW@m_jZL&Mx4L
z4X%3)4M1laf(oPfq?9z!$W>Y%18A2bXt_1=@(WNSy#%x<rJ@AX7Xr7`pz|Rq;1jh<
zV7-}w)FRMOB<O&HO3>;I(20Ykx!|MaKn*ri6N~}9fFM^lUsqpnD41G6Eddox&<X04
z{Jd09tqH!$2-FG%AEgOu$${F>ppEkd$r+HLGti(JZ2N8qD1}06EYQF+B$~lR95^aL
zwIHmc2r97SK}AzaW^pnDq)Q5}j|&o0;tdT9AYE7kbB3bSlElos_)O3ZTOb(|hD6XY
zs_}&xph2t56i{~yG!GXK8aFDAH%*4lmF8rFTW6qC3P9yJLk29dgKp%4)NQDF2e!Ww
z>@rAJN3O(j^1-VpOY-AEYZt)dT(B+|s09k%|4@<~Uz`D3(F-yMbVW^Z5!fM_1)%r`
zk4uC1^q>#2I{SzEg&-Z56_i>C+Udp+A77f1Sq9qa0$OMR8Yu=x2<S34ztoBnR~L-f
z1;s41?*v+v2kuycOH6R14diK1FAiQ{faVt<w{;*czd${-5R{6{z-PpO){sIIDReTS
zARlxRR|$At31KW~u{bCai%U`q;z4~w2Jkw014Afn45dvNl9NE&(jc<ndo*%D{T%49
z0H{0xEfoeedck#@5kn4WybE+92xveuB^7lv0g?pFO~7S7EWSamH@ASaOUxW0Weup7
zg9iY3g%5PAJ*aGkOlX6Kaf%^@7AWyT5AlI4O#wCfAVc-AslnosBG9}AL>iL1K;w;|
ziU2(B0zR+>v=OGbqzE*;4Vu-0OfE4bCT6B2moPxrKzX=;mq3AvMbKU#Q2hgH9)ldr
zkdm4Pt_;BIxWRjHV3WF#F$r+@A~gjXwlF#soXyRXVGGL2Kv#Q#2eab~z+=Ce`QRQi
zM4O>8BrSkPClDzf)Go?}9qJ2ReFRG2&=ZtEi3(8*rNMTef>u3YcD+jyA*cF)BE|wd
zZ<dx>0ST0}e9$>-Y5CyU%T(|%O$lfp1n4|}a1cN?G=sK=f$JgAfhV9kv$U9@5IkQ4
zzCDitx^)h`unT%*2dHL;G^0ROExcy})`Swb$TOgMrMZqd>BZp84vI=}b0a=JGd<4`
zbbbt|8_fW&#FBC#K?vEcjC5)w>LT<2kH}z8XGfp-fFRdkS3hUhcppzUS5P$*@8j?6
z4LVv3yuB72JD?F2&@S+jg53N9(DEX1cqKD{hTja$K&$W#4G?J#DM^BEktoY71}%Rs
z0G*zdoC(X$;D%>0_>^M?*aA6l@&uLCux0q5L1S<wS`51@AvJ{|HwRRorj|fP7ND(R
zP<I8A*3l;|p<C6{!5!7iBG5X(Vn~T@2<mUA<rg#LLH3M;Yy<ZwK;2L9>OoLUfzCdG
z9v%rg#1}S4Z)gTunw1S|ftAF=PWga@yiaO+Vsd3rVlF7(f(u;G+QWj(WTX5%q+TOr
z&L6(|!N`OGR4Bq`OTpuu;OSCNe`n~rHBdbanm_|@@&Qf0gR&E3w?1f`0KBFKT!BN!
zCXo9U(CI|b)J;fmFs!}?Cu_*)BV;NT6tR}ckW)lKN56qCv;b#x(DK&&B2cvm_7!ZB
z&&Ao-1$sXoXtM%nM-Jo|J<$DA;DJbR`vO#<gHOZ;pCla*TELJG8gnYhgp6FF7lp8F
z3%bD&zNZ#+8x1t-;p-vb2O7hg`=HD85NsnzAj2Zf2x;`(0GW-LyfrW|hqv|(3@jMH
zi#kE$*#!ll@k*%C#krY~@d9|)29o%|P191ywR4bFMGUDa72wVH#hDg449*#enR)(@
zyO-cvArlmk72U99B%n+FKzkU$tBx3geSHIbAqx{h14^LgFhg;sMJXf;fcuuP4G^H=
zcj(SC$TEHS?JkgsK=5oS^x_;)?=TtMlTXYAPp71S?x-lu1D|(i6c1YJ0v=HUFPZ}p
zh71LnMX+{pKJ)@V@ctoC(giJ|%>f_G1lnl@UOAMK4{gzb5*l<05Il+u?qj()I)gir
z#SEFn<=|6ppuuZsV33Fu3&>{>fNu#*jfWh&2x^KWse_+b0Y2uoAQ!Z^C9?!NKnUu{
z!j4-2&9D_?q&evAS1GAwkgfsTF-W^D3=9pSYbn4R=|HE$A{=074C=Un`r_b=89>3C
z2R<GIH0cYfmk_NI*v=`)XbR}O0MNK^F6ij*Y;cnSRNF#Exj<vn;L-pz*bW-MD@)8V
z0`1+2Ps%JYgpO!~@;?J;>0xNF6KGZvdaOI-1UAs1Ms8wBa)wi7Nh)X>BG|`21j~_@
zpiV1z`V_Jy2-M34)rE*~0BsopujGSuH8V;RlR?8gMTwyGZJ^0IP}K`Qzyw^9g8QrB
z2nXHX3K9afRiKVzfF76v>XoHdlz@hTK-)z?MLERh(3T^p@Bpm}fOa{GD~ll=T5!Sx
zwZT9qWPxs8$;gC`(xIG732h{T7au}fis1E|sSKbi?jTVOS_uFSV@Ngz4@y8}Kz;HY
z@YG02aWbfNT?Fa^r4^+XG8E*4#!@O#G9kFSWB|=;g4zh6CD*x$plgh>N{c}mEf2Ko
z3bZ#J)Y}4$X2S|%Q0o}%X-E?pR+EG0o%8bZk|B%J%Rz(D@NGzt;|IVutANg&0xdcN
zPaJ^8H^CF5pkxl|xPxZ|!R2^vBB&D%xt<o9_&}#1Ku_NT&%uG$&OmN)1ub7qtzZCe
z&ICC*w-_>v48L3uxr%|DHHdbWCnz0f6ePmZs{wRoB^h+^Hh2=s5IkT7pGF3+K7hmm
zXlxkeTt!er18flJT50e#te`9b&WNDlchEE#s8Y!W4Iv{=Is~`Q&{_qcm1dyzji52n
z+yZdf2TJ_lQmi<&1Uv=@T>}cr0Z6MyKu1~?q%y$To#5>>(0LNjN?y=;K%ig;1r}tD
za#0fa^j%PLfU1MFk3enks?2nw0(c3M2s&aVBhl2*2(+dn3EUonPHcf2{*bVRO!~ox
zUqD_1j~gIv!GnY!<SbEWjai(Wn3D=>-GdsZ;5r$cH$iy|w3rOi<N@*E$2@|D6HD`;
zdk4U4FpA6LlS)fU^7BB$o1g_^(8d?20}Sp6fUnAdA75)?3hHD*_8x)Ce^6Eednq%o
z5Io7xPz>JY49W-bpyfW0^FBbO1Z)Kxs9g^(4k5cLAXQI%5m-raMq+$+KB!s(?JNeh
z#z0qCgN~C0k70t>e1QWA(t(ao0-vi2PCvz^ki#5GiqexuZ)?xX*9D(9is!a=1>Lmr
zjQpHbkdk!J3KsBnhu}gBa<Cp~&x!%s<O6tvYp{oB00TTTg7Pb<3Ip%TElFX3?50Qp
zU9(&Sx;zTf+{h?RL0l6GI=m7*`vXb~@rj^W+TzOGr2HI6Vt`%xnvz-uUPTWXzH#vn
z0$)Yq2AY}y<!o?)3N9T%Yp+0g8hj24sM7{Ikrz}-LC3&A9sDA&7-TydEVt%^ZaM~!
zgo6gZL0vG=0ow4x=nHZxLD%SHrh&%2K${t0E5(XZOG=9%H;;pkrz*~@0H^)TbkLn8
z;36N^Uqm#ON((@hDx_e;Ja87$=g3USNd@0!5f8ac4|>IJYDEcHA2i!TM;;8p-4L(@
zY)0PDED?0qDfGmB(A)|1h-Xk&E;X+d)QSN0$-%?fphaik89h*=3Vx_Ev~LR=r%WvX
z4Hdxp4(XuNb@OvUTl$k=S1*9h?T7V<;if<fSMWqS<OVg+_*Q<7k&&UHp<z7ezJt{C
zOwiUzP=g1wxEHi{AGA;&bUIc+Mt*8uW(9Z}wFo>j1G;(}v@{pA)1n}+02&a9paufC
z`3jm;VMtFbhzF&DqWoOYs18F(es*deq&&*V1dWb?HvS{6i3T0R0zMxdbm~J6=vH>{
zMI@l29&|V!=yV+r8!`<HT1yLVltap4(DF1V@KxcUrOK(r#XkAvU@Jfs9Ax4XI^qIJ
zypU0sjLc$43k2G129G}HFo4EGL2VvrVgXILS{T5aozQK5kZyG{_>LX03ec6p;Is=W
z;SmdkkW`p56l8$*bQC3)gNsk_;VIC5Bq+p+5eu_nnHbz}0c}o!T@DR87^(<7$O0*H
zi$RMY%fUW`9Jw1GUkpBRgCQ(4(ai~L4=7h7j;{l^!62Gp=>*hxb#{(-a&&U?agBFz
z4RLh_T~GmTCxEgq<UU7G{gRmvx@8lz(GFZcAZ~4kY@LR6S$$mMLDQlP&Q73y5~xXz
z)PjS=SaA{P2&fEDn-x;gLobSe-lzz!*mLsB!MhEh69k}uMQWtty71S>$KTm8#1(vP
zLJ?>WuBVG{BIvACNJ#+7Y@l)TJkTn|V%Q7`d^-=gDFbP><$?+l=yC2z$tgxjphGG$
z^NYbFvPgUXK${>z+kNx%ptn0aJI99vIYIZ*hiBx2^JHdmB4`OO$P?hTtf0*X`FW5o
zE@+G$9Oa<Vh<HdblbR9_ImQE2I)di!p`ic?J{+D0pHLPb;19YGCJ5BJ0$m}W3%YVC
zClzvG54g?-HNrrrw?NmEff5Mhv>Dj_93WSMS|6YjvKWF>^NLd;xyvWN9F)P3a)xCh
zc)Sdx0kkd&S{Q;hqm*PO7o`^Gmlh?bg09}mt%SAc{DaL*81j-pr<Lb}&I^NFg&Uui
zlMlXJ7j$Sk=(Z-v<X=3fwE^mSL55yHR~3Q`FDd~yi(yAT!`EVfRtA7J2*cKBf?94!
zD|}%GIDn=l3ldWdAWM-GQw*VZ*nm#L0OuJ{2*pF!9)m}HQ_Dc>F+dRo+RuPk4-Xoj
z16_!opI-tx%NsO00bYJn3_fK9)KSeyO@y4|g)-O!UnLK+36zP8O27-3A&VkGiv(Z=
zEVPSO23l1PUiAt(;|<bSgC1nckdm5Hk_f8}AqfQJ5YWLY;L#4qaYSfk03@w}2MIyT
z;fsqwYq&ux!$3W+c+fa~NkOg)ba5PbvIpF81!sJ4dlHnkQqw`*f_U(XR_GK_KKQm+
z&^}7&^bu?cSTO@=lNCc?YHq1>TDnVaq9de<m<c-nD=!VHh=88P1Zgp&xA~!b=+zRC
z0vz19C@qf9$S*0#DNT<D&2fXa$AknqIXi>=l$u)#shXiDB;=J;fOd_7<1;rAv=$%@
zbdPC%UK!}Nt&;qB&;_5+1x?_327E6aIHQ0vDr5~Rq%zCN2MyJOYZQnbppC`w-Y#f8
zO>st|k*QgHN<Mhr1k`<p%toZ8fR1)CfOSw|E5Jb;=}SQSoIvphP9AARnW=dxIhEjY
z9x0qaqm`fwj6ow(pyC<a{D;LnXf+?`;0I{>0m(zI?*?zj29@LB8WQBE)S@Ejyj@-@
zv_t~koC@A{oB}=G349!3abi(Act{%T67b@`O2~3El*A1>n~fo(95iDU;sTokgyzxA
zJos7$Q1bwEtqx>xI6e{Fqt44OiBBr7WGE;pDai!QHG}&0pc@fON=owK^Lo&#8Z_dA
z6rRvMxJijcnJLgQBuM4LPzLTC<|1vK0}nWW23f$>6X;B2_#PL~7zC&hoCMxD3t}b1
z22!BQG$E$OCqeFthb+NNg4_rXt{osFVW7B!p8Zk`wgpr|f;R7iC%-}WYC#IMQqWEI
zpqdRl;0#g(n`=ygX1`)klM<9JQcJ)-hn(>Tsw9g+Tk;u_K}|2vF_9=2c7x<02k3zE
z2iP^Ria)uuxPl=wA2bt?nGRk60BNXzr%Rv-5!T-WO?(uC*AIebOF-@ft!v0k0Zmze
zy#-zqpOVT@Tn-wAcXADbOn^fNwLq<0@RlR+reM&5D)1tOWQb347>ZKCBjC^zt{{0H
zJe~zQ;5;#<1hilgyxt(c2y_snAwzOfZW4GZ1k{f}oWcm6+<_%2_*7Y1B521i#3@D4
zo_0=RWoi-V$b^#IV#w$<Vl>NwAtf;xTm_Wm7UaZ(I$fY_k_<X2HV0PSfNvPcPOVJJ
z2OSwrXx7Ig9D1(}XmA2_{C{c*<mk)z%)H`~#GD+49Po5TJfzuCke0_#0V+OWhtz>u
zEYK!4w8940YLH#L!2yooR0=sL$S6Lym;rPO9cXX_bZRH)WF=5)11-@7Wfo9;p%y;L
zxu6zJK`He3Qcz0+G$aLG(wSMDoWcOwUkB=qC4oEuI+ZyywFtB)3ADOBFFh4Bhz%Ze
z0F7pXs|V0-a7Z--8a^&9h)*;^9FH7t2&yt52{9g0XC!ANf~p^eQqY0$;6e<xcN`R-
zV6#Cf71~w?O|U?wYrt1Zf%ZdYf-WZmTb-Da0^TJAT5pt-n$H04uYlYQnmB@9Xb0*o
zKr=F^umo3T;FC~5<BlM8pu;XegSY{XL5{wzA@Cd1L5UN*E&_c20d!~v)XXZXj0eqE
zfa3*J(m;b4S{^}H1cOI|AV&|trV>DEeNv&VK<MEFp!Py)5oGBssKNwSW;vOuDbSHu
z*j^MP6UahM14Aec<C{VGpw$%M6$Icz;=rfzgNL|~7kh!C6*7KV1UmQ{G!PC-Hqd1q
zpkf15MdqgFf&&*+6Xs;XuVOHQ-;wTQXlCF8T8akh8i2051ufYE73UxiLS{vhA!BOr
zc29A3W&wB-+5o(9mjSX?0<_T*G%$x)pa)t@2<pXwPQ3t~>I`xosA2>)PYW`O%}l_N
z3z}2|-7S$=04k_*p(!P)G!1-+Eb{m?bfqrnlqOJjvX}uj-T^w6E*`YD4K!E_+Q^<*
zz<@aR0klXTbe$`>-UJs<ppE*lF}u9{0tQ4e2`VDvi;I%s83#704IN$wWklp!D-m?<
z0<^vYP4DF<RzP?Cfr=hbHyNBOK{Yje9Mi<W5WFB0R8)ahSAs?}KxbiqQwyl+0~&WN
zsDvC{3f?FJ>Ha{w!7c$IuBaV)$Z4#gS`l>W0_Y}l$VD2EIYr1i?Sc}t+sqii%l<+A
z$I{{?W5~u9)RsVgUI{qS!PY%P1|T6fF@Vz)tQdtHp9kxQfx3a9#xrP?vMe*dv=}_E
z0%;e5j_d`cL`bcdlMk^rC5fS=s5k@EN_S2y2nIzWWCZ|d%nGvP50sQZrAtn6NfCJa
zFSrK|OSbS8R-nENbVL9g(V%Stpe6yNh>Zu2)FU;*ios1M$Q2Ht@(WV%A=lz1`Oq8P
z4UJ8b7{FJg`InXyl$Hd5A_~-{f$m{}HY+l~yGRRQ9VF0kZtxZ<WZ^An3p?zDbl5Ns
zc-#U!l@A{72i+->p9?y~9DMdoZej)KkY(5ya;kv|XzLTWC`e(*1g)w7PXdFJcv4Yn
zVm5dH8$N*wI-oMSpcIs2z-bbcBN?ElT_t6fFeH@~6lLa>q@gUX0Jk_mW07T<C5btp
zq5#xr2OUKTUN;HO@u1aOumPt`_>F?lqw=8D9i*-RosXAN!jPGll9`-Xl3xUA0~HrS
z4rzq!H%QJc0Udw_JLf8=G!N99%!M5qo}ULg0}j%H0+nsx5*h4Dm=&PT1t@(b=BAc_
z+6W+3DXC?U^)aAjJVi<1({?}uTi{L)cpDeAi4BcDNU{SZZqRMAdFc$9DFH>0)4xEA
zd%z=jpyUA`o`Y%!kM)9XScXp6r{*QcgN9N;VGlY7J~2HtJ~IV&tUqWq9cbY!`2H5y
z(jCx&-JsePyv-AmqY#Zt==ucE@k;r5C59%T!Aa0W79_zs<>!|Kf$ru89kIfYSd<Pr
zv$!M?JaGdGBG9cYWyR$s7<0O5km4%|w0;dTArI~>f@@V!HU({j0W};!<1L`F8g%?*
zGH8kqbmuduz5o?r4B#{eF18s`K|9|-&1BF<>v+&<dAX&zpoRdbuaKEoTo?~(Re<L#
zKrLL*3Jn7T6L8-Osd)oEjw3U#1UiZhu6ZC6>JTj!pn=ok_@dIh_=3brP>F*y8VRcv
z;G^L2@YOJoi;*FV3BdO-LmK{|CVE;DB<|u1GAmMZKt0Sn@OcRgpn!;n_J9mgct)Ux
zhM#|YfTy2(e2{B!fWKcb?BFL*i4SVMRe~BNU=M>@7@z?cP$cD-mViSVdD{qB06NnM
zZAgFyPC=z!Q64ym5ETzN-ar?7gEnTDWEAC>re}cKji9s%nob8DGXuT55p)h3WO)j#
zg2+itD`9}l5`Y&PfLsVVd<e3dJ07$Z8*;o5c=9yA05<po9*+R^91_z?Qj0)WV}nj+
z&Mk;92Q}*RLC1xaWI&ovsVT;wyD1nzS65+l0s=CNz#~!6yaVdpf~s9;4GU_Tf#$nG
zkqSD%0(S2_XnY6K=Yp&SfS;)E2)dM)AtkjCQekF;&Th!h1GNWB;gb@ewi43fd{CL0
z3Odpdv<M+36|^)X6?{xxaY_<saswn^S{z?knwSGV@dC8gq$0nFAvpzfnmni<1S$YP
zi#ZB18A>7Rqd=1YprZ?mAe&JNav}8&B!{LY=4R$pf+7H%jX>ux8A3L*gImZ+IoY{o
z;2cy8TCNrk8Lfc~u@t4|g7yl)H}Qk2IOytMa480{02J}X#_>gv^JGAS3*e<thRM*j
z323Suw9p>fIs^|Ofo52fz->oRQ3;(%1<eb9j<6^w0mo4h=mz$9(DAv!uI~PBZt)@h
z@oqkjAps#lpk-p2WvTIy?FgW?Y{l8}MHnYtg65Y%oBqIlGBm3&HiA_8nV>ztsd?ZG
zRh$f7n8g5EV+Of#G^ISh2sC_ARFatw9y5nz#&}SZ7Ca7`m|TzvJL(mD#5pJx$0sG1
zp%-%Stda~`GM|?M3M25yCWrxA9tJWKcHJ<jpabVx&_rl*E^MV8ICM)A!8gCbnmHg>
zfO92E!39qB(BV(mLJsilsgN;p#5i6W==cK22p(t`4XBI+&A&i;!jL%41YM<=399xO
zQVT%GDQ1?W7A58c<QMxU7H7jYbQc%oWR`#m2}DH#+7_6a2RijRGX)Zypo#;!aTQX$
zfqTfH6NDMklas9!G~At?H5Cj^^^Eik6^smwObsjyEEF_?Qd1N>5=#`Ei}H($q0+jB
znhHsv4XBwp#a0T?L1P6YJrfgML%p<Q6Y%6bcrgVi=8Hkc<$!LihpdbMm5S)6)+9zm
zFn}%|clIpG2X%p=;~}8y2|(Rv=#By-#Nbvj_&zgm#sPI(L5oemOD{9?7&1||Aj4(|
zpnY^msDdx3hV<8<ovjoG#L*?7f&z4%3Ik;HyO<#<9eTE6ZZ7D=n}XC7@Bv+*P77!Z
z1Jt1fZ8UVu$zh032DMkAM;n8N{z0pG@(bdPjUe|q#OLKhCjyZ2Fj651+QI><ZBb9g
z%`3}=wHuNgb4pT+@)Ao@gHuaNKy7_c-BgeZ%08eiT=}5!xBUDPa2;s^KJ^RS<%QNJ
z@KV7jjRAB*XBp^RR?rc#pynM~xs5c64?O`9bl5c{D2hR2NQRKHL&#m~u-iA{L1!j_
zJO^D#1iEYwGJX?pXkuUtZr*@uI7m#CCFWQ_q5xb7fllawNEBoy8-i}Mg>CQwoxF>f
zuY%vw2I{DS7y71Flz>}i2wOo81&vk4CxTWsgPX^oY6jc}2DkCR8+jpVGBcl{6jbOt
zJ0aCVpuq+3G(6~FjP$(H<oL2g$h=`0SZjPbLmsG;Q_PSCsuQs84+Ni72pcZQ&q)E@
zRS0hDf-^h3KnFPt$!5&$_&)xA?x4xT;`|~|fI@rFknRE`Y9V{$Ks7z2`~V$tQjiOo
z+)4qL3!oYebp0e~XDjGV!u-+_=+ZRM$)?5NBX&U@MbP9is3FY|Y#aoxOTy9<L7n;>
zP`zbn1evG=hhRMDR0n9Y8QwBTN=?fzN@XZ00*$|=<}rYdkA}3*A<b}*+d+|F0FDw6
z%a9?zpakA`2hAUY#?Qe89HasT<w(%2b_IzgnMpa2<6t0@GT_ntqSRDyClwx?pyY>`
z!v!t01(npWt=Zrv4QOT&Dp-&iUsRk@zyNA(fNGE;hNAqGL}=q72~-p@fR~X&rml+_
z5XT=t2R(}tbHN=mM1F_$qd*&LAn6&ra5N9z!Gd&cAR~t0dKokg0lFd-G}jIqyaU~W
z11da0ZFk5ZG$<-zJtK&jpq?dYw5BLEHLnER3{L@HikT0aq;bp4No6QW0i_t|E^b2x
zC<A=5K>_FncgPeBG>bxuNsxCSH8HFg3n?w*lafJ|C-gwpc-THV&~h^H1!abi>%xp+
zL!yw=*g<m-kY<~+6QmgmUW5i(td?3-R9a9H4@w2F$_%^=5!6K}29J$H=4#@>1A*Xx
zNd+~aA*VbQmq6yW!F5DB_~5-1hJq^Semn57=b$@Hz(;a3#DljD$H#*j?5<(1ej)MT
zGh0AMO+e>*p;jSB0XT_dfL7*1lW<Zcq{jwo0Kx{sp%owlD4Bw;WGV&ivn<XAPX~ae
z8$kn>LEv-jQo)CJf+ih79t17fPlN<NXlODi-Uzbz4^$O_dX5aai6t4y1<;fT>9N4l
z7^vX}buUaPzW}t#0h|s%dp1F%?XWOS2KC}V<r&g4$NZF3&}bNV-3Vw<0Cb=m130;Z
z&V<X&1#N52PX@R3AuXm7P__m&;lNg;q^5z^vx71qsILs3Yy&kxKx_GmQ$c5+f)7gq
zMOhJK4hVFdA870h(O61N0bP7%0In0jy>svd_n`a$>4}1(D#$h1KQzc0)~AAw1%eMf
z&dUdHv@0)4EP!sLcL5)%Sp*thP6cgr2k&zSb@oBSY4HUaV3&h?lAx|UB(XDq>j%&Z
zIdJBOhBkD~4P+HHWXJ(}q&+0>m8B<UltWIO1o;}=5&?~><b%%-&ny8s9dzHco2Q?v
z3p9O!Dt3_PVKashlOXX5Ek#QTav=jFpphKVMsZM?P?TE2ke8naIszTCpAJ;ofyZEq
z@^e9>jVaDf;4}I_r8a0R3Y4=LGIK#A4yAdZz4Tz8F+i3k7DL+J`JhAdGC^4{zo4KJ
z+&cx|1r8Z&gEqB6gFWD-Wd%8)nhR9hff@?nyL=K$7(j=df%)JD3b-_5fDH11_JtIe
zgPPUwAx{GXQ_yKD;4+6H1+>;5a!+d>Xo447{1_S-SVHbi2h}x32GH&}>LJI$B}Jvl
zC9onEydVaY3PB@P(83K|oIq+QNCc)9gKR7X8ER+*Do8=@%Pmd^?bOLEf(|i&=R-j=
zE#*b9El1#<82tRD__WfT9MI@oW(p{Jq343f2Zsc?I{HF3o<dGpPDxHmOoX1N0$zp#
zDo?@dmLZGyp$$IhL>=gkEKoKnNo9x!Z~iIC%!4;IpqKwZN{QUml0;B=Lkd$+^#HEZ
zA@u_&4;QDF7@C2{d_cF!BxdG8rno@cOu(58T%3XO7bFc7fOb13XMj#EhbDXI`KXZ1
zSfCBw;KU6XfCF9h37@YkhRq8@mbifm8qksy$Z|!{yevZ*=;F#$SXu||ngxddXt4tL
z@NP&m2((HqBa;DEhJnv12Hyt*Y9_$uz~Lul86pnN0_{_Wo}Xn5p3_b(iU-$0pn;rt
z(82MbCLw4+BV^w*s8b8uMg_Wk2vqpS=jP`joi=5V0>1>&zz8zD4la;Dbuegfp)|EL
z6?7UGJV~3Hr$t17+L#%zRm}`3pwb4E96_y8(Cr?O`~*Fe8MMW`BpI6BK*nZ*heDyL
zAGBvQzW@?7shP!znJKUtOGpuwnGb5~!{&7pa|$w`C&7cSFaejs8Og~7paaw(+rgmy
zR3tANg6jQ(9EK#&R^Wo1#Jp6{nS#j~;Mr`j380~=qIi$|{Oov0>yII$+#@wHB>;L*
zIi%1^10D2lzyPKU88XT}{oMQ+z%dFQG62oL<d>y_20K7Qp5WvJnV|+Pwu^{hND3$~
z^3O90C@*r)&riYZLxV2n0cAe$t?%HmY{XzMsI>~Nx$^Uh<1_OaAm>Dai}qsh(s1xn
zjnbTwOmJ5dT;hUrAt>}9B}xu>y`>xUfW7>plA`?5640h)@QEE@ZQ$FHKviaLG3>r>
z@B~C^F1V@#)%Bp_EioC?l7t+F2O8pl1P^#*0@7k&0Brz=Ox_eErhwYl;EoqKtig+*
zpd$s4`L&$<ymSRH0Y760G?tePzGWmmjRDk^E>2AbrK9AGBGB*^cn=~Z2%w{9AV;U>
zmFA{`_wqt|1CR-5a0yol4o>J$5A=L=$an|n!VXZo12kd{YLI}gA}xWR6IqG4!6qp)
z9n`-p0}Y*|Ag)(2FiZlUfD5|7IWIK_baxG6Z9B9J2`Yv__v+^6mx1yoLqTc|I4BB|
zGjmgO%}hWAA?Pe3&?O4cjl~Smx)?lb8xLAY1sMl`HM>9~SJ3JcbVGCzLt=7rX)bs@
zZ*gimXqpmoxiL5eLC#Wu^~h54K{v}V6qG>@^(h0js6ky0Xr_f+008RerIv%U6)5N+
z&IDB;W#Fb6$i<-6dOUdPrlA>V@iOGHH1Luo5Ery*2fVnDAr0I~1+{_@1G%Xw#^7z;
z@QR25wCpmmBo%r9dVD&@Mc*j~7N8y5phyHQ`*jAdr-1Y+KnGHr8XAF*qy{Hs@FX<2
z;0Fa1G*N=08FF4C=mIC`W)(=ugJ>e=mFBu+7NsVaIAxX;Go%z36f?k%|AOXh&{{rF
zhYXUuK-FtTc|3T1WNu~&s33-qsDl%Jac*urc!^3P=z8(|f=Y(We8_zznRz9ddC(bh
z3+N%w&<pNC`4=)Wk(Od$3fhwb@(1*e<c!2(Xi)$vE#gx_m*9YUBM@)KgWAEMRr48T
zpeYd}2Jq}LWI-Xgu>&v36O)n{Kw}Bu^|GMJM^Gv#iU(J_si0$Fz-xm+-E@>Ii}FiL
zz_lr;DlW|f9XJVIMV*leDGNah(?A=;lVOv5pmCt0)I!jF66V1-pz{bpUdv2Dn#cfE
z5=gU^CHe8-mLaGp0v}7lP*PNo2)=L?G{p@X-YEgia53Z;$Cu<MLl>-rhFMEWav;l{
z7*bLTN;1IXH)f#R2wLU`o^S%SD#26w(3{kpo#Q?Ioc(<R978-ID~rQC;q7q9fr8Ki
z1#(<1EZ&SvK*^#6a>OvC<p~<_fmQMO1)%%8ipmjN<v>%9@uekc7T|gSkulOz49r0B
z4RT1Zzq3cYQ>dGpYfwDwn9byra_Cj{XgxGYaSJZgAT2piUkGxE2&7dA8l(f~ThMMZ
zNSy(m7z7vXpe7Hb7ZabJnxD&%2+7CkX$;`qMbNYkn#zHsB+vjy8f?2Fc$he~1boXp
zXaWqBC%~MNqQp$lajc0YiJ2*ooCY2tg^u2Ummh!%)%ZjUhLFUf^wbhh7f_mZa{^C>
zL;HG=3np_DD+(CWV55@YF)GlCdeG?{`FVMuBO1X251@2RXmyjbuM5)hrg&&KKQ}e8
zxU?u0njt}l5P+7nf@f90XF7m}#$m%Lpx!+=9U(<<ads(atS||*#<Zk}p|~76EC=4g
z069w*eT*Jf3Kp4}fcj$4Ez_X(7xcoY;-X|wc>x+T2X(%|p$<E`0&@!pqE<39KpY`z
zW?%@<@@Al;j-baL85kNG8N-*ufQtr56#yzv3@R*4z#atUyrR@X&;fZ!rdWcKGpH+^
zpOcc30WS2w^RsZ48KhFoO^MF~ozYT~2tJw)Yo7+PAq~_{0S}H9R~CatwhKVBk;M!p
z2H-(MXvqXxUko{a5InvMSv>=r!vM7;LH$0^VF2I_m+@(!QW4tk01tG5I`W{Cp`l{A
zpkA1>b9`v9Q+!B}qhGM2Gx#u2NQVY=&Wi<Tvv(5sEHUWns}jhRbgm(I9X7bQ$wUg6
zL|DZQGCLl&HXYP9PAUc6rBaXz>dP=d78gP&Lx#NK%oKzfhK5LNBk+h6_;vtrW{pp+
zD1Zzkr4|+Cg9>Z-na8LFk_AI?A#|t|G?D`<V?i}AsA6FNUlN*`48FMu(#?l13Ig3#
z16z%g3LR_&UuOx<wctDlS|L@EnVb!-eKYex<LRJYMN(>!e;WKI9?)?}MWB&vkhP$M
z3u;|KZhtj2gH@xTQUhGdfUXTJhU6^J65`~<9MI{*>8X$&UqMl3Zemd-c#SGUIp~o3
zjKm_Otqh<gMc}R`q!n6JnpXfF-v+Hq09Ay^#h5DqprtIx4WP&Y4dmwML9!>L2!%Ew
z^HQP3J@}R{Xc_=TVSEMXh6PZ^2XsogF{nquP@J3z9)$o6#e!SIpdnUJ`UR~50JTs-
z5(TM6nfWOUnc(Z210Y96r-JyP_ET~y1GqBH$p>Yy%%Vcj+!#0-Q(-3@6@%(7&?FJ~
zDsu2bM(}6_xZMNVkOaCw05pn{npBz&ay)1sG<d=dHf;!-9s)JX;tf!EhTy}GGt)AY
zL8}u%F;$ujySW8)vMjV70PWm^w7j4ffWX#zK$;+s<t@;-O-uog#e#}1@X`n9U>4{q
zDA1rItgj4eW`G8JAhW~ZMhs*M8q`7obv!D;Z52=mf+7vp4n{5NU0gvqILr~W6$mm|
z1x*zBxu9X3c*GzFC}4^z8FG{ID;Sb8OCW27!DS9~-4odLpjIfv{$kL@=vAq(R%$$?
zY-a#3JB8L};LcclJjf%U=~T3f4?%|jgSv#^0d>$AZYgYk6eO90$0Kr+^Fik<fW`+v
zMHjUG17|l-PJ-@51f6jNJx9d9EVanQ9k$CJG%!+H4C*UqLrQXR69J?Xl=VSv4CpQx
zP$;4-7lRKEg2!q=N34NzALy=a2GBTjd<l4i1mx=0^i)t|Hzhw8v4IoRU;`a-1zJ4<
zZgrOxf^Hj5EMh21PYMDp1I^DXE&&gPfXxPvW`i_=2X8?W%na~JeDJ()CglF!+|nHI
zAS0yc11$^%bw=XBof>Fk7}Ooe&x;4Isss;(#G55SMiYw*!3PT!K>C`XAuMnVfwFgI
zDyRhw+JOl={>{Y+ny*W83*y1?4%&zXn&pI~Ay8;RR~~={IA9qXbZMT4e^5w#fTOdw
zYY3>e1ZxH@5H89GpE(T+c1Tkmw!Iv@LN6Y2_XuR+7V=<)p%J3$2366B+5p5eg4Hk3
z&Yz)KHt1NjywaRR@WwIdsEQ#-tqCY4fObDaMomC7BCy>}puwQb{Jg{*$XQ?oxsd7d
zlKl7*2GIH{&>FndJe1{ypjCVf@$sN>d}AX}yn%BRs9H@e0*?uU=G!t;V1-OEWXC6>
zV+D>hXde{Rh6E3kfQMi~m1sd`ZoHu(II)#LmJEOz(cpCrkg?*#;$qM?7tl%xaBT>2
zVR9<?%xLhqaB@l#Xm%P@Rv-o`KojMlXphfEIxZw40#@pP)~|uj%>gxBGC<=$kOBi-
z5`p^Ypz(Xq1TFX;8zY8f^efBEA^j9kD+!#u5l2Q^KsTWj<(DI(*VGg=cm`dJ0?L><
z;AQlnH9o0%CGojQW(Fqapdtjcgr_tYwEs2@ItB$jodPL>jSaxLAsKR3A;{l34B#um
zL3>rf8&SboEGe@DG!p_!x}fT+q$nNKx61?<UEl^0$Q|Han*~Mr;4zNWk~Gjsut}+)
zy{-A6^%RgT+2F<ls22u{F(c?SMlqr<1zrCL$}`|m>Jo6X9vT*)6LY|IwV|;|s(~Rx
zYDEF4;f@dj9lHiTN(7R;!Ty7;e*+~vaC)dn1ub$)1g9ski$EPwP#{2ugdzDoz69(A
zzoa72iq&H1!cXw^KACyxIjNvaWRh~SL1_cBm>krZ0Cy$9mV)9QvPc$GOM?4$rNy9;
zKd>ysb@92mAZtN;wo8h@1JJOP!T>r=Eingt+!<&&aB_ZbL26zx<X-lq(&CiVvSM(z
z3$#K6R8c_6#!3dzN$$lZplB}!WxtRB->}po=wjH+JaBY6I~9Nql?PqP9G_PN>OB^N
zm-B<lH1M%R;6Wfr?ny0U$jk$`-9W44!SMl_kAba3$t=i$)`LZ<#YL%QsVVUWpm8b~
z+YGdqJ=i(e)6*Y%p-+4XY+Y3m=)6?W$|_I`FdkMNL&k&5Oc)@8gOJiC1$s+3G-6Wo
zQW#QGQoyU5z;zO+Wdt4rhbH{Y+{8QvSlEI*QUr-1NTVKfo(E)^XeMYH2wZc)_L_&e
zJAwvrJ-|JjBJjdO@LDnO$t@s_ka-qJykIUk2nH4B3{|N``QZK?NC9Go4t_v2D7k@R
z0=7sB)P4kazQMClkQNYRiWXcIf|Wu<8DOWZ8Zm&6!^%tnHRVeZ^O94+$qJI1AfvTO
z4B!L~4Omc13^D)+%2?1LZt$=?=)5_T_<~$$*n!e>JSbc;%Sxb&NWr~q&=vzo6FM1u
z1Y|*Ciit63gA3?{0&vq2oaHlfb3t_#czro&kPW=I9x_S`KGQlNA98|WngwVO6ST*b
z0Wuc?Ix!N|yaA<0aN7f9Onh1zXk8e1y=Ht-W^n~LGK(RL;9*5Dcx()`PYksF0jbpq
zI`|pn8|V}dXru?x&IMJh;Gr8(*#*muskxvtOEN)gOTqVXA-YkPMxb>hMc^VfF*zeM
zFBN?HDr`Cjy2uqYF$N9__~;=+SuSYCI32Ru9CX-wUJ7JSGAySXT7tLQf{rdrsbDAt
zXVFaXt<Wh9N$H^Kg(0^%Cp8tcZzQic6|`{%ybufCJpi|FKyyc+GkTMgp!O9M<rfr#
zrqCG*LDeky(tzZYBv{h}l(33Z3qgHsXaZr#EJ)7C2F>@Rm6m{luArm{e!?<jr+Z0$
z38?%p$jt?n0r22YEdd=7RFIQc32v7_YLJ|K2GEQHs11~vAD>(ZzN!K==x71jw2=xr
zz8e&H#i{Y7#-J@V72uhJFelge^2|Jx21!Y7K>=E#01f<thPYq{zJOB&WMMOOQ8P3#
zLw1#e4+8_IDe$Zlxbp?_2(%LqKA96#`GK~yf_Kh=Q%!ulTc{tTJ0H)GSDKR(0ve0T
z%u5djudqk~wUrrCK*Nuq90kdrpkeE@%yfqQqLfTf+X&WL0o9VQ>w+L-X$7G9Cd61j
zC@F$F(!~s*LFSUAoB{^WW+Bkv2Pj2>NB#2)K-~h+^aZ4q51lXt?L>hrJAhmc3o0JL
zM+n4&_dtQxq{FsJgZfLLrc)y1#8QyMp%o3Nw*cv}f^$1$(_nEa<oq^p5m;D~!T>(}
z5j?O}Q4*h$0xDEMlgiL;Ms9vdei3+pu(X&V4|IAds4s%lRsk&^0Ifp>IVm1gUFH`Q
zgYy-*AWAGw&dda@#m-Kx1bY-Tq61x^l>t5vx;WVgTo-{Fn9!hw^ba7nQ-G$I{ruxW
zr;r6h7Z2p6mV;WYpbEm+2y}G^SU-4wB)FsiZ50H^HYh{HCnv#r%4s=?#Tg8l#VMKT
znV{_#B}JecnxMriD1bp@5*XK9A|~q+jlh*?eo;zl5rZ%E`oEC;;N-+S@YZb9MOT@i
zGe)7g2Q(7_+BglmmjZkNP<(N20i@&x1s|e&1sWp-^{2qydFUmwpk?3S{ehr-oSawy
zo!bJXAW$C7W`OPlPf9IeKpg7?Y7fCmf#lp2(2_dvsvK~7fbYTuZ61Tpy@RjIM6Pf^
zxu={V4;1;JRR+bNnd$WS%rr>ZRFt0#YAZqpRiHf_@R1X+Y6#i~fcOo1)(Ar(s5Aw|
zbZK!abbSPLGXc2a14_H#sZ-D#MKPi$i8P*?oE%>cI<~hcHNGGn?52X^pwwc>`b%&^
zK#DK}XwMcj)tYFC-aP^J`6@w|JQS3|HtrzjV{k|@WI_iza#B;kYqN?WO?xC4LFNa+
zQ*xly`bGJmoxtFmzzRyhn{z=Y?5BfwVuDU<D9KL-l~V=a6bfogz+wscbc)nG(BM!m
zq*j8Ia>2g7p23cYgB?NjDyZcQ%21$oX?zJ{r4hJy4)z{w`5AacN<4U@66ioKa03st
zzymZ=1nx(Jode2JkTw@+=&LLhIru>97c%1^Yx5yz{((k>!SysO1wkwUt;5R!T_q1n
zOsSww7ejGQVp%Hu=vHu<m;+ww9-mWCg2)G;O=pm5JB6X39I|r&dgK7ujj-AYc9k(G
zg~C#QNd*I_L79>U?mXtEg4ZX*y1JmFH$X)O_*~VrG>n8$k(vyi^adX}TMSw>mzD=A
zw31Rl7vtn)XXb%T1-0oQdq6>>z=mlS(7m4EXaIHYGeLc0L?0^NqQcOOAp_i3@J_8n
zDk?Hy8;?O59<=lxHhhQJCl8u{&8Py~3*B}LI?Er_!~u72GD|>d7F1Y+j=6^|yhgiT
z53~jrc3K`-X<j-5Xvht8;V1OuPVme&_yil!6kQsqUs09H0J?4je3?oy11OdaDoiYq
zFCK+-hYLze3W`!oN-9CUCeWNHcw)Dh0d!6s`t`Za{=UABelGEjE-vs>UEp1F@H_%!
zo(Wc6gSG~M3mR}k8GH>J^kQ$&xEe!BW?nvMZUo#&fVK;u8$z8SCsBi&Qjo+1K4KEw
zV1jR^2ldRMCl!M0Q_%ML!~(~n)I@M2H$M+tML|~SW)|c?+CZSGyV6XkJ3$@Z4DeZn
z;GQXX-vL8mX<|wNgG)GMZ4hX!Y+i|>kp=ulN6@M086YBuAwIss07Mvq2qO?-3|G(K
z5?-1IIz$}QL(EC7fGmSZ$uCXH0WFLw%K)zc21$UAnqi2KFUuk0Xu5O-T?q0wQqYCr
zwA6~^)B@0zGQ|qIY2fP!GxO4Qb25|Clam#6)36=@7vSlvpqmC-3!9V)x`@U$BQqr>
zHIE@Q*b|)iVg7)7p(M8eG#CvEffPfAP#1`@`1nGQNTDIsJVTQEQGA}4pQj5NT+l@k
z#q=WNocrATl$1;p&?YdD2Z{_C^z`&0C_On@*ATpuL>IP`L?05E`jD1~enFysZe~tS
zrkROeFoQnW#VMIZ5Qe@}sHcyMellpsi7t{+U{(4^0&ufIgS%!Xx;dG7r4_pAd8PUo
z0ub97+?}04J6-%jiQnnM00JBg3=9Gc42%r!jw+1CiG~dJ|NnpZz?jnkp>r!37#MJ<
z$*q8>De=Iqro;oHrm6$CnkuMW_|z;v05NBk0A=Q^5`dVqMuD(7)n{<4sXhZS2cMcX
z3J^8x7vM4H0z^$O0|TSF2m>o9s2LcT7&sup+fK-Ew~I_+;ZRWFP*9r>iZBK?h}4D?
zEDSA-$g(UgjDHw8dl(Rkp{8uO<HDHFzz8#RqXQ3PItrJCi*><#6cJ|5{~+6-25fZU
zU`z&i0%G+>7Y?vI+?gAF6d2PHuHNXQz{bPC*dQ<;MU2T1*~kPQ#(X3r6L>(<2orMz
zP)y7b0GlX+Y+{Z8lL4}c6)Y$wR<MAi5hm84nph*i!o|UWY+enTc^#<cb%4!dfQRA&
zka@^l7A`IpWcMr(Knb)psK%{fVN6B}@*^PA5K(kQfW^Z`1vyTR2(a;3FZjTKY{MB2
z6d#}AfGL3+v`It+Ij%Q}h=9Y91<7Qvm>#Ohn-n-0a}cq!Nr8in2d0DpmI609urPQq
zX0doYVPRR!m<4heIDsO|w=gkgva~SGVP;v(m^q(i4)Yym#!Qww%wR2<5G~LIy(xr+
z;SM8X8cPTB31-GLB->+7urQ`DFhUGxK-eF{!tjELF`4BB(;Ft{{>u3*Z<rdGSti*q
z&Sz<0KETYF%yNMF1PfRIl&4_s+RVekaDtIBhh+lO3}(h023AIx(J+_9urPEmGUl^%
zFuq{q?qr$5#9^SqVW2jj<ppB{Gv8vyOl2f7uvPhBtI(tvK;<d}0|PV6+!ZVgA&faJ
z3z(KLF&WHfS;Djh<oqv8Uzouu1@5!WCs-In*e2O<7^}`_3Aw`vWil|K2f-E@76t>5
zQ3l|MNMKB3Nhn}UWhv-jWK2V(t}Q(%scTD*01FqJ0#X_PDL@MGEi+gcQxOpW;-)dM
zp@zH<V?HF5^D$&NS{TfwIQ~mPq5;lB7`Ryg<Q{n5*(@Ny!o{)xlp3G~4oCq~>9AP_
z#XTS{vaA89JVTgfzynU>0?6hW@Gv6zZ?grec@``vvJRj;gD}qll4nGa&2tbz(Gh@Z
zUI55Ec*(OlL<YGm+Z-YTcApGV*#j0+W?)9n-J4T*kRxGp3J)6(x{?M|pEvM8N^*qT
z8&Lh-f$Gi<RCo5Ey0Zu3P8MW$g2eO|2%xxg4yrrn@PNt+kP<`)tN?{5G8Y^I638a6
z5MeS$4&f~*W!vU093W}95nEQExOK}4h+C0O+_FLjTuZ?NW6K^CBe(29tHrh)K{fLT
z#7yLP+5!?|MvbQ}S5RuQEmwHhcpyp;u6=-N@&ky;97z7(0un<D*)1PXP5yuxvRnRu
zauUL#KahG7InK6##L!IM%7IcDZRKEr#Th)bw#slYrX#ZKRv8X(oFV5bkP@V3!Bz!S
zLlr<Z9Kt*kRP#(A<{{^*ttKeVjI9<d$dwR?i)>p0s(A?<kop{9VFF5YZ%sipEd|xF
zHK?Z5aG=%ZTWe5F`+$=3wxY(=)(%v=P+JmPH=x?J0pxPzmIFuuQu(%Z3#w^bP+fio
zlmZaGJ_Bmka3JNRt!D&~TM1ilpqh3A*)#^j93G@F2XR4-D46LChBHv5XMkI6kXi{+
z$uSsYurN3<X0bRFFov-dJYa-34VYjGHn1?TFy^qZu<$X1+mlSUR<KntD9vYJV1g9?
z3<g^mkX>PL2DvrD0OE#$?1Y>6fUt>AASN=v_55IAU}5cPX<(Yq!otFjaEUTV2+1jb
zz#73#1gHmoE?{A3U}Vf<X<&TA$QaD>g>eE8V=w~)7B!hH4UAV986#P)FizkBH-Q*f
zVV?YV#)NGF1EWX+sBHrE_`e$(FfkTrLz4lA7${zl)qtAM+(>#jp<a4*pMeLP@IwYR
zCRl@m;XebYGXb@lWd-8~Mkt$s6%^3$nxEmn0Ski(!e|x~7sebGA5f#FqJa@1j?^Ro
zYYBl%J!C;v_z*SJ{@buHh%ogqu!wjt=CkCKF!g}sA+0lL;DePg=Cg=MF!eC9NO*{p
zN=;$p_%CIlQYsB*C{AIT57x@a01ux30dP0J4rE}31qZTlFar}iJE~uQEns0#VN76A
zS;ENGz`*feip!rtaX!li<})nF{3|SfSdsa6*gDve_zaxP%n%<yO@{~iuOloB8jJ}n
z8Vi^h^I3YB=ddv5v&>;x!NS(Sz)>$XpJfBf30B5@mJ_TuSYbjt*bcD4*az4?urcPd
zw6J%8iY9Kj@$i;1+*)YZfh<&j#l-7$76lE)3>J+DB$0?EjEos9J<Ky$7&BNlu<QX*
zM_6uvs0S=xK-3?W23E!lmJZe#AZh{Y5)ie9bpwbx!g>Zo9bju_XUu>%R$-REVPS~i
zY+&GQfHV!CFg36saXVNxup)6Mu<c<(aG_p<n)Ew^g&~76h2;V33s(Mq24fXyN<V%<
zX+Fyf))Q=uDWGHn)&$eChlPQMF_nd<g;A(S9Gp%pRC*-948{2@Q$P++WjVt-feni^
z10!<I{(XXlL4h%uWdiFAR;CsfmKUroY~a>AGz<TF04h*nH8R8R7cq><h?MyI1tPeS
zQX;Z&Fuc-b`28aS+yn%B1=@XK_`|`%Ai|i!BBH{W&!VEk+`=@UMaKiFgU|4X!vox3
zg1YGM45WZY82)#QJ;>e2e*2fg!eGGB#lT^pVxTvl#lQl})|}7c-~(mr%|{InkRA)h
zWEKktrWQsP2Op4`4De$1mj;%ixeBGQ|D^*iVPVDMuQ}lQ3C>->z?cA!PLzP?5`gwU
z3&3>@OTh(Dp?ra{g^4kOrG@DVsLz=-pXCbk4Q9qHmK)4}SQsPV0}>2f0xUvYY%Eh)
zc>e$Y|6j_1LqSDeaXtextZ?WOV9~>n#}H5!fEl2K=uR<obL4=EXLz;Q%@GX_7HEWE
zk>+dx1v;pYiHM+X6Mf`Z?XK`aH57yIjn$M2Z?<Mo>4j(#Fo29g8jNA+UZ9Lz-}b1)
z!^(tH2f#rN%|<;cptPUKq7V<Ox=$UM!eS_cWOR>80%HWi4?QLUpsEoTs67V3;I;_Z
zP<S~7F`dy@f`vhzF^44}nK6gu0P|~R#vGO>9B()nb68pww<v<TxeK(8XfcMeT+wRL
zVGLz?q0^(w7z!?EphiSKU}4ba<YMlb!oravH=kt<({?5V7asYHISLt!(cp9p)tI9I
zDj-5xcruWj%NSsz4-OZIbD>IoC$KQAVPXtp>0#+$WejJz!}^~U<Y4v-?2O=M30O5$
zv3CXw!v$u>NR|i89j1(tEOShI%ornC4w$VlXN*L2&{H=!FouG|1FA3J2nz!T3zrAO
zd=?HB#w>V%G6tMbU`zzrzzC~H7=ysElEb2KfmN{nzkEGIJ%fR+1_Ps*u#MV$mKE#`
z9GJo&6Bw950Lh#wEDX+!DJ*jsZ$m~$7BGPaD>g8}Qp1!REE|{}u)w(wSaz^YU`KGl
zrZO-wFtH+;ngOaslUYjoL53b-Is+Q=xWaUYi7|!c4pR>+T=xr>Cv1BVhP?ns57<N`
z!#Y6G6wboqpi<5tq}%`lj4cdeB1l|__vf=XEMQ~|XPLru0_2kuOm7fQzrb>YZ4Sb=
z3*f+KWME(djj=F+0JzkLMn_Nw3j=8QkA=mbwV44lD$~H&!pII{Dl^V!X<?ke$T@Kb
zBb%`*h&zFC0V6oIGCpTyZ2>Ev!?XrG<g<op4-=E&e3m^-XPB6b=Chn(dc(qGJRj^B
zCSybq!Wg6@zy+z-7`KB*YCs_YbIl1B1`h6C21v=JEHIyigP*&r0KuKWxSWwOnSqI!
z8B}s2f-hJCRC9*2WaMy^Gl1NyG@m7>g0qK#4a%vw!^{}YvW2yWjWL{o3869M1q%ZY
z%sm?z=CeFu+{1*#2etQ5RkI+;vao>aUXT{XR0dFE2<i{8sf@{B!@!j!10yIJkYpiY
z&I2k482^CM&l08$OpG}UEU1?8uyD6<KpX{TF|a^J-k6ve8JU<sX2M&rj37&4#^$p;
z0X5<CSw4VF&u96=*aJ!^Jxo1J?EMUeDu#;lS$deJFtPVQIa8RHfE0jTk<YS$X%EOT
zOrStUSP=RImR2NK9oiXW=Cer1usVVnCJqo0XmG)EFtVG{Se`JhU}8*zn4Si2IxvQO
z$v_HIM2Qfppbjde7(x9HXwZdD0Oh%SmN$$I%-~_V4rZ4A74@Lx1xiL>4DARpg4A+=
zQY(iIV-Cw3#t)!i{=xVK<j*fm4WLof2IdaXI4KKQAKcO55-bb?%v@|HECLct{VXgJ
z2Ur-xSpKkri$Tad21o<cNg&lzz*%4l(+eiXRF)S^KR{OeVA{dLn9A~pbp<<8QwK?7
zgboXX3u8WuOA1pP14~K)V?Ikk35Z!S0W?HAfpH2WQyWM<++h(nSQsi8Gg$U8-C<_T
zfW|&T_6rMx0w@bA#4u*DEC4wsi)9aJxHt=%`=KrdSzN&1#?Z_lv%-KQVugY93WoVC
z1to&0LZA#^@`4dvA;d*UB$BBSj43QJFBln9SY9wLVd7|E=weVZlmU$guVG?LV0pp3
zfdwJh!rH-#;7tKFxD!~mu<l`nH;a%=X5jB(fRq|c7Z%8X$|(j8B%u{xp_Bq7A+RcN
z7(tDRiU9RWa#=JYnA)Ma2$8lUb66N`81q?de8B06<qv2CJ(*<&^8#j;W>5lSfQBJ#
z=o@NiWCW;VXE2{d#7Ddz=E7++*pNfkCqNRr6exrPVq{PxIU*2RLGm#P_~lD#81q>s
zFs}e*hc(Pwn4zr@P!R`D83;#$a)M6{Xoi4!0jL$S1f(MeRH}d@6zZwy87vGkywKp@
zU%_S}GoM99hcTaJ3rh>A-!=ynSD<+}1_lNe7G`FomNp|;FEl$dorY)(XW7DXhXvH4
zV0pm8T+T9|<pE0vD|0!=e3lN@39QWJJo8y5fXobs_R3-INMK<I0p;K+taDgddm!}<
z>mF9_eugPbT>t+|8LQ5R>R^O+A{e7#dO}hdQ&`@x9ARZlVL8KkhZWp$fCot|Xq1Gn
zUuz1Zp$y1iBNfH@EG!Zt5D|p=AaO+ND)xs9sHMt`NH-ww>cDFH{S_=*SeC#m{{0mU
zkd8OZJ8xJREYO10!htcA<pRqTPR39~!51&_fsrvBIY#0<K+S_376}8!9E5Y?Y`Ep2
zv2;rTHkZl~AqN$^wn1q=IBKEx#|N-5urv1@U|?a-VGIS!z{3M9$C%8*9wE}eV5HK(
zpkxB;eO{iRG@m6RhZinh2=3(|!XU1Kg+ZJ#mBj(pr-RxD68B&XXYq&t730vBGGp8f
z3#2XsWBh>#6t5qM0A+ue;`jp|;QAWUzhF#|2mv*V8Iic*3`nt&Py?!=N;z0qc$iB;
zLxpgaQ|>T9+o24MQ0FCrhU;J{_1cE{EG!C)`790&jQQY(Hv=ndgb1!9VF##$HJHy*
zP{EkPvV(C4s7Bercz}_;r=g*tvtT~U0mcvD2GR${DWE!F3eyZG=Kd25EIXKXfGSjQ
z%L|rLL8euJ%Ik^)U_A#Ie=vf^x)_*Y!-b476+VoiP|qeYFo1l(#KZ*agEGb}VPRlE
z_5p(eV;IXFt~*?i_BxWvDJ%>Ej5#a<28{VEZ@AuYK|Ki#ili?r3^6c+Zh6dS*}(XL
z5s42D5Ugq)(9}ABdQ6~{3ss#g!NOp{n8VV;xB?Vd8yL?pf+i*ri3e;oECU^=0Nae<
zB3qoi2NbzI8lcGS(E!abAlnnb!e9W?cguri3gZ&^sNF3OmOG3ekhmay2p1&(KpOeG
z<-p<rAIP}nz|zCA0N%8|<-ouQOHgSNQ+Plli84PyZ6s(E!31UbAoUA04ALZ67-ASB
zStc<4U}TI$wLA+vev`vev4W8?f@KdV*+eifz-_VlzzvFYgk!U9SQzA)OFuBO*fcYO
zXyg!rN`8S#eqlt;8&Js~P{|+Q7AY((rX_%eULsjMHh^3RZd`-C0P{ft3j?GnmB1Lx
zlCS}kPFXfE9smszKVja%!WaxK=|G+X=?2kAdL<Ymz(p5}fdykei-iYc4vWVUkcUA7
zvWyWBqw-mvF!z8)3a7Aa0F9Ke!3u%21P)lt9;g8M7tuyeD_~);KuEGIVB7$Y=K~ci
zSD078WA8u(qF0&`!^2a~z+s`nVWGy6E(01IftQ3C8K7j=4^C$N&}0VnN=6Sz3XuXq
zK?s$~oWR1M%$Uid6V8|kZghYet>Cr-thmYG01X($v#>~jDr``8$Y%k0pSiz&KFa~7
zH=y$33lpe4%CZGgE5p}1WXTvX)q~;#n$FUvDDZGGAAk+efSk_=vj*f433%2G0F9s_
z@fesGP*sAQ?7^4`aw*(|1uP7pp$Qoa#vD+49z|{f3j+^Qc=Lb@6$vB}9S;PDftiH`
zmcla6urM$%^=Pm#a4>^%FCv97RCBN}NHb=!NGE`YyFfBfT~Mh^h!l8L1tbU<s#OHQ
zl?o`BAyL3kZ31yOhX8X={d^Vy1&{)yrU_U917ju&g8*wMgP{so3CQOl3!!G%MzApG
zFlMpnoB<{6GmKXdvpg^-fs`0CX0jNA<-l%2Gr*WJgT?p&BV!oL0f+$^kU|k=#}rUP
z$YEg#XUu1S582yBuyA)OAfgmL#Adr916)BOEMas%0V-6pSS&s;F$S}IVA{b32{?Fy
zasRUg)PMjDlS3?J^a^2NkYUVck*NWN3M^-NNK9d7jDVz9P&o#&1B{`%Jl4SSeF|eF
zOG-1S2ybTW0L}Y!F!q3Jtsce~ppl3djP0NV+|JYiYUeFrxxxajw;36jz%c+a6lUfY
zP-z&>5>vul?f@ELc)-X~44SNZz&L}6rT75je3ltZ=Rp$(=b2hqc*|go>bD=1=CjOT
zIfEtyG8v9xRv54_ASrtd(#fLFn8Tv)fG`g%>JZMD!xG-XiY7dV^#Ym@qU`W6_`@V#
z0bPs6#RP9{fy`rI2bZ|;vIG=SDIA9L=Q1+Pm1h8rPQckY(;1oaKd`J|+z+A=Z9iz#
zfioS%U+@3~aiKmmnE@K_$YROp;9v}9>EM{a0Zsud6F{Si!7Oh$mT*D@mT-3PfmHA<
z;D-n-;9n!a7|gOp;D-Q2;D^8t3C3WS9TF3yAp#SmH>iQf3PE`bWG8Nn<eFl}OqSvf
z4#sepYcl7vOyKwc68HddP3C--C7dl>jNvRTTx+<%bA~KyxZVgchO@j8Iw1@ZI3c`2
zk};fRgJh2sM4(4%gA_<W3hX?Pq0%el8N*pt$j?!LsF<U$K>?&fVSyq<V1eQWHE8o0
z+37IH-eF-l!w4E{WqQEG7|Qa1=?4=_X#?YYmKV%#m>EM^-Y_??FqbmTXL$qa?S!(l
zuufrRE)}28(!zFu4Yf8lxx>Ps!qjEJqN2}KYyi$jP+QFBfI9cVEDxk#NHYe5QUwze
zv;<)U$yqZM8?Zc(ejv@516Bjl4jP6)(r(REtO1qNKqNo&Hx3Z<;HJG{VbB1XrU7cX
zBAWq`&|uMU0CgHbg#k>Dg$@ft31cuzO$(@)>tQ^?2#Iiba6z460h$zL%waLf23b(i
z0LuRzpmB*}1C}X_GeF!KjB^-4jt6@lZoUZ%Lk?pYOGyo57)uM|9!AD6h&-|a8OBhM
zf>4$TAO(=oZg|eI_yB5<1he=AFb1<kTtT=G=CUu42Cat=V-8D5GGh*!`C#cV77riB
zFqV)D5c?rj2cxAAH)z}$(TK2&U}2D8%wbVbK`t9DH;6EXL+d|eOIf&>BIdJr_(158
z3yfd}A_GH=2MxADby*%^VVD6bs24EZU}g*kHDF-D0F?@70ZT!8e4sdh>AV06#!!}=
z1@K1Av;`~+Kx28KEK``yFhf%#NDDmVEHAJy6o8^@0poR0%z(%KK>R684a^|AgZVIs
z2Dt-Tv>;grUfVDOH2yS$aRDQ9f5m)=ePIy$!ayk*?)nQX3_YOv0<crSGX#wAez=th
zXhtQ6ML~hNr(!;ff(<AQf*cCA6KbQC1+0FN5rU8JOk2Pv;{YDdkwFvnfQagdpr{3j
zf<{VoEU=h?$T+S)D!>^BnhIQhfC35XAgFWPY*-k0(1(y%L_{!!WRQfwV^5$leME|~
zo&&1lgIQP_Anga1DU5R<ERcnW*1YusP|GKWMaKk`$pTmxGiE6pfQwzIi$Dr$7=u|R
zfHE5->40hmBw1<LfWou|Y|0h$S#(U$1Wa7e1YBxR1rR~x*3!WQ4kM5&p?0{nurSnv
zlMUkyaB_OV*uezK@US%qj9^_Tb38T{kisvg25cHM#BD6(QS^cNppp%qbZtCX7)%&L
zSz<uL6G(2bi2#lI=CJt0fHNp|^`P<%>SpIDpjKQkiwVenkU4N2&NDz`fXOTdCXC4}
zCg2nR(uXP!Dt8S)BV{%POvM`DaT1upAni=X^H~fkKyw;MncQXzs5}a05r_d-qR5)S
zQlJnNkY~&U4_84=gGy+y2*fZ3BVxhkh6OXn0Z9KAs?t_~h2agT2>BzjK@@vYZ7Tu^
zBb6MGRXHu7vblwE1vtviFkJyP&VGn27X`%t$j2~)MZhbKLs@=^tPw?TX4;ytF!(Sg
zv!qO5WK3qcA<`}i9=L&LaoY``GCGIlj_?;@aKs>m2Uw1&hXX7LqQ3}ti-5aE(A40*
zhlQzF08(nhdLD2KYryv15CJbF2X%aq61}Yh$ku!o5fv8D$UjR&24fCOMgdFDiu(C1
zXGG43K*krq(_NrJTX@`pOy>cOCi2MO9IBO3z%x{<V1R!p)&{h47(9*-8k7aaG}sZa
zpf+J)pr!SQ8pzH-13U^04QV?A4W?31y8y<wkpY**Fm6o)qIQJ`mR$pA2|_-LM+hi6
zg+wssvqXSW79yG2HGsMjpeRRZ`oqEi8X%~d0cut(0gaCZgL49^3Xq94Gr%cx3FCSY
z4GJqnsb~i_CZ7dlOg;-p3F>H-{T9%gE^w*10pxU$-=KjEkpfu&nkfV&cF-UmiX^!A
zy_^x%NQV?qO&iRTa|E)s0#azeDmsT8Xx>TznVeD%EvG?>phi11urRD(WQ<~20-BMH
z0w-&j)CU%Z1t6&{j60YZqrep?vd#}I3<0228L$8pXj?#~tigPi8;l!3MKLI=!UNAy
z0aRNW&S&8O)zT{%JD3>5;2lUthYt#jQHZf&M-2^FM|?kMs}smdgh@G|(kh1~CV?@B
zWd>|4Vh<xv4+HlP1}O(0@QM+T<xo#JMu5i1YM{NI`JiR^oNyikBMUSwIWA!Uy8&*I
zlMHCYq!>IPTg(BPrh}?<(f~C*5p#e}8lV<2A`Lr5fEsD=4y{v*2n!eE7f_)HGhodN
zP~3wnONifKvE{S@)H}{$u?PUg7I>5@2iy~9>StiN!gvQ%GTvc)0#0|30a=7|H-H9s
zi#1pj7J!;S8$e4O^I5Kd6@zLjnB7luAjt>O+;Mus!XU#`tiU3Z!kEL7Qp4PXyq?(U
zMFn`*0^A}O0gxMmSsXy6I;!(sL?D%*%^XngWC>^*52bR2$cM4myZ}W%sBnbFkxK@s
z*2`hJz<8gLsTi~k3}i4&(g8F$63!w}0_vfG1|mVNO{jldJwSsg@W6I$u|cl4U0b9<
z83`$uxwfz{NP}ugX&c5+L<$5e1lbESb^)rfH$+g3y&(cJ7UV``3~?`mjsU2X&tehL
z0oSK2ItGkcECw#jU5xWtTqZy=Da!=rDWC;VQ<&E<vvh%aaBG;aKsv%;6Cp-1nmDj9
zXftN9XorA}LZmU11RYSl3ma@TNzmaeg)TjS4A_87ff{0*!NOq8n8jkf1Jrfg!FU4F
zoMSn`c!LpIZ^Bg0VPWWD<Sd4n1R08kbCHV%<2j)9wwz_CO5t2k+`<yI@c~eWKb)nY
z0X(q7#00A|jbE@ZFmRW0z(<b26Gb4G!?jv~8kt!v(vYA;k%Eo9A*7I-=Y|?kPoDt|
z@xVvJK$(ac-ob`?+b{-HC?ol00pkxwB<>Za70d`Oawvdw&Oi>Z1&k}05#fjIUc&}Z
zF&)ZM(*o-HFu>Qfg4MwMt7`$uKv^s%;5E!|7!NRk<DKOI(;imFV3s|sQy{}-EK}Ha
zu!BZE*w3&-RGeY|z>d_qg8EE1hlSw@C;)nxu7DPi>|mY1#u&~rgMAM>V>kmNJ3HLs
z98gqrNgzc9J9jaH3toteWGDl77Z0jh1Q+5XM4hNx!NLIQ#<DapZ2+xCxWf8`4YX2=
zeFJQ57Sv$<AE3@`Fv|~6FA=oj5~&o|1FxqF2Cc0uuAk4+z%qe_xwsyl){&!LPlkm7
zDLa6AD4{GfKm!G#EFCOMSQtZDmawc~VJ>By&$5E$0Shz_z?}_ez?|j4!jQo}nIn8M
z$7BhXi~=4AlPPyH(_|4)s)h-Kfdv{ECorOlOkkYD2-iP{aSNLC7RDWnypuU53QXph
z%mguG2jc}sKA6x%DX_VFnC37eOkv)@jB3dS=G`EX9FQSdAPrz|z`Ouz;&Z|lC(UOO
z5a%nGnZnY{APrfc1Pe!qa)$36pb^(B78wi1U=|A(a0){*j^Voo3xhpl7K=T!#{geg
z`(1+tb#x!B3rs+b{sv3o9*n^(9syvZSpp&$vsfZNfGb7NC_gk+GJJ~x)%9U4Ith$n
zED4~IFBGHZurLTS=CFvEgIn;BlAGZ>XdeT-smJgwg#$EV0@ep2pw9UI0o29MVo~@3
zDieP&wlIN{LkrUyP|dZ6=?G}b6{H@7k@VOzX0q6CVPcvnz_JCjYOGIy1*Dj1B4`UV
zsHG3<VKDsAU|}d=3<fnfKx-wLT0niE7N#E1Tq?*=SbfUy!-R$510(lDL<VB{!1#la
zyAMg=2V(;hvI=k+1ZzJ)od+_f2Gkm>SpyosU&FYAk-4mXKFbcqCm{Y4P{o<U0x}7-
z4gll?n8pZDC6mKq0~%|CkKO+`0h-8yO&T)%_`<?8k%s}aZVReSJA#D)v^kf>#RnAr
z%*?P@(~1DC^vVKNC6Gnm;I0I0CYnL3fQ3N>XD>!X1WzwUL`D)Ze1g1C1vG|YkpkMD
z0BYSJ`AzEuD2-&X2t$@5gJj?Z6NA<taD~Id1De*d01ZJx<-w&1Jc3p<fZ88fEF9aJ
z7_(TmGksxVU(A@r`A=#-%NNj6n=F<Y%uATzVoR8Jurg+`>|i~@3KIhx3k|lFOF%Bl
zVF@Szg&M*!D|bL*p@F#tw5|)R1sbA^IzK?oqbwF3@Z^mRIMX270=gW^j2TE=9(m+F
zV!8s-$h#tSMa02Nx*)lQQCC8kF$LPLhdNLbw5$-6j(9{Eb3kinKzoisX$>l0@d4DM
z$YfD5VCiI#pU+}o0v@`C&o47ne9-}?Flgfh#D`=-XuZ!+0b1?Fn8~7`12zGnvr+=G
zrwAVOY8jxVO<629A0QPWBvcTA29eKXu>loCne$m<K>3#C2oqR2e0~e03+i}?h71;)
z5KtBliDBv!V2No5?XPHO`~b?<AhlqOq9L8d#)C18#RFtb`h1p{4@{6%3SgCJu1y0Q
z&cgySoCj=p8Vkg59&omW84OxXEYQQikpNrsvR6ZCJ`0Do40H+1UIp+@2vm8fg&+!M
z&Id>$1`RN=<bc;lF)jf06ZU{+w?Hd%;O?6$08K{F5*@MngaIUF0g7}B7jUwKBoBtE
zG902^&?cS{Y*EeL32aL6&Kkp18E|aFs{jz+5Ybx#$uo2Kpa|eH6XYuphWgCz0Vttm
zv8co_2D8MZfKxq73Z(0VNCF^L;B4^%)U1WZIn)IE3E(~v6N>_9$vBdCrz~J$hyi&w
z1}zs(xx&K04jS`eHvz5Iflf9uOnD#!O44vog80auobo`1nZp6elT#kZfSVQ2a8wI`
zBy0p1yjlj~i^&H-WlRo>j4^WXPyT|!ozem7l)yJbOr8MRWscY!F?oUk3s<QDXi6Pw
z&*TXP%$yU@1sV`tQHCiwGHg8mt}uY7d7-+d)PVZ0pooB{oM{5kb~tE=Bq0YJ72r|>
z8qgqlNO<NTyMLMv$iX0!VCsBW7)02M8H`l=8I)K=K!b|#3TIjf54f0sx?)-g4>N}X
zl2fN8a5H8i(%rNK9wrBn*Wiwvx`TxQv>SuP2YJyJ!_+e%M}V4=2$g487({qr`AmaN
znS(_{0+lae&eYF=unl4e@`w?`R5A>)VCHOqw6&lCGNA#qy&{W6eg-J@LXT@ek;{b2
zWkS}&!TkWz2^oCJ0Ij|S&3ho6JK+lpTMOF$k_ihyX^;`NhiAea@J?Vj_W=W_n-AxH
z0M-7m#as*%zA%8Qa!^bn((FVD76yIBEEfF@OiU9wST->2U}EayVA;X+1H{LsHj_nv
z1*m<s0yJ+4I(q_~hTvWT890Lplr3j~*PKC&GJts;WFj<ZKq}9G=kU*fS~uY=PZ(!_
zwlM4f4LO8EmN6%TN9K?;K#T@E&tN`ub_`@D2qP(jnfn7&h=Q6+pvBruGeD!zJD5&@
zop%B<C=FRH4X=3_CW6Xfa2bzmqz?-N4|3Y#Vc`)#<qPOA_4Bak%wR+j22FB-%z-un
z7$y>JP!F0x@GLfo1+)zg-lm(B0b2cpR4h)7fG%1MNkGoVQ*%H$2;>%MFiq_NtsL%W
zLCe8Yr=aBEsZ)5sg(AGvoVoxd2Txr9kq3>=Fo5?2K#iZE0Bu<cfR^96fOfOGxG?vC
zhEKwodqBq=z>}#1$U}%^>cRjnLf|Q?zXIBkSpv;oNS+1B%>bvN8H`InEBoN??0*2-
z;|1Au0(DY9XaOI0e?!Ci&H@`%WtRCYEIbG<^L!Q_3GV)e1rS+gNES!9Vg_g=v4??$
zMFqB=X|Dzwi%L0Y@e<4{{Yy}CT>lCNM$j^4XldBL2jo%MFc(Ar9u{!nh!D5}&fKv2
zs{aZHlhJ$zCb;2uPz`?oG8~>P`hTFrTmKJ8yuia_0t;xHbQV%sJb?uzCMU2!bihrt
znUDdF2&n6ACLCa71T9yB@#n;VixU`k!3NOI7<k1Nvj9>lae#_<sG67s;2Iby5!%0i
zRGBKEb;TfYcz91b1Cj}4(a2#8Wyv`JTJeX-q>}}t!87hqb0=GXs#v(ylP1`JDtcr-
z8xI3_;RYn9OqyT=FUCRkLX$|}0?_<i7K_FSMo@8hg7E?)s5ra;8Wo=i*?NJb(tt6O
z#oz`gRc1m`3zA$7V+KnNSPon*quEizn9fpj0Mu<gzz9~94vH9LMSEBn=72oS0vc;z
z%wgHWxCg{Vgh9UnIJLkU=>0Be<v`ya&<JKGiwI~{8`OR9(0%H_!Vtii#S*ZE735FQ
zt_P+*i2u;kWU>S-0d2-x!n%hQ+DCvT(5Exjuz=Q+vLdwfurSPEVT@r}z;c9zF$O*~
z%kb2Jg{hMRT2mmD&tPE?W-4c3k<ej`Wzn$!F)h}xFvdc*E5QoQXACS1JD3<_SavW?
zU}lVAS;KsUnK1^dnplXMScsZfl*u0kkU1hu6$~sQ#>_PgY%In*5Ca6zn0v;;!ob5(
z#!w5{H^L*pR?ASvpfsOFK%cV)!~tz50YwwcZO>g;7}S|+7+5kI7@2CoGKk6*B+0`V
z%EBYSTv{`qB?EO@nE@ni!x#(F$`}jQ3UviUA`C16TGjwf=FdZP!0lOh_<__3AX$#m
zv;j$?TMjR3p0AN$G6SVqn9*w_K(2?E7SGp6a8zhaVFc}#N3=+uPY_|Q(LmNV1yZTN
zOql^XRs}XO&+vQ+2Pk=feFk^4DhG7XCW5)NU_MJk40BJxe3qCMNPR<SD5%PSrU1iO
zJXXL)xDke^fVz~S;L#2ihaaHjH6UAH8XH&`3>br1ToxcSBDD5^%9R`z4t<s$P|w#R
z0JJeS2FwAOfr!2R7N9wjEEbCyprMx;jB^l91dlC1Z38I_X3S&>{sAsBK#dJhk<q|3
z2eSnQQJcXMd<QfkcL!o5ynKMW5uz-eCHM(wjq(%529V9^^I1S<g7*MJ9E#$AG?rlK
zLP)UcG^lFOEDK0AirQ3`;093H(*SWmDkw%V6s52PKL9PXd;n3Dg05%+cv>--WdUgV
zE{A0WXlyo^fd!lfVYb}?^;L6NKpiyDo`qy^0RWSH!otAA+#E5VC8PjEftyOma*W9=
zAqC(We`xaB{{wRF8zP*3fF>l14Olo(lHmac7SQ<?ARob%s>}dIdnOBq2y<t}d=?Q<
z_a_snucxxb2Q+659_4~MLS+HyP_aywkO-zu29}5vQ02#rFmMS-7BYp2>@AQk@F6Tb
zOkGHQ50xLFqa@&UtI7o)Mo?%#eFoy@!zUvdK-?5Wwo|zy0orp4D|SI#q<UE8fe0f=
zF~Vh_we+9{xCm$gHNwgq6-K1>zA6b8AO|9~rBuMH%MlCD;e~~Yj{tLj1StMt&h>#D
zd;<z$Xkd9VurT;AX0iBy_YtgMyaTE%pj{y}Wg3i`EE-EdNoxt?5lH39a)j{?D^ghj
z_lsu=sI&-XQ2_1ZNjL$Tp}xR41G2>T2WW{eve{Qa-LM?UerQBJ>6Ic6Y6r7`TBuOR
zdd&gNQRJ{loB-v57mNoW^#HO8(3u*bm46kC!7MW%3ke{-PmqOh=Xq<eFz_=~GO+N=
zFvhURD1gQ|Y8Yd{>l$-dS{T=WN5c_CiZ^Jz8R%S>c#xA|5$Zhyv}OdwV7DF6Hm?U`
zD2qoADF1^46B+^T8sNp{Faz8ZQoz$jFxd?t^FSF9>R%Nd76uN^9tI0l(5AKdEF2Qt
zT?|v0pj>b-3Rxu=XhWJm<S-Eq2_BGAV^s(raeR-84g*sc0|N^i)KVxP#TPXKP+v5F
z*0nY;L+4GwYM>T^l;|^Nvgm{5z|9n>fi)pdz@Z0g{?<%M0I%YNNmt0QaDmQ3gD2CP
z3Ss8r4n_tBW~h={3m?$@DlC+06(m?39FUHFWT;h;fDQpdUE_NK+WZ5xnZN-Kk7|&V
z0AnVL07xnmsU_)qf(H~3AWuO}@c|F6X0fP%TXv|%faG`>Gg)}Ra>(ZRd|*K{Cqn}?
zbCSg(paB`HL9zlQ1vUmGl?iS;!UkqRQUZ)wECMnRT}-eRVul8|^^MGD<7sGMV3^Oq
zf~*F*g$nAKo(VV|0g}Su2#^$3NAyfUbwtku88)7V78FN-)Sx=TaRR6q$YN1|%r$`m
z0@eTnNr4>!k^+YWH1-`QK*AHg?wKJn1Jt0%V)0l3nZF0`sD*kHB9{r3LpCQe18fc>
zc*{FX^#;&p5`+0H3@I$73+m^yq@=KvE(FhHLT!)Saso8G3~x|H?NDIj`FHUE(z&P%
zQ9Be^xE#<#KwUnt|6m>rQUEPx%wlo5!U!7f1}z|A>VwQwL0tn;k;&q62U41XMlawi
zLl}Y*Kpj_u`7A6REX5$VdibyuqqsFF!yG*K0J0Wpr2h?26Do_v-~p(}eZUAFmqks<
zASE`8nJhM7IdENyG{F$yz`{_#F_EE^K}nedv|*8ZF=M8&)I<okqJa^@?*sEeB@l9x
z3Zxl4D<vQS-kl@?-Z`QJVuSn!3z>ib76u;HesO!1`7As#to>s4DxgXV*&80vbd$pv
z%#zas3Lc0jkZtq#U|~>a%w$mq_cTkuog9{u9$4EE79s^K3<7LD;PE&XpJ*rxWEY}%
z_tOA1OS4#Pz{{;?FfD+W+wfupqy$_6g5}Ud&94V^Ob|TO47Nan2^wsmJ|IfCfwsDV
zswJo!LE16HEf^eb@OFUTfeN-#us0ABtci1a;M*<ZZ-5Fn@Y)YpKqt<DjpgVwX0Z4K
zFn2J{X9*}~pC~hhMVS#C=7{uG*#TYtfYOCV4JeQrYsO3#YtYJkmOYFYKrsU@{6XrV
zzJVypV6lewlfjDMjb#)?>ELxS;Vhsjcb3JB=^!UTGh*e54p21$&xln99N@YVWDz`8
z(iTA79KsmP5(1ha%9_s-GY6!RffaI!Ez~}cN)^UT7L^cCzZo<=!~s&s1RWdznTn*+
zgfWA~1Y}&se3qDO#tfEh@G|TS*k~wB=@Dods{)#;2Q3pvGAAB9M3TkA0bf3ZCaDA3
zLubx3k%z?`qy!p_P@_S*%^5QwQs{xF+yOaJ&?SK}izTIp5j@-jG984W27uHUFy^or
zIKY<k-I~DS0$R710@{RJ(F5NaaBBhs19TxCgYppuXzha`0<W)?|A0oU;G;AUF34th
zv?QMZZS2lunZvSxg)x(51Iuw1P$L{xp(jBOgJgxqbkYUTGG=%>PkI4vBf)C6WFPQE
z3;ZCzWE}+-2QQWR49Fs&9kqu(GoXmEOnkzCs)}Xe0}PQ94D%T{!4(QpeoU?b4Y3-`
zXPLqXJE3Da6MGi}q!sptse>8ROh3Z>0(5K&R6D}+*ffI@-Ez?QIAkq8$SzQbLE|dL
z0Ms8cn9stI0a{nYcmg~!dIGeHFqmZm=zySLmMctKn30yjF{HAHu<`u=1FC@GQIX0b
z!s1}30xAcfVVlY#f>ALk-2kn&&16ZK0vcooZPx%dY9R|K;NDOMFQm(15s6Xjk_1nN
zI;eC(&WH0*QS5@9F{s!DJ!Eh`OF{zCDj`d+iBt{>C|HT6ECK4h<%1S)gU$nmFMCi9
zf%FVyKwEJb;TxeDlod=EGofLjT)+TIg>0Z>o8jKv20Jos4rqzU9Hu3ZqMv06(+%(u
zmWWDXTLcTk9#HS+4&wwK@KIF=Ln5GC!@yFZpdFE*iV9J-Zp#3z$_Qs+P+=`+a8R7j
zqB4V#wVc68aX!l##y3n*<{PF7%&g@M&WcFI;I;>#(L#9U*zN;4mke(8_6?vSD2GMG
z85W7KpxWUAnVarlT@E^p>k8`=R=5(l_HE!Dp%E-OCqN?>Cm4H}8KYQQI662Ok=G(K
z>;ND9n8Tuy3|e~+cg>C!(Tu5}9W2OEv||P66dVrU`78n=%pC6XSws#nF-Ea;u<l@m
z8j6<Eb~dmu*nkcuX0Zui3}e~Ae1sXyI|3Rm3}ZRMe1aLgmgWZY1F!^WzyTDzh^RrB
z5D>#;GM^<T1+>=!ZV+4}GXnz)sI3F{K1ibk*fI(5QpF9-8$c`dHZX5tW-hOv&vJyh
z1=LxEPulD_;K9rR9!O(=HQRT9CXZPrcCgK7;qZVA@*qp`Fov`6crZ@{52u4X4$bl)
zZID&{60AK8hN|;fBve>?>I_xqGcdvm#vNxEn99u<n9=xf*X-ml02>V3_Rp}BM~8Xh
z3PuLh^OqQQ@_>pL`}r&!GN45z3gB(d3OdYfpoTB3o3`_X3S$(ao4E6Z3Nz<>PzME?
zdm!@g>Uif170_5cG9NtO1S#2|p4>f$g@K2+pTR=aUkX%qnrhBx;Zfi(2lrtSLJGnB
z6FETLTDTBmRm$!y4(K7idkYH#3nau@93cHbScrq9Ks!e{9KZns8YF>76j%;aZgYr0
zLtI1wJ;ZnKK@D*zA0FbnzvzGshKKm>9~#&~d^hNn7$$qr$uNvLED|!{5SP&ahdA7@
zZ683#FT%Oo_ppHT2Q<95|4{+05{1>7+yAIAb1p<G*|+~uU<93E0#~j8iVt{Iu>Fq$
zBtBsE=&pbgkOFw#-4!4W>O3GxgVszSahZ#mkjkN5D?not%y9V#7Zxr?hWQN0A|UfY
zqZjZX-xUEmvu|Pt%X}6NVa6;LVHXw<2QfmnD?*qtg8|;N-4)>ias<rJy9z+(c){Bp
zyY9#!2hgrNGR&NBkV0hF9SQI@322Dyx+4K{5IjV7-H`x?2)L|*6_On<pku`gK*j$8
zCgkC4cqsu=<j$DM;ywd3e?9}E2-I8ymqO6A-U;f|Fy^rEsI&DjaK4k8&r&fRG_eUP
zZ(vF+Kx=V94L<O^R38r_nRnK(fL8cH+y=LJ_6*SZgIO%jG2qQ@;FcLn&JW0_7fdaP
zhFSnopUL9v0vbh!43)CvY+wYn!5FWAYPQVzELT9=mor(w+n2%10FVrrQvf=RB8MfT
z1X5LiJ;(q$G!LW*7HD%cSQr%8Crd<3=9tXEqF}%?S)ziWm_cbim~Y_DK3M{^5|)F-
zy#Q6Jpnz|(L@`4Jc#;OJxB#>s7g;x`tAwuT2;&7txOEp8A26briWo7RqXSxQ4en`z
zoeLfm2C<;QGe-wBtQE#06Tnf-V5tJ09}0+JD+8T2HlHOX2O*l1!%<uhRgtrS5h1aG
zaR(zp>Hz3enlP3#jCT-9K=vVOra22hJ<DJg8yC=mX;8BTv0;y4&H_*thNtg23l!iM
zA-Z^T7AUZAF@fgYkxcaf%>o9q1Vn&Lg?bp~$qE(*7PvVqECMk931Bt70@Vo>Fv~bO
z!5)DcI;#NE;c#dGZQE^NngU8oS@T)Ir~iRwx<HDN)XFesvdH`at$qK)2yRh9I?S*H
zG;0M5!xd12;|}PsLD1o-@FYKL0}I0u(C98`^9-mkfS&}yFdMwIH3u{`0c!gpw4j*=
zDuQ5c*#Mf21?|}ftyBqRU;=v!Ns@sv3#=jxyjh1a3{-W(T?x?~4weFsE`VAOh*$tQ
z6||7rX98%f1?*nXx_M~vGn)g{aD$yi!!T<D2V*D$G8a@hA@kvd6V!Rr9<VS>0G;1E
zfpG$4p8+V4VUB~!X0kwKLB$cmX&~7Q#tfDWuuf?A5y{-yjEw0lvmxe!JKZ3ok>n*9
z(^w>CGcva^&W9;W162kfWiSj?KBELuWH^9Uia<{KSira+)U&w5*bG{?)5G)xlxY4i
z%?2;61)n|%(`&)Pz`$CjG=*_Kr1}1a`3o~!*&&80;K2!KNY04Z0qSod^7(WZ7OoBk
zQ<Y{0MN@EF8J-lT*FYT806Ok7hXHidC9+i<Wy;{5%zPG*MVw`a86aFFqa`k|frlBO
zc2AdqjQAsLP+(y=1M<%g)&*?f#s^HL3g}oCP~bpqoDMqZnYrr%0}IOz(D4sQ6~Xiy
zEDRG^K@|b`%xvU}V3rQNB7mCHu>n+Sf%XG{%YTp!utWfoQUI;xwSXi~upF`^=zMY(
zZI+IPy7?^HAVsK20i<7>F&!e6J|B7(6Oz3wJc}7K%~d)Wl$1dyt*~fw!uTNbc)^^-
zj2U2A1}1iBP;_hn4I+TXVv$4`GZ<J{S&;<5?FWPoh{+&pKpkpiPslK4vB*F-8ljX*
zAm`(Cp$?i0Ibkh}jtwC5peY~fU%M61a0V@@hKx4CTmh2eV9aFU07*e}8azdSB*EdV
z4hd&<kfIE<zyvEo3ruy0mpeeq6x2=7oC*(2yA|kxX}5v_H84R+K#ehIVA`!<fS8OP
zm>@@h0~0j)kOdz1Kol7uN%X)(aiIp93n7UO9t`Cc&;`TbnXd?NT4jj<4FSRw!a@_I
zQkyZ8MLPhL0|FwL`glMJVeKDibd+a+y05`38lch@kwME}K&Ff#hQieTfJR*j_-GJ_
z-Jml{P*z}<{{R&ZnJmgJ$fK6<!xtDT6j&HUID4QguIICeNN~b;-?2#8fJYda`@tm>
z$abjR6%A0kO&Eh&OyJuCU{_o*D1nYb0<{YzK&SM=5}?uy`27p}E5OGRLyc290-B-d
z;Q-BgL(e7wH)EjEdmgYb7{J!C?XQ^6VgNdLjpYL40w%^tmIa_Ql`9!o)-c@wEyjVj
z_4oW>VV>9{0IuASoW2LN<qOjL^<fNV@hM=8V%foX0Mrcu)uEsQ3#1wz#bEWI9+X4@
zV;sv4kezWX3qV(P1+#1cZ7+*s*}wui)Qx2a%K;X~IEa0S07lji8uOjQ#0WaU<N&CP
z4YCO8$Gst-1yEruF;AG03)sB}elRg6Ld=9ErF{}0rQx7mNck)iK<h*y>n5Nk?PFnK
z@Mg?`Tq_3JNde6v`$|xjq3zqi0-6@6mjYFBFeMK__qxE_W_v#ffLAxc!(#6TP@lR{
z0JMZ560r;%q%H?E{)5O^1shlxQb6Oh*^HSi*~m+c;f8^fBrs;OB!GvS!Aj6e8IY0~
z#tfF235-k=6~O0uF!h1<%z^?AZjd4av^#SE)SWrNbOPE=I|14%6AZq#5`2g?0|PIr
z9wvwREEXPI{S3tnGDfPP1GGJ2c)&apD8GYo33ya;325VL3d;?~CydN3_48S7fQ(K7
zxq_D$;b}$C-Vvrw1{Rwd#vqm&@Da)%KwHy;;3`23Xgn$AurOFKb+WKnR4}HpR7_!H
z3}TrA+Hjr90@`rR7{u~~aSaoA>kI?f7KGy~SQvDeIyqQ$au}0Ya@K&x=RiFK(E0M9
z^a;8i31uy*Vh!ljqfQ<c4baN%j4PlMDy}fjVFIuB#7OaqpuKoZodPT}F^nNBF<>oQ
z7#TxYwt&ts%x5{kIDv^V1RCGS9@@dez`)bY(9fXW${^LxpgtdzPIFk+Fm7SwY-MO>
zPzQ^FmMJpku-ssLfFz3AoL979VGt1MH<`lHuP}v0y`KX_Fic@lpU)zoBGPX#g{5Bx
zB*X$DYQW-aKpuyb9iW2-;hW+VcYqRN6btAucE%{MTR^9Xf*b)lcpc;l@ZlsJ&@7;6
z!GP6b1|}pGpsf_FNPICYPBm14toVk-HpolZ)cLD|JSB$3Q~s*+k!;<;z!-$WWip-5
zfN;bP2G$}5Q;?nTeZDZ8cd#(%uof|RtAdU<WG!MaQk~D@F@ce_70d!1mID<8jfz7=
z8JIa?;qin4bXq$Sm&tEF0~->bwUxn71yu9Hb+AAU0i_KPhB`z8bRaBa7K?%d(?kgt
z2M?w`2^Nn4ril`Wk!y_ym=zu4oCBbJ%vmfse?a;B4^s<dLY$?AxdU{(3v8@|an1o3
z#w>WL1mc2v8?e%hah{6+QX`jfUWf#ki*O+0yc|%imd|2x9dthQ6_zWk;8j+zd<T}_
z0^Uyyl7gJ>1RC8$Q2<&oz+!R-)OcsP!@LEw`ezHv7SNmt3&=!}lR!&%Q1vjPTMDl~
z80Y<AVORoMkpf<&3aZ;7;mkN+qX#t90vktSoF8xjHbw#oaK`zdV_q4PSqwfis`U$k
zTm23y{Q_Wyhl*mq5SV45qS!ACW+@_;m@zJNKnbmd0T3=IwBSx(m;hc?m&vk#aWx}&
zrP>8hk290y4I}8nPw=cP)F~jPpk@)v1<+3GPzGjjU5g~S16<C6^n>c!H;g@?Z4VIJ
zpd?K31xT++LPe;P1MF-Il}=7DLvcP!0{B3Q0&G&ClUs6F8W^WAVv&W90W&V*L9PQC
z7j-~94h{50GhnF(>YPOzSQ!3;lFI{@C!huMpoP9jQb$00zrlAVg@V`Jfyy}~=>~AR
zXaKE0&S5#ias<o;nFLBEpeY+9wf~txM{<BA`x)SEL&n7t)0r8w;6o>jOLf2whAt~&
zTx!Dro<M^~+EN?vv`r4n8OG0yLd7iLkh4%JW(6~luD)ShYV(<qvzP;NcsNqhSmpt?
z0XizmxGX}1vzP^@3N}a#5=L6}&bX`rGT#Yz$1>1zOSVpi7SLr{I@X{`DtJxG2$ED_
znyA5|U=2Ec9@eH~Ty{r=t%IS50o(zGM#-`};BbdFG8vcMiC`{9zD{tt1j-3M%S}L2
zT(BX0#^om9yX#;li^BM@Wx*gmyqJKwouSkMR8VBG$b12nNMD%#KwBJtm==JhD?zb?
zq82;{U(T4tQoaCGc7d8X;6X-6?1GKUVa#C3DQC=tDnaeCg6u12Ooz%rdvGW=lryHW
zl)nLu)V^T?+mQx}Fu0O32^NM5CYSjva~KaWGPxi%`N}FlBQ~%AW+*!W;=+gLOaI7#
zhyKA69I*L@(m$ZNu40b)ECSMunJm&W%;3Xnpy`33OaU?vfug4jbQ%vx9SeszV<wBZ
z1BeX?Cs?z#<N-8L5j`ZZ0%#zCq(Nr}D}#Djpb%t$#6LqR2YAUOvfAPUpb66~mXIT$
z(YPawNQ<H2X^a7)D3c`ww0MT42cigUFxV)Vvp~uM7&BM`t}rrBY+wc*=fTL_*TBpI
zS`ZBqfv83`H=Z$_B_5>V4--_wA10`VKj4xNtO@EfkPY#SX%Gz^FdI5xHgtd|bTBof
zvc#VNt@S>^2wq8*Iv;ESxbpyy_Yxn_%BWD5fC*>|gi10Xd%{ipA!FWP;~@mpRn`g6
zRVF@=o~6$M(6HPB#_f=jemf+*vgWhQVOk8@rM{SH4I~#pOo5UphGnvtfDFr=&*GE8
zn8}g>juy~$&>#~sS)eAMj+$Dp0i}ve78&q@8c_5gCYWtpKoiV4pe{3HY!vQqD+$n9
zG2puymqXmUobd>n^Po-xDXn14WU1%@4QTd&#?UfYpsGQmIZ%(F80{m(-M}<|GLyml
z$t+xqP4g$SOcrGE$<Rg@&7aI-Ie#(>j{^e(=lsbm2J<H~8P1=~2%<sTB?8dZcQJws
zVF#5i$QT`H%>ffw$U;T2iy6#PoR7y)&=4SoshyQzjSecE6<~&kiehIKm}Q}&*jWu`
z;Wc$R;|3-zbhqMm1+=${2(c8<J=&mhgr$RVGH70AGUEqEF#iMN4@Txb@ZAIO7Q59S
zT(PQt13KDb0%|XTQ$2LZ3T_uj33#Iu^z>!0B2cOUM<X=KL5i9|JMfz!i%meQ6j>HC
zLd#qfvjP~?Spq=EfPm*apsTfz%WjPXglk!BLZG<`YLWaM76#D%c*uGF@H(48{>==~
z_A{`XVC9Vb2NnhorXD61574DG6;l|QdO#%ww2+hk(ZdMdzy^1n0uLx_r?JG8Fe0wB
zW>C<vVN3-@03+<=as~wp*pf;f#(WkY4e$axP~i-9B*-8IMyNp`&w!kTBnO?aXUu1b
z0iAb|Qo@)EQUS(LWttqI^Omw$GC)V;vK(PN0~%|}0xk1+fLNx5q!v7UYXUmO6MQi&
zdi;Ql<6+ET;fZ1HD4Wj`16G6{J0L~iIuUGHI@B`IRmC8eAz22l8o`Rvpo-E!0R&P7
z?!&^ACV*<SiJ)3do-vC>9=ytc#lW61gT+1voLF;8AW0Qb)N3vPl|4Bu5+<OI0>nfx
z2{p6O1KM*bU<_p`*aHofJ&Z3v74-|I4rZ3R3AOWCI+%Z89tnhEL?%nl7Vv^v&`crd
z1c^PM4J?@~N5EVC1Xyl>u0qIUnZopg1%5CL*dZVS#iR_DoC%DKG2ml_!D*gl52#n4
z!2;Ua#~8zM19VVc21^Ii573r4kaieGF(#cQ2kf2n`7C=F&x0mb&cn6_LL8G0b_^uL
zz?&0AEFz#ocwsGtA{G&lYf+>@JLNz&LTxKj0M7@3jy>MM2nnqXj0-^LS;6{s3`GhH
zn8C)t8U!E#@QyopUICe6!<f!u18y3D+E2_34De-CMGm0Uo5L~zv;!iCWdrC?LdeAv
zFh_v5<3zGptY89f`+(-jBA+izkb}LzgOv!|0$3OxfQpv~j0>2Ui|gjIfTq|PBUn~2
zU0`C&V7b8b0W1tng)mD%Q|X|-56>DV#w3;vOdpsSlR(`CL~<*FD_H`%AZi6jNdj02
z%nZ=-cTgGP5CbYb;A?7%IT)m1L%bfa!$0<SD}jrCwB?<}9H3nV87vwFV5ft&lYkgV
zojHc051=ksBFhZM4UCM5pneUgIDr*pAX!+M0Xi=cd^8B?stNG!D0nCpYk=0bC$dz`
z0GWXl<zNZW;_-?Zpd=5Hff)^!VvGUniNTZz21|g?4+j^~D0V?^<ggKiACbSmLuQ46
z2lPHK8wYW05};Fl96XSu7Qpp@q$*}GVmA-$HrNs747~-Qnd=;uIiRDvb68rKrZAy&
zcNluXmq=u?<op3`S_TCsG(tf-v%z;Uu3<tyH3uXITK>YKkiwY3G6ytPh`4PR#cqfy
z55{zsIgDRGdG!mZ+U=>C&jLPuDjm5P>;+%363oIAz+B7->O(*id+(kAzGCQ!mXHPB
z$O*4^258N74--oXq~3yO&OQebseb6>0=AR~TZq-?V8YwM2ss+eNJSZRl_-1&grQFZ
zl-`m-RUK#>8rWi3k^srUQX8U%0@aA1IDiJDr2-2>31b#ZNi}08OZ68>ISi6V<Smer
z9L7wRoGXmX<rVW;t}ud?p;t{HWd)2GECp}C`zPNpegSQ{#x$y$F`cFQ0jPQY0Af%&
zC@kR#(lQ3LbiRzClR-(DXFiL;3`UOfiZU<<Y!=Mj1)!}^{h)mbJ)j!|IkW}A9OyYB
z2Ljk+K*mC&$g)8iGN20!8_OM_0oW`S5ozYG8c?4PY&J|*UW0|foiU5Wy#{i&J*1i6
z!U$>yLlh!H2c#CfeF8k!1f5D^0jou9?qghD!j7^i8*U1i0r3+f^9>fr86E}@3k^Wa
zxf41dal+C8DpImoHZX$g{H*yb4?rVISuD_PrCFejqCKGQMi0{$P**x@KFb&8KcI6h
z|1kHkfK7xX53rTU1k`#K4i*Lh(H>|@hFu!XJc$RiZQ4Mz3#)`dgxF%nEDi+~4h1z-
zEfEcjIP^3yZeYZvYXjpJT-vrUUcjmC0^=QA+U_tOVa8?K5#}?@I2?I~`3^2^;IM-Q
z+6xv2ZpM5T?gNa>6CqatLsJnWD-UQNV;YM_IOs4JXcf%JYN8KYfPdr@eB~R8@E`aN
zQbtx2@G3p{m<y{(31syTl88P(G|?aV1g*7TWeg*0h68MJFvDU#xK@R_n-z2{g9v7v
z3MjE~@QY%JQUN7+Bb||H3FKfZc%}`R0O~Vmu?T~^qTs_R;EVp?a^O9p;9dzdSB8L%
zfiGtbSpvT18Yy%cPOg9+9J&NtrYvDxgH)!#ZHK7JWU&UFE0;N+rJx7Ylj>od&Imqx
z4P+q1*HH5^Sgb*Z27~u?f*X2ppD~<#0a{`R8}ec}B_YBXj5z(^l!OQ@?hdqoj71a!
z2f&v?X0d4O0QHr3Fit?}QbVl=DFPplwE?uEX#+$Nv>ZiIlEGpOHUQePN0Cd1%7NNy
z&_u;>V8RX1fH!DZ6yz+JdeG)mSo|NTn9m~P!I;mIu!4~>p9OSd6tvoeslEf+$K4V!
zpT(w!k+~%TIk_+#07){YfTX~EEoclL_#go0!lU8<cp9_^yptO=@BmZygM|q+G7D?o
z&fNk!0tM8GgX^3Nnips0NS)8Zp~INZqT>&46G8RQ-Jt;DGQyW0GBQGMXJweD0_sQv
zv&;ZpH5<$VzBag&f#nPnbO5r2nW>b4<pIkB78niQOA4BtKx$3Q(*Ye$W-y;c!JVxi
zH0e2?WdhRzCKwykO6BOUFJ_PdwQW`~ZGg#uN>osT3N`>ZAJkO>ZT@j!3}$ig04>L3
zSpvEe7qrX|WG6JR!RnZ-K$EN>5~PI53S1At7gvH#;eo22w}OQMRQIqnfQ<srUo(|f
zuxw$P!^{}WGKYB$Gl;u}`2vW0f%yWM3!<_5bpy<=!EDVCzy4tCV1ltbm?kiBG{gJ~
znnZ`nfQt`!e9b?>!jQsTS}`AVNOft#e3qI$j36#3{edtjRG=jx!~72{4E&(2tm=$8
zEE>*?IiUMmvRG;w7@0xmFgJj1f&z`xgXde}L3xIS0d&I<=(d<(7LXcnXs!WuMbJYN
zq!bj66&;Kq3Zw=aoQNT@`42$mWkIcOVPx(CEq6!cV6Z&sARm^J7Df;a@&!VAGw6mm
z#w->KXT}T`=P8g%8B+;(PoOhnI#dZXbHhUoWD0mQnKSdmDNImB8A!{fH_!0^FN6XG
zHY_AIgKhx<_p@0%p!dGOOIMH_4`UV!k2qrni?|1*ng^}-hbA46yf|YzL<;O0XqMW%
z160yMJOEWIdjPtsvj<$-_JA(v>4P2if~*GA7jpnDbqt6=ngM`&atrKe5XkBm(AZBF
zOGq?h221n-M7V(y2%4Tu76lXLi9Jj#CN|7{Jxrj39y3`yKvgSv#0SN-5L+@>6hO9Q
z%m>+$!4d+t09tH<ltY~jQJl`A0AH1pKA*(~bnhUd?BB8gv?K?<fPG7d13V@e;NiU`
z1a$EnXe@*Sl%n||1Nz{S3>IBrC5%}t9Q=$KEc_18D1jAyTS6Q_K18xM0~!(F0D-z!
z7PeV9hiM`QOHK*sB$AQ^plAX0DG{j>tPT_%E})&UB~ut-@xjQ5Ncl1sKw~jkEIbOJ
z%ZW6=n-4TRKzAqlfY{)q2FiL+yTQsqX7Y$I=Cf#MFs86*_<%-nkWAD77f4x<>o~JO
z0gZ5zj0VWMOcox{l}Z7i>pD^8Ep9;D-jFg95<U<mP#1tyfG38)C)$A$H7Mn>vck#}
zkh}t828)6|_@Dq-TZqBp2kI0gLpJPO@(GA^2et`n5kx+dMcM$=t2VFzjUQQnR@9*E
z%g$B-ufAfD2?vj1LNiddi#e!Hf>puUHITbYKmiF))maUoC1zPH$}ym5j7b4SV@d}&
z8d24)VPP-;DFHcwgT(@*9Fan@)^LChTmw5Co)EKkfJS^lXK*v-u;_rw1&BP{Zle#-
znVu9-Nym~h1=Qx40vmvYDu#vwNNoXQCQHE)Mo>V2hAClt(^1UxV9a3g0IA_%fv7<{
zY6@gdJ!3jc{T9&d(iVtisQo+R1{MYug;GXHm%&g4#!`ay9+(cyP@2!eBBKVn#0aho
ziG!*V>=BqZCP0@vfwt;`TAJ`<UKnS80Z)4bv-Cg?0f9~HG0qV|nbd}GL54!iWSk?z
z!e9=%yrvs8E)8C93TiiiF=#z8EJ7IB4WOGuMP&HlH*w!OAY-CBpG5{)=mJ<s$3zfS
z6=-|C39=wa9Z1l@16^god=?L6L9oh#`7B2mk1#TGB!C!a7zN>{GlLzWoB$f)MG*#T
zOMtZV7+9eG<p6ubaz2ZQ1}OIzNI*LmuU~WjVUXftVUXc`p~CqCv;YU1^cguO2!JN#
z;S<Lk69iaXKzsO+MIhTwA$f<9vmgLvHja_A0d(p=V=zk#V?X-1I3t${WMlsZk>eta
znJiaC?tpFp0>u%i`2|a$j9d<&+axB+u}If2hO^XsU}KD8xgc^wgfX1uhR6pI@LnLW
zCNKf@F34i=fov>$7@>29SC~M{pss+<C<|kGB0571#GN6wLJZ_&_|OX@=K~go3+#-M
zEG?oJM8SifU~{2m6eHIc7KR>Bb8HT14`DFN2IlRczW5g5J;Jau8m@E+Xk0OeMZ<tG
zndJ@S5+qQK0(Bxc3&<o`J3f<RKFbo}HNr@IPyr4z3srIL2~@?kCm^wn-DCk&#hC)2
z5fpgvf=mW4GXmL;x^Mzr3LFsN8VI2qystKl#lxR5i^V^LxmaR8O9<%XW|j|34WM9}
zA-q5sbS?~Nz!(w8+ybyeFe5;*02=Byn9l-I3rcZdd*D8|0hP5mEXoexiy*%UK?b1V
z(o>+)CXCTweXub2gCq_cZ)fEBv4atGp((W1X5<xE0OG@!aPY>2fcJJn(=%@eXrdjS
z+<9LV2$eCIsB-+5vXU!fum>H%qXY_hsB%6Q9id{Fd@)=eUM7j0Fab5(VU~+L0UZel
zJ6MyE_XPteB|^ss8TnX1%UD2Og8GPm1`ERvP%rce*As4#Iq<5P5hQhnlgVQ~%M-2#
zR!koA(KhQc@`E-PfEFOI$fz@Bv8X>_1ar=CZQ%wnK(-)E69A1NFh;QK;C#W)7{T&^
ze~l_*1OseQJ)^)5cyD<>=+0z#S`b~r!qCIU7{M}w?TR#VFpBOtgL(uUqv#bDhC86!
zHeRqU0o{KIDt4jX6boTtxWmF2%<_U|i4<yjM3(|N8>Xv(h2aA;V=T)VmK*Hg)B2!s
zBGz&Qa?lI1;x8-=plz)zDmIMCEH=^LF+`|(DV;MyurvrYTPX!}UiCy17WOHi*$`N>
zgi$O+2GWuQZA6Ev6}MnvSOHoh)583P6%t9%_9G)yDwYK-g?ykOqj(An19%(N4W>QN
zn^WMrN>~`)FfvB7oM76)3Qposhe{}LtMo7!t8g**OkpvCP)dd>kO5^S&J!w}Usd}V
zlt6hMszb6w0hAMA#k=?l5oQk10j6+)Jt?r>71TEp9xMzJjFBuQPnbbF;b93^B7g<F
zg$in}L_z?#=!0=f<k@=|xR@BEK=Uk6K`EUbpe0oB5iBVWANE=X?r;C4kQ^x0BEVkD
z;GqgyNQzMT;13_TjE9*7;>Uu^MtI7T`T@H;Z2}8pB+CqzCw$<N8>&TGX9FL|=S*-7
z(lIOyE0`I>Shg@XfTTc+^Pql4mja!bhbk2X(G|tOieX?RL<&5Yh9vm_w3#iO<pXFD
z0O$YtEI*k3fJX4)O+iN4ISJrhzz7Gv0beQ;#<B!-^EYJc9n2L!SQu_FGRCva0PXOM
z2c>IRVJNc#RO5uRWNZN60tAa#85RXl#KMDA#sYM%778~Sz8#%WCWC>iUU3Q|$A2l%
z;W4mrJaln*sV1{U22^grE!!dvp6Y>yz04jF6xlue$hZ8-3MfDt5D1SqfO-)*EEb>(
zLE+`H^aK{Bi7JRCf6_~MK#PGv%Sxf4A{zlZhAE6?31bTv*g|l)fC-q2DUjxV2IyRr
zGc0pJrzOl`UBU|L5-nj}1LEFceSkPT0jf=ohlN1_v~S?Q)O;2N70!uwAS+eov#5ak
z4bXudsA_ow@V>D`mNQH*n3>8XSXx+5u!870Y)ja{Glxhm0FYt<jz-9W#Q7`&>lv9_
z>p^p;TbMu$@ad>X=B{UCOkr8TbO1Cj2KE@3fGIFxVc5dN7|*hY=>;=mJWB&>4=ZCl
zOAqT2R;DrqmKkgd*cjs(cww<58)40ugUq#Ip4h>NNCa{`49pX+Gr$ieV1x<4j*wxL
zivbPmGC|LefpXz#O0HxNBO^-Ml-mJn?d7n9WFYmn80B7gFebv!rD2pi!oWQ79RmZx
zSf~IzwaIVL2hX@blNX4a%)kUa<&IJQ2m@m>1MJW{C>QQ1g@QYvttRZq;igc)!mtLE
zn~pGD00rL#(5WwFpdA-b8x#)oFoXA_!1y&T;N|nMkW{E~VdiK+D#a9PT)+tsroO>}
zF%iB4oKfKlxGsdZNWlC=L`k4%0q(az&w^l7c)`Hb$byIlC?DP=Q54Vs)mCsXDhjAG
zW+A2@6g>=>Igl4QD|%=%X2JKTGAdSp@-A$9Dwvyy$YqLqCV=W~gyA4Ql3SG&K+PlA
zoI9i98C17I`3Sc{?kqtV_l1S2j00hvk_N~zaA^=1$uijmAX#`ikX?XM%*d`lDQ09>
zfQlLTLUE-O(9J;bMfZ$K1wTLqB)oW0+Ovic)M$WJa7q_uAl*%d<iZ;cNOzRM6RFY-
zP*V+=%UuSY0ag~6k4VhQ91KX>8DR^SMOzpcBf#T7(7Y_M0knRp0(>iC1qW!O0Vu^n
zB?UlB5kO^@ga%_Ui-rMPF+&finuj+_1SM2hxIqWmA&GEsfK`Fc41!0tpo9u+*5lPx
zL;@6S5J%3S%3BnWD|h81Imn4yg#$7=0!`~GGIJnDw=jbo3~R!ugn;(q7|dtU*Z|s5
zyMgHr6X>891_lP$$Pc4R1`ERxP_yX-C>Me*1%;Uy@&vjp9x5QXfCtt^I#2=HZvqup
z34z~dd7uKZB|<fXhlPvz#eC2`1@Lh$Mj;MZd%*%SsGozFnp4|y1ZpF^s8g%3Va$Qr
zqqc<sl;Pm5VYMxDz{`svBPP%|Qrp79P{K0tD#Lu1l6uB0mijr2U>+ir)xOv>=78fI
zUh}C3urMfqm9Z#<GiI`cuRzzNenA5{YJ?J$!CX*SLoF6s!NL&17|ilSYlaSEFv}91
z3!okce7}fL2mF+<11L>*oim^oaWMyriVkB6(#BjyR0&1~2I%|@qlOP?wxO7VMZpKG
z0~$OUKJerBk1Bw+o??n0TL2P=dmCYp3izB{n1(YV%p8tLEl7<s@NUPetB5SAQK0}<
z2QM}>DilDQmEeBXs8B#j<_L>FurQoqVN7IM!ghw8F%do;$f)t*4m&K3y*i4N#y}E`
zk>H(m(D2q2U}2a8GNXlU4af{oPXH-8Gz&mOra3HgnAR|Z`ne0(Hn4#XE;_(=h7IIM
zkWw&)_Kv}9Faa~af`!3`sZoVx3TStI3d<9wDa?#HET9`L8Piziu&!VQNv>dh!3sKs
z<^$^wR>m}zKddcmjA<-AY%|zEvf!#eg=GQT3O1%jCYBX!JHWy_*p9G4C;31-I6yrx
zu+3lsW_<$-g9%fk8cPq;9A?I3@Qf5=F3S|w1*{;^1*{KP#hV#~Kxh7NzyB{L0%GWD
zFffV<&u4kT`iGS<m!*Ym0vkx}1hy$`jL9rh*cPxcHL|dPL!wcQWdqwDHpnf`pz}LH
zc7un@;gO^Xae)R)4`>NdD$5k6In2x)_VZchFfU<dOlO(G3Nl`UWdhp_HpWzNGl!{>
z4Qjjw*m#g~P<H__`T#Xl0PHQMMgf*7tb5p)8U;Z45j4IIjtxkFpag`$e6TY>g)hh*
zYzr8e7v?aqOkte@ZbVLDeZUG9D`jAr0P?oMe3l7p3)sM7jSLV+8O#Se3M`hxz`%m!
zDgn@WZHX*P82`XFz`|@dU|~>ZYGhz(0bMfC2nr==F45fK%+!d~E(Y_}5cNNpuYo8I
z!F&NkVW+vnS-b^&-d!u0lxx(0Y-^E2O7@xp3ZOO`ta8+h0UZ&9nDk`Sx&fVEa;a<-
znZg3XkY1>n3WBZF!Jve~H$s-=P*9aIR7I#pQAtRrlBw!^1}<28Oyh$BEb|^+fL;8x
z8>%?CT@DRVZ5;tH7oGyObyyf)FfvB4OkiHX3>rIvS)^@Zz?h2&YHbq_#xz7oYnx;+
zrXvDc+hj3loEf$Pff3A4K{Uj`{8aGC4A4l|HUX`v<gI`%&oNO^_5`h)oxzMMgs4)4
zEj*BGYT+l~+5w!MAVxBn{{Y`YoyD?(aXn}$#d^p-3ebo;C{00okzi#@K=R<LwKG_t
z%0P29=*kv=7JV*Y1nv7c0l7Sxx$guhX@GJM%vK5FY?WYPAjVb+@D98T7A&@cT?dOe
z2Gbp&GkLODY#x9nEgmrbfXo%K{9t?lUBrqUHW1aBEH<EZ`W>t+kahYUtYGEL6FWfn
zghS1Tg%d<e28#`-#*F|QpD~~12Wb0qFv|v}2cV@Q=m$iA^?(Wxn-In@mLH%U$zk9r
zBWPfm89*xV9iWTlK<yxGc7pWRKrfv9z$jSEV63v3F#|My|6bKfMQJ|R@uG_vGdSv{
z(4|1`0*!@$&4pQ70va|5W6?0dVwQ;wc9XycfC#7|QWntQUcd}GqJa4dbg|kM<`1C3
zBX;nTOR!fFv#wx0pgrj}EsR|K43!Kr#^6oqEsPxqzTkY84#pFVJYabXkP5;1;Cq!p
z!El4|3=?ZRgR$y-mNQIOm{{8@j8(zwEs*0@>I`UXAcDo^0H_Cj0CX5pG|K^|J51p5
zG|1u;m@h7X%Cc}4haHTJX`u6JnHW=8E->9-0&h8B0M!hz=$E<!+Ab8vVzP#jF_mQv
z=#=_2mII(uJX1lz0(Jn10W%qNqyu9pivjo^_!Xe(s#F$mG)J+#04-%rWmyAShaCmd
z10RfKka`1}4-8>ZnFHFwK8JA+^lnq+^YW#@7p(@fC`<rtSegJzfXU#i!oWRcRR8?}
z4X*^Th_o<*DrZpo%K|k|m>6@xlP-wS2?l8f(87ug7J&rN<y@d0@VP7#m{u@>ri`Iw
zAcJ&_4!j8pbvG<{q#IZmc(hs=d_+X#l^s;XRTWzp{6s`l#O0M8R29`*7(5Z2YS7sz
zJQ8MY46O|6Eeuj1T1uTby-M?0Bs|R87^<K;s~AYo>CwYTuBAPUb3l5@vUU#R0!Fh|
zsFOi72~Gyx=K;~%#vldJ+lCa#ZODP#h8)OB^BEXm=kiEZfW}E+Jyr%xE|c?o1{PG+
z$XsR)TV&H(KsVPROvB)U+PVnsU}<D7lf`@nMs7$2%pffQavE&Z5et{e4(SvCh-&zu
z0MY^sOiuF|I8Y5k<}!0=&S&7}L$M5nn}sTyi{!ExkT(%_VQ`r_l;*>SY8a%!@(7Q_
zFfjQbI}I$2a9RulGlx3TLB`TCpfz~#(~m*iG{nKjAZ{uH0|%tr39s`&*T6$}Ekcj(
z?tm7<9k5eYp^J!d>ILm>hi)PT>&*nUI*x#jOFhC2)(dI}K<$MVZBSc5b#enU^TZ8I
zEDg*Z%*=fom{>ZPzko%+g$uZZ0F^L^;>{$1g&~GzVh7WFmY8(LOqTQsj1b-g#>Jo}
z$YMrNFBl~Kg0Y1OBGtk)ory7%WjfOphyVj4$T?thp$-C>3O@2phB1sqW(Bn3f5Er}
zH2$yzq;D}}7HG&0)GvSs9!Qr8V>pWnSVQJ~7O;kJ7N~~I`QU?9kgO143}tx%Di}dW
z0V9m50WYEnW9a~0uo%X`3c6+nRw{z*01Y5OZcPFk4Lbb}95QedK+`TZj9H+~J49Ed
zU_B^RDdc<?L{(~}s*F;Vf=_%wuSz?>CuD%D(vBJ<%&Ju44hw?|=)e~u>QadZEDR2y
z<6c0OX*x<}3f{DaT$xI|0rfOHIl#4P8l*N&ht#IvoekjH6dLprA3&>WI(gt#=^7@+
zG^~}U#2?VGMyCMY+EbDNG?LLNLQM53$pcyp(kTJ1KT}y+km}D=a1sZlLZ~w(1wcDQ
zI%SY5&{T{HR5Axvfx>i6U}4}1X<;w|RhtUX={#{UNQX)cREgT+kWp`8uo4kL*CDU0
zpsJ`2sbHrtCQ#epc7`?v#TEuB5G|#MT*XLqfXZ=rrGUw00*&s#su+kgyi$<pU;x!X
z@cK$(3aIEs7>2=RGDoVfAgU3DO#xR5@ES%^0pv1x!HmfTUA+b`<{{F^TqbLzVjLn3
zFUBPm7??bfDj0|~yn+F7kt!GvHx*IANalciiLeTT%VdjGzd%$Yyph8Ino2{s1gsmG
z%jAYsy-4PuR4*WII-+_3anm3zc38<J{sFoOD}WJnA}M5fA8gc(L4t*Yqlcl3WeN*u
zBNMndgC=P48K4$t7K?}s=&;Zbh(53an90+?Q+_ZNur*$YI$~M}3xfzZc%HkHLC#8g
zK8r{Q516}{F$=_p&#o{`>#+efPoYB<4AV|9@bof(=E7e?=E7k!0u0kmfL5xbI71wC
zE*vAw8K8Scz*Pjar68`6gS;$Iyg>wN@>kVn(C|ClWbp<JldmoSO`~VANUQ;!gtmqW
zbzeR-oIr}en+PHp!&oA~N}%Tg!0Uyp2SD2~GFgNz7{gdBU<a<krbHO7-f3V$8UbLq
zR^bD#TcAF;HUTtS16O@*1L)if*c1rE)gR!|16as`xS(1Msu#qKfX|<R6^Eg6!y#db
zh_y=>KpmGX7L^I0w!;Kw=%qd^E11u)LYMHsJqA)M!I;S+(E>h~p7{*ub}~>q1J=*D
ztTF-OHIOaP0J~xW8eENKak<097|Zeibn8Ma{7@T)D?JV1UOsd=4TKNwTR}&#8LsrO
zFmN-Ka<FhWFo9RAz{a*=GMr$UNF+1oe1I;*g_&{H19WG14vVx4^TY|DwiqnDQb2<*
zu$eE0D|0@84*P)*7BO6T!vk45f>82?hnWM^4u*T##{s;41Zv`C9|zF913bfB_Hh8K
z2L%WSLjxsl2Q-(0uEENh&ytYCn8lKV<(vxmWC#ODiwR>Ui-|K!=bpOxEY1m_^BNOU
z7&BQ?mM}7RI?QKT!nlM9B)9~0@L(Sg$Ua0wgY<(J&o2Q@;DD4sHs64TfZ#D4cL%g-
zDuYEHltft?m^z??BcO>QsMF&?9Y&^NCKi<dreaV%3fCN81G*+C2egnb2a(s~doVKE
z#R_OfI{<3v9e_9VKn{l50#X9bX3%r8ktW$0Fy!Ew<>D4-`h&*CrGOaZtaYgZC2L)p
zfs(Z@9?1b^OIX&rcp?L=7q-Hb;o=q08H1e`EF3Y=i~(~iM8XDisyb-PD%A3eS7N|(
za7ezo0NyW}#Uil<RKjdwIs*z`^l?3qBCyxNB@9>zdI@vE1G$6&CmZB!cp;?&k_}-l
z;Xo;2E`sNS5rO7_5)2m_z{`YS!2seSl`tSKQV9d%B9$;8E=CD+`T}SddlpN^6wq?9
zDJ*j!yCGTTuv~%OA%xs&1gQpZcb&olI?A5~q@KBN1tVBFNCXs|h*S+yuEChWqHzOM
zB;8=X!U0LuAXU)l0VyeFOlK(u%YpZ8!ILaRE)6P&>rmx0D_9sBKqn&{0Sz04Le6Xt
zWqH8V44UQH!F&Qlfo5A6b6CEx{b55IYk|7qENFu~Y;_8cJ=a8oDU6V-09ocRE@6bp
ztYO>^V}qNiaCd_A+w)E|oWjUqp<<xR0b1k&(ugJm(vK<xA9rRr|3Vw=E@+xKI{`9(
zj1*AkLAR=d&PD}oJP-k$IggUP&)r~QZ~^awaY<&(Vo6Q`u@PnExf>~rprbdD3_Rn*
z!T{c(!Qv3kn8gwv1J(g5OVAWqFi$j?&td^Ov)Uz`sfz)u)Bv<(6G`DY0k~=4RjdJE
z(?Cvy1~N#22+PEojPqGUKntAVh4A?oI>==-BqTuP9#rG`7ofIJ6pIMx7-G<NAXwpk
z{sm;+GBnK2zktte9%ul$42+?MoQi;M<=z6?T)l<y1hhMQg7FJzWg}QABHcn%XR?%l
zcGnzWU^&2ef|0rJ00Rq1Ie058$YUT)NX9Q<1RoE3f^h;9m@xrVnFh1G0dKYg&5EI!
z51Pv?SpXVVzX0m~LUJb5ywjj_uNd<|dwf7U1wl5!Q`@OGEDRj1pi2W3SWIkKLnm`g
zR$#FShl<41a7;YGzy=ZoO(DRVhY$lpSxh`wK+^Cz6^7F-%Af&GW@hLbcZSmiEDYez
zHG>Ff#0fI+30nb=B+J2B$^n_?n$N-^0&4P!AVeSzMtJy81q(w3V-`!r6wq?!Da>=A
z11fWvuYgWIV}-Pmp=%u&K&mG&g07{Rz<2~y7K3wk4$B<oGoXc?;GLX^su!vnG*8HQ
z19S!kSXmOw8RjdX`C_nBpuu{W1H42ul%<F12<oAS42L5?b!!ewKn!CJBHJ8J05#~~
z?F$e$0zPfda99G=x_~!Y4|5<N#{#voWd;jF0b>?R!2&kMVDS7gxbe=ig6#x5s6s<_
z9!M>CkK7Md##ojgtS3N6*@LSNkSZhteLy$VL1$#Zir|~NkQCK}_L{r^9rF5u5v&Nc
za0OXb&zQzi50-<T`-WssD+>z)3v*Y&d={21tjxs)^I1R_sIx6*%yN*K&$5U04jV`i
znyx`f4U}c!i4>%pgE0(L>1MGAKVW1jdr%A7l|O@(vkJPZXFkge)-9}DeIKeJ{c?x}
zoP7c??jF`FY!H1{*zT|)^g--oW(Ey?AXiSPcIH5|=DYxH?RmlYhmpBd0OaliY>c5S
zptS>xF)U};u7FOP2e}*?aIGpV4B|}1JS^flj1kCZO@kzSK$9gtd)Qb!Tvg^{N}9}P
z@!7)$>OX>lk%0kzm_};_XwhUO3kNtcpJ3Sox@-OnXqhA=(<4Hyf`wrM3u8RX1eOyl
z9E%y#7c-_Q&1X5m@`4p*9Uw#d1xRX@PvL4{C}-f}|1SkT(gAJ~NC6M%+@=Q5(tLPX
z+vb71fS94pLx5#5BeY_LhCo{c3quPNC~jFASUOlh3`8~677+kGG!o)Ln2sr+uH|Hw
zE(R{<7qaswv#@CFVPu`m5;2(tym5qmGRwq0Op{qyKqm@7#1Z9BTSN-W#2rkCH7X1c
zJ5X#0H~`)Olf}{kn(+w+9lQ-Gzrm`Y&HyQz4;t>A&j{Y=2+cUCvKcH;Sx`j+Yefa7
zfX)|!=kkC9puM-CHD|Dz1|-6mi6|Dp{0#U)PliAq2Br?g0z()d>^fKp+@b)Q3Cdy-
zkY?`6n9m|z0WJsNbKMLrE)w7>6Sn3CB*4NY+yS15LzJY=3eY>K!Mhkh7qLUkL9q*@
z2z*%92T<bw0J&Qo+)RbmmCYHTiU+I*8a~Y%Ae}H92jq4LR2|$+%{3yZjsyvCK(9@Q
zn&f^0)X~UdQ2?FokKTL+NrF46>dZaa^I5>>|7RjazWWIlrY_JL5~xF=e2`0_#@iKu
zPWH=Uk-=s>ND_Qet}=6H_Iws)kQ!v;?Fzug!&}#OQ$Ve2xcA`F@O;#fz`|h9n8jib
zI)M<~GayNDrw@GE7f1y(&7o)qH-POK(;;SLK-x`E&wxw-8xPwF3rlew2`t>53{x06
z8$kPGAbL<tMc50{ieYaCC=N1M6wDdZS<EdEt!_|2!Z6egwF_7nVi>bnViFi*SrXPj
zG8W4k#v`Cg=m_f+P$dMqzJ`4XJ7X-%681Tq;1tI)hw~2?XuT)QI5Zl?^h}l*u)&%0
zS=NA74uGyy0vnt;pJfWj;7pjopmQBL_i!?1vh3l!0J14_KFbBp&me)%oDaCbcXzNn
z;Cjx*n91^->kmW#&1!f+LA;g$@>&GcYZ)LHw176)w6K9)kO6YR91g|^mN^_?uVu`K
zcnwt1L#8(1=GFPIFw9_KjAfa@@&Gitk_B3!1+A<<K*Q++`vp$O@%OMcBHVS*AOV@O
z1yoRNVFa53nj~TU!OED)@`Dv@O6Gi)59|{_muO7jSOV%YWzJ_=!f_lVaGYZcG*Gs1
z?gj<QZdfRRx+G8=k?gs_!WhAF1LE2YkZV7Hy#9d=Y)=Nro(r6iaT};BVR}I~0W*fO
z2<&ELuV9|SXe>3K<p}E)RygMj`xg$zP?iatOE?)r5yg3v%>zd8#bfX=Yl;93Cj_&o
z908BsfUJSq(KG|p^$cdI03A32az027R$MmS0G+teqcER^M}skx#lnUe#I^z5c?MgO
z%TVV7+Up3f-0DKWtG>aez^$*VU}1Oz+SBxgc?&ek_OPA-CG9h;M<7v#ZZ$~D8c?{c
zVF7E&05uzqfWqwv8(2#QcqJ^%r6A=?SQw*N_OKpd16>P<=70+z|A(?j++ksiWBJ1J
zft4|i<pb**HsMkRAr1u<Q!x<^1r_LmKd@G4@YDyeFx+8guLrLw1D#j&h84yECrcD%
zjL|G#nBRc*HbK_dAW2SPVvJ##!gPU&xsnlV3=4>Xv`UHrViRL9#0aE&nd%c-AiX1K
zX<T3Pf{_vB=(q+J7RXku15BXHEWi!}c><IYp>AmKU||5CZZ2cP7|!yCaRsPF{{qx2
z3THXN`~=iHf5QBQ88qaKsOB14!0VmDS#~h(fVKId=7GXHf-#l_5{;m1wUJ{Yf-wRj
z1Gy;+kq#O_^=1x>PXI>+8+cz1sJ(dvvQq`>y}AiD(7ryRjbHb|nW=&WQBA}6(7go=
z^#Kf!79Z4%hC2b^3KVW};~CI_bvY~^1?-0Ybqq2p^BFkc>lGQAY(TYH6pM)iV-%)%
zC`de%feZN*J&+DiYGVQ2PiX?Gt&zgI$$^DIf~kjr#lVEAhXEWmaEE|0BDgun!U8^>
zK?2;ggDs|GXo>)z4}iEyJ{Z&y1YP-M!@ig?i?acIcs3|*!RwC@UT}Q@I#D!>#Q=OS
z3S@4AB?NS@G<fs`QdulvTmss4xdwDj7bt;&%z?%yM1LlW0r;Tz14#E|Lxa>U0W?Ml
zpQCYe0c{k3E&OM2D*$ofvs$h%Kvw{v*VHZ_pyTK%jG-(k;8kYWlz>|%F^u6XF<>R=
zwJOLIa8(aF-lGK607DGlyG{TNY9M<HbWbtptkPgedI0rSU<uXv2Q<hQfC6O!;|^%0
zyMyruVuLq4;y|jw7l}hpDFCa^oX-MQorxG(cd-EtX~F}>#f1U3W_!;I24rEzFa~Dm
zW*-I@7Y4Rs2GEcdiWum;O^|00Int$ug@Hq?l)+dE(m#W4ec$tdO=&(02M;b89sxdt
z9?%{O76A$V#f+ISV?aWP+~!gP+EfSI&CB321>B>CO+UEIK;A9I;IaWF=0RN0sd5b9
zON*h2%L%+-EDJo#9n7)<a_9p1h}kJjpm7hVAK_sQQV$O6J)oBJ9*Fu((CGl6GZtC?
zFiruF8^A)(StSLu4iLHtg~3?|YmhtZfHoz=gWOpMGsr<oLZKBA)alMCEDQo-r3^;c
z0$e}@myC!4A3_gm=sKr>_O3F(9p3`JX&lb&U|`IL?*e0R26JJ%z@S`sUF-Zngcrpc
zL<xy01<#z$Yfxeg#0AF~C>9vuCpmjCKyya|V=zksIJIYiQu`aw!n`+(e;}C!qz8<l
z!3EL<jybRfaQ65NYGi$eXaMJBXo2G40-AV$=LnAgtg+@1z`z)a$P^v{n6U;@l8MM#
z9vujS9-s&_hQc>6F?j4i2?P)q90<sZ5gi{uXQ05P<`PEe@o+3h7#on2E!68E)y|BW
zEY34PiFO7=b>@7CYOvYJ0R>T=!Q#9DG!(i4qB;YrIs?(ycTxfEu7QV=6ZW+2qyx&6
z@U-oOC2fP0z|uA%qh+u#;3+h46(<5B;z)%DN*N>~gIunl?Am5<%8+52$N}FX$>7ui
zid)#;BrrD&5kpQ(P+|zg1&1PNg%qp^cc_5I&>Bz?zJ~D%BvrCpVVr>+Lva6s)Pv*b
z04UTCK-7b7m<8W?!qUPt1Jcq0#}u+9&Y&Z;j({Te2t-o`=#<eJOrQ&iVZB9%Jt$G-
za0HPKkxG7tBPdbja0D|!gOr4!7DJ8<pol8NUJUVwh~bbCQQ<?#phkuxg9<n@U^gK-
zsxW{yJ0o*L8CX!cY^Yq=c1Z@u22e!8+XfIWyu5MrL5WBZ7aWn0K!$~~_XE%x<SZ7G
z7{*|h81UFp)_j%&jG#lvSspO<piBe8BNU{|o-vcf9;_h~qybvqfHi>28>l_V7J=Ij
z&?64PIy0a;Ggv-D?zn*uPWYf^Kp*TG&<8aG`e4a`ASFn}lurgCc_0;2J{b(4Xn_Zw
z&jOUd192gN2Q78P4zMt=FlMo^faYbOttpt)2^Izk_I_y3MM8zW3&I4C+``nrw1Yah
zXxcMCTm3UxbU=+sq=1C!Yypj=<+BKY$I1;D^H~fmKnVyO+AuX8EDQp$=FjVN76BE;
zWEK_pJ%X=6Yv-V~ftZB`sPDndjJQ2l4Ad%z>&{@2k>TuN;QS%g54v<lMnwo(?!3;J
z!Uz>*U_{f++QVQjHJ?RBg%3%wIr6P}Vi6oDixI>;1X#EP-hx(C!d&Jd0NUcjc^m9A
zC;|20i3Cs>WwGdhue$~xt(!HUr3KW?4rN)w2))b>st2BEPiz5=MCY&=fKJg*$YIQ3
z*}`}obUG$H(Vd(EI@J@d50-R~1c3VLSu7b7Kx5YvST8`j&MX($8$fr+H*ieAjK(8t
zSQwsw`q2%nTiCG;G8~lwEk4O%sX4;T7|OB*bPr+<OAly|TMo+>(4IEX#ca^9I2vNl
zJn=lZBLo_*hq>!m0O+81riq#?6Bt*3<~r^$UI1;KXkeMZ0zSP0?)76KpzW#?wODvm
zKr=jGLlBZTK;va$;7eV?SQapzU;=F{Vd?<wbcd>h*?1guF*bV{Btf&tfDY7g2w{w7
z0j=2pA3p(g@Cg=Brx($*JyK$U(osB8VgcSn4hm{$oE|BG^^|oOBUp4SK+Q4e(Etob
zCV=~yj7WUY1O==HIC>+8g^Pm$De)Y=0a`EtZ?GL>aDnaUN}YkE?D!nW)=&5t=<zw|
zTRq{SbjScS>yX7Fk9s&A)We4Yz#D5}gX)KDOxQ~yp#<_GUJUU+V=n{vj;Sn`Gmx4t
z3slpA7E7>nz*eEKTw!VeEmQzaO+b2<9V|CMGix{49)JeMKu14w-r#2pX1T#X0W`Uh
zHJ@dIzz-3|V3r>u9b!-|VhhATlW}4PpaKWPu81=Rvs@AXA`Mo-0GhnP=3<ybYd~W<
zSu8z}<ExG^gOB04!}<i030R(R+~H#kX1T*Rg&%Al%M|`U!i>Qze}sEPAp$+3OGH6?
zi$#w>1&)Z`0J-Ug*bgbN3UDP1wQhz33j^r%LY66v-~p*Dq<w`m9Bx1w4v<)2oZ<0+
zk*yrkp@U^=#u*7~K!@%i_&FV{kmWPbRLwYJ4tTwFE=v#NWJb{4dayw@#+eg9r~JU1
zg^V+=T!Eat54CXSlQ*C-Ay8;Rojdan=x{wqZworb36+@zKJ^)Ny8i)Cp#w{tjI$o_
zfKDO-<us_u{s!>*EWx1r9w94I5ZnCv8}5KkRDk=YzoP@w%l$nDY?Wxi(7$94=)P7Y
zr}l3F9UsOR%F@HUhJ~ecFX+@$=*SLZ|C0lZ&<#CMM@?7)KIS5rWewvVCh$B63oB&m
z8c6{IGe-pIhHj3D3}p;5pp)e!B%th+`79C&P&VjjIV_qPgFz`Pj736%xvU1H9K1*g
z8q^aDOu%ItjN1S!s-f0ToB%l;#J~di3bl!Az<~=IC4%K-#)%JD7=D0`j{3p6feoDA
zST?YMZ}Vn{mMDx9AGDx^^28TD80l)_n>maap*)FY4I6Y`0P3zuDIiaUvPhg^1)qY;
z2;HU(lU@Q_aUj7M!6G5UT){Y>MaF@-0$iLyrj|iT12pagqG8(pz)DLK#uyfp7|`Tw
zOa*9F1?UC{<M}Kz7<)hq09bmM=P)zIu*_lJ!3?^)^91u07SR6jHIVBS5h;7h4GU;;
zg{>-MoUFmZAkLTrSs0na(!&heIgZdV*#UCzBs4-MFS)|V2)bYb#@_+zVj(F9@srT_
zDC$86LBMmxQ~?1<u7Dah)c|x;EkgTLj}@Rbm#~tXacaN<l%im2$Q<xs1$+#LacTk!
z13y!l4GaGSP<g=0#>T|N47<>Taq0tDJaDjeGEC%<na{$(!2xE0PIl%<;OMNM$N@U#
z89o!rI5j~7)VGBtnyCrklT=_+sUT_a0!v8ZgD1af1uP8Ea(xDLCCCg&QM!To0z?4e
z&1pTL6@74DPMcDKoF}HuSi#IzgO<^!%~`_CRt*yb<#&YDE5K($g|a+he89v~yr+IX
z%LAq#pygvfm}W481;9lwNE0-nO(Rds1yINE0?3xdjG$@>WJ@p$*cOlg*cK!kIv5$F
zSUMPIFtbej1Wx$SSf93H2Hb=2qyZL$dJsv_0lf4Prtv@nXsb26n4G=>G>nSip0NQ9
zZ$PVS#_2sQ$osNqC<uVhH3Q{0cy8#u0$Pa`%%TB0D7b;K0kn=6v|bGAi@p%h=G9;p
z7f_cNX`2rtL?R3<5e7aO10Ee9DShU$6AUc+HjJTQ6`;FH5%L|N25UHrKn1eb`hI|>
zZQ&m8n*s6)3O5`+9>v%<!vy3}SQ71<VFGG)!_!mW3=?J!hxrUb@NB|x9dv&NV>rtL
z#xLBA;S7R8kPv0KUI6bnfe-D23g0OCzzK34Y?$)42dGa93uuO$BA|7xkZBp1zZh=j
zfcDFP&QxCkY9X&+*}=k?!?J_r2dJS8t9u!4=KNr1@&~N|fLXQR3MkOwX5ZMef)g|V
z3H2PqO$N{jKCqAgahXg&lgCi)H$_yC&YWYoDWZZVEzi-z;NYzyuZXP40%RsEOEcWG
z5CMfB!j1sYkS#Ko$p)!?d2`7UNFy5N1P~uIHv{8unF6|&36YE#ZhL?>8i%sPfO^TG
zBWD=kBZDYXEGL-fKyGe_hwAMDPy)?iF>yw!02%HoXn-eVp*G%CkY}#F0qRL03p@bb
z>;xC!VXj3Jfb|9sG%zqSFu_);-ChD}>V&d{ykP=WdC<(naC^rM2p{h9J1;<2q~)+M
z$g}n^I3fq{?E?bH6R3B1WLUUZ7?8sMj)nr-GWR<kIuH?fsNb&O0T;vYkhl>8I{m1e
zgN22Mxg2y+9#ZOF1L}1Jv+Ushz{?oSAc!Qh1eDo=SvYuLzC}*vcRQwl)-A&_4g-`A
zPm6aKfKFe8&j3OS1%|tKU<thebbnX_;{--V(4AQaKs6<(T7aqh16qX;%u)cF5&;{6
zA`uRj2*;F&0ZYU%u)@Or?jO){Y7}lTs%$ta7gaAPZG##bP}}c;SDVDL$bfd3Av?DK
z6u!ma@GV9Q-vglGiC~sHyjS=cgW<=+F<jpPACTBzf$WicD^SgX$LhTU;M@)maVQ@i
z;`eUs0iD3b!~oh-4|VW;5zyv3gZV5X;LGD0K<#XJ-o38@x=j~_3kp(bvIohAf-@Yb
z%>^?LbYMBCtqVFuKZ`|N2h7&-Va!5=;(ZMt&`lt)7yxmR!WhI2MNte6V^9SP?R_v@
zzX1xeP?kOXJ;IEkEK`Jkh%$yEh1><?kONgoFvq=MVYmaTyXP>!0Ci}PN|F0$QixLy
z89-7BpmSao^r6E>P~#rRfG4xVSza)00d22A((}Lvd~R$g%MPYDpgAc_DbQ5)8y3cJ
z(4;H$I74`D1nCCdRl`zp0+b0(FoL$gu<T&E!@?NDatCw+bTG>kmNz)A&U-KgG|-mA
z!UD<~ETFCHj5#bH7<)kd;2xGKpo(J(%M#ErxZstspnzpW3M7Q(KR^Q{J3xmZMY23$
z0^R@2G97dtOC-wz<|`~r=JQ#ufE)oncoP;i4_QEGIV7>nVcx>bn8W~I?D~*}g)s?~
z@L+Rak8DiXxn3nyGRVw_rl&^*4D4L55<w#H)*Qnl9~Rag21BG1OBo(TNPzAZM#^0e
z6F@nl6r8(Cp}7klnAg96%G_X<JE8|98G~6)NdAyy3})bCfZBTfg#=3J1=siJ4-3N<
z(DLI0pu;r4*S*0!i7o{SLb$%i7g!hsz`ZslWsmtR0y0px*L)V47%1BVR7WFp2(U1K
zE*oT7!+Zx+xq*BJG7_51o*1w|7erJrhOvOI@W^550p0NyhFC}Q*gyu{DuFiz9vgs%
zlaTq~Ia;W%A2&!ab2uT@yN??rKszwuWy#|P32-$7%G&T+>G2E}2KY&EhqugU;Q{aU
zRsr`tRSX!z;OBWUJe~pVMZzqcVS!rXJn?}Xx`I)FLnK1M<#Z@=xd)L5151P<3Wz5@
z9*juE2Z)PQfP=V5r3r|Osux_iASM%^8~`n_h=CN~Nae#5@bQ311vuj7)9NYEx|#<x
zE)0q|SUM3k0CfkmSj0mZgIPj4KxHd@@1Lj#a$k@^G(rce8yf2(A3(DVnJgwY&_V}f
zFp?YxV+IQc`1(=_#$*-=8%FT0e8?FYWC90c77GV>$lHXuzkWW*H24Mq@CpM^{6bAN
zQh*NEDL{JoI^gZ_HjFteHXdv}44_FF7LNeV4u&oUB`_x-1ty%5!U0wQI=dF+PSAZj
zplSxi<V+TMkja_zS#)d|Q(0_m*jgDnK!=dnq;P^+U_(<<xM3WyX<#3L2H21y1LRT>
z#taq_dB$Xjp&9d8bPO0XSPX2KI~eD)*raeYgB)xqGoK|ThohgdnL)`Ayh#?RpgRPb
zsRG^qs>0sSpa6D>iVk~!J(vmVZh@_adf^ZYsI8O5!Xd)e1u}U)i--aTm<8(VDri7O
zLFpA!TP8?bCtMqt1=R*-&xh=1fF&D|6Ck@XSU4mYGgxFa7&Aa8izAyV(g8|wSu6|&
zkeD*C09~d7TG*KdK7||{vrvaa)Mi4|X3huCeXv-7)FNg|V9iqz50J%KEF1!CUEl*Q
zStMj&EExk1uoxs5A(0HT0<0|)q^%RK4a$-+-~h95YRdp=>tFz1JSZW<24%?@fLQf1
z^O2{3L^MDZTNVoo=qxl)ctGv1H~|`}H<-^N03Lc|Laa5aH~?zkXR%1=fEI5ciGy@7
zW`d@9GC?gEP^y3h0?0HL(BKdYXhFOHc>9zLDD!}JEutC$Q<eiVC<h!S@IrlS1Pg;V
zV-|}y=rWlc@FD}$Su2QwOcrmj95^zdW#!ftpmT!ZCB@bkBG94%Zus&Wpw@2|OANe<
z2PXuu3!s4lQIg3L13g#+EQewM=swSsa>h)Sa<CHco)D-DR)m0p7+!gZa43Mn4{QX~
z_@xq{8IUX%1$V|w7WW8*^>8Z|OaK+|Su7DhKnp*AaCAV%+mQ`{D9L1r0Ly`c0MwQS
zD*>fpP#lA35C#iEEr;mKV2QW_+WmS3e9<k(e3lPP4?y+x1Lh^5cG41X8;4~H%MKRM
zar-PsSdM^NKu1{iuz~q|*q(qU0-ms40j*QM!v2JvF_`5E`vMNe7?uSbOE^Ho?Hm_C
zybBx+oS>0DMn-T$4d#d!EDV1@yP*Ft{Q*t?{9*b6S|<93t$_pFw}Z#u;x96c>Ck{(
zV!{BwM-S{Hbb=97@PHCM%$5(J`Y4k{r2%vl73k(J#vGOo(6)w5mMe^)o9b9@Fx~+z
zT)6|f!ZL^D3204NCd&k-_n`Ay{(x@Y$YePJ+SQoJ@`Sm8g)x%_bO1MFCd(bx1#FC&
zEJr|RQf9JzVVl9un8|X0{RD{mz`lY5RPTUd0OTT23_zR)aWGgM>coXSpfeQ1SQ2uW
z%NXag<jeuBSl9q^Vi?N~#vP1c(H)Ej7@5nMK$F*?2?&-4Obb9q!LMN61ENka_pmUA
zvGlOKU;&*{%hJI5f{ihZ<ptXdHZcDM+Y)xLF-zF5u!D#5AkKi3pbX56<emV=e3png
zpv(DoFun#+Ul=blG3K*8VEPZDRxs~oX3S?f0oovz&vF2?nmV6l1=|WX#(b6=Y<ED^
z681Ihuxtl19W(%d==y^E9KaX@wj+jR2WTT%49f#hQ#pnO?57x(6QD4UVL1TuN({>q
z_7&{lv0hNf!5mrvI#b1PK8w#AM$kC)7seOh6H37cnu6^_QD`uqB_;<{Fm*7#0j-T@
z`NDVsbZRck9i|s-kY)@tl`WbATAK-<nO`Wvz*NQnAB1ICECE{21n<^?xG{+3M~hV$
zm}(f1_!(e6QuVv|3urA%D2qb@c%TfP<00a4An`a*5@rP5od$0_f@B34^I2qMK!gSO
z0y+l=#(Wls5D*)r0agKmlv*&xfDDRZU}nUVlUUh7XWT)938amIF%DGZ=dd_{mb$XB
zvopemBN@Qbpm1i8Vax!@XCP)<msEh7r=a8nHET%+3xfn>FpGo+*m3Z7@sb^&0c>Va
zPX^}NB|D%>6+lW^6f{6(1+06q<N)NzY$T(FI#?K-8M9cNq4%@@fh`yTB@LLNAVn68
znJgC2s~5qFASEQoC}d^ec8>*f2giIC$c1`7pwUHiRp5K{o`4FfCrn_&(jk2ic<c#z
zfG%&zVo`=QDjZ;CKB9FDQUhM}s?3<lVqgFwK*0>M3mR@970QemEXtr32DnOrl;}`t
z!3O9ugcXcT6Af5EH)k^S8L(_%JOSc^%mD`i+))tqnV?I#LRma=xJwyU7+66s(=J)S
zh{6XMf-C?s4Hiy<p!FTh6ZPhUMuvky?I}cF7W@J_25F)Ji-`@$EjA%c6AeIR9>UvT
z6^y|wHjpLDplC)hJOJ8o#$4GV2$srZkq1d-f?6}sEGihl!qf#e1m?u=7oe>hP$L<&
zsQ{7^X3S&}21z0BPx^jA1iZrqWDvr+)!^&QvRG6C7(-bCu+_~F6`3Fv&~s(LNek+>
z>L;Mx<e*+CG}b`M!51UyfM<bW%5Lx=Z^W*C0~(lwXA}?@ZRK_)_~4E#7HJF6xfT`<
zOyE;3pr%!(fF`p*9)Vg~sR23`Aq(PZ)bOzL01ZiIvGAzC+8t0s>_WIfi565_!GhJn
z0W?;W#Uh{sx)V;vgsBg7WC%QgfuyAwGg+jeTfdMT5ZHjz0fG|HhB9cY6v%C`v3x-b
zP_GWuI*0lKu2KT#RJhf422fvs;t+JtFKlJ4odE;L7a*sAG1REQ1)#i>$)aPx-r3O5
z&{+U#%!8w!#Ug<*lO>@B%t4Hu1bzTFdl4x;@B=6;GFb$msS#{Cn1EUVI{Z|HF^fe-
zgS`uCg$ArR2w}`(2?5;-4Dv6+%wQLgnV|4Rco6Qz;0>U$`79O}AI3};pF51$lz_IU
zgL<g~p!WC-s1kVH75oMi7D&Tq!Eaa?1W*np5}3h=dNL8%M_>Z#t<VHeUpkA$B!e-S
zC8Gyo2TKq5_EVNMu;uh%9UuZp7kI@USVQJ~7SJW0jF~J`AR013WA1RDf~+uL1YP0?
zT6qB~K41wj6f~j$ju{r805A=*0}+5Ac~E1MLx!cep<q5p5r~E=0#Q)+gh_w~va(o0
za+tdk=CkBL;)10ByivXZ;wg}FC`Qs1z?jJr5W?J9F&`3xpnIJw7&Ad*Nl*tdg0J6$
zIXTRPg+YNCG+v;fz?jdXU;t)^#DFMJR~518BP@r7L4d2Dp^HIAS;9zlK8t_=51a?;
z;tEJW`65QD;Ql<C>t?Vp1Tbc?1c2%T0cd?7z_NjH1ryUm$i<N$4KTleRcEpUfSZ_e
z7&m}CojD(@9H~`^qB?^mU;=0ya{@$l22^z<YI`o61=MN?XL0dh3}^93VT^!u_K*vb
zFp%Y-=2t)iXm#xd(AJbt7SJ8*%%zO;S++1<U}P?3fK;kb7le0!R;Gu7`rM!?EF_<V
zXMhTjU={%z#$Xl?&~P|N5}umC(#*y3^H~IJz?6p%h=QmA*N`w94nWgH56De(Ks|v_
zmOG%Os5vYT7#l#Ni4aXF>N8nFK>NH|=73b7yX*jH<5LEUPYq)vOHBi4b{$fUL(Bn_
zFvEVZFvzfVg2sd9v&f`yEN0AH%$TJ#A9REfTLnWYXl!Q*;|fN$P6&Gi;}%AQqAiRM
z7-6a&FrHw7%YepEKm$IYl!nMA;Xhy#6*7#$EGZR?!7Mc^KvU*hKtrLyEPEKQgVy_B
z2d%|JyV5u!hJ`^yv>1A*w}%{bh2?<_O7mG1TyRJPL|~Ud4uFUZP(wI_#U%zjMgxz&
zh#M>n8rZe7SY%+A0Go?2;RUGf$zjpZ0o_Pyz+TS41{xg$D}si8qyuzt5nc(xbwi{w
zS;Rq7;F=vxDgz>g6tPf4qXj@d%3`sAv~<AbHA@I&>k=X^AgVH1Lf$Zf8w7CEArcuZ
z7U2C*VB?`Rb974$xLJ%)+5$S_Bb22AUTdL9f$#eTNr4Rk`x{Ka+_`~;K|rXCVKU=n
z#)({$Stc`1<e$tmnVm&IL@*gcP((riESQg^P(lGotXK%FSwVw$G80%4R6rwuZ!%M{
z3`iS91lbKS9MG~0R%yZR7h;If(SR<VWS+PMG`I&1gqR#iWr~;<iODg5t6TypJK(_(
zI{{j2fh!^C*?3?Fz{+Wm3UDJFyh<FT0vg%yK2PixXzdJc<A82=hSuIFD!^Odr5Q6=
zq(Le`6&q}BE_RCzxMzuo`#26326x6R7I$#r3o{K}K9j{Abf#eDe3qE$puvghkkS|G
zJZL1wIY6#5=Z7|cKz>7!%47jcL3M$o;enIjz`|h7n8jiZDnM;O3%|4GvxJl|2D6mF
zq64HJY8*s$CW|##4r(4uZVG55E0{&W1)SOu&8LJZAQ3dhYe0?k92OQGNc9Ab*n~Bp
zGl@V|3e3<oEDWH<otg7lICR(+GiDlsN1q{mA%rJxz)lMQwM~6OKvx=vL@;KtL^MF|
zH3oSB5wr<6K$$a>#RBBr%=s)K$&8sS$>5qF>Pm=um>X_@YM%_Gjg}c;JsBW9sF^X5
z0a}(wfR^;bCyWyrK&@7=*-(!rf;z>Bk%UAB2~e@^pkjsC?TK)2ngpo9n#H1H!rWOu
zpCto)EFO5k5qg*f$hlC*rZs@lLM978WDzb%1_?tIr8_`#gay2LY5{6eWzA;^02>Z5
zm!)C`s4AGjxPXzRzd->lTcv}h;z9cmIN*kG@Iay-H0A=c3Upm1V?K+D0VC+1B1pu+
z<Q~APA`@}=y~ERHu*s}2;D~^BPE9N%u}gs(MHViS@C$`e^dYy9Al`>snGpaDO7P9r
z0U3;0EEz9AX@unk;}=HGP6n?3KRi?v=d*la{LRSK!ypgi|7M)S#66LN4JH6F6;^;`
zfP0F;EGnS&{U(rR2vQ(qoPeZu6&DtNZ<YBhE}-pY(CQiHFt7=sEGj0<r5W>COt!#k
z1dv5gHJJsVb*5P?>J^|qe?<c$sGAKM$^><^K}}_tx;>z=&S20a7205WCa9&sm<3us
zAI#za-Ms*^0g>3Upqm2%z!yU#fMX4sXtQ_dFmv`Jb-uHA=)g)fcwWrm0FB~gu}FX$
z6`+9$NSc7!0t>O69iY+zbXo}`$f000EH-B#tE{l9&16x~VGL!_ffTJQHV%xLEDmQN
z!31?+t_-Nd4bOJDCXkhPAmgAxliR_<08ZiSLBqi78Nu}{sPIK@4CdK@I-WV8US&Ru
zi3?;OF~|^@<MTB@EAFybY+68j>RXuRKt`Te<}kH@HqC>TB0?0RI+Mj_3KR3h3rwJE
zfS8#3E--<WgG6BJ(Y0i-*rYIqv7~^F2OW>WbOki-bcLw}+L~ks>x6m@Yz?SgZIi$l
z$}$IZ)nX{9B!xS=1H76&l;sQPC~?r)5n$bLX^@{l+B+CKK(=%+&0!K-%$Tv5F~dyN
zOhpEK7l)auCFqI{kPG1b1gQ08;H?~4EDGQ`TF42W5DQ>7fK+HRX0m8UfQBt15+K7C
z@Pq@A&S237=>@e`5Cbvgpgo$5pjBKP6UC-5^)Nt7NvPFT5zrAg<f;@V*8ob6VJtcw
zkX6<2b5g6o2k&ICNC$wMUeFX&bp>?i7(4}4{QwO^K)eApaA^Uw1Od-Sy@13#L<P*F
zASK{qfJzucSxUf4z=r@q&UAyB)4{?J!otOVU_MLE3ML3+1rzxCHWtuzj$jc)4Y6#4
z3=3Bc(gIb6rE3g8nGZftwDbhD`bQRF3}xVe4WTaEAj1PPVls!p{K-s{*-&J_84z3~
z!QA(Sg<%hPc>D(A6A+Cl$->3NFrNh^4Q7E#Ab1dfb%PEt0BvyxtATOA=74Uhg2((a
z(2aJ`<{MK&!+aJVP%BFz1upbrK1<39MmYBaXw&Qk1it~TW?FUw6z5qi5)O=^EDq@V
zmO*g^_2Y8zWHh+g4rcKH7kDX*IV@8c_cJo)u$*AL0A6VT(g5?<Y7c1aqn@*Xt^~Xx
zdI_XgjUoryeao1|!c&0SZdjcGIt40|MH(~~0Uq82>4Lg)?H$mn9E15RET9uvu7KvA
zKx=iODR#}93dUein1cJ*AZ_q)T^j&8mBL^?G$2wyxjO~4JZ%Q(UfxiaIiQ7{p)6}y
z9)Olsf$A#|#$trgd=?1}#xNF#6wpHclmf<RmKmT+)xtnGnXxcNLyQ1jVGecFh6&P)
znTT0|bsiFIJpX@#?sbGG&UGFVEL;xA33{D}1j<gW^&eb78@pgl=#3!@;8C7p0g7^{
zWgA1dVJnYr^&n1$*qAZ_R5`#`PHik`LD7#Q0a}j>?{<Jxf(iw=%`KqlLa2WNI?N3c
zOdt{(O`8m$jnE9nP?n4>j4Y)Mb)ex4#2)fJ&}{+Wx&}=r_*|(y;Fic9#v_cN7VHtw
zT|b#DZx}Z)fts}&nD#J%rV>FK5j6$KRu#q!7L^3XFqQ<cUEn?Cdzip0j-iUd6uLV-
z7(-b+_JF$nAR8HTSdK9M0gZlukBR|Z0tI$2X!shQqBb?KFbMFJF-&1HR)wC_Dj>tv
z#sKHZsPisn%s@yZdI6gz1hADsw+6sQc{eqnPN;2a5CBcEfn5vBaa&G6+p5-#87$V|
zAw*Dp4ORp75lD#+V<wA^HS@$CCa5A%E`mkimL~y_g}cm1BA~((G_eLV<OvG{_>eWw
zF{$7Tg}CZz%M)mUBF~t?A`fXPBYd`%LmjlU5qT=>U<PPL(qKNU&j7pU6n1|p!@(^E
zEL?mHhz(^72e&})Ikg0xR0Aus4{kAlrETy%r(kcxg63rl=*U3EV3sXR2Y4BSS$g;;
z2!U4SiM<g+EnZ%%0gcK9vxrDD<}k3s@AhVR@qvXQ2UIG6PV0q)2Q*K;lt4YP`_&2o
zkUXq>fQH%26`+n(Fv|p{IUxIA@OFT904@<b0kxkQo^W1*=k`Kb8ko+oGKR8TVSNHR
z021OG5D7Ez49KAoEEm`wfX;n-!uErQF@og??-M@82$lx1C1Q*bh+6CA3LaS4fEM<`
zH`Fk^X#s7hDdhkS4Tdr>Aa)49`T=d&En#7rXu-hD!U8Wep$-760EGyH1Y;bF1bEc8
zg_$vqr3JhNiDe3CO+*}GQuoyr2BuP^Dd9H;9*ptuJrE2aF6gXDXsEt1um)en1>@#`
z4$cCtg@D@rT7rdP254RF7p4|ak&G!7#{!m$12-j5bb)p(_n%_`%R|{X6um%F^nwA0
zqT5J{p!=X<)~SF7Hp5sNm|uW)7%+hr@WWE%Yw$6ir3@_MJxq*|EDg**K-Z@sMeu6}
zP+vNU<q6Xn(6UxodV;4DuskUI4L*QQ=zYSpfEmPFz<dC75dQ(@J0LE&p#d@!gki1%
z84Q|~25F3EdBW5J-h<Wx(iqQjfcXrVdxrTAGh;kRKQqK?m~Iai1`QVO9}M$ZG+uy~
z3cp~Q!OYD0VLr<Y<{h9-Y)3!`=Ek6oq`vL}H>e|6rZ6sH6q<O1VG0Z6h#n3Fl?u>~
z^#<k%pq)UVEhsR1BtV^tP?j%DJ)j|F3>i@L_AoQXA*#+dJ>d1E@D}Nt9?*JH_?m+^
zJrW$H8dDfK>XEm&zdn%xS|kiBMBae*(t$h;3NJ*}@m2<u*+N-FWSC1W=CjDG0G-hK
zg>4FGnb8LREBv4;5Ud00__v_7*sP2(EJxU$urtQ6H1IFsXN&<gJs_jZV72g=d<$Az
z4vISg3C3_12?Y={B8It~5w!Y(xtsyCPjC$=j$4?PfO=6Kd^7kML95~+#=z`MU}0cq
zE;V3dVSmEP7zx@f$<7$b@`i5$KX^+f!nzXB;+b%k3!pj-l;uFizzpeNVb}vY{;h*;
z1v_IL%Mrd8e2j4*1z-$Qb%TW=hhw5W^pLU{jBi*FydA7J*buxgyfgUVJj6jzZ*3Sr
zr+<M`7R<~J(9mWm%O22;h@s#pK$7uc42Q^o+zTxe-bH}Q1bB461z&UlZ#2E#z`@-E
z-rQ}XW-kSrID=|?yMaRhCSeOYy3#}wsh|FK0|$E#0~aF$IFW!o4JBZ%`2ZSb;}T$)
z&(gp+g^|U<QDr{M8^#_c2<r^f70|Mx8EgkYtBLOLe&A&cWBI__zz3EFdkeJw736V{
zx$vbb?^;+GAnWfd7;{)!7^g5ZCb9Ied;qWa`@r%8Watl;7VrhMEv#!;8IxE}@Z8~H
zOk%mi^M(ge;Xqya-Uc)an!_@Idj>ZsInCf+!VRf;5s4b4rh`dnqW%;{bJcRtRE2>i
zC_Lt~oMHaLj7@w3_Y!U_;)weFgM>2pu3>0Uf3SgUf`j|=Ehz99lfWUzR0>-1fGP!Y
zDkxOJt4W}Sy!`=M<qZlfsNdd!rehg%SoVP0<Y6EQ#1hGOXFxSs63Yyh6)cQNEE`z%
zfc5~u6UF-md5E>}%<#T}g<%FLZ*_oncY;zE$Uvw~?-zhZk#bmE;u&*5V~IHo46wZf
z9|a_k$9q0<XfTy(ARoB=Q3F)7_Gp0IlLK1t2`l(tJ^-H^7|e2kZ;c>o<Kt5R=z`8r
z76Z^`L3Y?V3NIfRFa|SlqH^I2lwQ7(0gt*sL+hgl=%N9TA7J)<ECHP>AHh;`g^{I#
zK_1i_fcyUA6wsL&;VhswcsWQ89#XF=zz2IQTmd!;(Z2gM2UHRUv-B_?04;n3uQ&^a
zZ+vI?)FXq`&;YF}gSzW8=u-G#DCbKG=-d|YRuI?{*w3J)7fi(rEW#T=Ln?bfEqHL;
z!o2Yryr?3FML->V%rPhvL1XE22MYrWtjD|e#e5c)48|OmJD`b4&^hVwkow%w!^mU+
z+xqb(1$2ZwC_};;x*&N*R3{>>K>HE_>RKYL#s}S|jmS)&_JA^6FpCdptYZc94N%}b
zV4eWl@&enh&hTji{P_R<pu6kgY5z+KsH+^zVi5tZNMNDV0vVHoao4cGj($XT)&z8C
zK_UzqHvc!UFyu34vE+Av+DaXuBb;(rW-zS)ZAHSOFq0+!0%$4a1;!PilSskC@Zf<l
zP&h$jf{`Hyv=TU<<pJYn(85O0C2~v_^I2XneE@L}FrQ!saZfP60Uemh2GI_&3u*!b
z$W@TS?hGSi0?Q1h7tD+aEFGW&Q4+wbXBiV%4zQeHVN788!!n1JF#)U{;w46g7|{F@
z=vbINpfLwnie+Rtp}`26ScU`_Bf|~I04G>0n1JeMeE~ga5j=<i8b!#O&r$#yW@cH!
z_yjZ%ku{&?38+H}TT2AXE{q_p;9<E8rim&n83jyzDl7$W7?~!jfGq$KP)pb(AUW9q
ze41kc_!Jw^d42HK3M1PZ5f(1?3!v=C#0k1Q5TqM~Ss0FhrmsL<TF6QXMkbag;Dxpz
zSq26MmVhmwn`pN%9$}P%oLU5FOMyn@|3gpWlLL+WykV3^mY-w{t_~rJ<v<pL3}ngK
z16r&K>eu=pt41-+K^0ZXK^1C>QWpb^jiNybV!uDKHdOmjjhti*H%AW1OjIqPYv({t
z28BUH4Py#R%@jta2?Z=u7>_VY;BW}U9g+xHR3ky5z>+ZobZ0ljWEKG##uOGA9i|C6
zEIMx(;m1NjDr^=97m$T6M;O^5-h~*?0W}n48ps$HhZx2jmY5bsrU`j0EsSp%SwZ%L
z+8_|w2*wnah$D=woeU1D5EIzI0RYm^xeGZlfYc*na5FlKWeQ^tXk0sMKIG(xEb!hp
z@VF$)7Um<&j9Dy4n0uh7X7sSVVPni<dBe5_vKpRc4d)F`#w?Z_oELb(TEOOmdhMAk
z5?~?FY%HjwhQLrIQ$TZEQy9T(Ig#z219c4C?mwW?1EhkW-JmTy3{0SwG1LWM!$B*b
zAUAMi&S%-e3^ooV#s+sENDC7K186-wsL=pAKm$aB)Pm?9whO$VMiJQI7z7Ikctt5_
zu0L}=OU)cmb^@6I&TlMRn9qRx13FTZ`2sUzE(<6GAyPls)^LI@f#%!*In|qG1J@01
z##ELKycc*G!Ph}U#(*FslD#Yv8H~v+8Go3#7BgmYo>1X@p$3h+WR@+U4pTDA73M#z
zD6*i<0?8~-*w%0&3$Nikz{!}*a)9#;itriE1Kf-mEPr^W@FJ^T!g~OPe*olA&<Tog
zw}G4r8D#_2Dqvw28E8Z=0o{rX3K+&LM7mnR%9z5^0~&PzC8`hXj43Q1*r$MYeNEw5
z!^xO}NM9Sc7*kkUczbvmQ&^VpZU9jmcz5tJX0hzxJ;2MD0<KiRHo^#yV<6)UOibX_
z*&qoP8R&-WDU6(5;9LGcfj5P51|t{f)L&>|&H(ir@*(*lhh+=%0??+@1uPp_c;Sj#
z8D!?OY+yM9k^y@lhvg017IskK%>IBK*{}!fM>rVsS=Mkia53hvG;nR;LYCdY)x*u0
z&a#B(4`>y`6y7DgjF~K8pXIZh00nS510w^=2Cf}kpyRO^m_Xa{q5WZ&CrodcIQkhJ
zRN6t^-WRNISi!sw5bpuo8_;5Wh{5?RQ+TKFGJ>cXyr5NZEHgkB<ukB>3<oW!2BmY5
z2f=sXK>L*}UqJn~e3ljL8`zm9D6p*IoWaGI&N72*1sBr<1yE>$3eSuR#$=WWEE`xD
z^I6`oePM%aIsgSe1IrT7)#GU_dzk((v9^NCCvXg=vGnjx;f08Ri~;36&>cmL$t))r
z|1g1y%NE`#yi5~vKt6>eC<c}npl!q%EFTzKn3y~2=d-kcM$_}bX#&g#nF+ESq#k4<
zXf}s2jpYK<6DH=i`uQv%Z!)HXtp@Qy7K4fkMh4J@M;Aa>n_pmj!N}In(8eGOy2rPJ
z3A9y(se_3z8Egr-WenB@^7b62HB5}TENhtdFmX0Bv@^(nb?sp~!o&^cg1jp`pXCH-
zPem5kQpimrP}ebl{BwkfF`eZIX!2=79?KEX{Yl9zFPK09Pyn$J;#$xhk|1qRyIJ0_
zd;x8P`NGn}3SOAd!}^AmF`wlRPYWoDm+-FO1q-hL<&u0*2!hLAmJ_U3SQ*n<uCTsf
zWp1yZ&+>xx4=XsAxA21akVprG#u1h)ER4A<Z&-R*8FN^ASbJC*(;#^cHm%LTz_NgK
z11n=L%Ldj1tekBO9Skz<pin!*`ht})3*wY4P?lr_ZK7acV0puG0%X|<))TCtdh7(q
z?lg!xsM&~ugyjqS1JL%+2cRM#9g-O`AlV$086d&H@`e2c2V)w`3yw9MpacWXGHGB{
z&~yV)$H4LfbY@==O9RIY4(6iz`7ARy=70)4kOnXxTz({j!U-D4EN?izfb9RmF@Y1D
zvL<j&;biWupU*Oda}DSc0+0@n1f;Hk+QY!W@`e2eJ7Y4-5B516j5#cGK%1~KSypiD
z;b6>V*#mOtL=K2=av<&m9nlKX4JoA<SWbZUYvr<B;CR5nF_B{mO9v=OA8@>Z@W285
zhGPaNV?N6a&IO#H15`joUp^?D!I%N$*##im7I5t05Nd<oJX8dw<>s@z0R?Fq#1Xk*
zM}P-L8JJiu@O<H6Ooo&b$sp4}LVtJ|b09)F-~;p-Kqb*19?(28sH6hXph|#gA`kfd
z8<q`RXShL;0Tx8fy*s!La4}}F9N@ab#oSdtpXCbI8*avYmIJ&eK#3Mq(t(8GvA{A1
zG{_LdvV?mFHzbz0TR`pusR!{HIAMVXE*g_rc5vMQ6|XnA=5T|G5m3nqNv+_L2o%Z;
zEFZWUxEXU<8o1|hb2Kwd<e9=EJD+6^_a1K0008$A&=vvIau{SA_-GYK$Ae`D*8|W+
z91plUxIw9S4)+33p$+maV<rPH1IrSg6FlI9YFRe$oB<6e@q>yAu$k#Bpb&#@o?}@9
zD(+JuLaCqw??HP1@Gwm%0*f(CC}Ln>U|)r;^#<yIXR(w#fy{t|>Hts^?G5u4=n<7y
z*w=vS&ovwepsRvFeuuV)z(U}T7)uM!1ds#a^)$$#3?+;tnGDj5W->Da3&Q~(&_MWF
zVUWe3lmw>X1hl<01+)<42~!U%V=~Jd);a8q87x=W-+=s(IiKYXdkY7s)aCdCU4-_B
z;{hmIC-5u)C4vP!2f)D$8mEVw%fJBICY#El^8}?`^n~dTGh-^tALbSg<hD!;M-K;M
zDoYQ?3>4uR91B2u(m@s=sRr2rDaSx8BwJZz3P5+AO<`nAVF7hr8FN^kFx>#f#{=d!
zAnFb1ppFz4P}K}>9z(pE!UB(^2i%M)EDyN<Kzw(A2hxy%bPzz6foHcM3{U|LYsi2s
z&Sxo@0-7%ekLl;LoMFDfjMSugz<dH!BcEWog4Aef1~po)up9wZ7e`p%fSQO|um<EC
z)&p#eK`d85WmrDT5B5LoNT&S(MMw@y3&##nQ)UOpA5f^lwf^Ba0cy$q;rar~(lbDj
zl*+PzX9Evo5OiPz>~8^h<B3C|l|e>zKFc4D1w6>2ZD3JQ=p&1Q)q)x-N0@JbrW3$s
zGBU8-V159amS6$-5i|vHfqMdY@DdhWEI(MLfNHQQtZP`o?HATL>}+7G=d*z9fU-f#
z5wQ#6K`~240b?3CkW*RCFx_ARHP)FQFf*pH>;Tn}IgsN+Qd!=BMpScHez448XG~?e
z!v27rF^%N`D8y1(T0jXZ4Qw5#P0z?uF@+IS<TA2!Fiv3v6$gwgQ$Va-1~vw;fvnA-
zh7toigvZ_t?q`EKb1X|hds1^j8MT9H4iosSMp!}t&xJ7Nvg`mYod=DkG=Lf}peu7h
z4P?-!Q_!&q5Y;R{Kr4-MS>`aE05!=^fUXhEVVT3egB?8F3h_M44#qE_Ceath2~6Ok
z4&?t_mN_7!a=~>0I7*o&%7FdGG*Jek59GQptY6p|(^<Z-&0z;s2H=E{&a#2$01v2U
zW&+o;EMHjvfLj88SQoIdOfs$qMac#pFbiZ7M9~$t7i^5VEHBtTuz|YDAK0d_vrICn
zpAR++%mN=o4AKCqep$b;f@bW$ur2`YfL*|LhK(@?a_L<bBsszZ0o=?1-G&D;{0m6g
z7q%(vjOi>>*r%{F=7Y^=Oh@z@zJM}EF3SP77i>!H(CQQ|HMcQHL&q`Zv%FxN!_Jrs
z4jD#Jgn=B$vV{8tsG>Q+eTJJclLeGmq00(bR&ZYcb^O3W>7bn(pipe#?BHRVD8bUf
zGl7SxPl9Cv&jJu1Jo?MPz|z7whYJ+CbGRn(uy;Tb2}BKQz1zV#0n|aCz`2AIRKc<=
z;oJeLCnxaC0M+fFyb2OV)Vpsuzkr%JUpPCsz^%v*t~a1YKS(`@4?6A#R`a%Sc7Pfo
z9h@DUqDX-O%ES{Tz;$Z}=L%43Wd-LOPEf}IR4{;|0Nfr0`SAef1y06XmJ6J3I62xG
zpqk!r_HcoUX08XI(gb8NV=AN?fh39!&J7?JZs5GZ2}+qaINxxpPBOxb6qq{@(ej3K
z2B?k)c^Xn*|KXa!4UQm|2JQvijHwLZ`uY!~OV$G_PA23r2r#hx0ktY}7`Q>K2i)*H
z$pzw10H<mO2Hm}|+M3n=|Njpk7(iR+SXekD7+`!E76uj;867zP3k!n`i;WMAFRs7>
znl$HNi77xABAPz~Vgy`0A^r!DdI1r*dIEfj4$yoRj|hu|3``41h=GNL1I`DXCc`2j
z!=hk-Dx{!-%10O>3HCUH0E-AbtRO-NQz3i?7MKwbK92w@-@*mX4*-X?42zBfx)7Y7
zgX(ulFdyM6DbOvJEGT{j2_gGc3bfz>)vpjCgkK?igsIX3AX^z&Sa>8@5UL=e2=74n
z2=7Aph~R<n4NO=p;NFu4`<RD^MFt-3Fd>+arDH&LBVrrEN4QP?4GTjFOHB``Mw-D0
z)1|<}!l1wslLO-`T7XPJxLt7vh>wUWMbNT277loVP?`aX3J!QwDS?iEW08R;AY}y>
z1{0Qm0GRp89V`qEEG`KwDJ^g}DDMELJ07^2KVUoId=(uK9}!+EpaZp7I1us>H^BJ@
zXF%!^ZZ-tRJwm-9s(QvPpcV6oM9;Y81K3Y6^BA{$0rO$WmvJi(3j+^}0D`ZA#s|&+
zu)xEFacc|6e>t#x&$tyFMhN*$Az<@ESUQ+bFhc`@akB#0P*^}RZms|;f@NmL%{?p(
zNI8{p^Bk}|+|ipCfcXghpw;p$AvvJQJ(wLEeOMSISY#C7eAIwt+?WD31Mbm{d(ij~
zKztJqsD1_$1rT3Eg2mwlBg+b=J4`H3n5Mvd#9+4q6fF!KEQp){5fTt#k<fsd;cx_`
z3hpKb5TApE2j&I_&<!3eNSVt~1r)e3F);m(J|O)(AaAi~z)NE%a1uh83gRQ1>XZR;
zIU=(-flhG-<zg8H78SVLoY71H@sUjdU2?>L2u}v*4p1CMM8MqUyat=wTwFk+2)BXw
z$fknss$xJYJzX|{)T8^*%>?8F4gnSc50;1smV^|Tr5*tw<p|?Jd}QN2K*u#9<t7hs
zjz>4%6P$)OFg{>rX<)ekFR8sXz{STJcwY8F3nCC7**2dHkZTa7l+OY%Uxr0N1u43G
zz%>;M4+|)1$gn8vfSd0NI(>?TM}S2{hD8Bhs`%dknS$^m==NMtQO+V`!{QLbl2QWN
zObiQ<Kpv1{30SIU2m~E%z@h-JU4lUeIkCvV%iiEOAoUCu4A7cB7|gdol%XLLKnggH
zz#SO^PCYDh7+FA9#4$kifi_`-9VGxS!$G^NWmtUR{s<2NH5ybxSYqJO2ihJg0owi*
zPy#b30-Uui5?BflZioSgBL`B6zyR8i#egV=7?QvVfd!QRSVSaP4DP_)n+%RL4sdWI
z0x`J;RKiSQ>|kP<z|_Iaa)h~og{6b#2n)*@mIv?@kUW8fp@QWL(-$U|D=ZzXFgIp^
z)-<qyVh~mWF=T9DVNhYQ*#oyWYYoV^79lV_MG7no513e9F#TX+X<(iKFF1-qKv~?z
zhoxo-6U!E+BTOu3n4U1fb%9Gy&=^1DhCa|fUY0GOUGN~KFjd7GEDRnj6%*i=7asse
z8oc5vg;Y9l*On=O%0?S_DgYh4#ls>1m#>ll=QnVeA<|Oy5vZsLJbBerurSoHOkhM<
z4Z1S*11rl9))#CnAK2D#vTWhp!^v`l^8_c%wV+!ex3Gfl;ACYv!@7r!1$0*@vLxtQ
z$RqH;t^=LN%c5bxl9B;e^aT`oh++|R1*HOu#tOLqK{qdgQVWX-+>4<57D3H476TKQ
zF-_oh2M63Upu3nESX|&Gesc-fzi{~$8wek%&};$Mb|*lW&s|}B!N@X$Z2>#X_zrNf
z%OSu5DrVsstOH!Yp;QzQAy8=mFVeeyfUV+T5y)YwsDYW-18#<M!0K9t9&p}7Nr$}=
zpycEbz_NvL4ik8YAEp^3!@>fZCt&%**n%q8w}*uxfF&XUrna94WQqVhB>JJwfy@5^
zI}cW0GfeaW@dXlCY8pVJ13mDFm;`sB1d9x)5M(j1ff+IxSq@%mOqBs8T^@KyOa&dO
zid2G6g|u(rR!@bthd{-q1U!_df%6TbRWuFKYJuyT23jk_VgoOmW`S<dWHEv3p9P6}
z9#C1LqQPQf!D6!lQsA-dVBEvVa)j{)Bg+J)1@MfDrojeY;LcgV!r%frSt10Ud_h8>
zDjXINbHNR3NZF-u0UmbqctBUFvut2Gz{GNaX$mvT50*dhl4*Vd3xfbs8+zUZ(Cs>)
zB`r)WJDAomvut7B11i<dFtc1?e!$G~g82=+$eDkFg&~KfriBrFtOm;*#ubd<!xUid
znSTakc0~i+CG#JE1WMrPaKRE#bVG_%P<Kg%#bpO0%K^q2Oe_nSRxq(_0Nnv|hv@(_
z%L(QV7M2O1OO0QE21{13?O<m)z}~{a(!;R_-ppPo05XmR?zcrxK+S3sM47Va4M>3w
zJWVWC0i_WZ4n(t-VKJn22RCyuxGB#gz#<XA5`gf@(mNoXpsWh>>{9TyBk)OXFrhUj
zEDUQ{ShlciU}f3CdVr1P1lt!jmOpG;*je_lAK*q-*29dZ3?{iY1XM&#VVVFB^|cc~
zc?wjytFYW*y1~qHhxrLJ%NynyaDRh$?XX;7?m>uvyEQE=h|&<$s%2r}P+(C(ly)1z
zens@wL0c{ukQ$<(*0cbN0KBEP1$1r<ivT?FZ~p_T4G?wXjsnni#w<Hncd)V?U_Hai
za)tE)E6WGgDQqy`?Eu#=Eb#JS2RswPbJ)%oAVU#-tz8$u-iJ3gp?px=2xjW;J)p<|
z<pa1Wd$xdLzGMX>%OA!!EG%DGzOb<TLCOXY`9F*ou*mIw0=5xesqKgKeBh1k11~^k
zBZBSV7O?fOGJvtS29)ZjFil}%X<_bRX6b?Cs5Sg7TlnXQvMdqZBg%3_^oJDG`HX$w
z@@#|f6POK*Gr{dj9s?GG7oeK|1FW=Qob>?IcIJV3lW`)XeJjHv)56Ho!U!)v87G2H
zfM-D{oOB1&ssJ@77l0Dz8CXhToV)?-8F*WgaVof7!6SpH?-)UMd8}Y&*?`m$n>Gg=
zMt?wFoC8a$jME{dp9G7<6h=t<j&X(pC@>J+LWmMjZ)ggvm|z55I$^>Bx@`g;B%pgH
zKvzY;1!jPnNgA*^fU$1|D3u_p<U<p{-hebbWLQ)*Sab})rLO~vhYw4|4v;&yz}(4j
z2vQe-Rm&)_IJmH!V4MI8WQIeK4jouFW)94i3`bHxUKS8w(Sax5W8m(ihy+W@2Dq~0
zb3l!MMEX4q?hbPBfNJxc6L4kcU$8Lfu;{?s6c<WBrt`oY?GwNf0`I+Dgf#C>SS)Nn
zZUxCjuq42%h0EX$E22?$MFSKz0dL?Q0txW2q##;{SI(e>mI6F;U3~*~g$^j_99&p@
z;H}VWkTeet6A1+t6&+CDfu)791MVS^3I=f31R@PD^sj?9BCt4kumps#L?p26U^)S+
zmRdMjdN?<5vh3ho!NanF=LoEe&Hz%*!otA=(t+qCUI({ed;(Z*Fg0+pbZ~;(hf8=^
z*6<vF>%7STDmoD(MmI&k`4T<`chdqSkLb?cgf#t;Yt);dg9cbQ1XxUNz!S?&aH8fB
zVY$LQhlOPW%M})uJ1l3|S+20ZfH&D7Y6L`B*07&J2sVI1xrL>Ng=GoL2^N+MEFJ7D
zJ?s<U3T}h5IikwH!-ML;JK%^!l&^O@KnC)_+m+WrC*&d3W!GnbV^4wQ4EG&wmM7e2
zcv-IS{^5n@AqJ2%3kwe@4&g%3@e!6c+$VThF7W<<D+XWcz@h+Zqr=Mv@J$b(;awI5
z50;P!mY4*V6!;j~U2s#c1d(5^gZ5#uJmLMq%kqc!3P0RRa8DXB4h6o=fJG#O1wItS
z01{#W#e#?piwiW}z_nihCGI1jo8M*#yb)rVAUs8wWsC3;VU{z(PlQ<-M5c(a%n{ik
z!g4_5jtI*WkrSdUH$-oUvb+%eA&P7U0}Bg0;amszb-~7wXwm}<Q0XSp0_uE$2X_82
zvCLowx1ugEv)o|*!p!oA`2h>d2bK@85|;sV);|yEJU5dSj4U4*8<<!+m=-Xx>|wgV
z#Bu}FWBdcUrDy?j3k%B>mML&;k0QWU!RiQx>n}j%%nQ*TF_tM}XCzs!NdA$8c@T2g
zJ<9>+7w}a47_>Q^1<@ya3?3%ufH$APC)Tsbl(6(LZh_}%kRS^ShX{*|3pn@2AdR3r
z0VhU8d^64lCwCSBs3RC>gFD}#P6nh2Z@}Vmg^}d};|E5TAB;V)!ijM<xTfX+k6m~i
zU}QPN2=9V3&H*<UR9p~!E5^Ac;7kpRJH~m?20PNo<2*>4orgulfyLtl3(E_Z2e3{d
z<H7_Mh69W&7eEV@-!QhoU9l(!l(pdPe#S-c8UhyJjEi7-MdSvk(E#t&GcE<4;lOf-
z@dYg0z#?}TSza*yfD0{a0J&So091xYz)E(;Wmmw~!uwB89YCsF;PWF-!Tlo%85SRK
zlkWx#%LAm8^o)UpVFReyK7pBK4f7s&Tt9bVVX$GzsDQ=<1Bfqx#D4+0gaF*{QDBKd
zl;AHqSQuuouq<F%0V?J?SXm~p{$Xcn;h4g~GKb>>2g?u8(u5Yy9!{1ioGUn4HgIm?
zX4%92fSct7_ZM!KKip?{Sg!Ew;b-X(SRlx<Lhyhv%L(BbqAUwUuZXkU5$};;nIf@A
zg5`+B1qqfL5)WYE$^f!9f~A24(VhkG6=m7Md;snvOp%x1NWQ>y0~Uo0;2okY6PR8w
zv3y{<!^-l6^$RP@AJz+O;NyW=p0K@PWBJ0?!Ok*)eF`Vb9L@urEGIaxaI)OtT*Jk(
zg=-Ek%M0EHewHO-8^l<4h#e4vh2BeW0=>X`0hWjuUhQCEh+s(ocagyHa)5>91j`u~
zmMbiG;Q95{18~&xut*rNSj>P#5X%u}Z~!l1VF6uD2eaW7xN<c(!NjtJc?&bk9_9%w
zEHhZ<fU1o(aPvSLHhDl>F5!U!+EmBGBC~*rWd+k2CYCEq;9;U2%q$0(SAe|Q!@;tF
ze-A&)5&kpq()Vo#v{$)@@c}GtGJphGSa{%F&$pmWKrB2dEK5K~K<$8xb^TyrIl_8}
zjirIFhmU0n-yA-e>p^>x7+6>=SU|_azy#m*fJT-A3Rqf@8r`71LL4kSGZ<Mqm{-8P
z@sS4<P>9J9$o?Ld3w$pGSUw1>5oFmTctDWlh~No9mKDNlgkd&-l!01#F#anQ7KRj-
z9=;{80*K*L52VBd4Is<`T@l~F1TK^jRXa!pc<>Q1_zn^RH$OxqSfHBDfJ$<NCeU^n
z1{RhcM(`FHnDw7FurL&`Y=Lym5T!Oq7-Sq=88|U<2(WBmz60u9Pk_hoC(vcdEO(fH
zzyszBV!Rio{Tt}G2^I->59~X5Kv4kJ^<V&<I?KSq0qY+y`~WwTRp0|ZKOwDsP!j+&
zhX<NXvte=ZVfnx~hmB<k8#u2ZWfOLmIqYlLS+=l)d*2t>S#GeO;b6JKafgHD3C9dh
zmIa)1xL{7hG}^_7rGse#_z)V34F~6t9gG(kQ99heEI>(T3g-v7D_|lg;G>2RkvW_T
zK+Z)7|A$Oh!OO`1;Oy$s11h!QEoVli6`&0REK3-dz%mOX%LY&*OGAgnU=FP4VPpf3
zv~%#V_`oY%Mt0Cqu`D82ATDNkf>b?luz;Kms`B8iB}R@Km>8_R%E)nmh2aYi%M$Se
z;w(4BABeMj5Z?kTH5oY-SQsX7vK$e6Aja}TtU(+a4UC*VEDTRLSZ0WA5o0+cb_G_7
zF>-T&%?HQ4j0%fN0;0Xe$PGFwgheEQB?H!)W8?<+Y``<YEHZFW9?+(C78ZDekdb!-
z3quPtO9S5#SaARrl0g*#55$JVfQ~;cfdx1tALyVR76l!oekPv?D8s_1MH%^Apl+5?
zU{O$DQGi#Q{3f7Fp;%6EgZmCA;Ee(P0v3h^Oe{UzZ@5{$aQ7g@H?S}~U}QPNwFWi_
z!zeHTbo(sJ7tSRDENcXQNU$_WK9OR1Beg}D<&1KJDocmz3sqQ{g4DVYsdNXZpM8e&
z4?jzb0Jx&tBgJw=sz;e+iSi8<mIo>a5T@<``wo^@83n-I&KI0t_*ohR&PcFak=P-{
zazLs>nPq|U6&02{Dtq8s#X?vZ?tmILTX<Ra@GjtIS;7B7oTWozk0i?x$tCcC1#t_|
zWmhaM%wJ$t7o+$dP!Nj*K$`C`4@&8<Fo0{!6YMM(*mv--9O0QEz_LMLg8<7GfgP{{
zl@T(r&jK45VUz-o_lfLbVL8IGf{kSZ+YD}&CEP#YNkIxSa3aE@GX>PFXklaNVf(_x
z(!hNMQ%MeCC4WHkYztUkz=}*p85WRd;Qb>;8SwBPVhS0=XJHY6^==tuz|(9z@DP_3
zK-CXg91w!&cQZ;aK^<+8jQ~}iOBj3DSZ1)jft4_fau%QxK?R;~<-n7*2y5g)ckZ$9
zz{f7+QD^oU6~OreF+`&108SXNLY+}@0jOIjgD8R&!J}pf4N9P!09iP;FtY4HYFG<=
zU}5lK@qvxrF@o0SsIaKO216MI!Od3qfH|XJ1`9(5%LJ7Z@bFRr-KWk1pO$2VEiqsb
zkYQ;6b>q)4U4WN?DjQfBmN0^w46tOSvIjD@%s7LQWdTwVstTU`fG?L|6uiK~@P?V?
zh57>>mKQo-bXflAe9>k3qdP&5Wrp4sLzX>;YfM?TnC>uTIbeFjl;wfx6H}Hqre921
z{+KQ>gINYLq=Myz`X0CkRY9AjSvcmv(~H^`7KR2!mKltQVprV+)SZ-p&r&ji4#VHU
z$Z|ycg*M9v?LXQqEjoX6SXy*v=&~%(-DALV#9)gF%N~;hCM+jR9+<GaFnMFb^2Owj
z2}_IV3R9R{KsNz^XA}`>QwVeq7if57i^&m?-W#xyA4WVf8$juAj`jy_mM_{rv|0XW
zH|Vg;(b)j^p%AP(pQC+18*Vwci7`WG4P2Q<1=y1cEDA^sCPtw>Ak)|AY|vrZqH{u@
z<%0eJW0n)fXN*~{7{4)Q`C|OTn5Ds_1L01v`YRBn9}HM-7-6V~I{{pjaqzHQ(b=NQ
z@<aE8KB~+WoiA|5Y4w0p`vg#<@B=f;59UA2EG;ZkK#kuO@R-xqVPSZ|$T9&j|H-KR
z0-P)0g^>otPS`*`qYk*Pf;a3K^-EY7Vi0qIjOKGdounlaYb016NI#H<InY7}ydVfX
z$1wqvRuD<U;sYoceF9h_z>`&1;7tNc2T%df!U&$h0QchOFtaRSUIJ?LUxE9<>JCWN
z9I-cIEMLTW;1#x;4JaB!;Qp|l13DkXpaHZZ2{A-!13Ey1<%P%#QI-#oF8>KJmJ4Dx
z#8@7Py%1wrBEAN0pp6Bnl*)mPzcJd>fDD|$cZ84S4BrbrmJfVAu<ih(tpF&`7l8c(
z&ZKXcSpJA?fQ^(e+M0mON`XzXGujz|%+i338Zg?`fam|<^CXORe^?k2SZZc~3Iaqk
z!9E65D_YpFM1aevE1;%x2fXBPNCDU8Pnh66SVo5rEDQ@6!3T7+++f^*Q2GHh=mB4Q
z!srNIl>ll<!5c=7I-v9fnJ&>uVVT4D0Ul2XDH#^96nxZ{(P<6n-gg$z0oSmU-~u{V
znZ*Io7<ADA`9cLz<hh>!_158o(2SsUA1o{>3qYQS&$2N37=Yp(zE+1Z@D2;Z3^tYz
z>{~ck_HZ14C)gm!S|<3^AY(9i+FU>cH0GO-!ctHIE=0jcg|jSS+Q7up0qJwzfG4rg
z22gbUVFZsUO<-o3fs|juB|w#($Q?$OC!oVNrZ9bAV)?;zfQ97`>jZX|8SD$#Syr%L
zfQ?NuM(BWCodWAQFh+@ht|K#XU~zF_@d#jvKqSq`2=G)s^BP#kg)!O(oTMvQ8d&GB
zvMgbJ0dIalWPD)b8;o(_^#brAS;puip!5h@!_G2?6+Ak;2VTua{{f}F11xt~Se~%_
z;9zOsY=FzffLqja*p`4=AzRp3cCZ~_V>!dN1mveR>?|ADcfdUs2U)%aZ_`5gJS-xx
z!EVO*1E8Y8!38vR5CX416ToxZJOL~ru;CiU7;qrn;W)y@a)xUUH_H+3Bk%@hj0q?Z
z_Hds;h@^n>#vJZBaFL`hpfYI#Y!v`3<$;6+SQOwzWHRVj3-EGxaOA_3CI0|TA$UZv
z^svCYk&K`Nd^;FfCP0SSz+=@vSXdfZXRxv?V12^M@&?q0e*&43yu!h9hvNwc%NvLX
zZg8<Y;QGPM(!kTf!!m(q3cUH81|EEufK97dIIy^Y%f~m2EMGt?0#>kGU}3qz@&%p_
zAsQf)FfKkUJ)qIH7mRP<88Hn!ZKa^X0-u^?Oao7(!-s_#)4<ij1?D^ORF%#E%Giij
zL%IbELk|=9YIl|f<|E83XPCh)(J8Dfa}ZOGjGzOEK|OGm5O^t;4xVe7!?Fc5Yy%!s
zdjfYlOl|?F0$Rhuzz$v5%+Rr&6~boRWWWPuZCP=J3Ci5$@Pq}*+;HFnOmrIqOzAd>
zHH=XCZ2}xH)(H(5>jPAb$@T!uoL+`6(opGHKYXC9*&ZP<)`BT8Yv$~L>SmmCphFZY
zzuW^RxI6%6<njmum~4j*XobEOYymfDy;27wbR8_q9MCz;pnDQvs}@dx_feccsAgbc
z5nvH%U}ouIUIAJ(&;V-OFX3ca!}*1WWeV>cUKY@%Oa_)Yj88yQm~TLXa$lGjAmdsK
zSk{1s7~g;<hrh5wRsLZ6!^YCU-onn(!H&qdXV_UTu-{;3c>vld^?`i}Cj-kG&JQ3f
zX7DnwoZ<Y#$<n|zg^Ohd*Agz44WLZ;0@C|y;9*(9vxJ9%We@iYZk9KoA<71xB_P2I
zJRqNMLifuJ(8A0oEG%zWrm(Xtfed+o$3I(m7+9t-o?&7+09xh++Ihorh2;qgOwAQ`
z29^fa4px>P))lNQYgiAkvK#?TeqVrOw<+ulpzW6&EDJccaIoy)IK#nm0hH-paD3rl
z`NPq`$<o5v0~&zb!Nqcf>jW3eAFe-K3@kldTew(ua2?@dIl=V@B)Ebb<Z1{8Z@OS)
zVBuimkpqc{fCyMZ1+f_z7(ikm%m5XafQnl%Fff2Ou0X{DpyE0%!Ucj%buAz+IB7uT
z8$bdK3=Aingwq6>>Kt1+otn8_+S%JUTDYK6$mR)oKm{F~v6?5;0g-2{aT3lEWU6at
zaB5?8YGrb6W@!QKtpm#<xm$z-EW*G5+I)>Ht^pMX`2|@VZa*{(p#B$u+RNa8CVm2H
z4#+%Yb3Q=DZ5S9BR6uM<c!(N+*bEE|9ZpdHIW>dx21po5zvvE-00RR9C@hi1UqHn{
z<|2uUf$RrKp^L-z2#27$TkHTxF{b%qFn5F82?`si|HVP!2hvjFD9BU?VxXo2@flFD
z5F~jde~ZJ+jez;v5#etWkX}gmNI=7%@q>$So*+|QFN0$zi&qb0H&YjL2WvZ98+$89
z3uiMV=^*Ko0;NmPp+v;!Lkc$;Sh#@>T0$1T0CE!p1A`AVjG*Bl3k!z@F2Y%YOm$Ap
z?5^$1Z7i*<E#UK%z`Bt9Eei|hDKPbHE^W-MEG?h|^^nxbfsW1rX%2y<d!+C|a+ll&
zkRk>Kh7#0tB@gpQj}tiD+87*L8J(M%TR?kxk@U;M(iO;mNa6~x^j*Qgz<?C4icsqq
zXF&3I4})Vfr)M`~7gHy52TMC^8(S-T3oMTznWqFx4<NIU#X<Ih%mnE{7QX=!WME)G
ziw9*``7s4G{i?vqBQ$eVVDSUGKMKiw6<GLy(loL-G`*phcPfxGj~Ez0=?Ymr%wM3L
z(xAKvO&6*lcYxBL25PzF(!$&fathdYNam=4@)t-Dqz_pfWFJTz<X&WPn0r9#k?d82
z=5NLVCvbXnX=8S3WpQp{ZAK(V<nl)y7S4Ad>CvZ^wVB-uns$-WqXsOU1UQ4sS*I4b
zFHp)eO^|y)?tS1QoFvFp=hn>E%G1IN5`okq(D2cOm0KWxBl$}U7LRD<sunCi^q`hA
zS}=18VC4vEy3mH{1BDlof3#u#34x^J76xZT`Ge#h9q0{IETHldDVz<U;mq*B863{e
z9Zc=aPHikst*lPX?9Pw?M6%BimacBV?8BO$88?B#0~A`IMg_thj9WnY0F<6U?m!aX
z1PUk6w&oNRe=}}?mNSe6sN&l|W`i)A`P*ROz6MP_)c@ea36SjFhP|F++y*PxLFoXY
zp2-&K9`M#oP@aRP10z`e%z>42sPStw0pwT)28I|{X#I#<{u;sTI|EJc?aWTCtS)UV
zEo{w@I|fk8FJq`X7{9m(I|(w?g><R6YdN=RJGJUKHS4)|YIJC}=t8YTF855K>4h=D
zNq9y*sNvEX<kTMG)E4U08s^j-;oK420z0h`Ie(eM!u5_DxV;nG!sXNqYkDE25Az>T
zO9`m6faO;YSa>0&Bc$|c2@BURkZ^HsV|H$4b7^OSRyAPTknFdDx|7kxNq7&)f37Vi
z&8A>gDEZqOl#f8^P{&C)MUbh^wUw)dyBU<2P|^*94J_V{pvIRiEI(d>l#5PnOinE<
zPR*=Nt?=d=xa@_d4?9?X0Hr0QbYln0Pbx_H9$6lg?m^Bsf#o;UbY%z4PYfn*h;)S%
z9(E5vni&`vUO?RG+{)C#>;x^kk?gUD<%0?&dyvd=faXsI6G%Pm2(EykW+TOy1E`(_
zg{uVAzBVSOR%YjBRvhK5BP@IaVD=)FUr6RULjA$WK%BWwF!dsk_7+OJ0m)y^u=M%^
zi#jCxU10h12P7SKGB~v}IfH8?mu9vO#x_u_Bbn<8E6*=L-0RfJ?9$BI#sm%qBz11E
z{K(@BZQnSxGP<-dHG|AUiXV4a{2-?TBy(WNh~W>!KG$XzP)tK22-J3lrbADN2m{j{
zC*cf1rn(*mr*1~4PG+YL7UwoLr&e~C77mwY&Mu~QP(u!?7|9-QSh(^)>~Ti!q9CdB
zfrZx%NVv8#IJGc3HG^7hDEZJA=C1@;xrjaf{Xp#oP`Xlpguin;QyViR{GH)V0wnwW
zVF3bdH?}f3BkV_tSASSJ^a5h8E67|>*#b8dwLKaDEq56XK;o;F!Ks<asRh#2L5i<H
zSo=-^DPM!~J~SQz7eK?d2DMxXf|Yl7oWb$q)Xw76#_H6{=G4sL)B>#ukj#OfB?&4g
zkn9fz@j+JD!15Jpxe*L&Z{I=c*C6Q+f#u5!NbW}p-%x1z$*==U`HkehFlc$q016LK
zn;Gi=Flc*|QNsmXpE!0gJ9V-+wXr+3a=3yzL@lt+5Nf>_4h?_C21t9Qi@~Ln(W!&U
z30z--nk=9y6XbDJ|3<>fFXVC-$vu(Kb`awVXK=VXb}@l+MLVlgE4yn4OB-7YM>8kX
zSmb&!8rH6WmJ3d;EH2G#ZOq_)5K=hAfZ7ot{UCoMg>wun9atcRGqOA^eeOVtN2GX&
zg~d||EdL<Yqe$xFVD@i-nS(<etUS_zl=IHb%uev49?86TSoszL$p?;zQ3{m&od65>
z8PM{gnYEP}TnM7(s|1)o8}Qqk2&;FY?Ez3DshJ%b=ScZF2|9kme8O2cMv$q_vqiX*
zuY<o`piQt<s2LnFDDF&yrPB_G{kZ&-28*vb5Oq$-;e!-!=`epUfQ2_|yCNN0jxvDC
zDI|Rv&~lDJ14$oJxMx89#V7+QuiPMAbVwT!NnIu^|93#rvvUi(Q!^|LAghDbe=U&s
zfiz-32^BSdvOxJ4B-{Z}=M0KPr)Eecfn;7b%#I1r@WGKTvO)O(WL^%;pV-r54$Qm_
zu>65kKOotg15LLKXCU_Cs_%1Q;{iV){lqv}nF?|Xl6iSB|E|E|KBRIZ9~xhbEl$D?
z;O4ZpQ@gHHo1RmvzEiWIbB9g~tmTK2-U?vl?+l1L{E>UME+EH1#*GR==>ya+s&EpH
z6J)A$?%{N574V<LJdtGrYd>2bdoM>fR~L6DPX}*1UmJgmV6zZNGXx{$hhkW{DdQx(
z3)C)lZZ~pjGj?h<ac(hfHiM`~@_z{|eMUgS(+N2qk<2ZH_UjoJK-=4ntwv7GChi^j
z?FMazEyiGjk<2ZF<?{qcI&wm^Mp4429BMAZ0jRoGCWKNX^U9IZFKAp1rJhGpR{@Jp
zczuX{e6j)>PUz#46|nXUDDIK+Yb7-P8IbFFBzr5N@yFl*3r9#32pld*;aCYvmlq)U
z+Nqt%2|VQC)WYfnYl|S6TLmizH$cM271XqBWrk!(Bz4uW{F4B&-x*$*qvr2wX#L0F
zgQY%4HV>B1py>ivc-KJdMaBt`dfKU##TAsq!R=(E_Gm4%JY}tM0*|vyVsPwb_3z-C
z$T)$ipSh2vhpn5vi=&gXox6>vmA8ej8FVZUC=Q_Qh-PSe3DhqDwP!&sSa56BsfEL-
znbR3Gk_QfJ5P{^67N|ak3P|`l!s;ZDI;8y90xhSQPe9YR(*zBteod!dZI^D{E<LAC
zedi8?c0=bjBd1nlrxp{ZW>c3wtsZd9B9H%fz}ibbu<``8ebNCd4=j-SaY+8`fY!H+
z8jyCoQzw&C8>@3Gn-jQTckW<rM+{_vZHJT}UC?-7s)3X<T@3CWOr4Cdp<PJ5fs~$m
zVC@MU^-m8p{u!S*3HO1@5!cqlmZaunP_QAli~6AP%5Vdco*i3}2JevU>xcFi8J57>
zFR0-HKU_8eDcq3aaRMw~&w!+F7aZl(L}>laSOE<`aLBo|v$V0ot3_n@PlAQRA4vbD
zjlrXp5!x+7RyP@{j!^*SKJ4|=6j*o^xPtq6DE%R%@R$mXF9sLv;V~7K?-OA4A!>L{
zg~ks9d_Dp-pHG9Cp99m6<X$9qOoN4M3{w99DP2v2)(^}RAoE||UCf;<pmsa*L<W-j
zS<v<fqY7l)wS&Q_ozWRQXyObjw!mdBG+)n#<~vY)fyQSXTe;nvc{|xVINCYexLP0s
zHAv>qh5C!R0b+hTgKG<O8)GXIbf^QIK9S0u1<-h7>420wj=ii--Rw?X98R5_P90oM
z?c7eSyiU#huAm~Qji-eVWB^jSTMA82pl}A&JBUUyYIrY&`8&f|H~}=T(#q%D!tc}!
zb}o{6%V725A4q-ywQJ!+e@N<<!_=*SsB>;+a{~7@K<-0|zZKB<V>$v$m#FSq4Xc-y
zK*~Rqc}ApiXEn6mV{>p44iRLk^KOyp5$P7~66+N2kZ6}|lWLW2mIc`j!btG}8~<gr
zftc?I83$@%fz(hS)hPA-W@tDuOmPzS0kv~ll$*ic2B`!yAm!N>SbcT?qRz2d)wxx<
z1*`%&Uv7boEA%)C`+?0<YE}lB1;Sv}5c9Ue^3x7Tx!?#cPC<%L`<>gs5yrs47U3-1
z04n!fI&#``TMC?-3*EXiyRtg7+wxi=2ih?(fX23=>39#cUS+!AEc~DrG|)JqnW?Xp
zsi&RExx0hOrL&8vqnoL{hsn96pUJa%0@K7Mrv4VD-ZrMLPNueArq({B_5xD8?1#3G
zK>Yx4y$9*9cCa|LvpTi0Ik&PyDnPJLko<c9>R(0yNW3_;G9#M&Na_wk-OVrsRt_PR
z6X5O>B>WD6Er5<;Ao3SuFI1fO3ncu5nw2IAPZXIT+Ar28-Yd}~*)7#2-6_){+b-88
z->T38o{vMa{}8Oz>;Wm)TNzxMnV`cg;JHg^_#T4RAB<O=!2LX@No-CN*_|eEIQ4Tn
z^>I1(a`*5!b@MuP@i}z}IJFD9v<kO~I5mqpck;KvTgnJ`GaP~TuUG_}g&%?9%ekYA
z$*H}Y$)mfSsjGvjvy-W<hpDxfsilvpxgQ!gNbzz4TF*0jI14`m>33=EU~1`Pa&GQo
za&B*9YHNq;0fi5ee^0{3ao0fN#krXU(d0(TSEpd{R{|-woZGpb+IU<$xZsT=1_lNs
z|D1--OR|JO;=!p;+^JW>sY}|qQ^pw-?oQ20?)_q*_<+O($X!VGU4XW48GRt`f|c7Y
zpqvaF>PAw35f&dIkn+i?joBU4?gI_jgNz1ar1sS%sQZ}CI0-+h0~L^6?TpUtU5wr>
zy^PI$jJ++4J*|x0ZH%2Aj2)efZQYEmJ&?gRXqtnjgR9W`6*TS-T0eo+ok-zw4ceaK
zV{s7<5@f3L>Jp#CKT*JMf?&T;pKz~8k7&18r$mQjyHuNWt4xb*GiX5xBEA@B!TKFO
zkp8t3e6kp&K4zQ^D`!Js^({)d!Z;h|ZV_1f%(;!lxs}x&RQPu?f@b5uK?Wue`Hpc8
zteyvzhlucJoCEE@aCJcHWv6B?SJ>(Tuo)l%$(-dd_kqko7Ki2o^m(o)(E0$;Pe4s?
zPod);OnV^nDvsSOPF<`{?Ho?cJRZGFJ<OeK9qetKpxG9XOCT62UZBy!!1KXXI0BR$
zTEqh;aZco#z}?T&$J@)-!{05?CD<v{A>1y~CfX|24628b>b);8_rd2wQO8}r!u$(b
z|A6o>!&hi~g8}4kWO0~-K<W|k&+rXe{xW=kq;uys=4Li$(7-WD{4;!q<{yR_?Dg<>
zSijE&mOhZiL6H3Q9hy&2`k9D$XZQ~FH=_$QJ+`trx3If3bAVd7kWfZh-}Dpa{tQ@u
zkAZ;!DPR7Crb{*f$oQEfxHxs{<#y`fap~sm;_Kvx6sS&ZLN2YsF3qCO6F6GH0f%DF
ze`vpkX$7Rba+<*8)X(hH$Kuq>3TkSBi!V@9tA)?4nIF>I>wv6+L2e%~GQrBd8kl>L
z!U+*CjLgvX5fcw2{kybq!KW#a`eTgCq2@6dAjJzJycw6n;zb8m|Dm*>7+GQI;te$Z
zK?`M^Al)gX@|Tef>K-)(C-6LNV2ko3(TQRc#QP=sBzvWLq`PIhWIN?L<l7b66kC-b
zZ5||d=)lSu8<@XQ$~{J1Xgo51fcV!LwEhgV60L)+oxK%0VvR^AjE2zk$au#Ey#Aq`
z!MTOm1+AfsWWO<}TmYpX<aKb!@=*I3kmZr=GlsPzZouqw0*~Z4w=p7G=1B2p0xdrn
zLLmLFRt9Ip{0gF;Wi)~2S78H)zn$9Iotn8ldziYJyI49|JJ{MdS~+1W@sRYv=Fylf
zAo}pG`$3dTjNYIyU|?WS>~ItI0FCo?%Lh%8m?$|xs$aTKrdPH{u1ld)u|ug{xlN^2
zwMDI29jXB<#mvCK2x&i|N;5MsFoDGxq1gs1&CI~S3>IgC1rJ1mnSp@?BJKqn&j3p>
zGcZ8TnPKvU_H)3(phK)77l|>&z|uchf|&ujpqHr*RzAYSIUwfOLEAN8VURhTP;qE|
z4;SZxibMM!aB*&^IJ$dypyHtQ8W6<{;OlI8A>#d@au->g4=RrC9)5`U1aMr#G%zzT
z2tdWbWgC*XAXFUOR!0&Sf{KIIp}>Se{uPFbgVv`Zi;F<T!3#uT63h$?qEK;YI)%tE
zGcbrj#E+pwFf#*#I7Iw7wEl*xmw<}H`ZHh&W(EdHs5q=%fQd^%#807{BMnx7MleI`
z1T<lgf8m`vWI1LA22eW)SqRK#W?+y9GtdZT$of<?QE>c%8~o@J%nS@l=wcu~GXn#>
z^9JI>Ff+7{fbn58GXsMvjEzh)Gcc$j^Py};7KZ;Hp=@LdRQ6%Zr=aUBVB&~TH%J)3
z#6fytW`XR4iZg=CPN)Q^e1VB0s|QW$!o>eT)q<!j&;&R*ei;~%<Gl(=95kN{QVYVJ
zNaD!p6O<;Q<}<<iSs?W-42W<*E>9LA%;7x)QV7Lcki_>u#XuBjtqjzBKIC%X5<)#6
za(;h~5a(Y4G60G{Bg6$@^$bYrFG8FjDSQ|~)g9Dc0cd|6q?{2c`~{H0fzbeayfa$i
z5cdOJRu2h(L6E^9EW*IRn1Cb>YL9}%Ef^U1{v(Nl+La)29R>!*OeAqw_?%#1U@Sz4
zBi4&EFfi63i9_2Zj5Q1ljI9W9<n`c;pfLkzIEX;&dr;elaVnB}SUK;&z`!^MNgQfE
zXgxUNVkB```J=(Wz_<!Y9NO*#wRspfA;b~u!5J7Bk06P|`YoVvxQ-+aYfsrQFfcwq
zh$FB6W_*bx4r^D0FfcHFLlTFTdpZmZOw8~Le3@!t_6jgCFi9e*hq>Q?fq_X4A&yuV
z&cMKV2T2^1cR=wN!oa|!izE&+CxU^2$qFHkSoh7qz~qi_PYu*PpuQ|qAVNK2y*C2`
zQyfBl6*T=bH83zRWgyfeuk&UqK@x|R4?YYGOi1YmvCf-;fvJ~~fdNuqFi!&IWstvE
z7#Nu5Gs5ey12F$`FfcH!L70zN|INU_v<=A|SiJ@^=O~gnuzDY4&Uu76i1pzN3`~y@
z>Zicc8_1mZNa|tcmoP9eeMhnvRt~c;FfcPAiNnfOkT^GzILNOc3=$VZ5{HZ|GcYV*
zU|^O)*o#<)&cMK|jU*0@M}`Xw49qSFb0)&l0|x^Ga|Dt&tUV91w-Djq{jhv@fPsOz
z5n(>^`gP{XNan!GJw^rwW>9=V<8dM^AA!u@i7*FN-7?N#U|>Fil&)aqyZ{3O^Erfi
zC0M+hFfcIRMRF&sy$ABw3ncZh^ac|Dfg}#?|A5xNv#=n<m0{)H6b1$s5xBpYZXu-;
z7BwVsSiFO-YcW8WgS=jz#T`i;<}c7z)JP<8r1FrZ07)EH9*Qt9upos$@_Koe2}tT;
z;giF_z_Jk`j#w|xz`$|=DcoS@b1*Ql+(r_I)e9hTr0_&uN6+#HVZIu)9AMC3U|{7$
z5{I>iIT#pNrIEy;<s@kRG^-ZE-o3E!VPs%nwL=nzh0g&7239YGIf(W33=FLC2yw)E
zdIknor1A%`ex8AW6}0RRS|4e`(x(9f1M3uoImqkfSyv*(J8WDO<S(T91$iAk>mh{u
zr@`U{r2Zn3IWYgSFfg!!${9$0VY&uQSIh+r46L7#+yirG0RsaY7eX9)9X=bP++ex@
z9WP-xz`($!fTSK)K7=qZu&E;4a}KH=G#boif>4jVPM^&dA&yw5&%nUuix4-2rK=kZ
z3~bS$TW`Vb6O{G$Y*`3#<n{M#p!kCJH<8!hvw`9ZDvrGVo^2As9OU))YzvUYVeOwa
z3=C{*k;Gx`F%AX>wmnGVuyS65fr0HTk~mWN$#x4aj<Wuq?GYjz5bN(57}#DRiNng1
z7zPG5q;>*gy*&d1JLnc8X!=B~t7l+fN6KG_b@L1i?7|515$oa^7}$~O3&c8j1_pLT
zgnGofcLoM_LxebDoja&2ju1zzXJ=qw_d$pw)~_=#u!keWk=LuUry$Dt+ApBWj)8$e
zfPsO%5=k7E&UqLZ*g^9d&~QMkZ)ad&Ux+Xtc^x}DD1M>pk;OUgA*qL@PZb6RcBJ~q
z4mRIs!oa|O5=lKQzk|eYB8fxin;Bj(Ft9&^=OgBcu=wR*U|>gTCm`0dGca(nBFsUo
zV`pICU`7&$)@zIs3=ABii1K6)EPOZ^7&z3C#9{6Mi6gc55bN0)7&tr;<|EdxGca&~
z@+maj5bM+#7&vke>JjVG85lTf5#oq-=nM=T6A|Kw_2vu=9J3JOi1p<R3>^Cr;;?Zr
z(B2S^%Ls8;bTRy4VBmOy5J#*VXJFv?g%C%q2WMd5<Uxod)_*fFa7rV>Z9lA@Vq#$6
z)Ig|5tOI9Y;Iu@DBi4O0FmQ&z<DKdCD`<LVWMJS-MG}9BByNo`2eBTUfq@fL?m@#J
zvHqKZfwLE(9<k1wfq@gLe}q`q&A`C90-+vxJvS#(zCf(!W?<kvjL3I&NbOS2GYE4)
zU4O6-3K$qTFCdA-@{0`v11D0x2!_^Q40jk9IG-cbBi3&-FmQfFh$Gf*Gca(mBEsz!
zto_Nsz`%u6z9FyQ=2AzPgIK@Kz`*5z5J#-fW?<k7K!_vOUo$XpA+^U4>#i9XxbhI{
z5$mcM7`SQ>;>hc$xjNzQXPyY_zwj_HaLq&#hm9u)Ffec-#TR1TH3I_|Qu{3i)?VGg
zz`(T&$sDA11sABj0ck%lPlVRvpm{Pbq<#%zT{Z&)7gGNbu@0Mof$Jf{UvbcO0;3KC
z1J@^nIAWbO0|Pe)LL9NKnt_2E(GFpr2<!i{Ffec<^=A?5s~H%$k;*H?dTIs+ZZ9PN
zg2r$_2@zyY7{Xq}x@ran?qnqOuzH+>fkB}HNgUQM0GWd{zJXY8&A`B2k1!vxzM6r7
z8`R!_=2OIaY6b@GX$bYm>!`Uw?Fy)R#5!sQ25zK&4PyN?0|Pfwdk?W*nt_1_sUFXS
z_19V$7<kMP_9E6pGcfRg`hC#x-UG1oz`?-4gOvUe>!KMLc#y`65bK~B7<fvN!VT6x
zVqsw5LF$hn)<ZKe@F0~-i1p753_RNq?nJD2W?<k!DmM`8n;95*kj7OI>zNrCc>W^H
zL9AD1VBke+FCo?^GcfQXl^cll#taO+dI)n6>xvl|c#+z-h;_sa47^C~Tf}-{1_oYG
zI~E$hi1on?47^C?17bZe0|PHod5&2B%fP_92;m;&^}f8Tk;Gx`PZI_P-knJCf>ciO
z9zv)`tOI6X;03i~q3%QxM=A$U#F5&oDB?)%Rb+8Kr0_?qFJ@ri<3(~0%$*k)82IE6
z;)r#_3=Dio^&?`PFarZ$C_+7AT`&U!UpkUFw7g=7U|`@ws!tK?ei<0}Kx>Vm;ec4@
z%fP^gG!BVazstbDw*+B6Vtp<H10Pbq53wGXfr0NJLOo)AEdv7|sJ{TU7qPCEfr0Ne
zl6q*nj!}bwf$uj$9I;-Ofq|a|9`8)2Vf`8w1_pisg!n0>a*|&hNgSyh=9fdXf2P9v
zp*9Q*{MtzBVeLr~1_pj>g!(D4bjZQL!0(Nu9#&6*#AA@u!^$fG1_u6YB=xZNKS+Hw
zLj6=&I|L-&g$M`4I$#C{{uxN((0FHj!oa|f)SgGI_hn$<Ka5b1Sl`RQz>n0PL9FX#
zVBkk8e-P_=85sDH(m!JTE(3!AQo9|oPM3i}04e<=*5xuV2#6!xgII^lz#xFsFGH-m
zWnd66MyN-uw`E`uKq{{g>uebq1pE=|5$kIi7z7fL#9`%m3<HAz()cZ69W4WcKq*2!
zV!bQ_g8))HAF(c$fk9v?LOo*rD+7bTdPMvlfRzI*3=9JMki=o`0g0bM5{J!?fW&XX
z(+~3`*nAC09BG^iv5uC3K~M+b9>n@s1_ptT2=kA@`ga@*3<5~wT8MSB3=D#72y+nY
zVi_0&wGiTnb+8N!f=Ka&Sog}nAZP=3Khr5#`-F#qLC^=`o+;4u%)rIKAc)kDMy!uz
zU=U12*o#;X%fKL5j1b=hokwG|VPFtMntws8Yh_>%L~4H`*0C}$2qNVd#JW`m20^57
zMyyk1U=aL>uotl|m4QJBbagqj+(WE8Wnd6Os+SS#Mj04{kjAkQ>p~eAge(!^a{$^e
z2A!KA<b<#nu|AZ6K`0Cn&bMIcii3fH5vgB;SkKA8Ae4eI2eE#WfkCJUA&yvw$-p3l
z)c-}SuVi2lLJDWZ`bh=`A*B8<V!b2-gAh``>@>7p3OWx%Xdl8}#Ck^t1|g*OJYroV
z1A`FK{1jsSA_Ifa7lb*8^@t1%!bsx}h;@ey48np);RdZQK*MChNd4u*uzrmM1A{PP
zz6ohv5d(v;86v*+!`5}MFfa%s^~;_@7mhIPVPFtOO6SmOkb&m|0|QGuk~y$(W)21h
z;Y1{Hs5zkYAY6bD-wQQ}F@S+V7^yvvSdYiRAUp-hzp!xtkolnTLuk51UY{q7)Q&}7
zpC^185zb$s_JY;~3nTTX5bN_87=)49`H1y+3=AUN2y+nY@E90GklO!<b$1L5B1ruy
z#Ckgh1`%^azrGSyUkfrYh#<{JAlB0{Fo=Ni3)=b(rV|VdB5916>p(ad7(_}K85q#l
zfq=xD5bj5;vtwWo0rh{O>wGF;<74~`3?eJx>XFvdF))a1Mu;QU&oMBF>_&(q*1It<
zh#=|(rq{1QokY-lJOhKsTSPe2!pd7&1_qI@@OWpQh}3Qo1zqJ1?MF|7mBTCy45Fa+
z71aGz&~g>jzZO+Qm@^5s-T;&YHR0k+uiqftBZ`zSj==JT0t17nBf_0^uyiiKz#tlg
zBo4}mAfuER7(_wsE0}v=?IlqL2GJaZy|<9&aYV}z=2XJ`E6%_m+75Coczm8|53C*p
zxn}{AdT2SoAjZHTx&cWX)~}RgU=TfkBo3?JLFR+zo1pHjgpC)0%z1#M9u^LQ3=E<l
z5bl`<6L(->5CzSvLi@ARVD@q_Fo>}u)bD}CFAD>Mm@tw!%)cOUc_e$0!beOWDcq3i
z7cr#z`WDPRAbUamYe+g_Is<hNXx>B&l#ih9+ygDoLFJMdVqAjh7Azb<=78o~Vc`QC
z=md#3BHVLk4k*$Y7(nSw3^CuzbQ-#Dhp~ZyL2NFPe_{C@WX@6~|H9H09|MEfRwQxQ
z{2C7fgBWOj9O5r#L6|#1;dT|_o?Ec-E0FjTguT;X<`^(Ah<!tdPldJr4Hy{2k>YDA
zEWSYENaNd6VdGjLaU~>kp!0?dAaMhP_%vv`<;h@R5J#Ff+yk>$fPq0Ash@HSW)2Gj
zgLpWSzmW2~IC6Z!>N}8nQ2v6(?=q<S!S+@m+_M*!A3^ql@)s<AVfj~#fkAvaBj&ow
z0}Kq}OAzAQVf``%1_tph2=k}F(iKR2FOqs_G69{xD1I7A99lnu)^&&@#p7vYcY@|G
zp#FmQJ2)5^#6jgGOdQtV<X~Ws;6Q}iDcHO}4+DdQ1j3zDW1tQKsYjZpm;xIgW?^8E
zut20k_<m+d1_lWaggKL;<t-?kO9UgtCql(R`A!09T}lNkzl$+2NaP{hc^O*oFe@-H
zNYo(2FG2G!!v_Wii9Uq*MQD3~(Sd<M0;xQNkI#rOFi0SkhZQh$WEdDEK;<DMA2HqX
zKne$>@V^C(7f|^i@f>0AEtol=@c9CdM<!jUIA|T2BpX6p0ouOh6<}bH1cg6zp7aOQ
z{Td)~P`@53z5{Bn14tYxzbu1_gZ3Lph9bgw87#ge7#Ji${dZ`3SOyJGP<oRDl~+*l
zrLcSyz`!6m1IZj%`2aF!9g;XK9V##|NP^aZz|4WhFW5au>l2nj!+`;0&PRkfOQGQa
za*q^JIkN;>K7h=TLK^pg_Xi~y7^F-P<}87g8wv~zQlRl?sC$;c@?!u4gA`Kxa|tXQ
zK<0qzS(tiQ`3W)yw5|y%z8F>xfXo5qcbGWL{UCEd<NPpjXgq@b1*%V>;#*+x0x}1b
zexTx8VeSN(^B3W-t<Yo$GDjMzeq0PIZvz+@q><KREP=&~1OtP#1Hzoeu=cG21A{bj
zeFw7_WKJ$Z{T`(7kp`Uv2zBQkr0|gjwGW}<yOG@k%3o0NJ;?4khA@9OvU~0zi6e!x
z^k*b-q;QtuL=r~|XBkjC0c!6qSbHXbfk6hT{k991P9zu@WRUvryI|#y0t16g62kml
zu<!?&1DfxKnGXvGkU9NG>S65@kU5}w9IAdNtbGD9XAeUCPFOgA%(;Xl4y~s^@h<ZM
zA-)6FP5_znA0fUI77h{&46;b|@=jR!puoT&3o1{b?%4sWPXibjWStP^?0|&>$Q;mm
zGnjf<`2aEpR6aw+x5LI8LFTj~nF9+4kU6uF#9`$F$efJ`@$Im78ps^bY1lCHVc`HW
z=N^)JSor`l2UOld)o+8<vjGeYa-em3Q1R`saFAeNkOQ^<VdAj#ufV_{2kL)8#kaxA
ze~>wT2z$4|!U1FsXk7$MJuLl$%t2~bY=yPMLFP<EG6xn8Aaj-@iNn%A$Q)2R0c!qM
zSUV78&J~3Et*~$anez%s9G3nSK+DMy;+tXRZ~y~?JZPL5YW^0Oy%G!z^14XsVd)KI
zjx&-t%>5v9qLAuAr20Z0sb9YtmVZI!v?0vd0#gq%2dO>01s0wl_iRQ|56ed&b53Gk
zUoB6n_+=dC+=i`V|Ns9#tUt)Wz##twNgNhFAn~_2#J?el!^$6!`u_uCuLAo3*~>pb
z_R0*5y`at?w*4RqDvVh7?<nXB!S{0^_Qx_XC>RRB#Tk+IB`LTn!q->thvhFu1_p%~
zg!mCydjlk%0qU$n#trtv>Ms@s28AMo_+DuL6x453Xpm)s?k{6p3(M~e3=9fg2=zxm
z=MRJGNRT;G5cVEGHh&>P{K#gIV#qj;!bZ4%84>&S7#I|eBkWy|w0}zB0z!NZtiA)e
z=O&VSVD%1Y{lIgC`H20B3=9hYkkrH4IV=neih_u6=7g1#puKu(2z!@9%X20l1_nhv
zg!zbb3K$p^Z4ly!{eBD#ia`i-*2CsUK<3B5?PXk#Y;Q6`{Tf(10i-?$uAYGtw(m@a
zfkCkup}rbg4+?59Fer8*!v8QVJ+Lq^@Xdp}lL4`hmw`bMIUZs4Ajq6~2z$ZjFoL4-
z4g-VYGK4wE=Qt>?g^MHYb7x>s+>UV15tzR?7#I{!3c~ggFuj6?GXpCFgW?^8z5LL9
zNud2tiqDbEIR#BuObiT)pAq)XhK47j2m^!Se}p(<-zNiuk^oYA0Pi_vU|`^5U{E}Z
z<esAt^BGkb7?hCH18m-wfq_8@k$+M4)hk(m7R5vI9rFH4B_~9Dt%0RmkU2gG_w0rB
z-&q(KltK~VzzR+O91aW&O0h!ld|CpHFE)^PI>P*Quzo$r{6d8KTxfmDc7cIGsTwIf
zVeKUj1_q@zgnN!c+e@H+y~tZZ1_tOjNd+vw%Q7%1^&r$AftnBMFDuPKxMvMgd7`uw
z$zE7}D$Ky3v>G1%%#-#)!XHE`ZA6Gqd;$`IjI$~2N5t=PSa^cM?G(cN!?1m4An_{*
z_pFD7GbnuSBE;7~^AX4vrDq6pj=<U{j0_A)?*!oCfV>}8=^MhFb+C301855(k~t?q
zCWA5(1A{UzBHWI`+{3}Zpe&7~9(2w>NDB)CgEDB5H*~&(7upVI^k866wgGKU0;e~W
z{lCiI2=fm>%K^~wz{;R>g=Jr`aw0<g5m>udfPq1|65+4)Nb#uLgoqbGXnh2tl=~6s
zRsa@mpm10WSI>mJ&s2E@A|4UvP%tnkA3zER*!UhJ1B3EKg!%lia1LQ$P=16k2eA*I
zfkF8V!u_kD?OrBOIDf{TPnCZl!eKwGK4M{DP+>#3=O}F7kN^XNiV(tH#J+k41{HOL
z`XjJ@4I=}CiYb!#CQ#%;(u0aC!kz12^)l%A0Dpvkp{l`@3Md|->46WH&Oz!^k@6`l
zT?H{PsN^He;f2Mo1_OgiJ(7E%<tJ#pw@Mq5dtm+rnLhy$K8HbjGeNG2Vqj32jWC}H
zR{n4>FsQ6RGJhsWG1R{s;prA-f4a&(M0gs*`awDj3@X<V_8w_PGUpk>ook@w6-ZX)
zH$we>n0r_l7*u%?<|EE?U|>)c$25nzf`LI*0g-NBL(41G1_lOIU4(x*VdbF=1B0p~
zk~y&U5(5K+su#jNN1*u^R8Fc!BB_Us+k@06A<XB6#ft<3gQ_}c(g~d3nI<6RFV#|{
zaNY<C0Z2HjHX_Vli<C}OyOG3U=>%l&6eM@HA(?|*Zi6y9ND365>k#S>!1|{k@tufp
zMw|!1z@T~_VecAPy#uoM210xttR4Z0KSY>+3>FTI3=FDok^BoQw*?p&RDUAE2YJ7|
z8Uw;Ti1T$A7}VGi<{yFeqgfaj)P#}5VeL0Y1_m`HggMKh^)DzM)sWil{7CI~H6Mg}
z*!p>93kC+Y2t>V{1GD!H1A`h;IlLb>Zo|RApq7d7@BT(m;6vh9trU?yZ^6<7$o)--
z@LY>@{(xE!k~lOygG^HcEkc5pCrr?CkLd#ggW3{=`YNb98C@6{)K(+J*Td2S0|SHF
zR)l{M=a4WksGUKGBhL3=U{HGucR%w)SiS(c|07(S=@!!bnmTfPA%(xX5Tag2K952j
zsXjdnODBvB8L5dWdie|)1-Z%bsd*(ul?+9x#i=Dwc5Y%(c4`rWN^wbIQAue*d|FXz
zaYlSnett=63PLoiw74X`C>180Ssb66pO;vaoDrW~Pzse`P(c-DP$|wWh|f&PNsZ6R
z&o6**Q!6q{pxmV5VhF1sB{@DhF()TAB|a~)s3^aj0ZF7hGbNQF*~}!~*eJdzwWPEt
zk0CifuPn6)<em~UllY|4w6xSBhRpnwWSDj^8>~?e%q&VRF*ZV05ua6>TM%E8AD@<4
zlv|!yl*#~C$WWGARGgWgr<cr-oSdJMYHXC2lUSmcuUC>=pqI=LA75Oam}G1epPZjp
zT#}eq0u?bcVJIjqDb36)0nx>odFeT+8L1T@4wOocFD@x!C@v|=NzG%(P0dZtEdcRA
zRBmc+acT*OSCU*%$&go?lM_;un3<EAmmXY@n4HRxlA4xSno|;AP?VpXT3j5TU%-%^
zloFqrms!F9ipreSlwz<5h?AC+n9h)zQ<PsBpP!ZnG8n?iC`g0~6zdrpSTGbP7iY$2
z7RMK*CZ;fyrljU1Rx*@i=B5_KCugK4XB#mTXCxY#n#CvO<R@o?IPux}dKMNSmZ_l;
zny@)TdQN^)d_hraT4n`9L1IyHYJ91&5d$d2#OEYu6vwA!=A|$=W#$*Vr{?FTmK0Sw
z=a=S{polPl)WjDQW#%(D<>!~=7p0^YK~=%H44K8?#0gRa3ee2t5(Y3kBQd8$&%%fy
zF(oBFDYcBjBe5*i!v$mvgOh6*#1xR28(fT`q#!pQ6ks{|>G6q0sfi!~BZK(#)ROq(
z(t?7L_=4o3q{O`JVyHwxa#4J7YEEi$NoIZ?HnI5P%&Js|jKt!M_=3cu#N5=9)FQCv
z_~gXA_~MNG^7!1;yi$gc0N;3MG6S<S5{u&tGAfHRlM{15L0Fucmz)X;XG7FbHaBA^
zNX`U@WPEZ?VsSA;fU~DdYFTD-YB4125|axu<4Y2ga#9(JbCWXji{tZBD@qs&Q*%q>
zlhe|n&Swbl4+@D7boC95cXo4+cMkCZIXXVExTGkbA*D1ow=y1NPjOCu2{<$|iwYTv
zOY(~n(^KO!Q&K^JR$9OSR*tC<q_ZeBJu^QqJ~1aVJrC?;s6cUPE;2VaGrcIWBsJd5
zBq<Y89%ZH$gB5_C4ocqfMfv%loDMRtI6gNOtUot3H$F8l1*8(h1Q%Tl$wf(E$AV%N
z7Pug>#N?99vc!^9u!8c$%#xJElEkvaoXiwZ6lRpimlP%D73XG_fTF@9JU*o;vn;g;
zR5+9tr-GC~MZghhXau$+Ik6xyDKjUtq!OgS5L7ZHro@AyF~2-7wFo2_U!0j+kdqpp
zoSVXsnU|7U5ucwH?;H>s?-Ah0;1S>m%6UGH!JhHisg+6jiA5<4If=!Y@fih)keCGJ
z))a8mf^t)4adJF_SIm%HT2urMc9=j$K|vyl0Mz*OqQruX%;aLIPKKh?-2AfC__U(@
z-1zL&)Pne&%;FLTa3~jp(@Z=xlELL~USe)4*i8k+pwcckHxU%##YP4BMJ3P_P+XE3
zUt9u;!QAv*Q2CV^p9Hdk0VI)@pH~uJnpcop2IhjT0lNsyEl$lzi!VtnhUm)7D+Cp&
zX<(_;isaOS_>7bsP-&S7vMN3q6yKnl3uJIgZeo0LNl^|&ab60jFa_HR^<S!mkpV+y
zUNNYO0J9<G7$`r1%B_@q5X;!Y1Vot{8iA@4aOIYm5}%ft1Br4_k&s%JnpXmfN+W~#
z)QS>Nf&-;3C=*n0fJ)2!(vo6^l1xw_L&|7`U_ov?tl&;5ElLEH8pR9+MX3deMXBII
zEWRMIB!dA|gO=pS=cF1NF@OkA(n~HVWysG+&Wz6}O^Q!RElEu-VMqk=!J!W-v2(!b
z8N@0|EiQm^iVMI_0hM4Nr^2!UC`%^i=cQ$)$CnpnmZX+5K#~k7Cc$#KDQF^~Ji<_r
znOT99-@z)8Oi2ReKX9~Vrh_Yya&!TR3UHy0lw&~VfJ-G111wpTTAW{6l$;t5YM2z2
zrN$$vMub9UadLiM9w;P08lnCH1waniUPO_RR0^uplEI=-WngdTfPG{V4=MIRB^ao*
zEXa*dN-R!g$V|?#j4#dwX)aDJDJ@`#kIzlaPK^hf3(^lNRpT@BN>Xze5Df!R`Y$R$
z767Faghr72^7C>kp&G%yNl7hEHY&(0NM*=LH8X)ncWFry*n#nx#fkArMVTq-u#y(!
z-^`-IVusATB!;4rWN>IRWEK^I(pnLy?Uc*_iu3H$N>CA=oyveHJ>tRn7@Ta1Q;RYa
zbK(sdlJj%HX)rfGr8FlMk_y2Q0ZtZ>VkJJQ5+VW0Lh*?yDS8EoMJ0L$3@|=JZgK{u
zQ^Adjw9K3wXu+3R5)X1@eknL7A?F8B&Vutx^1%rgR7il6GMoV_K0&2;a&8Kwb_H>Y
zQ}a^5DKx*dB!?k4H9fI75!Apaf)uy#+747wfJ=8!0}(C?iV_A;WeAc^%>zYi3ZjMt
z$wHgPa2?PL2-1V1zMv=-?9iaZ+~CZrRR6NnA`^FnQN`Jr1qdG4U~mDGnU@1A;|mg@
zg)=C)!PSHwxM5jPlwY7{z>rt~szP!TlQZ){<sc}@rliE@<mP7P$ERc#r6!l8ro<N|
z=B1~iXe%kmh1E#~sYSVod8v6N@t|g5F&1SIAH|mx<f2Fx<>!JN3vO&M1VK1K`S~Rb
zFo~S}#1v3-7nB#`b4wu=2rNWEEv=x^yny`T5(Y@<fm%eMRES~;R0@(XQDjOAa*Yh)
zGcr?)K)sC0<ovvnqWm0mC7?iwPfN_qDJ_Dwms0Xk)D&kV8iEsAQfX#RN_<LYI;hG4
zm5rcwVs2_;acNO%E+}|FC2)Q^SS?5j)N07j12u~>;=z>xqyhltL}-zcn^>G(j$#=|
z5*nJhskupsMc@($Dw3IxCXiHGoSRr&l3K(7Zf=8{Mu|nBias|nCnrCdp|~V5IlG{w
zhylWn&&e-`F-vj_GBVRMkhn;aX~n7OFc~yekkkl^!Nimll-LBtH;RW~3PDj_TvC*o
zmkuhdz>!{*3aa*#@=NoQQ$bxYP$dj*?!}kn7BGNI$@t9l6i@_}7BG|+CxOZ=khkK&
z1s}K^1l4Vz62Ame)q&b(C7H?D5FRLxL)3yagL$yZ6q*>2DnwB6oSK6q05KNSS|}(j
z0R?4dJR}}c7?SgI^bCy|it@|#42{5T2yo9OIV~N`Ny^F2EsM|00|h)tKZFm?JV^5S
zr6n*0;C2o|J(!Cw4bfhZnH-;)1nzT`7JyQkkpZMWj(1JV3@%7b_DpdFwK;-Iib|79
z7(n3>UzD0|0WKOr2@>3l1+_K6g*8|N)VEGfgtSDVeK~M@0Hg{OXy9TJ#3?AsPlB|8
z5iC%VRLKA;Q9*Wr^g%>G>JcoE9LN}Gn>n*M9wdTLoeSwYf}1DF`H*%Zn3IxOoDGWh
z6maxFdIPB`kXS;MgLD(YWvMf$@9CD4Ur<mPoSDwx0_pjBxCDTDg;1U|ga_)}1%Y~!
zA(^?U3`u1LMVWaeX$-~5MX9NInR#jX5Mx1BfkNBR2$UM*!7cRoOi=GV2em*c&V!l&
zsy!jqW^yK|d<NH{dd6l9p!R!6M2McTIb<{eR5E}@E+F{|R6l_I04Z!h#Q~^+hmxg0
z{b6u_6&!`&+7eRVLfi`PDaWHrAv7hHz$y(CldE8^2ZueVs0Deqv;bTPf#V$H6>wJ(
z<T7ZFEE$rKA>%?I$AMX(`X1Z`_W|_~AjLDpG*~MDYCgC@VT3Z2P|1*-0_tIa41+Rr
zQ&Tb%;}J0eDqxdSAi9b`{gBeU;`rj^#5{-)xCaKYjv=Qw6A~04JvpU$45`Hhr~<I+
zAEZCNB(W$xwS*zJpafMBcnkw-WM)|jw2SOpP~z$D?3tHY5|mn43aS}$6EpL`Q5c+&
zn37-a<l+VnK4@U&CKiC32C!Z#q@4%~&CGmI@eJ#fLIXO!Bq;|{xW^adm!}pLm&YfS
zmXze@F~GQ>GQ`C-4Ad8dcD<ll8DOH2CL1(~Kn3$sOUm<$vSCUKAhiZGmOw2ns0gU&
z%SbE&H$98;5_4c3NvJq9qr`)_Fe#`ZnRyKH@ou4h&LN)ue(~{o#wPHdAY|N$0TSBz
zpx!H}0l<)*S_$eT#TVx!7H7bDsd=FK4NS(Dq*j!mBv=$13{4;z092VXq~wFUN6<_Q
zF6ThC4SEwLEi*4MC%!DPC?~%h+71tM4GQ-3_hSh51&uU0rlb^s>mE=OG`=`9J+Y*O
zA+-$DeFcrrl;jubnVT~>yFf;VKsvys52z{zS5O|MN&W>4#RaLUDWHlkxg-ZXzylh?
zNzO<tDn<(=Q-~M9$rnw^m?1Ym1>ByFPt7gONd&dq!0OP=FhbL4h{iWS<r`U|@hupN
zD?wdy@F)SOU6Y%boROKA$^fbU;{AioOc+XXlHlnWB^Hd#8Hy5f!3}LtdItA3Kxs6u
zEI%i)Br_)!K0@H0pOccB=bM_F4;oK~=>a!4P)#&r$Si{9H@KZ}5pd=L4SAsIF-7x~
z2}53KZhU@TPG(*zXu!Fc0X&ulDq$c4YM@adP`f!ETw{Y;sUQ(hQbiE}D*@>OwN~Om
z(r^xl0ZDYw0E>4vHa9SU6zotTc(%>UF8~jbfXvGW4YieI#)Im82B^Y#Cqpv>ABbL9
z9~{+(#^AODXgD{%C_fj>ftE4gF&U6yU<Szfx%qj}@~X5rwJ07`6@xW^n=PpoC7^*l
zumGswLTb4nxS*VgP=VAq0V{ztPD;V$US?uWW>sp6o)KEQGcp1tU{DFJXJ`pxf-5#d
z3$%zbfDR)hXU2mD-Vr=d>IdmY6#*H7YJ#CT8s7|7GJzu~Be5tYC9^mgMG#!wfSa5}
ziOD7LnFWxMAy6Fz3deYh3PUrn@8Ke56^4)qfQuL!R2UhcDl#;yfK3{Jf*dq57oV1z
zVgLf55CGR_n4%y*p^Ab+0vu~FVPmXDAViUkfQVumVPs%nfZ+;bxG0JdU{OpXEU+2@
z7ez4wEQ)DFGFBttq9{gyMKO#pG%&*A5rinR5fD){BS0?0bOo{~!U&isnh|MfiCAI;
zSrlOeOcdP+knb=&l7=LTWCT<c-H0@>^UxwS4M`Nq2&gEg5uo&fX#`vp#R#w{rV$|L
zVHyD!MKJ;_if#nfJd%baiev;-6w?S(%t%d3F@TGr7y%Z=G{Ow45pYoyBfz4VMwnwY
z0xpVT1XvW)2ypI$m4A>TAT0%y>LK|T#R#xkOe0LNx&khWVgy(e(+E)7LXXrG1Gp%P
z5nxd)Mi^oy@Du|Jm?)|dAW<|Uz?lrg2xL)&5in6SBS4<R3=3pYgb^@NG$Yc|lF~4Z
zKo&(90TabA0_15(^nofhXr!hgM3Ievh+-IFh_%Q;h$0&S5zWa=N>5HU0!>1vWR`jA
z<ueo+8^(hs=@^QO3?Pi$q5=q`0Mt#&$uD7uPsuC`)yrpyFG|e?(<zx{ph5fM5|ChS
zX%5Jsc$Y{&M_*58hK!sN21s)qb?zQCV+k76DN0LBPK__lC@o3JFVABrPAy8#&x=ni
zDJf#`O{@rT_H-&OX7EW(PfV_a4vI3UsDNA$Z)m^}mYL}01a3itdhWrXE*E&76Jkhm
zeolN&VsQzqZU={$t6xY^WPFH^6U-P(2*Wep7}UuCPn<zUiJ*NRBwe0<o*@ij?v5V$
z`Pm+cc_}%mMIn_1sSL0=fB4{YW?2cu)O=3{P?HQY!ya!88XZb3DgljLf`;W_`XFjU
z;|)z1;!{Dr8i;^rycq*z1_-iD0o-E%t!gM@P*DMeGXrRtqR0p2MbH2wsFj`y8sq~l
zy8tyvK~w+WsZ3DlFrao5;?vU@%F+`dlM&$N2zbI8>|1b;9TpX!emO%1*thWopwU-o
zxPVqvKoo+8LsCmhK*Ro^wmx{=)(GkaxX#>MhImkKHa@=~1u7SBXvR>IpBxWa4FFo%
zQ3hK4P@0>cl9Fi*Q4|^vZorkMWR`)%Kz<DkcFInzWbkzHO)Ow=NlhwE_b)9eC@l%d
zFM@`;XS@l6vx{qPDMNf}QgJaT{S{TlgXRZQ6DwdYD$dPhC`v8Jsf^DpPKQ}$4r7=y
zIH%^7lonMo#24j*f(Ihu333iJjTRT=WR@@>1}x*#azK4r$n*qs$pg4i4-Tbx@PZQt
zaDM{SNCd|VWa<OlE{})wH^IRJwV)^!)EP}rjE96iDAqyQG~N=Hpuyw0NLGMD9u&w7
z@gQ%5(gZk*6_pm0zzhMUK}hxh<uOS9KtwvUTL7^z-VmBMLK))Y(+e09A(LB%iSfyK
zC9rWcmw*sgn0vtHKr)!8KP>$~x`{AeQGPkZPFN;3WdQf%k$hoh5^rY0;1ufV<KpS(
z=8q%;_8&u01$cNEY=CFHp(z7oY|j%kJO>Wd`0Ui8ywn`9!pf4=Vnm>WX40U^7s;*8
z{(f$r?hKxwi8z<c;)0ySN>6AS1+7g;s)UqoprtthIf*4{`9--wrFnUodFlS3@qAD@
z5N~J!OCUxJ1(~_=pmYsRHjoSq8qz~74FWqoG~SpYIR&(g0^Dr}<wvl%XS^vxaS>?h
zKLa#84hg;#SoncP31BuELNi%tycvq)!DUiVh%=~jR}4vF$>5bSm|hPKaD<r#_kcMx
zKp|ro&Mraux!^2X%n+Xn_EJhdxEu(}Oazt4ps@^w;M`1583PSHh6>2Ua!w9tqzJl_
z3X%)JQ5c_}mkRE>SAz3DB()WRrbkP2K)F01vj{xU0;(fG<5HP<=?n$M<*?$l80KU{
z0|+ZL-p~kaQerV|T3<y4R69YWJwXL4tgMZPL<r1I%peJI4GuvrF_J0}<$HN%N(pH8
zCOJDbg&{Y;v^W(~Rm7)43kgV4bny>jV9+bB%q>YwV$drtDT2@$Fc!Fo*DEf`WY7bZ
zhI$1#B@B8gAOdQP9yr?;FzBUJ<`q}wLg<nr2EFvWQa#XWAO^hv#~{yOXT8$Aa?mO$
zz0{2OG|>7W20d^Tfix!OW+pS}fjYN|MJak^iA9EHdV2cBMalZvNhx~CddB7^_@xc;
zNgJ74GU$Oy8NIyxl2iu06i`7N4;oKFW`h<~!T6wt4UC<blvI>j2Iqk%9E)MxVvtWk
z<Nl!45@0Wbhrjhe1y*KKDJVz7tjkXZ6`pXNMS1Bcd`OUhR%lX)L3cTU4wwKL!wz0Q
z3}S&XXnzN2H7W9bB(Mb1x=serWe}+PVfzgjH$v6HwpW4mf(WGb*bLzNbU=cjtGdAU
z!`6K>IYRYwA*%-|h3zK?v9&=i1Thrg_nJZX*D!fQ*9C*l;|HmLV`TlHy$fLXBlJV>
zIb#AXu?OklgRRpCaX=VZzbVXq2H3eEu=~)MVxjw}6_M7{g0zFy1%qi2VT-9Bx=xj;
z9%e7nI&6>@&{0QV8br7<Ffed~7zq2J_p340!`97$^n>p+f~teLA0+Mz3U{bD6D0iW
zD!_cEde}ZyaQJ}5AOtc$l7RuVKMO1Y(+`O^(DgE4VbHz-6hFi42kjpS&Hw-Z8$=oO
zzB;BlNP=N%fbPox-8Y0)KS*1A0RucdoS^Q9oG-}K0NuwW08IyQbs&2|dO<W6{m^^j
zm?ps1#lzeI^EXHzOn)9`{PjcjWid^Fh5r?hVk8XnKS&6R{m^^onBeD7<Fg-|e#rfF
zOcP=I(n!@0*-ywc5$0}E^+VQ)Gr{*|k*XiEE}dy2?3__j^+VR>GfjfU6F&W*v<{0`
z=>8|@{t2c@p!~tWz+eWYLD2=q$njUlz`(!;7KN8T(ESBWCqQKjD0zVF2jxGgGI&}B
ziMN9kKqa8|L+|ZlItkkcfova0Dd^xF5Dmi1u;_=B8%!sW*1?06!ZEUb(4Iy#{~w2}
zhi5to-9HC9PY$jZ#6Z>$+It6cAJqNOeOydupy75LbjKP<9}L6%1>(PCU|?VeF)%P(
zKLaE^Ar!#k6(sT=$^Rfe0yCX~>=R`)M%q6EmWKHk#QBY+9~xgEVeoE3XuZP@$q!Ir
zB=w9842+<%7uh_7Di(G~I%eJiy~-9Yg`}QQ9LYSm0x*MpH*{ZxDEuIQusEW;18D`_
zO^9S3R0W7)zW^<Nn32O9Bm+u!AR43}v?m3oAJzZtSD^kscOI%3M#0pB{BI931S)~5
zpJNdyZa`8XJ3urHBkKpHQS9;0u^4=pD+2=~(tath5lHdR7>8s(SQ1WfEP?EAWVD(H
z7lSZh_Jgz{m){Us7|D6x5yI3jgwSvjSwATMBk|#C7#O(tp!?}GAoUqS3YK3$A|SoU
z`3WQj!CdB`uwh_ea0c!7(Ev3sAQJHM1C+l&<qBv6CsYcF;;Mr9pFtgzMvx@n^&m(L
Zbon3-{R^*x6fiI_c0*`5334--0|2IMul@i4

delta 108708
zcmaEGTWiKCo(a0b%(4*-oJ=AN4h$9ytPBne@(gkl9o&Srb=d#^|KS7ERt^|FafU57
zv&04l5MX}5IPrm~GP9TkSe9922aE>EGB7YI!05>mjNObDlb0~M^O@?Jo9m_<CYu_X
zC7D=k{>j+FsBdM*Xrjp5@I{e_!NiV{LAltD(Y%`F!1qKR289YcMw4X5hA$xYd_G2#
z76zutYnWx(vq9o)4U;c0i?U0|F`9C)ZkYUrS(4onWEPXbW*(NAOzKDmDc`bVG{48&
z@ckeU!wc@EHs<#j85BJ97)_iw8#bR|Q)Q9jvST#m;A;5F$b;g7mkbA{Gj?!_ZdTyl
z$|8(pqJlObqlqG?!sHkHGx?FkUvRDZGkJo5WIb4(Dd39&4}*dh$XVPBU^ZBs4Vj$)
z7FP$U;rRe&L)08VusI6AY$S75Fg(!WU|@1kfaz1@VR)f%fawJTqmuF?0fxyMf~M?H
zcTG+aY=p5lzY&yWtUqCQ(ENn`!s6q07fsk1M2e5uJ>-yLaw|S+_mM-A$+h^fy`cGF
zyS>Fn>=}~}*zM<#W^&<RXNu(DV2XXgv*Zj1D^ryD9EJoA7N%&P8X*Q$`K>=d@^3aZ
zNPy%`lI{P$ke4szkYRG&lb|4Ae$;-UjCO(mLx3`)0#AZ~<ZVm-ANv&)JV1s7AF^|t
z++ZYMpUA<+6ve^H6#M%B-oGZv3`{TN<#R#Cff5z}A)$k}ZMYv4A7SKZH)^oBEy4c)
z<Q((6_6uMC-#hpAOzsE4hwL7{aJaw_e8ir2K7;*n^EnLbUdYRDHJ`(f2hv}BoYCVp
zJO6{?V|EvBJ>!2+d=wl6Ag?nPA5pUV*e~GVz#+-xZ1ThYBgknW#T;x*;SfvqmrnK&
ziI%km`4r?VkO~eqricrb5`Q2n_OVVrAR^6pcJdt&Y0IgY>ZEEQ>h{KBk%OACS9P+1
zsI=r;xC*ch(ooqwdnc!eDroQr2;2#dXHb|we}MuhEcs^&F@VI(=P)qw#|T|`;c$To
z6l#-Kh<3{gnMZ-ca;mu{m_ExP&lJNU#T0YflK;VEA2AgkkW#RK1owl<C1Ms9;Ltk4
z$N_RLC}F(*zjrH#6qB=wFoVPG`TP&e|J(oPe#|A${dmWM7YqzV9L!8HAi2pb;wCcu
z4+LZ`&yoMpJUKoWr0|8jyf6O)A&7%4#I5XDHYCqybTN@<U@#G8ut}cJV3Ita!6JD+
zqeSw2Mi~=%hMMHb3}(rb8LW~gGfIJCG<iOwoOXf&Lx3^MhRGYmrI=U}CZ7>kVq)1a
z`GdHG#BB-gAMFkb7Pr20f8e%fkmMF-5Wa2C^<c7$go4E7D5)PNGWP%5-5LyT$8-PC
zPGDdNuwhr293kOR?;gYGaC-{>gUj>f`1>Cyc$mmA$eGA6$jon0FfyNS|DUl&;=rZJ
zA`F*`rT@1jC<xsC&;8)`9PS^W0Dd7azZMjfpwI*HLG<k??gvZ^9DBH9xMXh60kijW
z&u5YEe-Qr^lyzb1Ok@}s_zwvQ9=sh1Nz>l5*d<=@tXMPIXM(-+-P^mEd_iIV`u{$#
zHsq8IvIeRhP51IWAS-U~<$l1uce<Q3qm%&m9<I5!cQH3Z%~G9w$6iu665=e784z2S
z{h4easm(m+_MFLal4gwaCr_1h;6BHwQGC|!WAPb##>q336j+K6+fSU#A{AcW$*&>M
z!NJKC!ok55&Tk;l&Tk>m#=*`M#=*wq<*mw~;H|=-!NJND%)!Fs?5)IL;BCub!NJ57
z$|1`XZz93KV8X}5aH*K9`%*Et4QCD0oJ++Vr@5uLctC9427w-M1Szr`a9D70^Ck#%
zb9QraUz)<@!&$>6!?k$wEh(q^+r8WmZsu@5;1FZ-+Rvx(fkTujo->n+ldFS^gI`mq
zA^5D_N3Q2w>|DpV*!VSsI)cyGGjg|bv2vwwvGA)4O$a`1FUXO^#l){BG=pm|mu&DU
zd&O*328H00_J-Li3>v{F>>aa}7z~1s+XrUbGFSv3vO5@j%sw&rsC{AZ5&OxzmARbH
z*}dgpW(wsHXA0vGW^(2bVG8HqWeR>FFT0n6hbaUUO`vSVA;lDL9?HT{e3nt8_>A4h
z;?wqw#i#5Ai%;4sPQD|ZuX~c;K;Q&4Ji~(385Dxm7z{YrnL<I~8LZ0S5Uj!w01MB_
z6*98AzqojK8wAc=D&~WRAKPhYm^pyLki#4tZl^)v#!)=^kW9EIB4`c-pRxPMb)1Wx
zYZ*9bE(D)O1Whr>_EV6cDOO`J;NHO{5q#2Ku^8lv6ZVG1DwC6BwX>O-VmZW^LZQA6
z<B$RS`YH!E#Mc~>Ofe>63?U}s3~~Gp0wVkk0`j+}@c-D?ppbF<EB}wnpYQ*eR?NU)
zR&4+OxUhqTi7-PP_h+X0m;c}YG5tRS1E|cn{NTR)3kC+J$sc6xWbFQf%C#5ra&JK;
zS=UtiSSbIjdDLV-xk&#2P(Xu%p!g(XhWSZwC3lcRipjnBusx#*GXq2M3A>G;QXf>}
z7ay_v$loB)cH<cTg8&=$1pWqrqYZ~0B0$Bt2?qlM2gl@nZff;B3j}U*uroz*aDpnN
zJzqIknLI$H{{9C0Qj?_&2G9!1^+q!P1CZ4LHtYp(XPjX4fYr57X9$9wam?-^sJ;c&
zvHT4Jtv8l}ozTGFAaJZ<v4a4}2`?BJJWQDFb^r4mfI5H!<bd5@K^B4>0J3m?gZ*5S
zV+;bIayR&p-NMNSA|>lj*qwzXI*@}vH6^I*4p3&Fz>^>_r+==31E?GU)x)6jAi#>z
z;PwA~v7j=8r$(p&qy{8Ec}@X?i3|hN?K#~4gAdyag34b|joR;`ka0U6>RDs<1$+qt
zbIhkOF!eVm81R({HB9zV;I`cW678PapaCjWL4{raBm2D|*SwII?+q|!KLCn35TCC`
zs3E|H{Q~zCt~>nmg&JPS%g>#>K*39B#ZeA6rbv)S!3DkzOTpwn3htQ?Kw-<@AaEa4
zl+S;ln8B|g!~inL{0{?1fHC_Az662EAU;<;moTW5;cpR;HQ&O(#x;jaWM9cbCQvH;
z{9llRzezxh`x{eOfGGz9hXhkRhbU7x-vR-rjxdD@=8qVdCNEHwW!yh`pQ36#D~AYE
zjM-KOgPs6;*BkNN4_?U2r*cRzg@TGs{(}OCKpq4IImq4s8x8^f1_7DL4F*gv7#O75
zTND~VJ^-l&sROYCY}i0*<l7(EUj>On^(pW-2+ZMb2#T3Lhk=2+fko!>90~as@?P@2
zx95No2w0QM<vI6%z!bcYmk+%?hg%*LDBuDnn2DkIJflbPIlGI+XYC#qqZc%9Bqb;B
zRMKN?p8P^dv7VX9i9?LZ#e|hX&4i7?&xD<!%!Gr1&4iPI#e|E2i9>|R+k~HC!MxVS
z4(`uPb2zw}e7W{8$#DN+nggoT_(K%>E;w=YaGv4f0eOMDhf5|vk;8yTSE0vj3Ih}8
z94?tlTe;V8%;A!`*~|Ulb|3cxPzA8BU*QCYJd;a3cQY3=M=X~tzp_vRDEV^E;F91f
z=Mv|)73v5+XLphN8<!Zrh0uiHvvv>p&4p%w%B*ZN1_e-A6@1EG5L6}wpRhL!K5p+A
ze9S&D_^5qi@DcmM;KTNf;N*JV?ktBeQ#=PBlhX@%xm-}WJg==mfvc2h4hI*LuP?|a
zAPJCf=CwB%aerot;r`6T1M(#YCzCJd9Hy8T@^ZQ$d9Wr9CYT;pkQm6<x1+c}1lVvm
zOjc33!vV6@M27L-<`t^NjEn)3Wz==*LCslEMtl8#&r^=YEX>>uEHd29Ofo!ogbqN`
zHv>a}F-HPlg23hdlNWH9$TKj38by2lEZ{H^W?(WAW?<l|XNm!Z(B(Pu|AUX&T?8eF
z;G=dAgOAvK3_fhn2(mZ$I3(kP*d{UzESF=Xe<(ljpS)jP*9Gd(9|1NT1;r;AJ#L-g
zegNtLa7Zw@gL?qtkRAZ2L;@8SpcLFcPr(D!BLL+zklmodh5v-zS&&)WbGTvxlsOtE
z2WTiWhE6Wg@MhdQ`GAIeeJ#jGpz<rAhG7E-2U8Tt=fO=33NIW!Fa*zLFxcN<XNsg|
z0yvkmW2ytG+23G$7u0v)IUq2nf70BeAhQB$7z&Whdm%47mxGll#zcm(iT_Z&&_VNi
zj0x#?>^7RnFzA?wF)*axvD;}P!*B|uIsJ~^!OJm{AJXsG9W{|*;7Gq?ck!}~<Ofh;
zeCsLq1M};44?*7NkYI97zh!rlLyRdZ{ifYb^P6@XK|zy#&2DS@HM_m(*X+)w-?6*;
z`u`r;Y*6n(hADpk1BDEe$xk&?>JQs9n%}Uy2&!N}jb)I<;I51m1K0ir1q0{%c5iv=
zAt@d?{><;$9eg1#e-;$ppwh%#f<ff6jN}JU<~F~_2=1<c!X8wa-8#no;I=dO4_HN(
ze#dSr$Rp_o>^9b?-?7^ZDu&W;*zE*GWcp3JgY8X<9O>8Xj!tecV0pp7$YmnI&|o6T
zz>s~z?xguqJ428oL0yg4|F>#_q7M}O9BfQs=GW~`a<DQ*fI<MI=Jo%bwH(Y$Q5+B-
zYk(Z<e&5d4{f?dE=l?<i+<%xjW5B8NkR9XX4FTfyilCTzAusn86e-Gc&Vzb{cg^Q8
zFqz2kBq(iP|DV4>;0mY|+&4#o3uN321_mwj$qY=NKMVG7?dOu;A8&u0LzoF{DyRf)
zcTn)S9SW_0Y&a%>Y6J5xq5=F51TN1jRk#3Zi|<QN$T0uUut7Va9@NU`SOCgU{0#zA
zKmmAb3jc!uV~!0VL!0J1SeO+vY%nXf4}8JE5CL+?{xA0VAj4kB%eR8m2bI|e?z^g>
zVg8?i3DhXz{?9d;`!iQO_k6B9AP0f^r?>y}gR3S`Z3_vfeQQBA>io&IItjt@;2eGc
zWFcRIz?FHk6eP@w83gt<C|JM^ozHd0d=7&E|3rcN+z&JsykKAuf*L**Y<Ppf{TK4`
zTlwb;T?D0$$rifutQTJY-*9kpjIO;U*M0{D3-c)Z|DdK3sA_+~z#tG{!{`8F2iPzM
zfXp(HVVE>OX8uu-Sof^`*Fo}|FX;L)GBGAhR?rt?Vsw~%L04{anErx##sZM47xL1%
z0XB>cP<Cj54dVnT+cv<4aRHRA8eqe?0m|kLuwgs^VM~1tuwlFaW#0|3VSE5(9}Tc!
z`~YRI4X|NifU>6s*f0rz+4b^LwE;Fv3Sf@BRBC_?lL3_N8(_l(_SOq|DboNOrU0n8
zY=8|@0+h`fV8aCUfaKc%8z!g+B(Db8FhM;axi`Ru3F-mKr2#ffP!CA<2G}qisD~IN
zSsGx&1oeSrY=8|D)CZET0X9rfA4uv3*f2wVASoJP!wm6(yu{xC8)m2nB%TJ?Fhe~c
zaW=q)8R`LvtpPU7P!CAV4X|N`dO)JSHNb`$>H~?~02^kg4<teZY?z@wkgyG~VTSrZ
zLN&mK8R`QG-T)hBXcUNl4X|N`dO-YcfDJR$1L8*mY?z@Q5MLW$!vgAt9t2elkOpf#
zVsyxaje!MJKq@TZ{|zb}Z##2;02PKNdl)3XH}EikS}h!Rm}L4J6b^ujjvH0nKNM2<
zf19u|h?vwcaF`#rUkFw=ONaqk&*eGN|JxfB8bEqXk{LL@B=9isBnZfW>YCum2O}jw
zEm_d8)9e4Me}bCepq4+lTw({cgjZh#Rje=M<#j<~ph6Oq_mo@se}gS+fDBDR^5W`B
z6Djr!Aa$V16{H4~)xhfJ3o(GyfE@Aq|K77EQq2EA>Of-kP{E}pQjD))f>5zq6Dh?9
zXkwuzQVdKWF%v1q7a#*(|KF<%QV$Y?@RxIf3I$N}8dOVzn$sYMb4W6UfE>TyYJtIR
z3GN3VwJ%uqN0y)~HW#-44=SN<6>~q}s^XI8mf;fZTc9AoJ()}Ng}nSyZh00Nt}R@m
zd<z7`xaV_;n$H0bz^&!mCIpUONaK_B!DJZ|Eh*LjkUiX1T$0=pToK%}xTIeH-#7KT
z1V{2@g;0rl6B!1(;!}(nw_b5SC_ZVoF+h{`LGcN@gB+4f9`L5aQM-?z<^w1>fRYBU
zf<Rlt9fuXSUHKnyEMt)Y+o#ML0BSCn>|$WLF2j+0JBlCdLGCE7D3fChOrN6!k~x-g
zxtd4XU*vY?lHyk8l6?JtuVgGoD%W9NHK7Kc450%&=|UGWvKSPC57{+NR`6D=KV`QT
zR0@JZ&-@-FQ3u$t2o#^OYc%0uXed5yH_?Qfp|1Fp-9qzI_6tEC;E-VQ1baXV;sNvH
zc7~w-HOK?E)wn^!fFDg*85lqwF+Xf$2=bJPJc9v$hrnk34uLIvn}t@a{}_LlZ;Q~1
z6p-(lyBkk%tl*Noa7SA0${tS5>vK4c-8jMh3l!ztZ7ggY983|Qx)K!3FIaY)a4h3G
z%E`<nV<K<Q$Uk3*;l@(#2U8^&>e?9`H-M4|NFQjZ6{P<4{}qjseF`PL|LyMunE{e7
zK5AD8k_YjNkJ>DRs^bLfV_}L0%W*=QQZHC`>6l0`I0T=uYYaYZH!=8-4ddj3Wokk;
zieTkDOc5MhOtCLmcFvi6p-`kA#CiRHxuD5Xh6a#bFXUy{g4_pEY%0aT1ZpdQ?fbWn
z7Zgh-G7Nc*GV^#LYUOf4Zi7Sy8#M4489;$=!o~0p6!_rYICAO%^~#UgJv3osU?@In
zm;2HDsO3aZ$lqoL4TRY<avWxnY3^z);5fl0c_U4l9psQ3$=p9djTDeWUa;)o;b3Np
z;7COT=!av1UN<uMA8;JzIyO~;;a@w0V+P29Aibc#0qJ}Ff2HT-3+B?Ap&*k$vc<=&
z8WFN99)iTdL3YY+Velc##K{SBmFg`U!G>@%MSunZUa)Li15yUk4$=yiV}%V8tWY#L
z#>fDYdm%5!dgB=P1CYE)6>=!<mgRQkk}{EDxYtlKFBGbFE66FJPy|&z=JyyE1lX`B
zfQnx8dQjA}GKGTDB*+&a13{q$YN&EZGDVokGbHd&5cteLLEsDDW}y%3AA-~A2M#Hw
z$k+e(q{1D`$`lDoJ|Ht*uxwQ^kzhy&K5F+d_=r6tXaGJK+R-<^XP1cVkoo`{76Y(L
zD00Ydc%XBjIAn_ms6C3uA@v7u3v)j(k+J^|Dks4{mtu1EsAm-DmR|rGtB>OTyrTis
z*9)j*G=TVSbI$D_+z&iz7zLp1(T6bKfy!N2=>aODz~-K0%((TEA5_F`<d9(U01p!#
zwr31bW+^B>UT=30*3=HDXE2!mK+)p18vg^H0)acGstgi0)wv(=BnV95ILgHe&NchF
zgt;fP2zO0h@B(BwC>p@yH1bSQps50g12^e_qLJecm(+zn5<mE3gcvUTkp$7;O60;H
zsUQ6ALTntIOcDJ2F+waH988fAjT`q&4zSjoeAG?e1Qbc;_gE5?YR>-$xzMbbf#tR;
z{{wL61JrJhWDo##82B9oWIoRkmH-VuO+H{PU%!!iK2!YdIh+sD?^uKSLP93O%q;2m
ztxu-kvA(GMh=IZUmi6=WJJvTrV?ZEl)9+hf1-aK`DT7)1W$T0KhpqRfAGSW5e%ShM
z@*V4k$%m~UzhGH^CHb)R(+hh*eJty(pmc2_!yuA=)OsfeGgDah9lML>NA0$oU-z@S
z2<cW>Zv+|s`u~oHpmYiCR&;;@&HKLH#r`h}1<v>F4m;nmJNo&*u*By%;4Vgt^L@MH
zpivx<C!Futot(VEM!LQcy+>?*&w3#wfIux$28IB84gpYU4@$_OoCHco{0{`=+aD=d
zfF?oupD3OH*$i>fo~NMd_XPvvir_<biYD@mP3iaT0{I;Tgg+GvOPI(rxTN2=i{y6`
z5CPR1Ci3+R8tM1#63rtS1o)i<<Uze5u6m|;eis4Z+y5m$d@2^?NWX8F$~750{0&l@
zX@1Kt7i3xbQM*u3*rp$~i+#beR>g#k!6y5d-9=FNnIE<TO(B7LVi!RLp7~9?K#-o-
z|F;E#vo)kA7GWYTWB(r%X5G&e9Nh2QEp)$Qw-n@v$s25>nCuiMD|m>@I)aits817M
z!vPv@yuv?0;4+l|V6ujt21k2?f&)lka)g}%OMnf>hsh0gA@!h8giM=3S|^~S1{xax
zCo^d#7f=!d^>snH=Jo&Gk=|Ae4j{*K$S}pvf1vOHl!$m12;2#N#$W)dmO#CJo*JP8
zJR1b=fZ`qGA)Xqc3juo=6hHw{P{W`Qu!q5*poYO9U=M?-LqQFLL%<$}fEO$)TMB9z
z0zig?oEc!naRFu^$dDH-D_uB#flF3~$qN?9Ox|F>g`@ZwqXvg0liTzHc18&mWe5M;
z=1~kCumA7M{qDfSaJ!ZJ|C|L1VE3A^GBANg6DG&xNz{Xf9lGXk2ML1hvf%_Zc5m`4
z2*`k@KKYfvG!wrHm}cQu1Ji8$8ep1(Ukglg@uUdM>F=7a4l;-5fWQoMO9md3Dh3{I
znH>!rGE5OXH-s8MZa0^(|N4Su=^IcJ@P)h_=UI?TKoK_C!?8vMx!}8P1&M~&|93A1
zB~sA1EvRsttPm;&?(lL7fMN?28@JiGLBkslZ>w@Y0L2n0#z2Dt?G1_spq4x+v_Y1?
z{<r2XC?-Gw`+mN{0S*}^cM}=LAKa}>G9b@isFeP3-I9}odnQw4fDI>TtnwB}?{$0m
z|6u+9_w{nSb4hV%voJ-2Gz8di8t^v=+%b`7VBvnsB+oscOP=FDm&}FxQa`Rg<CWl_
zFXRA<As?t>kcs!NBy)1WY~^ldat4iKU8$G<&)v$z%KuoX0jd^kFn22#>xDZ~Kd!g&
zO1zMlH|5zQ<S<#lIiwz{2ssGA10`63Kms)gR`DVQ!3xrYVE0~bcP>RKP#E4=%KZ=O
z5V&hOo^rABEE57JOqeS%ybaO>@;WU1K;8!#2J${=3KisSP@({3Ns!tA8%_aG0tXdp
zP#+3{3O8sZTcG-Ig)G#En$a9GOm1)PE1dW~pFsc?<{$&nV|wxl7g<?(1{RPUC?a7F
z14rn6E*buY$!xB=kr*BUd4f><f#Yp~Ks-JVO`hN?&-i!p23H9i;uGWcrQB{@;D`V@
z8|384EN;f?7>)$Vf*cA`0ZOfq(4HLU=F3<*d5v3AJ>x%6hxkGbV$l7#%zb@OHQI18
zULHh)asdZ3WQD}*|9f&lh4TD%yQiR3U{cAz1eOO+-s~|2$$>gOAUO^hCg&IO@~)r>
zD47329dJ-Yf@-GQ&ioH9*GEbJ1@*ST)z%Sv#(oEd2cY^LWT=TGgA63=?QXqLCH>*J
zjKd0$!6wNJ0-)I;P}>^R`MxSGA#kBa>PL60LI+46sPN?g_n~)u1?dCz5--n@{?Ogg
z04`TA)JXsBZ%|MInKSv1yDF$J9*i`r1nLWb915}<<k;J;+#f(51Eo5+TMyd{zW%@c
zEXY0+d9$46KMG*8!2!k$8O#O^D9fI(gQ$^YU;&x;`u}$D!U_|41_|yzlUI32*Z*Of
zb9v7F53o6pV>0pTAXC7YgF(prnEgUfy$G@i)I{Q71C0*s0@ayOpwO7#V7C_()FAoW
z?fehSXELxs)a(E+zj)uYA3SJn@)PEQ9l9Xjn8-8Ob^qBH$_1KSdm%4pYr;I)%~O>%
zlskrN*5nUD;**!R2sxj!TWBK5pkTtqpaAOTe6$g80`)P?PuNWaMH$F(pkM)64vJH7
z9eLdDVz4`dLclMEfY<-mmrnlBA{zW}K`BU0_8q&KAV-7bKzxWpSIcr*aY=E;Fv+(+
zPynyIfy@0{uoX1QKEJ_!Do7uwSq%xseXNrcT4g6sJg7c-LJSM6w82+W2%we}yDOn3
z1+1W0@O?f51E`<?=b2U}R!}tnvW&k$09+M-a@>Vv=^vm%oMSPl<FQs1R6TI8Fi9d;
z3AaF+UjJY57o-7H(@r*UW3LBg%{wOYjNpYC+)tTUp~g6avLt^qXqu1{+_DE{)7Sr3
zsPZ=m%mPh-fhOfag<<hU$f!&4c{@iFeg>1`b9R9yd<+c5XYCSAco~d}&)5~3@G$->
zK5f@%!p*}`e9CU32^WJ%@kzUdw>|5jO@B!y4-QVINKn-Yj=ZCG53lUv<hZa@`U9xy
zG+Ao@9~AiDs`P@LVexUhgRlQ@>jkA4a0JLOIkzMv`~ax|nFI0aHeV!pcM~245zwH7
z2`>+a2_J)j2|t683BLe?Ny~%80+7aF(AfEheKz&M7wvQ}q)UI`;9`p80H^Eqx}cG;
z&KiXRux+5lS)i^wFHC;TTaY|hj*kgEm(9Tsm)i=L1C8K=^n%UYvJ~V}ke(Ova-yKT
za^acu2M!*l`bfyIz&cmZP+R97B?FKmkPA8Zn4oeSbU|{>oeCCkIZmbs6G;YeT)qCk
z`YcEuE(dZ97bt_S-wP7wWe{LBS<1k4V=4C!UREK7IeU=IVV!K{!y~!c7NihnfQcl7
z2_#I{PmcGIM4DV%b@aw+e(;bSxD=3Pa)GGZt;)g86vfLRAlRe~Y2<-C0Fm1QcKrSZ
zg$}U!f=tf5%#d+IaET%S^W-XCxEnxA0YD)K_QXcTzlfld2F+EugAJd_0A4cn`u`5w
z$s)cw^_<CE+`J3|GMzPX-@!JdaxuS<m%Dl+nfnJQ>4I_;xE?<aTA2nOib6EljzOl9
zp!GRgi)FJUESJ8YuK;SXxM9hmjtg;T(Isc0SrjFQf(A7pLA0b7oJ$uhkVyc!5|lwf
z`5u%BL75cfU2sMPh09_lXOJdPhJF2i|4C4$1%)d}Uw}QQ0sjN=6ox7PAE5?Vg=Zqc
zAY>xRPyuSefSTtbCj1Tp&aeM3n+o$6Sho$Q1Al{nD@Y7v1ISiT_t8X>p#e0=I{8Di
zSR4b>>;KDGO(Y>hFUU$wb}%uRNHQv1mzR-${eREe8_S>x1)2>&jsO|^`v1~a6G_G;
zAV-@VW8eUd4FuS*Ht@FzHGs+~@B%rQdnO0?Ys)SL840oqtVM!>31ZBWR*=gk2RMsQ
zUhgl%_+auGf2sOS;EA*BJ9ZmEia{X^@&-i1Ca~AC@7V1G$=%q`{SP$rYYv*m6lF-`
z{>&u;TEAdc%)s<6Z~tAssX`3ge?ToS0eKTv1_e+=fJcDl3o&@#u-gbS7gWhZ%-#uU
z*H2Ci5Hnl~a_gQ23LYS9z&^3!4ES!(1fCZI4Fv~Sa3+AXy<l1VgFAvnVzSN^4U6KV
zj2fV(B}f8P2!d)EkR6~x5L9Wr{=XD#$MG5ma7F?RUj^8(I7|w3uLs)*nz(`$)1dis
z&>StO3kfn5RDyy^TadvZ0~r`tz>7*j%^wa{CO43auN;t(16dC8)a(E2{+b+T;6M*Z
zkUEf>*Z<e;1+|wUfjRk5pra(XY6bZi6zJYJ>~=!bZF8M06Es7IyMaaK(iG``$sr6j
zm*+^!Un-XVaD5Kv+H1vJ0$h8TVz~b>#c<UyMZNyNEpzgnAQcf<+6DE<z$X3O<2zX(
zSd58NVDg0wk$R91L5=G9HVqES^Y8xu-p{m^dnT9U<rt|S*Jtrce7EOe;I|QS08Pn(
z<jw6B7|rMK{{ziO?Eljspxn^^pWjNz;f1{XcJnz5CqUx-Gld#1$4mXV{)<-vByT>4
z;RaZIK3H8kI4*5CK}(MU4_=M}RaTH?o3H=xTgu-ca1(jX0ptOw2GBYblqDs{Wezyp
zj^h3S^?(7$fs<W=GwV;<Ei^xAHxaai3e+M7MVkpb!wFE-aX{7&KMYXiYyd@}2{Xe1
zP;@3Au$!2Cz-}_n0s)E3^3s2A%Sbo#91w`&?&OkTtd}^z-yk4-{gD7@bwfO8KpfnP
z1{JR0*7DAkpqjy?1~R8&(cNyJd%KzYf%7f9iJ(viCBWDJ_bxS&<XixXTN6pnMIiCl
z|M%89-?Ez=e9~@V@Cmz(lQ&FOm|PRWrN;^OYkPx&1;|fe|HU*2fFoxXm(=%o9tO}L
z87NZB;}sYuZwU!!WSz_ts#OnKH^%5;!om0t)Vc+=s6kCT4o1k533FElK2XyR)E<R3
z^&qY5eX^ih|MGnKAMFnkz|A&LPXkouH)JSyfR>4XmWT%2=bXU*Kwv)i9~PPZhWJ*H
zzg{pfaDWD)zyp_)uU=Az6h)v_uQs8U%v`JXOs)u>Q*VBc2|RfPYSDmNGl~ukOr~Cp
z37{4YD4rA<4ltN<Fsy^dRSGDsK%D|m)-yk9CkTooP<(+FPJ^rk1tW(HlP9R$Ge2y<
zkb{xQ8!XPw6amV59L!9yumA311$is5n1y$PQ$526(6F3S4a29&KA{p^puEBv!zIIM
zGdV3RN}#!8-dd2MAio43vVAx?;H9=ABdErM=bit1eL*7_{S66Rm*>d60Qq?G2O*Kk
zPr}seZ-5FCkORQ+`ftfsP#)jkps)jECO84xa|(b4@Q{}b9+y8Lq5OpZ_vb%640Gxg
zDnMo^H|c|C1^3h_WPtb}9ALu&T6BamDEvZR{%U{?3v@zOOMY*F4a)@3`rZH=mITn!
zv;Z5H0)9UMVSYUU`Afy}KQ8~5|It;iaANYBaOL_Y&|Loecl-Bp|Kbvv-=Gj=BF`XT
zBFf+Z;&cDx66R|Vn8KGJFu7~8f|mJz29Et-?azYbKxyuUy!>0xDA@~n`MaPgK2RP7
z1r*quHXIX*&oFkFpRr#Eo!PPjO|IPL0ykO@f|e^5ACI!T2wr3eTgZPByw>p{C{2RW
zCx3&$Nl;jFa4|&$S}_=K@PL|O`&2<?A_pgv8z@ZYHz-tq+J77iG#2oz5IVrY2JWdP
zPF_&2S%1c^*OY^SX)m|Es;MSuX$1oVXjUh{hGPMLgFpw!p*K1B9|YKQZ0N{HfGlE^
zm)8X)I1YIxx8Pq41|YjZ^Cz$W?*X+_!OQ#RHz;VB+-KM@XMx>SlVk=vP|x*+yxd-%
z#X<*6AgljlL1H1GR0#?Z(4=I57V85LAJpdxuxAap&B+ZKxkpS+%0t#QaYu5ofx4(1
zQjnbuuuRJ9ATaq>G5>?fJ&{UG>t!czi1e@5;z;I-=lIWc-}^g*Lf1<LCGIvB4h|V6
zSB_+^m=_ETJ2?Ju9p`Rkk>UR%bOAJ*Gv~(squ^Q!RAk*?k$|MqwQoUL1+>l)6ry|X
z>?;MOZ=MeV_d!+mo;wRXIPS2>fMNooe$81>s^(y+XNu-^5SY{496z1sfxw*?@^b7v
z&x8(m{AW<;erfxb=a0|@kS6X9E=b$*-<nvE#uxIk;9+)HdI4pu`3ef4wea9+*4O{{
z>;*Xhx%>x(A}G4d?=d!j(vkToyNSh<|3-1w!wR<mHO>Z5xS6mr94J0vcMzV490Z)<
zrTPH@ncE%w4{pzwZoWK6`Y-n@E_wb30>YrR^4FUL7`SSfVn8hg{y)$rHE22%JnXOn
z-e@)1$pB6$;Hgq}rux{||CfU&0!;Qmiha;vNq48c>g`tal7ID8Sji76?LlD)3ZB>h
zSA%MVMWC<;c`*Qg%kd|;{RWylWd_ZgPW~6o!?f(;WS$r$roEMu4PxX4_kxCqA*LxX
zfEt676Jn-GEt>->13{7OQo~>XVuKv;`tR!4$pW!bW~)^}{RM}528I473LGXf3?U{m
z3<1e^>^26}Fc@5(51JjZ+v!rnppt&yZtLawQa_UK*d3gl5NllDz#YXE^LdWIQttU&
zGW-(+uIy`2i1<_`pa}Mj3FiX-DMA;(Y*UU8d<z7o@l6wI;9DUujc<d%RK96K9eh)T
zCU6IH34baUSjtroj*>h38x+8;_W&Et4g7zE4uJI=b3EWn5SYS0MW}%<159`D6-?%f
z6Ji0SrO66$%8aFxUE*}>|Lr;o3R*}YfM!uR4}c5-`4}V)9Z%oz`rocnL|}o{T>v%p
z(bQdd{co2lnmPt7=AC%`Z|7BzIv$Y4AVXgN-^)7rPn<I2g~<x>(t-y-vudD@4M^?<
z^TH>Sed1-A|Lr+CIVWDtj#B`X6QBhjdJ885v_Avf0<dX_0JjGEnYMzA;hxFG{QBSa
zyOYnv>!^U*S^QSuHOWgs*$37Z11SWx$6o*2ZaY~fL8cxQUZ6Y$YWSH5Gdu!yW<dLB
zI3yrVgzF75_P1HV<L`pE=R;P{bWc`DxUCGG8m?sQFp**a*X6JO@BMn)lKX*4B_ntu
z9>fNvuNMpq9oOS!<V-3V8cbvuw76%%hsA;!KqGj^WE?C&icMrVl(^@^C82Wn>p_NG
z*d^V3Jzhp0<b&7$_o{-T4-~q}9#G5wuG(uJC32AG$mD+s;gb{dgePYtDoJq`fLf3s
zO&oGeG3J&G60iU7UTZ$f?&IVIi83BwuiNlH08cp_wr2!2GeAuYQ1hZ4w7W}+$r-dS
z3!Lg~I3Iu(47E2X1c3M;Ltp>jchp3Jfdw=h04{+7Kn>Xjfn(fOT&$pe7|5BRssPfg
zTIdVPTs$>G@*RuqkAj^4LS8-=v}y?C5Rjp_Z9vr!=L2xRg_R#M@9{uje)|K32+%0p
z^*LMuCK3!Hpb`q=h`qhsGE9sSlOI%y)L)(@{Q)W}2(ley3zAB3kqyfIpiT`e_Ccj7
z$aawT1JpRdvo5ff7^npX3Jy?f3p}mVplETsl^?t?02DD0yY^UeurfJwurSp_I^*h`
z1)v%h)LP+SWb)v702yb4)S&wn&7&AN0_9m2fOcR(T0!zZy8kFl067*ETyHY=&j;xN
z%{zfS!E;oo0X(k33Yka-wUo_o*-iAmV>j{mode)4dms-4*a&ex;BOUb0BdB0HUScf
zmE`OiVV(tz0h`}r0#ChzDhH4UCbz6rWd64!buvqeYW=?*qM#%Vc8eqfcq9s>=Jmhr
zPhsNVmWDKwi-{yd3{-9{NX|sw^ab~0rsfOD_diTYW?<k*U|~MS><|GqOJ0cqv}zl5
zMA$(A)EEe`XWhX6Kw!@G`7-kLpppmFjsgW<_5r)V085q)pg_nzVAp7V%=TjT0lQ96
zIs#doeaH4<_8r@s*>`LozW%#wWAYu_m-`zOG(Z-j85|EX7o_L)|J|t|^Y%9=f*l58
zL&Wzenn*F!Ll&OMFgYV6c7HUHV#vBahg;&hGM50zaL{C0zk))Aasy=A6Jo&bg(gyv
z4VLf_l43}L%4J?j=JdKghbsuIznLjgxq*QR6l<U!W`GSB1E>t(kd|X|0Todu@F9tn
zwV<GV!NB+fq;c|uRI&OUTR{`oAg&1q19*KQsQNcQY5UNGi$Ms~`1ihJ*Vx@U4^mEW
zFhxQ#;C5C}z=8CE+H--GEZ}8-V7b5BXL4{dLC4({BtY&5b>cu9CP3>V+;7?5obO=U
z>V4GqqB$>k%jVWjPylf(ovfB77Y&|L+Rx>BV<~eA2P2bL_EEb=kl)OY*#(-gGZ=t2
zkbaeCVEAg!!2ok#b8`cDRs&RmC@VNX3(+OE-{YBr5X*RMC+8nk6#%z&!8=R0@`C&@
z`9hjp{j%2JTXumU?|?GR3wgP_H<BUca_~*NM94<eWwtOi!T0R~=f7xh2)<*N7+B23
zz&)Q!gfBs0>bx!c+d=w4UI2NQuU@DD#14$%65zDwlIL#_xIF*!d~^Q!LI*&L7C~yk
znW_Ge&_Pgz0cvi6auTS@YIjiBaXS*W#F-OZV)i#E6oA6wwlepF05#46P+0IBfR+dl
zKTQOc2qrc5|3RMVZ?NAB>My@wV9)>+QzjCyLCH;~prim21Fg83oRTL1F2X^bG*F2N
zp4SHz<45d1ddGuT*m!_SOz#**i~a_M2=7Qn0}gqn2uOn5TnZ|`V5@9Eg=fHJD_G&V
z;U_q9S(u_dsu(RG8umVgi&ZiTK*TnJ$In57`5=S9!E#9GAjr3%QPIg~GR(}D90j#v
zUobF$H!p$eY)~&9Y1l*oTwOZ|%mG!^u+^25Z8GIW!CNRnhJp+P)%*cA91|wzWCk%U
zoH_YGrbxYs1cMH!^ad4bpo$CRC{Sq)?KLpI{<{Ivbz)(PHW6n4Z&x<IVK>o4k_qC0
zzdLwMq!>6r!47I_fs;MR%$s&=L1w*RUL64nCD2S#@FBZIv~?<+4CeRj8ehoE@10zd
ztt>m&{FdFt{S6A>xjg4Pc2_4i7%;qGV6fVgpx`ihOSVEiD2s!(Hh|3L5Mv7G5MzpX
z{ddP#&~^pTqIHn{pncaS%=Z65bt0%@2B`&QZ&2+78?OQR5mY0+{<}637AfYfkm3ZC
zT?1^mK(jK3K^BAMArp7glZ_drf?1g&Oez^bSt|DR-!&gW*=c@*eJ>~sKnvn|5(Ex|
z>^8s0r~tAXl(a!+fRZ<8ObWEW8l)DqBZ5PQDGC%elLHb(>b>VP3Yh<~|KHv>e=GMN
z(6VCtrC^N*>^=s^Fe;cxFbJ66wEGA$6nP^^e?vWZ9UVyg_5T$MgKyb=d?7Dy3rgo8
zhkzm<l)OP64p8PY0C}D#L7=r~fkFmI4M-n{G?ON%I(qQ>|H_9ZQjBsS7n(>iJOW9+
z{=af3C>BAzbkKqeP+Ff9%rSY!bRHGZUX0iO*MLfX7N{N;kfTBROr#k1z5c(FbMk>)
zF|idlO{5q@z)Ii^zSR>azsZ#YZDQuhGx0EYgN!1B%7fdg+&@6QN#wu-WyRP3m+v%@
zVgOqO3V4t;um7(q1X=mM1u}&)SwK-{@&pf-dZ;9)NfiUj<vG&7`dgrLg`jRL8>}g?
z>?NpB067d?<Jqum;BMuL=h(v~!~a-_=|Zv85B|?W3?}jnBFXa^1zyO@i-N)dl&ehS
z85}?X3>wr;zi+qGM4rh>DT#q0{l48n6M2Su3DBmG^viZf&F3(%n20ejrQf$ZX(G=c
zWPaVAGySsN)yu&WKg@5~eN4Y^cM-PFB>leKP0(8H<jZ!?F9%Eh0Bs%tRp-g~?H+<1
zaoO(W<zT5F$+zs@f|5`6eS6O0Bld!zjWD47FX?x{J9O?Q-x0EVoP5XbY4T;e*RTJs
zVNJec_kQw@{2(R{fyq1tN=$45lMM>Am^QFZjwuMPR{#yAnQ$|Jy2YT$!8%X_4%7w%
z4W~g@K0|ht9<#d$8rc997tp3XqxoU$kDye=aTL6CbpvSW>V^H%YS-s;YF_`(aqPx2
z=-S|?ET9@Rg1eOqyrt;{)BZW2t~|$KEyP+@Q2v{81H3qR1}IiQQ46ZRz_Iyv-^$58
zg;Gw7KZ5mv`mdm489){4pFQ9u=f!vI3c=dgnIent*d#)=34+uIpSEiZJ_TA6Y<+NY
zLa~yN^+T}fu*I!R`(!|Cf?dGv%)fgBO^(6W1RsU3X1#^9n)UCZPS~2@hCB0ALH53o
zmum%OmdOT1uAt%$6fWjRAyX5e90*&u3R)2e>c_qQzZ<l*7Tj_GHMBwQ1iASI)1DL)
z2?h<28Q{%QhwK`I58E?NK2Rhk#sOOIU3i;^8?-=uA%`TBCn!25FL)`*e%h`PG$J~g
zr&xvsRE$s7DNe6f1+`5;OHNE=7&HR3*&pyG2ppgDz@8UWHh^L?z@GgBXe`#`4`}j-
zfuZ=I?MLqCT<qo%3=$k{Onw|}O#bEpOb^V@+Ariy5V*>>0JP3eSb}d6Xi=b$0QYC6
zV7?_FF+mQ{+CRQ!0>a#%nc^GoFHqudsTYtpf5pJY8N<cJ@d|ukLe!o=cA^*VNc`a0
zBP3w5ltJLa9Z3+I3AC<>XPFQi&mJKbjvXvAFXUy<f`&%tKTr(fZxfJjf1v0D+R4h_
zBq03xzaR$(KT}LF$g!W9oC6Fw7&ru(LirX5gmoQO6ap>2=d$6t!|&cEz+uY4z``lP
z#W7c4uIh~%t_S?gLQLio3@rRILb7H?j19#%>=^kJ1Y)|I6@r3n7!>9=C>#jBVaLe9
z!xRY$Jq})`*vS`4MC#2984UIr+4qAKg9d3pBRHVMVS0suiGvHYZBlmbtv>Dt=F=FM
z%(gNZ^j)yqd+QEp@2re0sHMTDCLm!V$@nk$mK`I=(AUs}3tABaN<g5J1yZW8BtS|e
zHUUtK-u42=cKyOzFTq288*i-uZ)H3P-O6~8Lk!&Meh5l&pp*ugH&yrnnri|jbMwR2
z8%-pb9)K!)PzrnfXSXdVwPl0WsIo9cXP>eLPoSBIGcbWX1uB2R>i+Kpcl$t&>u)ei
zhyV`_g33@CXc_u%xhBXUkb?OQ3I!Z8uoFWz&jqzzf)80YPF@h9R&Tu!W-drM#Oxj5
zwY4Cv9Gpzy9H0SrSTF70!kHj-kh;to-U9>GWw%`+>i|K1<&b2G0{IW*=huIBh{7sZ
z(7Ic2uTO?4oI{2w)P!G>feT{kp1<HMS~E>z@}4pomfMot4<_F!vyy9KFp*&}n(v^X
zVUhtEpM$91+6!{{WP@@M9`j??7hnI`z7|ybO!g@^u`oXlDMdh;6*K`4((!_6lMDwt
zQ`DXXir~H!Ob#Rlk>7Y{@|JR2_P_hU6Y-OOlzY`L(gc|~zrk)PC^W#$7#Ri=SaJXl
zt4K0Mfd+T@8wBR>f1semKSN-0UxI=XC|SK=V7LHk08V~j{{IC7gOGbLgF{!n{c`g;
z;Ef#f+y5(o#9X@S?d!o}69gu^$1`|v)iccpnZu=B&m`afz}_7s89WD^0Tf_K1-ZEa
zs*EO2m?&v4&kz7|45(cLs+zfHa*1#^a|ydmWyra-Me4`3sk{=Pif{jX`=fj%LJpv)
z1o{2-pDj}p5*Pv|7sSidgWCU~Ehr!fP`wXIbGKO`14Ym{6$DST{#(}xG5{1Z9D5+U
zOD;=5TigFuHiGnl+Vs%n{0Bj6LcvYpV|H&rnF*Uc98yfGuE-6H*Z+1U@;eBCws<;U
zhV0P-uk8ReDC&<dc4z>(NV$Q5<4S^z%#Aee2cT`-$_)$}pi!ufn)$V$o|uUwthcd`
zmuG=M6sWO~v4<f7oW0qYVoYvA<^S!B1j)~Dum`u^UdYR{f`S$n-=I_u3KdXKwfKl#
z@JEp4pd=0o>(~EwJOsJ)@_gz4@Rd<AOs?POGZ=nZz#?a|-~RvnKMe_>UNFKzd*1RS
zKpj-W5W&GZ`Cg?oBkSZ}m8y)slNG8IQotbvI=bPm{X*ze=f&IV+&@6Gez)DYe_W52
zlmx{Ra-f0gv)6yNm6{|o@PT6oG;aVZ96(c<|JIj+W9<%;eD`z6-23DUmsA{>7&!KG
z><6C;lMC|K3wimephOIE0EZNK6%7L@ZGi&d_5XdnCQ^(Hpu`Q1(j)e~lO3v@8676K
zRC$0?5NL@rNGZr|pgPY)ilG7IMo`jx{eM5$3Xt38gErmCFgb(vT)>j{>pyE^LG7r3
zJq!s2H4F(3`xy!n>KO{0=P;OX&*72*&0S>FFc|P05QqUyk|)$KIDne$pq6v+QM<{>
zd4iB(;|bG6>Tf%9KY0CrUnt1a`x_L%14|%>z5c&X7bFJq13YOSvFC+HHfU%13&{2`
z&{XSfb?_lg4{x*agLh{^JjLjM@YKG)pm2kF>H-I3xFyrYM1s));j>ks1E|0)3lj-O
z@Y(`U3j^$+Kda`NR51u-WH5rqV?cvN0X8fbK&x9oZGwUtMg>qOC?lN_w21e9MjE39
zPrc9q{$`;ApaDnF3P$S_c4t8m2J2*jnjoO^7}U`MCDhmdcfmVX`x_KIK-C6l8VVG8
z;1N&nc1D3Y5A2uTcm^2{1Uu~i?pBjqkSUP)4feSpp9Sn;Q~*~DptYvZ<{om1)Zb7q
z%W;^C4b(R0IUocIRPd%hSPFt9gMFo-iUB-3$;<%iR;p@%8WQIJ?H7VJWrMaFb3f*C
z28rGN&;Mip1N-9~$z08o3*zPE6u_wwWKMuGs{v1fz#UNU4dULNUnld_dhmcoCqSY5
z`u~o*lM`yi*mkT1#W<+1G<iZTM?HMqDD(&vP?QE(u{?l9DJa@s|KA4hZi8dQisb_+
zn&C0}fBQ;MfPkVMlxD#W__xp%qy{85CqWT3Z|CNb!6-17K>?~)0W>mHzwq_{?Wr6b
zupuhN4WLEdAdLYvj0&LI4b;X4xfo<9YUn1Sj`RK9)(Wb}Ko)`*@h=bnSHB>Aum5eC
zX(9<3X`6FE;R7hC@GKCBH<6KIQ0V@na3lD*-9?b4$_kLa-s}I{Y$tE1Q!?8Op8f}$
z37(L$U-<g()>@EKuo!5wzybmAnF_D}ZJuc&$*==tHYgcNBQ4N1zsICde8#SjLyE}<
z)PX^15g)iAA;a$=a3{EnLBTPG!J)lHVFhSwBs@)86#LZAS5T1RR}i=Z+FQ?WFLZ!^
zrqF@83ii4nMZ9VPpiNHydX{NaaBwlj^Xdr5IL>E?Xn&&GaJ!fP0p|h>(C+mr6J7?U
z%MCj}T%Xe=uyrki!sUh?Kd#T|<k-5FLEv)3j+*OpI$E}_W#G8nu*2^9oDQe0YZ+KB
zH(1DTUCU6<baO5L16~aQd0s668Bhb)gpUEdxWGh;L4)&bMFR&flOJf>+f$NV;&Q*#
zkE?%pC0=l?TEdtoaR4;=$e1VL017tqW%mC;<sf$(7aJ&QE*xNByWP$I;PwAay*Dm!
zKL9sfLH#F4(E(jESidRsx*JCes5-s*p8Ep_KU35T&b2R~ap1}!%LIvo|C?ArmT)Wx
zst27|1WHSw0|Gb_f@(m^m2dxNkOx(YH!gur3uBN6t&Zq#u$c=s=K(|wNdER52KoIR
zHo2E4N`n`UnixtjG{72Bum9}J1SLq&J}|IGP)i)Py7AwRi6FUx^vQ9J;^M4KQ5k6r
z;PqPtsSE|L|E_;}<2m<($vuq{^`C<TT0j$xAoudr3yGLV**^pY2)8Sj)a$?Nb3vV4
zo*E&(%kw3E@YD-|$FeTZmjto7OoZ(pg7lhxvj5LhFT`Ua&!EsLkl0|dhCv}PiXi}G
zrg;=}#pmDktT)oRAAp>?cY)FmP;tlKAW#q9ea5p0)Hf0m0BzgiSpwRTCdk3FOh5`0
zFknMKJ=nkNLb+!#Me)xP5aypFAP+JCWElTE0U4eh0wO%cLQ*^>LJ~anLZDqZ;B{fI
z|E>kCCy3(NBP0j*z<wbKu;cd&Nr4>Bv%g+Q=7qduu1PY3!o&p*945RB953Xh-kPqp
z|H-pohy|RJrI}oKHiI|Z#ex<(@N5)f;CRo)4qDW}vr&i%6qLo6?HFJGT`O9A-}WPD
z|HS1v;JzCNwBN=Ba_EISQs7wR*(1cmvrLE&+>NgPyJjs14-?3RVwa~#{NULl1g>!|
zPmu(%g+RW)JVgpL+5<Ui>hBs~o-INmAOpE4aY=y<`MU-@5)bwz#0+rN8hqdOBgmZK
z%XW-BTZE)Q=J0F*d01vE2M?3$)N>3D^`H!K<&XdaXtx1(8`m8ECIJ!t76D;UZxYl+
z;wcf5;;9jm;3*c8;i(sb2J329P{^1FGuU08Ch_C)RLLJ8!!OU5{=u<~YYzW3AqM`b
zLQMQqgjo3J3$byW=91~29Dnq78~=kB@?uj#q0Q?caClCFLSz<Cjeu}hs)7Tk+5k=W
zg3~h(tn0Mtph=be!x!>mrl5L}gPAG*g}i((sFVlgUQj~avq0emD3o6RUv-y*feE}_
zYkq_2(a8$eMCJc%KM1M`K%oUT7u52Co4xVn<bW2X`jz1J$P0PtsXTjx8eacj`4wag
zsI~-YGjC-G0Il%xp2H9TsyabyazHe=YQM<%qWFTH;bj2{c`gYq0np0wO9Ju-Z|m_t
z01X)365xKoA;shk>YswjThL$;sQQPtTONXj>Wk|S+cSR2XW9x{o(@`)4l1Bw(}Mf~
z0(bZw1kMJ}VMyTIz!kvXAaI6%g1~VO9wtwY94=;ee+CuP4h6=m3NmsxySV>-spnzX
zdq9zagO@1~)J_47lz~RdK@s__o<RWljHtbn8#q8Mwt5aerg+eRD(Dm>(AkAb^Y8vw
zTG0Pr=|KPgc?FPj80I%9W`MSk@+1g^U-~cg<N9}Ai5Cov8Mps)gR4>SFaT(>;opXv
zW`>Xf$bAO($N3Z>wV%l^1{Uy)$-gZ>InHu{w}*q0JqIh3V(jbxOTU6*u)QG>oc3Mo
z8B{p`v&g5`GpL{}c{iKS{|~f$Yp;BRgxP+E6TA%q@h{}%T>0vSVnO2kFNGS+?lar~
zv7xI@!e7YC>6`wy2lWFyZolV$U?R*Y#8ty2(>}r0mg54KfNKqd3ilrtnbaBvl^61I
zYfWVAzwSMtz+ocK7-S;PC<F?b+jIEqAM9_iD>sp`{|q`83gjwKA~2U=Vz_R}@f?&G
zxFxwHVJDCVM=>aHh(pux-xa=~Lli)bTUY}fq#iUBYIe>3KWG7$SusB&=)_XcA}-Lv
z8_@D4@ba4Db{9dti{hgqb{}C)p<ri*gy0y43Bm4@=go*vTf7%k(u0!f{00RJ(BJ|n
zEKMXB6hQ4QP!4(he;?~)nVE9+dym4Dg1RbTsXyB@LCQheIb@hTOgI@7z*`V_7+6fW
zp^airCeSPeWL^K?Mc{TDNd5c<l>ks#2eT5K!9d%$!As!xfKES*;%sA*X>U-z0aEW!
z|DVByvmQKh58l;kBExvdM3|w0dp?tV^JityW>9b|+(ZJrbOyd5{q^64M@={w3_ym!
zEW7qVMjoaP?2-R_;Cu8y(-{g!7{F$Mn{FUSu`|W8y#Bk;bh5!LCA$S+$03^s+VGAD
zFUZIbNFE%Hpi%=i>hgC%>EsEs<d}9HoxEX|6x05nlh4djW7@xR@|Rg^VmsmHf{y$E
zyX()Ui<1pz%Q5Y2og6S*ifP}@$vLy-tagGO`+|WX0MxI$a7_At%K-%;hyM&MFXUxJ
zL4m}?z_Eu@2DJ1u8X8#k|3Py^pe1+gXY6`G$#3$9*^cUeRw;r;Yh11|sF=tw{%g9^
zpa60>M;VvQ_x}tm-19pYykKAqnjA5wjCb2xo&y5cL7Q*;A0$k^Jx3FyWx|998le3<
zQ(nl+y#);{f>I~wU@6enXHc(YQn8}EgTS#1cclOKgBAixF}Z@h_J6M|sH6mC2G9b|
zdPPuiReZ<J5i~9r9K)bce8(;@IEKNX_>Ns-a14V3Xz)3}h85IhIu7di7azAX+^?Xx
zApMSAD5&?rA<5)ve#*`e)VVg{W?^vI!=TdL+z4(*fcH~?I?exgKjq+JirNp_z6ENa
zfer-*MG$vAQv|q?4myySX<-CtA{8_l3knQS4+i82lVdClpuLhelDR*ClPl;bL9qG-
zKR^{4NG*6z4ah)<WxSwWBKsR`!Q1vg=7G#bHV<SL$f3>k&GW%A^+H~@7c^7>Y7?7q
zvM_*s!v#KCcdhwpJ3~<Lg4Qa6!q9}v{w^r9n{YB1fHFKtEvT!b@Qi`M<T-;9B=g&S
z1PxMx@;@lAg8EtDQI0>WADT!p!&;wi;A3gPz5=Cpkn8_$cLZnnKd2kTxVxCdQPln4
z*a}w1!W0c2dbkfBdH^qDFcF93Bk&L%ED!wOs0ve$ls`1Vrx3jUyA7OiK|u*x!U@W-
zU`24v8`e(V5UB%S90dw0P*)V>HBgX%yyrcKU4nZK*BlVOK8K?PbfzBn9IpGH>IF5q
zKeGsPPv)BZ`Llo%S3L`8|L}e8`CRk4=X1q>su$$o{tOlaonY+z`p@#f+p`$WK#l>K
z{rdmrMv%*c58F=;b{3p$Go7n`-&s&1?r%s?xILfyKlF$#rQ>rBXn_t4LoT&nfS2If
z|AZdK_8mDQQ6fi@$r%)>pa=y;CM*(zV;B;g-5EfOrjEY;zsVDnZTssRl087q<H-_`
zH<4kO2dZyCL1D6jfd}MdP@mL<&E655N!jcZx!aiBUjJLL@y0Q3@QMvk-vTr+3ep2o
z|N8IVxu7lr$1|q3<7rOd<>e;w_IG)51Y}HBF))G5H(ANRVzPpP&15+PN4<$WgGcv#
zg%2jn7`Q-&fYLwIAYPt40q|Z~Q0C()5Rih1@3{+B2g-aLOp!cAaPhTpadxIio)Wk?
zqNB>j6v<Nt7x(3mW~z4q`5vs13szz7k>yE1vN#E*VfS0GI+(>NaPhrxagfDnaPeNa
zILP7*xOgl~++?Q_10Td!yG?m=1f*UtFc^SRBuD{R{6A#JXnR9#DafJ72MvMZAGACG
zqz=@yyR88pmIAG|b_0#{fXo1m^nk_y!Og$pkkdl=0|btnNHK^6`~e@%a@1rgxN#Ku
z`tQ!K;MLe54}u1BV7<BjyS{R;gNi%_$m$_!CKvD-O|Sp&G6hY(><3l+AWfh}QxYr;
zp!f$l>h=F6pwm*pLtLQBt@sXPi^S`{J5^1j7zBc$TOoq)*i8g&hd|^>2?hz!v@Iz0
zf($Z04p}n}I@<&^+5#I%L{9a=&I|^xfA8uAxfE0$n#eQ$Yn~6SjB2>#ztuCa?El=T
z0h$)RJYVWX@_oC5H|iyRB;U6?e50QELGpdO*rPY<nO@vT<_1X~2PMo22Q)x)%Nfac
z>^9%1k$M3d=Ssd~xBW(q<OfhMJo&KQR!}y&kSy^h`M%xWEA=w>K@Lv7W4H75|2?hA
zhwXNAH)t#{kztUSEMuxr4>b_9XkQg%C^QZafHZ+x-Jm1gO(a+tK+SZ}>LO762O5h)
ziBHfG@RAG+uYd0VZ`}f=3s4pWnE{G(6A6ZZ*S~kTLPIJMRMn;5u>+-_`e+cR_^@3d
zNU`~0yM-VP#dqw$#gd5xgT(9K+pmH&CLgy0Z;=2`(XheB6?Ux!$ps&`I|w@M6LkIv
zd;%1D+Nb$FJ4aC40OT=PErW=zdV5B&g`hnEC+rS_;ul;x9kv$)mrfqw(&?Cq6a#3D
z@nMr>2A0=<x1@qM;D8pnNI|EFe($jbnFIDYa!UQX1+?G=+&cxWLjZa5_3u51IjnlP
zPnPcl8PMO52tE*LE`wr%$#DiAkQlse`g^ac2^S-{1Ov5AK_d|$d2l7q3EFY8*%Z_g
z06PNI3IK`y-!vDbroSNpysaF>hIEm)?gb@Glg1c@10W5cdX7^bT+cxY17=v^v#A%F
zH8uvHusaCO?*}4fAeAdST#=}W6eGB+$+G}lZaZ}UvG)Z96KI1U*j6^!N~k53peZ=e
z1O~`rSlocRX8|@`0iZYnRTQ^9_<w++!-SoI0bF@N2SPzvtoX3KuAs+b9uCj~v@i8M
zEzp&+3LcpZ3Lt}er4%9pRJjs(mV=KEZ3G>KHu-P2d_AW!7iWMLR{>a&h*Cs=8dn3a
zgTQ={Li7I&OuX?z4LoN+L-+C@KpkaXEdh~RlldQT2s1^#;M}1Csv4X3$Grsw1IP@n
z8Wx!VRjvs<Hv~dKe4Z^r9swF$3pm)A!g;m|g@D8Y6uCBlN*kW#LW(XP^$asO7?~nK
zYf*WY3;BSmGf=AFSuO-_)=fUqqs$z`RWtcrkCX~nCuj_oktu>_zfgcj4Z{qOV(w-x
z8J;adAs|~OYxHVbb8d41xy*bo=omYhzr3+R4Lm0VqIfj~BriwFe|W*UjfH1{z#Nc#
z^BxBUP<(*QdHsL)+sQq>`hf>taO`6Mna1lNFq40-Pyqic0jU=pdvEY}2zh}0V8L~P
zf38pnhYV9Bhz~k~I>3qxymKNT336&}KsAHG3wi0Sps<-N&?m;UpL6noOtHy!eVmLB
zCVTX`3jbbv7gRWbq8&V5ZNthic|o5z<A=#R`tsRd?Vn<oYJPvRUcXp9hdfghe*@yk
zLC{3>>)&g@MF^<54yuy){|IsL{}BR@C7F~nF!BEp;xUn7U;}M<<^LnZXCld<0ruse
z&09g{y^xok8hps&;QR*)hd`q_?GF?-fp*q`4jkfd5|HPRWr_hUMhGzGsAu31W(ws?
z5D4qKuh0cv7_f)ysyXD8?+2gf2soL~VX$a!n)4L2a>48m1Bcmn1}2U@Tyt)H=YGIH
zUnqiqvQP|I{S44lzU)`fA@ATR{$kJ+zr8DTia!_B-2oL%=JyyKKxHeaTrEBv1}T={
zV}*bAOf^4hcM)_HFDUS`??8sdL5DShefWE0DQF*B_8q&MAbC*yg7={P-UwbSGQYw8
zDoA{?f|o=D#5NWO&=U3H3wDkm1C$sU7>du?C7PeJUs!zBt`KxQ;B6g#@Z3MB|83r7
z{ScH1Z=Hl}qyioMWg@}k0Lq{o;!N&0Ik+E8PH9uEKW`TZ>a)N8y`tCT7?T4}g@CV#
z4C51!<r#Nu4}wxV$Z;S$U;o(^%DI4rH{*`&Nsv4!WkAKjqjwp1Y{BO`nMy%hB!6~-
zM@2I3*xtPHg8PAT179MiIu|=gucAT&18CT>eqw_HgQ5Zh6L%+*=S@xS2b}CH8eTB4
zIPE#wya5!{a~o8HlpXpKLHi{jmhA*Jx?Fe`2!VIxn(Sgw0F8P<<wQY_<yjyESy?2*
z<i=AdFpFo8&;*D)VljdVD+6d98?Os@D-)zu_-Du5$rIXjng8sGoqV7@qn>*f3q<1g
znx&uv6SD8vS%RDnI$e>c5H!RqEWuNZH0)an5)<U$DMt+Zf{!-%v+XKq*cUY1%aaLG
zBP_v_jifJEK!zt@K<e`xK@RY6F$+^P_bet~(0OXHum5ZVm+n^<$jCM9Q34m(ATNRq
z{=EjY$1Q4pgWX+_!$85slPEC%`hU6m^BWWtc<O~3!QTGAQ+4u}4xjoxN9U(rl#%|z
z$<89rJ%L50d47Vx?brMdxO<soKvM@`gF%a&`Iur~|JicaWIZHoL57190z@3#NaooC
z34hQG0tZAK+(-t6HAp=tH<uL1yxSh!51{h(wxDBtdG<ge=Y_mfD+fQ5tFi-M@(X#X
zrJsFx7+%QBz6BQ)hlD^I-s1V+fPzbq1Jt|Xe<vWuA;A>RJ&h@hUqL{UKR`hEx`K=(
z$k%--3KEwsrGG$tyL~T*JW~X6zXz0qZd+P`menwVkNCXx96IUE20m%}Bcy?3&j{+e
zF)?s#1~~$JbqL4$08o#1a=-)|l^e-SzFf&%%%D09<TdaKu75T`PX4>YB-7lkkTE?$
zj8O!%FNz5^eI<Uv?ks4RILJtlJ3xgo=!~+-EEAP|g+Xmeu6icnNeK#|Da#_IB>&sr
z5_lN+>V+7T67!MRNa6`d;t2@x$srTXnD$(q+%qu^G*HIC1lni46=pAJy#dIZpfCcp
z=|Sbz>;L;%LBkfx5BzVNe`fG7|Ic7>eGcag6Hx{Qt{N_3(A+raL{?Dm6?D!tPlCV{
zuK67eFBlk{_!0!fxSw)~fGT0WX+jL3i(~j31Vp%|GKuu@H`uQSDF&Se4syUWGe(&d
zP(uN1`!TzRpfw?gMx8w)sH_4tB0%L6C=y=(-wR$F3rb3$>o=GfIJUw<4m5QKYD$3&
z=Kmou%X=of#0!p<po6`<CV!Y@Q-A$4=L}F}DJA&d=330fY?i^`0g5zEc`gpKVg>_H
z;Ro74cKbQ^gZT{#;N6Fy`99NN1}5&OT=KWFxF3MFo$$&FF@WyKx&4Rx!{z_?KTL<;
z-Ej|ecgLZwH2bL_eISQ`>d@emcAzHLWOZ*T@l$qd!OgZmtJi{>ZMWxeec0b%&k9N(
zVnXtu3l=20((JZ^8Udhndy{#lm@|e>cA4VJ{AZQx<en*#%zsw#PF^v^R{GD{+Rv^$
z3?{cAJ13MC8bI^C3t#_P>pN+xHDl^zo2iD(e^%5^E|_X4|7Q&=sH6l18%QB2nVM8V
zCeB{}S$%f$fvJ+rf0i$ud}pc}(?-V0EYnmtpzFpPCNG$##J1TKq<ykNs2Cdq12~!L
zOw$BAC1RQ!)27(T71LzE2eyGC^7a3%;KB)H+w~aE8K4MKZt%YyV9(JoX}UUN?_`bX
z@{-`@EH)*R6Q;{aZMX}vACy^<?}xZOheLjH$8>qgy`U8rST!G*u2#SPEr&Q$1Zcqp
zOf$qF78#HMu(4`bgVjWe0enRO$m!rlDST|&?jtzO{oM#&)el`71fGEcc`3k#>jQs-
z5O{SENbl>v8&{f0F;sCRfO@RR)2n|sR)Q=sk(UGa2|xosU;|9JL0fxdz=u!%=ac8C
zVT$3K4>|J<l(hm(xdr(43pJRCF<dZ_XE=3vvh<&}6a|IblWphg`GObXD{C+?y#BXP
z)7(<zASgJ%#@cf$fHv)bTV__Q;Kk^#|1AaA#UM5F8x%Xh^Gq_3h3^4s>;;o;7AVy-
zyy9xmSio~fsDbBzz${Q20ekD;f~(h~IFdnHA;z;efTpwNgSMs1Fu8)3k%9)MLED!>
zr&-^g!~bJ{gVHJvHYR7D1p>Fg+hl&P11|~T*#o%&Vo!qoT+r%I(C!A1GyA{TJvDPK
zW?%x1KXQmNg}jiLJ9>K#{{xU?Knen^SRu#j{96o9TJsx}K(hj%BlE!ffdbUn118%n
zP_Cba?hVk%%Mh>ZXGHT#0>mqd3FfT~0wAxLa4<MPy>k)a9mOoLcQy*#0v(wE@uFf9
zsAB=@5J0@RHxm?O;C;;|I~h2@9CoJI*T45#f)#?gnXuizp!NR{IY!W(I(riAWkKQl
zf`K6cR6(>)QRFbG2aT-C%5umvIro3DGX<T6f)qTWu;2ly2Q9A%K4$k2ycBNo*+?GH
zN#gBO6e1vo$i;#TY3@*f-iRib3-ZN$2fJF3>-pV;7+%QBrGgI9=Sc&z!InbUGP)qW
zpc)Fi$l|=6BZnlDKWIXbLxRZ<G_PmE%a8z?+cV)|NB~U^ns75XWPxS|O}H4mK*K{O
zoD4CbVI&g{h7+Kn2orXO8=zqbP;i5)9MG6=@g+OK;)`~Qpjk&)^O^Sn<ifo93hEDn
z57{2<)=~s-t22Gdz{J7L6v)BG6wk9@a^E6xMxDva7U|b7WncnL5WbL?zYCJ<R#%YX
zStKBHdnW&nW_5*Gpp9AF8Ws&N7#MFgYdHKcx3O1j)>H+Jp*(BWbf_?qVc1|I!{F6y
zqnH7TJrhX=FAxnHSOq7a-wPN)O_LW4jF6GdB?2;_AuiCsJID@)W*g-TCNd1ix^3)R
zK^k~Z2+TA+&meHwQvL_Xkk`NVgO|I!V1RV~FVB(w(LQ0mF32J66XvT=p0HTCe#-y<
z{|i8vfq|(3LNj!LXb@&#V1zVTf9=}}G7+3;<Ym5^tY=^X*~EK5;N08;2@c@nsz8Hg
zk_?cA8^0in(?IGu53ulo<zWkMe(eJ{(Li!9<m=^QIry3UK!$;uC%gv)Zi3jLg$yP#
z3=6vdC<cHm0S%vnmOb(w5CG@w+m=$06X1U@P=q<mM3SKdCH#Kv^##QN$Rdz_kY11(
z$Z9UvTT0J<{cHc++m_tF!3rfAVn7N&;raU49`K4}kVdeaI0FM{spD-+?!O>QA!_!6
zOFB@B2B`t*HIal?b-(t2hBCmzh9;5>;0a!co;|QrBBSd;E(4A0gEnV@g2{xRVFT|0
zflJ)_O#P-87z8+kn1V09zyD+Edx+(x@9qCzd@n73t5`Z^UxGpww>*oy`5pU(#dmB!
z-hRjZp!ERciY*R)rf?1+#A(#8f9<`>A;9GKLS6=Z9G|%aD8I|s=Yr=;K`YP&nIePl
z+JbjHy#BT8uIV|*KDV3aKs`};U(hObP_%UavG|J||9cN82$)~6UkENY^%xa+4?wcf
zegy^a(E~5!WlX`*z|0iIA;1*-`qwU1({o_UmvXR}F-3#o8)N_|o?)8jD_Db%Ed&KK
zMAOc_P)*>|7$(~kdqCDh&R8bTXfS!lG9{+1Unk#L=4k$FzpnW$yVB&tc5_W+SU}g)
zfcvl}GW-qcckC)bCuSz!v0D!sKTN)3w|33~g$c=b?3PZ}S+36N09rvgIbykz6XY(a
z_6EfO6B$N^h8jiiIVS;@tO1}H2FK#RC6=&FX<)xAvnIghe(gz}yl1(Z+(Jh*CE)Yt
zz}kQ9zB_4!n$!Z&MkB~rgakthXjBp+yJzlXhZW+C4U;2QC^G+E8alaVg*7K6GydNl
zJNdv0QRcs^d?(*nAy?130Aw$C9XcyhI4Fg}w^aRJaupPW`x_v~WzJck-~n<g2nSfQ
z9stoG>jJD;FTDQ03w%e}3wgO-&>9iYez^ckR`89qkn)%@!F;d%MsN`dy3k9C$r;po
zH;I>FU?|?q;BecR`$6$8`-}WLg%0xX5W2{}UFZP+HlYi}TNxDE6%-Z}Z(%Uts^Ss`
zSsGx&3fgper}&oLK@M4_2o8Cs$l^P88_jRoZ7jZP2VOb#`v3a9#h2|aPQI|xV6x8@
zj(X(={-2;e7^syrKSrqwv>|bRjM60K#`XW_$0*HGZtDlpi<D=8=~X5&3XJn(lr||h
z_$khhQQD>4!2f%GjM5?HCVdcnO1T-#zogs@=HF6o1oIy$H-YI_pnELl$0&U=pTop3
zKSrtkmvRF?<NO$9CgleH+w)_Txs*HjZ=26yVF0sdfW?HAXM$-d<vCzlNqHWa)<V0D
zhiU(m1r4BEctFAb`uAdRkvP9W=>w<`0f&$U>xba!;7f!gK<yy&yY==91C+TPUjN?%
zo@E5xrUQy6_%%Mi?88A9;IvP2@VGsn`-k~|h6K<GQ;_BW8}0!9`9cDqb}6Wx3Tu;s
zid^&m40#|6!SQXw2EAxSekte@HK=%RfDN01c71{XXwtVdz=jQa(~5j-fDM}iRFP|d
z4IA`eA9>vX8#d@oEApZNHf+#~R^<K$*sy^&Lcfrgdm3QF2EAxS?reY!8}y<Txvc><
zY|x8V<mLw0uz?dPXuDH=fDIe;rWLu|02?;wO)GMt0XA&Vn^xp(18mr#K9ExluwjQ@
z6(h$RV8af*Dn|BefDJp;1G0AmY}lb5kUbh;!w&U;>{{@Rg@=R=n#k}JfL8SvAGNE8
z-`@*rwu6>1AHQ?p0;o0N?Z#jM%7Wmy{J#slX#*CI9%T#$0aonb-727?={-sq6g*17
zH+MqjdH-*g1?h#U=SdKl#*-m1ou@zmJZ2kU#oqAx|E8-v6-)v%L5JiCKr$l}cnlSk
z0Vi*GsZ;;@@1~m|W9Bz#pMV(!;s;o<PcRW@U;$m#2X@}SWj8_R+QQTXSh0gk572HL
zkQzl7=t&j-mUWs&LKYx_A~-;qeFMlGP-y}(7o-+yo~4N-!(`=kq5_~HDGqj~sMmit
zOf)}j=R4V9oml;1S<wA9NY)*=-3(cWeeE$vGI+BoXi?(7rI{v@4B$ypkagbI?JNVV
z*ui~blL`i=Yu`DNK{uyBtXwJxQwy)p;d7qrD?tklK=y&w4S*A^`AIuR^P{$g9BfQJ
zpkWjaMkZeqK1K%jJ9fU!%}(H^vmy%v14yH(By`2_-*qp+hJ#Pr7GN;pVqgL5V`c!S
zFB2XH9?)<cXmJl{F(U^flONPPa1jrhP6X`;uQ!ooFao>!?>bMAi@+}9U}ykoHa}?#
zT3F!aeaFtRxw&};Xuc8T`v5Bz@I>0{zxyHAVz4kp?{82|0Cl6FfzP3=!oUCuY>3%w
zCz@L_uzBCHGwg5B0QdSpYexcXSnD_NHwer*zUS~Os74lLB?boNxPHi?;(vBc{p`%c
z@PdIEyc-(4{0zL}Vf99k4?vFPU}g#r+`$exN&|E(DM<eRrmLWFSCeCq6yko}&JmQj
zL3V)Vy+Lx|ajAdx3lD-8dVmaazh&nLRsb^K?{-Ddp;PX6>>NRI9Cx^6UdYSb1+8oZ
zI|6iY>fco>VUBRVW9Qo6pzy)@x}E!_@6ta4Z*YK@CAnX-^W@-$9l*MAEy!Z9V_2A?
z&A!`zHLZ_;OooAi7Cc({Z^1&4B9NtU2Z1fy#%La8{}tpQkb^;otbx?r?gA~fl<@^Q
z7Hshjc5pimT-(Ae-mn*BCX&U!U&zbznnp0NLFT)_7OWHmDFPYlecjd&6cX+?Z7o4Z
zJb--(R<j?pf);!|#S3|9(D9`Yz_WB<xfK)P`fu0<g7gR9v~>)=1y0zpum9{41vwmK
zKFG14w9wo<zaHWM*bMle)xIWD4BJ48V2KHwfc~tOHIZTfpZf-0iUw-SOEK(%$gO&M
z<rufb=Q$kUgatZV15~GQ++>ObZIlO{u@PXy1#atsma&7{9}s;zzJ7NS<B$Pa21(T%
z;6a4fe|J8d?666^-T`z(J;)#F2W$;NnGL>&=<o8IAiuibu{CUOPy}Br1u_AoHb9*N
zGQ{wAC+K#esQnF!6Oe3xbld;#01u&n#P>HSLRQzog5dA&uaGvG98>iC21U>r8m`Js
z_P;@f!-w$y?p{0Dp;|%%G&c_R%&+CD@Ln}+lM8GX^Vf3U$u^s%6+uU+-T?&-Y+DOx
zh!C`u1+=9l_>e8*WS?SlM@7&<8!zOgpMpvNP+1Pz*uo(RK2Pl;^h6{0=E`6R27~zw
ziUyz|Q&0#5SaJkRezI91B*20L+}gZ#jQg+2QYMB=*Q952q_RkY9s7UPR1S8gaFF-s
z98hoo?H>ba2FV9la1?;baHu-a!NcJoc~DCNyjuq3e%Mmi_6CI=AdMg#V9o)qtwF&Q
zV8OA#L=ti~;_Lq_!G}wLEaN#MAU^MbT`hMj7c)o?$Re<Xu(1EX(scSvCU7!(Aup#3
zviOC(yl;Rx2kgMw`h({8m>oc)>7Xt<Y=JMRngg{v=Y!7ePz9aaA;19Iz!hN00X}rb
z{IJbMh>!Mw&oBfz2IPPM3l7kDEVxe!ayaP5MGjV`aPymX7hnHhA<I3JMG~YItoPS8
zUk+wArl{aUHVY?jFcYso2#OuboU<F=ZH77rw1*0ZbC%sjbq?27@Zv_8b4=mR0gX<B
z)>nX59Dr7mfZD^LQEX7NWWR%g2ZuP5GbjYXIu%T%>TM2!Y)1*Oqp$$mr3%Vvpg;hr
z!3Z#R@O|UZ09)#d>cUOngWTsg*!>4t$3H<}K2N=n3;zs(`QCFF6nN@|9C&JkJYLw#
z%k2dXPQyk(K|xAYKkNXXk%Ht0)KEt8!{WK9e%JsSlmbm&;rD|xh94LkKz=Y^Zod!|
z51_q)pg6eg3cX%S8hmMsVDT>d#^Rm!6N`7)FPwZ}nPl?cjqm`U-=Hu7R0@Lw-i8C*
zA>vrf#R^(p1X`d2Dtw9$+bsm0A!UBoeqr%ZyN$2^Z(0Z%)C#_1w=np=-A3*|9ScCG
zd4MLpL3tRwv{k`WdUAgZE9fW>1M_=qpo_x5N4kPmBtu8Y0zigLZa6Edc*d>}G>irs
zF#}~eZ#M?eDul>j4~B%-zt`Dva7@0pUAmqPx?<zsic0Vt9B6bAw7eL!z!S3g6P&6|
z#2Hjx|65_m@f}k9fR<;OgW7k$79tkA!M1LK)<c8zg4Q|zUTX_77j({HdmH44Ezr^u
z=<dy>-~}z9L>7F=^5LZYdi7S|^*7+v#xSS-UW2sp3}pp(0w^TG&iJ=%CCD03QUR3*
z@Fg<87Wjh35y9dzOrD^FKux$9!F3u3=-393GePHh{$34Q6d1*A-^Ik*vOod6lp5qt
zPJ8eY81Q7#3wgO%kW)bxfR|Q-G(&IdH4$e}d;M?e!pQ|Y<?6Rz1dWH9$k>C9B#Y+x
zBLtcXb}<oSVK6^#1!^pS*5QVO)Ii+6v=CIF?r%`h0J#%1fRRzdu)_Vmm0(61gTduL
z(((y43=SSO3@iE@R0T|A7#4ws&_FlofCfTRY8YJH?^ubZ)G+wC-?5TSsjp%1aKB@v
znNq_L;C{zC_Sl{S9Nu@V8H4XwF9h8Wbh}fk`}=<efxY$(0w!Dxvu<}vhMI6O^nqI>
z(o8NM*$fN74*R=^)%=#7Ajnam*=3Nw!Q#JmT?DmILE_*fZpi_<#v&Xf&%wnMQqRH3
z6v`pP6b1@mu!jFTK+EYC6o9Tah9ocsUIqd1-3Ra({J+`Ogw_6kMh(LO_sdpKk8eIu
z0kXjTj&<SXInqBt_n}{&Bd^xqpx|M`%D`j7%D~mKUuhC(t1@G%#DPn5L>M45D@yed
zpvl4;OZk5szkDdcgwy`N`yFdu6Ltoc<9i$oF3*?#d-=co!Ttvd5+>{n;A`3^w_7ln
zu!GeJ9>3!tV8Y430lL23ypw??Ad6uF$Y&^<et&Hd1g)$xk+Hwe8zTfhPNrqQ;*5YA
zh6z{p*UQ|$v7Gydi97=vXb=#*!AF|Og}+@$0(AHgXimul)*Jb^5WKJr<WrM!NN)}l
zGLTT)0y=9e@`b#lE2xwW$V50KBY|NBJpKII^b^$3G?B3fFZSTAw?QO0aC3nbvOfWA
zD5#mt%oNq$Q0)q`^o6`cFDOmFke5y6kY{oQt%(6e!wY#iUJgzs_m=+(LRbFF><6X&
z8_&6a^s2=9f>vN%wU?=XAunfoQ=R(<Bq0hgfD$6etjQ94h3d^g%gMk)x*nOZ<g_;s
zdve;Qh?<-@!Ce4w3Swmn=ir1b6x-ZtBE^6;6@k6>f8A10Y67L87v}P^VE@6YCKCw(
z2J?GD44`p1&}0Kh1E|C_KdUFm!OIi{E+vnE&SiWlS`RBZL8rTdmZX9%5;zLJ;F|IE
zuk|lMsR0yr;IwbW2`)@P=Dq&A@FB>2klgJ~P-8}cAwYx0ftNvGPJ2Uw#6=q!c}^P^
znf8W+7r}>g!B;qfTV>iD4jjBpJ{)XJ{-9JC16sPn!NwG5BE<O5<Q3#1oa<hk9H1W9
z<tXV7prt&ZwGOX;Z%DoA4n2}zhRL;MLBa`;;~Ik$lt7j?cg5G5_Am%^oUE?}nFF$P
zvQ4pDy&faTh}VA?fsPskuOFP>U~kJI!vr1#1sA@8Op)MrG3ey#Uuzr9_!tCu69n!Q
zaWjB-Pk`2~^2rEY;O`T<z?&y@fVV;54tE3S_GKog#^(xLpzWbIj`2U>We}Lmm7dY?
zf`N&NgN-SegPqBruU=S)<-%%dNPi1t5jRs5A1nBXhuGJ@x9lyFVK7LOVQ{!SM-n`2
zmL|jC0`ixMB!d9h;lH<(g8KAXG7R7e6cb5?Dv&%xZslH(T#^h!2q+@JV<Mo+4CImD
zD_cQwOi416^$y6@L)Gho#FAtfz$XKCw>v1@p3MJ%b2Arc6YmwS28#v!6NC<c!jpS)
zMgy;~Py@JO1vhgIXa*j9A~UFvd?7Dm%fZLw4O(l$%MLmNRrW1tyC5tf7N2J9xXlgT
zs$ahlG`n@Hiyv_c&k4JY9OB?xRuA4<4qYq_J(dO3Qvl8W!kWyl|L%iM6oR@t3ZRw|
z=wN~ZPznU6#$PL6f?_Zuoxy`AQ|Q2l=K?Jz{}}{$vV|sqRv~aab>d>>*&uMIAcH}n
zAdSHwBa6XdeuIJ#f1|)<t~Bs5J6#3!3<)O13<03%2HhUVKUwGk|7W2C@D|B}2$lNa
z({{c4(iDV(C);1#m$5${qzSYp?}fa)ENC<h?sd>59qM4OgPK+sZ@ck70Q(4Z5xh8)
zE68V{Xasc#UjN-w2wE0Czd-?fNImE#iR^X;gFOor1o)dl2l)yx1gLU?7I&I56t^-s
z1Q>HC@FfV`pZ`EXi2tF$6s~p;&^nT&;>ipN=2I8~=08y2D4x#{!2d<)0$+*H0dSwF
zt39F0`-}a?rndNYkirQE0@z+KFa&kADR>2cu|LR@ARxxqARyXxb-z1EzU!)jlt(Fp
zf!7oUgRU+6<w0T`@=U>?vkyU+bijPdA;}aD&e=BH;GO@sCHX;(z&Y&<2^^sLR?w<R
z4k;#H=uv=sr-If3PZyZWC=sCSWd9p977kh`0g6UYAK>+$-SF9JP`eToNS9|q)*~r9
z?*IS#&u&?edQf@?b-h4CL|2kIH3RHfHca+7EYJ93a>n6AX7;TPlg}Kktv_kE5wwjB
zv>wL%gzZI8YuALGfsKQm$rse(1$AFREnZNs17s7(1)#yu*S}Udnn<aGcOZgNI%oqH
z#~x5|<_Mln1(nmF5(+#T^J`Hjs6Cc^0J3H;Ascc|XG#Kt%H#t_SU?T8Se^u-0|glj
z4xq(2DG3Y);I%TKH4mVy1!_aWF7NrZ@FQq1Wb#?tuOKfbpR)y@UI8`~H2K8F6q}OI
zpaQz@xF82?9_wV4qm!7HpPanosFIx!1L$Z9Pzi4$%%A|;{0?d(bAT?=J!_W;nsNrW
zlR>5ZNjq@Lgv}g-QsQKRV+!@=r|bkltJdL}>*sz~Py?X&xSe9Fyc&2QW6lFL$a$Vz
z@WtqVP1qQi(vR7hLMNvTLC!akVNe2x>m55s^TT@JhD7mUJ3&xvzy80A)r6ISZGVF@
z_-140J9>is4a)U1Ojtn&YYBiW#sEvmeNL}`?%ivCOHUYN=>7)f08o?2`M%zK=R0}}
zL6-|4?)=nS{Q18i2go6y4dl*u^p=8F0)p0tz#Rf=%m3fW3-T1iJXH%&B!eB$RIh5_
zd`C~Xzd_Z&`M#d7i44Q4?mwy;&iD2FO=K8Dy8oyOIN#R`G?8Hx=>DS$xpTn=Hq)kX
z0+b#>l_kis0835>uuuOk1|9kb-YyT43sB<(S3Y35pS!_F6@wgNA}YYZF?r!}$@&GF
zCQ=OG2{n*;pj!y|+l3Ce-_Z-*-=M(Zd{QqMG!=MzGS>t5V|uY*HOed>cxr^CZrtH|
z0A62KBP8Q|M=uf73*e~{;&8sBmkip{&r>fX=6zo;k*7w8>+&C|A3ViE5<E3RJRW}-
z3@%TWK6rVK^naeoh9`s#c<P1tc#4JCcoKvJitpPw?m3_^qxg=U;9dnq3y_VbGWG{~
zYJ@;rd1Jt}Z9uURsI~<SyRkDkfJ2vuDVF0|MFR&LllzU=+#k|U+nK)pzqR(pTmA?8
z8<fCfD8YB^969%J$#ABzaD(;>UU|-$9el@5@Wylg2RGBWKY;e(a{S?v39w-WAGtEW
zL2&`d`c}1u0|7QH8+g)$Se)lGD1c(!S${Hv66kz26M6euu6ibU6JdrXu6m~6%m1Zb
zBu{2gN}kW40NPm9s-gh8oK<DA&q+BZ*|(E(PMSN`f=)7iAupS2!pgw+LS8o3gq1<y
zg}kh<2`hup3wc>v6IKS17xJ>YCaer%FXUxqO;{NuUdYSxny@lRfl9;44^Em&|J)8f
zaUT?&#YgSHBj4a?{=Zpwvcai1rj2(ePdFtHOVnHEPTp}!yWSLZGxq)lJMf_opcDeq
z5@5*zp4BkFp?C20|Lvfo7i~bsf=We@{Oh0FOhJ_%=-N3@9R(Wb0R>Ee4eJKbY!CDR
z&yTkuhg-w$dz=G`;dap0O-aa2Ot1gf?*T6^1{ppda`;R*$Pu93CIOb5;2}D&h5xrb
z1T{)Q>OhWwminL@Q|7cRfS2~5TZ+IPKG0w~MBnOE6DbBZ@JbuV9nz?WPJvFhHIZOw
zFu%uk095M08?B(r*mxP3Kurg51NNl-!eUUf0dhI}LG$CbfuPnjs0ag{{lvk_<OQ!-
zLHDkmw{rxox&aq?poZ;Xd&bv4H@)RxW%2=eqWFaEMqUPiW02ux(2kMcTR_d~sQ!i&
zaQ76Hi9t&bO_&)SOinZKOjw}7V8YCp02-~ok;nhw_3sU=9DGbso|J7-tOxB|i~+d_
zygw1-ke}NjhlYTv2-tR(-<xwm4(e}60=E=FjsRH>4&vYI;86%_;X%YUt_7(Fnad%=
z<Y#gkyiD5#q|Zc(VHHHpx>l3(^$cuaMWB1vV56MB*M-6kAw@Ef7s)_x5F291hP$A(
z%O>&+tGHh?b(_fBhhEIS|6^)40|WPbrum!+EZnfmSGXUr$aB^+#UGc4+`7(rn5p?f
zee(Suurs_bB;1#O!N6#=*Fixe`KawdxFvsgn1bRO>`+h<Bf;ooe##OY|6oV_-3F?q
zBIh?KfH#=K_5EJI)Z`WeANV{gP=8#K0lfMUo;d&PcdZBQ$?0!MfG-I*kzl+5s@@?6
zZv_oRN6l|ghOCn3Vqn^{K<P&CAxp&<^3tswyiAZoh2XPy3mst&o!<aHcoekU&I#0W
z1UbqfpP|4+2GWBB*<m7MU;iI8RAGM0_M-b8%fQQRQa`TT;gtxefvmuB?qe`{{b#4|
zg=13S)jb?C&<l59b??tjqBo9lgVRLMDJ2ci`F)`58(_i-p0Wm68eqxUz`@NF23}CZ
z#{_MQtq+7`=X$2-o>K}ZIAoZ-K$e0uI8-ncfPC*flfmfq|5b^>vltvelPX|&7N%&B
zJV+f#9wY}+`}+S{Mo`Bd97SwQ5g^}z274fK+aPOUSeT;S?^_++vp^xhgo}X*R0UmE
zo6jqu{O|mK^Z#~-KwDBli#tJgjhg>wXzHGCaTFB9!G|m-zu#wHZ|Ml~+Y5Qws{tmQ
z;K2%zHDD|L?0t#|cpFd`4;1jA;adjx`<9`w@guO6^LZuQ?_0)##*vWtnJG049xy(5
zNa?=STp0h@o<kDe^|!1XgKt?u)^_|}`V<rfpvVLH`F1yStf{_1z=V%s*6nV|P!m3e
zK5&?EF-1D}GnjxP*`WXuwy*zeH3jJh=>>%?sKx|)<mWng<_CE;z>*U*ni<By#}r)8
z!OaBPh!n~pz!c8G4~a>TA+P_h_5{bK43it!LTDs`3<Sx8BI@=3Ww3~ZL^KvPpvZjv
ze<dO!x!~72fd)rGXJah{7eg=PrT>Cl4zl3&FUa<k7xJ=iL7@Svia>{Wfi}T{<U!4D
z*kJ#yXW**~Ki)cuI>-!ecK_K08axB<)`Jc#M}caYWDf?T0DJC&WOq9T&<%leK#NY2
zV;D?8Lojm^6gc=l3pMa02*hN^Fn~`GFLq{d;CB-`!0#$_;r0JbcZ(eu6hMnUL5E<0
zb`gN8Ymg(sw+bF-^Z+>$G?1Kp%<iJIJA=>b--|mzhX#V0g%|!v|8H-A>=XorB<Lzv
zkb2PJjG*KV3WVEjki*~++pf02n*nnUC<xr1#{FR50fhk2_AGF3%tV4g#zc($g$Wxo
zWKx=qDI8Swferq@mlb62@#O~&fDDIP3YiuBvl+h46v<Msr(gfs461v<OZDa)u=@+L
zblw3wP<02onG0k-^y<Mq^<agd8<aqyVj{sHXClV-0(6O$2^-S`P{@F<4ZCBPTzndI
zy1oE|2{)u32K5dgb+KJ8s4fPrMF4j(V3U8)Yu-ThFsMsmBF`Yj-yo#4{%`zS5DgmR
zFTNFJr)VN$@0fhYE)jg)OoPCk;sbV$#dqus&F|PHg3gKn`PwuYe7tJxm1K@&(9sI%
zhwU6+|Jeq<M-bE$-48mX5LBqM+W+SO-$4PnKCGS*bb3ClpyX8$g0x0KbN2uDI`S$D
zf%lp3hl~Tc1|PN)<Vg^ifBC<3b7%ej*4ux$A8^!god9i&n3G`-y2&htr$iv0r$8X;
z`hPBg+yD6=aK|%6-Tu$~VE+RJaQg@}7zb)81UzC;c;S%ufg#{G<ct#ThM;)(W{3Y0
z@*MlQWI&gCfX=uC-JJ{xYi96tFzD2u+x+|wK)o+eyTyc$!2#430v(bDY6EddGI@a#
z2_*b&J0an3^AVJC?Jw9F!n=3SfxP5!hKS@ahN#y+_n!pyP>T=SGJ+BmXsISBctK`?
z6Wq`Jos%D&)u;z4GLd2MNIz>U3X&*3X>0iU|E|jPJGP1-jr$vvK!@hJg73n-37Nk)
zKW@heQv3Sneo0vI3!<T7;N!+YdQBu4l+171CW0(BKW)1oBoAs?y#BdwrTG~<W$=wA
zAOVoX>!16<b0biV;IjzKZ`wlkVEx?Z3F;z)<Ulk;{XX#KY3KX4&X@m7vnSLuI5^+2
zb-X=?`*(krB6x}eROy0>Q_#?DfF<VvP}u=mxBx1!KqaU7T{C;IAsjqRp`gn0^}qd~
z4ea14Xi!lL8p!}#_J29#+#7I;vpG2V!#=yoS?760LqVg-5EVNVL1DSSLHWnzp7WB-
zKX>1pyyCp9ya0nh@iCi^AUTjaNce7hn0~=laesrd$K)sH?HLzLR=J?6`*Y_+P$=$i
zP((Cmj@dp0M;+|+jGwzaL0ip}FHA1Gpu_?)bn=`FQuSLkLGiV}K@r@)a=vdn*ZGd^
zd{D~0K8KUT`KIkcP>&e2<e^<bVaII~?g!47Z5Pi=P*?#9o`4z#h423v80OD!m;eeM
z4q>LK7i`NHfP2uOHTbej@f@;DkuTVmyZ~*v>0h8=0n!KRihx!?zKCXD?2}T$;FD6!
z;E__x0A7s-GAO{3^8(1zpacL5V$hKN>wmk>g2EphpZrV_h+y6bKF9Wjyfo;x@0b_z
z(yEgeT$Bj8?amDvO9S6M2EK>l2xPYzXh7%npH<-632c}Qlk=Pe#S5T_4p_#J;IV=M
zysQb-)o@tKP=QGP+YKl4T#^or<T)S!UO1hQ%1{An$z1p$4L)oQbf_uF=>=&F2?^;8
zRj>bT-I|fX0KQ%s<adWMhN=Kd&Ib<V3>6^n1yn$qZm<9CI6C>wbvdR@ODE5{B+n>1
zdCw&W#POEL?JnZ?%W`;|3Dn;r&M#ZQhy9tz*fWD$oGeVy${mp9UKuqE76F!=#vef5
zyzou>2WS-m$g3bHgWAI&Z-Qb1)vMc5GcqP`yDTsNZ`0m@D#*?$hYE%&hf0PDkV=r)
z>wg<qC(pSgH(BV4?Bwg0)b+R^1=?x5#@pK54@@K(3c!_w6qCD&6cYoi!v?D)CNFp?
z8w(qgIsraj;^ON+tHF!XK`}YMRSA?VoXwA!egrwzM1n&AJ|*;X<3dm_0I4&PfW$D8
z9Qatogw)B;u6WmTGess8GZ<aCECJr$m{7wIccDh&M?x_}z=g|_pt&7^3pJ7;e$a)>
zQXsz2g&L_J38@Sk38@TP3H1y*38@Sw38@Tb3B?Q{326*r38@Sb38@TG3H1yyJT*ch
zuYa%R<w+J21G#2@s{&}Xn-?gBnD8((XoHS;<B(zUHQ}>oHQ{GsFcDxV;9vyJeK0KW
zzGM24yK6?n3kHTs!G}yITNk_6n?B^ZAt2M<prm0M51AR^xgfy7b4h>`e0<uUg{7eK
z4`kJRP%#1BKE(mM>l<_g+s}32sSTbyAqJiY0x_T%2B`<#_wDirGSiS!!%)E?z!a5`
z!B7J-HzAXu?)9Gqz8Uq|3<U)>3<>ia6v6W#pfe6{YC_gMf^r9V5EOLb56Gf_YvzK=
zE3o05OkqKmT%eOjAoHY<gUVxH|69M6Lx?G=_>LX88UpJFjeo+;SPAZF!OTbqzG(-k
z1vtQ`l7kK&i+%lnHF)0wND(MhOpY-qypWgqd;1mt15jNGYIcHBCAi6nx1iYfb8^6S
z(RjQC!|H>ehM0+rJtr(Pf$|P0d4ZB4DDQv*0#r<ZLl%0V1)`W(6*@WOk}C7RwW;7@
zV7V(OlQ6B^I$7t2yJv&>JtoKnmFMjO1B_V~D0lGx2aQH^)o{sxid)dAG-!4oWEW^;
z8tku2c8bLp?F>P?*Fn41K|9tbH>{Pd|HFI$v{wA}&kc#`f0)6ew4kPQfIa5~$j&wf
zh5&sI2i^w)N9Qb1$S_%K{}Ch)8Ug2EWO98|sBi&vWCh4B@Tm5mO&<exaZlhW5I779
zYtSldlVp2H_5(Fs#hF3v6d6!hfZSF8`u_q~@MICFJtoEmK8DdmoC%~z4n76^fB#RI
z8qiRciM)LyXbg|{fxvO|%k~SC=QFaHJh%U7BEZB0Iz{u%$3@_B<n_-zm0*XlFhzqb
z1F>KK+!F}e4aNHa?7;eHa5e+Ekdet7l+!?b4mKuF^W(OLCcO5HiU$}tK&xjt7?}dz
z6s`u>OQ7jpumOxrULfCr^q6onD1h{XvMdKXlZW|9uzqI66X3<FK@k0G9)UvAL{Ndj
zWU2i}^OI`!3*T&9mjyBmY)G>GM-xs3(30B#&?QuF3b#yvte!jS9;@i`hry$Jf?ATp
z9|oWPCbfXzyLODP|Lg^~KKdKdz|9qqA5A0~z+IEqe>Q2ta@YI@RnX}ih%3YXY%esC
zVgQd_%x_TLG1=jkEc360cPA&@5|i4(2{Hy0e*w23vl5`-d;M#h=Hv+=Wjk+9-f&B_
z{@2!>Cfp1cGVVaytf*?YHkwB<NMzh$03YxUp0DL#@-*RMVld%l5HR6mVlWY6P%;r@
zaA3@kIN))g!Qy(80C<yTdxP=|QyECf1)hKWv+X6Qg$Hua{03#vP4upybraxOWzexw
zU`0O{B~A{wEnEL*H+X$$!5&CG%OS($1NIDPrUW#>`DeEvs4gkk1G#tvGz<Xh6M)r#
z<#%0#%1_{I2r8L2g@GaXzMY`i6#M_TrZC8JKY*Oa3p$GzbOtZ?7pD0B2TIVsr;@|u
zH@AhX7J}}y0C%XsEtp-<u_KW2KNp+?I~g=W$Hf#8unV$c0pf)P6DM2TkyZY)_9?7t
z^4QJ*zJZK`mnj0gju&LcpS4RTSKLu${<Ai8@`5|E%zxI3PCjr)wEoX7(|}!&niia0
zKx+Rj2A{Ii-T=8J+G8if0<ap8+@GEBQ*}V$-96Fz?(Gil2Rt7Hj=zu>cLilBM6hhk
zgvG)B1_cFBu)@p&T}cK?ACm*_YSzzWSOE6RpB+~NXF=RzA_-Zr3=!X;2pTpkoCA#>
zKJexjL4-Z)AA&|F3+F(i2ex1ewE7zC=JgAq@)I}~1f@<{%D@nO-A>SCsr~;OOBv)R
zf4M7A&y~vL+Oq&M6E?rW7ChPlsx>^}j$364bDZaNNC1Q7K!FUlWaU?wJZKdYNDj;g
z$^BZd33e>#jEG50;cz)njRcbav$7s^O941Ddd^{3;W>lh0I0qVoXM~O6axLA(356z
zdHrw8Ur<B%g}e;-Hj3B(msvvjt)P@1P{ZI5SkI;Ky@7=RG;z9rz9M+#0%#loRNub-
zv+^gXmI0}4Z%~|Yy9+Xwz`<P46a`VR>Ldpn6L|XHG?GCB<Z95OWw6|@9igDZZ$X+(
z1fj`OkSPM3G(q+9k6o#tk|X)7ts!`T<c@73NG(V#NQTP*WLEY$+f0yI#fNPtg6{B4
zK4H5u`Hb!A*Y*Fmab};gUDysgK#7eh2vmWCG=Vg{{=X2s9>6RHatM9@1pB?WCviUj
zrNRC_yQiRwe?j%f3wfcbpwbl_67gIPNFf2<GzuD#2AlV1`AejbFsQ#h5f&7%kXW&k
zgB@}WwV5S@1jr$Xkl5x5npy_?4itx=W)Q4p@nc6UXxR`(C~z`G1<7y)Bp<U~2{H@h
z2vBH%LZSGuZT-aLOSY?D|KGxxebIKI$sM>aZ9z-?AwCmK1^LWn4}$}j4byzs(FUMl
z?ql)?3`~R-0=Q}r_pEX^u*h6)xF`RDf!WJt4}*(|Jj0LX`ON|*j0{`48=D18gc-EV
z=h%BIDDY@7*3?TJFtKOw`u>E6;eh<37bcPn;P?WKGraz_?<D9-43Ka8+Zs4Pi3vsi
z&(cV6(E%!+WSBhK8<a9`w{t%Li^0bD|1489VPnv8S;gRDBEzA?af+#pyNhWK$V~9n
znUgO*G-3U{$k&8>GS?&ddTu5kaI55w?L)-{Y>Y|{9E?f~JPaH;;O)Uu4Y|sY5-u0i
zie(gPC{VOeZeU{Mr~%7sfdUwGhb-9nKlbo~?vMpp1)7@x&98Ib0nM*FM1bb9<{VJq
z2)<?eG5D74L$Lba3wa^4G%QTf*BfM5Kn`iBQJTTQ%;fVzUhXTXe+0Tg*F=~@sd=)k
zEGR5^HV7PjA<w%PR6#csDI8F4;A3p4vA+%xmjjn3Cfp1HpyJRp#@_pSyv+RDbGSd4
z$TJu;&u`GU?alo_`2m9l=&ow>{|xn92jmk3Zc1`LF!{;g07`bCvhwxsHQ>X`z_V~H
zOwp#^_TDBk3<fu|xj!`4G)jQ(JYme1IAA`9f$M<GgC95LAxXOUz8xc|yKDkG;pg`n
z&8rDA_N@sD;8h1N<YniYa5L~JW-u^-P9`$Vt``AMhJa6i`MvLB@GUz=$W)#^xYz*&
zFIeu!j=7)%@J$g{Joeu125o<p`3o`-qz>c(gvF~ZL7st~as5JG<|!yNK`SJ|9{j&=
zCMeassF#<G1;v+34TD2>r;3qF4TFpM9Q%c!AZzYw5els5N&p2FsEj)x{}{aD36w0s
zhWy?SUqlWXQ*Cch-T+RHpo|LJQ~hT_<&9;Kc?|GynlzJ(vI7U?gpS`UKh~SPfL23N
z4B(^CK?a-rWXO2^d*x1$4?vDHk%Ami3X%hzP4fEp%0_T?3(5zeHLM^*13Vzp^1oMl
zf^JX)=`%kI+WgDF5TM4rz~l@A=n50?X%3*~E%@fC-z(}rg030fa|UvqFsSJXiWl><
zwi``&AcZnG_<!#{2nsHavt080e}o)ByNmXmvEK`_1ndx4=KH+@H2VS`q5(C91FTrV
z%^;JX3>_fHzy7^K5acQFye6ngEl>}+ewBlj$=CdtE#zEWK6_ACFpz_h$)AIjDF_s|
z90E)c9K1}C;H^tPz!%L&C7(kp{n?nJ0{?IofYgIZeURGZqqZwS<zDhdP?5KCX7+KU
zf?tTqhr^l&a(5I+@$3H!KpO-jP3OSN#J#tBxF3LSWbf~@dkY%jgp`l$tf2C7a?Uel
z#Rjmy{;u%_SqlmeP(v9c7GT9S;q~7&vXeJF6R8Iag6^icWG84M#E<|Q6#e>}*%CA$
zs(8SG0Wu(JzY#Pr4Qg3~21ZS|z~|&G<ltiR1PzLU#~MHb(ueICK@C>;DG8v}j-ZKP
z&<e*Rb|3i-1n!%^u-{mG%l6}3Ue!y1JPh>#fou#4d(JgX;CUc$A+UyP0S6aT0Dpr3
z_%04JRW=4t-T(UMUR6*mLo%Q;xMgf6!@vZ(@T|YXe(CKAkfmR*|L+B#OT)#+#m4gt
zyt3{nuYf>X&wb?^pyJzM3qw%w9ovteN(7R*CbI~8iX<_3a8KsC{Ar3n3)f^WVZH*P
z10V;@IiO;2JCOT>$uax?o+1n$eGLj9K!)B@h4jZSNl5)Lkz}v{JMPzFNs!|}K@4gw
zfr1;fogX5%KydPz=Th~HR$@_-0#@>K|5BJ7*s3N4@SqmRs!I}*A50{{xBA4s{<$A=
zUK0yb^o1Leu>9@<HA5D~j25L1kbaO;z-H7-GI&4~?mG)ph-8QlRBkFv?v?~IXcP%F
zff5Cl`?W(7WEjYgH*SFCB3>{sE&!>&CBy&o^BiGI&OclNw}iPLfO?XkGYrA%K`pzV
zdrQGLor5%k8%mH;DE9Twy{=|fYziQ8Gb=W5egs*@aezhg_0PS$*X`x2LH8$s<Y5M0
zx0jIzsd@c#57;9w<YmAI+V>o&$p=N8rwD^X%Nd0ew<hv~?h)a*a*V_2#xd@C$gB@2
zuYyV?kgI-etGpZ~{b8O0<Z4c^k8d(?fRYK=f?wM#!9HMNiVl=v2ndu1jm#*3P60f?
zKVRs=3wfzf(+>NM4x1SQE)`4v>`SsY<q%?Wdm%5cYQn})06GmM_>!Gq@I^bt;0u%8
zitQ{w{r><PP6g1oiLwI&qxn6i1kjiRC{Kc{Dn=e_0G)1k&Mpx;-k?&?-ym@K^{>54
z!Gi{%(iK*W|K2bYq*?g^17r6eodcl20_ACtSb!BLWcS?ftp`D)ugM2&H=19z-3U?x
zjwRR-mM~K!s3ZqD<n^z$mKTzxf3ze(?%FnCX8dP<)ZTTW^DWzr-OkDxpfgy&3jb|_
z2N2X}prt9oV75I+0+_bp2mqC~Z3)U20R}7%lV`k=(c+U4Y6!652Jg`hu;&6@4}Kq{
z7<3DBfDQKr<%bLmAT}Sv<a@8A>wj+p%?N=zh4UM<K%H1{UmP^G2l5kW931SN9}7!O
zxEY`YJOe|3B8LNyg1|A8WA-24TwKIpBE!SM#~{#Y!q30}8ddvnQXrXAjfIUPjq6ye
zg4+&Ic!ACNxiApcC<eKzKER&)0;rBP|F6I}fBu3GCNc`(rE)wqLXZu&KNmTIG=Nrt
z&7W@o-V<AV-xhp*r%4rqLh*gugCK)J7o5NTxsVfF*MbICZrXzHGz7`L{<+|$Nfl&J
z0b~|LY~e)s8O`$>bV2I{JQ*1Iz*ot<{=aE2sM7;>^-bH2x1+d0!^^R+f33_+zGb`d
zg}e-SjrzA@W=qhbTF^SG@Bf*;yWD5+=>DUi<Zz!M=<|GmWYFyk95q~birW|xctE4^
z+)Tc==SaQy`kz7I^B;j^6Tx~04(|CZGA2Uy55WrW*nV`m!{A{e%)`+=SwX>ckNw~F
zwgv&y{ovC%j^2LD|Dbh^GLz|2297IBIh;ThKF<LGPmn`Fl{?sHzm^$-x(A?S*t<sQ
z252D!NZv%kfDxnyBnMHq&d{Wu#{fKfX~G9SQ3rg_Ge{9c!P12w#UO(?WSHDRhJXeR
z5b|rmTaxE8D1q<3F<A;d^9VMh^J}RhNI!TS161it*#8Hc0heEE2-<N1PJAFkL6Q)Q
zmw*ipz6{^O0y&097_uD#WGF=4nvEa5I2bryF?oR;$=Suk#p%EzHt&GK4AVUfOmh!F
z&O6~c-?2amG~UI*6as38bMP^Rf-jNgWvYiP9{INcbenVJ{00^9;?21X3KAd#K*0_Q
zauB<}C*~~Zt|y)g0>@s+OUZ&#zQY}c0MHhf{wABRCaeqzpw^}dD?<UOBJFQbSYX0q
z|I<XCL4f-elT3eu0*4770}CjmO&A$?I6$ost$HR7E)Av*Qx5z87da&4L4(quP%r@n
z6+D<$y#)FAg}lsBkS{s7K}W{OujSxo^5AS|65~3+BKAUFPW09_?gs&P7!p9^AfU4V
zOf~KQn;f&B_(EQi6_h3U8w5OV%1FKV7$cC(-NnMik;Qc?us((%0c0txX*;>W0@Nh%
zdi`^!DrgE0Y$0@s4mikv?%9eY?mIU@=>^DAkfTj28CW1{w#?;k5Qs7nW{|o(Up~cz
zkpXlyto-d(sTUmfO!Glzg2t&X|Cg4p=YGn>3L3Wrt?X2CU|^Z>z=FX<NP%I_1Em=O
z=NJ;+JW-lpBFNyecY(4L2R~Eb=jQ?~9QV28i|^YBf{uda0PO+$u>*V@I%q%)WH?Nm
zE2d)shYVBD>mNJ7hk5L8Pyi2zO;`ZAUHoFr{rVrETdN=)*?7>|eOxUM6u@`OatJZS
z?6YYxFblW;Kj(phgqgYhf39#YaV`fI8Sd#!f^VLvaDW`h!Os)|@;wJTQ)s|Vh6D~F
zrZ5gc(4jB(|G|#?x5g2)7G{5gB6x-^_>gU5@FhFN;EQ&K!51cn9ks0okCcLj4nd&?
z3Bj#<O(Yq>2hCk>z5fF=oW!w!h4qEJtm%!V-0~)Zkkc(pBpCnk9uSBE+w*h1D+g#x
z2B`KDWQs(HZw9Z++23Hx3JM&P=L}45p6%HW3hWp1(!Qpe_4fbYJW^P3b0hzQH%}B^
zm{~Gtm{}rSg8Fl>DN>aC!G<az4&Cz?Cim$N2LtDIroeahdwfB$1l~`<&lG58i8NOG
zbI)9u`u_RWppI_fi+XwKr=X|>g(B3@P?#b!OXw(p43i&JP8K8wD^tuYAt3>g+x-+I
z2TBGY$AEmxd4O|HdxPCo?(ZOnEfC`1V+wpBFU<>bV1I+vcaXiH?NHNS$V=blp3Wr>
zas+&!`sZ#}P%!RqPynCc0b;}CK@I>}s?5Rv|MjoMj^+~f4?z}!^n%oZ<X->Wbrhr?
z<RFk7NF2lm=>?rc3Rd%LQT<7fCXfQqO5w|Mr2q6cS-l0NtAINU0p@e;H<}3BZ=65b
z>Zpkb1C#fB28Z?sR%=1>paWup=P)3aU;o(T$^lwn2}%RdAxf|%KQ@V)--5JEK=Kf=
zjnKOV!kD5tWSGE3KUAU@rWn-J39#Y<?bvqb;ADavkMeslyk!D!9{gGZ?oog|0jkym
z?70LcyL?ut=XlD+%E`dOVY0{mKc_sCJjVkTcF+l%-yg6r72mhL$o+>)hT{*D3}}+*
zdjkto@f}FD4XVb$j`@$c1jrn@O8>tYbR-g_>R@Ja19dFTkJ~TgV-T3r+?x0Uq+dIM
zp&r&yIc&nlPz7=ssQ<>n$m9;169Mx%7%Dgz!7~7CCfp1hCZOwqco}Nm6fOeYe+@n&
z+k~ABVGaia2gnT2Op^&GLyZX+gTR}@#Yj=GX0M498@Qn~zoFi|6+HR?UgF8X2G8HW
zcU=UXtN;ow6E+3`6Ly9gkb_J(7}!8N7z2_S4CW-5L)NFVF-3rGZv~C!z5cx`5j2tk
z(g(W!2P_V1?z1w*zW%*S6BI=+<mJJqiGdOtM?L6>!T$@vw>^V2ncRfrMNlgUd}iVQ
zg{<I{z(CdWO$G<BCeX$Vu)YOnZ!CrEQ3Ed=KgLkNlOW&+Rs*u|=c-uHm^a8=(0bI{
zGa;R~fIr-zT}Dx$4MdY~e31dI!vT%n#lHTzbS+E+*bvb1`XGaTZ|e-Sg4~}6ZeM_W
z1UkqAEVm;Nq{pEKT+@P<u7SI!VEv#mQP9``L>(hY9mp||uDXmbD4JYq7$iNq+ZCL^
z8aS9D!9m8x6#M$;vZ<54iPxKgRDr?`JWcp>MJlL=!rjFr)81ge6=Yh#QqbNd`>h}Y
zUdRj21(n~RE(R#^1lVwY0B!jJd3An+LK5g;7iird06N$Slzl*{IKYbQ!t1{)!N&oC
z%mj(O{=Zj}gCUH`0i+Oi`V+`tkb(Oh6d)~p3m))@5y&8r13(A0n}{=idHr{#qlqMg
z3c|2Gji3f=a128O=%Ulf7rx0&UZ%sJ9UySWM4o|zzfC{}RIqUWVVYw;hw&e1ZQSiS
z-14xMgJ^bwyEUkGvar1Vy8?8`50ag`1Ci{Enym0$31nwF#7+@hc4F}(cv=+AKCRb(
zmw`5ABH6b~5y`%w$pzoRevBtzAIy)S?hI%?9kj3pH2-|t8FDQFXpS1xPxQ87Z|HAO
z2mmicWM+yIVPIqgttSMnvIL!`2?~D>Nyr-2*T2^PG?8L=K)vdBM<LjKtqc=57FaAW
zIV!-=Q=(vCvJ7(j3?$O`?KP2t9I6Bo2dy{!a-WC6gq;Dh0|~UK@7Ge$!In|n?MyP=
z?e=FuaSWcAzEB0(IQIJ2BE#?YphL0c=7Jr#;)fN}2FA%xeoU!{AEkT(as>wX6qBQN
zAEA2?H9#H(c?1*y;G>m~**)~0&*AX;$I6YjA4Bt?3=`z002@wFms6%4)RL`->|g?W
z;>SAhoyPkcAeXj)bAkmAXhml|_{>3&1(1}=A@cg~!bH@Rx@93al;$%`Fn`Iw1v*<4
zH2V0}o`(T+7y{^?zd6Sjz}7;?zW%ik+!p|4tM&#3@We34d~gW{I;P;)!a~rNRh~UU
z3>++SOwpj?3_JiY1G-@>J{4pc2OCoi=p1Iy<q^!M?AA^$cqY&J0qmDQ`}a<M@JqD*
z&wg+d5){~A@&8-FH-Le*Z=1+7FlEnY*ZBYU)x{U`^5DynK;3Te0K)}4LlXf8CeXN^
z2|wcj(72unAA<s9T#q3Ow20A!hhZ6Le9wfNp$9a+$HB-1J{46_h5t8bd{2>u|91vx
zkPmwK^F<Rj1}o5_BJ-oRkhA@yn4H0ben;#+W*@MVG?ihH_};+7fK=REFtq_~GgDvy
z)k_?VOdj5M>?FI}GX+4!8i)-lwm=&gCp#27*Dr+X2JMVX0fi<gZ-Bl1eJ^;~LtqTc
z1~Yp|kNNU{=^yQn8VsCgFuHW<D{ycKFvXk5Gq7;~0Nq$Amzq4E(dDwR^uM+Q1&>?y
z+&{UWF-<lrw*P-z_<+D=Vd?*U33lor7jsB31z$^$kxQQJ#pu%fy4iz6kSXfAgN$VJ
z+op)iQPMw}pDBMZ5oQQ!{;b?!BFVsV$x!}BpF-_Y^UwDGO+*;hT`HFT(Nr?G6_nmg
zgc(=@On4k7Klx)`p8*m9;Q$k!1n0>Ndd^cB3_y25n20e5aFsHJa$RK-n|DA}i?2r@
zcs_&b3-d4b#h0c?|CrP;LE;4i>#2DMR99R}kdZL|&#>V7e@>3upSeFcPhph!G)0iZ
zc|M~Q*L<dU=cx=9&QlmnK5Z4`0E<s!Fms;4D8n_)hbio{gdm6W6b38j>5Ot*TbM$)
z#hJp*rZTYH+RFWb>+6gL4pFA~ru)|0LE*qRS;*n`XRZgy^BJr_TP~6(Ggz2^wx8OR
zH+TOf!^yY)>elaJU|@*(|Nq|}VlV>(!w&`qMuFxxN()Sc8CEoZwweyI=Y_n?Sx^v~
zh%+>R`h&_!4B)!t_4hsC<LzF^OWA^wJGUg0c;5pnU5Fm}tsLS)Oc9`i<+#N`5|)2K
z5|d~Ai)S?jv;O>(RX3FX(WX%G9K?5?!YJiDpHTv|V~zU@Q}FHoTo00`Fqnao)MSVM
zqV*CCDalh9EI?zKpd`juDFkk2y#BszZ}NPGUoYe(bV1H|AuqevL{fp__>EifAZNdj
zmtcjM&tPC8%pk!vnMt^>!b%k+*QZc^9wcWX&!Cb#pWzS4ToZYQjMx9S9!;Ll@b87Z
z)Z73Qo`B<94+zxX+Q|(P*vr=;5PUrJfC68GK(P6D`(n`9VUr#-NW5TR&^m5<z`?B4
z-rhu<!RXRf=^tF%L9>1gQu`IGd_e^WD6IHe1cLV~Sm}f47xGf_*Xm{VzL1xSy;aQp
zVP1mSdXR%&$V<6`63*-I+reuX0$EuYH%yISROamk`4QyK*Wb6NPVHc{u9q+oX8hOv
zx#86H2Qm_%+eRI>KvJB;W=1LVISedZlbM1Ywlc~%Y+;lGr8>~m6ew|V&6&{vI{N-r
z4cCK&%?xG<dl*bE|B?RD-e4LEax5sjgU%f@pToe!Q!gZ+eaBAng}f*`=s0;3c}DQU
zG7}j+1_scocu;K!JFy6~X#vkDsbu|8$W@&jGE5;L!?~Ne<oW*#2w$p~|Iz=z{yIp!
ztIa{;Rxkepj>B9s9BfR!{F8;i<9VR+8tnZ)8;_dsKn4=cPudBBo4s5NOeXB0)i(?d
zCj1QlOavITOavM1JZEt@fU~tCrvQ(FfJ_GLl2`LN_WzH|9JBzP5U<?A{~J`C?T=AZ
z0JV{!#TnD<{~Nc0hD|`>&fQ?KAo-4+pz~!r!CO`QKl-B-FL0$Z&FMIsxB+y3Jm+FA
zdHx4NpplQ5;6t_#C;J?AtG5G<mc_pQu?M_x2V~5AP=yCtGz@BR{$CE>C^a9sP693F
z0n4qq3$yx#yj(4)+y(o?f(N_}3ALreap3iz^|GjS<f2FpS@1Ota-pDm?NR;hpuv?t
z{T&mdSpD1uw&Etd3=F3GAtP&`u_{m)y#Bumd^t48(co4w*ioy%ol&qDI}>Cr#{X5|
zL-=3F%YYYmbO$IL0L>wTnk6Pe3=Vr2C`f?J=E(&e3NB*{vI`WxV0$>2>SJI3UnL8g
za0VMH#1sXYO<Rewdk-oGUi=F_QkjJ*y5ns0dQj|k2S(2a(VUC9WI%&$pwt3B`TZ?q
z{Ua#UKy6b{b0t8TTLE-+MBjYH1E7nXv=ht(zy(@>6}Q0aKWo54JRpbgBp{t#|8xD>
z+s=?q45-cyFk#s+*&u8RctxW5e};7v64d{{U|`q<s@OsC5@5xxF#Qh;qig-2RkmC+
zStLQ_63Eo%`SVpl3P6cCz>3@8^`DjCz3d=4kl5@0E5X+-f^s0JiEDn3aRJEr0ru=0
zK$SUcbuj+}f%)C>2@<zsV3TTldO>=iYA<mA;kwWNKwwUNdz)f~`BA&V$qnG64T{>E
zAWPcYTNF7!4gnRYCK3!OV9UR+R0S2d@GH{}**OLyu1!lck!NIRp05O+6aW<g-Sh2R
zLHb|F%l!rE53u5fOd|hT5ekZ6@b(4JoCVlb;A;*9W`Y#H{<8v{ia;7cJ`b?shTPZp
zXE}HU0!R$BJ`!}Vw22fW_+U={7Xr-zR@~sE|N77JsZa}|;YGsV<?vPR;Or#B<gA?l
zYH-RhMFv=LLuOk4EC(;31|M$&J^@sL0dyWN=>F&S28A1-kN}4Y=mtU9PW4}FV<86%
zGJ)4q1}Jh*;9!LA@&CRQd=fjz!61DgITKM9P!SLYy4aJ$oslU5bfziD0I<)0t%3zj
zG{`bgaD##nEcbnxF349e<YmAoTZ6;`thf_i|5>_sdIUS8tS|Ux6aELVz6MA!C{2Ts
z=IdWu5<!P7gIuz|K@qex+|~KM-A?39rpM(EcsO6P+j{)5g9Qic<aNn%EPV&;_fEgV
z&L~;`V_heQ80Zc~d(b_6(Hw`Fm|GI;<3U@9z&^9$h8zm@X9>982iXI1Ajl1`zpuJ#
zBE`P|CieRO;-jF%_(ERpu8EBOe@H?GAAQPLe8euX_>yg7@kQH-#TRTB7N57>SbWa*
zpiS{v+l$3#Y#$b%w*6Rq$_{j8i(v5yJ4MhPxW&ip9E*?I1r{H+D}4QD13ZsH(iL~Z
z^c@_G4ov&MO#j8fIGI_QWyACdoQ$Hu-xtC+oIzCbG<<Jh5i_4-!FYQ<=Lhf|^z}k=
zJT*cxxBqY{T>dW&KJ7Q5o<YMzf+-3VH=xvOe%GGy_4frw6KWXLrvKn%l(qi3HWuV>
zsDBw>|5=Z`6qoV!_eJn-04VZ7YQcv5+`Dsn02iaE^v}JWAd^7`m`F0NK~fMoy@88S
z)cxmP_(D9e&VRe$CPHIl1IT$`xnCRMbqiDuH0Q<m`qu`=>36soCF_5!KMCGT$-)#p
z=YR${Y0PiX@bb992s%v6u3JU}?C*d(j0)g!y%W};+ZP!@OEZF-Kzp}7Fa*zLFmOL+
zUF)%jQJ~|FI(R8H+||D}oCWCv`DT8D`V0;kCh*m*Ao+kjj0*LjeH5U<5s+)mkJ>XL
z8=8I6x)G!i<QtF%keb)ucf-enK|5deE0{`vPSTijKvBT`v~?}im!N}^8DD?j4Os#N
z&dm%A0aiTVULVw)P7WESdRLGIP)#4WTe(=FlHg!7+0S6XJ)cYd`g{oiP>Y?jhDD}(
zatZkCQSR4VGU<1$Yu)cyCvs0-(U5-MI??@(btkCVl77d!)BTopt%(fF29SB(F;l>y
z`1;p6@bU(bouDa+`R(<p6`=J!bB-%ZWZ$uF<Zl-O7ii{f3<d!@+@M>%!Asb9_6RZY
zEEi${t)~PT`1<=UL7wG8;BDw23;UZKJizN9K|`~k!7b1(R37kXD&y<F+c-JhxWH;b
zhnj(sJI`_<jsP8=2^{s1<u#12zwayr8P37Z<OMPi<U-Jbqy8p`2++hRI1WJuvol42
z&gum_;_uc-j%QqKplt<U^{@CJ-2Tt~0~DGjGWHjF_6u<Z=x~D<I`Hff;sKct*7tqK
zOr8Zod>}pbAj?1&fGh%8h~1(so!Bhm*)JquvWr0kls0%42nj(CmIir75|m~V7J#nx
zW)R@nBLulsQ-*;fVF80i!X5@SP}!5PfT3P1VGn~&!X5@alcNkwdmR)6K&>I3Q$kE8
zM;TZ^GbW(K2`Ys_mVjOVcXOfnG3!E*>p^o`aPeQOz>^rxN3Els?^{Q5&u5VbsY$+X
z4L<73WTpK>kmtZ={8|ZWzC}9Uce1VqDNMd^T@6wUikkp+o&`J)1nz(ju>~!^>N@?x
z`@VIc`5d)<-G3B8gCO8t9w5tK|61ugeGMO@V*U4Rj3CqZHz<H7utBZ@xg28K3UD6W
z-=I(cvIHat5nq`L@)@{B1dZo|;umxt90x4nY|I1=zw`Wo+^7TB_jCJ96DbCf<1&5?
zF!Sm`MHbl5pW747FIoqJC1jY~kTe;>mzyFc4j5nm+|CH906~XBU7jOd0lKyN@_*?+
z+<&;@FYJNvFD#Y*!?A}e>cSlepZh;o{DouEf4Kj1&F8qo<z^zoAjtr_ii<m*YZmAt
z9_}cvSsb^xX1!opoH6|cKjYN;dWH{|=S%)bsAu?edA`&SkgF2v8NQfEfm=6>uYYd2
znNY*<4diNYBhH=`biWa}U!m-E4790$@%8tOTg{^&!3&C~{S7)C0ct$pGe?x2IJCgN
z|GqKTJc@0_{sv?4xyqnw9Ap>hL~sVsXaq#jriq~353!7aA;6Lcamub04`^tV@%5ig
zoF*I$dOQaNj)ByHk~7F4P#i<d*s#|8q&;|M9bAAcP`t#mKtQIy$pW-yHIiqMfJ}GC
z4Dea%#m8;x13?=hi;vqRn%}em7vQhIZ|F4H#UL=hK`{Yj0Vvb*oDmS_*&!gxvr9mX
zXM=z|&n5v0o-G2hJlg~$9riHjwWTyD1X%GX^re`4@thM7o|MqQ^@2g%2z18`&prX+
z>^t_Im$pd%aM;73lYPg&^3ql5AD6{J{CWnh>^t_Em%mB>xV!@-z@U+R$37Btah}5-
z2DR)v_MQ%V7*w+F*jqa6VNlAxW3TD3he09xj=dz$9s!x`JNBGlU;kMTUX}rKFepR<
ztia=fjIVz!0%dyeG#V&+0u*^R@Yo17n4h+1)UHneUnvGUtofv=rv1mahTASEH5>pn
z?ipYISP4HY4Q$E3rQi$;vIL&0e=P=Y#080gf*WKpSnaRHhL>ka|8S^hPykgPpdku}
z8U`iMhSAG&q(5C*%6X2vmC3a}A(cVt!XBv~2{n*2^1v>Hj(+wxC}@C!A8g>?72ui&
zWD!UVWD)2%f3V!I1(BeZFG#MvL1D)2`TP(1pBSou<-RWmH#YY-7=llngqY8r0GT&1
zsJ{ndKn~#(I0iB}z={Xd9%p?0XD#G_c32&0!vP+Wo!nr+^n#IJ0A$eQ1_PECjQkZQ
zGE6-ny<kUK@_?G<jIV!fP6X#)(EJW7XyYUUg9!%%C}$inKW@)xBF@0U!3tWL4=P<a
zm_otFF@sLK08Ie>+EB?M&J+n+1_|<2{{;KFw_CZvmpp(iQDp=dcdx%MfG>~hZ%6>0
zJ_U&)$kiv1X#Bf4&_s$6yiNq<=l~n;1oLC|jQkA(N432Z7#KJhnS4Nb+hnQzM$r76
z2`?iPn9l*0^E2UR{AVJ-!2sHsW5Q^^kz=98f)|W}2S5%1Wj{zTFZeq>L4;A%{`&&Z
zCR`Sft0A`WfKFQijby(7@xh9JEp`QI?r%r{7X~0UM0{`H^bI16Vp6Q&{0TZO9CWTC
z!je^r(;tX1sz-wBe$aKHpgY+3TZKUV6vo%Tb}v+pH~^mi16dVd%=3URK|mf<kAUuO
z1dG{lZ{TkbXzoc!sDQ0|xsWUk8jxmu{bR}0=?S8YO7#mPK^-KJ7eLN>!LnrysAV2}
z$+j{0qV2@sL)MDH7i<>>pSRr@e9rb@@LAi7!DnnA2A{V57<|f(G5DmNVDJe$#o*(1
zhQY_|9D|SA1qL6nOAJ12R|uMIGQVf-$gcp}kEsCm2YA@v`?9H^33QO1FY4vFrh=Mq
zFXXwVf(Gbc$a60R(XW5)ssuUYg*-Q8ISOcQQ;I<j<jB|G*MSDF!PPk^BZ86`C|to)
zjXzhc1eK4+WiE<>EC8L+3q4C1JP-XsUI26oJOh7+fINSffN=fi|H2ZViiHF~Ct&gS
zfUZRq1T7<p=kF5`=KjnSZz9Yvt^4z2aCg#qGDCy&e1@h^#ljMw{|gC#F8_6&%+LZF
z1a_Xn&;>HXc|JqO=l|Ri&NCU>K26~g;QqoC;yj<B$9WdRw9o%JIlzOwQyBU_P2phR
z{=!rblAHi?1XN<urzt`(O;bQc2}qo)5?UL7-($%A3)BfS0(Zhd(G2o=fGS5rz#ay0
zK0$6ggF*nLW`2XZMSvCu=-gUxbp{GWPE9WN56|lbmU2AhVh{Mk5P(f%z#j&O01XcC
zqGw)C@b$_lt#jTOA#fU;-(c7aTD%3$OY#g%pgwcUBef0u^Mx3Co*2f0>Okc$2bh#+
zFff?^=VUOSBh`?7-zGA<{=QA3QcVMcS+R0r_I>L}UIqbqP}TnVzrfP$JJyNHEes6i
zbF>n<pK^iEcgenN6PSJ3IuKTmX5X>SG(Tw*7_f&y0o2w(_XPMrT~Mhb#uNo!jKvO~
zT4Q|uea%%9Nv4i^P!R2J(0BoA<d}#<_uYXG4i|?jY&DT&YJ;i+bzY*B=bZl!YO|)_
zu?aMhVbDpxV*@UVOk|k8q~EbgG+}3CFp**4O21>1$sxrQW+KBNkbcW1)cm?lXZkIh
zSPtlBqx4%g^{Jq^NWW#1n|{ltF#VQIY5E<T%GckQ`DP!t>D=F-4lXr<?^p-kZsmN?
zu)KW+XnfZFzI7t_^uGB_G5Z_TL0ifhd-k<wm@Kt_+_R=V;>L2wt`(5kuYYX@Z$Jfk
z0OUzfdI+##e=y%coq>N=y%4x;1D!e!R{Ur8UGtmP`5?tmg&*K$&hJg&Hs}5ZHE`#r
z_<(hyi421V=m@yt1J;G+H>?x089)`bHRw=)JM$Y99%LW24s@Q+U;s+s&Qln4z*8EN
z8H`{#&bfX*g9$j5*E7XC&t%YZp2c9sHIpe4l*+*l`near^xZ@hvI>VokSUBqlqnn(
zj3$x{JYaRd7DM`!;3`aj0o2S4u;c-)vt)ezYbp3lxfk+0z95e|PiF9Op3mS1%Et9b
z`8WWYkHet(I0TxHgOKuZg!3$hB&2*C1<l8xY#amfB`CW(Php5d%Ek#`56)+b2W3@6
zR^GCb`xjGv)cghu@Jfmo^4zkZYywggu!jL$Oe3e}{S6AxO)gwVLD}wwyhN!9Cj%2o
z3TFqc2m`N=V|@L6xvYsKqY=o*`x}%EKyeQ;8+2^4i8zA*=-v%Qg?jK_5yscwmmM{=
zWDuDTJpcow5FD&OS5F0HHHaY!pj;B>e8)Puzd>P>^Kt7$=R4M^-0e*67oJQ1=y{;9
z0;JDGoWTKPILJJ(8Q+)jg0{|q%-{g!EKpGnb%1HTC4&e=(bA(JMWAJcAcdgB2bvKL
zu;EYu-5n1#*ai~kOwfk*qQ9UcANMyXf{y}+sxdLYVH0Q~$pmTId|$K`qy}W>{su+R
zL0|63WlTNzs9R|!m*77P3g$O$a?Nj9=YkxB9P}W~pd13WK#YL}bOMKoB>2>7#@FAM
zgn}FnQUji<mSKXNb_zP*T!txJS%CwT7}-E(zW%=Wuel|ISbKvdc%sHco}s>~`Hy8i
zC@X;#{M-Z{?R_E74qinEZdC7qHma|H+sxob^<^{ZAD{^&hdt0X^>*nWmnFdRkT&&C
zFdKiHdY^#I3;BAEqo9U0$Y<a^W8b$|f~rrDZ(hi=ods2|t~LxFj`j>bpo36AZCbM_
zYzo~|)QmuSK>be+ZqVI+OLxNNBIY-!{s0drfr?$Q+-gwo4&1|--=GRw<pnwnCjr#d
zL5w|o+x`}mLJO8L1b_}h1vwyL4|J&zCllxxEymZsmQO5L328eA?1HREGm*3hU1-Gk
z`p4Rt=1~mb69}=$C4#nNgUkfoUIKDBIJAGQOavce2a*8QUPuxPO{5?e&3T{#I*`JR
zyCJ9sw1^WlDRg@dgZ%ym6@$wi(%@dCi3Ahq;0DmTHOAN9w#CBI1E{|RG7~gV2Db3q
zHdRpQ@|+L?)eoSKvvoAj9U&%=BAydMEFej+!XL{Y@|=JS?OdKN@#FF|$sd=eO8qbq
zW&j;x|HDLt!GYuR^jQ*&^7XqIz-@4l5#~`08LxjV&otp;0oTf)fH1#n4=%MqG4lGy
zazpbd2Jo4x++9puAbHRhaG09cKUO`2$%Et&;>!-g#NoZ=Z@a)r6<mSB?<}9sE&=M0
zgEVvh=aL7Vv(NpXYtH960!u-w)Vb$y-QoVj6~q09YYqs1o+EG!Dn94a9Dx?@DJ(J|
zd5~wg|8SiF^>l9bF!`ECF+h66KUOZ}%HiU<*#lWaVt&@Xo)KgjNCSAw*^i}#AjO~<
z1)pjt!{h;8rZES+Ok+JvEr<sB?)8tQf-s+f#6aeN_#inGNfw6JKUN&%p2-BhD+VqP
z8t(nEWFbf$2TMIuG_Qfc$rtiWOF^AVP+Jyc2uLx=kk>y}IGRU6mN<Zt0Z1GqZyp7S
zw%0#aFq-f&fRC*OB^!vI#o+CcAWwkIL(&6o;l2K`eCCDY(w{h<bH#Jl|L2kiDKP(U
zrU^QPi+c{&<xi6Zj&U5|oC(?t1>P7nS@1oSJ?Hiu<_Dl&!sY+c2SLM{m;XyIy8fRF
zT(yAiG66a6$^jWhP+H=625ol!Shkbfo+*;!IoI(U&$%Cf?BjUO74!LzK+AL$X-3KV
zKV0n~jW>QWH=9Q>K)NVDmT8&@G4OzV0oDK;W&E*-6B2Yx(Qxr71`d$VO(YrfUjJCS
zlUs`kd|*0U9vtKgK{*_pc+tc&>&>GWz-<yxDu+obYk*fGFuwk=RMI?(0X+MlY;pcS
zOx`?-0d&zGs4sNW{FF^6$e|Z*Nq}?o^(YQSkb_=-+bVkDnDh^j9H@H+@+2r4A#&?%
zL3LyHG3)w;AO)a0E5L^5L-sN2nP9de5BQQI9tD9}#Ye3RL7G5k-oO5~Rk!#KWO&RR
z)SkU#-3d}(e9YF6gOSO<__D2I@D*Fbt_}qSkcHlNtY@}2=s9>Fw_XXFK!g;y3j|H1
zAbUIKH!vwrn7%=VQM4XZ+<sg0^(GJZ1D=bJ5xa~t3<{w3BgiDs003y@7UXP@Dae&v
zdxHbGh~D3zbOK}}DBF17x9$Yx&-MnV86f>2J+HrQx(b@@1>N5S@-^J-2?BTOVTOae
ziflMYVShuC0H~BrxWf>^b3ovZi3r1=;9dp=$2|;A%~Kk|`=CKXiXgqOzir|LT_?fo
zAk+}}hnIoZK?t0XKm{a!yTbg-f24j~pU*3ie#Zv1zs3c$pws-WeLdsrUn@946${TD
zA@Cf8i2wt`{0ZRG@1v40*aVu0Lzc-UU$+ScSqy5%gLZ#jo-Fm_S`Dv6`URWF^vgD(
z@FB9_D=O13*nl_j&Yz$Fs=VBJE(qM5Z=e7^QvjqF?BHL^B{|qYLmVtj(Xb#1p2J{(
zFGN7W460AE?^w?S-6i-!UivF&n*=DR!G?a@zzS-}!W?>g4)>45Jq%8u&;*4<!X1Vv
zkYnKLgMTd(1O)}m_wzy5zsfL0naJ2Pf?89_cWgRM7$Ixyk}uhGr{A~f1+|vakK2Im
z31Un?XfyTo?`1PVmBM`J@r~0B<QPTke=P;w^9NoCz2|{Kg!diml_dCbCC4AoHGi^y
zv+r21biZs9dZ}LO$Mw&=5+=f||1STR{?ProLBjctO+08XH0UH0P$#FqZ{Aao@3Ifr
zY^(<j*k1p`E0KJ_X0Q1T8}O#9^!qkD!NK%v31~xB6vEf)pdDtuAYUinu~}$-*=C`M
z3<FQ{9h=3VpaQio((l+T1%;G}j1WWm0h^Vet%>P(Y}Rt{Lfaa@mlPIXwhi3hV0#xl
zP3?Zg20X)7e8n~qWa*_@Qa`ST@JhV?x#Q|((48Bg!E+g=fcXu!wZT^)NA{&(v02L@
z!xUkD(`F$^&+FfdPl7Di-(YJBibFmY0bx*|gO5!>hO34t#{IHQZ&!`YU+xK9B4)e{
zLVO$oq9)=D3rr;H8IH_bU~?T59J~tz#JJ9KiS3)VXFHg`NI<5)L-7{xDgl|v4F*Cl
z7#NcJCn(P1T_+&J^@nNlrQ-WPrWG?VKo-k6XmHDbk5&NhNC73j<1z;`%(mM9H<4iw
z;^Pt!=D8pMzIZ43j!pNa8mS-GC-X`q*B`LyG?8Fn040p{J2t%_-=rU~nfUtmBF*#z
zHdFUESWgA{sNe#FLBUxD2R;@75l~-`k4-=rw7`g~fJ>fpKZ`u*7|4wK3<12W1ccj)
ztj$3l=qpfY;$0^oZz9aFp!u_khKVr4k><}<|3Pw~?D;}o>Tdn*cK!$bZ3;rXYXoH4
zo4~g?3xQnCA;#qULSFXht*zV-Kyv*}R;{KR7=*ara>>t=Uy#Me1P&FB7YqzR{ap%1
zd@P_P%JM(j8xo{I!G3v;^uNgs2B2FVr1%&>En@jz?g?B1pmJj#gXLRLXz;ERsF&$)
zQoH~f-3U-*N#IcsxUrwXazDt0d>jHYpXUg2@Nt1g-<aZIC6oCa`;VaWc-tq;Of?Z<
za59l$5KF#d(+NsHphO4?Nl*}jL-K}AZ~6_JiLZa{pPGKd1{{*0Gtc%nSiA+LB@>x?
z1`&`;KpH@rK?4dP!@vjQa6u|*P_(3<1slSfeimv7Xs;}&8O{q)^ZMuBqo9HV6jgA~
z*a#iqZU{=B@|=MIv~L2mBJRd>2KoLL^RHkvx@-=-^$S2gHos56$G^co?wa0eBE#SW
zDr`W$1o<4~XprO6Z$Q%y*tdK4!hE~G!CV&9)B&l37pXt@<boW_yGQ5%X!8tsojhm*
z4QSf#g}m5a6Lx!WWey6$*WWj~f?E|bOrWWt1nxG_+Iq;!VUVGqN*|;StcHy#^7Z#E
zSFbC`%mal4Oz!os&G5U*0@gAFn4hp`G+hJkgVei#*B5=?;LF<}Fbkv!v=;%i=P`H=
zgTnk)g(%(#P&yEn;Ee+1X(0jL7y)_i$xOkZzCUlAfDCA?5Y&5mAuk`xI|p>{i@dL?
z4+H2HO7Peb$Z@Z~Z(eJ<3vy=-$Wb7NgF+B=1vKO9@0&}_qZlGUmcu0>SD=C9Y(YNb
zStWE}&jT&+k@zp<Il&90K%=RkNp-McpcPs_mVkHfv^Ug)SCN1Q^8>8FOU4+%2fc&R
z3v?7Ez={WQ@OQlolPlPTKi7e->jhs_3c6|qlr6yqs3K2aae!8WFuwl18+79;xFH8t
zV+ENfgP61Srir95_;7Ggw+}4#W3ed6ksW_@e}X)T>~PT5^Vruv7F`7;2xOOoGz3`j
zfM?iW|K4>FbbAL#GpIckpvDc_4|^2Eh7S1qn{eB21UbfpkHN)+hhdiaDSJi^MkZg5
z)u6kHSen2N`L+c-);PZba?hJ~f<Qe(fE5quBu>WHzjyuwSqieG=aB*jXm-d%ihBoG
z<Bz@Id6eQiw&1x>kj0Q02LXoSgEkLA78f710q<dgsNc8HM2h`_i9C~8_k0!bs&j{W
zh7X`|B!^;#Pq0xkhx#;zFQA0vP{QyHl#rAX8kj%>%Vx!l3BmVm1G!4LM7Y1Oh+LX4
zodWH1P5!i5kb`S8m++@zfn@H_EW)2Q3$%dv+@HBF!^F5hb4^xIIKaUDnd`oZBE!1L
z3&LdUzp#ijHO>Q9c9&bFe_ZaBdjV>AfIJO$^tX+3i|^Pvn#eP};C{-~3OanMWkE7{
z#<{&gc?QUn0g5~h&?QieuYYfcPpyGs2Q@A32dyHBLc}NoLwx{b_KBmFNl5@?STBnb
z_?B<;!}g5D2W<mQxY@zCfrFwABp;y2YXGtgyy5@%HgJ0|_#h+(0<3tUH$rWL&)o&?
z;#GjEMeHyGC3?_-0zdZFKLjl`Y@crr&K>P7IyXQgZ0&9O4dyp(4!1X{Nq|D(g}gj3
z$nv>-*14d=BLn~N3UGID$pq{KmlrPl4Fa6tRyJt!z_)Fj7d7R<od{5KAaEBCWYCq9
zDUt&u|9h(@sQDMLlpz4zp?o1PwH1_L+Z$@xK~eBRUb++%{2&})#S5A0`n~0#i2#EV
zC>??vQhd->5Ja0_w&^TBXv<i9*;Wz6FFt7V(fpK6Ab3+SKLdyPNo(-rBFGc3e=Y_&
zAPUyh1E~+Fx8jA2n*QDb88~2Jif&z`)(G08z;i(0D9B+Z!VE4=HCC=B;`SToY_~EE
zzGCYbIG<O5`wwV^tAPCF|MEYY=9}CARo@_Af!FDQrrcnCz;Ao@n%@GAZ`*@sX`Jua
zggW21i3F`ct%r@WT%IE>-~T{C093|YpD$w%qP_3fbhbArYdGJr3FlyEa{aQOB|i9|
ztzdu^FJ!py_a^W`3O81B|DT(n1P*erudH}M3j-Nn|K0>HZ8?uJfv+cSZ%{gMdlEl*
zvN6Dl7u0dB2Ppy{$;SDVNd|P)SMg=gZNy684kpyF3E<%Sy%D^$sO1^FoL~sB;)ND|
z8#_VK1&W^FgSLzTR=nV0n%BQKf*mk7K{*2?2Q?2`er;6bkgjKPF_B?#$i8D8IL|=|
z+=+oIf~?y5y#c(z%S47DF8hvk<nh*n(CKbSvp&Fz7g|nj=mgyqWFo@=9s&kUrUW0f
z0Z#>Rs&cgkSn(?GEP&1?{@!2+o<sx9-_~<OQZRTn?Z@_upaKe(8=AYFK^Nu3G*57H
zFrROKx4+4LJ;;~f(D=80CTPa4y}{-#C~98F%bfkPpQS$dpv}V<^0KS}Ry^QfejzVw
z8eqi>W(QdDg2%aE|6UKi7yEeY0SWMc63E98g?!+(P@t=00<8GJ<pIdT04qMwZZ5{x
zzt<gv`qB;*oM2yGwl$oWV5bZ6Ey$bzD?Z4u$?tXGf(SIx3<?1gc?R(PAw2s*wXy6`
z(D^&yq8@4iG(oLn1Wmr0$S{B}l6fI7Zwm@`kik%O(0E<D5i}8EBEtaQO7=ot?ky+^
z+yBf3uQ~-ad>I%-Hk%bQ81U6AOu03M{{h!zE|FIa2bdTb7;OIk|2GAK>tPHC&A`BL
z1R??9gV+oV44}OmXBZe5u5fTLxpHta#q&Q9nB10N1D>bss<FRo{+|K79kzYK3|mn2
zfL4byFo<k7`_5p%_eWtq$U)rSx#V9z06QRsfq|igfq|iip`L+Z2?GPehX4P6{{UeI
z2F4l&2F3}^^A!?I<Qd|c=i7sB@!@zOFAbehmHP{d0+5d(xBkf8h1>!pcNP?Kpab(k
zH&2;JF@R3eXMFu*H~6;H`3+{Eo>lY<28J2I2W>!mo<N({7(mNpm_Vl_f?WOj-%@b!
zy^xom4;l=7AukV_a)(c1zW%nw7PResK6KALsA&i?3{=d5=DY)}c%TVv6?g^a3wcrS
z6=B|YYy$fm6hK!1FoL2oz={uA=&h;;FRXkaFA6^)?Ddabt{~U%Z?Ffi6a>XPsIdxh
z;1XS^9QX(us2pT*uMBu?FX%FL#@F9A&*hK-&D`37kF^3>3OYS3z>2Q`q#tb7@3oBJ
z{Qp8;_V^2V`K#czg$#p5`W@>?6B#DI^gGsx3Wpd#W5*((piaML4PGp)D0BXQ`ZeoV
zQw|1}^kdekCISo+=_jl~Wj+&VWGnpwWRjGFizz()nsqMtfFnVs$n>Mug`hRPAj{K_
zS(m0CwXRIBzh+&Ve9pQt`I>ce@-^$$<ZIULufMIintjKn)BC<nXa5&Pa6`rYzD=zA
zEt^Ep1R7|zj(ZkURKJ5Fhlvb>8OXt)kT8*9@&P+UjDacrmUSq|0U*oMZ&`yTLBRv&
zAWwlD4RU1qE$iHRkgMRXxdnC1E$imj-&UVZzGdACaRlVRANR{PvF`V65<x8`u6m|;
z?)gkH?G5^0LBR{cpc5`YX~0C1feYlz*T0v657&Po&kv7Yu=uxqf#$bt4muyTsRtk3
z3vIgjfeZnS$$@Cl-7BDjY)v>oOI$!rI$K8*AqE?eT!13q21FxdDfnc>z+)WXVR+C9
zTO3?W?#_2?4ubBu<ZfpY;oxA3;Y$$^?b@Q~#XW~BhT{&`9sUWRPFB4lWd7(mm%OPB
z1Jmv2+&}s!*|*;A<bDu*(AF`)iVt$e=<g-qWl(dVml1;<VZ{fnBbI<204fnd(ZB(2
z*{lf!H*9*Gz+0Q!n;bQq@7o+~pKre(q^7^geks_DdPT^hAdqif|6T$<G3tdpFL>tE
zd@2JIs08cVVApzU59oY6xvd<}x#U4J?_f)QFWwpWi?4xWITL6V40tvMWH?l=F-VFJ
zQHw&`h)_B3;WD6Q_u%p$G%x|0{F*+8!GW<x!r}5C*zLV`=^z6^V?-Q#nC5^gmfNk|
zKg|C#81x$`zPN3}{on-ylLFTiE)i2r1}3imT=Ae&Nz(r?G9>?CWZ`OMk^wa`Ky3{0
zaU65x<w1?x<UfpT$$uC*UNA7$FG&8w$kjc`7F?9hSzrq~0U*}=4kW9Y$TL{+HwdMy
z{|UaDBL#Fd2Xr|AOZpw_Koc3JFi?sHUB_c0!yu6kTAy&!W<O|jCH;<dq4_PFjp=u+
zD?yhygA!i)3F}xBP6h_h#-#N7)~V?y>aBCr?^~C?{<hOH`3_|5v-4G(ji5srI5?TY
z%&%L6*731%O$7(B7Y7?tJck%l4F3}W$!-(d_vSMhnBWPjK_F&-gYA1xO|E!Qh?u+q
z9plUWqqo7n_GUZxgNr5-Ke&3BLXxjox8F43gs|(cSa;qu;ev3kSa);kKu#V>zGB@A
z9u>W1-4Aj(rzTg#>)*RgKT8NGa%ytPaN2OmaL?hAF`vU=cX^8B2hKT6F`#k)WPync
zgGl-n>rhaF%)Vm-If;ZF<QbcV<~M9Q&2K_hl)wJAL=-fJ9JRl}3Oowpe&1%Q`yHE^
z;6mmPXt9G8xIO^SBSR;<O(dDRKn{BSZ3TEc(*6c3S&&69<oUjW#OEwfRR^URaO#Gw
zc>A>v+@cQH!w?X#88VD+vLAepsU-(rjnDzmMW&!Z>Wl>p1_jF?r-l{mVF&=98YU-j
zl;^(C0r1>(gTS204F(J^<OJSM_fTh4tpBzge1q5vIRVHVFDC;7C_yOPIse~;gFz$x
zq;;stX$B_H5Kj7O>%jCA){*Hatz*;gSf?^Ea4cnF;DA&ZU$=rcO>wt!$=sgL{2=>|
zbs;DiK|agAZ=DHB3!oWSP_Yd1o%wN_PEb3)o`an!95k{C^7`v<3td5{wRoSj>FhO8
zdI8dmz1&vXU?RixE&a3&xYe3|%cj?ahe5)GmBAtXjLk&z(>4oDz-742R1R*)%8T?n
zHZwt|M1br`KVdWX^|uAN*+*^a7kb~fS=jwl2|T0Ze&0IQ{irphl6cDG3R(x*vq15N
z_Z{oZ>^nArplkwiz4smK!t6UXktPxh8lVvm?>p9&*>`Lb&2L$EgDmjAW8Ij2$0pPJ
zj&*1D9h*XvI}Fh5#*hR`WF|69L7-3ujg$$cAGK}-<uzD71Lv#z;Oeb5`KWbk`cdo9
z^rP0X>1V7n(~nx`g0fliQS0{CzqjTlpRfi`1ZAIuq*9Qt!9E79c^8C^qJ4v$?g{c}
z{};$+aretMQ{C^|%=}be3|SWjs)-;8gQpji@<6_L{bLiP$t1@Eo>1UfATVpP18DG(
z^U!1m@ct{U$qoigFBlk{COa6gykKD5^n!um2hRq9o87+lPeILV(CpI-28Iiud4a(D
ztRMIv2*|Y0YcS&3AaEt%Gs}f~t{Se(pnezV5?lU1LZIW5W%`>GRyou#C^*zJD1inm
zLAQLG$k^9{E)L_6VT!*zN9qM=RqFNsGV&%e415Xo3`z+#jAkIqK&=zd_U_l;)`B|^
zp#B^v9lem_nG5O*_BYMn4pIj-zaGN^6M2Rv?mtZNAVXmmftt}KG7Rq=iWr%AHVB+-
zi)+xh<;DLX;1A0M?nzvCiaQw@Kqn+8)G#vfstCk1_cv(q>Iejzh%nTE2C^>|OMmDp
zX=pH!Vc_6Z5RmDfsPN0v3Ur81J(J7jDCtF@;5Lt9D0=;Uhc0N>x2G|K0m#*tilzT?
z6>|wQ7E2tsJV%7#_8jhii8c&Qt|kl~pi0Npn8C-@lp&zKt<59Qj6vb{9R3G*n$0g5
z7?|ELFfi3HFfjda)n@RxSYLDh1E_WZ8Foy@vB1@g!ROK)6frN51)z2phbU8I@m1Tx
z;%ksOg%?bVAr~Wo<`O_hlR&%6FPIiXmhXU$F*IgS2)=4txUXixj^JyyiI+Ct{{S1_
zzf>$GU*DIY&}AaS!O(Q40W|2W&{)%8U?Rd$*R-Vp)HY+{5N3)2mD8ZQ7F6|t9m35N
zsZ_wg@PcX47triT_vYC9pilvgtb=MQ<rxif=5sh0=G|#=Fp=e8xOI*D!RKiL$GGlr
z$$a`F*u(XQO9nKT&vl2ZUWV%q7kHLg>Bj*+?rAJiX5Y>KUyhPK$UTco%0!0oU(@x5
zjLT8du1XIWI6!hu*Bd-cWEdHgo-nXL`5GoN3=K-p7??o(uIpfjgYF;&U8fiMf_d*6
z6ETLm+k3e`aBtYrz#+gC%WEU#0^;+UMG5(|Iz{f~wH5OC6eQ4MB5(gcEuLYHSro&h
zz6lK+Ci098Ci09ElHwT_-Kyt$kQBo(je82yoTPY$Rk!zZJxB^;SO-4Gc@6_ZQZU0B
zP$PlsD$}&2c!o*SbQwkKV;QD!Z)Tc%c@HE?LGqUy;y`D5C4p||0u^Ry!3;~1LKs$n
z7RP|nVNxi=tk*vmPfUtonBf%906zPTdp?VNQar;3o*K}wu^<Oeoq)V{0{HI7_`ME_
z1pzkP4JN`2lhWsN7`%`d|64qn0~7!X(`V>1+SGIJ;ks)g!ytEiFY^QwF%AY3afW~0
z+Zv=m@d}zc>z+RU?(MzO2SFzWa)>g8aR@WTzL1w+$|1rO!>b_>3(8V2<Ym6{>Ii^V
z(m~~Au7c!2LHj~pW-lnJOoSOWrO)TM@Iqd!w|FwgfxyW;7x)qc6lL1yO%Df^O5jrG
zKMQy}DX7pX{=&rYLS9UCdWjyR9vk0<*T2@SoxVbk(YD@$!2&e3>Fvs3z#k#d{`%Xl
zO4uS`=&~s{kpBZLctIU|^aDPAy#BRzEz0KQzYAW1i$h2jS@`<zlE0Atl`3RV87BU1
z*G-T;_4^xC!9(Yu2r>s<X8d<Ccy^&3I>-w;I%<AHf`o|-PXTC}{P>=O;B(eNjsock
zu!K15^{*XkK`W+PmZ;nS6(~K+6v0QT^JEBs7vJ+F2sDERsiAgU<#{XwIx9yJ+~@{v
zmgGp~Vg^?T$Ltq^E)nUdQ3x<^XJDFsL7!2>gug)m+~N+{#rFVQ>i$|?d)X2)b_kj}
z;9zHpff&7TEy$Yr4ay4B7Z@;#)iZqxu;De}ZxFc8lOZst_`Y3Z@f|x*lYwQz0t--c
zgDv@v-9+y{3>N(j3KAwV3<{t-j<WwSSb*4j_9$lXBnV7)|H9y6A|=4UA;J{-f_bY6
zIE;mvqHgcu2Hl_$`GRRD2T1JpX6_H^m+hu{|6;HJtF33=atAE2m-_)%?TiKKckRFp
zXlO@y;S0tcJUj)Exf4)$7T>W0&5162{d=je`7OIbP*{Qvv2wp@H+9bfMUCJ)c8%_{
z7+fw}N`H94v_k=AHqT$7hB*ngwk9(6zhB79+6Eu8bDWo;AXM-Ehrxw=@{9(a8leV|
zFG0THs)6u%5(H*l4wnAfmtb?%M8^ItPl3SXOC{1@`x<Qaf(!uZ1v&Hu^JefVdtk@Q
zFhzpz@nYVr1G4;uyxi2=d$>WH3K!nC<o@u2aa#_^fiL9cuHK%@Rp0Ptg$=0kWB{cY
zL~7amm4lfn>V>@YQxh5czi*aVhl5hen<cv-p(D-Y0^&oWbiX7dO0B`$<arXHo1y<M
z*$djD^+H}cl;@971L&k7kR701vjLX84#meAJvgMM?=oVPs|TH=<?Y5`@cP%LtNalH
z&EQaF1y5-&eEn@R{ALr-y1w}hiV`OB_HRM40kMD2PDmC)Oq)T(_wEGQzrO*}=SHaC
z2Nnm}0h$dnk+*k!YjVf_Z+k~WhKaoWUufM48S|=v4mo{>4>?&dFffQPFfgov;vXjR
z_U}35nPR3V7&EHY|J@5Y6C6|*$}qX@Z?JC#DFFE#bS*`IC2xSoF9rp3OYqXLg|C0_
z{|Is!PnysHkc%KL-vc`8JE|a!!2q=Up&*SxVRC~8gNZx?A5Xo|1@Qi3c?JfM??CE7
z7tX)_yBpj+neJl3D9QYH&&25oCX6Z)AZwuko&Y*30Hpl&ul2dp7nm?A^A;cp@q&fw
z8$i(lQU%(P4{{jjVn^`N7su=_f_CbAyD?aRRs(@b#Mi&prGiRDki$Vq0Hp8rw{_s5
zY_OONliQpF3KKwS7i1P#{_hU(O?LaC1sFtZC-_h&4jCn;`1ubM3_u$8EKrEzDG->$
z-zs!~=c!Nw&r_ie&|p63PEDCNi}vpYB}`E5!1F+;0m+{erk^oolw|(3=I-<tri@MX
zYzm;0fR5jB;4tA}XfWY`3=@N`{k9%-8Aen<7DGZnHfRz9eAb`an+=O30y2@*{aOYZ
zdjhW_0Ua#@Dh5H`39#b(z`@BB!okf18X^h<-LVGR6AU){*S?FO<|W7Umu8HzN&F12
zf9-1wsD!lUK#T9^>}d`#kzv$&vxv#UWU2k%fK&$Xb_KBJZ|lGb02GEG%K}On90IKP
zLCcW9qwoP`3;_Y<(0k{8?Y#&(k9hhEGe$X6eudY+_JZw!RS5GNRKX`@f<nkdTqNQJ
z1J8;83*H4Fb6?2Iu?86PPv33MXu_B>{ewB9xZ@fI2L2-q4E#6#|Nn2pz`*|mL?dGc
z27wqfegTNjz`*1HT30{a!-CPc{s#jC(-j5=mJJLHtUe43tVb9a*c2ET*l#c}a6~XL
za0)Oma31*o|KAo6W?*34!N9-`8n4{}VT1TQ3=9lBFBlkj6Xxt`1hpdm&Dk^eyvb5~
zMw6xXmrZ0C(&p@$(+WD|7vz@!dwvJdQOS&{5(lm~P5)=XC|R!x@-*m%+yHxSP><vO
z{0B-50mTdfpd(LSFvuvqZ(7vlQN!Q?8il?-hg1GivGjk?iWYDr{9V5gbeq--2F8kl
z1kmzcMz=kCtlL2m6;RKRu>XOQKtK)X&O-)<0Ao%8z61f`z68Y=CL#=cCc+FN{8Oe+
zvSbvke^5N1Apq=%REB`}EeZw!X$%hUTNn<2j-A-wpfIZ-mBGOzmBFB(h9MxJjKSg7
z4bHm-6$}Qj7(71bKmgbyHoO~-emhXWKSSXr*vIDl;ESyStoRea4*s>H@X|Hu4?GKm
z4!mGsH~`8l^XE_3vSO6b;Wq$vIe7L6UEtXRIXc>-g2CeT*BzPxRSXV12ZTVAH%y>Q
zfq3pr&$D7o=K8h>JYU@3kTCtW6{B_%>j92ETt_|ju&n5BP!KYavHuQAJv?`W4g{n#
z7=Q<@s~A9Y4+|$e*t5Zeon^!8-y17I%g=d^3mteNFS|Bl0m}-gKMsI)wt>Rr{WLk(
zfHa1H_G$C%rzco5s;T|^!@$5$z`(#TgMonoG*tk?PZ$^&-u(an?+*-5Ut`Uv!Lw(N
zJ@`}+P=z}Efi<IeW-VwA>irWNeUQWUKd^agB4hv4V-Ew!0j{8e9ad(({<;}FbO%xg
z%4X&>7?=X8z*~_PzW%ypBgjK9<YjU}ff!KC;1IB%VZy$88($L{`<pN1rE{kz*f5H5
zu^E7un%J-@OmDDZlxMs!eSr<5aeXUjm<8%p(AK&+kn`EBRY64-=+e#ilN!KtLZIQb
zf*J+|j|v8j084(*T;IaiUpI4tT=GI*+7zS~6ii^Vk{JR5?0FB&Z%_cG*PHKKcC~`c
z14sSW#T!ADJ!F@p8tA|l$y(4M;b4t6ybnM{pos+IgJK&-(1k`(=9UZ}rkB_<>RSC?
zGZCcog}mfkkY7Q^ASpL6{sGy#zriv$AeAA2;Q<GD0UE@nJx@U`18};qWt6G63$WmY
z%yZwhUkEza4pcI}{<Q(L-U2+O1lILu@mi2AJc~g|LHsNzAqG@3B<xqPs0G;o(gRwJ
z4p#ehgCQuEK(S&X!`Q$WBjEr_v>>m5^np5d1$!6;0&I8>@Hf;8-0_~naN_bDd2sZ;
zkQWy%*u$s*a{l`^h6^CW-#0OXw}S3(FkcEX1QeaOiuoS|*l<h$HJQz)hz87WP!Qs8
z5V$(8Q~`7(c)a->h7J3t*q;Tfx8Ya-+UC#SATR~Q2hD*6*l=v<{*vHiQZHlw^M$-P
zE2ug4zGK^aP>g^wAkPA!3ojU$JPH;tfa;%X^U4$y%%?JJF#pfM#39NQ13HKlG?xV$
z#t5ikFxcOq5W)XJ;3iLjz<m=Lh6UVzW-Q>T5xT%rAaDa5D!*4s22?R9@DvE#c_A<A
z3knhQIrhKn-}mrJm`JcN@azyeU?R`_kEcN3^1k}1paV+4>!3hE8(_%-n)zM$`uB>7
zAVUH&Ae#ihiC2w{0hHW8Z1X7l-vR2Z;AF`0jD-!P_XXo_@KLXz=m1r2-0fVF5C<*)
z$-%)ieYHKKzMIHeP}%|cJHUpI0pxd3z!vNQ-Pb6*v|s^)0jR`$|45+#RARn=qR;^<
z!1g~du?K}0C{P28`2?mbI50}f$b!Zy!9w<Y0-zH8g}itzs2~oo=bs+#z$h;&w6u6W
zg8?{-JA^|6>KOvsJ0?$$w`NqCzTSb6r#^*&fuSS-RDue#FmTIriOick=_sg40XEf=
z;{x|jE>K{CORLwvmx2$bd?7Em7F5im=?jJHv*NfAP|4u%LSDX?`xloKI1Ik-xC=_w
zFXRPH!Fp>L65e-k2|k6mY2tlQk)~V^YAu>DFffGt|NjfrYD_@2V<Oy+7xHqw0hW9U
zX!4>kH-P3OK~u<}>+N623yAXn5jp_!6Da;c;t)5j=mf1Kej(3)733!Egn9)AP*?@n
zvnha%S2}**fdiB+KyB{*4F;hQMW8+Ae4sNE@62!QPX#5002@|^J$n`?DF6S*59Ke|
zv!@@l;F7`oKmWh)4|o{%?C%G4=$XFMGcfE~+y`E`1#!gYt*|`2zrI25C}_zU$fW_0
zedF@&5A;DrD-)<^sr-OJ<@<adhHv!@pp_UR^Cma^`23iM0dzD9X#XTgp9wo?b0!C9
z6Z~Nl4h9AAxwOZb+D$ka0^SrV6mW1bd4mo~2c=l>6=R@-&%dqf<w+2TGPpcn`hWWa
zg&CkE{Jnuij=L4KXo_J`%K?R19L!8!oDPURGB4!$Y^N(YGm6%~;$fIq-^U6nZa{q{
z4lX9Q?+q+6P|aLD5A5?nnoVmMIJ!IS-h%F30@)6_eFYo@-`19bYzJlV?+;i+zyAjX
z*8=c`Bg##n5fd)?J^S}P2blpmlUELWCNC(e-Z!lk<pJdkP;S}Zp!0Y79%n|y`mY<{
zdkR6>C%}pyb|lQg*T0qsf_j1=FM@0bx#acNRVPiPn8BmxAhFk9_J9u;eId`I3d*iv
zo4OPyfD-HbF3>rGj12P|6g5EM{l0DWebA)z3wf@;{11c<?4PW?w;m(_Dm(+q7!2ke
z(4GrQmL{SMOdt*XUqKTKe4q%rGkJ;z18CldYYUeM{}-VPAbGw7p#uRXd<=XELNoXp
z1g_kgB9$}ms+KEXiO_`k4chD=2bqX4u<(BoI&gcARL=KD95Puo3<gE@pfZH>YgPio
z^!qN1;#z#5v4T4<<T=+C|6y<d8SPQe;1OWMXYfLvj~8@zM?f({!n+hM)9DJXjAEeX
z{{w;fxBr8VIpkCY$zPr<{qOc1?*H=}6cqSBL;4OT;sOjW<OQ|{SnvffT$TWv3(713
z#=HkE|ChecmmqK%v_h?@o?*iad5)>zwpuDf!ka~k76IuD0dJNlS(r#LFzs2OsSA#{
zD$t-VlZ&}6Xw2sOy1T{Du>$aRNEy&oEgYaC`a7uB1GP245%hIICkH!I6zJ}}`3(wA
z0r#iBb7fR^z5}j8?(_T?I>0|c;116pp$i^&7#u*&nHTcxt_6P>6hN&wP@IE}`M&lj
z%)0pvcA))fZqozY7{%(BL!wNAi2+nXfUE+m|FR#v*B?|3aopjW<2{GL17tQRErHHY
z0jv4CCYI-bz%5WWRAC_l!wY#fQ=X?n7tC+kf%b<ieEof;CCCl)8`Q3Y+J?dN85F$d
zK-|dxK;SaZXQ2c9^&bT8gB;8AU+6;c9lOF8@~mqM{xBH4kY}CCS1)t`R4PGQ1!}G!
z!@w4QU(pFVS9pGdnmX9vISdLW@(eQkO#;UJO#&u7n}w9t|Bb)Pvqebhg*+>$Gy<1)
z-y2x%-#6{&2DR2f_JGoEJvha;v>XQ&c`xKy5zVJRd%l9oaZn|-|ADG6C{;mAD&f8a
zRZ~zxS4!6Z9Z<sH@Ts1MVc%p`UWghFP)qjmz61pUrDpx#FXUN3k^1&q0}sQ#68od(
za~K3b-3{et{ol7rm~9`J&w-vzJ4L90f3i@=3wh?X1@(~b!Ttu@%@EhJfGULlV8_m3
zF$IN6`<xd2=^`GCYV{w#{Qr*|GcYjhU|?W40aL@kz!1T}z)%B9WuPbrhv=8xx}dW8
zg*>k;XwV$u5!hkI%AycHUjnGf_(GoNDkv#H#5e``>l;9aA}B%IMPNlUK$5p*_#XsV
z@)hvx5jt>Pf};i0qIe<CarCwXXptJYa%p%W&tnT}7J$^7hzmY=A<yX=V8J&5G%y4j
zqbNSdc%t~Y-9`>6CimjAc7erb>=KJl+Z7g{vTH0pX*aR>gx$jW;$wCPi;vn}EIwlQ
zu=uduM}`L+tDy<M@%7iGwxG2Fp!51a+6Xv-&f@_k;tw?fE#MkVmGuC3GYhkF0|VoS
z!ve`1i@6TZNmt0osDXA&Ecif+;2J@NE67YxYt}?uWWwv8J9?pmxb>hri5p-4S$z_e
zUf>F~z-td0U;o?zUe*J$6eJg5#lHZ24ijWlxAFDQ?Vtm|B0=&T%uMbk+zbrnXY3nI
zctItZ07HNx|Av6C3<jVYEZ`f10?!A5>!9@vAjj}L5V*m?Qx7_ueS4|NbI47rU`rJF
z5Ab{xxCU1AP~dvN5BrN?O`t09=XTkEpY{h$YZ$=un%%wjy0^ReAs13{fydVxU;o^8
z6?UYL`Dyz`6CSu@E(DY^8Gt5B1Im~b0?L^LIO-XhqCge}R4_4scUAq|7Hg7>>X?8s
zM)0{=0p*Mj0xB3UfE@$c;q`MHYd|IA0h2#a$Mo3if)+=D%rn1h-}w6H)}x?BQJkDy
zGM{Y(TDWJjfEPQO+-CtVrVFs*e*oF{yoc*(@E?YP;Li*R!Cx61g1<ov+q?FS!QUAa
z_&*5T2>!wlP<#h$sBFMa$i7l=Xl-Rq2(aRZIB*-wgn;cVpw*L&0Xvu#UjN*3G+-w)
zIHbVoWha9|fE5F1-D>0OpIbmni>IIVW>hz0IRL9S0_^!VfCdjhlY1aB$iM<a6-cZv
z!TxRVAv?w3vvz^OXY3NEEBG*K)}OQU1s!17-k`t%vIDd+4&?a&D+YnrKR1K#{RJft
zkl5=#n|VRW41~d%Mux{Az?km<D6@e0=J%Kzz!~JE-9*qhAt-|cXmARE%q_lT$5?#P
zPO$ibonrBMJHz60c8;J-HT{4OBj@ysK8#}Z$4q2+Kz)-tpmXne<%Jl~_X_jXfG*2o
znE<jYz?kpC?Kz<1Z5SA`Km!%Vd=J3l+I$~Cd@x&+pCJ=EB9dvt5D;JtI)g_6qTYth
z0JI?<<hB4CHU<9q^+F8{_az)mWOzX9^FR){%vC>Q0jP!s%?5xCwBg%eBFrNI(a6A{
zJpb>1z662$=5zS}fljrZ|EI|yK$VYyXFsGJ9ALxcV8RSq<)pw6V9yG^$xDf$|3ApA
zjAZtP04=@-GZ}^xApYn2W*&wB9Zm(_IS|c?5BmQHsB;>a{$aTAxtWInRP})rezRvP
z<_#1&5TM6dU?RiQ04l;j%~jqz;DMCJ*FX0{uA%_ls|8NR`(A>QG$<CqzO{nfDgla7
zWsCm*=9UZwufH$cTK`#@hXJn0p5+0^P>=>tt3CiUDa;I>w{Lt6I`0v*&>OVORgyua
z*=9k<?HQn`Pyi>*04oNE*FV>RS0{qZ16lO?&%%eGWb^$W^Bj;TKp_-h!so!3AaDn?
zGxCMJZ2eq5u+J430<6HBdK+K=SaK5Pa?qRxNaOwng@gcIUT`<VOrGIHfDOL_C^SF~
zbdY0t=L;PG?Q}8y&u{@G7NE?K0BWd!<UnQxSTcaRlZ~&xtW^b#8|-g@w8Ks0>mdzC
zP{Iqa=LZj@@a`8n5Ma;H0P6LD4B(9i^Cy7VAhFCE1_zLZ0rm_FGHn>Z<9%qBfmS3p
zzW%bt7it;!N+Vtw(9whp44^SW-WZ_+peX05|08rjxk-;1WGTpCkbxi{^DYp$6QIK}
z!F&!AxaA7k4If~|9{|z>@)0<AzpTlHU4{p8T!0nih61qM_kE1u?fNXBb5%i>@;(4{
zUqNOESn?-;)PvL|1XwX#c>R4Ze90SFfhP9{UK>z?gk1C%V8sBMxoLd;W6@90Lel;Q
z1@KN{UImaE28IA_Uhp|gya@s`K?Vm{fluH7sh>H$A%Ib;9%c?B18+Te*>vOU?|Wt{
ztLXm*r4_K9_Iv`UX^#<n9U{n)uYW8AT{8hqrwj}M>ih*J@;n6~yCCV55xmzIqIQ8M
zXe=IN?)(M?(B)Fj+Vu%g2UvoS!)ko}Wd-P7qbP7Y7?hx87??n_Lm&e|p&MYy2<n!D
z)Pb%WL{`UwqRxsDw1Bzs^^XM$K`k4QrC`tK^EdGR0X6Cs7(g)zzDYR1iV-wI3R3JD
zJd+`TcY(ltP~|bNMgiO(EB?a(xlqKOUjf1fWeP?}!u`GvJV6SwU_NLnNrnl0?G4zm
zR{WrG6_8_fLCFN92ILXtM*<81%B-NMu4e$<w-sQ?3ht_LE3+_zg6c*x_k-8J7L{@^
zGl6G!xtqC|L33E_4n_^^4onT^Q49)ms^)_S7g!RE8W<Q@7))f?DtHzM+`s)<Du;iv
zPy=Z62-IuJp3k-bWNG$%wiVg)*){~&Gd6(upbV2er=D#`@qBiM0DHy>Ac5lf>;fk8
zJP9DS`G5QW@BcMKfT~4M(3yx!F$GxggJ%Xn%^gtl2jtk-KbKww`SyjpIQT630DJBS
zpf<gUJVOKMem~v=0{4sOGfV(gLD};e7Vs(v+yM<lf=X?k`UL`aK=lTwSk9<nH^``A
zw@_~AXXoz_n6Es6cZc~L2A=Le8lZb{8$pf;Q0Cv@QNy6n-=GTFx2VSo_FaG~s{_Y6
z7CzHE^8Y3ts9@mWV~V*wM=qzmML_|q&z}DPsM5Vw!y^Q$h<P6f%mJ-ssR!SfEyKVB
zN)#YLkYbQTfF}P1P}7!ILEt{GjlyLUK?Vk1W1$0_He7ei&)YYG>LK$BHWNYepmQs@
zG`VE>8w4)#`9Ws7`CJ5|_#6acxIgV!z#+sG&pnGp$~=mJ=>_8^kK!w~4~y^He!RVd
zyZ(XsE(Qe-ex}&h-?zmU->|(1N+iJ`8q_G1U{K%?Vu}RI|JoM`N&}!7CN2Xm8UD#a
z2ZFEIg73{TGh`6hXJYp?_`dB&^UL;)CPEAh#g}alg3f#63IIFo4u7A3B!7!Q6n}$2
z2p8Nj^&24vn8`Cm-CocAAo#BBLDTmP3ZSuq*T42wa_}>O&drVI^5l{M`55Fl^ZyKX
zW<d-Bod3Dx_XXP9et*Cs4T@8aJuLDW^$ZH2#KmhMaG!fVi!lFWp$Vqv?EeQEGbnIR
zW&w5gCn()H|3A>4!2oo1BVT=u(1e>;xE}=AFfIVqoE&>tWIzUF)G%}e*f4GYu|da!
zz~nM&7&e$qvHu%j!wBkH-9b{{5MaXyE|IyKxkQlE&)^VdiVv{iKY*mxBEW_bH0XV&
z9!YRQfDPjZQ2cW+Gle1<umF^I18n#oK-4lYWYjQtWaKdz1laI@fQTu8!~z0rm>56~
zHoL|F8Z8DpE~AEFMSu+x=-@#xA0(eq!>}X3h6xl>_24lzkRcg03<m;in83pqQ2q<h
zqNaIM7aq9&pOb@cj*t_`aRKIB;LVF3HIPf71MC?Xvi?JAQBYP5uw)S6Zsw8!v+Wra
z`0a(jqp1NF3<h8^D+UL|83y%`8Aq_eHe3OqJPOK};DV!>2XuNxBQFD}Pp1f;eSH08
z!CX+g0hA7S7YJMi>r>`9U{=g@0d!eAXdE2WtL2|4aAjYE;tms0h9(m+h6cU_fs=a`
z6gQa2FsOC^X_^3P)qxyiQZLTt@IqcZHNb))fNz0-IM;us_)F!||JxoYB!I4U;GWMk
zheLuX{PukQ5A6>UB0x)lKu54}-DjGA`w#aAv;X%0`ybfvz5Sj00ca@AteAnxY%2rP
z3whaI&>;Q`dHJoNr9-d3ZUcA8Ktre;pt*NxCYRS=SADGi9?uLuo)%P+fl4uD7yjR`
zzpgs?*%{LM0`Wm|=21-G?HRAXuIdEIy^xpv3o-~aU=O-L5>(vs6$sn`UEIVy)uI7(
zEI#*C@I@F!lN%;TffqkEOb~m)z`)htXM5kQm|=tYABK7+j(V>9{4c>%asr@ZFPo>?
zUpM~)_Q6!JqB-{2pzG{G>&E*VZ1X{4ph0Gc8u`+!PId)QP=cq-Y#2cO^7)e=C@{QW
zU@YQo0M8aMn12-w03DD8DwgLZC`5d#=V1U9&B33i|BGUjuK&hR5LC>dko}p#!TdkN
zhW%gd+d)b}u?vdP04<IMybegS8^#<PIE0y;yT7EK0ENx#uPeY!S`$_t0iFc{H^0wk
z;FxdI3SLMAO7GzOW5wif+fuRwtp4Xt@I3Vkc`oqo=X(B5p$1+C0p6Qy`G4$PprEDP
z!2jEP4uityUhq9V;OYVtpr8l>8KCT>|NHgV<$>QFppoRP{~IRv`s;E<khroVKe!14
zVuSR&{<;jjk^&TIybS`^KuMfKj42p&Qa0$mXp3*#nFK&1F`z*hsKt{()zGJ64hH49
z-|vDpVwlfitpUl+|6^YdGDO)KG^!(S``MR=VSk9i1oQt40^D=B=5q)$IdRYD0?iXK
zaoy*-&mqqg%N=U5fJ2@s!bF5&0#AUzcb))&pZwc}KCEl3kH5>mQ|JRo5G3$|fk6UP
z_3%FcWg>fDP=*7=I$wgot^E%6XE~Ue;^#9c9WW7Rn-MI}prBOI{~r{adlx8heEZBK
z!0RAzJy;l$+rNKj5(qG1DB$`JI;B7=hp%3U50qL!jtnqnXaG4<seZ@$|DbttkW0C~
zvWO}~^#3=HWMDFz!eG#_vtfr>F@pm)c$p)ELvxJd3DCj&9LZdu+xfgWQn_4Bco{Zu
z9pyS|!pFb>sv8@!te%2~kU&ua-pkJit-`)+-3Yo{1r!B0lKCHiR%e(jW!O;9A<yK+
zA;IKpBE>L)cZ0xR-VFked1Hk>tapsR%j+!k0W20P^dVS^LE+O+!5)rqE^+?vLI?OA
z1n%<96*|BlAaECyaQWs6T?me1P~e*`bRbxq!Judsg96_Jfm_92><js-gbwh15V*xx
zC3GR^7lT4k6@x<1cLoCvNhZyxqH+d<Tic~_%(f~p@RbYkfpT~8XZuDIakev{;Cdm?
z#~NV4FkyN|45M7V<Wo>?2Pdj;+rSI%K|TUCzCbx9z=jK4Qh?=uue%B=Pk9*xz$c&G
zSj+zdq{f7Yfnn|%g&P4H9N@9!06o406A5Mp-ZP-4DFXxOc$ENsK5&@}Hs{M`K@NVV
zC|(AE%S!bN7?VL3niboB<lte7;oxBk0ZE#OF&LR`WsoxwxBss!A%7dxA$V7~=!5Be
z1}0F03uHJbN=zi!Ko_WkJBP2oY)S-mg+M3LfDFH|6nbGQ3sbaNf&E9&#i_?x4}g}~
zf)33W0R=`%@j=^#x95O-BEV35&~_r|R$h=q@g3WP#RqM{4K)r%rl5C%i*A4{oV!39
zw0W};#D4u{{ZbPtK5&m=euD<67vRd@AOIdUGLc{a9VplM`upCU(+!dsMU}tq1mC&<
znIBh&EH(t4vnR=*0S=b0JMK=;NMe+={<>o>=<dP(c@3C~zVBTKN{#y))W92OLF-pR
zE`b`LJN-Zs=#cS!pgH}h@9&wwMbZlfwhYkqn%&<NEN;KyelQ<&0kI5&0q-491PL&h
zhzr)dkmuA5uwVc!9gX1+6>7LWhr8kW91bU^dWH~C<C*&pQw)E&(1h!AxFxveFvai{
z2wdim5$Z6T!oUP-!ShE5&Ac^*`!6US>tD#rsB%a$#qc@^bbwv<Wz$AJ27#!Xg8UEO
z&xgzlnTWH7fx`KPJcn(71;YbSQ;&m_$-nrr?M4$G25?UclyZXa+HQRPb(<?lKPaKR
zZ)yN7w06BbRr-J10tN7@ki8ESxHx2({J%b6kvE;gP|su{&*0TP-@f#A5C4NN>zTH4
ztmk3{Sr(wkuz<^uYkp8TUjvstSIp=C0xf(G1g>+~bIC*HH-K*6{<KlR2{bjE-N4}R
zsZc=i+kYO0;t325U-t7ba2axi6;Ed<;4tI5_Hm-X(&A~LW+G@nli>h|4i`UvE9k&Z
zdC1sdaX*8Bi3Gy}P`53+1AH7|BgluvS8X2_U$edV`pcR|Q0p1g*yVpAFz0%MjH*%+
z0|Wmbp$@ZR0|yfsd*k4%wh#IL2!V&{++-L$OvD*Q_&*Cd1YfhgXu`<E(A}sY!2eDt
zhX0+Ah>18Ohjx8}00WmPmng`$pSB9La4qDL;h!$V23kfAT9*fM3_Q_%S=|WQ*d7eM
zuAa*n+S*cN*uY`Kb)WyK&;kAjLg0=!DB(e(b4M-A(cBF|F`%{d;6>JRB;-M5ef{S-
zf@_QaK<3>|Bp{2+K$b!@uUZJo;GnpK203`Az3D6lCKCw;9&ShQd~@ULFRKDgBpLtl
zdI&Y}F$lzi)L;H0-5h+`_8>^#<^R%u0~8q!a5jRw4;=grLR|b)gm`*|9O^-XXnZf^
zrCm+LSr_pM2wVmom;x>VAo&fne7W)U*Nsad*=z=Q9}_4<K-mfG$nV=$f_yu_!2-Ms
z1XN1}e`aXdv)TSVsBA9&!vG#B<bMF^@deoPeaMDR(FNG+@iQPed=Efuu%W;9Z3S5Z
z@`;HQ6ST-$ws!i5SVmdq@7pz}3&b&s*4HpJ?Ac@g-Xxh}LqR>n8lD7!`vErm0@?E!
z9C#iG%xP~@GQjLuDuFhgf+r|JQyl@8d>2522qqFp!!=*Qd&R+fLro+YA*Hn?A9#q|
zL<)S&Xk-2BuiHDpJ=kPO1cCw^dJ1{t>z~WOD=$G_02TcK7X07=D-%hEh5#!j$SB3n
zW#9%8L=9+gfeA7o@pBn?+b)tgWYFQ~(x0$kf$Z&O1l>BR06GZV71ZJaUCIlhP1t!7
zKsP3upS5oU@n0}7d;lHY@%ra}$aXGynWrGbLB0k#4&?IyOFr=MH#q#iZoLV*suQFJ
z=6le(t^iAZh6xE1gkCVPCe2BxSIr2tWSS7Lov8slVj<1s5;%)#1Nh{^pG#IEs(kJT
zpxYnz)a-8sIVQl03AC@X@%7Io;8QGk69ncQzjFk7%(((XfGN`jNXf4PJ{be7$Aswt
zh&GYo5eP76`oP~Ha9JC41U_iBcYq~-0O+88kb+yqk|hCF%nYF32Pmk(zWKR$B8M0g
zct{20+W>X$1dxM3(PbjSz!0Ft@PXF>)T<F-0NorNpuxz%%OG%{Lxd?5bS4D%bkM>8
z=2Kh^8Vh)Xg${5n&{)7LFLa=u*FoSkFN44t6IKRr)$g&39drpJ6X=RHu*Kh2UA%FU
zA6)%_Mov9;ae%M!gU;+WzW%mqB1kPLm_d$roW>C4IGq91^#(88cC28Ca;#*C2(V%X
z9T?g8`sX4>P$$(yhT&MJjdDGBM=Gy_z#Xu!RCx_R^K2mg{00Rr=gABaAaUn83{e60
zyaD{5g(mR-5dzQ4fkGz0k{@(xE+lV#-Na}j#l8S>Mhqx1GD9-|&xPPM{18Wi=Il5?
zi`VWK&!2uSjZsPp6jJjaC`dVfW{60h%qZskpCKxFKBENBg6T}@jH;rC-y}6QfP5EV
z#SA*Rpz-z31%lIU(ivqLnWsmkGfGE(-UU8*;)T4xN023;iwFZH`3+vkOHB<7X95pA
zy^xod4KM|XNt*_k@Pm5G(<U8I03CFtwf}(v7ykr-`=B)k!E+b_K!+-UqOtGDbgxuK
zDNq%Am6t)_4yfg?{DgtQyP2H<bfyi+P27*Un0X!uoB$mG0~&n;t)(u$W19%dEX8+h
z3qfj%58E1=a@cPK9k!Ev-!{<v6nJWGmialGiJ;BYpsP&xaw`;pl9b6Ydt;E@CL;D5
zLH$w_QHJ^xCSnZ7K*uhcn%f)i|Dy20MA&}g{>jR_Km#1$4RM==4uDSz294%}PEh%=
zH#Be-Gq~*G6%e=+C<&<-Ky7O0i3}0oQ&v9jT?;z55ENjb;{gJHF$aKR6)g8-&sESq
z$v_U!;^lg#Xprk)$jfcz5MYYwG*!w1jfnN7DOK@*5V*{<89HQa!v`8!nbY2&RsqTw
zAfH3dq)}i{6yV*#!N}xo%E7<`5;x&tFydfj@&mC06q#Z7gEhYXu^WD&8A#5Ai-7?&
zH|S}83{nn(f-Cue%|zt}en!uD_J;013LYR=Lrds6-5m-BpnW1BvDZI#`v&e}2A|>x
z;)BFr|Jbb>Sj7y!^TkAxK@TJj8jS<X{aOB#Lx2gq9NR>SK?E%JdwXa-ND(-g1i<G?
zfDS?Vu`fZ9<MtfxAI^7dKyzeEK+W3j`HG-51QVR^*i1H&XXv^-NB&3md__o$^Y<=Q
zP=Bn`OhE_~dTlAT{h-imIny8oqMa%jBAR~K=7T~r_&+EO%IKQ^x8KO$ATa%VCZm9%
zDp&@RI=_Nai1}oDd+_C~IrH{|1{2KZ*dGLKaC{*zHy6a8Zj;3*$$g8t0ql<-JN`~j
z$YQjuzs20}LZ0&>sB|%rXK3l3Z|@3q?>vZm?ezmengp0)_!|V|uRoC44?4c4|AGB|
z(2gchXT|v^Lj*|f_GkVdpd||C|LqsPU|`U=ZOQ-OGU(pgPxJSJ)S4CBFT7RB{{x(^
zh3z+jTrIJGvVvBi74rg!tG1_t0{4Zy^xEkb*^IK``=RHrgYF9dvF&f*FXj!P=mv#8
zs8<3~4A%H(@kPw2+6=x94iqET8)WvI$TPHoVx@V$)zRr|vKgi789{B82A&0=dxR7M
zKsgqa#y}wvV8wjk^^dLKb!IQ***!t_1=uqRfDY<`%&{miIL`!^qu|yVNYCpZTc?_z
zur&mk2T~6*59B_u+|P}?plw$B8`L&}<UneQ>+je)f-cSjMHFaIroE|A0i+0210~<F
z1zkbY`1<Dt@HS_V2GG7E_n8bXFBo_I0T}|aApNc__=pP=E(R7*u>#T$vM~9SZQ$#l
z8&r!A*d~J1?r%^%2s&KUBa`ugM;hY`(7gfmJP87k%{B@N9@(JbO4uYH^MltvAP0QC
zkY@!iApjZp`sW644+?aQ3CJ-Z4BB4}anQaJP&o%G%Wm)G1~+Mn@7gB990PLb>!0g+
z(~sMRg7vX6MHSz%t#<^u%zX}n3uu%W6jU!5_dWsn0_-bJrYMm33&y>BK)wMR%)t}|
zG8p2Zb-5<T82CU2I?rc_xN<-SysbUsKl=ty4Rzxf_XCb>F7Av!>^nUEuxqq8C^T@S
zaj}7-IKYzm17y9T6$_-g`mqUouOY}mCgPxpT>;RtgRlS_M$mxkEDmv|h!^rgx*Tkv
zNf`wO(5l)1OBMn1dkhViW28S6-?5(<eBFNX<#@>t#rN$eUbd0`5PZ#kGD!Tgz2t}B
z8}^f}euU2g$ywb9pAmf1ezH~l&+zHRx9lfd-3*@@eARwp@eTXQ!B^}j-VWz}P<+#V
za`0vQiN)9LCkNlRpU5?zOXkvk$q(G~x#YX%H%Qzz<9-0zpT<3zOZZkX_k-J(>>xc8
zL6+W*Vt-J49pWIX>*3Qbf06u9e9eAx@J;)PTqRt>#kcGy2H&!uTz{*C`@yBH(jZB&
zM(eQfS)e)%<fzY6co>3j*-r$WeavmeCB?O$OP;HWOX~A{7KYEWco-nJm)JLg)(Dv2
zV_0z8nEOHT5&Op5X6z4chjKqCK5Renwk7j}+ac@^_A4k`+>T*>&{fjn!6D2P1{xf`
zbii^tcM+p$eftB20?>5C^gj%Cprb6N|7UQxR?NV_STErK^4X;Y3{oKRYf~5)u5D#t
z;F`r01v<_0b_{r+HtJHD<cCWY(jPd)m?DdB*cZNF*i{gG&Au39CP?i1TrPnZj63dJ
z+9LU(_^y3n@OArQtLx#@x#lp%6koTmFTTB>`$6z^`@-8(xF0l6Ul4KY2loT>{r3O4
zCv(Ywmg05GG#G&7nra#}xJ6h*%=g;=1<UQ{egF~&iGeKQ5MhdX!LYLe6rvzDNDN~6
z_9t9>m_m^)zrCFs6h+0sSL*Exo3<=)xHXOYf%$g(|6H57M7ypwDBSwa{h+C|LBd3g
zfdOP8NCSusiVjc|frhs~Pvc<#jUR!cB>0fMWAG9C#^A&D6QNO)*mb2LfI|#?O*m+B
z5OmE314s{w`g$Y{pe3l6A6S04{D0;L(5UI<2Ub5W|DW{(G!TFJfpyL0|Fdh%=P+<w
zeqg=t^8eZUK-VLK7A=A%`uiJHZ`_{G{ebJr3eb=>S5xVHc@B9<T)&W)X9YQaUxI=G
zXbuH*m@H`9{0qjdTk1iT;O))a4?q%>IY233`ZNYRt`ZiJTNRQYZcX8SaI2jA1Nejj
z5vC{(38u&w4BH$)_JN~EmMMlqf~h|81>=@A9O6tN;P|;_UtD|zo=B!$+6m4&#n<O>
z2?SrUFXXmiiUFmUTeG+yG*4MzaeF3OT8U{80Eu<gw66d~8+Rm&2*_fPg)bPkdT@v{
z#emo#v1{OjS-*J;D8axjzk{$G6z9d)?2Ea!Fog!+u`g`ev%mth9s`z6x<wl#py`AI
zWEn_3Dd~f;Ou}J${Tv2|E1>LFBjIo%Me@U?1_scTe378p<O{{pABr!7vef1q;4B3i
zSYcs`<d9{Gf5EuP<<bHM8L-2lSqfxe@pb!RP*x4TX<rD=u5*||ZWMDrxHO;h4=CH-
zn8E$vMmhI~+uOJw+_vI=P~SXrK?Eq_m~XTH51MWQ?VazAX)pkZHGr~QJc~TYcOW^i
zrup0txZ}b127(>=f??BwOH-sjfE>)h!W0R~avOQT`5P&}-`)wya-b|5eBZvXdH#Zc
z+rL2braK`P-?rp_&>hpD0aDOV(;xx0lo_P)MhW)=?hqD{YuC60KnaW6j42GX-}Kfs
z{s+_NGdO?>tLf7j>@GDh$S{^mI9$61DZnlzfKM=u;<~{UcImL>hf6o4KY$7;aA-1v
z5@h{G4Uh(KX~hf<+L#xN>!*N%5G82qB^*FOduaiKJSb?n<}-zW^j(_6`3F>5f)XVt
zIKiPg1DYtOK?^WYXwKk%&~&FkgFAu+;xUjMr~s><!TkUv$N{ok0#t%+-~b1w1XC19
z3=*8{N-%<R3p6-qaX$#YVPDuhV}ZtPN$v;cTkQXHPvepSg;KLk<B8j|xF1}a0rB;v
z8gQ*xTztpA@KQ0jRxGZ!x)DAdl*oc_+82XTuhq@)X&|41E{XveeEG8^I1z%&?H}PY
zif`B#Tm1~58GOyY@Ujdfdj?;&FXXmjkt)7vU(9uxON46<mrU241__Y3QU?PA=x~2f
zT>?6H=dy(K2T*nf)r8%_3+g?%Ww;=52C7{4>;RWu+`$$gS_o9UzK|E43o5-pBe5X*
zg}i7jNE}uNypWf$1?BmsJM&CIJ_V<nX<TBrw{SlI4RPGM#SOmf9b8M=Lu*M>_6N5^
zK((X<w3-YCRg+2|K-FaT=jIz6^3y++GTPO*9Z<-)b(Q<UwCfCZp!lA4jltpie+C9n
zRs&T|@B~-PzyL}!piPCKpa(650HvwR-y}a={tT@h!C86r190M#0pIro%`K~ZE=@+O
z9cy5<<7CiezI|cy+yw@p0)~4&mrU2628r8~xgRwDY2X0yL2RziEW)4~54<IuVYLJ}
z4GA+vfzl61`~~C67OpwaQWjcX+?oSPL&10L3!COHumDv9T=Tg^x=I=pKyuArtQsV^
zYFK1If*=79o3T{F0pz>O4GiGx!?D$TO`GSRoo-Oh=;otzW7=T`JFd-;N~!tFd|3`D
zrWo!oEHYf1S;6;jfXw>*pM&9ryxddJp)~s+C@65qGetrwsO57&^#v$*amY_URL<y7
zuO@JND)$4>iLtl8OMU>Qs@vbVKY+Xqx~1<0!wLhC4lrMqDF!UYxNHt+f)JdaK^4qp
zL>Uhb_iOf$3g)hTAt?TC@8Es_4(`d^4?w}&ErS%?_4B!8K;g|T%pwdj9Awc8hUFe8
z;VsS-`GRrj7I=7rEWL)X6cm)8iUktxdtwpcKF1X#_d;GqoH1F#0aSiZyUySMN_dwN
z7-TL#V34Q>r7Er+Oc9q^BtKjhmHq%KbBnKnDv4zd@RSAeISa@UOV)r40{a{q>7ddI
zl)piSf=aSW4Gf~7k_)7ctCT4el)5kN;rt9r&7kuHnkpAW+)CztV7|xxKUW1;y)Y=k
zx`P`GK!VM}4I13eEX<%h$5p{44AKA+2Z@0k2AYw2!LU@|(q`!oAT~(s+FnqDaB&UD
zGGvE=%6X8(Zf)j%5PZwNuxZx<joVJ#56pMk|L5AlB?_t^8ba$^EI<k_n@WEG`5NS7
zP-$}cE0hoMCAgHj{8jP;D2T!8K&94=@M)k11Sse)&yoB9vIJBVg3JK5NI@L~kOM%W
z0xIP$Z<YK2YI=j}e(q2%(QeZQ36A<;7GcoM9o#lt;N%Z#p<Lc8{egQXm&~=TTmqo-
zmU}CgXjjbwg<CthA9U3ySbz!(uBqUXO^N#}izK%Us|-jT$VVVKP=k`&ghie^m{s^v
z0)q%+xx@ib`yUilAo<G=800~Betn+I!cdPbzk#YgP<(=pqq{E8zyNBmUuKs4a4CU7
z9#n~d>gLO0;EqP&3x<V1Kt2YEamX@-f#hE>E=U2DWXRD0G7l6QAV+{g5tJUdYMAPS
zZ_9H(xKzgZ2UN`6DCd4~Ta5d|?Oo6;Gn4xP_Y5wX?wAG%P?_8;)4&DdgV@}WEHWU=
zKneH-!-5Z>Gm=1TkQk_xdcn9q0+jub9RbQ|AV+{40M3#-U7!}&K=Y(b0|)mEE{WU1
z+z+^oS%hE6i+=@`3C*IjkAu<(IAMYk&rVQfAUze7b{H78v(+$O6{=qVI`6<lhGAdx
zpN0jX&6v%96hV`ti<<u^flefG=>DTT19Vipa}0w*dz*p*Xvkx7!vwY$3@l3X8&p8^
zdkgzp6fQvLcNV_>wrMV?^Z|{|2OqLIX#U6E5i}?T>hprGjtH<}0j+<&b5%*0fxA<R
zNoIe8Qk8N;1H<<TJPh2OOq_ESlrl_&89Ao=^fM}oe_97xA`tb0fk6Rm8fc5rw<V#|
zTlyI@>yI;lR~ni~Fn|txUikXU{#cWrkOlhv4Ru>VCuo>RFn~s{8Q>d$KCLbVb@O?i
z3UPrB1LFB3!~z<*1~vP6{y?sC0$l*h^GArsrHVo2_5Ym<L7Sa;5(KV;k_y6`J03=W
z&VlG}s8a`>A_!VH14_irpXY)1(Ov!{|D(Sl!NWv`;X(5sThK;V251;R0fi^`A5itq
zX!Jr}b}7hm^Z)jY?Jwr`g4ok_j2Y$XnRpl&SSBzqu!D{zxWK@`snGn#7Ib`x#0z;@
zUXVHyc?N~<`8He4LEDk<fS1eMdi`aUsCg6vA85tm^#&O!(5O!He4F(kx4n>;nQJ1$
z81nkt#<w81zmS&!Z6ap?oeKuqU<+QFGhg~g`vV(alX@8j@TOSvqqd+BkN|}e$fDO@
z_M}3~vFQGW>b;;HC;|5w5<s!Q|3Lt}s+#|Sz$tJ@9k=-i*7Iov_{Oc|6E@#3%E-M)
zzGL$fJkB9w4?c}O`Hl_fnmEuka|=y18CYI_S-Q3!d}1YNc@sMmctQzm(6?paGj;Yi
zD1uLV07WH4eCb=zev17K3Xna3$L$xIAG6&Fn&1Pe;oxG51fQ1tWpS;^QU;bi%k1HI
zmV)(vS-uuDlmv1V$Q;l`H49&V-2q-`-rtY_9=5(bQ~H0qf<gtzK&U2H(<lb;N&BFU
zaK(4*7(tGP$bk=?6$rj#$2h;iaxW<HzL1v$?H!hw%V578bhxOAJZKXrlYILFd(ieQ
z@TwmU4)C3p3txY$UoQy?<`?qv;B!4emO30~sBk#NP-T7s93`NcjD@ei?DXZ}fZWB@
z-%zoXLx#x{q|f6hcp2S7kiOTSRvx_?FY`S4l<ia4ge@p>XCJWn37fdhK4B{fn%oC@
z;PwB_6SLV5*m`Cku$?(QVIrf9!u578f$Q_-?`Pk!`Ka8$Z~!!xntjKX(fp3>Q&1yt
z`h<y$BK1lQTnyQFY!yvpAWQMG@7QW8H!wUfpUl9Lec#p+q|5xI{le_~wvnJoP4mMx
zA8({{Kghmso2mSOAptZ-oPEc((fp3>OAclxx9t12h35BdUuWO3?Nn}PX3V~9YnXk-
z)-n6CZD96Y+r;eqww2j;Y$x&@5SYcm$;2A_`t#P<=?0S+HS51DSZcC@0h~xK{DRyh
zZnBdBbV=R9*IyRog6bVmWMB9t3BFCrWG4gU(55d7Okr{+I~n3`{NezQB|_qK|4)#d
z$x4P6kY1Ce3~e_#xF47ww_kWulluW^*^vo11BVG00~cg~9&~r|mqn$ZK}e7Wa0&y>
zhd{(#L04gc#bubBLGc7hp^HR8Q_tMZOwJdQrGNA!nAn2VoMvL{IRL%U2&DhhvZtVw
z`a)h_6(sL`-}bfh9ov_ng&LRVOV|JCe_(tTlIcZkL8%X90XPAjWvBuzVlzJj&6{7g
zxPlg1fDGwxC<YyY>;XzVpb`_L2jp{;RSXI@y|^E|{<8NcI4glxvr936FU14PFJq7Z
z4|amC?f9~Hqsi*&=O#0X*MC_MYqA`&0}6Dh4#>D0&mreCz5cS-5wzXP`HszJkkyyx
zOaH#!%dyn_to=ez8#wun&1X&>E*X#>{ssXl@C59aJvTvmOf?yp-dgMjpVADH2MvjW
zobme09?*^VEhcLql|Vh{5<2ku;WM@$IT?aHr)n}VnD8=ia4N8Hn(#3wnD8^Om<TYi
zfz}pZ)Rd4183r+E-%C*7?sHHApHze-z7w?Tj(Z}LeE$OzumeowLCb%cWWXm$GB7u_
zDkx}xGS}sp`}H4SOCyfSI5>cFDJb?KH-apD{bjeKi4^2|0MPIhhX7L$C{w)tzxpF+
znGVQO4q2uku!BA=oD0g;;39^FDf&{BG&tFU<-Y6!E%yNrlV6I0Bz2Iu$xb^4j@Msy
zRf5tiD2OjbLDD)zlA+-BmtBr9ISwAkf)%LTgx6oT{+-@1l~J^QCqu{UFI$g-6oLvf
zkU=0tAlI4fWN0vvVqgR9lr@oJWPAN(XCp`*NDU}Xz-puzVda#ki4b@xDEK~sJ|_h)
z?mo}~xr!Vhb-_1nKY|X^2ATc(%Z`s6{7gYF<Yo5OgA8kPu?5%KeQpXHxO+jG6jp!~
zf;7JVvbz$TRzXz-C?m0h_xgc?*ApZU(hqVBNd4<CJ3v9M0?HR0H5#A>kHiak-lMSm
z0ao*A|4-0$q%Y*9K~;omG{_KehB*PtFl*O><C29by1yZp6*Q+Y{lYXxNx@G$H=0N=
z6qv{`u<`5>V&Gt({%abeh1T+o2@4n$c=ibKT;3w_<ML+74+&csG%oL#dXcc1LF@Kj
z?jH&J8FWBKPLG(**r@$w(_NlDLLx8Z1^q#Go1d~h3br5A_W82f6qW(|8?t(*3(R1Y
zW&X5p=5&J@j4~`2eoB9s9x#JZifL)!^qd)tq57Y86@t>u{02qPRhH4p4Ga$1cWfnL
zB@rkFL7oQ1+UqatW2b+Z!6;*4!pV>Vx?7G@hDD~m!4WdO51Rh^x`-1L)ZAU*C;%^R
z0J#u6{q=R>#pw<+8Aa>AE?fw*()*4rV{@w}cwuqNf&}pLKTsnuz={<#@4xW%mvyF~
zcJB*$_N$-<lyU>;USeBG<p!>W+-;y;<8rCl$7}=P7JS<I5ajF^@^avF!C%O;r-II;
z1daYHvn*gRzsCq}=}qsL!^kWBY4b^CX9WgO<b!VP1vf@O;rD6t%;_8EFshn=T?XHb
z1PXxHU$%nJeFbR%EieFWuLHZ*o|OTfEPt(gI-O@OqlQHBNxO|EoGN+6C+rTIpRiw8
zeBACLXkY1ci@A&n^{+o~1}{hfnFU%Q(UXt}PU07`q(6X)FYrA@pLc?bZ;%@9R;Ky4
zCrf_dG-jG}`TzY7)Bl665QQ9G2^#SMZQ;25UrPR%%z+8F|8xJC|3IOG<1*7^6G?_m
zpwNN1f5k*liN(Rf1m3s1@b%Xv;A7N57C=12y@9_Oyen$q>;HRmL2Y!9A(x5~hm#%?
zJ|F;!y8RFAeN7}GyPY78-2}QG7+k`<ke7=Ec?vYb|9w6K11R{-?=eC)u9&bG6dz`@
zX9O(*m>w{XQKkNRgN!_1gMjGm`P?5sC(9<sGbAO)FeEf>R&a2RVX&Crps)kvyyRf;
zA%{-M!3<W(!3;Jp7#Kmv-P%oVn85dfK|~9FF+&Z;A$1B23=Cfw7?{5>FtBPcFtEBX
zFtC4t9=lcV12R0ohNA#9ISk772{jBB2{jB>{r?mM5^5N1K=r4I41*i!2;2ndjt>)g
zh6SLba6!|x3H1yrCh`m`66zV$K$AuZ^$bQP@(e5qH4JtM^$Z39_ACVnH4GXFH4It_
zH4HilH4J+E9|Z1Po-FZ$r+9kQd`2Y+o?;;po_ZlJ&<%M!HA0|+?RY?k=u9@aB0c@^
zd`1g(4-;VqkLJlL6(;NqMj&UJ$TM*8+!12nxi7@Tb4Q5f1p^BM&z<RV3mC65%1-~X
zfYF$BFG$^VorR1O)xU0l->kjA!6p|}B7roU$S_!d5;5rh+5j7tg6U5dGMX~~Sll>W
zW)Y)2<I(9hix_t^&YJ#X5u?5%=s+_gehmQ`ek}oc*a^h_&l<V-4M5jr33Bio3CMs#
z6VyQsFy;Us0yZfDd=&DcwiJa6(^D2RDq4S9r3%U~`x_KidEd7yH2=@Qar-~_2cG>x
z4m=BlToMu(ED{nJtX{~A-c3kgurZ%wSAThq^oRbI`Qg*|EM}B8lsEqmI%Y`zDCk-g
z(3S^KV-nQc;hO`#l9wSlhQT5^25f|GatwpbbdDvA=B%LY7)H|_mN2en4FKuf{$>fI
zEhF>S<$=?6mNCjPu@p@AS;lCu%$rcpU;|QMBG15JBFw<TvtNjTXR{C!&we2m&|U<d
z{nJ-1WBeceW!G8m8B7r%WiUsB9Q;C_zc-<t!Hz!waw;r;5cpa=4#;`U44|zDOrRwX
z{C|X4`2Ps8!CVV+DfAcuwrMLEMeAc2OhBRR9L%5vYO^`VGiZGNFD$|DAt3UpSV#ag
z*x?+{pu_JaAo=;fAO~p0zH=~xo^u3)8A#4Vo<Sn}zFj5g3O`U{DL!D=2r3MU57<ov
z%{OHquv=(;-EJeu580RP3PCrvgAVZo7ZzU^71n3pw_CZt!5VxK87Pr}60-My&<P~c
zr5W`M8n^#&J^22gMIMw}U&!;ef^se>(}PZzc;RpXbR`Nn^Mm!;umltzVdUU%5SRtB
z0JJ&m^{)+;{Ii4_f)Cj}1nCPtV$TaIETHNY13<|HqzR<q^{)+z{0*pzx7(~_RN>g(
zu#u62QGoBOP=tx71Owj}A&=W%xW8<lvx!lJu^xP$0)tQk$O2Gy0P__DX7OtX#D9<H
zX}SHM{{z3DfGEF*fbgYl(tmGl;eTLu&HjJenT86GdeGzv1B1vO^EnI#{L>WX-rmdq
zfO`*@?CS;KD_3L~7#No@Ffh(wU|^iUz`)qSz`$6+z`&RRIs^0g)C0a;-1E8afY!Vo
zFFhb|?LJ2fXx;(L4+Zm=!uh6P{xKN;(pLE&Z3_|vuK(wF4jNzu>6xCfg;9}l*7U9|
zjN3qCoROen^!9)5S)c*du9AdV{762%KA$5QH0k+5UN#h@nfpH%=w4<S(4{1xjYTiy
z<&T2yb$%f)EBbl9fD=d_v~&ct5d4L_%-hfN1r*z#DR^*5F~v@PU;w&(QL6umLI;Nw
zQ|Jo@hI)`hm{}<U+pVqq5BR4t$eNWhut3>j*RFALaBpJ@15K2fl`=3v#YI7*e_U6Y
zLP4`^{0ahM*RF9(aBX7>^ZLqQV78UV0i=#^n@|JyXD(sT!Bj8g<$OUqn?TX#^`F5&
zxrc$ld@_RpSN(LeZH$`*Ed*jN&yoMYZz2#6nwR08KmFG>#$-VQsIU%9czfP<Mj^)S
z6+0MzbWGpi$i&7aqG133|A!AuRSDA<I5LTGiBCZ0i*r6e<-UM(6`YvFIe);pV9n|b
zXnYMgKf#GfjO&pBD*wp=RQ@9eRQ>}r`DYTS^3TxBdxmD;Glc8G_CM!<>7VA$B*vAC
zkOn*71fl(aGm|)H0ZjGu2hL1#OjQZfT$sc;8{nc~O*RQ|z5_@a;UqA30bI5LB-;V!
zf;Bq^!1)J2(i>2@h|mVB_CvT2%=Z_7D~IqA4hHi>JmB&NT$#i<;l77Nbppb2u<`^n
z$0Z_S11z7l0&X0bpM&r!m|wgDRle~CD!&uWd2=gJ<(Hy)ZyB2VmZ1g5iVRf!E7AC?
z(9B<jNKIh(u10hJYLuie#<dzPbw5P&-wQPNys|)b&pSligHxYy1giW$g!{nqDG2>w
zej*|~!2G?4lm_NkBjN|l7eVviB}90G<xe4!JD7hO5#L~b3c~+j{uzXS!Tcpi;pNFB
z&WZ3oSo%7ecg`T31Cd80ZZJO<k&(dsWQ6fx{&jSDMBxIKKaH*)&Aa7j-kpu+-dMEY
zOGX5*;zq{!=>{7a14t$WrwjNqvDI&ZhQ($my#bPxnD2i9Cjn+YNK#<F{{hN}CiOEg
zbuJL``;Z*Wd>`Ug=KDTSafsiU??aLdGcQb?4OqUO`93u5Y=8s;GcQabqzqu@g%lmk
zTu^x~XyBZO<RNBtD6I@}5YxF6V1t=upk=_8Enq&=76_mD-UTq9Ssk3`>pw7aK_$2#
znShxWQqM433PBWF3PNagXe!wPwctL)LgstWkh=E-qV68p;1A6ApbowdNe#^RSs?QF
zp&q&q@?iak56pa!=w!YJv4Hs=)B;Hvhz5xxP#Pl7bQTf?%n}d_na)BTEO7^{j_E8U
zM42TZ4rDqD4N*R5(DOl~h|k6TfBpXtADHjI0c&Iyfuwt835Wxj&Om~inGb4!1k`8h
zP;o&>He?nof#~OjRC>%j5Q~|4p+4t^hOjy$gqb!#&EK%Wz8+kqZ<ql#fN29XE=8dh
zh(awCg#;zjdQgyk_`qx_3{k%YQZ6vxhgy994@7(eG_gK_I>1r{EY2(h32CM+5C<}C
zxlj+5VA=r5!OZF~hd_gv3#wrQBm|f?KrCX~05O<pJ;b3*>miAX=^VsCOy?mvoS6&4
zXXb*MyB^|mW_3t`#mrR?wO9%oL|o7yRfj|c(|SmpGfP2&j#&~K*IY1p7!8$=gIL6@
zeg)#ObCB%IbPkdxn9f3deiq^oruwrG4NPAk4q<u%_3?Q~dBDsCb*Vbkf$ET`U{;4D
zHfAoULF*wtWrPMf<8w$NV>$~7DaPjzhciBhn9nT919o6N(^;58XzG-NXka?q16IJa
z9+D=Q&Oj_?It?*^=_Hh14~;4XXj+knL<zGT#KBDKp;5OU5_Qb#un-12xc&pPIyCNj
z!2%zcdLas!dZ8iH2lZhu)WBXyh%og+qK2s#rXT9SUWfyjdZ9tx2T8O{eUN<5)CUO(
zran-~SpVSzQy(-0`XD}G>Vx{M50Z$O`XEuk)CY~CKBz<cU=D;jtPc_bOnp#?^g(g~
zQy<hJ{ZI$=L(@XP10?@5^+PT0hg#eZwYVQ@aX-|;erU+_LlPTPKQ!_6Lqnn;8WR1`
z5a@?mJOLU46ChE*)CUd02^!G+KLHv?6QHSe0@P<Gpg}(onkFVdeKry5lL=6ZCO~~Y
z5$dyvprHNmfoUQ%WKTdHHWBL4iO@7Pu>qR@CqjKT5gL>ep)Q;Rb@@c7Lnc8Do&<I9
zM5qHMK@FS)4XH^`k4%DEI0<U*38+J-z|5(K84PvdB&ZK3LE~;R)aR3-4w(!M!pTsd
zPKG*UG9>pfO@=yTGSmT6powh?G{mOB%!8U=KN)J_WT-<XLw!CO>f*`JsF)1(*<@&%
zm;$wU3XBg`KLwf=roem(4WX$}i>E>zG8Lk~o@px7g;SwHH5KZEsZfJYKpi+0n%Jg7
zLuxA2!Be4$aVj(lr$QYt73zSgF#S*;pMW}O8aPDjKQK*$xP)mMH1$t|T09Nv<7rTz
zO@mrE4QlW-sKL{q22X<;JRKTE)1gr^9qO^^&|EbgYVLGU$b$0!bf^W>p%zSsT5tkt
z@N}p}C!pDBI@F?*&>)=-RW}3dqYq3oplRbIj1Nt0GoTKd0WC*ntbpeK8BmL7LN&~U
zM#)U5%V$DEW+pUbW<nh@6Xb&rADCuBqh==5VY8rdJPWFC7F6FXsQOvZG&bu1H2=?n
z#_24mPi8|MG8<~ZY^VVXU>czzG#l!Z*)W5l`F%FjL9?MAn+**?Si^b_RR8<~(EL9K
z8kF;)4wwh^$$Y5BInYEl52|hs)Z#f%3+6!8&xQJYF4O_@pdmRAn#SfqLv#)_1n1U6
z<7O^Y0@l-<2leqhXvoZiIRF|0^P%eJLle~kXxuJ<=KBTET(kh{paswnS^#zMLa2l4
z7eX~GgeJm8P=gjhEnEl<(nT<hQ2B+>AY25Eszp$TE`p~1MNs+0PzNlACd$Q7^A<zw
zt!G*c4a&t(2P}sAa0xW%mOwQufu@Be(4bumjhZD;hpmO?`?WAW)Im#NG}J*$pi#UO
z?6CR|Ot8-UQfQDYg$C_XsD(?RLA(?iB}<|CcPTVTmqH!B7HYv-sKZWzE%?B65*i{W
zp&mL34T+PWs0Zc$lTeFKLVbD?8pJ1|4mk-4DyF4SA1;F$xD4u$<xqz$hWczVG%+rQ
zCbAV!^{`QhCD25?gaexYS3rHZ0&36-sK%Ahs96cMcqLSP71Ti3u)`XtgV#V4-71jJ
zK73$W1C7cx(4u(_RR3D2{<Rj+{J#VmRBNFQSOQfr4dMW1UP#C=^Fj<}=7Z8gkdR^K
zgCs&`AxH=?@YjIbj?6+P5Ze4Lgyw=o5wkEP3Ydi&AVJS81aTSj14f8KK}h41SqPE~
zn1vy62W#Cj^A$`_h-DH@X697^Yhd7odbI!&w#>ZHzMCb)C(J^SIAP|41QD|cB+)SN
zLtV)02sVdV9g=#P)z3iqLIK-v#4>GQQpn<bmcBcEU8_yr=c1+lU#$Z9g6e0pX7tE6
z-&`I2;H>2Ijs&I#mN0imhUq4WOe);&L5=|)p3cD<hMLo*6PaYEM<g<7Z0|^9s$h(A
z4|b0C2ykR@@$~ZtGeCp23=9x{sAEtFR1hp5>>TU~<vRz2f?2+<zWzaxU?x~6Ldo>3
zWG0*G+mf01>wO&kU@AiWy#4&c{S-iUf;71L1o=lM!(<s4z<didz7ZPV0Ks<*4hiy)
zM|TAS14JBRi!jI{AID(Ncz3r5sMhKClbOV(UrlBb;B*Xi@dW#QdtD0CCMG+VFc*Di
z7X}8G)UwRvR0akJUm-fNBvCa*S2e{-LA6-HF~l*zQ&%-bLA5v*WIO`{14Mp$Y#Ni+
zbc1xJ3A_Rf3_>6|0VM?mhUt6LnVi`e7#RNlyRiLVI@4+<k&?us5(WQ)lFa-(g&==l
zh2Z4GyzNV~n1mVYLo!koLW)X@OHxx50&)^d((;RP6@2qkN^?>bG(rM=H5D?86%rLP
z5{pvG6N^$6QowFi$jnnH$;d2L$W2Vn$jnRC<MJ#~NKVXC$Vkm8P$)|+%1o<ND9K1w
z$jmEAO)ttUsZ_{MQz))1E=kQ*D9%qS0hy)8#l=w15E9@EvLY|PM4>#tC_6JRT_HKY
zs3<kLB&Sl3i-Ca)<ih0AqN3Ei5{2TD#FA8yQ6RG+I<2@sK4)N1P;kvlOv*_G-DCk0
zQBZKnEJhMgNX$!7NK7utEK3FJ0P|DoQ^7)sC8;T3Q3jAf{^fb8Ma3DJ1qvC7#R^HO
zsd)+|iP@=n5ETjvsPZ6}BdbwRa8xKQPAvk52S}enKHR+gG;pYd1o(0>C@6#^X4ixK
zi%lM3bqdrQ5Zf6T7`XiMOH!>ALh==I6SGr6c7Z}9F(*eMtu!wg6v>G>nI)AvFsl@D
zON&bsl2R2?Apr#TIoR8&di5Yvxg5(9Gjl*;rH~I!B*hAeMX9iWWnfT9(Srph%uJ9r
z28A*`1s8Y#BBT@w^b`V$Qp-RwmYG*vl9-c|2yzzKnR$@l02!cAtXHq#n3I!Vu7FP&
z1A{`Mo`NGN>Oip%je4*Fsd~^@M_3My`(!-@=bY5UB8Xj}s01lz;POmU$jetq&PdEl
zPX(pAl={@-%%ap3h5RCgOi<i_l5}cbsX}>Tu|iR5Vsb`mib7JQLT+X;C?<6j3W`#T
zixpghofS&*xr$Pg^7Bi;R>SiF$a)5FqE5+AEmi;}j*P^zRE0#Szd=cwfdQO?6pBle
z>yuN9i_=PTaw-*)K@Lt$(c_BDFI6bd%*j#6OHEBtD9MM$n?5+okU~HqF+DLe50r}-
z82k$qK;?yFo<eF-QGSs^elj@Aq*y5!RH#;PF&M%E1f2937>x83oI#;bp9;+r3IWbR
z3Q381*~Q?HV&DqNPfyRmlm&$bI1oSyH?K4|DYZx;JGGJvq6?IJK<-d2hJ*tHgMtP$
z)oDURxLkvstrUt<OG=CK6iV{#K_Oa}nO|D0kP8m?%#w`!(h_JCf!yM#pkM`YBgpH;
zsX3|OBo4K2`?hQ*EoL?+Lo)*(hUxe6n6##A<TD*$H8(V6VA%dNpDBlt(PDZ~A(I`W
z#q^1VOnHnZ+lrVJn6%x(K^2IeYKop}3YUU{V@^qGQ69(!aFiA#mSk8dC_of#cP?RS
zU}ka)pMJQU$$DD_(-KAnV?851Lj@xPBVz+|BMSwMpwtuvkHiuM=c4@LVg*Cv>4pUy
zvN{I3#(HVV#+DGTGZd#LCS~Rq>t+-bB<hwKn(CUH>!uqfn;M!WnOJP+tzw$YsPEz$
z7N1!hpO;z!Dh=aPz{M@7nuLfKrxs-<<{*Tp`}c8)Z=YAqw3C?+)x7Dc^-TZjBRJR?
zI2afhq!<{45*QeS=5R2A`JftO0Rw}G3<oQiFT%heqQJl);s8<%aju951A|Bc5<i21
zL1YOMe+2`B$P*;~3kC*J0R&%Ef`Or4Gz3W?f`LKw1_u+^LIDN_(FY6+VjKv0F#!e!
zF&`v;00V<q2NHh*1A`cng`jgI#gQx&mtbHJcR{EZ_h6`J5JxgVd;$Z5_yi;cGZ+}e
zcOdZ(Ffd3MAVNsOf`LI|0up})1B1j14hFCX7#J8NJ}@vyx*$9x>A}Dt?ZCkUmKS1R
zkoKr&V30N7;D!mvS}-uk-a%L>`+$K#P6NT0GhkqlyTZW^RxifDAa{d-LB0SQg(3_L
z@)ZmW@@Ehh%3ok$P_RJgS8!lpP&mQC0@g3Yz@Sinfq_AB1;WLO8yFarR1g}JG#D6^
zzi{w^HHa`UDF0w!P(gB#iU9+IiU~r!iUk9M3X%s@9xyPdAVrDF3kC*NuwjriRIkdx
zz@RFDFhEs-fk721O{hjNFsL3tl0U(~p!NZgDAj&2FsS`O$g49jFsLJWKwX1@L0tz)
z-hhEYV+lOO>KQavFfeFVa4>@%CC0#@*}%Y{c>x-PA`A?gHy9YSjzEJ<j)6hz1OtN>
zl7-p~3=G;+5Ef|9U|`T;L8J+g-8vBnd7T6X2AvI1^9AY|7<6_pFc|V66c`FHFc{u}
zyO6=~0Rw~46oi3BGZ+|*{vi0q3=9m$5lH+51_l!a4i1=yOf(o6Ouuk&f%$d}45mLA
z7|e4xIKlk-3<d`C0tN>2FVGN>Vqh@;!N6cqgWy{<FfdraLPUUp!Quu3gC$ZTw7kK<
zV66gG@5aDjt--)x69Ek|83qQM1O^6M8H5LI6&M(7-$0_U9(3)i?FR-1JFs&giNcP9
zfx%7#;UhZ(1_rwXBz^`1gWU`y{sIOD`v$0mLJSP{9SjWiNFn6Fz`)>O01I*k1_uiU
z21g&T1L_$-4sZ-$U~rs+P~f<Lfx&48SOHkxX#oR+^9qCo&KnpQT$UjCE-M%qTvs5n
zrRxR;2Db)86uNaVFu1Ql@ZC2sFt|Sec>uJqNPvOC{RIPq#~WyzNiZ;Yd|+Vke1fpR
z^92KguLuV}IFRHR7<?rd82l6v4)oJtVDRTasP`9OVDQgDc*wtifgxZ5RJ|AjL%<9M
zhCoo1)q|o%h=CzcgMlGP1fd{Ef`K9E1~g8E7#M;cFfarm1!*t?14D2RNHZkLf+sLA
z1n&U(h=GAYfPo?S00Tn^Qe6?^!N3rz0SzGu28K`r28Pf%91I};gG~rsz`ziC17Seu
z0|tgLq#z9IU|<LbRW?vN!!sBdBGy1tu>u1_#0Cb22qgUx4;UCCk)kwm0Ruyn0#q{t
z14EPs14DEOM?EB4NH8!&M=&tN+<-=b7z0Dh0|tgzq<kF9!N3r=1u8GWz!0~Cfgyek
zG|0sm7~(fDFeG>&EJz4oU`S{|cqpNRfg#Zb!B2ExU`X6hkBFnh9SjUf83=w-0Ruxa
zQX)%U!N8CVivl4Ah7<+{hLkzbC=+2|NLj$Zkg9-)vQ!NQhBTxgPcvX($P$2tm<j_!
zmIMPsRy~phSt}SAvK<fxWP30$WP?*FBu=wmFfinRiZgJ8F)-v9FfinVAbgY)!N8F7
z1gc+xfg$Gw14Aw>5sEM{<Q6b6<o-c8IFEsWp+0X4)W<>$40$sc81nu=4G>~r$Y)?+
z$X^4M7hqt>-@w37Pyr2cAqIwm1_p-05~u^j7#IpG7#NCV5bBE*7#NDTKz;1Qz)-w{
zfuSS>YQ7i)LrDZfJww?I4gqksQet2zd%(a@ApnhIHwK0Z2?mCW5~v0t28N0X28JpH
zXg+pfV5rhyV5m9(b$|c^L)8fehH3?b1FAI`7^-^^4z8ZSz)%x_;MYXdGceR3WwV+G
z3=Fjr2m@*r7#M2zKrIwuV5mL7z)<@HVPWkH28KGM7EYZ614A8BBCHEwV5rMMsIMzv
zV5nz6IG`Ss|LZ*v7S;zaFf_;@ENoC<U}!jjh_i+Z3=EAL2=$Ey3=EAGNc;u{hQ=$1
z5No`_z|fq5Ft53QfuS>l10Le_ogje%M7HUyU|{H8fhg&^H!v`CBl)=d1p`BW2edYm
zU|{H<z`!tJ3&Mg4I~W)yg+Sw6j)7rP1Ovn5256LuF)&Q-U|^WS19xye!xRAqhABv?
zcuE8V!?YZPhG_*14AUbJCD-%>28J0a&=3)0V3?7?z%bJS%9mkanCZa4FzW?E|Ev!T
z40B5m{J9kj40GYF?0N=<xeFK==1+kJSrG%n{22@k3q+uN5e9|@5)2HBzi{w@6R8UW
z!{Q$d3`<-Pak|8Vfnli%A_SIdFfc5AfskMNfq`L}4}!lefPrDz1E~4+LJSPcUNA7M
zNI|%8MFs=I$^=9rS((AWu&M+eWDKh+7#LO|mG!F*Ffgpvff^{pz_8kYfnjwI!ot-P
z7#LQ6LE`^lU|3TCF|Qs}S*)pGVA#Nd@WBQS28JyM5Q${V2?mC(GEf7A7#OxHFfeRe
z1GNyu-oU`HeFc;+#=x+B0|Ud32#5s?VhjvB5*QeEA+?HkU0`6?T>|!CJ$PVjcLf8(
z!8g!$xgG<<!4C`!hc%#aD#E~U*nolI@ENcM1_l!bhQk*a7>?v1_(uvD7>+tX)tfLd
z9Q9yeI3|JMA5&mpI0kL;Fi0>k9Q(k)a0Z-+LG@n(1H+jK3=HQhAU<YPU|=}kz`$@}
z0yGs%Ffd%0!N714R)32yFkA%jk!rh(4;UCOA=Mq13K$qJ%|PU;OA8nnF2RasAqIv^
zFBllEfI=9Q{~1&m7_OXPV7T!E(h&hU;3fkD!z~wx4;ZBw7;bqmFx>hB^|25G!)*oz
zh6jJ3i86<Q;UNP9!@~`TD15ksf#J~?h<;ED>(LJeh9@mh4=FG(Jn3Lyc=3RPuO6JL
zjTjhSykKB>Wq>f?l?4OCYoz-Bbq52(yE%{$Vpzn$@NNME!}|va_3vLWF#Ick%Ih&O
z{HtJK_=i+9|2x6J$W#NBS7KmfYG7dGpTkiPDT&k=82J}4F!Cc(DI@<621bDnXrdEf
zU=*0Zz$mDK;0tOnFbX1a0i)mn21X%78;?<F0|TQl2SUBD00X0N05nm8*bxkj!X@=c
z3Mv>FMfSk6A*09v21ZdN3q>^;7^QunC8HVxqjUfRqg)8oM+yv#auE!S@^=sx$Uk6U
zRQv$V6;ce0ia!__m0)d3F$PAZ7YvNC^)^rgd>9yG9T*s6D-aHfZD3$bgw=LZ42+2y
z42(&L`kOJCfq^j@(M)GdHeg^(Ms!3NlM@&iQ%vA#fHB2_fia~6>L4Ko#*_&RjP>O=
zpk=uf17rCE2F7X|Xf~8#V61jvV4VE~>Oczy#=Qv)jHm8E`9=(kryejco`yL<f`Re0
z0R!Xd280JrcQ7!Xfi>C07#Pp&U|>A62c9b!&m3T=XS|*Rb)ggk<Mjdt#_J^r1=lMW
z7_V0#@f#QzudhK^aD4*<<8?$fWPEUdf$<Tdcg*<6fPwK5qWjJG$bo_J31U2f@yUUD
z2F7Os2n(J`Ffcwtv{D(LX)rK8Lo~S<pBXSPKD&XW{s9Bya~1^uIR^vdb3|W~Dfa;b
zQ|<$V{OlJDjB{Y!aggxz`xBVd>#uk~nskf|435GT5H_e(V6gcQ0{^aRK*ZQR7@UO5
z1exkwTbP=eA!1;4DIjJ4|J{L_!?p#BIvEBAh90oG|NIvqdYOE{G^h|{U|;|#SOZZ2
zo~&SCU|<5d5v&F@ngY7K9xVUw5$Ga&1_lO37qBGboEHp?OLU-VpNoNUi2(!Sss{-E
z^#=@$w=|%xV_;ysWx&9A#{|Z&XJB0Qf`M@jl7c%942<`;z!ZQiu?MdSEQU@xmO$nJ
znV>UkOhst?GRPDiQyEl!8Fc!!06KkJ0Oc2g^x1v*z*GpCOk^sAOw}<JLgx0E3ZWVb
zp#~O04J?EjP{hDEo#1j?@#zf<Ia#*vp29SnQ7RT{LIBi64UiK)d|-T$Fuh<J(~Rjg
zdziSVZ=S-WIz4AM6ZdrI=`dFDbS72i{}&pj&z{cYT)!4FcgVCBGP}vN7BX4Mv<~Wl
zb<o+<bx@D2gUoI+tup|H=KmjHisAo-01%hq|Ahi54ccYL!0-diV_^7yp#jYLf1wdV
z|Nj7{8KzsjWRw6cFLnm67*_fUb<URtO9KM~eem!uL?whwSTNmT29r2QhlCvqM2w*b
zjRtXfKm;i1L1~5$j2aNPfp;P?FeFYtyMjqlTmUA|2xg#23ZY3dFgQ#Pn91Y<vKPXV
z0eKLTq#i@2f0>>@=c}J+fFjgJ=7RtOG$<cKr`#VyWA5<+n2H3bibs$MTBgU4nPaBM
z5-=681Pa?4@(8+6;n4(`iU6n?u;uxWpb_<m1FS;&gMb1|1!RJo=^-@bJe+R$fzeu)
zf#HLI160Wa$P6;mL&yv>(}U?7A2Vu$LS0DagTMlqDrlN`0G)z=Pyn_{=7T^3RK<Ph
zGKL3`IdrD`FJLMfVJe{M>pmp;GTl#rsQAMG3$}aEl?eBsDf8Y9h>8yia1~Iq?m?Ft
z+zWuI5P-_uh0guog(k1NCtxaIfpQ0${_jFF>RktjivPc%i%yyDKxWsO?m#2@&JLK0
z4^UffLo@RoXhh#J0I48z2|W>u?m78b7RWF%FmN(}67S>B(>gf8IYZkGRh$8usu}nN
zy|ZHky<}g2(>eo#6_kck2@60>mIie5pyG`Xah&G4fpjBdMumnh28JFC_o0g8G!MDp
z1{=$$z|h6OPz*M&F&*JwRB@c<xq=NrA{Z5<xEUDwz~;T(i)<dUI8O5*)fSR@ObsA?
z6EMs}6~}3wCz4TMCQ}0_{93S>hb)fMJV?C^HVHz|z&tJnhGww)kkcPiLj#gHN$%rf
zV5r7n9!wmkdCm}DB1nikN^qD56US+uFTx}U3le^q=^0fVr+GNyw+pP{mJlNSLCk}R
zgQY<ZK+nH^AVFjd(boj_?~8@#=E1~qn&*ye7KqK%(9q4m0I9QoKLwR$PHw1TAXQ+D
z?lvrW4U}eE!ESr226vkUq%44m<8)gP*cK#WyT%NrGDe}#&}!iew0QpF0dl6z^fxn^
zxP(4KYlP3xlKJxiu%yht%dm3)6SPM73|Z~P^w|QeV)~p}Ok6^rpq0TV=rX@g8^Dq>
z|1KYZ7Wp5cmBA-yt^Wy9>reNY&BP`20a~4ZgjVMtq18FO(ZI|EaWpd%#298KNS!kM
z4@mn*Xf^T?+FtkwZZFWTIw7LQ0W0y`K4A%yE~_vzC)Cwk5YIDnK|Rm2iiuO0nG@oC
zW=@FnnK{AEw~+z08Np2^W)4XBFmpn}hnW)+KGXMr^>aX)(##x?rVcX)w5jv|0<_*|
zW{0ecW9EP~b(lFgrW>qgaus4`hqQ2**&!_)W_DN$=l=z0Q;V4m(!yb8hqQ2**^pW|
zpjIrzg=~-(4l^61g~QASZQ=aC08Ky4tdJHCGaICZ!_4|(`h+!1_Rx(c%&d^+4KpjG
zdBe;KZQg(y#1Jc3Ak7<Q7Dzf~W`Q(srq`?m1tJS1oiVdO5;8Ljv}yAT);wZnhBR%M
znIQ?8nHk!&`2ttL1ZmnZGec4{Gc&YlLpT}USqE|hBP44uGeV<_aRnq7{Qm)MUNJL3
z?N*1nk`bDT{>%pJhh#oxCTN0SqIR>$bNhxZOtU#z82(?FFx`D0Q@K|WB;uJ$p>#1M
z7@0~S@yS#QNn1>1Fg_%Dm`Wi*#8d{8PXO(ZPJ$Z;Ny<zGP~|01Wd%@c%3#(&jVXfo
zoT&h+uk--}Lqi(_LjeP*{|hS1z-fS~_`&ps{Y+v~#ZY-o2~_zKhUpvjGl@wSgNE_j
z7#Io#85kHDL297-r{CYtBra77n&1&(U|?_qEnPrJmnuvbIKU((RSMHC43a~#zG1op
zNWORh1A{;|0|SFN1H*r?6CuWzESO#Zk}p{Ray~>aGqU^xP=b&E_u!Zc9Ht*Qz!X-$
z4w9*vN)9k^Gl6@95X06%!>mYwfrka$dxVNZ3K6Cv2L@ga&{QupEZ0F&4O3A9gOC8S
zIT0WafU&v)vUmbmZ2HuLOoEc@AYDF?h-L$_p`Zf6aQlaYObN`>AAo|stbu_+fQf;@
zc_PGr&@zUpKmp`8)#<TEnHm*~pz&A?u>+RFn2NzhGcd4BXYAk<19g+6w;LQ|`p4*0
z4ze1AA^S6#wt`jW|Nr+D;_I!Delr6DE0k{mQp~`>zy{?jOfNXW<R^6E1XNrON;6D9
za00v;ALP9F?e-^`Y?)2mot>=|G~E3{H5CjAtz6PG(lgXG)MS`GVKIjk7j*Li<D3@|
zK6K9k;}Qc1AG+z8aTQd46(q;Q`PU&So$(e_J-YlYNQumN#{ps<On!|Hgug}y>|aJ0
z{|+RTFy21^m51uzn=t+9Laqn0$@#gtsd*&~dg*zkdP$|3IVpOHB_&0fNu?#J#h@VZ
zV&tB_WHFZ#`~3sp5SxB)8k3leAZV}&%x7R=huHW4!ex9o{r_Svm3lEG70h52OwcsM
zR0tWvVBmtsK13^c>>J8tkcR13U|@jiuY#y&s)ky{JOQQ{N+XSq)iZ#SGN_vcVn7Y3
zg$$N3)k9sv4;?mxY6oR@IFmsY<^a&(2gC!t9bjpueyBz2P>+B`K?GEsfq_Aufk7A3
zfUOV(Oxrr9J1pf=mNjKyVBiL6MA!kE%mMMXEtuW_Qew-%zyKRsWP&(jD<o|*ZQC*Z
z07wa_HOz`;3OIW(Fl{?9Z5fxctZV-N|KHG5Kr#%|whPl8mT@V^f|f*pgNuQI!3k<l
z4p<A*wl`oJvSb>>gsB6K-+=fa8jJqpQ2i&~Og{j!A`UY^jzdC_=_JS)5Pkw8kT4{`
zAOcvdIFSODVmkQ*Y=tZ~B_&WLUvMjFfhak}f?LTHs1gy}N|r#CsNhzz1**gZtOT^$
z2;7VZi9*vTw18qd1?{tYL((ir1q3692x!RwXyrOc2BM!?WCw`Dz$^wyBn+V0D+W%m
z7=(c77hqtJV*nMau-JqeAbJC=j#)fny2DB?W!Y&+u?ABD$$-q_2@oY)u_%EIjWCO6
zOh2%aOWE}b10r`pO_6{UD9lpe%8P;FxFgtN1OZ9I5I$%Ej(uXFC^NH^!E}dJT*|Wd
zkt~Ip08z@oEH!1?8ZIR^29O(|nodl201JUU%RDhql$%*51giYs^umRl!jKFE0FeX(
A?EnA(

diff --git a/roms/seabios-hppa b/roms/seabios-hppa
index 3391c58096..d0d359929a 160000
--- a/roms/seabios-hppa
+++ b/roms/seabios-hppa
@@ -1 +1 @@
-Subproject commit 3391c580960febcb9fa8f686f9666adaa462c349
+Subproject commit d0d359929a009549f7cecac9d2a29c8bdbc07a98

From 4a11070978ac3a17e6325fc1cce66c43179ae6ad Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Tue, 7 Oct 2025 19:22:32 -0500
Subject: [PATCH 1434/2396] linux-user/hexagon: Fix sigcontext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to correspond with the kernel, we've now (1) moved the
preds[] to the right offset and combined the representation as a single
ulong "p3_0", (2), added the cs{0,1} registers, (3) added a pad for 48
words, (4) added the user regs structure to an 8-byte aligned
target_sigcontext structure.

Co-authored-by: Alex Rønne Petersen <alex@alexrp.com>
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 linux-user/hexagon/signal.c | 209 ++++++++++++++++++++----------------
 1 file changed, 117 insertions(+), 92 deletions(-)

diff --git a/linux-user/hexagon/signal.c b/linux-user/hexagon/signal.c
index 492b51f155..2847952216 100644
--- a/linux-user/hexagon/signal.c
+++ b/linux-user/hexagon/signal.c
@@ -23,7 +23,7 @@
 #include "signal-common.h"
 #include "linux-user/trace.h"
 
-struct target_sigcontext {
+struct target_user_regs_struct {
     target_ulong r0,  r1,  r2,  r3;
     target_ulong r4,  r5,  r6,  r7;
     target_ulong r8,  r9, r10, r11;
@@ -39,14 +39,23 @@ struct target_sigcontext {
     target_ulong m0;
     target_ulong m1;
     target_ulong usr;
+    target_ulong p3_0;
     target_ulong gp;
     target_ulong ugp;
     target_ulong pc;
     target_ulong cause;
     target_ulong badva;
-    target_ulong pred[NUM_PREGS];
+    target_ulong cs0;
+    target_ulong cs1;
+    target_ulong pad1; /* pad to 48 words */
 };
 
+QEMU_BUILD_BUG_ON(sizeof(struct target_user_regs_struct) != 48 * 4);
+
+struct target_sigcontext {
+    struct target_user_regs_struct sc_regs;
+} QEMU_ALIGNED(8);
+
 struct target_ucontext {
     unsigned long uc_flags;
     target_ulong uc_link; /* target pointer */
@@ -76,53 +85,63 @@ static abi_ulong get_sigframe(struct target_sigaction *ka,
 
 static void setup_sigcontext(struct target_sigcontext *sc, CPUHexagonState *env)
 {
-    __put_user(env->gpr[HEX_REG_R00], &sc->r0);
-    __put_user(env->gpr[HEX_REG_R01], &sc->r1);
-    __put_user(env->gpr[HEX_REG_R02], &sc->r2);
-    __put_user(env->gpr[HEX_REG_R03], &sc->r3);
-    __put_user(env->gpr[HEX_REG_R04], &sc->r4);
-    __put_user(env->gpr[HEX_REG_R05], &sc->r5);
-    __put_user(env->gpr[HEX_REG_R06], &sc->r6);
-    __put_user(env->gpr[HEX_REG_R07], &sc->r7);
-    __put_user(env->gpr[HEX_REG_R08], &sc->r8);
-    __put_user(env->gpr[HEX_REG_R09], &sc->r9);
-    __put_user(env->gpr[HEX_REG_R10], &sc->r10);
-    __put_user(env->gpr[HEX_REG_R11], &sc->r11);
-    __put_user(env->gpr[HEX_REG_R12], &sc->r12);
-    __put_user(env->gpr[HEX_REG_R13], &sc->r13);
-    __put_user(env->gpr[HEX_REG_R14], &sc->r14);
-    __put_user(env->gpr[HEX_REG_R15], &sc->r15);
-    __put_user(env->gpr[HEX_REG_R16], &sc->r16);
-    __put_user(env->gpr[HEX_REG_R17], &sc->r17);
-    __put_user(env->gpr[HEX_REG_R18], &sc->r18);
-    __put_user(env->gpr[HEX_REG_R19], &sc->r19);
-    __put_user(env->gpr[HEX_REG_R20], &sc->r20);
-    __put_user(env->gpr[HEX_REG_R21], &sc->r21);
-    __put_user(env->gpr[HEX_REG_R22], &sc->r22);
-    __put_user(env->gpr[HEX_REG_R23], &sc->r23);
-    __put_user(env->gpr[HEX_REG_R24], &sc->r24);
-    __put_user(env->gpr[HEX_REG_R25], &sc->r25);
-    __put_user(env->gpr[HEX_REG_R26], &sc->r26);
-    __put_user(env->gpr[HEX_REG_R27], &sc->r27);
-    __put_user(env->gpr[HEX_REG_R28], &sc->r28);
-    __put_user(env->gpr[HEX_REG_R29], &sc->r29);
-    __put_user(env->gpr[HEX_REG_R30], &sc->r30);
-    __put_user(env->gpr[HEX_REG_R31], &sc->r31);
-    __put_user(env->gpr[HEX_REG_SA0], &sc->sa0);
-    __put_user(env->gpr[HEX_REG_LC0], &sc->lc0);
-    __put_user(env->gpr[HEX_REG_SA1], &sc->sa1);
-    __put_user(env->gpr[HEX_REG_LC1], &sc->lc1);
-    __put_user(env->gpr[HEX_REG_M0], &sc->m0);
-    __put_user(env->gpr[HEX_REG_M1], &sc->m1);
-    __put_user(env->gpr[HEX_REG_USR], &sc->usr);
-    __put_user(env->gpr[HEX_REG_GP], &sc->gp);
-    __put_user(env->gpr[HEX_REG_UGP], &sc->ugp);
-    __put_user(env->gpr[HEX_REG_PC], &sc->pc);
+    target_ulong preds = 0;
 
-    int i;
-    for (i = 0; i < NUM_PREGS; i++) {
-        __put_user(env->pred[i], &(sc->pred[i]));
+    __put_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
+    __put_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);
+    __put_user(env->gpr[HEX_REG_R02], &sc->sc_regs.r2);
+    __put_user(env->gpr[HEX_REG_R03], &sc->sc_regs.r3);
+    __put_user(env->gpr[HEX_REG_R04], &sc->sc_regs.r4);
+    __put_user(env->gpr[HEX_REG_R05], &sc->sc_regs.r5);
+    __put_user(env->gpr[HEX_REG_R06], &sc->sc_regs.r6);
+    __put_user(env->gpr[HEX_REG_R07], &sc->sc_regs.r7);
+    __put_user(env->gpr[HEX_REG_R08], &sc->sc_regs.r8);
+    __put_user(env->gpr[HEX_REG_R09], &sc->sc_regs.r9);
+    __put_user(env->gpr[HEX_REG_R10], &sc->sc_regs.r10);
+    __put_user(env->gpr[HEX_REG_R11], &sc->sc_regs.r11);
+    __put_user(env->gpr[HEX_REG_R12], &sc->sc_regs.r12);
+    __put_user(env->gpr[HEX_REG_R13], &sc->sc_regs.r13);
+    __put_user(env->gpr[HEX_REG_R14], &sc->sc_regs.r14);
+    __put_user(env->gpr[HEX_REG_R15], &sc->sc_regs.r15);
+    __put_user(env->gpr[HEX_REG_R16], &sc->sc_regs.r16);
+    __put_user(env->gpr[HEX_REG_R17], &sc->sc_regs.r17);
+    __put_user(env->gpr[HEX_REG_R18], &sc->sc_regs.r18);
+    __put_user(env->gpr[HEX_REG_R19], &sc->sc_regs.r19);
+    __put_user(env->gpr[HEX_REG_R20], &sc->sc_regs.r20);
+    __put_user(env->gpr[HEX_REG_R21], &sc->sc_regs.r21);
+    __put_user(env->gpr[HEX_REG_R22], &sc->sc_regs.r22);
+    __put_user(env->gpr[HEX_REG_R23], &sc->sc_regs.r23);
+    __put_user(env->gpr[HEX_REG_R24], &sc->sc_regs.r24);
+    __put_user(env->gpr[HEX_REG_R25], &sc->sc_regs.r25);
+    __put_user(env->gpr[HEX_REG_R26], &sc->sc_regs.r26);
+    __put_user(env->gpr[HEX_REG_R27], &sc->sc_regs.r27);
+    __put_user(env->gpr[HEX_REG_R28], &sc->sc_regs.r28);
+    __put_user(env->gpr[HEX_REG_R29], &sc->sc_regs.r29);
+    __put_user(env->gpr[HEX_REG_R30], &sc->sc_regs.r30);
+    __put_user(env->gpr[HEX_REG_R31], &sc->sc_regs.r31);
+    __put_user(env->gpr[HEX_REG_SA0], &sc->sc_regs.sa0);
+    __put_user(env->gpr[HEX_REG_LC0], &sc->sc_regs.lc0);
+    __put_user(env->gpr[HEX_REG_SA1], &sc->sc_regs.sa1);
+    __put_user(env->gpr[HEX_REG_LC1], &sc->sc_regs.lc1);
+    __put_user(env->gpr[HEX_REG_M0], &sc->sc_regs.m0);
+    __put_user(env->gpr[HEX_REG_M1], &sc->sc_regs.m1);
+    __put_user(env->gpr[HEX_REG_USR], &sc->sc_regs.usr);
+    __put_user(env->gpr[HEX_REG_GP], &sc->sc_regs.gp);
+    __put_user(env->gpr[HEX_REG_UGP], &sc->sc_regs.ugp);
+    __put_user(env->gpr[HEX_REG_PC], &sc->sc_regs.pc);
+
+    /* Consolidate predicates into p3_0 */
+    for (int i = 0; i < NUM_PREGS; i++) {
+        preds |= (env->pred[i] & 0xff) << (i * 8);
     }
+    __put_user(preds, &sc->sc_regs.p3_0);
+
+    /* Set cause and badva to 0 - these are set by kernel on exceptions */
+    __put_user(0, &sc->sc_regs.cause);
+    __put_user(0, &sc->sc_regs.badva);
+
+    __put_user(env->gpr[HEX_REG_CS0], &sc->sc_regs.cs0);
+    __put_user(env->gpr[HEX_REG_CS1], &sc->sc_regs.cs1);
 }
 
 static void setup_ucontext(struct target_ucontext *uc,
@@ -192,53 +211,59 @@ badframe:
 static void restore_sigcontext(CPUHexagonState *env,
                                struct target_sigcontext *sc)
 {
-    __get_user(env->gpr[HEX_REG_R00], &sc->r0);
-    __get_user(env->gpr[HEX_REG_R01], &sc->r1);
-    __get_user(env->gpr[HEX_REG_R02], &sc->r2);
-    __get_user(env->gpr[HEX_REG_R03], &sc->r3);
-    __get_user(env->gpr[HEX_REG_R04], &sc->r4);
-    __get_user(env->gpr[HEX_REG_R05], &sc->r5);
-    __get_user(env->gpr[HEX_REG_R06], &sc->r6);
-    __get_user(env->gpr[HEX_REG_R07], &sc->r7);
-    __get_user(env->gpr[HEX_REG_R08], &sc->r8);
-    __get_user(env->gpr[HEX_REG_R09], &sc->r9);
-    __get_user(env->gpr[HEX_REG_R10], &sc->r10);
-    __get_user(env->gpr[HEX_REG_R11], &sc->r11);
-    __get_user(env->gpr[HEX_REG_R12], &sc->r12);
-    __get_user(env->gpr[HEX_REG_R13], &sc->r13);
-    __get_user(env->gpr[HEX_REG_R14], &sc->r14);
-    __get_user(env->gpr[HEX_REG_R15], &sc->r15);
-    __get_user(env->gpr[HEX_REG_R16], &sc->r16);
-    __get_user(env->gpr[HEX_REG_R17], &sc->r17);
-    __get_user(env->gpr[HEX_REG_R18], &sc->r18);
-    __get_user(env->gpr[HEX_REG_R19], &sc->r19);
-    __get_user(env->gpr[HEX_REG_R20], &sc->r20);
-    __get_user(env->gpr[HEX_REG_R21], &sc->r21);
-    __get_user(env->gpr[HEX_REG_R22], &sc->r22);
-    __get_user(env->gpr[HEX_REG_R23], &sc->r23);
-    __get_user(env->gpr[HEX_REG_R24], &sc->r24);
-    __get_user(env->gpr[HEX_REG_R25], &sc->r25);
-    __get_user(env->gpr[HEX_REG_R26], &sc->r26);
-    __get_user(env->gpr[HEX_REG_R27], &sc->r27);
-    __get_user(env->gpr[HEX_REG_R28], &sc->r28);
-    __get_user(env->gpr[HEX_REG_R29], &sc->r29);
-    __get_user(env->gpr[HEX_REG_R30], &sc->r30);
-    __get_user(env->gpr[HEX_REG_R31], &sc->r31);
-    __get_user(env->gpr[HEX_REG_SA0], &sc->sa0);
-    __get_user(env->gpr[HEX_REG_LC0], &sc->lc0);
-    __get_user(env->gpr[HEX_REG_SA1], &sc->sa1);
-    __get_user(env->gpr[HEX_REG_LC1], &sc->lc1);
-    __get_user(env->gpr[HEX_REG_M0], &sc->m0);
-    __get_user(env->gpr[HEX_REG_M1], &sc->m1);
-    __get_user(env->gpr[HEX_REG_USR], &sc->usr);
-    __get_user(env->gpr[HEX_REG_GP], &sc->gp);
-    __get_user(env->gpr[HEX_REG_UGP], &sc->ugp);
-    __get_user(env->gpr[HEX_REG_PC], &sc->pc);
+    target_ulong preds;
 
-    int i;
-    for (i = 0; i < NUM_PREGS; i++) {
-        __get_user(env->pred[i], &(sc->pred[i]));
+    __get_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
+    __get_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);
+    __get_user(env->gpr[HEX_REG_R02], &sc->sc_regs.r2);
+    __get_user(env->gpr[HEX_REG_R03], &sc->sc_regs.r3);
+    __get_user(env->gpr[HEX_REG_R04], &sc->sc_regs.r4);
+    __get_user(env->gpr[HEX_REG_R05], &sc->sc_regs.r5);
+    __get_user(env->gpr[HEX_REG_R06], &sc->sc_regs.r6);
+    __get_user(env->gpr[HEX_REG_R07], &sc->sc_regs.r7);
+    __get_user(env->gpr[HEX_REG_R08], &sc->sc_regs.r8);
+    __get_user(env->gpr[HEX_REG_R09], &sc->sc_regs.r9);
+    __get_user(env->gpr[HEX_REG_R10], &sc->sc_regs.r10);
+    __get_user(env->gpr[HEX_REG_R11], &sc->sc_regs.r11);
+    __get_user(env->gpr[HEX_REG_R12], &sc->sc_regs.r12);
+    __get_user(env->gpr[HEX_REG_R13], &sc->sc_regs.r13);
+    __get_user(env->gpr[HEX_REG_R14], &sc->sc_regs.r14);
+    __get_user(env->gpr[HEX_REG_R15], &sc->sc_regs.r15);
+    __get_user(env->gpr[HEX_REG_R16], &sc->sc_regs.r16);
+    __get_user(env->gpr[HEX_REG_R17], &sc->sc_regs.r17);
+    __get_user(env->gpr[HEX_REG_R18], &sc->sc_regs.r18);
+    __get_user(env->gpr[HEX_REG_R19], &sc->sc_regs.r19);
+    __get_user(env->gpr[HEX_REG_R20], &sc->sc_regs.r20);
+    __get_user(env->gpr[HEX_REG_R21], &sc->sc_regs.r21);
+    __get_user(env->gpr[HEX_REG_R22], &sc->sc_regs.r22);
+    __get_user(env->gpr[HEX_REG_R23], &sc->sc_regs.r23);
+    __get_user(env->gpr[HEX_REG_R24], &sc->sc_regs.r24);
+    __get_user(env->gpr[HEX_REG_R25], &sc->sc_regs.r25);
+    __get_user(env->gpr[HEX_REG_R26], &sc->sc_regs.r26);
+    __get_user(env->gpr[HEX_REG_R27], &sc->sc_regs.r27);
+    __get_user(env->gpr[HEX_REG_R28], &sc->sc_regs.r28);
+    __get_user(env->gpr[HEX_REG_R29], &sc->sc_regs.r29);
+    __get_user(env->gpr[HEX_REG_R30], &sc->sc_regs.r30);
+    __get_user(env->gpr[HEX_REG_R31], &sc->sc_regs.r31);
+    __get_user(env->gpr[HEX_REG_SA0], &sc->sc_regs.sa0);
+    __get_user(env->gpr[HEX_REG_LC0], &sc->sc_regs.lc0);
+    __get_user(env->gpr[HEX_REG_SA1], &sc->sc_regs.sa1);
+    __get_user(env->gpr[HEX_REG_LC1], &sc->sc_regs.lc1);
+    __get_user(env->gpr[HEX_REG_M0], &sc->sc_regs.m0);
+    __get_user(env->gpr[HEX_REG_M1], &sc->sc_regs.m1);
+    __get_user(env->gpr[HEX_REG_USR], &sc->sc_regs.usr);
+    __get_user(env->gpr[HEX_REG_GP], &sc->sc_regs.gp);
+    __get_user(env->gpr[HEX_REG_UGP], &sc->sc_regs.ugp);
+    __get_user(env->gpr[HEX_REG_PC], &sc->sc_regs.pc);
+
+    /* Restore predicates from p3_0 */
+    __get_user(preds, &sc->sc_regs.p3_0);
+    for (int i = 0; i < NUM_PREGS; i++) {
+        env->pred[i] = (preds >> (i * 8)) & 0xff;
     }
+
+    __get_user(env->gpr[HEX_REG_CS0], &sc->sc_regs.cs0);
+    __get_user(env->gpr[HEX_REG_CS1], &sc->sc_regs.cs1);
 }
 
 static void restore_ucontext(CPUHexagonState *env, struct target_ucontext *uc)

From ef9bb7c6e44683a17765ccf000048436c9915137 Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Wed, 8 Oct 2025 17:22:34 -0500
Subject: [PATCH 1435/2396] linux-user/hexagon: use abi_ulong
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Change the user_regs_struct to use abi_ulong instead of
target_ulong.

Link: https://lore.kernel.org/qemu-devel/7bf3d8c5-df07-4cbd-ba62-4c7246a5f96b@linaro.org/
Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 linux-user/hexagon/signal.c | 52 ++++++++++++++++++-------------------
 1 file changed, 26 insertions(+), 26 deletions(-)

diff --git a/linux-user/hexagon/signal.c b/linux-user/hexagon/signal.c
index 2847952216..e5514b2bec 100644
--- a/linux-user/hexagon/signal.c
+++ b/linux-user/hexagon/signal.c
@@ -24,30 +24,30 @@
 #include "linux-user/trace.h"
 
 struct target_user_regs_struct {
-    target_ulong r0,  r1,  r2,  r3;
-    target_ulong r4,  r5,  r6,  r7;
-    target_ulong r8,  r9, r10, r11;
-    target_ulong r12, r13, r14, r15;
-    target_ulong r16, r17, r18, r19;
-    target_ulong r20, r21, r22, r23;
-    target_ulong r24, r25, r26, r27;
-    target_ulong r28, r29, r30, r31;
-    target_ulong sa0;
-    target_ulong lc0;
-    target_ulong sa1;
-    target_ulong lc1;
-    target_ulong m0;
-    target_ulong m1;
-    target_ulong usr;
-    target_ulong p3_0;
-    target_ulong gp;
-    target_ulong ugp;
-    target_ulong pc;
-    target_ulong cause;
-    target_ulong badva;
-    target_ulong cs0;
-    target_ulong cs1;
-    target_ulong pad1; /* pad to 48 words */
+    abi_ulong r0,  r1,  r2,  r3;
+    abi_ulong r4,  r5,  r6,  r7;
+    abi_ulong r8,  r9, r10, r11;
+    abi_ulong r12, r13, r14, r15;
+    abi_ulong r16, r17, r18, r19;
+    abi_ulong r20, r21, r22, r23;
+    abi_ulong r24, r25, r26, r27;
+    abi_ulong r28, r29, r30, r31;
+    abi_ulong sa0;
+    abi_ulong lc0;
+    abi_ulong sa1;
+    abi_ulong lc1;
+    abi_ulong m0;
+    abi_ulong m1;
+    abi_ulong usr;
+    abi_ulong p3_0;
+    abi_ulong gp;
+    abi_ulong ugp;
+    abi_ulong pc;
+    abi_ulong cause;
+    abi_ulong badva;
+    abi_ulong cs0;
+    abi_ulong cs1;
+    abi_ulong pad1; /* pad to 48 words */
 };
 
 QEMU_BUILD_BUG_ON(sizeof(struct target_user_regs_struct) != 48 * 4);
@@ -85,7 +85,7 @@ static abi_ulong get_sigframe(struct target_sigaction *ka,
 
 static void setup_sigcontext(struct target_sigcontext *sc, CPUHexagonState *env)
 {
-    target_ulong preds = 0;
+    abi_ulong preds = 0;
 
     __put_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
     __put_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);
@@ -211,7 +211,7 @@ badframe:
 static void restore_sigcontext(CPUHexagonState *env,
                                struct target_sigcontext *sc)
 {
-    target_ulong preds;
+    abi_ulong preds;
 
     __get_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
     __get_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);

From 81c9311296ebf67f3821f347141a11838aa7d9d3 Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Wed, 8 Oct 2025 18:06:42 -0500
Subject: [PATCH 1436/2396] linux-user/hexagon: Use an array for GPRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Link: https://lore.kernel.org/qemu-devel/023e01dc389c$faf84320$f0e8c960$@gmail.com/
Suggested-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 linux-user/hexagon/signal.c | 79 ++++---------------------------------
 1 file changed, 7 insertions(+), 72 deletions(-)

diff --git a/linux-user/hexagon/signal.c b/linux-user/hexagon/signal.c
index e5514b2bec..183ecfaa19 100644
--- a/linux-user/hexagon/signal.c
+++ b/linux-user/hexagon/signal.c
@@ -24,14 +24,7 @@
 #include "linux-user/trace.h"
 
 struct target_user_regs_struct {
-    abi_ulong r0,  r1,  r2,  r3;
-    abi_ulong r4,  r5,  r6,  r7;
-    abi_ulong r8,  r9, r10, r11;
-    abi_ulong r12, r13, r14, r15;
-    abi_ulong r16, r17, r18, r19;
-    abi_ulong r20, r21, r22, r23;
-    abi_ulong r24, r25, r26, r27;
-    abi_ulong r28, r29, r30, r31;
+    abi_ulong gpr[32];
     abi_ulong sa0;
     abi_ulong lc0;
     abi_ulong sa1;
@@ -87,38 +80,9 @@ static void setup_sigcontext(struct target_sigcontext *sc, CPUHexagonState *env)
 {
     abi_ulong preds = 0;
 
-    __put_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
-    __put_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);
-    __put_user(env->gpr[HEX_REG_R02], &sc->sc_regs.r2);
-    __put_user(env->gpr[HEX_REG_R03], &sc->sc_regs.r3);
-    __put_user(env->gpr[HEX_REG_R04], &sc->sc_regs.r4);
-    __put_user(env->gpr[HEX_REG_R05], &sc->sc_regs.r5);
-    __put_user(env->gpr[HEX_REG_R06], &sc->sc_regs.r6);
-    __put_user(env->gpr[HEX_REG_R07], &sc->sc_regs.r7);
-    __put_user(env->gpr[HEX_REG_R08], &sc->sc_regs.r8);
-    __put_user(env->gpr[HEX_REG_R09], &sc->sc_regs.r9);
-    __put_user(env->gpr[HEX_REG_R10], &sc->sc_regs.r10);
-    __put_user(env->gpr[HEX_REG_R11], &sc->sc_regs.r11);
-    __put_user(env->gpr[HEX_REG_R12], &sc->sc_regs.r12);
-    __put_user(env->gpr[HEX_REG_R13], &sc->sc_regs.r13);
-    __put_user(env->gpr[HEX_REG_R14], &sc->sc_regs.r14);
-    __put_user(env->gpr[HEX_REG_R15], &sc->sc_regs.r15);
-    __put_user(env->gpr[HEX_REG_R16], &sc->sc_regs.r16);
-    __put_user(env->gpr[HEX_REG_R17], &sc->sc_regs.r17);
-    __put_user(env->gpr[HEX_REG_R18], &sc->sc_regs.r18);
-    __put_user(env->gpr[HEX_REG_R19], &sc->sc_regs.r19);
-    __put_user(env->gpr[HEX_REG_R20], &sc->sc_regs.r20);
-    __put_user(env->gpr[HEX_REG_R21], &sc->sc_regs.r21);
-    __put_user(env->gpr[HEX_REG_R22], &sc->sc_regs.r22);
-    __put_user(env->gpr[HEX_REG_R23], &sc->sc_regs.r23);
-    __put_user(env->gpr[HEX_REG_R24], &sc->sc_regs.r24);
-    __put_user(env->gpr[HEX_REG_R25], &sc->sc_regs.r25);
-    __put_user(env->gpr[HEX_REG_R26], &sc->sc_regs.r26);
-    __put_user(env->gpr[HEX_REG_R27], &sc->sc_regs.r27);
-    __put_user(env->gpr[HEX_REG_R28], &sc->sc_regs.r28);
-    __put_user(env->gpr[HEX_REG_R29], &sc->sc_regs.r29);
-    __put_user(env->gpr[HEX_REG_R30], &sc->sc_regs.r30);
-    __put_user(env->gpr[HEX_REG_R31], &sc->sc_regs.r31);
+    for (int i = 0; i < 32; i++) {
+        __put_user(env->gpr[HEX_REG_R00 + i], &sc->sc_regs.gpr[i]);
+    }
     __put_user(env->gpr[HEX_REG_SA0], &sc->sc_regs.sa0);
     __put_user(env->gpr[HEX_REG_LC0], &sc->sc_regs.lc0);
     __put_user(env->gpr[HEX_REG_SA1], &sc->sc_regs.sa1);
@@ -213,38 +177,9 @@ static void restore_sigcontext(CPUHexagonState *env,
 {
     abi_ulong preds;
 
-    __get_user(env->gpr[HEX_REG_R00], &sc->sc_regs.r0);
-    __get_user(env->gpr[HEX_REG_R01], &sc->sc_regs.r1);
-    __get_user(env->gpr[HEX_REG_R02], &sc->sc_regs.r2);
-    __get_user(env->gpr[HEX_REG_R03], &sc->sc_regs.r3);
-    __get_user(env->gpr[HEX_REG_R04], &sc->sc_regs.r4);
-    __get_user(env->gpr[HEX_REG_R05], &sc->sc_regs.r5);
-    __get_user(env->gpr[HEX_REG_R06], &sc->sc_regs.r6);
-    __get_user(env->gpr[HEX_REG_R07], &sc->sc_regs.r7);
-    __get_user(env->gpr[HEX_REG_R08], &sc->sc_regs.r8);
-    __get_user(env->gpr[HEX_REG_R09], &sc->sc_regs.r9);
-    __get_user(env->gpr[HEX_REG_R10], &sc->sc_regs.r10);
-    __get_user(env->gpr[HEX_REG_R11], &sc->sc_regs.r11);
-    __get_user(env->gpr[HEX_REG_R12], &sc->sc_regs.r12);
-    __get_user(env->gpr[HEX_REG_R13], &sc->sc_regs.r13);
-    __get_user(env->gpr[HEX_REG_R14], &sc->sc_regs.r14);
-    __get_user(env->gpr[HEX_REG_R15], &sc->sc_regs.r15);
-    __get_user(env->gpr[HEX_REG_R16], &sc->sc_regs.r16);
-    __get_user(env->gpr[HEX_REG_R17], &sc->sc_regs.r17);
-    __get_user(env->gpr[HEX_REG_R18], &sc->sc_regs.r18);
-    __get_user(env->gpr[HEX_REG_R19], &sc->sc_regs.r19);
-    __get_user(env->gpr[HEX_REG_R20], &sc->sc_regs.r20);
-    __get_user(env->gpr[HEX_REG_R21], &sc->sc_regs.r21);
-    __get_user(env->gpr[HEX_REG_R22], &sc->sc_regs.r22);
-    __get_user(env->gpr[HEX_REG_R23], &sc->sc_regs.r23);
-    __get_user(env->gpr[HEX_REG_R24], &sc->sc_regs.r24);
-    __get_user(env->gpr[HEX_REG_R25], &sc->sc_regs.r25);
-    __get_user(env->gpr[HEX_REG_R26], &sc->sc_regs.r26);
-    __get_user(env->gpr[HEX_REG_R27], &sc->sc_regs.r27);
-    __get_user(env->gpr[HEX_REG_R28], &sc->sc_regs.r28);
-    __get_user(env->gpr[HEX_REG_R29], &sc->sc_regs.r29);
-    __get_user(env->gpr[HEX_REG_R30], &sc->sc_regs.r30);
-    __get_user(env->gpr[HEX_REG_R31], &sc->sc_regs.r31);
+    for (int i = 0; i < 32; i++) {
+        __get_user(env->gpr[HEX_REG_R00 + i], &sc->sc_regs.gpr[i]);
+    }
     __get_user(env->gpr[HEX_REG_SA0], &sc->sc_regs.sa0);
     __get_user(env->gpr[HEX_REG_LC0], &sc->sc_regs.lc0);
     __get_user(env->gpr[HEX_REG_SA1], &sc->sc_regs.sa1);

From 6f6edad6c8daae1e7217ba0066b9e4791187c969 Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Tue, 7 Oct 2025 20:04:53 -0500
Subject: [PATCH 1437/2396] tests/tcg/hexagon: Add cs{0,1} coverage

Cover cs0,1 register corruption in the signal_context test case.

lc0, sa0 registers previously omitted from the clobbers list
are now captured.

Reviewed-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 tests/tcg/hexagon/signal_context.c | 23 ++++++++++++++++++++---
 1 file changed, 20 insertions(+), 3 deletions(-)

diff --git a/tests/tcg/hexagon/signal_context.c b/tests/tcg/hexagon/signal_context.c
index 7202fa64b6..9de7f6be4f 100644
--- a/tests/tcg/hexagon/signal_context.c
+++ b/tests/tcg/hexagon/signal_context.c
@@ -26,7 +26,11 @@ void sig_user(int sig, siginfo_t *info, void *puc)
         "p1 = r7\n\t"
         "p2 = r7\n\t"
         "p3 = r7\n\t"
-        : : : "r7", "p0", "p1", "p2", "p3");
+        "r6 = #0x12345678\n\t"
+        "cs0 = r6\n\t"
+        "r6 = #0x87654321\n\t"
+        "cs1 = r6\n\t"
+        : : : "r6", "r7", "p0", "p1", "p2", "p3", "cs0", "cs1");
 }
 
 int main()
@@ -53,7 +57,11 @@ int main()
     timer_settime(tid, 0, &it, NULL);
 
     asm("loop0(1f, %1)\n\t"
-        "1: r8 = #0xff\n\t"
+        "1: r9 = #0xdeadbeef\n\t"
+        "   cs0 = r9\n\t"
+        "   r9 = #0xbadc0fee\n\t"
+        "   cs1 = r9\n\t"
+        "   r8 = #0xff\n\t"
         "   p0 = r8\n\t"
         "   p1 = r8\n\t"
         "   p2 = r8\n\t"
@@ -74,10 +82,19 @@ int main()
         "   r8 = p3\n\t"
         "   p0 = cmp.eq(r8, #0xff)\n\t"
         "   if (!p0) jump 2b\n\t"
+        "   r8 = cs0\n\t"
+        "   r9 = #0xdeadbeef\n\t"
+        "   p0 = cmp.eq(r8, r9)\n\t"
+        "   if (!p0) jump 2b\n\t"
+        "   r8 = cs1\n\t"
+        "   r9 = #0xbadc0fee\n\t"
+        "   p0 = cmp.eq(r8, r9)\n\t"
+        "   if (!p0) jump 2b\n\t"
         "4: {}: endloop0\n\t"
         :
         : "r"(&err), "r"(i)
-        : "memory", "r8", "p0", "p1", "p2", "p3");
+        : "memory", "r8", "r9", "p0", "p1", "p2", "p3", "cs0", "cs1", "lc0",
+          "sa0");
 
     puts(err ? "FAIL" : "PASS");
     return err;

From 0c8a4e8434e3e8fa3193a38413c17cd259ce3457 Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Mon, 7 Apr 2025 12:27:01 -0700
Subject: [PATCH 1438/2396] target/hexagon: handle .new values

Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/hex_common.py | 22 +++++++++++++++++-----
 1 file changed, 17 insertions(+), 5 deletions(-)

diff --git a/target/hexagon/hex_common.py b/target/hexagon/hex_common.py
index 758e5fd12d..6803908718 100755
--- a/target/hexagon/hex_common.py
+++ b/target/hexagon/hex_common.py
@@ -350,6 +350,7 @@ class Register:
             f"{self.helper_arg_type()} {self.helper_arg_name()}"
         )
 
+
 #
 # Every register is either Single or Pair or Hvx
 #
@@ -1070,11 +1071,22 @@ def init_registers():
     for reg in new_regs:
         new_registers[f"{reg.regtype}{reg.regid}"] = reg
 
-def get_register(tag, regtype, regid):
-    if f"{regtype}{regid}V" in semdict[tag]:
-        return registers[f"{regtype}{regid}"]
-    else:
-        return new_registers[f"{regtype}{regid}"]
+def is_new_reg(tag, regid):
+    if regid[0] in "NO":
+        return True
+    return regid[0] == "P" and \
+           f"{regid}N" in semdict[tag] and \
+           f"{regid}V" not in semdict[tag]
+
+def get_register(tag, regtype, regid, subtype=""):
+    regid = f"{regtype}{regid}"
+    is_new = is_new_reg(tag, regid)
+    try:
+        reg = new_registers[regid] if is_new else registers[regid]
+    except KeyError:
+        raise Exception(f"Unknown {'new ' if is_new else ''}register {regid}" +\
+                        f"from '{tag}' with syntax '{semdict[tag]}'") from None
+    return reg
 
 def helper_ret_type(tag, regs):
     ## If there is a scalar result, it is the return type

From 1118972ef58b8e6e5644a70ff9579ec10541a873 Mon Sep 17 00:00:00 2001
From: Brian Cain <brian.cain@oss.qualcomm.com>
Date: Mon, 7 Apr 2025 12:27:04 -0700
Subject: [PATCH 1439/2396] target/hexagon:
 s/pkt_has_store/pkt_has_scalar_store

To remove any confusion with HVX or other potential store instructions,
we'll qualify this context var with "scalar".

Reviewed-by: Taylor Simpson <ltaylorsimpson@gmail.com>
Reviewed-by: Matheus Tavares Bernardino <matheus.bernardino@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/decode.c                     | 4 ++--
 target/hexagon/gen_helper_funcs.py          | 2 +-
 target/hexagon/genptr.c                     | 3 ++-
 target/hexagon/idef-parser/README.rst       | 2 +-
 target/hexagon/idef-parser/parser-helpers.c | 4 ++--
 target/hexagon/insn.h                       | 4 ++--
 target/hexagon/macros.h                     | 8 ++++----
 target/hexagon/op_helper.c                  | 4 ++--
 target/hexagon/translate.c                  | 9 +++++----
 9 files changed, 21 insertions(+), 19 deletions(-)

diff --git a/target/hexagon/decode.c b/target/hexagon/decode.c
index 23deba2426..b5ece60450 100644
--- a/target/hexagon/decode.c
+++ b/target/hexagon/decode.c
@@ -236,9 +236,9 @@ static void decode_set_insn_attr_fields(Packet *pkt)
             if (GET_ATTRIB(opcode, A_SCALAR_STORE) &&
                 !GET_ATTRIB(opcode, A_MEMSIZE_0B)) {
                 if (pkt->insn[i].slot == 0) {
-                    pkt->pkt_has_store_s0 = true;
+                    pkt->pkt_has_scalar_store_s0 = true;
                 } else {
-                    pkt->pkt_has_store_s1 = true;
+                    pkt->pkt_has_scalar_store_s1 = true;
                 }
             }
         }
diff --git a/target/hexagon/gen_helper_funcs.py b/target/hexagon/gen_helper_funcs.py
index c1f806ac4b..a9c0e27a80 100755
--- a/target/hexagon/gen_helper_funcs.py
+++ b/target/hexagon/gen_helper_funcs.py
@@ -69,7 +69,7 @@ def gen_helper_function(f, tag, tagregs, tagimms):
     if hex_common.need_slot(tag):
         if "A_LOAD" in hex_common.attribdict[tag]:
             f.write(hex_common.code_fmt(f"""\
-                bool pkt_has_store_s1 = slotval & 0x1;
+                bool pkt_has_scalar_store_s1 = slotval & 0x1;
             """))
         f.write(hex_common.code_fmt(f"""\
             uint32_t slot = slotval >> 1;
diff --git a/target/hexagon/genptr.c b/target/hexagon/genptr.c
index 08fc5413de..cecaece4ae 100644
--- a/target/hexagon/genptr.c
+++ b/target/hexagon/genptr.c
@@ -395,7 +395,8 @@ static inline void gen_store_conditional8(DisasContext *ctx,
 #ifndef CONFIG_HEXAGON_IDEF_PARSER
 static TCGv gen_slotval(DisasContext *ctx)
 {
-    int slotval = (ctx->pkt->pkt_has_store_s1 & 1) | (ctx->insn->slot << 1);
+    int slotval =
+        (ctx->pkt->pkt_has_scalar_store_s1 & 1) | (ctx->insn->slot << 1);
     return tcg_constant_tl(slotval);
 }
 #endif
diff --git a/target/hexagon/idef-parser/README.rst b/target/hexagon/idef-parser/README.rst
index 7199177ee3..235e3debee 100644
--- a/target/hexagon/idef-parser/README.rst
+++ b/target/hexagon/idef-parser/README.rst
@@ -637,7 +637,7 @@ tinycode for the Hexagon ``add`` instruction
 ::
 
    ---- 00021094
-   mov_i32 pkt_has_store_s1,$0x0
+   mov_i32 pkt_has_scalar_store_s1,$0x0
    add_i32 tmp0,r2,r2
    mov_i32 loc2,tmp0
    mov_i32 new_r1,loc2
diff --git a/target/hexagon/idef-parser/parser-helpers.c b/target/hexagon/idef-parser/parser-helpers.c
index 542af8d0a6..1dc52b4e02 100644
--- a/target/hexagon/idef-parser/parser-helpers.c
+++ b/target/hexagon/idef-parser/parser-helpers.c
@@ -1725,7 +1725,7 @@ void gen_cancel(Context *c, YYLTYPE *locp)
 
 void gen_load_cancel(Context *c, YYLTYPE *locp)
 {
-    OUT(c, locp, "if (insn->slot == 0 && pkt->pkt_has_store_s1) {\n");
+    OUT(c, locp, "if (insn->slot == 0 && pkt->pkt_has_scalar_store_s1) {\n");
     OUT(c, locp, "ctx->s1_store_processed = false;\n");
     OUT(c, locp, "process_store(ctx, 1);\n");
     OUT(c, locp, "}\n");
@@ -1750,7 +1750,7 @@ void gen_load(Context *c, YYLTYPE *locp, HexValue *width,
 
     /* Lookup the effective address EA */
     find_variable(c, locp, ea, ea);
-    OUT(c, locp, "if (insn->slot == 0 && pkt->pkt_has_store_s1) {\n");
+    OUT(c, locp, "if (insn->slot == 0 && pkt->pkt_has_scalar_store_s1) {\n");
     OUT(c, locp, "probe_noshuf_load(", ea, ", ", width, ", ctx->mem_idx);\n");
     OUT(c, locp, "process_store(ctx, 1);\n");
     OUT(c, locp, "}\n");
diff --git a/target/hexagon/insn.h b/target/hexagon/insn.h
index 24dcf7fe9f..5d59430da9 100644
--- a/target/hexagon/insn.h
+++ b/target/hexagon/insn.h
@@ -66,8 +66,8 @@ struct Packet {
 
     bool pkt_has_dczeroa;
 
-    bool pkt_has_store_s0;
-    bool pkt_has_store_s1;
+    bool pkt_has_scalar_store_s0;
+    bool pkt_has_scalar_store_s1;
 
     bool pkt_has_hvx;
     Insn *vhist_insn;
diff --git a/target/hexagon/macros.h b/target/hexagon/macros.h
index 9ba9be408d..088e5961ab 100644
--- a/target/hexagon/macros.h
+++ b/target/hexagon/macros.h
@@ -83,7 +83,7 @@
  */
 #define CHECK_NOSHUF(VA, SIZE) \
     do { \
-        if (insn->slot == 0 && ctx->pkt->pkt_has_store_s1) { \
+        if (insn->slot == 0 && ctx->pkt->pkt_has_scalar_store_s1) { \
             probe_noshuf_load(VA, SIZE, ctx->mem_idx); \
             process_store(ctx, 1); \
         } \
@@ -94,11 +94,11 @@
         TCGLabel *noshuf_label = gen_new_label(); \
         tcg_gen_brcondi_tl(TCG_COND_EQ, PRED, 0, noshuf_label); \
         GET_EA; \
-        if (insn->slot == 0 && ctx->pkt->pkt_has_store_s1) { \
+        if (insn->slot == 0 && ctx->pkt->pkt_has_scalar_store_s1) { \
             probe_noshuf_load(EA, SIZE, ctx->mem_idx); \
         } \
         gen_set_label(noshuf_label); \
-        if (insn->slot == 0 && ctx->pkt->pkt_has_store_s1) { \
+        if (insn->slot == 0 && ctx->pkt->pkt_has_scalar_store_s1) { \
             process_store(ctx, 1); \
         } \
     } while (0)
@@ -525,7 +525,7 @@ static inline TCGv gen_read_ireg(TCGv result, TCGv val, int shift)
 
 #define fLOAD(NUM, SIZE, SIGN, EA, DST) \
     do { \
-        check_noshuf(env, pkt_has_store_s1, slot, EA, SIZE, GETPC()); \
+        check_noshuf(env, pkt_has_scalar_store_s1, slot, EA, SIZE, GETPC()); \
         DST = (size##SIZE##SIGN##_t)MEM_LOAD##SIZE(env, EA, GETPC()); \
     } while (0)
 #endif
diff --git a/target/hexagon/op_helper.c b/target/hexagon/op_helper.c
index 444799d3ad..e2e80ca7ef 100644
--- a/target/hexagon/op_helper.c
+++ b/target/hexagon/op_helper.c
@@ -463,11 +463,11 @@ void HELPER(probe_pkt_scalar_hvx_stores)(CPUHexagonState *env, int mask)
  * If the load is in slot 0 and there is a store in slot1 (that
  * wasn't cancelled), we have to do the store first.
  */
-static void check_noshuf(CPUHexagonState *env, bool pkt_has_store_s1,
+static void check_noshuf(CPUHexagonState *env, bool pkt_has_scalar_store_s1,
                          uint32_t slot, target_ulong vaddr, int size,
                          uintptr_t ra)
 {
-    if (slot == 0 && pkt_has_store_s1 &&
+    if (slot == 0 && pkt_has_scalar_store_s1 &&
         ((env->slot_cancelled & (1 << 1)) == 0)) {
         probe_read(env, vaddr, size, MMU_USER_IDX, ra);
         commit_store(env, 1, ra);
diff --git a/target/hexagon/translate.c b/target/hexagon/translate.c
index 50766eafe2..8fce219c0d 100644
--- a/target/hexagon/translate.c
+++ b/target/hexagon/translate.c
@@ -693,11 +693,11 @@ static void process_store_log(DisasContext *ctx)
      *  the memory accesses overlap.
      */
     Packet *pkt = ctx->pkt;
-    if (pkt->pkt_has_store_s1) {
+    if (pkt->pkt_has_scalar_store_s1) {
         g_assert(!pkt->pkt_has_dczeroa);
         process_store(ctx, 1);
     }
-    if (pkt->pkt_has_store_s0) {
+    if (pkt->pkt_has_scalar_store_s0) {
         g_assert(!pkt->pkt_has_dczeroa);
         process_store(ctx, 0);
     }
@@ -822,8 +822,9 @@ static void gen_commit_packet(DisasContext *ctx)
      * involved in committing the packet.
      */
     Packet *pkt = ctx->pkt;
-    bool has_store_s0 = pkt->pkt_has_store_s0;
-    bool has_store_s1 = (pkt->pkt_has_store_s1 && !ctx->s1_store_processed);
+    bool has_store_s0 = pkt->pkt_has_scalar_store_s0;
+    bool has_store_s1 =
+        (pkt->pkt_has_scalar_store_s1 && !ctx->s1_store_processed);
     bool has_hvx_store = pkt_has_hvx_store(pkt);
     if (pkt->pkt_has_dczeroa) {
         /*

From e01046a1400e40315d3d4be13b47473ade76b7a7 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 2 Apr 2025 13:42:58 +0200
Subject: [PATCH 1440/2396] target/hexagon: Replace `prepare` script with meson
 target

The purpose of the prepare script is to invoke `cpp` to preprocess input
to idef-parser by expanding a few select macros.  On macOS `cpp`
expands into `clang ... -traditional-cpp` which breaks macro
concatenation.  Replace `cpp` with `${compiler} -E`
and replace the script with a meson custom_target.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/idef-parser/prepare | 24 ------------------------
 target/hexagon/meson.build         |  3 ++-
 2 files changed, 2 insertions(+), 25 deletions(-)
 delete mode 100755 target/hexagon/idef-parser/prepare

diff --git a/target/hexagon/idef-parser/prepare b/target/hexagon/idef-parser/prepare
deleted file mode 100755
index cb3622d4f8..0000000000
--- a/target/hexagon/idef-parser/prepare
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/usr/bin/env bash
-
-#
-#  Copyright(c) 2019-2021 rev.ng Labs Srl. All Rights Reserved.
-#
-#  This program is free software; you can redistribute it and/or modify
-#  it under the terms of the GNU General Public License as published by
-#  the Free Software Foundation; either version 2 of the License, or
-#  (at your option) any later version.
-#
-#  This program is distributed in the hope that it will be useful,
-#  but WITHOUT ANY WARRANTY; without even the implied warranty of
-#  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-#  GNU General Public License for more details.
-#
-#  You should have received a copy of the GNU General Public License
-#  along with this program; if not, see <http://www.gnu.org/licenses/>.
-#
-
-set -e
-set -o pipefail
-
-# Run the preprocessor and drop comments
-cpp "$@"
diff --git a/target/hexagon/meson.build b/target/hexagon/meson.build
index bb4ebaae81..abcf00ca1f 100644
--- a/target/hexagon/meson.build
+++ b/target/hexagon/meson.build
@@ -280,12 +280,13 @@ if idef_parser_enabled and 'hexagon-linux-user' in target_dirs
         command: [python, files('gen_idef_parser_funcs.py'), semantics_generated, '@OUTPUT@'],
     )
 
+    compiler = meson.get_compiler('c').get_id()
     preprocessed_idef_parser_input_generated = custom_target(
         'idef_parser_input.preprocessed.h.inc',
         output: 'idef_parser_input.preprocessed.h.inc',
         input: idef_parser_input_generated,
         depend_files: [idef_parser_dir / 'macros.h.inc'],
-        command: [idef_parser_dir / 'prepare', '@INPUT@', '-I' + idef_parser_dir, '-o', '@OUTPUT@'],
+        command: [compiler, '-x', 'c', '-E', '-I', idef_parser_dir, '-o', '@OUTPUT@', '@INPUT@'],
     )
 
     flex = generator(

From f97700e0752753e294db11de8462aef5d8009a89 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Wed, 2 Apr 2025 13:42:59 +0200
Subject: [PATCH 1441/2396] target/hexagon: Only indent on linux

indent on macOS, installed via homebrew, doesn't support -linux. Only
run indent on linux hosts.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Signed-off-by: Brian Cain <brian.cain@oss.qualcomm.com>
---
 target/hexagon/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/hexagon/meson.build b/target/hexagon/meson.build
index abcf00ca1f..d26787a9b9 100644
--- a/target/hexagon/meson.build
+++ b/target/hexagon/meson.build
@@ -324,7 +324,7 @@ if idef_parser_enabled and 'hexagon-linux-user' in target_dirs
     )
 
     indent = find_program('indent', required: false)
-    if indent.found()
+    if indent.found() and host_os == 'linux'
         idef_generated_tcg_c = custom_target(
             'indent',
             input: idef_generated_tcg[0],

From f8a5ba111596ca788524e7e4d7d31d9ffe8e2a79 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 15 Oct 2025 11:55:33 -0700
Subject: [PATCH 1442/2396] tcg/ppc: Remove dead cases from tcg_target_op_def
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Missed some lines when converting to TCGOutOpQemuLdSt*.

Fixes: 86fe5c2597c ("tcg: Convert qemu_st{2} to TCGOutOpLdSt{2}")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/ppc/tcg-target.c.inc | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index b8b23d44d5..cd2b68f9e1 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -4435,12 +4435,6 @@ static TCGConstraintSetIndex
 tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
 {
     switch (op) {
-    case INDEX_op_qemu_st:
-        return C_O0_I2(r, r);
-    case INDEX_op_qemu_st2:
-        return TCG_TARGET_REG_BITS == 64
-               ? C_O0_I3(o, m, r) : C_O0_I3(r, r, r);
-
     case INDEX_op_add_vec:
     case INDEX_op_sub_vec:
     case INDEX_op_mul_vec:

From 5c1ec5a1ee0958068a532ac1e06cc6cee0c75ba3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 14 Oct 2025 19:38:57 +0200
Subject: [PATCH 1443/2396] tcg/ppc: Remove support for 32-bit hosts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

32-bit host support is deprecated since commit 6d701c9bac1
("meson: Deprecate 32-bit host support"), released as v10.0.
The next release being v10.2, we can remove the TCG backend
for 32-bit PPC hosts.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251014173900.87497-2-philmd@linaro.org>
---
 tcg/ppc/tcg-target-has.h      |   5 +-
 tcg/ppc/tcg-target-reg-bits.h |   8 +-
 tcg/ppc/tcg-target.c.inc      | 385 +++++++---------------------------
 3 files changed, 79 insertions(+), 319 deletions(-)

diff --git a/tcg/ppc/tcg-target-has.h b/tcg/ppc/tcg-target-has.h
index 81ec5aece7..a3711feeae 100644
--- a/tcg/ppc/tcg-target-has.h
+++ b/tcg/ppc/tcg-target-has.h
@@ -17,12 +17,9 @@
 #define have_vsx       (cpuinfo & CPUINFO_VSX)
 
 /* optional instructions */
-#if TCG_TARGET_REG_BITS == 64
 #define TCG_TARGET_HAS_extr_i64_i32     0
-#endif
 
-#define TCG_TARGET_HAS_qemu_ldst_i128   \
-    (TCG_TARGET_REG_BITS == 64 && have_isa_2_07)
+#define TCG_TARGET_HAS_qemu_ldst_i128   have_isa_2_07
 
 #define TCG_TARGET_HAS_tst              1
 
diff --git a/tcg/ppc/tcg-target-reg-bits.h b/tcg/ppc/tcg-target-reg-bits.h
index 0efa80e7e0..3a15d7bee4 100644
--- a/tcg/ppc/tcg-target-reg-bits.h
+++ b/tcg/ppc/tcg-target-reg-bits.h
@@ -7,10 +7,10 @@
 #ifndef TCG_TARGET_REG_BITS_H
 #define TCG_TARGET_REG_BITS_H
 
-#ifdef _ARCH_PPC64
-# define TCG_TARGET_REG_BITS  64
-#else
-# define TCG_TARGET_REG_BITS  32
+#ifndef _ARCH_PPC64
+# error Expecting 64-bit host architecture
 #endif
 
+#define TCG_TARGET_REG_BITS  64
+
 #endif
diff --git a/tcg/ppc/tcg-target.c.inc b/tcg/ppc/tcg-target.c.inc
index cd2b68f9e1..3c36b26f25 100644
--- a/tcg/ppc/tcg-target.c.inc
+++ b/tcg/ppc/tcg-target.c.inc
@@ -29,35 +29,18 @@
  * Apple XCode does not define _CALL_DARWIN.
  * Clang defines _CALL_ELF (64-bit) but not _CALL_SYSV or _CALL_AIX.
  */
-#if TCG_TARGET_REG_BITS == 64
-# ifdef _CALL_AIX
+#ifdef _CALL_AIX
     /* ok */
-# elif defined(_CALL_ELF) && _CALL_ELF == 1
+#elif defined(_CALL_ELF) && _CALL_ELF == 1
 #  define _CALL_AIX
-# elif defined(_CALL_ELF) && _CALL_ELF == 2
+#elif defined(_CALL_ELF) && _CALL_ELF == 2
     /* ok */
-# else
-#  error "Unknown ABI"
-# endif
 #else
-# if defined(_CALL_SYSV) || defined(_CALL_DARWIN)
-    /* ok */
-# elif defined(__APPLE__)
-#  define _CALL_DARWIN
-# elif defined(__ELF__)
-#  define _CALL_SYSV
-# else
 #  error "Unknown ABI"
-# endif
 #endif
 
-#if TCG_TARGET_REG_BITS == 64
-# define TCG_TARGET_CALL_ARG_I32   TCG_CALL_ARG_EXTEND
-# define TCG_TARGET_CALL_RET_I128  TCG_CALL_RET_NORMAL
-#else
-# define TCG_TARGET_CALL_ARG_I32   TCG_CALL_ARG_NORMAL
-# define TCG_TARGET_CALL_RET_I128  TCG_CALL_RET_BY_REF
-#endif
+#define TCG_TARGET_CALL_ARG_I32   TCG_CALL_ARG_EXTEND
+#define TCG_TARGET_CALL_RET_I128  TCG_CALL_RET_NORMAL
 #ifdef _CALL_SYSV
 # define TCG_TARGET_CALL_ARG_I64   TCG_CALL_ARG_EVEN
 # define TCG_TARGET_CALL_ARG_I128  TCG_CALL_ARG_BY_REF
@@ -81,7 +64,7 @@
 #define TCG_VEC_TMP2    TCG_REG_V1
 
 #define TCG_REG_TB     TCG_REG_R31
-#define USE_REG_TB     (TCG_TARGET_REG_BITS == 64 && !have_isa_3_00)
+#define USE_REG_TB     !have_isa_3_00
 
 /* Shorthand for size of a pointer.  Avoid promotion to unsigned.  */
 #define SZP  ((int)sizeof(void *))
@@ -327,8 +310,7 @@ static bool tcg_target_const_match(int64_t sval, int ct,
             if (uval == (uint32_t)uval && mask_operand(uval, &mb, &me)) {
                 return 1;
             }
-            if (TCG_TARGET_REG_BITS == 64 &&
-                mask64_operand(uval << clz64(uval), &mb, &me)) {
+            if (mask64_operand(uval << clz64(uval), &mb, &me)) {
                 return 1;
             }
             return 0;
@@ -857,10 +839,8 @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
         return true;
     }
     switch (type) {
-    case TCG_TYPE_I64:
-        tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
-        /* fallthru */
     case TCG_TYPE_I32:
+    case TCG_TYPE_I64:
         if (ret < TCG_REG_V0) {
             if (arg < TCG_REG_V0) {
                 tcg_out32(s, OR | SAB(arg, ret, arg));
@@ -898,7 +878,6 @@ static bool tcg_out_mov(TCGContext *s, TCGType type, TCGReg ret, TCGReg arg)
 static void tcg_out_rld_rc(TCGContext *s, int op, TCGReg ra, TCGReg rs,
                            int sh, int mb, bool rc)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     sh = SH(sh & 0x1f) | (((sh >> 5) & 1) << 1);
     mb = MB64((mb >> 5) | ((mb << 1) & 0x3f));
     tcg_out32(s, op | RA(ra) | RS(rs) | sh | mb | rc);
@@ -946,13 +925,11 @@ static void tcg_out_ext16u(TCGContext *s, TCGReg dst, TCGReg src)
 
 static void tcg_out_ext32s(TCGContext *s, TCGReg dst, TCGReg src)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out32(s, EXTSW | RA(dst) | RS(src));
 }
 
 static void tcg_out_ext32u(TCGContext *s, TCGReg dst, TCGReg src)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out_rld(s, RLDICL, dst, src, 0, 32);
 }
 
@@ -968,7 +945,6 @@ static void tcg_out_extu_i32_i64(TCGContext *s, TCGReg dst, TCGReg src)
 
 static void tcg_out_extrl_i64_i32(TCGContext *s, TCGReg rd, TCGReg rn)
 {
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     tcg_out_mov(s, TCG_TYPE_I32, rd, rn);
 }
 
@@ -1037,9 +1013,7 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
     tcg_target_long tmp;
     int shift;
 
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
-
-    if (TCG_TARGET_REG_BITS == 64 && type == TCG_TYPE_I32) {
+    if (type == TCG_TYPE_I32) {
         arg = (int32_t)arg;
     }
 
@@ -1076,7 +1050,7 @@ static void tcg_out_movi_int(TCGContext *s, TCGType type, TCGReg ret,
 
     /* Load 32-bit immediates with two insns.  Note that we've already
        eliminated bare ADDIS, so we know both insns are required.  */
-    if (TCG_TARGET_REG_BITS == 32 || arg == (int32_t)arg) {
+    if (arg == (int32_t)arg) {
         tcg_out32(s, ADDIS | TAI(ret, 0, arg >> 16));
         tcg_out32(s, ORI | SAI(ret, ret, arg));
         return;
@@ -1227,19 +1201,10 @@ static void tcg_out_dupi_vec(TCGContext *s, TCGType type, unsigned vece,
     if (have_vsx) {
         load_insn = type == TCG_TYPE_V64 ? LXSDX : LXVDSX;
         load_insn |= VRT(ret) | RB(TCG_REG_TMP1);
-        if (TCG_TARGET_REG_BITS == 64) {
-            new_pool_label(s, val, rel, s->code_ptr, add);
-        } else {
-            new_pool_l2(s, rel, s->code_ptr, add, val >> 32, val);
-        }
+        new_pool_label(s, val, rel, s->code_ptr, add);
     } else {
         load_insn = LVX | VRT(ret) | RB(TCG_REG_TMP1);
-        if (TCG_TARGET_REG_BITS == 64) {
-            new_pool_l2(s, rel, s->code_ptr, add, val, val);
-        } else {
-            new_pool_l4(s, rel, s->code_ptr, add,
-                        val >> 32, val, val >> 32, val);
-        }
+        new_pool_l2(s, rel, s->code_ptr, add, val, val);
     }
 
     if (USE_REG_TB) {
@@ -1351,7 +1316,6 @@ static void tcg_out_andi64(TCGContext *s, TCGReg dst, TCGReg src, uint64_t c)
 {
     int mb, me;
 
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
     if (mask64_operand(c, &mb, &me)) {
         if (mb == 0) {
             tcg_out_rld(s, RLDICR, dst, src, 0, me);
@@ -1543,7 +1507,6 @@ static void tcg_out_ld(TCGContext *s, TCGType type, TCGReg ret,
         break;
     case TCG_TYPE_I64:
         if (ret < TCG_REG_V0) {
-            tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
             tcg_out_mem_long(s, LD, LDX, ret, base, offset);
             break;
         }
@@ -1598,7 +1561,6 @@ static void tcg_out_st(TCGContext *s, TCGType type, TCGReg arg,
         break;
     case TCG_TYPE_I64:
         if (arg < TCG_REG_V0) {
-            tcg_debug_assert(TCG_TARGET_REG_BITS == 64);
             tcg_out_mem_long(s, STD, STDX, arg, base, offset);
             break;
         }
@@ -1641,7 +1603,7 @@ static inline bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
 static void tcg_out_test(TCGContext *s, TCGReg dest, TCGReg arg1, TCGArg arg2,
                          bool const_arg2, TCGType type, bool rc)
 {
-    int mb, me;
+    int mb, me, sh;
 
     if (!const_arg2) {
         tcg_out32(s, AND | SAB(arg1, dest, arg2) | rc);
@@ -1664,12 +1626,10 @@ static void tcg_out_test(TCGContext *s, TCGReg dest, TCGReg arg1, TCGArg arg2,
         tcg_out_rlw_rc(s, RLWINM, dest, arg1, 0, mb, me, rc);
         return;
     }
-    if (TCG_TARGET_REG_BITS == 64) {
-        int sh = clz64(arg2);
-        if (mask64_operand(arg2 << sh, &mb, &me)) {
-            tcg_out_rld_rc(s, RLDICR, dest, arg1, sh, me, rc);
-            return;
-        }
+    sh = clz64(arg2);
+    if (mask64_operand(arg2 << sh, &mb, &me)) {
+        tcg_out_rld_rc(s, RLDICR, dest, arg1, sh, me, rc);
+        return;
     }
     /* Constraints should satisfy this. */
     g_assert_not_reached();
@@ -1680,8 +1640,6 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
 {
     uint32_t op;
 
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
-
     /*
      * Simplify the comparisons below wrt CMPI.
      * All of the tests are 16-bit, so a 32-bit sign extend always works.
@@ -1747,7 +1705,7 @@ static void tcg_out_cmp(TCGContext *s, int cond, TCGArg arg1, TCGArg arg2,
 static void tcg_out_setcond_eq0(TCGContext *s, TCGType type,
                                 TCGReg dst, TCGReg src, bool neg)
 {
-    if (neg && (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I64)) {
+    if (neg && type == TCG_TYPE_I64) {
         /*
          * X != 0 implies X + -1 generates a carry.
          * RT = (~X + X) + CA
@@ -1774,7 +1732,7 @@ static void tcg_out_setcond_eq0(TCGContext *s, TCGType type,
 static void tcg_out_setcond_ne0(TCGContext *s, TCGType type,
                                 TCGReg dst, TCGReg src, bool neg)
 {
-    if (!neg && (TCG_TARGET_REG_BITS == 32 || type == TCG_TYPE_I64)) {
+    if (!neg && type == TCG_TYPE_I64) {
         /*
          * X != 0 implies X + -1 generates a carry.  Extra addition
          * trickery means: R = X-1 + ~X + C = X-1 + (-X+1) + C = C.
@@ -1814,8 +1772,6 @@ static void tcg_out_setcond(TCGContext *s, TCGType type, TCGCond cond,
     int sh;
     bool inv;
 
-    tcg_debug_assert(TCG_TARGET_REG_BITS == 64 || type == TCG_TYPE_I32);
-
     /* Ignore high bits of a potential constant arg2.  */
     if (type == TCG_TYPE_I32) {
         arg2 = (uint32_t)arg2;
@@ -2117,109 +2073,6 @@ static void tcg_out_cntxz(TCGContext *s, TCGType type, uint32_t opc,
     }
 }
 
-static void tcg_out_cmp2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
-                         TCGArg bl, bool blconst, TCGArg bh, bool bhconst)
-{
-    static const struct { uint8_t bit1, bit2; } bits[] = {
-        [TCG_COND_LT ] = { CR_LT, CR_LT },
-        [TCG_COND_LE ] = { CR_LT, CR_GT },
-        [TCG_COND_GT ] = { CR_GT, CR_GT },
-        [TCG_COND_GE ] = { CR_GT, CR_LT },
-        [TCG_COND_LTU] = { CR_LT, CR_LT },
-        [TCG_COND_LEU] = { CR_LT, CR_GT },
-        [TCG_COND_GTU] = { CR_GT, CR_GT },
-        [TCG_COND_GEU] = { CR_GT, CR_LT },
-    };
-
-    TCGCond cond2;
-    int op, bit1, bit2;
-
-    switch (cond) {
-    case TCG_COND_EQ:
-        op = CRAND;
-        goto do_equality;
-    case TCG_COND_NE:
-        op = CRNAND;
-    do_equality:
-        tcg_out_cmp(s, cond, al, bl, blconst, 6, TCG_TYPE_I32);
-        tcg_out_cmp(s, cond, ah, bh, bhconst, 7, TCG_TYPE_I32);
-        tcg_out32(s, op | BT(0, CR_EQ) | BA(6, CR_EQ) | BB(7, CR_EQ));
-        break;
-
-    case TCG_COND_TSTEQ:
-    case TCG_COND_TSTNE:
-        if (blconst) {
-            tcg_out_andi32(s, TCG_REG_R0, al, bl);
-        } else {
-            tcg_out32(s, AND | SAB(al, TCG_REG_R0, bl));
-        }
-        if (bhconst) {
-            tcg_out_andi32(s, TCG_REG_TMP1, ah, bh);
-        } else {
-            tcg_out32(s, AND | SAB(ah, TCG_REG_TMP1, bh));
-        }
-        tcg_out32(s, OR | SAB(TCG_REG_R0, TCG_REG_R0, TCG_REG_TMP1) | 1);
-        break;
-
-    case TCG_COND_LT:
-    case TCG_COND_LE:
-    case TCG_COND_GT:
-    case TCG_COND_GE:
-    case TCG_COND_LTU:
-    case TCG_COND_LEU:
-    case TCG_COND_GTU:
-    case TCG_COND_GEU:
-        bit1 = bits[cond].bit1;
-        bit2 = bits[cond].bit2;
-        op = (bit1 != bit2 ? CRANDC : CRAND);
-        cond2 = tcg_unsigned_cond(cond);
-
-        tcg_out_cmp(s, cond, ah, bh, bhconst, 6, TCG_TYPE_I32);
-        tcg_out_cmp(s, cond2, al, bl, blconst, 7, TCG_TYPE_I32);
-        tcg_out32(s, op | BT(0, CR_EQ) | BA(6, CR_EQ) | BB(7, bit2));
-        tcg_out32(s, CROR | BT(0, CR_EQ) | BA(6, bit1) | BB(0, CR_EQ));
-        break;
-
-    default:
-        g_assert_not_reached();
-    }
-}
-
-static void tgen_setcond2(TCGContext *s, TCGCond cond, TCGReg ret,
-                          TCGReg al, TCGReg ah,
-                          TCGArg bl, bool const_bl,
-                          TCGArg bh, bool const_bh)
-{
-    tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
-    tcg_out32(s, MFOCRF | RT(TCG_REG_R0) | FXM(0));
-    tcg_out_rlw(s, RLWINM, ret, TCG_REG_R0, CR_EQ + 0*4 + 1, 31, 31);
-}
-
-#if TCG_TARGET_REG_BITS != 32
-__attribute__((unused))
-#endif
-static const TCGOutOpSetcond2 outop_setcond2 = {
-    .base.static_constraint = C_O1_I4(r, r, r, rU, rC),
-    .out = tgen_setcond2,
-};
-
-static void tgen_brcond2(TCGContext *s, TCGCond cond, TCGReg al, TCGReg ah,
-                         TCGArg bl, bool const_bl,
-                         TCGArg bh, bool const_bh, TCGLabel *l)
-{
-    assert(TCG_TARGET_REG_BITS == 32);
-    tcg_out_cmp2(s, cond, al, ah, bl, const_bl, bh, const_bh);
-    tcg_out_bc_lab(s, TCG_COND_EQ, l);
-}
-
-#if TCG_TARGET_REG_BITS != 32
-__attribute__((unused))
-#endif
-static const TCGOutOpBrcond2 outop_brcond2 = {
-    .base.static_constraint = C_O0_I4(r, r, rU, rC),
-    .out = tgen_brcond2,
-};
-
 static void tcg_out_mb(TCGContext *s, unsigned a0)
 {
     uint32_t insn;
@@ -2438,13 +2291,8 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP2, TCG_AREG0, table_off);
 
         /* Extract the page index, shifted into place for tlb index.  */
-        if (TCG_TARGET_REG_BITS == 32) {
-            tcg_out_shri32(s, TCG_REG_R0, addr,
-                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
-        } else {
-            tcg_out_shri64(s, TCG_REG_R0, addr,
-                           TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
-        }
+        tcg_out_shri64(s, TCG_REG_R0, addr,
+                       TARGET_PAGE_BITS - CPU_TLB_ENTRY_BITS);
         tcg_out32(s, AND | SAB(TCG_REG_TMP1, TCG_REG_TMP1, TCG_REG_R0));
 
         /*
@@ -2453,8 +2301,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          * We will ignore the high bits with tcg_out_cmp(..., addr_type).
          */
         if (cmp_off == 0) {
-            tcg_out32(s, (TCG_TARGET_REG_BITS == 64 ? LDUX : LWZUX)
-                      | TAB(TCG_REG_TMP2, TCG_REG_TMP1, TCG_REG_TMP2));
+            tcg_out32(s, LDUX | TAB(TCG_REG_TMP2, TCG_REG_TMP1, TCG_REG_TMP2));
         } else {
             tcg_out32(s, ADD | TAB(TCG_REG_TMP1, TCG_REG_TMP1, TCG_REG_TMP2));
             tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP2, TCG_REG_TMP1, cmp_off);
@@ -2464,51 +2311,36 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
          * Load the TLB addend for use on the fast path.
          * Do this asap to minimize any load use delay.
          */
-        if (TCG_TARGET_REG_BITS == 64 || addr_type == TCG_TYPE_I32) {
-            tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, TCG_REG_TMP1,
-                       offsetof(CPUTLBEntry, addend));
-        }
+        tcg_out_ld(s, TCG_TYPE_PTR, TCG_REG_TMP1, TCG_REG_TMP1,
+                   offsetof(CPUTLBEntry, addend));
 
         /* Clear the non-page, non-alignment bits from the address in R0. */
-        if (TCG_TARGET_REG_BITS == 32) {
-            /*
-             * We don't support unaligned accesses on 32-bits.
-             * Preserve the bottom bits and thus trigger a comparison
-             * failure on unaligned accesses.
-             */
-            if (a_bits < s_bits) {
-                a_bits = s_bits;
-            }
-            tcg_out_rlw(s, RLWINM, TCG_REG_R0, addr, 0,
+        TCGReg t = addr;
+
+        /*
+         * If the access is unaligned, we need to make sure we fail if we
+         * cross a page boundary.  The trick is to add the access size-1
+         * to the address before masking the low bits.  That will make the
+         * address overflow to the next page if we cross a page boundary,
+         * which will then force a mismatch of the TLB compare.
+         */
+        if (a_bits < s_bits) {
+            unsigned a_mask = (1 << a_bits) - 1;
+            unsigned s_mask = (1 << s_bits) - 1;
+            tcg_out32(s, ADDI | TAI(TCG_REG_R0, t, s_mask - a_mask));
+            t = TCG_REG_R0;
+        }
+
+        /* Mask the address for the requested alignment.  */
+        if (addr_type == TCG_TYPE_I32) {
+            tcg_out_rlw(s, RLWINM, TCG_REG_R0, t, 0,
                         (32 - a_bits) & 31, 31 - TARGET_PAGE_BITS);
+        } else if (a_bits == 0) {
+            tcg_out_rld(s, RLDICR, TCG_REG_R0, t, 0, 63 - TARGET_PAGE_BITS);
         } else {
-            TCGReg t = addr;
-
-            /*
-             * If the access is unaligned, we need to make sure we fail if we
-             * cross a page boundary.  The trick is to add the access size-1
-             * to the address before masking the low bits.  That will make the
-             * address overflow to the next page if we cross a page boundary,
-             * which will then force a mismatch of the TLB compare.
-             */
-            if (a_bits < s_bits) {
-                unsigned a_mask = (1 << a_bits) - 1;
-                unsigned s_mask = (1 << s_bits) - 1;
-                tcg_out32(s, ADDI | TAI(TCG_REG_R0, t, s_mask - a_mask));
-                t = TCG_REG_R0;
-            }
-
-            /* Mask the address for the requested alignment.  */
-            if (addr_type == TCG_TYPE_I32) {
-                tcg_out_rlw(s, RLWINM, TCG_REG_R0, t, 0,
-                            (32 - a_bits) & 31, 31 - TARGET_PAGE_BITS);
-            } else if (a_bits == 0) {
-                tcg_out_rld(s, RLDICR, TCG_REG_R0, t, 0, 63 - TARGET_PAGE_BITS);
-            } else {
-                tcg_out_rld(s, RLDICL, TCG_REG_R0, t,
-                            64 - TARGET_PAGE_BITS, TARGET_PAGE_BITS - a_bits);
-                tcg_out_rld(s, RLDICL, TCG_REG_R0, TCG_REG_R0, TARGET_PAGE_BITS, 0);
-            }
+            tcg_out_rld(s, RLDICL, TCG_REG_R0, t,
+                        64 - TARGET_PAGE_BITS, TARGET_PAGE_BITS - a_bits);
+            tcg_out_rld(s, RLDICL, TCG_REG_R0, TCG_REG_R0, TARGET_PAGE_BITS, 0);
         }
 
         /* Full comparison into cr0. */
@@ -2537,7 +2369,7 @@ static TCGLabelQemuLdst *prepare_host_addr(TCGContext *s, HostAddress *h,
         h->base = guest_base ? TCG_GUEST_BASE_REG : 0;
     }
 
-    if (TCG_TARGET_REG_BITS == 64 && addr_type == TCG_TYPE_I32) {
+    if (addr_type == TCG_TYPE_I32) {
         /* Zero-extend the guest address for use in the host address. */
         tcg_out_ext32u(s, TCG_REG_TMP2, addr);
         h->index = TCG_REG_TMP2;
@@ -2554,40 +2386,22 @@ static void tcg_out_qemu_ld(TCGContext *s, TCGReg datalo, TCGReg datahi,
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
     HostAddress h;
+    uint32_t insn = qemu_ldx_opc[opc & (MO_BSWAP | MO_SSIZE)];
 
     ldst = prepare_host_addr(s, &h, addr, oi, true);
 
-    if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
-        if (opc & MO_BSWAP) {
-            tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
-            tcg_out32(s, LWBRX | TAB(datalo, h.base, h.index));
-            tcg_out32(s, LWBRX | TAB(datahi, h.base, TCG_REG_R0));
-        } else if (h.base != 0) {
-            tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
-            tcg_out32(s, LWZX | TAB(datahi, h.base, h.index));
-            tcg_out32(s, LWZX | TAB(datalo, h.base, TCG_REG_R0));
-        } else if (h.index == datahi) {
-            tcg_out32(s, LWZ | TAI(datalo, h.index, 4));
-            tcg_out32(s, LWZ | TAI(datahi, h.index, 0));
-        } else {
-            tcg_out32(s, LWZ | TAI(datahi, h.index, 0));
-            tcg_out32(s, LWZ | TAI(datalo, h.index, 4));
-        }
+    if (!have_isa_2_06 && insn == LDBRX) {
+        tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
+        tcg_out32(s, LWBRX | TAB(datalo, h.base, h.index));
+        tcg_out32(s, LWBRX | TAB(TCG_REG_R0, h.base, TCG_REG_R0));
+        tcg_out_rld(s, RLDIMI, datalo, TCG_REG_R0, 32, 0);
+    } else if (insn) {
+        tcg_out32(s, insn | TAB(datalo, h.base, h.index));
     } else {
-        uint32_t insn = qemu_ldx_opc[opc & (MO_BSWAP | MO_SSIZE)];
-        if (!have_isa_2_06 && insn == LDBRX) {
-            tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
-            tcg_out32(s, LWBRX | TAB(datalo, h.base, h.index));
-            tcg_out32(s, LWBRX | TAB(TCG_REG_R0, h.base, TCG_REG_R0));
-            tcg_out_rld(s, RLDIMI, datalo, TCG_REG_R0, 32, 0);
-        } else if (insn) {
-            tcg_out32(s, insn | TAB(datalo, h.base, h.index));
-        } else {
-            insn = qemu_ldx_opc[opc & (MO_SIZE | MO_BSWAP)];
-            tcg_out32(s, insn | TAB(datalo, h.base, h.index));
-            tcg_out_movext(s, TCG_TYPE_REG, datalo,
-                           TCG_TYPE_REG, opc & MO_SSIZE, datalo);
-        }
+        insn = qemu_ldx_opc[opc & (MO_SIZE | MO_BSWAP)];
+        tcg_out32(s, insn | TAB(datalo, h.base, h.index));
+        tcg_out_movext(s, TCG_TYPE_REG, datalo,
+                       TCG_TYPE_REG, opc & MO_SSIZE, datalo);
     }
 
     if (ldst) {
@@ -2604,32 +2418,17 @@ static void tcg_out_qemu_st(TCGContext *s, TCGReg datalo, TCGReg datahi,
     MemOp opc = get_memop(oi);
     TCGLabelQemuLdst *ldst;
     HostAddress h;
+    uint32_t insn = qemu_stx_opc[opc & (MO_BSWAP | MO_SIZE)];
 
     ldst = prepare_host_addr(s, &h, addr, oi, false);
 
-    if (TCG_TARGET_REG_BITS == 32 && (opc & MO_SIZE) == MO_64) {
-        if (opc & MO_BSWAP) {
-            tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
-            tcg_out32(s, STWBRX | SAB(datalo, h.base, h.index));
-            tcg_out32(s, STWBRX | SAB(datahi, h.base, TCG_REG_R0));
-        } else if (h.base != 0) {
-            tcg_out32(s, ADDI | TAI(TCG_REG_R0, h.index, 4));
-            tcg_out32(s, STWX | SAB(datahi, h.base, h.index));
-            tcg_out32(s, STWX | SAB(datalo, h.base, TCG_REG_R0));
-        } else {
-            tcg_out32(s, STW | TAI(datahi, h.index, 0));
-            tcg_out32(s, STW | TAI(datalo, h.index, 4));
-        }
+    if (!have_isa_2_06 && insn == STDBRX) {
+        tcg_out32(s, STWBRX | SAB(datalo, h.base, h.index));
+        tcg_out32(s, ADDI | TAI(TCG_REG_TMP2, h.index, 4));
+        tcg_out_shri64(s, TCG_REG_R0, datalo, 32);
+        tcg_out32(s, STWBRX | SAB(TCG_REG_R0, h.base, TCG_REG_TMP2));
     } else {
-        uint32_t insn = qemu_stx_opc[opc & (MO_BSWAP | MO_SIZE)];
-        if (!have_isa_2_06 && insn == STDBRX) {
-            tcg_out32(s, STWBRX | SAB(datalo, h.base, h.index));
-            tcg_out32(s, ADDI | TAI(TCG_REG_TMP2, h.index, 4));
-            tcg_out_shri64(s, TCG_REG_R0, datalo, 32);
-            tcg_out32(s, STWBRX | SAB(TCG_REG_R0, h.base, TCG_REG_TMP2));
-        } else {
-            tcg_out32(s, insn | SAB(datalo, h.base, h.index));
-        }
+        tcg_out32(s, insn | SAB(datalo, h.base, h.index));
     }
 
     if (ldst) {
@@ -2709,16 +2508,11 @@ static const TCGOutOpQemuLdSt outop_qemu_ld = {
 static void tgen_qemu_ld2(TCGContext *s, TCGType type, TCGReg datalo,
                           TCGReg datahi, TCGReg addr, MemOpIdx oi)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_out_qemu_ld(s, datalo, datahi, addr, oi, type);
-    } else {
-        tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, true);
-    }
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, true);
 }
 
 static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
-    .base.static_constraint =
-        TCG_TARGET_REG_BITS == 64 ? C_N1O1_I1(o, m, r) : C_O2_I1(r, r, r),
+    .base.static_constraint = C_N1O1_I1(o, m, r),
     .out = tgen_qemu_ld2,
 };
 
@@ -2736,16 +2530,11 @@ static const TCGOutOpQemuLdSt outop_qemu_st = {
 static void tgen_qemu_st2(TCGContext *s, TCGType type, TCGReg datalo,
                           TCGReg datahi, TCGReg addr, MemOpIdx oi)
 {
-    if (TCG_TARGET_REG_BITS == 32) {
-        tcg_out_qemu_st(s, datalo, datahi, addr, oi, type);
-    } else {
-        tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, false);
-    }
+    tcg_out_qemu_ldst_i128(s, datalo, datahi, addr, oi, false);
 }
 
 static const TCGOutOpQemuLdSt2 outop_qemu_st2 = {
-    .base.static_constraint =
-        TCG_TARGET_REG_BITS == 64 ? C_O0_I3(o, m, r) : C_O0_I3(r, r, r),
+    .base.static_constraint =  C_O0_I3(o, m, r),
     .out = tgen_qemu_st2,
 };
 
@@ -2767,16 +2556,11 @@ static void tcg_out_nop_fill(tcg_insn_unit *p, int count)
 #elif defined(_CALL_DARWIN)
 # define LINK_AREA_SIZE                (6 * SZR)
 # define LR_OFFSET                     (2 * SZR)
-#elif TCG_TARGET_REG_BITS == 64
+#else
 # if defined(_CALL_ELF) && _CALL_ELF == 2
 #  define LINK_AREA_SIZE               (4 * SZR)
 #  define LR_OFFSET                    (1 * SZR)
 # endif
-#else /* TCG_TARGET_REG_BITS == 32 */
-# if defined(_CALL_SYSV)
-#  define LINK_AREA_SIZE               (2 * SZR)
-#  define LR_OFFSET                    (1 * SZR)
-# endif
 #endif
 #ifndef LR_OFFSET
 # error "Unhandled abi"
@@ -3107,7 +2891,6 @@ static void tgen_eqv(TCGContext *s, TCGType type,
     tcg_out32(s, EQV | SAB(a1, a0, a2));
 }
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_extrh_i64_i32(TCGContext *s, TCGType t, TCGReg a0, TCGReg a1)
 {
     tcg_out_shri64(s, a0, a1, 32);
@@ -3117,7 +2900,6 @@ static const TCGOutOpUnary outop_extrh_i64_i32 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_extrh_i64_i32,
 };
-#endif
 
 static void tgen_divs(TCGContext *s, TCGType type,
                       TCGReg a0, TCGReg a1, TCGReg a2)
@@ -3596,7 +3378,6 @@ static const TCGOutOpBswap outop_bswap32 = {
     .out_rr = tgen_bswap32,
 };
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_bswap64(TCGContext *s, TCGType type, TCGReg dst, TCGReg src)
 {
     TCGReg t0 = dst == src ? TCG_REG_R0 : dst;
@@ -3639,7 +3420,6 @@ static const TCGOutOpUnary outop_bswap64 = {
     .base.static_constraint = C_O1_I1(r, r),
     .out_rr = tgen_bswap64,
 };
-#endif /* TCG_TARGET_REG_BITS == 64 */
 
 static void tgen_neg(TCGContext *s, TCGType type, TCGReg a0, TCGReg a1)
 {
@@ -3776,7 +3556,6 @@ static const TCGOutOpLoad outop_ld16s = {
     .out = tgen_ld16s,
 };
 
-#if TCG_TARGET_REG_BITS == 64
 static void tgen_ld32u(TCGContext *s, TCGType type, TCGReg dest,
                        TCGReg base, ptrdiff_t offset)
 {
@@ -3798,7 +3577,6 @@ static const TCGOutOpLoad outop_ld32s = {
     .base.static_constraint = C_O1_I1(r, r),
     .out = tgen_ld32s,
 };
-#endif
 
 static void tgen_st8(TCGContext *s, TCGType type, TCGReg data,
                      TCGReg base, ptrdiff_t offset)
@@ -4278,14 +4056,6 @@ static void tcg_out_vec_op(TCGContext *s, TCGOpcode opc,
         tcg_out_bitsel_vec(s, a0, a1, a2, args[3]);
         return;
 
-    case INDEX_op_dup2_vec:
-        assert(TCG_TARGET_REG_BITS == 32);
-        /* With inputs a1 = xLxx, a2 = xHxx  */
-        tcg_out32(s, VMRGHW | VRT(a0) | VRA(a2) | VRB(a1));  /* a0  = xxHL */
-        tcg_out_vsldoi(s, TCG_VEC_TMP1, a0, a0, 8);          /* tmp = HLxx */
-        tcg_out_vsldoi(s, a0, a0, TCG_VEC_TMP1, 8);          /* a0  = HLHL */
-        return;
-
     case INDEX_op_ppc_mrgh_vec:
         insn = mrgh_op[vece];
         break;
@@ -4465,7 +4235,6 @@ tcg_target_op_def(TCGOpcode op, TCGType type, unsigned flags)
     case INDEX_op_ppc_muleu_vec:
     case INDEX_op_ppc_mulou_vec:
     case INDEX_op_ppc_pkum_vec:
-    case INDEX_op_dup2_vec:
         return C_O1_I2(v, v, v);
 
     case INDEX_op_not_vec:
@@ -4543,9 +4312,7 @@ static void tcg_target_init(TCGContext *s)
 #if defined(_CALL_SYSV)
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R2); /* toc pointer */
 #endif
-#if defined(_CALL_SYSV) || TCG_TARGET_REG_BITS == 64
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_R13); /* thread pointer */
-#endif
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_TMP1);
     tcg_regset_set_reg(s->reserved_regs, TCG_REG_TMP2);
     tcg_regset_set_reg(s->reserved_regs, TCG_VEC_TMP1);
@@ -4566,11 +4333,7 @@ typedef struct {
 /* We're expecting a 2 byte uleb128 encoded value.  */
 QEMU_BUILD_BUG_ON(FRAME_SIZE >= (1 << 14));
 
-#if TCG_TARGET_REG_BITS == 64
-# define ELF_HOST_MACHINE EM_PPC64
-#else
-# define ELF_HOST_MACHINE EM_PPC
-#endif
+#define ELF_HOST_MACHINE EM_PPC64
 
 static DebugFrame debug_frame = {
     .cie.len = sizeof(DebugFrameCIE)-4, /* length after .len member */

From 3a2d5612a7422732b648b46d4b934e2e54622fd6 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 14:31:56 +0100
Subject: [PATCH 1444/2396] .gitlab-ci.d/buildtest.yml: Install 'file' for the
 Coverity job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The coverity-scan upload job has started failing as of 30th
September:

[ERROR] Cannot find '/usr/bin/file' command, and no 'file' command is found in the PATH
        Coverity Capture uses this tool to identify the file type of executables.
        Please ensure '/usr/bin/file' is available, or add the 'file' utility to your PATH.

This seems to have broken when we moved our containers from Fedora 40
to 41 -- probably F40 indirectly pulled in 'file' via some other
dependency, but in F41 it does not.

Explicitly install 'file' for the coverity job, in the same way we
already do for curl and wget.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251017133156.926094-1-peter.maydell@linaro.org>
---
 .gitlab-ci.d/buildtest.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 0502094b9a..21f6d7e96f 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -759,7 +759,7 @@ coverity:
     - job: amd64-fedora-container
       optional: true
   before_script:
-    - dnf install -y curl wget
+    - dnf install -y curl wget file
   script:
     # would be nice to cancel the job if over quota (https://gitlab.com/gitlab-org/gitlab/-/issues/256089)
     # for example:

From b83d8be7a73d977440cd852620a0142a1e551434 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:46 +0100
Subject: [PATCH 1445/2396] gitlab: use template for ubuntu-24.04-aarch64 jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most of the test is pure boilerplate so to save ourselves from
repetition move all the main bits into a minimal copy of
native_build_job_template but without the caching.

We keep all the current allow_fail and configure setups but do take
the opportunity to replace the -j`nproc --ignore=40` hack with
something that almost, but not quite, saturates the machine its being
built on.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251016150357.876415-2-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .../custom-runners/ubuntu-24.04-aarch64.yml   | 230 ++++++++----------
 1 file changed, 96 insertions(+), 134 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index d26c7827f4..46db9ae013 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -2,150 +2,112 @@
 # setup by the scripts/ci/setup/ubuntu/build-environment.yml task
 # "Install basic packages to build QEMU on Ubuntu 24.04"
 
+.ubuntu_aarch64_template:
+  extends: .custom_runner_template
+  needs: []
+  stage: build
+  tags:
+    - ubuntu_24.04
+    - aarch64
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+  before_script:
+    - source scripts/ci/gitlab-ci-section
+    - section_start setup "Pre-script setup"
+    - JOBS=$(expr $(nproc) - 4)
+    - section_end setup
+  script:
+    - mkdir build
+    - cd build
+    - section_start configure "Running configure"
+    - ../configure $CONFIGURE_ARGS ||
+          { cat config.log meson-logs/meson-log.txt && exit 1; }
+    - section_end configure
+    - section_start build "Building QEMU"
+    - make --output-sync -j"$JOBS"
+    - section_end build
+    - section_start test "Running tests"
+    - if test -n "$MAKE_CHECK_ARGS";
+      then
+        make -j"$JOBS" $MAKE_CHECK_ARGS ;
+      fi
+    - section_end test
+
 ubuntu-24.04-aarch64-all-linux-static:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
- - if: "$AARCH64_RUNNER_AVAILABLE"
- script:
- - mkdir build
- - cd build
- # Disable -static-pie due to build error with system libc:
- # https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1987438
- - ../configure --enable-debug --static --disable-system --disable-pie
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make check-tcg
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    # Disable -static-pie due to build error with system libc:
+    # https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1987438
+    CONFIGURE_ARGS: --enable-debug --static --disable-system --disable-pie
+    MAKE_CHECK_ARGS: check-tcg
 
 ubuntu-24.04-aarch64-all:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH64_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    MAKE_CHECK_ARGS: check
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+      when: manual
+      allow_failure: true
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+      when: manual
+      allow_failure: true
 
 ubuntu-24.04-aarch64-without-defaults:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH64_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --disable-user --without-default-devices --without-default-features
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    CONFIGURE_ARGS: --disable-user --without-default-devices --without-default-features
+    MAKE_CHECK_ARGS: check
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+      when: manual
+      allow_failure: true
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+      when: manual
+      allow_failure: true
 
 ubuntu-24.04-aarch64-alldbg:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
- - if: "$AARCH64_RUNNER_AVAILABLE"
- script:
- - mkdir build
- - cd build
- - ../configure --enable-debug
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make clean
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    CONFIGURE_ARGS: --enable-debug
+    MAKE_CHECK_ARGS: check-tcg
 
 ubuntu-24.04-aarch64-clang:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH64_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --disable-libssh --cc=clang --cxx=clang++ --enable-ubsan
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-ubsan
+    MAKE_CHECK_ARGS: check
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+      when: manual
+      allow_failure: true
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+      when: manual
+      allow_failure: true
 
 ubuntu-24.04-aarch64-tci:
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH64_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --enable-tcg-interpreter
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
+  extends: .ubuntu_aarch64_template
+  variables:
+    CONFIGURE_ARGS: --enable-tcg-interpreter
+    MAKE_CHECK_ARGS: check
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+      when: manual
+      allow_failure: true
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+      when: manual
+      allow_failure: true
 
 ubuntu-24.04-aarch64-notcg:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch64
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH64_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --disable-tcg --with-devices-aarch64=minimal
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
+  extends: .ubuntu_aarch64_template
+  variables:
+    CONFIGURE_ARGS: --disable-tcg --with-devices-aarch64=minimal
+    MAKE_CHECK_ARGS: check
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+      when: manual
+      allow_failure: true
+    - if: "$AARCH64_RUNNER_AVAILABLE"
+      when: manual
+      allow_failure: true

From 76a7a7158722bb032ab7169f44d3c32cb3442152 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:47 +0100
Subject: [PATCH 1446/2396] gitlab: drop aarch32 runner and associated bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While working out what hoops to jump through to get a full set of
aarch32 packages installed on the aarch64 runner it was pointed out 32
bit host support is deprecated. As the extra packages where needed for
system emulation (marked deprecated since 8.0!) there didn't seem much
point keeping this in.

While the full expunging of 32 bit host support will probably be done
for 11.0 we can at least reduce the CI burden a bit now.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251016150357.876415-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners.yml               |   1 -
 .../custom-runners/ubuntu-24.04-aarch32.yml   |  25 ----
 scripts/ci/setup/ubuntu/build-environment.yml |  17 ---
 .../setup/ubuntu/ubuntu-2204-armhf-cross.yml  | 127 ------------------
 4 files changed, 170 deletions(-)
 delete mode 100644 .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
 delete mode 100644 scripts/ci/setup/ubuntu/ubuntu-2204-armhf-cross.yml

diff --git a/.gitlab-ci.d/custom-runners.yml b/.gitlab-ci.d/custom-runners.yml
index 3eb8216d57..142fbf4a24 100644
--- a/.gitlab-ci.d/custom-runners.yml
+++ b/.gitlab-ci.d/custom-runners.yml
@@ -31,4 +31,3 @@
 include:
   - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml'
   - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml'
-  - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml'
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
deleted file mode 100644
index 75029c9187..0000000000
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch32.yml
+++ /dev/null
@@ -1,25 +0,0 @@
-# All ubuntu-24.04 jobs should run successfully in an environment
-# setup by the scripts/ci/setup/ubuntu/build-environment.yml task
-# "Install basic packages to build QEMU on Ubuntu 24.04"
-
-ubuntu-24.04-aarch32-all:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - aarch32
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$AARCH32_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --cross-prefix=arm-linux-gnueabihf-
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc --ignore=40`
- - make --output-sync -j`nproc --ignore=40` check
diff --git a/scripts/ci/setup/ubuntu/build-environment.yml b/scripts/ci/setup/ubuntu/build-environment.yml
index 6042750cb4..0f8ec5fab0 100644
--- a/scripts/ci/setup/ubuntu/build-environment.yml
+++ b/scripts/ci/setup/ubuntu/build-environment.yml
@@ -47,21 +47,4 @@
         - ansible_facts['distribution'] == 'Ubuntu'
         - ansible_facts['distribution_version'] == '24.04'
 
-    - name: Install armhf cross-compile packages to build QEMU on AArch64 Ubuntu 24.04
-      package:
-        name:
-          - binutils-arm-linux-gnueabihf
-          - gcc-arm-linux-gnueabihf
-          - libblkid-dev:armhf
-          - libc6-dev:armhf
-          - libffi-dev:armhf
-          - libglib2.0-dev:armhf
-          - libmount-dev:armhf
-          - libpcre2-dev:armhf
-          - libpixman-1-dev:armhf
-          - zlib1g-dev:armhf
-      when:
-        - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '24.04'
-        - ansible_facts['architecture'] == 'aarch64'
 
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2204-armhf-cross.yml b/scripts/ci/setup/ubuntu/ubuntu-2204-armhf-cross.yml
deleted file mode 100644
index 0cc34cd10b..0000000000
--- a/scripts/ci/setup/ubuntu/ubuntu-2204-armhf-cross.yml
+++ /dev/null
@@ -1,127 +0,0 @@
-# THIS FILE WAS AUTO-GENERATED
-#
-#  $ lcitool variables --cross-arch armv7l ubuntu-2204 qemu
-#
-# https://gitlab.com/libvirt/libvirt-ci
-
-packages:
-  - bash
-  - bc
-  - bison
-  - bsdextrautils
-  - bzip2
-  - ca-certificates
-  - ccache
-  - dbus
-  - debianutils
-  - diffutils
-  - exuberant-ctags
-  - findutils
-  - flex
-  - gcc
-  - gcovr
-  - gettext
-  - git
-  - hostname
-  - libglib2.0-dev
-  - libpcre2-dev
-  - libsndio-dev
-  - libspice-protocol-dev
-  - llvm
-  - locales
-  - make
-  - meson
-  - mtools
-  - ncat
-  - ninja-build
-  - openssh-client
-  - pkgconf
-  - python3
-  - python3-numpy
-  - python3-opencv
-  - python3-pillow
-  - python3-pip
-  - python3-sphinx
-  - python3-sphinx-rtd-theme
-  - python3-tomli
-  - python3-venv
-  - python3-yaml
-  - rpm2cpio
-  - sed
-  - socat
-  - sparse
-  - swtpm
-  - tar
-  - tesseract-ocr
-  - tesseract-ocr-eng
-  - xorriso
-  - zstd
-  - gcc-arm-linux-gnueabihf
-  - libaio-dev:armhf
-  - libasan6:armhf
-  - libasound2-dev:armhf
-  - libattr1-dev:armhf
-  - libbpf-dev:armhf
-  - libbrlapi-dev:armhf
-  - libbz2-dev:armhf
-  - libc6-dev:armhf
-  - libcacard-dev:armhf
-  - libcap-ng-dev:armhf
-  - libcapstone-dev:armhf
-  - libcmocka-dev:armhf
-  - libcurl4-gnutls-dev:armhf
-  - libdaxctl-dev:armhf
-  - libdrm-dev:armhf
-  - libepoxy-dev:armhf
-  - libfdt-dev:armhf
-  - libffi-dev:armhf
-  - libfuse3-dev:armhf
-  - libgbm-dev:armhf
-  - libgcrypt20-dev:armhf
-  - libglib2.0-dev:armhf
-  - libglusterfs-dev:armhf
-  - libgnutls28-dev:armhf
-  - libgtk-3-dev:armhf
-  - libibumad-dev:armhf
-  - libibverbs-dev:armhf
-  - libiscsi-dev:armhf
-  - libjemalloc-dev:armhf
-  - libjpeg-turbo8-dev:armhf
-  - libjson-c-dev:armhf
-  - liblttng-ust-dev:armhf
-  - liblzo2-dev:armhf
-  - libncursesw5-dev:armhf
-  - libnfs-dev:armhf
-  - libnuma-dev:armhf
-  - libpam0g-dev:armhf
-  - libpipewire-0.3-dev:armhf
-  - libpixman-1-dev:armhf
-  - libpng-dev:armhf
-  - libpulse-dev:armhf
-  - librbd-dev:armhf
-  - librdmacm-dev:armhf
-  - libsasl2-dev:armhf
-  - libsdl2-dev:armhf
-  - libsdl2-image-dev:armhf
-  - libseccomp-dev:armhf
-  - libselinux1-dev:armhf
-  - libslirp-dev:armhf
-  - libsnappy-dev:armhf
-  - libspice-server-dev:armhf
-  - libssh-dev:armhf
-  - libsystemd-dev:armhf
-  - libtasn1-6-dev:armhf
-  - libubsan1:armhf
-  - libudev-dev:armhf
-  - liburing-dev:armhf
-  - libusb-1.0-0-dev:armhf
-  - libusbredirhost-dev:armhf
-  - libvdeplug-dev:armhf
-  - libvirglrenderer-dev:armhf
-  - libvte-2.91-dev:armhf
-  - libxen-dev:armhf
-  - libzstd-dev:armhf
-  - nettle-dev:armhf
-  - systemtap-sdt-dev:armhf
-  - zlib1g-dev:armhf
-

From 77dc9d662f80b9f4eb450df27f60a0a9b3c97785 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 16 Oct 2025 16:03:48 +0100
Subject: [PATCH 1447/2396] tests/tcg/multiarch/linux/linux-test: Don't try to
 test atime update
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The linux-test test includes an attempt to check the utime and stat
syscalls by setting the atime and mtime of a file to specific values,
and then calling stat() to check that the values read back correctly.

Unfortunately this is flaky, as it will fail if some other process
(for instance a virus scanner, backup program, etc) gets in and reads
the file between the utime() and stat() call, resulting in a host
syscall sequence like this:

utimensat(AT_FDCWD, "file2",
  [{tv_sec=1001, tv_nsec=0} /* 1970-01-01T01:16:41+0100 */,
   {tv_sec=1000, tv_nsec=0} /* 1970-01-01T01:16:40+0100 */], 0) = 0
# successfully set atime to 1001 and mtime to 1000
statx(AT_FDCWD, "file2", AT_STATX_SYNC_AS_STAT|AT_NO_AUTOMOUNT,
  STATX_BASIC_STATS,
  {stx_mask=STATX_BASIC_STATS|STATX_MNT_ID,
   stx_blksize=4096, stx_attributes=0, stx_nlink=1, stx_uid=32808,
   stx_gid=32808, stx_mode=S_IFREG|0600, stx_ino=21659016,
   stx_size=100, stx_blocks=8,
   stx_attributes_mask=STATX_ATTR_COMPRESSED|STATX_ATTR_IMMUTABLE|
         STATX_ATTR_APPEND|STATX_ATTR_NODUMP|STATX_ATTR_ENCRYPTED|
         STATX_ATTR_AUTOMOUNT|STATX_ATTR_MOUNT_ROOT|STATX_ATTR_VERITY|
         STATX_ATTR_DAX,
   stx_atime={tv_sec=1760091862, tv_nsec=63509009} /* 2025-10-10T11:24:22.063509009+0100 */,
   stx_ctime={tv_sec=1760091862, tv_nsec=63509009} /* 2025-10-10T11:24:22.063509009+0100 */,
   stx_mtime={tv_sec=1000, tv_nsec=0} /* 1970-01-01T01:16:40+0100 */,
   stx_rdev_major=0, stx_rdev_minor=0, stx_dev_major=252,
   stx_dev_minor=0, stx_mnt_id=0x1f}) = 0
# but when we statx the file, we get back an mtime of 1000
# but an atime corresponding to when the other process read it

and which will cause the test program to fail with the error
message "stat time".

In theory we could defend against this by e.g.  operating on files in
a dummy loopback mount filesystem which we mounted as 'noatime', but
this isn't worth the hassle.  Just drop the check on atime.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251016150357.876415-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/tcg/multiarch/linux/linux-test.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tests/tcg/multiarch/linux/linux-test.c b/tests/tcg/multiarch/linux/linux-test.c
index 64f57cb287..bf6e0fda26 100644
--- a/tests/tcg/multiarch/linux/linux-test.c
+++ b/tests/tcg/multiarch/linux/linux-test.c
@@ -155,9 +155,14 @@ static void test_file(void)
         error("stat mode");
     if ((st.st_mode & 0777) != 0600)
         error("stat mode2");
-    if (st.st_atime != 1001 ||
-        st.st_mtime != 1000)
+    /*
+     * Only check mtime, not atime: other processes such as
+     * virus scanners might race with this test program and get
+     * in and update the atime, causing random failures.
+     */
+    if (st.st_mtime != 1000) {
         error("stat time");
+    }
 
     chk_error(stat(tmpdir, &st));
     if (!S_ISDIR(st.st_mode))

From 0c6d6d79a5cbd538c6c0798b1068f37bfbbf9693 Mon Sep 17 00:00:00 2001
From: Dongwon Kim <dongwon.kim@intel.com>
Date: Thu, 16 Oct 2025 16:03:50 +0100
Subject: [PATCH 1448/2396] ui/gtk-gl-area: Remove extra draw call in refresh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This partially reverts commit 77bf310084dad38b3a2badf01766c659056f1cf2
which causes some guest display corruption when gtk-gl-area
is used for GTK rendering (e.g. Wayland Compositor) possibly due to
simulataneous accesses on the guest frame buffer by host compositor
and the guest.

Fixes: 77bf310084 ("ui/gtk: Draw guest frame at refresh cycle")
Reported-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reported-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Cc: Marc-André Lureau <marcandre.lureau@redhat.com>
Cc: Vivek Kasireddy <vivek.kasireddy@intel.com>
Signed-off-by: Dongwon Kim <dongwon.kim@intel.com>
Message-Id: <20250214170813.2234754-1-dongwon.kim@intel.com>
Message-ID: <20250603110204.838117-12-alex.bennee@linaro.org>
Cc: qemu-stable@nongnu.org
Message-ID: <20251016150357.876415-6-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 ui/gtk-gl-area.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/ui/gtk-gl-area.c b/ui/gtk-gl-area.c
index 05fc38096e..cd86022d26 100644
--- a/ui/gtk-gl-area.c
+++ b/ui/gtk-gl-area.c
@@ -165,7 +165,22 @@ void gd_gl_area_refresh(DisplayChangeListener *dcl)
 
     if (vc->gfx.guest_fb.dmabuf &&
         qemu_dmabuf_get_draw_submitted(vc->gfx.guest_fb.dmabuf)) {
-        gd_gl_area_draw(vc);
+        /*
+         * gd_egl_refresh() calls gd_egl_draw() if a DMA-BUF draw has already
+         * been submitted, but this function does not call gd_gl_area_draw() in
+         * such a case due to display corruption.
+         *
+         * Calling gd_gl_area_draw() is necessary to prevent a situation where
+         * there is a scheduled draw event but it won't happen bacause the window
+         * is currently in inactive state (minimized or tabified). If draw is not
+         * done for a long time, gl_block timeout and/or fence timeout (on the
+         * guest) will happen eventually.
+         *
+         * However, it is found that calling gd_gl_area_draw() here causes guest
+         * display corruption on a Wayland Compositor. The display corruption is
+         * more serious than the possible fence timeout so gd_gl_area_draw() is
+         * omitted for now.
+         */
         return;
     }
 

From 9f714c4b2064d11ca422ab71c973f41ebaea121e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:51 +0100
Subject: [PATCH 1449/2396] hw/display: add blob map/unmap trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As these events happen dynamically as the guest does various things
they are quite handy to trace.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20251016150357.876415-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 hw/display/trace-events       | 2 ++
 hw/display/virtio-gpu-virgl.c | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/hw/display/trace-events b/hw/display/trace-events
index 52786e6e18..e323a82cff 100644
--- a/hw/display/trace-events
+++ b/hw/display/trace-events
@@ -38,6 +38,8 @@ virtio_gpu_cmd_set_scanout_blob(uint32_t id, uint32_t res, uint32_t w, uint32_t
 virtio_gpu_cmd_res_create_2d(uint32_t res, uint32_t fmt, uint32_t w, uint32_t h) "res 0x%x, fmt 0x%x, w %d, h %d"
 virtio_gpu_cmd_res_create_3d(uint32_t res, uint32_t fmt, uint32_t w, uint32_t h, uint32_t d) "res 0x%x, fmt 0x%x, w %d, h %d, d %d"
 virtio_gpu_cmd_res_create_blob(uint32_t res, uint64_t size) "res 0x%x, size %" PRId64
+virtio_gpu_cmd_res_map_blob(uint32_t res, void *vmr, void *mr) "res 0x%x, vmr %p, mr %p"
+virtio_gpu_cmd_res_unmap_blob(uint32_t res, void *mr, bool finish_unmapping) "res 0x%x, mr %p, finish_unmapping %d"
 virtio_gpu_cmd_res_unref(uint32_t res) "res 0x%x"
 virtio_gpu_cmd_res_back_attach(uint32_t res) "res 0x%x"
 virtio_gpu_cmd_res_back_detach(uint32_t res) "res 0x%x"
diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 94ddc01f91..07f6355ad6 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -134,6 +134,8 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g,
 
     res->mr = mr;
 
+    trace_virtio_gpu_cmd_res_map_blob(res->base.resource_id, vmr, mr);
+
     return 0;
 }
 
@@ -153,6 +155,8 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g,
 
     vmr = to_hostmem_region(res->mr);
 
+    trace_virtio_gpu_cmd_res_unmap_blob(res->base.resource_id, mr, vmr->finish_unmapping);
+
     /*
      * Perform async unmapping in 3 steps:
      *

From 8a545a336d577e87b47e39031c17dd89eebd77d7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Thu, 16 Oct 2025 16:03:52 +0100
Subject: [PATCH 1450/2396] contrib/plugins/uftrace_symbols.py: generate debug
 files to map symbols to source
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enhance uftrace_symbols.py to generate .dbg files, containing
source location for every symbol present in .sym file.
It allows to use `uftrace {replay,dump} --srcline` and show origin of
functions, connecting trace to original source code.

It was first implemented with pyelftools DWARF parser, which was way
too slow (~minutes) to get locations for every symbol in the linux
kernel. Thus, we use `addr2line` instead, which runs in seconds.

As well, there were some bugs with latest pyelftools release,
requiring to run master version, which is not installable with pip.
Thus, since we now require binutils (addr2line), we can ditch pyelftools
based implementation and simply rely on `nm` to get symbols information,
which is faster and better.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251016150357.876415-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/plugins/uftrace_symbols.py | 116 +++++++++++++++++++----------
 1 file changed, 76 insertions(+), 40 deletions(-)

diff --git a/contrib/plugins/uftrace_symbols.py b/contrib/plugins/uftrace_symbols.py
index b49e03203c..45fb79c7a5 100755
--- a/contrib/plugins/uftrace_symbols.py
+++ b/contrib/plugins/uftrace_symbols.py
@@ -1,7 +1,7 @@
 #!/usr/bin/env python3
 # -*- coding: utf-8 -*-
 #
-# Create symbols and mapping files for uftrace.
+# Create symbols, debug and mapping files for uftrace.
 #
 # Copyright 2025 Linaro Ltd
 # Author: Pierrick Bouvier <pierrick.bouvier@linaro.org>
@@ -9,44 +9,71 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import argparse
-import elftools # pip install pyelftools
 import os
+import subprocess
 
-from elftools.elf.elffile import ELFFile
-from elftools.elf.sections import SymbolTableSection
+class Symbol:
+    def __init__(self, name, addr, size):
+        self.name = name
+        # clamp addr to 48 bits, like uftrace entries
+        self.addr = addr & 0xffffffffffff
+        self.full_addr = addr
+        self.size = size
 
-def elf_func_symbols(elf):
-    symbol_tables = [(idx, s) for idx, s in enumerate(elf.iter_sections())
-                  if isinstance(s, SymbolTableSection)]
-    symbols = []
-    for _, section in symbol_tables:
-        for _, symbol in enumerate(section.iter_symbols()):
-            if symbol_size(symbol) == 0:
-                continue
-            type = symbol['st_info']['type']
-            if type == 'STT_FUNC' or type == 'STT_NOTYPE':
-                symbols.append(symbol)
-    symbols.sort(key = lambda x: symbol_addr(x))
+    def set_loc(self, file, line):
+        self.file = file
+        self.line = line
+
+def get_symbols(elf_file):
+    symbols=[]
+    try:
+        out = subprocess.check_output(['nm', '--print-size', elf_file],
+                                      stderr=subprocess.STDOUT,
+                                      text=True)
+    except subprocess.CalledProcessError as e:
+        print(e.output)
+        raise
+    out = out.strip().split('\n')
+    for line in out:
+        info = line.split(' ')
+        if len(info) == 3:
+            # missing size information
+            continue
+        addr, size, type, name = info
+        # add only symbols from .text section
+        if type.lower() != 't':
+            continue
+        addr = int(addr, 16)
+        size = int(size, 16)
+        symbols.append(Symbol(name, addr, size))
+    symbols.sort(key = lambda x: x.addr)
     return symbols
 
-def symbol_size(symbol):
-    return symbol['st_size']
-
-def symbol_addr(symbol):
-    addr = symbol['st_value']
-    # clamp addr to 48 bits, like uftrace entries
-    return addr & 0xffffffffffff
-
-def symbol_name(symbol):
-    return symbol.name
+def find_symbols_locations(elf_file, symbols):
+    addresses = '\n'.join([hex(x.full_addr) for x in symbols])
+    try:
+        out = subprocess.check_output(['addr2line', '--exe', elf_file],
+                                      stderr=subprocess.STDOUT,
+                                      input=addresses, text=True)
+    except subprocess.CalledProcessError as e:
+        print(e.output)
+        raise
+    out = out.strip().split('\n')
+    assert len(out) == len(symbols)
+    for i in range(len(symbols)):
+        s = symbols[i]
+        file, line = out[i].split(':')
+        # addr2line may return 'line (discriminator [0-9]+)' sometimes,
+        # remove this to keep only line number.
+        line = line.split(' ')[0]
+        s.set_loc(file, line)
 
 class BinaryFile:
     def __init__(self, path, map_offset):
         self.fullpath = os.path.realpath(path)
         self.map_offset = map_offset
-        with open(path, 'rb') as f:
-            self.elf = ELFFile(f)
-            self.symbols = elf_func_symbols(self.elf)
+        self.symbols = get_symbols(self.fullpath)
+        find_symbols_locations(self.fullpath, self.symbols)
 
     def path(self):
         return self.fullpath
@@ -56,24 +83,31 @@ class BinaryFile:
 
     def addr_end(self):
         last_sym = self.symbols[-1]
-        return symbol_addr(last_sym) + symbol_size(last_sym) + self.map_offset
+        return last_sym.addr + last_sym.size + self.map_offset
 
     def generate_symbol_file(self, prefix_symbols):
         binary_name = os.path.basename(self.fullpath)
-        sym_file_path = f'./uftrace.data/{binary_name}.sym'
+        sym_file_path = os.path.join('uftrace.data', f'{binary_name}.sym')
         print(f'{sym_file_path} ({len(self.symbols)} symbols)')
         with open(sym_file_path, 'w') as sym_file:
             # print hexadecimal addresses on 48 bits
             addrx = "0>12x"
             for s in self.symbols:
-                addr = symbol_addr(s)
+                addr = s.addr
                 addr = f'{addr:{addrx}}'
-                size = f'{symbol_size(s):{addrx}}'
-                name = symbol_name(s)
+                size = f'{s.size:{addrx}}'
                 if prefix_symbols:
-                    name = f'{binary_name}:{name}'
+                    name = f'{binary_name}:{s.name}'
                 print(addr, size, 'T', name, file=sym_file)
 
+    def generate_debug_file(self):
+        binary_name = os.path.basename(self.fullpath)
+        dbg_file_path = os.path.join('uftrace.data', f'{binary_name}.dbg')
+        with open(dbg_file_path, 'w') as dbg_file:
+            for s in self.symbols:
+                print(f'F: {hex(s.addr)} {s.name}', file=dbg_file)
+                print(f'L: {s.line} {s.file}', file=dbg_file)
+
 def parse_parameter(p):
     s = p.split(":")
     path = s[0]
@@ -84,7 +118,7 @@ def parse_parameter(p):
     offset = s[1]
     if not offset.startswith('0x'):
         err = f'offset "{offset}" is not an hexadecimal constant. '
-        err += 'It should starts with "0x".'
+        err += 'It should start with "0x".'
         raise ValueError(err)
     offset = int(offset, 16)
     return path, offset
@@ -97,7 +131,7 @@ def is_from_user_mode(map_file_path):
     return False
 
 def generate_map(binaries):
-    map_file_path = './uftrace.data/sid-0.map'
+    map_file_path = os.path.join('uftrace.data', 'sid-0.map')
 
     if is_from_user_mode(map_file_path):
         print(f'do not overwrite {map_file_path} generated from qemu-user')
@@ -124,7 +158,8 @@ def generate_map(binaries):
 
 def main():
     parser = argparse.ArgumentParser(description=
-                                     'generate symbol files for uftrace')
+                                     'generate symbol files for uftrace. '
+                                     'Require binutils (nm and addr2line).')
     parser.add_argument('elf_file', nargs='+',
                         help='path to an ELF file. '
                         'Use /path/to/file:0xdeadbeef to add a mapping offset.')
@@ -133,8 +168,8 @@ def main():
                         action=argparse.BooleanOptionalAction)
     args = parser.parse_args()
 
-    if not os.path.exists('./uftrace.data'):
-        os.mkdir('./uftrace.data')
+    if not os.path.exists('uftrace.data'):
+        os.mkdir('uftrace.data')
 
     binaries = []
     for file in args.elf_file:
@@ -145,6 +180,7 @@ def main():
 
     for b in binaries:
         b.generate_symbol_file(args.prefix_symbols)
+        b.generate_debug_file()
 
     generate_map(binaries)
 

From 487ce6ce999ca8f41960c19981ae3f01f6209d54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:53 +0100
Subject: [PATCH 1451/2396] docs/system: split VirtIO devices from the rest
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In an effort to tidy up our device documentation split the VirtIO docs
from the rest of the index and put the index to them at the front of
the list. Sort the remaining entries alphabetically and tweak the
references appropriately.

Add a short preface to the VirtIO section nudging users to use VirtIO
unless they specifically want a particular piece of hardware
emulation.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251016150357.876415-9-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/device-emulation.rst              | 18 +++++------
 docs/system/devices/vfio-user.rst             |  2 +-
 docs/system/devices/virtio/index.rst          | 30 +++++++++++++++++++
 .../devices/{ => virtio}/vhost-user-input.rst |  0
 .../devices/{ => virtio}/vhost-user-rng.rst   |  0
 .../devices/{ => virtio}/vhost-user.rst       |  0
 .../devices/{ => virtio}/virtio-gpu.rst       |  0
 .../devices/{ => virtio}/virtio-pmem.rst      |  0
 .../devices/{ => virtio}/virtio-snd.rst       |  0
 9 files changed, 38 insertions(+), 12 deletions(-)
 create mode 100644 docs/system/devices/virtio/index.rst
 rename docs/system/devices/{ => virtio}/vhost-user-input.rst (100%)
 rename docs/system/devices/{ => virtio}/vhost-user-rng.rst (100%)
 rename docs/system/devices/{ => virtio}/vhost-user.rst (100%)
 rename docs/system/devices/{ => virtio}/virtio-gpu.rst (100%)
 rename docs/system/devices/{ => virtio}/virtio-pmem.rst (100%)
 rename docs/system/devices/{ => virtio}/virtio-snd.rst (100%)

diff --git a/docs/system/device-emulation.rst b/docs/system/device-emulation.rst
index 911381643f..db714ad47a 100644
--- a/docs/system/device-emulation.rst
+++ b/docs/system/device-emulation.rst
@@ -82,22 +82,18 @@ Emulated Devices
 .. toctree::
    :maxdepth: 1
 
+   devices/virtio/index.rst
+
    devices/can.rst
+   devices/canokey.rst
    devices/ccid.rst
    devices/cxl.rst
-   devices/vfio-user.rst
-   devices/ivshmem.rst
+   devices/igb.rst
    devices/ivshmem-flat.rst
+   devices/ivshmem.rst
    devices/keyboard.rst
    devices/net.rst
    devices/nvme.rst
-   devices/usb.rst
-   devices/vhost-user.rst
-   devices/virtio-gpu.rst
-   devices/virtio-pmem.rst
-   devices/virtio-snd.rst
-   devices/vhost-user-input.rst
-   devices/vhost-user-rng.rst
-   devices/canokey.rst
    devices/usb-u2f.rst
-   devices/igb.rst
+   devices/usb.rst
+   devices/vfio-user.rst
diff --git a/docs/system/devices/vfio-user.rst b/docs/system/devices/vfio-user.rst
index b6dcaa5615..30c2215f4e 100644
--- a/docs/system/devices/vfio-user.rst
+++ b/docs/system/devices/vfio-user.rst
@@ -6,7 +6,7 @@ vfio-user
 
 QEMU includes a ``vfio-user`` client. The ``vfio-user`` specification allows for
 implementing (PCI) devices in userspace outside of QEMU; it is similar to
-``vhost-user`` in this respect (see :doc:`vhost-user`), but can emulate arbitrary
+``vhost-user`` in this respect (see :doc:`virtio/vhost-user`), but can emulate arbitrary
 PCI devices, not just ``virtio``. Whereas ``vfio`` is handled by the host
 kernel, ``vfio-user``, while similar in implementation, is handled entirely in
 userspace.
diff --git a/docs/system/devices/virtio/index.rst b/docs/system/devices/virtio/index.rst
new file mode 100644
index 0000000000..fc457ca74c
--- /dev/null
+++ b/docs/system/devices/virtio/index.rst
@@ -0,0 +1,30 @@
+VirtIO Devices
+==============
+
+VirtIO devices are paravirtualized devices designed to be efficient to
+emulate and virtualize. Unless you are specifically trying to exercise
+a driver for some particular hardware they are the recommended device
+models to use for virtual machines.
+
+The `VirtIO specification`_ is an open standard managed by OASIS. It
+describes how a *driver* in a guest operating system interacts with
+the *device* model provided by QEMU. Multiple Operating Systems
+support drivers for VirtIO with Linux perhaps having the widest range
+of device types supported.
+
+The device implementation can either be provided wholly by QEMU, or in
+concert with the kernel (known as *vhost*). The device implementation
+can also be off-loaded to an external process via :ref:`vhost user
+<vhost_user>`.
+
+.. toctree::
+   :maxdepth: 1
+
+   virtio-gpu.rst
+   virtio-pmem.rst
+   virtio-snd.rst
+   vhost-user.rst
+   vhost-user-input.rst
+   vhost-user-rng.rst
+
+.. _VirtIO specification: https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html
diff --git a/docs/system/devices/vhost-user-input.rst b/docs/system/devices/virtio/vhost-user-input.rst
similarity index 100%
rename from docs/system/devices/vhost-user-input.rst
rename to docs/system/devices/virtio/vhost-user-input.rst
diff --git a/docs/system/devices/vhost-user-rng.rst b/docs/system/devices/virtio/vhost-user-rng.rst
similarity index 100%
rename from docs/system/devices/vhost-user-rng.rst
rename to docs/system/devices/virtio/vhost-user-rng.rst
diff --git a/docs/system/devices/vhost-user.rst b/docs/system/devices/virtio/vhost-user.rst
similarity index 100%
rename from docs/system/devices/vhost-user.rst
rename to docs/system/devices/virtio/vhost-user.rst
diff --git a/docs/system/devices/virtio-gpu.rst b/docs/system/devices/virtio/virtio-gpu.rst
similarity index 100%
rename from docs/system/devices/virtio-gpu.rst
rename to docs/system/devices/virtio/virtio-gpu.rst
diff --git a/docs/system/devices/virtio-pmem.rst b/docs/system/devices/virtio/virtio-pmem.rst
similarity index 100%
rename from docs/system/devices/virtio-pmem.rst
rename to docs/system/devices/virtio/virtio-pmem.rst
diff --git a/docs/system/devices/virtio-snd.rst b/docs/system/devices/virtio/virtio-snd.rst
similarity index 100%
rename from docs/system/devices/virtio-snd.rst
rename to docs/system/devices/virtio/virtio-snd.rst

From bb8ad154e6dbe29e2dc3d172d75bf87dc7222ed7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:54 +0100
Subject: [PATCH 1452/2396] docs/system: unify the naming style for VirtIO
 devices
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This makes the index look a little neater.

Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251016150357.876415-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/devices/virtio/virtio-gpu.rst  | 2 +-
 docs/system/devices/virtio/virtio-pmem.rst | 6 ++----
 docs/system/devices/virtio/virtio-snd.rst  | 2 +-
 3 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/docs/system/devices/virtio/virtio-gpu.rst b/docs/system/devices/virtio/virtio-gpu.rst
index b7eb0fc0e7..39d2fd2d21 100644
--- a/docs/system/devices/virtio/virtio-gpu.rst
+++ b/docs/system/devices/virtio/virtio-gpu.rst
@@ -1,7 +1,7 @@
 ..
    SPDX-License-Identifier: GPL-2.0-or-later
 
-virtio-gpu
+VirtIO GPU
 ==========
 
 This document explains the setup and usage of the virtio-gpu device.
diff --git a/docs/system/devices/virtio/virtio-pmem.rst b/docs/system/devices/virtio/virtio-pmem.rst
index c82ac06731..0c24de83ec 100644
--- a/docs/system/devices/virtio/virtio-pmem.rst
+++ b/docs/system/devices/virtio/virtio-pmem.rst
@@ -1,7 +1,5 @@
-
-===========
-virtio pmem
-===========
+VirtIO Persistent Memory
+========================
 
 This document explains the setup and usage of the virtio pmem device.
 The virtio pmem device is a paravirtualized persistent memory device
diff --git a/docs/system/devices/virtio/virtio-snd.rst b/docs/system/devices/virtio/virtio-snd.rst
index 2a9187fd70..3c797f66e0 100644
--- a/docs/system/devices/virtio/virtio-snd.rst
+++ b/docs/system/devices/virtio/virtio-snd.rst
@@ -1,4 +1,4 @@
-virtio sound
+VirtIO Sound
 ============
 
 This document explains the setup and usage of the Virtio sound device.

From b1401456d561aeb9edd8a4df52f6036a0e8f50b8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:55 +0100
Subject: [PATCH 1453/2396] docs/system: drop vhost-user-rng docs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a fairly lightweight document which doesn't add much to the
general advice in vhost-user. Update the vhost-user docs to point
directly at the rust-vmm repo.

Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251016150357.876415-11-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/devices/virtio/index.rst          |  1 -
 docs/system/devices/virtio/vhost-user-rng.rst | 41 -------------------
 docs/system/devices/virtio/vhost-user.rst     |  2 +-
 3 files changed, 1 insertion(+), 43 deletions(-)
 delete mode 100644 docs/system/devices/virtio/vhost-user-rng.rst

diff --git a/docs/system/devices/virtio/index.rst b/docs/system/devices/virtio/index.rst
index fc457ca74c..e3839e6182 100644
--- a/docs/system/devices/virtio/index.rst
+++ b/docs/system/devices/virtio/index.rst
@@ -25,6 +25,5 @@ can also be off-loaded to an external process via :ref:`vhost user
    virtio-snd.rst
    vhost-user.rst
    vhost-user-input.rst
-   vhost-user-rng.rst
 
 .. _VirtIO specification: https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html
diff --git a/docs/system/devices/virtio/vhost-user-rng.rst b/docs/system/devices/virtio/vhost-user-rng.rst
deleted file mode 100644
index ead1405326..0000000000
--- a/docs/system/devices/virtio/vhost-user-rng.rst
+++ /dev/null
@@ -1,41 +0,0 @@
-.. _vhost_user_rng:
-
-QEMU vhost-user-rng - RNG emulation
-===================================
-
-Background
-----------
-
-What follows builds on the material presented in vhost-user.rst - it should
-be reviewed before moving forward with the content in this file.
-
-Description
------------
-
-The vhost-user-rng device implementation was designed to work with a random
-number generator daemon such as the one found in the vhost-device crate of
-the rust-vmm project available on github [1].
-
-[1]. https://github.com/rust-vmm/vhost-device
-
-Examples
---------
-
-The daemon should be started first:
-
-::
-
-  host# vhost-device-rng --socket-path=rng.sock -c 1 -m 512 -p 1000
-
-The QEMU invocation needs to create a chardev socket the device can
-use to communicate as well as share the guests memory over a memfd.
-
-::
-
-  host# qemu-system								\
-      -chardev socket,path=$(PATH)/rng.sock,id=rng0				\
-      -device vhost-user-rng-pci,chardev=rng0					\
-      -m 4096 									\
-      -object memory-backend-file,id=mem,size=4G,mem-path=/dev/shm,share=on	\
-      -numa node,memdev=mem							\
-      ...
diff --git a/docs/system/devices/virtio/vhost-user.rst b/docs/system/devices/virtio/vhost-user.rst
index bddf8df5ed..9c9a28df38 100644
--- a/docs/system/devices/virtio/vhost-user.rst
+++ b/docs/system/devices/virtio/vhost-user.rst
@@ -45,7 +45,7 @@ platform details for what sort of virtio bus to use.
     - :ref:`vhost_user_input`
   * - vhost-user-rng
     - Entropy driver
-    - :ref:`vhost_user_rng`
+    - See https://github.com/rust-vmm/vhost-device
   * - vhost-user-scmi
     - System Control and Management Interface
     - See https://github.com/rust-vmm/vhost-device

From faa29110b903fed29ba27bad3d0d8fcc7a8aa0fa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 16 Oct 2025 16:03:56 +0100
Subject: [PATCH 1454/2396] docs/system: merge vhost-user-input into
 vhost-user-contrib
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We might as well group all the contrib submissions together and gently
dissuade people from using them in production. Update the references in
vhost-user to neatly refer to the storage daemon and the various
external rust backends.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251016150357.876415-12-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/system/devices/virtio/index.rst          |  2 +-
 .../devices/virtio/vhost-user-contrib.rst     | 87 +++++++++++++++++++
 .../devices/virtio/vhost-user-input.rst       | 45 ----------
 docs/system/devices/virtio/vhost-user.rst     | 22 ++---
 docs/system/devices/virtio/virtio-gpu.rst     |  2 +
 5 files changed, 101 insertions(+), 57 deletions(-)
 create mode 100644 docs/system/devices/virtio/vhost-user-contrib.rst
 delete mode 100644 docs/system/devices/virtio/vhost-user-input.rst

diff --git a/docs/system/devices/virtio/index.rst b/docs/system/devices/virtio/index.rst
index e3839e6182..c292101ade 100644
--- a/docs/system/devices/virtio/index.rst
+++ b/docs/system/devices/virtio/index.rst
@@ -24,6 +24,6 @@ can also be off-loaded to an external process via :ref:`vhost user
    virtio-pmem.rst
    virtio-snd.rst
    vhost-user.rst
-   vhost-user-input.rst
+   vhost-user-contrib.rst
 
 .. _VirtIO specification: https://docs.oasis-open.org/virtio/virtio/v1.3/virtio-v1.3.html
diff --git a/docs/system/devices/virtio/vhost-user-contrib.rst b/docs/system/devices/virtio/vhost-user-contrib.rst
new file mode 100644
index 0000000000..48d04d2ade
--- /dev/null
+++ b/docs/system/devices/virtio/vhost-user-contrib.rst
@@ -0,0 +1,87 @@
+vhost-user daemons in contrib
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+QEMU provides a number of :ref:`vhost_user` daemons in the contrib
+directory. They were often written when vhost-user was initially added
+to the code base. You should also consider if other vhost-user daemons
+such as those from the rust-vmm `vhost-device repository`_ are better
+suited for production use.
+
+.. _vhost-device repository: https://github.com/rust-vmm/vhost-device
+
+.. _vhost_user_block:
+
+vhost-user-block - block device
+===============================
+
+vhost-user-block is a backend for exposing block devices. It can
+present a flat file or block device as a simple block device to the
+guest. You almost certainly want to use the :ref:`storage-daemon`
+instead which supports a wide variety of storage modes and exports a
+number of interfaces including vhost-user.
+
+.. _vhost_user_gpu:
+
+vhost-user-gpu - gpu device
+===========================
+
+vhost-user-gpu presents a paravirtualized GPU and display controller.
+You probably want to use the internal :ref:`virtio_gpu` implementation
+if you want the latest features. There is also a `vhost_device_gpu`_
+daemon as part of the rust-vmm project.
+
+.. _vhost_device_gpu: https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-gpu
+
+.. _vhost_user_input:
+
+vhost-user-input - Input emulation
+==================================
+
+The Virtio input device is a paravirtualized device for input events.
+
+Description
+-----------
+
+The vhost-user-input device implementation was designed to work with a daemon
+polling on input devices and passes input events to the guest.
+
+QEMU provides a backend implementation in contrib/vhost-user-input.
+
+Linux kernel support
+--------------------
+
+Virtio input requires a guest Linux kernel built with the
+``CONFIG_VIRTIO_INPUT`` option.
+
+Examples
+--------
+
+The backend daemon should be started first:
+
+::
+
+  host# vhost-user-input --socket-path=input.sock	\
+      --evdev-path=/dev/input/event17
+
+The QEMU invocation needs to create a chardev socket to communicate with the
+backend daemon and access the VirtIO queues with the guest over the
+:ref:`shared memory <shared_memory_object>`.
+
+::
+
+  host# qemu-system								\
+      -chardev socket,path=/tmp/input.sock,id=mouse0				\
+      -device vhost-user-input-pci,chardev=mouse0				\
+      -m 4096 									\
+      -object memory-backend-file,id=mem,size=4G,mem-path=/dev/shm,share=on	\
+      -numa node,memdev=mem							\
+      ...
+
+
+.. _vhost_user_scsi:
+
+vhost-user-scsi - SCSI controller
+=================================
+
+The vhost-user-scsi daemon can proxy iSCSI devices onto a virtualized
+SCSI controller.
diff --git a/docs/system/devices/virtio/vhost-user-input.rst b/docs/system/devices/virtio/vhost-user-input.rst
deleted file mode 100644
index 118eb78101..0000000000
--- a/docs/system/devices/virtio/vhost-user-input.rst
+++ /dev/null
@@ -1,45 +0,0 @@
-.. _vhost_user_input:
-
-QEMU vhost-user-input - Input emulation
-=======================================
-
-This document describes the setup and usage of the Virtio input device.
-The Virtio input device is a paravirtualized device for input events.
-
-Description
------------
-
-The vhost-user-input device implementation was designed to work with a daemon
-polling on input devices and passes input events to the guest.
-
-QEMU provides a backend implementation in contrib/vhost-user-input.
-
-Linux kernel support
---------------------
-
-Virtio input requires a guest Linux kernel built with the
-``CONFIG_VIRTIO_INPUT`` option.
-
-Examples
---------
-
-The backend daemon should be started first:
-
-::
-
-  host# vhost-user-input --socket-path=input.sock	\
-      --evdev-path=/dev/input/event17
-
-The QEMU invocation needs to create a chardev socket to communicate with the
-backend daemon and access the VirtIO queues with the guest over the
-:ref:`shared memory <shared_memory_object>`.
-
-::
-
-  host# qemu-system								\
-      -chardev socket,path=/tmp/input.sock,id=mouse0				\
-      -device vhost-user-input-pci,chardev=mouse0				\
-      -m 4096 									\
-      -object memory-backend-file,id=mem,size=4G,mem-path=/dev/shm,share=on	\
-      -numa node,memdev=mem							\
-      ...
diff --git a/docs/system/devices/virtio/vhost-user.rst b/docs/system/devices/virtio/vhost-user.rst
index 9c9a28df38..f556a840e9 100644
--- a/docs/system/devices/virtio/vhost-user.rst
+++ b/docs/system/devices/virtio/vhost-user.rst
@@ -27,37 +27,37 @@ platform details for what sort of virtio bus to use.
     - Notes
   * - vhost-user-blk
     - Block storage
-    - See contrib/vhost-user-blk
+    - :ref:`storage-daemon`
   * - vhost-user-fs
     - File based storage driver
-    - See https://gitlab.com/virtio-fs/virtiofsd
+    - `virtiofsd <https://gitlab.com/virtio-fs/virtiofsd>`_
   * - vhost-user-gpio
     - Proxy gpio pins to host
-    - See https://github.com/rust-vmm/vhost-device
+    - `vhost-device-gpio <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-gpio>`_
   * - vhost-user-gpu
     - GPU driver
-    - See contrib/vhost-user-gpu
+    - `vhost-device-gpu <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-gpu>`_ or :ref:`vhost_user_gpu`
   * - vhost-user-i2c
     - Proxy i2c devices to host
-    - See https://github.com/rust-vmm/vhost-device
+    - `vhost-device-i2c <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-i2c>`_
   * - vhost-user-input
     - Generic input driver
-    - :ref:`vhost_user_input`
+    - `vhost-device-input <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-input>`_ or :ref:`vhost_user_input`
   * - vhost-user-rng
     - Entropy driver
-    - See https://github.com/rust-vmm/vhost-device
+    - `vhost-device-rng <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-rng>`_
   * - vhost-user-scmi
     - System Control and Management Interface
-    - See https://github.com/rust-vmm/vhost-device
+    - `vhost-device-scmi <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-scmi>`_
   * - vhost-user-snd
     - Audio device
-    - See https://github.com/rust-vmm/vhost-device/staging
+    - `vhost-device-sound <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-sound>`_
   * - vhost-user-scsi
     - SCSI based storage
-    - See contrib/vhost-user-scsi
+    - :ref:`vhost_user_scsi`
   * - vhost-user-vsock
     - Socket based communication
-    - See https://github.com/rust-vmm/vhost-device
+    - `vhost-device-vsock <https://github.com/rust-vmm/vhost-device/tree/main/vhost-device-vsock>`_
 
 The referenced *daemons* are not exhaustive, any conforming backend
 implementing the device and using the vhost-user protocol should work.
diff --git a/docs/system/devices/virtio/virtio-gpu.rst b/docs/system/devices/virtio/virtio-gpu.rst
index 39d2fd2d21..0f4bb304a9 100644
--- a/docs/system/devices/virtio/virtio-gpu.rst
+++ b/docs/system/devices/virtio/virtio-gpu.rst
@@ -1,6 +1,8 @@
 ..
    SPDX-License-Identifier: GPL-2.0-or-later
 
+.. _virtio_gpu:
+
 VirtIO GPU
 ==========
 

From 1a5319e26797404a5f7738111ba788b593483af6 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 13 Oct 2025 13:21:02 +0200
Subject: [PATCH 1455/2396] ui/pixman: Fix crash in
 qemu_pixman_shareable_free()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reported-by: Bernhard Beschow <shentey@gmail.com>
Fixes: b296b29d3414 (ui/pixman: Consistent error handling in qemu_pixman_shareable_free())
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251013112102.2396012-1-armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
---
 ui/qemu-pixman.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ui/qemu-pixman.c b/ui/qemu-pixman.c
index e46c6232cf..aea09755b9 100644
--- a/ui/qemu-pixman.c
+++ b/ui/qemu-pixman.c
@@ -291,7 +291,9 @@ qemu_pixman_shareable_free(qemu_pixman_shareable handle,
     Error *err = NULL;
 
     qemu_win32_map_free(ptr, handle, &err);
-    error_report_err(err);
+    if (err) {
+        error_report_err(err);
+    }
 #else
     qemu_memfd_free(ptr, size, handle);
 #endif

From 0ce63280dc6fe9fce1d89922f2d17dcae77827e6 Mon Sep 17 00:00:00 2001
From: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Date: Thu, 16 Oct 2025 14:17:07 +0200
Subject: [PATCH 1456/2396] qapi/machine-s390x: add QAPI event
 SCLP_CPI_INFO_AVAILABLE

Add QAPI event SCLP_CPI_INFO_AVAILABLE to notify the availability
of Control-Program Identification data in QOM.

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251016121708.334133-1-shalini@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/sclpcpi.c      |  4 ++++
 qapi/machine-s390x.json | 21 +++++++++++++++++++++
 2 files changed, 25 insertions(+)

diff --git a/hw/s390x/sclpcpi.c b/hw/s390x/sclpcpi.c
index 7aa039d510..68fc1b809b 100644
--- a/hw/s390x/sclpcpi.c
+++ b/hw/s390x/sclpcpi.c
@@ -54,6 +54,7 @@
 #include "hw/s390x/event-facility.h"
 #include "hw/s390x/ebcdic.h"
 #include "qapi/qapi-visit-machine.h"
+#include "qapi/qapi-events-machine-s390x.h"
 #include "migration/vmstate.h"
 
 typedef struct Data {
@@ -106,6 +107,9 @@ static int write_event_data(SCLPEvent *event, EventBufferHeader *evt_buf_hdr)
     e->timestamp = qemu_clock_get_ns(QEMU_CLOCK_HOST);
 
     cpim->ebh.flags = SCLP_EVENT_BUFFER_ACCEPTED;
+
+    qapi_event_send_sclp_cpi_info_available();
+
     return SCLP_RC_NORMAL_COMPLETION;
 }
 
diff --git a/qapi/machine-s390x.json b/qapi/machine-s390x.json
index 966dbd61d2..8412668b67 100644
--- a/qapi/machine-s390x.json
+++ b/qapi/machine-s390x.json
@@ -119,3 +119,24 @@
 { 'command': 'query-s390x-cpu-polarization', 'returns': 'CpuPolarizationInfo',
   'features': [ 'unstable' ]
 }
+
+##
+# @SCLP_CPI_INFO_AVAILABLE:
+#
+# Emitted when the Control-Program Identification data is available
+# in the QOM tree.
+#
+# Features:
+#
+# @unstable: This event is experimental.
+#
+# Since: 10.2
+#
+# .. qmp-example::
+#
+#     <- { "event": "SCLP_CPI_INFO_AVAILABLE",
+#          "timestamp": { "seconds": 1401385907, "microseconds": 422329 } }
+##
+{ 'event': 'SCLP_CPI_INFO_AVAILABLE',
+  'features': [ 'unstable' ]
+}

From bc436b739c3c8683ef5e8c22391952dcaa95242e Mon Sep 17 00:00:00 2001
From: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Date: Thu, 16 Oct 2025 14:17:08 +0200
Subject: [PATCH 1457/2396] tests/functional: add tests for SCLP event CPI

Add tests for SCLP event type Control-Program Identification.

Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com>
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com>
Reviewed-by Thomas Huth <thuth@redhat.com>
Message-ID: <20251016121708.334133-2-shalini@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/s390x/test_ccw_virtio.py | 26 +++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/tests/functional/s390x/test_ccw_virtio.py b/tests/functional/s390x/test_ccw_virtio.py
index 453711aa0f..0455337856 100755
--- a/tests/functional/s390x/test_ccw_virtio.py
+++ b/tests/functional/s390x/test_ccw_virtio.py
@@ -15,6 +15,7 @@ import os
 import tempfile
 
 from qemu_test import QemuSystemTest, Asset
+from qemu_test import exec_command
 from qemu_test import exec_command_and_wait_for_pattern
 from qemu_test import wait_for_console_pattern
 
@@ -270,5 +271,30 @@ class S390CCWVirtioMachine(QemuSystemTest):
                         'while ! (dmesg -c | grep Start.virtcrypto_remove) ; do'
                         ' sleep 1 ; done', 'Start virtcrypto_remove.')
 
+        # Test SCLP event Control-Program Identification (CPI)
+        cpi = '/sys/firmware/cpi/'
+        sclpcpi = '/machine/sclp/s390-sclp-event-facility/sclpcpi'
+        self.log.info("Test SCLP event CPI")
+        exec_command(self, 'echo TESTVM > ' + cpi + 'system_name')
+        exec_command(self, 'echo LINUX > ' + cpi + 'system_type')
+        exec_command(self, 'echo TESTPLEX > ' + cpi + 'sysplex_name')
+        exec_command(self, 'echo 0x001a000000060b00 > ' + cpi + 'system_level')
+        exec_command_and_wait_for_pattern(self,
+                                          'echo 1 > ' + cpi + 'set', ':/#')
+        try:
+            event = self.vm.event_wait('SCLP_CPI_INFO_AVAILABLE')
+        except TimeoutError:
+            self.fail('Timed out waiting for the SCLP_CPI_INFO_AVAILABLE event')
+        ts = self.vm.cmd('qom-get', path=sclpcpi, property='timestamp')
+        self.assertNotEqual(ts, 0)
+        name = self.vm.cmd('qom-get', path=sclpcpi, property='system_name')
+        self.assertEqual(name.strip(), 'TESTVM')
+        typ = self.vm.cmd('qom-get', path=sclpcpi, property='system_type')
+        self.assertEqual(typ.strip(), 'LINUX')
+        sysplex = self.vm.cmd('qom-get', path=sclpcpi, property='sysplex_name')
+        self.assertEqual(sysplex.strip(), 'TESTPLEX')
+        level = self.vm.cmd('qom-get', path=sclpcpi, property='system_level')
+        self.assertEqual(level, 0x001a000000060b00)
+
 if __name__ == '__main__':
     QemuSystemTest.main()

From 6fc2caf39602aa42cc6ca8de24c7f2c568a3b634 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:49:00 +0200
Subject: [PATCH 1458/2396] hw/s390x/ccw: Remove deprecated s390-ccw-virtio-4.2
 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251020094903.72182-2-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-virtio-ccw.c | 33 ---------------------------------
 1 file changed, 33 deletions(-)

diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index ad2c48188a..64b81345f1 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -715,26 +715,6 @@ static void s390_nmi(NMIState *n, int cpu_index, Error **errp)
     s390_cpu_restart(S390_CPU(cs));
 }
 
-static ram_addr_t s390_fixup_ram_size(ram_addr_t sz)
-{
-    /* same logic as in sclp.c */
-    int increment_size = 20;
-    ram_addr_t newsz;
-
-    while ((sz >> increment_size) > MAX_STORAGE_INCREMENTS) {
-        increment_size++;
-    }
-    newsz = sz >> increment_size << increment_size;
-
-    if (sz != newsz) {
-        qemu_printf("Ram size %" PRIu64 "MB was fixed up to %" PRIu64
-                    "MB to match machine restrictions. Consider updating "
-                    "the guest definition.\n", (uint64_t) (sz / MiB),
-                    (uint64_t) (newsz / MiB));
-    }
-    return newsz;
-}
-
 static inline bool machine_get_aes_key_wrap(Object *obj, Error **errp)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(obj);
@@ -1165,19 +1145,6 @@ static void ccw_machine_5_0_class_options(MachineClass *mc)
 }
 DEFINE_CCW_MACHINE(5, 0);
 
-static void ccw_machine_4_2_instance_options(MachineState *machine)
-{
-    ccw_machine_5_0_instance_options(machine);
-}
-
-static void ccw_machine_4_2_class_options(MachineClass *mc)
-{
-    ccw_machine_5_0_class_options(mc);
-    mc->fixup_ram_size = s390_fixup_ram_size;
-    compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
-}
-DEFINE_CCW_MACHINE(4, 2);
-
 static void ccw_machine_register_types(void)
 {
     type_register_static(&ccw_machine_info);

From 9280e54fa664f7820ae046a0e0e139720d8eedb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:49:01 +0200
Subject: [PATCH 1459/2396] hw/s390x/ccw: Remove SCLPDevice::increment_size
 field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SCLPDevice::increment_size field was only used by the
s390-ccw-virtio-4.2 machine, which got removed. Remove it
as now unused, along with the sclp_memory_init() method.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251020094903.72182-3-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/sclp.c         | 34 +++-------------------------------
 include/hw/s390x/sclp.h |  5 +----
 2 files changed, 4 insertions(+), 35 deletions(-)

diff --git a/hw/s390x/sclp.c b/hw/s390x/sclp.c
index 8602a566a4..c9a9c4bb37 100644
--- a/hw/s390x/sclp.c
+++ b/hw/s390x/sclp.c
@@ -110,7 +110,7 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
     ReadInfo *read_info = (ReadInfo *) sccb;
     MachineState *machine = MACHINE(qdev_get_machine());
     int cpu_count;
-    int rnsize, rnmax;
+    int rnmax;
     int required_len = SCCB_REQ_LEN(ReadInfo, machine->possible_cpus->len);
     int offset_cpu = s390_has_feat(S390_FEAT_EXTENDED_LENGTH_SCCB) ?
                      offsetof(ReadInfo, entries) :
@@ -153,21 +153,14 @@ static void read_SCP_info(SCLPDevice *sclp, SCCB *sccb)
 
     read_info->mha_pow = s390_get_mha_pow();
     read_info->hmfai = cpu_to_be32(s390_get_hmfai());
-
-    rnsize = 1 << (sclp->increment_size - 20);
-    if (rnsize <= 128) {
-        read_info->rnsize = rnsize;
-    } else {
-        read_info->rnsize = 0;
-        read_info->rnsize2 = cpu_to_be32(rnsize);
-    }
+    read_info->rnsize = 1;
 
     /*
      * We don't support standby memory. maxram_size is used for sizing the
      * memory device region, which is not exposed through SCLP but through
      * diag500.
      */
-    rnmax = machine->ram_size >> sclp->increment_size;
+    rnmax = machine->ram_size >> 20;
     if (rnmax < 0x10000) {
         read_info->rnmax = cpu_to_be16(rnmax);
     } else {
@@ -406,25 +399,6 @@ static void sclp_realize(DeviceState *dev, Error **errp)
     }
 }
 
-static void sclp_memory_init(SCLPDevice *sclp)
-{
-    MachineState *machine = MACHINE(qdev_get_machine());
-    MachineClass *machine_class = MACHINE_GET_CLASS(qdev_get_machine());
-    ram_addr_t initial_mem = machine->ram_size;
-    int increment_size = 20;
-
-    /* The storage increment size is a multiple of 1M and is a power of 2.
-     * For some machine types, the number of storage increments must be
-     * MAX_STORAGE_INCREMENTS or fewer.
-     * The variable 'increment_size' is an exponent of 2 that can be
-     * used to calculate the size (in bytes) of an increment. */
-    while (machine_class->fixup_ram_size != NULL &&
-           (initial_mem >> increment_size) > MAX_STORAGE_INCREMENTS) {
-        increment_size++;
-    }
-    sclp->increment_size = increment_size;
-}
-
 static void sclp_init(Object *obj)
 {
     SCLPDevice *sclp = SCLP(obj);
@@ -434,8 +408,6 @@ static void sclp_init(Object *obj)
     object_property_add_child(obj, TYPE_SCLP_EVENT_FACILITY, new);
     object_unref(new);
     sclp->event_facility = EVENT_FACILITY(new);
-
-    sclp_memory_init(sclp);
 }
 
 static void sclp_class_init(ObjectClass *oc, const void *data)
diff --git a/include/hw/s390x/sclp.h b/include/hw/s390x/sclp.h
index d32f6180e0..33f01f85bb 100644
--- a/include/hw/s390x/sclp.h
+++ b/include/hw/s390x/sclp.h
@@ -197,12 +197,9 @@ OBJECT_DECLARE_TYPE(SCLPDevice, SCLPDeviceClass,
 struct SCLPEventFacility;
 
 struct SCLPDevice {
-    /* private */
     DeviceState parent_obj;
-    struct SCLPEventFacility *event_facility;
-    int increment_size;
 
-    /* public */
+    struct SCLPEventFacility *event_facility;
 };
 
 struct SCLPDeviceClass {

From 049271a2ea27a0a617537ac8bad6839a67ffaa51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:49:02 +0200
Subject: [PATCH 1460/2396] hw/core/machine: Remove
 MachineClass::fixup_ram_size callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The MachineClass::fixup_ram_size callback, which was added
in commit 5c30ef937f5 ("vl/s390x: fixup ram sizes for compat
machines"), was only used by the s390-ccw-virtio-4.2 machine,
which got removed. Remove it as now unused.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251020094903.72182-4-philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/core/machine.c   | 3 ---
 include/hw/boards.h | 7 -------
 2 files changed, 10 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 681adbb7ac..7aec3916e8 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -648,9 +648,6 @@ static void machine_set_mem(Object *obj, Visitor *v, const char *name,
         mem->size = mc->default_ram_size;
     }
     mem->size = QEMU_ALIGN_UP(mem->size, 8192);
-    if (mc->fixup_ram_size) {
-        mem->size = mc->fixup_ram_size(mem->size);
-    }
     if ((ram_addr_t)mem->size != mem->size) {
         error_setg(errp, "ram size %llu exceeds permitted maximum %llu",
                    (unsigned long long)mem->size,
diff --git a/include/hw/boards.h b/include/hw/boards.h
index 665b620121..d0a69cd490 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -250,12 +250,6 @@ typedef struct {
  *    It also will be used as a way to option into "-m" option support.
  *    If it's not set by board, '-m' will be ignored and generic code will
  *    not create default RAM MemoryRegion.
- * @fixup_ram_size:
- *    Amends user provided ram size (with -m option) using machine
- *    specific algorithm. To be used by old machine types for compat
- *    purposes only.
- *    Applies only to default memory backend, i.e., explicit memory backend
- *    wasn't used.
  * @smbios_memory_device_size:
  *    Default size of memory device,
  *    SMBIOS 3.1.0 "7.18 Memory Device (Type 17)"
@@ -325,7 +319,6 @@ struct MachineClass {
                                                          unsigned cpu_index);
     const CPUArchIdList *(*possible_cpu_arch_ids)(MachineState *machine);
     int64_t (*get_default_cpu_node_id)(const MachineState *ms, int idx);
-    ram_addr_t (*fixup_ram_size)(ram_addr_t size);
     uint64_t smbios_memory_device_size;
     bool (*create_default_memdev)(MachineState *ms, const char *path,
                                   Error **errp);

From 8a2b283efa007f705f12784fc10185435bd1852f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 20 Oct 2025 18:17:59 +0200
Subject: [PATCH 1461/2396] gitlab-ci: Decrease the size of the compiler cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Uploading the cache from the runner takes a long time in the MSYS2
job, mostly due to the size of the compiler cache.
However, looking at runs with a non-poluted cache, it seems like
you can get a build with a 99% hit rate already with ~ 160 MiB cache
size, so the compiler cache with 500 MiB certainly contains a lot of
stale files. Thus decrease the size of the ccache to a more reasonable
value to speed up the MSYS2 job in our CI.

While at it, also add a "du -sh" for the build folder to get a better
feeling for the amount of object code that is required for the build,
and publish the list of files in /var/cache to be able to better
analyze what is really clogging our cache here.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251020161759.50241-1-thuth@redhat.com>
---
 .gitlab-ci.d/windows.yml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/windows.yml b/.gitlab-ci.d/windows.yml
index 6e1135d8b8..5dbdabfbec 100644
--- a/.gitlab-ci.d/windows.yml
+++ b/.gitlab-ci.d/windows.yml
@@ -25,6 +25,7 @@ msys2-64bit:
     expire_in: 7 days
     paths:
       - build/meson-logs
+      - build/cache-log.txt
     reports:
       junit: build/meson-logs/*.junit.xml
   before_script:
@@ -94,7 +95,7 @@ msys2-64bit:
   - $env:MSYS = 'winsymlinks:native' # Enable native Windows symlink
   - $env:CCACHE_BASEDIR = "$env:CI_PROJECT_DIR"
   - $env:CCACHE_DIR = "$env:CCACHE_BASEDIR/ccache"
-  - $env:CCACHE_MAXSIZE = "500M"
+  - $env:CCACHE_MAXSIZE = "180M"
   - $env:CCACHE_DEPEND = 1 # cache misses are too expensive with preprocessor mode
   - $env:CC = "ccache gcc"
   - mkdir build
@@ -103,5 +104,7 @@ msys2-64bit:
   - ..\msys64\usr\bin\bash -lc "../configure $CONFIGURE_ARGS"
   - ..\msys64\usr\bin\bash -lc "make -j$env:JOBS"
   - ..\msys64\usr\bin\bash -lc "make check MTESTARGS='$TEST_ARGS' || { cat meson-logs/testlog.txt; exit 1; } ;"
+  - ..\msys64\usr\bin\bash -lc "ls -lR /var/cache > cache-log.txt"
+  - ..\msys64\usr\bin\bash -lc "du -sh ."
   - ..\msys64\usr\bin\bash -lc "ccache --show-stats"
   - Write-Output "Finished build at $(Get-Date -Format u)"

From d9a8e9d79ade5b82d9ba467fbcb49a9003b88e28 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 7 Mar 2025 14:21:06 +0100
Subject: [PATCH 1462/2396] hw/virtio/virtio-mem: Convert
 VIRTIO_MEM_USABLE_EXTENT to runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use target_arch() to check at runtime which target architecture
is being run.

Note, since TARGET_ARM is defined for TARGET_AARCH64, we
check for both ARM & AARCH64 enum values.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250502214551.80401-4-philmd@linaro.org>
---
 hw/virtio/virtio-mem.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index 15ba6799f2..f16445b934 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -15,6 +15,7 @@
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
 #include "qemu/units.h"
+#include "qemu/target-info-qapi.h"
 #include "system/numa.h"
 #include "system/system.h"
 #include "system/ramblock.h"
@@ -170,13 +171,20 @@ static bool virtio_mem_has_shared_zeropage(RAMBlock *rb)
  * necessary (as the section size can change). But it's more likely that the
  * section size will rather get smaller and not bigger over time.
  */
-#if defined(TARGET_X86_64) || defined(TARGET_I386) || defined(TARGET_S390X)
-#define VIRTIO_MEM_USABLE_EXTENT (2 * (128 * MiB))
-#elif defined(TARGET_ARM)
-#define VIRTIO_MEM_USABLE_EXTENT (2 * (512 * MiB))
-#else
-#error VIRTIO_MEM_USABLE_EXTENT not defined
-#endif
+static uint64_t virtio_mem_usable_extent_size(void)
+{
+    switch (target_arch()) {
+    case SYS_EMU_TARGET_I386:
+    case SYS_EMU_TARGET_X86_64:
+    case SYS_EMU_TARGET_S390X:
+        return 2 * 128 * MiB;
+    case SYS_EMU_TARGET_AARCH64:
+    case SYS_EMU_TARGET_ARM:
+        return 2 * 512 * MiB;
+    default:
+        g_assert_not_reached();
+    }
+}
 
 static bool virtio_mem_is_busy(void)
 {
@@ -699,7 +707,7 @@ static void virtio_mem_resize_usable_region(VirtIOMEM *vmem,
                                             bool can_shrink)
 {
     uint64_t newsize = MIN(memory_region_size(&vmem->memdev->mr),
-                           requested_size + VIRTIO_MEM_USABLE_EXTENT);
+                           requested_size + virtio_mem_usable_extent_size());
 
     /* The usable region size always has to be multiples of the block size. */
     newsize = QEMU_ALIGN_UP(newsize, vmem->block_size);

From 0d9468ba523431794b0d11da64a7f67b95fe3ed4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 16 Apr 2025 14:29:55 +0200
Subject: [PATCH 1463/2396] hw/virtio/virtio-mem: Convert
 VIRTIO_MEM_HAS_LEGACY_GUESTS to runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Check legacy guests support at runtime: instead of evaluating
the VIRTIO_MEM_HAS_LEGACY_GUESTS definition at compile time,
call target_arch() to detect which target is being run at runtime.
Register virtio_mem_legacy_guests_properties[] at runtime.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250502214551.80401-5-philmd@linaro.org>
---
 hw/virtio/virtio-mem.c | 76 ++++++++++++++++++++++++------------------
 1 file changed, 43 insertions(+), 33 deletions(-)

diff --git a/hw/virtio/virtio-mem.c b/hw/virtio/virtio-mem.c
index f16445b934..ae7c13e33c 100644
--- a/hw/virtio/virtio-mem.c
+++ b/hw/virtio/virtio-mem.c
@@ -34,13 +34,21 @@
 
 static const VMStateDescription vmstate_virtio_mem_device_early;
 
-/*
- * We only had legacy x86 guests that did not support
- * VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE. Other targets don't have legacy guests.
- */
-#if defined(TARGET_X86_64) || defined(TARGET_I386)
-#define VIRTIO_MEM_HAS_LEGACY_GUESTS
-#endif
+static bool virtio_mem_has_legacy_guests(void)
+{
+    /*
+     * We only had legacy x86 guests that did not support
+     * VIRTIO_MEM_F_UNPLUGGED_INACCESSIBLE. Other targets don't have
+     * legacy guests.
+     */
+    switch (target_arch()) {
+    case SYS_EMU_TARGET_I386:
+    case SYS_EMU_TARGET_X86_64:
+        return true;
+    default:
+        return false;
+    }
+}
 
 /*
  * Let's not allow blocks smaller than 1 MiB, for example, to keep the tracking
@@ -144,7 +152,6 @@ static uint64_t virtio_mem_default_block_size(RAMBlock *rb)
     return MAX(page_size, VIRTIO_MEM_MIN_BLOCK_SIZE);
 }
 
-#if defined(VIRTIO_MEM_HAS_LEGACY_GUESTS)
 static bool virtio_mem_has_shared_zeropage(RAMBlock *rb)
 {
     /*
@@ -155,7 +162,6 @@ static bool virtio_mem_has_shared_zeropage(RAMBlock *rb)
     return !qemu_ram_is_shared(rb) && qemu_ram_get_fd(rb) < 0 &&
            qemu_ram_pagesize(rb) == qemu_real_host_page_size();
 }
-#endif /* VIRTIO_MEM_HAS_LEGACY_GUESTS */
 
 /*
  * Size the usable region bigger than the requested size if possible. Esp.
@@ -983,28 +989,28 @@ static void virtio_mem_device_realize(DeviceState *dev, Error **errp)
     rb = vmem->memdev->mr.ram_block;
     page_size = qemu_ram_pagesize(rb);
 
-#if defined(VIRTIO_MEM_HAS_LEGACY_GUESTS)
-    switch (vmem->unplugged_inaccessible) {
-    case ON_OFF_AUTO_AUTO:
-        if (virtio_mem_has_shared_zeropage(rb)) {
-            vmem->unplugged_inaccessible = ON_OFF_AUTO_OFF;
-        } else {
-            vmem->unplugged_inaccessible = ON_OFF_AUTO_ON;
+    if (virtio_mem_has_legacy_guests()) {
+        switch (vmem->unplugged_inaccessible) {
+        case ON_OFF_AUTO_AUTO:
+            if (virtio_mem_has_shared_zeropage(rb)) {
+                vmem->unplugged_inaccessible = ON_OFF_AUTO_OFF;
+            } else {
+                vmem->unplugged_inaccessible = ON_OFF_AUTO_ON;
+            }
+            break;
+        case ON_OFF_AUTO_OFF:
+            if (!virtio_mem_has_shared_zeropage(rb)) {
+                warn_report("'%s' property set to 'off' with a memdev that does"
+                            " not support the shared zeropage.",
+                            VIRTIO_MEM_UNPLUGGED_INACCESSIBLE_PROP);
+            }
+            break;
+        default:
+            break;
         }
-        break;
-    case ON_OFF_AUTO_OFF:
-        if (!virtio_mem_has_shared_zeropage(rb)) {
-            warn_report("'%s' property set to 'off' with a memdev that does"
-                        " not support the shared zeropage.",
-                        VIRTIO_MEM_UNPLUGGED_INACCESSIBLE_PROP);
-        }
-        break;
-    default:
-        break;
+    } else {
+        vmem->unplugged_inaccessible = ON_OFF_AUTO_ON;
     }
-#else /* VIRTIO_MEM_HAS_LEGACY_GUESTS */
-    vmem->unplugged_inaccessible = ON_OFF_AUTO_ON;
-#endif /* VIRTIO_MEM_HAS_LEGACY_GUESTS */
 
     if (vmem->dynamic_memslots &&
         vmem->unplugged_inaccessible != ON_OFF_AUTO_ON) {
@@ -1701,16 +1707,17 @@ static const Property virtio_mem_properties[] = {
     DEFINE_PROP_BOOL(VIRTIO_MEM_PREALLOC_PROP, VirtIOMEM, prealloc, false),
     DEFINE_PROP_LINK(VIRTIO_MEM_MEMDEV_PROP, VirtIOMEM, memdev,
                      TYPE_MEMORY_BACKEND, HostMemoryBackend *),
-#if defined(VIRTIO_MEM_HAS_LEGACY_GUESTS)
-    DEFINE_PROP_ON_OFF_AUTO(VIRTIO_MEM_UNPLUGGED_INACCESSIBLE_PROP, VirtIOMEM,
-                            unplugged_inaccessible, ON_OFF_AUTO_ON),
-#endif
     DEFINE_PROP_BOOL(VIRTIO_MEM_EARLY_MIGRATION_PROP, VirtIOMEM,
                      early_migration, true),
     DEFINE_PROP_BOOL(VIRTIO_MEM_DYNAMIC_MEMSLOTS_PROP, VirtIOMEM,
                      dynamic_memslots, false),
 };
 
+static const Property virtio_mem_legacy_guests_properties[] = {
+    DEFINE_PROP_ON_OFF_AUTO(VIRTIO_MEM_UNPLUGGED_INACCESSIBLE_PROP, VirtIOMEM,
+                            unplugged_inaccessible, ON_OFF_AUTO_ON),
+};
+
 static uint64_t virtio_mem_rdm_get_min_granularity(const RamDiscardManager *rdm,
                                                    const MemoryRegion *mr)
 {
@@ -1862,6 +1869,9 @@ static void virtio_mem_class_init(ObjectClass *klass, const void *data)
     RamDiscardManagerClass *rdmc = RAM_DISCARD_MANAGER_CLASS(klass);
 
     device_class_set_props(dc, virtio_mem_properties);
+    if (virtio_mem_has_legacy_guests()) {
+        device_class_set_props(dc, virtio_mem_legacy_guests_properties);
+    }
     dc->vmsd = &vmstate_virtio_mem;
 
     set_bit(DEVICE_CATEGORY_MISC, dc->categories);

From f1ee11469318a1e5d9da16b6c6c6b51c99b3edf5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 7 Mar 2025 14:51:58 +0100
Subject: [PATCH 1464/2396] hw/virtio: Compile virtio-mem.c once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unused "system/ram_addr.h" header. This file doesn't
use any target specific definitions anymore, compile it once
by moving it to system_virtio_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20250502214551.80401-6-philmd@linaro.org>
---
 hw/virtio/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/meson.build b/hw/virtio/meson.build
index 48b9fedfa5..affd66887d 100644
--- a/hw/virtio/meson.build
+++ b/hw/virtio/meson.build
@@ -57,7 +57,7 @@ specific_virtio_ss.add(when: 'CONFIG_VIRTIO_BALLOON', if_true: files('virtio-bal
 specific_virtio_ss.add(when: 'CONFIG_VHOST_USER_FS', if_true: files('vhost-user-fs.c'))
 specific_virtio_ss.add(when: 'CONFIG_VIRTIO_PMEM', if_true: files('virtio-pmem.c'))
 specific_virtio_ss.add(when: 'CONFIG_VHOST_VSOCK', if_true: files('vhost-vsock.c'))
-specific_virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem.c'))
+system_virtio_ss.add(when: 'CONFIG_VIRTIO_MEM', if_true: files('virtio-mem.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_NSM', if_true: files('virtio-nsm.c'))
 system_virtio_ss.add(when: 'CONFIG_VIRTIO_NSM', if_true: [files('cbor-helpers.c'), libcbor])
 system_virtio_ss.add(when: 'CONFIG_VHOST_USER_SCMI', if_true: files('vhost-user-scmi.c'))

From 62ef928312a981d0e25672f72dd467f4a0c05463 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sun, 4 May 2025 18:01:35 +0200
Subject: [PATCH 1465/2396] hw/pci-host/raven: Simplify direct config access
 address decoding
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use ctz instead of an open coded version and rename function to better
show what it does.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <68c038fd225463db282d0277d80cb525e0551413.1760795082.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index f8c0be5d21..ee9058e262 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -72,16 +72,9 @@ struct PRePPCIState {
 
 #define PCI_IO_BASE_ADDR    0x80000000  /* Physical address on main bus */
 
-static inline uint32_t raven_pci_io_config(hwaddr addr)
+static inline uint32_t raven_idsel_to_addr(hwaddr addr)
 {
-    int i;
-
-    for (i = 0; i < 11; i++) {
-        if ((addr & (1 << (11 + i))) != 0) {
-            break;
-        }
-    }
-    return (addr & 0x7ff) |  (i << 11);
+    return (ctz16(addr >> 11) << 11) | (addr & 0x7ff);
 }
 
 static void raven_pci_io_write(void *opaque, hwaddr addr,
@@ -89,7 +82,7 @@ static void raven_pci_io_write(void *opaque, hwaddr addr,
 {
     PREPPCIState *s = opaque;
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
-    pci_data_write(phb->bus, raven_pci_io_config(addr), val, size);
+    pci_data_write(phb->bus, raven_idsel_to_addr(addr), val, size);
 }
 
 static uint64_t raven_pci_io_read(void *opaque, hwaddr addr,
@@ -97,7 +90,7 @@ static uint64_t raven_pci_io_read(void *opaque, hwaddr addr,
 {
     PREPPCIState *s = opaque;
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
-    return pci_data_read(phb->bus, raven_pci_io_config(addr), size);
+    return pci_data_read(phb->bus, raven_idsel_to_addr(addr), size);
 }
 
 static const MemoryRegionOps raven_pci_io_ops = {

From 046d2e21fcf6a8b0dca8555da2d5684ca8a4dd82 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sun, 4 May 2025 18:01:36 +0200
Subject: [PATCH 1466/2396] hw/pci-host/raven: Rename direct config access ops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename memory io ops implementing PCI configuration direct access to
mmcfg which describes better what these are for.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <74fcd70106289663ea426161aada78e879995d6c.1760795082.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index ee9058e262..e0ebc81c24 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -77,25 +77,24 @@ static inline uint32_t raven_idsel_to_addr(hwaddr addr)
     return (ctz16(addr >> 11) << 11) | (addr & 0x7ff);
 }
 
-static void raven_pci_io_write(void *opaque, hwaddr addr,
-                               uint64_t val, unsigned int size)
+static void raven_mmcfg_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned int size)
 {
     PREPPCIState *s = opaque;
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
     pci_data_write(phb->bus, raven_idsel_to_addr(addr), val, size);
 }
 
-static uint64_t raven_pci_io_read(void *opaque, hwaddr addr,
-                                  unsigned int size)
+static uint64_t raven_mmcfg_read(void *opaque, hwaddr addr, unsigned int size)
 {
     PREPPCIState *s = opaque;
     PCIHostState *phb = PCI_HOST_BRIDGE(s);
     return pci_data_read(phb->bus, raven_idsel_to_addr(addr), size);
 }
 
-static const MemoryRegionOps raven_pci_io_ops = {
-    .read = raven_pci_io_read,
-    .write = raven_pci_io_write,
+static const MemoryRegionOps raven_mmcfg_ops = {
+    .read = raven_mmcfg_read,
+    .write = raven_mmcfg_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
@@ -253,8 +252,8 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
                           "pci-conf-data", 4);
     memory_region_add_subregion(&s->pci_io, 0xcfc, &h->data_mem);
 
-    memory_region_init_io(&h->mmcfg, OBJECT(s), &raven_pci_io_ops, s,
-                          "pciio", 0x00400000);
+    memory_region_init_io(&h->mmcfg, OBJECT(s), &raven_mmcfg_ops, s,
+                          "pci-mmcfg", 0x00400000);
     memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
 
     memory_region_init_io(&s->pci_intack, OBJECT(s), &raven_intack_ops, s,

From dcff29f4cca2090d8454aa8a6ba23511e4758ff4 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 3 Jul 2025 00:09:02 +0200
Subject: [PATCH 1467/2396] hw/pci-host/raven: Use correct parameter in direct
 access ops
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of passing unneeded enclosing objects to the config direct
access ops that only need the bus we can pass that directly thus
simplifying the functions.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <226e0756661e72a03ba363887730112a58acde85.1760795082.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index e0ebc81c24..eacffc86d8 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -80,16 +80,16 @@ static inline uint32_t raven_idsel_to_addr(hwaddr addr)
 static void raven_mmcfg_write(void *opaque, hwaddr addr, uint64_t val,
                               unsigned int size)
 {
-    PREPPCIState *s = opaque;
-    PCIHostState *phb = PCI_HOST_BRIDGE(s);
-    pci_data_write(phb->bus, raven_idsel_to_addr(addr), val, size);
+    PCIBus *hbus = opaque;
+
+    pci_data_write(hbus, raven_idsel_to_addr(addr), val, size);
 }
 
 static uint64_t raven_mmcfg_read(void *opaque, hwaddr addr, unsigned int size)
 {
-    PREPPCIState *s = opaque;
-    PCIHostState *phb = PCI_HOST_BRIDGE(s);
-    return pci_data_read(phb->bus, raven_idsel_to_addr(addr), size);
+    PCIBus *hbus = opaque;
+
+    return pci_data_read(hbus, raven_idsel_to_addr(addr), size);
 }
 
 static const MemoryRegionOps raven_mmcfg_ops = {
@@ -252,7 +252,7 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
                           "pci-conf-data", 4);
     memory_region_add_subregion(&s->pci_io, 0xcfc, &h->data_mem);
 
-    memory_region_init_io(&h->mmcfg, OBJECT(s), &raven_mmcfg_ops, s,
+    memory_region_init_io(&h->mmcfg, OBJECT(h), &raven_mmcfg_ops, h->bus,
                           "pci-mmcfg", 0x00400000);
     memory_region_add_subregion(address_space_mem, 0x80800000, &h->mmcfg);
 

From 2c6fab1c143059e59128b805f4e6a6796eedee43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 23:46:21 +0200
Subject: [PATCH 1468/2396] hw/core: Filter machine list available for a
 particular target binary
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Binaries can register a QOM type to filter their machines
by filling their TargetInfo::machine_typename field.

Commit 28502121be7 ("system/vl: Filter machine list available
for a particular target binary") added the filter to
machine_help_func() but missed the other places where the machine
list must be filtered, such QMP 'query-machines' command used by
QTests, and select_machine(). Fix that.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251020220941.65269-2-philmd@linaro.org>
---
 hw/core/machine-qmp-cmds.c | 4 +++-
 monitor/qemu-config-qmp.c  | 3 ++-
 system/vl.c                | 3 ++-
 3 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/core/machine-qmp-cmds.c b/hw/core/machine-qmp-cmds.c
index 51d5c230f7..28dfd3e15b 100644
--- a/hw/core/machine-qmp-cmds.c
+++ b/hw/core/machine-qmp-cmds.c
@@ -20,6 +20,7 @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/type-helpers.h"
 #include "qemu/uuid.h"
+#include "qemu/target-info.h"
 #include "qemu/target-info-qapi.h"
 #include "qom/qom-qobject.h"
 #include "system/hostmem.h"
@@ -94,9 +95,10 @@ CpuInfoFastList *qmp_query_cpus_fast(Error **errp)
 MachineInfoList *qmp_query_machines(bool has_compat_props, bool compat_props,
                                     Error **errp)
 {
-    GSList *el, *machines = object_class_get_list(TYPE_MACHINE, false);
+    GSList *el, *machines;
     MachineInfoList *mach_list = NULL;
 
+    machines = object_class_get_list(target_machine_typename(), false);
     for (el = machines; el; el = el->next) {
         MachineClass *mc = el->data;
         const char *default_cpu_type = machine_class_default_cpu_type(mc);
diff --git a/monitor/qemu-config-qmp.c b/monitor/qemu-config-qmp.c
index 9a3b183602..8bd28fc232 100644
--- a/monitor/qemu-config-qmp.c
+++ b/monitor/qemu-config-qmp.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: GPL-2.0-or-later */
 #include "qemu/osdep.h"
+#include "qemu/target-info.h"
 #include "qapi/error.h"
 #include "qapi/qapi-commands-misc.h"
 #include "qobject/qlist.h"
@@ -128,7 +129,7 @@ static CommandLineParameterInfoList *query_all_machine_properties(void)
     ObjectProperty *prop;
     bool is_new;
 
-    machines = object_class_get_list(TYPE_MACHINE, false);
+    machines = object_class_get_list(target_machine_typename(), false);
     assert(machines);
 
     /* Loop over all machine classes */
diff --git a/system/vl.c b/system/vl.c
index 646239e4a6..a96063f990 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -1672,7 +1672,8 @@ static MachineClass *select_machine(QDict *qdict, Error **errp)
 {
     ERRP_GUARD();
     const char *machine_type = qdict_get_try_str(qdict, "type");
-    g_autoptr(GSList) machines = object_class_get_list(TYPE_MACHINE, false);
+    g_autoptr(GSList) machines = object_class_get_list(target_machine_typename(),
+                                                       false);
     MachineClass *machine_class = NULL;
 
     if (machine_type) {

From 42a4700bb9c6e9424b3ed12f041209e0770f971c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:54:15 +0200
Subject: [PATCH 1469/2396] hw/core/machine: Allow dynamic registration of
 valid CPU types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add MachineClass::get_valid_cpu_types(), a helper that
returns a dynamic list of CPU types. Since the helper
takes a MachineState argument, we know the machine is
created by the time we call it.

Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20251020220941.65269-4-philmd@linaro.org>
---
 hw/core/machine.c   | 28 ++++++++++++++++++++++++++++
 include/hw/boards.h |  4 ++++
 2 files changed, 32 insertions(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 7aec3916e8..cd2f1414a7 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1570,6 +1570,8 @@ static bool is_cpu_type_supported(const MachineState *machine, Error **errp)
      */
     if (mc->valid_cpu_types) {
         assert(mc->valid_cpu_types[0] != NULL);
+        assert(!mc->get_valid_cpu_types);
+
         for (i = 0; mc->valid_cpu_types[i]; i++) {
             if (object_class_dynamic_cast(oc, mc->valid_cpu_types[i])) {
                 break;
@@ -1596,6 +1598,32 @@ static bool is_cpu_type_supported(const MachineState *machine, Error **errp)
                 error_append_hint(errp, "\n");
             }
 
+            return false;
+        }
+    } else if (mc->get_valid_cpu_types) {
+        GPtrArray *vct = mc->get_valid_cpu_types(machine);
+        bool valid = false;
+
+        for (i = 0; i < vct->len; i++) {
+            if (object_class_dynamic_cast(oc, vct->pdata[i])) {
+                valid = true;
+                break;
+            }
+        }
+
+        if (!valid) {
+            g_autofree char *requested = cpu_model_from_type(machine->cpu_type);
+
+            error_setg(errp, "Invalid CPU model: %s", requested);
+            error_append_hint(errp, "The valid models are: ");
+            for (i = 0; i < vct->len; i++) {
+                g_autofree char *model = cpu_model_from_type(vct->pdata[i]);
+                error_append_hint(errp, "%s%s",
+                                  model, i + 1 == vct->len ? "\n" : ", ");
+            }
+        }
+        g_ptr_array_free(vct, true);
+        if (!valid) {
             return false;
         }
     }
diff --git a/include/hw/boards.h b/include/hw/boards.h
index d0a69cd490..c45272b741 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -253,6 +253,9 @@ typedef struct {
  * @smbios_memory_device_size:
  *    Default size of memory device,
  *    SMBIOS 3.1.0 "7.18 Memory Device (Type 17)"
+ * @get_valid_cpu_types:
+ *    Returns a list of valid CPU types for this board. May be NULL
+ *    if not needed.
  */
 struct MachineClass {
     /*< private >*/
@@ -299,6 +302,7 @@ struct MachineClass {
     bool ignore_memory_transaction_failures;
     int numa_mem_align_shift;
     const char * const *valid_cpu_types;
+    GPtrArray *(*get_valid_cpu_types)(const MachineState *ms);
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;

From 6d06b1e3f6b2f906767e2faa1b781dcef2308bd0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Apr 2025 12:11:56 +0200
Subject: [PATCH 1470/2396] hw/core: Introduce
 MachineClass::get_default_cpu_type() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MachineClass::get_default_cpu_type() runs once the machine is
created, being able to evaluate runtime checks; it returns the
machine default CPU type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251020221508.67413-7-philmd@linaro.org>
---
 hw/core/machine.c   | 10 ++++++++++
 include/hw/boards.h |  6 ++++++
 system/vl.c         |  2 +-
 3 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index cd2f1414a7..cd63803000 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1556,6 +1556,16 @@ const char *machine_class_default_cpu_type(MachineClass *mc)
     return mc->default_cpu_type;
 }
 
+const char *machine_default_cpu_type(const MachineState *ms)
+{
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+
+    if (mc->get_default_cpu_type) {
+        return mc->get_default_cpu_type(ms);
+    }
+    return machine_class_default_cpu_type(mc);
+}
+
 static bool is_cpu_type_supported(const MachineState *machine, Error **errp)
 {
     MachineClass *mc = MACHINE_GET_CLASS(machine);
diff --git a/include/hw/boards.h b/include/hw/boards.h
index c45272b741..014007920d 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -25,6 +25,11 @@ OBJECT_DECLARE_TYPE(MachineState, MachineClass, MACHINE)
 
 extern MachineState *current_machine;
 
+/**
+ * machine_default_cpu_type: Return the machine default CPU type.
+ * @ms: Machine state
+ */
+const char *machine_default_cpu_type(const MachineState *ms);
 /**
  * machine_class_default_cpu_type: Return the machine default CPU type.
  * @mc: Machine class
@@ -303,6 +308,7 @@ struct MachineClass {
     int numa_mem_align_shift;
     const char * const *valid_cpu_types;
     GPtrArray *(*get_valid_cpu_types)(const MachineState *ms);
+    const char *(*get_default_cpu_type)(const MachineState *ms);
     strList *allowed_dynamic_sysbus_devices;
     bool auto_enable_numa_with_memhp;
     bool auto_enable_numa_with_memdev;
diff --git a/system/vl.c b/system/vl.c
index a96063f990..fd98ea52d9 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -3817,7 +3817,7 @@ void qemu_init(int argc, char **argv)
     migration_object_init();
 
     /* parse features once if machine provides default cpu_type */
-    current_machine->cpu_type = machine_class_default_cpu_type(machine_class);
+    current_machine->cpu_type = machine_default_cpu_type(current_machine);
     if (cpu_option) {
         current_machine->cpu_type = parse_cpu_option(cpu_option);
     }

From 0f212b0d12cc35d4600d08d4a337f4b6c243f07b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 16:50:03 +0200
Subject: [PATCH 1471/2396] hw/boards: Move DEFINE_MACHINE() definition closer
 to its doc string
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Code movement to have the DEFINE_MACHINE() definition follow
its usage documentation comment.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251020220941.65269-3-philmd@linaro.org>
---
 include/hw/boards.h | 34 +++++++++++++++++-----------------
 1 file changed, 17 insertions(+), 17 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index 014007920d..a214e3322a 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -506,6 +506,23 @@ struct MachineState {
  *      DEFINE_VIRT_MACHINE_IMPL(false, major, minor, micro, _, tag)
  */
 
+#define DEFINE_MACHINE(namestr, machine_initfn) \
+    static void machine_initfn##_class_init(ObjectClass *oc, const void *data) \
+    { \
+        MachineClass *mc = MACHINE_CLASS(oc); \
+        machine_initfn(mc); \
+    } \
+    static const TypeInfo machine_initfn##_typeinfo = { \
+        .name       = MACHINE_TYPE_NAME(namestr), \
+        .parent     = TYPE_MACHINE, \
+        .class_init = machine_initfn##_class_init, \
+    }; \
+    static void machine_initfn##_register_types(void) \
+    { \
+        type_register_static(&machine_initfn##_typeinfo); \
+    } \
+    type_init(machine_initfn##_register_types)
+
 /*
  * Helper for dispatching different macros based on how
  * many __VA_ARGS__ are passed. Supports 1 to 5 variadic
@@ -765,23 +782,6 @@ struct MachineState {
         } \
     } while (0)
 
-#define DEFINE_MACHINE(namestr, machine_initfn) \
-    static void machine_initfn##_class_init(ObjectClass *oc, const void *data) \
-    { \
-        MachineClass *mc = MACHINE_CLASS(oc); \
-        machine_initfn(mc); \
-    } \
-    static const TypeInfo machine_initfn##_typeinfo = { \
-        .name       = MACHINE_TYPE_NAME(namestr), \
-        .parent     = TYPE_MACHINE, \
-        .class_init = machine_initfn##_class_init, \
-    }; \
-    static void machine_initfn##_register_types(void) \
-    { \
-        type_register_static(&machine_initfn##_typeinfo); \
-    } \
-    type_init(machine_initfn##_register_types)
-
 extern GlobalProperty hw_compat_10_1[];
 extern const size_t hw_compat_10_1_len;
 

From ce837a4fd65dedf04abb3fac7f69c26c69dfbe9a Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Fri, 2 May 2025 01:20:33 +0200
Subject: [PATCH 1472/2396] hw/boards: Extend DEFINE_MACHINE macro to cover
 more use cases
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a more general DEFINE_MACHINE_EXTENDED macro and define simpler
versions with less parameters based on that. This is inspired by how
the OBJECT_DEFINE macros do this in a similar way to allow using the
shortened definition in more complex cases too.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <d75c8bbed97650f1a4d2d675444582a240a335b4.1760798392.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
---
 include/hw/boards.h | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index a214e3322a..b2964cf055 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -506,7 +506,8 @@ struct MachineState {
  *      DEFINE_VIRT_MACHINE_IMPL(false, major, minor, micro, _, tag)
  */
 
-#define DEFINE_MACHINE(namestr, machine_initfn) \
+#define DEFINE_MACHINE_EXTENDED(namestr, PARENT_NAME, InstanceName, \
+                                machine_initfn, ABSTRACT, ...) \
     static void machine_initfn##_class_init(ObjectClass *oc, const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
@@ -514,8 +515,11 @@ struct MachineState {
     } \
     static const TypeInfo machine_initfn##_typeinfo = { \
         .name       = MACHINE_TYPE_NAME(namestr), \
-        .parent     = TYPE_MACHINE, \
+        .parent     = TYPE_##PARENT_NAME, \
         .class_init = machine_initfn##_class_init, \
+        .instance_size = sizeof(InstanceName), \
+        .abstract = ABSTRACT, \
+        .interfaces = (const InterfaceInfo[]) { __VA_ARGS__ }, \
     }; \
     static void machine_initfn##_register_types(void) \
     { \
@@ -523,6 +527,14 @@ struct MachineState {
     } \
     type_init(machine_initfn##_register_types)
 
+#define DEFINE_MACHINE(namestr, machine_initfn) \
+    DEFINE_MACHINE_EXTENDED(namestr, MACHINE, MachineState, machine_initfn, \
+                            false, { })
+
+#define DEFINE_MACHINE_WITH_INTERFACES(namestr, machine_initfn, ...) \
+    DEFINE_MACHINE_EXTENDED(namestr, MACHINE, MachineState, machine_initfn, \
+                            false, __VA_ARGS__)
+
 /*
  * Helper for dispatching different macros based on how
  * many __VA_ARGS__ are passed. Supports 1 to 5 variadic

From a4d934ea079563a38cc6ea4a556da3fb14a2b753 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 15:10:49 +0200
Subject: [PATCH 1473/2396] hw/boards: Introduce
 DEFINE_MACHINE_WITH_INTERFACE_ARRAY() macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

DEFINE_MACHINE_WITH_INTERFACE_ARRAY() is similar to
DEFINE_MACHINE_WITH_INTERFACES() but allows to pass
an InterfaceInfo[] pointer.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251020220941.65269-5-philmd@linaro.org>
---
 include/hw/boards.h | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index b2964cf055..a48ed4f86a 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -507,7 +507,7 @@ struct MachineState {
  */
 
 #define DEFINE_MACHINE_EXTENDED(namestr, PARENT_NAME, InstanceName, \
-                                machine_initfn, ABSTRACT, ...) \
+                                machine_initfn, ABSTRACT, ifaces...) \
     static void machine_initfn##_class_init(ObjectClass *oc, const void *data) \
     { \
         MachineClass *mc = MACHINE_CLASS(oc); \
@@ -519,7 +519,7 @@ struct MachineState {
         .class_init = machine_initfn##_class_init, \
         .instance_size = sizeof(InstanceName), \
         .abstract = ABSTRACT, \
-        .interfaces = (const InterfaceInfo[]) { __VA_ARGS__ }, \
+        .interfaces = ifaces, \
     }; \
     static void machine_initfn##_register_types(void) \
     { \
@@ -529,11 +529,15 @@ struct MachineState {
 
 #define DEFINE_MACHINE(namestr, machine_initfn) \
     DEFINE_MACHINE_EXTENDED(namestr, MACHINE, MachineState, machine_initfn, \
-                            false, { })
+                            false, NULL)
+
+#define DEFINE_MACHINE_WITH_INTERFACE_ARRAY(namestr, machine_initfn, ifaces...)\
+    DEFINE_MACHINE_EXTENDED(namestr, MACHINE, MachineState, machine_initfn, \
+                            false, ifaces)
 
 #define DEFINE_MACHINE_WITH_INTERFACES(namestr, machine_initfn, ...) \
-    DEFINE_MACHINE_EXTENDED(namestr, MACHINE, MachineState, machine_initfn, \
-                            false, __VA_ARGS__)
+    DEFINE_MACHINE_WITH_INTERFACE_ARRAY(namestr, machine_initfn, \
+                                        (const InterfaceInfo[]) { __VA_ARGS__ })
 
 /*
  * Helper for dispatching different macros based on how

From 40eed74cc9deaa4343b31e49a6fbf7f037e8d841 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 8 Oct 2025 14:25:02 +0200
Subject: [PATCH 1474/2396] hw/i2c/smbus_eeprom: Add minimum write recovery
 time for DDR2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is needed for newer u-boot-sam460ex versions to pass the DRAM
setup.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251008122502.9DA8956F301@zero.eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i2c/smbus_eeprom.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/i2c/smbus_eeprom.c b/hw/i2c/smbus_eeprom.c
index 0a1088fbb0..26e211b31a 100644
--- a/hw/i2c/smbus_eeprom.c
+++ b/hw/i2c/smbus_eeprom.c
@@ -288,6 +288,7 @@ uint8_t *spd_data_generate(enum sdram_type type, ram_addr_t ram_size)
     spd[33] = 8;    /* addr/cmd hold time */
     spd[34] = 20;   /* data input setup time */
     spd[35] = 8;    /* data input hold time */
+    spd[36] = (type == DDR2 ? 13 << 2 : 0); /* min. write recovery time */
 
     /* checksum */
     for (i = 0; i < 63; i++) {

From 270b28681e369082dc17f58eae2871b75d3e8e6c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Oct 2025 13:12:43 +0200
Subject: [PATCH 1475/2396] hw/ppc/e500: Check for compatible CPU type instead
 of aborting ungracefully
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When using the ppce500 machine with an embedded CPU type that has
the right MMU model, but is not part of the e500 CPU family, QEMU
currently aborts ungracefully:

 $ ./qemu-system-ppc -machine ppce500 -cpu e200z5 -nographic
 qemu-system-ppc: ../qemu/hw/core/gpio.c:108: qdev_get_gpio_in_named:
  Assertion `n >= 0 && n < gpio_list->num_in' failed.
 Aborted (core dumped)

The ppce500 machine expects a CPU with certain GPIO interrupt pins,
so let's replace the coarse check for the MMU_BOOKE206 model with
a more precise check that only allows CPUs from the e500 family.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3162
Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20251015111243.1585018-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/e500.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 723c97fad2..3d69428f31 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -20,6 +20,7 @@
 #include "qemu/guest-random.h"
 #include "exec/target_page.h"
 #include "qapi/error.h"
+#include "cpu-models.h"
 #include "e500.h"
 #include "e500-ccsr.h"
 #include "net/net.h"
@@ -942,9 +943,8 @@ void ppce500_init(MachineState *machine)
         env = &cpu->env;
         cs = CPU(cpu);
 
-        if (env->mmu_model != POWERPC_MMU_BOOKE206) {
-            error_report("MMU model %i not supported by this machine",
-                         env->mmu_model);
+        if (!(POWERPC_CPU_GET_CLASS(cpu)->svr & POWERPC_SVR_E500)) {
+            error_report("This machine needs a CPU from the e500 family");
             exit(1);
         }
 

From 6095c7dd3b6750eaac7eee7a6327ae68af19097e Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Thu, 16 Oct 2025 14:48:10 +0200
Subject: [PATCH 1476/2396] hw/openrisc/openrisc_sim: Avoid buffer overflow
 build error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Resolves this build breakage (which is actually a false-positive)

../hw/openrisc/openrisc_sim.c: In function ‘openrisc_sim_init’:
../hw/openrisc/openrisc_sim.c:284:45: error: ‘__builtin___snprintf_chk’ output may be truncated before the last format character [-Werror=format-truncation=]
     snprintf(alias, sizeof(alias), "serial%d", uart_idx);
                                             ^
In file included from /usr/include/stdio.h:964:0,
                 from /data/qemu/include/qemu/osdep.h:114,
                 from ../hw/openrisc/openrisc_sim.c:21:
/usr/include/bits/stdio2.h:54:10: note: ‘__builtin___snprintf_chk’ output between 8 and 9 bytes into a destination of size 8
   return __builtin___snprintf_chk (__s, __n, __USE_FORTIFY_LEVEL - 1,
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        __glibc_objsize (__s), __fmt,
        ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
        __va_arg_pack ());
        ~~~~~~~~~~~~~~~~~

by using a modern, more robust allocation pattern.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <298bd904-1ee9-439e-8220-7a24e0952861@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/openrisc/openrisc_sim.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/openrisc/openrisc_sim.c b/hw/openrisc/openrisc_sim.c
index 880c8ebbb8..b7d9cdd900 100644
--- a/hw/openrisc/openrisc_sim.c
+++ b/hw/openrisc/openrisc_sim.c
@@ -247,10 +247,10 @@ static void openrisc_sim_serial_init(Or1ksimState *state, hwaddr base,
                                      OpenRISCCPU *cpus[], int irq_pin,
                                      int uart_idx)
 {
+    g_autofree char *alias = g_strdup_printf("serial%d", uart_idx);
     void *fdt = state->fdt;
     char *nodename;
     qemu_irq serial_irq;
-    char alias[sizeof("serial0")];
     int i;
 
     if (num_cpus > 1) {
@@ -281,7 +281,6 @@ static void openrisc_sim_serial_init(Or1ksimState *state, hwaddr base,
         /* The /chosen node is created during fdt creation. */
         qemu_fdt_setprop_string(fdt, "/chosen", "stdout-path", nodename);
     }
-    snprintf(alias, sizeof(alias), "serial%d", uart_idx);
     qemu_fdt_setprop_string(fdt, "/aliases", alias, nodename);
 
     g_free(nodename);

From f74ce602264d05f3b17de6d431f887fa0f0d5932 Mon Sep 17 00:00:00 2001
From: Roger Pau Monne <roger.pau@citrix.com>
Date: Fri, 17 Oct 2025 17:51:36 +0200
Subject: [PATCH 1477/2396] hw/xen: pass PCI domain to
 xc_physdev_map_pirq_msi()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It's currently impossible for passthrough devices on segment different
than 0 to work correctly, as the PCI domain is not provided to
xc_physdev_map_pirq_msi(), and hence it's unconditionally assumed that
all devices are on segment 0.

Adjust the call to xc_physdev_map_pirq_msi() to pass the PCI domain in
the high 16bits of the bus parameter.  On versions of Xen where this
is not supported the passed segment will be ignored and assume to be 0,
no worse than the current state.

Signed-off-by: Roger Pau Monné <roger.pau@citrix.com>
Reviewed-by: Frediano Ziglio <freddy77@gmail.com>
Reviewed-by: Anthony PERARD <anthony.perard@vates.tech>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-ID: <20251017155136.16540-1-roger.pau@citrix.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/xen/xen_pt_msi.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/xen/xen_pt_msi.c b/hw/xen/xen_pt_msi.c
index e9ba17317a..df15ccf0d0 100644
--- a/hw/xen/xen_pt_msi.c
+++ b/hw/xen/xen_pt_msi.c
@@ -138,6 +138,7 @@ static int msi_msix_setup(XenPCIPassthroughState *s,
         rc = xc_physdev_map_pirq_msi(xen_xc, xen_domid, XEN_PT_AUTO_ASSIGN,
                                      ppirq, PCI_DEVFN(s->real_device.dev,
                                                       s->real_device.func),
+                                     ((uint32_t)s->real_device.domain << 16) |
                                      s->real_device.bus,
                                      msix_entry, table_base);
         if (rc) {

From f66752961a5750298229b86adccd821e7785bfdf Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:00 +0200
Subject: [PATCH 1478/2396] hw/core/register: remove the REGISTER device type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The REGISTER class (RegisterInfo struct) is currently a QOM type
inheriting from DEVICE. This class has no real purpose:
   - the qdev API is not used,
   - according to the comment preceding it, the object_initialize call
     is here to zero-initialize the struct. However all the effective
     struct attributes are then initialized explicitly.
   - the object is never parented.

This commits drops the REGISTER QOM type completely, leaving the
RegisterInfo struct as a bare C struct.

The register_register_types function is left empty here because it is
reused in the next commit.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-2-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/register.c             | 18 ------------------
 hw/net/can/xlnx-versal-canfd.c |  2 --
 include/hw/register.h          |  7 -------
 3 files changed, 27 deletions(-)

diff --git a/hw/core/register.c b/hw/core/register.c
index 3340df70b0..2553cb15ab 100644
--- a/hw/core/register.c
+++ b/hw/core/register.c
@@ -258,9 +258,6 @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
         int index = rae[i].addr / data_size;
         RegisterInfo *r = &ri[index];
 
-        /* Init the register, this will zero it. */
-        object_initialize((void *)r, sizeof(*r), TYPE_REGISTER);
-
         /* Set the properties of the register */
         r->data = data + data_size * index;
         r->data_size = data_size;
@@ -318,24 +315,9 @@ void register_finalize_block(RegisterInfoArray *r_array)
     g_free(r_array);
 }
 
-static void register_class_init(ObjectClass *oc, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-
-    /* Reason: needs to be wired up to work */
-    dc->user_creatable = false;
-}
-
-static const TypeInfo register_info = {
-    .name  = TYPE_REGISTER,
-    .parent = TYPE_DEVICE,
-    .class_init = register_class_init,
-    .instance_size = sizeof(RegisterInfo),
-};
 
 static void register_register_types(void)
 {
-    type_register_static(&register_info);
 }
 
 type_init(register_register_types)
diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index 343348660b..99bbdd7d3f 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -1868,8 +1868,6 @@ static int canfd_populate_regarray(XlnxVersalCANFDState *s,
         int index = rae[i].addr / 4;
         RegisterInfo *r = &s->reg_info[index];
 
-        object_initialize(r, sizeof(*r), TYPE_REGISTER);
-
         *r = (RegisterInfo) {
             .data = &s->regs[index],
             .data_size = sizeof(uint32_t),
diff --git a/include/hw/register.h b/include/hw/register.h
index a913c52aee..4d13ea183c 100644
--- a/include/hw/register.h
+++ b/include/hw/register.h
@@ -75,10 +75,6 @@ struct RegisterAccessInfo {
  */
 
 struct RegisterInfo {
-    /* <private> */
-    DeviceState parent_obj;
-
-    /* <public> */
     void *data;
     int data_size;
 
@@ -87,9 +83,6 @@ struct RegisterInfo {
     void *opaque;
 };
 
-#define TYPE_REGISTER "qemu-register"
-DECLARE_INSTANCE_CHECKER(RegisterInfo, REGISTER,
-                         TYPE_REGISTER)
 
 /**
  * This structure is used to group all of the individual registers which are

From 5c6367bc1c8850f74812eeaaf87cff9911be58de Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:01 +0200
Subject: [PATCH 1479/2396] hw/core/register: add the REGISTER_ARRAY type
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduce the REGISTER_ARRAY QOM type. This type reuses the existing
RegisterInfoArray struct. When `register_init_block' is called, it creates
a REGISTER_ARRAY object and parents it to the calling device. This way
it gets finalized when the device is. The memory region is parented to
the REGISTER_ARRAY object to ensure correct finalizing order.

The finalize function of the REGISTER_ARRAY type performs the necessary
cleaning that used to be done by `register_finalize_block'. The latter
is left empty and will be removed when all the register API users have
been refactored.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-3-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/register.c    | 26 ++++++++++++++++++++++----
 include/hw/register.h |  4 ++++
 2 files changed, 26 insertions(+), 4 deletions(-)

diff --git a/hw/core/register.c b/hw/core/register.c
index 2553cb15ab..1612ad174f 100644
--- a/hw/core/register.c
+++ b/hw/core/register.c
@@ -245,10 +245,16 @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
                                               size_t data_size_bits)
 {
     const char *device_prefix = object_get_typename(OBJECT(owner));
-    RegisterInfoArray *r_array = g_new0(RegisterInfoArray, 1);
+    Object *obj;
+    RegisterInfoArray *r_array;
     int data_size = data_size_bits >> 3;
     int i;
 
+    obj = object_new(TYPE_REGISTER_ARRAY);
+    object_property_add_child(OBJECT(owner), "reg-array[*]", obj);
+    object_unref(obj);
+
+    r_array = REGISTER_ARRAY(obj);
     r_array->r = g_new0(RegisterInfo *, num);
     r_array->num_elements = num;
     r_array->debug = debug_enabled;
@@ -267,7 +273,7 @@ static RegisterInfoArray *register_init_block(DeviceState *owner,
         r_array->r[i] = r;
     }
 
-    memory_region_init_io(&r_array->mem, OBJECT(owner), ops, r_array,
+    memory_region_init_io(&r_array->mem, OBJECT(r_array), ops, r_array,
                           device_prefix, memory_size);
 
     return r_array;
@@ -309,15 +315,27 @@ RegisterInfoArray *register_init_block64(DeviceState *owner,
                                data, ops, debug_enabled, memory_size, 64);
 }
 
-void register_finalize_block(RegisterInfoArray *r_array)
+static void register_array_finalize(Object *obj)
 {
+    RegisterInfoArray *r_array = REGISTER_ARRAY(obj);
+
     g_free(r_array->r);
-    g_free(r_array);
 }
 
+void register_finalize_block(RegisterInfoArray *r_array)
+{
+}
+
+static const TypeInfo register_array_info = {
+    .name  = TYPE_REGISTER_ARRAY,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(RegisterInfoArray),
+    .instance_finalize = register_array_finalize,
+};
 
 static void register_register_types(void)
 {
+    type_register_static(&register_array_info);
 }
 
 type_init(register_register_types)
diff --git a/include/hw/register.h b/include/hw/register.h
index 4d13ea183c..65c82600e0 100644
--- a/include/hw/register.h
+++ b/include/hw/register.h
@@ -83,6 +83,8 @@ struct RegisterInfo {
     void *opaque;
 };
 
+#define TYPE_REGISTER_ARRAY "qemu-register-array"
+OBJECT_DECLARE_SIMPLE_TYPE(RegisterInfoArray, REGISTER_ARRAY)
 
 /**
  * This structure is used to group all of the individual registers which are
@@ -96,6 +98,8 @@ struct RegisterInfo {
  */
 
 struct RegisterInfoArray {
+    Object parent_obj;
+
     MemoryRegion mem;
 
     int num_elements;

From f423f7ebac82136515f3e3957a26f2482ff04ed9 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:02 +0200
Subject: [PATCH 1480/2396] hw/core/register: remove the calls to
 `register_finalize_block'
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function is now a no-op. The register array is parented to the
device and get finalized when the device is.

Drop all the calls to `register_finalize_block'. Drop the
RegisterInfoArray reference when it is not used elsewhere in the device.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-4-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/misc/xlnx-versal-crl.c              | 38 +++++++++++---------------
 hw/misc/xlnx-versal-trng.c             |  1 -
 hw/misc/xlnx-versal-xramc.c            | 12 ++------
 hw/misc/xlnx-zynqmp-apu-ctrl.c         | 12 ++------
 hw/misc/xlnx-zynqmp-crf.c              | 12 ++------
 hw/nvram/xlnx-bbram.c                  | 13 ++-------
 hw/nvram/xlnx-versal-efuse-ctrl.c      |  1 -
 hw/nvram/xlnx-zynqmp-efuse.c           |  8 ------
 include/hw/misc/xlnx-versal-crl.h      |  1 -
 include/hw/misc/xlnx-versal-xramc.h    |  1 -
 include/hw/misc/xlnx-zynqmp-apu-ctrl.h |  1 -
 include/hw/misc/xlnx-zynqmp-crf.h      |  1 -
 include/hw/nvram/xlnx-bbram.h          |  1 -
 13 files changed, 28 insertions(+), 74 deletions(-)

diff --git a/hw/misc/xlnx-versal-crl.c b/hw/misc/xlnx-versal-crl.c
index 10e6af002b..5987f32c71 100644
--- a/hw/misc/xlnx-versal-crl.c
+++ b/hw/misc/xlnx-versal-crl.c
@@ -634,17 +634,17 @@ static void versal_crl_init(Object *obj)
     XlnxVersalCRL *s = XLNX_VERSAL_CRL(obj);
     XlnxVersalCRLBase *xvcb = XLNX_VERSAL_CRL_BASE(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
     int i;
 
-    xvcb->reg_array =
-        register_init_block32(DEVICE(obj), crl_regs_info,
-                              ARRAY_SIZE(crl_regs_info),
-                              s->regs_info, s->regs,
-                              &crl_ops,
-                              XLNX_VERSAL_CRL_ERR_DEBUG,
-                              CRL_R_MAX * 4);
+    reg_array = register_init_block32(DEVICE(obj), crl_regs_info,
+                                      ARRAY_SIZE(crl_regs_info),
+                                      s->regs_info, s->regs,
+                                      &crl_ops,
+                                      XLNX_VERSAL_CRL_ERR_DEBUG,
+                                      CRL_R_MAX * 4);
     xvcb->regs = s->regs;
-    sysbus_init_mmio(sbd, &xvcb->reg_array->mem);
+    sysbus_init_mmio(sbd, &reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 
     for (i = 0; i < ARRAY_SIZE(s->cfg.rpu); ++i) {
@@ -688,17 +688,18 @@ static void versal2_crl_init(Object *obj)
     XlnxVersal2CRL *s = XLNX_VERSAL2_CRL(obj);
     XlnxVersalCRLBase *xvcb = XLNX_VERSAL_CRL_BASE(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
     size_t i;
 
-    xvcb->reg_array = register_init_block32(DEVICE(obj), versal2_crl_regs_info,
-                                            ARRAY_SIZE(versal2_crl_regs_info),
-                                            s->regs_info, s->regs,
-                                            &crl_ops,
-                                            XLNX_VERSAL_CRL_ERR_DEBUG,
-                                            VERSAL2_CRL_R_MAX * 4);
+    reg_array = register_init_block32(DEVICE(obj), versal2_crl_regs_info,
+                                      ARRAY_SIZE(versal2_crl_regs_info),
+                                      s->regs_info, s->regs,
+                                      &crl_ops,
+                                      XLNX_VERSAL_CRL_ERR_DEBUG,
+                                      VERSAL2_CRL_R_MAX * 4);
     xvcb->regs = s->regs;
 
-    sysbus_init_mmio(sbd, &xvcb->reg_array->mem);
+    sysbus_init_mmio(sbd, &reg_array->mem);
 
     for (i = 0; i < ARRAY_SIZE(s->cfg.rpu); ++i) {
         object_property_add_link(obj, "rpu[*]", TYPE_ARM_CPU,
@@ -750,12 +751,6 @@ static void versal2_crl_init(Object *obj)
     }
 }
 
-static void crl_finalize(Object *obj)
-{
-    XlnxVersalCRLBase *s = XLNX_VERSAL_CRL_BASE(obj);
-    register_finalize_block(s->reg_array);
-}
-
 static const VMStateDescription vmstate_versal_crl = {
     .name = TYPE_XLNX_VERSAL_CRL,
     .version_id = 1,
@@ -804,7 +799,6 @@ static const TypeInfo crl_base_info = {
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(XlnxVersalCRLBase),
     .class_size    = sizeof(XlnxVersalCRLBaseClass),
-    .instance_finalize = crl_finalize,
     .abstract      = true,
 };
 
diff --git a/hw/misc/xlnx-versal-trng.c b/hw/misc/xlnx-versal-trng.c
index f34dd3ef35..2b573a45bd 100644
--- a/hw/misc/xlnx-versal-trng.c
+++ b/hw/misc/xlnx-versal-trng.c
@@ -627,7 +627,6 @@ static void trng_finalize(Object *obj)
 {
     XlnxVersalTRng *s = XLNX_VERSAL_TRNG(obj);
 
-    register_finalize_block(s->reg_array);
     g_rand_free(s->prng);
     s->prng = NULL;
 }
diff --git a/hw/misc/xlnx-versal-xramc.c b/hw/misc/xlnx-versal-xramc.c
index 07370b80c0..d90f3e87c7 100644
--- a/hw/misc/xlnx-versal-xramc.c
+++ b/hw/misc/xlnx-versal-xramc.c
@@ -190,24 +190,19 @@ static void xram_ctrl_init(Object *obj)
 {
     XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
 
-    s->reg_array =
+    reg_array =
         register_init_block32(DEVICE(obj), xram_ctrl_regs_info,
                               ARRAY_SIZE(xram_ctrl_regs_info),
                               s->regs_info, s->regs,
                               &xram_ctrl_ops,
                               XLNX_XRAM_CTRL_ERR_DEBUG,
                               XRAM_CTRL_R_MAX * 4);
-    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_mmio(sbd, &reg_array->mem);
     sysbus_init_irq(sbd, &s->irq);
 }
 
-static void xram_ctrl_finalize(Object *obj)
-{
-    XlnxXramCtrl *s = XLNX_XRAM_CTRL(obj);
-    register_finalize_block(s->reg_array);
-}
-
 static const VMStateDescription vmstate_xram_ctrl = {
     .name = TYPE_XLNX_XRAM_CTRL,
     .version_id = 1,
@@ -241,7 +236,6 @@ static const TypeInfo xram_ctrl_info = {
     .instance_size     = sizeof(XlnxXramCtrl),
     .class_init        = xram_ctrl_class_init,
     .instance_init     = xram_ctrl_init,
-    .instance_finalize = xram_ctrl_finalize,
 };
 
 static void xram_ctrl_register_types(void)
diff --git a/hw/misc/xlnx-zynqmp-apu-ctrl.c b/hw/misc/xlnx-zynqmp-apu-ctrl.c
index e85da32d99..08777496d5 100644
--- a/hw/misc/xlnx-zynqmp-apu-ctrl.c
+++ b/hw/misc/xlnx-zynqmp-apu-ctrl.c
@@ -179,16 +179,17 @@ static void zynqmp_apu_handle_wfi(void *opaque, int irq, int level)
 static void zynqmp_apu_init(Object *obj)
 {
     XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
+    RegisterInfoArray *reg_array;
     int i;
 
-    s->reg_array =
+    reg_array =
         register_init_block32(DEVICE(obj), zynqmp_apu_regs_info,
                               ARRAY_SIZE(zynqmp_apu_regs_info),
                               s->regs_info, s->regs,
                               &zynqmp_apu_ops,
                               XILINX_ZYNQMP_APU_ERR_DEBUG,
                               APU_R_MAX * 4);
-    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->reg_array->mem);
+    sysbus_init_mmio(SYS_BUS_DEVICE(obj), &reg_array->mem);
     sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq_imr);
 
     for (i = 0; i < APU_MAX_CPU; ++i) {
@@ -208,12 +209,6 @@ static void zynqmp_apu_init(Object *obj)
     qdev_init_gpio_in_named(DEVICE(obj), zynqmp_apu_handle_wfi, "wfi_in", 4);
 }
 
-static void zynqmp_apu_finalize(Object *obj)
-{
-    XlnxZynqMPAPUCtrl *s = XLNX_ZYNQMP_APU_CTRL(obj);
-    register_finalize_block(s->reg_array);
-}
-
 static const VMStateDescription vmstate_zynqmp_apu = {
     .name = TYPE_XLNX_ZYNQMP_APU_CTRL,
     .version_id = 1,
@@ -241,7 +236,6 @@ static const TypeInfo zynqmp_apu_info = {
     .instance_size     = sizeof(XlnxZynqMPAPUCtrl),
     .class_init        = zynqmp_apu_class_init,
     .instance_init     = zynqmp_apu_init,
-    .instance_finalize = zynqmp_apu_finalize,
 };
 
 static void zynqmp_apu_register_types(void)
diff --git a/hw/misc/xlnx-zynqmp-crf.c b/hw/misc/xlnx-zynqmp-crf.c
index cccca0e814..d9c1bd50e4 100644
--- a/hw/misc/xlnx-zynqmp-crf.c
+++ b/hw/misc/xlnx-zynqmp-crf.c
@@ -211,24 +211,19 @@ static void crf_init(Object *obj)
 {
     XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
 
-    s->reg_array =
+    reg_array =
         register_init_block32(DEVICE(obj), crf_regs_info,
                               ARRAY_SIZE(crf_regs_info),
                               s->regs_info, s->regs,
                               &crf_ops,
                               XLNX_ZYNQMP_CRF_ERR_DEBUG,
                               CRF_R_MAX * 4);
-    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_mmio(sbd, &reg_array->mem);
     sysbus_init_irq(sbd, &s->irq_ir);
 }
 
-static void crf_finalize(Object *obj)
-{
-    XlnxZynqMPCRF *s = XLNX_ZYNQMP_CRF(obj);
-    register_finalize_block(s->reg_array);
-}
-
 static const VMStateDescription vmstate_crf = {
     .name = TYPE_XLNX_ZYNQMP_CRF,
     .version_id = 1,
@@ -255,7 +250,6 @@ static const TypeInfo crf_info = {
     .instance_size     = sizeof(XlnxZynqMPCRF),
     .class_init        = crf_class_init,
     .instance_init     = crf_init,
-    .instance_finalize = crf_finalize,
 };
 
 static void crf_register_types(void)
diff --git a/hw/nvram/xlnx-bbram.c b/hw/nvram/xlnx-bbram.c
index 5702bb3f31..22aefbc240 100644
--- a/hw/nvram/xlnx-bbram.c
+++ b/hw/nvram/xlnx-bbram.c
@@ -456,8 +456,9 @@ static void bbram_ctrl_init(Object *obj)
 {
     XlnxBBRam *s = XLNX_BBRAM(obj);
     SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
 
-    s->reg_array =
+    reg_array =
         register_init_block32(DEVICE(obj), bbram_ctrl_regs_info,
                               ARRAY_SIZE(bbram_ctrl_regs_info),
                               s->regs_info, s->regs,
@@ -465,17 +466,10 @@ static void bbram_ctrl_init(Object *obj)
                               XLNX_BBRAM_ERR_DEBUG,
                               R_MAX * 4);
 
-    sysbus_init_mmio(sbd, &s->reg_array->mem);
+    sysbus_init_mmio(sbd, &reg_array->mem);
     sysbus_init_irq(sbd, &s->irq_bbram);
 }
 
-static void bbram_ctrl_finalize(Object *obj)
-{
-    XlnxBBRam *s = XLNX_BBRAM(obj);
-
-    register_finalize_block(s->reg_array);
-}
-
 static void bbram_prop_set_drive(Object *obj, Visitor *v, const char *name,
                                  void *opaque, Error **errp)
 {
@@ -542,7 +536,6 @@ static const TypeInfo bbram_ctrl_info = {
     .instance_size = sizeof(XlnxBBRam),
     .class_init    = bbram_ctrl_class_init,
     .instance_init = bbram_ctrl_init,
-    .instance_finalize = bbram_ctrl_finalize,
 };
 
 static void bbram_ctrl_register_types(void)
diff --git a/hw/nvram/xlnx-versal-efuse-ctrl.c b/hw/nvram/xlnx-versal-efuse-ctrl.c
index 9096219800..6f17f32a0c 100644
--- a/hw/nvram/xlnx-versal-efuse-ctrl.c
+++ b/hw/nvram/xlnx-versal-efuse-ctrl.c
@@ -728,7 +728,6 @@ static void efuse_ctrl_finalize(Object *obj)
 {
     XlnxVersalEFuseCtrl *s = XLNX_VERSAL_EFUSE_CTRL(obj);
 
-    register_finalize_block(s->reg_array);
     g_free(s->extra_pg0_lock_spec);
 }
 
diff --git a/hw/nvram/xlnx-zynqmp-efuse.c b/hw/nvram/xlnx-zynqmp-efuse.c
index 5a218c32e8..ce35bb0cc1 100644
--- a/hw/nvram/xlnx-zynqmp-efuse.c
+++ b/hw/nvram/xlnx-zynqmp-efuse.c
@@ -816,13 +816,6 @@ static void zynqmp_efuse_init(Object *obj)
     sysbus_init_irq(sbd, &s->irq);
 }
 
-static void zynqmp_efuse_finalize(Object *obj)
-{
-    XlnxZynqMPEFuse *s = XLNX_ZYNQMP_EFUSE(obj);
-
-    register_finalize_block(s->reg_array);
-}
-
 static const VMStateDescription vmstate_efuse = {
     .name = TYPE_XLNX_ZYNQMP_EFUSE,
     .version_id = 1,
@@ -857,7 +850,6 @@ static const TypeInfo efuse_info = {
     .instance_size = sizeof(XlnxZynqMPEFuse),
     .class_init    = zynqmp_efuse_class_init,
     .instance_init = zynqmp_efuse_init,
-    .instance_finalize = zynqmp_efuse_finalize,
 };
 
 static void efuse_register_types(void)
diff --git a/include/hw/misc/xlnx-versal-crl.h b/include/hw/misc/xlnx-versal-crl.h
index f6b8694ebe..49ed500acd 100644
--- a/include/hw/misc/xlnx-versal-crl.h
+++ b/include/hw/misc/xlnx-versal-crl.h
@@ -533,7 +533,6 @@ REG32(VERSAL2_RST_OCM, 0x3d8)
 struct XlnxVersalCRLBase {
     SysBusDevice parent_obj;
 
-    RegisterInfoArray *reg_array;
     uint32_t *regs;
 };
 
diff --git a/include/hw/misc/xlnx-versal-xramc.h b/include/hw/misc/xlnx-versal-xramc.h
index d3d1862676..35e4e8b91d 100644
--- a/include/hw/misc/xlnx-versal-xramc.h
+++ b/include/hw/misc/xlnx-versal-xramc.h
@@ -90,7 +90,6 @@ typedef struct XlnxXramCtrl {
         unsigned int encoded_size;
     } cfg;
 
-    RegisterInfoArray *reg_array;
     uint32_t regs[XRAM_CTRL_R_MAX];
     RegisterInfo regs_info[XRAM_CTRL_R_MAX];
 } XlnxXramCtrl;
diff --git a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
index c3bf3c1583..fbfe34aa7e 100644
--- a/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
+++ b/include/hw/misc/xlnx-zynqmp-apu-ctrl.h
@@ -85,7 +85,6 @@ struct XlnxZynqMPAPUCtrl {
     uint8_t cpu_pwrdwn_req;
     uint8_t cpu_in_wfi;
 
-    RegisterInfoArray *reg_array;
     uint32_t regs[APU_R_MAX];
     RegisterInfo regs_info[APU_R_MAX];
 };
diff --git a/include/hw/misc/xlnx-zynqmp-crf.h b/include/hw/misc/xlnx-zynqmp-crf.h
index 02ef0bdeee..c746ae1039 100644
--- a/include/hw/misc/xlnx-zynqmp-crf.h
+++ b/include/hw/misc/xlnx-zynqmp-crf.h
@@ -203,7 +203,6 @@ struct XlnxZynqMPCRF {
     MemoryRegion iomem;
     qemu_irq irq_ir;
 
-    RegisterInfoArray *reg_array;
     uint32_t regs[CRF_R_MAX];
     RegisterInfo regs_info[CRF_R_MAX];
 };
diff --git a/include/hw/nvram/xlnx-bbram.h b/include/hw/nvram/xlnx-bbram.h
index 58acbe9f51..af90900bfc 100644
--- a/include/hw/nvram/xlnx-bbram.h
+++ b/include/hw/nvram/xlnx-bbram.h
@@ -47,7 +47,6 @@ struct XlnxBBRam {
     bool bbram8_wo;
     bool blk_ro;
 
-    RegisterInfoArray *reg_array;
     uint32_t regs[RMAX_XLNX_BBRAM];
     RegisterInfo regs_info[RMAX_XLNX_BBRAM];
 };

From 2fcb0f1f28a03bdf61259f4856b980517d1cc9d7 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:03 +0200
Subject: [PATCH 1481/2396] hw/core/register: remove the
 `register_finalize_block' function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function is now unused. Drop it.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-5-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/register.c    |  4 ----
 include/hw/register.h | 14 --------------
 2 files changed, 18 deletions(-)

diff --git a/hw/core/register.c b/hw/core/register.c
index 1612ad174f..81316d4859 100644
--- a/hw/core/register.c
+++ b/hw/core/register.c
@@ -322,10 +322,6 @@ static void register_array_finalize(Object *obj)
     g_free(r_array->r);
 }
 
-void register_finalize_block(RegisterInfoArray *r_array)
-{
-}
-
 static const TypeInfo register_array_info = {
     .name  = TYPE_REGISTER_ARRAY,
     .parent = TYPE_OBJECT,
diff --git a/include/hw/register.h b/include/hw/register.h
index 65c82600e0..7b0f4c8b7a 100644
--- a/include/hw/register.h
+++ b/include/hw/register.h
@@ -209,18 +209,4 @@ RegisterInfoArray *register_init_block64(DeviceState *owner,
                                          bool debug_enabled,
                                          uint64_t memory_size);
 
-/**
- * This function should be called to cleanup the registers that were initialized
- * when calling register_init_block32(). This function should only be called
- * from the device's instance_finalize function.
- *
- * Any memory operations that the device performed that require cleanup (such
- * as creating subregions) need to be called before calling this function.
- *
- * @r_array: A structure containing all of the registers, as returned by
- *           register_init_block32()
- */
-
-void register_finalize_block(RegisterInfoArray *r_array);
-
 #endif

From b7477d714005e1ed5784f6c066a4c43d55c010e5 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:04 +0200
Subject: [PATCH 1482/2396] hw/net/can/xlnx-versal-canfd: refactor the banked
 registers logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CANFD device has several groups of registers:
  - the main control registers from 0x0 to 0xec
  - several banks of multiple registers. The number of banks is either
    hardcoded, or configurable using QOM properties:
      - Tx registers
      - Filter registers
      - Tx events registers
      - Rx0 registers
      - Rx1 registers

As of now, all the registers are handled using the register API. The
banked register logic results in a convoluted code to correctly allocate
the register descriptors for the register API. This code bypasses the
standard register API creation function (register_init_block). The
resulting code leaks memory when the device is finalized.

This commit introduces decoding logic for the banked registers. Those
registers are quite simple in practice. Accessing them triggers no
side-effect (only the filter registers need a check to catch guest
invalid behaviour). Starting from the Tx events registers, they are all
read-only.

The main device memory region is changed to an I/O one, calling the
new decoding logic when accessed. The register API memory region still
overlaps all of it so for now the introduced code has no effect. The
next commit will remove the register API usage for banked registers.

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-6-luc.michel@amd.com>
[PMD: Have canfd_decode_reg_bank() take optional @idx, types fixups]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/can/xlnx-versal-canfd.c | 150 ++++++++++++++++++++++++++++++++-
 1 file changed, 146 insertions(+), 4 deletions(-)

diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index 99bbdd7d3f..04f9a6d57d 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -1410,6 +1410,22 @@ static uint64_t canfd_srr_pre_write(RegisterInfo *reg, uint64_t val64)
     return s->regs[R_SOFTWARE_RESET_REGISTER];
 }
 
+static void filter_reg_write(XlnxVersalCANFDState *s, hwaddr addr,
+                             unsigned bank_idx, uint32_t val)
+{
+    size_t reg_idx = addr / sizeof(uint32_t);
+
+    if (!(s->regs[R_ACCEPTANCE_FILTER_CONTROL_REGISTER] & (1 << bank_idx))) {
+        s->regs[reg_idx] = val;
+    } else {
+        g_autofree char *path = object_get_canonical_path(OBJECT(s));
+
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter register 0x%"
+                      HWADDR_PRIx " changed while filter %u enabled\n",
+                      path, addr, bank_idx + 1);
+    }
+}
+
 static uint64_t filter_mask(RegisterInfo *reg, uint64_t val64)
 {
     XlnxVersalCANFDState *s = XILINX_CANFD(reg->opaque);
@@ -1763,9 +1779,135 @@ static void xlnx_versal_canfd_ptimer_cb(void *opaque)
     /* No action required on the timer rollover. */
 }
 
+static bool canfd_decode_reg_bank(XlnxVersalCANFDState *s, hwaddr addr,
+                                  hwaddr first_reg, hwaddr last_reg,
+                                  size_t num_banks, unsigned *idx,
+                                  hwaddr *offset)
+{
+    hwaddr base = addr - first_reg;
+    hwaddr span = last_reg - first_reg + sizeof(uint32_t);
+    unsigned index = base / span;
+
+    if (index >= num_banks) {
+        return false;
+    }
+    if (idx) {
+        *idx = index;
+    }
+
+    *offset = base % span;
+    *offset += first_reg;
+
+    return true;
+}
+
+/*
+ * Decode the given addr into a (idx, offset) pair:
+ *   - idx is the bank index of the register at addr,
+ *   - offset is the register offset relative to bank 0
+ *
+ * @return true is the decoding succeded, false otherwise
+ */
+static bool canfd_decode_addr(XlnxVersalCANFDState *s, hwaddr addr,
+                              unsigned *idx, hwaddr *offset)
+{
+    if (addr <= A_RX_FIFO_WATERMARK_REGISTER) {
+        /* from 0x0 to 0xec. Handled by the register API */
+        g_assert_not_reached();
+    } else if (addr < A_TB_ID_REGISTER) {
+        /* no register in this gap */
+        return false;
+    } else if (addr < A_AFMR_REGISTER) {
+        /* TX registers */
+        return canfd_decode_reg_bank(s, addr,
+                                     A_TB_ID_REGISTER, A_TB_DW15_REGISTER,
+                                     s->cfg.tx_fifo, idx, offset);
+    } else if (addr < A_TXE_FIFO_TB_ID_REGISTER) {
+        /* Filter registers */
+        return canfd_decode_reg_bank(s, addr,
+                                     A_AFMR_REGISTER, A_AFIR_REGISTER,
+                                     32, idx, offset);
+    } else if (addr < A_RB_ID_REGISTER) {
+        /* TX event registers */
+        return canfd_decode_reg_bank(s, addr,
+                                     A_TXE_FIFO_TB_ID_REGISTER,
+                                     A_TXE_FIFO_TB_DLC_REGISTER,
+                                     32, idx, offset);
+    } else if (addr < A_RB_ID_REGISTER_1) {
+        /* RX0 registers */
+        return canfd_decode_reg_bank(s, addr,
+                                     A_RB_ID_REGISTER,
+                                     A_RB_DW15_REGISTER,
+                                     s->cfg.rx0_fifo, idx, offset);
+    } else if (addr <= A_RB_DW15_REGISTER_1) {
+        /* RX1 registers */
+        return canfd_decode_reg_bank(s, addr,
+                                     A_RB_ID_REGISTER_1,
+                                     A_RB_DW15_REGISTER_1,
+                                     s->cfg.rx1_fifo, idx, offset);
+    }
+
+    /* decode error */
+    return false;
+}
+
+static uint64_t canfd_read(void *opaque, hwaddr addr, unsigned size)
+{
+    XlnxVersalCANFDState *s = XILINX_CANFD(opaque);
+    hwaddr reg_offset;
+    uint64_t ret;
+
+    if (!canfd_decode_addr(s, addr, NULL, &reg_offset)) {
+        qemu_log_mask(LOG_GUEST_ERROR, TYPE_XILINX_CANFD
+                      ": read to unknown register at address 0x%"
+                      HWADDR_PRIx "\n", addr);
+        return 0;
+    }
+
+    switch (reg_offset) {
+    default:
+        ret = s->regs[addr / sizeof(uint32_t)];
+    }
+
+    return ret;
+}
+
+static void canfd_write(void *opaque, hwaddr addr, uint64_t value,
+                        unsigned size)
+{
+    XlnxVersalCANFDState *s = XILINX_CANFD(opaque);
+    unsigned bank_idx;
+    hwaddr reg_offset;
+
+    if (!canfd_decode_addr(s, addr, &bank_idx, &reg_offset)) {
+        qemu_log_mask(LOG_GUEST_ERROR, TYPE_XILINX_CANFD
+                      ": write to unknown register at address 0x%"
+                      HWADDR_PRIx "\n", addr);
+        return;
+    }
+
+    if (addr >= A_TXE_FIFO_TB_ID_REGISTER) {
+        /* All registers from TX event regs to the end are read-only */
+        qemu_log_mask(LOG_GUEST_ERROR, TYPE_XILINX_CANFD
+                      ": write to read-only register at 0x%" HWADDR_PRIx "\n",
+                      addr);
+        return;
+    }
+
+    switch (reg_offset) {
+    case A_AFMR_REGISTER:
+    case A_AFIR_REGISTER:
+        filter_reg_write(s, addr, bank_idx, value);
+        break;
+
+    default:
+        s->regs[addr / sizeof(uint32_t)] = value;
+    }
+}
+
 static const MemoryRegionOps canfd_ops = {
-    .read = register_read_memory,
-    .write = register_write_memory,
+    .read = canfd_read,
+    .write = canfd_write,
     .endianness = DEVICE_LITTLE_ENDIAN,
     .valid = {
         .min_access_size = 4,
@@ -2018,8 +2160,8 @@ static void canfd_init(Object *obj)
 {
     XlnxVersalCANFDState *s = XILINX_CANFD(obj);
 
-    memory_region_init(&s->iomem, obj, TYPE_XILINX_CANFD,
-                       XLNX_VERSAL_CANFD_R_MAX * 4);
+    memory_region_init_io(&s->iomem, obj, &canfd_ops, s, TYPE_XILINX_CANFD,
+                          XLNX_VERSAL_CANFD_R_MAX * 4);
 }
 
 static const VMStateDescription vmstate_canfd = {

From c11200c71575cb38f78548743555c2797d14bf96 Mon Sep 17 00:00:00 2001
From: Luc Michel <luc.michel@amd.com>
Date: Fri, 17 Oct 2025 18:18:05 +0200
Subject: [PATCH 1483/2396] hw/net/can/xlnx-versal-canfd: remove register API
 usage for banked regs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we have a simple decoding logic for all the banked registers,
remove the register API usage for them. This restricts the register API
usage to only the base registers (from 0x0 to 0xec).

This also removes all the custom code that was creating register
descriptors for the register API and was leading to memory leaks when
the device was finalized.

Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Luc Michel <luc.michel@amd.com>
Message-ID: <20251017161809.235740-7-luc.michel@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/can/xlnx-versal-canfd.c     | 303 ++---------------------------
 include/hw/net/xlnx-versal-canfd.h |   8 -
 2 files changed, 15 insertions(+), 296 deletions(-)

diff --git a/hw/net/can/xlnx-versal-canfd.c b/hw/net/can/xlnx-versal-canfd.c
index 04f9a6d57d..5735639b85 100644
--- a/hw/net/can/xlnx-versal-canfd.c
+++ b/hw/net/can/xlnx-versal-canfd.c
@@ -1426,46 +1426,6 @@ static void filter_reg_write(XlnxVersalCANFDState *s, hwaddr addr,
     }
 }
 
-static uint64_t filter_mask(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCANFDState *s = XILINX_CANFD(reg->opaque);
-    uint32_t reg_idx = (reg->access->addr) / 4;
-    uint32_t val = val64;
-    uint32_t filter_offset = (reg_idx - R_AFMR_REGISTER) / 2;
-
-    if (!(s->regs[R_ACCEPTANCE_FILTER_CONTROL_REGISTER] &
-        (1 << filter_offset))) {
-        s->regs[reg_idx] = val;
-    } else {
-        g_autofree char *path = object_get_canonical_path(OBJECT(s));
-
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d not enabled\n",
-                      path, filter_offset + 1);
-    }
-
-    return s->regs[reg_idx];
-}
-
-static uint64_t filter_id(RegisterInfo *reg, uint64_t val64)
-{
-    XlnxVersalCANFDState *s = XILINX_CANFD(reg->opaque);
-    hwaddr reg_idx = (reg->access->addr) / 4;
-    uint32_t val = val64;
-    uint32_t filter_offset = (reg_idx - R_AFIR_REGISTER) / 2;
-
-    if (!(s->regs[R_ACCEPTANCE_FILTER_CONTROL_REGISTER] &
-        (1 << filter_offset))) {
-        s->regs[reg_idx] = val;
-    } else {
-        g_autofree char *path = object_get_canonical_path(OBJECT(s));
-
-        qemu_log_mask(LOG_GUEST_ERROR, "%s: Acceptance filter %d not enabled\n",
-                      path, filter_offset + 1);
-    }
-
-    return s->regs[reg_idx];
-}
-
 static uint64_t canfd_tx_fifo_status_prew(RegisterInfo *reg, uint64_t val64)
 {
     XlnxVersalCANFDState *s = XILINX_CANFD(reg->opaque);
@@ -1591,125 +1551,6 @@ static uint64_t canfd_write_check_prew(RegisterInfo *reg, uint64_t val64)
     return 0;
 }
 
-static const RegisterAccessInfo canfd_tx_regs[] = {
-    {   .name = "TB_ID_REGISTER",  .addr = A_TB_ID_REGISTER,
-    },{ .name = "TB0_DLC_REGISTER",  .addr = A_TB0_DLC_REGISTER,
-    },{ .name = "TB_DW0_REGISTER",  .addr = A_TB_DW0_REGISTER,
-    },{ .name = "TB_DW1_REGISTER",  .addr = A_TB_DW1_REGISTER,
-    },{ .name = "TB_DW2_REGISTER",  .addr = A_TB_DW2_REGISTER,
-    },{ .name = "TB_DW3_REGISTER",  .addr = A_TB_DW3_REGISTER,
-    },{ .name = "TB_DW4_REGISTER",  .addr = A_TB_DW4_REGISTER,
-    },{ .name = "TB_DW5_REGISTER",  .addr = A_TB_DW5_REGISTER,
-    },{ .name = "TB_DW6_REGISTER",  .addr = A_TB_DW6_REGISTER,
-    },{ .name = "TB_DW7_REGISTER",  .addr = A_TB_DW7_REGISTER,
-    },{ .name = "TB_DW8_REGISTER",  .addr = A_TB_DW8_REGISTER,
-    },{ .name = "TB_DW9_REGISTER",  .addr = A_TB_DW9_REGISTER,
-    },{ .name = "TB_DW10_REGISTER",  .addr = A_TB_DW10_REGISTER,
-    },{ .name = "TB_DW11_REGISTER",  .addr = A_TB_DW11_REGISTER,
-    },{ .name = "TB_DW12_REGISTER",  .addr = A_TB_DW12_REGISTER,
-    },{ .name = "TB_DW13_REGISTER",  .addr = A_TB_DW13_REGISTER,
-    },{ .name = "TB_DW14_REGISTER",  .addr = A_TB_DW14_REGISTER,
-    },{ .name = "TB_DW15_REGISTER",  .addr = A_TB_DW15_REGISTER,
-    }
-};
-
-static const RegisterAccessInfo canfd_rx0_regs[] = {
-    {   .name = "RB_ID_REGISTER",  .addr = A_RB_ID_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DLC_REGISTER",  .addr = A_RB_DLC_REGISTER,
-        .ro = 0xfe1fffff,
-    },{ .name = "RB_DW0_REGISTER",  .addr = A_RB_DW0_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW1_REGISTER",  .addr = A_RB_DW1_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW2_REGISTER",  .addr = A_RB_DW2_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW3_REGISTER",  .addr = A_RB_DW3_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW4_REGISTER",  .addr = A_RB_DW4_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW5_REGISTER",  .addr = A_RB_DW5_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW6_REGISTER",  .addr = A_RB_DW6_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW7_REGISTER",  .addr = A_RB_DW7_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW8_REGISTER",  .addr = A_RB_DW8_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW9_REGISTER",  .addr = A_RB_DW9_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW10_REGISTER",  .addr = A_RB_DW10_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW11_REGISTER",  .addr = A_RB_DW11_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW12_REGISTER",  .addr = A_RB_DW12_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW13_REGISTER",  .addr = A_RB_DW13_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW14_REGISTER",  .addr = A_RB_DW14_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW15_REGISTER",  .addr = A_RB_DW15_REGISTER,
-        .ro = 0xffffffff,
-    }
-};
-
-static const RegisterAccessInfo canfd_rx1_regs[] = {
-    {   .name = "RB_ID_REGISTER_1",  .addr = A_RB_ID_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DLC_REGISTER_1",  .addr = A_RB_DLC_REGISTER_1,
-        .ro = 0xfe1fffff,
-    },{ .name = "RB0_DW0_REGISTER_1",  .addr = A_RB0_DW0_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW1_REGISTER_1",  .addr = A_RB_DW1_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW2_REGISTER_1",  .addr = A_RB_DW2_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW3_REGISTER_1",  .addr = A_RB_DW3_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW4_REGISTER_1",  .addr = A_RB_DW4_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW5_REGISTER_1",  .addr = A_RB_DW5_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW6_REGISTER_1",  .addr = A_RB_DW6_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW7_REGISTER_1",  .addr = A_RB_DW7_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW8_REGISTER_1",  .addr = A_RB_DW8_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW9_REGISTER_1",  .addr = A_RB_DW9_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW10_REGISTER_1",  .addr = A_RB_DW10_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW11_REGISTER_1",  .addr = A_RB_DW11_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW12_REGISTER_1",  .addr = A_RB_DW12_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW13_REGISTER_1",  .addr = A_RB_DW13_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW14_REGISTER_1",  .addr = A_RB_DW14_REGISTER_1,
-        .ro = 0xffffffff,
-    },{ .name = "RB_DW15_REGISTER_1",  .addr = A_RB_DW15_REGISTER_1,
-        .ro = 0xffffffff,
-    }
-};
-
-/* Acceptance filter registers. */
-static const RegisterAccessInfo canfd_af_regs[] = {
-    {   .name = "AFMR_REGISTER",  .addr = A_AFMR_REGISTER,
-        .pre_write = filter_mask,
-    },{ .name = "AFIR_REGISTER",  .addr = A_AFIR_REGISTER,
-        .pre_write = filter_id,
-    }
-};
-
-static const RegisterAccessInfo canfd_txe_regs[] = {
-    {   .name = "TXE_FIFO_TB_ID_REGISTER",  .addr = A_TXE_FIFO_TB_ID_REGISTER,
-        .ro = 0xffffffff,
-    },{ .name = "TXE_FIFO_TB_DLC_REGISTER",  .addr = A_TXE_FIFO_TB_DLC_REGISTER,
-        .ro = 0xffffffff,
-    }
-};
-
 static const RegisterAccessInfo canfd_regs_info[] = {
     {   .name = "SOFTWARE_RESET_REGISTER",  .addr = A_SOFTWARE_RESET_REGISTER,
         .pre_write = canfd_srr_pre_write,
@@ -1915,6 +1756,16 @@ static const MemoryRegionOps canfd_ops = {
     },
 };
 
+static const MemoryRegionOps canfd_regs_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
 static void canfd_reset(DeviceState *dev)
 {
     XlnxVersalCANFDState *s = XILINX_CANFD(dev);
@@ -1994,140 +1845,16 @@ static int xlnx_canfd_connect_to_bus(XlnxVersalCANFDState *s,
     return can_bus_insert_client(bus, &s->bus_client);
 }
 
-#define NUM_REG_PER_AF      ARRAY_SIZE(canfd_af_regs)
-#define NUM_AF              32
-#define NUM_REG_PER_TXE     ARRAY_SIZE(canfd_txe_regs)
-#define NUM_TXE             32
-
-static int canfd_populate_regarray(XlnxVersalCANFDState *s,
-                                  RegisterInfoArray *r_array, int pos,
-                                  const RegisterAccessInfo *rae,
-                                  int num_rae)
-{
-    int i;
-
-    for (i = 0; i < num_rae; i++) {
-        int index = rae[i].addr / 4;
-        RegisterInfo *r = &s->reg_info[index];
-
-        *r = (RegisterInfo) {
-            .data = &s->regs[index],
-            .data_size = sizeof(uint32_t),
-            .access = &rae[i],
-            .opaque = OBJECT(s),
-        };
-
-        r_array->r[i + pos] = r;
-    }
-    return i + pos;
-}
-
-static void canfd_create_rai(RegisterAccessInfo *rai_array,
-                                const RegisterAccessInfo *canfd_regs,
-                                int template_rai_array_sz,
-                                int num_template_to_copy)
-{
-    int i;
-    int reg_num;
-
-    for (reg_num = 0; reg_num < num_template_to_copy; reg_num++) {
-        int pos = reg_num * template_rai_array_sz;
-
-        memcpy(rai_array + pos, canfd_regs,
-               template_rai_array_sz * sizeof(RegisterAccessInfo));
-
-        for (i = 0; i < template_rai_array_sz; i++) {
-            const char *name = canfd_regs[i].name;
-            uint64_t addr = canfd_regs[i].addr;
-            rai_array[i + pos].name = g_strdup_printf("%s%d", name, reg_num);
-            rai_array[i + pos].addr = addr + pos * 4;
-        }
-    }
-}
-
-static RegisterInfoArray *canfd_create_regarray(XlnxVersalCANFDState *s)
-{
-    const char *device_prefix = object_get_typename(OBJECT(s));
-    uint64_t memory_size = XLNX_VERSAL_CANFD_R_MAX * 4;
-    int num_regs;
-    int pos = 0;
-    RegisterInfoArray *r_array;
-
-    num_regs = ARRAY_SIZE(canfd_regs_info) +
-                s->cfg.tx_fifo * NUM_REGS_PER_MSG_SPACE +
-                s->cfg.rx0_fifo * NUM_REGS_PER_MSG_SPACE +
-                NUM_AF * NUM_REG_PER_AF +
-                NUM_TXE * NUM_REG_PER_TXE;
-
-    s->tx_regs = g_new0(RegisterAccessInfo,
-                        s->cfg.tx_fifo * ARRAY_SIZE(canfd_tx_regs));
-
-    canfd_create_rai(s->tx_regs, canfd_tx_regs,
-                     ARRAY_SIZE(canfd_tx_regs), s->cfg.tx_fifo);
-
-    s->rx0_regs = g_new0(RegisterAccessInfo,
-                         s->cfg.rx0_fifo * ARRAY_SIZE(canfd_rx0_regs));
-
-    canfd_create_rai(s->rx0_regs, canfd_rx0_regs,
-                     ARRAY_SIZE(canfd_rx0_regs), s->cfg.rx0_fifo);
-
-    s->af_regs = g_new0(RegisterAccessInfo,
-                        NUM_AF * ARRAY_SIZE(canfd_af_regs));
-
-    canfd_create_rai(s->af_regs, canfd_af_regs,
-                     ARRAY_SIZE(canfd_af_regs), NUM_AF);
-
-    s->txe_regs = g_new0(RegisterAccessInfo,
-                         NUM_TXE * ARRAY_SIZE(canfd_txe_regs));
-
-    canfd_create_rai(s->txe_regs, canfd_txe_regs,
-                     ARRAY_SIZE(canfd_txe_regs), NUM_TXE);
-
-    if (s->cfg.enable_rx_fifo1) {
-        num_regs += s->cfg.rx1_fifo * NUM_REGS_PER_MSG_SPACE;
-
-        s->rx1_regs = g_new0(RegisterAccessInfo,
-                             s->cfg.rx1_fifo * ARRAY_SIZE(canfd_rx1_regs));
-
-        canfd_create_rai(s->rx1_regs, canfd_rx1_regs,
-                         ARRAY_SIZE(canfd_rx1_regs), s->cfg.rx1_fifo);
-    }
-
-    r_array = g_new0(RegisterInfoArray, 1);
-    r_array->r = g_new0(RegisterInfo * , num_regs);
-    r_array->num_elements = num_regs;
-    r_array->prefix = device_prefix;
-
-    pos = canfd_populate_regarray(s, r_array, pos,
-                                  canfd_regs_info,
-                                  ARRAY_SIZE(canfd_regs_info));
-    pos = canfd_populate_regarray(s, r_array, pos,
-                                  s->tx_regs, s->cfg.tx_fifo *
-                                  NUM_REGS_PER_MSG_SPACE);
-    pos = canfd_populate_regarray(s, r_array, pos,
-                                  s->rx0_regs, s->cfg.rx0_fifo *
-                                  NUM_REGS_PER_MSG_SPACE);
-    if (s->cfg.enable_rx_fifo1) {
-        pos = canfd_populate_regarray(s, r_array, pos,
-                                      s->rx1_regs, s->cfg.rx1_fifo *
-                                      NUM_REGS_PER_MSG_SPACE);
-    }
-    pos = canfd_populate_regarray(s, r_array, pos,
-                                  s->af_regs, NUM_AF * NUM_REG_PER_AF);
-    pos = canfd_populate_regarray(s, r_array, pos,
-                                  s->txe_regs, NUM_TXE * NUM_REG_PER_TXE);
-
-    memory_region_init_io(&r_array->mem, OBJECT(s), &canfd_ops, r_array,
-                          device_prefix, memory_size);
-    return r_array;
-}
-
 static void canfd_realize(DeviceState *dev, Error **errp)
 {
     XlnxVersalCANFDState *s = XILINX_CANFD(dev);
     RegisterInfoArray *reg_array;
 
-    reg_array = canfd_create_regarray(s);
+    reg_array = register_init_block32(dev, canfd_regs_info,
+                                      ARRAY_SIZE(canfd_regs_info), s->reg_info,
+                                      s->regs, &canfd_regs_ops, false,
+                                      A_RX_FIFO_WATERMARK_REGISTER
+                                          + sizeof(uint32_t));
     memory_region_add_subregion(&s->iomem, 0x00, &reg_array->mem);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq_canfd_int);
diff --git a/include/hw/net/xlnx-versal-canfd.h b/include/hw/net/xlnx-versal-canfd.h
index ad3104dd13..396f90d6dc 100644
--- a/include/hw/net/xlnx-versal-canfd.h
+++ b/include/hw/net/xlnx-versal-canfd.h
@@ -54,14 +54,6 @@ typedef struct XlnxVersalCANFDState {
     qemu_irq                irq_addr_err;
 
     RegisterInfo            reg_info[XLNX_VERSAL_CANFD_R_MAX];
-    RegisterAccessInfo      *tx_regs;
-    RegisterAccessInfo      *rx0_regs;
-    RegisterAccessInfo      *rx1_regs;
-    RegisterAccessInfo      *af_regs;
-    RegisterAccessInfo      *txe_regs;
-    RegisterAccessInfo      *rx_mailbox_regs;
-    RegisterAccessInfo      *af_mask_regs_mailbox;
-
     uint32_t                regs[XLNX_VERSAL_CANFD_R_MAX];
 
     ptimer_state            *canfd_timer;

From 5e7ea00c5fdcb05d189fb0a5cb8ab9f520303ee8 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 18 Oct 2025 16:04:59 +0200
Subject: [PATCH 1484/2396] hw/ppc/prep: Always create prep-systemio
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The prep-systemio device models the system control ports of the 40p
machine which is not an optional pluggable device but part of the
system so it should not be disabled by -nodefaults but always created.

Additionally remove some line breaks to make lines related to one
device appear in one block for logical separation from other devices.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <b5b0150b6c579b10682f6482e7832cf381ffb759.1760795082.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/prep.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 982e40e53e..c730cb3429 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -308,6 +308,13 @@ static void ibm_40p_init(MachineState *machine)
     sysbus_connect_irq(pcihost, 0, qdev_get_gpio_in(i82378_dev, 15));
     isa_bus = ISA_BUS(qdev_get_child_bus(i82378_dev, "isa.0"));
 
+    /* system control ports */
+    isa_dev = isa_new("prep-systemio");
+    dev = DEVICE(isa_dev);
+    qdev_prop_set_uint32(dev, "ibm-planar-id", 0xfc);
+    qdev_prop_set_uint32(dev, "equipment", 0xc0);
+    isa_realize_and_unref(isa_dev, isa_bus, &error_fatal);
+
     /* Memory controller */
     isa_dev = isa_new("rs6000-mc");
     dev = DEVICE(isa_dev);
@@ -333,7 +340,6 @@ static void ibm_40p_init(MachineState *machine)
         dev = DEVICE(isa_dev);
         qdev_prop_set_uint32(dev, "iobase", 0x830);
         qdev_prop_set_uint32(dev, "irq", 10);
-
         if (machine->audiodev) {
             qdev_prop_set_string(dev, "audiodev", machine->audiodev);
         }
@@ -344,14 +350,7 @@ static void ibm_40p_init(MachineState *machine)
         qdev_prop_set_uint32(dev, "config", 12);
         isa_realize_and_unref(isa_dev, isa_bus, &error_fatal);
 
-        isa_dev = isa_new("prep-systemio");
-        dev = DEVICE(isa_dev);
-        qdev_prop_set_uint32(dev, "ibm-planar-id", 0xfc);
-        qdev_prop_set_uint32(dev, "equipment", 0xc0);
-        isa_realize_and_unref(isa_dev, isa_bus, &error_fatal);
-
-        dev = DEVICE(pci_create_simple(pci_bus, PCI_DEVFN(1, 0),
-                                       "lsi53c810"));
+        dev = DEVICE(pci_create_simple(pci_bus, PCI_DEVFN(1, 0), "lsi53c810"));
         lsi53c8xx_handle_legacy_cmdline(dev);
         qdev_connect_gpio_out(dev, 0, qdev_get_gpio_in(i82378_dev, 13));
 

From be2f66e07aab5998f55d5e6e4de0a69a069759ed Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:54 +0200
Subject: [PATCH 1485/2396] hw/timer/i8254: Add I/O trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allows to see how the guest interacts with the device.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-2-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/timer/i8254.c      | 6 ++++++
 hw/timer/trace-events | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/hw/timer/i8254.c b/hw/timer/i8254.c
index 4b25c487f7..7033ebf50d 100644
--- a/hw/timer/i8254.c
+++ b/hw/timer/i8254.c
@@ -29,6 +29,7 @@
 #include "hw/timer/i8254.h"
 #include "hw/timer/i8254_internal.h"
 #include "qom/object.h"
+#include "trace.h"
 
 //#define DEBUG_PIT
 
@@ -130,6 +131,8 @@ static void pit_ioport_write(void *opaque, hwaddr addr,
     int channel, access;
     PITChannelState *s;
 
+    trace_pit_ioport_write(addr, val);
+
     addr &= 3;
     if (addr == 3) {
         channel = val >> 6;
@@ -248,6 +251,9 @@ static uint64_t pit_ioport_read(void *opaque, hwaddr addr,
             break;
         }
     }
+
+    trace_pit_ioport_read(addr, ret);
+
     return ret;
 }
 
diff --git a/hw/timer/trace-events b/hw/timer/trace-events
index c5b6db49f5..2bb51f95ea 100644
--- a/hw/timer/trace-events
+++ b/hw/timer/trace-events
@@ -49,6 +49,10 @@ cmsdk_apb_dualtimer_read(uint64_t offset, uint64_t data, unsigned size) "CMSDK A
 cmsdk_apb_dualtimer_write(uint64_t offset, uint64_t data, unsigned size) "CMSDK APB dualtimer write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
 cmsdk_apb_dualtimer_reset(void) "CMSDK APB dualtimer: reset"
 
+# i8254.c
+pit_ioport_read(uint8_t addr, uint32_t value) "[0x%" PRIx8 "] -> 0x%" PRIx32
+pit_ioport_write(uint8_t addr, uint32_t value) "[0x%" PRIx8 "] <- 0x%" PRIx32
+
 # imx_gpt.c
 imx_gpt_set_freq(uint32_t clksrc, uint32_t freq) "Setting clksrc %u to %u Hz"
 imx_gpt_read(const char *name, uint64_t value) "%s -> 0x%08" PRIx64

From 6b670b1b9616ac113392eb438642cbf6e854e3eb Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:55 +0200
Subject: [PATCH 1486/2396] hw/audio/pcspk: Add I/O trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Allows to see how the guest interacts with the device.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-3-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/pcspk.c      | 10 +++++++++-
 hw/audio/trace-events |  4 ++++
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index a419161b5b..f8020593b0 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -34,6 +34,7 @@
 #include "hw/audio/pcspk.h"
 #include "qapi/error.h"
 #include "qom/object.h"
+#include "trace.h"
 
 #define PCSPK_BUF_LEN 1792
 #define PCSPK_SAMPLE_RATE 32000
@@ -137,13 +138,18 @@ static uint64_t pcspk_io_read(void *opaque, hwaddr addr,
 {
     PCSpkState *s = opaque;
     PITChannelInfo ch;
+    uint8_t val;
 
     pit_get_channel_info(s->pit, 2, &ch);
 
     s->dummy_refresh_clock ^= (1 << 4);
 
-    return ch.gate | (s->data_on << 1) | s->dummy_refresh_clock |
+    val = ch.gate | (s->data_on << 1) | s->dummy_refresh_clock |
        (ch.out << 5);
+
+    trace_pcspk_io_read(s->iobase, val);
+
+    return val;
 }
 
 static void pcspk_io_write(void *opaque, hwaddr addr, uint64_t val,
@@ -152,6 +158,8 @@ static void pcspk_io_write(void *opaque, hwaddr addr, uint64_t val,
     PCSpkState *s = opaque;
     const int gate = val & 1;
 
+    trace_pcspk_io_write(s->iobase, val);
+
     s->data_on = (val >> 1) & 1;
     pit_set_gate(s->pit, 2, gate);
     if (s->voice) {
diff --git a/hw/audio/trace-events b/hw/audio/trace-events
index b8ef572767..30f5921545 100644
--- a/hw/audio/trace-events
+++ b/hw/audio/trace-events
@@ -23,6 +23,10 @@ hda_audio_format(const char *stream, int chan, const char *fmt, int freq) "st %s
 hda_audio_adjust(const char *stream, int pos) "st %s, pos %d"
 hda_audio_overrun(const char *stream) "st %s"
 
+# pcspk.c
+pcspk_io_read(uint16_t addr, uint8_t val) "[0x%"PRIx16"] -> 0x%"PRIx8
+pcspk_io_write(uint16_t addr, uint8_t val) "[0x%"PRIx16"] <- 0x%"PRIx8
+
 #via-ac97.c
 via_ac97_codec_write(uint8_t addr, uint16_t val) "0x%x <- 0x%x"
 via_ac97_sgd_fetch(uint32_t curr, uint32_t addr, char stop, char eol, char flag, uint32_t len) "curr=0x%x addr=0x%x %c%c%c len=%d"

From 4847c5701a33d519067c06054243434e489e337c Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:56 +0200
Subject: [PATCH 1487/2396] hw/rtc/mc146818rtc: Convert CMOS_DPRINTF() into
 trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-4-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/rtc/mc146818rtc.c | 14 +++-----------
 hw/rtc/trace-events  |  4 ++++
 2 files changed, 7 insertions(+), 11 deletions(-)

diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index f9f5cf396f..61e9c0bf99 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -43,16 +43,10 @@
 #include "qapi/error.h"
 #include "qapi/qapi-events-misc.h"
 #include "qapi/visitor.h"
+#include "trace.h"
 
-//#define DEBUG_CMOS
 //#define DEBUG_COALESCED
 
-#ifdef DEBUG_CMOS
-# define CMOS_DPRINTF(format, ...)      printf(format, ## __VA_ARGS__)
-#else
-# define CMOS_DPRINTF(format, ...)      do { } while (0)
-#endif
-
 #ifdef DEBUG_COALESCED
 # define DPRINTF_C(format, ...)      printf(format, ## __VA_ARGS__)
 #else
@@ -439,8 +433,7 @@ static void cmos_ioport_write(void *opaque, hwaddr addr,
     if ((addr & 1) == 0) {
         s->cmos_index = data & 0x7f;
     } else {
-        CMOS_DPRINTF("cmos: write index=0x%02x val=0x%02" PRIx64 "\n",
-                     s->cmos_index, data);
+        trace_mc146818_rtc_ioport_write(s->cmos_index, data);
         switch(s->cmos_index) {
         case RTC_SECONDS_ALARM:
         case RTC_MINUTES_ALARM:
@@ -726,8 +719,7 @@ static uint64_t cmos_ioport_read(void *opaque, hwaddr addr,
             ret = s->cmos_data[s->cmos_index];
             break;
         }
-        CMOS_DPRINTF("cmos: read index=0x%02x val=0x%02x\n",
-                     s->cmos_index, ret);
+        trace_mc146818_rtc_ioport_read(s->cmos_index, ret);
         return ret;
     }
 }
diff --git a/hw/rtc/trace-events b/hw/rtc/trace-events
index b9f2852d35..d2f36217cb 100644
--- a/hw/rtc/trace-events
+++ b/hw/rtc/trace-events
@@ -32,6 +32,10 @@ m48txx_nvram_io_write(uint64_t addr, uint64_t value) "io write addr:0x%04" PRIx6
 m48txx_nvram_mem_read(uint32_t addr, uint32_t value) "mem read addr:0x%04x value:0x%02x"
 m48txx_nvram_mem_write(uint32_t addr, uint32_t value) "mem write addr:0x%04x value:0x%02x"
 
+# mc146818rtc.c
+mc146818_rtc_ioport_read(uint8_t addr, uint8_t value) "[0x%02" PRIx8 "] -> 0x%02" PRIx8
+mc146818_rtc_ioport_write(uint8_t addr, uint8_t value) "[0x%02" PRIx8 "] <- 0x%02" PRIx8
+
 # goldfish_rtc.c
 goldfish_rtc_read(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64
 goldfish_rtc_write(uint64_t addr, uint64_t value) "addr 0x%02" PRIx64 " value 0x%08" PRIx64

From 3006fa8d26fe8b8d9b344c9e983513cd59477cb7 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:57 +0200
Subject: [PATCH 1488/2396] hw/rtc/mc146818rtc: Use ARRAY_SIZE macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoids the error-prone repetition of the array size.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-5-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/rtc/mc146818rtc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index 61e9c0bf99..5a89062b4c 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -726,13 +726,14 @@ static uint64_t cmos_ioport_read(void *opaque, hwaddr addr,
 
 void mc146818rtc_set_cmos_data(MC146818RtcState *s, int addr, int val)
 {
-    if (addr >= 0 && addr <= 127)
+    if (addr >= 0 && addr < ARRAY_SIZE(s->cmos_data)) {
         s->cmos_data[addr] = val;
+    }
 }
 
 int mc146818rtc_get_cmos_data(MC146818RtcState *s, int addr)
 {
-    assert(addr >= 0 && addr <= 127);
+    assert(addr >= 0 && addr < ARRAY_SIZE(s->cmos_data));
     return s->cmos_data[addr];
 }
 

From f3c0c9da662b22d62532c25b7c561dd9ce6b8def Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:58 +0200
Subject: [PATCH 1489/2396] hw/rtc/mc146818rtc: Assert correct usage of
 mc146818rtc_set_cmos_data()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The offset is never controlled by the guest, so any misuse constitutes a
programming error and shouldn't be silently ignored. Fix this by using assert().

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-6-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/rtc/mc146818rtc.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index 5a89062b4c..8631386b9f 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -726,9 +726,8 @@ static uint64_t cmos_ioport_read(void *opaque, hwaddr addr,
 
 void mc146818rtc_set_cmos_data(MC146818RtcState *s, int addr, int val)
 {
-    if (addr >= 0 && addr < ARRAY_SIZE(s->cmos_data)) {
-        s->cmos_data[addr] = val;
-    }
+    assert(addr >= 0 && addr < ARRAY_SIZE(s->cmos_data));
+    s->cmos_data[addr] = val;
 }
 
 int mc146818rtc_get_cmos_data(MC146818RtcState *s, int addr)

From dd012373a591ea52e3b9105cd5f8ba69d2303103 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:02:59 +0200
Subject: [PATCH 1490/2396] hw/ide/ide-internal: Move dma_buf_commit() into ide
 "namespace"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The identifier suggests that it is a generic DMA function while it is tied
to IDE. Fix this by adding an "ide_" prefix.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-7-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ide/ahci.c         |  8 ++++----
 hw/ide/core.c         | 10 +++++-----
 hw/ide/ide-internal.h |  2 +-
 3 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/ide/ahci.c b/hw/ide/ahci.c
index 1303c21cb7..14bc66fb7f 100644
--- a/hw/ide/ahci.c
+++ b/hw/ide/ahci.c
@@ -1417,7 +1417,7 @@ static void ahci_pio_transfer(const IDEDMA *dma)
     }
 
     /* Update number of transferred bytes, destroy sglist */
-    dma_buf_commit(s, size);
+    ide_dma_buf_commit(s, size);
 
 out:
     /* declare that we processed everything */
@@ -1482,8 +1482,8 @@ static int32_t ahci_dma_prepare_buf(const IDEDMA *dma, int32_t limit)
 
 /**
  * Updates the command header with a bytes-read value.
- * Called via dma_buf_commit, for both DMA and PIO paths.
- * sglist destruction is handled within dma_buf_commit.
+ * Called via ide_dma_buf_commit, for both DMA and PIO paths.
+ * sglist destruction is handled within ide_dma_buf_commit.
  */
 static void ahci_commit_buf(const IDEDMA *dma, uint32_t tx_bytes)
 {
@@ -1511,7 +1511,7 @@ static int ahci_dma_rw_buf(const IDEDMA *dma, bool is_write)
     }
 
     /* free sglist, update byte count */
-    dma_buf_commit(s, l);
+    ide_dma_buf_commit(s, l);
     s->io_buffer_index += l;
 
     trace_ahci_dma_rw_buf(ad->hba, ad->port_no, l);
diff --git a/hw/ide/core.c b/hw/ide/core.c
index b14983ec54..8c380abf7c 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -827,7 +827,7 @@ static void ide_sector_read(IDEState *s)
                                       ide_sector_read_cb, s);
 }
 
-void dma_buf_commit(IDEState *s, uint32_t tx_bytes)
+void ide_dma_buf_commit(IDEState *s, uint32_t tx_bytes)
 {
     if (s->bus->dma->ops->commit_buf) {
         s->bus->dma->ops->commit_buf(s->bus->dma, tx_bytes);
@@ -848,7 +848,7 @@ void ide_set_inactive(IDEState *s, bool more)
 
 void ide_dma_error(IDEState *s)
 {
-    dma_buf_commit(s, 0);
+    ide_dma_buf_commit(s, 0);
     ide_abort_command(s);
     ide_set_inactive(s, false);
     ide_bus_set_irq(s->bus);
@@ -893,7 +893,7 @@ static void ide_dma_cb(void *opaque, int ret)
     if (ret < 0) {
         if (ide_handle_rw_error(s, -ret, ide_dma_cmd_to_retry(s->dma_cmd))) {
             s->bus->dma->aiocb = NULL;
-            dma_buf_commit(s, 0);
+            ide_dma_buf_commit(s, 0);
             return;
         }
     }
@@ -912,7 +912,7 @@ static void ide_dma_cb(void *opaque, int ret)
     sector_num = ide_get_sector(s);
     if (n > 0) {
         assert(n * 512 == s->sg.size);
-        dma_buf_commit(s, s->sg.size);
+        ide_dma_buf_commit(s, s->sg.size);
         sector_num += n;
         ide_set_sector(s, sector_num);
         s->nsector -= n;
@@ -944,7 +944,7 @@ static void ide_dma_cb(void *opaque, int ret)
          * Reset the Active bit and don't raise the interrupt.
          */
         s->status = READY_STAT | SEEK_STAT;
-        dma_buf_commit(s, 0);
+        ide_dma_buf_commit(s, 0);
         goto eot;
     }
 
diff --git a/hw/ide/ide-internal.h b/hw/ide/ide-internal.h
index 0d64805da2..281d07c9d5 100644
--- a/hw/ide/ide-internal.h
+++ b/hw/ide/ide-internal.h
@@ -398,7 +398,7 @@ int64_t ide_get_sector(IDEState *s);
 void ide_set_sector(IDEState *s, int64_t sector_num);
 
 void ide_start_dma(IDEState *s, BlockCompletionFunc *cb);
-void dma_buf_commit(IDEState *s, uint32_t tx_bytes);
+void ide_dma_buf_commit(IDEState *s, uint32_t tx_bytes);
 void ide_dma_error(IDEState *s);
 void ide_abort_command(IDEState *s);
 

From 2fd15a24ca3b88531d66efb203d1f7f39d8519f5 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:03:00 +0200
Subject: [PATCH 1491/2396] hw/i386/apic: Prefer APICCommonState over
 DeviceState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Makes the APIC API more type-safe by resolving quite a few APIC_COMMON
downcasts.

Like PICCommonState, the APICCommonState is now a public typedef while staying
an abstract datatype.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-8-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/kvm/apic.c               |  3 +-
 hw/i386/vapic.c                  |  2 +-
 hw/i386/x86-cpu.c                |  2 +-
 hw/intc/apic.c                   | 97 +++++++++++++-------------------
 hw/intc/apic_common.c            | 56 +++++++-----------
 include/hw/i386/apic.h           | 33 +++++------
 include/hw/i386/apic_internal.h  |  7 +--
 target/i386/cpu-apic.c           | 18 +++---
 target/i386/cpu-dump.c           |  2 +-
 target/i386/cpu.c                |  2 +-
 target/i386/cpu.h                |  5 +-
 target/i386/kvm/kvm.c            |  2 +-
 target/i386/kvm/kvm_i386.h       |  2 +-
 target/i386/whpx/whpx-apic.c     |  3 +-
 target/i386/whpx/whpx-internal.h |  4 +-
 15 files changed, 98 insertions(+), 140 deletions(-)

diff --git a/hw/i386/kvm/apic.c b/hw/i386/kvm/apic.c
index 1be9bfe36e..82355f0463 100644
--- a/hw/i386/kvm/apic.c
+++ b/hw/i386/kvm/apic.c
@@ -60,9 +60,8 @@ static void kvm_put_apic_state(APICCommonState *s, struct kvm_lapic_state *kapic
     kvm_apic_set_reg(kapic, 0x3e, s->divide_conf);
 }
 
-void kvm_get_apic_state(DeviceState *dev, struct kvm_lapic_state *kapic)
+void kvm_get_apic_state(APICCommonState *s, struct kvm_lapic_state *kapic)
 {
-    APICCommonState *s = APIC_COMMON(dev);
     int i, v;
 
     if (kvm_has_x2apic_api() && s->apicbase & MSR_IA32_APICBASE_EXTD) {
diff --git a/hw/i386/vapic.c b/hw/i386/vapic.c
index 0c1c92c479..f1089f0a7c 100644
--- a/hw/i386/vapic.c
+++ b/hw/i386/vapic.c
@@ -490,7 +490,7 @@ void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
 }
 
 typedef struct VAPICEnableTPRReporting {
-    DeviceState *apic;
+    APICCommonState *apic;
     bool enable;
 } VAPICEnableTPRReporting;
 
diff --git a/hw/i386/x86-cpu.c b/hw/i386/x86-cpu.c
index c876e6709e..1a86a853d5 100644
--- a/hw/i386/x86-cpu.c
+++ b/hw/i386/x86-cpu.c
@@ -86,7 +86,7 @@ int cpu_get_pic_interrupt(CPUX86State *env)
     return intno;
 }
 
-DeviceState *cpu_get_current_apic(void)
+APICCommonState *cpu_get_current_apic(void)
 {
     if (current_cpu) {
         X86CPU *cpu = X86_CPU(current_cpu);
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index c768033856..cb35c80c75 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -181,10 +181,8 @@ static void apic_local_deliver(APICCommonState *s, int vector)
     }
 }
 
-void apic_deliver_pic_intr(DeviceState *dev, int level)
+void apic_deliver_pic_intr(APICCommonState *s, int level)
 {
-    APICCommonState *s = APIC(dev);
-
     if (level) {
         apic_local_deliver(s, APIC_LVT_LINT0);
     } else {
@@ -301,10 +299,8 @@ static void apic_deliver_irq(uint32_t dest, uint8_t dest_mode,
     apic_bus_deliver(deliver_bitmask, delivery_mode, vector_num, trigger_mode);
 }
 
-bool is_x2apic_mode(DeviceState *dev)
+bool is_x2apic_mode(APICCommonState *s)
 {
-    APICCommonState *s = APIC(dev);
-
     return s->apicbase & MSR_IA32_APICBASE_EXTD;
 }
 
@@ -388,15 +384,12 @@ static void apic_set_tpr(APICCommonState *s, uint8_t val)
     }
 }
 
-int apic_get_highest_priority_irr(DeviceState *dev)
+int apic_get_highest_priority_irr(APICCommonState *s)
 {
-    APICCommonState *s;
-
-    if (!dev) {
+    if (!s) {
         /* no interrupts */
         return -1;
     }
-    s = APIC_COMMON(dev);
     return get_highest_priority_int(s->irr);
 }
 
@@ -458,22 +451,19 @@ static int apic_irq_pending(APICCommonState *s)
 static void apic_update_irq(APICCommonState *s)
 {
     CPUState *cpu;
-    DeviceState *dev = (DeviceState *)s;
 
     cpu = CPU(s->cpu);
     if (!qemu_cpu_is_self(cpu)) {
         cpu_interrupt(cpu, CPU_INTERRUPT_POLL);
     } else if (apic_irq_pending(s) > 0) {
         cpu_interrupt(cpu, CPU_INTERRUPT_HARD);
-    } else if (!apic_accept_pic_intr(dev) || !pic_get_output(isa_pic)) {
+    } else if (!apic_accept_pic_intr(s) || !pic_get_output(isa_pic)) {
         cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
     }
 }
 
-void apic_poll_irq(DeviceState *dev)
+void apic_poll_irq(APICCommonState *s)
 {
-    APICCommonState *s = APIC(dev);
-
     apic_sync_vapic(s, SYNC_FROM_VAPIC);
     apic_update_irq(s);
 }
@@ -516,7 +506,7 @@ static void apic_eoi(APICCommonState *s)
 
 static bool apic_match_dest(APICCommonState *apic, uint32_t dest)
 {
-    if (is_x2apic_mode(&apic->parent_obj)) {
+    if (is_x2apic_mode(apic)) {
         return apic->initial_apic_id == dest;
     } else {
         return apic->id == (uint8_t)dest;
@@ -550,7 +540,7 @@ static void apic_get_broadcast_bitmask(uint32_t *deliver_bitmask,
     for (i = 0; i < max_apics; i++) {
         apic_iter = local_apics[i];
         if (apic_iter) {
-            bool apic_in_x2apic = is_x2apic_mode(&apic_iter->parent_obj);
+            bool apic_in_x2apic = is_x2apic_mode(apic_iter);
 
             if (is_x2apic_broadcast && apic_in_x2apic) {
                 apic_set_bit(deliver_bitmask, i);
@@ -642,27 +632,24 @@ static void apic_startup(APICCommonState *s, int vector_num)
     cpu_interrupt(CPU(s->cpu), CPU_INTERRUPT_SIPI);
 }
 
-void apic_sipi(DeviceState *dev)
+void apic_sipi(APICCommonState *s)
 {
-    APICCommonState *s = APIC(dev);
-
     if (!s->wait_for_sipi)
         return;
     cpu_x86_load_seg_cache_sipi(s->cpu, s->sipi_vector);
     s->wait_for_sipi = 0;
 }
 
-static void apic_deliver(DeviceState *dev, uint32_t dest, uint8_t dest_mode,
+static void apic_deliver(APICCommonState *s, uint32_t dest, uint8_t dest_mode,
                          uint8_t delivery_mode, uint8_t vector_num,
                          uint8_t trigger_mode, uint8_t dest_shorthand)
 {
-    APICCommonState *s = APIC(dev);
     APICCommonState *apic_iter;
     uint32_t deliver_bitmask_size = max_apic_words * sizeof(uint32_t);
     g_autofree uint32_t *deliver_bitmask = g_new(uint32_t, max_apic_words);
     uint32_t current_apic_id;
 
-    if (is_x2apic_mode(dev)) {
+    if (is_x2apic_mode(s)) {
         current_apic_id = s->initial_apic_id;
     } else {
         current_apic_id = s->id;
@@ -709,18 +696,15 @@ static void apic_deliver(DeviceState *dev, uint32_t dest, uint8_t dest_mode,
 
 static bool apic_check_pic(APICCommonState *s)
 {
-    DeviceState *dev = (DeviceState *)s;
-
-    if (!apic_accept_pic_intr(dev) || !pic_get_output(isa_pic)) {
+    if (!apic_accept_pic_intr(s) || !pic_get_output(isa_pic)) {
         return false;
     }
-    apic_deliver_pic_intr(dev, 1);
+    apic_deliver_pic_intr(s, 1);
     return true;
 }
 
-int apic_get_interrupt(DeviceState *dev)
+int apic_get_interrupt(APICCommonState *s)
 {
-    APICCommonState *s = APIC(dev);
     int intno;
 
     /* if the APIC is installed or enabled, we let the 8259 handle the
@@ -752,9 +736,8 @@ int apic_get_interrupt(DeviceState *dev)
     return intno;
 }
 
-int apic_accept_pic_intr(DeviceState *dev)
+int apic_accept_pic_intr(APICCommonState *s)
 {
-    APICCommonState *s = APIC(dev);
     uint32_t lvt0;
 
     if (!s)
@@ -788,20 +771,18 @@ static void apic_timer(void *opaque)
 
 static int apic_register_read(int index, uint64_t *value)
 {
-    DeviceState *dev;
     APICCommonState *s;
     uint32_t val;
     int ret = 0;
 
-    dev = cpu_get_current_apic();
-    if (!dev) {
+    s = cpu_get_current_apic();
+    if (!s) {
         return -1;
     }
-    s = APIC(dev);
 
     switch(index) {
     case 0x02: /* id */
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             val = s->initial_apic_id;
         } else {
             val = s->id << 24;
@@ -828,14 +809,14 @@ static int apic_register_read(int index, uint64_t *value)
         val = 0;
         break;
     case 0x0d:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             val = s->extended_log_dest;
         } else {
             val = s->log_dest << 24;
         }
         break;
     case 0x0e:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             val = 0;
             ret = -1;
         } else {
@@ -902,14 +883,14 @@ static uint64_t apic_mem_read(void *opaque, hwaddr addr, unsigned size)
 
 int apic_msr_read(int index, uint64_t *val)
 {
-    DeviceState *dev;
+    APICCommonState *s;
 
-    dev = cpu_get_current_apic();
-    if (!dev) {
+    s = cpu_get_current_apic();
+    if (!s) {
         return -1;
     }
 
-    if (!is_x2apic_mode(dev)) {
+    if (!is_x2apic_mode(s)) {
         return -1;
     }
 
@@ -943,20 +924,18 @@ static void apic_send_msi(MSIMessage *msi)
 
 static int apic_register_write(int index, uint64_t val)
 {
-    DeviceState *dev;
     APICCommonState *s;
 
-    dev = cpu_get_current_apic();
-    if (!dev) {
+    s = cpu_get_current_apic();
+    if (!s) {
         return -1;
     }
-    s = APIC(dev);
 
     trace_apic_register_write(index, val);
 
     switch(index) {
     case 0x02:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             return -1;
         }
 
@@ -979,14 +958,14 @@ static int apic_register_write(int index, uint64_t val)
         apic_eoi(s);
         break;
     case 0x0d:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             return -1;
         }
 
         s->log_dest = val >> 24;
         break;
     case 0x0e:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             return -1;
         }
 
@@ -1005,20 +984,20 @@ static int apic_register_write(int index, uint64_t val)
         uint32_t dest;
 
         s->icr[0] = val;
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             s->icr[1] = val >> 32;
             dest = s->icr[1];
         } else {
             dest = (s->icr[1] >> 24) & 0xff;
         }
 
-        apic_deliver(dev, dest, (s->icr[0] >> 11) & 1,
+        apic_deliver(s, dest, (s->icr[0] >> 11) & 1,
                      (s->icr[0] >> 8) & 7, (s->icr[0] & 0xff),
                      (s->icr[0] >> 15) & 1, (s->icr[0] >> 18) & 3);
         break;
     }
     case 0x31:
-        if (is_x2apic_mode(dev)) {
+        if (is_x2apic_mode(s)) {
             return -1;
         }
 
@@ -1053,7 +1032,7 @@ static int apic_register_write(int index, uint64_t val)
     case 0x3f: {
         int vector = val & 0xff;
 
-        if (!is_x2apic_mode(dev)) {
+        if (!is_x2apic_mode(s)) {
             return -1;
         }
 
@@ -1063,7 +1042,7 @@ static int apic_register_write(int index, uint64_t val)
          * - Trigger mode: 0 (Edge)
          * - Delivery mode: 0 (Fixed)
          */
-        apic_deliver(dev, 0, 0, APIC_DM_FIXED, vector, 0, 1);
+        apic_deliver(s, 0, 0, APIC_DM_FIXED, vector, 0, 1);
 
         break;
     }
@@ -1102,14 +1081,14 @@ static void apic_mem_write(void *opaque, hwaddr addr, uint64_t val,
 
 int apic_msr_write(int index, uint64_t val)
 {
-    DeviceState *dev;
+    APICCommonState *s;
 
-    dev = cpu_get_current_apic();
-    if (!dev) {
+    s = cpu_get_current_apic();
+    if (!s) {
         return -1;
     }
 
-    if (!is_x2apic_mode(dev)) {
+    if (!is_x2apic_mode(s)) {
         return -1;
     }
 
diff --git a/hw/intc/apic_common.c b/hw/intc/apic_common.c
index 394fe02013..ec9e978b0b 100644
--- a/hw/intc/apic_common.c
+++ b/hw/intc/apic_common.c
@@ -35,12 +35,11 @@
 
 bool apic_report_tpr_access;
 
-int cpu_set_apic_base(DeviceState *dev, uint64_t val)
+int cpu_set_apic_base(APICCommonState *s, uint64_t val)
 {
     trace_cpu_set_apic_base(val);
 
-    if (dev) {
-        APICCommonState *s = APIC_COMMON(dev);
+    if (s) {
         APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
         /* Reset possibly modified xAPIC ID */
         s->id = s->initial_apic_id;
@@ -50,10 +49,9 @@ int cpu_set_apic_base(DeviceState *dev, uint64_t val)
     return 0;
 }
 
-uint64_t cpu_get_apic_base(DeviceState *dev)
+uint64_t cpu_get_apic_base(APICCommonState *s)
 {
-    if (dev) {
-        APICCommonState *s = APIC_COMMON(dev);
+    if (s) {
         trace_cpu_get_apic_base((uint64_t)s->apicbase);
         return s->apicbase;
     } else {
@@ -62,52 +60,43 @@ uint64_t cpu_get_apic_base(DeviceState *dev)
     }
 }
 
-bool cpu_is_apic_enabled(DeviceState *dev)
+bool cpu_is_apic_enabled(APICCommonState *s)
 {
-    APICCommonState *s;
-
-    if (!dev) {
+    if (!s) {
         return false;
     }
 
-    s = APIC_COMMON(dev);
-
     return s->apicbase & MSR_IA32_APICBASE_ENABLE;
 }
 
-void cpu_set_apic_tpr(DeviceState *dev, uint8_t val)
+void cpu_set_apic_tpr(APICCommonState *s, uint8_t val)
 {
-    APICCommonState *s;
     APICCommonClass *info;
 
-    if (!dev) {
+    if (!s) {
         return;
     }
 
-    s = APIC_COMMON(dev);
     info = APIC_COMMON_GET_CLASS(s);
 
     info->set_tpr(s, val);
 }
 
-uint8_t cpu_get_apic_tpr(DeviceState *dev)
+uint8_t cpu_get_apic_tpr(APICCommonState *s)
 {
-    APICCommonState *s;
     APICCommonClass *info;
 
-    if (!dev) {
+    if (!s) {
         return 0;
     }
 
-    s = APIC_COMMON(dev);
     info = APIC_COMMON_GET_CLASS(s);
 
     return info->get_tpr(s);
 }
 
-void apic_enable_tpr_access_reporting(DeviceState *dev, bool enable)
+void apic_enable_tpr_access_reporting(APICCommonState *s, bool enable)
 {
-    APICCommonState *s = APIC_COMMON(dev);
     APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
 
     apic_report_tpr_access = enable;
@@ -116,26 +105,22 @@ void apic_enable_tpr_access_reporting(DeviceState *dev, bool enable)
     }
 }
 
-void apic_enable_vapic(DeviceState *dev, hwaddr paddr)
+void apic_enable_vapic(APICCommonState *s, hwaddr paddr)
 {
-    APICCommonState *s = APIC_COMMON(dev);
     APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
 
     s->vapic_paddr = paddr;
     info->vapic_base_update(s);
 }
 
-void apic_handle_tpr_access_report(DeviceState *dev, target_ulong ip,
+void apic_handle_tpr_access_report(APICCommonState *s, target_ulong ip,
                                    TPRAccess access)
 {
-    APICCommonState *s = APIC_COMMON(dev);
-
     vapic_report_tpr_access(s->vapic, CPU(s->cpu), ip, access);
 }
 
-void apic_deliver_nmi(DeviceState *dev)
+void apic_deliver_nmi(APICCommonState *s)
 {
-    APICCommonState *s = APIC_COMMON(dev);
     APICCommonClass *info = APIC_COMMON_GET_CLASS(s);
 
     info->external_nmi(s);
@@ -193,16 +178,14 @@ uint32_t apic_get_current_count(APICCommonState *s)
     return val;
 }
 
-void apic_init_reset(DeviceState *dev)
+void apic_init_reset(APICCommonState *s)
 {
-    APICCommonState *s;
     APICCommonClass *info;
     int i;
 
-    if (!dev) {
+    if (!s) {
         return;
     }
-    s = APIC_COMMON(dev);
     s->tpr = 0;
     s->spurious_vec = 0xff;
     s->log_dest = 0;
@@ -233,13 +216,12 @@ void apic_init_reset(DeviceState *dev)
     }
 }
 
-void apic_designate_bsp(DeviceState *dev, bool bsp)
+void apic_designate_bsp(APICCommonState *s, bool bsp)
 {
-    if (dev == NULL) {
+    if (s == NULL) {
         return;
     }
 
-    APICCommonState *s = APIC_COMMON(dev);
     if (bsp) {
         s->apicbase |= MSR_IA32_APICBASE_BSP;
     } else {
@@ -262,7 +244,7 @@ static void apic_reset_common(DeviceState *dev)
     s->vapic_paddr = 0;
     info->vapic_base_update(s);
 
-    apic_init_reset(dev);
+    apic_init_reset(s);
 }
 
 static const VMStateDescription vmstate_apic_common;
diff --git a/include/hw/i386/apic.h b/include/hw/i386/apic.h
index eb606d6076..871f142888 100644
--- a/include/hw/i386/apic.h
+++ b/include/hw/i386/apic.h
@@ -1,28 +1,29 @@
 #ifndef APIC_H
 #define APIC_H
 
+typedef struct APICCommonState APICCommonState;
 
 /* apic.c */
 void apic_set_max_apic_id(uint32_t max_apic_id);
-int apic_accept_pic_intr(DeviceState *s);
-void apic_deliver_pic_intr(DeviceState *s, int level);
-void apic_deliver_nmi(DeviceState *d);
-int apic_get_interrupt(DeviceState *s);
-int cpu_set_apic_base(DeviceState *s, uint64_t val);
-uint64_t cpu_get_apic_base(DeviceState *s);
-bool cpu_is_apic_enabled(DeviceState *s);
-void cpu_set_apic_tpr(DeviceState *s, uint8_t val);
-uint8_t cpu_get_apic_tpr(DeviceState *s);
-void apic_init_reset(DeviceState *s);
-void apic_sipi(DeviceState *s);
-void apic_poll_irq(DeviceState *d);
-void apic_designate_bsp(DeviceState *d, bool bsp);
-int apic_get_highest_priority_irr(DeviceState *dev);
+int apic_accept_pic_intr(APICCommonState *s);
+void apic_deliver_pic_intr(APICCommonState *s, int level);
+void apic_deliver_nmi(APICCommonState *s);
+int apic_get_interrupt(APICCommonState *s);
+int cpu_set_apic_base(APICCommonState *s, uint64_t val);
+uint64_t cpu_get_apic_base(APICCommonState *s);
+bool cpu_is_apic_enabled(APICCommonState *s);
+void cpu_set_apic_tpr(APICCommonState *s, uint8_t val);
+uint8_t cpu_get_apic_tpr(APICCommonState *s);
+void apic_init_reset(APICCommonState *s);
+void apic_sipi(APICCommonState *s);
+void apic_poll_irq(APICCommonState *s);
+void apic_designate_bsp(APICCommonState *s, bool bsp);
+int apic_get_highest_priority_irr(APICCommonState *s);
 int apic_msr_read(int index, uint64_t *val);
 int apic_msr_write(int index, uint64_t val);
-bool is_x2apic_mode(DeviceState *d);
+bool is_x2apic_mode(APICCommonState *s);
 
 /* pc.c */
-DeviceState *cpu_get_current_apic(void);
+APICCommonState *cpu_get_current_apic(void);
 
 #endif
diff --git a/include/hw/i386/apic_internal.h b/include/hw/i386/apic_internal.h
index 429278da61..4a62fdceb4 100644
--- a/include/hw/i386/apic_internal.h
+++ b/include/hw/i386/apic_internal.h
@@ -22,6 +22,7 @@
 #define QEMU_APIC_INTERNAL_H
 
 #include "cpu.h"
+#include "hw/i386/apic.h"
 #include "system/memory.h"
 #include "qemu/timer.h"
 #include "target/i386/cpu-qom.h"
@@ -125,8 +126,6 @@
 #define VAPIC_ENABLE_BIT                0
 #define VAPIC_ENABLE_MASK               (1 << VAPIC_ENABLE_BIT)
 
-typedef struct APICCommonState APICCommonState;
-
 #define TYPE_APIC_COMMON "apic-common"
 typedef struct APICCommonClass APICCommonClass;
 DECLARE_OBJ_CHECKERS(APICCommonState, APICCommonClass,
@@ -203,8 +202,8 @@ typedef struct VAPICState {
 extern bool apic_report_tpr_access;
 
 bool apic_next_timer(APICCommonState *s, int64_t current_time);
-void apic_enable_tpr_access_reporting(DeviceState *d, bool enable);
-void apic_enable_vapic(DeviceState *d, hwaddr paddr);
+void apic_enable_tpr_access_reporting(APICCommonState *s, bool enable);
+void apic_enable_vapic(APICCommonState *s, hwaddr paddr);
 
 void vapic_report_tpr_access(DeviceState *dev, CPUState *cpu, target_ulong ip,
                              TPRAccess access);
diff --git a/target/i386/cpu-apic.c b/target/i386/cpu-apic.c
index 242a05fdbe..564c1288e4 100644
--- a/target/i386/cpu-apic.c
+++ b/target/i386/cpu-apic.c
@@ -41,34 +41,31 @@ APICCommonClass *apic_get_class(Error **errp)
 
 void x86_cpu_apic_create(X86CPU *cpu, Error **errp)
 {
-    APICCommonState *apic;
     APICCommonClass *apic_class = apic_get_class(errp);
 
     if (!apic_class) {
         return;
     }
 
-    cpu->apic_state = DEVICE(object_new_with_class(OBJECT_CLASS(apic_class)));
+    cpu->apic_state = APIC_COMMON(object_new_with_class(OBJECT_CLASS(apic_class)));
     object_property_add_child(OBJECT(cpu), "lapic",
                               OBJECT(cpu->apic_state));
     object_unref(OBJECT(cpu->apic_state));
 
     /* TODO: convert to link<> */
-    apic = APIC_COMMON(cpu->apic_state);
-    apic->cpu = cpu;
-    apic->apicbase = APIC_DEFAULT_ADDRESS | MSR_IA32_APICBASE_ENABLE;
+    cpu->apic_state->cpu = cpu;
+    cpu->apic_state->apicbase = APIC_DEFAULT_ADDRESS | MSR_IA32_APICBASE_ENABLE;
 
     /*
      * apic_common_set_id needs to check if the CPU has x2APIC
-     * feature in case APIC ID >= 255, so we need to set apic->cpu
+     * feature in case APIC ID >= 255, so we need to set cpu->apic_state->cpu
      * before setting APIC ID
      */
-    qdev_prop_set_uint32(cpu->apic_state, "id", cpu->apic_id);
+    qdev_prop_set_uint32(DEVICE(cpu->apic_state), "id", cpu->apic_id);
 }
 
 void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
 {
-    APICCommonState *apic;
     static bool apic_mmio_map_once;
 
     if (cpu->apic_state == NULL) {
@@ -77,12 +74,11 @@ void x86_cpu_apic_realize(X86CPU *cpu, Error **errp)
     qdev_realize(DEVICE(cpu->apic_state), NULL, errp);
 
     /* Map APIC MMIO area */
-    apic = APIC_COMMON(cpu->apic_state);
     if (!apic_mmio_map_once) {
         memory_region_add_subregion_overlap(get_system_memory(),
-                                            apic->apicbase &
+                                            cpu->apic_state->apicbase &
                                             MSR_IA32_APICBASE_BASE,
-                                            &apic->io_memory,
+                                            &cpu->apic_state->io_memory,
                                             0x1000);
         apic_mmio_map_once = true;
      }
diff --git a/target/i386/cpu-dump.c b/target/i386/cpu-dump.c
index a72ed93bd2..67bf31e0ca 100644
--- a/target/i386/cpu-dump.c
+++ b/target/i386/cpu-dump.c
@@ -291,7 +291,7 @@ static void dump_apic_interrupt(const char *name, uint32_t *ireg_tab,
 void x86_cpu_dump_local_apic_state(CPUState *cs, int flags)
 {
     X86CPU *cpu = X86_CPU(cs);
-    APICCommonState *s = APIC_COMMON(cpu->apic_state);
+    APICCommonState *s = cpu->apic_state;
     if (!s) {
         qemu_printf("local apic state not available\n");
         return;
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 455caff6b2..0a66e1fec9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8789,7 +8789,7 @@ void x86_cpu_after_reset(X86CPU *cpu)
     }
 
     if (cpu->apic_state) {
-        device_cold_reset(cpu->apic_state);
+        device_cold_reset(DEVICE(cpu->apic_state));
     }
 #endif
 }
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index ce948861a7..d0da9bfe58 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -27,6 +27,7 @@
 #include "exec/cpu-defs.h"
 #include "exec/cpu-interrupt.h"
 #include "exec/memop.h"
+#include "hw/i386/apic.h"
 #include "hw/i386/topology.h"
 #include "qapi/qapi-types-common.h"
 #include "qemu/cpu-float.h"
@@ -2349,7 +2350,7 @@ struct ArchCPU {
 
     /* in order to simplify APIC support, we leave this pointer to the
        user */
-    struct DeviceState *apic_state;
+    APICCommonState *apic_state;
     struct MemoryRegion *cpu_as_root, *cpu_as_mem, *smram;
     Notifier machine_done;
 
@@ -2830,7 +2831,7 @@ bool cpu_svm_has_intercept(CPUX86State *env, uint32_t type);
 
 /* apic.c */
 void cpu_report_tpr_access(CPUX86State *env, TPRAccess access);
-void apic_handle_tpr_access_report(DeviceState *d, target_ulong ip,
+void apic_handle_tpr_access_report(APICCommonState *s, target_ulong ip,
                                    TPRAccess access);
 
 /* Special values for X86CPUVersion: */
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 309f043373..f7a6ef650a 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5029,7 +5029,7 @@ static int kvm_get_mp_state(X86CPU *cpu)
 
 static int kvm_get_apic(X86CPU *cpu)
 {
-    DeviceState *apic = cpu->apic_state;
+    APICCommonState *apic = cpu->apic_state;
     struct kvm_lapic_state kapic;
     int ret;
 
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index 5f83e8850a..5c908fdd6a 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -56,7 +56,7 @@ bool kvm_has_adjust_clock_stable(void);
 bool kvm_has_exception_payload(void);
 void kvm_synchronize_all_tsc(void);
 
-void kvm_get_apic_state(DeviceState *d, struct kvm_lapic_state *kapic);
+void kvm_get_apic_state(APICCommonState *s, struct kvm_lapic_state *kapic);
 void kvm_put_apicbase(X86CPU *cpu, uint64_t value);
 
 bool kvm_has_x2apic_api(void);
diff --git a/target/i386/whpx/whpx-apic.c b/target/i386/whpx/whpx-apic.c
index e1ef6d4e6d..afcb25843b 100644
--- a/target/i386/whpx/whpx-apic.c
+++ b/target/i386/whpx/whpx-apic.c
@@ -151,9 +151,8 @@ static void whpx_apic_put(CPUState *cs, run_on_cpu_data data)
     }
 }
 
-void whpx_apic_get(DeviceState *dev)
+void whpx_apic_get(APICCommonState *s)
 {
-    APICCommonState *s = APIC_COMMON(dev);
     CPUState *cpu = CPU(s->cpu);
     struct whpx_lapic_state kapic;
 
diff --git a/target/i386/whpx/whpx-internal.h b/target/i386/whpx/whpx-internal.h
index 6633e9c4ca..2dcad1f565 100644
--- a/target/i386/whpx/whpx-internal.h
+++ b/target/i386/whpx/whpx-internal.h
@@ -5,6 +5,8 @@
 #include <winhvplatform.h>
 #include <winhvemulation.h>
 
+#include "hw/i386/apic.h"
+
 typedef enum WhpxBreakpointState {
     WHPX_BP_CLEARED = 0,
     WHPX_BP_SET_PENDING,
@@ -44,7 +46,7 @@ struct whpx_state {
 };
 
 extern struct whpx_state whpx_global;
-void whpx_apic_get(DeviceState *s);
+void whpx_apic_get(APICCommonState *s);
 
 #define WHV_E_UNKNOWN_CAPABILITY 0x80370300L
 

From 337eece9c0a4b84cd2e34ed94b55efbad9f37a6b Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:03:01 +0200
Subject: [PATCH 1492/2396] hw/i386/apic: Ensure own APIC use in
 apic_msr_{read,write}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Avoids the `current_cpu` global and seems more robust by not "forgetting" the
own APIC and then re-determining it by cpu_get_current_apic() which uses the
global.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-9-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/apic.c                       | 10 ++--------
 include/hw/i386/apic.h               |  4 ++--
 target/i386/hvf/hvf.c                |  4 ++--
 target/i386/tcg/system/misc_helper.c |  4 ++--
 4 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index cb35c80c75..ba0eda3921 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -881,11 +881,8 @@ static uint64_t apic_mem_read(void *opaque, hwaddr addr, unsigned size)
     return val;
 }
 
-int apic_msr_read(int index, uint64_t *val)
+int apic_msr_read(APICCommonState *s, int index, uint64_t *val)
 {
-    APICCommonState *s;
-
-    s = cpu_get_current_apic();
     if (!s) {
         return -1;
     }
@@ -1079,11 +1076,8 @@ static void apic_mem_write(void *opaque, hwaddr addr, uint64_t val,
     apic_register_write(index, val);
 }
 
-int apic_msr_write(int index, uint64_t val)
+int apic_msr_write(APICCommonState *s, int index, uint64_t val)
 {
-    APICCommonState *s;
-
-    s = cpu_get_current_apic();
     if (!s) {
         return -1;
     }
diff --git a/include/hw/i386/apic.h b/include/hw/i386/apic.h
index 871f142888..6a0933f401 100644
--- a/include/hw/i386/apic.h
+++ b/include/hw/i386/apic.h
@@ -19,8 +19,8 @@ void apic_sipi(APICCommonState *s);
 void apic_poll_irq(APICCommonState *s);
 void apic_designate_bsp(APICCommonState *s, bool bsp);
 int apic_get_highest_priority_irr(APICCommonState *s);
-int apic_msr_read(int index, uint64_t *val);
-int apic_msr_write(int index, uint64_t val);
+int apic_msr_read(APICCommonState *s, int index, uint64_t *val);
+int apic_msr_write(APICCommonState *s, int index, uint64_t val);
 bool is_x2apic_mode(APICCommonState *s);
 
 /* pc.c */
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 8445cadece..33f723a76a 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -527,7 +527,7 @@ void hvf_simulate_rdmsr(CPUState *cs)
         int ret;
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
 
-        ret = apic_msr_read(index, &val);
+        ret = apic_msr_read(cpu->apic_state, index, &val);
         if (ret < 0) {
             x86_emul_raise_exception(env, EXCP0D_GPF, 0);
         }
@@ -638,7 +638,7 @@ void hvf_simulate_wrmsr(CPUState *cs)
         int ret;
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
 
-        ret = apic_msr_write(index, data);
+        ret = apic_msr_write(cpu->apic_state, index, data);
         if (ret < 0) {
             x86_emul_raise_exception(env, EXCP0D_GPF, 0);
         }
diff --git a/target/i386/tcg/system/misc_helper.c b/target/i386/tcg/system/misc_helper.c
index 9c3f5cc99b..0c32424d36 100644
--- a/target/i386/tcg/system/misc_helper.c
+++ b/target/i386/tcg/system/misc_helper.c
@@ -299,7 +299,7 @@ void helper_wrmsr(CPUX86State *env)
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
 
         bql_lock();
-        ret = apic_msr_write(index, val);
+        ret = apic_msr_write(env_archcpu(env)->apic_state, index, val);
         bql_unlock();
         if (ret < 0) {
             goto error;
@@ -477,7 +477,7 @@ void helper_rdmsr(CPUX86State *env)
         int index = (uint32_t)env->regs[R_ECX] - MSR_APIC_START;
 
         bql_lock();
-        ret = apic_msr_read(index, &val);
+        ret = apic_msr_read(x86_cpu->apic_state, index, &val);
         bql_unlock();
         if (ret < 0) {
             raise_exception_err_ra(env, EXCP0D_GPF, 0, GETPC());

From e2bb6f999f44f7b5835df4a52d83fc2d7b349a14 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:03:02 +0200
Subject: [PATCH 1493/2396] hw/intc/apic: Pass APICCommonState to
 apic_register_{read,write}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As per the previous patch, the APIC instance is already available in
apic_msr_{read,write}, so it can be passed along. It turns out that
the call to cpu_get_current_apic() is only required in
apic_mem_{read,write}, so it has been moved there. Longer term,
cpu_get_current_apic() could be removed entirely if
apic_mem_{read,write} is tied to a CPU's local address space.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251019210303.104718-10-shentey@gmail.com>
[PMD: Move return after apic_send_msi() in apic_mem_write()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/apic.c | 35 ++++++++++++++++-------------------
 1 file changed, 16 insertions(+), 19 deletions(-)

diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index ba0eda3921..aad253af15 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -769,17 +769,11 @@ static void apic_timer(void *opaque)
     apic_timer_update(s, s->next_time);
 }
 
-static int apic_register_read(int index, uint64_t *value)
+static int apic_register_read(APICCommonState *s, int index, uint64_t *value)
 {
-    APICCommonState *s;
     uint32_t val;
     int ret = 0;
 
-    s = cpu_get_current_apic();
-    if (!s) {
-        return -1;
-    }
-
     switch(index) {
     case 0x02: /* id */
         if (is_x2apic_mode(s)) {
@@ -868,6 +862,7 @@ static int apic_register_read(int index, uint64_t *value)
 
 static uint64_t apic_mem_read(void *opaque, hwaddr addr, unsigned size)
 {
+    APICCommonState *s = cpu_get_current_apic();
     uint64_t val;
     int index;
 
@@ -875,8 +870,12 @@ static uint64_t apic_mem_read(void *opaque, hwaddr addr, unsigned size)
         return 0;
     }
 
+    if (!s) {
+        return -1;
+    }
+
     index = (addr >> 4) & 0xff;
-    apic_register_read(index, &val);
+    apic_register_read(s, index, &val);
 
     return val;
 }
@@ -891,7 +890,7 @@ int apic_msr_read(APICCommonState *s, int index, uint64_t *val)
         return -1;
     }
 
-    return apic_register_read(index, val);
+    return apic_register_read(s, index, val);
 }
 
 static void apic_send_msi(MSIMessage *msi)
@@ -919,15 +918,8 @@ static void apic_send_msi(MSIMessage *msi)
     apic_deliver_irq(dest, dest_mode, delivery, vector, trigger_mode);
 }
 
-static int apic_register_write(int index, uint64_t val)
+static int apic_register_write(APICCommonState *s, int index, uint64_t val)
 {
-    APICCommonState *s;
-
-    s = cpu_get_current_apic();
-    if (!s) {
-        return -1;
-    }
-
     trace_apic_register_write(index, val);
 
     switch(index) {
@@ -1054,6 +1046,7 @@ static int apic_register_write(int index, uint64_t val)
 static void apic_mem_write(void *opaque, hwaddr addr, uint64_t val,
                            unsigned size)
 {
+    APICCommonState *s = cpu_get_current_apic();
     int index = (addr >> 4) & 0xff;
 
     if (size < 4) {
@@ -1073,7 +1066,11 @@ static void apic_mem_write(void *opaque, hwaddr addr, uint64_t val,
         return;
     }
 
-    apic_register_write(index, val);
+    if (!s) {
+        return;
+    }
+
+    apic_register_write(s, index, val);
 }
 
 int apic_msr_write(APICCommonState *s, int index, uint64_t val)
@@ -1086,7 +1083,7 @@ int apic_msr_write(APICCommonState *s, int index, uint64_t val)
         return -1;
     }
 
-    return apic_register_write(index, val);
+    return apic_register_write(s, index, val);
 }
 
 static void apic_pre_save(APICCommonState *s)

From 5a78db7f8099274550bdacdc1fc24943567ac615 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 04:54:27 -0400
Subject: [PATCH 1494/2396] vfio/container: Remap only populated parts in a
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If there are multiple containers and unmap-all fails for some of them, we
need to remap vaddr for the other containers for which unmap-all succeeded.
When ram discard is enabled, we should only remap populated parts in a
section instead of the whole section.

Fixes: eba1f657cbb1 ("vfio/container: recover from unmap-all-vaddr failure")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steven Sistare <steven.sistare@oracle.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c       | 20 +++++++++++++++-----
 hw/vfio/listener.c         |  4 ++--
 include/hw/vfio/vfio-cpr.h |  2 +-
 3 files changed, 18 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 80af7469d0..b4581e8f85 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -228,22 +228,32 @@ void vfio_cpr_giommu_remap(VFIOContainer *bcontainer,
     memory_region_iommu_replay(giommu->iommu_mr, &giommu->n);
 }
 
+static int vfio_cpr_rdm_remap(MemoryRegionSection *section, void *opaque)
+{
+    RamDiscardListener *rdl = opaque;
+
+    return rdl->notify_populate(rdl, section);
+}
+
 /*
  * In old QEMU, VFIO_DMA_UNMAP_FLAG_VADDR may fail on some mapping after
  * succeeding for others, so the latter have lost their vaddr.  Call this
- * to restore vaddr for a section with a RamDiscardManager.
+ * to restore vaddr for populated parts in a section with a RamDiscardManager.
  *
- * The ram discard listener already exists.  Call its populate function
+ * The ram discard listener already exists.  Call its replay_populated function
  * directly, which calls vfio_legacy_cpr_dma_map.
  */
-bool vfio_cpr_ram_discard_register_listener(VFIOContainer *bcontainer,
-                                            MemoryRegionSection *section)
+bool vfio_cpr_ram_discard_replay_populated(VFIOContainer *bcontainer,
+                                           MemoryRegionSection *section)
 {
+    RamDiscardManager *rdm = memory_region_get_ram_discard_manager(section->mr);
     VFIORamDiscardListener *vrdl =
         vfio_find_ram_discard_listener(bcontainer, section);
 
     g_assert(vrdl);
-    return vrdl->listener.notify_populate(&vrdl->listener, section) == 0;
+    return ram_discard_manager_replay_populated(rdm, section,
+                                                vfio_cpr_rdm_remap,
+                                                &vrdl->listener) == 0;
 }
 
 int vfio_cpr_group_get_device_fd(int d, const char *name)
diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index c6bb58f520..1b6e5065a3 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -577,8 +577,8 @@ void vfio_container_region_add(VFIOContainer *bcontainer,
             if (!vfio_ram_discard_register_listener(bcontainer, section, &err)) {
                 goto fail;
             }
-        } else if (!vfio_cpr_ram_discard_register_listener(bcontainer,
-                                                           section)) {
+        } else if (!vfio_cpr_ram_discard_replay_populated(bcontainer,
+                                                          section)) {
             error_setg(&err,
                        "vfio_cpr_ram_discard_register_listener for %s failed",
                        memory_region_name(section->mr));
diff --git a/include/hw/vfio/vfio-cpr.h b/include/hw/vfio/vfio-cpr.h
index 81f4e24e22..4606da500a 100644
--- a/include/hw/vfio/vfio-cpr.h
+++ b/include/hw/vfio/vfio-cpr.h
@@ -68,7 +68,7 @@ bool vfio_cpr_container_match(struct VFIOLegacyContainer *container,
 void vfio_cpr_giommu_remap(struct VFIOContainer *bcontainer,
                            MemoryRegionSection *section);
 
-bool vfio_cpr_ram_discard_register_listener(
+bool vfio_cpr_ram_discard_replay_populated(
     struct VFIOContainer *bcontainer, MemoryRegionSection *section);
 
 void vfio_cpr_save_vector_fd(struct VFIOPCIDevice *vdev, const char *name,

From 94230948960e56cb47e835266c7cd8df46da03a4 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 04:54:28 -0400
Subject: [PATCH 1495/2396] vfio/cpr-legacy: drop an erroneous assert
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vfio_legacy_cpr_dma_map() is not only used in post_load on destination
but also error recovery path on source side. Assert it for destination
is wrong.

Fixes: 7e9f21411302 ("vfio/container: restore DMA vaddr")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/cpr-legacy.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index b4581e8f85..7184c93991 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -52,8 +52,6 @@ static int vfio_legacy_cpr_dma_map(const VFIOContainer *bcontainer,
         .size = size,
     };
 
-    g_assert(cpr_is_incoming());
-
     if (ioctl(container->fd, VFIO_IOMMU_MAP_DMA, &map)) {
         return -errno;
     }

From d59db04aed750ba4fc56f79cae99814334ec8285 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 04:54:29 -0400
Subject: [PATCH 1496/2396] vfio/iommufd: Set cpr.ioas_id on source side for
 CPR transfer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

On source side, if there are more than one VFIO devices and they
attach to same container, only the first device sets cpr.ioas_id,
the others are bypassed. We should set it for each device, or
else only first device works.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 68470d552e..63a16d4dc1 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -602,7 +602,6 @@ skip_ioas_alloc:
     container->be = vbasedev->iommufd;
     container->ioas_id = ioas_id;
     QLIST_INIT(&container->hwpt_list);
-    vbasedev->cpr.ioas_id = ioas_id;
 
     bcontainer = VFIO_IOMMU(container);
     vfio_address_space_insert(space, bcontainer);
@@ -636,6 +635,8 @@ skip_ioas_alloc:
     bcontainer->initialized = true;
 
 found_container:
+    vbasedev->cpr.ioas_id = container->ioas_id;
+
     ret = ioctl(devfd, VFIO_DEVICE_GET_INFO, &dev_info);
     if (ret) {
         error_setg_errno(errp, errno, "error getting device info");

From 8bf49fff0dfbb065ad65daa48d2e1a63ad2fd552 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 04:54:30 -0400
Subject: [PATCH 1497/2396] vfio/iommufd: Restore vbasedev's reference to hwpt
 after CPR transfer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

After CPR transfer, if there are more than one VFIO devices, device is
not added to hwpt->device_list and its reference to hwpt isn't restored
on destination. We still need to call iommufd_cdev_attach_container() to
restore it after a matching container is found, or else SIGSEV triggers.

Fixes: 4296ee07455e ("vfio/iommufd: reconstruct device")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-5-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 63a16d4dc1..24a99efa87 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -560,10 +560,9 @@ static bool iommufd_cdev_attach(const char *name, VFIODevice *vbasedev,
             continue;
         }
 
-        if (!cpr_is_incoming()) {
+        if (!cpr_is_incoming() ||
+            (vbasedev->cpr.ioas_id == container->ioas_id)) {
             res = iommufd_cdev_attach_container(vbasedev, container, &err);
-        } else if (vbasedev->cpr.ioas_id == container->ioas_id) {
-            res = true;
         } else {
             continue;
         }

From 725ec898039dfed0a669bf78b556529b51e248e8 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Sun, 28 Sep 2025 04:54:31 -0400
Subject: [PATCH 1498/2396] accel/kvm: Fix an erroneous check on
 coalesced_mmio_ring
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to KVM uAPI, coalesced mmio page is KVM_COALESCED_MMIO_PAGE_OFFSET
offset from kvm_run pages. For x86 it's 2 pages offset, for arm it's 1 page
offset currently. We shouldn't presume it's hardcoded 1 page or else
coalesced_mmio_ring will not be cleared in do_kvm_destroy_vcpu() in x86.

Fixes: 7ed0919119b0 ("migration: close kvm after cpr")
Cc: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Steve Sistare <steven.sistare@oracle.com>
Link: https://lore.kernel.org/qemu-devel/20250928085432.40107-6-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 accel/kvm/kvm-all.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index 56031925c4..f9254ae654 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -525,7 +525,8 @@ static int do_kvm_destroy_vcpu(CPUState *cpu)
     }
 
     /* If I am the CPU that created coalesced_mmio_ring, then discard it */
-    if (s->coalesced_mmio_ring == (void *)cpu->kvm_run + PAGE_SIZE) {
+    if (s->coalesced_mmio_ring ==
+           (void *)cpu->kvm_run + s->coalesced_mmio * PAGE_SIZE) {
         s->coalesced_mmio_ring = NULL;
     }
 

From 962bcf0911e7f3601da0f07ba7da9824cb6a5ba5 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 9 Oct 2025 00:01:32 -0400
Subject: [PATCH 1499/2396] vfio/container: Support unmap all in one ioctl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

VFIO type1 kernel uAPI supports unmapping whole address space in one call
since commit c19650995374 ("vfio/type1: implement unmap all"). Use the
unmap_all variant whenever it's supported in kernel.

Opportunistically pass VFIOLegacyContainer pointer in low level function
vfio_legacy_dma_unmap_one().

Co-developed-by: John Levon <levon@movementarian.org>
Signed-off-by: John Levon <levon@movementarian.org>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-2-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/container-legacy.c              | 36 ++++++++++++++-----------
 include/hw/vfio/vfio-container-legacy.h |  1 +
 2 files changed, 22 insertions(+), 15 deletions(-)

diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index a3615d7b5d..8e9639603e 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -121,14 +121,14 @@ unmap_exit:
     return ret;
 }
 
-static int vfio_legacy_dma_unmap_one(const VFIOContainer *bcontainer,
+static int vfio_legacy_dma_unmap_one(const VFIOLegacyContainer *container,
                                      hwaddr iova, uint64_t size,
-                                     IOMMUTLBEntry *iotlb)
+                                     uint32_t flags, IOMMUTLBEntry *iotlb)
 {
-    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    const VFIOContainer *bcontainer = VFIO_IOMMU(container);
     struct vfio_iommu_type1_dma_unmap unmap = {
         .argsz = sizeof(unmap),
-        .flags = 0,
+        .flags = flags,
         .iova = iova,
         .size = size,
     };
@@ -170,25 +170,28 @@ static int vfio_legacy_dma_unmap(const VFIOContainer *bcontainer,
                                  hwaddr iova, uint64_t size,
                                  IOMMUTLBEntry *iotlb, bool unmap_all)
 {
+    const VFIOLegacyContainer *container = VFIO_IOMMU_LEGACY(bcontainer);
+    uint32_t flags = 0;
     int ret;
 
     if (unmap_all) {
-        /* The unmap ioctl doesn't accept a full 64-bit span. */
-        Int128 llsize = int128_rshift(int128_2_64(), 1);
+        if (container->unmap_all_supported) {
+            flags = VFIO_DMA_UNMAP_FLAG_ALL;
+        } else {
+            /* The unmap ioctl doesn't accept a full 64-bit span. */
+            Int128 llsize = int128_rshift(int128_2_64(), 1);
+            size = int128_get64(llsize);
 
-        ret = vfio_legacy_dma_unmap_one(bcontainer, 0, int128_get64(llsize),
-                                        iotlb);
+            ret = vfio_legacy_dma_unmap_one(container, 0, size, flags, iotlb);
+            if (ret) {
+                return ret;
+            }
 
-        if (ret == 0) {
-            ret = vfio_legacy_dma_unmap_one(bcontainer, int128_get64(llsize),
-                                            int128_get64(llsize), iotlb);
+            iova = size;
         }
-
-    } else {
-        ret = vfio_legacy_dma_unmap_one(bcontainer, iova, size, iotlb);
     }
 
-    return ret;
+    return vfio_legacy_dma_unmap_one(container, iova, size, flags, iotlb);
 }
 
 static int vfio_legacy_dma_map(const VFIOContainer *bcontainer, hwaddr iova,
@@ -519,6 +522,9 @@ static bool vfio_legacy_setup(VFIOContainer *bcontainer, Error **errp)
 
     vfio_get_info_iova_range(info, bcontainer);
 
+    ret = ioctl(container->fd, VFIO_CHECK_EXTENSION, VFIO_UNMAP_ALL);
+    container->unmap_all_supported = !!ret;
+
     vfio_get_iommu_info_migration(container, info);
     return true;
 }
diff --git a/include/hw/vfio/vfio-container-legacy.h b/include/hw/vfio/vfio-container-legacy.h
index 74a72df018..ffd594e80d 100644
--- a/include/hw/vfio/vfio-container-legacy.h
+++ b/include/hw/vfio/vfio-container-legacy.h
@@ -30,6 +30,7 @@ struct VFIOLegacyContainer {
 
     int fd; /* /dev/vfio/vfio, empowered by the attached groups */
     unsigned iommu_type;
+    bool unmap_all_supported;
     QLIST_HEAD(, VFIOGroup) group_list;
     VFIOContainerCPR cpr;
 };

From b30823e5619ed5658d33e43abe1308195edb3e8b Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 9 Oct 2025 00:01:33 -0400
Subject: [PATCH 1500/2396] vfio/iommufd: Support unmap all in one ioctl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

IOMMUFD kernel uAPI supports unmapping whole address space in one call with
[iova, size] set to [0, UINT64_MAX], this can simplify iommufd_cdev_unmap()
a bit. See iommufd_ioas_unmap() in kernel for details.

Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-3-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/iommufd.c | 15 +--------------
 1 file changed, 1 insertion(+), 14 deletions(-)

diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index 24a99efa87..fc9cd9d22f 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -62,21 +62,8 @@ static int iommufd_cdev_unmap(const VFIOContainer *bcontainer,
 {
     const VFIOIOMMUFDContainer *container = VFIO_IOMMU_IOMMUFD(bcontainer);
 
-    /* unmap in halves */
     if (unmap_all) {
-        Int128 llsize = int128_rshift(int128_2_64(), 1);
-        int ret;
-
-        ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
-                                        0, int128_get64(llsize));
-
-        if (ret == 0) {
-            ret = iommufd_backend_unmap_dma(container->be, container->ioas_id,
-                                            int128_get64(llsize),
-                                            int128_get64(llsize));
-        }
-
-        return ret;
+        size = UINT64_MAX;
     }
 
     /* TODO: Handle dma_unmap_bitmap with iotlb args (migration) */

From 271fec6f18492630df2e1b4599ba2de6eb1d0668 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Thu, 9 Oct 2025 00:01:34 -0400
Subject: [PATCH 1501/2396] vfio/listener: Add an assertion for unmap_all
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the maximum of iommu address space is 64bit. So when a maximum
iommu memory section is deleted, it's in scope [0, 2^64). Add a
assertion for that.

Suggested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251009040134.334251-4-zhenzhong.duan@intel.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/listener.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/vfio/listener.c b/hw/vfio/listener.c
index 1b6e5065a3..2d7d3a4645 100644
--- a/hw/vfio/listener.c
+++ b/hw/vfio/listener.c
@@ -715,6 +715,7 @@ static void vfio_listener_region_del(MemoryListener *listener,
         bool unmap_all = false;
 
         if (int128_eq(llsize, int128_2_64())) {
+            assert(!iova);
             unmap_all = true;
             llsize = int128_zero();
         }

From 1118a4207b0c5287d942a18b1a446c2e29baea3a Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Thu, 9 Oct 2025 16:02:06 +0200
Subject: [PATCH 1502/2396] docs/system/devices/vfio-user: fix formatting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The example QEMU argument was not rendering properly, as it was not
indented.

Signed-off-by: John Levon <john.levon@nutanix.com>
Fixes: c688cc165b ("docs: add vfio-user documentation")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251009140206.386249-1-john.levon@nutanix.com
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/system/devices/vfio-user.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/devices/vfio-user.rst b/docs/system/devices/vfio-user.rst
index 30c2215f4e..e10a6d0822 100644
--- a/docs/system/devices/vfio-user.rst
+++ b/docs/system/devices/vfio-user.rst
@@ -20,7 +20,7 @@ Presuming a suitable ``vfio-user`` server has opened a socket at
 
 .. code-block:: console
 
--device '{"driver": "vfio-user-pci","socket": {"path": "/tmp/vfio-user.sock", "type": "unix"}}'
+  --device '{"driver": "vfio-user-pci","socket": {"path": "/tmp/vfio-user.sock", "type": "unix"}}'
 
 See `libvfio-user <https://github.com/nutanix/libvfio-user/>`_ for further
 information.

From 7ea3fd2b6c2543c60fb309265fa445fa8fdcc1ea Mon Sep 17 00:00:00 2001
From: Alex Williamson <alex.williamson@redhat.com>
Date: Mon, 13 Oct 2025 09:35:35 -0600
Subject: [PATCH 1503/2396] MAINTAINERS: Update Alex Williamson's email address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch to a personal email account as I'll be leaving Red Hat soon.

Signed-off-by: Alex Williamson <alex@shazbot.org>
Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251013153543.3091169-1-alex.williamson@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 .mailmap    | 1 +
 MAINTAINERS | 4 ++--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index 15bec72470..7f817d9f42 100644
--- a/.mailmap
+++ b/.mailmap
@@ -74,6 +74,7 @@ Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <aleksandar.markovic@imgte
 Aleksandar Markovic <aleksandar.qemu.devel@gmail.com> <amarkovic@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <arikalo@wavecomp.com>
 Aleksandar Rikalo <aleksandar.rikalo@syrmia.com> <aleksandar.rikalo@rt-rk.com>
+Alex Williamson <alex@shazbot.org> <alex.williamson@redhat.com>
 Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Ani Sinha <anisinha@redhat.com> <ani@anisinha.ca>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index 667acd933c..7a0809d82a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2285,7 +2285,7 @@ S: Maintained
 F: hw/usb/dev-serial.c
 
 VFIO
-M: Alex Williamson <alex.williamson@redhat.com>
+M: Alex Williamson <alex@shazbot.org>
 M: Cédric Le Goater <clg@redhat.com>
 S: Supported
 F: hw/vfio/*
@@ -2297,7 +2297,7 @@ F: migration/vfio-stub.c
 F: tests/functional/aarch64/test_device_passthrough.py
 
 vfio-igd
-M: Alex Williamson <alex.williamson@redhat.com>
+M: Alex Williamson <alex@shazbot.org>
 M: Cédric Le Goater <clg@redhat.com>
 M: Tomita Moeko <tomitamoeko@gmail.com>
 S: Supported

From aaca725884b57c9245528a0afb3f32e078543faf Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 14 Oct 2025 17:12:26 +0200
Subject: [PATCH 1504/2396] vfio: rename field to "num_initial_regions"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We set VFIODevice::num_regions at initialization time, and do not
otherwise refresh it. As it is valid in theory for a VFIO device to
later increase the number of supported regions, rename the field to
"num_initial_regions" to better reflect its semantics.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/device.c         |  2 +-
 hw/vfio/ccw.c                 |  4 ++--
 hw/vfio/device.c              | 12 ++++++------
 hw/vfio/iommufd.c             |  3 ++-
 hw/vfio/pci.c                 |  4 ++--
 include/hw/vfio/vfio-device.h |  2 +-
 6 files changed, 14 insertions(+), 13 deletions(-)

diff --git a/hw/vfio-user/device.c b/hw/vfio-user/device.c
index 0609a7dc25..64ef35b320 100644
--- a/hw/vfio-user/device.c
+++ b/hw/vfio-user/device.c
@@ -134,7 +134,7 @@ static int vfio_user_device_io_get_region_info(VFIODevice *vbasedev,
     VFIOUserFDs fds = { 0, 1, fd};
     int ret;
 
-    if (info->index > vbasedev->num_regions) {
+    if (info->index > vbasedev->num_initial_regions) {
         return -EINVAL;
     }
 
diff --git a/hw/vfio/ccw.c b/hw/vfio/ccw.c
index 9560b8d851..4d9588e7aa 100644
--- a/hw/vfio/ccw.c
+++ b/hw/vfio/ccw.c
@@ -484,9 +484,9 @@ static bool vfio_ccw_get_region(VFIOCCWDevice *vcdev, Error **errp)
      * We always expect at least the I/O region to be present. We also
      * may have a variable number of regions governed by capabilities.
      */
-    if (vdev->num_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
+    if (vdev->num_initial_regions < VFIO_CCW_CONFIG_REGION_INDEX + 1) {
         error_setg(errp, "vfio: too few regions (%u), expected at least %u",
-                   vdev->num_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
+                   vdev->num_initial_regions, VFIO_CCW_CONFIG_REGION_INDEX + 1);
         return false;
     }
 
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 64f8750389..52079f4cf5 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -257,7 +257,7 @@ int vfio_device_get_region_info_type(VFIODevice *vbasedev, uint32_t type,
 {
     int i;
 
-    for (i = 0; i < vbasedev->num_regions; i++) {
+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
         struct vfio_info_cap_header *hdr;
         struct vfio_region_info_cap_type *cap_type;
 
@@ -466,7 +466,7 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
     int i;
 
     vbasedev->num_irqs = info->num_irqs;
-    vbasedev->num_regions = info->num_regions;
+    vbasedev->num_initial_regions = info->num_regions;
     vbasedev->flags = info->flags;
     vbasedev->reset_works = !!(info->flags & VFIO_DEVICE_FLAGS_RESET);
 
@@ -476,10 +476,10 @@ void vfio_device_prepare(VFIODevice *vbasedev, VFIOContainer *bcontainer,
     QLIST_INSERT_HEAD(&vfio_device_list, vbasedev, global_next);
 
     vbasedev->reginfo = g_new0(struct vfio_region_info *,
-                               vbasedev->num_regions);
+                               vbasedev->num_initial_regions);
     if (vbasedev->use_region_fds) {
-        vbasedev->region_fds = g_new0(int, vbasedev->num_regions);
-        for (i = 0; i < vbasedev->num_regions; i++) {
+        vbasedev->region_fds = g_new0(int, vbasedev->num_initial_regions);
+        for (i = 0; i < vbasedev->num_initial_regions; i++) {
             vbasedev->region_fds[i] = -1;
         }
     }
@@ -489,7 +489,7 @@ void vfio_device_unprepare(VFIODevice *vbasedev)
 {
     int i;
 
-    for (i = 0; i < vbasedev->num_regions; i++) {
+    for (i = 0; i < vbasedev->num_initial_regions; i++) {
         g_free(vbasedev->reginfo[i]);
         if (vbasedev->region_fds != NULL && vbasedev->region_fds[i] != -1) {
             close(vbasedev->region_fds[i]);
diff --git a/hw/vfio/iommufd.c b/hw/vfio/iommufd.c
index fc9cd9d22f..bb5775aa71 100644
--- a/hw/vfio/iommufd.c
+++ b/hw/vfio/iommufd.c
@@ -650,7 +650,8 @@ found_container:
     vfio_iommufd_cpr_register_device(vbasedev);
 
     trace_iommufd_cdev_device_info(vbasedev->name, devfd, vbasedev->num_irqs,
-                                   vbasedev->num_regions, vbasedev->flags);
+                                   vbasedev->num_initial_regions,
+                                   vbasedev->flags);
     return true;
 
 err_listener_register:
diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 06b06afc2b..8b8bc5a421 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -2975,9 +2975,9 @@ bool vfio_pci_populate_device(VFIOPCIDevice *vdev, Error **errp)
         return false;
     }
 
-    if (vbasedev->num_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
+    if (vbasedev->num_initial_regions < VFIO_PCI_CONFIG_REGION_INDEX + 1) {
         error_setg(errp, "unexpected number of io regions %u",
-                   vbasedev->num_regions);
+                   vbasedev->num_initial_regions);
         return false;
     }
 
diff --git a/include/hw/vfio/vfio-device.h b/include/hw/vfio/vfio-device.h
index 7e9aed6d3c..0fe6c60ba2 100644
--- a/include/hw/vfio/vfio-device.h
+++ b/include/hw/vfio/vfio-device.h
@@ -74,7 +74,7 @@ typedef struct VFIODevice {
     VFIODeviceOps *ops;
     VFIODeviceIOOps *io_ops;
     unsigned int num_irqs;
-    unsigned int num_regions;
+    unsigned int num_initial_regions;
     unsigned int flags;
     VFIOMigration *migration;
     Error *migration_blocker;

From ecbe424a63c9f860a901d6a4a75724b046abd796 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Tue, 14 Oct 2025 17:12:27 +0200
Subject: [PATCH 1505/2396] vfio: only check region info cache for initial
 regions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is semantically valid for a VFIO device to increase the number of
regions after initialization. In this case, we'd attempt to check for
cached region info past the size of the ->reginfo array. Check for the
region index and skip the cache in these cases.

This also works around some VGPU use cases which appear to be a bug,
where VFIO_DEVICE_QUERY_GFX_PLANE returns a region index beyond the
reported ->num_regions.

Fixes: 95cdb024 ("vfio: add region info cache")
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Alex Williamson <alex@shazbot.org>
Link: https://lore.kernel.org/qemu-devel/20251014151227.2298892-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio/device.c | 27 +++++++++++++++++++--------
 1 file changed, 19 insertions(+), 8 deletions(-)

diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 52079f4cf5..8b63e765ac 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -205,10 +205,19 @@ int vfio_device_get_region_info(VFIODevice *vbasedev, int index,
     int fd = -1;
     int ret;
 
-    /* check cache */
-    if (vbasedev->reginfo[index] != NULL) {
-        *info = vbasedev->reginfo[index];
-        return 0;
+    /*
+     * We only set up the region info cache for the initial number of regions.
+     *
+     * Since a VFIO device may later increase the number of regions then use
+     * such regions with an index past ->num_initial_regions, don't attempt to
+     * use the info cache in those cases.
+     */
+    if (index < vbasedev->num_initial_regions) {
+        /* check cache */
+        if (vbasedev->reginfo[index] != NULL) {
+            *info = vbasedev->reginfo[index];
+            return 0;
+        }
     }
 
     *info = g_malloc0(argsz);
@@ -236,10 +245,12 @@ retry:
         goto retry;
     }
 
-    /* fill cache */
-    vbasedev->reginfo[index] = *info;
-    if (vbasedev->region_fds != NULL) {
-        vbasedev->region_fds[index] = fd;
+    if (index < vbasedev->num_initial_regions) {
+        /* fill cache */
+        vbasedev->reginfo[index] = *info;
+        if (vbasedev->region_fds != NULL) {
+            vbasedev->region_fds[index] = fd;
+        }
     }
 
     return 0;

From 274e199ba07160d61bb0675070649725aa122f78 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:21:56 +0800
Subject: [PATCH 1506/2396] hw/arm/aspeed_ast27x0-ssp: Add SDRAM region and fix
 naming and size to 512MB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, the SSP memory was incorrectly modeled as "SRAM" with
a 32 MB size. This change introduces a new sdram field in
AspeedCoprocessorState and updates the realization logic accordingly.
Rename from SRAM to SDRAM and correct size from 32MB to 512MB to match
hardware.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-ssp.c         | 20 ++++++++++----------
 include/hw/arm/aspeed_coprocessor.h |  1 +
 2 files changed, 11 insertions(+), 10 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 936c7c72e8..9f3a1933a0 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -16,10 +16,10 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/aspeed_coprocessor.h"
 
-#define AST2700_SSP_RAM_SIZE (32 * MiB)
+#define AST2700_SSP_SDRAM_SIZE (512 * MiB)
 
 static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
-    [ASPEED_DEV_SRAM]      =  0x00000000,
+    [ASPEED_DEV_SDRAM]     =  0x00000000,
     [ASPEED_DEV_INTC]      =  0x72100000,
     [ASPEED_DEV_SCU]       =  0x72C02000,
     [ASPEED_DEV_SCUIO]     =  0x74C02000,
@@ -165,7 +165,7 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
-    g_autofree char *sram_name = NULL;
+    g_autofree char *sdram_name = NULL;
     int uart;
     int i;
 
@@ -184,16 +184,16 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
                              OBJECT(s->memory), &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
 
-    sram_name = g_strdup_printf("aspeed.dram.%d",
-                                CPU(a->armv7m.cpu)->cpu_index);
-
-    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name,
-                                AST2700_SSP_RAM_SIZE, errp)) {
+    /* SDRAM */
+    sdram_name = g_strdup_printf("aspeed.sdram.%d",
+                                 CPU(a->armv7m.cpu)->cpu_index);
+    if (!memory_region_init_ram(&s->sdram, OBJECT(s), sdram_name,
+                                AST2700_SSP_SDRAM_SIZE, errp)) {
         return;
     }
     memory_region_add_subregion(s->memory,
-                                sc->memmap[ASPEED_DEV_SRAM],
-                                &s->sram);
+                                sc->memmap[ASPEED_DEV_SDRAM],
+                                &s->sdram);
 
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index d77655d659..0c7168a89c 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -16,6 +16,7 @@ struct AspeedCoprocessorState {
     DeviceState parent;
 
     MemoryRegion *memory;
+    MemoryRegion sdram;
     MemoryRegion sram;
     Clock *sysclk;
 

From 4e7232f268a583a7b37ffea2cf41471e3b1cf97c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:21:57 +0800
Subject: [PATCH 1507/2396] hw/arm/aspeed_ast27x0-tsp: Add SDRAM region and fix
 naming and size to 512MB
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously, the TSP memory was incorrectly modeled as "SRAM" with
a 32 MB size. Rename from SRAM to SDRAM and correct size from 32MB
to 512MB to match hardware.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-tsp.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 9318f8c86c..caeb3392a8 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -16,10 +16,10 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/aspeed_coprocessor.h"
 
-#define AST2700_TSP_RAM_SIZE (32 * MiB)
+#define AST2700_TSP_SDRAM_SIZE (512 * MiB)
 
 static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
-    [ASPEED_DEV_SRAM]      =  0x00000000,
+    [ASPEED_DEV_SDRAM]     =  0x00000000,
     [ASPEED_DEV_INTC]      =  0x72100000,
     [ASPEED_DEV_SCU]       =  0x72C02000,
     [ASPEED_DEV_SCUIO]     =  0x74C02000,
@@ -165,7 +165,7 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(dev_soc);
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
-    g_autofree char *sram_name = NULL;
+    g_autofree char *sdram_name = NULL;
     int uart;
     int i;
 
@@ -184,16 +184,16 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
                              OBJECT(s->memory), &error_abort);
     sysbus_realize(SYS_BUS_DEVICE(&a->armv7m), &error_abort);
 
-    sram_name = g_strdup_printf("aspeed.dram.%d",
-                                CPU(a->armv7m.cpu)->cpu_index);
-
-    if (!memory_region_init_ram(&s->sram, OBJECT(s), sram_name,
-                                AST2700_TSP_RAM_SIZE, errp)) {
+    /* SDRAM */
+    sdram_name = g_strdup_printf("aspeed.sdram.%d",
+                                 CPU(a->armv7m.cpu)->cpu_index);
+    if (!memory_region_init_ram(&s->sdram, OBJECT(s), sdram_name,
+                                AST2700_TSP_SDRAM_SIZE, errp)) {
         return;
     }
     memory_region_add_subregion(s->memory,
-                                sc->memmap[ASPEED_DEV_SRAM],
-                                &s->sram);
+                                sc->memmap[ASPEED_DEV_SDRAM],
+                                &s->sdram);
 
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {

From 00d65b454187089fbcbd64ba0d756b6883039531 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:21:58 +0800
Subject: [PATCH 1508/2396] hw/arm/ast27x0: Add SRAM link and alias mapping for
 SSP coprocessor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST2700 has a 128KB SRAM, physically mapped at 0x10000000–0x1001FFFF for
the PSP (CA35) processor. The SSP coprocessor shares this same SRAM but
accesses it through a different address window at 0x70000000–0x7001FFFF.

To model this shared-memory behavior in QEMU, this commit introduces a
linked SRAM property and alias mapping between the PSP and SSP subsystems.

Changes include:
- Add a "MemoryRegion *sram" link and "MemoryRegion sram_alias" to
  AspeedCoprocessorState.
- Register the new "sram" property in aspeed_coprocessor_common.c.
- In aspeed_ast27x0-fc.c, connect the SSP coprocessor’s "sram" link to
  the PSP’s SRAM region.
- In aspeed_ast27x0-ssp.c, create an alias mapping for SRAM at
  0x70000000 – 0x7001FFFF in the SSP’s memory map.

This ensures that the SSP can correctly access the shared SRAM contents
through its own address space while maintaining a consistent physical
backing region. It also guarantees that the SRAM is realized before the
SSP device, ensuring successful alias setup.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          | 4 ++++
 hw/arm/aspeed_ast27x0-ssp.c         | 7 +++++++
 hw/arm/aspeed_coprocessor_common.c  | 2 ++
 include/hw/arm/aspeed_coprocessor.h | 3 ++-
 4 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index a61ecff390..25e668a648 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -118,6 +118,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
     AspeedCoprocessorState *soc;
     AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
+    AspeedSoCState *psp = ASPEED_SOC(&s->ca35);
+
     s->ssp_sysclk = clock_new(OBJECT(s), "SSP_SYSCLK");
     clock_set_hz(s->ssp_sysclk, 200000000ULL);
 
@@ -134,6 +136,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
     sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
     aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART4, sc->uarts_base,
                             sc->uarts_num, serial_hd(1));
+    object_property_set_link(OBJECT(&s->ssp), "sram",
+                             OBJECT(&psp->sram), &error_abort);
     if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
         return false;
     }
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 9f3a1933a0..66c4ef6d1b 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -20,6 +20,7 @@
 
 static const hwaddr aspeed_soc_ast27x0ssp_memmap[] = {
     [ASPEED_DEV_SDRAM]     =  0x00000000,
+    [ASPEED_DEV_SRAM]      =  0x70000000,
     [ASPEED_DEV_INTC]      =  0x72100000,
     [ASPEED_DEV_SCU]       =  0x72C02000,
     [ASPEED_DEV_SCUIO]     =  0x74C02000,
@@ -195,6 +196,12 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
                                 sc->memmap[ASPEED_DEV_SDRAM],
                                 &s->sdram);
 
+    /* SRAM */
+    memory_region_init_alias(&s->sram_alias, OBJECT(s), "sram.alias",
+                             s->sram, 0, memory_region_size(s->sram));
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM],
+                                &s->sram_alias);
+
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;
diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
index 8a94b44f07..8322ad5eb5 100644
--- a/hw/arm/aspeed_coprocessor_common.c
+++ b/hw/arm/aspeed_coprocessor_common.c
@@ -25,6 +25,8 @@ static void aspeed_coprocessor_realize(DeviceState *dev, Error **errp)
 static const Property aspeed_coprocessor_properties[] = {
     DEFINE_PROP_LINK("memory", AspeedCoprocessorState, memory,
                      TYPE_MEMORY_REGION, MemoryRegion *),
+    DEFINE_PROP_LINK("sram", AspeedCoprocessorState, sram, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
 };
 
 static void aspeed_coprocessor_class_init(ObjectClass *oc, const void *data)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index 0c7168a89c..d9a5f517d7 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -17,7 +17,8 @@ struct AspeedCoprocessorState {
 
     MemoryRegion *memory;
     MemoryRegion sdram;
-    MemoryRegion sram;
+    MemoryRegion *sram;
+    MemoryRegion sram_alias;
     Clock *sysclk;
 
     AspeedSCUState scu;

From 2c9078b8d2e31af6c33d530f9edb4ba6387b77bd Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:21:59 +0800
Subject: [PATCH 1509/2396] hw/arm/ast27x0: Add SRAM link and alias mapping for
 TSP coprocessor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST2700 has a 128KB SRAM, physically mapped at 0x10000000–0x1001FFFF for
the PSP (CA35) processor. The TSP coprocessor shares this same SRAM but
accesses it through a different address window at 0x70000000–0x7001FFFF.

To model this shared-memory behavior in QEMU, this commit introduces a
linked SRAM property and alias mapping between the PSP and TSP subsystems.

Changes include:
- Add the SRAM alias mapping at 0x70000000 in aspeed_ast27x0-tsp.c.
- In aspeed_ast27x0-fc.c, connect the TSP coprocessor’s "sram" link to
  the PSP’s SRAM region.
- Ensure the alias region is initialized during TSP SoC realization so
  the TSP can correctly access shared SRAM through its own address space.

This ensures that the TSP and PSP share the same physical SRAM backing.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c  | 4 ++++
 hw/arm/aspeed_ast27x0-tsp.c | 7 +++++++
 2 files changed, 11 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 25e668a648..dfac7d1e17 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -150,6 +150,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
     AspeedCoprocessorState *soc;
     AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
+    AspeedSoCState *psp = ASPEED_SOC(&s->ca35);
+
     s->tsp_sysclk = clock_new(OBJECT(s), "TSP_SYSCLK");
     clock_set_hz(s->tsp_sysclk, 200000000ULL);
 
@@ -166,6 +168,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
     sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
     aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
                             sc->uarts_num, serial_hd(2));
+    object_property_set_link(OBJECT(&s->tsp), "sram",
+                             OBJECT(&psp->sram), &error_abort);
     if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
         return false;
     }
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index caeb3392a8..56b68adf54 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -20,6 +20,7 @@
 
 static const hwaddr aspeed_soc_ast27x0tsp_memmap[] = {
     [ASPEED_DEV_SDRAM]     =  0x00000000,
+    [ASPEED_DEV_SRAM]      =  0x70000000,
     [ASPEED_DEV_INTC]      =  0x72100000,
     [ASPEED_DEV_SCU]       =  0x72C02000,
     [ASPEED_DEV_SCUIO]     =  0x74C02000,
@@ -195,6 +196,12 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
                                 sc->memmap[ASPEED_DEV_SDRAM],
                                 &s->sdram);
 
+    /* SRAM */
+    memory_region_init_alias(&s->sram_alias, OBJECT(s), "sram.alias",
+                             s->sram, 0, memory_region_size(s->sram));
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SRAM],
+                                &s->sram_alias);
+
     /* SCU */
     if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
         return;

From 362e54b10ddd76ac9989900f53b7acede09ca86f Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:00 +0800
Subject: [PATCH 1510/2396] hw/arm/ast27x0: Share single SCU instance across
 PSP, SSP, and TSP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AST2700 has a single SCU hardware block, memory-mapped at
0x12C02000–0x12C03FFF from the perspective of the main CA35 processor (PSP).
The SSP and TSP coprocessors access this same SCU block at different
addresses: 0x72C02000–0x72C03FFF.

Previously, each subsystem (PSP, SSP, and TSP) instantiated its own SCU
device, resulting in three independent SCU instances in the QEMU model.
In real hardware, however, only a single SCU exists and is shared among
all processors.

This commit reworks the SCU model to correctly reflect the hardware
behavior by allowing SSP and TSP to reference the PSP’s SCU instance.
The following changes are introduced:

- Add a scu property to AspeedCoprocessorState for linking the
  coprocessor to the PSP’s SCU instance.
- Replace per-coprocessor SCU instantiation with a shared SCU link.
- Add "MemoryRegion scu_alias" to model address remapping for SSP and TSP.
- Create SCU alias regions in both SSP and TSP coprocessors and map
  them at 0x72C02000 to mirror the PSP’s SCU registers.
- Ensure the SCU device in PSP is realized before SSP/TSP alias setup.

With this change, PSP, SSP, and TSP now share a consistent SCU state,
matching the single-SCU hardware design of AST2700.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          |  4 ++++
 hw/arm/aspeed_ast27x0-ssp.c         | 13 +++++--------
 hw/arm/aspeed_ast27x0-tsp.c         | 13 +++++--------
 hw/arm/aspeed_coprocessor_common.c  |  2 ++
 include/hw/arm/aspeed_coprocessor.h |  4 ++--
 5 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index dfac7d1e17..ba43a46207 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -138,6 +138,8 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
                             sc->uarts_num, serial_hd(1));
     object_property_set_link(OBJECT(&s->ssp), "sram",
                              OBJECT(&psp->sram), &error_abort);
+    object_property_set_link(OBJECT(&s->ssp), "scu",
+                             OBJECT(&psp->scu), &error_abort);
     if (!qdev_realize(DEVICE(&s->ssp), NULL, errp)) {
         return false;
     }
@@ -170,6 +172,8 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
                             sc->uarts_num, serial_hd(2));
     object_property_set_link(OBJECT(&s->tsp), "sram",
                              OBJECT(&psp->sram), &error_abort);
+    object_property_set_link(OBJECT(&s->tsp), "scu",
+                             OBJECT(&psp->scu), &error_abort);
     if (!qdev_realize(DEVICE(&s->tsp), NULL, errp)) {
         return false;
     }
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 66c4ef6d1b..577a3379c6 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -137,9 +137,7 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
     int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
-    object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
-    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev", sc->silicon_rev);
 
     for (i = 0; i < sc->uarts_num; i++) {
         object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
@@ -203,11 +201,11 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
                                 &s->sram_alias);
 
     /* SCU */
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-        return;
-    }
-    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
-                    sc->memmap[ASPEED_DEV_SCU]);
+    memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
+                             &s->scu->iomem, 0,
+                             memory_region_size(&s->scu->iomem));
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
+                                &s->scu_alias);
 
     /* INTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
@@ -285,7 +283,6 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
     dc->realize = aspeed_soc_ast27x0ssp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
-    sc->silicon_rev = AST2700_A1_SILICON_REV;
     sc->uarts_num = 13;
     sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index 56b68adf54..a7c141678f 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -137,9 +137,7 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
     int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
-    object_initialize_child(obj, "scu", &s->scu, TYPE_ASPEED_2700_SCU);
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
-    qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev", sc->silicon_rev);
 
     for (i = 0; i < sc->uarts_num; i++) {
         object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
@@ -203,11 +201,11 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
                                 &s->sram_alias);
 
     /* SCU */
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->scu), errp)) {
-        return;
-    }
-    aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->scu), 0,
-                    sc->memmap[ASPEED_DEV_SCU]);
+    memory_region_init_alias(&s->scu_alias, OBJECT(s), "scu.alias",
+                             &s->scu->iomem, 0,
+                             memory_region_size(&s->scu->iomem));
+    memory_region_add_subregion(s->memory, sc->memmap[ASPEED_DEV_SCU],
+                                &s->scu_alias);
 
     /* INTC */
     if (!sysbus_realize(SYS_BUS_DEVICE(&a->intc[0]), errp)) {
@@ -285,7 +283,6 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
     dc->realize = aspeed_soc_ast27x0tsp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
-    sc->silicon_rev = AST2700_A1_SILICON_REV;
     sc->uarts_num = 13;
     sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
index 8322ad5eb5..14e26bbe23 100644
--- a/hw/arm/aspeed_coprocessor_common.c
+++ b/hw/arm/aspeed_coprocessor_common.c
@@ -27,6 +27,8 @@ static const Property aspeed_coprocessor_properties[] = {
                      TYPE_MEMORY_REGION, MemoryRegion *),
     DEFINE_PROP_LINK("sram", AspeedCoprocessorState, sram, TYPE_MEMORY_REGION,
                      MemoryRegion *),
+    DEFINE_PROP_LINK("scu", AspeedCoprocessorState, scu, TYPE_ASPEED_SCU,
+                     AspeedSCUState *),
 };
 
 static void aspeed_coprocessor_class_init(ObjectClass *oc, const void *data)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index d9a5f517d7..c1f2c549c3 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -19,9 +19,10 @@ struct AspeedCoprocessorState {
     MemoryRegion sdram;
     MemoryRegion *sram;
     MemoryRegion sram_alias;
+    MemoryRegion scu_alias;
     Clock *sysclk;
 
-    AspeedSCUState scu;
+    AspeedSCUState *scu;
     AspeedSCUState scuio;
     AspeedTimerCtrlState timerctrl;
     SerialMM uart[ASPEED_UARTS_NUM];
@@ -36,7 +37,6 @@ struct AspeedCoprocessorClass {
 
     /** valid_cpu_types: NULL terminated array of a single CPU type. */
     const char * const *valid_cpu_types;
-    uint32_t silicon_rev;
     const hwaddr *memmap;
     const int *irqmap;
     int uarts_base;

From 10e377246d37bc0bfeaed4d9a700975ae9bc5282 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:01 +0800
Subject: [PATCH 1511/2396] hw/arm/ast27x0: Share single UART set across PSP,
 SSP, and TSP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the original model, each subsystem (PSP, SSP, and TSP) created its own
set of 13 UART devices, resulting in a total of 39 UART instances. However,
on real AST2700 hardware, there is only one set of 13 UARTs shared among
all processors.

This commit reworks the UART handling to correctly model the shared
hardware design. The PSP now creates the full set of 13 UART instances,
while the SSP and TSP link to the corresponding shared UART device
through object properties.

Changes include:
- Add "DEFINE_PROP_LINK("uart", ...)" and "DEFINE_PROP_INT32("uart-dev", ...)"
  to allow each coprocessor to reference a specific shared UART instance.
- Modify SSP to link to PSP’s UART4, and TSP to link to PSP’s UART7.
- Introduce "uart_alias" to remap the UART’s MMIO region into the coprocessor’s
  memory space.
- Redirect the UART interrupt to the coprocessor’s NVIC, replacing the
  default routing to the PSP’s GIC.

With this change, only one set of 13 UART devices is instantiated by the PSP,
while the SSP and TSP reuse them via aliasing and shared interrupt routing,
matching the real AST2700 hardware behavior.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c          | 24 ++++++++++++------------
 hw/arm/aspeed_ast27x0-ssp.c         | 29 ++++++++++++-----------------
 hw/arm/aspeed_ast27x0-tsp.c         | 29 ++++++++++++-----------------
 hw/arm/aspeed_coprocessor_common.c  |  3 +++
 include/hw/arm/aspeed_coprocessor.h |  6 +++---
 5 files changed, 42 insertions(+), 49 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index ba43a46207..99af87dbd7 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -93,6 +93,10 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
                             AST2700FC_HW_STRAP2, &error_abort);
     aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART12, sc->uarts_base,
                             sc->uarts_num, serial_hd(0));
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART4, sc->uarts_base,
+                            sc->uarts_num, serial_hd(1));
+    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
+                            sc->uarts_num, serial_hd(2));
     if (!qdev_realize(DEVICE(&s->ca35), NULL, errp)) {
         return false;
     }
@@ -115,8 +119,6 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
 
 static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 {
-    AspeedCoprocessorState *soc;
-    AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *psp = ASPEED_SOC(&s->ca35);
 
@@ -132,10 +134,10 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
     object_property_set_link(OBJECT(&s->ssp), "memory",
                              OBJECT(&s->ssp_memory), &error_abort);
 
-    soc = ASPEED_COPROCESSOR(&s->ssp);
-    sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
-    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART4, sc->uarts_base,
-                            sc->uarts_num, serial_hd(1));
+    object_property_set_link(OBJECT(&s->ssp), "uart",
+                             OBJECT(&psp->uart[4]), &error_abort);
+    object_property_set_int(OBJECT(&s->ssp), "uart-dev", ASPEED_DEV_UART4,
+                            &error_abort);
     object_property_set_link(OBJECT(&s->ssp), "sram",
                              OBJECT(&psp->sram), &error_abort);
     object_property_set_link(OBJECT(&s->ssp), "scu",
@@ -149,8 +151,6 @@ static bool ast2700fc_ssp_init(MachineState *machine, Error **errp)
 
 static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
 {
-    AspeedCoprocessorState *soc;
-    AspeedCoprocessorClass *sc;
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *psp = ASPEED_SOC(&s->ca35);
 
@@ -166,10 +166,10 @@ static bool ast2700fc_tsp_init(MachineState *machine, Error **errp)
     object_property_set_link(OBJECT(&s->tsp), "memory",
                              OBJECT(&s->tsp_memory), &error_abort);
 
-    soc = ASPEED_COPROCESSOR(&s->tsp);
-    sc = ASPEED_COPROCESSOR_GET_CLASS(soc);
-    aspeed_soc_uart_set_chr(soc->uart, ASPEED_DEV_UART7, sc->uarts_base,
-                            sc->uarts_num, serial_hd(2));
+    object_property_set_link(OBJECT(&s->tsp), "uart",
+                             OBJECT(&psp->uart[7]), &error_abort);
+    object_property_set_int(OBJECT(&s->tsp), "uart-dev", ASPEED_DEV_UART7,
+                            &error_abort);
     object_property_set_link(OBJECT(&s->tsp), "sram",
                              OBJECT(&psp->sram), &error_abort);
     object_property_set_link(OBJECT(&s->tsp), "scu",
diff --git a/hw/arm/aspeed_ast27x0-ssp.c b/hw/arm/aspeed_ast27x0-ssp.c
index 577a3379c6..d12a9b8459 100644
--- a/hw/arm/aspeed_ast27x0-ssp.c
+++ b/hw/arm/aspeed_ast27x0-ssp.c
@@ -133,16 +133,10 @@ static void aspeed_soc_ast27x0ssp_init(Object *obj)
 {
     Aspeed27x0CoprocessorState *a = ASPEED27X0SSP_COPROCESSOR(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
-    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
-    int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 
-    for (i = 0; i < sc->uarts_num; i++) {
-        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
-    }
-
     object_initialize_child(obj, "intc0", &a->intc[0],
                             TYPE_ASPEED_2700SSP_INTC);
     object_initialize_child(obj, "intc1", &a->intc[1],
@@ -165,7 +159,6 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sdram_name = NULL;
-    int uart;
     int i;
 
     if (!clock_has_source(s->sysclk)) {
@@ -244,15 +237,19 @@ static void aspeed_soc_ast27x0ssp_realize(DeviceState *dev_soc, Error **errp)
         sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[1]), i,
                         qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
     }
+
     /* UART */
-    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
-        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
-                                     sc->memmap[uart], errp)) {
-            return;
-        }
-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_ast27x0ssp_get_irq(s, uart));
-    }
+    memory_region_init_alias(&s->uart_alias, OBJECT(s), "uart.alias",
+                             &s->uart->serial.io, 0,
+                             memory_region_size(&s->uart->serial.io));
+    memory_region_add_subregion(s->memory, sc->memmap[s->uart_dev],
+                                &s->uart_alias);
+    /*
+     * Redirect the UART interrupt to the NVIC, replacing the default routing
+     * to the PSP's GIC.
+     */
+    sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
+                       aspeed_soc_ast27x0ssp_get_irq(s, s->uart_dev));
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
                                   "aspeed.timerctrl",
@@ -283,8 +280,6 @@ static void aspeed_soc_ast27x0ssp_class_init(ObjectClass *klass,
     dc->realize = aspeed_soc_ast27x0ssp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
-    sc->uarts_num = 13;
-    sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0ssp_irqmap;
     sc->memmap = aspeed_soc_ast27x0ssp_memmap;
 }
diff --git a/hw/arm/aspeed_ast27x0-tsp.c b/hw/arm/aspeed_ast27x0-tsp.c
index a7c141678f..5b75e14206 100644
--- a/hw/arm/aspeed_ast27x0-tsp.c
+++ b/hw/arm/aspeed_ast27x0-tsp.c
@@ -133,16 +133,10 @@ static void aspeed_soc_ast27x0tsp_init(Object *obj)
 {
     Aspeed27x0CoprocessorState *a = ASPEED27X0TSP_COPROCESSOR(obj);
     AspeedCoprocessorState *s = ASPEED_COPROCESSOR(obj);
-    AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
-    int i;
 
     object_initialize_child(obj, "armv7m", &a->armv7m, TYPE_ARMV7M);
     s->sysclk = qdev_init_clock_in(DEVICE(s), "sysclk", NULL, NULL, 0);
 
-    for (i = 0; i < sc->uarts_num; i++) {
-        object_initialize_child(obj, "uart[*]", &s->uart[i], TYPE_SERIAL_MM);
-    }
-
     object_initialize_child(obj, "intc0", &a->intc[0],
                             TYPE_ASPEED_2700TSP_INTC);
     object_initialize_child(obj, "intc1", &a->intc[1],
@@ -165,7 +159,6 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
     AspeedCoprocessorClass *sc = ASPEED_COPROCESSOR_GET_CLASS(s);
     DeviceState *armv7m;
     g_autofree char *sdram_name = NULL;
-    int uart;
     int i;
 
     if (!clock_has_source(s->sysclk)) {
@@ -244,15 +237,19 @@ static void aspeed_soc_ast27x0tsp_realize(DeviceState *dev_soc, Error **errp)
         sysbus_connect_irq(SYS_BUS_DEVICE(&a->intc[1]), i,
                         qdev_get_gpio_in(DEVICE(&a->intc[0].orgates[0]), i));
     }
+
     /* UART */
-    for (i = 0, uart = sc->uarts_base; i < sc->uarts_num; i++, uart++) {
-        if (!aspeed_soc_uart_realize(s->memory, &s->uart[i],
-                                     sc->memmap[uart], errp)) {
-            return;
-        }
-        sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart[i]), 0,
-                           aspeed_soc_ast27x0tsp_get_irq(s, uart));
-    }
+    memory_region_init_alias(&s->uart_alias, OBJECT(s), "uart.alias",
+                             &s->uart->serial.io, 0,
+                             memory_region_size(&s->uart->serial.io));
+    memory_region_add_subregion(s->memory, sc->memmap[s->uart_dev],
+                                &s->uart_alias);
+    /*
+     * Redirect the UART interrupt to the NVIC, replacing the default routing
+     * to the PSP's GIC.
+     */
+    sysbus_connect_irq(SYS_BUS_DEVICE(s->uart), 0,
+                       aspeed_soc_ast27x0tsp_get_irq(s, s->uart_dev));
 
     aspeed_mmio_map_unimplemented(s->memory, SYS_BUS_DEVICE(&s->timerctrl),
                                   "aspeed.timerctrl",
@@ -283,8 +280,6 @@ static void aspeed_soc_ast27x0tsp_class_init(ObjectClass *klass,
     dc->realize = aspeed_soc_ast27x0tsp_realize;
 
     sc->valid_cpu_types = valid_cpu_types;
-    sc->uarts_num = 13;
-    sc->uarts_base = ASPEED_DEV_UART0;
     sc->irqmap = aspeed_soc_ast27x0tsp_irqmap;
     sc->memmap = aspeed_soc_ast27x0tsp_memmap;
 }
diff --git a/hw/arm/aspeed_coprocessor_common.c b/hw/arm/aspeed_coprocessor_common.c
index 14e26bbe23..f037d5b573 100644
--- a/hw/arm/aspeed_coprocessor_common.c
+++ b/hw/arm/aspeed_coprocessor_common.c
@@ -29,6 +29,9 @@ static const Property aspeed_coprocessor_properties[] = {
                      MemoryRegion *),
     DEFINE_PROP_LINK("scu", AspeedCoprocessorState, scu, TYPE_ASPEED_SCU,
                      AspeedSCUState *),
+    DEFINE_PROP_LINK("uart", AspeedCoprocessorState, uart, TYPE_SERIAL_MM,
+                     SerialMM *),
+    DEFINE_PROP_INT32("uart-dev", AspeedCoprocessorState, uart_dev, 0),
 };
 
 static void aspeed_coprocessor_class_init(ObjectClass *oc, const void *data)
diff --git a/include/hw/arm/aspeed_coprocessor.h b/include/hw/arm/aspeed_coprocessor.h
index c1f2c549c3..4a50f688ec 100644
--- a/include/hw/arm/aspeed_coprocessor.h
+++ b/include/hw/arm/aspeed_coprocessor.h
@@ -19,13 +19,15 @@ struct AspeedCoprocessorState {
     MemoryRegion sdram;
     MemoryRegion *sram;
     MemoryRegion sram_alias;
+    MemoryRegion uart_alias;
     MemoryRegion scu_alias;
     Clock *sysclk;
 
     AspeedSCUState *scu;
     AspeedSCUState scuio;
     AspeedTimerCtrlState timerctrl;
-    SerialMM uart[ASPEED_UARTS_NUM];
+    SerialMM *uart;
+    int uart_dev;
 };
 
 #define TYPE_ASPEED_COPROCESSOR "aspeed-coprocessor"
@@ -39,8 +41,6 @@ struct AspeedCoprocessorClass {
     const char * const *valid_cpu_types;
     const hwaddr *memmap;
     const int *irqmap;
-    int uarts_base;
-    int uarts_num;
 };
 
 struct Aspeed27x0CoprocessorState {

From 71c01f57879129bc62b7cb53cd0a13bd70d79582 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:02 +0800
Subject: [PATCH 1512/2396] hw/arm/aspeed_ast27x0-fc: Map FMC0 flash contents
 into CA35 boot ROM
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch introduces a dedicated ca35_boot_rom memory region and
copies the FMC0 flash data into it.

The motivation is to support the upcoming vbootrom. The vbootrom
replaces the existing BOOTMCU (RISC-V 32 SPL) flow, which currently reads
the "image-bmc" from FMC_CS0 and loads the following components
into DRAM:

- Trusted Firmware-A
- OP-TEE OS
- u-boot-nodtb.bin
- u-boot.dtb

After loading, BOOTMCU releases the CA35 reset so that CA35 can start
executing Trusted Firmware-A.

The vbootrom follows the same sequence: CA35 fetches "image-bmc" from FMC0
flash at the SPI boot ROM base address (0x100000000), parses the FIT image,
loads each component into its designated DRAM location, and then jumps to
Trusted Firmware-A.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 99af87dbd7..99c0b34159 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -35,6 +35,7 @@ struct Ast2700FCState {
 
     MemoryRegion ca35_memory;
     MemoryRegion ca35_dram;
+    MemoryRegion ca35_boot_rom;
     MemoryRegion ssp_memory;
     MemoryRegion tsp_memory;
 
@@ -44,8 +45,6 @@ struct Ast2700FCState {
     Aspeed27x0SoCState ca35;
     Aspeed27x0CoprocessorState ssp;
     Aspeed27x0CoprocessorState tsp;
-
-    bool mmio_exec;
 };
 
 #define AST2700FC_BMC_RAM_SIZE (1 * GiB)
@@ -61,6 +60,9 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *soc;
     AspeedSoCClass *sc;
+    BlockBackend *fmc0 = NULL;
+    DeviceState *dev = NULL;
+    uint64_t rom_size;
 
     object_initialize_child(OBJECT(s), "ca35", &s->ca35, "ast2700-a1");
     soc = ASPEED_SOC(&s->ca35);
@@ -112,6 +114,14 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
     ast2700fc_board_info.ram_size = machine->ram_size;
     ast2700fc_board_info.loader_start = sc->memmap[ASPEED_DEV_SDRAM];
 
+    dev = ssi_get_cs(soc->fmc.spi, 0);
+    fmc0 = dev ? m25p80_get_blk(dev) : NULL;
+
+    if (fmc0) {
+        rom_size = memory_region_size(&soc->spi_boot);
+        aspeed_install_boot_rom(soc, fmc0, &s->ca35_boot_rom, rom_size);
+    }
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
 
     return true;

From 02bf7686e87979325f7af6f3ab88766853b881ef Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:03 +0800
Subject: [PATCH 1513/2396] hw/arm/aspeed_ast27x0-fc: Add VBOOTROM support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Introduces support for loading a vbootrom image into the dedicated vbootrom
memory region in the AST2700 Full Core machine.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 99c0b34159..7be2e84927 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -60,6 +60,7 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
     Ast2700FCState *s = AST2700A1FC(machine);
     AspeedSoCState *soc;
     AspeedSoCClass *sc;
+    const char *bios_name = NULL;
     BlockBackend *fmc0 = NULL;
     DeviceState *dev = NULL;
     uint64_t rom_size;
@@ -122,6 +123,10 @@ static bool ast2700fc_ca35_init(MachineState *machine, Error **errp)
         aspeed_install_boot_rom(soc, fmc0, &s->ca35_boot_rom, rom_size);
     }
 
+    /* VBOOTROM */
+    bios_name = machine->firmware ?: VBOOTROM_FILE_NAME;
+    aspeed_load_vbootrom(soc, bios_name, errp);
+
     arm_load_kernel(ARM_CPU(first_cpu), machine, &ast2700fc_board_info);
 
     return true;

From 37acdd737a2696a9c2d8e165fb67e2e497b4e331 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:04 +0800
Subject: [PATCH 1514/2396] tests/functional/aarch64/ast2700fc: Update test
 ASPEED SDK v09.08
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700fc.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index 28b66614d9..bcce0c8d4e 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -36,9 +36,9 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
         exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
 
-    ASSET_SDK_V906_AST2700 = Asset(
-            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.06/ast2700-default-obmc.tar.gz',
-            'f1d53e0be8a404ecce3e105f72bc50fa4e090ad13160ffa91b10a6e0233a9dc6')
+    ASSET_SDK_V908_AST2700 = Asset(
+            'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
+            'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
 
     def do_ast2700_i2c_test(self):
         exec_command_and_wait_for_pattern(self,
@@ -66,7 +66,7 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.vm.set_console(console_index=1)
         self.vm.launch()
 
-        exec_command_and_wait_for_pattern(self, '\012', 'ssp:~$')
+        exec_command_and_wait_for_pattern(self, '\012', 'ssp_tsp:~$')
         exec_command_and_wait_for_pattern(self, 'version',
                                           'Zephyr version 3.7.1')
         exec_command_and_wait_for_pattern(self, 'md 72c02000 1',
@@ -133,10 +133,10 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
                 self.scratch_file(name, 'image-bmc'))
 
-    def test_aarch64_ast2700fc_sdk_v09_06(self):
+    def test_aarch64_ast2700fc_sdk_v09_08(self):
         self.set_machine('ast2700fc')
 
-        self.archive_extract(self.ASSET_SDK_V906_AST2700)
+        self.archive_extract(self.ASSET_SDK_V908_AST2700)
         self.start_ast2700fc_test('ast2700-default')
         self.verify_openbmc_boot_and_login('ast2700-default')
         self.do_ast2700_i2c_test()

From f001f5d95aeed29032029c3ab1dca7a50af922bc Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:05 +0800
Subject: [PATCH 1515/2396] tests/functional/aarch64/ast2700fc: Add eth2
 network interface check in PCIe test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Enhance the AST2700 functional PCIe test to verify the network interface
configuration for eth2. This adds an additional command to check the IP
address assignment on eth2 to ensure network functionality is correctly
initialized in the test environment.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700fc.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index bcce0c8d4e..843647e6c5 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -60,6 +60,9 @@ class AST2x00MachineSDK(QemuSystemTest):
             'lspci -s 0002:01:00.0',
             '0002:01:00.0 Ethernet controller: '
             'Intel Corporation 82574L Gigabit Network Connection')
+        exec_command_and_wait_for_pattern(self,
+            'ip addr show dev eth2',
+            'inet 10.0.2.15/24')
 
     def do_ast2700fc_ssp_test(self):
         self.vm.shutdown()
@@ -135,6 +138,7 @@ class AST2x00MachineSDK(QemuSystemTest):
 
     def test_aarch64_ast2700fc_sdk_v09_08(self):
         self.set_machine('ast2700fc')
+        self.require_netdev('user')
 
         self.archive_extract(self.ASSET_SDK_V908_AST2700)
         self.start_ast2700fc_test('ast2700-default')

From 7c77c48e824cd4a1e58b17b747bfb3e2e09a79a2 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:06 +0800
Subject: [PATCH 1516/2396] tests/functional/aarch64/ast2700fc: Move
 coprocessor image loading to common function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This removes duplicate code in start_ast2700fc_test() and prepares for reuse in
upcoming VBOOTROM tests.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 .../aarch64/test_aspeed_ast2700fc.py          | 22 ++++++++++---------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index 843647e6c5..9ab3d3269b 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -36,6 +36,17 @@ class AST2x00MachineSDK(QemuSystemTest):
         exec_command_and_wait_for_pattern(self, 'root', 'Password:')
         exec_command_and_wait_for_pattern(self, '0penBmc', f'root@{name}:~#')
 
+    def load_ast2700fc_coprocessor(self, name):
+        load_elf_list = {
+            'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
+            'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
+        }
+
+        for cpu_num, key in enumerate(load_elf_list, start=4):
+            file = load_elf_list[key]
+            self.vm.add_args('-device',
+                             f'loader,file={file},cpu-num={cpu_num}')
+
     ASSET_SDK_V908_AST2700 = Asset(
             'https://github.com/AspeedTech-BMC/openbmc/releases/download/v09.08/ast2700-default-obmc.tar.gz',
             'eac3dc409b7ea3cd4b03d4792d3cebd469792ad893cb51e1d15f0fc20bd1e2cd')
@@ -123,16 +134,7 @@ class AST2x00MachineSDK(QemuSystemTest):
             self.vm.add_args('-device',
                              f'loader,addr=0x430000000,cpu-num={i}')
 
-        load_elf_list = {
-            'ssp': self.scratch_file(name, 'zephyr-aspeed-ssp.elf'),
-            'tsp': self.scratch_file(name, 'zephyr-aspeed-tsp.elf')
-        }
-
-        for cpu_num, key in enumerate(load_elf_list, start=4):
-            file = load_elf_list[key]
-            self.vm.add_args('-device',
-                             f'loader,file={file},cpu-num={cpu_num}')
-
+        self.load_ast2700fc_coprocessor(name)
         self.do_test_aarch64_aspeed_sdk_start(
                 self.scratch_file(name, 'image-bmc'))
 

From d187d120d17c6b6de3b6432243dcc706ec144658 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Wed, 15 Oct 2025 14:22:07 +0800
Subject: [PATCH 1517/2396] tests/functional/aarch64/ast2700fc: Add vbootrom
 test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add start_ast2700fc_test_vbootrom() which boots the ast2700fc machine
with -bios ast27x0_bootrom.bin and reuses the coprocessor loader.

Add test_aarch64_ast2700fc_sdk_vbootrom_v09_08() to test the vbootrom
with ast2700fc machine.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015062210.3128710-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/functional/aarch64/test_aspeed_ast2700fc.py | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/tests/functional/aarch64/test_aspeed_ast2700fc.py b/tests/functional/aarch64/test_aspeed_ast2700fc.py
index 9ab3d3269b..8dbc8f234f 100755
--- a/tests/functional/aarch64/test_aspeed_ast2700fc.py
+++ b/tests/functional/aarch64/test_aspeed_ast2700fc.py
@@ -138,6 +138,12 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_test_aarch64_aspeed_sdk_start(
                 self.scratch_file(name, 'image-bmc'))
 
+    def start_ast2700fc_test_vbootrom(self, name):
+        self.vm.add_args('-bios', 'ast27x0_bootrom.bin')
+        self.load_ast2700fc_coprocessor(name)
+        self.do_test_aarch64_aspeed_sdk_start(
+                self.scratch_file(name, 'image-bmc'))
+
     def test_aarch64_ast2700fc_sdk_v09_08(self):
         self.set_machine('ast2700fc')
         self.require_netdev('user')
@@ -150,5 +156,14 @@ class AST2x00MachineSDK(QemuSystemTest):
         self.do_ast2700fc_ssp_test()
         self.do_ast2700fc_tsp_test()
 
+    def test_aarch64_ast2700fc_sdk_vbootrom_v09_08(self):
+        self.set_machine('ast2700fc')
+
+        self.archive_extract(self.ASSET_SDK_V908_AST2700)
+        self.start_ast2700fc_test_vbootrom('ast2700-default')
+        self.verify_openbmc_boot_and_login('ast2700-default')
+        self.do_ast2700fc_ssp_test()
+        self.do_ast2700fc_tsp_test()
+
 if __name__ == '__main__':
     QemuSystemTest.main()

From 42fa4bd01a90baea260833d565922fec5d28f768 Mon Sep 17 00:00:00 2001
From: Felix Wu <flwu@google.com>
Date: Wed, 15 Oct 2025 01:18:25 +0000
Subject: [PATCH 1518/2396] hw/gpio: Add property for ASPEED GPIO in 32 bits
 basis
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Added 32 bits property for ASPEED GPIO. Previously it can only be
access in bitwise manner.

The changes to qobject is to index gpios with array indices on top of
accessing with registers.  This allows for easier gpio access,
especially in tests with complex behaviors that requires large number
of gpios at a time, like fault injection and networking behaviors.

Indexing multiple gpios at once allows qmp/side band client to no
longer hardcode and populate register names and manipulate them
faster.

Signed-off-by: Felix Wu <flwu@google.com>
Reviewed-by: Andrew Jeffery <andrew@codeconstruct.com.au>
Link: https://lore.kernel.org/qemu-devel/20251015011830.1688468-2-lixiaoyan@google.com
[ clg: wrapped commit log lines ]
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/gpio/aspeed_gpio.c | 57 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index 609a556908..2d78bf9515 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -1308,6 +1308,57 @@ static void aspeed_gpio_2700_write(void *opaque, hwaddr offset,
 }
 
 /* Setup functions */
+static void aspeed_gpio_set_set(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
+{
+    uint32_t set_val = 0;
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int set_idx = 0;
+
+    if (!visit_type_uint32(v, name, &set_val, errp)) {
+        return;
+    }
+
+    if (sscanf(name, "gpio-set[%d]", &set_idx) != 1) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+
+    if (set_idx >= agc->nr_gpio_sets || set_idx < 0) {
+        error_setg(errp, "%s: invalid set_idx %s", __func__, name);
+        return;
+    }
+
+    aspeed_gpio_update(s, &s->sets[set_idx], set_val,
+                       ~s->sets[set_idx].direction);
+}
+
+static void aspeed_gpio_get_set(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
+{
+    uint32_t set_val = 0;
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int set_idx = 0;
+
+    if (sscanf(name, "gpio-set[%d]", &set_idx) != 1) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+
+    if (set_idx >= agc->nr_gpio_sets || set_idx < 0) {
+        error_setg(errp, "%s: invalid set_idx %s", __func__, name);
+        return;
+    }
+
+    set_val = s->sets[set_idx].data_value;
+    visit_type_uint32(v, name, &set_val, errp);
+}
+
+/****************** Setup functions ******************/
 static const GPIOSetProperties ast2400_set_props[ASPEED_GPIO_MAX_NR_SETS] = {
     [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
     [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
@@ -1435,6 +1486,12 @@ static void aspeed_gpio_init(Object *obj)
             g_free(name);
         }
     }
+
+    for (int i = 0; i < agc->nr_gpio_sets; i++) {
+        char *name = g_strdup_printf("gpio-set[%d]", i);
+        object_property_add(obj, name, "uint32", aspeed_gpio_get_set,
+        aspeed_gpio_set_set, NULL, NULL);
+    }
 }
 
 static const VMStateDescription vmstate_gpio_regs = {

From 1306584925d1e5d8c4a7699a9f3fa125a10e4996 Mon Sep 17 00:00:00 2001
From: Felix Wu <flwu@google.com>
Date: Wed, 15 Oct 2025 01:18:26 +0000
Subject: [PATCH 1519/2396] tests/qtest: Add qtest for for ASPEED GPIO gpio-set
 property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

 - Added qtests to test gpio-set property for ASPEED.
 - Added function to get uint in qdict.

Signed-off-by: Felix Wu <flwu@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251015011830.1688468-3-lixiaoyan@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 include/qobject/qdict.h        |   1 +
 qobject/qdict.c                |  13 ++++
 tests/qtest/aspeed_gpio-test.c | 105 ++++++++++++++++++++++++++++++---
 3 files changed, 110 insertions(+), 9 deletions(-)

diff --git a/include/qobject/qdict.h b/include/qobject/qdict.h
index 903e6e5462..861996f08d 100644
--- a/include/qobject/qdict.h
+++ b/include/qobject/qdict.h
@@ -57,6 +57,7 @@ void qdict_put_str(QDict *qdict, const char *key, const char *value);
 
 double qdict_get_double(const QDict *qdict, const char *key);
 int64_t qdict_get_int(const QDict *qdict, const char *key);
+uint64_t qdict_get_uint(const QDict *qdict, const char *key);
 bool qdict_get_bool(const QDict *qdict, const char *key);
 QList *qdict_get_qlist(const QDict *qdict, const char *key);
 QDict *qdict_get_qdict(const QDict *qdict, const char *key);
diff --git a/qobject/qdict.c b/qobject/qdict.c
index a90ac9ae2f..0dafe6d421 100644
--- a/qobject/qdict.c
+++ b/qobject/qdict.c
@@ -209,6 +209,19 @@ int64_t qdict_get_int(const QDict *qdict, const char *key)
     return qnum_get_int(qobject_to(QNum, qdict_get(qdict, key)));
 }
 
+/**
+ * qdict_get_uint(): Get an unsigned integer mapped by 'key'
+ *
+ * This function assumes that 'key' exists and it stores a
+ * QNum representable as uint.
+ *
+ * Return unsigned integer mapped by 'key'.
+ */
+uint64_t qdict_get_uint(const QDict *qdict, const char *key)
+{
+    return qnum_get_uint(qobject_to(QNum, qdict_get(qdict, key)));
+}
+
 /**
  * qdict_get_bool(): Get a bool mapped by 'key'
  *
diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
index 12675d4cbb..c2f9ca2298 100644
--- a/tests/qtest/aspeed_gpio-test.c
+++ b/tests/qtest/aspeed_gpio-test.c
@@ -27,28 +27,115 @@
 #include "qemu/timer.h"
 #include "qobject/qdict.h"
 #include "libqtest-single.h"
+#include "qemu/typedefs.h"
 
 #define AST2600_GPIO_BASE 0x1E780000
 
 #define GPIO_ABCD_DATA_VALUE 0x000
 #define GPIO_ABCD_DIRECTION  0x004
 
+static uint32_t qtest_qom_get_uint32(QTestState *s, const char *path,
+                                     const char *property)
+{
+    QDict *r;
+
+    uint32_t res;
+    r = qtest_qmp(s, "{ 'execute': 'qom-get', 'arguments': "
+                     "{ 'path': %s, 'property': %s } }", path, property);
+    res = qdict_get_uint(r, "return");
+    qobject_unref(r);
+
+    return res;
+}
+
+static void qtest_qom_set_uint32(QTestState *s, const char *path,
+                                 const char *property, uint32_t value)
+{
+    QDict *r;
+
+    r = qtest_qmp(s, "{ 'execute': 'qom-set', 'arguments': "
+                     "{ 'path': %s, 'property': %s, 'value': %" PRIu32 " } }",
+                     path, property, value);
+    qobject_unref(r);
+}
+
+static const char *resp_get_error(QDict *r, const char* error_key)
+{
+    QDict *qdict;
+
+    g_assert(r);
+
+    qdict = qdict_get_qdict(r, "error");
+    if (qdict) {
+        return qdict_get_str(qdict, error_key);
+    }
+
+    return NULL;
+}
+
+static bool qtest_qom_check_error(QTestState *s, const char *path,
+                                  const char *property, const char *error_msg,
+                                  const char *error_msg_key)
+{
+    QDict *r;
+    bool b;
+
+    r = qtest_qmp(s, "{ 'execute': 'qom-get', 'arguments': "
+                     "{ 'path': %s, 'property': %s } }", path, property);
+    b = g_str_equal(resp_get_error(r, error_msg_key), error_msg);
+    qobject_unref(r);
+
+    return b;
+}
+
 static void test_set_colocated_pins(const void *data)
 {
     QTestState *s = (QTestState *)data;
-
+    const char path[] = "/machine/soc/gpio";
     /*
      * gpioV4-7 occupy bits within a single 32-bit value, so we want to make
      * sure that modifying one doesn't affect the other.
      */
-    qtest_qom_set_bool(s, "/machine/soc/gpio", "gpioV4", true);
-    qtest_qom_set_bool(s, "/machine/soc/gpio", "gpioV5", false);
-    qtest_qom_set_bool(s, "/machine/soc/gpio", "gpioV6", true);
-    qtest_qom_set_bool(s, "/machine/soc/gpio", "gpioV7", false);
-    g_assert(qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV4"));
-    g_assert(!qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV5"));
-    g_assert(qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV6"));
-    g_assert(!qtest_qom_get_bool(s, "/machine/soc/gpio", "gpioV7"));
+    qtest_qom_set_bool(s, path, "gpioV4", true);
+    qtest_qom_set_bool(s, path, "gpioV5", false);
+    qtest_qom_set_bool(s, path, "gpioV6", true);
+    qtest_qom_set_bool(s, path, "gpioV7", false);
+    g_assert(qtest_qom_get_bool(s, path, "gpioV4"));
+    g_assert(!qtest_qom_get_bool(s, path, "gpioV5"));
+    g_assert(qtest_qom_get_bool(s, path, "gpioV6"));
+    g_assert(!qtest_qom_get_bool(s, path, "gpioV7"));
+
+    /*
+     * Testing the gpio-set[%d] properties, using individual gpio boolean
+     * properties to do cross check.
+     * We use gpioR4-7 for test, Setting them to be 0b1010.
+     */
+    qtest_qom_set_uint32(s, path, "gpio-set[4]", 0x0);
+    g_assert(qtest_qom_get_uint32(s, path, "gpio-set[4]") == 0x0);
+    qtest_qom_set_uint32(s, path, "gpio-set[4]", 0xa000);
+    g_assert(qtest_qom_get_uint32(s, path, "gpio-set[4]") == 0xa000);
+
+    g_assert(!qtest_qom_get_bool(s, path, "gpioR4"));
+    g_assert(qtest_qom_get_bool(s, path, "gpioR5"));
+    g_assert(!qtest_qom_get_bool(s, path, "gpioR6"));
+    g_assert(qtest_qom_get_bool(s, path, "gpioR7"));
+
+    /*
+     * Testing the invalid indexing, the response info should contain following
+     * info:
+     * {key: "class", value: "GenericError"}
+     *
+     * For pins, it should follow "gpio%2[A-Z]%1d" or "gpio%3[18A-E]%1d" format.
+     */
+    const char error_msg[] = "GenericError";
+    const char error_msg_key[] = "class";
+
+    g_assert(qtest_qom_check_error(s, path, "gpioR+1", error_msg,
+                                   error_msg_key));
+    g_assert(qtest_qom_check_error(s, path, "gpio-set[99]", error_msg,
+                                   error_msg_key));
+    g_assert(qtest_qom_check_error(s, path, "gpio-set[-3]", error_msg,
+                                   error_msg_key));
 }
 
 static void test_set_input_pins(const void *data)

From fa42484ee1553aa8a8b97aa933315f7e0b9dba2d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Thu, 16 Oct 2025 23:24:37 +0200
Subject: [PATCH 1520/2396] hw/arm/aspeed: ast2600-evb: Use w25q512jv flash
 model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The ast2600-evb machine model is using the "mx66u51235f" flash model,
which has issues with recent Linux kernels (6.15+) when reading SFDP
data.

Change the flash model to "w25q512jv", which is the model present on
some ast2600a3 EVB board and is known to work correctly with recent
kernels. Adjust the corresponding qtest to reflect the new JEDEC ID of
the w25q512jv flash.

Reviewed-by: Jamin Lin <jamin_lin@aspeedtech.com>
Link: https://lore.kernel.org/qemu-devel/20251016212437.1046135-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c               | 4 ++--
 tests/qtest/aspeed_smc-test.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 21ee62f750..1bc9e534ba 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1592,8 +1592,8 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
     amc->soc_name  = "ast2600-a3";
     amc->hw_strap1 = AST2600_EVB_HW_STRAP1;
     amc->hw_strap2 = AST2600_EVB_HW_STRAP2;
-    amc->fmc_model = "mx66u51235f";
-    amc->spi_model = "mx66u51235f";
+    amc->fmc_model = "w25q512jv";
+    amc->spi_model = "w25q512jv";
     amc->num_cs    = 1;
     amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON |
                      ASPEED_MAC3_ON;
diff --git a/tests/qtest/aspeed_smc-test.c b/tests/qtest/aspeed_smc-test.c
index 52a00e6f0a..50a87e6250 100644
--- a/tests/qtest/aspeed_smc-test.c
+++ b/tests/qtest/aspeed_smc-test.c
@@ -134,10 +134,10 @@ static void test_ast2600_evb(AspeedSMCTestData *data)
                           "-drive file=%s,format=raw,if=mtd",
                           data->tmp_path);
 
-    /* fmc cs0 with mx66u51235f flash */
+    /* fmc cs0 with w25q512jv flash */
     data->flash_base = 0x20000000;
     data->spi_base = 0x1E620000;
-    data->jedec_id = 0xc2253a;
+    data->jedec_id = 0xef4020;
     data->cs = 0;
     data->node = "/machine/soc/fmc/ssi.0/child[0]";
     /* beyond 16MB */

From d7bd42a740d0e8887540d7b450d0bdb2d6ba31ea Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 13:04:27 +0200
Subject: [PATCH 1521/2396] hw/arm/aspeed: Remove ast2700fc self-aliasing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove pointless alias to the very same machine:

  $ qemu-system-aarch64 -M help | fgrep ast2700fc
  ast2700fc            ast2700 full core support (alias of ast2700fc)
  ast2700fc            ast2700 full core support

Fixes: a74faf35efc ("hw/arm: Introduce ASPEED AST2700 A1 full core machine")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251021110427.93991-1-philmd@linaro.org
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0-fc.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 7be2e84927..580ac5f7a1 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -207,7 +207,6 @@ static void ast2700fc_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->alias = "ast2700fc";
     mc->desc = "ast2700 full core support";
     mc->init = ast2700fc_init;
     mc->no_floppy = 1;

From 0305ee82754aba1f312fb1fc6ad613219f697db7 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sun, 19 Oct 2025 23:03:03 +0200
Subject: [PATCH 1522/2396] tests/qtest/ds1338: Reuse from_bcd()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

from_bcd() is a public API function which can be unit-tested. Reuse it to avoid
code duplication.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251019210303.104718-11-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 tests/qtest/ds1338-test.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/tests/qtest/ds1338-test.c b/tests/qtest/ds1338-test.c
index d12424d27f..b8d0e65ec4 100644
--- a/tests/qtest/ds1338-test.c
+++ b/tests/qtest/ds1338-test.c
@@ -18,16 +18,12 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bcd.h"
 #include "libqtest.h"
 #include "libqos/i2c.h"
 
 #define DS1338_ADDR 0x68
 
-static inline uint8_t bcd2bin(uint8_t x)
-{
-    return ((x) & 0x0f) + ((x) >> 4) * 10;
-}
-
 static void send_and_receive(void *obj, void *data, QGuestAllocator *alloc)
 {
     QI2CDevice *i2cdev = (QI2CDevice *)obj;
@@ -39,9 +35,9 @@ static void send_and_receive(void *obj, void *data, QGuestAllocator *alloc)
     i2c_read_block(i2cdev, 0, resp, sizeof(resp));
 
     /* check retrieved time against local time */
-    g_assert_cmpuint(bcd2bin(resp[4]), == , tm_ptr->tm_mday);
-    g_assert_cmpuint(bcd2bin(resp[5]), == , 1 + tm_ptr->tm_mon);
-    g_assert_cmpuint(2000 + bcd2bin(resp[6]), == , 1900 + tm_ptr->tm_year);
+    g_assert_cmpuint(from_bcd(resp[4]), == , tm_ptr->tm_mday);
+    g_assert_cmpuint(from_bcd(resp[5]), == , 1 + tm_ptr->tm_mon);
+    g_assert_cmpuint(2000 + from_bcd(resp[6]), == , 1900 + tm_ptr->tm_year);
 }
 
 static void ds1338_register_nodes(void)

From 047b721c60f592bdd6abbc69ed2f63316e061fe8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:32 +0400
Subject: [PATCH 1523/2396] hw/audio: improve error reports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The -audiodev argument is 'model=..', use same terminology.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-2-marcandre.lureau@redhat.com>
[PMD: Fixed checkpatch.pl issues]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/soundhw.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/hw/audio/soundhw.c b/hw/audio/soundhw.c
index d18fd9fa05..2a41e108c0 100644
--- a/hw/audio/soundhw.c
+++ b/hw/audio/soundhw.c
@@ -70,13 +70,13 @@ void show_valid_soundhw(void)
     struct soundhw *c;
 
     if (soundhw_count) {
-         printf("Valid sound card names (comma separated):\n");
-         for (c = soundhw; c->name; ++c) {
-             printf ("%-11s %s\n", c->name, c->descr);
-         }
+        printf("Valid audio device model names:\n");
+        for (c = soundhw; c->name; ++c) {
+            printf("%-11s %s\n", c->name, c->descr);
+        }
     } else {
-         printf("Machine has no user-selectable audio hardware "
-                "(it may or may not have always-present audio hardware).\n");
+        printf("Machine has no user-selectable audio hardware "
+               "(it may or may not have always-present audio hardware).\n");
     }
 }
 
@@ -88,7 +88,7 @@ void select_soundhw(const char *name, const char *audiodev)
     struct soundhw *c;
 
     if (selected) {
-        error_report("only one -soundhw option is allowed");
+        error_report("only one -audio option is allowed");
         exit(1);
     }
 
@@ -101,7 +101,7 @@ void select_soundhw(const char *name, const char *audiodev)
     }
 
     if (!c->name) {
-        error_report("Unknown sound card name `%s'", name);
+        error_report("Unknown audio device model `%s'", name);
         show_valid_soundhw();
         exit(1);
     }
@@ -140,4 +140,3 @@ void soundhw_init(void)
         c->init_pci(pci_bus, audiodev_id);
     }
 }
-

From 74d3a119ef642477a548360476c6b566a0fe6744 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:33 +0400
Subject: [PATCH 1524/2396] hw/audio: rename model list function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-3-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/soundhw.c         | 4 ++--
 include/hw/audio/soundhw.h | 2 +-
 system/vl.c                | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/audio/soundhw.c b/hw/audio/soundhw.c
index 2a41e108c0..63a6855635 100644
--- a/hw/audio/soundhw.c
+++ b/hw/audio/soundhw.c
@@ -65,7 +65,7 @@ void deprecated_register_soundhw(const char *name, const char *descr,
     soundhw_count++;
 }
 
-void show_valid_soundhw(void)
+void audio_print_available_models(void)
 {
     struct soundhw *c;
 
@@ -102,7 +102,7 @@ void select_soundhw(const char *name, const char *audiodev)
 
     if (!c->name) {
         error_report("Unknown audio device model `%s'", name);
-        show_valid_soundhw();
+        audio_print_available_models();
         exit(1);
     }
 }
diff --git a/include/hw/audio/soundhw.h b/include/hw/audio/soundhw.h
index 474c5ff94e..83b3011083 100644
--- a/include/hw/audio/soundhw.h
+++ b/include/hw/audio/soundhw.h
@@ -7,7 +7,7 @@ void deprecated_register_soundhw(const char *name, const char *descr,
                                  int isa, const char *typename);
 
 void soundhw_init(void);
-void show_valid_soundhw(void);
+void audio_print_available_models(void);
 void select_soundhw(const char *name, const char *audiodev);
 
 #endif
diff --git a/system/vl.c b/system/vl.c
index fd98ea52d9..17bbc092c8 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -3078,7 +3078,7 @@ void qemu_init(int argc, char **argv)
                     model = g_strdup(qdict_get_str(dict, "model"));
                     qdict_del(dict, "model");
                     if (is_help_option(model)) {
-                        show_valid_soundhw();
+                        audio_print_available_models();
                         exit(0);
                     }
                 }

From 0347f9e0e1caaaf6fb6e7f53b5f90ced6a6ec5e1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:34 +0400
Subject: [PATCH 1525/2396] hw/audio: remove global pcspk
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is no longer used since commit 6033b9ecd4 ("pc: remove -soundhw pcspk")

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-4-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/pcspk.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index f8020593b0..610a5b2162 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -61,7 +61,6 @@ struct PCSpkState {
 };
 
 static const char *s_spk = "pcspk";
-static PCSpkState *pcspk_state;
 
 static inline void generate_samples(PCSpkState *s)
 {
@@ -200,8 +199,6 @@ static void pcspk_realizefn(DeviceState *dev, Error **errp)
     if (s->card.state && AUD_register_card(s_spk, &s->card, errp)) {
         pcspk_audio_init(s);
     }
-
-    pcspk_state = s;
 }
 
 static bool migrate_needed(void *opaque)
@@ -237,7 +234,6 @@ static void pcspk_class_initfn(ObjectClass *klass, const void *data)
     set_bit(DEVICE_CATEGORY_SOUND, dc->categories);
     dc->vmsd = &vmstate_spk;
     device_class_set_props(dc, pcspk_properties);
-    /* Reason: realize sets global pcspk_state */
     /* Reason: pit object link */
     dc->user_creatable = false;
 }

From 0c35f5bf86813f085e8a5053a90ebac0bc33e3ca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:35 +0400
Subject: [PATCH 1526/2396] hw/pcspk: use explicitly the required PIT types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-5-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/pcspk.c         | 2 +-
 hw/timer/i8254_common.c  | 6 ++----
 include/hw/timer/i8254.h | 4 ++--
 3 files changed, 5 insertions(+), 7 deletions(-)

diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 610a5b2162..9cf78ff55f 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -51,7 +51,7 @@ struct PCSpkState {
     uint8_t sample_buf[PCSPK_BUF_LEN];
     QEMUSoundCard card;
     SWVoiceOut *voice;
-    void *pit;
+    PITCommonState *pit;
     unsigned int pit_count;
     unsigned int samples;
     unsigned int play_pos;
diff --git a/hw/timer/i8254_common.c b/hw/timer/i8254_common.c
index ad091594cd..419d4cd6e5 100644
--- a/hw/timer/i8254_common.c
+++ b/hw/timer/i8254_common.c
@@ -32,9 +32,8 @@
 #include "migration/vmstate.h"
 
 /* val must be 0 or 1 */
-void pit_set_gate(ISADevice *dev, int channel, int val)
+void pit_set_gate(PITCommonState *pit, int channel, int val)
 {
-    PITCommonState *pit = PIT_COMMON(dev);
     PITChannelState *s = &pit->channels[channel];
     PITCommonClass *c = PIT_COMMON_GET_CLASS(pit);
 
@@ -139,9 +138,8 @@ void pit_get_channel_info_common(PITCommonState *s, PITChannelState *sc,
     info->out = pit_get_out(sc, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
 }
 
-void pit_get_channel_info(ISADevice *dev, int channel, PITChannelInfo *info)
+void pit_get_channel_info(PITCommonState *pit, int channel, PITChannelInfo *info)
 {
-    PITCommonState *pit = PIT_COMMON(dev);
     PITChannelState *s = &pit->channels[channel];
     PITCommonClass *c = PIT_COMMON_GET_CLASS(pit);
 
diff --git a/include/hw/timer/i8254.h b/include/hw/timer/i8254.h
index 8402caad30..f7148d9286 100644
--- a/include/hw/timer/i8254.h
+++ b/include/hw/timer/i8254.h
@@ -75,7 +75,7 @@ static inline ISADevice *kvm_pit_init(ISABus *bus, int base)
     return d;
 }
 
-void pit_set_gate(ISADevice *dev, int channel, int val);
-void pit_get_channel_info(ISADevice *dev, int channel, PITChannelInfo *info);
+void pit_set_gate(PITCommonState *pit, int channel, int val);
+void pit_get_channel_info(PITCommonState *pit, int channel, PITChannelInfo *info);
 
 #endif /* HW_I8254_H */

From 64a013e18bbd02c26a7ca2b2c4c1a14d77058749 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:36 +0400
Subject: [PATCH 1527/2396] hw/pcspk: make 'pit' a class property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This should be functionally equivalent. (for some reason, the device
property was convert to an object instance property in commit 873b4d3f0571)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251021090317.425409-6-marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/pcspk.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 9cf78ff55f..7b716c08ef 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -182,11 +182,6 @@ static void pcspk_initfn(Object *obj)
     PCSpkState *s = PC_SPEAKER(obj);
 
     memory_region_init_io(&s->ioport, OBJECT(s), &pcspk_io_ops, s, "pcspk", 1);
-
-    object_property_add_link(obj, "pit", TYPE_PIT_COMMON,
-                             (Object **)&s->pit,
-                             qdev_prop_allow_set_link_before_realize,
-                             0);
 }
 
 static void pcspk_realizefn(DeviceState *dev, Error **errp)
@@ -224,6 +219,7 @@ static const Property pcspk_properties[] = {
     DEFINE_AUDIO_PROPERTIES(PCSpkState, card),
     DEFINE_PROP_UINT32("iobase", PCSpkState, iobase,  0x61),
     DEFINE_PROP_BOOL("migrate", PCSpkState, migrate,  true),
+    DEFINE_PROP_LINK("pit", PCSpkState, pit, TYPE_PIT_COMMON, PITCommonState *),
 };
 
 static void pcspk_class_initfn(ObjectClass *klass, const void *data)

From 840c2c4ed9645fe729321a53d76c5abd3fecc67b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:37 +0400
Subject: [PATCH 1528/2396] hw/pcspk: check the "pit" is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't let the user create a "isa-pcspk" via -device yet (in theory,
we could, and fallback on a lookup PIT), but we can add some safety
checks that the property was correctly set nonetheless.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-7-marcandre.lureau@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/pcspk.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 7b716c08ef..54fcf632e6 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -189,6 +189,11 @@ static void pcspk_realizefn(DeviceState *dev, Error **errp)
     ISADevice *isadev = ISA_DEVICE(dev);
     PCSpkState *s = PC_SPEAKER(dev);
 
+    if (!s->pit) {
+        error_setg(errp, "pcspk: No \"pit\" set or available");
+        return;
+    }
+
     isa_register_ioport(isadev, &s->ioport, s->iobase);
 
     if (s->card.state && AUD_register_card(s_spk, &s->card, errp)) {

From 55634cdf115f31ec26b66d622e6ea50354805b16 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:03:02 +0400
Subject: [PATCH 1529/2396] hw/audio: replace AUD_log() usage
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AUD_log() is just printf(stderr, "prefix: "..), we can use
error_report() or warn_report() appropriately instead.

Ideally it should be converted to traces, but there are many places to
convert, this is left for another day.

Avoid bit-rot by using conditionals.

The patch could be splitted if necessary.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021090317.425409-32-marcandre.lureau@redhat.com>
[PMD: Fixed checkpatch.pl issues]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/ac97.c    | 124 +++++++++++++++++++++++----------------------
 hw/audio/adlib.c   |  24 ++++-----
 hw/audio/cs4231a.c |  44 ++++++++--------
 hw/audio/es1370.c  |  24 ++++-----
 hw/audio/gus.c     |  25 ++++-----
 hw/audio/pcspk.c   |   2 +-
 hw/audio/sb16.c    | 115 +++++++++++++++++++++--------------------
 7 files changed, 180 insertions(+), 178 deletions(-)

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index eb7a847080..828333b66a 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -26,6 +26,7 @@
 #include "qemu/module.h"
 #include "system/dma.h"
 #include "qom/object.h"
+#include "qemu/error-report.h"
 #include "ac97.h"
 
 #define SOFT_VOLUME
@@ -141,11 +142,12 @@ enum {
     BUP_LAST = 2
 };
 
-#ifdef DEBUG_AC97
-#define dolog(...) AUD_log("ac97", __VA_ARGS__)
-#else
-#define dolog(...)
-#endif
+#define DEBUG_AC97 0
+#define dolog(fmt, ...) do { \
+        if (DEBUG_AC97) { \
+            error_report("ac97: " fmt, ##__VA_ARGS__); \
+        } \
+    } while (0)
 
 #define MKREGS(prefix, start)                   \
 enum {                                          \
@@ -190,7 +192,7 @@ static void fetch_bd(AC97LinkState *s, AC97BusMasterRegs *r)
     r->bd.addr = le32_to_cpu(*(uint32_t *) &b[0]) & ~3;
     r->bd.ctl_len = le32_to_cpu(*(uint32_t *) &b[4]);
     r->picb = r->bd.ctl_len & 0xffff;
-    dolog("bd %2d addr=0x%x ctl=0x%06x len=0x%x(%d bytes)\n",
+    dolog("bd %2d addr=0x%x ctl=0x%06x len=0x%x(%d bytes)",
           r->civ, r->bd.addr, r->bd.ctl_len >> 16,
           r->bd.ctl_len & 0xffff, (r->bd.ctl_len & 0xffff) << 1);
 }
@@ -222,7 +224,7 @@ static void update_sr(AC97LinkState *s, AC97BusMasterRegs *r, uint32_t new_sr)
 
     r->sr = new_sr;
 
-    dolog("IOC%d LVB%d sr=0x%x event=%d level=%d\n",
+    dolog("IOC%d LVB%d sr=0x%x event=%d level=%d",
           r->sr & SR_BCIS, r->sr & SR_LVBCI, r->sr, event, level);
 
     if (!event) {
@@ -231,11 +233,11 @@ static void update_sr(AC97LinkState *s, AC97BusMasterRegs *r, uint32_t new_sr)
 
     if (level) {
         s->glob_sta |= masks[r - s->bm_regs];
-        dolog("set irq level=1\n");
+        dolog("set irq level=1");
         pci_irq_assert(&s->dev);
     } else {
         s->glob_sta &= ~masks[r - s->bm_regs];
-        dolog("set irq level=0\n");
+        dolog("set irq level=0");
         pci_irq_deassert(&s->dev);
     }
 }
@@ -256,14 +258,14 @@ static void voice_set_active(AC97LinkState *s, int bm_index, int on)
         break;
 
     default:
-        AUD_log("ac97", "invalid bm_index(%d) in voice_set_active", bm_index);
+        error_report("ac97: invalid bm_index(%d) in voice_set_active", bm_index);
         break;
     }
 }
 
 static void reset_bm_regs(AC97LinkState *s, AC97BusMasterRegs *r)
 {
-    dolog("reset_bm_regs\n");
+    dolog("reset_bm_regs");
     r->bdbar = 0;
     r->civ = 0;
     r->lvi = 0;
@@ -281,7 +283,7 @@ static void reset_bm_regs(AC97LinkState *s, AC97BusMasterRegs *r)
 static void mixer_store(AC97LinkState *s, uint32_t i, uint16_t v)
 {
     if (i + 2 > sizeof(s->mixer_data)) {
-        dolog("mixer_store: index %d out of bounds %zd\n",
+        dolog("mixer_store: index %d out of bounds %zd",
               i, sizeof(s->mixer_data));
         return;
     }
@@ -295,7 +297,7 @@ static uint16_t mixer_load(AC97LinkState *s, uint32_t i)
     uint16_t val = 0xffff;
 
     if (i + 2 > sizeof(s->mixer_data)) {
-        dolog("mixer_load: index %d out of bounds %zd\n",
+        dolog("mixer_load: index %d out of bounds %zd",
               i, sizeof(s->mixer_data));
     } else {
         val = s->mixer_data[i + 0] | (s->mixer_data[i + 1] << 8);
@@ -460,7 +462,7 @@ static void mixer_reset(AC97LinkState *s)
 {
     uint8_t active[LAST_INDEX];
 
-    dolog("mixer_reset\n");
+    dolog("mixer_reset");
     memset(s->mixer_data, 0, sizeof(s->mixer_data));
     memset(active, 0, sizeof(active));
     mixer_store(s, AC97_Reset, 0x0000); /* 6940 */
@@ -508,7 +510,7 @@ static void mixer_reset(AC97LinkState *s)
 static uint32_t nam_readb(void *opaque, uint32_t addr)
 {
     AC97LinkState *s = opaque;
-    dolog("U nam readb 0x%x\n", addr);
+    dolog("U nam readb 0x%x", addr);
     s->cas = 0;
     return ~0U;
 }
@@ -523,7 +525,7 @@ static uint32_t nam_readw(void *opaque, uint32_t addr)
 static uint32_t nam_readl(void *opaque, uint32_t addr)
 {
     AC97LinkState *s = opaque;
-    dolog("U nam readl 0x%x\n", addr);
+    dolog("U nam readl 0x%x", addr);
     s->cas = 0;
     return ~0U;
 }
@@ -535,7 +537,7 @@ static uint32_t nam_readl(void *opaque, uint32_t addr)
 static void nam_writeb(void *opaque, uint32_t addr, uint32_t val)
 {
     AC97LinkState *s = opaque;
-    dolog("U nam writeb 0x%x <- 0x%x\n", addr, val);
+    dolog("U nam writeb 0x%x <- 0x%x", addr, val);
     s->cas = 0;
 }
 
@@ -563,10 +565,10 @@ static void nam_writew(void *opaque, uint32_t addr, uint32_t val)
         break;
     case AC97_Vendor_ID1:
     case AC97_Vendor_ID2:
-        dolog("Attempt to write vendor ID to 0x%x\n", val);
+        dolog("Attempt to write vendor ID to 0x%x", val);
         break;
     case AC97_Extended_Audio_ID:
-        dolog("Attempt to write extended audio ID to 0x%x\n", val);
+        dolog("Attempt to write extended audio ID to 0x%x", val);
         break;
     case AC97_Extended_Audio_Ctrl_Stat:
         if (!(val & EACS_VRA)) {
@@ -579,36 +581,36 @@ static void nam_writew(void *opaque, uint32_t addr, uint32_t val)
             mixer_store(s, AC97_MIC_ADC_Rate, 0xbb80);
             open_voice(s, MC_INDEX, 48000);
         }
-        dolog("Setting extended audio control to 0x%x\n", val);
+        dolog("Setting extended audio control to 0x%x", val);
         mixer_store(s, AC97_Extended_Audio_Ctrl_Stat, val);
         break;
     case AC97_PCM_Front_DAC_Rate:
         if (mixer_load(s, AC97_Extended_Audio_Ctrl_Stat) & EACS_VRA) {
             mixer_store(s, addr, val);
-            dolog("Set front DAC rate to %d\n", val);
+            dolog("Set front DAC rate to %d", val);
             open_voice(s, PO_INDEX, val);
         } else {
-            dolog("Attempt to set front DAC rate to %d, but VRA is not set\n",
+            dolog("Attempt to set front DAC rate to %d, but VRA is not set",
                   val);
         }
         break;
     case AC97_MIC_ADC_Rate:
         if (mixer_load(s, AC97_Extended_Audio_Ctrl_Stat) & EACS_VRM) {
             mixer_store(s, addr, val);
-            dolog("Set MIC ADC rate to %d\n", val);
+            dolog("Set MIC ADC rate to %d", val);
             open_voice(s, MC_INDEX, val);
         } else {
-            dolog("Attempt to set MIC ADC rate to %d, but VRM is not set\n",
+            dolog("Attempt to set MIC ADC rate to %d, but VRM is not set",
                   val);
         }
         break;
     case AC97_PCM_LR_ADC_Rate:
         if (mixer_load(s, AC97_Extended_Audio_Ctrl_Stat) & EACS_VRA) {
             mixer_store(s, addr, val);
-            dolog("Set front LR ADC rate to %d\n", val);
+            dolog("Set front LR ADC rate to %d", val);
             open_voice(s, PI_INDEX, val);
         } else {
-            dolog("Attempt to set LR ADC rate to %d, but VRA is not set\n",
+            dolog("Attempt to set LR ADC rate to %d, but VRA is not set",
                   val);
         }
         break;
@@ -630,7 +632,7 @@ static void nam_writew(void *opaque, uint32_t addr, uint32_t val)
         /* None of the features in these regs are emulated, so they are RO */
         break;
     default:
-        dolog("U nam writew 0x%x <- 0x%x\n", addr, val);
+        dolog("U nam writew 0x%x <- 0x%x", addr, val);
         mixer_store(s, addr, val);
         break;
     }
@@ -639,7 +641,7 @@ static void nam_writew(void *opaque, uint32_t addr, uint32_t val)
 static void nam_writel(void *opaque, uint32_t addr, uint32_t val)
 {
     AC97LinkState *s = opaque;
-    dolog("U nam writel 0x%x <- 0x%x\n", addr, val);
+    dolog("U nam writel 0x%x <- 0x%x", addr, val);
     s->cas = 0;
 }
 
@@ -655,7 +657,7 @@ static uint32_t nabm_readb(void *opaque, uint32_t addr)
 
     switch (addr) {
     case CAS:
-        dolog("CAS %d\n", s->cas);
+        dolog("CAS %d", s->cas);
         val = s->cas;
         s->cas = 1;
         break;
@@ -664,38 +666,38 @@ static uint32_t nabm_readb(void *opaque, uint32_t addr)
     case MC_CIV:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->civ;
-        dolog("CIV[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("CIV[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_LVI:
     case PO_LVI:
     case MC_LVI:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->lvi;
-        dolog("LVI[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("LVI[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_PIV:
     case PO_PIV:
     case MC_PIV:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->piv;
-        dolog("PIV[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("PIV[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_CR:
     case PO_CR:
     case MC_CR:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->cr;
-        dolog("CR[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("CR[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_SR:
     case PO_SR:
     case MC_SR:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->sr & 0xff;
-        dolog("SRb[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("SRb[%d] -> 0x%x", GET_BM(addr), val);
         break;
     default:
-        dolog("U nabm readb 0x%x -> 0x%x\n", addr, val);
+        dolog("U nabm readb 0x%x -> 0x%x", addr, val);
         break;
     }
     return val;
@@ -713,17 +715,17 @@ static uint32_t nabm_readw(void *opaque, uint32_t addr)
     case MC_SR:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->sr;
-        dolog("SR[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("SR[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_PICB:
     case PO_PICB:
     case MC_PICB:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->picb;
-        dolog("PICB[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("PICB[%d] -> 0x%x", GET_BM(addr), val);
         break;
     default:
-        dolog("U nabm readw 0x%x -> 0x%x\n", addr, val);
+        dolog("U nabm readw 0x%x -> 0x%x", addr, val);
         break;
     }
     return val;
@@ -741,14 +743,14 @@ static uint32_t nabm_readl(void *opaque, uint32_t addr)
     case MC_BDBAR:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->bdbar;
-        dolog("BMADDR[%d] -> 0x%x\n", GET_BM(addr), val);
+        dolog("BMADDR[%d] -> 0x%x", GET_BM(addr), val);
         break;
     case PI_CIV:
     case PO_CIV:
     case MC_CIV:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->civ | (r->lvi << 8) | (r->sr << 16);
-        dolog("CIV LVI SR[%d] -> 0x%x, 0x%x, 0x%x\n", GET_BM(addr),
+        dolog("CIV LVI SR[%d] -> 0x%x, 0x%x, 0x%x", GET_BM(addr),
                r->civ, r->lvi, r->sr);
         break;
     case PI_PICB:
@@ -756,19 +758,19 @@ static uint32_t nabm_readl(void *opaque, uint32_t addr)
     case MC_PICB:
         r = &s->bm_regs[GET_BM(addr)];
         val = r->picb | (r->piv << 16) | (r->cr << 24);
-        dolog("PICB PIV CR[%d] -> 0x%x 0x%x 0x%x 0x%x\n", GET_BM(addr),
+        dolog("PICB PIV CR[%d] -> 0x%x 0x%x 0x%x 0x%x", GET_BM(addr),
                val, r->picb, r->piv, r->cr);
         break;
     case GLOB_CNT:
         val = s->glob_cnt;
-        dolog("glob_cnt -> 0x%x\n", val);
+        dolog("glob_cnt -> 0x%x", val);
         break;
     case GLOB_STA:
         val = s->glob_sta | GS_S0CR;
-        dolog("glob_sta -> 0x%x\n", val);
+        dolog("glob_sta -> 0x%x", val);
         break;
     default:
-        dolog("U nabm readl 0x%x -> 0x%x\n", addr, val);
+        dolog("U nabm readl 0x%x -> 0x%x", addr, val);
         break;
     }
     return val;
@@ -795,7 +797,7 @@ static void nabm_writeb(void *opaque, uint32_t addr, uint32_t val)
             fetch_bd(s, r);
         }
         r->lvi = val % 32;
-        dolog("LVI[%d] <- 0x%x\n", GET_BM(addr), val);
+        dolog("LVI[%d] <- 0x%x", GET_BM(addr), val);
         break;
     case PI_CR:
     case PO_CR:
@@ -816,7 +818,7 @@ static void nabm_writeb(void *opaque, uint32_t addr, uint32_t val)
                 voice_set_active(s, r - s->bm_regs, 1);
             }
         }
-        dolog("CR[%d] <- 0x%x (cr 0x%x)\n", GET_BM(addr), val, r->cr);
+        dolog("CR[%d] <- 0x%x (cr 0x%x)", GET_BM(addr), val, r->cr);
         break;
     case PI_SR:
     case PO_SR:
@@ -824,10 +826,10 @@ static void nabm_writeb(void *opaque, uint32_t addr, uint32_t val)
         r = &s->bm_regs[GET_BM(addr)];
         r->sr |= val & ~(SR_RO_MASK | SR_WCLEAR_MASK);
         update_sr(s, r, r->sr & ~(val & SR_WCLEAR_MASK));
-        dolog("SR[%d] <- 0x%x (sr 0x%x)\n", GET_BM(addr), val, r->sr);
+        dolog("SR[%d] <- 0x%x (sr 0x%x)", GET_BM(addr), val, r->sr);
         break;
     default:
-        dolog("U nabm writeb 0x%x <- 0x%x\n", addr, val);
+        dolog("U nabm writeb 0x%x <- 0x%x", addr, val);
         break;
     }
 }
@@ -844,10 +846,10 @@ static void nabm_writew(void *opaque, uint32_t addr, uint32_t val)
         r = &s->bm_regs[GET_BM(addr)];
         r->sr |= val & ~(SR_RO_MASK | SR_WCLEAR_MASK);
         update_sr(s, r, r->sr & ~(val & SR_WCLEAR_MASK));
-        dolog("SR[%d] <- 0x%x (sr 0x%x)\n", GET_BM(addr), val, r->sr);
+        dolog("SR[%d] <- 0x%x (sr 0x%x)", GET_BM(addr), val, r->sr);
         break;
     default:
-        dolog("U nabm writew 0x%x <- 0x%x\n", addr, val);
+        dolog("U nabm writew 0x%x <- 0x%x", addr, val);
         break;
     }
 }
@@ -863,22 +865,22 @@ static void nabm_writel(void *opaque, uint32_t addr, uint32_t val)
     case MC_BDBAR:
         r = &s->bm_regs[GET_BM(addr)];
         r->bdbar = val & ~3;
-        dolog("BDBAR[%d] <- 0x%x (bdbar 0x%x)\n", GET_BM(addr), val, r->bdbar);
+        dolog("BDBAR[%d] <- 0x%x (bdbar 0x%x)", GET_BM(addr), val, r->bdbar);
         break;
     case GLOB_CNT:
         /* TODO: Handle WR or CR being set (warm/cold reset requests) */
         if (!(val & (GC_WR | GC_CR))) {
             s->glob_cnt = val & GC_VALID_MASK;
         }
-        dolog("glob_cnt <- 0x%x (glob_cnt 0x%x)\n", val, s->glob_cnt);
+        dolog("glob_cnt <- 0x%x (glob_cnt 0x%x)", val, s->glob_cnt);
         break;
     case GLOB_STA:
         s->glob_sta &= ~(val & GS_WCLEAR_MASK);
         s->glob_sta |= (val & ~(GS_WCLEAR_MASK | GS_RO_MASK)) & GS_VALID_MASK;
-        dolog("glob_sta <- 0x%x (glob_sta 0x%x)\n", val, s->glob_sta);
+        dolog("glob_sta <- 0x%x (glob_sta 0x%x)", val, s->glob_sta);
         break;
     default:
-        dolog("U nabm writel 0x%x <- 0x%x\n", addr, val);
+        dolog("U nabm writel 0x%x <- 0x%x", addr, val);
         break;
     }
 }
@@ -903,7 +905,7 @@ static int write_audio(AC97LinkState *s, AC97BusMasterRegs *r,
         to_copy = MIN(temp, sizeof(tmpbuf));
         pci_dma_read(&s->dev, addr, tmpbuf, to_copy);
         copied = AUD_write(s->voice_po, tmpbuf, to_copy);
-        dolog("write_audio max=%x to_copy=%x copied=%x\n",
+        dolog("write_audio max=%x to_copy=%x copied=%x",
               max, to_copy, copied);
         if (!copied) {
             *stop = 1;
@@ -916,7 +918,7 @@ static int write_audio(AC97LinkState *s, AC97BusMasterRegs *r,
 
     if (!temp) {
         if (to_copy < 4) {
-            dolog("whoops\n");
+            dolog("whoops");
             s->last_samp = 0;
         } else {
             s->last_samp = *(uint32_t *)&tmpbuf[to_copy - 4];
@@ -929,7 +931,7 @@ static int write_audio(AC97LinkState *s, AC97BusMasterRegs *r,
 
 static void write_bup(AC97LinkState *s, int elapsed)
 {
-    dolog("write_bup\n");
+    dolog("write_bup");
     if (!(s->bup_flag & BUP_SET)) {
         if (s->bup_flag & BUP_LAST) {
             int i;
@@ -997,7 +999,7 @@ static void transfer_audio(AC97LinkState *s, int index, int elapsed)
     int stop = 0;
 
     if (s->invalid_freq[index]) {
-        AUD_log("ac97", "attempt to use voice %d with invalid frequency %d\n",
+        error_report("ac97: attempt to use voice %d with invalid frequency %d",
                 index, s->invalid_freq[index]);
         return;
     }
@@ -1017,12 +1019,12 @@ static void transfer_audio(AC97LinkState *s, int index, int elapsed)
         int temp;
 
         if (!r->bd_valid) {
-            dolog("invalid bd\n");
+            dolog("invalid bd");
             fetch_bd(s, r);
         }
 
         if (!r->picb) {
-            dolog("fresh bd %d is empty 0x%x 0x%x\n",
+            dolog("fresh bd %d is empty 0x%x 0x%x",
                   r->civ, r->bd.addr, r->bd.ctl_len);
             if (r->civ == r->lvi) {
                 r->sr |= SR_DCH; /* CELV? */
@@ -1059,7 +1061,7 @@ static void transfer_audio(AC97LinkState *s, int index, int elapsed)
             }
 
             if (r->civ == r->lvi) {
-                dolog("Underrun civ (%d) == lvi (%d)\n", r->civ, r->lvi);
+                dolog("Underrun civ (%d) == lvi (%d)", r->civ, r->lvi);
 
                 new_sr |= SR_LVBCI | SR_DCH | SR_CELV;
                 stop = 1;
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 1f29a7e319..772435f04c 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -29,24 +29,24 @@
 #include "audio/audio.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
+#include "qemu/error-report.h"
 #include "qom/object.h"
 
-//#define DEBUG
+#define DEBUG 0
 
 #define ADLIB_KILL_TIMERS 1
 
 #define ADLIB_DESC "Yamaha YM3812 (OPL2)"
 
-#ifdef DEBUG
+#if DEBUG
 #include "qemu/timer.h"
 #endif
 
-#define dolog(...) AUD_log ("adlib", __VA_ARGS__)
-#ifdef DEBUG
-#define ldebug(...) dolog (__VA_ARGS__)
-#else
-#define ldebug(...)
-#endif
+#define ldebug(fmt, ...) do { \
+        if (DEBUG) { \
+            error_report("adlib: " fmt, ##__VA_ARGS__); \
+        } \
+    } while (0)
 
 #include "fmopl.h"
 #define SHIFT 1
@@ -64,7 +64,7 @@ struct AdlibState {
     int enabled;
     int active;
     int bufpos;
-#ifdef DEBUG
+#if DEBUG
     int64_t exp[2];
 #endif
     int16_t *mixbuf;
@@ -92,7 +92,7 @@ static void adlib_kill_timers (AdlibState *s)
 
             delta = AUD_get_elapsed_usec_out (s->voice, &s->ats);
             ldebug (
-                "delta = %f dexp = %f expired => %d\n",
+                "delta = %f dexp = %f expired => %d",
                 delta / 1000000.0,
                 s->dexp[i] / 1000000.0,
                 delta >= s->dexp[i]
@@ -131,7 +131,7 @@ static void timer_handler (void *opaque, int c, double interval_Sec)
 {
     AdlibState *s = opaque;
     unsigned n = c & 1;
-#ifdef DEBUG
+#if DEBUG
     double interval;
     int64_t exp;
 #endif
@@ -142,7 +142,7 @@ static void timer_handler (void *opaque, int c, double interval_Sec)
     }
 
     s->ticking[n] = 1;
-#ifdef DEBUG
+#if DEBUG
     interval = NANOSECONDS_PER_SECOND * interval_Sec;
     exp = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + interval;
     s->exp[n] = exp;
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 6dfff202ff..7931fcfec8 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -30,7 +30,7 @@
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
-#include "qemu/timer.h"
+#include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qom/object.h"
 
@@ -43,21 +43,21 @@
   More...
 */
 
-/* #define DEBUG */
+#define DEBUG 0
 /* #define DEBUG_XLAW */
 
 static struct {
     int aci_counter;
 } conf = {1};
 
-#ifdef DEBUG
-#define dolog(...) AUD_log ("cs4231a", __VA_ARGS__)
-#else
-#define dolog(...)
-#endif
+#define dolog(fmt, ...) do { \
+        if (DEBUG) { \
+            error_report("cs4231a: " fmt, ##__VA_ARGS__); \
+        } \
+    } while (0)
 
-#define lwarn(...) AUD_log ("cs4231a", "warning: " __VA_ARGS__)
-#define lerr(...) AUD_log ("cs4231a", "error: " __VA_ARGS__)
+#define lwarn(fmt, ...) warn_report("cs4231a: " fmt, ##__VA_ARGS__)
+#define lerr(fmt, ...) error_report("cs4231a: " fmt, ##__VA_ARGS__)
 
 #define CS_REGS 16
 #define CS_DREGS 32
@@ -284,7 +284,7 @@ static void cs_reset_voices (CSState *s, uint32_t val)
     as.freq = freqs[xtal][(val >> 1) & 7];
 
     if (as.freq == -1) {
-        lerr ("unsupported frequency (val=%#x)\n", val);
+        lerr("unsupported frequency (val=0x%x)", val);
         goto error;
     }
 
@@ -319,11 +319,11 @@ static void cs_reset_voices (CSState *s, uint32_t val)
 
     case 7:
     case 4:
-        lerr ("attempt to use reserved format value (%#x)\n", val);
+        lerr("attempt to use reserved format value (0x%x)", val);
         goto error;
 
     case 5:
-        lerr ("ADPCM 4 bit IMA compatible format is not supported\n");
+        lerr("ADPCM 4 bit IMA compatible format is not supported");
         goto error;
     }
 
@@ -393,7 +393,7 @@ static uint64_t cs_read (void *opaque, hwaddr addr, unsigned size)
         ret = s->regs[saddr];
         break;
     }
-    dolog ("read %d:%d -> %d\n", saddr, iaddr, ret);
+    dolog("read %d:%d -> %d", saddr, iaddr, ret);
     return ret;
 }
 
@@ -425,7 +425,7 @@ static void cs_write (void *opaque, hwaddr addr,
         case RESERVED:
         case RESERVED_2:
         case RESERVED_3:
-            lwarn ("attempt to write %#x to reserved indirect register %d\n",
+            lwarn("attempt to write 0x%x to reserved indirect register %d",
                    val, iaddr);
             break;
 
@@ -439,7 +439,7 @@ static void cs_write (void *opaque, hwaddr addr,
                     cs_reset_voices (s, val);
                 }
                 else {
-                    lwarn ("[P]MCE(%#x, %#x) is not set, val=%#x\n",
+                    lwarn("[P]MCE(0x%x, 0x%x) is not set, val=0x%x",
                            s->regs[Index_Address],
                            s->dregs[Alternate_Feature_Status],
                            val);
@@ -453,7 +453,7 @@ static void cs_write (void *opaque, hwaddr addr,
             val &= ~(1 << 5);   /* D5 is reserved */
             s->dregs[iaddr] = val;
             if (val & PPIO) {
-                lwarn ("PIO is not supported (%#x)\n", val);
+                lwarn("PIO is not supported (0x%x)", val);
                 break;
             }
             if (val & PEN) {
@@ -472,11 +472,11 @@ static void cs_write (void *opaque, hwaddr addr,
             break;
 
         case Error_Status_And_Initialization:
-            lwarn ("attempt to write to read only register %d\n", iaddr);
+            lwarn("attempt to write to read only register %d", iaddr);
             break;
 
         case MODE_And_ID:
-            dolog ("val=%#x\n", val);
+            dolog("val=0x%x", val);
             if (val & MODE2)
                 s->dregs[iaddr] |= MODE2;
             else
@@ -485,7 +485,7 @@ static void cs_write (void *opaque, hwaddr addr,
 
         case Alternate_Feature_Enable_I:
             if (val & TE)
-                lerr ("timer is not yet supported\n");
+                lerr("timer is not yet supported");
             s->dregs[iaddr] = val;
             break;
 
@@ -499,7 +499,7 @@ static void cs_write (void *opaque, hwaddr addr,
             break;
 
         case Version_Chip_ID:
-            lwarn ("write to Version_Chip_ID register %#x\n", val);
+            lwarn("write to Version_Chip_ID register 0x%x", val);
             s->dregs[iaddr] = val;
             break;
 
@@ -507,7 +507,7 @@ static void cs_write (void *opaque, hwaddr addr,
             s->dregs[iaddr] = val;
             break;
         }
-        dolog ("written value %#x to indirect register %d\n", val, iaddr);
+        dolog("written value 0x%x to indirect register %d", val, iaddr);
         break;
 
     case Status:
@@ -519,7 +519,7 @@ static void cs_write (void *opaque, hwaddr addr,
         break;
 
     case PIO_Data:
-        lwarn ("attempt to write value %#x to PIO register\n", val);
+        lwarn("attempt to write value 0x%x to PIO register", val);
         break;
     }
 }
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index a6a32a6348..6b0da0746e 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -32,7 +32,7 @@
 #include "migration/vmstate.h"
 #include "qemu/cutils.h"
 #include "qemu/module.h"
-#include "system/dma.h"
+#include "qemu/error-report.h"
 #include "qom/object.h"
 #include "trace.h"
 
@@ -190,7 +190,7 @@ static void print_ctl(uint32_t val)
         a(CDC_EN);
         a(SERR_DIS);
 #undef a
-        AUD_log("es1370", "ctl - PCLKDIV %d(DAC2 freq %d), freq %d,%s\n",
+        error_report("es1370: ctl - PCLKDIV %d(DAC2 freq %d), freq %d,%s",
                 (val & CTRL_PCLKDIV) >> CTRL_SH_PCLKDIV,
                 DAC2_DIVTOSR((val & CTRL_PCLKDIV) >> CTRL_SH_PCLKDIV),
                 dac1_samplerate[(val & CTRL_WTSRSEL) >> CTRL_SH_WTSRSEL],
@@ -226,7 +226,7 @@ static void print_sctl(uint32_t val)
         }
 #undef b
 #undef a
-        AUD_log("es1370",
+        error_report("es1370: "
                 "%s p2_end_inc %d, p2_st_inc %d,"
                 " r1_fmt %s, p2_fmt %s, p1_fmt %s\n",
                 buf,
@@ -238,10 +238,10 @@ static void print_sctl(uint32_t val)
     }
 }
 
-#define lwarn(...) \
+#define lwarn(fmt, ...) \
 do { \
     if (VERBOSE_ES1370) { \
-        AUD_log("es1370: warning", __VA_ARGS__); \
+        error_report("es1370: " fmt, ##__VA_ARGS__); \
     } \
 } while (0)
 
@@ -502,10 +502,10 @@ static void es1370_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
         break;
 
     case ES1370_REG_PHANTOM_FRAMECNT:
-        lwarn("writing to phantom frame count 0x%" PRIx64 "\n", val);
+        lwarn("writing to phantom frame count 0x%" PRIx64, val);
         break;
     case ES1370_REG_PHANTOM_FRAMEADR:
-        lwarn("writing to phantom frame address 0x%" PRIx64 "\n", val);
+        lwarn("writing to phantom frame address 0x%" PRIx64, val);
         break;
 
     case ES1370_REG_ADC_FRAMECNT:
@@ -522,7 +522,7 @@ static void es1370_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
         break;
 
     default:
-        lwarn("writel 0x%" PRIx64 " <- 0x%" PRIx64 "\n", addr, val);
+        lwarn("writel 0x%" PRIx64 " <- 0x%" PRIx64, addr, val);
         break;
     }
 }
@@ -586,16 +586,16 @@ static uint64_t es1370_read(void *opaque, hwaddr addr, unsigned size)
 
     case ES1370_REG_PHANTOM_FRAMECNT:
         val = ~0U;
-        lwarn("reading from phantom frame count\n");
+        lwarn("reading from phantom frame count");
         break;
     case ES1370_REG_PHANTOM_FRAMEADR:
         val = ~0U;
-        lwarn("reading from phantom frame address\n");
+        lwarn("reading from phantom frame address");
         break;
 
     default:
         val = ~0U;
-        lwarn("readl 0x%" PRIx64 " -> 0x%x\n", addr, val);
+        lwarn("readl 0x%" PRIx64 " -> 0x%x", addr, val);
         break;
     }
     return val;
@@ -677,7 +677,7 @@ static void es1370_transfer_audio (ES1370State *s, struct chan *d, int loop_sel,
          * when the sample count reaches zero) or 1 for stop mode (set
          * interrupt and stop recording).
          */
-        AUD_log ("es1370: warning", "non looping mode\n");
+        warn_report("es1370: non looping mode");
     } else {
         d->frame_cnt = size;
 
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index c36df0240f..91d07e0f81 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -32,15 +32,16 @@
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "gusemu.h"
-#include "gustate.h"
+#include "qemu/error-report.h"
 #include "qom/object.h"
 
-#define dolog(...) AUD_log ("audio", __VA_ARGS__)
-#ifdef DEBUG
-#define ldebug(...) dolog (__VA_ARGS__)
-#else
-#define ldebug(...)
-#endif
+#define DEBUG 0
+
+#define ldebug(fmt, ...) do { \
+        if (DEBUG) { \
+            error_report("gus: " fmt, ##__VA_ARGS__); \
+        } \
+    } while (0)
 
 #define TYPE_GUS "gus"
 OBJECT_DECLARE_SIMPLE_TYPE(GUSState, GUS)
@@ -154,14 +155,14 @@ int GUS_irqrequest (GUSEmuState *emu, int hwirq, int n)
     /* qemu_irq_lower (s->pic); */
     qemu_irq_raise (s->pic);
     s->irqs += n;
-    ldebug ("irqrequest %d %d %d\n", hwirq, n, s->irqs);
+    ldebug("irqrequest %d %d %d", hwirq, n, s->irqs);
     return n;
 }
 
 void GUS_irqclear (GUSEmuState *emu, int hwirq)
 {
     GUSState *s = emu->opaque;
-    ldebug ("irqclear %d %d\n", hwirq, s->irqs);
+    ldebug("irqclear %d %d", hwirq, s->irqs);
     qemu_irq_lower (s->pic);
     s->irqs -= 1;
 #ifdef IRQ_STORM
@@ -175,7 +176,7 @@ void GUS_dmarequest (GUSEmuState *emu)
 {
     GUSState *s = emu->opaque;
     IsaDmaClass *k = ISADMA_GET_CLASS(s->isa_dma);
-    ldebug ("dma request %d\n", der->gusdma);
+    ldebug("dma request %d", s->emu.gusdma);
     k->hold_DREQ(s->isa_dma, s->emu.gusdma);
 }
 
@@ -186,13 +187,13 @@ static int GUS_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
     QEMU_UNINITIALIZED char tmpbuf[4096];
     int pos = dma_pos, mode, left = dma_len - dma_pos;
 
-    ldebug ("read DMA %#x %d\n", dma_pos, dma_len);
+    ldebug("read DMA 0x%x %d", dma_pos, dma_len);
     mode = k->has_autoinitialization(s->isa_dma, s->emu.gusdma);
     while (left) {
         int to_copy = MIN ((size_t) left, sizeof (tmpbuf));
         int copied;
 
-        ldebug ("left=%d to_copy=%d pos=%d\n", left, to_copy, pos);
+        ldebug("left=%d to_copy=%d pos=%d", left, to_copy, pos);
         copied = k->read_memory(s->isa_dma, nchan, tmpbuf, pos, to_copy);
         gus_dma_transferdata (&s->emu, tmpbuf, copied, left == copied);
         left -= copied;
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 54fcf632e6..a719912872 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -125,7 +125,7 @@ static int pcspk_audio_init(PCSpkState *s)
 
     s->voice = AUD_open_out(&s->card, s->voice, s_spk, s, pcspk_callback, &as);
     if (!s->voice) {
-        AUD_log(s_spk, "Could not open voice\n");
+        error_report("pcspk: Could not open voice");
         return -1;
     }
 
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index bac64118fe..03c82f2777 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -30,22 +30,21 @@
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
 #include "qemu/timer.h"
+#include "qemu/error-report.h"
 #include "qemu/host-utils.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
 #include "qom/object.h"
 
-#define dolog(...) AUD_log ("sb16", __VA_ARGS__)
-
-/* #define DEBUG */
+#define DEBUG 0
 /* #define DEBUG_SB16_MOST */
 
-#ifdef DEBUG
-#define ldebug(...) dolog (__VA_ARGS__)
-#else
-#define ldebug(...)
-#endif
+#define ldebug(fmt, ...) do { \
+        if (DEBUG) { \
+            error_report("sb16: " fmt, ##__VA_ARGS__); \
+        } \
+    } while (0)
 
 static const char e3[] = "COPYRIGHT (C) CREATIVE TECHNOLOGY LTD, 1992.";
 
@@ -157,7 +156,7 @@ static int irq_of_magic (int magic)
 #if 0
 static void log_dsp (SB16State *dsp)
 {
-    ldebug ("%s:%s:%d:%s:dmasize=%d:freq=%d:const=%d:speaker=%d\n",
+    ldebug("%s:%s:%d:%s:dmasize=%d:freq=%d:const=%d:speaker=%d",
             dsp->fmt_stereo ? "Stereo" : "Mono",
             dsp->fmt_signed ? "Signed" : "Unsigned",
             dsp->fmt_bits,
@@ -182,7 +181,7 @@ static void control (SB16State *s, int hold)
     IsaDmaClass *k = ISADMA_GET_CLASS(isa_dma);
     s->dma_running = hold;
 
-    ldebug ("hold %d high %d dma %d\n", hold, s->use_hdma, dma);
+    ldebug("hold %d high %d dma %d", hold, s->use_hdma, dma);
 
     if (hold) {
         k->hold_DREQ(isa_dma, dma);
@@ -289,8 +288,8 @@ static void dma_cmd8 (SB16State *s, int mask, int dma_len)
                       " alignment %d\n", s->block_size, s->align + 1);
     }
 
-    ldebug ("freq %d, stereo %d, sign %d, bits %d, "
-            "dma %d, auto %d, fifo %d, high %d\n",
+    ldebug("freq %d, stereo %d, sign %d, bits %d, "
+            "dma %d, auto %d, fifo %d, high %d",
             s->freq, s->fmt_stereo, s->fmt_signed, s->fmt_bits,
             s->block_size, s->dma_auto, s->fifo, s->highspeed);
 
@@ -337,8 +336,8 @@ static void dma_cmd (SB16State *s, uint8_t cmd, uint8_t d0, int dma_len)
         s->block_size <<= s->fmt_stereo;
     }
 
-    ldebug ("freq %d, stereo %d, sign %d, bits %d, "
-            "dma %d, auto %d, fifo %d, high %d\n",
+    ldebug("freq %d, stereo %d, sign %d, bits %d, "
+            "dma %d, auto %d, fifo %d, high %d",
             s->freq, s->fmt_stereo, s->fmt_signed, s->fmt_bits,
             s->block_size, s->dma_auto, s->fifo, s->highspeed);
 
@@ -395,7 +394,7 @@ static void dma_cmd (SB16State *s, uint8_t cmd, uint8_t d0, int dma_len)
 
 static inline void dsp_out_data (SB16State *s, uint8_t val)
 {
-    ldebug ("outdata %#x\n", val);
+    ldebug("outdata 0x%x", val);
     if ((size_t) s->out_data_len < sizeof (s->out_data)) {
         s->out_data[s->out_data_len++] = val;
     }
@@ -407,18 +406,18 @@ static inline uint8_t dsp_get_data (SB16State *s)
         return s->in2_data[--s->in_index];
     }
     else {
-        dolog ("buffer underflow\n");
+        warn_report("sb16: buffer underflow");
         return 0;
     }
 }
 
 static void command (SB16State *s, uint8_t cmd)
 {
-    ldebug ("command %#x\n", cmd);
+    ldebug("command 0x%x", cmd);
 
     if (cmd > 0xaf && cmd < 0xd0) {
         if (cmd & 8) {
-            qemu_log_mask(LOG_UNIMP, "ADC not yet supported (command %#x)\n",
+            qemu_log_mask(LOG_UNIMP, "ADC not yet supported (command 0x%x)\n",
                           cmd);
         }
 
@@ -427,7 +426,7 @@ static void command (SB16State *s, uint8_t cmd)
         case 12:
             break;
         default:
-            qemu_log_mask(LOG_GUEST_ERROR, "%#x wrong bits\n", cmd);
+            qemu_log_mask(LOG_GUEST_ERROR, "0x%x wrong bits\n", cmd);
         }
         s->needed_bytes = 3;
     }
@@ -645,13 +644,13 @@ static void command (SB16State *s, uint8_t cmd)
             goto warn;
 
         default:
-            qemu_log_mask(LOG_UNIMP, "Unrecognized command %#x\n", cmd);
+            qemu_log_mask(LOG_UNIMP, "Unrecognized command 0x%x\n", cmd);
             break;
         }
     }
 
     if (!s->needed_bytes) {
-        ldebug ("\n");
+        ldebug("!needed_bytes");
     }
 
  exit:
@@ -664,7 +663,7 @@ static void command (SB16State *s, uint8_t cmd)
     return;
 
  warn:
-    qemu_log_mask(LOG_UNIMP, "warning: command %#x,%d is not truly understood"
+    qemu_log_mask(LOG_UNIMP, "warning: command 0x%x,%d is not truly understood"
                   " yet\n", cmd, s->needed_bytes);
     goto exit;
 
@@ -687,7 +686,7 @@ static uint16_t dsp_get_hilo (SB16State *s)
 static void complete (SB16State *s)
 {
     int d0, d1, d2;
-    ldebug ("complete command %#x, in_index %d, needed_bytes %d\n",
+    ldebug("complete command 0x%x, in_index %d, needed_bytes %d",
             s->cmd, s->in_index, s->needed_bytes);
 
     if (s->cmd > 0xaf && s->cmd < 0xd0) {
@@ -696,11 +695,11 @@ static void complete (SB16State *s)
         d0 = dsp_get_data (s);
 
         if (s->cmd & 8) {
-            dolog ("ADC params cmd = %#x d0 = %d, d1 = %d, d2 = %d\n",
+            warn_report("sb16: ADC params cmd = 0x%x d0 = %d, d1 = %d, d2 = %d",
                    s->cmd, d0, d1, d2);
         }
         else {
-            ldebug ("cmd = %#x d0 = %d, d1 = %d, d2 = %d\n",
+            ldebug("cmd = 0x%x d0 = %d, d1 = %d, d2 = %d",
                     s->cmd, d0, d1, d2);
             dma_cmd (s, s->cmd, d0, d1 + (d2 << 8));
         }
@@ -711,13 +710,13 @@ static void complete (SB16State *s)
             s->csp_mode = dsp_get_data (s);
             s->csp_reg83r = 0;
             s->csp_reg83w = 0;
-            ldebug ("CSP command 0x04: mode=%#x\n", s->csp_mode);
+            ldebug("CSP command 0x04: mode=0x%x", s->csp_mode);
             break;
 
         case 0x05:
             s->csp_param = dsp_get_data (s);
             s->csp_value = dsp_get_data (s);
-            ldebug ("CSP command 0x05: param=%#x value=%#x\n",
+            ldebug("CSP command 0x05: param=0x%x value=0x%x",
                     s->csp_param,
                     s->csp_value);
             break;
@@ -725,9 +724,9 @@ static void complete (SB16State *s)
         case 0x0e:
             d0 = dsp_get_data (s);
             d1 = dsp_get_data (s);
-            ldebug ("write CSP register %d <- %#x\n", d1, d0);
+            ldebug("write CSP register %d <- 0x%x", d1, d0);
             if (d1 == 0x83) {
-                ldebug ("0x83[%d] <- %#x\n", s->csp_reg83r, d0);
+                ldebug("0x83[%d] <- 0x%x", s->csp_reg83r, d0);
                 s->csp_reg83[s->csp_reg83r % 4] = d0;
                 s->csp_reg83r += 1;
             }
@@ -738,10 +737,10 @@ static void complete (SB16State *s)
 
         case 0x0f:
             d0 = dsp_get_data (s);
-            ldebug ("read CSP register %#x -> %#x, mode=%#x\n",
+            ldebug("read CSP register 0x%x -> 0x%x, mode=0x%x",
                     d0, s->csp_regs[d0], s->csp_mode);
             if (d0 == 0x83) {
-                ldebug ("0x83[%d] -> %#x\n",
+                ldebug("0x83[%d] -> 0x%x",
                         s->csp_reg83w,
                         s->csp_reg83[s->csp_reg83w % 4]);
                 dsp_out_data (s, s->csp_reg83[s->csp_reg83w % 4]);
@@ -754,7 +753,7 @@ static void complete (SB16State *s)
 
         case 0x10:
             d0 = dsp_get_data (s);
-            dolog ("cmd 0x10 d0=%#x\n", d0);
+            warn_report("sb16: cmd 0x10 d0=0x%x", d0);
             break;
 
         case 0x14:
@@ -763,7 +762,7 @@ static void complete (SB16State *s)
 
         case 0x40:
             s->time_const = dsp_get_data (s);
-            ldebug ("set time const %d\n", s->time_const);
+            ldebug("set time const %d", s->time_const);
             break;
 
         case 0x41:
@@ -776,12 +775,12 @@ static void complete (SB16State *s)
              * http://homepages.cae.wisc.edu/~brodskye/sb16doc/sb16doc.html#SamplingRate
              */
             s->freq = restrict_sampling_rate(dsp_get_hilo(s));
-            ldebug ("set freq %d\n", s->freq);
+            ldebug("set freq %d", s->freq);
             break;
 
         case 0x48:
             s->block_size = dsp_get_lohi (s) + 1;
-            ldebug ("set dma block len %d\n", s->block_size);
+            ldebug("set dma block len %d", s->block_size);
             break;
 
         case 0x74:
@@ -811,21 +810,21 @@ static void complete (SB16State *s)
                             );
                     }
                 }
-                ldebug ("mix silence %d %d %" PRId64 "\n", samples, bytes, ticks);
+                ldebug("mix silence %d %d %" PRId64, samples, bytes, ticks);
             }
             break;
 
         case 0xe0:
             d0 = dsp_get_data (s);
             s->out_data_len = 0;
-            ldebug ("E0 data = %#x\n", d0);
+            ldebug("E0 data = 0x%x", d0);
             dsp_out_data (s, ~d0);
             break;
 
         case 0xe2:
-#ifdef DEBUG
+#if DEBUG
             d0 = dsp_get_data (s);
-            dolog ("E2 = %#x\n", d0);
+            warn_report("sb16: E2 = 0x%x", d0);
 #endif
             break;
 
@@ -835,7 +834,7 @@ static void complete (SB16State *s)
 
         case 0xf9:
             d0 = dsp_get_data (s);
-            ldebug ("command 0xf9 with %#x\n", d0);
+            ldebug("command 0xf9 with 0x%x", d0);
             switch (d0) {
             case 0x0e:
                 dsp_out_data (s, 0xff);
@@ -856,13 +855,13 @@ static void complete (SB16State *s)
             break;
 
         default:
-            qemu_log_mask(LOG_UNIMP, "complete: unrecognized command %#x\n",
+            qemu_log_mask(LOG_UNIMP, "complete: unrecognized command 0x%x\n",
                           s->cmd);
             return;
         }
     }
 
-    ldebug ("\n");
+    ldebug("");
     s->cmd = -1;
 }
 
@@ -926,7 +925,7 @@ static void dsp_write(void *opaque, uint32_t nport, uint32_t val)
 
     iport = nport - s->port;
 
-    ldebug ("write %#x <- %#x\n", nport, val);
+    ldebug("write 0x%x <- 0x%x", nport, val);
     switch (iport) {
     case 0x06:
         switch (val) {
@@ -976,7 +975,7 @@ static void dsp_write(void *opaque, uint32_t nport, uint32_t val)
         }
         else {
             if (s->in_index == sizeof (s->in2_data)) {
-                dolog ("in data overrun\n");
+                warn_report("sb16: in data overrun");
             }
             else {
                 s->in2_data[s->in_index++] = val;
@@ -992,7 +991,7 @@ static void dsp_write(void *opaque, uint32_t nport, uint32_t val)
         break;
 
     default:
-        ldebug ("(nport=%#x, val=%#x)\n", nport, val);
+        ldebug("(nport=0x%x, val=0x%x)", nport, val);
         break;
     }
 }
@@ -1016,7 +1015,7 @@ static uint32_t dsp_read(void *opaque, uint32_t nport)
         }
         else {
             if (s->cmd != -1) {
-                dolog ("empty output buffer for command %#x\n",
+                warn_report("sb16: empty output buffer for command 0x%x",
                        s->cmd);
             }
             retval = s->last_read_byte;
@@ -1029,7 +1028,7 @@ static uint32_t dsp_read(void *opaque, uint32_t nport)
         break;
 
     case 0x0d:                  /* timer interrupt clear */
-        /* dolog ("timer interrupt clear\n"); */
+        /* warn_report("sb16: timer interrupt clear"); */
         retval = 0;
         break;
 
@@ -1056,13 +1055,13 @@ static uint32_t dsp_read(void *opaque, uint32_t nport)
     }
 
     if (!ack) {
-        ldebug ("read %#x -> %#x\n", nport, retval);
+        ldebug("read 0x%x -> 0x%x", nport, retval);
     }
 
     return retval;
 
  error:
-    dolog ("warning: dsp_read %#x error\n", nport);
+    warn_report("sb16: dsp_read 0x%x error", nport);
     return 0xff;
 }
 
@@ -1108,7 +1107,7 @@ static void mixer_write_datab(void *opaque, uint32_t nport, uint32_t val)
     SB16State *s = opaque;
 
     (void) nport;
-    ldebug ("mixer_write [%#x] <- %#x\n", s->mixer_nreg, val);
+    ldebug("mixer_write [0x%x] <- 0x%x", s->mixer_nreg, val);
 
     switch (s->mixer_nreg) {
     case 0x00:
@@ -1118,7 +1117,7 @@ static void mixer_write_datab(void *opaque, uint32_t nport, uint32_t val)
     case 0x80:
         {
             int irq = irq_of_magic (val);
-            ldebug ("setting irq to %d (val=%#x)\n", irq, val);
+            ldebug("setting irq to %d (val=0x%x)", irq, val);
             if (irq > 0) {
                 s->irq = irq;
             }
@@ -1133,7 +1132,7 @@ static void mixer_write_datab(void *opaque, uint32_t nport, uint32_t val)
             hdma = ctz32 (val & 0xf0);
             if (dma != s->dma || hdma != s->hdma) {
                 qemu_log_mask(LOG_GUEST_ERROR, "attempt to change DMA 8bit"
-                              " %d(%d), 16bit %d(%d) (val=%#x)\n", dma, s->dma,
+                              " %d(%d), 16bit %d(%d) (val=0x%x)\n", dma, s->dma,
                               hdma, s->hdma, val);
             }
 #if 0
@@ -1145,12 +1144,12 @@ static void mixer_write_datab(void *opaque, uint32_t nport, uint32_t val)
 
     case 0x82:
         qemu_log_mask(LOG_GUEST_ERROR, "attempt to write into IRQ status"
-                      " register (val=%#x)\n", val);
+                      " register (val=0x%x)\n", val);
         return;
 
     default:
         if (s->mixer_nreg >= 0x80) {
-            ldebug ("attempt to write mixer[%#x] <- %#x\n", s->mixer_nreg, val);
+            ldebug("attempt to write mixer[0x%x] <- 0x%x", s->mixer_nreg, val);
         }
         break;
     }
@@ -1165,11 +1164,11 @@ static uint32_t mixer_read(void *opaque, uint32_t nport)
     (void) nport;
 #ifndef DEBUG_SB16_MOST
     if (s->mixer_nreg != 0x82) {
-        ldebug ("mixer_read[%#x] -> %#x\n",
+        ldebug("mixer_read[0x%x] -> 0x%x",
                 s->mixer_nreg, s->mixer_regs[s->mixer_nreg]);
     }
 #else
-    ldebug ("mixer_read[%#x] -> %#x\n",
+    ldebug("mixer_read[0x%x] -> 0x%x",
             s->mixer_nreg, s->mixer_regs[s->mixer_nreg]);
 #endif
     return s->mixer_regs[s->mixer_nreg];
@@ -1241,7 +1240,7 @@ static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
     till = s->left_till_irq;
 
 #ifdef DEBUG_SB16_MOST
-    dolog ("pos:%06d %d till:%d len:%d\n",
+    warn_report("sb16: pos:%06d %d till:%d len:%d",
            dma_pos, free, till, dma_len);
 #endif
 
@@ -1265,7 +1264,7 @@ static int SB_read_DMA (void *opaque, int nchan, int dma_pos, int dma_len)
     }
 
 #ifdef DEBUG_SB16_MOST
-    ldebug ("pos %5d free %5d size %5d till % 5d copy %5d written %5d size %5d\n",
+    ldebug("pos %5d free %5d size %5d till % 5d copy %5d written %5d size %5d",
             dma_pos, free, dma_len, s->left_till_irq, copy, written,
             s->block_size);
 #endif

From 344c79b8ff700559dec0f871b30f09b25f0aca45 Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Tue, 21 Oct 2025 16:24:44 +0530
Subject: [PATCH 1530/2396] hw/ppc/spapr: Rename resize_hpt_err to errp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename resize_hpt_err to standard errp naming convention.

Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251021105442.1474602-9-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/spapr.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 97ab6bebd2..e0a2e5a984 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2817,7 +2817,7 @@ static void spapr_machine_init(MachineState *machine)
     int i;
     MemoryRegion *sysmem = get_system_memory();
     long load_limit, fw_size;
-    Error *resize_hpt_err = NULL;
+    Error *errp = NULL;
     NICInfo *nd;
 
     if (!filename) {
@@ -2845,7 +2845,7 @@ static void spapr_machine_init(MachineState *machine)
     /* Determine capabilities to run with */
     spapr_caps_init(spapr);
 
-    kvmppc_check_papr_resize_hpt(&resize_hpt_err);
+    kvmppc_check_papr_resize_hpt(&errp);
     if (spapr->resize_hpt == SPAPR_RESIZE_HPT_DEFAULT) {
         /*
          * If the user explicitly requested a mode we should either
@@ -2853,10 +2853,10 @@ static void spapr_machine_init(MachineState *machine)
          * it's not set explicitly, we reset our mode to something
          * that works
          */
-        if (resize_hpt_err) {
+        if (errp) {
             spapr->resize_hpt = SPAPR_RESIZE_HPT_DISABLED;
-            error_free(resize_hpt_err);
-            resize_hpt_err = NULL;
+            error_free(errp);
+            errp = NULL;
         } else {
             spapr->resize_hpt = smc->resize_hpt_default;
         }
@@ -2864,14 +2864,14 @@ static void spapr_machine_init(MachineState *machine)
 
     assert(spapr->resize_hpt != SPAPR_RESIZE_HPT_DEFAULT);
 
-    if ((spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) && resize_hpt_err) {
+    if ((spapr->resize_hpt != SPAPR_RESIZE_HPT_DISABLED) && errp) {
         /*
          * User requested HPT resize, but this host can't supply it.  Bail out
          */
-        error_report_err(resize_hpt_err);
+        error_report_err(errp);
         exit(1);
     }
-    error_free(resize_hpt_err);
+    error_free(errp);
 
     spapr->rma_size = spapr_rma_size(spapr, &error_fatal);
 

From 253f902d845b4ce2877b4b446c026be0dd0ea7f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 13 May 2025 12:33:29 +0100
Subject: [PATCH 1531/2396] qemu/target-info: Include missing
 'qapi-types-common.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When adding the TargetInfo::@endianness field in commit a37aec2e7d8,
we neglected to include the "qapi-types-common.h" header to get the
EndianMode enum definition. Fix that.

Fixes: a37aec2e7d8 ("qemu/target-info: Add target_endian_mode()")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-Id: <20251020220941.65269-10-philmd@linaro.org>
---
 include/qemu/target-info-impl.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/qemu/target-info-impl.h b/include/qemu/target-info-impl.h
index 17887f64e2..e446585bf5 100644
--- a/include/qemu/target-info-impl.h
+++ b/include/qemu/target-info-impl.h
@@ -9,6 +9,7 @@
 #ifndef QEMU_TARGET_INFO_IMPL_H
 #define QEMU_TARGET_INFO_IMPL_H
 
+#include "qapi/qapi-types-common.h"
 #include "qapi/qapi-types-machine.h"
 
 typedef struct TargetInfo {

From 7d82e9b56c6fad65d993a31d990fdc5792926692 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 20 Oct 2025 16:04:24 +0200
Subject: [PATCH 1532/2396] MAINTAINERS: Add missing machine name in the Alpha
 section
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without a machine name here, get_maintainers.pl uses the "-----..."
separator for describing what the maintainer is taking care of:

 $ scripts/get_maintainer.pl -f hw/alpha/dp264.c
 Richard Henderson <richard.henderson@linaro.org> (maintainer:--------------)
 qemu-devel@nongnu.org (open list:All patches CC here)

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251020140425.45003-1-thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 667acd933c..d4e7fd965b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -671,6 +671,7 @@ F: tests/docker/dockerfiles/emsdk-wasm32-cross.docker
 
 Alpha Machines
 --------------
+Clipper
 M: Richard Henderson <richard.henderson@linaro.org>
 S: Maintained
 F: hw/alpha/

From ba4d0a0184cb364df98fe66d885b79427ebd0e7b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 13:02:38 +0400
Subject: [PATCH 1533/2396] docs: update -soundhw -> -device list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

(note: I wonder if pcspk was really an option when -soundhw was
available, since it was not user-creatable)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251021090317.425409-8-marcandre.lureau@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 docs/qdev-device-use.txt | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/docs/qdev-device-use.txt b/docs/qdev-device-use.txt
index c98c86d828..043ae46114 100644
--- a/docs/qdev-device-use.txt
+++ b/docs/qdev-device-use.txt
@@ -324,8 +324,10 @@ Map from -soundhw sound card name to -device:
     gus         -device gus,iobase=IOADDR,irq=IRQ,dma=DMA,freq=F
     hda         -device intel-hda,msi=MSI -device hda-duplex
     sb16        -device sb16,iobase=IOADDR,irq=IRQ,dma=DMA,dma16=DMA16,version=V
-    adlib       not yet available with -device
-    pcspk       not yet available with -device
+    adlib       -device adlib,iobase=IOADDR,freq=F
+
+    pcspk       Not available with -device,
+                but audiodev can be set with -machine pcspk-audiodev=<name>
 
 For PCI devices, you can add bus=PCI-BUS,addr=DEVFN to control the PCI
 device address, as usual.

From 274d9060664b1754a3d349af718d006ed2e70b2a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 15:11:07 +0200
Subject: [PATCH 1534/2396] docs: Update mentions of removed '-soundhw' command
 line option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The `-soundhw` CLI was removed in commit 039a68373c4 ("introduce
-audio as a replacement for -soundhw"). Remove outdated comments
and update the document mentioning the old usage.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-Id: <20251021131825.99390-2-philmd@linaro.org>
---
 docs/qdev-device-use.txt | 4 ++--
 system/qdev-monitor.c    | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/docs/qdev-device-use.txt b/docs/qdev-device-use.txt
index 043ae46114..fb420da2a9 100644
--- a/docs/qdev-device-use.txt
+++ b/docs/qdev-device-use.txt
@@ -311,9 +311,9 @@ constraints.
 
 Host and guest part of audio devices have always been separate.
 
-The old way to define guest audio devices is -soundhw C1,...
+The old way to define guest audio devices was -soundhw C1,...
 
-The new way is to define each guest audio device separately with
+The current way is to define each guest audio device separately with
 -device.
 
 Map from -soundhw sound card name to -device:
diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index 2ac92d0a07..ec4a2394ce 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -73,9 +73,9 @@ typedef struct QDevAlias
 
 /* Please keep this table sorted by typename. */
 static const QDevAlias qdev_alias_table[] = {
-    { "AC97", "ac97" }, /* -soundhw name */
+    { "AC97", "ac97" },
     { "e1000", "e1000-82540em" },
-    { "ES1370", "es1370" }, /* -soundhw name */
+    { "ES1370", "es1370" },
     { "ich9-ahci", "ahci" },
     { "lsi53c895a", "lsi" },
     { "virtio-9p-device", "virtio-9p", QEMU_ARCH_VIRTIO_MMIO },

From 1b2fda59164ea4e487d9eb1e34f6a885f67d6ee9 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Fri, 17 Oct 2025 13:50:03 +0200
Subject: [PATCH 1535/2396] hw/uefi: add query-firmware-log monitor command

Starting with the edk2-stable202508 tag OVMF (and ArmVirt too) have
optional support for logging to a memory buffer.  There is guest side
support -- for example in linux kernels v6.17+ -- to read that buffer.
But that might not helpful if your guest stops booting early enough that
guest tooling can not be used yet.  So host side support to read that
log buffer is a useful thing to have.

This patch implements the query-firmware-log qmp monitor command to
read the firmware log.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251017115006.2696991-2-kraxel@redhat.com>
---
 hw/uefi/meson.build        |   2 +-
 hw/uefi/ovmf-log.c         | 233 +++++++++++++++++++++++++++++++++++++
 qapi/machine.json          |  24 ++++
 tests/qtest/qmp-cmd-test.c |   2 +
 4 files changed, 260 insertions(+), 1 deletion(-)
 create mode 100644 hw/uefi/ovmf-log.c

diff --git a/hw/uefi/meson.build b/hw/uefi/meson.build
index 91eb95f89e..c8f38dfae2 100644
--- a/hw/uefi/meson.build
+++ b/hw/uefi/meson.build
@@ -1,4 +1,4 @@
-system_ss.add(files('hardware-info.c'))
+system_ss.add(files('hardware-info.c', 'ovmf-log.c'))
 
 uefi_vars_ss = ss.source_set()
 if (config_all_devices.has_key('CONFIG_UEFI_VARS'))
diff --git a/hw/uefi/ovmf-log.c b/hw/uefi/ovmf-log.c
new file mode 100644
index 0000000000..0d4bd503a0
--- /dev/null
+++ b/hw/uefi/ovmf-log.c
@@ -0,0 +1,233 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * print ovmf debug log
+ *
+ * see OvmfPkg/Library/MemDebugLogLib/ in edk2
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/units.h"
+#include "qemu/target-info-qapi.h"
+#include "hw/boards.h"
+#include "hw/i386/x86.h"
+#include "hw/arm/virt.h"
+#include "system/dma.h"
+#include "monitor/hmp.h"
+#include "monitor/monitor.h"
+#include "qapi/error.h"
+#include "qapi/type-helpers.h"
+#include "qapi/qapi-commands-machine.h"
+
+
+/* ----------------------------------------------------------------------- */
+/* copy from edk2                                                          */
+
+#define MEM_DEBUG_LOG_MAGIC1  0x3167646d666d766f  /* "ovmfmdg1" */
+#define MEM_DEBUG_LOG_MAGIC2  0x3267646d666d766f  /* "ovmfmdg2" */
+
+/*
+ * Mem Debug Log buffer header.
+ * The Log buffer is circular. Only the most
+ * recent messages are retained. Older messages
+ * will be discarded if the buffer overflows.
+ * The Debug Log starts just after the header.
+ */
+typedef struct {
+    /*
+     * Magic values
+     * These fields are used by tools to locate the buffer in
+     * memory. These MUST be the first two fields of the structure.
+     * Use a 128 bit Magic to vastly reduce the possibility of
+     * a collision with random data in memory.
+     */
+    uint64_t             Magic1;
+    uint64_t             Magic2;
+    /*
+     * Header Size
+     * This MUST be the third field of the structure
+     */
+    uint64_t             HeaderSize;
+    /*
+     * Debug log size (minus header)
+     */
+    uint64_t             DebugLogSize;
+    /*
+     * edk2 uses this for locking access.
+     */
+    uint64_t             MemDebugLogLock;
+    /*
+     * Debug log head offset
+     */
+    uint64_t             DebugLogHeadOffset;
+    /*
+     *  Debug log tail offset
+     */
+    uint64_t             DebugLogTailOffset;
+    /*
+     * Flag to indicate if the buffer wrapped and was thus truncated.
+     */
+    uint64_t             Truncated;
+    /*
+     * Firmware Build Version (PcdFirmwareVersionString)
+     */
+    char                 FirmwareVersion[128];
+} MEM_DEBUG_LOG_HDR;
+
+
+/* ----------------------------------------------------------------------- */
+/* qemu monitor command                                                    */
+
+typedef struct {
+    uint64_t             magic1;
+    uint64_t             magic2;
+} MemDebugLogMagic;
+
+/* find log buffer in guest memory by searching for the magic cookie */
+static dma_addr_t find_ovmf_log_range(dma_addr_t start, dma_addr_t end)
+{
+    static const MemDebugLogMagic magic = {
+        .magic1 = MEM_DEBUG_LOG_MAGIC1,
+        .magic2 = MEM_DEBUG_LOG_MAGIC2,
+    };
+    MemDebugLogMagic check;
+    dma_addr_t step = 4 * KiB;
+    dma_addr_t offset;
+
+    for (offset = start; offset < end; offset += step) {
+        if (dma_memory_read(&address_space_memory, offset,
+                            &check, sizeof(check),
+                            MEMTXATTRS_UNSPECIFIED)) {
+            /* dma error -> stop searching */
+            break;
+        }
+        if (memcmp(&magic, &check, sizeof(check)) == 0) {
+            return offset;
+        }
+    }
+    return (dma_addr_t)-1;
+}
+
+static dma_addr_t find_ovmf_log(void)
+{
+    MachineState *ms = MACHINE(qdev_get_machine());
+    dma_addr_t start, end, offset;
+
+    if (target_arch() == SYS_EMU_TARGET_X86_64 &&
+        object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)) {
+        X86MachineState *x86ms = X86_MACHINE(ms);
+
+        /* early log buffer, static allocation in memfd, sec + early pei */
+        offset = find_ovmf_log_range(0x800000, 0x900000);
+        if (offset != -1) {
+            return offset;
+        }
+
+        /*
+         * normal log buffer, dynamically allocated close to end of low memory,
+         * late pei + dxe phase
+         */
+        end = x86ms->below_4g_mem_size;
+        start = end - MIN(end, 128 * MiB);
+        return find_ovmf_log_range(start, end);
+    }
+
+    if (target_arch() == SYS_EMU_TARGET_AARCH64 &&
+        object_dynamic_cast(OBJECT(ms), TYPE_VIRT_MACHINE)) {
+        VirtMachineState *vms = VIRT_MACHINE(ms);
+
+        /* edk2 ArmVirt firmware allocations are in the first 128 MB */
+        start = vms->memmap[VIRT_MEM].base;
+        end = start + 128 * MiB;
+        return find_ovmf_log_range(start, end);
+    }
+
+    return (dma_addr_t)-1;
+}
+
+static void handle_ovmf_log_range(GString *out,
+                                  dma_addr_t start,
+                                  dma_addr_t end,
+                                  Error **errp)
+{
+    if (start > end) {
+        return;
+    }
+
+    size_t len = end - start;
+    g_string_set_size(out, out->len + len);
+    if (dma_memory_read(&address_space_memory, start,
+                        out->str + (out->len - len),
+                        len, MEMTXATTRS_UNSPECIFIED)) {
+        error_setg(errp, "can not read firmware log buffer contents");
+        return;
+    }
+}
+
+FirmwareLog *qmp_query_firmware_log(Error **errp)
+{
+    MEM_DEBUG_LOG_HDR header;
+    dma_addr_t offset, base;
+    FirmwareLog *ret;
+    g_autoptr(GString) log = g_string_new("");
+
+    offset = find_ovmf_log();
+    if (offset == -1) {
+        error_setg(errp, "firmware log buffer not found");
+        return NULL;
+    }
+
+    if (dma_memory_read(&address_space_memory, offset,
+                        &header, sizeof(header),
+                        MEMTXATTRS_UNSPECIFIED)) {
+        error_setg(errp, "can not read firmware log buffer header");
+        return NULL;
+    }
+
+    if (header.DebugLogSize > MiB) {
+        /* default size is 128k (32 pages), allow up to 1M */
+        error_setg(errp, "firmware log: log buffer is too big");
+        return NULL;
+    }
+
+    if (header.DebugLogHeadOffset > header.DebugLogSize ||
+        header.DebugLogTailOffset > header.DebugLogSize) {
+        error_setg(errp, "firmware log buffer header is invalid");
+        return NULL;
+    }
+
+    base = offset + header.HeaderSize;
+    if (header.DebugLogHeadOffset > header.DebugLogTailOffset) {
+        /* wrap around */
+        handle_ovmf_log_range(log,
+                              base + header.DebugLogHeadOffset,
+                              base + header.DebugLogSize,
+                              errp);
+        if (*errp) {
+            return NULL;
+        }
+        handle_ovmf_log_range(log,
+                              base + 0,
+                              base + header.DebugLogTailOffset,
+                              errp);
+        if (*errp) {
+            return NULL;
+        }
+    } else {
+        handle_ovmf_log_range(log,
+                              base + header.DebugLogHeadOffset,
+                              base + header.DebugLogTailOffset,
+                              errp);
+        if (*errp) {
+            return NULL;
+        }
+    }
+
+    ret = g_new0(FirmwareLog, 1);
+    if (header.FirmwareVersion[0] != '\0') {
+        ret->version = g_strndup(header.FirmwareVersion,
+                                 sizeof(header.FirmwareVersion));
+    }
+    ret->log = g_base64_encode((const guchar *)log->str, log->len);
+    return ret;
+}
diff --git a/qapi/machine.json b/qapi/machine.json
index 038eab281c..96133e5c71 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1839,6 +1839,30 @@
   'returns': 'HumanReadableText',
   'features': [ 'unstable' ]}
 
+##
+# @FirmwareLog:
+#
+# @version: Firmware version.
+#
+# @log: Firmware debug log, in base64 encoding.  First and last log
+#       line might be incomplete.
+#
+# Since: 10.2
+##
+{ 'struct': 'FirmwareLog',
+  'data': { '*version': 'str',
+            'log': 'str' } }
+
+##
+# @query-firmware-log:
+#
+# Find firmware memory log buffer in guest memory, return content.
+#
+# Since: 10.2
+##
+{ 'command': 'query-firmware-log',
+  'returns': 'FirmwareLog' }
+
 ##
 # @dump-skeys:
 #
diff --git a/tests/qtest/qmp-cmd-test.c b/tests/qtest/qmp-cmd-test.c
index cf71876186..279a8f5614 100644
--- a/tests/qtest/qmp-cmd-test.c
+++ b/tests/qtest/qmp-cmd-test.c
@@ -52,6 +52,8 @@ static int query_error_class(const char *cmd)
         /* Only valid with accel=tcg */
         { "x-query-jit", ERROR_CLASS_GENERIC_ERROR },
         { "xen-event-list", ERROR_CLASS_GENERIC_ERROR },
+        /* requires firmware with memory buffer logging support */
+        { "query-firmware-log", ERROR_CLASS_GENERIC_ERROR },
         { NULL, -1 }
     };
     int i;

From c8aa8120313fc7770900de13b657dacb7dc77a95 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Fri, 17 Oct 2025 13:50:04 +0200
Subject: [PATCH 1536/2396] hw/uefi: add 'info firmware-log' hmp monitor
 command.

This adds the hmp variant of the query-firmware-log qmp command.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251017115006.2696991-3-kraxel@redhat.com>
---
 hmp-commands-info.hx  | 13 +++++++++++++
 hw/uefi/ovmf-log.c    | 27 +++++++++++++++++++++++++++
 include/monitor/hmp.h |  1 +
 3 files changed, 41 insertions(+)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 25b4aed51f..33cf740bbc 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -995,3 +995,16 @@ SRST
   ``info cryptodev``
     Show the crypto devices.
 ERST
+
+    {
+        .name       = "firmware-log",
+        .args_type  = "",
+        .params     = "",
+        .help       = "show the firmware (ovmf) debug log",
+        .cmd        = hmp_info_firmware_log,
+    },
+
+SRST
+  ``info firmware-log``
+    Show the firmware (ovmf) debug log.
+ERST
diff --git a/hw/uefi/ovmf-log.c b/hw/uefi/ovmf-log.c
index 0d4bd503a0..fe8acbd192 100644
--- a/hw/uefi/ovmf-log.c
+++ b/hw/uefi/ovmf-log.c
@@ -231,3 +231,30 @@ FirmwareLog *qmp_query_firmware_log(Error **errp)
     ret->log = g_base64_encode((const guchar *)log->str, log->len);
     return ret;
 }
+
+void hmp_info_firmware_log(Monitor *mon, const QDict *qdict)
+{
+    g_autofree gchar *log_esc = NULL;
+    g_autofree guchar *log_out = NULL;
+    Error *err = NULL;
+    FirmwareLog *log;
+    gsize log_len;
+
+    log = qmp_query_firmware_log(&err);
+    if (err)  {
+        hmp_handle_error(mon, err);
+        return;
+    }
+
+    g_assert(log != NULL);
+    g_assert(log->log != NULL);
+
+    if (log->version) {
+        g_autofree gchar *esc = g_strescape(log->version, NULL);
+        monitor_printf(mon, "[ firmware version: %s ]\n", esc);
+    }
+
+    log_out = g_base64_decode(log->log, &log_len);
+    log_esc = g_strescape((gchar *)log_out, "\r\n");
+    monitor_printf(mon, "%s\n", log_esc);
+}
diff --git a/include/monitor/hmp.h b/include/monitor/hmp.h
index 897dfaa2b6..83721b5ffc 100644
--- a/include/monitor/hmp.h
+++ b/include/monitor/hmp.h
@@ -179,5 +179,6 @@ void hmp_boot_set(Monitor *mon, const QDict *qdict);
 void hmp_info_mtree(Monitor *mon, const QDict *qdict);
 void hmp_info_cryptodev(Monitor *mon, const QDict *qdict);
 void hmp_dumpdtb(Monitor *mon, const QDict *qdict);
+void hmp_info_firmware_log(Monitor *mon, const QDict *qdict);
 
 #endif

From c6c6d854447a7821288e01857d0f7fb28b82cf44 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Fri, 17 Oct 2025 13:50:05 +0200
Subject: [PATCH 1537/2396] hw/uefi/ovmf-log: add maxsize parameter

Allow limiting the amount of log output sent.  Allow up to 1 MiB.
In case the guest log buffer is larger than 1 MiB limit the output
instead of throwing an error.

Acked-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251017115006.2696991-4-kraxel@redhat.com>
---
 hmp-commands-info.hx |  4 ++--
 hw/uefi/ovmf-log.c   | 42 ++++++++++++++++++++++++++++++++++--------
 qapi/machine.json    |  5 +++++
 3 files changed, 41 insertions(+), 10 deletions(-)

diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 33cf740bbc..2a7f5810d7 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -998,8 +998,8 @@ ERST
 
     {
         .name       = "firmware-log",
-        .args_type  = "",
-        .params     = "",
+        .args_type  = "max-size:o?",
+        .params     = "[max-size]",
         .help       = "show the firmware (ovmf) debug log",
         .cmd        = hmp_info_firmware_log,
     },
diff --git a/hw/uefi/ovmf-log.c b/hw/uefi/ovmf-log.c
index fe8acbd192..98ebb02094 100644
--- a/hw/uefi/ovmf-log.c
+++ b/hw/uefi/ovmf-log.c
@@ -18,6 +18,7 @@
 #include "qapi/error.h"
 #include "qapi/type-helpers.h"
 #include "qapi/qapi-commands-machine.h"
+#include "qobject/qdict.h"
 
 
 /* ----------------------------------------------------------------------- */
@@ -164,7 +165,8 @@ static void handle_ovmf_log_range(GString *out,
     }
 }
 
-FirmwareLog *qmp_query_firmware_log(Error **errp)
+FirmwareLog *qmp_query_firmware_log(bool have_max_size, uint64_t max_size,
+                                    Error **errp)
 {
     MEM_DEBUG_LOG_HDR header;
     dma_addr_t offset, base;
@@ -184,18 +186,40 @@ FirmwareLog *qmp_query_firmware_log(Error **errp)
         return NULL;
     }
 
-    if (header.DebugLogSize > MiB) {
-        /* default size is 128k (32 pages), allow up to 1M */
-        error_setg(errp, "firmware log: log buffer is too big");
-        return NULL;
-    }
-
     if (header.DebugLogHeadOffset > header.DebugLogSize ||
         header.DebugLogTailOffset > header.DebugLogSize) {
         error_setg(errp, "firmware log buffer header is invalid");
         return NULL;
     }
 
+    if (have_max_size) {
+        if (max_size > MiB) {
+            error_setg(errp, "parameter 'max-size' exceeds 1MiB");
+            return NULL;
+        }
+    } else {
+        max_size = MiB;
+    }
+
+    /* adjust header.DebugLogHeadOffset so we return at most maxsize bytes */
+    if (header.DebugLogHeadOffset > header.DebugLogTailOffset) {
+        /* wrap around */
+        if (header.DebugLogTailOffset > max_size) {
+            header.DebugLogHeadOffset = header.DebugLogTailOffset - max_size;
+        } else {
+            uint64_t max_chunk = max_size - header.DebugLogTailOffset;
+            if (header.DebugLogSize > max_chunk &&
+                header.DebugLogHeadOffset < header.DebugLogSize - max_chunk) {
+                header.DebugLogHeadOffset = header.DebugLogSize - max_chunk;
+            }
+        }
+    } else {
+        if (header.DebugLogTailOffset > max_size &&
+            header.DebugLogHeadOffset < header.DebugLogTailOffset - max_size) {
+            header.DebugLogHeadOffset = header.DebugLogTailOffset - max_size;
+        }
+    }
+
     base = offset + header.HeaderSize;
     if (header.DebugLogHeadOffset > header.DebugLogTailOffset) {
         /* wrap around */
@@ -239,8 +263,10 @@ void hmp_info_firmware_log(Monitor *mon, const QDict *qdict)
     Error *err = NULL;
     FirmwareLog *log;
     gsize log_len;
+    int64_t maxsize;
 
-    log = qmp_query_firmware_log(&err);
+    maxsize = qdict_get_try_int(qdict, "max-size", -1);
+    log = qmp_query_firmware_log(maxsize != -1, (uint64_t)maxsize, &err);
     if (err)  {
         hmp_handle_error(mon, err);
         return;
diff --git a/qapi/machine.json b/qapi/machine.json
index 96133e5c71..c6dc6fe69b 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -1858,9 +1858,14 @@
 #
 # Find firmware memory log buffer in guest memory, return content.
 #
+# @max-size: limit the amount of log data returned.  Up to 1 MiB of
+#            log data is allowed.  In case the amount of log data is
+#            larger than @max-size the tail of the log is returned.
+#
 # Since: 10.2
 ##
 { 'command': 'query-firmware-log',
+  'data': { '*max-size': 'size' },
   'returns': 'FirmwareLog' }
 
 ##

From b6478122f059274b19805e14d12f76d2c0272ad4 Mon Sep 17 00:00:00 2001
From: GuoHan Zhao <zhaoguohan@kylinos.cn>
Date: Thu, 23 Oct 2025 14:31:06 +0800
Subject: [PATCH 1538/2396] hw/uefi/ovmf-log: Fix memory leak in
 hmp_info_firmware_log
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The FirmwareLog object returned by qmp_query_firmware_log() was
not being freed, causing a memory leak.

Use g_autoptr to ensure the object is automatically freed when
it goes out of scope.

Fixes: c8aa8120313f ("hw/uefi: add 'info firmware-log' hmp monitor command.")
Signed-off-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251023063106.9834-1-zhaoguohan_salmon@163.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
---
 hw/uefi/ovmf-log.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/uefi/ovmf-log.c b/hw/uefi/ovmf-log.c
index 98ebb02094..850ef21f88 100644
--- a/hw/uefi/ovmf-log.c
+++ b/hw/uefi/ovmf-log.c
@@ -261,7 +261,7 @@ void hmp_info_firmware_log(Monitor *mon, const QDict *qdict)
     g_autofree gchar *log_esc = NULL;
     g_autofree guchar *log_out = NULL;
     Error *err = NULL;
-    FirmwareLog *log;
+    g_autoptr(FirmwareLog) log = NULL;
     gsize log_len;
     int64_t maxsize;
 

From 6447334a31bc65cd3192ada3ac75a5f2fdeaa03b Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 30 Sep 2025 09:14:58 +0800
Subject: [PATCH 1539/2396] target/loongarch: Use auto method with PTW feature

PTW is short for page table walker, it is hardware page table walker
function. With PTW supported, hardware MMU will parse page table
table and update TLB entries automatically.

This patch adds type OnOffAuto for PTW feature setting.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c | 26 ++++++++++++++++++++++++++
 target/loongarch/cpu.h |  2 ++
 2 files changed, 28 insertions(+)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index 86490e0f72..e80a92fb2e 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -224,6 +224,25 @@ static void loongarch_set_msgint(Object *obj, bool value, Error **errp)
      cpu->env.cpucfg[1] = FIELD_DP32(cpu->env.cpucfg[1], CPUCFG1, MSG_INT, value);
 }
 
+static bool loongarch_get_ptw(Object *obj, Error **errp)
+{
+    return LOONGARCH_CPU(obj)->ptw != ON_OFF_AUTO_OFF;
+}
+
+static void loongarch_set_ptw(Object *obj, bool value, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(obj);
+
+    cpu->ptw = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+
+    if (kvm_enabled()) {
+        /* PTW feature is only support in TCG mode now */
+        return;
+    }
+
+    cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, HPTW, value);
+}
+
 static void loongarch_cpu_post_init(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
@@ -238,7 +257,10 @@ static void loongarch_cpu_post_init(Object *obj)
                              loongarch_set_lasx);
     object_property_add_bool(obj, "msgint", loongarch_get_msgint,
                              loongarch_set_msgint);
+    object_property_add_bool(obj, "ptw", loongarch_get_ptw,
+                             loongarch_set_ptw);
     /* lbt is enabled only in kvm mode, not supported in tcg mode */
+
     if (kvm_enabled()) {
         kvm_loongarch_cpu_post_init(cpu);
     }
@@ -346,6 +368,7 @@ static void loongarch_la464_initfn(Object *obj)
     env->CSR_PRCFG3 = FIELD_DP64(env->CSR_PRCFG3, CSR_PRCFG3, STLB_SETS, 8);
 
     cpu->msgint = ON_OFF_AUTO_OFF;
+    cpu->ptw = ON_OFF_AUTO_OFF;
     loongarch_la464_init_csr(obj);
     loongarch_cpu_post_init(obj);
 }
@@ -377,6 +400,7 @@ static void loongarch_la132_initfn(Object *obj)
     data = FIELD_DP32(data, CPUCFG1, CRC, 1);
     env->cpucfg[1] = data;
     cpu->msgint = ON_OFF_AUTO_OFF;
+    cpu->ptw = ON_OFF_AUTO_OFF;
 }
 
 static void loongarch_max_initfn(Object *obj)
@@ -388,6 +412,8 @@ static void loongarch_max_initfn(Object *obj)
     if (tcg_enabled()) {
         cpu->env.cpucfg[1] = FIELD_DP32(cpu->env.cpucfg[1], CPUCFG1, MSG_INT, 1);
         cpu->msgint = ON_OFF_AUTO_AUTO;
+        cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, HPTW, 1);
+        cpu->ptw = ON_OFF_AUTO_AUTO;
     }
 }
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index b8e3b46c3a..b1d6799222 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -137,6 +137,7 @@ FIELD(CPUCFG2, LBT_MIPS, 20, 1)
 FIELD(CPUCFG2, LBT_ALL, 18, 3)
 FIELD(CPUCFG2, LSPW, 21, 1)
 FIELD(CPUCFG2, LAM, 22, 1)
+FIELD(CPUCFG2, HPTW, 24, 1)
 
 /* cpucfg[3] bits */
 FIELD(CPUCFG3, CCDMA, 0, 1)
@@ -402,6 +403,7 @@ struct ArchCPU {
     uint32_t  phy_id;
     OnOffAuto lbt;
     OnOffAuto pmu;
+    OnOffAuto ptw;
     OnOffAuto lsx;
     OnOffAuto lasx;
     OnOffAuto msgint;

From 5cba5a518bf50d790deff0d6188d2ebd299bc3cc Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 16 Jul 2025 11:23:13 +0800
Subject: [PATCH 1540/2396] target/loongarch: Add CSR_PWCH write helper
 function

Bit HPTW_EN in register CSR_PWCH controls enabling hardware page
table walker feature when PTW feature is enabled. Otherwise it is
reserved bit.

Here add register CSR_PWCH write helper function.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-csr.h                        |  2 ++
 target/loongarch/tcg/csr_helper.c                 | 15 +++++++++++++++
 target/loongarch/tcg/helper.h                     |  1 +
 .../tcg/insn_trans/trans_privileged.c.inc         |  1 +
 4 files changed, 19 insertions(+)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 9097fddee1..0bcb51d3a3 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -105,6 +105,8 @@ FIELD(CSR_PWCH, DIR3_BASE, 0, 6)
 FIELD(CSR_PWCH, DIR3_WIDTH, 6, 6)
 FIELD(CSR_PWCH, DIR4_BASE, 12, 6)
 FIELD(CSR_PWCH, DIR4_WIDTH, 18, 6)
+FIELD(CSR_PWCH, HPTW_EN, 24, 1)
+FIELD(CSR_PWCH, RESERVE, 25, 7)
 
 #define LOONGARCH_CSR_STLBPS         0x1e /* Stlb page size */
 FIELD(CSR_STLBPS, PS, 0, 5)
diff --git a/target/loongarch/tcg/csr_helper.c b/target/loongarch/tcg/csr_helper.c
index 5ebe15f993..c1a8ba3089 100644
--- a/target/loongarch/tcg/csr_helper.c
+++ b/target/loongarch/tcg/csr_helper.c
@@ -163,3 +163,18 @@ target_ulong helper_csrwr_pwcl(CPULoongArchState *env, target_ulong val)
     env->CSR_PWCL = val;
     return old_v;
 }
+
+target_ulong helper_csrwr_pwch(CPULoongArchState *env, target_ulong val)
+{
+    uint8_t has_ptw;
+    int64_t old_v = env->CSR_PWCH;
+
+    val = FIELD_DP64(val, CSR_PWCH, RESERVE, 0);
+    has_ptw = FIELD_EX32(env->cpucfg[2], CPUCFG2, HPTW);
+    if (!has_ptw) {
+        val = FIELD_DP64(val, CSR_PWCH, HPTW_EN, 0);
+    }
+
+    env->CSR_PWCH = val;
+    return old_v;
+ }
diff --git a/target/loongarch/tcg/helper.h b/target/loongarch/tcg/helper.h
index 7e508c5a7b..8a6c62f116 100644
--- a/target/loongarch/tcg/helper.h
+++ b/target/loongarch/tcg/helper.h
@@ -107,6 +107,7 @@ DEF_HELPER_2(csrwr_asid, i64, env, tl)
 DEF_HELPER_2(csrwr_tcfg, i64, env, tl)
 DEF_HELPER_2(csrwr_ticlr, i64, env, tl)
 DEF_HELPER_2(csrwr_pwcl, i64, env, tl)
+DEF_HELPER_2(csrwr_pwch, i64, env, tl)
 DEF_HELPER_2(iocsrrd_b, i64, env, tl)
 DEF_HELPER_2(iocsrrd_h, i64, env, tl)
 DEF_HELPER_2(iocsrrd_w, i64, env, tl)
diff --git a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
index 64e53a4460..2094d182ac 100644
--- a/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
+++ b/target/loongarch/tcg/insn_trans/trans_privileged.c.inc
@@ -79,6 +79,7 @@ void loongarch_csr_translate_init(void)
     SET_CSR_FUNC(ASID,  NULL, gen_helper_csrwr_asid);
     SET_CSR_FUNC(PGD,   gen_helper_csrrd_pgd, NULL);
     SET_CSR_FUNC(PWCL,  NULL, gen_helper_csrwr_pwcl);
+    SET_CSR_FUNC(PWCH,  NULL, gen_helper_csrwr_pwch);
     SET_CSR_FUNC(CPUID, gen_helper_csrrd_cpuid, NULL);
     SET_CSR_FUNC(TCFG,  NULL, gen_helper_csrwr_tcfg);
     SET_CSR_FUNC(TVAL,  gen_helper_csrrd_tval, NULL);

From 7b7c6fae9bce5d1314f38b66dbf4bf25e862af3f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Oct 2025 11:32:43 +0800
Subject: [PATCH 1541/2396] target/loongarch: Add present and write bit with
 pte entry

With hardware PTW feature enabled, Present bit and Write bit is checked
by hardware, rather Valid bit and Dirty bit. Bit P means that the page is
valid and present, and bit W means that the page is writable.

The original V bit is treated as access bit, hardware sets this bit if
there is a read or write access. Bit D bit is updated by hardware if
there is a write access.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-csr.h        |  2 ++
 target/loongarch/cpu-mmu.h        | 31 +++++++++++++++++++++++++++++++
 target/loongarch/cpu_helper.c     |  7 ++++---
 target/loongarch/tcg/tlb_helper.c | 16 ++++++++--------
 4 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/target/loongarch/cpu-csr.h b/target/loongarch/cpu-csr.h
index 0bcb51d3a3..6898947498 100644
--- a/target/loongarch/cpu-csr.h
+++ b/target/loongarch/cpu-csr.h
@@ -70,6 +70,8 @@ FIELD(TLBENTRY, PLV, 2, 2)
 FIELD(TLBENTRY, MAT, 4, 2)
 FIELD(TLBENTRY, G, 6, 1)
 FIELD(TLBENTRY, HUGE, 6, 1)
+FIELD(TLBENTRY, P, 7, 1)
+FIELD(TLBENTRY, W, 8, 1)
 FIELD(TLBENTRY, HGLOBAL, 12, 1)
 FIELD(TLBENTRY, LEVEL, 13, 2)
 FIELD(TLBENTRY_32, PPN, 8, 24)
diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index dbc69c7c0f..4ba82a7f81 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -27,6 +27,37 @@ typedef struct MMUContext {
     int           prot;
 } MMUContext;
 
+static inline bool cpu_has_ptw(CPULoongArchState *env)
+{
+    return !!FIELD_EX64(env->CSR_PWCH, CSR_PWCH, HPTW_EN);
+}
+
+static inline bool pte_present(CPULoongArchState *env, uint64_t entry)
+{
+    uint8_t present;
+
+    if (cpu_has_ptw(env)) {
+        present = FIELD_EX64(entry, TLBENTRY, P);
+    } else {
+        present = FIELD_EX64(entry, TLBENTRY, V);
+    }
+
+    return !!present;
+}
+
+static inline bool pte_write(CPULoongArchState *env, uint64_t entry)
+{
+    uint8_t writable;
+
+    if (cpu_has_ptw(env)) {
+        writable = FIELD_EX64(entry, TLBENTRY, W);
+    } else {
+        writable = FIELD_EX64(entry, TLBENTRY, D);
+    }
+
+    return !!writable;
+}
+
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
 TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
                            MMUAccessType access_type, int mmu_idx);
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 867e7c8867..5165c44c7d 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -49,12 +49,13 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
 {
     uint64_t plv = mmu_idx;
     uint64_t tlb_entry, tlb_ppn;
-    uint8_t tlb_ps, tlb_v, tlb_d, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
+    uint8_t tlb_ps, tlb_plv, tlb_nx, tlb_nr, tlb_rplv;
+    bool tlb_v, tlb_d;
 
     tlb_entry = context->pte;
     tlb_ps = context->ps;
-    tlb_v = FIELD_EX64(tlb_entry, TLBENTRY, V);
-    tlb_d = FIELD_EX64(tlb_entry, TLBENTRY, D);
+    tlb_v = pte_present(env, tlb_entry);
+    tlb_d = pte_write(env, tlb_entry);
     tlb_plv = FIELD_EX64(tlb_entry, TLBENTRY, PLV);
     if (is_la64(env)) {
         tlb_ppn = FIELD_EX64(tlb_entry, TLBENTRY_64, PPN);
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index e119f78d92..bc89a4d5ee 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -114,9 +114,8 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     uint8_t tlb_ps;
     LoongArchTLB *tlb = &env->tlb[index];
     int idxmap = BIT(MMU_KERNEL_IDX) | BIT(MMU_USER_IDX);
-    uint8_t tlb_v0 = FIELD_EX64(tlb->tlb_entry0, TLBENTRY, V);
-    uint8_t tlb_v1 = FIELD_EX64(tlb->tlb_entry1, TLBENTRY, V);
     uint64_t tlb_vppn = FIELD_EX64(tlb->tlb_misc, TLB_MISC, VPPN);
+    bool tlb_v;
 
     tlb_ps = FIELD_EX64(tlb->tlb_misc, TLB_MISC, PS);
     pagesize = MAKE_64BIT_MASK(tlb_ps, 1);
@@ -124,12 +123,14 @@ static void invalidate_tlb_entry(CPULoongArchState *env, int index)
     addr = (tlb_vppn << R_TLB_MISC_VPPN_SHIFT) & ~mask;
     addr = sextract64(addr, 0, TARGET_VIRT_ADDR_SPACE_BITS);
 
-    if (tlb_v0) {
+    tlb_v = pte_present(env, tlb->tlb_entry0);
+    if (tlb_v) {
         tlb_flush_range_by_mmuidx(env_cpu(env), addr, pagesize,
                                   idxmap, TARGET_LONG_BITS);
     }
 
-    if (tlb_v1) {
+    tlb_v = pte_present(env, tlb->tlb_entry1);
+    if (tlb_v) {
         tlb_flush_range_by_mmuidx(env_cpu(env), addr + pagesize, pagesize,
                                   idxmap, TARGET_LONG_BITS);
     }
@@ -335,8 +336,7 @@ void helper_tlbwr(CPULoongArchState *env)
 {
     int index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
     LoongArchTLB *old, new = {};
-    bool skip_inv = false;
-    uint8_t tlb_v0, tlb_v1;
+    bool skip_inv = false, tlb_v0, tlb_v1;
 
     old = env->tlb + index;
     if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
@@ -348,8 +348,8 @@ void helper_tlbwr(CPULoongArchState *env)
     /* Check whether ASID/VPPN is the same */
     if (old->tlb_misc == new.tlb_misc) {
         /* Check whether both even/odd pages is the same or invalid */
-        tlb_v0 = FIELD_EX64(old->tlb_entry0, TLBENTRY, V);
-        tlb_v1 = FIELD_EX64(old->tlb_entry1, TLBENTRY, V);
+        tlb_v0 = pte_present(env, old->tlb_entry0);
+        tlb_v1 = pte_present(env, old->tlb_entry1);
         if ((!tlb_v0 || new.tlb_entry0 == old->tlb_entry0) &&
             (!tlb_v1 || new.tlb_entry1 == old->tlb_entry1)) {
             skip_inv = true;

From 261612da4eec561f0745d557345c013a78c109bd Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 30 Sep 2025 09:43:56 +0800
Subject: [PATCH 1542/2396] target/loongarch: Add function sptw_prepare_tlb
 before adding tlb entry

With software page table walker, tlb entry comes from CSR registers.
however with hardware page table walker, tlb entry comes from page
table entry information directly, TLB CSR registers are not necessary.

Here add function sptw_prepare_context(), get tlb entry information
from TLB CSR registers.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-mmu.h        |  1 +
 target/loongarch/tcg/tlb_helper.c | 23 +++++++++++++++++++++--
 2 files changed, 22 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index 4ba82a7f81..aa43e57128 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -25,6 +25,7 @@ typedef struct MMUContext {
     hwaddr        physical;
     int           ps;  /* page size shift */
     int           prot;
+    uint64_t      pte_buddy[2];
 } MMUContext;
 
 static inline bool cpu_has_ptw(CPULoongArchState *env)
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index bc89a4d5ee..f42bbcde67 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -159,10 +159,10 @@ static void invalidate_tlb(CPULoongArchState *env, int index)
     invalidate_tlb_entry(env, index);
 }
 
-static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb)
+/* Prepare tlb entry information in software PTW mode */
+static void sptw_prepare_context(CPULoongArchState *env, MMUContext *context)
 {
     uint64_t lo0, lo1, csr_vppn;
-    uint16_t csr_asid;
     uint8_t csr_ps;
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
@@ -185,6 +185,25 @@ static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb)
         lo1 = env->CSR_TLBELO1;
     }
 
+    context->ps = csr_ps;
+    context->addr = csr_vppn << R_TLB_MISC_VPPN_SHIFT;
+    context->pte_buddy[0] = lo0;
+    context->pte_buddy[1] = lo1;
+}
+
+static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb)
+{
+    uint64_t lo0, lo1, csr_vppn;
+    uint16_t csr_asid;
+    uint8_t csr_ps;
+    MMUContext context;
+
+    sptw_prepare_context(env, &context);
+    csr_vppn = context.addr >> R_TLB_MISC_VPPN_SHIFT;
+    csr_ps   = context.ps;
+    lo0      = context.pte_buddy[0];
+    lo1      = context.pte_buddy[1];
+
     /* Store page size in field PS */
     tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, PS, csr_ps);
     tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, VPPN, csr_vppn);

From f19c905b92dbda4623a9e6874e63433564947b9a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Oct 2025 11:37:32 +0800
Subject: [PATCH 1543/2396] target/loongarch: target/loongarch: Add common
 function get_tlb_random_index()

With software PTW system, tlb index is calculated randomly when new
TLB entry is added. For hardware PTW, it is the same logic to add
new TLB entry.

Here common function get_tlb_random_index() is added to get random
tlb index when adding new TLB entry.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 39 +++++++++++++++++++------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index f42bbcde67..dd1a92d28d 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -383,31 +383,21 @@ void helper_tlbwr(CPULoongArchState *env)
     *old = new;
 }
 
-void helper_tlbfill(CPULoongArchState *env)
+static int get_tlb_random_index(CPULoongArchState *env, vaddr addr,
+                                int pagesize)
 {
-    uint64_t address, entryhi;
+    uint64_t address;
     int index, set, i, stlb_idx;
-    uint16_t pagesize, stlb_ps;
-    uint16_t asid, tlb_asid;
+    uint16_t asid, tlb_asid, stlb_ps;
     LoongArchTLB *tlb;
     uint8_t tlb_e, tlb_g;
 
-    if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
-        entryhi = env->CSR_TLBREHI;
-        /* Validity of pagesize is checked in helper_ldpte() */
-        pagesize = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI, PS);
-    } else {
-        entryhi = env->CSR_TLBEHI;
-        /* Validity of pagesize is checked in helper_tlbrd() */
-        pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
-    }
-
     /* Validity of stlb_ps is checked in helper_csrwr_stlbps() */
     stlb_ps = FIELD_EX64(env->CSR_STLBPS, CSR_STLBPS, PS);
     asid = FIELD_EX64(env->CSR_ASID, CSR_ASID, ASID);
     if (pagesize == stlb_ps) {
         /* Only write into STLB bits [47:13] */
-        address = entryhi & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_64_VPPN_SHIFT);
+        address = addr & ~MAKE_64BIT_MASK(0, R_CSR_TLBEHI_64_VPPN_SHIFT);
         set = -1;
         stlb_idx = (address >> (stlb_ps + 1)) & 0xff; /* [0,255] */
         for (i = 0; i < 8; ++i) {
@@ -454,6 +444,25 @@ void helper_tlbfill(CPULoongArchState *env)
         }
     }
 
+    return index;
+}
+
+void helper_tlbfill(CPULoongArchState *env)
+{
+    vaddr entryhi;
+    int index, pagesize;
+
+    if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
+        entryhi = env->CSR_TLBREHI;
+        /* Validity of pagesize is checked in helper_ldpte() */
+        pagesize = FIELD_EX64(env->CSR_TLBREHI, CSR_TLBREHI, PS);
+    } else {
+        entryhi = env->CSR_TLBEHI;
+        /* Validity of pagesize is checked in helper_tlbrd() */
+        pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
+    }
+
+    index = get_tlb_random_index(env, entryhi, pagesize);
     invalidate_tlb(env, index);
     fill_tlb_entry(env, env->tlb + index);
 }

From 117767df98d7607bfebf10676aab39d7ebc7280e Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 30 Sep 2025 10:16:22 +0800
Subject: [PATCH 1544/2396] target/loongarch: Add MMUContext parameter in
 fill_tlb_entry()

Function fill_tlb_entry() can be used with hardware PTW in future,
here add input parameter MMUContext in fill_tlb_entry().

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 21 ++++++++++++---------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index dd1a92d28d..cdde721a21 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -191,18 +191,17 @@ static void sptw_prepare_context(CPULoongArchState *env, MMUContext *context)
     context->pte_buddy[1] = lo1;
 }
 
-static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb)
+static void fill_tlb_entry(CPULoongArchState *env, LoongArchTLB *tlb,
+                           MMUContext *context)
 {
     uint64_t lo0, lo1, csr_vppn;
     uint16_t csr_asid;
     uint8_t csr_ps;
-    MMUContext context;
 
-    sptw_prepare_context(env, &context);
-    csr_vppn = context.addr >> R_TLB_MISC_VPPN_SHIFT;
-    csr_ps   = context.ps;
-    lo0      = context.pte_buddy[0];
-    lo1      = context.pte_buddy[1];
+    csr_vppn = context->addr >> R_TLB_MISC_VPPN_SHIFT;
+    csr_ps   = context->ps;
+    lo0      = context->pte_buddy[0];
+    lo1      = context->pte_buddy[1];
 
     /* Store page size in field PS */
     tlb->tlb_misc = FIELD_DP64(tlb->tlb_misc, TLB_MISC, PS, csr_ps);
@@ -356,6 +355,7 @@ void helper_tlbwr(CPULoongArchState *env)
     int index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
     LoongArchTLB *old, new = {};
     bool skip_inv = false, tlb_v0, tlb_v1;
+    MMUContext context;
 
     old = env->tlb + index;
     if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
@@ -363,7 +363,8 @@ void helper_tlbwr(CPULoongArchState *env)
         return;
     }
 
-    fill_tlb_entry(env, &new);
+    sptw_prepare_context(env, &context);
+    fill_tlb_entry(env, &new, &context);
     /* Check whether ASID/VPPN is the same */
     if (old->tlb_misc == new.tlb_misc) {
         /* Check whether both even/odd pages is the same or invalid */
@@ -451,6 +452,7 @@ void helper_tlbfill(CPULoongArchState *env)
 {
     vaddr entryhi;
     int index, pagesize;
+    MMUContext context;
 
     if (FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR)) {
         entryhi = env->CSR_TLBREHI;
@@ -462,9 +464,10 @@ void helper_tlbfill(CPULoongArchState *env)
         pagesize = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, PS);
     }
 
+    sptw_prepare_context(env, &context);
     index = get_tlb_random_index(env, entryhi, pagesize);
     invalidate_tlb(env, index);
-    fill_tlb_entry(env, env->tlb + index);
+    fill_tlb_entry(env, env->tlb + index, &context);
 }
 
 void helper_tlbclr(CPULoongArchState *env)

From 72c29e7a917560b92da4e95b93aca53f73651487 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 30 Sep 2025 10:19:15 +0800
Subject: [PATCH 1545/2396] target/loongarch: Add debug parameter with
 loongarch_page_table_walker()

Add debug parameter with function loongarch_page_table_walker(),
in debug mode it is only to get physical address. And It used in
future HW PTW usage, bit dirty and access will be updated in HW
PTW mode.

Also function loongarch_page_table_walker() is renamed as
loongarch_ptw() for short.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 5165c44c7d..8af6ee7fb1 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -106,9 +106,8 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
     return TLBRET_MATCH;
 }
 
-static TLBRet loongarch_page_table_walker(CPULoongArchState *env,
-                                          MMUContext *context,
-                                          int access_type, int mmu_idx)
+static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
+                            int access_type, int mmu_idx, int debug)
 {
     CPUState *cs = env_cpu(env);
     target_ulong index, phys;
@@ -184,7 +183,7 @@ static TLBRet loongarch_map_address(CPULoongArchState *env,
          * legal mapping, even if the mapping is not yet in TLB. return 0 if
          * there is a valid map, else none zero.
          */
-        return loongarch_page_table_walker(env, context, access_type, mmu_idx);
+        return loongarch_ptw(env, context, access_type, mmu_idx, is_debug);
     }
 
     return TLBRET_NOMATCH;

From 6c66c390f9d9d6f60eac13a98f2c31d84a36bc3a Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 27 Aug 2025 11:53:07 +0800
Subject: [PATCH 1546/2396] target/loongarch: Reserve higher 48 bit PTE
 attribute with huge page

With PTE entry, high bit 48-63 is valid HW bit for PTE attribute,
for example bit 63 is RPLV and bit 62 is NX. With page directory table,
it is physical address of page table from view of HW, so high bit
48-63 need be discarded.

Here reverve high bit 48-63 with huge page since it is PTE entry, and
only discard it with page directory table.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 8af6ee7fb1..8388bfb782 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -134,10 +134,13 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
         /* get next level page directory */
         index = (address >> dir_base) & ((1 << dir_width) - 1);
         phys = base | index << 3;
-        base = ldq_phys(cs->as, phys) & TARGET_PHYS_MASK;
+        base = ldq_phys(cs->as, phys);
         if (FIELD_EX64(base, TLBENTRY, HUGE)) {
             /* base is a huge pte */
             break;
+        } else {
+            /* Discard high bits with page directory table */
+            base &= TARGET_PHYS_MASK;
         }
     }
 

From 6f6925aa36611f966b1a58ae8eb03d2dd8197c64 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 27 Aug 2025 12:11:02 +0800
Subject: [PATCH 1547/2396] target/loongarch: Move last PTE lookup into page
 table walker loop

The last PTE lookup sentence is much similiar with the whole page
table walker loop, move it into the whole loop.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu_helper.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 8388bfb782..520fd74b2b 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -124,7 +124,7 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
     }
     base &= TARGET_PHYS_MASK;
 
-    for (level = 4; level > 0; level--) {
+    for (level = 4; level >= 0; level--) {
         get_dir_base_width(env, &dir_base, &dir_width, level);
 
         if (dir_width == 0) {
@@ -135,17 +135,19 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
         index = (address >> dir_base) & ((1 << dir_width) - 1);
         phys = base | index << 3;
         base = ldq_phys(cs->as, phys);
-        if (FIELD_EX64(base, TLBENTRY, HUGE)) {
-            /* base is a huge pte */
-            break;
-        } else {
-            /* Discard high bits with page directory table */
-            base &= TARGET_PHYS_MASK;
+        if (level) {
+            if (FIELD_EX64(base, TLBENTRY, HUGE)) {
+                /* base is a huge pte */
+                break;
+            } else {
+                /* Discard high bits with page directory table */
+                base &= TARGET_PHYS_MASK;
+            }
         }
     }
 
     /* pte */
-    if (FIELD_EX64(base, TLBENTRY, HUGE)) {
+    if (level > 0) {
         /* Huge Page. base is pte */
         base = FIELD_DP64(base, TLBENTRY, LEVEL, 0);
         base = FIELD_DP64(base, TLBENTRY, HUGE, 0);
@@ -153,12 +155,6 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
             base = FIELD_DP64(base, TLBENTRY, HGLOBAL, 0);
             base = FIELD_DP64(base, TLBENTRY, G, 1);
         }
-    } else {
-        /* Normal Page. base points to pte */
-        get_dir_base_width(env, &dir_base, &dir_width, 0);
-        index = (address >> dir_base) & ((1 << dir_width) - 1);
-        phys = base | index << 3;
-        base = ldq_phys(cs->as, phys);
     }
 
     context->ps = dir_base;

From 52c60ad5f0977951786b5a8b68835ed950016279 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Tue, 30 Sep 2025 10:41:23 +0800
Subject: [PATCH 1548/2396] target/loongarch: Add field tlb_index to record TLB
 search info

With hardware PTW function, TLB entry will be searched at first.
If there is odd/even page on one TLB entry, and odd page is valid and
even page is none. When software access memory with address in even
page, hardware PTW will happen and fill new entry in the same TLB entry.

Here add field tlb_index to record TLB index when search TLB tables.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-mmu.h        | 2 ++
 target/loongarch/cpu_helper.c     | 3 +++
 target/loongarch/tcg/tlb_helper.c | 1 +
 3 files changed, 6 insertions(+)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index aa43e57128..3d6ae6cf2c 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -25,6 +25,8 @@ typedef struct MMUContext {
     hwaddr        physical;
     int           ps;  /* page size shift */
     int           prot;
+    int           tlb_index;
+    int           mmu_index;
     uint64_t      pte_buddy[2];
 } MMUContext;
 
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 520fd74b2b..caad357adf 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -97,6 +97,7 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
     context->physical = (tlb_ppn << R_TLBENTRY_64_PPN_SHIFT) |
                         (context->addr & MAKE_64BIT_MASK(0, tlb_ps));
     context->prot = PAGE_READ;
+    context->mmu_index = tlb_plv;
     if (tlb_d) {
         context->prot |= PAGE_WRITE;
     }
@@ -216,6 +217,7 @@ TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
     if (da & !pg) {
         context->physical = address & TARGET_PHYS_MASK;
         context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+        context->mmu_index = MMU_DA_IDX;
         return TLBRET_MATCH;
     }
 
@@ -235,6 +237,7 @@ TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
         if ((plv & env->CSR_DMW[i]) && (base_c == base_v)) {
             context->physical = dmw_va2pa(env, address, env->CSR_DMW[i]);
             context->prot = PAGE_READ | PAGE_WRITE | PAGE_EXEC;
+            context->mmu_index = MMU_DA_IDX;
             return TLBRET_MATCH;
         }
     }
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index cdde721a21..8d962ce3e3 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -746,6 +746,7 @@ static TLBRet loongarch_map_tlb_entry(CPULoongArchState *env,
     n = (context->addr >> tlb_ps) & 0x1;/* Odd or even */
     context->pte = n ? tlb->tlb_entry1 : tlb->tlb_entry0;
     context->ps = tlb_ps;
+    context->tlb_index = index;
     return loongarch_check_pte(env, context, access_type, mmu_idx);
 }
 

From d0472b89ba1664562081357692e6c51a09583a84 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 9 Oct 2025 14:54:33 +0800
Subject: [PATCH 1549/2396] target/loongarch: Add common interface
 update_tlb_index()

Common API update_tlb_index() is added here, it is to update TLB entry
with specified index. It is called by helper_tlbwr() now, also it can
be used by HW PTW when adding new TLB entry.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 8d962ce3e3..92f89841b0 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -350,21 +350,14 @@ void helper_tlbrd(CPULoongArchState *env)
     }
 }
 
-void helper_tlbwr(CPULoongArchState *env)
+static void update_tlb_index(CPULoongArchState *env, MMUContext *context,
+                             int index)
 {
-    int index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
     LoongArchTLB *old, new = {};
     bool skip_inv = false, tlb_v0, tlb_v1;
-    MMUContext context;
 
     old = env->tlb + index;
-    if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
-        invalidate_tlb(env, index);
-        return;
-    }
-
-    sptw_prepare_context(env, &context);
-    fill_tlb_entry(env, &new, &context);
+    fill_tlb_entry(env, &new, context);
     /* Check whether ASID/VPPN is the same */
     if (old->tlb_misc == new.tlb_misc) {
         /* Check whether both even/odd pages is the same or invalid */
@@ -384,6 +377,20 @@ void helper_tlbwr(CPULoongArchState *env)
     *old = new;
 }
 
+void helper_tlbwr(CPULoongArchState *env)
+{
+    int index = FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, INDEX);
+    MMUContext context;
+
+    if (FIELD_EX64(env->CSR_TLBIDX, CSR_TLBIDX, NE)) {
+        invalidate_tlb(env, index);
+        return;
+    }
+
+    sptw_prepare_context(env, &context);
+    update_tlb_index(env, &context, index);
+}
+
 static int get_tlb_random_index(CPULoongArchState *env, vaddr addr,
                                 int pagesize)
 {

From 1158eb13f128d021d76ed19c44799f293ce26126 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Thu, 23 Oct 2025 17:23:09 +0800
Subject: [PATCH 1550/2396] target/loongarch: Add basic hardware PTW support

However with hardware PTW supported, hardware will search page table
with TLB miss. Also if there is no TLB miss however bit Present is not set,
hardware PTW will happen also. Because there is odd/even page in one TLB
entry on LoongArch system, for example in the first time odd TLB entry is
valid and even TLB entry is 0. When software accesses with address within
even page, there is no TLB miss only that TLB entry is 0. In this
condition, hardwre PTW will happen also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-mmu.h        |  2 ++
 target/loongarch/cpu_helper.c     | 17 ++++++++++++++---
 target/loongarch/tcg/tlb_helper.c | 25 +++++++++++++++++++++++++
 3 files changed, 41 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index 3d6ae6cf2c..158bb61429 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -67,6 +67,8 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
 TLBRet get_physical_address(CPULoongArchState *env, MMUContext *context,
                             MMUAccessType access_type, int mmu_idx,
                             int is_debug);
+TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
+                     int access_type, int mmu_idx, int debug);
 void get_dir_base_width(CPULoongArchState *env, uint64_t *dir_base,
                         uint64_t *dir_width, unsigned int level);
 hwaddr loongarch_cpu_get_phys_page_debug(CPUState *cpu, vaddr addr);
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index caad357adf..55efe44cb4 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -107,11 +107,11 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
     return TLBRET_MATCH;
 }
 
-static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
-                            int access_type, int mmu_idx, int debug)
+TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
+                     int access_type, int mmu_idx, int debug)
 {
     CPUState *cs = env_cpu(env);
-    target_ulong index, phys;
+    target_ulong index = 0, phys = 0;
     uint64_t dir_base, dir_width;
     uint64_t base;
     int level;
@@ -139,6 +139,8 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
         if (level) {
             if (FIELD_EX64(base, TLBENTRY, HUGE)) {
                 /* base is a huge pte */
+                index = 0;
+                dir_base -= 1;
                 break;
             } else {
                 /* Discard high bits with page directory table */
@@ -156,6 +158,15 @@ static TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
             base = FIELD_DP64(base, TLBENTRY, HGLOBAL, 0);
             base = FIELD_DP64(base, TLBENTRY, G, 1);
         }
+
+        context->pte_buddy[index] = base;
+        context->pte_buddy[1 - index] = base + BIT_ULL(dir_base);
+        base += (BIT_ULL(dir_base) & address);
+    } else if (cpu_has_ptw(env)) {
+        index &= 1;
+        context->pte_buddy[index] = base;
+        context->pte_buddy[1 - index] = ldq_phys(cs->as,
+                                            phys + 8 * (1 - 2 * index));
     }
 
     context->ps = dir_base;
diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 92f89841b0..1f3aaaa41d 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -601,6 +601,18 @@ void helper_invtlb_page_asid_or_g(CPULoongArchState *env,
     }
 }
 
+static void ptw_update_tlb(CPULoongArchState *env, MMUContext *context)
+{
+    int index;
+
+    index = context->tlb_index;
+    if (index < 0) {
+        index = get_tlb_random_index(env, context->addr, context->ps);
+    }
+
+    update_tlb_index(env, context, index);
+}
+
 bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
                             MMUAccessType access_type, int mmu_idx,
                             bool probe, uintptr_t retaddr)
@@ -613,7 +625,20 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
 
     /* Data access */
     context.addr = address;
+    context.tlb_index = -1;
     ret = get_physical_address(env, &context, access_type, mmu_idx, 0);
+    if (ret != TLBRET_MATCH && cpu_has_ptw(env)) {
+        /* Take HW PTW if TLB missed or bit P is zero */
+        if (ret == TLBRET_NOMATCH || ret == TLBRET_INVALID) {
+            ret = loongarch_ptw(env, &context, access_type, mmu_idx, 0);
+            if (ret == TLBRET_MATCH) {
+                ptw_update_tlb(env, &context);
+            }
+        } else if (context.tlb_index >= 0) {
+            invalidate_tlb(env, context.tlb_index);
+        }
+    }
+
     if (ret == TLBRET_MATCH) {
         physical = context.physical;
         prot = context.prot;

From 80470b73def1f6fb24a7bcd7d43fb9bf0844721f Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Wed, 27 Aug 2025 15:04:33 +0800
Subject: [PATCH 1551/2396] target/loongarch: Update matched ptw bit A/D with
 PTW supported

With hardware PTE supported, bit A will be set if there is read access
or instruction fetch, and bit D will be set with write access.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu-mmu.h    | 26 ++++++++++
 target/loongarch/cpu_helper.c | 93 ++++++++++++++++++++++++++++++++++-
 2 files changed, 117 insertions(+), 2 deletions(-)

diff --git a/target/loongarch/cpu-mmu.h b/target/loongarch/cpu-mmu.h
index 158bb61429..2259de9d36 100644
--- a/target/loongarch/cpu-mmu.h
+++ b/target/loongarch/cpu-mmu.h
@@ -61,6 +61,32 @@ static inline bool pte_write(CPULoongArchState *env, uint64_t entry)
     return !!writable;
 }
 
+/*
+ * The folloing functions should be called with PTW enable checked
+ * With hardware PTW enabled
+ *   Bit D will be set by hardware with write access
+ *   Bit A will be set by hardware with read/intruction fetch access
+ */
+static inline uint64_t pte_mkaccess(uint64_t entry)
+{
+    return FIELD_DP64(entry, TLBENTRY, V, 1);
+}
+
+static inline uint64_t pte_mkdirty(uint64_t entry)
+{
+    return FIELD_DP64(entry, TLBENTRY, D, 1);
+}
+
+static inline bool pte_access(uint64_t entry)
+{
+    return !!FIELD_EX64(entry, TLBENTRY, V);
+}
+
+static inline bool pte_dirty(uint64_t entry)
+{
+    return !!FIELD_EX64(entry, TLBENTRY, D);
+}
+
 bool check_ps(CPULoongArchState *ent, uint8_t ps);
 TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
                            MMUAccessType access_type, int mmu_idx);
diff --git a/target/loongarch/cpu_helper.c b/target/loongarch/cpu_helper.c
index 55efe44cb4..a6eba4f416 100644
--- a/target/loongarch/cpu_helper.c
+++ b/target/loongarch/cpu_helper.c
@@ -107,15 +107,52 @@ TLBRet loongarch_check_pte(CPULoongArchState *env, MMUContext *context,
     return TLBRET_MATCH;
 }
 
+static MemTxResult loongarch_cmpxchg_phys(CPUState *cs, hwaddr phys,
+                                          uint64_t old, uint64_t new)
+{
+    hwaddr addr1, l = 8;
+    MemoryRegion *mr;
+    uint8_t *ram_ptr;
+    uint64_t old1;
+    MemTxResult ret;
+
+    rcu_read_lock();
+    mr = address_space_translate(cs->as, phys, &addr1, &l,
+                                 false, MEMTXATTRS_UNSPECIFIED);
+    if (!memory_region_is_ram(mr)) {
+        /*
+         * Misconfigured PTE in ROM (AD bits are not preset) or
+         * PTE is in IO space and can't be updated atomically.
+         */
+         rcu_read_unlock();
+         return MEMTX_ACCESS_ERROR;
+    }
+
+    ram_ptr = qemu_map_ram_ptr(mr->ram_block, addr1);
+    old1 = qatomic_cmpxchg((uint64_t *)ram_ptr, cpu_to_le64(old),
+                           cpu_to_le64(new));
+    old1 = le64_to_cpu(old1);
+    if (old1 == old) {
+        ret = MEMTX_OK;
+    } else {
+        ret = MEMTX_DECODE_ERROR;
+    }
+    rcu_read_unlock();
+
+    return ret;
+}
+
 TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
                      int access_type, int mmu_idx, int debug)
 {
     CPUState *cs = env_cpu(env);
     target_ulong index = 0, phys = 0;
     uint64_t dir_base, dir_width;
-    uint64_t base;
+    uint64_t base, pte;
     int level;
     vaddr address;
+    TLBRet ret;
+    MemTxResult ret1;
 
     address = context->addr;
     if ((address >> 63) & 0x1) {
@@ -149,7 +186,9 @@ TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
         }
     }
 
+restart:
     /* pte */
+    pte = base;
     if (level > 0) {
         /* Huge Page. base is pte */
         base = FIELD_DP64(base, TLBENTRY, LEVEL, 0);
@@ -171,7 +210,57 @@ TLBRet loongarch_ptw(CPULoongArchState *env, MMUContext *context,
 
     context->ps = dir_base;
     context->pte = base;
-    return loongarch_check_pte(env, context, access_type, mmu_idx);
+    ret = loongarch_check_pte(env, context, access_type, mmu_idx);
+    if (debug) {
+        return ret;
+    }
+
+    /*
+     * Update bit A/D with hardware PTW supported
+     *
+     * Need atomic compchxg operation with pte update, other vCPUs may
+     * update pte at the same time.
+     */
+    if (ret == TLBRET_MATCH && cpu_has_ptw(env)) {
+        if (access_type == MMU_DATA_STORE && pte_dirty(base)) {
+            return ret;
+        }
+
+        if (access_type != MMU_DATA_STORE && pte_access(base)) {
+            return ret;
+        }
+
+        base = pte_mkaccess(pte);
+        if (access_type == MMU_DATA_STORE) {
+            base = pte_mkdirty(base);
+        }
+        ret1 = loongarch_cmpxchg_phys(cs, phys, pte, base);
+        /* PTE updated by other CPU, reload PTE entry */
+        if (ret1 == MEMTX_DECODE_ERROR) {
+            base = ldq_phys(cs->as, phys);
+            goto restart;
+        }
+
+        base = context->pte_buddy[index];
+        base = pte_mkaccess(base);
+        if (access_type == MMU_DATA_STORE) {
+            base = pte_mkdirty(base);
+        }
+        context->pte_buddy[index] = base;
+
+        /* Bit A/D need be updated with both Even/Odd page with huge pte */
+        if (level > 0) {
+            index = 1 - index;
+            base = context->pte_buddy[index];
+            base = pte_mkaccess(base);
+            if (access_type == MMU_DATA_STORE) {
+                base = pte_mkdirty(base);
+            }
+            context->pte_buddy[index] = base;
+        }
+    }
+
+    return ret;
 }
 
 static TLBRet loongarch_map_address(CPULoongArchState *env,

From 79ff2eee9a377f654ed0c3533a0874a0e7d6226d Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Fri, 10 Oct 2025 11:11:07 +0800
Subject: [PATCH 1552/2396] target/loongarch: Add bit A/D checking in TLB entry
 with PTW supported

With read/write access, add bit A/D checking if hardware PTW is
supported. If no matched, hardware page table walk is called. And
then bit A/D is updated in PTE entry and TLB entry is updated also.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/tcg/tlb_helper.c | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/target/loongarch/tcg/tlb_helper.c b/target/loongarch/tcg/tlb_helper.c
index 1f3aaaa41d..01e0a27f0b 100644
--- a/target/loongarch/tcg/tlb_helper.c
+++ b/target/loongarch/tcg/tlb_helper.c
@@ -627,6 +627,31 @@ bool loongarch_cpu_tlb_fill(CPUState *cs, vaddr address, int size,
     context.addr = address;
     context.tlb_index = -1;
     ret = get_physical_address(env, &context, access_type, mmu_idx, 0);
+    if (ret == TLBRET_MATCH && context.mmu_index != MMU_DA_IDX
+        && cpu_has_ptw(env)) {
+        bool need_update = true;
+
+        if (access_type == MMU_DATA_STORE && pte_dirty(context.pte)) {
+            need_update = false;
+        } else if (access_type != MMU_DATA_STORE && pte_access(context.pte)) {
+            need_update = false;
+
+            /*
+             * FIXME: should context.prot be set without PAGE_WRITE with
+             * pte_write(context.pte) && !pte_dirty(context.pte)??
+             *
+             * Otherwise there will be no loongarch_cpu_tlb_fill() function call
+             * for MMU_DATA_STORE access_type in future since QEMU TLB with
+             * prot PAGE_WRITE is added already
+             */
+        }
+
+        if (need_update) {
+            /* Need update bit A/D in PTE entry, take PTW again */
+            ret = TLBRET_NOMATCH;
+        }
+    }
+
     if (ret != TLBRET_MATCH && cpu_has_ptw(env)) {
         /* Take HW PTW if TLB missed or bit P is zero */
         if (ret == TLBRET_NOMATCH || ret == TLBRET_INVALID) {

From 11b4071503a2a70f21c03892edc73f8ad029e743 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 21 Oct 2025 10:43:35 +0200
Subject: [PATCH 1553/2396] ppc/spapr: remove deprecated machine pseries-3.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pseries-3.0 had been deprecated and due for removal now as per policy.
Also remove legacy irq support which existed for pre pseries-3.1 machines.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-2-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c             | 27 +--------------------------
 hw/ppc/spapr_events.c      |  8 --------
 hw/ppc/spapr_irq.c         | 16 +---------------
 hw/ppc/spapr_pci.c         | 32 ++++----------------------------
 hw/ppc/spapr_vio.c         |  9 ---------
 include/hw/ppc/spapr.h     |  1 -
 include/hw/ppc/spapr_irq.h |  1 -
 7 files changed, 6 insertions(+), 88 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index e0a2e5a984..3728ae2a5e 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -3347,9 +3347,7 @@ static char *spapr_get_ic_mode(Object *obj, Error **errp)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 
-    if (spapr->irq == &spapr_irq_xics_legacy) {
-        return g_strdup("legacy");
-    } else if (spapr->irq == &spapr_irq_xics) {
+    if (spapr->irq == &spapr_irq_xics) {
         return g_strdup("xics");
     } else if (spapr->irq == &spapr_irq_xive) {
         return g_strdup("xive");
@@ -3363,11 +3361,6 @@ static void spapr_set_ic_mode(Object *obj, const char *value, Error **errp)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(obj);
 
-    if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-        error_setg(errp, "This machine only uses the legacy XICS backend, don't pass ic-mode");
-        return;
-    }
-
     /* The legacy IRQ backend can not be set */
     if (strcmp(value, "xics") == 0) {
         spapr->irq = &spapr_irq_xics;
@@ -5062,24 +5055,6 @@ static void spapr_machine_3_1_class_options(MachineClass *mc)
 
 DEFINE_SPAPR_MACHINE(3, 1);
 
-/*
- * pseries-3.0
- */
-
-static void spapr_machine_3_0_class_options(MachineClass *mc)
-{
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-
-    spapr_machine_3_1_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_0, hw_compat_3_0_len);
-
-    smc->legacy_irq_allocation = true;
-    smc->nr_xirqs = 0x400;
-    smc->irq = &spapr_irq_xics_legacy;
-}
-
-DEFINE_SPAPR_MACHINE(3, 0);
-
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 832b0212f3..548a190ce8 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -1043,10 +1043,6 @@ void spapr_events_init(SpaprMachineState *spapr)
 {
     int epow_irq = SPAPR_IRQ_EPOW;
 
-    if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-        epow_irq = spapr_irq_findone(spapr, &error_fatal);
-    }
-
     spapr_irq_claim(spapr, epow_irq, false, &error_fatal);
 
     QTAILQ_INIT(&spapr->pending_events);
@@ -1067,10 +1063,6 @@ void spapr_events_init(SpaprMachineState *spapr)
     if (spapr->use_hotplug_event_source) {
         int hp_irq = SPAPR_IRQ_HOTPLUG;
 
-        if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-            hp_irq = spapr_irq_findone(spapr, &error_fatal);
-        }
-
         spapr_irq_claim(spapr, hp_irq, false, &error_fatal);
 
         spapr_event_sources_register(spapr->event_sources, EVENT_CLASS_HOT_PLUG,
diff --git a/hw/ppc/spapr_irq.c b/hw/ppc/spapr_irq.c
index d6d368dd08..317d57a380 100644
--- a/hw/ppc/spapr_irq.c
+++ b/hw/ppc/spapr_irq.c
@@ -33,11 +33,6 @@ static const TypeInfo spapr_intc_info = {
 
 static void spapr_irq_msi_init(SpaprMachineState *spapr)
 {
-    if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-        /* Legacy mode doesn't use this allocator */
-        return;
-    }
-
     spapr->irq_map_nr = spapr_irq_nr_msis(spapr);
     spapr->irq_map = bitmap_new(spapr->irq_map_nr);
 }
@@ -286,11 +281,7 @@ uint32_t spapr_irq_nr_msis(SpaprMachineState *spapr)
 {
     SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
 
-    if (smc->legacy_irq_allocation) {
-        return smc->nr_xirqs;
-    } else {
-        return SPAPR_XIRQ_BASE + smc->nr_xirqs - SPAPR_IRQ_MSI;
-    }
+    return SPAPR_XIRQ_BASE + smc->nr_xirqs - SPAPR_IRQ_MSI;
 }
 
 void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
@@ -588,11 +579,6 @@ int spapr_irq_find(SpaprMachineState *spapr, int num, bool align, Error **errp)
     return first + ics->offset;
 }
 
-SpaprIrq spapr_irq_xics_legacy = {
-    .xics        = true,
-    .xive        = false,
-};
-
 static void spapr_irq_register_types(void)
 {
     type_register_static(&spapr_intc_info);
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index f9095552e8..bdec8f0728 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -268,7 +268,6 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, SpaprMachineState *spapr,
                                 target_ulong args, uint32_t nret,
                                 target_ulong rets)
 {
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     uint32_t config_addr = rtas_ld(args, 0);
     uint64_t buid = rtas_ldq(args, 1);
     unsigned int func = rtas_ld(args, 3);
@@ -373,13 +372,8 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, SpaprMachineState *spapr,
     }
 
     /* Allocate MSIs */
-    if (smc->legacy_irq_allocation) {
-        irq = spapr_irq_find(spapr, req_num, ret_intr_type == RTAS_TYPE_MSI,
-                             &err);
-    } else {
-        irq = spapr_irq_msi_alloc(spapr, req_num,
-                                  ret_intr_type == RTAS_TYPE_MSI, &err);
-    }
+    irq = spapr_irq_msi_alloc(spapr, req_num,
+                              ret_intr_type == RTAS_TYPE_MSI, &err);
     if (err) {
         error_reportf_err(err, "Can't allocate MSIs for device %x: ",
                           config_addr);
@@ -393,9 +387,7 @@ static void rtas_ibm_change_msi(PowerPCCPU *cpu, SpaprMachineState *spapr,
             if (i) {
                 spapr_irq_free(spapr, irq, i);
             }
-            if (!smc->legacy_irq_allocation) {
-                spapr_irq_msi_free(spapr, irq, req_num);
-            }
+            spapr_irq_msi_free(spapr, irq, req_num);
             error_reportf_err(err, "Can't allocate MSIs for device %x: ",
                               config_addr);
             rtas_st(rets, 0, RTAS_OUT_HW_ERROR);
@@ -1789,12 +1781,9 @@ static void spapr_phb_unrealize(DeviceState *dev)
 static void spapr_phb_destroy_msi(gpointer opaque)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(qdev_get_machine());
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     SpaprPciMsi *msi = opaque;
 
-    if (!smc->legacy_irq_allocation) {
-        spapr_irq_msi_free(spapr, msi->first_irq, msi->num);
-    }
+    spapr_irq_msi_free(spapr, msi->first_irq, msi->num);
     spapr_irq_free(spapr, msi->first_irq, msi->num);
     g_free(msi);
 }
@@ -1808,7 +1797,6 @@ static void spapr_phb_realize(DeviceState *dev, Error **errp)
     SpaprMachineState *spapr =
         (SpaprMachineState *) object_dynamic_cast(qdev_get_machine(),
                                                   TYPE_SPAPR_MACHINE);
-    SpaprMachineClass *smc = spapr ? SPAPR_MACHINE_GET_CLASS(spapr) : NULL;
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(sbd);
     PCIHostState *phb = PCI_HOST_BRIDGE(sbd);
@@ -1956,18 +1944,6 @@ static void spapr_phb_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < PCI_NUM_PINS; i++) {
         int irq = SPAPR_IRQ_PCI_LSI + sphb->index * PCI_NUM_PINS + i;
 
-        if (smc->legacy_irq_allocation) {
-            irq = spapr_irq_findone(spapr, errp);
-            if (irq < 0) {
-                error_prepend(errp, "can't allocate LSIs: ");
-                /*
-                 * Older machines will never support PHB hotplug, ie, this is an
-                 * init only path and QEMU will terminate. No need to rollback.
-                 */
-                return;
-            }
-        }
-
         if (spapr_irq_claim(spapr, irq, true, errp) < 0) {
             error_prepend(errp, "can't allocate LSIs: ");
             goto unrealize;
diff --git a/hw/ppc/spapr_vio.c b/hw/ppc/spapr_vio.c
index 7759436a4f..c21a2a3274 100644
--- a/hw/ppc/spapr_vio.c
+++ b/hw/ppc/spapr_vio.c
@@ -507,15 +507,6 @@ static void spapr_vio_busdev_realize(DeviceState *qdev, Error **errp)
 
     dev->irq = spapr_vio_reg_to_irq(dev->reg);
 
-    if (SPAPR_MACHINE_GET_CLASS(spapr)->legacy_irq_allocation) {
-        int irq = spapr_irq_findone(spapr, errp);
-
-        if (irq < 0) {
-            return;
-        }
-        dev->irq = irq;
-    }
-
     if (spapr_irq_claim(spapr, dev->irq, false, errp) < 0) {
         return;
     }
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 39bd5bd5ed..0c1e5132de 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -145,7 +145,6 @@ struct SpaprMachineClass {
     /*< public >*/
     bool dr_phb_enabled;       /* enable dynamic-reconfig/hotplug of PHBs */
     bool update_dt_enabled;    /* enable KVMPPC_H_UPDATE_DT */
-    bool legacy_irq_allocation;
     uint32_t nr_xirqs;
     bool broken_host_serial_model; /* present real host info to the guest */
     bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
diff --git a/include/hw/ppc/spapr_irq.h b/include/hw/ppc/spapr_irq.h
index cb9a85f657..5ddd1107c3 100644
--- a/include/hw/ppc/spapr_irq.h
+++ b/include/hw/ppc/spapr_irq.h
@@ -100,7 +100,6 @@ typedef struct SpaprIrq {
 } SpaprIrq;
 
 extern SpaprIrq spapr_irq_xics;
-extern SpaprIrq spapr_irq_xics_legacy;
 extern SpaprIrq spapr_irq_xive;
 extern SpaprIrq spapr_irq_dual;
 

From d9b3b2079a2d7418b8f47e745326bfefc76b05bf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:36 +0200
Subject: [PATCH 1554/2396] hw/ppc/spapr: Remove SpaprMachineClass::nr_xirqs
 field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SpaprMachineClass::nr_xirqs field was only used by the
pseries-3.0 machine, which got removed. Remove it as now unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-3-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         |  1 -
 hw/ppc/spapr_irq.c     | 22 +++++++---------------
 include/hw/ppc/spapr.h |  1 -
 3 files changed, 7 insertions(+), 17 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 3728ae2a5e..7be7fdaed8 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4691,7 +4691,6 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
     smc->dr_phb_enabled = true;
     smc->linux_pci_probe = true;
     smc->smp_threads_vsmt = true;
-    smc->nr_xirqs = SPAPR_NR_XIRQS;
     xfc->match_nvt = spapr_match_nvt;
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
diff --git a/hw/ppc/spapr_irq.c b/hw/ppc/spapr_irq.c
index 317d57a380..2ce323457b 100644
--- a/hw/ppc/spapr_irq.c
+++ b/hw/ppc/spapr_irq.c
@@ -279,15 +279,11 @@ void spapr_irq_dt(SpaprMachineState *spapr, uint32_t nr_servers,
 
 uint32_t spapr_irq_nr_msis(SpaprMachineState *spapr)
 {
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
-
-    return SPAPR_XIRQ_BASE + smc->nr_xirqs - SPAPR_IRQ_MSI;
+    return SPAPR_NR_XIRQS + SPAPR_XIRQ_BASE - SPAPR_IRQ_MSI;
 }
 
 void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
 {
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
-
     if (kvm_enabled() && kvm_kernel_irqchip_split()) {
         error_setg(errp, "kernel_irqchip split mode not supported on pseries");
         return;
@@ -308,7 +304,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
         object_property_add_child(OBJECT(spapr), "ics", obj);
         object_property_set_link(obj, ICS_PROP_XICS, OBJECT(spapr),
                                  &error_abort);
-        object_property_set_int(obj, "nr-irqs", smc->nr_xirqs, &error_abort);
+        object_property_set_int(obj, "nr-irqs", SPAPR_NR_XIRQS, &error_abort);
         if (!qdev_realize(DEVICE(obj), NULL, errp)) {
             return;
         }
@@ -322,7 +318,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
         int i;
 
         dev = qdev_new(TYPE_SPAPR_XIVE);
-        qdev_prop_set_uint32(dev, "nr-irqs", smc->nr_xirqs + SPAPR_IRQ_NR_IPIS);
+        qdev_prop_set_uint32(dev, "nr-irqs", SPAPR_NR_XIRQS + SPAPR_IRQ_NR_IPIS);
         /*
          * 8 XIVE END structures per CPU. One for each available
          * priority
@@ -349,7 +345,7 @@ void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
     }
 
     spapr->qirqs = qemu_allocate_irqs(spapr_set_irq, spapr,
-                                      smc->nr_xirqs + SPAPR_IRQ_NR_IPIS);
+                                      SPAPR_NR_XIRQS + SPAPR_IRQ_NR_IPIS);
 
     /*
      * Mostly we don't actually need this until reset, except that not
@@ -364,11 +360,10 @@ int spapr_irq_claim(SpaprMachineState *spapr, int irq, bool lsi, Error **errp)
 {
     SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
     int i;
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     int rc;
 
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert(irq < (smc->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert(irq < (SPAPR_NR_XIRQS + SPAPR_XIRQ_BASE));
 
     for (i = 0; i < ARRAY_SIZE(intcs); i++) {
         SpaprInterruptController *intc = intcs[i];
@@ -388,10 +383,9 @@ void spapr_irq_free(SpaprMachineState *spapr, int irq, int num)
 {
     SpaprInterruptController *intcs[] = ALL_INTCS(spapr);
     int i, j;
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
 
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert((irq + num) <= (smc->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert((irq + num) <= (SPAPR_NR_XIRQS + SPAPR_XIRQ_BASE));
 
     for (i = irq; i < (irq + num); i++) {
         for (j = 0; j < ARRAY_SIZE(intcs); j++) {
@@ -408,8 +402,6 @@ void spapr_irq_free(SpaprMachineState *spapr, int irq, int num)
 
 qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq)
 {
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
-
     /*
      * This interface is basically for VIO and PHB devices to find the
      * right qemu_irq to manipulate, so we only allow access to the
@@ -418,7 +410,7 @@ qemu_irq spapr_qirq(SpaprMachineState *spapr, int irq)
      * interfaces, we can change this if we need to in future.
      */
     assert(irq >= SPAPR_XIRQ_BASE);
-    assert(irq < (smc->nr_xirqs + SPAPR_XIRQ_BASE));
+    assert(irq < (SPAPR_NR_XIRQS + SPAPR_XIRQ_BASE));
 
     if (spapr->ics) {
         assert(ics_valid_irq(spapr->ics, irq));
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 0c1e5132de..494367fb99 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -145,7 +145,6 @@ struct SpaprMachineClass {
     /*< public >*/
     bool dr_phb_enabled;       /* enable dynamic-reconfig/hotplug of PHBs */
     bool update_dt_enabled;    /* enable KVMPPC_H_UPDATE_DT */
-    uint32_t nr_xirqs;
     bool broken_host_serial_model; /* present real host info to the guest */
     bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
     bool linux_pci_probe;

From ca9c5112f640f85524d0a3cc16a44e96eb69fb38 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 21 Oct 2025 10:43:37 +0200
Subject: [PATCH 1555/2396] ppc/spapr: remove deprecated machine pseries-3.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pseries-3.1 had been deprecated and due for removal now as per policy.
Also remove backward compatibility flags and related code introduced for
pre pseries-4.0 machines.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-4-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         | 62 ++++--------------------------------------
 hw/ppc/spapr_hcall.c   |  5 ----
 include/hw/ppc/spapr.h |  3 --
 3 files changed, 5 insertions(+), 65 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 7be7fdaed8..efeea03741 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1182,7 +1182,6 @@ void *spapr_build_fdt(SpaprMachineState *spapr, bool reset, size_t space)
 {
     MachineState *machine = MACHINE(spapr);
     MachineClass *mc = MACHINE_GET_CLASS(machine);
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
     uint32_t root_drc_type_mask = 0;
     int ret;
     void *fdt;
@@ -1213,16 +1212,10 @@ void *spapr_build_fdt(SpaprMachineState *spapr, bool reset, size_t space)
     /* Host Model & Serial Number */
     if (spapr->host_model) {
         _FDT(fdt_setprop_string(fdt, 0, "host-model", spapr->host_model));
-    } else if (smc->broken_host_serial_model && kvmppc_get_host_model(&buf)) {
-        _FDT(fdt_setprop_string(fdt, 0, "host-model", buf));
-        g_free(buf);
     }
 
     if (spapr->host_serial) {
         _FDT(fdt_setprop_string(fdt, 0, "host-serial", spapr->host_serial));
-    } else if (smc->broken_host_serial_model && kvmppc_get_host_serial(&buf)) {
-        _FDT(fdt_setprop_string(fdt, 0, "host-serial", buf));
-        g_free(buf);
     }
 
     _FDT(fdt_setprop_cell(fdt, 0, "#address-cells", 2));
@@ -1260,9 +1253,8 @@ void *spapr_build_fdt(SpaprMachineState *spapr, bool reset, size_t space)
 
     /* ibm,drc-indexes and friends */
     root_drc_type_mask |= SPAPR_DR_CONNECTOR_TYPE_LMB;
-    if (smc->dr_phb_enabled) {
-        root_drc_type_mask |= SPAPR_DR_CONNECTOR_TYPE_PHB;
-    }
+    root_drc_type_mask |= SPAPR_DR_CONNECTOR_TYPE_PHB;
+
     if (mc->nvdimm_supported) {
         root_drc_type_mask |= SPAPR_DR_CONNECTOR_TYPE_PMEM;
     }
@@ -2063,9 +2055,7 @@ static const VMStateDescription vmstate_spapr_irq_map = {
 
 static bool spapr_dtb_needed(void *opaque)
 {
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(opaque);
-
-    return smc->update_dt_enabled;
+    return true; /* backward migration compat */
 }
 
 static int spapr_dtb_pre_load(void *opaque)
@@ -3009,10 +2999,8 @@ static void spapr_machine_init(MachineState *machine)
      * connectors for a PHBs PCI slots) are added as needed during their
      * parent's realization.
      */
-    if (smc->dr_phb_enabled) {
-        for (i = 0; i < SPAPR_MAX_PHBS; i++) {
-            spapr_dr_connector_new(OBJECT(machine), TYPE_SPAPR_DRC_PHB, i);
-        }
+    for (i = 0; i < SPAPR_MAX_PHBS; i++) {
+        spapr_dr_connector_new(OBJECT(machine), TYPE_SPAPR_DRC_PHB, i);
     }
 
     /* Set up PCI */
@@ -4095,11 +4083,6 @@ static bool spapr_phb_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
     const unsigned windows_supported = spapr_phb_windows_supported(sphb);
     SpaprDrc *drc;
 
-    if (dev->hotplugged && !smc->dr_phb_enabled) {
-        error_setg(errp, "PHB hotplug not supported for this machine");
-        return false;
-    }
-
     if (sphb->index == (uint32_t)-1) {
         error_setg(errp, "\"index\" for PAPR PHB is mandatory");
         return false;
@@ -4125,16 +4108,10 @@ static bool spapr_phb_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
 
 static void spapr_phb_plug(HotplugHandler *hotplug_dev, DeviceState *dev)
 {
-    SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
     SpaprDrc *drc;
     bool hotplugged = spapr_drc_hotplugged(dev);
 
-    if (!smc->dr_phb_enabled) {
-        return;
-    }
-
     drc = spapr_drc_by_id(TYPE_SPAPR_DRC_PHB, sphb->index);
     /* hotplug hooks should check it's enabled before getting this far */
     assert(drc);
@@ -4260,7 +4237,6 @@ static void spapr_machine_device_unplug_request(HotplugHandler *hotplug_dev,
 {
     SpaprMachineState *sms = SPAPR_MACHINE(OBJECT(hotplug_dev));
     MachineClass *mc = MACHINE_GET_CLASS(sms);
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
 
     if (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM)) {
         if (spapr_memory_hot_unplug_supported(sms)) {
@@ -4275,10 +4251,6 @@ static void spapr_machine_device_unplug_request(HotplugHandler *hotplug_dev,
         }
         spapr_core_unplug_request(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_PCI_HOST_BRIDGE)) {
-        if (!smc->dr_phb_enabled) {
-            error_setg(errp, "PHB hot unplug not supported on this machine");
-            return;
-        }
         spapr_phb_unplug_request(hotplug_dev, dev, errp);
     } else if (object_dynamic_cast(OBJECT(dev), TYPE_SPAPR_TPM_PROXY)) {
         spapr_tpm_proxy_unplug(hotplug_dev, dev);
@@ -4634,7 +4606,6 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
     hc->unplug_request = spapr_machine_device_unplug_request;
     hc->unplug = spapr_machine_device_unplug;
 
-    smc->update_dt_enabled = true;
     mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power10_v2.0");
     mc->has_hotpluggable_cpus = true;
     mc->nvdimm_supported = true;
@@ -4688,7 +4659,6 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
     smc->default_caps.caps[SPAPR_CAP_AIL_MODE_3] = SPAPR_CAP_ON;
     spapr_caps_add_properties(smc);
     smc->irq = &spapr_irq_dual;
-    smc->dr_phb_enabled = true;
     smc->linux_pci_probe = true;
     smc->smp_threads_vsmt = true;
     xfc->match_nvt = spapr_match_nvt;
@@ -5032,28 +5002,6 @@ static void spapr_machine_4_0_class_options(MachineClass *mc)
 
 DEFINE_SPAPR_MACHINE(4, 0);
 
-/*
- * pseries-3.1
- */
-static void spapr_machine_3_1_class_options(MachineClass *mc)
-{
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-
-    spapr_machine_4_0_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_3_1, hw_compat_3_1_len);
-
-    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("power8_v2.0");
-    smc->update_dt_enabled = false;
-    smc->dr_phb_enabled = false;
-    smc->broken_host_serial_model = true;
-    smc->default_caps.caps[SPAPR_CAP_CFPC] = SPAPR_CAP_BROKEN;
-    smc->default_caps.caps[SPAPR_CAP_SBBC] = SPAPR_CAP_BROKEN;
-    smc->default_caps.caps[SPAPR_CAP_IBS] = SPAPR_CAP_BROKEN;
-    smc->default_caps.caps[SPAPR_CAP_LARGE_DECREMENTER] = SPAPR_CAP_OFF;
-}
-
-DEFINE_SPAPR_MACHINE(3, 1);
-
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
diff --git a/hw/ppc/spapr_hcall.c b/hw/ppc/spapr_hcall.c
index 8c1e0a4817..8f03b3e776 100644
--- a/hw/ppc/spapr_hcall.c
+++ b/hw/ppc/spapr_hcall.c
@@ -1475,16 +1475,11 @@ static target_ulong h_update_dt(PowerPCCPU *cpu, SpaprMachineState *spapr,
     target_ulong dt = ppc64_phys_to_real(args[0]);
     struct fdt_header hdr = { 0 };
     unsigned cb;
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     void *fdt;
 
     cpu_physical_memory_read(dt, &hdr, sizeof(hdr));
     cb = fdt32_to_cpu(hdr.totalsize);
 
-    if (!smc->update_dt_enabled) {
-        return H_SUCCESS;
-    }
-
     /* Check that the fdt did not grow out of proportion */
     if (cb > spapr->fdt_initial_size * 2) {
         trace_spapr_update_dt_failed_size(spapr->fdt_initial_size, cb,
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 494367fb99..1db67784de 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -143,9 +143,6 @@ struct SpaprMachineClass {
     MachineClass parent_class;
 
     /*< public >*/
-    bool dr_phb_enabled;       /* enable dynamic-reconfig/hotplug of PHBs */
-    bool update_dt_enabled;    /* enable KVMPPC_H_UPDATE_DT */
-    bool broken_host_serial_model; /* present real host info to the guest */
     bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
     bool linux_pci_probe;
     bool smp_threads_vsmt; /* set VSMT to smp_threads by default */

From 5c1e7eb37d5af317339ad8951ff4ac64ecdea302 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:38 +0200
Subject: [PATCH 1556/2396] hw/ppc/spapr: Inline spapr_dtb_needed()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-5-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index efeea03741..ab46e3bd60 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2053,11 +2053,6 @@ static const VMStateDescription vmstate_spapr_irq_map = {
     },
 };
 
-static bool spapr_dtb_needed(void *opaque)
-{
-    return true; /* backward migration compat */
-}
-
 static int spapr_dtb_pre_load(void *opaque)
 {
     SpaprMachineState *spapr = (SpaprMachineState *)opaque;
@@ -2073,7 +2068,6 @@ static const VMStateDescription vmstate_spapr_dtb = {
     .name = "spapr_dtb",
     .version_id = 1,
     .minimum_version_id = 1,
-    .needed = spapr_dtb_needed,
     .pre_load = spapr_dtb_pre_load,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32(fdt_initial_size, SpaprMachineState),

From 3d8939da6fcf191220e0668e778c4b98ff6d8316 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:39 +0200
Subject: [PATCH 1557/2396] hw/ppc/spapr: Inline few SPAPR_IRQ_* uses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-6-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr_events.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/ppc/spapr_events.c b/hw/ppc/spapr_events.c
index 548a190ce8..892ddc7f8f 100644
--- a/hw/ppc/spapr_events.c
+++ b/hw/ppc/spapr_events.c
@@ -1041,16 +1041,14 @@ void spapr_clear_pending_hotplug_events(SpaprMachineState *spapr)
 
 void spapr_events_init(SpaprMachineState *spapr)
 {
-    int epow_irq = SPAPR_IRQ_EPOW;
-
-    spapr_irq_claim(spapr, epow_irq, false, &error_fatal);
+    spapr_irq_claim(spapr, SPAPR_IRQ_EPOW, false, &error_fatal);
 
     QTAILQ_INIT(&spapr->pending_events);
 
     spapr->event_sources = spapr_event_sources_new();
 
     spapr_event_sources_register(spapr->event_sources, EVENT_CLASS_EPOW,
-                                 epow_irq);
+                                 SPAPR_IRQ_EPOW);
 
     /* NOTE: if machine supports modern/dedicated hotplug event source,
      * we add it to the device-tree unconditionally. This means we may
@@ -1061,12 +1059,10 @@ void spapr_events_init(SpaprMachineState *spapr)
      * checking that it's enabled.
      */
     if (spapr->use_hotplug_event_source) {
-        int hp_irq = SPAPR_IRQ_HOTPLUG;
-
-        spapr_irq_claim(spapr, hp_irq, false, &error_fatal);
+        spapr_irq_claim(spapr, SPAPR_IRQ_HOTPLUG, false, &error_fatal);
 
         spapr_event_sources_register(spapr->event_sources, EVENT_CLASS_HOT_PLUG,
-                                     hp_irq);
+                                     SPAPR_IRQ_HOTPLUG);
     }
 
     spapr->epow_notifier.notify = spapr_powerdown_req;

From ca70ed2738da9d04e81c5f0d91430503e0eac6f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:40 +0200
Subject: [PATCH 1558/2396] target/ppc/kvm: Remove kvmppc_get_host_serial() as
 unused
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-7-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 target/ppc/kvm.c     | 6 ------
 target/ppc/kvm_ppc.h | 6 ------
 2 files changed, 12 deletions(-)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index cd60893a17..cb61e99f9d 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1864,12 +1864,6 @@ uint32_t kvmppc_get_tbfreq(void)
     return cached_tbfreq;
 }
 
-bool kvmppc_get_host_serial(char **value)
-{
-    return g_file_get_contents("/proc/device-tree/system-id", value, NULL,
-                               NULL);
-}
-
 bool kvmppc_get_host_model(char **value)
 {
     return g_file_get_contents("/proc/device-tree/model", value, NULL, NULL);
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index a1d9ce9f9a..f24cc4de3c 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -22,7 +22,6 @@
 uint32_t kvmppc_get_tbfreq(void);
 uint64_t kvmppc_get_clockfreq(void);
 bool kvmppc_get_host_model(char **buf);
-bool kvmppc_get_host_serial(char **buf);
 int kvmppc_get_hasidle(CPUPPCState *env);
 int kvmppc_get_hypercall(CPUPPCState *env, uint8_t *buf, int buf_len);
 int kvmppc_set_interrupt(PowerPCCPU *cpu, int irq, int level);
@@ -134,11 +133,6 @@ static inline bool kvmppc_get_host_model(char **buf)
     return false;
 }
 
-static inline bool kvmppc_get_host_serial(char **buf)
-{
-    return false;
-}
-
 static inline uint64_t kvmppc_get_clockfreq(void)
 {
     return 0;

From 994abe73f9f649c6bde19fbc997004f4c5ab9f6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:41 +0200
Subject: [PATCH 1559/2396] target/ppc/kvm: Remove kvmppc_get_host_model() as
 unused
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-8-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 target/ppc/kvm.c     | 5 -----
 target/ppc/kvm_ppc.h | 6 ------
 2 files changed, 11 deletions(-)

diff --git a/target/ppc/kvm.c b/target/ppc/kvm.c
index cb61e99f9d..43124bf1c7 100644
--- a/target/ppc/kvm.c
+++ b/target/ppc/kvm.c
@@ -1864,11 +1864,6 @@ uint32_t kvmppc_get_tbfreq(void)
     return cached_tbfreq;
 }
 
-bool kvmppc_get_host_model(char **value)
-{
-    return g_file_get_contents("/proc/device-tree/model", value, NULL, NULL);
-}
-
 /* Try to find a device tree node for a CPU with clock-frequency property */
 static int kvmppc_find_cpu_dt(char *buf, int buf_len)
 {
diff --git a/target/ppc/kvm_ppc.h b/target/ppc/kvm_ppc.h
index f24cc4de3c..742881231e 100644
--- a/target/ppc/kvm_ppc.h
+++ b/target/ppc/kvm_ppc.h
@@ -21,7 +21,6 @@
 
 uint32_t kvmppc_get_tbfreq(void);
 uint64_t kvmppc_get_clockfreq(void);
-bool kvmppc_get_host_model(char **buf);
 int kvmppc_get_hasidle(CPUPPCState *env);
 int kvmppc_get_hypercall(CPUPPCState *env, uint8_t *buf, int buf_len);
 int kvmppc_set_interrupt(PowerPCCPU *cpu, int irq, int level);
@@ -128,11 +127,6 @@ static inline uint32_t kvmppc_get_tbfreq(void)
     return 0;
 }
 
-static inline bool kvmppc_get_host_model(char **buf)
-{
-    return false;
-}
-
 static inline uint64_t kvmppc_get_clockfreq(void)
 {
     return 0;

From 07718fe66060111821ffd38f1eaffcaec307db79 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 21 Oct 2025 10:43:42 +0200
Subject: [PATCH 1560/2396] ppc/spapr: remove deprecated machine pseries-4.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pseries-4.0 had been deprecated and due for removal now as per policy.
Also remove pre-4.1 migration hacks which were introduced for backward
compatibility.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
[PMD: Remove SpaprMachineClass::pre_4_1_migration field]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-9-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         | 27 ---------------------------
 hw/ppc/spapr_caps.c    | 12 +-----------
 include/hw/ppc/spapr.h |  3 ---
 3 files changed, 1 insertion(+), 41 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index ab46e3bd60..ea7d2a03aa 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4969,33 +4969,6 @@ static void spapr_machine_4_1_class_options(MachineClass *mc)
 
 DEFINE_SPAPR_MACHINE(4, 1);
 
-/*
- * pseries-4.0
- */
-static bool phb_placement_4_0(SpaprMachineState *spapr, uint32_t index,
-                              uint64_t *buid, hwaddr *pio,
-                              hwaddr *mmio32, hwaddr *mmio64,
-                              unsigned n_dma, uint32_t *liobns, Error **errp)
-{
-    if (!spapr_phb_placement(spapr, index, buid, pio, mmio32, mmio64, n_dma,
-                             liobns, errp)) {
-        return false;
-    }
-    return true;
-}
-static void spapr_machine_4_0_class_options(MachineClass *mc)
-{
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-
-    spapr_machine_4_1_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_0, hw_compat_4_0_len);
-    smc->phb_placement = phb_placement_4_0;
-    smc->irq = &spapr_irq_xics;
-    smc->pre_4_1_migration = true;
-}
-
-DEFINE_SPAPR_MACHINE(4, 0);
-
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
diff --git a/hw/ppc/spapr_caps.c b/hw/ppc/spapr_caps.c
index 0f94c192fd..170795ad6a 100644
--- a/hw/ppc/spapr_caps.c
+++ b/hw/ppc/spapr_caps.c
@@ -66,7 +66,6 @@ typedef struct SpaprCapabilityInfo {
     void (*apply)(SpaprMachineState *spapr, uint8_t val, Error **errp);
     void (*cpu_apply)(SpaprMachineState *spapr, PowerPCCPU *cpu,
                       uint8_t val, Error **errp);
-    bool (*migrate_needed)(void *opaque);
 } SpaprCapabilityInfo;
 
 static void spapr_cap_get_bool(Object *obj, Visitor *v, const char *name,
@@ -336,11 +335,6 @@ static void cap_hpt_maxpagesize_apply(SpaprMachineState *spapr,
     spapr_check_pagesize(spapr, qemu_minrampagesize(), errp);
 }
 
-static bool cap_hpt_maxpagesize_migrate_needed(void *opaque)
-{
-    return !SPAPR_MACHINE_GET_CLASS(opaque)->pre_4_1_migration;
-}
-
 static bool spapr_pagesize_cb(void *opaque, uint32_t seg_pshift,
                               uint32_t pshift)
 {
@@ -793,7 +787,6 @@ SpaprCapabilityInfo capability_table[SPAPR_CAP_NUM] = {
         .type = "int",
         .apply = cap_hpt_maxpagesize_apply,
         .cpu_apply = cap_hpt_maxpagesize_cpu_apply,
-        .migrate_needed = cap_hpt_maxpagesize_migrate_needed,
     },
     [SPAPR_CAP_NESTED_KVM_HV] = {
         .name = "nested-hv",
@@ -982,11 +975,8 @@ int spapr_caps_post_migration(SpaprMachineState *spapr)
 static bool spapr_cap_##sname##_needed(void *opaque)    \
 {                                                       \
     SpaprMachineState *spapr = opaque;                  \
-    bool (*needed)(void *opaque) =                      \
-        capability_table[cap].migrate_needed;           \
                                                         \
-    return needed ? needed(opaque) : true &&            \
-           spapr->cmd_line_caps[cap] &&                 \
+    return spapr->cmd_line_caps[cap] &&                 \
            (spapr->eff.caps[cap] !=                     \
             spapr->def.caps[cap]);                      \
 }                                                       \
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 1db67784de..58d31b096c 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -139,11 +139,8 @@ struct SpaprCapabilities {
  * SpaprMachineClass:
  */
 struct SpaprMachineClass {
-    /*< private >*/
     MachineClass parent_class;
 
-    /*< public >*/
-    bool pre_4_1_migration; /* don't migrate hpt-max-page-size */
     bool linux_pci_probe;
     bool smp_threads_vsmt; /* set VSMT to smp_threads by default */
     hwaddr rma_limit;          /* clamp the RMA to this size */

From cc62474851cf45017e7be13315a7f2c4723be33f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 10:43:43 +0200
Subject: [PATCH 1561/2396] hw/ppc/spapr: Remove
 SpaprMachineClass::phb_placement callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The SpaprMachineClass::phb_placement callback was only used by
the pseries-4.0 machine, which got removed. Remove it as now
unused, directly calling spapr_phb_placement().
Move spapr_phb_placement() definition to avoid forward declaration.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-10-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         | 114 ++++++++++++++++++++---------------------
 include/hw/ppc/spapr.h |   5 --
 2 files changed, 55 insertions(+), 64 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index ea7d2a03aa..371593d0b5 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4068,12 +4068,62 @@ int spapr_phb_dt_populate(SpaprDrc *drc, SpaprMachineState *spapr,
     return 0;
 }
 
+static bool spapr_phb_placement(SpaprMachineState *spapr, uint32_t index,
+                                uint64_t *buid, hwaddr *pio,
+                                hwaddr *mmio32, hwaddr *mmio64,
+                                unsigned n_dma, uint32_t *liobns, Error **errp)
+{
+    /*
+     * New-style PHB window placement.
+     *
+     * Goals: Gives large (1TiB), naturally aligned 64-bit MMIO window
+     * for each PHB, in addition to 2GiB 32-bit MMIO and 64kiB PIO
+     * windows.
+     *
+     * Some guest kernels can't work with MMIO windows above 1<<46
+     * (64TiB), so we place up to 31 PHBs in the area 32TiB..64TiB
+     *
+     * 32TiB..(33TiB+1984kiB) contains the 64kiB PIO windows for each
+     * PHB stacked together.  (32TiB+2GiB)..(32TiB+64GiB) contains the
+     * 2GiB 32-bit MMIO windows for each PHB.  Then 33..64TiB has the
+     * 1TiB 64-bit MMIO windows for each PHB.
+     */
+    const uint64_t base_buid = 0x800000020000000ULL;
+    int i;
+
+    /* Sanity check natural alignments */
+    QEMU_BUILD_BUG_ON((SPAPR_PCI_BASE % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
+    QEMU_BUILD_BUG_ON((SPAPR_PCI_LIMIT % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
+    QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM64_WIN_SIZE % SPAPR_PCI_MEM32_WIN_SIZE) != 0);
+    QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM32_WIN_SIZE % SPAPR_PCI_IO_WIN_SIZE) != 0);
+    /* Sanity check bounds */
+    QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_IO_WIN_SIZE) >
+                      SPAPR_PCI_MEM32_WIN_SIZE);
+    QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_MEM32_WIN_SIZE) >
+                      SPAPR_PCI_MEM64_WIN_SIZE);
+
+    if (index >= SPAPR_MAX_PHBS) {
+        error_setg(errp, "\"index\" for PAPR PHB is too large (max %llu)",
+                   SPAPR_MAX_PHBS - 1);
+        return false;
+    }
+
+    *buid = base_buid + index;
+    for (i = 0; i < n_dma; ++i) {
+        liobns[i] = SPAPR_PCI_LIOBN(index, i);
+    }
+
+    *pio = SPAPR_PCI_BASE + index * SPAPR_PCI_IO_WIN_SIZE;
+    *mmio32 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM32_WIN_SIZE;
+    *mmio64 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM64_WIN_SIZE;
+    return true;
+}
+
 static bool spapr_phb_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
                                Error **errp)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(OBJECT(hotplug_dev));
     SpaprPhbState *sphb = SPAPR_PCI_HOST_BRIDGE(dev);
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     const unsigned windows_supported = spapr_phb_windows_supported(sphb);
     SpaprDrc *drc;
 
@@ -4092,12 +4142,10 @@ static bool spapr_phb_pre_plug(HotplugHandler *hotplug_dev, DeviceState *dev,
      * This will check that sphb->index doesn't exceed the maximum number of
      * PHBs for the current machine type.
      */
-    return
-        smc->phb_placement(spapr, sphb->index,
-                           &sphb->buid, &sphb->io_win_addr,
-                           &sphb->mem_win_addr, &sphb->mem64_win_addr,
-                           windows_supported, sphb->dma_liobn,
-                           errp);
+    return spapr_phb_placement(spapr, sphb->index,
+                               &sphb->buid, &sphb->io_win_addr,
+                               &sphb->mem_win_addr, &sphb->mem64_win_addr,
+                               windows_supported, sphb->dma_liobn, errp);
 }
 
 static void spapr_phb_plug(HotplugHandler *hotplug_dev, DeviceState *dev)
@@ -4345,57 +4393,6 @@ static const CPUArchIdList *spapr_possible_cpu_arch_ids(MachineState *machine)
     return machine->possible_cpus;
 }
 
-static bool spapr_phb_placement(SpaprMachineState *spapr, uint32_t index,
-                                uint64_t *buid, hwaddr *pio,
-                                hwaddr *mmio32, hwaddr *mmio64,
-                                unsigned n_dma, uint32_t *liobns, Error **errp)
-{
-    /*
-     * New-style PHB window placement.
-     *
-     * Goals: Gives large (1TiB), naturally aligned 64-bit MMIO window
-     * for each PHB, in addition to 2GiB 32-bit MMIO and 64kiB PIO
-     * windows.
-     *
-     * Some guest kernels can't work with MMIO windows above 1<<46
-     * (64TiB), so we place up to 31 PHBs in the area 32TiB..64TiB
-     *
-     * 32TiB..(33TiB+1984kiB) contains the 64kiB PIO windows for each
-     * PHB stacked together.  (32TiB+2GiB)..(32TiB+64GiB) contains the
-     * 2GiB 32-bit MMIO windows for each PHB.  Then 33..64TiB has the
-     * 1TiB 64-bit MMIO windows for each PHB.
-     */
-    const uint64_t base_buid = 0x800000020000000ULL;
-    int i;
-
-    /* Sanity check natural alignments */
-    QEMU_BUILD_BUG_ON((SPAPR_PCI_BASE % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
-    QEMU_BUILD_BUG_ON((SPAPR_PCI_LIMIT % SPAPR_PCI_MEM64_WIN_SIZE) != 0);
-    QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM64_WIN_SIZE % SPAPR_PCI_MEM32_WIN_SIZE) != 0);
-    QEMU_BUILD_BUG_ON((SPAPR_PCI_MEM32_WIN_SIZE % SPAPR_PCI_IO_WIN_SIZE) != 0);
-    /* Sanity check bounds */
-    QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_IO_WIN_SIZE) >
-                      SPAPR_PCI_MEM32_WIN_SIZE);
-    QEMU_BUILD_BUG_ON((SPAPR_MAX_PHBS * SPAPR_PCI_MEM32_WIN_SIZE) >
-                      SPAPR_PCI_MEM64_WIN_SIZE);
-
-    if (index >= SPAPR_MAX_PHBS) {
-        error_setg(errp, "\"index\" for PAPR PHB is too large (max %llu)",
-                   SPAPR_MAX_PHBS - 1);
-        return false;
-    }
-
-    *buid = base_buid + index;
-    for (i = 0; i < n_dma; ++i) {
-        liobns[i] = SPAPR_PCI_LIOBN(index, i);
-    }
-
-    *pio = SPAPR_PCI_BASE + index * SPAPR_PCI_IO_WIN_SIZE;
-    *mmio32 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM32_WIN_SIZE;
-    *mmio64 = SPAPR_PCI_BASE + (index + 1) * SPAPR_PCI_MEM64_WIN_SIZE;
-    return true;
-}
-
 static ICSState *spapr_ics_get(XICSFabric *dev, int irq)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(dev);
@@ -4606,7 +4603,6 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
     smc->resize_hpt_default = SPAPR_RESIZE_HPT_ENABLED;
     fwc->get_dev_path = spapr_get_fw_dev_path;
     nc->nmi_monitor_handler = spapr_nmi;
-    smc->phb_placement = spapr_phb_placement;
     vhc->cpu_in_nested = spapr_cpu_in_nested;
     vhc->deliver_hv_excp = spapr_exit_nested;
     vhc->hypercall = emulate_spapr_hypercall;
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 58d31b096c..bd783e92e1 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -147,11 +147,6 @@ struct SpaprMachineClass {
     bool pre_5_1_assoc_refpoints;
     bool pre_5_2_numa_associativity;
     bool pre_6_2_numa_affinity;
-
-    bool (*phb_placement)(SpaprMachineState *spapr, uint32_t index,
-                          uint64_t *buid, hwaddr *pio,
-                          hwaddr *mmio32, hwaddr *mmio64,
-                          unsigned n_dma, uint32_t *liobns, Error **errp);
     SpaprResizeHpt resize_hpt_default;
     SpaprCapabilities default_caps;
     SpaprIrq *irq;

From 3d8736467fc93325b9bd730fa933bbd9b602b2f3 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 21 Oct 2025 10:43:44 +0200
Subject: [PATCH 1562/2396] ppc/spapr: remove deprecated machine pseries-4.1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the pseries-4.1 machine specific logic as had been deprecated and
due for removal now as per policy.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-11-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         | 37 +------------------------------------
 include/hw/ppc/spapr.h |  2 --
 2 files changed, 1 insertion(+), 38 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 371593d0b5..0e6218dc9c 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -1072,7 +1072,6 @@ static void spapr_dt_ov5_platform_support(SpaprMachineState *spapr, void *fdt,
 static void spapr_dt_chosen(SpaprMachineState *spapr, void *fdt, bool reset)
 {
     MachineState *machine = MACHINE(spapr);
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(machine);
     int chosen;
 
     _FDT(chosen = fdt_add_subnode(fdt, 0, "chosen"));
@@ -1143,9 +1142,7 @@ static void spapr_dt_chosen(SpaprMachineState *spapr, void *fdt, bool reset)
          * We can deal with BAR reallocation just fine, advertise it
          * to the guest
          */
-        if (smc->linux_pci_probe) {
-            _FDT(fdt_setprop_cell(fdt, chosen, "linux,pci-probe-only", 0));
-        }
+        _FDT(fdt_setprop_cell(fdt, chosen, "linux,pci-probe-only", 0));
 
         spapr_dt_ov5_platform_support(spapr, fdt, chosen);
     }
@@ -2589,7 +2586,6 @@ static CPUArchId *spapr_find_cpu_slot(MachineState *ms, uint32_t id, int *idx)
 static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
 {
     MachineState *ms = MACHINE(spapr);
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     Error *local_err = NULL;
     bool vsmt_user = !!spapr->vsmt;
     int kvm_smt = kvmppc_smt_threads();
@@ -2625,15 +2621,6 @@ static void spapr_set_vsmt_mode(SpaprMachineState *spapr, Error **errp)
             return;
         }
         /* In this case, spapr->vsmt has been set by the command line */
-    } else if (!smc->smp_threads_vsmt) {
-        /*
-         * Default VSMT value is tricky, because we need it to be as
-         * consistent as possible (for migration), but this requires
-         * changing it for at least some existing cases.  We pick 8 as
-         * the value that we'd get with KVM on POWER8, the
-         * overwhelmingly common case in production systems.
-         */
-        spapr->vsmt = MAX(8, smp_threads);
     } else {
         spapr->vsmt = smp_threads;
     }
@@ -4649,8 +4636,6 @@ static void spapr_machine_class_init(ObjectClass *oc, const void *data)
     smc->default_caps.caps[SPAPR_CAP_AIL_MODE_3] = SPAPR_CAP_ON;
     spapr_caps_add_properties(smc);
     smc->irq = &spapr_irq_dual;
-    smc->linux_pci_probe = true;
-    smc->smp_threads_vsmt = true;
     xfc->match_nvt = spapr_match_nvt;
     vmc->client_architecture_support = spapr_vof_client_architecture_support;
     vmc->quiesce = spapr_vof_quiesce;
@@ -4945,26 +4930,6 @@ static void spapr_machine_4_2_class_options(MachineClass *mc)
 
 DEFINE_SPAPR_MACHINE(4, 2);
 
-/*
- * pseries-4.1
- */
-static void spapr_machine_4_1_class_options(MachineClass *mc)
-{
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-    static GlobalProperty compat[] = {
-        /* Only allow 4kiB and 64kiB IOMMU pagesizes */
-        { TYPE_SPAPR_PCI_HOST_BRIDGE, "pgsz", "0x11000" },
-    };
-
-    spapr_machine_4_2_class_options(mc);
-    smc->linux_pci_probe = false;
-    smc->smp_threads_vsmt = false;
-    compat_props_add(mc->compat_props, hw_compat_4_1, hw_compat_4_1_len);
-    compat_props_add(mc->compat_props, compat, G_N_ELEMENTS(compat));
-}
-
-DEFINE_SPAPR_MACHINE(4, 1);
-
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index bd783e92e1..60d9a8a037 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -141,8 +141,6 @@ struct SpaprCapabilities {
 struct SpaprMachineClass {
     MachineClass parent_class;
 
-    bool linux_pci_probe;
-    bool smp_threads_vsmt; /* set VSMT to smp_threads by default */
     hwaddr rma_limit;          /* clamp the RMA to this size */
     bool pre_5_1_assoc_refpoints;
     bool pre_5_2_numa_associativity;

From 448b5be6253fb17d90f61902a75806d917ad4f78 Mon Sep 17 00:00:00 2001
From: Harsh Prateek Bora <harshpb@linux.ibm.com>
Date: Tue, 21 Oct 2025 10:43:45 +0200
Subject: [PATCH 1563/2396] ppc/spapr: remove deprecated machine pseries-4.2
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the pseries-4.2 machine specific logic as had been deprecated and
due for removal now as per policy.

Suggested-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251021084346.73671-12-philmd@linaro.org
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c         | 27 ---------------------------
 include/hw/ppc/spapr.h |  1 -
 2 files changed, 28 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 0e6218dc9c..117da76a3d 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2729,7 +2729,6 @@ static PCIHostState *spapr_create_default_phb(void)
 static hwaddr spapr_rma_size(SpaprMachineState *spapr, Error **errp)
 {
     MachineState *machine = MACHINE(spapr);
-    SpaprMachineClass *smc = SPAPR_MACHINE_GET_CLASS(spapr);
     hwaddr rma_size = machine->ram_size;
     hwaddr node0_size = spapr_node0_size(machine);
 
@@ -2742,15 +2741,6 @@ static hwaddr spapr_rma_size(SpaprMachineState *spapr, Error **errp)
      */
     rma_size = MIN(rma_size, 1 * TiB);
 
-    /*
-     * Clamp the RMA size based on machine type.  This is for
-     * migration compatibility with older qemu versions, which limited
-     * the RMA size for complicated and mostly bad reasons.
-     */
-    if (smc->rma_limit) {
-        rma_size = MIN(rma_size, smc->rma_limit);
-    }
-
     if (rma_size < MIN_RMA_SLOF) {
         error_setg(errp,
                    "pSeries SLOF firmware requires >= %" HWADDR_PRIx
@@ -4913,23 +4903,6 @@ static void spapr_machine_5_0_class_options(MachineClass *mc)
 
 DEFINE_SPAPR_MACHINE(5, 0);
 
-/*
- * pseries-4.2
- */
-static void spapr_machine_4_2_class_options(MachineClass *mc)
-{
-    SpaprMachineClass *smc = SPAPR_MACHINE_CLASS(mc);
-
-    spapr_machine_5_0_class_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
-    smc->default_caps.caps[SPAPR_CAP_CCF_ASSIST] = SPAPR_CAP_OFF;
-    smc->default_caps.caps[SPAPR_CAP_FWNMI] = SPAPR_CAP_OFF;
-    smc->rma_limit = 16 * GiB;
-    mc->nvdimm_supported = false;
-}
-
-DEFINE_SPAPR_MACHINE(4, 2);
-
 static void spapr_machine_register_types(void)
 {
     type_register_static(&spapr_machine_info);
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index 60d9a8a037..b9d884745f 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -141,7 +141,6 @@ struct SpaprCapabilities {
 struct SpaprMachineClass {
     MachineClass parent_class;
 
-    hwaddr rma_limit;          /* clamp the RMA to this size */
     bool pre_5_1_assoc_refpoints;
     bool pre_5_2_numa_associativity;
     bool pre_6_2_numa_affinity;

From 32a027f9404aee9c9c57a41abcea5dde5bf5e518 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Wed, 22 Oct 2025 23:07:47 +0200
Subject: [PATCH 1564/2396] ppc/amigaone: Free allocated struct

In create_bd_info function a bd_info struct is allocated but never
freed. Mark it g_autofree to avoid leaking it.

Fixes: 34f053d86b (ppc/amigaone: Add kernel and initrd support)
Resolves: Coverity CID 1641398
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251022211649.9A09E5972E5@zero.eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/amigaone.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/amigaone.c b/hw/ppc/amigaone.c
index 12279f42bc..47fb016b4a 100644
--- a/hw/ppc/amigaone.c
+++ b/hw/ppc/amigaone.c
@@ -221,7 +221,7 @@ struct bd_info {
 
 static void create_bd_info(hwaddr addr, ram_addr_t ram_size)
 {
-    struct bd_info *bd = g_new0(struct bd_info, 1);
+    g_autofree struct bd_info *bd = g_new0(struct bd_info, 1);
 
     bd->bi_memsize =    cpu_to_be32(ram_size);
     bd->bi_flashstart = cpu_to_be32(PROM_ADDR);

From e09a4dd4dcbbbff4ed213e829db6e10786c6c617 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:07 +0200
Subject: [PATCH 1565/2396] ppc/vof: Make nextprop behave more like Open
 Firmware

The FDT does not normally store name properties but reconstructs it
from path but Open Firmware specification says each node should at
least have this property. This is correctly handled in getprop but
nextprop should also return it even if not present as a property.

Explicit name properties are still allowed because they are needed
e.g. on the root node that guests expect to have specific names as
seen on real machines instead of being empty so sometimes the node
name may need to be overriden. For example on pegasos MorphOS checks
the name of "/" and expects to find bplan,Pegasos2 which is how it
identifies the machine.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Link: https://lore.kernel.org/qemu-devel/366f14ce852415cc079727c54ac21a2aa6ff3917.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/vof.c | 50 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 33 insertions(+), 17 deletions(-)

diff --git a/hw/ppc/vof.c b/hw/ppc/vof.c
index f14efa3a7c..5ecfc68910 100644
--- a/hw/ppc/vof.c
+++ b/hw/ppc/vof.c
@@ -353,34 +353,50 @@ static uint32_t vof_nextprop(const void *fdt, uint32_t phandle,
 {
     int offset, nodeoff = fdt_node_offset_by_phandle(fdt, phandle);
     char prev[OF_PROPNAME_LEN_MAX + 1];
-    const char *tmp;
+    const char *tmp = NULL;
+    bool match = false;
 
     if (readstr(prevaddr, prev, sizeof(prev))) {
         return PROM_ERROR;
     }
-
-    fdt_for_each_property_offset(offset, fdt, nodeoff) {
-        if (!fdt_getprop_by_offset(fdt, offset, &tmp, NULL)) {
-            return 0;
+    /*
+     * "name" may or may not be present in fdt but we should still return it.
+     * Do that first and then skip it if seen later.
+     */
+    if (prev[0] == '\0') {
+        tmp = "name";
+    } else {
+        if (strcmp(prev, "name") == 0) {
+            prev[0] = '\0';
         }
-        if (prev[0] == '\0' || strcmp(prev, tmp) == 0) {
-            if (prev[0] != '\0') {
-                offset = fdt_next_property_offset(fdt, offset);
-                if (offset < 0) {
-                    return 0;
-                }
-            }
+        fdt_for_each_property_offset(offset, fdt, nodeoff) {
             if (!fdt_getprop_by_offset(fdt, offset, &tmp, NULL)) {
                 return 0;
             }
-
-            if (VOF_MEM_WRITE(nameaddr, tmp, strlen(tmp) + 1) != MEMTX_OK) {
-                return PROM_ERROR;
+            if (strcmp(tmp, "name") == 0) {
+                continue;
             }
-            return 1;
+            if (match) {
+                break;
+            }
+            if (strcmp(prev, tmp) == 0) {
+                match = true;
+                continue;
+            }
+            if (prev[0] == '\0') {
+                break;
+            }
+        }
+        if (offset < 0) {
+            return 0;
         }
     }
-
+    if (tmp) {
+        if (VOF_MEM_WRITE(nameaddr, tmp, strlen(tmp) + 1) != MEMTX_OK) {
+            return PROM_ERROR;
+        }
+        return 1;
+    }
     return 0;
 }
 

From 63a9cc05807cbdbc1dbea736b312d87538c6273c Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:08 +0200
Subject: [PATCH 1566/2396] hw/ppc/pegasos2: Remove explicit name properties
 from device tree

These are not needed any more now that VOF can handle it.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/fa36ab5a04e10c6acb89583f646aad83df2b0b13.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 17 -----------------
 1 file changed, 17 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index e15cf96427..73995624e5 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -662,7 +662,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 1);
     qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 2);
     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "isa");
-    qemu_fdt_setprop_string(fi->fdt, fi->path, "name", "isa");
 
     /* additional devices */
     g_string_printf(name, "%s/lpt@i3bc", fi->path);
@@ -677,7 +676,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(8);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "lpt");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "lpt");
 
     g_string_printf(name, "%s/fdc@i3f0", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -691,7 +689,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(8);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "fdc");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "fdc");
 
     g_string_printf(name, "%s/timer@i40", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -701,7 +698,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(8);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "timer");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "timer");
 
     g_string_printf(name, "%s/rtc@i70", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -716,7 +712,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(2);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "rtc");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "rtc");
 
     g_string_printf(name, "%s/keyboard@i60", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -729,7 +724,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(5);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "keyboard");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "keyboard");
 
     g_string_printf(name, "%s/8042@i60", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -743,7 +737,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(5);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "8042");
 
     g_string_printf(name, "%s/serial@i2f8", fi->path);
     qemu_fdt_add_subnode(fi->fdt, name->str);
@@ -757,7 +750,6 @@ static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     cells[2] = cpu_to_be32(8);
     qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "serial");
-    qemu_fdt_setprop_string(fi->fdt, name->str, "name", "serial");
 
     g_string_free(name, TRUE);
 }
@@ -846,7 +838,6 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
         j += 5;
     }
     qemu_fdt_setprop(fi->fdt, node->str, "reg", cells, j * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, node->str, "name", name ?: pn);
     if (pci_get_byte(&d->config[PCI_INTERRUPT_PIN])) {
         qemu_fdt_setprop_cell(fi->fdt, node->str, "interrupts",
                               pci_get_byte(&d->config[PCI_INTERRUPT_PIN]));
@@ -916,7 +907,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#size-cells", 2);
     qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#address-cells", 3);
     qemu_fdt_setprop_string(fdt, "/pci@c0000000", "device_type", "pci");
-    qemu_fdt_setprop_string(fdt, "/pci@c0000000", "name", "pci");
 
     fi.path = "/pci@c0000000";
     pci_bus = mv64361_get_pci_bus(pm->mv, 0);
@@ -951,7 +941,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#size-cells", 2);
     qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#address-cells", 3);
     qemu_fdt_setprop_string(fdt, "/pci@80000000", "device_type", "pci");
-    qemu_fdt_setprop_string(fdt, "/pci@80000000", "name", "pci");
 
     fi.path = "/pci@80000000";
     pci_bus = mv64361_get_pci_bus(pm->mv, 1);
@@ -959,7 +948,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
 
     qemu_fdt_add_subnode(fdt, "/failsafe");
     qemu_fdt_setprop_string(fdt, "/failsafe", "device_type", "serial");
-    qemu_fdt_setprop_string(fdt, "/failsafe", "name", "failsafe");
 
     qemu_fdt_add_subnode(fdt, "/rtas");
     qemu_fdt_setprop_cell(fdt, "/rtas", "system-reboot", RTAS_SYSTEM_REBOOT);
@@ -989,14 +977,12 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-display-device", 0);
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-size", 20);
     qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-version", 1);
-    qemu_fdt_setprop_string(fdt, "/rtas", "name", "rtas");
 
     /* cpus */
     qemu_fdt_add_subnode(fdt, "/cpus");
     qemu_fdt_setprop_cell(fdt, "/cpus", "#cpus", 1);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 1);
     qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0);
-    qemu_fdt_setprop_string(fdt, "/cpus", "name", "cpus");
 
     /* FIXME Get CPU name from CPU object */
     const char *cp = "/cpus/PowerPC,G4";
@@ -1048,7 +1034,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     cells[1] = 0;
     qemu_fdt_setprop(fdt, cp, "reg", cells, 2 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fdt, cp, "device_type", "cpu");
-    qemu_fdt_setprop_string(fdt, cp, "name", strrchr(cp, '/') + 1);
 
     /* memory */
     qemu_fdt_add_subnode(fdt, "/memory@0");
@@ -1056,7 +1041,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     cells[1] = cpu_to_be32(machine->ram_size);
     qemu_fdt_setprop(fdt, "/memory@0", "reg", cells, 2 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fdt, "/memory@0", "device_type", "memory");
-    qemu_fdt_setprop_string(fdt, "/memory@0", "name", "memory");
 
     qemu_fdt_add_subnode(fdt, "/chosen");
     if (pm->initrd_addr && pm->initrd_size) {
@@ -1067,7 +1051,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     }
     qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
                             machine->kernel_cmdline ?: "");
-    qemu_fdt_setprop_string(fdt, "/chosen", "name", "chosen");
 
     qemu_fdt_add_subnode(fdt, "/openprom");
     qemu_fdt_setprop_string(fdt, "/openprom", "model", "Pegasos2,1.1");

From 9099b430a46ac8f513ee91bb4076b3f482babee1 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:09 +0200
Subject: [PATCH 1567/2396] hw/ppc/pegasos2: Change device tree generation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We generate a flattened device tree programmatically for VOF. Change
this to load the static parts from a device tree blob and only
generate the parts that depend on run time conditions such as CPU
type, memory size and PCI devices. Moving the static parts in a dts
makes the board code simpler and more generic.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/383891fc2696609b27d2de9773efe1b4f493e333.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c        | 291 +++++++--------------------------------
 pc-bios/dtb/meson.build  |   1 +
 pc-bios/dtb/pegasos2.dtb | Bin 0 -> 1701 bytes
 pc-bios/dtb/pegasos2.dts | 167 ++++++++++++++++++++++
 4 files changed, 219 insertions(+), 240 deletions(-)
 create mode 100644 pc-bios/dtb/pegasos2.dtb
 create mode 100644 pc-bios/dtb/pegasos2.dts

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 73995624e5..f4787397dc 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -58,16 +58,8 @@
 #define BUS_FREQ_HZ 133333333
 
 #define PCI0_CFG_ADDR 0xcf8
-#define PCI0_MEM_BASE 0xc0000000
-#define PCI0_MEM_SIZE 0x20000000
-#define PCI0_IO_BASE  0xf8000000
-#define PCI0_IO_SIZE  0x10000
-
 #define PCI1_CFG_ADDR 0xc78
-#define PCI1_MEM_BASE 0x80000000
-#define PCI1_MEM_SIZE 0x40000000
 #define PCI1_IO_BASE  0xfe000000
-#define PCI1_IO_SIZE  0x10000
 
 #define TYPE_PEGASOS2_MACHINE  MACHINE_TYPE_NAME("pegasos2")
 OBJECT_DECLARE_TYPE(Pegasos2MachineState, MachineClass, PEGASOS2_MACHINE)
@@ -411,7 +403,11 @@ static void pegasos2_machine_reset(MachineState *machine, ResetType type)
         error_report("Memory for initrd is in use");
         exit(1);
     }
+
     fdt = build_fdt(machine, &sz);
+    if (!fdt) {
+        exit(1);
+    }
     /* FIXME: VOF assumes entry is same as load address */
     d[0] = cpu_to_be64(pm->kernel_entry);
     d[1] = cpu_to_be64(pm->kernel_size - (pm->kernel_entry - pm->kernel_addr));
@@ -654,113 +650,12 @@ static void dt_usb(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
     qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "usb");
 }
 
-static void dt_isa(PCIBus *bus, PCIDevice *d, FDTInfo *fi)
-{
-    GString *name = g_string_sized_new(64);
-    uint32_t cells[3];
-
-    qemu_fdt_setprop_cell(fi->fdt, fi->path, "#size-cells", 1);
-    qemu_fdt_setprop_cell(fi->fdt, fi->path, "#address-cells", 2);
-    qemu_fdt_setprop_string(fi->fdt, fi->path, "device_type", "isa");
-
-    /* additional devices */
-    g_string_printf(name, "%s/lpt@i3bc", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(7);
-    cells[1] = 0;
-    qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
-                     cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x3bc);
-    cells[2] = cpu_to_be32(8);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "lpt");
-
-    g_string_printf(name, "%s/fdc@i3f0", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(6);
-    cells[1] = 0;
-    qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
-                     cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x3f0);
-    cells[2] = cpu_to_be32(8);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "fdc");
-
-    g_string_printf(name, "%s/timer@i40", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x40);
-    cells[2] = cpu_to_be32(8);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "timer");
-
-    g_string_printf(name, "%s/rtc@i70", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_string(fi->fdt, name->str, "compatible", "ds1385-rtc");
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(8);
-    cells[1] = 0;
-    qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
-                     cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x70);
-    cells[2] = cpu_to_be32(2);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "rtc");
-
-    g_string_printf(name, "%s/keyboard@i60", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    cells[0] = cpu_to_be32(1);
-    cells[1] = 0;
-    qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
-                     cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x60);
-    cells[2] = cpu_to_be32(5);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "keyboard");
-
-    g_string_printf(name, "%s/8042@i60", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "#interrupt-cells", 2);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "#size-cells", 0);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "#address-cells", 1);
-    qemu_fdt_setprop_string(fi->fdt, name->str, "interrupt-controller", "");
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x60);
-    cells[2] = cpu_to_be32(5);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "");
-
-    g_string_printf(name, "%s/serial@i2f8", fi->path);
-    qemu_fdt_add_subnode(fi->fdt, name->str);
-    qemu_fdt_setprop_cell(fi->fdt, name->str, "clock-frequency", 0);
-    cells[0] = cpu_to_be32(3);
-    cells[1] = 0;
-    qemu_fdt_setprop(fi->fdt, name->str, "interrupts",
-                     cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(1);
-    cells[1] = cpu_to_be32(0x2f8);
-    cells[2] = cpu_to_be32(8);
-    qemu_fdt_setprop(fi->fdt, name->str, "reg", cells, 3 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fi->fdt, name->str, "device_type", "serial");
-
-    g_string_free(name, TRUE);
-}
-
 static struct {
     const char *id;
     const char *name;
     void (*dtf)(PCIBus *bus, PCIDevice *d, FDTInfo *fi);
 } device_map[] = {
     { "pci11ab,6460", "host", NULL },
-    { "pci1106,8231", "isa", dt_isa },
     { "pci1106,571", "ide", dt_ide },
     { "pci1106,3044", "firewire", NULL },
     { "pci1106,3038", "usb", dt_usb },
@@ -780,7 +675,10 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
                                      pci_get_word(&d->config[PCI_VENDOR_ID]),
                                      pci_get_word(&d->config[PCI_DEVICE_ID]));
 
-    if (pci_get_word(&d->config[PCI_CLASS_DEVICE])  ==
+    if (!strcmp(pn, "pci1106,8231")) {
+        return; /* ISA bridge and devices are included in dtb */
+    }
+    if (pci_get_word(&d->config[PCI_CLASS_DEVICE]) ==
         PCI_CLASS_NETWORK_ETHERNET) {
         name = "ethernet";
     } else if (pci_get_word(&d->config[PCI_CLASS_DEVICE]) >> 8 ==
@@ -858,131 +756,9 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
     g_string_free(node, TRUE);
 }
 
-static void *build_fdt(MachineState *machine, int *fdt_size)
+static void add_cpu_info(void *fdt, PowerPCCPU *cpu)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
-    PowerPCCPU *cpu = pm->cpu;
-    PCIBus *pci_bus;
-    FDTInfo fi;
-    uint32_t cells[16];
-    void *fdt = create_device_tree(fdt_size);
-
-    fi.fdt = fdt;
-
-    /* root node */
-    qemu_fdt_setprop_string(fdt, "/", "CODEGEN,description",
-                            "Pegasos CHRP PowerPC System");
-    qemu_fdt_setprop_string(fdt, "/", "CODEGEN,board", "Pegasos2");
-    qemu_fdt_setprop_string(fdt, "/", "CODEGEN,vendor", "bplan GmbH");
-    qemu_fdt_setprop_string(fdt, "/", "revision", "2B");
-    qemu_fdt_setprop_string(fdt, "/", "model", "Pegasos2");
-    qemu_fdt_setprop_string(fdt, "/", "device_type", "chrp");
-    qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 1);
-    qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
-
-    /* pci@c0000000 */
-    qemu_fdt_add_subnode(fdt, "/pci@c0000000");
-    cells[0] = 0;
-    cells[1] = 0;
-    qemu_fdt_setprop(fdt, "/pci@c0000000", "bus-range",
-                     cells, 2 * sizeof(cells[0]));
-    qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "pci-bridge-number", 1);
-    cells[0] = cpu_to_be32(PCI0_MEM_BASE);
-    cells[1] = cpu_to_be32(PCI0_MEM_SIZE);
-    qemu_fdt_setprop(fdt, "/pci@c0000000", "reg", cells, 2 * sizeof(cells[0]));
-    cells[0] = cpu_to_be32(0x01000000);
-    cells[1] = 0;
-    cells[2] = 0;
-    cells[3] = cpu_to_be32(PCI0_IO_BASE);
-    cells[4] = 0;
-    cells[5] = cpu_to_be32(PCI0_IO_SIZE);
-    cells[6] = cpu_to_be32(0x02000000);
-    cells[7] = 0;
-    cells[8] = cpu_to_be32(PCI0_MEM_BASE);
-    cells[9] = cpu_to_be32(PCI0_MEM_BASE);
-    cells[10] = 0;
-    cells[11] = cpu_to_be32(PCI0_MEM_SIZE);
-    qemu_fdt_setprop(fdt, "/pci@c0000000", "ranges",
-                     cells, 12 * sizeof(cells[0]));
-    qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#size-cells", 2);
-    qemu_fdt_setprop_cell(fdt, "/pci@c0000000", "#address-cells", 3);
-    qemu_fdt_setprop_string(fdt, "/pci@c0000000", "device_type", "pci");
-
-    fi.path = "/pci@c0000000";
-    pci_bus = mv64361_get_pci_bus(pm->mv, 0);
-    pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
-
-    /* pci@80000000 */
-    qemu_fdt_add_subnode(fdt, "/pci@80000000");
-    cells[0] = 0;
-    cells[1] = 0;
-    qemu_fdt_setprop(fdt, "/pci@80000000", "bus-range",
-                     cells, 2 * sizeof(cells[0]));
-    qemu_fdt_setprop_cell(fdt, "/pci@80000000", "pci-bridge-number", 0);
-    cells[0] = cpu_to_be32(PCI1_MEM_BASE);
-    cells[1] = cpu_to_be32(PCI1_MEM_SIZE);
-    qemu_fdt_setprop(fdt, "/pci@80000000", "reg", cells, 2 * sizeof(cells[0]));
-    qemu_fdt_setprop_cell(fdt, "/pci@80000000", "8259-interrupt-acknowledge",
-                          0xf1000cb4);
-    cells[0] = cpu_to_be32(0x01000000);
-    cells[1] = 0;
-    cells[2] = 0;
-    cells[3] = cpu_to_be32(PCI1_IO_BASE);
-    cells[4] = 0;
-    cells[5] = cpu_to_be32(PCI1_IO_SIZE);
-    cells[6] = cpu_to_be32(0x02000000);
-    cells[7] = 0;
-    cells[8] = cpu_to_be32(PCI1_MEM_BASE);
-    cells[9] = cpu_to_be32(PCI1_MEM_BASE);
-    cells[10] = 0;
-    cells[11] = cpu_to_be32(PCI1_MEM_SIZE);
-    qemu_fdt_setprop(fdt, "/pci@80000000", "ranges",
-                     cells, 12 * sizeof(cells[0]));
-    qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#size-cells", 2);
-    qemu_fdt_setprop_cell(fdt, "/pci@80000000", "#address-cells", 3);
-    qemu_fdt_setprop_string(fdt, "/pci@80000000", "device_type", "pci");
-
-    fi.path = "/pci@80000000";
-    pci_bus = mv64361_get_pci_bus(pm->mv, 1);
-    pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
-
-    qemu_fdt_add_subnode(fdt, "/failsafe");
-    qemu_fdt_setprop_string(fdt, "/failsafe", "device_type", "serial");
-
-    qemu_fdt_add_subnode(fdt, "/rtas");
-    qemu_fdt_setprop_cell(fdt, "/rtas", "system-reboot", RTAS_SYSTEM_REBOOT);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "hibernate", RTAS_HIBERNATE);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "suspend", RTAS_SUSPEND);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "power-off", RTAS_POWER_OFF);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "set-indicator", RTAS_SET_INDICATOR);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "display-character",
-                          RTAS_DISPLAY_CHARACTER);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "write-pci-config",
-                          RTAS_WRITE_PCI_CONFIG);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "read-pci-config",
-                          RTAS_READ_PCI_CONFIG);
-    /* Pegasos2 firmware misspells check-exception and guests use that */
-    qemu_fdt_setprop_cell(fdt, "/rtas", "check-execption",
-                          RTAS_CHECK_EXCEPTION);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "event-scan", RTAS_EVENT_SCAN);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "set-time-of-day",
-                          RTAS_SET_TIME_OF_DAY);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "get-time-of-day",
-                          RTAS_GET_TIME_OF_DAY);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-store", RTAS_NVRAM_STORE);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "nvram-fetch", RTAS_NVRAM_FETCH);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "restart-rtas", RTAS_RESTART_RTAS);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-error-log-max", 0);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-event-scan-rate", 0);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-display-device", 0);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-size", 20);
-    qemu_fdt_setprop_cell(fdt, "/rtas", "rtas-version", 1);
-
-    /* cpus */
-    qemu_fdt_add_subnode(fdt, "/cpus");
-    qemu_fdt_setprop_cell(fdt, "/cpus", "#cpus", 1);
-    qemu_fdt_setprop_cell(fdt, "/cpus", "#address-cells", 1);
-    qemu_fdt_setprop_cell(fdt, "/cpus", "#size-cells", 0);
+    uint32_t cells[2];
 
     /* FIXME Get CPU name from CPU object */
     const char *cp = "/cpus/PowerPC,G4";
@@ -1034,15 +810,43 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     cells[1] = 0;
     qemu_fdt_setprop(fdt, cp, "reg", cells, 2 * sizeof(cells[0]));
     qemu_fdt_setprop_string(fdt, cp, "device_type", "cpu");
+}
 
-    /* memory */
-    qemu_fdt_add_subnode(fdt, "/memory@0");
+static void *load_dtb(const char *filename, int *fdt_size)
+{
+    void *fdt;
+    g_autofree char *name = qemu_find_file(QEMU_FILE_TYPE_DTB, filename);
+
+    if (!name) {
+        error_report("Could not find dtb file '%s'", filename);
+        return NULL;
+    }
+    fdt = load_device_tree(name, fdt_size);
+    if (!fdt) {
+        error_report("Could not load dtb file '%s'", name);
+    }
+    return fdt;
+}
+
+static void *build_fdt(MachineState *machine, int *fdt_size)
+{
+    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
+    FDTInfo fi;
+    PCIBus *pci_bus;
+    uint32_t cells[2];
+    void *fdt = load_dtb("pegasos2.dtb", fdt_size);
+
+    if (!fdt) {
+        return NULL;
+    }
+    qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
+
+    /* Set memory size */
     cells[0] = 0;
     cells[1] = cpu_to_be32(machine->ram_size);
     qemu_fdt_setprop(fdt, "/memory@0", "reg", cells, 2 * sizeof(cells[0]));
-    qemu_fdt_setprop_string(fdt, "/memory@0", "device_type", "memory");
 
-    qemu_fdt_add_subnode(fdt, "/chosen");
+    /* Boot parameters */
     if (pm->initrd_addr && pm->initrd_size) {
         qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
                               pm->initrd_addr + pm->initrd_size);
@@ -1052,8 +856,15 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
                             machine->kernel_cmdline ?: "");
 
-    qemu_fdt_add_subnode(fdt, "/openprom");
-    qemu_fdt_setprop_string(fdt, "/openprom", "model", "Pegasos2,1.1");
+    add_cpu_info(fdt, pm->cpu);
+
+    fi.fdt = fdt;
+    fi.path = "/pci@c0000000";
+    pci_bus = mv64361_get_pci_bus(pm->mv, 0);
+    pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
+    fi.path = "/pci@80000000";
+    pci_bus = mv64361_get_pci_bus(pm->mv, 1);
+    pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
 
     return fdt;
 }
diff --git a/pc-bios/dtb/meson.build b/pc-bios/dtb/meson.build
index 993032949f..f14648f3a4 100644
--- a/pc-bios/dtb/meson.build
+++ b/pc-bios/dtb/meson.build
@@ -1,6 +1,7 @@
 dtbs = [
   'bamboo.dtb',
   'canyonlands.dtb',
+  'pegasos2.dtb',
   'petalogix-ml605.dtb',
   'petalogix-s3adsp1800.dtb',
 ]
diff --git a/pc-bios/dtb/pegasos2.dtb b/pc-bios/dtb/pegasos2.dtb
new file mode 100644
index 0000000000000000000000000000000000000000..29c35216ec2d77e4083a3ef618ca185925fb5d61
GIT binary patch
literal 1701
zcmcb>`|m9S1KUyt1_lcT29^^H3=A3!3=Dz{3=9GcV8D2nfq`WLn2Aa-Lb=Qg3=Aw#
zHb@M_XJueu;7`sdDu9ZE#5frk7^DMI(-VvHi;a-PL2`;lPGAubo11}wK`W^sCoxaK
zJvYe%E)LRfiABE*0|SFQR9wN?BPc*2Aiq4dD8N}ExU#q;H5X(6V}3zuUO`bln8U!p
z0J4V{**!XjdWIl{3=9lR3=9m6$r<^@sd-=#Fh4gnH@~RT!2m1*(a#R@BSai53Nn*}
zfq@|!%!3eMy~zco#SkvoUQk%YqwzspSlEH&vq5fvxuvKi5nX>FR32m}NPQgx1A_?E
zUm$)5$Ur3i95nt$H2x7Z{zWwN??T-Iv+pI;Y#9G1Gz~!cjG(w;gQ{U+U|<Bf4HRB5
zc@+i*22fbR_$CYt3?Mx)zAFO*0~eD1a0UhjP`ZH0r$W;xjGxcIz#xRAzMO%9K^TeO
z2n`=_e5562<`gHUfy@AT8)OE^ZT!WlMVW~?AR$N^C`it9urPoCuqY(nLE+0^kemq;
z0_g?uVQd&56u%(5pnS%D#y<-}q3$tYU|^gNifoW35dH@uK$sDd_(04C1_lNY2C*GL
z1l(@MWgi)Mwm{7Sg<&*E9h#bh5G~;J#=*eAcp1tEQ6P6Qg8Y^Y@fvcP2Kj|#zcK%G
zSOs+thTndGYy@E>za3y;U;tr|umXsH_zmnAkT{YUDD8m!0tzlrSYq=F$UmIQi76>X
zsl~;*$*DOx#SAH_WtqvT@g<c7sSLUKDXBROMX6<(#hLke49@;8uI{dWI%TPODfvZk
zZc=_?Q3{-wl3JWxlvz*$(omF|&Y)bJS(OSkTN#|6L77swEVT%1CYS?K!T@HaWEL0X
zBv$G|TmcbFElbTS(Jf9+%+oDOEJ=k578T_e>E`68>*gj_FchU0mn0UI=z`2($SW&K
z%+*axElJLRvWrXdi&7cVQ%iJ9GILXP^V4)w5-S;s(f9~^7?Lwmle2YGD^inT9!X5m
zElAGPP0r6t%S>k|FUl-QMHYa$J2@k<C^5MtwFqo_W?o8Wa$-q-5kmo}T-D7_OJgW5
zEiOpSOJT^!OiC@v1No;IT-NFqr6%R)moOyf<R@qArWK_YmZs(<S27eO=B1|=Ggugz
zTIy!zm82FGl@^rfCMIX+<(KEArlhAbfZUZ-l$nyAs+(7uo0M9_kW^Z%3)aT~09&C8
A7XSbN

literal 0
HcmV?d00001

diff --git a/pc-bios/dtb/pegasos2.dts b/pc-bios/dtb/pegasos2.dts
new file mode 100644
index 0000000000..0ddb9e3bec
--- /dev/null
+++ b/pc-bios/dtb/pegasos2.dts
@@ -0,0 +1,167 @@
+/*
+ * QEMU Pegasos2 Device Tree Source
+ *
+ * Copyright 2025 BALATON Zoltan
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This is partial source, more info will be filled in by board code.
+ */
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	device_type = "chrp";
+	model = "Pegasos2";
+	revision = "2B";
+	CODEGEN,vendor = "bplan GmbH";
+	CODEGEN,board = "Pegasos2";
+	CODEGEN,description = "Pegasos CHRP PowerPC System";
+
+	openprom {
+		model = "Pegasos2,1.1";
+	};
+
+	chosen {
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0 0>;
+	};
+
+	cpus {
+		#size-cells	= <0>;
+		#address-cells	= <1>;
+		#cpus		= <1>;
+	};
+
+	rtas {
+		rtas-version		= <1>;
+		rtas-size		= <20>;
+		rtas-display-device	= <0>;
+		rtas-event-scan-rate	= <0>;
+		rtas-error-log-max	= <0>;
+		restart-rtas		= <0>;
+		nvram-fetch		= <1>;
+		nvram-store		= <2>;
+		get-time-of-day		= <3>;
+		set-time-of-day		= <4>;
+		event-scan		= <6>;
+		/* Pegasos2 firmware misspells check-exception */
+		check-execption		= <7>;
+		read-pci-config		= <8>;
+		write-pci-config	= <9>;
+		display-character	= <10>;
+		set-indicator		= <11>;
+		power-off		= <17>;
+		suspend			= <18>;
+		hibernate		= <19>;
+		system-reboot		= <20>;
+	};
+
+	failsafe {
+		device_type = "serial";
+	};
+
+	pci@80000000 {
+		device_type		= "pci";
+		#address-cells		= <3>;
+		#size-cells		= <2>;
+		clock-frequency		= <33333333>;
+		ranges = <0x01000000 0 0x00000000 0xfe000000 0 0x00010000
+			  0x02000000 0 0x80000000 0x80000000 0 0x40000000>;
+		8259-interrupt-acknowledge = <0xf1000cb4>;
+		reg = <0x80000000 0x40000000>;
+		pci-bridge-number	= <0>;
+		bus-range		= <0 0>;
+
+		isa@c {
+			vendor-id	= <0x1106>;
+			device-id	= <0x8231>;
+			revision-id	= <0x10>;
+			class-code	= <0x60100>;
+			/* Pegasos firmware has subsystem-id and
+			   subsystem-vendor-id swapped */
+			subsystem-id	= <0x1af4>;
+			subsystem-vendor-id = <0x1100>;
+			reg = <0x6000 0 0 0 0>;
+			device_type	= "isa";
+			#address-cells	= <2>;
+			#size-cells	= <1>;
+			eisa-slots	= <0>;
+			clock-frequency	= <8333333>;
+			slot-names	= <0>;
+
+			serial@i2f8 {
+				device_type	= "serial";
+				reg		= <1 0x2f8 8>;
+				interrupts	= <3 0>;
+				clock-frequency	= <1843200>;
+				compatible	= "pnpPNP,501";
+			};
+
+			8042@i60 {
+				device_type	= "";
+				reg		= <1 0x60 5>;
+				clock-frequency	= <0>;
+				compatible	= "chrp,8042";
+				interrupt-controller = "";
+				#address-cells	= <1>;
+				#size-cells	= <0>;
+				#interrupt-cells = <2>;
+
+			};
+
+			keyboard@i60 {
+				device_type	= "keyboard";
+				reg		= <1 0x60 5>;
+				interrupts	= <1 0>;
+				compatible	= "pnpPNP,303";
+			};
+
+			rtc@i70 {
+				device_type	= "rtc";
+				reg		= <1 0x70 2>;
+				interrupts	= <8 0>;
+				clock-frequency	= <0>;
+				compatible	= "ds1385-rtc";
+			};
+
+			timer@i40 {
+				device_type	= "timer";
+				reg		= <1 0x40 8>;
+				clock-frequency	= <0>;
+				compatible	= "pnpPNP,100";
+			};
+
+			fdc@i3f0 {
+				device_type	= "fdc";
+				reg		= <1 0x3f0 8>;
+				interrupts	= <6 0>;
+				clock-frequency	= <0>;
+				compatible	= "pnpPNP,700";
+			};
+
+			lpt@i3bc {
+				device_type	= "lpt";
+				reg		= <1 0x3bc 8>;
+				interrupts	= <7 0>;
+				clock-frequency	= <0>;
+				compatible	= "pnpPNP,400";
+			};
+		};
+	};
+
+	pci@c0000000 {
+		device_type		= "pci";
+		#address-cells		= <3>;
+		#size-cells		= <2>;
+		clock-frequency		= <66666666>;
+		ranges = <0x01000000 0 0x00000000 0xf8000000 0 0x00010000
+			  0x02000000 0 0xc0000000 0xc0000000 0 0x20000000>;
+		reg = <0xc0000000 0x20000000>;
+		pci-bridge-number	= <1>;
+		bus-range		= <0 0>;
+	};
+};

From 4f5ba146af4f18c0261c74b204e9b9b8d2735070 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:10 +0200
Subject: [PATCH 1568/2396] hw/ppc/pegasos2: Remove fdt pointer from machine
 state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The machine class has a field for storing the fdt so we don't need our
own and can use that instead.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/f4355b8d2889aba19d28001e61ac3f9937fc5250.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 7 ++-----
 1 file changed, 2 insertions(+), 5 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index f4787397dc..2ba579dddf 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -74,7 +74,6 @@ struct Pegasos2MachineState {
     qemu_irq mv_pirq[PCI_NUM_PINS];
     qemu_irq via_pirq[PCI_NUM_PINS];
     Vof *vof;
-    void *fdt_blob;
     uint64_t kernel_addr;
     uint64_t kernel_entry;
     uint64_t kernel_size;
@@ -413,13 +412,11 @@ static void pegasos2_machine_reset(MachineState *machine, ResetType type)
     d[1] = cpu_to_be64(pm->kernel_size - (pm->kernel_entry - pm->kernel_addr));
     qemu_fdt_setprop(fdt, "/chosen", "qemu,boot-kernel", d, sizeof(d));
 
-    g_free(pm->fdt_blob);
-    pm->fdt_blob = fdt;
-
     vof_build_dt(fdt, pm->vof);
     vof_client_open_store(fdt, pm->vof, "/chosen", "stdout", "/failsafe");
 
     /* Set machine->fdt for 'dumpdtb' QMP/HMP command */
+    g_free(machine->fdt);
     machine->fdt = fdt;
 
     pm->cpu->vhyp = PPC_VIRTUAL_HYPERVISOR(machine);
@@ -559,7 +556,7 @@ static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
     } else if (env->gpr[3] == KVMPPC_H_RTAS) {
         env->gpr[3] = pegasos2_rtas(cpu, pm, env->gpr[4]);
     } else if (env->gpr[3] == KVMPPC_H_VOF_CLIENT) {
-        int ret = vof_client_call(MACHINE(pm), pm->vof, pm->fdt_blob,
+        int ret = vof_client_call(MACHINE(pm), pm->vof, MACHINE(pm)->fdt,
                                   env->gpr[4]);
         env->gpr[3] = (ret ? H_PARAMETER : H_SUCCESS);
     } else {

From ac93f74b281893e383c244b8a922e270fe7c830d Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:12 +0200
Subject: [PATCH 1569/2396] hw/ppc/pegasos2: Rename mv field in machine state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use more generic name for the field used to store the north bridge in
the machine state.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/f1c189f16a260377abe0d270e778f2738649446a.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 2ba579dddf..9b89c7ecc2 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -68,7 +68,7 @@ struct Pegasos2MachineState {
     MachineState parent_obj;
 
     PowerPCCPU *cpu;
-    DeviceState *mv;
+    DeviceState *nb; /* north bridge */
     IRQState pci_irqs[PCI_NUM_PINS];
     OrIRQState orirq[PCI_NUM_PINS];
     qemu_irq mv_pirq[PCI_NUM_PINS];
@@ -166,12 +166,12 @@ static void pegasos2_init(MachineState *machine)
     }
 
     /* Marvell Discovery II system controller */
-    pm->mv = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
+    pm->nb = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
                           qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
     for (i = 0; i < PCI_NUM_PINS; i++) {
-        pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->mv, "gpp", 12 + i);
+        pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->nb, "gpp", 12 + i);
     }
-    pci_bus = mv64361_get_pci_bus(pm->mv, 1);
+    pci_bus = mv64361_get_pci_bus(pm->nb, 1);
 
     /* VIA VT8231 South Bridge (multifunction PCI device) */
     via = OBJECT(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
@@ -190,7 +190,7 @@ static void pegasos2_init(MachineState *machine)
                               object_resolve_path_component(via, "rtc"),
                               "date");
     qdev_connect_gpio_out_named(DEVICE(via), "intr", 0,
-                                qdev_get_gpio_in_named(pm->mv, "gpp", 31));
+                                qdev_get_gpio_in_named(pm->nb, "gpp", 31));
 
     dev = PCI_DEVICE(object_resolve_path_component(via, "ide"));
     pci_ide_create_devs(dev);
@@ -208,7 +208,7 @@ static void pegasos2_init(MachineState *machine)
         DeviceState *pd;
         g_autofree const char *pn = g_strdup_printf("pcihost%d", h);
 
-        pd = DEVICE(object_resolve_path_component(OBJECT(pm->mv), pn));
+        pd = DEVICE(object_resolve_path_component(OBJECT(pm->nb), pn));
         assert(pd);
         for (i = 0; i < PCI_NUM_PINS; i++) {
             OrIRQState *ori = &pm->orirq[i];
@@ -267,7 +267,7 @@ static void pegasos2_init(MachineState *machine)
 static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
                                      uint32_t addr, uint32_t len)
 {
-    MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
+    MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->nb), 0);
     uint64_t val = 0xffffffffULL;
     memory_region_dispatch_read(r, addr, &val, size_memop(len) | MO_LE,
                                 MEMTXATTRS_UNSPECIFIED);
@@ -277,7 +277,7 @@ static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
 static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
                                   uint32_t len, uint32_t val)
 {
-    MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->mv), 0);
+    MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->nb), 0);
     memory_region_dispatch_write(r, addr, val, size_memop(len) | MO_LE,
                                  MEMTXATTRS_UNSPECIFIED);
 }
@@ -857,10 +857,10 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
 
     fi.fdt = fdt;
     fi.path = "/pci@c0000000";
-    pci_bus = mv64361_get_pci_bus(pm->mv, 0);
+    pci_bus = mv64361_get_pci_bus(pm->nb, 0);
     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
     fi.path = "/pci@80000000";
-    pci_bus = mv64361_get_pci_bus(pm->mv, 1);
+    pci_bus = mv64361_get_pci_bus(pm->nb, 1);
     pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
 
     return fdt;

From 25d86d4f29f9712f8602d5768895d210466eb05a Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:13 +0200
Subject: [PATCH 1570/2396] hw/ppc/pegasos2: Add south bridge pointer in the
 machine state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add field for the south bridge in machine state to have both north and
south bridges in it.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/654d3223b418d5bb2ba08a2b014375c2abf341aa.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 9b89c7ecc2..4b63f0e175 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -69,6 +69,7 @@ struct Pegasos2MachineState {
 
     PowerPCCPU *cpu;
     DeviceState *nb; /* north bridge */
+    DeviceState *sb; /* south bridge */
     IRQState pci_irqs[PCI_NUM_PINS];
     OrIRQState orirq[PCI_NUM_PINS];
     qemu_irq mv_pirq[PCI_NUM_PINS];
@@ -174,7 +175,8 @@ static void pegasos2_init(MachineState *machine)
     pci_bus = mv64361_get_pci_bus(pm->nb, 1);
 
     /* VIA VT8231 South Bridge (multifunction PCI device) */
-    via = OBJECT(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
+    pm->sb = DEVICE(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
+    via = OBJECT(pm->sb);
 
     /* Set properties on individual devices before realizing the south bridge */
     if (machine->audiodev) {

From 4c17dcff41696a13c1ba50c789ea571b894b053f Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:14 +0200
Subject: [PATCH 1571/2396] hw/ppc/pegasos2: Move PCI IRQ routing setup to a
 function
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Collect steps of setting up PCI IRQ routing in one function.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/f5ff16a6933ab6e1f9e194d16ef85364ac3cf6df.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 66 +++++++++++++++++++++++------------------------
 1 file changed, 33 insertions(+), 33 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 4b63f0e175..2f9bd3eac5 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -107,6 +107,38 @@ static void pegasos2_pci_irq(void *opaque, int n, int level)
     qemu_set_irq(pm->via_pirq[n], level);
 }
 
+/* Set up PCI interrupt routing: lines from pci.0 and pci.1 are ORed */
+static void pegasos2_setup_pci_irq(Pegasos2MachineState *pm)
+{
+    for (int h = 0; h < 2; h++) {
+        DeviceState *pd;
+        g_autofree const char *pn = g_strdup_printf("pcihost%d", h);
+
+        pd = DEVICE(object_resolve_path_component(OBJECT(pm->nb), pn));
+        assert(pd);
+        for (int i = 0; i < PCI_NUM_PINS; i++) {
+            OrIRQState *ori = &pm->orirq[i];
+
+            if (h == 0) {
+                g_autofree const char *n = g_strdup_printf("pci-orirq[%d]", i);
+
+                object_initialize_child_with_props(OBJECT(pm), n,
+                                                   ori, sizeof(*ori),
+                                                   TYPE_OR_IRQ, &error_fatal,
+                                                   "num-lines", "2", NULL);
+                qdev_realize(DEVICE(ori), NULL, &error_fatal);
+                qemu_init_irq(&pm->pci_irqs[i], pegasos2_pci_irq, pm, i);
+                qdev_connect_gpio_out(DEVICE(ori), 0, &pm->pci_irqs[i]);
+                pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->nb, "gpp", 12 + i);
+                pm->via_pirq[i] = qdev_get_gpio_in_named(pm->sb, "pirq", i);
+            }
+            qdev_connect_gpio_out(pd, i, qdev_get_gpio_in(DEVICE(ori), h));
+        }
+    }
+    qdev_connect_gpio_out_named(pm->sb, "intr", 0,
+                                qdev_get_gpio_in_named(pm->nb, "gpp", 31));
+}
+
 static void pegasos2_init(MachineState *machine)
 {
     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
@@ -118,7 +150,6 @@ static void pegasos2_init(MachineState *machine)
     I2CBus *i2c_bus;
     const char *fwname = machine->firmware ?: PROM_FILENAME;
     char *filename;
-    int i;
     ssize_t sz;
     uint8_t *spd_data;
 
@@ -169,9 +200,6 @@ static void pegasos2_init(MachineState *machine)
     /* Marvell Discovery II system controller */
     pm->nb = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
                           qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
-    for (i = 0; i < PCI_NUM_PINS; i++) {
-        pm->mv_pirq[i] = qdev_get_gpio_in_named(pm->nb, "gpp", 12 + i);
-    }
     pci_bus = mv64361_get_pci_bus(pm->nb, 1);
 
     /* VIA VT8231 South Bridge (multifunction PCI device) */
@@ -185,14 +213,9 @@ static void pegasos2_init(MachineState *machine)
     }
 
     pci_realize_and_unref(PCI_DEVICE(via), pci_bus, &error_abort);
-    for (i = 0; i < PCI_NUM_PINS; i++) {
-        pm->via_pirq[i] = qdev_get_gpio_in_named(DEVICE(via), "pirq", i);
-    }
     object_property_add_alias(OBJECT(machine), "rtc-time",
                               object_resolve_path_component(via, "rtc"),
                               "date");
-    qdev_connect_gpio_out_named(DEVICE(via), "intr", 0,
-                                qdev_get_gpio_in_named(pm->nb, "gpp", 31));
 
     dev = PCI_DEVICE(object_resolve_path_component(via, "ide"));
     pci_ide_create_devs(dev);
@@ -205,30 +228,7 @@ static void pegasos2_init(MachineState *machine)
     /* other PC hardware */
     pci_vga_init(pci_bus);
 
-    /* PCI interrupt routing: lines from pci.0 and pci.1 are ORed */
-    for (int h = 0; h < 2; h++) {
-        DeviceState *pd;
-        g_autofree const char *pn = g_strdup_printf("pcihost%d", h);
-
-        pd = DEVICE(object_resolve_path_component(OBJECT(pm->nb), pn));
-        assert(pd);
-        for (i = 0; i < PCI_NUM_PINS; i++) {
-            OrIRQState *ori = &pm->orirq[i];
-
-            if (h == 0) {
-                g_autofree const char *n = g_strdup_printf("pci-orirq[%d]", i);
-
-                object_initialize_child_with_props(OBJECT(pm), n,
-                                                   ori, sizeof(*ori),
-                                                   TYPE_OR_IRQ, &error_fatal,
-                                                   "num-lines", "2", NULL);
-                qdev_realize(DEVICE(ori), NULL, &error_fatal);
-                qemu_init_irq(&pm->pci_irqs[i], pegasos2_pci_irq, pm, i);
-                qdev_connect_gpio_out(DEVICE(ori), 0, &pm->pci_irqs[i]);
-            }
-            qdev_connect_gpio_out(pd, i, qdev_get_gpio_in(DEVICE(ori), h));
-        }
-    }
+    pegasos2_setup_pci_irq(pm);
 
     if (machine->kernel_filename) {
         sz = load_elf(machine->kernel_filename, NULL, NULL, NULL,

From d617218e1bcac10482a6392474079c1d4398adae Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:15 +0200
Subject: [PATCH 1572/2396] hw/ppc/pegasos2: Move hardware specific parts out
 of machine reset
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Move the pegasos2 specific chipset reset out from machine reset to a
separate function and move generic parts that are not pegasos2
specific from build_fdt to machine reset so now build_fdt only
contains pegasos2 specific parts and can be renamed accordingly.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/f6633a68a72aad4fefb8d2373b52561f8ca8d41d.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 79 ++++++++++++++++++++++++-----------------------
 1 file changed, 41 insertions(+), 38 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 2f9bd3eac5..ed3070204b 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -57,10 +57,6 @@
 
 #define BUS_FREQ_HZ 133333333
 
-#define PCI0_CFG_ADDR 0xcf8
-#define PCI1_CFG_ADDR 0xc78
-#define PCI1_IO_BASE  0xfe000000
-
 #define TYPE_PEGASOS2_MACHINE  MACHINE_TYPE_NAME("pegasos2")
 OBJECT_DECLARE_TYPE(Pegasos2MachineState, MachineClass, PEGASOS2_MACHINE)
 
@@ -82,7 +78,7 @@ struct Pegasos2MachineState {
     uint64_t initrd_size;
 };
 
-static void *build_fdt(MachineState *machine, int *fdt_size);
+static void *pegasos2_build_fdt(Pegasos2MachineState *pm, int *fdt_size);
 
 static void pegasos2_cpu_reset(void *opaque)
 {
@@ -284,6 +280,9 @@ static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
                                  MEMTXATTRS_UNSPECIFIED);
 }
 
+#define PCI0_CFG_ADDR 0xcf8
+#define PCI1_CFG_ADDR 0xc78
+
 static uint32_t pegasos2_pci_config_read(Pegasos2MachineState *pm, int bus,
                                          uint32_t addr, uint32_t len)
 {
@@ -308,23 +307,12 @@ static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
 
 static void pegasos2_superio_write(uint8_t addr, uint8_t val)
 {
-    cpu_physical_memory_write(PCI1_IO_BASE + 0x3f0, &addr, 1);
-    cpu_physical_memory_write(PCI1_IO_BASE + 0x3f1, &val, 1);
+    cpu_physical_memory_write(0xfe0003f0, &addr, 1);
+    cpu_physical_memory_write(0xfe0003f1, &val, 1);
 }
 
-static void pegasos2_machine_reset(MachineState *machine, ResetType type)
+static void pegasos2_chipset_reset(Pegasos2MachineState *pm)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
-    void *fdt;
-    uint64_t d[2];
-    int sz;
-
-    qemu_devices_reset(type);
-    if (!pm->vof) {
-        return; /* Firmware should set up machine so nothing to do */
-    }
-
-    /* Otherwise, set up devices that board firmware would normally do */
     pegasos2_mv_reg_write(pm, 0, 4, 0x28020ff);
     pegasos2_mv_reg_write(pm, 0x278, 4, 0xa31fc);
     pegasos2_mv_reg_write(pm, 0xf300, 4, 0x11ff0400);
@@ -387,6 +375,23 @@ static void pegasos2_machine_reset(MachineState *machine, ResetType type)
 
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 6) << 8) |
                               PCI_INTERRUPT_LINE, 2, 0x309);
+}
+
+static void pegasos2_machine_reset(MachineState *machine, ResetType type)
+{
+    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
+    void *fdt;
+    uint32_t c[2];
+    uint64_t d[2];
+    int sz;
+
+    qemu_devices_reset(type);
+    if (!pm->vof) {
+        return; /* Firmware should set up machine so nothing to do */
+    }
+
+    /* Otherwise, set up devices that board firmware would normally do */
+    pegasos2_chipset_reset(pm);
 
     /* Device tree and VOF set up */
     vof_init(pm->vof, machine->ram_size, &error_fatal);
@@ -405,10 +410,25 @@ static void pegasos2_machine_reset(MachineState *machine, ResetType type)
         exit(1);
     }
 
-    fdt = build_fdt(machine, &sz);
+    fdt = pegasos2_build_fdt(pm, &sz);
     if (!fdt) {
         exit(1);
     }
+
+    /* Set memory size */
+    c[0] = 0;
+    c[1] = cpu_to_be32(machine->ram_size);
+    qemu_fdt_setprop(fdt, "/memory@0", "reg", c, sizeof(c));
+
+    /* Boot parameters */
+    if (pm->initrd_addr && pm->initrd_size) {
+        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
+                              pm->initrd_addr + pm->initrd_size);
+        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start",
+                              pm->initrd_addr);
+    }
+    qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
+                            machine->kernel_cmdline ?: "");
     /* FIXME: VOF assumes entry is same as load address */
     d[0] = cpu_to_be64(pm->kernel_entry);
     d[1] = cpu_to_be64(pm->kernel_size - (pm->kernel_entry - pm->kernel_addr));
@@ -827,12 +847,10 @@ static void *load_dtb(const char *filename, int *fdt_size)
     return fdt;
 }
 
-static void *build_fdt(MachineState *machine, int *fdt_size)
+static void *pegasos2_build_fdt(Pegasos2MachineState *pm, int *fdt_size)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
     FDTInfo fi;
     PCIBus *pci_bus;
-    uint32_t cells[2];
     void *fdt = load_dtb("pegasos2.dtb", fdt_size);
 
     if (!fdt) {
@@ -840,21 +858,6 @@ static void *build_fdt(MachineState *machine, int *fdt_size)
     }
     qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
 
-    /* Set memory size */
-    cells[0] = 0;
-    cells[1] = cpu_to_be32(machine->ram_size);
-    qemu_fdt_setprop(fdt, "/memory@0", "reg", cells, 2 * sizeof(cells[0]));
-
-    /* Boot parameters */
-    if (pm->initrd_addr && pm->initrd_size) {
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-end",
-                              pm->initrd_addr + pm->initrd_size);
-        qemu_fdt_setprop_cell(fdt, "/chosen", "linux,initrd-start",
-                              pm->initrd_addr);
-    }
-    qemu_fdt_setprop_string(fdt, "/chosen", "bootargs",
-                            machine->kernel_cmdline ?: "");
-
     add_cpu_info(fdt, pm->cpu);
 
     fi.fdt = fdt;

From 2c378545d02e0aa47c9234bf8c4028a9faaf72d1 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:16 +0200
Subject: [PATCH 1573/2396] hw/ppc/pegasos2: Introduce abstract superclass
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Rename machine state struct to PegasosMachineState as it will be used
for pegasos1 too.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/a09590a5da4572c9d392542f5c3793e6eb08ab9e.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 66 ++++++++++++++++++++++++-----------------------
 1 file changed, 34 insertions(+), 32 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index ed3070204b..f5b56c0e94 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -57,10 +57,10 @@
 
 #define BUS_FREQ_HZ 133333333
 
-#define TYPE_PEGASOS2_MACHINE  MACHINE_TYPE_NAME("pegasos2")
-OBJECT_DECLARE_TYPE(Pegasos2MachineState, MachineClass, PEGASOS2_MACHINE)
+#define TYPE_PEGASOS_MACHINE MACHINE_TYPE_NAME("pegasos")
+OBJECT_DECLARE_SIMPLE_TYPE(PegasosMachineState, PEGASOS_MACHINE)
 
-struct Pegasos2MachineState {
+struct PegasosMachineState {
     MachineState parent_obj;
 
     PowerPCCPU *cpu;
@@ -78,12 +78,12 @@ struct Pegasos2MachineState {
     uint64_t initrd_size;
 };
 
-static void *pegasos2_build_fdt(Pegasos2MachineState *pm, int *fdt_size);
+static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size);
 
 static void pegasos2_cpu_reset(void *opaque)
 {
     PowerPCCPU *cpu = opaque;
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(current_machine);
+    PegasosMachineState *pm = PEGASOS_MACHINE(current_machine);
 
     cpu_reset(CPU(cpu));
     cpu->env.spr[SPR_HID1] = 7ULL << 28;
@@ -96,7 +96,7 @@ static void pegasos2_cpu_reset(void *opaque)
 
 static void pegasos2_pci_irq(void *opaque, int n, int level)
 {
-    Pegasos2MachineState *pm = opaque;
+    PegasosMachineState *pm = opaque;
 
     /* PCI interrupt lines are connected to both MV64361 and VT8231 */
     qemu_set_irq(pm->mv_pirq[n], level);
@@ -104,7 +104,7 @@ static void pegasos2_pci_irq(void *opaque, int n, int level)
 }
 
 /* Set up PCI interrupt routing: lines from pci.0 and pci.1 are ORed */
-static void pegasos2_setup_pci_irq(Pegasos2MachineState *pm)
+static void pegasos2_setup_pci_irq(PegasosMachineState *pm)
 {
     for (int h = 0; h < 2; h++) {
         DeviceState *pd;
@@ -137,7 +137,7 @@ static void pegasos2_setup_pci_irq(Pegasos2MachineState *pm)
 
 static void pegasos2_init(MachineState *machine)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
+    PegasosMachineState *pm = PEGASOS_MACHINE(machine);
     CPUPPCState *env;
     MemoryRegion *rom = g_new(MemoryRegion, 1);
     PCIBus *pci_bus;
@@ -262,7 +262,7 @@ static void pegasos2_init(MachineState *machine)
     }
 }
 
-static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
+static uint32_t pegasos2_mv_reg_read(PegasosMachineState *pm,
                                      uint32_t addr, uint32_t len)
 {
     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->nb), 0);
@@ -272,7 +272,7 @@ static uint32_t pegasos2_mv_reg_read(Pegasos2MachineState *pm,
     return val;
 }
 
-static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
+static void pegasos2_mv_reg_write(PegasosMachineState *pm, uint32_t addr,
                                   uint32_t len, uint32_t val)
 {
     MemoryRegion *r = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->nb), 0);
@@ -283,7 +283,7 @@ static void pegasos2_mv_reg_write(Pegasos2MachineState *pm, uint32_t addr,
 #define PCI0_CFG_ADDR 0xcf8
 #define PCI1_CFG_ADDR 0xc78
 
-static uint32_t pegasos2_pci_config_read(Pegasos2MachineState *pm, int bus,
+static uint32_t pegasos2_pci_config_read(PegasosMachineState *pm, int bus,
                                          uint32_t addr, uint32_t len)
 {
     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
@@ -296,7 +296,7 @@ static uint32_t pegasos2_pci_config_read(Pegasos2MachineState *pm, int bus,
     return val;
 }
 
-static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
+static void pegasos2_pci_config_write(PegasosMachineState *pm, int bus,
                                       uint32_t addr, uint32_t len, uint32_t val)
 {
     hwaddr pcicfg = bus ? PCI1_CFG_ADDR : PCI0_CFG_ADDR;
@@ -311,7 +311,7 @@ static void pegasos2_superio_write(uint8_t addr, uint8_t val)
     cpu_physical_memory_write(0xfe0003f1, &val, 1);
 }
 
-static void pegasos2_chipset_reset(Pegasos2MachineState *pm)
+static void pegasos2_chipset_reset(PegasosMachineState *pm)
 {
     pegasos2_mv_reg_write(pm, 0, 4, 0x28020ff);
     pegasos2_mv_reg_write(pm, 0x278, 4, 0xa31fc);
@@ -379,7 +379,7 @@ static void pegasos2_chipset_reset(Pegasos2MachineState *pm)
 
 static void pegasos2_machine_reset(MachineState *machine, ResetType type)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
+    PegasosMachineState *pm = PEGASOS_MACHINE(machine);
     void *fdt;
     uint32_t c[2];
     uint64_t d[2];
@@ -463,7 +463,7 @@ enum pegasos2_rtas_tokens {
     RTAS_SYSTEM_REBOOT = 20,
 };
 
-static target_ulong pegasos2_rtas(PowerPCCPU *cpu, Pegasos2MachineState *pm,
+static target_ulong pegasos2_rtas(PowerPCCPU *cpu, PegasosMachineState *pm,
                                   target_ulong args_real)
 {
     AddressSpace *as = CPU(cpu)->as;
@@ -566,7 +566,7 @@ static bool pegasos2_cpu_in_nested(PowerPCCPU *cpu)
 
 static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
 {
-    Pegasos2MachineState *pm = PEGASOS2_MACHINE(vhyp);
+    PegasosMachineState *pm = PEGASOS_MACHINE(vhyp);
     CPUPPCState *env = &cpu->env;
 
     /* The TCG path should also be holding the BQL at this point */
@@ -629,24 +629,26 @@ static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
     vmc->setprop = pegasos2_setprop;
 }
 
-static const TypeInfo pegasos2_machine_info = {
-    .name          = TYPE_PEGASOS2_MACHINE,
-    .parent        = TYPE_MACHINE,
-    .class_init    = pegasos2_machine_class_init,
-    .instance_size = sizeof(Pegasos2MachineState),
-    .interfaces = (const InterfaceInfo[]) {
-        { TYPE_PPC_VIRTUAL_HYPERVISOR },
-        { TYPE_VOF_MACHINE_IF },
-        { }
+static const TypeInfo pegasos_machine_types[] = {
+    {
+        .name          = TYPE_PEGASOS_MACHINE,
+        .parent        = TYPE_MACHINE,
+        .instance_size = sizeof(PegasosMachineState),
+        .abstract      = true,
+        .interfaces = (const InterfaceInfo[]) {
+              { TYPE_PPC_VIRTUAL_HYPERVISOR },
+              { TYPE_VOF_MACHINE_IF },
+              { }
+        },
+    },
+    {
+        .name          = MACHINE_TYPE_NAME("pegasos2"),
+        .parent        = TYPE_PEGASOS_MACHINE,
+        .class_init    = pegasos2_machine_class_init,
     },
 };
 
-static void pegasos2_machine_register_types(void)
-{
-    type_register_static(&pegasos2_machine_info);
-}
-
-type_init(pegasos2_machine_register_types)
+DEFINE_TYPES(pegasos_machine_types)
 
 /* FDT creation for passing to firmware */
 
@@ -847,7 +849,7 @@ static void *load_dtb(const char *filename, int *fdt_size)
     return fdt;
 }
 
-static void *pegasos2_build_fdt(Pegasos2MachineState *pm, int *fdt_size)
+static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size)
 {
     FDTInfo fi;
     PCIBus *pci_bus;

From a310dbfade83b52b31f898fa82395e08aa9ae189 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:17 +0200
Subject: [PATCH 1574/2396] hw/ppc/pegasos2: Add bus frequency to machine state
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Store the bus frequency in the machine state and set it from instance
init method.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/b69e21e353b7d7f22a34db5f13443f60f51c7238.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 25 ++++++++++++++++---------
 1 file changed, 16 insertions(+), 9 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index f5b56c0e94..7eaefcf9a0 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -55,8 +55,6 @@
 #define H_PRIVILEGE  -3  /* Caller not privileged */
 #define H_PARAMETER  -4  /* Parameter invalid, out-of-range or conflicting */
 
-#define BUS_FREQ_HZ 133333333
-
 #define TYPE_PEGASOS_MACHINE MACHINE_TYPE_NAME("pegasos")
 OBJECT_DECLARE_SIMPLE_TYPE(PegasosMachineState, PEGASOS_MACHINE)
 
@@ -66,6 +64,7 @@ struct PegasosMachineState {
     PowerPCCPU *cpu;
     DeviceState *nb; /* north bridge */
     DeviceState *sb; /* south bridge */
+    int bus_freq_hz;
     IRQState pci_irqs[PCI_NUM_PINS];
     OrIRQState orirq[PCI_NUM_PINS];
     qemu_irq mv_pirq[PCI_NUM_PINS];
@@ -135,7 +134,7 @@ static void pegasos2_setup_pci_irq(PegasosMachineState *pm)
                                 qdev_get_gpio_in_named(pm->nb, "gpp", 31));
 }
 
-static void pegasos2_init(MachineState *machine)
+static void pegasos_init(MachineState *machine)
 {
     PegasosMachineState *pm = PEGASOS_MACHINE(machine);
     CPUPPCState *env;
@@ -158,7 +157,7 @@ static void pegasos2_init(MachineState *machine)
     }
 
     /* Set time-base frequency */
-    cpu_ppc_tb_init(env, BUS_FREQ_HZ / 4);
+    cpu_ppc_tb_init(env, pm->bus_freq_hz / 4);
     qemu_register_reset(pegasos2_cpu_reset, pm->cpu);
 
     /* RAM */
@@ -610,7 +609,7 @@ static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
     VofMachineIfClass *vmc = VOF_MACHINE_CLASS(oc);
 
     mc->desc = "Genesi/bPlan Pegasos II";
-    mc->init = pegasos2_init;
+    mc->init = pegasos_init;
     mc->reset = pegasos2_machine_reset;
     mc->block_default_type = IF_IDE;
     mc->default_boot_order = "cd";
@@ -629,6 +628,13 @@ static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
     vmc->setprop = pegasos2_setprop;
 }
 
+static void pegasos2_init(Object *obj)
+{
+    PegasosMachineState *pm = PEGASOS_MACHINE(obj);
+
+    pm->bus_freq_hz = 133333333;
+}
+
 static const TypeInfo pegasos_machine_types[] = {
     {
         .name          = TYPE_PEGASOS_MACHINE,
@@ -645,6 +651,7 @@ static const TypeInfo pegasos_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("pegasos2"),
         .parent        = TYPE_PEGASOS_MACHINE,
         .class_init    = pegasos2_machine_class_init,
+        .instance_init = pegasos2_init,
     },
 };
 
@@ -777,7 +784,7 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
     g_string_free(node, TRUE);
 }
 
-static void add_cpu_info(void *fdt, PowerPCCPU *cpu)
+static void add_cpu_info(void *fdt, PowerPCCPU *cpu, int bus_freq)
 {
     uint32_t cells[2];
 
@@ -824,8 +831,8 @@ static void add_cpu_info(void *fdt, PowerPCCPU *cpu)
     qemu_fdt_setprop_cell(fdt, cp, "reservation-granule-size", 4);
     qemu_fdt_setprop_cell(fdt, cp, "timebase-frequency",
                           cpu->env.tb_env->tb_freq);
-    qemu_fdt_setprop_cell(fdt, cp, "bus-frequency", BUS_FREQ_HZ);
-    qemu_fdt_setprop_cell(fdt, cp, "clock-frequency", BUS_FREQ_HZ * 7.5);
+    qemu_fdt_setprop_cell(fdt, cp, "bus-frequency", bus_freq);
+    qemu_fdt_setprop_cell(fdt, cp, "clock-frequency", bus_freq * 7.5);
     qemu_fdt_setprop_cell(fdt, cp, "cpu-version", cpu->env.spr[SPR_PVR]);
     cells[0] = 0;
     cells[1] = 0;
@@ -860,7 +867,7 @@ static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size)
     }
     qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos2");
 
-    add_cpu_info(fdt, pm->cpu);
+    add_cpu_info(fdt, pm->cpu, pm->bus_freq_hz);
 
     fi.fdt = fdt;
     fi.path = "/pci@c0000000";

From d3a16439c370205e9d9fb2a002dc68fc17fab2be Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:18 +0200
Subject: [PATCH 1575/2396] hw/ppc/pegasos2: Add Pegasos I emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Pegasos II is a redesign of the original Pegasos (later marked I)
that replaces the north bridge and has updated firmware but otherwise
these are very similar. The Pegasos uses the same north bridge that
AmigaOne used which we already emulate so we can also easily emulate
Pegasos I.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/8f5bd07553b41d83a54f9df0bb93b76b22dea5c5.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/pegasos2.c | 156 ++++++++++++++++++++++++++++++++++------------
 1 file changed, 117 insertions(+), 39 deletions(-)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 7eaefcf9a0..a11f3c99ed 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -1,5 +1,5 @@
 /*
- * QEMU PowerPC CHRP (Genesi/bPlan Pegasos II) hardware System Emulator
+ * QEMU PowerPC CHRP (Genesi/bPlan Pegasos I/II) hardware System Emulator
  *
  * Copyright (c) 2018-2021 BALATON Zoltan
  *
@@ -15,6 +15,7 @@
 #include "hw/pci/pci_host.h"
 #include "hw/irq.h"
 #include "hw/or-irq.h"
+#include "hw/pci-host/articia.h"
 #include "hw/pci-host/mv64361.h"
 #include "hw/isa/vt82c686.h"
 #include "hw/ide/pci.h"
@@ -55,12 +56,18 @@
 #define H_PRIVILEGE  -3  /* Caller not privileged */
 #define H_PARAMETER  -4  /* Parameter invalid, out-of-range or conflicting */
 
+typedef enum {
+    PEGASOS1 = 1,
+    PEGASOS2 = 2,
+} PegasosMachineType;
+
 #define TYPE_PEGASOS_MACHINE MACHINE_TYPE_NAME("pegasos")
 OBJECT_DECLARE_SIMPLE_TYPE(PegasosMachineState, PEGASOS_MACHINE)
 
 struct PegasosMachineState {
     MachineState parent_obj;
 
+    PegasosMachineType type;
     PowerPCCPU *cpu;
     DeviceState *nb; /* north bridge */
     DeviceState *sb; /* south bridge */
@@ -79,7 +86,7 @@ struct PegasosMachineState {
 
 static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size);
 
-static void pegasos2_cpu_reset(void *opaque)
+static void pegasos_cpu_reset(void *opaque)
 {
     PowerPCCPU *cpu = opaque;
     PegasosMachineState *pm = PEGASOS_MACHINE(current_machine);
@@ -89,6 +96,8 @@ static void pegasos2_cpu_reset(void *opaque)
     if (pm->vof) {
         cpu->env.gpr[1] = 2 * VOF_STACK_SIZE - 0x20;
         cpu->env.nip = 0x100;
+    } else if (pm->type == PEGASOS1) {
+        cpu->env.nip = 0xfffc0100;
     }
     cpu_ppc_tb_reset(&cpu->env);
 }
@@ -139,13 +148,15 @@ static void pegasos_init(MachineState *machine)
     PegasosMachineState *pm = PEGASOS_MACHINE(machine);
     CPUPPCState *env;
     MemoryRegion *rom = g_new(MemoryRegion, 1);
-    PCIBus *pci_bus;
+    PCIBus *pci_bus = NULL;
     Object *via;
     PCIDevice *dev;
     I2CBus *i2c_bus;
     const char *fwname = machine->firmware ?: PROM_FILENAME;
     char *filename;
+    hwaddr prom_addr;
     ssize_t sz;
+    int devfn;
     uint8_t *spd_data;
 
     /* init CPU */
@@ -158,7 +169,7 @@ static void pegasos_init(MachineState *machine)
 
     /* Set time-base frequency */
     cpu_ppc_tb_init(env, pm->bus_freq_hz / 4);
-    qemu_register_reset(pegasos2_cpu_reset, pm->cpu);
+    qemu_register_reset(pegasos_cpu_reset, pm->cpu);
 
     /* RAM */
     if (machine->ram_size > 2 * GiB) {
@@ -176,12 +187,16 @@ static void pegasos_init(MachineState *machine)
     if (!machine->firmware && !pm->vof) {
         pm->vof = g_malloc0(sizeof(*pm->vof));
     }
-    memory_region_init_rom(rom, NULL, "pegasos2.rom", PROM_SIZE, &error_fatal);
-    memory_region_add_subregion(get_system_memory(), PROM_ADDR, rom);
+    prom_addr = PROM_ADDR;
+    if (pm->type == PEGASOS1) {
+        prom_addr += PROM_SIZE;
+    }
+    memory_region_init_rom(rom, NULL, "rom", PROM_SIZE, &error_fatal);
+    memory_region_add_subregion(get_system_memory(), prom_addr, rom);
     sz = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                   ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
     if (sz <= 0) {
-        sz = load_image_targphys(filename, pm->vof ? 0 : PROM_ADDR, PROM_SIZE);
+        sz = load_image_targphys(filename, pm->vof ? 0 : prom_addr, PROM_SIZE);
     }
     if (sz <= 0 || sz > PROM_SIZE) {
         error_report("Could not load firmware '%s'", filename);
@@ -192,13 +207,37 @@ static void pegasos_init(MachineState *machine)
         pm->vof->fw_size = sz;
     }
 
-    /* Marvell Discovery II system controller */
-    pm->nb = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
-                          qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
-    pci_bus = mv64361_get_pci_bus(pm->nb, 1);
+    /* north bridge */
+    switch (pm->type) {
+    case PEGASOS1:
+    {
+        MemoryRegion *pci_mem, *mr;
+
+        /* Articia S */
+        pm->nb = DEVICE(sysbus_create_simple(TYPE_ARTICIA, 0xfe000000, NULL));
+        pci_mem = sysbus_mmio_get_region(SYS_BUS_DEVICE(pm->nb), 1);
+        mr = g_new(MemoryRegion, 1);
+        memory_region_init_alias(mr, OBJECT(pm->nb), "pci-mem-low", pci_mem,
+                                 0, 0x1000000);
+        memory_region_add_subregion(get_system_memory(), 0xfd000000, mr);
+        mr = g_new(MemoryRegion, 1);
+        memory_region_init_alias(mr, OBJECT(pm->nb), "pci-mem-high", pci_mem,
+                                 0x80000000, 0x7d000000);
+        memory_region_add_subregion(get_system_memory(), 0x80000000, mr);
+        pci_bus = PCI_BUS(qdev_get_child_bus(pm->nb, "pci.0"));
+        break;
+    }
+    case PEGASOS2:
+        /* Marvell Discovery II system controller */
+        pm->nb = DEVICE(sysbus_create_simple(TYPE_MV64361, -1,
+                        qdev_get_gpio_in(DEVICE(pm->cpu), PPC6xx_INPUT_INT)));
+        pci_bus = mv64361_get_pci_bus(pm->nb, 1);
+        break;
+    }
 
     /* VIA VT8231 South Bridge (multifunction PCI device) */
-    pm->sb = DEVICE(pci_new_multifunction(PCI_DEVFN(12, 0), TYPE_VT8231_ISA));
+    devfn = PCI_DEVFN(pm->type == PEGASOS1 ? 7 : 12, 0);
+    pm->sb = DEVICE(pci_new_multifunction(devfn, TYPE_VT8231_ISA));
     via = OBJECT(pm->sb);
 
     /* Set properties on individual devices before realizing the south bridge */
@@ -223,7 +262,21 @@ static void pegasos_init(MachineState *machine)
     /* other PC hardware */
     pci_vga_init(pci_bus);
 
-    pegasos2_setup_pci_irq(pm);
+    /* pci interrupt routing */
+    switch (pm->type) {
+    case PEGASOS1:
+        qdev_connect_gpio_out_named(pm->sb, "intr", 0,
+                                    qdev_get_gpio_in(DEVICE(pm->cpu),
+                                                     PPC6xx_INPUT_INT));
+        for (int i = 0; i < PCI_NUM_PINS; i++) {
+            qdev_connect_gpio_out(pm->nb, i,
+                                  qdev_get_gpio_in_named(pm->sb, "pirq", i));
+        }
+        break;
+    case PEGASOS2:
+        pegasos2_setup_pci_irq(pm);
+        break;
+    }
 
     if (machine->kernel_filename) {
         sz = load_elf(machine->kernel_filename, NULL, NULL, NULL,
@@ -376,7 +429,7 @@ static void pegasos2_chipset_reset(PegasosMachineState *pm)
                               PCI_INTERRUPT_LINE, 2, 0x309);
 }
 
-static void pegasos2_machine_reset(MachineState *machine, ResetType type)
+static void pegasos_machine_reset(MachineState *machine, ResetType type)
 {
     PegasosMachineState *pm = PEGASOS_MACHINE(machine);
     void *fdt;
@@ -387,6 +440,9 @@ static void pegasos2_machine_reset(MachineState *machine, ResetType type)
     qemu_devices_reset(type);
     if (!pm->vof) {
         return; /* Firmware should set up machine so nothing to do */
+    } else if (pm->type == PEGASOS1) {
+        error_report("VOF is not supported by this machine");
+        exit(1);
     }
 
     /* Otherwise, set up devices that board firmware would normally do */
@@ -558,12 +614,12 @@ static target_ulong pegasos2_rtas(PowerPCCPU *cpu, PegasosMachineState *pm,
     }
 }
 
-static bool pegasos2_cpu_in_nested(PowerPCCPU *cpu)
+static bool pegasos_cpu_in_nested(PowerPCCPU *cpu)
 {
     return false;
 }
 
-static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
+static void pegasos_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
 {
     PegasosMachineState *pm = PEGASOS_MACHINE(vhyp);
     CPUPPCState *env = &cpu->env;
@@ -574,7 +630,7 @@ static void pegasos2_hypercall(PPCVirtualHypervisor *vhyp, PowerPCCPU *cpu)
     if (FIELD_EX64(env->msr, MSR, PR)) {
         qemu_log_mask(LOG_GUEST_ERROR, "Hypercall made with MSR[PR]=1\n");
         env->gpr[3] = H_PRIVILEGE;
-    } else if (env->gpr[3] == KVMPPC_H_RTAS) {
+    } else if (env->gpr[3] == KVMPPC_H_RTAS && pm->type == PEGASOS2) {
         env->gpr[3] = pegasos2_rtas(cpu, pm, env->gpr[4]);
     } else if (env->gpr[3] == KVMPPC_H_VOF_CLIENT) {
         int ret = vof_client_call(MACHINE(pm), pm->vof, MACHINE(pm)->fdt,
@@ -596,56 +652,78 @@ static target_ulong vhyp_encode_hpt_for_kvm_pr(PPCVirtualHypervisor *vhyp)
     return POWERPC_CPU(current_cpu)->env.spr[SPR_SDR1];
 }
 
-static bool pegasos2_setprop(MachineState *ms, const char *path,
-                             const char *propname, void *val, int vallen)
+static bool pegasos_setprop(MachineState *ms, const char *path,
+                            const char *propname, void *val, int vallen)
 {
     return true;
 }
 
-static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
+static void pegasos_machine_init(MachineClass *mc)
 {
-    MachineClass *mc = MACHINE_CLASS(oc);
-    PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(oc);
-    VofMachineIfClass *vmc = VOF_MACHINE_CLASS(oc);
+    PPCVirtualHypervisorClass *vhc = PPC_VIRTUAL_HYPERVISOR_CLASS(mc);
+    VofMachineIfClass *vmc = VOF_MACHINE_CLASS(mc);
 
-    mc->desc = "Genesi/bPlan Pegasos II";
     mc->init = pegasos_init;
-    mc->reset = pegasos2_machine_reset;
+    mc->reset = pegasos_machine_reset;
     mc->block_default_type = IF_IDE;
     mc->default_boot_order = "cd";
     mc->default_display = "std";
-    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("7457_v1.2");
-    mc->default_ram_id = "pegasos2.ram";
+    mc->default_ram_id = "ram";
     mc->default_ram_size = 512 * MiB;
     machine_add_audiodev_property(mc);
 
-    vhc->cpu_in_nested = pegasos2_cpu_in_nested;
-    vhc->hypercall = pegasos2_hypercall;
+    vhc->cpu_in_nested = pegasos_cpu_in_nested;
+    vhc->hypercall = pegasos_hypercall;
     vhc->cpu_exec_enter = vhyp_nop;
     vhc->cpu_exec_exit = vhyp_nop;
     vhc->encode_hpt_for_kvm_pr = vhyp_encode_hpt_for_kvm_pr;
 
-    vmc->setprop = pegasos2_setprop;
+    vmc->setprop = pegasos_setprop;
+}
+
+static void pegasos1_init(Object *obj)
+{
+    PegasosMachineState *pm = PEGASOS_MACHINE(obj);
+
+    pm->type = PEGASOS1;
+    pm->bus_freq_hz = 33000000;
+}
+
+static void pegasos1_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Genesi/bPlan Pegasos I";
+    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("750cxe_v3.1b");
 }
 
 static void pegasos2_init(Object *obj)
 {
     PegasosMachineState *pm = PEGASOS_MACHINE(obj);
 
+    pm->type = PEGASOS2;
     pm->bus_freq_hz = 133333333;
 }
 
+static void pegasos2_machine_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "Genesi/bPlan Pegasos II";
+    mc->default_cpu_type = POWERPC_CPU_TYPE_NAME("7457_v1.2");
+}
+
+DEFINE_MACHINE_EXTENDED("pegasos", MACHINE, PegasosMachineState,
+                        pegasos_machine_init, true, (const InterfaceInfo[]) {
+                        { TYPE_PPC_VIRTUAL_HYPERVISOR },
+                        { TYPE_VOF_MACHINE_IF }, { } })
+
 static const TypeInfo pegasos_machine_types[] = {
     {
-        .name          = TYPE_PEGASOS_MACHINE,
-        .parent        = TYPE_MACHINE,
-        .instance_size = sizeof(PegasosMachineState),
-        .abstract      = true,
-        .interfaces = (const InterfaceInfo[]) {
-              { TYPE_PPC_VIRTUAL_HYPERVISOR },
-              { TYPE_VOF_MACHINE_IF },
-              { }
-        },
+        .name          = MACHINE_TYPE_NAME("pegasos1"),
+        .parent        = TYPE_PEGASOS_MACHINE,
+        .class_init    = pegasos1_machine_class_init,
+        .instance_init = pegasos1_init,
     },
     {
         .name          = MACHINE_TYPE_NAME("pegasos2"),

From 3c21f9dfcf8c8120e2fd5e8c5cbea61f21e7be69 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 02:06:19 +0200
Subject: [PATCH 1576/2396] hw/ppc/pegasos2: Add VOF support for pegasos1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When running without firmware ROM using Virtual Open Firmware we need
to do some hardware initialisation and provide the device tree as the
machine firmware would normally do.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/d2d7f173dbd436b47382f384d5a93eb7e713424e.1761176219.git.balaton@eik.bme.hu
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 MAINTAINERS              |   1 +
 hw/ppc/pegasos2.c        | 140 +++++++++++++++++++++++++++++++++------
 pc-bios/dtb/meson.build  |   1 +
 pc-bios/dtb/pegasos1.dtb | Bin 0 -> 857 bytes
 pc-bios/dtb/pegasos1.dts | 125 ++++++++++++++++++++++++++++++++++
 5 files changed, 246 insertions(+), 21 deletions(-)
 create mode 100644 pc-bios/dtb/pegasos1.dtb
 create mode 100644 pc-bios/dtb/pegasos1.dts

diff --git a/MAINTAINERS b/MAINTAINERS
index 36eef27b41..684d7a5b37 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1652,6 +1652,7 @@ F: hw/ppc/pegasos2.c
 F: hw/pci-host/mv64361.c
 F: hw/pci-host/mv643xx.h
 F: include/hw/pci-host/mv64361.h
+F: pc-bios/dtb/pegasos[12].dt[sb]
 
 amigaone
 M: BALATON Zoltan <balaton@eik.bme.hu>
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index a11f3c99ed..93696ed381 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -84,6 +84,7 @@ struct PegasosMachineState {
     uint64_t initrd_size;
 };
 
+static void *pegasos1_build_fdt(PegasosMachineState *pm, int *fdt_size);
 static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size);
 
 static void pegasos_cpu_reset(void *opaque)
@@ -314,6 +315,82 @@ static void pegasos_init(MachineState *machine)
     }
 }
 
+static void pegasos_superio_write(uint8_t addr, uint8_t val)
+{
+    cpu_physical_memory_write(0xfe0003f0, &addr, 1);
+    cpu_physical_memory_write(0xfe0003f1, &val, 1);
+}
+
+static void pegasos1_pci_config_write(PegasosMachineState *pm, int bus,
+                                      uint32_t addr, uint32_t len, uint32_t val)
+{
+    addr |= BIT(31);
+    cpu_physical_memory_write(0xfec00cf8, &addr, 4);
+    cpu_physical_memory_write(0xfee00cfc, &val, len);
+}
+
+static void pegasos1_chipset_reset(PegasosMachineState *pm)
+{
+    uint8_t elcr = 0x2e;
+    cpu_physical_memory_write(0xfe0004d1, &elcr, sizeof(elcr));
+
+    pegasos1_pci_config_write(pm, 0, PCI_COMMAND, 2, PCI_COMMAND_IO |
+                              PCI_COMMAND_MEMORY | PCI_COMMAND_MASTER);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x9);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              0x50, 1, 0x6);
+    pegasos_superio_write(0xf4, 0xbe);
+    pegasos_superio_write(0xf6, 0xef);
+    pegasos_superio_write(0xf7, 0xfc);
+    pegasos_superio_write(0xf2, 0x14);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              0x51, 1, 0x3d);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              0x55, 1, 0x90);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              0x56, 1, 0x99);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 0) << 8) |
+                              0x57, 1, 0x90);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 1) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x10e);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 1) << 8) |
+                              PCI_CLASS_PROG, 1, 0xf);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 1) << 8) |
+                              0x40, 1, 0xb);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 1) << 8) |
+                              0x50, 4, 0x17171717);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 1) << 8) |
+                              PCI_COMMAND, 2, 0x87);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 2) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x409);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 2) << 8) |
+                              PCI_COMMAND, 2, 0x7);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 3) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x409);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 3) << 8) |
+                              PCI_COMMAND, 2, 0x7);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 4) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x9);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 4) << 8) |
+                              0x48, 4, 0x2001);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 4) << 8) |
+                              0x41, 1, 0);
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 4) << 8) |
+                              0x90, 4, 0x1000);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 5) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x309);
+
+    pegasos1_pci_config_write(pm, 0, (PCI_DEVFN(7, 6) << 8) |
+                              PCI_INTERRUPT_LINE, 2, 0x309);
+}
+
 static uint32_t pegasos2_mv_reg_read(PegasosMachineState *pm,
                                      uint32_t addr, uint32_t len)
 {
@@ -357,12 +434,6 @@ static void pegasos2_pci_config_write(PegasosMachineState *pm, int bus,
     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
 }
 
-static void pegasos2_superio_write(uint8_t addr, uint8_t val)
-{
-    cpu_physical_memory_write(0xfe0003f0, &addr, 1);
-    cpu_physical_memory_write(0xfe0003f1, &val, 1);
-}
-
 static void pegasos2_chipset_reset(PegasosMachineState *pm)
 {
     pegasos2_mv_reg_write(pm, 0, 4, 0x28020ff);
@@ -379,10 +450,10 @@ static void pegasos2_chipset_reset(PegasosMachineState *pm)
                               PCI_INTERRUPT_LINE, 2, 0x9);
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
                               0x50, 1, 0x6);
-    pegasos2_superio_write(0xf4, 0xbe);
-    pegasos2_superio_write(0xf6, 0xef);
-    pegasos2_superio_write(0xf7, 0xfc);
-    pegasos2_superio_write(0xf2, 0x14);
+    pegasos_superio_write(0xf4, 0xbe);
+    pegasos_superio_write(0xf6, 0xef);
+    pegasos_superio_write(0xf7, 0xfc);
+    pegasos_superio_write(0xf2, 0x14);
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
                               0x50, 1, 0x2);
     pegasos2_pci_config_write(pm, 1, (PCI_DEVFN(12, 0) << 8) |
@@ -432,7 +503,7 @@ static void pegasos2_chipset_reset(PegasosMachineState *pm)
 static void pegasos_machine_reset(MachineState *machine, ResetType type)
 {
     PegasosMachineState *pm = PEGASOS_MACHINE(machine);
-    void *fdt;
+    void *fdt = NULL;
     uint32_t c[2];
     uint64_t d[2];
     int sz;
@@ -440,13 +511,22 @@ static void pegasos_machine_reset(MachineState *machine, ResetType type)
     qemu_devices_reset(type);
     if (!pm->vof) {
         return; /* Firmware should set up machine so nothing to do */
-    } else if (pm->type == PEGASOS1) {
-        error_report("VOF is not supported by this machine");
-        exit(1);
     }
 
     /* Otherwise, set up devices that board firmware would normally do */
-    pegasos2_chipset_reset(pm);
+    switch (pm->type) {
+    case PEGASOS1:
+        pegasos1_chipset_reset(pm);
+        fdt = pegasos1_build_fdt(pm, &sz);
+        break;
+    case PEGASOS2:
+        pegasos2_chipset_reset(pm);
+        fdt = pegasos2_build_fdt(pm, &sz);
+        break;
+    }
+    if (!fdt) {
+        exit(1);
+    }
 
     /* Device tree and VOF set up */
     vof_init(pm->vof, machine->ram_size, &error_fatal);
@@ -465,11 +545,6 @@ static void pegasos_machine_reset(MachineState *machine, ResetType type)
         exit(1);
     }
 
-    fdt = pegasos2_build_fdt(pm, &sz);
-    if (!fdt) {
-        exit(1);
-    }
-
     /* Set memory size */
     c[0] = 0;
     c[1] = cpu_to_be32(machine->ram_size);
@@ -761,6 +836,8 @@ static struct {
     const char *name;
     void (*dtf)(PCIBus *bus, PCIDevice *d, FDTInfo *fi);
 } device_map[] = {
+    { "pci10cc,660", "host", NULL },
+    { "pci10cc,661", "host", NULL },
     { "pci11ab,6460", "host", NULL },
     { "pci1106,571", "ide", dt_ide },
     { "pci1106,3044", "firewire", NULL },
@@ -846,7 +923,7 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
         qemu_fdt_setprop_cell(fi->fdt, node->str, "interrupts",
                               pci_get_byte(&d->config[PCI_INTERRUPT_PIN]));
     }
-    /* Pegasos2 firmware has subsystem-id amd subsystem-vendor-id swapped */
+    /* Pegasos firmware has subsystem-id and subsystem-vendor-id swapped */
     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-vendor-id",
                           pci_get_word(&d->config[PCI_SUBSYSTEM_ID]));
     qemu_fdt_setprop_cell(fi->fdt, node->str, "subsystem-id",
@@ -934,6 +1011,27 @@ static void *load_dtb(const char *filename, int *fdt_size)
     return fdt;
 }
 
+static void *pegasos1_build_fdt(PegasosMachineState *pm, int *fdt_size)
+{
+    FDTInfo fi;
+    PCIBus *pci_bus;
+    void *fdt = load_dtb("pegasos1.dtb", fdt_size);
+
+    if (!fdt) {
+        return NULL;
+    }
+    qemu_fdt_setprop_string(fdt, "/", "name", "bplan,Pegasos");
+
+    add_cpu_info(fdt, pm->cpu, pm->bus_freq_hz);
+
+    fi.fdt = fdt;
+    fi.path = "/pci@80000000";
+    pci_bus = PCI_BUS(qdev_get_child_bus(pm->nb, "pci.0"));
+    pci_for_each_device_reverse(pci_bus, 0, add_pci_device, &fi);
+
+    return fdt;
+}
+
 static void *pegasos2_build_fdt(PegasosMachineState *pm, int *fdt_size)
 {
     FDTInfo fi;
diff --git a/pc-bios/dtb/meson.build b/pc-bios/dtb/meson.build
index f14648f3a4..81bdd7580e 100644
--- a/pc-bios/dtb/meson.build
+++ b/pc-bios/dtb/meson.build
@@ -1,6 +1,7 @@
 dtbs = [
   'bamboo.dtb',
   'canyonlands.dtb',
+  'pegasos1.dtb',
   'pegasos2.dtb',
   'petalogix-ml605.dtb',
   'petalogix-s3adsp1800.dtb',
diff --git a/pc-bios/dtb/pegasos1.dtb b/pc-bios/dtb/pegasos1.dtb
new file mode 100644
index 0000000000000000000000000000000000000000..3b863b25288a59bcede9459ff42afad713dde741
GIT binary patch
literal 857
zcmcb>`|m9S19Kz;1A_$v1JfD?1_liV1_nU}1_l8J2w2O&z*GWZqL7SG9y0?20}GT5
z5(DvB85kJ&lQW76pyD7g4h9AW>44Pq#Nzy7kT6ILgcS`PL0kq9o11}wK`W^sCoxaK
zJvYe%E)LRbiKbVEfq}stDyHD<5fq>hkYAo!6yU57Tv=R_nhVm*m|u{ZS5TA><}fgT
z?Ev`;<_;YLJ;NkJBV&+SCI$uu#^j9r;?z74mjTSrP0h_Os&p^_i$L_VgZu^&2aAH-
z4RT*Jm<J)idXo!E!5)R$3ksunh&0$8AU=o-3o{Tu8{`HC28i8hiJ3XYiD{`IMNl)q
zb{D4>WhUl;MZxwIBxgEU7(f766yi>hdHe;*nIIvM8$o;+8^#B@2V@3}U&#1pK`7KN
zkov}dA3$2b?gjg?fq{Xc9xMbF1I5rBkOv?_3=IEZj0T7&KwOX>5C*Ypp`HV=|1vNz
zfG~&+H3Q@hkUfh*Vo(fn9|&_QC#Iwnr4|?KCa31)6f>lxmSrZV#+OtUq%!2@r=;dE
z6s4AB7H8(?F*y6XxVpRg>6E4BrQ{dExk>qnMJaGzN@{U(QD#92NJCL-I)id?W>qTG
zY-MoVCFkTPXX~aFr52W^<|S7$SQwdF>SpGZq!tyG7L@2FCTHj6m*=FWq^B|zCFZ54
N7BeK37VCnU3;=iUf@uH%

literal 0
HcmV?d00001

diff --git a/pc-bios/dtb/pegasos1.dts b/pc-bios/dtb/pegasos1.dts
new file mode 100644
index 0000000000..e5ef9db866
--- /dev/null
+++ b/pc-bios/dtb/pegasos1.dts
@@ -0,0 +1,125 @@
+/*
+ * QEMU Pegasos1 Device Tree Source
+ *
+ * Copyright 2025 BALATON Zoltan
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * This is partial source, more info will be filled in by board code.
+ */
+
+/dts-v1/;
+
+/ {
+	#address-cells = <1>;
+	device_type = "chrp";
+	model = "Pegasos";
+	revision = "1A";
+	CODEGEN,vendor = "bplan GmbH";
+	CODEGEN,board = "Pegasos";
+	CODEGEN,description = "Pegasos CHRP PowerPC System";
+
+	openprom {
+		model = "Pegasos,0.1b123";
+	};
+
+	chosen {
+	};
+
+	memory@0 {
+		device_type = "memory";
+		reg = <0 0>;
+	};
+
+	cpus {
+		#size-cells	= <0>;
+		#address-cells	= <1>;
+		#cpus		= <1>;
+	};
+
+	failsafe {
+		device_type = "serial";
+	};
+
+	pci@80000000 {
+		device_type = "pci";
+		#address-cells = <3>;
+		#size-cells = <2>;
+		clock-frequency = <33333333>;
+		8259-interrupt-acknowledge = <0xfef00000>;
+		reg = <0x80000000 0x7f000000>;
+		ranges = <0x01000000 0 0x00000000 0xfe000000 0 0x00800000
+			  0x02000000 0 0x80000000 0x80000000 0 0x7d000000
+			  0x02000000 0 0xfd000000 0xfd000000 0 0x01000000>;
+		bus-range = <0 0>;
+
+		isa@7 {
+			vendor-id	= <0x1106>;
+			device-id	= <0x8231>;
+			revision-id	= <0x10>;
+			class-code	= <0x60100>;
+			/* Pegasos firmware has subsystem-id and */
+			/* subsystem-vendor-id swapped */
+			subsystem-id	= <0x1af4>;
+			subsystem-vendor-id = <0x1100>;
+			reg = <0x3800 0 0 0 0>;
+			device_type	= "isa";
+			#address-cells	= <2>;
+			#size-cells	= <1>;
+			eisa-slots	= <0>;
+			clock-frequency	= <8333333>;
+			slot-names	= <0>;
+
+			serial@i2f8 {
+				device_type	= "serial";
+				reg		= <1 0x2f8 8>;
+				interrupts	= <3 0>;
+				clock-frequency	= <0>;
+			};
+
+			8042@i60 {
+				device_type	= "";
+				reg		= <1 0x60 5>;
+				clock-frequency	= <0>;
+				interrupt-controller = "";
+				#address-cells	= <1>;
+				#size-cells	= <0>;
+				#interrupt-cells = <2>;
+
+			};
+
+			keyboard@i60 {
+				device_type	= "keyboard";
+				reg		= <1 0x60 5>;
+				interrupts	= <1 0>;
+			};
+
+			rtc@i70 {
+				device_type	= "rtc";
+				reg		= <1 0x70 2>;
+				interrupts	= <8 0>;
+				clock-frequency	= <0>;
+				compatible	= "ds1385-rtc";
+			};
+
+			timer@i40 {
+				device_type	= "timer";
+				reg		= <1 0x40 8>;
+				clock-frequency	= <0>;
+			};
+
+			fdc@i3f0 {
+				device_type	= "fdc";
+				reg		= <1 0x3f0 8>;
+				interrupts	= <6 0>;
+				clock-frequency	= <0>;
+			};
+
+			lpt@i3bc {
+				device_type	= "lpt";
+				reg		= <1 0x3bc 8>;
+				interrupts	= <7 0>;
+				clock-frequency	= <0>;
+			};
+		};
+	};
+};

From a728c87e966d4d4ca1675fbe7127c813fb8f66e1 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:11 +0530
Subject: [PATCH 1577/2396] hw/ppc: Implement fadump register command
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add skeleton to handle "ibm,configure-kernel-dump" rtas call in QEMU,
including register, unregister and invalidate commands.

The register just verifies the structure of the fadump memory structure
passed by kernel, and set fadump_registered in spapr state to true.

Verify basic details mandated by the PAPR, such as number of
inputs/output, and add handling for the three fadump commands:
regiser/unregister/invalidate.

The checks are based on the table in following requirement in PAPR v2.13:
    "R1–7.3.30–1. For the Configure Platform Assisted Kernel Dump option ..."

Relevant section for the register command in PAPR is:
    Section 7.3.30: "ibm,configure-kernel-dump RTAS call" (PAPR v2.13)

Note: Any modifications made by the kernel to the fadump memory
structure after the 'ibm,configure-kernel-dump' RTAS call returns will
not be reflected in QEMU, as QEMU retains the fadump memory structure
that was provided during fadump registration.

The kernel must unregister and re-register fadump to apply any changes
to the fadump memory structure.

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-2-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/meson.build            |   1 +
 hw/ppc/spapr_fadump.c         | 123 ++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_rtas.c           |  71 ++++++++++++++++++++
 include/hw/ppc/spapr.h        |  11 ++-
 include/hw/ppc/spapr_fadump.h |  69 +++++++++++++++++++
 5 files changed, 274 insertions(+), 1 deletion(-)
 create mode 100644 hw/ppc/spapr_fadump.c
 create mode 100644 include/hw/ppc/spapr_fadump.h

diff --git a/hw/ppc/meson.build b/hw/ppc/meson.build
index 170b90ae7d..6b7c1f4f49 100644
--- a/hw/ppc/meson.build
+++ b/hw/ppc/meson.build
@@ -26,6 +26,7 @@ ppc_ss.add(when: 'CONFIG_PSERIES', if_true: files(
   'spapr_nvdimm.c',
   'spapr_rtas_ddw.c',
   'spapr_numa.c',
+  'spapr_fadump.c',
   'pef.c',
 ))
 ppc_ss.add(when: ['CONFIG_PSERIES', 'CONFIG_TCG'], if_true: files(
diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
new file mode 100644
index 0000000000..2c9f024c2d
--- /dev/null
+++ b/hw/ppc/spapr_fadump.c
@@ -0,0 +1,123 @@
+/*
+ * Firmware Assisted Dump in PSeries
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/ppc/spapr.h"
+
+/*
+ * Handle the "FADUMP_CMD_REGISTER" command in 'ibm,configure-kernel-dump'
+ *
+ * Note: Any changes made by the kernel to the fadump memory struct won't
+ * reflect in QEMU after the 'ibm,configure-kernel-dump' RTAS call has returned,
+ * as we store the passed fadump memory structure passed during fadump
+ * registration.
+ * Kernel has to invalidate & re-register fadump, if it intends to make any
+ * changes to the fadump memory structure
+ *
+ * Returns:
+ *  * RTAS_OUT_SUCCESS: On successful registration
+ *  * RTAS_OUT_PARAM_ERROR: If parameters are not correct, eg. too many
+ *                          sections, invalid memory addresses that we are
+ *                          unable to read, etc
+ *  * RTAS_OUT_DUMP_ALREADY_REGISTERED: Dump already registered
+ *  * RTAS_OUT_HW_ERROR: Misc issue such as memory access failures
+ */
+uint32_t do_fadump_register(SpaprMachineState *spapr, target_ulong args)
+{
+    FadumpSectionHeader header;
+    FadumpSection regions[FADUMP_MAX_SECTIONS] = {0};
+    target_ulong fdm_addr = rtas_ld(args, 1);
+    target_ulong fdm_size = rtas_ld(args, 2);
+    AddressSpace *default_as = &address_space_memory;
+    MemTxResult io_result;
+    MemTxAttrs attrs;
+    uint64_t next_section_addr;
+    uint16_t dump_num_sections;
+
+    /* Mark the memory transaction as privileged memory access */
+    attrs.user = 0;
+    attrs.memory = 1;
+
+    if (spapr->fadump_registered) {
+        /* FADump already registered */
+        return RTAS_OUT_DUMP_ALREADY_REGISTERED;
+    }
+
+    if (spapr->fadump_dump_active) {
+        return RTAS_OUT_DUMP_ACTIVE;
+    }
+
+    if (fdm_size < sizeof(FadumpSectionHeader)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Header size is invalid: " TARGET_FMT_lu "\n", fdm_size);
+        return RTAS_OUT_PARAM_ERROR;
+    }
+
+    /* Ensure fdm_addr points to a valid RMR-memory/RMA-memory buffer */
+    if ((fdm_addr <= 0) || ((fdm_addr + fdm_size) > spapr->rma_size)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Invalid fdm address: " TARGET_FMT_lu "\n", fdm_addr);
+        return RTAS_OUT_PARAM_ERROR;
+    }
+
+    /* Try to read the passed fadump header */
+    io_result = address_space_read(default_as, fdm_addr, attrs,
+            &header, sizeof(header));
+    if (io_result != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Unable to read fdm: " TARGET_FMT_lu "\n", fdm_addr);
+
+        return RTAS_OUT_HW_ERROR;
+    }
+
+    /* Verify that we understand the fadump header version */
+    if (header.dump_format_version != cpu_to_be32(FADUMP_VERSION)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Unknown fadump header version: 0x%x\n",
+            header.dump_format_version);
+        return RTAS_OUT_PARAM_ERROR;
+    }
+
+    /* Reset dump status flags */
+    header.dump_status_flag = 0;
+
+    dump_num_sections = be16_to_cpu(header.dump_num_sections);
+
+    if (dump_num_sections > FADUMP_MAX_SECTIONS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Too many sections: %d sections\n", dump_num_sections);
+        return RTAS_OUT_PARAM_ERROR;
+    }
+
+    next_section_addr =
+        fdm_addr +
+        be32_to_cpu(header.offset_first_dump_section);
+
+    for (int i = 0; i < dump_num_sections; ++i) {
+        /* Read the fadump section from memory */
+        io_result = address_space_read(default_as, next_section_addr, attrs,
+                &regions[i], sizeof(regions[i]));
+        if (io_result != MEMTX_OK) {
+            qemu_log_mask(LOG_UNIMP,
+                "FADump: Unable to read fadump %dth section\n", i);
+            return RTAS_OUT_PARAM_ERROR;
+        }
+
+        next_section_addr += sizeof(regions[i]);
+    }
+
+    spapr->fadump_registered = true;
+    spapr->fadump_dump_active = false;
+
+    /* Store the registered fadump memory struct */
+    spapr->registered_fdm.header = header;
+    for (int i = 0; i < dump_num_sections; ++i) {
+        spapr->registered_fdm.rgn[i] = regions[i];
+    }
+
+    return RTAS_OUT_SUCCESS;
+}
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 143bc8c379..6042fc72e5 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -344,6 +344,73 @@ static void rtas_ibm_set_system_parameter(PowerPCCPU *cpu,
     rtas_st(rets, 0, ret);
 }
 
+/* Papr Section 7.4.9 ibm,configure-kernel-dump RTAS call */
+static void rtas_configure_kernel_dump(PowerPCCPU *cpu,
+                                   SpaprMachineState *spapr,
+                                   uint32_t token, uint32_t nargs,
+                                   target_ulong args,
+                                   uint32_t nret, target_ulong rets)
+{
+    target_ulong cmd = rtas_ld(args, 0);
+    uint32_t ret_val;
+
+    /* Number of outputs has to be 1 */
+    if (nret != 1) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: ibm,configure-kernel-dump called with nret != 1.\n");
+        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+        return;
+    }
+
+    /* Number of inputs has to be 3 */
+    if (nargs != 3) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: ibm,configure-kernel-dump called with nargs != 3.\n");
+        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+        return;
+    }
+
+    switch (cmd) {
+    case FADUMP_CMD_REGISTER:
+        ret_val = do_fadump_register(spapr, args);
+        if (ret_val != RTAS_OUT_SUCCESS) {
+            rtas_st(rets, 0, ret_val);
+            return;
+        }
+        break;
+    case FADUMP_CMD_UNREGISTER:
+        if (spapr->fadump_dump_active) {
+            rtas_st(rets, 0, RTAS_OUT_DUMP_ACTIVE);
+            return;
+        }
+
+        spapr->fadump_registered = false;
+        spapr->fadump_dump_active = false;
+        memset(&spapr->registered_fdm, 0, sizeof(spapr->registered_fdm));
+        break;
+    case FADUMP_CMD_INVALIDATE:
+        if (!spapr->fadump_dump_active) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Nothing to invalidate, no dump active\n");
+
+            rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+        }
+
+        spapr->fadump_registered = false;
+        spapr->fadump_dump_active = false;
+        memset(&spapr->registered_fdm, 0, sizeof(spapr->registered_fdm));
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Unknown command: " TARGET_FMT_lu "\n", cmd);
+
+        rtas_st(rets, 0, RTAS_OUT_PARAM_ERROR);
+        return;
+    }
+
+    rtas_st(rets, 0, RTAS_OUT_SUCCESS);
+}
+
 static void rtas_ibm_os_term(PowerPCCPU *cpu,
                             SpaprMachineState *spapr,
                             uint32_t token, uint32_t nargs,
@@ -659,6 +726,10 @@ static void core_rtas_register_types(void)
     spapr_rtas_register(RTAS_IBM_NMI_INTERLOCK, "ibm,nmi-interlock",
                         rtas_ibm_nmi_interlock);
 
+    /* Register fadump rtas call */
+    spapr_rtas_register(RTAS_CONFIGURE_KERNEL_DUMP, "ibm,configure-kernel-dump",
+                        rtas_configure_kernel_dump);
+
     qtest_set_command_cb(spapr_qtest_callback);
 }
 
diff --git a/include/hw/ppc/spapr.h b/include/hw/ppc/spapr.h
index b9d884745f..28cf2723d8 100644
--- a/include/hw/ppc/spapr.h
+++ b/include/hw/ppc/spapr.h
@@ -13,6 +13,7 @@
 #include "hw/ppc/xics.h"        /* For ICSState */
 #include "hw/ppc/spapr_tpm_proxy.h"
 #include "hw/ppc/spapr_nested.h" /* For SpaprMachineStateNested */
+#include "hw/ppc/spapr_fadump.h" /* For FadumpMemStruct */
 
 struct SpaprVioBus;
 struct SpaprPhbState;
@@ -267,6 +268,11 @@ struct SpaprMachineState {
     Error *fwnmi_migration_blocker;
 
     SpaprWatchdog wds[WDT_MAX_WATCHDOGS];
+
+    /* Fadump State */
+    bool fadump_registered;
+    bool fadump_dump_active;
+    FadumpMemStruct registered_fdm;
 };
 
 #define H_SUCCESS         0
@@ -692,6 +698,8 @@ void push_sregs_to_kvm_pr(SpaprMachineState *spapr);
 #define RTAS_OUT_PARAM_ERROR                    -3
 #define RTAS_OUT_NOT_SUPPORTED                  -3
 #define RTAS_OUT_NO_SUCH_INDICATOR              -3
+#define RTAS_OUT_DUMP_ALREADY_REGISTERED        -9
+#define RTAS_OUT_DUMP_ACTIVE                    -10
 #define RTAS_OUT_NOT_AUTHORIZED                 -9002
 #define RTAS_OUT_SYSPARM_PARAM_ERROR            -9999
 
@@ -754,8 +762,9 @@ void push_sregs_to_kvm_pr(SpaprMachineState *spapr);
 #define RTAS_IBM_SUSPEND_ME                     (RTAS_TOKEN_BASE + 0x2A)
 #define RTAS_IBM_NMI_REGISTER                   (RTAS_TOKEN_BASE + 0x2B)
 #define RTAS_IBM_NMI_INTERLOCK                  (RTAS_TOKEN_BASE + 0x2C)
+#define RTAS_CONFIGURE_KERNEL_DUMP              (RTAS_TOKEN_BASE + 0x2D)
 
-#define RTAS_TOKEN_MAX                          (RTAS_TOKEN_BASE + 0x2D)
+#define RTAS_TOKEN_MAX                          (RTAS_TOKEN_BASE + 0x2E)
 
 /* RTAS ibm,get-system-parameter token values */
 #define RTAS_SYSPARM_SPLPAR_CHARACTERISTICS      20
diff --git a/include/hw/ppc/spapr_fadump.h b/include/hw/ppc/spapr_fadump.h
new file mode 100644
index 0000000000..f64f339204
--- /dev/null
+++ b/include/hw/ppc/spapr_fadump.h
@@ -0,0 +1,69 @@
+/*
+ * Firmware Assisted Dump in PSeries
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+#ifndef PPC_SPAPR_FADUMP_H
+#define PPC_SPAPR_FADUMP_H
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+
+/* Fadump commands */
+#define FADUMP_CMD_REGISTER            1
+#define FADUMP_CMD_UNREGISTER          2
+#define FADUMP_CMD_INVALIDATE          3
+
+#define FADUMP_VERSION                 1
+
+/*
+ * The Firmware Assisted Dump Memory structure supports a maximum of 10 sections
+ * in the dump memory structure. Presently, three sections are used for
+ * CPU state data, HPTE & Parameters area, while the remaining seven sections
+ * can be used for boot memory regions.
+ */
+#define FADUMP_MAX_SECTIONS            10
+
+typedef struct FadumpSection FadumpSection;
+typedef struct FadumpSectionHeader FadumpSectionHeader;
+typedef struct FadumpMemStruct FadumpMemStruct;
+
+struct SpaprMachineState;
+
+/* Kernel Dump section info */
+/* All fields are in big-endian */
+struct FadumpSection {
+    uint32_t    request_flag;
+    uint16_t    source_data_type;
+    uint16_t    error_flags;
+    uint64_t    source_address;
+    uint64_t    source_len;
+    uint64_t    bytes_dumped;
+    uint64_t    destination_address;
+};
+
+/* ibm,configure-kernel-dump header. */
+struct FadumpSectionHeader {
+    uint32_t    dump_format_version;
+    uint16_t    dump_num_sections;
+    uint16_t    dump_status_flag;
+    uint32_t    offset_first_dump_section;
+
+    /* Fields for disk dump option. */
+    uint32_t    dd_block_size;
+    uint64_t    dd_block_offset;
+    uint64_t    dd_num_blocks;
+    uint32_t    dd_offset_disk_path;
+
+    /* Maximum time allowed to prevent an automatic dump-reboot. */
+    uint32_t    max_time_auto;
+};
+
+/* Note: All the data in these structures is in big-endian */
+struct FadumpMemStruct {
+    FadumpSectionHeader header;
+    FadumpSection       rgn[FADUMP_MAX_SECTIONS];
+};
+
+uint32_t do_fadump_register(struct SpaprMachineState *, target_ulong);
+#endif /* PPC_SPAPR_FADUMP_H */

From 03cb7661d2503780532fddc51f02c777774a3e4e Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:12 +0530
Subject: [PATCH 1578/2396] hw/ppc: Trigger Fadump boot if fadump is registered
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

According to PAPR:

    R1–7.3.30–3. When the platform receives an ibm,os-term RTAS call, or
    on a system reset without an ibm,nmi-interlock RTAS call, if the
    platform has a dump structure registered through the
    ibm,configure-kernel-dump call, the platform must process each
    registered kernel dump section as required and, when available,
    present the dump structure information to the operating system
    through the “ibm,kernel-dump” property, updated with status for each
    dump section, until the dump has been invalidated through the
    ibm,configure-kernel-dump RTAS call.

If Fadump has been registered, trigger an Fadump boot (memory preserving
boot), if QEMU recieves a 'ibm,os-term' rtas call.

Implementing the fadump boot as:
    * pause all vcpus (will need to save registers later)
    * preserve memory regions specified by fadump (will be implemented
      in future)
    * do a memory preserving reboot (GUEST_RESET in QEMU doesn't clear
      the memory)

Memory regions registered by fadump will be handled in a later patch.

Note: Preserving memory regions is not implemented yet so on an
"ibm,os-term" call will just trigger a reboot in QEMU if fadump is
registered, and the second kernel will boot as a normal boot (not
fadump boot)

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-3-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr_fadump.c         | 77 +++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_rtas.c           |  5 +++
 include/hw/ppc/spapr_fadump.h |  6 +++
 3 files changed, 88 insertions(+)

diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index 2c9f024c2d..53e5c12c76 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -7,6 +7,7 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "hw/ppc/spapr.h"
+#include "system/cpus.h"
 
 /*
  * Handle the "FADUMP_CMD_REGISTER" command in 'ibm,configure-kernel-dump'
@@ -121,3 +122,79 @@ uint32_t do_fadump_register(SpaprMachineState *spapr, target_ulong args)
 
     return RTAS_OUT_SUCCESS;
 }
+
+/* Preserve the memory locations registered for fadump */
+static bool fadump_preserve_mem(void)
+{
+    /*
+     * TODO: Implement preserving memory regions requested during fadump
+     * registration
+     */
+    return false;
+}
+
+/*
+ * Trigger a fadump boot, ie. next boot will be a crashkernel/fadump boot
+ * with fadump dump active.
+ *
+ * This is triggered by ibm,os-term RTAS call, if fadump was registered.
+ *
+ * It preserves the memory and sets 'FADUMP_STATUS_DUMP_TRIGGERED' as
+ * fadump status, which can be used later to add the "ibm,kernel-dump"
+ * device tree node as presence of 'FADUMP_STATUS_DUMP_TRIGGERED' signifies
+ * next boot as fadump boot in our case
+ */
+void trigger_fadump_boot(SpaprMachineState *spapr, target_ulong spapr_retcode)
+{
+    FadumpSectionHeader *header = &spapr->registered_fdm.header;
+
+    pause_all_vcpus();
+
+    /* Preserve the memory locations registered for fadump */
+    if (!fadump_preserve_mem()) {
+        /* Failed to preserve the registered memory regions */
+        rtas_st(spapr_retcode, 0, RTAS_OUT_HW_ERROR);
+
+        /* Cause a reboot */
+        qemu_system_guest_panicked(NULL);
+        return;
+    }
+
+    /*
+     * Mark next boot as fadump boot
+     *
+     * Note: These is some bit of assumption involved here, as PAPR doesn't
+     * specify any use of the dump status flags, nor does the kernel use it
+     *
+     * But from description in Table 136 in PAPR v2.13, it looks like:
+     *   FADUMP_STATUS_DUMP_TRIGGERED
+     *      = Dump was triggered by the previous system boot (PAPR says)
+     *      = Next boot will be a fadump boot (Assumed)
+     *
+     *   FADUMP_STATUS_DUMP_PERFORMED
+     *      = Dump performed (Set to 0 by caller of the
+     *        ibm,configure-kernel-dump call) (PAPR says)
+     *      = Firmware has performed the copying/dump of requested regions
+     *        (Assumed)
+     *      = Dump is active for the next boot (Assumed)
+     */
+    header->dump_status_flag = cpu_to_be16(
+            FADUMP_STATUS_DUMP_TRIGGERED |  /* Next boot will be fadump boot */
+            FADUMP_STATUS_DUMP_PERFORMED    /* Dump is active */
+    );
+
+    /* Reset fadump_registered for next boot */
+    spapr->fadump_registered = false;
+    spapr->fadump_dump_active = true;
+
+    /*
+     * Then do a guest reset
+     *
+     * Requirement:
+     * GUEST_RESET is expected to NOT clear the memory, as is the case when
+     * this is merged
+     */
+    qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+
+    rtas_st(spapr_retcode, 0, RTAS_OUT_SUCCESS);
+}
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 6042fc72e5..1f78fe406e 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -420,6 +420,11 @@ static void rtas_ibm_os_term(PowerPCCPU *cpu,
     target_ulong msgaddr = rtas_ld(args, 0);
     char msg[512];
 
+    if (spapr->fadump_registered) {
+        /* If fadump boot works, control won't come back here */
+        return trigger_fadump_boot(spapr, rets);
+    }
+
     cpu_physical_memory_read(msgaddr, msg, sizeof(msg) - 1);
     msg[sizeof(msg) - 1] = 0;
 
diff --git a/include/hw/ppc/spapr_fadump.h b/include/hw/ppc/spapr_fadump.h
index f64f339204..1cb90c9d63 100644
--- a/include/hw/ppc/spapr_fadump.h
+++ b/include/hw/ppc/spapr_fadump.h
@@ -16,6 +16,11 @@
 
 #define FADUMP_VERSION                 1
 
+/* Dump status flags */
+#define FADUMP_STATUS_DUMP_PERFORMED            0x8000
+#define FADUMP_STATUS_DUMP_TRIGGERED            0x4000
+#define FADUMP_STATUS_DUMP_ERROR                0x2000
+
 /*
  * The Firmware Assisted Dump Memory structure supports a maximum of 10 sections
  * in the dump memory structure. Presently, three sections are used for
@@ -66,4 +71,5 @@ struct FadumpMemStruct {
 };
 
 uint32_t do_fadump_register(struct SpaprMachineState *, target_ulong);
+void     trigger_fadump_boot(struct SpaprMachineState *, target_ulong);
 #endif /* PPC_SPAPR_FADUMP_H */

From 6460c471768629adc4a915a998cafcfa30d6461a Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:13 +0530
Subject: [PATCH 1579/2396] hw/ppc: Preserve memory regions registered for
 fadump

While the first kernel boots, it registers memory regions for fadump
such as:
    * CPU state data  (has to be populated by the platform)
    * HPTE state data (has to be populated by the platform)
    * Real Mode Regions (platform should copy it to requested
      destination addresses)
    * OS defined regions (such as parameter save area)

Platform is also expected to modify the 'bytes_dumped' to the length of
data preserved/copied by platform (ideally same as the source length
passed by kernel).

The kernel passes source address and length for the memory regions, and
a destination address to where the memory is to be copied.

Implement the preserving/copying of the Real Mode Regions and the
Parameter Save Area in QEMU Pseries

The regions are copied in chunks instead of copying all at once.

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-4-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr_fadump.c         | 185 ++++++++++++++++++++++++++++++++--
 include/hw/ppc/spapr_fadump.h |  18 ++++
 2 files changed, 197 insertions(+), 6 deletions(-)

diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index 53e5c12c76..5068a9d83d 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -7,7 +7,9 @@
 #include "qemu/osdep.h"
 #include "qemu/log.h"
 #include "hw/ppc/spapr.h"
+#include "qemu/units.h"
 #include "system/cpus.h"
+#include <math.h>
 
 /*
  * Handle the "FADUMP_CMD_REGISTER" command in 'ibm,configure-kernel-dump'
@@ -123,14 +125,185 @@ uint32_t do_fadump_register(SpaprMachineState *spapr, target_ulong args)
     return RTAS_OUT_SUCCESS;
 }
 
-/* Preserve the memory locations registered for fadump */
-static bool fadump_preserve_mem(void)
+/*
+ * Copy the source region of given fadump section, to the destination
+ * address mentioned in the region
+ *
+ * Also set the region's error flag, if the copy fails due to non-existent
+ * address (MEMTX_DECODE_ERROR) or permission issues (MEMTX_ACCESS_ERROR)
+ *
+ * Returns true if successful copy
+ *
+ * Returns false in case of any other error, being treated as hardware
+ * error for fadump purposes
+ */
+static bool do_preserve_region(FadumpSection *region)
 {
+    AddressSpace *default_as = &address_space_memory;
+    MemTxResult io_result;
+    MemTxAttrs attrs;
+    uint64_t src_addr, src_len, dest_addr;
+    uint64_t num_chunks;
+    g_autofree void *copy_buffer = NULL;
+
+    src_addr  = be64_to_cpu(region->source_address);
+    src_len   = be64_to_cpu(region->source_len);
+    dest_addr = be64_to_cpu(region->destination_address);
+
+    /* Mark the memory transaction as privileged memory access */
+    attrs.user = 0;
+    attrs.memory = 1;
+
     /*
-     * TODO: Implement preserving memory regions requested during fadump
-     * registration
+     * Optimisation: Skip copy if source and destination are same
+     * (eg. param area)
      */
-    return false;
+    if (src_addr == dest_addr) {
+        region->bytes_dumped = cpu_to_be64(src_len);
+        return true;
+    }
+
+#define FADUMP_CHUNK_SIZE  ((size_t)(32 * MiB))
+    copy_buffer = g_try_malloc(FADUMP_CHUNK_SIZE);
+    if (copy_buffer == NULL) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Failed allocating memory (size: %zu) for copying"
+            " reserved memory regions\n", FADUMP_CHUNK_SIZE);
+    }
+
+    num_chunks = ceil((src_len * 1.0f) / FADUMP_CHUNK_SIZE);
+    for (uint64_t chunk_id = 0; chunk_id < num_chunks; ++chunk_id) {
+        /* Take minimum of bytes left to copy, and chunk size */
+        uint64_t copy_len = MIN(
+                        src_len - (chunk_id * FADUMP_CHUNK_SIZE),
+                        FADUMP_CHUNK_SIZE
+                    );
+
+        /* Copy the source region to destination */
+        io_result = address_space_read(default_as, src_addr, attrs,
+                copy_buffer, copy_len);
+        if ((io_result & MEMTX_DECODE_ERROR) ||
+            (io_result & MEMTX_ACCESS_ERROR)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Failed to decode/access address in section: %d\n",
+                region->source_data_type);
+
+            /*
+             * Invalid source address is not an hardware error, instead
+             * wrong parameter from the kernel.
+             * Return true to let caller know to continue reading other
+             * sections
+             */
+            region->error_flags = FADUMP_ERROR_INVALID_SOURCE_ADDR;
+            region->bytes_dumped = 0;
+            return true;
+        } else if (io_result != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Failed to read source region in section: %d\n",
+                region->source_data_type);
+
+            return false;
+        }
+
+        io_result = address_space_write(default_as, dest_addr, attrs,
+                copy_buffer, copy_len);
+        if ((io_result & MEMTX_DECODE_ERROR) ||
+            (io_result & MEMTX_ACCESS_ERROR)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Failed to decode/access address in section: %d\n",
+                region->source_data_type);
+
+            /*
+             * Invalid destination address is not an hardware error,
+             * instead wrong parameter from the kernel.
+             * Return true to let caller know to continue reading other
+             * sections
+             */
+            region->error_flags = FADUMP_ERROR_INVALID_DEST_ADDR;
+            region->bytes_dumped = 0;
+            return true;
+        } else if (io_result != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Failed to write destination in section: %d\n",
+                region->source_data_type);
+
+            return false;
+        }
+
+        src_addr += FADUMP_CHUNK_SIZE;
+        dest_addr += FADUMP_CHUNK_SIZE;
+    }
+#undef FADUMP_CHUNK_SIZE
+
+    /*
+     * Considering address_space_write would have copied the
+     * complete region
+     */
+    region->bytes_dumped = cpu_to_be64(src_len);
+    return true;
+}
+
+/* Preserve the memory locations registered for fadump */
+static bool fadump_preserve_mem(SpaprMachineState *spapr)
+{
+    FadumpMemStruct *fdm = &spapr->registered_fdm;
+    uint16_t dump_num_sections, data_type;
+
+    assert(spapr->fadump_registered);
+
+    /*
+     * Handle all sections
+     *
+     * CPU State Data and HPTE regions are handled in their own cases
+     *
+     * RMR regions and any custom OS reserved regions such as parameter
+     * save area, are handled by simply copying the source region to
+     * destination address
+     */
+    dump_num_sections = be16_to_cpu(fdm->header.dump_num_sections);
+    for (int i = 0; i < dump_num_sections; ++i) {
+        data_type = be16_to_cpu(fdm->rgn[i].source_data_type);
+
+        /* Reset error_flags & bytes_dumped for now */
+        fdm->rgn[i].error_flags = 0;
+        fdm->rgn[i].bytes_dumped = 0;
+
+        /* If kernel did not request for the memory region, then skip it */
+        if (be32_to_cpu(fdm->rgn[i].request_flag) != FADUMP_REQUEST_FLAG) {
+            qemu_log_mask(LOG_UNIMP,
+                "FADump: Skipping copying region as not requested\n");
+            continue;
+        }
+
+        switch (data_type) {
+        case FADUMP_CPU_STATE_DATA:
+            /* TODO: Add CPU state data */
+            break;
+        case FADUMP_HPTE_REGION:
+            /* TODO: Add hpte state data */
+            break;
+        case FADUMP_REAL_MODE_REGION:
+        case FADUMP_PARAM_AREA:
+            /* Copy the memory region from region's source to its destination */
+            if (!do_preserve_region(&fdm->rgn[i])) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                    "FADump: Failed to preserve dump section: %d\n",
+                    be16_to_cpu(fdm->rgn[i].source_data_type));
+                fdm->header.dump_status_flag |=
+                    cpu_to_be16(FADUMP_STATUS_DUMP_ERROR);
+            }
+
+            break;
+        default:
+            qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Skipping unknown source data type: %d\n", data_type);
+
+            fdm->rgn[i].error_flags =
+                cpu_to_be16(FADUMP_ERROR_INVALID_DATA_TYPE);
+        }
+    }
+
+    return true;
 }
 
 /*
@@ -151,7 +324,7 @@ void trigger_fadump_boot(SpaprMachineState *spapr, target_ulong spapr_retcode)
     pause_all_vcpus();
 
     /* Preserve the memory locations registered for fadump */
-    if (!fadump_preserve_mem()) {
+    if (!fadump_preserve_mem(spapr)) {
         /* Failed to preserve the registered memory regions */
         rtas_st(spapr_retcode, 0, RTAS_OUT_HW_ERROR);
 
diff --git a/include/hw/ppc/spapr_fadump.h b/include/hw/ppc/spapr_fadump.h
index 1cb90c9d63..71be2ad92c 100644
--- a/include/hw/ppc/spapr_fadump.h
+++ b/include/hw/ppc/spapr_fadump.h
@@ -16,11 +16,29 @@
 
 #define FADUMP_VERSION                 1
 
+/* Firmware provided dump sections */
+#define FADUMP_CPU_STATE_DATA   0x0001
+#define FADUMP_HPTE_REGION      0x0002
+#define FADUMP_REAL_MODE_REGION 0x0011
+
+/* OS defined sections */
+#define FADUMP_PARAM_AREA       0x0100
+
+/* Dump request flag */
+#define FADUMP_REQUEST_FLAG     0x00000001
+
 /* Dump status flags */
 #define FADUMP_STATUS_DUMP_PERFORMED            0x8000
 #define FADUMP_STATUS_DUMP_TRIGGERED            0x4000
 #define FADUMP_STATUS_DUMP_ERROR                0x2000
 
+/* Region dump error flags */
+#define FADUMP_ERROR_INVALID_DATA_TYPE          0x8000
+#define FADUMP_ERROR_INVALID_SOURCE_ADDR        0x4000
+#define FADUMP_ERROR_LENGTH_EXCEEDS_SOURCE      0x2000
+#define FADUMP_ERROR_INVALID_DEST_ADDR          0x1000
+#define FAUDMP_ERROR_DEST_TOO_SMALL             0x0800
+
 /*
  * The Firmware Assisted Dump Memory structure supports a maximum of 10 sections
  * in the dump memory structure. Presently, three sections are used for

From 7e69675d7fba1f00e8997fcd329445f60df51774 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:14 +0530
Subject: [PATCH 1580/2396] hw/ppc: Implement saving CPU state in Fadump

Kernel expects CPU states/register states in the format mentioned in
"Register Save Area" in PAPR.

The platform (in our case, QEMU) saves each CPU register in the form of
an array of "register entries", the start and end of this array is
signified by "CPUSTRT" and "CPUEND" register entries respectively.

The CPUSTRT and CPUEND register entry also has 4-byte logical CPU ID,
thus storing the CPU ID corresponding to the array of register entries.

Each register, and CPUSTRT, CPUEND has a predefined identifier.
Implement calculating identifier for a given register in
'fadump_str_to_u64', which has been taken from the linux kernel

Similarly GPRs also have predefined identifiers, and a corresponding
64-bit resiter value (split into two 32-bit cells). Implement
calculation of GPR identifiers with 'fadump_gpr_id_to_u64'

PAPR has restrictions on particular order of few registers, and is
free to be in any order for other registers.
Some registers mentioned in PAPR have not been exported as they are not
implemented in QEMU / don't make sense in QEMU.

Implement saving of CPU state according to the PAPR document

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-5-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr_fadump.c         | 361 +++++++++++++++++++++++++++++++++-
 include/hw/ppc/spapr_fadump.h |  31 +++
 2 files changed, 390 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index 5068a9d83d..fdd4929148 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -9,8 +9,73 @@
 #include "hw/ppc/spapr.h"
 #include "qemu/units.h"
 #include "system/cpus.h"
+#include "system/hw_accel.h"
 #include <math.h>
 
+/*
+ * Copy the ascii values for first 8 characters from a string into u64
+ * variable at their respective indexes.
+ * e.g.
+ *  The string "FADMPINF" will be converted into 0x4641444d50494e46
+ */
+static uint64_t fadump_str_to_u64(const char *str)
+{
+    uint64_t val = 0;
+    int i;
+
+    for (i = 0; i < sizeof(val); i++) {
+        val = (*str) ? (val << 8) | *str++ : val << 8;
+    }
+    return val;
+}
+
+/**
+ * Get the identifier id for register entries of GPRs
+ *
+ * It gives the same id as 'fadump_str_to_u64' when the complete string id
+ * of the GPR is given, ie.
+ *
+ *   fadump_str_to_u64("GPR05") == fadump_gpr_id_to_u64(5);
+ *   fadump_str_to_u64("GPR12") == fadump_gpr_id_to_u64(12);
+ *
+ * And so on. Hence this can be implemented by creating a dynamic
+ * string for each GPR, such as "GPR00", "GPR01", ... "GPR31"
+ * Instead of allocating a string, an observation from the math of
+ * 'fadump_str_to_u64' or from PAPR tells us that there's a pattern
+ * in the identifier IDs, such that the first 4 bytes are affected only by
+ * whether it is GPR0*, GPR1*, GPR2*, GPR3*.
+ * Upper half of 5th byte is always 0x3. Lower half (nibble) of 5th byte
+ * is the tens digit of the GPR id, ie. GPR ID / 10.
+ * Upper half of 6th byte is always 0x3. Lower half (nibble) of 5th byte
+ * is the ones digit of the GPR id, ie. GPR ID % 10
+ *
+ * For example, for GPR 29, the 5th and 6th byte will be 0x32 and 0x39
+ */
+static uint64_t fadump_gpr_id_to_u64(uint32_t gpr_id)
+{
+    uint64_t val = 0;
+
+    /* Valid range of GPR id is only GPR0 to GPR31 */
+    assert(gpr_id < 32);
+
+    /* Below calculations set the 0th to 5th byte */
+    if (gpr_id <= 9) {
+        val = fadump_str_to_u64("GPR0");
+    } else if (gpr_id <= 19) {
+        val = fadump_str_to_u64("GPR1");
+    } else if (gpr_id <= 29) {
+        val = fadump_str_to_u64("GPR2");
+    } else {
+        val = fadump_str_to_u64("GPR3");
+    }
+
+    /* Set the 6th byte */
+    val |= 0x30000000;
+    val |= ((gpr_id % 10) << 24);
+
+    return val;
+}
+
 /*
  * Handle the "FADUMP_CMD_REGISTER" command in 'ibm,configure-kernel-dump'
  *
@@ -243,7 +308,291 @@ static bool do_preserve_region(FadumpSection *region)
     return true;
 }
 
-/* Preserve the memory locations registered for fadump */
+/*
+ * Populate the passed CPUs register entries, in the buffer starting at
+ * the argument 'curr_reg_entry'
+ *
+ * The register entries is an array of pair of register id and register
+ * value, as described in Table 591/592 in section "H.1 Register Save Area"
+ * in PAPR v2.13
+ *
+ * Returns pointer just past this CPU's register entries, which can be used
+ * as the start address for next CPU's register entries
+ */
+static FadumpRegEntry *populate_cpu_reg_entries(CPUState *cpu,
+        FadumpRegEntry *curr_reg_entry)
+{
+    CPUPPCState *env;
+    PowerPCCPU *ppc_cpu;
+    uint32_t num_regs_per_cpu = 0;
+
+    ppc_cpu = POWERPC_CPU(cpu);
+    env = cpu_env(cpu);
+    num_regs_per_cpu = 0;
+
+    /*
+     * CPUSTRT and CPUEND register entries follow this format:
+     *
+     * 8 Bytes Reg ID (BE) | 4 Bytes (0x0) | 4 Bytes Logical CPU ID (BE)
+     */
+    curr_reg_entry->reg_id =
+        cpu_to_be64(fadump_str_to_u64("CPUSTRT"));
+    curr_reg_entry->reg_value = cpu_to_be64(
+            ppc_cpu->vcpu_id & FADUMP_CPU_ID_MASK);
+    ++curr_reg_entry;
+
+#define REG_ENTRY(id, val)                             \
+    do {                                               \
+        curr_reg_entry->reg_id =                       \
+            cpu_to_be64(fadump_str_to_u64(#id));       \
+        curr_reg_entry->reg_value = cpu_to_be64(val);  \
+        ++curr_reg_entry;                              \
+        ++num_regs_per_cpu;                            \
+    } while (0)
+
+    REG_ENTRY(ACOP, env->spr[SPR_ACOP]);
+    REG_ENTRY(AMR, env->spr[SPR_AMR]);
+    REG_ENTRY(BESCR, env->spr[SPR_BESCR]);
+    REG_ENTRY(CFAR, env->spr[SPR_CFAR]);
+    REG_ENTRY(CIABR, env->spr[SPR_CIABR]);
+
+    /* Save the condition register */
+    REG_ENTRY(CR, ppc_get_cr(env));
+
+    REG_ENTRY(CTR, env->spr[SPR_CTR]);
+    REG_ENTRY(CTRL, env->spr[SPR_CTRL]);
+    REG_ENTRY(DABR, env->spr[SPR_DABR]);
+    REG_ENTRY(DABRX, env->spr[SPR_DABRX]);
+    REG_ENTRY(DAR, env->spr[SPR_DAR]);
+    REG_ENTRY(DAWR0, env->spr[SPR_DAWR0]);
+    REG_ENTRY(DAWR1, env->spr[SPR_DAWR1]);
+    REG_ENTRY(DAWRX0, env->spr[SPR_DAWRX0]);
+    REG_ENTRY(DAWRX1, env->spr[SPR_DAWRX1]);
+    REG_ENTRY(DPDES, env->spr[SPR_DPDES]);
+    REG_ENTRY(DSCR, env->spr[SPR_DSCR]);
+    REG_ENTRY(DSISR, env->spr[SPR_DSISR]);
+    REG_ENTRY(EBBHR, env->spr[SPR_EBBHR]);
+    REG_ENTRY(EBBRR, env->spr[SPR_EBBRR]);
+
+    REG_ENTRY(FPSCR, env->fpscr);
+    REG_ENTRY(FSCR, env->spr[SPR_FSCR]);
+
+    /* Save the GPRs */
+    for (int gpr_id = 0; gpr_id < 32; ++gpr_id) {
+        curr_reg_entry->reg_id =
+            cpu_to_be64(fadump_gpr_id_to_u64(gpr_id));
+        curr_reg_entry->reg_value =
+            cpu_to_be64(env->gpr[gpr_id]);
+        ++curr_reg_entry;
+        ++num_regs_per_cpu;
+    }
+
+    REG_ENTRY(IAMR, env->spr[SPR_IAMR]);
+    REG_ENTRY(IC, env->spr[SPR_IC]);
+    REG_ENTRY(LR, env->spr[SPR_LR]);
+
+    REG_ENTRY(MSR, env->msr);
+    REG_ENTRY(NIA, env->nip);   /* NIA */
+    REG_ENTRY(PIR, env->spr[SPR_PIR]);
+    REG_ENTRY(PSPB, env->spr[SPR_PSPB]);
+    REG_ENTRY(PVR, env->spr[SPR_PVR]);
+    REG_ENTRY(RPR, env->spr[SPR_RPR]);
+    REG_ENTRY(SPURR, env->spr[SPR_SPURR]);
+    REG_ENTRY(SRR0, env->spr[SPR_SRR0]);
+    REG_ENTRY(SRR1, env->spr[SPR_SRR1]);
+    REG_ENTRY(TAR, env->spr[SPR_TAR]);
+    REG_ENTRY(TEXASR, env->spr[SPR_TEXASR]);
+    REG_ENTRY(TFHAR, env->spr[SPR_TFHAR]);
+    REG_ENTRY(TFIAR, env->spr[SPR_TFIAR]);
+    REG_ENTRY(TIR, env->spr[SPR_TIR]);
+    REG_ENTRY(UAMOR, env->spr[SPR_UAMOR]);
+    REG_ENTRY(VRSAVE, env->spr[SPR_VRSAVE]);
+    REG_ENTRY(VSCR, env->vscr);
+    REG_ENTRY(VTB, env->spr[SPR_VTB]);
+    REG_ENTRY(WORT, env->spr[SPR_WORT]);
+    REG_ENTRY(XER, env->spr[SPR_XER]);
+
+    /*
+     * Ignoring transaction checkpoint and few other registers
+     * mentioned in PAPR as not supported in QEMU
+     */
+#undef REG_ENTRY
+
+    /* End the registers for this CPU with "CPUEND" reg entry */
+    curr_reg_entry->reg_id =
+        cpu_to_be64(fadump_str_to_u64("CPUEND"));
+    curr_reg_entry->reg_value = cpu_to_be64(
+            ppc_cpu->vcpu_id & FADUMP_CPU_ID_MASK);
+
+    /*
+     * Ensure number of register entries saved matches the expected
+     * 'FADUMP_PER_CPU_REG_ENTRIES' count
+     *
+     * This will help catch an error if in future a new register entry
+     * is added/removed while not modifying FADUMP_PER_CPU_REG_ENTRIES
+     */
+    assert(FADUMP_PER_CPU_REG_ENTRIES == num_regs_per_cpu + 2 /*CPUSTRT+CPUEND*/);
+
+    ++curr_reg_entry;
+
+    return curr_reg_entry;
+}
+
+/*
+ * Populate the "Register Save Area"/CPU State as mentioned in section "H.1
+ * Register Save Area" in PAPR v2.13
+ *
+ * It allocates the buffer for this region, then populates the register
+ * entries
+ *
+ * Returns the pointer to the buffer (which should be deallocated by the
+ * callers), and sets the size of this buffer in the argument
+ * 'cpu_state_len'
+ */
+static void *get_cpu_state_data(uint64_t *cpu_state_len)
+{
+    FadumpRegSaveAreaHeader reg_save_hdr;
+    FadumpRegEntry *reg_entries;
+    FadumpRegEntry *curr_reg_entry;
+    CPUState *cpu;
+
+    uint32_t num_reg_entries;
+    uint32_t reg_entries_size;
+    uint32_t num_cpus = 0;
+
+    void *cpu_state_buffer = NULL;
+    uint64_t offset = 0;
+
+    CPU_FOREACH(cpu) {
+        ++num_cpus;
+    }
+
+    reg_save_hdr.version = cpu_to_be32(0);
+    reg_save_hdr.magic_number =
+        cpu_to_be64(fadump_str_to_u64("REGSAVE"));
+
+    /* Reg save area header is immediately followed by num cpus */
+    reg_save_hdr.num_cpu_offset =
+        cpu_to_be32(sizeof(FadumpRegSaveAreaHeader));
+
+    num_reg_entries = num_cpus * FADUMP_PER_CPU_REG_ENTRIES;
+    reg_entries_size = num_reg_entries * sizeof(FadumpRegEntry);
+
+    reg_entries = g_new(FadumpRegEntry, num_reg_entries);
+
+    /* Pointer to current CPU's registers */
+    curr_reg_entry = reg_entries;
+
+    /* Populate register entries for all CPUs */
+    CPU_FOREACH(cpu) {
+        cpu_synchronize_state(cpu);
+        curr_reg_entry = populate_cpu_reg_entries(cpu, curr_reg_entry);
+    }
+
+    *cpu_state_len = 0;
+    *cpu_state_len += sizeof(reg_save_hdr);     /* reg save header */
+    *cpu_state_len += 0xc;                      /* padding as in PAPR */
+    *cpu_state_len += sizeof(__be32);           /* num_cpus */
+    *cpu_state_len += reg_entries_size;         /* reg entries */
+
+    cpu_state_buffer = g_malloc(*cpu_state_len);
+
+    memcpy(cpu_state_buffer + offset,
+            &reg_save_hdr, sizeof(reg_save_hdr));
+    offset += sizeof(reg_save_hdr);
+
+    /* Write num_cpus */
+    num_cpus = cpu_to_be32(num_cpus);
+    memcpy(cpu_state_buffer + offset, &num_cpus, sizeof(__be32));
+    offset += sizeof(__be32);
+
+    /* Write the register entries */
+    memcpy(cpu_state_buffer + offset, reg_entries, reg_entries_size);
+    offset += reg_entries_size;
+
+    return cpu_state_buffer;
+}
+
+/*
+ * Save the CPU State Data (aka "Register Save Area") in given region
+ *
+ * Region argument is expected to be of CPU_STATE_DATA type
+ *
+ * Returns false only in case of Hardware Error, such as failure to
+ * read/write a valid address.
+ *
+ * Otherwise, even in case of unsuccessful copy of CPU state data for reasons
+ * such as invalid destination address or non-fatal error errors likely
+ * caused due to invalid parameters, return true and set region->error_flags
+ */
+static bool do_populate_cpu_state(FadumpSection *region)
+{
+    uint64_t dest_addr = be64_to_cpu(region->destination_address);
+    uint64_t cpu_state_len = 0;
+    g_autofree void *cpu_state_buffer = NULL;
+    AddressSpace *default_as = &address_space_memory;
+    MemTxResult io_result;
+    MemTxAttrs attrs;
+
+    assert(region->source_data_type == cpu_to_be16(FADUMP_CPU_STATE_DATA));
+
+    /* Mark the memory transaction as privileged memory access */
+    attrs.user = 0;
+    attrs.memory = 1;
+
+    cpu_state_buffer  = get_cpu_state_data(&cpu_state_len);
+
+    io_result = address_space_write(default_as, dest_addr, attrs,
+            cpu_state_buffer, cpu_state_len);
+    if ((io_result & MEMTX_DECODE_ERROR) ||
+        (io_result & MEMTX_ACCESS_ERROR)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Failed to decode/access address in CPU State Region's"
+            " destination address: 0x%016" PRIx64 "\n", dest_addr);
+
+        /*
+         * Invalid source address is not an hardware error, instead
+         * wrong parameter from the kernel.
+         * Return true to let caller know to continue reading other
+         * sections
+         */
+        region->error_flags = FADUMP_ERROR_INVALID_SOURCE_ADDR;
+        region->bytes_dumped = 0;
+        return true;
+    } else if (io_result != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "FADump: Failed to write CPU state region.\n");
+
+        return false;
+    }
+
+    /*
+     * Set bytes_dumped in cpu state region, so kernel knows platform have
+     * exported it
+     */
+    region->bytes_dumped = cpu_to_be64(cpu_state_len);
+
+    if (region->source_len != region->bytes_dumped) {
+        /*
+         * Log the error, but don't fail the dump collection here, let
+         * kernel handle the mismatch
+         */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                "FADump: Mismatch in CPU State region's length exported:"
+                " Kernel expected: 0x%" PRIx64 " bytes,"
+                " QEMU exported: 0x%" PRIx64 " bytes\n",
+                be64_to_cpu(region->source_len),
+                be64_to_cpu(region->bytes_dumped));
+    }
+
+    return true;
+}
+
+/*
+ * Preserve the memory locations registered for fadump
+ *
+ * Returns false only in case of RTAS_OUT_HW_ERROR, otherwise true
+ */
 static bool fadump_preserve_mem(SpaprMachineState *spapr)
 {
     FadumpMemStruct *fdm = &spapr->registered_fdm;
@@ -277,7 +626,15 @@ static bool fadump_preserve_mem(SpaprMachineState *spapr)
 
         switch (data_type) {
         case FADUMP_CPU_STATE_DATA:
-            /* TODO: Add CPU state data */
+            if (!do_populate_cpu_state(&fdm->rgn[i])) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                    "FADump: Failed to store CPU State Data");
+                fdm->header.dump_status_flag |=
+                    cpu_to_be16(FADUMP_STATUS_DUMP_ERROR);
+
+                return false;
+            }
+
             break;
         case FADUMP_HPTE_REGION:
             /* TODO: Add hpte state data */
diff --git a/include/hw/ppc/spapr_fadump.h b/include/hw/ppc/spapr_fadump.h
index 71be2ad92c..fde2830e94 100644
--- a/include/hw/ppc/spapr_fadump.h
+++ b/include/hw/ppc/spapr_fadump.h
@@ -47,9 +47,17 @@
  */
 #define FADUMP_MAX_SECTIONS            10
 
+/* Number of register entries stored per cpu */
+#define FADUMP_PER_CPU_REG_ENTRIES (32 /*GPR*/ + 45 /*others*/ + 2 /*STRT & END*/)
+
+/* Mask of CPU ID in CPUSTRT and CPUEND entries */
+#define FADUMP_CPU_ID_MASK      ((1ULL << 32) - 1)
+
 typedef struct FadumpSection FadumpSection;
 typedef struct FadumpSectionHeader FadumpSectionHeader;
 typedef struct FadumpMemStruct FadumpMemStruct;
+typedef struct FadumpRegSaveAreaHeader FadumpRegSaveAreaHeader;
+typedef struct FadumpRegEntry FadumpRegEntry;
 
 struct SpaprMachineState;
 
@@ -88,6 +96,29 @@ struct FadumpMemStruct {
     FadumpSection       rgn[FADUMP_MAX_SECTIONS];
 };
 
+/*
+ * The firmware-assisted dump format.
+ *
+ * The register save area is an area in the partition's memory used to preserve
+ * the register contents (CPU state data) for the active CPUs during a firmware
+ * assisted dump. The dump format contains register save area header followed
+ * by register entries. Each list of registers for a CPU starts with "CPUSTRT"
+ * and ends with "CPUEND".
+ */
+
+/* Register save area header. */
+struct FadumpRegSaveAreaHeader {
+    uint64_t    magic_number;
+    uint32_t    version;
+    uint32_t    num_cpu_offset;
+};
+
+/* Register entry. */
+struct FadumpRegEntry {
+    uint64_t    reg_id;
+    uint64_t    reg_value;
+};
+
 uint32_t do_fadump_register(struct SpaprMachineState *, target_ulong);
 void     trigger_fadump_boot(struct SpaprMachineState *, target_ulong);
 #endif /* PPC_SPAPR_FADUMP_H */

From dd29ab88a3441e70ccd8c410fa85561b8cc54861 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:15 +0530
Subject: [PATCH 1581/2396] hw/ppc: Pass dump-sizes property for fadump in
 device tree

Platform (ie. QEMU) is expected to pass few device tree properties for
details for fadump:

  * "ibm,configure-kernel-dump-sizes": Space required to store dump data
    for firmware provided dump sections (ie. CPU & HPTE regions)
  * "ibm,configure-kernel-dump-version": Versions of fadump supported

Pass the above device tree nodes so that kernel can reserve sufficient
space for preserving the CPU state data

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-6-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c        | 57 +++++++++++++++++++++++++++++++++++++++++++
 hw/ppc/spapr_fadump.c |  6 ++---
 2 files changed, 60 insertions(+), 3 deletions(-)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 117da76a3d..d6cfb9acbc 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -900,6 +900,61 @@ static int spapr_dt_rng(void *fdt)
     return ret ? -1 : 0;
 }
 
+static void spapr_dt_rtas_fadump(SpaprMachineState *spapr, void *fdt, int rtas)
+{
+    MachineState *ms = MACHINE(spapr);
+    MachineClass *mc = MACHINE_GET_CLASS(ms);
+
+    uint32_t max_possible_cpus = mc->possible_cpu_arch_ids(ms)->len;
+    uint64_t fadump_cpu_state_size = 0;
+    uint16_t fadump_versions[2] = {
+        FADUMP_VERSION /* min supported version */,
+        FADUMP_VERSION /* max supported version */
+    };
+    uint32_t fadump_rgn_sizes[2][3] = {
+        {
+            cpu_to_be32(FADUMP_CPU_STATE_DATA),
+            0, 0 /* Calculated later */
+        },
+        {
+            cpu_to_be32(FADUMP_HPTE_REGION),
+            0, 0 /* HPTE region not implemented */
+        }
+    };
+
+    /*
+     * CPU State Data contains multiple fields such as header, num_cpus and
+     * register entries
+     *
+     * Calculate the maximum CPU State Data size, according to maximum
+     * possible CPUs the QEMU VM can have
+     *
+     * This calculation must match the 'cpu_state_len' calculation done in
+     * 'populate_cpu_state_data' in spapr_fadump.c
+     */
+    fadump_cpu_state_size += sizeof(struct FadumpRegSaveAreaHeader);
+    fadump_cpu_state_size += 0xc;                      /* padding as in PAPR */
+    fadump_cpu_state_size += sizeof(uint32_t);         /* num_cpus */
+    fadump_cpu_state_size += max_possible_cpus   *     /* reg entries */
+                             FADUMP_PER_CPU_REG_ENTRIES *
+                             sizeof(struct FadumpRegEntry);
+
+    /* Set maximum size for CPU state data region */
+    assert(fadump_rgn_sizes[0][0] == cpu_to_be32(FADUMP_CPU_STATE_DATA));
+
+    /* Upper 32 bits of size, usually 0 */
+    fadump_rgn_sizes[0][1] = cpu_to_be32(fadump_cpu_state_size >> 32);
+
+    /* Lower 32 bits of size */
+    fadump_rgn_sizes[0][2] = cpu_to_be32(fadump_cpu_state_size & 0xffffffff);
+
+    /* Add device tree properties required from platform for fadump */
+    _FDT((fdt_setprop(fdt, rtas, "ibm,configure-kernel-dump-version",
+                    fadump_versions, sizeof(fadump_versions))));
+    _FDT((fdt_setprop(fdt, rtas, "ibm,configure-kernel-dump-sizes",
+                    fadump_rgn_sizes, sizeof(fadump_rgn_sizes))));
+}
+
 static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
 {
     MachineState *ms = MACHINE(spapr);
@@ -1015,6 +1070,8 @@ static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)
     _FDT(fdt_setprop(fdt, rtas, "ibm,lrdr-capacity",
                      lrdr_capacity, sizeof(lrdr_capacity)));
 
+    spapr_dt_rtas_fadump(spapr, fdt, rtas);
+
     spapr_dt_rtas_tokens(fdt, rtas);
 }
 
diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index fdd4929148..fa3aeac94c 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -492,7 +492,7 @@ static void *get_cpu_state_data(uint64_t *cpu_state_len)
     *cpu_state_len = 0;
     *cpu_state_len += sizeof(reg_save_hdr);     /* reg save header */
     *cpu_state_len += 0xc;                      /* padding as in PAPR */
-    *cpu_state_len += sizeof(__be32);           /* num_cpus */
+    *cpu_state_len += sizeof(num_cpus);         /* num_cpus */
     *cpu_state_len += reg_entries_size;         /* reg entries */
 
     cpu_state_buffer = g_malloc(*cpu_state_len);
@@ -503,8 +503,8 @@ static void *get_cpu_state_data(uint64_t *cpu_state_len)
 
     /* Write num_cpus */
     num_cpus = cpu_to_be32(num_cpus);
-    memcpy(cpu_state_buffer + offset, &num_cpus, sizeof(__be32));
-    offset += sizeof(__be32);
+    memcpy(cpu_state_buffer + offset, &num_cpus, sizeof(num_cpus));
+    offset += sizeof(num_cpus);
 
     /* Write the register entries */
     memcpy(cpu_state_buffer + offset, reg_entries, reg_entries_size);

From 041ed0e9ba29113cdccc608218f658502556e19c Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:16 +0530
Subject: [PATCH 1582/2396] hw/ppc: Enable fadump for PSeries

With all support in place for preserving memory regions, enable fadump by
exporting the "ibm,kernel-dump" property in the device tree, representing
the fadump dump information, in case of a crash.

Currently "ibm,configure-kernel-dump" RTAS call is already registered,
which tells the kernel that the platform (QEMU) supports fadump.

Now, in case of a crash, if fadump was registered, we also pass
"ibm,kernel-dump" in device tree, which tells the kernel that the fadump
dump is active.

Pass "fadump=on" to enable Linux to use firmware assisted dump.

Logs of a linux boot with firmware assisted dump:

    $ ./build/qemu-system-ppc64 -M pseries,x-vof=on --cpu power10 --smp 4 -m 4G -kernel some-vmlinux -initrd some-initrd -append "debug fadump=on crashkernel=1G" -nographic

    [    0.000000] fadump: Reserved 1024MB of memory at 0x00000040000000 (System RAM: 4096MB)
    [    0.000000] fadump: Initialized 0x40000000 bytes cma area at 1024MB from 0x400102a8 bytes of memory reserved for firmware-assisted dump
    ...
    [    1.084686] rtas fadump: Registration is successful!
    ...
    # cat /sys/kernel/debug/powerpc/fadump_region
    CPU :[0x00000040000000-0x000000400013df] 0x13e0 bytes, Dumped: 0x0
    HPTE:[0x000000400013e0-0x000000400013df] 0x0 bytes, Dumped: 0x0
    DUMP: Src: 0x00000000000000, Dest: 0x00000040010000, Size: 0x40000000, Dumped: 0x0 bytes

    [0x0000000921a000-0x0000000921a7ff]: cmdline append: ''
    # echo c > /proc/sysrq-trigger

The fadump boot after crash:

    [    0.000000] rtas fadump: Firmware-assisted dump is active.
    [    0.000000] fadump: Updated cmdline: debug fadump=on crashkernel=1G
    [    0.000000] fadump: Firmware-assisted dump is active.
    [    0.000000] fadump: Reserving 3072MB of memory at 0x00000040000000 for preserving crash data
    ....
    # file /proc/vmcore
    /proc/vmcore: ELF 64-bit LSB core file, 64-bit PowerPC or cisco 7500, OpenPOWER ELF V2 ABI, version 1 (SYSV), SVR4-style

Analysing the vmcore with crash-utility:

          KERNEL: vmlinux-6.14-rc2
        DUMPFILE: vmcore-fc92fb373aa0
            CPUS: 4
            DATE: Wed Mar 12 23:39:23 CDT 2025
          UPTIME: 00:00:22
    LOAD AVERAGE: 0.13, 0.03, 0.01
           TASKS: 95
        NODENAME: buildroot
         RELEASE: 6.12.0-rc4+
         VERSION: #1 SMP Fri Jan  3 00:15:17 IST 2025
         MACHINE: ppc64le  (1000 Mhz)
          MEMORY: 4 GB
           PANIC: "Kernel panic - not syncing: sysrq triggered crash"
             PID: 269
         COMMAND: "sh"
            TASK: c00000000a050b00  [THREAD_INFO: c00000000a050b00]
             CPU: 0
           STATE: TASK_RUNNING (PANIC)

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-7-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 hw/ppc/spapr.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index d6cfb9acbc..6764730beb 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -904,6 +904,8 @@ static void spapr_dt_rtas_fadump(SpaprMachineState *spapr, void *fdt, int rtas)
 {
     MachineState *ms = MACHINE(spapr);
     MachineClass *mc = MACHINE_GET_CLASS(ms);
+    FadumpMemStruct *fdm = &spapr->registered_fdm;
+    uint16_t dump_status_flag;
 
     uint32_t max_possible_cpus = mc->possible_cpu_arch_ids(ms)->len;
     uint64_t fadump_cpu_state_size = 0;
@@ -953,6 +955,16 @@ static void spapr_dt_rtas_fadump(SpaprMachineState *spapr, void *fdt, int rtas)
                     fadump_versions, sizeof(fadump_versions))));
     _FDT((fdt_setprop(fdt, rtas, "ibm,configure-kernel-dump-sizes",
                     fadump_rgn_sizes, sizeof(fadump_rgn_sizes))));
+
+    dump_status_flag = be16_to_cpu(fdm->header.dump_status_flag);
+    if (dump_status_flag & FADUMP_STATUS_DUMP_TRIGGERED) {
+        uint64_t fdm_size =
+            sizeof(struct FadumpSectionHeader) +
+            (be16_to_cpu(fdm->header.dump_num_sections) *
+            sizeof(struct FadumpSection));
+
+        _FDT((fdt_setprop(fdt, rtas, "ibm,kernel-dump", fdm, fdm_size)));
+    }
 }
 
 static void spapr_dt_rtas(SpaprMachineState *spapr, void *fdt)

From 945fd61c065a72712c78422e4fcffeb682714944 Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:17 +0530
Subject: [PATCH 1583/2396] tests/functional: Add test for fadump in PSeries

Add testcases for testing fadump with PSeries and PSeries+KVM
combinations

It tests if fadump is successfully detected and registered in the first
kernel boot. Then crashes the kernel, and verifies whether we have a
/proc/vmcore in the 2nd boot

Also introduce 'wait_for_regex_console_pattern' to check for cases where
there is a single success message, but can have multiple failure
messages.

This is particularly useful for cases such as fadump, where the
success message is
    "Reserved 1024MB ... successfully"
But at the same point, it can fail with multiple errors such as
    "Not supported" or "Allocation failed"

'wait_for_regex_console_pattern' also has a timeout, for cases when we
know the success/failure should appear in a short amount of time,
instead of waiting for the much longer test timeout, such as kernels
with support of fadump will print the success/failure in earlyboot of
the kernel, while kernel without support of fadump won't print anything
for long time, and without a timeout the testcase keeps waiting till
longer test timeout

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-8-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 tests/functional/ppc64/meson.build        |   2 +
 tests/functional/ppc64/test_fadump.py     | 182 ++++++++++++++++++++++
 tests/functional/qemu_test/linuxkernel.py |  59 +++++++
 3 files changed, 243 insertions(+)
 create mode 100755 tests/functional/ppc64/test_fadump.py

diff --git a/tests/functional/ppc64/meson.build b/tests/functional/ppc64/meson.build
index 1fa0a70f7e..f0f8ab8f61 100644
--- a/tests/functional/ppc64/meson.build
+++ b/tests/functional/ppc64/meson.build
@@ -1,6 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 test_ppc64_timeouts = {
+  'fadump' : 480,
   'hv' : 1000,
   'mac99' : 120,
   'powernv' : 480,
@@ -16,6 +17,7 @@ tests_ppc64_system_quick = [
 
 tests_ppc64_system_thorough = [
   'e500',
+  'fadump',
   'hv',
   'mac99',
   'powernv',
diff --git a/tests/functional/ppc64/test_fadump.py b/tests/functional/ppc64/test_fadump.py
new file mode 100755
index 0000000000..2d6b8017e8
--- /dev/null
+++ b/tests/functional/ppc64/test_fadump.py
@@ -0,0 +1,182 @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+from unittest import skip
+from qemu_test import Asset
+from qemu_test import wait_for_console_pattern
+from qemu_test import LinuxKernelTest
+from qemu_test import exec_command, exec_command_and_wait_for_pattern
+
+class QEMUFadump(LinuxKernelTest):
+    """
+    Functional test to verify Fadump is working in following scenarios:
+
+    1. test_fadump_pseries:       PSeries
+    2. test_fadump_pseries_kvm:   PSeries + KVM
+    """
+
+    timeout = 90
+    KERNEL_COMMON_COMMAND_LINE = 'console=hvc0 fadump=on '
+    msg_panic = 'Kernel panic - not syncing'
+    msg_not_supported = 'Firmware-Assisted Dump is not supported on this hardware'
+    msg_registered_success = ''
+    msg_registered_failed = ''
+    msg_dump_active = ''
+
+    ASSET_EPAPR_KERNEL = Asset(
+        ('https://github.com/open-power/op-build/releases/download/v2.7/'
+         'zImage.epapr'),
+        '0ab237df661727e5392cee97460e8674057a883c5f74381a128fa772588d45cd')
+
+    ASSET_VMLINUZ_KERNEL = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora-secondary/'
+         'releases/39/Everything/ppc64le/os/ppc/ppc64/vmlinuz'),
+        ('81e5541d243b50c8f9568906c6918dda22239744d637bb9a7b22d23c3d661226'
+         '8d5302beb2ca5c06f93bdbc9736c414ef5120756c8bf496ff488ad07d116d67f')
+        )
+
+    ASSET_FEDORA_INITRD = Asset(
+        ('https://archives.fedoraproject.org/pub/archive/fedora-secondary/'
+        'releases/39/Everything/ppc64le/os/ppc/ppc64/initrd.img'),
+        'e7f24b44cb2aaa67d30e551db6ac8d29cc57c934b158dabca6b7f885f2cfdd9b')
+
+    def do_test_fadump(self, is_kvm=False, is_powernv=False):
+        """
+        Helper Function for Fadump tests below
+
+        It boots the VM with fadump enabled, checks if fadump is correctly
+        registered.
+        Then crashes the system causing a QEMU_SYSTEM_RESET, after which
+        dump should be available in the kernel.
+        Finally it checks the filesize of the exported /proc/vmcore in 2nd
+        kernel to verify it's same as the VM's memory size
+        """
+        if is_kvm:
+            self.require_accelerator("kvm")
+            self.vm.add_args("-accel", "kvm")
+        else:
+            self.require_accelerator("tcg")
+
+        if is_powernv:
+            self.set_machine("powernv10")
+        else:
+            # SLOF takes upto >20s in startup time, use VOF
+            self.set_machine("pseries")
+            self.vm.add_args("-machine", "x-vof=on")
+            self.vm.add_args("-m", "6G")
+
+        self.vm.set_console()
+
+        kernel_path = None
+
+        if is_powernv:
+            kernel_path = self.ASSET_EPAPR_KERNEL.fetch()
+        else:
+            kernel_path = self.ASSET_VMLINUZ_KERNEL.fetch()
+
+        initrd_path = self.ASSET_FEDORA_INITRD.fetch()
+
+        self.vm.add_args('-kernel', kernel_path)
+        self.vm.add_args('-initrd', initrd_path)
+        self.vm.add_args('-append', "fadump=on"\
+                         " -nodefaults -serial mon:stdio crashkernel=2G"\
+                         " rdinit=/bin/sh ")
+
+        self.vm.launch()
+
+        # If kernel detects fadump support, and "fadump=on" is in command
+        # line which we add above, it will print something like:
+        #
+        #     fadump: Reserved 1024MB of memory at 0x00000040000000 ...
+        #
+        # Else, if the kernel doesn't detect fadump support, it prints:
+        #
+        #     fadump: Firmware-Assisted Dump is not supported on this hardware
+        #
+        # Timeout after 20s if kernel doesn't print any fadump logs, this
+        # can happen due to fadump being disabled in the kernel
+        self.wait_for_regex_console_pattern(
+            success_pattern="fadump: Reserved ",
+            failure_pattern=r"fadump: (Firmware-Assisted Dump is not"\
+            " supported on this hardware|Failed to find memory chunk for"\
+            " reservation!)",
+            timeout=20
+        )
+
+        # Ensure fadump is registered successfully, if registration
+        # succeeds, we get a log from rtas fadump:
+        #
+        #     rtas fadump: Registration is successful!
+        self.wait_for_console_pattern(
+            "rtas fadump: Registration is successful!"
+        )
+
+        # Wait for the shell
+        self.wait_for_console_pattern("#")
+
+        # Mount /proc since not available in the initrd used
+        exec_command(self, command="mount -t proc proc /proc")
+
+        # Crash the kernel
+        exec_command(self, command="echo c > /proc/sysrq-trigger")
+
+        # Check for the kernel panic message, setting timeout to 20s as it
+        # should occur almost immediately after previous echo c
+        self.wait_for_regex_console_pattern(
+            success_pattern="Kernel panic - not syncing: sysrq" \
+                " triggered crash",
+            timeout=20
+        )
+
+        # Check if fadump is active
+        # If the kernel shows that fadump is active, that implies it's a
+        # crashkernel boot
+        # Else if the kernel shows "fadump: Reserved ..." then it's
+        # treating this as the first kernel boot, this is likely the case
+        # that qemu didn't pass the 'ibm,kernel-dump' device tree node
+        wait_for_console_pattern(
+            test=self,
+            success_message="rtas fadump: Firmware-assisted dump is active",
+            failure_message="fadump: Reserved "
+        )
+
+        # In a successful fadump boot, we get these logs:
+        #
+        # [    0.000000] fadump: Firmware-assisted dump is active.
+        # [    0.000000] fadump: Reserving <>MB of memory at <> for preserving crash data
+        #
+        # Check if these logs are present in the fadump boot
+        self.wait_for_console_pattern("preserving crash data")
+
+        # Wait for prompt
+        self.wait_for_console_pattern("sh-5.2#")
+
+        # Mount /proc since not available in the initrd used
+        exec_command_and_wait_for_pattern(self,
+            command="mount -t proc proc /proc",
+            success_message="#"
+        )
+
+        # Check if vmcore exists
+        exec_command_and_wait_for_pattern(self,
+            command="stat /proc/vmcore",
+            success_message="File: /proc/vmcore",
+            failure_message="No such file or directory"
+        )
+
+    def test_fadump_pseries(self):
+        return self.do_test_fadump(is_kvm=False, is_powernv=False)
+
+    @skip("PowerNV Fadump not supported yet")
+    def test_fadump_powernv(self):
+        return
+
+    def test_fadump_pseries_kvm(self):
+        """
+        Test Fadump in PSeries with KVM accel
+        """
+        self.do_test_fadump(is_kvm=True, is_powernv=False)
+
+if __name__ == '__main__':
+    QEMUFadump.main()
diff --git a/tests/functional/qemu_test/linuxkernel.py b/tests/functional/qemu_test/linuxkernel.py
index 2aca0ee3cd..c4767527da 100644
--- a/tests/functional/qemu_test/linuxkernel.py
+++ b/tests/functional/qemu_test/linuxkernel.py
@@ -5,6 +5,9 @@
 
 import hashlib
 import urllib.request
+import logging
+import re
+import time
 
 from .cmd import wait_for_console_pattern, exec_command_and_wait_for_pattern
 from .testcase import QemuSystemTest
@@ -19,6 +22,62 @@ class LinuxKernelTest(QemuSystemTest):
                                  failure_message='Kernel panic - not syncing',
                                  vm=vm)
 
+    def wait_for_regex_console_pattern(self, success_pattern,
+                                       failure_pattern=None,
+                                       timeout=None):
+        """
+        Similar to 'wait_for_console_pattern', but supports regex patterns,
+        hence multiple failure/success patterns can be detected at a time.
+
+        Args:
+            success_pattern (str | re.Pattern): A regex pattern that indicates
+                a successful event. If found, the method exits normally.
+            failure_pattern (str | re.Pattern, optional): A regex pattern that
+                indicates a failure event. If found, the test fails
+            timeout (int, optional): The maximum time (in seconds) to wait for
+                a match.
+                If exceeded, the test fails.
+        """
+
+        console = self.vm.console_file
+        console_logger = logging.getLogger('console')
+
+        self.log.debug(
+            f"Console interaction: success_msg='{success_pattern}' " +
+            f"failure_msg='{failure_pattern}' timeout='{timeout}s'")
+
+        # Only consume console output if waiting for something
+        if success_pattern is None and failure_pattern is None:
+            return
+
+        start_time = time.time()
+
+        while time.time() - start_time < timeout:
+            try:
+                msg = console.readline().decode().strip()
+            except UnicodeDecodeError:
+                msg = None
+            if not msg:
+                continue
+            console_logger.debug(msg)
+            if success_pattern is None or re.search(success_pattern, msg):
+                break
+            if failure_pattern:
+                # Find the matching error to print in log
+                match = re.search(failure_pattern, msg)
+                if not match:
+                    continue
+
+                console.close()
+                fail = 'Failure message found in console: "%s".' \
+                        ' Expected: "%s"' % \
+                        (match.group(), success_pattern)
+                self.fail(fail)
+
+        if time.time() - start_time >= timeout:
+            fail = f"Timeout ({timeout}s) while trying to search pattern"
+            self.fail(fail)
+
     def launch_kernel(self, kernel, initrd=None, dtb=None, console_index=0,
                       wait_for=None):
         self.vm.set_console(console_index=console_index)

From 3db841bf1194b2720a08df2ee0a6ca517091ad0e Mon Sep 17 00:00:00 2001
From: Aditya Gupta <adityag@linux.ibm.com>
Date: Tue, 21 Oct 2025 19:18:18 +0530
Subject: [PATCH 1584/2396] MAINTAINERS: Add entry for FADump (pSeries)

Add maintainer and reviewer for fadump subsystem.

Signed-off-by: Aditya Gupta <adityag@linux.ibm.com>
Acked-by: Sourabh Jain <sourabhjain@linux.ibm.com>
Tested-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/20251021134823.1861675-9-adityag@linux.ibm.com
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 MAINTAINERS | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 684d7a5b37..53dbf915ea 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3215,6 +3215,14 @@ F: scripts/coccinelle/remove_local_err.cocci
 F: scripts/coccinelle/use-error_fatal.cocci
 F: scripts/coccinelle/errp-guard.cocci
 
+Firmware Assisted Dump (fadump) for sPAPR (pseries)
+M: Aditya Gupta <adityag@linux.ibm.com>
+R: Sourabh Jain <sourabhjain@linux.ibm.com>
+S: Maintained
+F: include/hw/ppc/spapr_fadump.h
+F: hw/ppc/spapr_fadump.c
+F: tests/functional/ppc64/test_fadump.py
+
 GDB stub
 M: Alex Bennée <alex.bennee@linaro.org>
 R: Philippe Mathieu-Daudé <philmd@linaro.org>

From fe7d70872b2f9f834e2ae76989a59dff0f40a521 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 23 Oct 2025 13:12:49 +0100
Subject: [PATCH 1585/2396] hw/intc/arm_gicv3_dist: Implement GICD_TYPER2 as 0

The GIC distributor registers GICD_TYPER2 is present when the
GICv4.1 is implemented, and RES0 otherwise. QEMU's TCG implementation
is only GICv4.0, so this register is RES0. However, since it's
reasonable for GICv4.1-aware software to read the register, expecting
the zero for GICv3 and GICv4.0, implement the case to avoid it being
logged as an invalid guest read.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/intc/arm_gicv3_dist.c | 9 +++++++++
 hw/intc/gicv3_internal.h | 1 +
 2 files changed, 10 insertions(+)

diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index d8207acb22..a7d10ed949 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -431,6 +431,15 @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
             (0xf << 19) | itlinesnumber;
         return true;
     }
+    case GICD_TYPER2:
+        /*
+         * This register only exists for GICv4.1, which QEMU doesn't
+         * currently emulate. On GICv3 and GICv4 it's defined to be RES0.
+         * We implement as read-zero here to avoid tracing a bad-register-read
+         * if GICv4.1-aware software reads this ID register.
+         */
+        *data = 0;
+        return true;
     case GICD_IIDR:
         /* We claim to be an ARM r0p0 with a zero ProductID.
          * This is the same as an r0p0 GIC-500.
diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index bc9f518fe8..fc586524f5 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -31,6 +31,7 @@
 #define GICD_CTLR            0x0000
 #define GICD_TYPER           0x0004
 #define GICD_IIDR            0x0008
+#define GICD_TYPER2          0x000C
 #define GICD_STATUSR         0x0010
 #define GICD_SETSPI_NSR      0x0040
 #define GICD_CLRSPI_NSR      0x0048

From 7ade034e66ce71d66090aca9695e10041bb0d646 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 23 Oct 2025 13:12:49 +0100
Subject: [PATCH 1586/2396] hw/intc/arm_gicv3_kvm: Drop DPRINTF macro

We don't generally like DPRINTF debug macros, preferring tracepoints.
In this case the macro is used in only three places (reset, realize,
and in the unlikely event the host kernel doesn't have GICv3 register
access support). These don't seem worth converting to tracepoints,
so simply delete the macro and its uses.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/intc/arm_gicv3_kvm.c | 13 -------------
 1 file changed, 13 deletions(-)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 9829e2146d..405496c7bb 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -36,14 +36,6 @@
 #include "target/arm/cpregs.h"
 
 
-#ifdef DEBUG_GICV3_KVM
-#define DPRINTF(fmt, ...) \
-    do { fprintf(stderr, "kvm_gicv3: " fmt, ## __VA_ARGS__); } while (0)
-#else
-#define DPRINTF(fmt, ...) \
-    do { } while (0)
-#endif
-
 #define TYPE_KVM_ARM_GICV3 "kvm-arm-gicv3"
 typedef struct KVMARMGICv3Class KVMARMGICv3Class;
 /* This is reusing the GICv3State typedef from ARM_GICV3_ITS_COMMON */
@@ -708,14 +700,11 @@ static void kvm_arm_gicv3_reset_hold(Object *obj, ResetType type)
     GICv3State *s = ARM_GICV3_COMMON(obj);
     KVMARMGICv3Class *kgc = KVM_ARM_GICV3_GET_CLASS(s);
 
-    DPRINTF("Reset\n");
-
     if (kgc->parent_phases.hold) {
         kgc->parent_phases.hold(obj, type);
     }
 
     if (s->migration_blocker) {
-        DPRINTF("Cannot put kernel gic state, no kernel interface\n");
         return;
     }
 
@@ -797,8 +786,6 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
     Error *local_err = NULL;
     int i;
 
-    DPRINTF("kvm_arm_gicv3_realize\n");
-
     kgc->parent_realize(dev, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);

From 97de03a0bf6ee07df4cfc910c1d709449f71ca47 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:49 +0100
Subject: [PATCH 1587/2396] target/arm: Add isar feature test for FEAT_AIE

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-features.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 37f1eca3af..579fa8f8f4 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -1364,6 +1364,11 @@ static inline bool isar_feature_aa64_s2pie(const ARMISARegisters *id)
     return FIELD_EX64_IDREG(id, ID_AA64MMFR3, S2PIE) != 0;
 }
 
+static inline bool isar_feature_aa64_aie(const ARMISARegisters *id)
+{
+    return FIELD_EX64_IDREG(id, ID_AA64MMFR3, AIE) != 0;
+}
+
 static inline bool isar_feature_aa64_mec(const ARMISARegisters *id)
 {
     return FIELD_EX64_IDREG(id, ID_AA64MMFR3, MEC) != 0;

From f50cbc6e6c0293010505f0231d94eead8ade5878 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1588/2396] target/arm: Implement MAIR2_ELx and AMAIR2_ELx

Enable the SCR.AIEn bit in scr_write, and test it in aien_access.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h |  2 ++
 target/arm/cpu.c    |  3 +++
 target/arm/cpu.h    |  5 +++-
 target/arm/helper.c | 62 +++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 71 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index 763de5e051..48a406a5fb 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -806,6 +806,8 @@ typedef enum FGTBit {
     DO_REV_BIT(HFGRTR, NTPIDR2_EL0),
     DO_REV_BIT(HFGRTR, NPIRE0_EL1),
     DO_REV_BIT(HFGRTR, NPIR_EL1),
+    DO_REV_BIT(HFGRTR, NMAIR2_EL1),
+    DO_REV_BIT(HFGRTR, NAMAIR2_EL1),
 
     /* Trap bits in HDFGRTR_EL2 / HDFGWTR_EL2, starting from bit 0. */
     DO_BIT(HDFGRTR, DBGBCRN_EL1),
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index 3b556f1404..d2fc17eab6 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -652,6 +652,9 @@ void arm_emulate_firmware_reset(CPUState *cpustate, int target_el)
                 cpu_isar_feature(aa64_s2pie, cpu)) {
                 env->cp15.scr_el3 |= SCR_PIEN;
             }
+            if (cpu_isar_feature(aa64_aie, cpu)) {
+                env->cp15.scr_el3 |= SCR_AIEN;
+            }
             if (cpu_isar_feature(aa64_mec, cpu)) {
                 env->cp15.scr_el3 |= SCR_MECEN;
             }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index bf221e6f97..7c226a112d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -447,7 +447,8 @@ typedef struct CPUArchState {
         uint64_t c9_pmuserenr; /* perf monitor user enable */
         uint64_t c9_pmselr; /* perf monitor counter selection register */
         uint64_t c9_pminten; /* perf monitor interrupt enables */
-        union { /* Memory attribute redirection */
+        /* Memory attribute redirection */
+        union {
             struct {
 #if HOST_BIG_ENDIAN
                 uint64_t _unused_mair_0;
@@ -467,6 +468,7 @@ typedef struct CPUArchState {
             };
             uint64_t mair_el[4];
         };
+        uint64_t mair2_el[4];
         union { /* vector base address register */
             struct {
                 uint64_t _unused_vbar;
@@ -1736,6 +1738,7 @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define SCR_TCR2EN            (1ULL << 43)
 #define SCR_SCTLR2EN          (1ULL << 44)
 #define SCR_PIEN              (1ULL << 45)
+#define SCR_AIEN              (1ULL << 46)
 #define SCR_GPF               (1ULL << 48)
 #define SCR_MECEN             (1ULL << 49)
 #define SCR_NSE               (1ULL << 62)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 167f2909b3..e4d1651440 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -779,6 +779,9 @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             cpu_isar_feature(aa64_s2pie, cpu)) {
             valid_mask |= SCR_PIEN;
         }
+        if (cpu_isar_feature(aa64_aie, cpu)) {
+            valid_mask |= SCR_AIEN;
+        }
         if (cpu_isar_feature(aa64_mec, cpu)) {
             valid_mask |= SCR_MECEN;
         }
@@ -6189,6 +6192,61 @@ static const ARMCPRegInfo s2pie_reginfo[] = {
       .fieldoffset = offsetof(CPUARMState, cp15.s2pir_el2) },
 };
 
+static CPAccessResult aien_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_AIEN)
+        && arm_current_el(env) < 3) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult aien_el1_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
+{
+    CPAccessResult ret = access_tvm_trvm(env, ri, isread);
+    if (ret == CP_ACCESS_OK) {
+        ret = aien_access(env, ri, isread);
+    }
+    return ret;
+}
+
+static const ARMCPRegInfo aie_reginfo[] = {
+    { .name = "MAIR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 2, .opc2 = 1,
+      .access = PL1_RW, .accessfn = aien_el1_access,
+      .fgt = FGT_NMAIR2_EL1, .nv2_redirect_offset = 0x280 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 1, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 2, 1),
+      .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[1]) },
+    { .name = "MAIR2_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 1, .opc2 = 1,
+      .access = PL2_RW, .accessfn = aien_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[2]) },
+    { .name = "MAIR2_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 1, .opc2 = 1,
+      .access = PL3_RW,
+      .fieldoffset = offsetof(CPUARMState, cp15.mair2_el[3]) },
+
+    { .name = "AMAIR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 10, .crm = 3, .opc2 = 1,
+      .access = PL1_RW, .accessfn = aien_el1_access,
+      .fgt = FGT_NAMAIR2_EL1, .nv2_redirect_offset = 0x288 | NV2_REDIR_NV1,
+      .vhe_redir_to_el2 = ENCODE_AA64_CP_REG(3, 4, 10, 3, 1),
+      .vhe_redir_to_el01 = ENCODE_AA64_CP_REG(3, 5, 10, 3, 1),
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "AMAIR2_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
+      .access = PL2_RW, .accessfn = aien_access,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "AMAIR2_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 10, .crm = 3, .opc2 = 1,
+      .access = PL3_RW,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+};
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -7434,6 +7492,10 @@ void register_cp_regs_for_features(ARMCPU *cpu)
         }
     }
 
+    if (cpu_isar_feature(aa64_aie, cpu)) {
+        define_arm_cp_regs(cpu, aie_reginfo);
+    }
+
     if (cpu_isar_feature(any_predinv, cpu)) {
         define_arm_cp_regs(cpu, predinv_reginfo);
     }

From 3bbdeedd6a3444100d739d052d9740695956f8fe Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1589/2396] target/arm: Add AIE to ARMVAParameters

Allow the bit to be set in TCR2;
extract the bit in aa64_va_parameters.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 30 +++++++++++++++++++++---------
 target/arm/internals.h |  1 +
 2 files changed, 22 insertions(+), 9 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index e4d1651440..8c0b8889db 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6098,6 +6098,9 @@ static void tcr2_el1_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_s1pie, cpu)) {
         valid_mask |= TCR2_PIE;
     }
+    if (cpu_isar_feature(aa64_aie, cpu)) {
+        valid_mask |= TCR2_AIE;
+    }
     value &= valid_mask;
     raw_write(env, ri, value);
 }
@@ -6111,7 +6114,10 @@ static void tcr2_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
     if (cpu_isar_feature(aa64_s1pie, cpu)) {
         valid_mask |= TCR2_PIE;
     }
-    if (cpu_isar_feature(aa64_mec, env_archcpu(env))) {
+    if (cpu_isar_feature(aa64_aie, cpu)) {
+        valid_mask |= TCR2_AIE;
+    }
+    if (cpu_isar_feature(aa64_mec, cpu)) {
         valid_mask |= TCR2_AMEC0 | TCR2_AMEC1;
     }
     value &= valid_mask;
@@ -9666,6 +9672,7 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
     bool epd, hpd, tsz_oob, ds, ha, hd, pie = false;
+    bool aie = false;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
@@ -9688,10 +9695,12 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             if (r_el == 3) {
                 pie = (extract64(tcr, 35, 1)
                        && cpu_isar_feature(aa64_s1pie, cpu));
-            } else {
-                pie = ((env->cp15.tcr2_el[2] & TCR2_PIE)
-                       && (!arm_feature(env, ARM_FEATURE_EL3)
-                           || (env->cp15.scr_el3 & SCR_TCR2EN)));
+                aie = (extract64(tcr, 37, 1)
+                       && cpu_isar_feature(aa64_aie, cpu));
+            } else if (!arm_feature(env, ARM_FEATURE_EL3)
+                       || (env->cp15.scr_el3 & SCR_TCR2EN)) {
+                pie = env->cp15.tcr2_el[2] & TCR2_PIE;
+                aie = env->cp15.tcr2_el[2] & TCR2_AIE;
             }
         }
         epd = false;
@@ -9733,10 +9742,12 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             epd = true;
         }
 
-        pie = ((env->cp15.tcr2_el[r_el] & TCR2_PIE)
-               && (!arm_feature(env, ARM_FEATURE_EL3)
-                   || (env->cp15.scr_el3 & SCR_TCR2EN))
-               && (r_el == 2 || (arm_hcrx_el2_eff(env) & HCRX_TCR2EN)));
+        if ((!arm_feature(env, ARM_FEATURE_EL3)
+             || (env->cp15.scr_el3 & SCR_TCR2EN))
+            && (r_el == 2 || (arm_hcrx_el2_eff(env) & HCRX_TCR2EN))) {
+            pie = env->cp15.tcr2_el[r_el] & TCR2_PIE;
+            aie = env->cp15.tcr2_el[r_el] & TCR2_AIE;
+        }
     }
     hpd |= pie;
 
@@ -9818,6 +9829,7 @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .hd = ha && hd,
         .gran = gran,
         .pie = pie,
+        .aie = aie,
     };
 }
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index f539bbe58e..a65386aaed 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1391,6 +1391,7 @@ typedef struct ARMVAParameters {
     bool hd         : 1;
     ARMGranuleSize gran : 2;
     bool pie        : 1;
+    bool aie        : 1;
 } ARMVAParameters;
 
 /**

From 56ff19a5c26d7254619684e14c5fe1b773a46b68 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1590/2396] target/arm: Drop trivial assert vs attrindx

We just extracted 3 bits; the <= 7 test is trivially true.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index d4386ede73..54c45fc9fe 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2320,7 +2320,6 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
         mair = env->cp15.mair_el[regime_el(mmu_idx)];
-        assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 

From f6e40ee151e68fbd403925341185e9b038f19164 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1591/2396] target/arm: Use el local indexing mair_el

We already have regime_el() computed to a local.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 54c45fc9fe..5fcf104272 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2319,7 +2319,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
-        mair = env->cp15.mair_el[regime_el(mmu_idx)];
+        mair = env->cp15.mair_el[el];
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 

From 7eaee7f73e798438a9630c502da19e61f1bfe34e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1592/2396] target/arm: Honor param.aie in get_phys_addr_lpae

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 5fcf104272..23f6616811 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2319,7 +2319,9 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
         /* Index into MAIR registers for cache attributes */
         attrindx = extract32(attrs, 2, 3);
-        mair = env->cp15.mair_el[el];
+        mair = (param.aie && extract64(attrs, 59, 1)
+                ? env->cp15.mair2_el[el]
+                : env->cp15.mair_el[el]);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 

From 2132c93fb97db6fc52f29ba685f109d8db5b6f92 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1593/2396] target/arm: Enable FEAT_AIE for -cpu max

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251014195017.421681-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index bf81da124a..31a5878a8f 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -21,6 +21,7 @@ the following architecture extensions:
 - FEAT_AdvSIMD (Advanced SIMD Extension)
 - FEAT_AES (AESD and AESE instructions)
 - FEAT_AFP (Alternate floating-point behavior)
+- FEAT_AIE (Memory Attribute Index Enhancement)
 - FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)
 - FEAT_ASID16 (16 bit ASID)
 - FEAT_ATS1A (Address Translation operations that ignore stage 1 permissions)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 1bffe66e81..6871956382 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1331,6 +1331,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR3, SPEC_FPACC, 1); /* FEAT_FPACC_SPEC */
     t = FIELD_DP64(t, ID_AA64MMFR3, S1PIE, 1);    /* FEAT_S1PIE */
     t = FIELD_DP64(t, ID_AA64MMFR3, S2PIE, 1);    /* FEAT_S2PIE */
+    t = FIELD_DP64(t, ID_AA64MMFR3, AIE, 1);      /* FEAT_AIE */
     SET_IDREG(isar, ID_AA64MMFR3, t);
 
     t = GET_IDREG(isar, ID_AA64ZFR0);

From 3f462d79a080060e54e39d31ce10fdf1a20317ef Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1594/2396] target/arm: Fix reads of CNTFRQ_EL0 in linux-user
 mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit bd8e9ddf6f6 ("target/arm: Refactor default generic timer
frequency handling") we changed how we initialized the generic timer
frequency as reported in the CNTFRQ_EL0 register.  As part of that,
we chanegd the linux-user version of the CNTFRQ_EL0 sysreg from
having a constant value set at compile time through the .resetvalue
field to having a reset value which we compute in a .resetfn.

This accidentally broke the reading of CNTFRQ_EL0 in linux-user mode,
because the cpreg is marked as ARM_CP_CONST, which means we translate
it as a read of the compile-time constant value in the .resetvalue
field.  This is now zero, so userspace sees a 0 frequency value.

Fix the bug by dropping the ARM_CP_CONST marking.  This will cause us
to translate the read as a load of the value from the CPU state
struct cp15.c14_cntfrq field, which is where the real frequency value
now lives.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3159
Fixes: bd8e9ddf6f6 ("target/arm: Refactor default generic timer frequency handling")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251013161040.216819-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 8c0b8889db..2ef9c17814 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -2309,7 +2309,7 @@ static uint64_t gt_virt_cnt_read(CPUARMState *env, const ARMCPRegInfo *ri)
 static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     { .name = "CNTFRQ_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 0, .opc2 = 0,
-      .type = ARM_CP_CONST, .access = PL0_R /* no PL1_RW in linux-user */,
+      .access = PL0_R /* no PL1_RW in linux-user */,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_cntfrq),
       .resetfn = arm_gt_cntfrq_reset,
     },

From 59ad421d66df9e53b944475378b6fe389a61612d Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 23 Oct 2025 13:12:50 +0100
Subject: [PATCH 1595/2396] hw/intc/arm_gicv3_kvm: Avoid reading ICC_CTLR_EL1
 from kernel in cpuif reset

Currently in arm_gicv3_icc_reset() we read the kernel's value of
ICC_CTLR_EL1 as part of resetting the CPU interface.  This mostly
works, but we're actually breaking an assumption the kernel makes
that userspace only accesses the in-kernel GIC data when the VM is
totally paused, which may not be the case if a single vCPU is being
reset.  The effect is that it's possible that the read attempt
returns EBUSY.

Avoid this by reading the kernel's value of the reset ICC_CTLR_EL1
once in device realize. This brings ICC_CTLR_EL1 into line with
the other cpuif registers, where we assume we know what the kernel
is resetting them to and just update QEMU's data structures in
arm_gicv3_icc_reset().

Reviewed-by: Salil Mehta <salil.mehta@huawei.com>
Tested-by: Salil Mehta <salil.mehta@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20251014102439.319915-1-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_kvm.c            | 49 +++++++++++++++++++++---------
 include/hw/intc/arm_gicv3_common.h |  3 ++
 2 files changed, 38 insertions(+), 14 deletions(-)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 405496c7bb..66b0dddfd4 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -658,11 +658,24 @@ static void kvm_arm_gicv3_get(GICv3State *s)
 
 static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    GICv3State *s;
-    GICv3CPUState *c;
+    GICv3CPUState *c = (GICv3CPUState *)env->gicv3state;
 
-    c = (GICv3CPUState *)env->gicv3state;
-    s = c->gic;
+    /*
+     * This function is called when each vcpu resets. The kernel
+     * API for the GIC assumes that it is only to be used when the
+     * whole VM is paused, so if we attempt to read the kernel's
+     * reset values here we might get EBUSY failures.
+     * So instead we assume we know what the kernel's reset values
+     * are (mostly zeroes) and only update the QEMU state struct
+     * fields. The exception is that we do need to know the kernel's
+     * idea of the ICC_CTLR_EL1 reset value, so we cache that at
+     * device realize time.
+     *
+     * This makes these sysregs different from the usual CPU ones,
+     * which can be validly read and written when only the single
+     * vcpu they apply to is paused, and where (in target/arm code)
+     * we read the reset values out of the kernel on every reset.
+     */
 
     c->icc_pmr_el1 = 0;
     /*
@@ -683,16 +696,8 @@ static void arm_gicv3_icc_reset(CPUARMState *env, const ARMCPRegInfo *ri)
     memset(c->icc_apr, 0, sizeof(c->icc_apr));
     memset(c->icc_igrpen, 0, sizeof(c->icc_igrpen));
 
-    if (s->migration_blocker) {
-        return;
-    }
-
-    /* Initialize to actual HW supported configuration */
-    kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
-                      KVM_VGIC_ATTR(ICC_CTLR_EL1, c->gicr_typer),
-                      &c->icc_ctlr_el1[GICV3_NS], false, &error_abort);
-
-    c->icc_ctlr_el1[GICV3_S] = c->icc_ctlr_el1[GICV3_NS];
+    c->icc_ctlr_el1[GICV3_NS] = c->kvm_reset_icc_ctlr_el1;
+    c->icc_ctlr_el1[GICV3_S] = c->kvm_reset_icc_ctlr_el1;
 }
 
 static void kvm_arm_gicv3_reset_hold(Object *obj, ResetType type)
@@ -926,6 +931,22 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
                                     kvm_arm_gicv3_notifier,
                                     MIG_MODE_CPR_TRANSFER);
     }
+
+    /*
+     * Now we can read the kernel's initial value of ICC_CTLR_EL1, which
+     * we will need if a CPU interface is reset. If the kernel is ancient
+     * and doesn't support writing the GIC state then we don't need to
+     * care what reset does to QEMU's data structures.
+     */
+    if (!s->migration_blocker) {
+        for (i = 0; i < s->num_cpu; i++) {
+            GICv3CPUState *c = &s->cpu[i];
+
+            kvm_device_access(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_CPU_SYSREGS,
+                              KVM_VGIC_ATTR(ICC_CTLR_EL1, c->gicr_typer),
+                              &c->kvm_reset_icc_ctlr_el1, false, &error_abort);
+        }
+    }
 }
 
 static void kvm_arm_gicv3_class_init(ObjectClass *klass, const void *data)
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index 38aa1961c5..61d51915e0 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -166,6 +166,9 @@ struct GICv3CPUState {
     uint64_t icc_igrpen[3];
     uint64_t icc_ctlr_el3;
 
+    /* For KVM, cached copy of the kernel reset value of ICC_CTLR_EL1 */
+    uint64_t kvm_reset_icc_ctlr_el1;
+
     /* Virtualization control interface */
     uint64_t ich_apr[3][4]; /* ich_apr[GICV3_G1][x] never used */
     uint64_t ich_hcr_el2;

From 0af7ba53fe126f653602f3abf1e37489e114867f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 16:42:44 +0100
Subject: [PATCH 1596/2396] MAINTAINERS: Claim the Arm XML in gdb-xml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add F: entries to the Arm CPU section to claim the Arm related
XML files in gdb-xml.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017154244.971608-1-peter.maydell@linaro.org
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index 36eef27b41..732b5242e8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -208,6 +208,8 @@ F: hw/cpu/a*mpcore.c
 F: include/hw/cpu/a*mpcore.h
 F: docs/system/target-arm.rst
 F: docs/system/arm/cpu-features.rst
+F: gdb-xml/arm*.xml
+F: gdb-xml/aarch64*.xml
 
 ARM SMMU
 M: Eric Auger <eric.auger@redhat.com>

From 841bb7d96f72efc4d825b7333b02bda32f3d04f7 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 16:30:25 +0100
Subject: [PATCH 1597/2396] target/arm: Implement SME2 support in gdbstub
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For SME2, we need to expose the new ZT0 register in the gdbstub XML.
gdb documents that the requirements are:

> The ‘org.gnu.gdb.aarch64.sme2’ feature is optional.  If present,
> then the ‘org.gnu.gdb.aarch64.sme’ feature must also be present.
> The ‘org.gnu.gdb.aarch64.sme2’ feature should contain the
> following:
>
>    - ZT0 is a register of 512 bits (64 bytes).  It is defined as a
>      vector of bytes.

Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017153027.969016-2-peter.maydell@linaro.org
---
 configs/targets/aarch64-bsd-user.mak      |  2 +-
 configs/targets/aarch64-linux-user.mak    |  2 +-
 configs/targets/aarch64-softmmu.mak       |  2 +-
 configs/targets/aarch64_be-linux-user.mak |  2 +-
 gdb-xml/aarch64-sme2.xml                  | 14 ++++++
 target/arm/gdbstub.c                      |  6 +++
 target/arm/gdbstub64.c                    | 52 +++++++++++++++++++++++
 target/arm/internals.h                    |  2 +
 8 files changed, 78 insertions(+), 4 deletions(-)
 create mode 100644 gdb-xml/aarch64-sme2.xml

diff --git a/configs/targets/aarch64-bsd-user.mak b/configs/targets/aarch64-bsd-user.mak
index f99c73377a..7f42e06047 100644
--- a/configs/targets/aarch64-bsd-user.mak
+++ b/configs/targets/aarch64-bsd-user.mak
@@ -1,4 +1,4 @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-sme2.xml
 TARGET_LONG_BITS=64
diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
index b779ac3b4a..bf328b3b80 100644
--- a/configs/targets/aarch64-linux-user.mak
+++ b/configs/targets/aarch64-linux-user.mak
@@ -1,6 +1,6 @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml gdb-xml/aarch64-sme2.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
index 5dfeb35af9..d14bcfc490 100644
--- a/configs/targets/aarch64-softmmu.mak
+++ b/configs/targets/aarch64-softmmu.mak
@@ -1,7 +1,7 @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_KVM_HAVE_GUEST_DEBUG=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-sme2.xml
 # needed by boot.c
 TARGET_NEED_FDT=y
 TARGET_LONG_BITS=64
diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
index ef9be02290..284430add7 100644
--- a/configs/targets/aarch64_be-linux-user.mak
+++ b/configs/targets/aarch64_be-linux-user.mak
@@ -1,7 +1,7 @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_BIG_ENDIAN=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml gdb-xml/aarch64-mte.xml gdb-xml/aarch64-sme2.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/gdb-xml/aarch64-sme2.xml b/gdb-xml/aarch64-sme2.xml
new file mode 100644
index 0000000000..43911dae16
--- /dev/null
+++ b/gdb-xml/aarch64-sme2.xml
@@ -0,0 +1,14 @@
+<?xml version="1.0"?>
+<!-- Copyright (C) 2025 Linaro Ltd.
+
+     SPDX-License-Identifier: GPL-2.0-or-later
+
+     This is the SME2 ZT0 register. Upstream GDB dynamically generates
+     the XML for this feature, but because the vector is always 64 bytes
+     in size we prefer to use static XML for it.
+     -->
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.aarch64.sme2">
+  <vector id="sme2_bv" type="uint8" count="64"/>
+  <reg name="zt0" bitsize="512" type="sme2_bv"/>
+</feature>
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 8d2229f519..1ca3e647a8 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -554,6 +554,12 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                 arm_gen_dynamic_smereg_feature(cs, cs->gdb_num_regs);
             gdb_register_coprocessor(cs, aarch64_gdb_get_sme_reg,
                                      aarch64_gdb_set_sme_reg, sme_feature, 0);
+            if (isar_feature_aa64_sme2(&cpu->isar)) {
+                gdb_register_coprocessor(cs, aarch64_gdb_get_sme2_reg,
+                                         aarch64_gdb_set_sme2_reg,
+                                         gdb_find_static_feature("aarch64-sme2.xml"),
+                                         0);
+            }
         }
         /*
          * Note that we report pauth information via the feature name
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 65d6bbe65f..5ad00fe771 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -335,6 +335,58 @@ int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg)
     return 0;
 }
 
+int aarch64_gdb_get_sme2_reg(CPUState *cs, GByteArray *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    int len = 0;
+
+    switch (reg) {
+    case 0: /* ZT0 */
+        for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i += 2) {
+            len += gdb_get_reg128(buf, env->za_state.zt0[i + 1],
+                                  env->za_state.zt0[i]);
+        }
+        return len;
+    default:
+        /* gdbstub asked for something out of range */
+        qemu_log_mask(LOG_UNIMP, "%s: out of range register %d", __func__, reg);
+        break;
+    }
+
+    return 0;
+}
+
+int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    int len = 0;
+
+    switch (reg) {
+    case 0: /* ZT0 */
+        for (int i = 0; i < ARRAY_SIZE(env->za_state.zt0); i += 2) {
+            if (target_big_endian()) {
+                env->za_state.zt0[i + 1] = ldq_p(buf);
+                buf += 8;
+                env->za_state.zt0[i] = ldq_p(buf);
+            } else {
+                env->za_state.zt0[i] = ldq_p(buf);
+                buf += 8;
+                env->za_state.zt0[i + 1] = ldq_p(buf);
+            }
+            buf += 8;
+            len += 16;
+        }
+        return len;
+    default:
+        /* gdbstub asked for something out of range */
+        break;
+    }
+
+    return 0;
+}
+
 int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
diff --git a/target/arm/internals.h b/target/arm/internals.h
index a65386aaed..bf44066f71 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1720,6 +1720,8 @@ int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_sme_reg(CPUState *cs, uint8_t *buf, int reg);
+int aarch64_gdb_get_sme2_reg(CPUState *cs, GByteArray *buf, int reg);
+int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_fpu_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg);

From 7fd82461ddd41a27dfbbe83647810acaf6331ccc Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 16:30:26 +0100
Subject: [PATCH 1598/2396] target/arm: Implement org.gnu.gdb.aarch64.tls XML
 feature in gdbstub

GDB expects the TLS registers to be exposed via org.gnu.gdb.aarch64.tls,
which will contain either just "tpidr", or else "tpidr" and "tpidr2".

This will be important for SME in future, because the lazy state
restoration scheme requires GDB to use the TPIDR2 information.
GDB doesn't currently implement that, but we should provide the
register via the XML so that we are ready when future GDB versions
support it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251017153027.969016-3-peter.maydell@linaro.org
---
 target/arm/cpu.h       |  1 +
 target/arm/gdbstub.c   |  6 ++++
 target/arm/gdbstub64.c | 63 ++++++++++++++++++++++++++++++++++++++++++
 target/arm/internals.h |  3 ++
 4 files changed, 73 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index 7c226a112d..39f2b2e54d 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -943,6 +943,7 @@ struct ArchCPU {
     DynamicGDBFeatureInfo dyn_smereg_feature;
     DynamicGDBFeatureInfo dyn_m_systemreg_feature;
     DynamicGDBFeatureInfo dyn_m_secextreg_feature;
+    DynamicGDBFeatureInfo dyn_tls_feature;
 
     /* Timers used by the generic (architected) timer */
     QEMUTimer *gt_timer[NUM_GTIMERS];
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index 1ca3e647a8..8865f27089 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -583,6 +583,12 @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      0);
         }
 #endif
+
+        /* All AArch64 CPUs have at least TPIDR */
+        gdb_register_coprocessor(cs, aarch64_gdb_get_tls_reg,
+                                 aarch64_gdb_set_tls_reg,
+                                 arm_gen_dynamic_tls_feature(cs, cs->gdb_num_regs),
+                                 0);
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index 5ad00fe771..3bc7ff45d5 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -387,6 +387,44 @@ int aarch64_gdb_set_sme2_reg(CPUState *cs, uint8_t *buf, int reg)
     return 0;
 }
 
+int aarch64_gdb_get_tls_reg(CPUState *cs, GByteArray *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    switch (reg) {
+    case 0: /* TPIDR_EL0 */
+        return gdb_get_reg64(buf, env->cp15.tpidr_el[0]);
+    case 1: /* TPIDR2_EL0 */
+        return gdb_get_reg64(buf, env->cp15.tpidr2_el0);
+    default:
+        /* gdbstub asked for something out of range */
+        break;
+    }
+
+    return 0;
+}
+
+int aarch64_gdb_set_tls_reg(CPUState *cs, uint8_t *buf, int reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+
+    switch (reg) {
+    case 0: /* TPIDR_EL0 */
+        env->cp15.tpidr_el[0] = ldq_p(buf);
+        return 8;
+    case 1: /* TPIDR2_EL0 */
+        env->cp15.tpidr2_el0 = ldq_p(buf);
+        return 8;
+    default:
+        /* gdbstub asked for something out of range */
+        break;
+    }
+
+    return 0;
+}
+
 int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -586,6 +624,31 @@ GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cs, int base_reg)
     return &cpu->dyn_smereg_feature.desc;
 }
 
+GDBFeature *arm_gen_dynamic_tls_feature(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GDBFeatureBuilder builder;
+    int reg = 0;
+
+    gdb_feature_builder_init(&builder, &cpu->dyn_tls_feature.desc,
+                             "org.gnu.gdb.aarch64.tls", "tls-registers.xml",
+                             base_reg);
+
+    /*
+     * This feature must always have "tpidr", and may also have "tpidr2"
+     * if the CPU has that register.
+     */
+    gdb_feature_builder_append_reg(&builder, "tpidr", 64,
+                                   reg++, "data_ptr", NULL);
+    if (cpu_isar_feature(aa64_sme, cpu)) {
+        gdb_feature_builder_append_reg(&builder, "tpidr2", 64,
+                                       reg++, "data_ptr", NULL);
+    }
+    gdb_feature_builder_end(&builder);
+
+    return &cpu->dyn_tls_feature.desc;
+}
+
 #ifdef CONFIG_USER_ONLY
 int aarch64_gdb_get_tag_ctl_reg(CPUState *cs, GByteArray *buf, int reg)
 {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index bf44066f71..f86f421a3d 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -1716,6 +1716,7 @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 
 GDBFeature *arm_gen_dynamic_svereg_feature(CPUState *cpu, int base_reg);
 GDBFeature *arm_gen_dynamic_smereg_feature(CPUState *cpu, int base_reg);
+GDBFeature *arm_gen_dynamic_tls_feature(CPUState *cpu, int base_reg);
 int aarch64_gdb_get_sve_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_sme_reg(CPUState *cs, GByteArray *buf, int reg);
@@ -1728,6 +1729,8 @@ int aarch64_gdb_get_pauth_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_pauth_reg(CPUState *cs, uint8_t *buf, int reg);
 int aarch64_gdb_get_tag_ctl_reg(CPUState *cs, GByteArray *buf, int reg);
 int aarch64_gdb_set_tag_ctl_reg(CPUState *cs, uint8_t *buf, int reg);
+int aarch64_gdb_get_tls_reg(CPUState *cs, GByteArray *buf, int reg);
+int aarch64_gdb_set_tls_reg(CPUState *cs, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);

From caa0e960979eada7518eeadc3757a0d2fb9765f6 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 16:30:27 +0100
Subject: [PATCH 1599/2396] tests/tcg/aarch64: Add test case for SME2 gdbstub
 registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test the SME2 register exposure over gdbstub, in the same way
we already do for SME.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251017153027.969016-4-peter.maydell@linaro.org
---
 tests/tcg/aarch64/Makefile.target      |  9 ++++++-
 tests/tcg/aarch64/gdbstub/test-sme2.py | 36 ++++++++++++++++++++++++++
 2 files changed, 44 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/aarch64/gdbstub/test-sme2.py

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index 55ce34e45e..9fa8687453 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -164,7 +164,14 @@ run-gdbstub-sysregs-sme-tile-slice: sysregs
 	"selected gdb ($(GDB)) does not support SME ZA tile slices")
 endif
 
-EXTRA_RUNS += run-gdbstub-sysregs-sme run-gdbstub-sysregs-sme-tile-slice
+run-gdbstub-sysregs-sme2: sysregs
+	$(call run-test, $@, $(GDB_SCRIPT) \
+		--gdb $(GDB) \
+		--qemu $(QEMU) --qargs "$(QEMU_OPTS)" \
+		--bin $< --test $(AARCH64_SRC)/gdbstub/test-sme2.py, \
+	gdbstub SME ZA tile slice support)
+
+EXTRA_RUNS += run-gdbstub-sysregs-sme run-gdbstub-sysregs-sme-tile-slice run-gdbstub-sysregs-sme2
 
 endif
 
diff --git a/tests/tcg/aarch64/gdbstub/test-sme2.py b/tests/tcg/aarch64/gdbstub/test-sme2.py
new file mode 100644
index 0000000000..74a045febf
--- /dev/null
+++ b/tests/tcg/aarch64/gdbstub/test-sme2.py
@@ -0,0 +1,36 @@
+#
+# Copyright (C) 2025 Linaro Ltd.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+#
+# Test the SME2 registers are visible and changeable via gdbstub
+#
+# This is launched via tests/guest-debug/run-test.py
+#
+
+import gdb
+from test_gdbstub import main, report
+
+
+def run_test():
+    """Test reads and writes of the SME2 registers"""
+    frame = gdb.selected_frame()
+    rname = "zt0"
+    zt0 = frame.read_register(rname)
+    report(True, "Reading %s" % rname)
+
+    # Writing to the ZT0 register, byte by byte.
+    for i in range(0, 64):
+        cmd = "set $zt0[%d] = 0x01" % (i)
+        gdb.execute(cmd)
+        report(True, "%s" % cmd)
+
+    # Reading from the ZT0 register, byte by byte.
+    for i in range(0, 64):
+        reg = "$zt0[%d]" % (i)
+        v = gdb.parse_and_eval(reg)
+        report(str(v.type) == "uint8_t", "size of %s" % (reg))
+        report(v == 0x1, "%s is 0x%x" % (reg, 0x1))
+
+main(run_test, expected_arch="aarch64")

From 33eff5c84d52e7186e0882ea5ee9ac5501c3deea Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 16 Oct 2025 15:54:07 +0100
Subject: [PATCH 1600/2396] hw/net/rocker: Don't overflow in
 of_dpa_mask2prefix()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In of_dpa_mask2prefix() we do "(2 << i)" for a loop where i can go up
to 31.  At i == 31 we shift off the top end of an integer.  This
doesn't actually calculate the wrong value in practice, because we
calculate 0 - 1 which is the 0xffffffff mask we wanted (and for QEMU
shifting off the top of a signed integer is not UB); but it makes
Coverity complain.

We could fix this simply by using "2ULL" (where the "(2ULL << i) - 1"
expression also evaluates to 0xffffffff for i == 31), but in fact
this function is a slow looping implementation of counting the number
of trailing zeroes in the (network-order) input mask:

 0bxxxxxxxxx1 => 32
 0bxxxxxxxx10 => 31
 0bxxxxxxx100 => 30
 ...
 0bx100000000 => 2
 0b1000000000 => 1
 0b0000000000 => 0

Replace the implementation with 32 - ctz32().

Coverity: CID 1547602
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251016145407.781978-1-peter.maydell@linaro.org
---
 hw/net/rocker/rocker_of_dpa.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/net/rocker/rocker_of_dpa.c b/hw/net/rocker/rocker_of_dpa.c
index 4aed178756..16b9bc7a4b 100644
--- a/hw/net/rocker/rocker_of_dpa.c
+++ b/hw/net/rocker/rocker_of_dpa.c
@@ -198,16 +198,7 @@ typedef struct of_dpa_group {
 
 static int of_dpa_mask2prefix(uint32_t mask)
 {
-    int i;
-    int count = 32;
-
-    for (i = 0; i < 32; i++) {
-        if (!(ntohl(mask) & ((2 << i) - 1))) {
-            count--;
-        }
-    }
-
-    return count;
+    return 32 - ctz32(ntohl(mask));
 }
 
 #if defined(DEBUG_ROCKER)

From e41139eaad1d6ea7c52b8ebb5def2dcb84ff57e1 Mon Sep 17 00:00:00 2001
From: Zejun Zhao <jelly.zhao.42@gmail.com>
Date: Mon, 13 Oct 2025 21:32:42 +0800
Subject: [PATCH 1601/2396] hw/riscv: Correct mmu-type property of sifive_u
 harts in device tree

Correct mmu-type property of sifive_u harts from Sv48 to Sv39 in 64-bit
mode since it's the only supported SATP mode.

Signed-off-by: Zejun Zhao <jelly.zhao.42@gmail.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251013133242.1945681-1-jelly.zhao.42@gmail.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 hw/riscv/sifive_u.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index d69f942cfb..3e1ed209ca 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -176,7 +176,7 @@ static void create_fdt(SiFiveUState *s, const MemMapEntry *memmap,
             if (is_32_bit) {
                 qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv32");
             } else {
-                qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv48");
+                qemu_fdt_setprop_string(fdt, nodename, "mmu-type", "riscv,sv39");
             }
             riscv_isa_write_fdt(&s->soc.u_cpus.harts[cpu - 1], fdt, nodename);
         } else {

From 73ae67fd4e655021290abf7ccffd622e6e23ebab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:33 +0200
Subject: [PATCH 1602/2396] target/riscv: Explode MO_TExx -> MO_TE | MO_xx
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Extract the implicit MO_TE definition in order to replace
it in the next commit.

Mechanical change using:

  $ for n in UW UL UQ UO SW SL SQ; do \
      sed -i -e "s/MO_TE$n/MO_TE | MO_$n/" \
           $(git grep -l MO_TE$n target/hexagon); \
    done

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-3-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rva.c.inc       | 44 ++++-----
 target/riscv/insn_trans/trans_rvd.c.inc       |  4 +-
 target/riscv/insn_trans/trans_rvf.c.inc       |  4 +-
 target/riscv/insn_trans/trans_rvi.c.inc       | 22 ++---
 target/riscv/insn_trans/trans_rvzabha.c.inc   | 20 ++---
 target/riscv/insn_trans/trans_rvzacas.c.inc   |  8 +-
 target/riscv/insn_trans/trans_rvzce.c.inc     | 10 +--
 target/riscv/insn_trans/trans_rvzfh.c.inc     |  4 +-
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  4 +-
 target/riscv/insn_trans/trans_xthead.c.inc    | 90 +++++++++----------
 target/riscv/op_helper.c                      | 16 ++--
 11 files changed, 113 insertions(+), 113 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
index 9cf3ae8019..10e4c55efd 100644
--- a/target/riscv/insn_trans/trans_rva.c.inc
+++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -99,142 +99,142 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
 static bool trans_lr_w(DisasContext *ctx, arg_lr_w *a)
 {
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_lr(ctx, a, (MO_ALIGN | MO_TESL));
+    return gen_lr(ctx, a, (MO_ALIGN | MO_TE | MO_SL));
 }
 
 static bool trans_sc_w(DisasContext *ctx, arg_sc_w *a)
 {
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_sc(ctx, a, (MO_ALIGN | MO_TESL));
+    return gen_sc(ctx, a, (MO_ALIGN | MO_TE | MO_SL));
 }
 
 static bool trans_amoswap_w(DisasContext *ctx, arg_amoswap_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amoadd_w(DisasContext *ctx, arg_amoadd_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amoxor_w(DisasContext *ctx, arg_amoxor_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amoand_w(DisasContext *ctx, arg_amoand_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amoor_w(DisasContext *ctx, arg_amoor_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amomin_w(DisasContext *ctx, arg_amomin_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amomax_w(DisasContext *ctx, arg_amomax_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amominu_w(DisasContext *ctx, arg_amominu_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_SL);
 }
 
 static bool trans_amomaxu_w(DisasContext *ctx, arg_amomaxu_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TESL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_SL);
 }
 
 static bool trans_lr_d(DisasContext *ctx, arg_lr_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_lr(ctx, a, MO_ALIGN | MO_TEUQ);
+    return gen_lr(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
 }
 
 static bool trans_sc_d(DisasContext *ctx, arg_sc_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_sc(ctx, a, (MO_ALIGN | MO_TEUQ));
+    return gen_sc(ctx, a, (MO_ALIGN | MO_TE | MO_UQ));
 }
 
 static bool trans_amoswap_d(DisasContext *ctx, arg_amoswap_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amoadd_d(DisasContext *ctx, arg_amoadd_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amoxor_d(DisasContext *ctx, arg_amoxor_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amoand_d(DisasContext *ctx, arg_amoand_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amoor_d(DisasContext *ctx, arg_amoor_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amomin_d(DisasContext *ctx, arg_amomin_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amomax_d(DisasContext *ctx, arg_amomax_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amominu_d(DisasContext *ctx, arg_amominu_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_UQ);
 }
 
 static bool trans_amomaxu_d(DisasContext *ctx, arg_amomaxu_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TEUQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_UQ);
 }
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 30883ea37c..3385820678 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -42,7 +42,7 @@
 static bool trans_fld(DisasContext *ctx, arg_fld *a)
 {
     TCGv addr;
-    MemOp memop = MO_TEUQ;
+    MemOp memop = MO_TE | MO_UQ;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
@@ -72,7 +72,7 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
 static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
 {
     TCGv addr;
-    MemOp memop = MO_TEUQ;
+    MemOp memop = MO_TE | MO_UQ;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index ed73afe089..150e2b9a7d 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -43,7 +43,7 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
 {
     TCGv_i64 dest;
     TCGv addr;
-    MemOp memop = MO_TEUL;
+    MemOp memop = MO_TE | MO_UL;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
@@ -65,7 +65,7 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
 static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
 {
     TCGv addr;
-    MemOp memop = MO_TEUL;
+    MemOp memop = MO_TE | MO_UL;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index b9c7160468..34012caf1e 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -426,24 +426,24 @@ static bool trans_lb(DisasContext *ctx, arg_lb *a)
 
 static bool trans_lh(DisasContext *ctx, arg_lh *a)
 {
-    return gen_load(ctx, a, MO_TESW);
+    return gen_load(ctx, a, MO_TE | MO_SW);
 }
 
 static bool trans_lw(DisasContext *ctx, arg_lw *a)
 {
-    return gen_load(ctx, a, MO_TESL);
+    return gen_load(ctx, a, MO_TE | MO_SL);
 }
 
 static bool trans_ld(DisasContext *ctx, arg_ld *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_load(ctx, a, MO_TESQ);
+    return gen_load(ctx, a, MO_TE | MO_SQ);
 }
 
 static bool trans_lq(DisasContext *ctx, arg_lq *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_load(ctx, a, MO_TEUO);
+    return gen_load(ctx, a, MO_TE | MO_UO);
 }
 
 static bool trans_lbu(DisasContext *ctx, arg_lbu *a)
@@ -453,19 +453,19 @@ static bool trans_lbu(DisasContext *ctx, arg_lbu *a)
 
 static bool trans_lhu(DisasContext *ctx, arg_lhu *a)
 {
-    return gen_load(ctx, a, MO_TEUW);
+    return gen_load(ctx, a, MO_TE | MO_UW);
 }
 
 static bool trans_lwu(DisasContext *ctx, arg_lwu *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_load(ctx, a, MO_TEUL);
+    return gen_load(ctx, a, MO_TE | MO_UL);
 }
 
 static bool trans_ldu(DisasContext *ctx, arg_ldu *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_load(ctx, a, MO_TEUQ);
+    return gen_load(ctx, a, MO_TE | MO_UQ);
 }
 
 static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
@@ -521,24 +521,24 @@ static bool trans_sb(DisasContext *ctx, arg_sb *a)
 
 static bool trans_sh(DisasContext *ctx, arg_sh *a)
 {
-    return gen_store(ctx, a, MO_TESW);
+    return gen_store(ctx, a, MO_TE | MO_SW);
 }
 
 static bool trans_sw(DisasContext *ctx, arg_sw *a)
 {
-    return gen_store(ctx, a, MO_TESL);
+    return gen_store(ctx, a, MO_TE | MO_SL);
 }
 
 static bool trans_sd(DisasContext *ctx, arg_sd *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_store(ctx, a, MO_TEUQ);
+    return gen_store(ctx, a, MO_TE | MO_UQ);
 }
 
 static bool trans_sq(DisasContext *ctx, arg_sq *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_store(ctx, a, MO_TEUO);
+    return gen_store(ctx, a, MO_TE | MO_UO);
 }
 
 static bool trans_addd(DisasContext *ctx, arg_addd *a)
diff --git a/target/riscv/insn_trans/trans_rvzabha.c.inc b/target/riscv/insn_trans/trans_rvzabha.c.inc
index ce8edcba62..25db42d24c 100644
--- a/target/riscv/insn_trans/trans_rvzabha.c.inc
+++ b/target/riscv/insn_trans/trans_rvzabha.c.inc
@@ -79,55 +79,55 @@ static bool trans_amomaxu_b(DisasContext *ctx, arg_amomaxu_b *a)
 static bool trans_amoswap_h(DisasContext *ctx, arg_amoswap_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amoadd_h(DisasContext *ctx, arg_amoadd_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amoxor_h(DisasContext *ctx, arg_amoxor_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amoand_h(DisasContext *ctx, arg_amoand_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amoor_h(DisasContext *ctx, arg_amoor_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amomin_h(DisasContext *ctx, arg_amomin_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amomax_h(DisasContext *ctx, arg_amomax_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amominu_h(DisasContext *ctx, arg_amominu_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amomaxu_h(DisasContext *ctx, arg_amomaxu_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TESW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_SW);
 }
 
 static bool trans_amocas_b(DisasContext *ctx, arg_amocas_b *a)
@@ -141,5 +141,5 @@ static bool trans_amocas_h(DisasContext *ctx, arg_amocas_h *a)
 {
     REQUIRE_ZACAS(ctx);
     REQUIRE_ZABHA(ctx);
-    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESW);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_SW);
 }
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
index 15e688a033..5e7c7c92b7 100644
--- a/target/riscv/insn_trans/trans_rvzacas.c.inc
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -25,7 +25,7 @@
 static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
 {
     REQUIRE_ZACAS(ctx);
-    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TESL);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_SL);
 }
 
 static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
@@ -88,10 +88,10 @@ static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
     REQUIRE_ZACAS(ctx);
     switch (get_ol(ctx)) {
     case MXL_RV32:
-        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TEUQ);
+        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
     case MXL_RV64:
     case MXL_RV128:
-        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TEUQ);
+        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
     default:
         g_assert_not_reached();
     }
@@ -123,7 +123,7 @@ static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
     tcg_gen_concat_i64_i128(dest, destl, desth);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
-                                (MO_ALIGN | MO_TEUO));
+                                (MO_ALIGN | MO_TE | MO_UO));
 
     tcg_gen_extr_i128_i64(destl, desth, dest);
 
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index dd15af0f54..d130179432 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -88,13 +88,13 @@ static bool trans_c_lbu(DisasContext *ctx, arg_c_lbu *a)
 static bool trans_c_lhu(DisasContext *ctx, arg_c_lhu *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_TEUW);
+    return gen_load(ctx, a, MO_TE | MO_UW);
 }
 
 static bool trans_c_lh(DisasContext *ctx, arg_c_lh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_TESW);
+    return gen_load(ctx, a, MO_TE | MO_SW);
 }
 
 static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
@@ -106,7 +106,7 @@ static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
 static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_store(ctx, a, MO_TEUW);
+    return gen_store(ctx, a, MO_TE | MO_UW);
 }
 
 #define X_S0    8
@@ -175,7 +175,7 @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
         return false;
     }
 
-    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TE | MO_UL : MO_TE | MO_UQ;
     int reg_size = memop_size(memop);
     target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
                              a->spimm;
@@ -228,7 +228,7 @@ static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
         return false;
     }
 
-    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TEUL : MO_TEUQ;
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TE | MO_UL : MO_TE | MO_UQ;
     int reg_size = memop_size(memop);
     target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
                              a->spimm;
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index bece48e600..eec478afcb 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -57,7 +57,7 @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     }
 
     dest = cpu_fpr[a->rd];
-    tcg_gen_qemu_ld_i64(dest, t0, ctx->mem_idx, MO_TEUW);
+    tcg_gen_qemu_ld_i64(dest, t0, ctx->mem_idx, MO_TE | MO_UW);
     gen_nanbox_h(dest, dest);
 
     mark_fs_dirty(ctx);
@@ -79,7 +79,7 @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
         t0 = temp;
     }
 
-    tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], t0, ctx->mem_idx, MO_TEUW);
+    tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], t0, ctx->mem_idx, MO_TE | MO_UW);
 
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index f4a1c12ca0..c555596617 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -105,7 +105,7 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
     src1 = get_address(ctx, a->rs1, 0);
 
     tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx),
-                           (MO_ALIGN | MO_TESL));
+                           (MO_ALIGN | MO_TE | MO_SL));
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -134,7 +134,7 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
     src1 = get_address(ctx, a->rs1, 0);
 
     tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx),
-                           (MO_ALIGN | MO_TESQ));
+                           (MO_ALIGN | MO_TE | MO_SQ));
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 22488412d4..754cb80e22 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -379,7 +379,7 @@ static bool trans_th_flrd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fload_idx(ctx, a, MO_TEUQ, false);
+    return gen_fload_idx(ctx, a, MO_TE | MO_UQ, false);
 }
 
 static bool trans_th_flrw(DisasContext *ctx, arg_th_memidx *a)
@@ -387,7 +387,7 @@ static bool trans_th_flrw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fload_idx(ctx, a, MO_TEUL, false);
+    return gen_fload_idx(ctx, a, MO_TE | MO_UL, false);
 }
 
 static bool trans_th_flurd(DisasContext *ctx, arg_th_memidx *a)
@@ -395,7 +395,7 @@ static bool trans_th_flurd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fload_idx(ctx, a, MO_TEUQ, true);
+    return gen_fload_idx(ctx, a, MO_TE | MO_UQ, true);
 }
 
 static bool trans_th_flurw(DisasContext *ctx, arg_th_memidx *a)
@@ -403,7 +403,7 @@ static bool trans_th_flurw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fload_idx(ctx, a, MO_TEUL, true);
+    return gen_fload_idx(ctx, a, MO_TE | MO_UL, true);
 }
 
 static bool trans_th_fsrd(DisasContext *ctx, arg_th_memidx *a)
@@ -411,7 +411,7 @@ static bool trans_th_fsrd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fstore_idx(ctx, a, MO_TEUQ, false);
+    return gen_fstore_idx(ctx, a, MO_TE | MO_UQ, false);
 }
 
 static bool trans_th_fsrw(DisasContext *ctx, arg_th_memidx *a)
@@ -419,7 +419,7 @@ static bool trans_th_fsrw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fstore_idx(ctx, a, MO_TEUL, false);
+    return gen_fstore_idx(ctx, a, MO_TE | MO_UL, false);
 }
 
 static bool trans_th_fsurd(DisasContext *ctx, arg_th_memidx *a)
@@ -427,7 +427,7 @@ static bool trans_th_fsurd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fstore_idx(ctx, a, MO_TEUQ, true);
+    return gen_fstore_idx(ctx, a, MO_TE | MO_UQ, true);
 }
 
 static bool trans_th_fsurw(DisasContext *ctx, arg_th_memidx *a)
@@ -435,7 +435,7 @@ static bool trans_th_fsurw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fstore_idx(ctx, a, MO_TEUL, true);
+    return gen_fstore_idx(ctx, a, MO_TE | MO_UL, true);
 }
 
 /* XTheadFmv */
@@ -598,64 +598,64 @@ static bool trans_th_ldia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TESQ, false);
+    return gen_load_inc(ctx, a, MO_TE | MO_SQ, false);
 }
 
 static bool trans_th_ldib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TESQ, true);
+    return gen_load_inc(ctx, a, MO_TE | MO_SQ, true);
 }
 
 static bool trans_th_lwia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TESL, false);
+    return gen_load_inc(ctx, a, MO_TE | MO_SL, false);
 }
 
 static bool trans_th_lwib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TESL, true);
+    return gen_load_inc(ctx, a, MO_TE | MO_SL, true);
 }
 
 static bool trans_th_lwuia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TEUL, false);
+    return gen_load_inc(ctx, a, MO_TE | MO_UL, false);
 }
 
 static bool trans_th_lwuib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TEUL, true);
+    return gen_load_inc(ctx, a, MO_TE | MO_UL, true);
 }
 
 static bool trans_th_lhia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TESW, false);
+    return gen_load_inc(ctx, a, MO_TE | MO_SW, false);
 }
 
 static bool trans_th_lhib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TESW, true);
+    return gen_load_inc(ctx, a, MO_TE | MO_SW, true);
 }
 
 static bool trans_th_lhuia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TEUW, false);
+    return gen_load_inc(ctx, a, MO_TE | MO_UW, false);
 }
 
 static bool trans_th_lhuib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TEUW, true);
+    return gen_load_inc(ctx, a, MO_TE | MO_UW, true);
 }
 
 static bool trans_th_lbia(DisasContext *ctx, arg_th_meminc *a)
@@ -686,38 +686,38 @@ static bool trans_th_sdia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_inc(ctx, a, MO_TESQ, false);
+    return gen_store_inc(ctx, a, MO_TE | MO_SQ, false);
 }
 
 static bool trans_th_sdib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_inc(ctx, a, MO_TESQ, true);
+    return gen_store_inc(ctx, a, MO_TE | MO_SQ, true);
 }
 
 static bool trans_th_swia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TESL, false);
+    return gen_store_inc(ctx, a, MO_TE | MO_SL, false);
 }
 
 static bool trans_th_swib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TESL, true);
+    return gen_store_inc(ctx, a, MO_TE | MO_SL, true);
 }
 
 static bool trans_th_shia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TESW, false);
+    return gen_store_inc(ctx, a, MO_TE | MO_SW, false);
 }
 
 static bool trans_th_shib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TESW, true);
+    return gen_store_inc(ctx, a, MO_TE | MO_SW, true);
 }
 
 static bool trans_th_sbia(DisasContext *ctx, arg_th_meminc *a)
@@ -769,32 +769,32 @@ static bool trans_th_lrd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TESQ, false);
+    return gen_load_idx(ctx, a, MO_TE | MO_SQ, false);
 }
 
 static bool trans_th_lrw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TESL, false);
+    return gen_load_idx(ctx, a, MO_TE | MO_SL, false);
 }
 
 static bool trans_th_lrwu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TEUL, false);
+    return gen_load_idx(ctx, a, MO_TE | MO_UL, false);
 }
 
 static bool trans_th_lrh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TESW, false);
+    return gen_load_idx(ctx, a, MO_TE | MO_SW, false);
 }
 
 static bool trans_th_lrhu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TEUW, false);
+    return gen_load_idx(ctx, a, MO_TE | MO_UW, false);
 }
 
 static bool trans_th_lrb(DisasContext *ctx, arg_th_memidx *a)
@@ -813,19 +813,19 @@ static bool trans_th_srd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_idx(ctx, a, MO_TESQ, false);
+    return gen_store_idx(ctx, a, MO_TE | MO_SQ, false);
 }
 
 static bool trans_th_srw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TESL, false);
+    return gen_store_idx(ctx, a, MO_TE | MO_SL, false);
 }
 
 static bool trans_th_srh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TESW, false);
+    return gen_store_idx(ctx, a, MO_TE | MO_SW, false);
 }
 
 static bool trans_th_srb(DisasContext *ctx, arg_th_memidx *a)
@@ -837,32 +837,32 @@ static bool trans_th_lurd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TESQ, true);
+    return gen_load_idx(ctx, a, MO_TE | MO_SQ, true);
 }
 
 static bool trans_th_lurw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TESL, true);
+    return gen_load_idx(ctx, a, MO_TE | MO_SL, true);
 }
 
 static bool trans_th_lurwu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TEUL, true);
+    return gen_load_idx(ctx, a, MO_TE | MO_UL, true);
 }
 
 static bool trans_th_lurh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TESW, true);
+    return gen_load_idx(ctx, a, MO_TE | MO_SW, true);
 }
 
 static bool trans_th_lurhu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TEUW, true);
+    return gen_load_idx(ctx, a, MO_TE | MO_UW, true);
 }
 
 static bool trans_th_lurb(DisasContext *ctx, arg_th_memidx *a)
@@ -881,19 +881,19 @@ static bool trans_th_surd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_idx(ctx, a, MO_TESQ, true);
+    return gen_store_idx(ctx, a, MO_TE | MO_SQ, true);
 }
 
 static bool trans_th_surw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TESL, true);
+    return gen_store_idx(ctx, a, MO_TE | MO_SL, true);
 }
 
 static bool trans_th_surh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TESW, true);
+    return gen_store_idx(ctx, a, MO_TE | MO_SW, true);
 }
 
 static bool trans_th_surb(DisasContext *ctx, arg_th_memidx *a)
@@ -931,19 +931,19 @@ static bool trans_th_ldd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TESQ, 4);
+    return gen_loadpair_tl(ctx, a, MO_TE | MO_SQ, 4);
 }
 
 static bool trans_th_lwd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TESL, 3);
+    return gen_loadpair_tl(ctx, a, MO_TE | MO_SL, 3);
 }
 
 static bool trans_th_lwud(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TEUL, 3);
+    return gen_loadpair_tl(ctx, a, MO_TE | MO_UL, 3);
 }
 
 static bool gen_storepair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
@@ -967,13 +967,13 @@ static bool trans_th_sdd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_storepair_tl(ctx, a, MO_TESQ, 4);
+    return gen_storepair_tl(ctx, a, MO_TE | MO_SQ, 4);
 }
 
 static bool trans_th_swd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_storepair_tl(ctx, a, MO_TESL, 3);
+    return gen_storepair_tl(ctx, a, MO_TE | MO_SL, 3);
 }
 
 /* XTheadSync */
diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index 8382aa94cb..c486f771d3 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -633,7 +633,7 @@ target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
 
     return cpu_ldw_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -642,7 +642,7 @@ target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
 
     return cpu_ldl_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -651,7 +651,7 @@ target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UQ, mmu_idx);
 
     return cpu_ldq_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -669,7 +669,7 @@ void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
 
     cpu_stw_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -678,7 +678,7 @@ void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
 
     cpu_stl_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -687,7 +687,7 @@ void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUQ, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UQ, mmu_idx);
 
     cpu_stq_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -703,7 +703,7 @@ target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, true, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
 
     return cpu_ldw_code_mmu(env, addr, oi, GETPC());
 }
@@ -712,7 +712,7 @@ target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, true, ra);
-    MemOpIdx oi = make_memop_idx(MO_TEUL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
 
     return cpu_ldl_code_mmu(env, addr, oi, ra);
 }

From cb2725db0cc314242dd8315823c90057e1b4e1ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:34 +0200
Subject: [PATCH 1603/2396] target/riscv: Conceal MO_TE within gen_amo()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_amo() set the MO_TE flag. Set it once in
the callee.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-4-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rva.c.inc     | 36 ++++++++++-----------
 target/riscv/insn_trans/trans_rvzabha.c.inc | 18 +++++------
 target/riscv/translate.c                    |  1 +
 3 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
index 10e4c55efd..e0fbfafdde 100644
--- a/target/riscv/insn_trans/trans_rva.c.inc
+++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -111,55 +111,55 @@ static bool trans_sc_w(DisasContext *ctx, arg_sc_w *a)
 static bool trans_amoswap_w(DisasContext *ctx, arg_amoswap_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_SL);
 }
 
 static bool trans_amoadd_w(DisasContext *ctx, arg_amoadd_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_SL);
 }
 
 static bool trans_amoxor_w(DisasContext *ctx, arg_amoxor_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_SL);
 }
 
 static bool trans_amoand_w(DisasContext *ctx, arg_amoand_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_SL);
 }
 
 static bool trans_amoor_w(DisasContext *ctx, arg_amoor_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_SL);
 }
 
 static bool trans_amomin_w(DisasContext *ctx, arg_amomin_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_SL);
 }
 
 static bool trans_amomax_w(DisasContext *ctx, arg_amomax_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_SL);
 }
 
 static bool trans_amominu_w(DisasContext *ctx, arg_amominu_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_SL);
 }
 
 static bool trans_amomaxu_w(DisasContext *ctx, arg_amomaxu_w *a)
 {
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_SL);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_SL);
 }
 
 static bool trans_lr_d(DisasContext *ctx, arg_lr_d *a)
@@ -180,61 +180,61 @@ static bool trans_amoswap_d(DisasContext *ctx, arg_amoswap_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_UQ);
 }
 
 static bool trans_amoadd_d(DisasContext *ctx, arg_amoadd_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_UQ);
 }
 
 static bool trans_amoxor_d(DisasContext *ctx, arg_amoxor_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_UQ);
 }
 
 static bool trans_amoand_d(DisasContext *ctx, arg_amoand_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_UQ);
 }
 
 static bool trans_amoor_d(DisasContext *ctx, arg_amoor_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_UQ);
 }
 
 static bool trans_amomin_d(DisasContext *ctx, arg_amomin_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_UQ);
 }
 
 static bool trans_amomax_d(DisasContext *ctx, arg_amomax_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_UQ);
 }
 
 static bool trans_amominu_d(DisasContext *ctx, arg_amominu_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_UQ);
 }
 
 static bool trans_amomaxu_d(DisasContext *ctx, arg_amomaxu_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZAAMO(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_UQ);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_UQ);
 }
diff --git a/target/riscv/insn_trans/trans_rvzabha.c.inc b/target/riscv/insn_trans/trans_rvzabha.c.inc
index 25db42d24c..c1f99b65f0 100644
--- a/target/riscv/insn_trans/trans_rvzabha.c.inc
+++ b/target/riscv/insn_trans/trans_rvzabha.c.inc
@@ -79,55 +79,55 @@ static bool trans_amomaxu_b(DisasContext *ctx, arg_amomaxu_b *a)
 static bool trans_amoswap_h(DisasContext *ctx, arg_amoswap_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_xchg_tl, MO_SW);
 }
 
 static bool trans_amoadd_h(DisasContext *ctx, arg_amoadd_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_add_tl, MO_SW);
 }
 
 static bool trans_amoxor_h(DisasContext *ctx, arg_amoxor_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_xor_tl, MO_SW);
 }
 
 static bool trans_amoand_h(DisasContext *ctx, arg_amoand_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_and_tl, MO_SW);
 }
 
 static bool trans_amoor_h(DisasContext *ctx, arg_amoor_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_or_tl, MO_SW);
 }
 
 static bool trans_amomin_h(DisasContext *ctx, arg_amomin_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smin_tl, MO_SW);
 }
 
 static bool trans_amomax_h(DisasContext *ctx, arg_amomax_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_smax_tl, MO_SW);
 }
 
 static bool trans_amominu_h(DisasContext *ctx, arg_amominu_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umin_tl, MO_SW);
 }
 
 static bool trans_amomaxu_h(DisasContext *ctx, arg_amomaxu_h *a)
 {
     REQUIRE_ZABHA(ctx);
-    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_TE | MO_SW);
+    return gen_amo(ctx, a, &tcg_gen_atomic_fetch_umax_tl, MO_SW);
 }
 
 static bool trans_amocas_b(DisasContext *ctx, arg_amocas_b *a)
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 9a53aecbfe..94af9853cf 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1135,6 +1135,7 @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a,
     TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE);
     MemOp size = mop & MO_SIZE;
 
+    mop |= MO_TE;
     if (ctx->cfg_ptr->ext_zama16b && size >= MO_32) {
         mop |= MO_ATOM_WITHIN16;
     } else {

From 133080735cf2e7b0aabdf164d766690b65eb5418 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:35 +0200
Subject: [PATCH 1604/2396] target/riscv: Conceal MO_TE within gen_inc()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_inc() set the MO_TE flag. Set it once in
the callee.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-5-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 34 ++++++++++++----------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 754cb80e22..7e69906e5b 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -568,6 +568,7 @@ static bool gen_load_inc(DisasContext *ctx, arg_th_meminc *a, MemOp memop,
     TCGv rd = dest_gpr(ctx, a->rd);
     TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
 
+    memop |= MO_TE;
     tcg_gen_qemu_ld_tl(rd, addr, ctx->mem_idx, memop);
     tcg_gen_addi_tl(rs1, rs1, imm);
     gen_set_gpr(ctx, a->rd, rd);
@@ -588,6 +589,7 @@ static bool gen_store_inc(DisasContext *ctx, arg_th_meminc *a, MemOp memop,
     TCGv data = get_gpr(ctx, a->rd, EXT_NONE);
     TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
 
+    memop |= MO_TE;
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
     tcg_gen_addi_tl(rs1, rs1, imm);
     gen_set_gpr(ctx, a->rs1, rs1);
@@ -598,64 +600,64 @@ static bool trans_th_ldia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SQ, false);
+    return gen_load_inc(ctx, a, MO_SQ, false);
 }
 
 static bool trans_th_ldib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SQ, true);
+    return gen_load_inc(ctx, a, MO_SQ, true);
 }
 
 static bool trans_th_lwia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SL, false);
+    return gen_load_inc(ctx, a, MO_SL, false);
 }
 
 static bool trans_th_lwib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SL, true);
+    return gen_load_inc(ctx, a, MO_SL, true);
 }
 
 static bool trans_th_lwuia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_UL, false);
+    return gen_load_inc(ctx, a, MO_UL, false);
 }
 
 static bool trans_th_lwuib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_UL, true);
+    return gen_load_inc(ctx, a, MO_UL, true);
 }
 
 static bool trans_th_lhia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SW, false);
+    return gen_load_inc(ctx, a, MO_SW, false);
 }
 
 static bool trans_th_lhib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_SW, true);
+    return gen_load_inc(ctx, a, MO_SW, true);
 }
 
 static bool trans_th_lhuia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_UW, false);
+    return gen_load_inc(ctx, a, MO_UW, false);
 }
 
 static bool trans_th_lhuib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_inc(ctx, a, MO_TE | MO_UW, true);
+    return gen_load_inc(ctx, a, MO_UW, true);
 }
 
 static bool trans_th_lbia(DisasContext *ctx, arg_th_meminc *a)
@@ -686,38 +688,38 @@ static bool trans_th_sdia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SQ, false);
+    return gen_store_inc(ctx, a, MO_SQ, false);
 }
 
 static bool trans_th_sdib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SQ, true);
+    return gen_store_inc(ctx, a, MO_SQ, true);
 }
 
 static bool trans_th_swia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SL, false);
+    return gen_store_inc(ctx, a, MO_SL, false);
 }
 
 static bool trans_th_swib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SL, true);
+    return gen_store_inc(ctx, a, MO_SL, true);
 }
 
 static bool trans_th_shia(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SW, false);
+    return gen_store_inc(ctx, a, MO_SW, false);
 }
 
 static bool trans_th_shib(DisasContext *ctx, arg_th_meminc *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_inc(ctx, a, MO_TE | MO_SW, true);
+    return gen_store_inc(ctx, a, MO_SW, true);
 }
 
 static bool trans_th_sbia(DisasContext *ctx, arg_th_meminc *a)

From 5ed09d6f7bf497f49d7ccfdfa664095dafa72c30 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:36 +0200
Subject: [PATCH 1605/2396] target/riscv: Conceal MO_TE within gen_load() /
 gen_store()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_load() / gen_store() set the MO_TE flag.
Set it once in the callees.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-6-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvi.c.inc   | 24 ++++++++++++-----------
 target/riscv/insn_trans/trans_rvzce.c.inc |  6 +++---
 2 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index 34012caf1e..9a03058f46 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -402,6 +402,7 @@ static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
 {
     bool out;
 
+    memop |= MO_TE;
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
@@ -426,24 +427,24 @@ static bool trans_lb(DisasContext *ctx, arg_lb *a)
 
 static bool trans_lh(DisasContext *ctx, arg_lh *a)
 {
-    return gen_load(ctx, a, MO_TE | MO_SW);
+    return gen_load(ctx, a, MO_SW);
 }
 
 static bool trans_lw(DisasContext *ctx, arg_lw *a)
 {
-    return gen_load(ctx, a, MO_TE | MO_SL);
+    return gen_load(ctx, a, MO_SL);
 }
 
 static bool trans_ld(DisasContext *ctx, arg_ld *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_load(ctx, a, MO_TE | MO_SQ);
+    return gen_load(ctx, a, MO_SQ);
 }
 
 static bool trans_lq(DisasContext *ctx, arg_lq *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_load(ctx, a, MO_TE | MO_UO);
+    return gen_load(ctx, a, MO_UO);
 }
 
 static bool trans_lbu(DisasContext *ctx, arg_lbu *a)
@@ -453,19 +454,19 @@ static bool trans_lbu(DisasContext *ctx, arg_lbu *a)
 
 static bool trans_lhu(DisasContext *ctx, arg_lhu *a)
 {
-    return gen_load(ctx, a, MO_TE | MO_UW);
+    return gen_load(ctx, a, MO_UW);
 }
 
 static bool trans_lwu(DisasContext *ctx, arg_lwu *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_load(ctx, a, MO_TE | MO_UL);
+    return gen_load(ctx, a, MO_UL);
 }
 
 static bool trans_ldu(DisasContext *ctx, arg_ldu *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_load(ctx, a, MO_TE | MO_UQ);
+    return gen_load(ctx, a, MO_UQ);
 }
 
 static bool gen_store_tl(DisasContext *ctx, arg_sb *a, MemOp memop)
@@ -503,6 +504,7 @@ static bool gen_store_i128(DisasContext *ctx, arg_sb *a, MemOp memop)
 
 static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
+    memop |= MO_TE;
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
@@ -521,24 +523,24 @@ static bool trans_sb(DisasContext *ctx, arg_sb *a)
 
 static bool trans_sh(DisasContext *ctx, arg_sh *a)
 {
-    return gen_store(ctx, a, MO_TE | MO_SW);
+    return gen_store(ctx, a, MO_SW);
 }
 
 static bool trans_sw(DisasContext *ctx, arg_sw *a)
 {
-    return gen_store(ctx, a, MO_TE | MO_SL);
+    return gen_store(ctx, a, MO_SL);
 }
 
 static bool trans_sd(DisasContext *ctx, arg_sd *a)
 {
     REQUIRE_64_OR_128BIT(ctx);
-    return gen_store(ctx, a, MO_TE | MO_UQ);
+    return gen_store(ctx, a, MO_UQ);
 }
 
 static bool trans_sq(DisasContext *ctx, arg_sq *a)
 {
     REQUIRE_128BIT(ctx);
-    return gen_store(ctx, a, MO_TE | MO_UO);
+    return gen_store(ctx, a, MO_UO);
 }
 
 static bool trans_addd(DisasContext *ctx, arg_addd *a)
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index d130179432..c8dc102c8e 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -88,13 +88,13 @@ static bool trans_c_lbu(DisasContext *ctx, arg_c_lbu *a)
 static bool trans_c_lhu(DisasContext *ctx, arg_c_lhu *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_TE | MO_UW);
+    return gen_load(ctx, a, MO_UW);
 }
 
 static bool trans_c_lh(DisasContext *ctx, arg_c_lh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_load(ctx, a, MO_TE | MO_SW);
+    return gen_load(ctx, a, MO_SW);
 }
 
 static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
@@ -106,7 +106,7 @@ static bool trans_c_sb(DisasContext *ctx, arg_c_sb *a)
 static bool trans_c_sh(DisasContext *ctx, arg_c_sh *a)
 {
     REQUIRE_ZCB(ctx);
-    return gen_store(ctx, a, MO_TE | MO_UW);
+    return gen_store(ctx, a, MO_UW);
 }
 
 #define X_S0    8

From 23a56ce74ba6d00362693a3aba7fe4f76a720698 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:37 +0200
Subject: [PATCH 1606/2396] target/riscv: Conceal MO_TE within gen_load_idx() /
 gen_store_idx()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_load_idx() / gen_store_idx() set the MO_TE flag.
Set it once in the callees.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-7-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 34 ++++++++++++----------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 7e69906e5b..70c563664a 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -745,6 +745,7 @@ static bool gen_load_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv rd = dest_gpr(ctx, a->rd);
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
+    memop |= MO_TE;
     tcg_gen_qemu_ld_tl(rd, addr, ctx->mem_idx, memop);
     gen_set_gpr(ctx, a->rd, rd);
 
@@ -762,6 +763,7 @@ static bool gen_store_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv data = get_gpr(ctx, a->rd, EXT_NONE);
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
+    memop |= MO_TE;
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
 
     return true;
@@ -771,32 +773,32 @@ static bool trans_th_lrd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SQ, false);
+    return gen_load_idx(ctx, a, MO_SQ, false);
 }
 
 static bool trans_th_lrw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SL, false);
+    return gen_load_idx(ctx, a, MO_SL, false);
 }
 
 static bool trans_th_lrwu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_UL, false);
+    return gen_load_idx(ctx, a, MO_UL, false);
 }
 
 static bool trans_th_lrh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SW, false);
+    return gen_load_idx(ctx, a, MO_SW, false);
 }
 
 static bool trans_th_lrhu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_UW, false);
+    return gen_load_idx(ctx, a, MO_UW, false);
 }
 
 static bool trans_th_lrb(DisasContext *ctx, arg_th_memidx *a)
@@ -815,19 +817,19 @@ static bool trans_th_srd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SQ, false);
+    return gen_store_idx(ctx, a, MO_SQ, false);
 }
 
 static bool trans_th_srw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SL, false);
+    return gen_store_idx(ctx, a, MO_SL, false);
 }
 
 static bool trans_th_srh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SW, false);
+    return gen_store_idx(ctx, a, MO_SW, false);
 }
 
 static bool trans_th_srb(DisasContext *ctx, arg_th_memidx *a)
@@ -839,32 +841,32 @@ static bool trans_th_lurd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SQ, true);
+    return gen_load_idx(ctx, a, MO_SQ, true);
 }
 
 static bool trans_th_lurw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SL, true);
+    return gen_load_idx(ctx, a, MO_SL, true);
 }
 
 static bool trans_th_lurwu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_UL, true);
+    return gen_load_idx(ctx, a, MO_UL, true);
 }
 
 static bool trans_th_lurh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_SW, true);
+    return gen_load_idx(ctx, a, MO_SW, true);
 }
 
 static bool trans_th_lurhu(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_load_idx(ctx, a, MO_TE | MO_UW, true);
+    return gen_load_idx(ctx, a, MO_UW, true);
 }
 
 static bool trans_th_lurb(DisasContext *ctx, arg_th_memidx *a)
@@ -883,19 +885,19 @@ static bool trans_th_surd(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SQ, true);
+    return gen_store_idx(ctx, a, MO_SQ, true);
 }
 
 static bool trans_th_surw(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SL, true);
+    return gen_store_idx(ctx, a, MO_SL, true);
 }
 
 static bool trans_th_surh(DisasContext *ctx, arg_th_memidx *a)
 {
     REQUIRE_XTHEADMEMIDX(ctx);
-    return gen_store_idx(ctx, a, MO_TE | MO_SW, true);
+    return gen_store_idx(ctx, a, MO_SW, true);
 }
 
 static bool trans_th_surb(DisasContext *ctx, arg_th_memidx *a)

From d46fa71ea99c4efd2e7fad0aa5c6efad15bc982b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:38 +0200
Subject: [PATCH 1607/2396] target/riscv: Conceal MO_TE within gen_fload_idx()
 / gen_fstore_idx()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_fload_idx() / gen_fstore_idx() set the MO_TE flag.
Set it once in the callees.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-8-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 70c563664a..859cbc26cb 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -349,6 +349,7 @@ static bool gen_fload_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv_i64 rd = cpu_fpr[a->rd];
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
+    memop |= MO_TE;
     tcg_gen_qemu_ld_i64(rd, addr, ctx->mem_idx, memop);
     if ((memop & MO_SIZE) == MO_32) {
         gen_nanbox_s(rd, rd);
@@ -369,6 +370,7 @@ static bool gen_fstore_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv_i64 rd = cpu_fpr[a->rd];
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
+    memop |= MO_TE;
     tcg_gen_qemu_st_i64(rd, addr, ctx->mem_idx, memop);
 
     return true;
@@ -379,7 +381,7 @@ static bool trans_th_flrd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fload_idx(ctx, a, MO_TE | MO_UQ, false);
+    return gen_fload_idx(ctx, a, MO_UQ, false);
 }
 
 static bool trans_th_flrw(DisasContext *ctx, arg_th_memidx *a)
@@ -387,7 +389,7 @@ static bool trans_th_flrw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fload_idx(ctx, a, MO_TE | MO_UL, false);
+    return gen_fload_idx(ctx, a, MO_UL, false);
 }
 
 static bool trans_th_flurd(DisasContext *ctx, arg_th_memidx *a)
@@ -395,7 +397,7 @@ static bool trans_th_flurd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fload_idx(ctx, a, MO_TE | MO_UQ, true);
+    return gen_fload_idx(ctx, a, MO_UQ, true);
 }
 
 static bool trans_th_flurw(DisasContext *ctx, arg_th_memidx *a)
@@ -403,7 +405,7 @@ static bool trans_th_flurw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fload_idx(ctx, a, MO_TE | MO_UL, true);
+    return gen_fload_idx(ctx, a, MO_UL, true);
 }
 
 static bool trans_th_fsrd(DisasContext *ctx, arg_th_memidx *a)
@@ -411,7 +413,7 @@ static bool trans_th_fsrd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fstore_idx(ctx, a, MO_TE | MO_UQ, false);
+    return gen_fstore_idx(ctx, a, MO_UQ, false);
 }
 
 static bool trans_th_fsrw(DisasContext *ctx, arg_th_memidx *a)
@@ -419,7 +421,7 @@ static bool trans_th_fsrw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fstore_idx(ctx, a, MO_TE | MO_UL, false);
+    return gen_fstore_idx(ctx, a, MO_UL, false);
 }
 
 static bool trans_th_fsurd(DisasContext *ctx, arg_th_memidx *a)
@@ -427,7 +429,7 @@ static bool trans_th_fsurd(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
-    return gen_fstore_idx(ctx, a, MO_TE | MO_UQ, true);
+    return gen_fstore_idx(ctx, a, MO_UQ, true);
 }
 
 static bool trans_th_fsurw(DisasContext *ctx, arg_th_memidx *a)
@@ -435,7 +437,7 @@ static bool trans_th_fsurw(DisasContext *ctx, arg_th_memidx *a)
     REQUIRE_XTHEADFMEMIDX(ctx);
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
-    return gen_fstore_idx(ctx, a, MO_TE | MO_UL, true);
+    return gen_fstore_idx(ctx, a, MO_UL, true);
 }
 
 /* XTheadFmv */

From 6a58a38655fb242051e4b7c29aebe0fecbea37b4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:39 +0200
Subject: [PATCH 1608/2396] target/riscv: Conceal MO_TE within
 gen_storepair_tl()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_storepair_tl() set the MO_TE flag. Set it once in
the callee.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-9-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_xthead.c.inc | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 859cbc26cb..2f31842791 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -926,6 +926,7 @@ static bool gen_loadpair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
     addr1 = get_address(ctx, a->rs, imm);
     addr2 = get_address(ctx, a->rs, memop_size(memop) + imm);
 
+    memop |= MO_TE;
     tcg_gen_qemu_ld_tl(t1, addr1, ctx->mem_idx, memop);
     tcg_gen_qemu_ld_tl(t2, addr2, ctx->mem_idx, memop);
     gen_set_gpr(ctx, a->rd1, t1);
@@ -937,19 +938,19 @@ static bool trans_th_ldd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TE | MO_SQ, 4);
+    return gen_loadpair_tl(ctx, a, MO_SQ, 4);
 }
 
 static bool trans_th_lwd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TE | MO_SL, 3);
+    return gen_loadpair_tl(ctx, a, MO_SL, 3);
 }
 
 static bool trans_th_lwud(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_loadpair_tl(ctx, a, MO_TE | MO_UL, 3);
+    return gen_loadpair_tl(ctx, a, MO_UL, 3);
 }
 
 static bool gen_storepair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
@@ -964,6 +965,7 @@ static bool gen_storepair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
     addr1 = get_address(ctx, a->rs, imm);
     addr2 = get_address(ctx, a->rs, memop_size(memop) + imm);
 
+    memop |= MO_TE;
     tcg_gen_qemu_st_tl(data1, addr1, ctx->mem_idx, memop);
     tcg_gen_qemu_st_tl(data2, addr2, ctx->mem_idx, memop);
     return true;
@@ -973,13 +975,13 @@ static bool trans_th_sdd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
     REQUIRE_64BIT(ctx);
-    return gen_storepair_tl(ctx, a, MO_TE | MO_SQ, 4);
+    return gen_storepair_tl(ctx, a, MO_SQ, 4);
 }
 
 static bool trans_th_swd(DisasContext *ctx, arg_th_pair *a)
 {
     REQUIRE_XTHEADMEMPAIR(ctx);
-    return gen_storepair_tl(ctx, a, MO_TE | MO_SL, 3);
+    return gen_storepair_tl(ctx, a, MO_SL, 3);
 }
 
 /* XTheadSync */

From 9f14d9d98dc32fb8fe99ba5ae57a2fec3912d544 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:40 +0200
Subject: [PATCH 1609/2396] target/riscv: Conceal MO_TE within gen_cmpxchg*()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_cmpxchg() / gen_cmpxchg64() set the MO_TE flag.
Set it once in the callees.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-10-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvzabha.c.inc | 2 +-
 target/riscv/insn_trans/trans_rvzacas.c.inc | 7 ++++---
 target/riscv/translate.c                    | 1 +
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvzabha.c.inc b/target/riscv/insn_trans/trans_rvzabha.c.inc
index c1f99b65f0..302c63f2a3 100644
--- a/target/riscv/insn_trans/trans_rvzabha.c.inc
+++ b/target/riscv/insn_trans/trans_rvzabha.c.inc
@@ -141,5 +141,5 @@ static bool trans_amocas_h(DisasContext *ctx, arg_amocas_h *a)
 {
     REQUIRE_ZACAS(ctx);
     REQUIRE_ZABHA(ctx);
-    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_SW);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_SW);
 }
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
index 5e7c7c92b7..d850b14264 100644
--- a/target/riscv/insn_trans/trans_rvzacas.c.inc
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -25,7 +25,7 @@
 static bool trans_amocas_w(DisasContext *ctx, arg_amocas_w *a)
 {
     REQUIRE_ZACAS(ctx);
-    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_SL);
+    return gen_cmpxchg(ctx, a, MO_ALIGN | MO_SL);
 }
 
 static TCGv_i64 get_gpr_pair(DisasContext *ctx, int reg_num)
@@ -76,6 +76,7 @@ static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGv src1 = get_address(ctx, a->rs1, 0);
     TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
 
+    mop |= MO_TE;
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
 
@@ -88,10 +89,10 @@ static bool trans_amocas_d(DisasContext *ctx, arg_amocas_d *a)
     REQUIRE_ZACAS(ctx);
     switch (get_ol(ctx)) {
     case MXL_RV32:
-        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
+        return gen_cmpxchg64(ctx, a, MO_ALIGN | MO_UQ);
     case MXL_RV64:
     case MXL_RV128:
-        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
+        return gen_cmpxchg(ctx, a, MO_ALIGN | MO_UQ);
     default:
         g_assert_not_reached();
     }
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 94af9853cf..2e6f39aa02 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -1156,6 +1156,7 @@ static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGv src1 = get_address(ctx, a->rs1, 0);
     TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 
+    mop |= MO_TE;
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
 

From c62bcc0048746c5dbfbf8cf390dafc473be31139 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:41 +0200
Subject: [PATCH 1610/2396] target/riscv: Conceal MO_TE|MO_ALIGN within
 gen_lr() / gen_sc()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers of gen_lr() / gen_sc() set the MO_TE and MO_ALIGN flags.
Set them once in the callees.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-11-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rva.c.inc | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
index e0fbfafdde..8737e8d60d 100644
--- a/target/riscv/insn_trans/trans_rva.c.inc
+++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -34,6 +34,9 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
 {
     TCGv src1;
 
+    mop |= MO_ALIGN;
+    mop |= MO_TE;
+
     decode_save_opc(ctx, 0);
     src1 = get_address(ctx, a->rs1, 0);
     if (a->rl) {
@@ -61,6 +64,9 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGLabel *l1 = gen_new_label();
     TCGLabel *l2 = gen_new_label();
 
+    mop |= MO_ALIGN;
+    mop |= MO_TE;
+
     decode_save_opc(ctx, 0);
     src1 = get_address(ctx, a->rs1, 0);
     tcg_gen_brcond_tl(TCG_COND_NE, load_res, src1, l1);
@@ -99,13 +105,13 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
 static bool trans_lr_w(DisasContext *ctx, arg_lr_w *a)
 {
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_lr(ctx, a, (MO_ALIGN | MO_TE | MO_SL));
+    return gen_lr(ctx, a, MO_SL);
 }
 
 static bool trans_sc_w(DisasContext *ctx, arg_sc_w *a)
 {
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_sc(ctx, a, (MO_ALIGN | MO_TE | MO_SL));
+    return gen_sc(ctx, a, MO_SL);
 }
 
 static bool trans_amoswap_w(DisasContext *ctx, arg_amoswap_w *a)
@@ -166,14 +172,14 @@ static bool trans_lr_d(DisasContext *ctx, arg_lr_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_lr(ctx, a, MO_ALIGN | MO_TE | MO_UQ);
+    return gen_lr(ctx, a, MO_UQ);
 }
 
 static bool trans_sc_d(DisasContext *ctx, arg_sc_d *a)
 {
     REQUIRE_64BIT(ctx);
     REQUIRE_A_OR_ZALRSC(ctx);
-    return gen_sc(ctx, a, (MO_ALIGN | MO_TE | MO_UQ));
+    return gen_sc(ctx, a, MO_UQ);
 }
 
 static bool trans_amoswap_d(DisasContext *ctx, arg_amoswap_d *a)

From 6f825fd4911f61d198e11457eab9f707a925f34f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:42 +0200
Subject: [PATCH 1611/2396] target/riscv: Factor MemOp variable out when MO_TE
 is set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In preparation of automatically replacing the MO_TE flag
in the next commit, use an local @memop variable.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-12-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rvd.c.inc       |  6 ++++--
 target/riscv/insn_trans/trans_rvf.c.inc       |  6 ++++--
 target/riscv/insn_trans/trans_rvzacas.c.inc   |  5 +++--
 target/riscv/insn_trans/trans_rvzce.c.inc     |  6 ++++--
 target/riscv/insn_trans/trans_rvzfh.c.inc     |  8 ++++++--
 target/riscv/insn_trans/trans_rvzicfiss.c.inc | 10 ++++++----
 6 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 3385820678..62b7535815 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -42,7 +42,7 @@
 static bool trans_fld(DisasContext *ctx, arg_fld *a)
 {
     TCGv addr;
-    MemOp memop = MO_TE | MO_UQ;
+    MemOp memop = MO_UQ;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
@@ -60,6 +60,7 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     } else {
         memop |= MO_ATOM_IFALIGN;
     }
+    memop |= MO_TE;
 
     decode_save_opc(ctx, 0);
     addr = get_address(ctx, a->rs1, a->imm);
@@ -72,7 +73,7 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
 static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
 {
     TCGv addr;
-    MemOp memop = MO_TE | MO_UQ;
+    MemOp memop = MO_UQ;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVD);
@@ -84,6 +85,7 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     } else {
         memop |= MO_ATOM_IFALIGN;
     }
+    memop |= MO_TE;
 
     decode_save_opc(ctx, 0);
     addr = get_address(ctx, a->rs1, a->imm);
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index 150e2b9a7d..878417eae9 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -43,11 +43,12 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
 {
     TCGv_i64 dest;
     TCGv addr;
-    MemOp memop = MO_TE | MO_UL;
+    MemOp memop = MO_UL;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
+    memop |= MO_TE;
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
@@ -65,11 +66,12 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
 static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
 {
     TCGv addr;
-    MemOp memop = MO_TE | MO_UL;
+    MemOp memop = MO_UL;
 
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
+    memop |= MO_TE;
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
index d850b14264..6458ac4f24 100644
--- a/target/riscv/insn_trans/trans_rvzacas.c.inc
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -119,12 +119,13 @@ static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
     TCGv_i64 src2h = get_gpr(ctx, a->rs2 == 0 ? 0 : a->rs2 + 1, EXT_NONE);
     TCGv_i64 destl = get_gpr(ctx, a->rd, EXT_NONE);
     TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
+    MemOp memop = MO_ALIGN | MO_UO;
 
+    memop |= MO_TE;
     tcg_gen_concat_i64_i128(src2, src2l, src2h);
     tcg_gen_concat_i64_i128(dest, destl, desth);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
-    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx,
-                                (MO_ALIGN | MO_TE | MO_UO));
+    tcg_gen_atomic_cmpxchg_i128(dest, src1, dest, src2, ctx->mem_idx, memop);
 
     tcg_gen_extr_i128_i64(destl, desth, dest);
 
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index c8dc102c8e..172c2c19c1 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -175,7 +175,7 @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
         return false;
     }
 
-    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TE | MO_UL : MO_TE | MO_UQ;
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_UL : MO_UQ;
     int reg_size = memop_size(memop);
     target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
                              a->spimm;
@@ -185,6 +185,7 @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
 
     tcg_gen_addi_tl(addr, sp, stack_adj - reg_size);
 
+    memop |= MO_TE;
     for (i = X_Sn + 11; i >= 0; i--) {
         if (reg_bitmap & (1 << i)) {
             TCGv dest = dest_gpr(ctx, i);
@@ -228,7 +229,7 @@ static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
         return false;
     }
 
-    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_TE | MO_UL : MO_TE | MO_UQ;
+    MemOp memop = get_ol(ctx) == MXL_RV32 ? MO_UL : MO_UQ;
     int reg_size = memop_size(memop);
     target_ulong stack_adj = ROUND_UP(ctpop32(reg_bitmap) * reg_size, 16) +
                              a->spimm;
@@ -238,6 +239,7 @@ static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
 
     tcg_gen_subi_tl(addr, sp, reg_size);
 
+    memop |= MO_TE;
     for (i = X_Sn + 11; i >= 0; i--) {
         if (reg_bitmap & (1 << i)) {
             TCGv val = get_gpr(ctx, i, EXT_NONE);
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index eec478afcb..5355cd46c3 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -42,12 +42,14 @@
 
 static bool trans_flh(DisasContext *ctx, arg_flh *a)
 {
+    MemOp memop = MO_UW;
     TCGv_i64 dest;
     TCGv t0;
 
     REQUIRE_FPU;
     REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
+    memop |= MO_TE;
     decode_save_opc(ctx, 0);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
     if (a->imm) {
@@ -57,7 +59,7 @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     }
 
     dest = cpu_fpr[a->rd];
-    tcg_gen_qemu_ld_i64(dest, t0, ctx->mem_idx, MO_TE | MO_UW);
+    tcg_gen_qemu_ld_i64(dest, t0, ctx->mem_idx, memop);
     gen_nanbox_h(dest, dest);
 
     mark_fs_dirty(ctx);
@@ -66,11 +68,13 @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
 
 static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
 {
+    MemOp memop = MO_UW;
     TCGv t0;
 
     REQUIRE_FPU;
     REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
+    memop |= MO_TE;
     decode_save_opc(ctx, 0);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
     if (a->imm) {
@@ -79,7 +83,7 @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
         t0 = temp;
     }
 
-    tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], t0, ctx->mem_idx, MO_TE | MO_UW);
+    tcg_gen_qemu_st_i64(cpu_fpr[a->rs2], t0, ctx->mem_idx, memop);
 
     return true;
 }
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index c555596617..89eed00758 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -100,12 +100,13 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
 
     TCGv dest = dest_gpr(ctx, a->rd);
     TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    MemOp memop = MO_ALIGN | MO_SL;
 
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     src1 = get_address(ctx, a->rs1, 0);
 
-    tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx),
-                           (MO_ALIGN | MO_TE | MO_SL));
+    memop |= MO_TE;
+    tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx), memop);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }
@@ -129,12 +130,13 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
 
     TCGv dest = dest_gpr(ctx, a->rd);
     TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE);
+    MemOp memop = MO_ALIGN | MO_SQ;
 
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     src1 = get_address(ctx, a->rs1, 0);
 
-    tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx),
-                           (MO_ALIGN | MO_TE | MO_SQ));
+    memop |= MO_TE;
+    tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx), memop);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
 }

From 504f7f304ff6a05da44571103832315910531d37 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:43 +0200
Subject: [PATCH 1612/2396] target/riscv: Introduce mo_endian() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mo_endian() returns the target endianness from DisasContext.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-13-philmd@linaro.org>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/insn_trans/trans_rva.c.inc       |  4 ++--
 target/riscv/insn_trans/trans_rvd.c.inc       |  4 ++--
 target/riscv/insn_trans/trans_rvf.c.inc       |  4 ++--
 target/riscv/insn_trans/trans_rvi.c.inc       |  4 ++--
 target/riscv/insn_trans/trans_rvzacas.c.inc   |  4 ++--
 target/riscv/insn_trans/trans_rvzce.c.inc     |  4 ++--
 target/riscv/insn_trans/trans_rvzfh.c.inc     |  4 ++--
 target/riscv/insn_trans/trans_rvzicfiss.c.inc |  4 ++--
 target/riscv/insn_trans/trans_xthead.c.inc    | 16 ++++++++--------
 target/riscv/translate.c                      | 18 +++++++++++++++---
 10 files changed, 39 insertions(+), 27 deletions(-)

diff --git a/target/riscv/insn_trans/trans_rva.c.inc b/target/riscv/insn_trans/trans_rva.c.inc
index 8737e8d60d..a7a3278d24 100644
--- a/target/riscv/insn_trans/trans_rva.c.inc
+++ b/target/riscv/insn_trans/trans_rva.c.inc
@@ -35,7 +35,7 @@ static bool gen_lr(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGv src1;
 
     mop |= MO_ALIGN;
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
 
     decode_save_opc(ctx, 0);
     src1 = get_address(ctx, a->rs1, 0);
@@ -65,7 +65,7 @@ static bool gen_sc(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGLabel *l2 = gen_new_label();
 
     mop |= MO_ALIGN;
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
 
     decode_save_opc(ctx, 0);
     src1 = get_address(ctx, a->rs1, 0);
diff --git a/target/riscv/insn_trans/trans_rvd.c.inc b/target/riscv/insn_trans/trans_rvd.c.inc
index 62b7535815..ffea0c2a1f 100644
--- a/target/riscv/insn_trans/trans_rvd.c.inc
+++ b/target/riscv/insn_trans/trans_rvd.c.inc
@@ -60,7 +60,7 @@ static bool trans_fld(DisasContext *ctx, arg_fld *a)
     } else {
         memop |= MO_ATOM_IFALIGN;
     }
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
 
     decode_save_opc(ctx, 0);
     addr = get_address(ctx, a->rs1, a->imm);
@@ -85,7 +85,7 @@ static bool trans_fsd(DisasContext *ctx, arg_fsd *a)
     } else {
         memop |= MO_ATOM_IFALIGN;
     }
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
 
     decode_save_opc(ctx, 0);
     addr = get_address(ctx, a->rs1, a->imm);
diff --git a/target/riscv/insn_trans/trans_rvf.c.inc b/target/riscv/insn_trans/trans_rvf.c.inc
index 878417eae9..89fb0f604a 100644
--- a/target/riscv/insn_trans/trans_rvf.c.inc
+++ b/target/riscv/insn_trans/trans_rvf.c.inc
@@ -48,7 +48,7 @@ static bool trans_flw(DisasContext *ctx, arg_flw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
@@ -71,7 +71,7 @@ static bool trans_fsw(DisasContext *ctx, arg_fsw *a)
     REQUIRE_FPU;
     REQUIRE_EXT(ctx, RVF);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
diff --git a/target/riscv/insn_trans/trans_rvi.c.inc b/target/riscv/insn_trans/trans_rvi.c.inc
index 9a03058f46..54b9b4f241 100644
--- a/target/riscv/insn_trans/trans_rvi.c.inc
+++ b/target/riscv/insn_trans/trans_rvi.c.inc
@@ -402,7 +402,7 @@ static bool gen_load(DisasContext *ctx, arg_lb *a, MemOp memop)
 {
     bool out;
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
@@ -504,7 +504,7 @@ static bool gen_store_i128(DisasContext *ctx, arg_sb *a, MemOp memop)
 
 static bool gen_store(DisasContext *ctx, arg_sb *a, MemOp memop)
 {
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     if (ctx->cfg_ptr->ext_zama16b) {
         memop |= MO_ATOM_WITHIN16;
     }
diff --git a/target/riscv/insn_trans/trans_rvzacas.c.inc b/target/riscv/insn_trans/trans_rvzacas.c.inc
index 6458ac4f24..8d94b83ce9 100644
--- a/target/riscv/insn_trans/trans_rvzacas.c.inc
+++ b/target/riscv/insn_trans/trans_rvzacas.c.inc
@@ -76,7 +76,7 @@ static bool gen_cmpxchg64(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGv src1 = get_address(ctx, a->rs1, 0);
     TCGv_i64 src2 = get_gpr_pair(ctx, a->rs2);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     tcg_gen_atomic_cmpxchg_i64(dest, src1, dest, src2, ctx->mem_idx, mop);
 
@@ -121,7 +121,7 @@ static bool trans_amocas_q(DisasContext *ctx, arg_amocas_q *a)
     TCGv_i64 desth = get_gpr(ctx, a->rd == 0 ? 0 : a->rd + 1, EXT_NONE);
     MemOp memop = MO_ALIGN | MO_UO;
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_concat_i64_i128(src2, src2l, src2h);
     tcg_gen_concat_i64_i128(dest, destl, desth);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
diff --git a/target/riscv/insn_trans/trans_rvzce.c.inc b/target/riscv/insn_trans/trans_rvzce.c.inc
index 172c2c19c1..0d3ba40e52 100644
--- a/target/riscv/insn_trans/trans_rvzce.c.inc
+++ b/target/riscv/insn_trans/trans_rvzce.c.inc
@@ -185,7 +185,7 @@ static bool gen_pop(DisasContext *ctx, arg_cmpp *a, bool ret, bool ret_val)
 
     tcg_gen_addi_tl(addr, sp, stack_adj - reg_size);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     for (i = X_Sn + 11; i >= 0; i--) {
         if (reg_bitmap & (1 << i)) {
             TCGv dest = dest_gpr(ctx, i);
@@ -239,7 +239,7 @@ static bool trans_cm_push(DisasContext *ctx, arg_cm_push *a)
 
     tcg_gen_subi_tl(addr, sp, reg_size);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     for (i = X_Sn + 11; i >= 0; i--) {
         if (reg_bitmap & (1 << i)) {
             TCGv val = get_gpr(ctx, i, EXT_NONE);
diff --git a/target/riscv/insn_trans/trans_rvzfh.c.inc b/target/riscv/insn_trans/trans_rvzfh.c.inc
index 5355cd46c3..791ee51f65 100644
--- a/target/riscv/insn_trans/trans_rvzfh.c.inc
+++ b/target/riscv/insn_trans/trans_rvzfh.c.inc
@@ -49,7 +49,7 @@ static bool trans_flh(DisasContext *ctx, arg_flh *a)
     REQUIRE_FPU;
     REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     decode_save_opc(ctx, 0);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
     if (a->imm) {
@@ -74,7 +74,7 @@ static bool trans_fsh(DisasContext *ctx, arg_fsh *a)
     REQUIRE_FPU;
     REQUIRE_ZFHMIN_OR_ZFBFMIN(ctx);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     decode_save_opc(ctx, 0);
     t0 = get_gpr(ctx, a->rs1, EXT_NONE);
     if (a->imm) {
diff --git a/target/riscv/insn_trans/trans_rvzicfiss.c.inc b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
index 89eed00758..0b6ad57965 100644
--- a/target/riscv/insn_trans/trans_rvzicfiss.c.inc
+++ b/target/riscv/insn_trans/trans_rvzicfiss.c.inc
@@ -105,7 +105,7 @@ static bool trans_ssamoswap_w(DisasContext *ctx, arg_amoswap_w *a)
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     src1 = get_address(ctx, a->rs1, 0);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx), memop);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
@@ -135,7 +135,7 @@ static bool trans_ssamoswap_d(DisasContext *ctx, arg_amoswap_w *a)
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     src1 = get_address(ctx, a->rs1, 0);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_atomic_xchg_tl(dest, src1, src2, SS_MMU_INDEX(ctx), memop);
     gen_set_gpr(ctx, a->rd, dest);
     return true;
diff --git a/target/riscv/insn_trans/trans_xthead.c.inc b/target/riscv/insn_trans/trans_xthead.c.inc
index 2f31842791..f8b95c6498 100644
--- a/target/riscv/insn_trans/trans_xthead.c.inc
+++ b/target/riscv/insn_trans/trans_xthead.c.inc
@@ -349,7 +349,7 @@ static bool gen_fload_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv_i64 rd = cpu_fpr[a->rd];
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_ld_i64(rd, addr, ctx->mem_idx, memop);
     if ((memop & MO_SIZE) == MO_32) {
         gen_nanbox_s(rd, rd);
@@ -370,7 +370,7 @@ static bool gen_fstore_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv_i64 rd = cpu_fpr[a->rd];
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_st_i64(rd, addr, ctx->mem_idx, memop);
 
     return true;
@@ -570,7 +570,7 @@ static bool gen_load_inc(DisasContext *ctx, arg_th_meminc *a, MemOp memop,
     TCGv rd = dest_gpr(ctx, a->rd);
     TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_ld_tl(rd, addr, ctx->mem_idx, memop);
     tcg_gen_addi_tl(rs1, rs1, imm);
     gen_set_gpr(ctx, a->rd, rd);
@@ -591,7 +591,7 @@ static bool gen_store_inc(DisasContext *ctx, arg_th_meminc *a, MemOp memop,
     TCGv data = get_gpr(ctx, a->rd, EXT_NONE);
     TCGv rs1 = get_gpr(ctx, a->rs1, EXT_NONE);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
     tcg_gen_addi_tl(rs1, rs1, imm);
     gen_set_gpr(ctx, a->rs1, rs1);
@@ -747,7 +747,7 @@ static bool gen_load_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv rd = dest_gpr(ctx, a->rd);
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_ld_tl(rd, addr, ctx->mem_idx, memop);
     gen_set_gpr(ctx, a->rd, rd);
 
@@ -765,7 +765,7 @@ static bool gen_store_idx(DisasContext *ctx, arg_th_memidx *a, MemOp memop,
     TCGv data = get_gpr(ctx, a->rd, EXT_NONE);
     TCGv addr = get_th_address_indexed(ctx, a->rs1, a->rs2, a->imm2, zext_offs);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_st_tl(data, addr, ctx->mem_idx, memop);
 
     return true;
@@ -926,7 +926,7 @@ static bool gen_loadpair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
     addr1 = get_address(ctx, a->rs, imm);
     addr2 = get_address(ctx, a->rs, memop_size(memop) + imm);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_ld_tl(t1, addr1, ctx->mem_idx, memop);
     tcg_gen_qemu_ld_tl(t2, addr2, ctx->mem_idx, memop);
     gen_set_gpr(ctx, a->rd1, t1);
@@ -965,7 +965,7 @@ static bool gen_storepair_tl(DisasContext *ctx, arg_th_pair *a, MemOp memop,
     addr1 = get_address(ctx, a->rs, imm);
     addr2 = get_address(ctx, a->rs, memop_size(memop) + imm);
 
-    memop |= MO_TE;
+    memop |= mo_endian(ctx);
     tcg_gen_qemu_st_tl(data1, addr1, ctx->mem_idx, memop);
     tcg_gen_qemu_st_tl(data2, addr2, ctx->mem_idx, memop);
     return true;
diff --git a/target/riscv/translate.c b/target/riscv/translate.c
index 2e6f39aa02..e1f4dc5ffd 100644
--- a/target/riscv/translate.c
+++ b/target/riscv/translate.c
@@ -126,6 +126,18 @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
     return ctx->misa_ext & ext;
 }
 
+static inline MemOp mo_endian(DisasContext *ctx)
+{
+    /*
+     * A couple of bits in MSTATUS set the endianness:
+     *  - MSTATUS_UBE (User-mode),
+     *  - MSTATUS_SBE (Supervisor-mode),
+     *  - MSTATUS_MBE (Machine-mode)
+     * but we don't implement that yet.
+     */
+    return MO_TE;
+}
+
 #ifdef TARGET_RISCV32
 #define get_xl(ctx)    MXL_RV32
 #elif defined(CONFIG_USER_ONLY)
@@ -142,7 +154,7 @@ static inline bool has_ext(DisasContext *ctx, uint32_t ext)
 #define get_address_xl(ctx)    ((ctx)->address_xl)
 #endif
 
-#define mxl_memop(ctx) ((get_xl(ctx) + 1) | MO_TE)
+#define mxl_memop(ctx) ((get_xl(ctx) + 1) | mo_endian(ctx))
 
 /* The word size for this machine mode. */
 static inline int __attribute__((unused)) get_xlen(DisasContext *ctx)
@@ -1135,7 +1147,7 @@ static bool gen_amo(DisasContext *ctx, arg_atomic *a,
     TCGv src1, src2 = get_gpr(ctx, a->rs2, EXT_NONE);
     MemOp size = mop & MO_SIZE;
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     if (ctx->cfg_ptr->ext_zama16b && size >= MO_32) {
         mop |= MO_ATOM_WITHIN16;
     } else {
@@ -1156,7 +1168,7 @@ static bool gen_cmpxchg(DisasContext *ctx, arg_atomic *a, MemOp mop)
     TCGv src1 = get_address(ctx, a->rs1, 0);
     TCGv src2 = get_gpr(ctx, a->rs2, EXT_NONE);
 
-    mop |= MO_TE;
+    mop |= mo_endian(ctx);
     decode_save_opc(ctx, RISCV_UW2_ALWAYS_STORE_AMO);
     tcg_gen_atomic_cmpxchg_tl(dest, src1, dest, src2, ctx->mem_idx, mop);
 

From d652720ecc6e6b62d358db07fb1b1b4c2578243b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 10 Oct 2025 17:50:44 +0200
Subject: [PATCH 1613/2396] target/riscv: Introduce mo_endian_env() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

mo_endian_env() returns the target endianness from CPUArchState.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251010155045.78220-14-philmd@linaro.org>
[ Changes by AF:
 - Only define mo_endian_env() for softmmu
]
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/op_helper.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/target/riscv/op_helper.c b/target/riscv/op_helper.c
index c486f771d3..6ccc127c30 100644
--- a/target/riscv/op_helper.c
+++ b/target/riscv/op_helper.c
@@ -28,6 +28,20 @@
 #include "exec/tlb-flags.h"
 #include "trace.h"
 
+#ifndef CONFIG_USER_ONLY
+static inline MemOp mo_endian_env(CPURISCVState *env)
+{
+    /*
+     * A couple of bits in MSTATUS set the endianness:
+     *  - MSTATUS_UBE (User-mode),
+     *  - MSTATUS_SBE (Supervisor-mode),
+     *  - MSTATUS_MBE (Machine-mode)
+     * but we don't implement that yet.
+     */
+    return MO_TE;
+}
+#endif
+
 /* Exceptions processing helpers */
 G_NORETURN void riscv_raise_exception(CPURISCVState *env,
                                       RISCVException exception,
@@ -633,7 +647,7 @@ target_ulong helper_hyp_hlv_hu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UW, mmu_idx);
 
     return cpu_ldw_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -642,7 +656,7 @@ target_ulong helper_hyp_hlv_wu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UL, mmu_idx);
 
     return cpu_ldl_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -651,7 +665,7 @@ target_ulong helper_hyp_hlv_d(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UQ, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UQ, mmu_idx);
 
     return cpu_ldq_mmu(env, adjust_addr_virt(env, addr), oi, ra);
 }
@@ -669,7 +683,7 @@ void helper_hyp_hsv_h(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UW, mmu_idx);
 
     cpu_stw_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -678,7 +692,7 @@ void helper_hyp_hsv_w(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UL, mmu_idx);
 
     cpu_stl_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -687,7 +701,7 @@ void helper_hyp_hsv_d(CPURISCVState *env, target_ulong addr, target_ulong val)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, false, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UQ, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UQ, mmu_idx);
 
     cpu_stq_mmu(env, adjust_addr_virt(env, addr), val, oi, ra);
 }
@@ -703,7 +717,7 @@ target_ulong helper_hyp_hlvx_hu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, true, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UW, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UW, mmu_idx);
 
     return cpu_ldw_code_mmu(env, addr, oi, GETPC());
 }
@@ -712,7 +726,7 @@ target_ulong helper_hyp_hlvx_wu(CPURISCVState *env, target_ulong addr)
 {
     uintptr_t ra = GETPC();
     int mmu_idx = check_access_hlsv(env, true, ra);
-    MemOpIdx oi = make_memop_idx(MO_TE | MO_UL, mmu_idx);
+    MemOpIdx oi = make_memop_idx(mo_endian_env(env) | MO_UL, mmu_idx);
 
     return cpu_ldl_code_mmu(env, addr, oi, ra);
 }

From e530e5d034daf6865239b94705dd57c8c45cf4e4 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sat, 4 Oct 2025 13:00:46 -0700
Subject: [PATCH 1614/2396] hw/net/cadence_gem: Support two Ethernet interfaces
 connected to single MDIO bus

The Microchip PolarFire SoC Icicle Kit supports two Ethernet interfaces.
The PHY on each may be connected to separate MDIO busses, or both may be
connected on the same MDIO bus using different PHY addresses.

To be able to support two PHY instances on a single MDIO bus, two properties
are needed: First, there needs to be a flag indicating if the MDIO bus on
a given Ethernet interface is connected. If not, attempts to read from this
bus must always return 0xffff. Implement this property as phy-connected.
Second, if the MDIO bus on an interface is active, it needs a link to the
consumer interface to be able to provide PHY access for it. Implement this
property as phy-consumer.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251004200049.871646-2-linux@roeck-us.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/net/cadence_gem.c         | 24 ++++++++++++++++++------
 include/hw/net/cadence_gem.h |  3 +++
 2 files changed, 21 insertions(+), 6 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 44446666de..520324adfd 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1541,12 +1541,20 @@ static void gem_handle_phy_access(CadenceGEMState *s)
 {
     uint32_t val = s->regs[R_PHYMNTNC];
     uint32_t phy_addr, reg_num;
+    CadenceGEMState *ps = s;
+    uint32_t op;
 
     phy_addr = FIELD_EX32(val, PHYMNTNC, PHY_ADDR);
+    op = FIELD_EX32(val, PHYMNTNC, OP);
 
-    if (phy_addr != s->phy_addr) {
-        /* no phy at this address */
-        if (FIELD_EX32(val, PHYMNTNC, OP) == MDIO_OP_READ) {
+    /* Switch phy to consumer interface if there is an address match */
+    if (s->phy_consumer && phy_addr == s->phy_consumer->phy_addr) {
+        ps = s->phy_consumer;
+    }
+
+    if (!s->phy_connected || phy_addr != ps->phy_addr) {
+        /* phy not connected or no phy at this address */
+        if (op == MDIO_OP_READ) {
             s->regs[R_PHYMNTNC] = FIELD_DP32(val, PHYMNTNC, DATA, 0xffff);
         }
         return;
@@ -1554,14 +1562,14 @@ static void gem_handle_phy_access(CadenceGEMState *s)
 
     reg_num = FIELD_EX32(val, PHYMNTNC, REG_ADDR);
 
-    switch (FIELD_EX32(val, PHYMNTNC, OP)) {
+    switch (op) {
     case MDIO_OP_READ:
         s->regs[R_PHYMNTNC] = FIELD_DP32(val, PHYMNTNC, DATA,
-                                         gem_phy_read(s, reg_num));
+                                         gem_phy_read(ps, reg_num));
         break;
 
     case MDIO_OP_WRITE:
-        gem_phy_write(s, reg_num, val);
+        gem_phy_write(ps, reg_num, val);
         break;
 
     default:
@@ -1813,6 +1821,10 @@ static const Property gem_properties[] = {
                       num_type2_screeners, 4),
     DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
                        jumbo_max_len, 10240),
+    DEFINE_PROP_BOOL("phy-connected", CadenceGEMState, phy_connected, true),
+    DEFINE_PROP_LINK("phy-consumer", CadenceGEMState, phy_consumer,
+                     TYPE_CADENCE_GEM, CadenceGEMState *),
+
     DEFINE_PROP_LINK("dma", CadenceGEMState, dma_mr,
                      TYPE_MEMORY_REGION, MemoryRegion *),
 };
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index 91ebb5c8ae..21e7319f53 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -81,6 +81,9 @@ struct CadenceGEMState {
 
     uint8_t phy_loop; /* Are we in phy loopback? */
 
+    bool phy_connected; /* true if connected */
+    struct CadenceGEMState *phy_consumer;
+
     /* The current DMA descriptor pointers */
     uint32_t rx_desc_addr[MAX_PRIORITY_QUEUES];
     uint32_t tx_desc_addr[MAX_PRIORITY_QUEUES];

From a79a4b9c2e5fa276d7a3317e0fdfe42edbb04555 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sat, 4 Oct 2025 13:00:47 -0700
Subject: [PATCH 1615/2396] hw/riscv: microchip_pfsoc: Connect Ethernet PHY
 channels

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251004200049.871646-3-linux@roeck-us.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 2e74783fce..9fbfba8ece 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -414,6 +414,8 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
 
     object_property_set_int(OBJECT(&s->gem0), "revision", GEM_REVISION, errp);
     object_property_set_int(OBJECT(&s->gem0), "phy-addr", 8, errp);
+    object_property_set_bool(OBJECT(&s->gem0), "phy-connected", false, errp);
+
     sysbus_realize(SYS_BUS_DEVICE(&s->gem0), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem0), 0,
                     memmap[MICROCHIP_PFSOC_GEM0].base);
@@ -422,6 +424,8 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
 
     object_property_set_int(OBJECT(&s->gem1), "revision", GEM_REVISION, errp);
     object_property_set_int(OBJECT(&s->gem1), "phy-addr", 9, errp);
+    object_property_set_link(OBJECT(&s->gem1), "phy-consumer",
+                             OBJECT(&s->gem0), errp);
     sysbus_realize(SYS_BUS_DEVICE(&s->gem1), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem1), 0,
                     memmap[MICROCHIP_PFSOC_GEM1].base);

From 35a5e8792046df64df10550cd7de4bbc0a2c1018 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sat, 4 Oct 2025 13:00:48 -0700
Subject: [PATCH 1616/2396] hw/net/cadence_gem: Add pcs-enabled property

The Linux kernel checks the PCS disabled bit in the R_DESCONF register
to determine if SGMII is supported. If the bit is set, SGMII support is
disabled. Since the Microchip Icicle devicetree file configures SGMII
interface mode, enabling the Ethernet interfaces fails when booting
the Linux kernel.

Add pcs-enabled property to to let the driver know if PCS should be
enabled. Set the flag to false by default (indicating that PCS is disabled)
to match the exiting code.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251004200049.871646-4-linux@roeck-us.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/net/cadence_gem.c         | 7 ++++++-
 include/hw/net/cadence_gem.h | 1 +
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 520324adfd..44896f1801 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1477,7 +1477,10 @@ static void gem_reset(DeviceState *d)
     s->regs[R_TXPARTIALSF] = 0x000003ff;
     s->regs[R_RXPARTIALSF] = 0x000003ff;
     s->regs[R_MODID] = s->revision;
-    s->regs[R_DESCONF] = 0x02D00111;
+    s->regs[R_DESCONF] = 0x02D00110;
+    if (!s->pcs_enabled) {
+        s->regs[R_DESCONF] |= 0x00000001;
+    }
     s->regs[R_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
     s->regs[R_DESCONF5] = 0x002f2045;
     s->regs[R_DESCONF6] = R_DESCONF6_DMA_ADDR_64B_MASK;
@@ -1821,6 +1824,8 @@ static const Property gem_properties[] = {
                       num_type2_screeners, 4),
     DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
                        jumbo_max_len, 10240),
+    DEFINE_PROP_BOOL("pcs-enabled", CadenceGEMState,
+                       pcs_enabled, false),
     DEFINE_PROP_BOOL("phy-connected", CadenceGEMState, phy_connected, true),
     DEFINE_PROP_LINK("phy-consumer", CadenceGEMState, phy_consumer,
                      TYPE_CADENCE_GEM, CadenceGEMState *),
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index 21e7319f53..e63941f18f 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -62,6 +62,7 @@ struct CadenceGEMState {
     uint8_t num_type2_screeners;
     uint32_t revision;
     uint16_t jumbo_max_len;
+    bool pcs_enabled;
 
     /* GEM registers backing store */
     uint32_t regs[CADENCE_GEM_MAXREG];

From cdbb7c3fa6f67d3370965cb0e4bbfdbca04c0913 Mon Sep 17 00:00:00 2001
From: Guenter Roeck <linux@roeck-us.net>
Date: Sat, 4 Oct 2025 13:00:49 -0700
Subject: [PATCH 1617/2396] microchip icicle: Enable PCS on Cadence Ethernet

PCS needs to be enabled for SGMII to be supported by the Linux kernel.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251004200049.871646-5-linux@roeck-us.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/riscv/microchip_pfsoc.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 9fbfba8ece..4c939d8e96 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -415,6 +415,7 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(&s->gem0), "revision", GEM_REVISION, errp);
     object_property_set_int(OBJECT(&s->gem0), "phy-addr", 8, errp);
     object_property_set_bool(OBJECT(&s->gem0), "phy-connected", false, errp);
+    object_property_set_bool(OBJECT(&s->gem0), "pcs-enabled", true, errp);
 
     sysbus_realize(SYS_BUS_DEVICE(&s->gem0), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem0), 0,
@@ -426,6 +427,7 @@ static void microchip_pfsoc_soc_realize(DeviceState *dev, Error **errp)
     object_property_set_int(OBJECT(&s->gem1), "phy-addr", 9, errp);
     object_property_set_link(OBJECT(&s->gem1), "phy-consumer",
                              OBJECT(&s->gem0), errp);
+    object_property_set_bool(OBJECT(&s->gem1), "pcs-enabled", true, errp);
     sysbus_realize(SYS_BUS_DEVICE(&s->gem1), errp);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->gem1), 0,
                     memmap[MICROCHIP_PFSOC_GEM1].base);

From 5e3e066e4ac894aff3e8dd3a072bca9c1986b2ff Mon Sep 17 00:00:00 2001
From: Jialong Yang <z_bajeer@yeah.net>
Date: Sat, 11 Oct 2025 08:54:39 +0800
Subject: [PATCH 1618/2396] aplic: fix mask for smsiaddrcfgh

 4.5.4. Supervisor MSI address configuration (smsiaddrcfg and
   smsiaddrcfgh)
smsiaddrcfgh:
        bits 22:20 LHXS(WARL)
        bits 11:0  High Base PPN(WARL)

Signed-off-by: Jialong Yang <z_bajeer@yeah.net>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <44f3e0d1.161.199d0c338b0.Coremail.z_bajeer@yeah.net>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 hw/intc/riscv_aplic.c | 29 ++++++++++++++++++-----------
 1 file changed, 18 insertions(+), 11 deletions(-)

diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index a1d9fa5085..6dccca73af 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -96,7 +96,7 @@
     (APLIC_xMSICFGADDR_PPN_HHX_MASK(__hhxw) << \
      APLIC_xMSICFGADDR_PPN_HHX_SHIFT(__hhxs))
 
-#define APLIC_xMSICFGADDRH_VALID_MASK   \
+#define APLIC_MMSICFGADDRH_VALID_MASK   \
     (APLIC_xMSICFGADDRH_L | \
      (APLIC_xMSICFGADDRH_HHXS_MASK << APLIC_xMSICFGADDRH_HHXS_SHIFT) | \
      (APLIC_xMSICFGADDRH_LHXS_MASK << APLIC_xMSICFGADDRH_LHXS_SHIFT) | \
@@ -104,6 +104,10 @@
      (APLIC_xMSICFGADDRH_LHXW_MASK << APLIC_xMSICFGADDRH_LHXW_SHIFT) | \
      APLIC_xMSICFGADDRH_BAPPN_MASK)
 
+#define APLIC_SMSICFGADDRH_VALID_MASK   \
+    ((APLIC_xMSICFGADDRH_LHXS_MASK << APLIC_xMSICFGADDRH_LHXS_SHIFT) | \
+     APLIC_xMSICFGADDRH_BAPPN_MASK)
+
 #define APLIC_SETIP_BASE               0x1c00
 #define APLIC_SETIPNUM                 0x1cdc
 
@@ -184,7 +188,7 @@ void riscv_aplic_set_kvm_msicfgaddr(RISCVAPLICState *aplic, hwaddr addr)
         addr >>= APLIC_xMSICFGADDR_PPN_SHIFT;
         aplic->kvm_msicfgaddr = extract64(addr, 0, 32);
         aplic->kvm_msicfgaddrH = extract64(addr, 32, 32) &
-                                 APLIC_xMSICFGADDRH_VALID_MASK;
+                                 APLIC_MMSICFGADDRH_VALID_MASK;
     }
 #endif
 }
@@ -409,13 +413,8 @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
         msicfgaddr = aplic->kvm_msicfgaddr;
         msicfgaddrH = ((uint64_t)aplic->kvm_msicfgaddrH << 32);
     } else {
-        if (aplic->mmode) {
-            msicfgaddr = aplic_m->mmsicfgaddr;
-            msicfgaddrH = aplic_m->mmsicfgaddrH;
-        } else {
-            msicfgaddr = aplic_m->smsicfgaddr;
-            msicfgaddrH = aplic_m->smsicfgaddrH;
-        }
+        msicfgaddr = aplic_m->mmsicfgaddr;
+        msicfgaddrH = aplic_m->mmsicfgaddrH;
     }
 
     lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
@@ -427,6 +426,14 @@ static void riscv_aplic_msi_send(RISCVAPLICState *aplic,
     hhxw = (msicfgaddrH >> APLIC_xMSICFGADDRH_HHXW_SHIFT) &
             APLIC_xMSICFGADDRH_HHXW_MASK;
 
+    if (!aplic->kvm_splitmode && !aplic->mmode) {
+        msicfgaddrH = aplic_m->smsicfgaddrH;
+        msicfgaddr = aplic_m->smsicfgaddr;
+
+        lhxs = (msicfgaddrH >> APLIC_xMSICFGADDRH_LHXS_SHIFT) &
+            APLIC_xMSICFGADDRH_LHXS_MASK;
+    }
+
     group_idx = hart_idx >> lhxw;
 
     addr = msicfgaddr;
@@ -771,7 +778,7 @@ static void riscv_aplic_write(void *opaque, hwaddr addr, uint64_t value,
     } else if (aplic->mmode && aplic->msimode &&
                (addr == APLIC_MMSICFGADDRH)) {
         if (!(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
-            aplic->mmsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
+            aplic->mmsicfgaddrH = value & APLIC_MMSICFGADDRH_VALID_MASK;
         }
     } else if (aplic->mmode && aplic->msimode &&
                (addr == APLIC_SMSICFGADDR)) {
@@ -792,7 +799,7 @@ static void riscv_aplic_write(void *opaque, hwaddr addr, uint64_t value,
                (addr == APLIC_SMSICFGADDRH)) {
         if (aplic->num_children &&
             !(aplic->mmsicfgaddrH & APLIC_xMSICFGADDRH_L)) {
-            aplic->smsicfgaddrH = value & APLIC_xMSICFGADDRH_VALID_MASK;
+            aplic->smsicfgaddrH = value & APLIC_SMSICFGADDRH_VALID_MASK;
         }
     } else if ((APLIC_SETIP_BASE <= addr) &&
             (addr < (APLIC_SETIP_BASE + aplic->bitfield_words * 4))) {

From 49c24c2ae5c02ea5351f2657217befd272e5333c Mon Sep 17 00:00:00 2001
From: Djordje Todorovic <Djordje.Todorovic@htecgroup.com>
Date: Sat, 18 Oct 2025 15:45:28 +0000
Subject: [PATCH 1619/2396] hw/intc: Allow gaps in hartids for aclint and aplic

This is needed for riscv based CPUs by MIPS since those may have
sparse hart-ID layouts. ACLINT and APLIC still assume a dense
range, and if a hart is missing, this causes NULL derefs.

Signed-off-by: Chao-ying Fu <cfu@mips.com>
Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251018154522.745788-2-djordje.todorovic@htecgroup.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 hw/intc/riscv_aclint.c | 18 ++++++++++++++++--
 hw/intc/riscv_aplic.c  | 13 ++++++++++---
 2 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/hw/intc/riscv_aclint.c b/hw/intc/riscv_aclint.c
index 9f4c36e965..c6f13f647e 100644
--- a/hw/intc/riscv_aclint.c
+++ b/hw/intc/riscv_aclint.c
@@ -297,7 +297,12 @@ static void riscv_aclint_mtimer_realize(DeviceState *dev, Error **errp)
     s->timecmp = g_new0(uint64_t, s->num_harts);
     /* Claim timer interrupt bits */
     for (i = 0; i < s->num_harts; i++) {
-        RISCVCPU *cpu = RISCV_CPU(cpu_by_arch_id(s->hartid_base + i));
+        CPUState *cpu_by_hartid = cpu_by_arch_id(s->hartid_base + i);
+        if (cpu_by_hartid == NULL) {
+            /* Valid for sparse hart layouts - skip this hart ID */
+            continue;
+        }
+        RISCVCPU *cpu = RISCV_CPU(cpu_by_hartid);
         if (riscv_cpu_claim_interrupts(cpu, MIP_MTIP) < 0) {
             error_report("MTIP already claimed");
             exit(1);
@@ -489,7 +494,12 @@ static void riscv_aclint_swi_realize(DeviceState *dev, Error **errp)
 
     /* Claim software interrupt bits */
     for (i = 0; i < swi->num_harts; i++) {
-        RISCVCPU *cpu = RISCV_CPU(qemu_get_cpu(swi->hartid_base + i));
+        CPUState *cpu_by_hartid = cpu_by_arch_id(swi->hartid_base + i);
+        if (cpu_by_hartid == NULL) {
+            /* Valid for sparse hart layouts - skip this hart ID */
+            continue;
+        }
+        RISCVCPU *cpu = RISCV_CPU(cpu_by_hartid);
         /* We don't claim mip.SSIP because it is writable by software */
         if (riscv_cpu_claim_interrupts(cpu, swi->sswi ? 0 : MIP_MSIP) < 0) {
             error_report("MSIP already claimed");
@@ -553,6 +563,10 @@ DeviceState *riscv_aclint_swi_create(hwaddr addr, uint32_t hartid_base,
 
     for (i = 0; i < num_harts; i++) {
         CPUState *cpu = cpu_by_arch_id(hartid_base + i);
+        if (cpu == NULL) {
+            /* Valid for sparse hart layouts - skip this hart ID */
+            continue;
+        }
         RISCVCPU *rvcpu = RISCV_CPU(cpu);
 
         qdev_connect_gpio_out(dev, i,
diff --git a/hw/intc/riscv_aplic.c b/hw/intc/riscv_aplic.c
index 6dccca73af..a2041e7022 100644
--- a/hw/intc/riscv_aplic.c
+++ b/hw/intc/riscv_aplic.c
@@ -910,9 +910,12 @@ static void riscv_aplic_realize(DeviceState *dev, Error **errp)
         if (!aplic->msimode) {
             /* Claim the CPU interrupt to be triggered by this APLIC */
             for (i = 0; i < aplic->num_harts; i++) {
-                RISCVCPU *cpu;
-
-                cpu = RISCV_CPU(cpu_by_arch_id(aplic->hartid_base + i));
+                CPUState *temp = cpu_by_arch_id(aplic->hartid_base + i);
+                if (temp == NULL) {
+                    /* Valid for sparse hart layouts - skip this hart ID */
+                    continue;
+                }
+                RISCVCPU *cpu = RISCV_CPU(temp);
                 if (riscv_cpu_claim_interrupts(cpu,
                     (aplic->mmode) ? MIP_MEIP : MIP_SEIP) < 0) {
                     error_report("%s already claimed",
@@ -1095,6 +1098,10 @@ DeviceState *riscv_aplic_create(hwaddr addr, hwaddr size,
         if (!msimode) {
             for (i = 0; i < num_harts; i++) {
                 CPUState *cpu = cpu_by_arch_id(hartid_base + i);
+                if (cpu == NULL) {
+                    /* Valid for sparse hart layouts - skip this hart ID */
+                    continue;
+                }
 
                 qdev_connect_gpio_out_named(dev, NULL, i,
                                             qdev_get_gpio_in(DEVICE(cpu),

From 2a21cbee47a124edf43fc9ee156d7093e2f957fd Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 22 Oct 2025 08:11:05 -0300
Subject: [PATCH 1620/2396] target/riscv/kvm: fix env->priv setting in
 reset_regs_csr()

This patch was originally made by Gitlab user Bo Gan (@ganboing) 4
months ago in the context of issue [1]. I asked the author to send a
patch to the mailing list ~3 months ago and got no reply. I'm sending
the patch myself because we already missed 10.1 without this fix.

I'll also just post verbatim Bo Gan comment in the commit msg:

"In RISCV Linux with KVM enabled, gdbstub is broken. The
get_physical_address isn't able to page-walk correctly and resolve the
physical page. This is due to that the vcpu is being treated as starting
in M mode even if KVM enabled. However, with KVM, the vcpu is actually
started in S mode. The mmu_idx will give 3 (M), instead of 1 (S),
resulting in Guest PA == VA (wrong)!"

Set env->priv to PRV_S in kvm_riscv_reset_regs_csr() since the VCPU is
always started in S-mode for KVM.

[1] https://gitlab.com/qemu-project/qemu/-/issues/2991

Cc: qemu-stable@nongnu.org
Closes: https://gitlab.com/qemu-project/qemu/-/issues/2991
Originally-by: Bo Gan (@ganboing in Gitlab)
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251022111105.483992-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/kvm/kvm-cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 0dd0d59d41..000e44b2b7 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -705,6 +705,7 @@ static void kvm_riscv_reset_regs_csr(CPURISCVState *env)
     env->satp = 0;
     env->scounteren = 0;
     env->senvcfg = 0;
+    env->priv = PRV_S;
 }
 
 static int kvm_riscv_get_regs_fp(CPUState *cs)

From f131f10b63fac3bfa8f96c67a446c36bfcccbe6a Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 22 Oct 2025 09:56:43 -0300
Subject: [PATCH 1621/2396] target/riscv/riscv-qmp-cmds.c: coverity-related
 fixes

Coverity CID 1641401 reports that, in reg_is_ulong_integer(), we're
dereferencing a NULL pointer in "reg1" when using it in strcasecmp()
call. A similar case is reported with CID 1641393.

In theory that will never happen - it's guaranteed that both "reg1" and
"reg2" is non-NULL because we're retrieving them in compile-time from
static arrays. Coverity doesn't know that though.

To make Coverity happier and add a bit more clarity in the code,
g_assert() each token to make it clear that those 2 values aren't
supposed to be NULL ever. Do that in both reg_is_ulong_integer() and
reg_is_u64_fpu().

We're also taking the opportunity to implement suggestions made by Peter
in [1] in both functions:

- use g_strsplit() instead of strtok();
- use g_ascii_strcasecmp() instead of strcasecmp().

[1] https://lore.kernel.org/qemu-devel/CAFEAcA_y4bwd9GANbXnpTy2mv80Vg_jp+A-VkQS5V6f0+BFRAA@mail.gmail.com/

Coverity: CID 1641393, 1641401
Fixes: e06d209aa6 ("target/riscv: implement MonitorDef HMP API")
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251022125643.588947-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/riscv-qmp-cmds.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/target/riscv/riscv-qmp-cmds.c b/target/riscv/riscv-qmp-cmds.c
index c499f9b9a7..d5e9bec0f8 100644
--- a/target/riscv/riscv-qmp-cmds.c
+++ b/target/riscv/riscv-qmp-cmds.c
@@ -273,12 +273,13 @@ static bool reg_is_ulong_integer(CPURISCVState *env, const char *name,
     }
 
     for (int i = 0; i < 32; i++) {
-        g_autofree char *reg_name = g_strdup(reg_names[i]);
-        char *reg1 = strtok(reg_name, "/");
-        char *reg2 = strtok(NULL, "/");
+        g_auto(GStrv) reg_name = g_strsplit(reg_names[i], "/", 2);
 
-        if (strcasecmp(reg1, name) == 0 ||
-            (reg2 && strcasecmp(reg2, name) == 0)) {
+        g_assert(reg_name[0]);
+        g_assert(reg_name[1]);
+
+        if (g_ascii_strcasecmp(reg_name[0], name) == 0 ||
+            g_ascii_strcasecmp(reg_name[1], name) == 0) {
             *val = vals[i];
             return true;
         }
@@ -294,12 +295,13 @@ static bool reg_is_u64_fpu(CPURISCVState *env, const char *name, uint64_t *val)
     }
 
     for (int i = 0; i < 32; i++) {
-        g_autofree char *reg_name = g_strdup(riscv_fpr_regnames[i]);
-        char *reg1 = strtok(reg_name, "/");
-        char *reg2 = strtok(NULL, "/");
+        g_auto(GStrv) reg_name = g_strsplit(riscv_fpr_regnames[i], "/", 2);
 
-        if (strcasecmp(reg1, name) == 0 ||
-            (reg2 && strcasecmp(reg2, name) == 0)) {
+        g_assert(reg_name[0]);
+        g_assert(reg_name[1]);
+
+        if (g_ascii_strcasecmp(reg_name[0], name) == 0 ||
+            g_ascii_strcasecmp(reg_name[1], name) == 0) {
             *val = env->fpr[i];
             return true;
         }

From 06e01941ffca3c246a9770f477e43118793fde59 Mon Sep 17 00:00:00 2001
From: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Date: Wed, 22 Oct 2025 09:43:40 -0300
Subject: [PATCH 1622/2396] target/riscv: fix riscv_cpu_sirq_pending() mask

We're filtering out (MIP_VSSIP | MIP_VSTIP | MIP_VSEIP) from S-mode
pending interrupts without apparent reason. There's no special treatment
for these ints as far as the spec goes, and this filtering is causing
read_stopi() to miss those VS interrupts [1].

We shouldn't return delegated VS interrupts in S-mode though, so change
the current mask with "~env->hideleg". Note that this is the same
handling we're doing in riscv_cpu_mirq_pending() and env->mideleg.

[1] https://gitlab.com/qemu-project/qemu/-/issues/2820

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2820
Signed-off-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251022124340.493358-1-dbarboza@ventanamicro.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
Cc: qemu-stable@nongnu.org
---
 target/riscv/cpu_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 3479a62cc7..360db133e2 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -443,8 +443,7 @@ int riscv_cpu_mirq_pending(CPURISCVState *env)
 
 int riscv_cpu_sirq_pending(CPURISCVState *env)
 {
-    uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg &
-                    ~(MIP_VSSIP | MIP_VSTIP | MIP_VSEIP);
+    uint64_t irqs = riscv_cpu_all_pending(env) & env->mideleg & ~env->hideleg;
     uint64_t irqs_f = env->mvip & env->mvien & ~env->mideleg & env->sie;
 
     return riscv_cpu_pending_to_irq(env, IRQ_S_EXT, IPRIO_DEFAULT_S,

From a66d9c37984317cf453a3d1c7341be1d54bb9863 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Tue, 21 Oct 2025 14:07:14 +0900
Subject: [PATCH 1623/2396] target/riscv: Fix a uninitialized variable warning

riscv_cpu_validate_v() left its variable, min_vlen, uninitialized if
no vector extension is available, causing a compiler warning.

Re-define riscv_cpu_validate_v() as no-op when no vector extension is
available to prevent the scenario that will read the unintialized
variable by construction. It also simplifies its caller as a bonus.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Message-ID: <20251021-vlen-v2-1-1fb581d4c6bf@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/tcg/tcg-cpu.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/riscv/tcg/tcg-cpu.c b/target/riscv/tcg/tcg-cpu.c
index 1150bd1469..d3968251fa 100644
--- a/target/riscv/tcg/tcg-cpu.c
+++ b/target/riscv/tcg/tcg-cpu.c
@@ -426,6 +426,8 @@ static void riscv_cpu_validate_v(CPURISCVState *env, RISCVCPUConfig *cfg,
         min_vlen = 64;
     } else if (cfg->ext_zve32x) {
         min_vlen = 32;
+    } else {
+        return;
     }
 
     if (vlen > RV_VLEN_MAX || vlen < min_vlen) {
@@ -676,12 +678,10 @@ void riscv_cpu_validate_set_extensions(RISCVCPU *cpu, Error **errp)
         return;
     }
 
-    if (cpu->cfg.ext_zve32x) {
-        riscv_cpu_validate_v(env, &cpu->cfg, &local_err);
-        if (local_err != NULL) {
-            error_propagate(errp, local_err);
-            return;
-        }
+    riscv_cpu_validate_v(env, &cpu->cfg, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
     }
 
     /* The Zve64d extension depends on the Zve64f extension */

From 8c9a22b8d626a50985bdd4401013479a71e23f13 Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Wed, 22 Oct 2025 10:41:40 +0800
Subject: [PATCH 1624/2396] target/riscv: Make PMP granularity configurable

Previously, the PMP granularity in qemu always used a minimum
granularity of 4 bytes, this patch add pmp-granularity to allow
platforms to configure the value.

A new CPU parameter pmp-granularity has been introduced to the QEMU
command line. For example:

        -cpu rv64, g=true, c=true, pmp=true, pmp-granularity=1024

If no specific value is provided, the default value is 4 bytes.

Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251022024141.42178-2-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/cpu.c                | 39 +++++++++++++++++++++++++++++++
 target/riscv/cpu.h                |  1 +
 target/riscv/cpu_cfg_fields.h.inc |  1 +
 3 files changed, 41 insertions(+)

diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
index a877018ab0..73d4280d7c 100644
--- a/target/riscv/cpu.c
+++ b/target/riscv/cpu.c
@@ -1121,6 +1121,7 @@ static void riscv_cpu_init(Object *obj)
     cpu->cfg.cbop_blocksize = 64;
     cpu->cfg.cboz_blocksize = 64;
     cpu->cfg.pmp_regions = 16;
+    cpu->cfg.pmp_granularity = MIN_RISCV_PMP_GRANULARITY;
     cpu->env.vext_ver = VEXT_VERSION_1_00_0;
     cpu->cfg.max_satp_mode = -1;
 
@@ -1606,6 +1607,43 @@ static const PropertyInfo prop_num_pmp_regions = {
     .set = prop_num_pmp_regions_set,
 };
 
+static void prop_pmp_granularity_set(Object *obj, Visitor *v, const char *name,
+                                     void *opaque, Error **errp)
+{
+    RISCVCPU *cpu = RISCV_CPU(obj);
+    uint32_t value;
+
+    visit_type_uint32(v, name, &value, errp);
+
+    if ((value < MIN_RISCV_PMP_GRANULARITY) && (value & (value - 1))) {
+        error_setg(errp, "PMP granularity must be a power of 2 and at least %d",
+                   MIN_RISCV_PMP_GRANULARITY);
+        return;
+    }
+
+    if (cpu->cfg.pmp_granularity != value && riscv_cpu_is_vendor(obj)) {
+        cpu_set_prop_err(cpu, name, errp);
+        return;
+    }
+
+    cpu_option_add_user_setting(name, value);
+    cpu->cfg.pmp_granularity = value;
+}
+
+static void prop_pmp_granularity_get(Object *obj, Visitor *v, const char *name,
+                                     void *opaque, Error **errp)
+{
+    uint32_t value = RISCV_CPU(obj)->cfg.pmp_granularity;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
+static const PropertyInfo prop_pmp_granularity = {
+    .description = "pmp-granularity",
+    .get = prop_pmp_granularity_get,
+    .set = prop_pmp_granularity_set,
+};
+
 static int priv_spec_from_str(const char *priv_spec_str)
 {
     int priv_version = -1;
@@ -2606,6 +2644,7 @@ static const Property riscv_cpu_properties[] = {
     {.name = "mmu", .info = &prop_mmu},
     {.name = "pmp", .info = &prop_pmp},
     {.name = "num-pmp-regions", .info = &prop_num_pmp_regions},
+    {.name = "pmp-granularity", .info = &prop_pmp_granularity},
 
     {.name = "priv_spec", .info = &prop_priv_spec},
     {.name = "vext_spec", .info = &prop_vext_spec},
diff --git a/target/riscv/cpu.h b/target/riscv/cpu.h
index 4c13012442..36e7f10037 100644
--- a/target/riscv/cpu.h
+++ b/target/riscv/cpu.h
@@ -176,6 +176,7 @@ extern RISCVCPUImpliedExtsRule *riscv_multi_ext_implied_rules[];
 
 #define MAX_RISCV_PMPS (64)
 #define OLD_MAX_RISCV_PMPS (16)
+#define MIN_RISCV_PMP_GRANULARITY 4
 
 #if !defined(CONFIG_USER_ONLY)
 #include "pmp.h"
diff --git a/target/riscv/cpu_cfg_fields.h.inc b/target/riscv/cpu_cfg_fields.h.inc
index e2d116f0df..a154ecdc79 100644
--- a/target/riscv/cpu_cfg_fields.h.inc
+++ b/target/riscv/cpu_cfg_fields.h.inc
@@ -166,6 +166,7 @@ TYPED_FIELD(uint16_t, cbom_blocksize, 0)
 TYPED_FIELD(uint16_t, cbop_blocksize, 0)
 TYPED_FIELD(uint16_t, cboz_blocksize, 0)
 TYPED_FIELD(uint8_t,  pmp_regions, 0)
+TYPED_FIELD(uint32_t, pmp_granularity, 0)
 
 TYPED_FIELD(int8_t, max_satp_mode, -1)
 

From eccf20c02a5ad913a910444dc6bbe5de0952d254 Mon Sep 17 00:00:00 2001
From: Jay Chang <jay.chang@sifive.com>
Date: Wed, 22 Oct 2025 10:41:41 +0800
Subject: [PATCH 1625/2396] target/riscv: Make PMP CSRs conform to WARL
 constraints

This patch ensure pmpcfg and pmpaddr comply with WARL constraints.

When the PMP granularity is greater than 4 bytes, NA4 mode is not valid
per the spec and will be silently ignored.

According to the spec, changing pmpcfg.A only affects the "read" value
of pmpaddr. When G > 2 and pmpcfg.A is NAPOT, bits pmpaddr[G-2:0] read
as all ones. When G > 1 and pmpcfg.A is OFF or TOR, bits pmpaddr[G-1:0]
read as all zeros. This allows software to read back the correct
granularity value.

In addition, when updating the PMP address rule in TOR mode,
the start and end addresses of the PMP region should be aligned
to the PMP granularity. (The current SPEC only state in TOR mode
that bits pmpaddr[G-1:0] do not affect the TOR address-matching logic.)

Signed-off-by: Jay Chang <jay.chang@sifive.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Reviewed-by: Jim Shu <jim.shu@sifive.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251022024141.42178-3-jay.chang@sifive.com>
Signed-off-by: Alistair Francis <alistair.francis@wdc.com>
---
 target/riscv/pmp.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/target/riscv/pmp.c b/target/riscv/pmp.c
index 72f1372a49..3ef62d26ad 100644
--- a/target/riscv/pmp.c
+++ b/target/riscv/pmp.c
@@ -108,6 +108,17 @@ static int pmp_is_invalid_smepmp_cfg(CPURISCVState *env, uint8_t val)
         g_assert_not_reached();
     }
 }
+/*
+ * Calculate PMP granularity value 'g'
+ *
+ * The granularity value 'g' is defined as log2(granularity) - 2, where
+ * granularity is the minimum alignment requirement for PMP regions in bytes.
+ */
+static inline int pmp_get_granularity_g(CPURISCVState *env)
+{
+    return __builtin_ctz(riscv_cpu_cfg(env)->pmp_granularity >> 2);
+}
+
 
 /*
  * Count the number of active rules.
@@ -153,6 +164,15 @@ static bool pmp_write_cfg(CPURISCVState *env, uint32_t pmp_index, uint8_t val)
             qemu_log_mask(LOG_GUEST_ERROR,
                           "ignoring pmpcfg write - invalid\n");
         } else {
+            uint8_t a_field = pmp_get_a_field(val);
+            /*
+             * When granularity g >= 1 (i.e., granularity > 4 bytes),
+             * the NA4 (Naturally Aligned 4-byte) mode is not selectable
+             */
+            if ((riscv_cpu_cfg(env)->pmp_granularity >
+                MIN_RISCV_PMP_GRANULARITY) && (a_field == PMP_AMATCH_NA4)) {
+                    return false;
+            }
             env->pmp_state.pmp[pmp_index].cfg_reg = val;
             pmp_update_rule_addr(env, pmp_index);
             return true;
@@ -199,6 +219,7 @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
     target_ulong prev_addr = 0u;
     hwaddr sa = 0u;
     hwaddr ea = 0u;
+    int g = pmp_get_granularity_g(env);
 
     if (pmp_index >= 1u) {
         prev_addr = env->pmp_state.pmp[pmp_index - 1].addr_reg;
@@ -211,6 +232,11 @@ void pmp_update_rule_addr(CPURISCVState *env, uint32_t pmp_index)
         break;
 
     case PMP_AMATCH_TOR:
+        /* Bits pmpaddr[G-1:0] do not affect the TOR address-matching logic. */
+        if (g >= 1) {
+            prev_addr &= ~((1ULL << g) - 1ULL);
+            this_addr &= ~((1ULL << g) - 1ULL);
+        }
         if (prev_addr >= this_addr) {
             sa = ea = 0u;
             break;
@@ -577,6 +603,7 @@ void pmpaddr_csr_write(CPURISCVState *env, uint32_t addr_index,
 
 /*
  * Handle a read from a pmpaddr CSR
+ * Change A field of pmpcfg affects the read value of pmpaddr
  */
 target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 {
@@ -585,6 +612,25 @@ target_ulong pmpaddr_csr_read(CPURISCVState *env, uint32_t addr_index)
 
     if (addr_index < pmp_regions) {
         val = env->pmp_state.pmp[addr_index].addr_reg;
+        int g = pmp_get_granularity_g(env);
+        switch (pmp_get_a_field(env->pmp_state.pmp[addr_index].cfg_reg)) {
+        case PMP_AMATCH_OFF:
+            /* fallthrough */
+        case PMP_AMATCH_TOR:
+            /* Bit [g-1:0] read all zero */
+            if (g >= 1 && g < TARGET_LONG_BITS) {
+                val &= ~((1ULL << g) - 1ULL);
+            }
+            break;
+        case PMP_AMATCH_NAPOT:
+            /* Bit [g-2:0] read all one */
+            if (g >= 2 && g < TARGET_LONG_BITS) {
+                val |= ((1ULL << (g - 1)) - 1ULL);
+            }
+            break;
+        default:
+            break;
+        }
         trace_pmpaddr_csr_read(env->mhartid, addr_index, val);
     } else {
         qemu_log_mask(LOG_GUEST_ERROR,

From 6a9e81b705c04b7488e49103c51ee209065c83e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 6 Oct 2025 19:46:21 +0100
Subject: [PATCH 1626/2396] crypto: propagate Error object on premature
 termination
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The way that premature termination was handled in TLS connections was
changed to handle an ordering problem during graceful shutdown in the
migration code.

Unfortunately one of the codepaths returned -1 to indicate an error
condition, but failed to set the 'errp' parameter.

This broke error handling in the qio_channel_tls_handshake function,
as the QTask callback would no longer see that an error was raised.
As a result, the client will go on to try to use the already closed
TLS connection, resulting in misleading errors.

This was evidenced in the I/O test 233 which showed changes such as

-qemu-nbd: Certificate does not match the hostname localhost
+qemu-nbd: Failed to read initial magic: Unable to read from socket: Connection reset by peer

Fixes: 7e0c22d585581b8083ffdeb332ea497218665daf
Acked-by: Peter Xu <peterx@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlssession.c |  8 +++++---
 io/channel-tls.c    | 13 +++++++------
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index ac38c2121d..8c0bf457ad 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -569,8 +569,6 @@ qcrypto_tls_session_read(QCryptoTLSSession *session,
     if (ret < 0) {
         if (ret == GNUTLS_E_AGAIN) {
             return QCRYPTO_TLS_SESSION_ERR_BLOCK;
-        } else if (ret == GNUTLS_E_PREMATURE_TERMINATION) {
-            return QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION;
         } else {
             if (session->rerr) {
                 error_propagate(errp, session->rerr);
@@ -580,7 +578,11 @@ qcrypto_tls_session_read(QCryptoTLSSession *session,
                            "Cannot read from TLS channel: %s",
                            gnutls_strerror(ret));
             }
-            return -1;
+            if (ret == GNUTLS_E_PREMATURE_TERMINATION) {
+                return QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION;
+            } else {
+                return -1;
+            }
         }
     }
 
diff --git a/io/channel-tls.c b/io/channel-tls.c
index 1fbed4be0c..70fad38d18 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -368,6 +368,7 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
                                      int flags,
                                      Error **errp)
 {
+    ERRP_GUARD();
     QIOChannelTLS *tioc = QIO_CHANNEL_TLS(ioc);
     size_t i;
     ssize_t got = 0;
@@ -384,13 +385,13 @@ static ssize_t qio_channel_tls_readv(QIOChannel *ioc,
             } else {
                 return QIO_CHANNEL_ERR_BLOCK;
             }
-        } else if (ret == QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION) {
-            if (qio_channel_tls_allow_premature_termination(tioc, flags)) {
-                ret = 0;
-            } else {
-                return -1;
-            }
         } else if (ret < 0) {
+            if (ret == QCRYPTO_TLS_SESSION_PREMATURE_TERMINATION &&
+                qio_channel_tls_allow_premature_termination(tioc, flags)) {
+                error_free(*errp);
+                *errp = NULL;
+                return got;
+            }
             return -1;
         }
         got += ret;

From 7249713b4f3a0c0ae5e83015f9889d1c3d75218d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 1 Aug 2025 17:39:58 +0100
Subject: [PATCH 1627/2396] qom: use ERRP_GUARD in user_creatable_complete
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

With error_propagate, the stack trace from any error_abort/fatal
usage will start from the error_propagate() call, which is largely
useless. Using ERRP_GUARD ensures the stack trace starts from
the origin that reported the error.

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 qom/object_interfaces.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/qom/object_interfaces.c b/qom/object_interfaces.c
index 1ffea1a728..415cbee8c5 100644
--- a/qom/object_interfaces.c
+++ b/qom/object_interfaces.c
@@ -24,13 +24,12 @@
 bool user_creatable_complete(UserCreatable *uc, Error **errp)
 {
     UserCreatableClass *ucc = USER_CREATABLE_GET_CLASS(uc);
-    Error *err = NULL;
+    ERRP_GUARD();
 
     if (ucc->complete) {
-        ucc->complete(uc, &err);
-        error_propagate(errp, err);
+        ucc->complete(uc, errp);
     }
-    return !err;
+    return !*errp;
 }
 
 bool user_creatable_can_be_deleted(UserCreatable *uc)

From e60eff91ef347361411c5173c829a8a94acf8795 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 3 Mar 2022 16:34:51 +0000
Subject: [PATCH 1628/2396] tests: use macros for registering char tests for
 sockets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The test-char.c has a couple of helper macros for registering tests that
need to be repeated for both IP and UNIX sockets. One test case was not
using the macro though.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-char.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/tests/unit/test-char.c b/tests/unit/test-char.c
index f30a39f61f..e156b17329 100644
--- a/tests/unit/test-char.c
+++ b/tests/unit/test-char.c
@@ -1934,7 +1934,9 @@ int main(int argc, char **argv)
     g_test_add_data_func("/char/socket/server/mainloop-fdpass/" # name, \
                          &server3 ##name, char_socket_server_test);     \
     g_test_add_data_func("/char/socket/server/wait-conn-fdpass/" # name, \
-                         &server4 ##name, char_socket_server_test)
+                         &server4 ##name, char_socket_server_test);     \
+    g_test_add_data_func("/char/socket/server/two-clients/" # name,     \
+                         addr, char_socket_server_two_clients_test)
 
 #define SOCKET_CLIENT_TEST(name, addr)                                  \
     static CharSocketClientTestConfig client1 ## name =                 \
@@ -1974,14 +1976,10 @@ int main(int argc, char **argv)
     if (has_ipv4) {
         SOCKET_SERVER_TEST(tcp, &tcpaddr);
         SOCKET_CLIENT_TEST(tcp, &tcpaddr);
-        g_test_add_data_func("/char/socket/server/two-clients/tcp", &tcpaddr,
-                             char_socket_server_two_clients_test);
     }
 #ifndef WIN32
     SOCKET_SERVER_TEST(unix, &unixaddr);
     SOCKET_CLIENT_TEST(unix, &unixaddr);
-    g_test_add_data_func("/char/socket/server/two-clients/unix", &unixaddr,
-                         char_socket_server_two_clients_test);
 #endif
 
     g_test_add_func("/char/udp", char_udp_test);

From 2c147611cf568eb1cd7dc8bf4479b272bad3b9d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 3 Oct 2025 14:22:12 +0100
Subject: [PATCH 1629/2396] io: release active GSource in TLS channel finalizer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While code is supposed to call qio_channel_close() before releasing the
last reference on an QIOChannel, this is not guaranteed. QIOChannelFile
and QIOChannelSocket both cleanup resources in their finalizer if the
close operation was missed.

This ensures the TLS channel will do the same failsafe cleanup.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 io/channel-tls.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/io/channel-tls.c b/io/channel-tls.c
index 70fad38d18..ce041795c1 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -342,6 +342,16 @@ static void qio_channel_tls_finalize(Object *obj)
 {
     QIOChannelTLS *ioc = QIO_CHANNEL_TLS(obj);
 
+    if (ioc->hs_ioc_tag) {
+        trace_qio_channel_tls_handshake_cancel(ioc);
+        g_clear_handle_id(&ioc->hs_ioc_tag, g_source_remove);
+    }
+
+    if (ioc->bye_ioc_tag) {
+        trace_qio_channel_tls_bye_cancel(ioc);
+        g_clear_handle_id(&ioc->bye_ioc_tag, g_source_remove);
+    }
+
     object_unref(OBJECT(ioc->master));
     qcrypto_tls_session_free(ioc->session);
 }

From 322c3c4f3abee616a18b3bfe563ec29dd67eae63 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Sep 2025 11:58:35 +0100
Subject: [PATCH 1630/2396] io: move websock resource release to close method
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The QIOChannelWebsock object releases all its resources in the
finalize callback. This is later than desired, as callers expect
to be able to call qio_channel_close() to fully close a channel
and release resources related to I/O.

The logic in the finalize method is at most a failsafe to handle
cases where a consumer forgets to call qio_channel_close.

This adds equivalent logic to the close method to release the
resources, using g_clear_handle_id/g_clear_pointer to be robust
against repeated invocations. The finalize method is tweaked
so that the GSource is removed before releasing the underlying
channel.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 io/channel-websock.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/io/channel-websock.c b/io/channel-websock.c
index 0a8c5c4712..a50a160e18 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -922,13 +922,13 @@ static void qio_channel_websock_finalize(Object *obj)
     buffer_free(&ioc->encinput);
     buffer_free(&ioc->encoutput);
     buffer_free(&ioc->rawinput);
-    object_unref(OBJECT(ioc->master));
     if (ioc->io_tag) {
         g_source_remove(ioc->io_tag);
     }
     if (ioc->io_err) {
         error_free(ioc->io_err);
     }
+    object_unref(OBJECT(ioc->master));
 }
 
 
@@ -1218,6 +1218,15 @@ static int qio_channel_websock_close(QIOChannel *ioc,
     QIOChannelWebsock *wioc = QIO_CHANNEL_WEBSOCK(ioc);
 
     trace_qio_channel_websock_close(ioc);
+    buffer_free(&wioc->encinput);
+    buffer_free(&wioc->encoutput);
+    buffer_free(&wioc->rawinput);
+    if (wioc->io_tag) {
+        g_clear_handle_id(&wioc->io_tag, g_source_remove);
+    }
+    if (wioc->io_err) {
+        g_clear_pointer(&wioc->io_err, error_free);
+    }
     return qio_channel_close(wioc->master, errp);
 }
 

From b7a1f2ca45c7865b9e98e02ae605a65fc9458ae9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 30 Sep 2025 12:03:15 +0100
Subject: [PATCH 1631/2396] io: fix use after free in websocket handshake code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the QIOChannelWebsock object is freed while it is waiting to
complete a handshake, a GSource is leaked. This can lead to the
callback firing later on and triggering a use-after-free in the
use of the channel. This was observed in the VNC server with the
following trace from valgrind:

==2523108== Invalid read of size 4
==2523108==    at 0x4054A24: vnc_disconnect_start (vnc.c:1296)
==2523108==    by 0x4054A24: vnc_client_error (vnc.c:1392)
==2523108==    by 0x4068A09: vncws_handshake_done (vnc-ws.c:105)
==2523108==    by 0x44863B4: qio_task_complete (task.c:197)
==2523108==    by 0x448343D: qio_channel_websock_handshake_io (channel-websock.c:588)
==2523108==    by 0x6EDB862: UnknownInlinedFun (gmain.c:3398)
==2523108==    by 0x6EDB862: g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4249)
==2523108==    by 0x6EDBAE4: g_main_context_dispatch (gmain.c:4237)
==2523108==    by 0x45EC79F: glib_pollfds_poll (main-loop.c:287)
==2523108==    by 0x45EC79F: os_host_main_loop_wait (main-loop.c:310)
==2523108==    by 0x45EC79F: main_loop_wait (main-loop.c:589)
==2523108==    by 0x423A56D: qemu_main_loop (runstate.c:835)
==2523108==    by 0x454F300: qemu_default_main (main.c:37)
==2523108==    by 0x73D6574: (below main) (libc_start_call_main.h:58)
==2523108==  Address 0x57a6e0dc is 28 bytes inside a block of size 103,608 free'd
==2523108==    at 0x5F2FE43: free (vg_replace_malloc.c:989)
==2523108==    by 0x6EDC444: g_free (gmem.c:208)
==2523108==    by 0x4053F23: vnc_update_client (vnc.c:1153)
==2523108==    by 0x4053F23: vnc_refresh (vnc.c:3225)
==2523108==    by 0x4042881: dpy_refresh (console.c:880)
==2523108==    by 0x4042881: gui_update (console.c:90)
==2523108==    by 0x45EFA1B: timerlist_run_timers.part.0 (qemu-timer.c:562)
==2523108==    by 0x45EFC8F: timerlist_run_timers (qemu-timer.c:495)
==2523108==    by 0x45EFC8F: qemu_clock_run_timers (qemu-timer.c:576)
==2523108==    by 0x45EFC8F: qemu_clock_run_all_timers (qemu-timer.c:663)
==2523108==    by 0x45EC765: main_loop_wait (main-loop.c:600)
==2523108==    by 0x423A56D: qemu_main_loop (runstate.c:835)
==2523108==    by 0x454F300: qemu_default_main (main.c:37)
==2523108==    by 0x73D6574: (below main) (libc_start_call_main.h:58)
==2523108==  Block was alloc'd at
==2523108==    at 0x5F343F3: calloc (vg_replace_malloc.c:1675)
==2523108==    by 0x6EE2F81: g_malloc0 (gmem.c:133)
==2523108==    by 0x4057DA3: vnc_connect (vnc.c:3245)
==2523108==    by 0x448591B: qio_net_listener_channel_func (net-listener.c:54)
==2523108==    by 0x6EDB862: UnknownInlinedFun (gmain.c:3398)
==2523108==    by 0x6EDB862: g_main_context_dispatch_unlocked.lto_priv.0 (gmain.c:4249)
==2523108==    by 0x6EDBAE4: g_main_context_dispatch (gmain.c:4237)
==2523108==    by 0x45EC79F: glib_pollfds_poll (main-loop.c:287)
==2523108==    by 0x45EC79F: os_host_main_loop_wait (main-loop.c:310)
==2523108==    by 0x45EC79F: main_loop_wait (main-loop.c:589)
==2523108==    by 0x423A56D: qemu_main_loop (runstate.c:835)
==2523108==    by 0x454F300: qemu_default_main (main.c:37)
==2523108==    by 0x73D6574: (below main) (libc_start_call_main.h:58)
==2523108==

The above can be reproduced by launching QEMU with

  $ qemu-system-x86_64 -vnc localhost:0,websocket=5700

and then repeatedly running:

  for i in {1..100}; do
     (echo -n "GET / HTTP/1.1" && sleep 0.05) | nc -w 1 localhost 5700 &
  done

CVE-2025-11234
Reported-by: Grant Millar | Cylo <rid@cylo.io>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel-websock.h |  3 ++-
 io/channel-websock.c         | 22 ++++++++++++++++------
 2 files changed, 18 insertions(+), 7 deletions(-)

diff --git a/include/io/channel-websock.h b/include/io/channel-websock.h
index e180827c57..6700cf8946 100644
--- a/include/io/channel-websock.h
+++ b/include/io/channel-websock.h
@@ -61,7 +61,8 @@ struct QIOChannelWebsock {
     size_t payload_remain;
     size_t pong_remain;
     QIOChannelWebsockMask mask;
-    guint io_tag;
+    guint hs_io_tag; /* tracking handshake task */
+    guint io_tag; /* tracking watch task */
     Error *io_err;
     gboolean io_eof;
     uint8_t opcode;
diff --git a/io/channel-websock.c b/io/channel-websock.c
index a50a160e18..cb4dafdebb 100644
--- a/io/channel-websock.c
+++ b/io/channel-websock.c
@@ -545,6 +545,7 @@ static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc,
         trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err));
         qio_task_set_error(task, err);
         qio_task_complete(task);
+        wioc->hs_io_tag = 0;
         return FALSE;
     }
 
@@ -560,6 +561,7 @@ static gboolean qio_channel_websock_handshake_send(QIOChannel *ioc,
             trace_qio_channel_websock_handshake_complete(ioc);
             qio_task_complete(task);
         }
+        wioc->hs_io_tag = 0;
         return FALSE;
     }
     trace_qio_channel_websock_handshake_pending(ioc, G_IO_OUT);
@@ -586,6 +588,7 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
         trace_qio_channel_websock_handshake_fail(ioc, error_get_pretty(err));
         qio_task_set_error(task, err);
         qio_task_complete(task);
+        wioc->hs_io_tag = 0;
         return FALSE;
     }
     if (ret == 0) {
@@ -597,7 +600,7 @@ static gboolean qio_channel_websock_handshake_io(QIOChannel *ioc,
     error_propagate(&wioc->io_err, err);
 
     trace_qio_channel_websock_handshake_reply(ioc);
-    qio_channel_add_watch(
+    wioc->hs_io_tag = qio_channel_add_watch(
         wioc->master,
         G_IO_OUT,
         qio_channel_websock_handshake_send,
@@ -907,11 +910,12 @@ void qio_channel_websock_handshake(QIOChannelWebsock *ioc,
 
     trace_qio_channel_websock_handshake_start(ioc);
     trace_qio_channel_websock_handshake_pending(ioc, G_IO_IN);
-    qio_channel_add_watch(ioc->master,
-                          G_IO_IN,
-                          qio_channel_websock_handshake_io,
-                          task,
-                          NULL);
+    ioc->hs_io_tag = qio_channel_add_watch(
+        ioc->master,
+        G_IO_IN,
+        qio_channel_websock_handshake_io,
+        task,
+        NULL);
 }
 
 
@@ -922,6 +926,9 @@ static void qio_channel_websock_finalize(Object *obj)
     buffer_free(&ioc->encinput);
     buffer_free(&ioc->encoutput);
     buffer_free(&ioc->rawinput);
+    if (ioc->hs_io_tag) {
+        g_source_remove(ioc->hs_io_tag);
+    }
     if (ioc->io_tag) {
         g_source_remove(ioc->io_tag);
     }
@@ -1221,6 +1228,9 @@ static int qio_channel_websock_close(QIOChannel *ioc,
     buffer_free(&wioc->encinput);
     buffer_free(&wioc->encoutput);
     buffer_free(&wioc->rawinput);
+    if (wioc->hs_io_tag) {
+        g_clear_handle_id(&wioc->hs_io_tag, g_source_remove);
+    }
     if (wioc->io_tag) {
         g_clear_handle_id(&wioc->io_tag, g_source_remove);
     }

From 75216f239f663f66ea0358a6fc2354d39909c1e3 Mon Sep 17 00:00:00 2001
From: Henry Kleynhans <hkleynhans@fb.com>
Date: Wed, 22 Dec 2021 15:06:00 +0000
Subject: [PATCH 1632/2396] crypto: only verify CA certs in chain of trust
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CA file provided to qemu may contain CA certificates which do not
form part of the chain of trust for the specific certificate we are
sanity checking.

This patch changes the sanity checking from validating every CA
certificate to only checking the CA certificates which are part of the
chain of trust (issuer chain).  Other certificates are ignored.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Henry Kleynhans <hkleynhans@fb.com>
[DB: changed 'int' to 'bool' in 'checking_issuer' variable]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c                 | 57 ++++++++++++++++++++++++---
 tests/unit/test-crypto-tlscredsx509.c | 25 +++++++++++-
 2 files changed, 75 insertions(+), 7 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index cd1f504471..3df2a33b0b 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -315,6 +315,51 @@ qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
     return 0;
 }
 
+static int
+qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
+                                        gnutls_x509_crt_t cert,
+                                        gnutls_x509_crt_t *cacerts,
+                                        unsigned int ncacerts,
+                                        const char *cacertFile,
+                                        bool isServer,
+                                        bool isCA,
+                                        Error **errp)
+{
+    gnutls_x509_crt_t *cert_to_check = &cert;
+    bool checking_issuer = true;
+    int retval = 0;
+
+    while (checking_issuer) {
+        checking_issuer = false;
+
+        if (gnutls_x509_crt_check_issuer(*cert_to_check,
+                                         *cert_to_check)) {
+            /*
+             * The cert is self-signed indicating we have
+             * reached the root of trust.
+             */
+            return qcrypto_tls_creds_check_cert(
+                creds, *cert_to_check, cacertFile,
+                isServer, isCA, errp);
+        }
+        for (int i = 0; i < ncacerts; i++) {
+            if (gnutls_x509_crt_check_issuer(*cert_to_check,
+                                             cacerts[i])) {
+                retval = qcrypto_tls_creds_check_cert(
+                    creds, cacerts[i], cacertFile,
+                    isServer, isCA, errp);
+                if (retval < 0) {
+                    return retval;
+                }
+                cert_to_check = &cacerts[i];
+                checking_issuer = true;
+                break;
+            }
+        }
+    }
+
+    return -1;
+}
 
 static int
 qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
@@ -499,12 +544,12 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
         goto cleanup;
     }
 
-    for (i = 0; i < ncacerts; i++) {
-        if (qcrypto_tls_creds_check_cert(creds,
-                                         cacerts[i], cacertFile,
-                                         isServer, true, errp) < 0) {
-            goto cleanup;
-        }
+    if (cert &&
+        qcrypto_tls_creds_check_authority_chain(creds, cert,
+                                                cacerts, ncacerts,
+                                                cacertFile, isServer,
+                                                true, errp) < 0) {
+        goto cleanup;
     }
 
     if (cert && ncacerts &&
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index 3c25d75ca1..a7ea5f422d 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -589,6 +589,12 @@ int main(int argc, char **argv)
                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
                  false, false, NULL, NULL,
                  0, 0);
+    TLS_CERT_REQ(cacertlevel1creq_invalid, cacertrootreq,
+                 "UK", "qemu level 1c invalid", NULL, NULL, NULL, NULL,
+                 true, true, true,
+                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+                 false, false, NULL, NULL,
+                 360, 400);
     TLS_CERT_REQ(cacertlevel2areq, cacertlevel1areq,
                  "UK", "qemu level 2a", NULL, NULL, NULL, NULL,
                  true, true, true,
@@ -617,16 +623,32 @@ int main(int argc, char **argv)
         cacertlevel2areq.crt,
     };
 
+
     test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
                               certchain,
                               G_N_ELEMENTS(certchain));
 
+    gnutls_x509_crt_t certchain_with_invalid[] = {
+        cacertrootreq.crt,
+        cacertlevel1areq.crt,
+        cacertlevel1breq.crt,
+        cacertlevel1creq_invalid.crt,
+        cacertlevel2areq.crt,
+    };
+
+    test_tls_write_cert_chain(WORKDIR "cacertchain-with-invalid-ctx.pem",
+                              certchain_with_invalid,
+                              G_N_ELEMENTS(certchain_with_invalid));
+
     TLS_TEST_REG(chain1, true,
                  WORKDIR "cacertchain-ctx.pem",
                  servercertlevel3areq.filename, false);
     TLS_TEST_REG(chain2, false,
                  WORKDIR "cacertchain-ctx.pem",
                  clientcertlevel2breq.filename, false);
+    TLS_TEST_REG(certchainwithexpiredcert, false,
+                 WORKDIR "cacertchain-with-invalid-ctx.pem",
+                 clientcertlevel2breq.filename, false);
 
     /* Some missing certs - first two are fatal, the last
      * is ok
@@ -640,7 +662,6 @@ int main(int argc, char **argv)
     TLS_TEST_REG(missingclient, false,
                  cacert1req.filename,
                  "clientcertdoesnotexist.pem", false);
-
     ret = g_test_run();
 
     test_tls_discard_cert(&cacertreq);
@@ -694,10 +715,12 @@ int main(int argc, char **argv)
     test_tls_discard_cert(&cacertrootreq);
     test_tls_discard_cert(&cacertlevel1areq);
     test_tls_discard_cert(&cacertlevel1breq);
+    test_tls_discard_cert(&cacertlevel1creq_invalid);
     test_tls_discard_cert(&cacertlevel2areq);
     test_tls_discard_cert(&servercertlevel3areq);
     test_tls_discard_cert(&clientcertlevel2breq);
     unlink(WORKDIR "cacertchain-ctx.pem");
+    unlink(WORKDIR "cacertchain-with-invalid-ctx.pem");
 
     test_tls_cleanup(KEYFILE);
     rmdir(WORKDIR);

From 068e0379af39e5f02fc3e47f7638af194695c990 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 11 Jul 2025 13:30:07 +0100
Subject: [PATCH 1633/2396] crypto: remove extraneous pointer usage in gnutls
 certs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'gnutls_x509_crt_t' type is already a pointer, not a struct,
so the extra level of pointer indirection is not needed.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 3df2a33b0b..4169ad9a75 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -325,25 +325,25 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
                                         bool isCA,
                                         Error **errp)
 {
-    gnutls_x509_crt_t *cert_to_check = &cert;
+    gnutls_x509_crt_t cert_to_check = cert;
     bool checking_issuer = true;
     int retval = 0;
 
     while (checking_issuer) {
         checking_issuer = false;
 
-        if (gnutls_x509_crt_check_issuer(*cert_to_check,
-                                         *cert_to_check)) {
+        if (gnutls_x509_crt_check_issuer(cert_to_check,
+                                         cert_to_check)) {
             /*
              * The cert is self-signed indicating we have
              * reached the root of trust.
              */
             return qcrypto_tls_creds_check_cert(
-                creds, *cert_to_check, cacertFile,
+                creds, cert_to_check, cacertFile,
                 isServer, isCA, errp);
         }
         for (int i = 0; i < ncacerts; i++) {
-            if (gnutls_x509_crt_check_issuer(*cert_to_check,
+            if (gnutls_x509_crt_check_issuer(cert_to_check,
                                              cacerts[i])) {
                 retval = qcrypto_tls_creds_check_cert(
                     creds, cacerts[i], cacertFile,
@@ -351,7 +351,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
                 if (retval < 0) {
                     return retval;
                 }
-                cert_to_check = &cacerts[i];
+                cert_to_check = cacerts[i];
                 checking_issuer = true;
                 break;
             }

From d37677602a76557f9096ce35eaf25296c7da636c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 20 Oct 2025 15:04:39 +0100
Subject: [PATCH 1634/2396] crypto: validate an error is reported in test
 expected fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There was a bug where TLS x509 credentials validation failed
to fill out the Error object. Validate this in the failure
scenarios.

Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/unit/test-crypto-tlscredsx509.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index a7ea5f422d..85f51aee1b 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -73,6 +73,7 @@ static void test_tls_creds(const void *opaque)
     struct QCryptoTLSCredsTestData *data =
         (struct QCryptoTLSCredsTestData *)opaque;
     QCryptoTLSCreds *creds;
+    Error *err = NULL;
 
 #define CERT_DIR "tests/test-crypto-tlscredsx509-certs/"
     g_mkdir_with_parents(CERT_DIR, 0700);
@@ -111,10 +112,12 @@ static void test_tls_creds(const void *opaque)
          QCRYPTO_TLS_CREDS_ENDPOINT_SERVER :
          QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT),
         CERT_DIR,
-        data->expectFail ? NULL : &error_abort);
+        data->expectFail ? &err : &error_abort);
 
     if (data->expectFail) {
         g_assert(creds == NULL);
+        g_assert(err != NULL);
+        error_free(err);
     } else {
         g_assert(creds != NULL);
     }

From c677657e99e080a174052074ae77ff37dbe91335 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 9 Jul 2025 08:36:22 +0100
Subject: [PATCH 1635/2396] crypto: fix error reporting in cert chain checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The loop that checks the CA certificate chain can fail to report
an error message if one of the certs in the chain has an issuer
that is not present in the chain. In this case, the outer loop
'while (checking_issuer)' will terminate after failing to find
the issuer, and no error message will be reported.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c                 | 33 ++++++++++++++++++---------
 tests/unit/test-crypto-tlscredsx509.c | 12 ++++++++++
 2 files changed, 34 insertions(+), 11 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 4169ad9a75..2eccd71b3c 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -326,11 +326,11 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
                                         Error **errp)
 {
     gnutls_x509_crt_t cert_to_check = cert;
-    bool checking_issuer = true;
     int retval = 0;
+    gnutls_datum_t dn = {};
 
-    while (checking_issuer) {
-        checking_issuer = false;
+    for (;;) {
+        gnutls_x509_crt_t cert_issuer = NULL;
 
         if (gnutls_x509_crt_check_issuer(cert_to_check,
                                          cert_to_check)) {
@@ -345,19 +345,30 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
         for (int i = 0; i < ncacerts; i++) {
             if (gnutls_x509_crt_check_issuer(cert_to_check,
                                              cacerts[i])) {
-                retval = qcrypto_tls_creds_check_cert(
-                    creds, cacerts[i], cacertFile,
-                    isServer, isCA, errp);
-                if (retval < 0) {
-                    return retval;
-                }
-                cert_to_check = cacerts[i];
-                checking_issuer = true;
+                cert_issuer = cacerts[i];
                 break;
             }
         }
+        if (!cert_issuer) {
+            break;
+        }
+
+        if (qcrypto_tls_creds_check_cert(creds, cert_issuer, cacertFile,
+                                         isServer, isCA, errp) < 0) {
+            return -1;
+        }
+
+        cert_to_check = cert_issuer;
     }
 
+    retval = gnutls_x509_crt_get_dn2(cert_to_check, &dn);
+    if (retval < 0) {
+        error_setg(errp, "Unable to fetch cert DN: %s",
+                   gnutls_strerror(retval));
+        return -1;
+    }
+    error_setg(errp, "Cert '%s' has no issuer in CA chain", dn.data);
+    g_free(dn.data);
     return -1;
 }
 
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index 85f51aee1b..7c5df32bcc 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -643,6 +643,15 @@ int main(int argc, char **argv)
                               certchain_with_invalid,
                               G_N_ELEMENTS(certchain_with_invalid));
 
+    gnutls_x509_crt_t certchain_incomplete[] = {
+        cacertrootreq.crt,
+        cacertlevel2areq.crt,
+    };
+
+    test_tls_write_cert_chain(WORKDIR "cacertchain-incomplete-ctx.pem",
+                              certchain_incomplete,
+                              G_N_ELEMENTS(certchain_incomplete));
+
     TLS_TEST_REG(chain1, true,
                  WORKDIR "cacertchain-ctx.pem",
                  servercertlevel3areq.filename, false);
@@ -652,6 +661,9 @@ int main(int argc, char **argv)
     TLS_TEST_REG(certchainwithexpiredcert, false,
                  WORKDIR "cacertchain-with-invalid-ctx.pem",
                  clientcertlevel2breq.filename, false);
+    TLS_TEST_REG(chainincomplete, true,
+                 WORKDIR "cacertchain-incomplete-ctx.pem",
+                 servercertlevel3areq.filename, true);
 
     /* Some missing certs - first two are fatal, the last
      * is ok

From 87d6282e53a2db1915ea715cf9ee0634f6fb1c70 Mon Sep 17 00:00:00 2001
From: matoro <matoro@users.noreply.github.com>
Date: Mon, 13 Feb 2023 13:00:49 -0500
Subject: [PATCH 1636/2396] crypto: allow client/server cert chains
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The existing implementation assumes that client/server certificates are
single individual certificates.  If using publicly-issued certificates,
or internal CAs that use an intermediate issuer, this is unlikely to be
the case, and they will instead be certificate chains.  While this can
be worked around by moving the intermediate certificates to the CA
certificate, which DOES currently support multiple certificates, this
instead allows the issued certificate chains to be used as-is, without
requiring the overhead of shuffling certificates around.

Corresponding libvirt change is available here:
https://gitlab.com/libvirt/libvirt/-/merge_requests/222

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: matoro <matoro_mailinglist_qemu@matoro.tk>
[DB: adapted for code conflicts with multi-CA patch]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c                 | 157 ++++++++++++--------------
 tests/unit/test-crypto-tlscredsx509.c |  77 +++++++++++++
 2 files changed, 147 insertions(+), 87 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 2eccd71b3c..86fdfce886 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -317,7 +317,8 @@ qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
 
 static int
 qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
-                                        gnutls_x509_crt_t cert,
+                                        gnutls_x509_crt_t *certs,
+                                        unsigned int ncerts,
                                         gnutls_x509_crt_t *cacerts,
                                         unsigned int ncacerts,
                                         const char *cacertFile,
@@ -325,9 +326,32 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
                                         bool isCA,
                                         Error **errp)
 {
-    gnutls_x509_crt_t cert_to_check = cert;
+    gnutls_x509_crt_t cert_to_check = certs[ncerts - 1];
     int retval = 0;
-    gnutls_datum_t dn = {};
+    gnutls_datum_t dn = {}, dnissuer = {};
+
+    for (int i = 0; i < (ncerts - 1); i++) {
+        if (!gnutls_x509_crt_check_issuer(certs[i], certs[i + 1])) {
+            retval = gnutls_x509_crt_get_dn2(certs[i], &dn);
+            if (retval < 0) {
+                error_setg(errp, "Unable to fetch cert DN: %s",
+                           gnutls_strerror(retval));
+                return -1;
+            }
+            retval = gnutls_x509_crt_get_dn2(certs[i + 1], &dnissuer);
+            if (retval < 0) {
+                g_free(dn.data);
+                error_setg(errp, "Unable to fetch cert DN: %s",
+                           gnutls_strerror(retval));
+                return -1;
+            }
+            error_setg(errp, "Cert '%s' does not match issuer of cert '%s'",
+                       dnissuer.data, dn.data);
+            g_free(dn.data);
+            g_free(dnissuer.data);
+            return -1;
+        }
+    }
 
     for (;;) {
         gnutls_x509_crt_t cert_issuer = NULL;
@@ -373,7 +397,8 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
 }
 
 static int
-qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
+qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t *certs,
+                                  size_t ncerts,
                                   const char *certFile,
                                   gnutls_x509_crt_t *cacerts,
                                   size_t ncacerts,
@@ -383,7 +408,7 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
 {
     unsigned int status;
 
-    if (gnutls_x509_crt_list_verify(&cert, 1,
+    if (gnutls_x509_crt_list_verify(certs, ncerts,
                                     cacerts, ncacerts,
                                     NULL, 0,
                                     0, &status) < 0) {
@@ -425,66 +450,14 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t cert,
 }
 
 
-static gnutls_x509_crt_t
-qcrypto_tls_creds_load_cert(QCryptoTLSCredsX509 *creds,
-                            const char *certFile,
-                            bool isServer,
-                            Error **errp)
-{
-    gnutls_datum_t data;
-    gnutls_x509_crt_t cert = NULL;
-    g_autofree char *buf = NULL;
-    gsize buflen;
-    GError *gerr = NULL;
-    int ret = -1;
-    int err;
-
-    trace_qcrypto_tls_creds_x509_load_cert(creds, isServer, certFile);
-
-    err = gnutls_x509_crt_init(&cert);
-    if (err < 0) {
-        error_setg(errp, "Unable to initialize certificate: %s",
-                   gnutls_strerror(err));
-        goto cleanup;
-    }
-
-    if (!g_file_get_contents(certFile, &buf, &buflen, &gerr)) {
-        error_setg(errp, "Cannot load CA cert list %s: %s",
-                   certFile, gerr->message);
-        g_error_free(gerr);
-        goto cleanup;
-    }
-
-    data.data = (unsigned char *)buf;
-    data.size = strlen(buf);
-
-    err = gnutls_x509_crt_import(cert, &data, GNUTLS_X509_FMT_PEM);
-    if (err < 0) {
-        error_setg(errp, isServer ?
-                   "Unable to import server certificate %s: %s" :
-                   "Unable to import client certificate %s: %s",
-                   certFile,
-                   gnutls_strerror(err));
-        goto cleanup;
-    }
-
-    ret = 0;
-
- cleanup:
-    if (ret != 0) {
-        gnutls_x509_crt_deinit(cert);
-        cert = NULL;
-    }
-    return cert;
-}
-
-
 static int
-qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
-                                    const char *certFile,
-                                    gnutls_x509_crt_t **certs,
-                                    unsigned int *ncerts,
-                                    Error **errp)
+qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds,
+                                 const char *certFile,
+                                 gnutls_x509_crt_t **certs,
+                                 unsigned int *ncerts,
+                                 bool isServer,
+                                 bool isCA,
+                                 Error **errp)
 {
     gnutls_datum_t data;
     g_autofree char *buf = NULL;
@@ -507,7 +480,9 @@ qcrypto_tls_creds_load_ca_cert_list(QCryptoTLSCredsX509 *creds,
     if (gnutls_x509_crt_list_import2(certs, ncerts, &data,
                                      GNUTLS_X509_FMT_PEM, 0) < 0) {
         error_setg(errp,
-                   "Unable to import CA certificate list %s",
+                   isCA ? "Unable to import CA certificate list %s" :
+                   (isServer ? "Unable to import server certificate %s" :
+                    "Unable to import client certificate %s"),
                    certFile);
         return -1;
     }
@@ -523,7 +498,8 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     const char *certFile,
                                     Error **errp)
 {
-    gnutls_x509_crt_t cert = NULL;
+    gnutls_x509_crt_t *certs = NULL;
+    unsigned int ncerts = 0;
     gnutls_x509_crt_t *cacerts = NULL;
     unsigned int ncacerts = 0;
     size_t i;
@@ -531,41 +507,48 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
 
     if (certFile &&
         access(certFile, R_OK) == 0) {
-        cert = qcrypto_tls_creds_load_cert(creds,
-                                           certFile, isServer,
-                                           errp);
-        if (!cert) {
+        if (qcrypto_tls_creds_load_cert_list(creds,
+                                             certFile,
+                                             &certs,
+                                             &ncerts,
+                                             isServer,
+                                             false,
+                                             errp) < 0) {
             goto cleanup;
         }
     }
     if (access(cacertFile, R_OK) == 0) {
-        if (qcrypto_tls_creds_load_ca_cert_list(creds,
-                                                cacertFile,
-                                                &cacerts,
-                                                &ncacerts,
-                                                errp) < 0) {
+        if (qcrypto_tls_creds_load_cert_list(creds,
+                                             cacertFile,
+                                             &cacerts,
+                                             &ncacerts,
+                                             isServer,
+                                             true,
+                                             errp) < 0) {
             goto cleanup;
         }
     }
 
-    if (cert &&
-        qcrypto_tls_creds_check_cert(creds,
-                                     cert, certFile, isServer,
-                                     false, errp) < 0) {
-        goto cleanup;
+    for (i = 0; i < ncerts; i++) {
+        if (qcrypto_tls_creds_check_cert(creds,
+                                         certs[i], certFile,
+                                         isServer, i != 0, errp) < 0) {
+            goto cleanup;
+        }
     }
 
-    if (cert &&
-        qcrypto_tls_creds_check_authority_chain(creds, cert,
+    if (ncerts &&
+        qcrypto_tls_creds_check_authority_chain(creds,
+                                                certs, ncerts,
                                                 cacerts, ncacerts,
                                                 cacertFile, isServer,
                                                 true, errp) < 0) {
         goto cleanup;
     }
 
-    if (cert && ncacerts &&
-        qcrypto_tls_creds_check_cert_pair(cert, certFile, cacerts,
-                                          ncacerts, cacertFile,
+    if (ncerts && ncacerts &&
+        qcrypto_tls_creds_check_cert_pair(certs, ncerts, certFile,
+                                          cacerts, ncacerts, cacertFile,
                                           isServer, errp) < 0) {
         goto cleanup;
     }
@@ -573,8 +556,8 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     ret = 0;
 
  cleanup:
-    if (cert) {
-        gnutls_x509_crt_deinit(cert);
+    for (i = 0; i < ncerts; i++) {
+        gnutls_x509_crt_deinit(certs[i]);
     }
     for (i = 0; i < ncacerts; i++) {
         gnutls_x509_crt_deinit(cacerts[i]);
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index 7c5df32bcc..96ad4e741b 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -580,6 +580,12 @@ int main(int argc, char **argv)
                  true, true, GNUTLS_KEY_KEY_CERT_SIGN,
                  false, false, NULL, NULL,
                  0, 0);
+    TLS_ROOT_REQ(someotherrootreq,
+                 "UK", "some other random CA", NULL, NULL, NULL, NULL,
+                 true, true, true,
+                 true, true, GNUTLS_KEY_KEY_CERT_SIGN,
+                 false, false, NULL, NULL,
+                 0, 0);
     TLS_CERT_REQ(cacertlevel1areq, cacertrootreq,
                  "UK", "qemu level 1a", NULL, NULL, NULL, NULL,
                  true, true, true,
@@ -626,6 +632,32 @@ int main(int argc, char **argv)
         cacertlevel2areq.crt,
     };
 
+    gnutls_x509_crt_t cabundle[] = {
+        someotherrootreq.crt,
+        cacertrootreq.crt,
+    };
+
+    gnutls_x509_crt_t servercertchain[] = {
+        servercertlevel3areq.crt,
+        cacertlevel2areq.crt,
+        cacertlevel1areq.crt,
+    };
+
+    gnutls_x509_crt_t servercertchain_incomplete[] = {
+        servercertlevel3areq.crt,
+        cacertlevel2areq.crt,
+    };
+
+    gnutls_x509_crt_t servercertchain_unsorted[] = {
+        servercertlevel3areq.crt,
+        cacertlevel1areq.crt,
+        cacertlevel2areq.crt,
+    };
+
+    gnutls_x509_crt_t clientcertchain[] = {
+        clientcertlevel2breq.crt,
+        cacertlevel1breq.crt,
+    };
 
     test_tls_write_cert_chain(WORKDIR "cacertchain-ctx.pem",
                               certchain,
@@ -665,6 +697,46 @@ int main(int argc, char **argv)
                  WORKDIR "cacertchain-incomplete-ctx.pem",
                  servercertlevel3areq.filename, true);
 
+    test_tls_write_cert_chain(WORKDIR "servercertchain-ctx.pem",
+                              servercertchain,
+                              G_N_ELEMENTS(servercertchain));
+
+    TLS_TEST_REG(serverchain, true,
+                 cacertrootreq.filename,
+                 WORKDIR "servercertchain-ctx.pem", false);
+
+    test_tls_write_cert_chain(WORKDIR "cabundle-ctx.pem",
+                              cabundle,
+                              G_N_ELEMENTS(cabundle));
+
+    TLS_TEST_REG(multiplecaswithchain, true,
+                 WORKDIR "cabundle-ctx.pem",
+                 WORKDIR "servercertchain-ctx.pem", false);
+
+    test_tls_write_cert_chain(WORKDIR "servercertchain_incomplete-ctx.pem",
+                              servercertchain_incomplete,
+                              G_N_ELEMENTS(servercertchain_incomplete));
+
+    TLS_TEST_REG(incompleteserverchain, true,
+                 cacertrootreq.filename,
+                 WORKDIR "servercertchain_incomplete-ctx.pem", true);
+
+    test_tls_write_cert_chain(WORKDIR "servercertchain_unsorted-ctx.pem",
+                              servercertchain_unsorted,
+                              G_N_ELEMENTS(servercertchain_unsorted));
+
+    TLS_TEST_REG(unsortedserverchain, true,
+                 cacertrootreq.filename,
+                 WORKDIR "servercertchain_unsorted-ctx.pem", true);
+
+    test_tls_write_cert_chain(WORKDIR "clientcertchain-ctx.pem",
+                              clientcertchain,
+                              G_N_ELEMENTS(clientcertchain));
+
+    TLS_TEST_REG(clientchain, false,
+                 cacertrootreq.filename,
+                 WORKDIR "clientcertchain-ctx.pem", false);
+
     /* Some missing certs - first two are fatal, the last
      * is ok
      */
@@ -734,8 +806,13 @@ int main(int argc, char **argv)
     test_tls_discard_cert(&cacertlevel2areq);
     test_tls_discard_cert(&servercertlevel3areq);
     test_tls_discard_cert(&clientcertlevel2breq);
+    test_tls_discard_cert(&someotherrootreq);
     unlink(WORKDIR "cacertchain-ctx.pem");
     unlink(WORKDIR "cacertchain-with-invalid-ctx.pem");
+    unlink(WORKDIR "servercertchain-ctx.pem");
+    unlink(WORKDIR "servercertchain_incomplete-ctx.pem");
+    unlink(WORKDIR "servercertchain_unsorted-ctx.pem");
+    unlink(WORKDIR "clientcertchain-ctx.pem");
 
     test_tls_cleanup(KEYFILE);
     rmdir(WORKDIR);

From 3995fc238e0599e0417ba958ffc5c7a609e82a7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 1 Jul 2025 18:33:21 +0100
Subject: [PATCH 1637/2396] crypto: stop requiring "key encipherment" usage in
 x509 certs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This usage flag was deprecated by RFC8813, such that it is
forbidden to be present for certs using ECDSA/ECDH algorithms,
and in TLS 1.3 is conceptually obsolete.

As such many valid certs will no longer have this key usage
flag set, and QEMU should not be rejecting them, as this
prevents use of otherwise valid & desirable algorithms.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c                 | 10 +-------
 docs/system/tls.rst                   | 13 +++-------
 tests/unit/crypto-tls-x509-helpers.h  |  6 ++---
 tests/unit/test-crypto-tlscredsx509.c | 36 +++++++++++++--------------
 tests/unit/test-crypto-tlssession.c   | 14 +++++------
 tests/unit/test-io-channel-tls.c      |  4 +--
 6 files changed, 34 insertions(+), 49 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 86fdfce886..db2b74bafa 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -144,7 +144,7 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
     if (status < 0) {
         if (status == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
             usage = isCA ? GNUTLS_KEY_KEY_CERT_SIGN :
-                GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT;
+                GNUTLS_KEY_DIGITAL_SIGNATURE;
         } else {
             error_setg(errp,
                        "Unable to query certificate %s key usage: %s",
@@ -171,14 +171,6 @@ qcrypto_tls_creds_check_cert_key_usage(QCryptoTLSCredsX509 *creds,
                 return -1;
             }
         }
-        if (!(usage & GNUTLS_KEY_KEY_ENCIPHERMENT)) {
-            if (critical) {
-                error_setg(errp,
-                           "Certificate %s usage does not permit key "
-                           "encipherment", certFile);
-                return -1;
-            }
-        }
     }
 
     return 0;
diff --git a/docs/system/tls.rst b/docs/system/tls.rst
index e284c82801..a4f6781d62 100644
--- a/docs/system/tls.rst
+++ b/docs/system/tls.rst
@@ -118,7 +118,6 @@ information for each server, and use it to issue server certificates.
    ip_address = 2620:0:cafe::87
    ip_address = 2001:24::92
    tls_www_server
-   encryption_key
    signing_key
    EOF
    # certtool --generate-privkey > server-hostNNN-key.pem
@@ -134,9 +133,8 @@ the subject alt name extension data. The ``tls_www_server`` keyword is
 the key purpose extension to indicate this certificate is intended for
 usage in a web server. Although QEMU network services are not in fact
 HTTP servers (except for VNC websockets), setting this key purpose is
-still recommended. The ``encryption_key`` and ``signing_key`` keyword is
-the key usage extension to indicate this certificate is intended for
-usage in the data session.
+still recommended. The ``signing_key`` keyword is the key usage extension
+to indicate this certificate is intended for usage in the data session.
 
 The ``server-hostNNN-key.pem`` and ``server-hostNNN-cert.pem`` files
 should now be securely copied to the server for which they were
@@ -171,7 +169,6 @@ certificates.
    organization = Name of your organization
    cn = hostNNN.foo.example.com
    tls_www_client
-   encryption_key
    signing_key
    EOF
    # certtool --generate-privkey > client-hostNNN-key.pem
@@ -187,9 +184,8 @@ the ``dns_name`` and ``ip_address`` fields are not included. The
 ``tls_www_client`` keyword is the key purpose extension to indicate this
 certificate is intended for usage in a web client. Although QEMU network
 clients are not in fact HTTP clients, setting this key purpose is still
-recommended. The ``encryption_key`` and ``signing_key`` keyword is the
-key usage extension to indicate this certificate is intended for usage
-in the data session.
+recommended. The ``signing_key`` keyword is the key usage extension to
+indicate this certificate is intended for usage in the data session.
 
 The ``client-hostNNN-key.pem`` and ``client-hostNNN-cert.pem`` files
 should now be securely copied to the client for which they were
@@ -222,7 +218,6 @@ client and server instructions in one.
    ip_address = 2001:24::92
    tls_www_server
    tls_www_client
-   encryption_key
    signing_key
    EOF
    # certtool --generate-privkey > both-hostNNN-key.pem
diff --git a/tests/unit/crypto-tls-x509-helpers.h b/tests/unit/crypto-tls-x509-helpers.h
index 2a0f7c04fd..7e9a508ad6 100644
--- a/tests/unit/crypto-tls-x509-helpers.h
+++ b/tests/unit/crypto-tls-x509-helpers.h
@@ -148,8 +148,7 @@ void test_tls_cleanup(const char *keyfile);
         .basicConstraintsIsCA = false,                                  \
         .keyUsageEnable = true,                                         \
         .keyUsageCritical = true,                                       \
-        .keyUsageValue =                                                \
-        GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,     \
+        .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE,                  \
         .keyPurposeEnable = true,                                       \
         .keyPurposeCritical = true,                                     \
         .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_CLIENT,                     \
@@ -168,8 +167,7 @@ void test_tls_cleanup(const char *keyfile);
         .basicConstraintsIsCA = false,                                  \
         .keyUsageEnable = true,                                         \
         .keyUsageCritical = true,                                       \
-        .keyUsageValue =                                                \
-        GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,     \
+        .keyUsageValue = GNUTLS_KEY_DIGITAL_SIGNATURE,                  \
         .keyPurposeEnable = true,                                       \
         .keyPurposeCritical = true,                                     \
         .keyPurposeOID1 = GNUTLS_KP_TLS_WWW_SERVER,                     \
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index 96ad4e741b..a5f21728d4 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -169,14 +169,14 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(clientcertreq, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 
@@ -199,7 +199,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
 
@@ -214,7 +214,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
 
@@ -229,7 +229,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
 
@@ -253,7 +253,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     /* no-basic */
@@ -267,7 +267,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     /* Key usage:dig-sig:critical */
@@ -281,7 +281,7 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
 
@@ -306,7 +306,7 @@ int main(int argc, char **argv)
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
+                 GNUTLS_KEY_DIGITAL_SIGNATURE |
                  GNUTLS_KEY_KEY_CERT_SIGN,
                  false, false, NULL, NULL,
                  0, 0);
@@ -409,7 +409,7 @@ int main(int argc, char **argv)
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT |
+                 GNUTLS_KEY_DIGITAL_SIGNATURE |
                  GNUTLS_KEY_KEY_CERT_SIGN,
                  false, false, NULL, NULL,
                  0, 0);
@@ -511,21 +511,21 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(servercertexp1req, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, -1);
     TLS_CERT_REQ(clientcertexp1req, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, -1);
 
@@ -549,21 +549,21 @@ int main(int argc, char **argv)
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(servercertnew1req, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  1, 2);
     TLS_CERT_REQ(clientcertnew1req, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  1, 2);
 
@@ -614,14 +614,14 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
                  "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 
diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-tlssession.c
index 61311cbe6e..d0baf3b304 100644
--- a/tests/unit/test-crypto-tlssession.c
+++ b/tests/unit/test-crypto-tlssession.c
@@ -472,14 +472,14 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(clientcertreq, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 
@@ -487,7 +487,7 @@ int main(int argc, char **argv)
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 
@@ -506,7 +506,7 @@ int main(int argc, char **argv)
                  "192.168.122.1", "fec0::dead:beaf",
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     /* This intentionally doesn't replicate */
@@ -515,7 +515,7 @@ int main(int argc, char **argv)
                  "192.168.122.1", "fec0::dead:beaf",
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
 
@@ -619,14 +619,14 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(clientcertlevel2breq, cacertlevel1breq,
                  "UK", "qemu client level 2b", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 
diff --git a/tests/unit/test-io-channel-tls.c b/tests/unit/test-io-channel-tls.c
index 6f282ad45d..4e4034af67 100644
--- a/tests/unit/test-io-channel-tls.c
+++ b/tests/unit/test-io-channel-tls.c
@@ -302,14 +302,14 @@ int main(int argc, char **argv)
                  "UK", "qemu.org", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_SERVER, NULL,
                  0, 0);
     TLS_CERT_REQ(clientcertreq, cacertreq,
                  "UK", "qemu", NULL, NULL, NULL, NULL,
                  true, true, false,
                  true, true,
-                 GNUTLS_KEY_DIGITAL_SIGNATURE | GNUTLS_KEY_KEY_ENCIPHERMENT,
+                 GNUTLS_KEY_DIGITAL_SIGNATURE,
                  true, true, GNUTLS_KP_TLS_WWW_CLIENT, NULL,
                  0, 0);
 

From 3b3257b00fd256b8704db13373f4fa9c8bc40342 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 11 Jul 2025 13:21:34 +0100
Subject: [PATCH 1638/2396] crypto: switch to newer gnutls API for
 distinguished name
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The new API automatically allocates the right amount of memory
to hold the distinguished name, avoiding the need to loop and
realloc.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlssession.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 8c0bf457ad..92fe4f0380 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -409,20 +409,14 @@ qcrypto_tls_session_check_certificate(QCryptoTLSSession *session,
         }
 
         if (i == 0) {
-            size_t dnameSize = 1024;
-            session->peername = g_malloc(dnameSize);
-        requery:
-            ret = gnutls_x509_crt_get_dn(cert, session->peername, &dnameSize);
+            gnutls_datum_t dname = {};
+            ret = gnutls_x509_crt_get_dn2(cert, &dname);
             if (ret < 0) {
-                if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
-                    session->peername = g_realloc(session->peername,
-                                                  dnameSize);
-                    goto requery;
-                }
                 error_setg(errp, "Cannot get client distinguished name: %s",
                            gnutls_strerror(ret));
                 goto error;
             }
+            session->peername = (char *)g_steal_pointer(&dname.data);
             if (session->authzid) {
                 bool allow;
 

From 6910f04aa646f63a0257f77201ad8ea15992b816 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Fri, 17 Oct 2025 11:43:30 +0200
Subject: [PATCH 1639/2396] hw/scsi: avoid deadlock upon TMF request cancelling
 with VirtIO

When scsi_req_dequeue() is reached via
scsi_req_cancel_async()
virtio_scsi_tmf_cancel_req()
virtio_scsi_do_tmf_aio_context(),
there is a deadlock when trying to acquire the SCSI device's requests
lock, because it was already acquired in
virtio_scsi_do_tmf_aio_context().

In particular, the issue happens with a FreeBSD guest (13, 14, 15,
maybe more), when it cancels SCSI requests, because of timeout.

This is a regression caused by commit da6eebb33b ("virtio-scsi:
perform TMFs in appropriate AioContexts") and the introduction of the
requests_lock earlier.

To fix the issue, only cancel the requests after releasing the
requests_lock. For this, the SCSI device's requests are iterated while
holding the requests_lock and the requests to be cancelled are
collected in a list. Then, the collected requests are cancelled
one by one while not holding the requests_lock. This is safe, because
only requests from the current AioContext are collected and acted
upon.

Originally reported by Proxmox VE users:
https://bugzilla.proxmox.com/show_bug.cgi?id=6810
https://forum.proxmox.com/threads/173914/

Fixes: da6eebb33b ("virtio-scsi: perform TMFs in appropriate AioContexts")
Suggested-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-id: 20251017094518.328905-1-f.ebner@proxmox.com
[Changed g_list_append() to g_list_prepend() to avoid traversing the
list each time.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/scsi/virtio-scsi.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/hw/scsi/virtio-scsi.c b/hw/scsi/virtio-scsi.c
index d817fc42b4..93e87c459c 100644
--- a/hw/scsi/virtio-scsi.c
+++ b/hw/scsi/virtio-scsi.c
@@ -339,6 +339,7 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque)
     SCSIDevice *d = virtio_scsi_device_get(s, tmf->req.tmf.lun);
     SCSIRequest *r;
     bool match_tag;
+    g_autoptr(GList) reqs = NULL;
 
     if (!d) {
         tmf->resp.tmf.response = VIRTIO_SCSI_S_BAD_TARGET;
@@ -374,10 +375,21 @@ static void virtio_scsi_do_tmf_aio_context(void *opaque)
             if (match_tag && cmd_req->req.cmd.tag != tmf->req.tmf.tag) {
                 continue;
             }
-            virtio_scsi_tmf_cancel_req(tmf, r);
+            /*
+             * Cannot cancel directly, because scsi_req_dequeue() would deadlock
+             * when attempting to acquire the request_lock a second time. Taking
+             * a reference here is paired with an unref after cancelling below.
+             */
+            scsi_req_ref(r);
+            reqs = g_list_prepend(reqs, r);
         }
     }
 
+    for (GList *elem = g_list_first(reqs); elem; elem = g_list_next(elem)) {
+        virtio_scsi_tmf_cancel_req(tmf, elem->data);
+        scsi_req_unref(elem->data);
+    }
+
     /* Incremented by virtio_scsi_do_tmf() */
     virtio_scsi_tmf_dec_remaining(tmf);
 

From b94f5a536272274a873182e1fcce10685ca20035 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 14 Oct 2025 22:40:18 +0200
Subject: [PATCH 1640/2396] lasi_ncr710: Add LASI wrapper for NCR 53c710 SCSI
 chip

The LASI multi I/O chip in older PA-RISC machines includes a SCSI
core based on the NCR 53c710 SCSI chip.
This driver adds the glue code to talk to the NCR710 via LASI.

This driver was developed as part of the Google Summer of Code 2025 program.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 MAINTAINERS           |   1 +
 hw/scsi/lasi_ncr710.c | 282 ++++++++++++++++++++++++++++++++++++++++++
 hw/scsi/lasi_ncr710.h |  57 +++++++++
 hw/scsi/trace-events  |  17 +++
 4 files changed, 357 insertions(+)
 create mode 100644 hw/scsi/lasi_ncr710.c
 create mode 100644 hw/scsi/lasi_ncr710.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 84cfd85e1f..a204c38754 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1283,6 +1283,7 @@ F: hw/net/*i82596*
 F: hw/misc/lasi.c
 F: hw/pci-host/astro.c
 F: hw/pci-host/dino.c
+F: hw/scsi/lasi_ncr710.*
 F: include/hw/input/lasips2.h
 F: include/hw/misc/lasi.h
 F: include/hw/net/lasi_82596.h
diff --git a/hw/scsi/lasi_ncr710.c b/hw/scsi/lasi_ncr710.c
new file mode 100644
index 0000000000..b674a4066f
--- /dev/null
+++ b/hw/scsi/lasi_ncr710.c
@@ -0,0 +1,282 @@
+/*
+ * LASI Wrapper for NCR710 SCSI Controller
+ *
+ * Copyright (c) 2025 Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
+ * This driver was developed during the Google Summer of Code 2025 program.
+ * Mentored by Helge Deller <deller@gmx.de>
+ *
+ * NCR710 SCSI Controller implementation
+ * Based on the NCR53C710 Technical Manual Version 3.2, December 2000
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "hw/scsi/lasi_ncr710.h"
+#include "hw/scsi/ncr53c710.h"
+#include "hw/sysbus.h"
+#include "qemu/timer.h"
+#include "qemu/log.h"
+#include "trace.h"
+#include "system/blockdev.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "system/dma.h"
+
+#define LASI_710_SVERSION    0x00082
+#define SCNR                 0xBEEFBABE
+#define LASI_710_HVERSION    0x3D
+#define HPHW_FIO             5        /* Fixed I/O module */
+
+static uint64_t lasi_ncr710_reg_read(void *opaque, hwaddr addr,
+                                    unsigned size)
+{
+    LasiNCR710State *s = LASI_NCR710(opaque);
+    uint64_t val = 0;
+
+    trace_lasi_ncr710_reg_read(addr, 0, size);
+
+    if (addr == 0x00) {  /* Device ID */
+        val = (HPHW_FIO << 24) | LASI_710_SVERSION;
+        trace_lasi_ncr710_reg_read_id(HPHW_FIO, LASI_710_SVERSION, val);
+        return val;
+    }
+
+    if (addr == 0x08) {  /* HVersion */
+        val = LASI_710_HVERSION;
+        trace_lasi_ncr710_reg_read_hversion(val);
+        return val;
+    }
+
+    if (addr >= 0x100) {
+        hwaddr ncr_addr = addr - 0x100;
+        if (size == 1) {
+            ncr_addr ^= 3;
+            NCR710_DPRINTF("Reading value to LASI WRAPPER == 0x%lx%s, "
+                           "val=0x%lx, size=%u\n",
+                           addr - 0x100, size == 1 ? " (XORed)" : "",
+                           val, size);
+            val = ncr710_reg_read(&s->ncr710, ncr_addr, size);
+        } else {
+            val = 0;
+            for (unsigned i = 0; i < size; i++) {
+                uint8_t byte_val = ncr710_reg_read(&s->ncr710, ncr_addr + i, 1);
+                val |= ((uint64_t)byte_val) << (i * 8);
+                NCR710_DPRINTF("  Read byte %u from NCR addr 0x%lx: "
+                               "0x%02x\n", i, ncr_addr + i, byte_val);
+            }
+            NCR710_DPRINTF("  Reconstructed %u-byte value: 0x%lx\n",
+                           size, val);
+        }
+
+        trace_lasi_ncr710_reg_forward_read(addr, val);
+    } else {
+        val = 0;
+        trace_lasi_ncr710_reg_read(addr, val, size);
+    }
+    return val;
+}
+
+static void lasi_ncr710_reg_write(void *opaque, hwaddr addr,
+                                   uint64_t val, unsigned size)
+{
+    LasiNCR710State *s = LASI_NCR710(opaque);
+
+    trace_lasi_ncr710_reg_write(addr, val, size);
+
+    if (addr <= 0x0F) {
+        return;
+    }
+
+    if (addr >= 0x100) {
+        hwaddr ncr_addr = addr - 0x100;
+
+        if (size == 1) {
+            ncr_addr ^= 3;
+            NCR710_DPRINTF("Writing value to LASI WRAPPER == 0x%lx%s, "
+                           "val=0x%lx, size=%u\n",
+                           addr - 0x100, size == 1 ? " (XORed)" : "",
+                           val, size);
+            ncr710_reg_write(&s->ncr710, ncr_addr, val, size);
+        } else {
+            for (unsigned i = 0; i < size; i++) {
+                uint8_t byte_val = (val >> (i * 8)) & 0xff;
+                 NCR710_DPRINTF("  Writing byte %u to NCR addr 0x%lx: 0x%02x\n",
+                       i, ncr_addr + i, byte_val);
+                ncr710_reg_write(&s->ncr710, ncr_addr + i, byte_val, 1);
+            }
+        }
+
+        trace_lasi_ncr710_reg_forward_write(addr, val);
+    } else {
+        trace_lasi_ncr710_reg_write(addr, val, size);
+    }
+}
+
+/*
+ * req_cancelled, command_complete, transfer_data forwards
+ * commands to its core counterparts.
+ */
+static void lasi_ncr710_request_cancelled(SCSIRequest *req)
+{
+    trace_lasi_ncr710_request_cancelled(req);
+    ncr710_request_cancelled(req);
+}
+
+static void lasi_ncr710_command_complete(SCSIRequest *req, size_t resid)
+{
+    trace_lasi_ncr710_command_complete(req->status, resid);
+    ncr710_command_complete(req, resid);
+}
+
+ static void lasi_ncr710_transfer_data(SCSIRequest *req, uint32_t len)
+{
+    trace_lasi_ncr710_transfer_data(len);
+    ncr710_transfer_data(req, len);
+}
+
+static const struct SCSIBusInfo lasi_ncr710_scsi_info = {
+    .tcq = true,
+    .max_target = 8,
+    .max_lun = 8,  /* full LUN support */
+
+    .transfer_data = lasi_ncr710_transfer_data,
+    .complete = lasi_ncr710_command_complete,
+    .cancel = lasi_ncr710_request_cancelled,
+};
+
+static const MemoryRegionOps lasi_ncr710_mmio_ops = {
+    .read = lasi_ncr710_reg_read,
+    .write = lasi_ncr710_reg_write,
+    .endianness = DEVICE_BIG_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static const VMStateDescription vmstate_lasi_ncr710 = {
+    .name = "lasi-ncr710",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void lasi_ncr710_realize(DeviceState *dev, Error **errp)
+{
+    LasiNCR710State *s = LASI_NCR710(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    trace_lasi_ncr710_device_realize();
+
+    scsi_bus_init(&s->ncr710.bus, sizeof(s->ncr710.bus), dev,
+                  &lasi_ncr710_scsi_info);
+    s->ncr710.as = &address_space_memory;
+    s->ncr710.irq = s->lasi_irq;
+
+    s->ncr710.reselection_retry_timer =
+        timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                     ncr710_reselection_retry_callback,
+                     &s->ncr710);
+
+    ncr710_soft_reset(&s->ncr710);
+
+    trace_lasi_ncr710_timers_initialized(
+        (uint64_t)s->ncr710.reselection_retry_timer);
+
+    /* Initialize memory region */
+    memory_region_init_io(&s->mmio, OBJECT(dev), &lasi_ncr710_mmio_ops, s,
+                          "lasi-ncr710", 0x200);
+    sysbus_init_mmio(sbd, &s->mmio);
+}
+
+void lasi_ncr710_handle_legacy_cmdline(DeviceState *lasi_dev)
+{
+    LasiNCR710State *s = LASI_NCR710(lasi_dev);
+    SCSIBus *bus = &s->ncr710.bus;
+    int found_drives = 0;
+
+    if (!bus) {
+        return;
+    }
+
+    for (int unit = 0; unit <= 7; unit++) {
+        DriveInfo *dinfo = drive_get(IF_SCSI, bus->busnr, unit);
+        if (dinfo) {
+            trace_lasi_ncr710_legacy_drive_found(bus->busnr, unit);
+            found_drives++;
+        }
+    }
+
+    trace_lasi_ncr710_handle_legacy_cmdline(bus->busnr, found_drives);
+
+    scsi_bus_legacy_handle_cmdline(bus);
+    BusChild *kid;
+    QTAILQ_FOREACH(kid, &bus->qbus.children, sibling) {
+        trace_lasi_ncr710_scsi_device_created(
+            object_get_typename(OBJECT(kid->child)));
+    }
+}
+
+DeviceState *lasi_ncr710_init(MemoryRegion *addr_space, hwaddr hpa,
+                               qemu_irq irq)
+{
+    DeviceState *dev;
+    LasiNCR710State *s;
+    SysBusDevice *sbd;
+
+    dev = qdev_new(TYPE_LASI_NCR710);
+    s = LASI_NCR710(dev);
+    sbd = SYS_BUS_DEVICE(dev);
+    s->lasi_irq = irq;
+    sysbus_realize_and_unref(sbd, &error_fatal);
+    memory_region_add_subregion(addr_space, hpa,
+                               sysbus_mmio_get_region(sbd, 0));
+    return dev;
+}
+
+static void lasi_ncr710_reset(DeviceState *dev)
+{
+    LasiNCR710State *s = LASI_NCR710(dev);
+    trace_lasi_ncr710_device_reset();
+    ncr710_soft_reset(&s->ncr710);
+}
+
+static void lasi_ncr710_instance_init(Object *obj)
+{
+    LasiNCR710State *s = LASI_NCR710(obj);
+
+    s->hw_type = HPHW_FIO;
+    s->sversion = LASI_710_SVERSION;
+    s->hversion = LASI_710_HVERSION;
+}
+
+static void lasi_ncr710_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = lasi_ncr710_realize;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+    dc->fw_name = "scsi";
+    dc->desc = "HP-PARISC LASI NCR710 SCSI adapter";
+    device_class_set_legacy_reset(dc, lasi_ncr710_reset);
+    dc->vmsd = &vmstate_lasi_ncr710;
+    dc->user_creatable = false;
+}
+
+static const TypeInfo lasi_ncr710_info = {
+    .name          = TYPE_LASI_NCR710,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(LasiNCR710State),
+    .instance_init = lasi_ncr710_instance_init,
+    .class_init    = lasi_ncr710_class_init,
+};
+
+static void lasi_ncr710_register_types(void)
+{
+    type_register_static(&lasi_ncr710_info);
+}
+
+type_init(lasi_ncr710_register_types)
diff --git a/hw/scsi/lasi_ncr710.h b/hw/scsi/lasi_ncr710.h
new file mode 100644
index 0000000000..3711233b0f
--- /dev/null
+++ b/hw/scsi/lasi_ncr710.h
@@ -0,0 +1,57 @@
+/*
+ * LASI Wrapper for NCR710 SCSI Controller
+ *
+ * Copyright (c) 2025 Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
+ * This driver was developed during the Google Summer of Code 2025 program.
+ * Mentored by Helge Deller <deller@gmx.de>
+ *
+ * NCR710 SCSI Controller implementation
+ * Based on the NCR53C710 Technical Manual Version 3.2, December 2000
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_LASI_NCR710_H
+#define HW_LASI_NCR710_H
+
+#include "hw/sysbus.h"
+#include "qemu/osdep.h"
+#include "exec/memattrs.h"
+#include "hw/scsi/scsi.h"
+#include "hw/scsi/ncr53c710.h"
+
+#define TYPE_LASI_NCR710 "lasi-ncr710"
+OBJECT_DECLARE_SIMPLE_TYPE(LasiNCR710State, LASI_NCR710)
+
+#define LASI_SCSI_RESET         0x000   /* SCSI Reset Register */
+#define LASI_SCSI_NCR710_BASE   0x100   /* NCR710 Base Register Offset */
+
+#define PARISC_DEVICE_ID_OFF    0x00    /* HW type, HVERSION, SVERSION */
+#define PARISC_DEVICE_CONFIG_OFF 0x04   /* Configuration data */
+
+#define PHASE_MASK              7
+#define PHASE_DO                0
+
+#define NCR710_SCNTL1_RST       0x08    /* SCSI Reset */
+#define NCR710_ISTAT_RST        0x40    /* Device Reset */
+#define NCR710_ISTAT_ABRT       0x80    /* Script Abort */
+#define NCR710_ISTAT_CON        0x08    /* ISTAT_Connected */
+#define NCR710_DSTAT_DFE        0x80    /* DMA FIFO Empty */
+#define NCR710_CTEST2_DACK      0x01    /* DMA Acknowledge */
+
+typedef struct LasiNCR710State {
+    SysBusDevice parent_obj;
+    MemoryRegion mmio;
+    qemu_irq lasi_irq;       /* IRQ line to LASI controller */
+    uint32_t hw_type;        /* Hardware type (HPHW_*) */
+    uint32_t sversion;       /* Software version */
+    uint32_t hversion;       /* Hardware version */
+    SCSIBus bus;
+    NCR710State ncr710;
+} LasiNCR710State;
+
+DeviceState *lasi_ncr710_init(MemoryRegion *addr_space, hwaddr hpa,
+                               qemu_irq irq);
+void lasi_ncr710_handle_legacy_cmdline(DeviceState *lasi_dev);
+
+#endif
diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
index 6c2788e202..0604050a67 100644
--- a/hw/scsi/trace-events
+++ b/hw/scsi/trace-events
@@ -306,6 +306,23 @@ lsi_reg_write(const char *name, int offset, uint8_t val) "Write reg %s 0x%x = 0x
 lsi_scripts_timer_triggered(void) "SCRIPTS timer triggered"
 lsi_scripts_timer_start(void) "SCRIPTS timer started"
 
+# lasi_ncr710.c
+lasi_ncr710_device_realize(void) "Device realized"
+lasi_ncr710_device_reset(void) "Device reset"
+lasi_ncr710_reg_read(uint32_t addr, uint32_t val, unsigned size) "addr=0x%03x val=0x%08x size=%u"
+lasi_ncr710_reg_write(uint32_t addr, uint32_t val, unsigned size) "addr=0x%03x val=0x%08x size=%u"
+lasi_ncr710_reg_read_id(uint32_t hw_type, uint32_t sversion, uint32_t val) "hw_type=%u sversion=0x%04x val=0x%08x"
+lasi_ncr710_reg_read_hversion(uint32_t hversion) "LASI NCR710: HVersion read -> 0x%02x"
+lasi_ncr710_reg_forward_read(uint32_t addr, uint32_t val) "LASI NCR710: Forward read to NCR710 core addr=0x%03x val=0x%08x"
+lasi_ncr710_reg_forward_write(uint32_t addr, uint32_t val) "LASI NCR710: Forward write to NCR710 core addr=0x%03x val=0x%08x"
+lasi_ncr710_command_complete(uint32_t status, size_t resid) "LASI NCR710: Command complete status=0x%02x resid=%zu"
+lasi_ncr710_transfer_data(uint32_t len) "LASI NCR710: Transfer data len=%u"
+lasi_ncr710_request_cancelled(void *req) "LASI NCR710: Request cancelled req=%p"
+lasi_ncr710_timers_initialized(uint64_t reselection) "Timers: reselection=0x%" PRIx64
+lasi_ncr710_handle_legacy_cmdline(int busnr, int found_drives) "LASI NCR710: Handle legacy cmdline busnr=%d found_drives=%d"
+lasi_ncr710_legacy_drive_found(int busnr, int unit) "LASI NCR710: Found legacy drive at bus=%d unit=%d"
+lasi_ncr710_scsi_device_created(const char *type) "LASI NCR710: SCSI device created: %s"
+
 # virtio-scsi.c
 virtio_scsi_cmd_req(int lun, uint32_t tag, uint8_t cmd) "virtio_scsi_cmd_req lun=%u tag=0x%x cmd=0x%x"
 virtio_scsi_cmd_resp(int lun, uint32_t tag, int response, uint8_t status) "virtio_scsi_cmd_resp lun=%u tag=0x%x response=%d status=0x%x"

From 9ce93b74cdc0078d0d34947f7e885a7178e4f3ff Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 14 Oct 2025 22:40:18 +0200
Subject: [PATCH 1641/2396] ncr710: Add driver for the NCR 53c710 SCSI chip

Add an emulation for the NCR 53c710 SCSI chip.
This SCSI chip was used widely in historic machines, e.g. as SCSI core
in the LASI controller in HP PA-RISC machines.

This driver was developed as part of the Google Summer of Code 2025 program.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 MAINTAINERS          |    1 +
 hw/scsi/ncr53c710.c  | 2432 ++++++++++++++++++++++++++++++++++++++++++
 hw/scsi/ncr53c710.h  |  246 +++++
 hw/scsi/trace-events |   12 +
 4 files changed, 2691 insertions(+)
 create mode 100644 hw/scsi/ncr53c710.c
 create mode 100644 hw/scsi/ncr53c710.h

diff --git a/MAINTAINERS b/MAINTAINERS
index a204c38754..2fee936fb0 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1284,6 +1284,7 @@ F: hw/misc/lasi.c
 F: hw/pci-host/astro.c
 F: hw/pci-host/dino.c
 F: hw/scsi/lasi_ncr710.*
+F: hw/scsi/ncr53c710.*
 F: include/hw/input/lasips2.h
 F: include/hw/misc/lasi.h
 F: include/hw/net/lasi_82596.h
diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c
new file mode 100644
index 0000000000..ade951b1d1
--- /dev/null
+++ b/hw/scsi/ncr53c710.c
@@ -0,0 +1,2432 @@
+/*
+ * QEMU NCR710 SCSI Controller
+ *
+ * Copyright (c) 2025 Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
+ * This driver was developed during the Google Summer of Code 2025 program.
+ *
+ * NCR710 SCSI Controller implementation
+ * Based on the NCR53C710 Technical Manual Version 3.2, December 2000
+ *
+ * Developed from an implementation of NCR53C710 by Helge Deller
+ * which was interim based on the implementation by Toni Wilen for UAE.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * Contents:
+ * 1. Register Definitions
+ * 2. Register name functions
+ * 3. Parity functions
+ * 4. SCSI FIFO Structures
+ * 5. Scripts Misc functions
+ * 6. DMA functions
+ * 7. Scripts functions
+ * 8. Read and Write functions
+ * 9. QEMU Device model functions
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/timer.h"
+#include "hw/irq.h"
+#include "hw/sysbus.h"
+#include "hw/scsi/scsi.h"
+#include "hw/scsi/ncr53c710.h"
+#include "migration/vmstate.h"
+#include "system/dma.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "trace.h"
+#include "qom/object.h"
+
+#define NCR710_MAX_DEVS 7
+
+/* SCNTL0 (0x00) - SCSI Control Register 0 */
+#define NCR710_SCNTL0_TRG    0x01
+#define NCR710_SCNTL0_AAP    0x02
+#define NCR710_SCNTL0_EPG    0x04
+#define NCR710_SCNTL0_EPC    0x08
+#define NCR710_SCNTL0_WATN   0x10
+#define NCR710_SCNTL0_START  0x20
+#define NCR710_SCNTL0_ARB0   0x40
+#define NCR710_SCNTL0_ARB1   0x80
+
+/* SCNTL1 (0x01) - SCSI Control Register 1 */
+#define NCR710_SCNTL1_RES0   0x01
+#define NCR710_SCNTL1_RES1   0x02
+#define NCR710_SCNTL1_AESP   0x04
+#define NCR710_SCNTL1_RST    0x08
+#define NCR710_SCNTL1_CON    0x10
+#define NCR710_SCNTL1_ESR    0x20
+#define NCR710_SCNTL1_ADB    0x40
+#define NCR710_SCNTL1_EXC    0x80
+
+/* ISTAT (0x21) - Interrupt Status Register */
+#define NCR710_ISTAT_DIP    0x01
+#define NCR710_ISTAT_SIP    0x02
+#define NCR710_ISTAT_CON    0x08
+#define NCR710_ISTAT_SIGP   0x20
+#define NCR710_ISTAT_RST    0x40
+#define NCR710_ISTAT_ABRT   0x80
+
+/* SSTAT0 (0x0D) - SCSI Status Register 0 */
+#define NCR710_SSTAT0_PAR    0x01
+#define NCR710_SSTAT0_RST    0x02
+#define NCR710_SSTAT0_UDC    0x04
+#define NCR710_SSTAT0_SGE    0x08
+#define NCR710_SSTAT0_SEL    0x10
+#define NCR710_SSTAT0_STO    0x20
+#define NCR710_SSTAT0_FCMP   0x40
+#define NCR710_SSTAT0_MA     0x80
+
+/* SSTAT1 (0x0E) - SCSI Status Register 1 */
+#define NCR710_SSTAT1_ORF    0x02
+#define NCR710_SSTAT1_ILF    0x04
+
+/* SSTAT2 (0x0F) - SCSI Status Register 2 */
+#define NCR710_SSTAT2_FF0    0x01
+#define NCR710_SSTAT2_FF1    0x02
+#define NCR710_SSTAT2_FF2    0x04
+#define NCR710_SSTAT2_FF3    0x08
+
+/* SOCL (0x07) / SBCL (0x0B) - SCSI Output/Bus Control Lines */
+#define NCR710_SOCL_IO       0x01
+#define NCR710_SOCL_CD       0x02
+#define NCR710_SOCL_MSG      0x04
+#define NCR710_SOCL_ATN      0x08
+#define NCR710_SOCL_SEL      0x10
+#define NCR710_SOCL_BSY      0x20
+#define NCR710_SOCL_ACK      0x40
+#define NCR710_SOCL_REQ      0x80
+
+/* SBCL bits same as SOCL */
+#define NCR710_SBCL_IO       0x01
+#define NCR710_SBCL_CD       0x02
+#define NCR710_SBCL_MSG      0x04
+#define NCR710_SBCL_ATN      0x08
+#define NCR710_SBCL_SEL      0x10
+#define NCR710_SBCL_BSY      0x20
+#define NCR710_SBCL_ACK      0x40
+#define NCR710_SBCL_REQ      0x80
+
+/* DSTAT (0x0C) - DMA Status Register */
+#define NCR710_DSTAT_IID     0x01
+#define NCR710_DSTAT_SIR     0x04
+#define NCR710_DSTAT_SSI     0x08
+#define NCR710_DSTAT_ABRT    0x10
+#define NCR710_DSTAT_BF      0x20
+#define NCR710_DSTAT_MDPE    0x40
+#define NCR710_DSTAT_DFE     0x80
+
+/* DCNTL (0x3B) - DMA Control Register */
+#define NCR710_DCNTL_COM     0x01
+#define NCR710_DCNTL_IRQD    0x02
+#define NCR710_DCNTL_STD     0x04
+#define NCR710_DCNTL_IRQM    0x08
+#define NCR710_DCNTL_SSM     0x10
+#define NCR710_DCNTL_PFEN    0x20
+#define NCR710_DCNTL_PFF     0x40
+
+/* DMODE (0x38) - DMA Mode Register */
+#define NCR710_DMODE_MAN     0x01
+#define NCR710_DMODE_BOF     0x02
+#define NCR710_DMODE_ERMP    0x04
+#define NCR710_DMODE_ERL     0x08
+#define NCR710_DMODE_DIOM    0x10
+#define NCR710_DMODE_SIOM    0x20
+#define NCR710_DMODE_BL_MASK 0xC0
+#define NCR710_DMODE_BL_1    0x00
+#define NCR710_DMODE_BL_2    0x40
+#define NCR710_DMODE_BL_4    0x80
+#define NCR710_DMODE_BL_8    0xC0
+
+/* CTEST2 (0x16) - Chip Test Register 2 */
+#define NCR710_CTEST2_DACK   0x01
+#define NCR710_CTEST2_DREQ   0x02
+#define NCR710_CTEST2_TEOP   0x04
+#define NCR710_CTEST2_PCICIE 0x08
+#define NCR710_CTEST2_CM     0x10
+#define NCR710_CTEST2_CIO    0x20
+#define NCR710_CTEST2_SIGP   0x40
+#define NCR710_CTEST2_DDIR   0x80
+
+/* CTEST5 (0x19) - Chip Test Register 5 */
+#define NCR710_CTEST5_BL2    0x04
+#define NCR710_CTEST5_DDIR   0x08
+#define NCR710_CTEST5_MASR   0x10
+#define NCR710_CTEST5_DFSN   0x20
+#define NCR710_CTEST5_BBCK   0x40
+#define NCR710_CTEST5_ADCK   0x80
+
+/* SCID (0x04) - SCSI Chip ID Register */
+#define NCR710_SCID_RRE      0x60
+#define NCR710_SCID_ID_MASK  0x07
+
+#define NCR710_HOST_ID       7
+
+/* NCR53C710 has 8-byte SCSI FIFO */
+#define NCR710_MAX_MSGIN_LEN 8
+#define NCR710_BUF_SIZE         4096
+
+/* Standard SCSI Message Byte Constants */
+#define SCSI_MSG_ABORT                      0x06
+#define SCSI_MSG_BUS_DEVICE_RESET           0x0c
+#define SCSI_MSG_COMMAND_COMPLETE           0x00
+#define SCSI_MSG_DISCONNECT                 0x04
+#define SCSI_MSG_EXTENDED_MESSAGE           0x01
+#define SCSI_MSG_IDENTIFY                   0x80
+#define SCSI_MSG_IGNORE_WIDE_RESIDUE        0x23
+#define SCSI_MSG_MESSAGE_PARITY_ERROR       0x09
+#define SCSI_MSG_MESSAGE_REJECT             0x07
+#define SCSI_MSG_NO_OPERATION               0x08
+#define SCSI_MSG_RELEASE_RECOVERY           0x10
+#define SCSI_MSG_RESTORE_POINTERS           0x03
+#define SCSI_MSG_SAVE_DATA_POINTER          0x02
+#define SCSI_MSG_SYNCHRONOUS_DATA_TRANSFER  0x01
+#define SCSI_MSG_WIDE_DATA_TRANSFER         0x03
+
+/* Script interrupt codes */
+#define A_GOOD_STATUS_AFTER_STATUS          0x401
+#define A_DISCONNECT_AFTER_CMD              0x380
+#define A_DISCONNECT_AFTER_DATA             0x580
+#define A_DISCONNECT_DURING_DATA            0x780
+#define A_RESELECTION_IDENTIFIED            0x1003
+#define A_UNEXPECTED_PHASE                  0x20
+#define A_FATAL                             0x2000
+#define A_DEBUG_INTERRUPT                   0x3000
+
+/* SCSI Script execution states */
+#define SCRIPT_STATE_IDLE                  0
+#define SCRIPT_STATE_SELECTING             1
+#define SCRIPT_STATE_COMMAND               2
+#define SCRIPT_STATE_DATA                  3
+#define SCRIPT_STATE_STATUS                4
+#define SCRIPT_STATE_MESSAGE               5
+#define SCRIPT_STATE_DISCONNECTED          6
+
+#define AFTER_SELECTION         0x100
+#define BEFORE_CMD              0x200
+#define AFTER_CMD               0x300
+#define AFTER_STATUS            0x400
+#define AFTER_DATA_IN           0x500
+#define AFTER_DATA_OUT          0x600
+#define DURING_DATA_IN          0x700
+
+#define NOT_MSG_OUT             0x10
+#define UNEXPECTED_PHASE        0x20
+#define NOT_MSG_IN              0x30
+#define UNEXPECTED_MSG          0x40
+#define MSG_IN                  0x50
+#define SDTR_MSG_R              0x60
+#define REJECT_MSG_R            0x70
+#define DISCONNECT              0x80
+#define MSG_OUT                 0x90
+#define WDTR_MSG_R              0xA0
+
+#define GOOD_STATUS             0x1
+
+#define NOT_MSG_OUT_AFTER_SELECTION         0x110
+#define UNEXPECTED_PHASE_BEFORE_CMD         0x220
+#define UNEXPECTED_PHASE_AFTER_CMD          0x320
+#define NOT_MSG_IN_AFTER_STATUS             0x430
+#define GOOD_STATUS_AFTER_STATUS            0x401
+#define UNEXPECTED_PHASE_AFTER_DATA_IN      0x520
+#define UNEXPECTED_PHASE_AFTER_DATA_OUT     0x620
+#define UNEXPECTED_MSG_BEFORE_CMD           0x240
+#define MSG_IN_BEFORE_CMD                   0x250
+#define MSG_IN_AFTER_CMD                    0x350
+#define SDTR_MSG_BEFORE_CMD                 0x260
+#define REJECT_MSG_BEFORE_CMD               0x270
+#define DISCONNECT_AFTER_CMD                0x380
+#define SDTR_MSG_AFTER_CMD                  0x360
+#define WDTR_MSG_AFTER_CMD                  0x3A0
+#define MSG_IN_AFTER_STATUS                 0x440
+#define DISCONNECT_AFTER_DATA               0x580
+#define MSG_IN_AFTER_DATA_IN                0x550
+#define MSG_IN_AFTER_DATA_OUT               0x650
+#define MSG_OUT_AFTER_DATA_IN               0x590
+#define DATA_IN_AFTER_DATA_IN               0x5a0
+#define MSG_IN_DURING_DATA_IN               0x750
+#define DISCONNECT_DURING_DATA              0x780
+
+#define RESELECTED_DURING_SELECTION      0x1000
+#define COMPLETED_SELECTION_AS_TARGET    0x1001
+#define RESELECTION_IDENTIFIED           0x1003
+
+#define FATAL                            0x2000
+#define FATAL_UNEXPECTED_RESELECTION_MSG 0x2000
+#define FATAL_SEND_MSG                   0x2001
+#define FATAL_NOT_MSG_IN_AFTER_SELECTION 0x2002
+#define FATAL_ILLEGAL_MSG_LENGTH         0x2003
+
+#define DEBUG_INTERRUPT     0x3000
+#define DEBUG_INTERRUPT1    0x3001
+#define DEBUG_INTERRUPT2    0x3002
+#define DEBUG_INTERRUPT3    0x3003
+#define DEBUG_INTERRUPT4    0x3004
+#define DEBUG_INTERRUPT5    0x3005
+#define DEBUG_INTERRUPT6    0x3006
+
+#define COMMAND_COMPLETE_MSG      0x00
+#define EXTENDED_MSG              0x01
+#define SDTR_MSG                  0x01
+#define SAVE_DATA_PTRS_MSG        0x02
+#define RESTORE_DATA_PTRS_MSG     0x03
+#define WDTR_MSG                  0x03
+#define DISCONNECT_MSG            0x04
+#define REJECT_MSG                0x07
+#define PARITY_ERROR_MSG          0x09
+#define SIMPLE_TAG_MSG            0x20
+#define IDENTIFY_MSG              0x80
+#define IDENTIFY_MSG_MASK         0x7F
+#define TWO_BYTE_MSG              0x20
+#define TWO_BYTE_MSG_MASK         0x0F
+
+/* SCSI phases */
+#define PHASE_DO   0  /* Data out phase */
+#define PHASE_DI   1  /* Data in phase */
+#define PHASE_CO   2  /* Command phase */
+#define PHASE_SI   3  /* Status phase */
+#define PHASE_ST   3  /* Status phase (alias) */
+#define PHASE_MO   6  /* Message out phase */
+#define PHASE_MI   7  /* Message in phase */
+#define PHASE_MASK 7  /* Mask for phase bits */
+
+#define NCR710_TAG_VALID     (1 << 16)
+
+static void ncr710_scsi_fifo_init(NCR710_SCSI_FIFO *fifo);
+static const char *ncr710_reg_name(int offset);
+static void ncr710_script_scsi_interrupt(NCR710State *s, int stat0);
+static void ncr710_update_irq(NCR710State *s);
+static void ncr710_script_dma_interrupt(NCR710State *s, int stat);
+static void ncr710_request_free(NCR710State *s, NCR710Request *p);
+static inline void ncr710_dma_read(NCR710State *s, uint32_t addr,
+                                   void *buf, uint32_t len);
+static inline void ncr710_dma_write(NCR710State *s, uint32_t addr,
+                                    const void *buf, uint32_t len);
+static uint8_t ncr710_reg_readb(NCR710State *s, int offset);
+static void ncr710_reg_writeb(NCR710State *s, int offset, uint8_t val);
+
+
+static inline int ncr710_irq_on_rsl(NCR710State *s)
+{
+    return (s->sien0 & NCR710_SSTAT0_SEL) != 0;
+}
+
+static void ncr710_clear_pending_irq(NCR710State *s)
+{
+    if (s->current) {
+        if (s->current->req) {
+            s->current->req->hba_private = NULL;
+        }
+        ncr710_request_free(s, s->current);
+        s->current = NULL;
+    }
+}
+
+void ncr710_soft_reset(NCR710State *s)
+{
+    trace_ncr710_reset();
+    s->carry = 0;
+    s->msg_action = NCR710_MSG_ACTION_NONE;
+    s->msg_len = 0;
+    s->waiting = NCR710_WAIT_NONE;
+    s->wait_reselect = false;
+    s->reselection_id = 0;
+    s->dsa = 0;
+    s->dnad = 0;
+    s->dbc = 0;
+    s->temp = 0;
+    s->scratch = 0;
+    s->istat &= 0x40;
+    s->dcmd = 0x40;
+    s->dstat = NCR710_DSTAT_DFE;
+    s->dien = 0x04;
+    s->sien0 = 0;
+    s->ctest2 = NCR710_CTEST2_DACK;
+    s->ctest3 = 0;
+    s->ctest4 = 0;
+    s->ctest5 = 0;
+    s->dsp = 0;
+    s->dsps = 0;
+    s->dmode = 0;
+    s->dcntl = 0;
+    s->scntl0 = 0xc0;
+    s->scntl1 = 0;
+    s->sstat0 = 0;
+    s->sstat1 = 0;
+    s->sstat2 = 0;
+    s->scid = 0x80;
+    s->sxfer = 0;
+    s->socl = 0;
+    s->sdid = 0;
+    s->sbcl = 0;
+    s->sidl = 0;
+    s->sfbr = 0;
+    qemu_set_irq(s->irq, 0);
+    ncr710_clear_pending_irq(s);
+    ncr710_scsi_fifo_init(&s->scsi_fifo);
+}
+
+static const char *ncr710_reg_name(int offset)
+{
+    switch (offset) {
+    case NCR710_SCNTL0_REG:      return "SCNTL0";
+    case NCR710_SCNTL1_REG:      return "SCNTL1";
+    case NCR710_SDID_REG:        return "SDID";
+    case NCR710_SIEN_REG:        return "SIEN";
+    case NCR710_SCID_REG:        return "SCID";
+    case NCR710_SXFER_REG:       return "SXFER";
+    case NCR710_SODL_REG:        return "SODL";
+    case NCR710_SOCL_REG:        return "SOCL";
+    case NCR710_SFBR_REG:        return "SFBR";
+    case NCR710_SIDL_REG:        return "SIDL";
+    case NCR710_SBDL_REG:        return "SBDL";
+    case NCR710_SBCL_REG:        return "SBCL";
+    case NCR710_DSTAT_REG:       return "DSTAT";
+    case NCR710_SSTAT0_REG:      return "SSTAT0";
+    case NCR710_SSTAT1_REG:      return "SSTAT1";
+    case NCR710_SSTAT2_REG:      return "SSTAT2";
+    case NCR710_DSA_REG:         return "DSA";
+    case NCR710_DSA_REG + 1:     return "DSA+1";
+    case NCR710_DSA_REG + 2:     return "DSA+2";
+    case NCR710_DSA_REG + 3:     return "DSA+3";
+    case NCR710_CTEST0_REG:      return "CTEST0";
+    case NCR710_CTEST1_REG:      return "CTEST1";
+    case NCR710_CTEST2_REG:      return "CTEST2";
+    case NCR710_CTEST3_REG:      return "CTEST3";
+    case NCR710_CTEST4_REG:      return "CTEST4";
+    case NCR710_CTEST5_REG:      return "CTEST5";
+    case NCR710_CTEST6_REG:      return "CTEST6";
+    case NCR710_CTEST7_REG:      return "CTEST7";
+    case NCR710_TEMP_REG:        return "TEMP";
+    case NCR710_TEMP_REG + 1:    return "TEMP+1";
+    case NCR710_TEMP_REG + 2:    return "TEMP+2";
+    case NCR710_TEMP_REG + 3:    return "TEMP+3";
+    case NCR710_DFIFO_REG:       return "DFIFO";
+    case NCR710_ISTAT_REG:       return "ISTAT";
+    case NCR710_CTEST8_REG:      return "CTEST8";
+    case NCR710_LCRC_REG:        return "LCRC";
+    case NCR710_DBC_REG:         return "DBC";
+    case NCR710_DBC_REG + 1:     return "DBC+1";
+    case NCR710_DBC_REG + 2:     return "DBC+2";
+    case NCR710_DCMD_REG:        return "DCMD";
+    case NCR710_DNAD_REG:        return "DNAD";
+    case NCR710_DNAD_REG + 1:    return "DNAD+1";
+    case NCR710_DNAD_REG + 2:    return "DNAD+2";
+    case NCR710_DNAD_REG + 3:    return "DNAD+3";
+    case NCR710_DSP_REG:         return "DSP";
+    case NCR710_DSP_REG + 1:     return "DSP+1";
+    case NCR710_DSP_REG + 2:     return "DSP+2";
+    case NCR710_DSP_REG + 3:     return "DSP+3";
+    case NCR710_DSPS_REG:        return "DSPS";
+    case NCR710_DSPS_REG + 1:    return "DSPS+1";
+    case NCR710_DSPS_REG + 2:    return "DSPS+2";
+    case NCR710_DSPS_REG + 3:    return "DSPS+3";
+    case NCR710_SCRATCH_REG:     return "SCRATCH";
+    case NCR710_SCRATCH_REG + 1: return "SCRATCH+1";
+    case NCR710_SCRATCH_REG + 2: return "SCRATCH+2";
+    case NCR710_SCRATCH_REG + 3: return "SCRATCH+3";
+    case NCR710_DMODE_REG:       return "DMODE";
+    case NCR710_DIEN_REG:        return "DIEN";
+    case NCR710_DWT_REG:         return "DWT";
+    case NCR710_DCNTL_REG:       return "DCNTL";
+    case NCR710_ADDER_REG:       return "ADDER";
+    case NCR710_ADDER_REG + 1:   return "ADDER+1";
+    case NCR710_ADDER_REG + 2:   return "ADDER+2";
+    case NCR710_ADDER_REG + 3:   return "ADDER+3";
+    default:                     return "UNKNOWN";
+    }
+}
+
+static uint8_t ncr710_generate_scsi_parity(NCR710State *s, uint8_t data)
+{
+    uint8_t parity = parity8(data);
+
+    if (s->scntl1 & NCR710_SCNTL1_AESP) {
+        parity = !parity;
+    }
+
+    return parity;
+}
+
+static bool ncr710_check_scsi_parity(NCR710State *s, uint8_t data,
+                                     uint8_t parity)
+{
+    if (!(s->scntl0 & NCR710_SCNTL0_EPC)) {
+        return true;
+    }
+
+    uint8_t expected_parity = ncr710_generate_scsi_parity(s, data);
+    return parity == expected_parity;
+}
+
+static void ncr710_handle_parity_error(NCR710State *s)
+{
+    s->sstat0 |= NCR710_SSTAT0_PAR;
+
+    /* If parity error ATN is enabled, assert ATN */
+    if (s->scntl0 & NCR710_SCNTL0_AAP) {
+        s->socl |= NCR710_SOCL_ATN;
+    }
+
+    ncr710_script_scsi_interrupt(s, NCR710_SSTAT0_PAR);
+}
+
+/*
+ * NCR710 SCSI FIFO IMPLEMENTATION
+ *
+ * Hardware Specifications (NCR53C710 datasheet):
+ * - Width: 9 bits (8 data bits + 1 parity bit)
+ * - Depth: 8 bytes
+ * - Type: Circular buffer
+ *
+ * Implementation:
+ * - Enqueue: Add byte at tail position ((head + count) % 8)
+ * - Dequeue: Remove byte from head position, advance head
+ * - Status: Empty (count=0), Full (count=8)
+ *
+ * FIFO Operations:
+ * - ncr710_scsi_fifo_init()    - Reset FIFO to empty state
+ * - ncr710_scsi_fifo_enqueue() - Add byte with parity to tail
+ * - ncr710_scsi_fifo_dequeue() - Remove byte with parity from head
+ * - ncr710_scsi_fifo_empty()   - Check if FIFO is empty
+ * - ncr710_scsi_fifo_full()    - Check if FIFO is full
+ */
+
+static void ncr710_scsi_fifo_init(NCR710_SCSI_FIFO *fifo)
+{
+    memset(fifo->data, 0, NCR710_SCSI_FIFO_SIZE);
+    memset(fifo->parity, 0, NCR710_SCSI_FIFO_SIZE);
+    fifo->head = 0;
+    fifo->count = 0;
+}
+
+static inline bool ncr710_scsi_fifo_empty(NCR710_SCSI_FIFO *fifo)
+{
+    return fifo->count == 0;
+}
+
+static inline bool ncr710_scsi_fifo_full(NCR710_SCSI_FIFO *fifo)
+{
+    return fifo->count == NCR710_SCSI_FIFO_SIZE;
+}
+
+static inline int ncr710_scsi_fifo_enqueue(NCR710_SCSI_FIFO *fifo,
+                                           uint8_t data, uint8_t parity)
+{
+    if (ncr710_scsi_fifo_full(fifo)) {
+        return -1; /* FIFO full - 8 transfers deep */
+    }
+
+    /* Add data at the tail (head + count) */
+    int tail_pos = (fifo->head + fifo->count) % NCR710_SCSI_FIFO_SIZE;
+    fifo->data[tail_pos] = data;
+    fifo->parity[tail_pos] = parity;
+    fifo->count++;
+
+    return 0;
+}
+
+static inline uint8_t ncr710_scsi_fifo_dequeue(NCR710_SCSI_FIFO *fifo,
+                                                uint8_t *parity)
+{
+    uint8_t data;
+
+    if (ncr710_scsi_fifo_empty(fifo)) {
+        *parity = 0;
+        return 0; /* FIFO empty */
+    }
+
+    /* Taking data from the head position */
+    data = fifo->data[fifo->head];
+    *parity = fifo->parity[fifo->head];
+    fifo->head = (fifo->head + 1) % NCR710_SCSI_FIFO_SIZE;
+    fifo->count--;
+
+    return data;
+}
+
+static inline uint32_t ncr710_read_dword(NCR710State *s, uint32_t addr)
+{
+    uint32_t buf;
+    address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+                       (uint8_t *)&buf, 4);
+    /*
+     * The NCR710 datasheet saying "operates internally in LE mode"
+     * refers to its internal register organization,
+     * not how it reads SCRIPTS from host memory.
+     */
+    buf = be32_to_cpu(buf);
+    NCR710_DPRINTF("Read dword %08x from %08x\n", buf, addr);
+    return buf;
+}
+
+static inline void ncr710_dma_read(NCR710State *s, uint32_t addr,
+                                   void *buf, uint32_t len)
+{
+    address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+                       buf, len);
+    NCR710_DPRINTF("Read %d bytes from %08x: ", len, addr);
+    for (int i = 0; i < len && i < 16; i++) {
+        NCR710_DPRINTF("%02x ", ((uint8_t *)buf)[i]);
+    }
+    NCR710_DPRINTF("\n");
+}
+
+static inline void ncr710_dma_write(NCR710State *s, uint32_t addr,
+                                    const void *buf, uint32_t len)
+{
+    address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+                        buf, len);
+    NCR710_DPRINTF("Wrote %d bytes to %08x\n", len, addr);
+}
+
+static void ncr710_stop_script(NCR710State *s)
+{
+    s->script_active = 0;
+    s->scntl1 &= ~NCR710_SCNTL1_CON;
+    s->istat &= ~NCR710_ISTAT_CON;
+}
+
+static void ncr710_update_irq(NCR710State *s)
+{
+    int level = 0;
+
+    if (s->dstat) {
+        if (s->dstat & s->dien) {
+            level = 1;
+        }
+        s->istat |= NCR710_ISTAT_DIP;
+    } else {
+        s->istat &= ~NCR710_ISTAT_DIP;
+    }
+
+    if (s->sstat0) {
+        if ((s->sstat0 & s->sien0)) {
+            level = 1;
+        }
+        s->istat |= NCR710_ISTAT_SIP;
+    } else {
+        s->istat &= ~NCR710_ISTAT_SIP;
+    }
+
+    qemu_set_irq(s->irq, level);
+}
+
+static void ncr710_script_scsi_interrupt(NCR710State *s, int stat0)
+{
+    uint32_t mask0;
+
+    trace_ncr710_script_scsi_interrupt(stat0, s->sstat0);
+    s->sstat0 |= stat0;
+    mask0 = stat0 & s->sien0;
+    if (mask0) {
+        ncr710_stop_script(s);
+        s->istat |= NCR710_ISTAT_SIP;
+        ncr710_update_irq(s);
+    }
+}
+
+static void ncr710_script_dma_interrupt(NCR710State *s, int stat)
+{
+    trace_ncr710_script_dma_interrupt(stat, s->dstat);
+    if (stat == NCR710_DSTAT_SIR && (s->dstat & NCR710_DSTAT_DFE)) {
+        s->dstat &= ~NCR710_DSTAT_DFE;
+    }
+
+    s->dstat |= stat;
+    s->istat |= NCR710_ISTAT_DIP;
+    ncr710_update_irq(s);
+    ncr710_stop_script(s);
+}
+
+inline void ncr710_set_phase(NCR710State *s, int phase)
+{
+    s->sstat2 = (s->sstat2 & ~PHASE_MASK) | phase;
+    s->ctest0 &= ~1;
+    if (phase == PHASE_DI) {
+        s->ctest0 |= 1;
+    }
+    s->sbcl &= ~NCR710_SBCL_REQ;
+}
+
+static void ncr710_disconnect(NCR710State *s)
+{
+    trace_ncr710_disconnect(s->waiting);
+    if (s->waiting == NCR710_WAIT_NONE) {
+        s->scntl1 &= ~NCR710_SCNTL1_CON;
+        s->istat &= ~NCR710_ISTAT_CON;
+    }
+    s->sstat2 &= ~PHASE_MASK;
+}
+
+static void ncr710_bad_selection(NCR710State *s, uint32_t id)
+{
+    trace_ncr710_bad_selection(id);
+    s->dstat = 0;
+    s->dsps = 0;
+    ncr710_script_scsi_interrupt(s, NCR710_SSTAT0_STO);
+    ncr710_disconnect(s);
+}
+
+static void ncr710_clear_selection_timeout(NCR710State *s)
+{
+    if (s->sstat0 & NCR710_SSTAT0_STO) {
+        s->sstat0 &= ~NCR710_SSTAT0_STO;
+        ncr710_clear_pending_irq(s);
+        if (s->sstat0 == 0) {
+            s->istat &= ~NCR710_ISTAT_SIP;
+        }
+        ncr710_update_irq(s);
+    }
+}
+
+static void ncr710_do_dma(NCR710State *s, int out)
+{
+    uint32_t count;
+    uint32_t addr;
+    SCSIDevice *dev;
+    assert(s->current);
+    if (!s->current->dma_len) {
+        /* We wait until data is available.  */
+        return;
+    }
+
+    dev = s->current->req->dev;
+    assert(dev);
+
+    count = s->dbc;
+    if (count > s->current->dma_len) {
+        count = s->current->dma_len;
+    }
+
+    addr = s->dnad;
+
+    s->dnad += count;
+    s->dbc -= count;
+    if (s->current->dma_buf == NULL) {
+        s->current->dma_buf = scsi_req_get_buf(s->current->req);
+    }
+    /* ??? Set SFBR to first data byte.  */
+    if (out) {
+        ncr710_dma_read(s, addr, s->current->dma_buf, count);
+    } else {
+        ncr710_dma_write(s, addr, s->current->dma_buf, count);
+    }
+    s->current->dma_len -= count;
+    if (s->current->dma_len == 0) {
+        s->current->dma_buf = NULL;
+        s->current->pending = 0;
+        scsi_req_continue(s->current->req);
+    } else {
+        s->current->dma_buf += count;
+        s->waiting = NCR710_WAIT_NONE;
+        ncr710_execute_script(s);
+    }
+}
+
+static void ncr710_add_msg_byte(NCR710State *s, uint8_t data)
+{
+    if (s->msg_len >= NCR710_MAX_MSGIN_LEN) {
+        BADF("MSG IN data too long\n");
+    } else {
+        s->msg[s->msg_len++] = data;
+    }
+}
+
+static void ncr710_request_free(NCR710State *s, NCR710Request *p)
+{
+    if (p == s->current) {
+        s->current = NULL;
+    }
+    g_free(p);
+}
+
+void ncr710_request_cancelled(SCSIRequest *req)
+{
+    NCR710State *s = ncr710_from_scsi_bus(req->bus);
+    NCR710Request *p = (NCR710Request *)req->hba_private;
+    req->hba_private = NULL;
+    ncr710_request_free(s, p);
+    scsi_req_unref(req);
+}
+
+static int ncr710_queue_req(NCR710State *s, SCSIRequest *req, uint32_t len)
+{
+    NCR710Request *p = (NCR710Request *)req->hba_private;
+
+    if (!p) {
+        return -1;
+    }
+    p->pending = len;
+    if ((s->waiting == NCR710_WAIT_RESELECT &&
+        !(s->istat & (NCR710_ISTAT_SIP | NCR710_ISTAT_DIP))) ||
+        (ncr710_irq_on_rsl(s) && !(s->scntl1 & NCR710_SCNTL1_CON) &&
+        !(s->istat & (NCR710_ISTAT_SIP | NCR710_ISTAT_DIP)))) {
+        s->current = p;
+        return 0;
+    } else {
+        s->current = p;
+        return 1;
+    }
+}
+
+void ncr710_command_complete(SCSIRequest *req, size_t resid)
+{
+    NCR710State *s = ncr710_from_scsi_bus(req->bus);
+    NCR710Request *p = (NCR710Request *)req->hba_private;
+
+    trace_ncr710_command_complete(req->tag, req->status);
+
+    s->lcrc = 0;
+    s->status = req->status;
+    s->command_complete = NCR710_CMD_COMPLETE;
+
+    if (p) {
+        p->pending = 0;
+    }
+
+    ncr710_set_phase(s, PHASE_ST);
+
+    if (req->hba_private == s->current) {
+        scsi_req_unref(req);
+    }
+
+    if (s->waiting == NCR710_WAIT_RESELECT || s->waiting == NCR710_WAIT_DMA) {
+        s->waiting = NCR710_WAIT_NONE;
+        ncr710_execute_script(s);
+    }
+}
+
+void ncr710_transfer_data(SCSIRequest *req, uint32_t len)
+{
+    NCR710State *s = ncr710_from_scsi_bus(req->bus);
+
+    assert(req->hba_private);
+
+    if (s->waiting == NCR710_WAIT_DMA) {
+        NCR710Request *p = (NCR710Request *)req->hba_private;
+        if (p) {
+            p->dma_len = len;
+        }
+        s->dsp -= 8;
+        s->waiting = NCR710_WAIT_NONE;
+        ncr710_execute_script(s);
+        return;
+    }
+
+    if (s->wait_reselect) {
+        s->current = (NCR710Request *)req->hba_private;
+        s->current->dma_len = len;
+        s->waiting = NCR710_WAIT_RESELECT;
+    }
+
+    if (req->hba_private != s->current ||
+        (ncr710_irq_on_rsl(s) && !(s->scntl1 & NCR710_SCNTL1_CON)) ||
+        s->waiting == NCR710_WAIT_RESELECT) {
+        int queue_result = ncr710_queue_req(s, req, len);
+        if (queue_result != 0) {
+            return;
+        }
+    }
+
+    /* Host adapter (re)connected */
+    s->current->dma_len = len;
+    s->command_complete = NCR710_CMD_DATA_READY;
+
+    if (!s->current) {
+        return;
+    }
+
+    if (s->waiting) {
+        s->scntl1 |= NCR710_SCNTL1_CON;
+        s->istat |= NCR710_ISTAT_CON;
+        s->sbcl = NCR710_SBCL_IO | NCR710_SBCL_CD | NCR710_SBCL_MSG |
+                  NCR710_SBCL_BSY | NCR710_SBCL_SEL | NCR710_SBCL_REQ;
+        uint8_t host_id = (s->scid & 0x07);
+
+        /* Special case: both target and host are ID 0 */
+        if (req->dev->id == 0 && host_id == 0) {
+            s->sfbr = 0x00;
+        } else {
+            s->sfbr = (req->dev->id == 0 ? 0 : (1 << req->dev->id)) |
+                      (host_id == 0 ? 0 : (1 << host_id));
+        }
+
+        ncr710_set_phase(s, PHASE_MI);
+
+        if (s->current) {
+            uint8_t identify_msg = 0x80 | (req->lun & 0x07);
+            ncr710_add_msg_byte(s, identify_msg);
+
+            if (s->current->tag) {
+                ncr710_add_msg_byte(s, 0x20);  /* SIMPLE_TAG_MSG */
+                ncr710_add_msg_byte(s, s->current->tag & 0xff);
+            }
+        }
+
+        s->sstat0 |= NCR710_SSTAT0_SEL;
+        s->istat |= NCR710_ISTAT_SIP;
+        s->dsps = RESELECTED_DURING_SELECTION;
+        s->waiting = NCR710_WAIT_NONE;
+        ncr710_update_irq(s);
+        return;
+    }
+    if (!s->script_active && !s->waiting) {
+        ncr710_execute_script(s);
+    }
+}
+
+static int idbitstonum(uint8_t id)
+{
+    return 7 - clz8(id);
+}
+
+static void ncr710_do_command(NCR710State *s)
+{
+    SCSIDevice *dev;
+    uint8_t buf[16];
+    uint32_t id;
+    int n;
+    int bytes_read;
+    if (s->dbc > 16) {
+        s->dbc = 16;
+    }
+
+    /*
+     * Reading command data directly from memory
+     * NOTE: SCSI commands can be up to 16 bytes
+     * (e.g., READ_CAPACITY_10 is 10 bytes) but the NCR710 SCSI FIFO is
+     * only 8 bytes deep. For command phase, we bypass the FIFO and read
+     * directly from memory since commands don't need FIFO buffering.
+     */
+    bytes_read = MIN(s->dbc, sizeof(buf));
+    ncr710_dma_read(s, s->dnad, buf, bytes_read);
+
+    s->dnad += bytes_read;
+    s->dbc -= bytes_read;
+    s->sfbr = buf[0];
+
+    s->command_complete = NCR710_CMD_PENDING;
+    id = (s->select_tag >> 8) & 0xff;
+    s->lcrc = id;
+
+    dev = scsi_device_find(&s->bus, 0, idbitstonum(id), s->current_lun);
+
+    if (!dev) {
+        ncr710_bad_selection(s, id);
+        return;
+    }
+
+    if (s->current) {
+        ncr710_request_free(s, s->current);
+        s->current = NULL;
+    }
+
+    s->current = g_new0(NCR710Request, 1);
+    s->current->tag = s->select_tag;
+    s->current->resume_offset = 0;
+
+    s->current->req = scsi_req_new(dev, s->current->tag, s->current_lun, buf,
+                                   bytes_read, s->current);
+    n = scsi_req_enqueue(s->current->req);
+    if (n) {
+        if (n > 0) {
+            ncr710_set_phase(s, PHASE_DI);
+        } else if (n < 0) {
+            ncr710_set_phase(s, PHASE_DO);
+        }
+        scsi_req_continue(s->current->req);
+    }
+
+    if (!s->command_complete) {
+        if (!n) {
+            ncr710_set_phase(s, PHASE_SI);
+        } else {
+            NCR710_DPRINTF("Data transfer phase\n");
+        }
+    }
+}
+
+static void ncr710_do_status(NCR710State *s)
+{
+    uint8_t status = s->status;
+    uint8_t parity = 0;
+
+    if (s->dbc != 1) {
+        BADF("Bad Status move\n");
+    }
+    s->dbc = 1;
+    s->sfbr = status;
+
+    /* Generate parity if enabled and enqueue status byte */
+    if (s->scntl0 & NCR710_SCNTL0_EPG) {
+        parity = ncr710_generate_scsi_parity(s, status);
+    }
+    ncr710_scsi_fifo_enqueue(&s->scsi_fifo, status, parity);
+
+    /* Dequeue status byte and write to memory */
+    status = ncr710_scsi_fifo_dequeue(&s->scsi_fifo, &parity);
+    if (s->scntl0 & NCR710_SCNTL0_EPC) {
+        if (!ncr710_check_scsi_parity(s, status, parity)) {
+            ncr710_handle_parity_error(s);
+        }
+    }
+    ncr710_dma_write(s, s->dnad, &status, 1);
+
+    s->dnad += 1;
+    s->dbc  -= 1;
+
+    ncr710_set_phase(s, PHASE_MI);
+    s->msg_action = NCR710_MSG_ACTION_DISCONNECT;
+    ncr710_add_msg_byte(s, 0); /* COMMAND COMPLETE */
+}
+
+static void ncr710_do_msgin(NCR710State *s)
+{
+    int len;
+    len = s->msg_len;
+    if (len > s->dbc) {
+        len = s->dbc;
+    }
+    s->sfbr = s->msg[0];
+
+    for (int i = 0; i < len; i++) {
+        uint8_t parity = 0;
+        if (s->scntl0 & NCR710_SCNTL0_EPG) {
+            parity = ncr710_generate_scsi_parity(s, s->msg[i]);
+        }
+        ncr710_scsi_fifo_enqueue(&s->scsi_fifo, s->msg[i], parity);
+    }
+
+    uint8_t buf[NCR710_MAX_MSGIN_LEN];
+    for (int i = 0; i < len; i++) {
+        uint8_t parity;
+        buf[i] = ncr710_scsi_fifo_dequeue(&s->scsi_fifo, &parity);
+        if (s->scntl0 & NCR710_SCNTL0_EPC) {
+            if (!ncr710_check_scsi_parity(s, buf[i], parity)) {
+                ncr710_handle_parity_error(s);
+            }
+        }
+    }
+    ncr710_dma_write(s, s->dnad, buf, len);
+
+    s->dnad += len;
+    s->dbc  -= len;
+    s->sidl = s->msg[len - 1];
+    s->msg_len -= len;
+    if (s->msg_len) {
+        memmove(s->msg, s->msg + len, s->msg_len);
+        return;
+    }
+    switch (s->msg_action) {
+    case NCR710_MSG_ACTION_NONE:
+        ncr710_set_phase(s, PHASE_CO);
+        break;
+    case NCR710_MSG_ACTION_DISCONNECT:
+        ncr710_disconnect(s);
+        break;
+    case NCR710_MSG_ACTION_DATA_OUT:
+        ncr710_set_phase(s, PHASE_DO);
+        break;
+    case NCR710_MSG_ACTION_DATA_IN:
+        ncr710_set_phase(s, PHASE_DI);
+        break;
+    default:
+        abort();
+    }
+}
+
+static void ncr710_do_msgout(NCR710State *s)
+{
+    NCR710Request *current_req = s->current;
+
+    while (s->dbc > 0) {
+        int to_move = MIN((int)s->dbc, NCR710_SCSI_FIFO_SIZE);
+        uint8_t temp_buf[NCR710_SCSI_FIFO_SIZE];
+        ncr710_dma_read(s, s->dnad, temp_buf, to_move);
+        int filled = 0;
+        for (int j = 0; j < to_move &&
+                 !ncr710_scsi_fifo_full(&s->scsi_fifo); j++) {
+            uint8_t parity = 0;
+            if (s->scntl0 & NCR710_SCNTL0_EPG) {
+                parity = ncr710_generate_scsi_parity(s, temp_buf[j]);
+            }
+            if (ncr710_scsi_fifo_enqueue(&s->scsi_fifo, temp_buf[j],
+                                         parity) == 0) {
+                filled++;
+            } else {
+                break;
+            }
+        }
+
+        if (filled <= 0) {
+            break;
+        }
+        uint8_t buf[NCR710_SCSI_FIFO_SIZE];
+        int bytes = 0;
+        for (int j = 0; j < filled &&
+                 !ncr710_scsi_fifo_empty(&s->scsi_fifo); j++) {
+            uint8_t parity;
+            buf[bytes] = ncr710_scsi_fifo_dequeue(&s->scsi_fifo, &parity);
+            if (s->scntl0 & NCR710_SCNTL0_EPC) {
+                if (!ncr710_check_scsi_parity(s, buf[bytes], parity)) {
+                    ncr710_handle_parity_error(s);
+                }
+            }
+            bytes++;
+        }
+
+        s->dnad += bytes;
+        s->dbc  -= bytes;
+        int i = 0;
+        while (i < bytes) {
+            uint8_t msg = buf[i++];
+            s->sfbr = msg;
+
+            switch (msg) {
+            case SCSI_MSG_COMMAND_COMPLETE:
+                /* 0x00 - NOP / padding byte / Command Complete */
+                /* Just gonna ignore padding bytes, continue processing */
+                break;
+
+            case SCSI_MSG_DISCONNECT: /* 0x04 - Disconnect */
+                ncr710_disconnect(s);
+                break;
+
+            case SCSI_MSG_MESSAGE_REJECT: /* 0x07 - Message Reject */
+                /* Target is rejecting our last message */
+                ncr710_set_phase(s, PHASE_CO);
+                break;
+
+            case SCSI_MSG_NO_OPERATION: /* 0x08 - NOP */
+                ncr710_set_phase(s, PHASE_CO);
+                break;
+
+            case SCSI_MSG_SAVE_DATA_POINTER: /* 0x02 - Save Data Pointer */
+                /* Save current data pointer for later restore */
+                break;
+
+            case SCSI_MSG_RESTORE_POINTERS: /* 0x03 - Restore Pointers */
+                /* Restore previously saved data pointer */
+                break;
+
+            case SCSI_MSG_EXTENDED_MESSAGE: { /* 0x01 - Extended message */
+                if (i >= bytes) {
+                    /* Not enough data; let next chunk continue parsing */
+                    i--; /* rewind one to reparse later */
+                    goto out_chunk;
+                }
+                i++; /* skip ext_len */
+
+                if (i >= bytes) {
+                    i -= 2; /* rewind msg + ext_len for next chunk */
+                    goto out_chunk;
+                }
+                uint8_t ext_code = buf[i++];
+
+                switch (ext_code) {
+                case 1: /* SDTR (ignore body) */
+                    /* Body has 2 bytes, may span chunks: skip what we have */
+                    {
+                        int skip = MIN(2, bytes - i);
+                        i += skip;
+                        /*
+                         * If not all skipped this chunk, rest will arrive
+                         * in next loop
+                         */
+                    }
+                    break;
+                case 3: /* WDTR (ignore body) */
+                    if (i < bytes) {
+                        i++; /* skip one param byte if present this chunk */
+                    }
+                    break;
+                default:
+                    goto bad;
+                }
+                break;
+            }
+
+            case 0x20: /* SIMPLE queue tag */
+            case 0x21: /* HEAD of queue tag */
+            case 0x22: /* ORDERED queue tag */
+                if (i < bytes) {
+                    uint8_t tag = buf[i++];
+                    s->select_tag = (s->select_tag & 0xFF00) | tag |
+                                    NCR710_TAG_VALID;
+                    NCR710_DPRINTF("Tagged command: tag=0x%02x, "
+                                   "type=0x%02x\n", tag, msg);
+                } else {
+                    /*
+                     * Tag byte not in this chunk; rewind and reparse
+                     * next loop
+                     */
+                    i--;
+                    goto out_chunk;
+                }
+                break;
+
+            case 0x0d: /* ABORT TAG */
+                if (current_req) {
+                    scsi_req_cancel(current_req->req);
+                }
+                ncr710_disconnect(s);
+                break;
+
+            case SCSI_MSG_ABORT: /* 0x06 - ABORT */
+            case 0x0e: /* CLEAR QUEUE */
+            case SCSI_MSG_BUS_DEVICE_RESET: /* 0x0c - BUS DEVICE RESET */
+                if (s->current) {
+                    scsi_req_cancel(s->current->req);
+                }
+                ncr710_disconnect(s);
+                break;
+
+            default:
+                if (msg & SCSI_MSG_IDENTIFY) {
+                    uint8_t lun = msg & 0x07;
+                    s->current_lun = lun;
+                    ncr710_set_phase(s, PHASE_CO);
+                    break;
+                }
+
+                /* Unknown message - reject it */
+                goto bad;
+            }
+        }
+
+out_chunk:
+        continue;
+    }
+
+    return;
+
+bad:
+    BADF("Unimplemented/Invalid message 0x%02x\n", s->sfbr);
+    ncr710_set_phase(s, PHASE_MI);
+    ncr710_add_msg_byte(s, 7);
+    s->msg_action = NCR710_MSG_ACTION_NONE;
+}
+
+static void ncr710_memcpy(NCR710State *s, uint32_t dest, uint32_t src,
+                          int count)
+{
+    uint8_t buf[NCR710_BUF_SIZE];
+
+    while (count) {
+        int chunk = MIN(count, NCR710_BUF_SIZE);
+        /* Read from source */
+        ncr710_dma_read(s, src, buf, chunk);
+
+        /* Write to destination */
+        ncr710_dma_write(s, dest, buf, chunk);
+
+        src += chunk;
+        dest += chunk;
+        count -= chunk;
+    }
+}
+
+static void ncr710_wait_reselect(NCR710State *s)
+{
+    s->wait_reselect = true;
+    s->waiting = NCR710_WAIT_RESELECT;
+    s->script_active = false;
+
+    s->scntl1 &= ~NCR710_SCNTL1_CON;
+    s->istat &= ~NCR710_ISTAT_CON;
+}
+
+void ncr710_reselection_retry_callback(void *opaque)
+{
+    NCR710State *s = opaque;
+
+    if (!s->current || s->current->pending == 0) {
+        return;
+    }
+
+    if (s->waiting != NCR710_WAIT_RESELECT) {
+        return;
+    }
+
+    if (s->istat & (NCR710_ISTAT_SIP | NCR710_ISTAT_DIP)) {
+        timer_mod(s->reselection_retry_timer,
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 1000);
+        return;
+    }
+
+    NCR710Request *p = s->current;
+    uint32_t len = p->pending;
+    p->pending = 0;
+
+    SCSIRequest *req = p->req;
+    s->command_complete = NCR710_CMD_PENDING;
+    p->dma_len = len;
+
+    s->scntl1 |= NCR710_SCNTL1_CON;
+    s->istat |= NCR710_ISTAT_CON;
+    s->sbcl = NCR710_SBCL_IO | NCR710_SBCL_CD | NCR710_SBCL_MSG |
+              NCR710_SBCL_BSY | NCR710_SBCL_SEL | NCR710_SBCL_REQ;
+
+    uint8_t host_id = (s->scid & 0x07);
+    if (req->dev->id == 0 && host_id == 0) {
+        s->sfbr = 0x00;
+    } else {
+        s->sfbr = (req->dev->id == 0 ? 0 : (1 << req->dev->id)) |
+                  (host_id == 0 ? 0 : (1 << host_id));
+    }
+
+    ncr710_set_phase(s, PHASE_MI);
+
+    uint8_t identify_msg = 0x80 | (req->lun & 0x07);
+    ncr710_add_msg_byte(s, identify_msg);
+
+    if (p->tag) {
+        ncr710_add_msg_byte(s, 0x20);  /* SIMPLE_TAG_MSG */
+        ncr710_add_msg_byte(s, p->tag & 0xff);
+    }
+
+    s->dsp = p->resume_offset - 8;
+
+    s->dsps = RESELECTED_DURING_SELECTION;
+    s->sstat0 |= NCR710_SSTAT0_SEL;
+    s->istat |= NCR710_ISTAT_SIP;
+    ncr710_update_irq(s);
+    s->waiting = NCR710_WAIT_NONE;
+}
+
+void ncr710_execute_script(NCR710State *s)
+{
+    uint32_t insn;
+    uint32_t addr;
+    int opcode;
+    s->script_active = 1;
+
+again:
+    insn = ncr710_read_dword(s, s->dsp);
+    if (!insn) {
+        /*
+         * If we receive an empty opcode increment the DSP by 4 bytes
+         * and execute the next opcode at that location
+         */
+        s->dsp += 4;
+        goto again;
+    }
+    addr = ncr710_read_dword(s, s->dsp + 4);
+    s->dsps = addr;
+    s->dcmd = insn >> 24;
+    s->dsp += 8;
+    switch (insn >> 30) {
+    case 0: /* Block move.  */
+        if (s->sstat0 & NCR710_SSTAT0_STO) {
+            NCR710_DPRINTF("Delayed select timeout\n");
+            ncr710_stop_script(s);
+            ncr710_update_irq(s);
+            break;
+        }
+        s->dbc = insn & 0xffffff;
+        if (insn & (1 << 29)) {
+            /* Indirect addressing.  */
+            addr = ncr710_read_dword(s, addr);
+        } else if (insn & (1 << 28)) {
+            uint32_t buf[2];
+            int32_t offset;
+            /* Table indirect addressing.  */
+
+            /* 32-bit Table indirect */
+            offset = sextract32(addr, 0, 24);
+            ncr710_dma_read(s, s->dsa + offset, buf, 8);
+            /* byte count is stored in bits 0:23 only */
+            s->dbc = cpu_to_le32(buf[0]) & 0xffffff;
+            addr = cpu_to_le32(buf[1]);
+        }
+        /* Check phase match for block move instructions */
+        if ((s->sstat2 & PHASE_MASK) != ((insn >> 24) & 7)) {
+            uint8_t current_phase = s->sstat2 & PHASE_MASK;
+
+            ncr710_set_phase(s, current_phase);
+            s->sbcl |= NCR710_SBCL_REQ;
+            ncr710_script_scsi_interrupt(s, NCR710_SSTAT0_MA);
+            ncr710_stop_script(s);
+            break;
+        }
+
+        s->dnad = addr;
+        switch (s->sstat2 & 0x7) {
+        case PHASE_DO:
+            s->waiting = NCR710_WAIT_DMA;
+            ncr710_do_dma(s, 1);
+            break;
+        case PHASE_DI:
+            s->waiting = NCR710_WAIT_DMA;
+            ncr710_do_dma(s, 0);
+            if (s->waiting != NCR710_WAIT_NONE) {
+                /* Async - stop and wait */
+                break;
+            }
+            /* Sync - continue execution */
+            break;
+        case PHASE_CO:
+            ncr710_do_command(s);
+            break;
+        case PHASE_SI:
+            ncr710_do_status(s);
+            break;
+        case PHASE_MO:
+            ncr710_do_msgout(s);
+            break;
+        case PHASE_MI:
+            ncr710_do_msgin(s);
+            break;
+        default:
+            BADF("Unimplemented phase %d\n", s->sstat2 & PHASE_MASK);
+        }
+        s->ctest5 = (s->ctest5 & 0xfc) | ((s->dbc >> 8) & 3);
+        s->sbcl = s->dbc;
+        break;
+
+    case 1: /* IO or Read/Write instruction.  */
+        opcode = (insn >> 27) & 7;
+        if (opcode < 5) {
+            uint32_t id;
+
+            if (insn & (1 << 25)) {
+                id = ncr710_read_dword(s, s->dsa + sextract32(insn, 0, 24));
+            } else {
+                id = insn;
+            }
+            id = (id >> 16) & 0xff;
+            if (insn & (1 << 26)) {
+                addr = s->dsp + sextract32(addr, 0, 24);
+            }
+            s->dnad = addr;
+            switch (opcode) {
+            case 0: /* Select */
+                s->sdid = id;
+                if (s->scntl1 & NCR710_SCNTL1_CON) {
+                    if (!(insn & (1 << 24))) {
+                        s->dsp = s->dnad;
+                        break;
+                    }
+                } else if (!scsi_device_find(&s->bus, 0, idbitstonum(id), 0)) {
+                    ncr710_bad_selection(s, id);
+                    break;
+                } else {
+                    /*
+                     * ??? Linux drivers compain when this is set. Maybe
+                     * it only applies in low-level mode (unimplemented).
+                     * ncr710_script_scsi_interrupt(s, NCR710_SIST0_CMP, 0);
+                     */
+                    s->select_tag = id << 8;
+                    s->scntl1 |= NCR710_SCNTL1_CON;
+
+                    if (insn & (1 << 24)) {
+                        s->socl |= NCR710_SOCL_ATN;
+                        ncr710_set_phase(s, PHASE_MO);
+                    } else {
+                        ncr710_set_phase(s, PHASE_CO);
+                    }
+                }
+                break;
+            case 1: /* Disconnect */
+
+                if (s->command_complete != NCR710_CMD_PENDING) {
+                    s->scntl1 &= ~NCR710_SCNTL1_CON;
+                    s->istat &= ~NCR710_ISTAT_CON;
+                    if (s->waiting == NCR710_WAIT_RESELECT) {
+                        s->waiting = NCR710_WAIT_NONE;
+                    }
+                } else {
+                    if (s->current) {
+                        s->current->resume_offset = s->dsp;
+                    }
+
+                    s->waiting = NCR710_WAIT_RESELECT;
+                    ncr710_stop_script(s);
+                    NCR710_DPRINTF("SCRIPTS paused at WAIT DISCONNECT\n");
+                }
+                break;
+            case 2: /* Wait Reselect */
+                if (!ncr710_irq_on_rsl(s)) {
+                    ncr710_wait_reselect(s);
+                }
+                break;
+            case 3: /* Set */
+                if (insn & (1 << 3)) {
+                    s->socl |= NCR710_SOCL_ATN;
+                    ncr710_set_phase(s, PHASE_MO);
+                }
+                if (insn & (1 << 10)) {
+                    s->carry = 1;
+                }
+                break;
+            case 4: /* Clear */
+                if (insn & (1 << 3)) {
+                    s->socl &= ~NCR710_SOCL_ATN;
+                }
+                if (insn & (1 << 10)) {
+                    s->carry = 0;
+                }
+                break;
+            }
+        } else {
+            uint8_t op0;
+            uint8_t op1;
+            uint8_t data8;
+            int reg;
+            int xoperator;
+
+            reg = ((insn >> 16) & 0x7f) | (insn & 0x80);
+            data8 = (insn >> 8) & 0xff;
+            opcode = (insn >> 27) & 7;
+            xoperator = (insn >> 24) & 7;
+            op0 = op1 = 0;
+            switch (opcode) {
+            case 5: /* From SFBR */
+                op0 = s->sfbr;
+                op1 = data8;
+                break;
+            case 6: /* To SFBR */
+                if (xoperator) {
+                    op0 = ncr710_reg_readb(s, reg);
+                }
+                op1 = data8;
+                break;
+            case 7: /* Read-modify-write */
+                if (xoperator) {
+                    op0 = ncr710_reg_readb(s, reg);
+                }
+                if (insn & (1 << 23)) {
+                    op1 = s->sfbr;
+                } else {
+                    op1 = data8;
+                }
+                break;
+            }
+
+            switch (xoperator) {
+            case 0: /* move */
+                op0 = op1;
+                break;
+            case 1: /* Shift left */
+                op1 = op0 >> 7;
+                op0 = (op0 << 1) | s->carry;
+                s->carry = op1;
+                break;
+            case 2: /* OR */
+                op0 |= op1;
+                break;
+            case 3: /* XOR */
+                op0 ^= op1;
+                break;
+            case 4: /* AND */
+                op0 &= op1;
+                break;
+            case 5: /* SHR */
+                op1 = op0 & 1;
+                op0 = (op0 >> 1) | (s->carry << 7);
+                s->carry = op1;
+                break;
+            case 6: /* ADD */
+                op0 += op1;
+                s->carry = op0 < op1;
+                break;
+            case 7: /* ADC */
+                op0 += op1 + s->carry;
+                if (s->carry) {
+                    s->carry = op0 <= op1;
+                } else {
+                    s->carry = op0 < op1;
+                }
+                break;
+            }
+
+            switch (opcode) {
+            case 5: /* From SFBR */
+            case 7: /* Read-modify-write */
+                ncr710_reg_writeb(s, reg, op0);
+                break;
+            case 6: /* To SFBR */
+                s->sfbr = op0;
+                break;
+            }
+        }
+        break;
+
+    case 2: /* Transfer Control.  */
+        {
+            int cond;
+            int jmp;
+
+
+            if (s->sstat0 & NCR710_SSTAT0_STO) {
+                break;
+            }
+            cond = jmp = (insn & (1 << 19)) != 0;
+            if (cond == jmp && (insn & (1 << 21))) {
+                cond = s->carry != 0;
+            }
+            if (cond == jmp && (insn & (1 << 17))) {
+                cond = (s->sstat2 & PHASE_MASK) == ((insn >> 24) & 7);
+            }
+            if (cond == jmp && (insn & (1 << 18))) {
+                uint8_t mask;
+
+                mask = (~insn >> 8) & 0xff;
+                cond = (s->sfbr & mask) == (insn & mask);
+            }
+            if (cond == jmp) {
+                if (insn & (1 << 23)) {
+                    /* Relative address.  */
+                    addr = s->dsp + sextract32(addr, 0, 24);
+                }
+                switch ((insn >> 27) & 7) {
+                case 0: /* Jump */
+                    s->dsp = addr;
+                    break;
+                case 1: /* Call */
+                    s->temp = s->dsp;
+                    s->dsp = addr;
+                    break;
+                case 2: /* Return */
+                    if (s->temp == 0) {
+                        ncr710_script_dma_interrupt(s, NCR710_DSTAT_IID);
+                        break;
+                    }
+                    s->dsp = s->temp;
+                    break;
+                case 3: /* Interrupt */
+                    if ((insn & (1 << 20)) != 0) {
+                        ncr710_update_irq(s);
+                    } else {
+                        if (s->dsps == GOOD_STATUS_AFTER_STATUS) {
+                            NCR710_DPRINTF("Script completion: Processing "
+                                           "GOOD_STATUS_AFTER_STATUS\n");
+                            NCR710_DPRINTF("Script completion: Command state "
+                                           "preserved for driver processing\n");
+                            ncr710_script_dma_interrupt(s,
+                                                        NCR710_DSTAT_SIR);
+                            s->command_complete = NCR710_CMD_PENDING;
+                        } else {
+                            ncr710_script_dma_interrupt(s, NCR710_DSTAT_SIR);
+                        }
+                    }
+                    break;
+                default:
+                    ncr710_script_dma_interrupt(s, NCR710_DSTAT_IID);
+                    break;
+                }
+            }
+        }
+        break;
+
+    case 3:
+        if ((insn & (1 << 29)) == 0) {
+            /* Memory move.  */
+            uint32_t dest;
+            /*
+             * ??? The docs imply the destination address is loaded into
+             * the TEMP register.  However the Linux drivers rely on
+             * the value being preserved.
+             */
+            dest = ncr710_read_dword(s, s->dsp);
+            s->dsp += 4;
+            ncr710_memcpy(s, dest, addr, insn & 0xffffff);
+        } else {
+            uint8_t data[8];
+            int reg;
+            int n;
+            int i;
+            bool dsa_relative = (insn & (1 << 28)) != 0;
+            bool is_load = (insn & (1 << 24)) != 0;
+
+            if (dsa_relative) {
+                addr = s->dsa + sextract32(addr, 0, 24);
+            }
+
+            n = (insn & 7);
+            if (n == 0) {
+                n = 8;  /* 0 means 8 bytes */
+            }
+
+            reg = (insn >> 16) & 0xff;
+
+            if (is_load) {
+                ncr710_dma_read(s, addr, data, n);
+                for (i = 0; i < n; i++) {
+                    ncr710_reg_writeb(s, reg + i, data[i]);
+                }
+            } else {
+                for (i = 0; i < n; i++) {
+                    data[i] = ncr710_reg_readb(s, reg + i);
+                }
+                ncr710_dma_write(s, addr, data, n);
+            }
+        }
+    }
+
+    if (s->script_active && s->waiting == NCR710_WAIT_NONE) {
+        if (s->dcntl & NCR710_DCNTL_SSM) {
+            ncr710_script_dma_interrupt(s, NCR710_DSTAT_SSI);
+            return;
+        } else {
+            goto again;
+        }
+    } else if (s->waiting == NCR710_WAIT_RESELECT) {
+        return;
+    } else if (s->waiting == NCR710_WAIT_DMA ||
+               s->waiting == NCR710_WAIT_RESERVED) {
+        if (s->command_complete == NCR710_CMD_COMPLETE) {
+            s->waiting = NCR710_WAIT_NONE;
+            goto again;
+        }
+        return;
+    }
+}
+
+static uint8_t ncr710_reg_readb(NCR710State *s, int offset)
+{
+    uint8_t ret = 0;
+
+#define CASE_GET_REG24(name, addr) \
+    case addr: \
+        ret = s->name & 0xff; \
+        break; \
+    case addr + 1: \
+        ret = (s->name >> 8) & 0xff; \
+        break; \
+    case addr + 2: \
+        ret = (s->name >> 16) & 0xff; \
+        break;
+
+#define CASE_GET_REG32(name, addr) \
+    case addr: \
+        ret = s->name & 0xff; \
+        break; \
+    case addr + 1: \
+        ret = (s->name >> 8) & 0xff; \
+        break; \
+    case addr + 2: \
+        ret = (s->name >> 16) & 0xff; \
+        break; \
+    case addr + 3: \
+        ret = (s->name >> 24) & 0xff; \
+        break;
+
+    switch (offset) {
+    case NCR710_SCNTL0_REG: /* SCNTL0 */
+        ret = s->scntl0;
+        break;
+    case NCR710_SCNTL1_REG: /* SCNTL1 */
+        ret = s->scntl1;
+        break;
+    case NCR710_SDID_REG: /* SDID */
+        ret = s->sdid;
+        break;
+    case NCR710_SIEN_REG: /* SIEN */
+        ret = s->sien0;
+        break;
+    case NCR710_SCID_REG:
+        ret = s->scid;
+        if ((ret & 0x7F) == 0) {
+            ret = 0x80 | NCR710_HOST_ID;
+        } else {
+            ret |= 0x80;
+        }
+        break;
+    case NCR710_SXFER_REG: /* SXFER */
+        ret = s->sxfer;
+        break;
+    case NCR710_SODL_REG: /* SODL */
+        ret = s->sodl;
+        break;
+    case NCR710_SOCL_REG: /* SOCL */
+        ret = s->socl;
+        break;
+    case NCR710_SFBR_REG: /* SFBR */
+        ret = s->sfbr;
+        break;
+    case NCR710_SIDL_REG: /* SIDL */
+        ret = s->sidl;
+        break;
+    case NCR710_SBDL_REG: /* SBDL */
+        ret = s->sbdl;
+        break;
+    case NCR710_SBCL_REG: /* SBCL */
+        ret = 0;
+        if (s->scntl1 & NCR710_SCNTL1_CON) {
+            ret = s->sstat2 & PHASE_MASK;
+            ret |= s->sbcl;
+            if (s->socl & NCR710_SOCL_ATN) {
+                ret |= NCR710_SBCL_ATN;
+            }
+        }
+        break;
+    case NCR710_DSTAT_REG: /* DSTAT */
+        ret = s->dstat;
+
+        /*
+         * Not freeing s->current here:: driver needs it for completion
+         * processing. It will be freed when the next command starts.
+         */
+        if (s->dstat & NCR710_DSTAT_SIR) {
+            /* SIR bit set */
+        }
+        s->dstat = 0;  /* Clear all DMA interrupt status bits */
+        s->dstat |= NCR710_DSTAT_DFE;
+        s->istat &= ~NCR710_ISTAT_DIP;
+        ncr710_update_irq(s);
+
+        if (s->waiting == NCR710_WAIT_RESELECT && s->current &&
+            s->current->pending > 0) {
+            timer_mod(s->reselection_retry_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL));
+        }
+
+        if (!s->script_active && s->current && s->current->pending > 0 &&
+            s->command_complete == NCR710_CMD_COMPLETE) {
+            s->current->pending = 0;
+            s->waiting = NCR710_WAIT_NONE;
+            ncr710_execute_script(s);
+        }
+
+        if (s->waiting && s->current && s->current->pending > 0 &&
+            s->command_complete == NCR710_CMD_COMPLETE) {
+            s->current->pending = 0;
+            s->waiting = NCR710_WAIT_NONE;
+            ncr710_execute_script(s);
+        }
+
+        return ret;
+    case NCR710_SSTAT0_REG: /* SSTAT0 */
+        ret = s->sstat0;
+        if (s->sstat0 != 0 && !(s->sstat0 & NCR710_SSTAT0_STO)) {
+            s->sstat0 = 0;
+            s->istat &= ~NCR710_ISTAT_SIP;
+            ncr710_update_irq(s);
+            if (s->sbcl != 0) {
+                s->sbcl = 0;
+            }
+        }
+        break;
+    case NCR710_SSTAT1_REG: /* SSTAT1 */
+        ret = s->sstat0;
+        break;
+    case NCR710_SSTAT2_REG: /* SSTAT2 */
+        ret = s->dstat;
+
+        if (s->dstat & NCR710_DSTAT_SIR) {
+            /* SIR bit processing */
+        }
+        s->dstat = 0;
+        s->istat &= ~NCR710_ISTAT_DIP;
+        ncr710_update_irq(s);
+        break;
+        CASE_GET_REG32(dsa, NCR710_DSA_REG)
+        break;
+    case NCR710_CTEST0_REG: /* CTEST0 */
+        ret = s->ctest0;
+        break;
+    case NCR710_CTEST1_REG: /* CTEST1 */
+        ret = s->ctest1;
+        break;
+    case NCR710_CTEST2_REG: /* CTEST2 */
+        ret = s->ctest2;
+        s->ctest2 |= 0x04;
+        break;
+    case NCR710_CTEST3_REG: /* CTEST3 */
+        ret = s->ctest3;
+        if (!ncr710_scsi_fifo_empty(&s->scsi_fifo)) {
+            uint8_t parity;
+            ret = ncr710_scsi_fifo_dequeue(&s->scsi_fifo, &parity);
+            if (parity) {
+                s->ctest2 |= 0x10;
+            } else {
+                s->ctest2 &= ~0x10;
+            }
+        }
+        break;
+    case NCR710_CTEST4_REG: /* CTEST4 */
+        ret = s->ctest4;
+        break;
+    case NCR710_CTEST5_REG: /* CTEST5 */
+        ret = s->ctest5;
+        break;
+    case NCR710_CTEST6_REG: /* CTEST6 */
+        ret = s->ctest6;
+        break;
+    case NCR710_CTEST7_REG: /* CTEST7 */
+        ret = s->ctest7;
+        break;
+        CASE_GET_REG32(temp, NCR710_TEMP_REG)
+    case NCR710_DFIFO_REG: /* DFIFO */
+        ret = s->dfifo;
+        s->dfifo = 0;  /* DMA FIFO count is always 0 */
+        break;
+    case NCR710_ISTAT_REG: /* ISTAT */
+        ret = s->istat;
+        break;
+    case NCR710_CTEST8_REG: /* CTEST8 */
+        ret = s->istat;
+        break;
+    case NCR710_LCRC_REG: /* LCRC */
+        ret = s->lcrc;
+        break;
+        CASE_GET_REG24(dbc, NCR710_DBC_REG)
+    case NCR710_DCMD_REG: /* DCMD */
+        ret = s->dcmd;
+        break;
+        CASE_GET_REG32(dnad, NCR710_DNAD_REG)
+    case NCR710_DSP_REG:
+        ret = s->dsp & 0xff;
+        break;
+    case NCR710_DSP_REG + 1:
+        ret = (s->dsp >> 8) & 0xff;
+        break;
+    case NCR710_DSP_REG + 2:
+        ret = (s->dsp >> 16) & 0xff;
+        break;
+    case NCR710_DSP_REG + 3:
+        ret = (s->dsp >> 24) & 0xff;
+        if (s->dsps == GOOD_STATUS_AFTER_STATUS &&
+            (s->dstat & NCR710_DSTAT_SIR)) {
+            s->dstat &= ~NCR710_DSTAT_SIR;
+            s->istat &= ~NCR710_ISTAT_DIP;
+            ncr710_update_irq(s);
+        }
+        break;
+    case NCR710_DSPS_REG:
+        ret = s->dsps & 0xff;
+        break;
+    case NCR710_DSPS_REG + 1:
+        ret = (s->dsps >> 8) & 0xff;
+        break;
+    case NCR710_DSPS_REG + 2:
+        ret = (s->dsps >> 16) & 0xff;
+        break;
+    case NCR710_DSPS_REG + 3:
+        ret = (s->dsps >> 24) & 0xff;
+        if (!(s->dstat & NCR710_DSTAT_SIR) && s->dsps != 0) {
+            s->dsps = 0;
+        }
+        break;
+        CASE_GET_REG32(scratch, NCR710_SCRATCH_REG)
+        break;
+    case NCR710_DMODE_REG: /* DMODE */
+        ret = s->dmode;
+        break;
+    case NCR710_DIEN_REG: /* DIEN */
+        ret = s->dien;
+        break;
+    case NCR710_DWT_REG: /* DWT */
+        ret = s->dwt;
+        break;
+    case NCR710_DCNTL_REG: /* DCNTL */
+        ret = s->dcntl;
+        return ret;
+        CASE_GET_REG32(adder, NCR710_ADDER_REG)
+        break;
+    default:
+        ret = 0;
+        break;
+    }
+
+#undef CASE_GET_REG24
+#undef CASE_GET_REG32
+    return ret;
+}
+
+static void ncr710_reg_writeb(NCR710State *s, int offset, uint8_t val)
+{
+    uint8_t old_val;
+
+#define CASE_SET_REG24(name, addr) \
+    case addr: \
+        s->name &= 0xffffff00; \
+        s->name |= val; \
+        break; \
+    case addr + 1: \
+        s->name &= 0xffff00ff; \
+        s->name |= val << 8; \
+        break; \
+    case addr + 2: \
+        s->name &= 0xff00ffff; \
+        s->name |= val << 16; \
+        break;
+
+#define CASE_SET_REG32(name, addr) \
+    case addr: \
+        s->name &= 0xffffff00; \
+        s->name |= val; \
+        break; \
+    case addr + 1: \
+        s->name &= 0xffff00ff; \
+        s->name |= val << 8; \
+        break; \
+    case addr + 2: \
+        s->name &= 0xff00ffff; \
+        s->name |= val << 16; \
+        break; \
+    case addr + 3: \
+        s->name &= 0x00ffffff; \
+        s->name |= val << 24; \
+        break;
+
+    trace_ncr710_reg_write(ncr710_reg_name(offset), offset, val);
+
+    switch (offset) {
+    case NCR710_SCNTL0_REG: /* SCNTL0 */
+        old_val = s->scntl0;
+        s->scntl0 = val;
+        break;
+
+    case NCR710_SCNTL1_REG: /* SCNTL1 */
+        old_val = s->scntl1;
+        s->scntl1 = val;
+
+
+        /* Handle Assert Even SCSI Parity (AESP) bit changes */
+        if ((val & NCR710_SCNTL1_AESP) != (old_val & NCR710_SCNTL1_AESP)) {
+            trace_ncr710_parity_sense_changed((val & NCR710_SCNTL1_AESP)
+                                               != 0 ? "even" : "odd");
+        }
+
+        if (val & NCR710_SCNTL1_RST) {
+            if (!(s->sstat0 & NCR710_SSTAT0_RST)) {
+                s->sstat0 |= NCR710_SSTAT0_RST;
+                ncr710_script_scsi_interrupt(s, NCR710_SSTAT0_RST);
+            }
+            if (!(old_val & NCR710_SCNTL1_RST)) {
+                NCR710_DPRINTF("NCR710: SCNTL1: SCSI bus reset "
+                               "initiated\n");
+                ncr710_soft_reset(s);
+            }
+        } else {
+            s->sstat0 &= ~NCR710_SSTAT0_RST;
+        }
+        break;
+
+    case NCR710_SDID_REG: /* SDID */
+        s->sdid = val & 0x0F; /* Only lower 4 bits are valid */
+        break;
+
+    case NCR710_SIEN_REG: /* SIEN */
+        s->sien0 = val;
+        NCR710_DPRINTF("SIEN: interrupt mask=0x%02x\n", val);
+        ncr710_update_irq(s);
+        break;
+
+    case NCR710_SCID_REG: /* SCID */
+        s->scid = val;
+        break;
+
+    case NCR710_SXFER_REG: /* SXFER */
+        s->sxfer = val;
+        break;
+
+    case NCR710_SODL_REG: /* SODL */
+        s->sodl = val;
+        s->sstat1 |= NCR710_SSTAT1_ORF; /* SCSI Output Register Full */
+        break;
+
+    case NCR710_SOCL_REG: /* SOCL */
+        s->socl = val;
+        break;
+
+    case NCR710_SFBR_REG: /* SFBR */
+        s->sfbr = val;
+        break;
+
+    case NCR710_SIDL_REG: /* SIDL */
+    case NCR710_SBDL_REG: /* SBDL */
+        break;
+
+    case NCR710_SBCL_REG: /* SBCL */
+        s->sbcl = val;
+        ncr710_set_phase(s, val & PHASE_MASK);
+        break;
+
+    case NCR710_DSTAT_REG:
+    case NCR710_SSTAT0_REG:
+    case NCR710_SSTAT1_REG:
+    case NCR710_SSTAT2_REG:
+        /* Linux writes to these readonly registers on startup */
+        return;
+
+    CASE_SET_REG32(dsa, NCR710_DSA_REG)
+        break;
+
+    case NCR710_CTEST0_REG: /* CTEST0 */
+        s->ctest0 = val;
+        break;
+
+    case NCR710_CTEST1_REG: /* CTEST1, read-only */
+        s->ctest1 = val;
+        break;
+
+    case NCR710_CTEST2_REG: /* CTEST2, read-only */
+        s->ctest2 = val;
+        break;
+
+    case NCR710_CTEST3_REG: /* CTEST3 */
+        s->ctest3 = val;
+        break;
+
+    case NCR710_CTEST4_REG: /* CTEST4 */
+        s->ctest4 = val;
+        break;
+
+    case NCR710_CTEST5_REG: /* CTEST5 */
+        s->ctest5 = val;
+        break;
+
+    case NCR710_CTEST6_REG: /* CTEST6 */
+        s->ctest6 = val;
+        break;
+
+    case NCR710_CTEST7_REG: /* CTEST7 */
+        s->ctest7 = val;
+        break;
+
+    CASE_SET_REG32(temp, NCR710_TEMP_REG)
+
+    case NCR710_DFIFO_REG: /* DFIFO, read-only */
+        break;
+
+    case NCR710_ISTAT_REG: /* ISTAT */
+        old_val = s->istat;
+
+        if ((old_val & NCR710_ISTAT_DIP) && !(val & NCR710_ISTAT_DIP)) {
+            /* Clear script interrupt data after Linux processes it */
+            s->dstat = 0;
+            s->dsps = 0;
+        }
+
+        if ((old_val & NCR710_ISTAT_SIP) && !(val & NCR710_ISTAT_SIP)) {
+            s->sstat0 = 0;
+        }
+
+        s->istat = (val & ~(NCR710_ISTAT_DIP | NCR710_ISTAT_SIP)) |
+                  (s->istat & (NCR710_ISTAT_DIP | NCR710_ISTAT_SIP));
+        ncr710_update_irq(s);
+
+        if (val & NCR710_ISTAT_ABRT) {
+            ncr710_script_dma_interrupt(s, NCR710_DSTAT_ABRT);
+        }
+        break;
+
+    case NCR710_CTEST8_REG: /* CTEST8 */
+        if (val & 0x08) {
+            s->dstat |= NCR710_DSTAT_DFE;
+        }
+        if (val & 0x04) {
+            ncr710_scsi_fifo_init(&s->scsi_fifo);
+            s->dstat |= NCR710_DSTAT_DFE;
+        }
+        break;
+    case NCR710_LCRC_REG: /* LCRC */
+        s->lcrc = val;
+        break;
+
+    CASE_SET_REG24(dbc, NCR710_DBC_REG)
+
+    case NCR710_DCMD_REG: /* DCMD */
+        s->dcmd = val;
+        break;
+
+    CASE_SET_REG32(dnad, NCR710_DNAD_REG)
+    case 0x2c: /* DSP[0:7] */
+        s->dsp &= 0xffffff00;
+        s->dsp |= val;
+        break;
+    case 0x2d: /* DSP[8:15] */
+        s->dsp &= 0xffff00ff;
+        s->dsp |= val << 8;
+        break;
+    case 0x2e: /* DSP[16:23] */
+        s->dsp &= 0xff00ffff;
+        s->dsp |= val << 16;
+        break;
+    case 0x2f: /* DSP[24:31] */
+        s->dsp &= 0x00ffffff;
+        s->dsp |= val << 24;
+        s->waiting = NCR710_WAIT_NONE;
+        s->script_active = 1;
+        s->istat |= NCR710_ISTAT_CON;
+        ncr710_clear_selection_timeout(s);
+        ncr710_execute_script(s);
+        break;
+    CASE_SET_REG32(dsps, NCR710_DSPS_REG)
+    CASE_SET_REG32(scratch, NCR710_SCRATCH_REG)
+        break;
+
+    case NCR710_DMODE_REG: /* DMODE */
+        s->dmode = val;
+        break;
+
+    case NCR710_DIEN_REG: /* DIEN */
+        s->dien = val;
+        NCR710_DPRINTF("DIEN: interrupt enable=0x%02x\n", val);
+        ncr710_update_irq(s);
+        break;
+
+    case NCR710_DWT_REG: /* DWT */
+        s->dwt = val;
+        break;
+
+    case NCR710_DCNTL_REG: /* DCNTL */
+        s->dcntl = val & ~(NCR710_DCNTL_PFF);
+        if (val & NCR710_DCNTL_STD) {
+            s->waiting = NCR710_WAIT_NONE;
+            ncr710_execute_script(s);
+            s->dcntl &= ~NCR710_DCNTL_STD;
+        }
+        break;
+
+    CASE_SET_REG32(adder, NCR710_ADDER_REG)
+        break;
+
+    default:
+        break;
+    }
+
+#undef CASE_SET_REG24
+#undef CASE_SET_REG32
+}
+
+/* Memory region wrapper for NCR710 registers */
+uint64_t ncr710_reg_read(void *opaque, hwaddr addr, unsigned size)
+{
+    NCR710State *s = opaque;
+    uint8_t offset = addr & 0xff;
+    uint8_t val = ncr710_reg_readb(s, offset);
+    trace_ncr710_reg_read(ncr710_reg_name(offset), offset, val);
+    return val;
+}
+
+void ncr710_reg_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    NCR710State *s = opaque;
+    uint8_t offset = addr & 0xff;
+    uint8_t val8 = val & 0xff;
+    trace_ncr710_reg_write(ncr710_reg_name(offset), offset, val8);
+    ncr710_reg_writeb(s, offset, val8);
+}
+
+/* Device reset */
+static void ncr710_device_reset(DeviceState *dev)
+{
+    SysBusNCR710State *sysbus_dev = SYSBUS_NCR710_SCSI(dev);
+    NCR710State *s = &sysbus_dev->ncr710;
+
+    ncr710_soft_reset(s);
+}
+
+static const struct SCSIBusInfo ncr710_scsi_info = {
+    .tcq = true,
+    .max_target = 8,
+    .max_lun = 8,  /* Full LUN support */
+
+    .transfer_data = ncr710_transfer_data,
+    .complete = ncr710_command_complete,
+    .cancel = ncr710_request_cancelled,
+};
+
+static const MemoryRegionOps ncr710_mmio_ops = {
+    .read = ncr710_reg_read,
+    .write = ncr710_reg_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 4,
+    },
+};
+
+static const VMStateDescription vmstate_ncr710_scsi_fifo = {
+    .name = "ncr710_scsi_fifo",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8_ARRAY(data, NCR710_SCSI_FIFO, NCR710_SCSI_FIFO_SIZE),
+        VMSTATE_UINT8_ARRAY(parity, NCR710_SCSI_FIFO, NCR710_SCSI_FIFO_SIZE),
+        VMSTATE_INT32(count, NCR710_SCSI_FIFO),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_ncr710 = {
+    .name = "ncr710",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(scntl0, NCR710State),
+        VMSTATE_UINT8(scntl1, NCR710State),
+        VMSTATE_UINT8(sdid, NCR710State),
+        VMSTATE_UINT8(sien0, NCR710State),
+        VMSTATE_UINT8(scid, NCR710State),
+        VMSTATE_UINT8(sxfer, NCR710State),
+        VMSTATE_UINT8(sodl, NCR710State),
+        VMSTATE_UINT8(socl, NCR710State),
+        VMSTATE_UINT8(sfbr, NCR710State),
+        VMSTATE_UINT8(sidl, NCR710State),
+        VMSTATE_UINT8(sbdl, NCR710State),
+        VMSTATE_UINT8(sbcl, NCR710State),
+        VMSTATE_UINT8(dstat, NCR710State),
+        VMSTATE_UINT8(sstat0, NCR710State),
+        VMSTATE_UINT8(sstat1, NCR710State),
+        VMSTATE_UINT8(sstat2, NCR710State),
+        VMSTATE_UINT8(ctest0, NCR710State),
+        VMSTATE_UINT8(ctest1, NCR710State),
+        VMSTATE_UINT8(ctest2, NCR710State),
+        VMSTATE_UINT8(ctest3, NCR710State),
+        VMSTATE_UINT8(ctest4, NCR710State),
+        VMSTATE_UINT8(ctest5, NCR710State),
+        VMSTATE_UINT8(ctest6, NCR710State),
+        VMSTATE_UINT8(ctest7, NCR710State),
+        VMSTATE_UINT8(ctest8, NCR710State),
+        VMSTATE_UINT32(temp, NCR710State),
+        VMSTATE_UINT8(dfifo, NCR710State),
+        VMSTATE_UINT8(istat, NCR710State),
+        VMSTATE_UINT8(lcrc, NCR710State),
+        VMSTATE_UINT8(dcmd, NCR710State),
+        VMSTATE_UINT8(dmode, NCR710State),
+        VMSTATE_UINT8(dien, NCR710State),
+        VMSTATE_UINT8(dwt, NCR710State),
+        VMSTATE_UINT8(dcntl, NCR710State),
+        VMSTATE_UINT32(dsa, NCR710State),
+        VMSTATE_UINT32(dbc, NCR710State),
+        VMSTATE_UINT32(dnad, NCR710State),
+        VMSTATE_UINT32(dsp, NCR710State),
+        VMSTATE_UINT32(dsps, NCR710State),
+        VMSTATE_UINT32(scratch, NCR710State),
+        VMSTATE_UINT32(adder, NCR710State),
+        VMSTATE_STRUCT(scsi_fifo, NCR710State, 1,
+            vmstate_ncr710_scsi_fifo, NCR710_SCSI_FIFO),
+        VMSTATE_UINT8(status, NCR710State),
+        VMSTATE_UINT8_ARRAY(msg, NCR710State,
+            NCR710_MAX_MSGIN_LEN),
+        VMSTATE_UINT8(msg_len, NCR710State),
+        VMSTATE_UINT8(msg_action, NCR710State),
+        VMSTATE_INT32(carry, NCR710State),
+        VMSTATE_BOOL(script_active, NCR710State),
+        VMSTATE_INT32(waiting, NCR710State),
+        VMSTATE_UINT8(command_complete, NCR710State),
+        VMSTATE_UINT32(select_tag, NCR710State),
+        VMSTATE_UINT8(current_lun, NCR710State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_sysbus_ncr710 = {
+    .name = "sysbus_ncr710",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT(ncr710, SysBusNCR710State, 1, vmstate_ncr710,
+                       NCR710State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+DeviceState *ncr710_device_create_sysbus(hwaddr addr, qemu_irq irq)
+{
+    DeviceState *dev;
+    SysBusDevice *sysbus;
+
+    dev = qdev_new(TYPE_SYSBUS_NCR710_SCSI);
+    sysbus = SYS_BUS_DEVICE(dev);
+
+    qdev_realize_and_unref(dev, NULL, &error_abort);
+    sysbus_mmio_map(sysbus, 0, addr);
+    sysbus_connect_irq(sysbus, 0, irq);
+    return dev;
+}
+
+DeviceState *ncr53c710_init(MemoryRegion *address_space, hwaddr addr,
+                             qemu_irq irq)
+{
+    DeviceState *dev;
+    SysBusDevice *sysbus;
+    SysBusNCR710State *s;
+
+    /* trace_ncr710_device_init(addr); */
+
+    dev = qdev_new(TYPE_SYSBUS_NCR710_SCSI);
+    sysbus = SYS_BUS_DEVICE(dev);
+
+    qdev_realize_and_unref(dev, NULL, &error_abort);
+    sysbus_mmio_map(sysbus, 0, addr);
+    sysbus_connect_irq(sysbus, 0, irq);
+
+    s = SYSBUS_NCR710_SCSI(dev);
+    if (!s->ncr710.as) {
+        s->ncr710.as = &address_space_memory;
+    }
+
+    return dev;
+}
+
+static void sysbus_ncr710_realize(DeviceState *dev, Error **errp)
+{
+    SysBusNCR710State *s = SYSBUS_NCR710_SCSI(dev);
+
+    trace_ncr710_device_realize();
+    scsi_bus_init(&s->ncr710.bus, sizeof(s->ncr710.bus), dev,
+                  &ncr710_scsi_info);
+    s->ncr710.as = &address_space_memory;
+
+    ncr710_scsi_fifo_init(&s->ncr710.scsi_fifo);
+    s->ncr710.dcntl &= ~NCR710_DCNTL_COM;
+    s->ncr710.scid = 0x80 | NCR710_HOST_ID;
+
+    s->ncr710.reselection_retry_timer =
+        timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                     ncr710_reselection_retry_callback,
+                     &s->ncr710);
+
+    memset(s->ncr710.msg, 0, sizeof(s->ncr710.msg));
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &ncr710_mmio_ops, &s->ncr710,
+                          "ncr710", 0x100);
+    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
+    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->ncr710.irq);
+
+}
+
+static void sysbus_ncr710_init(Object *obj)
+{
+    SysBusNCR710State *s = SYSBUS_NCR710_SCSI(obj);
+    memset(&s->ncr710, 0, sizeof(NCR710State));
+    s->ncr710.ctest0 = 0x01;
+    s->ncr710.scid = 0x80 | NCR710_HOST_ID;
+    s->ncr710.dstat = NCR710_DSTAT_DFE;
+}
+
+static void sysbus_ncr710_class_init(ObjectClass *oc, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(oc);
+
+    dc->realize = sysbus_ncr710_realize;
+    device_class_set_legacy_reset(dc, ncr710_device_reset);
+    dc->bus_type = NULL;
+    set_bit(DEVICE_CATEGORY_STORAGE, dc->categories);
+    dc->desc = "NCR53C710 SCSI I/O Processor (SysBus)";
+    dc->vmsd = &vmstate_sysbus_ncr710;
+}
+
+static const TypeInfo sysbus_ncr710_info = {
+    .name = TYPE_SYSBUS_NCR710_SCSI,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(SysBusNCR710State),
+    .instance_init = sysbus_ncr710_init,
+    .class_init = sysbus_ncr710_class_init,
+};
+
+static void ncr710_register_types(void)
+{
+    type_register_static(&sysbus_ncr710_info);
+}
+
+type_init(ncr710_register_types)
diff --git a/hw/scsi/ncr53c710.h b/hw/scsi/ncr53c710.h
new file mode 100644
index 0000000000..380e3959b3
--- /dev/null
+++ b/hw/scsi/ncr53c710.h
@@ -0,0 +1,246 @@
+/*
+ * QEMU NCR710 SCSI Controller
+ *
+ * Copyright (c) 2025 Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
+ *
+ * NCR710 SCSI Controller implementation
+ * Based on the NCR53C710 Technical Manual Version 3.2, December 2000
+ *
+ * Developed from the hackish implementation of NCR53C710 by Helge Deller
+ * which was interim based on the hackish implementation by Toni Wilen for UAE
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_NCR53C710_H
+#define HW_NCR53C710_H
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/scsi/scsi.h"
+#include "qemu/fifo8.h"
+#include "qom/object.h"
+#include "system/memory.h"
+#include "hw/irq.h"
+#include "qemu/timer.h"
+
+#define TYPE_NCR710_SCSI "ncr710-scsi"
+#define TYPE_SYSBUS_NCR710_SCSI "sysbus-ncr710-scsi"
+
+#define SYSBUS_NCR710_SCSI(obj) \
+    OBJECT_CHECK(SysBusNCR710State, (obj), TYPE_SYSBUS_NCR710_SCSI)
+
+#define ENABLE_DEBUG 0
+#if ENABLE_DEBUG
+#define DBG(x)          x
+#define NCR710_DPRINTF(fmt, ...) \
+    fprintf(stderr, "QEMU: " fmt, ## __VA_ARGS__)
+#define BADF(fmt, ...) \
+    fprintf(stderr, "QEMU: error: " fmt, ## __VA_ARGS__)
+#else
+#define DBG(x)         do { } while (0)
+#define NCR710_DPRINTF(fmt, ...) do { } while (0)
+#define BADF(fmt, ...) do { } while (0)
+#endif
+
+/* NCR710 - Little Endian register Ordering */
+#define NCR710_SCNTL0_REG       0x00    /* SCSI Control Zero */
+#define NCR710_SCNTL1_REG       0x01    /* SCSI Control One */
+#define NCR710_SDID_REG         0x02    /* SCSI Destination ID */
+#define NCR710_SIEN_REG         0x03    /* SCSI Interrupt Enable */
+#define NCR710_SCID_REG         0x04    /* SCSI Chip ID */
+#define NCR710_SXFER_REG        0x05    /* SCSI Transfer */
+#define NCR710_SODL_REG         0x06    /* SCSI Output Data Latch */
+#define NCR710_SOCL_REG         0x07    /* SCSI Output Control Latch */
+#define NCR710_SFBR_REG         0x08    /* SCSI First Byte Received */
+#define NCR710_SIDL_REG         0x09    /* SCSI Input Data Latch */
+#define NCR710_SBDL_REG         0x0A    /* SCSI Bus Data Lines */
+#define NCR710_SBCL_REG         0x0B    /* SCSI Bus Control Lines */
+#define NCR710_DSTAT_REG        0x0C    /* DMA Status */
+#define NCR710_SSTAT0_REG       0x0D    /* SCSI Status Zero */
+#define NCR710_SSTAT1_REG       0x0E    /* SCSI Status One */
+#define NCR710_SSTAT2_REG       0x0F    /* SCSI Status Two */
+#define NCR710_DSA_REG          0x10    /* Data Structure Address */
+#define NCR710_CTEST0_REG       0x14    /* Chip Test Zero */
+#define NCR710_CTEST1_REG       0x15    /* Chip Test One */
+#define NCR710_CTEST2_REG       0x16    /* Chip Test Two */
+#define NCR710_CTEST3_REG       0x17    /* Chip Test Three */
+#define NCR710_CTEST4_REG       0x18    /* Chip Test Four */
+#define NCR710_CTEST5_REG       0x19    /* Chip Test Five */
+#define NCR710_CTEST6_REG       0x1A    /* Chip Test Six */
+#define NCR710_CTEST7_REG       0x1B    /* Chip Test Seven */
+#define NCR710_TEMP_REG         0x1C    /* Temporary Stack */
+#define NCR710_DFIFO_REG        0x20    /* DMA FIFO */
+#define NCR710_ISTAT_REG        0x21    /* Interrupt Status */
+#define NCR710_CTEST8_REG       0x22    /* Chip Test Eight */
+#define NCR710_LCRC_REG         0x23    /* Longitudinal Parity */
+#define NCR710_DBC_REG          0x24    /* DMA Byte Counter (24-bit, LE) */
+#define NCR710_DCMD_REG         0x27    /* DMA Command */
+#define NCR710_DNAD_REG         0x28    /* DMA Next Data Address (32-bit, LE) */
+#define NCR710_DSP_REG          0x2C    /* DMA SCRIPTS Pointer (32-bit, LE) */
+#define NCR710_DSPS_REG         0x30    /* DMA SCRIPTS Pointer Save */
+#define NCR710_SCRATCH_REG      0x34    /* Scratch (32-bit, LE) */
+#define NCR710_DMODE_REG        0x38    /* DMA Mode */
+#define NCR710_DIEN_REG         0x39    /* DMA Interrupt Enable */
+#define NCR710_DWT_REG          0x3A    /* DMA Watchdog Timer */
+#define NCR710_DCNTL_REG        0x3B    /* DMA Control */
+#define NCR710_ADDER_REG        0x3C    /* Adder Sum Output (32-bit, LE) */
+
+#define NCR710_REG_SIZE         0x100
+
+#define NCR710_BUF_SIZE         4096
+#define NCR710_HOST_ID          7
+#define NCR710_MAX_MSGIN_LEN    8
+#define NCR710_SCSI_FIFO_SIZE   8
+
+typedef enum {
+    NCR710_WAIT_NONE = 0,
+    NCR710_WAIT_RESELECT = 1,
+    NCR710_WAIT_DMA = 2,
+    NCR710_WAIT_RESERVED = 3
+} NCR710WaitState;
+
+typedef enum {
+    NCR710_CMD_PENDING = 0,
+    NCR710_CMD_DATA_READY = 1,
+    NCR710_CMD_COMPLETE = 2
+} NCR710CommandState;
+
+typedef enum {
+    NCR710_MSG_ACTION_NONE = 0,
+    NCR710_MSG_ACTION_DISCONNECT = 1,
+    NCR710_MSG_ACTION_DATA_OUT = 2,
+    NCR710_MSG_ACTION_DATA_IN = 3
+} NCR710MessageAction;
+
+typedef struct NCR710State NCR710State;
+typedef struct NCR710Request NCR710Request;
+
+/*
+ * SCSI FIFO structure - 8 transfers deep, 1 byte per transfer
+ * (9-bit wide with parity)
+ */
+typedef struct {
+    uint8_t data[NCR710_SCSI_FIFO_SIZE];
+    uint8_t parity[NCR710_SCSI_FIFO_SIZE];
+    int head;
+    int count;
+} NCR710_SCSI_FIFO;
+
+struct NCR710Request {
+    SCSIRequest *req;
+    uint32_t tag;
+    uint32_t dma_len;
+    uint32_t pending;
+    uint8_t status;
+    bool active;
+    uint8_t *dma_buf;
+    bool out;
+    uint32_t resume_offset;
+    uint32_t saved_dnad;
+};
+
+struct NCR710State {
+    SysBusDevice parent_obj;
+    MemoryRegion mmio;
+    qemu_irq irq;
+
+    SCSIBus bus;
+    AddressSpace *as;
+
+    /* Registers */
+    uint8_t scntl0;
+    uint8_t scntl1;
+    uint8_t sdid;
+    uint8_t sien0;
+    uint8_t scid;
+    uint8_t sxfer;
+    uint8_t sodl;
+    uint8_t socl;
+    uint8_t sfbr;
+    uint8_t sidl;
+    uint8_t sbdl;
+    uint8_t sbcl;
+    uint8_t dstat;
+    uint8_t sstat0;
+    uint8_t sstat1;
+    uint8_t sstat2;
+    uint32_t dsa;
+    uint8_t ctest0;
+    uint8_t ctest1;
+    uint8_t ctest2;
+    uint8_t ctest3;
+    uint8_t ctest4;
+    uint8_t ctest5;
+    uint8_t ctest6;
+    uint8_t ctest7;
+    uint8_t ctest8;
+    uint32_t temp;
+    uint8_t dfifo;
+    uint8_t istat;
+    uint8_t lcrc;
+    uint32_t dbc;
+    uint8_t dcmd;
+    uint32_t dnad;
+    uint32_t dsp;
+    uint32_t dsps;
+    uint32_t scratch;
+    uint8_t dmode;
+    uint8_t dien;
+    uint8_t dwt;
+    uint8_t dcntl;
+    uint32_t adder;
+
+    NCR710_SCSI_FIFO scsi_fifo;
+
+    NCR710Request *current;
+    uint8_t status;
+    uint8_t msg[NCR710_MAX_MSGIN_LEN];
+    uint8_t msg_len;
+    uint8_t msg_action;         /* NCR710MessageAction values */
+    int carry;
+    bool script_active;
+    int32_t waiting;            /* NCR710WaitState values */
+    uint8_t command_complete;   /* NCR710CommandState values */
+
+    QEMUTimer *reselection_retry_timer;
+    uint32_t saved_dsps;
+
+    uint32_t select_tag;
+    uint8_t current_lun;
+    uint8_t reselection_id;
+    bool wait_reselect;
+};
+
+typedef struct SysBusNCR710State {
+    SysBusDevice parent_obj;
+    MemoryRegion mmio;
+    MemoryRegion iomem;
+    qemu_irq irq;
+    NCR710State ncr710;
+} SysBusNCR710State;
+
+static inline NCR710State *ncr710_from_scsi_bus(SCSIBus *bus)
+{
+    return container_of(bus, NCR710State, bus);
+}
+
+static inline SysBusNCR710State *sysbus_from_ncr710(NCR710State *s)
+{
+    return container_of(s, SysBusNCR710State, ncr710);
+}
+
+DeviceState *ncr53c710_init(MemoryRegion *address_space, hwaddr addr,
+                             qemu_irq irq);
+DeviceState *ncr710_device_create_sysbus(hwaddr addr, qemu_irq irq);
+void ncr710_reg_write(void *opaque, hwaddr addr, uint64_t val, unsigned size);
+uint64_t ncr710_reg_read(void *opaque, hwaddr addr, unsigned size);
+void ncr710_soft_reset(NCR710State *s);
+void ncr710_request_cancelled(SCSIRequest *req);
+void ncr710_command_complete(SCSIRequest *req, size_t resid);
+void ncr710_transfer_data(SCSIRequest *req, uint32_t len);
+void ncr710_execute_script(NCR710State *s);
+void ncr710_set_phase(NCR710State *s, int phase);
+void ncr710_reselection_retry_callback(void *opaque);
+
+#endif /* HW_NCR53C710_H */
diff --git a/hw/scsi/trace-events b/hw/scsi/trace-events
index 0604050a67..3e81f44dad 100644
--- a/hw/scsi/trace-events
+++ b/hw/scsi/trace-events
@@ -306,6 +306,18 @@ lsi_reg_write(const char *name, int offset, uint8_t val) "Write reg %s 0x%x = 0x
 lsi_scripts_timer_triggered(void) "SCRIPTS timer triggered"
 lsi_scripts_timer_start(void) "SCRIPTS timer started"
 
+# ncr53c710.c
+ncr710_reset(void) "Reset"
+ncr710_reg_read(const char *name, int offset, uint8_t ret) "Read %s [0x%02x] = 0x%02x"
+ncr710_reg_write(const char *name, int offset, uint8_t val) "Write %s [0x%02x] = 0x%02x"
+ncr710_script_scsi_interrupt(uint8_t stat0, uint8_t sstat0) "SCSI interrupt stat=0x%02x sstat=0x%02x"
+ncr710_script_dma_interrupt(uint8_t stat, uint8_t dstat) "DMA interrupt stat=0x%02x dstat=0x%02x"
+ncr710_command_complete(uint32_t tag, uint8_t status) "tag=0x%x status=0x%02x"
+ncr710_disconnect(uint8_t waiting) "waiting=%d"
+ncr710_bad_selection(uint32_t target) "target=%d"
+ncr710_parity_sense_changed(const char *parity) "Parity sense changed to %s"
+ncr710_device_realize(void) "Device realized"
+
 # lasi_ncr710.c
 lasi_ncr710_device_realize(void) "Device realized"
 lasi_ncr710_device_reset(void) "Device reset"

From 555a090ed079614cf8898e43451eb9b1516ea77d Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 14 Oct 2025 22:44:16 +0200
Subject: [PATCH 1642/2396] lasi: Forward LASI SCSI ports to NCR 53c710 driver

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/misc/lasi.c         | 6 +++++-
 include/hw/misc/lasi.h | 2 ++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/misc/lasi.c b/hw/misc/lasi.c
index 9f758c6a86..6684f16fd7 100644
--- a/hw/misc/lasi.c
+++ b/hw/misc/lasi.c
@@ -43,7 +43,7 @@ static bool lasi_chip_mem_valid(void *opaque, hwaddr addr,
     case LASI_LAN + 12: /* LASI LAN MAC */
     case LASI_RTC:
     case LASI_FDC:
-
+    case LASI_SCSI ... LASI_SCSI + 0xFF:
     case LASI_PCR ... LASI_AMR:
         ret = true;
     }
@@ -84,6 +84,7 @@ static MemTxResult lasi_chip_read_with_attrs(void *opaque, hwaddr addr,
     case LASI_LAN:
     case LASI_LAN + 12:
     case LASI_FDC:
+    case LASI_SCSI ... LASI_SCSI + 0xFF:
         val = 0;
         break;
     case LASI_RTC:
@@ -156,6 +157,9 @@ static MemTxResult lasi_chip_write_with_attrs(void *opaque, hwaddr addr,
     case LASI_UART:
         /* XXX: reset serial port */
         break;
+    case LASI_SCSI ... LASI_SCSI + 0xFF:
+        /* XXX: reset SCSI Controller */
+        break;
     case LASI_LAN:
         /* XXX: reset LAN card */
         break;
diff --git a/include/hw/misc/lasi.h b/include/hw/misc/lasi.h
index 0bdfb11b50..04312d0b58 100644
--- a/include/hw/misc/lasi.h
+++ b/include/hw/misc/lasi.h
@@ -28,7 +28,9 @@ OBJECT_DECLARE_SIMPLE_TYPE(LasiState, LASI_CHIP)
 #define LASI_LPT        0x02000
 #define LASI_AUDIO      0x04000
 #define LASI_UART       0x05000
+#define LASI_SCSI       0x06000
 #define LASI_LAN        0x07000
+#define LASI_PS2        0x08000
 #define LASI_RTC        0x09000
 #define LASI_FDC        0x0A000
 

From 008aad460dedd84cc922ceeb9badf37fd71d6136 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 14 Oct 2025 22:46:15 +0200
Subject: [PATCH 1643/2396] hw/scsi: Add config option for new ncr710 driver

Add config option and wire up in meson makefile.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/scsi/Kconfig     | 5 +++++
 hw/scsi/meson.build | 1 +
 2 files changed, 6 insertions(+)

diff --git a/hw/scsi/Kconfig b/hw/scsi/Kconfig
index 1feab84c4c..5743ee9b4d 100644
--- a/hw/scsi/Kconfig
+++ b/hw/scsi/Kconfig
@@ -7,6 +7,11 @@ config LSI_SCSI_PCI
     depends on PCI
     select SCSI
 
+config NCR710_SCSI
+    bool
+    default y if LASI
+    select SCSI
+
 config MPTSAS_SCSI_PCI
     bool
     default y if PCI_DEVICES
diff --git a/hw/scsi/meson.build b/hw/scsi/meson.build
index bb7d289aa0..b874fe1ecd 100644
--- a/hw/scsi/meson.build
+++ b/hw/scsi/meson.build
@@ -12,6 +12,7 @@ scsi_ss.add(files(
 scsi_ss.add(when: 'CONFIG_ESP', if_true: files('esp.c'))
 scsi_ss.add(when: 'CONFIG_ESP_PCI', if_true: files('esp-pci.c'))
 scsi_ss.add(when: 'CONFIG_LSI_SCSI_PCI', if_true: files('lsi53c895a.c'))
+scsi_ss.add(when: 'CONFIG_NCR710_SCSI', if_true: files('ncr53c710.c', 'lasi_ncr710.c'))
 scsi_ss.add(when: 'CONFIG_MEGASAS_SCSI_PCI', if_true: files('megasas.c'))
 scsi_ss.add(when: 'CONFIG_MPTSAS_SCSI_PCI', if_true: files('mptsas.c', 'mptconfig.c', 'mptendian.c'))
 scsi_ss.add(when: 'CONFIG_VMW_PVSCSI_SCSI_PCI', if_true: files('vmw_pvscsi.c'))

From 0c1737e207955582cf2976e24cb65f7c78b9f1d2 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 14 Oct 2025 22:48:07 +0200
Subject: [PATCH 1644/2396] hw/hppa: Fix firmware end address for LASI chip

The base address of a LASI chip on a 715 machine starts at HPA
0xf0100000.  Make sure that the firmware does not extend beyond that
address, otherwise it's not possible to access the LASI ports.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/hppa/hppa_hardware.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/hppa/hppa_hardware.h b/hw/hppa/hppa_hardware.h
index 21c777cba6..d422af0429 100644
--- a/hw/hppa/hppa_hardware.h
+++ b/hw/hppa/hppa_hardware.h
@@ -5,7 +5,7 @@
 #define HW_HPPA_HPPA_HARDWARE_H
 
 #define FIRMWARE_START  0xf0000000
-#define FIRMWARE_END    0xf0800000
+#define FIRMWARE_END    0xf0100000
 #define FIRMWARE_HIGH   0xfffffff0  /* upper 32-bits of 64-bit firmware address */
 
 #define RAM_MAP_HIGH  0x0100000000  /* memory above 3.75 GB is mapped here */
@@ -19,6 +19,7 @@
 #define DINO_UART_HPA   0xfff83000
 #define  DINO_UART_BASE 0xfff83800
 #define DINO_SCSI_HPA   0xfff8c000
+#define LASI_HPA_715    0xf0100000
 #define LASI_HPA        0xffd00000
 #define LASI_UART_HPA   0xffd05000
 #define LASI_SCSI_HPA   0xffd06000

From fb722e1dc2d84529ab9aa597315b7d5ca6e2a23e Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 14 Oct 2025 22:59:05 +0200
Subject: [PATCH 1645/2396] hw/hppa: Fix interrupt of LASI parallel port
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix wrong assignment where the LASI parallel port was using the IRQ line of the
LASI LAN card.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/hppa/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index cddca69b93..bec5a86f24 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -584,7 +584,7 @@ static void machine_HP_B160L_init(MachineState *machine)
 
     /* Parallel port */
     parallel_mm_init(addr_space, translate(NULL, LASI_LPT_HPA + 0x800), 0,
-                     qdev_get_gpio_in(lasi_dev, LASI_IRQ_LAN_HPA),
+                     qdev_get_gpio_in(lasi_dev, LASI_IRQ_LPT_HPA),
                      parallel_hds[0]);
 
     /* PS/2 Keyboard/Mouse */

From 70cb0f51ca3fe704854694b1a3ef04acfbf1313e Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 25 Oct 2025 11:11:23 +0200
Subject: [PATCH 1646/2396] hw/hppa: Add NCR 710 SCSI driver to LASI chip
 Kconfig entry

The LASI chip is a multi I/O chip used in many older PA-RISC machines.
It includes functionality for NCR710 SCSI, serial, parallel, audio,
i82596 networking and PS/2 ports.

Add the functionality for NCR710_SCSI to the LASI Kconfig option
and move over the relevant parts from the generic HPPA_B160L Kconfig
option to get the dependency right.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/Kconfig | 2 --
 hw/misc/Kconfig | 5 +++++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/hw/hppa/Kconfig b/hw/hppa/Kconfig
index cab21045de..9ede4d1140 100644
--- a/hw/hppa/Kconfig
+++ b/hw/hppa/Kconfig
@@ -17,7 +17,5 @@ config HPPA_B160L
     select IDE_CMD646
     select MC146818RTC
     select LSI_SCSI_PCI
-    select LASI_82596
-    select LASIPS2
     select PARALLEL
     select ARTIST
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 4e35657468..fccd735c24 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -212,6 +212,11 @@ config VIRT_CTRL
 
 config LASI
     bool
+    select LASI_82596
+    select LASIPS2
+    select NCR710_SCSI
+    select PARALLEL
+    select SERIAL_MM
 
 config ALLWINNER_SRAMC
     bool

From 557bc5260cfdb1047290b4c92d1128f93abf6097 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 25 Oct 2025 11:22:45 +0200
Subject: [PATCH 1647/2396] hw/hppa: PCI devices depend on availability of PCI
 bus
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Only create the PCI serial ports (DIVA) and PCI network cards when there is
actually a PCI bus. The shortly added 715 machine will not have a PCI bus, so
avoid creating further PCI devices.

Signed-off-by: Helge Deller <deller@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/hppa/machine.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index bec5a86f24..31eeba72b4 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -387,20 +387,22 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
                         enable_lasi_lan());
     }
 
-    pci_init_nic_devices(pci_bus, mc->default_nic);
+    if (pci_bus) {
+        pci_init_nic_devices(pci_bus, mc->default_nic);
 
-    /* BMC board: HP Diva GSP */
-    dev = qdev_new("diva-gsp");
-    if (!object_property_get_bool(OBJECT(dev), "disable", NULL)) {
-        pci_dev = pci_new_multifunction(PCI_DEVFN(2, 0), "diva-gsp");
-        if (!lasi_dev) {
-            /* bind default keyboard/serial to Diva card */
-            qdev_prop_set_chr(DEVICE(pci_dev), "chardev1", serial_hd(0));
-            qdev_prop_set_chr(DEVICE(pci_dev), "chardev2", serial_hd(1));
-            qdev_prop_set_chr(DEVICE(pci_dev), "chardev3", serial_hd(2));
-            qdev_prop_set_chr(DEVICE(pci_dev), "chardev4", serial_hd(3));
+        /* BMC board: HP Diva GSP PCI card */
+        dev = qdev_new("diva-gsp");
+        if (dev && !object_property_get_bool(OBJECT(dev), "disable", NULL)) {
+            pci_dev = pci_new_multifunction(PCI_DEVFN(2, 0), "diva-gsp");
+            if (!lasi_dev) {
+                /* bind default keyboard/serial to Diva card */
+                qdev_prop_set_chr(DEVICE(pci_dev), "chardev1", serial_hd(0));
+                qdev_prop_set_chr(DEVICE(pci_dev), "chardev2", serial_hd(1));
+                qdev_prop_set_chr(DEVICE(pci_dev), "chardev3", serial_hd(2));
+                qdev_prop_set_chr(DEVICE(pci_dev), "chardev4", serial_hd(3));
+            }
+            pci_realize_and_unref(pci_dev, pci_bus, &error_fatal);
         }
-        pci_realize_and_unref(pci_dev, pci_bus, &error_fatal);
     }
 
     /* create USB OHCI controller for USB keyboard & mouse on Astro machines */

From bcefa910e8fd6a3a108e0e59e1e977792e572e47 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Tue, 14 Oct 2025 23:15:53 +0200
Subject: [PATCH 1648/2396] hw/hppa: Require SeaBIOS version 19 for 715 machine

Require at least SeaBIOS version 19 before adding the 715 machine.  This is
required, because the machine inventory of the 715 is provided by the SeaBIOS
firmware.

Signed-off-by: Helge Deller <deller@gmx.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
---
 hw/hppa/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 31eeba72b4..81ed050b5e 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -43,7 +43,7 @@ struct HppaMachineState {
     MachineState parent_obj;
 };
 
-#define MIN_SEABIOS_HPPA_VERSION 12 /* require at least this fw version */
+#define MIN_SEABIOS_HPPA_VERSION 19 /* require at least this fw version */
 
 #define HPA_POWER_BUTTON        (FIRMWARE_END - 0x10)
 static hwaddr soft_power_reg;

From 95a3f921811ba3f817538580ee7b85336dd16e39 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sat, 25 Oct 2025 11:30:39 +0200
Subject: [PATCH 1649/2396] hw/hppa: Add 715 machine type including NCR710 SCSI

Add a new emulation for a 715/64 machine.
This machines has no PCI bus, and has the majority of the devices (SCSI,
network, serial ports, ...) provided by a LASI multi-function I/O chip.

Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/machine.c | 114 ++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 105 insertions(+), 9 deletions(-)

diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index 81ed050b5e..110fe6bb0c 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -30,6 +30,8 @@
 #include "hw/pci-host/astro.h"
 #include "hw/pci-host/dino.h"
 #include "hw/misc/lasi.h"
+#include "hw/scsi/ncr53c710.h"
+#include "hw/scsi/lasi_ncr710.h"
 #include "hppa_hardware.h"
 #include "qemu/units.h"
 #include "qapi/error.h"
@@ -346,7 +348,7 @@ static TranslateFn *machine_HP_common_init_cpus(MachineState *machine)
 }
 
 /*
- * Last creation step: Add SCSI discs, NICs, graphics & load firmware
+ * Last creation step: Add NICs, graphics & load firmware
  */
 static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
                                         TranslateFn *translate)
@@ -361,12 +363,6 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
     MemoryRegion *rom_region;
     SysBusDevice *s;
 
-    /* SCSI disk setup. */
-    if (drive_get_max_bus(IF_SCSI) >= 0) {
-        dev = DEVICE(pci_create_simple(pci_bus, -1, "lsi53c895a"));
-        lsi53c8xx_handle_legacy_cmdline(dev);
-    }
-
     /* Graphics setup. */
     if (machine->enable_graphics && vga_interface_type != VGA_NONE) {
         dev = qdev_new("artist");
@@ -537,6 +533,71 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
     cpu[0]->env.kernel_entry = kernel_entry;
 }
 
+/*
+ * Create HP 715/64 workstation
+ */
+static void machine_HP_715_init(MachineState *machine)
+{
+    DeviceState *dev;
+    MemoryRegion *addr_space = get_system_memory();
+    TranslateFn *translate;
+    ISABus *isa_bus;
+
+    /* Create CPUs and RAM.  */
+    translate = machine_HP_common_init_cpus(machine);
+
+    if (hppa_is_pa20(&cpu[0]->env)) {
+        error_report("The HP 715/64 workstation requires a 32-bit "
+                     "CPU. Use '-machine 715' instead.");
+        exit(1);
+    }
+
+    /* Create ISA bus, needed for PS/2 kbd/mouse port emulation */
+    isa_bus = hppa_isa_bus(translate(NULL, IDE_HPA));
+    assert(isa_bus);
+
+    /* Init Lasi chip */
+    lasi_dev = DEVICE(lasi_init());
+    memory_region_add_subregion(addr_space, translate(NULL, LASI_HPA_715),
+                                sysbus_mmio_get_region(
+                                    SYS_BUS_DEVICE(lasi_dev), 0));
+
+    /* Serial ports: Lasi use a 7.272727 MHz clock. */
+    serial_mm_init(addr_space, translate(NULL, LASI_HPA_715 + LASI_UART + 0x800), 0,
+        qdev_get_gpio_in(lasi_dev, LASI_IRQ_UART_HPA), 7272727 / 16,
+        serial_hd(0), DEVICE_BIG_ENDIAN);
+
+    /* Parallel port */
+    parallel_mm_init(addr_space, translate(NULL, LASI_HPA_715 + LASI_LPT + 0x800), 0,
+                     qdev_get_gpio_in(lasi_dev, LASI_IRQ_LPT_HPA),
+                     parallel_hds[0]);
+
+    /* PS/2 Keyboard/Mouse */
+    dev = qdev_new(TYPE_LASIPS2);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(lasi_dev, LASI_IRQ_PS2KBD_HPA));
+    memory_region_add_subregion(addr_space,
+                                translate(NULL, LASI_HPA_715 + LASI_PS2),
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
+                                                       0));
+    memory_region_add_subregion(addr_space,
+                                translate(NULL, LASI_HPA_715 + LASI_PS2 + 0x100),
+                                sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
+                                                       1));
+    /* SCSI disk setup. */
+    if (drive_get_max_bus(IF_SCSI) >= 0) {
+        dev = lasi_ncr710_init(addr_space,
+                               translate(NULL, LASI_HPA_715 + 0x6000),
+                               qdev_get_gpio_in(lasi_dev, LASI_IRQ_SCSI_HPA));
+        assert(dev);
+        lasi_ncr710_handle_legacy_cmdline(dev);
+    }
+
+    /* Add NICs, graphics & load firmware */
+    machine_HP_common_init_tail(machine, NULL, translate);
+}
+
 /*
  * Create HP B160L workstation
  */
@@ -603,7 +664,13 @@ static void machine_HP_B160L_init(MachineState *machine)
                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
                                                        1));
 
-    /* Add SCSI discs, NICs, graphics & load firmware */
+    /* SCSI disk setup. */
+    if (drive_get_max_bus(IF_SCSI) >= 0) {
+        dev = DEVICE(pci_create_simple(pci_bus, -1, "lsi53c895a"));
+        lsi53c8xx_handle_legacy_cmdline(dev);
+    }
+
+    /* Add NICs, graphics & load firmware */
     machine_HP_common_init_tail(machine, pci_bus, translate);
 }
 
@@ -646,7 +713,13 @@ static void machine_HP_C3700_init(MachineState *machine)
     pci_bus = PCI_BUS(qdev_get_child_bus(DEVICE(astro->elroy[0]), "pci"));
     assert(pci_bus);
 
-    /* Add SCSI discs, NICs, graphics & load firmware */
+    /* SCSI disk setup. */
+    if (drive_get_max_bus(IF_SCSI) >= 0) {
+        DeviceState *dev = DEVICE(pci_create_simple(pci_bus, -1, "lsi53c895a"));
+        lsi53c8xx_handle_legacy_cmdline(dev);
+    }
+
+    /* Add NICs, graphics & load firmware */
     machine_HP_common_init_tail(machine, pci_bus, translate);
 }
 
@@ -743,6 +816,25 @@ static void HP_C3700_machine_init_class_init(ObjectClass *oc, const void *data)
     mc->default_ram_size = 1024 * MiB;
 }
 
+static void HP_715_machine_init_class_init(ObjectClass *oc, const void *data)
+{
+    static const char * const valid_cpu_types[] = {
+        TYPE_HPPA_CPU,
+        NULL
+    };
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    mc->desc = "HP 715/64 workstation";
+    mc->default_cpu_type = TYPE_HPPA_CPU;
+    mc->valid_cpu_types = valid_cpu_types;
+    mc->init = machine_HP_715_init;
+    /* can only support up to max. 8 CPUs due inventory major numbers */
+    mc->max_cpus = MIN_CONST(HPPA_MAX_CPUS, 8);
+    mc->default_ram_size = 256 * MiB;
+    mc->default_nic = NULL;
+}
+
+
 static const TypeInfo hppa_machine_types[] = {
     {
         .name           = TYPE_HPPA_COMMON_MACHINE,
@@ -762,6 +854,10 @@ static const TypeInfo hppa_machine_types[] = {
         .name = MACHINE_TYPE_NAME("C3700"),
         .parent = TYPE_HPPA_COMMON_MACHINE,
         .class_init = HP_C3700_machine_init_class_init,
+    }, {
+        .name = MACHINE_TYPE_NAME("715"),
+        .parent = TYPE_HPPA_COMMON_MACHINE,
+        .class_init = HP_715_machine_init_class_init,
     },
 };
 

From 1a8ffd6172f3d9ad8232189adb879a16ec416f89 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 17 Oct 2025 09:53:50 +0100
Subject: [PATCH 1650/2396] target/hppa: Set FPCR exception flag bits for
 non-trapped exceptions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In commit ebd394948de4e8 ("target/hppa: Fix FPE exceptions") when
we added the code for setting up the registers correctly on trapping
FP exceptions, we accidentally broke the handling of the flag bits
for non-trapping exceptions.

In update_fr0_op() we incorrectly zero out the flag bits and the C
bit, so any fp operation would clear previously set flag bits. We
also stopped setting the flag bits when the fp operation raises
an exception and the trap is not enabled.

Adjust the code so that we set the Flag bits for every exception that
happened and where the trap is not enabled.  (This is the correct
behaviour for the case where an instruction triggers two exceptions,
one of which traps and one of which does not; that can only happen
for inexact + underflow or inexact + overflow.)

Cc: qemu-stable@nongnu.org
Fixes: ebd394948de4e8 ("target/hppa: Fix FPE exceptions")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3158
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Helge Deller <deller@gmx.de>
Tested-by: Helge Deller <deller@gmx.de>
Message-ID: <20251017085350.895681-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/hppa/fpu_helper.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index 45353202fa..2d272730f6 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -94,7 +94,8 @@ static void update_fr0_op(CPUHPPAState *env, uintptr_t ra)
 {
     uint32_t soft_exp = get_float_exception_flags(&env->fp_status);
     uint32_t hard_exp = 0;
-    uint32_t shadow = env->fr0_shadow & 0x3ffffff;
+    uint32_t shadow = env->fr0_shadow;
+    uint32_t to_flag = 0;
     uint32_t fr1 = 0;
 
     if (likely(soft_exp == 0)) {
@@ -122,6 +123,10 @@ static void update_fr0_op(CPUHPPAState *env, uintptr_t ra)
             fr1 |= hard_exp << (R_FPSR_FLAGS_SHIFT - R_FPSR_ENABLES_SHIFT);
         }
     }
+    /* Set the Flag bits for every exception that was not enabled */
+    to_flag = hard_exp & ~shadow;
+    shadow |= to_flag << (R_FPSR_FLAGS_SHIFT - R_FPSR_ENABLES_SHIFT);
+
     env->fr0_shadow = shadow;
     env->fr[0] = (uint64_t)shadow << 32 | fr1;
 

From b12c1b37242d986f96c1c1ba7a5dff213d59b0b0 Mon Sep 17 00:00:00 2001
From: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Thu, 23 Oct 2025 14:34:28 +0800
Subject: [PATCH 1651/2396] qom: remove redundant typedef when use
 OBJECT_DECLARE_SIMPLE_TYPE
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When OBJECT_DECLARE_SIMPLE_TYPE is used, it automatically provides
the typedef, so we don’t have to define it ourselves.

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251023063429.1400398-1-phind.uet@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 backends/cryptodev-lkcf.c               | 1 -
 hw/char/ipoctal232.c                    | 9 ++++-----
 hw/char/xen_console.c                   | 1 -
 hw/dma/pl330.c                          | 6 ++----
 hw/net/fsl_etsec/etsec.h                | 1 -
 hw/net/xen_nic.c                        | 2 --
 hw/pci-host/bonito.c                    | 7 +++----
 hw/ppc/pef.c                            | 1 -
 hw/usb/dev-mtp.c                        | 7 +++----
 hw/usb/dev-uas.c                        | 7 +++----
 include/hw/char/serial.h                | 1 -
 include/hw/input/lasips2.h              | 6 ++----
 include/hw/misc/auxbus.h                | 7 +++----
 include/hw/misc/bcm2835_mphi.h          | 7 ++-----
 include/hw/misc/npcm7xx_pwm.h           | 7 ++-----
 include/hw/pci-host/pnv_phb3.h          | 6 ++----
 include/hw/pci-host/pnv_phb4.h          | 8 ++++----
 include/hw/ppc/mac_dbdma.h              | 7 +++----
 include/hw/riscv/iommu.h                | 3 ---
 include/hw/scsi/scsi.h                  | 7 +++----
 include/hw/vfio/vfio-container-legacy.h | 5 ++---
 include/hw/virtio/virtio-serial.h       | 5 ++---
 include/net/can_emu.h                   | 7 +++----
 23 files changed, 43 insertions(+), 75 deletions(-)

diff --git a/backends/cryptodev-lkcf.c b/backends/cryptodev-lkcf.c
index bb7a81d5d0..97a8a8812c 100644
--- a/backends/cryptodev-lkcf.c
+++ b/backends/cryptodev-lkcf.c
@@ -68,7 +68,6 @@ typedef struct CryptoDevBackendLKCFSession {
     QCryptoAkCipherOptions akcipher_opts;
 } CryptoDevBackendLKCFSession;
 
-typedef struct CryptoDevBackendLKCF CryptoDevBackendLKCF;
 typedef struct CryptoDevLKCFTask CryptoDevLKCFTask;
 struct CryptoDevLKCFTask {
     CryptoDevBackendLKCFSession *sess;
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index 752c6c818a..0a7ffcd0b7 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -93,7 +93,10 @@
 #define ISR_RXRDY(CH) (((CH) & 1) ? BIT(5) : BIT(1))
 #define ISR_BREAK(CH) (((CH) & 1) ? BIT(6) : BIT(2))
 
-typedef struct IPOctalState IPOctalState;
+#define TYPE_IPOCTAL "ipoctal232"
+
+OBJECT_DECLARE_SIMPLE_TYPE(IPOctalState, IPOCTAL)
+
 typedef struct SCC2698Channel SCC2698Channel;
 typedef struct SCC2698Block SCC2698Block;
 
@@ -122,10 +125,6 @@ struct IPOctalState {
     uint8_t irq_vector;
 };
 
-#define TYPE_IPOCTAL "ipoctal232"
-
-OBJECT_DECLARE_SIMPLE_TYPE(IPOctalState, IPOCTAL)
-
 static const VMStateDescription vmstate_scc2698_channel = {
     .name = "scc2698_channel",
     .version_id = 1,
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index 9c34a554bf..0e73c2aee4 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -56,7 +56,6 @@ struct XenConsole {
     CharBackend       chr;
     int               backlog;
 };
-typedef struct XenConsole XenConsole;
 
 #define TYPE_XEN_CONSOLE_DEVICE "xen-console"
 OBJECT_DECLARE_SIMPLE_TYPE(XenConsole, XEN_CONSOLE_DEVICE)
diff --git a/hw/dma/pl330.c b/hw/dma/pl330.c
index a570bb08ec..f9c91f924b 100644
--- a/hw/dma/pl330.c
+++ b/hw/dma/pl330.c
@@ -111,7 +111,8 @@ typedef enum  {
     pl330_chan_fault = 15,
 } PL330ChanState;
 
-typedef struct PL330State PL330State;
+#define TYPE_PL330 "pl330"
+OBJECT_DECLARE_SIMPLE_TYPE(PL330State, PL330)
 
 typedef struct PL330Chan {
     uint32_t src;
@@ -274,9 +275,6 @@ struct PL330State {
     AddressSpace *mem_as;
 };
 
-#define TYPE_PL330 "pl330"
-OBJECT_DECLARE_SIMPLE_TYPE(PL330State, PL330)
-
 static const VMStateDescription vmstate_pl330 = {
     .name = "pl330",
     .version_id = 2,
diff --git a/hw/net/fsl_etsec/etsec.h b/hw/net/fsl_etsec/etsec.h
index 3860864a3f..bd2de3f99c 100644
--- a/hw/net/fsl_etsec/etsec.h
+++ b/hw/net/fsl_etsec/etsec.h
@@ -130,7 +130,6 @@ struct eTSEC {
     /* Whether we should flush the rx queue when buffer becomes available. */
     bool need_flush;
 };
-typedef struct eTSEC eTSEC;
 
 #define TYPE_ETSEC_COMMON "eTSEC"
 OBJECT_DECLARE_SIMPLE_TYPE(eTSEC, ETSEC_COMMON)
diff --git a/hw/net/xen_nic.c b/hw/net/xen_nic.c
index 34c6a1d0b0..e7bdc732de 100644
--- a/hw/net/xen_nic.c
+++ b/hw/net/xen_nic.c
@@ -62,8 +62,6 @@ struct XenNetDev {
     NICState              *nic;
 };
 
-typedef struct XenNetDev XenNetDev;
-
 #define TYPE_XEN_NET_DEVICE "xen-net-device"
 OBJECT_DECLARE_SIMPLE_TYPE(XenNetDev, XEN_NET_DEVICE)
 
diff --git a/hw/pci-host/bonito.c b/hw/pci-host/bonito.c
index 7d6251a78d..cbda068ef7 100644
--- a/hw/pci-host/bonito.c
+++ b/hw/pci-host/bonito.c
@@ -230,7 +230,9 @@ struct PCIBonitoState {
     MemoryRegion bonito_localio;
 
 };
-typedef struct PCIBonitoState PCIBonitoState;
+
+#define TYPE_PCI_BONITO "Bonito"
+OBJECT_DECLARE_SIMPLE_TYPE(PCIBonitoState, PCI_BONITO)
 
 struct BonitoState {
     PCIHostState parent_obj;
@@ -239,9 +241,6 @@ struct BonitoState {
     MemoryRegion pci_mem;
 };
 
-#define TYPE_PCI_BONITO "Bonito"
-OBJECT_DECLARE_SIMPLE_TYPE(PCIBonitoState, PCI_BONITO)
-
 static void bonito_writel(void *opaque, hwaddr addr,
                           uint64_t val, unsigned size)
 {
diff --git a/hw/ppc/pef.c b/hw/ppc/pef.c
index 254f570787..39b4ce94f1 100644
--- a/hw/ppc/pef.c
+++ b/hw/ppc/pef.c
@@ -19,7 +19,6 @@
 #define TYPE_PEF_GUEST "pef-guest"
 OBJECT_DECLARE_SIMPLE_TYPE(PefGuest, PEF_GUEST)
 
-typedef struct PefGuest PefGuest;
 typedef struct PefGuestClass PefGuestClass;
 
 struct PefGuestClass {
diff --git a/hw/usb/dev-mtp.c b/hw/usb/dev-mtp.c
index ce45c9cd06..afd7944b73 100644
--- a/hw/usb/dev-mtp.c
+++ b/hw/usb/dev-mtp.c
@@ -123,11 +123,13 @@ typedef struct {
 
 /* ----------------------------------------------------------------------- */
 
-typedef struct MTPState MTPState;
 typedef struct MTPControl MTPControl;
 typedef struct MTPData MTPData;
 typedef struct MTPObject MTPObject;
 
+#define TYPE_USB_MTP "usb-mtp"
+OBJECT_DECLARE_SIMPLE_TYPE(MTPState, USB_MTP)
+
 enum {
     EP_DATA_IN = 1,
     EP_DATA_OUT,
@@ -236,9 +238,6 @@ typedef struct {
     /* string and other data follows */
 } QEMU_PACKED ObjectInfo;
 
-#define TYPE_USB_MTP "usb-mtp"
-OBJECT_DECLARE_SIMPLE_TYPE(MTPState, USB_MTP)
-
 #define QEMU_STORAGE_ID 0x00010001
 
 #define MTP_FLAG_WRITABLE 0
diff --git a/hw/usb/dev-uas.c b/hw/usb/dev-uas.c
index 21cc2835c6..18ebe15d0c 100644
--- a/hw/usb/dev-uas.c
+++ b/hw/usb/dev-uas.c
@@ -109,10 +109,12 @@ typedef struct {
 #define UAS_STREAM_BM_ATTR  4
 #define UAS_MAX_STREAMS     (1 << UAS_STREAM_BM_ATTR)
 
-typedef struct UASDevice UASDevice;
 typedef struct UASRequest UASRequest;
 typedef struct UASStatus UASStatus;
 
+#define TYPE_USB_UAS "usb-uas"
+OBJECT_DECLARE_SIMPLE_TYPE(UASDevice, USB_UAS)
+
 struct UASDevice {
     USBDevice                 dev;
     SCSIBus                   bus;
@@ -133,9 +135,6 @@ struct UASDevice {
     USBPacket                 *status3[UAS_MAX_STREAMS + 1];
 };
 
-#define TYPE_USB_UAS "usb-uas"
-OBJECT_DECLARE_SIMPLE_TYPE(UASDevice, USB_UAS)
-
 struct UASRequest {
     uint16_t     tag;
     uint64_t     lun;
diff --git a/include/hw/char/serial.h b/include/hw/char/serial.h
index 4bf90a46f3..2cfeaed7fb 100644
--- a/include/hw/char/serial.h
+++ b/include/hw/char/serial.h
@@ -77,7 +77,6 @@ struct SerialState {
     QEMUTimer *modem_status_poll;
     MemoryRegion io;
 };
-typedef struct SerialState SerialState;
 
 extern const VMStateDescription vmstate_serial;
 extern const MemoryRegionOps serial_io_ops;
diff --git a/include/hw/input/lasips2.h b/include/hw/input/lasips2.h
index 01911c50f9..fd74883073 100644
--- a/include/hw/input/lasips2.h
+++ b/include/hw/input/lasips2.h
@@ -32,7 +32,8 @@ struct LASIPS2PortDeviceClass {
     DeviceRealize parent_realize;
 };
 
-typedef struct LASIPS2State LASIPS2State;
+#define TYPE_LASIPS2 "lasips2"
+OBJECT_DECLARE_SIMPLE_TYPE(LASIPS2State, LASIPS2)
 
 struct LASIPS2Port {
     DeviceState parent_obj;
@@ -74,7 +75,4 @@ struct LASIPS2State {
     qemu_irq irq;
 };
 
-#define TYPE_LASIPS2 "lasips2"
-OBJECT_DECLARE_SIMPLE_TYPE(LASIPS2State, LASIPS2)
-
 #endif /* HW_INPUT_LASIPS2_H */
diff --git a/include/hw/misc/auxbus.h b/include/hw/misc/auxbus.h
index ccd18ce209..0051e03947 100644
--- a/include/hw/misc/auxbus.h
+++ b/include/hw/misc/auxbus.h
@@ -29,13 +29,15 @@
 #include "hw/qdev-core.h"
 #include "qom/object.h"
 
-typedef struct AUXSlave AUXSlave;
 typedef enum AUXCommand AUXCommand;
 typedef enum AUXReply AUXReply;
 
 #define TYPE_AUXTOI2C "aux-to-i2c-bridge"
 OBJECT_DECLARE_SIMPLE_TYPE(AUXTOI2CState, AUXTOI2C)
 
+#define TYPE_AUX_SLAVE "aux-slave"
+OBJECT_DECLARE_SIMPLE_TYPE(AUXSlave, AUX_SLAVE)
+
 enum AUXCommand {
     WRITE_I2C = 0,
     READ_I2C = 1,
@@ -73,9 +75,6 @@ struct AUXBus {
     AddressSpace aux_addr_space;
 };
 
-#define TYPE_AUX_SLAVE "aux-slave"
-OBJECT_DECLARE_SIMPLE_TYPE(AUXSlave, AUX_SLAVE)
-
 struct AUXSlave {
     /* < private > */
     DeviceState parent_obj;
diff --git a/include/hw/misc/bcm2835_mphi.h b/include/hw/misc/bcm2835_mphi.h
index 751363f496..3f1997e5f2 100644
--- a/include/hw/misc/bcm2835_mphi.h
+++ b/include/hw/misc/bcm2835_mphi.h
@@ -23,7 +23,8 @@
 
 #define MPHI_MMIO_SIZE      0x1000
 
-typedef struct BCM2835MphiState BCM2835MphiState;
+#define TYPE_BCM2835_MPHI   "bcm2835-mphi"
+OBJECT_DECLARE_SIMPLE_TYPE(BCM2835MphiState, BCM2835_MPHI)
 
 struct BCM2835MphiState {
     SysBusDevice parent_obj;
@@ -37,8 +38,4 @@ struct BCM2835MphiState {
     uint32_t swirq;
 };
 
-#define TYPE_BCM2835_MPHI   "bcm2835-mphi"
-
-OBJECT_DECLARE_SIMPLE_TYPE(BCM2835MphiState, BCM2835_MPHI)
-
 #endif
diff --git a/include/hw/misc/npcm7xx_pwm.h b/include/hw/misc/npcm7xx_pwm.h
index bf953440ac..df92726620 100644
--- a/include/hw/misc/npcm7xx_pwm.h
+++ b/include/hw/misc/npcm7xx_pwm.h
@@ -35,8 +35,8 @@
  * value of 100,000 the duty cycle for that PWM is 10%.
  */
 #define NPCM7XX_PWM_MAX_DUTY 1000000
-
-typedef struct NPCM7xxPWMState NPCM7xxPWMState;
+#define TYPE_NPCM7XX_PWM "npcm7xx-pwm"
+OBJECT_DECLARE_SIMPLE_TYPE(NPCM7xxPWMState, NPCM7XX_PWM)
 
 /**
  * struct NPCM7xxPWM - The state of a single PWM channel.
@@ -100,7 +100,4 @@ struct NPCM7xxPWMState {
     uint32_t    piir;
 };
 
-#define TYPE_NPCM7XX_PWM "npcm7xx-pwm"
-OBJECT_DECLARE_SIMPLE_TYPE(NPCM7xxPWMState, NPCM7XX_PWM)
-
 #endif /* NPCM7XX_PWM_H */
diff --git a/include/hw/pci-host/pnv_phb3.h b/include/hw/pci-host/pnv_phb3.h
index 24ca3dddaa..682f62a638 100644
--- a/include/hw/pci-host/pnv_phb3.h
+++ b/include/hw/pci-host/pnv_phb3.h
@@ -14,7 +14,8 @@
 #include "qom/object.h"
 #include "hw/pci-host/pnv_phb.h"
 
-typedef struct PnvPHB3 PnvPHB3;
+#define TYPE_PNV_PHB3 "pnv-phb3"
+OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB3, PNV_PHB3)
 
 /*
  * PHB3 XICS Source for MSIs
@@ -115,9 +116,6 @@ OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB3RootBus, PNV_PHB3_ROOT_BUS)
 /*
  * PHB3 PCIe Host Bridge for PowerNV machines (POWER8)
  */
-#define TYPE_PNV_PHB3 "pnv-phb3"
-OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB3, PNV_PHB3)
-
 #define PNV_PHB3_NUM_M64      16
 #define PNV_PHB3_NUM_REGS     (0x1000 >> 3)
 #define PNV_PHB3_NUM_LSI      8
diff --git a/include/hw/pci-host/pnv_phb4.h b/include/hw/pci-host/pnv_phb4.h
index 8a80c0c667..de996e718b 100644
--- a/include/hw/pci-host/pnv_phb4.h
+++ b/include/hw/pci-host/pnv_phb4.h
@@ -17,8 +17,11 @@
 #include "hw/ppc/xive.h"
 #include "qom/object.h"
 
+
+#define TYPE_PNV_PHB4 "pnv-phb4"
+OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB4, PNV_PHB4)
+
 typedef struct PnvPhb4PecStack PnvPhb4PecStack;
-typedef struct PnvPHB4 PnvPHB4;
 
 /*
  * We have one such address space wrapper per possible device under
@@ -59,9 +62,6 @@ OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB4RootBus, PNV_PHB4_ROOT_BUS)
 /*
  * PHB4 PCIe Host Bridge for PowerNV machines (POWER9)
  */
-#define TYPE_PNV_PHB4 "pnv-phb4"
-OBJECT_DECLARE_SIMPLE_TYPE(PnvPHB4, PNV_PHB4)
-
 #define PNV_PHB4_MAX_LSIs          8
 #define PNV_PHB4_MAX_INTs          4096
 #define PNV_PHB4_MAX_MIST          (PNV_PHB4_MAX_INTs >> 2)
diff --git a/include/hw/ppc/mac_dbdma.h b/include/hw/ppc/mac_dbdma.h
index 896ee4a2b1..7676488245 100644
--- a/include/hw/ppc/mac_dbdma.h
+++ b/include/hw/ppc/mac_dbdma.h
@@ -164,7 +164,9 @@ struct DBDMAState {
     DBDMA_channel channels[DBDMA_CHANNELS];
     QEMUBH *bh;
 };
-typedef struct DBDMAState DBDMAState;
+
+#define TYPE_MAC_DBDMA "mac-dbdma"
+OBJECT_DECLARE_SIMPLE_TYPE(DBDMAState, MAC_DBDMA)
 
 /* Externally callable functions */
 
@@ -173,7 +175,4 @@ void DBDMA_register_channel(void *dbdma, int nchan, qemu_irq irq,
                             void *opaque);
 void DBDMA_kick(DBDMAState *dbdma);
 
-#define TYPE_MAC_DBDMA "mac-dbdma"
-OBJECT_DECLARE_SIMPLE_TYPE(DBDMAState, MAC_DBDMA)
-
 #endif
diff --git a/include/hw/riscv/iommu.h b/include/hw/riscv/iommu.h
index 8a8acfc3f0..25f1a8b159 100644
--- a/include/hw/riscv/iommu.h
+++ b/include/hw/riscv/iommu.h
@@ -24,18 +24,15 @@
 
 #define TYPE_RISCV_IOMMU "riscv-iommu"
 OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUState, RISCV_IOMMU)
-typedef struct RISCVIOMMUState RISCVIOMMUState;
 
 #define TYPE_RISCV_IOMMU_MEMORY_REGION "riscv-iommu-mr"
 typedef struct RISCVIOMMUSpace RISCVIOMMUSpace;
 
 #define TYPE_RISCV_IOMMU_PCI "riscv-iommu-pci"
 OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStatePci, RISCV_IOMMU_PCI)
-typedef struct RISCVIOMMUStatePci RISCVIOMMUStatePci;
 
 #define TYPE_RISCV_IOMMU_SYS "riscv-iommu-device"
 OBJECT_DECLARE_SIMPLE_TYPE(RISCVIOMMUStateSys, RISCV_IOMMU_SYS)
-typedef struct RISCVIOMMUStateSys RISCVIOMMUStateSys;
 
 #define FDT_IRQ_TYPE_EDGE_LOW 1
 
diff --git a/include/hw/scsi/scsi.h b/include/hw/scsi/scsi.h
index 90ee192b4d..044bd048b4 100644
--- a/include/hw/scsi/scsi.h
+++ b/include/hw/scsi/scsi.h
@@ -10,7 +10,9 @@
 
 #define MAX_SCSI_DEVS 255
 
-typedef struct SCSIBus SCSIBus;
+#define TYPE_SCSI_BUS "SCSI"
+OBJECT_DECLARE_SIMPLE_TYPE(SCSIBus, SCSI_BUS)
+
 typedef struct SCSIBusInfo SCSIBusInfo;
 typedef struct SCSIDevice SCSIDevice;
 typedef struct SCSIRequest SCSIRequest;
@@ -151,9 +153,6 @@ struct SCSIBusInfo {
     void (*drained_end)(SCSIBus *bus);
 };
 
-#define TYPE_SCSI_BUS "SCSI"
-OBJECT_DECLARE_SIMPLE_TYPE(SCSIBus, SCSI_BUS)
-
 struct SCSIBus {
     BusState qbus;
     int busnr;
diff --git a/include/hw/vfio/vfio-container-legacy.h b/include/hw/vfio/vfio-container-legacy.h
index ffd594e80d..fe82212526 100644
--- a/include/hw/vfio/vfio-container-legacy.h
+++ b/include/hw/vfio/vfio-container-legacy.h
@@ -12,7 +12,8 @@
 #include "hw/vfio/vfio-container.h"
 #include "hw/vfio/vfio-cpr.h"
 
-typedef struct VFIOLegacyContainer VFIOLegacyContainer;
+OBJECT_DECLARE_SIMPLE_TYPE(VFIOLegacyContainer, VFIO_IOMMU_LEGACY);
+
 typedef struct VFIODevice VFIODevice;
 
 typedef struct VFIOGroup {
@@ -35,6 +36,4 @@ struct VFIOLegacyContainer {
     VFIOContainerCPR cpr;
 };
 
-OBJECT_DECLARE_SIMPLE_TYPE(VFIOLegacyContainer, VFIO_IOMMU_LEGACY);
-
 #endif /* HW_VFIO_CONTAINER_LEGACY_H */
diff --git a/include/hw/virtio/virtio-serial.h b/include/hw/virtio/virtio-serial.h
index d87c62eab7..60641860bf 100644
--- a/include/hw/virtio/virtio-serial.h
+++ b/include/hw/virtio/virtio-serial.h
@@ -29,7 +29,8 @@ struct virtio_serial_conf {
 OBJECT_DECLARE_TYPE(VirtIOSerialPort, VirtIOSerialPortClass,
                     VIRTIO_SERIAL_PORT)
 
-typedef struct VirtIOSerial VirtIOSerial;
+#define TYPE_VIRTIO_SERIAL "virtio-serial-device"
+OBJECT_DECLARE_SIMPLE_TYPE(VirtIOSerial, VIRTIO_SERIAL)
 
 #define TYPE_VIRTIO_SERIAL_BUS "virtio-serial-bus"
 OBJECT_DECLARE_SIMPLE_TYPE(VirtIOSerialBus, VIRTIO_SERIAL_BUS)
@@ -221,7 +222,5 @@ size_t virtio_serial_guest_ready(VirtIOSerialPort *port);
  */
 void virtio_serial_throttle_port(VirtIOSerialPort *port, bool throttle);
 
-#define TYPE_VIRTIO_SERIAL "virtio-serial-device"
-OBJECT_DECLARE_SIMPLE_TYPE(VirtIOSerial, VIRTIO_SERIAL)
 
 #endif
diff --git a/include/net/can_emu.h b/include/net/can_emu.h
index 6f9b206bb5..777281bad9 100644
--- a/include/net/can_emu.h
+++ b/include/net/can_emu.h
@@ -85,7 +85,9 @@ typedef struct qemu_can_filter {
 #define QEMU_CAN_INV_FILTER 0x20000000U
 
 typedef struct CanBusClientState CanBusClientState;
-typedef struct CanBusState CanBusState;
+
+#define TYPE_CAN_BUS "can-bus"
+OBJECT_DECLARE_SIMPLE_TYPE(CanBusState, CAN_BUS)
 
 typedef struct CanBusClientInfo {
     bool (*can_receive)(CanBusClientState *);
@@ -105,9 +107,6 @@ struct CanBusClientState {
     bool fd_mode;
 };
 
-#define TYPE_CAN_BUS "can-bus"
-OBJECT_DECLARE_SIMPLE_TYPE(CanBusState, CAN_BUS)
-
 int can_bus_filter_match(struct qemu_can_filter *filter, qemu_canid_t can_id);
 
 int can_bus_insert_client(CanBusState *bus, CanBusClientState *client);

From 3a9cd2a4a1571266dea37398de04f650c2a72d86 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Thu, 23 Oct 2025 16:53:09 +0300
Subject: [PATCH 1652/2396] hw/net/virtio-net: make VirtIONet.vlans an array
 instead of a pointer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This field is a fixed-size buffer (number of elements is MAX_VLAN,
known at build time).  There's no need to allocate it dynamically,
it can be made an integral part of VirtIONet structure.

This field is the only user of VMSTATE_BUFFER_POINTER_UNSAFE() macro.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Message-ID: <20251023135316.31128-2-mjt@tls.msk.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/virtio-net.c            | 9 ++++-----
 include/hw/virtio/virtio-net.h | 2 +-
 2 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 33116712eb..17ed0ef919 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -986,7 +986,7 @@ static void virtio_net_set_features(VirtIODevice *vdev,
         virtio_has_feature_ex(vdev->guest_features_ex,
                               VIRTIO_NET_F_CTRL_VLAN)) {
         bool vlan = virtio_has_feature_ex(features, VIRTIO_NET_F_CTRL_VLAN);
-        memset(n->vlans, vlan ? 0 : 0xff, MAX_VLAN >> 3);
+        memset(n->vlans, vlan ? 0 : 0xff, sizeof(n->vlans));
     }
 
     if (virtio_has_feature_ex(features, VIRTIO_NET_F_STANDBY)) {
@@ -3600,7 +3600,8 @@ static const VMStateDescription vmstate_virtio_net_device = {
          * buffer; hold onto your endiannesses; it's actually used as a bitmap
          * but based on the uint.
          */
-        VMSTATE_BUFFER_POINTER_UNSAFE(vlans, VirtIONet, 0, MAX_VLAN >> 3),
+        VMSTATE_BUFFER_UNSAFE(vlans, VirtIONet, 0,
+                              sizeof(typeof_field(VirtIONet, vlans))),
         VMSTATE_WITH_TMP(VirtIONet, struct VirtIONetMigTmp,
                          vmstate_virtio_net_has_vnet),
         VMSTATE_UINT8(mac_table.multi_overflow, VirtIONet),
@@ -4018,8 +4019,7 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
 
-    n->vlans = g_malloc0(MAX_VLAN >> 3);
-    memset(n->vlans, 0xff, MAX_VLAN >> 3);
+    memset(n->vlans, 0xff, sizeof(n->vlans));
 
     nc = qemu_get_queue(n->nic);
     nc->rxfilter_notify_enabled = 1;
@@ -4068,7 +4068,6 @@ static void virtio_net_device_unrealize(DeviceState *dev)
     n->netclient_type = NULL;
 
     g_free(n->mac_table.macs);
-    g_free(n->vlans);
 
     if (n->failover) {
         qobject_unref(n->primary_opts);
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index 5b8ab7bda7..f708355306 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -202,7 +202,7 @@ struct VirtIONet {
         uint8_t uni_overflow;
         uint8_t *macs;
     } mac_table;
-    uint32_t *vlans;
+    uint32_t vlans[MAX_VLAN];
     virtio_net_conf net_conf;
     NICConf nic_conf;
     DeviceState *qdev;

From 58341158d022823234d25fd337654a82fa6d157b Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Thu, 23 Oct 2025 16:53:10 +0300
Subject: [PATCH 1653/2396] migration/vmstate: remove
 VMSTATE_BUFFER_POINTER_UNSAFE macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only user of this macro was VirtIONet.vlans, which has been
converted to regular VMSTATE_BUFFER.

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-ID: <20251023135316.31128-3-mjt@tls.msk.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/migration/vmstate.h | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 63ccaee07a..09f1eefcfb 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -727,15 +727,6 @@ extern const VMStateInfo vmstate_info_qlist;
     .offset     = offsetof(_state, _field),                          \
 }
 
-#define VMSTATE_BUFFER_POINTER_UNSAFE(_field, _state, _version, _size) { \
-    .name       = (stringify(_field)),                               \
-    .version_id = (_version),                                        \
-    .size       = (_size),                                           \
-    .info       = &vmstate_info_buffer,                              \
-    .flags      = VMS_BUFFER|VMS_POINTER,                            \
-    .offset     = offsetof(_state, _field),                          \
-}
-
 /* Allocate a temporary of type 'tmp_type', set tmp->parent to _state
  * and execute the vmsd on the temporary.  Note that we're working with
  * the whole of _state here, not a field within it.

From 2984218aeab22a262174b4a131ae4d4fbddf5e44 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 17:26:21 +0200
Subject: [PATCH 1654/2396] hw/pci-host/raven: Simplify creating PCI facing
 part
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no need to init and realize the PCI facing part of the host
bridge separately as it does not expose any properties that need to be
available before realize. It can be simpilfied using pci_create_simple.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <5a60e395d72e5eb4d01093434fbb645d72ac567a.1761232472.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 11 +----------
 1 file changed, 1 insertion(+), 10 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index eacffc86d8..c0492d1456 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -65,7 +65,6 @@ struct PRePPCIState {
     MemoryRegion bm_ram_alias;
     MemoryRegion bm_pci_memory_alias;
     AddressSpace bm_as;
-    RavenPCIState pci_dev;
 
     int contiguous_map;
 };
@@ -260,8 +259,7 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
                           "pci-intack", 1);
     memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->pci_intack);
 
-    /* TODO Remove once realize propagates to child devices. */
-    qdev_realize(DEVICE(&s->pci_dev), BUS(&s->pci_bus), errp);
+    pci_create_simple(&s->pci_bus, PCI_DEVFN(0, 0), TYPE_RAVEN_PCI_DEVICE);
 }
 
 static void raven_pcihost_initfn(Object *obj)
@@ -269,7 +267,6 @@ static void raven_pcihost_initfn(Object *obj)
     PCIHostState *h = PCI_HOST_BRIDGE(obj);
     PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(obj);
     MemoryRegion *address_space_mem = get_system_memory();
-    DeviceState *pci_dev;
 
     memory_region_init(&s->pci_io, obj, "pci-io", 0x3f800000);
     memory_region_init_io(&s->pci_io_non_contiguous, obj, &raven_io_ops, s,
@@ -306,12 +303,6 @@ static void raven_pcihost_initfn(Object *obj)
     pci_setup_iommu(&s->pci_bus, &raven_iommu_ops, s);
 
     h->bus = &s->pci_bus;
-
-    object_initialize(&s->pci_dev, sizeof(s->pci_dev), TYPE_RAVEN_PCI_DEVICE);
-    pci_dev = DEVICE(&s->pci_dev);
-    object_property_set_int(OBJECT(&s->pci_dev), "addr", PCI_DEVFN(0, 0),
-                            NULL);
-    qdev_prop_set_bit(pci_dev, "multifunction", false);
 }
 
 static void raven_realize(PCIDevice *d, Error **errp)

From 7695e59e5e15379b2993b7a9b4633c018a16a2b0 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 17:26:22 +0200
Subject: [PATCH 1655/2396] hw/pci-host/raven: Simplify PCI facing part
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The raven PCI device does not need a state struct as it has no data to
store there any more, so we can remove that to simplify code.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <3c4cb144c24a2a729669549c4c0e6e47d230e68e.1761232472.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index c0492d1456..fa76e5170c 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -31,7 +31,6 @@
 #include "hw/pci/pci_bus.h"
 #include "hw/pci/pci_host.h"
 #include "hw/qdev-properties.h"
-#include "migration/vmstate.h"
 #include "hw/intc/i8259.h"
 #include "hw/irq.h"
 #include "hw/or-irq.h"
@@ -40,12 +39,6 @@
 #define TYPE_RAVEN_PCI_DEVICE "raven"
 #define TYPE_RAVEN_PCI_HOST_BRIDGE "raven-pcihost"
 
-OBJECT_DECLARE_SIMPLE_TYPE(RavenPCIState, RAVEN_PCI_DEVICE)
-
-struct RavenPCIState {
-    PCIDevice dev;
-};
-
 typedef struct PRePPCIState PREPPCIState;
 DECLARE_INSTANCE_CHECKER(PREPPCIState, RAVEN_PCI_HOST_BRIDGE,
                          TYPE_RAVEN_PCI_HOST_BRIDGE)
@@ -312,16 +305,6 @@ static void raven_realize(PCIDevice *d, Error **errp)
     d->config[PCI_CAPABILITY_LIST] = 0x00;
 }
 
-static const VMStateDescription vmstate_raven = {
-    .name = "raven",
-    .version_id = 0,
-    .minimum_version_id = 0,
-    .fields = (const VMStateField[]) {
-        VMSTATE_PCI_DEVICE(dev, RavenPCIState),
-        VMSTATE_END_OF_LIST()
-    },
-};
-
 static void raven_class_init(ObjectClass *klass, const void *data)
 {
     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
@@ -333,7 +316,6 @@ static void raven_class_init(ObjectClass *klass, const void *data)
     k->revision = 0x00;
     k->class_id = PCI_CLASS_BRIDGE_HOST;
     dc->desc = "PReP Host Bridge - Motorola Raven";
-    dc->vmsd = &vmstate_raven;
     /*
      * Reason: PCI-facing part of the host bridge, not usable without
      * the host-facing part, which can't be device_add'ed, yet.
@@ -344,7 +326,6 @@ static void raven_class_init(ObjectClass *klass, const void *data)
 static const TypeInfo raven_info = {
     .name = TYPE_RAVEN_PCI_DEVICE,
     .parent = TYPE_PCI_DEVICE,
-    .instance_size = sizeof(RavenPCIState),
     .class_init = raven_class_init,
     .interfaces = (const InterfaceInfo[]) {
         { INTERFACE_CONVENTIONAL_PCI_DEVICE },

From 9efa75e9bcb4184090e6677d6437ceaebba86005 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 17:26:23 +0200
Subject: [PATCH 1656/2396] hw/pci-host/raven: Simplify host bridge type
 declaration
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use OBJECT_DECLARE_SIMPLE_TYPE macro instead of open coding it and
change state struct name to match the previous typedef.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <e14793737092eac0642aa87214801a1f4bb1e2e7.1761232472.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index fa76e5170c..ea5ad69547 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -39,11 +39,9 @@
 #define TYPE_RAVEN_PCI_DEVICE "raven"
 #define TYPE_RAVEN_PCI_HOST_BRIDGE "raven-pcihost"
 
-typedef struct PRePPCIState PREPPCIState;
-DECLARE_INSTANCE_CHECKER(PREPPCIState, RAVEN_PCI_HOST_BRIDGE,
-                         TYPE_RAVEN_PCI_HOST_BRIDGE)
+OBJECT_DECLARE_SIMPLE_TYPE(PREPPCIState, RAVEN_PCI_HOST_BRIDGE)
 
-struct PRePPCIState {
+struct PREPPCIState {
     PCIHostState parent_obj;
 
     OrIRQState *or_irq;

From 3c334e48ccf55b33411c2e257a606d48987edb78 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 17:26:24 +0200
Subject: [PATCH 1657/2396] hw/pci-host/raven: Use DEFINE_TYPES macro
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Convert to using DEFINE_TYPES macro and move raven_pcihost_class_init
so methods of each object are grouped together.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <4ff8a3e1de847846f08d9ea6b389efeb3eb12aed.1761232472.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 57 +++++++++++++++++++++------------------------
 1 file changed, 26 insertions(+), 31 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index ea5ad69547..1d09a28bff 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -296,6 +296,15 @@ static void raven_pcihost_initfn(Object *obj)
     h->bus = &s->pci_bus;
 }
 
+static void raven_pcihost_class_init(ObjectClass *klass, const void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
+    dc->realize = raven_pcihost_realizefn;
+    dc->fw_name = "pci";
+}
+
 static void raven_realize(PCIDevice *d, Error **errp)
 {
     d->config[PCI_CACHE_LINE_SIZE] = 0x08;
@@ -321,37 +330,23 @@ static void raven_class_init(ObjectClass *klass, const void *data)
     dc->user_creatable = false;
 }
 
-static const TypeInfo raven_info = {
-    .name = TYPE_RAVEN_PCI_DEVICE,
-    .parent = TYPE_PCI_DEVICE,
-    .class_init = raven_class_init,
-    .interfaces = (const InterfaceInfo[]) {
-        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-        { },
+static const TypeInfo raven_types[] = {
+    {
+        .name = TYPE_RAVEN_PCI_HOST_BRIDGE,
+        .parent = TYPE_PCI_HOST_BRIDGE,
+        .instance_size = sizeof(PREPPCIState),
+        .instance_init = raven_pcihost_initfn,
+        .class_init = raven_pcihost_class_init,
+    },
+    {
+        .name = TYPE_RAVEN_PCI_DEVICE,
+        .parent = TYPE_PCI_DEVICE,
+        .class_init = raven_class_init,
+        .interfaces = (const InterfaceInfo[]) {
+            { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+            { },
+        },
     },
 };
 
-static void raven_pcihost_class_init(ObjectClass *klass, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    set_bit(DEVICE_CATEGORY_BRIDGE, dc->categories);
-    dc->realize = raven_pcihost_realizefn;
-    dc->fw_name = "pci";
-}
-
-static const TypeInfo raven_pcihost_info = {
-    .name = TYPE_RAVEN_PCI_HOST_BRIDGE,
-    .parent = TYPE_PCI_HOST_BRIDGE,
-    .instance_size = sizeof(PREPPCIState),
-    .instance_init = raven_pcihost_initfn,
-    .class_init = raven_pcihost_class_init,
-};
-
-static void raven_register_types(void)
-{
-    type_register_static(&raven_pcihost_info);
-    type_register_static(&raven_info);
-}
-
-type_init(raven_register_types)
+DEFINE_TYPES(raven_types)

From 0d10cb62cbb3ddf9583914172be96886bd027003 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Thu, 23 Oct 2025 17:26:25 +0200
Subject: [PATCH 1658/2396] hw/pci-host/raven: Simplify PCI bus creation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Instead of doing it manually use pci_register_root_bus() to create and
register the PCI bus. Also drop pci_bus from PREPPCIState and use the
existing bus field in the parent PCIHostState.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-ID: <4ffa168d68947d95a16c51d73cedd141b0df0ea0.1761232472.git.balaton@eik.bme.hu>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci-host/raven.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/hw/pci-host/raven.c b/hw/pci-host/raven.c
index 1d09a28bff..22ad244eb6 100644
--- a/hw/pci-host/raven.c
+++ b/hw/pci-host/raven.c
@@ -46,7 +46,6 @@ struct PREPPCIState {
 
     OrIRQState *or_irq;
     qemu_irq pci_irqs[PCI_NUM_PINS];
-    PCIBus pci_bus;
     AddressSpace pci_io_as;
     MemoryRegion pci_io;
     MemoryRegion pci_io_non_contiguous;
@@ -231,8 +230,9 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
 
     qdev_init_gpio_in(d, raven_change_gpio, 1);
 
-    pci_bus_irqs(&s->pci_bus, raven_set_irq, s, PCI_NUM_PINS);
-    pci_bus_map_irqs(&s->pci_bus, raven_map_irq);
+    h->bus = pci_register_root_bus(d, NULL, raven_set_irq, raven_map_irq,
+                                   s, &s->pci_memory, &s->pci_io, 0, 4,
+                                   TYPE_PCI_BUS);
 
     memory_region_init_io(&h->conf_mem, OBJECT(h), &pci_host_conf_le_ops, s,
                           "pci-conf-idx", 4);
@@ -250,12 +250,14 @@ static void raven_pcihost_realizefn(DeviceState *d, Error **errp)
                           "pci-intack", 1);
     memory_region_add_subregion(address_space_mem, 0xbffffff0, &s->pci_intack);
 
-    pci_create_simple(&s->pci_bus, PCI_DEVFN(0, 0), TYPE_RAVEN_PCI_DEVICE);
+    pci_create_simple(h->bus, PCI_DEVFN(0, 0), TYPE_RAVEN_PCI_DEVICE);
+
+    address_space_init(&s->bm_as, &s->bm, "raven-bm");
+    pci_setup_iommu(h->bus, &raven_iommu_ops, s);
 }
 
 static void raven_pcihost_initfn(Object *obj)
 {
-    PCIHostState *h = PCI_HOST_BRIDGE(obj);
     PREPPCIState *s = RAVEN_PCI_HOST_BRIDGE(obj);
     MemoryRegion *address_space_mem = get_system_memory();
 
@@ -278,8 +280,6 @@ static void raven_pcihost_initfn(Object *obj)
     memory_region_add_subregion_overlap(address_space_mem, PCI_IO_BASE_ADDR,
                                         &s->pci_io_non_contiguous, 1);
     memory_region_add_subregion(address_space_mem, 0xc0000000, &s->pci_memory);
-    pci_root_bus_init(&s->pci_bus, sizeof(s->pci_bus), DEVICE(obj), NULL,
-                      &s->pci_memory, &s->pci_io, 0, TYPE_PCI_BUS);
 
     /* Bus master address space */
     memory_region_init(&s->bm, obj, "bm-raven", 4 * GiB);
@@ -290,10 +290,6 @@ static void raven_pcihost_initfn(Object *obj)
                              get_system_memory(), 0, 0x80000000);
     memory_region_add_subregion(&s->bm, 0         , &s->bm_pci_memory_alias);
     memory_region_add_subregion(&s->bm, 0x80000000, &s->bm_ram_alias);
-    address_space_init(&s->bm_as, &s->bm, "raven-bm");
-    pci_setup_iommu(&s->pci_bus, &raven_iommu_ops, s);
-
-    h->bus = &s->pci_bus;
 }
 
 static void raven_pcihost_class_init(ObjectClass *klass, const void *data)

From 980f677c1ebb0a2f759f287b18245ac01682201c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Oct 2025 16:49:52 +0200
Subject: [PATCH 1659/2396] hw/qdev: Have qdev_get_gpio_out_connector() take
 const DeviceState arg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This getter doesn't update any DeviceState internal fields,
make it const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20251024190416.8803-2-philmd@linaro.org>
---
 hw/core/gpio.c         | 3 ++-
 include/hw/qdev-core.h | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/core/gpio.c b/hw/core/gpio.c
index 6e32a8eec6..c7c2936fc5 100644
--- a/hw/core/gpio.c
+++ b/hw/core/gpio.c
@@ -129,7 +129,8 @@ void qdev_connect_gpio_out_named(DeviceState *dev, const char *name, int n,
     g_free(propname);
 }
 
-qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int n)
+qemu_irq qdev_get_gpio_out_connector(const DeviceState *dev,
+                                     const char *name, int n)
 {
     g_autofree char *propname = g_strdup_printf("%s[%d]",
                                      name ? name : "unnamed-gpio-out", n);
diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index a7bfb10dc7..2caa0cbd26 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -725,7 +725,8 @@ void qdev_connect_gpio_out_named(DeviceState *dev, const char *name, int n,
  *
  * Return: qemu_irq associated with GPIO or NULL if un-wired.
  */
-qemu_irq qdev_get_gpio_out_connector(DeviceState *dev, const char *name, int n);
+qemu_irq qdev_get_gpio_out_connector(const DeviceState *dev,
+                                     const char *name, int n);
 
 /**
  * qdev_intercept_gpio_out: Intercept an existing GPIO connection

From 2226fa1a92c41d48e3d3d3e1ead42e979e331df2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Oct 2025 13:17:18 +0200
Subject: [PATCH 1660/2396] hw/sysbus: Have various helpers take a const
 SysBusDevice argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These getters don't update any SysBusDevice internal fields,
make the argument const.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Message-Id: <20251024190416.8803-3-philmd@linaro.org>
---
 hw/core/sysbus.c    | 10 +++++-----
 include/hw/sysbus.h | 10 +++++-----
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/core/sysbus.c b/hw/core/sysbus.c
index ec69e877a2..ae447c1196 100644
--- a/hw/core/sysbus.c
+++ b/hw/core/sysbus.c
@@ -80,7 +80,7 @@ static void system_bus_class_init(ObjectClass *klass, const void *data)
 }
 
 /* Check whether an IRQ source exists */
-bool sysbus_has_irq(SysBusDevice *dev, int n)
+bool sysbus_has_irq(const SysBusDevice *dev, int n)
 {
     char *prop = g_strdup_printf("%s[%d]", SYSBUS_DEVICE_GPIO_IRQ, n);
     ObjectProperty *r;
@@ -91,12 +91,12 @@ bool sysbus_has_irq(SysBusDevice *dev, int n)
     return (r != NULL);
 }
 
-bool sysbus_is_irq_connected(SysBusDevice *dev, int n)
+bool sysbus_is_irq_connected(const SysBusDevice *dev, int n)
 {
     return !!sysbus_get_connected_irq(dev, n);
 }
 
-qemu_irq sysbus_get_connected_irq(SysBusDevice *dev, int n)
+qemu_irq sysbus_get_connected_irq(const SysBusDevice *dev, int n)
 {
     DeviceState *d = DEVICE(dev);
     return qdev_get_gpio_out_connector(d, SYSBUS_DEVICE_GPIO_IRQ, n);
@@ -114,7 +114,7 @@ void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq)
 }
 
 /* Check whether an MMIO region exists */
-bool sysbus_has_mmio(SysBusDevice *dev, unsigned int n)
+bool sysbus_has_mmio(const SysBusDevice *dev, unsigned int n)
 {
     return (n < dev->num_mmio);
 }
@@ -190,7 +190,7 @@ void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory)
     dev->mmio[n].memory = memory;
 }
 
-MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n)
+MemoryRegion *sysbus_mmio_get_region(const SysBusDevice *dev, int n)
 {
     assert(n >= 0 && n < QDEV_MAX_MMIO);
     return dev->mmio[n].memory;
diff --git a/include/hw/sysbus.h b/include/hw/sysbus.h
index 18fde8a7b4..69eb62e29c 100644
--- a/include/hw/sysbus.h
+++ b/include/hw/sysbus.h
@@ -70,17 +70,17 @@ struct SysBusDevice {
 typedef void FindSysbusDeviceFunc(SysBusDevice *sbdev, void *opaque);
 
 void sysbus_init_mmio(SysBusDevice *dev, MemoryRegion *memory);
-MemoryRegion *sysbus_mmio_get_region(SysBusDevice *dev, int n);
+MemoryRegion *sysbus_mmio_get_region(const SysBusDevice *dev, int n);
 void sysbus_init_irq(SysBusDevice *dev, qemu_irq *p);
 void sysbus_pass_irq(SysBusDevice *dev, SysBusDevice *target);
 void sysbus_init_ioports(SysBusDevice *dev, uint32_t ioport, uint32_t size);
 
 
-bool sysbus_has_irq(SysBusDevice *dev, int n);
-bool sysbus_has_mmio(SysBusDevice *dev, unsigned int n);
+bool sysbus_has_irq(const SysBusDevice *dev, int n);
+bool sysbus_has_mmio(const SysBusDevice *dev, unsigned int n);
 void sysbus_connect_irq(SysBusDevice *dev, int n, qemu_irq irq);
-bool sysbus_is_irq_connected(SysBusDevice *dev, int n);
-qemu_irq sysbus_get_connected_irq(SysBusDevice *dev, int n);
+bool sysbus_is_irq_connected(const SysBusDevice *dev, int n);
+qemu_irq sysbus_get_connected_irq(const SysBusDevice *dev, int n);
 void sysbus_mmio_map(SysBusDevice *dev, int n, hwaddr addr);
 int sysbus_mmio_map_name(SysBusDevice *dev, const char*name, hwaddr addr);
 void sysbus_mmio_map_overlap(SysBusDevice *dev, int n, hwaddr addr,

From 271fd69da7c01487bfe990f577ff54001067dd5f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Oct 2025 15:33:02 +0200
Subject: [PATCH 1661/2396] hw/uefi: Include missing 'system/memory.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"system/memory.h" header is indirectly pulled by "hw/sysbus.h".
Include it explicitly to avoid when refactoring the latter:

  include/hw/uefi/var-service.h:50:39: error: field has incomplete type 'MemoryRegion' (aka 'struct MemoryRegion')
     50 |     MemoryRegion                      mr;
        |                                       ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Gerd Hoffmann <kraxel@redhat.com>
Message-Id: <20251024190416.8803-14-philmd@linaro.org>
---
 include/hw/uefi/var-service.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/include/hw/uefi/var-service.h b/include/hw/uefi/var-service.h
index f7ceac4ce2..91fb4a2091 100644
--- a/include/hw/uefi/var-service.h
+++ b/include/hw/uefi/var-service.h
@@ -9,6 +9,7 @@
 #include "qemu/uuid.h"
 #include "qemu/queue.h"
 
+#include "system/memory.h"
 #include "hw/uefi/var-service-edk2.h"
 
 #define MAX_BUFFER_SIZE (64 * 1024)

From 34bcd8f4ff9146822d51c4c15659de47eeb90c3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 24 Oct 2025 16:24:09 +0200
Subject: [PATCH 1662/2396] hw/int/loongarch: Include missing 'system/memory.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"system/memory.h" header is indirectly pulled by "hw/sysbus.h".
Include it explicitly to avoid when refactoring the latter:

  In file included from ../../hw/intc/loongson_ipi.c:9:
  In file included from /Users/philmd/source/qemu/include/hw/intc/loongson_ipi.h:12:
  include/hw/intc/loongson_ipi_common.h:37:18: error: field has incomplete type 'MemoryRegion' (aka 'struct MemoryRegion')
     37 |     MemoryRegion ipi_iocsr_mem;
        |                  ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Message-Id: <20251024190416.8803-21-philmd@linaro.org>
---
 include/hw/intc/loongarch_dintc.h         | 2 +-
 include/hw/intc/loongarch_extioi_common.h | 1 +
 include/hw/intc/loongarch_pch_msi.h       | 1 +
 include/hw/intc/loongarch_pic_common.h    | 1 +
 include/hw/intc/loongson_ipi_common.h     | 1 +
 5 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/include/hw/intc/loongarch_dintc.h b/include/hw/intc/loongarch_dintc.h
index 0b0b5347b2..01bb1e465c 100644
--- a/include/hw/intc/loongarch_dintc.h
+++ b/include/hw/intc/loongarch_dintc.h
@@ -8,7 +8,7 @@
 #include "qom/object.h"
 #include "hw/sysbus.h"
 #include "hw/loongarch/virt.h"
-
+#include "system/memory.h"
 
 #define NR_VECTORS     256
 
diff --git a/include/hw/intc/loongarch_extioi_common.h b/include/hw/intc/loongarch_extioi_common.h
index c021ccee0f..1bd2bfa07f 100644
--- a/include/hw/intc/loongarch_extioi_common.h
+++ b/include/hw/intc/loongarch_extioi_common.h
@@ -10,6 +10,7 @@
 #include "qom/object.h"
 #include "hw/sysbus.h"
 #include "hw/loongarch/virt.h"
+#include "system/memory.h"
 
 #define LS3A_INTC_IP                 8
 #define EXTIOI_IRQS                  (256)
diff --git a/include/hw/intc/loongarch_pch_msi.h b/include/hw/intc/loongarch_pch_msi.h
index b8586fb3b6..ef4ec4fdeb 100644
--- a/include/hw/intc/loongarch_pch_msi.h
+++ b/include/hw/intc/loongarch_pch_msi.h
@@ -6,6 +6,7 @@
  */
 
 #include "hw/sysbus.h"
+#include "system/memory.h"
 
 #define TYPE_LOONGARCH_PCH_MSI "loongarch_pch_msi"
 OBJECT_DECLARE_SIMPLE_TYPE(LoongArchPCHMSI, LOONGARCH_PCH_MSI)
diff --git a/include/hw/intc/loongarch_pic_common.h b/include/hw/intc/loongarch_pic_common.h
index 675ba96e64..179361eb56 100644
--- a/include/hw/intc/loongarch_pic_common.h
+++ b/include/hw/intc/loongarch_pic_common.h
@@ -9,6 +9,7 @@
 
 #include "hw/loongarch/virt.h"
 #include "hw/sysbus.h"
+#include "system/memory.h"
 
 #define PCH_PIC_INT_ID                  0x00
 #define  PCH_PIC_INT_ID_VAL             0x7
diff --git a/include/hw/intc/loongson_ipi_common.h b/include/hw/intc/loongson_ipi_common.h
index e58ce2aa1c..4fa03bc351 100644
--- a/include/hw/intc/loongson_ipi_common.h
+++ b/include/hw/intc/loongson_ipi_common.h
@@ -11,6 +11,7 @@
 #include "qom/object.h"
 #include "hw/sysbus.h"
 #include "exec/memattrs.h"
+#include "system/memory.h"
 
 #define IPI_MBX_NUM           4
 

From 77a5b02b5b3a3053414560737a41151005623b50 Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:35:53 +0530
Subject: [PATCH 1663/2396] hw/core/loader: Use qemu_open() instead of open()
 in get_image_size()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace open() with qemu_open() which provides better error handling
via the Error object, automatically sets O_CLOEXEC, and supports FD
passing with /dev/fdset.

Currently pass errp argument as NULL.

Suggested-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-4-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/loader.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index 477661a025..c9782d67e8 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -74,7 +74,7 @@ int64_t get_image_size(const char *filename)
 {
     int fd;
     int64_t size;
-    fd = open(filename, O_RDONLY | O_BINARY);
+    fd = qemu_open(filename, O_RDONLY | O_BINARY, NULL);
     if (fd < 0)
         return -1;
     size = lseek(fd, 0, SEEK_END);

From a9c608904f82044f63629d292acf49a068da4eca Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:35:55 +0530
Subject: [PATCH 1664/2396] hw/core/loader: capture Error from
 load_image_targphys
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add Error **errp parameter to load_image_targphys(),
load_image_targphys_as(), and get_image_size() to enable better
error reporting when image loading fails.

Pass NULL for errp in all existing call sites to maintain current
behavior. No functional change intended in this patch.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Tested-by: Aditya Gupta <adityag@linux.ibm.com>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-6-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/alpha/dp264.c         |  4 ++--
 hw/arm/armv7m.c          |  2 +-
 hw/arm/boot.c            |  5 +++--
 hw/arm/digic_boards.c    |  2 +-
 hw/arm/highbank.c        |  3 ++-
 hw/arm/raspi.c           |  2 +-
 hw/arm/vexpress.c        |  2 +-
 hw/core/generic-loader.c |  3 ++-
 hw/core/guest-loader.c   |  2 +-
 hw/core/loader.c         | 16 +++++++++-------
 hw/hppa/machine.c        |  5 +++--
 hw/i386/multiboot.c      |  2 +-
 hw/i386/x86-common.c     |  4 ++--
 hw/ipmi/ipmi_bmc_sim.c   |  2 +-
 hw/loongarch/boot.c      |  5 ++---
 hw/m68k/an5206.c         |  2 +-
 hw/m68k/mcf5208.c        |  4 ++--
 hw/m68k/next-cube.c      |  2 +-
 hw/m68k/q800.c           |  7 ++++---
 hw/m68k/virt.c           |  4 ++--
 hw/microblaze/boot.c     |  5 +++--
 hw/mips/boston.c         |  2 +-
 hw/mips/fuloong2e.c      |  9 +++++----
 hw/mips/jazz.c           |  2 +-
 hw/mips/loongson3_virt.c | 10 ++++++----
 hw/mips/malta.c          |  9 +++++----
 hw/nubus/nubus-device.c  |  2 +-
 hw/openrisc/boot.c       |  5 +++--
 hw/pci/pci.c             |  2 +-
 hw/ppc/amigaone.c        |  4 ++--
 hw/ppc/e500.c            |  5 +++--
 hw/ppc/mac_newworld.c    |  9 ++++++---
 hw/ppc/mac_oldworld.c    |  9 ++++++---
 hw/ppc/pegasos2.c        |  5 +++--
 hw/ppc/pnv.c             |  9 ++++++---
 hw/ppc/ppc440_bamboo.c   |  3 ++-
 hw/ppc/prep.c            |  8 +++++---
 hw/ppc/sam460ex.c        |  3 ++-
 hw/ppc/spapr.c           |  8 ++++----
 hw/ppc/virtex_ml507.c    |  5 +++--
 hw/riscv/boot.c          |  7 ++++---
 hw/rx/rx-gdbsim.c        |  2 +-
 hw/s390x/ipl.c           |  8 +++++---
 hw/sh4/r2d.c             |  8 +++++---
 hw/smbios/smbios.c       |  2 +-
 hw/sparc/leon3.c         |  4 ++--
 hw/sparc/sun4m.c         |  8 +++++---
 hw/sparc64/sun4u.c       |  7 ++++---
 hw/xtensa/xtfpga.c       |  3 ++-
 include/hw/loader.h      |  8 +++++---
 system/device_tree.c     |  2 +-
 51 files changed, 145 insertions(+), 106 deletions(-)

diff --git a/hw/alpha/dp264.c b/hw/alpha/dp264.c
index 19562b5967..b6155646ef 100644
--- a/hw/alpha/dp264.c
+++ b/hw/alpha/dp264.c
@@ -182,7 +182,7 @@ static void clipper_init(MachineState *machine)
             long initrd_base;
             int64_t initrd_size;
 
-            initrd_size = get_image_size(initrd_filename);
+            initrd_size = get_image_size(initrd_filename, NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -192,7 +192,7 @@ static void clipper_init(MachineState *machine)
             /* Put the initrd image as high in memory as possible.  */
             initrd_base = (ram_size - initrd_size) & TARGET_PAGE_MASK;
             load_image_targphys(initrd_filename, initrd_base,
-                                ram_size - initrd_base);
+                                ram_size - initrd_base, NULL);
 
             address_space_stq(&address_space_memory, param_offset + 0x100,
                               initrd_base + 0xfffffc0000000000ULL,
diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index cea3eb49ee..c4a9c3ac52 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -611,7 +611,7 @@ void armv7m_load_kernel(ARMCPU *cpu, const char *kernel_filename,
                                  NULL, ELFDATA2LSB, EM_ARM, 1, 0, as);
         if (image_size < 0) {
             image_size = load_image_targphys_as(kernel_filename, mem_base,
-                                                mem_size, as);
+                                                mem_size, as, NULL);
         }
         if (image_size < 0) {
             error_report("Could not load kernel '%s'", kernel_filename);
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index e77d8679d8..b91660208f 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -964,7 +964,8 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
         /* 32-bit ARM */
         entry = info->loader_start + KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys_as(info->kernel_filename, entry,
-                                             ram_end - KERNEL_LOAD_ADDR, as);
+                                             ram_end - KERNEL_LOAD_ADDR, as,
+                                             NULL);
         is_linux = 1;
         if (kernel_size >= 0) {
             image_low_addr = entry;
@@ -1025,7 +1026,7 @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                                                      info->initrd_start,
                                                      ram_end -
                                                      info->initrd_start,
-                                                     as);
+                                                     as, NULL);
             }
             if (initrd_size < 0) {
                 error_report("could not load initrd '%s'",
diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index 466b8b84c0..de56991bac 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -97,7 +97,7 @@ static void digic_load_rom(DigicState *s, hwaddr addr,
             exit(1);
         }
 
-        rom_size = load_image_targphys(fn, addr, max_size);
+        rom_size = load_image_targphys(fn, addr, max_size, NULL);
         if (rom_size < 0 || rom_size > max_size) {
             error_report("Couldn't load rom image '%s'.", filename);
             exit(1);
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index 165c0b741a..ff987467a9 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -235,7 +235,8 @@ static void calxeda_init(MachineState *machine, enum cxmachines machine_id)
     if (machine->firmware != NULL) {
         sysboot_filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, machine->firmware);
         if (sysboot_filename != NULL) {
-            if (load_image_targphys(sysboot_filename, 0xfff88000, 0x8000) < 0) {
+            if (load_image_targphys(sysboot_filename, 0xfff88000, 0x8000,
+                                    NULL) < 0) {
                 error_report("Unable to load %s", machine->firmware);
                 exit(1);
             }
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index 9d9af63d65..fbf3e09c03 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -230,7 +230,7 @@ static void setup_boot(MachineState *machine, ARMCPU *cpu,
                              ? FIRMWARE_ADDR_2 : FIRMWARE_ADDR_3;
         /* load the firmware image (typically kernel.img) */
         r = load_image_targphys(machine->firmware, firmware_addr,
-                                ram_size - firmware_addr);
+                                ram_size - firmware_addr, NULL);
         if (r < 0) {
             error_report("Failed to load firmware from %s", machine->firmware);
             exit(1);
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 35f8d05ea1..60cd375fe7 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -578,7 +578,7 @@ static void vexpress_common_init(MachineState *machine)
             exit(1);
         }
         image_size = load_image_targphys(fn, map[VE_NORFLASH0],
-                                         VEXPRESS_FLASH_SIZE);
+                                         VEXPRESS_FLASH_SIZE, NULL);
         g_free(fn);
         if (image_size < 0) {
             error_report("Could not load ROM image '%s'", machine->firmware);
diff --git a/hw/core/generic-loader.c b/hw/core/generic-loader.c
index e72bbde2a2..6689847c33 100644
--- a/hw/core/generic-loader.c
+++ b/hw/core/generic-loader.c
@@ -148,7 +148,8 @@ static void generic_loader_realize(DeviceState *dev, Error **errp)
 
         if (size < 0 || s->force_raw) {
             /* Default to the maximum size being the machine's ram size */
-            size = load_image_targphys_as(s->file, s->addr, current_machine->ram_size, as);
+            size = load_image_targphys_as(s->file, s->addr,
+                    current_machine->ram_size, as, NULL);
         } else {
             s->addr = entry;
         }
diff --git a/hw/core/guest-loader.c b/hw/core/guest-loader.c
index 3db89d7a2e..59f325ad9c 100644
--- a/hw/core/guest-loader.c
+++ b/hw/core/guest-loader.c
@@ -101,7 +101,7 @@ static void guest_loader_realize(DeviceState *dev, Error **errp)
 
     /* Default to the maximum size being the machine's ram size */
     size = load_image_targphys_as(file, s->addr, current_machine->ram_size,
-                                  NULL);
+                                  NULL, NULL);
     if (size < 0) {
         error_setg(errp, "Cannot load specified image %s", file);
         return;
diff --git a/hw/core/loader.c b/hw/core/loader.c
index c9782d67e8..7aca4989ef 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -48,6 +48,7 @@
 #include "qapi/error.h"
 #include "qapi/qapi-commands-machine.h"
 #include "qapi/type-helpers.h"
+#include "qemu/units.h"
 #include "trace.h"
 #include "hw/hw.h"
 #include "disas/disas.h"
@@ -70,11 +71,11 @@
 static int roms_loaded;
 
 /* return the size or -1 if error */
-int64_t get_image_size(const char *filename)
+int64_t get_image_size(const char *filename, Error **errp)
 {
     int fd;
     int64_t size;
-    fd = qemu_open(filename, O_RDONLY | O_BINARY, NULL);
+    fd = qemu_open(filename, O_RDONLY | O_BINARY, errp);
     if (fd < 0)
         return -1;
     size = lseek(fd, 0, SEEK_END);
@@ -118,18 +119,19 @@ ssize_t read_targphys(const char *name,
 }
 
 ssize_t load_image_targphys(const char *filename,
-                            hwaddr addr, uint64_t max_sz)
+                            hwaddr addr, uint64_t max_sz, Error **errp)
 {
-    return load_image_targphys_as(filename, addr, max_sz, NULL);
+    return load_image_targphys_as(filename, addr, max_sz, NULL, errp);
 }
 
 /* return the size or -1 if error */
 ssize_t load_image_targphys_as(const char *filename,
-                               hwaddr addr, uint64_t max_sz, AddressSpace *as)
+                               hwaddr addr, uint64_t max_sz, AddressSpace *as,
+                               Error **errp)
 {
     ssize_t size;
 
-    size = get_image_size(filename);
+    size = get_image_size(filename, errp);
     if (size < 0 || size > max_sz) {
         return -1;
     }
@@ -150,7 +152,7 @@ ssize_t load_image_mr(const char *filename, MemoryRegion *mr)
         return -1;
     }
 
-    size = get_image_size(filename);
+    size = get_image_size(filename, NULL);
 
     if (size < 0 || size > memory_region_size(mr)) {
         return -1;
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index cddca69b93..ba894f8b1e 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -495,7 +495,7 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
             ram_addr_t initrd_base;
             int64_t initrd_size;
 
-            initrd_size = get_image_size(initrd_filename);
+            initrd_size = get_image_size(initrd_filename, NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -516,7 +516,8 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
                 exit(1);
             }
 
-            load_image_targphys(initrd_filename, initrd_base, initrd_size);
+            load_image_targphys(initrd_filename, initrd_base, initrd_size,
+                                NULL);
             cpu[0]->env.initrd_base = initrd_base;
             cpu[0]->env.initrd_end  = initrd_base + initrd_size;
         }
diff --git a/hw/i386/multiboot.c b/hw/i386/multiboot.c
index 6e6b96bc34..78690781b7 100644
--- a/hw/i386/multiboot.c
+++ b/hw/i386/multiboot.c
@@ -337,7 +337,7 @@ int load_multiboot(X86MachineState *x86ms,
                 *next_space = '\0';
             }
             mb_debug("multiboot loading module: %s", one_file);
-            mb_mod_length = get_image_size(one_file);
+            mb_mod_length = get_image_size(one_file, NULL);
             if (mb_mod_length < 0) {
                 error_report("Failed to open file '%s'", one_file);
                 exit(1);
diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index 7512be64d6..6e78f3d07d 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -924,7 +924,7 @@ void x86_load_linux(X86MachineState *x86ms,
             exit(1);
         }
 
-        dtb_size = get_image_size(dtb_filename);
+        dtb_size = get_image_size(dtb_filename, NULL);
         if (dtb_size <= 0) {
             fprintf(stderr, "qemu: error reading dtb %s: %s\n",
                     dtb_filename, strerror(errno));
@@ -1025,7 +1025,7 @@ void x86_bios_rom_init(X86MachineState *x86ms, const char *default_firmware,
     bios_name = MACHINE(x86ms)->firmware ?: default_firmware;
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
     if (filename) {
-        bios_size = get_image_size(filename);
+        bios_size = get_image_size(filename, NULL);
     } else {
         bios_size = -1;
     }
diff --git a/hw/ipmi/ipmi_bmc_sim.c b/hw/ipmi/ipmi_bmc_sim.c
index 04e1dcd0e7..4604d632b1 100644
--- a/hw/ipmi/ipmi_bmc_sim.c
+++ b/hw/ipmi/ipmi_bmc_sim.c
@@ -2211,7 +2211,7 @@ static void ipmi_fru_init(IPMIFru *fru)
         goto out;
     }
 
-    fsize = get_image_size(fru->filename);
+    fsize = get_image_size(fru->filename, NULL);
     if (fsize > 0) {
         size = QEMU_ALIGN_UP(fsize, fru->areasize);
         fru->data = g_malloc0(size);
diff --git a/hw/loongarch/boot.c b/hw/loongarch/boot.c
index 3dd48cb8aa..8857a04998 100644
--- a/hw/loongarch/boot.c
+++ b/hw/loongarch/boot.c
@@ -328,14 +328,13 @@ static int64_t load_kernel_info(struct loongarch_boot_info *info)
     }
 
     if (info->initrd_filename) {
-        ssize_t initrd_size = get_image_size(info->initrd_filename);
-
+        ssize_t initrd_size = get_image_size(info->initrd_filename, NULL);
         if (initrd_size > 0) {
             initrd_offset = ROUND_UP(kernel_high + 4 * kernel_size, 64 * KiB);
             initrd_offset = alloc_initrd_memory(info, initrd_offset,
                                                 initrd_size);
             initrd_size = load_image_targphys(info->initrd_filename,
-                                              initrd_offset, initrd_size);
+                                              initrd_offset, initrd_size, NULL);
         }
 
         if (initrd_size == -1) {
diff --git a/hw/m68k/an5206.c b/hw/m68k/an5206.c
index d97399b882..ff21d7779e 100644
--- a/hw/m68k/an5206.c
+++ b/hw/m68k/an5206.c
@@ -82,7 +82,7 @@ static void an5206_init(MachineState *machine)
     }
     if (kernel_size < 0) {
         kernel_size = load_image_targphys(kernel_filename, KERNEL_LOAD_ADDR,
-                                          ram_size - KERNEL_LOAD_ADDR);
+                                          ram_size - KERNEL_LOAD_ADDR, NULL);
         entry = KERNEL_LOAD_ADDR;
     }
     if (kernel_size < 0) {
diff --git a/hw/m68k/mcf5208.c b/hw/m68k/mcf5208.c
index 75cc076f78..4a585b231d 100644
--- a/hw/m68k/mcf5208.c
+++ b/hw/m68k/mcf5208.c
@@ -351,7 +351,7 @@ static void mcf5208evb_init(MachineState *machine)
             error_report("Could not find ROM image '%s'", machine->firmware);
             exit(1);
         }
-        if (load_image_targphys(fn, 0x0, ROM_SIZE) < 8) {
+        if (load_image_targphys(fn, 0x0, ROM_SIZE, NULL) < 8) {
             error_report("Could not load ROM image '%s'", machine->firmware);
             exit(1);
         }
@@ -380,7 +380,7 @@ static void mcf5208evb_init(MachineState *machine)
     }
     if (kernel_size < 0) {
         kernel_size = load_image_targphys(kernel_filename, 0x40000000,
-                                          ram_size);
+                                          ram_size, NULL);
         entry = 0x40000000;
     }
     if (kernel_size < 0) {
diff --git a/hw/m68k/next-cube.c b/hw/m68k/next-cube.c
index 957644b2d1..cfb2b319e5 100644
--- a/hw/m68k/next-cube.c
+++ b/hw/m68k/next-cube.c
@@ -1325,7 +1325,7 @@ static void next_cube_init(MachineState *machine)
     memory_region_init_alias(&m->rom2, NULL, "next.rom2", &m->rom, 0x0,
                              0x20000);
     memory_region_add_subregion(sysmem, 0x0, &m->rom2);
-    if (load_image_targphys(bios_name, 0x01000000, 0x20000) < 8) {
+    if (load_image_targphys(bios_name, 0x01000000, 0x20000, NULL) < 8) {
         if (!qtest_enabled()) {
             error_report("Failed to load firmware '%s'.", bios_name);
         }
diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index 793b23f815..b8676feb41 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -629,7 +629,7 @@ static void q800_machine_init(MachineState *machine)
 
         /* load initrd */
         if (initrd_filename) {
-            initrd_size = get_image_size(initrd_filename);
+            initrd_size = get_image_size(initrd_filename, NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -638,7 +638,7 @@ static void q800_machine_init(MachineState *machine)
 
             initrd_base = (ram_size - initrd_size) & TARGET_PAGE_MASK;
             load_image_targphys(initrd_filename, initrd_base,
-                                ram_size - initrd_base);
+                                ram_size - initrd_base, NULL);
             BOOTINFO2(param_ptr, BI_RAMDISK, initrd_base,
                       initrd_size);
         } else {
@@ -668,7 +668,8 @@ static void q800_machine_init(MachineState *machine)
 
         /* Load MacROM binary */
         if (filename) {
-            bios_size = load_image_targphys(filename, MACROM_ADDR, MACROM_SIZE);
+            bios_size = load_image_targphys(filename, MACROM_ADDR, MACROM_SIZE,
+                                            NULL);
             g_free(filename);
         } else {
             bios_size = -1;
diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index 98cfe43c73..3f65d91556 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -283,7 +283,7 @@ static void virt_init(MachineState *machine)
 
         /* load initrd */
         if (initrd_filename) {
-            initrd_size = get_image_size(initrd_filename);
+            initrd_size = get_image_size(initrd_filename, NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -292,7 +292,7 @@ static void virt_init(MachineState *machine)
 
             initrd_base = (ram_size - initrd_size) & TARGET_PAGE_MASK;
             load_image_targphys(initrd_filename, initrd_base,
-                                ram_size - initrd_base);
+                                ram_size - initrd_base, NULL);
             BOOTINFO2(param_ptr, BI_RAMDISK, initrd_base,
                       initrd_size);
         } else {
diff --git a/hw/microblaze/boot.c b/hw/microblaze/boot.c
index 4a9c9df318..ec38107f50 100644
--- a/hw/microblaze/boot.c
+++ b/hw/microblaze/boot.c
@@ -170,7 +170,7 @@ void microblaze_load_kernel(MicroBlazeCPU *cpu, bool is_little_endian,
         /* Not an ELF image nor an u-boot image, try a RAW image.  */
         if (kernel_size < 0) {
             kernel_size = load_image_targphys(kernel_filename, ddr_base,
-                                              ramsize);
+                                              ramsize, NULL);
             boot_info.bootstrap_pc = ddr_base;
             high = (ddr_base + kernel_size + 3) & ~3;
         }
@@ -189,7 +189,8 @@ void microblaze_load_kernel(MicroBlazeCPU *cpu, bool is_little_endian,
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys(initrd_filename,
                                                   boot_info.initrd_start,
-                                                  ramsize - initrd_offset);
+                                                  ramsize - initrd_offset,
+                                                  NULL);
             }
             if (initrd_size < 0) {
                 error_report("could not load initrd '%s'",
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 149a263bd5..0a3a827b5f 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -778,7 +778,7 @@ static void boston_mach_init(MachineState *machine)
 
     if (machine->firmware) {
         fw_size = load_image_targphys(machine->firmware,
-                                      0x1fc00000, 4 * MiB);
+                                      0x1fc00000, 4 * MiB, NULL);
         if (fw_size == -1) {
             error_report("unable to load firmware image '%s'",
                           machine->firmware);
diff --git a/hw/mips/fuloong2e.c b/hw/mips/fuloong2e.c
index 2a8507b8b0..5fe40eee65 100644
--- a/hw/mips/fuloong2e.c
+++ b/hw/mips/fuloong2e.c
@@ -118,7 +118,7 @@ static uint64_t load_kernel(MIPSCPU *cpu)
     initrd_size = 0;
     initrd_offset = 0;
     if (loaderparams.initrd_filename) {
-        initrd_size = get_image_size(loaderparams.initrd_filename);
+        initrd_size = get_image_size(loaderparams.initrd_filename, NULL);
         if (initrd_size > 0) {
             initrd_offset = ROUND_UP(kernel_high, INITRD_PAGE_SIZE);
             if (initrd_offset + initrd_size > loaderparams.ram_size) {
@@ -127,8 +127,9 @@ static uint64_t load_kernel(MIPSCPU *cpu)
                 exit(1);
             }
             initrd_size = load_image_targphys(loaderparams.initrd_filename,
-                                              initrd_offset,
-                                              loaderparams.ram_size - initrd_offset);
+                                         initrd_offset,
+                                         loaderparams.ram_size - initrd_offset,
+                                         NULL);
         }
         if (initrd_size == (target_ulong) -1) {
             error_report("could not load initial ram disk '%s'",
@@ -264,7 +265,7 @@ static void mips_fuloong2e_init(MachineState *machine)
                                   machine->firmware ?: FULOONG_BIOSNAME);
         if (filename) {
             bios_size = load_image_targphys(filename, 0x1fc00000LL,
-                                            BIOS_SIZE);
+                                            BIOS_SIZE, NULL);
             g_free(filename);
         } else {
             bios_size = -1;
diff --git a/hw/mips/jazz.c b/hw/mips/jazz.c
index 7fb0b97a38..1d6bdc0091 100644
--- a/hw/mips/jazz.c
+++ b/hw/mips/jazz.c
@@ -245,7 +245,7 @@ static void mips_jazz_init(MachineState *machine,
                               machine->firmware ?: bios_name);
     if (filename) {
         bios_size = load_image_targphys(filename, 0xfff00000LL,
-                                        MAGNUM_BIOS_SIZE);
+                                        MAGNUM_BIOS_SIZE, NULL);
         g_free(filename);
     } else {
         bios_size = -1;
diff --git a/hw/mips/loongson3_virt.c b/hw/mips/loongson3_virt.c
index 672083dec9..77dc895648 100644
--- a/hw/mips/loongson3_virt.c
+++ b/hw/mips/loongson3_virt.c
@@ -371,7 +371,7 @@ static uint64_t load_kernel(CPUMIPSState *env)
     initrd_size = 0;
     initrd_offset = 0;
     if (loaderparams.initrd_filename) {
-        initrd_size = get_image_size(loaderparams.initrd_filename);
+        initrd_size = get_image_size(loaderparams.initrd_filename, NULL);
         if (initrd_size > 0) {
             initrd_offset = MAX(loader_memmap[LOADER_INITRD].base,
                                 ROUND_UP(kernel_high, INITRD_PAGE_SIZE));
@@ -383,8 +383,9 @@ static uint64_t load_kernel(CPUMIPSState *env)
             }
 
             initrd_size = load_image_targphys(loaderparams.initrd_filename,
-                                              initrd_offset,
-                                              loaderparams.ram_size - initrd_offset);
+                                        initrd_offset,
+                                        loaderparams.ram_size - initrd_offset,
+                                        NULL);
         }
 
         if (initrd_size == (target_ulong) -1) {
@@ -650,7 +651,8 @@ static void mips_loongson3_virt_init(MachineState *machine)
         if (filename) {
             bios_size = load_image_targphys(filename,
                                             virt_memmap[VIRT_BIOS_ROM].base,
-                                            virt_memmap[VIRT_BIOS_ROM].size);
+                                            virt_memmap[VIRT_BIOS_ROM].size,
+                                            NULL);
             g_free(filename);
         } else {
             bios_size = -1;
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 02da629b5a..806e8d5078 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -892,7 +892,7 @@ static uint64_t load_kernel(void)
     initrd_size = 0;
     initrd_offset = 0;
     if (loaderparams.initrd_filename) {
-        initrd_size = get_image_size(loaderparams.initrd_filename);
+        initrd_size = get_image_size(loaderparams.initrd_filename, NULL);
         if (initrd_size > 0) {
             /*
              * The kernel allocates the bootmap memory in the low memory after
@@ -908,8 +908,9 @@ static uint64_t load_kernel(void)
                 exit(1);
             }
             initrd_size = load_image_targphys(loaderparams.initrd_filename,
-                                              initrd_offset,
-                                              loaderparams.ram_size - initrd_offset);
+                                        initrd_offset,
+                                        loaderparams.ram_size - initrd_offset,
+                                        NULL);
         }
         if (initrd_size == (target_ulong) -1) {
             error_report("could not load initial ram disk '%s'",
@@ -1176,7 +1177,7 @@ void mips_malta_init(MachineState *machine)
                                       machine->firmware ?: bios_name);
             if (filename) {
                 bios_size = load_image_targphys(filename, FLASH_ADDRESS,
-                                                BIOS_SIZE);
+                                                BIOS_SIZE, NULL);
                 g_free(filename);
             } else {
                 bios_size = -1;
diff --git a/hw/nubus/nubus-device.c b/hw/nubus/nubus-device.c
index 7797e61c7f..0d4d6c0d87 100644
--- a/hw/nubus/nubus-device.c
+++ b/hw/nubus/nubus-device.c
@@ -68,7 +68,7 @@ static void nubus_device_realize(DeviceState *dev, Error **errp)
             path = g_strdup(nd->romfile);
         }
 
-        size = get_image_size(path);
+        size = get_image_size(path, NULL);
         if (size < 0) {
             error_setg(errp, "failed to find romfile \"%s\"", nd->romfile);
             g_free(path);
diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
index c81efe8138..db6fea071e 100644
--- a/hw/openrisc/boot.c
+++ b/hw/openrisc/boot.c
@@ -44,7 +44,8 @@ hwaddr openrisc_load_kernel(ram_addr_t ram_size,
         if (kernel_size < 0) {
             kernel_size = load_image_targphys(kernel_filename,
                                               KERNEL_LOAD_ADDR,
-                                              ram_size - KERNEL_LOAD_ADDR);
+                                              ram_size - KERNEL_LOAD_ADDR,
+                                              NULL);
             high_addr = KERNEL_LOAD_ADDR + kernel_size;
         }
 
@@ -74,7 +75,7 @@ hwaddr openrisc_load_initrd(void *fdt, const char *filename,
 
     size = load_ramdisk(filename, start, mem_size - start);
     if (size < 0) {
-        size = load_image_targphys(filename, start, mem_size - start);
+        size = load_image_targphys(filename, start, mem_size - start, NULL);
         if (size < 0) {
             error_report("could not load ramdisk '%s'", filename);
             exit(1);
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index acc03fd470..738b0c41ae 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -2557,7 +2557,7 @@ static void pci_add_option_rom(PCIDevice *pdev, bool is_default_rom,
             path = g_strdup(pdev->romfile);
         }
 
-        size = get_image_size(path);
+        size = get_image_size(path, NULL);
         if (size < 0) {
             error_setg(errp, "failed to find romfile \"%s\"", pdev->romfile);
             return;
diff --git a/hw/ppc/amigaone.c b/hw/ppc/amigaone.c
index 47fb016b4a..192474e0ae 100644
--- a/hw/ppc/amigaone.c
+++ b/hw/ppc/amigaone.c
@@ -324,7 +324,7 @@ static void amigaone_init(MachineState *machine)
             error_report("Could not find firmware '%s'", machine->firmware);
             exit(1);
         }
-        sz = load_image_targphys(filename, PROM_ADDR, PROM_SIZE);
+        sz = load_image_targphys(filename, PROM_ADDR, PROM_SIZE, NULL);
         if (sz <= 0 || sz > PROM_SIZE) {
             error_report("Could not load firmware '%s'", filename);
             exit(1);
@@ -413,7 +413,7 @@ static void amigaone_init(MachineState *machine)
         loadaddr = ROUND_UP(loadaddr + 4 * MiB, 4 * KiB);
         loadaddr = MAX(loadaddr, INITRD_MIN_ADDR);
         sz = load_image_targphys(machine->initrd_filename, loadaddr,
-                                 bi->bd_info - loadaddr);
+                                 bi->bd_info - loadaddr, NULL);
         if (sz <= 0) {
             error_report("Could not load initrd '%s'",
                          machine->initrd_filename);
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 3d69428f31..418e1bb2fb 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -1227,7 +1227,7 @@ void ppce500_init(MachineState *machine)
         kernel_base = cur_base;
         kernel_size = load_image_targphys(machine->kernel_filename,
                                           cur_base,
-                                          machine->ram_size - cur_base);
+                                          machine->ram_size - cur_base, NULL);
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'",
                          machine->kernel_filename);
@@ -1241,7 +1241,8 @@ void ppce500_init(MachineState *machine)
     if (machine->initrd_filename) {
         initrd_base = (cur_base + INITRD_LOAD_PAD) & ~INITRD_PAD_MASK;
         initrd_size = load_image_targphys(machine->initrd_filename, initrd_base,
-                                          machine->ram_size - initrd_base);
+                                          machine->ram_size - initrd_base,
+                                          NULL);
 
         if (initrd_size < 0) {
             error_report("could not load initial ram disk '%s'",
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 0b6e096116..004efc6b97 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -188,7 +188,8 @@ static void ppc_core99_init(MachineState *machine)
 
         if (bios_size <= 0) {
             /* or load binary ROM image */
-            bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE);
+            bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE,
+                                            NULL);
         }
         g_free(filename);
     }
@@ -210,7 +211,8 @@ static void ppc_core99_init(MachineState *machine)
         if (kernel_size < 0) {
             kernel_size = load_image_targphys(machine->kernel_filename,
                                               kernel_base,
-                                              machine->ram_size - kernel_base);
+                                              machine->ram_size - kernel_base,
+                                              NULL);
         }
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'",
@@ -222,7 +224,8 @@ static void ppc_core99_init(MachineState *machine)
             initrd_base = TARGET_PAGE_ALIGN(kernel_base + kernel_size + KERNEL_GAP);
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
-                                              machine->ram_size - initrd_base);
+                                              machine->ram_size - initrd_base,
+                                              NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              machine->initrd_filename);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index 40ae936ad8..c7e44d49b0 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -143,7 +143,8 @@ static void ppc_heathrow_init(MachineState *machine)
 
         if (bios_size <= 0) {
             /* or if could not load ELF try loading a binary ROM image */
-            bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE);
+            bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE,
+                                            NULL);
             bios_addr = PROM_BASE;
         }
         g_free(filename);
@@ -166,7 +167,8 @@ static void ppc_heathrow_init(MachineState *machine)
         if (kernel_size < 0) {
             kernel_size = load_image_targphys(machine->kernel_filename,
                                               kernel_base,
-                                              machine->ram_size - kernel_base);
+                                              machine->ram_size - kernel_base,
+                                              NULL);
         }
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'",
@@ -179,7 +181,8 @@ static void ppc_heathrow_init(MachineState *machine)
                                             KERNEL_GAP);
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
-                                              machine->ram_size - initrd_base);
+                                              machine->ram_size - initrd_base,
+                                              NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              machine->initrd_filename);
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 93696ed381..a9e706644c 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -197,7 +197,8 @@ static void pegasos_init(MachineState *machine)
     sz = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                   ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
     if (sz <= 0) {
-        sz = load_image_targphys(filename, pm->vof ? 0 : prom_addr, PROM_SIZE);
+        sz = load_image_targphys(filename, pm->vof ? 0 : prom_addr, PROM_SIZE,
+                                 NULL);
     }
     if (sz <= 0 || sz > PROM_SIZE) {
         error_report("Could not load firmware '%s'", filename);
@@ -301,7 +302,7 @@ static void pegasos_init(MachineState *machine)
         pm->initrd_addr = ROUND_UP(pm->initrd_addr, 4);
         pm->initrd_addr = MAX(pm->initrd_addr, INITRD_MIN_ADDR);
         sz = load_image_targphys(machine->initrd_filename, pm->initrd_addr,
-                                 machine->ram_size - pm->initrd_addr);
+                                 machine->ram_size - pm->initrd_addr, NULL);
         if (sz <= 0) {
             error_report("Could not load initrd '%s'",
                          machine->initrd_filename);
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index f0469cdb8b..1c0dadda87 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1068,7 +1068,8 @@ static void pnv_init(MachineState *machine)
         exit(1);
     }
 
-    fw_size = load_image_targphys(fw_filename, pnv->fw_load_addr, FW_MAX_SIZE);
+    fw_size = load_image_targphys(fw_filename, pnv->fw_load_addr, FW_MAX_SIZE,
+                                  NULL);
     if (fw_size < 0) {
         error_report("Could not load OPAL firmware '%s'", fw_filename);
         exit(1);
@@ -1080,7 +1081,8 @@ static void pnv_init(MachineState *machine)
         long kernel_size;
 
         kernel_size = load_image_targphys(machine->kernel_filename,
-                                          KERNEL_LOAD_ADDR, KERNEL_MAX_SIZE);
+                                          KERNEL_LOAD_ADDR, KERNEL_MAX_SIZE,
+                                          NULL);
         if (kernel_size < 0) {
             error_report("Could not load kernel '%s'",
                          machine->kernel_filename);
@@ -1092,7 +1094,8 @@ static void pnv_init(MachineState *machine)
     if (machine->initrd_filename) {
         pnv->initrd_base = INITRD_LOAD_ADDR;
         pnv->initrd_size = load_image_targphys(machine->initrd_filename,
-                                  pnv->initrd_base, INITRD_MAX_SIZE);
+                                               pnv->initrd_base,
+                                               INITRD_MAX_SIZE, NULL);
         if (pnv->initrd_size < 0) {
             error_report("Could not load initial ram disk '%s'",
                          machine->initrd_filename);
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 6fff0d8afb..7c66912c10 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -242,7 +242,8 @@ static void bamboo_init(MachineState *machine)
     /* Load initrd. */
     if (initrd_filename) {
         initrd_size = load_image_targphys(initrd_filename, RAMDISK_ADDR,
-                                          machine->ram_size - RAMDISK_ADDR);
+                                          machine->ram_size - RAMDISK_ADDR,
+                                          NULL);
 
         if (initrd_size < 0) {
             error_report("could not load ram disk '%s' at %x",
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index c730cb3429..0759e95cb6 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -280,7 +280,7 @@ static void ibm_40p_init(MachineState *machine)
     bios_size = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                          ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
     if (bios_size < 0) {
-        bios_size = load_image_targphys(filename, BIOS_ADDR, BIOS_SIZE);
+        bios_size = load_image_targphys(filename, BIOS_ADDR, BIOS_SIZE, NULL);
     }
     if (bios_size < 0 || bios_size > BIOS_SIZE) {
         error_report("Could not load bios image '%s'", filename);
@@ -379,7 +379,8 @@ static void ibm_40p_init(MachineState *machine)
         kernel_base = KERNEL_LOAD_ADDR;
         kernel_size = load_image_targphys(machine->kernel_filename,
                                           kernel_base,
-                                          machine->ram_size - kernel_base);
+                                          machine->ram_size - kernel_base,
+                                          NULL);
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'",
                          machine->kernel_filename);
@@ -392,7 +393,8 @@ static void ibm_40p_init(MachineState *machine)
             initrd_base = INITRD_LOAD_ADDR;
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
-                                              machine->ram_size - initrd_base);
+                                              machine->ram_size - initrd_base,
+                                              NULL);
             if (initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              machine->initrd_filename);
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index ee31bd8f34..68d3eacbff 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -494,7 +494,8 @@ static void sam460ex_init(MachineState *machine)
     if (machine->initrd_filename) {
         initrd_size = load_image_targphys(machine->initrd_filename,
                                           RAMDISK_ADDR,
-                                          machine->ram_size - RAMDISK_ADDR);
+                                          machine->ram_size - RAMDISK_ADDR,
+                                          NULL);
         if (initrd_size < 0) {
             error_report("could not load ram disk '%s' at %x",
                     machine->initrd_filename, RAMDISK_ADDR);
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 6764730beb..cdf2fdeadc 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2854,7 +2854,7 @@ static void spapr_machine_init(MachineState *machine)
         error_report("Could not find LPAR firmware '%s'", bios_name);
         exit(1);
     }
-    fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE);
+    fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE, NULL);
     if (fw_size <= 0) {
         error_report("Could not load LPAR firmware '%s'", filename);
         exit(1);
@@ -3115,9 +3115,9 @@ static void spapr_machine_init(MachineState *machine)
             spapr->initrd_base = (spapr->kernel_addr + spapr->kernel_size
                                   + 0x1ffff) & ~0xffff;
             spapr->initrd_size = load_image_targphys(initrd_filename,
-                                                     spapr->initrd_base,
-                                                     load_limit
-                                                     - spapr->initrd_base);
+                                                spapr->initrd_base,
+                                                load_limit - spapr->initrd_base,
+                                                NULL);
             if (spapr->initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index c9969ae48a..00d9ab7509 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -253,7 +253,7 @@ static void virtex_init(MachineState *machine)
             /* If we failed loading ELF's try a raw image.  */
             kernel_size = load_image_targphys(kernel_filename,
                                               boot_offset,
-                                              machine->ram_size);
+                                              machine->ram_size, NULL);
             boot_info.bootstrap_pc = boot_offset;
             high = boot_info.bootstrap_pc + kernel_size + 8192;
         }
@@ -264,7 +264,8 @@ static void virtex_init(MachineState *machine)
         if (machine->initrd_filename) {
             initrd_base = high = ROUND_UP(high, 4);
             initrd_size = load_image_targphys(machine->initrd_filename,
-                                              high, machine->ram_size - high);
+                                              high, machine->ram_size - high,
+                                              NULL);
 
             if (initrd_size < 0) {
                 error_report("couldn't load ram disk '%s'",
diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index 828a867be3..f38078c8c2 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -172,7 +172,8 @@ target_ulong riscv_load_firmware(const char *firmware_filename,
 
     firmware_size = load_image_targphys_as(firmware_filename,
                                            *firmware_load_addr,
-                                           current_machine->ram_size, NULL);
+                                           current_machine->ram_size, NULL,
+                                           NULL);
 
     if (firmware_size > 0) {
         return *firmware_load_addr + firmware_size;
@@ -207,7 +208,7 @@ static void riscv_load_initrd(MachineState *machine, RISCVBootInfo *info)
 
     size = load_ramdisk(filename, start, mem_size - start);
     if (size == -1) {
-        size = load_image_targphys(filename, start, mem_size - start);
+        size = load_image_targphys(filename, start, mem_size - start, NULL);
         if (size == -1) {
             error_report("could not load ramdisk '%s'", filename);
             exit(1);
@@ -262,7 +263,7 @@ void riscv_load_kernel(MachineState *machine,
     }
 
     kernel_size = load_image_targphys_as(kernel_filename, kernel_start_addr,
-                                         current_machine->ram_size, NULL);
+                                         current_machine->ram_size, NULL, NULL);
     if (kernel_size > 0) {
         info->kernel_size = kernel_size;
         info->image_low_addr = kernel_start_addr;
diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
index 5b9004e9e1..ed91c63178 100644
--- a/hw/rx/rx-gdbsim.c
+++ b/hw/rx/rx-gdbsim.c
@@ -63,7 +63,7 @@ static void rx_load_image(RXCPU *cpu, const char *filename,
     long kernel_size;
     int i;
 
-    kernel_size = load_image_targphys(filename, start, size);
+    kernel_size = load_image_targphys(filename, start, size, NULL);
     if (kernel_size < 0) {
         fprintf(stderr, "qemu: could not load kernel '%s'\n", filename);
         exit(1);
diff --git a/hw/s390x/ipl.c b/hw/s390x/ipl.c
index 2f082396c7..3843d2a850 100644
--- a/hw/s390x/ipl.c
+++ b/hw/s390x/ipl.c
@@ -169,7 +169,7 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
         } else {
             /* Try to load non-ELF file */
             bios_size = load_image_targphys(bios_filename, ZIPL_IMAGE_START,
-                                            4096);
+                                            4096, NULL);
             ipl->bios_start_addr = ZIPL_IMAGE_START;
         }
         g_free(bios_filename);
@@ -188,7 +188,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
                                &pentry, NULL,
                                NULL, NULL, ELFDATA2MSB, EM_S390, 0, 0);
         if (kernel_size < 0) {
-            kernel_size = load_image_targphys(ipl->kernel, 0, ms->ram_size);
+            kernel_size = load_image_targphys(ipl->kernel, 0, ms->ram_size,
+                                              NULL);
             if (kernel_size < 0) {
                 error_setg(errp, "could not load kernel '%s'", ipl->kernel);
                 return;
@@ -247,7 +248,8 @@ static void s390_ipl_realize(DeviceState *dev, Error **errp)
                 initrd_offset += 0x100000;
             }
             initrd_size = load_image_targphys(ipl->initrd, initrd_offset,
-                                              ms->ram_size - initrd_offset);
+                                              ms->ram_size - initrd_offset,
+                                              NULL);
             if (initrd_size == -1) {
                 error_setg(errp, "could not load initrd '%s'", ipl->initrd);
                 return;
diff --git a/hw/sh4/r2d.c b/hw/sh4/r2d.c
index d68c94e82e..010be6d539 100644
--- a/hw/sh4/r2d.c
+++ b/hw/sh4/r2d.c
@@ -329,8 +329,9 @@ static void r2d_init(MachineState *machine)
         int kernel_size;
 
         kernel_size = load_image_targphys(kernel_filename,
-                                          SDRAM_BASE + LINUX_LOAD_OFFSET,
-                                          INITRD_LOAD_OFFSET - LINUX_LOAD_OFFSET);
+                                        SDRAM_BASE + LINUX_LOAD_OFFSET,
+                                        INITRD_LOAD_OFFSET - LINUX_LOAD_OFFSET,
+                                        NULL);
         if (kernel_size < 0) {
             error_report("qemu: could not load kernel '%s'", kernel_filename);
             exit(1);
@@ -350,7 +351,8 @@ static void r2d_init(MachineState *machine)
 
         initrd_size = load_image_targphys(initrd_filename,
                                           SDRAM_BASE + INITRD_LOAD_OFFSET,
-                                          SDRAM_SIZE - INITRD_LOAD_OFFSET);
+                                          SDRAM_SIZE - INITRD_LOAD_OFFSET,
+                                          NULL);
 
         if (initrd_size < 0) {
             error_report("qemu: could not load initrd '%s'", initrd_filename);
diff --git a/hw/smbios/smbios.c b/hw/smbios/smbios.c
index 13e21a9c43..7558b2ad83 100644
--- a/hw/smbios/smbios.c
+++ b/hw/smbios/smbios.c
@@ -1340,7 +1340,7 @@ void smbios_entry_add(QemuOpts *opts, Error **errp)
             return;
         }
 
-        size = get_image_size(val);
+        size = get_image_size(val, NULL);
         if (size == -1 || size < sizeof(struct smbios_structure_header)) {
             error_setg(errp, "Cannot read SMBIOS file %s", val);
             return;
diff --git a/hw/sparc/leon3.c b/hw/sparc/leon3.c
index 09d2cec488..631c6113b5 100644
--- a/hw/sparc/leon3.c
+++ b/hw/sparc/leon3.c
@@ -349,7 +349,7 @@ static void leon3_generic_hw_init(MachineState *machine)
     filename = qemu_find_file(QEMU_FILE_TYPE_BIOS, bios_name);
 
     if (filename) {
-        bios_size = get_image_size(filename);
+        bios_size = get_image_size(filename, NULL);
     } else {
         bios_size = -1;
     }
@@ -360,7 +360,7 @@ static void leon3_generic_hw_init(MachineState *machine)
     }
 
     if (bios_size > 0) {
-        ret = load_image_targphys(filename, LEON3_PROM_OFFSET, bios_size);
+        ret = load_image_targphys(filename, LEON3_PROM_OFFSET, bios_size, NULL);
         if (ret < 0 || ret > prom_size) {
             error_report("could not load prom '%s'", filename);
             exit(1);
diff --git a/hw/sparc/sun4m.c b/hw/sparc/sun4m.c
index 8ac7e625ef..53d7ae08ae 100644
--- a/hw/sparc/sun4m.c
+++ b/hw/sparc/sun4m.c
@@ -245,7 +245,8 @@ static unsigned long sun4m_load_kernel(const char *kernel_filename,
         if (kernel_size < 0)
             kernel_size = load_image_targphys(kernel_filename,
                                               KERNEL_LOAD_ADDR,
-                                              RAM_size - KERNEL_LOAD_ADDR);
+                                              RAM_size - KERNEL_LOAD_ADDR,
+                                              NULL);
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'", kernel_filename);
             exit(1);
@@ -256,7 +257,8 @@ static unsigned long sun4m_load_kernel(const char *kernel_filename,
         if (initrd_filename) {
             *initrd_size = load_image_targphys(initrd_filename,
                                                INITRD_LOAD_ADDR,
-                                               RAM_size - INITRD_LOAD_ADDR);
+                                               RAM_size - INITRD_LOAD_ADDR,
+                                               NULL);
             if ((int)*initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -700,7 +702,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
                        translate_prom_address, &addr, NULL,
                        NULL, NULL, NULL, ELFDATA2MSB, EM_SPARC, 0, 0);
         if (ret < 0 || ret > PROM_SIZE_MAX) {
-            ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
+            ret = load_image_targphys(filename, addr, PROM_SIZE_MAX, NULL);
         }
         g_free(filename);
     } else {
diff --git a/hw/sparc64/sun4u.c b/hw/sparc64/sun4u.c
index e9f9b0a4cb..82c3e7c855 100644
--- a/hw/sparc64/sun4u.c
+++ b/hw/sparc64/sun4u.c
@@ -182,7 +182,8 @@ static uint64_t sun4u_load_kernel(const char *kernel_filename,
         if (kernel_size < 0) {
             kernel_size = load_image_targphys(kernel_filename,
                                               KERNEL_LOAD_ADDR,
-                                              RAM_size - KERNEL_LOAD_ADDR);
+                                              RAM_size - KERNEL_LOAD_ADDR,
+                                              NULL);
         }
         if (kernel_size < 0) {
             error_report("could not load kernel '%s'", kernel_filename);
@@ -195,7 +196,7 @@ static uint64_t sun4u_load_kernel(const char *kernel_filename,
 
             *initrd_size = load_image_targphys(initrd_filename,
                                                *initrd_addr,
-                                               RAM_size - *initrd_addr);
+                                               RAM_size - *initrd_addr, NULL);
             if ((int)*initrd_size < 0) {
                 error_report("could not load initial ram disk '%s'",
                              initrd_filename);
@@ -437,7 +438,7 @@ static void prom_init(hwaddr addr, const char *bios_name)
         ret = load_elf(filename, NULL, translate_prom_address, &addr,
                        NULL, NULL, NULL, NULL, ELFDATA2MSB, EM_SPARCV9, 0, 0);
         if (ret < 0 || ret > PROM_SIZE_MAX) {
-            ret = load_image_targphys(filename, addr, PROM_SIZE_MAX);
+            ret = load_image_targphys(filename, addr, PROM_SIZE_MAX, NULL);
         }
         g_free(filename);
     } else {
diff --git a/hw/xtensa/xtfpga.c b/hw/xtensa/xtfpga.c
index 55de1a7a07..db3b015549 100644
--- a/hw/xtensa/xtfpga.c
+++ b/hw/xtensa/xtfpga.c
@@ -381,7 +381,8 @@ static void xtfpga_init(const XtfpgaBoardDesc *board, MachineState *machine)
             if (initrd_size < 0) {
                 initrd_size = load_image_targphys(initrd_filename,
                                                   cur_lowmem,
-                                                  lowmem_end - cur_lowmem);
+                                                  lowmem_end - cur_lowmem,
+                                                  NULL);
             }
             if (initrd_size < 0) {
                 error_report("could not load initrd '%s'", initrd_filename);
diff --git a/include/hw/loader.h b/include/hw/loader.h
index c96b5e141c..d035e72748 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -1,6 +1,7 @@
 #ifndef LOADER_H
 #define LOADER_H
 #include "hw/nvram/fw_cfg.h"
+#include "qemu/typedefs.h"
 
 /* loader.c */
 /**
@@ -10,7 +11,7 @@
  * Returns the size of the image file on success, -1 otherwise.
  * On error, errno is also set as appropriate.
  */
-int64_t get_image_size(const char *filename);
+int64_t get_image_size(const char *filename, Error **errp);
 /**
  * load_image_size: load an image file into specified buffer
  * @filename: Path to the image file
@@ -41,7 +42,8 @@ ssize_t load_image_size(const char *filename, void *addr, size_t size);
  * Returns the size of the loaded image on success, -1 otherwise.
  */
 ssize_t load_image_targphys_as(const char *filename,
-                               hwaddr addr, uint64_t max_sz, AddressSpace *as);
+                               hwaddr addr, uint64_t max_sz, AddressSpace *as,
+                               Error **errp);
 
 /**load_targphys_hex_as:
  * @filename: Path to the .hex file
@@ -61,7 +63,7 @@ ssize_t load_targphys_hex_as(const char *filename, hwaddr *entry,
  * an AddressSpace.
  */
 ssize_t load_image_targphys(const char *filename, hwaddr,
-                            uint64_t max_sz);
+                            uint64_t max_sz, Error **errp);
 
 /**
  * load_image_mr: load an image into a memory region
diff --git a/system/device_tree.c b/system/device_tree.c
index aa3fe9516f..7850b90fa7 100644
--- a/system/device_tree.c
+++ b/system/device_tree.c
@@ -83,7 +83,7 @@ void *load_device_tree(const char *filename_path, int *sizep)
     void *fdt = NULL;
 
     *sizep = 0;
-    dt_size = get_image_size(filename_path);
+    dt_size = get_image_size(filename_path, NULL);
     if (dt_size < 0) {
         error_report("Unable to get size of device tree file '%s'",
                      filename_path);

From f62226f7dc445341ec86438638bb0b0f8d4e21ee Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:35:57 +0530
Subject: [PATCH 1665/2396] hw/core/loader: improve error handling in image
 loading functions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add error checking for lseek() failure and provide better error
messages when image loading fails, including filenames and addresses.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-8-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/loader.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index 7aca4989ef..d7c11c18f1 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -79,6 +79,10 @@ int64_t get_image_size(const char *filename, Error **errp)
     if (fd < 0)
         return -1;
     size = lseek(fd, 0, SEEK_END);
+    if (size < 0) {
+        error_setg_errno(errp, errno, "lseek failure: %s", filename);
+        return -1;
+    }
     close(fd);
     return size;
 }
@@ -132,11 +136,20 @@ ssize_t load_image_targphys_as(const char *filename,
     ssize_t size;
 
     size = get_image_size(filename, errp);
-    if (size < 0 || size > max_sz) {
+    if (size < 0) {
         return -1;
     }
+
+    if (size > max_sz) {
+        error_setg(errp, "%s exceeds maximum image size (%s)",
+                   filename, size_to_str(max_sz));
+        return -1;
+    }
+
     if (size > 0) {
         if (rom_add_file_fixed_as(filename, addr, -1, as) < 0) {
+            error_setg(errp, "could not load '%s' at %" HWADDR_PRIx,
+                       filename, addr);
             return -1;
         }
     }

From beded5ebd076d9d72862b8834f215712d94d3473 Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:35:59 +0530
Subject: [PATCH 1666/2396] hw/core/loader: add check for zero size in
 load_image_targphys_as
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently load_image_targphys_as() returns -1 on file open failure or
when max size is exceeded. Add an explicit check for zero-sized files
to catch this error early, since some callers check for size <= 0.

Also, remove the redundant size > 0 check later in the function.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-10-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/loader.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index d7c11c18f1..590c5b02aa 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -140,18 +140,21 @@ ssize_t load_image_targphys_as(const char *filename,
         return -1;
     }
 
+    if (size == 0) {
+        error_setg(errp, "empty file: %s", filename);
+        return -1;
+    }
+
     if (size > max_sz) {
         error_setg(errp, "%s exceeds maximum image size (%s)",
                    filename, size_to_str(max_sz));
         return -1;
     }
 
-    if (size > 0) {
-        if (rom_add_file_fixed_as(filename, addr, -1, as) < 0) {
-            error_setg(errp, "could not load '%s' at %" HWADDR_PRIx,
-                       filename, addr);
-            return -1;
-        }
+    if (rom_add_file_fixed_as(filename, addr, -1, as) < 0) {
+        error_setg(errp, "could not load '%s' at %" HWADDR_PRIx,
+                   filename, addr);
+        return -1;
     }
     return size;
 }

From 1b5eafee86d9bd26efcc09ad82424a85c88206f4 Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:36:01 +0530
Subject: [PATCH 1667/2396] hw/core/loader: Pass errp to
 load_image_targphys_as()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass errp to load_image_targphys_as() in generic-loader and
guest-loader to capture detailed error information from the
loader functions.

Use error_prepend() instead of error_setg() to preserve the
underlying error details while adding context about which image
failed to load.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-12-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/generic-loader.c | 4 ++--
 hw/core/guest-loader.c   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/core/generic-loader.c b/hw/core/generic-loader.c
index 6689847c33..433efb7387 100644
--- a/hw/core/generic-loader.c
+++ b/hw/core/generic-loader.c
@@ -149,13 +149,13 @@ static void generic_loader_realize(DeviceState *dev, Error **errp)
         if (size < 0 || s->force_raw) {
             /* Default to the maximum size being the machine's ram size */
             size = load_image_targphys_as(s->file, s->addr,
-                    current_machine->ram_size, as, NULL);
+                    current_machine->ram_size, as, errp);
         } else {
             s->addr = entry;
         }
 
         if (size < 0) {
-            error_setg(errp, "Cannot load specified image %s", s->file);
+            error_prepend(errp, "Cannot load specified image %s: ", s->file);
             return;
         }
     }
diff --git a/hw/core/guest-loader.c b/hw/core/guest-loader.c
index 59f325ad9c..618455e556 100644
--- a/hw/core/guest-loader.c
+++ b/hw/core/guest-loader.c
@@ -101,9 +101,9 @@ static void guest_loader_realize(DeviceState *dev, Error **errp)
 
     /* Default to the maximum size being the machine's ram size */
     size = load_image_targphys_as(file, s->addr, current_machine->ram_size,
-                                  NULL, NULL);
+                                  NULL, errp);
     if (size < 0) {
-        error_setg(errp, "Cannot load specified image %s", file);
+        error_prepend(errp, "Cannot load specified image %s: ", file);
         return;
     }
 

From cd274e83d50ba52ede62d2a8ea0f0ae7cb1ef469 Mon Sep 17 00:00:00 2001
From: Vishal Chourasia <vishalc@linux.ibm.com>
Date: Fri, 24 Oct 2025 18:36:03 +0530
Subject: [PATCH 1668/2396] hw/ppc: Pass error_fatal to load_image_targphys()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pass error_fatal to load_image_targphys() calls in ppc machine initialization
to capture detailed error information when loading firmware, kernel,
and initrd images.

Passing error_fatal automatically reports detailed error messages and
exits immediately on failure. Eliminating redundant exit(1) calls, as
error_fatal handles termination

The behavior remains functionally identical, but error messages now
come directly from the loader function with more context about the
failure cause.

Reviewed-by: Aditya Gupta <adityag@linux.ibm.com>
Reviewed-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Vishal Chourasia <vishalc@linux.ibm.com>
Message-ID: <20251024130556.1942835-14-vishalc@linux.ibm.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/ppc/amigaone.c      | 13 ++-----------
 hw/ppc/e500.c          | 19 +++----------------
 hw/ppc/mac_newworld.c  | 16 +++-------------
 hw/ppc/mac_oldworld.c  | 16 +++-------------
 hw/ppc/pegasos2.c      |  9 ++-------
 hw/ppc/pnv.c           | 28 +++++-----------------------
 hw/ppc/ppc440_bamboo.c |  8 +-------
 hw/ppc/prep.c          | 17 ++++-------------
 hw/ppc/sam460ex.c      |  7 +------
 hw/ppc/spapr.c         | 13 ++-----------
 hw/ppc/virtex_ml507.c  | 10 ++--------
 11 files changed, 28 insertions(+), 128 deletions(-)

diff --git a/hw/ppc/amigaone.c b/hw/ppc/amigaone.c
index 192474e0ae..74a1fa3b63 100644
--- a/hw/ppc/amigaone.c
+++ b/hw/ppc/amigaone.c
@@ -324,11 +324,7 @@ static void amigaone_init(MachineState *machine)
             error_report("Could not find firmware '%s'", machine->firmware);
             exit(1);
         }
-        sz = load_image_targphys(filename, PROM_ADDR, PROM_SIZE, NULL);
-        if (sz <= 0 || sz > PROM_SIZE) {
-            error_report("Could not load firmware '%s'", filename);
-            exit(1);
-        }
+        sz = load_image_targphys(filename, PROM_ADDR, PROM_SIZE, &error_fatal);
     }
 
     /* Articia S */
@@ -413,12 +409,7 @@ static void amigaone_init(MachineState *machine)
         loadaddr = ROUND_UP(loadaddr + 4 * MiB, 4 * KiB);
         loadaddr = MAX(loadaddr, INITRD_MIN_ADDR);
         sz = load_image_targphys(machine->initrd_filename, loadaddr,
-                                 bi->bd_info - loadaddr, NULL);
-        if (sz <= 0) {
-            error_report("Could not load initrd '%s'",
-                         machine->initrd_filename);
-            exit(1);
-        }
+                                 bi->bd_info - loadaddr, &error_fatal);
         bi->initrd_start = loadaddr;
         bi->initrd_end = loadaddr + sz;
     }
diff --git a/hw/ppc/e500.c b/hw/ppc/e500.c
index 418e1bb2fb..8842f7f6b8 100644
--- a/hw/ppc/e500.c
+++ b/hw/ppc/e500.c
@@ -1226,14 +1226,8 @@ void ppce500_init(MachineState *machine)
     if (machine->kernel_filename && !kernel_as_payload) {
         kernel_base = cur_base;
         kernel_size = load_image_targphys(machine->kernel_filename,
-                                          cur_base,
-                                          machine->ram_size - cur_base, NULL);
-        if (kernel_size < 0) {
-            error_report("could not load kernel '%s'",
-                         machine->kernel_filename);
-            exit(1);
-        }
-
+                                      cur_base, machine->ram_size - cur_base,
+                                      &error_fatal);
         cur_base += kernel_size;
     }
 
@@ -1242,14 +1236,7 @@ void ppce500_init(MachineState *machine)
         initrd_base = (cur_base + INITRD_LOAD_PAD) & ~INITRD_PAD_MASK;
         initrd_size = load_image_targphys(machine->initrd_filename, initrd_base,
                                           machine->ram_size - initrd_base,
-                                          NULL);
-
-        if (initrd_size < 0) {
-            error_report("could not load initial ram disk '%s'",
-                         machine->initrd_filename);
-            exit(1);
-        }
-
+                                          &error_fatal);
         cur_base = initrd_base + initrd_size;
     }
 
diff --git a/hw/ppc/mac_newworld.c b/hw/ppc/mac_newworld.c
index 004efc6b97..951de4bae4 100644
--- a/hw/ppc/mac_newworld.c
+++ b/hw/ppc/mac_newworld.c
@@ -189,7 +189,7 @@ static void ppc_core99_init(MachineState *machine)
         if (bios_size <= 0) {
             /* or load binary ROM image */
             bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE,
-                                            NULL);
+                                            &error_fatal);
         }
         g_free(filename);
     }
@@ -212,12 +212,7 @@ static void ppc_core99_init(MachineState *machine)
             kernel_size = load_image_targphys(machine->kernel_filename,
                                               kernel_base,
                                               machine->ram_size - kernel_base,
-                                              NULL);
-        }
-        if (kernel_size < 0) {
-            error_report("could not load kernel '%s'",
-                         machine->kernel_filename);
-            exit(1);
+                                              &error_fatal);
         }
         /* load initrd */
         if (machine->initrd_filename) {
@@ -225,12 +220,7 @@ static void ppc_core99_init(MachineState *machine)
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
                                               machine->ram_size - initrd_base,
-                                              NULL);
-            if (initrd_size < 0) {
-                error_report("could not load initial ram disk '%s'",
-                             machine->initrd_filename);
-                exit(1);
-            }
+                                              &error_fatal);
             cmdline_base = TARGET_PAGE_ALIGN(initrd_base + initrd_size);
         } else {
             cmdline_base = TARGET_PAGE_ALIGN(kernel_base + kernel_size + KERNEL_GAP);
diff --git a/hw/ppc/mac_oldworld.c b/hw/ppc/mac_oldworld.c
index c7e44d49b0..cd2bb46442 100644
--- a/hw/ppc/mac_oldworld.c
+++ b/hw/ppc/mac_oldworld.c
@@ -144,7 +144,7 @@ static void ppc_heathrow_init(MachineState *machine)
         if (bios_size <= 0) {
             /* or if could not load ELF try loading a binary ROM image */
             bios_size = load_image_targphys(filename, PROM_BASE, PROM_SIZE,
-                                            NULL);
+                                            &error_fatal);
             bios_addr = PROM_BASE;
         }
         g_free(filename);
@@ -168,12 +168,7 @@ static void ppc_heathrow_init(MachineState *machine)
             kernel_size = load_image_targphys(machine->kernel_filename,
                                               kernel_base,
                                               machine->ram_size - kernel_base,
-                                              NULL);
-        }
-        if (kernel_size < 0) {
-            error_report("could not load kernel '%s'",
-                         machine->kernel_filename);
-            exit(1);
+                                              &error_fatal);
         }
         /* load initrd */
         if (machine->initrd_filename) {
@@ -182,12 +177,7 @@ static void ppc_heathrow_init(MachineState *machine)
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
                                               machine->ram_size - initrd_base,
-                                              NULL);
-            if (initrd_size < 0) {
-                error_report("could not load initial ram disk '%s'",
-                             machine->initrd_filename);
-                exit(1);
-            }
+                                              &error_fatal);
             cmdline_base = TARGET_PAGE_ALIGN(initrd_base + initrd_size);
         } else {
             cmdline_base = TARGET_PAGE_ALIGN(kernel_base + kernel_size + KERNEL_GAP);
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index a9e706644c..3c02c53c3a 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -198,7 +198,7 @@ static void pegasos_init(MachineState *machine)
                   ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
     if (sz <= 0) {
         sz = load_image_targphys(filename, pm->vof ? 0 : prom_addr, PROM_SIZE,
-                                 NULL);
+                                 &error_fatal);
     }
     if (sz <= 0 || sz > PROM_SIZE) {
         error_report("Could not load firmware '%s'", filename);
@@ -302,12 +302,7 @@ static void pegasos_init(MachineState *machine)
         pm->initrd_addr = ROUND_UP(pm->initrd_addr, 4);
         pm->initrd_addr = MAX(pm->initrd_addr, INITRD_MIN_ADDR);
         sz = load_image_targphys(machine->initrd_filename, pm->initrd_addr,
-                                 machine->ram_size - pm->initrd_addr, NULL);
-        if (sz <= 0) {
-            error_report("Could not load initrd '%s'",
-                         machine->initrd_filename);
-            exit(1);
-        }
+                            machine->ram_size - pm->initrd_addr, &error_fatal);
         pm->initrd_size = sz;
     }
 
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index 1c0dadda87..895132da91 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -1009,7 +1009,6 @@ static void pnv_init(MachineState *machine)
     PnvMachineClass *pmc = PNV_MACHINE_GET_CLASS(machine);
     int max_smt_threads = pmc->max_smt_threads;
     char *fw_filename;
-    long fw_size;
     uint64_t chip_ram_start = 0;
     int i;
     char *chip_typename;
@@ -1068,26 +1067,14 @@ static void pnv_init(MachineState *machine)
         exit(1);
     }
 
-    fw_size = load_image_targphys(fw_filename, pnv->fw_load_addr, FW_MAX_SIZE,
-                                  NULL);
-    if (fw_size < 0) {
-        error_report("Could not load OPAL firmware '%s'", fw_filename);
-        exit(1);
-    }
+    load_image_targphys(fw_filename, pnv->fw_load_addr, FW_MAX_SIZE,
+                        &error_fatal);
     g_free(fw_filename);
 
     /* load kernel */
     if (machine->kernel_filename) {
-        long kernel_size;
-
-        kernel_size = load_image_targphys(machine->kernel_filename,
-                                          KERNEL_LOAD_ADDR, KERNEL_MAX_SIZE,
-                                          NULL);
-        if (kernel_size < 0) {
-            error_report("Could not load kernel '%s'",
-                         machine->kernel_filename);
-            exit(1);
-        }
+        load_image_targphys(machine->kernel_filename,
+                            KERNEL_LOAD_ADDR, KERNEL_MAX_SIZE, &error_fatal);
     }
 
     /* load initrd */
@@ -1095,12 +1082,7 @@ static void pnv_init(MachineState *machine)
         pnv->initrd_base = INITRD_LOAD_ADDR;
         pnv->initrd_size = load_image_targphys(machine->initrd_filename,
                                                pnv->initrd_base,
-                                               INITRD_MAX_SIZE, NULL);
-        if (pnv->initrd_size < 0) {
-            error_report("Could not load initial ram disk '%s'",
-                         machine->initrd_filename);
-            exit(1);
-        }
+                                               INITRD_MAX_SIZE, &error_fatal);
     }
 
     /* load dtb if passed */
diff --git a/hw/ppc/ppc440_bamboo.c b/hw/ppc/ppc440_bamboo.c
index 7c66912c10..7e739a2114 100644
--- a/hw/ppc/ppc440_bamboo.c
+++ b/hw/ppc/ppc440_bamboo.c
@@ -243,13 +243,7 @@ static void bamboo_init(MachineState *machine)
     if (initrd_filename) {
         initrd_size = load_image_targphys(initrd_filename, RAMDISK_ADDR,
                                           machine->ram_size - RAMDISK_ADDR,
-                                          NULL);
-
-        if (initrd_size < 0) {
-            error_report("could not load ram disk '%s' at %x",
-                         initrd_filename, RAMDISK_ADDR);
-            exit(1);
-        }
+                                          &error_fatal);
     }
 
     /* If we're loading a kernel directly, we must load the device tree too. */
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index 0759e95cb6..c2fe16e985 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -280,7 +280,8 @@ static void ibm_40p_init(MachineState *machine)
     bios_size = load_elf(filename, NULL, NULL, NULL, NULL, NULL, NULL, NULL,
                          ELFDATA2MSB, PPC_ELF_MACHINE, 0, 0);
     if (bios_size < 0) {
-        bios_size = load_image_targphys(filename, BIOS_ADDR, BIOS_SIZE, NULL);
+        bios_size = load_image_targphys(filename, BIOS_ADDR, BIOS_SIZE,
+                                        &error_fatal);
     }
     if (bios_size < 0 || bios_size > BIOS_SIZE) {
         error_report("Could not load bios image '%s'", filename);
@@ -380,12 +381,7 @@ static void ibm_40p_init(MachineState *machine)
         kernel_size = load_image_targphys(machine->kernel_filename,
                                           kernel_base,
                                           machine->ram_size - kernel_base,
-                                          NULL);
-        if (kernel_size < 0) {
-            error_report("could not load kernel '%s'",
-                         machine->kernel_filename);
-            exit(1);
-        }
+                                          &error_fatal);
         fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_ADDR, kernel_base);
         fw_cfg_add_i32(fw_cfg, FW_CFG_KERNEL_SIZE, kernel_size);
         /* load initrd */
@@ -394,12 +390,7 @@ static void ibm_40p_init(MachineState *machine)
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               initrd_base,
                                               machine->ram_size - initrd_base,
-                                              NULL);
-            if (initrd_size < 0) {
-                error_report("could not load initial ram disk '%s'",
-                             machine->initrd_filename);
-                exit(1);
-            }
+                                              &error_fatal);
             fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_ADDR, initrd_base);
             fw_cfg_add_i32(fw_cfg, FW_CFG_INITRD_SIZE, initrd_size);
         }
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 68d3eacbff..258d43f8d2 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -495,12 +495,7 @@ static void sam460ex_init(MachineState *machine)
         initrd_size = load_image_targphys(machine->initrd_filename,
                                           RAMDISK_ADDR,
                                           machine->ram_size - RAMDISK_ADDR,
-                                          NULL);
-        if (initrd_size < 0) {
-            error_report("could not load ram disk '%s' at %x",
-                    machine->initrd_filename, RAMDISK_ADDR);
-            exit(1);
-        }
+                                          &error_fatal);
     }
 
     /* If we're loading a kernel directly, we must load the device tree too. */
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index cdf2fdeadc..99b843ba2f 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -2854,11 +2854,7 @@ static void spapr_machine_init(MachineState *machine)
         error_report("Could not find LPAR firmware '%s'", bios_name);
         exit(1);
     }
-    fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE, NULL);
-    if (fw_size <= 0) {
-        error_report("Could not load LPAR firmware '%s'", filename);
-        exit(1);
-    }
+    fw_size = load_image_targphys(filename, 0, FW_MAX_SIZE, &error_fatal);
 
     /*
      * if Secure VM (PEF) support is configured, then initialize it
@@ -3117,12 +3113,7 @@ static void spapr_machine_init(MachineState *machine)
             spapr->initrd_size = load_image_targphys(initrd_filename,
                                                 spapr->initrd_base,
                                                 load_limit - spapr->initrd_base,
-                                                NULL);
-            if (spapr->initrd_size < 0) {
-                error_report("could not load initial ram disk '%s'",
-                             initrd_filename);
-                exit(1);
-            }
+                                                &error_fatal);
         }
     }
 
diff --git a/hw/ppc/virtex_ml507.c b/hw/ppc/virtex_ml507.c
index 00d9ab7509..43a6d505a8 100644
--- a/hw/ppc/virtex_ml507.c
+++ b/hw/ppc/virtex_ml507.c
@@ -253,7 +253,7 @@ static void virtex_init(MachineState *machine)
             /* If we failed loading ELF's try a raw image.  */
             kernel_size = load_image_targphys(kernel_filename,
                                               boot_offset,
-                                              machine->ram_size, NULL);
+                                              machine->ram_size, &error_fatal);
             boot_info.bootstrap_pc = boot_offset;
             high = boot_info.bootstrap_pc + kernel_size + 8192;
         }
@@ -265,13 +265,7 @@ static void virtex_init(MachineState *machine)
             initrd_base = high = ROUND_UP(high, 4);
             initrd_size = load_image_targphys(machine->initrd_filename,
                                               high, machine->ram_size - high,
-                                              NULL);
-
-            if (initrd_size < 0) {
-                error_report("couldn't load ram disk '%s'",
-                             machine->initrd_filename);
-                exit(1);
-            }
+                                              &error_fatal);
             high = ROUND_UP(high + initrd_size, 4);
         }
 

From 575264e9083bd839ce6ce265fd606c44135799c3 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Mon, 27 Oct 2025 10:05:38 +0900
Subject: [PATCH 1669/2396] nw/nvram/ds1225y: Fix nvram MemoryRegion owner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

s points to the MemoryRegion itself. dev points to DS1225Y, the real
owner.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027-ds1225y-v1-1-406888eb495f@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/nvram/ds1225y.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/nvram/ds1225y.c b/hw/nvram/ds1225y.c
index dbfd0d2e53..0945e36652 100644
--- a/hw/nvram/ds1225y.c
+++ b/hw/nvram/ds1225y.c
@@ -126,7 +126,7 @@ static void nvram_sysbus_realize(DeviceState *dev, Error **errp)
 
     s->contents = g_malloc0(s->chip_size);
 
-    memory_region_init_io(&s->iomem, OBJECT(s), &nvram_ops, s,
+    memory_region_init_io(&s->iomem, OBJECT(dev), &nvram_ops, s,
                           "nvram", s->chip_size);
     sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->iomem);
 

From 3114ec3e69a60db602205b3fe69e62ebccfbf0ad Mon Sep 17 00:00:00 2001
From: CLEMENT MATHIEU--DRIF <clement.mathieu--drif@eviden.com>
Date: Mon, 27 Oct 2025 07:52:57 +0000
Subject: [PATCH 1670/2396] hw/i386/intel_iommu: Remove an unused state field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

dma_translation has been moved to x86-iommu and is no longer referenced.

Fixes: b6b49c2cd6c2 (intel-iommu: Move dma_translation to x86-iommu)
Signed-off-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027075232.95262-1-clement.mathieu--drif@eviden.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/i386/intel_iommu.h | 1 -
 1 file changed, 1 deletion(-)

diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
index 47730ac3c7..b2f1ef9595 100644
--- a/include/hw/i386/intel_iommu.h
+++ b/include/hw/i386/intel_iommu.h
@@ -307,7 +307,6 @@ struct IntelIOMMUState {
     bool buggy_eim;                 /* Force buggy EIM unless eim=off */
     uint8_t aw_bits;                /* Host/IOVA address width (in bits) */
     bool dma_drain;                 /* Whether DMA r/w draining enabled */
-    bool dma_translation;           /* Whether DMA translation supported */
     bool pasid;                     /* Whether to support PASID */
     bool fs1gp;                     /* First Stage 1-GByte Page Support */
 

From f64cc60cfbff70edc7ee850f29f2e82c21a19ba3 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 27 Oct 2025 13:35:10 +0100
Subject: [PATCH 1671/2396] hw/riscv: Use generic hwaddr for firmware addresses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Anton Johansson <anjo@rev.ng>
Message-ID: <20251027-feature-single-binary-hw-v1-v2-1-44478d589ae9@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[PMD: Do not update riscv_load_kernel()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/riscv/boot.c            | 20 ++++++++++----------
 hw/riscv/microchip_pfsoc.c |  2 +-
 hw/riscv/sifive_u.c        |  2 +-
 hw/riscv/spike.c           |  4 ++--
 hw/riscv/virt.c            |  2 +-
 include/hw/riscv/boot.h    | 18 +++++++++---------
 6 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index f38078c8c2..9510fca939 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -74,8 +74,8 @@ void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts)
     info->is_32bit = riscv_is_32bit(harts);
 }
 
-target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
-                                          target_ulong firmware_end_addr) {
+hwaddr riscv_calc_kernel_start_addr(RISCVBootInfo *info,
+                                    hwaddr firmware_end_addr) {
     if (info->is_32bit) {
         return QEMU_ALIGN_UP(firmware_end_addr, 4 * MiB);
     } else {
@@ -133,13 +133,13 @@ char *riscv_find_firmware(const char *firmware_filename,
     return filename;
 }
 
-target_ulong riscv_find_and_load_firmware(MachineState *machine,
-                                          const char *default_machine_firmware,
-                                          hwaddr *firmware_load_addr,
-                                          symbol_fn_t sym_cb)
+hwaddr riscv_find_and_load_firmware(MachineState *machine,
+                                    const char *default_machine_firmware,
+                                    hwaddr *firmware_load_addr,
+                                    symbol_fn_t sym_cb)
 {
     char *firmware_filename;
-    target_ulong firmware_end_addr = *firmware_load_addr;
+    hwaddr firmware_end_addr = *firmware_load_addr;
 
     firmware_filename = riscv_find_firmware(machine->firmware,
                                             default_machine_firmware);
@@ -154,9 +154,9 @@ target_ulong riscv_find_and_load_firmware(MachineState *machine,
     return firmware_end_addr;
 }
 
-target_ulong riscv_load_firmware(const char *firmware_filename,
-                                 hwaddr *firmware_load_addr,
-                                 symbol_fn_t sym_cb)
+hwaddr riscv_load_firmware(const char *firmware_filename,
+                           hwaddr *firmware_load_addr,
+                           symbol_fn_t sym_cb)
 {
     uint64_t firmware_entry, firmware_end;
     ssize_t firmware_size;
diff --git a/hw/riscv/microchip_pfsoc.c b/hw/riscv/microchip_pfsoc.c
index 4c939d8e96..a17f62cd08 100644
--- a/hw/riscv/microchip_pfsoc.c
+++ b/hw/riscv/microchip_pfsoc.c
@@ -521,7 +521,7 @@ static void microchip_icicle_kit_machine_init(MachineState *machine)
     uint64_t mem_low_size, mem_high_size;
     hwaddr firmware_load_addr;
     const char *firmware_name;
-    target_ulong firmware_end_addr, kernel_start_addr;
+    hwaddr firmware_end_addr, kernel_start_addr;
     uint64_t kernel_entry;
     uint64_t fdt_load_addr;
     DriveInfo *dinfo = drive_get(IF_SD, 0, 0);
diff --git a/hw/riscv/sifive_u.c b/hw/riscv/sifive_u.c
index 3e1ed209ca..a7492aa27a 100644
--- a/hw/riscv/sifive_u.c
+++ b/hw/riscv/sifive_u.c
@@ -515,7 +515,7 @@ static void sifive_u_machine_init(MachineState *machine)
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *flash0 = g_new(MemoryRegion, 1);
     hwaddr start_addr = memmap[SIFIVE_U_DEV_DRAM].base;
-    target_ulong firmware_end_addr, kernel_start_addr;
+    hwaddr firmware_end_addr, kernel_start_addr;
     const char *firmware_name;
     uint32_t start_addr_hi32 = 0x00000000;
     uint32_t fdt_load_addr_hi32 = 0x00000000;
diff --git a/hw/riscv/spike.c b/hw/riscv/spike.c
index 641aae8c01..b0bab3fe00 100644
--- a/hw/riscv/spike.c
+++ b/hw/riscv/spike.c
@@ -197,9 +197,9 @@ static void spike_board_init(MachineState *machine)
     SpikeState *s = SPIKE_MACHINE(machine);
     MemoryRegion *system_memory = get_system_memory();
     MemoryRegion *mask_rom = g_new(MemoryRegion, 1);
-    target_ulong firmware_end_addr = memmap[SPIKE_DRAM].base;
+    hwaddr firmware_end_addr = memmap[SPIKE_DRAM].base;
     hwaddr firmware_load_addr = memmap[SPIKE_DRAM].base;
-    target_ulong kernel_start_addr;
+    hwaddr kernel_start_addr;
     char *firmware_name;
     uint64_t fdt_load_addr;
     uint64_t kernel_entry;
diff --git a/hw/riscv/virt.c b/hw/riscv/virt.c
index 47e573f85a..17909206c7 100644
--- a/hw/riscv/virt.c
+++ b/hw/riscv/virt.c
@@ -1434,7 +1434,7 @@ static void virt_machine_done(Notifier *notifier, void *data)
                                      machine_done);
     MachineState *machine = MACHINE(s);
     hwaddr start_addr = s->memmap[VIRT_DRAM].base;
-    target_ulong firmware_end_addr, kernel_start_addr;
+    hwaddr firmware_end_addr, kernel_start_addr;
     const char *firmware_name = riscv_default_firmware_name(&s->soc[0]);
     uint64_t fdt_load_addr;
     uint64_t kernel_entry = 0;
diff --git a/include/hw/riscv/boot.h b/include/hw/riscv/boot.h
index 7d59b2e6c6..51b0e13bd3 100644
--- a/include/hw/riscv/boot.h
+++ b/include/hw/riscv/boot.h
@@ -43,18 +43,18 @@ bool riscv_is_32bit(RISCVHartArrayState *harts);
 char *riscv_plic_hart_config_string(int hart_count);
 
 void riscv_boot_info_init(RISCVBootInfo *info, RISCVHartArrayState *harts);
-target_ulong riscv_calc_kernel_start_addr(RISCVBootInfo *info,
-                                          target_ulong firmware_end_addr);
-target_ulong riscv_find_and_load_firmware(MachineState *machine,
-                                          const char *default_machine_firmware,
-                                          hwaddr *firmware_load_addr,
-                                          symbol_fn_t sym_cb);
+hwaddr riscv_calc_kernel_start_addr(RISCVBootInfo *info,
+                                    hwaddr firmware_end_addr);
+hwaddr riscv_find_and_load_firmware(MachineState *machine,
+                                    const char *default_machine_firmware,
+                                    hwaddr *firmware_load_addr,
+                                    symbol_fn_t sym_cb);
 const char *riscv_default_firmware_name(RISCVHartArrayState *harts);
 char *riscv_find_firmware(const char *firmware_filename,
                           const char *default_machine_firmware);
-target_ulong riscv_load_firmware(const char *firmware_filename,
-                                 hwaddr *firmware_load_addr,
-                                 symbol_fn_t sym_cb);
+hwaddr riscv_load_firmware(const char *firmware_filename,
+                           hwaddr *firmware_load_addr,
+                           symbol_fn_t sym_cb);
 void riscv_load_kernel(MachineState *machine,
                        RISCVBootInfo *info,
                        target_ulong kernel_start_addr,

From 7dbe2d7df094aa8af2d8fcdf08fccce70b1ca5bc Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 27 Oct 2025 13:35:12 +0100
Subject: [PATCH 1672/2396] hw/riscv: Widen OpenSBI dynamic info struct
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since fw_dynamic_info is only used for non 32 bit targets, target_long
is int64_t anyway.  Rename struct to fw_dynamic_info64 and use int64_t.

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027-feature-single-binary-hw-v1-v2-3-44478d589ae9@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/riscv/boot.c                 | 22 ++++++++++++----------
 include/hw/riscv/boot_opensbi.h | 14 +++++++-------
 2 files changed, 19 insertions(+), 17 deletions(-)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index 9510fca939..75f34287ff 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -388,7 +388,8 @@ void riscv_rom_copy_firmware_info(MachineState *machine,
                                   uint64_t kernel_entry)
 {
     struct fw_dynamic_info32 dinfo32;
-    struct fw_dynamic_info dinfo;
+    struct fw_dynamic_info64 dinfo64;
+    void *dinfo_ptr = NULL;
     size_t dinfo_len;
 
     if (riscv_is_32bit(harts)) {
@@ -398,15 +399,17 @@ void riscv_rom_copy_firmware_info(MachineState *machine,
         dinfo32.next_addr = cpu_to_le32(kernel_entry);
         dinfo32.options = 0;
         dinfo32.boot_hart = 0;
+        dinfo_ptr = &dinfo32;
         dinfo_len = sizeof(dinfo32);
     } else {
-        dinfo.magic = cpu_to_le64(FW_DYNAMIC_INFO_MAGIC_VALUE);
-        dinfo.version = cpu_to_le64(FW_DYNAMIC_INFO_VERSION);
-        dinfo.next_mode = cpu_to_le64(FW_DYNAMIC_INFO_NEXT_MODE_S);
-        dinfo.next_addr = cpu_to_le64(kernel_entry);
-        dinfo.options = 0;
-        dinfo.boot_hart = 0;
-        dinfo_len = sizeof(dinfo);
+        dinfo64.magic = cpu_to_le64(FW_DYNAMIC_INFO_MAGIC_VALUE);
+        dinfo64.version = cpu_to_le64(FW_DYNAMIC_INFO_VERSION);
+        dinfo64.next_mode = cpu_to_le64(FW_DYNAMIC_INFO_NEXT_MODE_S);
+        dinfo64.next_addr = cpu_to_le64(kernel_entry);
+        dinfo64.options = 0;
+        dinfo64.boot_hart = 0;
+        dinfo_ptr = &dinfo64;
+        dinfo_len = sizeof(dinfo64);
     }
 
     /**
@@ -420,8 +423,7 @@ void riscv_rom_copy_firmware_info(MachineState *machine,
     }
 
     rom_add_blob_fixed_as("mrom.finfo",
-                           riscv_is_32bit(harts) ?
-                           (void *)&dinfo32 : (void *)&dinfo,
+                           dinfo_ptr,
                            dinfo_len,
                            rom_base + reset_vec_size,
                            &address_space_memory);
diff --git a/include/hw/riscv/boot_opensbi.h b/include/hw/riscv/boot_opensbi.h
index 18664a174b..ab9999be3f 100644
--- a/include/hw/riscv/boot_opensbi.h
+++ b/include/hw/riscv/boot_opensbi.h
@@ -29,17 +29,17 @@ enum sbi_scratch_options {
 };
 
 /** Representation dynamic info passed by previous booting stage */
-struct fw_dynamic_info {
+struct fw_dynamic_info64 {
     /** Info magic */
-    target_long magic;
+    int64_t magic;
     /** Info version */
-    target_long version;
+    int64_t version;
     /** Next booting stage address */
-    target_long next_addr;
+    int64_t next_addr;
     /** Next booting stage mode */
-    target_long next_mode;
+    int64_t next_mode;
     /** Options for OpenSBI library */
-    target_long options;
+    int64_t options;
     /**
      * Preferred boot HART id
      *
@@ -55,7 +55,7 @@ struct fw_dynamic_info {
      * stage can set it to -1UL which will force the FW_DYNAMIC firmware
      * to use the relocation lottery mechanism.
      */
-    target_long boot_hart;
+    int64_t boot_hart;
 };
 
 /** Representation dynamic info passed by previous booting stage */

From 63f0f567afb38a7f6fa41f11776605eba00e9e24 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 29 Aug 2023 10:37:12 +0200
Subject: [PATCH 1673/2396] scripts: clean up meson-buildoptions.py

Fix a few issues reported by flake8 and pylint, mostly parameter names
that shadow globals.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/meson-buildoptions.py | 51 +++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 23 deletions(-)

diff --git a/scripts/meson-buildoptions.py b/scripts/meson-buildoptions.py
index a3e22471b2..e636d258e8 100644
--- a/scripts/meson-buildoptions.py
+++ b/scripts/meson-buildoptions.py
@@ -111,13 +111,13 @@ def help_line(left, opt, indent, long):
     right = f'{opt["description"]}'
     if long:
         value = get_help(opt)
-        if value != "auto" and value != "":
+        if value not in {"", "auto"}:
             right += f" [{value}]"
     if "choices" in opt and long:
         choices = "/".join(sorted(opt["choices"]))
         right += f" (choices: {choices})"
-    for x in wrap("  " + left, right, indent):
-        sh_print(x)
+    for line in wrap("  " + left, right, indent):
+        sh_print(line)
 
 
 # Return whether the option (a dictionary) can be used with
@@ -144,18 +144,18 @@ def require_arg(opt):
     return not ({"enabled", "disabled"}.intersection(opt["choices"]))
 
 
-def filter_options(json):
-    if ":" in json["name"]:
+def filter_options(opt):
+    if ":" in opt["name"]:
         return False
-    if json["section"] == "user":
-        return json["name"] not in SKIP_OPTIONS
+    if opt["section"] == "user":
+        return opt["name"] not in SKIP_OPTIONS
     else:
-        return json["name"] in BUILTIN_OPTIONS
+        return opt["name"] in BUILTIN_OPTIONS
 
 
-def load_options(json):
-    json = [x for x in json if filter_options(x)]
-    return sorted(json, key=lambda x: x["name"])
+def load_options(opts):
+    opts = [opt for opt in opts if filter_options(opt)]
+    return sorted(opts, key=lambda opt: opt["name"])
 
 
 def cli_option(opt):
@@ -223,7 +223,7 @@ def print_parse(options):
         key = cli_option(opt)
         name = opt["name"]
         if require_arg(opt):
-            if opt["type"] == "array" and not "choices" in opt:
+            if opt["type"] == "array" and "choices" not in opt:
                 print(f'    --{key}=*) quote_sh "-D{name}=$(meson_option_build_array $2)" ;;')
             else:
                 print(f'    --{key}=*) quote_sh "-D{name}=$2" ;;')
@@ -241,14 +241,19 @@ def print_parse(options):
     print("  esac")
     print("}")
 
-json_data = sys.stdin.read()
-try:
-    options = load_options(json.loads(json_data))
-except:
-    print("Failure in scripts/meson-buildoptions.py parsing stdin as json",
-          file=sys.stderr)
-    print(json_data, file=sys.stderr)
-    sys.exit(1)
-print("# This file is generated by meson-buildoptions.py, do not edit!")
-print_help(options)
-print_parse(options)
+
+def main():
+    json_data = sys.stdin.read()
+    try:
+        options = load_options(json.loads(json_data))
+    except:
+        print("Failure in scripts/meson-buildoptions.py parsing stdin as json",
+              file=sys.stderr)
+        print(json_data, file=sys.stderr)
+        sys.exit(1)
+    print("# This file is generated by meson-buildoptions.py, do not edit!")
+    print_help(options)
+    print_parse(options)
+
+
+sys.exit(main())

From 639a29422754f62b4bfd26cff936b3c981758010 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Tue, 14 Oct 2025 17:42:14 +0800
Subject: [PATCH 1674/2396] i386/kvm/cpu: Init SMM cpu address space for
 hotplugged CPUs

The SMM cpu address space is initialized in a machine_init_done
notifier. It only runs once when QEMU starts up, which leads to the
issue that for any hotplugged CPU after the machine is ready, SMM
cpu address space doesn't get initialized.

Fix the issue by initializing the SMM cpu address space in x86_cpu_plug()
when the cpu is hotplugged.

Fixes: 591f817d819f ("target/i386: Define enum X86ASIdx for x86's address spaces")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Closes: https://lore.kernel.org/qemu-devel/CAFEAcA_3kkZ+a5rTZGmK8W5K6J7qpYD31HkvjBnxWr-fGT2h_A@mail.gmail.com/
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Link: https://lore.kernel.org/r/20251014094216.164306-2-xiaoyao.li@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/x86-common.c       | 11 +++++++++++
 target/i386/kvm/kvm.c      |  6 ++++++
 target/i386/kvm/kvm_i386.h |  1 +
 3 files changed, 18 insertions(+)

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index 7512be64d6..5716191fff 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -183,6 +183,17 @@ void x86_cpu_plug(HotplugHandler *hotplug_dev,
         fw_cfg_modify_i16(x86ms->fw_cfg, FW_CFG_NB_CPUS, x86ms->boot_cpus);
     }
 
+    /*
+     * Non-hotplugged CPUs get their SMM cpu address space initialized in
+     * machine init done notifier: register_smram_listener().
+     *
+     * We need initialize the SMM cpu address space for the hotplugged CPU
+     * specifically.
+     */
+    if (kvm_enabled() && dev->hotplugged && x86_machine_is_smm_enabled(x86ms)) {
+        kvm_smm_cpu_address_space_init(cpu);
+    }
+
     found_cpu = x86_find_cpu_slot(MACHINE(x86ms), cpu->apic_id, NULL);
     found_cpu->cpu = CPU(dev);
 out:
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index f7a6ef650a..4dea1ed8f0 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -2748,6 +2748,12 @@ static void register_smram_listener(Notifier *n, void *unused)
     }
 }
 
+/* It should only be called in cpu's hotplug callback */
+void kvm_smm_cpu_address_space_init(X86CPU *cpu)
+{
+    cpu_address_space_init(CPU(cpu), X86ASIdx_SMM, "cpu-smm", &smram_as_root);
+}
+
 static void *kvm_msr_energy_thread(void *data)
 {
     KVMState *s = data;
diff --git a/target/i386/kvm/kvm_i386.h b/target/i386/kvm/kvm_i386.h
index 5c908fdd6a..2b653442f4 100644
--- a/target/i386/kvm/kvm_i386.h
+++ b/target/i386/kvm/kvm_i386.h
@@ -74,6 +74,7 @@ uint32_t kvm_x86_build_cpuid(CPUX86State *env, struct kvm_cpuid_entry2 *entries,
                              uint32_t cpuid_i);
 #endif /* CONFIG_KVM */
 
+void kvm_smm_cpu_address_space_init(X86CPU *cpu);
 void kvm_pc_setup_irq_routing(bool pci_enabled);
 
 #endif

From 55d98e3edeeb17dd8445db27605d2b34f4c3ba85 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Thu, 16 Oct 2025 15:34:41 +0900
Subject: [PATCH 1675/2396] rcu: Unify force quiescent state

Borrow the concept of force quiescent state from Linux to ensure readers
remain fast during normal operation and to avoid stalls.

Background
==========

The previous implementation had four steps to begin reclamation.

1. call_rcu_thread() would wait for the first callback.

2. call_rcu_thread() would periodically poll until a decent number of
   callbacks piled up or it timed out.

3. synchronize_rcu() would statr a grace period (GP).

4. wait_for_readers() would wait for the GP to end. It would also
   trigger the force_rcu notifier to break busy loops in a read-side
   critical section if drain_call_rcu() had been called.

Problem
=======

The separation of waiting logic across these steps led to suboptimal
behavior:

The GP was delayed until call_rcu_thread() stops polling.

force_rcu was not consistently triggered when call_rcu_thread() detected
a high number of pending callbacks or a timeout. This inconsistency
sometimes led to stalls, as reported in a virtio-gpu issue where memory
unmapping was blocked[1].

wait_for_readers() imposed unnecessary overhead in non-urgent cases by
unconditionally executing qatomic_set(&index->waiting, true) and
qemu_event_reset(&rcu_gp_event), which are necessary only for expedited
synchronization.

Solution
========

Move the polling in call_rcu_thread() to wait_for_readers() to prevent
the delay of the GP. Additionally, reorganize wait_for_readers() to
distinguish between two states:

Normal State: it relies exclusively on periodic polling to detect
the end of the GP and maintains the read-side fast path.

Force Quiescent State: Whenever expediting synchronization, it always
triggers force_rcu and executes both qatomic_set(&index->waiting, true)
and qemu_event_reset(&rcu_gp_event). This avoids stalls while confining
the read-side overhead to this state.

This unified approach, inspired by the Linux RCU, ensures consistent and
efficient RCU grace period handling and confirms resolution of the
virtio-gpu issue.

[1] https://lore.kernel.org/qemu-devel/20251014111234.3190346-9-alex.bennee@linaro.org/

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20251016-force-v1-1-919a82112498@rsg.ci.i.u-tokyo.ac.jp
Tested-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 util/rcu.c | 81 +++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 52 insertions(+), 29 deletions(-)

diff --git a/util/rcu.c b/util/rcu.c
index b703c86f15..acac9446ea 100644
--- a/util/rcu.c
+++ b/util/rcu.c
@@ -43,10 +43,14 @@
 #define RCU_GP_LOCKED           (1UL << 0)
 #define RCU_GP_CTR              (1UL << 1)
 
+
+#define RCU_CALL_MIN_SIZE        30
+
 unsigned long rcu_gp_ctr = RCU_GP_LOCKED;
 
 QemuEvent rcu_gp_event;
 static int in_drain_call_rcu;
+static int rcu_call_count;
 static QemuMutex rcu_registry_lock;
 static QemuMutex rcu_sync_lock;
 
@@ -76,15 +80,29 @@ static void wait_for_readers(void)
 {
     ThreadList qsreaders = QLIST_HEAD_INITIALIZER(qsreaders);
     struct rcu_reader_data *index, *tmp;
+    int sleeps = 0;
+    bool forced = false;
 
     for (;;) {
-        /* We want to be notified of changes made to rcu_gp_ongoing
-         * while we walk the list.
+        /*
+         * Force the grace period to end and wait for it if any of the
+         * following heuristical conditions are satisfied:
+         * - A decent number of callbacks piled up.
+         * - It timed out.
+         * - It is in a drain_call_rcu() call.
+         *
+         * Otherwise, periodically poll the grace period, hoping it ends
+         * promptly.
          */
-        qemu_event_reset(&rcu_gp_event);
+        if (!forced &&
+            (qatomic_read(&rcu_call_count) >= RCU_CALL_MIN_SIZE ||
+             sleeps >= 5 || qatomic_read(&in_drain_call_rcu))) {
+            forced = true;
 
-        QLIST_FOREACH(index, &registry, node) {
-            qatomic_set(&index->waiting, true);
+            QLIST_FOREACH(index, &registry, node) {
+                notifier_list_notify(&index->force_rcu, NULL);
+                qatomic_set(&index->waiting, true);
+            }
         }
 
         /* Here, order the stores to index->waiting before the loads of
@@ -106,8 +124,6 @@ static void wait_for_readers(void)
                  * get some extra futex wakeups.
                  */
                 qatomic_set(&index->waiting, false);
-            } else if (qatomic_read(&in_drain_call_rcu)) {
-                notifier_list_notify(&index->force_rcu, NULL);
             }
         }
 
@@ -115,7 +131,8 @@ static void wait_for_readers(void)
             break;
         }
 
-        /* Wait for one thread to report a quiescent state and try again.
+        /*
+         * Sleep for a while and try again.
          * Release rcu_registry_lock, so rcu_(un)register_thread() doesn't
          * wait too much time.
          *
@@ -133,7 +150,20 @@ static void wait_for_readers(void)
          * rcu_registry_lock is released.
          */
         qemu_mutex_unlock(&rcu_registry_lock);
-        qemu_event_wait(&rcu_gp_event);
+
+        if (forced) {
+            qemu_event_wait(&rcu_gp_event);
+
+            /*
+             * We want to be notified of changes made to rcu_gp_ongoing
+             * while we walk the list.
+             */
+            qemu_event_reset(&rcu_gp_event);
+        } else {
+            g_usleep(10000);
+            sleeps++;
+        }
+
         qemu_mutex_lock(&rcu_registry_lock);
     }
 
@@ -173,15 +203,11 @@ void synchronize_rcu(void)
     }
 }
 
-
-#define RCU_CALL_MIN_SIZE        30
-
 /* Multi-producer, single-consumer queue based on urcu/static/wfqueue.h
  * from liburcu.  Note that head is only used by the consumer.
  */
 static struct rcu_head dummy;
 static struct rcu_head *head = &dummy, **tail = &dummy.next;
-static int rcu_call_count;
 static QemuEvent rcu_call_ready_event;
 
 static void enqueue(struct rcu_head *node)
@@ -259,30 +285,27 @@ static void *call_rcu_thread(void *opaque)
     rcu_register_thread();
 
     for (;;) {
-        int tries = 0;
-        int n = qatomic_read(&rcu_call_count);
+        int n;
 
-        /* Heuristically wait for a decent number of callbacks to pile up.
+        /*
          * Fetch rcu_call_count now, we only must process elements that were
          * added before synchronize_rcu() starts.
          */
-        while (n == 0 || (n < RCU_CALL_MIN_SIZE && ++tries <= 5)) {
-            g_usleep(10000);
-            if (n == 0) {
-                qemu_event_reset(&rcu_call_ready_event);
-                n = qatomic_read(&rcu_call_count);
-                if (n == 0) {
-#if defined(CONFIG_MALLOC_TRIM)
-                    malloc_trim(4 * 1024 * 1024);
-#endif
-                    qemu_event_wait(&rcu_call_ready_event);
-                }
-            }
+        for (;;) {
+            qemu_event_reset(&rcu_call_ready_event);
             n = qatomic_read(&rcu_call_count);
+            if (n) {
+                break;
+            }
+
+#if defined(CONFIG_MALLOC_TRIM)
+            malloc_trim(4 * 1024 * 1024);
+#endif
+            qemu_event_wait(&rcu_call_ready_event);
         }
 
-        qatomic_sub(&rcu_call_count, n);
         synchronize_rcu();
+        qatomic_sub(&rcu_call_count, n);
         bql_lock();
         while (n > 0) {
             node = try_dequeue();

From 80a3c9c01aa29ec70d69802aea757a90ffe8356d Mon Sep 17 00:00:00 2001
From: Martin Kletzander <mkletzan@redhat.com>
Date: Thu, 16 Oct 2025 14:11:15 +0200
Subject: [PATCH 1676/2396] rust: remove useless glib_sys bindings

The definition of types needed for g_autolist(), g_autoslist(),
g_autoqueue() need the imports for GList, GSList and GQueue
to appear everything.  Rust code is never going to see those,
since they are not used in structs.  Block the types from
appearing in the bindings.

Co-authored-by: Martin Kletzander <mkletzan@redhat.com>
Signed-off-by: Martin Kletzander <mkletzan@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build                        | 1 +
 rust/bql/src/bindings.rs           | 4 +---
 rust/chardev/src/bindings.rs       | 4 ++--
 rust/hw/char/pl011/src/bindings.rs | 2 +-
 rust/hw/core/src/bindings.rs       | 4 +---
 rust/migration/src/bindings.rs     | 2 +-
 rust/qom/src/bindings.rs           | 2 +-
 rust/system/src/bindings.rs        | 4 ++--
 rust/util/src/bindings.rs          | 2 +-
 9 files changed, 11 insertions(+), 14 deletions(-)

diff --git a/meson.build b/meson.build
index c5710a6a47..8ad37c992b 100644
--- a/meson.build
+++ b/meson.build
@@ -4251,6 +4251,7 @@ if have_rust
     '--allowlist-file', meson.project_source_root() + '/include/.*',
     '--allowlist-file', meson.project_build_root() + '/.*',
     '--blocklist-file', glib_pc.get_variable('includedir') + '/glib-2.0/.*',
+    '--blocklist-type', '.*_([a-z]*autoptr)$',
     ]
   if not rustfmt.found()
     if bindgen.version().version_compare('<0.65.0')
diff --git a/rust/bql/src/bindings.rs b/rust/bql/src/bindings.rs
index 8c70f3a87c..c656cf1884 100644
--- a/rust/bql/src/bindings.rs
+++ b/rust/bql/src/bindings.rs
@@ -18,9 +18,7 @@
     clippy::too_many_arguments
 )]
 
-use glib_sys::{
-    guint, GArray, GHashTable, GHashTableIter, GList, GPollFD, GPtrArray, GQueue, GSList, GSource,
-};
+use glib_sys::{guint, GArray, GHashTable, GHashTableIter, GPollFD, GPtrArray, GSList, GSource};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/chardev/src/bindings.rs b/rust/chardev/src/bindings.rs
index c95dc89c56..63bfbb8ce6 100644
--- a/rust/chardev/src/bindings.rs
+++ b/rust/chardev/src/bindings.rs
@@ -20,8 +20,8 @@
 
 use common::Zeroable;
 use glib_sys::{
-    gboolean, guint, GArray, GHashTable, GHashTableIter, GIOCondition, GList, GMainContext,
-    GPollFD, GPtrArray, GQueue, GSList, GSource, GSourceFunc,
+    gboolean, guint, GArray, GHashTable, GHashTableIter, GIOCondition, GMainContext, GPollFD,
+    GPtrArray, GSList, GSource, GSourceFunc,
 };
 
 #[cfg(MESON)]
diff --git a/rust/hw/char/pl011/src/bindings.rs b/rust/hw/char/pl011/src/bindings.rs
index 52a76d0de5..654be9185b 100644
--- a/rust/hw/char/pl011/src/bindings.rs
+++ b/rust/hw/char/pl011/src/bindings.rs
@@ -22,7 +22,7 @@
 
 use glib_sys::{
     gboolean, guint, GArray, GByteArray, GHashTable, GHashTableIter, GIOCondition, GList,
-    GMainContext, GPollFD, GPtrArray, GQueue, GSList, GSource, GSourceFunc, GString,
+    GMainContext, GPollFD, GPtrArray, GSList, GSource, GSourceFunc, GString,
 };
 
 #[cfg(MESON)]
diff --git a/rust/hw/core/src/bindings.rs b/rust/hw/core/src/bindings.rs
index 65b9aae753..730d5b28a3 100644
--- a/rust/hw/core/src/bindings.rs
+++ b/rust/hw/core/src/bindings.rs
@@ -20,9 +20,7 @@
 
 use chardev::bindings::Chardev;
 use common::Zeroable;
-use glib_sys::{
-    GArray, GByteArray, GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList, GString,
-};
+use glib_sys::{GArray, GByteArray, GHashTable, GHashTableIter, GList, GPtrArray, GSList, GString};
 use migration::bindings::VMStateDescription;
 use qom::bindings::ObjectClass;
 use system::bindings::MemoryRegion;
diff --git a/rust/migration/src/bindings.rs b/rust/migration/src/bindings.rs
index 24503eb69b..e9c058386c 100644
--- a/rust/migration/src/bindings.rs
+++ b/rust/migration/src/bindings.rs
@@ -19,7 +19,7 @@
 )]
 
 use common::Zeroable;
-use glib_sys::{GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList};
+use glib_sys::{GHashTable, GHashTableIter, GPtrArray, GSList};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/qom/src/bindings.rs b/rust/qom/src/bindings.rs
index 91de42f242..e61259ec2e 100644
--- a/rust/qom/src/bindings.rs
+++ b/rust/qom/src/bindings.rs
@@ -18,7 +18,7 @@
     clippy::too_many_arguments
 )]
 
-use glib_sys::{GHashTable, GHashTableIter, GList, GPtrArray, GQueue, GSList};
+use glib_sys::{GHashTable, GHashTableIter, GPtrArray, GSList};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");
diff --git a/rust/system/src/bindings.rs b/rust/system/src/bindings.rs
index 6cbb588de3..ddccfe0436 100644
--- a/rust/system/src/bindings.rs
+++ b/rust/system/src/bindings.rs
@@ -20,8 +20,8 @@
 
 use common::Zeroable;
 use glib_sys::{
-    guint, GArray, GByteArray, GHashTable, GHashTableIter, GList, GPollFD, GPtrArray, GQueue,
-    GSList, GString,
+    guint, GArray, GByteArray, GHashTable, GHashTableIter, GList, GPollFD, GPtrArray, GSList,
+    GString,
 };
 
 #[cfg(MESON)]
diff --git a/rust/util/src/bindings.rs b/rust/util/src/bindings.rs
index c277a295ad..3514a66f5f 100644
--- a/rust/util/src/bindings.rs
+++ b/rust/util/src/bindings.rs
@@ -18,7 +18,7 @@
     clippy::too_many_arguments
 )]
 
-use glib_sys::{guint, GList, GPollFD, GQueue, GSList, GString};
+use glib_sys::{guint, GPollFD, GString};
 
 #[cfg(MESON)]
 include!("bindings.inc.rs");

From 025a1d344d8ce6c889933926071edc799ad81390 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 17 Oct 2025 15:21:11 +0200
Subject: [PATCH 1677/2396] rust: only leave leaf crates as workspace members

Everything else can be obtained as a dependency.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/Cargo.toml | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/rust/Cargo.toml b/rust/Cargo.toml
index 783e626802..ace0baf9bd 100644
--- a/rust/Cargo.toml
+++ b/rust/Cargo.toml
@@ -1,18 +1,8 @@
 [workspace]
 resolver = "2"
 members = [
-    "bits",
-    "bql",
-    "common",
-    "migration",
-    "qemu-macros",
-    "qom",
-    "system",
-    "hw/core",
     "hw/char/pl011",
     "hw/timer/hpet",
-    "trace",
-    "util",
     "tests",
 ]
 

From dc72ba5dc48c69b2f2bc79c0e977a9cb8b7b01e4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 30 Sep 2025 13:17:11 +0200
Subject: [PATCH 1678/2396] qobject: make refcount atomic

The Rust bindings for QObject will only operate on complete objects,
treating them as immutable as long as the Rust QObject is live.

With that constraint, it is trivial for Rust code to treat QObjects as
thread-safe; all that's needed is to make reference count operations
atomic.  Do the same when the C code adds or removes references, since
we don't really know what the Rust code is up to; of course C code will
have to agree with not making changes to the QObjects after they've
been passed to Rust code.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 include/qobject/qobject.h | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/include/qobject/qobject.h b/include/qobject/qobject.h
index a6244d0ce0..02f4c6a6eb 100644
--- a/include/qobject/qobject.h
+++ b/include/qobject/qobject.h
@@ -32,6 +32,7 @@
 #ifndef QOBJECT_H
 #define QOBJECT_H
 
+#include "qemu/atomic.h"
 #include "qapi/qapi-builtin-types.h"
 
 /* Not for use outside include/qobject/ */
@@ -73,7 +74,7 @@ QEMU_BUILD_BUG_MSG(QTYPE__MAX != 7,
 static inline void qobject_ref_impl(QObject *obj)
 {
     if (obj) {
-        obj->base.refcnt++;
+        qatomic_inc(&obj->base.refcnt);
     }
 }
 
@@ -95,7 +96,7 @@ void qobject_destroy(QObject *obj);
 static inline void qobject_unref_impl(QObject *obj)
 {
     assert(!obj || obj->base.refcnt);
-    if (obj && --obj->base.refcnt == 0) {
+    if (obj && qatomic_fetch_dec(&obj->base.refcnt) == 1) {
         qobject_destroy(obj);
     }
 }

From f223a90b0cccf38ad7fe34059c893b39c8d6b77a Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 24 Sep 2025 16:33:08 +0300
Subject: [PATCH 1679/2396] chardev: remove deprecated 'reconnect' option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was deprecated in 9.2, time to remove.

Note, that (which become obvious with this commit) we forget to do some
checks for reconnect-ms options, for example, it was silently ignored
for listening server, instead of error-out. The commit fixes this, as
now we use reconnect_ms everywhere.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 chardev/char-socket.c           | 24 +++++-------------------
 chardev/char.c                  |  3 ---
 docs/about/deprecated.rst       |  6 ------
 docs/about/removed-features.rst | 12 ++++++++++++
 qapi/char.json                  | 14 +-------------
 5 files changed, 18 insertions(+), 41 deletions(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index cb4ec78ebe..62852e3caf 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1296,9 +1296,9 @@ static bool qmp_chardev_validate_socket(ChardevSocket *sock,
     /* Validate any options which have a dependency on address type */
     switch (addr->type) {
     case SOCKET_ADDRESS_TYPE_FD:
-        if (sock->has_reconnect) {
+        if (sock->has_reconnect_ms) {
             error_setg(errp,
-                       "'reconnect' option is incompatible with "
+                       "'reconnect-ms' option is incompatible with "
                        "'fd' address type");
             return false;
         }
@@ -1342,9 +1342,9 @@ static bool qmp_chardev_validate_socket(ChardevSocket *sock,
 
     /* Validate any options which have a dependency on client vs server */
     if (!sock->has_server || sock->server) {
-        if (sock->has_reconnect) {
+        if (sock->has_reconnect_ms) {
             error_setg(errp,
-                       "'reconnect' option is incompatible with "
+                       "'reconnect-ms' option is incompatible with "
                        "socket in server listen mode");
             return false;
         }
@@ -1361,12 +1361,6 @@ static bool qmp_chardev_validate_socket(ChardevSocket *sock,
         }
     }
 
-    if (sock->has_reconnect_ms && sock->has_reconnect) {
-        error_setg(errp,
-            "'reconnect' and 'reconnect-ms' are mutually exclusive");
-        return false;
-    }
-
     return true;
 }
 
@@ -1384,7 +1378,7 @@ static void qmp_chardev_open_socket(Chardev *chr,
     bool is_tn3270      = sock->has_tn3270  ? sock->tn3270  : false;
     bool is_waitconnect = sock->has_wait    ? sock->wait    : false;
     bool is_websock     = sock->has_websocket ? sock->websocket : false;
-    int64_t reconnect_ms = 0;
+    int64_t reconnect_ms = sock->has_reconnect_ms ? sock->reconnect_ms : 0;
     SocketAddress *addr;
 
     s->is_listen = is_listen;
@@ -1456,12 +1450,6 @@ static void qmp_chardev_open_socket(Chardev *chr,
             return;
         }
     } else {
-        if (sock->has_reconnect) {
-            reconnect_ms = sock->reconnect * 1000ULL;
-        } else if (sock->has_reconnect_ms) {
-            reconnect_ms = sock->reconnect_ms;
-        }
-
         if (qmp_chardev_open_socket_client(chr, reconnect_ms, errp) < 0) {
             return;
         }
@@ -1526,8 +1514,6 @@ static void qemu_chr_parse_socket(QemuOpts *opts, ChardevBackend *backend,
      */
     sock->has_wait = qemu_opt_find(opts, "wait") || sock->server;
     sock->wait = qemu_opt_get_bool(opts, "wait", true);
-    sock->has_reconnect = qemu_opt_find(opts, "reconnect");
-    sock->reconnect = qemu_opt_get_number(opts, "reconnect", 0);
     sock->has_reconnect_ms = qemu_opt_find(opts, "reconnect-ms");
     sock->reconnect_ms = qemu_opt_get_number(opts, "reconnect-ms", 0);
 
diff --git a/chardev/char.c b/chardev/char.c
index bbebd246c3..a43b7e5481 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -892,9 +892,6 @@ QemuOptsList qemu_chardev_opts = {
         },{
             .name = "nodelay",
             .type = QEMU_OPT_BOOL,
-        },{
-            .name = "reconnect",
-            .type = QEMU_OPT_NUMBER,
         },{
             .name = "reconnect-ms",
             .type = QEMU_OPT_NUMBER,
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index dacf2882e4..aff3f13163 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -468,12 +468,6 @@ Backend ``memory`` (since 9.0)
 
 ``memory`` is a deprecated synonym for ``ringbuf``.
 
-``reconnect`` (since 9.2)
-^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The ``reconnect`` option only allows specifying second granularity timeouts,
-which is not enough for all types of use cases, use ``reconnect-ms`` instead.
-
 
 Net device options
 ''''''''''''''''''
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 53829f59e6..269f6bb654 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1367,4 +1367,16 @@ The ``blacklist`` config file option has been renamed to ``block-rpcs``
 (to be in sync with the renaming of the corresponding command line
 option).
 
+Device options
+--------------
+
+Character device options
+''''''''''''''''''''''''
+
+``reconnect`` (removed in 10.2)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The ``reconnect`` has been replaced by ``reconnect-ms``, which provides
+better precision.
+
 .. _Intel discontinuance notification: https://www.intel.com/content/www/us/en/content-details/781327/intel-is-discontinuing-ip-ordering-codes-listed-in-pdn2312-for-nios-ii-ip.html
diff --git a/qapi/char.json b/qapi/char.json
index f0a53f742c..b07e3bb827 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -269,22 +269,11 @@
 # @websocket: enable websocket protocol on server sockets
 #     (default: false) (Since: 3.1)
 #
-# @reconnect: For a client socket, if a socket is disconnected, then
-#     attempt a reconnect after the given number of seconds.  Setting
-#     this to zero disables this function.  The use of this member is
-#     deprecated, use @reconnect-ms instead.  (default: 0) (Since: 2.2)
-#
 # @reconnect-ms: For a client socket, if a socket is disconnected,
 #     then attempt a reconnect after the given number of milliseconds.
-#     Setting this to zero disables this function.  This member is
-#     mutually exclusive with @reconnect.
+#     Setting this to zero disables this function.
 #     (default: 0) (Since: 9.2)
 #
-# Features:
-#
-# @deprecated: Member @reconnect is deprecated.  Use @reconnect-ms
-#     instead.
-#
 # Since: 1.4
 ##
 { 'struct': 'ChardevSocket',
@@ -297,7 +286,6 @@
             '*telnet': 'bool',
             '*tn3270': 'bool',
             '*websocket': 'bool',
-            '*reconnect': { 'type': 'int', 'features': [ 'deprecated' ] },
             '*reconnect-ms': 'int' },
   'base': 'ChardevCommon' }
 

From 015051a21cf9b204c7ecd954f0fa8d8885985a5b Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Wed, 24 Sep 2025 16:33:09 +0300
Subject: [PATCH 1680/2396] net/stream: remove deprecated 'reconnect' option
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was deprecated in 9.2, time to remove.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Daniil Tatianin <d-tatianin@yandex-team.ru>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/about/deprecated.rst       |  9 ---------
 docs/about/removed-features.rst | 10 ++++++++++
 net/stream.c                    | 20 +++++---------------
 qapi/net.json                   | 13 +------------
 4 files changed, 16 insertions(+), 36 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index aff3f13163..bd86c036fb 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -469,15 +469,6 @@ Backend ``memory`` (since 9.0)
 ``memory`` is a deprecated synonym for ``ringbuf``.
 
 
-Net device options
-''''''''''''''''''
-
-Stream ``reconnect`` (since 9.2)
-^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
-
-The ``reconnect`` option only allows specifying second granularity timeouts,
-which is not enough for all types of use cases, use ``reconnect-ms`` instead.
-
 CPU device properties
 '''''''''''''''''''''
 
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 269f6bb654..88ea0dc4ed 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -1379,4 +1379,14 @@ Character device options
 The ``reconnect`` has been replaced by ``reconnect-ms``, which provides
 better precision.
 
+Net device options
+''''''''''''''''''
+
+Stream ``reconnect`` (removed in 10.2)
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The ``reconnect`` has been replaced by ``reconnect-ms``, which provides
+better precision.
+
+
 .. _Intel discontinuance notification: https://www.intel.com/content/www/us/en/content-details/781327/intel-is-discontinuing-ip-ordering-codes-listed-in-pdn2312-for-nios-ii-ip.html
diff --git a/net/stream.c b/net/stream.c
index 94f823a2a7..ea83f4a763 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -274,23 +274,13 @@ int net_init_stream(const Netdev *netdev, const char *name,
     sock = &netdev->u.stream;
 
     if (!sock->has_server || !sock->server) {
-        uint32_t reconnect_ms = 0;
-
-        if (sock->has_reconnect && sock->has_reconnect_ms) {
-            error_setg(errp, "'reconnect' and 'reconnect-ms' are mutually "
-                             "exclusive");
-            return -1;
-        } else if (sock->has_reconnect_ms) {
-            reconnect_ms = sock->reconnect_ms;
-        } else if (sock->has_reconnect) {
-            reconnect_ms = sock->reconnect * 1000u;
-        }
-
         return net_stream_client_init(peer, "stream", name, sock->addr,
-                                      reconnect_ms, errp);
+                                      sock->has_reconnect_ms ?
+                                          sock->reconnect_ms : 0,
+                                      errp);
     }
-    if (sock->has_reconnect || sock->has_reconnect_ms) {
-        error_setg(errp, "'reconnect' and 'reconnect-ms' options are "
+    if (sock->has_reconnect_ms) {
+        error_setg(errp, "'reconnect-ms' option is "
                          "incompatible with socket in server mode");
         return -1;
     }
diff --git a/qapi/net.json b/qapi/net.json
index 60d196afe5..7f62f8cc39 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -770,29 +770,18 @@
 #
 # @server: create server socket (default: false)
 #
-# @reconnect: For a client socket, if a socket is disconnected, then
-#     attempt a reconnect after the given number of seconds.  Setting
-#     this to zero disables this function.  (default: 0) (since 8.0)
-#
 # @reconnect-ms: For a client socket, if a socket is disconnected, then
 #     attempt a reconnect after the given number of milliseconds.  Setting
-#     this to zero disables this function.  This member is mutually
-#     exclusive with @reconnect.  (default: 0) (Since: 9.2)
+#     this to zero disables this function.  (default: 0) (Since: 9.2)
 #
 # Only `SocketAddress` types 'unix', 'inet' and 'fd' are supported.
 #
-# Features:
-#
-# @deprecated: Member @reconnect is deprecated.  Use @reconnect-ms
-#     instead.
-#
 # Since: 7.2
 ##
 { 'struct': 'NetdevStreamOptions',
   'data': {
     'addr':   'SocketAddress',
     '*server': 'bool',
-    '*reconnect': { 'type': 'int', 'features': [ 'deprecated' ] },
     '*reconnect-ms': 'int' } }
 
 ##

From 337c7a7ad13c0a0e45b0710d4fb00a87d145be01 Mon Sep 17 00:00:00 2001
From: Nir Lichtman <nir@lichtman.org>
Date: Fri, 15 Aug 2025 09:00:25 +0000
Subject: [PATCH 1681/2396] docs/system/keys: fix incorrect reset scaling key
 binding

Fix incorrect key binding for resetting the graphical frontends scaling

Signed-off-by: Nir Lichtman <nir@lichtman.org>
Fixes: 15421f7113 "ui/sdl2: fix reset scaling binding to be consistent with gtk"
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/system/keys.rst.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/system/keys.rst.inc b/docs/system/keys.rst.inc
index c28ae1a227..3b5307b775 100644
--- a/docs/system/keys.rst.inc
+++ b/docs/system/keys.rst.inc
@@ -21,7 +21,7 @@ while ``-display sdl,grab-mod=rctrl`` changes it to the right :kbd:`Ctrl` key.
   * - :kbd:`Ctrl+Alt+-`
     - Shrink the screen
 
-  * - :kbd:`Ctrl+Alt+u`
+  * - :kbd:`Ctrl+Alt+0`
     - Restore the screen's un-scaled dimensions
 
   * - :kbd:`Ctrl+Alt+n`

From 1b21518f731cc9a87badc90c1ae40660632c75c7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 22 Oct 2025 11:46:10 +0400
Subject: [PATCH 1682/2396] char: rename CharBackend->CharFrontend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The actual backend is "Chardev", CharBackend is the frontend side of
it (whatever talks to the backend), let's rename it for readability.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Link: https://lore.kernel.org/r/20251022074612.1258413-1-marcandre.lureau@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 backends/cryptodev-vhost-user.c      |   2 +-
 backends/rng-egd.c                   |   2 +-
 backends/tpm/tpm_emulator.c          |   4 +-
 chardev/char-fe.c                    | 144 +++++++++----------
 chardev/char-hub.c                   |  18 +--
 chardev/char-mux.c                   |  40 +++---
 chardev/char.c                       |  44 +++---
 chardev/chardev-internal.h           |  12 +-
 gdbstub/system.c                     |   2 +-
 hw/arm/strongarm.c                   |   2 +-
 hw/char/debugcon.c                   |   2 +-
 hw/char/exynos4210_uart.c            |   2 +-
 hw/char/grlib_apbuart.c              |   2 +-
 hw/char/ipoctal232.c                 |   2 +-
 hw/char/mcf_uart.c                   |   2 +-
 hw/char/sclpconsole-lm.c             |   2 +-
 hw/char/sclpconsole.c                |   2 +-
 hw/char/sh_serial.c                  |   2 +-
 hw/char/spapr_vty.c                  |   2 +-
 hw/char/terminal3270.c               |   2 +-
 hw/char/virtio-console.c             |   2 +-
 hw/char/xen_console.c                |   2 +-
 hw/char/xilinx_uartlite.c            |   2 +-
 hw/core/qdev-properties-system.c     |  16 +--
 hw/hppa/machine.c                    |   2 +-
 hw/ipmi/ipmi_bmc_extern.c            |   2 +-
 hw/mips/boston.c                     |   2 +-
 hw/mips/malta.c                      |   2 +-
 hw/misc/ivshmem-pci.c                |   2 +-
 hw/ppc/spapr_rtas.c                  |   2 +-
 hw/riscv/riscv_hart.c                |   2 +-
 hw/usb/ccid-card-passthru.c          |   2 +-
 hw/usb/dev-serial.c                  |   2 +-
 hw/usb/redirect.c                    |   2 +-
 hw/virtio/vhost-stub.c               |   2 +-
 hw/virtio/vhost-user.c               |  20 +--
 include/chardev/char-fe.h            |  67 +++++----
 include/chardev/char.h               |   4 +-
 include/hw/char/avr_usart.h          |   2 +-
 include/hw/char/bcm2835_aux.h        |   2 +-
 include/hw/char/cadence_uart.h       |   2 +-
 include/hw/char/cmsdk-apb-uart.h     |   2 +-
 include/hw/char/digic-uart.h         |   2 +-
 include/hw/char/escc.h               |   2 +-
 include/hw/char/goldfish_tty.h       |   2 +-
 include/hw/char/ibex_uart.h          |   2 +-
 include/hw/char/imx_serial.h         |   2 +-
 include/hw/char/max78000_uart.h      |   2 +-
 include/hw/char/nrf51_uart.h         |   2 +-
 include/hw/char/parallel.h           |   2 +-
 include/hw/char/pl011.h              |   2 +-
 include/hw/char/renesas_sci.h        |   2 +-
 include/hw/char/riscv_htif.h         |   2 +-
 include/hw/char/serial.h             |   2 +-
 include/hw/char/shakti_uart.h        |   2 +-
 include/hw/char/sifive_uart.h        |   2 +-
 include/hw/char/stm32f2xx_usart.h    |   2 +-
 include/hw/char/stm32l4x5_usart.h    |   2 +-
 include/hw/misc/ivshmem-flat.h       |   2 +-
 include/hw/qdev-properties-system.h  |   2 +-
 include/hw/virtio/vhost-user-base.h  |   2 +-
 include/hw/virtio/vhost-user-blk.h   |   2 +-
 include/hw/virtio/vhost-user-fs.h    |   2 +-
 include/hw/virtio/vhost-user-scmi.h  |   2 +-
 include/hw/virtio/vhost-user-vsock.h |   2 +-
 include/hw/virtio/vhost-user.h       |   8 +-
 include/hw/virtio/virtio-gpu.h       |   2 +-
 include/hw/virtio/virtio-scsi.h      |   2 +-
 include/system/qtest.h               |   4 +-
 include/system/vhost-user-backend.h  |   2 +-
 monitor/monitor-internal.h           |   2 +-
 net/colo-compare.c                   |  10 +-
 net/filter-mirror.c                  |   4 +-
 net/passt.c                          |   2 +-
 net/slirp.c                          |   2 +-
 net/vhost-user.c                     |   2 +-
 rust/bindings/src/lib.rs             |   4 +-
 rust/chardev/src/bindings.rs         |   6 +-
 rust/chardev/src/chardev.rs          |  26 ++--
 rust/hw/char/pl011/src/device.rs     |  12 +-
 rust/hw/core/src/qdev.rs             |   2 +-
 semihosting/console.c                |   6 +-
 system/qtest.c                       |  20 +--
 target/hppa/sys_helper.c             |  12 +-
 target/riscv/kvm/kvm-cpu.c           |  10 +-
 target/xtensa/xtensa-semi.c          |  10 +-
 tests/qtest/vhost-user-test.c        |  16 +--
 tests/unit/test-char.c               | 202 +++++++++++++--------------
 tests/unit/test-yank.c               |  12 +-
 89 files changed, 428 insertions(+), 429 deletions(-)

diff --git a/backends/cryptodev-vhost-user.c b/backends/cryptodev-vhost-user.c
index cb04e68b02..cc478d9902 100644
--- a/backends/cryptodev-vhost-user.c
+++ b/backends/cryptodev-vhost-user.c
@@ -46,7 +46,7 @@ struct CryptoDevBackendVhostUser {
     CryptoDevBackend parent_obj;
 
     VhostUserState vhost_user;
-    CharBackend chr;
+    CharFrontend chr;
     char *chr_name;
     bool opened;
     CryptoDevBackendVhost *vhost_crypto[MAX_CRYPTO_QUEUE_NUM];
diff --git a/backends/rng-egd.c b/backends/rng-egd.c
index 9fd3393ede..1d92bd71cf 100644
--- a/backends/rng-egd.c
+++ b/backends/rng-egd.c
@@ -24,7 +24,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(RngEgd, RNG_EGD)
 struct RngEgd {
     RngBackend parent;
 
-    CharBackend chr;
+    CharFrontend chr;
     char *chr_name;
 };
 
diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index dacfca5ab7..f32b67dac7 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -69,7 +69,7 @@ struct TPMEmulator {
     TPMBackend parent;
 
     TPMEmulatorOptions *options;
-    CharBackend ctrl_chr;
+    CharFrontend ctrl_chr;
     QIOChannel *data_ioc;
     TPMVersion tpm_version;
     uint32_t caps; /* capabilities of the TPM */
@@ -126,7 +126,7 @@ static int tpm_emulator_ctrlcmd(TPMEmulator *tpm, unsigned long cmd, void *msg,
                                 size_t msg_len_in, size_t msg_len_out_err,
                                 size_t msg_len_out_total)
 {
-    CharBackend *dev = &tpm->ctrl_chr;
+    CharFrontend *dev = &tpm->ctrl_chr;
     uint32_t cmd_no = cpu_to_be32(cmd);
     ssize_t n = sizeof(uint32_t) + msg_len_in;
     ptm_res res;
diff --git a/chardev/char-fe.c b/chardev/char-fe.c
index 158a5f4f55..34b83fc1c4 100644
--- a/chardev/char-fe.c
+++ b/chardev/char-fe.c
@@ -30,9 +30,9 @@
 #include "chardev/char-io.h"
 #include "chardev-internal.h"
 
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
+int qemu_chr_fe_write(CharFrontend *c, const uint8_t *buf, int len)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
 
     if (!s) {
         return 0;
@@ -41,9 +41,9 @@ int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len)
     return qemu_chr_write(s, buf, len, false);
 }
 
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
+int qemu_chr_fe_write_all(CharFrontend *c, const uint8_t *buf, int len)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
 
     if (!s) {
         return 0;
@@ -52,9 +52,9 @@ int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len)
     return qemu_chr_write(s, buf, len, true);
 }
 
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
+int qemu_chr_fe_read_all(CharFrontend *c, uint8_t *buf, int len)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
     int offset = 0;
     int res;
 
@@ -95,9 +95,9 @@ int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len)
     return offset;
 }
 
-int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg)
+int qemu_chr_fe_ioctl(CharFrontend *c, int cmd, void *arg)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
     int res;
 
     if (!s || !CHARDEV_GET_CLASS(s)->chr_ioctl || qemu_chr_replay(s)) {
@@ -109,11 +109,11 @@ int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg)
     return res;
 }
 
-int qemu_chr_fe_get_msgfd(CharBackend *be)
+int qemu_chr_fe_get_msgfd(CharFrontend *c)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
     int fd;
-    int res = (qemu_chr_fe_get_msgfds(be, &fd, 1) == 1) ? fd : -1;
+    int res = (qemu_chr_fe_get_msgfds(c, &fd, 1) == 1) ? fd : -1;
     if (s && qemu_chr_replay(s)) {
         error_report("Replay: get msgfd is not supported "
                      "for serial devices yet");
@@ -122,9 +122,9 @@ int qemu_chr_fe_get_msgfd(CharBackend *be)
     return res;
 }
 
-int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int len)
+int qemu_chr_fe_get_msgfds(CharFrontend *c, int *fds, int len)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
 
     if (!s) {
         return -1;
@@ -134,9 +134,9 @@ int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int len)
         CHARDEV_GET_CLASS(s)->get_msgfds(s, fds, len) : -1;
 }
 
-int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num)
+int qemu_chr_fe_set_msgfds(CharFrontend *c, int *fds, int num)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
 
     if (!s) {
         return -1;
@@ -146,9 +146,9 @@ int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num)
         CHARDEV_GET_CLASS(s)->set_msgfds(s, fds, num) : -1;
 }
 
-void qemu_chr_fe_accept_input(CharBackend *be)
+void qemu_chr_fe_accept_input(CharFrontend *c)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
 
     if (!s) {
         return;
@@ -160,7 +160,7 @@ void qemu_chr_fe_accept_input(CharBackend *be)
     qemu_notify_event();
 }
 
-void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
+void qemu_chr_fe_printf(CharFrontend *c, const char *fmt, ...)
 {
     char buf[CHR_READ_BUF_LEN];
     va_list ap;
@@ -168,28 +168,28 @@ void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
     vsnprintf(buf, sizeof(buf), fmt, ap);
     /* XXX this blocks entire thread. Rewrite to use
      * qemu_chr_fe_write and background I/O callbacks */
-    qemu_chr_fe_write_all(be, (uint8_t *)buf, strlen(buf));
+    qemu_chr_fe_write_all(c, (uint8_t *)buf, strlen(buf));
     va_end(ap);
 }
 
-Chardev *qemu_chr_fe_get_driver(CharBackend *be)
+Chardev *qemu_chr_fe_get_driver(CharFrontend *c)
 {
     /* this is unsafe for the users that support chardev hotswap */
-    assert(be->chr_be_change == NULL);
-    return be->chr;
+    assert(c->chr_be_change == NULL);
+    return c->chr;
 }
 
-bool qemu_chr_fe_backend_connected(CharBackend *be)
+bool qemu_chr_fe_backend_connected(CharFrontend *c)
 {
-    return !!be->chr;
+    return !!c->chr;
 }
 
-bool qemu_chr_fe_backend_open(CharBackend *be)
+bool qemu_chr_fe_backend_open(CharFrontend *c)
 {
-    return be->chr && be->chr->be_open;
+    return c->chr && c->chr->be_open;
 }
 
-bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp)
+bool qemu_chr_fe_init(CharFrontend *c, Chardev *s, Error **errp)
 {
     unsigned int tag = 0;
 
@@ -197,49 +197,49 @@ bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp)
         if (CHARDEV_IS_MUX(s)) {
             MuxChardev *d = MUX_CHARDEV(s);
 
-            if (!mux_chr_attach_frontend(d, b, &tag, errp)) {
+            if (!mux_chr_attach_frontend(d, c, &tag, errp)) {
                 return false;
             }
-        } else if (s->be) {
+        } else if (s->fe) {
             error_setg(errp, "chardev '%s' is already in use", s->label);
             return false;
         } else {
-            s->be = b;
+            s->fe = c;
         }
     }
 
-    b->fe_is_open = false;
-    b->tag = tag;
-    b->chr = s;
+    c->fe_is_open = false;
+    c->tag = tag;
+    c->chr = s;
     return true;
 }
 
-void qemu_chr_fe_deinit(CharBackend *b, bool del)
+void qemu_chr_fe_deinit(CharFrontend *c, bool del)
 {
-    assert(b);
+    assert(c);
 
-    if (b->chr) {
-        qemu_chr_fe_set_handlers(b, NULL, NULL, NULL, NULL, NULL, NULL, true);
-        if (b->chr->be == b) {
-            b->chr->be = NULL;
+    if (c->chr) {
+        qemu_chr_fe_set_handlers(c, NULL, NULL, NULL, NULL, NULL, NULL, true);
+        if (c->chr->fe == c) {
+            c->chr->fe = NULL;
         }
-        if (CHARDEV_IS_MUX(b->chr)) {
-            MuxChardev *d = MUX_CHARDEV(b->chr);
-            mux_chr_detach_frontend(d, b->tag);
+        if (CHARDEV_IS_MUX(c->chr)) {
+            MuxChardev *d = MUX_CHARDEV(c->chr);
+            mux_chr_detach_frontend(d, c->tag);
         }
         if (del) {
-            Object *obj = OBJECT(b->chr);
+            Object *obj = OBJECT(c->chr);
             if (obj->parent) {
                 object_unparent(obj);
             } else {
                 object_unref(obj);
             }
         }
-        b->chr = NULL;
+        c->chr = NULL;
     }
 }
 
-void qemu_chr_fe_set_handlers_full(CharBackend *b,
+void qemu_chr_fe_set_handlers_full(CharFrontend *c,
                                    IOCanReadHandler *fd_can_read,
                                    IOReadHandler *fd_read,
                                    IOEventHandler *fd_event,
@@ -252,7 +252,7 @@ void qemu_chr_fe_set_handlers_full(CharBackend *b,
     Chardev *s;
     bool fe_open;
 
-    s = b->chr;
+    s = c->chr;
     if (!s) {
         return;
     }
@@ -263,20 +263,20 @@ void qemu_chr_fe_set_handlers_full(CharBackend *b,
     } else {
         fe_open = true;
     }
-    b->chr_can_read = fd_can_read;
-    b->chr_read = fd_read;
-    b->chr_event = fd_event;
-    b->chr_be_change = be_change;
-    b->opaque = opaque;
+    c->chr_can_read = fd_can_read;
+    c->chr_read = fd_read;
+    c->chr_event = fd_event;
+    c->chr_be_change = be_change;
+    c->opaque = opaque;
 
     qemu_chr_be_update_read_handlers(s, context);
 
     if (set_open) {
-        qemu_chr_fe_set_open(b, fe_open);
+        qemu_chr_fe_set_open(c, fe_open);
     }
 
     if (fe_open) {
-        qemu_chr_fe_take_focus(b);
+        qemu_chr_fe_take_focus(c);
         /* We're connecting to an already opened device, so let's make sure we
            also get the open event */
         if (sync_state && s->be_open) {
@@ -285,7 +285,7 @@ void qemu_chr_fe_set_handlers_full(CharBackend *b,
     }
 }
 
-void qemu_chr_fe_set_handlers(CharBackend *b,
+void qemu_chr_fe_set_handlers(CharFrontend *c,
                               IOCanReadHandler *fd_can_read,
                               IOReadHandler *fd_read,
                               IOEventHandler *fd_event,
@@ -294,62 +294,62 @@ void qemu_chr_fe_set_handlers(CharBackend *b,
                               GMainContext *context,
                               bool set_open)
 {
-    qemu_chr_fe_set_handlers_full(b, fd_can_read, fd_read, fd_event, be_change,
+    qemu_chr_fe_set_handlers_full(c, fd_can_read, fd_read, fd_event, be_change,
                                   opaque, context, set_open,
                                   true);
 }
 
-void qemu_chr_fe_take_focus(CharBackend *b)
+void qemu_chr_fe_take_focus(CharFrontend *c)
 {
-    if (!b->chr) {
+    if (!c->chr) {
         return;
     }
 
-    if (CHARDEV_IS_MUX(b->chr)) {
-        mux_set_focus(b->chr, b->tag);
+    if (CHARDEV_IS_MUX(c->chr)) {
+        mux_set_focus(c->chr, c->tag);
     }
 }
 
-int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp)
+int qemu_chr_fe_wait_connected(CharFrontend *c, Error **errp)
 {
-    if (!be->chr) {
+    if (!c->chr) {
         error_setg(errp, "missing associated backend");
         return -1;
     }
 
-    return qemu_chr_wait_connected(be->chr, errp);
+    return qemu_chr_wait_connected(c->chr, errp);
 }
 
-void qemu_chr_fe_set_echo(CharBackend *be, bool echo)
+void qemu_chr_fe_set_echo(CharFrontend *c, bool echo)
 {
-    Chardev *chr = be->chr;
+    Chardev *chr = c->chr;
 
     if (chr && CHARDEV_GET_CLASS(chr)->chr_set_echo) {
         CHARDEV_GET_CLASS(chr)->chr_set_echo(chr, echo);
     }
 }
 
-void qemu_chr_fe_set_open(CharBackend *be, bool is_open)
+void qemu_chr_fe_set_open(CharFrontend *c, bool is_open)
 {
-    Chardev *chr = be->chr;
+    Chardev *chr = c->chr;
 
     if (!chr) {
         return;
     }
 
-    if (be->fe_is_open == is_open) {
+    if (c->fe_is_open == is_open) {
         return;
     }
-    be->fe_is_open = is_open;
+    c->fe_is_open = is_open;
     if (CHARDEV_GET_CLASS(chr)->chr_set_fe_open) {
         CHARDEV_GET_CLASS(chr)->chr_set_fe_open(chr, is_open);
     }
 }
 
-guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
+guint qemu_chr_fe_add_watch(CharFrontend *c, GIOCondition cond,
                             FEWatchFunc func, void *user_data)
 {
-    Chardev *s = be->chr;
+    Chardev *s = c->chr;
     GSource *src;
     guint tag;
 
@@ -369,9 +369,9 @@ guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
     return tag;
 }
 
-void qemu_chr_fe_disconnect(CharBackend *be)
+void qemu_chr_fe_disconnect(CharFrontend *c)
 {
-    Chardev *chr = be->chr;
+    Chardev *chr = c->chr;
 
     if (chr && CHARDEV_GET_CLASS(chr)->chr_disconnect) {
         CHARDEV_GET_CLASS(chr)->chr_disconnect(chr);
diff --git a/chardev/char-hub.c b/chardev/char-hub.c
index 16ffee2017..d0967c2233 100644
--- a/chardev/char-hub.c
+++ b/chardev/char-hub.c
@@ -54,7 +54,7 @@ static int hub_chr_write(Chardev *chr, const uint8_t *buf, int len)
     d->be_eagain_ind = -1;
 
     for (i = 0; i < d->be_cnt; i++) {
-        if (!d->backends[i].be.chr->be_open) {
+        if (!d->backends[i].fe.chr->be_open) {
             /* Skip closed backend */
             continue;
         }
@@ -64,7 +64,7 @@ static int hub_chr_write(Chardev *chr, const uint8_t *buf, int len)
             ret = MIN(written, ret);
             continue;
         }
-        r = qemu_chr_fe_write(&d->backends[i].be, buf, len);
+        r = qemu_chr_fe_write(&d->backends[i].fe, buf, len);
         if (r < 0) {
             if (errno == EAGAIN) {
                 /* Set index and expect to be called soon on watch wake up */
@@ -84,7 +84,7 @@ static int hub_chr_write(Chardev *chr, const uint8_t *buf, int len)
 static int hub_chr_can_read(void *opaque)
 {
     HubCharBackend *backend = opaque;
-    CharBackend *fe = backend->hub->parent.be;
+    CharFrontend *fe = backend->hub->parent.fe;
 
     if (fe && fe->chr_can_read) {
         return fe->chr_can_read(fe->opaque);
@@ -96,7 +96,7 @@ static int hub_chr_can_read(void *opaque)
 static void hub_chr_read(void *opaque, const uint8_t *buf, int size)
 {
     HubCharBackend *backend = opaque;
-    CharBackend *fe = backend->hub->parent.be;
+    CharFrontend *fe = backend->hub->parent.fe;
 
     if (fe && fe->chr_read) {
         fe->chr_read(fe->opaque, buf, size);
@@ -107,7 +107,7 @@ static void hub_chr_event(void *opaque, QEMUChrEvent event)
 {
     HubCharBackend *backend = opaque;
     HubChardev *d = backend->hub;
-    CharBackend *fe = d->parent.be;
+    CharFrontend *fe = d->parent.fe;
 
     if (event == CHR_EVENT_OPENED) {
         /*
@@ -147,7 +147,7 @@ static GSource *hub_chr_add_watch(Chardev *s, GIOCondition cond)
     }
 
     assert(d->be_eagain_ind < d->be_cnt);
-    chr = qemu_chr_fe_get_driver(&d->backends[d->be_eagain_ind].be);
+    chr = qemu_chr_fe_get_driver(&d->backends[d->be_eagain_ind].fe);
     cc = CHARDEV_GET_CLASS(chr);
     if (!cc->chr_add_watch) {
         return NULL;
@@ -167,7 +167,7 @@ static bool hub_chr_attach_chardev(HubChardev *d, Chardev *chr,
                    d->parent.label);
         return false;
     }
-    ret = qemu_chr_fe_init(&d->backends[d->be_cnt].be, chr, errp);
+    ret = qemu_chr_fe_init(&d->backends[d->be_cnt].fe, chr, errp);
     if (ret) {
         d->backends[d->be_cnt].hub = d;
         d->backends[d->be_cnt].be_ind = d->be_cnt;
@@ -183,7 +183,7 @@ static void char_hub_finalize(Object *obj)
     int i;
 
     for (i = 0; i < d->be_cnt; i++) {
-        qemu_chr_fe_deinit(&d->backends[i].be, false);
+        qemu_chr_fe_deinit(&d->backends[i].fe, false);
     }
 }
 
@@ -193,7 +193,7 @@ static void hub_chr_update_read_handlers(Chardev *chr)
     int i;
 
     for (i = 0; i < d->be_cnt; i++) {
-        qemu_chr_fe_set_handlers_full(&d->backends[i].be,
+        qemu_chr_fe_set_handlers_full(&d->backends[i].fe,
                                       hub_chr_can_read,
                                       hub_chr_read,
                                       hub_chr_event,
diff --git a/chardev/char-mux.c b/chardev/char-mux.c
index 6b36290e2c..db9e89f441 100644
--- a/chardev/char-mux.c
+++ b/chardev/char-mux.c
@@ -128,10 +128,10 @@ static void mux_print_help(Chardev *chr)
 static void mux_chr_send_event(MuxChardev *d, unsigned int mux_nr,
                                QEMUChrEvent event)
 {
-    CharBackend *be = d->backends[mux_nr];
+    CharFrontend *fe = d->frontends[mux_nr];
 
-    if (be && be->chr_event) {
-        be->chr_event(be->opaque, event);
+    if (fe && fe->chr_event) {
+        fe->chr_event(fe->opaque, event);
     }
 }
 
@@ -200,11 +200,11 @@ static void mux_chr_accept_input(Chardev *chr)
 {
     MuxChardev *d = MUX_CHARDEV(chr);
     int m = d->focus;
-    CharBackend *be = d->backends[m];
+    CharFrontend *fe = d->frontends[m];
 
-    while (be && d->prod[m] != d->cons[m] &&
-           be->chr_can_read && be->chr_can_read(be->opaque)) {
-        be->chr_read(be->opaque,
+    while (fe && d->prod[m] != d->cons[m] &&
+           fe->chr_can_read && fe->chr_can_read(fe->opaque)) {
+        fe->chr_read(fe->opaque,
                      &d->buffer[m][d->cons[m]++ & MUX_BUFFER_MASK], 1);
     }
 }
@@ -213,14 +213,14 @@ static int mux_chr_can_read(void *opaque)
 {
     MuxChardev *d = MUX_CHARDEV(opaque);
     int m = d->focus;
-    CharBackend *be = d->backends[m];
+    CharFrontend *fe = d->frontends[m];
 
     if ((d->prod[m] - d->cons[m]) < MUX_BUFFER_SIZE) {
         return 1;
     }
 
-    if (be && be->chr_can_read) {
-        return be->chr_can_read(be->opaque);
+    if (fe && fe->chr_can_read) {
+        return fe->chr_can_read(fe->opaque);
     }
 
     return 0;
@@ -231,7 +231,7 @@ static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
     Chardev *chr = CHARDEV(opaque);
     MuxChardev *d = MUX_CHARDEV(opaque);
     int m = d->focus;
-    CharBackend *be = d->backends[m];
+    CharFrontend *fe = d->frontends[m];
     int i;
 
     mux_chr_accept_input(opaque);
@@ -239,9 +239,9 @@ static void mux_chr_read(void *opaque, const uint8_t *buf, int size)
     for (i = 0; i < size; i++)
         if (mux_proc_byte(chr, d, buf[i])) {
             if (d->prod[m] == d->cons[m] &&
-                be && be->chr_can_read &&
-                be->chr_can_read(be->opaque)) {
-                be->chr_read(be->opaque, &buf[i], 1);
+                fe && fe->chr_can_read &&
+                fe->chr_can_read(fe->opaque)) {
+                fe->chr_read(fe->opaque, &buf[i], 1);
             } else {
                 d->buffer[m][d->prod[m]++ & MUX_BUFFER_MASK] = buf[i];
             }
@@ -289,9 +289,9 @@ static void char_mux_finalize(Object *obj)
 
     bit = -1;
     while ((bit = find_next_bit(&d->mux_bitset, MAX_MUX, bit + 1)) < MAX_MUX) {
-        CharBackend *be = d->backends[bit];
+        CharFrontend *be = d->frontends[bit];
         be->chr = NULL;
-        d->backends[bit] = NULL;
+        d->frontends[bit] = NULL;
     }
     d->mux_bitset = 0;
     qemu_chr_fe_deinit(&d->chr, false);
@@ -311,7 +311,7 @@ static void mux_chr_update_read_handlers(Chardev *chr)
                                   chr->gcontext, true, false);
 }
 
-bool mux_chr_attach_frontend(MuxChardev *d, CharBackend *b,
+bool mux_chr_attach_frontend(MuxChardev *d, CharFrontend *c,
                              unsigned int *tag, Error **errp)
 {
     unsigned int bit;
@@ -328,7 +328,7 @@ bool mux_chr_attach_frontend(MuxChardev *d, CharBackend *b,
     }
 
     d->mux_bitset |= (1ul << bit);
-    d->backends[bit] = b;
+    d->frontends[bit] = c;
     *tag = bit;
 
     return true;
@@ -341,7 +341,7 @@ bool mux_chr_detach_frontend(MuxChardev *d, unsigned int tag)
     }
 
     d->mux_bitset &= ~(1ul << tag);
-    d->backends[tag] = NULL;
+    d->frontends[tag] = NULL;
 
     return true;
 }
@@ -357,7 +357,7 @@ void mux_set_focus(Chardev *chr, unsigned int focus)
     }
 
     d->focus = focus;
-    chr->be = d->backends[focus];
+    chr->fe = d->frontends[focus];
     mux_chr_send_event(d, d->focus, CHR_EVENT_MUX_IN);
 }
 
diff --git a/chardev/char.c b/chardev/char.c
index bbebd246c3..30b21fedce 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -53,13 +53,13 @@ Object *get_chardevs_root(void)
 
 static void chr_be_event(Chardev *s, QEMUChrEvent event)
 {
-    CharBackend *be = s->be;
+    CharFrontend *fe = s->fe;
 
-    if (!be || !be->chr_event) {
+    if (!fe || !fe->chr_event) {
         return;
     }
 
-    be->chr_event(be->opaque, event);
+    fe->chr_event(fe->opaque, event);
 }
 
 void qemu_chr_be_event(Chardev *s, QEMUChrEvent event)
@@ -197,21 +197,21 @@ int qemu_chr_write(Chardev *s, const uint8_t *buf, int len, bool write_all)
 
 int qemu_chr_be_can_write(Chardev *s)
 {
-    CharBackend *be = s->be;
+    CharFrontend *fe = s->fe;
 
-    if (!be || !be->chr_can_read) {
+    if (!fe || !fe->chr_can_read) {
         return 0;
     }
 
-    return be->chr_can_read(be->opaque);
+    return fe->chr_can_read(fe->opaque);
 }
 
 void qemu_chr_be_write_impl(Chardev *s, const uint8_t *buf, int len)
 {
-    CharBackend *be = s->be;
+    CharFrontend *fe = s->fe;
 
-    if (be && be->chr_read) {
-        be->chr_read(be->opaque, buf, len);
+    if (fe && fe->chr_read) {
+        fe->chr_read(fe->opaque, buf, len);
     }
 }
 
@@ -307,8 +307,8 @@ static void char_finalize(Object *obj)
 {
     Chardev *chr = CHARDEV(obj);
 
-    if (chr->be) {
-        chr->be->chr = NULL;
+    if (chr->fe) {
+        chr->fe->chr = NULL;
     }
     g_free(chr->filename);
     g_free(chr->label);
@@ -335,7 +335,7 @@ static bool qemu_chr_is_busy(Chardev *s)
         MuxChardev *d = MUX_CHARDEV(s);
         return d->mux_bitset != 0;
     } else {
-        return s->be != NULL;
+        return s->fe != NULL;
     }
 }
 
@@ -798,7 +798,7 @@ static int qmp_query_chardev_foreach(Object *obj, void *data)
 
     value->label = g_strdup(chr->label);
     value->filename = g_strdup(chr->filename);
-    value->frontend_open = chr->be && chr->be->fe_is_open;
+    value->frontend_open = chr->fe && chr->fe->fe_is_open;
 
     QAPI_LIST_PREPEND(*list, value);
 
@@ -1112,7 +1112,7 @@ err:
 ChardevReturn *qmp_chardev_change(const char *id, ChardevBackend *backend,
                                   Error **errp)
 {
-    CharBackend *be;
+    CharFrontend *fe;
     const ChardevClass *cc, *cc_new;
     Chardev *chr, *chr_new;
     bool closed_sent = false;
@@ -1136,14 +1136,14 @@ ChardevReturn *qmp_chardev_change(const char *id, ChardevBackend *backend,
         return NULL;
     }
 
-    be = chr->be;
-    if (!be) {
+    fe = chr->fe;
+    if (!fe) {
         /* easy case */
         object_unparent(OBJECT(chr));
         return qmp_chardev_add(id, backend, errp);
     }
 
-    if (!be->chr_be_change) {
+    if (!fe->chr_be_change) {
         error_setg(errp, "Chardev user does not support chardev hotswap");
         return NULL;
     }
@@ -1171,13 +1171,13 @@ ChardevReturn *qmp_chardev_change(const char *id, ChardevBackend *backend,
         closed_sent = true;
     }
 
-    chr->be = NULL;
-    qemu_chr_fe_init(be, chr_new, &error_abort);
+    chr->fe = NULL;
+    qemu_chr_fe_init(fe, chr_new, &error_abort);
 
-    if (be->chr_be_change(be->opaque) < 0) {
+    if (fe->chr_be_change(fe->opaque) < 0) {
         error_setg(errp, "Chardev '%s' change failed", chr_new->label);
-        chr_new->be = NULL;
-        qemu_chr_fe_init(be, chr, &error_abort);
+        chr_new->fe = NULL;
+        qemu_chr_fe_init(fe, chr, &error_abort);
         if (closed_sent) {
             qemu_chr_be_event(chr, CHR_EVENT_OPENED);
         }
diff --git a/chardev/chardev-internal.h b/chardev/chardev-internal.h
index 9752dd75f7..8ea10414ab 100644
--- a/chardev/chardev-internal.h
+++ b/chardev/chardev-internal.h
@@ -37,9 +37,9 @@
 struct MuxChardev {
     Chardev parent;
     /* Linked frontends */
-    CharBackend *backends[MAX_MUX];
-    /* Linked backend */
-    CharBackend chr;
+    CharFrontend *frontends[MAX_MUX];
+    /* frontend of the underlying muxed chardev */
+    CharFrontend chr;
     unsigned long mux_bitset;
     int focus;
     bool term_got_escape;
@@ -64,8 +64,8 @@ typedef struct HubCharBackend HubCharBackend;
  * `hub->backends` array
  */
 struct HubCharBackend {
-    HubChardev   *hub;
-    CharBackend  be;
+    HubChardev *hub;
+    CharFrontend fe;
     unsigned int be_ind;
 };
 
@@ -108,7 +108,7 @@ DECLARE_INSTANCE_CHECKER(HubChardev, HUB_CHARDEV,
 #define CHARDEV_IS_HUB(chr)                                \
     object_dynamic_cast(OBJECT(chr), TYPE_CHARDEV_HUB)
 
-bool mux_chr_attach_frontend(MuxChardev *d, CharBackend *b,
+bool mux_chr_attach_frontend(MuxChardev *d, CharFrontend *c,
                              unsigned int *tag, Error **errp);
 bool mux_chr_detach_frontend(MuxChardev *d, unsigned int tag);
 void mux_set_focus(Chardev *chr, unsigned int focus);
diff --git a/gdbstub/system.c b/gdbstub/system.c
index 5221c579d9..e2220c1ae4 100644
--- a/gdbstub/system.c
+++ b/gdbstub/system.c
@@ -34,7 +34,7 @@
 
 /* System emulation specific state */
 typedef struct {
-    CharBackend chr;
+    CharFrontend chr;
     Chardev *mon_chr;
 } GDBSystemState;
 
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index 229c98ddd9..059b07907d 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -927,7 +927,7 @@ struct StrongARMUARTState {
     SysBusDevice parent_obj;
 
     MemoryRegion iomem;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
 
     uint8_t utcr0;
diff --git a/hw/char/debugcon.c b/hw/char/debugcon.c
index bf44aaf9e4..bb323adda5 100644
--- a/hw/char/debugcon.c
+++ b/hw/char/debugcon.c
@@ -40,7 +40,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(ISADebugconState, ISA_DEBUGCON_DEVICE)
 
 typedef struct DebugconState {
     MemoryRegion io;
-    CharBackend chr;
+    CharFrontend chr;
     uint32_t readback;
 } DebugconState;
 
diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index 6521b4cedd..9e45d81990 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -154,7 +154,7 @@ struct Exynos4210UartState {
     QEMUTimer *fifo_timeout_timer;
     uint64_t wordtime;        /* word time in ns */
 
-    CharBackend       chr;
+    CharFrontend       chr;
     qemu_irq          irq;
     qemu_irq          dmairq;
 
diff --git a/hw/char/grlib_apbuart.c b/hw/char/grlib_apbuart.c
index 81c26e3389..b2d5a40bb4 100644
--- a/hw/char/grlib_apbuart.c
+++ b/hw/char/grlib_apbuart.c
@@ -84,7 +84,7 @@ struct UART {
     MemoryRegion iomem;
     qemu_irq irq;
 
-    CharBackend chr;
+    CharFrontend chr;
 
     /* registers */
     uint32_t status;
diff --git a/hw/char/ipoctal232.c b/hw/char/ipoctal232.c
index 752c6c818a..d0108d0b9a 100644
--- a/hw/char/ipoctal232.c
+++ b/hw/char/ipoctal232.c
@@ -99,7 +99,7 @@ typedef struct SCC2698Block SCC2698Block;
 
 struct SCC2698Channel {
     IPOctalState *ipoctal;
-    CharBackend dev;
+    CharFrontend dev;
     bool rx_enabled;
     uint8_t mr[2];
     uint8_t mr_idx;
diff --git a/hw/char/mcf_uart.c b/hw/char/mcf_uart.c
index 87bfcbebdc..f14de59530 100644
--- a/hw/char/mcf_uart.c
+++ b/hw/char/mcf_uart.c
@@ -36,7 +36,7 @@ struct mcf_uart_state {
     int tx_enabled;
     int rx_enabled;
     qemu_irq irq;
-    CharBackend chr;
+    CharFrontend chr;
 };
 
 #define TYPE_MCF_UART "mcf-uart"
diff --git a/hw/char/sclpconsole-lm.c b/hw/char/sclpconsole-lm.c
index 3e40d5e434..c51308f9c5 100644
--- a/hw/char/sclpconsole-lm.c
+++ b/hw/char/sclpconsole-lm.c
@@ -41,7 +41,7 @@ typedef struct OprtnsCommand {
 
 struct SCLPConsoleLM {
     SCLPEvent event;
-    CharBackend chr;
+    CharFrontend chr;
     bool echo;                  /* immediate echo of input if true        */
     uint32_t write_errors;      /* errors writing to char layer           */
     uint32_t length;            /* length of byte stream in buffer        */
diff --git a/hw/char/sclpconsole.c b/hw/char/sclpconsole.c
index 95e3045178..2abf861dbc 100644
--- a/hw/char/sclpconsole.c
+++ b/hw/char/sclpconsole.c
@@ -35,7 +35,7 @@ typedef struct ASCIIConsoleData {
 
 struct SCLPConsole {
     SCLPEvent event;
-    CharBackend chr;
+    CharFrontend chr;
     uint8_t iov[SIZE_BUFFER_VT220];
     uint32_t iov_sclp;      /* offset in buf for SCLP read operation       */
     uint32_t iov_bs;        /* offset in buf for char layer read operation */
diff --git a/hw/char/sh_serial.c b/hw/char/sh_serial.c
index 30447fa018..83227a84a6 100644
--- a/hw/char/sh_serial.c
+++ b/hw/char/sh_serial.c
@@ -67,7 +67,7 @@ struct SHSerialState {
     int flags;
     int rtrg;
 
-    CharBackend chr;
+    CharFrontend chr;
     QEMUTimer fifo_timeout_timer;
     uint64_t etu; /* Elementary Time Unit (ns) */
 
diff --git a/hw/char/spapr_vty.c b/hw/char/spapr_vty.c
index fc8ea604f8..766b2bfcac 100644
--- a/hw/char/spapr_vty.c
+++ b/hw/char/spapr_vty.c
@@ -14,7 +14,7 @@
 
 struct SpaprVioVty {
     SpaprVioDevice sdev;
-    CharBackend chardev;
+    CharFrontend chardev;
     uint32_t in, out;
     uint8_t buf[VTERM_BUFSIZE];
 };
diff --git a/hw/char/terminal3270.c b/hw/char/terminal3270.c
index d950c17292..c993f67b42 100644
--- a/hw/char/terminal3270.c
+++ b/hw/char/terminal3270.c
@@ -30,7 +30,7 @@
 
 struct Terminal3270 {
     EmulatedCcw3270Device cdev;
-    CharBackend chr;
+    CharFrontend chr;
     uint8_t inv[INPUT_BUFFER_SIZE];
     uint8_t outv[OUTPUT_BUFFER_SIZE];
     int in_len;
diff --git a/hw/char/virtio-console.c b/hw/char/virtio-console.c
index 0932a3572b..1b669c9be8 100644
--- a/hw/char/virtio-console.c
+++ b/hw/char/virtio-console.c
@@ -30,7 +30,7 @@ DECLARE_INSTANCE_CHECKER(VirtConsole, VIRTIO_CONSOLE,
 struct VirtConsole {
     VirtIOSerialPort parent_obj;
 
-    CharBackend chr;
+    CharFrontend chr;
     guint watch;
 };
 
diff --git a/hw/char/xen_console.c b/hw/char/xen_console.c
index 9c34a554bf..462476553f 100644
--- a/hw/char/xen_console.c
+++ b/hw/char/xen_console.c
@@ -53,7 +53,7 @@ struct XenConsole {
     char              *fe_path;
     unsigned int      ring_ref;
     void              *sring;
-    CharBackend       chr;
+    CharFrontend       chr;
     int               backlog;
 };
 typedef struct XenConsole XenConsole;
diff --git a/hw/char/xilinx_uartlite.c b/hw/char/xilinx_uartlite.c
index 8008171eea..8feb58a898 100644
--- a/hw/char/xilinx_uartlite.c
+++ b/hw/char/xilinx_uartlite.c
@@ -60,7 +60,7 @@ struct XilinxUARTLite {
 
     EndianMode model_endianness;
     MemoryRegion mmio;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
 
     uint8_t rx_fifo[8];
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 1f810b7ddf..c15371f8cd 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -258,10 +258,10 @@ const PropertyInfo qdev_prop_drive_iothread = {
 static void get_chr(Object *obj, Visitor *v, const char *name, void *opaque,
                     Error **errp)
 {
-    CharBackend *be = object_field_prop_ptr(obj, opaque);
+    CharFrontend *fe = object_field_prop_ptr(obj, opaque);
     char *p;
 
-    p = g_strdup(be->chr && be->chr->label ? be->chr->label : "");
+    p = g_strdup(fe->chr && fe->chr->label ? fe->chr->label : "");
     visit_type_str(v, name, &p, errp);
     g_free(p);
 }
@@ -271,7 +271,7 @@ static void set_chr(Object *obj, Visitor *v, const char *name, void *opaque,
 {
     ERRP_GUARD();
     const Property *prop = opaque;
-    CharBackend *be = object_field_prop_ptr(obj, prop);
+    CharFrontend *fe = object_field_prop_ptr(obj, prop);
     Chardev *s;
     char *str;
 
@@ -283,13 +283,13 @@ static void set_chr(Object *obj, Visitor *v, const char *name, void *opaque,
      * TODO Should this really be an error?  If no, the old value
      * needs to be released before we store the new one.
      */
-    if (!check_prop_still_unset(obj, name, be->chr, str, false, errp)) {
+    if (!check_prop_still_unset(obj, name, fe->chr, str, false, errp)) {
         return;
     }
 
     if (!*str) {
         g_free(str);
-        be->chr = NULL;
+        fe->chr = NULL;
         return;
     }
 
@@ -297,7 +297,7 @@ static void set_chr(Object *obj, Visitor *v, const char *name, void *opaque,
     if (s == NULL) {
         error_setg(errp, "Property '%s.%s' can't find value '%s'",
                    object_get_typename(obj), name, str);
-    } else if (!qemu_chr_fe_init(be, s, errp)) {
+    } else if (!qemu_chr_fe_init(fe, s, errp)) {
         error_prepend(errp, "Property '%s.%s' can't take value '%s': ",
                       object_get_typename(obj), name, str);
     }
@@ -307,9 +307,9 @@ static void set_chr(Object *obj, Visitor *v, const char *name, void *opaque,
 static void release_chr(Object *obj, const char *name, void *opaque)
 {
     const Property *prop = opaque;
-    CharBackend *be = object_field_prop_ptr(obj, prop);
+    CharFrontend *fe = object_field_prop_ptr(obj, prop);
 
-    qemu_chr_fe_deinit(be, false);
+    qemu_chr_fe_deinit(fe, false);
 }
 
 const PropertyInfo qdev_prop_chr = {
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index cddca69b93..570bfb2736 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -149,7 +149,7 @@ static void io_cpu_write(void *opaque, hwaddr addr,
         ch = val;
         debugout = serial_hd(0);
         if (debugout) {
-            qemu_chr_fe_write_all(debugout->be, &ch, 1);
+            qemu_chr_fe_write_all(debugout->fe, &ch, 1);
         } else {
             fprintf(stderr, "%c", ch);
         }
diff --git a/hw/ipmi/ipmi_bmc_extern.c b/hw/ipmi/ipmi_bmc_extern.c
index 9f1ba7b2f8..2c6c515579 100644
--- a/hw/ipmi/ipmi_bmc_extern.c
+++ b/hw/ipmi/ipmi_bmc_extern.c
@@ -67,7 +67,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(IPMIBmcExtern, IPMI_BMC_EXTERN)
 struct IPMIBmcExtern {
     IPMIBmc parent;
 
-    CharBackend chr;
+    CharFrontend chr;
 
     bool connected;
 
diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index 149a263bd5..8ecac41d47 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -68,7 +68,7 @@ struct BostonState {
     SerialMM *uart;
     Clock *cpuclk;
 
-    CharBackend lcd_display;
+    CharFrontend lcd_display;
     char lcd_content[8];
     bool lcd_inited;
 
diff --git a/hw/mips/malta.c b/hw/mips/malta.c
index 02da629b5a..a3b7632ad9 100644
--- a/hw/mips/malta.c
+++ b/hw/mips/malta.c
@@ -89,7 +89,7 @@ typedef struct {
     uint32_t i2coe;
     uint32_t i2cout;
     uint32_t i2csel;
-    CharBackend display;
+    CharFrontend display;
     char display_text[9];
     SerialMM *uart;
     bool display_inited;
diff --git a/hw/misc/ivshmem-pci.c b/hw/misc/ivshmem-pci.c
index 2748db9286..636d0b83de 100644
--- a/hw/misc/ivshmem-pci.c
+++ b/hw/misc/ivshmem-pci.c
@@ -94,7 +94,7 @@ struct IVShmemState {
 
     /* exactly one of these two may be set */
     HostMemoryBackend *hostmem; /* with interrupts */
-    CharBackend server_chr; /* without interrupts */
+    CharFrontend server_chr; /* without interrupts */
 
     /* registers */
     uint32_t intrmask;
diff --git a/hw/ppc/spapr_rtas.c b/hw/ppc/spapr_rtas.c
index 1f78fe406e..a6715b4026 100644
--- a/hw/ppc/spapr_rtas.c
+++ b/hw/ppc/spapr_rtas.c
@@ -623,7 +623,7 @@ static uint64_t qtest_rtas_call(char *cmd, uint32_t nargs, uint64_t args,
     return H_PARAMETER;
 }
 
-static bool spapr_qtest_callback(CharBackend *chr, gchar **words)
+static bool spapr_qtest_callback(CharFrontend *chr, gchar **words)
 {
     if (strcmp(words[0], "rtas") == 0) {
         uint64_t res, args, ret;
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index 7f2676008c..4d51a93dd5 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -78,7 +78,7 @@ static void csr_call(char *cmd, uint64_t cpu_num, int csrno, uint64_t *val)
     g_assert(ret == RISCV_EXCP_NONE);
 }
 
-static bool csr_qtest_callback(CharBackend *chr, gchar **words)
+static bool csr_qtest_callback(CharFrontend *chr, gchar **words)
 {
     if (strcmp(words[0], "csr") == 0) {
 
diff --git a/hw/usb/ccid-card-passthru.c b/hw/usb/ccid-card-passthru.c
index 1eea21a733..c8aada0988 100644
--- a/hw/usb/ccid-card-passthru.c
+++ b/hw/usb/ccid-card-passthru.c
@@ -56,7 +56,7 @@ typedef struct PassthruState PassthruState;
 
 struct PassthruState {
     CCIDCardState base;
-    CharBackend cs;
+    CharFrontend cs;
     uint8_t  vscard_in_data[VSCARD_IN_SIZE];
     uint32_t vscard_in_pos;
     uint32_t vscard_in_hdr;
diff --git a/hw/usb/dev-serial.c b/hw/usb/dev-serial.c
index 1c116d8b0f..2eb52b2e01 100644
--- a/hw/usb/dev-serial.c
+++ b/hw/usb/dev-serial.c
@@ -105,7 +105,7 @@ struct USBSerialState {
     uint8_t xoff;
     QEMUSerialSetParams params;
     int latency;        /* ms */
-    CharBackend cs;
+    CharFrontend cs;
 };
 
 #define TYPE_USB_SERIAL "usb-serial-dev"
diff --git a/hw/usb/redirect.c b/hw/usb/redirect.c
index f516ff42a1..d603a4a6f9 100644
--- a/hw/usb/redirect.c
+++ b/hw/usb/redirect.c
@@ -113,7 +113,7 @@ struct PacketIdQueue {
 struct USBRedirDevice {
     USBDevice dev;
     /* Properties */
-    CharBackend cs;
+    CharFrontend cs;
     bool enable_streams;
     bool suppress_remote_wake;
     bool in_write;
diff --git a/hw/virtio/vhost-stub.c b/hw/virtio/vhost-stub.c
index 52d42adab2..7321dc9210 100644
--- a/hw/virtio/vhost-stub.c
+++ b/hw/virtio/vhost-stub.c
@@ -12,7 +12,7 @@ unsigned int vhost_get_free_memslots(void)
     return UINT_MAX;
 }
 
-bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp)
+bool vhost_user_init(VhostUserState *user, CharFrontend *chr, Error **errp)
 {
     return false;
 }
diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 36c9c2e04d..aac98f898a 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -275,7 +275,7 @@ struct scrub_regions {
 static int vhost_user_read_header(struct vhost_dev *dev, VhostUserMsg *msg)
 {
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     uint8_t *p = (uint8_t *) msg;
     int r, size = VHOST_USER_HDR_SIZE;
 
@@ -303,7 +303,7 @@ static int vhost_user_read_header(struct vhost_dev *dev, VhostUserMsg *msg)
 static int vhost_user_read(struct vhost_dev *dev, VhostUserMsg *msg)
 {
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     uint8_t *p = (uint8_t *) msg;
     int r, size;
 
@@ -383,7 +383,7 @@ static int vhost_user_write(struct vhost_dev *dev, VhostUserMsg *msg,
                             int *fds, int fd_num)
 {
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     int ret, size = VHOST_USER_HDR_SIZE + msg->hdr.size;
 
     /*
@@ -1680,7 +1680,7 @@ int vhost_user_get_shared_object(struct vhost_dev *dev, unsigned char *uuid,
                                  int *dmabuf_fd)
 {
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     int ret;
     VhostUserMsg msg = {
         .hdr.request = VHOST_USER_GET_SHARED_OBJECT,
@@ -1721,7 +1721,7 @@ vhost_user_backend_handle_shared_object_lookup(struct vhost_user *u,
                                                VhostUserPayload *payload)
 {
     QemuUUID uuid;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     Error *local_err = NULL;
     int dmabuf_fd = -1;
     int fd_num = 0;
@@ -2004,7 +2004,7 @@ static int vhost_user_postcopy_advise(struct vhost_dev *dev, Error **errp)
 {
 #ifdef CONFIG_LINUX
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     int ufd;
     int ret;
     VhostUserMsg msg = {
@@ -2670,7 +2670,7 @@ static int vhost_user_get_inflight_fd(struct vhost_dev *dev,
     int fd;
     int ret;
     struct vhost_user *u = dev->opaque;
-    CharBackend *chr = u->user->chr;
+    CharFrontend *chr = u->user->chr;
     VhostUserMsg msg = {
         .hdr.request = VHOST_USER_GET_INFLIGHT_FD,
         .hdr.flags = VHOST_USER_VERSION,
@@ -2761,7 +2761,7 @@ static void vhost_user_state_destroy(gpointer data)
     vhost_user_host_notifier_remove(n, NULL, true);
 }
 
-bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp)
+bool vhost_user_init(VhostUserState *user, CharFrontend *chr, Error **errp)
 {
     if (user->chr) {
         error_setg(errp, "Cannot initialize vhost-user state");
@@ -2787,7 +2787,7 @@ void vhost_user_cleanup(VhostUserState *user)
 typedef struct {
     vu_async_close_fn cb;
     DeviceState *dev;
-    CharBackend *cd;
+    CharFrontend *cd;
     struct vhost_dev *vhost;
 } VhostAsyncCallback;
 
@@ -2806,7 +2806,7 @@ static void vhost_user_async_close_bh(void *opaque)
  * purposes.
  */
 void vhost_user_async_close(DeviceState *d,
-                            CharBackend *chardev, struct vhost_dev *vhost,
+                            CharFrontend *chardev, struct vhost_dev *vhost,
                             vu_async_close_fn cb)
 {
     if (!runstate_check(RUN_STATE_SHUTDOWN)) {
diff --git a/include/chardev/char-fe.h b/include/chardev/char-fe.h
index 8ef05b3dd0..5f8a6df17d 100644
--- a/include/chardev/char-fe.h
+++ b/include/chardev/char-fe.h
@@ -8,12 +8,12 @@ typedef void IOEventHandler(void *opaque, QEMUChrEvent event);
 typedef int BackendChangeHandler(void *opaque);
 
 /**
- * struct CharBackend - back end as seen by front end
+ * struct CharFrontend - Chardev as seen by front end
  * @fe_is_open: the front end is ready for IO
  *
  * The actual backend is Chardev
  */
-struct CharBackend {
+struct CharFrontend {
     Chardev *chr;
     IOEventHandler *chr_event;
     IOCanReadHandler *chr_can_read;
@@ -27,53 +27,52 @@ struct CharBackend {
 /**
  * qemu_chr_fe_init:
  *
- * Initializes a front end for the given CharBackend and
- * Chardev. Call qemu_chr_fe_deinit() to remove the association and
- * release the driver.
+ * Initializes the frontend @c for the given Chardev backend @s. Call
+ * qemu_chr_fe_deinit() to remove the association and release the backend.
  *
  * Returns: false on error.
  */
-bool qemu_chr_fe_init(CharBackend *b, Chardev *s, Error **errp);
+bool qemu_chr_fe_init(CharFrontend *c, Chardev *be, Error **errp);
 
 /**
  * qemu_chr_fe_deinit:
- * @b: a CharBackend
+ * @c: a CharFrontend
  * @del: if true, delete the chardev backend
 *
- * Dissociate the CharBackend from the Chardev.
+ * Dissociate the CharFrontend from the Chardev.
  *
  * Safe to call without associated Chardev.
  */
-void qemu_chr_fe_deinit(CharBackend *b, bool del);
+void qemu_chr_fe_deinit(CharFrontend *c, bool del);
 
 /**
  * qemu_chr_fe_get_driver:
  *
- * Returns: the driver associated with a CharBackend or NULL if no
+ * Returns: the driver associated with a CharFrontend or NULL if no
  * associated Chardev.
  * Note: avoid this function as the driver should never be accessed directly,
  *       especially by the frontends that support chardevice hotswap.
  *       Consider qemu_chr_fe_backend_connected() to check for driver existence
  */
-Chardev *qemu_chr_fe_get_driver(CharBackend *be);
+Chardev *qemu_chr_fe_get_driver(CharFrontend *c);
 
 /**
  * qemu_chr_fe_backend_connected:
  *
- * Returns: true if there is a chardevice associated with @be.
+ * Returns: true if there is a backend associated with @c.
  */
-bool qemu_chr_fe_backend_connected(CharBackend *be);
+bool qemu_chr_fe_backend_connected(CharFrontend *c);
 
 /**
  * qemu_chr_fe_backend_open:
  *
- * Returns: true if chardevice associated with @be is open.
+ * Returns: true if the backend associated with @c is open.
  */
-bool qemu_chr_fe_backend_open(CharBackend *be);
+bool qemu_chr_fe_backend_open(CharFrontend *c);
 
 /**
  * qemu_chr_fe_set_handlers_full:
- * @b: a CharBackend
+ * @c: a CharFrontend
  * @fd_can_read: callback to get the amount of data the frontend may
  *               receive
  * @fd_read: callback to receive data from char
@@ -91,7 +90,7 @@ bool qemu_chr_fe_backend_open(CharBackend *be);
  *
  * Without associated Chardev, nothing is changed.
  */
-void qemu_chr_fe_set_handlers_full(CharBackend *b,
+void qemu_chr_fe_set_handlers_full(CharFrontend *c,
                                    IOCanReadHandler *fd_can_read,
                                    IOReadHandler *fd_read,
                                    IOEventHandler *fd_event,
@@ -106,7 +105,7 @@ void qemu_chr_fe_set_handlers_full(CharBackend *b,
  *
  * Version of qemu_chr_fe_set_handlers_full() with sync_state = true.
  */
-void qemu_chr_fe_set_handlers(CharBackend *b,
+void qemu_chr_fe_set_handlers(CharFrontend *c,
                               IOCanReadHandler *fd_can_read,
                               IOReadHandler *fd_read,
                               IOEventHandler *fd_event,
@@ -122,14 +121,14 @@ void qemu_chr_fe_set_handlers(CharBackend *b,
  *
  * Without associated Chardev, nothing is changed.
  */
-void qemu_chr_fe_take_focus(CharBackend *b);
+void qemu_chr_fe_take_focus(CharFrontend *c);
 
 /**
  * qemu_chr_fe_accept_input:
  *
  * Notify that the frontend is ready to receive data
  */
-void qemu_chr_fe_accept_input(CharBackend *be);
+void qemu_chr_fe_accept_input(CharFrontend *c);
 
 /**
  * qemu_chr_fe_disconnect:
@@ -137,7 +136,7 @@ void qemu_chr_fe_accept_input(CharBackend *be);
  * Close a fd accepted by character backend.
  * Without associated Chardev, do nothing.
  */
-void qemu_chr_fe_disconnect(CharBackend *be);
+void qemu_chr_fe_disconnect(CharFrontend *c);
 
 /**
  * qemu_chr_fe_wait_connected:
@@ -145,7 +144,7 @@ void qemu_chr_fe_disconnect(CharBackend *be);
  * Wait for character backend to be connected, return < 0 on error or
  * if no associated Chardev.
  */
-int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp);
+int qemu_chr_fe_wait_connected(CharFrontend *c, Error **errp);
 
 /**
  * qemu_chr_fe_set_echo:
@@ -156,17 +155,17 @@ int qemu_chr_fe_wait_connected(CharBackend *be, Error **errp);
  * can see what you type if you try to type QMP commands.
  * Without associated Chardev, do nothing.
  */
-void qemu_chr_fe_set_echo(CharBackend *be, bool echo);
+void qemu_chr_fe_set_echo(CharFrontend *c, bool echo);
 
 /**
  * qemu_chr_fe_set_open:
- * @be: a CharBackend
+ * @c: a CharFrontend
  * @is_open: the front end open status
  *
  * This is an indication that the front end is ready (or not) to begin
  * doing I/O. Without associated Chardev, do nothing.
  */
-void qemu_chr_fe_set_open(CharBackend *be, bool is_open);
+void qemu_chr_fe_set_open(CharFrontend *c, bool is_open);
 
 /**
  * qemu_chr_fe_printf:
@@ -176,7 +175,7 @@ void qemu_chr_fe_set_open(CharBackend *be, bool is_open);
  * function is thread-safe. It does nothing without associated
  * Chardev.
  */
-void qemu_chr_fe_printf(CharBackend *be, const char *fmt, ...)
+void qemu_chr_fe_printf(CharFrontend *c, const char *fmt, ...)
     G_GNUC_PRINTF(2, 3);
 
 
@@ -215,7 +214,7 @@ typedef gboolean (*FEWatchFunc)(void *do_not_use, GIOCondition condition, void *
  *
  * Returns: the source tag
  */
-guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
+guint qemu_chr_fe_add_watch(CharFrontend *c, GIOCondition cond,
                             FEWatchFunc func, void *user_data);
 
 /**
@@ -230,7 +229,7 @@ guint qemu_chr_fe_add_watch(CharBackend *be, GIOCondition cond,
  * Returns: the number of bytes consumed (0 if no associated Chardev)
  *          or -1 on error.
  */
-int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
+int qemu_chr_fe_write(CharFrontend *c, const uint8_t *buf, int len);
 
 /**
  * qemu_chr_fe_write_all:
@@ -245,7 +244,7 @@ int qemu_chr_fe_write(CharBackend *be, const uint8_t *buf, int len);
  * Returns: the number of bytes consumed (0 if no associated Chardev)
  *          or -1 on error.
  */
-int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
+int qemu_chr_fe_write_all(CharFrontend *c, const uint8_t *buf, int len);
 
 /**
  * qemu_chr_fe_read_all:
@@ -257,7 +256,7 @@ int qemu_chr_fe_write_all(CharBackend *be, const uint8_t *buf, int len);
  * Returns: the number of bytes read (0 if no associated Chardev)
  *          or -1 on error.
  */
-int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len);
+int qemu_chr_fe_read_all(CharFrontend *c, uint8_t *buf, int len);
 
 /**
  * qemu_chr_fe_ioctl:
@@ -270,7 +269,7 @@ int qemu_chr_fe_read_all(CharBackend *be, uint8_t *buf, int len);
  *          associated Chardev, -ENOTSUP, otherwise the return
  *          value depends on the semantics of @cmd
  */
-int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg);
+int qemu_chr_fe_ioctl(CharFrontend *c, int cmd, void *arg);
 
 /**
  * qemu_chr_fe_get_msgfd:
@@ -283,7 +282,7 @@ int qemu_chr_fe_ioctl(CharBackend *be, int cmd, void *arg);
  *          this function will return -1 until a client sends a new file
  *          descriptor.
  */
-int qemu_chr_fe_get_msgfd(CharBackend *be);
+int qemu_chr_fe_get_msgfd(CharFrontend *c);
 
 /**
  * qemu_chr_fe_get_msgfds:
@@ -296,7 +295,7 @@ int qemu_chr_fe_get_msgfd(CharBackend *be);
  *          this function will return -1 until a client sends a new set of file
  *          descriptors.
  */
-int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int num);
+int qemu_chr_fe_get_msgfds(CharFrontend *c, int *fds, int num);
 
 /**
  * qemu_chr_fe_set_msgfds:
@@ -309,6 +308,6 @@ int qemu_chr_fe_get_msgfds(CharBackend *be, int *fds, int num);
  *
  * Returns: -1 if fd passing isn't supported or no associated Chardev.
  */
-int qemu_chr_fe_set_msgfds(CharBackend *be, int *fds, int num);
+int qemu_chr_fe_set_msgfds(CharFrontend *c, int *fds, int num);
 
 #endif /* QEMU_CHAR_FE_H */
diff --git a/include/chardev/char.h b/include/chardev/char.h
index 429852f8d9..b65e9981c1 100644
--- a/include/chardev/char.h
+++ b/include/chardev/char.h
@@ -15,7 +15,7 @@
 #define IAC 255
 
 /* character device */
-typedef struct CharBackend CharBackend;
+typedef struct CharFrontend CharFrontend;
 
 typedef enum {
     CHR_EVENT_BREAK, /* serial break char */
@@ -60,7 +60,7 @@ struct Chardev {
     Object parent_obj;
 
     QemuMutex chr_write_lock;
-    CharBackend *be;
+    CharFrontend *fe;
     char *label;
     char *filename;
     int logfd;
diff --git a/include/hw/char/avr_usart.h b/include/hw/char/avr_usart.h
index 0cc599e9b1..bd2d488f9a 100644
--- a/include/hw/char/avr_usart.h
+++ b/include/hw/char/avr_usart.h
@@ -66,7 +66,7 @@ struct AVRUsartState {
     /* <public> */
     MemoryRegion mmio;
 
-    CharBackend chr;
+    CharFrontend chr;
 
     bool enabled;
 
diff --git a/include/hw/char/bcm2835_aux.h b/include/hw/char/bcm2835_aux.h
index 9e081793a0..a11134f216 100644
--- a/include/hw/char/bcm2835_aux.h
+++ b/include/hw/char/bcm2835_aux.h
@@ -24,7 +24,7 @@ struct BCM2835AuxState {
     /*< public >*/
 
     MemoryRegion iomem;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
 
     uint8_t read_fifo[BCM2835_AUX_RX_FIFO_LEN];
diff --git a/include/hw/char/cadence_uart.h b/include/hw/char/cadence_uart.h
index e7f7cd8468..c87c327357 100644
--- a/include/hw/char/cadence_uart.h
+++ b/include/hw/char/cadence_uart.h
@@ -47,7 +47,7 @@ struct CadenceUARTState {
     uint32_t rx_count;
     uint32_t tx_count;
     uint64_t char_tx_time;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
     QEMUTimer *fifo_trigger_handle;
     Clock *refclk;
diff --git a/include/hw/char/cmsdk-apb-uart.h b/include/hw/char/cmsdk-apb-uart.h
index 7de8f8d1b9..3d0af26ceb 100644
--- a/include/hw/char/cmsdk-apb-uart.h
+++ b/include/hw/char/cmsdk-apb-uart.h
@@ -25,7 +25,7 @@ struct CMSDKAPBUART {
 
     /*< public >*/
     MemoryRegion iomem;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq txint;
     qemu_irq rxint;
     qemu_irq txovrint;
diff --git a/include/hw/char/digic-uart.h b/include/hw/char/digic-uart.h
index f710a1a099..3eebdab8a0 100644
--- a/include/hw/char/digic-uart.h
+++ b/include/hw/char/digic-uart.h
@@ -38,7 +38,7 @@ struct DigicUartState {
     /*< public >*/
 
     MemoryRegion regs_region;
-    CharBackend chr;
+    CharFrontend chr;
 
     uint32_t reg_rx;
     uint32_t reg_st;
diff --git a/include/hw/char/escc.h b/include/hw/char/escc.h
index 8c4c6a7730..857f64699e 100644
--- a/include/hw/char/escc.h
+++ b/include/hw/char/escc.h
@@ -36,7 +36,7 @@ typedef struct ESCCChannelState {
     uint32_t reg;
     uint8_t wregs[ESCC_SERIAL_REGS], rregs[ESCC_SERIAL_REGS];
     ESCCSERIOQueue queue;
-    CharBackend chr;
+    CharFrontend chr;
     int e0_mode, led_mode, caps_lock_mode, num_lock_mode;
     int disabled;
     int clock;
diff --git a/include/hw/char/goldfish_tty.h b/include/hw/char/goldfish_tty.h
index d59733e5ae..70fdedd1d0 100644
--- a/include/hw/char/goldfish_tty.h
+++ b/include/hw/char/goldfish_tty.h
@@ -24,7 +24,7 @@ struct GoldfishTTYState {
 
     MemoryRegion iomem;
     qemu_irq irq;
-    CharBackend chr;
+    CharFrontend chr;
 
     uint32_t data_len;
     uint64_t data_ptr;
diff --git a/include/hw/char/ibex_uart.h b/include/hw/char/ibex_uart.h
index 9deadf223b..1ccbb602e6 100644
--- a/include/hw/char/ibex_uart.h
+++ b/include/hw/char/ibex_uart.h
@@ -64,7 +64,7 @@ struct IbexUartState {
 
     Clock *f_clk;
 
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq tx_watermark;
     qemu_irq rx_watermark;
     qemu_irq tx_empty;
diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index 90ba3ff18c..2dcd2e6bcd 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -122,7 +122,7 @@ struct IMXSerialState {
     uint32_t ucr4;
 
     qemu_irq irq;
-    CharBackend chr;
+    CharFrontend chr;
 };
 
 #endif
diff --git a/include/hw/char/max78000_uart.h b/include/hw/char/max78000_uart.h
index cf90d51dbf..ac93f83389 100644
--- a/include/hw/char/max78000_uart.h
+++ b/include/hw/char/max78000_uart.h
@@ -72,7 +72,7 @@ struct Max78000UartState {
 
     Fifo8 rx_fifo;
 
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
 };
 #endif /* HW_STM32F2XX_USART_H */
diff --git a/include/hw/char/nrf51_uart.h b/include/hw/char/nrf51_uart.h
index 561b6383c4..03d8c2a20d 100644
--- a/include/hw/char/nrf51_uart.h
+++ b/include/hw/char/nrf51_uart.h
@@ -59,7 +59,7 @@ struct NRF51UARTState {
     SysBusDevice parent_obj;
 
     MemoryRegion iomem;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
     guint watch_tag;
 
diff --git a/include/hw/char/parallel.h b/include/hw/char/parallel.h
index 7b04478226..3f8d9b59a7 100644
--- a/include/hw/char/parallel.h
+++ b/include/hw/char/parallel.h
@@ -15,7 +15,7 @@ typedef struct ParallelState {
     uint8_t control;
     qemu_irq irq;
     int irq_pending;
-    CharBackend chr;
+    CharFrontend chr;
     int hw_driver;
     int epp_timeout;
     uint32_t last_read_offset; /* For debugging */
diff --git a/include/hw/char/pl011.h b/include/hw/char/pl011.h
index 299ca9b18b..2d4ff01c81 100644
--- a/include/hw/char/pl011.h
+++ b/include/hw/char/pl011.h
@@ -47,7 +47,7 @@ struct PL011State {
     int read_pos;
     int read_count;
     int read_trigger;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq[6];
     Clock *clk;
     bool migrate_clk;
diff --git a/include/hw/char/renesas_sci.h b/include/hw/char/renesas_sci.h
index a4764e3eee..90e784f36a 100644
--- a/include/hw/char/renesas_sci.h
+++ b/include/hw/char/renesas_sci.h
@@ -33,7 +33,7 @@ struct RSCIState {
 
     MemoryRegion memory;
     QEMUTimer timer;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq[SCI_NR_IRQ];
 
     uint8_t smr;
diff --git a/include/hw/char/riscv_htif.h b/include/hw/char/riscv_htif.h
index ee0ca29902..9d61e60d0a 100644
--- a/include/hw/char/riscv_htif.h
+++ b/include/hw/char/riscv_htif.h
@@ -36,7 +36,7 @@ typedef struct HTIFState {
     hwaddr fromhost_offset;
     MemoryRegion mmio;
 
-    CharBackend chr;
+    CharFrontend chr;
     uint64_t pending_read;
 } HTIFState;
 
diff --git a/include/hw/char/serial.h b/include/hw/char/serial.h
index 4bf90a46f3..486c0e0f35 100644
--- a/include/hw/char/serial.h
+++ b/include/hw/char/serial.h
@@ -54,7 +54,7 @@ struct SerialState {
        it can be reset while reading iir */
     int thr_ipending;
     qemu_irq irq;
-    CharBackend chr;
+    CharFrontend chr;
     int last_break_enable;
     uint32_t baudbase;
     uint32_t tsr_retry;
diff --git a/include/hw/char/shakti_uart.h b/include/hw/char/shakti_uart.h
index 526c408233..e5e775d7c9 100644
--- a/include/hw/char/shakti_uart.h
+++ b/include/hw/char/shakti_uart.h
@@ -68,7 +68,7 @@ typedef struct {
     uint32_t uart_iq_cycles;
     uint32_t uart_rx_threshold;
 
-    CharBackend chr;
+    CharFrontend chr;
 } ShaktiUartState;
 
 #endif /* HW_SHAKTI_UART_H */
diff --git a/include/hw/char/sifive_uart.h b/include/hw/char/sifive_uart.h
index 0846cf6218..6486c3f4a5 100644
--- a/include/hw/char/sifive_uart.h
+++ b/include/hw/char/sifive_uart.h
@@ -67,7 +67,7 @@ struct SiFiveUARTState {
     /*< public >*/
     qemu_irq irq;
     MemoryRegion mmio;
-    CharBackend chr;
+    CharFrontend chr;
 
     uint32_t txfifo;
     uint32_t ie;
diff --git a/include/hw/char/stm32f2xx_usart.h b/include/hw/char/stm32f2xx_usart.h
index fdfa7424a7..f9018b8b8f 100644
--- a/include/hw/char/stm32f2xx_usart.h
+++ b/include/hw/char/stm32f2xx_usart.h
@@ -73,7 +73,7 @@ struct STM32F2XXUsartState {
     uint32_t usart_cr3;
     uint32_t usart_gtpr;
 
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
 };
 #endif /* HW_STM32F2XX_USART_H */
diff --git a/include/hw/char/stm32l4x5_usart.h b/include/hw/char/stm32l4x5_usart.h
index dd3866682a..cdf7419f53 100644
--- a/include/hw/char/stm32l4x5_usart.h
+++ b/include/hw/char/stm32l4x5_usart.h
@@ -53,7 +53,7 @@ struct Stm32l4x5UsartBaseState {
     uint32_t tdr;
 
     Clock *clk;
-    CharBackend chr;
+    CharFrontend chr;
     qemu_irq irq;
     guint watch_tag;
 };
diff --git a/include/hw/misc/ivshmem-flat.h b/include/hw/misc/ivshmem-flat.h
index 3eca99004e..d656e57808 100644
--- a/include/hw/misc/ivshmem-flat.h
+++ b/include/hw/misc/ivshmem-flat.h
@@ -65,7 +65,7 @@ struct IvshmemFTState {
     QTAILQ_HEAD(, IvshmemPeer) peer;
     IvshmemPeer own;
 
-    CharBackend server_chr;
+    CharFrontend server_chr;
 
     /* IRQ */
     qemu_irq irq;
diff --git a/include/hw/qdev-properties-system.h b/include/hw/qdev-properties-system.h
index 9601a11a09..5c6cc5eae8 100644
--- a/include/hw/qdev-properties-system.h
+++ b/include/hw/qdev-properties-system.h
@@ -38,7 +38,7 @@ extern const PropertyInfo qdev_prop_virtio_gpu_output_list;
     DEFINE_PROP_SIGNED(_n, _s, _f, _d, qdev_prop_pci_devfn, int32_t)
 
 #define DEFINE_PROP_CHR(_n, _s, _f)             \
-    DEFINE_PROP(_n, _s, _f, qdev_prop_chr, CharBackend)
+    DEFINE_PROP(_n, _s, _f, qdev_prop_chr, CharFrontend)
 #define DEFINE_PROP_NETDEV(_n, _s, _f)             \
     DEFINE_PROP(_n, _s, _f, qdev_prop_netdev, NICPeers)
 #define DEFINE_PROP_DRIVE(_n, _s, _f) \
diff --git a/include/hw/virtio/vhost-user-base.h b/include/hw/virtio/vhost-user-base.h
index 387e434b80..d5d2f081ae 100644
--- a/include/hw/virtio/vhost-user-base.h
+++ b/include/hw/virtio/vhost-user-base.h
@@ -20,7 +20,7 @@ struct VHostUserBase {
     VirtIODevice parent_obj;
 
     /* Properties */
-    CharBackend chardev;
+    CharFrontend chardev;
     uint16_t virtio_id;
     uint32_t num_vqs;
     uint32_t vq_size; /* can't exceed VIRTIO_QUEUE_MAX */
diff --git a/include/hw/virtio/vhost-user-blk.h b/include/hw/virtio/vhost-user-blk.h
index a10f785672..8158d4673d 100644
--- a/include/hw/virtio/vhost-user-blk.h
+++ b/include/hw/virtio/vhost-user-blk.h
@@ -29,7 +29,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VHostUserBlk, VHOST_USER_BLK)
 
 struct VHostUserBlk {
     VirtIODevice parent_obj;
-    CharBackend chardev;
+    CharFrontend chardev;
     int32_t bootindex;
     struct virtio_blk_config blkcfg;
     uint16_t num_queues;
diff --git a/include/hw/virtio/vhost-user-fs.h b/include/hw/virtio/vhost-user-fs.h
index 94c3aaa84e..5699ea03a1 100644
--- a/include/hw/virtio/vhost-user-fs.h
+++ b/include/hw/virtio/vhost-user-fs.h
@@ -24,7 +24,7 @@
 OBJECT_DECLARE_SIMPLE_TYPE(VHostUserFS, VHOST_USER_FS)
 
 typedef struct {
-    CharBackend chardev;
+    CharFrontend chardev;
     char *tag;
     uint16_t num_request_queues;
     uint16_t queue_size;
diff --git a/include/hw/virtio/vhost-user-scmi.h b/include/hw/virtio/vhost-user-scmi.h
index c90db77dd5..30ab0d7ab7 100644
--- a/include/hw/virtio/vhost-user-scmi.h
+++ b/include/hw/virtio/vhost-user-scmi.h
@@ -18,7 +18,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(VHostUserSCMI, VHOST_USER_SCMI);
 
 struct VHostUserSCMI {
     VirtIODevice parent;
-    CharBackend chardev;
+    CharFrontend chardev;
     struct vhost_virtqueue *vhost_vqs;
     struct vhost_dev vhost_dev;
     VhostUserState vhost_user;
diff --git a/include/hw/virtio/vhost-user-vsock.h b/include/hw/virtio/vhost-user-vsock.h
index 67aa46c952..5db6938b8b 100644
--- a/include/hw/virtio/vhost-user-vsock.h
+++ b/include/hw/virtio/vhost-user-vsock.h
@@ -20,7 +20,7 @@
 OBJECT_DECLARE_SIMPLE_TYPE(VHostUserVSock, VHOST_USER_VSOCK)
 
 typedef struct {
-    CharBackend chardev;
+    CharFrontend chardev;
 } VHostUserVSockConf;
 
 struct VHostUserVSock {
diff --git a/include/hw/virtio/vhost-user.h b/include/hw/virtio/vhost-user.h
index 9a3f238b43..55d5725ef8 100644
--- a/include/hw/virtio/vhost-user.h
+++ b/include/hw/virtio/vhost-user.h
@@ -64,7 +64,7 @@ typedef struct VhostUserHostNotifier {
  * @memory_slots:
  */
 typedef struct VhostUserState {
-    CharBackend *chr;
+    CharFrontend *chr;
     GPtrArray *notifiers;
     int memory_slots;
     bool supports_config;
@@ -82,7 +82,7 @@ typedef struct VhostUserState {
  *
  * Return: true on success, false on error while setting errp.
  */
-bool vhost_user_init(VhostUserState *user, CharBackend *chr, Error **errp);
+bool vhost_user_init(VhostUserState *user, CharFrontend *chr, Error **errp);
 
 /**
  * vhost_user_cleanup() - cleanup state
@@ -96,7 +96,7 @@ void vhost_user_cleanup(VhostUserState *user);
 /**
  * vhost_user_async_close() - cleanup vhost-user post connection drop
  * @d: DeviceState for the associated device (passed to callback)
- * @chardev: the CharBackend associated with the connection
+ * @chardev: the CharFrontend associated with the connection
  * @vhost: the common vhost device
  * @cb: the user callback function to complete the clean-up
  *
@@ -108,7 +108,7 @@ void vhost_user_cleanup(VhostUserState *user);
 typedef void (*vu_async_close_fn)(DeviceState *cb);
 
 void vhost_user_async_close(DeviceState *d,
-                            CharBackend *chardev, struct vhost_dev *vhost,
+                            CharFrontend *chardev, struct vhost_dev *vhost,
                             vu_async_close_fn cb);
 
 #endif
diff --git a/include/hw/virtio/virtio-gpu.h b/include/hw/virtio/virtio-gpu.h
index 9f16f89a36..58e0f91fda 100644
--- a/include/hw/virtio/virtio-gpu.h
+++ b/include/hw/virtio/virtio-gpu.h
@@ -257,7 +257,7 @@ struct VhostUserGPU {
 
     VhostUserBackend *vhost;
     int vhost_gpu_fd; /* closed by the chardev */
-    CharBackend vhost_chr;
+    CharFrontend vhost_chr;
     QemuDmaBuf *dmabuf[VIRTIO_GPU_MAX_SCANOUTS];
     bool backend_blocked;
 };
diff --git a/include/hw/virtio/virtio-scsi.h b/include/hw/virtio/virtio-scsi.h
index 31e852ed6c..b6028bb5cd 100644
--- a/include/hw/virtio/virtio-scsi.h
+++ b/include/hw/virtio/virtio-scsi.h
@@ -58,7 +58,7 @@ struct VirtIOSCSIConf {
     uint32_t cmd_per_lun;
     char *vhostfd;
     char *wwpn;
-    CharBackend chardev;
+    CharFrontend chardev;
     uint32_t boot_tpgt;
     IOThread *iothread;
     IOThreadVirtQueueMappingList *iothread_vq_mapping_list;
diff --git a/include/system/qtest.h b/include/system/qtest.h
index 84b1f8c6ee..7f6dc01d14 100644
--- a/include/system/qtest.h
+++ b/include/system/qtest.h
@@ -23,8 +23,8 @@ static inline bool qtest_enabled(void)
     return qtest_allowed;
 }
 
-void G_GNUC_PRINTF(2, 3) qtest_sendf(CharBackend *chr, const char *fmt, ...);
-void qtest_set_command_cb(bool (*pc_cb)(CharBackend *chr, gchar **words));
+void G_GNUC_PRINTF(2, 3) qtest_sendf(CharFrontend *chr, const char *fmt, ...);
+void qtest_set_command_cb(bool (*pc_cb)(CharFrontend *chr, gchar **words));
 bool qtest_driver(void);
 
 void qtest_server_init(const char *qtest_chrdev, const char *qtest_log, Error **errp);
diff --git a/include/system/vhost-user-backend.h b/include/system/vhost-user-backend.h
index 5634ebdb2e..3184c8e799 100644
--- a/include/system/vhost-user-backend.h
+++ b/include/system/vhost-user-backend.h
@@ -32,7 +32,7 @@ struct VhostUserBackend {
     Object parent;
 
     char *chr_name;
-    CharBackend chr;
+    CharFrontend chr;
     VhostUserState vhost_user;
     struct vhost_dev dev;
     VirtIODevice *vdev;
diff --git a/monitor/monitor-internal.h b/monitor/monitor-internal.h
index 5676eb334e..7735c73108 100644
--- a/monitor/monitor-internal.h
+++ b/monitor/monitor-internal.h
@@ -93,7 +93,7 @@ typedef struct HMPCommand {
 } HMPCommand;
 
 struct Monitor {
-    CharBackend chr;
+    CharFrontend chr;
     int suspend_cnt;            /* Needs to be accessed atomically */
     bool is_qmp;
     bool skip_flush;
diff --git a/net/colo-compare.c b/net/colo-compare.c
index 0e1844ee4c..95018b4704 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -88,7 +88,7 @@ static uint32_t max_queue_size;
 typedef struct SendCo {
     Coroutine *co;
     struct CompareState *s;
-    CharBackend *chr;
+    CharFrontend *chr;
     GQueue send_list;
     bool notify_remote_frame;
     bool done;
@@ -108,10 +108,10 @@ struct CompareState {
     char *sec_indev;
     char *outdev;
     char *notify_dev;
-    CharBackend chr_pri_in;
-    CharBackend chr_sec_in;
-    CharBackend chr_out;
-    CharBackend chr_notify_dev;
+    CharFrontend chr_pri_in;
+    CharFrontend chr_sec_in;
+    CharFrontend chr_out;
+    CharFrontend chr_notify_dev;
     SocketReadState pri_rs;
     SocketReadState sec_rs;
     SocketReadState notify_rs;
diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index 27734c91a7..8e01e98f40 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -37,8 +37,8 @@ struct MirrorState {
     NetFilterState parent_obj;
     char *indev;
     char *outdev;
-    CharBackend chr_in;
-    CharBackend chr_out;
+    CharFrontend chr_in;
+    CharFrontend chr_out;
     SocketReadState rs;
     bool vnet_hdr;
 };
diff --git a/net/passt.c b/net/passt.c
index 32ecffb763..9ed811a514 100644
--- a/net/passt.c
+++ b/net/passt.c
@@ -71,7 +71,7 @@ typedef struct NetPasstState {
     /* vhost user */
     VhostUserState *vhost_user;
     VHostNetState *vhost_net;
-    CharBackend vhost_chr;
+    CharFrontend vhost_chr;
     guint vhost_watch;
     uint64_t acked_features;
     bool started;
diff --git a/net/slirp.c b/net/slirp.c
index c627a9dd24..120eef6122 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -80,7 +80,7 @@ struct slirp_config_str {
 };
 
 struct GuestFwd {
-    CharBackend hd;
+    CharFrontend hd;
     struct in_addr server;
     int port;
     Slirp *slirp;
diff --git a/net/vhost-user.c b/net/vhost-user.c
index 8b96157145..a4bb49bbcf 100644
--- a/net/vhost-user.c
+++ b/net/vhost-user.c
@@ -65,7 +65,7 @@ static const int user_feature_bits[] = {
 
 typedef struct NetVhostUserState {
     NetClientState nc;
-    CharBackend chr; /* only queue index 0 */
+    CharFrontend chr; /* only queue index 0 */
     VhostUserState *vhost_user;
     VHostNetState *vhost_net;
     guint watch;
diff --git a/rust/bindings/src/lib.rs b/rust/bindings/src/lib.rs
index 5bf03b1370..4c9bb794f7 100644
--- a/rust/bindings/src/lib.rs
+++ b/rust/bindings/src/lib.rs
@@ -28,8 +28,8 @@ include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
 // BQL is taken, either directly or via `BqlCell` and `BqlRefCell`.
 // When bindings for character devices are introduced, this can be
 // moved to the Opaque<> wrapper in src/chardev.rs.
-unsafe impl Send for CharBackend {}
-unsafe impl Sync for CharBackend {}
+unsafe impl Send for CharFrontend {}
+unsafe impl Sync for CharFrontend {}
 
 // SAFETY: this is a pure data struct
 unsafe impl Send for CoalescedMemoryRange {}
diff --git a/rust/chardev/src/bindings.rs b/rust/chardev/src/bindings.rs
index 63bfbb8ce6..360b30d6a3 100644
--- a/rust/chardev/src/bindings.rs
+++ b/rust/chardev/src/bindings.rs
@@ -34,7 +34,7 @@ include!(concat!(env!("OUT_DIR"), "/bindings.inc.rs"));
 // BQL is taken, either directly or via `BqlCell` and `BqlRefCell`.
 // When bindings for character devices are introduced, this can be
 // moved to the Opaque<> wrapper in src/chardev.rs.
-unsafe impl Send for CharBackend {}
-unsafe impl Sync for CharBackend {}
+unsafe impl Send for CharFrontend {}
+unsafe impl Sync for CharFrontend {}
 
-unsafe impl Zeroable for CharBackend {}
+unsafe impl Zeroable for CharFrontend {}
diff --git a/rust/chardev/src/chardev.rs b/rust/chardev/src/chardev.rs
index 2014479674..f0b7975dbf 100644
--- a/rust/chardev/src/chardev.rs
+++ b/rust/chardev/src/chardev.rs
@@ -6,7 +6,7 @@
 //!
 //! Character devices in QEMU can run under the big QEMU lock or in a separate
 //! `GMainContext`. Here we only support the former, because the bindings
-//! enforce that the BQL is taken whenever the functions in [`CharBackend`] are
+//! enforce that the BQL is taken whenever the functions in [`CharFrontend`] are
 //! called.
 
 use std::{
@@ -32,25 +32,25 @@ pub struct Chardev(Opaque<bindings::Chardev>);
 pub type ChardevClass = bindings::ChardevClass;
 pub type Event = bindings::QEMUChrEvent;
 
-/// A safe wrapper around [`bindings::CharBackend`], denoting the character
+/// A safe wrapper around [`bindings::CharFrontend`], denoting the character
 /// back-end that is used for example by a device.  Compared to the
 /// underlying C struct it adds BQL protection, and is marked as pinned
 /// because the QOM object ([`bindings::Chardev`]) contains a pointer to
-/// the `CharBackend`.
-pub struct CharBackend {
-    inner: BqlRefCell<bindings::CharBackend>,
+/// the `CharFrontend`.
+pub struct CharFrontend {
+    inner: BqlRefCell<bindings::CharFrontend>,
     _pin: PhantomPinned,
 }
 
-pub struct CharBackendMut<'a>(BqlRefMut<'a, bindings::CharBackend>);
+pub struct CharFrontendMut<'a>(BqlRefMut<'a, bindings::CharFrontend>);
 
-impl Write for CharBackendMut<'_> {
+impl Write for CharFrontendMut<'_> {
     fn flush(&mut self) -> io::Result<()> {
         Ok(())
     }
 
     fn write(&mut self, buf: &[u8]) -> io::Result<usize> {
-        let chr: &mut bindings::CharBackend = &mut self.0;
+        let chr: &mut bindings::CharFrontend = &mut self.0;
 
         let len = buf.len().try_into().unwrap();
         let r = unsafe { bindings::qemu_chr_fe_write(addr_of_mut!(*chr), buf.as_ptr(), len) };
@@ -58,7 +58,7 @@ impl Write for CharBackendMut<'_> {
     }
 
     fn write_all(&mut self, buf: &[u8]) -> io::Result<()> {
-        let chr: &mut bindings::CharBackend = &mut self.0;
+        let chr: &mut bindings::CharFrontend = &mut self.0;
 
         let len = buf.len().try_into().unwrap();
         let r = unsafe { bindings::qemu_chr_fe_write_all(addr_of_mut!(*chr), buf.as_ptr(), len) };
@@ -72,7 +72,7 @@ impl Write for CharBackendMut<'_> {
     }
 }
 
-impl Debug for CharBackend {
+impl Debug for CharFrontend {
     fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
         // SAFETY: accessed just to print the values
         let chr = self.inner.as_ptr();
@@ -81,13 +81,13 @@ impl Debug for CharBackend {
 }
 
 // FIXME: use something like PinnedDrop from the pinned_init crate
-impl Drop for CharBackend {
+impl Drop for CharFrontend {
     fn drop(&mut self) {
         self.disable_handlers();
     }
 }
 
-impl CharBackend {
+impl CharFrontend {
     /// Enable the front-end's character device handlers, if there is an
     /// associated `Chardev`.
     pub fn enable_handlers<
@@ -198,7 +198,7 @@ impl CharBackend {
     /// the big QEMU lock while the character device is borrowed, as
     /// that might cause C code to write to the character device.
     pub fn borrow_mut(&self) -> impl Write + '_ {
-        CharBackendMut(self.inner.borrow_mut())
+        CharFrontendMut(self.inner.borrow_mut())
     }
 
     /// Send a continuous stream of zero bits on the line if `enabled` is
diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 8889d6e54f..5e9b13fdf9 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -5,7 +5,7 @@
 use std::{ffi::CStr, mem::size_of};
 
 use bql::BqlRefCell;
-use chardev::{CharBackend, Chardev, Event};
+use chardev::{CharFrontend, Chardev, Event};
 use common::{static_assert, uninit_field_mut};
 use hwcore::{
     Clock, ClockEvent, DeviceImpl, DeviceMethods, DeviceState, IRQState, InterruptSource,
@@ -106,7 +106,7 @@ pub struct PL011State {
     pub iomem: MemoryRegion,
     #[doc(alias = "chr")]
     #[property(rename = "chardev")]
-    pub char_backend: CharBackend,
+    pub char_frontend: CharFrontend,
     pub regs: BqlRefCell<PL011Registers>,
     /// QEMU interrupts
     ///
@@ -240,7 +240,7 @@ impl PL011Registers {
                 }
                 let update = (self.line_control.send_break() != new_val.send_break()) && {
                     let break_enable = new_val.send_break();
-                    let _ = device.char_backend.send_break(break_enable);
+                    let _ = device.char_frontend.send_break(break_enable);
                     self.loopback_break(break_enable)
                 };
                 self.line_control = new_val;
@@ -561,7 +561,7 @@ impl PL011State {
                 trace::trace_pl011_read(offset, result, c"");
                 if update_irq {
                     self.update();
-                    self.char_backend.accept_input();
+                    self.char_frontend.accept_input();
                 }
                 result.into()
             }
@@ -579,7 +579,7 @@ impl PL011State {
                 let ch: [u8; 1] = [value as u8];
                 // XXX this blocks entire thread. Rewrite to use
                 // qemu_chr_fe_write and background I/O callbacks
-                let _ = self.char_backend.write_all(&ch);
+                let _ = self.char_frontend.write_all(&ch);
             }
 
             update_irq = self.regs.borrow_mut().write(field, value as u32, self);
@@ -645,7 +645,7 @@ impl PL011State {
     }
 
     fn realize(&self) -> util::Result<()> {
-        self.char_backend
+        self.char_frontend
             .enable_handlers(self, Self::can_receive, Self::receive, Self::event);
         Ok(())
     }
diff --git a/rust/hw/core/src/qdev.rs b/rust/hw/core/src/qdev.rs
index c3097a284d..4e983da28b 100644
--- a/rust/hw/core/src/qdev.rs
+++ b/rust/hw/core/src/qdev.rs
@@ -156,7 +156,7 @@ impl_qdev_prop!(u64, qdev_prop_uint64, qdev_prop_bit64);
 impl_qdev_prop!(usize, qdev_prop_usize);
 impl_qdev_prop!(i32, qdev_prop_int32);
 impl_qdev_prop!(i64, qdev_prop_int64);
-impl_qdev_prop!(chardev::CharBackend, qdev_prop_chr);
+impl_qdev_prop!(chardev::CharFrontend, qdev_prop_chr);
 
 /// Trait to define device properties.
 ///
diff --git a/semihosting/console.c b/semihosting/console.c
index c3683a1566..a4db8d8e76 100644
--- a/semihosting/console.c
+++ b/semihosting/console.c
@@ -30,7 +30,7 @@
 
 /* Access to this structure is protected by the BQL */
 typedef struct SemihostingConsole {
-    CharBackend         backend;
+    CharFrontend        frontend;
     Chardev             *chr;
     GSList              *sleeping_cpus;
     bool                got;
@@ -122,8 +122,8 @@ void qemu_semihosting_console_init(Chardev *chr)
     console.chr = chr;
     if  (chr) {
         fifo8_create(&console.fifo, FIFO_SIZE);
-        qemu_chr_fe_init(&console.backend, chr, &error_abort);
-        qemu_chr_fe_set_handlers(&console.backend,
+        qemu_chr_fe_init(&console.frontend, chr, &error_abort);
+        qemu_chr_fe_set_handlers(&console.frontend,
                                  console_can_read,
                                  console_read,
                                  NULL, NULL, &console,
diff --git a/system/qtest.c b/system/qtest.c
index fa42c9f921..e4d1cd75da 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -44,7 +44,7 @@ struct QTest {
     bool has_machine_link;
     char *chr_name;
     Chardev *chr;
-    CharBackend qtest_chr;
+    CharFrontend qtest_chr;
     char *log;
 };
 
@@ -293,20 +293,20 @@ static void G_GNUC_PRINTF(1, 2) qtest_log_send(const char *fmt, ...)
 static void qtest_server_char_be_send(void *opaque, const char *str)
 {
     size_t len = strlen(str);
-    CharBackend* chr = (CharBackend *)opaque;
+    CharFrontend* chr = (CharFrontend *)opaque;
     qemu_chr_fe_write_all(chr, (uint8_t *)str, len);
     if (qtest_log_fp && qtest_opened) {
         fprintf(qtest_log_fp, "%s", str);
     }
 }
 
-static void qtest_send(CharBackend *chr, const char *str)
+static void qtest_send(CharFrontend *chr, const char *str)
 {
     qtest_log_timestamp();
     qtest_server_send(qtest_server_send_opaque, str);
 }
 
-void qtest_sendf(CharBackend *chr, const char *fmt, ...)
+void qtest_sendf(CharFrontend *chr, const char *fmt, ...)
 {
     va_list ap;
     gchar *buffer;
@@ -324,16 +324,16 @@ static void qtest_irq_handler(void *opaque, int n, int level)
     qemu_set_irq(old_irq, level);
 
     if (irq_levels[n] != level) {
-        CharBackend *chr = &qtest->qtest_chr;
+        CharFrontend *chr = &qtest->qtest_chr;
         irq_levels[n] = level;
         qtest_sendf(chr, "IRQ %s %d\n",
                     level ? "raise" : "lower", n);
     }
 }
 
-static bool (*process_command_cb)(CharBackend *chr, gchar **words);
+static bool (*process_command_cb)(CharFrontend *chr, gchar **words);
 
-void qtest_set_command_cb(bool (*pc_cb)(CharBackend *chr, gchar **words))
+void qtest_set_command_cb(bool (*pc_cb)(CharFrontend *chr, gchar **words))
 {
     assert(!process_command_cb);  /* Switch to a list if we need more than one */
 
@@ -349,7 +349,7 @@ static void qtest_install_gpio_out_intercept(DeviceState *dev, const char *name,
     *disconnected = qdev_intercept_gpio_out(dev, icpt, name, n);
 }
 
-static void qtest_process_command(CharBackend *chr, gchar **words)
+static void qtest_process_command(CharFrontend *chr, gchar **words)
 {
     const gchar *command;
 
@@ -757,7 +757,7 @@ static void qtest_process_command(CharBackend *chr, gchar **words)
  * Process as much of @inbuf as we can in newline terminated chunks.
  * Remove the processed commands from @inbuf as we go.
  */
-static void qtest_process_inbuf(CharBackend *chr, GString *inbuf)
+static void qtest_process_inbuf(CharFrontend *chr, GString *inbuf)
 {
     char *end;
 
@@ -773,7 +773,7 @@ static void qtest_process_inbuf(CharBackend *chr, GString *inbuf)
 
 static void qtest_read(void *opaque, const uint8_t *buf, int size)
 {
-    CharBackend *chr = opaque;
+    CharFrontend *chr = opaque;
 
     g_string_append_len(inbuf, (const gchar *)buf, size);
     qtest_process_inbuf(chr, inbuf);
diff --git a/target/hppa/sys_helper.c b/target/hppa/sys_helper.c
index 6e65fadcc7..88109f0181 100644
--- a/target/hppa/sys_helper.c
+++ b/target/hppa/sys_helper.c
@@ -135,7 +135,7 @@ void HELPER(rfi_r)(CPUHPPAState *env)
  */
 void HELPER(diag_console_output)(CPUHPPAState *env)
 {
-    CharBackend *serial_backend;
+    CharFrontend *fe;
     Chardev *serial_port;
     unsigned char c;
 
@@ -145,14 +145,14 @@ void HELPER(diag_console_output)(CPUHPPAState *env)
         return;
     }
 
-    /* get serial_backend for the serial port */
-    serial_backend = serial_port->be;
-    if (!serial_backend ||
-        !qemu_chr_fe_backend_connected(serial_backend)) {
+    /* get the frontend for the serial port */
+    fe = serial_port->fe;
+    if (!fe ||
+        !qemu_chr_fe_backend_connected(fe)) {
         return;
     }
 
     c = (unsigned char)env->gr[26];
-    qemu_chr_fe_write(serial_backend, &c, sizeof(c));
+    qemu_chr_fe_write(fe, &c, sizeof(c));
 }
 #endif
diff --git a/target/riscv/kvm/kvm-cpu.c b/target/riscv/kvm/kvm-cpu.c
index 000e44b2b7..47e672c7aa 100644
--- a/target/riscv/kvm/kvm-cpu.c
+++ b/target/riscv/kvm/kvm-cpu.c
@@ -1598,7 +1598,7 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
         buf = g_malloc0(num_bytes);
 
         if (run->riscv_sbi.function_id == SBI_EXT_DBCN_CONSOLE_READ) {
-            ret = qemu_chr_fe_read_all(serial_hd(0)->be, buf, num_bytes);
+            ret = qemu_chr_fe_read_all(serial_hd(0)->fe, buf, num_bytes);
             if (ret < 0) {
                 error_report("SBI_EXT_DBCN_CONSOLE_READ: error when "
                              "reading chardev");
@@ -1609,7 +1609,7 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
         } else {
             address_space_read(cs->as, addr, attrs, buf, num_bytes);
 
-            ret = qemu_chr_fe_write_all(serial_hd(0)->be, buf, num_bytes);
+            ret = qemu_chr_fe_write_all(serial_hd(0)->fe, buf, num_bytes);
             if (ret < 0) {
                 error_report("SBI_EXT_DBCN_CONSOLE_WRITE: error when "
                              "writing chardev");
@@ -1622,7 +1622,7 @@ static void kvm_riscv_handle_sbi_dbcn(CPUState *cs, struct kvm_run *run)
         break;
     case SBI_EXT_DBCN_CONSOLE_WRITE_BYTE:
         ch = run->riscv_sbi.args[0];
-        ret = qemu_chr_fe_write_all(serial_hd(0)->be, &ch, sizeof(ch));
+        ret = qemu_chr_fe_write_all(serial_hd(0)->fe, &ch, sizeof(ch));
 
         if (ret < 0) {
             error_report("SBI_EXT_DBCN_CONSOLE_WRITE_BYTE: error when "
@@ -1645,10 +1645,10 @@ static int kvm_riscv_handle_sbi(CPUState *cs, struct kvm_run *run)
     switch (run->riscv_sbi.extension_id) {
     case SBI_EXT_0_1_CONSOLE_PUTCHAR:
         ch = run->riscv_sbi.args[0];
-        qemu_chr_fe_write(serial_hd(0)->be, &ch, sizeof(ch));
+        qemu_chr_fe_write(serial_hd(0)->fe, &ch, sizeof(ch));
         break;
     case SBI_EXT_0_1_CONSOLE_GETCHAR:
-        ret = qemu_chr_fe_read_all(serial_hd(0)->be, &ch, sizeof(ch));
+        ret = qemu_chr_fe_read_all(serial_hd(0)->fe, &ch, sizeof(ch));
         if (ret == sizeof(ch)) {
             run->riscv_sbi.ret[0] = ch;
         } else {
diff --git a/target/xtensa/xtensa-semi.c b/target/xtensa/xtensa-semi.c
index 431c263dc5..552815ebfd 100644
--- a/target/xtensa/xtensa-semi.c
+++ b/target/xtensa/xtensa-semi.c
@@ -148,7 +148,7 @@ static uint32_t errno_h2g(int host_errno)
 }
 
 typedef struct XtensaSimConsole {
-    CharBackend be;
+    CharFrontend fe;
     struct {
         char buffer[16];
         size_t offset;
@@ -182,8 +182,8 @@ void xtensa_sim_open_console(Chardev *chr)
 {
     static XtensaSimConsole console;
 
-    qemu_chr_fe_init(&console.be, chr, &error_abort);
-    qemu_chr_fe_set_handlers(&console.be,
+    qemu_chr_fe_init(&console.fe, chr, &error_abort);
+    qemu_chr_fe_set_handlers(&console.fe,
                              sim_console_can_read,
                              sim_console_read,
                              NULL, NULL, &console,
@@ -227,7 +227,7 @@ void HELPER(simcall)(CPUXtensaState *env)
                     len -= io_sz;
                     if (fd < 3 && sim_console) {
                         if (is_write && (fd == 1 || fd == 2)) {
-                            io_done = qemu_chr_fe_write_all(&sim_console->be,
+                            io_done = qemu_chr_fe_write_all(&sim_console->fe,
                                                             buf, io_sz);
                             regs[3] = errno_h2g(errno);
                         } else if (!is_write && fd == 0) {
@@ -241,7 +241,7 @@ void HELPER(simcall)(CPUXtensaState *env)
                                         sim_console->input.buffer + io_done,
                                         sim_console->input.offset - io_done);
                                 sim_console->input.offset -= io_done;
-                                qemu_chr_fe_accept_input(&sim_console->be);
+                                qemu_chr_fe_accept_input(&sim_console->fe);
                             } else {
                                 io_done = -1;
                                 regs[3] = TARGET_EAGAIN;
diff --git a/tests/qtest/vhost-user-test.c b/tests/qtest/vhost-user-test.c
index 609ff24059..d2bb21d5b9 100644
--- a/tests/qtest/vhost-user-test.c
+++ b/tests/qtest/vhost-user-test.c
@@ -155,7 +155,7 @@ typedef struct TestServer {
     gchar *mig_path;
     gchar *chr_name;
     gchar *tmpfs;
-    CharBackend chr;
+    CharFrontend chr;
     int fds_num;
     int fds[VHOST_MEMORY_MAX_NREGIONS];
     VhostUserMemory memory;
@@ -180,10 +180,10 @@ struct vhost_user_ops {
 
     /* VHOST-USER commands. */
     uint64_t (*get_features)(TestServer *s);
-    void (*set_features)(TestServer *s, CharBackend *chr,
+    void (*set_features)(TestServer *s, CharFrontend *chr,
                          VhostUserMsg *msg);
     void (*get_protocol_features)(TestServer *s,
-                                  CharBackend *chr, VhostUserMsg *msg);
+                                  CharFrontend *chr, VhostUserMsg *msg);
 };
 
 static const char *init_hugepagefs(void);
@@ -331,7 +331,7 @@ static int chr_can_read(void *opaque)
 static void chr_read(void *opaque, const uint8_t *buf, int size)
 {
     TestServer *s = opaque;
-    CharBackend *chr = &s->chr;
+    CharFrontend *chr = &s->chr;
     VhostUserMsg msg;
     uint8_t *p = (uint8_t *) &msg;
     int fd = -1;
@@ -1051,7 +1051,7 @@ static uint64_t vu_net_get_features(TestServer *s)
     return features;
 }
 
-static void vu_net_set_features(TestServer *s, CharBackend *chr,
+static void vu_net_set_features(TestServer *s, CharFrontend *chr,
                                 VhostUserMsg *msg)
 {
     g_assert(msg->payload.u64 & (0x1ULL << VHOST_USER_F_PROTOCOL_FEATURES));
@@ -1061,7 +1061,7 @@ static void vu_net_set_features(TestServer *s, CharBackend *chr,
     }
 }
 
-static void vu_net_get_protocol_features(TestServer *s, CharBackend *chr,
+static void vu_net_get_protocol_features(TestServer *s, CharFrontend *chr,
         VhostUserMsg *msg)
 {
     /* send back features to qemu */
@@ -1148,7 +1148,7 @@ static uint64_t vu_gpio_get_features(TestServer *s)
  * that we support VHOST_USER_PROTOCOL_F_CONFIG as gpio would use it
  * talking to a read vhost-user daemon.
  */
-static void vu_gpio_get_protocol_features(TestServer *s, CharBackend *chr,
+static void vu_gpio_get_protocol_features(TestServer *s, CharFrontend *chr,
                                           VhostUserMsg *msg)
 {
     /* send back features to qemu */
@@ -1191,7 +1191,7 @@ static uint64_t vu_scmi_get_features(TestServer *s)
         0x1ULL << VHOST_USER_F_PROTOCOL_FEATURES;
 }
 
-static void vu_scmi_get_protocol_features(TestServer *s, CharBackend *chr,
+static void vu_scmi_get_protocol_features(TestServer *s, CharFrontend *chr,
                                           VhostUserMsg *msg)
 {
     msg->flags |= VHOST_USER_REPLY_MASK;
diff --git a/tests/unit/test-char.c b/tests/unit/test-char.c
index e156b17329..8a98e42cad 100644
--- a/tests/unit/test-char.c
+++ b/tests/unit/test-char.c
@@ -107,18 +107,18 @@ static void char_console_test(void)
 static void char_stdio_test_subprocess(void)
 {
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
     int ret;
 
     chr = qemu_chr_new("label", "stdio", NULL);
     g_assert_nonnull(chr);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
-    qemu_chr_fe_set_open(&be, true);
-    ret = qemu_chr_fe_write(&be, (void *)"buf", 4);
+    qemu_chr_fe_init(&c, chr, &error_abort);
+    qemu_chr_fe_set_open(&c, true);
+    ret = qemu_chr_fe_write(&c, (void *)"buf", 4);
     g_assert_cmpint(ret, ==, 4);
 
-    qemu_chr_fe_deinit(&be, true);
+    qemu_chr_fe_deinit(&c, true);
 }
 
 static void char_stdio_test(void)
@@ -132,7 +132,7 @@ static void char_ringbuf_test(void)
 {
     QemuOpts *opts;
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
     char *data;
     int ret;
 
@@ -153,8 +153,8 @@ static void char_ringbuf_test(void)
     g_assert_nonnull(chr);
     qemu_opts_del(opts);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
-    ret = qemu_chr_fe_write(&be, (void *)"buff", 4);
+    qemu_chr_fe_init(&c, chr, &error_abort);
+    ret = qemu_chr_fe_write(&c, (void *)"buff", 4);
     g_assert_cmpint(ret, ==, 4);
 
     data = qmp_ringbuf_read("ringbuf-label", 4, false, 0, &error_abort);
@@ -165,7 +165,7 @@ static void char_ringbuf_test(void)
     g_assert_cmpstr(data, ==, "");
     g_free(data);
 
-    qemu_chr_fe_deinit(&be, true);
+    qemu_chr_fe_deinit(&c, true);
 
     /* check alias */
     opts = qemu_opts_create(qemu_find_opts("chardev"), "memory-label",
@@ -184,7 +184,7 @@ static void char_mux_test(void)
     Chardev *chr, *base;
     char *data;
     FeHandler h1 = { 0, false, 0, false, }, h2 = { 0, false, 0, false, };
-    CharBackend chr_be1, chr_be2;
+    CharFrontend chr_fe1, chr_fe2;
     Error *error = NULL;
 
     /* Create mux and chardev to be immediately removed */
@@ -210,8 +210,8 @@ static void char_mux_test(void)
     g_assert_nonnull(chr);
     qemu_opts_del(opts);
 
-    qemu_chr_fe_init(&chr_be1, chr, &error_abort);
-    qemu_chr_fe_set_handlers(&chr_be1,
+    qemu_chr_fe_init(&chr_fe1, chr, &error_abort);
+    qemu_chr_fe_set_handlers(&chr_fe1,
                              fe_can_read,
                              fe_read,
                              fe_event,
@@ -219,15 +219,15 @@ static void char_mux_test(void)
                              &h1,
                              NULL, true);
 
-    qemu_chr_fe_init(&chr_be2, chr, &error_abort);
-    qemu_chr_fe_set_handlers(&chr_be2,
+    qemu_chr_fe_init(&chr_fe2, chr, &error_abort);
+    qemu_chr_fe_set_handlers(&chr_fe2,
                              fe_can_read,
                              fe_read,
                              fe_event,
                              NULL,
                              &h2,
                              NULL, true);
-    qemu_chr_fe_take_focus(&chr_be2);
+    qemu_chr_fe_take_focus(&chr_fe2);
 
     base = qemu_chr_find("mux-label-base");
     g_assert_cmpint(qemu_chr_be_can_write(base), !=, 0);
@@ -271,8 +271,8 @@ static void char_mux_test(void)
     g_assert_cmpint(h2.last_event, ==, CHR_EVENT_MUX_OUT);
 
     /* open/close state and corresponding events */
-    g_assert_true(qemu_chr_fe_backend_open(&chr_be1));
-    g_assert_true(qemu_chr_fe_backend_open(&chr_be2));
+    g_assert_true(qemu_chr_fe_backend_open(&chr_fe1));
+    g_assert_true(qemu_chr_fe_backend_open(&chr_fe2));
     g_assert_true(h1.is_open);
     g_assert_false(h1.openclose_mismatch);
     g_assert_true(h2.is_open);
@@ -280,22 +280,22 @@ static void char_mux_test(void)
 
     h1.openclose_count = h2.openclose_count = 0;
 
-    qemu_chr_fe_set_handlers(&chr_be1, NULL, NULL, NULL, NULL,
+    qemu_chr_fe_set_handlers(&chr_fe1, NULL, NULL, NULL, NULL,
                              NULL, NULL, false);
-    qemu_chr_fe_set_handlers(&chr_be2, NULL, NULL, NULL, NULL,
+    qemu_chr_fe_set_handlers(&chr_fe2, NULL, NULL, NULL, NULL,
                              NULL, NULL, false);
     g_assert_cmpint(h1.openclose_count, ==, 0);
     g_assert_cmpint(h2.openclose_count, ==, 0);
 
     h1.is_open = h2.is_open = false;
-    qemu_chr_fe_set_handlers(&chr_be1,
+    qemu_chr_fe_set_handlers(&chr_fe1,
                              NULL,
                              NULL,
                              fe_event,
                              NULL,
                              &h1,
                              NULL, false);
-    qemu_chr_fe_set_handlers(&chr_be2,
+    qemu_chr_fe_set_handlers(&chr_fe2,
                              NULL,
                              NULL,
                              fe_event,
@@ -314,14 +314,14 @@ static void char_mux_test(void)
     g_assert_cmpint(h2.openclose_count, ==, 3);
     g_assert_false(h2.openclose_mismatch);
 
-    qemu_chr_fe_set_handlers(&chr_be2,
+    qemu_chr_fe_set_handlers(&chr_fe2,
                              fe_can_read,
                              fe_read,
                              fe_event,
                              NULL,
                              &h2,
                              NULL, false);
-    qemu_chr_fe_set_handlers(&chr_be1,
+    qemu_chr_fe_set_handlers(&chr_fe1,
                              fe_can_read,
                              fe_read,
                              fe_event,
@@ -330,7 +330,7 @@ static void char_mux_test(void)
                              NULL, false);
 
     /* remove first handler */
-    qemu_chr_fe_set_handlers(&chr_be1, NULL, NULL, NULL, NULL,
+    qemu_chr_fe_set_handlers(&chr_fe1, NULL, NULL, NULL, NULL,
                              NULL, NULL, true);
     qemu_chr_be_write(base, (void *)"hello", 6);
     g_assert_cmpint(h1.read_count, ==, 0);
@@ -349,13 +349,13 @@ static void char_mux_test(void)
     g_assert_cmpint(strlen(data), !=, 0);
     g_free(data);
 
-    qemu_chr_fe_deinit(&chr_be1, false);
+    qemu_chr_fe_deinit(&chr_fe1, false);
 
     qmp_chardev_remove("mux-label", &error);
     g_assert_cmpstr(error_get_pretty(error), ==, "Chardev 'mux-label' is busy");
     error_free(error);
 
-    qemu_chr_fe_deinit(&chr_be2, false);
+    qemu_chr_fe_deinit(&chr_fe2, false);
     qmp_chardev_remove("mux-label", &error_abort);
 }
 
@@ -366,7 +366,7 @@ static void char_hub_test(void)
     char *data;
     FeHandler h = { 0, false, 0, false, };
     Error *error = NULL;
-    CharBackend chr_be;
+    CharFrontend chr_fe;
     int ret, i;
 
 #define RB_SIZE 128
@@ -497,8 +497,8 @@ static void char_hub_test(void)
     qemu_opts_del(opts);
 
     /* Attach hub to a frontend */
-    qemu_chr_fe_init(&chr_be, hub, &error_abort);
-    qemu_chr_fe_set_handlers(&chr_be,
+    qemu_chr_fe_init(&chr_fe, hub, &error_abort);
+    qemu_chr_fe_set_handlers(&chr_fe,
                              fe_can_read,
                              fe_read,
                              fe_event,
@@ -507,7 +507,7 @@ static void char_hub_test(void)
                              NULL, true);
 
     /* Fails second time */
-    qemu_chr_fe_init(&chr_be, hub, &error);
+    qemu_chr_fe_init(&chr_fe, hub, &error);
     g_assert_cmpstr(error_get_pretty(error), ==, "chardev 'hub0' is already in use");
     error_free(error);
     error = NULL;
@@ -531,7 +531,7 @@ static void char_hub_test(void)
     h.read_count = 0;
 
     /* Write to frontend, chr_be */
-    ret = qemu_chr_fe_write(&chr_be, (void *)"heyhey", 6);
+    ret = qemu_chr_fe_write(&chr_fe, (void *)"heyhey", 6);
     g_assert_cmpint(ret, ==, 6);
 
     data = qmp_ringbuf_read("chr1", RB_SIZE, false, 0, &error_abort);
@@ -557,7 +557,7 @@ static void char_hub_test(void)
     error = NULL;
 
     /* Finalize frontend */
-    qemu_chr_fe_deinit(&chr_be, false);
+    qemu_chr_fe_deinit(&chr_fe, false);
 
     /* Finalize hub0 */
     qmp_chardev_remove("hub0", &error_abort);
@@ -632,8 +632,8 @@ static void char_hub_test(void)
         qemu_opts_del(opts);
 
         /* Attach hub to a frontend */
-        qemu_chr_fe_init(&chr_be, hub, &error_abort);
-        qemu_chr_fe_set_handlers(&chr_be,
+        qemu_chr_fe_init(&chr_fe, hub, &error_abort);
+        qemu_chr_fe_set_handlers(&chr_fe,
                                  fe_can_read,
                                  fe_read,
                                  fe_event,
@@ -642,7 +642,7 @@ static void char_hub_test(void)
                                  NULL, true);
 
         /* Write to frontend, chr_be */
-        ret = qemu_chr_fe_write(&chr_be, (void *)"thisis", 6);
+        ret = qemu_chr_fe_write(&chr_fe, (void *)"thisis", 6);
         g_assert_cmpint(ret, ==, 6);
 
         data = qmp_ringbuf_read("chr1", RB_SIZE, false, 0, &error_abort);
@@ -663,7 +663,7 @@ static void char_hub_test(void)
         close(fd);
 
         /* Add watch. 0 indicates no watches if nothing to wait for */
-        ret = qemu_chr_fe_add_watch(&chr_be, G_IO_OUT | G_IO_HUP,
+        ret = qemu_chr_fe_add_watch(&chr_fe, G_IO_OUT | G_IO_HUP,
                                     NULL, NULL);
         g_assert_cmpint(ret, ==, 0);
 
@@ -672,14 +672,14 @@ static void char_hub_test(void)
          * power of two to fit nicely the whole pipe buffer.
          */
         len = 0;
-        while ((ret = qemu_chr_fe_write(&chr_be, (void *)"thisisit", 8))
+        while ((ret = qemu_chr_fe_write(&chr_fe, (void *)"thisisit", 8))
                != -1) {
             len += ret;
         }
         g_assert_cmpint(errno, ==, EAGAIN);
 
         /* Further all writes should cause EAGAIN */
-        ret = qemu_chr_fe_write(&chr_be, (void *)"b", 1);
+        ret = qemu_chr_fe_write(&chr_fe, (void *)"b", 1);
         g_assert_cmpint(ret, ==, -1);
         g_assert_cmpint(errno, ==, EAGAIN);
 
@@ -687,7 +687,7 @@ static void char_hub_test(void)
          * Add watch. Non 0 indicates we have a blocked chardev, which
          * can wakes us up when write is possible.
          */
-        ret = qemu_chr_fe_add_watch(&chr_be, G_IO_OUT | G_IO_HUP,
+        ret = qemu_chr_fe_add_watch(&chr_fe, G_IO_OUT | G_IO_HUP,
                                     NULL, NULL);
         g_assert_cmpint(ret, !=, 0);
         g_source_remove(ret);
@@ -712,10 +712,10 @@ static void char_hub_test(void)
          * was already consumed and drained by the ring buffers, but
          * pipe have not recieved that yet.
          */
-        ret = qemu_chr_fe_write(&chr_be, (void *)"thisisit", 8);
+        ret = qemu_chr_fe_write(&chr_fe, (void *)"thisisit", 8);
         g_assert_cmpint(ret, ==, 8);
 
-        ret = qemu_chr_fe_write(&chr_be, (void *)"streamisrestored", 16);
+        ret = qemu_chr_fe_write(&chr_fe, (void *)"streamisrestored", 16);
         g_assert_cmpint(ret, ==, 16);
 
         data = qmp_ringbuf_read("chr1", RB_SIZE, false, 0, &error_abort);
@@ -744,7 +744,7 @@ static void char_hub_test(void)
         g_free(pipe);
 
         /* Finalize frontend */
-        qemu_chr_fe_deinit(&chr_be, false);
+        qemu_chr_fe_deinit(&chr_fe, false);
 
         /* Finalize hub0 */
         qmp_chardev_remove("hub0", &error_abort);
@@ -803,10 +803,10 @@ static void websock_client_read(void *opaque, const uint8_t *buf, int size)
     Chardev *chr_client = opaque;
 
     if (websock_check_http_headers((char *) buf, size)) {
-        qemu_chr_fe_write(chr_client->be, ping, sizeof(ping));
+        qemu_chr_fe_write(chr_client->fe, ping, sizeof(ping));
     } else if (buf[0] == 0x8a && buf[1] == 0x05) {
         g_assert(strncmp((char *) buf + 2, "hello", 5) == 0);
-        qemu_chr_fe_write(chr_client->be, binary, sizeof(binary));
+        qemu_chr_fe_write(chr_client->fe, binary, sizeof(binary));
     } else {
         g_assert(buf[0] == 0x88 && buf[1] == 0x16);
         g_assert(strncmp((char *) buf + 4, "peer requested close", 10) == 0);
@@ -828,8 +828,8 @@ static void char_websock_test(void)
     const char *port;
     char *tmp;
     char *handshake_port;
-    CharBackend be;
-    CharBackend client_be;
+    CharFrontend fe;
+    CharFrontend client_fe;
     Chardev *chr_client;
     Chardev *chr = qemu_chr_new("server",
                                 "websocket:127.0.0.1:0,server=on,wait=off", NULL);
@@ -852,13 +852,13 @@ static void char_websock_test(void)
     handshake_port = g_strdup_printf(handshake, port, port);
     qobject_unref(qdict);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
-    qemu_chr_fe_set_handlers(&be, websock_server_can_read, websock_server_read,
+    qemu_chr_fe_init(&fe, chr, &error_abort);
+    qemu_chr_fe_set_handlers(&fe, websock_server_can_read, websock_server_read,
                              NULL, NULL, chr, NULL, true);
 
     chr_client = qemu_chr_new("client", tmp, NULL);
-    qemu_chr_fe_init(&client_be, chr_client, &error_abort);
-    qemu_chr_fe_set_handlers(&client_be, websock_client_can_read,
+    qemu_chr_fe_init(&client_fe, chr_client, &error_abort);
+    qemu_chr_fe_set_handlers(&client_fe, websock_client_can_read,
                              websock_client_read,
                              NULL, NULL, chr_client, NULL, true);
     g_free(tmp);
@@ -887,7 +887,7 @@ static void char_pipe_test(void)
     gchar *tmp_path = g_dir_make_tmp("qemu-test-char.XXXXXX", NULL);
     gchar *tmp, *in, *out, *pipe = g_build_filename(tmp_path, "pipe", NULL);
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
     int ret, fd;
     char buf[10];
     FeHandler fe = { 0, };
@@ -906,9 +906,9 @@ static void char_pipe_test(void)
     g_assert_nonnull(chr);
     g_free(tmp);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
-    ret = qemu_chr_fe_write(&be, (void *)"pipe-out", 9);
+    ret = qemu_chr_fe_write(&c, (void *)"pipe-out", 9);
     g_assert_cmpint(ret, ==, 9);
 
     fd = open(out, O_RDWR);
@@ -922,7 +922,7 @@ static void char_pipe_test(void)
     g_assert_cmpint(ret, ==, 8);
     close(fd);
 
-    qemu_chr_fe_set_handlers(&be,
+    qemu_chr_fe_set_handlers(&c,
                              fe_can_read,
                              fe_read,
                              fe_event,
@@ -935,7 +935,7 @@ static void char_pipe_test(void)
     g_assert_cmpint(fe.read_count, ==, 8);
     g_assert_cmpstr(fe.read_buf, ==, "pipe-in");
 
-    qemu_chr_fe_deinit(&be, true);
+    qemu_chr_fe_deinit(&c, true);
 
     g_assert(g_unlink(in) == 0);
     g_assert(g_unlink(out) == 0);
@@ -951,8 +951,8 @@ typedef struct SocketIdleData {
     GMainLoop *loop;
     Chardev *chr;
     bool conn_expected;
-    CharBackend *be;
-    CharBackend *client_be;
+    CharFrontend *fe;
+    CharFrontend *client_fe;
 } SocketIdleData;
 
 
@@ -993,7 +993,7 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
     struct sockaddr_in other;
     SocketIdleData d = { 0, };
     Chardev *chr;
-    CharBackend stack_be, *be = &stack_be;
+    CharFrontend stack_fe, *fe = &stack_fe;
     socklen_t alen = sizeof(other);
     int ret;
     char buf[10];
@@ -1001,7 +1001,7 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
 
     if (reuse_chr) {
         chr = reuse_chr;
-        be = chr->be;
+        fe = chr->fe;
     } else {
         int port;
         sock = make_udp_socket(&port);
@@ -1009,11 +1009,11 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
         chr = qemu_chr_new("client", tmp, NULL);
         g_assert_nonnull(chr);
 
-        qemu_chr_fe_init(be, chr, &error_abort);
+        qemu_chr_fe_init(fe, chr, &error_abort);
     }
 
     d.chr = chr;
-    qemu_chr_fe_set_handlers(be, socket_can_read_hello, socket_read_hello,
+    qemu_chr_fe_set_handlers(fe, socket_can_read_hello, socket_read_hello,
                              NULL, NULL, &d, NULL, true);
     ret = qemu_chr_write_all(chr, (uint8_t *)"hello", 5);
     g_assert_cmpint(ret, ==, 5);
@@ -1028,7 +1028,7 @@ static void char_udp_test_internal(Chardev *reuse_chr, int sock)
 
     if (!reuse_chr) {
         close(sock);
-        qemu_chr_fe_deinit(be, true);
+        qemu_chr_fe_deinit(fe, true);
     }
     g_free(tmp);
 }
@@ -1042,7 +1042,7 @@ static void char_udp_test(void)
 typedef struct {
     int event;
     bool got_pong;
-    CharBackend *be;
+    CharFrontend *fe;
 } CharSocketTestData;
 
 
@@ -1063,13 +1063,13 @@ char_socket_event_with_error(void *opaque, QEMUChrEvent event)
 {
     static bool first_error;
     CharSocketTestData *data = opaque;
-    CharBackend *be = data->be;
+    CharFrontend *fe = data->fe;
     data->event = event;
     switch (event) {
     case CHR_EVENT_OPENED:
         if (!first_error) {
             first_error = true;
-            qemu_chr_fe_disconnect(be);
+            qemu_chr_fe_disconnect(fe);
         }
         return;
     case CHR_EVENT_CLOSED:
@@ -1185,7 +1185,7 @@ static void char_socket_server_test(gconstpointer opaque)
 {
     const CharSocketServerTestConfig *config = opaque;
     Chardev *chr;
-    CharBackend be = {0};
+    CharFrontend c = {0};
     CharSocketTestData data = {0};
     QObject *qaddr;
     SocketAddress *addr;
@@ -1224,12 +1224,12 @@ static void char_socket_server_test(gconstpointer opaque)
     visit_free(v);
     qobject_unref(qaddr);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
  reconnect:
     data.event = -1;
-    data.be = &be;
-    qemu_chr_fe_set_handlers(&be, NULL, NULL,
+    data.fe = &c;
+    qemu_chr_fe_set_handlers(&c, NULL, NULL,
                              char_socket_event, NULL,
                              &data, NULL, true);
     g_assert(data.event == -1);
@@ -1260,13 +1260,13 @@ static void char_socket_server_test(gconstpointer opaque)
     data.event = -1;
 
     /* Send a greeting to the client */
-    ret = qemu_chr_fe_write_all(&be, (const uint8_t *)SOCKET_PING,
+    ret = qemu_chr_fe_write_all(&c, (const uint8_t *)SOCKET_PING,
                                 sizeof(SOCKET_PING));
     g_assert_cmpint(ret, ==, sizeof(SOCKET_PING));
     g_assert(data.event == -1);
 
     /* Setup a callback to receive the reply to our greeting */
-    qemu_chr_fe_set_handlers(&be, char_socket_can_read,
+    qemu_chr_fe_set_handlers(&c, char_socket_can_read,
                              char_socket_read,
                              char_socket_event, NULL,
                              &data, NULL, true);
@@ -1375,7 +1375,7 @@ static void char_socket_client_test(gconstpointer opaque)
     QIOChannelSocket *ioc;
     char *optstr;
     Chardev *chr;
-    CharBackend be = {0};
+    CharFrontend c = {0};
     CharSocketTestData data = {0};
     SocketAddress *addr;
     QemuThread thread;
@@ -1431,12 +1431,12 @@ static void char_socket_client_test(gconstpointer opaque)
                                           &error_abort));
     }
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
  reconnect:
     data.event = -1;
-    data.be = &be;
-    qemu_chr_fe_set_handlers(&be, NULL, NULL,
+    data.fe = &c;
+    qemu_chr_fe_set_handlers(&c, NULL, NULL,
                              event_cb, NULL,
                              &data, NULL, true);
     if (config->reconnect) {
@@ -1467,13 +1467,13 @@ static void char_socket_client_test(gconstpointer opaque)
     g_assert(object_property_get_bool(OBJECT(chr), "connected", &error_abort));
 
     /* Send a greeting to the server */
-    ret = qemu_chr_fe_write_all(&be, (const uint8_t *)SOCKET_PING,
+    ret = qemu_chr_fe_write_all(&c, (const uint8_t *)SOCKET_PING,
                                 sizeof(SOCKET_PING));
     g_assert_cmpint(ret, ==, sizeof(SOCKET_PING));
     g_assert(data.event == -1);
 
     /* Setup a callback to receive the reply to our greeting */
-    qemu_chr_fe_set_handlers(&be, char_socket_can_read,
+    qemu_chr_fe_set_handlers(&c, char_socket_can_read,
                              char_socket_read,
                              event_cb, NULL,
                              &data, NULL, true);
@@ -1521,7 +1521,7 @@ static void char_socket_server_two_clients_test(gconstpointer opaque)
 {
     SocketAddress *incoming_addr = (gpointer) opaque;
     Chardev *chr;
-    CharBackend be = {0};
+    CharFrontend c = {0};
     QObject *qaddr;
     SocketAddress *addr;
     Visitor *v;
@@ -1558,9 +1558,9 @@ static void char_socket_server_two_clients_test(gconstpointer opaque)
     visit_free(v);
     qobject_unref(qaddr);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
-    qemu_chr_fe_set_handlers(&be, char_socket_can_read, char_socket_discard_read,
+    qemu_chr_fe_set_handlers(&c, char_socket_can_read, char_socket_discard_read,
                              count_closed_event, NULL,
                              &closed, NULL, true);
 
@@ -1570,7 +1570,7 @@ static void char_socket_server_two_clients_test(gconstpointer opaque)
 
     /* switch the chardev to another context */
     GMainContext *ctx = g_main_context_new();
-    qemu_chr_fe_set_handlers(&be, char_socket_can_read, char_socket_discard_read,
+    qemu_chr_fe_set_handlers(&c, char_socket_can_read, char_socket_discard_read,
                              count_closed_event, NULL,
                              &closed, ctx, true);
 
@@ -1649,7 +1649,7 @@ static void char_parallel_test(void)
 static void char_file_fifo_test(void)
 {
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
     char *tmp_path = g_dir_make_tmp("qemu-test-char.XXXXXX", NULL);
     char *fifo = g_build_filename(tmp_path, "fifo", NULL);
     char *out = g_build_filename(tmp_path, "out", NULL);
@@ -1671,8 +1671,8 @@ static void char_file_fifo_test(void)
     chr = qemu_chardev_new("label-file", TYPE_CHARDEV_FILE, &backend,
                            NULL, &error_abort);
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
-    qemu_chr_fe_set_handlers(&be,
+    qemu_chr_fe_init(&c, chr, &error_abort);
+    qemu_chr_fe_set_handlers(&c,
                              fe_can_read,
                              fe_read,
                              fe_event,
@@ -1692,7 +1692,7 @@ static void char_file_fifo_test(void)
     g_assert_cmpint(fe.read_count, ==, 8);
     g_assert_cmpstr(fe.read_buf, ==, "fifo-in");
 
-    qemu_chr_fe_deinit(&be, true);
+    qemu_chr_fe_deinit(&c, true);
 
     g_unlink(fifo);
     g_free(fifo);
@@ -1752,7 +1752,7 @@ static void char_null_test(void)
 {
     Error *err = NULL;
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
     int ret;
 
     chr = qemu_chr_find("label-null");
@@ -1768,27 +1768,27 @@ static void char_null_test(void)
                  QEMU_CHAR_FEATURE_RECONNECTABLE) == false);
 
     /* check max avail */
-    qemu_chr_fe_init(&be, chr, &error_abort);
-    qemu_chr_fe_init(&be, chr, &err);
+    qemu_chr_fe_init(&c, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &err);
     error_free_or_abort(&err);
 
     /* deinit & reinit */
-    qemu_chr_fe_deinit(&be, false);
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_deinit(&c, false);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
-    qemu_chr_fe_set_open(&be, true);
+    qemu_chr_fe_set_open(&c, true);
 
-    qemu_chr_fe_set_handlers(&be,
+    qemu_chr_fe_set_handlers(&c,
                              fe_can_read,
                              fe_read,
                              fe_event,
                              NULL,
                              NULL, NULL, true);
 
-    ret = qemu_chr_fe_write(&be, (void *)"buf", 4);
+    ret = qemu_chr_fe_write(&c, (void *)"buf", 4);
     g_assert_cmpint(ret, ==, 4);
 
-    qemu_chr_fe_deinit(&be, true);
+    qemu_chr_fe_deinit(&c, true);
 }
 
 static void char_invalid_test(void)
@@ -1814,7 +1814,7 @@ static void char_hotswap_test(void)
 {
     char *chr_args;
     Chardev *chr;
-    CharBackend be;
+    CharFrontend c;
 
     gchar *tmp_path = g_dir_make_tmp("qemu-test-char.XXXXXX", NULL);
     char *filename = g_build_filename(tmp_path, "file", NULL);
@@ -1830,32 +1830,32 @@ static void char_hotswap_test(void)
     chr_args = g_strdup_printf("udp:127.0.0.1:%d", port);
 
     chr = qemu_chr_new("chardev", chr_args, NULL);
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&c, chr, &error_abort);
 
     /* check that chardev operates correctly */
     char_udp_test_internal(chr, sock);
 
     /* set the handler that denies the hotswap */
-    qemu_chr_fe_set_handlers(&be, NULL, NULL,
+    qemu_chr_fe_set_handlers(&c, NULL, NULL,
                              NULL, chardev_change_denied, NULL, NULL, true);
 
     /* now, change is denied and has to keep the old backend operating */
     ret = qmp_chardev_change("chardev", &backend, NULL);
     g_assert(!ret);
-    g_assert(be.chr == chr);
+    g_assert(c.chr == chr);
 
     char_udp_test_internal(chr, sock);
 
     /* now allow the change */
-    qemu_chr_fe_set_handlers(&be, NULL, NULL,
+    qemu_chr_fe_set_handlers(&c, NULL, NULL,
                              NULL, chardev_change, NULL, NULL, true);
 
     /* has to succeed now */
     ret = qmp_chardev_change("chardev", &backend, &error_abort);
-    g_assert(be.chr != chr);
+    g_assert(c.chr != chr);
 
     close(sock);
-    chr = be.chr;
+    chr = c.chr;
 
     /* run the file chardev test */
     char_file_test_internal(chr, filename);
diff --git a/tests/unit/test-yank.c b/tests/unit/test-yank.c
index 4acfb2f3f6..9fc86a2128 100644
--- a/tests/unit/test-yank.c
+++ b/tests/unit/test-yank.c
@@ -65,7 +65,7 @@ static void char_change_test(gconstpointer opaque)
     CharChangeTestConfig *conf = (gpointer) opaque;
     SocketAddress *addr;
     Chardev *chr;
-    CharBackend be;
+    CharFrontend fe;
     ChardevReturn *ret;
     QIOChannelSocket *ioc;
     QemuThread thread;
@@ -144,9 +144,9 @@ static void char_change_test(gconstpointer opaque)
         qemu_thread_join(&thread);
     }
 
-    qemu_chr_fe_init(&be, chr, &error_abort);
+    qemu_chr_fe_init(&fe, chr, &error_abort);
     /* allow chardev-change */
-    qemu_chr_fe_set_handlers(&be, NULL, NULL,
+    qemu_chr_fe_set_handlers(&fe, NULL, NULL,
                              NULL, chardev_change, NULL, NULL, true);
 
     if (conf->fail) {
@@ -154,7 +154,7 @@ static void char_change_test(gconstpointer opaque)
         ret = qmp_chardev_change("chardev", &fail_backend[conf->new_yank],
                                  NULL);
         g_assert_null(ret);
-        g_assert(be.chr == chr);
+        g_assert(fe.chr == chr);
         g_assert(is_yank_instance_registered() == conf->old_yank);
         g_unsetenv("QTEST_SILENT_ERRORS");
     } else {
@@ -168,11 +168,11 @@ static void char_change_test(gconstpointer opaque)
             qemu_thread_join(&thread);
         }
         g_assert_nonnull(ret);
-        g_assert(be.chr != chr);
+        g_assert(fe.chr != chr);
         g_assert(is_yank_instance_registered() == conf->new_yank);
     }
 
-    object_unparent(OBJECT(be.chr));
+    object_unparent(OBJECT(fe.chr));
     object_unref(OBJECT(ioc));
     qapi_free_ChardevReturn(ret);
     qapi_free_SocketAddress(addr);

From 2cd3c1d35a06a62b25afa80c5baf381ce4b56805 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 22 Oct 2025 14:52:48 +0200
Subject: [PATCH 1683/2396] accel/mshv: initialize thread name

The initialization was dropped when the code was copied from existing
accelerators.  Coverity knows (CID 1641400).  Fix it.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 accel/mshv/mshv-all.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/accel/mshv/mshv-all.c b/accel/mshv/mshv-all.c
index 45174f7c4e..80428d130d 100644
--- a/accel/mshv/mshv-all.c
+++ b/accel/mshv/mshv-all.c
@@ -596,6 +596,9 @@ static void mshv_start_vcpu_thread(CPUState *cpu)
 {
     char thread_name[VCPU_THREAD_NAME_SIZE];
 
+    snprintf(thread_name, VCPU_THREAD_NAME_SIZE, "CPU %d/MSHV",
+             cpu->cpu_index);
+
     cpu->thread = g_malloc0(sizeof(QemuThread));
     cpu->halt_cond = g_malloc0(sizeof(QemuCond));
 

From 1557adc82698416bc68033765cfffb0a0b91c6bf Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 22 Oct 2025 14:54:30 +0200
Subject: [PATCH 1684/2396] accel/mshv: use return value of handle_pio_str_read

Coverity complains because we assign to ret here but
then never read it again before we overwrite it with
the call to set_x64_registers().

Analyzed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/mshv/mshv-cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/i386/mshv/mshv-cpu.c b/target/i386/mshv/mshv-cpu.c
index 1f7b9cb37e..1c3db02188 100644
--- a/target/i386/mshv/mshv-cpu.c
+++ b/target/i386/mshv/mshv-cpu.c
@@ -1489,6 +1489,10 @@ static int handle_pio_str(CPUState *cpu, hv_x64_io_port_intercept_message *info)
         reg_values[0] = info->rsi;
     } else {
         ret = handle_pio_str_read(cpu, info, repeat, port, direction_flag);
+        if (ret < 0) {
+            error_report("Failed to handle pio str read");
+            return -1;
+        }
         reg_names[0] = HV_X64_REGISTER_RDI;
         reg_values[0] = info->rdi;
     }

From 36ec1a829a07cd9a926b2f0ddfa5079c8dc9dae5 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Thu, 25 Sep 2025 13:28:45 +0100
Subject: [PATCH 1685/2396] esp.c: fix esp_cdb_ready() FIFO wraparound limit
 calculation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The original calculation in commit 3cc70889a3 ("esp.c: prevent cmdfifo overflow
in esp_cdb_ready()") subtracted cmdfifo_cdb_offset from fifo8_num_used() to
calculate the outstanding cmdfifo length, but this is incorrect because
fifo8_num_used() can also include wraparound data.

Instead calculate the maximum offset used by scsi_cdb_length() which is just
the first byte after cmdfifo_cdb_offset, and then peek the entire content
of the cmdfifo. The fifo8_peek_bufptr() result will then return the maximum
length of remaining data up to the end of the internal cmdfifo array, which
can then be used for the overflow check.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Fixes: 3cc70889a3 ("esp.c: prevent cmdfifo overflow in esp_cdb_ready()")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3082
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250925122846.527615-2-mark.cave-ayland@ilande.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/esp.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/esp.c b/hw/scsi/esp.c
index 1d264c40e5..2809fcdee0 100644
--- a/hw/scsi/esp.c
+++ b/hw/scsi/esp.c
@@ -447,7 +447,9 @@ static void write_response(ESPState *s)
 
 static bool esp_cdb_ready(ESPState *s)
 {
-    int len = fifo8_num_used(&s->cmdfifo) - s->cmdfifo_cdb_offset;
+    /* scsi_cdb_length() only reads the first byte */
+    int limit = s->cmdfifo_cdb_offset + 1;
+    int len = fifo8_num_used(&s->cmdfifo);
     const uint8_t *pbuf;
     uint32_t n;
     int cdblen;
@@ -457,7 +459,7 @@ static bool esp_cdb_ready(ESPState *s)
     }
 
     pbuf = fifo8_peek_bufptr(&s->cmdfifo, len, &n);
-    if (n < len) {
+    if (n < limit) {
         /*
          * In normal use the cmdfifo should never wrap, but include this check
          * to prevent a malicious guest from reading past the end of the

From e9d02b59316fcbc9650d747b06e2755374ab3b70 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Date: Thu, 25 Sep 2025 13:28:46 +0100
Subject: [PATCH 1686/2396] qtest/am53c974-test: add additional test for
 cmdfifo overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Based upon the qtest reproducer posted to Gitlab issue #3082 at
https://gitlab.com/qemu-project/qemu/-/issues/3082.

Signed-off-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20250925122846.527615-3-mark.cave-ayland@ilande.co.uk
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 tests/qtest/am53c974-test.c | 40 +++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/tests/qtest/am53c974-test.c b/tests/qtest/am53c974-test.c
index ed3ac7db20..a3667275ac 100644
--- a/tests/qtest/am53c974-test.c
+++ b/tests/qtest/am53c974-test.c
@@ -109,6 +109,44 @@ static void test_cmdfifo_overflow2_ok(void)
     qtest_quit(s);
 }
 
+/* Reported as https://issues.oss-fuzz.com/issues/439878564 */
+static void test_cmdfifo_overflow3_ok(void)
+{
+    QTestState *s = qtest_init(
+        "-device am53c974,id=scsi -device scsi-hd,drive=disk0 "
+        "-drive id=disk0,if=none,file=null-co://,format=raw -nodefaults");
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xc000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x01);
+    qtest_outb(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00b, 0x9100);
+    qtest_outl(s, 0xc009, 0x02000000);
+    qtest_outl(s, 0xc000, 0x0b);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0xc200);
+    qtest_outl(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc00b, 0x9000);
+    qtest_outb(s, 0xc008, 0x00);
+    qtest_outb(s, 0xc008, 0x00);
+    qtest_outl(s, 0xc03f, 0x0300);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x4200);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outw(s, 0xc00b, 0x1200);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outb(s, 0xc00c, 0x43);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc00b, 0x00);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_outl(s, 0xc00b, 0x1000);
+    qtest_outl(s, 0xc007, 0x00);
+    qtest_quit(s);
+}
+
 /* Reported as crash_0900379669 */
 static void test_fifo_pop_buf(void)
 {
@@ -266,6 +304,8 @@ int main(int argc, char **argv)
                        test_cmdfifo_overflow_ok);
         qtest_add_func("am53c974/test_cmdfifo_overflow2_ok",
                        test_cmdfifo_overflow2_ok);
+        qtest_add_func("am53c974/test_cmdfifo_overflow3_ok",
+                       test_cmdfifo_overflow3_ok);
         qtest_add_func("am53c974/test_fifo_pop_buf",
                        test_fifo_pop_buf);
         qtest_add_func("am53c974/test_target_selected_ok",

From 59d8f86442fb7ef7fb8f62ce0e7fedadd027ba39 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 24 Oct 2025 12:13:44 +0800
Subject: [PATCH 1687/2396] rust/qemu-macros: Convert bit value to u8 within
 #[property]

For bit property, make the type conversion within the #[property] macro
so that users do not need to handle the conversion.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Link: https://lore.kernel.org/r/20251024041344.1389488-1-zhao1.liu@intel.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs |  2 +-
 rust/qemu-macros/src/lib.rs      | 23 ++++++++++++++++++-----
 rust/qemu-macros/src/tests.rs    | 15 ++++++++++++---
 3 files changed, 31 insertions(+), 9 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 86638c0766..23f2eefd1c 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -539,7 +539,7 @@ pub struct HPETState {
     // Internal state
     /// Capabilities that QEMU HPET supports.
     /// bit 0: MSI (or FSB) support.
-    #[property(rename = "msi", bit = HPET_FLAG_MSI_SUPPORT_SHIFT as u8, default = false)]
+    #[property(rename = "msi", bit = HPET_FLAG_MSI_SUPPORT_SHIFT, default = false)]
     flags: u32,
 
     /// Offset of main counter relative to qemu clock.
diff --git a/rust/qemu-macros/src/lib.rs b/rust/qemu-macros/src/lib.rs
index 50239f228b..ee417bb4b4 100644
--- a/rust/qemu-macros/src/lib.rs
+++ b/rust/qemu-macros/src/lib.rs
@@ -262,12 +262,25 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
             },
         )?;
         let field_ty = field.ty.clone();
-        let qdev_prop = if bitnr.is_none() {
-            quote! { <#field_ty as ::hwcore::QDevProp>::BASE_INFO }
+        let (qdev_prop, bitval) = if let Some(bitval) = bitnr {
+            (
+                quote! { <#field_ty as ::hwcore::QDevProp>::BIT_INFO },
+                quote! {
+                    {
+                        const {
+                            assert!(#bitval >= 0 && #bitval < #field_ty::BITS as _,
+                                    "bit number exceeds type bits range");
+                        }
+                        #bitval as u8
+                    }
+                },
+            )
         } else {
-            quote! { <#field_ty as ::hwcore::QDevProp>::BIT_INFO }
+            (
+                quote! { <#field_ty as ::hwcore::QDevProp>::BASE_INFO },
+                quote! { 0 },
+            )
         };
-        let bitnr = bitnr.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
         let set_default = defval.is_some();
         let defval = defval.unwrap_or(syn::Expr::Verbatim(quote! { 0 }));
         properties_expanded.push(quote! {
@@ -275,7 +288,7 @@ fn derive_device_or_error(input: DeriveInput) -> Result<proc_macro2::TokenStream
                 name: ::std::ffi::CStr::as_ptr(#prop_name),
                 info: #qdev_prop,
                 offset: ::core::mem::offset_of!(#name, #field_name) as isize,
-                bitnr: #bitnr,
+                bitnr: #bitval,
                 set_default: #set_default,
                 defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: #defval as u64 },
                 ..::common::Zeroable::ZERO
diff --git a/rust/qemu-macros/src/tests.rs b/rust/qemu-macros/src/tests.rs
index 65691412ff..b65cf656fa 100644
--- a/rust/qemu-macros/src/tests.rs
+++ b/rust/qemu-macros/src/tests.rs
@@ -179,7 +179,10 @@ fn test_derive_device() {
                         name: ::std::ffi::CStr::as_ptr(c"flags"),
                         info: <u32 as ::hwcore::QDevProp>::BIT_INFO,
                         offset: ::core::mem::offset_of!(DummyState, flags) as isize,
-                        bitnr: 3,
+                        bitnr : {
+                            const { assert!(3 >= 0 && 3 < u32::BITS as _ , "bit number exceeds type bits range"); }
+                            3 as u8
+                        },
                         set_default: false,
                         defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: 0 as u64 },
                         ..::common::Zeroable::ZERO
@@ -207,7 +210,10 @@ fn test_derive_device() {
                         name: ::std::ffi::CStr::as_ptr(c"flags"),
                         info: <u32 as ::hwcore::QDevProp>::BIT_INFO,
                         offset: ::core::mem::offset_of!(DummyState, flags) as isize,
-                        bitnr: 3,
+                        bitnr : {
+                            const { assert!(3 >= 0 && 3 < u32::BITS as _ , "bit number exceeds type bits range"); }
+                            3 as u8
+                        },
                         set_default: true,
                         defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: true as u64 },
                         ..::common::Zeroable::ZERO
@@ -235,7 +241,10 @@ fn test_derive_device() {
                         name: ::std::ffi::CStr::as_ptr(c"msi"),
                         info: <u64 as ::hwcore::QDevProp>::BIT_INFO,
                         offset: ::core::mem::offset_of!(DummyState, flags) as isize,
-                        bitnr: 3,
+                        bitnr : {
+                            const { assert!(3 >= 0 && 3 < u64::BITS as _ , "bit number exceeds type bits range"); }
+                            3 as u8
+                        },
                         set_default: true,
                         defval: ::hwcore::bindings::Property__bindgen_ty_1 { u: false as u64 },
                         ..::common::Zeroable::ZERO

From 7e7df2072466de7c0e503857b1530b5459aadfca Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 18 Oct 2025 10:13:45 +0200
Subject: [PATCH 1688/2396] scsi: make SCSIRequest refcount atomic

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/scsi/scsi-bus.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/hw/scsi/scsi-bus.c b/hw/scsi/scsi-bus.c
index 9b12ee7f1c..b9b115deed 100644
--- a/hw/scsi/scsi-bus.c
+++ b/hw/scsi/scsi-bus.c
@@ -823,7 +823,6 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
 {
     SCSIRequest *req;
     SCSIBus *bus = scsi_bus_from_device(d);
-    BusState *qbus = BUS(bus);
     const int memset_off = offsetof(SCSIRequest, sense)
                            + sizeof(req->sense);
 
@@ -838,8 +837,6 @@ SCSIRequest *scsi_req_alloc(const SCSIReqOps *reqops, SCSIDevice *d,
     req->status = -1;
     req->host_status = -1;
     req->ops = reqops;
-    object_ref(OBJECT(d));
-    object_ref(OBJECT(qbus->parent));
     notifier_list_init(&req->cancel_notifiers);
 
     if (reqops->init_req) {
@@ -1496,15 +1493,15 @@ void scsi_device_report_change(SCSIDevice *dev, SCSISense sense)
 
 SCSIRequest *scsi_req_ref(SCSIRequest *req)
 {
-    assert(req->refcount > 0);
-    req->refcount++;
+    assert(qatomic_read(&req->refcount) > 0);
+    qatomic_inc(&req->refcount);
     return req;
 }
 
 void scsi_req_unref(SCSIRequest *req)
 {
-    assert(req->refcount > 0);
-    if (--req->refcount == 0) {
+    assert(qatomic_read(&req->refcount) > 0);
+    if (qatomic_fetch_dec(&req->refcount) == 1) {
         BusState *qbus = req->dev->qdev.parent_bus;
         SCSIBus *bus = DO_UPCAST(SCSIBus, qbus, qbus);
 
@@ -1514,8 +1511,6 @@ void scsi_req_unref(SCSIRequest *req)
         if (req->ops->free_req) {
             req->ops->free_req(req);
         }
-        object_unref(OBJECT(req->dev));
-        object_unref(OBJECT(qbus->parent));
         g_free(req);
     }
 }

From 6763d7be6b4d6992966f932b23c63490b735ac63 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 22 Oct 2025 12:14:18 +0200
Subject: [PATCH 1689/2396] qdev: Change PropertyInfo method print() to return
 malloc'ed string
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simpler (more so after the next commit), and no risk of truncation
because the caller's buffer is too small.  Performance doesn't matter;
the method is only used for "info qdev".

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251022101420.36059-2-armbru@redhat.com
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/core/qdev-properties-system.c | 7 +++----
 hw/core/qdev-properties.c        | 9 ++++-----
 include/hw/qdev-properties.h     | 2 +-
 3 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index c15371f8cd..13cc91680b 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -865,15 +865,14 @@ out:
     visit_end_alternate(v, (void **) &alt);
 }
 
-static int print_pci_devfn(Object *obj, const Property *prop, char *dest,
-                           size_t len)
+static char *print_pci_devfn(Object *obj, const Property *prop)
 {
     int32_t *ptr = object_field_prop_ptr(obj, prop);
 
     if (*ptr == -1) {
-        return snprintf(dest, len, "<unset>");
+        return g_strdup("<unset>");
     } else {
-        return snprintf(dest, len, "%02x.%x", *ptr >> 3, *ptr & 7);
+        return g_strdup_printf("%02x.%x", *ptr >> 3, *ptr & 7);
     }
 }
 
diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index b7e8a89ba5..422a486969 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -1117,12 +1117,11 @@ static void qdev_get_legacy_property(Object *obj, Visitor *v,
                                      Error **errp)
 {
     const Property *prop = opaque;
+    char *s;
 
-    char buffer[1024];
-    char *ptr = buffer;
-
-    prop->info->print(obj, prop, buffer, sizeof(buffer));
-    visit_type_str(v, name, &ptr, errp);
+    s = prop->info->print(obj, prop);
+    visit_type_str(v, name, &s, errp);
+    g_free(s);
 }
 
 /**
diff --git a/include/hw/qdev-properties.h b/include/hw/qdev-properties.h
index 0197aa4995..60b8133009 100644
--- a/include/hw/qdev-properties.h
+++ b/include/hw/qdev-properties.h
@@ -34,7 +34,7 @@ struct PropertyInfo {
     const char *description;
     const QEnumLookup *enum_table;
     bool realized_set_allowed; /* allow setting property on realized device */
-    int (*print)(Object *obj, const Property *prop, char *dest, size_t len);
+    char *(*print)(Object *obj, const Property *prop);
     void (*set_default_value)(ObjectProperty *op, const Property *prop);
     ObjectProperty *(*create)(ObjectClass *oc, const char *name,
                               const Property *prop);

From 329e36af941edaac7f688abc13c4be0c54cc8440 Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 23 Oct 2025 15:28:09 +0100
Subject: [PATCH 1690/2396] hw/i386/isapc.c: warn rather than reject modern x86
 CPU models
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit e1e2909f8e ("hw/i386/pc_piix.c: restrict isapc machine to 32-bit CPUs")
restricted the isapc machine to 32-bit CPUs, but subsequent concern has been
expressed as to the effect this could have on users.

The outcome of the latest discussion is that we should exercise more caution
and follow the official deprecation route, so instead of rejecting modern x86
CPUs issue a deprecation warning but allow the user to continue.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251023142926.964718-2-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/i386/isapc.c | 55 ++++++++++++++++++++-----------------------------
 1 file changed, 22 insertions(+), 33 deletions(-)

diff --git a/hw/i386/isapc.c b/hw/i386/isapc.c
index 44f4a44672..1ba9ae22cc 100644
--- a/hw/i386/isapc.c
+++ b/hw/i386/isapc.c
@@ -41,29 +41,31 @@ static void pc_init_isa(MachineState *machine)
     DriveInfo *hd[MAX_IDE_BUS * MAX_IDE_DEVS];
     int i;
 
-    /*
-     * There is a small chance that someone unintentionally passes "-cpu max"
-     * for the isapc machine, which will provide a much more modern 32-bit
-     * CPU than would be expected for an ISA-era PC. If the "max" cpu type has
-     * been specified, choose the "best" 32-bit cpu possible which we consider
-     * be the pentium3 (deliberately choosing an Intel CPU given that the
-     * default 486 CPU for the isapc machine is also an Intel CPU).
-     */
-    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("max"))) {
-        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
-        warn_report("-cpu max is invalid for isapc machine, using pentium3");
-    }
+    bool valid_cpu_type = false;
+    static const char * const valid_cpu_types[] = {
+        X86_CPU_TYPE_NAME("486"),
+        X86_CPU_TYPE_NAME("athlon"),
+        X86_CPU_TYPE_NAME("kvm32"),
+        X86_CPU_TYPE_NAME("pentium"),
+        X86_CPU_TYPE_NAME("pentium2"),
+        X86_CPU_TYPE_NAME("pentium3"),
+        X86_CPU_TYPE_NAME("qemu32"),
+    };
 
     /*
-     * Similarly if someone unintentionally passes "-cpu host" for the isapc
-     * machine then display a warning and also switch to the "best" 32-bit
-     * cpu possible which we consider to be the pentium3. This is because any
-     * host CPU will already be modern than this, but it also ensures any
-     * newer CPU flags/features are filtered out for older guests.
+     * The isapc machine is supposed to represent a legacy ISA-only PC with a
+     * 32-bit processor. For historical reasons the machine can still accept
+     * almost any valid processor, but this is now deprecated in 10.2. Emit
+     * a warning if anyone tries to use a deprecated CPU.
      */
-    if (!strcmp(machine->cpu_type, X86_CPU_TYPE_NAME("host"))) {
-        machine->cpu_type = X86_CPU_TYPE_NAME("pentium3");
-        warn_report("-cpu host is invalid for isapc machine, using pentium3");
+    for (i = 0; i < ARRAY_SIZE(valid_cpu_types); i++) {
+        if (!strcmp(machine->cpu_type, valid_cpu_types[i])) {
+            valid_cpu_type = true;
+        }
+    }
+
+    if (!valid_cpu_type) {
+        warn_report("cpu type %s is deprecated for isapc machine", machine->cpu_type);
     }
 
     if (machine->ram_size > 3.5 * GiB) {
@@ -154,18 +156,6 @@ static void pc_init_isa(MachineState *machine)
 
 static void isapc_machine_options(MachineClass *m)
 {
-    static const char * const valid_cpu_types[] = {
-        X86_CPU_TYPE_NAME("486"),
-        X86_CPU_TYPE_NAME("athlon"),
-        X86_CPU_TYPE_NAME("kvm32"),
-        X86_CPU_TYPE_NAME("pentium"),
-        X86_CPU_TYPE_NAME("pentium2"),
-        X86_CPU_TYPE_NAME("pentium3"),
-        X86_CPU_TYPE_NAME("qemu32"),
-        X86_CPU_TYPE_NAME("max"),
-        X86_CPU_TYPE_NAME("host"),
-        NULL
-    };
     PCMachineClass *pcmc = PC_MACHINE_CLASS(m);
 
     m->desc = "ISA-only PC";
@@ -180,7 +170,6 @@ static void isapc_machine_options(MachineClass *m)
     pcmc->has_reserved_memory = false;
     m->default_nic = "ne2k_isa";
     m->default_cpu_type = X86_CPU_TYPE_NAME("486");
-    m->valid_cpu_types = valid_cpu_types;
     m->no_floppy = !module_object_class_by_name(TYPE_ISA_FDC);
     m->no_parallel = !module_object_class_by_name(TYPE_ISA_PARALLEL);
 }

From 9a2aa6bfebd63a768304daa0bc9da7cd7c131b6f Mon Sep 17 00:00:00 2001
From: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Date: Thu, 23 Oct 2025 15:28:10 +0100
Subject: [PATCH 1691/2396] docs/about/deprecated.rst: document isapc
 deprecation for modern x86 CPU models
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a new paragraph in the "Backwards compatibility" section documenting that
using modern x86 CPU models with the isapc machine is deprecated, and will be
rejected in a future release.

Signed-off-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251023142926.964718-3-mark.caveayland@nutanix.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 docs/about/deprecated.rst | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index dacf2882e4..020610132f 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -544,6 +544,20 @@ available firmwares that are using the current (wrong) name.  The
 property is kept as is in 9.1, together with "riscv,delegation", to
 give more time for firmware developers to change their code.
 
+x86 "isapc" board use of modern x86 CPUs (since 10.2)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The "isapc" board represents a historical x86 ISA PC and is intended for
+older 32-bit x86 CPU models, defaulting to a 486 CPU model.  Previously it
+was possible (but non-sensical) to specify a more modern x86 CPU, including
+``-cpu host`` or ``-cpu max`` even if the features were incompatible with many
+of the intended guest OSs.
+
+If the user requests a modern x86 CPU model (i.e. not one of ``486``,
+``athlon``, ``kvm32``, ``pentium``, ``pentium2``, ``pentium3``or ``qemu32``)
+a warning will be displayed until a future QEMU version when such CPUs will
+be rejected.
+
 Migration
 ---------
 

From 2a5c43fafc668c845647c346be0604bd8792fc3b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 27 Oct 2025 11:40:12 +0100
Subject: [PATCH 1692/2396] tests/functional/i386: Remove unused variable from
 the replay test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove a left-over from the time when this test was still an
avocado-based test.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/functional/i386/test_replay.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tests/functional/i386/test_replay.py b/tests/functional/i386/test_replay.py
index 7c4c2602da..3a92ecde17 100755
--- a/tests/functional/i386/test_replay.py
+++ b/tests/functional/i386/test_replay.py
@@ -17,7 +17,6 @@ class I386Replay(ReplayKernelBase):
 
     def test_pc(self):
         self.set_machine('pc')
-        kernel_url = ()
         kernel_path = self.ASSET_KERNEL.fetch()
         kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
         console_pattern = 'VFS: Cannot open root device'

From d5e1d2dea11b803ba9121fc12d3c1662b79ad941 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 24 Oct 2025 09:18:43 +0200
Subject: [PATCH 1693/2396] target/i386: clear CPU_INTERRUPT_SIPI for all
 accelerators

Similar to what commit df32e5c5 did for TCG; fixes boot with multiple
processors on WHPX and probably more accelerators

Fixes: df32e5c568c ("i386/cpu: Prevent delivering SIPI during SMM in TCG mode", 2025-10-14)
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3178
Cc: qemu-stable@nongnu.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/hvf/x86hvf.c    | 1 +
 target/i386/kvm/kvm.c       | 1 +
 target/i386/nvmm/nvmm-all.c | 1 +
 target/i386/whpx/whpx-all.c | 1 +
 4 files changed, 4 insertions(+)

diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index a502437c30..3838c9f5a6 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -446,6 +446,7 @@ int hvf_process_events(CPUState *cs)
         cs->halted = 0;
     }
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_SIPI)) {
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_SIPI);
         cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
diff --git a/target/i386/kvm/kvm.c b/target/i386/kvm/kvm.c
index 4dea1ed8f0..60c7981138 100644
--- a/target/i386/kvm/kvm.c
+++ b/target/i386/kvm/kvm.c
@@ -5659,6 +5659,7 @@ int kvm_arch_process_async_events(CPUState *cs)
         cs->halted = 0;
     }
     if (cpu_test_interrupt(cs, CPU_INTERRUPT_SIPI)) {
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_SIPI);
         kvm_cpu_synchronize_state(cs);
         do_cpu_sipi(cpu);
     }
diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index 2e442baf4b..b9bd9ed985 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -709,6 +709,7 @@ nvmm_vcpu_loop(CPUState *cpu)
         cpu->halted = false;
     }
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SIPI)) {
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_SIPI);
         nvmm_cpu_synchronize_state(cpu);
         do_cpu_sipi(x86_cpu);
     }
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 256761834c..6bf8d5f4bb 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1621,6 +1621,7 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
     }
 
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_SIPI)) {
+        cpu_reset_interrupt(cpu, CPU_INTERRUPT_SIPI);
         whpx_cpu_synchronize_state(cpu);
         do_cpu_sipi(x86_cpu);
     }

From e1be0f37e2eb142e807a99815dc073b2ade72d51 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 27 Oct 2025 15:04:20 +0000
Subject: [PATCH 1694/2396] docs/system/sriov.rst: Fix typo in title

Fix a typo in the title of the sriov.rst document.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 docs/system/sriov.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/system/sriov.rst b/docs/system/sriov.rst
index d12178f3c3..b19e787339 100644
--- a/docs/system/sriov.rst
+++ b/docs/system/sriov.rst
@@ -1,7 +1,7 @@
 .. SPDX-License-Identifier: GPL-2.0-or-later
 
-Compsable SR-IOV device
-=======================
+Composable SR-IOV device
+========================
 
 SR-IOV (Single Root I/O Virtualization) is an optional extended capability of a
 PCI Express device. It allows a single physical function (PF) to appear as

From aba49488cb4fa1c7501a454457c20be73bcba651 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 13 Oct 2025 13:11:52 +0200
Subject: [PATCH 1695/2396] hw/xen: Avoid non-inclusive language in params.h

Copy the latest version of Xen's params.h to the QEMU repository:

https://xenbits.xen.org/gitweb/?p=xen.git;a=commitdiff;h=0291089f6ea81690f37035a124d54c51fa7ba097#patch8

With this patch, we get rid of a non-inclusive word in the comment
there.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Acked-by: Anthony PERARD <anthony.perard@vates.tech>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 include/hw/xen/interface/hvm/params.h | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/include/hw/xen/interface/hvm/params.h b/include/hw/xen/interface/hvm/params.h
index a22b4ed45d..99c40b4287 100644
--- a/include/hw/xen/interface/hvm/params.h
+++ b/include/hw/xen/interface/hvm/params.h
@@ -246,16 +246,11 @@
 #define HVM_PARAM_VM_GENERATION_ID_ADDR 34
 
 /*
- * Set mode for altp2m:
- *  disabled: don't activate altp2m (default)
+ * Get mode for altp2m:
+ *  disabled: altp2m not active (default)
  *  mixed: allow access to all altp2m ops for both in-guest and external tools
  *  external: allow access to external privileged tools only
  *  limited: guest only has limited access (ie. control VMFUNC and #VE)
- *
- * Note that 'mixed' mode has not been evaluated for safety from a
- * security perspective.  Before using this mode in a
- * security-critical environment, each subop should be evaluated for
- * safety, with unsafe subops blacklisted in XSM.
  */
 #define HVM_PARAM_ALTP2M       35
 #define XEN_ALTP2M_disabled      0

From 7c7089321670fb51022a1c4493cbcc69aa288a0f Mon Sep 17 00:00:00 2001
From: Bastian Blank <bblank@thinkmo.de>
Date: Tue, 28 Oct 2025 13:16:12 +0100
Subject: [PATCH 1696/2396] linux-user: Use correct type for FIBMAP and
 FIGETBSZ emulation

Both the FIBMAP and FIGETBSZ ioctl get "int *" (pointer to 32bit
integer) as argument, not "long *" as specified in qemu.  Using the
correct type makes the emulation work in cross endian context.

Both ioctl does not seem to be documented. However the kernel
implementation has always used "int *".

Signed-off-by: Bastian Blank <waldi@debian.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3185
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Helge Deller <deller@gmx.de>
Reviwed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/ioctls.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h
index 3b41128fd7..2f62fd2cb9 100644
--- a/linux-user/ioctls.h
+++ b/linux-user/ioctls.h
@@ -130,7 +130,7 @@
      IOCTL(FDTWADDLE, 0, TYPE_NULL)
      IOCTL(FDEJECT, 0, TYPE_NULL)
 
-     IOCTL(FIBMAP, IOC_W | IOC_R, MK_PTR(TYPE_LONG))
+     IOCTL(FIBMAP, IOC_W | IOC_R, MK_PTR(TYPE_INT))
 #ifdef FICLONE
      IOCTL(FICLONE, IOC_W, TYPE_INT)
      IOCTL(FICLONERANGE, IOC_W, MK_PTR(MK_STRUCT(STRUCT_file_clone_range)))
@@ -145,7 +145,7 @@
      IOCTL(FITRIM, IOC_W | IOC_R, MK_PTR(MK_STRUCT(STRUCT_fstrim_range)))
 #endif
 
-     IOCTL(FIGETBSZ, IOC_R, MK_PTR(TYPE_LONG))
+     IOCTL(FIGETBSZ, IOC_R, MK_PTR(TYPE_INT))
 #ifdef CONFIG_FIEMAP
      IOCTL_SPECIAL(FS_IOC_FIEMAP, IOC_W | IOC_R, do_ioctl_fs_ioc_fiemap,
                    MK_PTR(MK_STRUCT(STRUCT_fiemap)))

From d4fbf6ff8d12cd11d53f7baa408f50fbb0441d87 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 28 Oct 2025 12:21:29 +0100
Subject: [PATCH 1697/2396] rust: migration: allow passing ParentField<> to
 vmstate_of!

The common superclass for devices could have its own migration state;
for it to be included in the subclass's VMState, ParentField<> must
implement the VMState trait.

Reported-by: Chen Miao <chenmiao@openatom.club>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 3 ++-
 rust/qom/src/qom.rs           | 3 ++-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 42e5df8d81..5a237c409a 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -268,7 +268,7 @@ macro_rules! impl_vmstate_transparent {
     ($type:ty where $base:tt: VMState $($where:tt)*) => {
         unsafe impl<$base> $crate::vmstate::VMState for $type where $base: $crate::vmstate::VMState $($where)* {
             const BASE: $crate::vmstate::VMStateField = $crate::vmstate::VMStateField {
-                size: mem::size_of::<$type>(),
+                size: ::core::mem::size_of::<$type>(),
                 ..<$base as $crate::vmstate::VMState>::BASE
             };
             const VARRAY_FLAG: $crate::bindings::VMStateFlags = <$base as $crate::vmstate::VMState>::VARRAY_FLAG;
@@ -282,6 +282,7 @@ impl_vmstate_transparent!(std::cell::Cell<T> where T: VMState);
 impl_vmstate_transparent!(std::cell::UnsafeCell<T> where T: VMState);
 impl_vmstate_transparent!(std::pin::Pin<T> where T: VMState);
 impl_vmstate_transparent!(common::Opaque<T> where T: VMState);
+impl_vmstate_transparent!(std::mem::ManuallyDrop<T> where T: VMState);
 
 #[macro_export]
 macro_rules! impl_vmstate_bitsized {
diff --git a/rust/qom/src/qom.rs b/rust/qom/src/qom.rs
index 5808051cd7..84455cea79 100644
--- a/rust/qom/src/qom.rs
+++ b/rust/qom/src/qom.rs
@@ -102,7 +102,7 @@ use std::{
 };
 
 use common::Opaque;
-use migration::impl_vmstate_pointer;
+use migration::{impl_vmstate_pointer, impl_vmstate_transparent};
 
 use crate::bindings::{
     self, object_class_dynamic_cast, object_dynamic_cast, object_get_class, object_get_typename,
@@ -182,6 +182,7 @@ macro_rules! qom_isa {
 #[derive(Debug)]
 #[repr(transparent)]
 pub struct ParentField<T: ObjectType>(std::mem::ManuallyDrop<T>);
+impl_vmstate_transparent!(ParentField<T> where T: VMState + ObjectType);
 
 impl<T: ObjectType> Deref for ParentField<T> {
     type Target = T;

From 3ab823b980ae33cec3e64053230af7b2807dce60 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 11 Sep 2025 16:29:22 +0200
Subject: [PATCH 1698/2396] tests/qemu-iotests: Mark the 'inactive-node-nbd' as
 unsupported with -luks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When running "./check -luks inactive-node-nbd", the test currently fails
because QEMU terminates immediately. The reason can be seen with the
"-p" parameter of the "check" script:

 qemu-system-x86_64: -blockdev luks,file=disk-file,node-name=disk-fmt,active=off:
  Parameter 'key-secret' is required for cipher

Quoting Kevin: "The test case just isn't made for luks. iotests.py has
special code for luks in VM.add_drive(), but not in VM.add_blockdev()."

Thus let's mark it as unsupported on luks to avoid the failure.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20250911142922.222365-1-thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/inactive-node-nbd | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qemu-iotests/tests/inactive-node-nbd b/tests/qemu-iotests/tests/inactive-node-nbd
index a95b37e796..664157bfd0 100755
--- a/tests/qemu-iotests/tests/inactive-node-nbd
+++ b/tests/qemu-iotests/tests/inactive-node-nbd
@@ -24,6 +24,7 @@ from iotests import QemuIoInteractive
 from iotests import filter_qemu_io, filter_qtest, filter_qmp_testfiles
 
 iotests.script_initialize(supported_fmts=['generic'],
+                          unsupported_fmts=['luks'],
                           supported_protocols=['file'],
                           supported_platforms=['linux'])
 

From 6eda39a87f4fda78befa4085e3644e4440afc1dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 19 Sep 2025 11:38:10 +0100
Subject: [PATCH 1699/2396] block: remove 'detached-header' option from opts
 after use
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code for creating LUKS devices references a 'detached-header'
option in the QemuOpts  data, but does not consume (remove) the
option.

Thus when the code later tries to convert the remaining unused
QemuOpts into a QCryptoBlockCreateOptions struct, an error is
reported by the QAPI code that 'detached-header' is not a valid
field.

This fixes a regression caused by

  commit e818c01ae6e7c54c7019baaf307be59d99ce80b9
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Mon Feb 19 15:12:59 2024 +0000

    qapi: drop unused QCryptoBlockCreateOptionsLUKS.detached-header

which identified that the QAPI field was unused, but failed to
realize the QemuOpts -> QCryptoBlockCreateOptions conversion
was seeing the left-over 'detached-header' option which had not
been removed from QemuOpts.

This problem was identified by the 'luks-detached-header' I/O
test, but unfortunately I/O tests are not run regularly for the
LUKS format.

Fixes: e818c01ae6e7c54c7019baaf307be59d99ce80b9
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250919103810.1513109-1-berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/crypto.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/crypto.c b/block/crypto.c
index d4226cc68a..17b4749a1e 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -792,7 +792,7 @@ block_crypto_co_create_opts_luks(BlockDriver *drv, const char *filename,
     char *buf = NULL;
     int64_t size;
     bool detached_hdr =
-        qemu_opt_get_bool(opts, "detached-header", false);
+        qemu_opt_get_bool_del(opts, "detached-header", false);
     unsigned int cflags = 0;
     int ret;
     Error *local_err = NULL;

From c86488abaf017ed3f5a636c3247cd640a93d3b08 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 19 Sep 2025 12:22:13 +0100
Subject: [PATCH 1700/2396] block: fix luks 'amend' when run in coroutine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Launch QEMU with

  $ qemu-img create \
      --object secret,id=sec0,data=123456 \
      -f luks -o key-secret=sec0 demo.luks 1g

  $ qemu-system-x86_64 \
      --object secret,id=sec0,data=123456 \
      -blockdev  driver=luks,key-secret=sec0,file.filename=demo.luks,file.driver=file,node-name=luks

Then in QMP shell attempt

  x-blockdev-amend job-id=fish node-name=luks options={'state':'active','new-secret':'sec0','driver':'luks'}

It will result in an assertion

  #0  __pthread_kill_implementation (threadid=<optimized out>, signo=signo@entry=6, no_tid=no_tid@entry=0) at pthread_kill.c:44
  #1  0x00007fad18b73f63 in __pthread_kill_internal (threadid=<optimized out>, signo=6) at pthread_kill.c:89
  #2  0x00007fad18b19f3e in __GI_raise (sig=sig@entry=6) at ../sysdeps/posix/raise.c:26
  #3  0x00007fad18b016d0 in __GI_abort () at abort.c:77
  #4  0x00007fad18b01639 in __assert_fail_base
      (fmt=<optimized out>, assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>) at assert.c:118
  #5  0x00007fad18b120af in __assert_fail (assertion=<optimized out>, file=<optimized out>, line=<optimized out>, function=<optimized out>)
      at assert.c:127
  #6  0x000055ff74fdbd46 in bdrv_graph_rdlock_main_loop () at ../block/graph-lock.c:260
  #7  0x000055ff7548521b in graph_lockable_auto_lock_mainloop (x=<optimized out>)
      at /usr/src/debug/qemu-9.2.4-1.fc42.x86_64/include/block/graph-lock.h:266
  #8  block_crypto_read_func (block=<optimized out>, offset=4096, buf=0x55ffb6d66ef0 "", buflen=256000, opaque=0x55ffb5edcc30, errp=0x55ffb6f00700)
      at ../block/crypto.c:71
  #9  0x000055ff75439f8b in qcrypto_block_luks_load_key
      (block=block@entry=0x55ffb5edbe90, slot_idx=slot_idx@entry=0, password=password@entry=0x55ffb67dc260 "123456", masterkey=masterkey@entry=0x55ffb5fb0c40 "", readfunc=readfunc@entry=0x55ff754851e0 <block_crypto_read_func>, opaque=opaque@entry=0x55ffb5edcc30, errp=0x55ffb6f00700)
      at ../crypto/block-luks.c:927
  #10 0x000055ff7543b90f in qcrypto_block_luks_find_key
      (block=<optimized out>, password=<optimized out>, masterkey=<optimized out>, readfunc=<optimized out>, opaque=<optimized out>, errp=<optimized out>) at ../crypto/block-luks.c:1045
  #11 qcrypto_block_luks_amend_add_keyslot
      (block=0x55ffb5edbe90, readfunc=0x55ff754851e0 <block_crypto_read_func>, writefunc=0x55ff75485100 <block_crypto_write_func>, opaque=0x55ffb5edcc3, opts_luks=0x7fad1715aef8, force=<optimized out>, errp=0x55ffb6f00700) at ../crypto/block-luks.c:1673
  #12 qcrypto_block_luks_amend_options
      (block=0x55ffb5edbe90, readfunc=0x55ff754851e0 <block_crypto_read_func>, writefunc=0x55ff75485100 <block_crypto_write_func>, opaque=0x55ffb5edcc30, options=0x7fad1715aef0, force=<optimized out>, errp=0x55ffb6f00700) at ../crypto/block-luks.c:1865
  #13 0x000055ff75485b95 in block_crypto_amend_options_generic_luks
      (bs=<optimized out>, amend_options=<optimized out>, force=<optimized out>, errp=<optimized out>) at ../block/crypto.c:949
  #14 0x000055ff75485c28 in block_crypto_co_amend_luks (bs=<optimized out>, opts=<optimized out>, force=<optimized out>, errp=<optimized out>)
      at ../block/crypto.c:1008
  #15 0x000055ff754778e5 in blockdev_amend_run (job=0x55ffb6f00640, errp=0x55ffb6f00700) at ../block/amend.c:52
  #16 0x000055ff75468b90 in job_co_entry (opaque=0x55ffb6f00640) at ../job.c:1106
  #17 0x000055ff755a0fc2 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at ../util/coroutine-ucontext.c:175

This changes the read/write callbacks to not assert that they
are run in mainloop context if already in a coroutine.

This is also reproduced by qemu-iotests cases 295 and 296.

Fixes: 1f051dcbdf2e4b6f518db731c84e304b2b9d15ce
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20250919112213.1530079-1-berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/crypto.c | 30 ++++++++++++++++++++++--------
 1 file changed, 22 insertions(+), 8 deletions(-)

diff --git a/block/crypto.c b/block/crypto.c
index 17b4749a1e..7c37b23e36 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -67,11 +67,18 @@ static int block_crypto_read_func(QCryptoBlock *block,
     BlockCrypto *crypto = bs->opaque;
     ssize_t ret;
 
-    GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    if (qemu_in_coroutine()) {
+        GRAPH_RDLOCK_GUARD();
 
-    ret = bdrv_pread(crypto->header ? crypto->header : bs->file,
-                     offset, buflen, buf, 0);
+        ret = bdrv_co_pread(crypto->header ? crypto->header : bs->file,
+                            offset, buflen, buf, 0);
+    } else {
+        GLOBAL_STATE_CODE();
+        GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+        ret = bdrv_pread(crypto->header ? crypto->header : bs->file,
+                         offset, buflen, buf, 0);
+    }
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not read encryption header");
         return ret;
@@ -90,11 +97,18 @@ static int block_crypto_write_func(QCryptoBlock *block,
     BlockCrypto *crypto = bs->opaque;
     ssize_t ret;
 
-    GLOBAL_STATE_CODE();
-    GRAPH_RDLOCK_GUARD_MAINLOOP();
+    if (qemu_in_coroutine()) {
+        GRAPH_RDLOCK_GUARD();
 
-    ret = bdrv_pwrite(crypto->header ? crypto->header : bs->file,
-                      offset, buflen, buf, 0);
+        ret = bdrv_co_pwrite(crypto->header ? crypto->header : bs->file,
+                             offset, buflen, buf, 0);
+    } else {
+        GLOBAL_STATE_CODE();
+        GRAPH_RDLOCK_GUARD_MAINLOOP();
+
+        ret = bdrv_pwrite(crypto->header ? crypto->header : bs->file,
+                          offset, buflen, buf, 0);
+    }
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not write encryption header");
         return ret;

From dec83ac02bee2f57f5b646dc1bedc5c200f3d679 Mon Sep 17 00:00:00 2001
From: Bin Guo <guobin@linux.alibaba.com>
Date: Tue, 16 Sep 2025 13:48:50 +0800
Subject: [PATCH 1701/2396] block/monitor: Use hmp_handle_error to report error

According to writing-monitor-commands.rst, best practice is to
use the 'hmp_handle_error' function, which ensures that the
message gets an 'Error: ' prefix.

Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Message-ID: <20250916054850.40963-1-guobin@linux.alibaba.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
[kwolf: Fixed up iotests reference output]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/monitor/block-hmp-cmds.c | 45 +++++++++++++++++-----------------
 tests/qemu-iotests/267.out     |  8 +++---
 2 files changed, 27 insertions(+), 26 deletions(-)

diff --git a/block/monitor/block-hmp-cmds.c b/block/monitor/block-hmp-cmds.c
index 282d1c386e..3640d1f3dc 100644
--- a/block/monitor/block-hmp-cmds.c
+++ b/block/monitor/block-hmp-cmds.c
@@ -62,7 +62,7 @@ static void hmp_drive_add_node(Monitor *mon, const char *optstr)
 {
     QemuOpts *opts;
     QDict *qdict;
-    Error *local_err = NULL;
+    Error *err = NULL;
 
     opts = qemu_opts_parse_noisily(&qemu_drive_opts, optstr, false);
     if (!opts) {
@@ -73,19 +73,19 @@ static void hmp_drive_add_node(Monitor *mon, const char *optstr)
 
     if (!qdict_get_try_str(qdict, "node-name")) {
         qobject_unref(qdict);
-        error_report("'node-name' needs to be specified");
+        error_setg(&err, "'node-name' needs to be specified");
         goto out;
     }
 
-    BlockDriverState *bs = bds_tree_init(qdict, &local_err);
+    BlockDriverState *bs = bds_tree_init(qdict, &err);
     if (!bs) {
-        error_report_err(local_err);
         goto out;
     }
 
     bdrv_set_monitor_owned(bs);
 out:
     qemu_opts_del(opts);
+    hmp_handle_error(mon, err);
 }
 
 void hmp_drive_add(Monitor *mon, const QDict *qdict)
@@ -109,7 +109,6 @@ void hmp_drive_add(Monitor *mon, const QDict *qdict)
     mc = MACHINE_GET_CLASS(current_machine);
     dinfo = drive_new(opts, mc->block_default_type, &err);
     if (err) {
-        error_report_err(err);
         qemu_opts_del(opts);
         goto err;
     }
@@ -123,7 +122,7 @@ void hmp_drive_add(Monitor *mon, const QDict *qdict)
         monitor_printf(mon, "OK\n");
         break;
     default:
-        monitor_printf(mon, "Can't hot-add drive to type %d\n", dinfo->type);
+        error_setg(&err, "Can't hot-add drive to type %d", dinfo->type);
         goto err;
     }
     return;
@@ -134,6 +133,7 @@ err:
         monitor_remove_blk(blk);
         blk_unref(blk);
     }
+    hmp_handle_error(mon, err);
 }
 
 void hmp_drive_del(Monitor *mon, const QDict *qdict)
@@ -141,36 +141,32 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
     const char *id = qdict_get_str(qdict, "id");
     BlockBackend *blk;
     BlockDriverState *bs;
-    Error *local_err = NULL;
+    Error *err = NULL;
 
     GLOBAL_STATE_CODE();
     bdrv_graph_rdlock_main_loop();
 
     bs = bdrv_find_node(id);
     if (bs) {
-        qmp_blockdev_del(id, &local_err);
-        if (local_err) {
-            error_report_err(local_err);
-        }
+        qmp_blockdev_del(id, &err);
         goto unlock;
     }
 
     blk = blk_by_name(id);
     if (!blk) {
-        error_report("Device '%s' not found", id);
+        error_setg(&err, "Device '%s' not found", id);
         goto unlock;
     }
 
     if (!blk_legacy_dinfo(blk)) {
-        error_report("Deleting device added with blockdev-add"
-                     " is not supported");
+        error_setg(&err, "Deleting device added with blockdev-add"
+                   " is not supported");
         goto unlock;
     }
 
     bs = blk_bs(blk);
     if (bs) {
-        if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, &local_err)) {
-            error_report_err(local_err);
+        if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, &err)) {
             goto unlock;
         }
 
@@ -196,6 +192,7 @@ void hmp_drive_del(Monitor *mon, const QDict *qdict)
 
 unlock:
     bdrv_graph_rdunlock_main_loop();
+    hmp_handle_error(mon, err);
 }
 
 void hmp_commit(Monitor *mon, const QDict *qdict)
@@ -203,6 +200,7 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
     const char *device = qdict_get_str(qdict, "device");
     BlockBackend *blk;
     int ret;
+    Error *err = NULL;
 
     GLOBAL_STATE_CODE();
     GRAPH_RDLOCK_GUARD_MAINLOOP();
@@ -214,22 +212,25 @@ void hmp_commit(Monitor *mon, const QDict *qdict)
 
         blk = blk_by_name(device);
         if (!blk) {
-            error_report("Device '%s' not found", device);
-            return;
+            error_setg(&err, "Device '%s' not found", device);
+            goto end;
         }
 
         bs = bdrv_skip_implicit_filters(blk_bs(blk));
 
         if (!blk_is_available(blk)) {
-            error_report("Device '%s' has no medium", device);
-            return;
+            error_setg(&err, "Device '%s' has no medium", device);
+            goto end;
         }
 
         ret = bdrv_commit(bs);
     }
     if (ret < 0) {
-        error_report("'commit' error for '%s': %s", device, strerror(-ret));
+        error_setg(&err, "'commit' error for '%s': %s", device, strerror(-ret));
     }
+
+end:
+    hmp_handle_error(mon, err);
 }
 
 void hmp_drive_mirror(Monitor *mon, const QDict *qdict)
@@ -890,7 +891,7 @@ void hmp_info_snapshots(Monitor *mon, const QDict *qdict)
 
     bs = bdrv_all_find_vmstate_bs(NULL, false, NULL, &err);
     if (!bs) {
-        error_report_err(err);
+        hmp_handle_error(mon, err);
         return;
     }
 
diff --git a/tests/qemu-iotests/267.out b/tests/qemu-iotests/267.out
index f6f5d8715a..37b7ebd280 100644
--- a/tests/qemu-iotests/267.out
+++ b/tests/qemu-iotests/267.out
@@ -8,7 +8,7 @@ QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
 Error: no block device can store vmstate for snapshot
 (qemu) info snapshots
-no block device can store vmstate for snapshot
+Error: no block device can store vmstate for snapshot
 (qemu) loadvm snap0
 Error: no block device can store vmstate for snapshot
 (qemu) quit
@@ -22,7 +22,7 @@ QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
 Error: Device 'none0' is writable but does not support snapshots
 (qemu) info snapshots
-no block device can store vmstate for snapshot
+Error: no block device can store vmstate for snapshot
 (qemu) loadvm snap0
 Error: Device 'none0' is writable but does not support snapshots
 (qemu) quit
@@ -58,7 +58,7 @@ QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
 Error: Device 'virtio0' is writable but does not support snapshots
 (qemu) info snapshots
-no block device can store vmstate for snapshot
+Error: no block device can store vmstate for snapshot
 (qemu) loadvm snap0
 Error: Device 'virtio0' is writable but does not support snapshots
 (qemu) quit
@@ -83,7 +83,7 @@ QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
 Error: Device 'file' is writable but does not support snapshots
 (qemu) info snapshots
-no block device can store vmstate for snapshot
+Error: no block device can store vmstate for snapshot
 (qemu) loadvm snap0
 Error: Device 'file' is writable but does not support snapshots
 (qemu) quit

From ad97769e9dcf4dbdaae6d859176e5f37fd6a7c66 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Mon, 13 Oct 2025 13:41:19 +0100
Subject: [PATCH 1702/2396] block/curl.c: Fix CURLOPT_VERBOSE parameter type

In commit ed26056d90 ("block/curl.c: Use explicit long constants in
curl_easy_setopt calls") we missed a further call that takes a long
parameter.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Message-ID: <20251013124127.604401-1-rjones@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/curl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/curl.c b/block/curl.c
index 68cf83ce55..d7d93d967f 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -524,7 +524,7 @@ static int curl_init_state(BDRVCURLState *s, CURLState *state)
 #endif
 
 #ifdef DEBUG_VERBOSE
-        if (curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1)) {
+        if (curl_easy_setopt(state->curl, CURLOPT_VERBOSE, 1L)) {
             goto err;
         }
 #endif

From 5e5aebd848a0daa69fe2b478e376ab2ddf9d9a32 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 13 Oct 2025 16:36:10 -0500
Subject: [PATCH 1703/2396] iotests: Adjust nbd expected outputs to match
 current behavior
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'git bisect' confirms that the NBD iotests 94 and 119 have been broken
since commit effd60c8 in v9.0.0; but as Dan Berrange's efforts to
improve CI have proven, we haven't been reliably running them to
notice.  The change was good (moving coroutine commands to run in the
right context), but it meant that "execute":"quit" now waits to
complete until the coroutines tearing down NBD have first reported the
SHUTDOWN event, in the opposite order of what happened pre-patch.

Signed-off-by: Eric Blake <eblake@redhat.com>
Fixes: effd60c8 ("monitor: only run coroutine commands in qemu_aio_context", v9.0.0)
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251013213638.494193-2-eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/094.out | 2 +-
 tests/qemu-iotests/119.out | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qemu-iotests/094.out b/tests/qemu-iotests/094.out
index 97f894cf8f..9178474e79 100644
--- a/tests/qemu-iotests/094.out
+++ b/tests/qemu-iotests/094.out
@@ -23,6 +23,6 @@ Formatting 'TEST_DIR/source.IMGFMT', fmt=IMGFMT size=67108864
 {'execute': 'quit'}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "concluded", "id": "src"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "src"}}
-{"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
+{"return": {}}
 *** done
diff --git a/tests/qemu-iotests/119.out b/tests/qemu-iotests/119.out
index 7b7f0f4bcc..45f82a4faa 100644
--- a/tests/qemu-iotests/119.out
+++ b/tests/qemu-iotests/119.out
@@ -5,7 +5,7 @@ QMP_VERSION
 read 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 {"return": ""}
-{"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
+{"return": {}}
 
 *** done

From 3ab02c857047c16e622a7ad2adb51ef21e24989e Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Tue, 21 Oct 2025 15:58:40 -0500
Subject: [PATCH 1704/2396] iotests: Adjust fuse-allow-other expected output
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The iotest fuse-allow-other has been broken since commit effd60c8 in
v9.0.0; but as Dan Berrange's efforts to improve CI have proven, we
haven't been reliably running it to notice.  The change in that commit
was good (moving coroutine commands to run in the right context), but
it meant that "execute":"quit" now waits to complete until the
coroutines tearing down fuse have first reported the SHUTDOWN event,
in the opposite order of what happened pre-patch.

Signed-off-by: Eric Blake <eblake@redhat.com>
Fixes: effd60c8 ("monitor: only run coroutine commands in qemu_aio_context",
Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251021205843.2585624-2-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/fuse-allow-other.out | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/tests/fuse-allow-other.out b/tests/qemu-iotests/tests/fuse-allow-other.out
index 543fa52a06..3219fc35e0 100644
--- a/tests/qemu-iotests/tests/fuse-allow-other.out
+++ b/tests/qemu-iotests/tests/fuse-allow-other.out
@@ -28,9 +28,9 @@ stat: cannot statx 'fuse-export': Permission denied
 cat: fuse-export: Permission denied
 stat: cannot statx 'fuse-export': Permission denied
 {'execute': 'quit'}
-{"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+{"return": {}}
 
 --- allow-other=on ---
 {'execute': 'qmp_capabilities'}
@@ -55,9 +55,9 @@ Permissions seen by nobody: 444
 cat: fuse-export: Permission denied
 Permissions seen by nobody: 440
 {'execute': 'quit'}
-{"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+{"return": {}}
 
 --- allow-other=auto ---
 {'execute': 'qmp_capabilities'}
@@ -82,7 +82,7 @@ Permissions seen by nobody: 444
 cat: fuse-export: Permission denied
 Permissions seen by nobody: 440
 {'execute': 'quit'}
-{"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+{"return": {}}
 *** done

From 9f0c763e16c65d3aab5f3f17768df58321874685 Mon Sep 17 00:00:00 2001
From: Chandan Somani <csomani@redhat.com>
Date: Fri, 3 Oct 2025 14:59:26 -0700
Subject: [PATCH 1705/2396] block: enable stats-intervals for storage devices

This patch allows stats-intervals to be used for storage
devices with the -device option. It accepts a list of interval
lengths in JSON format.

It configures and collects the stats in the BlockBackend layer
through the storage device that consumes the BlockBackend.

Signed-off-by: Chandan Somani <csomani@redhat.com>
Message-ID: <20251003220039.1336663-1-csomani@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/accounting.c         | 17 +++++++++++++++--
 blockdev.c                 |  3 ++-
 hw/block/block.c           |  7 +++++--
 include/block/accounting.h |  5 +++--
 include/hw/block/block.h   |  7 ++++++-
 tests/qemu-iotests/172.out | 38 ++++++++++++++++++++++++++++++++++++++
 6 files changed, 69 insertions(+), 8 deletions(-)

diff --git a/block/accounting.c b/block/accounting.c
index 3e46159569..0933c61f3a 100644
--- a/block/accounting.c
+++ b/block/accounting.c
@@ -28,6 +28,7 @@
 #include "block/block_int.h"
 #include "qemu/timer.h"
 #include "system/qtest.h"
+#include "qapi/error.h"
 
 static QEMUClockType clock_type = QEMU_CLOCK_REALTIME;
 static const int qtest_latency_ns = NANOSECONDS_PER_SECOND / 1000;
@@ -56,13 +57,25 @@ static bool bool_from_onoffauto(OnOffAuto val, bool def)
     }
 }
 
-void block_acct_setup(BlockAcctStats *stats, enum OnOffAuto account_invalid,
-                      enum OnOffAuto account_failed)
+bool block_acct_setup(BlockAcctStats *stats, enum OnOffAuto account_invalid,
+                      enum OnOffAuto account_failed, uint32_t *stats_intervals,
+                      uint32_t num_stats_intervals, Error **errp)
 {
     stats->account_invalid = bool_from_onoffauto(account_invalid,
                                                  stats->account_invalid);
     stats->account_failed = bool_from_onoffauto(account_failed,
                                                 stats->account_failed);
+    if (stats_intervals) {
+        for (int i = 0; i < num_stats_intervals; i++) {
+            if (stats_intervals[i] <= 0) {
+                error_setg(errp, "Invalid interval length: %u", stats_intervals[i]);
+                return false;
+            }
+            block_acct_add_interval(stats, stats_intervals[i]);
+        }
+        g_free(stats_intervals);
+    }
+    return true;
 }
 
 void block_acct_cleanup(BlockAcctStats *stats)
diff --git a/blockdev.c b/blockdev.c
index b451fee6e1..dbd1d4d3e8 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -617,7 +617,8 @@ static BlockBackend *blockdev_init(const char *file, QDict *bs_opts,
 
         bs->detect_zeroes = detect_zeroes;
 
-        block_acct_setup(blk_get_stats(blk), account_invalid, account_failed);
+        block_acct_setup(blk_get_stats(blk), account_invalid, account_failed,
+                         NULL, 0, NULL);
 
         if (!parse_stats_intervals(blk_get_stats(blk), interval_list, errp)) {
             blk_unref(blk);
diff --git a/hw/block/block.c b/hw/block/block.c
index 2e10611d95..f187fa025d 100644
--- a/hw/block/block.c
+++ b/hw/block/block.c
@@ -249,8 +249,11 @@ bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
     blk_set_enable_write_cache(blk, wce);
     blk_set_on_error(blk, rerror, werror);
 
-    block_acct_setup(blk_get_stats(blk), conf->account_invalid,
-                     conf->account_failed);
+    if (!block_acct_setup(blk_get_stats(blk), conf->account_invalid,
+                          conf->account_failed, conf->stats_intervals,
+                          conf->num_stats_intervals, errp)) {
+        return false;
+    }
     return true;
 }
 
diff --git a/include/block/accounting.h b/include/block/accounting.h
index a59e39f49d..b1cf417b57 100644
--- a/include/block/accounting.h
+++ b/include/block/accounting.h
@@ -101,8 +101,9 @@ typedef struct BlockAcctCookie {
 } BlockAcctCookie;
 
 void block_acct_init(BlockAcctStats *stats);
-void block_acct_setup(BlockAcctStats *stats, enum OnOffAuto account_invalid,
-                      enum OnOffAuto account_failed);
+bool block_acct_setup(BlockAcctStats *stats, enum OnOffAuto account_invalid,
+                      enum OnOffAuto account_failed, uint32_t *stats_intervals,
+                      uint32_t num_stats_intervals, Error **errp);
 void block_acct_cleanup(BlockAcctStats *stats);
 void block_acct_add_interval(BlockAcctStats *stats, unsigned interval_length);
 BlockAcctTimedStats *block_acct_interval_next(BlockAcctStats *stats,
diff --git a/include/hw/block/block.h b/include/hw/block/block.h
index de3946a5f1..b4d914624e 100644
--- a/include/hw/block/block.h
+++ b/include/hw/block/block.h
@@ -34,6 +34,8 @@ typedef struct BlockConf {
     OnOffAuto account_invalid, account_failed;
     BlockdevOnError rerror;
     BlockdevOnError werror;
+    uint32_t num_stats_intervals;
+    uint32_t *stats_intervals;
 } BlockConf;
 
 static inline unsigned int get_physical_block_exp(BlockConf *conf)
@@ -66,7 +68,10 @@ static inline unsigned int get_physical_block_exp(BlockConf *conf)
     DEFINE_PROP_ON_OFF_AUTO("account-invalid", _state,                  \
                             _conf.account_invalid, ON_OFF_AUTO_AUTO),   \
     DEFINE_PROP_ON_OFF_AUTO("account-failed", _state,                   \
-                            _conf.account_failed, ON_OFF_AUTO_AUTO)
+                            _conf.account_failed, ON_OFF_AUTO_AUTO),    \
+    DEFINE_PROP_ARRAY("stats-intervals", _state,                        \
+                     _conf.num_stats_intervals, _conf.stats_intervals,  \
+                     qdev_prop_uint32, uint32_t)
 
 #define DEFINE_BLOCK_PROPERTIES(_state, _conf)                          \
     DEFINE_PROP_DRIVE("drive", _state, _conf.blk),                      \
diff --git a/tests/qemu-iotests/172.out b/tests/qemu-iotests/172.out
index 146fc72388..a023cd407d 100644
--- a/tests/qemu-iotests/172.out
+++ b/tests/qemu-iotests/172.out
@@ -30,6 +30,7 @@ Testing:
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 
 
@@ -59,6 +60,7 @@ Testing: -fda TEST_DIR/t.qcow2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -95,6 +97,7 @@ Testing: -fdb TEST_DIR/t.qcow2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -109,6 +112,7 @@ Testing: -fdb TEST_DIR/t.qcow2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -149,6 +153,7 @@ Testing: -fda TEST_DIR/t.qcow2 -fdb TEST_DIR/t.qcow2.2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -163,6 +168,7 @@ Testing: -fda TEST_DIR/t.qcow2 -fdb TEST_DIR/t.qcow2.2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -204,6 +210,7 @@ Testing: -fdb
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -218,6 +225,7 @@ Testing: -fdb
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 
 
@@ -247,6 +255,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -283,6 +292,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2,index=1
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -297,6 +307,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2,index=1
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -337,6 +348,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=floppy,file=TEST_DIR/t
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -351,6 +363,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=floppy,file=TEST_DIR/t
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -395,6 +408,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -431,6 +445,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,unit=1
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -467,6 +482,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qco
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -481,6 +497,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qco
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -531,6 +548,7 @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -545,6 +563,7 @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -586,6 +605,7 @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -600,6 +620,7 @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -641,6 +662,7 @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 1 (0x1)
@@ -655,6 +677,7 @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -696,6 +719,7 @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 1 (0x1)
@@ -710,6 +734,7 @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -760,6 +785,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -774,6 +800,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -815,6 +842,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
               dev: floppy, id ""
                 unit = 0 (0x0)
@@ -829,6 +857,7 @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/unattached/device[N]
@@ -876,6 +905,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -global floppy.drive=none0 -device
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -942,6 +972,7 @@ Testing: -device floppy
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 
 Testing: -device floppy,drive-type=120
@@ -968,6 +999,7 @@ Testing: -device floppy,drive-type=120
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "120"
 
 Testing: -device floppy,drive-type=144
@@ -994,6 +1026,7 @@ Testing: -device floppy,drive-type=144
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 
 Testing: -device floppy,drive-type=288
@@ -1020,6 +1053,7 @@ Testing: -device floppy,drive-type=288
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 
 
@@ -1049,6 +1083,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "120"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -1085,6 +1120,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "288"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -1124,6 +1160,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,logical
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]
@@ -1160,6 +1197,7 @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,physica
                 share-rw = false
                 account-invalid = "auto"
                 account-failed = "auto"
+                stats-intervals = <null>
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
     Attached to:      /machine/peripheral-anon/device[N]

From aa981ab3a371c1100f8efaddbc319126ecdc3dd0 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 2 Oct 2025 13:54:46 +0100
Subject: [PATCH 1706/2396] MAINTAINERS: Mark VHDX block driver as "Odd Fixes"

In 2018 (in commit 5f5246b6b) Jeff Cody stepped down as block
maintainer, but left himself as maintainer for VHDX and with a status
of "Supported", with the rationale:

    For VHDX, added my personal email address as a maintainer, as I can
    answer questions or send the occassional bug fix.  Leaving it as
    'Supported', instead of 'Odd Fixes', because I think the rest of the
    block layer maintainers and developers will upkeep it as well, if
    needed.

However, today the way we treat subsystems which are only maintained
under the general umbrella of a wider system is usually to mark them
as "Odd Fixes".  The vhdx.c code has had no commits which aren't a
part of more general refactoring changes since 2020, and Jeff himself
hasn't been active on qemu-devel since 2018, so this seems also to be
how we've handled the code in practice.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-ID: <20251002125446.2500179-1-peter.maydell@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 64491c800c..fd78a563a2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4081,7 +4081,7 @@ F: block/rbd.c
 VHDX
 M: Jeff Cody <codyprime@gmail.com>
 L: qemu-block@nongnu.org
-S: Supported
+S: Odd Fixes
 F: block/vhdx*
 
 VDI

From 41203754207ce78b2024043c457f66a833b723b9 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 17 Sep 2025 13:54:48 +0200
Subject: [PATCH 1707/2396] include/block/block_int-common: document when
 resize callback is used

The 'resize' callback is only called by bdrv_parent_cb_resize() which
is only called by bdrv_co_write_req_finish() to notify the parent(s)
that the child was resized.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20250917115509.401015-2-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int-common.h | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 034c0634c8..8a3d427356 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -1020,6 +1020,9 @@ struct BdrvChildClass {
      * the I/O API.
      */
 
+    /*
+     * Notifies the parent that the child was resized.
+     */
     void (*resize)(BdrvChild *child);
 
     /*

From 08736e7584c41b75e734f412e1fea5ae949afac1 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 17 Sep 2025 13:54:49 +0200
Subject: [PATCH 1708/2396] block: make bdrv_co_parent_cb_resize() a proper IO
 API function

In preparation for calling it via the bdrv_child_cb_resize() callback
that will be added by the next commit. Rename it to include the "_co_"
part while at it.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20250917115509.401015-3-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c                   | 9 +++------
 include/block/block_int-io.h | 6 ++++++
 2 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/block/io.c b/block/io.c
index 9bd8ba8431..928c02d1ad 100644
--- a/block/io.c
+++ b/block/io.c
@@ -46,9 +46,6 @@
 /* Maximum read size for checking if data reads as zero, in bytes */
 #define MAX_ZERO_CHECK_BUFFER (128 * KiB)
 
-static void coroutine_fn GRAPH_RDLOCK
-bdrv_parent_cb_resize(BlockDriverState *bs);
-
 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
     int64_t offset, int64_t bytes, BdrvRequestFlags flags);
 
@@ -2038,7 +2035,7 @@ bdrv_co_write_req_finish(BdrvChild *child, int64_t offset, int64_t bytes,
          end_sector > bs->total_sectors) &&
         req->type != BDRV_TRACKED_DISCARD) {
         bs->total_sectors = end_sector;
-        bdrv_parent_cb_resize(bs);
+        bdrv_co_parent_cb_resize(bs);
         bdrv_dirty_bitmap_truncate(bs, end_sector << BDRV_SECTOR_BITS);
     }
     if (req->bytes) {
@@ -3570,11 +3567,11 @@ int coroutine_fn bdrv_co_copy_range(BdrvChild *src, int64_t src_offset,
                                    bytes, read_flags, write_flags);
 }
 
-static void coroutine_fn GRAPH_RDLOCK
-bdrv_parent_cb_resize(BlockDriverState *bs)
+void coroutine_fn bdrv_co_parent_cb_resize(BlockDriverState *bs)
 {
     BdrvChild *c;
 
+    IO_CODE();
     assert_bdrv_graph_readable();
 
     QLIST_FOREACH(c, &bs->parents, next_parent) {
diff --git a/include/block/block_int-io.h b/include/block/block_int-io.h
index 4f94eb3c5a..ed8b5657d6 100644
--- a/include/block/block_int-io.h
+++ b/include/block/block_int-io.h
@@ -191,4 +191,10 @@ void bdrv_bsc_invalidate_range(BlockDriverState *bs,
  */
 void bdrv_bsc_fill(BlockDriverState *bs, int64_t offset, int64_t bytes);
 
+/*
+ * Notify all parents that the size of the child changed.
+ */
+void coroutine_fn GRAPH_RDLOCK
+bdrv_co_parent_cb_resize(BlockDriverState *bs);
+
 #endif /* BLOCK_INT_IO_H */

From cbadaf57a775e84ff10455108afd6e191c5c0630 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 17 Sep 2025 13:54:50 +0200
Subject: [PATCH 1709/2396] block: implement 'resize' callback for child_of_bds
 class

If a filtered child is resized, the size of the parent node is now
also refreshed (recursively for chains of filtered children).

For filter block drivers that do not implement .bdrv_co_getlength(),
this commit does not change the current behavior, because
bdrv_co_refresh_total_sectors() will used the current size via the
passed-in hint. This is the case for block drivers for (some) block
jobs, as well as copy-before-write.

Block jobs already set up a blocker preventing a QMP block_resize
operation while the job is running. That does not directly cover an
associated 'file' node of a 'raw' node, but resizing such a 'file'
node is already prevented too (backup, commit, mirror and stream were
checked).

The other case is copy-before-write. This commit does not change the
fact that the copy-before-write node still has the same size after its
filtered child is resized.

Block drivers that do implement .bdrv_co_getlength() and where
.is_filter is true, already returned the length of the file child, so
there is no change before and after this commit, with two exceptions:
1. preallocate can return an early data_end and otherwise queries the
   file child, but that special casing is not changed.
2. blkverify returns the length of the test file. This commit does not
   affect that behavior.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250917115509.401015-4-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 12 ++++++++++++
 include/block/block_int-common.h |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 8848e9a7ed..cf08e64add 100644
--- a/block.c
+++ b/block.c
@@ -1497,6 +1497,17 @@ static void GRAPH_WRLOCK bdrv_child_cb_detach(BdrvChild *child)
     }
 }
 
+static void coroutine_fn GRAPH_RDLOCK bdrv_child_cb_resize(BdrvChild *child)
+{
+    BlockDriverState *bs = child->opaque;
+
+    if (child->role & BDRV_CHILD_FILTERED) {
+        /* Best effort, ignore errors. */
+        bdrv_co_refresh_total_sectors(bs, bs->total_sectors);
+        bdrv_co_parent_cb_resize(bs);
+    }
+}
+
 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
                                          const char *filename,
                                          bool backing_mask_protocol,
@@ -1529,6 +1540,7 @@ const BdrvChildClass child_of_bds = {
     .detach          = bdrv_child_cb_detach,
     .inactivate      = bdrv_child_cb_inactivate,
     .change_aio_ctx  = bdrv_child_cb_change_aio_ctx,
+    .resize          = bdrv_child_cb_resize,
     .update_filename = bdrv_child_cb_update_filename,
     .get_parent_aio_context = child_of_bds_get_parent_aio_context,
 };
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index 8a3d427356..c55b35da8e 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -1023,7 +1023,7 @@ struct BdrvChildClass {
     /*
      * Notifies the parent that the child was resized.
      */
-    void (*resize)(BdrvChild *child);
+    void GRAPH_RDLOCK_PTR (*resize)(BdrvChild *child);
 
     /*
      * Returns a name that is supposedly more useful for human users than the

From 4eb4365b9fbd564aa8ef40b1cbd4f0e2076b4d6d Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 17 Sep 2025 13:54:51 +0200
Subject: [PATCH 1710/2396] iotests: add test for resizing a node below filters

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20250917115509.401015-5-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/resize-below-filter  | 73 +++++++++++++++++++
 .../tests/resize-below-filter.out             |  5 ++
 2 files changed, 78 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/resize-below-filter
 create mode 100644 tests/qemu-iotests/tests/resize-below-filter.out

diff --git a/tests/qemu-iotests/tests/resize-below-filter b/tests/qemu-iotests/tests/resize-below-filter
new file mode 100755
index 0000000000..f55619cf34
--- /dev/null
+++ b/tests/qemu-iotests/tests/resize-below-filter
@@ -0,0 +1,73 @@
+#!/usr/bin/env python3
+# group: rw quick
+#
+# Test what happens when a node below filter nodes is resized.
+#
+# Copyright (C) Proxmox Server Solutions GmbH
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+import iotests
+from iotests import imgfmt, qemu_img_create, QMPTestCase
+
+image_size = 1 * 1024 * 1024
+image = os.path.join(iotests.test_dir, 'test.img')
+
+class TestResizeBelowFilter(QMPTestCase):
+    def setUp(self) -> None:
+        qemu_img_create('-f', imgfmt, image, str(image_size))
+
+        self.vm = iotests.VM()
+        self.vm.add_blockdev(self.vm.qmp_to_opts({
+            'driver': imgfmt,
+            'node-name': 'node0',
+            'file': {
+                'driver': 'file',
+                'filename': image,
+            }
+        }))
+        self.vm.add_blockdev(self.vm.qmp_to_opts({
+            'driver': 'compress',
+            'node-name': 'comp0',
+            'file': 'node0',
+        }))
+        self.vm.add_object('throttle-group,id=thrgr0')
+        self.vm.add_blockdev(self.vm.qmp_to_opts({
+            'driver': 'throttle',
+            'node-name': 'thr0',
+            'throttle-group': 'thrgr0',
+            'file': 'comp0',
+        }))
+        self.vm.add_object('throttle-group,id=thrgr1')
+        self.vm.add_blockdev(self.vm.qmp_to_opts({
+            'driver': 'throttle',
+            'node-name': 'thr1',
+            'throttle-group': 'thrgr1',
+            'file': 'node0',
+        }))
+        self.vm.launch()
+
+    def tearDown(self) -> None:
+        self.vm.shutdown()
+        os.remove(image)
+
+    def assert_size(self, size: int) -> None:
+        nodes = self.vm.qmp('query-named-block-nodes', flat=True)['return']
+        self.assertEqual(len(nodes), 5)
+        for node in nodes:
+            if node['drv'] == 'file':
+                continue
+            self.assertEqual(node['image']['virtual-size'], size)
+
+    def test_resize_below_filter(self) -> None:
+        self.assert_size(image_size)
+        self.vm.qmp('block_resize', node_name='thr0', size=2*image_size)
+        self.assert_size(2*image_size)
+        self.vm.qmp('block_resize', node_name='comp0', size=3*image_size)
+        self.assert_size(3*image_size)
+        self.vm.qmp('block_resize', node_name='node0', size=4*image_size)
+        self.assert_size(4*image_size)
+
+if __name__ == '__main__':
+    iotests.main(supported_fmts=['qcow2'], supported_protocols=['file'])
diff --git a/tests/qemu-iotests/tests/resize-below-filter.out b/tests/qemu-iotests/tests/resize-below-filter.out
new file mode 100644
index 0000000000..ae1213e6f8
--- /dev/null
+++ b/tests/qemu-iotests/tests/resize-below-filter.out
@@ -0,0 +1,5 @@
+.
+----------------------------------------------------------------------
+Ran 1 tests
+
+OK

From 59e231f3f03f6db5506312e3e7659480a752eba3 Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Wed, 17 Sep 2025 13:54:52 +0200
Subject: [PATCH 1711/2396] iotests: add test for resizing a 'file' node below
 a 'raw' node

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Message-ID: <20250917115509.401015-6-f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/resize-below-raw     | 53 +++++++++++++++++++
 tests/qemu-iotests/tests/resize-below-raw.out |  5 ++
 2 files changed, 58 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/resize-below-raw
 create mode 100644 tests/qemu-iotests/tests/resize-below-raw.out

diff --git a/tests/qemu-iotests/tests/resize-below-raw b/tests/qemu-iotests/tests/resize-below-raw
new file mode 100755
index 0000000000..3c9241c918
--- /dev/null
+++ b/tests/qemu-iotests/tests/resize-below-raw
@@ -0,0 +1,53 @@
+#!/usr/bin/env python3
+# group: rw quick
+#
+# Test what happens when a 'file' node below a 'raw' node is resized.
+#
+# Copyright (C) Proxmox Server Solutions GmbH
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+import os
+import iotests
+from iotests import imgfmt, qemu_img_create, QMPTestCase
+
+image_size = 1 * 1024 * 1024
+image = os.path.join(iotests.test_dir, 'test.img')
+
+class TestResizeBelowRaw(QMPTestCase):
+    def setUp(self) -> None:
+        qemu_img_create('-f', imgfmt, image, str(image_size))
+
+        self.vm = iotests.VM()
+        self.vm.add_blockdev(self.vm.qmp_to_opts({
+            'driver': imgfmt,
+            'node-name': 'node0',
+            'file': {
+                'driver': 'file',
+                'filename': image,
+                'node-name': 'file0',
+            }
+        }))
+        self.vm.launch()
+
+    def tearDown(self) -> None:
+        self.vm.shutdown()
+        os.remove(image)
+
+    def assert_size(self, size: int) -> None:
+        nodes = self.vm.qmp('query-named-block-nodes', flat=True)['return']
+        self.assertEqual(len(nodes), 2)
+        for node in nodes:
+            if node['drv'] == 'file':
+                continue
+            self.assertEqual(node['image']['virtual-size'], size)
+
+    def test_resize_below_raw(self) -> None:
+        self.assert_size(image_size)
+        self.vm.qmp('block_resize', node_name='file0', size=2*image_size)
+        self.assert_size(2*image_size)
+        self.vm.qmp('block_resize', node_name='node0', size=3*image_size)
+        self.assert_size(3*image_size)
+
+if __name__ == '__main__':
+    iotests.main(supported_fmts=['raw'], supported_protocols=['file'])
diff --git a/tests/qemu-iotests/tests/resize-below-raw.out b/tests/qemu-iotests/tests/resize-below-raw.out
new file mode 100644
index 0000000000..ae1213e6f8
--- /dev/null
+++ b/tests/qemu-iotests/tests/resize-below-raw.out
@@ -0,0 +1,5 @@
+.
+----------------------------------------------------------------------
+Ran 1 tests
+
+OK

From 46dd683d56b1328cb2bc923914bfd7ac590064f7 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 24 Oct 2025 14:30:37 +0200
Subject: [PATCH 1712/2396] block: Improve comments in BlockLimits

Patches to expose the limits in QAPI have made clear that the existing
documentation of BlockLimits could be improved: The meaning of
min_mem_alignment and opt_mem_alignment could be clearer, and talking
about better alignment values isn't helpful when we only detect these
values and never choose them.

Make the changes in the BlockLimits documentation now, so that the
patches exposing the fields in QAPI can use descriptions consistent with
it.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251024123041.51254-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int-common.h | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index c55b35da8e..f2a4e863fc 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -817,10 +817,10 @@ typedef struct BlockLimits {
     int64_t max_pdiscard;
 
     /*
-     * Optimal alignment for discard requests in bytes. A power of 2
-     * is best but not mandatory.  Must be a multiple of
-     * bl.request_alignment, and must be less than max_pdiscard if
-     * that is set. May be 0 if bl.request_alignment is good enough
+     * Optimal alignment for discard requests in bytes. Note that this doesn't
+     * have to be a power of two. Must be a multiple of bl.request_alignment,
+     * and must be less than max_pdiscard if that is set. May be 0 if
+     * bl.request_alignment is good enough.
      */
     uint32_t pdiscard_alignment;
 
@@ -831,11 +831,10 @@ typedef struct BlockLimits {
     int64_t max_pwrite_zeroes;
 
     /*
-     * Optimal alignment for write zeroes requests in bytes. A power
-     * of 2 is best but not mandatory.  Must be a multiple of
-     * bl.request_alignment, and must be less than max_pwrite_zeroes
-     * if that is set. May be 0 if bl.request_alignment is good
-     * enough
+     * Optimal alignment for write zeroes requests in bytes. Note that this
+     * doesn't have to be a power of two. Must be a multiple of
+     * bl.request_alignment, and must be less than max_pwrite_zeroes if that is
+     * set. May be 0 if bl.request_alignment is good enough.
      */
     uint32_t pwrite_zeroes_alignment;
 
@@ -863,18 +862,23 @@ typedef struct BlockLimits {
     uint64_t max_hw_transfer;
 
     /*
-     * Maximal number of scatter/gather elements allowed by the hardware.
+     * Maximum number of scatter/gather elements allowed by the hardware.
      * Applies whenever transfers to the device bypass the kernel I/O
      * scheduler, for example with SG_IO.  If larger than max_iov
      * or if zero, blk_get_max_hw_iov will fall back to max_iov.
      */
     int max_hw_iov;
 
-
-    /* memory alignment, in bytes so that no bounce buffer is needed */
+    /*
+     * Minimal required memory alignment in bytes for zero-copy I/O to succeed.
+     * For unaligned requests, a bounce buffer will be used.
+     */
     size_t min_mem_alignment;
 
-    /* memory alignment, in bytes, for bounce buffer */
+    /*
+     * Optimal memory alignment in bytes. This is the alignment used for any
+     * buffer allocations QEMU performs internally.
+     */
     size_t opt_mem_alignment;
 
     /* maximum number of iovec elements */

From d2634e18286a5772f04cc724e64f8b16a2124587 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 24 Oct 2025 14:30:38 +0200
Subject: [PATCH 1713/2396] block: Expose block limits for images in QMP

This information can be useful both for debugging and for management
tools trying to configure guest devices with the optimal limits
(possibly across multiple hosts). There is no reason not to make it
available, so just add it to BlockNodeInfo.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251024123041.51254-3-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qapi.c                     | 34 ++++++++++++++--
 qapi/block-core.json             | 66 ++++++++++++++++++++++++++++++++
 tests/qemu-iotests/184           |  5 ++-
 tests/qemu-iotests/184.out       |  8 ----
 tests/qemu-iotests/common.filter |  3 +-
 5 files changed, 102 insertions(+), 14 deletions(-)

diff --git a/block/qapi.c b/block/qapi.c
index 12fbf8d1b7..54521d0a68 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -235,7 +235,8 @@ int bdrv_query_snapshot_info_list(BlockDriverState *bs,
  * in @info, setting @errp on error.
  */
 static void GRAPH_RDLOCK
-bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, Error **errp)
+bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, bool limits,
+                        Error **errp)
 {
     int64_t size;
     const char *backing_filename;
@@ -269,6 +270,33 @@ bdrv_do_query_node_info(BlockDriverState *bs, BlockNodeInfo *info, Error **errp)
         info->dirty_flag = bdi.is_dirty;
         info->has_dirty_flag = true;
     }
+
+    if (limits) {
+        info->limits = g_new(BlockLimitsInfo, 1);
+        *info->limits = (BlockLimitsInfo) {
+            .request_alignment          = bs->bl.request_alignment,
+            .has_max_discard            = bs->bl.max_pdiscard != 0,
+            .max_discard                = bs->bl.max_pdiscard,
+            .has_discard_alignment      = bs->bl.pdiscard_alignment != 0,
+            .discard_alignment          = bs->bl.pdiscard_alignment,
+            .has_max_write_zeroes       = bs->bl.max_pwrite_zeroes != 0,
+            .max_write_zeroes           = bs->bl.max_pwrite_zeroes,
+            .has_write_zeroes_alignment = bs->bl.pwrite_zeroes_alignment != 0,
+            .write_zeroes_alignment     = bs->bl.pwrite_zeroes_alignment,
+            .has_opt_transfer           = bs->bl.opt_transfer != 0,
+            .opt_transfer               = bs->bl.opt_transfer,
+            .has_max_transfer           = bs->bl.max_transfer != 0,
+            .max_transfer               = bs->bl.max_transfer,
+            .has_max_hw_transfer        = bs->bl.max_hw_transfer != 0,
+            .max_hw_transfer            = bs->bl.max_hw_transfer,
+            .max_iov                    = bs->bl.max_iov,
+            .has_max_hw_iov             = bs->bl.max_hw_iov != 0,
+            .max_hw_iov                 = bs->bl.max_hw_iov,
+            .min_mem_alignment          = bs->bl.min_mem_alignment,
+            .opt_mem_alignment          = bs->bl.opt_mem_alignment,
+        };
+    }
+
     info->format_specific = bdrv_get_specific_info(bs, &err);
     if (err) {
         error_propagate(errp, err);
@@ -343,7 +371,7 @@ void bdrv_query_image_info(BlockDriverState *bs,
     ImageInfo *info;
 
     info = g_new0(ImageInfo, 1);
-    bdrv_do_query_node_info(bs, qapi_ImageInfo_base(info), errp);
+    bdrv_do_query_node_info(bs, qapi_ImageInfo_base(info), true, errp);
     if (*errp) {
         goto fail;
     }
@@ -397,7 +425,7 @@ void bdrv_query_block_graph_info(BlockDriverState *bs,
     BdrvChild *c;
 
     info = g_new0(BlockGraphInfo, 1);
-    bdrv_do_query_node_info(bs, qapi_BlockGraphInfo_base(info), errp);
+    bdrv_do_query_node_info(bs, qapi_BlockGraphInfo_base(info), false, errp);
     if (*errp) {
         goto fail;
     }
diff --git a/qapi/block-core.json b/qapi/block-core.json
index dc6eb4ae23..2c037183f0 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -275,6 +275,69 @@
       'file': 'ImageInfoSpecificFileWrapper'
   } }
 
+##
+# @BlockLimitsInfo:
+#
+# @request-alignment: Alignment requirement, in bytes, for
+#     offset/length of I/O requests.
+#
+# @max-discard: Maximum number of bytes that can be discarded at once.
+#     If not present, there is no specific maximum.
+#
+# @discard-alignment: Optimal alignment for discard requests in bytes.
+#     Note that this doesn't have to be a power of two.  If not
+#     present, discards don't have a alignment requirement different
+#     from @request-alignment.
+#
+# @max-write-zeroes: Maximum number of bytes that can be zeroed out at
+#     once.  If not present, there is no specific maximum.
+#
+# @write-zeroes-alignment: Optimal alignment for write zeroes requests
+#     in bytes.  Note that this doesn't have to be a power of two.  If
+#     not present, write_zeroes doesn't have a alignment requirement
+#     different from @request-alignment.
+#
+# @opt-transfer: Optimal transfer length in bytes.  If not present,
+#     there is no preferred size.
+#
+# @max-transfer: Maximal transfer length in bytes.  If not present,
+#     there is no specific maximum.
+#
+# @max-hw-transfer: Maximal hardware transfer length in bytes.
+#     Applies whenever transfers to the device bypass the kernel I/O
+#     scheduler, for example with SG_IO.  If not present, there is no
+#     specific maximum.
+#
+# @max-iov: Maximum number of scatter/gather elements
+#
+# @max-hw-iov: Maximum number of scatter/gather elements allowed by
+#     the hardware.  Applies whenever transfers to the device bypass
+#     the kernel I/O scheduler, for example with SG_IO.  If not
+#     present, the hardware limits is unknown and @max-iov is always
+#     used.
+#
+# @min-mem-alignment: Minimal required memory alignment in bytes for
+#     zero-copy I/O to succeed.  For unaligned requests, a bounce
+#     buffer will be used.
+#
+# @opt-mem-alignment: Optimal memory alignment in bytes.  This is the
+#     alignment used for any buffer allocations QEMU performs
+#     internally.
+##
+{ 'struct': 'BlockLimitsInfo',
+  'data': { 'request-alignment': 'uint32',
+            '*max-discard': 'uint64',
+            '*discard-alignment': 'uint32',
+            '*max-write-zeroes': 'uint64',
+            '*write-zeroes-alignment': 'uint32',
+            '*opt-transfer': 'uint32',
+            '*max-transfer': 'uint32',
+            '*max-hw-transfer': 'uint32',
+            'max-iov': 'int',
+            '*max-hw-iov': 'int',
+            'min-mem-alignment': 'size',
+            'opt-mem-alignment': 'size' } }
+
 ##
 # @BlockNodeInfo:
 #
@@ -304,6 +367,8 @@
 #
 # @snapshots: list of VM snapshots
 #
+# @limits: block limits that are used for I/O on the node (Since 10.2)
+#
 # @format-specific: structure supplying additional format-specific
 #     information (since 1.7)
 #
@@ -315,6 +380,7 @@
            '*cluster-size': 'int', '*encrypted': 'bool', '*compressed': 'bool',
            '*backing-filename': 'str', '*full-backing-filename': 'str',
            '*backing-filename-format': 'str', '*snapshots': ['SnapshotInfo'],
+           '*limits': 'BlockLimitsInfo',
            '*format-specific': 'ImageInfoSpecific' } }
 
 ##
diff --git a/tests/qemu-iotests/184 b/tests/qemu-iotests/184
index e4cbcd8634..6d0afe9d38 100755
--- a/tests/qemu-iotests/184
+++ b/tests/qemu-iotests/184
@@ -45,8 +45,9 @@ do_run_qemu()
 
 run_qemu()
 {
-    do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qemu | _filter_qmp\
-                          | _filter_qemu_io | _filter_generated_node_ids
+    do_run_qemu "$@" 2>&1 | _filter_testdir | _filter_qemu | _filter_qmp \
+                          | _filter_qemu_io | _filter_generated_node_ids \
+                          | _filter_img_info
 }
 
 test_throttle=$($QEMU_IMG --help|grep throttle)
diff --git a/tests/qemu-iotests/184.out b/tests/qemu-iotests/184.out
index ef99bb2e9a..52692b6b3b 100644
--- a/tests/qemu-iotests/184.out
+++ b/tests/qemu-iotests/184.out
@@ -41,12 +41,6 @@ Testing:
             },
             "iops_wr": 0,
             "ro": false,
-            "children": [
-                {
-                    "node-name": "disk0",
-                    "child": "file"
-                }
-            ],
             "node-name": "throttle0",
             "backing_file_depth": 1,
             "drv": "throttle",
@@ -75,8 +69,6 @@ Testing:
             },
             "iops_wr": 0,
             "ro": false,
-            "children": [
-            ],
             "node-name": "disk0",
             "backing_file_depth": 0,
             "drv": "null-co",
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index 511a55b1e8..26e6b45b04 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -229,6 +229,7 @@ _filter_img_info()
     discard=0
     regex_json_spec_start='^ *"format-specific": \{'
     regex_json_child_start='^ *"children": \['
+    regex_json_limit_start='^ *"limits": \{'
     gsed -e "s#$REMOTE_TEST_DIR#TEST_DIR#g" \
         -e "s#$IMGPROTO:$TEST_DIR#TEST_DIR#g" \
         -e "s#$TEST_DIR#TEST_DIR#g" \
@@ -261,7 +262,7 @@ _filter_img_info()
                 discard=1
             elif [[ $line =~ "Child node '/" ]]; then
                 discard=1
-            elif [[ $line =~ $regex_json_spec_start ]]; then
+            elif [[ $line =~ $regex_json_spec_start || $line =~ $regex_json_limit_start ]]; then
                 discard=2
                 regex_json_end="^${line%%[^ ]*}\\},? *$"
             elif [[ $line =~ $regex_json_child_start ]]; then

From 5b4b3bfdfc28d2398f34194d260d6eef9a9048b4 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 24 Oct 2025 14:30:39 +0200
Subject: [PATCH 1714/2396] qemu-img info: Optionally show block limits

Add a new --limits option to 'qemu-img info' that displays the block
limits for the image and all of its children, making the information
more accessible for human users than in QMP. This option is not enabled
by default because it can be a lot of output that isn't usually relevant
if you're not specifically trying to diagnose some I/O problem.

This makes the same information automatically also available in HMP
'info block -v'.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251024123041.51254-4-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qapi.c            | 34 ++++++++++++++++++++++++++++++++--
 docs/tools/qemu-img.rst |  6 +++++-
 include/block/qapi.h    |  2 +-
 qemu-img-cmds.hx        |  4 ++--
 qemu-img.c              | 15 ++++++++++++---
 5 files changed, 52 insertions(+), 9 deletions(-)

diff --git a/block/qapi.c b/block/qapi.c
index 54521d0a68..9f5771e019 100644
--- a/block/qapi.c
+++ b/block/qapi.c
@@ -417,6 +417,7 @@ fail:
  */
 void bdrv_query_block_graph_info(BlockDriverState *bs,
                                  BlockGraphInfo **p_info,
+                                 bool limits,
                                  Error **errp)
 {
     ERRP_GUARD();
@@ -425,7 +426,7 @@ void bdrv_query_block_graph_info(BlockDriverState *bs,
     BdrvChild *c;
 
     info = g_new0(BlockGraphInfo, 1);
-    bdrv_do_query_node_info(bs, qapi_BlockGraphInfo_base(info), false, errp);
+    bdrv_do_query_node_info(bs, qapi_BlockGraphInfo_base(info), limits, errp);
     if (*errp) {
         goto fail;
     }
@@ -439,7 +440,7 @@ void bdrv_query_block_graph_info(BlockDriverState *bs,
         QAPI_LIST_APPEND(children_list_tail, c_info);
 
         c_info->name = g_strdup(c->name);
-        bdrv_query_block_graph_info(c->bs, &c_info->info, errp);
+        bdrv_query_block_graph_info(c->bs, &c_info->info, limits, errp);
         if (*errp) {
             goto fail;
         }
@@ -936,6 +937,29 @@ void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec,
     visit_free(v);
 }
 
+/**
+ * Dumps the given BlockLimitsInfo object in a human-readable form,
+ * prepending an optional prefix if the dump is not empty.
+ */
+static void bdrv_image_info_limits_dump(BlockLimitsInfo *limits,
+                                        const char *prefix,
+                                        int indentation)
+{
+    QObject *obj;
+    Visitor *v = qobject_output_visitor_new(&obj);
+
+    visit_type_BlockLimitsInfo(v, NULL, &limits, &error_abort);
+    visit_complete(v, &obj);
+    if (!qobject_is_empty_dump(obj)) {
+        if (prefix) {
+            qemu_printf("%*s%s", indentation * 4, "", prefix);
+        }
+        dump_qobject(indentation + 1, obj);
+    }
+    qobject_unref(obj);
+    visit_free(v);
+}
+
 /**
  * Print the given @info object in human-readable form.  Every field is indented
  * using the given @indentation (four spaces per indentation level).
@@ -1011,6 +1035,12 @@ void bdrv_node_info_dump(BlockNodeInfo *info, int indentation, bool protocol)
         }
     }
 
+    if (info->limits) {
+        bdrv_image_info_limits_dump(info->limits,
+                                    "Block limits:\n",
+                                    indentation);
+    }
+
     if (info->has_snapshots) {
         SnapshotInfoList *elem;
 
diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index 5e7b85079d..fdc9ea9cf2 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -503,7 +503,7 @@ Command description:
 
   The size syntax is similar to :manpage:`dd(1)`'s size syntax.
 
-.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [-U] FILENAME
+.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-U] FILENAME
 
   Give information about the disk image *FILENAME*. Use it in
   particular to know the size reserved on disk which can be different
@@ -571,6 +571,10 @@ Command description:
     ``ImageInfoSpecific*`` QAPI object (e.g. ``ImageInfoSpecificQCow2``
     for qcow2 images).
 
+  *Block limits*
+    The block limits for I/O that QEMU detected for the image.
+    This information is only shown if the ``--limits`` option was specified.
+
 .. option:: map [--object OBJECTDEF] [--image-opts] [-f FMT] [--start-offset=OFFSET] [--max-length=LEN] [--output=OFMT] [-U] FILENAME
 
   Dump the metadata of image *FILENAME* and its backing file chain.
diff --git a/include/block/qapi.h b/include/block/qapi.h
index 54c48de26a..be554e53dc 100644
--- a/include/block/qapi.h
+++ b/include/block/qapi.h
@@ -42,7 +42,7 @@ bdrv_query_image_info(BlockDriverState *bs, ImageInfo **p_info, bool flat,
                       bool skip_implicit_filters, Error **errp);
 void GRAPH_RDLOCK
 bdrv_query_block_graph_info(BlockDriverState *bs, BlockGraphInfo **p_info,
-                            Error **errp);
+                            bool limits, Error **errp);
 
 void bdrv_snapshot_dump(QEMUSnapshotInfo *sn);
 void bdrv_image_info_specific_dump(ImageInfoSpecific *info_spec,
diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
index 2c5a8a28f9..74b66f9d42 100644
--- a/qemu-img-cmds.hx
+++ b/qemu-img-cmds.hx
@@ -66,9 +66,9 @@ SRST
 ERST
 
 DEF("info", img_info,
-    "info [--object objectdef] [--image-opts] [-f fmt] [--output=ofmt] [--backing-chain] [-U] filename")
+    "info [--object objectdef] [--image-opts] [-f fmt] [--output=ofmt] [--backing-chain] [--limits] [-U] filename")
 SRST
-.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [-U] FILENAME
+.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-U] FILENAME
 ERST
 
 DEF("map", img_map,
diff --git a/qemu-img.c b/qemu-img.c
index 7a162fdc08..5cdbeda969 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -86,6 +86,7 @@ enum {
     OPTION_BITMAPS = 275,
     OPTION_FORCE = 276,
     OPTION_SKIP_BROKEN = 277,
+    OPTION_LIMITS = 278,
 };
 
 typedef enum OutputFormat {
@@ -3002,7 +3003,8 @@ static gboolean str_equal_func(gconstpointer a, gconstpointer b)
 static BlockGraphInfoList *collect_image_info_list(bool image_opts,
                                                    const char *filename,
                                                    const char *fmt,
-                                                   bool chain, bool force_share)
+                                                   bool chain, bool limits,
+                                                   bool force_share)
 {
     BlockGraphInfoList *head = NULL;
     BlockGraphInfoList **tail = &head;
@@ -3039,7 +3041,7 @@ static BlockGraphInfoList *collect_image_info_list(bool image_opts,
          * the chain manually here.
          */
         bdrv_graph_rdlock_main_loop();
-        bdrv_query_block_graph_info(bs, &info, &err);
+        bdrv_query_block_graph_info(bs, &info, limits, &err);
         bdrv_graph_rdunlock_main_loop();
 
         if (err) {
@@ -3088,6 +3090,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     BlockGraphInfoList *list;
     bool image_opts = false;
     bool force_share = false;
+    bool limits = false;
 
     fmt = NULL;
     for(;;) {
@@ -3097,6 +3100,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
             {"backing-chain", no_argument, 0, OPTION_BACKING_CHAIN},
             {"force-share", no_argument, 0, 'U'},
+            {"limits", no_argument, 0, OPTION_LIMITS},
             {"output", required_argument, 0, OPTION_OUTPUT},
             {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
@@ -3119,6 +3123,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
 "     display information about the backing chain for copy-on-write overlays\n"
 "  -U, --force-share\n"
 "     open image in shared mode for concurrent access\n"
+"  --limits\n"
+"     show detected block limits (may depend on options, e.g. cache mode)\n"
 "  --output human|json\n"
 "     specify output format (default: human)\n"
 "  --object OBJDEF\n"
@@ -3140,6 +3146,9 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
         case 'U':
             force_share = true;
             break;
+        case OPTION_LIMITS:
+            limits = true;
+            break;
         case OPTION_OUTPUT:
             output_format = parse_output_format(argv[0], optarg);
             break;
@@ -3156,7 +3165,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     filename = argv[optind++];
 
     list = collect_image_info_list(image_opts, filename, fmt, chain,
-                                   force_share);
+                                   limits, force_share);
     if (!list) {
         return 1;
     }

From 911992fd6ec7a84c7cc82831b4bcd8a2ca5ccc76 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 24 Oct 2025 14:30:40 +0200
Subject: [PATCH 1715/2396] qemu-img info: Add cache mode option

When querying block limits, different cache modes (in particular
O_DIRECT or not) can result in different limits. Add an option to
'qemu-img info' that allows the user to specify a cache mode, so that
they can get the block limits for the cache mode they intend to use with
their VM.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251024123041.51254-5-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/qemu-img.rst |  2 +-
 qemu-img-cmds.hx        |  4 ++--
 qemu-img.c              | 25 +++++++++++++++++++++----
 3 files changed, 24 insertions(+), 7 deletions(-)

diff --git a/docs/tools/qemu-img.rst b/docs/tools/qemu-img.rst
index fdc9ea9cf2..558b0eb84d 100644
--- a/docs/tools/qemu-img.rst
+++ b/docs/tools/qemu-img.rst
@@ -503,7 +503,7 @@ Command description:
 
   The size syntax is similar to :manpage:`dd(1)`'s size syntax.
 
-.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-U] FILENAME
+.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-t CACHE] [-U] FILENAME
 
   Give information about the disk image *FILENAME*. Use it in
   particular to know the size reserved on disk which can be different
diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
index 74b66f9d42..6bc8265cfb 100644
--- a/qemu-img-cmds.hx
+++ b/qemu-img-cmds.hx
@@ -66,9 +66,9 @@ SRST
 ERST
 
 DEF("info", img_info,
-    "info [--object objectdef] [--image-opts] [-f fmt] [--output=ofmt] [--backing-chain] [--limits] [-U] filename")
+    "info [--object objectdef] [--image-opts] [-f fmt] [--output=ofmt] [--backing-chain] [--limits] [-t CACHE] [-U] filename")
 SRST
-.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-U] FILENAME
+.. option:: info [--object OBJECTDEF] [--image-opts] [-f FMT] [--output=OFMT] [--backing-chain] [--limits] [-t CACHE] [-U] FILENAME
 ERST
 
 DEF("map", img_map,
diff --git a/qemu-img.c b/qemu-img.c
index 5cdbeda969..a7791896c1 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3003,6 +3003,7 @@ static gboolean str_equal_func(gconstpointer a, gconstpointer b)
 static BlockGraphInfoList *collect_image_info_list(bool image_opts,
                                                    const char *filename,
                                                    const char *fmt,
+                                                   const char *cache,
                                                    bool chain, bool limits,
                                                    bool force_share)
 {
@@ -3010,6 +3011,15 @@ static BlockGraphInfoList *collect_image_info_list(bool image_opts,
     BlockGraphInfoList **tail = &head;
     GHashTable *filenames;
     Error *err = NULL;
+    int cache_flags = 0;
+    bool writethrough = false;
+    int ret;
+
+    ret = bdrv_parse_cache_mode(cache, &cache_flags, &writethrough);
+    if (ret < 0) {
+        error_report("Invalid cache option: %s", cache);
+        return NULL;
+    }
 
     filenames = g_hash_table_new_full(g_str_hash, str_equal_func, NULL, NULL);
 
@@ -3026,8 +3036,8 @@ static BlockGraphInfoList *collect_image_info_list(bool image_opts,
         g_hash_table_insert(filenames, (gpointer)filename, NULL);
 
         blk = img_open(image_opts, filename, fmt,
-                       BDRV_O_NO_BACKING | BDRV_O_NO_IO, false, false,
-                       force_share);
+                       BDRV_O_NO_BACKING | BDRV_O_NO_IO | cache_flags,
+                       writethrough, false, force_share);
         if (!blk) {
             goto err;
         }
@@ -3087,6 +3097,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     OutputFormat output_format = OFORMAT_HUMAN;
     bool chain = false;
     const char *filename, *fmt;
+    const char *cache = BDRV_DEFAULT_CACHE;
     BlockGraphInfoList *list;
     bool image_opts = false;
     bool force_share = false;
@@ -3099,13 +3110,14 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
             {"format", required_argument, 0, 'f'},
             {"image-opts", no_argument, 0, OPTION_IMAGE_OPTS},
             {"backing-chain", no_argument, 0, OPTION_BACKING_CHAIN},
+            {"cache", required_argument, 0, 't'},
             {"force-share", no_argument, 0, 'U'},
             {"limits", no_argument, 0, OPTION_LIMITS},
             {"output", required_argument, 0, OPTION_OUTPUT},
             {"object", required_argument, 0, OPTION_OBJECT},
             {0, 0, 0, 0}
         };
-        c = getopt_long(argc, argv, "hf:U", long_options, NULL);
+        c = getopt_long(argc, argv, "hf:t:U", long_options, NULL);
         if (c == -1) {
             break;
         }
@@ -3121,6 +3133,8 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
 "     (incompatible with -f|--format)\n"
 "  --backing-chain\n"
 "     display information about the backing chain for copy-on-write overlays\n"
+"  -t, --cache CACHE\n"
+"     cache mode for FILE (default: " BDRV_DEFAULT_CACHE ")\n"
 "  -U, --force-share\n"
 "     open image in shared mode for concurrent access\n"
 "  --limits\n"
@@ -3143,6 +3157,9 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
         case OPTION_BACKING_CHAIN:
             chain = true;
             break;
+        case 't':
+            cache = optarg;
+            break;
         case 'U':
             force_share = true;
             break;
@@ -3164,7 +3181,7 @@ static int img_info(const img_cmd_t *ccmd, int argc, char **argv)
     }
     filename = argv[optind++];
 
-    list = collect_image_info_list(image_opts, filename, fmt, chain,
+    list = collect_image_info_list(image_opts, filename, fmt, cache, chain,
                                    limits, force_share);
     if (!list) {
         return 1;

From a04c5ba543c1bc83a25a557e3b62ee811869b373 Mon Sep 17 00:00:00 2001
From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
Date: Sun, 24 Aug 2025 22:38:28 +0200
Subject: [PATCH 1716/2396] target/microblaze: Remove unused arg from
 check_divz()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unused arg from check_divz(). No functional change.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/microblaze/op_helper.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index df93c4229d..886224df3c 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -69,7 +69,7 @@ void helper_raise_exception(CPUMBState *env, uint32_t index)
     cpu_loop_exit(cs);
 }
 
-static bool check_divz(CPUMBState *env, uint32_t a, uint32_t b, uintptr_t ra)
+static bool check_divz(CPUMBState *env, uint32_t b, uintptr_t ra)
 {
     if (unlikely(b == 0)) {
         env->msr |= MSR_DZ;
@@ -89,7 +89,7 @@ static bool check_divz(CPUMBState *env, uint32_t a, uint32_t b, uintptr_t ra)
 
 uint32_t helper_divs(CPUMBState *env, uint32_t a, uint32_t b)
 {
-    if (!check_divz(env, a, b, GETPC())) {
+    if (!check_divz(env, b, GETPC())) {
         return 0;
     }
     return (int32_t)a / (int32_t)b;
@@ -97,7 +97,7 @@ uint32_t helper_divs(CPUMBState *env, uint32_t a, uint32_t b)
 
 uint32_t helper_divu(CPUMBState *env, uint32_t a, uint32_t b)
 {
-    if (!check_divz(env, a, b, GETPC())) {
+    if (!check_divz(env, b, GETPC())) {
         return 0;
     }
     return a / b;

From 0e46b4d1f13b26c3c0e30eafa2be8eed76548bd3 Mon Sep 17 00:00:00 2001
From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
Date: Sun, 24 Aug 2025 22:55:56 +0200
Subject: [PATCH 1717/2396] target/microblaze: div: Break out raise_divzero()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Break out raise_divzero() and take the opportunity to rename
and reorder function args to better match with spec and
pseudo code.

No functional change.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/microblaze/op_helper.c | 34 ++++++++++++++++------------------
 target/microblaze/translate.c | 12 ++----------
 2 files changed, 18 insertions(+), 28 deletions(-)

diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index 886224df3c..d3f688e375 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -69,38 +69,36 @@ void helper_raise_exception(CPUMBState *env, uint32_t index)
     cpu_loop_exit(cs);
 }
 
-static bool check_divz(CPUMBState *env, uint32_t b, uintptr_t ra)
+/* Raises ESR_EC_DIVZERO if exceptions are enabled.  */
+static void raise_divzero(CPUMBState *env, uint32_t esr, uintptr_t unwind_pc)
 {
-    if (unlikely(b == 0)) {
-        env->msr |= MSR_DZ;
+    env->msr |= MSR_DZ;
 
-        if ((env->msr & MSR_EE) &&
-            env_archcpu(env)->cfg.div_zero_exception) {
-            CPUState *cs = env_cpu(env);
+    if ((env->msr & MSR_EE) && env_archcpu(env)->cfg.div_zero_exception) {
+        CPUState *cs = env_cpu(env);
 
-            env->esr = ESR_EC_DIVZERO;
-            cs->exception_index = EXCP_HW_EXCP;
-            cpu_loop_exit_restore(cs, ra);
-        }
-        return false;
+        env->esr = esr;
+        cs->exception_index = EXCP_HW_EXCP;
+        cpu_loop_exit_restore(cs, unwind_pc);
     }
-    return true;
 }
 
-uint32_t helper_divs(CPUMBState *env, uint32_t a, uint32_t b)
+uint32_t helper_divs(CPUMBState *env, uint32_t ra, uint32_t rb)
 {
-    if (!check_divz(env, b, GETPC())) {
+    if (!ra) {
+        raise_divzero(env, ESR_EC_DIVZERO, GETPC());
         return 0;
     }
-    return (int32_t)a / (int32_t)b;
+    return (int32_t)rb / (int32_t)ra;
 }
 
-uint32_t helper_divu(CPUMBState *env, uint32_t a, uint32_t b)
+uint32_t helper_divu(CPUMBState *env, uint32_t ra, uint32_t rb)
 {
-    if (!check_divz(env, b, GETPC())) {
+    if (!ra) {
+        raise_divzero(env, ESR_EC_DIVZERO, GETPC());
         return 0;
     }
-    return a / b;
+    return rb / ra;
 }
 
 /* raise FPU exception.  */
diff --git a/target/microblaze/translate.c b/target/microblaze/translate.c
index 6442a250c5..fefe5cb552 100644
--- a/target/microblaze/translate.c
+++ b/target/microblaze/translate.c
@@ -450,16 +450,8 @@ DO_TYPEA0_CFG(flt, use_fpu >= 2, true, gen_flt)
 DO_TYPEA0_CFG(fint, use_fpu >= 2, true, gen_fint)
 DO_TYPEA0_CFG(fsqrt, use_fpu >= 2, true, gen_fsqrt)
 
-/* Does not use ENV_WRAPPER3, because arguments are swapped as well. */
-static void gen_idiv(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
-{
-    gen_helper_divs(out, tcg_env, inb, ina);
-}
-
-static void gen_idivu(TCGv_i32 out, TCGv_i32 ina, TCGv_i32 inb)
-{
-    gen_helper_divu(out, tcg_env, inb, ina);
-}
+ENV_WRAPPER3(gen_idiv, gen_helper_divs)
+ENV_WRAPPER3(gen_idivu, gen_helper_divu)
 
 DO_TYPEA_CFG(idiv, use_div, true, gen_idiv)
 DO_TYPEA_CFG(idivu, use_div, true, gen_idivu)

From cfc1d54251d3b4c4cf21c4fa278c8aea2fe25a99 Mon Sep 17 00:00:00 2001
From: "Edgar E. Iglesias" <edgar.iglesias@amd.com>
Date: Sun, 24 Aug 2025 21:37:32 +0200
Subject: [PATCH 1718/2396] target/microblaze: Handle signed division overflows

Handle signed division overflows as specified in UG984:
https://docs.amd.com/r/en-US/ug984-vivado-microblaze-ref/idiv

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/microblaze/cpu.h       |  1 +
 target/microblaze/op_helper.c | 15 +++++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/target/microblaze/cpu.h b/target/microblaze/cpu.h
index 14b107876a..d26b933b6d 100644
--- a/target/microblaze/cpu.h
+++ b/target/microblaze/cpu.h
@@ -87,6 +87,7 @@ typedef struct CPUArchState CPUMBState;
 #define          ESR_ESS_FSL_OFFSET     5
 
 #define          ESR_ESS_MASK  (0x7f << 5)
+#define          ESR_ESS_DEC_OF  (1 << 11) /* DEC: 0=DBZ, 1=OF */
 
 #define          ESR_EC_FSL             0
 #define          ESR_EC_UNALIGNED_DATA  1
diff --git a/target/microblaze/op_helper.c b/target/microblaze/op_helper.c
index d3f688e375..31da2c7c3a 100644
--- a/target/microblaze/op_helper.c
+++ b/target/microblaze/op_helper.c
@@ -89,6 +89,21 @@ uint32_t helper_divs(CPUMBState *env, uint32_t ra, uint32_t rb)
         raise_divzero(env, ESR_EC_DIVZERO, GETPC());
         return 0;
     }
+
+    /*
+     * Check for division overflows.
+     *
+     * Spec: https://docs.amd.com/r/en-US/ug984-vivado-microblaze-ref/idiv
+     * UG984, Chapter 5 MicroBlaze Instruction Set Architecture, idiv.
+     *
+     * If the U bit is clear, the value of rA is -1, and the value of rB is
+     * -2147483648 (divide overflow), the DZO bit in MSR will be set and
+     * the value in rD will be -2147483648, unless an exception is generated.
+     */
+    if ((int32_t)ra == -1 && (int32_t)rb == INT32_MIN) {
+        raise_divzero(env, ESR_EC_DIVZERO | ESR_ESS_DEC_OF, GETPC());
+        return INT32_MIN;
+    }
     return (int32_t)rb / (int32_t)ra;
 }
 

From 2d89f33cd02ef8345d98262f51bc91bfcaaff86d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:08 +0000
Subject: [PATCH 1719/2396] ci: clean-up remaining bits of armhf builds.
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We no longer need to support 32 bit builds and we missed this while
cleaning up.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251027110344.2289945-2-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/devel/testing/ci-jobs.rst.inc            | 7 -------
 scripts/ci/setup/ubuntu/build-environment.yml | 6 ------
 2 files changed, 13 deletions(-)

diff --git a/docs/devel/testing/ci-jobs.rst.inc b/docs/devel/testing/ci-jobs.rst.inc
index f1c541cc25..b92d372a0a 100644
--- a/docs/devel/testing/ci-jobs.rst.inc
+++ b/docs/devel/testing/ci-jobs.rst.inc
@@ -168,13 +168,6 @@ If you've got access to an aarch64 host that can be used as a gitlab-CI
 runner, you can set this variable to enable the tests that require this
 kind of host. The runner should be tagged with "aarch64".
 
-AARCH32_RUNNER_AVAILABLE
-~~~~~~~~~~~~~~~~~~~~~~~~
-If you've got access to an armhf host or an arch64 host that can run
-aarch32 EL0 code to be used as a gitlab-CI runner, you can set this
-variable to enable the tests that require this kind of host. The
-runner should be tagged with "aarch32".
-
 S390X_RUNNER_AVAILABLE
 ~~~~~~~~~~~~~~~~~~~~~~
 If you've got access to an IBM Z host that can be used as a gitlab-CI
diff --git a/scripts/ci/setup/ubuntu/build-environment.yml b/scripts/ci/setup/ubuntu/build-environment.yml
index 0f8ec5fab0..1c517c74f7 100644
--- a/scripts/ci/setup/ubuntu/build-environment.yml
+++ b/scripts/ci/setup/ubuntu/build-environment.yml
@@ -19,12 +19,6 @@
           - '((ansible_version.major == 2) and (ansible_version.minor >= 8)) or (ansible_version.major >= 3)'
         msg: "Unsuitable ansible version, please use version 2.8.0 or later"
 
-    - name: Add armhf foreign architecture to aarch64 hosts
-      command: dpkg --add-architecture armhf
-      when:
-        - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['architecture'] == 'aarch64'
-
     - name: Update apt cache / upgrade packages via apt
       apt:
         update_cache: yes

From 1a0b5af768b0e428eaf33f7b6a2d0eb1e6dffe0a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:09 +0000
Subject: [PATCH 1720/2396] scripts/ci/setup: regenerate yaml
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We inadvertently updated the base libvirt-ci project which has
resulted in changes. Make sure the output matches what we generate.

Fixes: 0d4fb8f746d (configure: set the bindgen cross target)
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251027110344.2289945-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml | 4 ++--
 scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml   | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
index ce632d9710..70063db198 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
@@ -26,7 +26,7 @@ packages:
   - git
   - hostname
   - libaio-dev
-  - libasan6
+  - libasan8
   - libasound2-dev
   - libattr1-dev
   - libbpf-dev
@@ -37,7 +37,7 @@ packages:
   - libcap-ng-dev
   - libcapstone-dev
   - libcbor-dev
-  - libclang-dev
+  - libclang-rt-dev
   - libcmocka-dev
   - libcurl4-gnutls-dev
   - libdaxctl-dev
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
index f45f75c960..4f1a49be34 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
@@ -26,7 +26,7 @@ packages:
   - git
   - hostname
   - libaio-dev
-  - libasan6
+  - libasan8
   - libasound2-dev
   - libattr1-dev
   - libbpf-dev
@@ -37,7 +37,7 @@ packages:
   - libcap-ng-dev
   - libcapstone-dev
   - libcbor-dev
-  - libclang-dev
+  - libclang-rt-dev
   - libcmocka-dev
   - libcurl4-gnutls-dev
   - libdaxctl-dev

From ced14739eb60e7f856374752adcc3fd056ce795c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:10 +0000
Subject: [PATCH 1721/2396] scripts/ci: move build-environment.yaml up a level
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We can share the setup of the build environment with multiple
operating systems as we just need to check the YAML for each env is
present in the directory structure.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251027110344.2289945-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .../ci/setup/{ubuntu => }/build-environment.yml  | 16 +++++++++++-----
 1 file changed, 11 insertions(+), 5 deletions(-)
 rename scripts/ci/setup/{ubuntu => }/build-environment.yml (81%)

diff --git a/scripts/ci/setup/ubuntu/build-environment.yml b/scripts/ci/setup/build-environment.yml
similarity index 81%
rename from scripts/ci/setup/ubuntu/build-environment.yml
rename to scripts/ci/setup/build-environment.yml
index 1c517c74f7..66bde18875 100644
--- a/scripts/ci/setup/ubuntu/build-environment.yml
+++ b/scripts/ci/setup/build-environment.yml
@@ -27,18 +27,24 @@
         - ansible_facts['distribution'] == 'Ubuntu'
 
     # the package lists are updated by "make lcitool-refresh"
-    - name: Include package lists based on OS and architecture
-      include_vars:
-        file: "ubuntu-2404-{{ ansible_facts['architecture'] }}.yaml"
+    - name: Define package list file path
+      set_fact:
+        package_file: "ubuntu/ubuntu-2404-{{ ansible_facts['architecture'] }}.yaml"
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
         - ansible_facts['distribution_version'] == '24.04'
 
+    - name: Include package lists based on OS and architecture
+      include_vars:
+        file: "{{ package_file }}"
+      when:
+        - package_file is exists
+
     - name: Install packages for QEMU on Ubuntu 24.04
       package:
         name: "{{ packages }}"
       when:
-        - ansible_facts['distribution'] == 'Ubuntu'
-        - ansible_facts['distribution_version'] == '24.04'
+        - package_file is exists
+        - packages is defined
 
 

From 7425f47727e302d41fa803fbf1df86961bb1d177 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:11 +0000
Subject: [PATCH 1722/2396] scripts/ci: allow both Ubuntu or Debian to run
 upgrade
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no practical difference between the systems when it comes to
updating the installed system.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251027110344.2289945-5-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/ci/setup/build-environment.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/ci/setup/build-environment.yml b/scripts/ci/setup/build-environment.yml
index 66bde18875..253d0b759b 100644
--- a/scripts/ci/setup/build-environment.yml
+++ b/scripts/ci/setup/build-environment.yml
@@ -24,7 +24,7 @@
         update_cache: yes
         upgrade: yes
       when:
-        - ansible_facts['distribution'] == 'Ubuntu'
+        - ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
     # the package lists are updated by "make lcitool-refresh"
     - name: Define package list file path

From e1bbb4c62e0d96802ab6773f4661de9e1582e8bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:12 +0000
Subject: [PATCH 1723/2396] tests/lcitool: generate a yaml file for the ppc64le
 runner
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unlike the Aarch64 runners this comes with pure Debian out of the box.
We need a minor tweak to build-environment to deal with the
differences in naming convention.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251027110344.2289945-6-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/ci/setup/build-environment.yml        |  10 +-
 .../ci/setup/debian/debian-13-ppc64le.yaml    | 134 ++++++++++++++++++
 tests/lcitool/refresh                         |   1 +
 3 files changed, 143 insertions(+), 2 deletions(-)
 create mode 100644 scripts/ci/setup/debian/debian-13-ppc64le.yaml

diff --git a/scripts/ci/setup/build-environment.yml b/scripts/ci/setup/build-environment.yml
index 253d0b759b..528150dce7 100644
--- a/scripts/ci/setup/build-environment.yml
+++ b/scripts/ci/setup/build-environment.yml
@@ -27,20 +27,26 @@
         - ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
     # the package lists are updated by "make lcitool-refresh"
-    - name: Define package list file path
+    - name: Define package list file path for Ubuntu
       set_fact:
         package_file: "ubuntu/ubuntu-2404-{{ ansible_facts['architecture'] }}.yaml"
       when:
         - ansible_facts['distribution'] == 'Ubuntu'
         - ansible_facts['distribution_version'] == '24.04'
 
+    - name: Define package list file path for Debian
+      set_fact:
+        package_file: "debian/debian-{{ ansible_facts['distribution_major_version'] }}-{{ ansible_facts['architecture'] }}.yaml"
+      when:
+        - ansible_facts['distribution'] == 'Debian'
+
     - name: Include package lists based on OS and architecture
       include_vars:
         file: "{{ package_file }}"
       when:
         - package_file is exists
 
-    - name: Install packages for QEMU on Ubuntu 24.04
+    - name: Install packages for QEMU on Ubuntu/Debian
       package:
         name: "{{ packages }}"
       when:
diff --git a/scripts/ci/setup/debian/debian-13-ppc64le.yaml b/scripts/ci/setup/debian/debian-13-ppc64le.yaml
new file mode 100644
index 0000000000..e29c9c1840
--- /dev/null
+++ b/scripts/ci/setup/debian/debian-13-ppc64le.yaml
@@ -0,0 +1,134 @@
+# THIS FILE WAS AUTO-GENERATED
+#
+#  $ lcitool variables --host-arch ppc64le debian-13 qemu
+#
+# https://gitlab.com/libvirt/libvirt-ci
+
+packages:
+  - bash
+  - bc
+  - bindgen
+  - bison
+  - bsdextrautils
+  - bzip2
+  - ca-certificates
+  - ccache
+  - clang
+  - dbus
+  - debianutils
+  - diffutils
+  - exuberant-ctags
+  - findutils
+  - flex
+  - gcc
+  - gcovr
+  - gettext
+  - git
+  - hostname
+  - libaio-dev
+  - libasan8
+  - libasound2-dev
+  - libattr1-dev
+  - libbpf-dev
+  - libbrlapi-dev
+  - libbz2-dev
+  - libc6-dev
+  - libcacard-dev
+  - libcap-ng-dev
+  - libcapstone-dev
+  - libcbor-dev
+  - libclang-rt-dev
+  - libcmocka-dev
+  - libcurl4-gnutls-dev
+  - libdaxctl-dev
+  - libdrm-dev
+  - libepoxy-dev
+  - libfdt-dev
+  - libffi-dev
+  - libfuse3-dev
+  - libgbm-dev
+  - libgcrypt20-dev
+  - libglib2.0-dev
+  - libglusterfs-dev
+  - libgnutls28-dev
+  - libgtk-3-dev
+  - libgtk-vnc-2.0-dev
+  - libibverbs-dev
+  - libiscsi-dev
+  - libjemalloc-dev
+  - libjpeg62-turbo-dev
+  - libjson-c-dev
+  - liblttng-ust-dev
+  - liblzo2-dev
+  - libncursesw5-dev
+  - libnfs-dev
+  - libnuma-dev
+  - libpam0g-dev
+  - libpcre2-dev
+  - libpipewire-0.3-dev
+  - libpixman-1-dev
+  - libpng-dev
+  - libpulse-dev
+  - librbd-dev
+  - librdmacm-dev
+  - libsasl2-dev
+  - libsdl2-dev
+  - libsdl2-image-dev
+  - libseccomp-dev
+  - libselinux1-dev
+  - libslirp-dev
+  - libsnappy-dev
+  - libsndio-dev
+  - libspice-protocol-dev
+  - libspice-server-dev
+  - libssh-dev
+  - libstd-rust-dev
+  - libsystemd-dev
+  - libtasn1-6-dev
+  - libubsan1
+  - libudev-dev
+  - liburing-dev
+  - libusb-1.0-0-dev
+  - libusbredirhost-dev
+  - libvdeplug-dev
+  - libvirglrenderer-dev
+  - libvte-2.91-dev
+  - libxdp-dev
+  - libzstd-dev
+  - llvm
+  - locales
+  - make
+  - mtools
+  - multipath-tools
+  - ncat
+  - nettle-dev
+  - ninja-build
+  - openssh-client
+  - pkgconf
+  - python3
+  - python3-numpy
+  - python3-opencv
+  - python3-pillow
+  - python3-pip
+  - python3-setuptools
+  - python3-sphinx
+  - python3-sphinx-rtd-theme
+  - python3-tomli
+  - python3-venv
+  - python3-wheel
+  - python3-yaml
+  - rpm2cpio
+  - rustc
+  - sed
+  - socat
+  - sparse
+  - swtpm
+  - systemtap-sdt-dev
+  - tar
+  - tesseract-ocr
+  - tesseract-ocr-eng
+  - vulkan-tools
+  - xorriso
+  - zlib1g-dev
+  - zstd
+
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 056cfb6e9d..7fbdf6f340 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -272,6 +272,7 @@ try:
     #
     generate_yaml("ubuntu", "ubuntu-2404", "aarch64")
     generate_yaml("ubuntu", "ubuntu-2404", "s390x")
+    generate_yaml("debian", "debian-13", "ppc64le")
 
 
     sys.exit(0)

From 900a5ecf0a1e5db4dc93190a3f69d49755670450 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:13 +0000
Subject: [PATCH 1724/2396] scripts/ci: modify gitlab runner deb setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both Debian and Ubuntu are setup the same way.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-ID: <20251027110344.2289945-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 scripts/ci/setup/gitlab-runner.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/ci/setup/gitlab-runner.yml b/scripts/ci/setup/gitlab-runner.yml
index 7025935487..76aeaf4ee9 100644
--- a/scripts/ci/setup/gitlab-runner.yml
+++ b/scripts/ci/setup/gitlab-runner.yml
@@ -56,12 +56,12 @@
         url: "https://packages.gitlab.com/install/repositories/runner/gitlab-runner/script.deb.sh"
         mode: 0755
       when:
-        - ansible_facts['distribution'] == 'Ubuntu'
+        - ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
     - name: Run gitlab-runner repo setup script (DEB)
       shell: "/root/script.deb.sh"
       when:
-        - ansible_facts['distribution'] == 'Ubuntu'
+        - ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
     - name: Install gitlab-runner (DEB)
       ansible.builtin.apt:
@@ -69,7 +69,7 @@
           update_cache: yes
           state: present
       when:
-        - ansible_facts['distribution'] == 'Ubuntu'
+        - ansible_facts['distribution'] in ['Ubuntu', 'Debian']
 
     # RPM setup
     - name: Get gitlab-runner repo setup script (RPM)

From a8b477239ec084f4749354059d3c0d4925e9c9a5 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:14 +0000
Subject: [PATCH 1725/2396] plugins: add types for callbacks related to certain
 discontinuities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The plugin API allows registration of callbacks for a variety of VCPU
related events, such as VCPU reset, idle and resume. However, traps of
any kind, i.e. interrupts or exceptions, were previously not covered.
These kinds of events are arguably quite significant and usually go hand
in hand with a PC discontinuity. On most platforms, the discontinuity
also includes a transition from some "mode" to another. Thus, plugins
for the analysis of (virtualized) embedded systems may benefit from or
even require the possiblity to perform work on the occurance of an
interrupt or exception.

This change introduces the concept of such a discontinuity event in the
form of an enumeration. Currently only traps are covered. Specifically
we (loosely) define interrupts, exceptions and host calls across all
platforms. In addition, this change introduces a type to use for
callback functions related to such events. Since possible modes and the
enumeration of interupts and exceptions vary greatly between different
architectures, the callback type only receives the VCPU id, the type of
event as well as the old and new PC.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/qemu/plugin.h      |  1 +
 include/qemu/qemu-plugin.h | 44 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index f355c7cb8a..8cf20cd96f 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -59,6 +59,7 @@ union qemu_plugin_cb_sig {
     qemu_plugin_udata_cb_t           udata;
     qemu_plugin_vcpu_simple_cb_t     vcpu_simple;
     qemu_plugin_vcpu_udata_cb_t      vcpu_udata;
+    qemu_plugin_vcpu_discon_cb_t     vcpu_discon;
     qemu_plugin_vcpu_tb_trans_cb_t   vcpu_tb_trans;
     qemu_plugin_vcpu_mem_cb_t        vcpu_mem;
     qemu_plugin_vcpu_syscall_cb_t    vcpu_syscall;
diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index c450106af1..08bf366e36 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -161,6 +161,50 @@ typedef void (*qemu_plugin_vcpu_simple_cb_t)(qemu_plugin_id_t id,
 typedef void (*qemu_plugin_vcpu_udata_cb_t)(unsigned int vcpu_index,
                                             void *userdata);
 
+
+/**
+ * enum qemu_plugin_discon_type - type of a (potential) PC discontinuity
+ *
+ * @QEMU_PLUGIN_DISCON_INTERRUPT: an interrupt, defined across all architectures
+ *                                as an asynchronous event, usually originating
+ *                                from outside the CPU
+ * @QEMU_PLUGIN_DISCON_EXCEPTION: an exception, defined across all architectures
+ *                                as a synchronous event in response to a
+ *                                specific instruction being executed
+ * @QEMU_PLUGIN_DISCON_HOSTCALL: a host call, functionally a special kind of
+ *                               exception that is not handled by code run by
+ *                               the vCPU but machinery outside the vCPU
+ * @QEMU_PLUGIN_DISCON_ALL: all types of disconinuity events currently covered
+ */
+enum qemu_plugin_discon_type {
+    QEMU_PLUGIN_DISCON_INTERRUPT = 1 << 0,
+    QEMU_PLUGIN_DISCON_EXCEPTION = 1 << 1,
+    QEMU_PLUGIN_DISCON_HOSTCALL = 1 << 2,
+    QEMU_PLUGIN_DISCON_ALL = -1
+};
+
+/**
+ * typedef qemu_plugin_vcpu_discon_cb_t - vcpu discontinuity callback
+ * @id: plugin ID
+ * @vcpu_index: the current vcpu context
+ * @type: the type of discontinuity
+ * @from_pc: the source of the discontinuity, e.g. the PC before the
+ *           transition
+ * @to_pc: the PC pointing to the next instruction to be executed
+ *
+ * The exact semantics of @from_pc depends on the @type of discontinuity. For
+ * interrupts, @from_pc will point to the next instruction which would have
+ * been executed. For exceptions and host calls, @from_pc will point to the
+ * instruction that caused the exception or issued the host call. Note that
+ * in the case of exceptions, the instruction may not be retired and thus not
+ * observable via general instruction exec callbacks. The same may be the case
+ * for some host calls such as hypervisor call "exceptions".
+ */
+typedef void (*qemu_plugin_vcpu_discon_cb_t)(qemu_plugin_id_t id,
+                                             unsigned int vcpu_index,
+                                             enum qemu_plugin_discon_type type,
+                                             uint64_t from_pc, uint64_t to_pc);
+
 /**
  * qemu_plugin_uninstall() - Uninstall a plugin
  * @id: this plugin's opaque ID

From aac73d85d2d6f556dbcee6041a2898cb0ef9b0e6 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:15 +0000
Subject: [PATCH 1726/2396] plugins: add API for registering discontinuity
 callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The plugin API allows registration of callbacks for a variety of VCPU
related events, such as VCPU reset, idle and resume. In addition to
those events, we recently defined discontinuity events, which include
traps.

This change introduces a function to register callbacks for these
events. We define one distinct plugin event type for each type of
discontinuity, granting fine control to plugins in term of which events
they receive.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-9-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/qemu/plugin-event.h |  3 +++
 include/qemu/qemu-plugin.h  | 16 ++++++++++++++++
 plugins/core.c              | 15 +++++++++++++++
 3 files changed, 34 insertions(+)

diff --git a/include/qemu/plugin-event.h b/include/qemu/plugin-event.h
index 7056d8427b..1100dae212 100644
--- a/include/qemu/plugin-event.h
+++ b/include/qemu/plugin-event.h
@@ -20,6 +20,9 @@ enum qemu_plugin_event {
     QEMU_PLUGIN_EV_VCPU_SYSCALL_RET,
     QEMU_PLUGIN_EV_FLUSH,
     QEMU_PLUGIN_EV_ATEXIT,
+    QEMU_PLUGIN_EV_VCPU_INTERRUPT,
+    QEMU_PLUGIN_EV_VCPU_EXCEPTION,
+    QEMU_PLUGIN_EV_VCPU_HOSTCALL,
     QEMU_PLUGIN_EV_MAX, /* total number of plugin events we support */
 };
 
diff --git a/include/qemu/qemu-plugin.h b/include/qemu/qemu-plugin.h
index 08bf366e36..60de4fdd3f 100644
--- a/include/qemu/qemu-plugin.h
+++ b/include/qemu/qemu-plugin.h
@@ -281,6 +281,22 @@ QEMU_PLUGIN_API
 void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
                                          qemu_plugin_vcpu_simple_cb_t cb);
 
+/**
+ * qemu_plugin_register_vcpu_discon_cb() - register a discontinuity callback
+ * @id: plugin ID
+ * @type: types of discontinuities for which to call the callback
+ * @cb: callback function
+ *
+ * The @cb function is called every time a vCPU receives a discontinuity event
+ * of the specified type(s), after the vCPU was prepared to handle the event.
+ * Preparation entails updating the PC, usually to some interrupt handler or
+ * trap vector entry.
+ */
+QEMU_PLUGIN_API
+void qemu_plugin_register_vcpu_discon_cb(qemu_plugin_id_t id,
+                                         enum qemu_plugin_discon_type type,
+                                         qemu_plugin_vcpu_discon_cb_t cb);
+
 /** struct qemu_plugin_tb - Opaque handle for a translation block */
 struct qemu_plugin_tb;
 /** struct qemu_plugin_insn - Opaque handle for a translated instruction */
diff --git a/plugins/core.c b/plugins/core.c
index ead09fd2f1..40d001d39a 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -569,6 +569,21 @@ void qemu_plugin_register_vcpu_resume_cb(qemu_plugin_id_t id,
     plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_RESUME, cb);
 }
 
+void qemu_plugin_register_vcpu_discon_cb(qemu_plugin_id_t id,
+                                         enum qemu_plugin_discon_type type,
+                                         qemu_plugin_vcpu_discon_cb_t cb)
+{
+    if (type & QEMU_PLUGIN_DISCON_INTERRUPT) {
+        plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_INTERRUPT, cb);
+    }
+    if (type & QEMU_PLUGIN_DISCON_EXCEPTION) {
+        plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_EXCEPTION, cb);
+    }
+    if (type & QEMU_PLUGIN_DISCON_HOSTCALL) {
+        plugin_register_cb(id, QEMU_PLUGIN_EV_VCPU_HOSTCALL, cb);
+    }
+}
+
 void qemu_plugin_register_flush_cb(qemu_plugin_id_t id,
                                    qemu_plugin_simple_cb_t cb)
 {

From a1688bc86ce93ac0e006673766cd123eed43c02c Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:16 +0000
Subject: [PATCH 1727/2396] plugins: add hooks for new discontinuity related
 callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The plugin API allows registration of callbacks for a variety of VCPU
related events, such as VCPU reset, idle and resume. In addition, we
recently introduced API for registering callbacks for discontinuity
events, specifically for interrupts, exceptions and host calls.

This change introduces the corresponding hooks called from target
specific code inside qemu.

Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 include/qemu/plugin.h | 12 ++++++++++++
 plugins/core.c        | 42 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+)

diff --git a/include/qemu/plugin.h b/include/qemu/plugin.h
index 8cf20cd96f..cea0a68858 100644
--- a/include/qemu/plugin.h
+++ b/include/qemu/plugin.h
@@ -161,6 +161,9 @@ void qemu_plugin_vcpu_exit_hook(CPUState *cpu);
 void qemu_plugin_tb_trans_cb(CPUState *cpu, struct qemu_plugin_tb *tb);
 void qemu_plugin_vcpu_idle_cb(CPUState *cpu);
 void qemu_plugin_vcpu_resume_cb(CPUState *cpu);
+void qemu_plugin_vcpu_interrupt_cb(CPUState *cpu, uint64_t from);
+void qemu_plugin_vcpu_exception_cb(CPUState *cpu, uint64_t from);
+void qemu_plugin_vcpu_hostcall_cb(CPUState *cpu, uint64_t from);
 void
 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1,
                          uint64_t a2, uint64_t a3, uint64_t a4, uint64_t a5,
@@ -258,6 +261,15 @@ static inline void qemu_plugin_vcpu_idle_cb(CPUState *cpu)
 static inline void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
 { }
 
+static inline void qemu_plugin_vcpu_interrupt_cb(CPUState *cpu, uint64_t from)
+{ }
+
+static inline void qemu_plugin_vcpu_exception_cb(CPUState *cpu, uint64_t from)
+{ }
+
+static inline void qemu_plugin_vcpu_hostcall_cb(CPUState *cpu, uint64_t from)
+{ }
+
 static inline void
 qemu_plugin_vcpu_syscall(CPUState *cpu, int64_t num, uint64_t a1, uint64_t a2,
                          uint64_t a3, uint64_t a4, uint64_t a5, uint64_t a6,
diff --git a/plugins/core.c b/plugins/core.c
index 40d001d39a..35a252d272 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -105,6 +105,30 @@ static void plugin_vcpu_cb__simple(CPUState *cpu, enum qemu_plugin_event ev)
     }
 }
 
+/*
+ * Disable CFI checks.
+ * The callback function has been loaded from an external library so we do not
+ * have type information
+ */
+QEMU_DISABLE_CFI
+static void plugin_vcpu_cb__discon(CPUState *cpu,
+                                   enum qemu_plugin_event ev,
+                                   enum qemu_plugin_discon_type type,
+                                   uint64_t from)
+{
+    struct qemu_plugin_cb *cb, *next;
+    uint64_t to = cpu->cc->get_pc(cpu);
+
+    if (cpu->cpu_index < plugin.num_vcpus) {
+        /* iterate safely; plugins might uninstall themselves at any time */
+        QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
+            qemu_plugin_vcpu_discon_cb_t func = cb->f.vcpu_discon;
+
+            func(cb->ctx->id, cpu->cpu_index, type, from, to);
+        }
+    }
+}
+
 /*
  * Disable CFI checks.
  * The callback function has been loaded from an external library so we do not
@@ -557,6 +581,24 @@ void qemu_plugin_vcpu_resume_cb(CPUState *cpu)
     }
 }
 
+void qemu_plugin_vcpu_interrupt_cb(CPUState *cpu, uint64_t from)
+{
+    plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_INTERRUPT,
+                           QEMU_PLUGIN_DISCON_INTERRUPT, from);
+}
+
+void qemu_plugin_vcpu_exception_cb(CPUState *cpu, uint64_t from)
+{
+    plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_EXCEPTION,
+                           QEMU_PLUGIN_DISCON_EXCEPTION, from);
+}
+
+void qemu_plugin_vcpu_hostcall_cb(CPUState *cpu, uint64_t from)
+{
+    plugin_vcpu_cb__discon(cpu, QEMU_PLUGIN_EV_VCPU_HOSTCALL,
+                           QEMU_PLUGIN_DISCON_HOSTCALL, from);
+}
+
 void qemu_plugin_register_vcpu_idle_cb(qemu_plugin_id_t id,
                                        qemu_plugin_vcpu_simple_cb_t cb)
 {

From 9fe4dd99438a6ea70f4c3b7309ca9219ebdfc1f5 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:17 +0000
Subject: [PATCH 1728/2396] contrib/plugins: add plugin showcasing new
 dicontinuity related API
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced new plugin API for registration of discontinuity
related callbacks. This change introduces a minimal plugin showcasing
the new API. It simply counts the occurances of interrupts, exceptions
and host calls per CPU and reports the counts when exitting.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-11-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/plugins/meson.build |  2 +-
 contrib/plugins/traps.c     | 83 +++++++++++++++++++++++++++++++++++++
 docs/about/emulation.rst    |  8 ++++
 3 files changed, 92 insertions(+), 1 deletion(-)
 create mode 100644 contrib/plugins/traps.c

diff --git a/contrib/plugins/meson.build b/contrib/plugins/meson.build
index 7eb3629c95..eb944b5159 100644
--- a/contrib/plugins/meson.build
+++ b/contrib/plugins/meson.build
@@ -1,6 +1,6 @@
 contrib_plugins = ['bbv', 'cache', 'cflow', 'drcov', 'execlog', 'hotblocks',
                    'hotpages', 'howvec', 'hwprofile', 'ips', 'stoptrigger',
-                   'uftrace']
+                   'traps', 'uftrace']
 if host_os != 'windows'
   # lockstep uses socket.h
   contrib_plugins += 'lockstep'
diff --git a/contrib/plugins/traps.c b/contrib/plugins/traps.c
new file mode 100644
index 0000000000..d5ddc0f3dd
--- /dev/null
+++ b/contrib/plugins/traps.c
@@ -0,0 +1,83 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2025, Julian Ganz <neither@nut.email>
+ *
+ * Traps - count traps
+ *
+ * Count the number of interrupts (asyncronous events), exceptions (synchronous
+ * events) and host calls (e.g. semihosting) per cpu and report those counts on
+ * exit.
+ */
+
+#include <stdio.h>
+
+#include <qemu-plugin.h>
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
+
+typedef struct {
+    uint64_t interrupts;
+    uint64_t exceptions;
+    uint64_t hostcalls;
+} TrapCounters;
+
+static struct qemu_plugin_scoreboard *traps;
+
+static void vcpu_discon(qemu_plugin_id_t id, unsigned int vcpu_index,
+                        enum qemu_plugin_discon_type type, uint64_t from_pc,
+                        uint64_t to_pc)
+{
+    TrapCounters *rec = qemu_plugin_scoreboard_find(traps, vcpu_index);
+    switch (type) {
+    case QEMU_PLUGIN_DISCON_INTERRUPT:
+        rec->interrupts++;
+        break;
+    case QEMU_PLUGIN_DISCON_EXCEPTION:
+        rec->exceptions++;
+        break;
+    case QEMU_PLUGIN_DISCON_HOSTCALL:
+        rec->hostcalls++;
+        break;
+    default:
+        g_assert_not_reached();
+        break;
+    }
+}
+
+static void plugin_exit(qemu_plugin_id_t id, void *p)
+{
+    g_autoptr(GString) report;
+    report = g_string_new("VCPU, interrupts, exceptions, hostcalls\n");
+    int max_vcpus = qemu_plugin_num_vcpus();
+    int vcpu;
+
+    for (vcpu = 0; vcpu < max_vcpus; vcpu++) {
+        TrapCounters *rec = qemu_plugin_scoreboard_find(traps, vcpu);
+        g_string_append_printf(report,
+                               "% 4d, % 10"PRId64", % 10"PRId64", % 10"PRId64
+                               "\n", vcpu, rec->interrupts, rec->exceptions,
+                               rec->hostcalls);
+    }
+
+    qemu_plugin_outs(report->str);
+    qemu_plugin_scoreboard_free(traps);
+}
+
+QEMU_PLUGIN_EXPORT
+int qemu_plugin_install(qemu_plugin_id_t id, const qemu_info_t *info,
+                        int argc, char **argv)
+{
+    if (!info->system_emulation) {
+        qemu_plugin_outs("Note: interrupts are only reported in system"
+                         " emulation mode.");
+    }
+
+    traps = qemu_plugin_scoreboard_new(sizeof(TrapCounters));
+
+    qemu_plugin_register_vcpu_discon_cb(id, QEMU_PLUGIN_DISCON_ALL,
+                                        vcpu_discon);
+
+    qemu_plugin_register_atexit_cb(id, plugin_exit, NULL);
+
+    return 0;
+}
diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
index 8a5e128f67..92c219119e 100644
--- a/docs/about/emulation.rst
+++ b/docs/about/emulation.rst
@@ -1015,6 +1015,14 @@ interesting to generate them around a particular point of execution::
     # generate trace around init execution (2 seconds):
     $ uftrace dump --chrome --time-range=1753122320~1753122322 > init.json
 
+Count traps
+...........
+
+``contrib/plugins/traps.c``
+
+This plugin counts the number of interrupts (asyncronous events), exceptions
+(synchronous events) and host calls (e.g. semihosting) per cpu.
+
 Other emulation features
 ------------------------
 

From 3d57ddace13912df5f1d52b5660c84cd91dd4507 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:18 +0000
Subject: [PATCH 1729/2396] target/alpha: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for Alpha targets.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-12-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/alpha/helper.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/target/alpha/helper.c b/target/alpha/helper.c
index 096eac3445..a9af52a928 100644
--- a/target/alpha/helper.c
+++ b/target/alpha/helper.c
@@ -27,6 +27,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/qemu-print.h"
 #include "system/memory.h"
+#include "qemu/plugin.h"
 
 
 #define CONVERT_BIT(X, SRC, DST) \
@@ -328,6 +329,7 @@ void alpha_cpu_do_interrupt(CPUState *cs)
 {
     CPUAlphaState *env = cpu_env(cs);
     int i = cs->exception_index;
+    uint64_t last_pc = env->pc;
 
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
         static int count;
@@ -431,6 +433,17 @@ void alpha_cpu_do_interrupt(CPUState *cs)
 
     /* Switch to PALmode.  */
     env->flags |= ENV_FLAG_PAL_MODE;
+
+    switch (i) {
+    case EXCP_SMP_INTERRUPT:
+    case EXCP_CLK_INTERRUPT:
+    case EXCP_DEV_INTERRUPT:
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+        break;
+    }
 }
 
 bool alpha_cpu_exec_interrupt(CPUState *cs, int interrupt_request)

From 105e3c75697afa4cbd8f885ef0a2347b766f5e10 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:19 +0000
Subject: [PATCH 1730/2396] target/arm: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for ARM (and Aarch64) targets. We decided to
treat the (V)IRQ, (VI/VF)NMI, (V)FIQ and VSERR exceptions as interrupts
since they are, presumably, async in nature.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-13-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/helper.c       | 24 ++++++++++++++++++++++++
 target/arm/internals.h    |  1 +
 target/arm/tcg/m_helper.c |  5 +++++
 3 files changed, 30 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 2ef9c17814..ef6435c3ef 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -34,6 +34,7 @@
 #endif
 #include "cpregs.h"
 #include "target/arm/gtimer.h"
+#include "qemu/plugin.h"
 
 #define HELPER_H "tcg/helper.h"
 #include "exec/helper-proto.h.inc"
@@ -8783,6 +8784,24 @@ static void take_aarch32_exception(CPUARMState *env, int new_mode,
     }
 }
 
+void arm_do_plugin_vcpu_discon_cb(CPUState *cs, uint64_t from)
+{
+    switch (cs->exception_index) {
+    case EXCP_IRQ:
+    case EXCP_VIRQ:
+    case EXCP_NMI:
+    case EXCP_VINMI:
+    case EXCP_FIQ:
+    case EXCP_VFIQ:
+    case EXCP_VFNMI:
+    case EXCP_VSERR:
+        qemu_plugin_vcpu_interrupt_cb(cs, from);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, from);
+    }
+}
+
 static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
 {
     /*
@@ -9473,6 +9492,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
     unsigned int new_el = env->exception.target_el;
+    uint64_t last_pc = cs->cc->get_pc(cs);
 
     assert(!arm_feature(env, ARM_FEATURE_M));
 
@@ -9489,6 +9509,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
     if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) {
         arm_handle_psci_call(cpu);
         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
+        qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
         return;
     }
 
@@ -9500,6 +9521,7 @@ void arm_cpu_do_interrupt(CPUState *cs)
 #ifdef CONFIG_TCG
     if (cs->exception_index == EXCP_SEMIHOST) {
         tcg_handle_semihosting(cs);
+        qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
         return;
     }
 #endif
@@ -9525,6 +9547,8 @@ void arm_cpu_do_interrupt(CPUState *cs)
     if (!kvm_enabled()) {
         cpu_set_interrupt(cs, CPU_INTERRUPT_EXITTB);
     }
+
+    arm_do_plugin_vcpu_discon_cb(cs, last_pc);
 }
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index f86f421a3d..6fbf7e1ca4 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -375,6 +375,7 @@ static inline int r14_bank_number(int mode)
 
 void arm_cpu_register(const ARMCPUInfo *info);
 
+void arm_do_plugin_vcpu_discon_cb(CPUState *cs, uint64_t from);
 void register_cp_regs_for_features(ARMCPU *cpu);
 void init_cpreg_list(ARMCPU *cpu);
 
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index d856e3bc8e..3fb24c7790 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -23,6 +23,7 @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/intc/armv7m_nvic.h"
 #endif
+#include "qemu/plugin.h"
 
 static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
                          uint32_t reg, uint32_t val)
@@ -2194,6 +2195,7 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
     CPUARMState *env = &cpu->env;
     uint32_t lr;
     bool ignore_stackfaults;
+    uint64_t last_pc = env->regs[15];
 
     arm_log_exception(cs);
 
@@ -2361,6 +2363,7 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         g_assert_not_reached();
 #endif
         env->regs[15] += env->thumb ? 2 : 4;
+        qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
         return;
     case EXCP_BKPT:
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
@@ -2427,6 +2430,8 @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
 
     ignore_stackfaults = v7m_push_stack(cpu);
     v7m_exception_taken(cpu, lr, false, ignore_stackfaults);
+
+    arm_do_plugin_vcpu_discon_cb(cs, last_pc);
 }
 
 uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)

From 14e1f3186ccbbe2f3e2fd3038213bd6f65cd0de6 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:20 +0000
Subject: [PATCH 1731/2396] target/avr: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places the hook for AVR targets. That architecture appears
to only know interrupts.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-14-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/avr/helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/avr/helper.c b/target/avr/helper.c
index 4b29ab3526..365c8c60e1 100644
--- a/target/avr/helper.c
+++ b/target/avr/helper.c
@@ -28,6 +28,7 @@
 #include "exec/target_page.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/helper-proto.h"
+#include "qemu/plugin.h"
 
 bool avr_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 {
@@ -102,6 +103,8 @@ void avr_cpu_do_interrupt(CPUState *cs)
     env->sregI = 0; /* clear Global Interrupt Flag */
 
     cs->exception_index = -1;
+
+    qemu_plugin_vcpu_interrupt_cb(cs, ret);
 }
 
 hwaddr avr_cpu_get_phys_page_debug(CPUState *cs, vaddr addr)

From ed7b86888efcedebf50cf9055e1edd2e7ea019cb Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:21 +0000
Subject: [PATCH 1732/2396] target/hppa: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We identified a number of exceptions as interrupts, and we assume every
other exception is a (syncroneous) exceptions. PA-RISC appears to not
have any form of host-call.

This change places the hook for PA-RISC targets.

Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-15-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/hppa/int_helper.c | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/target/hppa/int_helper.c b/target/hppa/int_helper.c
index 191ae19404..4e4869285b 100644
--- a/target/hppa/int_helper.c
+++ b/target/hppa/int_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "hw/core/cpu.h"
 #include "hw/hppa/hppa_hardware.h"
+#include "qemu/plugin.h"
 
 static void eval_interrupt(HPPACPU *cpu)
 {
@@ -95,6 +96,7 @@ void hppa_cpu_do_interrupt(CPUState *cs)
     CPUHPPAState *env = &cpu->env;
     int i = cs->exception_index;
     uint64_t old_psw, old_gva_offset_mask;
+    uint64_t last_pc = cs->cc->get_pc(cs);
 
     /* As documented in pa2.0 -- interruption handling.  */
     /* step 1 */
@@ -212,6 +214,21 @@ void hppa_cpu_do_interrupt(CPUState *cs)
     env->iasq_f = 0;
     env->iasq_b = 0;
 
+    switch (i) {
+    case EXCP_HPMC:
+    case EXCP_POWER_FAIL:
+    case EXCP_RC:
+    case EXCP_EXT_INTERRUPT:
+    case EXCP_LPMC:
+    case EXCP_PER_INTERRUPT:
+    case EXCP_TOC:
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+        break;
+    }
+
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
         static const char * const names[] = {
             [EXCP_HPMC]          = "high priority machine check",

From b5c8cd61447b7dd8e454b0b6055b05d92f09a06e Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:22 +0000
Subject: [PATCH 1733/2396] target/i386: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places the hook for x86 targets.

Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-16-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/i386/tcg/excp_helper.c | 3 +++
 target/i386/tcg/seg_helper.c  | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/target/i386/tcg/excp_helper.c b/target/i386/tcg/excp_helper.c
index 6fb8036d98..32f2784e92 100644
--- a/target/i386/tcg/excp_helper.c
+++ b/target/i386/tcg/excp_helper.c
@@ -23,6 +23,7 @@
 #include "system/runstate.h"
 #include "exec/helper-proto.h"
 #include "helper-tcg.h"
+#include "qemu/plugin.h"
 
 G_NORETURN void helper_raise_interrupt(CPUX86State *env, int intno,
                                           int next_eip_addend)
@@ -93,6 +94,7 @@ void raise_interrupt2(CPUX86State *env, int intno,
                       uintptr_t retaddr)
 {
     CPUState *cs = env_cpu(env);
+    uint64_t last_pc = env->eip + env->segs[R_CS].base;
 
     if (!is_int) {
         cpu_svm_check_intercept_param(env, SVM_EXIT_EXCP_BASE + intno,
@@ -106,6 +108,7 @@ void raise_interrupt2(CPUX86State *env, int intno,
     env->error_code = error_code;
     env->exception_is_int = is_int;
     env->exception_next_eip = env->eip + next_eip_addend;
+    qemu_plugin_vcpu_exception_cb(cs, last_pc);
     cpu_loop_exit_restore(cs, retaddr);
 }
 
diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index f49fe851cd..667b1c3869 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -29,6 +29,7 @@
 #include "seg_helper.h"
 #include "access.h"
 #include "tcg-cpu.h"
+#include "qemu/plugin.h"
 
 #ifdef TARGET_X86_64
 #define SET_ESP(val, sp_mask)                                   \
@@ -1192,6 +1193,7 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
                       int error_code, target_ulong next_eip, int is_hw)
 {
     CPUX86State *env = &cpu->env;
+    uint64_t last_pc = env->eip + env->segs[R_CS].base;
 
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
         if ((env->cr[0] & CR0_PE_MASK)) {
@@ -1263,6 +1265,8 @@ void do_interrupt_all(X86CPU *cpu, int intno, int is_int,
                  event_inj & ~SVM_EVTINJ_VALID);
     }
 #endif
+
+    qemu_plugin_vcpu_interrupt_cb(CPU(cpu), last_pc);
 }
 
 void do_interrupt_x86_hardirq(CPUX86State *env, int intno, int is_hw)

From ee0a63d0dac825e9a5133b073ec3a843d8b7e206 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:23 +0000
Subject: [PATCH 1734/2396] target/loongarch: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for loongarch targets. This architecture
has one special "exception" for interrupts and no host calls.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Song Gao <gaosong@loongson.cn>
Message-ID: <20251027110344.2289945-17-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/loongarch/tcg/tcg_cpu.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index 82b54e6dc3..9d077c56d9 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -8,6 +8,7 @@
 #include "qemu/accel.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
+#include "qemu/plugin.h"
 #include "accel/accel-cpu-target.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "accel/tcg/cpu-ops.h"
@@ -80,6 +81,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
     int cause = -1;
     bool tlbfill = FIELD_EX64(env->CSR_TLBRERA, CSR_TLBRERA, ISTLBR);
     uint32_t vec_size = FIELD_EX64(env->CSR_ECFG, CSR_ECFG, VS);
+    uint64_t last_pc = env->pc;
 
     if (cs->exception_index != EXCCODE_INT) {
         qemu_log_mask(CPU_LOG_INT,
@@ -190,6 +192,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
                       __func__, env->pc, env->CSR_ERA,
                       cause, env->CSR_BADV, env->CSR_DERA, vector,
                       env->CSR_ECFG, env->CSR_ESTAT);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
     } else {
         if (tlbfill) {
             set_pc(env, env->CSR_TLBRENTRY);
@@ -208,6 +211,7 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
                       tlbfill ? env->CSR_TLBRBADV : env->CSR_BADV,
                       env->CSR_BADI, env->gpr[11], cs->cpu_index,
                       env->CSR_ASID);
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
     }
     cs->exception_index = -1;
 }

From b2d8618c216f9da8a468d20e2eb161ba72e6ecef Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:24 +0000
Subject: [PATCH 1735/2396] target/m68k: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for Motorola 68000 targets.

Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-18-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/m68k/op_helper.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index f29ae12af8..e9c20a8e03 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -22,6 +22,7 @@
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "semihosting/semihost.h"
+#include "qemu/plugin.h"
 
 #if !defined(CONFIG_USER_ONLY)
 
@@ -183,6 +184,21 @@ static const char *m68k_exception_name(int index)
     return "Unassigned";
 }
 
+static void do_plugin_vcpu_interrupt_cb(CPUState *cs, uint64_t from)
+{
+    switch (cs->exception_index) {
+    case EXCP_SPURIOUS ... EXCP_INT_LEVEL_7:
+        qemu_plugin_vcpu_interrupt_cb(cs, from);
+        break;
+    case EXCP_SEMIHOSTING:
+        qemu_plugin_vcpu_hostcall_cb(cs, from);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, from);
+        break;
+    }
+}
+
 static void cf_interrupt_all(CPUM68KState *env, int is_hw)
 {
     CPUState *cs = env_cpu(env);
@@ -203,6 +219,7 @@ static void cf_interrupt_all(CPUM68KState *env, int is_hw)
             return;
         case EXCP_SEMIHOSTING:
             do_m68k_semihosting(env, env->dregs[0]);
+            qemu_plugin_vcpu_hostcall_cb(cs, retaddr);
             return;
         }
     }
@@ -239,6 +256,8 @@ static void cf_interrupt_all(CPUM68KState *env, int is_hw)
     env->aregs[7] = sp;
     /* Jump to vector.  */
     env->pc = cpu_ldl_mmuidx_ra(env, env->vbr + vector, MMU_KERNEL_IDX, 0);
+
+    do_plugin_vcpu_interrupt_cb(cs, retaddr);
 }
 
 static inline void do_stack_frame(CPUM68KState *env, uint32_t *sp,
@@ -277,6 +296,7 @@ static void m68k_interrupt_all(CPUM68KState *env, int is_hw)
     uint32_t sp;
     uint32_t vector;
     uint16_t sr, oldsr;
+    uint64_t last_pc = env->pc;
 
     if (!is_hw) {
         switch (cs->exception_index) {
@@ -417,6 +437,8 @@ static void m68k_interrupt_all(CPUM68KState *env, int is_hw)
     env->aregs[7] = sp;
     /* Jump to vector.  */
     env->pc = cpu_ldl_mmuidx_ra(env, env->vbr + vector, MMU_KERNEL_IDX, 0);
+
+    do_plugin_vcpu_interrupt_cb(cs, last_pc);
 }
 
 static void do_interrupt_all(CPUM68KState *env, int is_hw)

From cd6ee56222610f3228caf10c4868bd8593532b0c Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:25 +0000
Subject: [PATCH 1736/2396] target/microblaze: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places the hook for MicroBlaze targets. This architecture
has one special "exception" for interrupts and no host calls.

Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-19-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/microblaze/helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/microblaze/helper.c b/target/microblaze/helper.c
index cf577a7226..a1857b7217 100644
--- a/target/microblaze/helper.c
+++ b/target/microblaze/helper.c
@@ -27,6 +27,7 @@
 #include "qemu/host-utils.h"
 #include "exec/log.h"
 #include "exec/helper-proto.h"
+#include "qemu/plugin.h"
 
 
 G_NORETURN
@@ -35,6 +36,7 @@ static void mb_unaligned_access_internal(CPUState *cs, uint64_t addr,
 {
     CPUMBState *env = cpu_env(cs);
     uint32_t esr, iflags;
+    uint64_t last_pc = env->pc;
 
     /* Recover the pc and iflags from the corresponding insn_start.  */
     cpu_restore_state(cs, retaddr);
@@ -54,6 +56,7 @@ static void mb_unaligned_access_internal(CPUState *cs, uint64_t addr,
     env->ear = addr;
     env->esr = esr;
     cs->exception_index = EXCP_HW_EXCP;
+    qemu_plugin_vcpu_exception_cb(cs, last_pc);
     cpu_loop_exit(cs);
 }
 
@@ -152,6 +155,7 @@ void mb_cpu_do_interrupt(CPUState *cs)
     CPUMBState *env = &cpu->env;
     uint32_t t, msr = mb_cpu_read_msr(env);
     bool set_esr;
+    uint64_t last_pc = env->pc;
 
     /* IMM flag cannot propagate across a branch and into the dslot.  */
     assert((env->iflags & (D_FLAG | IMM_FLAG)) != (D_FLAG | IMM_FLAG));
@@ -256,6 +260,12 @@ void mb_cpu_do_interrupt(CPUState *cs)
     env->res_addr = RES_ADDR_NONE;
     env->iflags = 0;
 
+    if (cs->exception_index == EXCP_IRQ) {
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+    } else {
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+    }
+
     if (!set_esr) {
         qemu_log_mask(CPU_LOG_INT,
                       "         to pc=%08x msr=%08x\n", env->pc, msr);

From c3d7005a6cbd5f7fe0ba01b92954964c90b76d15 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:26 +0000
Subject: [PATCH 1737/2396] target/mips: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for MIPS targets. We consider the exceptions
NMI and EXT_INTERRUPT to be asynchronous interrupts rather than
exceptions.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-20-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/mips/tcg/system/tlb_helper.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/target/mips/tcg/system/tlb_helper.c b/target/mips/tcg/system/tlb_helper.c
index 1e8901556d..566924b079 100644
--- a/target/mips/tcg/system/tlb_helper.c
+++ b/target/mips/tcg/system/tlb_helper.c
@@ -18,6 +18,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/bitops.h"
+#include "qemu/plugin.h"
 
 #include "cpu.h"
 #include "internal.h"
@@ -1034,6 +1035,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
     bool update_badinstr = 0;
     target_ulong offset;
     int cause = -1;
+    uint64_t last_pc = env->active_tc.PC;
 
     if (qemu_loglevel_mask(CPU_LOG_INT)
         && cs->exception_index != EXCP_EXT_INTERRUPT) {
@@ -1052,6 +1054,7 @@ void mips_cpu_do_interrupt(CPUState *cs)
         cs->exception_index = EXCP_NONE;
         mips_semihosting(env);
         env->active_tc.PC += env->error_code;
+        qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
         return;
     case EXCP_DSS:
         env->CP0_Debug |= 1 << CP0DB_DSS;
@@ -1336,6 +1339,14 @@ void mips_cpu_do_interrupt(CPUState *cs)
                  env->CP0_Status, env->CP0_Cause, env->CP0_BadVAddr,
                  env->CP0_DEPC);
     }
+    switch (cs->exception_index) {
+    case EXCP_NMI:
+    case EXCP_EXT_INTERRUPT:
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+    }
     cs->exception_index = EXCP_NONE;
 }
 

From cbf0e6e3dc8ece2f3eb05c1840d95440eab4ae8c Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:27 +0000
Subject: [PATCH 1738/2396] target/openrisc: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for OpenRISC targets. We treat anything other
than resets, timer and device interrupts as exceptions.

Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-21-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/openrisc/interrupt.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/target/openrisc/interrupt.c b/target/openrisc/interrupt.c
index 486823094c..d357aaa7da 100644
--- a/target/openrisc/interrupt.c
+++ b/target/openrisc/interrupt.c
@@ -25,11 +25,13 @@
 #ifndef CONFIG_USER_ONLY
 #include "hw/loader.h"
 #endif
+#include "qemu/plugin.h"
 
 void openrisc_cpu_do_interrupt(CPUState *cs)
 {
     CPUOpenRISCState *env = cpu_env(cs);
     int exception = cs->exception_index;
+    uint64_t last_pc = env->pc;
 
     env->epcr = env->pc;
 
@@ -98,6 +100,19 @@ void openrisc_cpu_do_interrupt(CPUState *cs)
         cpu_abort(cs, "Unhandled exception 0x%x\n", exception);
     }
 
+    switch (exception) {
+    case EXCP_RESET:
+        /* Resets are already exposed to plugins through a dedicated callback */
+        break;
+    case EXCP_TICK:
+    case EXCP_INT:
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+        break;
+    }
+
     cs->exception_index = -1;
 }
 

From 11af01e8b760ba27f0246e1d990162ed6c6ea113 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:28 +0000
Subject: [PATCH 1739/2396] target/ppc: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for Power PC targets.

Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-22-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/ppc/excp_helper.c | 41 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/target/ppc/excp_helper.c b/target/ppc/excp_helper.c
index d8bca19fff..6d05b86505 100644
--- a/target/ppc/excp_helper.c
+++ b/target/ppc/excp_helper.c
@@ -27,6 +27,7 @@
 #include "internal.h"
 #include "helper_regs.h"
 #include "hw/ppc/ppc.h"
+#include "qemu/plugin.h"
 
 #include "trace.h"
 
@@ -404,11 +405,31 @@ static void powerpc_mcheck_checkstop(CPUPPCState *env)
     powerpc_checkstop(env, "machine check with MSR[ME]=0");
 }
 
+static void powerpc_do_plugin_vcpu_interrupt_cb(CPUState *cs, int excp,
+                                                uint64_t from)
+{
+    switch (excp) {
+    case POWERPC_EXCP_NONE:
+        break;
+    case POWERPC_EXCP_FIT:
+    case POWERPC_EXCP_WDT:
+    case POWERPC_EXCP_PIT:
+    case POWERPC_EXCP_SMI:
+    case POWERPC_EXCP_PERFM:
+    case POWERPC_EXCP_THERM:
+        qemu_plugin_vcpu_interrupt_cb(cs, from);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, from);
+    }
+}
+
 static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
     int srr0 = SPR_SRR0, srr1 = SPR_SRR1;
+    uint64_t last_pc = env->nip;
 
     /* new srr1 value excluding must-be-zero bits */
     msr = env->msr & ~0x783f0000ULL;
@@ -456,6 +477,7 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             env->spr[SPR_40x_ESR] = ESR_FP;
@@ -510,12 +532,14 @@ static void powerpc_excp_40x(PowerPCCPU *cpu, int excp)
     env->spr[srr0] = env->nip;
     env->spr[srr1] = msr;
     powerpc_set_excp_state(cpu, vector, new_msr);
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 
 static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
+    uint64_t last_pc = env->nip;
 
     /* new srr1 value excluding must-be-zero bits */
     msr = env->msr & ~0x783f0000ULL;
@@ -567,6 +591,7 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             /*
@@ -653,12 +678,14 @@ static void powerpc_excp_6xx(PowerPCCPU *cpu, int excp)
     env->spr[SPR_SRR0] = env->nip;
     env->spr[SPR_SRR1] = msr;
     powerpc_set_excp_state(cpu, vector, new_msr);
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 
 static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
+    uint64_t last_pc = env->nip;
 
     /* new srr1 value excluding must-be-zero bits */
     msr = env->msr & ~0x783f0000ULL;
@@ -708,6 +735,7 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             /*
@@ -758,6 +786,7 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
         if (lev == 1 && cpu->vhyp) {
             cpu->vhyp_class->hypercall(cpu->vhyp, cpu);
             powerpc_reset_excp_state(cpu);
+            qemu_plugin_vcpu_hostcall_cb(env_cpu(env), last_pc);
             return;
         }
 
@@ -803,12 +832,14 @@ static void powerpc_excp_7xx(PowerPCCPU *cpu, int excp)
     env->spr[SPR_SRR0] = env->nip;
     env->spr[SPR_SRR1] = msr;
     powerpc_set_excp_state(cpu, vector, new_msr);
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 
 static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
 {
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
+    uint64_t last_pc = env->nip;
 
     /* new srr1 value excluding must-be-zero bits */
     msr = env->msr & ~0x783f0000ULL;
@@ -858,6 +889,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             /*
@@ -908,6 +940,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
         if (lev == 1 && cpu->vhyp) {
             cpu->vhyp_class->hypercall(cpu->vhyp, cpu);
             powerpc_reset_excp_state(cpu);
+            qemu_plugin_vcpu_hostcall_cb(env_cpu(env), last_pc);
             return;
         }
 
@@ -947,6 +980,7 @@ static void powerpc_excp_74xx(PowerPCCPU *cpu, int excp)
     env->spr[SPR_SRR0] = env->nip;
     env->spr[SPR_SRR1] = msr;
     powerpc_set_excp_state(cpu, vector, new_msr);
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 
 static void powerpc_excp_ppe42(PowerPCCPU *cpu, int excp)
@@ -1073,6 +1107,7 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
     int srr0 = SPR_SRR0, srr1 = SPR_SRR1;
+    uint64_t last_pc = env->nip;
 
     /*
      * Book E does not play games with certain bits of xSRR1 being MSR save
@@ -1144,6 +1179,7 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             /*
@@ -1252,6 +1288,7 @@ static void powerpc_excp_booke(PowerPCCPU *cpu, int excp)
     env->spr[srr0] = env->nip;
     env->spr[srr1] = msr;
     powerpc_set_excp_state(cpu, vector, new_msr);
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 
 /*
@@ -1373,6 +1410,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
     CPUPPCState *env = &cpu->env;
     target_ulong msr, new_msr, vector;
     int srr0 = SPR_SRR0, srr1 = SPR_SRR1, lev = -1;
+    uint64_t last_pc = env->nip;
 
     /* new srr1 value excluding must-be-zero bits */
     msr = env->msr & ~0x783f0000ULL;
@@ -1472,6 +1510,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
             if (!FIELD_EX64_FE(env->msr) || !FIELD_EX64(env->msr, MSR, FP)) {
                 trace_ppc_excp_fp_ignore();
                 powerpc_reset_excp_state(cpu);
+                qemu_plugin_vcpu_exception_cb(env_cpu(env), last_pc);
                 return;
             }
             /*
@@ -1516,6 +1555,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
         if (lev == 1 && books_vhyp_handles_hcall(cpu)) {
             cpu->vhyp_class->hypercall(cpu->vhyp, cpu);
             powerpc_reset_excp_state(cpu);
+            qemu_plugin_vcpu_hostcall_cb(env_cpu(env), last_pc);
             return;
         }
         if (env->insns_flags2 & PPC2_ISA310) {
@@ -1662,6 +1702,7 @@ static void powerpc_excp_books(PowerPCCPU *cpu, int excp)
         ppc_excp_apply_ail(cpu, excp, msr, &new_msr, &vector);
         powerpc_set_excp_state(cpu, vector, new_msr);
     }
+    powerpc_do_plugin_vcpu_interrupt_cb(env_cpu(env), excp, last_pc);
 }
 #else
 static inline void powerpc_excp_books(PowerPCCPU *cpu, int excp)

From 081aaba705feea37986e02873e17348627e79770 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:29 +0000
Subject: [PATCH 1740/2396] target/riscv: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for RISC-V targets.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-23-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/riscv/cpu_helper.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/riscv/cpu_helper.c b/target/riscv/cpu_helper.c
index 360db133e2..c4fb68b5de 100644
--- a/target/riscv/cpu_helper.c
+++ b/target/riscv/cpu_helper.c
@@ -36,6 +36,7 @@
 #include "cpu_bits.h"
 #include "debug.h"
 #include "pmp.h"
+#include "qemu/plugin.h"
 
 int riscv_env_mmu_index(CPURISCVState *env, bool ifetch)
 {
@@ -2175,6 +2176,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
     uint64_t hdeleg = async ? env->hideleg : env->hedeleg;
     const bool prev_virt = env->virt_enabled;
     const target_ulong prev_priv = env->priv;
+    uint64_t last_pc = env->pc;
     target_ulong tval = 0;
     target_ulong tinst = 0;
     target_ulong htval = 0;
@@ -2197,6 +2199,7 @@ void riscv_cpu_do_interrupt(CPUState *cs)
         case RISCV_EXCP_SEMIHOST:
             do_common_semihosting(cs);
             env->pc += 4;
+            qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
             return;
 #endif
         case RISCV_EXCP_LOAD_GUEST_ACCESS_FAULT:
@@ -2466,6 +2469,12 @@ void riscv_cpu_do_interrupt(CPUState *cs)
                         prev_priv, prev_virt);
     }
 
+    if (async) {
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+    } else {
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
+    }
+
     /*
      * Interrupt/exception/trap delivery is asynchronous event and as per
      * zicfilp spec CPU should clear up the ELP state. No harm in clearing

From dde21df2393a64df083cd8a524994a1ed9fd45dd Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:30 +0000
Subject: [PATCH 1741/2396] target/rx: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for Renesas Xtreme targets.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com>
Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-24-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/rx/helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/rx/helper.c b/target/rx/helper.c
index 41c9606fd1..ef47e32add 100644
--- a/target/rx/helper.c
+++ b/target/rx/helper.c
@@ -22,6 +22,7 @@
 #include "exec/log.h"
 #include "accel/tcg/cpu-ldst.h"
 #include "hw/irq.h"
+#include "qemu/plugin.h"
 
 void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte)
 {
@@ -46,6 +47,7 @@ void rx_cpu_do_interrupt(CPUState *cs)
     CPURXState *env = cpu_env(cs);
     int do_irq = cpu_test_interrupt(cs, INT_FLAGS);
     uint32_t save_psw;
+    uint64_t last_pc = env->pc;
 
     env->in_sleep = 0;
 
@@ -65,6 +67,7 @@ void rx_cpu_do_interrupt(CPUState *cs)
             env->psw_ipl = 15;
             cpu_reset_interrupt(cs, CPU_INTERRUPT_FIR);
             qemu_set_irq(env->ack, env->ack_irq);
+            qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
             qemu_log_mask(CPU_LOG_INT, "fast interrupt raised\n");
         } else if (do_irq & CPU_INTERRUPT_HARD) {
             env->isp -= 4;
@@ -75,6 +78,7 @@ void rx_cpu_do_interrupt(CPUState *cs)
             env->psw_ipl = env->ack_ipl;
             cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
             qemu_set_irq(env->ack, env->ack_irq);
+            qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
             qemu_log_mask(CPU_LOG_INT,
                           "interrupt 0x%02x raised\n", env->ack_irq);
         }
@@ -92,6 +96,14 @@ void rx_cpu_do_interrupt(CPUState *cs)
         } else {
             env->pc = cpu_ldl_data(env, env->intb + (vec & 0xff) * 4);
         }
+
+        if (vec == 30) {
+            /* Non-maskable interrupt */
+            qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        } else {
+            qemu_plugin_vcpu_exception_cb(cs, last_pc);
+        }
+
         switch (vec) {
         case 20:
             expname = "privilege violation";

From 42261299144ec57053431033afaa1ef8b376b79e Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:31 +0000
Subject: [PATCH 1742/2396] target/s390x: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for IBM System/390 targets. We treat "program
interrupts" and service calls as exceptions. We treat external and io
"exceptions" as well as resets as interrupts.

Acked-by: David Hildenbrand <david@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-25-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/s390x/tcg/excp_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/s390x/tcg/excp_helper.c b/target/s390x/tcg/excp_helper.c
index 0ae4e26606..c6641280bc 100644
--- a/target/s390x/tcg/excp_helper.c
+++ b/target/s390x/tcg/excp_helper.c
@@ -35,6 +35,7 @@
 #include "hw/s390x/s390_flic.h"
 #include "hw/boards.h"
 #endif
+#include "qemu/plugin.h"
 
 G_NORETURN void tcg_s390_program_interrupt(CPUS390XState *env,
                                            uint32_t code, uintptr_t ra)
@@ -502,6 +503,7 @@ void s390_cpu_do_interrupt(CPUState *cs)
     S390CPU *cpu = S390_CPU(cs);
     CPUS390XState *env = &cpu->env;
     bool stopped = false;
+    uint64_t last_pc = cpu->env.psw.addr;
 
     qemu_log_mask(CPU_LOG_INT, "%s: %d at psw=%" PRIx64 ":%" PRIx64 "\n",
                   __func__, cs->exception_index, env->psw.mask, env->psw.addr);
@@ -531,21 +533,27 @@ try_deliver:
     switch (cs->exception_index) {
     case EXCP_PGM:
         do_program_interrupt(env);
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
         break;
     case EXCP_SVC:
         do_svc_interrupt(env);
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
         break;
     case EXCP_EXT:
         do_ext_interrupt(env);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
         break;
     case EXCP_IO:
         do_io_interrupt(env);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
         break;
     case EXCP_MCHK:
         do_mchk_interrupt(env);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
         break;
     case EXCP_RESTART:
         do_restart_interrupt(env);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
         break;
     case EXCP_STOP:
         do_stop_interrupt(env);

From 01f0738c57063d7efdb682d543e85690db295053 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:32 +0000
Subject: [PATCH 1743/2396] target/sh4: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for SuperH targets.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Yoshinori Sato <yoshinori.sato@nifty.com>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-26-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/sh4/helper.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/sh4/helper.c b/target/sh4/helper.c
index 3b18a320b8..5d6295618f 100644
--- a/target/sh4/helper.c
+++ b/target/sh4/helper.c
@@ -24,6 +24,7 @@
 #include "exec/page-protection.h"
 #include "exec/target_page.h"
 #include "exec/log.h"
+#include "qemu/plugin.h"
 
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/sh4/sh_intc.h"
@@ -60,6 +61,7 @@ void superh_cpu_do_interrupt(CPUState *cs)
     CPUSH4State *env = cpu_env(cs);
     int do_irq = cpu_test_interrupt(cs, CPU_INTERRUPT_HARD);
     int do_exp, irq_vector = cs->exception_index;
+    uint64_t last_pc = env->pc;
 
     /* prioritize exceptions over interrupts */
 
@@ -176,12 +178,14 @@ void superh_cpu_do_interrupt(CPUState *cs)
             env->pc = env->vbr + 0x100;
             break;
         }
+        qemu_plugin_vcpu_exception_cb(cs, last_pc);
         return;
     }
 
     if (do_irq) {
         env->intevt = irq_vector;
         env->pc = env->vbr + 0x600;
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
         return;
     }
 }

From 8a315a788a4bb4c09390dbadf934289b2cfcecb5 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:33 +0000
Subject: [PATCH 1744/2396] target/sparc: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for SPARC (32bit and 64bit) targets. We treat
any interrupt other than EXTINT and IVEC as exceptions as they appear to
be synchroneous events.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-27-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/sparc/int32_helper.c |  7 +++++++
 target/sparc/int64_helper.c | 10 ++++++++++
 2 files changed, 17 insertions(+)

diff --git a/target/sparc/int32_helper.c b/target/sparc/int32_helper.c
index fdcaa0a578..b29f693a6b 100644
--- a/target/sparc/int32_helper.c
+++ b/target/sparc/int32_helper.c
@@ -24,6 +24,7 @@
 #include "accel/tcg/cpu-ldst.h"
 #include "exec/log.h"
 #include "system/runstate.h"
+#include "qemu/plugin.h"
 
 static const char * const excp_names[0x80] = {
     [TT_TFAULT] = "Instruction Access Fault",
@@ -174,4 +175,10 @@ void sparc_cpu_do_interrupt(CPUState *cs)
         env->qemu_irq_ack(env, intno);
     }
 #endif
+
+    if (intno == TT_EXTINT) {
+        qemu_plugin_vcpu_interrupt_cb(cs, env->regwptr[9]);
+    } else {
+        qemu_plugin_vcpu_exception_cb(cs, env->regwptr[9]);
+    }
 }
diff --git a/target/sparc/int64_helper.c b/target/sparc/int64_helper.c
index 96ef81c26c..60ab0478fc 100644
--- a/target/sparc/int64_helper.c
+++ b/target/sparc/int64_helper.c
@@ -24,6 +24,7 @@
 #include "exec/helper-proto.h"
 #include "exec/log.h"
 #include "trace.h"
+#include "qemu/plugin.h"
 
 #define DEBUG_PCALL
 
@@ -256,6 +257,15 @@ void sparc_cpu_do_interrupt(CPUState *cs)
     }
     env->npc = env->pc + 4;
     cs->exception_index = -1;
+
+    switch (intno) {
+    case TT_EXTINT:
+    case TT_IVEC:
+        qemu_plugin_vcpu_interrupt_cb(cs, tsptr->tpc);
+        break;
+    default:
+        qemu_plugin_vcpu_exception_cb(cs, tsptr->tpc);
+    }
 }
 
 trap_state *cpu_tsptr(CPUSPARCState* env)

From c4057ef38f8c7037b36d5931ae2144b7d523cd0c Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:34 +0000
Subject: [PATCH 1745/2396] target/tricore: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places an exception hook for TriCore targets. Interrupts are
not implemented for this target and it has no host calls.

Reviewed-by: Bastian Koppelmann <kbastian@mail.uni-paderborn.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-28-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/tricore/op_helper.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/tricore/op_helper.c b/target/tricore/op_helper.c
index 610f148a23..2c8281a67e 100644
--- a/target/tricore/op_helper.c
+++ b/target/tricore/op_helper.c
@@ -19,6 +19,7 @@
 #include "qemu/host-utils.h"
 #include "exec/helper-proto.h"
 #include "accel/tcg/cpu-ldst.h"
+#include "qemu/plugin.h"
 #include <zlib.h> /* for crc32 */
 
 
@@ -29,8 +30,11 @@ void raise_exception_sync_internal(CPUTriCoreState *env, uint32_t class, int tin
                                    uintptr_t pc, uint32_t fcd_pc)
 {
     CPUState *cs = env_cpu(env);
+    uint64_t last_pc;
+
     /* in case we come from a helper-call we need to restore the PC */
     cpu_restore_state(cs, pc);
+    last_pc = env->PC;
 
     /* Tin is loaded into d[15] */
     env->gpr_d[15] = tin;
@@ -90,6 +94,7 @@ void raise_exception_sync_internal(CPUTriCoreState *env, uint32_t class, int tin
     /* Update PC using the trap vector table */
     env->PC = env->BTV | (class << 5);
 
+    qemu_plugin_vcpu_exception_cb(cs, last_pc);
     cpu_loop_exit(cs);
 }
 

From 6a0f4c11dd0e1a54f25842e94b465d35071c7c84 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:35 +0000
Subject: [PATCH 1746/2396] target/xtensa: call plugin trap callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced API for registering callbacks for trap related
events as well as the corresponding hook functions. Due to differences
between architectures, the latter need to be called from target specific
code.

This change places hooks for xtensa targets.

Reviewed-by: Max Filippov <jcmvbkbc@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-29-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/xtensa/exc_helper.c  | 6 ++++++
 target/xtensa/xtensa-semi.c | 3 +++
 2 files changed, 9 insertions(+)

diff --git a/target/xtensa/exc_helper.c b/target/xtensa/exc_helper.c
index b611c9bf97..fdc522698d 100644
--- a/target/xtensa/exc_helper.c
+++ b/target/xtensa/exc_helper.c
@@ -32,6 +32,7 @@
 #include "exec/helper-proto.h"
 #include "qemu/host-utils.h"
 #include "qemu/atomic.h"
+#include "qemu/plugin.h"
 
 void HELPER(exception)(CPUXtensaState *env, uint32_t excp)
 {
@@ -207,6 +208,8 @@ void xtensa_cpu_do_interrupt(CPUState *cs)
     CPUXtensaState *env = cpu_env(cs);
 
     if (cs->exception_index == EXC_IRQ) {
+        uint64_t last_pc = env->pc;
+
         qemu_log_mask(CPU_LOG_INT,
                       "%s(EXC_IRQ) level = %d, cintlevel = %d, "
                       "pc = %08x, a0 = %08x, ps = %08x, "
@@ -218,6 +221,7 @@ void xtensa_cpu_do_interrupt(CPUState *cs)
                       env->sregs[INTSET], env->sregs[INTENABLE],
                       env->sregs[CCOUNT]);
         handle_interrupt(env);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
     }
 
     switch (cs->exception_index) {
@@ -238,9 +242,11 @@ void xtensa_cpu_do_interrupt(CPUState *cs)
                       env->sregs[CCOUNT]);
         if (env->config->exception_vector[cs->exception_index]) {
             uint32_t vector;
+            uint64_t last_pc = env->pc;
 
             vector = env->config->exception_vector[cs->exception_index];
             env->pc = relocated_vector(env, vector);
+            qemu_plugin_vcpu_exception_cb(cs, last_pc);
         } else {
             qemu_log_mask(CPU_LOG_INT,
                           "%s(pc = %08x) bad exception_index: %d\n",
diff --git a/target/xtensa/xtensa-semi.c b/target/xtensa/xtensa-semi.c
index 552815ebfd..28dfb29cbd 100644
--- a/target/xtensa/xtensa-semi.c
+++ b/target/xtensa/xtensa-semi.c
@@ -35,6 +35,7 @@
 #include "system/memory.h"
 #include "qapi/error.h"
 #include "qemu/log.h"
+#include "qemu/plugin.h"
 
 enum {
     TARGET_SYS_exit = 1,
@@ -197,6 +198,7 @@ void HELPER(simcall)(CPUXtensaState *env)
     CPUState *cs = env_cpu(env);
     AddressSpace *as = cs->as;
     uint32_t *regs = env->regs;
+    uint64_t last_pc = env->pc;
 
     switch (regs[2]) {
     case TARGET_SYS_exit:
@@ -433,4 +435,5 @@ void HELPER(simcall)(CPUXtensaState *env)
         regs[3] = TARGET_ENOSYS;
         break;
     }
+    qemu_plugin_vcpu_hostcall_cb(cs, last_pc);
 }

From 9125196aaa8c0be2f1e7d62ad30fd67cf46bbe9a Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:36 +0000
Subject: [PATCH 1747/2396] tests: add plugin asserting correctness of discon
 event's to_pc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We recently introduced plugin API for the registration of callbacks for
discontinuity events, specifically for interrupts, exceptions and host
call events. The callback receives various bits of information,
including the VCPU index and PCs.

This change introduces a test plugin asserting the correctness of that
behaviour in cases where this is possible with reasonable effort.

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-30-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/tcg/plugins/discons.c   | 221 ++++++++++++++++++++++++++++++++++
 tests/tcg/plugins/meson.build |   2 +-
 2 files changed, 222 insertions(+), 1 deletion(-)
 create mode 100644 tests/tcg/plugins/discons.c

diff --git a/tests/tcg/plugins/discons.c b/tests/tcg/plugins/discons.c
new file mode 100644
index 0000000000..2e0e664e82
--- /dev/null
+++ b/tests/tcg/plugins/discons.c
@@ -0,0 +1,221 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ * Copyright (C) 2025, Julian Ganz <neither@nut.email>
+ *
+ * This plugin exercises the discontinuity plugin API and asserts some
+ * of its behaviour regarding reported program counters.
+ */
+#include <stdio.h>
+
+#include <qemu-plugin.h>
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_version = QEMU_PLUGIN_VERSION;
+
+struct cpu_state {
+    uint64_t last_pc;
+    uint64_t from_pc;
+    uint64_t next_pc;
+    uint64_t has_from;
+    bool has_next;
+    enum qemu_plugin_discon_type next_type;
+};
+
+struct insn_data {
+    uint64_t addr;
+    uint64_t next_pc;
+    bool next_valid;
+};
+
+static struct qemu_plugin_scoreboard *states;
+
+static qemu_plugin_u64 last_pc;
+static qemu_plugin_u64 from_pc;
+static qemu_plugin_u64 has_from;
+
+static bool abort_on_mismatch;
+static bool trace_all_insns;
+
+static bool addr_eq(uint64_t a, uint64_t b)
+{
+    if (a == b) {
+        return true;
+    }
+
+    uint64_t a_hw;
+    uint64_t b_hw;
+    if (!qemu_plugin_translate_vaddr(a, &a_hw) ||
+        !qemu_plugin_translate_vaddr(b, &b_hw))
+    {
+        return false;
+    }
+
+    return a_hw == b_hw;
+}
+
+static void report_mismatch(const char *pc_name, unsigned int vcpu_index,
+                            enum qemu_plugin_discon_type type, uint64_t last,
+                            uint64_t expected, uint64_t encountered)
+{
+    gchar *report;
+    const char *discon_type_name = "unknown";
+
+    if (addr_eq(expected, encountered)) {
+        return;
+    }
+
+    switch (type) {
+    case QEMU_PLUGIN_DISCON_INTERRUPT:
+        discon_type_name = "interrupt";
+        break;
+    case QEMU_PLUGIN_DISCON_EXCEPTION:
+        discon_type_name = "exception";
+        break;
+    case QEMU_PLUGIN_DISCON_HOSTCALL:
+        discon_type_name = "hostcall";
+        break;
+    default:
+        break;
+    }
+
+    report = g_strdup_printf("Discon %s PC mismatch on VCPU %d\n"
+                             "Expected:      %"PRIx64"\nEncountered:   %"
+                             PRIx64"\nExecuted Last: %"PRIx64
+                             "\nEvent type:    %s\n",
+                             pc_name, vcpu_index, expected, encountered, last,
+                             discon_type_name);
+    if (abort_on_mismatch) {
+        /*
+         * The qemu log infrastructure may lose messages when aborting. Using
+         * fputs directly ensures the final report is visible to developers.
+         */
+        fputs(report, stderr);
+        g_abort();
+    } else {
+        qemu_plugin_outs(report);
+    }
+    g_free(report);
+}
+
+static void vcpu_discon(qemu_plugin_id_t id, unsigned int vcpu_index,
+                        enum qemu_plugin_discon_type type, uint64_t from_pc,
+                        uint64_t to_pc)
+{
+    struct cpu_state *state = qemu_plugin_scoreboard_find(states, vcpu_index);
+
+    if (type == QEMU_PLUGIN_DISCON_EXCEPTION &&
+        addr_eq(state->last_pc, from_pc))
+    {
+        /*
+         * For some types of exceptions, insn_exec will be called for the
+         * instruction that caused the exception. This is valid behaviour and
+         * does not need to be reported.
+         */
+    } else if (state->has_next) {
+        /*
+         * We may encounter discontinuity chains without any instructions
+         * being executed in between.
+         */
+        report_mismatch("source", vcpu_index, type, state->last_pc,
+                        state->next_pc, from_pc);
+    } else if (state->has_from) {
+        report_mismatch("source", vcpu_index, type, state->last_pc,
+                        state->from_pc, from_pc);
+    }
+
+    state->has_from = false;
+
+    state->next_pc = to_pc;
+    state->next_type = type;
+    state->has_next = true;
+}
+
+static void insn_exec(unsigned int vcpu_index, void *userdata)
+{
+    struct cpu_state *state = qemu_plugin_scoreboard_find(states, vcpu_index);
+
+    if (state->has_next) {
+        report_mismatch("target", vcpu_index, state->next_type, state->last_pc,
+                        state->next_pc, state->last_pc);
+        state->has_next = false;
+    }
+
+    if (trace_all_insns) {
+        g_autoptr(GString) report = g_string_new(NULL);
+        g_string_append_printf(report, "Exec insn at %"PRIx64" on VCPU %d\n",
+                               state->last_pc, vcpu_index);
+        qemu_plugin_outs(report->str);
+    }
+}
+
+static void vcpu_tb_trans(qemu_plugin_id_t id, struct qemu_plugin_tb *tb)
+{
+    size_t n_insns = qemu_plugin_tb_n_insns(tb);
+    for (size_t i = 0; i < n_insns; i++) {
+        struct qemu_plugin_insn *insn = qemu_plugin_tb_get_insn(tb, i);
+        uint64_t pc = qemu_plugin_insn_vaddr(insn);
+        uint64_t next_pc = pc + qemu_plugin_insn_size(insn);
+        uint64_t has_next = (i + 1) < n_insns;
+
+        qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(insn,
+                                                            QEMU_PLUGIN_INLINE_STORE_U64,
+                                                            last_pc, pc);
+        qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(insn,
+                                                            QEMU_PLUGIN_INLINE_STORE_U64,
+                                                            from_pc, next_pc);
+        qemu_plugin_register_vcpu_insn_exec_inline_per_vcpu(insn,
+                                                            QEMU_PLUGIN_INLINE_STORE_U64,
+                                                            has_from, has_next);
+        qemu_plugin_register_vcpu_insn_exec_cb(insn, insn_exec,
+                                               QEMU_PLUGIN_CB_NO_REGS, NULL);
+    }
+}
+
+QEMU_PLUGIN_EXPORT int qemu_plugin_install(qemu_plugin_id_t id,
+                                           const qemu_info_t *info,
+                                           int argc, char **argv)
+{
+    if (!info->system_emulation) {
+        qemu_plugin_outs("Testing of the disontinuity plugin API is only"
+                         " possible in system emulation mode.");
+        return 0;
+    }
+
+    /* Set defaults */
+    abort_on_mismatch = true;
+    trace_all_insns = false;
+
+    for (int i = 0; i < argc; i++) {
+        char *opt = argv[i];
+        g_auto(GStrv) tokens = g_strsplit(opt, "=", 2);
+        if (g_strcmp0(tokens[0], "abort") == 0) {
+            if (!qemu_plugin_bool_parse(tokens[0], tokens[1],
+                                        &abort_on_mismatch)) {
+                fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
+                return -1;
+            }
+        } else if (g_strcmp0(tokens[0], "trace-all") == 0) {
+            if (!qemu_plugin_bool_parse(tokens[0], tokens[1],
+                                        &trace_all_insns)) {
+                fprintf(stderr, "boolean argument parsing failed: %s\n", opt);
+                return -1;
+            }
+        } else {
+            fprintf(stderr, "option parsing failed: %s\n", opt);
+            return -1;
+        }
+    }
+
+    states = qemu_plugin_scoreboard_new(sizeof(struct cpu_state));
+    last_pc = qemu_plugin_scoreboard_u64_in_struct(states, struct cpu_state,
+                                                   last_pc);
+    from_pc = qemu_plugin_scoreboard_u64_in_struct(states, struct cpu_state,
+                                                   from_pc);
+    has_from = qemu_plugin_scoreboard_u64_in_struct(states, struct cpu_state,
+                                                    has_from);
+
+    qemu_plugin_register_vcpu_discon_cb(id, QEMU_PLUGIN_DISCON_ALL,
+                                        vcpu_discon);
+    qemu_plugin_register_vcpu_tb_trans_cb(id, vcpu_tb_trans);
+
+    return 0;
+}
diff --git a/tests/tcg/plugins/meson.build b/tests/tcg/plugins/meson.build
index 61a007d9e7..561584159e 100644
--- a/tests/tcg/plugins/meson.build
+++ b/tests/tcg/plugins/meson.build
@@ -1,6 +1,6 @@
 t = []
 if get_option('plugins')
-  foreach i : ['bb', 'empty', 'inline', 'insn', 'mem', 'reset', 'syscall', 'patch']
+  foreach i : ['bb', 'discons', 'empty', 'inline', 'insn', 'mem', 'reset', 'syscall', 'patch']
     if host_os == 'windows'
       t += shared_module(i, files(i + '.c') + '../../../contrib/plugins/win32_linker.c',
                         include_directories: '../../../include/qemu',

From 3c0b1fc078a2be255a72bec1ba4e088230307398 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:37 +0000
Subject: [PATCH 1748/2396] tests: add test for double-traps on rv64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We do have a number of test-case for various architectures exercising
their interrupt/exception logic. However, for the recently introduced
trap API we also want to exercise the logic for double traps on at least
one architecture.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-31-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/tcg/riscv64/Makefile.softmmu-target |  6 ++
 tests/tcg/riscv64/doubletrap.S            | 73 +++++++++++++++++++++++
 2 files changed, 79 insertions(+)
 create mode 100644 tests/tcg/riscv64/doubletrap.S

diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/Makefile.softmmu-target
index 3ca595335d..d9c0036eb4 100644
--- a/tests/tcg/riscv64/Makefile.softmmu-target
+++ b/tests/tcg/riscv64/Makefile.softmmu-target
@@ -24,5 +24,11 @@ EXTRA_RUNS += run-test-mepc-masking
 run-test-mepc-masking: test-mepc-masking
 	$(call run-test, $<, $(QEMU) $(QEMU_OPTS)$<)
 
+EXTRA_RUNS += run-plugin-doubletrap
+run-plugin-doubletrap: doubletrap
+	$(call run-test, $<, \
+	  $(QEMU) -plugin ../plugins/libdiscons.so -d plugin -D $<.pout \
+	  $(QEMU_OPTS)$<)
+
 # We don't currently support the multiarch system tests
 undefine MULTIARCH_TESTS
diff --git a/tests/tcg/riscv64/doubletrap.S b/tests/tcg/riscv64/doubletrap.S
new file mode 100644
index 0000000000..b61089c9c1
--- /dev/null
+++ b/tests/tcg/riscv64/doubletrap.S
@@ -0,0 +1,73 @@
+	.option norvc
+
+	.text
+	.global _start
+_start:
+	# Set up vectored interrupts
+	lla	t0, trap
+	add	t0, t0, 1
+	csrw	mtvec, t0
+
+	# Enable sw interrupts
+	csrrsi	zero, mie, 0x8
+	csrrsi	zero, mstatus, 0x8
+
+	# Engage the double trap: we trigger an machine-level software
+	# interrupt, which will trap to an illegal instruction
+	lui	t1, 0x02000
+	li	t0, 1
+	sw	t0, 0(t1)
+
+	# If we still not went out via the software interrupt route after a
+	# short while, we failed the test.
+	lui	t0, 0x1
+0:
+	addi	t0, t0, -1
+	bnez	t0, 0b
+	j	fail
+
+trap:
+	j	illegal_insn # Exceptions
+	j	fail # Supervisor software interrupt
+	j	fail
+	.insn	i CUSTOM_0, 0, x0, x0, 0 # Machine software interrupt
+	j	fail
+	j	fail # Supervisor timer interrupt
+	j	fail
+	j	fail # Machine timer interrupt
+	j	fail
+	j	fail # Supervisor external interrupt
+	j	fail
+	j	fail # Machine external interrupt
+	j	fail
+	j	fail # Counter overflow interrupt
+	j	fail
+	j	fail
+
+illegal_insn:
+	# Check whether we really got an illegal instruction
+	csrr	t0, mcause
+	li	t1, 2
+	bne	t0, t1, fail
+	li	a0, 0
+	j	_exit
+fail:
+	li	a0, 1
+_exit:
+	lla	a1, semiargs
+	li	t0, 0x20026	# ADP_Stopped_ApplicationExit
+	sd	t0, 0(a1)
+	sd	a0, 8(a1)
+	li	a0, 0x20	# TARGET_SYS_EXIT_EXTENDED
+
+	# Semihosting call sequence
+	.balign	16
+	slli	zero, zero, 0x1f
+	ebreak
+	srai	zero, zero, 0x7
+	j	.
+
+	.data
+	.balign	16
+semiargs:
+	.space	16

From 5241645c47a9987f4fcc65bab303a444966b7942 Mon Sep 17 00:00:00 2001
From: Julian Ganz <neither@nut.email>
Date: Mon, 27 Oct 2025 11:03:38 +0000
Subject: [PATCH 1749/2396] tests: add test with interrupted memory accesses on
 rv64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This test aims at catching API misbehaviour w.r.t. the interaction
between interrupts and memory accesses, such as the bug fixed in

    27f347e6a1d269c533633c812321cabb249eada8
    (accel/tcg: also suppress asynchronous IRQs for cpu_io_recompile)

Because the condition for triggering misbehaviour may not be
deterministic and the cross-section between memory accesses and
interrupt handlers may be small, we have to place our trust in large
numbers. Instead of guessing/trying an arbitrary, fixed loop-bound, we
decided to loop for a fixed amount of real-time. This avoids the test
running into a time-out on slower machines while enabling a high number
of possible interactions on faster machines.

The test program sends a single '.' per 1000000 loads/stores over the
serial. This output is not captured, but may be used by developers to
gauge the number of possible interactions.

Reviewed-by: Daniel Henrique Barboza <dbarboza@ventanamicro.com>
Signed-off-by: Julian Ganz <neither@nut.email>
Message-ID: <20251027110344.2289945-32-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/tcg/riscv64/Makefile.softmmu-target |  6 ++
 tests/tcg/riscv64/interruptedmemory.S     | 97 +++++++++++++++++++++++
 2 files changed, 103 insertions(+)
 create mode 100644 tests/tcg/riscv64/interruptedmemory.S

diff --git a/tests/tcg/riscv64/Makefile.softmmu-target b/tests/tcg/riscv64/Makefile.softmmu-target
index d9c0036eb4..eb1ce6504a 100644
--- a/tests/tcg/riscv64/Makefile.softmmu-target
+++ b/tests/tcg/riscv64/Makefile.softmmu-target
@@ -30,5 +30,11 @@ run-plugin-doubletrap: doubletrap
 	  $(QEMU) -plugin ../plugins/libdiscons.so -d plugin -D $<.pout \
 	  $(QEMU_OPTS)$<)
 
+EXTRA_RUNS += run-plugin-interruptedmemory
+run-plugin-interruptedmemory: interruptedmemory
+	$(call run-test, $<, \
+	  $(QEMU) -plugin ../plugins/libdiscons.so -d plugin -D $<.pout \
+	  $(QEMU_OPTS)$<)
+
 # We don't currently support the multiarch system tests
 undefine MULTIARCH_TESTS
diff --git a/tests/tcg/riscv64/interruptedmemory.S b/tests/tcg/riscv64/interruptedmemory.S
new file mode 100644
index 0000000000..cd9073ee31
--- /dev/null
+++ b/tests/tcg/riscv64/interruptedmemory.S
@@ -0,0 +1,97 @@
+	.option norvc
+
+	.text
+	.global _start
+_start:
+	# Set up trap vector
+	lla	t0, trap
+	csrw	mtvec, t0
+
+	# Set up timer
+	lui	t1, 0x02004
+	sd	zero, 0(t1) # MTIMECMP0
+
+	# Enable timer interrupts
+	li	t0, 0x80
+	csrrs	zero, mie, t0
+	csrrsi	zero, mstatus, 0x8
+
+	# Set up UART
+	lui	t1, 0x10000
+	li	a0, 0x80	# DLAB=1
+	sb	a0, 3(t1)
+	li	a0, 1		# Full speed
+	sw	a0, 0(t1)
+	li	a0, 0x03	# 8N1, DLAB=0
+	sb	a0, 3(t1)
+
+	# Run test for around 60s
+	call	rtc_get
+	li	t0, 30
+	slli	t0, t0, 30 # Approx. 10e9 ns
+	add	t0, t0, a0
+0:
+	# Tight loop with memory accesses
+	li	a1, 1000000
+	la	a2, semiargs
+1:
+	ld	a0, 0(a2)
+	sd	a0, 0(a2)
+	addi	a1, a1, -1
+	bnez	a1, 1b
+
+	li	a0, '.'
+	call	send_byte
+	call	rtc_get
+	bltu	a0, t0, 0b
+
+	li	a0, '\n'
+	call	send_byte
+
+	# Exit
+	li	a0, 0
+	lla	a1, semiargs
+	li	t0, 0x20026	# ADP_Stopped_ApplicationExit
+	sd	t0, 0(a1)
+	sd	a0, 8(a1)
+	li	a0, 0x20	# TARGET_SYS_EXIT_EXTENDED
+
+	# Semihosting call sequence
+	.balign	16
+	slli	zero, zero, 0x1f
+	ebreak
+	srai	zero, zero, 0x7
+
+	j	.
+
+rtc_get:
+	# Get current time from the goldfish RTC
+	lui	t3, 0x0101
+	lw	a0, 0(t3)
+	lw	t3, 4(t3)
+	slli	t3, t3, 32
+	add	a0, a0, t3
+	ret
+
+send_byte:
+	# Send a single byte over the serial
+	lui	t3, 0x10000
+	lb	a1, 5(t3)
+	andi	a1, a1, 0x20
+	beqz	a1, send_byte
+	sb	a0, 0(t3)
+	ret
+
+	.balign 4
+trap:
+	lui	t5, 0x0200c
+	ld	t6, -0x8(t5) # MTIME
+	addi	t6, t6, 100
+	lui	t5, 0x02004
+	sd	t6, 0(t5) # MTIMECMP
+	mret
+
+	.data
+	.balign	16
+semiargs:
+	.space	16

From 78bd26bbf07ffdb58953b62ec8777a5283849809 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:39 +0000
Subject: [PATCH 1750/2396] plugins/core: add missing QEMU_DISABLE_CFI
 annotations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most of the memory callbacks come directly from the generated code
however we have do have a a direct from C callback for the slow-path
and memory helpers.

There is also a reset callback that calls out to plugins.

Like the other plugin points we need to disable CFI as we are making
function calls to dynamically linked libraries.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3175
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251027110344.2289945-33-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 plugins/core.c   | 1 +
 plugins/loader.c | 1 +
 2 files changed, 2 insertions(+)

diff --git a/plugins/core.c b/plugins/core.c
index 35a252d272..8f8bc7219c 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -668,6 +668,7 @@ void exec_inline_op(enum plugin_dyn_cb_type type,
     }
 }
 
+QEMU_DISABLE_CFI
 void qemu_plugin_vcpu_mem_cb(CPUState *cpu, uint64_t vaddr,
                              uint64_t value_low,
                              uint64_t value_high,
diff --git a/plugins/loader.c b/plugins/loader.c
index ba10ebac99..0dbe7bea26 100644
--- a/plugins/loader.c
+++ b/plugins/loader.c
@@ -318,6 +318,7 @@ struct qemu_plugin_reset_data {
     bool reset;
 };
 
+QEMU_DISABLE_CFI
 static void plugin_reset_destroy__locked(struct qemu_plugin_reset_data *data)
 {
     struct qemu_plugin_ctx *ctx = data->ctx;

From 12e9a13e32662f2b9abce1fc34a89b0786280328 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 27 Oct 2025 11:03:40 +0000
Subject: [PATCH 1751/2396] configs: drop SBSA_REF from minimal specification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The whole point of SBSA_REF is for testing firmware which by
definition requires TCG. This means the configuration of:

  --disable-tcg --with-devices-aarch64=minimal

makes no sense (and indeed is broken for the
ubuntu-24.04-aarch64-notcg) test. Drop it from minimal and remove the
allow_failure from the test case.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-34-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml | 2 --
 configs/devices/aarch64-softmmu/minimal.mak          | 1 -
 2 files changed, 3 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index 46db9ae013..ee13587d99 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -107,7 +107,5 @@ ubuntu-24.04-aarch64-notcg:
   rules:
     - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
       when: manual
-      allow_failure: true
     - if: "$AARCH64_RUNNER_AVAILABLE"
       when: manual
-      allow_failure: true
diff --git a/configs/devices/aarch64-softmmu/minimal.mak b/configs/devices/aarch64-softmmu/minimal.mak
index 0ebc1dca56..3c8582e12c 100644
--- a/configs/devices/aarch64-softmmu/minimal.mak
+++ b/configs/devices/aarch64-softmmu/minimal.mak
@@ -6,4 +6,3 @@
 #
 
 CONFIG_ARM_VIRT=y
-CONFIG_SBSA_REF=y

From 524fc77d2322814f0dfde272559d74ec1599f01e Mon Sep 17 00:00:00 2001
From: Sean Anderson <sean.anderson@linux.dev>
Date: Mon, 27 Oct 2025 11:03:41 +0000
Subject: [PATCH 1752/2396] gdbstub: Fix %s formatting
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The format string for %s has two format characters. This causes it to
emit strings like "466f5bd8/6x" instead of "466f5bd8/6". GDB detects
this and returns EIO, causing all open File I/O calls to fail.

Fixes: 0820a075af ("gdbstub: Adjust gdb_do_syscall to only use uint32_t and uint64_t")
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251027110344.2289945-35-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 gdbstub/syscalls.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdbstub/syscalls.c b/gdbstub/syscalls.c
index e855df21ab..d8bb90cc1c 100644
--- a/gdbstub/syscalls.c
+++ b/gdbstub/syscalls.c
@@ -127,7 +127,7 @@ void gdb_do_syscall(gdb_syscall_complete_cb cb, const char *fmt, ...)
             case 's':
                 i64 = va_arg(va, uint64_t);
                 i32 = va_arg(va, uint32_t);
-                p += snprintf(p, p_end - p, "%" PRIx64 "/%x" PRIx32, i64, i32);
+                p += snprintf(p, p_end - p, "%" PRIx64 "/%" PRIx32, i64, i32);
                 break;
             default:
             bad_format:

From 4f45b2c352bb72c13a8801805061b31979e3f048 Mon Sep 17 00:00:00 2001
From: Sean Anderson <sean.anderson@linux.dev>
Date: Mon, 27 Oct 2025 11:03:42 +0000
Subject: [PATCH 1753/2396] semihosting: Fix GDB File-I/O FLEN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

fstat returns 0 on success and -1 on error. Since we have already
checked for error, ret must be zero. Therefore, any call to fstat on a
non-empty file will return -1/EOVERFLOW.

Restore the original logic that just did a byteswap. I don't really know
what the intention of the fixed commit was.

Fixes: a6300ed6b7 ("semihosting: Split out semihost_sys_flen")
Signed-off-by: Sean Anderson <sean.anderson@linux.dev>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-ID: <20251027110344.2289945-36-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 semihosting/arm-compat-semi.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/semihosting/arm-compat-semi.c b/semihosting/arm-compat-semi.c
index 6100126796..c5a07cb947 100644
--- a/semihosting/arm-compat-semi.c
+++ b/semihosting/arm-compat-semi.c
@@ -316,10 +316,7 @@ common_semi_flen_fstat_cb(CPUState *cs, uint64_t ret, int err)
                                 &size, 8, 0)) {
             ret = -1, err = EFAULT;
         } else {
-            size = be64_to_cpu(size);
-            if (ret != size) {
-                ret = -1, err = EOVERFLOW;
-            }
+            ret = be64_to_cpu(size);
         }
     }
     common_semi_cb(cs, ret, err);

From 5de9216064d32eaac125dac4de1878486c16d73e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 22:50:46 +0100
Subject: [PATCH 1754/2396] hw/arm: Register TYPE_TARGET_ARM/AARCH64_MACHINE
 QOM interfaces
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Define the TYPE_TARGET_ARM_MACHINE and TYPE_TARGET_AARCH64_MACHINE
QOM interface names to allow machines to implement them.

Register these interfaces in common code in target_info-qom.c used
by all binaries because QOM interfaces must be registered before
being checked (see next commit with the 'none' machine).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-2-philmd@linaro.org>
---
 include/hw/arm/machines-qom.h | 18 ++++++++++++++++++
 meson.build                   |  1 +
 target-info-qom.c             | 24 ++++++++++++++++++++++++
 3 files changed, 43 insertions(+)
 create mode 100644 include/hw/arm/machines-qom.h
 create mode 100644 target-info-qom.c

diff --git a/include/hw/arm/machines-qom.h b/include/hw/arm/machines-qom.h
new file mode 100644
index 0000000000..a17225f5f9
--- /dev/null
+++ b/include/hw/arm/machines-qom.h
@@ -0,0 +1,18 @@
+/*
+ * QOM type definitions for ARM / Aarch64 machines
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef HW_ARM_MACHINES_QOM_H
+#define HW_ARM_MACHINES_QOM_H
+
+#define TYPE_TARGET_ARM_MACHINE \
+        "target-info-arm-machine"
+
+#define TYPE_TARGET_AARCH64_MACHINE \
+        "target-info-aarch64-machine"
+
+#endif
diff --git a/meson.build b/meson.build
index 8ad37c992b..de95da3269 100644
--- a/meson.build
+++ b/meson.build
@@ -3911,6 +3911,7 @@ common_ss.add(pagevary)
 specific_ss.add(files('page-vary-target.c'))
 
 common_ss.add(files('target-info.c'))
+system_ss.add(files('target-info-qom.c'))
 specific_ss.add(files('target-info-stub.c'))
 
 subdir('backends')
diff --git a/target-info-qom.c b/target-info-qom.c
new file mode 100644
index 0000000000..7fd58d2481
--- /dev/null
+++ b/target-info-qom.c
@@ -0,0 +1,24 @@
+/*
+ * QEMU binary/target API (QOM types)
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qom/object.h"
+#include "hw/arm/machines-qom.h"
+
+static const TypeInfo target_info_types[] = {
+    {
+        .name           = TYPE_TARGET_ARM_MACHINE,
+        .parent         = TYPE_INTERFACE,
+    },
+    {
+        .name           = TYPE_TARGET_AARCH64_MACHINE,
+        .parent         = TYPE_INTERFACE,
+    },
+};
+
+DEFINE_TYPES(target_info_types)

From eb796c55513d9d39bf7ef40eec367098b16edd7f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 18 Apr 2025 00:44:24 +0200
Subject: [PATCH 1755/2396] hw/core: Allow ARM/Aarch64 binaries to use the
 'none' machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we'll start to use target_machine_typename() to filter
machines for the ARM/Aarch64 binaries, the 'none' machine
would be filtered. Register the proper interfaces to keep
it available.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-3-philmd@linaro.org>
---
 hw/core/null-machine.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/core/null-machine.c b/hw/core/null-machine.c
index a6e477a2d8..67b769bd3e 100644
--- a/hw/core/null-machine.c
+++ b/hw/core/null-machine.c
@@ -16,6 +16,7 @@
 #include "hw/boards.h"
 #include "system/address-spaces.h"
 #include "hw/core/cpu.h"
+#include "hw/arm/machines-qom.h"
 
 static void machine_none_init(MachineState *mch)
 {
@@ -55,4 +56,7 @@ static void machine_none_machine_init(MachineClass *mc)
     mc->no_cdrom = 1;
 }
 
-DEFINE_MACHINE("none", machine_none_machine_init)
+DEFINE_MACHINE_WITH_INTERFACES("none", machine_none_machine_init,
+                               { TYPE_TARGET_AARCH64_MACHINE },
+                               { TYPE_TARGET_ARM_MACHINE },
+                               { })

From 453bf5c72f9b8d5dc96d4f8fce86a03464fae616 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 24 Apr 2025 15:34:33 +0200
Subject: [PATCH 1756/2396] hw/arm: Add DEFINE_MACHINE_ARM() /
 DEFINE_MACHINE_AARCH64() macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A machine defined with the DEFINE_MACHINE_ARM() macro will
be available in both qemu-system-arm and qemu-system-aarch64
binaries.

One defined with DEFINE_MACHINE_AARCH64() will only be
available in the qemu-system-aarch64 binary.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-4-philmd@linaro.org>
---
 include/hw/arm/machines-qom.h | 28 ++++++++++++++++++++++++++++
 target/arm/machine.c          | 18 ++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/include/hw/arm/machines-qom.h b/include/hw/arm/machines-qom.h
index a17225f5f9..3f64d5eb02 100644
--- a/include/hw/arm/machines-qom.h
+++ b/include/hw/arm/machines-qom.h
@@ -9,10 +9,38 @@
 #ifndef HW_ARM_MACHINES_QOM_H
 #define HW_ARM_MACHINES_QOM_H
 
+#include "hw/boards.h"
+
 #define TYPE_TARGET_ARM_MACHINE \
         "target-info-arm-machine"
 
 #define TYPE_TARGET_AARCH64_MACHINE \
         "target-info-aarch64-machine"
 
+/*
+ * A machine filtered with arm_machine_interfaces[] or
+ * arm_aarch64_machine_interfaces[] will be available
+ * in both qemu-system-arm and qemu-system-aarch64 binaries.
+ *
+ * One filtered with aarch64_machine_interfaces[] will only
+ * be available in the qemu-system-aarch64 binary.
+ */
+extern const InterfaceInfo arm_machine_interfaces[];
+extern const InterfaceInfo arm_aarch64_machine_interfaces[];
+extern const InterfaceInfo aarch64_machine_interfaces[];
+
+/*
+ * A machine defined with the DEFINE_MACHINE_ARM() macro will be
+ * available in both qemu-system-arm and qemu-system-aarch64 binaries.
+ *
+ * One defined with DEFINE_MACHINE_AARCH64() will only be available in
+ * the qemu-system-aarch64 binary.
+ */
+#define DEFINE_MACHINE_ARM(namestr, machine_initfn) \
+        DEFINE_MACHINE_WITH_INTERFACE_ARRAY(namestr, machine_initfn, \
+                                            arm_machine_interfaces)
+#define DEFINE_MACHINE_AARCH64(namestr, machine_initfn) \
+        DEFINE_MACHINE_WITH_INTERFACE_ARRAY(namestr, machine_initfn, \
+                                            aarch64_machine_interfaces)
+
 #endif
diff --git a/target/arm/machine.c b/target/arm/machine.c
index 44a0cf844b..0befdb0b28 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -9,6 +9,7 @@
 #include "migration/qemu-file-types.h"
 #include "migration/vmstate.h"
 #include "target/arm/gtimer.h"
+#include "hw/arm/machines-qom.h"
 
 static bool vfp_needed(void *opaque)
 {
@@ -1212,3 +1213,20 @@ const VMStateDescription vmstate_arm_cpu = {
         NULL
     }
 };
+
+const InterfaceInfo arm_machine_interfaces[] = {
+    { TYPE_TARGET_ARM_MACHINE },
+    { TYPE_TARGET_AARCH64_MACHINE },
+    { }
+};
+
+const InterfaceInfo arm_aarch64_machine_interfaces[] = {
+    { TYPE_TARGET_ARM_MACHINE },
+    { TYPE_TARGET_AARCH64_MACHINE },
+    { }
+};
+
+const InterfaceInfo aarch64_machine_interfaces[] = {
+    { TYPE_TARGET_AARCH64_MACHINE },
+    { }
+};

From faa5c9ac3f577582b02770e720c6b0459966bbc4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 14:31:15 +0400
Subject: [PATCH 1757/2396] qdev: add qdev_find_default_bus()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This helper is used next by -audio code.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/monitor/qdev.h |  3 +++
 system/qdev-monitor.c  | 25 +++++++++++++++++++++----
 2 files changed, 24 insertions(+), 4 deletions(-)

diff --git a/include/monitor/qdev.h b/include/monitor/qdev.h
index 1d57bf6577..de33637869 100644
--- a/include/monitor/qdev.h
+++ b/include/monitor/qdev.h
@@ -1,6 +1,8 @@
 #ifndef MONITOR_QDEV_H
 #define MONITOR_QDEV_H
 
+#include "hw/qdev-core.h"
+
 /*** monitor commands ***/
 
 void hmp_info_qtree(Monitor *mon, const QDict *qdict);
@@ -11,6 +13,7 @@ int qdev_device_help(QemuOpts *opts);
 DeviceState *qdev_device_add(QemuOpts *opts, Error **errp);
 DeviceState *qdev_device_add_from_qdict(const QDict *opts,
                                         bool from_json, Error **errp);
+BusState *qdev_find_default_bus(DeviceClass *dc, Error **errp);
 
 /**
  * qdev_set_id: parent the device and set its id if provided.
diff --git a/system/qdev-monitor.c b/system/qdev-monitor.c
index ec4a2394ce..f2aa400a77 100644
--- a/system/qdev-monitor.c
+++ b/system/qdev-monitor.c
@@ -621,6 +621,25 @@ const char *qdev_set_id(DeviceState *dev, char *id, Error **errp)
     return prop->name;
 }
 
+BusState *qdev_find_default_bus(DeviceClass *dc, Error **errp)
+{
+    BusState *bus = NULL;
+
+    assert(dc->bus_type != NULL);
+    bus = qbus_find_recursive(sysbus_get_default(), NULL, dc->bus_type);
+    if (!bus) {
+        error_setg(errp, "No '%s' bus found for device '%s'",
+                   dc->bus_type, object_class_get_name(OBJECT_CLASS(dc)));
+        return NULL;
+    }
+    if (qbus_is_full(bus)) {
+        error_setg(errp, "A '%s' bus was found but is full", dc->bus_type);
+        return NULL;
+    }
+
+    return bus;
+}
+
 DeviceState *qdev_device_add_from_qdict(const QDict *opts,
                                         bool from_json, Error **errp)
 {
@@ -657,10 +676,8 @@ DeviceState *qdev_device_add_from_qdict(const QDict *opts,
             return NULL;
         }
     } else if (dc->bus_type != NULL) {
-        bus = qbus_find_recursive(sysbus_get_default(), NULL, dc->bus_type);
-        if (!bus || qbus_is_full(bus)) {
-            error_setg(errp, "No '%s' bus found for device '%s'",
-                       dc->bus_type, driver);
+        bus = qdev_find_default_bus(dc, errp);
+        if (!bus) {
             return NULL;
         }
     }

From 2e0096a2b6a5a7e3cde1dd13704cc71af6b9bdd7 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 27 Oct 2025 09:43:32 +0800
Subject: [PATCH 1758/2396] linux-headers: Update to Linux v6.18-rc3

Update headers to retrieve the latest KVM caps for LoongArch. It is added
to the tree by running `update-linux-headers.sh` on linux v6.18-rc3.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 include/standard-headers/linux/ethtool.h      |  1 +
 include/standard-headers/linux/fuse.h         | 22 ++++++++++--
 .../linux/input-event-codes.h                 |  1 +
 include/standard-headers/linux/input.h        | 22 +++++++++++-
 include/standard-headers/linux/pci_regs.h     | 10 ++++++
 include/standard-headers/linux/virtio_ids.h   |  1 +
 linux-headers/asm-loongarch/kvm.h             |  1 +
 linux-headers/asm-riscv/kvm.h                 | 23 ++++++++++++-
 linux-headers/asm-riscv/ptrace.h              |  4 +--
 linux-headers/asm-x86/kvm.h                   | 34 +++++++++++++++++++
 linux-headers/asm-x86/unistd_64.h             |  1 +
 linux-headers/asm-x86/unistd_x32.h            |  1 +
 linux-headers/linux/kvm.h                     |  3 ++
 linux-headers/linux/psp-sev.h                 | 10 +++++-
 linux-headers/linux/stddef.h                  |  1 -
 linux-headers/linux/vduse.h                   |  2 +-
 linux-headers/linux/vhost.h                   |  4 +--
 17 files changed, 130 insertions(+), 11 deletions(-)

diff --git a/include/standard-headers/linux/ethtool.h b/include/standard-headers/linux/ethtool.h
index eb80314028..dc24512d28 100644
--- a/include/standard-headers/linux/ethtool.h
+++ b/include/standard-headers/linux/ethtool.h
@@ -2380,6 +2380,7 @@ enum {
 #define	RXH_L4_B_0_1	(1 << 6) /* src port in case of TCP/UDP/SCTP */
 #define	RXH_L4_B_2_3	(1 << 7) /* dst port in case of TCP/UDP/SCTP */
 #define	RXH_GTP_TEID	(1 << 8) /* teid in case of GTP */
+#define	RXH_IP6_FL	(1 << 9) /* IPv6 flow label */
 #define	RXH_DISCARD	(1 << 31)
 
 #define	RX_CLS_FLOW_DISC	0xffffffffffffffffULL
diff --git a/include/standard-headers/linux/fuse.h b/include/standard-headers/linux/fuse.h
index d8b2fd67e1..abf3a78858 100644
--- a/include/standard-headers/linux/fuse.h
+++ b/include/standard-headers/linux/fuse.h
@@ -235,6 +235,11 @@
  *
  *  7.44
  *  - add FUSE_NOTIFY_INC_EPOCH
+ *
+ *  7.45
+ *  - add FUSE_COPY_FILE_RANGE_64
+ *  - add struct fuse_copy_file_range_out
+ *  - add FUSE_NOTIFY_PRUNE
  */
 
 #ifndef _LINUX_FUSE_H
@@ -266,7 +271,7 @@
 #define FUSE_KERNEL_VERSION 7
 
 /** Minor version number of this interface */
-#define FUSE_KERNEL_MINOR_VERSION 44
+#define FUSE_KERNEL_MINOR_VERSION 45
 
 /** The node ID of the root inode */
 #define FUSE_ROOT_ID 1
@@ -653,6 +658,7 @@ enum fuse_opcode {
 	FUSE_SYNCFS		= 50,
 	FUSE_TMPFILE		= 51,
 	FUSE_STATX		= 52,
+	FUSE_COPY_FILE_RANGE_64	= 53,
 
 	/* CUSE specific operations */
 	CUSE_INIT		= 4096,
@@ -671,7 +677,7 @@ enum fuse_notify_code {
 	FUSE_NOTIFY_DELETE = 6,
 	FUSE_NOTIFY_RESEND = 7,
 	FUSE_NOTIFY_INC_EPOCH = 8,
-	FUSE_NOTIFY_CODE_MAX,
+	FUSE_NOTIFY_PRUNE = 9,
 };
 
 /* The read buffer is required to be at least 8k, but may be much larger */
@@ -1110,6 +1116,12 @@ struct fuse_notify_retrieve_in {
 	uint64_t	dummy4;
 };
 
+struct fuse_notify_prune_out {
+	uint32_t	count;
+	uint32_t	padding;
+	uint64_t	spare;
+};
+
 struct fuse_backing_map {
 	int32_t		fd;
 	uint32_t	flags;
@@ -1122,6 +1134,7 @@ struct fuse_backing_map {
 #define FUSE_DEV_IOC_BACKING_OPEN	_IOW(FUSE_DEV_IOC_MAGIC, 1, \
 					     struct fuse_backing_map)
 #define FUSE_DEV_IOC_BACKING_CLOSE	_IOW(FUSE_DEV_IOC_MAGIC, 2, uint32_t)
+#define FUSE_DEV_IOC_SYNC_INIT		_IO(FUSE_DEV_IOC_MAGIC, 3)
 
 struct fuse_lseek_in {
 	uint64_t	fh;
@@ -1144,6 +1157,11 @@ struct fuse_copy_file_range_in {
 	uint64_t	flags;
 };
 
+/* For FUSE_COPY_FILE_RANGE_64 */
+struct fuse_copy_file_range_out {
+	uint64_t	bytes_copied;
+};
+
 #define FUSE_SETUPMAPPING_FLAG_WRITE (1ull << 0)
 #define FUSE_SETUPMAPPING_FLAG_READ (1ull << 1)
 struct fuse_setupmapping_in {
diff --git a/include/standard-headers/linux/input-event-codes.h b/include/standard-headers/linux/input-event-codes.h
index 00dc9caac9..c914ccd723 100644
--- a/include/standard-headers/linux/input-event-codes.h
+++ b/include/standard-headers/linux/input-event-codes.h
@@ -27,6 +27,7 @@
 #define INPUT_PROP_TOPBUTTONPAD		0x04	/* softbuttons at top of pad */
 #define INPUT_PROP_POINTING_STICK	0x05	/* is a pointing stick */
 #define INPUT_PROP_ACCELEROMETER	0x06	/* has accelerometer */
+#define INPUT_PROP_HAPTIC_TOUCHPAD	0x07	/* is a haptic touchpad */
 
 #define INPUT_PROP_MAX			0x1f
 #define INPUT_PROP_CNT			(INPUT_PROP_MAX + 1)
diff --git a/include/standard-headers/linux/input.h b/include/standard-headers/linux/input.h
index d4512c20b5..9aff211dd5 100644
--- a/include/standard-headers/linux/input.h
+++ b/include/standard-headers/linux/input.h
@@ -426,6 +426,24 @@ struct ff_rumble_effect {
 	uint16_t weak_magnitude;
 };
 
+/**
+ * struct ff_haptic_effect
+ * @hid_usage: hid_usage according to Haptics page (WAVEFORM_CLICK, etc.)
+ * @vendor_id: the waveform vendor ID if hid_usage is in the vendor-defined range
+ * @vendor_waveform_page: the vendor waveform page if hid_usage is in the vendor-defined range
+ * @intensity: strength of the effect as percentage
+ * @repeat_count: number of times to retrigger effect
+ * @retrigger_period: time before effect is retriggered (in ms)
+ */
+struct ff_haptic_effect {
+	uint16_t hid_usage;
+	uint16_t vendor_id;
+	uint8_t  vendor_waveform_page;
+	uint16_t intensity;
+	uint16_t repeat_count;
+	uint16_t retrigger_period;
+};
+
 /**
  * struct ff_effect - defines force feedback effect
  * @type: type of the effect (FF_CONSTANT, FF_PERIODIC, FF_RAMP, FF_SPRING,
@@ -462,6 +480,7 @@ struct ff_effect {
 		struct ff_periodic_effect periodic;
 		struct ff_condition_effect condition[2]; /* One for each axis */
 		struct ff_rumble_effect rumble;
+		struct ff_haptic_effect haptic;
 	} u;
 };
 
@@ -469,6 +488,7 @@ struct ff_effect {
  * Force feedback effect types
  */
 
+#define FF_HAPTIC		0x4f
 #define FF_RUMBLE	0x50
 #define FF_PERIODIC	0x51
 #define FF_CONSTANT	0x52
@@ -478,7 +498,7 @@ struct ff_effect {
 #define FF_INERTIA	0x56
 #define FF_RAMP		0x57
 
-#define FF_EFFECT_MIN	FF_RUMBLE
+#define FF_EFFECT_MIN	FF_HAPTIC
 #define FF_EFFECT_MAX	FF_RAMP
 
 /*
diff --git a/include/standard-headers/linux/pci_regs.h b/include/standard-headers/linux/pci_regs.h
index f5b17745de..07e06aafec 100644
--- a/include/standard-headers/linux/pci_regs.h
+++ b/include/standard-headers/linux/pci_regs.h
@@ -207,6 +207,9 @@
 
 /* Capability lists */
 
+#define PCI_CAP_ID_MASK		0x00ff	/* Capability ID mask */
+#define PCI_CAP_LIST_NEXT_MASK	0xff00	/* Next Capability Pointer mask */
+
 #define PCI_CAP_LIST_ID		0	/* Capability ID */
 #define  PCI_CAP_ID_PM		0x01	/* Power Management */
 #define  PCI_CAP_ID_AGP		0x02	/* Accelerated Graphics Port */
@@ -776,6 +779,12 @@
 #define  PCI_ERR_UNC_MCBTLP	0x00800000	/* MC blocked TLP */
 #define  PCI_ERR_UNC_ATOMEG	0x01000000	/* Atomic egress blocked */
 #define  PCI_ERR_UNC_TLPPRE	0x02000000	/* TLP prefix blocked */
+#define  PCI_ERR_UNC_POISON_BLK	0x04000000	/* Poisoned TLP Egress Blocked */
+#define  PCI_ERR_UNC_DMWR_BLK	0x08000000	/* DMWr Request Egress Blocked */
+#define  PCI_ERR_UNC_IDE_CHECK	0x10000000	/* IDE Check Failed */
+#define  PCI_ERR_UNC_MISR_IDE	0x20000000	/* Misrouted IDE TLP */
+#define  PCI_ERR_UNC_PCRC_CHECK	0x40000000	/* PCRC Check Failed */
+#define  PCI_ERR_UNC_XLAT_BLK	0x80000000	/* TLP Translation Egress Blocked */
 #define PCI_ERR_UNCOR_MASK	0x08	/* Uncorrectable Error Mask */
 	/* Same bits as above */
 #define PCI_ERR_UNCOR_SEVER	0x0c	/* Uncorrectable Error Severity */
@@ -798,6 +807,7 @@
 #define  PCI_ERR_CAP_ECRC_CHKC		0x00000080 /* ECRC Check Capable */
 #define  PCI_ERR_CAP_ECRC_CHKE		0x00000100 /* ECRC Check Enable */
 #define  PCI_ERR_CAP_PREFIX_LOG_PRESENT	0x00000800 /* TLP Prefix Log Present */
+#define  PCI_ERR_CAP_COMP_TIME_LOG	0x00001000 /* Completion Timeout Prefix/Header Log Capable */
 #define  PCI_ERR_CAP_TLP_LOG_FLIT	0x00040000 /* TLP was logged in Flit Mode */
 #define  PCI_ERR_CAP_TLP_LOG_SIZE	0x00f80000 /* Logged TLP Size (only in Flit mode) */
 #define PCI_ERR_HEADER_LOG	0x1c	/* Header Log Register (16 bytes) */
diff --git a/include/standard-headers/linux/virtio_ids.h b/include/standard-headers/linux/virtio_ids.h
index 7aa2eb7662..6c12db16fa 100644
--- a/include/standard-headers/linux/virtio_ids.h
+++ b/include/standard-headers/linux/virtio_ids.h
@@ -68,6 +68,7 @@
 #define VIRTIO_ID_AUDIO_POLICY		39 /* virtio audio policy */
 #define VIRTIO_ID_BT			40 /* virtio bluetooth */
 #define VIRTIO_ID_GPIO			41 /* virtio gpio */
+#define VIRTIO_ID_SPI			45 /* virtio spi */
 
 /*
  * Virtio Transitional IDs
diff --git a/linux-headers/asm-loongarch/kvm.h b/linux-headers/asm-loongarch/kvm.h
index 5f354f5c68..57ba1a563b 100644
--- a/linux-headers/asm-loongarch/kvm.h
+++ b/linux-headers/asm-loongarch/kvm.h
@@ -103,6 +103,7 @@ struct kvm_fpu {
 #define  KVM_LOONGARCH_VM_FEAT_PMU		5
 #define  KVM_LOONGARCH_VM_FEAT_PV_IPI		6
 #define  KVM_LOONGARCH_VM_FEAT_PV_STEALTIME	7
+#define  KVM_LOONGARCH_VM_FEAT_PTW		8
 
 /* Device Control API on vcpu fd */
 #define KVM_LOONGARCH_VCPU_CPUCFG	0
diff --git a/linux-headers/asm-riscv/kvm.h b/linux-headers/asm-riscv/kvm.h
index ef27d4289d..759a4852c0 100644
--- a/linux-headers/asm-riscv/kvm.h
+++ b/linux-headers/asm-riscv/kvm.h
@@ -9,7 +9,7 @@
 #ifndef __LINUX_KVM_RISCV_H
 #define __LINUX_KVM_RISCV_H
 
-#ifndef __ASSEMBLY__
+#ifndef __ASSEMBLER__
 
 #include <linux/types.h>
 #include <asm/bitsperlong.h>
@@ -56,6 +56,7 @@ struct kvm_riscv_config {
 	unsigned long mimpid;
 	unsigned long zicboz_block_size;
 	unsigned long satp_mode;
+	unsigned long zicbop_block_size;
 };
 
 /* CORE registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
@@ -185,6 +186,10 @@ enum KVM_RISCV_ISA_EXT_ID {
 	KVM_RISCV_ISA_EXT_ZICCRSE,
 	KVM_RISCV_ISA_EXT_ZAAMO,
 	KVM_RISCV_ISA_EXT_ZALRSC,
+	KVM_RISCV_ISA_EXT_ZICBOP,
+	KVM_RISCV_ISA_EXT_ZFBFMIN,
+	KVM_RISCV_ISA_EXT_ZVFBFMIN,
+	KVM_RISCV_ISA_EXT_ZVFBFWMA,
 	KVM_RISCV_ISA_EXT_MAX,
 };
 
@@ -205,6 +210,7 @@ enum KVM_RISCV_SBI_EXT_ID {
 	KVM_RISCV_SBI_EXT_DBCN,
 	KVM_RISCV_SBI_EXT_STA,
 	KVM_RISCV_SBI_EXT_SUSP,
+	KVM_RISCV_SBI_EXT_FWFT,
 	KVM_RISCV_SBI_EXT_MAX,
 };
 
@@ -214,6 +220,18 @@ struct kvm_riscv_sbi_sta {
 	unsigned long shmem_hi;
 };
 
+struct kvm_riscv_sbi_fwft_feature {
+	unsigned long enable;
+	unsigned long flags;
+	unsigned long value;
+};
+
+/* SBI FWFT extension registers for KVM_GET_ONE_REG and KVM_SET_ONE_REG */
+struct kvm_riscv_sbi_fwft {
+	struct kvm_riscv_sbi_fwft_feature misaligned_deleg;
+	struct kvm_riscv_sbi_fwft_feature pointer_masking;
+};
+
 /* Possible states for kvm_riscv_timer */
 #define KVM_RISCV_TIMER_STATE_OFF	0
 #define KVM_RISCV_TIMER_STATE_ON	1
@@ -297,6 +315,9 @@ struct kvm_riscv_sbi_sta {
 #define KVM_REG_RISCV_SBI_STA		(0x0 << KVM_REG_RISCV_SUBTYPE_SHIFT)
 #define KVM_REG_RISCV_SBI_STA_REG(name)		\
 		(offsetof(struct kvm_riscv_sbi_sta, name) / sizeof(unsigned long))
+#define KVM_REG_RISCV_SBI_FWFT		(0x1 << KVM_REG_RISCV_SUBTYPE_SHIFT)
+#define KVM_REG_RISCV_SBI_FWFT_REG(name)	\
+		(offsetof(struct kvm_riscv_sbi_fwft, name) / sizeof(unsigned long))
 
 /* Device Control API: RISC-V AIA */
 #define KVM_DEV_RISCV_APLIC_ALIGN		0x1000
diff --git a/linux-headers/asm-riscv/ptrace.h b/linux-headers/asm-riscv/ptrace.h
index 1e3166caca..a3f8211ede 100644
--- a/linux-headers/asm-riscv/ptrace.h
+++ b/linux-headers/asm-riscv/ptrace.h
@@ -6,7 +6,7 @@
 #ifndef _ASM_RISCV_PTRACE_H
 #define _ASM_RISCV_PTRACE_H
 
-#ifndef __ASSEMBLY__
+#ifndef __ASSEMBLER__
 
 #include <linux/types.h>
 
@@ -127,6 +127,6 @@ struct __riscv_v_regset_state {
  */
 #define RISCV_MAX_VLENB (8192)
 
-#endif /* __ASSEMBLY__ */
+#endif /* __ASSEMBLER__ */
 
 #endif /* _ASM_RISCV_PTRACE_H */
diff --git a/linux-headers/asm-x86/kvm.h b/linux-headers/asm-x86/kvm.h
index f0c1a730d9..3bb38f6c3a 100644
--- a/linux-headers/asm-x86/kvm.h
+++ b/linux-headers/asm-x86/kvm.h
@@ -35,6 +35,11 @@
 #define MC_VECTOR 18
 #define XM_VECTOR 19
 #define VE_VECTOR 20
+#define CP_VECTOR 21
+
+#define HV_VECTOR 28
+#define VC_VECTOR 29
+#define SX_VECTOR 30
 
 /* Select x86 specific features in <linux/kvm.h> */
 #define __KVM_HAVE_PIT
@@ -409,6 +414,35 @@ struct kvm_xcrs {
 	__u64 padding[16];
 };
 
+#define KVM_X86_REG_TYPE_MSR		2
+#define KVM_X86_REG_TYPE_KVM		3
+
+#define KVM_X86_KVM_REG_SIZE(reg)						\
+({										\
+	reg == KVM_REG_GUEST_SSP ? KVM_REG_SIZE_U64 : 0;			\
+})
+
+#define KVM_X86_REG_TYPE_SIZE(type, reg)					\
+({										\
+	__u64 type_size = (__u64)type << 32;					\
+										\
+	type_size |= type == KVM_X86_REG_TYPE_MSR ? KVM_REG_SIZE_U64 :		\
+		     type == KVM_X86_REG_TYPE_KVM ? KVM_X86_KVM_REG_SIZE(reg) :	\
+		     0;								\
+	type_size;								\
+})
+
+#define KVM_X86_REG_ID(type, index)				\
+	(KVM_REG_X86 | KVM_X86_REG_TYPE_SIZE(type, index) | index)
+
+#define KVM_X86_REG_MSR(index)					\
+	KVM_X86_REG_ID(KVM_X86_REG_TYPE_MSR, index)
+#define KVM_X86_REG_KVM(index)					\
+	KVM_X86_REG_ID(KVM_X86_REG_TYPE_KVM, index)
+
+/* KVM-defined registers starting from 0 */
+#define KVM_REG_GUEST_SSP	0
+
 #define KVM_SYNC_X86_REGS      (1UL << 0)
 #define KVM_SYNC_X86_SREGS     (1UL << 1)
 #define KVM_SYNC_X86_EVENTS    (1UL << 2)
diff --git a/linux-headers/asm-x86/unistd_64.h b/linux-headers/asm-x86/unistd_64.h
index 2f55bebb81..26c258d1a6 100644
--- a/linux-headers/asm-x86/unistd_64.h
+++ b/linux-headers/asm-x86/unistd_64.h
@@ -337,6 +337,7 @@
 #define __NR_io_pgetevents 333
 #define __NR_rseq 334
 #define __NR_uretprobe 335
+#define __NR_uprobe 336
 #define __NR_pidfd_send_signal 424
 #define __NR_io_uring_setup 425
 #define __NR_io_uring_enter 426
diff --git a/linux-headers/asm-x86/unistd_x32.h b/linux-headers/asm-x86/unistd_x32.h
index 8cc8673f15..65c2aed946 100644
--- a/linux-headers/asm-x86/unistd_x32.h
+++ b/linux-headers/asm-x86/unistd_x32.h
@@ -290,6 +290,7 @@
 #define __NR_io_pgetevents (__X32_SYSCALL_BIT + 333)
 #define __NR_rseq (__X32_SYSCALL_BIT + 334)
 #define __NR_uretprobe (__X32_SYSCALL_BIT + 335)
+#define __NR_uprobe (__X32_SYSCALL_BIT + 336)
 #define __NR_pidfd_send_signal (__X32_SYSCALL_BIT + 424)
 #define __NR_io_uring_setup (__X32_SYSCALL_BIT + 425)
 #define __NR_io_uring_enter (__X32_SYSCALL_BIT + 426)
diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index be704965d8..4ea28ef7ca 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -954,6 +954,7 @@ struct kvm_enable_cap {
 #define KVM_CAP_ARM_EL2_E2H0 241
 #define KVM_CAP_RISCV_MP_STATE_RESET 242
 #define KVM_CAP_ARM_CACHEABLE_PFNMAP_SUPPORTED 243
+#define KVM_CAP_GUEST_MEMFD_FLAGS 244
 
 struct kvm_irq_routing_irqchip {
 	__u32 irqchip;
@@ -1590,6 +1591,8 @@ struct kvm_memory_attributes {
 #define KVM_MEMORY_ATTRIBUTE_PRIVATE           (1ULL << 3)
 
 #define KVM_CREATE_GUEST_MEMFD	_IOWR(KVMIO,  0xd4, struct kvm_create_guest_memfd)
+#define GUEST_MEMFD_FLAG_MMAP		(1ULL << 0)
+#define GUEST_MEMFD_FLAG_INIT_SHARED	(1ULL << 1)
 
 struct kvm_create_guest_memfd {
 	__u64 size;
diff --git a/linux-headers/linux/psp-sev.h b/linux-headers/linux/psp-sev.h
index 113c4ceb78..c525125ea8 100644
--- a/linux-headers/linux/psp-sev.h
+++ b/linux-headers/linux/psp-sev.h
@@ -185,6 +185,10 @@ struct sev_user_data_get_id2 {
  * @mask_chip_id: whether chip id is present in attestation reports or not
  * @mask_chip_key: whether attestation reports are signed or not
  * @vlek_en: VLEK (Version Loaded Endorsement Key) hashstick is loaded
+ * @feature_info: whether SNP_FEATURE_INFO command is available
+ * @rapl_dis: whether RAPL is disabled
+ * @ciphertext_hiding_cap: whether platform has ciphertext hiding capability
+ * @ciphertext_hiding_en: whether ciphertext hiding is enabled
  * @rsvd1: reserved
  * @guest_count: the number of guest currently managed by the firmware
  * @current_tcb_version: current TCB version
@@ -200,7 +204,11 @@ struct sev_user_data_snp_status {
 	__u32 mask_chip_id:1;		/* Out */
 	__u32 mask_chip_key:1;		/* Out */
 	__u32 vlek_en:1;		/* Out */
-	__u32 rsvd1:29;
+	__u32 feature_info:1;		/* Out */
+	__u32 rapl_dis:1;		/* Out */
+	__u32 ciphertext_hiding_cap:1;	/* Out */
+	__u32 ciphertext_hiding_en:1;	/* Out */
+	__u32 rsvd1:25;
 	__u32 guest_count;		/* Out */
 	__u64 current_tcb_version;	/* Out */
 	__u64 reported_tcb_version;	/* Out */
diff --git a/linux-headers/linux/stddef.h b/linux-headers/linux/stddef.h
index e1fcfcf3b3..48ee4438e0 100644
--- a/linux-headers/linux/stddef.h
+++ b/linux-headers/linux/stddef.h
@@ -3,7 +3,6 @@
 #define _LINUX_STDDEF_H
 
 
-
 #ifndef __always_inline
 #define __always_inline __inline__
 #endif
diff --git a/linux-headers/linux/vduse.h b/linux-headers/linux/vduse.h
index f46269af34..da6ac89af1 100644
--- a/linux-headers/linux/vduse.h
+++ b/linux-headers/linux/vduse.h
@@ -237,7 +237,7 @@ struct vduse_iova_umem {
  * struct vduse_iova_info - information of one IOVA region
  * @start: start of the IOVA region
  * @last: last of the IOVA region
- * @capability: capability of the IOVA regsion
+ * @capability: capability of the IOVA region
  * @reserved: for future use, needs to be initialized to zero
  *
  * Structure used by VDUSE_IOTLB_GET_INFO ioctl to get information of
diff --git a/linux-headers/linux/vhost.h b/linux-headers/linux/vhost.h
index 283348b64a..c57674a6aa 100644
--- a/linux-headers/linux/vhost.h
+++ b/linux-headers/linux/vhost.h
@@ -260,7 +260,7 @@
  * When fork_owner is set to VHOST_FORK_OWNER_KTHREAD:
  *   - Vhost will create vhost workers as kernel threads.
  */
-#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x83, __u8)
+#define VHOST_SET_FORK_FROM_OWNER _IOW(VHOST_VIRTIO, 0x84, __u8)
 
 /**
  * VHOST_GET_FORK_OWNER - Get the current fork_owner flag for the vhost device.
@@ -268,6 +268,6 @@
  *
  * @return: An 8-bit value indicating the current thread mode.
  */
-#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x84, __u8)
+#define VHOST_GET_FORK_FROM_OWNER _IOR(VHOST_VIRTIO, 0x85, __u8)
 
 #endif

From c981119dab04ac20f86ae755a669d74fc1373cb7 Mon Sep 17 00:00:00 2001
From: Bibo Mao <maobibo@loongson.cn>
Date: Mon, 27 Oct 2025 09:54:55 +0800
Subject: [PATCH 1759/2396] target/loongarch: Add PTW feature support in KVM
 mode

Implement Hardware page table walker(PTW for short) feature in KVM mode.
Use OnOffAuto type variable ptw to check the PTW feature. If the PTW
feature is not supported on KVM host, there is error reported with ptw=on
option.

By default PTW feature is disabled on la464 CPU type, and auto detected
on max CPU type.

Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Song Gao <gaosong@loongson.cn>
---
 target/loongarch/cpu.c     |  6 +++---
 target/loongarch/cpu.h     |  1 +
 target/loongarch/kvm/kvm.c | 35 +++++++++++++++++++++++++++++++++++
 3 files changed, 39 insertions(+), 3 deletions(-)

diff --git a/target/loongarch/cpu.c b/target/loongarch/cpu.c
index e80a92fb2e..d74c3c3766 100644
--- a/target/loongarch/cpu.c
+++ b/target/loongarch/cpu.c
@@ -236,7 +236,7 @@ static void loongarch_set_ptw(Object *obj, bool value, Error **errp)
     cpu->ptw = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 
     if (kvm_enabled()) {
-        /* PTW feature is only support in TCG mode now */
+        /* kvm feature detection in function kvm_arch_init_vcpu */
         return;
     }
 
@@ -406,14 +406,14 @@ static void loongarch_la132_initfn(Object *obj)
 static void loongarch_max_initfn(Object *obj)
 {
     LoongArchCPU *cpu = LOONGARCH_CPU(obj);
-    /* '-cpu max' for TCG: we use cpu la464. */
+    /* '-cpu max': use it for max supported CPU features */
     loongarch_la464_initfn(obj);
 
+    cpu->ptw = ON_OFF_AUTO_AUTO;
     if (tcg_enabled()) {
         cpu->env.cpucfg[1] = FIELD_DP32(cpu->env.cpucfg[1], CPUCFG1, MSG_INT, 1);
         cpu->msgint = ON_OFF_AUTO_AUTO;
         cpu->env.cpucfg[2] = FIELD_DP32(cpu->env.cpucfg[2], CPUCFG2, HPTW, 1);
-        cpu->ptw = ON_OFF_AUTO_AUTO;
     }
 }
 
diff --git a/target/loongarch/cpu.h b/target/loongarch/cpu.h
index b1d6799222..1a14469b3b 100644
--- a/target/loongarch/cpu.h
+++ b/target/loongarch/cpu.h
@@ -279,6 +279,7 @@ enum loongarch_features {
     LOONGARCH_FEATURE_PMU,
     LOONGARCH_FEATURE_PV_IPI,
     LOONGARCH_FEATURE_STEALTIME,
+    LOONGARCH_FEATURE_PTW,
 };
 
 typedef struct  LoongArchBT {
diff --git a/target/loongarch/kvm/kvm.c b/target/loongarch/kvm/kvm.c
index 4e4f4e79f6..26e40c9bdc 100644
--- a/target/loongarch/kvm/kvm.c
+++ b/target/loongarch/kvm/kvm.c
@@ -931,6 +931,12 @@ static bool kvm_feature_supported(CPUState *cs, enum loongarch_features feature)
         ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
         return (ret == 0);
 
+    case LOONGARCH_FEATURE_PTW:
+        attr.group = KVM_LOONGARCH_VM_FEAT_CTRL;
+        attr.attr = KVM_LOONGARCH_VM_FEAT_PTW;
+        ret = kvm_vm_ioctl(kvm_state, KVM_HAS_DEVICE_ATTR, &attr);
+        return (ret == 0);
+
     default:
         return false;
     }
@@ -1029,6 +1035,29 @@ static int kvm_cpu_check_pmu(CPUState *cs, Error **errp)
     return 0;
 }
 
+static int kvm_cpu_check_ptw(CPUState *cs, Error **errp)
+{
+    LoongArchCPU *cpu = LOONGARCH_CPU(cs);
+    CPULoongArchState *env = cpu_env(cs);
+    bool kvm_supported;
+
+    kvm_supported = kvm_feature_supported(cs, LOONGARCH_FEATURE_PTW);
+    if (cpu->ptw == ON_OFF_AUTO_ON) {
+        if (!kvm_supported) {
+            error_setg(errp, "'ptw' feature not supported by KVM on the host");
+            return -ENOTSUP;
+        }
+    } else if (cpu->ptw != ON_OFF_AUTO_AUTO) {
+        /* disable pmu if ON_OFF_AUTO_OFF is set */
+        kvm_supported = false;
+    }
+
+    if (kvm_supported) {
+        env->cpucfg[2] = FIELD_DP32(env->cpucfg[2], CPUCFG2, HPTW, 1);
+    }
+    return 0;
+}
+
 static int kvm_cpu_check_pv_features(CPUState *cs, Error **errp)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
@@ -1123,6 +1152,12 @@ int kvm_arch_init_vcpu(CPUState *cs)
         return ret;
     }
 
+    ret = kvm_cpu_check_ptw(cs, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+        return ret;
+    }
+
     return 0;
 }
 

From 169e8d0c4b014fed1785fd3e31932ce92b15883f Mon Sep 17 00:00:00 2001
From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Date: Fri, 3 Oct 2025 21:39:42 +1000
Subject: [PATCH 1760/2396] spdm-socket: add seperate send/recv functions

This is to support uni-directional transports such as SPDM over Storage.
As specified by the DMTF DSP0286.

Also update spdm_socket_rsp() to use the new send()/receive() functions. For
the case of spdm_socket_receive(), this allows us to do error checking
in one place with the addition of spdm_socket_command_valid().

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 backends/spdm-socket.c       | 58 ++++++++++++++++++++++++++++--------
 include/system/spdm-socket.h | 32 ++++++++++++++++++++
 2 files changed, 77 insertions(+), 13 deletions(-)

diff --git a/backends/spdm-socket.c b/backends/spdm-socket.c
index 2c709c68c8..ab74a02d9c 100644
--- a/backends/spdm-socket.c
+++ b/backends/spdm-socket.c
@@ -184,29 +184,61 @@ int spdm_socket_connect(uint16_t port, Error **errp)
     return client_socket;
 }
 
-uint32_t spdm_socket_rsp(const int socket, uint32_t transport_type,
-                         void *req, uint32_t req_len,
-                         void *rsp, uint32_t rsp_len)
+static bool spdm_socket_command_valid(uint32_t command)
+{
+    switch (command) {
+    case SPDM_SOCKET_COMMAND_NORMAL:
+    case SPDM_SOCKET_STORAGE_CMD_IF_SEND:
+    case SPDM_SOCKET_STORAGE_CMD_IF_RECV:
+    case SOCKET_SPDM_STORAGE_ACK_STATUS:
+    case SPDM_SOCKET_COMMAND_OOB_ENCAP_KEY_UPDATE:
+    case SPDM_SOCKET_COMMAND_CONTINUE:
+    case SPDM_SOCKET_COMMAND_SHUTDOWN:
+    case SPDM_SOCKET_COMMAND_UNKOWN:
+    case SPDM_SOCKET_COMMAND_TEST:
+        return true;
+    default:
+        return false;
+    }
+}
+
+uint32_t spdm_socket_receive(const int socket, uint32_t transport_type,
+                             void *rsp, uint32_t rsp_len)
 {
     uint32_t command;
     bool result;
 
-    result = send_platform_data(socket, transport_type,
-                                SPDM_SOCKET_COMMAND_NORMAL,
-                                req, req_len);
-    if (!result) {
-        return 0;
-    }
-
     result = receive_platform_data(socket, transport_type, &command,
                                    (uint8_t *)rsp, &rsp_len);
+
+    /* we may have received some data, but check if the command is valid */
+    if (!result || !spdm_socket_command_valid(command)) {
+        return 0;
+    }
+
+    return rsp_len;
+}
+
+bool spdm_socket_send(const int socket, uint32_t socket_cmd,
+                      uint32_t transport_type, void *req, uint32_t req_len)
+{
+    return send_platform_data(socket, transport_type, socket_cmd, req,
+                              req_len);
+}
+
+uint32_t spdm_socket_rsp(const int socket, uint32_t transport_type,
+                         void *req, uint32_t req_len,
+                         void *rsp, uint32_t rsp_len)
+{
+    bool result;
+
+    result = spdm_socket_send(socket, SPDM_SOCKET_COMMAND_NORMAL,
+                              transport_type, req, req_len);
     if (!result) {
         return 0;
     }
 
-    assert(command != 0);
-
-    return rsp_len;
+    return spdm_socket_receive(socket, transport_type, rsp, rsp_len);
 }
 
 void spdm_socket_close(const int socket, uint32_t transport_type)
diff --git a/include/system/spdm-socket.h b/include/system/spdm-socket.h
index 5d8bd9aa4e..29aa04fd52 100644
--- a/include/system/spdm-socket.h
+++ b/include/system/spdm-socket.h
@@ -50,6 +50,35 @@ uint32_t spdm_socket_rsp(const int socket, uint32_t transport_type,
                          void *req, uint32_t req_len,
                          void *rsp, uint32_t rsp_len);
 
+/**
+ * spdm_socket_rsp: Receive a message from an SPDM server
+ * @socket: socket returned from spdm_socket_connect()
+ * @transport_type: SPDM_SOCKET_TRANSPORT_TYPE_* macro
+ * @rsp: response buffer
+ * @rsp_len: response buffer length
+ *
+ * Receives a message from the SPDM server and returns the number of bytes
+ * received or 0 on failure. This can be used to receive a message from the SPDM
+ * server without sending anything first.
+ */
+uint32_t spdm_socket_receive(const int socket, uint32_t transport_type,
+                             void *rsp, uint32_t rsp_len);
+
+/**
+ * spdm_socket_rsp: Sends a message to an SPDM server
+ * @socket: socket returned from spdm_socket_connect()
+ * @socket_cmd: socket command type (normal/if_recv/if_send etc...)
+ * @transport_type: SPDM_SOCKET_TRANSPORT_TYPE_* macro
+ * @req: request buffer
+ * @req_len: request buffer length
+ *
+ * Sends platform data to a SPDM server on socket, returns true on success.
+ * The response from the server must then be fetched by using
+ * spdm_socket_receive().
+ */
+bool spdm_socket_send(const int socket, uint32_t socket_cmd,
+                      uint32_t transport_type, void *req, uint32_t req_len);
+
 /**
  * spdm_socket_close: send a shutdown command to the server
  * @socket: socket returned from spdm_socket_connect()
@@ -60,6 +89,9 @@ uint32_t spdm_socket_rsp(const int socket, uint32_t transport_type,
 void spdm_socket_close(const int socket, uint32_t transport_type);
 
 #define SPDM_SOCKET_COMMAND_NORMAL                0x0001
+#define SPDM_SOCKET_STORAGE_CMD_IF_SEND           0x0002
+#define SPDM_SOCKET_STORAGE_CMD_IF_RECV           0x0003
+#define SOCKET_SPDM_STORAGE_ACK_STATUS            0x0004
 #define SPDM_SOCKET_COMMAND_OOB_ENCAP_KEY_UPDATE  0x8001
 #define SPDM_SOCKET_COMMAND_CONTINUE              0xFFFD
 #define SPDM_SOCKET_COMMAND_SHUTDOWN              0xFFFE

From 64a9336a413beb3f6e90a2fa12b761043d10b68d Mon Sep 17 00:00:00 2001
From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Date: Fri, 3 Oct 2025 21:39:43 +1000
Subject: [PATCH 1761/2396] spdm: add spdm storage transport virtual header

This header contains the transport encoding for an SPDM message that
uses the SPDM over Storage transport as defined by the DMTF DSP0286.

Note that in the StorageSpdmTransportHeader structure, security_protocol
field is defined in the SCSI Primary Commands 5 (SPC-5) specification.
The NVMe specification also refers to the SPC-5 for this definition.
The security_protocol_specific field is defined in DSP0286 and is
referred to as SP Specific for NVMe and ATA.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 include/system/spdm-socket.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/include/system/spdm-socket.h b/include/system/spdm-socket.h
index 29aa04fd52..8c07dc12d2 100644
--- a/include/system/spdm-socket.h
+++ b/include/system/spdm-socket.h
@@ -88,6 +88,20 @@ bool spdm_socket_send(const int socket, uint32_t socket_cmd,
  */
 void spdm_socket_close(const int socket, uint32_t transport_type);
 
+/*
+ * Defines the transport encoding for SPDM, this information shall be passed
+ * down to the SPDM server, when conforming to the SPDM over Storage standard
+ * as defined by DSP0286.
+ */
+typedef struct {
+    uint8_t security_protocol;              /* Must be 0xE8 for SPDM Commands
+                                               as per SCSI Primary Commands 5 */
+    uint16_t security_protocol_specific;    /* Bit[7:2] SPDM Operation
+                                               Bit[0:1] Connection ID
+                                               per DSP0286 1.0: Section 7.2 */
+    uint32_t length;                        /* Length of the SPDM Message*/
+} QEMU_PACKED StorageSpdmTransportHeader;
+
 #define SPDM_SOCKET_COMMAND_NORMAL                0x0001
 #define SPDM_SOCKET_STORAGE_CMD_IF_SEND           0x0002
 #define SPDM_SOCKET_STORAGE_CMD_IF_RECV           0x0003

From e5534abeb4575db0afc2664e542b26975413fd5a Mon Sep 17 00:00:00 2001
From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Date: Fri, 3 Oct 2025 21:39:44 +1000
Subject: [PATCH 1762/2396] hw/nvme: add NVMe Admin Security SPDM support

Adds the NVMe Admin Security Send/Receive command support with support
for DMTFs SPDM. The transport binding for SPDM is defined in the
DMTF DSP0286.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c               | 212 ++++++++++++++++++++++++++++++++++-
 hw/nvme/nvme.h               |   5 +
 include/block/nvme.h         |  15 +++
 include/system/spdm-socket.h |   2 +
 4 files changed, 233 insertions(+), 1 deletion(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index cd81f73997..e450e785ea 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -282,6 +282,8 @@ static const uint32_t nvme_cse_acs_default[256] = {
     [NVME_ADM_CMD_FORMAT_NVM]       = NVME_CMD_EFF_CSUPP | NVME_CMD_EFF_LBCC,
     [NVME_ADM_CMD_DIRECTIVE_RECV]   = NVME_CMD_EFF_CSUPP,
     [NVME_ADM_CMD_DIRECTIVE_SEND]   = NVME_CMD_EFF_CSUPP,
+    [NVME_ADM_CMD_SECURITY_SEND]    = NVME_CMD_EFF_CSUPP,
+    [NVME_ADM_CMD_SECURITY_RECV]    = NVME_CMD_EFF_CSUPP,
 };
 
 static const uint32_t nvme_cse_iocs_nvm_default[256] = {
@@ -7282,6 +7284,207 @@ static uint16_t nvme_dbbuf_config(NvmeCtrl *n, const NvmeRequest *req)
     return NVME_SUCCESS;
 }
 
+static uint16_t nvme_sec_prot_spdm_send(NvmeCtrl *n, NvmeRequest *req)
+{
+    StorageSpdmTransportHeader hdr = {0};
+    g_autofree uint8_t *sec_buf = NULL;
+    uint32_t transfer_len = le32_to_cpu(req->cmd.cdw11);
+    uint32_t transport_transfer_len = transfer_len;
+    uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
+    uint32_t recvd;
+    uint16_t nvme_cmd_status, ret;
+    uint8_t secp = extract32(dw10, 24, 8);
+    uint16_t spsp = extract32(dw10, 8, 16);
+    bool spdm_res;
+
+    if (transport_transfer_len > UINT32_MAX - sizeof(hdr)) {
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
+    transport_transfer_len += sizeof(hdr);
+    if (transport_transfer_len > SPDM_SOCKET_MAX_MESSAGE_BUFFER_SIZE) {
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
+    ret = nvme_check_mdts(n, transport_transfer_len);
+    if (ret != NVME_SUCCESS) {
+        return ret;
+    }
+
+    /* Generate the NVMe transport header */
+    hdr.security_protocol = secp;
+    hdr.security_protocol_specific = cpu_to_le16(spsp);
+    hdr.length = cpu_to_le32(transfer_len);
+
+    sec_buf = g_try_malloc0(transport_transfer_len);
+    if (!sec_buf) {
+        return NVME_INTERNAL_DEV_ERROR;
+    }
+
+    /* Attach the transport header */
+    memcpy(sec_buf, &hdr, sizeof(hdr));
+    ret = nvme_h2c(n, sec_buf + sizeof(hdr), transfer_len, req);
+    if (ret) {
+        return ret;
+    }
+
+    spdm_res = spdm_socket_send(n->spdm_socket, SPDM_SOCKET_STORAGE_CMD_IF_SEND,
+                                SPDM_SOCKET_TRANSPORT_TYPE_NVME, sec_buf,
+                                transport_transfer_len);
+    if (!spdm_res) {
+        return NVME_DATA_TRAS_ERROR | NVME_DNR;
+    }
+
+    /* The responder shall ack with message status */
+    recvd = spdm_socket_receive(n->spdm_socket, SPDM_SOCKET_TRANSPORT_TYPE_NVME,
+                                &nvme_cmd_status,
+                                SPDM_SOCKET_MAX_MSG_STATUS_LEN);
+
+    nvme_cmd_status = be16_to_cpu(nvme_cmd_status);
+
+    if (recvd < SPDM_SOCKET_MAX_MSG_STATUS_LEN) {
+        return NVME_DATA_TRAS_ERROR | NVME_DNR;
+    }
+
+    return nvme_cmd_status;
+}
+
+/* From host to controller */
+static uint16_t nvme_security_send(NvmeCtrl *n, NvmeRequest *req)
+{
+    uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
+    uint8_t secp = extract32(dw10, 24, 8);
+
+    switch (secp) {
+    case NVME_SEC_PROT_DMTF_SPDM:
+        if (n->spdm_socket < 0) {
+            return NVME_INVALID_FIELD | NVME_DNR;
+        }
+        return nvme_sec_prot_spdm_send(n, req);
+    default:
+        /* Unsupported Security Protocol Type */
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
+    return NVME_INVALID_FIELD | NVME_DNR;
+}
+
+static uint16_t nvme_sec_prot_spdm_receive(NvmeCtrl *n, NvmeRequest *req)
+{
+    StorageSpdmTransportHeader hdr;
+    g_autofree uint8_t *rsp_spdm_buf = NULL;
+    uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
+    uint32_t alloc_len = le32_to_cpu(req->cmd.cdw11);
+    uint32_t recvd, spdm_res;
+    uint16_t nvme_cmd_status, ret;
+    uint8_t secp = extract32(dw10, 24, 8);
+    uint8_t spsp = extract32(dw10, 8, 16);
+    if (!alloc_len) {
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
+    /* Generate the NVMe transport header */
+    hdr = (StorageSpdmTransportHeader) {
+        .security_protocol = secp,
+        .security_protocol_specific = cpu_to_le16(spsp),
+        .length = cpu_to_le32(alloc_len),
+    };
+
+    /* Forward if_recv to the SPDM Server with SPSP0 */
+    spdm_res = spdm_socket_send(n->spdm_socket, SPDM_SOCKET_STORAGE_CMD_IF_RECV,
+                                SPDM_SOCKET_TRANSPORT_TYPE_NVME,
+                                &hdr, sizeof(hdr));
+    if (!spdm_res) {
+        return NVME_DATA_TRAS_ERROR | NVME_DNR;
+    }
+
+    /* The responder shall ack with message status */
+    recvd = spdm_socket_receive(n->spdm_socket, SPDM_SOCKET_TRANSPORT_TYPE_NVME,
+                                &nvme_cmd_status,
+                                SPDM_SOCKET_MAX_MSG_STATUS_LEN);
+    if (recvd < SPDM_SOCKET_MAX_MSG_STATUS_LEN) {
+        return NVME_DATA_TRAS_ERROR | NVME_DNR;
+    }
+
+    nvme_cmd_status = be16_to_cpu(nvme_cmd_status);
+    /* An error here implies the prior if_recv from requester was spurious */
+    if (nvme_cmd_status != NVME_SUCCESS) {
+        return nvme_cmd_status;
+    }
+
+    /* Clear to start receiving data from the server */
+    rsp_spdm_buf = g_try_malloc0(alloc_len);
+    if (!rsp_spdm_buf) {
+        return NVME_INTERNAL_DEV_ERROR;
+    }
+
+    recvd = spdm_socket_receive(n->spdm_socket,
+                                SPDM_SOCKET_TRANSPORT_TYPE_NVME,
+                                rsp_spdm_buf, alloc_len);
+    if (!recvd) {
+        return NVME_DATA_TRAS_ERROR | NVME_DNR;
+    }
+
+    ret = nvme_c2h(n, rsp_spdm_buf, MIN(recvd, alloc_len), req);
+    if (ret) {
+        return ret;
+    }
+
+    return NVME_SUCCESS;
+}
+
+static uint16_t nvme_get_sec_prot_info(NvmeCtrl *n, NvmeRequest *req)
+{
+    uint32_t alloc_len = le32_to_cpu(req->cmd.cdw11);
+    uint8_t resp[10] = {
+        /* Support Security Protol List Length */
+        [6] = 0, /* MSB */
+        [7] = 2, /* LSB */
+        /* Support Security Protocol List */
+        [8] = SFSC_SECURITY_PROT_INFO,
+        [9] = 0,
+    };
+
+    if (n->spdm_socket >= 0) {
+        resp[9] = NVME_SEC_PROT_DMTF_SPDM;
+    }
+
+    if (alloc_len < 10) {
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+
+    return nvme_c2h(n, resp, sizeof(resp), req);
+}
+
+/* From controller to host */
+static uint16_t nvme_security_receive(NvmeCtrl *n, NvmeRequest *req)
+{
+    uint32_t dw10 = le32_to_cpu(req->cmd.cdw10);
+    uint16_t spsp = extract32(dw10, 8, 16);
+    uint8_t secp = extract32(dw10, 24, 8);
+
+    switch (secp) {
+    case SFSC_SECURITY_PROT_INFO:
+        switch (spsp) {
+        case 0:
+            /* Supported security protocol list */
+            return nvme_get_sec_prot_info(n, req);
+        case 1:
+            /* Certificate data */
+            /* fallthrough */
+        default:
+            return NVME_INVALID_FIELD | NVME_DNR;
+        }
+    case NVME_SEC_PROT_DMTF_SPDM:
+        if (n->spdm_socket < 0) {
+            return NVME_INVALID_FIELD | NVME_DNR;
+        }
+        return nvme_sec_prot_spdm_receive(n, req);
+    default:
+        return NVME_INVALID_FIELD | NVME_DNR;
+    }
+}
+
 static uint16_t nvme_directive_send(NvmeCtrl *n, NvmeRequest *req)
 {
     return NVME_INVALID_FIELD | NVME_DNR;
@@ -7389,6 +7592,10 @@ static uint16_t nvme_admin_cmd(NvmeCtrl *n, NvmeRequest *req)
         return nvme_directive_send(n, req);
     case NVME_ADM_CMD_DIRECTIVE_RECV:
         return nvme_directive_receive(n, req);
+    case NVME_ADM_CMD_SECURITY_SEND:
+        return nvme_security_send(n, req);
+    case NVME_ADM_CMD_SECURITY_RECV:
+        return nvme_security_receive(n, req);
     default:
         g_assert_not_reached();
     }
@@ -8459,6 +8666,8 @@ static void nvme_init_state(NvmeCtrl *n)
         sctrl->vfn = cpu_to_le16(i + 1);
     }
 
+    n->spdm_socket = -1;
+
     cap->cntlid = cpu_to_le16(n->cntlid);
     cap->crt = NVME_CRT_VQ | NVME_CRT_VI;
 
@@ -8820,7 +9029,8 @@ static void nvme_init_ctrl(NvmeCtrl *n, PCIDevice *pci_dev)
     id->mdts = n->params.mdts;
     id->ver = cpu_to_le32(NVME_SPEC_VER);
 
-    oacs = NVME_OACS_NMS | NVME_OACS_FORMAT | NVME_OACS_DIRECTIVES;
+    oacs = NVME_OACS_NMS | NVME_OACS_FORMAT | NVME_OACS_DIRECTIVES |
+           NVME_OACS_SECURITY;
 
     if (n->params.dbcs) {
         oacs |= NVME_OACS_DBCS;
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index b5c9378ea4..67ed562e00 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -461,6 +461,8 @@ static inline const char *nvme_adm_opc_str(uint8_t opc)
     case NVME_ADM_CMD_DIRECTIVE_RECV:   return "NVME_ADM_CMD_DIRECTIVE_RECV";
     case NVME_ADM_CMD_DBBUF_CONFIG:     return "NVME_ADM_CMD_DBBUF_CONFIG";
     case NVME_ADM_CMD_FORMAT_NVM:       return "NVME_ADM_CMD_FORMAT_NVM";
+    case NVME_ADM_CMD_SECURITY_SEND:    return "NVME_ADM_CMD_SECURITY_SEND";
+    case NVME_ADM_CMD_SECURITY_RECV:    return "NVME_ADM_CMD_SECURITY_RECV";
     default:                            return "NVME_ADM_CMD_UNKNOWN";
     }
 }
@@ -648,6 +650,9 @@ typedef struct NvmeCtrl {
     } next_pri_ctrl_cap;    /* These override pri_ctrl_cap after reset */
     uint32_t    dn; /* Disable Normal */
     NvmeAtomic  atomic;
+
+    /* Socket mapping to SPDM over NVMe Security In/Out commands */
+    int spdm_socket;
 } NvmeCtrl;
 
 typedef enum NvmeResetType {
diff --git a/include/block/nvme.h b/include/block/nvme.h
index 358e516e38..9fa2ecaf28 100644
--- a/include/block/nvme.h
+++ b/include/block/nvme.h
@@ -1779,6 +1779,21 @@ enum NvmeDirectiveOperations {
     NVME_DIRECTIVE_RETURN_PARAMS = 0x1,
 };
 
+typedef enum SfscSecurityProtocol {
+    SFSC_SECURITY_PROT_INFO = 0x00,
+} SfscSecurityProtocol;
+
+typedef enum NvmeSecurityProtocols {
+    NVME_SEC_PROT_DMTF_SPDM    = 0xE8,
+} NvmeSecurityProtocols;
+
+typedef enum SpdmOperationCodes {
+    SPDM_STORAGE_DISCOVERY      = 0x1, /* Mandatory */
+    SPDM_STORAGE_PENDING_INFO   = 0x2, /* Optional */
+    SPDM_STORAGE_MSG            = 0x5, /* Mandatory */
+    SPDM_STORAGE_SEC_MSG        = 0x6, /* Optional */
+} SpdmOperationCodes;
+
 typedef struct QEMU_PACKED NvmeFdpConfsHdr {
     uint16_t num_confs;
     uint8_t  version;
diff --git a/include/system/spdm-socket.h b/include/system/spdm-socket.h
index 8c07dc12d2..e611633812 100644
--- a/include/system/spdm-socket.h
+++ b/include/system/spdm-socket.h
@@ -114,7 +114,9 @@ typedef struct {
 
 #define SPDM_SOCKET_TRANSPORT_TYPE_MCTP           0x01
 #define SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE        0x02
+#define SPDM_SOCKET_TRANSPORT_TYPE_NVME           0x04
 
 #define SPDM_SOCKET_MAX_MESSAGE_BUFFER_SIZE       0x1200
+#define SPDM_SOCKET_MAX_MSG_STATUS_LEN            0x02
 
 #endif

From 3d8412c2fbe9387ece65d6acb8708960bf762693 Mon Sep 17 00:00:00 2001
From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Date: Fri, 3 Oct 2025 21:39:45 +1000
Subject: [PATCH 1763/2396] spdm: define SPDM transport enum types

SPDM maybe used over different transports. This patch specifies the
trasnport types as an enum with a qdev property definition such that
a user input transport type (string) can be mapped directly into the
respective SPDM transportenum for internal use.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 backends/spdm-socket.c       | 23 +++++++++++++++++++++++
 include/system/spdm-socket.h | 19 +++++++++++++++----
 2 files changed, 38 insertions(+), 4 deletions(-)

diff --git a/backends/spdm-socket.c b/backends/spdm-socket.c
index ab74a02d9c..6d8f02d3b9 100644
--- a/backends/spdm-socket.c
+++ b/backends/spdm-socket.c
@@ -13,6 +13,9 @@
 #include "qemu/osdep.h"
 #include "system/spdm-socket.h"
 #include "qapi/error.h"
+#include "hw/qdev-properties.h"
+#include "hw/qdev-properties-system.h"
+#include "hw/core/qdev-prop-internal.h"
 
 static bool read_bytes(const int socket, uint8_t *buffer,
                        size_t number_of_bytes)
@@ -246,3 +249,23 @@ void spdm_socket_close(const int socket, uint32_t transport_type)
     send_platform_data(socket, transport_type,
                        SPDM_SOCKET_COMMAND_SHUTDOWN, NULL, 0);
 }
+
+const QEnumLookup SpdmTransport_lookup = {
+    .array = (const char *const[]) {
+        [SPDM_SOCKET_TRANSPORT_TYPE_UNSPEC] = "unspecified",
+        [SPDM_SOCKET_TRANSPORT_TYPE_MCTP] = "mctp",
+        [SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE] = "doe",
+        [SPDM_SOCKET_TRANSPORT_TYPE_SCSI] = "scsi",
+        [SPDM_SOCKET_TRANSPORT_TYPE_NVME] = "nvme",
+    },
+    .size = SPDM_SOCKET_TRANSPORT_TYPE_MAX
+};
+
+const PropertyInfo qdev_prop_spdm_trans = {
+    .type = "SpdmTransportType",
+    .description = "Spdm Transport, doe/nvme/mctp/scsi/unspecified",
+    .enum_table = &SpdmTransport_lookup,
+    .get = qdev_propinfo_get_enum,
+    .set = qdev_propinfo_set_enum,
+    .set_default_value = qdev_propinfo_set_default_value_enum,
+};
diff --git a/include/system/spdm-socket.h b/include/system/spdm-socket.h
index e611633812..00cb0e97f3 100644
--- a/include/system/spdm-socket.h
+++ b/include/system/spdm-socket.h
@@ -112,11 +112,22 @@ typedef struct {
 #define SPDM_SOCKET_COMMAND_UNKOWN                0xFFFF
 #define SPDM_SOCKET_COMMAND_TEST                  0xDEAD
 
-#define SPDM_SOCKET_TRANSPORT_TYPE_MCTP           0x01
-#define SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE        0x02
-#define SPDM_SOCKET_TRANSPORT_TYPE_NVME           0x04
-
 #define SPDM_SOCKET_MAX_MESSAGE_BUFFER_SIZE       0x1200
 #define SPDM_SOCKET_MAX_MSG_STATUS_LEN            0x02
 
+typedef enum SpdmTransportType {
+    SPDM_SOCKET_TRANSPORT_TYPE_UNSPEC = 0,
+    SPDM_SOCKET_TRANSPORT_TYPE_MCTP,
+    SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE,
+    SPDM_SOCKET_TRANSPORT_TYPE_SCSI,
+    SPDM_SOCKET_TRANSPORT_TYPE_NVME,
+    SPDM_SOCKET_TRANSPORT_TYPE_MAX
+} SpdmTransportType;
+
+extern const PropertyInfo qdev_prop_spdm_trans;
+
+#define DEFINE_PROP_SPDM_TRANS(_name, _state, _field, _default) \
+    DEFINE_PROP_UNSIGNED(_name, _state, _field, _default, \
+                         qdev_prop_spdm_trans, SpdmTransportType)
+
 #endif

From 7f2eeccb4b2ea66ff516d94ff57e6b72a4b4d4f9 Mon Sep 17 00:00:00 2001
From: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Date: Fri, 3 Oct 2025 21:39:46 +1000
Subject: [PATCH 1764/2396] hw/nvme: connect SPDM over NVMe Security Send/Recv

This patch extends the existing support we have for NVMe with only DoE
to also add support to SPDM over the NVMe Security Send/Recv commands.

With the new definition of the `spdm-trans` argument, users can specify
`spdm_trans=nvme` or `spdm_trans=doe`. This allows us to select the SPDM
transport respectively. SPDM over the NVMe Security Send/Recv commands
are defined in the DMTF DSP0286.

Signed-off-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
[k.jensen: fix declaration in case statement; fix quotes in docs]
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 docs/specs/spdm.rst         | 10 ++++++--
 hw/nvme/ctrl.c              | 47 ++++++++++++++++++++++++++++---------
 include/hw/pci/pci_device.h |  2 ++
 3 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/docs/specs/spdm.rst b/docs/specs/spdm.rst
index 0e3ad25bc6..477ff9ef36 100644
--- a/docs/specs/spdm.rst
+++ b/docs/specs/spdm.rst
@@ -98,7 +98,7 @@ Then you can add this to your QEMU command line:
 .. code-block:: shell
 
     -drive file=blknvme,if=none,id=mynvme,format=raw \
-        -device nvme,drive=mynvme,serial=deadbeef,spdm_port=2323
+        -device nvme,drive=mynvme,serial=deadbeef,spdm_port=2323,spdm_trans=doe
 
 At which point QEMU will try to connect to the SPDM server.
 
@@ -113,7 +113,13 @@ of the default. So the entire QEMU command might look like this
         -append "root=/dev/vda console=ttyS0" \
         -net none -nographic \
         -drive file=blknvme,if=none,id=mynvme,format=raw \
-        -device nvme,drive=mynvme,serial=deadbeef,spdm_port=2323
+        -device nvme,drive=mynvme,serial=deadbeef,spdm_port=2323,spdm_trans=doe
+
+The ``spdm_trans`` argument defines the underlying transport type that is
+emulated by QEMU. For an PCIe NVMe controller, both "doe" and "nvme" are
+supported. Where, "doe" does SPDM transport over the PCIe extended capability
+Data Object Exchange (DOE), and "nvme" uses the NVMe Admin Security
+Send/Receive commands to implement the SPDM transport.
 
 .. _DMTF:
    https://www.dmtf.org/standards/SPDM
diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index e450e785ea..fa003031e7 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8943,19 +8943,33 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
 
     pcie_cap_deverr_init(pci_dev);
 
-    /* DOE Initialisation */
+    /* SPDM Initialisation */
     if (pci_dev->spdm_port) {
-        uint16_t doe_offset = n->params.sriov_max_vfs ?
-                                  PCI_CONFIG_SPACE_SIZE + PCI_ARI_SIZEOF
-                                  : PCI_CONFIG_SPACE_SIZE;
+        uint16_t doe_offset = PCI_CONFIG_SPACE_SIZE;
 
-        pcie_doe_init(pci_dev, &pci_dev->doe_spdm, doe_offset,
-                      doe_spdm_prot, true, 0);
+        switch  (pci_dev->spdm_trans) {
+        case SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE:
+            if (n->params.sriov_max_vfs) {
+                doe_offset += PCI_ARI_SIZEOF;
+            }
 
-        pci_dev->doe_spdm.spdm_socket = spdm_socket_connect(pci_dev->spdm_port,
-                                                            errp);
+            pcie_doe_init(pci_dev, &pci_dev->doe_spdm, doe_offset,
+                          doe_spdm_prot, true, 0);
 
-        if (pci_dev->doe_spdm.spdm_socket < 0) {
+            pci_dev->doe_spdm.spdm_socket =
+                spdm_socket_connect(pci_dev->spdm_port, errp);
+
+            if (pci_dev->doe_spdm.spdm_socket < 0) {
+                return false;
+            }
+            break;
+        case SPDM_SOCKET_TRANSPORT_TYPE_NVME:
+            n->spdm_socket = spdm_socket_connect(pci_dev->spdm_port, errp);
+            if (n->spdm_socket < 0) {
+                return false;
+            }
+            break;
+        default:
             return false;
         }
     }
@@ -9246,9 +9260,14 @@ static void nvme_exit(PCIDevice *pci_dev)
         g_free(n->cmb.buf);
     }
 
+    /* Only one of the `spdm_socket`s below should have been setup */
+    assert(!(pci_dev->doe_spdm.spdm_socket > 0 && n->spdm_socket >= 0));
     if (pci_dev->doe_spdm.spdm_socket > 0) {
         spdm_socket_close(pci_dev->doe_spdm.spdm_socket,
                           SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE);
+    } else if (n->spdm_socket >= 0) {
+        spdm_socket_close(pci_dev->doe_spdm.spdm_socket,
+                          SPDM_SOCKET_TRANSPORT_TYPE_NVME);
     }
 
     if (n->pmr.dev) {
@@ -9303,6 +9322,8 @@ static const Property nvme_props[] = {
                      false),
     DEFINE_PROP_UINT16("mqes", NvmeCtrl, params.mqes, 0x7ff),
     DEFINE_PROP_UINT16("spdm_port", PCIDevice, spdm_port, 0),
+    DEFINE_PROP_SPDM_TRANS("spdm_trans", PCIDevice, spdm_trans,
+                           SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE),
     DEFINE_PROP_BOOL("ctratt.mem", NvmeCtrl, params.ctratt.mem, false),
     DEFINE_PROP_BOOL("atomic.dn", NvmeCtrl, params.atomic_dn, 0),
     DEFINE_PROP_UINT16("atomic.awun", NvmeCtrl, params.atomic_awun, 0),
@@ -9378,7 +9399,9 @@ static void nvme_pci_write_config(PCIDevice *dev, uint32_t address,
 {
     uint16_t old_num_vfs = pcie_sriov_num_vfs(dev);
 
-    if (pcie_find_capability(dev, PCI_EXT_CAP_ID_DOE)) {
+    /* DOE is only initialised if SPDM over DOE is used */
+    if (pcie_find_capability(dev, PCI_EXT_CAP_ID_DOE) &&
+        dev->spdm_trans == SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE) {
         pcie_doe_write_config(&dev->doe_spdm, address, val, len);
     }
     pci_default_write_config(dev, address, val, len);
@@ -9389,7 +9412,9 @@ static void nvme_pci_write_config(PCIDevice *dev, uint32_t address,
 static uint32_t nvme_pci_read_config(PCIDevice *dev, uint32_t address, int len)
 {
     uint32_t val;
-    if (dev->spdm_port && pcie_find_capability(dev, PCI_EXT_CAP_ID_DOE)) {
+
+    if (dev->spdm_port && pcie_find_capability(dev, PCI_EXT_CAP_ID_DOE) &&
+        (dev->spdm_trans == SPDM_SOCKET_TRANSPORT_TYPE_PCI_DOE)) {
         if (pcie_doe_read_config(&dev->doe_spdm, address, len, &val)) {
             return val;
         }
diff --git a/include/hw/pci/pci_device.h b/include/hw/pci/pci_device.h
index eee0338568..88ccea5011 100644
--- a/include/hw/pci/pci_device.h
+++ b/include/hw/pci/pci_device.h
@@ -4,6 +4,7 @@
 #include "hw/pci/pci.h"
 #include "hw/pci/pcie.h"
 #include "hw/pci/pcie_doe.h"
+#include "system/spdm-socket.h"
 
 #define TYPE_PCI_DEVICE "pci-device"
 typedef struct PCIDeviceClass PCIDeviceClass;
@@ -166,6 +167,7 @@ struct PCIDevice {
 
     /* SPDM */
     uint16_t spdm_port;
+    SpdmTransportType spdm_trans;
 
     /* DOE */
     DOECap doe_spdm;

From 3b41acc9629990e04812c538bdfceb7cd061861e Mon Sep 17 00:00:00 2001
From: Alan Adamson <alan.adamson@oracle.com>
Date: Mon, 2 Jun 2025 16:04:57 -0700
Subject: [PATCH 1765/2396] hw/nvme: enable ns atomic writes

Add support for the namespace atomic paramters: NAWUN and NAWUN. Namespace
Atomic Compare and Write Unit (NACWU) is not currently supported.

Writes that adhere to the NACWU and NAWUPF parameters are guaranteed to be
atomic.

New NVMe QEMU Paramters (See NVMe Specification for details):
        atomic.nawun=UINT16 (default: 0)
        atomic.nawupf=UINT16 (default: 0)
        atomic.nsfeat (default off) - Set Namespace Supported Atomic Boundary &
                Power (NSABP) bit in Namespace Features (NSFEAT) in the Identify
                Namespace Data Structure

See the NVMe Specification for more information.

Signed-off-by: Alan Adamson <alan.adamson@oracle.com>
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 23 +++++++++++++++++++++++
 hw/nvme/ns.c   | 38 ++++++++++++++++++++++++++++++++++++++
 hw/nvme/nvme.h |  6 ++++++
 3 files changed, 67 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index fa003031e7..121a95b2e3 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6705,6 +6705,23 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
         } else {
             atomic->atomic_writes = 1;
         }
+        for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
+            ns = nvme_ns(n, i);
+            if (ns && ns->atomic.atomic_writes) {
+                if (n->dn) {
+                    ns->atomic.atomic_max_write_size =
+                        le16_to_cpu(ns->id_ns.nawupf) + 1;
+                } else {
+                    ns->atomic.atomic_max_write_size =
+                        le16_to_cpu(ns->id_ns.nawun) + 1;
+                }
+                if (ns->atomic.atomic_max_write_size == 1) {
+                    ns->atomic.atomic_writes = 0;
+                } else {
+                    ns->atomic.atomic_writes = 1;
+                }
+            }
+        }
         break;
     default:
         return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
@@ -7688,6 +7705,12 @@ static int nvme_atomic_write_check(NvmeCtrl *n, NvmeCmd *cmd,
 
 static NvmeAtomic *nvme_get_atomic(NvmeCtrl *n, NvmeCmd *cmd)
 {
+    NvmeNamespace *ns = nvme_ns(n, cmd->nsid);
+
+    if (ns && ns->atomic.atomic_writes) {
+        return &ns->atomic;
+    }
+
     if (n->atomic.atomic_writes) {
         return &n->atomic;
     }
diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 6df2e8e7c5..28aacb8db5 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -724,11 +724,46 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp)
     BusState *s = qdev_get_parent_bus(dev);
     NvmeCtrl *n = NVME(s->parent);
     NvmeSubsystem *subsys = n->subsys;
+    NvmeIdCtrl *id = &n->id_ctrl;
+    NvmeIdNs *id_ns = &ns->id_ns;
     uint32_t nsid = ns->params.nsid;
     int i;
 
     assert(subsys);
 
+    /* Set atomic write parameters */
+    if (ns->params.atomic_nsfeat) {
+        id_ns->nsfeat |= NVME_ID_NS_NSFEAT_NSABPNS;
+        id_ns->nawun = cpu_to_le16(ns->params.atomic_nawun);
+        if (!id->awupf || (id_ns->nawun && (id_ns->nawun < id->awun))) {
+            error_report("Invalid NAWUN: %x AWUN=%x", id_ns->nawun, id->awun);
+        }
+        id_ns->nawupf = cpu_to_le16(ns->params.atomic_nawupf);
+        if (!id->awupf || (id_ns->nawupf && (id_ns->nawupf < id->awupf))) {
+            error_report("Invalid NAWUPF: %x AWUPF=%x",
+                id_ns->nawupf, id->awupf);
+        }
+        if (id_ns->nawupf > id_ns->nawun) {
+            error_report("Invalid: NAWUN=%x NAWUPF=%x",
+                id_ns->nawun, id_ns->nawupf);
+        }
+    }
+
+    if (id_ns->nawun || id_ns->nawupf) {
+        NvmeAtomic *atomic = &ns->atomic;
+
+        if (n->dn) {
+            atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawupf) + 1;
+        } else {
+            atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawun) + 1;
+        }
+        if (atomic->atomic_max_write_size == 1) {
+            atomic->atomic_writes = 0;
+        } else {
+            atomic->atomic_writes = 1;
+        }
+    }
+
     /* reparent to subsystem bus */
     if (!qdev_set_parent_bus(dev, &subsys->bus.parent_bus, errp)) {
         return;
@@ -804,6 +839,9 @@ static const Property nvme_ns_props[] = {
     DEFINE_PROP_BOOL("eui64-default", NvmeNamespace, params.eui64_default,
                      false),
     DEFINE_PROP_STRING("fdp.ruhs", NvmeNamespace, params.fdp.ruhs),
+    DEFINE_PROP_UINT16("atomic.nawun", NvmeNamespace, params.atomic_nawun, 0),
+    DEFINE_PROP_UINT16("atomic.nawupf", NvmeNamespace, params.atomic_nawupf, 0),
+    DEFINE_PROP_BOOL("atomic.nsfeat", NvmeNamespace, params.atomic_nsfeat, 0),
 };
 
 static void nvme_ns_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index 67ed562e00..7d01080fc1 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -218,6 +218,9 @@ typedef struct NvmeNamespaceParams {
     struct {
         char *ruhs;
     } fdp;
+    uint16_t atomic_nawun;
+    uint16_t atomic_nawupf;
+    bool     atomic_nsfeat;
 } NvmeNamespaceParams;
 
 typedef struct NvmeAtomic {
@@ -280,6 +283,9 @@ typedef struct NvmeNamespace {
         /* reclaim unit handle identifiers indexed by placement handle */
         uint16_t *phs;
     } fdp;
+    uint16_t  atomic_nawun;
+    uint16_t  atomic_nawupf;
+    NvmeAtomic  atomic;
 } NvmeNamespace;
 
 static inline uint32_t nvme_nsid(NvmeNamespace *ns)

From bce51b83709b548fbecbe64acd65225587c5b803 Mon Sep 17 00:00:00 2001
From: Alan Adamson <alan.adamson@oracle.com>
Date: Mon, 2 Jun 2025 16:04:58 -0700
Subject: [PATCH 1766/2396] hw/nvme: add atomic boundary support

Add support for the namespace atomic boundary paramters: NABO, NABSN, and NABSPF.

Writes that cross an atomic boundary whose size is less than or equal to values
reported by AWUN/AWUPF are guaranteed to be atomic. If AWUN/AWUPF is set to zero,
writes that cross an atomic boundary are not guaranteed to be atomic.

The value reported by NABO field indicates the LBA on this namespace where the
first atomic boundary starts.

New NVMe QEMU Paramters (See NVMe Specification for details):
        atomic.nabo=UINT16 (default: 0)
        atomic.nabsn=UINT16 (default: 0)
        atomic.nabspf=UINT16 (default: 0)

See the NVMe Specification for more information.

Signed-off-by: Alan Adamson <alan.adamson@oracle.com>
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c | 53 ++++++++++++++++++++++++++++++++++++++++++++++++++
 hw/nvme/ns.c   | 36 ++++++++++++++++++++++++++++++++++
 hw/nvme/nvme.h |  8 ++++++++
 3 files changed, 97 insertions(+)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 121a95b2e3..4d150c7206 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6711,9 +6711,21 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
                 if (n->dn) {
                     ns->atomic.atomic_max_write_size =
                         le16_to_cpu(ns->id_ns.nawupf) + 1;
+                    if (ns->id_ns.nabspf) {
+                        ns->atomic.atomic_boundary =
+                            le16_to_cpu(ns->id_ns.nabspf) + 1;
+                    } else {
+                        ns->atomic.atomic_boundary = 0;
+                    }
                 } else {
                     ns->atomic.atomic_max_write_size =
                         le16_to_cpu(ns->id_ns.nawun) + 1;
+                    if (ns->id_ns.nabsn) {
+                        ns->atomic.atomic_boundary =
+                            le16_to_cpu(ns->id_ns.nabsn) + 1;
+                    } else {
+                        ns->atomic.atomic_boundary = 0;
+                    }
                 }
                 if (ns->atomic.atomic_max_write_size == 1) {
                     ns->atomic.atomic_writes = 0;
@@ -7636,6 +7648,36 @@ static void nvme_update_sq_tail(NvmeSQueue *sq)
     trace_pci_nvme_update_sq_tail(sq->sqid, sq->tail);
 }
 
+static int nvme_atomic_boundary_check(NvmeCtrl *n, NvmeCmd *cmd,
+    NvmeAtomic *atomic)
+{
+    NvmeRwCmd *rw = (NvmeRwCmd *)cmd;
+
+    if (atomic->atomic_boundary) {
+        uint64_t slba = le64_to_cpu(rw->slba);
+        uint32_t nlb = (uint32_t)le16_to_cpu(rw->nlb);
+        uint64_t elba = slba + nlb;
+        uint64_t imask;
+
+        if ((slba < atomic->atomic_nabo) || (elba < atomic->atomic_nabo)) {
+            return 0;
+        }
+
+        /* Update slba/elba based on boundary offset */
+        slba = slba - atomic->atomic_nabo;
+        elba = slba + nlb;
+
+        imask = ~(atomic->atomic_boundary - 1);
+        if ((slba & imask) != (elba & imask)) {
+            if (n->atomic.atomic_max_write_size &&
+                ((nlb + 1) <= n->atomic.atomic_max_write_size)) {
+                return 1;
+            }
+            return 0;
+        }
+    }
+    return 1;
+}
 #define NVME_ATOMIC_NO_START        0
 #define NVME_ATOMIC_START_ATOMIC    1
 #define NVME_ATOMIC_START_NONATOMIC 2
@@ -7655,6 +7697,15 @@ static int nvme_atomic_write_check(NvmeCtrl *n, NvmeCmd *cmd,
         cmd_atomic_wr = false;
     }
 
+    /*
+     * Check if a write crosses an atomic boundary.
+     */
+    if (cmd->opcode == NVME_CMD_WRITE) {
+        if (!nvme_atomic_boundary_check(n, cmd, atomic)) {
+            cmd_atomic_wr = false;
+        }
+    }
+
     /*
      * Walk the queues to see if there are any atomic conflicts.
      */
@@ -8741,6 +8792,8 @@ static void nvme_init_state(NvmeCtrl *n)
         } else {
             atomic->atomic_writes = 1;
         }
+        atomic->atomic_boundary = 0;
+        atomic->atomic_nabo = 0;
     }
 }
 
diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 28aacb8db5..86f5ab0a75 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -747,6 +747,28 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp)
             error_report("Invalid: NAWUN=%x NAWUPF=%x",
                 id_ns->nawun, id_ns->nawupf);
         }
+        id_ns->nabsn = cpu_to_le16(ns->params.atomic_nabsn);
+        id_ns->nabspf = cpu_to_le16(ns->params.atomic_nabspf);
+        id_ns->nabo = cpu_to_le16(ns->params.atomic_nabo);
+        if (!id->awun || (id_ns->nabsn && ((id_ns->nabsn < id_ns->nawun) ||
+            (id_ns->nabsn < id->awun)))) {
+            error_report("Invalid NABSN: %x NAWUN=%x AWUN=%x",
+                id_ns->nabsn, id_ns->nawun, id->awun);
+        }
+        if (!id->awupf || (id_ns->nabspf && ((id_ns->nabspf < id_ns->nawupf) ||
+            (id_ns->nawupf < id->awupf)))) {
+            error_report("Invalid NABSPF: %x NAWUPF=%x AWUPF=%x",
+                id_ns->nabspf, id_ns->nawupf, id->awupf);
+        }
+        if (id_ns->nabo && ((id_ns->nabo > id_ns->nabsn) ||
+            (id_ns->nabo > id_ns->nabspf))) {
+            error_report("Invalid NABO: %x NABSN=%x NABSPF=%x",
+                id_ns->nabo, id_ns->nabsn, id_ns->nabspf);
+        }
+        if (id_ns->nawupf > id_ns->nawun) {
+            error_report("Invalid: NAWUN=%x NAWUPF=%x", id_ns->nawun,
+                id_ns->nawupf);
+        }
     }
 
     if (id_ns->nawun || id_ns->nawupf) {
@@ -754,14 +776,25 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp)
 
         if (n->dn) {
             atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawupf) + 1;
+            if (id_ns->nabspf) {
+                atomic->atomic_boundary = cpu_to_le16(id_ns->nabspf) + 1;
+            } else {
+                atomic->atomic_boundary = 0;
+            }
         } else {
             atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawun) + 1;
+            if (id_ns->nabsn) {
+                atomic->atomic_boundary = cpu_to_le16(id_ns->nabsn) + 1;
+            } else {
+                atomic->atomic_boundary = 0;
+            }
         }
         if (atomic->atomic_max_write_size == 1) {
             atomic->atomic_writes = 0;
         } else {
             atomic->atomic_writes = 1;
         }
+        atomic->atomic_nabo = cpu_to_le16(id_ns->nabo);
     }
 
     /* reparent to subsystem bus */
@@ -841,6 +874,9 @@ static const Property nvme_ns_props[] = {
     DEFINE_PROP_STRING("fdp.ruhs", NvmeNamespace, params.fdp.ruhs),
     DEFINE_PROP_UINT16("atomic.nawun", NvmeNamespace, params.atomic_nawun, 0),
     DEFINE_PROP_UINT16("atomic.nawupf", NvmeNamespace, params.atomic_nawupf, 0),
+    DEFINE_PROP_UINT16("atomic.nabspf", NvmeNamespace, params.atomic_nabspf, 0),
+    DEFINE_PROP_UINT16("atomic.nabsn", NvmeNamespace, params.atomic_nabsn, 0),
+    DEFINE_PROP_UINT16("atomic.nabo", NvmeNamespace, params.atomic_nabo, 0),
     DEFINE_PROP_BOOL("atomic.nsfeat", NvmeNamespace, params.atomic_nsfeat, 0),
 };
 
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index 7d01080fc1..a7d225d2d8 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -220,11 +220,16 @@ typedef struct NvmeNamespaceParams {
     } fdp;
     uint16_t atomic_nawun;
     uint16_t atomic_nawupf;
+    uint16_t atomic_nabsn;
+    uint16_t atomic_nabspf;
+    uint16_t atomic_nabo;
     bool     atomic_nsfeat;
 } NvmeNamespaceParams;
 
 typedef struct NvmeAtomic {
     uint32_t    atomic_max_write_size;
+    uint64_t    atomic_boundary;
+    uint64_t    atomic_nabo;
     bool        atomic_writes;
 } NvmeAtomic;
 
@@ -285,6 +290,9 @@ typedef struct NvmeNamespace {
     } fdp;
     uint16_t  atomic_nawun;
     uint16_t  atomic_nawupf;
+    uint16_t  atomic_nabsn;
+    uint16_t  atomic_nabspf;
+    uint16_t  atomic_nabo;
     NvmeAtomic  atomic;
 } NvmeNamespace;
 

From f551663d021fde5c6aad5f33e7f76beb1b51ac8e Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 27 Oct 2025 08:09:51 +0100
Subject: [PATCH 1767/2396] pseries: Update SLOF firmware image to release
 20251027

- Fix some measurements in the TPM code
- Fix for compiling with GCC in C23 mode
- Silence some initializer-string warnings with recent GCC

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251027074404.25758-1-thuth@redhat.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 pc-bios/README   |   2 +-
 pc-bios/slof.bin | Bin 996184 -> 994176 bytes
 roms/SLOF        |   2 +-
 3 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/pc-bios/README b/pc-bios/README
index d009c37895..4818272968 100644
--- a/pc-bios/README
+++ b/pc-bios/README
@@ -14,7 +14,7 @@
 - SLOF (Slimline Open Firmware) is a free IEEE 1275 Open Firmware
   implementation for certain IBM POWER hardware.  The sources are at
   https://gitlab.com/slof/slof, and the image currently in qemu is
-  built from git tag qemu-slof-20241106.
+  built from git tag qemu-slof-20251026.
 
 - VOF (Virtual Open Firmware) is a minimalistic firmware to work with
   -machine pseries,x-vof=on. When enabled, the firmware acts as a slim shim and
diff --git a/pc-bios/slof.bin b/pc-bios/slof.bin
index 4314e17b9ddc964c905a7b107d9aa7a651a43890..39b924896748fe1148f88a31ef0de1b9aaed7a43 100644
GIT binary patch
delta 332180
zcmccd%%<VG%>*-X?FJ85M;8VpP?(xqYA{)mQI<_XRX|O`bz*@C2iI(M)&Kwh|DXOL
zoJC@?0i)%{yIqWoHWLFSCNYUmp3W2iVKb*gY4OR^nW17V5V6S(P{t%CvB_erfs8hj
z6&YttVoQfI*kKHiGzUzY6IqlCCdv&H<$*Ckns{N-d@xad7y~3N0FxGki3-6OAZcNk
zv<R}OC`?ogCMphNfHX<Kq$OdZQZNQcS{f!T0~3{nF+kFCFll*YQ3aT&B1}{X#sFzj
zhDocyL{(u7khB_1S{+$b1172o6V-w-K$^5+(mF6vT^Iu-tp}6VPiM559>~J@etH56
z;{$3FlMNV8PI3rm&9zAI6qy|3pde6`nv<GXoT^}CU}S1&U}Uy=f<rQ+;NBNW4IDp|
z85nAqnJYXPI7}zAI2~u)I{A!Kg^7Q1iGq<CSc8J0g_Vh^m5~uImx5ckLRe~1ab|v=
zf~^9EsWr}<SjAc*Y#JCC5?UA-Dq7f&rL=(9^#+q&Jlz>TPVVvaXASZG|Lfs&0Z+!5
z$tGTs?27*<{>Z3dm>l92RsUPUgF&t_fq{XcW*5^ko238$E0!=QStS29@L-V31dH!R
z5%=(5kP8HhZ*oFbpWwkDX9*VHj3Qp)!62sy68B(WVDSF`wG_nm{{O!QoNXuTdRKD&
z+VR7YLBoSVuXXYUZ>==xlOQD^r&ua5FxWc%|8J4}`@&DHx)&Y{vbHd}`X|3DEEY0M
zut@&>!~6fQRFJq1GXsM|6XT7SiVQPA`k-nGEWQ31{9ehxQR^IBQ5zFn;r;)Y>0}!p
zDL!dWkTy#NMuwM;3=Pw3av3cq&+*|4`xD{)|K~xF9K=Y5FE;c437E7nGB`9ca=b`n
zm|^qi|9^`E3=9?v844_(|KsprU|k4OZ?owCf19TN|3S{TSo&v%Ma!QB7Ri5BcreHq
zPV&vs0gEU9p5ehDy%VI~`~O!*5Upbea{50DsQdyC2I-%Z=lIIi|KadpkOl`D%n6Q-
z{~18ael#*{ut@%s;lUui6=cMVMurXE|NlJ!v1?MKD?n;2lEL~-L1KhM<%cgw9mva$
zP5)#-`s=w{9#>c-|FQ63koq{;!Oxm8c5#g#<KzZ^V@`0`Stv3xOxw#WG5LzWY&|mr
zgRMioYoeErTMb75gF_R;gHC4#)|yP|3LP#6CdVd*1wR!3PwaGNVA0`XV03I^NC1gD
zG%={ua4;?Vk;t&%2O~p+2ZIneCB0x|Xn3i}u%L#6dD%iw1_4X2|Nlb0SnM=FdK(#f
z7J4!WS$h3{0~4!vY-DKY$Yfx#P-H0ZYhX}7HI)4*$alzwdjJ2w1|$Z<3!O16u~_Jg
zYKdbbgHA^>0}IG}i-iCGq4Zzx|NljMEE4|z@&5n6#UkPVU#P^N=>c0AB_{ug<(&R@
zH6xGnT;+-%j0^%bb<!0-6#p0gSjceU$3cc0-v9rt)L~{|tf`l-aBO1Oqr(giFO!$H
z3=9^E3=<SJ85mxG^d(CQOfOi%C{kaO%)SL=$BTmuH(o4cxM0!1z)*kqbA<;37dR#U
zsAXUPg?wim11l($9h?5IfyfILf;<c}Ii#L_AIRj_3;(~!{?EYl`r!W$AlvHyGnjxv
zz9v~xApHN$I_v)o%=M2YEM7nS|Dz_E-4kp%$RJDyFoP|?;s70(SF9f}u!1ZF84mUi
z3&=auFRW&ioz5%GBqUh)qmkhREO352WOy(=VIQM-Vom+y-xVGV+_4~wUn(-3cyW;7
z!Hb0qH)@(a0zh&<8W{>a7&yW5FB%yNUOF;d0EGfbu2#iM<fj$`g9iimT9E!udj?h=
zPH;G@faE<G1Vtyy1WPkcn7%=XS!VhMKPFCluzf7xVh6W<OuQiT!1gIJTmX5pCRs`3
zM<xRU$RvsB7v3>R)Hh;gj~Ad63UVGONkFp(G_n{pkg^Fl`#3Z)h=8()2LoRu$U0Eg
zASPQlHZoLndNN4D@|+JSH8?aeq|_>VS9maR?w#zAAu`<{n2ALLVm$L%nDO5K|4#w2
zVHl!==`UOd2Pg}8|Np;Yazm&@y@m>dxI-gD4;G(-68pqXWd;@<PH@Ke00q256N3RL
z1R$B7A6!a-@+T<&f|4F6dBdy*(ICq}axig(UKUVcv^hVNpHWQ^To^X&XAo$#XAlA9
zii*Vy3N=eT0&0>UiBv3QQ1D<7m^eM=5aXQ54&i)ke>Qk92!7nobC{8baZ((s^~3)^
zEFLq6SSm9JSUNB;fMTZRfsIZrgP)G2GJ{a9f}c*!3+81Oj~OID;`J|>mesrj^A#pf
zi0~DD%pg+#l4;q*W(I``%nT}%A2UcyeiI=xnJ2PhdV&y>L_Gr|0|O+a7&8_sGic~=
zGMG3tF~)Q-Gq5%~Gsx5&RuWmTm_bX20hBbEB0@b6*adnz$pw14+10Glt_XEKW*6$=
zqF1R2@|JT&t+JO0NbN#q1|7#HMvG8(7rjufV|F1+S?nws7#M23tSds@S?oZ?qz*en
zJ%gne17ocx^D@UKh7UC_wM3j87;I|PEF2sg7;ad4GO$=`G6>Wrgy_^d_~_KUw63W2
ziV~^xVo<2j2yk#{_<y0+Be(*rkKz9rOJxQHkmU;=GZ=u>TPic?)hzJSsdWw#acpAL
z2zl(H7xMC$U9F~cMaW_nyHNFd7Q0YQ7CRkw1_nz_a9XI)(PUt(StTW6srmoEV-tf*
zjhY6?F+LWrK;<!mNNs|RPR)Z59gy#9o=1sPJO??(0_2zzV7)J_D`5H^n*JZL$Y5Zu
zNM=u|QIT-)X<$$Qr5jM1v2<WytgZKCUgrJ(KaZsX1Ecr<{~e%&1;U~1EOwz>Ebw3h
zJJ1X4z!N%J42-pzS|XNSU<caNs6{w9HvC`H@REV0v6DfdHZ!`S=6Mpb!!CgI)V#2+
zfa!B+`hNx#QuU3_3<?VtGw6YX%sEKJq3Pd)kk>4BAun0%KtZI#4G)<du<zg@^Ir!N
zGXG5)UNHzXW-*9h36Tq6J*Xja#{2)j4<O%r|NpOM0rD*fgW|MSIY`9&|KAhP(3k>l
zm4S%Kz0o)2xWVPxOM3=|7yB7BKzXUA#!IATrAB}U1Lw!-HYXT+CJV%}vHkhr!N8q4
zStj;L{jZ1rcl>7jf1qZ%a)mVm1H*5}{}+Bg{Qu+k!T%qADE@Z@RdBBlGicNw{v=`@
z$H3yjz@P$h3=A){XRxuBU|_V4VsNP8Jiy@Cz?9Nx#lWD$$-v^!^#4ht6@x~lrddj@
zotMZ<O$LraO;9fRf9Az41{obShI$6arvC>(1;cMehK}Ef3^RT=GA#JLkYUBIgA4^f
z7#S|uFJO?cZ~Fh=T7iK9)WEb(U|>w%d!W*K&R>J3TMQ~y*UVDt?rjo*J1CyP;>9lp
zk(cre3ZR@*^U_MB*4{~^(3OF)X1|q)V-tfyt-OPt4hJZ$)HAt&nl=mN8O&-moj{TX
zm0o|8K-sO)lYs#w=h(!g0G9W3$b<3)Kx&;B{y(Udx6pdg%E0mB8-qkmxs%9CR|bKK
zP6j0n76#4Q@E{RcO$LctdoPh%O)IePYrVWg92=P!^jjDh9Op5aI0iQ|T(MR9|KH-}
zoq&o?@s5fX28CL6uT>xowVKS!{2Evk7#J9~FfcIYKxi=Agn@x^0s{kM1wsrY&TxT&
zf#JgR10R{yrl0%BEXoLBPd=B=QO}sbz`z&)QP1cA3oVd+poXJG^4|at1`bt_I4EjB
zGzh=6Vlb(<^b)BC6<(SK4vr1~0$@@8f|20@DB52gWGHy8$k6dRkzvN`Mur8i7c#5>
zRR^Ht;Lz}QiG?D=fmihp|L=Is`2WCb$Nv{VO%_nI1eC`^y%?-EIx{eUECp3xm0m3h
zNc@&cF9szfe#uXS+Kk$8M?I*%m{8CDf0bS>OtqRpA{&+A=DC2xK>F*U3Qa&!_EM8U
zqDI5R!J*;rm-^<%6&?)ix**>|)d+ytFl?#v|B41DgNS3}zZ>-#9%i*1FDxCJ{=L!Q
zWZ-pd`tPE_$-wT=^l#5gWd?>?&0Qit;g<h90m^~i|NkvvU|^VDf0oh7`wRnL%}E_l
z#UxUz;G<J<pMlTf00RpsrY)5j4C+rZEvsSh0m&=WEc4N^ILu%IQdgT`24b64tYqM;
zX#le=rVE^7jF`M8$<+G|17FPx6&;IC1_?_B2A0|c6`hI)a4`jtSjB4yzotP&2h4xM
zz-RH2L8JZ!sHC>hvE*bhsD94CH`yUsRr&=3-%m~kg9VQnEEX~|nANZcFo4p#L&JZM
z={83hWu`kEXXKc?AX%l}p^<UJLS+UM9Zm)ZhbG1)oy`oaFP#|_pjD!o4i5tpsKjz?
zVz8+6U{DHmKVTQ=?j#q=dB84^(@8GS9a2RGa=O{Us>zzA&J`6e8Ti1}Bo71ALS_aF
z$0o)UEY)N^ay^MuO){#0t2+mV07x~-$YYtwz+vgYz*55%qf?s@qhsmGpkS%Mz*51@
zz*oZwsyai!Rc8ek10SgRgjSt<kgCodmd*?sAUz;Y)w~4hsSg3glohD{ta!!1x8N~@
z4YVFLz^q4E(5ulNaKR6+EEpmnl?6kBWfp^k#RCSG8g__dEnYDwfE*8YEEgogKov<v
zJv##*sD7={0N1Tszy_k$BpdM7t>CKl-wkMGQi7*SJpig6VO1k2Izd%xy<@}wEiYa&
zaJ=ATP=M5_Od?RnTmfmQL9I_OfP(I&GlRy0#SB)k&~j+{cLPUt8UpqZJcRyRKtkxh
z!;4o85-+nDEEPb(fD{5(z#33P;DY!6{|wN&)B)<#HPZubG0RLpbC-FEM6J4ag(VjQ
zqopPTlcg5}(~ML9|93oRV48d(&Aq;+Rz*vsM%lx`v5}!bN0ouWw~0Z)V(I_?1uGdC
zYg)8KYMHe}EL9j7Ej<_*9hw;SR4o1BWXa0FSj)-0%!7eJ0#=H2a{T`f>JQIk|Np<^
z<p2Mcod5q@y!!v&QuF^mkd2_q1XLWt)PwA@RGD0su7ulx8`2F7YPp;%I$0PPYC4rG
zW^#c>Z2nt-ngcKls#$BYVS@|5ZcG-)D3beiqj?{wTg3n#FanLb)TByR)Gub=;{E^0
z-N_3w#Mu5ec>jNLaPppv^^%exH(4|?6o8rnFX|YW>Yx6u@c#e!=ky#_7M;llGJ_c(
zPJi>7*-};g1E`7jq1Nk^NDXrUgF_=jLamoX0I26$2nnB-O0Vf&Z<zZTxu)NG!|XNL
zCtHZ=Z^z_>?0Cj0lMiG|D=L62tFimx@Y0Hb!FtaB|MhjZD{3+yu5)Z)aHy~QJ!$fv
zYzYpKga-rH%IP28GKWkq$Win@`2Ryqopj|7#eWNbBr;BLY~oy?qr$)dYCAbLG0pg;
z$nfI#LPn4Ji=Qj3m;C?Vsmj1msKxN#v56@M6huD{GF<rikm1HJMurEI@8lTPKV*#X
zU|=u+xdw)38Zt0g88R?hEM;K)rN}s;rmiCZVGiRK5WhzGg@Z!_;|d)v233cq{}(`2
zdnYRcgGD1lzh&mD1E2=XTowk#nswS0y`W^G<y`@4Ra?CHe>>y>o1F#&L$G7x{|EII
z&qY_%ytZ0Z^V&)T)LntJ0~ojb|Ns949dJEGmM}1Im=JO#0|SQwZZ-9&zGPtF;9+23
z|ADT7fr0%Ax)_Mhz`%Zifq{Jwhz-IF3>+~~+5<#`FarbQl^2YR1uqXWTzL7A;l?XQ
zh6k@489uy9WccxFa%G+dC=Gz(3l#6K6d7K;UdZTSp~#p38u<XVU_jZ`(vX4C(t$zM
zVjTn1%s>W)pWt-i5m0OBUE%%z?-5XeQme_n#p)qLfyD!c3RqeK(Y0ReTWZa{L_mE$
z>qdr&p!VX7mkbJ)Y787Rxfm4ce=0J7+W87I6&W^kIx<YO)cSv^P?O=WV-s6Mp$91O
zGA4i$*y}U~hWf`Z0_x1VE36zqosqvQtP&VltQtTLV%X8C$gtt3BEy0DzzqR4_7@x+
z8W|NVwf=9kwqallRcEu)U}w;FY-G3s8Y8XL6kTEQ{B2CFx)%$m5jws5BXfZw3j+fq
z3#91?YG$%LL9iK*Ffg!~Oqcn@tXr@3|3aq>17oNro1F$H1E*snYe7{fgF+|=n_a!l
z=?beU42-pkULrF+845t<mJSDa4E0V;-G+d=i<>K69Ar2F3P|t&zyE*&NQZ-=6r>;2
zt*@`RT>;bU*u>xwmMLKYD%3$;&{|Iqv-(UA%X-Hq1_Mh523^ota#f~WhIJSN<4iFI
z21~EME9#{gF8p?6oKPQlA)r>vL#tlG!=jUsVMEQV9|84jhb!uy?ydmEwnZZ21d9g@
zT;BhGu)b(yoM3T)fvcYNa0N)b%ANf|%|wNOnwB2{-v585cE&I;zB<S_0pz(*54L(c
z@BjZ%iVRz(|NlV_sp?`-09j<o@ppyA0|tg##~=}qg*7KUv_Osk84j|1#w&0#;i#`N
zu&8&tT;cuydn42l9QCds{{I?K$iT3b0|VoWhYUNaGUPI9X4U@)09gbY<^~xKG8AMH
z$l!W+2d$Tk3<oS8FbK>z#ZXXRbpd99BGdu_kOd$gg7kU+|1Sfw1mr`j1O^VM5AD4F
z{|f+#!!X#s1W3osvYvrK0c0V_r=TFTIKaR-Ba5K`<{0n)-?qL~WSjsp6l9>)Ne0H*
znG6h}9&C2M4l+*g{{Qz2EWRxkFmQod&!9N3d%U}%KI%sRDBXB4FoQ=+YbvBG>XUC*
zc>n(j;Y&z3)H^gXeW`Um5K!#Nz*u)<a|I}<L7iqx1_p(C&&w6HVW2?{1_cc(1_p;l
zrajhTkn~~kfPt~bBEZ41i6NxsT1P;o<`1WuW4}Z|C9{qiD3O8&p_n{CzMd(;zyRv+
zBI!{8wK^;{|JQ@6lMI*wkbw?O|F8UJ1SPry0U#gLiyf}8S^%zkbwGxJaIM9LfEvvU
z4h{_rI<?j-)>&O+V6@uGz&O+F|9?=ZKz#XSFGy{Tsf2@L!~YAg5Cnys_y0c!KynET
z^$ZLk1~^U@Fff3k!BT;N2^1xuI0c0QIQ~~L6x65P2B&y?rvLxF|9@3{wUBWFs3@^^
z0Qv6kd`r#03+gVe2&mQfuBh9vx}xsdj{pw_1`Uw;wWbXLHD(?T4vh>ty%r3NRs!JO
zKjX}Lga7}3F)~i5eOz7P{r?MiETYB=;^LZ#4FMoWfD_mO1_4kOs!s*Q-=6~@-++9g
z!@-aPYUzX1Mgjwe_y6B7Ko%m&XE-)7nn2~5y#N0`fn31WTRdPW@c#cx1zFJI0Ykp`
z|6c-VVwv9mfBr!eOY#2y^97n%viJX=SJ1>jlT8QE#QeSg|EynwCRpnI|K|)ev10H4
zKU*Np(7zWzz5`)P1qOpoM}|q(jSQ1OrM>t6pL0OsFbt}8KusA?wF9btKvhq{a|Te0
z6PzePiQW6Z*WVQ|4X`2?RLpw+|FxtyhJnc{fq@Ye%-;WhO@Z<`p!}Blzykr`gc=1Z
z+5RR>7ASMAPXkSDFnVaPGN}AG!oc9z$Z*D%fq}7-qxnf9hZ=(i0|R`}#o`zPBS=lB
z8v{eAH=CVyH-kbgXN*}PXvA<X!xD$4{|`V-T8AbE4p7zxjhQ(%G1P!O1#+{+tN#})
zx&F_$)c$`V<T;xi*!>#p44m2>43Z9wppl&a`z^KquXLEpAQI}uW@oAW|D*;NgQRaG
zgF>wqy9vkvwXBktYBkwSYPd8QK*NY22i0UciGUnc=*{roq3Qn|P{@HTOkiMuu|a$t
zRd6=X(cxw=06Ea1>3@Ajry2tzh@->FP~p(@Kf+Rtf$66T14E}90~5%XAjJ+%3<aHR
z49q$l44{c1pISBV3X25{0^a}sgL4bWa1gd={QtrG|Gym|HVEsmG6*;{{bzxg@$V1F
zE{Hw<KGd8vuCO?%&A<dQ2;_@SPl$!y|NosqSn%%vtd-9&`EU6w%QcPh3=Fmk9t??^
z3>-CF9t@66Oc~z)|A#_m2$^Qo*neQCKmNJGp^-%Z6!JC;{{OdWV6d5dp+dSoqS2lK
zEL+0~nhN~?qR}2a`p@9d^#4wyJp+dhCn$*iUud*v;DNG_G}<!=K-oL$|NXA0fBqY#
zjZ<T50h)rH(<sNlP=D&fkNT6JD{5ndL~1xR7%IKKKXPnhI$&wXz*4`g{&hu-<_iXg
z1_lEiEe4R&H9!M!pty8wV(PHe1Sx{3acp4X0R<rlL%n8V(~!YrtDpp$Rj*0Z1Pw`p
zEmnb9Y_WiWrPj+xq=v%-W^sn~JqDH<I|GoNe{__=mNGar#xXEJ!)^jhfnx(`x|`v~
z<Uf_VT=PIa`CL)6LVNQ38q3K!Rf4MX7+Amq1<SQ7YMwiZSUhK_59MGm2zkz6Q1ikf
zAmsVUe>E?sOI>9&W2s1He=z;P3`U9R4<<14n0WvH^AX|&1`|;1SS*0VfklH2L&DPk
z{~a6uE~v5nz~I>U50s*oc>n)%aQd99j1pjjCOcG%)hjT7s;x%IJOE3rhIa)d%ot28
zH4tIu(D0815uX1~psNSfR3Nb$E(K78p8%yYki#6B{$8<Zs9~^GaA8PjVaiC<WKi<{
z4=K68;`ItH4E4)iSAfzLl7bBg!~T|d|Np-Q6j_aO3@kMqAPfH5fGqI-|9=5U9EK-=
z!uG`HiW<BD$-JzF!6B!Hfn`k%gZrB4JFYPb^F)BPo`OY-jjRDE)R5D-W8<F;iv-XV
z!rwoe-_&?BGftQs&>%M1uR&mPT7v+mw*xpcF}6(ZZxGk?i-7XL6a$0b3NVAQ1xzt8
z_&0zVj4hMjH;C5<f`(`r7~rx&Fj=r728LkJuq={%$OEthTz%*SRDSpZRDOg38Xq)_
zi!iUAArehP49qiNeGCk7Xbz0q0G5C|AgKVApMqv#3aW(+=_uyaGccs1IUoZ?0RuxO
znt_>UKF&f@pM~b2EVK~I0VNq&2)HsZFyx~7s2oj0g#fA#D<NekJOru?Hg9O&TECr@
zh0)WV>ls8h*RvJVBb*uigdTySpOL|V!GeK_!GS@5fq(iAXGS$C=ObWKH|>Xbhe3cL
zrQ~TK0|NuwWJN~(>E9-Ch)p(NwAQwNz$cOX{|Lj6dIkn4o8!lPI9uSyeK>piVi!hj
zzM~AFlE8zZ_o@d2BhzF>#s$-BTp76-6{felGX7`eo!;)oD9?4&p+<^%*$bzm9@96t
zF^VxNEI;nX$b@ZWk};u`Nz?y(FiL`!9I;H7@MMf*%6U22AwyyM3{OTWrkst_9kw#6
zOuymDD8=|``e#qZ^7>B<HS?4!tR+4%G}<?VCVN1uM;vUG{{OXPU;s@uFj)L={$c64
z^3Fv0W^l9AQho`8#i1<*KmIp!SlX}T_$j}H;m4sZ8b9M#a{RPkDPgO`u*}ktp~6yg
zl0c0XXlx!dBfL@pRJ}MhIUXs_1Wg<<h`h9K=CGXp(u>iRZPNj(N1GN*H}PhyW83Tj
zX7BK3+{BbNar%ZhM#<@|K8&(VDV5Wg_%OOLB^z#k<HH!m#JG6+{A5P8?YaJpri@HB
zJ=>QAFlMk>ym-h^@lqb-v{HuG%NaOcdN43pJZIpr<oN&N$3upS*LOkv$p8O;$~SXV
zddaKQpJZMJnroQu5YFhS&&W{mG9IM4h2ixI29B3r3=EbW3>-fh5gL&-ZQl~k*u==R
z{_b>#T1HD|hII$07ep~?$*pn)rE8E6b(9$xK<g14n;05ER)NH(3p6q+PCr}4XsiI5
zwt12H|Ahx*19*52Bn{Kz&}8H@y`h#-a{9wa#z3YemQYJp>;+rGw48DJf*3~C=?9}2
zRhbs3PJa=_XvQ>u?sSD{#vrD-JEteKGm1>_0CA>moc^JPQD*v&Xhu7xX`xVark(_w
z!#HL7{20byrU^5rzwu#|o4ziQQEWO-4I?KrL!;;P1*MD<(|uwYrI;F?PS1#CG-9et
zoIWR(QQeXg?nPz>21`!{0mml&0FW1Lng0L%8Q;ud@xt;Bh;7MX`QgV)298D#1_n?s
zZu*Z{Mm?r#*XafojEd7e;}{K@iuZzCEipZzn^B6XY9T1rotUckPX7|e7|&=qJtUsd
zjj8J9bb&-h@#&l68O52ZTBkcCGD=T>9?z)HR22)6(NAEMVB~~IBquQHGgUr>NUTm^
z6lbdJg~;3o%cO#2^ce*~VqQ$;52rU&Fj{alWc~l+!BF7{39c83jA~5fvC{>T7~L5~
zL7^ity&#EEoY8Pv8>7thB}t58Ol4<5-cX(XFo{vKz6>%BdlE9;2TDjU6&WgConl~k
zy^?{$lI#BuOHBrjpNb3>I%W(Epp*zog^o>zIj^<;|ERmQxx%`Efx+7H|9?=}BIBM)
z2FB_+{7XET>TiO?&7=PRuSwoiQB(5>)S`U?3ip@OYm*uC7(aqyRg;;i%yqg%3Ztwu
zC`sElbAXbw#mfIbUV1VxSe*R-0hFvQUjBapOWHs7H*>r?`Txg{`^_9LIsbnEW$zj-
z2M5O{{Ug(BQW%4n3O`Q2kizJxzEZiOR@1toQj<MFLz98Uu}R~MW22UfjwYzJr`@3e
zo*34$nJ$pVC^KCmnUQDugj7Z+G0g_YM$I`8RXP<ARhm;ks$6^=8r9ysRQvy-;0Xg`
z%`5AQT26<6n&)034ozxXD!qO<fu?am-B!m2tqe;~2F8w;42-o}4(n>z!6W(#jtyD?
zmRbyqP7Z2Irmsn3Oss#={N$x4#5c7ZRwA|T!4)qx|9_}e3$Ca*#-5;|1}cQq9W>NH
z9?;sMqXu%kriG3cXhcD?r_h6e+2YiH(5eU<9SzU~GlPnb21pNsz>Jj)3^m7%!Q;I%
zIzgoiX!xIjQAeGD5yS_LHn2E0X?jeblFsNd{YpBcMg2<-NQl<52UpZQ_pYdT&Yqy5
z4zgSAiDRSs869=7{Tv$VAUo8LfJ44PYeCHmFOeE83kQb=ttpV8`*@^KgMkq={|uUx
zv3Ln~qX<ZU&x`;6=ez>(KP~``e1Ik+J5K!nZ}H;)bnZ;X-Au|U(@$hF)_DC?WT<#?
zoPpuR3kHUo=SCtR&;NMA!0_V#5{8%T3=ED9$`4)~|No<w%OSwx*#G~vUIqam2RSq-
zeX)4{{{uKNYcg>B_&>cXi_w8edBb#r35+s2palQoAVUQxp<BHA{{b`r3QFKFxfmEg
z$?3(b|37Nf9T*&&lsmS|WHY)jPM;9UD7n2hhp~~7$?fm7JVq~Jw~e6m4NA{HYW{x!
z4VQaNPt9XgWV&Sw%BvFF7vwSiV`H*;3o4q-m~5tk@}J7IPDX|4GG&ZrOx8C+5~9;H
z%NPrptPDXMGbX2#AXTc<Ys(o`nH+qlCzLZfG1={$zMz{?k(tTWbb3J*qvZ6zWsIUs
z&Zg7a7!{@;C}k95GMWq0=Er1x7gRhrF<DhYj5B`-5?7d>P|GMX-Jp_@i^;hV$p|N~
zG}t!r=_@K3`IyY6B1xO1g34{l>9JLef=niyNHT_;2pLAD>G@TR)=a$@L4^^xy0B%c
zV1#gVs~K&DiV8s?1+FoeK|MOb8`Ep58N-+gGC{7j0F~ifOnIfC(%y<G`{neI8b%|n
z^j5egWl)k6vH%6OB`0Xn)&KuLG8s5PG4|7wL16lZ8b&*&q_-d&{ieUGVN?S7SBfb?
z5mdm4Oy{X%T*VYn2rdeF>KHYr|E*&TWis0e3S7nMrS*)mOs-2Im5@L)Ba1+$CIchL
z>{?BR3qQ3OIHotWGfG0#xw|6N@uR7mF5k$g#qPzxVVU{=!t{VfMmwf3Up&h7Qy4|3
zU#Mbaoqo2F(UK`R5RY0+qXTZ@QI2Y~k{@`f!Rz_W95tEJm5xn3EkA7-I4o@#1b*5#
zb9gXC_D<JmVzgrNSqMpIj1IL>hR4e32ih5Br=M(MG-Pt=gj<=X>+lsEJ&p_=FF}iN
z?VCBkB~lZY2{f8GEFB<im!F;t(^oe$nyc7=Gt5gzhK?5x85%&z0W=G$p~1lD(8%=y
zr0vJc>3J=TYSVRE80AzfG+{PiQSO0I?!aWaboz!CMk^*0OAxIxU7!_|CC)-PJ|K=^
zB8Ve1y`hy+ipfNB`kYoqJtm`_)7lt~m<&U~l>SF>0tski<YUX0uy~%%F#SU{qs;V%
zHb!<v-{~D~jCLULV<7QPMlmMSiPN97G1@aqg0h7HPe==!-HNRL|2!Csr-Fhho-q;>
zbU{o;M?vY#WV%NOBR^vzR7@1wil}82;i*YxHvz{3gJCF0sm!!a#vrD};0)x#@gnp8
z2M>mYPp2>FWHe%07C612i_wT_DKCWnE(xK(9)-}~93k}Ly-=DHn*Tw~m3g&LTe}&h
z89SjdtegsBC^II4C?%$2cR_hZi>WISVnBy2$N<&pxjl@kOl^#C1EiQ*eIY8F8X+op
zBN;WB>I*^TjtB=Rc0dsfYCwwU*eWrwfa3DULPiCP%x4Z3O$`MeOu69p0cc?I#X?4f
ziS{cMy#Mc$n6A*rD68kd!0^)(G+xG{05ZzrBzS!S!%t2I4p5E<RsBC+GDv_5-C9kp
z>F2W;C8r<gV^mP-$OO$yJFKf=R&a1^yxHQ|z`O-i&DE%TI5;%jGy%=*Oh1susA2^&
z7u5K(b^8Ao-1zgdykW^<d8E;c0c;Pb0SK}SWCuvCWefucDBJvupT4f2QC!_ExB@iR
zS#!d;0(%wopU3<E9f@fZ7!5dHx-oEoo9-abO;=4}<ey$LiBX{*G(TU<=3D{FI-u5r
z#VZCz#|EZ=f+q~jHBYTU!+SP5D$q(@1ytcO2yEnJU;s4|K&uBfoP<~EOrS~~#0QBx
zHZk#3toqOdYK?%zHk@Q&0yXG1oc#Z1!^!{uoEZMUd8x=SeS12iWId?DbZlUise#wv
ztOAf4{L~MNlmGv~YVd+%p!IbOGM4QB|1=!`|EFe!m&lY;|NqpeYdAPIv0iED`2WXZ
z#s5E`{)@$_|9>pK{{NWJ#lTY2;U!X|uHewH^#7j;%l`jyX!?Hx6riAhwMbx?UOtIY
zc6vf8BMXZ|6Enkfhg3!t7KbLLFCdm;y*dM%L(>fxh$ESIARNiO2I@!_i<AHVAvu!C
zp$Y8Be+!QP{|9p9mQ(-#K^)0)V?oFNe-<nL|Fh)y|HtCg|9_TV|Nm_0Vqk(fa>3I7
z|28c9{}1NK1duCDz5f4jY+#6}^m=iqlAZmS#VH0xP+P6wC<8O7edXB1D5IkajV4t{
zH2nlclUp#T?Zp9NgPJFxD9}-3U<C0&Y=<U>C({ciGRjOhnarp${Xrk2QoVzNV*?Wp
z!kbJC5O1D1VR7>R4<v7LK)v|`l=?v4{Bi34Plz{}x4h{1|HER%{~wkd|36rq`v1ey
z>;H!zT?`yBZ@yUi|HqGI|9`-|3G!vds}D`J;-1XQK+Xf@G)qkeg`b@NKm6qU|6}@w
zbVz#rgGjF*njq=*-vxZ>bs{Jr+`$3CG69iZSwQI(#0QPDIyU|5fu&cF*o2diHO3Q8
z{{J!I<o`d&=@k@A3e!2JF<R7vLdF8rZUna_kLwhwGB8@K1hp#}K=HxQv4VjC<Xlj8
znXwAgh&avxYj1Y4F)&)XF)&)HGcZ~lV_>p)&cFm(D%0u3z&O*Bff2Mk29`>}_PqH2
z0~C^uO~;OaLc3<UhD$)fQU-7|=x8!<yZ~7SDiqkAD}I12W8Cx7oq@xmoq@yRIfH=3
zG6oKdV+;a6-Twcmb@vER^kU$s(Q=r6dorU`{fqzqK&jEO=~xKVaFE&Hl&qu4z_b9#
z><tjJLl(L-Fj=&N9nNC0jDgAG7z4{jxBvg3W;4}jIWR1AVPM+m%D@B~Yen-6DE0qw
zY&!a+X1PN^ea%uYk%Fa={H>$Oz|w$Z;RLXS3}+hM8CWdZ8CXDL6c)=ESS*e)a7=Xj
z{|9Oz3&_Go7Y3Gzt{`*%Ux8bw#lT?k;Q#;Ep8sF`c=`W@W7E+B&@yRjtN;J4uKoXC
z?{!I4#Djr>r^fOEXhPHn)P?k5^7{*_GHPn1D|*Tp7(JN$-cGNX%4jkD##BZFF7O~2
z0|R3N*Yu!ij2euk)2pX3$}=_0m_BD3qg>LKz?%6V0zd;=76}Zj*8f0*uv=`w>n@pG
zo`TG+Z+%<=+5%;fz`*VOe~Y3;0|OU$hX<4MQjk1IFL;?!opc4r49M=Q|0^JBToz83
zna-HRB!6^z!*oU^Ci#WamrQ3gGumuu{itC9Snm<`Eg*f~|2NA*^f(^{nG0IUgs^ur
z<8+=GjEeOK|9=3jfCde4)znLaxBq|)0U7W^@qeTD|4n<r8*`YPQ$dD+<e-MIdjH?F
z5advpI7pB6qlOjU|2K6)Ej9$np<28t7i0!#y4xawL4?Qq|E5^bU=C=X)%1ckCW+|^
z+{~QyiVO|N%0Sz3K=Xm1g|wj6w%-3YLB=>i5y8a30P+IJDvRX*|3M46Uotgr0P!`L
z85mzWHG(Ii7AiF!_;HXCG)`6U(~+TKqas6tV<VG{4htxiGKuJbXT_L!Kue@7K#Q{N
z7csC{KVV?C-unr()8ay-Edyw02xtnz$I^j;&-wuai={1t1gNU>U|;}Ga!+3{lTo?;
zN24c$hYlC0!}0&l?}H3rw^$!)?0^KN<4cg+>W_X#N(UQNk^Sraf1_wk9jL*~m;qM%
zpM48#y|_hF!vpzx1_|%~{{%rHS3mcb$d4KZ4#y@&@Jvzt;rh=N7EO%;-v9r81S$AY
z0~&W?^Z;AX$WQ=^C-46owpt`I6nHQ>g0~}q<Ph<?VP^f2&)~T&kT^)a^`S-w@BbSb
zp&kIYk5N6aAr-8)fq}t7K7m2R`~QYekmU|d3>|O@h`8<a2eTN(v^Icz%m%X5`riLv
zFA^C!YFa*tcrdwuXaB*I`L;LpK<lojtITH9s&9DV!IW?p6dEA0*GTKHUms-H07@0s
z5B~r6{{R07NDYW>k<_rmgDGJph!57YkYNQ(t@r=`;8|yjq(%u3rUY=0542YZq!xy)
zAN>Dkk<=LA!IY4iP|pC~<aPnJ;M@EE{}^~#z{<d&!OS4<*vPO)R+&M<mWhD{w6DXG
z;}b*83lF_o4lfbVmJP=yh6SL31cxSu8K7iVvq~GB#X$iC+RFpVaX%RuK*{rf_y2Vd
zUpg`z0Lg)3z@yd$v^jL$*_VtA1u(%E9iWv1>%hA;EfzJNs9CIC@naz<TJ1wYzId^a
zp#T)Z76}Z}-v8H4v`}Pdn699~Br!eW5tHzAZ6jvBdg{BI5!u}kXRm#W=4=7)|7*dm
za1B&<+kv-}qPlzSMl^RvZ)N12zG5z87*pegY4aG3#B67Rd|SWtH7rL-d;ec^b-Kqq
z#yqRW7qFm(6iT+NV6{(w!_;zn|6c>%=L!y0Pyz<0(>1!&Kg?rvt8aV((Pz_(sc$uS
zJ20xg)!;o|pe-cT_drW&7+9eC!5dgn3&Yi&AT!bQgF~Q3PQt;l@&5^n>09SBS{gO}
z0Hpz#N4)>9mIY~q7;FvR42){<s=w0}7BIRAHok!5SZi=DuRr>Edi#7vRS8gd+A1-$
z)&G|gft9V3Uru6}eqcVM#N-W`JkxJ1V3aeP#9;jh=6x%$SJ7+%2PLZWSALwXvyib^
z5VRbX72)8OxziRf%89K62LhT7OORVtQb0KZRFKzXNmta&R|c&tU;w2aRG+VS3-<XF
z$lN>FBv3{Bs7b*4|B8!XIncI9CQEQIqPlm*MvzS!(--VvWSQQvkWt)K0nKnoFhL9e
z&+MQX0N!f}wiKRDR%n6@Rhcfam{B=45#(^|MNJBz0u*Gn_y6VK9gFpgUsrfAS%8P5
zkkTo)_y6VK{hp|1E(fRQTIJu9YBhges!{d;%{Zw{KhVc4Gu`11BTGFvQ!fCo`DOL~
zzZ{&|!B!%~z)2bu9u|w53=jo_IXKrLWiXHvL_z9m=KT@@J0pRC)uIJdlr94|gdk2g
z2QNK?I$af1Y;k-4Uj{CZ!J6RVu?(D0EEE|QOix(CXgK}uYDR(hhyQ=zkJe?7kjIQx
z1MmOKz+QnQb~8vD3MKb0Qv}5TBwFj?sVGCbqNYo^qGrE#MJ<anI5mNiBPde9<*Xya
z4)6a<!A+wVjSM@$o=9L|_5QyUJXnO;vT1Vg{=al8D5RiHu>`YGoU&9Dob14c!9!$e
zA~yGdQu%%?<-a4t2Jin%!3)YjyXL`0f!(#_C)hsBAPVsQzXTi+5O<k^k4!*KxJ$s5
zs)ZuMboB*{YT*z6{{Wc<OGVa?ni9a_!pI;13LEeLOL9T-Q1b-AY!rVk!IF=cK=Sc)
ziRFyquHaS%D7+!&Er#S;aK<v3h-uzpa3%r!6&`GhcY=aV1#I5*_wyO~r|(<F$irkJ
zIQ`5r#t?8D8`NY)b@(Fi;2@UBo8bL_5jg2XJY`&q?uh9H%NY%DnF@|oET%5-{=W#k
z;TdA85hTMP1=aKq%Ncb+;SKT|rgInKa_$E2{|k|vYlPuk@Ba&t!pHRhYA`HBia#SP
z@wX65{4IpUABj0=0XRdV=AZ?Tau_qE-thjv08%}IQ-UER=n%mr?friN<J9RF)-h^K
z4_MF0JN@ngM(%o0uz`{iC<wvcRQ%s)eW>Y$_x}ZuEC@PTfXM)o1yEYm3&0b`pm>An
z_5QyATxo&g3zPypm<+(ZF6&24KR{~0SpuBh=0nVT{9B^JgUJ9(o|->Be-Wb|ya%;U
zy8@d-z5maL#05r+x|zfK|9tRqC6GE=ACeYOJTM>9g94o=0x#L;!|Q&K2W&i;^ud`M
z(+Be)27-fHA6%oL77FvOPA^!*s4;!P3P#T9oNF2R7$v5^Si`8#sZpx}TGIdT%=ChV
zjIyA!A>`{p0bg_1xB_(cf%pG;;579jk>P{~lO8xmQ3G%8N08f41AZ<nK*2o=4<<cu
znznw_Y=Nd1Y#u0rJec%gDI^!EwKf-A2!k}ix{==h=Yk^$+T%z;lY@6%LFz$A8i2Z<
z6Kz2|h~|Pe=Y#j!{-}eTW>Krmz6G*stzk727aOP^{C{QogQbkJ(|gx3a#;p|k|L;7
zgSb!^+;u<=*g4=98LA`ZtOX@&bJYkm?ck~xO?x1y;Dgj>(>vBN@>^!0YSMv(5F+1j
zd;gye4sldFXWyN^U_GO8eIn?122hO*>O;d;f`ThbM}~smi3}CL7czAGe#kK62P34f
z3W_}I2Mi1rNzE13ixvjFxW^#zVjly?i+KzT9!x&qWep%T7D>%3Jea(}6%&a6(vE@S
zr5uBVrPI`e+NfY~L|ZzsEtRN^4z8GfU<0Gb^qdWhoa~LDgH#wYrq^s>R1pE~mVVL6
zpi$HE#H^x){ecIQcjfdA8yK}cb#&wz7{dRs?bDwF8bbTOp!g*NyTiQyQ$Xv)J(#?~
zlS`m|@~;~i8bJ12BsKr=VDbis=?g}N4X+&;3SK8NR7{`H%_LI~Qc>@Gxx$0V3!D_a
z|HJo>F*dM47L<b<p!1b0e<=P>{E^6T!Lf<q3MiyNqXWMWGEDg0$j|@^t(tw>puv(2
zphdpc2Lu@E_kW&LYy0t1{Y$S3L(TvH>-REFsb0yppnA{6CNO^vWBnA18V1&iWO)_u
z{~y6lhs=pFB)oKFxbXWW14nhMyoyBw!~fr%3<AGF6AzgT8oyUEDEw4pC;&}LcrfXL
z3oDS<UMeyafV};BAw$ROgA5Zu(F^JXgN8^zM`6IC8Kf4Xt{$QgqzI%Kv|tdV7^D#1
zkp=Cp%K?u&YytTi6dItU_xcTk#7i9pg&LOMlWH}Xmsu+O|6l9y^HNPqP(`f=(=vk=
z(4k3;Q);vr92^@MeO~%7aMW`Bo>cSV=cQUNs|tgx|Nm?1lLG~6lAT0AOD#diFVwIy
zgLf@hoB^*m1@FNCMUlmG$iA~0W(x<$CPtB(C+u57UbF41=)BlesVT2gtLC9qs}*Bb
z2tEMe|CJhM@QDm>YS=YE`_VXRUReA9FOcBS5~<{1P_X2HY*9?|U|;}mxdZK#cXD9R
zsr6*vQmKhBG}MD_U#+GKcp*1vA#e?shJ!=X|B{+c=4CYrN+K0685BTA1y~<oV64%U
z0PSLM0XZ1tFp#6`PfTC7nNh7C6jGoN1BFzrCeyN)J`4=C98Al=ZFvTVfFC>z3ZOX|
zP;LbGz8?Pn0g5tE%z$D8BnAp$Q0yR!gTz35kQ$H&A@2LP#ryw%$Qnon21W)Z21f=^
zF$mhcS<|Lm@uHc50kp>S#bO4I8WjW3=FTgijh?k`Rw6Z;0id%ij=Xeckf>=f2zbd1
z+K?YSX?n#LMpagI4+o#d>5H~7PUHoRe}P(t6Fr#R?t&J`nXyjdu;iGuy?QI79^2^I
zN~32hftp|pqh~8k7(H7F^^i3>ovp;jsLmt@?xf*8T!~3G5OlcGYE};qCQHTbqvtAt
zivQ7bl}681f;0dp_eS54XA%dG#b7;HiAiiD=wPKuY%LugOhz+@&Y?=6W*Ww!N=+>%
zhRvZ$e=S~W4%neepwP8QYI)(oqz@j61|2N~5(D88a;OrM9(Vv7<a6);{{=ukhvCsf
zl|~O$5^-YqKYFMV@;QYTL;O&sf`yC<_4wzsDj);D7{lPL65jtSAOpYPu~`ntI4#O>
zUIlpI7j-zV0zB{wn!5$<i+{n$F#Y~IM%l?M6_ZD|LyvBU9^DQN-la}pJM^@fj3U!3
zt~2u1H~xR1Vavo&vjjYlD*#&VXR&~Z;fLbiM8`%34$w?DWQ7zPc<vIU)}fK%fu-%=
z|DdJZzYj7^`2CP+My2L1r~3JiD?o#NiJl)Ae=0H+)M_v-vp&hd=)u6?18W6<XwYg-
z(28Bq#x5VnCI*ieiA)9HNfOXW?VuCeA22b1j!1H0U{KPrV_>xY&%|JT54^0@qxvOm
zFB!ughsOUqG&Di$lm8z8nK9kt2BW&m0kFM$|1nt4VPbfFkZHo}hfFhMHUBZx@AVR?
z?|cwY-}$-%u_cXB#Icb9bRsKgaX|-YIJmy$@$}s{7-cvYfQBGnH~xPx{lN`J2^O#w
zIyV`m*!~NE*?+DxO4NhSZ3X$nv5CP2svC6beL?;5*A)rL9~ePr^T0e~p~wU`6Lgq2
zY^W3Ji6hARtC#<9g6e0)qn~FPXdD!(ar*h2j553^R!nbL!YCnN)4(T?(88)<vw%+^
zVJU0JbcI`tPK*N6lW#F9GYU*^zr`reD6oC`Ek-p)(Ba<P9-x(wpds%civJ5ck{LKG
zk{MVkl0`GT|DOa;a};EPS6kbFb`Mk}v!~3oXW;bye+E3E06ARylL%<*^Rz@J37vv0
z1{TnKlLP2XNM*JspyP?48o={$$QmY3$P}snk;qWcQ4hA26>4iDDCK}g`zw;!kJV~Q
zS5!g`0xegA^xGI18<-%|7vMqrh5uhzBrr-qeG%yW|0ra(p%y%_|G^@G!Q}Tth85ob
zPl2aGLo(UyKr@#*oZu5`8D)MaGIacIWSH>#Aj1OmgW;_IGcZ;^W_{rO|0H;w2a;yc
z!pJM(|Jdxp|FhYFrZm0(p9D`=ge0@s=`b^Jf{#D02OWP5)(>9$WNFX90?K-o${?}&
zli)ENOM3>6nre_wL4qg1ArRilW(S&_)!}4d2InCV-N*<#v-=I?%<lgwpb)gEV-T>u
z%b?-?|AZ<i^gxH7PpD<cm|e%f0oqLravaDb-v9qTojs3%3*w;@Kf#OqkbUIP^xx!l
zB16aPMurKm4>Bz1v}I7z;RMY^F$i?pG8lo_4owW8qZS!JbBh+W3>-gg85m~TG6>DI
zWdJR~Y<>NZVTFYv!v@eY8gRB+`2Phg`GXwSY0KaQGRLv$|DO6zTZSMgX9FmORcbOY
zfeZv0;{E^s9*_p>yP(CN|3N9A0mRqgWMHwr%i!VI^k2pM|GyOLy9^fI|Np~}V+5(O
zNNP3kV3GmPrs8r8=-^g$Sth~hCifW^uv8>7C``X`pD_T!N_fpEG2P_>V@f^fv`5gq
zP)!c_mVm^H73_~2m>C#eKV}f9Ic!`}o5?(_)`fXmZ8qbzT5XR2(1F^uUX0gjy%Yj!
zz1X)@dZ<0Axeq>m_(a9h{|_CT7&<`77Bu(xVhw`^Xr|4viQ&voM##$1nkS&Wu1w27
zvu{5e8R{?mRAgxQagd?nrz1nbkB1B&eljxr09{$&{r_+!$geLO87{nZWGHya$j|}W
zY6&tFydnK)pw>%8h996Au@?^+K7eM;K>I&mDl#;HBE&MDfu$mqL8+$R6?7NCf|^yX
zI+mdAGn`DzY954w*gUli_2D1}U#&v84rqP`R0h?0GA*mAchs8jjDcgL8Ux=(HwGTi
z3>!?|7P<)uvH__zz=KH=eCr6vAs~yr|Np;&oRKS*esHN+D&ADFlz~Y@m4Vr(i9rE$
zZ2gPJ3>vldD$dhtH65?jbb`)iW8YHIA+J*N+(8SpyA?d=!@;zyqEqb&C^<q)fW{w*
z3>#iNW)QG+XJDy0?j=&Q%15Ur-A4z!`IM2NpkgrtU(Es^9q<2#z-8P^M}`gH^_rk5
zU`2+8ms$)OH7^~tK*@J{izlPV^dFBHEfhks4%k&>GAIRPImrcNx!Hv(AFvBlc9IKJ
zcC)K=X5gD1;K?X4J>xNB!sG&P*7}G4e}r_o=!JA10~a^7n!%tMQ~_}M&|qHn(iyb%
zo&B+66T=kHEF0+16pIE1rWcDDBrFmb94u8C<Sdplh}GJ8SAgor8V0sC76}YCpk>G)
zbs#a&#Fs-8Lkq|bkX;}<K<3w+U|Oco7|)OaJ}Nwc!2zV9Rx|J#<eYjh5s>ET4MNN^
z5}<i9u+>mi7E2ifz_JMk7$xdK1$d$+cuhbDEXo+5WiKf0ffBL?3j@>d#{UnXp&#hj
z$lUXLA;S#NnGhBW7%V`=DyaPZ?a0soDr&9gLXH~+)jajhkHFUg)Yrcf0dE>${0W}d
zuRqDYrT+16;R?{oj9M$u>Wp8R77YRn6RM}1J!MoBhA)5kQO(fc*u-qmXgxjaDWg1N
z^z^Q$jMAyn3=?XWdWm>2{sfl+FYOr^URN_TRBEz6c4%T`d9j~?BmCGgyYQ1Pdg0ZJ
z?LYxubIiK}6iy+>SnMp8GVp;y0Tk%rX$R~;>OpEO8W>oD)0{vN!x5Y|o$DE+B4f;S
zoo9^lmI<#N85%%^C&(YK7c$HM6`-JU3{?JrQWB_r0ZRU$ECdQW7@l77j8VCMMMEt^
z0mz4t3G+SR9P^`=VTSkr|2_3Cmn%TaFMcaBRCxdYaTMg8iY&D!pkkmlGPt5r^Z!GK
zCPp2QQ(xLMNK{ubC?Pu+)L64v$)FIN=4MxMj6nh9HBjRz-0c9^>lO|53@pKJPI4A2
z8B~JZ5Q^%nPl<pGgc%010Ax5g3|2B|fDFcMDBMgPWHYPp@h?F()B2tOb1kO^^RoJT
zw?r&fPValpC?^4S-7%Q!7+8XjfgNWu{lIfZ)p~F+{Nn(HprtYclO-4b|B5Vm6;SuF
zQiXpBXt{)?mjH83i<3x23(J$5mLM?g{eKU*f|j*numIJ!wf0`1i$NB6|Nn<_wFc<K
z1&gHC0uLr(@X`uU41!`67K;|>(FoNr!GlQ%ygUq+6p)hvs5+azVKtM;bdJ@GJoPoT
z(iNZ_0L?Yv%V%DsFld0Xv||%POrr|;oP7q+HizF289G4AQ$YSj#xM3VFw{R`--4*$
ze=;`AV_>LZ`2ku?{p3X*gU0KJ3>_6M@*dv*cY|9$FX|Wsbd(u9L9G`H(CNL9w8Ie5
zXve@H)5#zNT5@2iDZp&eBEVd!$?^mefL<cr|962GkAf@%WouA@>%sUnar%L!j3RQd
z5P8waa1B)Rd;kA>5~Kpu8hlYVUGEj6F@GJXf$%>8Bn(=LGHoWK#Pp6=j0uzCSVU?%
zn3sWq;-xYJ11OU^HZj;t|MLp8T*iZG*+ebyW&{D4Ez>PtGs<(G0WHM<NlkC?WE25y
zSYQB^M<JaD>;gKS<Uqy+bh_Dr$~;gyMJjOT{9gF~1*p)qIl#zJF^@qBRKbJt_Up&c
z!q=XGqt@2DqE;1B_=X=lU}qW6zyr$%pyXH^A6!xE8e9>444hwd!MO^g0Nj;oU|<1t
z2tYXvR2qZDpZ*3FFf1T3@QN$+!k5KjDFZ|n;vr@R2Bh#f0rDKk(J;q?91rs3OJ#_o
zL7s#;7?giNwFSsimYNJKwe|?lfRdO)6T^y{6->)Qnh)54+!@g9Bp1-^W(QJVk;#6{
zB7q^$0ao>Z3<53L0!e}#4>e!`NHaK3JpBIyWB@37K!$+YQuT+WD?kfAkW0JiEN>Z2
z>Ot0mmUe)G1Y{z}`btgqBlv7{Z2F%8(gU-tQW<ok6!S7{wt#k`fLs8w8B3it{rgfz
zzUfEbG72%KPQUS%Q9d*jRJ3~k|7Tl&SfbLQiJ=6<w`c^NH~D8}LnA{0h@a5Hz){lz
zIz{`BDM$_^=KcRqXQLuRL7^sSI}$_0@B82t>flSFz_si2jCYK3W}t1@tq(kyc)$})
zAm@4i|GxpPm9)Wwi3hSWJ^@_aPMH4ZEt6z@2lFyeUj-V?u&mLb!^*(&`Y@;s%+TW4
z$nZdi71T>(T%p4X+T6w1fE4{qHTxj-JtWo`zkpVWS2VLIfGQD4R$~kSg=?tuF}qMt
z7d=p{ftqqP$=((9pePMVX0ZbWCamazTFzm8k3qzt>3<87Wh`ix&45_OfMglNi%{nS
zb|4F376m#xfy<9TXE!@o#6j(<hqU-v!J9wVfGh&#Tu^!hr5t3-K&b<iV?hhlYUV0e
zfYid&S*&DWsoAFmZuNjd0i+hJu2Z?<WjwqYwkA~TfL-`vWXDPU{}HI=Bp19G>Ow6y
zyWquccAzf(^gHhvWx(5>z)@X~WFaHWVW85_B7xyQXdndC8-)2fq?yeQ9K;;V;9fn*
zw;;LdB@7Cc%IwEL=EFj#CRw=x6br~P08$T1N1%frDw0_gy#N18<gsY@{~s*S%m5O|
zfTw+C)V?yP2&p;2ybM%~prxyV*N+)I>Q68&19_(Yzm^E-Jath2%%PFNV!FpiMiZ8r
z45nq^!b|M+V+IcE|DdgJ|0f{qn!fHMqoyEu1?r1Nh9XEd`C&SJ!7oNBw;$m3$%ur<
zP+`-+zz9-P(bD`Rp@qT0`~Pq7lp18w90T}_Sg>!KmT#~~YW?BC#Hl)c&TmF3rtdqa
zr+i{ml?I(1{}^;={SR<&2voa(4D|m0iF5jrPmIdCVDlhCKfxRMEESj-3X&Nd9Gm|4
zfW$%PM_M$1Jo0<y^e>+nRh^-E-uwS|aO=_g|9{Atb)fB+j11sf#-f3t0Tg<mo5Fr1
zGA!`^{|%hIUx3-~AA(kmX@IYqoA{YgxE_=bK*{ch;(x}Pz1pC90CWr-N6kIsike^6
z;HA_vLCYQ;87;j3{{pXYwzU2KzgF{;2x#q{V<XcGm^(pk_Wu71Jfc#N$@m{MD(}$5
z9Pw)*!;0UE3@2(b*|%8RGZg$vWSH@*kzv8FgADZ>em!K^@tcw1!0$wc8^0SF9@MOS
zc`4nafuUmQ4yD)i3=>}bXJB}7pP^%+H3QS4XADfWrrs45FF~zkCIwJm3)DMzXkt?N
z>B!Jv>%_1u>>G<+!+eGUn?nrCCUR}k0EvN)hqHLVATUvD6X+z0WfsRaY1Av9uK2OC
zev^T$83S{Dr}DHH`xzMO=O|vQpW_iw-^sqkT84qKe(qyPOW)YLBAk=O&inss@E|1U
zCP>hM&mcXP3=GUQuRdOLY+~R5Sya!-zU9S1Mhj~h1}0E1p^}4r0q8O+kcG7-aC5*7
zz8BL&zcTXITO4F4sApl{0#f4r|24P|(J0SQ0P_3Gc!rKzGv{d)&)FY?`kS?y8v-1g
z7zD!S9<vMYaM7#Z>s(Q($$tWLF2Lqh3@o5CDnSX^>N^ADOL>Nlx>vhFV~wEhoIu#C
zV|HOLUG!?byel?(Ffc*WWPL^0UXb73g7?FE|6c*#7-HQl+yS~x0%V}~{}tdx;x#g$
zla(0+K#@_y`2uv0(i2b^)TPX>fH?jQWT0n114CWQVwf0Ykvb@R5uOC^(CAcTDA3^)
z0&UP`xbrHJVaBUQh6VM9*|$tD_{ONh0=l<n@`Eao`ns39D?-hW*@ddR=+%7(jYBwB
zgmN6P3t4`^E>OcsE?~KnT%d-VUByZUrGVvbcA=^V>;hGt<N{UQ>}(Yn87iJK@Ol6L
zi*k{pHE5hSsg1*fi3L3G1G=RWWHqR~16hnz)=hq0B{==YH%4LJ3=bw2@RkjbW2fhQ
zV^jd0zmC#Kht;38uIyXDc7TsNX>;&kVg~Pk_5S}q1y(FI@J?U$oiUnS8C0h~pE{l6
z2V=e}xQuG}&A<R^MuR%Kppdm>U|<5B&JIc@-v3`XPM`CGF<*2es0dmZ$G{Z+lEn^k
zhAzXK=?Xs?jTv`L5BbSxFS(@F;fhY9H3LHpX8>r;X~aZpNLyg~1W9JY>312Kr0Z)v
zK|5Oi!w+%>*<1HyH#GKMKw=csq=(1e3vi5rd;%)%z5o9&LHLM)0aTEKvz-D1BWU=x
z`P3#09XSSuAJFR>Cn_=&I5aW(fZB}{PHj@O0QDoFt%(KR|6g1M`3g};zh4R}q@^vv
z<CLJJ4Qd>K_cMcTvji8hAHb9T(Bxd<{r@F6mx8KP$0mje(>Hu#6svy^-lOv3Aj5?h
z3mHy;?w<mW_$TMw@L-Szr|uVw3=2Tr5>TxM8W9Gi22gE>T*Fzw>jefT@Bg2`XD5Q{
z1cxRD2}JYjJ$Rtk`~Uw0kXJz1f~#ry0Z2u`Fn#uKMj1))<_Tmgtq*`3SS8aBEMSze
zz%0k#ffF929DfcTiv`_t2udKJzy>ATiCUX1rXTQR6q%fm!8(1SB9rj+gg=aYY?~}B
z9<?o)Uh;>rSrcCC{9eeY;K3jR?nr`s0P6TTG%+jzmEs-@vU{g1{AILeoH#w^FQc4T
z+XD~Ae_&5FG%{*Hl*rdkpYWH_NUv>$2jgFG_Yz4Cd{3kI|Nr1E|KI>fWcc90pr$+h
z!(T>e#=z-3{}{vT!POqz@`nE>KqJdw)k*Cd9*lp%^60m}A=I?}@L>E4?mad%GJJrz
zN)GHngiGYWQRMyq-wBYpAdFBeB?q<uNinz`06O`6dcr;?1@L*vF-Z2E@L>D{9vMey
zkp*`?z5oC7K&WdM@L>D{jxF#1|2+`)$%3m!B)y%}TmCcZsvrEn0dyVSZ^i#7U{~S&
zO8gJn1tRdP@&AHf3;(YGU70ui&VNQl@mt0fHQ%f&td$uafI49>of&?BPF0#J!W80T
zRn5RyU(UXzzT|dASSE`dC>PfigE|KfASrx51B2rv1|A&?P?5`+@!}vO=t?REQ27li
zVJsdn<bX;W@Ba^cr*2^?*932H@%}#-oWHCWgKGqotN0+b!(7|x0gO!QqTp13S|L2R
zIK79FNpbo{Mke9u0rpHREVUCF6{gQoX4Z)T#fA>(&Yfrm(8a$MAm@a8ve<!~19Aqa
zY6UsT`~N-gybj1@P<jVBweHyFih39JE!FG{3Lv%K|L=jf-+TZ62R^8GdH@rXbUb*_
z&ins=@SzYOEimI@+CVk7_y2pDAg6$g2RQ*|1;}`i(NHHq6Vl%w(6WxXfp_{TCMHAB
z!CAi;rR1K26~GE8@N67XVKLo=nMs*3b$SFdlakeQ@WwnudG!#Iof{Y!K_h3NgzWwQ
zAvghn2L3=f6DnpoeG4;_F=TTqe8))wc*E3!>7bF(=^`vlVqD8FfQuT&@0E}?=`-Hx
z0W3^13Ydk;Q%Jxjf*OkVJ|Y^2ds&#I0>N#RnkvwA74s7vd&rd=6Rj9{9GjR+els#m
zu$E#F0GFZ*7$xeN4_A0F-hymTW<Ffu{r?`gCIgq4VE$9n=^Cs|UU^Tz?TnXJ3<8jn
zoav9H0s|MQ5c_qIq2V{^%4$%_&V0CHqShuG@BdH1^(Hv9z~<Zsm*gOGK{Hk$d%geP
z2iH<MHVh0kWuPkrm^mP&KQqJh2dqqDW}9s6l^B*;ConKtFJNG>w%lZ6k<9w4BH2R2
z`~Mtp?1R*U&hG%lfMXNmk6#ZNI;QKeF=={le_dhe&iV?}h^zJbc@1<dSpB^qk@{nw
zE4=^T0#{27HyIdS>|zjrC!G}bEufJ(iwCT)tg9KAYL0yp@&11+cKQM~CQaV$$Lzva
zfm$-b6`Nj8zsAPoRu8&Y1{5MM{xB%K6l0J8h0H?m0h<gGwOZa4p`OR=Lfu{TEFBmb
zKqs1R^k87HWnx$cngR!fz($Qt4xrY?OEU(Ejh+llpzePnXnaM5eG90*_5S||9MgzU
zyaP^Opyu;LD~9RQ*_lKXA?sQeFff7!??8P-kjb@HAJ<vm1J!oV{!Tx`&J@Jgp5ejx
zxfPUSUL9m;m|k#&No2YM2a`DXx<`iBj0_V%ySpqJ7&SmwdwBn!1Ky|R{r}GyaIcE_
za0RqirQrSlDY#MrRRIo7|JPV5Fz}$H15k$to(>*?PXh4%{|DUr0-0@*)b8NH_zAp0
z*ZaTDpB#{bEgBe_z5hQ1m(w5zf*ka^5wx58Kj=D3Q0@ht8l=X_6y#xP&mi#oAZUP_
zp#e0`1KQT({r>^D`2ZSF^!|SfY$+&SK@NLS&(JZ^o`I*KYm<#d3+t<j7El73b$9w6
zP9~}P`;ZOthd+aMxiebKXV~HW|327*uMdJ+c>hB{mNS5QYtX}TYU-sce<%LG0ovx~
z*u*pkbblClTiaaa3dbg<2GC?1=#c7#nwuP6$}<SOjAvL-$-(}3As2W&r6808a>bu@
z0s})$JqP&u1szbk>NjXdVI#OJxS`=cLqjd6^|V?J%WJh79s!k_@*be>LZcP~OC#vC
zN=*jF`jghv>hD=ztH0+F0J5;TbCV4ya6oe$^>YFOYGgDV>SsT$aBO63sXxlT1)PqY
zFIRw8MR@<e0q&00SGO`KfNDX|K&uDi6>x3vGM+)eW)Z`(m+}lVKsg5Fn1!mF94fuo
zA20L(A4<o#QFRk&hgnFiXK+QRnu}hj7Gwsb*2}m8G#e7?%3=qa1*uiFo>r@Ad97Ac
zBLLjz;qVgKa01@vneNZcqy|ZPpe?00z$pMUx%b+U0cDRKw1KyvKAC;X>%{*zKtmp&
zMqViUF}qMU7d_Ba6*xqn8&`xpXR)hc2L&txWGfzlfUO6GtfdwMi=`I>2lyUMhY%gm
z`GdrUutVd&7Es>$v5?_`MN<0&561V9x_cqRgPPsi6*YUbE4=^z1Gg+e0fQVU-v9qO
zo&jlwVR#*($bjKnkQ$J@HF#j}-xnzTX8IZ)Ch2-bcyerHI8ZYOk{m%PONW*96?E6-
z2ggPxonN3mtBMROEaMpjKxORjM1~!|4l+#m^^jr4Z$^d%za1Gi{9ed#qBb<R!n&Se
zhqdJ<pO^NKvfr_ZaSbT7fm4(6>57Jxn`}H7Fa8AIEA(PNgTPCBh6@#|*dH(U1h)`G
zKsPFdS{<_s)pF6Rj|#46lxNrx?#cZp+>6ByG`lj<k)fb|rSr7<y^h!F_j&}>uVmk1
zEz7_N>WJ5xfu`%OfJZ~>x!AXW%m?WKoo!MZ4(bA30r#gs4ti0)pFyBr?Q{jGeNcB~
zb4A0;O*SCKpizMOov$mr|6c~zI3Pnng#&1TOnuwqit6JG3ZPaONUit(%izMJ;XlKU
zMn{H%7xx(iUdl6EsMWHbR&fl}od+f507!R!C!|iOw+se%=cPes6>ZjlrtNqJ0qZCR
z#uxt?F4TKmp6<`bBq~t1cy)#M|Eq<dXneuQ@L~D^F=i2&*NzMuUMDi_044F)jSL4~
zFJw4jp~&z6)R&pQ;R2&beYnRlyKqkzy;=@XaQvSF@-8UeKyd&He{0K4PM}tg2jd0s
zo@|g0QKR8s3i_2?pqj@bsr`Tl;~QAF<^#xfn9ZPG6eyF`a4=85J%L$J4kQWf@AyDz
z7kJsoJw1(|NzoJBD+hN2n;(NJT5v-fRIh<5)<jLv=nAZEy9I6`ytIMO(SXLW7(wbP
zS{Rt7U*KnwQd|B2(k6NhZYCm`(@+bqBX9Xm7Z6|)0bg`7T|<CLUUn%ccxxalc1kP~
zm>57MGRV8$|0hXKPZ419W4houeTx87AKRt~@Bf#VPWKRGQewLCae9s*6XeE}=^cVh
z@`m7k7ATBCuJZnW8Qehv8SK#XZwe?IdjJ0iUMgad)c(MO@#WR&Hw2lyO(9L4`3&G=
z=PVY0j<LH24hW0+kmIKy4Z~~TlnY^BRE2C?ZxCVv&q#vjxEUD=VDsFdB}G3#BW?>B
zW>`8itN``AL6fyF7K5jC4&cpi@eC`%qgm`;&j()<2wo%yx|Pi0Aj1n#qN(2<JZ<qE
z2B!MGf!FHy-Uu+RU&X!!oWUYM8SE^0tx}^r!wS&Q7U&9>m+=e-YORrnw{A@L7iLm(
zjsg!~9jN!Z3?9C6XkwTH9kK$C%ZA?rjaXd(2aosvu7{v#g7!}&Abpaqv(pa<Gbu{5
z9EJ{LoP%YR1Fsnw3aSsYKbXGZJd*}^J9@YmG*ftiGX=P30*Ymeqz(ZO#^>OMtoQ%_
z6F}C0Fj!8JVFSn%P~ryF9`N+b0U3z}jbmFZU}yk^FDT-nqq2<P)r^d%z=Lcr<r#Dt
zUdA&_0Oi7knwugJl{<q2ta7&iRqo)roiSqi4G|_~1@LM{<k||X1Xf#dT1;0KW%8+C
z3vwxFa28Z2Lu~~I7-((*S|@iv>*Ruks+%Iv>f{K=CWaN{*U8i0i85I-9-Xcs#$+Ie
zSyTP5fCm`U^foaj1IA6$w~H~UOKnO31;&rgO&MT%<)#8KeR5O9<PYg0(|N?1gd8`4
zu4xDDgl_a;JfR5kCrFLO0tN8$uNRq{Dm)lZfSaA5W!f+8Hx+<eZ;T8ApknB!)~4z4
z;!N80n-X5E+5{dpwtvL1>_yk60_*>q5<s&ejm``V6CD{rw?K=48fA`6j4Yt`_KOpn
zDnLiaIW{qT(cn@5T~M~CW{E}sXb-q!0|WS0`5%r9;9+Nrhm004vNmP>U}Q|FS)i&@
zvy^=c=t_f^nG6D;!wO$a?^S2wu7@;!876>QN}%-z3tlm>F63ljtzmay04-ST<YZvc
z;b6#iY+~r?1T`!)85nCg!E!n;Kt^*gFSAf&3;-=g2l)<^7D3_`3IBhAssZo+|DQnl
zzoGmq77719d;k9rYAf)9r?Q|sr}s=>Ai*SFzr-Tp{}<5Fd=?4+e}HaCw^+b%0+fa!
zspuG_Wi_8c!cv8Sy;i|bM}w2$IB1I3p%Hx7+Hs2(22P0D!{Fi;6hjuEGY^wG3_KVg
zfrk~KZu$##6XdoYP}`Vs^1A@Jdiz5R%RtRyQ1*FIx2XUYx%Np6%j}yNmU%E9g$xu{
zZ>oUFc`zP52(s#>-6qi0r=a2~1vK>p60<(k;qcRDQ^SOp3=E*A{Y#ro4HhpMSbqH3
z)G(8ifd$03<YZv{DYL0zqbEZ>BUr$bf$3+=riNOFKROdV8JNIgnhY!;gFF}yf*k-7
z15I^+46SwW*Ll5XQ-k$h2BzP8HZ^!K9)y(4M?P0T?mK>6;lX%xF33S3^&X4|A?1M0
zrUtMXkAGKyjwJYLBeAK$`~P26P~w2}NEs|ZYuV}#Pyd(5tmOqV;AQkCPy>j;Qj3AT
z=7En+4TlBjf<z9`WeXGK89?IPAaxd947?Ue9RZ*_!#x-eg8O|Sa~+!g_gEj8{!WU?
zLg)ZEN<cQfsAmxHU_7vNx`i~8Uj3#5P_$bw`2XL7@i4gGj+xO8gGVz!VGf#fv3S4$
z3ik|9PqpT@am7zHNSMD=gNFArXn3n_Y5<2f8#uffE$ta3Y8`xZK<X?x8JK>uZEBcU
z4+?XTLQe*kpKhBPCa+{*0V#M<&%gm%J^(V@gK<B^0oI!uY7+c)Uf<r-@OnN2Xd0La
zRN4N%4T^{T;L@<Z<uN24K>Oqw4}-_!KxTO`?gt+$_!4ABmUIOu5J2%z|I-?*8C-RM
zB@q?~fO^G97J$PQ%>r<73o^`uaX+{t_%eD^1Gr}mifAq`k)P6=8tPYh>VeFL91p_K
z0rr^nCeWg->5pZYBp4@5|0BcXTMx<*j0^%G?V#iBKtt=u83Q!S?7?^t+;;_)cCbwG
zA`4U+Ler|<Ch*J{G?FSnkpv#<Ui_M1MA?91WTPhoBPaqaK^ensQ$ziOP#w_FGe`_+
z#^eVmQ-l4X21>_2JHYGxCFGbSSbslc*kM22RE|lWy`~Zr(wnBo%P~pTTQe{)crYFS
z*W}1)%-U(j3`l`~0Nn5a73QGI3pDa!@qi)El7W$-{{H8RpQ@W0CVDb3yj0!PU~!Ux
z<;T%Y4KrRcuz>k585n;&-PEv=lYtS$2d6LAO%3%8t~yY@Da%igzyi1cn7`2zVgTq!
zb&v&}cJS3t48I;SR7}^9X9}y|15R6@ECsqc3FP?3NCt+NoSPaz?3bFG3TibS0zhWe
zYQ7Sw;qm|-&eCD^gMm@joPpO;lYtW|R#LyfT?Z6*pkxGEu2UNmT=61nQ-eh^1JjQz
za8d*hX@bfe9dQN$ka<7NZ8kMHHZdyH{n%a6X%BIrL(_i=9SQI#FVCxo3>A>VW;ZyO
zgGRa>niwsn8z_KA#tJriGVpu<|85ELfI|}lxJU3(a}(&`a`svWKb;z`1E5t|FF+^h
zIyNyRfR1jS-k`u#Fg>A)*+9aYfk7ag>zG|Qr;8rQD$wkr_y7MK(=8O4<OMIhz76V(
z|8KBJ`2XGe|Nk}9GZdLrr`xV&<gW*hd@wQy*e^mV>T5R@fYzVEQZJ~eFTTeR|GJ(*
z!h>-yIG4VtK`!$5g6G#?{Dq`!XlJYdl(IpcupiGhHB7W;V0i(e)fpH-2^C!IKid=n
zDfiV-%OQ{gSn7rs`ye&YB53wWND&0;(}Rj1@Bd#lp&=*o(q_~2d?hA7u=kSS-UDS^
z#s7)0nyjW%xdJiQuE0=p$GGCBBEt=c7x#e2Qa}j@76g#gzXv?H1S(}g3FN2NriSL*
z)Af{@)Iq)kIU4FKl09Xq04ZBRXQWqmF(}nH*y_}J+QJHAP&vy}f524-;@Qt9p`JAX
zIq^m3rV0&EBcL8s|Hyv;O)+}BNMyKS(Zax8{ggq$gK;;w)&O-)rvFG}*5R;7`2W@W
z|Njfq1@<w@PUl_C$n6eWr3<R^L4kx`vVqda>-nJg-vu7(dr^xV|B&T>FXJ{%pRd9s
z1uBq1HN`|NNL*V&qYYdXK%$WmBo8hMAbcheA0?_mH9WZB`qT>bt;S2+O`yR57E4bC
zt(q4hI<*cVIu)-N_<qJS2y|*P2+p);-~g4R(`{6lbf!0~V`Sk6jh27{3DgmI{c_Xv
za#bdEwoM%#j5~KuU!uyS&3JeE1yv?5%}pKN|NrNJRlWqX;Y*qu7#YBa2!Z5YYHphD
ztj4sTYxxh0q>cy=#w!=M^QbfVFxJ;(fJW#Ue4wf(fZDH)O^}1ILG?dq{P?9NLjXwJ
zq3QpZpIi(9phhA{4unDaesXS_022eb8zgR#)B!*640If_2jgY%{1`|*Xj%G8%}pS?
zQbC1-2}lDBW3v#{4hK~fpo#%x5y%jbrQZMlzkqiH7$7TxKx<b(g%oH@0!SUmqUnD$
znA$iyK<)kp55`N=yEU20;oOVUxwV*<bFSckgv^EQyS13i8R7i%(|>C-edk;u0g*m8
z{kIO2Zav7BP89~`P)+uIpj|7DO$?xm|Ck+{7(mCWGJ<ATK`w>)3KT4zDhy1ZRW&~t
z85%-0PyPd~L2_&Y?Qr>V^(7<2f*%<S8lW3LUobK>fb_$B3o^s||BsDOH3lFxjFSUG
zMdcG27Jv-%{{N#DDhXO;&j>RBG@UCkJ>VcC%k&?*OfoW{yIheS1u_`a`2&ehH_&4e
z6Z3Bciz$K+7zddn0G2xd+5<p}IRW6|TaYI}js-;>syX%0Q`62gdNQQgGB9w2dNIk>
zaDlGO0x$by1Sv;$YQsy01Rc<oT}}U=bb2yaTXZs5fQHRNz1a8ZaDm77R6u8hS+p>4
z)UZ1^I5hs>)9J#%43l?g`u_wJ2he_WeIaPDej+17!;eM=Q2AK^TCfRPYVH01?@Z7}
ztwu(Mh8K+t6(EaI4Q9|lHyCtXEG!&hjs|6CWWU2A6Ovq~pYvqonyygK#90r%Qi-94
z*nmLtMB|H0_|j?t(D8EK|GzB-x&1{Zg8?)PaCra!HW8G4u(<^k*Bmg1Pgl@klAoS$
zz_ghQmK9DJPS-JH3Kz6|QO{uD{r{(-MFMClCsz_QMx-)*har=*s-Uey1DmA+2ZKc;
zL(`9X1_g_S3<Zf^42+eY417OTK-Ks6v(pufn1UHAr<WKpDcgbvvmm;J7+!#MG%_?{
z(WMJ5JxxF^1Pum)(gb*w9(ZcK9%2M1#E69qO%{y|J&9fnOkj%@8G5|`f4c}W!m;W9
zip2*RTEb7U*y(U_g4P|)2tVbb7k=`X9e8{>kzvR0Mur2ReI}q83(x>QD0S3YgNAc*
z!K>Cl$+gzTyTY-FF$d&iTZe{vHc<Kl^;<y}Z$8K{31s<3MurI!9l@4^Z?Sf0V$i8i
zxm^LOS-k(}g4<uPVOG#MruYB<-~<0bQPHW$&<<*tS~4(jf-C`<3rdm`9T_HAIx_Ta
zWMt?8ZCUdE|MjO1b3JGW+y51y@hXc1h7{{Npe>A9;2BiQsQ=$Vjr34Y7CTTO<Iu$5
z;=#bs;xLavq0ycpp_83~NrRJtd80f-g+n958Bl9vqCG=G_)0dr@V#tywVnY1_4i(h
zgnF>p>2QGTVesg*V_@vw2W}s-=yx)(Iz%-6-_mKvz}hLtzy`WYx#J!Kd#GlETquWw
zUah8cMXjcB#YB6C6i~Ab<U0@sg#suvy#MEbD|T2&fD$JpH2$$9OlS0D6rTRTgo%x7
zg@Hv<M}r6BvE1n&OqdkRemrDYvC)xXfkh^R1?Z&gntCY_55`sC;ZTsrUOZ%2vCt7T
z9sQq!0Rk8s*ruDAGFi!39AG#MTb*5T>;MC3%{S->QSbkmg426Unauq1!2`iB>KQhG
zwyb#n&jyb^yqM3x02#z#P<c_$u)<;i=#KJy$h1m51A|2ah@TB^TY?%Y77Yvsy#MF%
zP8Tp^vPl3{-=Iq%Ko?s4Sjfl#y1c@%iSZ988-wnr09^<HTG{)9k>SEiI|hN*nG6cA
ze=|scCd?h17&g4LXW#%;y+5rPBtXlNEEX_;CgK@DHhD0vP@KNSjLE<Lg9az42xP1P
z-;j{VFasnFy5zt@k>LPnh!Hfj11o`kT7#C-{x1MU2nbsw2r&F^1O-|qc!U*Ha{Q=f
z*Z`Uz2aQyL297}i0_w8-W@Kpit;o>v+mT^{_y1gQ4;4J$0_uSMsAkw<ZNq;6w3FIW
zsbfY>m2^d|xp##J0|QD8ZyC>!P;2uez*3%}phoM2L#^f|k)QUUrK=1MKjj%DKzk61
zUo!CjmIwLy|CPGOyDK~x4}%Y4z^b?2o&j{m<B6Bn3=*Kga%^Jy@Y0$=!7_$H;HM`8
z2Pi<T=kOQ&p3R^D>SVlTWN3J;$k6fHkzvAXu+RU6fI<R>VW9|;1BD_e<Uk<_+O7f$
zO>pQw{Qm=1)=%%SV3Gmf5HNj-1(SgST>nDwu2GB_n0~{8Nxq)p*FlB?P@smqY>W%_
zvM_)LZX<Z&YeL8m7Q347))g=IGZ?&%W?*Qz$B@w|$B<LAO}pa7LPicy4h!XAs{`e>
z`qaadKn0j({QnP$ngI;83ZXjIyBQekcd~D(wp4op8ejMRpAH@`s;L1r`RW;a>QzpI
zCYu?&|7U~SX7#G4L31Arpg{sqR;{)4uJB-73ZB^qS@<H6kpVQK<H5KTJUsfMk&y!|
zwg6PjXF&$E6d4(Gq!}1~&u37m*En7A+n&K<@_q&%&;ZqsdIpD|_6!=0ii|uHrR^C!
z92yx?sxufAthfLF54ukfv@O+QfyjqxR!mB~r$lNF*y>ok1YKKoXu7@?lT^K=mk6kU
zv{hhWo*2WxF){xCAItdvKN2+=8S527bu8omf2m~%)oF}lNU7lhPrDk}Du6r4pk`)5
zqdkMbtAh*$*werti?EXi?1D}@$pxKsvzutez%bE@L1Cg5gTq8ChJ?oW{~tU+284Ps
zO_&(}{{v`!n)M$Bf#1JDJ9+=gSXwc#)E)5E@&5n+1}q_2G_CNkNb0!Y!FT|?SPZ1!
z`~UxjX|tFmvoobDL3=$xgSwy#+(2wlsQ_)EB);@w5P0dupzxB5K|x0YTnGpJ)L`If
z<YW-g;Q;NQW(WY)KtHt@6hPG#sAK?Ly9K&_3ld3-!DHK?fxqbw)R;u-e`+yEz;rt_
z{onE8Bm;vj0|Rp+2P0#{Glmq<m@#N|uq^`vCy4FP^nVIy#tL+(FzB+K9|sv48ae-e
zc=3vX;iV^oK`IA>L(PBdirTo~iiw>6KY*$tkc%2tGI+e`WYBn#$>8u)k)dEB=l>rQ
zIseyxnaKJ7kN5vfaC!o@QyNw>_`K+3P<WBaU{SGD?TPpQOz@m1Sgw=7=S3!iLPZNm
zJQb4O4l*==91N0w>Bvxl=5Q5+!x?xi<r!E&9Z%2(;nxpAI}Ww}od`d1z%KZNlU(o#
zH#^WE=R|o1g^BVE4in`W5)caiEdZ^el$gFFh)F=Dwt+zn6fM6Q{~v&_u}l1a1GG*R
zRJenpYr2mulce}A?FwrK2FCiz+Z8_=8981zgEB?J!Ra-&OxmUyC7n#50r`ZGxd-e5
z<~qp*%yqN#U|@hBG6kxmz5geG3pwz;Aq|WI)9=_a$<*sFW?%s6hUs#g_y0hn4MPj4
zW_N7*UlOWvz%Ee5NiI;u%?>nxG0}#h1++mP6df-W896{Lfl4g~1wBg!hWcF!0re}@
zN@`ZU60P6u0b0-J<1m-80MxFrwgjF3%d)0c>xEvS2E&I+jps@ZO$_Q+5;d6^ERHg8
zG_o>q)HImr)M~xdoA8u@17rcHdEn6We}$gq^lNrZmWEqEw->{bKa2+L00C7H7D*j1
zJQ(*t)~hKpT&QPe-!lEd2}VU`(5k)*6PRV{Z4NQ8RC3B?OnAsp16q|ok&yv>8IHxV
zN8k&XYT7)sERs4kU_%3qpj)3E85%%$VKh8ssL|kHU<P@>q4D1fn7iva7%t#;`@atF
z|NkC9oeG`LNa_^uVBFm~{fZrvRsG)@&><O+)&v7{0|%s=3DN*g7YF};0HuK+ivI%}
zl^Fy;ok52tW{#SdX$7^Kj8i}prZs=8D>OJ685|p#4}h8ypdl*9CT0=vr0PP38KCS6
z8q<MKwkk4I{7z)(01anY)GrWVsJUfa(VWa60U3y!2fo0>R^fw4eb?g(P+<$&_hYN@
zfd{mN&9RBO29zYM8yFa1$)f(`XHYHdP}}1q67uwb-NelQUnX?^{}AxhNiMYEfL*Oe
zKwy28lSp8LlbrP&2F8G=ZgznUZgvw^{{K-wf%E?#$0mlHaPI?l+N%T@EHxPfg1w#O
zK#MOeXZ`<Q>k(X0^Uou|f`Ne{*xSv{VJ>Jdg8)O#Un|f~stF(qK^B0_fmsS_IDjk!
zSq5?p$U=~14o&~(fHo_E_9lV$BsJPI1WQ;la4<j;JH%j6i)_Jt204%+jq(3~EcnkL
z)2PCb)6l|@5pt|CF66mwL8upF--P}Dzf7$E|EJbVx}ugtxgu1Pt!`rc{~wm|)B7Bm
zq^GZRWfB*8smY-5+LM8!*225OVi$u(%}(u#=@l!P6sCW0WReSt29Ft8CxaKSf)Abs
zMSP?E{~wL<|G$K4GI4=c&O0_Sh<N{x29M;{NP{o^c>u~Cpix-R!jAeQpDRGC%e?>p
zs+|7EjY(m8ixZQE3dor3eGH8C_ZUn{H5nPg@7=5eT`L8eVt%d2Pyw1Cp02QwQNjS!
zg9f!cKrInis{=fZoYd*y!MFpwj2X0{7o-EEcKU%ZCW(5mil!9_7D=5GJQ%lw7q5U$
z!GPVb1@a0ETO@U^@L=2yZUS4{|Nj6JuVwJjv9$mH#{y!`j+zHx{+F5qVEPB>$N>+=
z?cg~MkbgoonRq7J|Nl|Lz*4_PM;3fvr@)JPP+9mEyb##?|9=LM;h-ZSzz$66Oz>db
z4n8Ui>NpMLBmkQE^8Wu9emFKL1HuYr(Bfv4g1Pbk15m*X%8<Vw*8l%8v5|q}m*W49
zU!axH2mfyXt%L@Rtb#V&{ZRZbXsN=$2F_&(3<jWeO7#hTI^9bc7=A2dH1Pf(19mW^
z{mWngn%}A~y<HK$_vAnC|MB3t28#s@2H@OVB@G=Vp9${Rfc3~XFmQmHQPmNk26sGo
zF3&Q8L7=7*)c#`nF#UrIlfCc_O9uufP|wTaAA>+`U~q+1!*n}Wre^Vz3<|Hy7&xqc
zGbn)4QmESjySk^lE2cNBWRjTv!Iep_J{-Ic2D)-V1Qe(+>^P5Mi}(L<@TyHvtbh`0
zjjV(ND8bfuf;Myfe*oUp(ZtXL)AP%bq2X5|Lx)AviVBOQPH+maN?_pdVB7*8`3I@9
z-t+&zl~b35MN$`sM>69U@LXiaTn5HE=gAdT#sB|<<}N)Lw}6L{I_5GkfW$o*w}9t-
z&5Hm32VErzGRPunse}jP7H|N+a%5<DmB`Rhr`BCj?|QkS?(pUcP>%8b|BV-vTNIg|
z?w&61&Sa7ZPUjAj7-c}22^97aWwCETMuG}Qiw4j@MI<;}EEE|&WG`l5Y;0uU0Og6A
zWCoL0ivK%aHU3}lYT^GCuMYm-5R!be?$yKpJ6<#XKLB4^4!&%7`VDs`^?HLBiHruI
z$P8NoS~3y??)4R~WcY9C!11}J1hiO~fy2^4;Iobi1B0amgMvd7Lj-sz=>Y@7gnJA!
z6XO^JEDkU*TgEX+O!&tjQghL`0@Osc_y<Z8f1ZFG4#F=Q84bdgve?x%FRt+Z9|LYm
zd;hQhcLgK~!q(OQ|A)07unTH;lB=&?Bmz3LAgJBV4s>V%=&%CNL_55W;)gCGfn5w)
zCk?*E0hBF3soo-~OTmM2Qy|D(iv&=2H4;2116ok(*u;7Rw66E}KL!O0e$YKW3m6Xk
zv}4flV4S*ex{N225>xoz=?<Pu;*J*zY8d{5w)MYmWViq}E2%5NgK;CcoB?HdNY@yW
zN<rP?dhmXmC~zQxVrM$&unusc3JPM7>fZ|)Zv1-4u;Mo(!-n693@5z*N1dF0!;?u%
zDg@lYw%E%c0?G^)2mXW3&H)_(!ZKaKi^*Vmgcp;USP0l^Sn+0&)HTC{al^{#OT3tj
zZNMw;z<t|#1_#ipc*iD|6tF87KzcQ=YZ(kY7$<{`uvow#0Ls@Ewf{eOFixH>?9H@?
zF=qM&Zzd(VAaEIJv5&z7;*tt=*swy%vHN<{MSPgd8Lv$D@nLdj<efgnhsmWLv>ep>
z9z%%t|3L6)5-6;6WEmJNmAW2)>Kzc@QmN|)sI%<Y#ANbYkzvPgM}`9)3=9DvIS>w+
zb-*rQmXln-EH}GyF9v~dFXlPnQOr>eO-u%$xiyC-h6_4UpgB8+6FM?r`iS}7|NpJ4
z88{iO?=i4AHZi=I?%>NLrpCwtJ53;<)6K3_6ST{kL87FE5!66^1Ik(+jBB?}zvIg!
z9h%|&|2jD2K&vjRQy3ILo%))Y$`wDAK?ff^23L=uQ8tGrhBKi4WO^rq0I0(b={v3k
z&qvkUoCc>qkUv0px{V)`CO^b+V7ECm{a2WNU_Fxz3n*DkOJtImzQvbGP0Syhk-h)_
z`vF>+>%kxa4!-F+0ZdwQ|53W^7D-(e9*k?i)`83bB`w+d1OLBO9BWYU{{I&=hR9%X
zAiA;QSO<gm|352UJ!Dw%8g#ozBEtz#`hC5S;fDABU*N@C7D-(jJQ!Dl*ARmAg8T#;
zgai4>`~OvN8~w$91_4lb{77Wz_yJlg{TLJ;j}$@vYjk9o@S>5S!2}dA6CD{E9GV!w
zuC++&`r*O28eD2NIx;jsBJQ6JB;x*k00q=^g8(LVO$X4yN43n(6&?)YVEYit|Goh!
zPoKje<k<9o!}NpzCUwRS(+d=tM5b%hGx6}iPMvUUV%#(RM*x$`^a}w@a$K8cK)S??
z1t3Aodi(!hUdA(6SjzwZ0h$p9)#r`&3_i6CE;<{YZkkbZ${@f}^Z)-)4hE~5<7y?~
z11Go~0zh|U)Vh0Ls`c``RO@9CQ0c7BQKJkVxPP+Ho<Z)VJcGu|dIp6T{}~)Whx62&
zHWH~>EhPfh?*X|+vsTkeq#opV$0i1cniovVKxbYkv@<YTfNo>;`v1S?CG)b{jvx`x
z1<{sX3`{jV3hQb+tVCvT{r?YQ&tQk#ux!a7^1;%9fuWXLQqPi=fu&Z#RcE3r1INO6
z2073~bFG$_h@~q74`?(5bQU(q!=UxwwVFYSBA|`&pndRxT5fg|-5}kWiShrxfCeMM
zL(K^X7)2C8H3w+)43vOCqOcYiw5(-hnEWt6SlA|sfyE;Eu>rJ%o#_4l>U8_9jGEJV
zJQ;bW3wScJfO?ZjOx*`3J7kDVHwb1@W9n|5?2w^Q4{EP~MhL;3NyYz(j!ldcz#WT)
z3?0ys!4061!Izy33a{TVXh25>=fFn>br>`pn;2?9{eMuA1uA4c7`wrD&w;vwpz|Ak
z+B0x;+CpZlCfYLyG}<v_OtfbZS!l~J{c{hKEDLC%`*e+7CdGOkPzCxQyoel>ltF`o
zKf$L)_<#ooUp6unfD6$a2G9z>C7^*pP~rU}5p;-80C*SEi-QamAa#}ukU|tRs$=QK
zaNtJ{LxQCmL&J|WhJ>GP3?ASO!q25der7Uw{8+)@@#6(ULcOI1Lqn~bN5GFx1`kV4
zhK5=%DG|#|h65HW869e#IRyOlWJqvg_<!c54ub|{tdGIsr4ECEr5l3-c&zUYgNDU1
z{sTYGfIRYV4ajGp6|$gs19=EEhUfkNKa2G<28Z8oK$CAs=XNnOOb-ublIPtt2Q(zE
z!^yxnQESum=1`^v$mOIj>KP(HKKB0a4Xy-U%x6#lb?6+M7(ipgpxb#Jy#M=yGwch{
z%tixf^S^iPbcZk|X+iKD{EK=92@8mD;Pjj@CTT@*)%&8J!2)VBxVQzyqD2EkhWCHp
zrPEi0F<Eh~=&(rY5%6GKGI9EwFeV)yP!$L|_Q?DHzd4}s3X$nIjF?5I`-U?GGP&)Y
zz95`QlD!FZh@9Kp=?B7@RCvJS2rUW>j`RMXnf@i5Ne8l0`9mhN^mOY8CSLILASkJW
zf(q2hK-lnK1!6;nA2WZwA)=ehG{aVbf${f2h66SKtSb^V9T>p79U7Vb{Ay$<__dIs
z0<_ksrc}BDv^fj3DGIdl>$f7qjNge2D?ppIemgQO_`Q%}2dLXsbIrKIs+B>(x`jc;
z>IuUfdj>{^Mr8&G&>1(i)(j>uwHO4#tLtypy<W+nkX_Bd7+&q5XC3qZ2|Ve8?uBA(
z1vj27W&VEvEl#LD#h?J1o~YGiURHO&RmajyfT7lFlL+V(pc>5p28RZQ5=#z9(P616
zzyP`{9x5JFs~HerDf9nL{mBmjpblvGsRp@PKd;*rsa_2XiC#PnwGOU2j!g_cmNEaI
zSkGZlsK3X)rLG}VXR^%y6IN3g6l!dCIMiMHBmyeuKs$uI|3hl6ke3Z|mQf5GwVJo5
z=SMP$*;*k66+np;)UdEL{eQt?>;D7w3cfmxrVJtrMH%E4hBC;6Y9^?Kax}<=dO7I5
z_{-q%;_7s}WG3nQ(Emq3#T-cMOH&4gm$3{I;C1c_p*kQj`vyh^>w1O;@Bhx=Nhs^X
z!k``c0*#;v22KW0IEZ-vcLs+Yc>JmH{|k`5MtcT^8qNox@lzR?TE_-P5$pd93N`jO
zK;!NktRFBi8oab+a6q>dw3o;G|DQroJ?PlPQ1Pmfq2Sd*hKlOP><^|lBrqvVpA*F-
zBLT{j7D+t@9*hgX1&D<r!v(Ms@TNqcXeKV96*DZ7dKP#vE&!KnAakbIBrvJCy*>zP
zzCx~nh8h##!8jjWRzc;!mx@8<Dm)nHgL~=T|Np&#72yp$(=SCcsmS&0@L-$|?#Nms
zfO4K2cwPz8C}w#vT_lD{iK%Jpbc+}!Hzvok(;H%#lo@@dFNt9?XDpn4Cx%J6UIjEx
zS2Ihw!l8*p0#tN*|91h8tV4#}SwOdFGeWYtJ9wrJw1^GVdW6Las3LG|V(|eLsgP2_
z9lSuvVgdNLJBFGHSU<B7e9!~ve1c>)1}0kv2L_u5MvM%Vnhbms;}|4DP93nD@Q;CE
z!aoL%fKyI#wHn?P77rL1EN%Y(`6<UB0IFdFPPy4lS72e5n7$*HNs(FYfZg<%=Zq2&
zPzQmVGN4Tcj!n!82nV@=OFp=Rs--JHvFyRv0Pf$~JOB;RIxr+>F))D~H{mY>%S2hw
z;>@=?(|zKYTzTyo0ze1PfznpG+w^&HOy1se-R&Kl80Ub>3s^Y;$_3U6|NmJ#{QqaE
z)Vrd3FN1>h0S1?9%Law&s0#|9(JiY7kP|(u8UFo-T?;ndB%Udj&+T#r=&&qM^R`y=
z!1Vd?Oy*2>SEt{IXOd-7J3ak-Jd>9DG*Ac34%|`o{(l7AumrVnLHl(kJ!Z%N9i;|o
z<6Z<O36OYArgQ~p!4#-0aBO0T@L*sUot}}v6llMAb%h7xEO5Kd`~SZRm`|)1Fz|y)
zJ@5bjR4fks|5I`7fr9t{-v>axvq<W>;K4WxynS@~f&?ZB$fdv*Nj*P27-xa&3fQR=
z7D>Gz<H2h{LCteeuNM>n-v3=dV_*!RlmhDgdjEIu1Q`vQ>;WwTv{)d(;QikPT)}`+
z9cVDZ`@e%KNR9XZzu>-wMN+SW2jk3(5V8OD;GOOkNxcFdj5EQ3;{E@x20W*5L&_;|
z`{d#OAJFEGBdA6I&2EAM#-WL63urp=H|Rq5dg%(#unK6(5VYUiB7q^{r6z;GYfVt#
z+k+<pAW5Ei0wjgiGbDiK7D3aZu<5bipgG5dprdY`Abr3E3<)(=(%_jYkgq)$Yry-4
zAO=8&T)h7~fk&Bb6&m<#K*?T;LBTSPfhSRug8>w?wG3Z%EEyPBDqb@1ftn{4j~O^X
zS;VqlS%BfE90N;DLZ}X;im(6|jh0@ZDk4+|Rz+CaFtBy+VPF8QUk42c6<YlN59+=-
zG%;C#T3wcM3<{t<W7#Vi7;POG87jRP_(C-u^ink&7=C&%FeGa7G+26oHu*t{XG{D4
z7cBPwKfqM)FkLR0Nt*HJbgN`0{rX7MQr!E$6}W#2sv7I>f3ARz{b)d9&kCFc!6maS
z_^cHJNa+n)fypQWE4>{W{@(!QKJWil;4%a>E(8(-nE@##`vg1~r-O4w{Yy&*hnHxM
z03|Q)|DR2vrTP<4QUhfRiv^&I>>VMkpGHOo&}bECEXVu5BcxxpfFYsUnE`yQw)cNW
za8VD6K#K;31n>X0;IkKC({rHW|1~4S^yK+WV(bSQHh`vIL3`9i>MfFbZ+I|H1DEh1
zQIL~CjdZXM&=u7jh~uYVt_M|6$dw_)2cMuTH2%X6B><Ua(X?U%q^_9;+qnZC5CR3y
zi$unH2GDjuP+AL@Xpr;%Zx1fV!&f=z*)lLPSXwbSSlnY!sOJi<m?+1fVkyU<Q>$RA
zV{w3i1=MJ$Imx`t;vR#BrLq9H0Rh@?4o+r|cZt+GnCjFdxa!nsLX#X?tHe?c)R+wW
z8v$|&GPX$S{o%nl6}(yjJgwcxu;BGU(4OUgPvAM13z2i7os|jD+&j_x|G~f071EfB
z>vx2DFv-~}FmTj>cMLJyK$<<xu~1}K0BRP3GCyd9$O3ekEofUt0t4$rMTQR0*}vZZ
zo`6dmkn=1S^?5+AET7=PSOTtgUo2#p0NzlPz`*VO?=g6+6x2conO(zC4~aRb1uWPt
zcnlwmv{=-)!u$XK1yJ=&IMjm^GSopCpi{4)>X|Xr*E2F~@c#E0oDiWJK&vYeL(hmM
zhK-=QprM%|rJ}1%NrMY~R9=h*7Xv5g=mrfg@bs(=$RdzApxHQ!q&`q_Il+T*GI(3y
z3r6sDpA9ug$rZet45R@(pQ{LJto;LLZID3)T?_#lTnwO_YbQ81F&Kc<K@C3O!8jQ_
zn1{_!kUG$L+TQ<9*n-%g$x~3y1+7d1@j=+4X~hAHq&~+79*mR0Gp(T0c|Z~{3|e6X
zn#%S5Zw9V$Ko)@v0<A0q`2gf#@Be>mraK&DlrRR3CxF%&+cGgM>r~yepySo1g_azf
z7KCcC*;$-oV60)YU;s^bgF0EY96=&8RX0uN&t#IE-ms97WwL=6TRp=v(8<&<H8-z-
zCelPmUym^avZQnK1}NX9Q-^_}P?JFkGz9~)vr}vHj!;eZUo*8f@32_Iz-aS`VVMOF
z1AEOX?Fx(Mn-+jNoiJa4Xz*>PO^iA{rx+M5)&Bnv)nv2NsOMxzc5M9r!jgf34P;@+
z5jHzeHDQ^#`2eVNujTewSHqzIT1s{V<OwH+{~s*X{+|ogV6)TUU{G{yWR$UG`v0#|
zQ*?zT$MGk%8eXevHJwC2oe;kU76k?d#u^3&hCkRbV@*8+10N3q0|yHO18)ig1E&iE
z1M3t92DTIi26ht$2F4x+2Ieme3@k?&7`TrxFz`%)7{sv#Lh~JAVBpxpz`*~7fr0Z4
z0|S2!0|VC-1_o{$1_q`l3=GUU3=B*$3=Di*Kp_CapqR3BTIB#@TPm%rzwy&!^9oRK
z{?yvM!TbNe1t19+wp3@7w{&1&>p0552)dQj)a(C0OHS~8uS}qQ3Nudr|KIVPfoaAI
z21d{otf0&dDxpCM1yq1^sxwLyYJ$!n;GY4GJ`K<?GXH}@Wd<dOCjKdfn)M8V4ow0g
zIvk*NJ^xZb7F#N<EU3v;SO+@U9n{QlZ2IQ|I+Om#Lxzr@jSLq+>tKH@gd8aD{r_*_
zi-!yyphLu8fYxy?WT<%Q2s%UovP%}^fJ{vWrkU!D65jv+v2?OCFm$vtFov?R*;%SF
zFxJ#_g5vh?8&F~Zt$wgfV34-RU|_U<$-r21+(=|bIs-$EyaL0_G*HGDIAD>%z*MWr
zzQr<uAvz?D%?>1AtL`OYk;cF{Gn0X%h8bj@zyym724>3y21Ae;Adi65fy}VTWMG7<
zNwLUaV5zTF0~=-uQv}igQUp>ARcK<#!N6*9fT0d#(M)y*h8ZUrI3Oz>{+eL;2;w0b
zB0W^kK%9^GFVvi5-(tzZz-)1V!4cCTf7W1k$e$_r9a0YqT7C~A9U_6`5Em>CQNiI5
z9;^<j$B1LT1;jaouK>v*PM8k)JqNo(ezzbyq#k!-<2ym5LuNn|n-M7Oz|s*Y{eaRD
zBn|Q9fD#)ttr@`7)Eqae7Xc{(DTXSv!JXKCox$#-Ut5rUgxf<rKQKL1&%gi*I@IjL
z1M)d2`{3~r&m1Hl86x=z%|kpnxIOgqPiH-PfdI}vKc5iiBVG<nA7S;-4QLc$ln3>o
z;D-b~&l)5jnd0$L4IUrqV2`4oA~-x$k5<C*R1oPSP<91H5r&VDJS2nUA#>~=ss|O9
z+;4FE=tm58AN_E_;UhE;af2L+yU4DGm)YDBxZ()mBd#|{KC-~>Banx<_Tcu=_a0;q
z)q`sxaH9KOLY$8{v1B7`iH;MNi~Mny3!L?HKtrMy2N(iD*$}mI`St`_eX>BR&u>?d
zU5;@0w>`u;oXY?yZTUlLPptW$ivg)<^}ymV9~=%bA<iKjps0qViF&;CIQt7|n!po;
z>|dZE7>w!AuS>8y^lJ~yq4oG19Gn73L58Qn!SMj<P-EP2&2a|mP~>(*J+vY5<qvk3
zej&0X<me#Mp%GArnn4^|4{1VyDj-BQ<Iut4QkX+Sa5&Tk7Nqz?lnoS8khlj$eLc=L
z9NPw@MCgnex1Vv;hM$S74cWmZZ9U<}Bs-`C0~NJ+YD0G9qShF9!Ni7M($*t2CO_dw
z1D}XY1FRs2B7zoY$g+a6AJjwjMj|lRqNV{B<f7IDrUsN~K<Nae7E)`n;3;Z9;iwHi
zA!@^VyzPBvQ2r;vN6b5*sTxl?!2)W=gDzDFLQYHdkaqmX7VN3|V-9htn$>~0?8gc!
zPe4Hrb7(!d2LlRDP_RORlvxCt{Q{6(3UTO%JJ33T5mG07z>y0+5Sa_=nLte=B7&G{
z1vH59<N_v8%Lo+2$R!-K-1vaKUr^ul0ei;)qhG-M0V#-~wHLN(m-zrvx#5Nxg6~oK
z1xWS(dz6j=?q)P2kwq;dtf(~w<r-KHLXB$1deB}<96|Q(i>2ECKcEDt!O0-$*vR1V
zQk_vC<QSV>%}IlGAt%|uTh1Jt-XYQeCz~B29lZnf7a5U5!2AEZ1uxYZIS^*l!wu<x
z=Kxeg3P5`@(F}=!juUX8juX6d!97m!HWM^1@M0kYXy;S|c)Z{tLx*?$|91kAl>H8x
zP~I^>_-}te=?_r)1(bdOrEfs#3sCw5ls*8ZcR=Y4P<jQF1|1$f!~6f+86bYW_y4yO
zKn(ByZ#$rL1C*|S(gjdD14<`A=?Ewt0Hr;kv;&m3fYJs~8g!Ws$YKR3U*h#chI)_y
zGz8v4L*Okm1l~YH;0-hc-atd(4KxJaKttdSGz8v2L*NZG1l~YH;0-hc-atd(4KxJa
z%y|8<9<*QM4KxJaKttdSGz8v2L*NZG1l~YH;0-hc-atd(4KxJaKttdSGz8v2L*NZG
z1l~YH;0-hc-blRm2X7d80}X*U&=7b74T0Ct5P1CoKDrLQKLNC?7&K!FUdzMC06Jp|
zw4SG8`ju)XEv7ZH(`uOX>Q{qTtAZv=K+AP35*aEy7!$zL8J4jO6)$QT6l@h1GJ+Pp
zTQo8h)H;OeBx*7+S}bI!*vQCG20D**qa#C!_y5)4ab)OF?hcCt&~UNRK~Nq54OxO0
z>11v`0lJ0n_d$jU)_)l+K+CNgr*Exc;@5%hTL<k|cd@<)x}=nWqlOD~1jGL)pq((F
zMNpt|JJ6D+=^tvCB&PK;bJs7kIKa?Q|KvA#%J;>}%_qG7uLUpBYm5a=;rvG#CItBm
zbeg*N|Nkx^SE2ei9z2Zi{r^9BfEy$a!xl{|9#|yxD|j&0fKQ4Ct-SL7|38L-Ar2hg
zjG&7OL5e}6;-F!8=n(P57s(6~Aa6T1G06N>1Z`+s4qjFMQjuW+XqDJcPX-B4(0~py
zevt`sydroh1Z<l+=*A_9=^yl%#HX{@F^LPsftOE%7wmvnKrPpuZcxW0CAeuJ$Q0O0
znNH13)1&K{l$l=4o!(H#WN&H%I>-p50yL-!a(t)TriC3ZH!T1UfqSyq)o@yXmQ#pW
zdNDA9PHLR#wrSz?A9YMBpp(}@H|&9y96&v#=-9*@gA{TF9*nWzX<1u`1>kMh;AKXj
zn`avtDiXaIG@-knE4=@&0H=>mMTR2CcqvnYt%5Q$=yXk62W948$R}(jLUurdPTKVO
zeURb8Z$*X`psCVCFBS&t1&j=!nM_cKgO1Gwopx!d)E{AefPv9IVKIYs0}BIa5i97D
z(NIm+cZHhZb)-K)7Ek|C&!jF`F*%W;V)H_Vn$3+2b>9D%znyN-z@%SavC)yCZqh-B
zl=uJT;0YqoM1%K#8Svz-_kU^d1d+8ec&Q2~C>cPmfO@&XqLBgJXz*<MLPdrKs4FzQ
z|4V~|p+*wCE8_%64&ut`_Zpb^>OrIV7LbXoib)S4ZrP{^b|!ct3*sJWaQ5{6FAbh$
z0l5d{4)6cc;Awi0*$$2W4&ZjzGO&J--G!P03=U2IPk@#hywqfvp54gA?X?i>#A+7?
zh2M`EI6!NYLDG=b2kXF7r_fyf27IbG^Wlp6Tc0aD7|X#46co@koF5n*8~=Gs_Yh!~
znLfdfiG}0!L52&UUGvi~)G~=oFF3%+0bXg1+mTCuPFHDSa%bE)J*SCDN$D|ocHaB{
zU+`hE7D@dc9*kw+_yCy-ij3(ALQIm==N@6=p3dRPC;(pOI4O>G`rRfbLncYz=>pA6
zYC)3V)drBeKNu|<?M!OI|Fi$Ak@o-v19%>~(UyUyQl)HBs8-274HgDP$0kOHLN5ke
z4K4-+$0i2wxt0|zYzr)s`a3)rOTSL<XlBx^moo`?8E2C5;-5)Dtw%sWttVu=RiPXI
zf6xjk(9$hXCknLG6m-2pW1LCNPdSr}S}z8ZP_LVH6XQ&3UhHEKuvp4q0h$c2)M8Ky
z)qr2k#{s$+1hnHK&<%1qNT8dWT_qdj{zT9UOcl_Qzv`C^O5v{#*ag3Gk_)vxU>9iX
zBp3Y3%`VW^&8{+*fp5A^3zN$99W6|T^|1`x8eHIo)&ig;H_^`IiTD417eLJ@DEkPw
za04A-$HD;Gfs1c*Xd`GFCuoDH1_uKZXp^X86GH%K>ziW}!;F_)CKkvWMnPLL>wjvQ
zSb!$!;5$U2`^Y^Q!@={$pou)>IU10rpPZoGrx3$H`$fTGS|$b{vtZ_c%!Dn!^I!}I
z&;6sDmB7H@%FwWq!2-G|)Bv=Z6f&DA3r@kHnZ$-p1`E)67T*6Q!HEnc2D0#_BSQtq
zA)s^kr@#5ZEHRy>jY)#X(w>3G;y-9jhL6s4l{O}K#@y*SZA==|XS6XXiAjJLHh=;e
zR3CtDat7_4pMIf@NsliSTw!U*fv0FKrt`EjN$7wUI#)bn;H%VBdt&o|QKFX1OQhzM
zr`C@b3>=Ux0-$~Vpv5%Oz0*V5nM@{c$YiMp?Lq?8^q@^fKNSBPf>yZvSjZ@#qY2ur
z%aroclR*Hqq5!nJ*RhEaJWmZ?`v_X|2wVSnkl_Gmh0qU1h6muak)XAZ^OP$<3k)nk
z`-cvHu6VtYA>ySLgF<600|)3(ikF%U60iR<$OqKM1XqAgtnmIX1u0<c7}#FQF))BC
zyPC@BN*zo}9H4*#og_Woqk~Du2DDtIQ0xDHP=Q@*!JrnZ*<e>|(5L{S9hw*(fP&2W
zKZAfJgMb2PISWWP$TYACGdh?Q!&}8WKniMhX+bt(KyFxN0bSb%K2ZU5_<r*33h)0v
zZ~p$v5CE#WK+Bat^)zVJh4IV(|LgyI3V8pQ0xxWHn8a}41tY_Q=?zg#GT@8ZK&$p(
z3jje|cR=+lXlo8=<`7is!tjekMgdSLg|o2OO$1NwNrFpfOM3<x(1FR8@(dC+<<b=(
zr-RmMTFNsBRAezI)oObD04=kylxGkL)nxw%mWyYQN!4VSzP^)5w*EyUqd+(-iydee
zgZF<)aM|qr|37%b9b`GkaiC}gIS#hy1m-|!9%gRfge<oJsRu1zg(Lx{h!?9E1awrv
z$;0QRGJ^s%sW^a|GN9C+$nl|`0b2DZ*04J;I5sk-fRAHOWT^Pv$k6Z`bYS*Dh6$iq
z$=96>0<T{(Fudquh-l<w(0IL+L7_JOL4ak(|Njjw3>=kS51C%<Wsm^1GitaZK&Pa8
zSjK>lL=doyVc>bm$)Heil0gY{8dc4Kr#cpQ7&vMkIGXBM{9$0Jm2ncORRA6474QS3
zxc<LG04TT;HCYs3>r59aGsrYDGe}glh<DU1RT2r+<glsLbe{gXi%Ho@5ZrhJ9k^-j
zz`zJvZfae<`2uX6p5r`5hRM;OU4a7N><(UX+Q9G!)FcM2C-naRJ#czVH<Lm=`26)m
zh6+$i6n4lVsD%pZu7Fyo$fXu2xGj?UXLvB?f=_1z$%AStkQ$JF*bFpC9SDO?+o<GF
z=Kv+~-!B;iEIIyvnCQu%W9z^uQJuh`6kd0r-Y&S#NiKx@fL#E$lU#6}n_U36n_cy3
z2EN*QN3B|UCy}2Xki7$-sPO*(uLNW;41+93PCGEqpnJso|9|kZ9*}yFLqUlhl9r}N
z^)SiS2Rb&ff)feo4r1_@;<?J8i<b|8b_To#?F{&1VgRa_9Ge(^z;_1Nm>7U61X%eD
zT2t=9=noEWP+|k`43J0N834MOy)lj<V`4mm$ii3#mW}ZYa-FeO3{0V3C;v^1XOQTO
z1+m%fHpVl^fR;XMKu#V}dBMnV0JMGc^+JXjpkTHD-Io6NcLnI&aEbb#HYT9!%rju&
z(iq2(0y@P3baDe^TMCm0Ob&c0XVZ!w7D@d-JQ%aV%T1vNC!lOg@cu983(^BF;%iJk
zfc9}ZHZlJI6$+r$j^6)8z-#3!9T@7xKzs6j)R_FJfBCxtbbPJ{1LBA?kRg_w3=Wo_
z3=Ni=3<oS;Ff{z+{O<vZ*dH$#Jbs*H;BaF2|KMeeiGig({{cv5X8!Rq#>C?HD+Ugb
z=U)FYF#xUn1epcGulF%T=-7fX`o9~E^7RZ7FXO=1*}nj7n19^`+9=4J@uH4_0o0!Z
z`M|M>c?)QvAZWM#k2(f{A9V~8m0rzHKxfGR_y;-|7qnuGfpMZ7WXI{xIM9|nKk#zs
z#yAEIOFISy(DoTn`EPT8QKF{ZM+dYw7j#y+Wxdz`{}rtae3f2mPikHSiPWqJ)cSE8
zyiZ1^QJz7<;=u=oP)!Mo4gVSBQZ+v?gnDt<Bx*9S)p|KsgsL5|3siHG3siHn>$GJM
zXxPgLI_Zq*r7VMlLlg5FOD*ue9Y&i54hGNy(^^f<Yc;O|K)WUxz~?||GANkUYIuoE
zILW}$@Q*>~#XSav37rfA7M%<npcVQx&y6c8o-ruZJW$oCIjO2+slmWf>)@+1Va4=&
z6PRS`zlr|7&j3181toofRvUr#$XhBfaDW1PqdkM1r7c4RsDgY^%TNIcQ>G5kB4p70
zC_iNx8h+F=bo{7gm{6(N{A6M*=qMin25{fHfq~(tEyDs2MjuFOvt?LdahG8RXocv@
z`dEevP@AA;g^5nh0TW1DVHu>YfZR@4P|qM&k?f=~p&qp9f)Bhbuwg!f1*muNqaL);
zL<qcq7qmBNp*@4lk9r0JP}qlhHOPSq&O|Q;JJ3lkuvRB1d_iHI1!{VB#xe+ijyZE^
zVtiuh2?=meV1t%H*LrDQt9kBWV6%XOA>ldr;4KAMcsIr}EO~L4Va9}&3<4G_A>j?W
z7^Bh+RP5{O)ST1>hj+~bU!BPvknsL8@pnCg!b@3(ju(F!DjH)M7SyUc1X!&4|G!f0
zA(O>1(E2S62gfFc9!n1ffuFGq9Si<5$XR+Y@VvOsU{I^6R${S&fdf>j)T(=4t9hWS
zWATE4r`9XrN2nM3KhQp~L@ySFT1_L7S_fMl(3UMw;~N(1HO34qYe3l@bnCeH|KB<2
z1q-O^1&LeVW!PY;z`*AH|Id`^D<(22*3V^FQgM`l51jg!dushS1u2(bf>MR1LxA`H
z{|>+Zm>7VvtM~t3J)k>)K+8|P|9?>h<q}YeacKGjzUR*(X@Y_WV;Xp*2HgSP|9@Qp
z=>;`?z5joH3DNiW3V8LNMN<C(55_d`;0DA8zutgy1SoPqwG7DnwH#g|6HYL&Se#(s
zXtZTm^5QSUj0r11jV=b3T21SUN_7S$(4x_r7p6KBy%<>PA24u$A{mt2LFRyp2+%!3
zprvzgbL<%8bza6XD1ZzC9|YvUz*4CJF{qZyRA<8T>Axm1Y2|?K(Q|BKJOjFF3ex&u
zJOFB_LJBp;Ex$o$tS~VwYvkB`L5G8Z@%4RBFN|>msD<)_kzv7$m(a$jJc9)2ZstaJ
z1`bei25sZ3^b$`2CFK{(86-eSdHRIOOezwf%T+<)<^BKNUQk#$HZiLFUdT`}{lsJ@
zWnWN2;;?weAn@ZK$UwD{7l{lfK&?jbX2N&|jap5|Yv54R@)7}^QVd#t>%r&&-kb?i
z2Wl;VS`8kI9*NUUrZ5@Tf3W0Y5CCm*0H;eXq;$E8fdjO^5uPqzG4RxKIQ$6ZfTl|h
zXu4zorOQwqQ22pvW2t5E1@EDGeGq&w;{?#)7^qnatEoW+J_v&^<U44{0AADyJphma
zS>cO&3=A*+F-U-#*|ts$%NpevG$v|oo-RL?$%av4ddyTNUFKE>zUdRDGKn+Zm^PD9
zWO{}n6OY61ga1E(wsl(HXJ7%{{|jm%g6<0bq4>YC{^;ilP|F(>v<^)Se~|a~7HV>U
z_Vk{azF`rQ2xuFq2pedtrH<BgqiIYXQf%Oz4WNUJK&}V*%0iK$0pzR66Ea0aKpaqm
z1k`#09X<h)n0{bBqXek;GhJgklM@ry#OXQHnQZwFFlbx<VFX{@<o*Aj==2@anbd^1
z!M(v3^`IM)Kz%3n+UXyrGl{vmfSc4W<}<87+B<gwvRQ#!6XX=|Icp7IJ>cc0us8-?
z(Qdt;!NP;lC2_jX3??ZxF7QE<h~0B+kaPj+g)Dvz>P3OnDo*d2!6a4B1+f==W*f+C
zHgGNlnF&fikk*ki_*jP*^Z(y?QUCt|#7$gKfBe4zX;!d-H?Y5$|Np~_`u{(mYQP&W
zUey2p096AXwlTl=|G)KrMh%Cie=}ZBSDne^8^sCUG5w;(<N!n=E4VrKVvb3G^&gV}
zc!1QH6hI8-1lLF}YD@y4>cQQ0kYiyExBdk>+}7#g^fNP=q*VnfTHF>?bTKG}bR4h?
z=x~yQ)h7WRZg!xm1T=~<U0@cIo*E~(h5n+(qyuU+c*hU2(H@LWzSC1?F&XJ`fUSK|
zW8z@Zz`@}Cp9S3Ev`Anu^8U{VZf1e1BZ~%82JipuwxC2|0y=TezT(&cCh!0M;l~_-
zj%5RtXVVQ-m}Kig=Myaa|3ZV6K?iy(5NOEU@W(+$3D8+N;LdU)!-|@p)}YSMhTjhv
zPJlKHf?9f@Z6($T3<{0PCNDtan+{FP4f1h}8lYWQ_4_Z0OuoxtFu9h|!}~uoI4VHd
z<3}xngJTo3ilqVrlcj?ILp^Mt4yXqX>V40&Ww4kS%U}ZvdQh71U~~WvP`s#RZ~)cg
zkZ@uHM@gqGgT;?p1`p_gKLsyk860dCm>C)!8D(^A7#MzPFff36UbUjm6}4f(6`@}2
zb{&5iEMDAYaL9Phz*O^`VY>7jCN80L3k%Tga5c-UL>!x#W$HU0PdA^#q*QOkkP*t!
zBnNUwt=H*_ntCr0OI6S|0uF{6P`}pARtHotdH;X86Er*s8a8xnV*F4We@Ub|lR=@=
zi@^fYWMJS3&*ZSFx4$G}%b><!^MHc^6i6>485|Nh92h`*q$hGRurx+8OnE8E&@tg9
zgMh_L29D`B<}iuXGlHu?aNt#fcKkBhSTYEJ1{fGEtr#>w;WSZ_A!KGGLjcH~_3~aK
z9*p+jp8bnTh6qHMv4VGdRG*Sp3BPxMuLiV{>hbT2<YPJvKP?#&DpeVjKzmtV%9}V?
zykKCd)d<z8Sstp>S#QY@kO{i2N0Y%MRP$zCttP{T`f3l07c&_=UPdxRR97=7RJ1ZE
zg|sl3)o0xj@&5n(FK9Rq)apyVX8=AX@uw*RL-jER1&|(?TJQhQuY%Nh|8D_DFlckQ
zr2_+V)e!~-&^a#?of$Gf<FECd)(rf=n;AGJG&7X^W@d<(sLYV_qY~7bn^+1esX!s`
z(8S2`VkSexi%NzBP>6W{X9aKi1BU>(6k`OJYW4RoiM*J{kO9x+bqpO4^(>G=ppGE}
zlEN5%g3PXayxSC9gn@$AgV7E=l3M@&k_brCi}?%=FX|aQy#KR+2hLyAgLVjliZzD4
z(-WeZRJ9*6oB&-{2pX;kU(5!%oPOc|7od_H)IkGvF|89oTT1>kOjnrCBqlW>z=JUg
zTqeM(1W5Dfm@L>p>4yv_y#N1isXMW`!u$VU7EmQNQ4`WUnf@V_Ng@Y4AO^aJH1Yq9
zn%T;r9a=1)<GDf8VxWOC(20_u!7^|aruaYb^&bX?mo^L>7W)}kKxZq!s<Du{Y<8d<
zv8@*{fKK_a0abMt`xyja@(xW*FQyADU=pim247naK1b^y_$=fDphlLx0~1572lKK@
zP2m+FyFmKu|9gpmdX@+?7z9FE82M^gE-*MYF`j^{d-@w(or1QdIW#dY2<dFI2MvCL
zE{_M5GmcG6HMN?rL_qbZWwhr1|JJYm|F4nvaByf~)T#cj&S7cE!eH(2|G$<r12f1{
z(9Xr`C<X=4{76XG0lSb+#&ZE(PI4f_0=nGn949fpacE*n0Uy=@nTZo{Y+`r-sk1p2
zGD&cN?rwHyV&IvsvXDth=r?%M0hA^{MXvY%hmK&S_4Wx29~_z(L_%gCunU;&Bo{E-
z%`Ut;NDQ0_52%2434%Ll-v6H{HtaEZqQeU6p8j_L<&Ele28D{H(4$40A6G!91O>eR
z|11SL%%SPO2DlyU$j|_4C%it$umIG<2Q>*m<6y59|685_r7G}^c#Z!byauJThyQ=T
z2F5_?8HOzt82)?z|0e_EgPkwn(DY9uq=n6{h6S{#_@4}1l%=5MKZ8Tl-#^y(88|>E
zn26Ma5(enZvyi!McA)kTEb?HH3$g*!ICW_HyCbC2%?`wdZKj0T>e%#8rqGLt!LjL|
zNJ$Hr=JEdj4?fHXYVd-RI4p4`YX1KZy7|ic|KD)%jj*ur0EGp}>!9!eHJ6~_aRL-J
zxPqh93v^!V-#Om@{~myh^Dr<suutFR!KA4hXpuCb!GkdryqWK%9q7hwQ-(@Sc9oxY
z3=H1?{($GWKvRT{P3&u?Pgu+(#$@qz`ijL&TO>f!MzFB>eV;+XdJh8&s6#xxU<s45
zuPUe*cWh#^fhhqUPX-GzhbAT!%%&rg09<YBV{pCznc>jH<}v-j5+;@D97~y;n7%)p
z?z5E1Q{mrVXaft{w)yuH+`s~zWcFgdNr3hAjZ2wC)c^ejw>n?cLt8Zeeu4+<L1`J*
zqVZrfTRZ*DQYLBD8lqY=2FsZA)c$}A@)z~c*37>j;F=5Ea$Ep9TLE-Ih?(T{mSs#v
z!hc#pso+IDv^DeZ$5hCv!yFb#6Fzt_23byjvW&?@!BXM>e^A%M`~P3?0k#PKpEn=_
zrdup$GOlL`X)*t&!@|HYVZO-=2hadi0tbWlzwd}<N4<%IW7B^Riv=9uOlW-vbkL9q
zxQqw80W|*zYE}LF1-_)@N4<#$sD=bpP@t|cY+eeK(gQUhEjrNL0Ay~e9?`4=#ijLr
zPyjG6fjsX0|DGu*z8stWHCWm(NPv<uG(I^%^9G>9t3i4|YAhWX>_J(oqRVZ;OM8<Q
zm6~iRpnfEVBU~?6pg2Ms%M2N)ec}D@8*&H)I5z!FnZ95JlTp1f_>ci`0s#A5fWiCU
zPw;pN$k!mfKkZEly#IX##~{dYKk7{mI5z#+0xrrL1Q>oRGE{i~`w4EBg9dkA>^C{^
z(%z)tN4?33iSZ^E&>am9EojIE@}oI;dd5m7pL$Dc1`BxDXfQ8B3mbk&*tjcztf|yw
zdjboaniWjTkRu7jDm0rwVQpy*KI9)<r-AA`s6Eq-S21~l905ArA0!E$>48crfx-YS
zf==L!pw!!_5roANpzr~8$w8UU`~R!EAoCrYerba4Yhng<0KETy=>*>%T_arq<yY1u
zKdt~ZcO093c}zdx#3Z8O{r~p`#33O+_ki*Q2wNmgnBl?b3-0NFO2z4*bH1i`tY+eq
znsC5_(H9)o-v57tPD+FJ5PmJ0zF{?!p)=@qlU3Rkpi4YzjvIqoKMbJOz6G@Y0-eEL
z8w)yb(z?R?|IM`x`yut1Llc7mtiwI+Kch+nhyyzI19VLwXn!)O4-4|h>&E{NKouRh
zemeO71E_ZnD!je_zk?OTj18a(SPrIT(0#J7<2@&O|F4vt-mr$rjdAnz<7=3V>YW&t
zfd;WBA7rSpNcjK1;nn6lprJ+3ShFP~!vs*u1noKwNoG;|agd?IqLHBhbmhQAM~0T4
ziVP(a9)h-{X@Ps3-Hi+r8tpgVuy<f!2Hm9!y0ygm9|Kc$RPz(-d!TbqSk$Z@Ffdr}
z-FzcCih;?RkzoRhwE_d<^qRFyhW3sOC6gaA)J$e%Xqc?X&;lA%_WrL0K3%U<kzqo8
z=OfU89gH<{KfniefKJE?Z$1QW6V@a@5}9VkEHZ5!lUdT{8=z*1V-w>MQ1u5ofz3XF
zf%$hM!-d}m86Ln-W`mwj_WL2jiyw@P44_lntQ-FSudZ%>Vt<HX8EA;kT7iKfd=876
z^}WqEtQ{F9Bv&&qfsV(WK4Tq|tau{Sy^ahGlNn*|)eN0}W*w6yNOB@0L(ODVN!IBy
z>zRCoK{_278YVr2>C#v_y=Fbr+Ud3~OajwAFEaDlezbeUu*~`ygFNU4G0<77ptDs$
zCufBJXE5{r|MzIK`Q{s-wrEY2G^i!JwI=yQKn?Q`2ZsiRi0L&Om^7#JnlW=v7kI@i
zG5x>=MvnSM^UXJYB{Hn|)yS~n*Fx|WwFhP&WSC&-`Tu{74d^&Uh7izr4mdS5!c)To
zP-*}*NI|IqlnOwp;in@cC4f=~C^f)R0w`5@|5pRoVj%l0V?g&C|Nj^M|6#pdr3Zt;
z=7$UuYBW3?92*$|Kue22mQ8eoTJ~Zy*fOM~#{{wrWGQ;m10_3<rQZM5z%?-_wm`Lo
z-2nz>s|TRF+SI{2psW8eC|E}^uvA^EZ+;T?okgw2PQn3n*=udoFA=K*&_(E*ZzNq~
zV6tjtm|(Slff1CxL6fE+$2v4Hpd9(uXvx4(^Y_C#&`kRbghw<QEg3j|B{FpUI>=B0
z^30@0hK5NCVR5SpK9<6|{yzgF$b}#mc`&Mhhay0Z09gof6wFe`hW~Two7uNm|6ySC
z{{Kr6v<R#E6@$WzM1~2CnwxKcEU(dmh9E5SK7@wgD~u3igoU6B?jTeJuQ0Qo!yxb~
zkzvKFMurWq7BcL3b&%nJg(9N>=&+9JISdNFD;PMYD{N*Gg(obL=`!n>IIVaY7(kAk
zkh%E|nC{&C08Fpkd;>)PIJx-+sGkOHB7!N9c%$d$>GL-;$ptYnEVFfBV6MrOt^k)n
zFE-x+O&Woc0cea69Q}&_6G1mqOjKm30i{Fm*8N6?0+633JcO1=iVQ73!HWu2rt@!M
zGEUum!xD51n{t4|j7EkNj*Sc{pz;8m>QJqF0J9Ei{0WfpAnQP5#ULv{NqnLrLkq|%
zkQE>&f#S{kzw-3uTbR@tH%~vmg>0WNfs6uK12P_F704Rz|4P&Cw=x;0fqn9?MmfM?
z1L;0tBF-mDk<(XfVNzq<JpKPxvc1BB+bfFG^S8mg@(1LV38Z_4g*dM$YQnstznyHa
zaNzce!u0vuVd?7!$SdIa2-4CQ2XS7JpKiW`NnLaEjT%nyVJIe`61r1s^9N8B=g`EU
z0&32KlJrci%^zN5Y@Xh}gUOm{^M~mHo{S<Kp!5zJx0wE52a{1fWJn9t`T-5IIW#iN
zDad4Cv{e58|92x}!S92N4Zj~Uc7R5XtRFJugIXz$O$;VA_S~Qr3?sO&KJRfwPd!6{
z_rE^yDK<KGpx!qFeAXM(ZtAFKV1&$GGcZ_#hmIMTy#MvZCV&o4?*NTkgG$*3P%p3#
zJl+f%Uv_Bvf97=~W5Mf#j18|JGIm%fGEM*$mM=i})h_)1VtT_8MhWnpV&DZ!pyC65
zZ1TeYFF@rY=zuoRxXcg5e-}Z4<JiO)0`mVaMurW)Aoc!>--(PIzZ)3^em`W?_`%5N
z@XL|mz;8!JhTjJn6@ETsSn*4dVaKmTh7-R)Z3RV!AE1Ve9jJ_TVps-h6I4evb3U;O
z+Wg(pYx9rkF}s+ggf`!>R%Do<WW>M%YSGmC2Ukq**u`YX=s11XE+!c<S@4iy_d|vW
z^^4iJg#Tx=^Zx&F@ANmjnB-Y|949eyOc&VAq&YosFO#^6HN*e^pusNCz2?8SGBErW
zW#F(-WHbQv#X)ENg3kAyUbB};2E59m(GE0?^8Y_*BF&P40bGduc7#+wlNA{nKxYa}
zWMpUol~tgo6lkou-u`rj_kS7iii5?B3==@ZHlRBa9h?3eIQB8jnSN(ClVrVwf?56E
zLn1Y@pj#UM)qu{r230!Ms~8kOaR{w^VyquBOt5ZbC}@mhU;$O*pt2jZA_LS?oxG5t
zX7WRZ22k4p<ba=y3>_04845t{1yF?qY9~OdZ)xzrAE<p-!@0o0p@~sL+p&vb2B;-g
z7cjZP`T+w^ec>w+P%F&p00V>70|xNz3XOIQ47Jit)93GDQp*PU8r0TOL~c?^gAYFI
zbYz$?H-LfB{6F~E<~0@z7<lSZW>?fcuCDN4lmRy`K{>*qiD82EUIqbciU0p!Ffuy4
ze8{lk6(hrjSBeZfK=A<{0FzMAn69v!NfH!Y(jqvc2Q+@d0CHeBN=W{>;{6|S?oDGH
z14H#n1_f{x1**;){;ipQW-n8gk{q~a2^zJrX!!rXzV$KqQ0`irm+L?$rFj4UT{=Bx
zACrMNC=-A(_ixYy1n4q{#{Ul*H8)RRzmG{?a`Ol1`MFC#1;*=Fn_qx#0iGGXdHVBx
zO!A?!;KQasQm~kse2}396pM{sn;*bp5)^x&QV<q{(3mTL#GC}!oi7*}K3FI+JeWOu
z^YrNbOoq;&wl?Ut+~1503qVV-LAO(ZX81wv>K}{@A3#Ycd@qX{DBFM*Re{>nusb9`
zUIKaH{C*}aX;32>)E!V{XlT^j{9v*ptU)EgJ6+@eQyk;w>BR?_zDsSs;r;&&csaR6
z14DgHnskLlB13`2qKOx#w;W`Os0W>YVyVCYK2jFcj;&duT>&}=rRJz{Ma?s7&<Z5b
zgiWJmB13+CYXE~K7XzaO0|SF)Hv?l0s{;cl?SnEI=t_VZmVk9LxEUB78W}iho;a+V
z@rHrXGKYcD(u08!q|S-q|ACqgre&a;z<wk$Y?!IYzze#0q4q^0`1q#=$nyLKBWBKe
z6$VBPO^{KHH$deS$nQ1DN+R(4IY7ri%~Gxam2IGAkh04E4?h(DGuAMJhiL_VFJyS}
zJCWfAD7-7`85DjuGCcTwkm19xgA5yfJ!IJNn~~uFC>Mdtt?K3{up9*H%UFTRBT&GD
zIy0a`8-ziFM4;FP^{4B1{t^NC2OM6SKO7tz7<51d&aZ<E9lxOwGwC66zefZ-mj=pi
zpp-w;kzqph3I+w3d7!I1z$sk=+|K}+RnGx8Y#~DpnqlC{NsvL-|3O!M|8Q_@{Gamb
zAj5`N4;gm62CdRcWVrFVk>SDXg$yrVA7uDYlX*(SV%Gl;pew*@TG+RE|NpfWJkXNJ
zumF@Sy#IfF`XZ5G!HY(Q6&A_=KUlP6F$f?j?gRyY^Gi@#dIesN1kwaeOAA10$@>5Q
z4>iYr1b}9Ey#K$xX`#r-02)LF*HDW8Ap@n3|1ZG$;(iSb3ZQ}jG=MsN!VxAF$U&t$
zjxebU-nCFfyPNRC5hfKbkW!Gg1cvE$e;B3eVY7+g<40?xD}E^cdkFSZ14F$<B4}&K
zmxV7C8CJY_$glu3f}x}N|37H*tv3EcK#i6M=%x;Vn)#1JES~@W@LQ4L#c$B^+=YxB
zHS7uupwq7%8krS9-mZ1A2>A7o;RYzBfi^~fui|ZFsy_lc0;$t=^9RsiMW`2>oemf1
zNN%Pzp!UX$qnkgx<k<WIvPhe0hQ*2h|7{j9F#k?u`0)$0`@)gogC)cN{}oG{pMcIp
z4dq}_tLaj%sFilENLazZR4WBK78<fJ9+dh(7~~j`BS0y!(gSq#Y$HPf=ukFLQUvuH
z>sP+6aBO4%pPvNkXiaov*f8NC!+{?M8Fn;kZoUJm|13cl%`t%Pu4iZfRX3oz4_f`S
zc>fm!kLH4^n}&xB2VQ{mIWlaRtH!_xn&zxw4*;#`uc>*=zQv-xfkB}D#^(y}|KI=C
z+C37f4fhfO-IL+az_6v(%p<_&0qDe-|NlXuRPns|320qM$VnD8(9}}hEA}lGOE=#D
zjaw(YWMBdfRDyiis0!*qI*EYuMe=RXk}(Ca=hQqLdNmjrXDTvGaBO7o`RT}TpdOU@
z8dVuMeljxb__2^-1E|vt^5KMs3^gEMf_w%#m>cX%M}`*f{{rCAs+W!o2VOEV?0B(|
zVS}j`xZdjlRVSe0{?$Q-3$GqB+<5KC@ZohL!w*oiv1a~(fO=*2Eui5VNZ$F*+x&NP
z{S8Z-|DQG=WSCH?!Jq)@f?9h0|5pRa!6BeD0P3}Yx=f(@q5;%-_iBCu>a{_8XyA?q
zsO|vuZ9qPT^=&}?97z9006eGI{1=q(o@s*e7$}s$`L1F5zvE0CNfR$1a^3T<uNfI0
zyjEm*0m^x=7czpHM+%^91I~q@85^Y0Fi=(kdljk&rXG|lVd_D8r-Sb7kpo9LJjTC%
z_5T0w3b?BZ+RVT;{o4s9jrz^ElK<!Gc>n*p)m9-V-`2r7VDdwT381W)=oM;^sF}`S
zv5;Yc#R2&bpbbnG4Ge)l6&a>@|9{R3QV&uKnq~p%gQ-pQ3N-}jw>ZH50i+(J52EMU
z#YWrBpldZi8~zqlpI}hfIDPI(CILTCb5wzW8EL!@JZJ*CfCC!#b3pYpDBMA<EKs<E
z!XFg&KjGtbeBe>%M%&HPf1hNM3xb*n8n6P#CF(H39FW;CGeKs7%mkSSG9SrIaKj9m
zho@(sLYRy0R+u|29T->$o68Hn?+s?|?NdxrF!zE+3z6Mx$;dDVY_<afeBcP=PLO*+
z?nZSlFL){%X0H2bXipJzEgSX$DI&vx2VBI!%-w#PNv<9mzUb}+yOogvWG>Ed0Ou7&
z&{jzva90A9KP-|aKJfnk<{_AUfFG1{3c#so(IgJ<|4$@Ab~l6TvPa<kPb&B;v&Sz%
z)9cd{ellxJUvP#=j%o9a=?2f4HDN1TK(pSU7RV39|B0Z>$ZP7PD{5vbS6I*4!cntZ
z8#F`CV6lJ^JTL3P$PaFcft&^!lS4kK&T$??M@`Mob>KR^?w3gY-`^D#$)H12pMe)!
zXzynP-}UU!^#4YE>g@_0P)`DMX98#<*MpG<+@J?t=?QAEgYJ0Kkq6aB|L0gA`2T<U
zn|+Kr_0|s<89=8g!gDSgWD5hRjSQL$2i;)l*u?k-)ZqH{kf8#6dnKf?)bP6z++ghh
z-C_wlzSW+IVHw!VyR|Do_g7g<Y~iq;vy}rhFbwh{3`4zI58mem5_Fu$kb~W?Pr*~4
zD1QC^y8?7&4A{HLw=3#ivTv!i@DiD=$;jZr$PHeG0rj$njyR~t&By`@5>QZh|Nq}%
z^?;E9qQCwz_-J2{0icjT7{Uc^tAh-2X!?Huls-U_P~Y*mqEmA#hYlx$E$EWWnoNlw
zwVJ;~3bnwSyd-*FFff8DAy8?n!wyz+q*C)o66mx*&?$h(cVc#&U|_Vc25DetVANp)
zE1uEuoPiN^6*g$&Jk)>|&>f1F%HXRHE`T<-f$o{Csqqq-{y~9Bg9Eg%15|KNf1|*p
zBLga`VIrU_6ly&|ExZ36pz*osIf_gY(@*#@%S^Y~$H*V)2pZG?B}-6}s@b7kQFGI{
zqCWPLNX>8Sidq@xiu(PpE4=?d1`ik4$X;LoC1b}11`!ViM)0P4NVG8qR6k}=03}UO
z2zmd1>^ObT1t$G^2^~vN$TM^lYceoe|M>sE-tKgTrRD$s_3<wPKu1~DRQ(d^n8CmR
z+7nhUe;AswAA?giXdhUuop&YZTuqQQ9rGC&LFz$PfW}BbPWJx)7~C&MmV=6$CNStR
zFhIviPSo!`B~rZ@yv)JYdM^Vb=u#c;|Bu0IUO;QMK#rNd;v$p0D0o?+`5bTy090i%
zfR37-{@@~$PCclH=KcTQ9Z>NJx@rcVVW2m|fmXbL&ie*!33F^>iUDO9@DcZOl`E>7
z85BS(*g(hMgE9r^=zP$sHqiDj*wNRZg=qDAUWtIp2k-w6!QD;Jm8vx|FF*mWTH)Bh
zAmhQn_y-gmAPfqM8u=HXWh^g1G2s3GVdC^XmzX5$UD>zP!!IBH<q29g2AT)4Ui|;R
z2Ll86;$iE(|Nn!6#QXn4NN!OE7YuLe%YOubf~Xo?$~*;^OrWdgKquBZG%^a*SF>-i
zKK%bbXbIhKMTQy0nUJdwt)u_{ua`RzP=DuhMScC%&lR9Bt*Q7VQg>%FG-4lsS2ol~
zUap)`22L10AYZ_6O~oS->lg+`Ys>%tt>-W>K_c=2xLY%$=Kueiic2C;F>rBUZu$TJ
zj4B4uNs}kQj+pu)0OSbACWd;Anwn1{J@XhCp&Gz#y!z<Npwt8(dFz<Rzz9+YDi=Tr
z0;(1~xPmMP6$i(Mc{Mm?oB$nW|5}k@M%`i1ny4q>DgBzczeMUEvu~-HUat@UX%xN!
z&tri0xxE4{Ax>amc=eE><2570gx8J?3tlHOta!bUVFzgE8)z=_^+SdeplSs)R|(3{
z)(`%J*2`Ex6CC2kd+2H0;AK~h{~v%79b_2qzoBCji%QM(hgX<H>Os2=4>BA8C9#@c
z))lpq&J{J&lq<mb{JJq{r=BXPe0OYO&H*J;4@MTS7wc_LSJWt<U~p_=HUTBux;vXh
zKuHypbiM!I1J|H6G8-7cNwZEGlqv;07?^&5;?Z#)(+5yWtpEMHf&-L1z5n0aIKAd7
zlVUx~Vd!1h->23+z7YVL+^zb<paAMQd;fn7o=vH#kgjxWViwR7XJD|t@&7;UE{VE%
zKLYBfKCW<_#IUEhlY!Cd4ye<{pi@)wNu*v5R&3k@@3N@7y18;j1vqt00J#W+!RoB;
zF)&(f{r}(k9xQ3y1#bwQQTP9UP01!`(z^Q+q`_?K|Nk?}zy-PwNHZ3_;PV#H^nz0k
zOs_-J{~mZ=`~P40KPX(h|KIHdS)ilLVC&HI{|%^s1O*f5o(Sux>GQ5JNjuJBV5~mO
zpa4ph-v94H%A>vDRQIC(|0xmBm@>#H>;0g)uDjrcBaV|8d_d7rzwdR0^^EDit}*HA
zwu0<|4&lA1-@8i$G$-Z#{~>s7MUC_e@N^>RJ_S%xo*r<WNmU#vDT0zAXbcsU6sJ$P
z&ZN!war&O?O!A`O1Pv-TK<)sQ6W;&t?4ADMI+J`o_!N9JDX?#$nP!gn|Nr2%U!Zwz
z@Be>oKrRGf&}u`_6~y%}mn%FN8NsO#Qt$rR0lEVUlz%{Z1az%%z5C?~P{sr0pSowe
zE9zMfS3vTV9K!_AS^b~{1<q`W3>QF|3hs+FHy~aF34%-m=e7iJ4qGt&#SJDmzT@C?
zk|BA5@y>Lcn@sYIj?-gqGRf3iBq%U|`g#-Dw+Vo{aTDVhI3{Xr6Y>6c9K6`YqJcpG
zG8repVCgBq@Y8;q#Lw7m3f}*YgBP-c&er}>vrQvWnSsUo-?612Z@<{T4SX!ckIZcb
zkiDUdF)#jZQ_xWdC11vXmoeKkpu02bT_7tp7;SzhGE~?c`2Qy%lYtqu7o_4?&M{Ei
z!XklD1hnU}*3GyA)M*8^uB@xK3H;RBX7N&vfuUg@14kuC3zPT1f8YV!niT0uhbG1f
z`vw1h*f%h6RPRk?133zYU+e}gS7DT?S^7)F`o9(j!;hs544?%RHA`PtG|Xe*@c#Et
z6r{Mu{sE}}e+AUO07c~VIk%W3rti4LWW_Z}z=Kf^?A7TTZZS!K_sM{cBC$xCWZ=Ol
z2d?H{H!?JUuIT~o>h%8qA9@SHqyP^_IdH&&+FdU)x53W$5U^-aVDSET96a6xmD7NP
z4d~7x(2AmC;IloTat2U25t{}ETaJVlaOi{6FvzW-SOYo8``<BeJ%{EPa00bRnpEMz
zD0_DLp4&_k({J2n(qlRnI-TPVlUCFpa7aRJLUZ9UJT5$n%Y{$}9=$ld=MIxaJ;>zW
zj0^>!<y*fGGAwA++$I8A0R>u(Xz%d<2WVdqXs8k#4WQQcOyvsed)ox8nI^5Mj)KJJ
z%Qyy!N=<c+hJOs;&PFYlhhD9hmq;il14Aeai(M&)14DhM1%typh7+$}flf7M*wCoO
zz)~|`Nmrys(!-%vm3<3n9fe~9Lx%?=1Gq!cFq?s+`afu}j!~xm>E#OVf4>!{m)vF2
zXUv(t<Svtm3CKm2DhvvsGRK2a8oX{EG)?3EA94LWl)nVhtopxaI>$YxAf{h$r^no5
za$=iw!-G-k<@6=@m^6bH{(k}5@CDKU>Xd-`R-mRd=;mF}oerScIFN-P-0R7}Sid(&
z#EIem5713}j!g^~ETb7%K*3b2a7U;9L70y9y=~Lw?=y)@Zu0=`ZM0Y#!T=hf1TE4^
z|KGsyV(+%;{`Z+m+&6$1ae~&fLPtnIbuze7*T^sdWFRPBtnY1euy$m~1I5Y9I0gpm
z1_mb3HiJSh(9z_KCiN?)%ROLn0`I}muztY&95ilk{r~@eP)E$MiQ!7E)&tP`Ge*cj
zA%lbWzdfPTXFOn1uz}rV;@I?mhlV@@BWT(ZwEGTJ>V|5z*lo39VA7CfV0LKwuL4Rc
zFEzJ06lyXEfNqkV{^tRcdHsRcjtmW;&AFg5&-?#ha2*W_CJ?r6U;rIS!QuV?---G;
z9u|<vkN@Cp%oa(L89W#zz_l`Lxhtp@f-vi!56DXB!a0@~E4O)AEM?#Tg&`=%EmUME
zacHt*;3;Wg0Ueg^k*NvpWFk(~XJcRhjjttYHni1nN`N*iK~DR20Er7oT0B~{V)~DV
zO!B%WH7p*WwM%bgy`cN2m>8CUIypZzwt3V%4-x^Db}!W#IDTqvbC|BMg;8{RtS2M)
z<Ug^T^^E@yfM$C@1v5w$s6%d%z#srB$U(i@pIX~ItoLqn@cy?KT+Kq;AD~@m;7cGu
zmy!H_$gsnM;TL$#zfA*ZJ1zqQXqMIf5yP^C76%3UT2N7V0Guse?BC`A8dL@?I|tbb
z>Wevml2)y)M}Wmrh8sVv9TY%81X4J?;4yS-R=xED215@91`fx0%q)eP3{0T2XB?Us
zY`p*N1h<%9>}BA9g)}UbK}&W)Aq`4OpoF47pMe2%?Tus8|2?2w=l%b8Dx?l&+5_&j
zD>8Ig{bdlawiOTn_tZf>_k#=@tYbOq1?v9ot^i#@SRa2GW$_N|HcU`i>A~<5ygCT9
zgz%-cg92!eY;BB}i1i!}gGzVMuF|hMH7~yEfEKOQ*j)fc*^#>MULv530=ifT6ev|M
z8I)e^+vWk=T5Pe@f+bLGy4({cF7>cy2kby{FttI?oa8K)S}+7XbF%}5AvoOjZJX}@
zgh`BP-?r)c&zZy-w@t5q!X#<~)^~sfG`ZjavM1%(F9wUHEDTUR9xyXOgGUxi8NuTA
zcNti$?`a53fAEA!ydE5XC|>jYBw~FJ=C!{%H81|^fX~0MKLPeyeUz67C=EdS`VQ5e
z3`(GA1zA5a+Cc!}MGY2EDFgFDxZ43cusZ1Z8NqHKZ)$2V1iK;m6O@pk3TzHAa9AwW
z0B5Zi`?pP>{}fzu!MtR1pq{~EsfGmDtNXW2KmU|TynY+p$2JFq8el#K)zA|y7<gVi
zWB@gxI$k?6On9BhFyl4!+K|@|8FqkryP)I)9_(fOe*m;x5>$AAioTE*_dTHH&JIm~
zZ9r<kwI>5;QNkYZuprp1hYUNsrT_m2F9`)rTUsQwJ9sb(gTvSR|NkYR`zj@-&v?cp
z$GC0!_Ge7WjN7K)e#Rutxea{B?~8rgrvHD2;zLNJL4AlC@ysCQ@z0sG)wX$n0@z|{
z2n#46K$!)cCK?#Pd{9PlXkuiUzTr8OnB+DO(3NaZbzI*6wt`&`GV1<wCVio89-uNE
zA-(19bcGj8a!k8>r#rl05@Xt>I=x^KqYU`grWkPQKJdRD79Aj43Ax0v=|2mom;kBs
z{tvkn8&n{JFp{_q`070iP=!;IDP0Mw^*~!eL4_D-RMD}C5i}In0h&Sqo%4oX98Xtx
z$)xChh+!S5xe9I#-rMG2$+69$(au2tdIhusXx7Nmlc5oOKER0}k&b5!JO$4|eQE{+
zaI5Sf__C4((+#4T6zVOWF>rvEJ=b)E=vbTpZ2+><sd*NnWBvdCpNc08d^N0~Nk@h`
zFXJ4*n@T|C<WEJ0il2-O1vOm?0UivW!QG~piVPJm85s&dyLds}2+-*}7MUCpH5pPO
z9t@ws<FBB+2=x*;OTSpTEz-jh<n#kRI<N!}@(QTO4Qc>`FL}3f5I}Y|I2D8DgrRq>
zfc60)-*5uyVE^ZsCI>o$rcSyNwEWnyiLnF}=pfsFKV;|tZCM7@Z=fkfP{IN&a0BIX
zi=`IujY*)YxmJUD8F(8`=K;HbPA54~X$%qrnFG=X(gQNbVyOi<w?Yyn!w=8~BTG*P
z$$C(c4$>Iv#a0K>44PAPXkyTq-ZF<#r5?2VA0z{sSOisOphg|&fSu~6pal`z94s{%
z1T0=Lu+(Jv=-6^GaMYjj5~(@vqw|u(L80O>17A&sM1TjwCvdaWQh}MlGLC_x{z16T
zMmq*>P+*5IJ75QODmcJ{mpRFSoEyB%&CX(}g{K54xq@;9c(e0D2JrIm*AE#wKr606
zv%;W3M_5q-O3I+>9h5jhVdMS(e*mcc06O+>x_~^h<n+ilOsY()R!nbr!(_*}ZTkK<
zOyX?Y96T646i&bMhDnO)lgQ)+Arg}xgh))kQN=6+?mPTY{8wnvG?l^nAVa~Ag^U+K
z+gN@)WPI?Gk@3Y(MaB<59T|W8ILLSdQeFK6XKPTDTO4G(02*(osgn{>m=78tW(1EQ
zS<L_ct9~)N323aQW}cFW_rKE+J%>M6crd&HcW*2fFifmTkro9nC;=}f`L_$)O$05s
zf{g!vSjxydo%bD+BvV!Dbd7gRa%@utJQ%qfr~ABP@{(%+H!VQ70)qxmAzJ|duXvHj
z(B=LAU*+_GcT6(VFT7(?n4WNuk+mLlkNv{`FJR4F(82~#hX3vO{{m=)2Xuu!sO6&D
z#=uf@#~3n}Q!8BoTI_87l!4K)kMW2O8v`5YRy|N0fUrf=qy-j9Q!P9gxxhUx4~BSf
z2grkA7Wm2^JsSoFT^R;8`y_^S;9#~^U|_R$U|_Lsnp$C9{VfC3#Heq6Tv7joeTxSp
z7q}?*U=#yy{slEVbeI{W9h(?R9Op5DhG>pB_AxRzbp1c`qK+{Ll)WcgGcb5COaPCz
zfKn`|Snyz&2_A?5HBmrKCC4Vl7#+_4p8p-17?z+~$O#_e@L&`J_qJdbIyC*C0`^_f
z)CLbmPVmkGP)Y+;V71EZTc$ra!Khe2iBSQREI|tlY9}%(fHtMUk|@k2pu>nf7~;XT
zj}G(y{}9*w2k-O(%@$iEP2J(a$O%pupwl8iJ0U?9qw0?XI})VV`~QFNd3#_rAi|<)
zY5^qtIlyCQ-v9p<fW%?gqG@UdR32P9dN9O+2V}kf{{vst2U7>4L8E9ENmD0yFmixL
zNkBgK{{Qa_NNz$RLxBfFCpefv4Y!&UY559^ItC68hBx5k4t2c_bljS`fn)lq1&mVQ
zqY!J-rNN7OK#S2pQ;a_pe;HaNu<fY1XI$}9ku~9`B5Q`N62rP557`)gG_r9_^!%1F
zk&(6H$3iv%?|<uHzOQs_5)rXjz_tSv@4pjSSAZt-Js4htTaF+{T0dZ5ut=Kv!Gn<l
zyy@Ix0V8h&NU=pCQ-cS?Yu)JvpP0m)mVh&j4)gzips5dsCWaIbMiH<ENMd9B0va{b
zk!Rp?Y+`)j{ckNe`n><G2Ct&`{<kJ|ddDXwIlU#|Q81V}j!plUfTH*}BkP3UimWq!
zJF+hL-N?G(_d?bkj!o<q)6aZjk`tR2Fwv3uf(IiTIJPVjSqnTEG+d{BW)g>ta6uMu
zGEUHtWBBjb$j<Sikxiif=x5Lhs)qW5pF}(uo`Y=#m4B9w%r`6+Fo1(&rX52=t#fci
zZDeqT2g6J77=T40LxTr{B>3zCa8>|K6IMxAI5e@(00p<D0|RTL=C_QAjx07hob{l~
z+__fhaDp;8?+)vOED@Fp3|y8D3?dU9S$gXKdjx=j#G!$K!}<XOm&F1Gmii-~D<(f=
z>3{_9OK{=<84NO1hm(QDp@~t&`XMW5wJHm!*aV&N>cQ|Dd;uQFK@Lqk3mO$!Y&19-
zSRLydSr^zk{r^{~DV}2K6?~*t3v|0x5Yp{dtPKndtUU}2tOg7WtRf5ytUe43Ea1@q
zP~=-A7_eD1P2=$X|KqClga5PZlW$j8G_dXP{<jWXsJuvIKH$Od4Lq3sB9Zxo2g5gT
zA@Mqqb%li@>jf52T|eF66tkqXA|hNt!2mjv1+=NkgW*Nz^n@==TJ<l$DFNB5j!plb
zK!T1%0Pdwm1{Z{nLe60Nh(U#cfu(_gfklIXfrW<w+@53x7Y-mFfpDiHGkEiir6SV-
zP<`jn#M)t7uf(tp7RD15nXfoDv4ajzVsmU_2cMzq!SDoJi-5zpk>!9z^8f#qiVO`k
zb?jSeJwJ(bdNDcZa53mRHZkP9bYzAeJ;f97B9ZwL$nl`V2OOKYc6k2_0w*3&zJiJ~
zJ2rB))PwG@1~EV_5>Oa}!rJ@a7H|#lnvr$FYem)>uN_$zyl!OO@OmLDXq?pn<`aje
z|8p!7I2f7_vh;W`d<2&?ppXQ$Sbk)FD{yQQ2(W(00v}(uSjf;|(KN%L{@L#ei=-J2
z-v74LgQpC^zH8#$(5T2V;l)CR1|3cY6^BM%&>?mOAOkHLSwYKN1zx=TRscHp7!(5a
z$Jn<(QmX=Fy)-iecqf=+17nP16Z?agiY${X7BKt=)gsmR7!)cs^_J8sdWpQ~Wa#i<
zcnqHDd9kpb4U{jzLku9p>W_V{n5oFT-~0b}PLQL(rAi|s2gtBW4ZS6`j7}miIv6HE
zs%M5Zjf!kM^^d{XiNT?fcg9OaHir8D>{~#Vf-L{($l6f<=XXV|W{?Od&OI0&gHNsn
z*#mBI)F(1E)Gq-|o_?DNwh)xD>%o&HGis6_1b_+*kbM2$M<O+~pl0tga91Ccplas*
z2(U<+al!lFMsRBlBnHZt7D+Q+c>mh~&K@9#zjS16fcgIQONJRb_MmZN1{2VBw|bBZ
zJs2K>a{)+mO{z4wYj3fXfzcvqCWH6Cjo|IKAVX^7gDXJM@gnnEfd|89@CtKiVq$V^
z;shr;?|%W{H6@^7D~E=^bFinOKMV~ESvo8ZFw`?xG%_`S6W#xBm7vBKNTXu|lMKir
zSk7>4V(tNDNr$FCM?h7UMI&p1MIuXr2g5V)f)G&1IW)1^fW;Ru2v{Vtcz7^810V4R
zkz;*>W}XPdy!t;S7Ku!top%i$3_ajP0SZQoMurB9q-i%i7#YA-mInhP{3<-_hpY);
zM<lX%fI`fJ;Td@R3t|z=4NK4}7ey8us1Ml?9{f5J<Uvry50zuFsE7OhYb{ig1!Mup
zV5lVt9t=;x4Y5W=<_jQ89Gh4iEE-u7K+P8qhIVj^1C*~p=f#4`XsBKmi$s<J4~D1U
zYzflm(8PWK)DW1c$TS1&0Fd3Fp!Z;K1)q!walk+DA$k@G1`O5@{?D;!nr7hr|Fa_Y
zc>Dz(`UZuV^@IOEEt00q@L>24E@*J52Tv)3$`Acc1_p<Dzw1*Rn|_}Fm1-a#fbuoC
zWYhd4(y7Vhpu@?a@6hyjiTD5COF)*uu#P-vVvk7&HBK2_Kym8W#CSkQ{{KJFISkhS
z8CXCgqK=Kfz=e=Sf&qv1ga1=4nx+?c|NrFsBC($NlJ`Gfa4W+5|8E&k{ZOxR8dS~w
z_h7gW9_$Cz&yX_VSAwM?%MXhK3@MP72txyC|1BtAgN{q}U=RZ5B9J4&`M+t}0S|^J
z;I+Gu;Ac_+)#ISy70}+=iHa;X9`y`@;8bd9_y0d=$02AjBdV|1u7G?6s=OSVn2+d4
zf%5JT9*{#omVz7un%V+62-NoWU=WG~IiORK<p*e|hC>r;4yf**sL0X*k_TDr!5|1u
zGa6D1jP*6OpjHGcN24N3hxh;QI~p39!1tkBBu$qHX=k&mXgj7<(b}d|(c-4$!SELx
zBHsW1Ede(g4u7t&Xk@MMV0a9!mm$7nT>}yW$y+3{ICwBT2Deh7axo3y_L~-XoYYo{
zp&nlQIX3<80QuCR>0baMOLqE#d;`MpEXnW}JX7ZV|DQs`LZ%rYIZz2{ku-fq$O<;Q
zisi?YDwee=RV)QN7+f-X|Nn6Wq|PG2fYG99+7IvlA3{Mjr1!siZ%E4lYfbkZe6lsv
z@CzOcf57c-i$tacAjfzxbij*Z5Z@xH!@`5%4|sOd`~Qy+nBy!G44AAR{GVmfG~EH+
zf!_81-=BrJ#2eg}^8Wv04#=g@1a!iK;Ss!cb8KP+XCJ8C1rLTt@Y>U{iLnNhZcrP7
zpmrcf04P*JISaDuh_MHhmc0M}Jp(E~>Olzyl=VCqn!vfhgP|7Oe*zUg;EQ+@nL0ce
z?t@dY_y1oNpu7u8SdLA<RV*4=JV5F|A>zSsA3TExI<OIxvc3QR_JCOmP74hT43PA2
z58Su}<*HgMZ^nx03;r=l)!zdzqC!$w;K6VY9Ngaj|1v<c4U_l(Kac^#2mk+DB+V%B
zVE7GQ_Tl~iX9~n2EFKn(Oba|19>7aI$ELqMV26UDZ2^OT2g5z^+`aezpD&<#5<tap
zhX=z0aNP__sg6xQH-L&*a6*J=0#`KN|9{Q^mG2-2fwB_FrydNv;Lx#*`~M#_{RGa&
zQNf_u)pZlKzGXnNEEDLq6iB(TkYxfWD|#?M&VaN?WSLM8a-j!93wW6)$N>&btU8^F
zEE7OA8Q7H#3=E)PcW7c|@nE<Mo+twu0&;})EzoKmUhon|kmWjZpfZAS1GsEZJq=z%
z2vY08zz43VKv8JPz@T5Rb-Ds%rehPs^utWdy7eGMAOk%Zc)%5oh8$?&3#fcx0d4L9
z&vk&RT~Gq@V7LR0N0{R*5?Lxd816uW_P2%(Cj+ZP)7Ke@Hsvbtx(o0BUt2sF0>M!W
zN%$V%vcvoT*Lu(qS}fq&3tVvA1Fw?+g@$9(XCIKOA+G%ls{O!fEfSe#KoajAa5o8*
zs6bKT{r~$6u<uz9gMIJ8zzbf&g(wx7L1%o4OjKm)0q3R$21XBtdTwy}4JipfwOA}*
z-~#0i&=9r<!((tO2;`Uvi7Xus4Zm7IxdADK!$QZygW)zfCxILTD$YUlOhx7!-v9p{
z0QuO1ApqQ_@c#d8g+(I^XmpbW<Pnd0hC9$8`T;r=6jXmZSTr)t@L;$L&RQVL9h-hl
zuxMm)0BHc_77vEo;C3F!F(5v;u>l^Ix{Fjc{Bi*G@4)il;`cVx0lzdF4zl#TSjff!
zZv4JzWMlZL$lBoj|Mk<CimVMF3qfrHhejp~kjontLA^`R!8FWQy#Kj@L&W?4=LwJ$
z{`&<e$Uz}y0Z-xF;L;G3!a<JqVBm)rW)4k^H=qd|5|s@M)BTy4*`pXYcre@o`xlfH
zK}phsfeW0rEv+DRBq$YtDqY8>-xEMqf|i7Utc9qB91sXfEof<6WBM5;W)&HbDv-$@
z44jZeE(=NIj!nOHrt>f}OVop$3koj}20nNSbZBC_0(R~K1{Sbghd+b!jzbgE1`mdt
z;P6B;8C;fI+W!9s&X1g+{K#|$<W^A7fb};&uJB;s0@rRJ`#=f7gMkm!*Q;j$g}Xx&
z!v?U0iO>`RF8~;NJQ!|*2TBkYa)8@hAj`b}e}^=6l4f{#Fnj}7f1r&m-v2)(fKoCn
zReLZz0LLH5t_g`OJq`_j&UpX-bHIb4{suTj)yH100G(D1v&8%VKc7xV<{O~-XUC>*
zEZ+Y=Z}4Ea0Uq7+{{I~*Tsgp_NKnVHcre_6lvZ&d^M1qCK}szSkdGN4YJY*JovrI3
zh5G^zhOgjOsrUcS7RW*8!N3V_Q9y$&!Goa=+*<|t#G#4N2O4USHaa}i7&AN=Zh%LI
zU>>r*_y3;<13S1y19AYQ*kmZEN45;4*n@!s>;tHU6&?(A-~myHg$yxJ3qg%Wa3KIn
zpAJn7CLRpe!3_kE8K4vgDK^=`aSpQ3`~O!+4FstgD?AvkgQBFK0i@9T|JO5U8o}et
zP>mZvjRerNghkTS6CMm-z<WKs|G#U1l}O(I|9E&X_<#$1P~P?a=LF7F-v8fk@nE<P
z4ngn#e@kF?crZXtyR@{ehooBX|9=Bul8~Tc1J|h#2mAvKSAlZ^q?d6GTm^dn|0?0Z
za19)!-v9rB>uQUn=|4OeK7$u{feMg@MCJ>iQ3=pg0O(G3?|)9<L<;hZ_y6|}9-0i^
z;7T3jYOvrxM{pa>`~Q0t=#V610|#jB`SfdS%(|9fuUp#x|F6Nx@Yk`CRRWZE!JX?w
z#uN1qe~EZ7T!Rm^StK%^m}$>=!h?a0ak>LLvvmCx4Q9{+J{HjK1_#jILQwVuDf3`p
z1E(vCMy3-M;4xD!aKZ*fyJHh0==4f-_23>cl6r7M6{4Oc2V^EF8F(<Tf-56X$!c+6
z`Ym>5fqFLZxTM8GrW+QGOlKgrv4i6ds#^urS%>I`oUExK$G`+K!Lf+}RPMrE;=#ZQ
zKK{a@k?8`&9LNEo5ObLCAejS7Yz!K549qpwpb>{A&`vi7WP`vp2&}*WY4l*Y1CFZ+
ziA+~K7#P6A)6*AlFpFz~I}{cN5ZXa*^I%{F&(R@5gp+sr0}f{KRB#0eZeG-bniu~r
zSS(<K4)1~nr>}sMIw*--B+bn5VE6!zKTt7d(Ewidz-V!h>4EpZUT{hS4b_6?Ols=c
zw>UO2M}UTL9h;afrpItH%hk_(G5H|l0S|@`;B;b<$n?O2K@eOGH7YWlf#g+28;eGU
z0*eC-EEWqG<Uor?y#GH1XOWs@b`y~Kj!jHE8o-G_<{`*k4UG`rTO`dg!0aZy2fNFI
zK~6NGo`Hb@x`r+Q91frgBoQ<Obs608YiMNX02yeJG^+rMLEwH8NDXMv)q_C|(pLI6
z1>E+sRY*%~WMsOMsFjuuno_7q{#Q_|88EF@Q>>sS*(0DP+40)+1}<i{`pMvm%!2{6
zE?f{?3VJZ8fs1+2Se;`N!yoT|Qy?COp1cVP7{|u{S3qt9<wA?3E(Q;Vci@QgU|@Iv
z5(i;W8Ur^h8kx>`FkAvxgbj&I;DHK<CdQJ6M5Y@$^~|6ekkJFQLfV4?8iL@^lm?e6
z_(Ss@I30R0$bicjP+&SX{o4Vu{6{0x2aBXx0UiwRz@_SoMy3xSaf_r`3CMvNP|@PX
z<iYR`oCLi8|EmEhLdKv*q(#!K4iAQR;GFm(5!4L1500T1iHtiu8193U%!@?EL*D;v
z9!}$C)&S3eAt!lI2KQiK1g8&hRD*rU3T|b9vY$iKpC=$oA;CFQz=Po}IC{PRL#C)e
zau$i8V3Y<oL?<LNff|kA^Tt7PAPfmXX;7`{%i#SVGFAgIa2AIL!&`7Z1dT9(6obaj
zEs|#L@L+fg&bFW{a-iaKERtqU@L+fYZZ~-U|1SbsL?AK!1P^n92k1rtkTMwVR0j7w
zbU;JI9t;c$y~+%XI-CqTpwb(ZOdOj2f2d?;Pyns{ut;WL1l_#o{r~@&=>-cJC8l@q
zGN<r>R=<GuggZ7d+?f7@mw6u3>95mg@G(!XpHRcWv<!6T*zZP$1K_L09Kn06XMpy&
zgZ8xlR%BT58+8BJLI&`nPwNE?j5Ry8D?p1ztW*B~w|1H_19b3}2g4=Ez#}-VG3)^?
z5{8snXCMi?4zy^TF$PJTF@d2TG-xalP*cNhq9Mb;>Db87Qd7rn0y>ii(h*@O01v@7
zJ`$-Zldh=$51O|*1#S+^`U75>0PZ7zmiK!wTmd^kgBdj6!(dZW{c;`X0EkX|28K*c
z2EAJ75w)N*KOLGFQb6Z*=<tGF%UA(gtEXW*-AaHty#Da!3Xt6%3@7288dxC=vS+3u
zL!}49WpIZXRP2GoJQz-Z`JiDW4Ne9*$HxCTpf%(5|D{A6oBn$!-(vtDR#>a~!C;~#
z=vI~gCKe40F^~W{4zA}wy8}Se2%sSWu*9#0pknGccsQV@ULv5Tl-)!_6dXuXKmlfT
zkfESzD}w^av7n<AKn|%}xJm@H@!f;rB)F)WeU+i0{{JJ9R|^?BV96Dhu0Z-hdMy?(
zaDw!DFq{PSe*+mnoY{>aU!DL7Fo1mF{r{gw_F@K>nq&r(kmQ?nHOUMYy#N2}ffUyN
zK&L8!EU19D5V#o_KotgP{WvHgD%6A4C4lD0L5pH69x@dCNMyL+!4L-ST7a@AXyhAI
zYdJPD6zDMj|LfSqFyloc!v#>)V5z{sU;$dgaFC(lry^)BE(TlzgQx53r7NKG0U{u;
zStQMR;KA@5+?4~}F9Vv4dcnvr-8`B}Qs$*1!v(0K85W%k4jv58z>y462wFTNQE!nn
z>wpKtGjLhw{r~?QxQ7@S7(j~@>lZ7DfSd!G`v0N$UvQ#214E7S3kQb=<|ClI1Uici
zv{o53?f=V>0X&%Z8+7)HB0~lAAgu-PbJ{>>v?MZ|fSuF!tC698!Y|MTEpiVS>>MD+
zfmkZdRsbD@Ru$Czq~@D-Ma_2Y3Q#z~G9dV*FQwTMwT9jmNkK{s4h@Xp)%##?HZX8O
z(%2F3*gB}Tv04mXH>BXfz~}-hTC_VE6zV*E%nCIb7#-(|F@Ub5(E*JJ&q`)stWgG?
zy7vFhbOjb>2@g<K(&1!K(C=j61fBouFpoh1G{Nir|Nje+b)eG7v55iHGgEeK0v#*Q
zpa8WV+%yAO54!Jix`GI^E$Fr>4~Em=;ZjiiJ2Ww@shhF5qQ(>ym<$3nat|2l_OGsR
zZ20%(1tTNFD@BHiSB?w~uM!zLUNtgIc(ssW#;b!23tl~BSOHor@S2ff!)rx`9j_f3
z4!lleIPtoX0d&LZ3(#45^@rKFfR@OC78!tw$(pKLBK7rKLGwQUAnBojffM4=!;nTM
zWS5l+$XDPzk~Hgw2g4Ka)?)Af{}VuBb;{ip9t@|zl@!ziHaZpz4D~13w}9q*>ZW^Y
zIW{pU)HN@z04)gcU^ooU%TTrT9Fwnsju8TF4}qM&4l>jtX|{$3!zp;K0F_kGo{<F1
z;97GpkzbwvUwHrjcLU+T*#;gAr+7hp5Qds%;lXec+|B?cNhEOx4~F{3;Kdl;|Nns(
zXh1a>crcs<r+ug^6`+;}pjrOG`~N@i)<UR0kVW9)7ozX~45+>mG<`q3|Nn!8Dw0NU
z8UO_=CGiaMq4)oP;BBf<vmHDb9)X*JkTmsw2`D{z|NpZBl&Pmr`OYX%56ZH?693Qm
z)%bq_{MaSX5!sIaFMu`*g0eg~t1~hP{CfC*2WWZU55@nAppqYS&;)pw)-B_Tn!k{p
zn6;+f6}2J36)%z*Jzgd<27r=$ZE<vkV-wQ_4~9dkpg7QAX1D{&!H$j0^$MW6*XkdG
z18AK-=$t(3{|pZG|9*+Qn8)bh!Eg}VX#{BkZKkqFn*G6p;Su<J=@)g34j{uFo0tkf
z^|J@VL2$f*R@#Hi@nARz?ugV>ONnSGGcq_fGM#xbkI?~?%ImJNZ}DI_=n1ZWL5Ej^
z#@InE+`6NnZE`;!zD{J=0g6b+M#d6Qk_PP&1SMgRW)Fsg;QkXxA4ok+ulN6-E1`NE
zIwKiaJ1rSlKn@4#>6Bz(?)b^T)Nzx6v12C#gGJLE2M>lzFB9S!7#Oe^ln611;YXt#
zV+d&d1E^Gi8D`NmTf&3k0JuSjMXxGIuR{aFo>vDMCQM)RlTniY;r|_=1EyXp{y*{B
z@&ASC34fR+>Kpcf`mhY(Bj`a57;Ae5PK%~F8P@U)jOg<O9t@YjjTjFG25=n%ata7L
z&in5%@8|#jn9lf7S-<0i1K25z|L=g*f^ZG<0|wA}Gqy?$vf#i030fRr_->K;%)w&O
zT2R0=fEv5g6C{~MWa`pqSJcLOuB&TXTv4}lbwy1IWNI7ivk8*SqS$;UQt$o$#{rPR
zFbs-r@Be?_fRdR-1A{&!c^m_e4c63ynq>?Qpkln%{6~O>Cc`<$MurklvIOY|#hyje
z><1nU`@lm@Aif8~en<-VFD2sr|E~l{ZQcLf72f~<g9=ke28*QG2_6jh!F>YAa>9S$
zr5F}Ta|ApX?t@z<AU}YT8B`uTvtp4n8#LJ=I{kwbv&3{8YbK8A9Ma5kY~Lz87!DOq
zcE}K!?jX%91m+(+I@uvZfx{+=VVy<tw~FZx(wJ51LA@~hLk#Oc?F@?rtnWZ$3840d
z^}TNmp!EGyk>LV(nnv?m1!xG<gW({!qy@J#4uD!LtnWa>7vBGB!M+8>pJNk4iem#q
zj0Q6UFX&c3P|kH|gd7ZKv4DXMWUfWiS_uz^!}ZAHQlO0&>lSK$>(SxlU~_C@c$2I3
z|Gy4b+g-;dMg<*C4$u|D;LF58ApmNBfJS6qKo5ljRaBr#4OCg#G=clY%wUUJo-%ka
z90Hfz5Xb$W19rrc*A?}L>p|-w54D2g4Jz4SsbFjj*0=z2jM_#;PzV1I(oD<$80elZ
zc&`i`8vFl$vY5*t2HHyI!N3jfM1j=db7;c!vtdl^I+)t|!EG#T+NU1~V-hjI)Da7w
zpunaB6f)BddYL7re^|=MGkuRNGapmU#pw=P88s&ViREyp=~S)&71E%ius~4-3LT4N
z1~yQV0A0tkQJI15$3cb@9t``zy}uWY;OmUopb0y1y21iRjp+;aFtSX~kYkq70O_;-
z|EI-z0RtCk+3`fJKLxf<4C_GE%|xv~B_Q@htv?mh*T^v|Gx|=yAjho5SJnY?CTKb1
zPc4fEh;tR>nT6EYT|gBMtWp8F6SQ;`v|JQa*?{Z<or5*KK%QBQld%VsR2wxdruWM;
z%j$z-bwL*c(*iCAHuE|Ee=qD}U|E>Oz_H{M16Qr4l1ME_l1Qy4lSnN`lt`_n(e&%`
z%=-0=Kbq?q1azeT{|A}XaPm)uV-uqXi2bXPVZpD33@d&+GF)iXw3twz<?#bDw#>)^
z@>8RiMNbXa4bb-D6ez!=J}aoA*3-iR)XsBgVgenBx~@_4Pe~1@frDcc>l2%XGiU6b
z7}h1UoH=V9^{2pt8@h?zaUOHP^d1Ff>3RWKO$IKIxwV=O0ri~*piLSVEUg&87tny>
z3Um~5t%)~e5lqus4T~BE7E7hI3N@9|6`;!1gJB<dSQ?VRSxsIwGAwwtkYUAZM^JZy
zp+bWb)V%%I0P<s_r$q;t*0kuE=)%A=QKg<i!2AC{@D?Uec!Dr?&oSOXHW<`*v2S8n
z2U0I{jE%v1&YuR5qd;rf>gO1Vc>n(eZh2YPFmTnYovr}&WkC1vfL3>S|NjFXKmqq-
zxu5*5u&7~>@L<^ecY1;{vzX8y@PG&C$Sqj@pT1xNlgRW5QcOH1o98n~Su9`xZzcwf
z^ms7r29F*sjAxK|ai4*wQ=Wkn6v2g_|Ns9u$WXJ<k)de%A7y66dQ}Eyi_ZW5Yt_8L
z8~k-tL4&Le5<033Ob$)VH<qjdA71>wevX!ijwS=+QY{9i`Z-=Apo+fY<cB8EzP*K7
z3``5U7+4mpVqjZxih%<pU(2B+0@72<VFcQ{_n>}`lZd4wL!QL}1};#qXdxF^51YKn
zvH!mpWPvqvfUYWC-UUjfQX(J&YBjZ{?^a>9cKh=L7CSYZpp?c?0^)-sMDtHcbC$&v
zNXlYn!AM!~gvC&RoUo(=7?2Z|_y51}MZT~&gvG0^5(5h;(ZJ(V^C<@+KL4%&IR*K^
zIZMqy4WPsRV2KkP|EAs*AagAi)H7&-DjSetmTC-KKMpcXs5S8t0WD|&UC!>ouoE25
zFF+eLjxk8on;40J)Oi2@4z49_71&rna<&c(jG$@%L{0EXqil&@91Iqf3>=`tlR)9p
z^va^6*2GZDgJCDQ7M=8yfe(~x>e801uCS<N5b|Ky2_EyET*)Be{r?-d;H_J>y27G?
zgAJ4_L4AAg|3ASkZi@vBTHvkNi$NWspI`@qPT6p1Vmx32+L7XL<_stln%n+VBzm1W
z+wk(w^z(|$(u{wmzgA?HXZ$mrTZvh=zNSP<WTFil&*U1=?EZFeN7MWNH}LSe#Z?9l
zP(}b*ZBb>T;r;&yxW5F>44}MFWn*T2kAcsFVFx&2gRGl;(yqh%UnO|%#`|9dc;*5$
z?gh$xFzo%W5<E1a!_45y;Lyk*1DZzm{{Iy`aMx(V20HfzwB7lR1?VgXXb}O*U?>Oe
zIf8CrXJi0Xx`<2%+RnQUIpRU3ruYB9N9tewt^n08%expvy#N0JoiDczRN5h{g(VVD
z>4%<By#N1g0M+#%XMpN;i-iCGKpQSVoe>7mQCvLW1}QJ-#OZYtGA%&sflh$NPDI#2
z!P1avF<oDc*;>g0R4=g1WPi$S%f!I4A@eDZr2<3TMvtc)woVKzGqs*_P47`-Rug*4
z0j*CaPSmpK@nG0`5>!j7zzut^#w^cfF~$4;H;649P+O)<|DeV!$7V6X`~SBNRQvPQ
znPo$2wb)C*HAN$Xi>2rP2AhQc|3OFSRU|VgXmByu`!q5rSZXpjfPx-$f4T-IgS>Ae
zXczK-29O$%-(m4+k-+f3BKZKr^atw95#Y`kxK4y_t<Yd)5Qh385p-7Xk9vj+4vma!
zzz$7e5CCnbXw<X-txW_Su2KR%NVthX1u|p60A0gq0b17tYHjg=<Q<wAb3m)-7tCYe
zvW)xx&*A|Cxa8U>$KcKdl7Kl4L@(@OU|N{Pz-IFN|L+A{kkSlN-zJIFaxjV1YDS6F
za%h3-TM>t*|5s`?okT)frvKAmmak{=0PU82vCxiztx!uIv|-{+p{4?ZLlfhZPCEup
z(5fKECdM5)oD71FO^g#j3xOS)7<P2pF^DXTV_*VZ^c(8UVh8Ft>TrTKd^4Va)VmBW
z3*#6h5;d=sfo|q?XkuttXvZK0)n8%D#IUZ>j)6y|(c@1+4JYW(KZX>LM#m<G7*G*C
zQR7bmC~7S185T@0sAkrvw^ew+06Kcpv4P=+t-=Q|+o1t6whameP@?tz{~tW(3F3o-
z-{uj+x`mu}Qx<}b>V5vFpoRnF-T&a~wv*FtCdi9WF>s;Y$Z0nR<SeLI0?3R;O}hm(
zoD%h*j2aN?EMc)=9|M#1awi3gc?=>J$qXW(oMN%`|C<`{%G*ugX-P<Ug2M5?3@DsJ
zHDxS7=V^eJ_<~Bvjaqh-y#N0LkGp{!3&Nnbf<x2aJ>LKSf;uP+AbVcaGh6`Mv$X#I
z8%Qgc4P0`9_E|5O$G~J!#~@<S^8XEJ*O3PUJGcex{r?|$Isnw`02u=6D_A7kP4HmY
z2%dKE{{OFIVm(8N#p?fWYHYbHY#IJD)+}Y;0=DP@14AVTgMy_hgR;c|SAk0KB_#|O
zUL+?nFw`V^W=;6dPyh-d(6*@!2N^)ep0!N)$H22Oj)Cc?90SWlJ5c$$5j<Gj@SmZ;
zQh|Z9MvJ?mv7Vs>lyE_H_KbfFA{+iOh%MD(052m2`5uI)@6l#9-~su$GL=CA<m_ph
z%o5WDbeP%VK2^R{1mCaAP`?mV5&Z4wv|~_(q)!IWLLxzjroSZ?-T!Mk_A!WB)G-)T
zw1BS5Vgr}Jpo4$0$bmZ{puyj1GZ`i7L3^PzSQ(^$Br<$(Xk^R*?bZhE(_5$lp4wn^
zXkrXmr~*p#p!+ZxJ$@f#*Z@i)puSwArbUPKy*~wwE({Wo1kb3lP=$dFl;9nk7(tCu
zCWj_Q0Z_vlbiSGQ|F_^-GElW>F&|VTZmb8p29gRGt~AVN-~;WC1@*%~mVi<Xs1@6g
z^``=y4VoA^Y!;k313Ex0Vd<H(pwnR>;tX#rUNSI(He<@1WMimx*AT0fGZG2)eDSZ*
zgF(PDg8|&St#1J}LM#Ft=KVk8*u=1-=3c!Kc+>#2zw&1yLxrUpg9zAlO=~s44Fp^7
z3J-=2;1mRPWQ)ao@E&$HP`&2CupV65gZ5&+Ok}8N)L`QQ<!FZ{#-7&;8CHOg8RKAH
z=E1-K-^20xAj1amM&X42|1Ihj84e(qx}X#RD#1aU*AWUCz-MT|)WHmf$%A^M-v9r@
zmtli~`?n%P2Y8cuBEt+&Xn~HI14RKSRIT?h2sCQ`sj$A!z)=rsX@HtX^*29PG|y+?
zlYhy^U}?|5W&NK)qShALOtJ!n!dh^@+x!0;@JJbGoj$DP0y-_P{_Zak@Bi<>O#<)#
zZ@>u<)O50iHk&}93TiTePF@6Use(3}T-P;cS#;Fe{?zhdSPNdvFu9I_54zBp&7uyJ
zNY;WUa3;@VkO0k4fgJoIk>P{)|F_^K1t^H8Z<xm<QV$7-f8YTY>w7jDpy98dphKCV
zLjfKPYr*9dC=5U*fb!alm3Cd;|KEaB;mbsD&Sm(i&H4jmDkz+xX6C?K0_@<H00U^C
z5j3>{GHXKTpMoEWjIp3&BX~fkQiCE26bZHrt^&3SSIQ<dGBns6;9y8(2cJdG0BS;7
zGW>4<P2yF&V&JPd$-r01(S6Kf0YivI1B2F2Mh4JcsGgsW44_l5TRa%nxK1}PV3v>v
zB@Yl@n8m;ZYW#yc0jC%^mb?PB;iIO<8!$_9yhvmeuxMl`nBHK(ti<*9ChV~6=?6R+
zC8h@)WMqLhH2zFKZ@{dk?83mL!^M6PG!UWzq8k}pbhsE?9Ge*C=x{M9fvU0T35LvK
zOc8gd8yGT63VQtiufx&6=+MOAvCxHqL5FL4lp(V$V=72iV)_I_W(gIDID@l8)BhKs
zps-l_|A$2j0|%(c{lN&DCQ?*{D`x?h5C|##sc<Qt=`u#lPE4k<(-VxC|1quXot|LK
zyp3(r0uP2IjnidJm`m$H!@;1#$RGay@f&np1!#yk@&64_>jczu2XFdZ`2Pi{psU%h
zT>(0*PfMPG1ytbGG%Hv9aAeT%U|0fPS7Cjafz@#mV}zvxgNC&NgMoDdgNCI7gGOyc
zaE0|_21)xx4C_Ie#rhtDi1l8V2GE3MJ*XT2Z6U6odrHKEVL7zZAY=kMAlG^h0}m+C
zCTcP=)Y_iZ+Zglz2WaV#2g72>IyL9Z6&?(W!3}TFj+&a<TOyWT42+JG7{1stFvx`8
zW3dCx)ma>1FiqrOU<4)EgryCPwK9Qv-v9rCa+xn^GEcx_F6$3SHx%Lk4+a<Tf&<WW
z9!OJ7nlxw?mLSNn9t^JFX<AU)t$)hC1)LX_ysog+v}l;_5W_6bcmTZjlX*g;!t{dG
zOp^5u3?kMF3^LXU44?@%5m0cz>RV81v}FKyi5S9<u-L&|ig4v0aM0Q+F|4ndcSr<$
z7Qq4r!G@P!1t7<Sw6NHD|NjUcI0x-*hGsNo$T}uSW}CjljG2$oYx;3BW_dm@@Gi?A
zivK5iFf9E!okyKXWx9kpGtYD#ab}t64(7}pETGwd=|1MnG8WcMlNMP2_wE2qi`U#T
z22b{YhLb=M35q}uhJ}J4AAm4;EUszJ4G)IJvC|irGmF*FdEmjY80<3Z!wgI?HP%f{
z9iT%qJs1{)OG3y{KZ68FKU5qt;&2!;O9&FTZkpi$kz4c;WDZ0R(-M#vNZx~C5x8?!
zKTiU@V-+N3RsU$ti@GPfD?At$fu~BKni4=_AO#)_i@<XbHFXjJA(<?8;ax0t;2rOv
zW8!P1D=cmP{}0t<vD4sW_~+Qj#1TG+#SWAfejQ{e00jbQX1advBM}dVg`iav;H_Sk
zv1}Zm>4cd!>>Tyry_R91y_WOAMJ-5^2g3qzcThtaG?&k$QvdRIh4o!_PSE+&9t;dR
zvtKYUIL>AK<H4{1yyCgj?*IQ<nO~qyMWBX$2<T9@x|h2vI^+KTxBmD4zjX%#Bj{f8
z`s<%7>R<i<FRatyV$jp;Vwi4h$t+fH?hP8f1}~Tcg`BMu!}?mApX(aEyb3@SrDGEl
zgO(Hno8u%V3y|DIEuR_IcR3V5?P(An<QY(4&D8RlW8J_Y=fN-^lxr9?q!?K0e=w+l
z<UAPWg989`oGB!b8D&5L1sWr&_x}Iup!dHNa140=O9rpX@nB$Z067MP8*MoxKvlkD
z69Z5E4@L!0kD=3+1KiC8&BQuRVs!BSmkh4kz)groMh1|<-v1wfXN5X#Ib>=z*-Id1
z{NM5l)V@rB)c6(2?2HelH+*1HoGxj`EDu>%lQidp2g5$_FahW|5Re;S7~+|EV9$Uq
z?S%5d6Yh}JiGNWB*uX;!$+tlV8LssH|L+ATut38Q9t?BAB?QP^i=??69t?Xyk!i^Q
za-8@7{{|ol5VoH4|3Bo^qkoXKS`7?x7D;mpJQ((Zr?{Z%8KwtVGmB|01P2~S40N_D
z=pay#85T)%H9Q#hf*a2uInZkG=@YD(#h4a`PG4coEXTEAD@Yya!q4d!teG{Y@0iOd
zP!F2=14S}ux({@YRib7C!$M~Urce(S4NzAGG`|b(Oer#K01f$qDrJx{FkI-x0J@p5
z2UI)#UdS-x_d|vimdXq~pkt^OIy1095*I@aC=ppd09{D!y8v`@1oUj-dWMB@3@nz)
z3@kNVKS1LgA>dTJ6g1fXxdJq2<Ng0zASg9~4i*NV0JV@|2B^RG8agZP{r`Uk%rPJu
zwEGEU87QTC|Nrl?Fphx@;s{324QcB^XO;bKWSC&-<<emNpq_!DHX6K@V!fpo#AP7O
zmR?>RwK1S93+}73fgA#LU<a}TLC1-M&O`xK`U^cl4FJ&C?Eeek0%`H<3eb779t^X<
zWBs6WWWg!7iJ@SjC#b#$?PP9Zn4-hQAmiA?Afv+t9>R24=*hrg=>=+u1c`t)`CD`{
za9LDyaDa9~creU|%;!L^QRo1jgY|kL18ABByhgzL|G$VvO$IKICqQ}F`~UwN7PC1N
zKy?JvF_4zFB4`Z?14D*m(|=IG0AA7!3O*19TezD;0i*$x_Pzgqxd?VWWX(Xz>qG{y
z#h}&OuqZ)9$KM;!%7?Lm6;knl(#CWJab}6>Q|y?X?B*V@NSZsNX09@L2;AxbBcs&=
z1~$;hqczjq51?TX4~AXf`UF(l)w{570j;F?ebR4%2gA;v(?#r=wV3AmPIs_pHueNB
zfZcSEp=Z`ZhCWcfvq)t4;lVHyJT~Y3|28;(gBs1CF-MC;h7}$Rb5lWnd{N67v|u4a
z5vYLj{(tY`^gZ^>T0(QcHG%iPIA}Q)J9YXGduFASNU(E2vFF&tuw{W9gT&@}3=)=c
z3_P&W6;S^aWG)DUo0VPAK^5o_F=S8$G?*eK0-4M}8&qKc531NRfJPY@EIREN#6bfm
z4owU?3+)(GbT}DY9GVyu7TPf=>2QJ?gbX5`b_`meh0dUH50JIq|6(1d-*I48%i95&
zrjr64r27xtGpky{pkUPi+SD}nga^ZRP%*^d!2nt^brbAWP!L(nV{o&oW6<(om<tXz
zkaufJK+9*rqaN#DWcn=t<wVf3yt<Ux6`<o4JQ!xronGL`EGIV|Ts(q0+90=BB+dQt
z)0%;yKJj*i2gCNn>1!OBV<vwHkeP1c#O%g2YvJ@7CuSw4S+&y_I5A5x%}SiU$BDVm
zXeM~(13DiFJ_o>}<*9%N!)(av8fK7(SOqks8CXE&j6)-<#`GFzW|jI{xmP0fF`nyc
z?Ov=4)nc>L;9_ugY-BXCbpqX=E4sqcYl#fzmU<Qz1_tIU3=B*n3=GUmAT*d=f?$LA
z1aZ9xi5jS^zMeS*;s9n91_q`l3=B+1Abf%@hdHE$fq}^d6mdFS43`|6m~}KjbR)wS
z9WI7g$0nvXI$R7F9hw-PSlTl%+AA@vue1Q&Q-5F`Xg#KfH^V~kYBf;m_)+P%!m)`#
zqh{ZMbry3Om_X;*crZ){w|r{t4y=0_>9+!uS!%gJ(RBcHpgdFk%U>cj@;4kD8~&M0
z-{8t@AppAD0aVrKa4~=e7Hy`vGRr_NVNq~pmZ%50!umf06KJHO*3M%c$N-S*VHjfA
z-yZM(|H1cdfz*Q>V^PB_2G(cGpa61M&Au1wJQ${dhf_dl2egc|*2YU@rYEx)hz~Ls
zG$w%1&jiw6&s2$O0JzuyX+Rjjgls@bqXz>M$PlpQnhXjPW0)9V4)^~5Kg2SgfvM7y
zL7`U8W1Xc2sKLnwYH+eUHZsnbDZ>Q5I~BBmrvBfLb@i{<K!XJT6{f#&W7g*fFGz-Y
zywPL2mOHbo<`Gc031;EU7zQ>_NP!$NF@}i)Ve!8?(+k|0WraN$m?p+B@gPa$Okd#6
zEUOKX5I~YZY{>o(TG$0y_W-hfx`hX`dL;ZzaFFE~358)EqyeYQ!0@BeZ-ZmgUkOk;
zvEB<xC$B_27^Z+nN1*9s11z0*|Nrx0dV&YDN<AoDfQ|wNHAO&!3ZOJ%{eXeR`~ROS
z@M;IVcY}ce)U*K&wp%KgGTJgRtOreQZ`ANV0;(JBA2F=AImEEu(#vlJsOe+<-~V{0
zGLvY>V<wSM4K}+O&-{<+a4>+{+7gxwCX6<Z7}i_AVq{U8sqQ~r+LJk!1LS28o?ha~
z+|TRMX~*CUYI`~~G0d4R;Ki&_4{{=Cf*j;TPz`9Qz~E#tk4X&NTLxW!$;hx^rakCH
zqCRjV??od+K@I2{&3e$xB?IG3dj`f(RW>^hhDqR#ZKpj0Bk0I0khd*08JIx5W|*yx
zP5*PCb~sziV+PsbTk!+c5^zr$k0s!C0X9p#|Nj>Nt=<+<fKB6rmVSZ`hX+sdKm7j#
z6w;u^<8&EsW@%aQgk&wJbA{tP2A*1biFLJ_Rw6ZQ9u5wT3>wotyqRU{L01M&v}Irb
ztud%R#-LCuZLqH9wvh-V$Qc=QI2isrHZhz4`3cmLY^Y^m098khO$=W^tyK>O2Jjj?
zPy{&6V|d^=4P=u7#3s-kTa657DpeU2EM7vwvNm309q1U?8jb)4{VoRA|9V}Zs^tHP
zdeE|x$G<DQ|9|~!X~)0_I+PpKqyc3YP(asOd#tNJ`AMWk?tz12!~cl-!;dOJ7fORx
z2~Tg3ViK9&;lnHdUXlkA1~tfEC;q<yN}@H%>?PAL%w(4F0d>|O2K;;B{r~@jj%ASZ
z;A@T;SNu50P*77ZC1SCZfyskm0=S-gagd>)(UyUs(+zYn83R+TW{?Odv_M^k=>q#0
zMW$QGG6~i{VptCvodKtr1&kg)6n_U=|MvqQ@ngM!krC9*v_HhK-uj;3il2%s4?Gz9
z!L=(WD_A-(uz?y^Gd=vSHEM>e0A-2ItNgBj=!sf>H@yF!Z3Trbs96ARIn^<Ecrf&X
z*FRb;V37cg-q=6}O8UShKd8#KRA6A-ypVAdc(+E&Qvr)QMv0k<Of54N84G7BGM3F$
zWGtSk$avO+q2F`5PY|=3->-ufbqp#N2N;|!7BIM2G%%WY|9=ABNdj`5#e@I<L7uPx
zjdPp~SyS;GbZ-Kqhxh-R;9mZVM3x8Ob&v}{Vi!`U9|&SLumL3*P_73B4QM%x2g3|-
zV-U1d#)DyoD%e|!44~x`>%;#y$bsfY>;FqtOnw=%V%mJr$liKJj>&HVIH&JD$;dN(
z>mEk_dQiFt4Sa$0g32`eCWiIahbAqswhY+-N{-fZ{8oU@IRK6LgW9T~Mx}KOI|u04
zuI75i01t*vaL|FoL8H7L44vS;QJ~-k=?7h9@OxF*1`ywR0Rt1LWBXIf56u6m<yXJL
z`~TmGpx^~5n5h-E!~35<*i+vB{J>2;kOuGnr@`a0oi-c-pt&{uPSEar1`Wq~j3M6t
z{J={zz<H?g{}l~cP*;P|2DH}!RKGRagQqD##T^gGj)__!YZ~ntz&&z@rs?1OnMLwC
zA#GrAAAkWgZN9!yGi(p2%mdxl3Gymfr#*uNXxzEcD`bsDJ%hu<cu)z~0ZvVzLKIx+
zf)=|cFfhDi_gnGO&2Pg`b-xuq)%-U6lxKAK8PDheIy!Cgfh+@duz^}()7J+ui+go|
zr|%)b*8$Eapyq~S(|;R~m_;M#D)R#fUp6tgK+hS2ce6p}g1U~=A7nFYx-VoX0F5bv
zf)2DX%lrQ`@Q4N|h#Z>!F9D@Mm<Ju2{vEMM`2WZI|9^P7Z;|l-ulN6dKc;V3%_KYh
z?gB>kdQhbT%8j6;XR(0M1C&dCDE>|a<w{Ua1SMu@ZoJ^Z&;=g10ELIe14c&BMTa0O
zK@Erv&-|`{!U~i#XR`ZU1LfG69{vuH-~i>$6X0qTHFtJJg4aQV3;`*GWz$B@kTsy3
zI#J8-fd@kuxE27Z0q0l;2F6CsumhG14D6uX3TkYFa_>w>hGjDunOY_)G8K3*bS(ts
zR`pOx%*^@#948>-Kz;*dREq{ikA|0FplfQ@H=GPv<Ng0CIHkTwWVwLItfwKJ4n>v)
zlP6><K&Hh(Q{tc_GP9&BK=}w1h&6j57Zm+a{4NOgPa;dlPe)D#4~9-~Q3hSE51JiI
z_?^gc0^|@-V1WY8lEZHW=)Stfc+l7as8_`n16mRD`yj^y>-!9Eemim;u+)4iV6lLq
z9^BIa_3J^~={*>_!M=hd1V#-@+y5dK3t2jTH*#D6^@c%J16ZvMXh`k7CrBOWbni|@
zwz;6(;Lyb2(y7Qc2gC-QjS7m4?o(kqbmTyJj_HJs9B73S!vfF&298av9H8UW*c_W!
zF1&8!xZuIS2(C;lZT|~^2NsWj&vPr7sK~LvgP{Z5iiTRm<k-X%1Ip-*O)Mdxxk85~
z1|N$93=J0h8FDNdITlzXf^MGrwi2?%5Zsp0X#k0XPDTPv=(I4ffF?S<wg10s1^L3E
z=|B7;l-G_N2VN&~oB%oM^+ApYpnPMY$njzNhZ-h{=^Y`=Qc)pmCfbJW0eP>{{_mZM
zT44t~7+S!i)S!&%(8QQw{huKRlrTIPn!&XMM4TBks>lq|2P(>77J&wtz!t$RF*v};
zGMyuoS+Kr|VLd41CwhdenP?NX$Ah66T%3Z816?K6Xag&USUjxnGvt8OdN4GD_cDOg
zI5aUG067t4CCHiJWa7lIz9BPY4d}29kTbmhUjUEyf#hCfhHU`p0}sl`vh5IXY-CXY
zo$(1uz#a_kqSIG|GAq?z0FOa8B(lx${(li%uYl?Y817VL>4PMJzh@c}*(QMU6{tY)
z{{Ns8qy`kQ-v9rd0kJ{2d2iSr&_VGIP5-8V>IsVl3=S66>>M5p&EPRTki%xL3<YgV
zfSin8584d7pFsx^)n5|5|NjN=TLc*h8X9nD`Ww&~&mhpK$kqYM7}mcT1Yji-C}KeE
z1W>5LLdJuk6})H~q?S+{q2BxdVepy(crjEBY9zFR(<nH%g14Q6R^zsUi)&C&gF|69
z8|XZW5>VT~gP|2%-$TSXBxWCESY(k1Ds@`HqnsddP$@n8Aj7iR2N?@zA7m_>eUPzu
z^Fl_EO`8`oInF-Fcy{(dhO-vcj1nFUt<ztJGi%h}w5UdJR@{Qj<AApQAAl^02bETc
zCdGO1M#UG2oC=`u0Y$X;|6|}v8gz(0D11N>21zM@z~=~n)L2xrfrjN8JQy0mgR7v*
z+}6pGVf{?4Py_G(f53+Vfg%Hh!Lf?a&<YZRXn?8zJH0xLSw8GjA}BXHHvN79i(Bw6
z(ESWL-v2+jdjJ0oKEVg19fZL~FfptLxes(==0uGU&?TSiCu%@S;hCOcJG}q@(V2cB
zf?25^Rc`Xhusse<3|~M+3MkHJdW3AS)cpSsx~d6uRW1)?p9>>P_d%A^AU0?e0Ic4L
zVg2k=AsY%c8UBKbAIGLYHkS4bIp7I@8_-mDJ-9sr$w_|{Kx3j7^>F_;fJ<<2sy+!0
zD+Z8fU>H>NfQlUN|G&U{3&3HwfWcv+BF6?uu4n)^M;aA5z^$a2TA-Zq8+=$3$P94g
zEMVK=!O#S*6}|ue25*f8kNtxbSTwTDgBVl?&W_&y|Eqw+VHg~<jqLM080x_LrM&<D
z1|9g|U@@OT2coYYTn0fs0Lqq6;2lsl1_qEgs2K{b$`t<#HmnRgQLCy@A5g2gtN>Il
zI5aXefZD1cg&<3RA7psYs2O&~(rF&Y4@O3Y+PGlQHZxF@tfT%(SP7(1n+G0c1MMOL
zMc3<t3=crNzd(%!P%@qTBJ2cM98`~TFfW_v5q1W&WNxC?QwdNvG=U)sG9nAI5L6j9
zYCe@H)MEY*8U+T$6X^VEho=8IAVWbKLH$>l=31BFikhWipjA5s9t{29wdI|lYrz>9
zI4l(z3Z_d$Gi&k9e*qg|1x-VOx{WIJpl%|pT?B3;btzYXH!b`RyHK+XQpJNxBZ~!$
zpc~jg8yMDu=97OqGTiuakl}%)X4nbPN$DO84d5~z6l9H>;TNF$W<aaP*g&b+gFy~5
zZLGww9+bPmv$YKjnLICEhTi~N@Eo+PM;^RO+fsqS1hmu#v`gXzC>$5CU$kgo;Q5gV
zYDiuKm*+1M844CEGTZ}YtLmkYji?)y8Mrn&Gl16;f~I<3YBDgq^kiTFE%BdzK$}T?
zdVCBs+w_xt%)-+jOkm~#twmoCwj8|uf<f@5X7~+@1_p(Om!Ji#r@&)RmI@3C7Ih3V
zAjf$B|L=qBAW+5V{r_t2^a}~hlG9%<WfTD)&iwHI56}cHe6HT{{{>K!3Di{qg*UWI
zu4t=}p9~7~M9q>^(A2o~|F8>|3?<+@A3@a-$YtQRyAs3tpN@<Ipm5*F$WQ_fb8s%M
z1FusBg*m7c1ciJ3i>z?aNuw+l$qWvTO-!JreQXX*%qkuX)!?QRC^>*eRlr4oHK-`4
z0ykJe$*z8%l!&F$JPEKIctuPVxE8UrVU(!fD+O6lY!21~9u}#YD<xv7!e9nk{Q+9N
z?7<*Y51u*&xu^kjjN$?YK~PMCd;*GSixvhxi{}gqpeb<=1{rX<ZfV0{06NVMq^Cai
za>a|x@Eah<doWai8^oYKE~p~_T5svWPz9c>2Bla~&!YaGmxu>L6*%L8#OfZ`@2-F}
z6sy2{rYz<$@L3#Sa0N+PEMUJ_({c%X$CdRB2CkYGFA<PKy#HSYZ|4Gc;+PoLZ?s_G
zc+nAl!=i=30XiVm;K5J{?h=6a{H98S5Bdh3lIg)v3y%V@!|Rhl`+6(EH8sdmkjp_i
z7vj=NaK%!eavQuzA5?5W4FTsJkXjFhO7Qj=u-?U>6$=cEP`%)a8Z;;ZTF;E67u<%g
zU;MhlgP~Ft+(-mz2JN!~SzK%9B?8HymEi6uXlfnRfEsXH3A|K76|_`>Q2<mzgYpk#
zsl<cn2QD$2)O#>gK<ZpYh62<CQ~@r9VF{>y-s1|?L{tHGxn&Ha1Zaj9Jmnq^n!l?6
zyBt&~TG}!wfpUPw0S1Pb9N{-=H6Mw9(hR7i0FAITykLlx2vuRR1En(W|Hr^{B$jpz
zGN6Rx{r_)^2SYhHvw}tvKs_oChH~(dDo{uyFo2Geo+kksl=EOH2X}8k;ubZG5|EH7
zUpak60<$`!A~+w{b25MyKP7?+;g_0E6+qX2|43xG;Ml}y0IL;1mnr;iWM}~I$(pBJ
z@uD;Q6(|9N3WOhw3>!epaA4Wg`~Q!r-v4aC>BRe=HMmM!Xve^@P>zAY<`KjCS}k^y
zjqKr|VSLb5tsnI|T;S1x3!s`F(i36&qQk|&?9jvjT7A8KVH^Y3f|ubRLS0zwLSC}i
zS)62GtYK3C?Us?rRsa8AhaGf6CQCyNCrFHCN)4xigJUD}1CRqjWr#(>|7$NjBN!%}
z0y~0hA{PVC3r6sw$Mvrp8S25;d%r%&Fafj$YC>j&07#>SBEtgEsM|!(2p&*<^)iOh
zqEU;10hGojYB7M;v2OrhjRn;QQVR+VkUo%lP#J8gz{C*B%3=p9+&0=Us(Jtau@`oq
z7ifKv^*;u#-wW#*I_mFfiPYGCaByf~fpob*g%Wt7B4q0uC`!TUqX9I6Q34)=1=W$D
z{oSBh50C{O3?<<73KidC{g{CfVkW~1NNy<w%foZj<KGqF+*r?01#Xvs8hW5pj-iUd
zg%Rv529PD7p+OIZI&eb@6hfdPcp+!_8_-o#8?wURK^CU4PIhc$P67EI=5z1=-%o;q
z8ys2-89HDg4GJ;PF|N}Cl9@&77jlKa0hzc_EBu}H9|n$%;JYvw89-hGdEJAd0z4`V
zvUwpRLjkDphg7;uCZOfB4oyriKzckF#K3EHK<Yq6F(^xcieiu%77Yx%)^`{TKt-|#
zgBUmmSt>A?E@WhIE&$bcp=_YVS>Vc-7gXYS|33>}C<+?<w^d+Z1+88MRlYOj7<dvj
z892ZNhnGbI$h#Bmrt_sR%hiMK+OSCY|HJ$LU-%|JP%7-SW8l`{WB^U0gdpYukFLR-
z3uH85U|_UiU|@7%U;wjq7#J8;pltAQ1D5U#j35t!7LtK#RM75*7bhb?Exr2njq>3y
z8eT?#S_SJTEMs8U=o$WD!9E6-T306#ORxW5YPc*ws~f=8tM~su;9c#YykE-!x@-Rb
z7mIleJTEezDu7n+)g(KKcrcWMTOc3{K@0goo?Wmq{EhejuV+DG3*{JC8vcjBSm+u4
z&QhcP{})Ry25#^;J4XP+MEmd;4vmZ=3u72T>+Tp5HUIyIEG+)BpwWg=2i*K@`ZEO-
zLKX@Czk`nQ0;P74!Js^goaMa#|H-jP`2W-U{~r~Lg#W+1|NoJ(NcjKT`~M#iNCW*3
zk3~IrEbI>pWQ^?hACN(yViuG(KxqNm<WU5r2kScwGLWXvL2%l#RA5j9r7ciW@c#c7
ze(n#*K@EQxb#&OlBNsdxEDVeejsIF|z}pV~M}R^El-j-jf7uIKY`-2<%)R7{U}$s?
z|Iw%cT4}<-IMF@)2e|Oi03Av4dkLueooK`8;{E^k3{bxb6atV!;?D;V+x!2Y7s%-m
zRJeHmKWz&xv!{E$VG^2tI*pl|GlB=?#R-`a)9<G-+t)`hfN~LNHQYq4@E0I9$n`&J
z!*75R%0#UQ9#9M2qG@4(_5ZLFjm(T8Kh+`SvP}}h`U%S;I6#iKSim~PB02oQgyRt+
zAU<elaH4wn4-k8zdKh?g3p6G^kux0JMBeZ${Ea2U|Nl0inShC&kRo&<d)OIJ;se)s
z4h)Q-;&7rz_!p3)K-t`bp$Xi&0XfhjX`X@y!vt_!0F>n+@%iy0C}I9S`BcICpD8%I
zdjB&4S7<M7!*9IEWDN5D|E1T10d&a~1H(&uMgbd$;3jZu=w&>kMWa2VPa_utLk))q
z=yuOFjb02a;G2FL7`HUqgO5=LZ4=S({%7)adPD}ZeEpW173?ND9H2UdVatN~j2e*W
zW{?4yAF`Ci4r0ZpSg`S03@qSS)nZ`r{$~nq&U^ne0T17T)I-#61dj!S)gw8_q49r=
zg(AZQONakAKw)H&@c+gO#_4RC%o2PN0-!z*sEGWj^;BWHPA0QPy#@!UPW%r(sMjKC
zo`nZPA2>`9_Ix%4+W~UR|No!_11b^LgG_43j1T~whYd0fQqVKlfYJ>poI#bj_x}&z
zAhSqXD&fJ<2W}vO<QqD}e}LBSJ2WwHg3d!<-;f#pV)}(uj0)f$#dMA=W-UEb$AW4<
zP?Ul&Xg`NV(!2x@hF);v*Zcqfis>I#F=~L%Vg_{*Y93ox)cmuq_@VgE@kb-$j~@$}
z7=9dN;_zUo25-Es0q>b-vZ+7%xdK#mc`)RG$Dlx_TP$E;2jydnrg<wo7;?c&n?Rle
zHP=9MAP!B8cPtthqCsjr7;?bPFX$2}Nr6ttx~FK+F-;Z?40=#SyweS`nZ=~C!On%$
zrA*+3prFnC9t_!crzd1Ht3~C2TedF}nK&#CFtAyGPE=dSSm6Et6u5H%a)e_Oqri(s
z#vc}mj0GMH65wh17l}*^7V|*oujYW4PC@Lf1E(4bMaBd5i`lnKKQMz)vc7>K_ID%W
zf}e_v4IT{H;L-`?a?r8HFBKUZ9Ge(dfO;(;NBvG@oB>q_uKB>~ti3Cs>ekeHJ_rCi
zB$I)$){A{h{mH;}9t@)3_8HWnI$(#*201Jn+_;c|xU3dj*}qO?obkGmaRIUmCBV@S
z9>M_KRcVnlKf!~c8$3?t{r^AsfB{epfiS3&gs7Rf!Gob2oE4zPgL`PORfAA96&?)T
z;I6ax|9{{yD}?^}8XgSY;8=v{uc-%*q<R1U2Ofn&D4h4egP|MT{D&$8_fJ4;#84eH
z-@}8U3tYoP)qzJ6K&OAg)LA6WXYgR?0+%@;H6TZNFw}q@_&Tv35-{HX|ADJzBnO=E
zVCVw3d_kH#7;0oe27&_7`~P3?DhZHUi==rEKnp(MgEg$+mUyG3Dg$TDX=Bj#YL1#0
z))kJ8j87m<2JsF{uk$XouscTTHJO+BHLxf!Ffi<4U|_hzz`*c_fq_v5+J1;(U|_6a
zU|;~<ZUYV>kRw1%dP@ZZ(5j^hP;m|_jei_uIPv0m1Q$sD2P4CTiQqabLc-!PgM-DQ
z`71zu7>fpm0MMlf9t_jKQD~9ye@6YwM1~W;UxQo2pw@E*sKByNWN1Jx13-paIv6lp
zB>bNVlCxBrKVhOf1H(@>1_qcqO9ul9i-iB(5cvfSSmebm68`r<<s+c-^~eSYTO|CS
z09D`sRe&rnWRdWHB2-=hi@cyk!v9H7c@8Y{0u~AXCqv}te}Kr>Lwo=YQqJEG89*mt
zuLt=U6r`435fb3wRA*qYI1CQT8>m4!6_WK6{!j7#|8Iw-Dg(a;=q%|*h6Wwh|2Jy7
zltD)b$mp>CzYdz#(P906t!6R%7Kf&P3&3{PD;S7@ECt0Q$U>0C7SExUYJiS@S*QRm
zVE<cJG@N4KX;=li`KS_{Yb+A}_hO4a@Bjb6=O$RHGVp=S1DUVE$-rW<Xg+A2{shNH
z$gwPyn(`j?mQHI8YF2q@St=NS8prE@CPEIbgD0S-1>nR3NjR0@Y-5q|e>&($cCZf=
z3`9W|fII-Q4CDz^4=nfq_rNL!77qqUuihfzf1mgN|E>_1Dj0w+V+W^Z9ER*bGK9f{
zp#l~H{h+%Br%%`eTE|etY{ZncaC=S>vlk;{#PsdO%*jkyjnidHm=z$)y&OuIO{Pz&
zV-f@%@d$D~=ms+IAQxzivkG!q6sRX$Gg}!nsHg~9C2P^bAYqZnFu{W%13b!XY0to?
zp~?Erv60yad<@`1h7+LH8b~eZNI>ho5gFhU*BcoMtZy@DSkGqQcqz@m@zR<>;AJd>
zz{^?&38kNm;G@|(z}txu87e#&GFw4DhZN^b5}nr5)k>LF7$c^8momH5gA1RUO3>jm
zObe{%LN~kFovr|lgL^P!!0RlBCdLb(DHM=6WK&B9ct8wfu0s=(PNOB8ME$(S;K5*r
zCMFq+MurKXaVZZ5@l25Y-v5_?2UkEXIM8-7(7=mD<#fI>W=>CVe-d<5EoeB%qLRVP
zgCPxE^iKZCCgJ^015)(<QwOIJ(AhuU|I`tdH!=l)Eb{)pWbO2XGG@{GMur2RqV@Gc
zh7+$3GF<RrVCZ>K&A{<uHfZ0b9C)oe^wRPiP&>xDGoqlz?g41$a*X%?CE&HX)^iy&
zkX@S4(smc*Yw!Qdz?C4}v9(~wf;&ML`x*E^p<@7Y4XB6Y{eKyFIPP^L!vUCMKs&}j
z+i5}TIY4J1ftKM+S2(~Z0`44utN_LKi_VA+4~A55tEJN#yvI_|q3Q391-l_vRDp)a
zy#N2Y2x){cYHX-x0PPS0Z-xT}HVDHbOZjw#2SYmR^cm&MR(7di@4-$i1E~XHG;>`y
zR5NISHjTbkWLN=`hxuT-Kn1g;IB4Y%C|N^qiL^*yQ}AHOJ3HN>f>|ss1>7J3c><II
zKxZa+Fr<K+YnBSEjG$#F8!Z_mJs4!c4H8)Rd;k9nU;hAVi*B?AdFam!kOM%LgBq-$
zAe_FXg4y2Jup=3^(25a!_vG(Hh84dX88-ZW$Z+Bp=nhIoh6%qF8D{)oWO(q~kzv8_
zg$z5a9xyO~R;}18FfdxP{Qqa|0=h0BBX|0RN@nr;6&?(6;F%K86b@|Y40J;fc%07e
zM}T7!!+~0Rc9U9bb`uSG2A2BN+ZCWA5<M6a!0EgCC4)l!y;~xnyOn0W1RseBJ_Q>T
zr5+4f;5J<i^9hHVOt%7u1_p~-i<j$as$Q<^r~`Rr`n*bJNzoe63PTNB1|f&0|1Kae
zzhGo|FufrPblWBe^Rm|u8BSOzGF$*H*@M-N)}ZDk=;AW)LF)0~={=B@vmY{)cre64
z`1e5PL;d#v#U!X12|8#MWIAX`4ZMB937K*MMaYZHhz^kXP&p7aU49C)Sp9tEikf}e
zprT#?v}Wl?BEyCkDGU-XS{M|(|NpoNDhfawF*M{D)EycbBs%RODHpWzTZfau%CU(-
z1yo6bI~I%#0w8~YmY;#9Z$PaBkex3Q88(12m&N@5HXaPZVE2RcfYeQ%kSQXwU_S#3
zNRh>S1`Y53ThSG$$bd`VhyQ=rIwXKE!U82Hi)04yAq><1R5Q!S{CEf|6cWKv@}iLe
zRICYD)PoL#Ni;-0cF2&4XL?EvvzS-{xG=Jq&%kW4fPvW}k)hUuA>r)wGj+^TObHvO
zuc=`+5U^BW{0o}R0L`XVYVKf~{-%amNh|?eWLeBZ(P;_QDLdVvmf4OmVtRcov#AVd
z%_t}YK(PeFpoMxM@#z<8nf2wtrxt>n@b=)-WJD|$KuReOhPZ<X4Aa-CGD%G@5MqLy
zrU!D!4@L%1OeKQGY(ZD<{%B;l;lYpr?!Z8LPYj?Lf6xV{3?2+|U<<&v%r-Jy02QGg
z3~}JGe((Qtz*!jNeb6L?MIr-e-DZOaLmap`1<eJ3<Um1V(ZXQM49iWH3jhB>4Fqj+
zE!e2YQ0>7G2QJW|;sqA<pq57*q<^o-uwc4E9kWV3$oU{Af|kRA_N{=T6?B#Ci+Toz
z7xNi7y#IgM2ug4cO$;ZX3v57ZF*88k^k7Jbcrg=HuQ99uFH&e=0L|JJcre6*w+*~h
zWGJv?sBg4%VEkXn(ZN*db%5a~Cj-MzPX>-!Wp9&;&UgminVt;1o$(BOGd&sjI^!Am
zXL>U5d;kBR3CbleH6t=~G{K`jpsOC&ztoJIe!resoG-2c6lI__u%I6NbcYgVX-)8W
zF^CJwccAnRQUZ%@kZHePMr3&Z|Gxmz;D~5o)~|<*+Cz@(P0_Ojor=Z)jj0%LDGt_m
zGNQwA5@QCa{|g$H1Qom<3^CwJ3M6lTh+#b_KU?1eng1`)rio#_Z4!9mk<rqjzOhp!
z4z%QAoz0>D|9`BGn^Ec2!DIv4`1+#Wq5(9v`O`IS0;nHgajY@|bZ78Su80bYIyMcE
z*pK533^P^YI;;;cu>9nTXz>33_oD}c7`SH$Nj}`*>2D7P9<YO<@fG6zPZsPz?|(Aj
z{sMHD6@&LbnUA2P4^~&-2syOW`~S?dAVCiXZg8Z6BpsXn->|;-|374+|Njz)NenI^
z-y+2ccn3bTBM(X#5}?`7N-rjtN-qxv4K2pMpqo=)YBE@W;t;fJ3p6_4*vP;Eu9+A9
ze=%L4i5YZ;-%Q9fo)g1*P!<P`AAnN&>s1jQpllAx3H3)lSNyaE4ZlZ&*A;=}!C4+$
zP(*_Ve6VMPD99j<B16GXTTqhz=K>1WpIQ+eplg>I7#OB6Z(_D#l$`#giP^QjQyE<J
zf}$AIHu<6W-w<3oDSKBy?hTEEWYPu(D^L~S!4LutO;Cy9*u(%jM`6eBgA50(7eH1t
zgN{K51uP7M0s^!K*s+Ph!XlG_(V~IDs@5Jf#Tf$5<kM#~GutUGyx_qQ4z4Ldxf67D
z14uu}K8vP>H#`_ZrcVFS%pAuQ`gM9l3$r}q(diW}%t~4j;I<67NdTU?{xT67j~U>G
zAgHmJ4BCSeF?0Hn7G^y*kTqeY(|@!un=yUinQqX^Y&iX*AG7dun|+M@^?@^0KnGSs
zuIK~V55v|@3xCwiRj#m3TKK_QY2gFwra3RH4>JgWN{EjC42+=b)(W06{CAkg5CA$b
z3bb4bG++X1ctR#OQo$uQXafYOEe8?<&6GGcF$8!p1cK{<PWvnd24uq==l$OST1*=9
zoXxIMjRCR-Yw>H)zCb1qh7|CcGLRuK109<FgO@*nj!Us_TEqYr2VYhb3eGN|fUTeZ
z0ko###`J(TX0v(*$WorguPZE?Kp_(d?i+U6Gq8ZJb^{HRJ2o+Zw>(%MTEqcrA%g;>
z*B*3|2e^b%umG*sJ@OfR3$+JB5O~fS8UuGg;|(B>dN2flTh$=FAihP@A^{JEz}$rC
zjP1;#TwsgA3MTK#G6CBLTJr=_>A?^HE>yjthtYyefMJllMbn%Y9t;8CrXgqy2)r8A
z3e<)K?IeI65D6NDhE!NTCtClH17F+lQ;}_f2SW%rn|S~K1YWdN|NQrK_6}y9dT`Zb
zF`vP~Qh|XRoaqu7*3VRASm(hI3Ta&`FffCTqyQbkkm$w01v-Yp(ve})Pc6_m`y`0|
z1q^J^Ds7hsLkPIgwRK>eVDo^1<3%Fd0$T+J30npRwuI*lOo?6$Y>6BU;)$9J))lXm
z82Bt28R{xI!AE}u{d8nF@KcfDg!lh9;8?U!WGk4SAjG6HJ;Rfc&ny;Pc!3J38JY0{
z9t^QyKSB9|9t^Qyn=KR>3P56@LTE;2yb$6Phv^ZW%%b(6{UMAD0-%!HR)K*LR5||W
zh?fAB+Mr=#(0Lo6g4g~K1Itg3xC@}t#QNS-jh|X^pd<7ZEgcw`KzDP2wzh(XekW=@
z)$sl&3ND<z|A~Oz4bt!Ze<HZk*k}h?aIM`5S`^BVz~eBFK?hQe{r?Xdjg*)!(8bJU
zCIarig40vu|22?h+y9S%rZFJ%CI35MsR2Yo3}9dYUkA<ss@OqGL8cdUG0WA*3xFHn
z$qbC3p0D-ZxC<T(Az=4`Oa~nr1<J}goDA#^O$?yv4VDR+Pc^LX{r>~53mO@2{BC4y
z`0dD80LmGl-I~7>87n*(7;1Dl86+H=7(j<mSvxc_G%T)XV6vFczyg{h53gde1MLU*
z;Aij$ciCRdW$;+=pMhz*LpQT%eJ5zG%>!_I5qhLmM0hoeoplrgOa1K+0rmeci6FVa
z2DCdxhm%3vv56r;14K9euUKf$z!a**Vh5TDtv~r8z|xC>1*E6`e~<{s<&KU2&%AbI
zEO?#BSn;}%vB5%-aRI2U07?kckIY~cneK3hktG3S%!^tE59@mHS)>A>atmavMKXf{
z$Y_wUAmc&CdN2fnJJ#TiV9M<ZkZ~X@z5lNU=ML}x|6L%~{QnQK26Qm@^oDL`k?B3#
zm^ka%KocWO%fRh0P%ceieFw>%{|kRAG92(=fK*<f!V0tp#!>;)mSSK6%}@P4$k0%!
z*}?SFkpXn>3?FERuJ`|U;Oq}NqXIhlY6WhvG=PqRd=H*suykl;uvB1V+!)VbX0p+q
z!Or`CUm`fgz%pq)Xh}%`c!>yjmBx|J6)zGQ4p=N;uz;=7kl_KPU=M~^a8WgV&0J;)
z3D8s#*c{ODzD<iHJQ%XUW8Bj>%w-k<HJLf5=hiawv%JWRSDG#`g;`Y^$;Y78HlTH2
zKNUgUhRELO6MC5?>%o@-_<@H<7RoX3b^K%C1vMo>!C<|gfe+N2garY}`x_Y<>SjD-
zsP+E;23+={1OupCZvge7-hv0CEfv}sKy3<eMPJWgx6vLn$lwocM=&yOv}f=$@c!Qe
z_8=&B!R1#ysD|<bmyqC~S@IebG@#Cn2RvvvAVCx3IQ>o!vl-Vj2aBdf9v%!?g41Ps
znRTXXEM-)x{|O$O`l-k+U}?|50cziXmyv^)9Qc9@F_4uO^BCAbImd&+7g{NTkEm(~
z9fPgI$<X20#0VM+Y6JE4K(|r-Ze%+En#!E0$hKjlBHNZ1^$Z*@=7R=gptk^JN>_qr
zFdXZfm=7$pXV3!`U6x*P9TROBBs#em7#i&v3?|wz$TZqBm`t=`P*{AQfu+-)K{t?-
zZJ+hM{~th^Xr>keX!`n$^?%5$A1KP9#Ra2d6XOifGIWO~aF<8GVm|18T($`w48Gt7
z-b+Qc36+{mF7=g~9t;|qjG%iDG8*F<I2!H2EAv4!gb^<i*(SVb1g)fo97j}B3+`Yz
zc>jL`uH`{x6zJ$q@BeSXeJRK#EexRASHq$f<XazbhZR&OdjEe1o~;6v7NMFF7NBff
ztI0k+dlECZ)PE09;Ry<Z*NtokCThhifVzSfifj)cr7oy2sQ>+tZ3d{_Z+-v&Cs10k
z{?DLck;t~;_d&J^zaN4sPT0LyY#UxQf>xQbf?HvbEX(-iMI#%i_s3?@!ocRi-~*m<
zX|!jP0M!yR;~69&?TY`PEUW>Fb8tHW+)nWZ?QC*nXxPst@gk930GwEtGVnnLy}H3^
z5FFX|Y!cqk*+x)YSj=Z&0viM#tni*XJz^5Ge7%YH|9@{l(lBh1!1~UEArumV;5k0V
z1kl(hxM*o)I{->2-v3{KCtfTbGJuY{u>uz<4GapPhN$&@20QEh3<2K%UxK?CmWp6C
z0-)jsl$Jdhypi&f6oa4l{|=PA1d1LH2Cuu*IVLb01$luRTi*X)fYS*mph5W!WS9qo
z7kD<*`+r9&$nhY*f#tv}(7eEX8*pB1d0YVsCyNCPh`d-2$&2COdLI<a-v9rCPxS(s
zY|#ixnato)5i-d4cZLT86L{Ll`~Tk_kZmxGR=8DoFr<Rp=idJz=YN2D%P;nWQ~L%F
z1_tnKV@-{8J*ZX$TL4-#0UG3C03CkG!oUErkO8z0W&KOdcnwg;z_E!z2h_p<Me9qC
zc!M7q@diJ#7&Lw=GiZR4Caf<Daug`pg2aDh#Y4J@S@8zQYCvUzU&HhuPe!rHe_}c1
zVeP;K1_Njf)A*y2VaJb!;0D!(={{4KrF1;NA^f6|VFM_XAz|kMi#5;*SUVu&2p)Tp
zMnZV_L5(R;6$WZ4y?z-#{rVK<0LIqo8dI6m7~`k+Ph}2>h4~ZQ6GZc;!;g%3haXuC
z3O|)W2WK)cV)3WKkF0p`X*55w;vLZaIX%FWQDU-9roi-&Y0O%TZqw_hF^fyOflGlG
z^B6$O@<C%y9H8T}JQ&=jub;;3&KN)a`!wbN#?a{=)0wlRAc6Q(E8YMcuv!qyerm-#
zKn(vA%Q5}UbY?Ne`030un6(+>r|ZvP))cV<jdvz3T4Bw!2)wG;gTZ0q^qd*YdZHV^
zsUI}T21=}uBVb&nub;u(9=0AF%8<}?0MC+w))9e}StKy9djDMyZUljbpFJ4t!AlQ8
z<DgJ^ZtuVAAtT`n7{H6OED{(*y#KBjoZd5&IgM@64iAR-t<!(ZWVQ-g^uYTcBe*gF
zb*Md{C+v7I*rPbjB7uS1`|mpNju((SK)qgwnd`uL5|mIuXXknUV_Z4CWfrrwWdJDi
zcre(3Td$yX0SKq91($uO#;gVJ>hS)@XgdAJEM}wnMK7%X$9q5%VWIc`Kj2n^Mbe@V
z-v9rAGmb^lq95M>|I7rXt47Uu4@eow1a9B{Ze%F<y^x^-)cmnXS`6M`4B9&E!4L;_
zE=Z5{eg+Qfro{m;y|5GPLHR~!`pVhNn)R{ZY5}y@u}02=!Li{#<i4jviylBcXAACX
zp?Yo&czPYxb8EnB`XFHhxwhSUQ8W0!DUfAQv%oDu6tn98t^qGnMKcWCcmo;c*!2Gd
zq=2*mXTSQTuPYFtyasF_s@~P$HH0CVY@o9Oq8u9;erRwqI5;*kf;NB}I5sgxSS0^H
zACk;wr@_p?A>!D`@WxW}|M|vv1_tnYu*Uxp(>dlc%SEjQ7v~U{+rU!=)N)quzpKF^
z2g)U&U~kldM31HB|Nj%U;yoN18Ng>p)M|q6g;9G_YwsoUA`?_8`%au*Gnd&Xz#{qo
zd`r#$E1*u1bZGpq;QjwktoQ$a;6q?6HUFOgbzec@2g2U}|2V={1c3M;Y>~8>!Gj?h
z+{gnpFD0fc%wrbgS_K~R^#1?v&-8+IkdrtILFwV8XW|MSEe3`k3qh-D8P0$XHnwDA
z-~r8gg2v%qJWrfa%i$&RqBU`W#R3M#+AJrLn&%M#H7XVk4h;-46^q$Hdn+a&mrEdL
zfO=IHD;YRIfdguWgXWe&Q-ePaGTivFkfFW+G?wbYU<V$ndvTEA#*2jv1uq>LDqb=&
zH0Y=?Fw~sV)v5K;5&@n22MST}cqS-cD>6)Ysg<|_WHD&a9(2_1Pp!li=neom7Sz!L
zsRPM@2HHVapIKxvu>53{2JN@917~*7X_}ysPk0S9ed2s(#d=$CA_RHG(t(M|l7WE<
zl>04}7AI_UWN5Qkz*u0B$QCe@k)ahdu=g^Pfdet)X$ww-whGMP1#c4-*+O1sCGG(E
zqM<8sgC#cuOHH?uNJBPg<^?=F5@FlKzycnKdceSFk-)%U>EH9zpi_f^sg}*T0(4Z1
zr56KpEk}?@jf#VVV*`T@bU`v`j7FeSje!|d4mdP1l+>_VI9NPqV03K!e*~nrMg?@V
zKEs^p1q+$Y*!~{1P-H(aUBH=1#%ci@1B1l@2A0~+<O<NbyPA{C%R<;#>=vwKV5ni!
z0GaHtU?qbD=!8H^O$Gy~n2x2_^k)m0m8J_AGO_qnycF-S)MSv+;AFiIx~8zwlR=>(
zOT5DZbgo!31EZ`a*Z_fAw;+*P9WN1!Qw%(oUJQJlnheY}4CXqu3gJ2pt3jh7|6WXY
zILIhc51zC>`2Pbaae~TbP~{1_8{u_k;ttT}a*%kVX5t3x-wZ527BVvYILOFhv6zA9
zM<c_JX3$YO)m|bxlAus!DuFcE7#3J7fbQ&KSOFS&?6hZKs(<zy9;l$6YK`>|2ge2`
zi%?CrdOJ`^g0@Q{g(`SR1avjrOU=X`jhYM$HJmRT92@`dc-_db0CaFC$iNzFa7fR1
zsmRCyYO#Q>>8sZ~T@h}1z%J0zNiNXR&2G9K0|#h(bxoZ{0B9B#d=m|5I`iQF51>(b
zzlJOZg#~F04B&0Y3Jffuhyk7FYti!5AS8puu4axh`0VioFG0Oy3s5A5EO-eHV@7Z!
zae&1fK#}Ie@c$0Xfgnpk%^sMAAj_w3xWFh;U+Kl5U@6B~06M2n){8-+rX@(EQ-y&U
zbaqCqs+UNOrh^0M<a)<OM)1@Y$a}vYGF1F#WN7&9$S?tP&MU~fj!g_JHl#8zSgJBG
zSvxRr)S7!&EM@}@N;7~LAc1lc2%AU!|8G49JQU)y(1szCp+*9<>-hhhmo^NbMQIFm
zPj`bljz6G=mO!(Y07z4<C-brwo(vp*4J?W;92qn~hB-9--vc^86?6yDtA`8~)|L#6
zuMRR4yk=x*c<snA0aQqM|Nmz&-Czl`v?q8|2FM*C+_8s&*`k5rKWKx72ZIH8<ppS8
z5l9Y%VWH>!{~rS=ioO5;{Q)u>bc5b>hiQzUQ(&2v**suWv{hi>v}Iu6v2|eJOnBzN
zkf`p!0IJ4q7Bn!~DljO3`tKDd82Bn)G4NSDU}UIR$-p-uk)eA7<TATC77H0BfDU5)
z=?GpuQ2?6xuykPHvH(r5Ld%4ij0{~f85#N~Ix@`hU{C^8>C?-XGHcf-ZU7|{P}-d7
z%)l_yg@M5`6SR_)Nu=W>16#;ZHam-@49qpFwM1$ZG#q>z7!*Lojb+bM_>?!uvlb5+
zSQc_KFu==$m(0r$$&AqiGnp|efRmXi!~Z)L4;UCgm&g?yWB6aIX<ac>8I%JVmRKD7
z|KF0Ef!R`<feAF;4Z1I)*3%)N&~19yGG+%32M5O{2A4{&>GPH`+i`UqWnijVtz8jv
za{9An%tmY=e#pt`a?6>e89k?4EoWAqzHtwuNc~Ff3Q*DTL-CIzXyYKbFm7OAsDa+S
zWs%7E<EJ7E!;gb393Bj&knW%&;}44i42<C2;-J$^4*2ST)LAMr{;7Z9tK<FuS17pm
z+`!0V$;kKv6rq+54ve7Dz?ugxI*FPN43-RxO`ws^dW!`N(i<6>3o136pI9<5GW>L8
z&ah}?&Pdc`;GFP~xo9FIa~&x5K(T1?khu&rP%)E{xoM&!^90b6W)B8a@YpY?32f2G
z#9)!g(Cxus3T~8J+A~OlLK9RAfMfq4^8|~9%*_)O8Hzj@<UvaeeHj`RnL)eBxIlvm
zjf%{jwVKkP(GJi-^9?W`f>xG;eCYlEXYGrFEF3QuvM_*p&=9e2o)(JC2SCU0PY&>v
znf_u0GcSMR{|BHkIMB2>NCLbpB*G@afgvH8f!q84@0U<Eqxb*cccE+^@BhCqf{X&y
zZWaj)Y~Yc+#{UmGwGt<QOaqw&G7(g~fwE$#Cflc(T8R^;FOX%HkO6h+IyDj}6lyUv
zfDTN1sgXFLQd9mxs4|<~^d&2ql{6D4crZwT=ao9+6TxffKsHolndN{?tH{z@18ObJ
zj8B~Ye<ibGJ*eGc>G1!5r+VUqn*Y||39BE9|1MT~TIkGF2O9<+&F!>LoDh=5W>=AE
zmQ#_bx28~op<$+d;snr1av=R+_4Z)(;BE-IdXQSsd5NG?l^mNGe%LZJFxo0G)brRn
zFuH)|d%?r<4Gav{4;UOk@jua#;m72Mj2u4|89sP07=e4;@OWOxP+$S7#~ML$GN8c?
z22f&jXky4{RAeXvRY?v_3^7nkxIyOFIxsqe?O4Fzkm$t->F*@gGZcU<f?5I|0I+z#
zzyvlNWJx2#2T;QDV2}Z~2SJuNHZg!B8FYIsB%*)rghno-_y3=3p==)S|34RkA{i91
zut>B}WHhLL%%A{@5^w}h&pg1$T@P~e?}dyKzYl_LxB?v^#PGr9K?9>L17p>ML`DW%
z2L>_Fo)yak1`cqEc#x3;?3aZM1sf9?Su7bC8Z1CgeZau*(-Gq2pNb4WCNeT|crZwV
z^9ji54owU*8WkCeG&mU=92*&WnjbQh>Buvrg7bj}Cj-AjBSVFy=KqfxoD6IZjSM-J
zS_}%HmMCcc!TawQ@MtH<PoRFqkF3NUj!g_9p#FqKBSXChgCV$g25NA;KFFv5^5^80
zi5p%oWRw8;dwRkFMhS2U3K9XS@c#dA38*9mjfq(#EiUk2@CA33kmOsY&14jreqs%?
zsWxbd2qe*n*g7z}f&Bl2kwGBQi-7}tpQs}P^ju7<(&-v&nRQtoGVIZjpB}ZAS*9LT
z(J)q99Ar2F(q{310dz2mLZTOg2>9moMut70Sf0qpaAKk(!;zng40}8nB*BxhjfxDQ
zjlc>HO$-k}(S%fTfQD*CEE*YVCMq(3CcjpAFc`>!{L=`!EzN;Z)8+sJr)>fwgH3%y
z1JmS(3?~v@9T*ahIWX8fU@)Ai$glub16H&%@Kvl};ImZ_VW>F8z*m_G-ulV#;~_%<
zsFt&6WLN>J=|DH%{8VJ<_;HY72KaiTM221u27T~sFUV6MPk=mWv5;X8s4VngkOa?;
z2ta)SD*t2}6&VgqZ&}A|CzLn=kuD*L20Z_z0qTo@Vi6R)KNSB@{Lz`X0L;%!oB^d*
zc>n+Kce=rPX5|p1#Qzm3@qYy;e$f0FC<A~JJgEGESqSQ3z&j8OkbUi-g!NK0am9<Q
z#Oce|Gpp5uj&3>l|HBW(e}SMm;u=sjcElK5mDN18t^hUH9h(>&K+Xj%p#RCp*zn^a
zW5G{F#)=<|j0e2`@j-e^3mFSQ1G^553^p$q84tWvWUP2`kg);e9t%ar4HX>>3ZOnJ
zC>erF-i7~P)T(<|czFN+4sVKqHk5<n_V+`^6&4MQ3>J$P&j1xu9t>gNGz(#Cf`=Eu
zJ2Vp+3TnZV@tT#>dp0mDi*5zk{TifQk#Pg4qzBmrx#CP<CL_!A7aN#`84IWX*}&{y
z->AXDz-j3qz%bEKpunM#L7>r@fvJWIv?r251RTqX0u7*=0u+uQ|Nlr7*Z}G}LJBW|
z0&ucUU|{&cC@{f;K@2=m2r2<Ub;b)u0cax+GOhhmQD8&ELV*HMiUEbA2ZN9fcr#B!
zqCf#iv4x^Q!*qd-%o5WRwlcD0fa)O71mN$7|9^mn=|J@nxZ0nqTmh|@7QpKzO*T7=
z1o*UeiH1CbIA~<bv5_I8Mjq5DU`PPDA2b953SR3&Ye5I^FYsVs5SU)DiCLTR;q*D1
znBDY1HH#p4(4;diaRR7w3kqfAYHem*;)K@+85+O`1Uy*EC<CtBKuf$p+jBvaLZCVh
znx+du^%rQF(o1z{1**vg?a44|Xs|N=cW7jspuq*XhS=iK;tQYyq(Kg}c(ix}XaO=P
zYkDxKf#dtdL-3WotQ8pypkaR&P{OQvYAsmd{r~e>XsD}z`qtAg%wv+6ej$vB!{s-q
zA-ibthnmIO6+ae&de>^;tP1MZTQV^2s6YO>q9P4+G8qG}MFQv~!q2%-qo%wD=~ZNy
z05+~3v{wsc8hAQ>Awvb|q=8CK3ms66>%kxZ9^mVgPn_^#AwvZy%w9S&6o7ie6&YqZ
zpo+30LvPJY`9#o~{|<+yf8fyxP?UkPEGUVBk{KwgfRY+01VGqg(c&Lamj@PjFsOnj
z{XkBKInCl9;|`GXEg2X*U<O$<Fz|um9%PvJ|4;BSaZt#B#9`{DH*8}PoxC=a8+83i
zBPg|jQWz*@ffg`=Mw&r=C*%|c@&>5;2wHfE>`Z9NDgZ4@2Q91u2N5H~gctJ@54@;L
zJmLNKE!gFj3JfV02@EMe?Gq1p|9uT!QKF;FP|xtAF7X6t6=b6#!yXMzhG>UI28ox7
z3>z9f8F*|JV!*>)pu5LkFfxGBUcqb7?1m!f1P;(<4h98~13;}Kumc`3tOvD{K)VPa
zal;30Q-GRjApM}YK}pZ?_25VWoudpMngj(rbUZ!AgFzkK>Un9GcmmX!`RU0J12W__
zs3Z4~0lay``~SZ$@G_POvRo9DXF(wf>R%y+Drkdv2YQG));BT8fP(C$ec}md?-I0M
zvfi<gK?bz?3e<u@4sMVGK|TiUp#-r(Q!f@xYdb)@$~_n~z(Z`1G|ZUu8?*y`Awvgf
zH#*3CQ1rZ%OFZ!6BtuNd@dI`hrx=v#1CBe%1sr#?3w1kS7wG0B7wG0@SMiL2ui})Q
zO3hv43X3d;Cp8)p4xm+44h;+`pb;hSzc0bFDKF&{PrTTdcmTAT3Y6p>n;1E2S)9Rb
z1keB*$YUN1YTzOTRP%t-L{{Pn&;cpXG!V-GT6Fk(e&PYpK-*8d#1j@-3@M<2F^dHZ
z4K<lkA|4EC;3<1ht@zS2@r0!<17oEIgObH7h8WQ49<>U#I<;K3I_P_*L7_KY;6I~e
zJqOb=PyzwD2DI1{nm{%{5(tkgC>Ws$WW$R_h8viPByocG|9|lF?m-qo^4CA`$Z^dQ
z?TT7vh_Ai>z5>q{fIRinF7d!m`@|FVpi^SuiG+oL0hBmk3B$38p#&pQG%*B#d~4Cb
zzy{8=FB4B#Dlo95v@|eSvNObhD`rm@omvJLok|Y|zDf=|6-y3=lu8Z;1yH%@{r_D7
z$Wu@}U3@3Aem$sg=LYrE7(jjn4LpN#G$=EG`YSWz6DNR{W`M0#WM}|c{Q_z&*a@Je
z$q)bkKz0Hs3~KQ@<1J$G{q&<dnXN-C9f}xUG_3_6><g_W0$(gzn*eg@i$iO{r@_B?
zv=(%I6bopG2_(LdX)S17ZNZO)3>Bc$Nq!t;X!!Avp<^Q>!-S2F3<c9Ob}?ILDp?$0
zP_k%X-~a^<sP^{${|3DH8g#T8$QX-7O9Y_B=>iW1$hu)$rT_n5EM!<<(ZIkCo-758
za&o3K*ed=13mO@)c)5h3mfax$6tLd^-*ke`37y`sn^^&Lea!k!&BW>cyO}i@zfP~%
z&1}Y)IDP$YW*NqVpquQ#_r3BUU*0`Ep_N&5y5=5c?)sk(|5yBC{NM0P@qY*SAQ(_1
z3|!IwOSDyBRJTiD;IVnYAOq^(+cGqO@7(}-p^_c4#i-I4Lfa>St{+|U0<^LTBoD&Y
zOiL7MzF1dSD=jhjsmSmGBxbc}Nq}|rQv*w-r4H8jo+cVuH!YR0c3KKLB_6!F&QfV9
zNb!Su=ED^p47RNxO`u%~9t^hN*@L>pt3l%6B_`f~-ya3Z>o7AI>NhhO=`}M*gHn#;
zJVqafY5$*qR?ke^%Ph*D_<zQ$#{UamE&LBY-hP@Hv&6KE%mUK`rZcj*fX1Xi!x_IC
z847+SGE^jbIWX8VFfu?})*C>p(kvPo3MMi#bXbDMoE|_nEl+f0IPp^vbbAh0;PgKS
zn2ns)f)9>@wai~8tz7_e-Aksm;7uAo7#Ru{I;{m?4+py5s#9t0CeV=oMn{H@nTiZu
z9t@m!rxzS#mJ5K~G;aYuXnn~J4+b0Xc)9oge>E1347V*38E$$1e?GJ8A;YaMMTXm9
zAK2{b_?tn4f-gWPaaunBZ3eXl*B78ctGXA{=j{b`iY9ctVvqpsc((LnFsOlygw}xg
zppj6}@NM{i4jT<w22O{j|KNLQJQ%FOE$SjY(DB*KEg;{(u=n4$2SIEdW(HGGDdpJ6
z02*>JaBO4%-PI@U(DeTSXtLjf!5TcE;LZO3FE|*cI~-t^tN&k9zl41YXeW*bgEe@b
zp-%G$Xn+~qDgzxK0@4g~lm~+qc$5n2I0ocFNF8Q|M2DvTF*<zUj&y_f-?y;luc>1r
zLkP%mI-Cp!4vqgqKn}Ll{C^>|UX#rZH1AaV%Fmz>bj458e;G>$2F6-X4})66t_siv
zbs)tc{34Ozfd_*Xc)5f3|NlAOf8T(o9YH?VZ)QkzX#Bsxao+zP(54-5Iy%T0V9CJ1
z_`8we$1g`l15nnn19c4@7`5#j7<jA~I55^%nlbQIavop;CAR9l9ZWwJ85yh}G89w>
zG4NS2FfhDSWMr^tWVrboG%AtEaO0OFL&dLy3=NwY879nPWS9i%7FsGWaDi6PO;lvK
z;{E?=Y)2!*4e+9UZ~{OKD_bo6|3Bn8hm8&^c+l}cO{YaYJg6O;{yzatbJU;uToLku
z%?`AHpynj=vW`=rX$}X_2)a(kDWr761{MRSBPWOdD`4szn*QGbooNZ0(WsU7(hKEe
z0Y{}{)Blz_O$&?qF7Oc*|E=dRFv@z>Gq8c$q#zg7YBHFBTvr<(BoeB5vu-07g99jP
zEEyP>XKFDx&*WlonyJO$GE<Ae)uHLX$K*za?)p~tEf%1q28j&)GD|_LV`RXIQPzfm
z%>tS|Ee<kVu~^7(0yL&)smUM@86ac>Cq^C6Hb93ahAoYX4Cg>~k3$o~3h)Sw0t1gN
z1EZ^@1A{}wOYp)`@REMejQd1Jh8@s6zrlk+8a%lQw(KCo3CKt#!v;`k@4>(d9=!rJ
zeH@w?0zktEP&-__|Gs(&N>laTe_w$|pFoKSltLXF8EjrRGW>Yu$Y}8DAY*{{|3Bcd
z5{smz1s)9M;Kiuk|Nqo@|9u7V0W{k=H2yyW$^ni|f3KkF4}jP6LZHbIre*LwkB$E)
z*9VE#+dDC^fEK5K_6#*fJp-L#DgbI)y?*(O0W{AEn$QC^yQ~xb|F85?djgsY0tLiR
zMTQ$c9)gDAq`+%@8m*pzk39JOkAcDd5d#aT;ZohqpzxCG8OP-P&lKzzK@M7&T>DI=
zlH(y0c$CS@$+be!i-DomD^Q?TGr(e^)iVL_e`4Ua95mz_UfMA*G&(YT0cq^iWMG&W
z|4gA!lcB+(iJ`zEf%%2^-&<#=I~-;f6MCiqSuXnw)bCmV+PpD6A%<CFy1@ZPj_ETF
zGs|*A4%1_K(fRbp^aF>P<(Nbjr$0E%EXD-lgRWu|IKs@w^h|BK!VzXUre`YC9gZ+7
z)jtEzQh*L6hct*8K}WN&G-^Im(c%0Lx>Dc-$X?Lq0nkkn76}Z0UYvRczF)RdlfCK1
zs%M}XP8QI>KttElKebxkpo17#etJGr@ct(P?sS8O)*PA`LDx8f?h|L})O`A3Le?|T
z)H{PieG~Yo2NsJ53~ZoGYO#=E#*56SKP(y<8Y~qKFm6-?^?(0{f(&tNVv>O_N&{VP
z`vKH^>eNgG9d8H9#0NlEtAH8}pcOEnt`{hfK+PuP7QIE&+6xv*%M3giOu$3R^-v9<
zBa^_FDZn&<lFf_EXB^&tZ-eK7L7@P0#E-0JpnaMmAbC*od9m^thX;c=I6rv*eGaZo
zKyqNUnNNQ>H2njwsRHE*i>9?ZERvRScrciNJF(vX|JTE-9FQi92MjzG2N<|PlR?l>
zD6mv$VBV+*TL1e8e7_IqrpuR(3==?6QmM($v>=Ot3FNq+TF(?fW`v}&*lDmb|DUk(
znTA6nLr+LDi=Fr1Tdg1mfaD<#dj?wdz+<Vv&%g-kE6mhNyZ}DZU^=5Gqi~F+J;Y3C
zXa#`G_FymuH?~2c47xK3WF8DdJht?O2ZJ#<%Dw;p12+ti<X>1MEj!@BV5~U(!7*kr
zZHQYf5*Qg8I-maW{wD}ty$C9rL4E<*@l)&R5AXl~JQBc83V=GLz=OdETo8h`4#JEF
z(H2c>K~_xgU@!tlENF`%$h#mp5N=rcOar23IfwWE|1qF#PT=cE!GZc?A;SmI)uW)!
z9!M7`{e#ZahvWgK9?(Tdp!5%t10CxB`yj)DhLg`UK$B0+M;MrD<P1Q|NmPD2GBkh-
z9VZ5s-=GVa7BC3>PGsl+6(FxyJp+%?*Zj7wsMJ(@Qoq-$UIem^MHF21f)s%+a<+76
zV6r*Hz_R%uL(xl)XB?n*Hz-tIq&+hLiGvz64Xd7M{9g7<0#wp~N}LI`3@j588A@us
zoGNNqKRBQlJPwTv9Q8*(SAg!f1=SZIM|v>Si-MyRWH=}}Su`>fG-N&fQ>n?$^wSEI
zg9X54IjFP(EnK%%U|<H#cqM8wuz~b|E&zD#$j|`0=LnQcz?Uo?WLN--LQq};%{hbe
z7-+s3IU`mdWl*T7KgOV7(X@`iB58Sq2ZI5)K?gRp5j^?;H^lq@|2?2cgyHIH@f6Um
zN^rUBv~~yR!mLV7b_VOcPe0Up-4X#gzWEeG0%%FDLlc9F2Ll6Kzx97mv3doZQA29v
zet>RUSnx6yw1|-TMW+@61E~CUZ2EtvQHFtG@hQ-Dh5!F-9x<?hLZwE|!QrR+GX+p^
z*2+0oRNrS%Xy^j(2mJu5Aw3vGM5li^$t)%HOd=zhfw3l;;R49#U{66qYI?vkMv(we
z*nq;rQh|ZBQj>wt`~N@GyQLt(V&TD{4^Gb@6F_=E>fqHL(hB+M35S?vY%CQR94wRn
z{{f{-P?xSYBf6rwnZcxaF@r^;GJ{R?VFr!{W(J;yW(I+V#S9`1hZ!Uqk{M(?7#KLF
z|2W00QePv-ToJ0tVOP_jTrp9D!2#6Y2CbR__1K&k{vT+xXW(g`&%j{Y&@XMnkax3r
zKLbnieFhGjhNvdcY-eK6o;wK)uNNk?RL-o`U|!Z}&j2}~d-v-K&=6qF38rOWmnnOL
zmVf%dq7+2ea5C3d)Os0Jv}-f4fQ}jr*`;A;$-%%Fp7p`5R`Zldt>z_>T1_dDn#0Bw
zpnElHo>^Das(M${x(8Qia4-mKcYyc(?$O|2u&&Rts&JV5e?!eH<BFPJ1{R=M?OLxJ
z7PVfND?klekRA1zRuv%gYc-8P`U7k=gH9!bE!8}DExa0HX?@o13Yf(XP5(RU=Xi<K
zYA`LU->W48+HYO+(n_ROlWE!H`3ww`_cO3ezR$oh;XeaU%}FDX3HKQUCLhSsk*j%S
z1YWiQae)!2`TYYHjSTG5x1C`QSGHtOsJA~2UguSP1iWP10aQF#-(zs7nXM$^!65K<
zy1`jyIVRsF(*w>j>l=b+uQcQt>?|GrH`FSA5}E1AP~h0epkYzRz^JgF!5&mWfv(I3
zEsOSG;D0-P!&zo^NpO!6+>CBy-0-`RaRcPOF9F@@AI>u8fQJXbvC*asURGzRv`(er
z(K-|85JKTgPVhml9N^iDqsHJ}wV<5|6CN@&fG;+7WB_?j5;SNADp5f5Ivx!C;63V~
zk<sZ5pvDMj;2nGqD`-3$)^(r0qn$}{`dvR}b`j9Ho}~hV0ce;Tv@QyiW~M8gXI7c+
zah}<#{+39s<|~o<zrQPL<e4jK6QV07sxsKrbSqcXJh85*Z+~3j#PA<<jG05zKL&<o
zIR=(yI|h#CI0hb&*DRa={{b1;T*n~LXvZMaJdZ)7c^`v>^`mtrb<cNKfV$@Os;4VJ
zyURd{xIW`{MSb_<iuz@*D{2+ID?I8M7{DW#wQ14d(?e^yohv|t=yfYrSAb?(TJ0HF
zYRil&+Hx3JYO=H|LPb~Dg^FCTtDCZ_qVB4LMXly6kx(%UySgcxD(bcxRn&%ASk!7R
z5~(TCun2htN_VS7>aH!W2>Ck0uGVW+MXe^2NXUZ#yIL=%in^6bA~7`wj4MD{vsTMX
zq*im2h!eyAin{O6gehSqQg10GQXi!yQeVAFWYRwdhWa^9B9rA9SSH&sa7>P4;F(;<
zATW6zgGl|}C=pOXoxG1hV!}NJ8Bn`v`UXZOk?9v4nGIwZcp;;#pn4Is1`E743v}zP
z<NpiOFPvc(ha54h!NOo)GgG<Z#iRA0{sBWxwRFWxruE=Kyq8Yv!TbJSDy<Lrv5-jt
zJfX$NSn<=5vEip8V~0Z{V~Tal{{z+s7#OS<G8BZ*xVX<6w0lZ|fw5X163p1M1CMV4
z!}LoRnZ>i`GZ=+Sc<6-NvF)?|&)@()38C6cr2hYj0MPy<P%a9;Ct(r(hs7@ZKZ{-c
zy+b0PMG_ti+~9?wh%EF7k%eloWg%`)P!<xOo_&c~fKhRJ%_U}O%~nu~0;Lp?HQxXK
zn7&A4QULKS7JyDs<_1@>7K)4yra!pIWFY}c(4hLtngQZpkY7Oq+tU|#Fe`B2&It}6
zjqsdMaG6<U`i#q1bHYzmh6*e>A>h?N28P#i3>>fR7zAF&F+dLUZ2tcPloMXpF(|yW
zW3YHVk3r-0J_ZBpN9zOXo?*!e>9;FDi^1v}9#_<_evQZpHQdbLoKW+?x&l-@gK|Nw
zTX4mz9tO_ZEQ^Yl_6(dgUl}YaUQA%B_*}qL%Q35>HWZYy7l~B7+QCrE5mZre<pTp~
zHD^tRRz<}r1*TffRU)-siz;e43@kv2yrxXUqT=ca25^qx*i=zl7F{v@!WCu_kNRpa
zk-G0ekaAhV2$B5fSc&}l$H4HrjzQtK90SL1I|hN@aSRf_=P_v1?`0CH&5RQHy^q1*
zXB~qDYSL$7;GJG{l{p$qsoVgHXzP0n4UkfqLwEXztITptp()b^t}*Kwu|o!O<QeL4
z6wCFf#WK6@^nz>5>XP8yFBS_JI4l~OKKyQE`e2dB@WO+EJ$L$sYs>}pp!1eMDGf9!
z`ci4*4N!6X;?PF$zFbiE?Zu-_44{|<sd?G75qv)63#N_WG0B%n8$W=G>sr@faP{(%
zX%qN<7SJjYi$n&{Qrrem7536;lfchLhKiqw;3@eDKOQp7_{qqy;HM&kV!=;G2GIRF
zS3&nTTYy%jEnqP4U|@qLZ-x!iAFN@P0Ux@C>eNl3W2OXN9NGjf8lX;fKsa?1xFmhS
zv`GW(^rTG&XifzeA6T3kfW@h*Ah*JtDvIP(2M-2T$ohFjh*M>CLAyTcAqOLY4-;u*
z*x|vz2(G7IG&1Y}wcBdyK~o}(tVlaLM5h0^!Mue7G)LwA|Nn*Q1q&HPrk}XUypeOU
zmI!D;P|f1$O}Cia>sc5WK;s^vTx@nAVaFzh2?eVd7;9E(S2#8?D9mJLV6aqXU<8d_
z^|CN9hO)ESLC^5asPy{b1X@{F>&d*#g8{N=d?x4r|CTNg^_?sXj22xedQ4_=LeBpM
znb*n1z^H&^F=Q-@;r{_pixU*eAUwV2Hgmyri+juh(<AOM>kERL1)$Lp(9!|#|9`hm
zpK*uTp7H4P8+VxH8JAA~afjKTF?74fU1kkN2~hU7<bqtgW$DGhG~?9&{~ga6m?mFH
zbFZ(dRnZcuQT71sSS!#`Wnl1aVo(6Nt6(JqV@->eNG-D#=&W)^OAiLnweEW=mi}<E
zWMyEi<plc|Trz>2*vaw#zopmze>2(t|L-{Y|Gy>Y|Nj=R{{IJEy#TV&iQ)ePWG{j2
zvQ(K|mac@`fg92d9BR3oD>^~()2UoBlMA%?_`e0TH3p_Y<~TMn^nl_D<Zesm|NkwX
z{QqC*$-r2%R7zy}jr+_~bU;lM&`FM<#x`i#0OCv_hCAR26Et_i$N-x9x0t@-0kZ|@
zc2Wk1rvFD?FfuIYsAXUP&F+I5^`K@^O{PQuXc5Kq3E!DT6hN||je{VSAXOk0AX(51
zB}nCTi-*iIx+tO?%*#MBpkxaQlTH<|zgoZ^0`04szVR)i$n>cXnS~gqZeQ_``6^?5
znl$JLHxCU~29+O27#JKI8P0$%SFhw~ev-(c2D<nZd?_j@DlCpMFoM){x-l?>db8PS
zcQYu|a>keyYBDf7&Sh8v8Vv^pn?n<LOA(h2H+U$v29)W+`d|IOV9E7=zNPm63!q~P
zLOIy%>NVIIIJG+%Bpn(V6fC{|@3++cztUkYgGi_so1LZh|C1VA43fT$3<{uAxj_!7
zWtF^CtI2Ls!==IC)4-qra!^gClL*LBh2Eec{Qq-6eg|8azyLpB55(6|1&^NR=x{R_
zSS(=Ra%lQrpV6rXzDk};hm)bgq3M5wr5Xd%PZb8xjdDyNUxE~a#^O5J7?^c97(f}<
zr&i4ywBb(xv@8Q;FbrEX{{H|vC=bThVPz0-X!_3rG2`DKkX;aa{(Y!9X<T7(614w&
z0fPX@7oDCAU<*Mv-5@OZcK{lDU`hvc<U|HI$|68f_LBt^WsEU42N)PDjx|3?IEET!
zpq>p#O{WI~L#QX4opvXKLd|g>vjWiWfVm7u9O|3?KY#=aqXuaF78ER?u~*Q{GAQ0W
z7#P51GR#LH!)h|EL|_Jj^f)##q*$E#f5GC_|M?(GLXNT7f#Mf538BHpz^UC1j$RFr
zoW-mE`z<xWQ7i#cQx6i<U}uoD)ck)EGzSlg=bERImq0ED#W5(Z9UK1l6lOCpg31t3
zcN!MIAV=wNGUz%qF|4uFU|<A!1RQmcG9@F_gUwEdg8?+or2)Dw5#+gA4etue1O`Tj
zrvEAy2@Lh1X_gHjgJ2jGte|)V`P8BD-x^RTpjpTO3L%H4e^0#s|9=9CW5*_jE1~Xe
zb}++1g*fCQG;jt4&sxLG2RRb7-WjCNGNB%nBL9Idz%l^cX4I*{z-Z|JPMx5^(F%vA
ze+`xz&;;qhzyz`&)Dv{kC4&oSz6azZsAD3K^g<K!KNoCzLHZn<{)09mGg$a90Hx4>
zG9X`qhU`EVfPx1!wuT5k1_e;?fy6=b4o!dGK-Ghr5+E^<9B429bWmNW0vZ{zN$@=O
zQtO#TLb6|OO|s`Dn`8z?i{y6ZA6d^VDw120!21TlT`|yz+K<d<7Sj!$GY2syPH%qB
z?8UUiWBU2$%toBn7NF4?7l*mixn3~av#Nk<l<j^mm<<@2PRdSic*(5AbmHUmH7}X1
z7!#*If645{ss6*kB9no|p>ey_D`p8sCf>;DA6Qr<rsuq7)|oEg$;dJNgCH~S^trE@
zeHp(^fBl--N>v?nwEh1NwO*%0YM28U92yxCYP}=^UfMD+6hhKcOQqLzuQ$y7j9k-i
zy<v`FTHY}^Av>ON%H#vt(u&~LOO4$RhnH3i44@0@>+5b;)MP$f=h(pDP+#|Z(&Rtc
z5*#22@Bd#Sr+;|M95T5eN74J>{|}%u0Dma{Tlgc9ae`wL=K@d$2ZgO;6Vr@eiVQD)
zFJ$znzxcVrdddI)ovI8Bg<7E7KAFHbnEpJ-aN*}eh8w>a86Hf&lVe!_kTJr8fdRZ6
z6_(m&8Zt0g8G@P&42-`N87I`#bp#;HVcY`Z*C@YmaA;s$p~J<X>d^H60%(@Lla&E9
zHP>&M>AwIpBs-Udfw5+tc116!iq`V301ZG|y!d}R<N=$V1_MK|W8?n^^%c)WSJb?=
zT2=GfN~Go`XtfZF0s{l%mjD0%pP&P-r^pfp1`ZQKj$~lqP{6IG9@Uo&3>-WR4D3J9
zH83!+KS37*@fjG{FEB8$?*Xwvn1O*K21<K?Xb@&#V7&5zk+I<AL52%2A2Qr{#mMmB
zl_SH4SBVTiUQMpd(*UIbP<(;n{gooai`NT5cSJHKfSLrLg>Rse%+e5C$f#PZV_=#Y
z$iVOuoGv^9Y7M<By#N0_0&2{G_9t3_mH<9r0OxU7daCte-%@MtB?21fvu<RVSQ{QB
zGUFwKf~6V*$4o8;g?iBGGoUMaW-2ml=yYV5XsPx866o41$0oLjLJv^lWdsi|y-ovN
zE%qXy&aAt_%7KBwQfX6!RRRNx737Gt9i55{8$d^V)CX<|sIkA`;LymZV5#+gqqPkK
zW2ictod!FDwqqm16`M!@|5s{?uCRC>WK*l|#j>ha(`tJ6N9F=W76t}J76t}}EfCBC
zx^oK3W<0{cz+y68<`c7Sz1IH=oiYrJpqW|?P6kfLM%IF=P6h>V<HY84h1C=WM$mDJ
zpm8-&n-NqHIyC*eQ&YDgpzh-4iWdhNPJjZ^`~Pq7ea<=@45c9bpw2;k#qA21UdJW|
zkFZP$3(y2SXy&)p)5EMj)5EeJbX0>S0|R)WWL2hIhIJSN<4iFI21}<+5%tmx7k)c3
zPN)yO5Kyb-p;a&8VbKY?&Sch)fO@vW6`*ZWpxCxZWSn5}fPu^V{}0v|jf@j44lr=l
zvmUMhiC4L^Kd70g5Kz<dBf$Ir&(zKs2F6zh87I`+oURD<V5_$SU6l)qUKkB>NL3eu
zLd~on0hUagB0y8XwT?j|APZ|wcxZtf0Wut9`HWW#1r`q&IO?kmEb84ZS9t&b-UxLB
z2k1N-@Bjbd7fpc7w{l=$eDRQBM^%PgM$N4H9|0hXKpRy+hJy?RSp+h;-rYg#B_qQD
ziw6t>GfpuS)K^`AS)d5DKmcR`$cG?(-v9rDmo|fZXqCXg0rjDs_kYN`F_7gT47Lxn
z@<@S!!4fo#2eJ_4Q&13s_6N<#Vkm$)#{2)btuGZBCx8qE8EAEqfpK;w0|TgX{B@9V
zg7^QwUtsYKs*OP%dr+K%wv*LI{RjZ18}I*b!DkcIR7h9UC*Q8{{{IBL8l*--!lB-w
zk?BjV^MQb3PX@-i8=EUYK@HxI$H1Ua?|HeRHY`X4)LGQ90-Y<uw8vTul0HByaB3_9
zKzpY`YOZwzRBHZksyX&c1XMEXsDYXlprI!waL;+B1OtP$1Op?I9t9muP}l8${eQ<M
zrVN+@kbw?O|F8UJ1SPry0U#gLiyf}8S^(a}rvnN;5U#b@5KyCe0kr#9r`CGKI;(38
zj8<D27-yRO{|^ckh%X<5cMjB;N;o(+{J#JTK~Ttf|NjGBs#XsfT?EI;0tN<9G=Q#W
z14RiaPAwT26u|MnilLxB?KU{YgB;-f|EuDwg^b|&5^Dzr25Y9}^DUK@FQ~h?BA`~^
zyP|Hx>WaE+KLTLw*ILttfEqLKz1ljx77UD50t}4SQ4EYT>ka<@|Ha5Sq4sfgh4=qQ
zxgf)9tROC~nb;5jas)Vm9bgauWg*Z}10dIfd;{`{4hKVyV-sTvIBg^_aCra!4IXbn
zlFx8#Vl;uuGkO32eFC|Ft+#jpn%MoNf-Gq9fFa-e|1SYFu}ts(KmVYKrFj4U`2tNW
z+57*`D`;X7-v56dKoj%#{{ORn4Vqx7_y3<W(8P+p|Nm?O&AWU5|9b%xLLdwpn(uUE
zm}K3^FbP!Jd;kAA2P6)|7K)4spr#C{+5uHRpsEMd?{H{>Tp9#Q?B4&qAPc5InqWmP
zsF?Ns|7%Ha3<Hx@0s|u`n7#l1ngZo>K>028fd>M>2{j5-vi(h%{^C2c5!2U=@b!Sx
zeSR>jf!co#TNzcR&-eja`;ahMAVZId=j&vL45R5>KbZxro+UKz12xm{gO}ccW=26n
ztl%?h|IPxB$blROI=c?EA>c(F1CvG5@)h2HXTF@gC&L81o*OjC)9B2=0vqIc(aazK
zYRNe^F|;%~GjKq~d33lK{2dw@Hh_i(EEX^X{8VJv09rczB9np1`|kqqo)^$kZ18Mr
z1H%d(W(I%IdFG(td+Es_0IGFsxg^(tRz<($1RcS~Ajt?CJ(%bT-c#Jrk%8#(PFMKF
zEM7kWYBu<!0v%-r&|pgdNPkBnLjg!D`ug%(5B4pffv1`$4(n=JoJ1gfng0{K|NjRc
zw+D(+(7}+PKmlQpS)dtSkXfK!1Gt|G8f;(y<?MO}2GF&8H8Vgbj{h?RWxYama4X;g
zC=h-vWUTmgkg?(SLdG4SX{cWh89RO}GS2wH$oSy5BjbYKiHs|LA7ni6`yt~A`vwL^
zP*w-+`mCPQ{G?{5b_Hk@9el<}B13-i95ryMYU%lZBPfYza4={();BUPv1R)IztT%|
zg(XLfOsz-Is#-565zw%jANXbh<`M=5#uftj2?2Q|{h;;+3*1c56$emBgdnP6=ni0o
zsz-4Y_(o1paDy;(bgp)K!yjg|`oFHA&5t_F3<{2o3<CAdGG+zI;Ao!HXve?;?VwL+
zv}51^u^k#2T0rfOiFOPeu-E{d*Z+c%@xiNwj1{jAGB&(=$k_2(k#WXrN5%!O6B$>$
zZe-j5ir&`?8F#!s$avuOL&g&pii{UPt88AgGeX7`r~moQY+kQHsyW{O|961=Q~!;9
zi}(LOo;p$t44@G;hbF{)efU;3ySn?ED>Otweq?E>?_2{JbZTO$sDH`61ytXHj=Qe!
ztcOW3903h#d;h-;-na=`@Z#9S@C3YgA9~fU_y4EhQTmsb3=Ec@3>-fr85lqpR8GhQ
z6$bxNdQmk}8$g}Hn5xB~1JWLYm&b$iXcL16sOkfIVB5`g-qRWXfi8{(sRtbm0E#Ra
z200$tu?~&@Ef5g|W<w+BzYZvZK<)=clK1~xpk3bJ1Cc<37O(&Y<wNX|WrsbsUPB`a
z<{+@6|AIpO*G_P#XG&K%G%<8cPx!|yUhjhJ*7~jxGsp^3hAAL-dH=uJ3Ni)~uKz)|
zy>ft7?t;W%xJK#)gF_>;iKXZN3!o*gpaDG%F3|mA%;24AwYE3cdH?^V3o1K7hg;O|
ze_f%$1&ZMRC+a)vL%=cY(Dc6sWRPPc(;bi_>i4p50Xd|8;VY4uwhRRhP5(=f0x<)T
z%KyiJ0ud5`|G@(=VE=vv`S&NpzqMfh!nf>%Z)3Bo+rPR(LySQIRBjxp@7w}*gkuxq
z4wTTCw#BUI8u&0uXlUF3R~?Yh_!k0d273ShTTmml0+MPDgHp`{@ZdT;)of*81UqOe
zC=`Bbf|5M41L{F%cfcIr(Dc6rWEe)05@S$6c9=use^3ZO^E{XhOHvr20g5KD1HdWZ
z$4XENsNekxbks^o0s})m14uzgCiu7<1;<84iTW-dXc}PTsei@31=K>D^@^dOzS9R9
zN(=>{ykybHPyowMFTi=}I&@|C?=3a*7Z@BG7)<8WLVR!ipMlZ){|{Y+J^vp-?5PKp
zVE^ZUG&nZ=zoNm(pnz<tL*xG*q<9ChVLoj@iuaN#aM0g}Y<^+}4M+dG0BWa#eGU%#
z?;Alu@BRNDcs2}@!SDNm#^u1fuN|BIIH2V4|KA%S8h(RY)~G)Do(j4!5EODS3`+fo
zl+U08$_XILA*ug6cvZRg|35wTFW9%#GCGOO)Bv>x|I82p#Ve=}2`bwleTcsb(?6s#
ziCBPEOMtgJsen)Hc>p?B9aOSAHZi4u>QvAjn4p<-@SFrA1L(Ll@Br2H045gkM9{FI
zYW>UKpt0^3o$?Hz9RT^D-qu_;2F6}_21e+dk*Z@8BZI|@{~Ikm85l#Jve{{{GH8N3
z+>8GI2MzRCEKT95d1|$)=D8N~V9$Zc2lADe7&lBm@R3<f4pbR3E?{6_oB-*BgZMDa
z*f9A(zF0kD0RscL-iGzfK}&j}Y`9WzYJ`O;$fdQO!4=4^b!hs}0rFL+CIcfVRe=J;
zq3Iv^)GE;aA<)&CpehWsNvZxY`xa266x1NKtk+~<s`X;uVu3W!0UG=OH?<stKzpel
zfZ_m@tU*29nVbv-pk*!I|G(KnGV}i>paZKxmV5vI-vT}|1!7*Y_y7MpkoX1O|NpN*
z;^%w+|39N1Ngxwc86xphK-ZBW@sqv(|Ia|;M|l7LAA!X8_x}Ii0~Gb3o-n)}#ssR*
zzJLM`D#QS~b&bU$^I3!U|1XRl;33=TJ6KrEm|oa|hDwv9o`aX+fxHZB@`6^jdH?M-
zoSwtVVo=W~z`6ir7@u$)h+^OqVEq7MAoy&cJD(Vk_+a~y_#05w2Z6Xq>Vq$U1Q6;&
zkk!{S@Ck%Bpeg`waY8a6(g9UI3Z0K^AOoL3bOEaR=m)6$7$o_61_nNXSdcuDg|TQp
zjztThI0KLdgpcCT9FTw}p8%ftL8wnec(|Sc<bWhJ3zN_+Oh%JWMw3rLlTSgDPeqeY
zh0BBNXW$b^1Laht5J*SUkRgET;|#PY$Uq8GkcTqSe4K?AB3Yn91Y{rBeg-~)Y>@dN
z0SGOS19u@vfKMP7jh~MQLU0HcphW@85wJdJq6V=+m`{M^2AGD6L+oeZ6DX8Gl>qTT
zJ}E=X4Hal1Q;Ft~DzwyIjh6UoU_J+1z*jF&hvu_-w4ka-i<$;B_04Ee(Te84R<w}m
zM2V_;K7npD3%k)Q>_aoK4=rx{(ezJ7lb-?cDKyCW1ZE(IC@BBWM)SdJ6c_Rd%t3R|
z9CUfqAQhN{=Hq#2iFY271Ht)!KAI2aqZzmWEy$OkS+ESvf@Nq9T#gn3%Ml>}N`HI;
zE73HpLQ7O@(F|CN=79BR9$1g2e={0?8$3!u_A~GaY)3P22bzVu(aQXNXd!d}ZXie_
zpTGe$4;?`Ya!{^13JX!N{S15p;MyH2|DQ%P@GP1E=g`v31+);jgr@%znu9Ju9Z(Oe
z^)92u;T5!ed=1UVH_#k(6KWvLyt`=T-9vNmeTez>@NDq_kto0=+Cwx89-$fd2u=Pm
zngx&13Z5ruQT!AfBK3$`=_#56o}pRr94&}nfT9{H%3h%9e~G656`BKIf#mCv40sI*
z5_pKb0lN_4z_;jpkO4^gKcbZr-~)1y<UgS$;_u+j5t4$RXo==0nvegW@&&<7S%iK;
z7Ss?B<Uw_?ARjva00Suf!+j{ohZ+Kc{HXa>P!Kf;1%*)^EGUfTK=67WBnOJ4nJ;?)
zWIvJuMKlFUsEJNc8O=c|sEJBY6*Wx=TB7C}L2I-Su&zf<rGhqS8f?)FbU=-BK_@i6
zGn#oWXbyHob3nZZS`d1n=3_zdY!6Zhg`hbIJb;8G4?b-Ni64vRz(iCJ)(d8$C7LX>
zAk9LP&q4D+9%`x<EJX7_AzG9cq3EyY6D&saQ8AhUC1{DN1kFJ3DIrKcE<-b~4AsYi
zC@rdb20p=Zv_yv1#1gDQOZ7Eqaa@NMVs&T^tVfID1|&YH{ugXO)6j&*Z$=A&b~GP$
zp*f%nEzY~p9NdlIgYqArU>{lt^rOZ3B$PPg6P$)-!Avv<%tA}`v(e0(1CL^m{S179
zXe}PW1xP`}z`!TC1hr@tTn0A)6cl`dE70UuqFJ~K&B3c-`oZ=y@CmL#bMbmK2OL35
zM5oaCXcnGEbI@s+g&_Ab@ClxQMggq;7d(%q;5?d(FQ5f6TKhoo23nfAiI!-=-EgE_
zavS1dc>OPU8_mKyXo>C)nh(L#2uKD#ffxv@Jq4ejdFUycgPwxR4MhDf_!P~6r|1Tt
zIq)eo2%#+=!Dnbe{tPXOUZHv59ms=7^}pbIG#9=HyAV-3en5+YkC3>8`}iZsK%@{s
zYYzybwFd-0Gk^w1ku-coGvF(l4}PKf@DFO73!$|Kgur8A2=j&5Q5`JA30kzsfTVyM
z)dC?N)F2n)Ma>mL{HReN1U^Ut$vg=(c_}pg(rER+5Lh0`09DjD6H)^!fJcdtCTa)?
z>7o{7LI!B^Mra{mgjW9xnWLrwA<z;E<PZXl<)QG=d}xK5W`sa9ipc6g=T9K>>#fmz
zXoD67wy0@B$PUc{2h>C<<cJmm&S>ggQPWJlkULtCxT9(CK+TpyUTE^(XhH0a<{)1*
z4+Ns5sd_%4AhaM4LUo}~Fq#FyXh9A>r35L>gra#U6vaY5p)h3mdImnB2s9T)qVZ$U
zd>o4wBJpVaBsBHO$QCm238f%82vq+IrJ?yK9nAo=(JP@WH2EBKK3bZ}MawmLh!6+W
ze|$oDXg<h8EqaCW(Gq0=YI{HkwN1w-RE*?91_nN%QZxsZ!yN#!pMg&Zyf6?c4lB?M
zs6<QE^=R^qXg+L2^H3w2hZ<q}!S*xo3ALidQ9D|cbfL+2qZ!zP=72u55SoC-p9FOP
zto|38f)<BU(F~l5=AdctAOyLLPiPuiE}4!NV$;#gpAN~U@cLh923j1?M04>hGzZK^
zGjKMV{2a76pNke^^S};3)c->B(egc5JyM!jfac=`XbwahB@<eN=AosafI>2FDabse
z`d<jVp$kdDN;C~C(aMFD&^UxPK!jF<3`Eku1}#dqp{d_4fLi|xZAS~z?PwZyp!sMg
zS}F%0Wr5^?!)Q?e9+O6rKcc`O1{&*uwP1wct=#G9IxK<HALy`%PS@3CX$G+@rti>U
z(b&F0m*oS?^bJNV3#JzsvwWCdVZxHV-Pn|+lzICL3l<Be=@Hf}H>L;JuxM|eY{SyZ
zwEctwivjcY05=vP#_3w#ERx%U-C3S8Z7=X*Il;U=!;i&-ar+K`mJQ6)Cj_(H*j^CA
z;=sIJBZ6fC<Kz?d3Szum;7DL7%PcC%%umY6j?c`?ESc_S%%U{CXd8zxBg6DNCM+S-
zS6Hw(OjodGv6yaP!=fNsTAUQ0k(m;oos<IB05)X1s6ESOMhON60ZA|)LO}AF&_{#m
z0xm3KQXfG_tAg_mM4AE2<`eoDG2H<yU%|j2PzjX-Q84)#(+j}zI~W)QszDM^43obx
zeF0eh2LpqEAXE-SaexRup-&vsFM#Aff!wDK5`$uxyv8(F7BQ($77Pr6kaiqI9<(f(
zflug@$8-a*d;|l7fG|V~OfrE;KA}$;(-Xk*Am>AR$RG&@2AF)u^a-vkqS8X2W-u@a
zR6yjwBuv4I=?5SRKpqqYOF;-m5XC3->A>_45Cs<)7zD&Yf=~=o@L;-v8;dBj(5DX*
z10|+g_^}xHfmHAb{f~gsV0-z5{zEd3(Ek-s@dFG+45<t`45<u>48;to3<?ZJ3<eBF
z45kc*VA>3%j)7tNyKok(?I$8x7O+fyQSZaTCtNEq{XrayTzwfNmW8Fjg$kdrq6SC@
zpRfyf5Rp$<1Y(o03pB@xL8oavp)`yS*9SF61maTRTBv!>P<zUt<~V}~via(TC833t
z6jVYKTG+uX76E&mfdL#=41B^8U_PI)2)ImPU|@h+APPwi!XnVDy#x|;!XjXc85kJA
zI}Z^af|zRq6~|^U)WC&MhgCu6p&FotUDSr@76~kJOi?E$28yuo2`_P&UXZ{dCk6G8
z1lS!6e2_^M20mdCjp-{ASj?D&I;KAW=@VKoEs;e`O6ULso3m$-t9vjw;03ruz_hT?
zjp+u7EOJajAEpO@Xkmfr1z_4>`UEf?Fnt4<E|`7+Oi!5p0Zeb0E|A0`$0U4Vx&fH}
zFg+lNMT|*AV0s3KFO)I8BZ);0wBMH5#}hJW1{(P1fkcR~NXGO7Ni1SgA`J}8E}`IZ
z6;u)m@W8@z#`F(KEMoN{8yHvuJe|Ekt_A7m{sLn035%RyU~viZhic>#5KV!KKVV=9
z4tGR|LxWM|2LqEGWM&#{j|kKpQ2_>~AUlv=5atsQfx1srgMlf?0X#ell>l$O<P#Qk
zU|<b`yNFLfI0h^)EE>VU>f#y@;sN3^@Ck_cfEawjq6G|WU~xq-UqA#J@S+_IY(ZcN
zh`8_-FfA;)fPoz%4$?54C51&uN^}PUqc%tyjQIp$!@i<7rW>TNh)IclU|`e&%Yg_!
z0U>B^662Vj0FoC|U|<Uh_V9EA#{-{$5HwK4ET&HY%LgzpJNmhRG=l?25E=+#8PgAd
z<r^57Bm7~Z$0q<Ah8CMK{R3Ej0|O(-wGadN1O%W>5wR1~6;fHmq{JRDFge2&@CgV&
z>rJsA(*r>A;sOjz;mGpf%)}=wt}(p<EbqX;<bx#7e*k0?pRjnu^bKJ70tTiCWO-;k
zF5WTyK`M(JllX#ZX&~yrbOkW|V7fyZi&(t|IPdTYOE54n+JH<1V?F_mIUoj~u!I5w
zQz%@5Pe212)e;sAOa{o}I#Bfi42+QRYA|0w9a^|aWH2xpz$N$u)FHv^EiBQ%z~bWX
z;tx^|O5Ex>AQqpn#0&;j7k_)G1fPI9G|fnCU|@6c_wk1$dp-fR6HxUhrYoegh;u@d
zoWz6a4j?YHB#~s8o{-KWR<C*nqFPdcfyFffmM8fHRF^=-9T+%+U41>B{eAqw6$40^
zflolS2E^bKmW*Ivca3m$4h?Yy2|zI)<OFX9K4HlU1{PocFsLM-fC@C0C1)_O2Ko9&
zLuL2`l%UZgxq*SrHwdPMPe2ixY$Q)Gum-t#`hdN|z$c&xE#xI1Ft9~A`-l2LlQAU5
z`Gh5ZOb^IlQInDqU|{iZ42I-D20j4=Xs}6HOrMa!BF+i*zf{2V4InNwmKPtGej$TJ
zj!A05^bcTq!*qd65dXq-12FwzdH{%)7MNZDrVXY~0Mh}}H-PDa=@-ECgy|o^^oHpI
zSuAo)(if&1WU;6*Nq?9g0piO@Os@db7Sm^d>4@n&z;wm*8(A!JY%((#nDqUo-^pT;
z;*i<Fz~b!c<1_tU7K=o^%nb%+eP>t(=M&&60fjxEFzB2o&{&2TETW-xoXigfX8mw1
z>N6nv(ACRoFfi-;U{T)zR$niSp&^2SSw8}c23Wa+<{;S)24;OfEb5`@7sLD=49w1s
zuoABx;bU27Whn~HS<p&QSoQ@2b2wZBl6q)ujILfzf`Qown|f#np{NISQRF-rm?N-h
z055Lf6GqX%z$YwM!NBZ?O+D1d80uFrusAy!LcNUe04Rz<Lll@6++bh{$EE?B4;c7_
z<vAEwe6Xp9#4(2X@)is%5fJsDE;^EnpmB`u1NjUF7C(pva2*0qq&R#mKZAkQ*~2ji
z;$?*Sa%fR2e`2~p9*bDLJk(xTl*@mB=+_0MQ3iy5P>6vu1w<U)@KcarU<G9<4E0d=
zfjVL!eK7MCJRs(S+e-|5((qgdOM`HQ71JN&v4~m8LJfk8FJNE;c`z94Lxclm!6$|B
zAslvMx<NjRSe6{5RzQe<096hl@X7%eprX(;4Xz_W4L)eVh=K+9gvFqhBbdv;Ck$&k
z!`!7PF?~Zmi(EY}b6_oEF=*`wi)fLG{}2FmzZkTI46_$*egOlEJ-kVW@Hfm{Xp6d@
zfdQJCVG?iyUNEqPgd&=JaF4^(Lp=ynucX1iVuZ~?s5%iS4Obt*z+&uD4{LNHTqq4q
zG9u7U2O&P(zzzmhBmXd0NCOGUJa8273B%1p=7UNVxB)j9SdHMVS%d+wP6mvIsaKX@
zU^ON}J%&CH24+7`NZWY&sX`VWDfI3P+=hnf9|~E-q~P5pXgLR$-!NUFh($~b7Wpu9
zV2KLGhpT@uJprs98i%;_!PKiLOkV(24-GOEXp0qQK8z1npD_JF5sR1=++3JGXq5=l
z2cuP>;&A;7rW+K4x*O2UqzFyq(8S8X0JUEkmMNg-OF^3~u+l>Ww5J@DO`w?>mpO2E
zK+T1kQ!k9mAh<(6FtF+d`NP{ru*?C=L>Lx=TSI)puz-Pk09uN`A_^j3&nFCZ38q7!
zJ#GvOpgw^42xcHobD$vu^N{Ka24*8z&kVF05auJ8fp8Z?gB)f7#Kj1o!3<QZU|=?a
zcj*wB31%KTjch)os)eRexPd1?2ExVx@E8crSbV~;@&@KWWD7tw49o*C^VKC7n2aEe
zBh;!E9)!>!hHI!`U=B6X2bWf$ZUZdD;Oe1q4p+Z|feEf0sj7slhqcEGpcbj$U|_OA
z>fpdE5QECY4A$V7UQos&W+jGZp@snivz?tIh6Bam7J;Prgf$|jA1DKrGSIXo2F-nN
z^BbmrC}R;5(tvdUpt)9K!*q#q7C9!38`CYyS>)<9elRe?`|wB}goU&On!7b67??ug
z8jxZX8uJop{?YVcV6s8#z`?>p6EY}NFD!xPK+OsUCL1gkz($oY)URM*vcqBl%;6a7
zZ!j<$z+HsYK!%mqn$Tt)EF`r!KpJ2!LiiZ29xYdDfx5Ub<wzk4R}b+yq_G03%Cs^V
zm<`}wz+wSfvrcOU19K?c2MG0=(D5I1A8VapU=GD%J}9cdxfVmi4+gey&kzq!a90*#
z0W3Gd3QQPZ6Y4;Ci4X0=C_{a!2~8W4&|D6Ud(Z$OG$%p^nuXC7YCsK!MTNG;v?>-k
zC0OQzHLtXx1u|UOf$0uaEMn97a#%R(VMPk~C^b-<4wQcw5M`e_G`eAB8_W<L1_qW;
z7g*j$1OlvRf{sK8i$XmG8LebsV6X>Sz$XmN@XEqs&;$;%0HzUcQN*-r7O{E~&BZhp
zEv$47FtGW#x;sKf91!k@B|}&Sht`_hko3sFC#<V6eF4Zpuvmr#96WZRv8js|>beOG
z%)XA`G>FoRQG#}>U>OqK9GFAUT3q$Qx+@r1Lg6MNd;m8PTGS9}ps?-_24-JKn#Srt
zq-4p!zyKOSf%+7O3x)MO7??sKwGWDc=zVg%8PjT6#JtdxEi3`(9bjNGg!HXYjDe|#
z#t=M$^gc{asAUn8g0-<>*#KsqzQXhg$nxm=^#i6KsAUn0(u0oU!zLDBy%M-N4Ge5f
z{-J&@;C>t;{9!o?W-lyw;QDq<H>d-RPeZFDSOS8}f0&+72da8t83Wonfh8z-!h^{}
z6B^7ObpIGAFtE5dI)Pn@T&Kg$fmWU9=|tE7YB0=U1|8D{>Ool%7Vl7p!3=_BQJBZ!
z;!txy1uD3e0_Ed$@C61Y7jV}WTvWij$58X@g$<xhV_1;^vk>M`Lk|Wf7c40T<{?9H
zE=2T`4LcZ^wBQqSh?s<02%kcN#FP)BaMXbo%rJ+*gAgVTE&R|O40q^`=>-ieVo|U{
z2iEt17nb0rA)hczUILnA450%85;s5{g8%>jLkl;wGD6tMVETgw7O{F*kpOE2!8`_|
zb)l^vm_J~ABdGl_aYz6lO<h4#0xV!*{xVv?z@(1|(0cSJL<><o0SfJ4!)g(2sD-df
z10LYeW*E#v@Uj7%M|AjvVLpHv1j{5aahS`EHKr>xfqHA;AqWNr251PN$AB?34daRd
zSlWi0`+$Kh*jGQu)fY8Q!wU;&UV?g{Uf2NIErvN57A3~8ZX(P9IC3wnw19aKBkG_Q
z!qq`T7Q(OR6Gr!ei3bClo3FmFKX@_+kxAgW9BLqXT7y{(^_j2<H1olHt_7{8U=9Tr
zv$3GjCvea+z&ps0wh+Q$Fb%NW4|gy$)4}A?GleO~bb%HYv3gjP!t}vH78Yfu7Z_Mz
z-bF4qVIBb|IZ#Up8WX0_W*tnw83zL+#LcKtZU#|TFRTnsoQPt`%!7d$8oVeK9aIB+
zVi;~g1p})V+=Yl3fjQ6!ybK4C_E8;Z!Y6FDf`Lg3?nHzEX3!=(h67(rk7#9)vw}sr
zG&FaDqYM-h&@?0sO_S)IH*<;U8(LZ9?BM#L<v50Z==2VT{sIQ}2%qUOtt?V-H^@Nk
z#4rQa@q;EWSfH7on4ZwaB4=a{Yu7@PtvNV45rGBc!}M7wOy2<32X!+nkm2S)Qvr+*
z*H<vD9b_GvHVde7SR#e-;o1&N4`^o*i-HFw)OoOi52nsifPpRC$IBnmZbL+&G%N^l
z>GPO=pq)i53$&*nTqi?=0nUfI&k~wj;r2B!u!TFh`9OyH5ca`>3znH+=D_uxnC{TQ
zA{GS;9=JL*^Q{;d*nA?e_y-o9IQ(N}F?~Y^i&&O9ES#aq!U`?=tqK^}e6YA57XC1I
z!A9|5eAsRyn18HROgHFc5vzxV4=g#r`Oxsgu>S)CTSPc!_*uY`Bh=mK_Jb|~0L2r`
zerpQ`Hm3-$=|?+R1nXgrgF6CRu)q=*x+AO`7}z4P1OhDZtf2WH=6M(&!<-Wg?2bO3
z(?h#hB<p3MZ4yX%f|$30i9;$DK4Dl!h55urfPv8yR6>F=B1OR*532xSj)8d+u0Ml;
z(F?rV4wnJYs32q@x&`QbxP>bi*h2jfQ{|8$8xus)0k;ThF|41D?s8j+=?l79#JrTC
z>R{6==oK3JG>dHl1B<i2FSwcmRZL3IG;h0NS`Uj@6l|0L=6($A2N;+Tv+#%jhm9uS
z)c0e00myuDXi)(x#bJ$AaEZgfCyZ;j1F8<P3<_za0T!-y2Gbw(fSO*=MlRSIkUD5B
z19umc57)PVfyoFmVUJR6!rTW7c33#Tq6cn1bWR3p9*?ly3kG&b85cY~v6V$MTOXRV
zCBQZ#8ih9CMk1duEJQ4!Cc(v_5i0}h;)70k1-010<{&D5dkY43A8?^StcBpX=M%Pq
z_A}rXLM@VkmL?LoEZo7s4k-mmwGdh|kZPfW1p_;z#39x~aBAWcwnh(9XtP)bnn-Z@
z&|wDyJEWW?)k0{60rw%17CM4_=mRR)Ar{sXOf*m*f{wBUmFy&2xPyTOzLJH3Pe8c`
zRQ~Y^J6SNWI{7$GpE`j>FbbOI7#P5boln>a>N{v!7j_C@V08_042G<%L6ik>eIPR#
zu;}ZUHjzb*$?3p!4KV#;dcZ``$N<z&uq@{UjXikD26cugv}FpHhpLlAtGLkRVObZ}
zq=z-(q28$%b{1e@4e<!_4~MuL-tWYiT7tGv;TAx1By8;_%p$lv)PXQ@SXl(~s3<s<
z$nXinTn1AJb(yg9is=oLkme(xt4HC3RxS?HH%wxYV{$2&egRBRnEnAwZ<sDHnMKXY
z<pKj+uzzTfGdQLY5#<7H7r|GzLOlYr*X76bg2^m$Os)pgCroCMixL7m6ls+#Og}W{
zU@-+Z59)DPNW)jjLPs26_P7R2=a>Sr=frf4DJ*hqt}hsvoPxnij+opyre}cU+%%?l
zOkq)Da`TwJ0n9I$egRBRnEqi3i<lQij)9Jk!*T{}*?=3=t?<4#)QvE=xNVpoFqK72
z%MDum!qmG#BOS(vsdpEcK4B`0n3OBj91Qt@=?A8=h*`nH0A3A1I&#9WZB=mhpoNWl
z!*qdZEMi))3P~Pn4=fSE`~`Q<h3Ns)kSao0B7+S`!t}w+gSC*vp>0P=XxWIK20a8A
zm_q}c!C3>;Zh$mg&=(XlFfb&7l<;{A!%KlGuz;{O)Zy?^7ia*$)j_j2Y;XnUA&-jb
z2Gd!@l3)&os|U~H@geMqBF!FHLkVurhv_S(v&eCHW-zdLyGGhiUpJjag3Ggmfz8p`
z*)<?!`iAK&VjP|;7+8V>9Q~&AO=OX<@;t%7<{A;;>I_}^2MZKWXibN{OdMvH=ZonH
zGg!pxVav>6lSJ^afhImzXry>Tr~P4x$Q3-gfmlNWYkk2cfnessMxSBxdvNn1RlhOD
zq!27{Qz5JSh0#kIFNNtEGg;)gy<RY|ySO@g`a1f6TRBlO(Cp>~bt$a91oN>s2LrQ*
zE4aUg($0c)HF4_mn0{a;i&!SCD~nTI0|Rq_BY1QP#r(z4ad?==APq=F2LtZD9SrOt
z{w|*G)8kuN#IrCG8z&@jp-y8kFfgDeV(_>n!g!dquyq>fiO&1S^aHb4#Jphk!E&o9
zv{eqvg|J);lZOpA!Q^4y@M)N?Fq=iJ-W%HJgqe#T9X<~jSUmiFpy7q65is;YYXn%o
z4A$F#xd&!0y!3#K1=kDvN-(eld%A-sIgyJC*nl29C87r)c;uZ=*cY0fU>@_WU|>`R
z#Q_*291KqnP>1?}8v*rv!m#;MA4pQiH1GrilQMK#1KEMT&|(Tc5(zdCY1A5O9(+X&
zG^Ak;^^;&=Ql7qf4vVlAtm}p=P+@_IUgG%`Oq<IhR__BHtcArPEbd{0xv;{(4;oak
zwBQSEzxzRJI=IUYFffI}!w`26LepM7d=M8`5c+E{Fo(j!5MiJ{wDf{G93I!`K?lv7
zFbDdB){iK|X7`a+55U?*qz0t_2?iF8P(4j>nn7AE01H`vXh``(;~eIY00{<0z3G$Z
zu?TzlLEY#EO<%C;8m=^efhkxIVgYh80v`tpT6_-45W)c+(?85(5vvb?Mix%<HZU;h
zK^E+xlw+_A2XhZBdBc(^#so0b9@s!RG>z2@yTj5mxVmLPtagN^HkiZU9(=*T913?4
zB9dVaf_aEI2h}5%AwgY4vV#IE7?|{+1s8INqn89Q2YQ1&$|nqt5m^R4VYouHSP$Zu
zzF+~1SUp@G8s%_<z_l0DAbjQ|Ffi$1DOp6J`4N^aFp5G*_Na$<17Ni|EThAlj?mg4
zW+1$Y3r>c7!mz>`w!RbWbI=wq*n}U{W3VU=+QGmGURVLvkCg9V?Rl61Fb%;O46H7m
z?$E6oh%^C9Y#z{j1@kGq79^(023l)|QLTb^Hu51B|AEI&5VJe5v;?ydmKb3n2a7`3
zVitIb1Wg;Txe8D_N)ObZhHsmL#0fk~V8dhZkeD(3!6Fv9dYHu+4LN874i=TL5Q4SZ
z(bHNmwDk>lAhaO~^8l<4K;zfL*HNMys0TF=rU6|ZHc1N$F<1iyR++#;5H{-#6Nh(0
zz-7HDQlf*dH2nwd$H2;NScruzU|?7A3-xt!4Fb0uaR(hVZeRw$Xiyx1q6ikGupog&
z0gMj|VtC?%wk+UnVMxf-gH}p`6FvhtQ6WZRQN4)dLx@KB;yQR-!HQgHNeXi?jK=P8
z&}1ppr?9Yw(Xg<F(IL>p086bHi47bVNW%!w#0PgEln)zB2PbCGA~{%4!d!|@!(9%o
z%tBu<usZtq_=9^rNcAeLu?<T^u>L+w9F_*ccQ7!5_ohJ)x`B_hz!buom9XLeaI{8N
z_zwmqXP60C8~|&M!Zux?>yNNtU<!xm2NgGn5)9@5acEG&2467@s9<37ff#^NO~du0
zjiqAf-@(8X0oD()ADa)LLoKkON(=*jfT94_z{d0dEaYHy0c_#~o)%zf4t8Qj1axo@
z-mZm?vccjk(t?3Cz{e3XgoNZ^SOWwW<nUYrO>7F#x&UK*25Mh2EZ@TNE37s{HxRZe
z17;w6@D`dYV2Kv);1vw)!68AOe(pNpg2oCKH?T4oHX;Hu5EjIdPy=BGMMX^iu!2R5
z3&t1xF<oFKi<}kYP$E9zs0*MiOu>-MfD|%O&=L?F(nw9gs2|faR)V%RD@;~otYP63
zj@FpYv5G~GD;gRk(I=)GtYVRan2)3}`or{uRV-pwupmYcIk<<Q4I3M1fdq4SjKcH{
zt60ROVxUnIV*o1m5Hkre1=Am_Vv$pVnePtmgu?YNU|{oc3~>z(nJzGqMT{xt#&nC-
zENV<KKc*+FW)Z88gt{LV(9uwPV9kgKC_e@oFtA(>EAL=QFbZ1Cz|4c$9}C(p>>B3k
z2wFaf6wpxfyoF&F!956#$yjJD4pj(O2X`Pez~C0mnC`HKMT|=kyw)6as?_v^H7s&W
zaSGEL)*#jP@XQ3OIlxiPCk)FIu(36C_r$?Ez2Jr%ViW<^VT2X<uyPs3hx$)j7@kR?
zA*Bp$nu1Goq!bh9Fx_J<i(EbIq;Xh^fz^@GU<dFC!&XMYJp}C}pnC-B0LVUXq}est
z!Q&Vs<&YGZ4PUJStGZx5f@fOjoD@u40qP;RN1+ad$-_JhOFFQai|3dgu#QEpJ{}qq
zFb~5$22Jv?7=g*dvI4A`1S^ctYrX^l238d}Pw1X>M6nACs04_IgAt7isD&_(!U6zB
z!z_R|IH7q2Jth-6raP=>QDaJEn4YnoMNTOZnuK8GI&2{nEFcm!rmtAfA{PWt;?Oof
zI9x#Mqo9o#m`CB}L1P{k5U^4hZf?eOi4CA#dQf-5A^_euf!YHrWMQQ_tVsZ~4<-+b
z0NC(3ymbbSa75OCZ5)7x6JnPhh6ZSW!z{Li#0W+Tgate-kHN>^!4@MLQLu<ZjgWdi
z;lvvZtO1Te7_(onyak(FfsfTfLk1QS@Uda2IJ!Dmp9Yq+U`am_)Vu_>+R)Q9EJ?wF
z6jouvEQAIfqQ?(S0x*khp@j)7s*`>&umyX2284tAvWT<}@)&q)1G*1j7Q+mLl@=I-
zrcjGuX#ib4%)zj<0!th4G~mDh-F*s;TbNH_2Elv+FFl}hH?X*b(J-GT-<Y<UMNTOh
zS}(!uONOR#n6i`u(;YUmsMV)3Ft7#qJA1o=t9(Sj2tlixR9N1G#w@G{0vmgVEn$cG
z6J0&bJ1}`zxI)eGW`LeOgn1YYw4Q_c50*LM7NFI0sT$J_wy=oRr$Sr1u%rv~ILu;L
zJq9ZbU~M^Al7y*)tviAj22gWh4GLJEghebg0cZ=u42EYyXnP;#5m*eQewh9N<lq#j
zM_}?W17YgYHZU@R(*~%4gVa)hh9Cn2cu0^>80Jw}#S7Q}f{_t?s0NyTXaYmDG+@nZ
zs04gdGi<gHmj&q>46MN+p#3A$6;`u|*LN^7MuY7F5r`C(4($clLPsHC?n__6zzDe<
z1XVrEf3TDW(+_KD!S&x@V6}&@0^$=0f=yh(HNcWCxHLqJ62eML_@-;<<R1DwQHI3y
z9otysvSCd=n8g_t42)JFH-j<4qp%2#g_hpX^ON8m!whJ(ln%|JaPw9$uv_{0`#Ji$
zLK^w7HY2PJO0+>grcc<;B4(8VPBwhPP<`+zc9;WVp@n8TG_S)Pk{K}l!FCq0dboaY
zlaPUdK?&qjL`s91s|f8D!OVqaAy^w2mc`&%3F<ENECf>z%{kKl|3k9|EFj<xTrhpY
z4i>R`oG}cwAQRf}gE<t|34l2ikpe&-!{R|`0Kv)<SlI&gAY!Bn*1|xaaE28sFo$Oa
zFfv7fLlI;lBFVrGyM)(|(4+w?^kC-0$`(jj!Gq}TWJ^rnu#<=ofms9#5!eVhu^|Fe
z5A#rV0V9(hIJChYvVkXZSnfqHoiGge!N3m6yq-SLL=OuxjK&=_7sFf%ixZejaxA7_
z*u^5plrv%ahh11g0#*^h(hR&_#ZfB2G9B!a99Xd<4E8Nz-3VMAq}2}#0K_)AoDI__
z>;|o}hb}NdcL0nJYhl2fLa-VeVz6)yl!hf*xWk|UgFZk7b0~Bv5yC;a0n-iku*lWJ
zTn??d5FH^<R3a^6hxr^9(zzcPSsguGp%c`IM4SV42rO+u+Gu>juo#2c2TRm&37Elo
z9@8J}VG*mxFbEt)xDA3?05@j=BTI;fE5>{+tUSwuhAjB<Vx%5s-Va6=SD)bNrF&Tf
z5rrSLv?k;mm?L0W6=n&{QTYapEY7g?Wk}UH%(JjifvV>b&Y!`^?&{|P(gUszFkJ*{
zJToAI1xJS!K7|5vSw7VJ@D?RB-q3?1{{$nGzZ*C)fW`$8dzWD02pgk;Wkq<zLk)xl
z2}~T;y@846p%u@NQVroDSWy585*I$<f(S-dS3ei1qYx<%<{+3u@}UU^)c`)>f)~>>
z_Or-o!BQfujDdAeU=D*=$R}K=F@3{+7BMMU9KrO#<qM`i*pH>6MNcb*Q1_sRaN&aK
z1_!X|hpLCU2dDlI(;E)3h(*Et4+~IOOvBt+<iN-l<Qm}Wh}Ou5=_`ar1T1C1^;Jy&
zaDYXQsc6G=frBh^^+nK#g%wp8DGpjhLF-5O*c8k?u<(PGIIwVs$-_z-c*=w}8KL?R
zCwIUC2JRqeLjmsa3ye(Aliff`7gi_>!y*!{59%SP1@M*<Y<nTh9!Tb_=M#o&M6<AX
z1|u`<EIH(fTwE5yvjo%uFpFRgfzc@TfjY_%mmu;8%*Q1hj4ZH~_{a``MKRn$sKa3v
z7C~DY=t;ArgOODmZXhJ9fji0=20|A}5j5}yBdd?ABm96mSSuafJV|JW6K)<fgv1Vj
z4~pay#u_w8#ULz1N;MeS?BO;-d;pqj!>|zAvBP2^DD5EG2QDrU3)Ns6;1<r9?r{V(
zoCGxxG`0Y;5LPO|SCT?~1Q&-!0gR766af>5_sh`q!{njvU=}XpnEnFUA+TZ)ZU8h5
zz{KGeqKU&=6tER|F!gYc;8G81>1e|za-l90E?dFC=I^Z=91_Ho54nsGRJ-sAmq$$B
zaFj)ksk~tNg`+HLOyv`%{{YiFrYjs{(PJuqFg@THiyBjf!1Rh^pmQA{7Qj!qt$?=4
zVD?m4Oy6;gMNSKrSzsQ)P*=gg9T4Q{7ot1;z%dpvFPJ>M2?jM67Q!$(2->BG1qh6W
z+rMLa!f_Tg_;fJ5hdCGGUsy#5w+EVHV41WW+C_%-S7421H>kg16(y`G2rF-4jc#a{
z*_z;>3d{gV2M^Jms8pElaDqjy9=1XVW&y@5Ei`~Cpbmz606Jv|sR%Jo?8Uj36Sd1+
zFI*1oTB3&p++egC2OiS@@P{;H?JwdWHw^Q^Z7Ur<#F@j;MpGrUYKBDxEXu1GrgxlV
zk%MnAhYp@2#?GM*O@!))M?JJqfem=VXlScl7#2gY!UjIN12qrUV}xG#kc_YpYA`JA
zz(WR_24SNduqcD19Yn=~VIg#&v)W^N$0>Xsg(eAD8ijcXMx%QS%>%@`UmL!h7nUhu
zA%mV7Ydoe0oMw@O?{Y>j1!2QAurv;j8E6RO?4Lm^s%qGPEI7as!%H=AanMGm|IYuR
zCw>dV912T10t*;eT*Dv}fyh<20NSuj?TP6IXISKdV67#%L!luKPt(w186M-%ya11J
zaN0&>_Sz5A7o1@c)5?Ul0%0kl4w~d)DFNo*x`gQu&akL4)h(FLaTYX$3@yE25dqf^
zbw4a%VFR1+ZUZ!cVg7*+o<PNM>Vwsn5ck!?&rpC3?ZPaAjXA@_VWTH-i=YmNd+Y=Q
zqdKVE0Aoap0hU4%pv_U#QqY6}zNx4V>N41T49sV+kc3%OzhipBIna;*tR{yRpRj>A
zS7`AGTNDRdvj)kd3=9n5b)|g5u>BdZV%iH<e1Z!Z1_lObNW$b{F#|ox-B}oRlshb_
zVF#m&IDpga|Nr2M0aOY?`OsN$m`55Erdyn6QDbWOF+Bl9H!4i;0Mj1RH=JjYt8au3
z;=?jIEQ!EqjFCaufEzSsU@->^NSHpDIJ^S^^(ago)V_LQ*w{6Aq6sur2n!iV+JVoc
z!2$qg0W9yq3KLkGm4NLdgwE;0<Y9Cp)Zvf-V&M~RESP@b0*jn7EDbe6D>R4#KH;Vb
z4D2e-L9UJ=knyj2^ig9z=x#PxE`-Hl6g2HXN*zSG4I9*jTX2Gb4PrhhRbwXVCe(!y
zJi^Tu4D6r-vt5JjAma`&zrk!mUwIG%T?-16hxOuME@;kRWOea(4F)G#q>&GpPnx0n
zVLpWGJHf!=?C&?-^%9Gu6D<5Nf(N>+0j3#7qX$C^!}JB0Sj2Ff!vhW;_?Q$<a}uWi
zxWppoh08s>Yf#OBH9>Kjw_|$3WfnP{?&5_W3=Y!|TiAo{zgC6m2QIUS)#Gv(ADTI^
zz;}V>9GLkS<~D%WW;ufAO_3rGhdt2(d^xBAP!DY@<Fw!f16y!NP$>GgBUr$}QbU`^
z^bJ>7<b+`D3b=T|^aod1#G-LHNPzbas(WB#53t!BSS5k(@wNqw>^`0$u0haUL0Yg7
zgA~Gu3<vWV%t7rO(<fYIkyA$ZI9xt}kt4uAI3&Q|Z#v^;7EySVK?^NmSkn=;njyZH
zfi*EP^uuZg*oY>Cw#G>FFrUJF2BXm%F6|xD7hGczlS+dYMeX1c0MW4MNSJ=%8jDyx
zEF@s&!f2SeFd7y@9TPwsdZFu5kkTBikcKtZVF3ki2tjKn*!o{+QmGe4ua99N1lI_y
z4Pc8&VU2G1ItgedfjjU9BNOb<Xyg_f%%iAH##p2cH_)aUECgU3Q&<SVXqW@Q0Sa21
z1Z~p69MD<8z~SWT;TY!WKV5MHizwvIL6AadRKOMfm|k!Lbb1OX6EN@zD?r<Luv8CI
z*JZ%K>g4YdiC#v-j*f%rgH^b2eHqgq++dLtLeD*23#JR)WRa`KRad}03hh;NU0`HN
z!LpwRmaEa1dc*2z*oFx7`WmJlK8X!;aJR(t12>V%Nti;|kS5$<Xa$eUVDw6^yMd7@
zpLh>g!^cKoR|^tt(TnL5ZXqsO=n0s<0mOwiO?wKaU%160#w8EEs-<Vb^bcS@w6oH)
zVY<L=7I98!q1ba_x&ep_y{4h(!}NgLEMi=8kVT2Yy#mt<ZnMbMOG8^Vy#@^28D+Xf
zC5gql>8aow5<o*_0#eZ1EqWsun1h^PO)NeEIjF6@6(Dig$rOA7ve5Q!?*s<spm2nG
zS*SaDSAfLf>gxq$Ap_UKy$2YWgM5%QfHMf6aPJL}I9!8(3^c#=eqdk@ia@BBfjYF0
z10;^59@<yyQ(zFtDAUc!PtQzF%+bwF&CM@hV3^)>hlR^Y2AYNXEEw1_%5;+x!FM|I
z2}nb`IeiHXJQ-!Wr3ER8C8@e8(9q!%kop7C$S2%aG5y9J7I{wS9XEY5rrl+c=Y*#J
zz5~-W?y|^nNrBzUC*1d9dH_fos<&TYdIg9JZCvzQOkV)vLR;tk3DZx2G)sba67dQ5
zcTE2Pl7{w1`Zr9MxW^*T32jLB-<a+I;({H>Cp>{+dd58#IWBRi%@Z`HPq@b-uL-TT
zCj>C?LGC5fO)J&~-Ae}cjevv-m=>N;G5rR}G-#i4!i;J6S;RS^&G-oirYqcMk>`Z=
z0wz3|?g8RL6W>IR=>;Gz)Ljz|rq8&~BFE(c4bO=Y(+`08&;Xm*F#QFX4=s!*u9z<H
zfJL4g+HjkAfkAY7p%}mDbpHn|>|E~96fp6}^n?d2a$N4vn4hFDy#vgLHaaJHOyBT;
zMNZHiyhMgicv1m_U}&(DZp8Hd2Q1=T?$DG!X~wjNEaIGyi^zm09hk20kVTBk4VsQ8
zJ(%tQ=0nr(WQOSpU_P`TH(6nN1DFr$D>Cp2Pj;BT;311Vc)2`?o4~*WveP5fN!Qa4
zx)X_kPrwy=nabo2h`evGGpal^(@$Q3kVn3B#uZu!Og;heQ%I1bU$C2Nkgjt`5GaRF
zw|m6G$qCJ)lV3~^c*G*71sk=VBEZ0vl%HRcTb!<&3{Ius2p4dH`e};A^cjy><T;`D
zzf6gke&7*{7?(3NNTxJQfAEM!j>{R^?wqn<I>%!W9~uNxPE0od@tyX7jTN5qVR{6Z
z5ABXjm6+b}m_>}s37RvfI!s^im_@GM5jx#4HGzR6udFCBS2r1)a6zVks$xg*{eOJI
zQ#;`Duxt)4svMvRb?OS3Jmj8ExPC~ZNO<ZAxID7{dI5(mAf<f5Q(wRo<e)kLnvkY(
zz~zw*5O9EI+G!dv`3hA1;GGnF!qYt9^2qx61RS6}o@p5jBGWGza)?a7_k@Lm%MP0P
zr*%yK@PtK-%NAO6OxrMB;3<nZrvk*;(=JRmc*-KjV-LLwYuX0}$?1ub9Fo%&p0Th%
zt9Jo=XsAz@U=YqrEuSv%j75YW9Da6CebYUrZ+Ob0#$^Xh4$}*!KX}R_$7K!m{`3XY
zIi9h|aalo~G5y4J0}$U9rvAh92oT=}nqFo|Om6`5p(Xtchv_Rod~0a>n2|C4!ZQ}R
zdMjv}pD}@fFFmzH7m@~&5{py8{u8i*nm=O)vV3u76-*x52%d2RBA=F%Se&7Yq#tAq
z1E27WAIS1>{q+KtPzTSHVBi5cAUCN3t{s#BEumxdGc6c+d_0}PTthr`{R0q-5n$)D
z&x~N;g~>bn_`{dpT0;9zGb<4KgJ6p-80z^1EWs5KpYY5X2m``{JVU_ep)l|XSU^jS
znL8LbTn)XEEC+dwPrw420B7D{-~`DdEQiWN6Vl8d5d8?t!8@Gz1i(ci1E26L35Wp*
z%OM7sL!)e#1p_b00$)dG-C)-c=v^Ru0_I=?_=IOgFmU*}hUohELzj|(v@`Gtm_du~
zSrriZ08c;2{mo$eK?<gTRPqVWn!&&cDx!3AQ}aqeLSW1%U<NL(_=IQeVBjn%$ki<_
zNh|`_b})IE18y+zfaKFM^AdBQDFhUSX3#Qi)(-|DkbF*RVp*zgT4qsh`Si?}EWBK%
z&>C#E#Po)jEOK0?&_p@gVfqRX-vnC7%+8p8;U$Y2mkG4qo;_jOD;9Z8Xcn1$fPoKW
zd}gt3d45rLW?nkTeS88Y(5iLzi|HP(Smd~j-+;x1=Wt9fc*Ua53C){x45lvtaiLv`
zISJD*ykZgKGKN;%b0$px@Cwn~n6qKJ#A_CLPH<VnCp_oIbcfe0@?6l4&s+wE>8oe3
zDNgTt&BDtGts3WQOkV)f0<HAsCQLu^nnjJr5SqT`b})!fU(d)d4yndKZUhCMA#{Li
z?hXc44^I~ZNa4jNU<fU?=DvW4gB`-aCtwJzzvnT4#SLNV4WI?hJPC+6OuYfLBA;gf
z7B^7@PYW~f2^c^#&O8r@1Y85u;&};RaZ|VjFpDc7;xP64(8!%Pfq}(0I0z!lz$c&&
zt;y!C0E<J60g2Z`V|U&G2G(GgAVY`_J^_7bMxA#9A`a2PC!i0idl~qI=Y3#c2?#@2
zpa+fT`5d6@7?H%G`Dwla151b#to6$$pa*R@)z7y8NrXb|W#ALggC?-~0Sv4zj!saM
z_ylyJW$}E_mS;z&Aee*npjFQN22e=&Bh*8iGxKLa#9``np($Yg1_rj^fS`JJ1F+S6
z0=m$ko__)?;SPy>J^@{5)XWE+{TmSE4hbSY0Uc;i&j+o}2Z@7i;1ke=M$G~Nh&j-W
zy#hMWC|IBY6$h)Y=M&I@M!^CHh=eiJK|0VVSP%gf2W#LH(1Aw5f&vD1kKlkHs1G1%
zn1N3~8ye&bI$-i(jR<*YR4rJ+!0u5GG63QwgaT+3EI0u*0Gh5L3it%Hp>en11p|wV
zt25ZSpxguN9W3Mki$iVY6VQZ)>_P<wHeX-oAXvz1t1vK_ffgAo1Z`>bb%r{FPe2P=
z1T73;VDWTzf}ShMC!hr#09gEB`hoW>;;_8FuwnXx_bhr$O9ZA1d|*-IItp#FFT60_
z;RB0W{X(d5ux>J}JH3d3fz8>`$43`D`NSun360T34h&quA&x;Ix<Mh(u|sh4K?_>_
zE{b5_a`Ood_HcG|_JGt}V0lewN?BCFAn4?)3)-0L>=@!d{pkl5Nv1_JrhR0QV_I}z
zy23{mIjKbt7+9TyV0RJn31~r6$6|)*5g%FPq83Xqu(^OYXM;i=G4j0_T4KWd0-F|s
z4D2yL@2BMxhN*+C6ovVDvBmTYA6fL6qza~eViDs4w+9&bgcoK^SNO!D&I#u82`^kQ
zJ>V0I8dnjtZdg2Fdc!BsemiIb6FN8rU&8>K%Yh9I#X$!kU_(T(ZD}xh*kBw?9=0zK
z;tM|ErO<XglrQeE8XOA7@T+s6Z9Vv!C)fZ4Y))t~G^I!uv<G}<X%G0!+8*$kZF|6H
z_Ib1GUqY%-p_ky4%O~^_GV~_&65?v1myjx0=q04FA@maBYoV8r){)Rlh~YvnA>&m-
zFCn3ZpdsA=p_h<!C-e&Bcm_TgT`%+!5{W|Rpbj|;srH1<LVAxvXCeIrp>t4mXCaLW
zp>vR65jqR$91EQTI~;5}G~z*QKA|^IbI-x_L84LU9Jqa{%qMgX(#I7#2Qvs#?+KlQ
zI^^8shxH<|;G?G?CccNd<N`E^E@(^)6shMEIuEtsJk-VKp$49ZT5theM}y2@U|?W|
z(hT5A8I)y&-dli{dw>s>fbcy)e3&{uq4!`uD^!3_=zRc49;!c;flugt21tMnuHYG%
z&kg6luK>wI?<fbU?_gwv-r)?fa0VkINCiX#pV0da2p$7S{fX%>CUV%-GegtB?G6TR
zCUAEIq=QeG85*>=S1|CffXfG{I5e%?zQMrD0ZwO7acIEYe!(ClfNTypO@Y)fs4F0g
zgOdcq^re$H1f`h4(F0bb*??^5jme6PYSX_>;>cj!KRtdjhkW7zkTiI(fq?-W-k@e7
zv%6m?L(~KDFptOuRu6?{Fg^L`^8JeTGc$K*XDbB_cfU|g1w&IkBRxX}BLgE-0}BHS
z1&yH86a|mO5(Vd?{NiG$w63A%WJN~V>3b$~C@~(Let$BDxa2)>t^qp^64#J=P&{Bd
z{}c}K`uhkEGBAK59Go)vgt@^f3aX74u>ye=9Dq=9A&7|#415Cp@IYo@U{DcaU;rl$
zKB3FtG|#}m0IJ`O5aP!nM$|JffO4rDLgEfMNi#4ofHILULi{v1FEB7Lff^7A2=Oc6
zqz>H(S%45f3JPfk1_p0XwOo!6zX2{i7#J8qr9o>wLgE%UuP`vMfkI>gLi`NOf&&Z;
z!e0>LcVXh7w)0#haY)i&U;y=bmI*-f7oR{W%wr&*Z-J_>XW$b$1<w8q42&R`orOv;
z@CjW6@j=N1ltykN#E*j8(hLj?AO}1^h+hIn9RmY1C`A7u#IJ%v5)@N53=E8%2=U7^
zU<W%VFfcHRA|!6X;$DP-fl&|PgEDYM3UWRJ1EU>6{ZUX*f`nTb7#KYe;#Z(i#-78#
zz!-!OKL%0@!Xgay42%haupO7;F3>mw9jMBfgV1mSoI4p9m=-WFFg74L2wbdzOk!YQ
zoQP0=1{Tye7#J95A;j;1O9ci7MvxKUs08;j_=N63gNPx8fq`)mLc>K1h~W$q7#J8~
zamK(WbQKykj2;XOjQc^Rfz<H{OouuY#A7^$Fy|yxJ%bJd1LF;Z__2Ce?wrHG!1xj&
zaTDq@rV|VdjGvLj!Bq_d1H&8!1}0{N_$`>vd>9ybkfP=|)Etn5m_!ij&p;hi56XT_
zNcr^=)B@%u3=B*L2o0y8LCP4yz`*2+5I+h^Y#`Hf7#NrWkwOAo$$}&p7??5<>Q5o%
z4yGERdU!!`9F&bf>LVB!nA#B<&O>tt!v+QhrkM!wW3Ym#fq{W(Jwp5>)S(O@2OU6&
zUxnrl(9uau7h&S{d_u=T`5n|k(_mm=x(Acs6FLh^6BP^$Os^5*r(wC{0RscmZ-n?A
zXle%?lf%q}5I+eGQHBK!49r3Z@yj6fp!CQ3g@J)t93gQF>QcrZ3=GU#0t^h05_`u7
zaQhjuFo@Y2q5du`j(Zpwm>m$}H=*V*lrS(bBbB6QVTt+#14BJ?GD5>Gs05<~0|Rpl
zLi`Lg3c%t$2=UX<5|i-&0|WDHg!mn(ID-lU1M^~p_!Vd(1w{cfBsYQl&nI*d=F$ZW
z3~c8SiKqzdb5NpSU|>FqFz7Bc3Ye!bFfgA%h#!NMj13G7%#RV`r=e+raRLJaGg5B4
zy8>iC0|Nt>4g&-8UxbEJ&>&@OVPIh4L5N?08pKe*z`!Dd5I+UYPN0H?#RegM5*l($
zE({DTJ_zwMuyUflhJk@45+QLKRHlPGY{0<4l7$ez3Q8;>aSsLtmP&;9U1;KB+`z!V
z0$LdbZp`rsz}twR`U5G-PCz}t7{S26GE0b|9#&7^gu0Yjg@J(uDbB7zqlO9O&~*rl
zFTxzOfPsN!KfDMRW`}tom4Sf;p3V4#u0qomO9%r4%U!rR^+HFXB_PuU1_qWVa0#Ik
zuqfEVz`*hgA$}U_V~|5xxe($fq3Rhj7#LWk5#m>1>VGgWuo@%8Z-G5f&%gl6W~}ar
zL^mCl?->{vSfdacj>DRNDhv#)r3mp8P@gfnFfg!oBgAh&gPO^Qfq`{8Li{$&p`dO`
zy)Z)JB-9|54h9C+c?j|Aupo_LU|?lMh#v*FeIe}t)~yKf%djZ(U|?WHuAIRAXiy?z
zU|_ujQ4iXFA#@sQF{s7D`V1lgYGhx5iAyjruzo{`ABC0eEes573<&W%FrPUvFtBmL
z(}cJSEL$otFt8z2LRT{&<80tlV%g*n2Hk}P-3kT<HdTc9RagO{!oa|0C<Jd>6++_}
z<To};g!=0+2i;*{VDm&oanTcyN)WDRU|<V_yHuDRniv^U85r2o5C)xr7C4~tfGrOp
zegoF>FJWL{L&}!7U>3VDFt8!T{Y6;G7{kE8wpNINp&r^yJ`c43lzQ3rAuKosYgRWf
zFtD9P@&PO)7#JAX?jY3PfjS6ORI?%Fri)Mqff73#Ql(XY8k+B!4lppVBW0(HFbByn
zFt8()bjM*1Qej|VH$ymRIxLYgFfgz?BZ(um83hg_9C{qmZh(}(JV?3VD71IPc!7a|
zJshFoEHq6pykTGvo{A8^3-vMR&P4W10ceMtPXM{U$X<+a5M*-_DDD{;*z1tm|2JSh
zj$mM5M{3XChQ%33d<nwhYcO#Q1_pklD7Xm|H(+33htzW5F6~8_2j(y^u)``dQ2YM`
zG%gtf7#P@*+WD7Y8Uz>^*q<XTz6~z97#J987#P^!AjB_0n^ufD3=Hf)krFkuJOCwX
z4t6B<KcMY@78M2t4grM3Sy)I^Ffee)BE-)?9m=qRfq_E{A$}a%YzLKq97wg_X{g1_
zAq)&0-U#(KU?CL1P|v`D)Bw2w^%>}F3XU3thFj3;lF5L9fuj#0ehn(l-oU`Xfz-~w
z3{8xnM9r}Zq5e3u!~~@cj)Q^>3_RfU$0u<FR)BCYFmPNzXt)E-9gG<a4BX%j11RC}
z3EhR2j3x{W9M=)*k3pMg3?K&~m83VI>X}j)7}$_n!$<33t=K;d3>=>j23>?zLLm$c
zoJj5bJ23G%3=Evy2=%8BLCV01RFa;8h7e-|0|TcnLj8GYgQXtSlHo*ZOx}UUJ);Z*
z1E(`W!zpM8v2ZXja7G}+@4ylr4+8@yQdC}mMggej#94w+e-kEN!@$7VjMV-=1GRuj
zgMopw7op)4G!Zd^EMABZzW^=KK+S5-ji9&$M~%c0SQLQN??qA%D<>8(FmS?4(t19D
z>EPLYkY)x3?pTC|>rjiCQy3UHuOh^c!P)^G3=Et|jm%5X+`;sLfr0Y_Lj7fE6fl6I
z@;^fSIw*UC(jRjL0|OUQ33weE63h(@3|z_x4QHTn&#1z{z@?24zXVI9cNiGBED<GL
zDZG|rVBm5=sJ{bq&<X~IdM<B-hH22A5GX9Tkc!@Ou*7A-z`%u+dQZT_MHm>ksuAXt
z!4fsdpgM%bH((BxVPN2bWMh#3`Gk&wnnEDO2N)Q*kn-_OP!PeyS0D_!42ye^#TyXf
zC!tZsbcBI{>j*;pI<#D20EG}z_P*8uvY&y0foTf^0~c~WhIK}FFfec-6}@MnaSYl7
z!G+XcI1cjwsGLCR`<;OLn2Cddfm;mWpcAlMQ-6nnfg7nPJq8;}X<%UBMvAjjP#=Jr
z;oM;egRVhCg7pal19uWa{01})ff5}zQa|E6EDeF|trldchjuO{V2K(uhRfZL$WG9v
z9=HX^Jp(R&a2i+yGA_uy0AcYRXu$%ioVb@G#IM6bu7ZJqdox_TUg#n$Uw&a=;64tQ
z5IPOhP{P2#jnpl_4NDUe3=G`JeL1MlK%GnOp9phK!NeypFz_Iin3urzg5rM#0|SpF
z+-DN-;(&vJfd?u3orT6FBMSoq57NlUd1%ytMof5Y5sgw7SV_mgz`)~$aL{#V2@C28
z@zjS1z(&8Ivn!zF&cMLmhR|>iT6utc#)Fjou0pdP%N7O(9;71nI@o6n44}3oPcy=t
zlTh^x5ey7G(;?#up!WYENK*`AG0%L2h7+*3Y++#F@<HTp<Z^;%GeUeiDDgmyVc<Y&
zqFsiD9McpA2A=&0^Dj$4+y9J97#Mg?APg#nWhYS3Ar-y1kwfAY!k{~_)Ly~B!1ECy
zei|D0ECCD*yht6D8_?{>GNGP<ftL@V;UrW8QwswFuOveJ2DHdztYKi_HARSDgN0BC
z0|RdeLi{XD9F&NWx^j16;w20Wyomy!@fT2d@d->rY9{j{jeK5)Y7os~VBkfH<4aI+
zP<g=Hgs}JwERIhwFz_M`VxIyz1Z33;1_s`x2=(<>phYH&1Oo%_4n!2NLQ^$J5AP|2
zhO;p79}En<H{gjEIu!^~&A`BmG+K5M7Bv$X7<iFN%yW=jP|v_%!N9=BkFXeCuz(uP
zQb-m<qX0DH!>5lBKMhOm0SpX$NCT7CpcXUtFfi~TH9oIFLju$y;)_LY|HJa@1O^7a
zY=i|@ATDKKFkxWeD?>Q647`RE;$uFf?0OPr&ISesKBT_id8mUx)i>W3s5$ivd;(=i
zqg;GQeZR|4pD}_$2x&0+Dm3+iPPyYl${oj{)h=jegAb`;asitC7!EKn@FC@n>lM)U
zKd4~gN2;}M!7P?xVBkmUuiu770pk}227aU=mNU>a#JGcjfnN;~a%Z7FW;nsXz;6NX
zkchj$YF7n@dIo;vS`KP4s2t%(YJl8^Mgh|U1_pklZuuQpP^&O7@aMsc@I!lGiIkCn
zfxiObpwrNhWBkCtzz=SKfXaUcKA|hHY$L(Iz>ib{UP3Bx_}4+>3>0PHRj`n_=ih^{
z;25;J1oe>kPa?#xL(K<uZ1|C)>~=jYh(Z_`_>so{FF}34;={ne{~ck_8EAbE>R<@4
zAUOzLYcVhgAWh}mfTng(6bm2?^WTD&AN7nP3=9IGS_?W5aT{6!GMg|k2m~W6J`L3X
z>QV_HwewHI(!>V_1_7iIkQ*?E9$;V)XoWje=qM!6z@)$w!Ft%}w!{%=B4XfRU=Tox
zf)miVXIR3(Ag~ePpbO9-1$8h44k1;$$RTkJq5dK)t*l^R5O@nqjP-oN@M+*w1_lA7
z66zu}=on8hFbIN{n?r|Irz7QiL8Joe7Az_!Ffa&$2B)AQdJ-Cy3|AN!1f38LIt5Bw
z;Pe;5z#xcJd0c=7HK=41L`v<qU@adF1_r@0gh97psoI5sK@h1Rx(W?BP|ryasV=w*
zjWPxi28Mb;q;dPJFbixL7zCFgEVu)5DJaH37Jx>rpgy|_i{k_a2ElCz^><-Wslvb@
zh*Y4RftmyAQ3*l{G?4%Kgf78cbb*0E@Cw49lhE>j5oEzrcp?&*22G?OHwhvQOkRM7
z1n4#?A<$SnG|E_Ety|D&8PX*5326HRJOC-gkFfYQEU_G5U=TuTx8H&lrE3@%g!B;V
zFF}JE)Oi&`8UZ;58yTr!U=TveO?O}+RPVvSAcQo?d;;oYh86|}A*6xEo6w*GRYF2Y
zv)Q*`A>qKlAk>L)&{bGs%wS*;LYmM#12g{&1B1|J0fu_W>JL7F>EKmupa5lH5JGB(
zABT;I<}fe_-9lJ!0vbZhpb$bTxNbmw#su;h(y;weSQOYWFbE?CH0p(pL&y6-0};Z=
zK@GJ4)PoT=L0EhR76lm$48lmWU1wl%KZAim*bkxp7|i?*1_r@%2=SxfflN^P^I%{Q
zjzJ`@V(?N~NJt2$A~YO_4J^E1U=T*??M_3g3xtuf-xX-oFo`fQ2v0$na}SzUz#guj
z3$L{xyI&X}ht~=tO|@KxW=qB?3=G0M5C)xs83Y<|K<Xjgg@up`1A{PhoF6ote-zfe
zFJNF0hOQgX0ZCkhWj`4P24Up38`L014hB6RXG6>F+S@pO3I~FNhEISIG{*!QVgQ#0
zU_nrmO@I-!>IWnas>NZ#415BNd<+bX#-K?RxFAHm(Da1U9OCs-3=9n0u}I57#nFvZ
zV_*Q)36Kdan2~$}j9O4}boHQPRY4(!?p)CJ#0XGJ2wj600|Th5gkb^b3_y@U=<0(Q
z7#NMPcpwZaj;<cGoD-B=AgiFJx1Q!utG~&>zyR_X%s&i#0?Z&apo@XPD{3Lrzn~R2
z%pi~Qfl4&EVsLme>wzc+1_nzsaWgb=khvi9L2DR5F%3!!U@c&W@(Hm1nf}0;OO#!J
z4OIB_O%FN4ahmbKbcM4V`iwiK2b|>)w*~jp_ypKNVGAm2p~amsI4|-Eu!Bze134WO
zEMTKS1fKvqC<q;=FFDJh4BeF~z`hBzLWO~W0jku<VETiz9O7{4T~KLou4P~_GMFxK
zjzdh!2wY0=32=Zs2XX;IyTdsSF(tS>D3(F;aQzUMaD14)-~gv6vjC^YwEJMXV7kH{
zPElh4?o$j547~^kfz*S7o%<YA9BL9wT=dBF1=l#lq`*rcK`Uz^(F&1f;1dwjnI7;4
zWP{j>=>qngVn*ViYz?{$6iuNxs65FBO-e)cf+;=$@d?uxFmsAYiG!x`KnL!i>5~wd
zen5j$j7cJ6y1;x+(PROM3k(d5pxlF|P!hBV1)Df15rDQ*p{oaNjaZB6AjucgFEDe8
zF-d7m|8RvvOiBurpg{*mqv@BLF#Q5Qrx>HubbS_1@g%8h3=9l;m;ozw4=Ropuu_j0
z7#Kk11~h8H!NI^MAoUC?j;3B(VY<Or4lyZd(DsZhOlM24m@dG>DaIuIX1c>YP=v_%
zOkYsPDOxWe1M(=SwT9*a8BmiFwATksTozO#U{Nm%$_CifgBECGQx94ho(ftnhGu~r
zD2rmzAP35jSS*lhfp}dG<lv8(UYF+p%QMLbK<S3*3jaC8nB=!iZ@A4N#-zY9z2FQe
zNE9-rCunerNhyH(GobW_<}gK>=?k8Kf=m%KcJvd|CM_8T21Z{j;u$!^L96;e1s9q{
zhFcgI7(s{Gql<$U%S%spS;r~pEnoyPG!)Y^BarJs3&GJe8*4ByFoNO;UA$y^fC-nV
zv;esL(#15;_|Ei%N1*UA;hFwn6PV#L-JuK2m@>U#6_{~j`U4X#QDy;Cf$0IaImDz)
zK@E^vOv6kYrW@pd6`q-%a1o>sw3Pyjv&=N69{}5G7BO9bjZ>`N4AcVw-R6ttelt*U
z47#WeP23#R_WF<M0&~z9F6iP`boDP77#K4#)mwmSpwA4`MOSbNFbh~@OuN7-DlK3E
zin^JYsx4WjCvb6!Nm+t+-%ZCNKVkX?K~6CytAObn7(wA+^=7&OC>*Ro)-+>ku<n_D
z094M{s4y@vVku{A7EEur$|1&NYcYL+5T}@wEhz1P0w2wLwpYN3ms!A0V7kFS4lyP>
zlj#MZ62UHFdP5Q@4((P<-*6683D|>*N^?x7*n=h#LB$=K(e^*4e_-bnV{(X@zCo2s
z)L6h_1_J{lXjv_qLWe6142-6j20IE&p8!r+jvmt$K%Q}|nC<|spd8msH<08MGjasY
z5P<4eG!vab%`s3dhgM8Fu}ycl$ss1?1ZpaP<k5;tC!y&DH#x+ZoJ^)aSPqI$Cs3IQ
zQiyI)9@L;R2FPJi=mu4R4Ki{9g-s-;*PK8_1?Ze|G>1F$OrHRX1?QaU3ZO#B`M`9A
z>!4V0VVPcVjYEvdC1U!5%OHBfwCfyVOs)*m4SGT8#noqegCM7vkt-+}gYpiV!LFcP
zwNEh};tD$LfJ0mo)Z+m)8_=}51xy#Xz#(Sj2Fhi#FtxjZ0^b^o_?PJyK+bj7m~L=|
zLyXDYXL<k!r<jpDs0Rfa_CT}8eF_5usB6xEE`DITgEuH5+`lj|Fk%TX4~OXjcR0kP
zJU|uPeN2aVESN3;F2y}QOkWTND$hJYO-fK9fEJ~mTGJiwaEMESghA41G3seHz2FXq
zcs;1L0aaaS4)p?=+KyR~dx09JJF$p^%6E`@G;6#-)`Qfei3gT2Ffh6?FleENP#|cX
zF{o*Y=Aa<H=>~T>#H4~ifd*>CLJb6!C7`BTklpkIu)Gs$W0C>X5@X;K2uhf)a0rz0
zf=XbF8fZ}wGyx_uXZnFYu$lv4DPw_PP=B!xGa7<H{XcBtb<+dxafmSmH$aUHZkyf!
z7MKDPm;*MNSs-`=ScFL+c)I){PBCVI;6G5A5CO0Zvp|T{^auAi#3ey-fz-YQjU9o!
z9HIeJX8_ab0uu>=F&4lW+ooT*&mkriatInepvnleG8Rnp34|P*_5dUeY5{|KQD9-n
z6d>5HOVbU&@}LGDNFEye44`Hb1D`-B+w=`*IK-Gj`KC9V;Se(l1vLUeZU)6a$QtmN
z1)o4@5!8C9e$ZMbkoln%P%nh`Kph-92gX=6eZpf7vHDQ7ZUU%}4b}>(89@akEX9CF
zp!ozsK~6<-0%$P-SUspM3KEAp0WJ<Ie6g7WDt`DFrmG$T)r?^*P=|&|fZZo85C%$-
zAoHMJ1+BUU*%PKWUEv{zIHLhr9kW1~1x%+8Oe6-zfThVWi0_jH!j>>FFxX-yyfB#K
zVU~f%6Zr(fKn-b-BVe9_iGw=ppez9k9B>PpPavFc`h*7@VqW2(E)B9iP{L;569@;z
z7dCyMLKUPQW<Pj%flnaZYI?$B4zZ+gQ11wvKG3z!$ofEm4YDT+H9auE#6cA>HgozQ
z=`4I2IGr(tUw{T-_!Ai82aNG=`hzDNVoVWC(*>S_XdY<zM<_s5MC3sXizu7^;W39e
zBP2&M3q%}&DYyY++=H6+2x`_Fs9BK=U=`8=k#$gyKm!IetO-g5k<+Fx0NEaS0;b~*
zSO>E}l-KlxXB=WoQGV0FR18!>Q~^vu3yiT3s`4B}C9I7T^#Z2g50nut0yQKWRyIW2
zz@)0CD?H~AlZtMGIux2x7(smy20npkSP2!q0A|J(nAUe7`^6dmP2cdGL!1$o17aXK
zfLS0$2dXf}YP!G+4l$+}ujvI~x(=jKj47rGD&7Ybp9C>!2GpjQH82AXfEm&Pv7mYe
zDZPMJcY}g6)@<5K4l$-!SV0#X05u{u1+0@<AhrU=fW)G-K<p)`k6}>*o=f8sh`l#`
z0@$zzFdeX1jf2H%9Bl9drWHKQ#wQTxHeKNrhZs{FtelNYfVv|NmX+f=z@|zI#DNAI
zki7yk;}+BmSjvt205v0?1+0}>ARZRN@vxF29+Ehu1>!-M4<VZhDg_z%1mf$aJG|x)
zV~X#983rpy<6+Sm52@Xl1>&#3?13eu1c-m61rn0b!VGGBLLSI?aYl$Um<1AGm1qL2
z5>0pmH8c?xh>4)qDY8>RjYS4Nfkdh42i|aqGs?g;Xh5Bu2urhx0Whg0FvboT<Jk0u
zw;W<piLl6pC1+>>k_hu#;sda$Oah7EdX`BbX*&Nq4sod@SV;!c2<lKW@ChWrl2#Hd
zX(hpuRuUv>fsB|BHewqzkf26@Di2U1O@gF6W`U#&V7r+Gl3;P11Sy@S^S<K{oNo7?
zgJZhdI}QOZCTKO946{5LW_dEq@??nR%mT@Kph1v)YWjiq9AZ+*u!;`m3{Z2AflnYA
zR(d5rfjT1@Vmq@y3M7P?1X8B^f8Y?8N&y`Q4T>U|5n!56ASD87S4s-hh!mJJQee(V
zIW_&k2M#f*6m(~Rn-F{gDKKZGz?_i+b4IGx^n#BZVp6GSalr)Y*)i}5q{4zD6&4(+
zu;56Axg+%q)QPFEY@GUT+9!~qztCa_Gz11R6joTKaX|f)21$X^0%>tjEzs=F1g%BW
z%BCOq#39C%2D3D+1*UZd)b=!35tg=Vy1*BZ+C4BO$EJS(YlfxBG+2sE1E)x4fpmyB
zr3KQ_YDp&WG$o%vdffB}pE<;s(qWC*^c<++>9B@oI;8lXzVs7^&~*7P9PCW#OJHi&
zfgB*t2#c_ESXGn`tBNwjrh!J)GC%`|$f*EYxo4<MclgU8CY1qdmxJVC!2{|oG4Kgw
z_)Smv$|1&-5dv1nlmTmWW~_laAp=sbGYe!u0zq0J1J+=HnFXG_;uFY#Bob+XjCatu
z04GHT1}2ySSoCGWqAwE?ear%xu%=cftc8`C0gfJNflRbQ7_`~|lvOj&O@Hu>LyRf&
z4%DTYAHX`81+rj;aF*3{hwmI>QdyvWGsyQa2Z3iu`2@0jpjxwFv6D4x`U0?yd1zh$
zPiylDWWj<Z3l=O{uwcnXt8l;*1Ppuv*>=+lPI8KR3uMFM0O|_30?>>GlIs+p<zO~w
zHUqSm7p(!9oizQ!4-T>V>@-w2GJ`sVAPYgc1)Dxt10EW0&|?V%vSIBXsJr0eu;vC-
zy$Uo<Wp{z?jb;GN=Ykrga0yVbVzD>}G<uCq92Ou@3z(tpnH;a_4L>==jB-GGgt6%Z
z4FO;g&t;izV9P0HlnZLfVi_JS01c6V0vcu?Xh?*CPoSV`y1*|EF{uI^<`!(4?f{kt
zbz?vsScv|{1)y<Ykp6ws3x08k)fa#|Xdrn=K*Hq<LH_r~>=6`#&b`4RUIZE;!6IG^
zieM~V*J98rwLZ|KIa*371_dZK4WKRxHgQl>0h>4|FtLe)as^x*G-(S;4h(z(C7`|0
za0##=XqHQ$1QasZ#6dBQO&pYzv5A9X3SAtuXsZO&Ktz`SIS4eCk4+pjQH4$X3j+fK
z7V%P0ZI4a-0|SE?Rt-O<FX-eFO%?#9J!}ffKvg~#6U#uOAK1ik1Ywy4*dl3xGEn7>
zO{2$jhb^Gd(=t#MjZFclyul`(F}=VWG^<bs8ZrX~3|cZPt6^YZ6lP#x;D*ICh~^V0
z1C35$Qx6(_#ikx~v=0{b<)Cz*Fx_P-ry#RHdC&BK8ysR%6`<}esM!W}3^S<P%fKg4
zv0!?_Kae~qErYhSL*+qE0#zHJ`%XGRqi>a<;tY!cl}Dz3xXU5NRQUvC5U9_jPzD+^
zt^y5AVll7^G%@%dGj~_DOn2x64Tx4tOm|oc8k?$4ftXy~0`WpMC>vtYStB!j!#2=R
zV+|-qKnDY%`Jpyvx&UY>y%tn}f$}Dre4Wu$0ZuW)I<#t!8I;%=_yp=eDFjRT*)pA9
zh*R9C1(d?DnA!p=-jIq<(Arc`h_)P?x`0zmss&WbV==WYZ0ZG0aZk|jHApkaaM12o
zkk=Ua1lmDmDQM#lh-P45XayxskT|Ga2@;2@hlzKvO*dfV6!!%A7}+>zbFTxmXcLPg
zIzh!U7V$nv`;A$kFKGG%Mow`_STho8Eej}-Fz^ZV!5RpCu;yDItohalX}&QF^yf@B
zVBr*Fns@<1PhtSm^^-wK8cTRi^I~9N1QmRsK{-hB1Q(Li{Gj3>HzSLKRx*IZ(A9%h
zGJwQE7+F22kUYXLed;pM=-0Gq(*>A0#U(*Q=OBe3%)qel0H{D?;1ig(3nIM_6gN<e
zEPV?i4I0A&=>%aU=@}Z+C#(dOEi*vVrJ!mJ6hBCAnE|Sau!$c4Yh)If38}l8X39)I
zaEn8XX=VhJu7T1sp!6Cj4cGVwY=X4FEKvSL%Fis&6gEo(tixy)=*%cA^0Pr=priy%
zfh?ecgMm+AHrw<7R!(tAP$iEg<;?Y%{$L>}lg<S-he3rnR6oSmd;)WyP2a%EDJC`d
z74$rJXp(}<znlJml~c@XE~xhkDk;%|Y#u1cKw~Lr;tN3Pu_UL39N_tWuZ0E-42+=F
zKxq0Fg3QCBZxQGa4J_&xtpS_Iv_uB%QD%W9PSY>2af*AQHCG|2kxyU=C@EtJs3mC4
zPROc1K7l1w(+$`;#X(!`L3;quXA_o!_KXT*7OP7^bAMRYXDkJsW`a!|G!2Et+e=q4
zFfiIMFiih;g+oAUDX7hjC9qfaOc(geA;z?F&GZeRdB2rgz<jBdpu!Fm@o0g(^3HUJ
z3mjtgD?v?REb^;Bi3CexSp_QYkP;y)sH$b)6IcZ*!a?fM63;5o04qp6R2;4zl>d4d
zv>DKYa}{Wq0Avuz0gxmJE^JmsO&8$g6q8y7D)>P1Py-=K_ykrZO?Tkr6f;@{s^zex
z(zT!igx+FC(^^PCFs=Oo4iKhwGSe3<1!b3Ypy?)%%b^ZY2USK4d;;r?rW?p}ib<`5
zg#^?gaCxig31E3p;~q;gTNeSfr~?vH>t;+(P~{Y3TDJ!(egYhGOzR-aW2DxD+6!1>
zXuS(qz0`V8MTEs;>yJQ|*Q|$_!?Yo7dH^@47}JI#C|x$aftyoIY6EDL4^&J-{JHP|
zX!@LiPhdma^bKHnP%jEu9_(K}fen37{nMbOFgSb|79N1fADQj|n$O(G1EmeXwA4mW
zO|=y>A~tTAwi49%*mwj)dkbuQ!@$6ZC0~ISdSMj@oi>C`{h{dwyqscQn_%5@u=^Mo
zSfK+Sn?MNzluFTZ$Y#(wM5Op<1@$2q_yjf!P2=ShHw1MYu*B|W(C`W<c|t-Hk~%@U
z!lqB)<rI_J3>x$V$wOTMQNSm#Ic@p@uso<EfhGBFz5^-bw)lWUk!ec-n6BRfDi5%P
z=2p<EJS?HHH3oaAZp9JWpy5Ysp}h?>VaUQTeJdZQ5Tnub2Yj4jOxygxwA41x#0r)a
zxh)5rVwtveK<Oor9I$N*BnND}0Twsf2C9fal^rw;S)t9rZJ$6}Eg9h5dARtO=?S)+
zVock0pjmf2sBpoOWwr-RUtj@h>242$<l*gTQ$y;Yyu`pKussfvhqr^~`LM+D_8PED
znYJGR(^A_(!_8QHy#3Mi4WN+O{%X2{Ag4H^)bs-aoZ^gf(=TvxiZSg_gNSNP;{x#-
zAo+F2n&}O8oMKWt_AoFog6_INOP4#YOiuu<57;R%?JkFy*G{xziVa#I?*s)NDEUGY
z8eAOI$H(HOoi5WC+yt2i>i>cCf%Jn`hl2Vv415ARLB#|}9A+L&9MoFDW?m22Jf@vX
zreC<sAy&T=)LH>yH1F&J6>rs;#lbF+{UG~5G{_y$fxum8#V#969OND>?$`yYPna2;
z;VVPgK+OvVK7n0maSs;<rCw|X<v={Ns|HHX0Mm@Srq930A?~#cw44yxz0g+OE>L0y
ziNnGTCJtJGhRvEkU}L>@qs?frfd&j1_yl%?^dOrD6UR{??bZOB$F$o5LhmsF7aUA`
zQoyv-9#E45O98Uy38)xm7TC)IqKyUif|@f}3Y5JL*b9`sSHR{o?fn6!rS>UcSGUgt
zEYGwr2TE@MXDOzAXQ1>OXr|r|>M>!-)cXw}rO18<NGY;E1WIQ>={XRC_TQR5!4j1D
z_uqqL{{0}skU~-&l-U{h1ol6JWd8l2rV%K#(NgRI7KnidOu)1h_)JDDng2i!WR&j!
zDAi+`XFmX{c(Cb%wnz?YfX!z*=rr9yf>Vs?VA%8r;+$fP2dA&U$|25l5bD2!H4uLu
zoCQ_34y=sn;3g=4AC!Lr>>Q>;8jyfK6at|Sb4@Rh<`iQ(EH+INL_vLZ7*vL0Nf(Dx
zAjQ<-7BKB~7&avX%csz4^6)M2;48eaW`l`?(i@ggJt6@1t<(|F;z}&d<0CHMbigcd
zBnslMBY9wdB^?13c%Z06i>4#6(PEgxKxH%opTH5=XfZ59!o)%40yc+1(vQ>;Pz{O2
zVMkTK4rc>z2zfjGizKHuqt|o=DNZRjMr_JK&Naj=?~Z~x!Pvx4L89mAIdJqGvx4~k
znB8;%X-;uNP;&v)q(JlhF;J<DCCwe{0+}YxI16IfDi9@g9MmDj64l3dO<y3*Db5H<
zKuO18F$xV(c2F~hfluH#DDaW;5nLR!E(A+}o>&HLFha~(cmUKNW8f1waccSp8BQ^#
z6St-($Z(1?J_E<EC-@*QP@+Ne;z<|m1<Fa#X_QzBs*}_0B{;>IPS#CVkmVF-?17~I
zlN-Ra)G3f>u!O;>rs)kJ<!#di<T%BcPW6Eu#dK=YbO$+3F)8rAXe^F9b!hqo8BQ^;
zQ)rD&c4!0R6e#aw37gZPP6L)Q;j|ApkujalfYKe{+#oG*8Z=A-3VcXlGN^-+7XzQb
z>3NVs?(`zmYzUWM1}Wsg`!BIM1k$o$I{gPyx}1@Klpbd?z~RMo=H2uU@|<E!XMRne
zpai0!>dq>F9Vm4cREvTV23oA0%>kR|brzNjq3(v9oW&<_whPt0aB)zZ7>hg4LfVX8
zXF=5|mh1ysYsP?098{ZN3Fvb#!2Xj0AE<>TJ)BPfRfo(1=Sx7ew7_}Lk)l{q+xbt^
z8x%Ojyw0P|5VJ$8>+_%$Us(Ke0hB<nB&Z8Xknp~c1`cndi=gTrOU4JE5``t>Uo@Mh
z#3|0`2G-4VF$_#gT?8dVEWW(tHa!8P+z+HooUv&72PIB1sY{@yA*d$^>*+x&%u7|%
z6_i2ppb{5Z9#l9n@CjUMnjWCcDaLfEZMuUBi0+!+0Ot2i7Xb5DLFKoB<)toxDoiY4
zaOo6O-!-s4sY{@K0XB8dz~(SrdNqB6Cdj^T(+fcMTowcQ1Jnu!2}@lDEviFyF4Q}h
z)u76?K+Y0p)Pv|U0vRgKXg1vd)LXwC1agZwV;IOO;*52m5D>2iC2C|7p#g9OH1CDQ
zq2L28*JIWNS74bImN`HH!oVkRWffZHfQf_VBZL?jgwO|5uDqMRK!sDB@fXPLVoX=r
zK#mq;y2=F(7^$nEOn}8*SH(cS5|g?LDipEFYeCJkn!Z4hQ%veAXz&MA2tlh<c4(D)
z)d>=kSN))L7?h5K(rHjS4@#Fo=_V-M1*LnS)8AL8K?RmU>2*+g16YByz*W%B6)egB
zDr}X^)mu;<ufR0hRZzL%KD|YaQ+c|)3MaeKHAsH}-d$h^b+8%u1g?R`osj(q6Hl4e
z4H~w%2Agod23eFbT~~vXYkIgcCqL7*ci`ZX0-yMXB{;7$L89e4A0*hXgNC}Xsgs(n
zpvfsdeLaXM)8G`GUa!K*&UD=h>=mZ#(9pi_1?2}p=_Dwf1*MCibQP3_hW7P7D1QPt
zFqs9e&w>gpg3_Cy^cJuJX#wy_F<3(TI&Age^?Ohq@1Qhn`Pubf(;sMZiZe1nC?N<1
zSy?D806zK>i@7&Uz!ozL+^~aa@Pklc5GoB!NrJ{vL6`HO)jT&YfwHq0(+x=JAaw)B
zY{!j%kl47%1&NKDI5NpivFQ(Vz<qj9X~J~VX!-$dPH{#n2;~H!ydYE%go=VtNf0Uz
zLbZV@Nl@z(i>q($gSh(UBd~3Tu<8U_GDv_XUm5rWKut5y=~U<iz%8!n0=k^yl4whC
z;o77ie!K;00b)sUx74Oj(Bl+m)S6zP%PBs6yDn!1W7_lux}4&Sc@U}$Le)X2HVD-R
zp{7BodD9#8ImH=SAo=9B*z^DpR}Lbo1o7T&HE<STx*Z0QO@qkhfhq7M7g&<R?JBS|
zV;h8mWx(6Vpk`hIn<)j}jE^N~Z$E=X^zB#RKw!G72hn%e3apRmt`}Hd>Mm#l5|+TZ
z8wb`W1>P@>O}+?fP8qngWx5M3&F)TuWQM!Y>~$BKz3#4pibJ#6-Ca=rAt-$gN?(K0
zkj%w+cY3}Gr??dO7-uZry!&msf)S@UV;sbH_p+u37;%b&(;F5?-<t&XG}FC#U|oWs
z<_e0k=>f)^;?v`eI5`;CO@Cm-DLy^lm{WrB9GK1cXu5zgr#Ry)2=xg<{hA(N3eM|b
ziVMOMgHTEk$_zrefhkGQj5!vc+z*>R!Gu$sF>1Pj38%OuXeJd)s<{6O;?euxAi@8D
zX}W_Mbb1WMCk)_ug$F{ASbTsZ3p{|P%m-TFSe(vh#wp3@H@yMmqc8{+2cgm+R33yX
zgHTNnstZg>f*P?{JoaD~*bR&iru$oPic3BC2kjui+F78ofq_rpq1f~Q3r_Lr;^v$J
ziZC%y0f5C@4?`gB^@sDodL%(D3gngvO#3Q`^g0|i9s^6)gL*MobU$i>wnw0)kvi1W
zN1%2PsIG*Hvx7!b82AJpp*8N|>OqS+K<Z)b2bg-$vH@)En#ZrEPq5+?V|x5<8i;zL
z1mQkW1982cz=jB6)<cILp1>Bq!K{IagVGz8w)m4EsIgHXW0{^zgK}p<xci{oL(>hc
zIMpGGiueScqRl#jW@SN(51xV=_E;==3R<ZF@;lVAaP^=t2Z=)+3l|5qt+1HG^sH#Q
zgCl6Y$TLtg9i$U#A}sWuRZTB&<P!B3cm`^xgA_oGhARNooLG#04w~TvEpb4rQJ-&u
z+V~taO8_zu&Bo`uz&6$kJO|CzgA}0I_#D)L#bV<N&?FB?J=8#T(3}wipTG+o7QFy1
zcmt`2nh#eGwih&^1(kq#^#u-#U)oIn0Gic*nE<7GAoMGq=??Coz<mYE!l1ZD3yaqg
z(-U+-ql<53rWah`5Mz2{0HNP1K?CV6XvPHOMyQ`)PI;>Z4y0s(x3H0XG`GG5@v#Kb
zTTpHTO_M;K!U0Yqd;)Jlxdxl~jOhUjK~2?n3}8<gy#sB8#S*XYDi|2Rx930&1{IW`
zB>Zj;*Z^aJcSo=*cn=!m#bV(5l<6D3g634;gRZH-reMSLg85(tKd_tpK>%zuv%rTP
zP?aA*g9}K(sSb)!20nog&!#u51sz}T0c~+FTmfhn38WDetf1Xzpw>1>Bd9%yC73^g
zk`I=8=HmjelcWVcg1VttrsO}qfI9UPsOZF^;FAbgfw90RP()xEEBplV6PCjLa|Ad%
znFT&~K$kpxo-}=e2B(<OXVBOhvgbh60|TGHXB?jUIst0Z*A-xsj0L`edQe#G{0j0V
zHt{!Ljr9WGK|Tao4Nc$bAPo$B0^ecD8Y<2K?Ph-m@j>dL@c>s3E4`uOaP>GQc)o)J
z2{c-bmRx^;Rsw(=g)R;%=CFy+07nP2z|RKI*bcM6&nqC>T;LZh#eiH4N-?082LqqL
zFHk*=<O2?<_-{~#5t`oP#Hm=%k_4{A`2>EWt}8=`qwQkkfX-+AhLz&5V1S8(EWwgY
zf5SGZz#Iu`xiR?g3H*i)(8CM@OYjN&2E`8+gZ_XP`(cUbe;J_AU>5i{1w=;+`~x`%
zshHt}7C-+%GvJ_5fjI<JVKMLt{70K_<A8~SMha2fG0lZjEKD7=dI+Qqtt|n)G+5w2
zTAKl`eiF1z0`)FjJ?L-_q3Jd*oJ!NzIdO8-|A*BjFomG>1+oz2FBJEHqLWYHKUzf%
zw-8oQL;cGMYE6L5K?`@ddQe}D8MN{RW-&|y$j6u#3o?jIbK?~AVgL<SA%`nSIRl>{
z11x_*jpKlcgZS8tI|9k_f(#EpIaf@I0n`k_jBr6l0kAw1lgqS~oMKE&DIltz2^Q{9
z?`lAzU62VD?oe^)EslarXd4vZ>On11kas}NWME)`tA~|fFmoVPzaSH2jH@1f!H^&m
zEFNJRAnQ5=nZR{FVzmJD0(e0t*y>Q2#W3}tf)7i0F@b^xE)J^tLFs{kPml>TbOe_G
z3xawSf=sYt0qP*=t^+}4P-a2$F<cx}Jzy~hbVCUPNDs990%tH&20lS%(Buwg0VW8#
z&V~V-_!3aTCdS0#0*=rm7En-PQO63h4CFwl!#N?l2nAVTQ_-*xgNcJ`PAm>*l>zlV
zM5P5;L1iB(_@F+3gb|-0E2KT(Ey#+Nm^h(nmlc+nU^c?U!I>Ciz*LYG;zKD`(2*UO
z6{#TW53tXf*i=AuwipxJlIaf8oTAKvY@4Px?B^6SVuK|jsD)gRdQ%X*x&Vt8+1`Mf
zP@=|y?4WUYEM8;>8GuEcg9G9MjwMj~3z#<IKua`Ska-+IPS`3Wn8RS=eA7HR#f(7L
zv4M}^gGqzhgbaLwoS-Pi;%?3}(+e(hh%yUuzL>t@5{Ia?AQveAVo}Mp1?(^;t|QYI
z@NkMI3v#2U4$#U%20lS<G#7Hh#BmtR4ciR_O=Vo5L;^A=Yr29vr<fEsXs{fMgScCu
zPUl_#b~>{l_dakKaHC~tE@&8V<H*oFB48g$3-W+8f-)b(B?}KgO9Gx#(+~J?ic5k{
zl*1y;s|Au4tLKB&&=Bn`NuY)Z1D_xt>Pi`eIOy1kaLmNZkA0L~kRMbrVo5^$pykPT
z7=$rOLIG&AP*9)-oZO`ZK~*lY4?sulFz^Wq#!Y|V%PGbrm<6V#1VR06ECqt#4{*UD
zB?L<3SmcFNpz@$7#3mmAl?O#BHu)N`e7#T)0|S=1azP<b1R)hj8lbg8419t@XjL&c
zq)8(v1gnanxdE;oGz$na2PzI%4{Cx4ffn_m6;Q&{|F7T_XA)ils`8{nv5x=?iUokA
znZ$BHR6Y3WUQix^n#BofM=<aSf^KF5XHiHpVc>=)6LC=TLUt5P95fJxCH;$o)+mD1
zL(S0ul`tUlA)C|c;WHLIU|;eHii1wc18D&B85rOiU=1{=I9xqwoD-YHXoWO4WadLq
z9JKHgZhk!j16%@>kFXg8o4$hjfCp4UfP4V!?ZX@d69;WC!)6Xz*N+F(fC5#F;%Hqy
zums2gQ1yY$pg+)xN&?i!!;;k`K(oAJOcEDBG0Y^%0c|-+DuDABlcWJm0KCRtOi~im
zx4~kL)b#aVImMU-r6j-_jif+6#iC9cR+d6Th!@f(6_gg5-Vh8rbM6kLP?phw(k9R{
zQ6>OdCd%YY2Nl=#g5X2vu=rU9tuw;|axw#-pv*Vab~9WY)H=jsjw~$sLY>M3Ep=tV
z8+<|G3GyT80DhPRsF=fMklyrw08TL`S)=I<0i0q+ve*|W3d(|F8A~A|8v!mvq-1dv
zGP00D#!MDA_y}__DDyM$3ChBfH_W{-anLY|(DXUMoJveQ3#K0k<`h%nffh8fpgs~7
zzsRvb6NH=zIHINGKx<pDM6_H2Se{89lECCAfD@Sf0T5L$kJgprh1x0)={dlcRKdkT
z7GQCWJZOypmJ&$;M{%wIDp9mRJrigV25YY=fL5ho33>$|aM0H)z?y5&pyh?kdkZR{
zln@LIaB&<3gaXJT*c=R7LkTrs161EI@ChnF@_RH!(WiixnBf{=(`T@_2Ge|k3V#?t
zv*#E!sv;z#*DJz0D^LgULesP&tg`|(hk*eu4(haEi4jFupAcdWOEM@=Fz^W~qQ)#j
z{0RdCV>p(oUI~2ShM18O%mEMs8F)dRdImm0C0J1la~Mn<JasF^q;vwb1zn6u3B1!?
z%t#rn;NgQ7Jj$Sy059Vi7~taI<5<LulwpH4F#AEJ1p}X;GTKl(FH9VK$cR|IGFl^$
z4_dP;qmGg=z{Nom6d-p%?csw)fHGRU9WD;qMvEl^ltC>WCZrw6;N~v_pP&kQ0Dy+;
zLE>nAA3m5kj=qnI2?GNoXr~b<;2`-2+$mInO$&fMpu)hQ0W%0zOM@jC82F$Ke3hW-
z7ks%yjRjR;3lgAF30DAGNQ}jcDiz?mK}rSGS3=56aG!3PE|9<}#-y@s`hqABy$j0U
zH~j*be`s1FNcb3(`v^pfGqO!Lh~^Y$<eUB=hEt45RcU$xh^sbTAQr^6n?3==b((%4
z8pQR2(m@cTRpY>BNP>z9q~_>BXp2X6-gJc+PBAZ4Q1cBmIt&R4MrF_fLIyrTRZw{d
z5{HBUTwJY)fdO>61?<dUNO1EBs+ED<D(0nD1(k>BgGe**395nSKVmTsm=jb3O=p3`
z(bcy>JgwFR^0XL}S|7;Q;-I@f7(i`(h;!k_tAi%nLE>n}fHw#sM+m66W#AJu2i2sY
z5)sWDb5KnR5=S$~98?i9fli!;rZHG&)e>|lBq*Gq;t&_{30kpW9aI;z0%bZ-k&CY0
z2Zwr4Q(-y012cW^S56LTK`T&}MUGWy|IeyudP6*?xFo2thE4htSeo$*c;2L5&>B=J
zA%_mM1OlJtiN%rD=*?khzOjZhhv8KMA9S$78kPZ}p{W5=56*u`?G?BNPzJ@4zpN*K
zCU!)n1+774FBYF!ubZ9_$0^2S4W85xld=J+!QulOk?9IoIK`N3)F2tr#t5A8Y|J2;
z#>NShX~c|dK*QKr0>%c^nFAHSXt8Ir3ToUss5#L5ZnFzwJT#lz90D89WOEB7>}3l&
zg%FD)ZE>UpTiCE3G|}>b3RVU_LEBZ+4I((jjO=ivIXlp*T`XzTE&yC=G1*0cnm|%^
z9oUng-5iMY9URgxpr(8PDPyu{08vu*pe5y4?6mip4jBxw&j7ccjRoyNi?Ff8x&069
z_Bl9ApKuN|oZ^rIZgzVMI-qSL<%3qd4zR%jX!3)LV;{~Jboc^tI+LReh^lu4t@K2y
z{`f&Tmw`{v5tR2p;!soJ;-I!L7JoQ{iX1Gl><l^z6q`7xovVeV{oxFrh7*%=0reS?
z6DO#=V&D^WSpaSbOAESy%5W?uyFwbsOs<fTIU_ev`oUt5JE$*+rRnKj0B%4_xr5Bc
zBJXJc3OFWDtLX>QImMVf-KHy~f@nzc@&sjmEVg+bn*JezQ>@+-HoyQ2S5UYy@CkZ?
z$~G+F>IG`vfLwx>7rjA61So!>xkLlnZ1ILQ&!FP`FmXsv*csl$higD<=fE|91{tt8
z$omR7{Fw#4zktKZ%jXIM1C|A1g1(>?z{nv1GLV5!&<|AnV)2n*1Jq!@DPV)^{XxYf
z76Sr6qgTk{prB*m6AVC`@8XA+&jGNE0}FDPI4Egi@nHZcr7<x?!`tj!FbmMaoFC*s
zkj1bthgkp<$1zkII0=$;0;hqKj#m(<7)SOH$N>y|f<d6XhB-eh7zCPT#1ewRaS(HZ
z)4=93g))H0qP+z}K}*T83|@zV<{6MI=7wheFi?$&CFzGjM&*pcK)p6B4hRD^9I@%k
z0Qcq$!*Dn}3{>G@(>FbTKBu@*7^pRe%{q`6Hf?Xf))|3DM6spJa2(zXhj>pa9F#(_
zm>cc^HdiVf)Ca>R4=uXFK_xRbdGNHom=P$Hu(>M&RCZv|7tsK=*C+zi?gsf8tt^ND
zrB7`7Zh-YMMLYr5T~ZNWun&eto&e`OX~8H^Ld0T06l8EoDhgx~QhI@9jA#?60nwoD
zITiz=A;ZQ-(V#LL*#Kyn5Ca+q#U?HStw&>g!1buKU<}9xEPjot0Q*%c29$TO$*%y*
z8^wUSZ&+Ly11iO^>3ag!#}w-{{R61!73()$A)ZrADi)N-u@oM$km{OQFunjB==JfS
zG>_~xkOLX`1mi)88d)3~6!GYJ5|kJj_yiNt1_}f~-9(T$tp5rveBk1sQceg<1)B)o
zttV<Mm<X~7OHd?%#E@JDD;1I_fQu7p!DNsEEMb)l$#+sIAg5uGPf-AerBMoK91dg#
zS~^aFv<cwlF07Z4vIVLSl>D&i1C6m@u`iVetj{YIZGKw-6eSFNf~l}|Q?Q_eiG%87
zEODC(%O|OzCIuFUr2YZdTvBPEu{op=gyoYom;vda^p3@VbjYX>Q#vF=F$<=LfK9B=
z1T~_OOoYWrCMb0vi-US_419u_AR3!Es3VHhY!Co>6{H@v76KL&FmX`xK?rG70~RNl
zuyt|Jc7^~bKY$EEn;VCVgOWRzFwFv`1tf=ZL9;;?Xk-#D?!&;q4e}`ipI{cOy#leA
zB^erNSuh7de1H%KttbQ41n|T*{Xr3@Iiu5bfg(;Zscg`c1*q7AXj^y?6e|pTg4y5;
zOGKFkvnNd}<`id~H~m2&rx;WAw&@p&IK`N9!1tAiG7IJuK_qhOpc03m{7VpiuE2DI
zub_5(ZUUGgEtm^xcEEkcz`zX(Vg^3J+yh_*%z}B7z(z>rftnA<3ZW%O-lpjrN;t(O
zK_wX$>3pT>4yE7?Sr<T5*z^Jr)d4j;e-cD?({!-xA&Bf3sB8iFlxZ=h0<CFfoS+>^
zA3)R;nCuGBCJ8aA0?;@%vdvH*6kG%AdNduZ>(lfP#hhYHg-p{G$~nauO`wJpE}Gs@
z&M7VlYD-}W_rg_BZR;S~Hcbxz>4pY-;jZZhWgtWMP2W%jqAx+DuYm)5`mu7*&Xo#I
z4oT3M8y3@xT%fKfDx2<5!70vIHT?m|_(>2;ixy260Eym#sw!rhZcxby8lk#S0otTc
z!6`63zmk(f0@OLiVtny*{jVHi%!0+sAo^BK2kB!x1Tnq%()14?(|Dk!ml#b~r~-%b
zfl5yC>B}oQ1*Xdvak5L5fQB%!7+<mkrt=y^=dI~ro&Hsv0@ME&bFwp)GJ)b#jH%QH
zs<Jc*oR*kM)4(CbRN4kf_NAclb1YVrUV&;XW1GI9np2#SYkC2QQi6D)%m`wBSq@Cu
zB#5$U5M_&|2Y{lbY}xb&V0s%Qy2^Gz`Os)9`vz6_3nE_bG5vxor<hmy6b1%HQ0pF^
zS3$)MpI|vC4`UO*fn9xt8pPKXW?)|%RiF<KeutP_0Sg64S+ejTsI$euCs;8Hs(;b+
z3)P%rOcl$f)qto&VB?r7!S^_cN()w^6<)BcTqOYwo~j*CMzsNq5i+ftQ%tG`wAdF*
z)4pa6=$aN$X2F_A(+lc2#Tma%H>l?nXB2`2SgjZ&z-pBs0b8pE$p^K1U~#EhP{ji(
z!O#M*HVhJfwONq(tDOLKPVFMFMy5I;h>z>UAYQDqf@rAogJ`IWfNH4Q1XZ|ex<d=6
zm{A?*ED_LsZfG{vfyOnkh}TDeJ!mWlI`oPWn*z|}7;@nPYHTy`3D&QhegG5_o4^iC
zst3*BA}fOyj`gr=01~APf}oK_kao}rFsR~#l=BF2P+J|@9H?~-OQs7v;S^(Pcm(lp
z!!NMCjE&Rp7jlX-HF|-$OpSA(;nMg5%#apr(qUl0=C39ju*anZn<8*1h?~~LDbAQQ
zy`Yg(ydG_6jvMN|CfKkHn)jMOqrzCc*VF+$*ajLs+)(c|g9g#Cgnl!qHWdRM3C7OJ
z&n(z{Z2AO{qo9>p^CL(yY<@QVLldX^bo(++cBbZkkR;T?1WAi6L68t@34;VtOBJNZ
zX#vfKVkvT3Hb6tJ1vDjv#Z9ej5CdD~AO^PffHg1+wyuLXr}YrT1+C}63Z+^>qt)09
zx&<}h7bJ1FaZSI_!YR%OD=gdGrY~sW6bIdWio7}w7WQqRrUEF8(ZaqBHiU+jwAw)3
zcPvS(4RqWC7U#8tnnx@Q4AaBfI0YHi!1>Fo9Y=C%2Nj1{3~$GgecGo@|Io@Q&bV#*
z1Q2y>x<VVLIO7j!NOmwye*oe`i}?<t=>qMX;*2RU>AdL|K>Q+zDrjxlu?V6HR%LYD
zgQ$80QS}cJ$enzU5~R}sYFMY&^n?yhaYjE#WOU|1)zv}OL6QTrVCOEdy6NYOIK`Pd
z??F|)gQ)6)6~SGgc0Y2Yfcnr3e1cti(?1k&iZOK=Oi#EDYJYW^O;;%76f^3AjpD;%
z3!1aK&|A#VoYLh7PE<@?L16bLb)k(*!cs>UXhjsVL!bpu7c9rZ?1PDehG(%vU>CFj
z*>wzTA5%Bm^a&lDVocpa(*rs=#SK9n0W2kaH)v1+)OLnubWjDyz`!TiT?49bn0lnZ
zrbzXGW`01K5R!%$9tI79GVlrZXn{-@W9reH{-BdnOsWUe&BkI}&kTrhcR-X>4``Mg
zn`ytmrWo~s{EEetK2RdXCjJ9-$CwyXzY3JLfzk<3x(7@rO#qEQVbMPU6#3Z1L2--}
z*1Vv&X5bT?08$IWXn{82%JhU@E>Um6iJ)0@ED9!q5&<@G9Kkkm2H4?D6OTaYJ5c(^
z^bhAaM2!U}fi^;6DHA4vs#j3g3eAO+&VZZZUXwuUkFYpoG7g7N1~m|{gv8_ou#f8n
zCxiOn*bD@Xk6;sj!N9<PMSKcq3;>%rDE(p+2Sv#a(7+s;Pp3fQoN3A$NRUl=1EHs~
zfP;=%aB2foU;&ig0;R7&=@$@snhYq-GEJ)h-N7fyEI928c!?IX;B=|!1{1+&r#+a&
zDdsgD6m(dcX464g1}U*00r`-DPjEV@KtUD<=?95>O`p)mDaJJ2Z+gLG5FIu>p^sBc
zYC5R?$2@FQaC*`7fPRp=vgsed>Ogy?u&HaCJ^|!h@EK5|%!1RWLG{g=egGssZ+ZjR
zm{nk7n5J(7D>nokB8KcrnCsE9@DXS?d-^x9>!)9v$SF8oegY>u(+pUbcLw;5PSJY7
z8IU;z_=G5UOD_YT;0#zB3|8cU`tl%gP>&T<$)QE@jC;@pVxSOaU|<jgjTL~@gWL=%
zQeo!6#6f9J2vh;088j1=vOyYP20_;o&IEM_LE<ojVB(<C4~v6l3QYsW+)OcW$V$z`
zzKKe3rrvZ=ieZ{*G+m*eQ%q_m=)f{8!|XG?Krti6G}CXo!(>kJ`ULF5urooo%3;$E
zYB+&h5A~H0$khydf-^zA8jv{DS8#FAFfle?fu=SSL93C_f^8NoW@kbCJqzmZSvdSX
z3+nG#P=C+D;qO^cf6wv*CrPPUI6OXU9wdj%S_jS{MzcVRbFrk=S+Kb?SU^D2>a0uP
zv}!a9wgw6oAW-?)pgDLfIeIo^G(cK#HmE?t5@K@<rbTdydCftaSP}x2@(g@}bI@j9
z;o_jG9h-5lrYlSZ_vsEy;S^(<^KZJtG)^(5xqQ<<fcSIOp!6<~GBKvPho*zo&5Hq#
zBs0xhH@#pQr#R!L=?zmk#k}UDwS0s?l_~?D;C!@QJ8*GOs9<r`{GjOzK*q*Rzc7tc
z+z@S;SqmD5^U;Qx;o^@Vx?h2HGk$_Nef}@78<`duLA<!Y4kEt5ZTg4loZ^gLV4pEA
zn67WjDJCtr0Mt^((x_R`1l8UH9tEBLZaSwV<G$$uGdRT=8Nh*Jv=G!30A+h<nuaY?
zTL|i4V=;2!vFRH?+OI)O`8NFlh$jZ2^dOWQgo=YuRbWaIG#H1)yhYC-PF(bD+AL5V
z0wSkBpUEk~7zSc8=7GrR`m;Fola}yc&-Y8vhNsy;!)pwDf=gf#42n3=Ih8PRP;$l+
zkxSC1e*n25Z~6ofH3>qk0f!UQl5G&~IWRT7e-@_%<G<+wb2!Br#UPZ?bO#X63Bn75
zP(={IItZ@^V%E}W5biceq%PeBQFII}Iz4|5C&%>TQ#kpVmR<p?H(CnXA`0>hG>#a+
zfKPB4jsRI^G;J=YIHMCJJ1h%>(x<?p*Py&#(+lQsiZLzwH+=#~G28S7AntN5aLO`T
z4ytmnWclTwof}x9arvd`1|VbZP5%I*(jbw#q6orW2j%XX9xx9S$q;|9)C1ckwGz}A
z#A4UVGKjX7ZD1!Gt%B7;(Bcc0g;s%9bs?4GaB)9~{#DQbSd|8`cU2xZb9t=-wRW-i
zWfdstW62V$(5hJxXo0cn+4KeNoMJ|+L6Z`H;ft`qkp${OtOm^mVBT~sxY_}93$7@$
z;A$UmW0Yxi%CuV?qRE1*LG?VS4S*Kkt6}9cGyp_Ek;K3!xEkg#XhMgJgQ{sP34M*u
zv}K%P^=m*)MkIgof%pu3f@@$)UZK_qfsN%8Tm!QPDlP(=P6DY1ts_GUf4F+I<_BCo
zxcPx)G4mQwV;r<a7tP;meoPNI1L}jW<(htA0jHSJTG-N0s7pklHTqi6dOakUz{TaJ
ze*o*lk@MGr#vwr~nb9m>n=<{wKMv7)!L^_{2atEs6@Vt*v4rqiP%i+RfuL9gIS}S>
zXe)9p+N_T#OdQl=69VmQM6-AuXe$b6?+m&)$Y5j(pmDkmZPl+ROdM4FWAVT`Q0ow8
zJ})#WgA(()qUj2gIK}GM!Rl_1g$xV~u*hA9HjpL?*2^cjt`6Ep1t%sX^`HSWYz}}m
z&S2(4hnClYhMbu}6KXICP_!`c39f@3w+OQUrUAAb4kiv$56V2)EC!8RU`d4QK#eMR
z$l5S4h(h}*>(E9<;o_k6JJ>9EGW|gk=#+Yp1F;l)>%+i_oN0X$IMFh#&jI(d>IK(>
z$|Wr2)p|&fz`GHmpde-76I_qxbGSIj=b$y3XlZ9XXh;~F`5=$PPrq`WQ%Gt(s7S$*
zu-E^Ye&HVI$a+w-Qx>xf+`uz^!e!7A_d3%roaYqt+5noOfrlmogDA*c20lUXk@p~R
zXl%j7L4Lv#m>YVgZ#WMsGdF;8+(RrDgB*`}ke}cNP+5b;vl~Ej;d?R7*(f%>VL7Mx
zbou3+5|W_7Wh^nbF%PVUv1q!&a_~8(2Dd<k$41cdCeR{BNQz}#52`~M_yjkCx_=;X
zh+h%nu<{h5o<S5e`T|l93U}nNfr*3GAz&%TH~s;&m#_>8Y~q;izz^DEyGaDhFc#bd
z8vVi&8k<0?F0uG@Qy(OaZkhy6qeh!xUV%87aRVsS8TbS@fyz51FT%t(vqAK4<^t<y
z+N=Vp0XOGNPw?avW7<4p`h<(15`XiV=?i{=8P}!<tOCj0n|@#=r&!`<SYSYGWDp0H
zlni`=o8Ljp8JIY<(YG0G-w9kjY<Djt5*Wmx>bFckZv)yFwnYtOuQ;O-$Xanmm+2Rz
zL0fLOfVwDHlGPSaoFK;qC}0`*1h;^a8y59jK{Xc^^;-=<*E5OM3vPuK+))2WfQAGa
z_yo6tGB8qNfQ!S9+d#|QTfvK|5i9E@Kpp^@gSLkOE)H@y7na1c6@2-nn9)|WQbz*X
z8rq6h>cGVpfUbuWWft7J2^6AYOk1~sf>exY>ke=tWER|d0TTJ!IHm_&0>$|@sp$vS
zfZL0p+M8*c&2&(PViw#M0b^uA6y!lt(YB812|=7<Ufa;>4l!tda~oO}0T;(ni*Gvs
zv*!iWMcY|m3<apvb{lXLfmv{S3|ORIaC-v-10$#@h!z9e(Oe}8O|je20t_w=DyET>
z2DHlFj#3dZFo=PgmkfM@+rjk^sD%Sf%5Vu#W&|Y{Gzaalnr^V3Q=HKb9C}_m(28Vn
zXwAI?ZTTl$9MmSl;=Ua<;Al+R0UAcZlH_-QCZn+=tR0}{1}H^CQ@R*v*p`7$a0jf_
z3-cCC{Kj+xF-}ow!5yHA6x8xV^WRRs=?xpebHAYEQ@_)Lfq@Z=y*ojjXKdQhhK<BP
z4Fd)~!JV*pgt-SM4yu8$R8c!Yt@*<Y(@k%22rvuoya7%o%z``LOn(4Q<vYJYocU||
zflZv^j3VGPT)zu6(SRHp&@{XYZOs)d4etV_0xY)gLMuPSLFyRz1b2ZF1ju}-FW};!
z&X^F=;$3hm0BL~D(!rt!G&2ekN1LA!gNcKJ6-)BiRRT^PUc1oB4{>P0whJvgz{Nq?
z0h<RmKm!a^)qp$%bssylowo~?U7#L?i-T%mZ05m|8`K;zXoau~Rx3lzfs2DW=S)cJ
z1YzB%U4OtHHQEhImPig01C^`{e1hoLMZm>H!0Fmpa5pTfVJ?A&&~CH=DlwS20azom
z;BF^K?Yi3woU@sB*Fejt-7VmzXZ>zaErq38-wjHt*u<Y;U!uMTRLo&%HtYd4jj@SC
z5+mZq4+(JU;uGA1mKx#WpxO*12MR;5S`fh}xCc_$N(=4*RbyCOyk`P9n;8r40gXFh
zQvgaHSaSWIN06}F^9&qzQlO?Fwo+rSz;uC|pw``9&;TD6zwQOi6k)MoZvpmVXfLQb
zz@{EY*zX0EdUrtKgBCXXKxG_gIU>3^=m<DaR}NiV2b@ls_PKzA%v*3DXj}wKknIEA
z@&+;--2hO(0gKD`U6>xQpHs|hAE-%<C4~0NFfcG;anOEHZybyL`+dL;los3%DhshG
zXaFlP7Tgc2(6K21rElai37Qr6KL7`T<N?sC4lF)AFnzxkmsq{v0Z?xli%$;Vi0cEO
zDJX2_;fU)4pcNe0)Pu^H)6<V=aS3`09t3s$u{h!&sOrZO4F^N8C%A(t(+_BIiPj4q
z#L=%j2nt1P2EvB2q2-b|XbBJlpWs1ICjeB?K}$%uI4FH!$;1aiC2Q&Qko}xO^#?&?
zLRdU?2oxIF#6i^<7PlS3ksA+zsx@rtA&nlyK6MGO<M{*+!R9Q$d<F)%I4E;q@ysF6
zwm6Vu(K5%O8Q^llTksGl&awFfG%<|LWuOIMSPVSO0XDE+@G!__SPTST4}-<P!=P#c
zn|jchRoK*{wSPpRndLCJ;szBwAO|ooFu)~1wF;J?IlKXTK0mw%oa^cjgNkBo4g-l{
za~P;R!6JSHRBM3rphdwE(3CkgaZvhYW|%HIjZ={6h}m?7d7NTW;Q3oDo;VT$cC6Hq
z6zrZk0%_JH9RW>+VY3V*hNVb40_qroDj76K9|i4<#1j2SEx@@}TJR`n8XTK~46uTF
z!K0ud6D+}W6m-%jHjSVS51`pAbeDjl2b(!Bu$L=GK@}6Eurd}r1{%o3qWPEscFo6J
zz;%YvF;MFfn?BG<O;{X%YzoxZ$3XQxHjSW85GW4Ne0L13xhDZ~Jp-TMG1wqDG?Bx_
zL1tiSHXZ{N(U3thuj6QKckp@G419veAqft?g%B<dDzvbedE5m&xWz1ZJOkS8Jl+8A
zG<XXhN6Va&pwb0o1zP6>E{>yfa(vD7047e+dcotMSjLh*kE4YTC}=_B!0;=Fpy2}-
z2MtDH^9yJ&$`Ny1?F4ARP=5NAdz?a2CqNZHmchdl4$~b#dks#2dcdGwCt4hyhyV{R
zCY^xwR6*ekI=B!zByj?5OqvrW4l4Puxb+06;=>XaCk{;Ca2qr*apDX#8cx7c3Dibd
zaG!upl|VxWE)L4=*lhd(js|JLlOV5w>QI=0&~ed|Len42;}kPG2}=7|3^<842Pz4&
zh=EV=q}uca^Et(&PU1*nCxfOJEaDVnIvF*6!6J}4(6~P~^E04>G$%`7j0Q-7c=7=D
zoP6>EG)JC<b)2AHk^pt&Ku&{=;6cL(E{-DwodPw^K%-TlAOdv*z?e_)6sUN|(u_O>
zvX2=wcLHKCFfd4h>L&(1!Bdc42qGK8#6hh)EPg-bg*v1NJ_H|R4s1Ou)B|vFP+J3L
z4#<A6LqQtQy3mrKZW2fwtqTno2Ni-agCK^0Pb@hDiX<!}D`(L<jG((D<UpDAESir&
z5@2zM=>egjb$Vw(b^B7x+<6w%+QB9c8uP&Bf&<{<Tk0IBt${`UTn$*B=^Xgl7%`@E
zC#D|&trR-<1WX&92eoan=sOP@^T8&b03J6sIu9z|u+&}WL8UclU;r)6To3`xfHGas
zo1U<kQ>^|1D20G>9W*ATK;CBH6TAQ_kg!C+1xTwAKI0+<YK?-_qeUcK9Aq9gb0DQP
zqV*{S@+Zh3a2pG8LMmJwlvJ@91e<CFd4z$1K?+otGw=ysRGRLvi&M<#A}nRVJP4DA
zC2g2EC|*JOGQjb{bnyp-zT^QNTDWurEHFLo1gC(N6m+QP671kIm?<!EP@RaywU;@d
zrd>9f{vi`|lFnsVR)V=7)QV!@6TA#t6bv&NCLRMe!C3Gz+R<TB(0cGPBxK=v94<Zu
zrV%#G1hWxT|AA}-?W;mg3NY~%V2#p(mr?i6F-U=WF(8fmrZ+6%6!W?aasf6^qYZDu
zT?DIOVO|932bl*M-ZT=tg0}2I3hJUOut{*3Mws|?eKAfkW5Fx1tDn$(c*PA`oT2N3
z#IdyC71%I2Oe55XR~CVND0Kyt*|7NVstq_ZGF{D??ywqk_f#3wBB(jipav-epWxNH
z=?0rX@*qBzruNktP;(&L<(RIXfSL!Y3z2*8(5Bio28jGMQ2QU7yx#PL^_*f}*U&sJ
z4fWSGP_qKdx{Yg~LJXUERp3k|bq%%`6c&)s%yX>;>K;%t0-OF%(=Tk~6brfzl0!;r
z(op|g2l)ewd#;1r3DN^C%=lpHL8T6;DlwX_aF$c9UI*H|xsKKxk^!~F8TbURgPKDi
z^-y<1Y8F1h>u6K-aC6Z72{)&Ofq?-ub^vt`)SP6&>mL{x7(pIGl@PoEYP^69Ll=it
zPq2gnDlQrL1aE*62gn?#L#1KjF5m!Wx)A_QDD^jBeRZgQDQM&81}p%e`r+cBHYCVw
zba#M8%|P}+&5?$-RBpfu8K^mMaggVou#A=8fE6MzgFrC~@(^ey7-Rv=AecC)(}K-G
zucjY3%PGcm<K1+HbDZMfMje)R=}jSsvYS%VC!FOJle!72ML{(mn*VM(LDjiI)q%nX
z)c%Gza}^6HLo)CQ-fWv5aE?=q>E<M;`e{)0pahN0+%3}&)NqO!-9&2*>p(NaO<3&&
z^)_7m1$exUS@7ns=>nit0XIRDu^<OQ6s}?c1uz4j;4M(tfWi&pP?i*E3cm%L)P$%<
zhzCFozLf)GOaL>a1#f|hSI~uVXkl}kVfqB{K9}1L(>MGFHS%vym@eSLC2A~q8`L1h
z66~OmV8AABHGRP)PH{s}-3syy#L=s`K-q<XPw)<?t^<if9E}i<o8EAjQ;g|O()5B$
zoZ^gG(;tA&pt_SceZxgg@J){wIK}GkfM(S|Hlw-!4ruTV)bE7Y2FZ&c+d$P7$To=h
zDmQ2x-vLdFfYd`=flv>sra<b!2RSmp)!zl>Q5J^jtrs~3neN(6KX92-oblN70~a{O
znC_mMo&e%rn*QJ-i2G>T9T4?ty1*q6{cXCzHBK?6drZ?CK+^ZvK$^vv?nzCb0MdO=
z4&+hLWsVC#%I}$hgCXf2sFXs)IfD+g>c0oej1Uho=s=q?_h3C@sE6R{(V9|l^$Wl$
zf?4q1DX6>7LEUu;;_iFbpzi(zmH#&F8u(JVgbSQvUiU#^hwMD4Gwy?0TA=WQIAawT
zG`#PF)^CE;L&V|EzHc%;;5=vt%l!Zb2F7^ICis0Ei%ss=Oh4etB`Pg=AC#i8q=*NP
zApUsp4C0RmpCIA=;M??q+ni!d4}O8dU5x3$zv&l1{D*wgA6y47X9Xw2hiTKn9(@QZ
zBtQ;_gf~kHs0qrzC-|@qdNCEmLvW8i1QqZg^$>A{`bl8(5+8z^=~x2jA=;=iES?^M
z5;np-c)&dbc^QP!GQz{@{^vn^$R8<9Pq@h`&Zsv1z)enZL(t$jmc051G>(Z)JOCUm
z(t?jNut&=yNboZYKI(&Hf=AOJ!TV^|^beq9{b&&+cpvS9@^3-q?}5do9)nhXU~&Ir
z0kF-+f{#HXfLId5V^Ge-;^fC((;FUuZr<{nUT_se2SAo&JqGpdu#BoaE&z|3Fg<Po
zkFGF1egyHz<4<4*Gd`Ife}Pk+=?NdGG!v700!r{$;_ZnVIKLV_fz3)n(g{4Co`CpR
z;_pckBwIa617|y_C!k3kq}B~TXl9RrPw+_-R9zcb9n+I-(-ZD+ic5lebs%Fw#xpRm
zq|62tVSIv54uMm9{S(x^4lF64x(j3+c$EaaXNAxQD)*4hgC_GQpc5`Z;;`flGY3}J
z!Ng(eAtOKVDNdFYP-_}wF>DwFrU51nTbKm%2+W{=;Or~)6qLS^9RQVoDhBqb)KgF!
z0!uo2>IBx$^wbTkj_GL<B-=kt17~-sr#Qm<X%kdk8(1CF(?yU{{pm7LsV?;tRHtK!
zrl*IX%8r4QF+Q8le~D9^>De)e<<A~LBJtTXNF+Xg2ToK>&%c2a57P@iC|xxD0I2SG
zQ3jEJQ8oPonBN4I@0+f0ms8B>1*m(6lo)+xLSp{~tZ;z@<|-d(Y`s`EeZyT&F)8pZ
zWgvYpd1wpo#jfcO!1AEURxEkzCD(KT(DKHYpgtE!KO_=Y`GDNPz$f_9W%>tj>j88-
z**;D&rk6$23+{1>dA&p{C4HbRmzSVw0h>jjc`z*EuPUYsEaeoFdIhRxundB|Iy3#j
zT23*h*J_Y}eys%wz}I@y3m$TUmal;e_17`r!i8DzHLPLux(iY)y@nKHjIXEPzrrcb
z^m^L#2M;*K4PiZdNO-|3;Ww~8DI^>a;sW4GRa)>3j`H@+JxC$*<{7w<k$Ma25@1Qa
zZ)Ly^l@@$!fxY~F>i|~3EciBSI=ET!HV>S%jNXD8_gF&kEvPMtO?(No9({`=?%%!x
zm#b25K_^s$;vQ7~GBB+2fsS&#{R1|DS@0dW-6zKM&JLVdrQU%O9~Qs8mjK5l(|adK
z9KCk~t7m$@WV*n8P|NfEo9O{pL5vR$)2@K&oaqO+KnpfMT$!$51sbsX2%0s-;+s#f
z+7}vOu(kM~&{{`u@d=Qw)MxM(1aZc)=>d;Hmz9Bx0r?dYzpKF~<}vUIe#X)I{JaNh
z%n5LhjOh!*^b1=!#iYJ~q8E!ZzsP_WqA-22n6BW(DQ5Hq)WE-uSe*#U%?u2Df?q&w
zWso?;9S~uV_#3eKOkciDF94k~@s(}b3r=xK&?aDK%qG-VE2t_vuqsgY0r?FQM5`m9
z70uVUX-_%D>c4`@MJ!JK3abbp+8AIV_!TsMgJfJJG+BH_E$<QPL7gFxdWe@+!_`BQ
z*YwcGoPttcQ9DBL@c#xG>Ztz)s}!J)kpVfHflu%oXjleOSunuGLGgfP9QPZjwF*)X
zGY8tk{sybeA&z8_fr*3oOR;R-_=Yyv#0099Kn`-7-tdf5to|Elg#<PSfLgcM#8F$F
z@MXE*V7&s6Ll_tk;-K;rn>nD`aw%xL04T(u=?9duzM*x|WuU3x8>|@$wE!*-TEu|O
z0?@o77V+<(5QmRggVsrbE$0*bZUV_F-yOhNMd~{!>fj2&iok>X-!DND?e|;LFMyKx
z_jl73-f)UBeg8Dw;01{OH{IYhrx?=@uIULN{tp3&xj!IFsil5^iYcUuS^&CA<A)2R
zS@;7KBUqY+KUyHo!XGoh%|frAATyAY2q>f(_ym8VRRJ<EaZtM!lnl`V{3pa+Oh3Ul
zg^Nl31T{-RW<%A%-1jpB?2n|MXemGj6q6u(VWWz$2!e@&A`qLs^H4`2L0$$WfS=2z
z2khh&tN#gV&|uRCidZb=z)x7dhGiLOzw{?4UxUI4<}R2xs7A+P{x49Puw`(@IIZs&
zsOrR0ZTteYI6(ym#NyS_(6-C3N7F#*;J3i^1E2#te!D@^#cwZ2y7(OjDbm5W9D=k%
z+y^gGz_%HK#L<lXT?H|=Y5IiMoMKYHL1SYeWl-%A&|>cQ8mP4wz(e^`f`34RPguh3
z&vf}WoZ?J>ydcT<PYhT+v*4czU<0K7Dxt*_bSmVp+VqCaoMKFW^`<)<<`hf%3vwq?
zILkukUjBjxC_v&Mc?JdsS!jCv3mS$2i9;NY5C@r$C0_nUO?P+;vM+6Vz<W+{Pf+&6
zrVK|-_!qR;1xp?D_XMQI`uhN!yqW&K0JmSH1^<FpvtS9Ye*)lEg493ItR$A?@DG}g
z|KZ5T{|dl^a!mgX!1>weKPbOp@yLJB=rJgKVBrQ*$G|7}zij%0ot$D)|8eB2|1Dq-
zFbn>l0dDg#3;tgR3Az89Kp`h4^&hmt7K_jRKY;|n|4-8eR&$Eg|A+N}U@-(qS|GQA
zHru0T5FrN8fCr|zLJZg&a6+K{Cs@Ymgcw0>@jI9~P>2!KHA4gmO9~{X2{FRz42VM!
z;w!)*U@XK0D$hXHLBf)W0hAXQ_=K21WgJKxq7g3695(&KM@}&&<`nQQmwF*)P@xCP
zWuU^FfnjwFsBmK76JiF99b)k^GpPT8MLi2>Wdj!VET9FDSj5>t6Phg3Q$BJEF|tjc
z|BFM6S%|G^`h<_1Vp43Nl#Wf$BCxy>JFHIx@$~9gP_#4f39*B=<$~M>@ianQ3gT&Y
zx#<d@IK`ycK^Y&U4yGT}a|h{Hn;rm`2em~&@-TCbgDOcrA$Ggz4Pbdc=s*-q|4FEP
z*z^sbIK`MaR!ndB$|)wr0h%Af;tx(9h&(5#+{Gf#l`>tRlvC7L2z+KJ76sg(X?>6b
zp$>?Fl>9>6Wz!2jbBay3`^G6dJ@^x+uoO2W#bKmq?pf0fzHo{$aW9(w;48-2j;mup
zO-u$pA?{Vvz^c|wzwjBPdeig+zd-c1=?Pyz*YkmfL_qF<22>2B#uwt=1J0@SLfoJU
zFKiwFWgN^RMu;1AFBLq!bAwu^p!@-`2rkY8YV=_-p9hqhnLrI9P(A=1Py(9CV&D_v
z37LLCmrIO^CvJMf4^DB$yy*%*IK@HBq8KrYP$8b4=?A`ZiZfoA-e3;WbO%bm0tK2F
z6VESD=t%Lx%6mv`z}nqHynfRS*to=)c!R*nPl^}R4M2DTp)P8A!8cAZCf+1)@?+v{
z0F_pv%tE~2t`dkbYx;$6oMKYEpyB`&-XQNWFsx1i_01Xhgm_m?PXOg=-fhzzesYR4
z?gCqA#0%Qvi=-Tuw|POu8K~fZ1rDgj0U2{@`i1`>hn$-};X8=F0BX32N(+IHXaF^1
zpc+8QodKlb$+RLaF(y8S=?%X*LF4HgK$Ow+2Ouf{oXDB@lBNgz;1pxxOPltK6V%-U
zt7(F$>4Ex`ZyMOeOnkGz9+Bch^C-;ae5=4EfD|97&5Xroe4D`XOnjf9mVTRF@RL)F
ziJu2*5x>NAgTI{Oj0T{kLSjt(6Q(OH<P>ER;-BvSgHxP|e;HW46h9~(g3O0R>1tR8
z6JP^pFeU*mh<gQuz)>b807{2g(zAdPB;yF^K~ju>86*P<SV6L%fE_pm34l7IAnPE>
z8=n0H+@>r1<`k0>0HrV_`B-rL^9c#~LGqyhsMCrh56g!FA>e!{EhGSnVJ!JXplEsk
zsH74AHE}@(!2AoE_-5b}5@?#<@Q+ho6Xq_MFlb~0n|G&8zwig-UL4h#z@q6J{&9+X
zf?^Mm5#YI50F*AVxf0Z%MNY5K%q;K+l9>hBrWgDN%_B@bz$MNoHC^C8r~GvH|C|D#
zWlh-fwV(+oUyDfz;wT*jS3#mna2+I?1vi1BiAiu9IJS)hVI#Vb(1N>P5Y%4A;xEBB
z;M!VRNC=cnkUaugBgeoeBxDE4ctTFo6&Sh1C2`cfLOZ6_bBam}34wwhi!s7#;Mimm
z)`O&eVXNsEn7BaO?ZBBp*a;jvOu}B%n7PCmeIWT$I0Z^qLEIo*2g&@x`@n`xcVp%f
zm>&0olY>e46vVi5;5@=4d;zNQ5tRRB`UVy*(D}2VG{7Xn2a0PkCJ`a9IZPsA(;tAO
zr9dUF7?X$+#2OJ5@WMuBArU=r8RsPe3RF;11gCLC87Bg2bz(^zBA|f+%*A*@A~leu
zlR_dZrY``MY9fcg?vxS%RZ^JUUm=l4(*>Bg#F#{$O;=#&5@Ql&0EITQkf_r11*}}+
zj8+hbi`q@U0OC4<y(c9Kn$7{m2U^i6>Icc;qG8~qBqa)3R|N7FEGt24SkX9e(h^OA
z6cnOqkOD$93zD-%K?@C#wSgSZz$YYH0M6O<LZUd*3U~`QHg|zW6|e-ODE7{$5U5Fo
zttkuM>WQs}6|(_nN-41z1_o?-Ppkl(_n5@$An8r44V)0z#6V-0>!-J{b16?h&&I{U
zxNf=wE0>s*7|3B*qD$=7^aE^M;*9se%9zBVu_Z18i8XOENU{@mf<&9R8zk|Idx7JP
zN!$-&y?7AVdM5EKsQN0X`Z}okCaC&0NS+e!0;eKI@#*?(T;fdPvmkZ1_%TRbFMbNj
ze*(@NQlJdafW`F^T+<6!xx|<x_`uGWk^rT4Z0h_ViBcj6oG7Iva1`Vc9ncC+Vg;BX
zEhGUdOtG1G3Tomxu!&3(kEVa%<PvB6H2nc6)k|_szaYgWmLv&kV}r^vP<8}$ZXtsn
zLXw~afs`OqK+(g%Cj`DA8KfSPz8Pd;>P@iTrYI!oH2nfMmpEe>)Y>Spwe^zVZUKC<
zY&G0?)IK9i3bdOd3CbS`YZ2n0;bf3F#Q6wu(4YcH9O6ub_#*IF0DN5}LIQOG4MH5$
zufbe0B_xS9e<2U*%!0z_*Yt#gpu$@c)cXeYG|>tSDXZxRIJv}_q}--2;0Dog(+fC2
zbRIZ_q@+Nz3|KO>RNZt35s<p3=>c3IdJ1TuTa;NyYTon*V1aeh6L`498Fx%S0BXxi
z-2vxMBWX|t0vhOsgb<`j$G|59zIGNQ4hbQIc+m6*yj-BujuUve#H6HiuxD@SDPZH7
zq`yJDBf|voj*Jw<J2F}j@5q3R$Ko9sD~NYw>>#d}ae{bD#tq~PF(#Rq=>Y;<;*2F=
z$`CZ!1&U6nCuE_?LIyRO8Q|g*z}gsBK&S)IpprQSwd@|$k~fgBlKBS_mt}*9%R)MC
zOtK2#+|49w0;N5mbP2@svQ1EZT~K{9!17YEp!PbJ!dG?|RQ*1v`XgZVOtN>tw3IAp
zSt}NOatvU3COHW(EhPsERBY;O!17FT5n$R&4pe7iQwJLB2E{!zI3bbGCnN`20Rs{T
znGX?U0JZ<+9)QhblKTOsjpRXT3QKgz!wM6qepqzKL)^_IZvfWMByR-?2YD}WI7rEZ
zmO^0Zm&w;a)%SpDBYD*JCOo?3VI#5V_AUYIW0Kzir5}Lf%}4<@!VK|03#@;o0LrT%
ze}PJA(9}OD9vS$A6y&Bm2y%%@DS*_23Pp(gYVd6%AbB%LqE~Q(Bzgr<8wM0cAoD=I
zQfR+j0laWRR9Z*@G!%xVqot5FJwTXCj7gzrnh=PZHBA~sEt-Bn6hvQ}E+7t~A5Bk?
z0MXy3FOcFAV^ZXrZU9oQ$T$4}NL*2BdV&y_n3p1G3Iy31pm7QYJ|RU=G=sbe@(!rX
zhvp_lw5dE;^eL_YEzK5X7E(L_V?Yyx;tz0(msv;&l4GQlKwBnI?(_g9BR(M|J+Q~5
zlt5O3LJ&kVFsx1mb-)<-gp|y{9#*oOE+E1sCZz-lA1p3cY62U>q|^seE~Nw;q(V1s
z8q^rj>PIYvkJ2_s;iI$<Qs^jMfff)-_aF&V>DBZHVqD^ke<0<9vI02WBq@XJ0p$-6
z4e}Tm^9d=tF)%QI#G&aAEX=?sqzrN&Xmk#uo=Fkp9*{UF9fQOn>Jj3Q2%erM$t5t|
zPmqg)N%<Kls>K;!O-}%&0Ofbn8^pN8rXK?-m?sKS@C}?ql>bdPkmeHi1dVthViumT
zRX`2^i9-@DLL4*%jHQ53ahon6#U;)d1PW#&70|X5EU}>iYwLncM~Y09B(N))RMMtT
zkmdqi<pFXulgcJY@>SUe@{<^o$}dP@t8#%$0V7q=u5B!(fGUn;teOQePc?6P0VrFj
z7D3EaEt|do%x{9yN5HYir1}k#JyidJvj>wJ(=<6Q&=n#EAj%G6n3@~J5H+vq2_RuV
zup6hd$#V%#?-%1@XHpA;n4%Unz2GFLD6^1S9N76xYDthnKrIbyyp$ShlZ8P6+NoA6
z0v8fYYITq}Rco5wAju`hq}Dcl0w|8vx~6ZC<Pwuo10^0%R)Hjv)u}N3)22TFtDiOf
zgB+LmbbnzkaVE7z5WlJ|gF0dr)RJ|Ol&-c7lG4?7f&IJ>6t7Hb$H0v-Cbd)3!9j2i
zl$4~@K-1Ak_QINGYS+M}kdzvz_Y0DT#X6|cV&D@}dp12m8su)!?ki+@Xckv{2hNoB
zYM?dLSXxwSplNDQ8ikn40Iozq=Aw=X!o}4=xeQAKOC7Wr9XYi^3t#XRz09B)W{3sw
zOrQ?hVF<DqEpw>LOuujs)Ra>P6>3;YYjr(v%uA_*+P=s(LOXBj9^hd!^_uAuK%=PY
zpy6v|WzgbS{RYe)Pz+<U=L6Ur4KYY@uVDr*?u|51=cVBO(EyDyVeyYf*>r=IoTA=B
z8ldVQqyUn#7-XRi(EyF@V+m0W&@d3P!=e7uSOj*Elm=)N4`d!%z-p`lJ5)*ow$KtS
zfHn4ktJQi9(6~G(#X#iY)v5-_UC8!AV^RZkMID0*wEofnrCg9Zp#Fl3U%}ot(EzQe
zV_}$HD$XUyr11!ngEZcO9mS;a2~vn@YJok;r0E6rjFu*7QUGKLnrAg(qrMPNu%v95
zro<)2B@0UJ417YGS<^o(1|=p<>|5`IG!KAhYP^LsL7|JKL#K&0JuC+uRMG_HFOY+v
zzJ`l`nAQy{pR@#^m9~}%jNt=gq`(-k0a~pk;DJ(RA+0^rAJ~Dlp8<C?nT51&K=x+}
zY4bpJX~PWEPM8ilvV>Vky8^0My9KPcUPv3X8XV+0NN_R8LBm5EHns+HHB21T&%}}j
zwb6YK4rV?fZFJwm#6ji>A<YbcN()e1R{IasWjdh78M4bj%L^Fzgmgf*gT!GjgNcI-
z1IdB(K}-WTj&)G$Tn0I4D%AnaE+Lx(69<`#&1E_^V3&Cd>41iTK{{b!25QEGTn0;G
zAQKoE7{JYYkT|Hdgw16sU;~+jbc&`g*bACy(t-7(U?zal8ps6Dlr}aKdcY=l3+aGb
zEXYm*ji`b&Li*G2-EeX+aqK&}gmkum4P+M5IW^q@;v~=j8OUUqlR%yUnGA9oHYYs+
zn~*G|1Do7M4<)qv0v1ZTpmp+~Mi)dqlQw8XkAY7}7sLmNLmYq*ht|)!P17f+bBQx{
zO%G7z5|h$}HIhNv7#JAjq1jM(*7O7FT;h^w0RoraF#Q2&^M{b`qv;0wKp9K-)AWJ^
zAch{(^an>llM{N=`HyjmNek(rr6_sOxHto!ke<=>1;;>Th#stjhq(bX{RUDHH2uR7
zumaG;At+E`3ZNYsy`t$2M>$24h4fIzO&H{%!#H}NMh8eEBrp)-FmJ&O1SJ@djj*B}
zrXD7KZu$caE^$d%i44;Q8rA}7yER=vlS^C@)KoyW4JQ2q8d&;Hps*K{(nre?3Q+&(
z`%Q09<r1sc2em|z41&vp3R^5~4SlraEDz1&`mmY|<{g+g%$rbu=zs>@82E(rK@+3Q
zpd-4V8sHMgpbkf?suZB9MgJPu;YRwP#uT!{Ve+7fQ!EZQV1k%yfZBs)P=JQJ0UyL%
z16Z2|>MpoEXiW<?bKRikq6ai|3dSG^Y_699XoC~7dtvf80@?r+P*^$`MoiNuXmN=#
z8Sza6Qw89Dq_mJRsPTqHy|Erdy|LBw1ds;f9IysvA>(;aiA7+8jGs(*um@!-6Beif
z6Ucdr(n2O6r-Is;XyvyFWJ89rkO^q03v*k9kO?SkvAD^k2ik5k0j*=e(rz<Z0B-m(
znQQ^K-%MUiZ#d5($}D8^Yx)CiE-@yPf72)Ea)~o?fXDcag-kWDu1FR##nDSM4FRnW
z7GpA<G`&EFON_~M-gE&YE-@oh(5ezF4mJfv22y)U2%6YT-+;r)SjY^NI<ROoLmSV4
zX*8PxZnGE*nSnaCSUTEfARDn6cxAdlAeR`E**!=|m^}i8gcy_gl<6NpGt%Z8z)cKk
zA#+gChov!O!2{avFDfl$0iI64SeYwiu?8~aWAO+QHWtsoVIyS;@*;8=fKmkmpO9tE
zbOmtaSgrvtxUUzo0xhw@;&v-gmck~EBbiu%QU^BmpfU`LxHYJqVGF99&=RUO$m!TL
zfYf3WZ-QhE>$d3%hFs!|Ea1qJ7P0~D(8Us2HaTDg#zHorxh8B1K$Qd*i)<Ev6L7td
z4XBBOO#!HW!X}P=|DzB{DYnTdThPinERkmmDt&yWFZsnGXe49{TI7Yr^|mJ%7#KmF
zMzmnHo!+m-CC+4fY5E33E^$dnp8$3M!|EJRtTONk**=;cV8|sVWeaL=g8C|ungAjH
z3oOrM=L89KJGbcqrd;BTJ>W2v7P15NQLwnmZqsxJkh*P<<Y@=$@_@XL=199s5M|e(
zrr!c9XR^BoE)J#a9$@#I-LvTzjJU+4>_8PQva3Nc$-pOM_ig$IV=l3JJ5ad@8o+}1
z3fj8m6S4!fr9fE_P23(72_W;pt!;+YIZ*TLLCyw=L)5R%fi?&2K?B1e^FetBYC5Pf
zZV#Ddnts%nOVG<6RA(V+PJ>RV*n{?mfgFLZSq-{83+f2CdcElh##~}d_GVzuG1=Qq
zpJ2=-CS?!03<paBuy>h$;2(#mw2(b0dCkWxOY9@2U$_Y>xa~8bCB8kVMUJJ!w{L)y
z`1Vu4CBFR}n8tmOc(XqQuB99lz!`>F$UzHIIyqQ@<I~FlRM29Heh1Kj0ocSrJ$7v3
z&>F#E8rWPW2gup5(n5})u)>lI9Rt7xF0+v13^1c!$Pv~qheRcVBFG60d_s<(41&}G
zfQy3$FEE#@3pt`qlqo{nc#fbXhinc^95iqCZTgo?E}?oS?8ngvIf1+lN`j!|2I|{G
z^*Z6G_?$pREjINya+?#x&B3rz0PcAwbVox2#R=qSES`5ZVPHVMuu>>v`UOiav3f;N
z8O6XS<c!u1RfLu{&aep$Sm1-w8%X^k@bo3zUC=!QLe6OIR=D}7D{vT~<}(X9Z<^k4
z8q_0n2JPZTiUzoeI2xcX4AUnp;1sPFashb_OH0xPb$o<D5n2Sepmkp1;-DbJ5_B#w
zr^A8(q>h14$OY_RP#p;^4qyq;We3=0#zHP=oeo84;p75K(J+lL@gI<Z5?2AJ0j{8e
z2oxqTt3k<%fltU)2^#t^17PARpcUt0My{aCr;+tRo$LzR!UEF=6L)})mbiAnY{n74
zuBfxq46s;oT?5w0EaduZdV&p?7?bO#=^L!L#H3t72@*>_cVmIhbhs%%rZ(Ixz=Pvb
zZlE!KEG3Cs1-Pg(7IFg(0%B7Ds@p-OGc+$kN_RdXcOJ+hN_Vm83#_@snB1kNKd|Kz
zXOsa8OS!`eZ%7!g&J_e{<P&n&ng;TRyAD_xle^V)0~;<eDR)qh7gRSuf^c;%Xk>ta
zPsqJ&`UkK)Xi5tt4=Udn7*^+k7i91WxlaOzi<CQRhGIzpwNya*7fqjF!zEVl4$43v
z{ZQxRfJPrc@~8oi&<9GLAoWoD;Ofyz8ewSj(j9de3}Fsv=o6^}iI6w}t!mss;ftlJ
zalZquVmuTeHIBzDNHBXW0|m1flgB2o$C*5~ffEFi#}05C-&@E7mJ1+0g<I%>+7pF~
zdx8ePv9!QFeWqWS4;pLmf^0XzSbFTGG9A1g%c}<51Y#EQS_4gcUMC=F&+7p=ZFviM
zfu<0!q%AK{^8?gufVdTuLcl|A-Z+{Q-Ui^Yp?V>2&_YR2GZ$SWtPp~VD}q{O417Y~
zpz#BcdPwp@ScKNyg{ueUU{HoYOZ48L;S&~6;RLZ@buP$IkOkAGD>!h8F?nAB2Zpqe
zH^|FaGN_LRG?08;rYAUYiA#cP!V)w-kcDC1LO!6zIyMEMaVjif=L5<KAaOLW`W%3U
zoe!w;134Sw1$bEappCaFLbHeus7?f_M>h}@d7#n|Dh^Zc3o;Q)*!hAQ@wT8-?a%_%
z7gQ-?@uBYl1_nk$%;uW!Ed~ZgMT{+<LcaH);!p>H+yQEY`hoH=%zRadC^(t<ftKQc
z8lh+o@@tuX;U}k9k{_sNmyPKFKTvNNW+1Y8JFvIX{Xk>epuz+a;_yV{_iB293zwLb
zKghvY%=32u4|W&}`GeX?*c5=88Q8?ZJCntv{6T~5SmXmBT}5W002OFz4DbMFS*ZXV
z$uR(u9F2tna3se7P=Sjjy$3+n=12<#fF^0Mx#bSDkO%;c=wnj=N`IgP4GBGHc=HJb
zf?^FM4hlV}C@8uEb-)Q-S||`yHiNcifD|GthyV{xNCkqn%zzR$y1`}B13-0bAZQv5
zB#&-E-E@cNppr2VlyI@6^uRgOwu0qBr4Ohni|&9^(*@kQ#2L>`FL37)V+y=AUBQh@
z%qS3+OhD-sRL6ns<r4}7?GFScA2jhGrs*GCxx|=)xIpHJGxC9rkqQD;o!FE^whDO*
z1%aG|C8~lzEjcU^5Cj_Q$0mLWYX3cu{bEePI@2dS0*%cDPl8AUPlHOlnjYZECB_u|
zZu$WaE^)?R(;Gaw#2J~UUjTVOgbhk7fmDezYE54N7S@BPGJ?uNY8h{#5KyMX;`$IA
znKA@4D~rYTp-dp_#F#?)AohjEKwTet4C4CGQxMmOo`ZyID5%+qC0s+VK@GYEHRvA5
z;bKgok034&W1GGK<ohtG=?=bJVoYI5P`(?OpA?2RmahaIwF^swwnm}JQwiD$3Inb2
zM=E#W>OsjBSsbPwwhbk00=RBs77E)iUEvU@a}b6jY{GH0{lk608kvQ{Aq&u$!gF8(
z6_DY$@E(}J0x*L~C}Mj4D^9Uwp$JeWKz1G|cQWt^MSz+Ypw=Hq9x0bbz#7#s??byt
z5wH<#aPDAWP=bm3OgB*E5@U);fVd>01ndB2p@<F`V+L4-R0Jp@K`w!s%mnJ$f?RTK
zdV@cgI3r}S9#g~zsJ=)R7=s65KqTtKJcAOb4q@OEinIgAtW+e(J0J^SPK3$3O<xee
zC0-92hCu4Aia<jm60Px~1S(!Y#)29z$i~6MLA3%lbI=nMsFnbk15Hp`3@~@WBtR(z
zn?ZSC|1d=sf!&=5n_Ps3n-Zuk3^Etg5<zw!OdQl$0*S-aL&G@|)Gq@C5n7B#E&^L8
z6^Ys=XHbIaTL*TAC#W+5D&x?#!`dS->!1lE3gk18Ghn`kiE}^_N|X#VdZP@$3@M=~
zkmEo)peDf*NYwOtA1-mGs1T^e46u4;p{N=dV**rW2~1!Ilo2ffW2iusL|ecFoWQ<j
ziuM8*2TajnP`UtIjTs9?gDOstAE5pffli=CgX&8x;xSCq1zv%2cMNO}3FdK7`Od&6
z6a$*{0(lW?ASBcA3B}kzofMNcJpnX&ACom*Aqcb@Er?5S`uspHcBYuN=?B0vUDFF<
zxWtTNKv9fTCgwwX%rT(R1uTVbEFZ+=SUIrCOtE@kx;_?1vm+LiRIn8Gv1t8hB~Vx}
z@Cn7j=J8-&hKYm15SuxWDtCHmFqa@x?5pVyg1E$(V&6?q2m#TbrV9jfiFw6=!U>Ta
zSW-Zf9t?a!aj;<oh-C<I(3Ayo#6YuueAn~~!Cc~uvmn;QFM?PTzYJ^*Q-av^f?zH&
zrUW^#yjKEj?K315!i`TrJ(dnGo&=iDz~aZG8`B?vXFigdAQmRGK`ct<f>@j^1h&vD
z8MVZP8=MSED<J=)`7;$1@pq<&gmNiaiGU)CflnwEL}Q8gR2;Q)>IJal>V?ukh9L(U
z$RGwjp)^oOA6Xn4nBc)+WN}bi3#1;@KE);uO8nTwK_hf5(@Vm*gc(;&7YO4LXFLX>
z9!)O*@t#3=pQay(<q~5`=bQc@6hzBSPYCA{XH=Lz0d&reP`Va`?*^f=psI=>+%^c+
z0aH8)!e0iVwn3;JFxf*8{w0vbVp18P`VmXCW@vyzPFg4fRGwi|&;wTBEtCNY8Z2JV
z0Bs?{CJsv9*u;-Pe3fwu>@uc|OVbxbf;XT+(pTmb@O7iiLYea*2`qCNIAKX;f-J(4
zC^Gj!5@hBna6<ITL@U9S!6g%)P!?K21{VhvWLRo~ESu>c47kLYvU(tcOj%pNA;Bz^
zEdXX13uWV&Qp*PQVz9V0`wCd2w@?nqN-SZM0~!;+CJyR9U=vq^gk_G_bb%Ny&?#GB
zDh*t`O67ohCZG%fZSlj3)ts{F4j|Q4pwd^Iu?|w0<}`r|(WD&oqz|p$b8y6e4k%i%
zxeZ7B=Ro5>=N!b%_aM|Ks4Kof-1ZCX7^a+mAUBE`<$`WK0W~K<g(x^aK?I*rE~rz1
zY&mGCo`Fv&ciVIU&~};JL(?6=^a<!vk=!egiZk~Gm^R7-<qIqZ<e|5&pa$oC07s#;
zP(CP1u*7kG&~$}3@Wz-15LE`w@Lu__#t5VoX3zyKU|`@A$_EV)A__%>IH<9L#aRV%
zkO(i(f@Gco9cXqhFoO#CLFqE6!Zs*>7T6(71-qs%kmVASDgbQ;N3vKMRCO}&2^Ach
z?f}|vRB&o~0hoq_msbI3APS3v3SooYP>(4?Ta|^NWmL%K!^9zbWTXl~1IgIT>zZzm
z0IuC8fT%f8?-eea4(1<&P@kr6kmnMUDuj(SL8=r6WoS|@f^3A5Dgvb#ES3~O1E;8J
zx<C?_IAb3qY>M_x|B%2X##D4@`h;W<eQLTwB8WaW{Xrs^xa0-Ub+(w}I7N@3%AP<A
zuA)!V7l4elgG52G*Ypb@t`FER)6XVxNipVug(N}l#gc}KCqWE==9J=dVAYKGAkHlQ
zG%cA+oblWAfD|rqLs&RN!(SIv(J}A|m4Nt2;SU$L01xmo3zdX{^)p6I{{S*AZn{DW
zmpJ1Bs256BL1foKginDLN#Ym>D!DfO0Z8*Lh~j%-t&&f$hgQiah^k-HFQjsbOM<c=
zmJlcvo4z0wyn7p@iZN@tK^l06Kmkaw1{{#gLZxlf!Td#F3gkM*M9k<Zy)_M__a4|j
z#!nEFzD-w1=aQd(JeG@}sZ0zK?PW^S1Jb#~C2{2ZvN}j~mi2-3iZf1tx}t0rguf0#
zZG#$i2$W{T>dQgp6qY1d4%!O>iXTusF)%RbfVv|Ld_v{0c`-<tjSvS7Rf8%psCoua
z4FXaR8hQqaL)F8@LA^IN(79tU4bT#&9MpY7)&LU+ZK(u_!_-3)Qh6Q&0|Q7LW&unb
zG)@2#hp7jZhad-mx_2OPaGnG$NrFj$e26V1V3`<dkTSIKU;b-)gA$h*Qw0mSq^_^v
zV_;wesR3b7sDd${P=yjy9Bd(25Iihf0h&4jb#l<vgBIL^#L?A*228NHuL2a3EDY0+
zW^xHJra?;6ik|5YKo{`{RUDdrAQRTu6Jx4)Fnz&a4$*p{N>J5{6urvO&TJ)Y)CKA&
zWl$x_z$a7*3N>W)pz<Fij@o)>P=U5vD?t-k2=(wrb|ttI4H_MX`VOuE)Wt&90Geq6
zSpe$>Kpg~I3||Rq&?3|`sK7h`nil|xL(PYK3^X$a69?H3_Zh5)gINHYr~+Ax*2hwY
z`4~KL3*YjK@EK$cC43373d|hTii{=Y5CbUH^9fagd<b(90|R{de<frt4Pg+>XJ~6M
zRbWvA8|Q)g7%mQKEMsXlR=!}+$9im3C8!F;rs2<YfojlzXVnI9+k#oB>e}>#IxeyL
zD$tNE$P3WCrwdxz#lR<21zM*A5{HJVF4$>&LRGM=1XB+a2aSCrs|O`@kU6lHGE6;G
zyc(1Zm_hdnz$^eO;1j9_HNQXxfemJ0(1nSEX4*jFF!i9m9s{3HHE7`uNF1gfCawbZ
zX}wT2Y#0uzQ3X1PRShcckTk-@LCpp%VOWhm_5^BygB$>=VX>(PjVxeWU0=fhjtp<1
z8c<kc(OCm(C}9%^HJh=CZvY!8EmR9?iDOYvD*#qtEL4l$mWBGE4pbmwsUz!7fCEul
zs2)^=gHj_Xc3=e{1D{a64om?kR829f#`*xT)yzWmWz!ARxx|?2tEMNYbBRgSgU0r;
zxV63mrs3Ii2Ro34SJN+m+Sm1;rXR535;LktO;IeVp#CxgpHKs6dKiln8}z{Xm>P_x
z3kY(F2{oXOiL#__nEs%UOKkc-Q7#Uz23TT&q$ZYBXwGeb)tQh)#F7f?k$^0PjfBF~
z!^DfgmU=aSChk6B21^6D5JeP0aPwegCCogS{Y$1hNOOv63pK#XE|^1L3ed`^)D6=M
zinzp-;0B`>NpKG|Dou9)9iY<)s>(pQ0i4|!SW-c$nt@NK(Pg^9R}RtXUyHc}r~Cck
z<fv~1H3zV%L|w>_umM)Tz)Xe)Q6uWe7(zXAG0(t&5Qq3+`c)1tL9a&GrX84}&_vJ(
zTN4Hg9++jI;WLn<Vc`lBe+Nz!OpX7he-Pyoo4%}+OJMpv4la)RCQwQT=|Hog3AG$z
zNd---G4KgBp_W4kanPDUkU20HK_jdQ)~kV;4-;2mU|>vTm~Q%&Lx5SR$!vPSEl|PT
zWCh6$O?J~8AOcR{6vou#2aZ6aCLGby1e(kS6}BM%FfcHPL0ffAbug2gU?#Rrzfca|
zUUH#?ORT;LR(nDm&Y%k_l|UXvO@R!m&`PWct@ebgM@^Xs^&ov%3V<d^R81EZ<Pv0R
zdIpXcrluFrUPIF-aA_db1gmdg!3RwM%}kI8ZRP@NG-?L5{;`w_%_0m8jFFfbvsn%t
zoLbE|@<TJIX@`hT23?Qo3o5w8q*S4!fX%R#SCE7TlD|;FCB_Gr2Q^oPrt?&CDNgtO
z!^v6S3~Kv<41{?En(>-JgJoFatr=EwK%xa+LN&u$Uodl^>8Tl3qQKNci~MFt_7jFR
zQdm-95^KOgJw3FFOF)?=6%<Phd_v8zScDl56F&t?G-6E6=ca>FjZ`xv_TcLRVX2_`
z+4KTUE-|BK(5hvScVW(fITN(j10)U$H)v{W{x*GqCYM-!GkSc(^nsR_VM#?TATf}6
z5PKMOLG=>@pHK@dn?l7^p{?B()FE<&dPw%IhXoS@Tmz`j0kQ;|uOO8opHK_PU}TG7
z7Qhk)NS=X#K@HRg1UU#+9l<;fQx6;C28-7tX#m9lHjB}#C};?^z$WED`atC=OdM8V
zKpX@wuv$R9H;@Ow7BfJ^SwSw%fK&yhHL$9n1=gj284XRlEwHo*F&bWUw4kO%22dUY
zEre)+^#mYRBGjYx1mNmH%@rX~8yr3G(aS7YV4{^-YM{sic?rGDf~kk4cBq5k>OrX<
z9`>L<2sqmLgj!Hr_VCQq0&CgBLIP$1>e@F3HE8kCg0}VzmML3c^%~Scx*&6=2iI~5
zWyAHhq9$#4#o3CQv=QPUH-RD=M1v9rv;b&DNqG!#zqE!ys-V^=a1qSZngy<bj9Nk6
zcaS--Q~)iCTS3iLEJbf?A6Oq#>m+bdE!7H(eV98yfy}@s)Vc^#gtwv&Y$DtP>-NFy
zh3VTgErd(Vs1-GC5!zsJ3)2P~bOu@X4D77>R#-^`a}G4Ww1P?+EN$dA&`1Qx`!My;
z20<Groq)t4Q3lCJ417Xuu;_r<4>i9HG%NNIOQLRrl@KrsU>aZ<9^D|cfdO4;e6*nr
z45)!dOF#~SHQc}s4Pjt_Yk;-fz!D4$a1Eer4)PsZ?rTHOeb6$uZ6CO)AuZH~)?bDd
z%5CSsO%Q3JHdwYm_tF<|^VeIb9aIE>0u?PR+ChAfIGV<G9NQS$lR#;tz8y3og{%#l
z7TVE$0u91;^l}6`WZ#aO*5D!74ohpW5QM1*B~>8?ag3#^U7-Gg?er@RTuSv~pbjSk
zpHLT$wJ%+u&OVm>)eUO$Ah#T#=5&J+7&i5wA#BWqZ7kFcntQ@#5Uhm`3Umer2Hh>7
zQjkxmd)2f?E-|TYSRg??4VT_E-Jp?6%%~fb?vRZIm1PWkLfxRd9x>e^)XN4kmZ?_>
ztUaj@Rw+Pj*Mo*>AFP;wBmoAvIINg}sfUj0^ue47Qx6m0HT?j{8-1|2gULfznf4u;
z{-KdetiBJ@A7NmC$wNn%`au(HSiI2>>YpNe8(QS|gQ5qUdXPMp=;{Y$e<q}ILJXvk
zflsI(l&G+20EuC<0JP@~n}cu^bQ58HU2s57|I^6DB{vaP)<EN04;l!Q!D(u`ObaL-
zL+h2vp!xudJ0^pY56F#Z#mQvQTmZ8BVCI0-f-t&zP=3HPUsz}gXjlZrpy?l4xx_6&
z0nflEGzC_Ff&In6U<fMSK;p3S5*opVF!goQ543QJNlk&3n=pOQLSjnS^bajuVp>zs
zT0w@O7Cp#ZSStu-Zo%}1HZE~aXf~KKZ+b!tm)P`eZCrw!&?&7c%cf5NiHWsy335WC
zd&;)y3awmX)7?N~pav1h=yTHpTDioMrl3bHG>=Td5w%lMi&X|gXgN3)t+!(cHD{{X
z^oCY0F{Y_@(+k?T#H6Nz2HimAC@d(Td1<QG^aWsf*jO7(9+ZX|_=Kj0P2bQ8(hqB+
z!sMY*JvDB+09Ze)lLV6oC3TSgwCN6Dc~~-p$wTw%)UxRp!1AD(1Z4L?lj+pHY3*EM
zMpHp+K9Ca#%$uMi7co<m&{W9jb4=49hdeV0&75BUl~bH)CUmRs%r}sIJhOP9bPR|#
z7Mcs1-UH3bprzcopiPrl#OIxX%u6f<xeeibmQ<+wmV(Ryi9=EnLLAa*ffY>%anxu+
zh=c6LW)3I?voK5-?c@^lS_*2WfpQWgtFO+7hVgRHGS`ckJ?Z73IKn3WZMr}wmzdOY
z&^R8*Jc#4r=B><_enFN?tbP?}$Pvo{ZmVI<9%x*vLuZRt!}>E2_c6f4*GMohFoHY?
z3M^1X1;%_rYeB^s=(G)pIZUged1x&ttucbiSBODyiS@9?2}A>fA*dc>;1gO88!CsW
zhl_6jjqo5@unyGqXW$ds0Gdw)i9^&g!NfPBB+_~YxIr6XGcgbi2ysyI1SJiq&m^D)
z*G5p`h%62*F*bq3K+%lmflZ*c97r75{8R=$p-rHu0ck?BU=t{)u!wI)Yk9yNv>DXb
z#S)d9p(|jwxPa5S(H2nE&JNly@gE96am6RJ1&4iGR!x6k&Lt+b1=L&v=`(<8`w!K(
zZMuU6ml)HQFJSYfwt=#}KW0+hZZUm>440VE_ACYlM$ir?XaIps0rgL}=Rw7x0R$JH
z1J!p4Dvz%35mX#qA7o`n(sodB42oQ6_`=NHf!d{DP=`*M?11&~pyt8FL0JHsIWwk#
z78>tl0a5k4KrseNcMw-H?Etk08Tf>DfounfLrg`8gO(zK^nm0U7#Ji#?K1{Gq21`Q
z3>Du48d=1meoq7g1EUMW^wzJOf=qi#z{e#p3+-70K43v=52!4|qHC`OB+mAN5-&D+
z$l_<CeQ3=pm@D_;(6<i~_DuVErU!&_i5cw&O~PO?e?O=S#3Fux1-w;KTIc`{ix0Gb
z4VF59o@k-LbYKhE<MjtXbtE<m(CTiOhYo_G3yb=Lppi3B^g*Nb04RDG_=FCE`mrE!
zXtct_4?|k@)4#sv6sQ+E3|e=J#ndApv0_kGgd|D`$tQFKlr%x&5K|$-417XIa76wQ
z&}<r(EO!J{!-IDVK~opRBtD@dpkTq0mXCrIfV=~0s(|(zfP$BSPv|JfVvw9Mh=5@}
zp`!xRKTO~foBnMImn5UYbcKmrVo^syaSc*}t`_7OB(qtdgO5kS`Hq2s0bM<)TtrsC
zVS2z+F8M@IF^41!;)05gqoAb#*sKLvgQPwX<aLmjzzt0-))q{EFcH);oXRCx4{8}A
z=?w+(L3+V;02aNV#wn8eFp%9K^`LBm&26CIMN%IQ@-j$0C|fWvFie-5#wAz}YQ`Zc
zihwBsMJ_f&K}`Z=^&tHqLqTN#HuazYK~f(HZ9yLeH$4~_rq@m567&QW>d1;fe2}5w
z>KRK&fKoh?`Y4#8Kc=sk#-+v-%`pAKG%k7Yj3<(^Xy}mPF;H2H#jVFc^2q8z0m#57
zbPPwDJBF6#VnBS5dT5%PZa1Av&=VA(NQTBh1MC=hWChc2$3RIANqrp5(1__7)49|b
z<EHmd=Th(l`4~x6JT&bb1NT6%m<p0dQl9|wD#)oF(@#w2Qe#S3F#W@HE_ucU(;cRA
ziFqA^CK2>pa}4BoBx4d`A%r8f96K<5!Bj4>>0vXtBt6kmLJ~|bG$mlz1xf@+b|u4{
z{9<~?3@$aM<OS0=%;1t|WSE{XjY}-*IF3T(IH(PZWK1g5nBzDS!Eum0lKM1(=>jvk
z<P$;BfGiA(Rt7$y<IuQ9cl~jYJhFOFgn`uKi1y<F(;KF9iA^t?$tCFt%GgMHGeCBO
z^x`N~j)TlbRu3vDK<X=|ub9cD#+1o0{lZKx`FfBrlCmsl1RTdvejEqMBdN~@@j=Go
zNF2w}5=Sm5&4JWI6UTJBSzLnkXyr#9NE1jAj`HI;sJ{i8cY)R!plk~&kdNa?HOE0k
z#&gi*3`8Y_<P$m$Dl!;Ai+<250<gWH^>=6%oWPNuPJq%4QmB-G4dxR%0ZKO@+tAGi
z6&?un%nW4;(-mfO$$Nql4nmxv92#0DKnVw%IiQ4tq`m@_of!CpP6SMkn9ZfeSUJ6Z
zHkU#@D2X7csshD1NEIlFU^5j|ULdKjfyVI(uxl{OkrSZ02}yk|G-;jy+rz*x{oQOX
zK|@f2LRJJS(m;*?8;-@$71JGNbBSw$lL8iLQ2IeKuF+w-!yGPoPf*Mu2{(fyfKTWI
zIAE|C14=Q->cQ6W37vQ_y<!fR8dH10^aXRc<h)LR8hJ?SI-y<!-`9pE2v33%3bJ~r
zZ%+zLzX3A0M`7ArE_qMXWWdk^$_EU5LMOqdW4iVvTJq=xtK$<o=`h`5E|(h9!~@e4
zK*oaFB}kTo#-%{n<0PmE!RA=B^f3*ZdQTQip8+y<ro;3DAY;*@c_ujd@CluSMl*V8
zcM>heXTic?!So*>V`mjiSD42oUyl}(v%tpj37rH729`iTi{e?(C_9NGicg|N@f=Xu
z4+>;ZRRU`9^v&ZEWPCAgK9`u$NwCkc*ohYXbD;r$iedVWd0c8tb0<uH0P+f2F)$CD
zw)uokfm0!-v8T}De-YFxr@+QzQI8h?OQ2pk1uY(?`_1PPtVb&omO!KF6gc>?7>br!
zKquvZQp+hEspS+}YFP>nGd`hHV0#!CrmvgNCFqG(ge(V3@(G>7QG}dAOIs_z>iC3C
zO_+XTK9?HPYKCbGxa8|Wl?+nCUJVN`Fpb4)Xh~}=I9&OJPT@#er_hqtT9_-KNo#uE
z0xm&MwDhzQrU;sz(6hlQQ00T<=q=#Hz$bL-!}J*oxYU@oZkT>x0hhcdT8ROg#Q;Ua
zX>c54`t3AYTH6VZE<T~t3e$gpjNJpekPfp(*$1`#G&ISeyY@6%>e&a4xYGgCBNlS0
zF&#QEy<s7jJosu^Bu^cNru5Tb<yc&cmL875T-z{x2guly3ez8ej72LlPJ<(gPv|t*
zcr3=EC5SU%U-1c@-Y{Ka5tka%IfLmAi!f`23$Q?d#w$i3phfWou&?-pPCuAl0W$W&
zg6Rtuamg{A{xSW+5-zbQ(1Zr4TtzqM3|gFC0^7$YbOuM9o<WP#D-)(I#;hf-K?CIs
zI5lGi${Dm$;yO6+_=L_lOt)CfrN(qyV0yx0F8O-2e18WTc4xp*gT+|1e18|_8F1iW
zQI8ho_n_s(8E}4KV3>YxF_&N>TE4#z^BcGlz+xy`0(k%qNj{-7U_W9}zhb(;axSsy
zYD>5zJ<&>ohcFL=?Zl!Ntu%ND&ft7PXD&>SSi+^o^k~EMh9z9`^=SF~F*rQ<gwBBd
zi^W*9y5uof9iPxya0<dye-<qfJpntHPv|Vz>!8-v5-vecw3PD{oHqD`&Vo}q7DLf$
z9?)uWP-%14V7kOoE;XiSAErAj<&yVAD-E8*?8Z@-oJC7hFQ7quHeq@N$k-PLrY`^)
zi<UHALX*;2XwpE>M`zJe$t!3OpPexM2FTdg1=E&s$$O#|2Crd`#Zfz)MN1Fw!Jgt1
zI(uNc#WF56ruPZc6P9tw*P|5%AHey8Pv|T-IbaD|wDj;5rXC#6Sk$AXhwtDh;}Zg{
zJOU+&>F1Vl3D%<}g747yJqJw$=pl9vEj|2#sRtX5>4<Y^>ER#L(dWSW7#ODOE$0%f
zM=e+wnZQ2c6FLWuWh{oGrXEHvXtbRJ2Q(J-sHumM2c{nE7zT#veIQ4m7DJ3Y&{#eP
zR*c0^)U?LP15In^aHO?!sA-Ln7p#s?=p3{}n*MG%m!KzVF~rCZ4go%)b2y5jbErv^
zQ4kyrd_w0oOqW=}rOL!8INg2)mjYVvg;5CXaXz7QU^ip&8*0*I6a}l}6FT=`dc_JZ
zRc1!%1Jf6*;F9w?hnmJ1<)I4CgAy1BqxDbEqb4^-1#mLs6FM(2{RY@z#fE7sF={48
z*m)f1p{WKvRh~ynK(KAp=N+b7tOU8&e8Thukhy3H!4e#|d_w2J;ei<r=h4!HB{*yH
z37s#PJ_Bs7)r9E>K<1*wtu@H&417Z8p>d1hUbJYogQm6f3#R`7o9l33y22_hd9<2^
z(Gg}pSUnc^qSh>oPS7-V{=)Q#RiJQiE|}i13ZrUabb}_F^Wcn!#ay&#_5deGJ|S>y
zgZzpX%@@$3*&iIfd_ot%(G99vR&fc|qZTEMpecV)RRL*4VLIXhYEi-%3^No*qPT#T
zD8gat!Fh^-VY=UHj7|+>G&p4Wgf8GHN-m(Kpm=Z$^9fx58;-@%XelTi9Kw7;kd_~)
zQv-4YT2Yb#u2}elE`XyCi=k-AEdypK*fChtqb0X2XtKWmjz$KC>3nOr1kq|a#vHJZ
z_=GNi9fQSC)LM=awv+$Df$0`&xYU^PFHBEZ!zGW_t6?mF*$qz0Sd2xj<roV=$%}zc
z=)#BTGeE``E|`7*WGq?=D*`71KB0@y6o#JTE}|v2B5=~>6S}A{{l^+Ewdwn|a&b&o
zTgxShHd4k2T3-iBl^3C@2E$;qx~K#k2Yf;o1Exo;<x*oR`7pg<Ek?hFu@vl1KB0@?
z;J^%qi)cxr44OkPHca0EGPcTL`h&Gx^7UvjTLlhPKB0@yn8k1{T76Lij$A&Wi(ndy
zGteTr1{Q4KYy!$d>$n6NPfR!1&Lw7a5iE(t5VYE)4(68!(<|0-sWH|~pTCYv-s>V-
zA=3ahj!y`*A{v|s&<dGLXi1<EnglKhOuw;?OO2_OVcL2wc|){PqXX<yKA}rs)tHXG
zWHG&A2bY-EB^>d62`#=m9!yVI&n54PRxWfxBjOS`7h$mmtz77VriV)f(`T&bQe*1<
zF#W)KF8O-2oIU}ZT=;}8fm0b4W6{#X6mUH830=aG9xkD!hv~4;0n?!7*#<5_w1G6n
z8Q@}xPv{cZa4e2MtA%Dlizi4g6^nYb^f3$USU#ak;4lO=&o*!gg3rc63=A;N1&08i
z&?T_pSPVr=P4l3M?lQyl9UHjRm=*<0f3Sf|9=#G;0=4@xSUIM#m(h~bGH^Y?Cv+J{
za=MIG2`vXZmrv+2G<i+;+sGw|)*E760S;I`q03;yu{Z)Pv8{wTI$?UnMlLm`RSnY@
zY~+$h8!Ka63-%MA&}DG^VKEjhu^oa2@#P8AZ-9(FF=5&!jNTCA37C(dNd~>hxr|nX
zoCJG{Pw4W2=@y%~)R;~#n4SPK7A+B+0!Kcd&}A@<#j$Ah#93Gve3(81WbD}k(+_}*
zMJpuEfnCWbbOoH>Fpa%}R!>0EET7O7h3P*)#$LNHU12lE=ojO4aCGtsT>;Zrj72Lo
zu7isOKA|fC(<3%>sWIJbnBK6NOCD`Ph4CgdAzT4xdo0GH)e^VBsgO_T3XT}Qf)>NK
zpmBEv9Mhn7*=CFh6~;#}w}L|$iz8M{|8RgyjOogT=@MH&!xsytJ8a>SuSY8d9)p91
zPv{D`SjS=vS^{_svld4JxPq1d9)tbNCv*kuCs5033ztCs6|`dDG1wD)LRY~x3Z^Tr
zqNSI|&=|OiBfVTjOD~VXuH_TD3eIZ`(|NaY38Br#Fg}6ifUDrx!r}(BGUEw2cKC#@
zI!w3N%B9Bi;=}ZWtz7bkXr;g#uyK4sSHS^?#n_DL1&6rAG_T@FOjpqo)7$C$w{j_X
zq9vJk&<u1H>?ka@pw&R{!2!)Dbalb>A0WrSH<+%l4YOwh8zZ?24sR^RqNS$yU{CT1
zUA-_pVjGtl(?^Es4IpFD62)g&m_QQ+df{{xEqQzf`-)HK8pHG*AY*?7On(3}7A=;4
zfzvRb&^1UbW32bNhE_|!Mm??>OqbZsrN;C>VY<V1j8QNqR%lpV11Av7K)8k)<4o+(
zK)9ALy<$6;>U7zoT%6OFZRe6iEBTqYz@f?~bPb$Guo#RQ$xPf}fAI-jn=t*xb}m(B
zCf*0rc3@1CF!96e2d4=v#-bMeOk&W?0U2n<q8>GpnIvG&00%b%!}PozT!LuBW=xVW
zzkv<MVkl~oU;-_51~urf;YbqKP?H3cGFTm-&~<R+fQFYrjzBFYm{g!Hy^f=pxQ?2D
znAD-^>^fK<rlYT;CLktlu(^Cf*TLx-)GphJF>J=92Qw60(qb_bwGv{2n8hb_9Y=Dz
zj+WdEz#+^h1gX40?XsO*g5XUKh;|v1DcEv8q3bwGnd=qP3r=u}F<oz%zGEjSX_+%j
zf3TBF9&O}{$sA@GxWLBZ8Pt|5lLa&_Uf(cXVi(9<iwDykc417>Fj<1L0H4rxXqrMV
z5w4?FLrj*i=zlQ10&K2T!1M*Xxa7R9qoosTaB%Vof%Jou3R-vN23nG_fjanx!1Nnn
zgY7m<+l?{w#bghS`5R#4F~i{oYGuLX2s74Uy2Wl#I5=OJo&YizEizrfZsZfX0alO2
zT+|K<lPg#qpU{nh=`+CQx;0Ecup6U?!sG!{2TqJw%tfsqm^{Ji_=IlYi02z<@$3mM
zYxsn2fN4-p*uy1=HcrOm4Gt_mp&Q_`0gEHh3L1Z~IzFKr7p6z-0R>us!}NwdT=I-B
zrXM)NB^Gr9oCvU(gO&yYp`N)34qQz2H__5S;DhN8_F!~En1Y~TcoRqIa1*U`2nJin
zCv+3+Z7kNJrIBE$cW;98DySE~7o!ux1X_m+DkpE^C>?I1C8#j4<$OXn6Q)<}1%+X_
z!Sn@tx#a6nn-xq^FwcQAA{NJ@)kV=@b$miM!C{L<Jz9c_g{g-osOfzBFb21n5@3#i
zrXuuG;3itl1v<kG92f_tTkHdQF6qGZgnbyJTTCg?QtKv|#^PAC$|x1)jt|pkfX&S?
zn0^3cE?Pp#fU3I%E)6ivy@gi4WWm%cO#cBkH|xW6h5Z=)7N%@)3gZ*H1x*R);cyGB
z%E$q$;}g0SFg;>FC>(McrZ?=z=(sTDfCHaT=oXGz;1*h<$OR`dKA~IS$iw14v_z2y
zHkVK67Bo>zf484Y5N$Aw2{zPt3+xyyhN2ZMh0ttq3rC{3g_bCa!KDJ9&@He&P&PWi
zC5YDTVJd}%7>@ep7O1{Jsz1wMF^3}s-9k%2WnjzsgdklxP`Bp*mw?wTw1TM|oNoAp
zK$l8@3k$T$={8z=tA(0+TVVQ)1E6@WSD1DXvvLA2Drevmx(&|zm?3-{t>CE##{{3y
zZHMU=2f@Z3n4SPK7p*L52D_0@=r%You$YThIkkcVi%;lw!Soqmb2}KO9{`z)mTWp<
z_Cu2mdUC&wR+e-@v&ZcP(|>@??J1b9aEJ?iX&F-=G&$Y|2OAdmqSZGO!0PyfZsSN4
zx6u;CByc$J3Ec+!6V&oL1X@})J>e>sn9*%;GQ?sjS{j%P*32h#hhh4TL!iK);xPTe
zAuf5eDSoCY;K1P%x&!t+rnz^}YM-glv~|Z|y2N3Sxl<FSI~>OB-An~%D?Xt+;Jl8-
zT(m?m4Xln&=uX1)io;y0Oia_K&p*tifZn&60rM7)qT>!)8kh+U%R3XM-vB#z=7VWR
zxa1jEOkZ%FODyUR*p*mZhnD$gLzB`Sa8zPZj~3-~HcU@Af-&jO1lr*Vs#xxTeSyUo
zwCoPr@CH_oBhv4nMfyBw@pBiPqd>ivBN&tZO!J`0_bxalF&%Lit#*MeKfH@0h1^9;
zAq$`}c^6ttOxHWgC5SfB!n7FdLO!9pU>9R?1X@+J7_5#@=x)IDh@)I;Op6nyHyp*7
zXkl6oGZySeEXJbMM9aZ$<P*BvFntHe*yRVNKL8nvRx+%F*$z$ySd2xhTUJ3c)!hx#
zC5~~aF>N_8-QgH!?_?`D2Ka;^YoM?gi&ijfg(l{^52jaujNN)*`hsIza`ku7lEF4;
z41i9B0S5?L`F{_s{NE1FOngH3!0y3x$33(Zu^;M=dyo_{o%cA#uou%oaFXQ{x(5zn
zEM}rr7ND~~KuP_c!*q+|pcR4&(-V$kEH7h%jZ)tOI|0L3VGdBn1#MP^F1Z&1XIMUA
z4p7;PEDj1<20md9P>w?u2k{yBggHUs#td514>d>_6lNd^P*@;o5C)}wkT}Sn$l{;`
z3=#*?$l{>N3?vTn0J1o!-~x$*QYb>ao<SIt7C{oAG=-305C)|=kT{4&76*j@NF3yI
zWN}at1ri7O99bO12Z@6s3|Sl;67_t-Tp*t#OMp@v1D`M#DE5)WML_C6;-HvC76*kG
zNF0<Zk;S1Q#{~)zWO0ywka|$6tVfmr1tmxV6e7stAcH~Tpu!wk92CSLagfiE#leLG
zpD-7w6h;;YS;)XA%#9S4;6t1gz(K($%nfoGk_JVnkGVm`1F|?MWIzUi9E>au(hm{`
zIT%?S#Ao0W76275NaFJrFo3o#^9c*=n6B`hORQc1El!~mc)|i`KC}V(0AwIqs&|5>
z4FOP`BUuE#gaV`<Ekw+q4i*3f05fRQJ2W?>!CZ`%Xe>Z+2{H(jMvyGXhKhqP&qNZ3
zsTTx=B$7DHp@N_i2`*mGz>o&@nII@p!6g_N%%DLIUJ`{QJ`d_+K~Q2t5>El86$U<G
zL6CV!;xnKg69oAjNjw!4m8KvKXmJf){39#~Qh=nv24+ye^bKs>Vp4*j_70LfENBH2
zrW-JEi`5H)5+#zn6(~eN_Mw&s45pwc1&M>o3ncYspiBW0M=K`Gpov-#B#)&2C@4xn
z>LF=Pn*n;<8iOe;WI!~M2DpQFKpl*h=HLznIS@%7+`(vR>o6>UKn_7tKO0n@fgFaG
zv=)NWK1dvrw1nXft^vge1D~*v!1M=?xWtTv(2_<CDC9x%Xi<F><WP{f2RL&j34t7h
z<PccQ3W4;44qk(%eNfH70MZ94UJ&Boa0ZKm(mIkkrqCoPR55+QV=l3JAy7;p`hW~<
zpo4Ef=0Rct?k^LNKS1Ij{mAOUV>Nuj;HnMD9utuNK<YvMLQ>BG+R+UXhh%!tS%DBQ
zn1DPCk^sd3vIfu*MIdps7%%~OjDb%WToodzX9pc+3=&7ltPBh$;2_}>23L`A^*js=
z?4TokKpG6DCp_U2s|Q~`3s=CvzzL0NVUPoneFzf=IRsffD9wY+L(4-Zpd<$p2jvxH
z^`MvoiG%bZ7i*vsia}8bu3M2cK!a8oEl-$2OC4cQUO-k44q!fEVNg^cc>p?GE-Z`^
z;`Iy+;N}U)MQA~83Uw*CZbh<y1C&-6_=H8!g4`4u<RT!4A*ttvrWp~mV$c+1PCdvV
zP$ojw08InnJKd0cU<}HAAoU=JA*tsA`3NKqiW(&Krl3Rz5(gDy$m&6f8YJGpz@W!~
ztN~^LC~lB7fZ`COVaD_Y&$z_AL_oy^vOFl4g5=Sn$PDCTkT@vqAghOopO}6im|ILr
z1msX8c}~!AQ6PN}rcc-ak_W{MlDu#VD31ArMSe_Ac*rFtB?>C9k>#ODMpR&Wg9^8p
zlqgz^2tmyk)tJ7486*#?aFFy1K?6wCVfqDmkUS_aAj?Bb4bh0{3OpcrP{1R}3xY1y
zW8f1OEtnbrk_IIVBxxbg$#)>>j_D5UAbGSx34Ag+NPfZe1X*sedQniYBIy?do&Eum
z2RRcd`pjY82Bmyt^`K*bK<YukjI171ZGyx>=?7UoD7Zl4pkQZaKvYlWAb&FO34_i$
zVL;L#04;>XIHni8<P!4|1C^f0@}Tqr(g!ja*#RJrgTz4&M^+Cy7#SpPG2P(@mzb0o
z$f3ycAoU>mfax3la*0Wbp=AhuX#9#z_y5i%UN450{`o=S2GS0S7i8x^lfM{R^5+Mg
zhYnH?axRj33s3<75(jw?$$8MF<icX0ctZ|93uw9*L(32R&<rnjV!8q-y^4V%3duk|
zXjv-uV0yzGZZRn_P{bh1L(6orAJZQQaf?ZbqvZ!akVhH#gvAA>D|mzCLGggBA6i0*
zYfOLO0g^|{4}2i?ApH*012%%>(eeW?G`z(lrU$fhi`9#R(g~9JydeLA^rO`g7NCR&
z5(l{tSv@qtii64>qyV=BWqXi%P(&cB2gN@~98{t*GfY3~%PlA+4vJ-DMWA!<K#C4b
zU(f+^Bw8TzKx1DV6xhg?f;<b-2a-oJj|aSEj87Pp){zTQ=t_5C36KPmdNoj_G4Kh4
zr`nM#K1)z?14)2VHL?cK6@VadP;4MO2$ZZq;%K=-4O;3*fE<jh9#lbs)Pq6^Za%0f
z0=m~2Bms&pWDTGY0EwgJ8&zm@Nr0jYSv@FZK<Ysrfm^`9pbClskT@v1kkng&@{KG=
z0xjdHLi4@EhUpEu++tD^pmc+5AT*yyoR~fVRPIZlMWG7Jrw^t#h;ob7gU{zd(ysz7
zcqKvU2-!iPbjiRcEQuCnDj+^c9F+c%)q^|=5(mW$lKINeBq0f^(7`uoK%1>r&?u7x
zMGdkB(4`L`gFqE1vIU?L93&2M7_xe3NhDb@{la@Lv3g06Ly+Y`Q4G?D7UI^R0s$nB
z7U0m^VTC0@?nAQQ8d^|+S9~CuuK+V26wt_N*c#+xkOgQlA`eYUk{}w{0+5G6>Oq+T
z$pU$hhd|<>B!#RV6c7x2!criQz}2fTFvx?V5+ngiQ^*=XMF&V+V|sxKk667FD5{X<
zK}7{f9xW5eL6eviD5j9rgM18956UZW2QV<mL8Dv><UnNgAP<AogWSQ0RENqzbF~!6
zr$`!(f-D4SSO9jgloVQ&*nrX?Nd5p+9+X6o^xHsVK<WWh9u%_3^3bT0W`M{`qXn1^
zC{r`=2}>(L<w2zpvVLfQNjpI0LGDGC2jx|e{sgEzT7cL<14Oz3EI<9&eJ%km&;gF1
zHor8))6>-+fCQmFm4^6qdK*{}>OE<Q_ohDs3qt)Q!vQu^N(Pi)k=$ep^^*)F5lmn9
z5M(?k4>0fv%XmOFfs!J!CTL8{WPs(Tn>_+)f);%;9biEz8MF*$2TGS9Lsx+1rym1p
zvV-O#nG+DfZ(u=Cf&;010TvXJK}+d&8PgRWbLkn{f^rfApRg>NpUk1omj#6qlC!O+
z*FWYG=duH(H;^_9NXJ?h6mCe$Y(dt6<U!6r5{Da$7Ok+3xGY*I*+I*8*$k*XXwhv4
zayG~wP#uEJ9#GUEiNoyyxgSZ~4jS;XGr;yl$%2w0vOFkXgX{qX3z9h8KWNzqZV$-)
zNb2n+rWZWn5}U5~or@z$7A<etfjkeg1QaJon&6gz(l(Mf+!B!Ek;Lsmfetd~2iP-G
z;01C>@^+w9#lR;l$1z<Xlv_+o4lR$u%#{NLE|Na`ifK=wZkLin%eQvW<Sb_aHq%fJ
zEkVG|1i1~_Oi+M=+%jGMJD0eW94M<HN!vlwkz5AYSS>lU_=g*d7XS7)rcXe)6|D@k
zhh`YL8DK+=<j^7;ZYaoYNRDxU<~}*dP_2|4s4PN~w}-}`+zF_;Xz>d-7cG7rpovTF
z1vI|U%2Ze$mHPoP7hD-3*$XpQ9^^hGaR*Q(!oVjiF99)E9xX4!GO4@<)LgVUg_{d<
zAF{d7^dk=$Rg;oO%gnG$DIWnf7cElZ=7QXZY%Vkn$yY$#i<WuqK<)tfrvqv(TD-!|
z1-TE|TxcSaUja22EwjS%o%{}{xoGhUHy7kSBy%01=}7(t*jz7gD+Ed20hA~~?nTR=
zaP!dO*%6w46d1tfIVqsUrz6z=;61iT_Q1?jK+CU=4bvyQfM(bz1+>V8B`O7wp-6_A
zg94R-Pgns*23A1Jz>X`Xe}Gw%1a7z?83qek1+<ukTY@7yD}X`{$s9*ejsZEU0~|75
z3Lr-!$-_!C1+<ulhYVT{cLIeh$h-|;^PCjWi)mO);7ADyXeq(TVETiX(2(|0Kr5#0
zL3IttG91Z30WBFgK`mE=Bm*z-6cmzY9Y8U_z$dJTqu5qNO9s$A!@`OhV9(YoqNM~g
zkY_;Vp``>zP#}ZE(NY3zmOv5Y4kUM(fwC1yJz8;K0pf$iLH<JSuD~roD<5DpMv7>u
z1{Rx&XsN~tR8E5|fTWIkMUcah9R~9tTIzt?kCr;%9t4?-Yz`=ZK=yz<iX?6UDyKl=
zkW@5XG?ZJAN$~)94kbzvtrD<+COt(^l14HF9(ri02kvRK)Z@%BUEvKh$<>3-nMNKQ
zfcZcPWEqkru!$Nav?Kyok5)s#ELQ@RbV%kngYqW>pRf`rL>L*StA6JaOj1HmC!pX4
zDMC*t(Da}LqLB=RTLwud@JSM9P_Tl`fwTdml+dEz3}g;S9^@z_^Wfs3=s^;P+XKp%
zNaD^fraQcahbUT_umPnhkR|A80+dEU;%I3Ct{&ugBumU->d{ITxOz}pWoB@O`yQ?V
zEgivqftHS3Kv4^F5Tr3tuY^{**nk`gk_T0aSR4jEX#q(brd}B>DZ$*OjH47%2DyWo
z0WpW?0`<8vq!>z6MlXgy(Zs+ftPDz1NDhF_ZYrZCFIWI5qa`mFPz-_00k<gY!FP^h
zGY;e&Y~tvt3+61e)CIR5B#&f{3n)H7)`JoZG;4S%gR%mWBG^nW_!?qlagbpk%^*J@
ziNh`1F#Q87w-}T10dP^Cqzp+d@WcX}kyb`aEass63o;kvIBe#k6*{h<um-9B0Jf)I
z89lK;6A|bDY?N{b<WB}ZVHNbm0&*uv94)cH!T~%2hQ(drT{z4P+;9)N7EBlT0L!B)
z=qUweJIM7&rooC<@cpjH;xP4~0t8tc=32CZ2o?(}kopRdv|VArQ2+@p@O{Y02Eyb)
z(TgPR3MvFZ!Gcy2!D?g`P#VIf9^`N&ak#@Eg%(n9eVFzU9$M%n5zJ8_M<5vn4=qqA
zAc=!6Pyh|0fbT>`5{Ek$Ep5TYA!!RyqQMP9tI^=TKr6A_Km`Q@pRg*VJyfrXp145C
z03?r=xST<u3KEBuMDR2Os{~a+nF7fpuAtZfsR!AIBn}G@RggW%qmeeCq5`A=Exo~7
zx2k9*6KvUqDq6aNI~0<xFdYiA2kxMH1_oHrf^Q;(OE56N(vvF4CrILOhk`-`NgVD_
zv~&h{C?q|>9R!Xc(1^M!TKVJ#vJey!ke+cp_(o79i(u^wRkSn(_c>a51&<;~+JQR&
z9u;Uw2Of2hqyw6C01wzALJGYA1LYtFK4I{{IkH2cnL-UMjln`t4K0nqLQoAQjny;2
zm)NMGB{G<g)zA_d%*SeIX$cn9YG`Q*R&s(bkwo$U*rBN)pP?l(xJ%I!8O+BhiHv~(
z9M>Ro(CR&RP%Z$8LmS&_XlV!TU{DAnISdv>YG`Q+7Nu%vNeb>kko%C#fvblUXNY12
zE`e5_!99YO_B=pQ4Dtx1_g=4tp4LF>LGoy64emimT0^8wn0mCN2J^T&C`DrNh&sp}
z%%JcFCq@Pan9tSG(i+So;A?G=4DyJWe&7qNlvhVfS1{LtFA71@1Q$n7Z=g_M;1gCy
zPj8?)5+n|yk<9@`4@ex6+_K@p0rxgqdV@uiI(qvHlwLpv;Yf$-Xz9>n#q@x$P+up3
zci$qp3Y-f-hJg%45;q5>4UjlmB7_GmS|S7=wF*)XDc79TLHd!*gWCg&dn9plP+bVp
zhgPmxGfaQ*l}n5Zyi^_}4{4-psiUPOxVdO)$^64~hi_bBN-+0oK++C8(7}hTGVlp&
zfJgkqJ<+;zFz;)i6-sd9&=L=L3opnx2T;34d^-DgE`BSR-!#xt0^ATtN<g>?6lNep
zz}+|T>FHoYKpqAOqQxrQ5Kx7J6rkY4VnFIAKwNVCI~TtsYzeFeT5MWOfB&6J91%#M
zB#LB~7bstW%mO!}#Rbvg&P!o>zz;5Q@Z>E>6(}l^bvsON_`xMMy-tOPWBRrqTmoEP
zpp?wOC#(sb9@0dq3m6!@K(#JNUSs-)pIqY8-G6fN2f;GACa5??GTsszTAFD25*9F;
zX!+6$lwv`KM}Q3%M9*zAreFBUC1zy_@&!m4j@+e*77t!9^&Mbir<?!c;t%oy6}cco
z&~lX(D4Bu8(c%H_W{?|^{OAozwIKC7z=jKgyo@Am#WDTBFD@}FxUm?S2vm~t32TDf
zh@{UO6qF!iUx1CBuKt^gKL{S4XgLXHIOrxW<Q@#n%~~KgA{!2kWG#v52mWx0qpv}>
z37Ed&H<y@|Hz@8I_=L64auVEFkQ<SW1qCHYy$9IX>EeI5_=8}*I4!iC<PC~@kYcn*
zh8qrYBeLP3lnqi}0XAF^El=45OkePaOUw!uty*X`Iow!~8<C9#1trMX6<}khv;XDd
zH-ftvltz#hgAx`<F<K;BGfX%5%O%F;11gF@@;AVSX@aUBB<)_H$`>RJqLIX{6sAx3
zi&PM5f!u^7?*j@t20meJj_C#exWpYnSsqCmmL0S~(S;-qOBLFn6pbWq%`jczAIP=P
ztgLMTHWodT!s<M2P(&eVH?x@D@Q+JO3N8<F9g@6v#q<pzc~~P*8!eZ*?3n%lB<}@^
z36QVQV$$ltbb<d|Vp6b})JBU*(+krb!16HtXc^M#!SsUvpp*cOEN!$%grx*+v`F*;
zsROy^1~@p-S6{$tG3^)Nd6lVb+yYWQ&@`!y7Gc&5Qw_MqxO_pC3Im_8j=(e~ZgKP-
z0G<+4Cvb~N!3OqpKxqdl7%e|cJ-{vI1#9W*pyf4K%R>jPXa#SV1lfrmYbU0D;6~K7
zI%tvR3kqbAwhWL{r-w6g^Gm_400ktH%RD`%H!yOGbAnPgNJ|H3Y*>8yc90%erL2Qi
zdRiz<f56BsW&~@g>7Z3(;4{WRhJhjh$u4V#=>klkpaf+Zko*O(``nqh1;FcXKtdpQ
zAZhXRm|g(VVg?ci$$tR3Pi*=!CT;;KnEQ0mN<<5V=@*!|#e!h&(?!cm;BB1@e8RdI
zc?nW{>!QV;A2jN9Ev7dxbBhb2#ga|H^aN&5a6r?rE=W0&A7HVrixy4R4AUntbBl5L
zfr1I-oC1jPXfb4FG5rHGw^$bRbP!=(P)<iO9+owALDnOQ`$5yQE?VrtvWzZTR`Y{4
zd~|m}oPn03oPSK;z``x&1*^7n(ds_9Ge9wg<P2DILKhV2$l?vt1z3?1u`XJ+^9SV-
z20mduj_C{7xy2*V%1LLCa*#Ay+``IFJ+!!mIZqF*`ZJp`{Q@hum=$a+R}U?6VWFjm
zmIeJmu>i6^0_?o$=4{;jQgBD1Rd-%HrYC^5;lLe%R!W-9m_7j{4|fD810#i%HN*4+
zY}{g8{-AaR$kG*HOTqWbASr{b#?S*LC?s)E9l_2m#uWfc*C6c|z}f{trXeY_DVW~C
z&Mh`wE|i<YNDnQ#;NbvDB}keAK#84!Pgox^1UCH{JGX!ota#N&i!}2I(*-!V;SE@Q
zv^WZAnC`&At;b|DVR``v)FFcUXaR3MeLe@bI9C9u%mLY(0BUxNY3ZW{Ic(NKAFaYN
zpD>LRDb?wt#Y6xo^@5BAx8}vBr*U!%On;}y%^{?ZmW^x-rcdDH7PErQn(2cagcLBa
z0Mkc{j6hJBfNVGccKGyfoZJFjuzExP2Dm;F(g!&M$uP4S(-pXoosAX?fuKNQ;1f20
z#zGqxw}26BXv+X(Ba&gTg2VtV>sT{P-@wH!#uW$(6Odt$6;wh7Xj#HbVY&b}sJsLD
z7^DuA1dz;!6+8xL<(-+ubO&y3u_Rbi#sDqKV8yioT9m;`5CgP=5mv4mfZU5@zcs`3
z1>7Kiz}yE}IW_$nH@Bc9v{W%bEBq`!Oyl7eV>F$v&%-S)6$mXl4L~%i$q78%Vq8I>
zkOTSr0VEEm@qmIGRQ`el(c%VH^BRCkEF{CsET$g-83vO#gsgd*{*8xQKoS;rh9H}e
zHBFc2<rX)Bm2%({XOX2r4rbsJHpDFD0(iN_tYATAh!&-=#A*miM@Z&DPX`h<jF_&#
z&n-TEJ1?TD2A{@-thQkK172=%PM8xaz)5+!7$3JFtj7wzy&PG~jp+`2+<HubC#Dzh
zaf?X?feIav^Fc9(q|SQ!d_Hb*u3%7LfTT}=T_cEA1DS1@#t%xC&?q)U%R{ha555{1
z$#Am`(+&8!#isKmadQY6qDRt+=?VPYVoatNrcdDK76-Q@8Tf>aKrTTtBdB2d0gyD*
z??#}47D?KgVfqJtZZWQ4Q1F7ZgGVjIw2VM}Bz3T^iV<3lay>9TK!96px*ZcY$MiM<
zZUK0w#t1F1SV28+gqBx=Bc^W<;1*-D%9#E@0I9k&0wr1`7r+vN5n5>nJ;q7c2(m0?
zx|<-kfF!KCGeT=BSWM3s<Q6xAC2S*%c!D&ujL_;Ie}?G`1VN2xSSW&01CrbP8Kz$l
z<Q6ju2AKy6MU1$Dm<v8{07;+ahiO8PC^Qh_7PEq7Zez6C2j+ESw8#qq<s}9_VPlKw
z9|XC@r%xB+=7;;u7%c{2`PLXM1}#5KKOn>{#sv!#<AiBR++x$e32_S~!OA^jw77&-
z3dU%032O@*qm_F;ptuA%6x1|9^1p?`^Z;RQv3gkR!x$}Y;ch}J6JfQuF<Nf400kV#
z9<-Vb?hmx&0CjJ&urVlNksJmqjf_DNiX;v<2rYrYV+bv0hkzUca?l4z42g?y^F#8A
zn+Q@~F+r;bVR;3-)fLJ5kQ37jL?C%(fe5G@0SadZK4BA3-a=9btCvi06s9I<X(JRA
zzaVoWrYDGSi(?Fk1xz;(1(jc*;07rJDMz*rCXSXIf;6Tlh=Q^WC{#fD(4ya;VfqA7
zZZR+DExf`epk#t<E+|$&`p}XEth_WqOBSXVrhfq02dm~y(4+grbOkYPF)6rywAeMh
zFg*Yy57&>D&CO;^ZxG`a3xdm|XLFGI8Tf?3+hvjb0ZSdGXuZKuP$~kcmzZuK&Mhtg
zO1((h%%<~;BNbMrpxllm4J+eJ(IVf%V!DGkk}plsBHL`k^a62iv7}It??ASrH-<n3
z1V|ih#LOG!S{#idQ?yiJ!7=@UIJk71Cc!Oc6aeZufQ$vvNZx>@RZ~#lA&Z}wZXf||
zY73d7#kARs=?N0tVp&$ulm*^Pj-nY-;F_YR0BD9W1*I$`_3#)%OA%opM}Zvu031Wp
zze{i<hV4wzn^Q2wXvre9VY-4OQWMz>Eg3+s<PbKKm_9*@TYP%EB)0%3G)tLjOizg6
z785c<i+r;a(>F+Ri%Ern0)~N4*bF15Pk$iEEyfiNb(2{H#B6aXZvN?Y1>77$;I&9d
zLEx$|-9ZZ3m1vnc92)&*9bl6fCrmFW067d~0g^Fh4bvB(7z1)3l6(Zn^B@QB02?!%
zT^gy*0vE4HibFuY0x3p|7PAx64WyBM4@w3|`m7nICrERPaYcZ#21x&p=>js`;^?Pr
zM0iX;05ZlEl<^q&gw4^4VNl};Yz!zUK=K9<V?d@N*=A-jJwS$A%*Ym+am>*&9IPK^
z4w6UKH)DE(47Zq+4JaLfj7Q6G<~OEqkU@$ObF>T=0Sa1>z7DXnG|@8_$eAE%v>382
znC>9UEhYtb7RVS>XBEhTyaNgikbY1dh9nQ0%L0#aA&G-JH?rJfT#=xx2h#Td?5yeR
za-bN7IR@lcBu%y;$AJ{1<rxc(=>~G3sskzyb}X_!gXsx!+~ShZL}`K6>IDs8$${Jg
zD%%+Nge{;QMhj4aLNX>&V)_R;ZgE3sZUe8nMUsvH6(1n&AY+ik%}z{LkmnY&g3F^7
ziLm0t0xiZOVfH}Q0ccsEMH%#_c3}&UuaWKBFnt4PvwI}Sn;`d~N7;$#4?ymL%cDgZ
z+&v)wAekEljVcSsbiS4aT0Vli2UJxc=>t_E3fy8+k)UD}<Q}xxGdnSTfdaRf6-?d|
zl<AT5!`x#DN@7UjQJ@^cz$a{}Fug#DTYNgZBB;0pB^i()S`i3Ne;{#C(n2!CLSedr
zB2u=oM9Yp*pw<LPUj*0^@KM1?+HFB@0!gFADcm}=IJHoien1g1as)nE8OgY)8`D21
za_ccgZJ4g01WM4*Bw&dag;5)(2PlEsSkNG~M2o^GP!xcig%*X@4AUEwxW%}lVa~n*
z_EjWWOu|yCCCC^g=fP@UaFYm0JPPJaw3r1Alq-X*1LX(?K4B{X@Hm5(6)0sQ>4&96
z@Q4bMxY>;91<KrFQZVmWp+zdF5CNMH${8T@A=_oNtUxIP$sAjdK9D@f9Z2Hl2d05`
z>BBk#R%nq3nn6<mIUgFzRt-?+qqR(73Ev9j3?$=0!=WJaqoL)F6(}ts$%BSNLFR+E
zdxM+@Sp%VEg%)eDj9~?G2a<l!Xqqawm=tWepB2a+RQUi^ZZWH9XpLos7M-w+Wd+JJ
zNcv(xd4z#a7&P9h&Mhv0mLH?0uUF+3htI@VqeW)ai|G$kLER0IYeA-<^+REy0Y3a2
z$yS(atU<OTiN`=&Vb&hg71X)K9ns=83S>RV8nn2DrB!RRdeV(y`T{jj)&Z58Abn^#
zGzJujAaPJNj^qq$hUpj7xW%|)VBVSlc8(^<7$jw|u(n2vYtZP7I=7e<TppBVko1|I
zn4SQZ2gM=CdbBhEs-x7o#kgXjIoJ9I*m^;<oEup%{R7CD7*H_=G6pSbK}kk~TTBWj
zZv!gRk(?2IV|suFQgLVlvJOc;78J@1e8M)6CFaw&X>bcj!S*28pv7Fkgy|17ppEiK
z8<2~TOoD4di%(d0$p&N-l6r8R4zd|7KCP$QYjTTo#e%{cBn{cwrUl*wjiepiSOm$V
z<z2G}(-&xRi%Wu{5hM+wk+p4@enAsCJkSc_SWt-v(g(@9)6KNF1r4Do#0Eqon+4*7
z)MB<z6SP2uJt!_g@*o;n-;C)Kw7A8RVB;I$79ff|C=&UEZ9r~876&CU20mf%-fU!X
zkRL(fX!+V~!}JeYNPe{i<t!w9aiHi0>C>2gL7Q6~{m?hF6Vn5<K^Y6`O<T0q6D$U7
z(Gr5oj_D2B+~TmAQ(Lrn2aV=ybBi&>t(bm7n_ExH8D>1FSU_@}MZk0c9cW?`vIS*g
zBuTRw(;alU#Ux?-o@_y>1xem|dcF>~xKbP_w}5;Is!oy41_19j1BoA)eqk}U7?bS<
zNC<%PDv~K)Gp6Z+3O-o)q7}Dr%R#mvX@eDf;LV~);_;xI!N4bM#{sT(gzV7rqF2TA
z3A%`+YX>Ujk+fT6Oh2H@Eye{i-p*jUfG4*YlO1HxcDkA#x1b_4iP(XxLedKx{<Dh!
zPg4uoq1BAu71JB^z`gb98}wiUy3h2u1;OW7fZPlU10(}MEdhOQF|K$}u?CWdjlb%1
z3mQVx75GL^Bt5XrW8jU?Na7X&(+l)L`2}PL$SkyIun3sGKp!a`gLj@I=}&;R2J9f4
zw*~D%*#}A9Z2EtFq>&WxZ4yY*uxPYL%O0R^rUAE@6wKM+J<urnrY9I6Im;g8Z6x^w
zP=&+5Cu|=8iEi*-XC(Q+i0K~;xW&PT!hn>a)mw4X<qf&Tr7WN^YLAvZqBEuk7;=jl
z#ep(CNIO~%v4CbPdr+Vv*=qY^dV?Xi*z|pV+#J)l8FCB27ya3TG6|B(1eggI!0val
zM~jv~P{sz?j8?pX8*3nOv}_T_F}=VDF;xL7O^}z7MK74Xz=&H+3g#gPwA^9wWBLUn
zZZS^SR%wUn>;1UJg&aVUkK}4l8_$?qj4KgTDlza0I|NL3FyR(QKWH*AV)_JQ&{%4~
z^aIAowt^xJ$vBG#(?5XZVfCv6T6Gi0F<rrgTTICUR91tmLkn)WYZpx4;KwZ{<N%6J
zB=bQHcoUFwp@Hpi0peVYu%7<F1mau)Q)K6YtVJ@;Qee7+DYsZ)EGU07@CiGDQU{Ve
zEO0SacY)e;AoXZ@0JeYJ5fa#rn1Ox4lv|7|2^!dr0n-J{u?Dt*8Ml}hEM+*NCv}i3
zLAIj>KDdJj5=Tq>F*l}9FhdFja1KTCrKQI717_S}TyWPz0^i6HBk(~b1)s1ZTFOs?
zMuy`Buy-OcA_J-oN5Xf+Ncd3on31)?9MpCLrE~^9Vel4fByYrVOn(59w}eKH6Gr4r
z7qEb3Wj70M0V7z|;DlBbB}3!K2}C2+gNi-V3oN+BxRRkBc7iNgU~<ZUR1;2U5t4jk
znkBcmBFH-+_oC&6WKej3#3A$AOil~Hrc6(><Q9-h1_dHW5-qGj?O;o8vFY=IxjC4e
zZcJAQ;TDr}LaS+0K-C!opD<_#ZwR;8^e`)K0j?B~<3NH6(=S+Yi=&@qYc4Q-gB7=!
z7p#@#j20#-&@AE%Du|Fm9XtvIG8Pn8NaAK2ra!Ra7LzgusRzk}ia#Xzl#J;D*4$!T
zu<FD)W4Zxo-<_K^w}2F^tpwf$jH;=?np?~Zt_dwj;rh@@ci4g)XSCu5v_RDwsZMf6
zYu=`S+DRbC?*NC{baoqVelOSt8*obu$#JlGIcHGRA&J974iw)=;uZnZ6Kp`~k&T-}
z$QdmYn4OqD!G>E*3Z@x+{3^2MjOhn#kXoBApiF@z59|JcH|rvcZ<zi8WG-yKrVA*u
zAj>yQSFi;&E}%)=1uYp^GfWS#<rd>g1&K583A+SLH?RW@!`pK6OTm`QyP)+^Qaz?`
zutf@H7qkK`71SdD8P)(v&n{@umj=y2E(@j?L~x5uFSFwo;7S9v_duEsKsA93LGno&
zG~v0tfM_za2WbMijDb(sm1Ft?dv5XR>Gs_GQn2HoUC|1Rw1DXo?779kXPtrcpam6Z
z_`;rBj4KV42to1=5Qn&eav!ooplv?a46vP=Xr4C#84J=5%AZKuoOVoaaNrh0xDI3u
zl6;!L^bH_+SO#=OOWSDy(;tB4p&8c|Ep6KbOc!wE7BhmKlI@CC(!h@M25<R8ve%kn
zx`QLg+o0qOa`z4J`A^fAIdThdrGs)gNbm<(P|6KdRUv6k2YHf#PuNWYDi88JvOLHW
zAbAU@JX)!e4ss+&9(p*J8(LtdgYq6oz5#qpvXmQIN&<%kNPYoWe)=|NZUL?gXi9QB
zF#UrgH^z32z=-JrF5F^9u<F<i<Z&c7!x{;0Xr-`4!*mCbz6?;-1lfsJpMi(l82E(U
z(ZUEcs^`Kj#+3n0!0rm*2BncZdRRfTs5@FK17@GQ#q<Ty++srRAaju1n;|gWz!fPs
zx}&An3}~U}4yoOyPjlrKFiHo99G|c|T7bhX14S&7C7{gV3i1Rfut1)i0QQ8CJ1ByY
z)Y$|~S8#*0)B@bN#f+f$(hIwTA{t2@Jg`8XMiK{gkKMS%xH6%E><(GVrR9zm8L%Fm
zJ6bvGm@!?z9aP?d+{M5LK13S1nGK3Wccj4b0NI0Ne<rj*@qk8>2U;Y-?Das4Bv>`;
zVKM!IBDdJ|Ywn<G59SE8RBvW6%>&UB@Brm8BqvzRm~P;~t!D+R{5;U22-eE+K#QVG
zXgqsB=2xUV(DDl0=`+CX5+;uoVA{w7EoywBNy7tF&LO!ARv&s?0P7R-03`(^dGiU=
z8$1zn0Ul^Elf^N8gD1BhlbOZz2cF#G)9snK*_k{Qz-AeFq6H_+4d88WNOr*7;OPO@
zH@(b@TL7{!))N$QNGf5W1m56=B%TFoOf&EadqNIgmjYjIi!2Yy)gbv9;1Wg16Rnud
zmYAO4%`G;4-D56}>C?Qq1-P=IRi`JU^)~$*SP&GcAY*<^Pw?dycLddVNVa5yQUn8^
zuoqfc0lN|byyFZ>y+y|K03W1e>jf&}kmR#LX#r%O0oXe9iwe>zrf={86?q_SAY~xy
zk+j2t)eGcmB=NKv(*=CF#f-8+brnb-C}|+c!xqMQp(W9@3)3BZk=k`$pg>2`=LK^v
z$Xq0G*op=(w4|F>F}(m}9;`v)1xo73`ar=5avxe`!Tp7n#Jy%rzu?O)#tFA?x;_)P
zxDa>`8<Mf99@7o{kV74<5XuI1s6f{KfV33A+tiTs=Rm#b4Jk~7ywM61+a1#n_;HI#
z<$!{LflnB`9}P*rMaJ|Ge%xY;u(S-`&V?kO11(>?!3UR25A)|1FoMnCd80)Y+zzy;
zvdEa;;E&`-Z?ve&f!4s@kOF`DHjpLYAzP4x(c%Ga30gc@WK4g6VhLJ&<bq0Jka^I>
z*KPsa0$fKyIT|E*1Dw~Hydj%{guKxT7Et{f0Lqc++#J*Q1#oL{!Ad$GNa-@2Es$G4
z3AWYA2b5ir0uh!*d>};%lMmz!y6Mvbxdp(h)tGz=AWLSCfsBF0g%4Ud<wE1oXTtOY
z0o>x#zXu{s{QIDV6RfuIK?|qwg6RrDpxO&mD>Cp2gSSf|xz%jO^Z>9tG~t2wMj^?E
zHcW2-%fs}8A`eL(RJ#Uoi*e;a!`tTr#IetVxcQB8L7AU{PuLf&tb&E6FDR2C8D^0&
zT_6}K<@lmCx1kp_3j1nIHwfky*F-Dg;ntzWhndCnf?#g3dRRNy7p<&<Eu{i){6caL
zxcdfjKFAwL;;^2RFDN-7iNpGw;Hm~$9FnP~Uk&CKgbz0RR!qN;#Vy9<+X3+lTKNQ?
zKnB?j(u-u4>4oVApbk4|fv}e^TB6Sb@j;r<>RDI{^94mBl41Fv@CT{C0d@oWR9Q~P
z^a-HB19-ThWs^LG=?6gauq}mtXwjUzVEPA;Jj_{spfrMHJ!tkclv|7|9~8a}e8PT^
zDKjBIw0O<WnBEY|EhYt9q34IzT(wY`z9AGc*8TuYZ<sC+hLnu_&<d!0P#yu<2c50<
z17$QMcey}=(GM+7awDb}gn{xBD1CwSqvb)+usTQ{mTvq&c?!u~^9j>0ptuVynn2D3
zoo?d?86Tc*7S1gol?N&nK$fAkjm#{jCxmm0OMvVENu$M$|MdQFZt)~ob?T26HTh64
z`h!vck`rMqM1QoX$_M2{20meb5RIh1Kw$cZaHOF2N2`wtKs^VLK8tCQ+~VkaRbhp@
zKU#*g2$&ua!7b($4h|7MVSi8pL9!K=0sYZ3U@j;^K(?XPRCzn5H$))25>$&KnO6V{
zjSi42r*Dto=C3aR<rR=wXc-VzcKL(sLNWtZ==*~r1X&!!2bqHw*|0q653&bIeIY1D
z82Ffl{cnIB;~vS)F9jQ&@<(effKp^6Xh;s4BK<*4O(er$ITsuYNaC;*8UV5kN!)zG
z^aYVf0TqB2-G!itVBixDfaKKa*CLTpXaL9&NQM<kOpD?clPUy721pNDB!lJ^qPWGl
z3Zc0%0MeNh3IM4`GNvG5`UH?U8DLNF2?wA>UdD&%2ci(2gaEY6T=-!6hbV5yX~$jx
zXpvS3$~7Rjf!u&(CoFQnd(V)>i$LK4QV%}1L99LiJ@TLlDFAJx3GQ~Z+7s571#d<}
zvIlNIT6`CQN<NVNpm=6vnBE)B%?UooxjqmrgTt~&AX*F;fU*n&pKu^r28Wg5fgm3u
zxdc|`27=o8NaC=~p@EPLk2viJmJb5aQUh#{Lm<ctNCv^S27ouVA&F;#ECe|e6zxdj
zuydgTK^}pNhcGa}@<<?B`hkUgAgC~bYd{<>6o{6dia>mj#gI<#^s*SFEnk6Xr9mMy
z!UNF~mTSZG1u;lfRv@SpK(gHO!1N0sd3b1{B_y+eX|YJ#$OF;R4LoqrDg}7pfYLRR
zb!H9I6JinLltE~T1vF(4%Pq!L3`#5ve8NEz(;ect#Wg`ufMg1+xDJBEIs9}Li-74L
zK-ytxF34i~hg5E{>1uJ@0!FYb7KE1l;fA5bFQ{J{hg1ZCH>M#uq8JndAU763+z5&-
zBx$&@plTCI+#+E5hB(j?5tw$gx;+P!(?G_8<dO8josSm5aC^{74p0*|9@+Vz1cGE9
z^m=dMpc7!{PcM(><~IT_lm=Oj7R|7_CI~H>Ek8_O5D#haT!;rXNI;%t;1do;i&v`$
z(-OGF;9JOo(egZOxH1?mp3McOCnO-v1_q<G$IK^8p8zr!)@}|)%hKSb@F3@)MS0<e
z=?6gO!ba+XQL->7M^68cz%9mA0@4T4Uom|_BDeT-^+ay|AXrrvj9$Kjk~&B+T7<%i
z&|tI(EddpsAoVLChPNkzdR3rA2ogk#tt?P!2oguDyv;18ZveRrJmM4#=}j61gOU(Z
zRD-(#Ak82bB8kKDd<X-$7b+Bj7A@uzraOSPjDec?)60^$1>mPifH$ZinFLE8A!ubS
ztS|?!_eW9>n#@W9O$mX*gn>^u1mtZbd2r_sBo3<Pk;F|eOuqoq2V2-5f>xBm246zZ
zGNb8+Y004FKG5VDf)+)vqeMbL&Ox#c7Ih(Ld9D;x?tq*JT}qag3>pyy`5h#PR)T^~
zXGw<Skpsz~fhtfQ0;xlbC0M-_f)+~_4bwj)BaNhlqU9}%fawY;++vcYQ2RsCV$pQE
ze+p;~D9CRNe8Qn1w<Gz{Y{T@16j0WM$%BkRmEQoC2UQ#({h&O7B%jkU{Q*cGmMucj
zqAb8-x<D#YREMI~im>tvyj2a!T#JC|4yoK?Qn0O;p`f@!l6P&GUH~fFK}QE@g`!0$
ztoINK@)VLLP`XRy7ORKt`VB=ZG~xO{o<-8<2y!&Y^Jv);t{yF0!V08Nw6p-N7QKbR
zJH(JIfVCMyL5TxN9F_vXd%BRs%RnU|1D|jhWcR&O7^uQTl80r;Fto$~UbYR=2P#jH
z)SF(Iejp8$3P7O@k_VZOByZL*{X-hJSQ0FQg`t(Su+hdawA29`4GKfc;Bfb$r53Xd
z(*x2$Q|&N!K$a^wg`s6=*yXEXAa%&@1f^b(`_T$#(+krdq;reI)_aDbWoTIZf_GgZ
z8+T&5KnAy15-dK$(BmIw9a{XugBd;kLCtZH^U&+phUo<v+~S5H-+-jiiw2lDTG8ND
zF?~S>X!Q*!)iCf0hocn@u+R@jPaUA-4N{MmI&1=_U&uhJr^C_eV_0$zM=wK8Ov~gJ
zlPUv6KFC;5s33)+tHN{xkUT6@!a?eg<V`P3PsrpJmxTHfyloCi8niY)6Iy_RjDamX
z4hN}6Qs*^e`Uj9aEG>qk7YYs26|%U+vS4{F94!&R#nB1{Seg$9g&LB5u)G<LmMF?W
zX%!R<C#DBvf=)2V;^v2s_=ZD{+i(g8MH!M|u&M2Ew5W%T6o;clJ!q9?Hn$j8B`7Qz
z_=F>%D^DZPqV#CO^nz^ArZ8v;7J(L}b`jGTfaEJd84+X-TE+*hr3c#s%1|JA$i9u~
zY&qNlMli=kfHWg{2E5G)q!_JTWqV_~K@PW=72Gnk>KhiK5ugx6GOrSpjX>r>dO}VS
zXfX?S2U>9tTPYcV7SpyrrXR@R7L$Uz10!aqf5_n$<EjGX8<4$_v3sEiQ1(S~*U^OO
z0lC~_MzAG<5onPLTOt^N7O9mH(;IS;+U60UrXZ5JRnSO{<d|-d$1RR}DL4be(S+#_
zK-R)mk42)#DJcIj@CiqvWz))t=>mC3)<%NVAzKTL<46yPwP<BFC@JM}i^2C0M54uR
zz=Y`w^0>v4V9Wo(du@=6hc!1N(ef>9XfP6FJ(BuLP$3EO23l;JZkTS6kL(S!{8|M~
zEs;CG-k3f;AL*PV@CF?uODtwgKadYv3JlF3=qm!vW=#K(&n@N!UZDqa3|dsemdZw=
z<xg0b2D}pw$v)7Y(gH+T7loEx<2a@_6o9fTC?zxS2}hwttz*XY4Ip{gK?zZ4+0{v6
z`hx<{LM=aT4xuPeGD5byVY)yeQou!_W!q{{dH`7pIk{aZ3N0Ig5<ns7L<vyB0IBN$
zF9>joLW>|+SVe(6fn+}{yMZ_AA&FOeOuvBQF0|}e4GMFReUQPf>1IVpYn!9c@}w~+
z6@e5(*HTRbDF&Y>0TM*ZXf>cD%)loc%`sh|7&Nn0#LaJ11M)UV5Uq^_UW*D6M~f5C
z>_IWN7*`F{=4i;`s_AXT+yY84o1;OA63Ndsph^Q|*aPsAFQaIXACcvui9Z@GUDbl(
zjDb%$22$Q@#h@i1m?LA*91j{<DdiU9ss&{}kbVR3A{Q_41~MdjVJ)E;v<4om!3JI}
zjierS-AhaWI4w+9E8`ZBbb@B47*OycDUO})U&f6%i#7(W_^$=UJIHO2=@6k9P=F$7
zubnY{Lm9W2R4u5r1yYBWzCZ^GmvM`6)q$EpAbCjlOehAV9?2ZXjOh;L++tRlAp1e;
z(2@|W8j1nM0g}EtP-X+Ee*u{jk3maKbx?1|3V_#FOgF3G7GSFDnC?-*ttV9lGK_&w
zI2J8nk0wl?P{A!W{ar6NhfpjiXCc{W5itEg1*oC|`4prXEkNrkrhlm57MFxs4Dt|?
zcF>BYN^UVDSV<ZSihLyb8fZYpq6Ku-jp+fENc&M@XG}ME&n?CjyJC7k1-G~$D4vjv
zsjHa2p%PSRfm{!AC0cmb&Y1q7l3Q$g-g|Birq~P99VT*%3B`iK1Jw|LDp1QGX2^@_
z4|=)9rn^;f3rN8xG{JkgkTh8{OfRV77PG1c)pQJe!f~KfkF*L}9=vIePdE-O%hrQR
zERcEwNKCO+a|>|RgS-V21TQ(zibD%)SPqB-1vZi!K<6}7gSt*I?P!7Q{A2ooYHo2w
zP}=}xI>>4y?X}RTjhit&;XSvQP#juYrGCZq4<O@BFMuM8PdE-#a3JY-*)d(AhFctb
zZWzdTv~mX47>)yJN780C-M<F32L&41aUj<rNt<q%-cZ9WCglPumO#d$C3UYE(>K&0
zRVDGDmJ*WwdXRMte8TYx(+|{gi%%D?<>r^F1tm|AASfRpDK@j1?obP=SD+yn?=bxW
zD2c?Q)n7g{rWe#gIsyx7xy8I-Qv&g5F#<jPM>rm2ACf(=A&PiV0goi^IAQvQTBP(F
zkCq+k4@|2A4WWaCLCy!o7?O6-OgKm$HYgPj@&=N;tHSgIkUXsS1m0MMByZL*eL@}5
zz)(CW?2zR_Q3|pbEyp;%n0}xR6dW6-f2iXYmw+iliz=7t^7Y)}Qm|H50$NOgR!P@$
zi*Yr8e8s>goB*9s+g8slAk_f!3P=#tGC+2c#q<aDAgeD-7ia*L$S}>I+6h&i16UqZ
zB7n?6kEt2c3qbO)S_HhY3Q0exgWG_V%o0FRfF$1t$}AvrA^Q@95<q+;dFLO~8o9-c
z8bNsmqzvR8BxzWlN&q<zN!+Yqx<Mnim=r8V6VPG=6r&({SkEv4GxtmY%fo^NElNNu
zP8+$!xSBx46$77eB6NvyBB&Tcaz_)WtN_VF_W`ywaSIqVfttG@K~UC3QVeT$C!)oH
z_l@ZrnvlXU5iJgypn;PJsdbqWJHQ36P$I~3Wb*^2J2Zn@${=x&{b*qgTHFGXhs9+g
zT3|P=n7#lk4=Rg6`q2Y@#`Ftdd1#;|q6NA&!?YGqn1R9)q#be_)AY0!(AX<fPZFq%
zL~^rD!1M_%++tF&)_4*qz>(z50;V4T846n$odmi3Qz!|ogaVDhg3N)9(I%l);${}p
z6<WE)q+m;rlhESEieq{}D<r=(v~r6j!A?d`LMx%5<AcIUXmto|xGM=Q{lgM)63G8Z
z{)*$6F3<*=IDy7(5-80e$%D=WYU393f+g@IkUAuJSi(+1iz8TV0^UZ2q~0oH`T~%B
zupyKrv<zX^F#Q5Z9yZXPgx0FHW|-E_EymQGF<qjaTMvF-K{8r&r5Q|5Xb0^x03{6u
zKH+4v{9+L>eL_1o<T%-=WVA91w*E93E$(2o0(d7ClAqFGmY~HYXp#}+2-tjaGFm&q
z`NwpH4p4glS{^5(#c^}P^Z<}NEbfxg;?z}PdILxv*4{`)i(8w5=^Hwro~%zsi&$6!
zN=A!NxM64!3il+)u}Gee2W2Es2!jFvNgUQR2JiV|W|;2V$<4{t0`dV!@r&sS?cCym
zXpx&{FnvKMXr(Qv;9=ksP63&XWF{;EQqXE9GmGgLI+0>K1uZpL1WfDV7W0BFeoR42
z46yJ`K}!d)Je-1-4$>}6Pv}BwfTje1mqrSupp~Z<4bvxp?1klZ@U|x;@4)hQ3R=9w
z-Gi35Z3?D;=tA};sC-2-FP>q#LN}=F*f2ey8#Ivu(hmwowDJ{}_fpWJ9<&d&n_G;l
z6&C!EGl8Z*>*f}aY6UfgK!$<Zc}SL~XG|C9;TE%M0VO_=JgC$~l82>(RJ6Ek17#Kl
zKH*deNEay;EmGP*o&(8SOrOw$d9JyM$Mg$5++vb#pkxhF1~LxGT8rubd$`5HOIN3x
z^>Pbv!Oovfg{)(BN(K1`Ndw#<P@o}+!_r(TDCr`J+Z0Tn0P1ysW|gE;L7qpFgk_>s
z=<dg3z1#v`u%bB?E!bhvor;#TV9^BLNQPuMsIS(?EhYtbF<KD{T8_|%RE?*i<+3)A
z{S17<X^<JA>1}=70`+Ym%Rz!@qXe*tfi$!%1&eO*hBYL|!F-;E7M-w`Hh5bal6vR>
zaJ_IETIPcdmw|V@A!&fMjnmMY{BVoW5(4ZToiwz}39IPSK#85Xo&mlz1U9abhL$T~
zH9vR@8Iprwt(Y{lgaa!*z&q)X)q~OsD5OCN93~DrFA}!KAPv2_1Tq+;0hH8X8W_N9
z4<7V!i*dEX<RODzLTR9=L{it5F<qb^RL#KDq4f?xyMg+V(n}gz4(|XJe<1sROy4kp
zTbvQH20$<!Ev2+fKi|(SE(KeOnht8bA-TeuVcG<4F|H0!wqxKEPPYIXhQ7QKR?DQL
z#V%-DDd-Lh*z_8BOCFNxX&0tX02vSK{-<Yvw~1+`qeUVt*@Cz1A?bJ7G5x><q)i6t
zXt})unrG6d%ZG4_OQoYlMJFhCfPA$B?5jkyy0a6M89>r#F%u7J5P-yS)Scjse@L$E
z1mzKs`WIkp7@_w~Y@5g}AO*7{1FdcZ?K+r<6uTK9ry`pPO8*Re!Wq!soZBR1!$1}y
zDF&U=F$q+|T$sLK61Nx^td*AmIZ{L`17sMI`czOff(%EC25W|ClexvXIzhn*l7?=p
zNSn+pAXN#?AK)E(NM?b?B|)0HKpq5Xf{fWYWuOIi8^{eHd9=W;1E~XvqXo8^!t@W5
zxgo19lQPiC(k@Uc25Cae6P?gx3|<Y1;z&?6$0wYDRtt840+NAGI1_qUS|(a7z{dQ*
ztK^W(JDM=PVG6f6C)634kg-^yOptL%%DNP$Z<xX@CIxd=CMevI<U!+|Q@F*rx<JVq
z<P6BdRjo`=SRtwFgeG(Fcqfv$nZk63soY{xu*y6WRFojecPUIS0Lj;b+yycpxol%#
zVCeLizF;a+A_VW!L)H%pc91^E2{J;NAa@|ickY-r4SFI?R3=*d!LoEFTCrvZ3p0?}
zNM<>Mf*xcST9kGvOi!4`Ee<<`KNBqmD{oAnFpXQx3sx^>fs!GTv9S6Cy#5MF99C^)
zft-UR4(cdQLmF|-LhDGvYJ)6L>5HTfG~zlPDJZkh>bq``IShQlS&%3e%0iD~jp-Yv
zgJvQ@`atSHDH+LpSZgE;lvI$!yB($r%mCFQAb)`LfwC!*d}hIPhZ)>rO0XQ01<Kn<
z^01;JYXf8nSr#ZeBFVSRn7&{Jw^%)_9?wFHW>`Zc3oV*q4VNsmXoj1E7R_*T&{{>%
zm7vpEXL1Wp_j}C6p_L8F%1ADRwLG%XVjgrx&`hKl$p$4bBz@f=moe}OXG2TaX*0P6
zq`E=Yg9Jf221zk!40tBA&lUyVAc-Ui8=1=n#T}A3)a}CAXl)#5<4QOiRL>x*Z<wwy
z3)#hJ#d8lR?m&)f08jl0fp<P4>F?B--Y^Tavk~MDkUF%q082yJAajuP!99)MAyJtA
zU>3KS6>QyeHd@+%rKxPRA{~~dvM)?mn8_`k2nuK<>tH2AHd+#ZTLX#%B=xY;EgLQC
z_kt1v1D|jXWF~ET*=*>hxarGga|;B)tjPh@@<_(PtjPi8NF;HXH92Te-wVodAZs9J
zMG5Ah#irSG{W;v?@S~`5&@wh?cg-B6v1#zWOC)Q%6sAv@gE*2c2V@(PG-#x84!0Or
zFDQ&bu2=x+m*t?vRUb6}=RjJUS~(!~Nan!WAvtLI7qmfUF6gLZP+9|-j}}>=G&Pr7
z%m_A~kb@REur!qmiVP(CtR75%05TW0vID$}5=p+#V7kCOP<aOmE(Si~T#);b<V`?T
z4M-d<_MCQ1cbLa5rUW+^J+?sZ2kC>3xR%XBnrhAkWeg-s`ap#^NHMff&ILIJN#4d_
z`h|I*`Wxg3kUF$NIi6wKd~Pu>SlEKMSt4nN^-*)ts$F=Pq4g-N9!yV|&n+g^3-be7
z99un@K4Ct$m{A`n<$|1pmLK8vp~bz^j_C(L=EB1at*kcLG5y1QP(A*Ei$f?EEmwjj
z#}{ymarHqRl?TmjZ40;sq+llIp_Q#>0n;}uKpJY!0|g*b$e2%<{$K%UC<IhOG4KiJ
zp~WJszmNxtAS8XDMN<p8#W?#x4IPj^@Jydj9$G=#7cjkGA;@@8q5>%cC2k~RV1sOV
zXz|&lFnz&7ZZU+n&@v-vdEG*8F)LWXmj`k_lDV)VBo8fO`#}K?atEXxHQj6xw}4b1
zC^3Qr(PGg|VS2(MZZRoXD#=63v7iD2Bo7aJP{bfP!X{w)fknuUM9Z;oN1_#{6QHRo
z9~!}Gi$OgOXf_1z+C#FWf5!BH#oS_2eIUab_=NM(A{aDgwU}FsYXT?)LGsY-xDCZn
zPzWFyYNjy#!D7Uj-}z{<3Jdjov|M^LVY<K)P!R?)4rCW*tU4?KEglEO7DyiCCM0Y7
zVd7}n6c$kVAbBM96F?CLGG_(28lJvv2~uo=w?iT+1|^v#NOgKXTHc%p3OJBqkh4Ul
zvn}NoFoL!B^Fg7DWEiaNoR1cDpy{rq++tF&5Gp`x3ORR7PXNiol2idGUm%$qFk$)x
zkUXrxQUFQ{Nb(bAOh2#`)W6&?{R2oHEY`t$GLh7Q%8F&&Vq6nJRU`wSa6!g&g{9o$
z)5Di>^K-#GRZsz5Xd+Yq%EL&SLF?F;af?fW+y>H%78{@<Wf`&`(efB5@hk(~6bAA;
zNIzQP2@e}kibk?_0;q@qsRzX>k~l1^!Mit+#T%wOEJt<+C~qUnpO{{-94W#J(8|+^
zAU?>xAJZ4C<QAWPeK|M36fA7OTQ-pm+c0efXlcm-ZVs(N^fDHdk{I}e3qb*fq{o_J
zy1@!=F|J9VYygsXfLJtr1vfu@!Dk^TuOMlHtvUj4%R~}4pD_Kv3MAixw_qa4gDzqK
zTLubMkYx=J%hXqL^TSKHLbRv^t-4%^6hwt+Q8^jZmH-*H0c@Bc$ZRA#J9kXqu##Kc
z5ae%=Do{8eNy7^FLd<gW!Afp1sYxJlkUq3>v+u)nfmO(^Ld$%UL79SqPq>I-dchiQ
zaY0ZzL$bDW$Mk|#NF6co22Uh;(+krVfaGE6un3g#k>n>`n0^5y56fFcXjP&$!?e}h
zVqB9!xd!Bl0I)0SK{*Y{6j(wkLMuCAsk{iS?1bg`BD5M3R`!9nFd~^h85(#+pfZ$^
zfnj>t8g4;BwD|4ZG5x@5ZZV_D(5zL27QYif1uDo7X#EgSVgmVb3Mgnn@&~|eU7;e7
zrAUsL;xIj94Y!`u6i^}tsY5FcK|A!;Ag%WRZ$?DY586wxhFctV7H%;pAt6b_no-4Q
zF=RGly1-g)v3gj=TZ|S%u#x3rkhhV{gUvG*qmBN+!oC>f4J7rj#!oR?+(Hv}v~V$6
zB*Gnp7Kw0+K_vl_1+XMo3`$E#;!^^qUswyeo)Tm}1D|j)TD-y%1$g5mvOZ8^1F45p
zh(g6^MQ>lg^n`WXVqUQLDn=`6;Q@}8li~hCi+?kP=@Zt076pJJ0Aw#(PVQ2eegGs7
z>z9LfN+P>AVEPA;JS?C~K;;dRJg6F5&n?C^6_fxN_=HO&rW<U)+{6lNz?FcMA!(ly
zFuh?tQjf0$<V+-aGll6JK=QDmDexvmB>66d=?_5iFz=V3r2|lVX9KsG5iB@MK+%Py
zAMP!*<X{sp-C+Y#!>|M``eD&q0?OM+=1qlW*OD3FV3@vq15%Auf|iHP6sBL;0E!!s
zqd;MYR(N+QOxp-L59c^HhgJz%e8Y;q614aR)o2^J#ki({YCw>gFTf7bL@S_SWgmE7
zCX)L>$pvI5=vZZ;Qc&4~Bne6@Ajx$g2bF>>K$3(xs1&V)02NeV2SGhq3c18as}wEg
z!(3E~p7Rx^2W$cb5-9K(_=HQ*Vz^6TdILxv7Q>|=dyw1(D&RJ8i@|I2QnU;X*M}Cv
zph*Xixv&DD6eELA7uXC6Xi%hq+y%|hrDz!%RM&yj!P-cr2c|E0&m}f}*=BA5cq6nF
zEfztg%VtoIA5`3d3`fhgu;g9}Y9Jwbc1pmsEuh>43ImWfw8FkiVY<N<q-whiErO?m
zawh|yaGApN2U{?YqBT1){lFG(F(dE<C`cK4W(9d2B#sufX#vwefSm>PO&N$ra<$op
z=?Ysx=7ORIq#sm9qR4{^9X{bQkhhS;vood#Yz282WFAN#NI#N1sFe(oht0^9p=DN3
z(%6dVLzRK@E{b-jwP;l`XeMGSw;0!Skb01{2Oyz^mP5@>On2CZ*o9Yy*7k)v3N30a
zGNu=71GSAn#(_*n%emPZ(-&+54P1f(gMm-D9OOu3S3~ucqs1+3&s90voM&3a^b5%L
zm80d~w18>bL17HD4%D(kv2MBnNFHuHdfXdKPuLDRD+QW1%0Y33q#st0mZN3s8KATU
z@*Y~jJmbam58JuLtY(6|4Uz|CKP2;Jf}9T$M+?@OpkjrAPq=~sya-yV0xcM3g6sjw
zYk;>XNL7IBM>ZFf2te`y(+zfVi)*4e7j~ds1zOT|+A-Z=7q^(yOpr4{+CkPJ84J4O
zZ5Ou~*Gy=vRZIXIKmGVF(6POsumWiU*^Q*hX~*;ryFg(8GZYlINb;~StpLd*iO&Kh
z36OagAeMyh=H@qoy9_PBVEx|;wDf1TVfu#Mp!5l{lz~sU5)=_gmXt(Hf3O=go&@z#
zC0ankrXVWO>JQLx)gEp!u36BCs&ttCU@y10Ac%`(yqU%H1$#i_Z=kDsukGO$kb<pA
zsRX4^B$cKYrtJl}6Ph3@(aQIk3DXTg^5A(wkU!AM_l$t)2_X3lP=W`^qeTK}A@g2t
zF-h0}ekCY8kgPYGzJD)t^^OpDOCOS)702`sd%@RX%kKm2RtGr^WCdDjZuMY#z&=ns
zgPaDEM=Q=@@mz%#1+zd-Vc-+4k^m372vvcC0Ll7{57Qs)0|gBzjf2#Iyoe-kr7&G!
zKiGNp`?<xXW`WW)NEs+OA}KRdm|n1-TTE&O$XOtHkUAuJ(+$%XfaGD*SXF4nGibzk
zKhh{f6<YBOOMz9Oau&&4SWQ}m79%r3DGKBcP)h+xeP+RQg9D%=Y(ee^$)jZpQ&@0;
zQY?}_GmGgH4sh!+S#eB1Z~z<}?+<W`8>K*FqZ%#LVJ-7&P%c9<CbM9=!a;5^FW6j4
zHOQGr@~|~h)o8H<b5=E4?993_z2P9Ym=r8wR-=`;ptAuFa*J`zhPg9g`iDcHT?vPf
zb_Q0Xl|zj?raK%0japrpUT}z8%%};}AYtGWt_B%`<XBjoRHKExtHSgPhq%SKU~6ov
zH-Jx#7pg`JYpVy-4kHbbRHFsC%Z}*=AbD7(sz$3coqtSEILs|(RSt3%$a!cv2JSpi
zl0<SgEbMC_3xB2`JIpO01zXusgB~FY(?1-B7BNCKpe7NLNnHxl6^?L=8Nr%`HK06%
zBoA9VRD&5S0Y|vSxaNR-#K0$9lQ4b4QEu@_v_cEE%cBM(en6>>PZ+#i56L>1hr!$N
zki^XzrVAWJTGU^ImWM!VqK|_72%5&ILCY{!52hC!McQ%#-oA%qI4tyQ(E6ru$AA(K
zlKPB*=@*W2%TH%N#?6lib<BFj;25`95G(*|K^{gj1Xgd<qGc~wAy|u6&&-7ebS-qs
z`q(jU0r<guwP>*hYmC*R#Tu-8Sc_H*!4~M$f{GMmM_No*I1Vl<{Eu^s*TW{ez<Ys^
zl);LMTC@@o7J#*ACE*-USTXPk*MgEgk~y#<q82ST&V{NMu0@Mk(+$%f90%=m0%c2(
zfoL%Zs)SE)i*Xr&${dh9bos2?32p%?BTyiK1ko~`HN*4*kf!;dHW34#a2<3~<Qhm5
zY~ZF2Et8pEn069$jRMF=AUz-pk$h&6G2P%KD1Cye`LvTrxwQ^G$Q!0lIEmD!sY9!U
z=0hvjI_N&%I<zqFc9{O*B)6C(tX8Q*3;X%g<xg>o!+UCVXc-B#qv#a3n9_V`kk_G=
zXbV6d19|WTq%N)lsYCK;+llE8rx8=y_2{WyVS2%7ZZW9^(6FyZOXZ;E&}q;*Zm2Ko
z6~Ge))32QdZ4?1D=@|Hg>p^ZnveRtFv@_gd;1wc5^=K*H?7?({Gu&cIuu8igEx2Jz
zMe8FV7Nwnm9^5Tdk5-g{PO><I)XJzw3wW~!(+`|Mc6tYR3HtPJXSfBFU~6sb(SjSc
z9Hf51bce@WVp{cR2^>~RfVVdyc^MQ<XSv0=7C_Tz{Rv2PfVb`;scXxazTqslm{b#}
z*arn2C<u|{trVs|0LjC0YCT#-v!G(Sz&UO)DcGKp2DH)&bm1FFem=-w41B^3XxRdk
zm(FpEaV><#cZ0#SbKK(S$AE(-%Fcl{zJqQkX#goja$={)wDa6zR%sxYfouTz7)cs-
z>RAI?K7k#%)&Mz#W_sFrZUHISEdmXo<b`BN#)s(>&VzP2fXWY$C7^7KBo7Oo2DE}H
z<HPh1=Rs)#)Ybv%12w&n^v&BbUEu<^m}Ck_93&4iA4%S9y8i`kaj)5+SO-a?RWxvG
z(P9l&PBx%rK2THX0w}bh)-^)*GD|jsoQGuXB2byYz$e@|eg0!E@#)Jhatm-Rg6T<s
zbSN9qYV1YO`lk_cjE7JoS`aN-Fg@WCXy6?hPvG5sNOqcSm_7j{4_oZj2(k}JJ}_eX
zflH7J8a{y4feIdw8_~kV?7?(}%b*~KrnpA5umK%H1eOPhgY=_?5$HAmWceoa5^Bcu
z4VSsaxL_@pCIRrW<>}8Za|_frgVGHHpKudefWjiG39V#;H6NSM>StJK)P!DIfdU0&
zK3X1tR#nqQuW$=;!ODatNRh?VlmNcNtiA~?#^CDE3o2;HHi0~Y6a$N3;-J)lBo1ql
zfHyQEi7y6)9LTYt)XT^)UG+PcU{Vvv2S|!wEer5QMI`aXpn?LV87)V^Edx0QN&ON~
zh=bHa=E{wl&?;@%QsO4G=!R8;O+ThTc*G^<)C_VolDV*UZ!>zq2DPslt%9lvn1103
z((0CGkUA9erd{P0lY*_fZAMEFpyBMR++tiyK&2Q1pK!Cs^aEG8#Rbu7rM8Ue2_R#Z
zfT9$n46SejExZOB0}3UOd;{1RO|+PUrGRF%yy`e%`iHCBVn*P$14uhsu?B0;HG^Un
z$#ZoA(-p2Edmhy6LXrn<bGe4pc4-DV4@rIrv}|a;0e0^6?bo>ZvtTjQj25FyK_L%v
z99oRRV+>>%lHstF(}EVmOQAvCA~F5KHBi6tIyb)+ELpaI>O~|&V9BTjE#6>`Y=PVt
zB-DbIaY3uCuOoE?ThJo3-eUTK>qv((v?NRq_`og3)KUO(6#ETiN1<g*xTDac7nJrG
z_=H;~fXDc>z^fjSJOc}<7PROEEvvqPlt^39@+>HI-QX7ES_%qzkogzDj?@Iz07%Be
z!w^)`B8k@>nEv4gVu5_i2k=bpbhVq@0`P8TD_SJMrt4bKvSF9P^nja4PHhDh8%TD6
z)*9X97UNn5Dli%Ngj*rAF+#0q@za(u{lQIcF(p_~wxY!kEPh)frf>MnEjC^37Se16
zc=H{SrIiuW9d3aRt^k$lAWP8-SXfGIMT^H}pl}AMhwQBoY6VqcNanU>OkZ#d*^y}3
z5AMhf;3|6hH55mp6{Kbg({6K%Nu`1!2V^H&H42(KxsB`xkUAu{!2N)hE0;raWh>-T
z*Xh%4a|^(8QyW_B!9u$YqzTDzm`B<qrXTpqEvD55O2|m^u!P%&mOB?lO#g5jX|SRV
z6ah&3V5M#wTI_=+b?<PCaV`f%6a$}d8+hs9^sqbJ0`Q|1z^NI@EKth2!!5?O9F*!o
zdLZqd>CZr#U}IcuXfX)tZ{Fn=;{rt-=nVcg=%PQjyW9dvU>iUtp~VzDl+a2`cqoCQ
z4(VJJ?mM8&!zbJZav73~K`R*VB93QnLyNh}8PhM^g)U<kYC|hL>n*0;L!5rzjuwwA
z45l0016`4%Fg@WOx7hT)d)%CwXkibFvv#zw2Q68=hg2uDqvgC6pde)66K>Cd^kCXS
zRUVSB7Dh~0xQ{e*4c=OZBo9ld?P!JL3Q&RunY#dN?)0|%+yYXtC};=eL?lC;e@x$S
zpIb}{cGg5YS`>l0N%y(Ml3?w;cC?^h08Lo!AWM<Vg>{?S(c%I&iqH-!VUg6&pE2Fx
z0jRqMigE@%VUVAYZwa$fm|pMzGOW4a0b&_c2U`AtrJN45{L`f{{lWvJ{L_IJhj4uu
zaX9TEvNp6Rgbi_ZfNEMK-+&rB54pvr$Nl8yVCpD<#6#LcZULzdkO?6Fp_Py;HcX%J
z5Gk>Apfy}pg2D@=4-%<D9iWVcWFx46cnF%E0|f|39a;kg?m@Kpg(cn&v@8f39esrC
z9<+F01+xb_8qxuBACh~_ET%U+;uiCQP0DnFaxRiQEWLH2WjI(m18-tPQt#R@{lO#9
zWE3de82E(219C|6u=Li6-h7!cUEnd&FnA|g1jFqE#S4;oekZ0EJmwb5f{kByqP0U|
zM?!R>jg`RFqh)4TW(9AGL$YTTNI%Fw9n&6ji-Qk%LXuqwN>?CRP*H&-4)#4r9Ibr=
zYrcZ_G9sym`w~a0=!B+<>3mPPIiz4Sz@3<B!r%!~Q?C;(O@LPNgXCe$Dm&5gzD36L
z2~UvHR3}<dyc(1i82E&{Ao~)9y3m?DjuWOUJO#~QgW?LL4lR>|hK8PUi*c<67an}V
zU6AG1LS3LH5>jZ`Oqjj_q|OPH7C`1e@0WV^lv@yXm2ej*UXb*x289qvZ3Q?pJ9UB5
zA(FfeD8GW_L3SgF!|edcBZ-?&m|pM<DJ;6sVsbSoY(VDi0NXeH+B0qec;BiEEn=)0
zrak8t<5~ks`yf5gJlTboC+jMvCp<?AzizZVStl@k0!SWKCUm1UUO>BY!1jRh0t26L
zH)KFw3%tt@$#1Z_rW>u0&FPq~@B-O>w0HpxV7%ZKoBl7An?tJ`l=P7dg$@J=cY`cP
z5;r?By#Zt>cncB8QD_;@B4hf77f1o!jTUihKm{pCAGB%Ojh59w8`fWPiy6Vq2dPK0
zAC~31(JEH64bvT7a*HLwE=K4EB_JeyaQ~piC9LP#4XOx{)WhvZ%XFYsCNGiwhnDHq
zf+7**zaP^-yyO-aM2mA!%ljp_m=(<U9*}Y*Yhm8&LCcG<!K@yI=^HAz#e{m$@}iN)
z^b0RR^%2N>41B^p7-<3I5I*4^P##3K50vjf>e14MHN&)5++tE|q0NmRkTRr}q3oII
z39q=t>eqsrAt3FbY=|rmidB#}S~gq<as@~n6sySU!Kc0O3HPAI>N;q(*8}nvvU*VP
zFz{&$_n<}FI*|WB7J#A!NrTLt=^I{ii%G2mC1(ac;a*VLhb%v5y1*N5vHEqO<O-4p
zg)g$a56I<w!o8q8j}(6EK;;NXJ*bRCQV-in+>4g2)`5~GNIfXqAgPyF0ycj->sxL?
zuXP~DgA}2Kstm-}!o6srx*p^ikb00~kPMZ+Fg@Wdw;0oUh3OOCa*G*B&jDK^+zWC9
zk|)-K5(`K_C@_)rhfM$QmRqcTJ;-w)d62u1<)N|Di&pTh2c;GUKH)x)bx7)^KzRuy
z4stKD{m?+~1NjeGJv30ZzT+13S`ST9;C*Sxil8yt2l526p`fG$vJ4ah$m$uUJG=*Z
z3Y4Tk@@O$3397R};-I9DY#zvyAaPLOBbg`h2jojW;XaW2kkoGgc@m@^WFC@wN${`{
zpSExxS}be;B{`4=P@Y24AW<-V!Ut|KqYcnl=m!~$EDufc{b)tWhKlI{AGyVh#GwxC
zM+=}0pwz;^C)|$~K;mnrKlsQkR=)unK;Ug~NcM??0tTcHlsb_;3=N=uw7f0u0tujg
zP=p|<-w29rkU40nP7IXFKzSRyp$%CB%%h;X8p%OoJ<}6DbBon)geJQQpk#?8FA83I
z%_lqo6u`*lfnt(@Pj~{T>_b)$wPyk-z>(F1ViKetEyajH0&4o!FWiDs8$q!LQUo#_
z$xtzs=>lK5#iTZYVh<z_G7L#x^uzQ5usq0-AbC(;L6%=J{lZsnvHDFQM=|gTPXq-j
zlDr5g_Cewx^N}3A3FKIiILKTi^}^7;{Y10^Z4)RNgVclUK~~=bvXF23*Kgc{Qky_Y
z7o-T36p$3T?U)|$9pp$z6berSB{5`qNZJ>k2udPIj@%4$JSZfQ)q@-XvImqzkkx~d
zGDsYh<dD_#fE`&cJQ0*ckTpOHiAkU|hor$36v_;I!jnKr23b8QZG*%?NdZ|sq(l;)
z1WGc<>OpB6q#l$689}a41G$8O!L?!fgrD4EQk!8Gp(P8~nCTyWa*KIw0W0Sdo`jYx
zT%kUl1PXB^3%7ux6J#OCTx18bOyBT}TTE&TG~_0M0s=|i<-&A<-ynHtvY3n(ATD#J
z7yRZHtKR~0Cj+1GWRU&H`avE9iGu<L**(wzn2c7KxR`)E#wR=(6amQUK`{z42UPSU
zn-5aXz!xn%859G^8bDDE(twtvoX>!C@Ci>wOHx}w9s{Wd1sswE&NHSf{N)y_-wN^=
zNFJ15k>#N+k;$MWjAZ{-kjEJKgu&Z}kkv!&nF30}$m&5^1Ee05zmU{Bf!xo)H{JCg
zw_yEN2uB#alpa|TG?b@+EJZdHls`a*f(%DiF9HdKDWK3qRuA$7NIfW1BdK?Ugnqs7
z6p#auG;9O;0;B;g)EvQQK=TPt0XYC!J;-+;^&pFoEr3S*6i}=os|R_AflqiU$R0)&
z#KBt*dmuiT3JOkS4GmK_@Q5WjfMN-x4=vek1I0Q>9Aqw%{SKhy1`-F+$i_iDE<6<!
zP)O?Se@ri6<Pr1Q268V*A1GXq<&Qv}2eJ>zyzL<8g4Cmhm)(bHOgv)s+o6eUD#-cB
z#zAw}R8X)X8wc_R1E26TkZnln?ZCwYpYSxa!hJg^9e~t>iZ3Mf_Awv>_@afUfr<%a
z3qT10qyZF;NE+;52BDQ}+d;(<NIfVVk<{DkOy9uFBPO*SRQ!PC(ZbWtX1V|ikC@kX
zQ1Jtj2ZbAwej8|;U>c~{Kyu#>Xn0Nor86Y;)_<m7VBryy+5vJm$UIQMA<5e)OgCWV
z5zE>Eawh|y@N{tcLL@KSE8qYTo(?h}**=iFLFz%~BAI6kGY2g^c7Xf=QlByXgD{WS
zbTu{}f%+ZLKmc!RKr+Mznv17{5)+c8J3(#%8G@E*EFrNbJRRhDWcAQYHXY5=7LbPB
z^rvh*f>Jx7NoNL{&#g123$XKudF_Py6udnE$&psj95DkF0?3v^eL4da63FU9rY~UU
z5v$(`(+4W2k>o9*8F>aMi6ff_O$jqVF^;4jwk~M~D5W8(-vvt241B^fK=vT3hXks&
z@C;C>BWnOf6-Wap3nObVn0|nRN6c#%M5FLbv;YEUQ3gI?@FHkr^FSU0iGxBP$vpE5
z(-k;*#H4mX1863wrbU)tFg<{iN34DqC>BBbK{YLsya*^jLE@k+hio4xc0uBxfJ0Jm
zo&!oQe8Mw9Sr<wDZcteOQjZp(<}zUQ(Zb;U3CJ2iWdTS7T8NrKYtWf!0lFI+pfk||
z)U0B<02hx~{cdQ0&O!@NGictPg_hTLLj!acT7a5?+{?fxJPQ;P$nJ#(@GP_dHie|H
zXyI9)B#*2C8sf9iLfjN&FvtS55Z?_A@mXjgZgOM#1&{~#KtmY3D*!1*Os0Tb%qKhx
zEy?bI2JkGj05$=+2V_550PleY@GP_dHi5XeUU(KL&mehl4>ZJQqlLH$wECZo7UFxL
zAwC;qAd&}+p>6-!XnB4QG{k3vk|^W!5@{Zx`q>~mk=+3D90Q;5Y>?SVW*UJ!0TKrV
zCbD{vA3)-uz(Q8P1`>#~L4_ca`n}M6KO0hIP8XHt5v-pLiYa78pd`V-Ck!6XKsFTA
zq5z45Vh&k7DCR-ppcq0@Z}<k{h&iAniL4%!*Ffq)DU6Z93VuGQF(_m}5+E8`1IQO3
zakNk|o^H>}BVNB38aQ)60gP-vG{w#V<zXb__CW(-4k)mZ)kFJF;I;6`>Om0+vK|!J
z$m${D^}=&O{zTRQid6<a;kh7-kTrk;4kQi=C}j1ZSOtkg0t6l&2GCk%E?Ri(1I0E-
zJxHDrv^E#oA2MJ8xr9%6E-0XoEr5p5Tu?|LIY=K`IL!qah@^f$D5--ifFu*RgY-e>
zg2a(ij4T5K!+vOHn~N4i`Zm)Q_<6+Y_d}D&JhZ%}59-V@@CnZYS%~ZaXo$=Mg%py5
z^`I?{d1y&$KPc)!=76FESv{mjIlYyiN3ecBG#Sl93uZlN9WW0qnD>K96p*2y5(e2&
z=!GWpK%PQ&G&GdwfkFvcJ;amR!t+4BLeg*mnjYqXnlMNjbni?T5a1E3KLAQUAP0b=
z2U#B4Uzi8-5VCook_e<8En(|IOM`hJ4<W0EX7qWW=tMRjQpwc|&ja}gSpzg-&j%$l
zWDU^q+xZ|5A*%-^PzFBX`Jm`UQm+Fo8RmmLh^!u3GRy}>FLJ`xfz(RE^FcmD)&NS-
zAPYe057`39c#80RkPng7LyLs@pr}Sx4{aRI2YC>t9+a^TfN}uH0#IBdY0!qW4u!$X
z_+c6t7#I$KG5|<DD5{av>*#=jj87Q6z#2*YK~RPOsRt!sB=y>J7#OA}3G#^49|UCq
zkP1*_BddVs-T5FdA)5%w0wDFE$VOHVO||nuK0;Ox$_*g(ptwd>56Knv!t+61Le>Dv
z4h($43qX;Lq(KW>?=1j%30XZTJAl-KA{$A)HY8gJF93NESv@E>fYgKH8aWYYL6iLg
zkPneHfU*Zj11PeQEYN}`d+_3VWc8rz0a6c&Y-IJ2WG}n`<UyEvSq27%gP{BY(f~@%
z$Qpd6Hwf{FNgV>kEl3{ZawK`pJ<~UU<w40GB##z_ns25*0Lz1X3X%s!4YK~2=>oza
z^Py3+5M&Rse9v?TVIDEAL!iXTz$d&=V!DDdk68UeP)Nf(z`($82%4=Hg0mH(-=+>t
z5(`20BddqzD)4H5Wc#2EfQ6udMph3>f*|`LxvCysUub~R6i5OT(#RS>9tDYm9FAmx
z2FzkmKqIL?3W^bsdXPtu)q~W5#6bZMSI@)1a2S*ZK@tbROYEc;f}$L*fPvvCNCQaz
z!}J0b9x<bZpft{e2pI;b{zae=N78o~<U<BN;YAAIiEN=oXleIw!}J3pJYw~*iN-}}
zAq!hLu?Q^*9|jc{Aag+>i{wFdXr5XGN&(330Qm=`9uzQ0>NP+y%)sX@ya*Js$QqzY
zcoE1VBn|42TrRu_6tYO_kAN~a$bucy52*5pNi6~;U1WKX$3gNprhic75z|@(icw^F
zkVioBpnyfPk8R8J4Wc|^R!2Y%XW$cF3<_u@c@1bD2d^tfHV@=(ka`X9DpaY(XaRc!
zRDOcwp;x1diSY<n9f1}Mi_t<47CVbUv58~}thc-vy4S=_j7J~{ZU`u?At{EPrnwkY
zydjChqIfaL#Yo~upqXSbWYs6r;set+eB=^iT6_V#>epy7sJwoMlmtOZ59A}XkUazn
zQ3gKYB@B?Hy95+dpan_LHXv9VNFEfjNcJCwBn{yu24H=LOF$vmh-u#vw4`|yRG5Iw
z12498T7nj4W-w{AEDl>*310e+<P6Y3mf}2OUa&1ZOVEN9ZXQ~&)<YBU60~3i9XbFq
zuO5^@LCyr_Y$W^O=7ACjk~nO!+Y(TbgCy>>W4eL_kJxm-iQF7aOAdffRF+x-io2Is
z!s-H8K5EGg1_nkpEb?e^2RmMB3CJ@@mcmYXS^_FBk;KgurZ-6Nh}FZES1biZE|NTK
zKhjcA8bA_13W`GpK4I|Mdn9pa+7x#{^E4O8e++!$4xkK!q@D{>%+!lJfI=5p0+d)m
z8bBJ6#X%keiGwsEiF1P-4iX3HLly@)93+kwP~4DICGG$+j~O)N0ZrZ9kW?)0fEH5R
z5Fd*>fN}@21(0$`+>v4W1uY&iCPxk^Eig@+N37lvR5K$h2c<>^K5<8o{m9~=R0k3V
z6?@pkLC!)F=K=*JNIfW%A=N9KAU;SO<Xk2OL`}&73P_Lys3D7_fdgg`$REh!Ab*0?
zgNimJaZZo}LE@lniX_ef3V4t>D4W8?>lqk0K_LK=02Rn^2?hoZP{@PCK@|y-I48(~
zAaPKLAo-XV<^fPef~+29F(_Xmi-XkFgA4*?Ok@d=3qj(bG>R+^QU?+Tg$S}Z%%Pwp
ziYyK)KtSq24nr0P@j>Dj7#QjqkR?Dq1xcVKEdh{)AaPKTBdO;G1w8|wxDzOCBa1_$
z0DJ>4k~kMMB%DBL3nC8cVK6XofeZ#21kwnR02#@^1@)N|C~+Z+Lqoy|l$emjxuKcK
z3FI)Os1bnr7<?lvviJ?K{e0q1AfKa1fb8cJcLD_=vN$N0f*cBpJ7jT~2S5%(5@&~r
zgF+BV9DME~$eenR%aA3YiO~rZRLJ6>kO64`g$S}ZC>w#qK^7s4gF=9TPuv+4LP+AO
zpr8kdgY-=U#Xq!I0r{5!Bmv51$Qqy)J4Y}uFiK$*@Z!#(#EPsQ6jdN|3K$p|{jjJ9
zl`jbO^$e;Y7lJf^f;tn62DG471-Trg9+W!}1~I5Yv!ydyh^oRu0u*(~>Ol@?VBr&Y
zDVS!+BgW)1VY-ANPmXY2eo3mHyI-hoaY<rwHiKSLaq(nDMwjWQ4SAyZszHSc0|Nsi
zNHgzr6C)lgro#-=3ygTo_-a5FGcYh71qCJV^esj_T0&qp0|OJ3W{@nH{sE-c5u%pC
z8<f*{r<)k_XmQ;Gl|Kv&O!o>V28vIwH|CKSLI{D(WMD}PnZCi8$BeHRl$;nC7(+mT
z$vgdvF^`sz3wR2VfgMUSFqlj?FyWD(zIh^t;PeG1JZwxZKR^cmH{{`w1zkS?&MOQI
z;8pnyeBz*ZXJ7#7pPpgDV<+SSN>L093`!uc@-Z+la8BQ0!lTEP4h;g~-_t*s@R)Hu
z0>>W%14BW(fhkYBfhq5H15>_zKbhEDrhm}mcN8wjFHbEhNH#Ok&B@Fwt<X)+E1h1Z
z&#!BMMM5_{Iho7Z-^a(*IV9dE#6Lbf$T1+mHON-Kw76)xr2)STJ4nC2q3QG(1Adiy
z5Qob-KQApay|gGbMWH;iB*RKUPftHRIa$}xRL@AyP}j)7$kf2Xz(PM6rcOauHz_kO
zC9?=@tbS5v9!R7#GbhEi!on=x%tW^+H6<gl1mR!>UEP$#l0>+c;*7+iR0ZAXM-BNE
zjZ;z!Qu9($^O7rdONtVcvorJ3LFzM$6O(dMb<^{6QjoYgnMvu%S<^Qf^2@U2WG3Yn
zR7}5Z$geVeogu%VKxtliW?qVJYDIEtK}lwQ-t<aCe%bos%$(G`65XQGoYZ0@lZvx)
zvJgs<WlA!NQWH}^BB1cl%}Ig#Qy*KHgWZ>!2X<|Id~!u%d}2vzMP`YDt}aN_Ehkks
zIU^P9FWaKjoYchPRHzildwHe0rFof!rK!64Nm;4MFkLyRx|w;IC25&?nYxKZMTwQu
z<qi2o>vfW~wGo<gGV`)ii*%DfL9d$$3MP<+IjOoiCHV+dc{w1jKxOiiit}?)OORYp
zkW-otjzOr3lEk9))RJP`#GD+E85OC?x&=k4X_*za`la>7MGCsQ8TrK}cw#y;FFB_)
zB^4goP`-k$Zf0IuK3o`_2J}Hf3c9*EnMtV?smX9jC?6z~pPZOeT#{G<GO*rOzbp~t
zgxo|#`hyshn+QsUaF>D|T2PdqUX+*%b3eAoQ_$5d#!Sp$BU50uf-Tk0$xKoZ)YUDn
zECyu+uuD@*lBcgT;FkpFBL!VuaB@j1O)o9VvCSwcDX`MlPby8X%FM}0)PrORz2y8{
zxR^dn3n;hcCT8Uq>6WDy6=&w>>E`F<RKjF4i$M_qHajo19OMkBO^}$=%}J>zB7uVS
z7grV+<>!|`lw%1F{o=}EU62Zx-Nlu~C8@cf=z-)dH1R5kYwAIU=a-h~W~3&jq!xja
z8%RVqxu8_n*vJ-akvU9jNoigxT+{+43Q}rjf=ww*6r>cIM2l0CON&wqazL2{Y>{qG
zeqOq6N`5J*#4t1hDFur|Ge|~aafWVjNo7u|EvWQ#G~#!NQK%{|N#ROQPF8@1xdNoT
zQ-GCs3K~JFDGDBmB?`_(`NhRhX<b821r2v+XH5kzcfU}DoD{frBRvxnT|>RJWD}$5
T+l=@p3jBuxP~EfcfZ}-oO#E3{

delta 325827
zcmZp;Zgb<A%>*-X<B0Uk65Z5P1LMThWTRw51GB=^+){(dij1;s3MztZqDB)7L|Ep0
zeEo0w24#M+$@+};8}D{8GCE8Ql$gXMK6yG*0EEq)4yDB>PiKaTu|UKoH$WMan8YTF
zu?8|aOjcx^F^Mf5%3y~vK++sAX-=3Z7mNXt=7vf0AdB+CMEPK%{4fSclK@Ow5GE=F
zV}PWEVbUTnQBfEJBrOJ$7Ke#Sz!)HDNtm=0vZypnR0bw03uAyZ$-$)MVWJ8!21r^F
zCanY$RfaJ@(kd`%Rb){$n5a5TR0GBUY0`vAYr#adVGNM84oq4XCaMQxfTZ;U86Bnv
zvM|1%p1{KRfZD`l1ICk+9Ku-(EfPFsCdW7^h@hv+L^Dgv%{>mujDiPWBsFmSP-bAL
zVP>xIVBj#E<aC^I=j0Pk6&8N^WeN&r3PuJ-CJKh8R>p=_rY5{x3U1*FVW~yMnfZAN
zwhCAcE^*$(D%QNirh$PWp@o5=qJ{lfN(+cxe_^tXr#s`z$t|A#tTEpIe?6T1z%!RU
zqlV#!;{S=0L%gEue@1vP$Oa}bFfi2YVp?XC^#6aw5(XuU<evo|46>GB@!crm9Ucs_
zieT|gPRQyPcreIvg2gwZi0|-VkogD__h4XP@c#d`62$iY|G$O-1SacxS91OM@xzfp
z!-GNR=;RIFT1iqnK}tYQu~cASuyy+X-y->!z)!8Z7aj~UyfC@?C%-E!7BWn*Nd9Hv
z{r^`kNL+`Rfx)4P@y1I<h8gxv|NleP6j;ysRq%Ty14n)H;|lNpzZ@q!_(<_d*@CpZ
zbYy6-RA6M7oZ;gZ_G^as|DR_;!Vr@fe%Q?aCt%XT$l%b($nzqRVTR44|NkuxFfdpw
zWGJwB{>Q_EfpscKz0IQk|81K7{|C9+V(G6N7A?OXSS0^?;lUuyI+?{cXZnZfj4V1}
z+2o%$JQ$=pLAt#Ee{}`XI(8s;|FeL~Kk#6XIyrfcuU!2v4-W<@uo9R<92@`r0V(^@
z$gsg8`PT{$2B}t%5ic4UHhBO4_W;DMNs+DqsR0FnMe;8XkoP?pB>#fsKtTfv7En-t
zJOK(8@Bcp{L2@8ZJ2w530qL!8d0b(^p8TuAgF*7>WEVec#>~YHevFfA{LL8yCvWk$
zt#@W%uvMscP1N*ptKsrsaA;!K@cZHaA2s#T6+aaJH+CvBu<CF!FgZ3cNOUSQu;_3y
zFgi9d<Uqw-7TPliSZe<N7plo(rvZ{{WN27u&md%}`Tq@)SWQPg1B-<sLqkn6`<B-a
z|Nro7U{C-#Hlv1vY1t1(h6x@Ff?(IbU}Tt3!@<1F`~UwHAO#3{_LCq!l6(h<Z;|l-
zKgdv+fffn>|9b!bKLaEO!WIet|9JoZ-!Z)*fLV6>T^DAK>5|_W`Ri-uDuX<jShGjF
zqUN@71<1qR|NmXoVP;^gsgtg7Y+`WHVFr7A&Wl<G1`9=o1q#Uw3@;cN1Zt8c1zsoq
zzwx^9|AW^H|G%g|EMWoi)a!%)KY-j0b5DKR?TY%=#}yV03=H*;e^+=guz>U2k6MO$
zhE97}$o^jeGu-+B11n_~aBc*7`bRATviTkm%LSK$<U*3!_vtYEF))FA<=DjFfMhu{
zDVBo_vp&GU;{E^Mi|Gp#nPjKmeZed(@k8-{A}DZcc4=4C+%c}G`E3mj-02E?8O2>I
zAWq?03(^e>A5cmMiPtZA5m3M6HK;&^$S-+aQIjbR)>FUNOXT-11_loXZpP^idl|);
z1Ue@x1WU6ns6WiUWqQLLCKVfy86FHQzWB{%k_E|wd|i|LO5{fs0|VTI$pTrN(|P-t
z*y|fH@&zLUC@I481|x$2p8U}Q%^x{f@<#=h{E^aW56@c_I-Cr=Ob$&90TBOiN=`SJ
z&nPkd!(&Dc9gx#K7<j=&z4!nB6Cix%iy+$j|NjOM4a#SrY%%@8V@3%Mh#^dGA%-Zt
zW0IJ@L6C{VM?-}{+@X=7rjeO}!PcSPHPOq*t%f52R03px>J_BiZUOa;0LWAeMTP=U
zW&?%B4@QOt4+g%<$qJz&JO}|6OOU|ig3y0z0^oABp`JmYVLyWiC?nJ?)(EIbW>BbD
z%Ain_{7A%ufxmD%&q2mHlMTZ8*nWNRU=Y~2ea}Hg9!7)T2mgNn1-Qjy1`$hT1_4V4
z28Q|rHaZrM86;{M{B$gp8HDN|fcXlw3Vu41Cq(%2A7&7l{Fp&vVl#un1ZD=6$sZzQ
zSSmFc6ejaTR!rtek*NoHyoOmx#G#S##6o2T4INGf6Ne_oJuut44>PbfDl^C|Sj?cM
zBL^-49)xNgunW|3k_*&wv#VLDT@k8!%q~>JMX%C}L7`@;b49Il5Xgl(iyt%S=*?qb
z3R%ixXUV|8P}|_AWAT820TeAzT+dL$k>F5sN=w9X8iPmu0s{w!28Icaa~N_gwHR1x
z6MS?mwHO3yP8nC!D){KsYDS4zaxgH0d{CqA;o#8l{|HEbt-5yw$P9;R{}0q~{BVGp
z^TKfsgGyr-14|>+4DbK{4_Kr#FjpkAr_`uOI5;%aGjM>S5mZ)z$}CV+f();9_7d^_
z|K9=RN=s!1g<1z6Q26TACiv+<eP^&BnZW?$yU=We??CE74yrj7h2)|C6CCIKp9A*D
z0<ecf;2sLs)WYMVC=rN{B%nU}@8LM-e@MeB27yK`2CyL@A2m8NC@f57&;vQl`~Uw8
zkcX!CoMV)k&T)W|cd~EHNjXRf^P-+X;l+Li4OqgfsgV-#VBnlMea&&kp2-Jd+1P#?
zcrb9ioO~ws$z+8<*6DKtn0e|S{{Qjo;QtN39{%6)gONetH{<^UzZ3u8_`UG|3s55Y
zq4?j?+JS)qRAto6RIYe^m_eid@Fx-Lc?>Kb3=9$r?HO#WqZk;i=P)?ba9&_=Y+$Nr
zv|(V-;bdTOX!`%8(S|{zQqwG@*3L`hr6vPMp(ZGi{Xg@fhCxP0nSr6+vFZPTW*G(*
zy9W#s_KW`iw@zSSuvoyrV0D0jG3on(O6$G93#ui|QtIUniGafYr3{0}!gvOY7e5#z
zUe<$Bq?3rH7XxFheUwPed@Yee4+h2;M;JINPB19Raxh5Lys#3f`EMoS*u<bvD<7e!
z!vU_;19Z3;7#GSj)SK06I*B+oG38Wx{ZXp*WM1aMz@P!L2!<ERGnmzSI^=;gfLaD1
z^-c~<HjSPP3?MOwrvDFW<2AHiYBEUFXn8m|HZVE7RACU%U}MmH$<Dx08yO^0Yw0Bd
z(&yO7@I=3jfx&Se6OUsfBZDnd{r~?KFK(}?I3eCqag0HsmfdMpEr*pzEhqCbzXlcs
z1_p))3=E7DAT*fW!oa{dhk=2y0wD$#XJKGqWI+`Ji4(x}U<*KsNY%`k!@$6}2Vx=P
z8dzw7XiK*LS2Q>nL>wC#6zYyUnAJSrVd>DsV57mo!0Xt=XraNu!0y<@&;#<Y52)o<
zbHup9BKh|O4+i#3kO82?0it2}r455geYKZJbt;2GjjDu$W5YiN^n~Zo@OQ#=i`mQ;
z^)Iy;7-}_7iTu=JU;vo}syae7`u|mGwlLLdc!_L8h*wNRuya82NOCcink@=Qe4k29
z1|=lE4a{|*$oKyL7u=3bU|=w10JXNg|Nr{|Q&7JcRL!%+g7{DeF@$O|SRoAi_hI^-
zGmNhO$Jme6_83>xoYVo8M<VqHz~z!b#WD6{H4I?3Lj8Z^3X1~_EH%q~bSw@tn1Bn;
z1TzrZtYRtqv6==j+oD!eyJC9IS;mOT0m+8(&p`%TSJb>v(Xr@ckg#L`mA)!E70*Ei
z!^IUq;vliwY=~G*gNhDJtfs}f!r~=^M*RyLotg(WI+mOa2G#%BkJUW?T`~Dgva0-l
z_G7gizbk%nG8im)%wVyQnZc}vJ%9m}?j0Kb8-VJg$p$GZ^^p3ANn@chgNY6&gM&j8
zlMJl50o8!riy2s7Ix{FNSj=FiBg?>4s~iN%y*8B|3`(J%2kZhpo#aB<57-5=JIMul
zy4lsN(yj<(ce4w1J!Ti`;i6Zm$$ku6Pib0L)GB+4SUNLUEI!O&p*I&?SJgu+t1xh7
z1uo7{g6pRgXuYz*aSlU|WhMiMr2_*?{i_(A+JqP#OHT#`O9ciNkdJG#e^=DM4AH4|
z2+^rIX<Pvo^ZH#;>jkO5YSaTjb=L}z*|qM$6*VWdKqdW>8jcSR^$UzZl^~;x;~WN!
zmzfM4FFhF)K!$k#|9=FOKu{|%Nc}ZEVK%c&y`?gP2FOXZTs}IWShsX$u&PZ6)2ZZO
zKUS;h4D+ka;=>F!Aiu(DuKEXI;HDI)>Z~~luDPII{omj?=YNmIN(Kp#xiwijIyDP)
z;9jjr28E+^MNKBytMy>Nf&^>5q$_H@AT=ApuRk0heg)TRP``q_`d`Lz&VP*;D;Xrv
zz4}s_L1SSugB2)}y#N3A0M%@uDjL+w24iOA#>Dind(5jOEM77&T5>TkT52*dS$Z)r
z%{cY{f5&qM#>o%T-9uw)RkTEEG(iOfLx7Gd1A}i9gF?Y721ZNP|Nm>9wL~167*<rQ
z_~8U9UOP_y|8Mc~|9?xa|NlX~I!mwr|7M(GVC;DQ|No2^|NlEN{C@y)&Ez>5I(V$j
zFfh>3U|{Iw{QrM0*Z=<xP5%Qxy1?#-5}?LnO*W*1Ymxj@VzNVKk=##-=6#?RJ_ESK
z1NCofQl%^E7qf5i{{M_~@`X$>w%-T5|37^@`Az0}NlkFlXk;h=)x$697?|px{;u%;
z|5SCl4+o3R^oG@p9Frvid8gaHW%g$AVBm3_-t(5(Qq|7F!J+a0hgz>wA~nnb3=WM9
z2{o@I0$$oOFciFCV036=XsLKL{ncCMen$4`RqvR+Cg<b`G5tO<xgjT>al+&WIns(U
zAe(FKemK0eVqmDRyIoO}`EZ?M1A{|--S0`(bN>IIER!q2;=#bhJJ}{TgaxE}@`PMP
zZ%Dto@`vKTg+CG*Cpb273h1aXFjyooFgP|bar`{UaN+ks#(?^FzbmYd{Quvn%D_;l
z!SLU)iSZ67yna4pxbcgT;lVFOh8L6n<Qmp5Wc2W0U@!og55qI{7#J+iF)-G$I#>KW
z$T*><z90a}92F41M)`w-Lj$9P4hMs(B`e6w|Ic(hWni#g$j}cOtC{ncfw5+Tc16!q
z2F6+q?+Qyz2F8#lY<4;<3@MIHj5#_i462Szj2`tC?f*B1bhFuMa5HE+HvT^Y8sw>H
z5nW-K^>Rl|x6-PbmMD>$PFStYZu0;C|26n90|R>sK6zw01_t)j3S<Eon}LB5t3?b9
z>^%$&><bX;*tdY#3=HfiKr{$5FtFcw!N^$f@*%^GSBwk~UV%bdp#U7xppXHD?#qJ=
z7hWG^46smSOaOKCVU1{541j1$JqE@ZeGCj18yJ{=DuQCcBcN8#yTbebKOajD1}3YA
z3<b5C>{~#Mx>^qQEw$!eBDLa9A~RkxD9l*FpkS%Sz|qObF!6O814F&@hk$zPg$xsa
zDl(j~RA5k;smQRwQse)nLQRIh4owUqmI@38os0~VtQRs&0?8G!gOf~xt<wMhwbzO(
ztP~g+tQ;6vEH!_>uu5QH_^HUSqf?P#!%szq10ctOaDCo}fEueC4i1fs3YHrGH(J{=
zFovqJ*=evbXgfACh+F|hZKbB@3X4;(_tdI+t*X^Dn!frobAh4=w28Hafq`KQ0|Uz!
z2n}L09${c$ahY!Og;}>=<Nt+@zYL6_nrxt9B2LFf)_|%^28DXt(-l_542-pkULrF&
z847A%SXYERXS35`2M?v)sj1%(P<L)~#fyUsCqRMe{r^u5$h|u345c9bpgvapjK>u)
z{f<ox9$}sm7M2X4;_(0fT22qM`c4naddDUP1B(X?y0%RJ|5tg+WmuOnFwXeKz+lPo
z`$fGB!-e08j1%hfZUoe7cxcs2cvy5YGHj@seIdXik#T~>0|u^ow!;;5Pj^><Qi1pX
zAFVGM87F|`>RAt0RH?H+usFcLRnw;sP}6cD!2AEtr=7A4jIRzdP5^l@l%1{K&ins=
zl#E)H&Y%E_ewc%59$JZjECe|SWblmT3<VYs7&t(d)|~Lr0yzj|dHrky3(&ZU_x~S^
zAV<`v-mU<thdP1-G$soQAu9z2#+Qx^JE}b7GOCh6odS?=9xw>hBua^Z3<VpO<)8)X
zRKH|oI55+hp#Wr1{p=f13%)OeSpYR$03`4I|3A3=1NqR(fq?_+Lp$&P{{lc3!*EqH
zgMwuO0|Uq&%X$U|1(3y{pal8S;s68V%w&cFkV7Dbem8xo$T$IHD9AvolMIZrI~f>4
z+1c!V9b}x~{r~S5SbSS7VBoT7U|;~ndEMjP74_8@0zhfUgMqm*0W<<$Azc9)7xn)C
zO%TkNkZ`DXXk^$@%X}c9IFo^~?#5<NbCIEvgF(UK0fRz)=Ix4FF;I_(K|#Zs0aPVq
zSc^f@2gso{77h-MO-xs6wiN_aYW{GlS$atXR3?IIQ->x70}lqK1dv5DelRdtOE54(
z)h~hZEe<f$!vrVjXhKq^L(~5&1;@bsE}8ng0|CDo87I_NUkLDEU=T=PfK>7zht`W7
zuCQ7Ft`${kEj9$yXx;z~80gg6tXOAtje*f>D+A+9v;Y4=p#<^uS6Pt$8dFe}|NjCc
zMC(sifP&Kd|DO#YNf@q5g~SmkN-Px^m}(YkiGZTRk^vkt0y9$?3hLV)gHt}J6YBl{
z>%><J87F{>7HiJm_v_BB2&h}Xy25G(17qDau;Wn@d97(hK#iG)gF}5IgHEpn1Eb}8
z21e^@2F98C|NsAd$T*>{d2xmJ|1aQS{~BwEi);ESz}XI#=s;NtG>QsxJjgd7kLa*7
z<Ty4lnt;=a0|STm|KB%2o<fq(aBN~^fyy)0d;kBv161;YN?lOtYq5aAAEW_P`ho^%
z;3e=%289_f7!<t!|NMcbKEnI||0`%>$=?6}A3zh!_x}HX4VqYe0ccDbO|aPe|Nj;=
zu~P5<{|nH>D!l*ykFiu>VD$d~_XMcg0W}yv)eflo0X3{Z9)V#{2@3Kxs1)`7|LaJv
zECZ93gBAlLDA>IJ|Jni(VBmoAmmnuT@Be>iOukU=TAv9T0B4lYU}aGGslveE*vRn4
z=E47e3D5ukuXx`4B;onZ{~ins;K2unCWZr`+yGM7>B+zl>dj`S-OZp-^CHfqkb{BI
zVebD2pq%2^#Bf80l|jI<iQx~-u^<}c84wM_7N`DSsJD3af4(L6{|h0<*z7<)(O_fX
z)NW^xbZBHyu=M)B-;(?PN{6`&BB5Svc9z`#Pik;6NcuK1DAaPXn}8fs^HlOuEeE?v
z4VMOkPXmJj$Z<6pRw5t=7J4&)nxu1JA*Z7XYJM@u=x~GToc|>j2@LfNFiDWBKoX!r
z$D!#zC=EQZX#D>HH0TYI17RI*1_OsChJ;Q|21bxN9S(*Hho=9a-XPOY76yh+PX?x1
zPUi|x$UxQVK-CIB)iPLeG9amyf+z;11&aj?0^lL81q@u?|Nq^X-mrjCWU_%5%j6@K
zlP!B1<3aN`9t??^3>={O8^<OlkQ+mFm_eRmssM$q%>o7+n+N~@*Vunxs6X<#!l98N
zW%7h7>3WYwdj^IYPSBX||2K`05oiX`*iEB71BVVLI5@5}+B5J#*(Vz983ds0J)q`!
z{lDK8H7YL{>X*H)aA;s&(kREkP=D&fkNT6JD{5ndL~1xJ7%IKKKXPnhma(*BV5!l3
z!QjxqV4$M~a$P->2x!2lhRXuf{C!}l2~ptKz=)DSpk8?cGTc@{32cGQgA68%1_qWy
zO$L`*FC&qJ=L|J993D{1n0&17F|gFw88A3BFtR`_WAJE<V_<*=(H5}0u$=*eV*{xC
zW`GS;FibvEt;_Wf<crT0H66;+tFJJ6ss3YNsr3l1sA*NMs9EYHVzHE=K9qyOAY>_n
zLCp${fRLpp|JAIVKJOZ%+~f&064MKEm^D<q|Nmu#xST-+RKQpyfD(rd11Jl5|Npzf
z`~RPZ(`&9WO0a-(@nnTsv3d;#$0mk=Mo&;vje!N!@`eNrgMp<6BxoEO{z)K$?Ee{b
zwGK`HZ-B%=$=;#q{~3@2YSp|!lUWx)K?VvwP*8z_&4YnK1(bS0*yceEgKeyW3pgS{
zNhIMpQ%0gDgHnwOC=CBS0fjv%VnJaJ3U63gJ2d^>GXWG_Cq5GqJc>Rg2-p3U0rhV|
zw!?6v90N-YhX#W~)1L?4|NrZNU8Uf{0CSA@|NjwS%T7V!=JYj28$lkBA03+hT>%BK
z_y50dHm|AkW@el+IiN*sGGCLx<hT|NMz6{KE#gex4j@4$?*cI87XqP{fGPh52=xI>
z1wg1Eh|1s#V8KuZ2(<uAg>L{;5fC#Y62QDjh+OmpFfSIOJr1HT5n@U*L`m`iu#z+Z
z2nErQ4&h}$G-N=`%z(Hh6Jk*&L|-<9mjlsPrT{jjEC5VZK(tpBYz}DIT0hx<alv+0
z7Di8du1_4`&NtV`3)3T<8U2Lb2{14)FfuqWSb#}>2EOS#oEg=){6XRj44ckRn6Bu;
z7(Us6(Nf#~0iQ(j|0@hX>KPcIY>prE;cS5)_u=g6i(MGC`3`|ww;l|Aq8<#4Op_HE
z7fi2lW#nQsnBMNn_@7aBdb=B=JlElb8Y$*wFPsi%OyA(fD8^{8{J0w<lNI_J3L`56
z17g-t@N!LO^kgh$%F~=&kf|_zh9{#GQ|`xUTNqWQ-|%FVV*D}vvnOMD{SStkdCC>m
z5<eIk?VCZv@}NmC2V158e?k2QP;#{R-~7YUbN-!)^3CA68%y~m3>JsBeE9LdnZwe4
zCC5+sB@90fZF%uCekI3G`;`*5N({>^9T_StHD?Hb2D}{_7z7&aS1N!COUEXshT=@n
z5I=*+OZ#RH%jqw@7+u*mH&{K|oG{(Qo3V~<3kR5eA&XIT`dM$rxlHL7rwb%7icD|t
zVN_yDeK~!J52G7XO5^r7K8#UJj5DXpr!cB*&-G_CWn{8b*uEryF@w$IB_l({%lKxF
z*DDw}K;ylZ91I+mUjKjmWMrs#eV2iuQd3^#XM8h9t-Y5>{YmC!mYO9$rn`hQdQOi_
zW#m?PsmZ`#>BYeD(-EN@p|ttO_C4W@O^i$%u1<G|WVB*hzjOM7C`K)%)!^3VOZ#RH
z(A0%vllcRX**`KF7%Un7{|AXrKM~2OI6W|mF_39#B}DVezhKQwD;%c_#4@T*H;iUf
zWm=dzJtCUXjA_By=@X(EgP7*soW7u*QDpiL5NG<v=?+PZvePqT7;TxRheC{*b`oq1
z<J9T=v5dh?6K_s`<HIO7ov)NpZ2FvPMowmiCd+9_j1trL#4<`THC~;5BbL#Ksorop
zPaLDVDR_MfsPu4bGS~ugG$;YsGX4K+>1p5qa=66{1D!@M22kBB@Z%)|$4~iYj_EmZ
zjCxEpoYM`G85O7Rjbk)qDk+@)A&$|AsX7%NXROn0;~6!XY8t0!#52Y-{+)gzp3#k|
zdM-$T9#ggFbcX~+FQ#fm5MO-y;sizs#<L(X>FL)K81<Q|mO>=t6B)&sssbT0!HFOl
zO^D3wL`Dh5s}PCvAc=~l(~=nNm?~L8!Q{kL0X2Gd5~Bg*&FN>781)&yPB-Xel$kD(
z%qYfGJ`v;rKc;fsX;q9eHm^=GFj#6baQsw+#68HTI%W(EueJXFaBMP)u(tgFzwXxN
z3Tx2XBnAeCo=OJB>N)&NJecZtPJfcj*v|M66cd`vOl7RoXQVL7PQMw+$ZzqIlYznF
z<o^$#WM%R4{|i{s`mw*6<F)4hA3yFlbG-EY56)FJ8UYTkPX2%4*ko{E`i~UGAf}?V
zpmZQRJu{V2N4-<KqE^$oqEeGRK|_;)#j#0ef@33tiH;_yA)&cOLz98Yp~>LP^fUd8
zDlCpo|L;uSlggMSrn3Y|)dHw02P9QCX^burFV+5kaA;ItQ1i;VqL$Mkpys)kNTCa8
zU`#!y((8v4bPCJ_R5HM@V}s5bOHT&Ij+YFKwOS7AYS=v-K$AO;4LVaSwHO$k9Ml7*
zpGjj(tbf(~<RvG>v$bAUBDHMJ6)!daf2dV=uBdp<o}i%)DjKv_XsCm{rMW{#9qc6@
z&<LtSqxOYD4hCk6XaE0$CQu!l7;JPjz@0`F9Sx8^27wtX85nAwS%XLEW^^(zSR4b5
z-7+xhs4*~t_#B}2uw#>U$Mg;9j4soEq%)e-zc>L2^jZ(&idqiuib@Xl1Pu+4{aOW%
zjSLe&b~`qyUC__~1uH{Gjh2CfV}njdEt{7}jh2IhLxWBYDCldwyhI$EbQf5h{Qs|(
z-MOOR7+AfG#f$&{7M%G1uV%TI$d*(8|J7)K+BUiw3)=txvsnJW{-4G3|9>n_{r_j_
z_5aU?E(WHWb}x|{4F!e;OaK4du<ZXoP(uckB|-Cj8X632j!pj?Adb-1K{!HN0m%_E
zh3X89puua$CI%5uAojfY|9{S_|NkAEbQwV1_F7HmWgRC#bBohgWiakxQi++Kk;z!&
z_To4L!;2RT3^mV<M0C^`7=FB9V0bCNgu$^vH3KC6;>7<SHLolJYP}2sEWQ5!uhFt_
zaA;7?vE=yw;q^)eQ228El%KAb#puAK>M^|_i&4Sgr6NOxCD;ES7O(z)cySV@rWu^U
zUUD%ofa;MKum1n2(Ezo5RVB9X$YOM1<f-*y2bV-YJ^%mM&XU78iIK_u>hu}8j9$|2
z;H74uF!@pQ{{tvoKr8XUsd4((Tt-Evo8S^eV!J^e<3Bbg>$TGjN*T?VtV2N=U1fSt
zDPtIu)l5*iDLVaUDPtj%#Ycz=$Cc9yx*2VzKPY45W3rE({-KP~iODu|`i4eEMP?=!
z(`i+VlGA(37{wS_K?R7y^ng-EF($*<=?BUg{g|xQP8X<PbYimfgqUWw5M-ai^n^%8
zk?9927`d373SlOQGC4kk*kw`4$j4+FijXiC1yux+)8AGy3Njh(L`dl0L`X0yO#ffW
zXwB4PIK82UQE_@~6{9UvStEqAw~EnLr~te~5ma`A%5{e(VT<WJ)r?_Gc{iseF<OA?
z1TLnWtJ5#kFj_HXc}{;)&1j^S`V|z2U_Hv9oF~cx3S>~_W$DQv@FSCf<0mJB!1N1|
zjH1)$b}%YWKT^Y}Gd-Y&QI9D;7h+UgBB-RYm|j!GC}L63!l3XX^ZyGE#%S;i1;S+E
zGa!?Zt42#tu<0D2YI*vdT1M09p0$jPOn%^ymYM#dma&e>L=qGwiqkvm7-hwr!D}<Y
zMuIzdd?!FgPCo*wVPz{BIUuTB_QJgcQ5Awv)mh3Y!JPU3!t@2Dj20k=-uPMH%;CWp
z;)$w<cLhw3=Jc-(jFw`7j;IQFcEA)UPRC`aADTmWcwl-UhAR1(f()(6l&*Aa;_Z1o
zznSBw4FiXz4THc>`(_Rgrtq)R0~#5vn7lke=~0Qv_9=vR3!L82&L}(mV<V#>lanB*
zp&&8crin32%nm%I{8Evj<0T_Q1E_p(XyW`by`hIuX8MgLMk5s~NDw+g6o86q4NV3{
zP>?z_@_^(1C+Bp%W=0nk(}^I*y~L`LI{@Sph)T8Tdzu-gn2cqo2edG%O#jmi${!mc
z9E%o4F(w075XXv1?<R<rnZBZhQHsM5Z2FIy>2;BeV$&bAFbXjl7(#Lwn4@<ViKCkd
z;>b*|Xl3MMOJuNk9?dYlp_);K<3-m0A07<mOQ&yWWwZmy9E)a{J|U7(jLG!mbe=Xw
zd&b6TRg4DHYuXsO8UKR9No4w*Hb!s8gP;HmVlvhRr7n}{1?`Odj3+^2!Hl(__KeQ7
z4n}Uqy&zc`Q0bvC-J^rih-uMFP<C^fexQSqo$>6nBu0hl0iBFOOiO=)9B9O}1l-Cn
zV*2tC!vEY0p}%lW>tZx!TngbW`Uo#2q?qQVPA>q-6+)s`;Vg(&WM;Spj&nt3hGSEw
z3v@GTGgd-0cbI|-5ih3JpCES{F}1o*{{WRvX4IT68Of;1R1a=wiqzXGF@UGvek^2E
zu*iJA!J?_*hX+&ET~Ne=M$}#`WK@`Fzf!^b|K1o-go4`77NCW}uNWkLaxrlH)M60$
zaf(3#R9=J1T#y>joC9*k#Urk&(2>c&P}AwKu7+8`!Ljki4aWvnA5eu{qiNyb&~&2)
zH2OaMK^mjVbb)?GiRlk|7+LEX7#N5&Ujd(ckeag^pyX}w!axMQIs4O-K>+T42L^_p
zo(v4rHF_CUrdv#8R7wNY`Ybhw3YVn-l%XKCKHD9OlmCA}YkdxfCI(Qg{{viEF831o
zaq9n1NUhJd=SBPf9~R61|FC%e|AWP;|356f{(tz<#lQip^rs(~$S4A`P(cXfA5a`v
zLc$(Yub%5=6qk1ot^k?*(u08ky()HWxHV_GKrf>VDDc>(-|A)Lnl97Fr~s;nW$H~%
z{Qptu&VCHk@^WloI$+81|GUKl21Xr?|Nk8tn0X4GF))LMOf8m!8VU?HpjMM(6N8G5
z8l-gv3Xqx=+Mw1I2Z(LS0d8G!fLdW-z9s{QV-r(G#fuM3pc!<K*iTPzg|G0_^FQ;4
zpPtj-O=MI8IpmLH1Cxp+$N%352QWnta==7S1_r1DSU_y316V)~0Q14EVa78s2Y|#T
zdV+_L1SWd^|1r_?{~srY|I<HDWRwMk5DN#W0s_VP^aUx5A{?L)2Z>By(9fs>a^*kA
z2Id=<9RL3!T*+8N$dwxru4DqSp{`^Cxf09=FL7gd0&^uuY@;Uw6R6X%(ewYGjh_Gi
z!CkqepHU$L(%NG@fJl6dTM&tl*~8-G|3A>g#{x}!e;Q8w{{w1rPC51e4<zw1{b*?a
z|Hoqa|34Pb|NpQ!_5Tm3M?9g6fd!uUCiF9kaDd7K5T1S^ol$1Gz(huk`if&8nk=4y
z2i=!c9Q)w}VgGBWIQHTYg#G6O$U&BD;AY+r(0aL=6$Sw{OT9!2mNI~IgpMWy$BShQ
z4B%BDCyXn8tOB(#m{eYRFmPCOFmPCMFbG&IXW+1S&LHs9{r`_z503yvF9wbpErWW7
zmo5w(KV3lv{l5Z=B~YA!ECh81EV)3*mGMuZDg&d%N)Vet1~iV{v5bMC=D2YMXt;6)
z*fPc&@V4)921ZMF21ZK_21bkL3{0R|h8ZXR|L^o-V4Ug6zzAC0fv~5Zfx(jP{~wE2
z|Nl5PF;1yj<|R_ILL;DHDQFENgN%+Q14{#v&n7@D3u*LVV6o_6U;zz2SS)8?v3SnF
zG12}1AE?h*YP1X(8eJGzCc1*mLG_p=+y8$Sum1mYY+_WYsYh4{S_=)bkZA#ug&V*Y
zGJIL+!N6qE0rm}x#c~EFi{}h18{Pl^gIdT0vT&gb1Jg!VP}c;>LJbB6ONamee|m!Y
zoD5q)Db_md|9@~-_nMQ4iU$J&PmS3H2gfD`pPniPMh_<6hoB@<QzKmg>i>E$`Cgnh
zmC<7Qj7CP0=?eXf9N_FV-DWDI&UA;Vj2zQXOk%W{o-vhCVEP3sCXVS9QyG;QtEbPN
z$|%p&s4#ucR7Sa^&4o4dKLmj0fh`gkSgrqolH2B3&^(?8lQVe72x#UDv_9S<fq~om
z|7J&v1_mzhl5Qp^R*-W*!|)*epgjv9Ga#E#{;z<jab}!uGmSBcNkMh`f@zFOObU$C
zk4$4UGujkr{iso+{s?3V0!W|t|4p_KJx;1%bD#dMK-jxUak|cQM#XyQ3RuvRw3>O!
z6`<9zV9O!9MG8R%fizn$YBccvzwu)I;m;KwOpf4@7O=V$Y0!)WtM~tnTVW0d>GA%*
zaVdC3Ad_P+NPqp(*GQIc>;&lrP5FvgBru40|KC^%8f$WBVo<P9WSB5LA&*&-Uy)$~
zOchAcbcNT9A}rqjH|k8^@R~^yw4@hgutoC!|Dff&FPWM^Gb0Qd%nXb#otnU_o);=L
zdHiH#C;*L8Y*b`uaBO7K&|v|k8YTr$-g0PSk^n8k`Q6B{;P*m?750l5SU?*belRjz
zuztY6Y`ymfL!&K&2V~5T!NbylfzSE@1B<0Cg9Hb32ti}|h8c{?^)DJd89a2jz!NNY
zejjAm0CJo4p+*NtfH{EX%^B*Centv}4W`K6^Zvg<wWbc#YG!N!>8=0IzU8+g!-U_7
z3^Od68c)c_Ge~&<|HlXlr~2AUB0s7@)f6LmX1V@w{pSjcrp6!M|NlM&Dfm$hnw4YJ
z09(+=PymV%kfGlH*B`V<WGJvsYSQpvvIp-T0jYr|3s&#{>lcD13qWEZJ>LJ<PpnVA
zUE#rG58fUITABb=%kBMteJNO70|SGFJUABDr-CeZXkzGrOF+bZr+=8qD5kX@<YP9F
z0oM2a{{rQSnwC!@9!$>Q9bcg7>RQ{2dM_9mE=+%r%p@}1VHTrQed7fWrr4Dr*S~gT
znD9E0VFpOS>qdqJuNN|`czuvz189Se^@IQaz5o9QFMqK}YGUwUiY*1{@&5n+42ZT!
zYFyyK6q^WQ!_<M;)(`&wvq);p@L-AsXHI0ZLFRfh|Noye{lFY1iFyrY26@Lu2Jo%|
zTPFq<`NIsLtucj`UOyN>i~4H0KIqk-`Xr*m0jd%h8bBit4owUd;1u?dp#v14HT$(I
zKw<NHAwvbo`X7u83%viYeTkfPtQR!}c>iB}^~F2}4v<=qKJWi)WsgGglPzQ;4I)2D
zd;ed%a(c=eCKd2D0MO*q^a+a@Y3g83Ob4&|`eGh~0K&m*WS>GDYy;l7hg1Mad;ec^
z5{rYU@0i0F#?%xsU0^Pwk(l*MPynH7Tm5u;#9YQatEK`_IR)CS11aFFL&0iM3b@ta
z9W`M0fKn(pA+ENaHjmLQu&Dr|%?jLW04*{ErAbJ6yy_;%C{%5$j)KHM8v?5DF(`O2
zFt9-N&jpJ={XM;XKBMaNJ@XiyrmtJZD8RHzclv<^jB-q?ctLw~-29pfAjN<sB<@g(
zftBF2jcVaa@E#k`t{+<^hPL|uQX-&jT%ZjelV8qYn0{d%qXc+0<n$-=8I{atFjzl=
zdC5`|>LjFsW~C@d49y0{={5@(i(SE~5*C==|5wz4ltO%G0nRL_p|c_uB#&y;3Qv$H
zRi<mqW8{ejZSJa>kElmL%0cl|tKto=C#(-O&G7!e96YLnoQAyrFNZ`1xPCD|2-1gI
zTrQuUzlu?B`rCPof^JPKK$!yJ?B(F)CJ<+vgX105*~@)F=Ak-!xh2%uix`y?3qfwS
zUevS#T>2$2uzLSr25}E)RXdXz#65^S$L;-p8F(ZF)y!q!xU5zFJ*ign=cO8D@a{_$
zaFwR;8noeSIwMQ{Z_ol)P_?-LvL*=R73-#^9p3+!f%i*-ov;ABh!o@uaIpj`D?OOZ
zz{5|d?T2OHy1i!JFA=a)5*S!5T0lkNGVq36NDefG1UJO_nxJ^#_Wr;0EoPW31t<R3
zpc(^I4d*OoG@Kr*!o&{V(+S!r18yc{N>_k_3l#hyJ3+>vMez>r|4SjM2ecU&?w6(D
zXn<q|Q$vtG)F@u6JH22Pqwe&z6PRV|{}+PO3{*2nvGt;+6W;%qfH#ez2GWwPAbHgE
zv}7Sz3><$Ztzb4J0HFR~(g+d*c>vT70ktr^|1SZjBT#(3m@XK=tUldfEhF!A-la_3
z>7bGu=3`Kdfqd-!e+eX%k9-D~>R<ywt-eD|H@yEZhJ-pw2rPyqDsUn<h9oMK!eB8X
zkux>Dn7&~dXcQ`N`k7^nA=4F>G4eb90NV}Ss_6ZH5jYYd3Ev33We_#tF9Mgn$ex^D
zu$<8VWEP)OGY6VsVBbRx!;*^@fuj$_un)@_b*JmjV`L8j34@kxgTe?F4xliyKGZDX
z{eK~(Fh>cCg;zo9AgRF++@M5F4GXt|QiBGlpyQl=b2>9m@B#(~99C#}|6d5nJg8Pc
zG7mVo4I!BaCAb%=5^sft_x}Zuq=#a~0!Y#WTVXI0>?0H_7EDF5V&(!yQMYCf)L>r#
zZv8-l-2l9s7&Q(TfahaD;fqM93pnA0m*DiB6PN|luw|F#1n>Xz!9@~kc9{>ZUQn~k
zd~kMvlo$G`V1FR8i?sLu`QZFKJtv1*VcL5p+39arGji91lz}1~6e}PH{!sj1XuYTz
z-rlr6)ZF0xe;y=}f^(uCB#|PF=Jx(S51dF*oih)TAV6EJne@QbEXaIlHO=b%e;z2P
zRT&_uM-NhKp@jQ9aDx?;m8S~?Fl&HvGRx$KAXbpW<-raI#e(&s<_X^a=Ydz1B8L&k
zW8VMg{shsWFadeQgGm=$Jl3N)el8>xqoj$skem&6ye^hT_FPR!*#u5Bx{$I7#qo2&
zkpXkOiU6oq1vv$@UdbY<dBOA<s~Pn<H-HLA@BjbKfL4&nPS0J-BvL<58N4+c6cIIh
zwLwK4D>&fp7*}}zp98M4Kw$<l%!5e>9<bJjnhziXcMg{HF$e4<NGjC<rw_2Xpn42k
zUCsfgk9v^d9!xrre23zvIpEm_kS0Vjo}&wL2(;6XfF=iy6qpz&1VCl<L>tgy6|=!J
zJfL;RpndV6aH>^i-|~WyVY=}@MoA7!1yBw6|Hkx&!%Q;MZPqe!TiyUAQ&4#X@qsqD
zbAX!9W*34S1G5lhnfL$MvC|vYGMcMCK+_KCsH3zuXETDbqy}g!Hp_I2wT%3hA5b-E
zfl~siowL9R0oBe~z0(8MF&ftgg0=!!C^BpSwfkVJ7r~tgM}~&qi3}aT8yP12UdS-x
z_d|viKNt~9|1FYQz)M^}-m#v?pke)hfx&vw@&aq8*%sDGt218QV~}{UkAdUGJO&02
zCJ%7Lfz(<gwHSCXd4Nm)mv(Fn953Y<B&Kt$XOv}EWT^09U`Uy+vz}2!pk|JTR!z$p
zvx*k>2OdoBZ>OiMXVi8y(2-|g2>;2pPk$z;|MP!I@k<7Fhk5^JKsu1_V4r&b|K9_$
z>a`-I|6`HV(%`}54$cD8Kb&F~o$e^iBwk<de7VAd$sJtZc>n)z0bb?Az`)qR4rwxh
znj$sxlq-KI{tt9)V)z0I6;Ox%w<1FYI7E;`2pT#ymC_ZUEaA|^z+t^WfT4cg>q)gX
zFE7=f^r|q_{Qtjx4&#*SPPPTrvoD4=fd#4=r&vcbuvSOOtAHHj{r>|v|J2ljdg%-a
zzwH?qe&1){u-NtghD8Iz|KIft0>Ae&Nc^79pkPtYpy9!!4Oahxk>LO+)lI*!2Gpk&
zW|Ck53BkE6(>K^Nv($rP8Z?6O`XFdBm;tmY7UXTXpKEeJ)-uijHNij|2|-;>P&m9k
z!yxf`4TD1clh2cC?LS_sY4NHsX!-xY{y*cC8rvTZjtz`DFLf9=Knbtb^Yf%yu8)^$
zHJvI9IRF2zVek~FVF(h@VPL3d0IjaJIK!X;TH6R(3T*M5fze_q17i(?g@a=gBTvl}
z_AMc=+4fa*UTgxbJgQam(5lspF)P#rEnoP5rG`Pn!LfniNe#P(18CiaLj%K+nwJ(o
zYBjY)K>N`_lO&)Sd)U_FT2J;Zp&o4eDm6joImoL(40M4R*aF({?8NZ@PEEa%NX1JA
zh2M?;AJjA`SJWtbI9N9@Fgi3c*nk`Za%g?W^q@_QYBHdZ0EI~X{uco?2_G-L)L~%w
zy#{nHftSd%Lrfx|o!BiP4KSZMH2wPnI`IP(?4Tfh4L!;P#0F(LP#l0U3j+hFpaN~S
zt7%iNc+t$jP_taS;-xc##EZoY95pHipw%K5K%4Vw*{norG#x;paiCT`cv4M^LBLC9
z28EiI;OW+z8I@QyEgXCrrYCJ?oXFb&EhHv-FgeFg+rntZI)lTKW5#ytEsT0>qi4D7
z89mDda!QT$0fy1DT(U;ba%p0q+F34t)tO|#Ej_%4xiCqC4|7?~dclLqbmHhaE}&I=
zppEIH=eRhMbB@aic_uONC@9v0T$n_`2f0jQYZdTd(my$Q&>rFfYQ%!}&w-lm@Izb{
zwFV69LtOq^ypVr0au0C<#X0y8m!#GL4<;S(@;cB-Cm?Yc9u9}NFlmEFq(ENt{{Nq0
z^bnWPLtI7=aUtmt7qxz7p?dstB&`d)|5rffKv2dGE5M_@kYO|qMo_U*k1~u_{ud+$
zs&){=XyxG1b<lJnXz~|2RX9C;HKWqxgO$@px0H@<DFyAst<~_Z0Bt`7?ZiNA+8mi%
zN~bHVWfTEV2iRU`<fwQ2e?h~RiJ@kRHh2M4O_g+o#R4XVABuki9UB=qKqLO3WiuX3
zY~b7pQtQyj@ZfhMQ-^i!-~YcAnJRuaGEMk>kZHm1hfFJ~t9LnpHdfWgU#_sWW?)R7
z^MSG6?lfo!6*R&J9-IZu=z^y_7BUn}e{zFSV7kT)Mjj2&e&Onuuq{yxe;gYbPJosO
zf({UbY<6Ne0Ma^L;0B|*&kp(Oe+<=@zDr&=GEI1WkZFPS-hT|QA2O||k2)ptT9K)u
ze)lVp*NIFW^`5UQ5Ie0HRU8``9)OH>XkwTFa#Fp^<>}Qo7-cv&fJ+ZY&~Aboj1oK=
zn&6!}9$+iaTxXOJKsoZQ`EkYcJvSJo>i=DUI?e@Z8t4e<g6iczoDz~hFoKTU0Ijih
zVPH_QP-KGJ0UCD$EwTZPvq5b-f~>!O`RfX(eg?eyxf&Q0pc<#w-(-|A#cBn37!PR_
z*`|R{Afbg-!Da!UK*Cbip6M5EGCDCTOc%bzsLZG^-TW4#Jfp()@LP;(jG$Q~9{)ON
zNb-OjG+fw`%)nuh%)nBSESll{{}gz5zaW!=5i}d-*u>xhT8<7nrE{ho1E=@@v*3wB
z&|C%hklH#12GEK&iRmAvGjeDYWP%n?GT2l<W_tpf)_`gOPsn0u(deiHTg(cz7(5vP
z(gixUtfu~V1;`Z8krmTF<S;ALTO=?_KnEEEz5gEtk4e|mf(DbBG%OMrOh8i!*0l^C
z-v3X5$LK>c+3X-I-WXND1L~l`bkJ18L52mOsRr0KbBlTgMo@j@{r^-Zs7^xYW4IAg
z$7UB&&t_MD_;Y=Q_y1GiwsJ@^o1G3b1E)jN{}UGV49rl?;5i`B8cd6N2JqH-@BgR3
zt5`rI_7?RF91wLU!QKq-WU~WhPaRGMX2&K*2MrM2$Z!L4iZx>Z=v-TervDihbqoU5
zcNsLi|JR=YPcKfWWyqLq$G}nT!k_@EUA_PReL8y{0~g5UFpTigNzn8n1I$MbP5;3=
z1wpeGuN@g0UN<sKczuvz!Rv<%D>`i%lpvwSAkb;cU<6`=R(*lu16)H-e|ncuh&A_h
zB16aYKX(~rrf;~x$WgDu$-n|SXUw7L-wZToX@Z>P{r^A8**l%K3{D`U9h?5QblNfm
zLD?0y3ZRo@o1gr&WnchV;r;(Vc=_OLTLuT~y9^cx@BX<6F&BJdqb!5<UGREB=;FB6
z9Ue@Q;2A#e|NmX42drfhnZDy5;~bWdWEQ*W5%(DbAgnd_8Efh*R<S<@ouFDP;au_C
z@&5(zNve(iAN+<M?)zKu{|V5N%$i@;6^+RZ46l_L1Zq8_r`11+o>uD>d97B<BOug{
z#jgH;<hA<$3IU*{j@7@_p48901v&z8OU2Uv4;`BrVnDMxzaD~TbXL?{H?F9u1?Ruq
z3!o$QK&6*s6T^v`!^YsX7d20;E2{s?t9buE{1g<QFKrn#YSN@D>R$fT0xjx$^^l<g
zv|tca-dI{PuvDC4P^!6kSI0t;;XtkDT^&ms29A0MUl7ex&)^TD`RWh&>r8$SE2@0(
z{|DH-0Lbi`n>V#4{9)kOD8s<B`3?gg$PAFW>4J<*;ySP$Dv;eNtv5WF#K2RZ=&k^r
zhd#YPfk~v^R)K-JV(AB$O3mgc6-&jNYE(TKe3}>(U;zp$P(X8+pd+kbGBaq@ssvA~
z)eO8=(+N7BihWDPJb9H`j}KZp;6peVLO=mm(W&+Xl>R^`vA=X?5U_Z~z*5WQB~p{+
zqf>L-N5@iwfum-Dk50ugcGY7w$)M@s!{Bb;OMCDEj10A&A3*^(0Tf`Mrsebt>zPES
z*REz{pKkGp(ZaMMlR>E_L%Jd)`G6hxFlA=YVaiT&fy{1pphK0xg;8>F1*mX`mb?rM
z)0aMCOs<FdE2Ps!FJ#^^yZU?H;92YNdn|S@l|lR3*&l<BP6bbMH83#MANySKVljh+
zMFN9^^-=~oi=_-=pt_`nfo+XN0)q{>er{l30*Qg<XdIdt8bUgc*@bku=+$ZlSAdSK
zZ;WTi0G%6Lf9$g)Xj<ICqJe=46o{ayDbNakkml(L(-<Yd(>Wk3LDqp(SuAA`0Luz6
zGD*~fGIpXSc!IeH?k{G@yd*era4;>?U}0ba<qBA_>)6Pg1DcnVU&3Hvv4FwiH>fCu
z6{`;!R#?|E6o6J=*EhcssZYKo0*Y`@<kjC|-vXXKW&8miGpl#G%nv?0-TVJ9TZ;w(
zh6y#(yPhyA3WFCYg1r8thM~c+iJ7I*X8OJ-jPi^z)9*cDl-8ADm;myl2jdTL1LmbY
z1H<b%3=Nf<?2jFq7=FCi&%hCW?3i8nNf*8FIn&jiGRjM~9k2rlLj!>&xXlR^?i|5w
z)8n2pDl!I4Z+OZmuNwj{4;M1bfR%}$sZ5Zw!EK4e|2IHM2$T$_-+0QXT)(BEmZ1RT
z_=;pucHIM>cK=b!Fava;QoYM%um`~v4<kc?_x~RYL9PWYhOekpds3<S|Di(@qfB_)
z0lU}n3=-8d7?e<)xQjs{xXsNDbm}fB&cfLa*jemiP=Tvqb8?akW<w~bpL0qCWDraN
z$l&Uk3`$`C?qbkDF-#3?n9lT=SSAUd>U;c4kagDIdn96gPk`BC7lT3dNtP$o_ZXBy
z)ehJNsyWF8sv&F)KL$3%1ZHFKF(<j{7S9<~>lqmeKvj(Q|9|kanJtwWm@Fgt|5v2Q
ztH?(&SX65AFR^G5V6N2+5&<>JEEX^@)W=^Esnle7Qq$rkQqjWl#QXmqa3}Fc6~h8h
zz3Tn{-x5&DgkkWwWm4-84<-TdIt}mt|G-=7;0Jv{6tqcrFbRNH7h;QJ@Be=<OuulM
zS!DVR7iM12HUf}Upac)TDqy!Z_%4PQDGVB*Wa-$%aHY`&e3Ue3p1I@qLxvf@9T^Jj
z9T=E@A7q$N9o78A`T!ymft>o%22>J&N=5Oe8qEu!6FqWj?SiL)G6pE))@ptTsMTcO
zQfV)*QeUZ|_M}$%hZeM2aCvFVAYk#5fu+{dNu(yzMW^Pt3+NPfSdj-U@%DgsY=Wu^
z(5}5&&!1W^Y8f;dV;LB%?=djeaD8xaZ2VvI+L58)^+ARSl`irguOEWa=`QfXpcl0a
z0#MKKTR>b3N}LQajkeQ|y<k-IhOA*){2Ek2S%94F!T1@xTnKbk0W5RCuAG2nlKK?(
zEufh7{{PhzqzAO}<wfmuy_bx}{I%edqhdh9-v9rbfY+r@?|8|WAOczy02**WDn1>i
zy<$|6m<Y=1&^c{TsKW4ci&u>DoF`z?)7RW*lmHjZA@dH{1<Z4j3z+9-2U_loWa1Ri
z3_Qptn*)pt74sRCpanF`Ygpktmw^McJQbYto*l5W-pjxPPv*~@<Uj>=@H0eK0Lg*W
zgAO4AovFtF(g+q@`nsb2*yjq61V{`PNT6C6G*b^MO+Y>Y&AfxvB`|;rbQX)H3@l*v
zsEa5V7+4@_3&}GpK#m91L?Amr9{T-|@Bfe2hauGrXwYT4gEy0062pv;`3LMke2~LH
zTS)`vJIMvice4X&tp3k_3}hivH3W75C|x)-F-!<)K41sx=71a>(Cj1^(ClUhx+|gn
zv2+E<Ga!#lH+jQoQV-g}0Jo(9d<OFokZrh3cWnA!VUzIxKg{%m<p2NCO$G%K41?6d
z)PQV7tGlMFKVs&a{`C!`5M%3fj<<~R(XF6GE8hSA#nvB|sB~yzC;{;;8bM|9pPP+}
z4B$odpi|0fRoJ&oR0NABg5*K!y#N2%3Q|)D-c896^7}q`K{ErSGc(yPSZw-?w~TW2
zpbflj86HfW;BJXU0=Qn?g4%>?v+!Wzge+Bq$WMW~ow0$5fdLeSpfm}pKSA{-C|VKG
z%qXJ6$^c5A9*#|n5{``wDLSm6<tmIdI;;##4)slpAvJqHfp#I;fU0^>U_+vgaZgQ`
zaz#Zmivp<n0acWaO^iCB&d2ORJzex*fewnonq=<^P%{}6sGz{sVFm5*WB3EgETCio
zN+uvXU}jr4fDTY*;Ha6ST)}6tkAVfDXu98fMg=WK4p4h494Y01tN~qC5!?)FW4YM{
zH@n$^vc&W`?-^x4J_7lW!+I}+h(puA4<O56X2L9WXks`6@el)&hZuB1oe}91Y>Ts#
zT%a=~jlw(xiWSJ=+(;%ff=mXLO%@3Z|3RfLs8<IImXKyPJCJEG6F|WN!j;PG$ExQr
zD8ST#)YK$Dt^oN3q!wfoXbWFOGK+%u|9>u^Gz;QG(`}%F_y7L}(8vepX;2u0A{?}9
z3ziTNk<U=_`Z0rtjtm1s{eLYH>m~pH*Ux(lIxG*oI}GHY={r6!nizqKTd<QrxBsBE
z^<O_`;IRG=+N1U#(cEL1F87g9QxH6P{-Tkg2$JG|ES;{y#3beR1AMRtQnKN&X<%Rk
zsi|mbev;6_;NboLH&`#|Obf>*h6s>TK-i+GUBe=&t-*tdEp+;wUyM>rKQyOb`N*g$
z-3ZBUup6O3H2}y!@Bg1Pr;B`IRMrKz03kv@!S-7!FfkM)GdMUl{qF&ZTP$E;v1kB!
z<oC_#DW4cs-9g7&KL#DJ4Y_3sbT%P0Y#AFE8Q_=WSTry+fHD@SZU^;3y#IfP>}CV&
z{Q%zLqEr7X@&62PXK*3pN)1q!1nB^+#r&c8pAoe5u4b|_s4C<DxxVI}aRsP@2r_vl
zxbXM|ZnRk1{{LUA`AGzPz<DEc2F%&N6B%xRyy5--7q|*7$YlIqQ!QQL(8QebOOb)K
z<Ci1Dgy|1l871o*86LchXJB|~&(Kln!TxwrCwSwxNL}aRick~CEiZLboGa=x*|&gp
z?7g;Un2_$#zyR7EU9<A#rNuiLm@1a;Py*eg1U}@E<A5D#rB|SalU$&Nn_b092Bnat
zkWNp)Q&5I<k_&k1W@qz&kpa~4sRv(Bur#;=bc9&gL>9Zoc!mONd4>X;Lk!C%a_-Oo
ziGz+Mt7kr3G2!J7P=|4u#RCQbi(@-9eyrSKAZy6LT;CZy?ZtiuhWa^y*XrkZ1X%rH
zV630UzNLQB<BG7CEOvEAHdlE6e+?d{DE4Gvtoi-%8c4k*14BKdV-w>7t33=%b>G>y
zRC2H{sCdqxP?t8lqVCD=im;U|b|8zr|Gx(B<pFC_0G;i{zyu0`x+UyeEDkahK-GX_
zx>25?;KhFihL`aS9kqte(<+{`Kd#kuyjH8(5#ZRwAP_$3m|b{>i(Xxjb48_QJ^u;N
zc><ff7+7i;Sk{2@fz=cS#+UL89d%ucLBo)sKF5cRpl!a;YqY}mve<e5e+ynG?)`rS
zI4xT@3wL-hFn~`c2ASjie+9S?R3igARF*+tp(O)T4d)96$EN>JK%M}F2-wly|KEs$
zG80(v$?giU;Qu#_aIq!qTOeYu!4`HZG8BM@QyiKYYF;Tabi8t8m;kyz>Qy7dg6V6%
zGODn=O8h@#`h~BM4LlqYVO_`U!a7~_YP~?`fB)yOWME+S{{JswdcikFY0(cJOpIWM
z!pwr1qrd|)71ZoQH7^R(@U=*4o8ZC32p&U3-k%7o3F}kYw}91wkGyC*;lacJ-i+`%
zk>LjD>JNCv<%cwMK%PxtnEve>V>G)hsA_(mIz8e$W4<c*c$S9W3=A*!LQZn7S3X@)
z&%(aNl7WG#-tBUQ_x~4y)8Bk&%ojZfGGt*K15@}*7CXqHq6|-_7yMu}X527+$qz<*
z#W}SOS9BV!!AFjQRzF5ew1!vn4?x3q(|$6#)Yp0jgATl10kRR41VJ`>|9=4<_XCN6
zY=?@0$Njwj|IY!{1fYYj;r`-9_zP6%+d45U1C6hO?j~#Q+F=1I<Uwr^hbG1x(D28E
zQ#&kvFJ$QWeUL$O0;sp~19bd%y>vy*KJ5xn55@cc3-DeXMDhLpEx7o$dJo>B07|x?
zS|8Mi1C>{hvgZRhf)M<d;ISr9i@~vpVa9ZYPmE$}@4@3}pc`L6EmKgF7d+0NoV>t;
zK^i;={DP5T!}Nl=j3VLn&FouXl^-ayK^VER@c#b^ytNTjQ8+X)NFbV5@4;ikpaV2P
zdO+Bssr?4H@?iWs{q`?L8AWh839{?;LWT}d2j=xdh8du42B-xB3gqb;f=pUk@4(ds
z#DCAhWddlp2Q<t93S>}v1y$1%wRTuccL3d5wn31IW%`L@Oajw8elv=(?Xa+T)NV0-
z$#2GHO>n*gne=-hqk;#647hs<ayw|~&Y_862}sU^LH6zRfIp1Zj0dOp{9%+6Yp?KN
z{0$zLXlP{AfGCk)JN>{PMkBp;2M@+yV2>clfwv!c|Np-O<ZTePNM!in!Jrm9UEwdI
zG-Km*o4<_V_2B(LaLXJ1pQuTZ25-8xNNPXe!T1ZD)?kC#AX7jXNzDWg#-HGQ1`Ul2
zA0V!hYXzx6xI_-Tjllc=zY`#F5JspKk^?&cNwMd2m4A$OLG1}1j6cC%K*-60E%N^V
z&jZN;D?Au~f`{Zl$EqR>mIY^gB)vPQZ~4cltL^xI0;m%Hb@2ZN(C92^6c$zq|7!fd
z;Mc<cD?s;Ofhy_g9RC>=#W!nL)Lb&IsQG4HVXe&Y0Mu@J>CEtBy2F3Q5FhJk2FChw
z_AT`#w=2RuS?s_WHwtub#{=+2D#u9-JUSMj{qBqz;F30NHuxxga53U?xx(TBLk=WU
z-~T!N!GFebRq*73_y4)zjXBnf!KFL+#z;`OK}z_!u~QqE)J4JNKgdw<Xpr*h3h)09
zHcs8cq$ut9e*&oReAW1W!K;P;SG+p-f5WSX|98|*XjGWKz?oTNdcibCjtCti1_qFJ
zt7ve|UjnN8!aP~*V8($8Y>@lB|K9_reURF^W1B1LT-djO(mluz)$9xk5cl5$$Cda0
ze>u||7@4Hw!NmjUG+U6nLE2zO!?b|vcJKf9!08KYG^pxDG8$wx#OS-wX#e{MTFx;y
z@J;{4$YjVk5mXjQ%YxGvtSAD_DIpgQ(^Ht3lo_W^?_gq5vU&lo-w-9!L-3fhMFZsS
zOHlIl{{IkM<bwJ+p!^6Glbrs9iOE<LT(H3k3ea2{XpCa|f|ZOS;A;w}doVKzakamI
z6fj>hA+6JAw$mG!nPgNz=?t@(_zZk57sQ%-cR{;jbf>>%W|9g7$8Sv)XbOsjMaLde
z5B+9jm|!i%ATZI2fyc3lIR#v3E?|@ZRn;DhH^JTkvAzG_0~d)PuR-`vQ>RC;FnQ%Y
z1&8=cD+U2b!ObjSsldPmD#U(01n-vF01h7J!xa;?cG!6Te+u5t1rziBe;=$LWG-kZ
z3u5+t@T`-L4Ff|>xpakN6Ek!;i&<g104tN2*$x|fC5C0z2@H(Z3m6!zEqB;hB(uJ%
zNVd@M{yzttxImS|j~WIJ&<Lhu6XTa(2N@cs$FMSKdT)DOVd>8L3e-BQ_4;`Ybn{^S
zy&w@#t>OLu7P#fraFc=I#V!VrM?f>6OrXIbiwCT)Ks^@gY6hm7W1mF4|KH-Beu0%q
zlXu%OyYN*mdUe-=D>j{+&c?>%Ru2k|moW?qpb%N81<DSLYihN;D?nFBg?b*ddl}9k
z0lHSnl7W$7BNqdMEfd2s&{!DA_Zu~KIDpz5FU=VwKu7z4`tymJ3@nKL{$t1<El?|t
z`EZ5z|2yDV0@cf)Sgb$7KK(o!lYpWkD5umv0Uu4m2<kI}Os}>2xX$_>1C#gv=Zw?X
znS%H_6g(I|fD4CL4;eb9C$KYVOM+V~pv^ZH4U8I~8~VKe&jBx*nO?xcq)-pe4a|ot
zp#3TZ@BffA04ntzn*L9*RAAsiiGNTx3LgKDz;%xI|36nip#aIX|1v;s1=(bg)c(VR
z@jZC^r1$^-H6S-zG%z%K|9=Rs1ztU55bt>12)f-DbaFm812Z;ofto4P%{Z8XTz(&9
zD6qcIAOOl3kQv8^;5-Up-vn1`pwb59z!&ul9TV*tcpAEP*jTi%zN%;eC7@Xkr(fV;
zlB&N4RtwT+v4DZmVm`wT@BjC}t+Uq$L2bML5n$UvQ`<}+`xzKO84|Ql2~^mFnn;dK
zOg*5BiGDXSG=Rn(9GjR5pv|KRAp5QNGYBm7+Trk0o<ZQHJ;Q=Z4)(_jIYB3-FlL0-
zbFkQfLIiY|s3Yviltc#5T=<5D{|pVaT-MWSIV`W$dISViddYi$#->3FOd2^EI6!@!
z=FA;7puIfxr>v*dS33mMNNYIMSKY3tzh`-^{$4<UV<Tft{ZaNU;GDSlb%pgk&?wLi
za6E%9!>b3?iJ%nk!FU<m>UkN@AOPx2y_9E|QGfh%#X_|m4wYW)k3lB~fp!^fRNDdC
zu@nGmcsA^3Xb4qz(F@grOmEbBSyzM~KV}!|#$s3V+`FPyO?z6crslO;O@n|+P5u+L
z99|+DUckF90+wD3)3dpllt8;cK@Rl(e*?TN4cx9uWT<%E$j|^QHbHGGP_bF>%)aHd
z<Nphwb`xk=1C*pdIF$XET_~H29yl<c8&`xpXR!la9_QG^umaR*{f#G3>p`Jv2{{Ig
z19T@_ErSoZ=SV1Y9UA|Ex7>km@7=9kVUg6~;lcO@+&J<6|E~b#Fc=00mK%#5a-ews
z|91g&=?eo$5zMz>A0A|w0P-!ePeJn54xs4!_XkRUnSO?wNxI$;DG6?XB|(s<by!(n
z{Z?d{@jH=W1*mauZO<U^gOTBZbv?rl$3`X|P}%*fk)gou5yP@y3mGav<tM1F`0WTj
zv}cFa_Z>bj?IC5pV-w>XP>KUZ6zC$EhLt;PJQy!@g6@9+wFp3I`vPeCdNJezY>|4-
z!xf<x$LvD2T=eQCf-4&18Fqwoa{mF%UWH4s*wwELo>sp%@LK&|kAV8E>|3nnGBDOH
zSzS>#4b&340&dd0*v}vU?tCWSuJHbU1$^8Q$Pr-iXS*vv>MiR*ne*ii8<4?aoh)|s
z+h13B|GxxoOMn!D?qmTK2B2jw)yEkW5C&cXcP1PDGwgVApF!ZIJi~=rE9+?$$3R_h
z%WJio7a(2m?a;FSdvFCT8E=9m<9G%EZqPM0Fa9%JsOLC5y`GmzR07fhxta)y))%0g
zu^Jf)UM*y(m>v+tBq9Pz%C8d{R)7k)*9#eTSST`Fn0|qmNu)lU<CtAIr;8rwlwt4x
z|EGYw3W^(0n1jOG>iZ5SP}qAgo&zsS1o`fzJp)p(|0@CYmO=KyFsPQXNb0EYV0;NK
zTS4x5t;jF~)M19X0_1|%2meohJe^Tc4&*HB1E6&FKLARD4$lP@gNzM4)2Hz<DSCpt
zX5j7}_;&eQ;I<a14g(b>iJA;dh<fZ6xFrCY!U0b`SAc7l=EvZgWg0(|lv>9NNYm#9
zxI#cOrUA*A+UXAbOd``8446cwXYe!e%YuCaS!}~tVv)ea0GjLq`PTdYB+Kbj_?i5e
z&i|bLgrBL8ZAXOn|I4k@D+HL7m~JXgpCiBoxkzIA4gn^4LvT+D6vQCMd;h--?rDJx
zc4+!H1yufc|Nkce3Qmipju{?|&yG&#5M=T;1ux98n9l${JPcHMc>li!Zc|#!hYTo!
z<`2F9UrPjOg|yTzih^2d8q+rjGO5;sb{RipSn->Yp#VH13!SqD?KTF@XM+astdkj5
zyjaY@@KTxK0D-Kv0+gj*&j(+625QcLhuka<GQ0rgiuzr_(-z-hV1i_~3jy^z*|%ud
ztAHB+XTd${MtO!6piwB$)g&+D84lE1A&*2|nBFeLq~<LF9%wpH&vh6!(6j_P&;%ZU
z1+6gf{(k{nwRr#U1~*W#cSXA1PX8dpq$sU&x&q`n@BillL16^ix%--tp#YRJ;X8OG
z>$#wL!V5ei6arESie-zWjuRe?Pr&U}&?pT^9E8DgiVPb-rhsOKK$Qe2?J|H$2@b^2
zE2u;Og|Wo~2GCR(186`MG?;3U$WZZ9k)gnY@g%r2X7Ey;0W>-{0hAdRYVL>t*WX;A
z`kTQcl!L_%v;qRus0ZEh;n>8OFinI>Sr_a~kaIv7RyV;_!s{mw(2T9XG!Z75=_w*i
z+V$W94m2zas+PgaA{kGByQH8&S7^1|0j-uJ(5mGK$0mj~&}zAWylQzmpD2?h<I?FK
zqD%%74f`1iKs7mPh4sH=`UTKP#SBp<J;oi=kBc&?OYTSjh0Tx79T{MH<&FX{eR9Wi
zb}=S(#~lUGux<2UJO(b-LDCir6c|96?nUN~3J=C(;PyOdaO9=^jsj4#2{t(LQ)|cc
zd@&~NtQ`q2x*$^aj~JG{Shb_U`u~mu(DX>n5{-aHX9k9ej*J$LO^o1cA|0C;8D89H
zkN}+&2HM81!KDDYm}yT97kDT25m5E`!;wM5;vu8O4@Sm>ngyylHA~sIyr^g3nBJhq
zBw+(-=rYUzwTNEYGe|6W#lX6dlYzB{-2pUT?$F7}z@o#!knPySFr`xqe1<4v4JTO6
zWO{-)lLUMw<OL&Rf<?mrU!a2D`~QE?rHLT^Zz%taMZ*8ju-jWf>BS=9{~z!F|F=xv
zAkHLSKgS~B{})hgV3F|u2WXSO#R7&Cppb*4k0ao+_r-h$2}>0Q_L>ELIw31rK-UHy
zcW4A3a&|mqDT|#&3j-%a{ULC#3v3POETW`N1`o#j;6ecE%)d})sX%hg^tJ$I@#%M6
zm^r3PerM#bw_n7t4Akre^|@Zu?kIr8qkR&?GW#ZmWgwHSA9V_NFdnf5v0qg0sDP>Q
zU_1iOQ!j0IfUfHUl~XC8IVe!+_|s-b!-SU%3@>eVG=NqY{P?q@VJ0U73y5#Y$-wwi
zW=F$DPlkF%uz)86)6bY44YdwmbS8Q-FoDH18CXDucrYFSm*60=nk;GXl9yTsf1THR
zb~IS;WnlWfXGenv<9_%FLXcZiUsrfA9)X-V1Ug%UaX+~E05{|C=L%3G@u!W{jt1}l
ze?>uw15|oAHZfR$8fx{A*|$t@P-Id7uQ~MsdHkjIjtbB%N|u}q?6nLoIyGDl4xlKh
z<#Mi=7{|b1(aFGTsmZ_%QfraasQ`*P561oAA^>E(L(~5r>j%@{Nitao?E^<LILPZ6
z1Uwk`J)LeL#iUoiqX3i;tQY+M@4<Ko-0Z~6T8F?L$Cq|Hz>_4P69_CB7&0s!7#V7A
z8&~{Pg9f`AG}xa(gI#S$131{(z`@RFY0n@5y5;^QM4ag-+m42b^`M{!33xKF{B+yV
zFnJ{d3rGPd6Ip_yLk$$v`@lWfm)1KPY7+c)Uf<r)@OnN22dIAvs&Ieb2C3N#o-U|w
zd0YXG4$$c>jEBHg2*@lC#=YQ$reHI&q$^(3GYEj9qyDEgSo20u7=k4c76_nO01j7F
z3l4(Y8z93x823VYKhZlHz@6yFzbim1`hH69XsBQ1sRuF})cyvw2EZP(-qG+nkzx8{
zX(kEAhUtH#nS7l<`GS!_02E1})gqu{VvzHP2jc;7O8_&14uDtizO>yjy<dh&EdKCk
zq9X+q)|Q~G;I^Zo{z0e?sLTY3y<YhL1*q-=b&^228SG>=P|E#TGkwErCYk9nvP>eZ
zpar0I(@kZW<hg%8WY_^(6a1ol$Mk4fCdqma#{J+*8QHn@_di#Fifd~I1_o=Vc^)2&
z`@y4LFU@xp*erq!Zdg2E$O8>{{8Zi106JayrRt6bi<1m2KaTEbnDLT<1<ZfR!1&|o
zj)sk#42&Q?_&PV%9S!vjt~yY@A<IvYzyi1cn7`2zVgTswW{?G)b`0PPi5#04eoWVp
zV+yO^1x`nx?Bm$P&;W9Lqa*`^)ei>77cX~!`Lf{*ye~C(6j*vOaMo&C1c1z{)qEvV
z!{Grs&!eV>BLGB~)Gx5t0o6mGBm<ggsErA(c#*ZE!6KP~=|>hQ+3f?zC#Z<f5eKEm
zS0X>_ZFV$(4&<%-vAd$v9^yEMrvDN;65!EX0nj*u2jfog5+~5$l|vJw4QNOR6rv!<
z{{GFt0O~w|9JtYwf#3W8cU_QYKzj*5@-H=afDYGYuXXU#so^>Rx&rMDXr2{x(}rUc
zLjriM+4Kf^rh@4@7nwAsizqNjaMVItPAt<c6qw{iue`nuI_BqpgGIvs@819aZ?H)C
z|807~MJ9>qS6rAy>OsRBplN?loee6_!DW5Dbj6FB9pH78u(BLf-WT6vh=0AGLBfM^
zH+X^>wXEO$5|k}p{DBlap!Sv}1499*-~n~`e>~gKFwvfY<pqdVXJ7!OTZ@+r5iB4H
zaKR5MSU?3ov;+bvfF<@?hd+>VAEX9a_{=^DDSSYq6rfVg`~O!-XxNFowB9j2Uy;cV
zUXO9dfroD(hrK1*A7WSrD$PL?=`ZRabz04AWpKL?wEO|I6w!lm7q}$`iUwF1fHH#z
z<1R??V+U!R{M6df(0psUo)VKfXmAbWYH)Riqg(~a<MI{gx_D5rTI(KMQQgI$RNr8$
zQ|oD~1J=XI0J=+sr~ZJe4#c;gcS3z@0&?Pu&K(s7pcX;>10S6ldC+P*1`mrC25wM`
zyZR}Ef(PR+aD@S?dqFiAXi9N<!yG16_Jsdmz5oBe09pYjJH1zdiNovR{~w?gAmAji
z2ohB2#TzK8yuJ@g3Om8Y*^3(FYJVqqu<>Q=j_LE2nWR9u0OYTUT99Z54ZVQ);PL?y
zql_RvxO{-{nLvD$Scg_G-v2+9LjA4t(q>16B?AMCr6+?{&5IBn&`?grbI@`2))hbF
z83Z~t83bqAGjL2dQDHLR2ekk}Aq7hCuV3z%UarEV&bFh&gK>xE^d%}x+KgwXUr=H4
z(%jJjn$H8Pd<kZEKpI92jG&bqpj-@+d#Sl&y0a?Ney+|8i=<8s55|iVxAUkm`7nYr
z6llB<w7$c!i6I248g#cUDF3Q}hKyfoG6aBHvJOrEzx;m15CCcjg9>j@=LMu5#Q*(r
z#{`%dC}Y7e$R8lKMN+554@QOw9*pO~ZI>5}44?((s>?vVBV;H4Q2aj;$=MS?CFOJ*
z4W>5EPKO_i3=JNP=ck|6U@C`m&rSE%WLnPISpo6c+3mkInammC{4>+7wVA$ic6LCd
zPfxejVbZPdbYWly1uZCFfxO<y!oU>j#lBC63p7&BprXSC+GWC!1M(W^HbQi-fxK17
z!O#Hm66lTr@Bcpqf7CO8w$(6#yav(-(gUjBK*8kw|HsE4^$Z3evtBSV=z_-28jux$
z3<MeG{r|_wANAm+h;W0Z3xJM&U9gamW4ehhlL8MYGk^>Qh3oVQx0xlTSLibFiTOhM
z_ln?CpFx@hKnkZH@MM&jK4CW_%XAA}CK+6s{lHT*7PvJ>)HCtdFX^;rNY&v49YD<>
z0b0=q@(<V>$?RJ|PHK#2NB|Z2ptTtwFM*Cb{(X?40X#=?p8=Ev7IfNy4%lX34Ao@c
z2impc*u<by!}Y?!`W^#^W8?oPFBrimJXgFv$j|@^KhWxMkXONDc^04>JwQvJk9-EV
zoxT76od~iNwsZpOC<bIl!IKv=VtgDF>5fedC1@UMK=%;H6QFo`QO}^ElL)?52y{j9
zcik8D3<jWd>evLjVfec&DAu8_-2-tgWI!HC9K04Alrlgaa;y$yoc>IoX%81HEgvtO
zzQ%wlT(A;knfL#nphMZ2y#MERf(B|-rdt>?Ijc^zRcK(dXk=*mQO}@Yv5=u4Q4_Q=
zi2YciCI`b$6;N&ZgLnD@L#ANHozuS<GAUcOf}97_1v-oaRhJM{*Y{j#$pu=k4qCqX
z0DK#2Jyd5mRA&=tK&?^}WFIF?ryxkDW7Gc?iw`oigr8)w)8XU<E!UaxyOH4lc&ovk
zV|KqC88-Y*WY|$Z$GakY7K<IIKJxyb2QG_iszFnPjG(5p0?0m4E2JKDJ9;BSefQ>r
z3==_?ZggbmpQy;t?fw7TLXd?HO$-{~iC*w<Y#zAD{MwOW!|Ozb9j_Z14tW3n4<0D%
zRAgue8EDDCzzOz5BSSZ6G;E?HL%*dXL+?gLhVEL0a2@ae-#kI)IyU`Z^IMT&1!$()
zBB7ok#d^;F@7A{&IIR^xp_>iv&xLn_d<kktF@Wy<o&XAC7zUkg-)PT}&>6|V1lqQ?
zF`fam7V!+IEiloZAt8Jvn_c)`HoN-H2Lbi>UWtTvvDiT}5rapk9Rp+cJ_ZK;P6ieo
zP6k$osCoalblNencE&NV)!+PF(J9Bk9;(?O7wY8z-tq#P)0=3|kOJBU2y+0aRt1HO
z_y1gQt@>J#VFf5;z=<6mI{&8on=pxUbuO?->J0E;JiK;#feDj>8u)a~Oa_aZdMObP
z#+BeUHOM!h;DqNa_UXq=n5<-M4jg6xFP3g#V5vC9pa5Db3OP?PbK-OvQzkRN0`TnS
zi+Y9)pp78j|8pSx`3wx8St?Lb`l6m;g~bA<4DbI1;2!UbdIkoI1`t07%m+6K8bHyR
z*E@ZIDU;1~nLZ}&SVhMsCLU031w|D&Z7pOt0ZLy#7#Ti**8SA%)UK$xWnA&njzQpc
zCWFH3-wYC<DQL$gh8-{M88|>S+)rx;2}jV**aZv<puQ`}E)T}#lG6i%nPjF%m@ygG
z-_QWhATTz(U}X3J3P_L|P+)?S*+PaB7K#iHKm`G;ivubae_DeIiT~g!Mo^?!BnU8o
z@`CsOEU^DU1<8+Uh7F+UXU8UnC!hgaQ26{>$k6fYAj5=Tpj{J;3=6Ct*Yh6$)mh&E
zbHQU(Aj3dc%KxZl*ilm<U14>oa|h^{J<E88gj$;)0haO%1vOeb9BMTWiTtz&tqEmt
z_$kjIQ5zpzQT&pD|JQzyhyP!xJG{BVgYf`(EjBK_pmn}4)2$gKtp6|wfI`c$iRsQu
zYX*hiFBv#Mp=mvbzu@<528CA(89H7aWSH>kA;XN<pu!xS`ToU#91Fv+(1V9uBg28$
z3mHy;LJkyy(?6IqNkBRbEEY@((={xZ3|PGX|Ff80VZkI{FYzmpq2gB~Lqo{R#<)-~
z3j<I{fkG4(QXyYi>_Yys*u9o!U}(6<kWpW?dQzhtL(Z%J3<kBD#ucF)Y;~Zl0@@{J
z8UO!7qGkX?twN}dRW$=+T?zY^swrwuAUE1)fCq(YYQQB@3#g!|YpGuhnvI&^{XZK#
zM^o3j7}6Rqldb@b8h9`+0T*NSu9v~$piYwq;}Y;}ILH7{UIdAG|IY@OQaaKM48QI(
zSp1&PpfIVP!RNO<gT~}|29F>03=W_{B8Nssm+A}#1?#>4|6AHH2v~405cvSQq6ie4
z(>GW$De-O+sX1V)WAXC;k6N!))9+g{N!4p^5&=yr**Y*VPn2Qcm?;1MkEQ(oABkR!
zjCBWGbu8uof2mb))oHY2NCB<!b8KP=uytVI1hE~O7;G#p7+C5a`06yq|Nj8GEIibU
zX~M+#{~ul@GE}^3WN5%1%YQ%@k%MkIzf&Lf@_=2?ODDOYmu_|wEf^RkS}-U~v|w<U
zXu*&GDxH4+25m(B3*UTX(bQ{Tk<|IYgK;l-bt}kH6w6SO)9(j$CqXM=|0B-JL|Q4B
z06Nza+Q0)H7MkeT#83cQP6J7|3@J4nOv`>BWS9V29r#j{LE!aC28EY)4B%TRK?}1%
zX&U4J$aZ6f2v7&{_df;&P;R$az@YHco`K`1J*Z@2VDMmE1YSS_o*6y}Zr3ieP@LYh
zomr^<_df;+m^ltj|2Kf<-a)%Q6EztbU+-sNXpCh@f!t)yAYrS(zzJpZfW~sX|NjRa
z_gVp(yKl7r|KasK28P%53<jy13=R|R|9=2gNFaAL>}T+JF`q%>MLk&j$3*-8Unbgv
zMrkwa!K-^3_A~grn9rc_qMpH`VyW5_@Bf+L0jGxf3_hS5u%ZPdmI@x_2019#lYv=>
zlaUd$?g+_I60eb_y}kecdjd*+mNpD5^$ET@XmZeXaefR8;h6{Qf-{}uf-~LhK!^BF
zv|&(~Xv5$z(FU9hHo)r;R!D;hR9-^Gz*KDmgBmEdKug%BZ?IvK;rRty)OPUyhUsT)
zm?Xt#C|7`Hx$7%$S6Dq@V0_&Ss+bcEr~k2G(l*Tr>2%){GWUR8z+5Le(0bp1xo&o#
z)yp0X4B)NS4)Z{J;1j^BLTltei;Ni^rpMSa$<%|&Wsq)=PW?^>28ho8dm3#RT0kZ_
zHvKOEH6<p-FtmVTL(h_d!EqA9noyMkc7ZBRa)BytcA!fn>vt&x)UQ-4sj>E8aA;(x
zsTN~UsNcIu6qG8h8bHg3{{IK*Z?t7#DAZ#3P-*&H$)SlcUc^$Cfg@3q36xAYY8qU0
zCe3Bwm}twu08*^q#lQeE7-T8PaFBs@yFC~j=P~FwPGZn-m<rkz@_z*=mXNVUQkQ`T
z<Ia-_4AbT8m@ExzJQx_@%kiq0Feq3(U|_IF>f-QV+zH;I37UYdd(6J2v5|oTG>A8S
zf-|#(0BGqQcm)7-pXc-odzmGsD=;!~)PpWbsah!quI@miQ<h$j3oMelJZic;v^*Gh
zfQO4UL>ZVt-gRjFcckts!v*jE|Mr06n}LD3fd`TlV6Fy5Kd5{EL-BuLqcVd4sMp}o
z#LNSli3A-?Q1ddapjMM{%5O)81`STedIr!cx0?Uf70u2J5{`|`TR?3K(4onY<p<0x
zppy?k^?S{3ZE%4N-j)lU>a<uOzyR8#;K4W-a=N%DgGv4K-<6@7H|uIO87_osGDz5J
zeh_hNV(tl5K41qrWI0gTNiI;?&91)lafJs1sMKx=5~+D*5jZjP|Cb4w|38GZ9<T!~
z@v{EUz!=c#Bp1-?W*5qGz%G!*Np8Z*|9=8m-0UWFf^KML$O%7vz)pL)0E49_gFx_U
zCppkHP!{w4{|6ndTPx!MzG5o)w40s7Tm}wH2LXm!X(thfrvDQ_=7H>-P`~p3ACRRW
z!$Hjpn8hH+z$|iT`adT;`G8$;vXfkJvYTC_ErWz50|#utlEacg0K8Cq!CeM9kQt4!
z|9>p_%OKOJ%8=8rlp!PJSYuqsbK8PYFUGzJbN_#tSo{A^t(SB~Er)gmSEwdi-Ne}c
zKP+RX$2l@d>)ZbS@KTn6;bkm?L8vCvgoz-&27|zBP6mb75eyvGRty@T1Rd&jz^-2P
zbj9>Fj!b6tG2o3~)`!8%MO9!)0Yo?2{{PV!`~OR*CKDH^wgTM}?EOCmT$O_JFX*^n
z29`DT&wf{cdJW(~Qt&dhUpqmKCy-r@w*NnX%TZfMISLX3wOm2=gZ6D%OpkS9k{9W;
z{r>}W%rR&Qb4@+N1<(vIc=lJIBANdI^0w#c3uZG)3MX|Xcrb1SS6`q`9%w%_NJ0X9
z?mWot7EQe#7D-(jJQ%lv2WVkCY(c7DFJzbjI#~j?z}X_H>x2j6R#5OWSla&o0MZY_
zwG2KwmbU-@K+U>Q^8n2MQgZ-I{{Zdo_h8%#UULQtt58j*OrD9h|9^lysU!dYk3-Xc
zmKU|4GV(3B{o?)q-xrX<praHllDZl^7`K3j1Hg`32stPQ>M(dg0ZKfeqz_9#pgCdh
z|9^ErTZ1K7K!x`78ylGv>kt0_FtL$=15_9Pf-O`=D!;*lxr+Z8EmauUKyhP{z+eE%
zr8PUWE9x5jbh?*-oEZZilZLd484N&^7~cOA!2MW@1q=q@oLnVc0UEgr-+S_3*lZR%
z55}3`sYDe}dkm_PqdFYa3{L<r<FX8A5U8mHHR_n&OrPVzWY2#E)DN@x#~@(kz`$gc
zF#VkiQ?vL=28Gw93>;Rs85BUF2TG!KM>m6$sO<Emu1u0@5s-Ac7@SVQ9ZXPAf-p2~
z?(zN~Q91pAE9eYrP|D;C0FA880I2}spAQ)-ekn3^{9<HiuxRQ{ut@3#-|b~(^Z&o~
z0tOBb#!cYmiXgR?kGd@^lDaiK7&n2ZpE@QoFj@&RFxEb<t^hR-tqd8MJQz2=1*z?r
z01@|K+z77O%=i8`{qNB9AGD^6!6IpOh6m$Da4f%k$WZZ$k)Z*!ZKcj_as{Z>TDN$0
z1*qfa{r{Wd^aXBAicCj0Pe1I&WD*OWm2#NG$N*aE0}6eJvN-UDYETSVG%y%=|BnLm
zEfg6UYHArSz-kUqrg=qhDR+lElX|@gDAK}OV0)Hg!C_FmlHtE4gTUvSV$hOYh6o*F
z1_q0N3<?(485A6v7-B#v0o1^@jAM|PFpoiI!afF(iE`i=Wv)38s^k6t&zrDT7Q1?u
z!xeSOvn#y+$AY)xdH??h&s`uhEg6hBKEn(K_5UrS|Njq5Jzy7<>Lgd|HA^Ja1;lo<
z3v_Xk3v_X_1C3%%U$CD^7IbHfn5CjcQn!N#<9hJeyF~)1vl<C*iGhY%9h+ExfL6+a
znv+lmANXm<py9zdW#jZc9!yG15x&zOcrb}O9w?|`_zyY|1vGpCic^cE?gkIW_251@
zqF)>VZp?vOrr>^YG`OD(>P1a<2v$%41th2g{TtLFW@K0Z?;t0FmXk(@PA~Cf(vk}W
zH(@RIGKhfExy^z9|3Sqes3=T0_W%F%9iB`EknY$MPbMp|P;efCEeo(n>fYhOxc29C
z6E7xX8}LpSP|FG2eW?Y-6iW=)wF?-*iz;5%G8lL;P6AJwS}XvslVz}|{r|y(ankg~
zUQBx!bEYSFGbt$rgL_^U`xs0hPP(s$a8iXjXnbM%0&gaB#s|}Hcr&>(c1~CDVR8XC
zIzVA%eUBl;`+pF)Bc>zEz)-!LLBU$7hrybuM*_4C)3J%M2G+OsU|@ic*o1T*unXvP
zk_+f`vnvIkaL*u7(!vN@RnY?Kw0SVD2AAB^1(q<0cz`MfSlbfRIxJtsAP~Ntc~1CV
z<|v0I#uqx`;4z^iAQw0^G3?Qi0rPj5SO5QS9mT+CeUE{~v5Dah*tF>mzDz9BIsBN^
z*dSMQgGD_YoBpSG|Gy4yi-8tAf{HOv3kS3_<EJv{WPr!u#046x0?oyN#6gRe)2D%E
z<5z)~g4NyGTrquyFOw!elEn^9|8=GdG&3o%Kog51|Kisb>2nx_JQyUw1<dpqe<n4#
z|KQy-pg;v-i=^%d55|>{N=}jC!DNSEnR=T8|G$9}3Mf{*|NqsnIk24x!u|s;=`51E
zFL*GngeIH6E}*_UsL$^G{~FjLu)jhW6lzMPD?sk9Ygt?Y@!KPC{Rj1%4afl?Ig6wo
z2@l2<;E6pQaRwhyky--lmV!L%{r?~MJS30?5C)ZK9t`3z4Ga!V|F3`|1>{@M9(N?Y
z)1&>FG(>$svW`vvPrzhADna3)&M5#Bn!d)LN!{=PwB5=GYqx?bJ4jAv1Ya5m+LI01
zr4GtXpiby?o&Y8@t{pQVojt~sX#q?s(+dKaMC;@Ke|c%oU;&!126fCV?*IQ$%MhZ|
z7|-Cd;pvVUH3v*|YB?POKr^Z##~7??+0{xwy9a6(JBfhSF@x?ms8#k7sbvqoRO=CV
zsn*LPpwdU3qvmjuNR65Y=mOLe3+)-?Udl6Qy!g-H06I+rbPP_dhld_${d0Y-rj-bE
z=+VLgbm3*(|NqLM6ER*gFRRT660vy2z-Z~kz*NKiVO?#8mB<XP|Nm>VKdhUX4!LyJ
zl0oDHs6$lCoTz8X#=rs^V3_E}z_Bo%K@Q~TS}iXTOE(4{&``@udj^G<@eCFqhlAEj
zglZi~v;%E+2koVu=*qwW%JmcD|9=4uQ-Y>4kVn*DY*4!iB!|*#WP&WDvq@rLu}FRl
zyNzX{_y4PBr)^=>m~Iiol*H7var%ROpq-tnOf1uP1To1mb(Kyo$W*8YHAz4VEJ3jd
znqPKoV%z}gfq)ii{{}6ipAEj{ZUg9~k=LCJ3a|e#Xg~)NSHK4nZ5T8hn;1GkLj|BR
z9#lAcFm{5QF`zE{@BIu6pdo}#YX)Y}Jjg_Q27yLfhKz~!4D})ltr=K0+B3*?S~D<(
zYM%Tz(Vjs9!e+PIXwM)69%q1d#i8S63qTft7gk_7@#Cirs76L)V({qWL52z5|9!zF
zEV!($VTb^=s~np^!><hj44_)W`+oqqy0?sDIAF=ZAn>DxApzu@A9V}~mUavcpdqNA
zaSR?9d+DA_iTqf};PK-GgU62-3<;JR3=Oq$9sxf(89XdG85(N6q(m%MG90it$>>n?
z&mrKaCqsf0!~ZicZ5TAH6aO(dKu2j@UfM7ifJS0KL2P}G|G@7%3<jY6jNbqM%|Q+Y
zkQgW=Kp7o`K@C&y|Nq|n{sTG)?*9pR1_h5XOy3s5q`<pl4ru%xbbQ=ItsT=JhcGqR
zf}`g}JwpU&?A80fH-tZ*K>^f%gpN&nSS(<0@c!=)uD!r{v;oBTK0AFuD3i1xcvSWU
zXaWx+ym0!NP$p?b@YEb=_yuY*m=B6Giw1@a@BhAEr*nicS#kBRut@4H@L*iHak@_!
zla3Uq8b*|=|7O7b!8CnR7*h_DJMXk`CQ0^r3^v~X-QG@D2xn3OA50U{;<iP<1$-ON
ziRl61OgiA>^`;-#%P2B^MmUo|Jt)h7XP`Kkmw~blszpd+YS3*Z;Pn6S{|{&{+z`<V
zXX*f*MECn3!-1NA))k4G4h%Ky9t@6+OfO(-_Cf27YOWerfY$Sa*Y7Jb)Pv3dS^!%3
z|9c_Bj^B+88$g?^KtniIM;R2XmoPNc%vP?jXJBM#RA!KP>CC`TYsp~pQj0+#-124}
zDAQ$IGBAc)I_SYO80fNE#ujjQ#?n-Pq52eqf~7PA59oNLTCY_ibqic|YBU2F92yu@
zEFOT)8+^&U%#s6ALRo4GFn}bT92jF98~(ouKiME>8O^{^t9iO2RkML1QIn?uRASjG
zFfvqXGVuMhhK#^in*YCGvHkx6(D8AN<_sbW#Tn!lhBL^7Y9^?KazN%}Ui@KjcyXP9
zA>la#Q_TZiorY%&Ikokg))ny4=kWhWK!$@#yO-t+3NK?ABtX+!FfscCMh5TyF5p%b
zv^OjQO5>gO3><};phLeHM7;mIfZMUq-tP;LS&jCf-Pt!l6{8GHtwR%If%Sg|1)CcC
z7Y+_h|JPVQU|@V{!{C5!DX7=v{r}HHP_^sW#Bk%)LWYW02N@c`D+wP&F)2(hiDHtd
zcWC&xrdBf`z*3rlqyFRv&>@Tr;inqpYQ0WZq<S?lBzo~Q)H=B8I5z#8Q+MF5&SYr@
z7VByTg&OM@4)yogw^&_cP^jDbNyM?~Uq`JSXlKPg`2Fo5KY}nQFIyz_PViuy3(hs5
z(I}8JK$m_!e#|I3eNPk<7gzrdi=;jV55~E+(-RgjsZP(0Vq&-O{{Mdgk`Ws`80UcN
z|JMgWEpo_tiBRKjcreZZ-wE#h|KEh^3JaM;rgJQ1l2$adNa~aDV4MTa*A@w&%<2XS
zYVc)HEO(~2L^CNdHBOzrBAUsK$w_zmhiE2cMw{s(F-+!+7pMEgFe%qdlyovN)XY?_
zaA;!T0hPYq|6RcQ-5|3HEH$9Q7E&^JfP3wrgDydBUGM)cfglgmfbWN9ae$};l{fC-
zjSHZ%2vi`0rhY(uFAv5BaN87gB1JL>1Cy<T1B1l@Jw}F#=L~$H)LV0sdD+A`28mFv
z19lVb7#JqnF>nNOIm!L_#~@&7^Z!pEmz&*momeK_dbb01AQym|EWvJ0a=~t>hc|iu
zcLw+HKozB96SE4E%OD+z1>kd;7(gd=fEHAFFxG>EFgcxp$(Dhk0pv2UgC4xqnJCM^
zGBK7x0-UvM!TZoSrr(HVvgD0t2ml>L2TIQAYSZQ7n7qAP-0eY|ePD$Ps8F$I`2Wvd
z;rD+~NF_`B|6eheT_M@>|9|TP3@)J4c&#2VFj*by=ctxoP^h+KP_TCR_uGSkL1y}v
zIHp)WwbK=_=6<c_h3WF~Oy*4XuG1spnPi#R4o@$SXVP+?3K}=C1CLvJ|33;|ISgvB
zf;RX}dd!dk@+73OdJ)`62Z@6hY9`;VfD98eM0hZ;r%rzn&lKnko@$#8?vs1}|5pL?
ziA4hgKgc)U|Np7j960|UQSSeSp4HiB;K4W@+|r+}kiaA{eL?~gTYX=I2jg_`K&AKp
zzu>W6i=@6A9*on$&3;ff0MtPTB@|d80!k<r;M&OnT&RF1-a$iTpn*^C|1RKY1?7K8
zf^-1$z5oC90R^u`Qr`j(#_8Y=ruYB<ClcxzKx4&y1s;skz_q3K|G&_s*$j*g+>mw{
zxFH2u%m%AC7#y0IZh$v(fy#c+=?rs}D?pV9sDc31122`q=Sd`h=VmxT!EX<qo`B>8
z<~`8#mQep&5we2}7L1@E1XU{D|DC`NvRJ^709rc=$|fM6doWgm*ONmH-~jp5`@a*o
zItL|4%SZ+VOJ)WRP@IC6HPkwM)v=6Y;7QeN-~%tIuw!7cR2E>UNeI=c)MTlDQlser
zs#SDA&E*<UrQ!vuR6=z?m5P%C1L!_522iB}3O*3Fv|(WD-owC9_rOmFG+I^k_5c5{
z?<{r>O-vq^aSRGp2N)O>Z5bGC85kKXy%;zuIT-jtH68R|712+w|36@LgQdO7{|grT
z{~xGV@YQLwXAoH^&mgxj9<2uYF@0SUlYV^!YQ5t9-x|Cd2DEP0ZUG|$bT^C+$c-Qj
z%5>iUt-(=UBMX`pVK9KyDJwwxLR1iS%KsbQ|E<8Au0VAQNUcM|{~I7PAcbpxfd}K1
zt>7Whmlg~TFVP$VN~7NYKf6NfnlGTV2wJgVu>iEv#u1!R>Ynbd0L_|$=Bd5^JDvm?
zUaiak8rw(!rEl;5j*zr`7<_bGg7<%0FdwPjV%#zvUU5w~$Y<si2TybKTX--|20I>B
zu}pvPm{Fu2=2B1%iCi5+T>B{$<XVTO|KO?^<QlM7oBA(6s-el?!AaP-Do7rb-oPDm
z=gSpgTN~uO|J#EX`CD2tIDkf)K+zq(%0aJI!B)rOA49zkD3R5z3a+S0umvTwCllou
zRBD-biPUI#Fo5b-i+>CnHD%HjkUG{@$DxtI0F(wT;}~?Xrb7)-v+VyHkYhmDG7eOa
zAf{hIVqi}s^+$LxN=*Wf4Zdb%nDE+>VF75{9i-O$cL7v8N=SfOgpdx_lK^O|aH9AB
zL$=csQkjbDPgHugflf!}aBO0DgEWQM09womYH)&V0~rB2p#{VS4Tyn8?kqstJ`xyM
zLG!ZKkNO`>RAlJz{`VNXY7^96_FyaqkA8tJH3SVggYRzt_ZZxd0rv<VGR&}0tY=sN
z>JGpx0$BjUXcn?yS~$T0G?E8W3&LpXnXss5@c#cl0i+g$;p*iXz(*S}W6=OU$!z)p
zK_<!ihyQ<ohP**b(Hfc=QYt#zlr$h~>moEb88|`5P=S^Ufp&3#Oa|EinoP7vngE)%
zp5Vba0bDkNR+xcSl_9t1L25x_pdbT@d;k9@0y3kZlL6F71I5^cddDUP@Z>wx&<GF4
z3E<rrxD53Ee;k}-AxWPBJ||<*G+~ED(u4{R#tGoo3+OyCumci6%aF{#^D;0qVGgR{
zVD??+{r_(Ryi3E#z+kh8VHs#uJLoKePSqU?I$rHqXvwi-L8um+oy92z#u_#Y2Hz$I
zg<3E6EuhX@Ek}^ZOw}C=W@IpMOb_s66sfmWVps+`e;0I85U3vyS{VFNbLR?h6{Pq-
z5mc%}I+u(dAhj<wcW!|4Ejq0k7z#BRlt9x-AXjv1?c5Qn$^L7m*3KQ)yBQck>#(h7
zGqBh12klhfvA~0Yfv3j)0cgXyPOm%zqov0G`v0MtY@qE;$&QWxUsyUYu-PgxEDL34
zv#a%FUS@G}=K)aXzt+uT9q2v=$EN>BK;Cd-`2WFD<NrC3H#N8z6dfBGb!?sf|Ets#
zU1909Z%VC}*DBBeNv$TRv&N#p0J@r!fsuy+1J{EEYZw@K{xC3bFJWNd319$?qcCu4
zFfefbVPN38z`(%R!@$7&hJk_Q00RT-6b1&i42VJOHc;A!fr0%80|W041_r(q1_pis
z1_u5q3=9Ge3=B+97#Nr{7#Nrm7#MiLtqo8_gW}85Y08U)a8SBen$qyoW9JG`5dPHK
zxxxGYzcnC5Fl>E~Q63aB9d{WRE&ehvntJ{JXDP?P2-^Jw+7&b7-v9p{&lwnJykKB-
zX!?H#RANlu;LI#By<i$6OMPb?BWN&$q0kGo$&r6ep%!R}oc~Xu8iSHU6aSh*O$I@S
zCIJ&2E(QmOrhnkAjy2EOw^%Aok*LYESO+`W-LdJP1t>>=&ZY+yHs1gLW`YV3P`Tm#
z{~!4DF_4ox?HDC8H5r&@+A&Ia|NmFd(iz9V(D9FfG1P<2&QgPcv4+!v!LjM@8&J&G
za)6JzkOn1Ii%tf{S~(|?8TS|%YFI27W~=}$oBeyl;uPrkX|THJkP~cnAo*H5FA<9q
z42&~YGH`$rxntAcIToiFn4#twhMa_|ldE?Uu{g=V2r>++u*BjN152$2*g#8!LJW02
zpd)iFy%<<685rt77S4=gV3^4Xs$>5e;P8|LhNtSW`s&XI;(YbzL@g)#7E3P%X3#<j
zR7d<-gWVB-rXV|_9(U0G$sy7aE=Z1WL34x#4o3(;9Z|o<VgUo5`2GEYI7j?GfaC}#
zR7d<?g543ndqOqq+3cW+0-qyNh;)PvQX(_LopyeUz|&a$0tN%z3V*%9oydM&!0xMG
zJD@>JAY^|{0C}n&WP!y320U5kR|avu`sD!k)dB{jEQX$Qeo27rgyx)jw5;><4|ZSu
zd_tVBe(nMJ3S<F(PyL(%@l-uHpW}(EpP*a-D-VouN7YXkkfl&xp?eBPF8C=BTCYh=
z0{lT_F8FZ(;wwU)`Y{6*RrMAN7))^c>PG=?U;PMymgOvvviye&_Ne=zgD2|hk;?KP
zEX2j#_dCS-^7|I3<5@6^=<hQij;%+pc)mB_aV?T#zegZB)*pAp^W6ZcVDdmMn7)g2
z)?=;xzWpK25#O#LIRZ}>{<a1w#Qc$?yB@Xn`__UKWWlJe{gwd<GV~Dp7C@w9HLy6g
zo&jVDYF+(}0m-#^3X-okV5!(*0fQ;BuTVYpbpzB>SgPv!uT!x5>T3;gzWN%1#aCE7
z^;HL}r|RX<i^s2^TmUO@%yIkb%N^Xl`f>ofr@pK}_f$RhX4RJl;(YZ5lnbyltI$35
z#Q-U)ERZ}^kJkM9!hzdYpWk5j)#oedzQXRQ&!Aku1Tr5{H`Fs=iL1{oNO6UdT~HI&
z=NOP-mR<~?0wxfYkP&Ub&ki^otAXO!`cn*yI9v<L1!%6t=Gaf5TmXv#JdXVY%LO3E
z2EiO#4{5P}!jTI;5t$1<5t$1<A?E^+W9uR9b&Oo_i3KTW17NO&IQHWUXvM<_sdzr#
zz#h~e51<4!){w3Tbs|23szV}z`eOl7y1-N5eDpwaJX%}eqYjE=>)}0~k0OL!3v%p-
zH^gPl51^hAEM4GixYRo~eVBvWwI3Q#Tnl&XhYTVe3u+U>LKa&sSr6@>eULz^Cf!iu
z`#p{};d>(6gzxdR3G0zNiSMC}LU8lR45^etE2Q4%;103(0oX(Ay#>|~1C{@v9xI|p
z`(A*!_<i>RDa4#nL+srdOO5~FHiQNzgQR04gU?GlMuAWcHoIC*hjpQxY<7@oly^(&
z;jZ;$vjdfGkY4b+9;go)(F`tmX~)Qc#h@4*=D=FT=;nZj#cQ6k$8NDyn!EvZAmN<=
z>OjI<N5nwF+b{3|F7Vm|=#0q1|1Ur@XW(He$jnHhV-sV>bd_2rEv9w4(*tUm^y=4w
zCo4h2;GoG1(9usGjEUe`5X)GGiWjvE3bqOh8Nnl_3mGbE8Nzfxdp|85I2b?&VsCV0
zDBH-$P~!c6EqEv#G-~JA#J~eG$NT@Ag%$}64c`A%z>_4PQ7Z5%kj$MY9Ge)nfOf`M
zPybrWB(4Lx4+peD1-cQ&0(3Wy^?%4tUC^=%(Bd4>5DjQW!SseOW(n{ZoW%i#2GBXK
zpsBwXD|epo{=We{k<b_m-t>VoAcX2c$g*DV|Nr3!6oE!zK-i*bB7;TJgc}}=)!>N>
z(9$38|Nl$i0n7~EHQ)=szW_YA3JKlD7s(6~ARmGT_q_kF1P`2o#^Qe3Gf04Z4?3&!
zMJC9hDv%S`6dAyKfu~OpWKx+PQO~3%6c1ip0AAYxz6)h#@AL`vOj3e77J>`_jk1Eq
zjyg4WOy6D4q|Eec?equrO!lr0pp&scDnO%TAUAiq?O53Ha>oMj$fhTo9b^EBK>~DA
zCMXrpblb5Iv>2-+gMkCIAsaM8HNC-;QDVA65EIYjfC!H1AN-kE>Y=0Vf{snhF{oh}
z2c8eKRan3VUZAp&p#qdh5;Yk#K{Hz5SuF6y3#-5hqf?Qg3X;8;Qhq_seA@sDZ+ix1
z=HH48JANHxSn%7C;lS@ih7-RV87}-@$Z+HLK?c_czZNpguvbuKwg$}}IWRCJORz8`
zTXHa1A7Eg#Pgu-g-N3>Cn$5C$G*QEYfdPDzVyGtTyFyLyYRVrVi>G@uGN}s|OipAd
z*u0RTWOE}!nfL#df2TJzGU?YBfYR_}MTnI5|CQkFi5B2dWjXL{viE;E@W{UvWc4*D
zbQwTShkCmK<ZU#g!Sn756&V_!uF&xQFAJXjsS%X`UHWtaBnNTjbiF1fK2V2~0c6gm
zgA8Sp8R2dL+Y5CIIB9$Tmjy2j0J#O^1`ziCFAJV*1exv7`0oI2cdY===XZkL#UKFQ
zYH80P@KTdu`tBws?x4lsx#wyZ28G{`88|?TKSA@)kU8fKV5fkxw?h-dn|c@aEuf{@
z^|wA(crccMmx6-=x`y)ugJa`Ak5>yBX1qGcuweQHUnUuc*9RFMSST`l0OexP)*etQ
z2HhnDO3AR<6FiRQoL<t*<j$BleNQu!lGao3#JKnWzu*ZGi=>GX9*m{n@&#%I1I&u)
z20NHUr)w@`;+}5N!equIJ$HIR3zJ%qG<byv<e~@0ibgw=n(+VZ|7zqtK+836fMz5c
zV;OiVUCI`PdY0_dU|~>nY+`IE)MT*L;bc&7Y+?YfzprRvTVRniF~WnfRCM}_7ADR5
zIFo>vb|x7w<xC1dcTm=<r4`g1W1Lc`&i_B;Sb|#3F^_<nW9(aMj)8X4Fi3zb{uyVI
zQLD*d0^0U7(axmi#XbfBi=_+}AV*Z3WKgO(VO$Xcy3j3w!2xt@k3|CmM<5&IQjkD4
z=uL>n*pJm53$73b?Slp_5p-x`FaVuUP`~)~bp3yfssYt68I;2R9<T!m2LE-E1DOO4
zq{jabKuaNCAN>Cz_^%uIP90F3fR;v9?`1z$zc;u7RJMYa{K4W0l;Eb{Xk{|2w`Jf4
zt!r~^f}9^c(az)vXjx0B7n|M0I54{fUTCsloQY5YTA~V>6kz~gsQ^097<2|gV>~!T
z3TSXKFoE_<IyN!XXh06i00plFR8LJkXvrR^aQ*$y!~!(o16t__-Yf~-R_(zU0iS3B
z9b^ph8ECc&l=?uvfo^6rXxPtS;r(9$Tp%~hXRrVr!r=X12FwSU|I;3{Y10I3G3Y?D
z-~UVuy#N2_L!5yETD~?tw4F(vqtl*&$KpQ&%k++RCU?fd=@;6WG^RJKW@MTEqn$}f
zObUD|3CK`TE%Bosw04eR%5;McCOy6|@ZtasIq;DnHq&!Dm?R7;HPxPgPH(Z){Qsfm
zm^Ju3E}I985;dnhwSK%{;DD@m2kj3PVDSDgdvp4R4ki-=(5eO<O_14)Cti9o2!IMK
z9q`?qjC*RK`y7#{uBNXz&#dVA@c$3c7MdT5{|!N_h(YH7fl?c2Mj5oC;dLfM#A_`E
zg=T36j@OY460d(V1bF|K1#g&GXve_zQjUQEv?jNvW_nvElM)LkB&KiZWYSRqEkOwT
z%3`M{%D~_-iQ$Fye+B_ifo;hkpa4<@(luS8i%GFwLc9YcS+na9czXbBWf180G*H?G
zwNF56<Gug?{Q3JgLqPqJ&*1xhz>8p-A6L}cgO10P0k>xyCNW$AO|=`;|Njr$7gCe_
zQvmr`|JRKF4}cmJuND8Fc<uQA0t;xf;q)GFMwt*$kb$H?=>(MGL7@=#gvAb&8@&HR
zuG#3cXOOXsXOOUzXAl5Qk=HE<)u~Bv)v3s0P_mR~5UJJl_yJm$W(i&?!TxW$MmLiJ
zczpuML=X;p%3@c)<aGsPy@3q)hzIZg|7D=rh8eW91*8s!K}!@N5y@onl8Zq=M*|ee
zOgf<XN6;GLm&yzZuTL;2y!2v-040DI`xqn|xj@|`#s*O1(b9pTo*~ie1L&a74K?fm
z433SA0ib&lVT+DI`-VYt<*z##1YW;nU}(%_(0I|wpimqCAi#qA|Nly_hfJ1UpsNc(
z7Bjk7#xMx{^kfj|v|-?}jA7uYIq+1c;uwQc&4W-K%NPchnmJ0~U;yokv5aBhssGQY
zFg?D9NleI@L86jFyrX8RlSrs0hfS?!@bvZ`CS^BaaP4OA1U>YAv2cfV)XodYOMe~b
zF+7-D1=_DA3|@Q$S_$IVz;FkgIu3uX@c#e3ar&DcCIt~t`}nmZLjfovVH=01-&oHm
zQ*V(pF~fr~2XZ(U=;js<=4GJfB`DfKg&{}>Eb1$>)j2>(^!G~!0UHKJ3CryNA0~P-
z=veP(V5ykRpi~<lB~mj#R;Ru;R_6y7XdaYh4JhnD;pYASUk}Jk<m;ASFfyoa067ch
zB+w>o*wrbZli)!bKn|GJ$E04L=-9+61ByFv)Fd*1w`qe8ngGovA`Y1_F#r|(phG_4
zYs0Ng3_!<n!k4ask8}(KZ&w3*=RO0&&v*uo?zs%i;d9vcO`gvnpd-V;+-L`0A1<=c
z7PLHkdQ~u!6zH%D4-Fa6nMI5W;6Q~g3!gqCm`SnT+61%&G6$AO8|4^MV0+IY=fN_8
z+hibl(0U4srpcgs^MnUuHh2wR^L)_WlK&kbc@T!IToeX3DZr&<waEv_i51KjK-mzo
zU`!l5-*4%_AXX3B4*R3p<Ok@`9?%3h=wu3zK`?B|#o%D^ilO1BC-}Iq13$SKIDWih
z@c40(fy2_1!NG~)|AUv-CI<EMA6I~Kjbjt@jhEIY7QZ_|2Tqt6SkK`<@Ow7MlmEaw
zR9^36h|sYGWq^No8si!2B|y<&eV5^d4i^Ih=*$m?CT5oxbqow3*E=>bPqB4i1Re9q
z@S~1F;71*UM5R|V=oWUypK_qXNd*`Zy%-oL+Cg?0{)_`{(eej(JsRy8G%W5hD1grM
zdKt&SQ1ik>2edZ>wN|LdtQIUDd|&{r&uWxskO=RTu-NdQK`vGE14F16hfSg;16!?^
zb49570lPqTC%Hg%H@i+-_-^MVjkSylmRbyqFYbc2>M}6eG;lCjEMQ=$<q9wWt(U6R
zjJyVNFnB|UnwQ7~!<P&!jdBb+Fa9woOz30~u;^sq0G--a%VAwn$<Clu%b==L^HNpE
zQjLM7*1=b2!m{b>CNas>f6M%RAGG4`Z;Pb@0|zKjLAw#G=Ysp36_BuF$^k7{0<GHl
z8OzY{qn4rLM=isIN{;3y6Kz4~w+JvKaxgH0a{f<Qh6NsszTh@?qb<V%i@OXnz~L6l
zP=Phv>akR(3+fr<Dw3TvCe(vk1cKmGY(OmnkpDsFZh8L~0b2k%V+#>xj32;ZZ4V8v
z1sn_wcNrBH{AZ8@g%{|uTTr-%JO?dU_O3{H&R_=$Uq4WQzLaH<sMRz?1gM4=Xi$Zv
z=7FhB!(WCaFYYqTn6Q#Tz+xpNOlzJSS5!O$m9M%wH79jJw`_yMbaDnHOusVzp3k80
zQkJ3P#b1Vs##n|0wdxK57AqJ8EV};xuT*=;WN{3%z(oPHUc2STUWN{kGix=~N;*9l
zcwXFRFtAv`z)`F2d9Btf;0I_Sd8ilrKZ_R(Jc(W`3g9Sru+^#6G!g-AxvA7*P_op3
z#44!4+N=-G%D-nIml2@S4b<`iE&B5Q|9gh@U4{+T4Ge7F|NrcmUNf0VvA&jJNd>40
zyVSVC<^ZEa&2mqzAEzMY=u2CMids#F08mH$_iRwJ>yHWO0u@k$#QXo3nV?kS(DVno
z*>vIu55}}sP`3B}{~NRikP))%@=GB^-CywbV~eDT6FeBxz&BBO|NpH~ztEmRreQvV
zgv|jC(23y;4SN|CUdA#=fL1v|>L%q1&^mk2H4cd!40hmP0PQgHWMHXf2-RtfWmxi3
zmSM((lMDhDpfW{)fd!PqDm@sKY8^~<YB^1HCOl_gsei!0(P+yEiXI7@1sn|E@=D9o
z_!`(i4KI-iFBw=YUNUer#xdx;lw(i;#XLACc{x`=471g#<+RnAaBTXnDNI^9j!ldw
zK!;*Ongon{5KRKc4Zj;13Vt7i9RJyHa_0pdHU>tpNB=WOfSL!dI~WvR-)B&Oc+k4S
zv59d8w3-3mU-pBMVL_u81ILR!pz=yQWqQC=CKVBI*n^L|e=iFPQ^zJok?B2CnUp<2
z35vtw8H2!&e+&|}T52VrmJ(>Z0JIV8^?n8o*e0<0y<Q@qHjf9R7i5VY<o;strHvkp
zo-?QanaX5b|HG1tLExtxg8)2zazWGQDroxTaDb#w4)%W*uNZg|IiTs20hT^Pbt*L&
zlq|JCk>slbN}sPA!51xqRtHW1bwxoPfg0$Ma^U0OK=KP2DqbI)zV0qFn=z=n1geaY
z)qzqM2*0?;!0_T9g9NB84_brND94~NQETV)`_q_g7zL)wOlQ)qZ(%=HvsAgFW|^bb
zkC)H{ZO6a>+REVl|KAyCE03`OdU-Htm<}|U1ZvHJ_VR&NmVu6#w7$>40;=&ri{$H%
zey#vDg+YPu(8MT!yp6O_lLNGU^adyzLHc>X8lL_JU8J&L`i1FCGE6$Q(?3mT>QLfT
z1o;7W0szSGpzr`?Q;?r4lGz`CFJy%szQ+LS0D{^@AQ@0-OrNlrQFi*>8BDfJyoS>Y
z<}jH|517fs$^VCOg7pCgZO~e8@BjZ;r)SJ$QWN3>_Yq#yLvCgF{?8>leZfp7F*jH6
z+RqpB8CD=|d^!PHAI=LNr~n_*)d1?+aDw^ZG}XWWs*fzJ_cK^{FuFEQ|1*<GN{tuX
zY(#8*;so<S6$4n$0<c=g={B>Nr0RLW=jDUDP7t%fe2WDP;5)QIJxLEnSMU<U7xVw$
zcv1iV0n|-UfBe4zX@YP<`1AjNcv1iV2Sg1Icp&0M{r?XTH5_2R`Mv-Dt^YG>I5hp6
z@p}5zSxmlBJm3-57d0japb8=UIVJ(te@p`40a9a905up~8NH}634p2x^FfY<Io$de
z=;Tos#_2V)nWQyEDq7qYRCF;Yg|r>83utqa3-vf)7wF+67trQr7w7@nW&s*CaIToX
zXEu|b8aH^*>qU)82gG=GFdx}?4@T$A=>l_@jP$s{7nZ%KF>$bH;9&6n&kp8WBrq6x
z|7QU=$w9@gMT04W_kYft;MBombHJVfRLFb(|1U6o%N!<+dJR?vaKEKypEf9g3j9#~
z@95ab`~q|!^KVCn2{qrXE36$D6n-Z%fDZIq06Lxdw<1Hw?}ZF2K)D38bqjPZZKJZu
z3(&ZtLlbk3yd9$ksQFmG|CGq&y9@@CV;McX|FeDtC3aAb`B4ixn~b@@Qh_0n33RB*
zuY(K)zZn@CX4*1XOpIl)0fjXv(ReUAK@vbMg9E7YhXe{Icwcd+ErZ36S_Tgt@cl*1
zGhWLwIM^yMGw4_|Fj&uFU<~hKxBF?qz%c#HTqa2&cMA*91za`DtUyP(1k`8Vp8kC<
zlTy7ULq;e^lN`vhTCd#|b^pCYEL9m;QoT4BK;vq)ZniqL48A(v|6fUhTn@U~t2X|W
zNWJIficT*E3(yIo4owUk;hr2eAm4(j5L*T{2Ac;QpaW1GK%tPx;lKde2|JOKfu%8)
zVG5{OFySTm-g=JdGv+ag)w6&Pl>nLlqn07U5quD{00XGG1q+CYu?!(IZ5aZ>uN~m4
zz9+BZ!RP?qtNEgqAp#LF?BEbiI;O(_?utMDT>;vZ{nM5q0aOIPj5h(bzgcRvzUtJn
zf7R)<We5PRb*!z24t#;myQz=zuy`?-!Q*8tLqv5HgF;0sgHlKfgIT@TB@yrcFH%9}
zH)!KT(lG-DP_hJtFvt>+9++D1|1WGo>b(EAgZHnzlxI+|bYNh%v}DkzZedWUsgtgl
z=**B&YwsoUlbJ!FzB7t}|93J2$K+;)lAp>95fhyma(>i;Hgiq}k6A-TI~hR^i+EAX
zkN^r5@Bi%JvIrak;PQhR%&)(HO60{nh75Sttpn}L1(jXwkPxe5$bcjxW-!0*@oq=Z
z=mogY@nEzE7ee*_Pl<pmc`={C;YB^@yeM{XKL>Q?7F08s|LPz^!K;T171KY+Gs$p(
z>L?3Eh6B?dY+;tL0A&Je2L^Bw03{7XMqmP$G0^CCaA^8717rs5;M3_F7BGovO;Ye+
zj0ErQ^8OF$lR?^AC%}XKFnd9@1=wy0P|vo$<8g)e|34Q%b>T!!NJD4(0V^hvdeCSS
z=#Xj9VrkH#=$cu|72t~_8~;B5Rd1kb3N+{hs;NN7F1_B(!0_6dfx}`i1N@r%kU4C2
zj!g_4)(s5*LFz$jE%q`9AgV#8KgiW!sAdav9*?p95BSKXhYTw~txr%XP^l@r0%i!f
zC9?E2QhmxG5Ypmqr^5p3=`w+W6?ADk3+QYqkY%7vK@Lrf4?;TI>>Zl^@6eG4^#K_t
z)Y?B1v5f!!-%|7c{~9h22Zshm7f>B+{ojwl-hKfCla>?%Gw53K>i;S)lJ_z&g08oz
z|M^SAgMq;S+2xLtm{e*tUsyn{9cIumpY#7eXkrXBCg#}0@M8LuMNB#@4oyrP(@!j7
zQmX$8xwkF(Hu(5I(8Y1!{&fNa*x4W_gW}rWf#HKg6N5;|tOIrdvz+7tX1UpgM+J$2
zv+n^FP&=6c)KT&N|0K0xx5*P7R*<*;yHp=zP^fliP^ef6J*6`Fb_L8e-v57Qn%B<(
zT{Qn6JZA|CTM!1_Uju4JAfH(TN-UruIM6T~sJR6iYI~jd|Hf<3b?6KKzW|N8!3JB<
z^fBPmr-G~zWH|_1Dlq)_{{Qz5hz-Ki4|p?)@%?=f(!yp}!*YSaq3Q1(uvq=yBLyx0
zLHs?|e;E*w{q#3HL4Z;msE`er(`JV)WUU`C{C8;jTN5%LbTrG~5|Dj`noP_(oJ`CP
zO@Be7;h>%{=u#$7^|c~V6Lh20U-0Zff+7QW9+3fcPxRj(&{iRH1N(HQrA#VXlL9;#
zL&3uVFYQ2^)l3;GHQ7~u+A%PA|N9RfK&b)m5oJF!Jzy!57?YLi^o*rUTSQ*hg9m=W
zN#XZ>1_|pu3@p=4mN6-FYJyUQV-u4DC>+FfHIS1aqz%a=0?#9@kKw`L(8QKAeaSK=
zmFY*8F}X4QnmC<jIg@Aje+F><|Dqn+l==4u%zv%OQ1N0uQd6cL)|6oYAC~f>9@>=o
z_Xo^}HDfI5O#(a^%^yzRu$)O+a{<xKm=DXD^wj=?E3_B&&}PiP-(Wth2?(leJs8bB
zr@O3RG7|a^9^ijb4{gT$`|Uc-lTn1jB5BeA55~Zq)0eDZGEuNq`2QaiZJ_$q`~P19
zRQ{hA(|@dBGOkw$X)*t&!@|HYVZO-=hb9&Yiv$h^?|;8IK`8<h+CS<|92}eedsu+F
zeV~*0?tspwF#}JjfnBfwG=>k-^A|if^`qXzqb5zd0#ut}n+5`P13=S2paJ?ot$HUp
z^tm8V=C|Gt3I+xykoUd+-|GcA#IfmL1?c=b>lpCi-=NgN0Xm5Zq#h)1ae%=dl;kVg
z+!nmFH(61s$(B;9W{le*u9qtU&Doql4H*v5R1!9afEpv-|9*hS<w2JGs5c34Z2B8A
zJ!BP=QN0Pci40B-;7|}?@c#D)95<lG1W4~sdy@k1e?P#p=}`R#9Gm{E0GD750t~+u
z87jR0{Q+OG0&2Xx*l%*+#eI{4AN3|DCfb`^z!i$%&=bcon>Jl!HIq-hwKanUG%s*~
z4sAmUCw@pcxhuT1Hz}ypWP5@)oK#O&AR-J$d|87}b_c}?3)HUZ_g6D{)>~JDk8}q~
zaDYylLvjRiWSt-wS*f=PIsz0{h+h7yqdLkAx(tp@zalIe7??o~FYo_f7J{$%t$|!C
z<o*B4#G2&C6`;0~W797K(7AQuy6~&BQH!^qQ$RVwB56{F2cs|e#2pJoh7F*jeWq)y
zW#W^XG{J+>7u@pp{{Pzo(P{YAGCg1|lVLPy3-3JT3Q(^YG(QDu|AP|&v>NmNfAeQU
zy~z`ZTNpGdQW+HL+aFheu5<%U7D3$qp0y?uGUJ-5%)kig@G>Y&H#oqgF+D+ri3NGn
z;RfjPhl$?*tM5*CSjXhXxN~~@IwqrfC5B}-4;YvyA7rQjT_)e?x${oNbMUw>gC!%w
zgpgzwwV#R%9iRglKxxvVk)dEBBSXVPMTV9i4;e}(I)ZLi)dBBx>uzM2&}hH&hCKrV
zGw5n5>xBRRt^YAFRZBEKvA)M306HntdhgB~$r21q)`|=htQ{B_S;DJX)TZ04XEL;B
zWGI>ZkfCO>B16MuM}`*AsvPhCI^cF<ry|3I`p!oppaUUm<bHq-W7q(iC9iHirUaS*
zu1S6*GCg4vlgRV~>zT}wcHRK>q#T<V!B>NUR%6&ZFffBxV;p3709&;ITCD+IrSXvA
z#ScbC2GB|k(5|)WsOBf2tKUIwEzqIm*7tVaNRDD)vQA`}V9mh57(RzZZF<B8CRuSu
zsEZRB8YVNsT&$fsy=McHB}j52BSXz(R7uh4cQ!Ej3WIbeGBiwj2-Bstb-K+)rnSt8
z|8Gp6aF$uz@+0W7NYJfL-~&PSYFB_xEwH}LAn*PE@7ZSaoi{*p3Euzz9t=OpU{;fS
zBA|vD)MR4_nC`NPNpt$d%goC4jpjQ++r}T%&w5<(E0JNvuSSLqzZQbms2rI6kYR$Q
z=l}mTHUSQfjgYG>zzLxdo)8|8o)9#^Jt&a9mN5+VOqQDe|ApUsXjkdMps*Qq)~|*K
z$g%*?0w0?L49pW9p_Xy(d{A)=lIkoTBBi=x3`~{^3{0R@H{l^e!;gauB@-DL3P7pP
z`@aUbA7IzOzzn)v+Umjo|5a0(pIApRuz;h^vVP|cs{{syq$vzcRtp&>SRG(s4ExTa
z2FkiH460MA|AB5$(EwLswNbxBK$d}uY*1pWd%PPoWT{YN2M*kVMoR{Un!g{`f!fG3
z9x_a*0ek5Go<>Us4v=R+X8lTJ==jyhP%^20Aw$EYgRmG@2XD;=S?Iy24jz`kXPINe
z{~7ho>|3n=Ffe-m|0N3wvFcY03NsQJCNyg9ya94RjTTa9g7WY~XlQ!w1V^0#s3U_f
z6T>nvBskS=r*GK8B%uM?vkhwIzjkDJ@Vf%Es)|wI_Y4N`aum=l@~;{H9{{z1r%$-d
zEHinIAEz7YQPK<`w@%31c?V2)?tB2ISMIz4qJNy+`2y5PhBgnu6iB?$bLVvbtxR%3
zPLT2l6anD!$O}>)fd-jDWf-VD0!<Nv%A<*j3^gF{!OEo{2N^oRUILX*j<8gsHhuqA
zCgaqdH$W$9)hGuz%xGjd;n)Z{)EYG82}<=y)`5c#WF6G_6CmS3)`5nSK~|s_e;_A;
z(v0_i)#>5enA90}POslawokxm9b^rrPgJJA-^OH|2KLE6kWV&{?h_{Be4-LLJz^V^
z8spCC>$j8b6&6saVE2mhbom`HulxadWdiA5VIj^d%9=2*+}}aAS2%EcMQOVKPFVW-
z0rJWZ(!Ih#oL3a5Ki|ouuDSC@4JY`72@_EA?bO=&0aV>NG%=`HD*XQsS~xjVYv+d-
z89S$&?_#oM+W7&z+nWQ_mj^AEnLc3`lTp1Lc+mi;g#oHa92yxW6l5|m{$9vf@%tcS
z!|#WT9o7dK@<Ah%){Fmxj@8ttvEv2}^nj-+d+Hbpy#GxAH*f3rzpezGeGV#9JL(u1
zt@kl7LMFHw7_9$;yZ%hx|0aO@cpbG+IpqdW$8Q378sGdsxC4IT^+Lvq*9RFJUO!~)
zuux>2F#W=FMv>_uDog_40T@s*@oVA#6`%nZP!R|^{17zg@<Z|8MNj}ZHZewk{P^=B
z!-`*!dj7?4M@EL<iHsb-8yN+DFfuy)e#oft3$!|uk>SHHMTQ-}4>BtJVr1CxE0N*E
zFVJdDMTQ@CP7KSyO_)Or%j}dGmRSYuWc?0m!%SD$!z3kyXul{4F|b$}?))*`XAhGh
zBjfbCJxnrU^56mO?uQH$>KC(b3IES#=l%cV!RZ_JFv)W^I8I{t^MaAlVe%OV$?3fN
znRq6DbP$=&yO)W*9u#$;dw)PDFaF-j!0^))T=E)#Mh-xWeLzzewUZbXY9}%(zy=H&
z?HE`<g(Rrv0bO2T>A=AB8`O+aWN7%w$j|{wv=bc}T0kWfs5w<{54t8;4t(m)Vn>Dv
zAbH10jBj+L7{E8q*f{nv%$UArFOy__l!96P-b*4ivY?yv{&jf&|IY)ea;jH>4g_Lg
zfL1*b)(;`3fLsE)IsxPwkV_^nWT=_^kf8yzL;z$v$Tc7rfXdQDF9s%1jq}qHwA@-2
zyp#;oz^mb0z~IotsN>khFh?8I0ITz#Tw(oyfv3LUl?Z5|mDK}C;|r9~K)BJ4fuUBq
zYI^=YCbeuvaLWMPdPKCUWWl46osJ9>=K3=*LetqAiv<ikbt$te>Xf@HJQ!ucElf~G
zaA;zf5bmj9X1$j|02E6vA2O_X#mKPXl_J9qP_%$nuT}45P?)x#NrVN|lb-wr6peeC
z*ryxpXJQdRkFx0&dzoZRK&}i&3C=$cy#N1A0r>!gLGqwr1qCl8SpTh<K4(8umYM>1
zAr+_+w`utQzrOV`_{`>7o0sbnTK@kBokQXM|99hbjRQ;upawsOG{`tmE&=5b(Ciy%
zxDu4(8#Q-M&p*H<FS+vr^hDJqppxVDtDP@ESGLZK-Z_2w0VerSIq*yt$OKsYO+Lub
z0*cp0&7BWmaSMu5P|AVDD>Oa}An_>$UReOTu*5=<;lb?LJEuz@WHNLH9iwZnz`$(1
z;Q#;Mpks9%!PDmq)t1dqKzGi7ZcVgyWSEd_$-rctz`z*3mqpEkfdPEBGsr<8FZ3T|
z(vnt$wz(Y{8bFSkoCs@QNy$#Xa*!#Gap!d7LrmYLcHZ#*{|4O5vS?ta2Mt14Br+6O
zESefH-Q_S-#Pm6t%)Ips3~ZoA1?T{K&?;e2!vb_lW6d+`3QGkB9?<$C%S48JP`H9{
z{k#AMOD+aRQ1jBVn}M-L&Vd0GZ59j+450Jn>z@X!oBf)B5p*?d4XeYt89WS(mN^WJ
zmL3d@Aaza*{||t!kE&n%x?-jxLk*Aj|9^#`^;#f-=>h@FD)p8s42&9@AR`!GfC@8^
z-$4_q^^cWAV9}|Z^8W*<00cXI4!9f1SR)T=pfZa5I>@l$HzUIVPyzOPA;XK`2N^#6
zddRTjw<5!d-;N9yz#SY=e{8}3|DcWys85E}AFBrkJjkyw3`*yqh9@Y-LCysEqwfAK
z5zytckmSk$x)g;4e3BHX?7`^5iGfp9$3un*prl@Pf<Xb)at5`oVP;lpF(`mrXBze3
z&Irgr4w!+H4x;x7#lT}rAj3euc5L{c@aiDLhF1?6cD!a}IPhAL;lyi4h6}G3GQ4<w
zkl{m3<}DG6IsZR^hHPtEK&R&YS_tlJCo(JmB@OTYUoXCBWLWV6#E))a5U@!8{{f^B
zq`~|DuToGHG`|F;r<dR%9*`zzdRhQVPuBlIi&}pKfTnT0|Gz#8I>s9`Rt)Nxg2snI
z=77eCr#pBuNlu@6o0)sM$uTAc$RU#v$C%Uw_gbLeBsbw0lM49QNl;rE78M{GlqNtY
z!-KLlIGaO{nS}KcL6sq>LI?Y>fuY_akzs-N|1Y&K6&Y5%a%5Ow$?*TbjwYx=XL?Z^
z|01A93v|vA)1BXp3?Hn5{(q>Ke<bn?yk&v0UZF<l0E0s#(+5xpfNIkEhzS9pgjXX4
z>Uc2CuzAF=?6)Grk8bsyAHucRz}Ij&G%-B@6)vD!cP9JJ53jR!z5q=rIyN!A0M)Rd
z?%J=13@@y!|NjToz~GwqAj1Pt*A3K#tCu@m0qM2XGceT`-mXCIx`7Un0XYWb2yntY
z#h?I6M4)aOC}DyUWWDC;3dcqU1CTmcR}3_|F=-*V#JGd#kqLu~2T;{B*N_2pwlrgn
z&<6&GrvD4-oY}Wn)Hg5))Ng%V;r;&yW3BBYk=iIP5zry^4h;-bK)wLA6RZ{f|F4e&
zU4Yd5#3~5V->i@J2mtpv4>C*uS6P;*ea=QB28P<GTi|{sXc;i5a}0L8hKED1H3Q>J
zMTQBEjSL#~jYbR{Fdu-b_(=zmM+}6)<4d3^dC*NcpjrYH?4Y{pRU!lE80HJF4l+Cd
zwFF;1WO(sfk>ST{M@EL%iHsaI^H&7aGqZ02l?B#w{(k}`cJKe+Wt;!)yiwi7ps;x%
z!-VRW4D|}2?mH+*$rv91cVj?3C2%(e-Wd}DPd$Sy^8WwK7L;?qi8@UhH1z{cte_lK
za}1Q5(m<=~UU0rz$Z+E|BV^OX>w}C67K)4ppezN-UZB(QL0JpbI0CKb08QC|aturl
z*vC*k775TUtmFR)Fg+l1z~{WCfnyvV;on%j|NjH8#sWDHgyAN_!to#@=xnMvAUP1m
zkWXaf0J+xt|NjbbCzpYNv4MZOo(z-p^v+XEqV+p(CI8RW@&5m{)K<Yc0F+H9gW6IH
z873rZh8kELkpE!Ozz_)9ft0G5lb@)W&hS%_VT$+vXGcNmL25yBOcoIJh9LbG2iS4x
znb>H%^M<7ZgTw2G3=67HFeq%CE_<3uzz=iq58V3&B_>NohB@FG9x?a_k5kZ~AE*Tf
zid*mh0^p4-jkY_dSD$8*3j&!58roq*8jLswAKF2fi8izYHV-ts10GQ12e%4ASr}CD
zzlNC$8stC>RN`|hxbF!{e_(Ur1C{*XDPfqo(Px;X!0rW^i#B*dFbq%zK>5JqUNCcy
zpFs)->_c3H!+{Yru*%m8N?b5=&CfE)!3S)Kb1ys`Kyd|&H}C&^;HD+WY>T9+3EuzT
zK<-{Rzz<461>n@QXljS||Hn5$c0+2vhu{G$75vrT<CUP@3ZS-(#&m^qOma*+Z%h~P
zVpObG{C@&GgMRS;2Ut4>)P8~2VT%6)L969!>ZB`bW++!!NA2PO-9ZSN>#|tD$N*Z3
z<-sVh6y#)N3~Gv5&tqWpU|;|rF6cOqA)==0=Q>dHqNeVbNd2B)BA_i=Dc=8|fd}ff
z_cMYQG&?l?zX6(^0G*Qv8u9XA<bn5yK}WqoX2ls|>i2<afd6yQ)Pk!HNT=aHXiwM%
zP;YN~!)0b20nk(csF@2YpunOEmzgv`<7Cri4>7UVgBs?bDR|I20mmlB9iSQ=b~O`d
z1_*TX(r-qF0?_mpXoekh`;xs9!!r9OhGn1|m}+hrS6Ex_;;^2xn*-cxe!#%s!2sFI
z1qvC*c?=n~Hb^1x_jd&-1ib%00eP^V0Tco?nbMWu5O~GD1vGC4J4LcKGDu{m79)cP
zBRBY(43G~Un;2}Mq45GVaSpn4)BFGbp4pO249I#t7`efHUyvS<+13vj!9#(an!7o4
zI2mjmn;8D+$k&5r<r%)zzxrJPT5kbrMizR4&Msp(Q0e(233O^3`oi~4&`yoV))k=h
z`gOR#2B|nXFer4KfHbXZpmLz5xegnHE$G@7(ADms(j7dJUn3;~x{3%imHT@7)iq4~
z(;bAFM5ceZ$0R!a?iwa`5SL~8276`}3sB^NY6{RQK~PQ7bAo{p#J70Bzz8zivFU$<
zjy%Y{|8>0o|1SYG^guM|A|H|I9T%A-qd_Sg+A0I3ZqS0TdS@jO&`=5}9zb{X)Z8?#
zsQGPOQ7hwI;r;(Hcz(4;{sIFi^*c5&@OUsVmN?F1EU13Wpiuw!cLgXld;fp*a5~Q=
zCjEK~9ng7TO$<H7nhcEAH~#+ztu+Jn?X4sK|F8S^A^?0xaQP>Zju{LLp!O8VTJQgl
z!6PvB@s~lPH6Ea(0>T~h7#M5HKZ#h!F)+eLYar?$fszYD$1ITiC2%J4{{QG|0)r6)
z1GFc70<`X?e(x!f>c!x-6}F&8o%LSOi1j1z_Fo+vaBSO5x4FS2JN@S+CO%1U+a0tb
z#G&c`3vkFPGJtn4fijOpJt*UVE;j>pHogD<-@*U^j18QSWd@)!q^3$5bW5S3V-pi(
z$K67P9o5bZ3iZ1{eI$kz;1kks8$(XWeaLX)2P4CSUk4c)K&Rz`4#2J1qg~<s{~<Uy
zYNTE;)W=`0fQG!Pf(HW=xYG#=8xRHseU1DJ&>^lrK+)m-|G~rQZ!R-Q)~B*>0cRWM
z%N3xVT%cofLEEQ5!)2g$Dp>R0|NlW@<Nf~u_yQ2ntgl1U|2OqFe*}QSsroRejRV;U
zsw2n10Gi`*Xk-)so%U_*{Qp1rnBIpB9mOXZ80+tRuCT8A|G)0mhJgC;%N6zYp_eN_
zB~?w?C6RjZ!_Z9r0KCSczUFr2j0$kzgHIv`IR=Dl%65rZmoqS0&-wq~>N^7yB&P3!
zr?hL$Zi&n&|Np;I8RV$@;MfO6)QoCyaz6obMBUaG0oL<C-3NwxjhfO+B0aMh7$Jr{
z0B8RCd5=+(7by9ZUJ|jM1!`e~Z*hTI`T#uP(lLjDv8MD9G<iJ$S4+?~?FsO4v=13N
zK*e+Y-d`f#|DS+UPtD910riii*tb9$uCHLbBOidyTn8no=`!q05;360;OmFrD`qc%
ziUQDj9Z;4Ag#!#*KL9Od`KJL*ZZ{yQ4RRPWNDX-57xef6$XMflL&qi-mTA|RMC%(F
zHh>Oc1|_eWpVk$%63!Jh)08Vf$*bnNF(^@}f(m-aCT1Vd;msb5EZ|l`z0~1~8s!5F
zj!n!Wb$2&`Gtcjb;Olo+c>li#Il^3a0|V&fOlYzc@L*s99}(<0kLdy^71sa$UBLlL
zn%@8KDNdhrjY$!l6c>Z)s_&+Chi?RcikqrC3<{t%tls}0fj5BHl!I^Z`k*Jqz+k=o
z|Nmc&3<dS`9#_=O{Sn|eiD5x;Cj%oW$yx0I$FNRK$t#h%zq_F+>n?Z^O5MKIl{3o0
zDGOePfYjAn?S;nhURbia3m#dkHCZJxqZXE|?t)VZD28X0LXs88JD`~M{(l$TkknBI
zm+%^(;D=#Q!30w0{r@gF*Mii5@{x`OXo#5sboC~)gSF-Kd)Jwy9cMByg7Oups`CDS
z7o1|uqrfA~FY5mv0<HaL0GVaIA5>1=1&<IqPGax@ZJPpB_SVy<TisyNHH0KZ$k6nQ
z`n{V(K%GqQ{|~_n2y3KYfG09vftK1QGOPflv*{DAGKnfHGR#0e0vMDCK`kOs0t5}^
zf_f^`FWg|#W^A1P=LVC!D7ZliDkDHG9Z;Fz{r`^dbc35r^7Y_-1!z)W?}M&Ga%lQL
z2eii$6hxqjcJKdxV?b;W1}$~0XFXg|uX4J=gOLgB6G*N6=LYDM<rj<$pxgKk)N>rJ
zs8>H-0Y0}_kzq#Nv)vV-Va8Vv89H7!$}w!HJF*$PaT=Vl6d5jnd;|Bzo109k;-CY`
zIhdD$PCEvL0VE&&n=@VG7Lyy_NpJ#y<N?ML(`#-q$uoYOKIaybO#MXlJt7tf3g8C9
z#5e|yiJW@`Kx+oP|D6QS>RL1~2tX#~1Q;wm1sHzX?~(W!yGOzM-%0S&Y+D5ejvqC9
zG!m5=SiJw80Iwi?v40Qvbc!FDdkl0`K}nR+<Hg@S3Oedww$00!JsLWY{loRp+vpiJ
zKwCy_4m2<%WHK;=E(c0D2EI#@(ISCS#6F2(8ECaPxRF`CN1)ctxB}G4{;9Rc0<=%K
zVIJtf@fIfUfB(UyWlajGRmGTK-_XEdzkq=wc@76d^&IwNpg4K48?-8hQKn|;FA?ki
zY8(tdmNGC@EM-urS^BsFWRUm2|KQebjr|MI7{nFOQ2F!+x0xiSJKO=?uW*M+tA6SP
z4@OzADp1`BGS>P4=tTLc8$1|g!40<8jSLN-txBMcn6Sf{Es~~QfQ@s5n)5F*_rOl~
z5U^-aVDSET5?ts&<upLG6lga*c%|;Yli+1-U^#D4z$$|RlR?C$fq^5T1r+!v!RZT>
z=0K4Ka*+4Gli<M#G{>-j9Bh#^^@j(e%){vdcbO!Z5*Vhd-DNUhIx%&6#9bz>sK4Nv
z2y7XKBTs<G4xn;qjywUb^`LUlxJ7p33Bl=i?lM_`&cCk!H?9wYPw4<%7~BDBWP^0t
zD>N{GhD1QFY}DK%0%~l74(I?a_O-sZN5GnCnntxH`>~gCpvxE3IU4>kFn~%|(5y`@
zmxo@hmzT)vR}37XoD2-1EG%}V91aZiofZr=^OZy#<}vJXY+^7}Xw+h00S})wF!a=_
zvTv!i^{((>WB{+9X_(ExQT?Am!6JcCrvB+^&|0v)(+}KZ(r3&7wN*_FDpeR1K$W2f
zqts52D?x(`AR2~2F7f{Ve}(k|P_6d=!1RdwOhHV4dZ(|s&*a25Ey9CQ^5^s~_n9<<
z8vj4ARA68O-S+@$qk{S*pq4jiq#4v+1+8(mRQ?aXBcj)nfw6v0kcbn*{~w^)1IH$Y
z2bR$cETEvORk)*5{~%1q`re-D`45=HCHHs)s=3)&EDd1*jfR32c%}buV0f{2&-D2Z
zm`Ye74L#WL#2jXzz7NP8@P-ISh6&d9_BdEOGUWYWWVm3hz`zLFEecxyVZDHXvCxY_
z$+3yip}uo^)I%mG3x_6#7oa7d^|mhz;8#*;y#Q?~0Bs+Nv3|h(+=GFE$8j1XDENKA
zE%kr<TBqN5$fPiR&J!jM8@>4q44{kaYPDWifbIu&Z2G?gG!Iv)*`l=7ih&8V4MIbP
zf!U$yzXB+Qywu#|P^bwyaD*Xey2&FZ^ZE;~6&X5SgSL5aFoO>0egKLJkP)!F2jMet
zSTA5;0kvyE#y}V1vAkHh$HQVN0|zLWKzVMVB14Ho6L|4<6=)SE=)UAkP0)Qd|1&^)
zavhpL3&%nEeOiMDquAR71~>4K7T6J>k{8J#KNui@v4I_YxH?0kW<y&IrvxZyzzclA
za~lc*k`|9<G)&ic%p`B<Qp4f_T3Pi*)(g5HjEP|xs5$jhV~<D8^B@sW(Fdx>UaB*2
z{M6dxFxenfWcr@jjQo@Tm-9|8@Mf)d{C@#7FbyiWL5e{ge2WAI0sAI~WuWfvPpv&3
z)^qkac>miEZV7=J@{Ud5>nQ|4)gMYXIFX^__d$jQ9t^+0qwb*c1~jM*%5e!T4hr^<
z7?#=ZVc_uocL?0Cf3bg$2k2hC|DbjCAP0a>T>#w*QfuP@9-6mU%5dYSt%Cw6v_Xnt
zv49){4owU(AuaBEK%wu@#1LTpfWZ(p3*|VC>5juZ1{?4xHve{mH&(pZgIIBGv6P`6
z9+jX5OGu~t9#9GcU4;!gyc{%y;r;)&E~F-AnqzIlAYgq*K)||&Ljcr!gI(?jTHWWt
z@C!UO4qC?e($)dIb-FgrOT_vfhe4$~gHo--U!9s4e|11h>TB$8fTHb4y``v^2q;)U
zJ_m(DwI+koi~W11`#)upR1a4>U<dWK14uGh%}LH;sRcu@8fXs{11wmk_djJ4W7@xG
zdi)Crz5gkbsE^HoUku2a6OOSkSS)3MXL4jY(9#);rHl-qaJIk0z*1j-yTW>ofPnQq
z4RFV5y1+9g@p^EDjp94cPuP8D177ZTq`n&BIZ(O<d9XSY>^TpRUna&n2!yH~unPqH
zNrMGc2Eodo@H8}kr-A&fslgDOhT?G#kf9*MYz{DRSS-~5M<poq&OZZ}YY6Fj28*Q{
z5+Lt^r2m6_vj<7HPy@{Opc;Il6$1}=+#!*n1AJrgL52mO%Yi}T44?!78YBXBOkRWT
zx`kdZhDd>bV?b)a)v5z%y~I9n6^LP;{6mHn-v9rD&!GZc)@hN{{=<V&2(~$L258Z#
z$n+D>ndBJvOn?5INttoabnX{S(wsX~LFLnneS4<szd-RNBod*%+y_n#;*5Ky?|;e!
zqWWJjX{+t=00ptd(h%?t7f^0`v2PDJIzT}KD$g967&)dtc)=tlxyPf{&KtY{-y(s5
z%lqGU@WK(0z5Fkk^o90#fC_$)Hi-1LztaO=GRZOR-8;SDC6gG_9@psws~Babf0)k5
zQV*&xK&x?K5dyL`;n@FrLauRa`j56r;olFC??GmP$_bEu@BjZbAmt_lV*}_k90mpk
zP~8Y>!h%LEe<=Rf1RXs$0aT2GZa4hx$WQ=2(c&S)3{Y_nx{MhV6rhAOJ>V6SV!ac?
zI#9b7w0+(>YLA2U-aQV@zZ?W=<O4wWODcfsdrNzUM$lOZwX$9!p#AHGUZ9>4g8}$(
z4W#xQc&0d+eG6z(5jH*r@&O2gYEnxN1`bPE1{P2g9(1fmeL|RyPpyZKPR(2&9qa1<
ze=5D$kJZTBaHwes22GJIcxmMT-WCIDyVZ0m1b8rf0dFU-eysKcwC5RACR-$PNYvCy
ziFh!4J~-XsHIrE09uG?^2LaIa*|2=jXyqVKpA5NW0(_gfm4g6y@4O>J0dgA<<N;6@
z0-Faw3&OpTZU=$%Y5p@zKQM<$0)ETn55@n5j!ld$;P8LQ&;i>X4i5YI$`!D%w^(Wc
z-&kdR0Mz+o5D1xfz%F2(lU%?&H#?Aim|Boti=`Ie91TsjETD#k^*x6AfKDg5@Oy0a
zb)aTKjU1?cWYB=^zkdCYp#!w+8dN8O`gO>I3!wP0?gXt@VXOPW$glvEYAZF>IqH{y
zuEW^lQ2mra0d!@(#XklXTR8@fnmQky`g>j?HOGB)UUE1nfVv$u$;K5m84>{=3{0Pv
zPQUPmNz%FP0L<x-LcGmM4&?mcHc+F>LIRYALD>kj6B^`7P*w8!AVUMPOQ$cm!6>2u
zc3%UiY4HC)$bF!b2|(!xhC$5<@BjZ<rUzs)OHa>!%cRUSqhb1lw@h}7d#0a%%OuXW
z$H9Z)!^i0g)0ib#y#If^GM(cclfm>2f=nFKc{~|8CKqJ!)`JG~=Y#M61Q-236#q3^
zG|js4V<F=Ki$sQk`lFvKemrEn@RO18#!pAa7e5X%p7^QA_`rkVFL<oM5;QG-knsR$
z(~?3nBLiqmqb5^I#DkFme8`l={Qti|YU&TOn}EiGYC4rfy#JjA@7n>Huj0Y*2Hd~5
zSimq5eE&@%Ljic*%)dS0uBnA0W5eVFS*p|jzGdW?uKJ!ykg4M8bc^>)a%{6+crbDW
zPLFxd<Rw=>6%;HlK)0FJNmoF2M*asa80hl;|F3g;!h0r}=?~sBDb)XZ_<ske0R(GP
zgWA)-8UG&uHH1L>1wlhdpb<=HS>mYM#=uf@-?*Y?yLJU=)*iGy-ufs5qhlW<=%fQS
z$0kPjwILQw(-bU{W(#;Qa)L`w4~BT~NqQa(Gr`VFU|^_cuuo!Gr)ST=pexV7X6-aP
zz?y-9&AR$ehP46%i}k(#|3TGB{So#p9*mse9-0TE2)K2nKaYVyhnYdzv55gR@Z91!
ziD80cA0v-L*Z(swY8it-CBbBA&_u%oaQ7UPj6p3i4~CiGBLYEfnwt80(CyWX89MUd
z3|D|^AqRNhiwC0!*Z`P?4o&~TdnrHzaTZClBRm*6!2Np<1_qQPEnyZ;wgx#O4m_%(
z!~Fk0C`mXrK`s@t5Kfvs!Gn<lJg^AbND8|6aJq#Jvm*Z_Mg>p~1(lkh1$5JU4l+vA
zqna5DX_D4US9t$NTvP>$c#Edl9*~e{2M?op|NjSHy#<wbfXai<FZ5uD1>eBr{r{f}
zNFEu3F13RC)jq?6ksaLe230#CMIH>D;Nc)pOAwq~YZ*8^7~X*A-9Y0u(5i_UG8jJH
z>@c%R{V#CO7qsRMbPb}V(!3WI32ZySyUO=!SG@FOV0f7cJ#^)sam7SN)(TrDhIKz3
zSrdLHvSv)w_><xNZv%L+9&){+h>yhrwjH4O290`nFuXnpav2C)B+WkI!N~Ry%wE6<
z+DXG;!Jf#};KA^E?sS9COkz&Uz|A@x=Kud{vZN~<nix_%7=^&YvyjBa@&q(ysUy$8
z<=Dh>!~5SlaF~1lTMN$4-v8ExPVe~4Bv-!-7QbL~9Gm_x0mb#NhpZjH8CfU%R%D&w
z*u?y$Q<1f_laUqNo#}YUTHJAvwWwnuYhgztYk@`59EORG%ojWuS;5<sEfQG^JQy^<
zIi@DZX<4HpYf(+I7kFsXgW(H!2t&sXG_=8}p;0f#@ZYhKZ2>re9Q|Bjk;u?cfAEut
z^+M(w9t_XH_o;#Ahb<N`fI|wjE^4M7LxTsyD@d`D2x3cuLk^rXK;>X1C_va_Y?T<+
zSvoMVHfsLKnCQr2qr(Zh(wysq4krVfV-t^s^+A@1dP@ZcE=vank%^8hJ+<~8pi8K@
z92&sU$YrsBfu;V)=ZcAnEFBi$(0>Kaf*^xIhJp+P-JNdzkQKCCmjzV0*FX7P0gFnI
zgB+T;YZ?_<Y&19-SREUgLLm1iiKke4dF-gw^0Gy{K#9qOfq}_~fr0S_0|Vn31_mY;
z1_p*5pwNJY0NB-wUsrfAyv&_`<tvj`{Y$X#ksamO^xp^KOGbl6M;03mE|BF61-4B8
z|5bX4r&w}$M$~!)t*Z5M5&@lm<<|hZyon)zfq`)a19*m)QHOznF@=GFL84(HO9!}(
z+Q`%ZDu=xP|NICl3c&M}4Xh%z^-2uuV4>mI#C8T^G5efON9G%lzBFskL`CK+){0CA
zK#OoZ7@mL=HaK(|nL;d*|NpmM$k0$z2O6XKB+{wL<e<aJpzqkk#PCv)`2ggAEpD)R
z4T;PbK%ogSm+=eeM1^|CCeAychJp9L5O84t%1vNJoD9s4jVz#J7Z^dbLlX;wMFZOo
zurK~?2cO09>LF{#Yev=yuN7HmcrY+ZSU+S<0F?<Ai7XzFsC)^{XbcPvO&l4P3JlB>
z6<KVcp~7a-$W#vvmLGRP!2-J787j$Q0S~et2cdEoKo)=uhFX%~!SE8A0~r`zBr;!e
zY+}D+(a4hE!O#gFpaXfv`~N@ib+Mr00E9v54Qd99MPfZmfd|7&aM=V7(k9L?pka}T
zicB-W4uLwtgTWn~^`Q;{&nQ?V7%*5r_&>*@Y4!u}|KD<vLjz<H41+=p6ms7G)`GM6
zi$vxF9t@ws2d=#kPGmme!SERzrxuE=7r<3P!yG0RP$z-|etMxrf&rWLga5NFn&utw
z{{QtMXkNQhkr}#wjKKjEW1#2-MJXsY9h*45c>fCmPhxog{|9c>z}y4U2kPrP%=>@F
zp^2{nw0XAqAWM%2!+Y@LA1E(?+Lu2v|I`;aHt}t-e#kNbrrBa4LxV-r+z0i~epgr|
z&Hdp0Z!5Uv0tr0c1&xX<6J9K2XwczgP;qGFZTS6=p#Wr{MI&p0r2~V&i<f^2EEzZ$
zEEO3V>W{H+fs_n#;BiHe8K3}mY+&?oY+_sSQn8+8lBFX<L-l>|osj=Q8K6>AZwcs>
zjTfDuI_D8ML_uX7$U&gCIcS{($k3UJ%=^9nf9(VtS|?rM(8%!Nr6S8DOGbu<N-e!5
zwH`qtFS-~6Agv^ZDfNqQ1n9^zFgP^wN?0sl0NYhxAN5J3elPnL4~9qJ+5uz<$Z*gR
z1t5#O|9{m4TTm@s0dYCQgqq|R0WgQu?|LOtQw8djJOvjspir!t{UX33X<mc(zm4D|
z01^Wg;1)^qW_bVG2tM2b<WP`DWk9|M`S$fo1_|higF2wbvIoP1gVTO8iPg{B;QenC
zI1kj{|6BnI=@*%Q3OpD-f-7iHvH&Fs$0qg-p#0(eF919U1uA|V8h(F3PO{$r|Dqf%
zVEy3#Pm82E9v%$;!M$%ZwG29(46F|IP5%#o(l#iKd;i-EuC`DW{sGSif|^>O`9+We
z5yc%7XuSoSV-r)1j{N_Bj!n!l*8dq;G(gK18ks(T(kZCe1MQgr4R|5z1r>>oO^hGv
zLFJ`G)2{>IP*gb$N|Oy94FACOq(vh`gGD0K0uP2R@X}t88n9SWCx-{aUvQf9{{O25
zWC=J1pwaHZ@BrL$1tlv;GWy?P&By{e@Gu3`-~d;%tcNQ+7=-E(QOJC_!lG$Tfd|7=
zaKjLkEF7Acc7POv23SCwd_iTOwcY>!9t?uu$q|r`Kv$$ALWJ!E$U~r7%CU*fMn@7<
z(f<g6Sq_>j133UR!{@;uRG7d}&%n^B$npacL@XOX^)aZv1t|bo=)oWeo~zW5WMBl%
z`#UzV7+4%&NP!vT!5{>lyhAc$f~5k3$V5e!9#Ce3m>~dedN(Svba?;&eg#~wgDzxk
zWUcV1XLt-Q7a_i7xnt1?smv`BSsXkV9)nkFLFIZHz>NS+aEO6?4)e7`6GKEpBU1x7
zdXnax2x(`tt7to>RMFa|RMFz5<iYR<Tr+w9|NEd}A=3<yI?#-vMbcc4`j8cDb`{Hy
zDOD_MQ>s`BRt&D1y#N2$018TnroW&v2DHVb!Goa#o(m!AU`~ez!*8&Iy#N1g0oN*x
ztO*v0pc>>6xXlM~JX3-NNPGc<0H|v7V0Z-1r8>+E^`I+{1(1E?*!155YO#k!A`{GF
zun#~kN3s~4ZN2~h1uqB#$$_v%f&qv1ga1=4n&v8a|9}4xl5Ks!oe|WW^|J*W{}u@b
zjF75f&I<4U?+-#XfQx=K4I!}Lvq&&tvVQP?mPON?59lH2{r`O}sCof81~iFd(KM&R
zgW(alY5;`>Xn7P|uD)qbg9pPS@LV%Qk~sks8kj9d4h>MKSUm(?ZO>c)O5xuB|AGz|
zWB^st9t=(3-jD}F4Y+FpiVASgB9W=Xg8{Pc!~6fYEub<1l-M1czE81eWbv>7DTL(l
z``|bMo!<w_X5Rn5?*Lf_O0A$Q14@wA3ZOpOeQ;$zJ?B4@RQ-MM83ssd3OpF@fm;sV
z|NnrS)1X-$@Be>5(+i-={=Y@iJOvMiU*MHc-v57fK<sDnuxJF8GY{Yi-m&Sg0N8<v
zObbA2JQ(hSOHuFte~*CppfqMt-w5*E1EkRV+XHI8fYZ$a1_2L-d(cAaZwV+`Js5((
zy<rgB`=1wh{J{JFHyMxzz)c!(u6qE^(vaBrQh*4tFDVv{;LGM&EE1V!fI_|AgW(>y
zw+kxiAffgZ)RgG({{Q&~H1xm|9-veY3B9}EmI_GyOhx7!V4r{vh)ZNi07a<>!(DI=
zLlUp>V7LqJwt>!mv{=Bv1&R$&y7FLnQV-8!6B1cE92$N*c>n)x0+NI&^k8@bUSSLJ
z&4fgj9*2hC3EuyIhj=gqfD0u^NO*!r1HJ!$6|rb!DFB5A$cG*bcfpe%-v7U`K*U%a
zEE<_+cre@t*Hb#o;5B}~6Trce$TS0_$b;c7I01V9|Lp<dgIl48KUa7#+ykdCkV71s
zehYwlHeh*hp>`KM-tGPW*N=vSEIqK=AJkIt{{QA9NDruW;Lylo1FDf>4K>I5CRPnl
zYt8$g2Y4LG`~Q~+kdHhV0$_!h2dK>qszX3UF{thUMUw{uH`vFZsZm=ehIODiWTMue
z3`l+PF91};gM!&&A<G0%Rp7zE1Fi-v5?LmI5~T-2Be?%p4{{l3KW3*Q%LGsy!{QB;
z#T=TLBs>^ygQEy!2-pEPL6sL5I1PZ;ft7<gi;RCjbD-Y;|9*ft;7`M^gRBjhj^GAQ
z216a;;K9IO4=+@Z90582js@g;h$9#*JQ!|+cLKs3VFhsnI0SUW7#KjlcW7ded3BJr
z0pgH967^=MD?Au(gBv>_hkzPvATvQ`crb8-i-1l=F6JBct6o=FGBD^*{ljb`1Cj-K
z(}RH%oa!{hKx+y?gGJ0D(|uT&CF;S^p2#x6gMkkmV<-W*fC21oP)8Qxb|w}NhFjoL
z9%i!Dwg3M-7&yU=Gnm^!%L74f1jQD@ja=X)1r4kM4+cI^uC50Seu1V&RiH5jN$d>_
zpw<|JLla|*2g5D!gdEI54+ai!41xj&6j0v(zn9e8fdc0yc(?{+F>2s&g1c;>VgnX7
zAkR29F_?HTOjn9!5}Pi;$SmQ3WC1vKG~{4m^?L%yP?&FEzJ-))ppdHr7dfzyo36md
zELP9(#)IJ|c+C*ZT<d$Fkm3M)2A0$un;3PF%?7FUVBi3kk<gH;@L;F|&nH36Ujq#&
z&=3Q-C<7H!AP+e-F|>Fv+yJ-3>gpfw25szM^k85Ik5NKG>YIcI!wvAlc2MYf|Nq9}
z!Egf{o!<ZdDS$!<V$c_j`n{h-I&C36Z-=HY65jtmf!op+NppXAFnk6F5NJ}^`~Rl`
z4~84y<mdhWzl8_G4REbc@BRPl8jx>5sSo5r4+eH{83l33S8(?WG8{KAz=Pp4*oWT#
zKZB|kaGJA71odODgNrDLW50rKj{*DGB9Wy6V&-*l2K4^_)d8aBM~4My_}~FUJp*hE
z0pu!B?gf?p-v57t_m)5`p1r_>;S;#K<^BJ|4oETO4Xy`4Z0~>0;3CEQ|9kL?IE$pY
zD?AuJfk%8m@}P1L(i34&@c!ov?oGj3C)N*i{{IJ!A$b4)VBx{w1unHgn!NuxgVTif
z|Nn>;k6hE)IGA;9A%k1?|Nm=nGW>OHWR(DAP0#?mMIz$~4~FaD<^*Wa9mKDH`AY;`
zXW27GcrdWOou0$NEM0#=gBi3Wk7b6%0R{)qen(L511a}lU<22!7L80NK;!cs3|!z2
z0Vqv5HZe+IQ4d~xgrpwa0fDGz$pD!Nidhc^7I5PNR2f(tn9jz@EKtu1Nxci1Zdf!j
zoq^cK4leznx)nhEJ*aMQ$Y{thFo8^PY+`tV>=F+KR&Z*zXk@woF^3bJcp>I6-#{`4
z990@}49qp=;IVLqIcNrf3s<lPXpQZ`a0gsiPe^3C;=#a>GyMW5v$!VMm&jT{?($$@
z1*cs^XmGrpF2Kbso(e8mzy(D;sNVQ@#R4`wo5)b$!EgoaJy6@yB58hr2g7@CUb8sJ
z^Z=B1K!+ef*2eUMOD@nzD`?p%$V$g1<`B?mu45Ck$@CsBX1V(L7bYKMJmA6b9-M$I
z5}6)&FbIMhT8)ZKpiwqZY1w1Z$WUN$fC1DzkOMXGy#GH1R~a?Q>?R=d9h;bTG$ewi
zPMLmqFvx%_(S}Bb0*D(INMLqV-hp$7M?HfqIMai!19NC%TmTLWQ2mg|&{6*%G@x(=
zTnIEYGIT%<i@;(SI2u4|Ky``-gDThq-v6e9!`;>)Ev=D}=?Z8ONlo&<f<&*h^jgh;
zX|<YS1@$$_9sxDUj@KZ~i>cuLFY>Jp9t?uurlbdh8aStb27ExptM|WYU_QuDQ2c{R
zILF5SS0Ik;R`6hW3(k437c%_-l?yKt88>(^JOCHdFA^Ddcre@tHOx2}UL-Oe^8ROc
zclsY5W)0AeIdE0=dm+;gP&)TuxD0N3HzYD$0HsfdCPsyZM5Y@cwqp~+7tm5|4+d#)
z*9;T^9t=|8DGmIA{}!C?JQ$?G2@MqXj!pkEz!OduNee7I7~X&l1o<U=Ih$SevSUis
zOWTyHm$)%mBrWjpV0Z)W%zFR-X97|KY9d=CEhz9{cmqzEAU}Km|MvkThn(m^+1rDG
z5!_?|M>IG!v%>oV4o&rco`5ug0?Z<5-VYCkH{kNc`~SZaAaM}3NMt(W!5|GzViOXX
zZg~Iy55DvYBnQHf5Rn46I=uh?1COd$B+dWe!SDv0#J&Ij3jwJEcLkH?FYsV^1CC(u
zBoOHEL-0^#(tObPI(QMN_y2!B(1{wx2IlE(e9TEcpxF>m9s?N!!kt>+mW7T(6N3mS
z_4H~nFzRqJ=z#8I0;LRxrvD#64uj1ogYGJ^NCvG}{(oY6!vaQ;=_mM@Q+R5Q8iRHK
z+ySkLnQp<)Jdf#2>GT`?%+u?^*QES9$S~p8Lxvf@7lId;?*Q++S7cZL+He2ckpXnJ
z`hnjE86b7h0S3mJUD_3(-iUR}|NquW^E^Pii$LkzgW)o$kpyldIW{rus86|F0ZPLj
z3}?XUACe##BM{>CXTV*PntF+Vnp$=f4Os?G$3}(*(BTO+sq7|@J{3bj{lZrwb@#PI
zK((<4!)b5^nJvozO3~o%45;SzV7Lm-(HhL4IT;3<nwpR6K+WOqZww6C{~7e^|1+3`
z|G!yR|LvCuXu_$Zo`FG!ml-s`!<YeD1Fm5=y-JWd9Mlv6+3Ue@3S5GKsx4S=2xQMp
zMTSZbhAZHrv8GnK0wm_aa1uNSYiSFv4&@vh|L5pffsAGlQQpg-02<M*)qG(v(Tahg
z{=bxn_y7N(o_7o+aE^mAEJIBhXw5xCOua<|16bnMLWT|xhU4I}792pO>?Rtb-~ei|
zddN^vwUt2u7D#mqSAmzEg8~WE1ovP#3C=OIw=xvGTFB7h{r_JFNRPz=22POYppFJN
z1VQXs2SJ`X0pdF{)ZGWU@LxpsVFs3(WCoLv<ePOh$qW~~|Nol<DWv}$fEfx;z}(<d
z${D=>|MdYSJc;Q7o{SvR4O*CZr@x)g$Zi5!aR90*Kr`H+;}a|%f@+))NKb~DfuSZ<
zx&l<2I5slm=rI5P3%bf>de3_%DWzy|qY8CW9kPedB5A=14~A!&pviX)9*g-54i-rZ
z8ax=Deg%oB)LSGiSmD9&6kJ|<|Np-L?pP+sYMuJSO5j!rXcqp5;(x`7>I@7ub`lN_
zjm#lBYzz#)8yOCOj@)x-WOe|pgZTZB;f6&EWG?x4BEybfi3}B>rL^$;13IrlkzoZW
z&-`FysQ>V*k)Z(;jrGY&pzQ=)p!f!z^9|bC1<KwY3`fC>u|aH5h5}Urpgrx@P74{V
z4lU#WT{i%d17WMh42+h_|NqZQW?-nX2kon8(5bbT2mmd|1<Cg+|Nmd8#qb++zo>pE
zgMtoM7y~D$Msb|SsL^Q;E=LsfJ3(R$91imsL_jmF-v9r<0BHtcP<i6m#89Eb$)N1m
z1UkH)0o?TQU^oIUuRxA-Y+`sby+M@O7PLOVgW(Lg`3b5s9GV!;)XiL6QDe8l!J(1C
zq(=4ugF^#@PTl_1poTrz=N=44AS1KNpxLN@e?W)u)?Wo(VD#?`=p2w&i3}C58W|cu
zY3tQNh6%48GR%0*$gtqGBEt&sY9L334X+a!cD!z6I8gr@6c>sN4?r6yVKeryQV<kG
zP7MF{c>n(gsW%%KI6*=0!EhMv6Nje%;AQ5Z++dNk;DHCjV{oGkw7vx-2D+jOR@6W}
zXam|#SHF^dOQoh>{gS#Fo?4Dg3<`D4iy`|b7!HH8DpWDY<n0U$kZl@}3JYYYMbbh6
z4~A3V+7YU*20Z7{!~nkB52{AOgW(jo@&ZK*R7}Bx;S{*;fr!<EW`7oHcrZKycPXI3
zegu>nK|v0>mky*5hM}%rQfuKQ@~iXz3-AB`z?(pzhJ!2w_Xwbl(g8Wjv58>=n!XR-
z|Np6gg5SD+0q8=ie=Q&jpoS=TFq{OpuAzn~Kn(dGf@a7M&^R)ZJ`E3shu|)<_y4~q
zVCewl5qxRE<26!Z0Hp=*|9`=&^pG3_F1|r&0G{uW&YuJ2=U<Kg7fknYV3w!{t+N4@
z0-!Z~pc3j=;{O?-H94SC0aPl%w`^_It^jS>s`+bOQETm8Q5zLpVb$^f|BGZskJpNf
z0gybx6yw2gXd=jq8q5rLK&75zBeMjkG_k5<Z~(33t4p2@+N<eM|L>Q`i+POo9v%#b
z!0j=RCX1wnH#`^~f@`xEb&L*BLm5064uM-Ipano613VZGfvek^8YvMCWkv?aMy4|_
z<}o_d&0*gHN$v;1yN^N3{J=YQmb?ZZ4CMX)=T%S~IW{u#=$L|Psd@&3x+SZjb@f5;
zP&Zfu=p-S8riBnq3^zK%7+5>a7$EuQ@$ZUGF$U(2ZwyQw*BBT(wlOeRG%eEbV7LSh
z0W9W3Ld}`bXvY`=T7}?f-^2(>NsoV5STrqU@L)IyZqQ=UEDO@?(7+G^N`|15gFp?B
zX+IftrzcKh6xXO>KEUAEz@THR1aTfXJP$B@x5#|H!D7*(0~Sq-GCUaWy`3h_EFuHi
z(o`Gkxvt*ras_D2uqK6l3uuW3$mr<?(#)dMXF4;>)Gz%10<<0obZ&(A|DQ4-BS9Dx
z%%DaeC{8UJ81x}gavYpVYrscTGpqrXv9-oO0yH!k&N((R+ySKlkX}&qSTrp>;lZ#U
z+yDacJs9?byP}W=!rz{TeUP23^&m;B`wW~`^BEW|nid6EEnr|kpEU4bxUdyuFfyLE
z?f-ww5d5B7zh#31C=@~WmO9M)f5-d(KXBr#tDg;8(ga?zWRbMc!-L@-s8DccfUNQR
z2OU>f_``$Y9=Hhx3MZ%>56EJRq=lgIdtNX*0kpN`FXEnN-sx^K%nEFODm)ktD^7o~
zk5OX!2UR8(0h=U-b>Mz~GDzxB>Ewb;1rD%a@}COOkpQyOdli_t1ML?vtOI3Div_Ij
zK<Yt_2<yFn8bI08zKLNSDB`T=fXp}uZcl-FY~V>n(8i|)tna-4HGtdWV4pWJB<M_c
zlx3C(2HnQfwCIKh!(nj$1|;jy1U}_--9pVjJvy8mpv842xmy4K>u|N*b!=i-p~J}m
zy8Y(?XzLWn`{328$?RKRFfs^$mS;~7kYg69w`l@*YnegrvS@i$;K6VhoTEWDI5z#C
zVzGdM4Yn84gW)i^M+udyuv9QM2J2hEzy#_dZ&U;|mJWfF2S|-W(|=G*1%Lt?hAsC0
z|70<TK@8;Yilq#)3LXrx;MNt`nTiYxKp6$ai8^Rn6g(KX!9hfd4u0@Z7*-t@<d`L=
z$Eq;#PyZvw%*RyEI4y`tXR<;di%U(Xas{ZU1r@R2GqsjL?nD6<m7s9>q4>XXqcQ`J
zMKS}M2g3od72x3|Q2DR`EXE63>8&$;jXbl2#zZZq0?;r#D0zSu{!Y|lDgp7W|1&jA
z)M5g)(YQd{&8EMRXI5tXJ6%A5S&Oeo1D2_OYS}eRR|sI1n4X}(ETqH+J!#?p3z!o@
z^#tfZ!CwdegU?5verF?-q>|!)LC{?;pgus&eC3Kp6$Tzq6AE-09%u%xQPXbvb_Hfx
zo&{M9Obb>qu$j;K|9koZU1o*pEQ-u}^~^__>lp-er2qd1sctyQRN>gf^aI3h)U=yW
zpXKobv`omciRlc;D~(=uJvCf67#y2eZJ_*)`mCUeT2BwqY$t<56U!EeUZ#>7P6G$W
zCe|36hBIgEofy_7w46C>9mP}tJNg2gV%QlN7#!!Z3QXUl$ShsYBdf{41v0-@(;=X~
z(*U$j<bt&o10-87U|<93sh{~s#G+}@3u~rD53K$$uz)%a9t``y&2vbqWO4wx0pyp8
z>);h5TA-XN_nnQw>N*3L)prJox|^Fs>UQoDfi$o7fD1qG|MkDX-6vZG21bzQz!Q%P
z7}!8pYBzP+by$=#a6k^YVPi?uWMHhd+^OZkum_wSCQW7F10|Vymctbmr3^wI412&1
znq0~t;r;(7xIt3ScDTZ#frAay#{gOE{U35<KWNvg#R3McdM)sNXvl%;prZ&Jnpkvf
z4l%5=bvSbd<fG;`riw(bGiMuKGEJ9OW0q!Qnr^PfEYHX^JzR}hwtk`w8^`1t2A-Nq
z&`Oit;1O)^|3AT%wZ#nv4$!qhAiFK9Y&5+8{{{~df|fLc+bUHyX4dx@_&gYPgPV^a
z>n5Lc>G1wn2OcZ&{#Og`J9{uNz-u1we|4aO8QjlyXk@6D0hJZr|9^lrG}^GSK+@s=
zI~EC`30H<48l0ew0)I|`3~%(b>j2Z5c0Cha7<eYCfUcwbvj!ByFbs->MlU<G6vp@l
z)QJO?wIFpe$JiLG=P=b+J+fN#pni^#i1+^=;3*U98U`*<wFCBX0|)f3jbGpfE!@{N
z3=$p;yWUQJpu{XD^b0(=3p%G8Rz^*q;LI#BJzzF7%QQwN6_d^L8Kf*0Fo60{43Lr4
zo#4n{7|$T_;y(jVr#u5EC^r>){{O$xk)i0vLx!5^G0Mz}^=b^v7Ayb%uT}R34S*Qv
zsDTEY86<Sn7?>QI7%P^XVgQ{z{U79h9Zd$trCJP3^>e&LK*uFiy!_Av>Rc_<0_R_r
z1*aI;mb_x%0Lj;KXo-OI)N)vX_B%ePpW`HA>Bx|0@qmE~G+?lh3#^At-sJiJ-wV1J
zK$<yfWt>EocQJ6)YAT6<45-yKnl7!vZ0+_Nv>SO{qo!R?4JRmzGn9ZL2pkETOeM`(
zc2gi(nqdi+EDg@0j`J82kaMzh00VMP_Wu7HURS{4(C!ff3p@_LKdS(F$NT@^86c}c
z@oNpbwn3Ar29(>q|Nr&@9mG<zQoCY#7lVlR|9=gjlEq$$VI5p;6jOn<r5#*@j77r#
ze;@-vRU{~0LA^70OPmMNwgG7dSvVonuEYEPj|kAvfe1TDq#@I8`hRt1YbCoLP+M*$
z`?G3WCI*%bna^r06&T_+dOQQ|ux6R5^{i@oj0Urs&@=F@S`)SGdVVPWpXkA`opah2
zMisbO`!$&5+3cox|NjoLgac~Hl<5aFnB~~)CV2n<E`e&jy(Y74h)u$OhFUH55^!PM
z$e?5C`M<#?;s1Zot=}444E7F<3=)=_pxcKS7(iWb4NeAmkQnl)9LSd-Y?1Jv0VF<s
zgC=tX=t3}Ihej3)P)`Kb_W)Ihuyy~S{Q=M#EfM5ca78muxdN0<8kR5!)Yx-ZfHFGh
zrkom14bUzj6&+UafebPr^^KZ#9Z-25ki0_^!y3@??*;c5xGdxTyZ?hF){SxuTp)>s
zT?|YMxER>LX*P?2WnmTr#}aUQO%kc)kP@lYWD=?6h!O#%Ux%juS86q#L_&^DKc~ek
zU(W`*OP;|5bTM|JviyJ0a<M{91<)A(mrgqdPSDa5$0kP5;wnMMCdLKOd(>Be(uM~E
z1Gvcv3Ly}-Rd~Qq!wNc1mZ8E{;RBfM(C}XXs@4MJH&7w8kke(#LOTW)>p4sX8la1J
z9hw-x8L5-gWhTf{keFi=!xm5}Xkia-0F_J!E$yt=VFiystN?Aa1zFi?#~`vWj)6&s
zlYu!jhQ-dYiAh0+lL0jTVgd?6&{2O2;}|3oHLsM_aDlw~UuU5mgA~Xc;61-g4C@;0
z7<d{zm<nn*13=sI!EFJ@rvEIU;$Wf%Q-SyY|KKh+cr+a3hel49IUr3SXF4?f2Uneq
znl1}!I5j{97=$ECSS;Abz+^qgNx@<sgNQ{kg9s=eSuFkk2Gr&AVAu@qYk<RC3l!G>
z{(w9YswrauI;^8s6TB05-9{~!N#6hefd?2so&_&j0vQadHNXZh{r?7ZzyN4s4y3^Q
z|Gymz<}ol?)G>%ywETYq+A-t70N>I8KFSW%KnI%vx{^HEWr7F8W^n)2`~SZRi#`9}
zyg10fP-D$qVaxEJ5oAZrQuZyN9fy@13<?(E4_pN-RT-4QmxyRGT&OwdnFR_7>w^ph
z8y+%%jumT}9LK=3F^+-hryK*zL_5$@oK4^wWOf{b$mTc(F-rvo&KfQ53Q!3RO1w+8
z7+R*!&}BB@sBeYz;-+8FWmZc2Ec#NBf#Ih$14Dh{?F#Szf2VZXF{nb)BLiqjl%PY?
z-v*00|7$w-F^F2!F&KdM{UCzkZwjUy8+2shuLmei)+Do+OzUHk0IwC+U}cbYXk_L9
zWn@sR5VV_lp$d5LjnScrv1XwPD3yWktz;|!9pD8@2%y9a%B-M-+~~p}0ZCzuKA;1=
zKpX5AsxYvDQkr8ExVsFhxO6~;2IxEj@Bi<>j<Hz4P|s#DAJqQYgw&B?Qfb)Fzz0h1
zphcb_%V4!iLl;v8Xdky@6O)V0fiq`7r-*^KRUc$nkZ|nGSr6!$x)3#te=Io}7(pj#
z%DiM_sP!-qtG{C<66*QlUt=5tk98aakE~`r16O@3q}~CoYzAfbnm<<HwRNBdn)Px9
z0Z{7^l<GVfHi8>wkX9q(0*m>ei=i3VAaWbPK5DdM1FcR4ou?FHJ;z1^+?NCOnVKJ0
zcra`LH#I;W0{5YkZ&$piU+L22{r^3<bp^_FKdo4QcrY+Zyaw&4ZDg1LiYw4=T2Op}
z`tqRq2$bBxC3_Pi3n)mzM?N?*G{8avbj}(mm_Zg<$1`v=YBE(=&tc#JwHiT9+h%(P
zKKYky4A%D<xazI{Gf33m`2;>n4%7?tU|0|CCVT&X1D=`!4Ku)+p&)th|L?(*o!-z>
z^{_R6o4M>dENW4jzf83@Keap<)`LS}vMd81XdyHt{%b+;zaBglKG~K*0^DUvz71M>
zq2>Mm9eAi2e!iI_`23F<pu-`-XP<!%XMu+lcyJFq#RUo>ko;>$h6Ydw!a@_aM;SCQ
z>;3=Vniq_63<p4xU`34#6QB}PKzvY;PZu}@%_E={-=F}U(8*Nb+r*#%4)}-vf7mK;
zFxWD<3fMaQX9P9(6FC?PKouZ(H)_2!=oTEoRLv`8l^pEHEEX_?fVu(`z)Or7dMp|k
zw0<%&fX<e#_^Ak5S+W*fID(1@iw6vx&?17hrRF8`GDtZA>R5w@R;CviF)OjX>jbqw
zr%w=MQh>G@n5OSHVpdZIXIS=&j!g_}G&tEWIyN%6=x{Q)I5shy(cxrL0xe^i9$?HY
z#uRBgUBQ@HQc&ane;tknMu#Q_4@l0R?q$p@%UBAMm6+aO%q$@Q@-e7H{J{v?|D*2;
zm*P-?Xkl;$UAPBQX0i1D4~rHC4uo<=M!0g8=^Q4^ZcHY*(*sPH|1qt4J3YXZc^lg_
z1rLU$8>jP_F_+dS{=WfgNPrp`;7x~&{||sR7=pqT)X)HLG=v>Qr}*Dci<N-|ROZw)
zD_4N_DF1L|(C}bb3T~iVFJ@qMoWvMm?ZBX6&A<S<HAKVe0fUD1V+Kk4Lk#Od8Nzxm
zgNXG#uZH^nULv40UJu&8>cOxAJUC^mAY@V-cSyvNfq@Z}Z4)&a8LYJ!cxvqq>TTp=
zU;(Xo_Fz~79)AQaX!l@P0-g^B&4t(0T@ta>WMFih#PGw`fk7sGFN+;`Rl)%VQ_%J7
zpyDB6X#-<zq^F+u|G(hjLyH9rz5*8WSbsqJ3@gADhzEl!c)k`i0R_@jlO_$yAc7#*
zdN8<wSAKv}XZ=(5EwBt^scF~nQj>vUdV?C1G~)%(RzZh)YX=4qYX$}x(0XmF2jE8W
z8c=S5VOt0A6$T99OIYkIpsqx?@DF&v$5x49ea+lmBH%4b3m60&UIr9^91_yP0=f<W
zyiCpe|9=%|yBWHn58QU1zTASDUoW5l)VlF&U{HWr3raLLNet`3O9_($z^!6Pi+FkD
zbRIP(mFXOo%sech#4ugLl39TTwC{AfjU}^;h1H{J3fBJvJ3!}Y*4#3#0PR5p<q-Qt
z4C}4;dNp`3ECTmCK~{lWY0<Rkg9pQsz0)UHGK<wO`r*N_1YGx6A7)^Jsj+Tq768Sy
z2g8z9kQihzn?VAkA1V%>cd<Uq03Le+iCZ_#{Q#8%Z+nF3VS=2Z2VM)h1YB^|&yxUm
zYruNynHDpE1_3-6mVo0Bswn{^22$X`umqeaYW7J4gm<#og{)$+s{!3!*~q{F8X>n-
z{r^8ylf_Phli{CZBNIo+9u_-r{6GF(VJ*uBR#QLsk%$MwBCvx&RSY<Qm=9OXv|;C{
z_h48Ej#E&Gc`z)D1o>7&88jKq<N&&NxBlht3hTS<oS?(BKsRB6<Y&KNU~rtv#N)xR
z2%IQ8?f(C-mH8zCYIHg_F@%8TrRz>^uIP;W|KIxG|Nqt<42-oZ-WB!NK3CMg{1E`k
zB|2OTdU{<9)0M56#p=zxK?8$(KxTumtrNrgTAQEi8odGvAoU!RfR+>ko8u%V50KnM
zt)Lm!e>oIDo&oW}9(w${Vy0Hm9L-q_EY=4Y<UAM_fTtNC{#pR8oI%HVLIRl405pmL
zn#%M3|LbVI_rG*-67c?)23~rGzCE|mmO}#SIS$7@#wDG$9MD>xfx~eUV~F>^G;m!B
zZW%N(ia-p8oTb)j%OO*%$zB4{|9{7;gACx*58A;Cs$m)%8Kzs?Fw5~zMB2nVp-};R
zo_c-KVh#_6ec%a8&|EMmbYQq1oTlc3qZKr2;r;*b3YZ*-hRTC0T+rl;_y51(r5+$T
z5C$i)WKiq!=S<Li6F3x^LHkqYf#;q<4h3)UwMbg5;K8sLoDsbL|A!CgfHpvb)>t|;
z{R3}OwP;|Fvq)Op;lZ#MoQyyQfVSpMH?U<E(^>?+IRPYQkpNoi0a?Rhk+j&sgJCZ?
z8G+<LmGblgTV^q)MN6l5*fPs;Edr;1@Be={Oy6M3tbuWCJgANUB?M4M6EwP>sM)}<
z(3ycL)Pn`wzXBii1sPH50eQR7i-F&viD3??#Q6<cKGMk0@cSUc1nb8PJfLGG7AiA<
zN1_~?7(k;6>p?@X)}6r%JQ%=-(AG07v}Itie$2p9!})>1p^>2koRUCuPK!ZjAAr2}
zEfAE-K!?PFkBI<P_6h(0zdpz?0W{(aYGS|!-$8T0$i*PYfuL<api~ViB0(wI`#)qI
z6-W-;3tDIkZdrpy^Fa;Z0?-+6_D&4z?VA|Z+b1zVTpZ=qU_B>zfpv92hX(_qoCO&I
z(htg_5DzelAbY_3|JSKCkZGVJ3++Lze$W`){|n&7FQ7JTJ;Q9|iQtTdkU4r*$0mjv
z9Zm)r$0mj)kY+!F%tCtx4ogi2E>N`!+ZzIMK%+ea7s!X;6F?FfDnR)e5mF2c$RPz<
zv}7@h1ANe<2gB@0aDN4q&m5cncfhiQ#V!s7i}?&(pq9Az|1Vde!QTS2!2AEd8j!^>
zY*EF*0a6dDZ9EtjfKwPk?f(iSb`G=>V{Bl9RAA@lFtJYeaA1zJTYSSJY4HZop#~sx
ztsXEkg3lvpU|_I1w1fjR(BZ+b6I`x<D$IHp_AQ{M!tawI3p^Nhc20ldz^uhIuXnnD
zBeSt5I0I~Y$j~#Jk)aPf!kftO!-HWKxaRWye;d340MsD?k1{7Rtngr%2ktX~jxSiS
zkf8`v=zIUaUpT$Tky%S<E;zG!|4W1}{Ywa)e!`JiDJB|TOo4_N7TjZy*gTIx!ZMD5
z2R5u?$-uy{05lGm1sPIVn8m=dpo@WH$tutgAZ#c_N~D%UNu*X&O9X95#T_!F;?QZw
zAg;s7An4Ep9$rxaH9j4h7&I2zF(~P9f*OhpGM#n|TF}M4C_^dU{}LFduW@2l%iBH^
z6tX%};BgOdpR8&LgMwAV|Nj<AiywF}Y=@QB9p3+MfeSiN5LwJ)aI>mo(DGoI2bKq=
zmYNdK($W8*G350xGD8-CQix*{g9zxN9MFjX9t?BtPIqu-mXn(S9smb*zd?3eBrOqu
zb;CUvwtbvl<IEg0oyC(;V6s9W>-4)W%pB7tzccbr|KiN-#x(olbQ>3DC8pVHrzf~D
zOEJx!IK9S&xzA`8cyowN69ag=I(P#}%d-X#hB@GJ668LICRPp&X$F?x4;fZCG_op8
zw{c}wsjvC>N~Au<b6suRi*=!%Y@k}+*|Cw)#8&D5|4J{>6_%VcVrn&lR)NN}Ktl?U
zJ>@Jc3=GUy7#NsT7#NtBKxi<#1i=RJ3F3Mc5;ag+eG+pB!~x78gP$-kFdc#L3A!Al
z9)w#M7?@l@@u<VeaLKWW>5m2{!zBkuX9zUh_h)*6JF^Vru96Av%o3oDp|K!!I-Cp_
z9hw-nSlcr&+A}e%ueJnTOn+h>Xqlo1!$R<!1t<;us0dl%*u<bwv+u+@i@6L;HS?52
zJQ!wxI{>wIC)T};2w4HjQng&3>p*<#{|ro^W#u3@fpCrd4F|`Dzi*%&-0Ax6%!U|M
zoTWYJ@M;Do&`3tDoyR(m0p9=rgNL+0hJYLivfQGESqx+W*s=4JL_m)6V3+}J-+?R#
zEu^fq@e-No$t(uqL(K_6=w|}yuV+FvU^=+K2WdbUz=UjoNTWLg6S5;G#xOB}9s1u3
zH0u7vGM<5{(vv}<R?cIcr3R?Q3Qo)Hj*W~HX38*u7j=OanAHFKv9A6V8|W<Le+Q<o
z@nF{H2k&73c@l&h-KW3uV3yTPv2<WygjqN<hJg(fG9X7xjA7ycTl^AihRt*XPi9$R
zcLt`3F-$y25<JrrJeg(dArb;$39wTUH<E+aKzRTEdj@1J2!p~1Ga<|e7dp^{u)(qE
zZwDyMt@nZw!YdIEhH2n7C@AP&MucpDB?RyPe-l7KGJTCFvofR4bPX?N6-XKk@M0EY
z`l|vuZe3yef>>sbU`qv4&`tCLwoDA`L3Ji*rg)=9=n?xz4C`$UF|4=r3Rz+OKlC_g
zK|!Z7lW50dCXrALHoF<mLXYWifR@QHNLVtMFxos~Sa1D`QE8@n==Aem%(2rgyqUXs
z13K*(oIx#9hbD$8(=T{4YfM*o%_t#bslec5y^l$3rac1#s8aP{=m)RZ0(Cv7Pw-(D
zvziQUBX-(@u6|-*0@d&^qa2(5mslz=I9u;yM%E8rL<iSjKN(y!BkTA6|6d1Q*)oGG
zTL$n7C(zk(cZ@4)c57FF8hfBYO3)wxXr3F?-~&~_pegu<BMb~WY+xVzfEt9LiQ`&(
ziFLJ_Rw6ZQ9^eIj;H#K885k|5Tlz8!*E=>bnmEk+f1#GsxdNmFv}7IB-mAXFpinD)
zVO@RnB@t*Kp3&i80NoQf1=MZ?wG$g^!DkAAM*0|_)`5Goj`J8kI8I~WskJwNSPi<k
zwvpjZr7DAh#Y@n{9Rp)+yvDjpHHJuq8jb)4{Vs<8dR?F@?*9qUU>himK)n|4|KB7n
z?HCwAEhFoDklYVyJJwoztgAoy3AD1>29z>EZAnm*8hp-P;{O|<PQ~;KdzmGsD=;##
zNPt^<at|CF8~)4GAAVE;QVv=lJKbO=lf-ltKW2fDiMHU8vpXQuK)7QU<kWM}5M52Z
zl!(Pr1||=NiQtjAMq37k&L~K%gU0G1dXZv|je!9aMAHK#n8fSXTP$Go_@Vea(E45o
z_$(PvM1eXc)(wn|kPdpt3J-<}kX8~Xi7PRzw{&1&Yt)QdvAHAU3Mkpn^a!~IO8OJE
zLT-5fKc@<EBB-9PNs+FwsAcf*V3+`2GGeiSMFKRM0~t4&;0r#>A5`grTGX2x88=zf
zGJ+0iV6kX<)-Y3%sb!`jW8q9i#<H1;jKwn*8P9q!Oqe;{CWKin>eoYyS_T!10}Rd<
z3m9B18W>Hy|33i_&4HS7HV^*)2YJF`0fS(}$*466&;S3oXkhfHcn&&R{^nDV13~RE
zP%MH1!2AD2@F;<WBFhH&1=bwXuY@xR>o$5Y%m8;zK_TP8Fax~8-$Ie00c275{{}hG
z;+OjWQWcY5My;4GFpp7U`htaw9MfAaGAY!9$HN}}{{hVk;Kri860{f4G!5KAwziDg
zU|k)u0yM4<>LY=MC_wE{>u7e+1shDDdkdTIGX{7tbb(u2V0q`u6&?&-;2|wg$b-^1
z=+OS(t70~Q_#n^!)C#EwbAD=ttnmK-w-yx2Ajz3pF+05f1%j(c?|%VD!J%;&v|tvp
z@V3*MLqNZiff>ApZXSaPXlBj(Um&=o1T}>~nNULlG~><K0lJVHb`~_q91w1V^f(wC
zn>ZPGKo(BaikiMUkXgRI3p|+vDvceQ7(h!P);DU#>;V;TpcTa+kAjukGf03A0%-J#
zT4Pbq;4m>BwA`Q*+`R>rlHgKRfq?<k|9Z(Dvf`y%$cCTlAuE2Wg>3jK&*<<op3wu^
zd50{Xf?gQ>dV23=W_fn76<RUV^Mjbh>pQ_+3&^tLPEU~QL9TOb`fmdgvuFfef^z_z
zc)>nzVi0Lm1d07O0I3CG&;~P5J_H3hXwQ-N|7YN|1X2%bdxMe*%$E*L|Grox{Qu+q
z|3Ap_3<>oNAa8({wEYL&0r1!R|9=H|5z7H7VnLY|T&zOJQ$b^*pmYUFxS-qw%e|oV
z3Cgh`hgk0g<=P(bJOL=UEFLg2S~4)OfgH2pS;!SoFoN0&^`LA#lRe}bBpZi1KmrGp
zjZcDe6KXc@0XK(1hJe(;vU8(m)EZEho~RY_z=NS1GA66UupXSV9T*rJHDeA~GBB{C
z<ZefXWiuI>I9nzvf>sdqFoLqRy00f@u7>PE0@(@j7$`@Ba&p7Vm;)d&Q115re-%8Q
zhnl0$<WA=ZU^bX;u$GZ`dT$FePkpsCc+?V{&-Q3n{80QZ2=jtPB1?w{Ll?M|gDz?Z
z&4+3HR^-?LvIdlAK|y708M2}=o`D52m&RuB+mYjdy%Ph=?}Ho<tnV|t`Mr?ihIQ1l
z22c+I<Xlj~@L=eH3@buX1j8TeJ^w{47P54J6jbkJPyp2@-v8g1g5*KH^G-#!xu87Z
z(8Q3?smL}5#CB|AbOD8V_o<j2I&z@A$E>0w2U=~y02;Vrb!=h*o%_V*(8TZuR2YEb
z)6#)~WuivZ8W4M;MocO=z-D^J?C@Y<08heL+WZ#)Z4w3r95@0MIY5W1$bynJ)DcXM
zO-vvMFgrFeu|S3mm~37va_o5R$Z_EHLXI1+4{|&J&Ba(Ka)7QlESbKhm04!`j4)=Y
zxTrM~ZDaO;T-|8@_s&GEm;)XRt*IcxL3zxfi7~?ZKSK_v4EA7Xg}2ijnwS@WHpheX
zfl4ZvWuOcLv(Wqh|BUGh;mnftix}2}f^nh;#4-<t7VrulkOiP|rRKdcdm!t@St6|O
zGvt8OdN8zrTmK+64o%DfAjg3$133^B*C2L7X4D#xBR~%D{(k{nv4Z4YWX5a&>2qvi
zkkOH0+aciC$f5um<^>JWcrbJ<oqi&mS*iXaxS(%HWSimr{~~xx56IUr+^NXY2Z_^v
zKN=F*CV&zPC?k9Se*kX7dH??hKF1rT9_9&$rhiMoQMG`<!J?9#!-Js(ye19gu-Pl4
zL96InKzb~U4lp!W>}SZaXyjO6kqElw_6uZ@b<^JuFfs5(xBUz{-v7U}dN43dkB(xN
z=lhZf*&zvPqy1eo-64!wto}_bBwhaPfu%)<rawPGd+A_Cz>M_%|3%OndJHhg9iX8D
zho--88sixR8Wq_(K<Uu>CxZa2-~z?G^#VplP~?FE9TWi`3~k_Y2c#C{FUxud2DZ&B
zAngoL4n%Eh909N4gcnkkpteREc)=SYXM@(bwt<UwP>g~DdnOy`tc(&+6T^d{4ZK<q
zBF-T(`yj(2i$qYF)COK~rw_`)Aj!=O88>ZS$mBTtAj7iR2N?@zA7m_>eUPzu_Cdz8
zvkx+ywWws2@L*`0ULDD-QNPln61{bD3!L&nEfd(R45%CfwM;<a0BM<=2Tvt|(h_KZ
z8Wc|6|BrzaE9kruP#8fH<ev&q_=40~RI+hcEC5aSHMN4oz<J-vj$!>wt!M-9|9`-J
zYmfv8gA)%z19)*HL<3ws_%O`r7owPz>fr?kxZIe0GG>oM6T_8GMYg%1$eHO8wE=WL
zBXn^R=+0Rl&{#8Q_j30^meU}%LleUhuzDwk^|Mb!Z79@a_zNjR{>WJGXUKtcTpGYf
zi$HSK9~Mwy2=-Jx*jJ6<NC2gT*(X6B`uzk{9)JoQ@BhERyKumsg6D|FRFFr(>cKhU
z_XKb#EnwT>!O#M3E_wg|4c@c~QU}5ojcoHExv3sJhUfkNKRD39<CtItpb%?hpXb3)
z5AITV|Njj-4bQ=1K7$TKV*|L%0b6<!lnwub&L;#_<KWZpLE@k;5vbnzq4;00VP(vT
zT2+OBTFqqzpklzGk)Z%o$Ai@!WB_OVM$MS|GuDTeDEwe#1fKx`8ojN55>^5!z~+J5
zQ7;%789<s|A7lVs0rvq^p@X7k^2?YLpp^)qG&9j72DH$Z1=KH@sP(J^G?ooo_|~ZT
ztfNqi`9Elo78LZLIZ%hD|23f5YFj4;me&up{{Mh!s973T01jsG2G|MU;fhX2h5}1P
zh5}0l29D_-vCLY0%Q!q3=7Q4{XdmMA3-cLe;lpp-^`H(RsMP}M5Q4_QLET|c$I!Yu
z=0eSWZP0Em1`E(dd&##eK;z`rb7D?FW{I1?o&|ZdQ8V@exKY}~0BSUXD!V5h407P+
z*^57n0+7Z50}p8K6_kOj=P(#pJ2047JZErK@L-S!mzJQj-azwP77N%fS~M{5c>li!
zZr+1x%guWjxWJRNuIyVj#(>7g?HcMqyG;*&u0TxGE|?Bl?FBl>kHrP#EJS{0P<W{s
zdjo2<jI{%ULc>eYdg0UH+Rgj_{}7PvFq=U&n)m;!2d4|fGfUP(yJfHrHK@k`S{M$R
zPz6n;g2E0o!ww2ZaBC2B#hc=P@Y;WHc-BZ)G&(H-nF$U@P`H9Bm4!-6Y(OnWu%qt9
zoY<(yPyz~9&|Qok3=LqfgFI1>2wbKd&^jiN;ET-I8y3k74h~IBFFY7(z<JS{5wcGn
z)ZDa=W0U|L>tn67#K7twgMkM_4cI`?%sQwG0~&SkV5k9acL$3(U#@_PfeU2No)ixT
z8Bl>;&+y_OGzRB0@WEs7KZ6-)(%RxVgMtTxEO?v?<S^^)3|uhBc`#IiSN(ue6v#0i
z4AtPS4cJ2E(-oj&tvwj3!I2NTAPv;8_h6_7=Vgm|415*`7+ftD)U#i#Y1t%F(;@}l
z@d~ok`~MYiQU_W1`ef`4Q2%M8IRl6FJq8CzKCA|pxuC28n%@HzXBJCACxzBS>M$jS
z^+=8cx1GU`Vm@2}%5U|1y+k}1s=;lAdeCGanjv5fP#=NYWMIw8r;#;7x-TlHE70_U
z)q|qIgP{tXKfrpOFC*!#0*3&odIRazK)AjRtO1-4K#LVX>A(4L1^QwIo7v1J^`QO+
zEJ1)0!;9M38&>}qWIzc5lyE#4s=zfgD6v3%QU%V<VAp`+=07M1DiQJLd>OQXP053y
z5?mO+w2i${|Nj$sAp>|5`vL|*P)e@<A0*Q7k|9tc{0V4917vp;Xnxg$p%Pq&f-D3z
zX+0P!!Hs&5h2X+GX^8<O1y+J<1CY2y9is&3egF@K%F^j3$;|4Ed%;<9`bjG$ei2Y<
z`BL-Q1jwz`tSO+Pdb+@OMu~b*x&RetHS?4!UUbI30(IU&`43c_fwH7^b<7Fx|35x@
z|8oFGhxb1_@P@>Nb_^Vg=P@vV%IaDzc9YE=v2S#^K*#Sge9_?o9mmUX22`zrPGWRy
zV%ng?1-b%;Va7sfMvaAW3|yg{EOwzTETMK5FBuqX*cBKYo0#t8g4YLumg%xM)Nq2t
zSVC$z6&xHJSp-1&-6G-twU^P17871Ea4eK#;F`$AzytCCXrOjNW}E<sJ<&6cXZjx{
zCY|XQ_A;{6gOoRFF))DA>O?J2M-?;*^&h?p0F+`Z6_^;pTUqQtMa@QQMm6vMKY2l6
z;Qjyq6wn$S>wgSf_4l+yYV1EaI5aT-0mXrJ(-H&F1U{(U1JdWgPzD}*1l2>1O$>WL
zL-?RuUKu<X%D^2vsKgTM#|(@RgBWIjif|8xa<DvTL<E$E!3KgeU=298gBq@&d&;0{
zVdGNZz5O6dKtpF93=QB3dXWD?4XnkTv2Q^8p*Lh{#lC|q++dyT*vK3L@-57#-v57S
zLVWoTeCfsX52?%|^^3b=-++wRs1^Ip`Zs9lAtM9Ge;{XhFjRp{Jdia=B`puAq;+Uw
z`ryGJ4xV9r@f%tQHZbsl3qjB_k!l75>jMm?kU~%boPomIK<kviH5e}_LwNr`X9zx`
z#8!cU6*P<uT98?PlzmI0CIiPzX$BrpGsx1*t^wqYiPj7pFSQuJ>y9Mr6aIs?&Taw4
z3@D*2v}523)nc>L;9>v`{~Opk{r_L7DZ0YaYsZILEibgAnHdEb7#KAe7#Iy07(i@>
zKMV|v3J^A<grx@qBgn^~6;+_|aEpZh|6ZJo1Gicl<zrtoyo}=jXQK(r7#KEs#(r3^
zkAbDu)k(zC>;IP;E(_4~JvjBkPE!PB###>cEf!1vf3cXy!1E&W*#yuMwwh!o5f6q+
zaO(qP;evUPx#k5cW8ZlH{}u}pTPVlC((pg_#X`^6ca|FezgT)PaMx;D)r)|}cqiJ&
zzHn${lvx<fr~zscCu;ux59#Fp`Os+1r~_`OHT`)43L%Sx|KGj;|7o#E`2XAc{~y$e
zYw-TWKN%JY|9^V_|C3;m@c)<h|348H3IG3k|Nj#J8U6X=0df$e-B8aUXwkr+2yQq)
zB3s7#0D~f=;cy7N=+gWDKNe8*fG}8N0t3TK&o~C;%<29A4+luTQJPT)IwH=a!NS1k
z(D<*Vh6TK~`~)cOK}i_2^4k0VS5J^xHs+5Q)`QaWOU^ikM)%ksjT#ILpz}T^y2t(i
z=X?!NuKx|{4ufx^ooLPI;{E^koaqy8GmGee!U_~7ki7rr1BmVY|IZ8L^a(QE`~T^;
zkV19kJx2cN8JWy{oN?d+XhLS(^!iL@`}#NrQ04*EC=<0}Ux3&k|NN+py#Y!(6Sd-a
zKn+}rrsW0J|6@)xGBbw!RA*oSjbwq=rA=5K#{ptnEMT2tksSMA!tpo}5Fa%9HBmkG
z2Z%jUJqEN_X}!gR|Nkd)#$EvVf5WrbH<k?l|J&3*Vpu=X6Iu|m$D9ErM^Fh3Dj-3n
z+(eJqFCa&Oa<>OVGq~UZInW|$iGv5j1aKz?l-nVFlTU%5r26~hvkBh+EWslH-v2DX
ztw2zf_9Bxp$ov17yB?52mEom5qks)Wa5H$?<z+mhMWa2VPa_v-u-*f7*W;c>F9wzx
z&Hx9;2F4?e_KYr&B*|#u{m-Ix`j0GT`T8R@E7(nRI6##E!;uB^88sjYfI$aje#lZ5
zJ5a<!tod{jY=stLJ2S{H;P}=8U8-jRE=;`tnS&?BLHZ&3Hi7*K){EpkhsOUt7K+o`
zvY9pb;sikb2T*_Gr`EFx)AwXEYt-v-fNC)4EeT0WB0L!S!3i5-?&nglnIOBNW22zR
z0h!d087BZb=mcaMq(En|0m*^F8C2_f|Nj84$t{vrXLvC5f!dPb@};3O_6PJHEe_BD
z%Ih04W2a~5Fo)}*x)9VO0{I<;LE&SOw4}j<p%1(?6?DPfbcMB`j?4>Y>3UH6`-kE`
zM^Hr%y7al`pEY<jD`?^iw6M{Gp$5D;9kM=$$p+My1#M09U?>2O0D`QrSiryzst_!i
zmYncl$Oi{6$Xj4DD?w`@81Gm#FhqmYcrfIGdzPT<e;k__Bn3L{z)Sw4L3?v78W{AT
ziq1~okjpG4l?xtug;bVI;FXY|{o@`CxpSvK$YoZG$^-k!0(9xB^W_SQg^Zvxve>-;
zp9Zf%0Xf34i4nZ2(jt+uz=J^&yne-E9s?t&hVfv?gETfDgU<4=2iH~>ii`*9mD#sU
zzYxT%S>M1A>%ou%X?s_JPMu*~0&)PTsr;Lfv7tWhLVyQD4tO}DrUER#rap=ty!_Il
zj)Ad$-^Fzv3}Rq;sADWFX22}Z1$XQr9<BrDk=Klj4KN3Q=3pj2$<~2)+N~8pOHh_J
zcrbK>I}P6d|ATk5fuaC}LDeBd&5{cq4Bg;1BgF7pa2w70|3C0-8&u5<4~FhukUsDK
z|BirYg#M)-9t_>!UQhkw-}Mz947K2B@c#b~JpGTPkimnY8{7zhS_Ct&1kJz<4~A}V
zs~M^e>~qkuPH5^BJQ%tld(y#CQfr&Q5XZm(3Kq~ghNy~{yzpS?0tYSBP;e^(`E(12
zPnR-yFm!?A9ipxV+zf}9`S%QH+FPRDQk8)dJfQKy8nk%6QG=6#19XdwV<S_FEx5HH
z-eKu==mlnLf#C!L1H%t!iy?x6fw6;ufpG@|1L$H02GGq{;6tE6Eo@5#1D4+h89@85
z*MqvRFHXgAfqZ1~n4#X`2P4CTi5d(H*7xE-^N9hV6lSq#=?M>pso?PVeIHb={-5!J
zkzvB?gP_qB=4GH6JJ2>K(7*_CmIoPX>0rPNqCsjb68_Je=+3}kskC$hNc~SW1_o3;
z^$ZM_4h9lP8oD7GmVx)eV`>1a7e`Xx165yv-2$+BVI=hvpz0IA>gzFF1lAygq+udd
zg9BItcJ<%{0QK=CsCw|JwKzNgzH0!azTP6?|755J0bCY9<B$^+hoJZaISw3MhZ!Kz
zr_R7&v1sWJiv|X8^m#B$0r!KUQ8xu-E-d;$mV%-HRHyhgFw`qpsxt6vfR3qeWGK;L
z{ePpTOS!_aiBUm^_5XG71`5{y*J>7PS2#5N1Mi8jR4@=jcL+EQfgI7a9Nd|2IK{xz
zu!@1hgP{ssv_T!x3v&d>a_|3t57cnfGcB`JW#9w(2xO=RCj*PcqNOuH20AuEPLQh9
zl=rZ7TK=JCm4}w4f&nWm1mKCbY1s)-qV-^?1P?w#Et`&JSqL-~MM3t!%&@M%7bgL-
z40NoNMbmNtkU<Tr7+5?QD!~i;p@#LL8O8xMOa#R+6tkAyfSSeN!B7bv`hc3%k8Bo;
z_y0e8reB!PC^DU+gxQEG`{8z*5@s((#<=P2rOe4p*$bz?DP>jwt(Pg8E>Om70$MIr
z0?KosAyEbf2F3=^!CV|n%aF&iK=mJJj0@Cx2HkiIIwA+O`qQF?LBb-DVS)!kCb(|3
zv}fSc&}4n**vRYyI`#x~fE;MN5LB&!4$rcl6PE$jm&njyeTzZkr4@s*z)L9xj+ZeE
z0xxSABz`I~bo^vwX!z;KQ1CO6p~8b93*6QLRXLVcpv{>~5}j7lzm+koFvd-nE@yVB
zhm2oUf~qX01=cm7o*e@l=(JtX*q{eP7WiZmkbZ|I#tWdy2#`3W&ddZ?;1D?`okmMG
ziTb+R;Qh4@O-wQtjSLe&jdBkLad4I9{eLOAK>%t;)*t%}9@Md@oPMvInbQ-pXyNJa
z3ebp+MJ0oo2SWz9mYDpLO~U)1Hn>6M{Z9+*7|_xh?|)k05CdD@$P@sw$ov0N+vx@s
z%%b&)3_Cz2Jm{>I*9RFccrY;Zyr^Q}crgpKCsGbvj6#|nj5(mzmUU)aL5&?~7dc~$
z_x~l}p(E=W1`TAFCbYEO1^L?h|8h-G?f{+I3U+J_$g%0*YRqCk10N`KbU>~F_1wJw
zF9V+@1UrEX<QUlbJD^$}v}k6!Ksd8R0;us_tLzQhRU`1CE3U(XAssx?-f0D1Z4KIR
zd1JvY$mK+!F+T7Azb--=LyQ_5su)1qcfi+4fSd-x@Q6|d9h;n?Iz6M3*~$*GzrY)M
z5+g_*2&0+nx}l0e%lrRd8_*eIAbFVUr$4A<mK0z3{{>QcrC^c3rr^Pl&pTb9idif!
z72F#DCsEMu!Aek(lL{Vjvs7SZ1P$43v}BO<V2}l;I#}3y|NjeLaR6!!Z?pn==+6w0
z13;F8`dFa2oZeE!Y%l8Akqlq^v;>sze={;POt&#$mZ<;zkYR`Q0tP0~;fnSS42;$)
z|NmL1fR6uW0I$9W`38h*?b%IgRoP86<QZ5%12~S2j0_$OiQwX@`X%@j4gqlFH$SeZ
zRrC^>%?X-k%LdEWFkf(}$#g4lXka)~Yx#0rP4&xl9d%$AO<!KkEFt*>v;a@TmO%)#
zh96YaTQ`DqXYx)LsAd+gFY#cA2Ukzvk=1(X3eW%!=$e#TyB`4#P5)g$%0Y8-AaM_d
z1aOND#Gd_-0i+kq2ZwM214I2iDG`vI2SXO5X$p0mV*_NK2jp2$=)GWMxbT{hq2aaS
z^l$P^TJX>YB~<VK{||uFc>n)@2VRIlmuG-t=tX8+$Ml9wW{v3{@0fUeK<BrBmI1y<
zVUT#y0$OtPV<{*Xg3fi*kYi8>ZRGE?hooBQ(Rfy%qai?-IfA=2pc8)<{(k{pDE44F
zql5$~D_P9{Zv%3S2ZL}c*wKm%6Q)nlX4a5cu%Cg&Vm<?S2-o}nR!B1+Dl0QtAd4pg
zoCZL9AsrIHw-|zw5NL+MBAI~$T<ZRVH03rl|Nk>%@&A9IB{wte8Q5!%7=!bh2SXBg
zrU4Wo7WE9EMOp$L3`w$}({gmD->qeqHA=h)cGP?ZW{U+3%od3ZwH^$K;H+)Y$WURa
z@c$q9O3y@wf{ls{)gBCq3#aSUF&hZjD*S5zIR(_B1Z~fpo>RxHWRwVA<ZUqz#WZlK
zg2Oc4=?ChV?HJ>x|F2^<l>vnusKx;~35G#S@Id0z1L~ReCBc1hNJou9#9{%YB=ca1
z-wL`>QUkPvOJMqga3=Qp!XJqYpvZUl(a3PZgCPT44nsA9PFn(9gvs#xAVY%(Lp->3
z5B4VLEJ1LqJRaH`m;>&Zf`SG#PhpYBPyq@{4~BT~qzbA><H3~xILI2OOVu$8D8)kx
zPtdW(3m7;o>OqA@Ja`D=^+ARPP`a5u;U=?eJ?I3=hyQ<ooCiAW$gzpx11Rc2&4m~B
z3=A*kGjMqS|B?twjGz@*(4{V*Ws^Ce`)ol?0}qCDaA^c7{TY^6faX>kKr67~z}^FI
zCwBPH1ZpZIYW`;cZKJK!Y<}`Hj)5WJryT=Fr#%DjOgjeNPJ0HvnRX0(o%Rg;Gwm4o
zz5oBu1hvLN8Rn&CTn6L{GlmohKc(UKO9l(ja1yAT2gTJ-dj^Z&uTmO7aRzFCfSQ5R
z5A0<W(E*tP5&^ZzK%$_m2`+Gx*}?4$kcq!v#$|Z_|Gxy%P`S~_tX~ga=mzl?V}YJ6
z_+(LV?0GQ6f|C|l-^sWR$4QJ8;J*9e&(PE#3m#$s$%DqHtPe1-fU>;xUXUICd_iNa
zHcbrcZIc+*+dTNsWO2%_0W?<CsglxRv*`c-is$UdEE(z<7=L=lRe%&(EG<j0sAbdm
z=^fVq@-FDo+8@gp7=FA;nE>L?R7vUh$(1t0`~TmM9t>jO0cucf?ZLnW9)Iy*;0D*w
z(0B~-{-*%hf%XqF84BGB#o+x<9^51ZtE+E>9K7lMe-^Zjzzt5DAW6rj|2Gi3#r`jG
zn8XkO@-0$4IoLA%YXI$$hUF&^-Ra4|pu+`TcPj$A>#@>{$)!fi0d$qYikF%U7N9tG
zX!?K0LXly?^onL?1@H}P-v4KU(=Nyc<Q(yOWn2fSH~{4gP*L#H7L@FwA;mdLQ4sxb
zx<DPXlw348PG2fA6#TRWCGCGEpy2zd6$jdRlrUYSh1s6*=Jb#jX4m@Jkb7WZ)xr<O
z|AwGVcc2D~2SXINL<Ln777Ywm9t@%2E^tjIsL980;P*m?9lsAU9I#%%zyMl(3_8RB
z<TKF9UB@N{3yVw!Mv%T*d+!PlhEVWiM*V+@0MO);jy-sP)|KfRt;~8#D<nJ^BEY#D
zltn>(7EmaH?QL42;K2|YI=!NmIgTl8>+~C~%<_z-(|@!wD``c7$0tCoMbMm<_x~@B
z&`8SwO?!aEA>N4WobJ-btj7kjCOma|MH{mj)8{?YH?%PuP8YRg7MT9FjaeE#Mgp=L
zgsqiUIDn_(omN<Y=FO~`R%lo^EoQJzW)QGG4C(2B)PXRl#OV0XzzDi%uHYHNe}{RD
z3u=zBZvibMb8KQP0k!ual~gJ?OM#|qK+`iIG0@Hj$0i0>1rLTG@Yo0R=J*XDgOPFl
zzSkAjO)EUW8o`?=!@v`0pfIbS{{ghG?#lEx?aXHNjNm;-Aj2)1K%Nc)4^eg6Gq8Ye
z90QGzg5n2cw)LSE0iby6h3uIFnW12@fPo2=)*x9c7`(a`8nAaj<2E33Js1MPfe$hR
z#J6Z#5#hlQ1g<`GrZ4Sa7UTn43|0g>2V#1|WoDBI(E3%7au0?;@X#On$*CdF+3af7
zAmIj@`h}=X1_ulHXm19{x_*nM#S9({0pKhEI-?vk0;4ef!E|O;qXn$*K(Pg?zCjH!
zQ2+3U;?IfJ_fnwO1cX9IzCM9#;ripBr?+=9>(qm%l`ZBmI9Mt$aD%d+MIyucnTibS
zJQza36S1HY-qMj_Q=%pV7bqL1YBDe<YBDhX)B?=}Oa_-UpvE(Jd3PeiE)RxKa5l7c
zVBoM-U|_RoWT*oLX`&YcQ=%q=xWxj7AV@92ek|2XiE%=zCWAzx7w8~12J4@W3<rKH
zGMw=K54q{pLXoXtdctZ(6&Gm5B>>rF9t*B_K_$kF%v1pnhFGxYpnO3OhFGu@EEK`l
z60QgJ9A;#u3Qa%Y$tW>>!fr;E={LHVMe7~@Gl9YjG_DWwC8&`Ga#^A#0~5%__J<f)
zetM)_02LzOM)JL9Gk$8N+yGhgqcc^)`~N>#=;b^t6Sbbr@ct(bZt!~l6N3~WkAGKq
z|DOo%9W~l9Fo1Fi=#VtWc?=;AO$-Jipqd)3g|}sTLpQUOkr=pO2dBQq|0^_PK}$UU
zgGwAm@Bjb7*L;I&Igr0VTT(%7=1EyH;66R*9ENE<%yRXq0-*E&n%D$&h^^<OT<~BB
z1rKI`jCE*Y)cKvrSOLnxI-Csb4o%<*V3rA)&t_QP`~L@&VL-RUgBNZ!GEDiskP);o
z6+G+%6|3otXJ7<vI<5cvy8?7lRj4Y99cYeJzl%X!r=E+!y8h&c083TyUC)0&)9jA(
z7%Ci^{vWZJ%fJFEx;z;C!85Z9{xUGVn8V-!5_@rkF{oD2O2lFbgM&p2gTm}g&;slG
z;Jz*BvId8y|1GZ<GIqR9WUR1IWLy9bhsOU8U}r6Yj=xF)H3wjgz85tN9@cxoM`a3t
zs&b2D(CU;R@VX2ze*ps<$RO|ktH3oWXyG*|i^DL)qW}NF0ghzRbb}pCqV=qxSsA8f
zux4vbopgmo0_!_a(gH0A@L-4r&ozU}E5{~=8@3MrnLvxNK$By?7cz8!lH5;4h6?Nb
z41Azr2=D*zAnm({3<aP`UyB6{R-gjGq5*V<-g|I;V(HMzV5z{!xG|o=%wnTGgPr&P
zKJeHAJSWyOICwAwg3}{-?Z%SVpvH>@sGWwqc0*$Nf+@^wOmTwKZ6+|AaXsH)(X=AL
zgCW~+dd&o89nkq@>tAH1DuKH*60lJjkncdt93Z}n+&ev>pII`x5!C1n02j?R4;UCb
z;~01s+A;9iGW=(<p3lIS@ccgmsKHS2y!i>}5S1Sf87gKvGSqHVWT^B0{|20aLC0ml
zz1;j5v<yta`~TaU(+~7BOF0FA_Z)z|ZO`E6{l6Dn>>~L%z=I(GTpoda-0~RYV-HZ!
zVfvUW2HcE#-N?`|eL)<v0_aRH@T@BM4Bw^|@DV1EtjzR=!%RHjvwJ}MWJFRxT{_4D
zzMq2D`@kbW0^sHYD3rmYNdDmZ&SE|T8_0d2gzdrL4<1D8v;&_A)$Z5?KI5gsv56UU
z?Q$EaAaHDAoM55I23b07@Q+cY9u(9b4B_B18<K#SFMtzHBHIa2g7N<U8r(OwzRzF>
z4!MU66(Apj5{*RzgMxKELxA`HH{d27sILTS@PN{Q2ZJ9ZA%PMRI5fM#jaravK_xk)
z1>wi&I&BKGQJ61y=*as&<Zfq>8DKTw%GeiL8+C(Y9#y|DID3O*0~9g~7(76Y8_d`c
zivoA>UMI4h0JZgzgFvJHMI8gji+KzJjZQ1TmvSsrTJdF~Bin|Jifmgv7?{B&Wlb%p
zZN^lx(2hY5TwMQSu(0Gx>6mECAkp!HfuYfk!C;~-gG{3xgULi&28D%o3@n{-47vfY
z*!EeU{Qm)T+4f8i(7mt>7k($Qov=^%*HB%}eyr1;p&qp2k`a_~K?k=vG%<iyXbV`(
z2i+3MHo=3z2kd~Cifj`qHJMy$G(n?c3^|RUbDZqKTLVDTwJ|Re*(SVb1g!vn0}e~b
z_2vvN-v3{N+X|pE8Fc%W_y0HG_^e3*d5A&9Vu2KchD8l%7|sV=Rf7W1`~O>TR+#QF
znOV;4zXvGXK+DlUJ_m*0M6FZ>@Bff<)8R$fd<G^^<bV=~2ZQ%lkY4%vFW&$EqnsxL
zDh+=hWSe2V@Bb%IJX_ym(6C5k+wglK+l1c-*%o*(c!O6^y+~x+@S+j4j+O;H6aYz^
z3?(lb!7JF=ELuPZ=z4=kw;Ju)BrF{mm}bT^NJ1K6f6rLoXV9=%P|v^yZdrj7lD8+w
ztquFxB*3jOQ1)NSzy}!>>;f0np#C7(fA(w=-v9rCN2oylv1kNE1T#46L&o_2=6EnL
zK@v3h^oqamgXusM@gRG^`Mkbq#Q_h76v$WwM4`otc?=vc_JLz}g9ifxxI+#q_&gXG
zz_q9M|Gx$BQ6E+Y28e|WKA={?OU+abP*=dQ34A#C`j?ui20t<xG(d8oF5r*MRM3G&
zj6a<jG-{REOJqP56iD(%W~v5gI0@u3&}a-ua(Y4yv#L0_GGQ=)Rwj)<8X0!{Sjcc-
z`kkrFQhJ`?iUJf|;HU);F?d3J)5x#`6n~Jx0Z(xGG2Ledv(EGf^BFn#L3V<MSU^pl
z*Dq72hfiY;V4OOA#WdzL#?<Nj)0qPTVIBha+K@ct@FSB!0i+-5AyC5+<RJx+o00ru
zfz3ZE)1ORd)?##@&Od`$T+$uf;{*jb%&DM5s5}_lr`yk9c4thT-admlfU$J?jTy{Y
zQmGoC<o#1C)c{IcKxv2R0iKK!lVt)qrq|457Gq4EK6xgyHe>4a{WF<0MXZxn{IF(P
z2|7cH0o17TU~o*F{%0n$p6Et!Mg)zefeJIwk-Z)auG8&jF}H_p0GDYH<qqI7476qm
zq|73Lfz|u(hO3~6f|QXC;9VN^skbYj^4#8kH-J3`(gSLXTO=@uc>mq7aJtNF<}|jI
z93BkutkXMYGg}3%H1Ph%0?s3#Mgyq)0h#N;U=NN%nA0p07`VOvt_RQ8qMErLY&WRv
zaA;z%@&3o6IbCE9v$Z97=Ej4;9=rmo{^(~Ur>zI~wb6_Lm%iTrn72;vn8R#TztY0`
zf2s#G$rXD4{{t?fERt3_c>n(c?h9Kat@QBz|7RvB9W-jDg6@w8tvduy*#2$=U8TiP
z0U8CfNLmTLM$39XXpAZrJgouJV|{>u!MbVX0+?QhMh5U$0Lc3~(=F#RYu3j=+RgS1
z3^j5d42})|!IvmmA6jVuslV*NH7u&<)~SLFK=s@@aCr&|BgQ2ldFw^Z;0;e8HpDDj
z@NgW8S@nO{!Xq9LiEF|A3XoxrP5;3ws5}^K!383y%Zo?=kaOWs9kLc&9))DGfzE}9
za%^O<(BNcnaBO4*odRm$*u<D&k^KL>rRM+hA<1lZ^%~3!91e{P8s7i^IwBqG$zYNE
zf4-&W{}mub8q5rmj*b5xG{!S9fR6-i_-|6H$-c$<KDbQ++7roIsj2n^wCEXBN_hWW
z3+@s_d~E}s%?CLW>Tp)?ziS{JD<=kB@VPXNT9CN4)cpT{qE@PhLnDI&$O4d|wf0^j
zFET+jlW*blH}jZ%K&d0p`#<E;4^ZHOoMox`{{+No|3c84)gUz%Nh<?97^1+<?&%8i
znI)z#n9nT6wHllQz5o9gn10|NBV={$?}h(gfSR1ISEjGfu?6i)Vz>iJOuri$8m!wG
zctFPjz4T0<Q9nlsv`%+D=+Jl2DR3`drZ1?u`$(kL%OIdeJ;1@CfdO>CNCW8H8qiQw
zB{Ta2P&W!xc!8V*!l3RZ=(r*4Ck!0F6B+8kIS90}2UOpHGA3wGxd($icv=S3dZ@qq
zSEqh2_|~TkP{9P+2L3vcp#o$H=olf;D$JK!=_^2%fx0HOnvX<4txu2xK$id1N?(EO
z0FXGy@gTWMW-ayy$dVuzf>JAJ?#!YVG}&thE|EZ;!|4kYnPjH_S->n-ZwIchK#DCD
zn3yaX7??mQ+0tp{28%?tfQ^a_Z59g{3uZDhw7$$@;CSi9zyO*81@%EZ7$8}~R)HD3
z4sW6&Tgc0-^c^6dHFTwKuz1bDQq!#@(vS_F#{uoCx9Rj|U<>tNv$N!2V6J6%5~-<I
zaR4n(>j3o)ZJQWa!0poo42+;N!a%((%bsToK!>_?s)KhIgN6xxK#r|p(*W)M|I_Kg
zzyw-BU(4=X0Xj~_Qj>wXR>MoAMg@Fs?;Vi2wHn?PAoCoX{-1%F<Jk27zyfv#1~ZEX
z3@o)>$rYe>1L#P`5Ox;31*aGoYS;}xBR)0@PJxeAX0-HTFo23_SZYo$TEwiBQL#$A
z19VJ<r5A&YtR{nm1{dr7S{*NuPEQ7A$HxCBDl)}8K;0FPBS4*OOHBrWT6HfGi<b<1
zmYNJawGQ?=H4Oeb4W~iFB>zQfURZ;-X@NWl!Zj)mp!4q=raxH7Y*zngtA!%_0Z>04
z)Wrm)4^VW2^nd~iG;$4Zaxg&l0fR1&0qq6>WdKmDfOds|R-}P;iGXVMmzwE2nz_<9
zfM(8X%B3r6ZW>ouB{T3?ax$>ga~=|DI?2EQx|<fXq`b4<lYuQXp3TnsKLd09i(eu&
z7C#&u8<-Y=JO{dG3N)1tnpy|<JQgyX0EKwXY~>2j9c@;iqWl0jHwtuWz+*B5<S@{X
zD99m=nxOLOgM&jO<C)HQ2B!KKzY#HN?<G=SV*!d%#tk3~LF1+%3qa8bGtjZ=|CR+A
z3=Ggs#NhLeYdx8lS+qP`5R%Sf2O6*ht@}WV-4rab8vt6;=)~~<4*X)Dg$yTNA7rS%
z0Geb5^}t>w{-5#c;D7L9pH~n6?|2Q{E&lNT4^WhVq7H^Z$pduxmSs3&0Vs*ow0Mbh
zwJ<PSO<`cFo4iP*#v}k#yk~&Q640$qpi8<yixfaN-hp=ZZYXA8ux?=Buqv)+U|O^S
zG`fvAejj9s`JDg%t@koWI5si(EVN}{s1XIP+<o)XmO-E{bvAhJAJhneHaV|=#@t_K
zG6;b5fI{bmCj*CH1B>DdM+Oa$Sq@GA_kiv`s++vH;?+Wi4y$VnjG+6EUh{+QAmd<O
z=KcR)0LbF$2}_x!>%mMA7lhG5>;fo>I5hp+0rHqdIRgji@<7lbf??MV*aez7$pxCZ
z*-g66zyS)_n&cS)ptKDOTx<c`v6q3_qJiN*<boSZR`AhjpyTLj<()yN4Nd{kptJ@m
z<3Nt~{{Ihg{s=E*2*&0CqoU1$1}0ku22N0>Pk8RYP;rd?7^o?e$l<_X>A=VUszE?g
zFe%3v6hPw<DbE>rQaKnnCnPd-{{S8Kw~%3i#X*KSKU6^j6p9R8GZh*7K}$q7Ix=)v
zDll+afacvEFhG_+D^B-Y#%xlbz5&!41|{{G&I}AQT^JZFGePTfnLy<QTc|6WoyAfH
z=9<-7A~gyc4!#Wx3ZMcJQ~-j)7KSYjFt99m&A?FG0WGsmGA~<j0#;rznk+a0Ew4CW
z<rSj>I7OQ>{J&%IfPtY?nSr6ui{XE*rgg<kWpJKcV(In&za=*Vv!ylzQ>7P!LampR
zNG)eTKq1?7v*pYV908y+-CZiVrq?ZJw&Ut_WnijVtz8l7IsMpjW+OHbKh$&jzvax*
zjGEJ>Rxm41w>``(TmQ!q)M5pVfq=>YP_+W8O29W($v9Wk+%~STNM!u%!C(e%rCBO6
zeg^N0Uh*0&UVp$Bbj35Hr6S|^`Uk!`-v56If*Vy0j1o2v7&vVm8kj5&GAD!df#MJ}
zL{`h-qhqPS*aRBYtf&VKBDpazSR7<7+^EQ$4T)?9PEZ8TRAjETSim4Xk&!v~$1?`d
zX)jz89hoaF8kv(p12Gd7nL9if%)re;P)%;p$oShLk)hjz!4y2;ZE4RS4UJ=v`5hJu
znd?BM@I*z1A`b?6u!p=F6`4Wj-g7xLG0bRGWNxX|l!mV3Vd#MS^Z)|`C=|T^|1_;n
zyIlb~&l1$#g@}D!Xrah_pdxvC-5e(M={r|4^YA<VzwkQo{|(UfKA<7Y$s1}!Tx=2?
z7!r~hxV``Xz6oVBdjJ1@7Ru)F{{Q<R$RJQ1V3EMU2C6?mt7JO0(kFln0~_=qTf`((
zlkL+?t@H_?QVd?1utD}6b!wzfDAZzT0M*7XGSVkhB+EajNM?U9y<`=$l4be?4+bf4
zXQ|UZeFA8TH6)q+AIPGR3<IN(EDey^A3*9s6<4jMb49IYaK%jf^y&LoF)P-C#zjHv
z?JXVt{|9BnABz7jcB-dOsQGVQQR!)+GgBRG0c3E@K79hnaAbpF27(+o(>{HILlc7q
z$Skm4dyrm9a7!KJI4pYWVXm1_kj%gcnydwlve`N`Fxo0Gy1?eMK`G4o0fWOtMF#Le
zzNuaeJd+<Xa{P2;_~5}{^b(XsL1%k_a+$?JMh=Tch7X`b;lUsS9-089UWX>ef<{G#
zGSC=@Lla{P#11V+XOKZ4i$Ioujw1$VmqdnwR4)c@kcCi7TBpBR%`9CHo*{yo$Ae@Z
zgKa_sqb&nt)r3Sw21^G9j>>HIW1teuQh}iX<fe^|j4Y|y3}UGq46GoxPE>@r^JgN%
z2avmeGBW&txEXSFF2oLo70nMBiZtXI8XOxL<}@EnV<-a;@Ha6`(2!@~cW7kju>Sx5
zqlP>Kn?oZ*&F_Vb64ieh6hQ4@@4w%`Q&ga|2O0+Xk(Iu~v5CP3)EBa7WT^LGFai$>
zf|>%a7cxprewn_(LXpv+`Y?mSWQSmh5YT9oMbgRx9t=L<Q6!KeP)LIkxAlSl{~-zg
zM=6M(0KRedM<$fb<Ng0fEXZO|LWiYo@BjZNfL7>>Ol}BbnZ9N%v!V9E{~sXnz~}}E
ze#jCRP_ro2i$P?fB0~kF!E1SRI>$O@UDksPdvxTcTdiZ3sb{RVbYM`hILL4U6wHa5
z3?dewa(^L1!9+)f6R8{wJQEcej#xA@>;VPqPez749t@J;VfaQx2GBJW3Jy&S4?q`s
zHa}!2tN$-up(77EIEqmQe9ufHLybiu=x9g-@L061LIab{14hl+4;dCrKFDywww{53
z6Ex!nDgkXB7#Tn{SgIz2A*l8O`32;tpNb3x7L5!mKm{PICQJ1aVE|e1Q;}i9Peq0q
zppkY^1@_aCp~E7Pq1S^!A6(FZJZ7<wVGp#h16ODs43glO0C_+_hm!$Rz=0C=q1O)?
zZcI;E&uk}@J^>copt>F8^XUy+m_;~1DnP@DpfwgUDxf(3(V4ygOfxco=k0!Eri0ID
z{gIiz!u$V++-Vz_l|xoSBb3qm|JS)tHjnrJuM<I$3!1?LMeqwo1_4mv0<#&V5My8f
zZ}9-Bf2o<i;zd^a^zseNYSRV3Gm6wJ{!0Wm4(p^Vz>7(b7+2K%v973<b_U(mqXBB0
zfffh<U}W6j{Z9ZqUjiC?1$A^^FfwicSqhr{spw!(sDJ*uq8?O^w?3`_6|JCh8kB-T
zy=hQ44L1Gc{r@|7DxtpZafOaW10w^d*0ET$@`VRO2xQ745wyNd6FhDJs?I?29t@fj
zr>AUWR_0s_vKM6M^a+=lWhT$@<D9N5!^A&*&qii`#>DAoHZuD=7HY77S~vm>6BPvt
z92yy9em@lG02$S&%)kWM@W~+a`k_DvD0(au1tx&10Z^cUau>+Y(*rg!i+e8cU=Rg&
zv_VAy=(^_@i~<Wl+Cbih9pu!oPym#~3LwK_I^f}|hD3n^m|BqW(;sYP7M(tKAtQSR
zXf_qpQwMcIK*Nimx&`DiP%MCoaK|Qw1+Y2>R3cj>Fff6Zy=llZh=WGgKzH-j$iD!M
znuB-Of`*YmuC_k326SK#=wM&)H2-vi&CJ@22dBquW_GIw)dGTGmv!2uPk6z|umHIx
z0Qn|VlkEenCYfoM4%!LO06HBRUKK)DA;X;yJzojz{5t4aL35SCi3sE^h*uZ|UTUOI
zs7%(Be^3ZIH@=C{LqneNze6KqhK3wN1K8b<Rw+0(K`uG7ezXcY2&o1h3<9U9r@t#I
zG8hyr8W>nD5*S!&*+A{x&nux(VgQ;X2F2cV&`E!wV+J_tLB@ix^`lh|kXTUz4}5`I
zGnNdDJ1Wu`6zZ4122G!Vw%@XN|Nra?G7faZ3{;;7M4u{n5hTb8kY0<w5WS$>21?MD
z3=AF?4Ges+gbj+G8V=^rW#0ckeF0U$prJm{>@v72wgE)~KX@dqGbVjPNGAKgP;~>N
zPz?=}P%pL*pzx{nvaYE0a;}&elRn{fBSV2h)4u~C%Ry;i`i5R+8Q4CG2_UOr&H($q
z;4qVn1vqk`5d(?@aOBiWSJcc?u7E@c!vS!FK;y%qi9rEm{&WFGCW(4bx(B)V_d*8n
zp%S3QTR#{X7QC37e&9t-`U&s9@4?f|mI_Q9770uoKW)<wc>jG1o;w3qZ#C&BKz9>s
z$T2ZEHZm-!KFXi~YR`EvXn+@sfQmY3H{iriPbLOXG6ebZ^+JY<8V=_AWgw@(!V;7j
zK@I{3BgjFE7}kS=5#*qmwxFQo1CQQz#zNCGQgDLPvlrV3cyPw1PXJls{r?|$OEoBt
zLD>2L69dSBAcuM|IH`lPIssQMLmq2H_5sN8(+dtWDTE-$0w|}0dQ{+;0F|-xVKKpI
zgB%l}Ba%Sj{n9r51hl)#qan{w@7Tzo0vhU?o-mtP1{^~mhl8dAK&7fh)0zgzK$`}5
z=oplU9h(?sUjI!8Z{2+9nSS6!JrhGkt(}VXUZ##3trwuty%<R2<TW@`)Ig5M{sB66
z8#Gb~+KUfLvoB_+pLnq+{eTC98o1PdQJo%n;>8?Ll)nMzir>G}PyF5ku>d@h*T~RN
zk!+^|8b}2lvSX3V!~xket_G>Ul^E8)^h`hTQj3WJ)GPa`1x^ARz~0-ih*7ehgJ~Hk
zx<TOpjp_}MsOAB8Dxgul0XgSji)zq4>!45q4Kae`z5o9M54?lc{D91UF)#hVi&{{6
zhRh{`)cyXKet_rq-}Dnu4H?rH++!30M<pogpqVEHxnKrOP=gYSO+y2CAo<11^b-j!
z3~ZpQi(axbG1NS@uBha&Q?cY=;sD*a1Sz=Q1x!D)li3PfB6EZLSlHU-pn@M>8r!E&
z09``>vJ2F?0NDq!3tj{~{Qm>pUXU*^?S8ue6f9soy>%C}bv>vKvUEsic#*UQR1q>j
zx*z`oUo@?804aO1XbpJU;l-gf0hS63te``g!QzkBM1bgpOluN;Br+8I0IgY8WGMKt
zkfGtnL57YW4;dzGbYv*l$jAT=c}q_QrkV#~I+mUcEVT?^n$1#^VY>EiW))Q}ivtXx
zD=Ila0S0o0_y0Gr1>iEEHDciM?ZIP45f|%6s}djuvpjeM2k78vP{9l;&@CDm*eyAu
z6l|6L{{@+1@p2YJExSViDCoWazj1||G(nI_19ZF0`cBRC>GyXtYcMXI&asEtj4^$>
z{T^l+#zNQ)sUklg{;&AO_`l(o;{T3cj{hh80$o*oXCsru^bIqaS?d`Y1b!a;UjQCy
zT=;(lcw}+m{}-S@{h|1;(T;&p-S$BP_!5pJ0S5+9fWfeR5(5ip`4o%~qbuLDAFC2z
zKW6o4Re?3rss?MNRST?~R$EwCKU-jZ@7W^jrqvl%N~<SWJFPAVv1(e~koulMCQX2W
z2XYOlHMn+x935f}nIi*l*RVbcvcUWAM{rKoYi2OiZ)PykVP=qaoW^{@aUMg8L(~5!
z7K)4wllS;b2!O|-8vic<rJ`30|F4+tFq>Isy2Dv!p6L(vGIO|DG&0<_NMyL>{r`n!
z_d<qSU5O00!?&{8)va7zQCB*<qSn~EqRx48h1CHDM(YQlBVMe*DIMep5C)Aq*RPn)
zx1U+2o@qkIE9j^VXq1`50yIxn11cY!82;Y@jlhNf=djTbW8idX`oE=4xx2!H!3yk+
zqHPTS9h#UofJ}s8@4p|w>qT{#8B9UzNgW#*40Jdd3>+I7f9P;BNINwBe*jt`;K5)8
zUf$td|NkGj6#_FrhnXP}Gz<tC`u)FU_CkgS)(;pMEDtbnfjS_YA2Ljs{g7eO#Dff1
zKz$F3MuwXfi3~SD{S1&9phd4QmDUu17A%4IFO}A0`~)3;s=&wqQV-fs<^BKJ+m3|{
zH!Kb?aMXh~%zGeRD{65JbgdzW4fN>WBQ+}nETG4mFgSuDseyr|{>0~sP<J*vP^YG*
zlX+Q32LnS53n=6mbUHeqp$QrTgNT8yMr3qy_`d?C4z$J?G&n1($xts*^V>@=<Ryz8
zs8{aT^uMKUWq?Kf3id4^hk$xMvK$O-U<a@<Fw|-?m{{*+U<~!*u&HHn5((A3S-0T@
zg9B*#%i;k8^Gpo}=NT^;oMvh;xXjdGa0Tr?nY@spyM8JA7K=uP4Hk(E{W42ID<9;*
zqXM$F^$cvFuD8WOhAS2e8BTyK1Z7@JO$K?$coI7}>4GXYhbGX$cns$t4rRRH{r4TX
zS%HXaCeT75gYJb44;&i*ftyO8D6rK0e*xqHkR$7|{0s`cK&u7+-T{StEw`tKL9OX3
z(4BM+(>LsAmaG3;Q+I@Y3usG}2ZIH;uUEJ72RsTKnizCI2?&-jJs2#&?H@=2{mbC}
z|1Wrs24rzv^Wq8*26J#_>HYuz8R)1h*UyIx1-}>>DnR{JP``DeBEtz#UlY_{wUA%P
zuwf#oBihJN02+1$hfV?m1E_=Q!N9g~y3RgkBd0asbHu^DZP4i!No&Bx>`SIK;1d1^
zBSXPLr#0Z~Q$RCTol0v~f%Jn$XlE)iba^na=}up;k6Et%w+_gm7T_BQR&#hTn1MUK
z-v57tyAT#hs}FcEn1Kg(y#N0Ruw`gqv~^%~wNzkm0FT#z?f`3GV3_F0umjXb19=40
z>;K8fu)%{t8oV(A?EZrcCqM%(;3NRPyMz_IY(&SO8PwhX`v5VD^Y@DP-#6glD(}B<
zV5{-LS=piS?-@|;bZq*g0*Yeq|Gy8wJ10Vr@$KmkHZqA!FF4K2Gkw8XX14nOf%Z%c
zETD4{K(jH87S9_%E7L&3ORrx&F95ZoK&#Sf?iyFr{IssHb^x8-qV@!|6cbX*NQ0Nm
zfb@aP`2CN8!Tu2g3uspHCD-$c$@`yAsBUIZuwTT$0xGa3$3CA@$?=d0bSihPms5q}
z^t*?dd5kTdH+cUO2d^-JCgYlyb_@)Y?VnEo>FCsCU?|jNXmDr(U8KYO!u#)?xziPn
zFpCL32kmZPnW*)A3Z(90pI(2N*>HNr5oTF#4sf5I<wfW7jOh!GFv~HC1x`P3gjtN~
zc?M(^?}sDId`!=$O*_gg$Mk&4bcLhLO7+jdH@W>#{GSMIVuEhEW@*%XK1GM~|9^)j
z22i6B99$L&41Zpnd=5GZf~BGBc@D_?FIGM;uvGvpQU(Q6^ApgaFF&=OPw@UH3hr5g
zx&RJMj7vZ(h(PKaHJ>L;$a>xY%CDg17q-)n9%UAEdY)m?$k1S^aDZ{6B141s|G$wS
zjiAdup-Z$tK288Nb{aL)K?m4@rXoSthcbd1il9-{=?_$yWa=%N)@4{Et@+`>U<}?1
z4JtOg|NjSj;YH^23h%#n!L3G+Q$RNS$a-Gj*u)4LcwqshfEO#DS9mZ;n1V8Z_urS`
z_yIW`tTyv`hC>tN>;jOyMbo+fi=;IdJQ$3?^T-yU*%w$x0Hn#{0RxZ40S0c1g$xs3
zWP-g|V5!i+47xMk`~ROrkfDxEj2<r)879~|Fz|wI(M|OF|9?Ry15>3}^AnI6Abv<H
zi``F;=Mywong35%`Fw^$Bg2%CWEMN`zjweh=^%9=vwmdyJzwD1#3%v{v-K0T(l2=b
z{|8<JVynQw401IHgM1I#Zv+XgwGxn(>CY#4Fc^W$El8;Sn=;LlQ3MpEAa8E)U@(N_
z-2~9w?7s|<K_Cn|6vd)xU4uo^+71r}Lr9P*FtEZbNz`QE0i_6#D=iWj85%mD=Xn1U
z21f&^t^%n8S@=`yd4~7@f8fQ^AakKOkOAsS3l9cEaNhU+|9=Nm65M=(S{~uSU<i(L
z@BjZn17_gSB#^p>mCt8D)m-rY|36`R!)`{2dQgBlG%?)(btgfMGthuL$cdoY8EA{w
z5ta#>k1#MfG%-y8$^UL-SWt7vxT4|Y^BFaA2B5i0i{FY29rj9)GUfL|h84dP8D@Y|
zQ={echS#f}7l4*PfXbEMjtmoOepy#kYO2*gso(1*0_t*kFo=RTPlFVL!oubd1Iy-v
z3`L;A#L}UG=|$S}1t2j{VFGGCgVg+9_PnEE)$<vkf@MN20}H5dnUKg(0xDo?SU)%@
zdNDB6dIbv9Y6e(Lw0z#+0J=%-=;sR1U9zCQt^J{T(E0~a@De4EuRv97L+0}wTLlI_
zP!<NI4iNp*4wRLJz^MXMPJzzQ1f?X1JOdlZF|QRFI$k?6On9BhFynP2!vaubzh20&
z0(5>jXm%JpB60Bl2k7>)EuaRZ-}FucChq!*V+;zQezrx^x)~Np>l8c~^uaAKkTKr>
z5yzx~qOm$kJO$bjWU*9Q7XWI2ReG^ASnqwFP^)=K<Y(OT3C$-N5}@Po3LXp$@QW?H
z|6T*H;Hr`P0a_%n<z*~`hD8E%{R`{=%r82%AZ4v%)Bih-HVh1lPceYzLiubSF|Z_Z
z{QqAg=iyMv(fkC&{>lD)0w^#+XWdobXHaP9VqgJHCWHDL9t<Mj>^S)j1A{_6Xrz$=
zv<!r$BANfePp#)28OaQcHOUMYK$E(VFq_VHk%^B56i(9@d}Wd}S72bR)MViE{{IiW
zN)zO35Qc^hg9n2ixak4v%7OwGWDsaXWO~3_CJ7nPx(3jC25>#R`2Qc!x(3kc0HE#}
z=&(HzgPIlE70t~ICe4c(EE<&=Y?==<a5O(=;AvoH5NJ$h5NSBfAkmP_AmhOR8F-t%
z<218Mef_`R6``6Ob~W<M6%#cW9BLDyD{4*~SAZ6#I5GS`(44}+(A>hnV#ClcZJUsH
zvv~;vNAnQ|9@~bfCeXl6^AiSv1cp6#60=_~Ozf$g2_6id`M9Ef#p{at<DV-al_~@H
zz}VWV=!#lRtBSU#3@o5H4Y{FFZwER_E8OaXU9ILWky_0|BDI=QBH*KgZW>pBR=L!w
zc~{hXT&~dIVi4Bu0&fl0(Ex3v&~&PBnEQW2EvI!wt%QX|jTCc5t>y^}$3_O7TFt|t
z`SCfmoK_XJvy#E$Ad5ls<e(sj;kKuF3@r7UP8A?WfD~wOF$CCZo=Oh6p<!pKdGK1e
zCB$L%R;Mdqj&o@GpHg4#1-^zJHfvwM_moKeJtvXZivLf5W*Y1NTZv3gVPKft!oV_l
z2?NLEBMdx~pD+ka-{8zF&(FZX$p9|fAnur6c9uC@*&cDjS@jX{?r{fD`2jjgvt~Bv
zMjk=g=^xHA%Q5+LOcyxEtZxWj`>3#=!M;}UlZd6m{|3-)!!tb@Kx5x3pyPr-%Y;GY
zR86gvhzEm!?DT?j%<7Wh0WZi7T*eK*8yP_j^c5Zq0<qIKoMX;O02P)HXE89;v@2Iw
zDy`eo$h7VZXgM6H-~>+?JO%HCP6V&5&}85Mw*wiW2Sz9|RCxdYCkZNYKyeS6bn#%|
z2e;Zml{x65R~czgaSZBRTPiRZfCehT{prU43u-l)r+YgvOHO~Yk%?paf{RS7?4ZrM
zsnQkGpPXk_na*;7*{=ST2xxZ=D8YgfYpv!jk(zGhikc_Z74_|pD<-Nk*f=r#U($4s
zfuZRi<n%63rfHUA;ApmE;IVA}{|A(5n&TJ*n(G)un&&Y{H1A`Ov3|7fOx^L#6`)>q
zJ?r5L@cuN9%N6z6w<|!i7WE5WS9mZmsDN)I0EJL(S~U3hiCS*w3Q&Tr>sVY-tL|OV
zYR|w@TWVC%=EJ~Jlcik|Dzd^ZRQQ5jUGbudx-AYCwVIPeLPag?>WWuY)J-v}s13ES
zsMVY$Qd6v95%LO@-WG|}ZJk{a@@0lyt=FOo(CzOb4+89Jy_hQMI+a8sY7Q7z)GX1i
zsMYcksnuL1;>7U3qVAfPNZofUk$MR!k$Oulk@~1bBK6fyB9rbhFiiT#z%p5mfn%~A
z1JC3*27$?S3?lV&qD1QV8i`Dv#~?9zAA`&*$Nv+i_c$}lOb?jN%meB73mjtNW@ljF
z1EtmJbr+e$xfB220GC6K|1V7cu#ri;9^A#(U}3O-@o4=8P@vSzP_C${maYKZWcre6
zJ$Oy&OQ-eVBb#3;t$*?3A!ET$M#hStj*JaI6&X7m8W|I;TmByaFMeIfP+;xISP(w_
z;y$bI42)I(85FQ*1s?EuT=g!~r(I$e=I&%L3j6M%6E4TL50o<`Ji_luScKZJ*oE4&
z*wx?LB?4M};K2YHP=sWdN0=F=hJg_^!*ExEGK~0i?aRypjDgc_E;CDOg4Zy^c5r(C
z|6>YfE1#~gSO7YHmmA#0u~20EFg<1ylZ6B*X@eR;Ru32$tf9X1{{QdG^a2GY3FJ)R
z08&XrCNR0etTH|13c*b9Q<b3tlnGwlV_<moj{$t{p``*tz-u`Mf!B5n5|+*Xe}FQ<
z>o^95*L4gUujersyxzxPVf|?Ri@IZInZW&WMSa5Uiu&%y74=)uGC>VDGdL5}Jg}~)
zIcyBh0JUzx6|Zs_IBT;kDqh+%aMpZbu&8)3fvMtC0aGo<q>9=QP@<kCQt@gBLoG*8
zMaAV044~`ZYBIDcDo!ad)oLyhsr8ywQOjXq0ZQLBr5Y9$S57d1GXuw}irUiXis=)s
zGK;v>T?-Pa`)-7k>b*qjtF1(S-D6<*^^bw$w;Y4OZ#xEw-*F5Izv~z@>gO<t)bEWF
z`8|)p;P*ZT3tXw58=C6DDc|TCb2OIH8GKHt^*x3LNa@TGJAK17W;v#Cj_DV!G3yy|
zfE!f``x)wqE1ub7ryE>nR+j|#O)M5La9A`lefZtT^uZ#L;e`hS``qaT*O?2zqqpE9
zxRZGqs7QX<v<bYJ99%T7WLoxuX%l!!<qyUGjxUoofycRC9NN?Y%9}49Z2}J=yky!0
z89H#<1RgqgskCVYs0jbr2)_2a;%6daME55n!;GJf3=4iLGJtN#k-Upkt{ZqTuz`nk
zz)c*`1>W$<3Q#SA=1lOI9g;J_jeMvx!Kco=IJ61em3i@K6SydO$+QVtd~AXiADdnf
zaHb;6ow7*Ibnswc1&@)!ojE;XJ|m9~D9eE+VL@&J9R=aRzzE+u0&06f<}nz-C+L8-
ziD*pUag%uq3+OJ>=@U$tC8u}ZV&1^HL`wv;FtcXKbf??Q?e#7U456NE(1A5Z4INbm
z2GE!!=(hEO6%33PPyhc1wbLA$7;aQ@{BWw}WM1aMzyKbR0Y%YFPsm}y7EAyC@AP0`
z1g#y0o>i*j<iKzREYAYIx{493#)W~=qJx1EG%~2e&cMLp(DeVn^o%>q1>iA!kdYt^
zT7U-{X}45nVC;24D0gi7p96BDL(_jAP*W467KA};kh8u2|M!{Ruz*oy`incv`hwun
z4K#WJnuqfK|F?Cz#$9H6#;MaY?t*vXcid(6XH?yO<1VuXqXg*aWlJuwQ<*Hi7?@_9
z`v1S<IRoS52kGviF|{gMA~l*44vq~B0U#HE185Zkqb2MA|FzDbJ2@FvRIGpmP{+yt
z|1Dnr|8L3l|3BzL1xv60|7M(GVC;DQ|No2^|NlEN{0FZDpFAf+2amNG1`awJ3=F-T
z|NqbB0u6oq4*>ZSI-UfkKrR6Vt78*Ghovh6qb2kI|22!XL@b{C|6l0Iz&O3*0rM1_
znp)|KP89~ws>wpoAS2=^A%>b7(4k!q89G2S^w7R0Xm%bvvjPg)=^hW6Eh0e43o=CV
z{{Uz{v7;7zV{F6ghYTH{{u5|ku_jX@05stYQVVh?NH<6wXm>J559nAEka}db({DUv
zmXUyof^~B+F9VqbGG+RN#f%cuS(Y-1Ot*N%%+FZ5-QyASRmS>EY0%kl5*n-wDnC^i
zK-0KyY##jo2fBCzv@tc|`OW_x3=H7WL5C)W1E8KNNL{BV14F1co1JzygF?-VIFmvS
z21bXu{~v$?(Xol)h7K!(fMXK_%Iqs>Bmm?Q7`8a||3baRtN-&Yx&L1XImTue@|?|1
zgN=bxyPZMOp^-ts((C_zOYZ+G9p*BKfEGeqa{oW6!Nnly+sL3$%f)U2a!k!r$xF2y
z>?So_8Vo)S3<@B})nr(KmYFgXdV?km{?CDhppGhd1*nV;H)s^{e+hV02PO$}6-dHj
z0cefS{|N8@|DRYi{s&zf^8zFX!aCdx2H<OlIKh|9bLns}fc9_eSaLEj{bXTa==5Y@
z0^P+23K^(colb~a0jOFARJBsh6(Ggl|NnzWCqXy&fE)liU<;i0>UC5gg@|JlV+Smf
zKmiE~1DgZ?|0Nvz|G(l`^OJ;Q;D{1%Xkz#P3Kvi~baFB<gmSUjX?HOw)Eo~pDR>Tz
zBrXPB(BPk?Cj%oWOe`1}7=OAjFo2v|>ls`D(gV6*H-Q1P*%K0zS3m_FXsQ`xIr5Fn
zAd70!okT#E6++HBiLlK0f5GC!|M?cL{$B{qX0roDt_C*)r*<1OVmbcrw|E7OSPnKj
zi&y_oYH%<}IyN%M)VyLhsb!VC1oA`;SG@*9&2x4W$A<rNY8co}K_vyKpN$e}stgPk
z4B!}z(BWb*0EM4J)Bli;mkf+L?BECr0L@22eaHm!Ayln^L(_i^B(*9iYSW>?;r;(V
ze9#FL4WN_(@;N9p92)=CfE)y3gT@HKr3sV(r5eycicNy&v6ouUS0p6+<<=y7Ub0DM
zV6;eXXa14(d__faOA>g?9uHWx5(CSR%;zhnA9%qW#F#!^_$9L!(@KTu@h_Q;IMr`}
zrt@7K=1iaUlG&bBQ^CQpVf($8%m$21paY~|Gix!OJ~-XxHM13C`t<VG%wC-K77iAf
z3@i=}+fTh_mSAM!SvmazJB!5hKW~_Iz*hj<zGe1h{64+=Ewh!XorQx#<Npt}UZ+HA
zm;*q^izn2)k_dQd%fL|Z0(4LdLrcZ0>95{0_cO9juX@KE!?fwc<c6Gh#tD-j<VY)m
zZ&t6d`{D4?ih%)ikY7#a!*z}g3=Z{mzb9GG`Tu{iOs)ir_y4c4lWlTCz~MQ0Law4W
zsFznSUHL=t-@+e>j1wH2I0Zn-9u%IAO-vj=4>DZ%eULGr{@w2i>m&dFcd9Zl6l#D@
z)nU8?Dsq25WVrE*k>SBFMTQrX|Ku9hFJ$!aU|@hBQ3eXtnR*Nimgg84YgwHueja3;
zP*YzJfMkveh+m@&I)tB5LWhGv)shwD-T!Ago`M_i{h)^YoWBf=H5;@mdY&>cg0|U!
zQfSB%Hai^_h7`vp#vC0M2363QZ@oqP|BWHtY<3#l44RIO|IgSu{r_LlBD%sd%SEE5
zTWM8IOOyy`8qcqRMS+2V-Q@rO|7-AJ1_t&NeDcV03=Hh4703cGHUk4AR*M)I*n1cl
z*cTwwv2Ovf85r14fM^hAU|_%Vf|0S{<wJ%WuNWB~yaI)^LIF6WK_LSQ-IoU$F1$X-
z7+|5u2tJ4vG$aVh6`;_EVM{#*#u<GK3>F(0n0_jPV!<PzR?izWX5eGV!N6qokfESf
zlYNWD0tN=qIrg>YULv*PP9ig2GAPVg!JuHN#=z0Z$T0DB8v{eV^M`<X>xB#xLC2$5
zDljO_RAks-sqz03=o%%^<_pm9LMJ1`B<qC?lR$EX?BFB=-uPU5t+>KUfq}uwfq}(R
zX|sS8Xu?gAVMnJT!-k)V4B#dy$kFwA8v<&qZh-dbC|GLz-)L>iz!<6quBEg=r<q;>
zMQx>~=n9KdZZfrMpyU6Irmz0YT%ahzz`)4Dz`(Etf?2*mXb_+A2m=F)%XFJB%)0d&
z|1Wg>WncugBs4e~I2{{V1FA9^6zXkHS6CG@FoKQ_oXN>h0NVHjsvSYiJcp)#cWUZ4
z1k|0|T=4=l(YAqs33krD4m(3BNIz(EUHuHm(SsoUj!g_6VV)8epbd1OY0+9v53~AC
z56gP+xq1&6bU~i2@|4T4E@NPv@r{AOl4-L*y$opYKjVb@yc+?v8Xj8p5*`+vj0_uU
zW?u-fNMxJ<x^lgq?Qlii)7{`5W#0dPw7zI$oB)yo4Wd-3vp=vnz`#}0rw~xnav{L`
z|IeqLvJ8x`4l+&vc`%fnt=`W2KjN-Pup`nLKnD+jN60`9s(EN70<sX~AdtZ`mNOJs
zJYe7eSz2?#Lkr{}P!g=4ZD0W!e)RtTgAwEi(EekPdZ;5fy#N0P-$Y=gz`*#@kzq%b
zhg?Qgay^3r$Z(4X3<5QYQX(Kj!G>iyXo1EzUotWrnCZ+=05Yh4_6?{7-xtCxfEq3U
zk_WAw1bG1DLn{Xc4yX_9U|Wblav)rl%%EVI0N#bcU|G+=pa8NM6qI0x9AIFanaofC
zatOrG@1`#m87F`Y1sP~{l7Vq{Cj&z$JDc6FgNzfr|Ns30i*Hc92O9AMr5W%zR`rDd
zP~3a}e+OO}Qd0prDboA@Q}A3%jf8|ly+b3zmRjZm0mYdNjCD6QSAZ^E04<=gc)*}g
zpLx5YR?JBRd@iFk_$-JFYcWXrusFcLSYzSf;Ml};rDj_}K&9pnr<$dgL_lRCs7V1j
z&c}m+37pwx{9s_PmVm2Y0^?g8V5o-~GC@ZZ)LQ_z%&!z215Ma7$kgW@2>8v&IHA58
zbTm3>sF?wrE<g^g7du>GwE(<DOr_RhLqLrtxN6j?wOO&w>KX&1)m8?^nP&h0gF*>3
zfA9VO33yRjjVY+#@&5uOMC(sifP&Kd{~vG<H37PpuqqW2N1!MHolH}+P)h_99hM9X
z3ZS$yGnJtLG%N^;CeWckpw-#07BYf6*w##&+3U`&2&h}Xy25G(17qDau;Wo`qgvC7
zfEqIo2Z#Db2Ay6D21d*G42;&*42(1N|NsB_kZ}TNC4u+<$KVOK8f%D)Yx*j{*$$TI
zKv@bjxCL@N$TuL5=&&>7fG&jwrxgd#k#E1j-Do8F496x$7N|T^z4!m$J3u8bsMH0O
zz7`7@{6V1rDt$pS`S22WC4<6@7of8`fBryI4{9l2K@&^%{{Q~~npi$)Ej*f7eF11j
z4^6Px`~UwIG_g`p3mHueG|C?Xnh*8<|Mvu_+5t5fK-CVYzk^=&fJ#u1uR*1#_y1o<
zdSw}ytQ@o$7(v12{r}e%hyVizl)nTy@p=FMJ7c=WFJ>dAZ-KDIV$*wmF{?50?3}iR
zQDyp#U!ckN3zHo(^_X}<Cl_QIP51iEEMWEgLi0Y*l<I?@pg;vp&w);)t6$8%#ryAE
z@M=tuIOw1?&|t)iItC_-rp*!Ff9G;eev@ee8Str>1|1_`*r?0^x?vPFIo|W4nE~8F
za%^H~XjEq40CgupOR9A^8T=g@8P<SWMHUMf0)BuN^VTykdH-DuUSgrc%)sE-z_3P#
znZX}aeSre%r9FcHsI05?lw1euTE2{D5C8>g4F|L2vWfQK4T}>xvKSaZib0_Z3fbui
zf0)JV7rcO&4bE6P%Agh#LjcH(jzsvW@)MA?)oQVC0hJK7ECK6kU4p=OlRGs1@A3Zs
zAKXa>MWFY8$VC{SfB~5Wo(%(U#rzMdOF`{w#s)@ELBPkr(5b?}Sf~!F*V+C|zp;@?
z2DDI*1sramk)2;itMq;-{xh_1U|_U%U|^`8)BFUyU2ms$1!%6(nuUQ8G)$X3M~%@s
zks%*sx25O*ji3=24GvHvj^T<e)BpdKUZN{3IsEU`dIYTkZyWSvUIuBzF(K9O4AZ?&
zGfFTnnS3BYTT+FAf%yue?g!QXAk2Jaazlcc8j7|p3=FJDO$LxM5N2F5o##KZx#15B
zMaB!D(_TQ6uAo(Vpl!LJIVf-l!?xu*{=Wd)iUAr(n0AOsgabNS!#h3TA81?kRp==R
z3XY8o0`<)@W}t<q4o&}K8tq`o>wiF_9VAIPH2!x1wH7AYfl3m{oy;Kf>c6pX@&5m(
zQ%8z{0W==s*u-Gs!NBkX6l`^i*|&hoU+@1<cY^rfB-g~qP`~Zwx_Xdi@Be=SL7Kqp
z2k&pL&=6%%05y{9JJ*<jmc)a0IoH2r-vX+}X1!!6fQdUaF{mIM$smDnBm)o3k)RPm
z@BeooD+0mWJ(;h7Cg(xbB1n$K`~UOO=^y?xOX>XsuV<~1+5qb11Rz}f1iW1d;%Wv9
zu&WP$u9)h;qHJpeQtjCIe+S6PASZ&ejiQ$bXx`1S@xO`p|Nkl=FV_DBh0kwGaQI|`
zE-hi0GhKm^MZ7))qz&$~t`M_AFL16Q(r359W0auf4USDrpyO;fy#N1uQX}<(!J&~^
z!P4{p1;}DO*!5J*Jhiqr*MXem{r}g@n#}2o7+GZNGwN5cZ>eQ;5}Bz1I!f+;3MigH
zit4|D-2E#O?Cx67zz{fI!8J(TVfHPcI@SCCWAL#{&=7i1zZGtQA~;&NvDww_UtOUg
z28-4$Xwh2lB?6AuX<N*Su94#VTi|(qi0>Ie2k&xu|NjdfEe3g@Mrs8lD&Y=&1YQCG
zb*Kg0q4ocNR$_7Kk@`-EOF_8-WEeQ6#TXPoQHB=Npo2SHz##^X>7SaQ5VPL<|G%Xp
zLjh>)w0_kqP_s$JgMk4&)D3drTw4Z4upaCG42<6Ye|!Zg4Alb16(|QhsqY9e1C67B
zPMZZ;N=`a?Y01C<8veHQWZ?K2$-wX;6IA`&03RLW{r|TDct{828W66L`T+_u3z*BG
z4vR%|*d3U|9Gd>;fb=*v{=cBX1q~Sn1_qErK`l+k#{VgxTRcH#gD|wf0`2<{KonR~
z|99Xku{=OU97qAEp21Ag3=)VW{e3COrJ%kKD7cX0$ov1F3DXr8GKp9~_hSTt$7~le
ze1KGyOdg;r^7lc81-~CMtN>R9^T7w;9ssT91uf5=F2KqnUZ0}F$)H;Q@;7Ld??tCP
z1B1mvhI~*DVJ<5JW385VMXx-l*$Qbz=&*yv0T>?Wu!F||L@ZwX-x%@?+*t$-16;5<
z1Ul<jbcMyS@Q9jcR;y~B8;O8U;ega2j8p#q|Gxnh*P{wBFfg{DDnOM-mSbRGEJ5bO
z*bEE|D`0G7nt_2ag@J)F1SZD7!07V79?eAz42%+%UJOj2)*`rd=mjaKYaN3`KnY;R
zD~1A#g$y4+DG-#@z5jm~1?4}`hCEQo1PVz|BJ0#-U<5@3=*sRFj0^`}A7ohY8Wa&6
z;G1YRfEq}k0qlBk8bDYGp53bTV&4Ml--1#d$l@6<846}{flIOuB*%eTkvEX|pqAzd
zBtED)x&w(1YO=0C;)9yCjx&%1{6PyyK*<BtLIE{HV0U$R|Njc*LMZT}tIX#gy#IfB
z0UpGiK7*abjOk@9Xyh$P>ZK$&Z!|I#z}kGE6-M5FCw!dl!@*)OJ)DK{K|P-U>jIEz
ze8L$Z3Xb^%SU-R`nBr^-IK)A=F<?=@0lWI32cWZcv1kavp&=B9LnFYa!eLq*8Gzm5
zC<BCeJ%|axd;-x(5)d&E$tMtv!{QhmK90En)`t<I;FVpd9tPRZClHGxsN)2%8x%JI
zyLdc~sENnnfkXw6{irTtU|`@ANW>8ZNe$R7PR3zzG7gJVVCup4gUkeDK7kY*8d7mY
zO)7Y$HfG$X;fVV*w5WmF&nJ+MBS<rFBrfn0Lo6YeiNl;s><+CL$i@-J**Jna8<cIZ
zSe%2y$GJGtRzBF?dd#3J!0u9kLL3IM90A20ra3G(u!|Q(Ac;f6ADrkaaKv#X4)H1+
ziL?gnGfW57Iv`mLVuH&b20npW96?%-!^aIcqNV{y;%&rXe)9zekpD4V+KR(xZCHE&
z%C22FeB6!0;vTT?LH2^|2XjCKpFkguMAQ$G#**mzapaCEIMmNTHy>g@pTJCX35Wp#
zvvDNG**KzR4qE;O8^gdSFb9YF`nfoQZZ3{QHxGw{=Ho~c^Kn?b0OH|#j7nl5L;^#6
zDGmoM$KiqHIHG0+I7mQo4`M*VADsPG;7Ba1a3s3bI2^hbM+vwNn>qCid;;rn1nCAG
zKHGvLB(~v*`yDt!V#fv0v@@1ey$6Q{`*GCw2XMskL2N!|;1f8C$lmbq2S>p%96@&y
zhe4-tSbPqLIp;A#6l_1Az(r76z!DOdF*JY_@(EnV5fYbiSPUANV!&el)p{Ipb{&U7
zH*utuTR4i|dpJCB9~z?d=&jxdI2`m4M^Hb);h@JjEPjlt9vuGQxPJn55xRq(;K-Iw
zair>JI1=wOM4|)5Ar#m12|UM9ay`f4;}@ttfEvUn@Di&9d;+g<nEx82vmQ&Lc#T8D
z8yp4B8ypUOi$nY!Qb@zX9~=cAaro>bjx_NJhxm6K;y*DHHOPKGfuA^1FL+fGW(Wx~
zU=M0RR_q}p$O~(3gMu86`2_jF?GG##@FN8gTs;GyAU_TZz=<7;IfB>|ub?n2q(S~i
zwm=wr&<Toy6~SsPFb5Q6g5bTlSS*&q;Q=MID1h3}C#ZzOVig=d2G6Nru~-#H)L3A5
zP`#iPIP5TeW`#W$2wG#$--6aSEVjp9R0}$S(;Q~|U(gAM#m+bqkqZtFxS<6#B+~c<
zJ&>~{H2lGF=?``hW=I5K4?4kM96k=mAs&Mz<mwq1_ypr|#C-;ixX(cL0mNHi4`gDo
z0Azj^4hQ8d0OvnUALrw+pa4e{;OMdm7UJ*#qAQ08f3OdVaKwEv4vUL%_^bqn#U<$F
z0mObj!BQM?4Br2XC7YGuNYz!?Yem6o93H5z!4cH8I8rruPY4zV)!}eZJr0W-A!!Ap
z{V&*vBipp%h?-7_LFoMj!A=|@3O@b{?g2>ngX6vnRwlz!G>E|`*n=Z?^x;rH5l7rl
z#pZ!}20lUXHUYScK$e0qpWsX!KAVN3oS2Qn;(0itW<Iq4j}df>am3kD9Eoc=4u|6C
zQ3<X@gd9Bl!BMaZN8GQ*VevW~iS#fIAD_esA+Y^?f+un0<5M^+IEBN4(>S8$9EQb^
zC_Yz@Em1J=37*H{<I6ZKz|mh21dl;sNn1CdQH<XH7rccd+uXw8&|5glkJ~sx^bu+l
zgTo&j_m6OCz>)nP;|QV0s1|_28EpPztmfDA2|mVU0S=!%!I37O;0U27h|~^s42a?r
zd<lvIEbV_m9PNC;w>T2fTO1+r4u{3>kvsqke{c}J#}W7MaisS5I4u5%WC6&p5X>j|
z8Pj}_{d|I-air=WI4t-LHW9Pk@DGPM|FMe;u{wb4$IKo=?AYT{h!eYmgt)M$6(Mfy
zQ6|I-QxCQu>>CilC&Z7#VlnJ-DI^Xv2&5g3`Gh2KI8+wRe5n0=LdrN?s*I)qVh5j)
zI+%eG1wvX_vl*X|9(E7Z3mIUqJcJCfCn6zJ96mG0OkAKuEo6>8@d|;KKrt|2w*Q4d
z^Q~CMYJ@;*NwJAr;Rp#U91gWYE^naW4|XYz9*mF;dZQ6yp^!ZeAKT+d?T%Q?0k!{y
zTyVs_D~`B##bOWx1D}u^j>PDJy+{`F#4-La<cY%|ZyZ4yfFmRVa3sb+xQ7wp4~~K$
z9EmOnM<NPBj!ST~fCxUJU>pt&K~L-u`}u@IaA*j_5trdO#G`OTO$?~A!BWuG$Kmi<
zB96FE!eLM{4vW)pglHPX0~qapp-gz(fPxZ+`GhiYI4B!O;>y9{P}F%sNce-}J{Lz6
z<l;y~xj5oJ4~K*Dv6)lPz$a9QLqjo+RE?vrC{%_cgvxO^6g1xm%Kzx?f1wH-2G!w+
z;|3fK#W5c!)PSf9;NcIBf(9HGwBU%#b{yh3`hG%P80LfR=M(D2kqdgU#Tf&iP(Kdw
zN#OK~Su0M4q;`yuo&r8m8B4yLio<7EJCO{0LQ`?X@iZK{X&Tf)=<R=@X*i1B={OSU
z42&QJ1p%MXEF2ckLUkxO{K0XLqxUK_2S?(<F{3Fo4@ZGBAHC=Wxs#!uPiQ`lxStOV
zBD4t!q4}sj02>3U{lLnxMCC#pX=O2}yus4`7g~%<0}hLE%ybGZ2fGL}F|I&LTd?p4
zN5M)Q8dl**6I*bU6I*aNbSsj@&|m}E&nL7Mhe6wL#N~DzX<{D^4;;i{&OrrpkUKDg
z2*=E&&_P(#Ouw(l5;#qnMPs^w5{u~cyGks|Al8iS8p<pmSoq2^i%K%{lX9}-GxIV_
zri*E?EShfN$)YfQhX%_BafobuacWU!Vh&gZ$Q2CJmus@*OfU9i@!c+<#ZtjM{eUNn
z!}bnc77M0nUMv>V59qVpn4Z6rLzaz!fkCy{YWhce7Ln=e4Om1(;xjT+;<J-d5QZ@@
zY~OFd(#f>Fz>8%A<8}{Y76az#3O+1iQvWtEFbGJ2ZG;ezSP}YnVtN2r{ssesfDl9q
zOhN)r=--d&4Iugd5)2FiRbUwi0hRx6F?|DAK7xTkfFB|SCOJSPpV0q`=?}p29SjTt
zY9KKvhRM&EF5t@|CiQ;>1A~ADR1QSJ<abPW0L!0XU=T!hA808*1E0|U8`BHG@-G+|
z1SCKjp_mCo^9lX`F@1qAi>S0P0|x_xKsiVdiXjSw86>7(fGE&lU=XN*N`feu0*h&W
zU;`W&7zD&X5>U(tqWOdw0;U^46eKV(2=IXfp%|v1U}B)e_6jo=A;#%a)+_?s51F$Z
zW18Mz&Z03fOkjJ570U_c=@ot~2HOMdSUecn^OH+bOBfioPq$~;$P5k=K4Ja}kePhK
z{4=05G)eNGfbt(q_i$#p0S=VyGA=AG%q|S+44Dii47v=d45<tT48{zJ45<vs3`Pve
z42BE_3}y_83}y_L44}21ATt;kI32);XEAC!Ffi~iF#P}j|Nq25k?8{dEDGBb+*uYd
zZa45}S->*QlSN_jibf9sUM`3}5XmRpeqp*o2#Z`jtTu;D6=}bK$oqqrVDJgcgG*LE
zVSi}uSA_Z~1WLpBaDC8%S{_=pv_sAFg;qh0P;>ksAyhA{0xj}Yp%MzvIt*s9JZLvN
zXmKgXT?~A}%3wa9usoR0z`y_va(QUb%0q*CJvepo3Cn>kW`OL9XFzxeVy+ET9Gk(A
zBrUuK>aZ5@Fdd(87qp;FEtp;r$|A><+A%RugoRIdJ;U@3p)7JzP!CB$+{ZT)N(;-q
znEoP^#f(YTW4b~ZiyV_|!gPl)7BMN=1_m}~&mdR#V30~a0WJ|REi5}@dI4D7hUpW)
z^o8jg!1Rad7eKU}!1NDb+F-gsIEx&UT)=b#FkLV`08CGqUI3;yOrH?WBE}?lVfqRX
zUshxKiEtJ<DR~YCW*^TGkY%8XMSy1qh{-1`uQ4rxMNCTGfq~g26da2XY3PbL`H1NT
z5iDZ$@&ybm0iMp@AWfj<UEH8OKcMjKU|?|x@`q~V6A+C7so)cqU%<c;9PWq^hsE0t
z1}3{8kQxx?6A*a=riJA%Ffaw#f!H9-Cm;fiSNRtVOhFFdIVq?FxDenIR$yRY4T8If
zPe2%Iv4R8xtBY$uhzCeH1D}A13y8rdtYE;v1{PNY^94j8MWnET2LoFWSOOvro9$Id
zU|@%cgEUNciDVIyQm9~H)CMU7V?F_pBS6Cs3Nxk`M6!rUDQsY1)B?+a2tENJXs%K?
zF?|78{s9A9P_T!m8#o&H1cacOLE*>r3m|z#0S0DAKd^(rkst_-BSnpAQ7mFoiVh6S
z5&p2i;}Z~sR=J81(+$A#1q_TJ$AT;e#gPCwFYpN~c1%wI%P(MHa)vA56A*wVb;TXi
zCxGQIFffH9%R_1*VZ|5I4}j#A7#Ns*kmUKHeFi0o=^w!I1`JFQ$nwy_LCIsfLNtpU
zlTyNT2Qb|*JpoKFnBEZ0B37>nO>0UA7#M9Jjt6^R6I@{O2`fEdU<!px@Cj(Z?ES&O
zWPmIVElZRI7#MAl%+c@xarlIlH5ix-;1YZS8ZuyUZ((Hz1{N287k>~J6maU$#*%Ub
z1FMU_Jye2EKpoUP1eF~H3~Vm`KK_to&nKX+0@BGRtlTj@A%;bqa}AWcV0r_H3n}}A
zl@Cl`5W^x?uLi!UkWX0o0RxL`1T0JP38+E6tHQv*8SLuo>Fn?0?*}pojQIpq?|>M5
z!YUFB?5+{6&Y>Z$AOR@m6HtW)i;4vUi?4qeRFY3X1sV-15e%$BzW&ir89o6e9*|x>
zVU+>~Hs2ta7Cr&R6sULy18b0*rw=&z82AK0`}#r2U1b3STa>eZs2?;LD?rnc%8uz1
zVp-IrR4y>EcsK?_av%erfIPGbsPbd_g;*AGPOy1=!m0w(KY+N9SP)*<FkK*yMUF`|
zV7dXAE|?wwrYB4<0Mi?$PXN;wrf&e#AEsXb(P{$IKY(e2=>qXAa!hIg(+$9M!Snzy
zJz;u5Jc}BW+J@;f!2BE2cYx_1({F%ib&2Uez_i75i3AooHuVSwCVju@G6^hF9O@Me
zEY7YzKGWqASS0GzXD~49JHs+Kp8!`0B%IWtRfht!%79i0!s<I1nDxW4sE3w?80udz
zFzfqZQ4bDDzItJF4H^;*%=!^nG(c-{4D}ui%=&&<)OSEUf}y^Gf!Wy+R^rto`50RJ
zDnJW3n2$A9FffP1H6W?~0kr^K{S5|YA1vxMU?GI89@H<><X~Wqz@`COgrGY}(}IE7
z51V?JkC824;1kx&U|?}}G=zE?$pakFb(t6z%wS*%$EE?B4?q^2U|{jVrXCW<!WicN
zU|@-Ws0a7U5Qz>J$7nv#(qLfmgJ=L3qVPnD!^c_?46M!`jzJJFBYdohZf?i)f@Bu4
zdM&8EuqfBs0MV}tieUzXet4#Ul}gaMPU{8(D=150sE4@^O}#b;#C&jbiGfcV5dhFM
z2y=+G#dL)f7BMRgs6lY?1O_&c2ZO;rL^x0bTDij2bxbcvVG+yHgcjFu@eQELAp~AI
zzyeernx?g&4u-d2VYM!_RD{XHn$B=@Z%qG?!Xj6X(;R3(D?(dBu#_Qh0c!jI|NkFq
zzap%K47C?#zK#I{i#@zahwwMto!|%qwXC4U7fb?fzzPPIkWfUE5AJbjz{^8D2v`4t
zfyD@$g-~_q>UAX;Sd3ljVU13N3t<(RJhan6h!1mst_K6Fk$;#gq=kfJ9yDa&<{|Sz
zr3&1D84RpO@YXEC09YpjM#I(LU|=;SLOr@ZJq`wDKTk;8csf@)3y+jMEKH%14YNVd
zVY)#&i<lI=y96!g;PM626Vh44wB%u4f|&zN958d?>K9C309FrEheID+{e$Tb!0Msu
z^q{>VSfYjTVe0i2rYmHyh*`ni1J$Pw&HXTaFd8Nf*Pk%GAOqChfF^z&XeNbs|DfjR
zLBk1Vk1Di@p#aT{au1-H1gamGIWTv?`~fwmUKp1_aEESSVAT!shqsO3nFE)@q2)Ww
z!Eg_tMHEE7o=+I+5=@6ceM-nju$aeb4m4z79x}*aU^asF%s^Wp;68%75bk1Vl)@~4
zxR_5EM#Bs=v|wO1f_LeVG85E1SkS|0Wb?sOATSHy26li91owGRYBrbwFj@iHvxAj4
zFoz*q0BXi!n16$T$q3RoLal1yK?qI!Fb5e~FffN2=|jp<q^b|5UJ+Wb!qsOmFu|2$
zQ?CFriceStHveukgMrBgse=QH5(RXJoS42Ln?=kD!@>^?%yxE;AX8C7Oc8DoNQzI`
zSYlcZsE~nn6cnLp80Kzchv^16EMh{&;1UbuKB%^W=@B_Ba!kfErdQ;!$kiL~U|@uI
z;gS3Y3uq-YXB*#OU<!q6KuRId!buq|{7g6)m~4>xZ?NDnh73B@3&R#nz#ML3!N6pL
z#RAx%5{CK=1|~Z!7Qh^ip?(GfvjN;iNbO@-aSb{d1eDa^4mttS0CN$-$8hy%Z4VPr
z4;Q8!DMVrFp+1L<s)1@UQw;`Y1GpEkSb)~5GmT(i4u$&wq22^KoQCdW(+&paP%P$y
zq6(a8F*NL8U<>yQ@$dxqWDyp?Gb1#u!T2Un2f_<{s6%uiaV%^MO&coEOb!bHc?Je(
zMubVAD})*hiwe^h(;f0z<dk5U71q2mg%(dRb!H9I8}eDi>WyFpIJ7mR49!EZiUL;3
zz}2CfbAW**)CHFP5di_$2aS4o=>=}qF)%RLgEO19Ff7w6LUSRkxHE!kggMw;V!A^C
zs0xLa(=d4)2IDptEx^nh7})$=-5nvL4hRpx(jqLELj!~xk|-JYgw0<}e*kt6G^$}C
z2ajTCHaABLF$)C-W?x5eg9oMb(uH=dV7U_A9GFAUT3z+R78wjIp>PusK7bhrO2nYt
zN~D3p7CRW2eIW@Os{@hJCIbTlXw(DhQyeZ72A%O03aNom3`FmjTSiQGC;}DO(6#_9
z?ZT3PWyACW6nSW?2rj>2`U0>#R2)P9gXtGg<e}<d`mF?}6|;y%SwhF#V3P^3o(No-
z0|T3rf2f}exbKDtZ&<|)vlbQ{aD5fi3yMKw(r5_=F27;=f?`m81Ir1}lnzTku#OC@
zEP~|}m_5)G3QwR`4;WZn9G$?f1P%Ye>J_*-(5#N0E`+VnQmnPd^nemj)`ONku)Ga3
z2*!td9O^-s1K|k}YA!AZTTftMashW|!DR!yOAIx?UKn&z2RJ1|4T4z+3qczW1|}Cs
z4;&?-!8~LGEp_4QJs6m@Aj=C;)I%+VPa8q9why8)Xa*fgh4~O3gwRqNRw$u67;bUJ
z^bMsfVo|U{2G&l8Oy__OJ_d(?Fic(<8lpDPK>+0$(0%~4`amlagl#@dS14l<tA`Z<
zu%-{(W6-2!0qu9d`~l-b8Vh{FFmXr#AWc_6b380yVg9mBU|`Zm1ZX{a6rzPFo&beb
zN3ei2g(f|CEddH25QcdG>LFOQ2T`Yk@Bz#qSSEq_4DRw5(-X=;X&hERfg9v}7%^ZA
zO?tRu0G764=GrY_U<>xu4|4SdxfZjqK#P%jVQX;Bz$XlIFf2;!U|mC)190SCcxi!4
z9aJA&9W-Pi{CYlNbRXDrFtEA#>ihbGCvcE_08NuHAE2i-c$$GmjXgB;!HP*!Xc~gW
z1h|-uWk5<~(73gP7Sr-jm%=o_az9KQ)^>u)qh|{H6Vn4KS;XpLnF^*47P7D?bC|%u
z0`o3Pxe4`%70f-*5Vl7fA9pyxzzA)$p_D2P5Owv!de8zMW}zbo12Z&uv1t%S_lTnf
z1FII?g-9_1b)YSDJ_i;Ms1CH?6L!pCVA6s+5n+HMw9SR#z!ePa;ZD<is#&D0V1>RK
zG>3wtjRBEt)S&4Lz0>A+WBP|G7CD4|XeE!KADZ#d^*b3%_oznJ4^0gi`eD62X!3#u
zvQx+O1=TEaMozE>FEp?mp}jX)V8QrseGjI80PBOg7na=N=0H;cj1SZ2Y%txS24o+)
zKB#(_eNIq5TwlZV2{kNYQLu1CZy&?eU0`4f_wn+FG}I7rs0Ix`T>4x%rq!~DWjRB=
z5AzP34|R?UG`GU6b8%o`3wLt!feh~<tb+xYJTy9B=D_uJOmC=V5sQKa4@@0~`3D%-
zd?K)T2O6C?z4K%G2atc9V8IM^hbvn2yBaXC`CxHBEcjvWf{on4_^<`*F#ot_OfRTo
z5vzx}9~ORaJ~aF=?BBq^77>mae$KGu2z58Q{jSi$25$ck1~#V%uj#DyEQ0kg$H5%|
zEm&Y_3*8ZJ4h(D&*a86>c&^a=5A!^Xk6}&+1G}S-=k%%dERyx=&^8IIn1&V0FmXu5
z!Y2&Ns4$<nU0`7J1XYS)j7U*1$HOW>m}6j`gz0zJU|{qDPha6M0A>)3#$_P71?YUZ
zg&7QNp?-+zaY%dG1kuKTSp=hDoqG(I-<bZOfkn(q2bxwCp+zYy<X{d!pIY%yU|@0f
z_XS5XsA5tAAD+u6?2$3up^-%_3O0y<Q-1>k6JqKe5#q+sE-_AhJEm^{nXd>dGhj78
zw5<eoJ_DaHu0alYh&u4fG*I&$)&_$GtjCAx3QeH47t~z%)DqZWMAZTdCzw9Z1O_G}
zq=gxf2tisL1$8eh9AWVSHy=6?12vCF*b`jOfih|E^uTHs(QGSd+J<aRLbS`>!9L;>
zhJ}a=)Fik#G-lPIeR|~`(Dpi7Zub1a!0rPs6^OJ@3EIJMfp$P(7Aiq4Qim2NxGeOl
zU|@$7gCtrAD+)-q@CO4sq{t!GLTLTvh8Cns&~~vpG?C!)p?3uXJEWi`)k0{E0rw%X
z7J_`}gGe;>gc6Ms)Q7H6np6vYDi~Pc%U2lq1e9|?1t6cW&kqJxCm+Y@S6f*Gqo8??
zfdSea^M(2jn%0GV1sGUegB*h)%V`j00bC!*Oa?w-41FHc9oksbn0y<iXMpJy(<ijC
zh}A1VJp(K2e4)_?%d;?X1!&t8E)P`)JNyHdN73bB;;^<btPv0OPrb131qRj-k0AeW
zh{NGMPmBpAXoCW70kn{Tuh@iUUAR2dfp7;vD{8ohz{y0058g_LDTKOA*e_%Hfp*ZS
z7Sv+sno;;LjX%Tm5A7^+O#TMb1v)@<z;pvJT`)bMgGJ5Ce*yzruzzTfGdQXcF$F%;
zp8;u2E7T(}d;NDz-vBn}!}JRsEOJq@V2APvqpxxGhsGQ%rqI{O!a^FZ4_aHm><JK<
z?$OC2#}v>pJ)@IFjxAsX1CvuQc%czfz=`QAz;Z99pXg*!V+!P${sF`fG?*^X#UjTP
z7%<(Si$%-}Bg;UGGg#JuEfxrbx)t90hIFamVHsF3eL@$Dm{!0KP%7XPhN%yP<^mWW
z=Jvn~(=T+fh)D%NBN<&jNMKqwi<lKG2;kKKv~e5+H5Tq1=x_|o_#lVr0o|Z!Y-pLK
z1+@lV(L($5aP<?WPv}Of2w`aqHX;er2kV2uS~QB#G^ql$2R#V}U0`4i4R8j92}%bO
zW)3{lCxVplc?-h@z>Dwsgw0?M2g!plGyvf0paFqivj<yDFX&+rOTw@SJbA~5uqO&+
zC<*qUrNQ70(_i$k$Z>>dFtB*LM%qt**TW*g72?6b=IHF~8W1x5Ll27>M@R+(OK^ar
z-*mq=774464hA;YhyYh-=yE?;>mdZ%2u5EU4vVCa71I~=vWV5g)|SJEV?ka3VQAaH
z9~vnkJ3xYnkt9g-jZYZXDuK1WV8a(Mb78~JuvtB{F-BvIIU`tPq(b))pcgbD52k1I
zvB+_Uu3%tyadr0eb@TzZa-!6r$u<<~QkctNJ`O#>!0h1)E<R9_53H++OJ5krw0;(`
zOju7Ar!ofy<^V_V=n{(Y>!9QCFn>YXk9-(w$-*ia*hBnXJl&`JSF?y`VWc%qNcf{p
zTQD#%pr>K*xFy1Pn6(VhVJKMZ92P2JJEl!w5%Ypu2W@ORK>Jd#JP6OTP<hyB6HFdv
zT)4yZgb6HS^<mH^C(K;*$OvD+z~bTW0}U=jb%3D{S{=Z;Ww6c$%snu3;bjNJoAtus
zHyBugJ>9_*o1k6>EMLIK^FYA~!sy`#9(d;y4u_^Dn8zY47#Nj7>cJS{V0dzXIy4-d
zG3xn*VRNQo&^9iHfgKD?%FtO2WCun-3n}<OB-lWt@kD6b8NP@HnnB?Xy}`hwJpJ=T
z7GWz`&ka|g!U7Y$yo)rL?l6f(tR8kQ7Az8B1vzXm7gnJ}K*I`_7$Ts}_ef|x2Xk6v
z0|QeiJP>h*AvE#T!v}G3g<<3i2If$BAR-KmgjSqzhl3-Hfq?-%?4WT2b6^x`&4@B=
zN*`&-0Ia=6YDh+PFtBKZ>S;pkM>r4`vQf~Gih@Qu+#xp@81<%Kp3EZb6$vdr0-*^E
zR$IfAMhh@71?xd9Ku$-|(8>(1&SSd46c(}Ree+m2>Tw!Yz`&#jS)qqgh{3WO%rUUU
z4NIgLv%S!k4{VeimcoJ{iMbxJ6A0R%hXpXqVQ^QkU|<e~y9g10Fb73JlOAafs^^2R
z+=9A@Xa~huFfi#si!J2fMlT0o4h)4Bn6T&os}p5FRGcuM#+;b`U@D7PJy-!q9va^;
zgTkN%6^cP1b!bT^R)K*@4@<cM@7h3HR~Q8$ByZHidjPPS9G1)B%|>Xhh8YNJ-NND+
zR#d|lbiy1AZ(gE}9>i8KFoKs+fYUHirh_%*VFtiLDo%re)y2~tx;FzUO+Z5ovbO<g
z00rEXVPIe&rnv@MT!vAnvV)w4NHZ99D%3}?;s%x&VIc>LLfGmRcpC_sMPU;apf;2q
zXlMz(PYx0%@F;-|jln}AV!FZ%7P)$u#Tbn^XzqeVB`iC_IwI(4Ee@JC;0}Z~rC=U_
zRRC!Gdie4}bOSA620|+-ba~heEiA-ftrJ*H0t-Rdls8Nq-UR^{^rn2mutW!|75_oY
z1z5QP3$geF26h#{P+uq4AaJV@chD(7;v8lGj0VLKD2m`g3eDfJD1ZeKEQsN01=_BF
zw}T-eQ;*m?32m@r_aefFFpDta8dl^&dt)#M!)WXd2hEg1eE<t<7!7j>jE;vo5SCgo
z901N{NFxZ)IEN=DXkvtoq=OSPXjvRQC<(b7(zX*$Si!*R=;PxL?(rb4yMwi~VTlOV
z)rX10(m+xL1EUTocA>}l!3SAj3So^(*w}v(v@r`eU<U(}Gt2}m4uCaAVY@6a^#5RB
z3Ww+i6*q_y4DJAMvgQ+p4ZNZokZi%g<O4APrJ9E6M;}MU&|ks86am%`vLA~N(1$58
z4A=pR0$B4J(*v-OgJnzDtO-0VKy#NW>^Q$<XySn7-~Z6G01NWu9}KJkK8}#lBP0jI
z8X&MBhZhXc#HS5yU||f+K*f_`*$I|kVYL~$fv_bRFazNOx3D4-&A}-d4D7)nL7sl@
zI^crF3Klo8G8i@*0y7X6#3|5h2J?BU#B_ssEMi<RzRZs40rObotYo0sHgy7M&r&cX
zGa!XbDs*rGHcbH2pSolEig_$@OfnB9D>Bxw@Cm2BnC>y3MUE>C8U<+`(+lRa$O)lq
zOxrMh!F(1mD|iq?N-$wq$iY1XZIHM@i(r_=X%D7<n9m|6l?IKPH0YEyOg`OUy21h$
zIVCNq{vc=<6fU2@z~<u^;u;(>U0^kfIOB}z6$@C@n9_GlU$B5htUd+md{{WALal+d
zB9fr|bZEH1GC8ccgQY;&#W67R;MRk-2fK#3I)au8B84;5Ja1u`MKJ%RLnAUB+R1<_
zgsX!)5b9r;MHvy(8y2#NaVhKpl~H`c83(2>SjZyBl<{EtfrTuH${wDVp!UFO9$1!u
z4XdHMCj&a#2-gp7Si*XXu<{;WEJF(;sQ<Ku;dvA~2(AY;09>FmAXcDfGEDDS#3EM@
zJ-G_LY6|AiG?4!o_=I7rqTmjK_IS`e0(F2eEMda<u+x<>#>gQxVm5rG3asXW`4Cn$
zqWe@E>LIvCp)FpRKA4ALNe32lnJ1=CSj-|<p9#&Hu(Ad2F$0i~`GjFH0+Wa31X!~Q
zmZRWRHdJ5M1qN0XH&5subVR8O3#cqejtfS#DWDo*9)$$}jD}eNZ*M~L5PD2zdrWUw
z!lK5MePH^EB`k7E+0Y~eE7oC)pkM)!{bKryB`k75@FWgxnZsfZ=5d%u;pRcQhwy$s
ztPqBoo1-y3VksyKK=U#z0^nT}SVJ6YAFMEkwFqGL!OCEmJ75Fn@WvS^o<JCy5MVn6
zpy5={06Gx`)C$DV01a@M#qN+8!AOCyfQO|#c;5(?(x9~oEaFfjq@GVWX9fdnfMXEm
z#1}N_!KPKf0Sf9RLPG==67XSRs5pi?Xh_167A)!KfE)&Dw4tYISdxMTDXhMPSqKd}
zc*w!j!7TQGh8!%ab9XSX1$%o2ga?D-0g={09s}=XK=%Q<fw0m6W55(zYQfR~%mFa<
zFbBiZ3M_5F(ttbz19Z13q<Dev1%nv`^9j84fX<k~;u1!~e4007y2A<<Ii);k#RRi3
z7n;an>hc?=H>_Y$tIt2cz!u=|?ClD!@)02;3#|w8VVM&ewXhxteBc=>5A!Ixdi0os
z1uWDYZ}=!0M&d{7t-^9A+yb<UF8{^!f|V>{_4&{W239Y?JPxxMR*}I<16W%QmL_59
zV2h66r2(`<0&7sfG9@f#p(#LH7-ld$7eYfGJ*EmaOgC5saxl~*FnO4Pu$U?=U}OX*
z4p7oXYAQfOkbwa_9>^yQ^C+z5h3j9z$Ot|#1x-IRg?Yi75U}PoR02L31DhzsX~7Ey
z*5DAw5ZCGcZ7kyTMIMZd(O|nk1R_PjE?$EjM+$RaQ3eBJEJ!IBBh<tE2TN%%{jjDM
zT>lIPR(tpoAiiLD2Mn$OmUO`uFu)59SaAv8WeuI!L!Tomx-tF7Y8JU{Sep-Kaj^vh
zBjog1kiiIt=R+ej9oi&?9+(7oS1~w%`Gkw0Srl$w1_Qg5pTD1@uPdaH4{J2S8lglR
zv}5{(H7sIQMbP>Jst-OR40AvRw9Q=v&Fe6Sln6{$Sj!?-57!S)`V0&VN??z|QyR=%
z9ccFlW-crX!5YD^EC$a?;N;9FjGl#H>Y+JD`u~4u;Q|W?xC0ZWUjRE0JpaZAPr>kN
z1ZqJEtaOHkIII%@b0{JOfINo9gU|qil_l`91tN|Zse-k&&?lQ=g$m5!r2>phQQ%Mn
zS%^q7r3zraFsy=vm8P&l4`x2BY=M*&Jc!nD>5b_h)`6moK#0IBf<+x{gq+wAfvJai
zsLX(oNe>*_U=P^96FDsRqL)q>2JB#92W4JQA84Y71sO)`4w{Q$E``Mj+$BGz3v6JK
zV=51rZm<DMNWdy0Sg8Q3Sm9{~+FFIB30S5phgP_-Vn-I5snExR$|3a?EC3LD;>ruA
zUjR7>Hg}Eg02m+EWWePhs0G3>2f`f&4H$F>!5j)*MTBrrg~0TJjVyBYFdsr|E_hD}
zHuMfpbkOn)7Sa_P7+D=XT%ohmh(uftbqFkNK^kd%!mt>F*#}G1a0!^fl^oL*HnE7+
zqZ<SX5!?pBEP$Jnz{nEf;fgU^3oFkmpfz#@G}poP?O<ea^$DK7brXvqqVR*39fW)X
za|A5ZV3xoQ|G>!N3|m`<RE@(t3kwyfdLH4b2u5~SKNpZ5aCLy;B1j>C2o@YYR`_T(
z%w?5O@57sv(AGJ6a8z|LGWolK@-+zaAvP|-!Vxw`1IvoAh=(O8c#uGY5Z1(liC3Z(
z&*&b46$OwWap4oLmSALc^>cwb3X$?)4uUxZT#+*%79m3n;1jN1F@41r7C9|gN`#d$
zuoMq-7+n2}=^wVRh)KcX2&NAvUt=&`VJnu37Co(i&#`0R6Gji=nuO^E*z}_(c%1q-
zOh2%dMJx*De|UgGV;JVnS_Ve8AlCp_N3=#hOkWK&B48;4uFqn+!8R5-rrLt(0oz#Q
z>T97n99C3eq&R3q!x{iEb@EX6z`_rfKw#kxlZTbD@RSKHd7%0bM|Hp=3hp4NLb$^x
zFfu`pazh!?hD9V?AJjuo3xr`Q7`C?%W)CED*7FI&HKJKq7s1F3J3J0~A{Up1aEqW0
zfLR1{2#iLt57bkJxCD{uVLq-q!N>wzhL7w3SQNu8ggP8%VJ)-~ik>v<Js4TF;RZso
z8n~y7VIXwKnxKI*7+HN>9pNX^!Iscqm<Mh1!Oeq)kYWSq{2~TEVXQ&JfEgn7FBsYE
z;Wk2i02*b%un^i|#9|>R?I76)tuA1x6s7?d1q~6?J9e@lPI&?iE`ThAl}hkMq);Eh
z#i3CE<713PKu2M~nG0$31*RTGL*2nF+;C#L#x5j>z{*j$0nju66Ng)fCJt*+z*gVE
z)Wbc3OFg8?qz#|Qg}O|*F@u54-&;30B#0?L8&s))F`sag#PkolSmc<R45kb0W>I5m
z3YcyIrYoi=>}JtpYFaRT0+@ec`i|Y8gB&0hz?bbdLEB_7dzyYs|FN4zP79V<U>-qN
z*KEPS9T4Q{7ot0D4~v)=Od3-BA{{^rjR06c$3kcDVBrCyVb(WSOkc2vMGZb14DVph
z1^E}tLAT)k6(79xX@U+}!@4W5Hgh1<+pu~P))Isjx3D%hw8w0Xd7>_)jS61@05hNo
z+5&)k;KB5Uy)1I|u+>2@3os^W!7YD2;by3VVTDW+R2)(dVxG_oYYM{}1n>Zd4%<P^
zsTXd7_AJpu0&XxkNh2@LfbJ>zhd-o!p&o`+Q0V4ELRbgsjA3Z+pao<u1D`M~Dqtbj
za$x$2eJpbD&E?R+bHvy=)S=*Q2@FW<?-W1=@?i|=LL2Sy#y+g9fe-FLV-nV3On`VO
z8DSyRU|8BgPlK>Q4rowAR~;itQ49;AQPajT{ltEJ9)(6dBm@b249x??x?fuu?g41#
zgoO-xW^Ct}KH&h19DIi}I3hr$D75f`jn=@@I6N(a74iw=?4ChK^V^^S4NsELlmfdP
z1KO5x{{J7ENnj3zB^~Jm1{T*a$V4D=%`J^KD$~(1z2G2=T#!7pF$H%hG{oU)8tO54
zj6?GRJitJM?no1B9UG=UILIQVg+5r)0ksE~5@7D_RG6-Ch((R5Ghw>NA<zgiwEl#Z
zj<6Kf33Wd#U}58$uwDafAQt8y*w_hN95Tp)F(V8c8-ePphtCAUG{P)`DTIqdJp{7|
zJ*9MZFfgivvLhHH8Vs-$k_{bOK`jMM7~uPfI-wOgY(56+LSa})!a}gCV)}x^NSp3q
z+iYOtZ~@R5g{_H$Em?z=?+oBIrHGvzuwps{HsA>M00RR9Gzr7xVKD<ex!qY9c62)|
zieLw!%Y)CH|Ns9#Gzy_<`2T-saSZp!gXtAVSk#!hcT8UZrXNf{0it_2rhhoXB3IuH
zovemsa(EJf=2?t^L1+NNVg?p-uz-Z=hl#`b4=_GV9n`*hVc5_$c%q2`sn~^PQuKKy
zm<6!B2XhE4&BE7dK$8MY9!7UV^8zG*Sonl{45kYlW06yarJ)|Q5bO<LU{`Stas`c^
zgLYTeqYoPM^?)K1Q7*&cFcsQ}gmqzIxfC|03vmITaBl|#8^nCDIk4d=VVHw@QP)NA
z2>1SAU<VzL?HX(c8FqmA4Q3Pi%7b+1EF(-F);xx}pihI5)y3a67@TO420mau>4WNr
z`2eo3gMq`@-*0;BaTZA@m~%0L2Yh56B6whipa(<Wf$0y9vxwm~2YNm>Oh1f9H>Y1=
zy2S|=IWJu9;f0<D4$}{7fx`G0=2c8zaDqh+r@MH;U4MlClAujb409e#JBc)xgb_?=
z#=yefAKHw-<-7?F;FVd9;AvB&xWnQ7XaPQO0|(*WE~tBPTCjqFEjT176n(=HEZks;
zVIs%$4<}jVgka4IxVXV|g;OkI(Ks9=zzaP{9cDjl<N-F91FIv@!*gN+BfF1hh-;7|
zWIvD=EW{vXFv5c{gW(Q3G5x|R7CB{fkHh3A2{3X5_y>ms`1?(FJi#Jb4|6%R%o2vR
z98qf-;wu?&1b_~%hZg?uW&*SU2log>-Wom%3-bv~0gMl$(c3MPJf=T5%_1gM2rY>w
zLJM`6PbVu(7dXQrRu2man7J?-W-g3|>k9yF<%KRwK}vJ5N($CihXoYegV3TCw)z*E
zRO*G%t7BLQ!8JlF1K3hhSg#1aOahuo;0~O@$OJnh8o9v+^C)VIF&3%Tf!6D=5P)?{
zVIcscVGh7mqE4}3;Ba#Fa18VGpPsmsMN|r|5E>OQmrmI+eZyJMky?=6fv`4ooDY`j
z;p#pxusZp>M4}hbu+x~~`k>~(^i9>6u5gY;P6$2sOih>`aE?W;9#>TX_b4<?PMyHW
zl!9d|4=it>FZ700)3EIj=+!k$J$woq?%*5K&Lb6*Fm<qQAk19Y?g(7wqE~U#92lAM
ziFdy>d|)IDk_m;0wrIul3+GwHIibyu=>pR~fVj{*DW)4t7r4M8#w7=B2Tl)|ZUE*l
z0oVP)(+j2tTwoFBgf^_FPncc+;zCp9^bOM|fK<yu2jHe(n7-ixi(I|b5vcAD4BQ!I
zx<w_4#k%RK;QJ6j<6{C+pcXI#pYRL`2Ie3qaAgh_mxbCo!vZ7@JCcG=Ko-0hflqiw
z00VPSIFfp(J7#2n#Nq1e1z>AaXEZP{2l*g0$Uy7b88blQa18=7&^s+=Y+zsxia=5i
zO>HwyfW#5%rJ?uI%y_^ckWr?alb@cMoS37Vo0^+nz`!v5%taP1CuwLiY{m};wu~~}
z<iuidpa@8VH}CKX&s1RG$tcq;El5c$N!3k(h7O;A6tw=EX)#^m5{o=1v?!SwG2H>g
z1sTG?Cp@!Zdd4LdIW9?PdwJ%H=@UTGP)lcCn7#wVg|>BO{+Rv%#Dx}HvlOOtTxOBu
zlDGmgjZb)%$8>|sEb^Stw)?Dt=@B3<^y-aSGp09yxGYe`2d1w8X%>UpJnO~u3zu2s
zVb`?G7GQv0rly-#tP8qK4XjN-9D2&iY>Vj<S6JjZq2<o(i0KYjSj0J@<5{yCrYC@8
zp$?tBV0s6L3w7u06Vo?<xZoibKH=FPrr)^2BFE(k?IzEWn06J!g{GD{4%0Qjd}u0}
zlQBKuDvLbl6R?AX=S-Mh0h0EBc5dhFn7#nahc<lXJeYn0%!lTjxg66!TxF3H^nfPb
zxdse^p}|hN5!26KWfAA{fX36@i0Ka3Sj0J@t%$h|(-W?-h;g|?`zdo5Om6`5!ST%}
zJomu#1z<in(eVk-eK7q1m=A4T&SRMV;2Mj3Jv4{SQ()i$S?Uq$r0eMi-GRiwC*TIn
zIrBUq^1i{&sPfQad|n1Z9{F||H)ukc*8%ZVNRXpnu$ya;u5(BbXua|Dy6Y^QoX|pI
z-iqlHuCvH#!45N-cY%Q`DL=m?w>Vul8Eg?agau$HbIkiO{l;|`c}{4inJ+Qz28$S%
z3p7OLJ4{!&!6L`y0-0$No}Vz?1I&kp!2FKs1t7lj6tJnn^EXVN0p>$z5$4~RegI^i
zGc*Y;V3_{k28&$16EuA;P+;K5D=SLO)lCM6F~}599qcp*#NrcP-~pG1WpHp|<OuEi
zFUWw&m!s;3mWc~G;PS}&>jfO4d2zuCn1UQs1E2|M!3nrLvH=2+>#_KR7rcPUSD@;L
zX2^vcaCv0?d;*Tp%fl9GFo;YSQ0EYtE_aKCgUcS8uNQhuH@L+j#$^Z1T?-4Q2i#&2
z=Y)1h7fzU7aEnEb#{pVqF5JK%Iej4?hvf8x+bk@Q%k=mJ9H61T@CJi$UTXRDfZHr0
zpsNJ=1ni;u7I94faEnEa3wHVSB7^A)w^`)4Y@p@fqJ-%lAigzpM1E1n^a2py4(wSz
z;YAy!&j9glVdmYKegMpe2H#?a=`TQh8)&z5vBq?PJ1lbb*3eR7aR38fdTNO-Bn>1b
z7N>&aUBDWe-WFFN%NJ)>!Q`RAw0H(YJ}oD)I71hq-wK+X7w<rphwHBwu!63iUwngs
z2jqa<qzbrpPy)1qrjNxx7<ha<ox)s0Jaqj75Ni;upe4!@2?k!6yt9u#e95gPw1`<^
zfzTfWTVugc&nI9BwO~mE!hrA~PskC?415BX&`iIif`P-;&>P8eNC;U#V`Rw;22PMX
z!g8oQv`AmF1EL>cIe23epMV9pFyIqjasy%j!g8nq;4MIW!b^TI@PaJxb#&GZb`62v
z`N1b(4lN><N-%KvxrXTa_(NBafV4C437A9M?@KKp@&TTH?qDgf{U8O<EV49$ffH0h
z>E@>9mBLgo@ClefJ0MFd7&uD`a&?PK5{tkEGgu9ufEmmIGZ=V4@@biQi8;^|0*XR2
zXc}9(gFy%+pOczcma3bUS(IBoedRqCUM@3G;mN=!y!6KO1NT_uxXhpx+cJjfFF<@#
z=={twjp+jSS=6{pp^0u;z;uWEEb^LXKn~#(Ue>_C2QojiShqaCC_6JR9V{+j0xc7l
zt(e|%pGA(#1X}eiJ28F3eHL|2Xc4&V!}JFrE_9f8xx#dT2P|S-CeXaQJYc%P0~UEs
z=%szj3#LbaxX^lW`Hble4_M^6ppAp&2N<Tm?qyS)e(C`WFRVsb{$lzAkQQ**@d>X`
zn9lK#MUBe{n!r|gOt*N*qFxUzSyogquzGm97(hxZJ^@2$&R($sA`Z^@415BH(3*I~
z0kF6sTs^epSaAa)4p$E??^b*Oi<`jI8$dHk{Ynmq1Wbbg)Z&#2U~yBp2B^g=Eg<4>
z_0ZT{8Nk5e8yo}?X5bUhhZY4ZGr-~yV;J}Z44|>OvVnm$*d?gm5Tb)mKp&bjSIz)S
zz<s6<EizVaU|<OdL$UxGuPaZ0?pZ_<hi0Ia4;WZNoL~)IJ^{Ty;PfH9@&`yf6k;u?
zNYH~Os8s?CtS*jDP?Pus^uRq_KH*iMt<8>3K@czS3Ftv9$yE-Zknl&ShgQz3A|T>$
z_0Sk!RlvX&91!Gg0JfS>Ko=C!pv4HQI-n9@9ee`1(70IzI^Z`T$Q=?yd;+@Apk4)9
zh7S^lsfR|*stXWvjGz|iK%-#Q3#d3uJv0hdGcd5#gIr_`(*TWv)e;a5#!wA9&?s1K
zz`*VS(g5)SC_KT<0v%|Oul9h+gEb=Lp;5Iu11b;k5l9}i*O5;^8yW?xJ75Y>4bX<h
z-Rcz#EH19jVCRC$8ct|gv-$*B9IA;=Koi>ZTm686&DYmC2$HS%1hk=L!)nmZMPFw_
z2k7Of0@~0rXN>>@i>I>_^zcYN0d45C)Vc-Jp0bF;vi2H>=?YI-^qAINm>%$yMUCq)
zbP{XLgy{`WS=8#+K#K`jhZxpxUUPtf&Dqh%M;Clv5}$w;G}EqSVBiW4aSRI44GMt{
z5`x1Own%=h1Ou0wPiU}*v!k;I_^d8a(D4aqLR%?oEf@rye04$lZ=D@O{HLovW07Q9
z8!_GC8H*g#+J@-~&sgN7)-GURbq<1EGRP;O1#R=MJurR7GZwk1wKo{pT)>;KA%=57
z3$C@$8V}|f_~Kb`NeR1nmQNU_4z?l`=IOORrVBi0(PL6InC|eLMT`qvy)f_zuhE#E
z@SH^**2`IwFnz*v7B#M7Xsdo*!1M#pS>)<rqdd@YDEMLp*m+to`AldWz(#{$8_;0#
zuyHq-JZuLbY$S3$)LtlG+#9^Ig3nkOHr5H7C4m_T8*G5h{;Y#m>?#KB6JD^iPk6!F
zKH&x1_6aZ8=gqGF0_iXbeSxGip)Zhzvd|Yu4I=af(p?k!0;!IKzCcot&=<&1k<b@N
zttIpY9D000Um)EMIQ<nAXAFEoUm@)yp|1)c0X`UAFZ2b{ED*W?HTVLg(iJ)nHRu9l
z2u0`u)BzWu23&yjNrf(eW1COt0=NeNG8`83AU2=Scc{LLkQS%VMQ|SF6S@Gd-&FX7
zE<!`#BBYBVbP>`66}kxN+6!G2m>4K53qD^8V&X5bPClW_P%mGeF)>iYfKTW$)Mb~U
zF1`$P*(FE>3S9;VEyxT81_tJdfg&d01`kw#Pv|$u=a97>P%-dH5>Pgu&~H#eVw@N#
zQ4eE7rN9&`n1m2~Lcc+7K`{%>E|A+$<UzNdLv%AR@CkjykmrU;GB9K^@Cp3}MH`9%
zNS9QD<Uyedk_TasRu~OpgXBSh0TP2@usDq16Z#E`UXW*5_=JAXm|oGwVOK8<4e%!`
z7`T~09t11r6BdRP1VT@4Fz~Q|2Z2Bme8R%eB=l5)ftLdu?ND)O1U|K35E4K#2izh7
zDPdqxS3njAMGOPObklYYK`9YXEI<@#HXs=)qA^*KQEj@q3!~WdIqe)ljOVAnZ|9Jg
zz5r4KP7&_T&Q=N<?tY<~3Wi2{hI$5*6&aPM_jGV5F&>`2zJo(t@&(vo5W^W5m>C$r
zfzBtMF#Uc9hj{%fP^7?QL1_c*E<Rx%WN}bk4;2?d76)DF4i%RM(@=xNL5UH><`d`#
z7Ze~i0|SGm5Ca1^P4NlcfP`s10|TfwG)G7rgQ{f!rEqVA_)~D6V_;waC6XY7_!)2u
zoq>S~)KE!9h~EO|P3ZAtr3mrE;6jOk!3Q(|T2qgZcmOU<7#J8q8oLnUkHMu80|OgK
z<5YzBIgmP#V-GMe2>(QgzktOuNc|#&_;YZ|VPIeY)q|@Az;VG)&%h^821>RdgFtvE
zLc=L&%z<}eT|$Uo1s9(T3@o7R_W&V&7+icZFn~kuDMI`j)O_X_3=E9S2=Ut<&{Ln8
zRTvl;`4AE}U<M^HFfd9X#2<n43IhX!2m=G7G1LbPd;;a5wjIdvpi<Hqq5cRsi83%S
zv@kF*`Xa<{flEUM2DTdv^$d*R2#F)03<@#`WI?JRY}b{zKe!x+%x5tcBGjJ%6$l_p
zpD-{mwjvx<0kr^R6yr36`m?Y!bcKO|aXv^K)FNZx6M6>9P$1PG7#Nt5;}TW@q%bfr
zE(d7<DdH2l3Q4^T3=<d_7?GmvHZ*D&Js21mk02a09U7G&-HfLZ=A5jDYGBY|U|_t9
zkT?qS!2$*b#&-zuN6_rYw1R<w@drZuA;@G9p2NVv#DNfh4D}e}8U_X)q^LO#jT*53
znIsV!&Ovhl!vzKgCZzm&4H`AfOBfiKOcCl&L4%a>3IhX^7ef39)S(PH3=B+Rh>(~8
zbr8s{OnE}}@B-m9tf25=U|?!Q7<3F4LJ<rMOg#wkOW?)?0|Ubb1_q{i2=SvZa~c>J
zn6@CqPr}Mrkb{oG#OwKlZoL4x1yWEjU4u#R2_1))XrPUhOpg)b=RpM!NJ|9+1JehD
z_!&@s2Z`SSWo?A`GgwqsFfcH)Bg9XF)Plo*1p@=KI6~qEv_xYCB}N&9_#<dOW@2Gr
zVAdCamE=1iXUaiV6frv>)W3j5K@S51vnxXU0nEc03=H+mNJZ&+SgJn4z`&e=(C`SF
z{TL+}7??W|;%A|$no$PS_COMcCN4&hISUZt&!8nKg9-x!^9ryy$p3sow_u3^WC2ok
zx&m|Q0tN=QD~Lo?4DK6(!jFN0`4re7P!~ezIW!8Gr!X)uUqpx>g_+;Lz`*<hA$~>z
zWIw0?nZUrnjFg?8gDM{e1_sU^1_l-;goe}L_8bEP;~WMC7D0sgO=vD)C}3b<QACKJ
zhUO+l0R{#ZM}+uEXyRq6&tPC+2}DSogO+FvH4F?aaR~9Vuu8>%fq^9-A$}X0RzS5P
zOC3V|IV5lx7*{Ybu(TmU4&LNsU|?XGD8x_?tB;REeZW}4z`z178bK!T2|a|ml-Y!V
zfdvw0;Gn((ON<>13@n=w7GH%qXbA%Y%Mo}HF7yXlelVmmFt8wUS-sG0Xrf~YVPIf+
zgfQqZ)F7rK3=AwU5#lFcQE-NVf#p9!9Mp^eIT=)$vGOCtPr-6Q0Rsc80z&*I*g^FS
z49p)G7+5V35|5$zmGJ=s1FH`r=%zzM2xJLsJVO03s0To)nzafcejJu-Vi*`$Cm_V{
zL(O5bVPIgbpM#Ki3UeuF073#GeiCW{O9ul3>tclXeOQ`^U|?Y7LWm!RCSFiGfOQu_
z{5mu@G5IhsutF;*(Dn?08Q>8OkiQrhSg#{AoPk;lx|@#mHA4I*)Mubm>R5jx#E(GJ
z1gO4eV?~HRgGL#H0|NsaA3RNn`+op$&w$kHY)F;RZD^tcS-_@@Fz7k73}@WKz`&-3
z5Wfv;u&6LFu$c*g%3n|-6@aX&fOw3}4x#=&ETkXQGcd6EA>z0M)F_0gXJCtlyHw~8
z)M8NTWy?kwbQanoVr*exU@Jz5KLGdh7#J8b7#P@)vgKn~NVqUCuz{k!9@-qf1}!of
zVi*|MHX#hU1TE3P1|3F-AAvPY8W<SZE+ISs8Bl=ufbAhd{WGY8Kt(tkQf{ih1`P@(
z4h9Bx284z)&?sQqz`($cl%1}^93;cQz>ZYX9fQ@1Dhv$l)(8j9faWHUlh{F1q|6`|
zpTKlbB8Rp=83axsEItl(5J(vhQZ6_Qbr9nP1_t&Rg!=QasCmP{AUq2p{sLNkgAy-$
zo&W;_s8h(mCjh2EhBGiQuvgS0Tv~$c(q@D~_n~pj5W&E}j?|ui3X8G?1_t((2=#Yi
zwVVb613yv}Jc6k=U|?W}RdV$Vd_q@YKA6M6z>ZX#oq*O_j5Z7m>`3kWYtRA&RPVFD
zL0J3*T4FLZFfg!xM2KI9wul&W7#P_9ArkfP4Y2S}WnkdoLDB&A0gD6!1BWO={5&k~
zD;O9!ln~<QpblkN!N9<wj}SiwRnO?cz`%i2`<;dsM9d)!^$Z*V2n`RQ7K0Wcb09T9
z9zdf86cQXrZNtaV+LG}H0|UooggJMi;_MC#3>-+6*-dDP2};x)>p|+l^*^7`F=&wq
zYRPaM6NELbB(A`shJ%5D<0?o4DCO`8J%zP=G8h=Rk@^eIVI`&s0|Un$g!&_}C~II~
z;6N%#@7F_%Ql=CJ2DUtehQqMV;vWVEj_(NZtFUYq!oa|Z)XskjD-Y%{FmMVW)Srfh
zXaoZTCsIjz8X7|Nj13G7oJI%@mtf895(WlNq{ie^Xf6QtY&bm->Q8~IQ3eL)8w?Db
zu?X>JutX=qz`%(Vl~-WB<_Qc8oRvuJ|3}ccVd!CC;OsycbQWp>lLi9==Ol#qDOhFm
zgMoo_8AALDtcYE}z`(f;DJr2&G0?$DoQGiQ>-mJPK#N8OkOripbOzGU4R;bu1E0`c
zSn36Z&@F`c5olC``h=WFjm+!N+`)8*fr0ZYLj4U;nggf52nGf&7KFq-Xrg1`U|`@v
zDgp0-(jI7JWeEcVmj*)pS!modsxUBc86d>3!4l~k1_mxWL_t@MRLRwIc_K7CgC+`4
zKIRHQXqXPQ7({U)6}=Z>iOYh4feR_|o`8vqFfed6Aj~O;rXi3y43H8Q<bOV)`!JUZ
zFfec-<>Mo;G;x4|feR@gKZJ%514w)=!UH#9bqC1etqAcG&?sYaVPN1oi4ecH0%Sj^
z{m;O_z=f2*??MY4(4Z0*Qa(NkOGHN)7`Tv%-t({qNB{!^H&TD$ILrf}assLEcO2?r
zrg{zr25xDDi%!6@%^d~?Zlt30C@e@D7#O&bqU<!xp$-fT+|dYg?m}|`>k$S9?sSCs
zeQ0iC2w`C0&PQthUxF4ajAs}axEm1J23DYf#+taNz{MrOamWCwY8V)}=fcGgE`wPB
z^4L;@#m`_NSHr--y#_8`FLVzUbReJYfJ+EngVo<(7#O(EAjHqW)R!<Ya3gigpTN?D
z1Oo#%a#s%OF;H8Q`yaxbQ{Y?!ivJD<1|Fm$^E#|NSi!)+BM0{xWT_m;+Z+rGJV@E^
zJhWi~8ZqHP8X36+t&W*N<~Si5r7WO)4>E^=fq|#qAK{{V(CQM@6XJ;!fQ^0$Lndn=
zI{3R0>R-SL90>*n9;EDd2inkJIl{oeQ;AT29~Pn+3=BNb5*F0{7di#i0BYgz%z+Oq
z974{nJWCJ;oq)w<3j+gJAR>PwmlHfYki@|YZ6F@tKx(4hsDQTrLD`Jw2*Ltb2r+J9
zVBk56FsK}22AJeQDte#5QYk1T-XqL;3QLS73=BNq5aMT`X@VuEo`HcEsi*P)n*CTV
zFfi~6BQ%_ZYG9hez`!eq5PtwIF+sH`uN6Z4E-ZvX7#MgX5#r}zwJWF=1a;+L?f>U6
zi4q0|-ZX@dr$L&@U?1}$jeOpKsuvAlVBkfH<Lgk1nR*x)c-s*cpM#YjCm0xbkp{8r
zPeW@bP?^uW3Zda9w0dRHU|`_gi*OJtc-9>39tPg?2=(Wosh!~m0|PI}`{2aJ2c21j
zsz(|vy9yDi2M?k0Ar+YyV5!c6fq_p1VevGW4?sOTc_fRWiG{g=fq~BiA$}I@0LX?m
zKBR%kJJ2-2+{3`Y7l1VWe-|1OpuQX*Qhomb6jvbEPGMl+D?nIq6XsA81_r)rghR{0
zYo9?H7#R4Fvg;{WU9g9Nfe+O819kmC?f**<wG5y^BEFqS1|f}d@gep7ZbE&=2nr#j
z!Q|VpHlqLo10PcEI0hAG+`z!Vhtx2+`~%khpToewhm<|;K@%6K$mB<=wH`xDMo@d6
zAE~?k1R4d5Ul<tpk%m~#LemiA4h9B(ZA8eOhkBUd1VcRozb(8+BJK~1V+95Ve&kvX
zYB7rl0|P%&1LO&`#AE_ljMOcE28%Kk1_u6OcoBZ+4AdM@Uy#2R<RDP_&%h^i1{y@5
zp;dmQ2FNX#gCrOj_>oG$Ye+>e|7N5p124sZc#r=e$N~_XPv|JL0m86_fr0-VLi~O`
zwCDv5GV>$F8F;w@NN)%O13%LE|8;16&!WS?!2btf&^c&*52}y_Kr6<f-Rufby$v!4
zboB_*RL%ovVy_3qu>jII|6^zY!l=N&AONbhK&h00Pv{A>1O$x(3Pd0*J_AiFpe~gF
zQak?)EKPi1U=TnW0eJv(=m7=>fi3~i_#4Q1d_sp{*#qR#neaH1xB^Y>pmw_eQWPAA
zWxpv53<BE_4!Q!1vIz_f0>_c6U8HO&a2uw+o=@l+%wmv>KEV^C&>vWwr7|!GA{9_q
zp$!nm6ATQ3e2BQ84ql%E@(crmAW{MK2wLEP`UQfZ!6|5no&=Sc;PiKefkDt6<|00!
zQ?SGp!oVPiRC#~~z`@2_Ffa%rrS?a#&ZPzegJ3nnoX610jM0RFK@h1Rx(&@W41X9H
z>IIQ1gWJ$J1I_OVB8}VMhBd8h7#IXsBP@6dbEpdggCNqN)g4$fJb{5ha5qBzGgyeK
zFfa&03N(=a`Gn3w4Ps7VU=Tzq(XK<QS5VVR@Fv2bQ_wWQ*ulUc_zDpP(_kUNz`!7g
zG%$Gu8WNx@sD#)M>RA;)_JhNefq@Na68bo_<O1amArXYdPhn|g4+Db`QnURLv^~!N
z5;sPuzXnaDpwTrUq!ExKP;tik8U_X-r0nz*X0ZnYgAmdn^9fkV)xy9agf!6j&;aUs
z69xvM8id7<z^z-zMXN%62=Uuc<)HCIq2);J|8p=4CNMAvA-CPY>jELVgpiuy$3UqU
zB%H&*AaoyL!3k*5%Y1=>K?tefx)1djQv?Hp5MtQAUg$8)2Q~~0!bl?;$6(Fs0tN<Q
zq@aEbwE)zE5w=8Fd=nN0AoWPIUFTqNKZAimI2fV+2v|KR{wFXn2wp}=9EO&3peYsM
zL_}gK0dElkd6|JhI18cv7%X>uU|<kN>g`SgFOG()N6LOTp;5ym!N4F~KNDfl3uvMM
zO(F>|LX?2uW$vI-k%56h7-_2I2GnB4B@7J0dlBZGf|&yva6sxIJ%@#;3Il^MbeP{0
zv@qugG&_MUMp`&<6;>X|Ffa%sx7}a{{bA7aaW=FBktW;kt>XA8T+b)K2%2Mh$^f0%
zh4>$|e322f8VDqgR3(AM`4|{LMHFNv3Q4^XR2*Hs6axbTs1^a2qe$xIK#RUX66hM#
z7#J9qVsVfbR2*Hs6$1l9Bo_6ct&SjZboE{c^&qRDPT~__1f3>`O+(Ohf&CofvSFZQ
z6rhPXs17j2CjegW!8zUJ0Ehnc$Je=p>IIlV5#+?c09qvgQUoc5_ym|iJ^*dD00k{b
z0*v_tnDrPK7(n8dU;!w>C%|lmCJr)}flq)Lv|J$*VLk)chkOF8pp~dqpm8wdg;)%H
z0&Eu36{c~DPM1B%v5WD?^cx2`^d-SfC_VvpkefiQ4`{wN{xMzQ5Qn%bOd51JAjm65
zP*;H|J^^-6SUF9PImDsN*fG7~5Qn%VxWwQSVBZEB^I~8C72Y7lMjg{PAW3t83<B8)
zq8S(%j0L7YK$ZqYCP*6Q9D(TqhdE&T83i~#Oh0g*LyU=2V|qaZr>M68C#bjpwc^lx
z%zcW1fuWCqfdOg_$R(iE%Y6<i4mBSpF1lyBLL;Xrvw-N2=^wZ`#f-#2qi&!w2hCtH
zP>M|gjXy!OLP$OVu`kmV&VURMSD3zF3Yd{Iy+DymlvzN0$@B+DIK-I5e@vSVl8{K4
zzQGG5A+ZO{kQR^tS!9Z7sHDpD3FkS)q$EK(_!<`Z9n%H=afmTVzL}ozheM1>N@4l|
zBTg|UDUazNHgk$53rNK=Fff1$B(z|V0{I{xGkByxS1f?kqXmyt9s>gdNIkmvn&}(1
zfczxQF#Ur$$WPKH(;ZH8h)IE0pn{IAMhidb8`BS*<PfWu0cDC#OfSiRTG$|0py`tV
ztrx?l9yF1RMZGMjw8f%c7F1oNF*q|YpjjXbT7Hd91E?X2#R542sMqBJrY~3k3In+*
zFp)b@hCI)7h2tFJj1JQa96&1MCrl4G#UaKd|6=-t%^(4Vg6Rb}IYp%f6y`86FoIT3
zqq#~kWcmgLE>U9vtri9bZ~=v;K<ff_ac!RI363Buj8vvyIL#r(WE3;~!Z{FqV|v4O
zkc4r<bOClwF)8C23=E8*o6gWoHhwbw!*!5C6OHK(Cpg5IOnjz)0HsEg8qhj3%&0Tj
zGF^d<Q;f-!WqQIf4lyQEk7+(!qS6AU4Gav7pbiY01*Qk47l2%5`eFKplOT)CY^Dnw
z<q)ek12tl>xCne5?_^Ai%|KN&Xi^-_0yEGC8PGZ9XyWFeRE)(z=Ah+a3=Gqkp5_o_
zGXF5WVLr%J77^1Y{NWI*w*aL;kcnufS%9itQ2sy@w*)Q2oQ3IHOVHYNP=^s+Jt(1p
zTEuALpc0YMlVR#sPC+KCi0KKlIYsLQtZf(=7*#P1x4yx^zz7<MKr;k<9~x*w0=hWJ
zF`!lznz$_o0|O(dYCsnU#U<l(5kpQPDLYV2a|qK7c0JP{{NfNZvRi{aP1}L`71J>F
z+4D@R1qHah!So0GoMKG&4bu&da*7%YIIu7<fJRTyv#bNC$^o4#kLE~+3)2OTfJ|~U
znZDpM$OOj%1_nk@?TMz+5#&TrEsHMxV!FXe4lyYwP$>l}7|`UM0;U(d=MeL90tM-I
zOs_bBYKfg##BVV$Fo5nZL@SS-?oDqv%ONiL3@QyuppcpcG<+uD^lJKsvm9bf&OFl>
ztOOMo&Y&t8i#g72Aalf|oI%wyNFL1~=OCy-8PgR&1(EZLX&jtlOwLcHKbQszFc+8U
z1zMnD+-1ge2S!dYDVIA842+;w5?TPb8cZ*k1=8V~G5rI$R&%{E-QgmKn3Nl6b*e0;
z*WDtfANU8-;np)f;XH@9B&c5wTK9xzvfG#G7k+SvF}Z6@Hvk*#9y8qlRH?a7n10|e
zhnST683qPMZA=S17^Z)C%ONJ^0dfGy?`Q^lcuY6=%pu0)ku$yFI7l6++ymuNbaiK@
zZ}<jssHepA1anZ?>j}zGpjJAXN>5O=%!}y~&lA%dE^vs|dp=@dU;yp=L5poqP&9)Y
zIq2f=pz6_L&GQp#lM0eD_yjybrBN@Y{oZ^G3=AEh!Fn_cK<l#^c41cg-k{yVpdKZf
z#onMcI!Ha5c;E*H21d}%O|$?3T?C5|2eqKUPURB_0{INoN`*S887dykH0=_Hm{c&x
z9^?Q451a7`1S?H9xWpmG6znkl0Jtg&4goWy1%hL+mo32sU<J$q!8OwrzJQDdt;oev
zv4*gKo5ailAsS$Yv_J@`t%U3du&4P1LK476N(+R5S^*#hU<p_Ymro$11f~E~F=Df8
z0$2gFK*+7>4=!_vOM<3`kqrV5!0-u#JOHbc76<_?{l;d{AFu*uflwYWLs}pdwDcN_
z%1{lk0%n0w3mBsX%#aocT?S1}(6|6s%?x}3p_`^JxWXYO6$)y=gF0(adC*86sOcQK
zZ~6tWJgCS=mIn_(@(F|<n|75$oblUqg@YVoOkr%(4X$#CNrj<@DyaR%z$XxvH2uPL
zkbDOAhzzR%JC|7?tOv}H76=2?rJzuQxeGjU$R`lCYWjw29OB@m8KAx_EKPz(I{5^`
zKsywWv_TdW@d<>1dIBJEXl%m8LB?V;2b6?C>Y>&%g7xtUgn@cW{0t1!k6q{FHx>x{
z1r1%WGy?-%*&pow3>N@<k69pG0nCsV2-m=&(gv)6Ss>g8#z=uNAc5sA5Du!VK>c1=
zAVBk3IB3!W$?*)JHVXrvKscyV0TPG07A}5cdV&?G=!*b#RY3}1z6MpI4159+APYd^
zP>tZq6(r6B*2pXnAvNs=hnQ3ZEN4U2f#$71i77$>rp{>k0Z=-L05x-v3<M2sfEC)n
z6xKl!Rz%nIhMOGXjEAN_08uBPK@f3kx&nxQ2gZK`W=IP}e8C=^ksM$J%mR^d5Q8JL
zz$um~auLX6F{a2BFa^6nMvE~;?tuxM0W+ipB0(Dyu;jkT7hna<0#SL>9d2=m8AY|B
zr3&zvE}uZu4(yJLg4n<;5N$O*;0}j4quq3a+Z<w2(LUJKM?=aeW`Sr(S;Q<5y$+&r
zA5`NJ92##xT^bDwuNY8c3yYs(B%mr|bifR0ftW0)r(kIVRD&?^3B;65|8Sc_j41|E
z;z$X^fZEmAjGVszI;R-3K+L`A3vPilyqoTDmqT0<M~ub7Vk}k$>;h(iSgq*-cR9qE
zVy&h>xC5f|AO^)2LB;E!;!TiH0G;ZLt(O%$2WH>~C?ig4`hvS0Vp4ISwhvOWWQ3L~
zaVB7e(gJY~*aJ2WQd2Pt#AU!#u0snh@W?2iK-|9R3HLa}nBoqA6*3FNT>&$s1>zpy
zF#8Kw0kc57*7O7SIK-slK}}d>SAqxV`2^x!zzU@W;sdao6b~yw;w!)^nFZo^L5&0r
zpkOl+=D2tqj*EvmE&&!@34YTB9&m^;C4^0T$RW-c0ktV12h5NbNT|T>xCBVa&m@ol
zPAAd=2^(-IJOVa}Ss($HniK6HRwnvQd&nWilo$Y2kO=Xwv_K-LLx3eoCPLCIvq0jb
z=@TA8Tja>W0ID4r_yiJRIXn?oB_}}&a%q7i8SJi1GJrZF2@)$z0!d(hF$*MZn;!6p
zLrf}ZA2fwP3ro<Fc2F6Z1WOr7u)t5k5%@`vz@Pr~F^3>0BdBI#;1fume*Y1NI8!pj
zT4{k~9El+r5;)8P$&kb#C6K%d>L6$i2UUw82PIF>e+)7a67JFh$)G_9ETNhF1nTAF
zA7F-*Knkc&2?|e`iO|MF%Jlyr6H{PrOu^yC6qp-RAZ}z9NZB=g!V?ZLsT5c}4-GuX
z?od8~6j%+B0;w9L1yXRdu2LXT$s~|EUH&PDxKwHw)b}tG!8D&hDl7%3!cuT5jue~<
zNx{qlskf$Yc*-Frl?rS5gN<TfU;>RoFz^Ya!je-e#0}B{pv!f!6;)}FvQJtdEeh&7
zSV)2f&KURv($c0oJmU~!N`uq{(gJCqE<2XUNt*(W6J~)lNJS?tkPeDp<j4W_uNn9R
z(%Ggx=MZB`hh^w=h#Qy%(jiG&S|A-X9D&7-bV$aVuKJQgXnOv04tA+@Q0o$82P_0Y
zeJGF}`=);YTXJZ+!V8dPu(So*3y&=z(qU;U9g?=B1u}5dTp5s>OIjcU)HB55$_z*w
zSy~_iG%5jd94t&h!!Zne0vYqBZvZ(eV*xbCGPXfno3R5dz$B0{UH%1!xKzdo?0G)}
zlJ=MdGCqJcNDE}(Xb)z>ijhnl#YiSB%rjx#5tw7aQ+#{^nR(MMyyOsL$}E|F;V6in
zHtiLMm{jIGXnKJKJZOl5flnZF2~-)R=<pWELQe&t(KQA>fh-)sn+4id3<@-u!7%l(
zRFVaAaTbnLk_Aa6(gImHdUaW_UR@Tfc+P^wL>8=3mMt~C;WdXCQ?}gn2acd&$869Z
zO)RmU4eLy1L#k+Lf$T15(7-|xG(g3`Cy?DYUEmFem{c~7!P#s`Ye8Bd`xTl2pz(Z=
z0q>?4fDOPA**TENW){d%0VfM)ft<eS7eG34CZU?B2F)fp)26-U5UbBY>kCOi%aI&d
zBtw0o1)3gV;1kG!739!3f*S{GlR(Ac=4^sm4;6=-0~)juW|;o8mP<fdAP3e)fZE0k
z?Z@Vvo1XBNLyRfs!t@8VpwXmU6Bwfb#+Wu;;T?yVR4&XTP>YzMZOGg?FojpZ3~7Np
z(0pzq=3qzO6z~u_vq0gt=^H>s7J>#WkkTVFw8>U@1Zq+tXgCEi7_o2xv`<s`Yr4RD
z4l$`h&}sT0d5D|f@<mM39o}<@F%^|ezc3dxKvXOOV|;-!N-DsE3Csc|Yha8MFvb%o
zqm%*0kbyBE({s!Mr6Dkp0vMwQ##jMk9Dy+&z!-m^j4}xr!vw|%fHKMrU<`}t2LCz4
zn93bs0tqli28;o-yu1RcwgD#7G2P%5Nb>}kzzi5;#dL!upfD-lFg+m-l>N&0FfcHJ
zMu@=&7=Zhs;IYi|GcX09p=xXj-ar*pfJ&%D%owk@G3^Y8m{cXG4+Sc#KwVMLv@Cex
z4xd2ff$0-IbBHr4OfLY9BUaf=FF3~`W>f{r)L4{PgNn5fOk1i|Ao{Bvrhixt@>z8R
z*dVED&~ziHX$7?x;x#^j>LVa~#f)k|<BC`etO4a6EZ(WP0P>DkEhxodF}4<zBhF&F
z4}7Z==$=V5XVmSPt{@A_bafBF8ADp2z6qL{Vc8Vg`LFMr{@@FT7*qWOaK>O3XjuZ)
z+HwG_m06%QXu88!4l$`#w5AYfs}ZOn*ct)WDlO0k8`6T>!2(_i#3#`9Y5Ib%9O9m!
z!4}X63skxla{7}%J7`=2Bo4`H3^4Hyka|!ahN@?Q7JnVrrhVfOXS@Nnm06(k36#;7
zH$CAShqz=N)TdD6SfEv6Ujwvw?Sr&=qy_qL3=8&cfvJQv8<_<9r@!9}>ZDF$0MDs1
z3rtdgGNzb-Ln&Ec+APq4379Jorp<$jgQ6CaOu$)S+9C!9M$iZv2qTLxgNmc8zcO9n
z0*9E?G*IgiBnQ#A@Bp;&Jnhx=2j4lwq^5(C0v7q{d{B8%;~Sg2-gJi_9O9Coqq;y7
z2OwjRoHb+4^aG$GW5yFOZ8Q^fL>CryGjWvAGaIIV_{Jf|G;;@(z5%7bK<HT<VA^XI
z4s&OLG7}d2W`U*&k#aQn#195Ofmt0;^FWhqSmbAeMwhXPg9;FA;<Kh7_{kwI39DOS
zi3^mU8TbTdFMuY(xo4(dumVla%>!jPEaU$3V52~=R1KO_VBiy&2Wo$S)I&{%ggu|Y
zJkSCLP%eOqv%u7YYBVh4{_{acm1u*CRJ0gexCES1nFSVZfh-tUcxU>AouEQ(5hM*W
z3oJH(iYyL*C|R-v>>Fu;C7?VCas|}Yki^F)u;kYCg5MnCjCY{kU-D`Cg5MnCl4t{<
zte`1020no$f57Ub1(t#eIV|%x%QU7h09UKaGGL4vsI!-?0J}+Q87Kg-Xk8UEeZm<I
zF{V{D(>Kfkd23Y*RA9#R2d6m1q*j4O4zP@iuG#~UUk!?OPz*r*2#bN$Y||C~a)?Q-
z2F<8|<e@PEmlv8I@RviZel;l2vBbz~(C`sRAG*1qoQNEz(DvJE&`KbXdUSh0`a$ZU
z;;b<BptTyk4AB^?8P<VLwF8Y<qoss(ISdSpSOQ{Q2M+Ny(;Yyah;{p>PhjN~V_J7;
zdci*qamHiQ4}iI+rY`_-&p_jL9jI%K#rX9S;BaPIuQC0?V$cNUdeA^7HiZ%3h?80m
zD)2#r(`fErzXBY?$pWBVHrPC}9+c^^czgq>5W!;L22i1gMSP>x^bepyZ=)BOmf8p^
zfIwv@BnB2902Lw(d;%MTrYdlXNo@p8b0ABDmLq_qlcolMq(MWa$kH&~c~cuW#h5nE
zn0AaqjA`Q)2=xO*d2Ip}r=Z?4S`cgkMPV*xgJ2VAg$OqBHPahBK$&9G0T|;7m?15&
z8LbP+3hlRSE}DLUkyD(p1RSl*0-G;QF96L3Zw5_YBPT;>|9JBq@F0D?z-Ca>8kBxP
z=@pVmz%}0HZ_tVvD$WWWM%x0*caTtp>fjUD0-JV#io?}|n(A2c*_Iv#21eWIBL6sq
zn6~@@1s~H^1rQ~*6;xJY3B|2Hz+u2Fu#E@Cm;z(005hZowt><GDApjZUU&f7zuER^
zdH^#gXsRoKnN!SbJ1FyGNpjmk!wp!{_;%2cF*flSaN1@T*q#H<CCLKYK?CR5RDya<
zprC^|jDZ6>l)N3(%>#);gAFbYI`IkAghNY8+uwk5H{*`!_fK(%OM$lYfsP!5Et+Ek
z6}Jq00z1S&nO;n42WTlLQuM>+<v^u?7}E{~aC%7=*a7P3V{!Km9Hq<-(6kkn5ZnQp
zs>BijJ2p*EVC57y1a-TyNrQ|6xf2>ZY|zqj$2W*Jv>FN~y%RKo28wdDP}*5Dz2G3I
z(Ao(~WuQh1x`HKBA8?8>?R+p@;53Jr(N0kR5!rfByMlpFU>7K6K;qEYVS|aYfP;-m
zVApj1uN>k=yWCJS3mbIGbQfshDzbi<xDQxAv%s#H=>lIl#F%!KOw;5PW7;)gdO|a3
zk>oB=*9TP2p}BiE%t5elf{xtmM$3I{FmVpBMaBZVLDd?_B`}T9a$q;CT7&rzCawe4
z$Skni2I9iqK2SOXN>_ksqurpKifk}+1adc8pPmgSz6WOT8K?nh{SY?jOvrA~QVfv6
zFqgr^VLgc5Kfnes?cspXdpSVG2h&~)5aqQOq#Wcnv=H12n!m$R=I#Ye3}O@i11?&a
z1@;Mm8B7BErvE?6A<ne#49Fg)eILNW%mVu*!2JC-Aj)VzXb2Zee%cQjn8GH$2b`~&
z_TPb2y9XGcCCdQ;aLK|fa6kpdumCfR1rC6!6)a{Q0F^1Akb}iFsQJdgCvadLq)<43
zHdMq0livm@6b|eFM^U}N0Z^D=vEU$RsTnqL9L4HEP}2s>K+r)@NsrAO(7L^Mpr$ce
z<Q)Vp{=%l=2llqmA))C3Je*=oht#G&0Mi=KP(1_*LuP?PKH$J)7C4jzRaysC+63kI
zf%#I0Kp6vz9}a=5ex}1JplD}0d~JFGFQ+);qv-+yoMQE$^?}%$JfO3I7_cPHBcQa7
zr91<l^M_4*5o)=^4sE0y0hPkc48rgw-EfH&;HZ@rI09NFh9xAAe1Nv(k7|Gu<n%gz
zPD#cfa2PNh4FM-kqobg;lSl~+bgCt2Y~g4b)Hxt;fKGn_w+{FOj#fZzJqjw0vDkX_
z4%k*>fn%U!WUweW1}eirbp%?1IHm=OrDJB(9RxT*%XT3hl4CK`KiGj<P{#^jjD4V(
z5o0=b3>-B~$E6@TkIPLH<P>KNn0{a$sKPi7YQkZ0!0{r8_TzO>?R{Wc>IA4V!xEDx
zCQY9JGIts{<fKl(N<(OtWCvAT415A7j!hR3<`iQ(aRMAd%mODTO-~Ty6q7m$%EKVD
zAwjwD0BAuQ1E0XjT@YuVJT_fHh*O;L1hl_(N&#97oic$j?4~z>R0K`m0HPAW>GM<z
zh>|)5%JEoSeL4tiy3}b<%L8OP#JLL(fEF(@@ClrbgLvmOXfZlS9_Bijd<NJ##sa6&
z2E*B*73XPCGYFJ&AQ~Cq;*h~(Z-FyB3=9ldBKizyZUsxcoUy>3^Up+pldsenP%|E6
zA;c#P>>!^r@ClsBgOr75iqMiQOuh_K7M_76-7`~gSab$lfJh6R0ae*p3W&4d`bg?5
zXr>qxWDtieJOCYTJ9}#S1QAX#rn4|}&Vp9zVe#oX9dPDjI%fm5@Ej<Tki7<NQl5*N
z?jXh~#&j+QoTj7&&Vi1y#Af0iXx=z?0nCsVI0rf^9!uz--vCNBUf@%lu_T)dp!H8!
z>dp%;3=E9e#0$V_R9fHyXki+%7oeSt3#X<xNOOuYU4ZmbnFTItfD@Lqz(vraBP_vq
z(Qf(zF-~#DFW`J^EN}_b?ZD#aOQ3a=SoB{~nw}ueDb8pFroh)FVDac>(5ekAx-Z*7
zBJpz4bOA|DamKXi4j?LPniQuvW8U-w;+$ekmy4zsfCS5?F91<h(=SMJickM9$;mNY
zU4oOJ>GCXy{4$9A2C#>j1upLbD`Y%2T|ok53M|84z6McuYx)DQ__OI7Kp}R84denb
zrYl?^)5Msr2u+^=vi*wK^bcTK3Znjs98{eWSfA7tQ2P+%Gf2i<cmOn1&%h^eH3sUA
zt3A{HbBGyTMVoKs0EIJ19okSETpTvkcJ&>^L05l49CD3qdIQMe*SNqAGP(vDuR%%*
z9H8AG415BhlMKN<9Eigh;Nl`shh3AKo*>I9&Im~%(_>{hg{J=(=VWKP<_7i}<F)DQ
zr8&i!u7!cQOxNO|bQ+Y-gVJSCx(P~mfoZ90pgIf7q~x_}V0or%%b@f+Fl`3fxsGl2
z`x>Y*fF(s<1FyuGen*y5dir*0PJX6qufPT|U3)Wq!*LEVrt3!21LQcx8Kb5vm~o0F
zT?dU@fC35@AkaGhI;iFX^%~Kt$m^gs6BhSh2hH|i6TbzHsOe=2oPyK)<v2MQe?UX}
z1`{O8Zty|U;tc_qgcKxBZ^(h;lIe!g^aBc<;*3@h$_YYwL8u@Il?0)(AXE{As)A5W
z5ULMMNrHORSloGI7Fe2b5ro<VraZS`pUuAk>JMQF{2QPaE;hsOfsJE)2c|$f@32Mb
zjbGCXlsLs1nIM!9nDWH2zV{|5p0GIKrU`Z@-?Rf8$LI&4!XQ){gld2!jhmOICn$4@
zGd`Q{0CL9%XnfrKHT?icm~Hw85XAu%z9lqWL4{MCQ4A7GxAdk5fVgI0YP!D)X9Z&x
zn9bM(p;{oe+}a0D5lpw9f%QwGb(UqJZJFB)P<w83P5+?ADb6SbP9{>fK~r8x2^Owi
z1*Tqa`T>x7qv;D&ImH>BrWb%HF9;O`p`svE5`@ZvP(=``3PLqOs4fUK2|~?+P>aA>
zO6m@%gu{|Y?m&a&4x}_>x}yg1@f|%#!oCv*39>uTGUE=U%#gYRnykkXr+2Er_A%XQ
z1JhD>Ks7LyWOnBe)Sh!td#*r2{LUjtPP_AL`UFi*aYnuA1|Z66`T-E-1(CcL0u8@=
zaS&CI#uu}|y&{OZGKiz^bxr>O(l!Y~&4N&iAk-=_HT}INrv&3JFq`oZh?1ZFU6WIQ
z@fwIN&Ug<(J%dm$AdbBEZMuUtxUwq%QAH3h-0y(8>i#5%Gw;uXC|dv%Uj<dT4&uD~
zo2EBtaf&mZgK{51xUV48CkXXxx`7Tjqk$<d2u}<`DM2VRFg0CYhf{*l1LDF5Vbd3Y
zoEA0xf;Oi(cuOXh$a?S!5(y8!K^*oFTFgC!<(r2>;DpTdPzLIShiXujS`arsgw`|<
zAvMiIXif7FTGKp)rkaP4RKxTTTGKp))-(?xH4W3l9*DCa&H~#f^$;`!3rexDCL?HG
znSoE>;lJq)dYs~t=uH`@^dmK}G_*oA7I*|2N5|4IeFUnqu^9ho5m>(@tOtT-`=fOb
zY0%<5Y`RZP576ZlOL`2NQ3K_Ah;{}JP*!2!6L^d^qs9TQ#`pvtgJ#q~>cM;lgnG0Y
zHMn}%6!?=*)AYe3yB|Q5()0^@oMKE*wWfd2=TujO4kJEA8;673E5Rr5GyvR0W)^r_
z1=UwKeS$uxn9(!XcpA+0(1E*Wpvo25l`wGuutCNG&(OUGQ-JP0m^j26$pX(oHi1kA
z(F_a>9MB%qb5N5LSsWZbd;-rw4PlTtn2)3$l){n4!SZ|p&mF)nWEOaSVfqJFPO+pH
zu$~W^g)d;8c$hfUfEQJ$Jtdd}U!cw4!y@PfWZ_V<z)N(CCV++o_yk_!u;?YaMKJX^
zEP4sE2sF0L02(?1MH0vkFy<3@1)9&qCJu@NY~r8|$~Q5mYhL?IZ+OQc#`H#E`U24I
z+BZ|CJFswyF}+y=rjy>HjmE%2=q+S42EMZ$7D8`9ISe_fpi%x7ZHX6L{RVIp8VkGw
zHM&6~!BCHKgSws!d;;%4s|&D+OH6OD0Il$O2eJW+kKZi;rwOKaKOppb8L$Rsf%h&@
zfdx?d&UA&PpmCKC0uX@@D$_q4<`850kOAfQKy`k!081o&1Pv8{JPAuq&;=eJ(I&Du
zp#9;Gu(2g@vSVQ2fT@S2BA7T#J!Hm9THqsSkq;>GLjwgI`3!slp9H`zk{0*`if$}Z
z(Vrr~E|vNO+E|NCz6C7L^l1uskcvs*^Yr|ip!Fr6Z$Ja%ivW1y-B{oYY`O*JS?Gd;
zFKDCe95C?|aEvkwe0>2m>KhB#C}x3gu*&9}0kqcn<^q;V7WfX!AW&N%H_7k`e1~Na
zs5l37Zty#-D24_dTs^F;f{Me{cYs~RB=7_5QDcE0pkV<lA@k!40|NsV@t+*v5R(JV
z+F<Md{|W((3rv@>;8dJ0YsJYa^&2*n0d)!V7B7L{ki|;I0>9C+7U%#j(1_!2w5$Rb
zhh&vx0niCv;O-+NOjwdYv(yZH0)NnAiWAz1{e#+AMW_e$k3q>8=0ccy*gVOfE8u8y
z7WfAmD8e%6@ej102b(x3^CD$h-i+xJEIGxLpcjG*{6~u=xHu%1rt?~H3I_2&o%0_w
zXaRC2#Jdcfpapphd;<Sr<Bw41!_|XEr9kST;&Al`z)8SZ;6H2@24*01gyuhJVH2`O
znD`5@#$<v2pvDVG0aPR0Mo^+a66b`>SPC-0YFwyGpy~y|JIF!mq2h4$keN$nK?axU
z4YgdN#)1r>y{sUWP#ZZR?IA%1*s^<=2{3WU_!zSwqXa1Pi7_$ifHIgE6Qd6(D#e%>
zQ^5RsChRdP$b@|=NstL`MvDhB^(DxJ7M5I)Ar3(%&=fq#;ZO&{)kA_%8$OB;*MJs=
zT##mtATwlIQd*E1Z7_ukY%-r9v(R({M@}&*W>C`+$ws)m1UUAX1(~7Ce+8Lcz#_(i
z%&;s94PEH^VnJrK(1nXbLf2ambZjI8O8N$s%zT2(pf!z{g@+*Mwg@bRiXaOEs8A7Q
z7G#+MjutN#(27JX2C$;lI9#A|pMg)16|H80ix+^sC@shensCKzC=0TJyDnl(tVbZ}
zg!SEY0S8VoDOR+2<ANqE)-PZKnFZNcpiX8J0aYDhOl&b=r!%p2fa@f0L3YrLnK4FF
zLy#R-3_(Mi3sPYSvZED4aB&T=mC}Ojps6;@8eWjS1(K%OXFzC<3a|^91vw#Y17kr>
zv|!@~H8L3Z1Ub<vYHm<#3M8HbHo;hs6IShj6Bz>oTq9bw1J?*CTbKp862K-f3vx9~
zH#ox~$}Gq=XL`T|Fat6L$t=k2G2P)4hp4e2H_S9xh(HD?1-a3RM=qE+q<AzI1fL%S
zO6xF<pmfK;C&+yXwLQxP6NfBcXBOms0d*A*2iR4{f;?!I2Fyo1u-Jly05phrRKT&q
zEXWfA_64&bZ{BnTCr)umP}3LGd4gzIcmOoH$iOGadk8F@2%74{BFzsgBOzX4NrF`H
zg8ZN+56FuU;}GJYp(s#02_z57bzsaV$PZ1>{C6OUK_CK3gIghDOoAMcWGeV;x_~pM
zIOD(R4$honOhQ~>T1p6%&b2WUt<Vf`a+ekq0v*hTO~DbE0#KokO~D7K0%6cJ5Ecc(
zGGGPFg2FnG93`AIy&;5COiCCnmGVI9c|qZ<=^McEXqg`_56S$-f+C=$KbY0Cpa}Lk
z3_(%w0!^`cG0+JDSoDd3Ci=07gC>}eibFm~zgSQlt%bt_O%md0odmczXc!B&uR~BA
zmY5+agMklPUWi|t?%>HOW+V=)k{~GrArGsPpyIsHOfL>uWMM2QftKWXAPovZ3A7{+
z7l$NyV?hbDek%_s${F|sCG1eM9b6pJKQ$JVfHm}?Ug3piCJD4+1}+Zi{z(f;fDTT^
zQhZD70jF*wNzk?dEHNSpx`Yp#_zXyKFS!Ad8zc`v`8S|^@NlablT-slTxteHTnapO
zBW5HG8@Ygb1ay)q0|TF+G+K<p#ARZj#i7g^7-I{x1d_P`E`gW@W!^vw5?M&S%q%Ed
zHvNM;r<jy1tWyAsNyy4KLD?E`88ltji&Kz^H(|Pi7pE8(FSL-9T>_Rg7L<i834ywm
z7aCi#u=XU(RG2uVe3llJ1@)D&WK`KZ;EXCQC<{vOSQN-Xs&ivOIkdJ4FQmgK2s#8D
z+;WFm4HFlEx>*jE1YvH5W_dZZI+7PA4yhxV1?4&*5hk|-5@B)|zzKv&?g^M*4@z)Y
zx-EhVIEn}b(8^dW2}l90M&*M#L;*G@4fPpZ9JD$fnx&Hk6+p=uOF^Lk>gQq!Pz6xV
z#3qg-h7=$%WGtu%3O`Wo0ir=`KcTHjMYItnKA5--I0B>v6+!JKEG|^+n!X@{Q;bQm
z4^sFj!sZNN{)N`GifD@gV1<t&WHA7<pyB~=gcvEIwe0zz$yW)j?Fko$v^|prm0&hQ
zyvC9Ystg(U1eH*2Mu;zAU|<BPL8~y8VdIAoa~SwQeKrO@LFJ_BAHq1rn3TaM28c;1
zmtdXC5mfE~?NJd+QigTIpyu#Ho2JUJ;u{)5aB<L(7E;vkLyKn>P^g2%Vd`PxQqu*Z
zImNtGK;|RMgXW$X_ykqZ8d3bvN=5~3bP_HO8J+YNQ~{lm53&>*Ft7kn0ku>>7J)1T
z9eoLn85Okph94&W0GxK}1wjX)fzK<28VGKgFz^Yg!nUTu41`u>s<0jlOdK?l1yT>I
zpI{*YQ;&9v2|r9dD02%>e^SdO$SkO80xoE!1yw=aXDr@RO`5(Slv9jJHEp^<0Eo_l
z^7E!Q1agWq7EPZ3ihk8H2zMHU+BE$@04Hd{eL)aN&%Nm%K-@>u7l66HrYnH7{+k{U
z$SKC8#s;PNASSCxO-}$VKUV{-r~x$rA^u%>5b7^Azv&wSImNuxK*c?18x};KQDq7!
z1o;HjKrsvwhlB@QTwRHQff00ADMUR;F(|7Gs;hw<E9RxH1(k>BL&$@+H-KiG(e;7&
zAaQi{X4ApGR<{EAT8v5E4&-g|dQbwd#yG}GP#v^99VCu!45(#`6e0Z3uCh6(=Q|VA
z91D<IkT{w-7NF>6Vqg#g4<mpQDAXW}7SMR5D6^o&78nD(vO<i>;tyCrTF?@0G?gE0
zHlLs+bhyA$Y5IX+PBA7+t?2@wL}ED!%3lQKF98h`i!uvZo&nb{UY4-N7AWjM#|=Ys
zttD(M1uD)Dtz<1>xgTsX1A_oe{k!Q0l0X)J0B0s<K`R5$0JJExpp_HI3F3@i5Eoea
zfGc5UK`TgOmC0($^alx?VoX-YAnDoa5+ngzU4x`Pt4EO3XAMeupdf|jPMFuNZ9pfz
zi82dXdqE7a_Je4&4uaBA5Cg5_zy>i{Cqd~ds5p3(OpM7I63E7aHn98)^}7JruY7_w
zu=YHd&%gi|heemo7jQH&3)(V3Gcou8L@d>?tp!-6w4g1HdfK)Ftbke2b_&=iV?kRS
zjdxqnrX*}u+<=+z2ijt@lYq9^>|i4)b}OK2>^@8{FyInp7PJ=uH|C55?a^8?kn7F)
z1ntpUGH`K7OD0*+9>>U(J!owQ7I!*;;uNX47JwGZ4xo4jiNiu0Ce8y*VNT$s9%52X
zHdse|1)U%%O<K?i)Z7Ev0x}Vl-=O7|vje2f<qRE%aE3ObT_A%wMy{YSGA#OBLB};>
zY1O#?fiw-=Ky4;0^6ofd(0$qT4N;t8OzxYeH^g#^CAou+f4~w_?w~w~#XTONbP5V7
z5Dm)1(C(WDth)mXL72D&Gz2{%gNjL>kU>2L*p3Y$XtUN6RI(u(3>i=r^a42oBn~wg
zrrrxS7626&fT@S9_-7XMQh|iH7kJu0jLBO8Tnb6~fJ#7+p|BVN#TWyhpid51p2=qi
zM4u0MZ=_g~FR13kqTUZQ3V<XIE1mpM+guC+prV|CPtXsw&4mz$wD!CO{Xi@Bu^9*(
zqlN`Jw9(=RTRaF00hl=C)Bt8d|4Wd#_P+*>Yoh?rigF|i_@QYt0Mw!ebxWZk0;&A?
z1Os+JLL_h=#GJroU~{B`K@DLngLc8-wbNooA)rixWRCzS1R3}QLqIFEu%y+H5@<0U
z(gU_oDg=}!uqoUDQwZs?NQK}S0uA{CRTv7*x1pfTZCFeUwSg%NfLI-h!;PU3H%beJ
zf}$OpNwC46P*8khQ4j{66cUvd3<EVru_*x07>Y6rhC$sD23j$PP2m-&qr+Z6932i?
z9gam|xDHfdxCOXiXBG_ifD9W&$UqW#1jH()2*^;sR3xa1MUFZUpMg&>vIL?&as}8%
z(7|#StT@GtqChqyspp4grYQ8J1{3#z)(=rV;QB#YFbYRpM?vCRS}+RKTf*YGs25Pr
zMg0N0Nh%sNmW)MVG<b?ulvywu((g5jM(gYgf+B>0PcRym(V!U$E)E;8jlKe|u$Tp7
z&w#_TUN9CkGl=YeXqJk@5iW6{4iA!g0Z^W2;1i5TYZ?iHI$<Dj&|+ky(hn{U3QtHg
zURp2#6iHYHeiC%R0ppd3R^q|(V<M=?#FCFe$AMv+fk=WRCuzYX&|-WnA)OQhjglnr
zA>m?DNuaH**c5(&Doh5iF%pwX1{E1t6edIJRU^S<w6O$1(1Jz=KEY(Pb`o5C`u$oi
zF=oLO4oJdH0WXggV@k0B*PD_lp#B1KM1aDOfln}Xy8Kd3ai&!0h;V8SSUFQFbc`!?
z0hlk9j@I>u1!?+(=>ZQp#hB6;K<P)*FVt{~Nu|S@xUi%Jtsc`M(}mK48EEZ5L1<x~
zAvfKimQ#!=12WxLFPH%;e~=sw%W)Z?@lYgjSjx&kt#4V9LBk{re1aLU`WE6MxOgUL
zln|8q&?<vW&}azD^pbQ=A*M{f=?NK}VoaG$(-)+3ib-XHb~}KY%n-8{9t7nI20p>e
zBcM~|#h5ZLLDk=yUXTvb_X)z!@_@)^ZGwnr?E{NX&r9btWDJ1FWiJ5JQrVy}btM16
zGG`70Se_~89M}x098i)&RtKuA82AKpUV+RO2Q6hqo{bZPO6LYmpOC>R&R93SA(K;#
zDYtK0Hi$X^F+BGaMD`U__7_+-PX{8KX9c#JDGw4XQhC_VRujy-0akC6_XPVWNj|6m
zLv}i}T*{Y%n4hl(@`4ysz8T0F;*4%!SL9cKO=Zge1c{7%P=sTNjQn2^UH`zk3Yexl
zWO0f!vQ57LqPV6X0Qt9oZ@NPPrx;U#5=2%FBI^b*xd1c;ipAst@GSyjOa;dvx=w+0
zO+TN-$uYe>larsR;M25hPH{$Pa1{nkp8(>9L3~qKHr*hbQ(O`>kA=nXLTDN){07nW
zYkETtr#Pb!$TMP0MM~2*fVeS`Feqw*gj7)*MAfqC3OStOlAu9cEJhc7f#@n$oBjY~
zh}QIiT=4o^a1tmE0tZxa4^+`6h@x!}Mc1Ya<Z?nzKgVKni3&thN!auYAS0uuC**;L
zOTZ?VG)-Rs65Rt;^a!Hp8Ay@(^!NFk>`W!!rWb%BqLd91F{NBkJ~V<#-KIat=M-Zq
z^@57em>%#EG;vsZXZnH!Q0J<Q1ICbnG18`Q$OpS3AfHoQ5_Db-$mx()<-&vCLCros
z!Ln-*Rkx-a6mp6&mED`30H*(eV@s+WG+GVP2FvQ8)(!)oU^yfPq{=}B8<sR&;R5k&
z#S;i!nE<AZDnb1lP|<}}+*E-E+_1Dss~&(3$`@m*R)WNIwHer5Ow~b<0I3dx1W0uf
zB;cykASt>!4=N66Vlq`vgCwBpRp3~zz5sR(Q}rW=vYH@>@iovyT2lp4UIQr?YGy!`
z*L;F1`!)SSC8rou&7bK8$3W3gYXM`-fVj7I4@}^~^ar0gMVSR_-$C@&ewyA;#3>Fw
z867#`paoMctel3#6N3n-Y-ZpStOErYQp*4?E&(=QTCfh(M7WPROIdFOvA5o9`hgNo
zaYksCsqceuKY)G4*f4$l7EW=dh6bp!8zw;f(Xa+4uxWZgDW^E&HgNcRHGrxWEY5F$
zwW-jY-vCN}Se)N*2kd-i!NwG*MU77&HaDq3+}&g}-Jy&VbiOb+2Q;}sVyr0)65&m8
zP<|35;+vp#OVc)pwp)<0tO?YxLQcofDy!)S*#At;3Q+5tp@n<1*R*m@amFoB=~Iy8
z)_iZeK{==T^!eqS9E>bbEiGK&Fkxy@gCv?3GjJMf$$;o>DFRD-wSd;!VF|Jp*hC*%
zkhQ?((;!(7o)TJSK!dDR2I_#;Nz)Z7IK>&4K~iNaEY4bCf!ihk)zT&gb_-LR+4Kh$
zoZ{2fD>((G^JjCiGqpjhm9{3RibY@*jGMrIX@h3tHfSPl`!wC4ic@_0c98!5Oip&D
zcBSbFRh;6CArMcu$3bGRJqfH3R?oKgK~zEO+4fUVRp%h8-a!Je{onKhAhQf0W_4Ii
z{{Z6JO`iaw;-)K9L$;ZLc#!5oQU`335f+G`@f8L>!49+qb0RQt(8w0(x*$-t0+obd
z%qQ3ZsyjgG6lM-&F|J_8vFQa<IK`McPC!Gl;~d0Mm%xtl1YOmLC2l)F<GsknL348l
z+E6DfH+TGi8sF(O{Q=0AZqo~DIK>(JrYqEOib-{X#uSiJ@gZm{wsQ@n<=+XKr@_3`
zL$C{^4oj)q1v;DuoA@`deN0`yrf&e*+YK6g!D4SW*YpQ<oMK+xpvhM(_I87M*I3N&
z2DNsviLV3O$JD(EY_3r+s3(KP++I*&iA{V3=u#9>X2ISYFvc4wqfZ3J@BuTD1^YpP
zg2j-29ESIUk`7WF3q!jk{h$^)HglFtS195X^Xdl`%vj_nfNr0_CXOR8CuD#f&MY`#
z28^)=%#aqG0GjgzHK@>1^MnV`5@O<<=>aXAVo4LRZ;lh32<jSQaSN!S&wx!FG`@l*
zEG9XC{ail@RLx`42Wr)069<JQHgQnv9*g*79C0@p)KlHeFx~VdhXAwS<Q#DLFbhtG
z1=M8F5DS)on&JReIVAzcD1kAiz!;Fk<t;b`RCi!Wy;DIE2O6Y9i-oBmPh;t?PrWsL
zLNlir)6{#@3pzN(q^5$#V6n7;rhb~P(84JuH4PNtNV)I`sQ<vgCpe93x<MzW7}GSN
z=?P$3Z2AX~xzi-3PuK|(H=6#S1w@-oZvfL4P;s~E8^Gp*0u77%riDTEMNJQA2kDQS
zF3<|1v!Ldbf%P*@TL!g%6V(1)(+j}r_Dx>^rq4ji@#*0E$i$4Mqpf%m0hI;}e1g+K
zb9|t}5?0~C#34&Mj0LB|rfp$`GpG>)(g;eX$QohdQ^14K#)8vfwE#>bXp9M@5jHXe
zvk@k~1+0--aQZ$_6oIdDXyFuRyZ{+Zn|=!%VNBESfdW9B@eNe?8zh{j|AK_m3?7L1
z3<WT4Gy~M7200Vz3Q=gCGXoUoAaSTG;Np-aLd=3QdcX!S&Da46$Qg$~t`cLKaSRec
zGp<18Aqk0T#v_os#F%D4256aP{DL@a#y^O|W(q*m&rAa+ET)-x;0QFDi54-UU<dID
z&O}?j2TOP}+rSZSG!qstVD$_PaD6xu^h`*ji*Xio&}P<y=?Ph&CC#&8v)Hf@g3im#
zMw=KCg^5EZhL{Cs&zioWi&Kng_Oj^#V0zv3f^HCh-}DAB{~CmzQwC8trwO8NE_CCE
z;9RhTIAhgx0g%4A?;!f;{sQYWng^N|21OCfVW2XfflqKAhz}Bn`5Yz=n+2O!G~HkW
zr<l|{SR)UrP#mUk6U3r<yTBGP%{v5f;JkAnhk*LM1>KzDjB?X@IK>&&AZq4ofgLY3
zA5;iq$+z>NgIV*7KxT_GR)EK_nC3S@wXcKHZ@`0^(t-;>6%nXxftFh$kb@Nj7eJ<P
zm=?56Hvm~bZF&NT+6JMnL8y1r8+yUx3SdeJ!n1==;KLEcm=<mWxkHR;;W3EtyXhN1
zTKFK88icZgP+<@%4?;oGwb3Hb5C<rfL7|N}XGL%kY-cVsP@(6t2rg!TX5YnTV4J76
z^>IovCQUEs;}mDC0sDIT**;D~rp4PJV&@>#v*{E1!MiRKK$H-Krv{;%rh^6jAUw#@
zwdt|_oLtkV_j3v`wn3t8Nf$)fG>EcU;D};cvIK0WwBQm@^@C;Da|!r77%`@$Ow$`C
zfJZwNK$O;WFx3VToHbowBB%Ux_DP)lOiRyAe*jW(ZMwlEPBEsXx4;%jEdzBiK&1&Z
zCcy;^1E1is3E=i2)3SNfFHGbVXIuqI0n44HPng6h&KLycHbJ<3Q0^y)pO*iF7`_6O
z+^`tF!f*NkkSTExZ7aS(Qv6C#n-LUg(8z(M_?33xIAL1p22sB<Y`Vf^PI1OKP=Xg@
zTA2WLs?kcc5m#8ET#44AmIReC419tsA5GiFDJHcFR6l}}1zHHKQkmXx1hlSt73gR?
zP;r8;05n;Sxn)^!Rm$`RHP8Udsx{LKY&pf4Rvnve0JaIOM++WlWZ)BA1vyf@UT`&N
zPGCP~hkP}tnShktL_u=|419vCVFp4|xhQlva5ZQx2`C_;;!>bSF-SdZEfO?<;p)L5
zG=0i8P9dh%(4$WUS3j9<a2_;LvHH#Q1A1Jd(t@keGL;mxYqI*+^aHaw#iZ7t#UD(5
z4d3*JX`EtAYak=k%z|q)rW?Emjc}}qn7#lsh_xnT`UZQD3dm|IX2CTxz$%Od*PzwI
zQqXdI4XoD%^$J`Zvh0#saLt|R2kbb-jMl)mAi%-`+C*3b^9;-YnD`H9Nw78sYyi{R
zqUjHIaf%tO1yyNS0(C7~8$=4UQi_33aBbc63EMcunASp8-+BwKg|#_gE`i44TD0k4
zSZu8Yb=^P~!dwVbKM!g!^xzP|wJV@8wf4~TfL)woQfp!90;Ur*<OXsQB%yf=t_5AS
zB8i#M)`GUHVac%TU~~6Sr-PTQGVlqmbDF+D6qMB0rGb+G)4C#XR7<S`6)RXOnstz3
zMQ9z&Z%_lJE=*rAgHvpJ++I!&rgaOzCvP$fuG<36*-Y!sOuz66loZ!J04ED+!F8Zp
zp+PH`(DLMZmgxppIK`OO^Gpv=203iK4p^(P;Cj$fEKq1dZIlM}2N?JS*TY&c(6EAw
zLyk3K7F^#l-Qgd|^7V73ANT`ioS60>Oh17*Z~ceq2~#=6m^N@h0%3y?BoH=$@&}gC
z+>iuSmj+hHw4q`8hVP(~W&>!yIcRAb#Ep#WpsmskpzX0Bafllc;t&T&Z3L~u!eY@z
zDUe0t)B9(0N_c|gL1sYBUJr5{1E1hVHwFd<kT}$AxHxD^{xfD0**FPoCgZf}6J~RY
zdmg|(QL#yafq^j@Q}-s&tZzCN@f>InYy!=?VX<}-Xc`oo_!+Q9X2DHQAVtY$0jR)c
zlj#YoIK{j+gFJ{7@lv1>4+cKL&9Ei25RWs!#X*MwU@2@jSAd$p;*2fRCs=ceF>Rgz
zrlmHcm9?^<eksWKd($TfgIcJYLDdZw^R{qc527s=(--^zC9f?`(<jX16le6BHjh&*
zX$xp-1<4ySP;YF3t?-4!D}xMlxP1$3Iuz<XxO%ju)o}GW(*urxt(^q1b{@!DsV$&z
z2aU;~Wwb3XKzU%g?0il^E?C=oYXC@0T5v1cum@az0{AF?X~C^%xnCCAwB5RBy1-LV
zy|8u3^a}?$#f-M1mHx8OcIH;J(jP9q1FX+$E2w<KQZ;Wys|;kJ8Eh+T2pt+&aPdFW
zFMy^aw{d~OM2u-0A1F|mwh4ga-fJ7^R4**4d>brjLE}UkS|x0Q#TC>VxOfb>z>^l-
z1{wru$IKqvR)I2|7}K_O(=ROG1f6CBs&JXMy#f~?M%zKj3ps5-!*e?*(m>)+`($9^
zutjUzWu{+f1QnCp)uvxC0fqc_y=kUk+5lP&ZubF2Dzo7BlIaOoIK_;%!@4Cfzd@Jm
zZwHN$AlU`JE1iK)aC^t}1@)X_OxxE?FE{~8U)#4q{IY!?*zru;KY$Hp+93i}u)_o@
z5CIb?foAC)6JU%b(-qEw4BN48`h!KB;*6WXW=ZV;jirDb0dpK^kcxp%aL2Lf2ljJ{
zG3|g{vS2K@12&opRS3SJ9i$MJKwu#Tjk%qWeWT2RI~BkoW-Pc9wqYG=f;4p4cPEGs
zast!@xHznTx6=peiJciRM%A<>kcnkbD{1Epm<?$Ao!}<H2CmU<SObo-dcmD&p&$co
z7VboA7Qn?pp#(}opya~9zyNDr?gU+Cf+czHgas1Fs|*Yb(x5Veflm-}Mlfi5CCp_|
z3DBB;<SBKS1-oz*fxAGhZBQ7(EP$42yNsqc9N-j_+6AgbusC>^-}DRnK=QD%66Ow2
zUB<vCxGMsj7L9hn%0QU;(0s8Ay)6I}F9GXg+SLY0y1V+o$&G2(4sf00wF^`WVrfq8
z0*&#5>Ro8S!a7&GK>ooZz8kUtk!iOBq+ziee14G_)9$?K0*^Swn0A*<cL38B;PQf5
za5p4FNDJ-;4K89c@d!ALNek`<)k4@5e3<^h3e>pY4Z6+=OJwg6fts)fG{}v`gguaz
zJWP8aO*^JN(3RAC_DpwR;}T^O+%w&t4Ybf^&kwLw#)5l63rMh7wHMU=!D7Q+6Q~pR
zf^s7^1(2NNEw~p{eqvJqsyC1m473-q7j)tPHkVuhJC#{*?-ytpw2uiA_4~LWQNK?G
zTu4dn1I>qIVwTwZz^4L=G3_gW8L$GX0aWFH2H(-r#6IxNHeyWsU^ecTfFy$b24Ia$
z`x~Gp?Oy^GklGI#B*tRWe(0Xn{U4wj4v0WB8~}~lV9{^@I%;zu2Bx6|V)cO@utuf>
z51<kU8NdRP2SE)^EWSPnIu1je>7WlxeF0d#)Im@N#HJoH3&nJB4@?7OBLLGus2>h-
zO)t35DJFFYw5R}7B0zIA=q`59PQgP0(424xnsp9AR<to4a)Fw7C~UgI6Oak8_CL%7
zX#4k20?dR8h^G%h_kSNcH{D@3rx??rYtswBH01hVX2C-*z=^|K@DS)uS1hULFes&g
z91AU8WT3_1VYL1+T$}^!1Zly;3Jh3V&4+EkHcAT~_Q0V4e59C|)M3z4Ni6CA@DWH4
z<?tU!d>jF79>$Uqj_5$;L5uCM$%jBg^#~+lnU1tfPdE&!h>y&H$?Sm|0n!e_XzBdO
z6R5(YEMSF9M<u}J1he2#8<<Q8SVrn7sNIRhh@&+yg>%4BCUq3lKSBy{IcVG-T{T@n
z3e>zg3aJ{I1&<y9cL${fkG_L$vW3Qx9CRH27}N9wNsyLfuvOy6M8N$&X~AQlQ5Y;;
zkYgdx#>lax=>^iDvh*0*l0$h=PnCgB@EEL5d8}c&!C?+jZ^2`rf(c869YbsQ%0mmR
zV`$S4aB;|rZezh?pyL`rJEPEo{TOHl3giql@#8#@4)bw^=^GkA{ywfT{lh9wF{a}d
z;2yNJ;BmCZEElvjaXf6g0%*+UIOGHxX2Ih*;8roy@d_~QbsThe2bSz{9JB%!i=U5!
z7QKOrD0C-&fQIk!f6(wf0n1>}ybKH96OfIs%z`Imz~O5wcmiz{ULI75G4KhV07W|}
z#lTE}i9=dx#)2n64g@IxDP&+^kOx&gAdRrlfN6w@hkzSj(t;;o{VteBX#4m?*7Ohm
zKrQPNIbfB{f+r?`leyOkP#VCJ%um4L8fp?~rUO*w!B5JDIsq;Yy*EJc#Fgm{PM{;R
zzf4c?<rFhI2@5WmL7?Ub1E1hYwDL#}CJssZ#)2o&wiL>NiWiVZkd>gofw=%C4jJGx
z7Cea->~f&;AEXgBjs(*P6Nl{qIV}U~ZFmcwhOLH$IvIK*rr>Gxjv6%h&#*8sFoN!A
zK}$PlWTp$e28H?=6Br`{WCOF{nFeUFb5;Q&aMlJaAT4+n$GGm<j_C?tKxN(8B{0Sv
zh}LrqAX-}R9O!IzEZxp?A<$Ct+yd~3u+%wFX@g~;_uQvxGN1zF9NOTdJg9}vz$bVP
zGB{~0cphy(lsvShdLGs*fd(*K9C`?o;Q65G24E}BqqULcp_SBmNOqPMJdf7OSAY(f
zo&N&${rP{>7f6FfI4+=7&M=i1U^`Wzj!^)$8W{KlFU)|NaNz}{U42mkDsT}db8*%5
z3*e&kA}kX?&5(x<dt8Lgw_ZE}HpA;8Xy_8OLJ=(mT!J|QnvxWtW8s%z%c-FT!^LI5
z<{4drB~_R{P~pkICwK`~Fu?S|#2uje&^AIVK#R*uXaxscJOr%I@Di+j0<#ZnKA+$v
zw7NtACJvqnH5R;tR`)5u+ykpY!0H(o;Nly=_Dz4bn^Qmu?g&_1!xY0D{ROPp=rUSz
zgE`_dT5^MnLz0`Z;AONybC`vfVWS9W7G7=uTPSq}M^3upFnt5~_?s(U(>L&e>Z>b$
z(*^j!i~w*e%2@D93idI{D>$~EUzq|nQ(Eu}s1pS$E1^k93|hEcIRREsFL(viiNdA;
zmR+H7rwH~HpWs!ri~$!1Wdtl!PFF#}j>Y_|pbDKCG?@mq0G7k9!V(+ULIwu7xDVLH
z-hx*_O(<+8o?>8N0F{?e17SVWtFR#gsJJ3@H1q1E=>@u=ynYolRRq!qwGplnZ96+$
z<D=;pbh$+91+RkE<zU`&C3p>V(j90D4jSk%1FwN*5SlSNR@czR4i%t9<2Bf53DjY5
zanRN^p6OdIa0u25;y8I+@EYi-R#1fo^ER{rc@1sCOc5py+Es=n0<VMC*I)_m>)>@9
z$PoxlTG!D_6PUOII58UuUWXMMFqeVDhfnZ2TJa5v5>Vsd`t*1!F0tu%4{!=9DL|VZ
z*U^SG;Nm4<OPB?(ubQrKm{W}D`nu^K4snV}T?f?#AeW)V$@NQ6b+^Fkn65*6X*ZZ4
z;y2hp;^LAZw}PS+L^Cj~Vu9B3H{7Og09kXx52`#2teg?D_`vH1XqF08I-}Wo18v?+
z5tIuV_yli&W=lYk290sJ_yX{70khzZP16gGaEf`|0F4%d+yha#iUo9T2m_zsO;AjM
z41l<k1$5&*C=73+W?O_fY--`A4%CL50We0x^n&S}VoWy=OkXgIQ;g{r!*qw0AUa_B
zhEt%aom)79^cHA-A4^c*`ZetYrx??1uIU#}foQ(zAC7`(q3IWngJ`+w3dcaS(sThZ
zUv1iH5Lat@09Y6@aFlc#6!Y?!hXLFM70aLyf%trt8#IP)gU&_(sfUCVIIV#~<Thww
zF-SeQnaluJe@AHg1CV`p#HJqrIrq*ih;#1D1GxjVyx0Ncx;v|;CtTzdW4g0zdI6Zf
zZ~6zY@>5{#jCZE*Kfx)^bmtMob9bJBJSWch4IBh_{(-%obQf0ELEOxs2wEh`z$bVY
zJ%>PB2zSv2+u`bA6)n_{iZJz%K_q6uyHy}hfHwMo!}2b4JnQb7=?}JWiZR{Y1#-0b
zboJw${L{~!;N&p63rdh!;_xo0J&i^D9t+qcse7OsTR<H<v;=?8VETe{poZo>Cy-0T
znC^Lj0!EzC4-~3mO!vY-;UmU)Z@T|6PI0DteGu76U{R)fki(pq?i~T!VssC5j}bOo
zKn*5ruKPE=;4G(@(S1<v0L3{ZoL2cjo0#`OVxUF_nyc?ady@ARz#T_s!TToAF6I3w
zP>6{!-H)5DaFSCTw5$e{3ht*tQo;QusB{}xIuVquL3Tjmc@-CESqB53;C)yD4-sd8
z#oK+*a5zXk)SYnkXbm8^`Yn)fxevNk0!z5u2US#9!sY%SXskSdtT$nL*aS(<58ELA
zcsL0Z4`NIYr%k_bfm4hLbVxZUb3B|k-2jyOAFi9e;1qa21Sl&@Jp%Q<K<<Y42ky^D
zT+<aYK%Ia`pq4900h-4iiA@j4;1W$1d<1HhffS&dfHr&%^Z6rCuMDIf-9V6jP&o(@
zhllJVFHi<FdIY;A6r_xS0pU;_8ShaPIKvt}0%bI8*1>wn=+;e|e&95xIO8;MSt9jl
z1_J}~q=7i7(Zs+f_-GSE**35;rbo}fu^{ybbw-CJ71VYBDgOkH9ivC6Z8Vlt&`>c*
z9<@h_(Dx4-4Ua+j01-NHjgPs&(O@k27*<_C!iOalRERS02|fnJAF@W6xEk1GX2HjL
zV5c)ZwgQ{PEcn<7>{h179^i2;rpHB41!Yk2NsyHFcp5lGNj=69M2|N?)olZ-V|+Z_
z{y3*N)8lL4Vp!@isP_r-6*LFKLiX{e>EPn}@i(wKrYG+p)<5|*z2E|9Ng*VkK2-vT
zywo$0|3L8z@%Jhp(9}HxpWrhwP_mJF2I^peq#@CakX8aG52<Ic)CkiKI-CZi-DvuQ
zOPpd%&kli%VS087teolDBQP!X4AfNt84J?}I?5BI?b~#L%ba3T&(X4#4`_6Sflu%`
z*K`N4JZQikOZI*qHND_6r<l=mv{dT@YJGt8gVGDAeGUyYNZrUM_<X^%TbyD{&o@oK
zaG6ug>p5sQ6UccmUqhz_pW_(xdI2g)u{h_&oaqgq+UCWT=?^$SrNIl(rB|Tw7&QA|
z20>!wWf(ZPUPgf<hw<g~_eVL!nO;r+7j{f9VQr$9`yhqX%R`W=<>fI*t?}{{xNb3e
z1qxPBq6N{QJ_59seFbtONF3rXc<uYj1>6EM7JLONN<oUy-1iC;ZrH^8z|{=Xt69^o
zbBZy&ngcCeUwwl(?A5>N0asy{7Kt&vHUN7>>NRKt9Ap)mHLnA}@=UMeAi?oE4;&6g
zuW?xa8kB6XIP3Kms5{<3!t)KJFk^ZHU5fNp0}?N9gTTT4HVm99nci-hb`mt6`xdk=
z2{Z$W=Dc^H0rl&cy&3Rv^Pq|iUHy~kA5L<JdI`SAQ5$^#B}-6zK;sFvl<xzm_5_JT
z;|VT4ef<RvF=@e%G1xoDADgCcxWOqV^%2(6gXmu!1Z^39gbcMaeT4OeKY|9Dv5a+n
z0!=NHWBT+Hj)eXRw1xu9-03IK951L-i54=SK()~wkR;USu#ET#lyO0$+z^*Tgc<k*
zKY^kIi-SJ1O}}uHQ;g}e*mMI>4*sk#{Q_ve)@LuMxF1+t>N98n29%>A_N|V9_NqST
zO;5PRDOUd(#K)47KBFDj0E>ywprK79^CF?`s?VT;4NJ^@231@j^$>rphN=Go3K$lK
z>057b3QBze)j>##VA1wP06Y+2EQo&Yz9Oh?%D^Z11=NN>vK20_0v<0l7W{%X4hB*W
z>Joebc^OF~T-*VyQCjc|D55|LAmPTq1nSy>Yz&+J;5Mfi)0Y^qLT14)C18fJ;1^H@
ziKGLzH0cZ4W&ybP1h7VC!7nRdjBV2=Sb+wEzU-TR0Kzx|lez<Cd{qGr)-nrzwE+i>
zwBT1zk%A>9f31Kjd<04m;*76A=|LQPw-YF&A>LXY1*(G?_yoT(O`mX=Q;g{w-}DKf
zi<7@eO+NtUtAMTX7W`&_J?DJ`?WIAgjU_=D1!N#-C;-F;#WOTDg983r1Z2kM+XQGk
z``Z$5JKI?BJE%fN3O^-ii|IS4+5m||QV;`NTmn23;Vt;x1iRC|gT`jCgv@tPlE>oY
z?;T*j8Vi0$ThgiosyG?=1i!-uZ(uHgi9=2}Vix?qZ+e0osJi<O8<Byjgw~_qA=iK!
z3w{R;!GO{rTJZb;xeMf3Nc=D;L08TGV4MEI0hBa;KxQ|j1%H6XW3ZV3oeux;Zu$pM
zO#b*bJ>dbTnAA^DWPnVE+9(Mf5dWD5iSeI#kQo0t4P2Bm{hS5S|8w4Sg@+*hppjZo
z%7J(ZUbOyP1vWqFC#b`MBp(4S7=D5ZHEi~R3N|bw-oHQ#9zo_nLI9pZe+7Y4sMjx0
z>|xUfsuHo-^9wXLg(aMR2TecV3>w;l-%SCrkU<Hw#DRfN@HePL21NzL!wgEGelkcL
ztpfm8kG3pF8Jd27qph%pi-YPW$PqWpg1@__F95BL`8{p=h9{h2OuuJ<6F0Nq?<0`L
z^zR4Y@?GjTsN};^AN+w7mCS;FB*0AxsXsW<#~%ks6W|ZzI54R{ppi;Y+JL4DNM7X=
z{8IzYs8W9xFfcHH3O_XYzX{L`{1<i*`(If0fCVIUXyPv@<sb(nOdN7oF|*)bNS~JJ
z?+I{gj9KvSJy2+XZdnEehSXmief@tT&<y(zRD6SMfZD7KaxVj);6GSb5*meYameyO
zZ^8c{-(pD||3MSE*u+62NZ7<7=XEjtzcpPT4O9T2U7x{{3e64wUx2-6EW`jB6bCI_
zhB%q=AE?>Iz$e528YcpYL!1m3XS_Cj!D~)2CdMb=^|kdvjGzh^lutlTVqjPu1DVAX
zVgiX_I#GxTRJ?-Z(A8r<h(d@7ls~bU!vY?Bn||aOrw|iM3)nHtLM)S}e|W|zCdC38
zuEwTm6GWaBG^z!11jN^?V?pDG417YYaS-3JrcDoc&MC&knl-)QIp_uk(5ddo>Otiy
zNPW@t4Pbe&V;Eo;XsnJs4vJ7dA=a+x55V%EB#Es5BvgLUbb%L~V)bk<uvQ&H?4ZIC
zi$B;ww-IAjDMIX^k##KUIY7~lTqr@RTOm$R3(yX91{G?q65<3k7LXhq11XGzIHyg&
z@Pbo}iE|Yspg7lo1AvKh!&Ct-F(%Gk(<i(HN$;EP07@mC$EF8-0P#;vR{+!JrW=6e
zFHKJX)7PdSc*!Xy#R-}Z0a*u0ZL4EIeQO3jA<jF~1Kxt<LH#Ez{^DW*Tg$}<O73Dw
zT(JBHF$R{}g}6X#POxbQb%BtB1u{<~#04sgFbg*!uDa<PUU7;sarI4acnhNEOnVQa
zHcVsZ5@X_KnEnB@>Q{)H2gZ<s1OvAgI2fe3Ve@s6WXAw)%nETgO`q_aQ*8RP7o4)9
zpz;IaeuVs_=@&r3$vth_OHOgd9pK`IS%@3bi(nSwzBJw74X2nCH>jl#3Pxz&N&yX*
zGw=y<Kbn5v8K)Q%_bYJnXX1Vbjy)r89C?=;RL~)Z3#hOMne%V@g)f|9Ogv1}KY;Ax
z0ojFFW()Cv2QfvNg?J=DjVduF9urU@Eyl!?2MR#YdB&jdlj6aC<*E?RqUjqz;mfmZ
z`h|BO`?f)}9fAZq&lzX{@IVVAo?Br5N%6os1yKLP$|4?!zomFU%auTGMwkBt2^U@?
zh`qdK5PNx{6M#az5!mx5FKDs_RI#IFA6`&p1!`KMi*JHjunla16dx#%K@Nf>h}E!c
z#wP~JW_)tsh+^cMzWzC<I1`@+IJxr~L2?<N9VB`2IYDw4pBp51@%e$18xvm;B$x4p
zO>g+XDJI1SEA=4BYjrF*82E(v;vl(@57eRnxdti^%Y}R?pj?RSUP~dqrs)sfA{{IR
z^9!V%BE&Zd6l>y=up$s<I81sD#81nn8+_svW8zx{&dN-Do2DQ5$|;t_2U~>=(FV`b
ze4q(SELoZllvF{X3JrNlXqM*3-k}!a7lYW#uLib{iC+tp)Wn$h^+2u`W8ycM_MTIm
z(FL5t`5~no|0zhg^PdC94io<+NO<#KgA|7RufTqg;zu781(m`Kd_n>o;L2B8NC4C}
zLUt@PzX}9F@|i#wIG-^I)J+%o$SKa)Hr?SPr~GvDPn`Tr0(}q%3rvElod#AbB>-B_
ziX~tK#il2G;*_7h{VgXylb{yFcY=E0bjT!V1PTT4Mao|}#f$`PuqSsx>^&JF!7PXy
z1oOadU=o}MvP+y1nvDflL2X+HwoOV9bOsET+Dq^dR37`Fh>+kbh%4Vgd@lG2V#_zE
z<-Z`d2r*6H@R?Jbkp;5eO-P6jTsRsDp*1{Ug`*HC60iiAP{1??E-@(~&`=Mk83s*I
zpo*J;flo-NWBP;|E-@ydMPNrW3GD#)bA^NsO&9nMy2R$#^oBp2V)a6xbdDUyAU;Sx
zs9l3aTo_cIViN~d)yU$|v?2^Df{?|b<_m*{wpbXZi+<r0Vq7)d;R~lY<GSeuAPSPT
zn1r{0bDr=%aA`7K>?^0hbidb}98AK{+FBS|TMI+ex9~Mcc_MrZQeFtdsvAh&gxA`_
z4?yLGn3OQ68o?5>A{-!#>p?f+Fkq7gjq+g=2l*76IH)m$90JfRF9KSKf~6K00Zm!C
zFifBNl~aiE2{>bme475@E97$5H=JTjqCAke6qTAT@C(G3oBrS@h_-=>dqKthpyFAO
zLPNA_dck+_9u#m{CfYQ80f^fMDfC6Vz$t}Mbb9}9PH`sDS&&Ly^ccAEXA(UH=1YlU
z-*qJ<`UhgU7#qlPaYinX-QtWoP*F2TvJ<lcCp#%IP=_5$V2Ncw>rOGqC<C*Q*aDCV
z(~th-6q+voos*qOY#rDLCb2`)FZ|^cV-mYG-2qI$n)Z)VOiB#YXaF@*Amu!RGGz2Y
zNbKA651=-n*stjZL0n=?;^3=l#hAq9AjXL6fwVJ;8$nDHw}U7bcbaaH!X+jp4(f1#
zjD;j7mQ=`4g^+j<R33Gy2133FET1Hf+Py`{gO({^E;11khgB?4Z>U1L$wK0wH9ZJ-
zFu=vnfO^7WOcG+#75;OINr5jWLaHoNKot@LpOAzZ#Jdt!5PwQIfD*fu1ju_J<q+#u
zr^1x`P2cdJQ><PBbU6^_0IrY(sLlZ8GqmDI0@T95lDH*6EB!!29T0mUr4`6opcxgA
zI3#%C;*yY3ar)E$oPtb}O4BDWa)~iXnt<B1Qj(ytGc0yUE}LEu0#ddL927~CAUlzQ
zOc~m)0G|g5nn;4V1>}DQJ|RhvTR?1xTUNt@P7>6s0;z|HGcbVEfYhG?1*teAI30>J
zJ^%-(Bxt4*qyS<#JU}JifdiCD^566a|G|e!fV@;M#e=;{lLF1Jf!q!;hCvzBRbb!~
zl0sXP2N%aa{wO5ng2Q}B%h8zub}<Ab<oSf8K<n$UM7R_vy<&-Qsc8`Z%mYVJz0?vM
z_HDr-4my7xOPwnP+MR|?98^7FiF;{K{ID=gE#(qo<N`azNE);N1B(&T*yjj^r0u2_
zaEUWIfpynQV;?sbk_Kf6Y^H+7-LMpF(x7$n*wlj#=*K1wX(!cVM2s|O8yYqZI6_Jq
zN8eN$)cOPEIB3d(MZ63sCxgVnsT|ZS1<UXW$s|orVB`{)L?6F{rbwA0P=JZoqn2~<
z1S`{kJ>q3>^s!`cBp?~kWusWUF9RwsSr{0mPh;c~WPCFH03(-pJ!m!+i&|OGW_WDk
zp!pRnnN1c{2!X`GLBas{lPqZeJ2rE4Ab!<C&s4IYUFTR*t!&fu1({r8OtNj$6VgHS
zy6FLYAbQvI1#BQ1T*8Pk$({oj+D5XV(iy2qAq8rBFz^Y<g0>=p8fc(61V<Z);1iO)
z0~(|hWfqcsH{Ad<79jg=x&RNC7?WJy^aCKiT-o#kpvqCMYWfFuF0mvz&`1EN^n&<!
zbs9Jw@CnI*CMuCF1{MDdd_wY|YzGP<XkvmDNAe(tfW#r@z(Y<Rx)xkW-T=HPTv`aU
z^@0&gSjs~dY#9s5gDx1vrU0}c0W_`zvI^u~Fy<4Ip9k@({G#asoLpi|^2;DzmR~pB
zfs;#2N*>e<!{(JoP<`*9>OVpCe*^1dQUJFOr4&GE0u(|JAH&Oc1u<~>UJqIW&4{J^
zQ~*_4SjtZY&~|z(NkajYpFr6WVh`AJp!U52XbKl34h>m|1fP%sXfZ1zXvhqrfk_UO
z{~7p%6hM|DMoi)2iel3zfRccs93;&ts!dnm<`QF4)SB+V52E#^2Y~rT(+j|Sv*`)!
zTw+p+ph6B501yYPPKDZ|m;_17ibdeGECs$D4Wt$=eiYjv;jB0b9L`dTpm@X*ABwXe
z;jg#|>W*cQcu?F0;VWrPH{jv|^$kH4DU*^9sBOTclmzjWQWn@ZQc9p<Uo568t%IuD
zH2ng|cS^g!>Y0@GO`pKaCB~$53QS8WgSuE)qDMIloMEJtL9-x8p#jS<%1Mw6rkn=J
zV9N8Re*n358OR#YflJ_guDlLZd5SS9Zvy!VbeJwE7fPXDlcol$TNwC+l=p#(S}`VN
zNDJ6V8PqVrW;tw~HzbM};QGNW6|w1T+*|_F{rI^!q?AF^*dP-iiDq>ww3nv*3>@jx
z&A7P)8AYZiaC3=GUkBEJHea0vS`!U&+Al~rD*uDTt_l-4{FqeOKy4&3CKWDl2_~fi
zDr%7}1eItEd_pRa?8BrY1qnA5IZ)~lXH)|>&Q-J^p{Sw<PJ>J;M&L%elnQA28e|&8
zqwut-Vl`bskV{NT1vXg*lLz(uK(={Jci`ayEx9b<;S%=*WlbziaTU<G6sQn`1P+5T
zsP6*O4T^J+IK)(hcmlX7E~Nr0m66jNh!4_N2FW2RRgfH_0$TfsrPNkwftK1Tec<?(
z0$*;1Y#^wS4Ki>AWEfNB4tN;TNEOuOK~@JXrBy)=$6}Fc0MsJY1c*VZZIIAcT?Pqn
z)m0D|t8N0jm`U~7bcYZwF)3A0BNsUYKm*ncd_t;kAR(X%YNa7N1nOWlq3IuZxx^X8
zAjYamfvgc{RDzhUrUxpC#2L-Nm7kXysDXiO2s9YgK!pm(a%i+@!NfsRMj&x$w7|u|
zSA~jAPvhefoPM95i-R#}ngAE*fUy8RF3@__1`st1;<8;37wv;O@EF)-Qfg?&z$ill
zR_)gG1EE}EOlsg`wZxdz9iS6F>JgyMtGAFkXy_8;Ca7DLp~+nxG;sqGhq@Im4)P0V
zd;qP`RG$E@E}4bYx4;-@V2meFh6WF~3oR|A0V=bwjPh#OfX<!}W72>OA2SPSL`)BG
z<Pu}jm;y5bV!E`D2B<-Sxusi3;|<sjW+9CqV68@)ut0};Pz4$?nxK9qk_X}9KHwBG
zy-k!$KuH-oouY{z8ZdG2<-}r4nl)g{q%=XZKOjS)mMKG%mFA@B4zXNfOq$^HJ;jVP
zL2Is%)Tw|nI0K)M<~r!MU}&hr#W#Q*#iY3hY>$y9tgj8VM+G$91=0_yV?pM^^uxr#
z2akv`X+DAKM;nR&7YHEzph5;&KPa{t_=L2;=M#!CY4JexYoT@iR6zL}qz-Mq7A_7x
z_EL;V%LJ+)RP2H5fx2HAT19KY*7QQ%4;Ke-Zxv(GN`UHz#RpVB%>P=THVMdFsD8LO
z_&`=MCan&reo*}bYH~pIGig9(w1u=l;Rh0j=!c7I%R!nP+Dg+ONO6ftX@mR;D%Qar
zc81ky&~Vn)n%)r4CB~#}HT{DOmsq_v%%2eR7*wFSOB+<)fy_Y5McS}aY#{DpP=U@K
zYQq+^z|4V(gSM7{{0mjD3TjL+@Cj*y>Ro1rdf2=w16%?$(Sxi3w1xqs0aR;(#Gw|b
zLdA7pYj<E4fEt4gd_p=P$0MtUiNib$R$tG+04~`<8c;`}5aOT-V30vz4GavbU<dFC
z>A*q)%tsQ3twn&ThpZG3(%FWZb5ud%tRRc;L843t)Q~{72;45^6ViDGjw&XdZ__U%
zbBRgmg2X|-LyH>SG>|zMolG@QOfv8Z>E?lrsn<nIfpB?Hu>;Co=*Gf^fS~?SftDD$
zprIa+bD{o+i=*XyHPEyT$bLu#APkRjxCGe$;*#jzho(f`S73J=>4IkXknB^1$%7gs
zSlq3rH2r`Km$)P-q(IuB&Q}8kI|HAPo)*YhaYIn^2P6&k1zZ}GZ?Kt~2Qd}2ZwRCf
zYN{%<(Wh4iHkGky`hpxTF(W<Dhz~YXK&1(&4n_-W1Ec8^<hjI{4D6-{D1hh%(CH*Y
zkaMtTFpL9hkTL{~EP%2*#2c&ApsC$(2G{^*A;WWEg-nK*ASN4$Ojp>*DatHl1UWl~
zS;z>oRZCjP2-H;mjj=#g$fyB4_U~l`8g>D-R?r-81e&(M;zlFT@((OcC!-_KrjyYH
zaNCQ?=n13=Wh^oMfhLz2ld;xx1!WMeH+_L3h_(Pbz{nUh@P@?!#-NKFu{glE1+rvW
z$oSCo2VeuwO*c^D5;HOeB_V7YK+%KLY?20tDxZ*v3^+86g-k%5W-J;_K+REX8jnC5
zH70k!Bb+863$W-nWtl#~2ox)(d=Rgj3W2;X&iDk>7Gf4MV*zc!7n3pr4TcnBMv++o
zv=w4D2c$t-$ZQQ{I0bz)#q0>!ASQDsNQjubfkUL;9F$;@Jpe5{%t39TpO_X}fM(c0
zRV!LrumBYjSUhO4g@FOv#1QCOVFo);b%17&C8%?R#UM*ilwcDFb%n8sgX$e@;-KY0
zaB*%>(F($RLRQoJ<+;R}tk@v=#R|3#$qF*5ZS@8kqt=iy4QuR2GYMI%fYWTfHIA7t
zYf!riZa>Is5atuI#*vn-LDe2M^`NATCE~0>Db1H*`qCd90?a}-5Xahp24=CunoSU-
zkgy4xZlKB~E(vORg9;T$A-6gQWH$q!kWJe32WnhmQZ}GM5Sx4*Sf0t|5Y)J1(>JJb
zi8Jy*gUlAP*1^^YlJ;!Pz-dp)7L?Yoc+EBlsxAy-oNXLfeUdHAd7z}gzyL4vY(c~C
zSbS#-DkDL|J`nGK!WndbwU8~SsfO$gP({eVCuCbRT|tveOv)BiVS@BQ>_O;jn%)4G
z2Q>s<V(cLmvYj+NK$A<X-WJp}LNY%M8jQA}WfLHM=;nf&-XQg$G9TnGn0ipd0wfM`
z|LPp*G@31_f(D60)x*U>4GtED>8ToAf=sr%z>a0I-8cP!2A7zTEodklTOb`_U|<Zz
z%;>fkre8S0A<86VJ3am+hnTdGEvP|?rBt{504>$+7$Bv(od~2<x09KkaFRomS;)=~
z5|4IH(;d{g#2Gh$a|n~&uIU#*+*8vRsB?*Xf&v^%Vz2|HXDs6Opix$A;!2RjW3L8I
zG)(r8F;QkA`!k@Dn92SQw8V6P467OoIl$V1kYHv|2YHf#Psjmn$O0~&09rRM=H&p&
z4M<G_bx`Pn^nsEONE{l?aB)ywfw{_9$N_w2O1+Q++5iCbyhtHOkbAKB)DdJpatQ#c
z#u@m89C2hTM|Ags%mt|jyBAdKf(&F}fCqqM4cMbej-WCei$zXoEpc^_#SDBxPH0^*
zb#OZ66LNwbk^>89uzh?&PD-FX3SwSPu$CKGoPhyu9%x@2a)83jLu<;ZgZ1$VIaz_W
zI*3U*fdT|eW6WvFbcGw7qQ*i_po|1E80H{Q*$nak=y*nuIM_f226dP?c<Y3ikuzvK
z8zc|Y2MtMQn8#uIVB#`h3%!M$VJ?Pg1T`xd_=KFnry;=CoHD4x#6dKcp$+E(uz~eL
z&fvI16h-QwRuafS*v1i<OJL%l&0kp3pfjk*!sa8i%~P;E;0&tnA!kT13pu|4yGB~b
z1(b-e1h@+%f|*>jz!Agbq65~zEaZ|mUBQS;jLD^Jx`P3Tt^wuIB$pNj25j>IE+AV$
zL-S~D1{YA@6U%_J3ur_JOU`lm0WN`zTyc~kuAuk^71U_<xb{F7gSt+eZeYkI#^gF{
zdVw*Bo&%PU7IH-^vU3GNwFjS&>#FG!z#7(o6*3FC?wWqUkV{O;6*?8i0Ewv8xuB%Q
zz$fJT4-ztNV$%}}xWt&;q^1WLafwN}f$|Wj?1!YF)j7~%A2+q>6F^HZ+(2{PAbD^e
zVL-_1P5)rXC1&IX(uX9U3+)}bfhKs7^0*9W#)pAV$juIFzZ2Aa(9$JPvPKIUHy>y%
z;1&TX{oNKoY6EvJP*8z}FTo+@t_1QI=o$`igu82i8`#W3?p_dk-2K4zFu8-5U>OU!
zgZf#ZouX*=d4SxDC2Bo9AWOMC)_~g{#zG#T&Hh;CmOMbcR4i%9QvjScygWezf><o@
z1QkZ0x(XDKpvVPdJ|XaF;vjKIM1n;b82E%dA>%{!o}e{cpfgF(^`YlHXh+Ty)K~zi
zM>h{WN5a&D@&@K<GD4o9UN{SbFaz}R_|>_f*aJE2+Vl;kTw+XKBH)l>7V<KgKEZ@b
z+%pGz=JNuzlCT7r*Anb4e6KB#fb;^TBrE~x1#%cDz|aE33p6YM5=Zm6Hw$>6tlk@>
z9uzPj8XC-?fc8c&TR}_782E&|L1imQJ-T@yH-U;gsJJ>zJt*g32}o~9he8`;k%2d;
zy9+W5Es6R-0@ho|2ei%vOA_<}b?UH$s1GPgu^Cta4pAu|P@fH({DJ8LW?bTipyeUh
ztOErqHf>M9#(MdHas(E6Ur@0C(u)@0zM!HCBn}NgNL=s<`9eli>wVGN8zA!;_=J2x
z^X13^4-<#gSx|e_LG2-sdQfv4Sv^b~v>F1W7A@R;moYFfDls_2Qar?6AcNL{CE(*x
z5D7jZKhSb9EFSlBnEv4as0r*hz5hRl7_*RH!t{iroTA=BexQ~GHXWdf3)BombCMsV
zWe#%@JP-Qqn;u}nC1&IY3PvpE`GbNMo45mbFvnQPAGE~>n*vZ~#U{Q4JTf9J<PXY~
zpn*j+m-^oT4@lGt`GdyeLD>cr!jO;xcb@!V!?I9ub&x>}d_w-9B{CrOASWZM2ek)~
zV-KnxRK+r2$z}nd6-fNkS(Lbhm;yAWPXPBI0=%XxSaXRn1^7+h0H&j+2Y~6g=?!2y
z4a(1h@|&RQ+o0;NK+Cv*H=qWFQ6R{HSb`@I)PTVz9t1KEH2np(K5)(S1n{U$kPt{*
zj44PAWREyw*7OTDTw+W?dD9bYL3GtLFjY6*08F<*xP4IWBB<(RP}Q&zhG6hc7^7eu
zBMiYfs=nYNka?g}dcc+kpMg3u#0=ud5G#-)#h60uAb}O)1PQDVH;_ItrVuZXJH#3N
zrrC0V?lUp~QDxHw?7764Lb|3ea01bjp!{uMeo_di5C_FBG&O+IKBzDb0nJ(<i-S`I
zpHK*>a0iKl`3wwj_0Lep$~D09d_o}~pmS%T4A2-1RhWL@I;im;iX#|8LG=+R(V?a6
z&^=&{(n6u2@)678n9w^g1vqwah5i96U=|7!05gPz!qAF14T0$!?776aG(aT^1D{Y>
z4d^^Ev7|8ABpNK3K-07!d9;p(226Yp0|R3&W~V$1wA>ks)5D&C9mFgY_5;k2777O)
zB#*^}aHr`FuR)#iaJT6X9J$1#!m*$2DHNUnHi=m%yaddU777O~D#B*us_70spfSww
zb&$jnzG->^L;#vf!a)r<P%Q$D5;<r`F&r`{1S=L9G+^Se83k}EU_gk2w&!3o=hE~7
zf3OR#O<&;8DJm@#4r&%-Q+W^S#7E%ts}&BLV}L~rs9<N{6AA|<AmnsfG5vxAC}Kg4
z00usx2=D>bVoVW2VDqFR(0YCvFm-ZZdzd1?XNZb<MSzB$K<2{igGP7+EFr;s3=^-w
zKAaoT1CA7Cp@;=A#wKXQMr;E`thgj-Tn9^1iMRpN@CM9~7K+5N!Y@(;tbkc4QUlD8
z7K#M*B9TKC#Ao0Wid+LzfMda7<QcF6W}(Py(+ixq#2N2_f(3Md0Jv0%VgNVoyrMvr
z0v7Y5&{_r>pl&e(pHLK9%K$Fk0nT<zQIIUpEEM%<`T;jCF{Y?@(;M7D^snh3K>TQ~
z=?Wlzw9xc`04_13XjtzG)COc=Se*}QR5S1iMT0gGVyPFR`yl2<FN2sHeF#iTMT43s
zSk%W@fUBPvv;_bfJ3#djpHK|iTr*s}1f-2ArfK>G4=ypLn6Bv#V7hObCx|;~dVvR*
zm{$yHZemG=rokA{hD=bJgQP9EcpPXbA33z4!;5iQ5NqP{z{bZlL2Qd_16#us&jgYN
z?O6ah!YCef^bBr#Jm`=REVd^4fc=vAV|qX{ml#u$64;U?HISiVOi5Z0OOlMhmKr6&
z#^50N1#Ws0Xebzq=_%lmX0H_Vgaj&p82E%zKs1(kNx?BtkOFb#^fWInfh;+YW(Gc?
zR8Zo;5^mt|MivK^K_K;L!)MTg)rC?)=3!HRYPy3rml#v(t?30|`X7h}U1RCs4PFOS
z0HTzpD+F_iF{Rmo6oXe~d2@+_R{1mPW7ZpKQ4k~AAk;dDo_!GBDKI5@hJgXA)@xvC
z#&6RNe7M9J*}xR&pa*P<(}lp&jCv3%102=qEs&^AhYY}`zkqNve899+2515Y^I|li
zjCqhGk+BS%6r?gh!H6a9GWLN}P{uKE$}!4-wIm=ZhCu_`-pqiN^pISD5dQ#P$KsU<
z8VkY_8=0U15^Un2@d0e&TA;ucW6IQ<F5t%nT9^f*BtbjRG%+J46E+@{c?BFAOj!nC
z+9(TjOf44QX5mPwSs%dqys|+pDlE>*2DO&3iK8cGXrj$_gLos`3l#lgOxZzDdK$Q-
zl*$GTPausW!Ai>Pd61GddljT)&0Ys7A+tAuOU9&ZP%I+516oLBgX~2X2k{yBgtE~V
zQNuD%HfUM^oBD51cmJEN5WpqQ$Ooa6rf&$~5}(c<z$GxfKY)vaQ48!GrW`%6GwXAv
zFfcHhV#ZGnsAGm?jXZQ!P0k}|dli<-K+a*{6UqVgnh@m@g9c0-v}OS`ybWyufy#SO
zI~mlRVsvGQ#u!w{#eUqgP%c_L!W@(fnlr-U&^#S*x{%7l(NWBs1PQOaMUeQ-+XgOI
zyz<bpkv7PD20o!Yv{j5S@qEyz5*GXO<EDQI;sW)IKxLU!K4@?WO97Q%2C+VW7L?uw
z);2xgn@gN2{~6d#^#vgFL4gYmbWKoNXW$bmfGwzpW^K4QXx%KbdT8VofCer=;xP3v
zaU5F|3P6o9CZxG)SfCfcT5T`~LEEnduoXlw3t-})7BrSNSpnKPGjQ`k2YG@V3N}B4
zfk6{guYr6F>rcQefQjSSF;oDW%?E`ZH2J|T_%+=iluMkEY5IgvE^$fFl>t~Hr;raU
z&8P>VCPDNpg76^eg{kn}^nfrfF{Z*#(<elL=wH(t!2EyH7ld<(F%>a@?g|uT7Ag_~
zNr+2=dfHe@{URl>dZ{8%m}4pbikv|9h%<VDl`$37L6UD#*K~z2E^)~o?3Gy2G_W+|
zE-)nt%GB7*eg-l79ms6ZrY3=KF7fH%;an1oS>P1NR9rPJf(z8cUJ%YDZU`FGfyWL5
zgEnZ)g@I3~7&N305{E_(TpW57jZpC|hz0i`K~?++6e40$#h^wbmLMq+1362KsYD8-
zUYt=5q+5)sL}~hm2rh9+P(6gjGbMUZWkz6Sj3&_VFR_D)JAuU|anv&<c~DD>pvqT4
z0=i@yID<-+fLi)k(n`r8usl=Av*`s<kdy^V4yA0<A4GD28jTA;qI}agfOz05)J2(v
zO68`5g_R(}PSXWIirgS31VMtnGznrt9$1YesI7`6L6`1>=sgG4%L?i)>rd~A;*y?T
z9>pcV_-p!sXfE;T|D(7#riX`d@iUe2O*e?<60b+A1!4K44A#K_XFvu9ZIC(!KA|$u
zU_K~{!F(if&|p6325qQ%258Ar2Abgqi9^-H#X-|W><kR`(7|~I2I#;+87Su?Yk-M^
zGCoKgW&x;m0&);&CKDtMvj8RzTC)cdhp7h@(;)SrGzt=jsIO;WfJuNl5g-Ye251>u
z2I`W7#G#2AGIGNwR1R9^f+Zr#VGVSsIhvp`Z3aG}a@1}C14O)@PpBMJGhitj%gY!T
z7>yA#oUod+ybUT2a}Zd9PpBNU-Wk-Tg<1?223ZV>GLSgBdQjObip>X?ASu2a+yEAn
zDhFlHhnP)-3Zv-;aiE6YG!PjuJwS&`tiA#?tPe^cP*-R|#}z8js#Q&BnNb0&R$=O)
z&7ules}(A)1&%L1p$b?#10oLZ7gaz;XX{}@DlDm>gv7unQ~?^EMRE{qp??KzpaWtM
zgBElaq!JV&$m*dUsD#zEF!fLmRHD?W^$ZL!A6LQ_2|&Xg=Hp7V5fe?Qk1Ii4aFE4N
z^)Me-qMru@Qx9rYA=E=WoXWr_R0*01MMyBfd|U~dz(W>?`55FQWO0~}Ve?8b2f=&{
z*&@MI8367;FjdBYX`@QeY9vs%6<XKA5@020{R}8nq2jQ;W>wI=^;IQc{Zdt+X$>s;
zt9F3p>#NaPHQG>jR>J}soJ1HH;Nq|V1^JJGfk7L(fW8_QpfL3?akLgD%$+qLaXZjN
zBGdygkJZFLnwT}9u_`PMuYvTim}<dyQHe3tf^U=(W2$Wc>#MH?6@s9EhdB@$A+@mj
z73M&gIBd`qrXD&-Qwu7(K<2>I!^A;F7f2kY9-4A$K`ZXTE7D;aU=nD9+S;IXt_*xa
zwWtFr3~+I@%&rY8j6v#QnH`#P;No8x7#Kn2EjS>j$24<s8P&nE1JsdP&;q{>7E4ew
z;NmLa)L>KxQjg?0EogVQ4n5Vv#KHGUi80j`fcxfkJ&-u419=^!1?(h9%!2wSb)e&2
zu*7LSY9eGwgJz0)STO){76SuI8Z>d%!@LLa20}d~_X;yGK;i(Q!2{&J`g+t6F@!#}
zQ770EyLymY5y8Qd22C^duxbZp4YWH`4_YD!QV(+%Og*G!51&J1Ndr|A417XpTecD6
zpqd}qAXtFRn7&{Er)a%UJ*ehJRsgdJlvt3(VHSbbse<Y~v>2&JomoNn5S9qheFE;O
zf@*14l)x-NO`UL`G@uSnvZNJEzmUQu#+3#w9~x4o33G|nH^BNhFk@lTu-RQ$NW;WI
zO(2jzVd|mIXn^H@n0lBvsD*+}JtUV;|C`FiSr3bq2AE%9hC`EG1FTww84eRit@Yr3
zZv>UkAWLC^2z5*&dUA&(pL(H2^z;rIC}!XjYJ{bCn8gqcLXD_}F+909qGofJG?+P%
z`~k1dVd=RMT)BY;aA6ieebxx-3V?h76Ne_VMh8%=2{pp<6D*)IrU#^PiPgjMZzF8`
zCM*D;&9+8ZzJiHElXoL5|G><H#&#oYT^h_8FmaGRP#{B7wF0P8WZ*LvY6OiZf!qx<
z2xc+rau*iZK8MCd(*<(4#F!eFO&7@I5=&}CE3<WB7NTYs22hZJ3bsbHvK+1+H5(z+
zKLD4vPK{^{FId6T2x)jB$}w1kgBCZSbn2!Tq;rV{!3xGEP(XnE4GSn}JT{>xEU0-+
zI1*Nq47j{(Qej|V1jQl9SXeR6z$erMYxKZ^7aBZGpfVrXdYCvY89~%D=t5^)notV|
z25smtT@z%Jl{S2B1zZE#o<_I^$ezafCe(fc3#^oBf)v1r@Ps)G6b_gPNT>-`{z4oK
zFBY3%#S2Uv+9+s(6uaCA3ua6Y$m9|YW=Vso02RO}F$W4yKA|Q^vjLGMK~*Oxh+!!W
z7LzdXN05}-^bC|z#p_`S1>ztESi);UYoP0Z8VDd`(Tgf*hHi#6#34BnZcZ~O=0PzE
z6^EJA3{6l%@R}B85Tsd_)C_VENF#`5V1P$?Gc1Wf#kHZ6Rn4GvRUq|Hi(oO{3`;st
zakzR1a1NR-m(9h`&7cb^2pIT;n!~0)H~^Z?Z$>R)5DH)k1ZtcPsOJyTm;yE~sTr0~
zAkKqFd^37I1oJNHTq3-rZ3gul5#B+F_kaq{`eyX<37Q_8VbvNe)?wn1^aV>Li0FYe
zY9Y>L&;je?6KaMvYN6hQC5vWI2c8+!>V`_dH5`EYAHCp%1uQH%!YqQ$)i$FSd@%Ls
z1s_a3q~NP>M(v5hvq>{*fryAVv~;cmEh(B|=^Wx8ggLNu4iSf&(*nxu%naP{l11mn
z^nzS2(Rz5L-2y3lU<wf8=xs!3#%@7PQE(Tupr<5g$h4rhbihTl37=34Y;*|XWO(DW
z1(uY+af@gKx2yn{(Jio~fvycTX|TYmmKIpjfW#zA8nj?(fwhoe)_{se20oz{Sbqm5
z4pR>)xU6Amk|hnAm0Dm)0%id$pkPS?X3&J`5Awkw4^_~LTGqe=pcTE91I>G_pfU|q
zJb?6pN>ecA6KVywX5eEy@VwUwau7zIl;IO<g+)2cWiSgoz^!d>p;lOXA7lck9|BW=
z-Y$WO!?H0%J%cXHhs&m4NZ=APYDJARggh+HAaTi{3mq<Ng?83k(Q_xX9&LpMEyO-}
zv!)f?T1RXIfEB8(u-pf+2caI8%g_R%4b*)!Mw+q!hcpA9P#Y}dU=~9IpbgY$00lL=
zL7;{xmMCk3rE!=!(6rPB8fJr=lfwW{WNk2?K{UWauno28&Y%k&GHru3-61|ks7DP6
zgnGy*gI6bLf)R^@J3-Yss4Rh|Jw<RX<`e1yO=4nE-(>>ItWsTQcTvE##ek&Qy1>CR
zy`_Xpi3=|EYWjszF0uM9m`h<k22I^E@CkLn;tb|9kjp^gs3jwVE>wLtC`}=|92(T!
zIHpK?AQiJVET6*->On2|;NrcHrYDqfiAnXsf*g_t81$e;cJI6C6Uw;6>U&{DG)x|}
zHlKk{s1M{gP@F?Ost0M*3-!U8C@}RfaZnT>tA|dK_Q85tF!eBT&^l>5(1Ko&Mo3Bq
zuSM+xO<sU3hl(qLR#bo-1S;{c#A)9RP^3xqfy~9Ct)BrTUEhym-DN+h?|@AksB?|Q
zwh5?Ngh3BvEd!s>1hldQCO!$Amauqp5@^#7vc*t?CV>(T7K<l+0r^8}GTMp;=yi`m
zlfhjDw#ne}yy<7kxs;UPQmCzE2195jnY?RyLM4}&)MQ9&1fH@Cp;gZ0Q`09@a)~ib
zJ~w?q1&F>j{XzvuJ!;LuU<ggRlkZIf8;4dV7(xr9$<L-A0L#M?Bs5_eLQCbz@1}pK
z<P!6mjMnxr1jRc8pU`Aj4ud8nxHv3_!OVjW>`neR{XrF%nAQ}~TpCh9D?!VmDd3<&
z9{Qi&P{Ae632g~ashTcO%_Sx^1=i$*84pd4Q@W-*RC9?jP3fB+Pz9o=O>d~;5}WQ;
z$tB1M+Q!SkCp2Z=^bH`fGLRTF-%VLIy#Q=3Xbc}IzZgRE-IR6H7gTeJO<z{YB`68a
zTT@^a63pu_reCP!63>JtnJKUcgh|81(Uw`jeGXc;fF+4d#c`_i)PU)r+o<b>X7XTP
zxHuEEyc^3j&rHzz1S~t<W`Z_NViN}~1;rvh7qr*Hy&gHPKm`V$&|C)w21a*G@p;hm
z2hlgoFGg<-Let7(^cDn69CXGUD3U-SYYS>}z$9SV9g-?o(qQ7KF$EW2!ZbagmP<@(
z38+v5RZfs<Vs$<=RV-tf{^2ud1@AHg7$Xg$V;N|1DM$y%382-BP#w!}Ob__TAzClA
z0@OJHwLm~dgMtN&`Gi)&#wH<7WH1B`S}^blt%Ri(h!f!At3daLV+qUEpb7$XRt>})
zrd7~c$TgsffDsfa5QE?nYhhsk(ZFB?)vy*a$j1QP6$ckz2g;mC7OVjk)eL+>>p&g?
zi9^kYiLZyXYCz_L?1x#f9yV?T(Ezt#J!rrWWC_SX1_lNdXo<2Ow8sZo9GbP)qm@u_
z^I;_olKJ(Zai<NSCNQ!=PzyGIN>Xg%Xe&2h4%!GZ7)w-c1SNAU`D>F2Lp=kwGb1;F
ziexMnZvu6ALFJ#(e<%PY7Cxa(^B5Sw)7J)2Veox7d_tR^V9)SdKxH;)c?#F`jw2kr
z^+H>IFfcHJM)#mW3^EoJGF!D67#Kkv2T)u=1i_X3Rz0XV$j8Xype1$K%$WpLk8aK)
zkT|FgM>l8%c9(D6GwnQwsIkyiSYm`4XawyUZ-w=+q2|HGZ-DgG3vB~M52)xy^XN8E
zwT(r5JE%VgO2iO*n6`qJsW9*fZ3p$|K;jU4;Nm+$Ssf|nR6(K4z$dg5)E;31rFN*r
za0yU{7Mli88pLwA$WBlq$D)3h0`>sg1+o~_Sq9lV-J6YzyM7m_#KB_pE*wtT1uC+z
zSh*WVeX|?XK*6RSR5c?n*@A_^ZqUiUplwPZHzK8`-JpsPi$Qw=u={ln=!jk{=IjAA
zVc_Q2FfhO@-UF(j;Svb(y`Ultn>gf5_j;kdpbiZd1^Yk;hF}rj52~&~$pxB>_JWcj
z1E0`-P|pt}4oyZd@dKbNfou*aPciTb9RzhDnLyPtG^k)cIS87o0JT*i7C-}$Pv{_M
zt^y<uu>c{C)_;MUQ!>5b2&f`Ecmu}x0LnSiLWe<mK~4pk2wG?fDnl6fgbs5|4`|~O
zlR6BlCXnSpkq44jfXahhfF#cXDs(~e7EpQ6dOT!#XpTM{0F?*vk>#OP_TdbuJSf#6
z$p=6iWQQA|@}M#mNj?ase+E<@l;M!%gJJ&L0F?)2JS6!rP%Z+w{{&PXluMB0!=X9<
z@B^qkC_IqlBS7H+(*FY@e*{#nBgscX<&OwJ<w4<vEDv?x5e=w3sOO0!9|a0820o!9
z4q$o7BOv!6%R?KvN2dF?afwSE0i`e`>1det0<d<eBcQqvSsvsakntT*c~Blhl8*tU
zRFM1vs5~gRk>x?r0g~SVl?Tm*Bgw~tybF@Q0F?(tC$c=u`!AsKpym;hd^}YDQ3jB_
z`1JBtE`F|fkRurQgpNvp1tme507*{*$d4dt1F-aT_BJklu0)tY9$-O9P|iitlL&Rk
z(FCyc^ywfyNiaPXU_nVx!HT3O38rTPSbDm8I~PA!GBm!At^f;4f(lC{J;|Wt2Xfm1
zu=MopAU!FdI0Xsb01JZq8%TO!=l&o4F#SLWm-uw|4laJKRA|5-;{XdvqGemyT+cBD
zkhB_CIy4;|vjFkMCDC$eI?S{Hu=MowPA-0~bf{a8Wq<`G(Q;-cG-(`bnEs%XON}cN
z8tlhrK$N3p#7t1kGw=x=+W?lH-rmK<&y@xB`LPpVK}odC2VRK|((_<iH<ub0XyG=f
zIdkmC^ne~NanMc)2BdJxgSz*)09bnZ@@_7Eu6$?$Kdu25lmy)fXU@RD04@GNr6I`3
z;|^eHL6CbuwFz8$x<?O}yd)@BfxHhF2I=DyI$i+QHT`%G7e7}SH0F<YfCVMda#A@=
zdI4B^dU!7vKUW1bB_H1b76jkIgyf?tXb>O20Fed-A(C`8xHG~hbo>QG8ZGZsgOoGy
z37ue=KB13GToPm$lI~h)$efS>OHVKF<KkzkYna~A$0aWbG8sv29W<$*@PMdg@8{y@
zs)w1M02Y)4m83{|8lffAi3+gv^ywfy%}@`Ym;e@(1euGZrv+p$$jK|f($m!^aPf0>
zfE*4IJOCDy1euGZrxWIk8(`__+d+Cj<3pf$J@H}ML@sejP;?<_=>bJE1E0`I4v_40
z_laEmT%i5ZARQ+aKw^@h*h13L3-TODhXqJ>`gM>F&~PkRM*v7n5|qP`bWDTUkug1B
z5|<j+bQr$@tQwTzkW|lvrrnb>K(f=nPvYX|nhA}dlN&%{k{}gGI%a`_0py|+(+ehZ
zsd3GMseS-f4dNlGo(&DdlRu_Un8GDKU3>}`Ki6!KCmHyJP6>bo!FK^8>6rtv5hSev
zl2+rI3(erC96)^VhA8ChHy30jNO=TUdb;^kE`F|gP+y-a01HZjj6kwtK1{j;EIs`=
zNY7%Jvlf5_B|%9BNzYQKS5EB!OHU7<#>LOI6dFILE`S9kL1_X>4`}QS6ji5QfTgED
zpT@<{wCut3AJe$x(euR$Xc{~%F>N}R`1JDWT>M-sq3%3w01`vb9jif+$-pOc+5;pz
zoqYxuKi3+VDG4Ak^t`ba8nmY?K(f=PgLJHe`s?%rkQjQ-*aQuf(<?x-)758k@pEl~
zCV|rjKw{|mVjDC_PTv5@PTvmFu??o<!}JNWF!RMOs3m7Oz|zy*XL0d!?FA)l20o!P
z3SdF>oUsoY?Pn~&($lYl^z4WF{!9Q^5It`k21O~z$PBRb^z_+W{9H$%p?IbNEC^nP
zjueH*VMflF{$Mtj8rMmfy&E9PK_QBy{0z*r6JY7-?Q^*Jxz0j^_{;;apd`o$Bt7Rr
z#RSM%Kc>y)QscS^Ree@q+FUMiNl;?|N%2K!u$<KZ$xdHBmy4h4BGl5e4j?hmjzQ!M
z0-CP^CBm~2(-r1%sc~I~M#k9!uxhldaTR7(2S|4M@p)YQT-QOKWZ)Azy8tAHo-uBK
z3R95m4v_5h@cCT)Tz6o8xBwDE&lY!~VS4rjNOt;jkdAv$SDj;+K4Af7t#Ka|W(<5n
z=On<=)5{ld@iRR*Fuh{|X07oMYWX=2h+6iATzuRN522nomjD(;&l-=QZaP;1mYzNx
ztmzRbLxZfH02W2h9gm@D{oD$$^mO$_Ae){*lk>R)U{Ul8@&uX+&)on^Pu~vK^b`~i
zAe%l+Ta1}Qo<hBUo&zL1-F-30o@Y=WomT(}qGyojP;1UxfMlm%2Wxo&wdH&ONDw`L
zfX>GPrIhm-Ald2ZOF*`~glTC238H6@SI`pb{0xxn^zUFTuVAj-01`y6L0-dTPfRaZ
z%B9N9@CF+6=O2KTgQSrX{Ck)$e@vgS3{-_I1G(xwG`U<50E?pMk`FLx4Un`dH^Wz$
zfCESXqZ0WJP4yQdz|zyrmxC<%4o%q?3c#Z1wa71MR=m(LeZz8)NB%*B{K5i=dJq@k
z6GmoeSY6lwmYyEIf{UMv8<f8p_=GN801KjJ6-HiY*>K?nSbF;N6<qvGybjZUtiY&2
z7<r-QUzC`(5>$h%<l^T7&A)-7^r8Vs46O!X<cB8jiyk1^>Flex__+k3;e9ayB!-qv
z7zLr>c(DQ`JAFDxhcMKQ7bk$k(DDeQ7&MeFt^mnSS6|J=&m{wm@rwsQVrUtJQ2`nm
z7jJ-Mr*8-8P=ML{VfutM82N)y3F`Gr9AN3`?rXUCxs;(cUs3=IqGb?9Wl;1m@CjYA
z083B54$@-=b=jo=upn9vVYGl2EtfLD($mw|a`AInKy%2Y2CyJn7GVS*a|^O(23UIf
zcaR=SnB^P5f@pb!(H7?P6JY7-?d!Psx$L3I@zMjZAX+uT=m2xZk7?_<)VRQBOfv8Z
zT^5+O9-|szbb@;1vIa<Y`ttQ${9G>3aKG#T5<{y-7~Mem5@cS)bcGFEYFxfh*IX_D
zs|Hz)l-2{F;dr?NBs=~11}=WCK&YQDF93<5RU?d{Fxef`9X4{QaYaE((aRUWszE6g
z$^2Modbs=oBs=~2MlOD?G-x8Y!Z3ZpCX6bCF%9a0D-vMo>E)Za_?glTrgv<@s6rSs
zppLoX0a44o8Pscp`uIu$SP(sH<igCa083Aw4$_kc&E8igfCbSr2dwXSWd&Gzy80GS
z-x21I17Jb)>;daqUbz95p1vKVrvMcG417XYK1^5GhM7MKq0YF<0hXTbzLkrgs}SnR
zs|sL2^!!l-b;eZ-u=MonAU#E(cwpcYx*7l$M9&|^&}hG!0hXSgzKx5Ys~DP?uQq@M
z(ep<MOnL@bdir;eo(gEqdUXR>5IuiX!u)drEIqw_I~PA!6*K~_J^%}%=Z|V=lE3<6
z`h*>ziev{DKUX!>@@oQML9}{=u?8ls0g_hZs)gEn%>l$muSOW_p=tJ71Xy~y`A#lA
zZpM0OzPeTb7DcN@7@MI{cdcXkhMioh+>GroQx-tfgQ5v3>9<3}_}UJz^z`suAWPa|
zF1-L2MXyIXpr!h?7t=570$I`p%|O=~rYr2h%q%@n_17i9($mX#gDmNXCW-3?U{Uny
zWHQtz*FC_})7kfM@i8+_OPDUPhf5wkyG)1r@_GeC@$@|)8)iWB*!2luQS|&W6Xt*w
zVCm`VdqJA!K>dFG09X_~!_0-&PuFjNrKfKPYg!16%IhDdC+x$_F^i!I@CFB1db;~Q
zkYAP>Opn;dC6As}mO*pH4GW0k>-#{?S`H1v8v$TZ^t`eHnk;T)fTgFW?+0mG3A48W
zEQ+34)<6^SjTvC+>EFSc4nhOq#s;t`dTu!m4YeC5z|zy(4}fes4oX)Hd_p%KfJM=>
z%L$lGKc*`j0%ezjAWbKrHr*5ei=yY3lhEk9sR5Rrz8tLS4AlOc4q#FAn&k{M+1!i(
zNvm=*o`r_N%>s~sIC_S;2(zREEIs}BA&|>p9haL6z@q5Y3utB!)DXJ4W4gm(PzJaL
zjsKe$AnHL;h?L82Ky%s67hvh>&kutvxdC<REr#g{M=*2E4QL5;O9CXV%FTEa8pgK_
zKmy|E8Rh{r3Ec7kOHXG%3bNz@Oj80_6g}fSfacs=6=3P<)4`e^Lc{FV1h6Q2#(4;{
zX$4q%y81DYO%Gu<9RQ1>XPk#Hn{I%mr*DU7f_d`8^bf}|GtMJuy1C5(mY(i@9AwiY
zXu#c80E?n$phwWGa@ztdJ^lJ|P;Ps!F#W}GE_w8f1M73#&VVRRKLN7gH8hdkZUBp-
zXPnp2@VPw$EIs`@SkoJry&J%y=o#lN%r7Uv($m{df^2#VO&Yf!fJM<W&Rb{}x&32$
z!YNS3IR(}Pwf~L)SQI_uyocI!M*}Q9eK}auN2pDA9KfRJ8RsK3BixAqOHVgH4YKJQ
z%%%dcD0=Pz-2ef~2zNTBZ#WIg2!CLvEP$v7r3s{r@E0b%11vo~{0tXA7c<OZ7r=sO
zwG9(1G`8=&n1105ml_v4)Jb<4rhhn#k!_ebpegFE1Xy}{`B^T0E>38C-ZcOVqGcT>
zZkQeqkhB^XFVxDr2_U{WTBczVfkyP*3b6F_>F2okxkO=ROaKd_<ryY%n5$QSrKhW(
z=i=v*hS_rfEQpq6m=s~Iz5$k=z8$1T5vJ$E^n?o-Ifh9UT0h<6083AIzre-Mq_JUo
z#089+hDitNk9!snwbw6j@pI`xtI~S`U_rF}!lVyPTlX>`(x4dyL<BP#L%n&g0U`}5
zDUhU1p;3Kr21FWleuc>tn%eJefJlSfhosvKCVc`TjXKl9WCkjA8Tf?mJ%C7qA_Pgd
zIZQWnmh(R9EGH9a(h`)G??Y!f?}N&8B>fgpuib~va^44NK$eFVaQC6JocBSoha?Z{
zrQL_ja^45c#~?{tL0x|zI?H(<6wgTVw$Pxv51r+_k2*KQWDCt&_o1_#_ffMRlReCQ
z=q%@b)LBj@Cy;X)_=N65XF2bK)FavN3~~=h9y-f;A9bdN$r+@cflufGc$QO4>H#RB
zAnA7jMF&V8JmD!O^#FColgSN~R6z3J8BZ~(2O$3<>34?)?*s7Ur<l|O)Y(racbNI$
z*-tU42cYOe((ei4gUkm{go;T$K%EI?@&nlik_XR(ib*{Hg(s4JKTvpr<iV4oVp0!K
zXGNL(q2c!cJS!?D1+H0<^ap^#1Ee23K`JKo05nC1EDued4?ch<P{pJ`M@b-!yfOtq
z{r?cU$l)RCY$;P9)PE15iyR(;@-dS6K_ET@pU^|-B8P{l)2B>9F#XU)4i7=@LDC-r
z3J;Ke=pu)QXgNO=CJ$ZY0B$58>5qV>kB87j4iC}teiSIXfy{?4asUspBI%C-xd$W<
zUF7f(E%(Pm)8|9zB8P{d^nj#40cJil`#(a<{)tfcJ%VQcM<De``ct6s_XwK(AE9Oc
z6sZ3nL9_oOP<lYppAO<P@CiMFWdBEK**_iX{72C24{qZiY0rdak4Mn#{|GJnXMvmx
zG9H@!AAyo9l784M^&@EZe}tC(v!T)d2%7!DgVjj-vq9#8%!g+GM`+nU8=5>HL$m*5
zP;epXhh0MR7@GYbqh<eGsQHhf+5a&pJ0j`Nhx-39H2XhB%l?HR^$dJMkD=KgJerQA
zA2yiq7@GYbqh<dRX!t*dX8*^a=tR<A3iBT{`#(m@{;-+z$I$Hm7^EIae;LetX!d`M
zmi=p>$?q{V`-2u-BWM3QsQ;cov;Pyc><^pWege(@;CTZi`|Ch;DFdI-6KM8-f|mX3
zp!Pq3X8$Lk?1rSj37Wp1K(qf7wCoSwy9F{In*E=E;tNSXY@p!@H2Xh6%l;iO`=QzY
z3CO)j`a41H0htfY{!h@de>XJ!Jb`BaCurHf7bXwQ{!h`eKghYD+W#pu`#%Nw7s>vK
zp!C4NC-fAW{hy*`|4C5yJ%wifr=aYPq<=EVJdl1!_J4|&{b8dWPodc#JcEO*9h96v
z+M(J1DO&cQ0<sPy56%8hLEc5uKLzG|X!d`Kmi?!If(xV{n*E=Gq610)RB-t42|a~o
z|EFl#e;P<V1E0_{X!d`Gmi=cy-S-Td{hy&_{~1vKJ%eWdXQ1ScWIt@I<{32mKSRs@
zvq0)W_CvG(Gf;7cq#w4j;2AXgKSRs@b3pC|>4#?jXQ1#x(hu4<07@RupxOT!TK1m{
zjs9oQ?EehpA7uR?^FZc9v;Q-+>^~Qz9wZOV{?9?pcqILxRn;K-pF^|%bF}O~9~9pV
zd_vEm+5b7Hwnx&x5ELFDd1&^3j+Xrw!t_J4|8tOkko7~|_Z*u2pQB}e*xH5X(Cq&l
zlwOeZFNOO5IW+q}N6Y@ppxNU&H2XhC%l^w@`k~qXIa>B#0ZqTpq1pdAh>v9dCTQ{d
z9Gd-Kpk@C}Q2)JvX8#u;_aN!t4B|8J3B7=3{}*W4e>2ql7trkg0+im7^lyQtuNRQ)
z{{k)hZ-pk`7trhvo?1oHz6a|47trkg0xkRRhZzse{x3k$iKKr&%=ysl{{k)h!`3>y
zfM)*}pzMsSA7mcL`{3*^S})81ieJ!n7U*g+QBZzh;1gy5#VfKnBwU3VK=Fwz4zd8G
z9u$vA;-EvS7(n8n_(K+lctDsD6mQI+#p_Uu#ULRk3_dUkSpz5mGw=yBf+7l891>B&
zjGzcY76*9<q#hJA$l{QY7iI+MgNcLe7lQ<eFe4}`U=j=r3}PUkf(!!5Ba1^rf)Nz-
z$l}nDU<A>~;-C-!nFA_mk;KIrK<5E6@Ch@4;v885#0QCkidJNCXwWf%LJC<NR78N(
zgNjmQagaKYIH<@#76%m>An^{+zF}kukO3eGP*5R@gMtzy4oVxy;-IpFflrtp<U=HJ
zHBb<P#L;}L1~Qj{PZ;b!uzIkC3=C=@gFzDDM1fcksRj*d0gw)`22g3rz@P>ybQ$=B
zr9o)}NqinC5rV`krYpSR64L??%OJ^5hv@@V8c5<c8Pf$`aEW<2fjk1zkCqgmTe*a#
zK^{QTX9fyckb1PtlGZWZ0c0NdvQ&^f$bU%svO(s6#6d|6NgS>oEonJ@m|g%f4|*t$
zur$b@Nczmc;m9W}jh6K0!TbaAH<J347t<HK;1Wxk0SX6@JJ2F36&it{Eei}t`m8~D
zkbzHF1}&a!pytS+#gqAr=@(vbi5bDdNd}aHk<5e6s|(A3QZSOZmBX}`Tw>GDUE|`=
zk^!YwBsnu^nvg-u_hvh$8@%KaGdc#c1LQ`uv|$Pg1CTf<&XCP3n4a*GOH2vw7LZ?%
z<gK8&NM^$H1J}63oMb?8ha`U(q#k50S{j%QiVKi9TJf>)$Mgd)xx~0Yr|5wSNSO=M
z6&`VmP5<_iOF*dxT6oETA`Z!tW1s+M;1ibR03~ek>EW-q_`P7UAq#3k+(zUYNFL!6
zmIZ|bLL3~YARA@T$`#WO(>J{05}RHZz|FxV8!_GC2A7zWEL!lHfPx$3f{N({H@L*6
zm%Zi^;4*<046+lZF92&o%Qq&_u#sIc{Q_7XEi6nxVF@zy#I&1SV$;pufXoEt6_D7A
z=>|7J4nYeF6HwY`;1ibPn4SQVmqSZ)CZMzolGm6%0c5D!TP^`EQ&13r1U;r70BZvI
z1}S_^p$S_qWBLcMJX#_#g=R3hj_C@wxWuN5y#pBvE&k+IOb@ulB_<_@<~vhRXn-s|
zF}(pS4@$YnmO_0h_h9-4uskS*BFjU4D$g+e0Z3jRln9XIO+dMZflpXoVY<L=F0tv;
z-g60XnSp`>Bxo_+;Wn3;lsqW;B55*%X$qKL0G0>&3|StO-9Y*?rY``?qlE-?=vG+1
zVfqD-rEMR$1nSM8At4X)F`~7>zzNz_3^EK9&&ZZQles)7#E{ergLWZ-)Pq6>Sv@Fk
zfy6=OBC>i=N@n2G7M4c~S~F0=3eo_|gh(2M-b^p}$R(C!1`AqHVnLP%If#Kz7?g96
z3qCVYA_R$pLKj&*XxB1G9F)G09Bj@p?Gu;SbiKP=99jyX5J#2+8_p-J0E!u8vs|Vp
zeBu(5GKZ!`1yIZ&%L`1O@QF*z${dt-L3V;-21y>e2uoN26dB0&K{Khsgy|3Na*0h>
z`^+W4WezS4_=FW!Oc%JvB_^c+@;I_4P>g{rIWXPf9+#Mq0x0B><#$Zq@EKHQ+~eYq
zQUHZAvLq-rK$<^HUjQ~76w1i*poGrAC#=XZ{lY!a{`fCk0#;yOg9JgrgXArKXc|%k
z#Wj*47N8&pskfMJaGy&|N)Z&C$nv0I2gwIaPq@z|Hl6J&mjIUqG<7RxOrHSO1PViB
zO`uW_q^V*00kAx%07I4sg)K;a#`F(hc~CGR%R>{k;)dx854gmpe*;?zO}&aIrU!ro
z)xL2FazYcR;)Cf854gmH6hT3PY|xGA4d1xLrtf>e#o-0ohliXREug7U2`x49LW4>P
z6f{VNS%L}<20mdWjp+gpxx}QDKtY2n4+?USyu);dhoJcQ&LzNQ362mxVWo)a1z=5}
zph4CIO@>Mp(-(j=UHi@@z+{;*?FX0G^m`AvIHZ)&!p0I5mLOYpOnby7R<8sK0c7)_
zp`--Lnn>{vy&_jw2`!OXf>I>NI8b09s|W3t1&O02I!jOpGw=y3g93w*fg8T-M(x1#
zfS+7q^`O&KK-Hr%C^V1^RD;H;GFk$(0);ZjKu|y-s|TGV0}@9|kXE2j2Z@6M4p}|8
zmBptmtPINVNFibcO{~hG42+~f^}=+AUmypAVgzI$C@&++gAz4J92DTl=0Ov$GFmCE
z3OWq~q#iB8tY97omBvWstALJUVBljGRz5KO!Xa)kA!W2EQ>mDq@S97_%L*Dr%Alw~
zHUP8}m4QzfY%j6{p;4rQmabJ;rhoX&CC<n(UEvRx7?(0+zqGK5#dLv-++y`AXaTAW
zN?9P|(ZbUj6d@pSwD44dhNB87+>o4O4HHKTUj@*4D<E?q;X7USFBhkgH8gNl&;nN;
zbaV|!F<RhSPncftmrKk@9&|qfNFEf($d*I1g9<1Nk-|={Vfux?Tw+|-Fi*ai{^2Q?
zSd<DVjFI(&;)H=uSQV1o;i+8~<PMNHD2$QRgSK>oQokxFl_T5dGyT9nE-@<`Xlhpl
zB}!y@Na_^^Z}vqp?<gp6K=ven-8Vh#KbHWP4JbxHf(;PCZD2uY$f+&>3reY?RYf+S
z5Cv&E0G6NX#x1~Q0}3sW*aNVblq#qYK(gHi>U%W?h`buQZ$Y8Oz$dJx0G6L_#>g$e
zWefG9ngdu+N)42*kPNj2Wpt1xsF#j`H9@_k2Jw;<xU@jl1ofR7)OTuVzO#k;PVEHL
zQjp7$^+SEC28m}WHIU1Z<w3<F1D~)u2Ux$5I>-}9@^%c<7cg^+P5<|li(~pVW^Ms4
zJ5c!s(%}KtG2M&>BnZtL>KPEhX<$KU22k$+3rc}+&P6sGlrcait$@md+=?s@O>62W
zrY~US76&&_kfjBtH?VSxS((GU0HTrPVf`C*P_cj{ZU;^J>OVl8A+hPtSh)p)?4YHq
z1}MEFDTWyizNryO9A>x%dU%0S5(A&Gh6dR1B=7~5Nc!wRi2@`KN(@NiaC<-ji6joU
z2b6D+#O<N6pb-JK$4LVe)=2Vppuz}b52&z05{KIZl1CD^wwT7wEyiUJb6yA7SS<}u
z8IGjP4#Wo;3rcoK;^q&gC$MviDZ!l!Dt?gU?V(Yvu>)+bkOn9YkmT(yOh3TREhc3S
zO5PyzK}|p;d25U5AHeQ|$-jV_0}5^=b@mL?6*xd?0;&#ll@@Z-2j)Iav}lGdiV)V6
zm|noaEv^X)U1VdSsRMjt5R$n0hUpC)NZ!^&i&Y0uxxv6Etmy$Z))5rCNZRc|kp_|m
z6#_`&uu#wh$s>tdTTB<=<QC&{03{NTz6!9hnxMc%Qf3d0B=8jqNaE%jrWbG`yA~}H
z9YARUWb6vCv5ufHMAB{t^9))xg}W9lPOUAbae*8Q&BdBGz@}=V<x*J2(?rXq<{PFb
za3MPut>AJ1r4R-_VJ(j74&2=0jv&V&I~EkwAZfJx33IF#S`32{7|6Ab;L#60VJ!==
zv6`TeMm822L|SOs(R{=70B$7LYN5rbBQybNWq^%!1Q~;DEHuWnK&3sBINY^pF>Gxy
z{Q)<(7?&d`fq;BD18l4&D5#ONJAh&kB#o9Etu3ZI@NkPw-`B*=!K8Hntk)CNP(acP
zb|OeGD4dbRVL3<(t)g)Rr3#Sx7hvNA(K4o;z%*V^z69CAz$dH?3T7;(YNO>#M^I`3
zsh60pz{@Q@J)M`EKL}O`X@lAtNQRih3<m`^k~qxC+Gx2Gx?M$B+XHMkc)vW7HoFVc
zKk#ykaly4GOn>l&TZ~D&0HPc%uIwjF58y*e0^sYMkc@KzmBb*g%z$V|i!1vB(>I`K
z2gMz-c4!jOJ^<DZy1X5^V1w?{5!S{LUD`LMFQ@`J{smY&di0nxOfTT)7E5x31|hhG
zjbuA)1Xc$ve#}6*mVr-L2QB+qK$~wmXxY#4#PkdN++tF&k!l^ZD73biCcrJm<phm(
z9S?9ZKRr!=TObK^(gCQ6se_)kU~UFw25fEy1w1x!v`lERWBLIBZZR)drqe;obg&U#
z@X69h=2?Ks2v8WH6{lt|rYi^{B?uj~T<8o+jv#%II&pfNAh!S)JfKg2hl{6g6XX^I
zFFOS(1ceHc#h_9^kXww)8I)8&@;|0O5at%2E-u8)F9jRt2A`9Pq{*yfx`Pmst8~#~
z$QhJz8Tf>CHNb{}3oaDxpq$GmtP65HHgQm3Ac<RBOurz+Eym>nDsMr?Mu3e4-w=$X
z%mx~Vy6ABQ$|WFeXmJHsUjaJy2QhYSwqSaKFt?ZyTppATk?b*pnFq>ENaEHO(<can
zoC&QqbXS0#sR;^MBxN?x<gN=U?2yFG7EJ#j%q=Dbmj`(VRbD{^IndDxPZyZ8UVyDd
z&z)vFrZ<Rii&>e0tYzR61|8CmocUoTlpb2{bO9w8ka~&f38LKM)1QlQ^BchpLCbn@
zakSFYY{zr~Q6#tPp~bK(DC>hP2>@Fnh?YCeE=(^F<rb5I8;=&l))vzjh;oZ@xq@m`
zkTDHlW2Rph<>u#tO$_Nxm~P<BEjFD^j9UQS#?%7^8d4y;g3<!WgbiR51VMp?ByIL$
zdV(0Ym=P>v=%K|Cta#BwD?!aJOrIcz?0-<8BAM$7%GMxjKY*=uL~EzOtOMPFha6|H
zl2aco&de@MR}klhobtiIC#;W_J*_RK2Z)1$3z`!34W@sP;1-|WE)L4`FhTSv`Z0Zj
zIJa03%!~S<RF3Qgkefl4p~W36UFoBhtZtyB15#fAwp<Vt@JPm)y_oJG0SalDbI>xO
z8>s96X-CV1ph`#r)Cm9;F(7%g2zIlWzCZ#gCiKyAryD3~f%F}KI14R;%?hSTf=WwJ
zGZm!j2DpS3(g(Q`$@Q)~rYA@uyB-ucNb)w&_y%PY<OnrCF@1t0w-}S@i|GfD?J-aQ
z+v8*a(tu<REHVs0p@Ags3bK!ZPuKu05^YvYSCHZsGlI2p4A3GGHbH5C7FpI7(;K9?
z#kkx+`2l2Z#WZPdaY6LTtzh~CkSb?r=omnzE2oP|bHmPz6*d6*9NDEiraMT3Tm+3T
z1CR|!^01_D05TI<{KfPFX>Ktucu1n<IJghdN=dj6(PGT`!1N2!+~U*EU*lq*&L+bx
zAO#CsL(I%&Aj2&t3A5P{Eq9qukC)*V2Swoo8Ki_}h!#cepxTImPuLLBJaIBaiwd~)
zX!*$%6hI(-Xi)@eDaeA#NKin4<U!`623P=C9^`S5JX+*|qF9z&jLQR*WI*yWAkC(2
zvdCe97JKFl(;vuki@}>!h9JiwSqgV7M(ly2n@<?M1qzF8Ly#ws%mH;a<Uo!C<#v$c
zpj~%EP(uSrojJqw1#(EK34CfGvOFlR82E&Z(BrgY`UN>|aqvN7AZd^?ByFxcrpY78
zf=VtVS+fh%4djtx+6XPCJwSy$$W)K%0rK49=v@Sx71JlkgSs`)JPSVB6Ulg30cr#)
znUKUip%G<N0XBB}cX@7pBUqv|LMtwz#{&o(fdUZ85NnI+3JTm}T+j^-!bU5=hGDc>
zK=BUp0$Ti9XiRTVK=wLXap?&veL?zefQ_C0T!EWk${glVP)bB~i-01?EuhF};1f1x
z0H;7LW3<SE`NbI2Xh79p0M-vR-xxA{re%y)Xj*{c4`e=CJb{{-iriw;<)pYdn2ZC!
zmJ1o9Wj~vY=>|%m&Ic%afeb;56>E#>2};~zTwc(oh;akd9JC1WikN-?qz)Fl#xtfn
zL~@HU8AHY~r>iM*3vhWsgU=W;Fgv{sEC|X=Ae$k1z{wab55V$}F(??2g2xiXXW$bC
zoiC1D=YV<u${-g*lc|XW*u`2Vpw>2$eweu?px{Fiw-T7{pn{YJOwfYW8x&0-d!Yp#
zcohedelL*wLGoxJZ3W_k#L)^mP&BD<i*b2F)4vI1p_PycT7hQeFx^0vTTBXW4rbC%
zPz9L-jY*RgP=BMf2;kv{miDb8rXNs6_BUGE_l8EE$qlf%LMEW_Me?^z$8-fXZZRou
zP{9xKCny|{<Uy@8HIVzD*};@!`T{j>aZONgA}ND4Z^6q;ki@+krf*O~a-Jz#w1H;`
z8Tf=vEx^W37gy)zmx3DxO1(&id3~7fppI-9C~lDCeLz_ZWLO5ou;uEYvIvyqL4s&a
zJ8w_`gT&Dy3>2~I++tilpa=)a&j1@H2nt6eySx>q8)zWKt0~AhBzaH{)BqU+if@oH
zC&0!ef`SoAnH4A;LDFaq1Xyx0MT;(2Mg=z@kj(LcW=GQ>(?4i&i%(bA<mL~8)q7@W
zMHj4R4qhRHWC&b6TEznkDl<s?PYAqn21%dGhv^$Mxy7WsK%QgZ69x}2Ajw-xOn;yW
z%G;o{1(FW{w<D*EX>ki6G@%z^64M>DxW%lzKmiNVgcg6WkT64wKOdMSGr%E%9&a`)
zreDwk)y*(tK{S$EeL+nEkacMJ%-Uj_Hn$j;FElloU4WR57HysZ(-XA0#gfcm%Frqo
zD^T(WnGSL!lC7|Iq8X@kL=uN}t-#GNByrDx=?Aot`WNP)WP~IS8UqG97gQQB@Clnk
zDj^|rP!2&-2WqbAaEnQKf&vkw4pf>U$(u_|576NjV={A?-T+but2DtIPm$DFL`>hH
zgVZfE2bE?>@^JHUL?U<*4w8C5P^k}c&jfI(HC;@XTR;jP7-(71vthb}E+|St$rhvu
zElR=35hM=EBS@B*|Cqi&ms`xs0#uBE<Uz?7Sst1c%+VtmWIjkeM&6u$L6=*M%MTj)
z=8#!AAy7?(T-DihOgGR&Y9oVN63F(Rn4X}=Ev^XG$0uw73JWA@KTz6X;1jkm0Edm1
z1xOu|JS=yE2lJ4`tu&?|(1Z0YzUgrbO#he6%^_p~D(8@tf!bpF++tk*(4=Ysso0Dx
zKuH8ioeL-_ft&&IEs{8_qOyQ=yM(~wqe${*7p8B}=N1Q_zzfn23QQzvP&+`MTa42m
zl!8F=)8*fAi5pp<#SPqcw77wlrxp*uMT`)5fe@1MpfMZ+gzc7~C`OV74dEDoJP%4L
z41B_tkXDGMC0ZQ7thWRO5|Vze>HiJ5#lg#Ur<)ma3k1QME0$<g8Eg#65>)LX82~HQ
zEJ0}!NgTS>R@gEF9O*)qpx{B0H-9kwfFZXyCnzm|+}$ueAq2FP){t9+3Dn&-0u>gZ
zpaw~Tn$bvlK~=mFw-{FdC?-Mj2f%hDf!7rwse`rZEz#lvR(M&W#Rc3iX!#@nRJ4NZ
z`2e<Ox|lJyKoD%06TJ2a$x_%5wiQ|(1~VKS;YjKOKqW2%pRknz*l;0miHjs}b7J}e
zV^BW_S~7xH+abxr%|$B-1EGbB6{JNzoy~+>Kq>$<P7bmREf0a3=O)}@R^TiMl1Gaz
zxFu-CVIU}#fYd|gtfx;i;T8lRZw(Ry*@fg#^9|Dvfb4*!Fe{8$1*L61VJlFqBk2nS
z<ztX}kXW9sW{Mb=w?d0qD~;&^rbrDg@P>Y5v!F3)1u5w?twB~I$$NoPF$15lHCp7E
zO}}r-Ee<JvtU&>bq{pmax_}u{!^#>hi<vV_cQE4?gXb)8SR(0%rAF`?CnRyOI*?mH
zVT>dm2u(27kmUzL;I&Rj@@56oFPL$Qae)&ONPhviWbv{Fg(H$W&^5!LIUQ?IE<zHA
z+Y4$4B8dlqaz4ns1(1YljTV2P!CG@fci$Qm)JWRR3Z@@02emX{&IhGuBzaiAu||th
zSnXhqmRZ3q43KlsGOLxqbOj4g;Q@+TkUXgNL9)l}!t?;JJji|qK4I|cDI|H&fQ|*X
z7*`M|`GVvnrcbcs76+fcholTvx7(n_b`U63K-xgH4U&4$kPp~eQ0fNBqh(jn`T|RC
zF|J@x!w4iF0k&2EEu#ia&$r|jw+aRo?;uq;@~I74J`IM(olOVW)alnPxdmXOHsD2C
zNG>%im}bQ-76eN^;6fBx8XA8#Adeu4`-0*J<Rr9shsBf40dO)DvO$YqbBXB_thmLb
z-~opgpXLnH4_F~(X&bco3<f1@20me1hUo@2ppJw!QiseI6q-nmbp0_sz#7z&0fjzD
z6I$%qbWCpm$y<TK6(kR;o{;nhPnf>Jnp=#?YQgje)`(i!7F28?DFa2O4YwFm@Q>*l
zHr#qru-exa<W?kg76sD_Y(UO|hN&%DmNR=XeSr<Pn4~|*86fANH6+capSR%_H-bx}
zMM(&#6a#6)h>~fxNCku~biUKfmRmpyRw~${MFXgN2+|Y+>h*xk{4srlEw?!OA|F_`
zumf3*<Wo@Yw*?iFpa5s!6ShMyL|;t*V9PBg2}?zGAazLk&8N%Taf=(lx+!*`06~@p
z83!^J6t76)J{P73*l~+<g5n1x4e7^e*`ehsxT`^)L(*=uV)_O<qz1PgTDF3vZ9BAh
zHHSF|t!OnrG5vuZVuHyIRKy@z2TC^f++s{2AEs;AbL%rYOfRqp&1`~90l6M6=U5d?
zUtrHI<`oJp>Fm&=%nFoRK>E;f46G?<hu(L)FwFrequHZHVJNg@vxhV>r>8l9x;Rj`
z*`vjm*^B8D9Js~mVIgae7GXi47+~NNwnvLFSjgF<ReG=_4qhaO6l9^Gqzy6$6vIg3
z(3qM2)qz`x6XZ6KnhbCWG+oUR)|CJ+jYH8jJ-`tuXV^o!1Wfh|rhiE0789}u1p$(J
zP}jf_v_dnPo5RZ<<P;Q1P`vO7+k=|sNaC>i)gDv<A&G~9$|{gEAp>92#hkbWj9|5&
zJ*b30QVb7Qw77LKnC{@j4LL1~fln9|y2w2_D~;&|PDlj~c##~Ev0)0+7dU|?;Gog!
z0IFw@<b9xSbN~e@lDIj;^b1bhVqCEHqk{!FsGS_pqA>vEXOO!<^%0VOSewuRBO0e0
zID>l1ppp%w4=sbj^?}N3B=f8#rYATfH3Gm(bdcoDc1)k(jFi?L&<fr#P*wxk2WjgF
zI-o_o&Gh%q+~V*ioda6b!&0RKj;MD41p|_E!a)TA$U11$hq-{F9u(yuK@g3kI1r>6
zB#svK<_yytT)4%g!a&6U1D`N>IUSNdYm4a{T)4%!!l8b1gydr_^p;IHOg~y2yGBeG
za7Fa;9no@h1T<+lLdL7L&=*|7jYW%MvmMh5T#=%}5iN=%z-gFI*b&mL7ji@^Yt3Fv
zzu?L(CKUoIn?c@2i%N5bX>QzNR`5^(6^baK0?DP0XfYfCN>L!=AS;BD9MPgO0^|&k
zJSaAh%yR{K4<rr>Wh8M}u6G1AlaRzCpefrC+P6IB1}asdmOFvmhNRfGWBLa-&@2ix
zOu(z?kmNxN7~HwVjBG(s$G|7-gqD5512-UXkUWw;P>0%`TZ}2<!Sn`qZn5ch9^9Pu
z=vfrzCXfe_^xA>~4rC^%L`M>b6$Rk6cSz!}Eb9a^4@uk>R8)Y>0mUOT1H<%p?%W(w
za2JDu8%Z^&s`TI%<B9~OLXfTn(+xbh#Wg{WK~e@QKAk|Jj3jP*VS0fFw^%*gk!Z0C
zcO+Wu+JX`%$U3yxg*y{1c44s&UQ~x<e<Uc8g7)D!K{}%K&S)_m2?~7%K4E9HN*Gq|
zJA-l?l7SJRx*Vh))bc<Qht`9_&S)tCt{##S5L>FOEv6fIf&vy)>VOP{WasJAJh=s=
zB0<3m5=2V_W-q26@Z=Vgg1Z_NOen6H{sBcE8pp8PlR!gwUfg0_QP9|QhEAfld2tIQ
z!7T+@j$|l2DA3{-be|}wU+aukD8qvSEv};&ra$mPDuA5P;x-Ce7dk(H^n0B_A%o-&
zTaD=s-k`b$76l+0N!}u2dVx2R`7UTt8U;!-41B^akn(u?HE(VKDOhfBfy57d50Lqf
zX+EF=02BcrJ)i(XvI`V@KHOql(V*l3l7|ldr1@|QOuuK!%^~E1mQ6toH6Ly<u%wg=
zTAqXjnM=j=0CR3JBNvQZ2uikm!Y-g7LUKklG%veA;?c+jt<Z&~J{R;T1qD6G*&C)`
zFy$7LazTqiSaxzbF#Uirw-}Sl1#pxYxqyNY$$nTm1TVrv5{G4Lmlt6FXo1f|M3RS_
zj~0c|C#E;}a_ceKW=!AUixkzaXt~NFV)_GLZgJ4%V4xJ}iZ%ui!!TXIk6UcI-Wx8C
zB=Dj;B)ehB+!d7bk;Gwc23IUd;?NuQgk8}h6y^uljOhzZxy6`Vq4lOKTHHl3Okdy!
zY6?Qb+!a(LA(`)HG5rFHJX#z^M@;iaO4Y7txiAKllo<GgU7@3PY5v>-)8ov!Iiy@c
z79v>$%g3%az>y;43Tl5K$(u7wpWx3eW(D^!TDu4CVYEn#0VN&=K4CZT!3$zeZlFAY
zWNs8Fph5CzMJ6o3-OwV}&0_iof246dH}u#A)fFJ~F!CfMlemE@Z6y0+LBb&QkUZ+-
z2FlY&^3fnZNFFVMVc`W{a)+XRdO!ful$IM>AqxvXH?)KR3qLosOdJc%#BPvGtmTH5
z0ALB$4J{MLG)&(R0O~`4;u++AP&^>HGX`WoNF1#kjuDvtAOI;vxq<W}>5By=P>?>z
z0*>i!f!qQ{u>A;bXps-=Xn=0OM(zNaZ<t;X$SuYN)8{S#?%8>{qa^}Z!@wOa5x@e=
z9j#oB1(iSye8TP)(*uII#iz3efmZB5W7r)Ol1M%=mzZu4gcL&VpqNIIhsCfvTFisS
zV1l^CxZ*%54`f*d*s@4afFfy!mD=uT5egRv1td20pk4^FxWx1iD9%KSXt*=cvOcI4
z8VvFtsG<Zp6D^`)8O$A&VUX-IdoevA7%2g`gTfR^J`P%>xW52<8-1m=Im7e~!Jxt!
z8tR}xM~Qld=?{Xr#e%?vJ_Dby2U>Xm^Nt5vQh-Id2U=2y1C>)Cb0E{2LLO-O-i2X$
zK?ta>21Nr%9mqjQ-Z9@WeL)DfIQYP6kThB%uvjqtLI}5>RXixAf#gBi8EN;f0_e_R
zkT_cG$3sKO13D9(7RoK)1zYIgftH71QQ?6Wwct5Wkl|=i3tFom$}Pqj5AzdvvUB>e
zP;LPu*t!P~v}l9d0SYf9|644W{vi}mS$d!q>+uJsD}-_DF<HEr9uUSYZV2_3CtB>l
z=E^-m!GvVG_lD^WVcd{|h@8M{{*WZ$nm|<mk~nNC#uF_rKy$od++tkupi+i`PuQ~n
z-0rCN1jPxGepq({ym|mh9JaN`6BKMn;;^kco@hA|7G$1iITEfO5{=66W+5z%dZNW+
zLdNuhaA=F8-V;3^!h#edAA)iapRgxd0SrqNo@fyaD_1<xA{g##P&vTN;0$*y+#s|l
zhx-B)%t*nM07``ne8OG=;9#F_7QrpR83+n9kl=KCcW!YlFHo6?q$dtk+k&Lga;3$K
z=@TNj#ir*uadT*aR~ur}gqAKW8KxhI;1)B2ZJ6{zE10c7Aq%n$6rxDxf%-L(++tjb
zpa2EQL-S-?B)0$;+ye`yJGgU;X@T<(l4iIM(CSZ1iRlj_L7j9nkPpz}4z39;?ko+a
z3q)~?1;O?}d!fY@+y^+K#0xD-5<#U71D~+B!1M`G+~N{wxf13#Z*b%Yd1FM*^b1kk
zVp5hMZ6H%Xk%i>-n1*T5++s#B&w!WuAxT3o;1c#m%cgb#(+#3Qvoi;#Cq#3LNx{;S
zH(EALVwk=nnp+PZ1KyAr5CSh7L$W8%VY)&Lx0n%lEd<D!plC*tj|F8zkT^ypOb>|R
z7W1+MB@>W5T84pb5ckFr3EmiyFnvP|w-{4W!}Jp|+<Ne&?*k6q>0+_m0`Rc%K}+v2
zxBH+4ajd{}hghUA_CZhbP`CS_hjGF5f>_W*4k#=b_=J5hll+2MZZW20hUph#x%HR=
zCrpdu7Mt$p&do91ERI`13Kpq8=*ik+dICsgpEEaykPl{vPKW~~7?`UtLUj58kUT6I
zgV)p{#T00HSsb^RRWdZ$`hxo4NR_E#4k(B63Hze83BV_SFz^ZcDoihk=N3obgAS`l
ze9;0uMPT}dc%<#Cz8=#jcyNm``9^?^nJ%8d%@10l=8(WGW(7UeT-X;amBLc5FUZYE
zeu3WdE$lmEdIBgD`J$EiDWFOQ<mLllc_!Zr(*@*t#F%^^fGrn<l*aJF*xX}!LL#Ui
z2oeWrL(AzY3#Ly1$;0X%KTyyiIR`ZMlgKSLo$n(TN0c8ZLnBE-4`dexFONeKht&Xn
zXtlOAD77*03HzZH80HMq6_U8cq~PYErDlr-(*u$~`$s|12-1(1nqgC3ejxLa+yPs-
z>jz3#NaCPH07=|pTq&S*1~L!QiI(z1iwoG69ls9ne20)9T7{jmV7fpuw>WG`j2~K5
zna`N+0Fs8e8ZAqtESO%9%q?aF4=uD@0jqfZ&<cCA3)2@QbBl4oTC{!-AY1sZC36c(
zfb0PI2(64UpZ-6YTO7W@&mZI@qyR|;Wpf5TVSj<?8&W`<!Bar9?4V&jkRV#iIJIH=
zgcPKPygyoOrh$?WNS^~Zg--vL!Y#m+2FgPq!G!4!&D>(s!%{(lp!fm_Hh@)1`GYEb
zBxj|8@(f6R1z3}mKgf5;@}T$t$)5l_TN5pyV25)0gQ6K(TgP;VG^D1xKPYb?$y-}Y
zFG%AS<4S`Tf&mO*=S{zs#x1~<_G4N)w;q#8!gPalZZSzGP(U;A34<?CL^307dVD&!
zcv2duR{)YmOR=!*761wXWNpyg9e|c%VQC})6emdPZ91kONaq%lf;$5gVo3678>W9q
zN3_DhOX`rM(<P=WWPoNkL1)l}WpE2{rGugX<lr5UlViX=ZDbwL##+D)u)Gj>eH*g;
zh3NvBFcaM}K~u4T+#F1SkmG!$0@2b+2B<`4;1dpXm|hS7+J>6NEx?rlO)G&3U_mMH
zy&Fh&WPkz<q^V(gLl(EVASld`qyr~RpOD23t(1;sAyrC&Xc^RE$Mg?b++tE0&{zsY
zOJ7zCrYmG4rSw3w1eO5`ZIDAAKpcXWjxrdgH)JClk5=|(XiVRb%`IjHvpxuvagaO$
zt0ICxfrKQU0ZPvde8NGHHHFi~a<~Pg(xI)DAoLLSnC_5+<cA=%vNaP_rh^QFj8jct
zmIFG)2^6Ft!31#Q)d_ra36cvkK?OTV9uxpb;;=OdK_LA|;-G=+Ty8P0OlUv{K_*^>
zz^j6g)R`4bpODKfmgNZZ3|fT1dQL&0oQb5*0;CS)9<(A99)f5QmkBL6f*^zb)7A1o
zGqTV^FbI^Tkqn2Gvq5Ol7cgUbKpv=S1sTr3Cmf6xeP#vI8}dN2+t3gW2GL07g4Ym(
z^r4ln)&<iyfXs!J|G{W63hJ)rfdUhn41ytZI9}jYU`Xb}x~svU?1C%~N&z5y(aI87
zb0@fB`UE-9@}`FA0R`ORj-V0&n|4qfA&J9!*THC+%-UjF0k;@e7R*-2h_O>JT2#SZ
z3kppnW8tnsYfYOuOrKD|EjE3g95)AOB^LMyVDOSCESf{mf*!USF$6v6EvA0}I~JOr
zLM*@~(DblEZUL@rP&_d335P_01*O1irI0Mk29@z3`3kW7^k-mA&_opiY0e3SpoLEM
zgy{}N+<Hve4buyXxW$ZM2T+Hg1p}-C2mwVplBJ*(;zitIT+qv7ghL<`%|an)i8XD*
zv|`ZG7f@PY;1dqz0JmtELM5g*OyL$23PlTu>;uyiijfv4g@XK!WNkXf^a;h>Vv;at
zg@R%iN#1Mv{$g%%Dez)ikaeJ-L6QblOJL(cNf0EDR^3@SOjjs@4)074D?!?p6N=VE
zvzD0NPy*QzvY~`qObT{DHu$b2BpX4QrUVpDpfVa{;|@rj?pDezz?B27)IuS}L47Dl
z5t3$GP>BH21fr3|b3nxqNE|J&VWAR+*35zxM`36sMGh#k8Tf?5K*^MmVY=!YE<vF%
zv?#Ilm{!IuCIz!I3@t`17ECuNLn`OP&|)MPREdD>fR^*q%0Tmw&~iKsE&Ov1Og~Tt
zS}+dE;~-6-RE*?txJS^+|6FMK9tK%3E)<4Vb{w5CU7?&?oY7%=KsjhE7aHziAR5K^
z=?&%FVqCeP$Oc&tnFtgLLreT-1=Aluj1#Ef7Uu-T4oLM6aN5=iM+;?GNfHhUWhC1`
zBefM^M_s5ua#T2|6@sM9+G1KI$W72V4~K@MStVk<dN^7zf)2*01eH-*+#FirXkiE|
z-ow$t5VX*`5>%~#5+MVha5!3B8oFcp0gyagKd3H4ap&|8Acy8b<05<mcvvke98{(u
zsmle$4aj_uhmgc!1#vi90S!yk-~~oV>Oq~UDsC~ZJW$C7G7mC=BNPsb4kUHC6Q)0?
z0?iwM!hwNL7+ew|$-|n&5opmCaALYZHE6aNl$k*K(4x=m!gL3aJj{I&pfrta?uF?E
z)rcl=1X{G_J(#|rnp=;_N@MzkYFLrOR>Lg->cJb-aEn>xfjk1T7?c{342ETb2($>w
z2jx7F`We%zxy7eXui@s0=h_HRAR(Dy(J}o%4YycQ9ym1kgd@-*3AP0?0xgnqK{)|r
z2U;Y--3lsEkn8~sRn~HgaY66+5{`HQavS;_Oa6lC4Yk~2O0WgZk)R+)G6l9XEfP|D
zXhot$1$Y-I1D|jtS`>hm^VETC2i4&qd57r>YPrQVK`9i;c-Yhpczz#AJa@wMf;v!+
zfTkSuBaSROrZ1=itzQ5+7i2t09g==n%Onylr-8QCf}B+VN)jM_6Tr@5oH5-Ym0L_G
z5>)sh8Dmy3-Jl+nfT0;P60OvNEn<yCi$j}^=?V4RVp7nH;Dsa6;tVtc4weU1k|1Y*
z;ugu?0*~nj>XAzJNRa)=@}Tqw()VNfhemF3K~N|lN#`7xuF$|O&Iwf&B`|%07N`T>
z09uI#N+t|^!r+?$k@V!=nBLI9EhYs^PElx;4QR1p1GgAg0W@nwd4R2+{=9*kU#Sq}
z0Fa@eG>v2^tYC>s0GH1~QE1U*`eM36Ba%PCD|3+aL+_sxj+z0nY<VL$Km72cD71`~
zJ7M~TMo?sdECD$NEmB~mO%z(ja$%U(1ZuN`;s~S-6hKIBfaQ7csvacq!U@w2nn2y&
zMs7~V58(7OJ*|mbz^D)!snMW7LDm3DTnv1|(P*U|XbP^0Ta2p^npL79eZ2Z;v@BHs
zD)mA7(PAb88qLw5G>v2*tj87&Dx8qSVIBgn=|K`N0%dKG`JhOIHc7mq(dxG%kfT6~
zK+QNL&2U3OfsZ6!1Pctv@efSV9n%wXxW$s9K~)iwI=Cl5o<tIddjb@ANaAq&&=Nrr
zD8qx?2U+DQ6pa?ypsDO;ZZR)-V4}q~tn`gW%aO41F&Y#}Nba!wF+Bh@xCOc%r9K+1
zQ3%`I0KQ29NfWGeia|>WnV^to;1dQf>_AcvD`aEP+J~?~&=^ppAkW9aLNf*}slY-l
z1}&)+fyy<I#gKmGbhj4J>3N`_0SQKcqilLv3%7t2EPP_n;@`z!`hpg2F)rBN+n5S)
zj-P%FqzN7lXpwGyVp=P=SQ6aZXmJepHpq2I!2$O+S_X&v8ZFL2t1Mc%#kioiRSL&I
z7G*odpv5JuogIT#+QJHs7*NrN?2Zf54}jdC15(exCk$TygCq~jE3s(N46`Q|)ILX2
z4{OfEf-)kKIB2e;m0OId_`-CKHf}w5%OVynV_SgkF#}ba(1?o#<vk>GauudGv~i0`
z!QF+Hw{s3m-_XV_4!&d?<Q=rE4C+s{af@-4fKnSszGJ#T8@IS1dZc<xcWCDpQ-YQK
z;5juUS6IQcuK=eIp;)w7G}|$KK|5%!4-^U@Ye3~Pl75?x=@;5zV|{ELphKBFKqW1o
za4aYukW|JwOgHENHSa+tfJ{Qmo&hJOCv<=+3{bjb;1iBRiziq(#i7NM)q?30I*@9u
zIFOH!?1kQXDja7q{Xqw}`1Io)-26eXL=*>dERtflC1{Za%c^mpG66|_DJV;W9Gd|)
zTo5gi%sQqkbaIPHL2srNjzep~niWhB=mhtC8aknU=uS{~1vI1*w*ed@)1P&63o<%P
z7w7`bzd*w-4y`<d^{nF1!W>q##i8ewg6Rca++y(ZBOVlGNZzvPn7*J3lxm=9Hy$m_
zVTWSGOF-OstqW8bfx?D?PdFYFCP;>PZJ5>#IXupw8x+5w6b4d;7R0bMH1Qx~khFu!
zi*9Z)u2N9`0O^Cw6-__Z4QfAu0vsd=s&$bxSw&3$&<*WO2*ra^6q2O1#B_xoP|gHt
z0%=Ao(JXdM4*<!-N``o}63n7wdP5J$MKH@RfI~qm9<2m3gM}ViteCx+{-B3jTmmMI
zmJ!UR^Y?O#!%w$JK+6X?2c|ppf;P=TU7rBTnMl41fVv8N88nhO%ryyU`6K7R^nzZb
z$(RJR+9-r$`hs3=F(X)AlYo|GU_*HcXz>Z!vjj31HV2phia#Xx1S?GI0~H6Lq{qM~
zoB(n*lC<N3=>{nBXjunTT!7?Z)lvdlQw6jIsSl}GNI+|vl!2;Dki7?{C-icQPygNr
zYRrNh0TKj74U%K5BBm?!!;(`1dUWoX9?%a;PSAv%fEJ%#8>Tn(bBiUx#^MsuA`~{f
zorspnU`2K!S_H$@qqRRQc1+*U56WPmiim+vI1w!(tzhCH8p(5@K^&Opri)Dg72(i0
zNkoe>#|6_JCV+||m^>)BkW2#4Re@{<HT#gn;XXl&L#v4C1rwmbI(-?)W>{k)5iQG_
z?U;UH0#X<!qGegH4bvtf)l!LQIo9mObOVq)Jm}Ek7t}+X2s*YAny0`Qr6YL&Hq?`d
z7WHs(wDPsAVfqA+eXgLgjDb%$2^3&R=7A3Bnh5o{P!f9l?wI~zB4~OU<VcWa4RG<o
zlw<*3OFKPm64G#N5?XEq4aZIbB?4$-Oai$8$!1spC!s~H*^cQOCLx`!l!O+wunI5<
zEo#d_5dm@}bigqQt^ILy#&m(npll9PhZeC;AErBi<d1@~FUTB_Iwbdkrh+GPi*Z(h
zk`727ydqL72^2O+%HZ13Dn`&MPmuAj^~gzR5m-54+7!glR1#XwtvoQ@U<$V$)6p5z
z6Q+QQNRX`ze8S0SInPdD`UH@CCCKw2d9)hP+G6^FDcoXQRiI=5l7}?xg_6;VOwj1;
zRM0XUm^!pbvNM<-0FsB>gAqy78>WKn0p)OzJ&;J5zHKVEfD|l<l0hMj6m*sb(;rL)
zExrRe2BZnCpoCk788ZUYxWzcDpfQsSjv1k3P#7T@e{{z5f@z>dULe1Kj7O^^VT-kr
zF=A%=f@w(QcQRVsRDrTM1D|jTWc$H%w&_TIOhL<1b`z!>Oy?F;f)!9HXmucLIeLl#
zII9VzfC3Q76QFY)rgMuKRe_3VkforoLXwA7LMb3mB8h|g3e&m8xT>KMngVURsLkLO
zkc4$&!3&CzG+9jdpTR9|1e=0QL5nX~Jq}*0gQU$VV0yz0ZZY_(yOa&!spI+-P(UH6
zgB8XpptdBEIBW_x1uX($3(8W^vld7lC@jz-6z*<Fgie>8$;~MRKIH<W7_Fdm3YhLN
z6LcB|$dL?u!l~$WBeWPx1qD2kV`0TnDq2KWgK`AO9LS<^tyHu+5S9s2(IVKaWBP@e
z++vcj1AJ1^BG_sA|C!w4MzFk)iWbk+&^(X|YE+;&bGpGSZZWPJP=Nt*7G&H-C>2!C
zpsJeyQfCYc2FQ9Fp;WXyXZ&LNhgqQY#vR-ojH%!ZH(hNuw}4a)NFm4qv`BJ1F+E^5
zQZ7n`L<)R$S`E~~H0TPOZL_%rl#D@&82E(K&|Fyqiae0`0`O{}>1lJh1r%#RF#{3=
zxd6#awa~IK4dTjUbGZeiU@Ml>&|C@1CUd#PxN4!Xo%R7dW8##CmgiwfD;<=bknDmb
z>2$Qz18T_6;}(M-%ao3mTAUV4Z<xm|W)%zdSUOs<083@*Xyth=G=S0_rhk|ZI(&W}
zH@{RZG(V)HC7s$I(*@=uML{}R+NlF2Q3gKY^a`+H=%-gZE||VxKDU@vCa72jDFcNo
zlHcKOL@OrhKuHm#e#P_y^PxwnAZe=u)x#j^3*fnOrt}BX6BcocF{OWixB@NYs|BV{
zSimjD1<OAf9Mcs*{i|aOxCN46o#_m;;H`v)NCqhNBijv1DhzzW8EC-`8*#}%3vSSn
zqzjQs-wd?OTLTS2@G>4Gd#VMd2P{MidGN9&B>6gMG-hN>H(10ij^25%+c15@LZpsX
z1}KvwX@^BPc%TbOybh!e<UO>Qs=G1$!9s2^sXCbVK~aFD&!S_xz#>rQ?&jvu$^a=s
zmINsV84AiGNaCO)s26dIN!5c=6-XYGwUAcc%I%rHU=g<%S3Rh-2g!c`$G21_S{AB@
zhDD~t^aqQ%#iyGu=H`dr*pUfofeK}U0vgG3(B{^~pqW8XgfZ|5gI5<J$(u_|Kd_iv
z%m@}z;Gsn%d00qgf*g+|UjJbFhsDt5@pQE%+yYXtnW;=r*dnPkXP6$a1gYVli5BLd
zLmQTGiz&g9XeKBak@UkV?#vC-4Yat$gfh{B*XzRc2O#~hT$Tw6MkM_Wpb`h<^9PV%
zb6*N737}au6I84qDK;yZUa%C@iGhZ77FrzCa!g;a6m&!^G~Z+iOm|q$Ek6A^$WT~o
zAqy?jm`hAs23o@kDytdzgtO412v+2RSN|Zn#iC=n!7^?!rFu|C2kApAwO}i6vm(H5
z5CoMbNZMT^rcVG_3+v!yp>+#j9iuF?_%hou{lGG$_{zeJuMf+(#jL<5D}bDZBfhfG
zvIpG09pHGJ9=4oYKoU0ckcAd$*3;{kbBl8|z=9bvUq1cWa&7^s23XvH!Uf60pi}5p
zzz)lFTfr@m1WVM}Xr&&kGRj6P^=d&TGVlp!qeURBJqKRhgk+<|j_C_lfDX|Gc@?A&
zt<(cep03~)<7x!uc#u5wyt-_(%;aJ)-C!k19Vj(|)IrXx)5^w(8c=fN6V3*uBqVo$
zqIxB_m=`Rnv(YLV@V*+5xj3Q<yf6yMJg*DWKdeM5m9s%j5G45~P)Y=u2U*}Ml?{p!
zWO-0*GVlrKK+a)z$^m6TWO-0~6eJI7m>`M6+W0wW@#P~h{lO|E_vE0(PZKoUavZ>o
z5~dsvaMh=o19B&_`JiwE*^AcWcATES8Z?{-ZJFkv<s?uvujUq$YJxc%Ehkw-Ouw)i
zv5heYWDByb7pAR2c05|-G($_~9LO3JtsJ!S4VL)8L!C&*f(As^z=rjwtpSa+f-DAk
z59CfHm2nQ!53B)A*g}(O4k);g<YC>498mH{5;yCZ{$UNMFocFnE?P9EFPN^d7PMdv
zl<XP!gmWQ7%|f|o(c>L3y<si4m=dfc&jqPRvIjQmmFofS+G*vYMGvfdlZ%#Z;yz3l
zSO*#+2dM|y4{|4xxvmk@9YFH1<PTmdg(Pn+F}(mJ4_lF&ixxAWi4~AMY(OR#RB0gT
z_qs6s!aAgw%|(m3W>9tmx$DHVb)fosJ!tq6lvO}tpdtauth9{j3G2DVq`>WCkUU5o
zlDtL7^a<-h<9g6I%tebU*qX>ZPziye4<x`RoQEEF9Mcbg?1R<1d1zVA{KWJRAbD7w
zmWLLnpzSCdxW%}dL4Ic76V8JicNGO*QH5kbtVqg3%Zjif7`&(lNj<C=nuiwG<{PGO
z*Z`TLc(4H}P3ASAUcr^lF<oFIx0qBssFDS_3$6A7HO4k_i*dDpiZqZs^z8mTP`Dzw
z1GX<B59B{2@$3cD7l6!%ha0G<Ly`v_JqnVC#bX{?JX>^3+k|widfp3gl8?$mi%!@C
za6TyZkc@{Jn~xTqFz4i>m8j+$rcc-e8Wsb2gMm*tAFakqUoiau$UWfwg&=vz=!zD2
zeHN0vuxQCg8_P`Rn69vyTg(U+-1(rah@=me<@3>sRM4Gbn?cbCa~E2X3R*m~nOlsj
z6`F<eXH1{4g<BllyF@a+6%=bAXQSmz*h2q&kUWz5mJ8Dzwjkx$d{8Ptl5c~Sp!qkZ
zgEp2;U$%u?fU6A@#UM){2Nel{N*Ux`^(GC|wsMPkwSh`q20q~ev?zc@O#xaCgG~q)
zpy#Xy(-XELmDb>uSIBOJ*@IS!f=Y<3pykM*umHIOEysZl9|p<8a$W&i4l{F@{$VRp
zX<h(XkRVh53KJyz&2~%=*aor(Bo49%t<-FLFuegJ59=xxfZT(m9~8CQxW%~IK(!D^
zKV-4HPyr~Ik<_&_Oc&S=N+O_=5Tp(*CxPN}JLoiBaD4Cy7l70u>4%-82ws1MBo5nB
zP=J=@U>kP9OS6#FgKh@ejyO-S5G{H^hs11$Rl{sMxCOkxiIjm)xDZsaBN+s%#tK12
z6OuTr`US7uLJ~LYm~OBG)Ng<`g2BtAkmO<2Rv~&s?wCGd2e-Hc$QqC{K;eU=t$q6b
z9o+g%Z40J<*Z~S&Xbvnyi$;qb(-n3iWtBp-XzT#xSdj5MraSE97S}|}NwCyi2y#4<
z?JXCkZ`cXyk3wS~yoL)&9<*j+C$|_^2Po%)jQ=scVK?R>tFUsg2%{XF?yw6qoCHct
z41B`iC0a<vr*lj%0LjA=CwMUdl6;27^aUXK7Lc<+`ayw+B=7QJ`h{Icp;Cla9(F*z
zRTME@U=OIy-_6a>)d|XpAj2vkenG3UIzjOVk_KfcB)j5gOrNkD*)Fsg>I6kBNZ$&u
zvD3fr2Hmd+DiuJ2Xz>BJ1QakxmRKy9uCNE$60}^_2`zw&UO+4f-^0x>1vd;W3xQ_c
z_do{)go@EJinYY_4ST=~DIV-W+JsPymP<hEVE1y1adkqAxnk%V^0K|$0#>l$s$x)(
zA^8H<_b*1PX1buEQ4Af_zqXfKK&lPurDC-3uKO`<A81YwRE06{2^T{S{c$P=DMzxa
z3nq`2Av&QcwirYssRu2N0GZnbjjm$ILjCE-_HheHRf7TvWEse}NScn$nEnBz$qZ&0
zWVm&@+J0^UDVPgN&>9Dw8>R>BM~cf5kl{#%c7f6a1D|k-!t{du+~R_06;J1f=^OTg
zN(88#C1`0Mlr=%}aO=_1etp4ofdkxPQk|gm4YCGg4wChtrq=;(F|KY<MF^5FfH(tG
zkRU1R{4jmN0d6rbSP4>s)`Ej&%@VZi01K)TwD@ukn0Am`3=wE((PLIH-2fyHn>Q)}
z1rm~T0w+vQI0!4>ryWE(XP^Wv&S2$u30g%|B{2QKL2mGg*&jeQ!Q#9Wt?UA=KR*Nt
zA5bD@;1e!Yn10|ex40pCG=b7SNE$8Uz}gw5ke2xLZHKr8q`E<Y3sMX!f{=V=7BT(7
zA#O1#*pM}N<qnd3SHyII!`xy<umusNpu~$L4~v{qP+TL4w_KQBa2S+^K<YvEqD3C)
zIB$@-?VzL!l1GaySmUG=Epvg6I0c&vEtg9{wHA`S)&<j!fTplv#-f#S<_yyfjv(cX
zQnXU82bv^HUx0&r`t&2*{8BxjfCsq|t(0>yn10|0w^%)FRZSUMJi^Ab%FwbOtRr6r
zvJA=Xum(vPTH74f?JNVi14%u!u$!)Wlv|Li2b2gI_=L+KLmxtAXqmDzVS2++(6Pjz
z!VaV^0^H#c0<Wz>GPFly`h%mOhy!I>kUCJpL6Xntm@aS(DI1l6%tMm5mYD8v3|zVw
z9OD)XY=Op88CpDo2jW4-qvb-VpM=ZM;<Xo427%N=rl_tR11+?hcAQ&G3T^{hZp-MH
zZg3nas>{$~uNRcR8Tf?DAt&hwm7~Q5=&*f|`LI#ha<tGlE13QPBoE7O<scU#1w>cG
zbcGY3fCRY<WDi<|fDW2H!7aws2TiKw36QQv+X-#~u0Ck!mqR8Y>&wwX8CLO@qh%|&
zW6;V(ShuYlEt|p3L5m((Hx9gHgqdOb(Q90S_2r-tL-HZ4OejaoWUz^+a!}kOsqcf9
zXXR*_4%P-M2PI)7^(N3ZR5>UFnHj9%Goi2z{N*48NE+Z4qeXR}#PkOzK(jS(xHya|
z&~hm(#Z{o?(mqhaXW$dAfNm<NK#PAHsBbFJieFfeR-mN^SddnLnj%P!hO0+QAF!yb
zfRxzaD41S$l3M`2QM3Z&0wk0AB&IJo$t_+FO2{CGgFJvN4N?vgM=Pq~7NMmvSSVMZ
zr7>72SD>XaSaeNiI|XtiGzC|nr7Y0y_EX$qoc%CYf-|&M1zK8xTY{EW%sQq|IK?ey
z1k05bkhB3$8n9Kg6=+Gr?85W|r$FN$pbWskCtL~2bx45&n$|wWEymRkDtAEgkP~R@
zE78j0K2RWm<k3<CtkF@4mKtE=9+haR0oHb^L`w}Ye^)|M1L81Z&~+TAxy7vD8bRTU
z;sKD4_=GD#tpX(R37}*RaxmnaHla%NRM9d0!D*z{ZYAXSmg!<=kQ$hkXi<H1#&m}>
zNL~L*v`FrXm|k#(TTBs_w<<xQitH$8Qmh0=z9zUek0jj*iad~;(IUTp`uQ{5;!^#f
zum?$_#l5w~w6mboceZeIFjYZk9IDWAJIrWsD-X#^So~Fik|mP3>5J(JXOXJADv;es
z@<(S(pKz92%n(-BSK)}~Dztbuo4)@n$Sa^^&%h^K1<B;_WDH7<XSv0=CV)yZkUZq-
zu<2^&xCNwOX|M_{Ds4KZ2b@Ey@v1;+70Im=K}iE-800{S>Dxet!2<-XA_g@K&mk>N
z1h3&jG7OdutI!I6=L6FP&U5QA1)P}fa2}MdU_SgX{lIo^F|8_)kC4oPWsqvLi0apv
zzTiBPXR6U6W+JFmV&D_5)|eh}fm>V<E#Gy1n05iw{RbsnkSg@xe=*(Q0;q2R%0(b~
zwD5-wyH<nbkz5P&bu}m`k;Kg+rYC^xgUw)o*ES)^cSTH}aDiLQXaXq8K=z@P!La04
zjTU8~IarWBxV<3%AejrBORWYKYe?dt^mBn*jB668_yXCt0}@JTHF)QT=>Zp!+9=ha
z$U-t^BFFRwkUZQPv>F;Tgm)2S4Jh$2@CnyIa-CKUT4cgXwHi=igk-+siRl8DK+Sbf
zA_D0LITuO3D`L9CC8R`9gBHt^pan$@q|rNl*(Gj)AXxUOL5owkBhca$R!G&L#pz^F
zRt7l=QgTjbyUZ<M1j{ZpI3lnHEdotnOgFfURDRT;Mc`zP=?NftSeaIXR+56YI9}!!
z<C+XDF>4@$q*^tg5JL(nxVz9|&@5v5hs)gZnrIOROHVauMd)OX=?Yi4#o$G34O(sm
zHCnHLoC7M*8Tf>2A&qCJTD05=b51Q<gu>E)Em|=Ox;^F!QbgB+!XC+cQ$Ps{WFKTT
z?sT!M+yY8)OVA>8GBlIbCV-2a>24s!uvo4Ibx4s-29*pTlOe}yO<#7ETYzf{%mnD9
zP%S8ZBWnW1GDs6B7?8v*I;LIY7UO~~$f$+fCZ$!2R*%6tx3y@oV$m@@;Tq_sAW$TN
zj0YueB;#Qz7`!|INgP&M)q$D-NaC=@P#q}rki=mf&^om22yKW@KYEQ@2zDh}9a>C*
z2BfZmW+gxgkbzGayd)0EY*@;w1BEM+_>_+63fGYuV0CD@6O^*9bBl3J0c8-7xsV!9
zs}3!`V7a>v6h)}!Z@3ORWCa>Ebs!o^{^<1k*FjVJptJ%q9%K!Yv{k`$fg9Xn^>F8-
z<wIEg4qgz3q;Cqy8jyMDDFIX<gT&EFTv#%!0|g(FIa5J}59k(*I_MV5I<&L__cvOO
zg*yN(typwSFSvoY?yH^wyux_;vKvUvx_Y$uKRRRjg&W*r@a5<AXt{Sv$F!SBQCN>w
z8iVe}1<Aw0upTW5fCfNsa*J_Ig(mO%i0Kz@af=Iryp9wUogbzjxXCRp35}_Gv;<(a
zVEP9XThL14DI2CM+(IhC>Ol<!B;!E|?H0Ef*ECQ9WZ)C7UjcCiS{4Tlg5CnPe_+l)
zi%8h<n&8EHNXB<XOn-2TTTF5a$UKnoXnDVXI{$5?!v(=>`H-|vgQlB$=o}-+bI5ay
zogbzb+(txegTQoy3U0CK%WiWEB*DVH0VCQ#<pQ5@16o#wb^IF8;t^KNG@uv49n<b0
zMSlaNivn-6c127#xPw%NH-JJ8*=wK_%D^Yw0Lj@x4QLVD`C<BmJD?ULNFPXD!?f32
zV$+Y^;TAB0dkrlzVX40XEjwFuO#c9KE8Ht+*%?$C-9`2bTK4UVm>zH!*)M3>bvh``
zg4_r>1W5?I6b;F*paa<Na*Nf&Ru43w)uXV@O^u+KLDC0a#?8Pd+=y0U!=kDYEyu#m
zL92h$AgQljxDhQaz%`(y1=zBYMzpj5w-_xgz|BF+<FNU-MsVV&XMm>;xIv(7hvZ|p
zL7-U2CJqW|Bym^)+6Zb8A&F0i7AlRP90OZaJ6-z?7q?a;sEkHZ3Tw?aq9rEK1n)hh
zr8kYByojU^v_T0Z57!S0WF-0Q1=H?>rfEUiKyipxV!*Ybr6s2i(+%!(i%CJ_Oc=aK
z5Xo3`hUp1ld5||i=AzXA77M0NxR1C=u@Nn)IenOZ0IVGpU<`c1O=wBW?8WpC_qoOD
zVFBBOmXv0IvMER(TFRISN?9Orv<RIEN+}?5v<iAAD1t%apx{CB-b_%0foi^{1CZs;
zO`w=WRshPoAdN4;TN$L9&^$O3RKhaw2{#K&FL=x?E{NuSn~dob9wD9j*^HL*XMUJ|
z;1S|3w`P#@k!+s@%Ap|B1Hh(FSAPsT?G+jo&1i|!>BIDZ$J}C8GoeLYGbrqk41<Mn
zGg{cp0_7r*B@-Z)Y=6wn&jmMR0c51U87;Y)y_hcW1gZ1ZjF#R?CQNsD0&1zje1I0N
zu=Lmr3O^J_PA_=EEygtq5;4Lp4AVb6;TG3KPd6aHG4KhupchFF)1D%&9%+HDM{hw3
zS5S}nDYux^Oi;-UG6q~=Aj*r(71Jkx<Y5y9EuiFs<jRbU=?9*I>Ss{N4bl%v-bnJW
z!RZ!|Gm*qW!}d=h`}Y-|A-fZDzok$MTJi)fP<n>63c3X?7G|E9zTp{CO#xm{hGgF?
zP;Lde?*=#&1<{&ynHtjto+B2Ow15&0l5VSr=?>4K6Y0~-o^uOG&4PwkD|)a;OkePv
zTP$fND4R0y3Aci>Cz469ah6t)Jd!x9FVcz@Kd|BLR#4JJQg7uj?FH09TCHet0vp9>
zMavd51EwduK$>K1MT?V+j_DI#aElqi-3ZEFNOr>Ah*n^ORw}(fio;gu!5FQeG=Zc)
z<;3)Wm!R4nWG*Od&`RLU71J9)^02hlik2fl8*X26i+RD_hZak-L0JQ2E?UWy0ZNk$
ze8O#@9Eju|(9(ui++tj_LGA#_D@+e~%`HB?{1rDp{DR~*w1{f_Fnz%*Xvj~$_KI78
zs~Ku-8{{hA>1?l&PIhPm*^OkUYs7Se*W6-Wuw%vB(25{ferW^cdL(_YmKS(M9Fn-p
zhv^Bgk@7_wC|x4U8%&?@np=zuJUImNBP4F7AA8L$U<3>3HnbuOHk;grR#c^eroli(
z9Vo$p3`5IBW)9N>-XM*#fR~gZIi@ROdILxvwlxJj>x?818pnFWEygt$l&Ki_gxeLS
ze|QVpEcON|LfSDSMBptfLfqbR3)I6VYTMDOL|3S@+d(vvwQzB?`~r)kcC<Kz#Zfz2
z{(-K|oxb!fw;(*g+Z({uhE_XTrh$chJ6eR9IZS(pv>c}$t(*gG%LmEBgAgt1K&_N_
zNabKVS`^NM1?>w+&>nw>RFAf!Wt?=5=^x%9HKjU0DIF=`U@LbzK!zfTn-xq~cn{n8
z5%!*20KP)011<7EE0o|Wx4q{UNSX_37clS%cc4WcEYo+OMbbQ&dbCJ_t4GUVE+3{l
zd_W4I4p3o)<aQ&FIUxIIOb__TEiQ;w4;eK~Ux1<=Eq>;Mq8X(91VlSp@S9zjZtxMB
zScN)3brO=*DJP~Ud<5;D1K9~O11&mW*|HNY8er$gcA`haj_C(JB6+nFtuC4mDxVqn
zggYTSf2XT`;ubK3tx)Mit8ieIN+((aVg7XgPu$}0<vg8ec?)#X<|l43r3KJv>O>3f
z1<>H`gbwk6S8XAM3Al&=xe?@6ByqDB(+fT$6-Aw(G8{>MLBsR~V0lm;1?fktODuLw
zzW|bl?OyIgiwkp!X<xX->S054ooG>E4K=n4txAC{a_vHkB3RYgg%(AyHA-D*t!1dQ
zrl)@47L<Z5Z0Q1pA(9_Kr>=ehwY^}DL2Em}9fKB?7CWXN_yQX42c=yGKH)C3tY$7T
z{R2oIwh*QZEz4OKOjr2IEoKF4xq?^HA-N0IyzWBFdJCX=qpM@O!&h$c>Fr;+`QfYo
zy3oqOriAGmzJeMRpacbSB&6aJ>OxBh3pPxD@D*v#R~K4BFuO2a;2XD?)qGG+1et@D
z5a5nQtIHOGDqxWM4`9a%q9p*Ej_C#8Kw$`SHUpn<H(G>uHcVgeja$qMybl^Aj~2n^
zplk#ZS72aZKngqX0$7kZdR#k9`;K%he>Yl`W@=0~_zpTM8stonc1T-9s2eTnGBu`8
z0GR{J&E24+gJk`@57Q5P2i*Vz$_^lNK%syn4@<}0XxVr+DD*(;A<g&cYCpIIm`q<x
z5BPyp{&b^7-9nfpkPX$-pMf+jIxt<}C%4%2x&UsD>25!{1-KSLmGvk<I;K5nb;x2+
zo?_q=?tx57)c2qz=S83x2g!p{5|Uq_)wOUBS{T8GLV7?&6OwwkI9iy&7OM9^lKXU5
zcW%M@9<%_0<&_>#9zZe_mPdO)=?F<2R`B$I>H=hOSYUv9<4EFgb3l2TnV}v&-~*d{
z=s^p7xCXQa1l(e@d;||IP(DJk7`!7L6uO{LhKutsFu-;q^*jJKfa-hDTI;Y@R}U!3
z!Zk85z>-)mTG0v%{$8}4W&}#241B`9pk#n#4lKlbAvq5bBG9r`xEC$!!G@B1(b5;(
zAoSuD<Uo+cXnAolOdOQO;SN$^V1N}hy=Vz^G00$$L68yIs9v-L25V;ZLJ}A}Y8Qjd
z0qFyU0Nf%Zd(hJ0l8EU7f1vBHw0hAJP#q{5K!!mQ5Zn^8i0KYsO^>)a>cNZkkZgkW
zN_x=}3#@qQMN2H;X<3jZD2auE0k({&7gUU3Gar=dk<SMO&qja@LQ7QeAO`sc$)F{m
zY{$SS+y^=OCaDiCvA}}350Y5mzFz_gC6GR}v;woI53QJ93XS_d$V_;BA4(cvV1T8i
zK2X#lxepcq;01?B;^28Mko{<76l@q5yp|7HJ;*+gdPowAhI<5V0a_Y@&NT}6;YdT^
z`7R_2mVz<|$O6b}{Q5rh@(EPPg5*H~hpZ3gFtp?aOF?~T#S=V$(Tb;~u!sbuAlMnd
zeQ3!B9-EM40}ljP8t+3(HL&E`_XB)EP<=lr7Lgneb7VhS(E}GpOHHuU30_=>WDd+z
z{b;FaDJc6e@Co;W0+*3tdhb7OPVkl7Uj3k=0m%fI&-&5I9GK7gLBWiq9_F+D0Pvt~
zeLpCAkmTV$Kuce6akM%R?lVaGf`=^JXK2Z587O~%d<Kd(SakKH)pc-Bp`|6br_j<8
z+*2FCOLgnPiv_WH3N7uxCXf3;!HrElT4@FMEGVrZsfT+OlI#$R1D7>SFZd5FV8Qd9
z$SpgVFDIZSBA741D+G~jf%$R*s7Qj%q%bfraMyrRC!g>Hv_u4pvI(FdXJ$ZTeb@<1
z6F{j8$pV=7CZMG;nD-{2rLkq8+{C~qJOQ!;$Y}yvT7r8JEiJ)4h?bVjBBt;_+IjWh
z^(aVAgZl-oRDy>ITFsUQ3L}uyK*<c7IcO;k?sZ6t!@RY20$P$=?lCoiM+}@NohG0q
zE4aVWk`>(FXvxYfV(J7Qv3i~yXgoqv5j-ow{SFFlB)=>K`3>Ypw89In9<9oQ`Eer1
z8YFX|(JL)H5iKDu2Nlf>e8LkUYi_+Jq9rg`_L&GtU~mUR4HTY;mcCYiN=1-)kaoG(
zM6@~&HcU4WEgiwlLrX_1K<N}@9%Lby*F?0k1{Mz!(Gm?T9wwqC8dzeQIAOZL8*Z`s
ziD-!g7O)c`i3ILn*fO7qXlVqzd=}(BP&gt5IIR0V5v_`YM-U`EX~Qjm2LM`vS^>&H
zAPXR~-SrdEQV85bXek6XZZr`sg}^*G2`z=d#nBQ7%w3Z}5zEXV40rGfPzq<@6P~02
zKJO!G5?V@tCEZD&7(@ygxJ76s4csEM+H55>n@>uB+5-v@B=cY?U=mvG1nav@LQ64?
zpnw9o8!g3Hfl?$$9I^<zeiB;BSOAJ)kUUz-fE{cx2`y#7`c#uZ`jFfU8<UuXmNH;7
z3X>oy0};@0he1}f)lWjJnP4ek5?Yx87e`Am@CX0}1d_wx;%F%bX3k_tib3?LU>YW)
zB^kIlB+0;23~cy%GAKroEQZDWWVEtpC8+FR;1iw<N?GvAaJtSLF0Lf-0#PJ0z$3aK
zwP>ko1<3OtakNwgw-aOsk~ynD<s3*oB(>Fp*M1_&!&3ERwA2O<B(&597e`BN@GwFv
zpWx!4f}fcIvwWD0mMm96lkH^4SgO}#wB!csSx-hwZm>;<lOf3s9!aq5F&UcLCZnY`
z*zwkr(Ni19d{DrF0vsv8VA*3bT55x3kI87M4VDe2KvElc>kZQs0q~K&^;6JO4v5dd
zCp-l$<-pEJp8|?aB*(xeai)M$6tXy|i~^YhqLIW`f$};?9F%%sE!in(Nd}fArhsAs
zNi%G7(G;{Q4c3jDk^vbb0WWw((g#a2Q_zwOY)=q)-4&90Sdy6nNiy)5go~r47<eFn
zJcrz7gmo9Epp|5>?jm?u9g@YcJTwIq^+@8YL3t1qYLHFVNmJ005ZoTLBm@r_v?K(#
z2Q3M$1|?kvKH;g5mGAXa(aIqkP*n<&M=OV%KzS4-4oW>p?uOObQ_)fr%>JopscAJR
z>4MAwr5Z+t>9%Y<kRDw9R8R;YnGAOcC><e*!(D=wq+sKBQ_+$X+$Cs9Y7HnogIogg
z87!SnMN2=hrpHvYA_s0LTKZW7s%SxmLQ0nUsc0n&Y?xvyTJ*!BaVjW!kUU!l@;t~q
zP_!V4!_p~uX)2O9++C35gQyVKfD$ywAjpAq^;6N(1*}Cd6%;>627(XoV&D^=1}R$L
z83pFxX=v#OHuyLVE&af5PMHQtKZptuHYzy{Edjv>fTp1(Ah?4-(TC(vScaPhN?1tZ
zun?JslDv2r7}kJt63AzeURwP$v~&Xtk!fh@2JQe*R3ljg4-xcQ4wN%N_JGnElKNbb
zhe6_yB!?wL(9#?{M9|V4+(DoyMzR1NB9Jl*9(C{#K`F9$7#P+<6WcV%jY>(=&=Mm&
zM9>l=+yS80EwTeZ9sv0ek{IC*fTxiM(-YFT#p<VlLI_D8JV~IXQFs90NTbuy(<sQ}
z41B`V(b6a^0H#CIXg1toYeBgcqyd!X;Eg8+23b(j0Ewfexpkn#3=#(g9I|>9kW2W4
zr=t~7>nx@laPo-N%YZxv(ubB**1_xn1ssxjGE1Q5p~d_<P?7?f1Byvx^`N8)5(oJQ
zDPY%uQV0W|w(xXN3?gd)c^IStEe6-^n0|nhM@&i@6oVjnki(G;yfOU)$U_oGAP$@X
z3J_#@P)srK3C{op9Flz!CQ$WgnRPuhPs~6IP-$oY%s>m!^`K16z&AaVi$}0t8hrT{
zpYRNj?~xp_9vZ4MK%s@?2x+LNXFxI_JQb`5#R|yLpwLEAF9j_yW`IHw*?drJG4Rz3
z&p?X?sWnhvqD8}cXu6yM%3sJ9q(Ie!Vh7m*P-Ovf5GWRq)q_G6Bo1;IGY?`d;`$5I
z1-N;{yd>X14Fp94vVous$G|5%6BJ!Y21@oo)PtAGBB|fNFuj1AM~q9-1uAbbUEm*R
z6+btRK)nRS`@-P$vdEesaU(nvE!ZVNxejDGTCi^bm9rpmQ0O2z3gkuxkT@uGk<EwL
zt1Ube6kJFe#6gJ|qya=DYuGS-0uPT^y*SL5XrZzJ6ub<4!m~g&BAaIe@%1cF;zTlU
zBS;ve9^_GE^`PPgBo0c%$m${KO<Q;tD1jnr5W500iBEVIDB&S%2$<f$%Oh4V1`0ut
zfoKVDBTO8WK9J3mftm+OU&!WxLKb8WD7_%57iEE}2PF$+^`L+SC2a6|K_m?#ppa$Y
z6P^u<N@NY7;sGQMN|?y%p*e6iT6W(A3TcpfP_{-=FS-TdpxGdO%t(v!H-Um0qygk}
zWDTIS1QG|)NDkTrO;fW$A&0CU<Pea0P>3L_homXt*`SbvsR!9F0*zDf3P@xPphO8W
z2o!WM4Gatn!q6z44GIxt_0W);0}450^(_z|&jE!9victk3~`{;KL_MuBn|GM!ij-T
zcn&B;kTh%tB~p+$$mhuFp@ridP})OQ?=k%YKaW_wJ0x)m&jFc>EDuVPAoD<F7?OEz
zPoNG4r9EWzppXWs2W2K?^&tHqaZuVrRu2kkP#T*HG7nh;bo72MDCChffI^yqPZ+%X
z4Ou-Xt$@TqX%9*L7Enlo#L?228?*|V3(|+2#<qY$8l(X&jk&=LLQ7*?Kp_oM5Ar#Z
zgIw=`e8eX_7cGr#fu^y!ppb*92VHvR3QbFMK|zA-1DH5kkh+48(c%-Hix#9?PE21Q
z$Rp<E3Q8Ibe8TfU?m#vV8iMmcX$|H81_lOKPz?f74@yEv>bG)CHxS|xt9Jp}50XbK
z*S12F&OA^+AerX^t+eN%CAqDjm;jjr3P@!2(4;mG6hO%KL&T?l72*-BcYzkh^FV=u
ztO%5DL570LEF?pnK^YJv4$64Q>Y?dz9!MTpJt)>e>d`8Ptq{-G3(p5717r=*P@WG8
zO(YApfkK^uPk25kIU%Wcg4W6NLHdx@gF+po9+V!D)q^|=5(kAYGsyR9V3QfPfuaE<
zffkHTAs~4^;rVF6xGiIvD34gZ6Ev3Rg8~5AerN!Khgy;BcLWbA@d?id1pu;oQ1S&?
z4+<z`^-yt8sz;vH+XhOdpp3o%6i~<-Kmo+SC%ga@07w>W2W5PaI4Gcy)H{G;5+n}t
zKeBpgGF$)(C}j0>AmIUCK#AN++8!`{gBXvPlszcPfDA+nu<ZrYAAsZ?K<O7G4~hw7
z3nxq$5C`dpwkH;V%t4mlFx>$p?*J`n7J%{{viybV1>!tn_4d&Gun^>7WO-21WZ)BC
z2nrZv4?(Nzg&+?jsow!gnIQFO0cI}(34n!Y0k#8FQi5V+A;^PB7T7}D4+}vV57`2k
zLqP$Bq}~Qv*?|Z3kkv!;(n3(cA*%-^8IVK4Nf1=MLX-3kP!S4}07Ws920Lg&dLddG
z+yPB%i$ESkRu4^5i_k)J2P6#&F9L-eOg+ecTc`z#KtY1!gPqVIU4)h?Z9zfIz$d&2
zl-7{d!z@P2lUC4%^CD2lA*;`TR_}|@g2)n-RzMbjg9y>G-wDm7i_k*I2Ie5N5Zbw8
z`T{8)F)wSV2f<6OkR1RGk;Q0f%o>_z7lT3yN&PO4=?2m~V)d{iT)``=kmW%E$iOGO
z7?gBiA<V$QU<qyCECwYBWc8qc1*r%53t2t15L*mN5y<L60SijAi$MW{tO1&47lV=n
zvIcND#3#HMEx;_G#qeUZ0NVwsd_fKZWj-YHE%t!Y7@zQBP})UqF6@Ga;1W<$LDm2*
z6_$XCJ0u6~2ARXaC%gm{QpoB-`a$BLB!sLU6f+=kQ09ZFH)UX8Fo(7;mVkl~SpzgF
zEJ2F`^PcGivOHo^yFqCdWFT6Qo7+sk0G5XYvG5YK5C(0ikmC{a+6@iSC1@dP25q!2
zK?~8{&=6gM7NVeyZE`$f^}C?~xD*rsFb^^?Fqr9pLW)m#DOv!6BZ7fX7`(s=Nxdm3
z3xUMZ0&ovB0GA>MAOiz~DX2IEC8eck0k{VmfJ@N=&=gwkE=5bjd!PXdUU7xwAQPC!
z(9-Z8XaFw-2QaAkffj!zFdv|$;XTk0Uy2suCeTc^6fMN}Ktp^fD6Jwp$OjUl%Rm$?
z#enSJ19j;#P*5Rj0F|E%e8S+xNiYoz3=Df=;-DZzQf~|miDjUmMph3>>mYMLA&0D9
zh5@tymrr;ZC`gbsfT9GX0pxQe4Mt}`PUjO|1_~);^`LSUq#opRWcAR-%QCd8c`qpF
zLF!+C>_^rB?ItY)C01k$Kta#IC%hb#7?IQ)!^A-$hpZkH^dR-<Ap}YbAaQsIfx@4G
zfngu0pan^w)x}1j)C>{_B}OC*_CZ5vIa)3@`~nG~<sgfY)q{c_WDY28A$h<s6B-oD
zK|zPC0TlEg4WP7vtN~^asD?sT4+>%iKH(K;A!GmwNsze0bOS*ivHBID+=XPG0kjvh
z0u)k6=Iw_D$O@3hk=28mz##KL?m$)#3Q>?a$lXZl^`SAb0+M79!|eM(X%3_TEkyL8
zRpkn_0ND=>DDWB%WDB4j)fH&Da6c?SKmi3;U(djx4{Z#r0EG;)4?rQ!z$d&C6oYUL
z3=I0v_S;HOu0vK2^%;1v2a<X{XvMG+ElnN(6|nUn3qaWsSp(F^D?w=u$$|sWC|C)K
z8f5iQAA{E#Agc#OEy#ROF@UTdTJEgO0A+V%4bViq5)_w68g!wR^GZ+@A*%<a1&{@3
ziCzy{`L9Gv^ar5D!b(uwL(GR{H(hAuyb=_r$QFPS56A*g+(R^gB7;E}T<P!$uLQ*@
zvU*V30jUSYJ+gXeF|raArO4_pfbHiKUI~hOWDU^DZY3yAku`u44+Ed@Dp1@bsn_`f
zau=WQDo~svsXqu32B`<dJ+gXe!MUm)6sO1<K-m?f0TlPh8la2rR)OLaSv@H2fYgJs
z8?t(6FAKc10$DvM?SRxn%e8t2Xl17Z?T4-c#VN7|P~rh;0L4AB1<-uI3KXZv>OpA-
zq#hLaNb0qri5k2d0inL0;UFmSfHZ*O9$5o4+pGe`DMACoK~UlWsRzY9vU+H$UInTG
zkky0I4oE#H?vd4lb4@*;@G4N8B5MF89*_o5+#_kwg64wNpg2WV4@x@>e8Q_iagU^4
z8=4DNgQ65k{UK1=0jUQ?eLa!}Eod%S4T@7_4WPsW(g2EkWcAQouo@Jn$m&692c#Yp
zb;#<WiF!3C?xE_z>HiQY@qjd-#jzGN+pI>5<3pe{0#Xmko=6sGLR0l>P!vHe00q_|
zXcU7NJ0Pq7!@$k}8ckh&V)_SA*LyW6=#dn#Lt9j<L2-v{ASjMO4gdu`l6rOM5Epn=
z1G0Kh6f^J%uK@);l6p;Odt?nL>X0`d9R@iYqyZH4$QnRF3K9p!9g+oyL2(Qc2L(N{
zdXRpQI4J6n)E@<f5J((U;=<J{Gcag?d<2pJS%jqFFer{e;?wg3xW%Q`fI<{W`Y0&i
zK++q)8v%^gfHDmeqMynDa~~)(An7{{%B3KE(3P2MKmmm;4>AWN4{{cgIBar#4JeNw
ziNmIH*Mh<iN&GM<voi1ruLT7(+`kMA8qm6TEy#Vy5pV<)Qy>kXynw6$>fp7YfJU<5
z2sEJAf|4?ldUfbn$XZZ9BdZ5R2*`X;aRpaj&%nSAE!Wn9@&d93P=tUqfE)nVzyMCb
zpd`E&loycIgYpbWJtzc`)U!dmWoyx5;s_{3n1VEb(l(L?4d}@JT2K@tTL25v7vRkV
zQftwo;s_|uFz^Yl;{dNYtzQQUdSv~eC<Vzwf*wBI3X9rxpb$k;58G6`4lU`!7U`}-
zj}e&pppZu10tGwBdL1Z9BUu1TJL^DEh$Ma#l$JmaEr4vJT!$7jHXw^Z@)N*YMU23+
z>hF=#K1@Ga3>^j~Es(wgkUX;v6riAe(a;(ZtPLa&iV!6C90nDiAn^}SeV~AE!nAKa
z$N(gLM?p!DflqinWSM$Bcyb*{9=2v~J$e9xQV>WV$h}DFVQcBugZz&q4!#-}q#hFR
z@Q8(*4+(cf%Nu;&8%P6Mz{4#7IULCX*gc}_L0JMx9Bu(9fRMytYi7X{`Ec=i1_rnV
zpiBstU|^^NC3TR4&|(^v)YgOY)+;O_j#etd)z4sHU<B1P$T16Qd4p&Ekt~L-kY5kV
zj7Z|JwQTD_Z4@MNxQ{_mgd`4IF|!^mlc#`+SCGd}FfiyLkH#Mbg#btbEv-TGgt&LX
z^aKSSv3hTiIwXs@K|#&HC+>|FQrwUlTHG5HQpoB->OktzLW&zys)58oG_rb7o&kx2
zXyo#l8{}h<1X@UOgEA3F94(}{AyF#s4bq2f0VG7kz0pF78<eR)=77wDtFLEZfJ>l-
z6c41r5cdXI1lPd8zym7YKn8(|Lu7GKE(3{!9Dq$6RD2<cbAvKRJxBw{Wk^*kFUY41
zeB$8dC$c!yK|UZFNt_2{Fi1V9JVp}d1z7+R2RRs7926xWaRpFs4Os$IK!YSeK0y|T
z#<35myg(KQl@lQKAR1X56vQBLkOPo>%m<2dkT@v&L)3#?iwtlHQ2vKVfQmW>K2U)J
z(f~@7NaDPp5Ce&W5+#y2AIM;kI4Dsgi-Xb#NF3x5WN{6!{e0p+pj3@40pf!+fKoNG
zI4Fog;-Dx(@|h6Cx#B(`i;&a{fYJy^Jt#3Ei^HOz9+bF{C16ni(ugb$3QCYcpu~kN
z4hnjZI4BJuiSvWZ1&M<~3Q1f56p{>l;=Z6LW(LJSv;-4^`pg$nmcz?<A*h3VK^l>L
z3=;>16tXzTV2}l9*;oh~mA;^~fly!1zyXs0`3xb!AO!WXA1JjWi-Xb#1E07b$RcEM
zP+9<qqk914K#(}P2f&H3o=@Bl&81o(hk!JI;uy5z5E??@C<cjx;u6VXEl|*d#7{6V
zFiK<8A>w|Zs6bW^iV~3e2Mi31_5N5ifDA;^pbfT}Puvfr5p?Z0nuGk&LP#6LXW$d}
z2SpLGInXHf2c;RPxE;uBZID8c22hYgCBWjK{0<TaB}UNLIK<-B`5*@}@QDX7OkbeN
zlf#@;Ts&Ek(PetF8c#G|8z?v#7#J8q;mtGsj2e#>(*cF)9O^t~eBjfO7#J9jf(+)F
z?xW75B?RdhF)%@C2Gt+aJ3wlE!Rdm5!5d^5&-63uJX%~YKq0`u!1UtB#6a=s;u<{i
zLI@#{iy2tbC8m35@R;#IPMu?53;|_%p6NXrJX%5l-~eD?htdoTLem4Zc*LgP)8OHh
z1P2=Q1QG^5ad0YQ0I8kspvhw=6aY$Y3=9lPAoF+`7#O&wPtfGi<0^uBSA+p-mL`t^
z*IQ810l6muEZ8om#nUdQ#k*Zji*LnGCKluACzSae4fQkfb5r#bGqd%Ri}H($_0yA+
zbq$U54D}3j^YU{tlalod^2<|;3X;uCbaOKEN-L(vtMQ9Xms8=_CRcBq3crLosn+Tz
zW#;MY=}oUx;g@08hq!S192I^QJuc_`ytK^p(xTK9h4Rdj3@ZhwpNjHQ^wTp-Kwi>M
zhN+p}pusO$ub``&nwOZAld4;iSd^YxQf!-;lcS)kTTqmmmRVtoWB?>oDlE+6%}hWh
z;SU^yxjBh>>7|M3sl~R*3c9)=cjcFs=w_rQrlb}X8!PDQreqd_9gvitUs7CBlvscy
zmX}kE#4E`tN=;0e{#%t_mMbSSDYrBwEhn*H`WaPzd6xA2+=A)0s{G2+532G@Y9yBA
z=VpQ|gqaSC!DK@u!$1ZUR7{_s#xFJ9S&QGnlq)?sS)nYos5mn}PXQ9H3L5Ut&YB8b
t?tY;PIVlPnAlfN2ue2mHr&v?LNYB_}`h6|_iGmFOp#YT13^#mI2LK;0k>mgX

diff --git a/roms/SLOF b/roms/SLOF
index 3a259df244..b7f755248e 160000
--- a/roms/SLOF
+++ b/roms/SLOF
@@ -1 +1 @@
-Subproject commit 3a259df2449fc4a4e43ab5f33f0b2c66484b4bc3
+Subproject commit b7f755248e2dcc56c02634d288e1c0ff7e0ce1c7

From 2a62bbf4ed49bcd8c4f2003e265ea554589da9f4 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Tue, 28 Oct 2025 16:19:23 +0100
Subject: [PATCH 1768/2396] hw/ppc/sam460ex: Update u-boot-sam460ex

Update the sam460ex firmware to match 2015.c version from the machine
vendor which fixes USB devices and some other bugs. Also cherry pick
some commits from upstream U-Boot that moves licenses in a subdir and
allows gitlab to correctly detect and show license information. Drop
version number from the binary name to avoid needing to change it in
case of future updates.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-Id: <20251028151923.10DBB5972E5@zero.eik.bme.hu>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 MAINTAINERS                        |   2 +-
 hw/ppc/sam460ex.c                  |   7 ++-----
 pc-bios/meson.build                |   2 +-
 pc-bios/u-boot-sam460-20100605.bin | Bin 524288 -> 0 bytes
 pc-bios/u-boot-sam460.bin          | Bin 0 -> 524288 bytes
 roms/Makefile                      |   5 +++--
 roms/u-boot-sam460ex               |   2 +-
 7 files changed, 8 insertions(+), 10 deletions(-)
 delete mode 100644 pc-bios/u-boot-sam460-20100605.bin
 create mode 100644 pc-bios/u-boot-sam460.bin

diff --git a/MAINTAINERS b/MAINTAINERS
index 64491c800c..0a620ba87c 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1643,7 +1643,7 @@ F: hw/display/sm501*
 F: hw/ide/sii3112.c
 F: hw/rtc/m41t80.c
 F: pc-bios/dtb/canyonlands.dt[sb]
-F: pc-bios/u-boot-sam460ex-20100605.bin
+F: pc-bios/u-boot-sam460ex.bin
 F: roms/u-boot-sam460ex
 F: docs/system/ppc/amigang.rst
 F: tests/functional/ppc/test_sam460ex.py
diff --git a/hw/ppc/sam460ex.c b/hw/ppc/sam460ex.c
index 258d43f8d2..038b98d0b8 100644
--- a/hw/ppc/sam460ex.c
+++ b/hw/ppc/sam460ex.c
@@ -43,10 +43,7 @@
 #include <libfdt.h>
 
 #define BINARY_DEVICE_TREE_FILE "canyonlands.dtb"
-#define UBOOT_FILENAME "u-boot-sam460-20100605.bin"
-/* to extract the official U-Boot bin from the updater: */
-/* dd bs=1 skip=$(($(stat -c '%s' updater/updater-460) - 0x80000)) \
-     if=updater/updater-460 of=u-boot-sam460-20100605.bin */
+#define UBOOT_FILENAME "u-boot-sam460.bin"
 
 #define PCIE0_DCRN_BASE 0x100
 #define PCIE1_DCRN_BASE 0x120
@@ -97,7 +94,7 @@ static int sam460ex_load_uboot(void)
      *
      * Else, it's initialized to zero.  And then 512KiB of ROM get
      * mapped on top of its second half (0xFFF80000..0xFFFFFFFF),
-     * initialized from u-boot-sam460-20100605.bin.
+     * initialized from UBOOT_FILENAME.
      *
      * This doesn't smell right.
      *
diff --git a/pc-bios/meson.build b/pc-bios/meson.build
index 3c41620044..9260aaad78 100644
--- a/pc-bios/meson.build
+++ b/pc-bios/meson.build
@@ -74,7 +74,7 @@ blobs = [
   'pnv-pnor.bin',
   'palcode-clipper',
   'u-boot.e500',
-  'u-boot-sam460-20100605.bin',
+  'u-boot-sam460.bin',
   'qemu_vga.ndrv',
   'edk2-licenses.txt',
   'hppa-firmware.img',
diff --git a/pc-bios/u-boot-sam460-20100605.bin b/pc-bios/u-boot-sam460-20100605.bin
deleted file mode 100644
index e17de77c1974382144625632c709c29a1a86edef..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 524288
zcmY#ql?)5jb;{2#Q7|$vG|)3J(=#wt(C{kFQ82Io30WxUDi|4AnV4D`8*4HQJ5V>l
zd0E{?=Vf&b3~E*j|1(UQ%CKV6Rfdd7Um0@hCO9pdG?gKt?xNGONmm(C>N=P}`~`I<
znLzwGb&X*DlDfHEAn`4Ax44$o{pMOWL6kvYf+>T@gir>F38oATbqiNlOekfLnJ|?>
zVZv4hl?hiFG%OMs1UwiRSV3ksO<_=|>tJ4H)xf|I^o6a+uYp04fkD@Rfk9~k1B2oh
zS_V3G{ol2$?spfJ{I4xD^!(4XtnN1x1^yQp;_*M~f9l1*k;`yS|231DmQ9$-u%%`b
z)3OO$8FrwRhboZr5R@NS6cA;iP6)Nbgu3M)+36pbe-}{Ozvy+zAn`x6{sYDLP_F;T
zj(=?aAFcoB(EdTs4<n5~()0gFi|<kYj)uT!2#kinXb3<;V5HZ7Bi;XyR4_`8hQMeD
zjE2By2#kinXb6mkz-S1JhQP=O0qVB@sXG7NLF>5>Pz+lzFfiCC{QqAg#=NXX#(7zd
ztn;!OgWzQ~BEidQ<hYmBFfuQLs9|78P-Nh!G2m{qaj5^F;Pn50jTTp1jiP`>jTU!X
zjXIRA&fR9C(7<4$08-D{QlkLkGcYD7a<<ecg4s-9wi1}l3}!1MnQ5g3G1E%Bt;QV6
zHrH;mQD9&Jt2F?zpE4vU@-u+kHHGp2A23$@|HFpi|NjJr|9_?^{{Jz7k%0%azM!^)
zX;}jgTSIL_l86TbTdN0y#LP)o879~rU|^~HzM*2$SB5DQzB1@c6lE}&Xv$zRF_gh#
zVkv{o#HkDp6Sp$BOuWkAG4U&d&m>WXfJvqdA(KKGA|{nG#7q`tD41-@P%=4`p<;3=
zL(Sx=3=NaFGPF#-%Fr?SD??A+3#Mg7KkOMMi!yAmI>5j%=_<pXx=YT>n#CCyn!Yoz
z)JrihtDDWdtnLN#vKj`KH9icCIz9{xDfJBu%Pblg7!q0<80zOJRKVow8yHn!>;^}M
zISq^q3u-)>m(_4EFKcjQSkl1Au%gD1d07qrM}>w&2APIN28D)&3@Qx=88jLmGUzli
zG8i-}GMF?vGFUVwGT1aWGB`9YWN>Lb$l%fVkin;kks+W-ks+kXks+cfks+q3ks+aJ
zAwx>jL57T`hYUH*j0^?MiVP*qjtmvei3~N(jSLOV3mICP4>EK#KV;}>aAcU!z{oJA
zCW?7kjWqMJ21W*f21f>o21N!Dn7fCE|G1acNOR-zU)s=*zwTu<(%rcH=TlSfw9K!8
zL19BP0|SVzX^_`}(6V59K{8Z4K@QBXNsxii4D3BM49q>Sv`}NywXDXbdzpm-149j?
zcuE2T4~Sj@mrs<gsOeO$s9B|5fyl>9dqDZPX0djKO~d~m2`vl^4Qm=CYL;jOSR7zb
zsC^O;P}@@_Qh%>Xq^4QH!Ge{6IfUWEe#bTj2gfFcni@{#WezP2GL|g=|5!Z!|EGn6
zfn^Fi1B(;G{~sO<3^E}M0#>ywOd>UpnM7JR{{NZ6{{Ih1PKS+wp=Pm`h+`9jg$3LH
z|24@B6*Vc+6*UYBIW;XtA~h@;4vr1~zku8h5m#S>E)L4y7F=o-p!^C7FAD|^J&T+M
zhQ^!*29UdIvn2v7lK=l{VP;^_VPIfzY+~T4VTcl$z|6ql#PI)(1p{kHLrw!&4x}EW
z*0G5}rlpyIrG_OU52SXYGXui}7Kr+WoCbx4o(7p3W(APnEkI>uK`R3@NKZ|xLO{(*
z=4Cal$`vzM85k^<GBASt39`!~nSlkQ$D!%}ms(}-idvW83J(Usoi!ay%MkIvXaS0c
zhBpm7jXVtkmI{mvHS7)!J`D^C4eSgI6F3<dES@v4SZXq`fW#e|{=cz!z%;{>fsMg~
zf&Z?>bBKCSm{~kvTjRmNf70Rs`y3Aj{(}||IA(Y-@b9#EzzL!^T0Gza(JL(;h=AyY
z77v6$^h}Ef3Ltu-2Ll5qDDEsC2r#5PXJD%N&AhDU1=F&cU(Cxu<xNcoGdR75w6gsV
zX}wwJ*u=mA@-Nu`4DxR*k{J|0eh0-JC|)|C>30S+eNTYW4N&o#X7ME;bv4Q2DPX#p
zAIj&4^4Xz$b}*lTwMl`2wJw5zwdMjyJ*aM~;b2;3k-)$Js-wLB|9|Vjz;@D7fkB|w
zh`G&HfsHj$v&f;=n7PeTfq?-c_Wxs|W&;CMOb8-Y-=C=YuK_B?1QGksoT#|~rcN0m
zwgY0819L&GA9Gu+K2uw$Cff!OJ5iINp;n){&C-Fn5X6Vd$${93nl20=xmrb~wp2|v
zhFV4CwpvXnTT{8Mfsuj70@NPhfP^o|KOp}xuvQ(JqWJ#-$d69*8CdrxGVs)&U|KeT
zkwK-VUb><|?*9kt1_t)}1D`}1>KYh47_Kma{HZ^mfx&SegF?e228Ko_28Kp129`#5
z28LRXAd&j{0S*p(8Dtt58B`kT8d!EGGVp-%k%c0If(OIp1GS!yuQk^*uvo8TV3hS@
zV6X2CU~t&Szynh2!EkwDLtO($eah_$4~ENA_2)7uI_~?wqxnArL;cFv72f~<cQCM4
z2@rB~{qx@y)(aRItpET2(=eZ*1?>L)3^N+;GfZieXIRo`&#<DQu7Ssc;j&@Fe1?vO
zx(0!e*8YDXZPWjSw9o$+(y{zsNay{3Azjb^c`#h&g}RNkd0qoc@ooloheZqm4RsA7
z^-Eq?craXg3vzSId<GT|hD#6iXEU&a{8Qij7$kR5e=dW(^<D->hk5@`SSB(kc(6E|
zFtAqoOi}#*0T%8x&B_(~4>E8-!(OCjzA`xMLGJec|6jDBo`J>t|G&rvMg~wkNbEky
zzyS?Y0S{(37Y5b}P&?`c%)AMV3^Mx{LgKQf77~vQ$qWr3^E?;?3U!#lWtPN*T84&N
zo33TGHr>lC6B#5tSezC#)HTR>FkF&ssB2L0V7MgMP}iUW^(SlnKdxn<xOdpYAkk3Q
zpb`F`q0WQh;@kRv+@SKNr~XgZvhtS>433My@u}m%aPeaKO9dF;z=Pr9!Sa^^FusWg
z!^Mr|FF9a*3lD~i3(H@!!1y*E3>PPszhr{(9XuE=HkQ9+gz;TG7%mo;zhr2D+UMcH
za51s|PxrF=#h|qE_ijTiDBS)kHZU^CG}JZt>|O{@ixM8pt~?B^<wua?0VNKg=^qqk
z-v9qjgv7z0tI#+IK#c>J0}QO?6-1ilT5HF(tW*o`?+_0L28B{BxW6Mj7#IXfwc!4a
z@nE>n3AH~IYJUQn{SLMY91OJv!QisWgMmMXfwk-fA@?-Qhop&y{R}M)bqy&E_Zb#=
zFkFxY*-`)GcLm4}P+0*>Yu^9=`Y^DTO(5Fbx`qr7hVy5^<~@d*r^p}xGSB<}ADbzP
z|6k}gGsxFuNmqc%6;PUWn9IOp>HPlzsGidAV&D%+=CA?fWrw*80v1{SKUgndU;&BQ
zCNwbEcD_%rd2oQCHX+2I=DCc4^&4&$P~Fhz!_C6O#lQfn$7?tke$;w7Sb)SQ`f#)8
zw=gi(+Ior9yt4RVtNA{`VIRW*kX%D2HwO<3M2~(e15-^`fCZ?G(+AbV^B7e0TNxN_
z9yl=6JeD(X*vBB@!N9;#n=E5c>m?0p^KjI3S%cgE6Fs>(^xGI19Of~A`v8qP+zdRN
z5OZrapzh$|X7FHO(9myVV075Wpa8NTMV%%y#4H_d2C$qx1HufLoIL}`3>~mMC$|9)
z2h<L(01I0N2ZmZ^Ik4M6@)JF|4M1t%LXklNQtp>pfWjVDURX9TFxVy>VA$UXFN0+4
zA2=|8%70M$w_#{tXtZl!u=HVIu{glM0P6EtGB7aIdU=UhDljP2YBDctc*VfbsP+F(
z$W!)T+O1%Jr8KN!V9{=6U~-(tAfpWlM-a_uk-`89Ll;mww@6{I0EMMR3WGyUvKP4j
z(cH|yz#{|kPbe#gO>M1?LH$!bgZjBID(aVNgTrRRVo<x~|3B?^21dudj4=(b7+ApU
zc?=gE=P)Q}w}b5!&~9g7cAUpp<H5jaVY2{KhcRpcg-OFp1_mB>h#d{97&xGA7N}u0
zF{pVCZpVt~w}Ru52O_2cvG*kdI8GW?GO+NlLiE?Ln;6tAhs6Jcmkcbmno3}QG^}Lc
zfT;;(=dh_ww=t-BZt<gLsRcMaPFTsn0d~tu1_7A5n&nWrm*6$`Ej9}r7-}*h<~1*7
z;NX#k*cmDVGVh5&&C(}eGwb(SSk&x&4R+(?#S9$Hs~9-+=Yr#*17t@t$h}a#ApgL_
zaU}yJ&nPnpz|*NZ)D4dr1S~li7(+SO?3^4JR6<U&+39yO@Pq0%iv|W3P#Ul}#=vOl
z#USAQ{~v>X4-<oB4-<pKzQ0!>^@)v-&4L3A-v9qQfZfo^zygcc8d(!?e1gO$<8s4u
zZBU&LDp$dEn?*7MTSzjC9jKhBnX6m@s^>gd)xUz;Dxi7^l+GOXFz|rNe-8%ctKt7S
zY(RCd_y7M-Anvg~04uvDKV;yUz{ns{|IDbZ_$33g<01wDiv)%X77Yvv-v9qkEPusd
z02O;+(ZJx~{r`V$@yi3Cx(B50gGB>Fg7^RbnYIcH28o&nnCoA9Skx*Qx7jNEKcA>+
z|EK<yho$2p1_e;rXOX~gp!p#K4=CSQz{|h?I+mb)6)e^!46KD~VD197!z>aQ<SZ62
zFd)}Qu)Ns(uYmznHhVBISAuAZ1O|DKS`P;1OemiV%8!KdxuJYdC|>}|w*<KjBnB<#
z1wrL9NDkyi4+drl?Pdmf$Gr?9wh9dlwaPLEH3`OTpz^~~`Tv8EEVh5zok;SUAqKSu
z5P6H_{|7*NK>BMnLkt}EGVs(YScCP}8bD}}oa0^wnOY~KHjvs{O&Nn)XYY!dB#0Sc
zJJR8H$kZAcwb?Q>Fw}C{7}RP8SJWCo)Pd}Ro26uhszwQ7SFMm$o2^3wL#>yMK`kdp
zFGL)!55)~0M7kk>2sZ>&)M9l5NH4?<Aqn^Xg(T~4sYzz82uTjmN=ddeNJwUM2Gwz(
ze%yo<P<f+}1Ii~g4C>&qCr}(<(dUqm%y<~AZw1q`38^4`8c==uaD5D{`7X$54OH)1
zJYZk|<z@8rHc^>@!BT;t0aU(&>H%;a;K0C8%W0Ws@tlEYA}0gOL{0_{Cx-toYDI#U
z*(&_rpQ!o&e=VnnMXgEjvf41_Wwl}4%V2GjMkSCv%r6=>8FXqjou}2BaWAViV_sHk
z60|H;lf?n7C!Twm_y0d%L3snz_V8e_5CHj?fi<rO+1;|t3_Qs01(gA?Jks#5fuUC2
zNu<$}fy2^^fpMZI14pg9gPwjDxZfhukjcPO>j~-$u_$^lFo<~n|N9fv#s}pE4~FBA
z_77%z<qHFA9tTR_!x3Izs>nAp@PO<GwYO_#D_7L)(yjo787RNj+<%}4Y7>CUr}{Pp
z2giBfc032DU0t6F>gya^3F<G^+CLJhuYafqD!(RsGO&R1<8DU=4p868`~RN{46L~w
z$YFrX|K9)qYBt6-Fv!$1@POhM6qdDIQX;ill6n(07+5@5%=Uo#{xu9zA`{pd7#i3?
zbpV*n(!dU?lfY~aNVw-J;Ib3sUyvUgz<tA`du<XJ*b<VZ8Y~(Z>OB}tb3tM1!Ekgb
z$bLv%nz=Br=3JPf_<seg?P0Ni!D0VG1|MkOC&v0A0|(gLC%?hr2kKjSFw8EsRbXJ$
zZ)RYqi50F$)I7xCFqc81{_*b$aGAP*fy;wg_hL<^bj3tl1`f+ah6sp#rWY7ka}to-
zI-t4(YL^Vip5{jkCQv`{crYCK2{O}zIYSUcgY5EP&R_-EJE4|A!f_viPD2xe1jy`$
zeGLL0%#xKLwg+>Pszm|=mj}a<iC{hhq<`qaaAc)L0s|wY?lE;~RAP{@Nf2PD@04)x
z-OHfRkOXUwW$%Ewu_j5n0#pZp>Nc2LL3Ld-sIRTWz|tW1|4pJM1LH&`1{RRJJs6n`
zLFvW&|2tj}#&FX{y9SxYxCV(@TaSQ=TA(rjGG1-dz{Frv`;WmQ`42-v3k!n>!-<Qw
z4*wYvy%_XBWy?Y>L>n_ylf^DklYt*3zEO*T!FmA$mqmiQfCsbcMf1J?|AWSxChuq9
znY^EYWAc7b-T!{02g8-4pgyC;d<GQ{2KK3-ext>FhCB}j_D)b=(Su>8rU$d)%L(<M
zaR6Ia4@TCB9t_udJs6I;dN79ddN43WS|l)tcrdHxLc);Qw4ts+$Ae+UM^N}X&SQ{(
z#<hS4v-Z<Qy9R>^nG6gKbqyvS3^UHwq)1mfHi5(4!eRkKg9n2&DE--ZFdS9|#ia)W
zr=|yET&@ShH%;&V|Nk(sW_b{it{prW4n4I<`2Wa*;k~H`XcC4s3pD<41D1Ym9G)^H
zIPo*=XM~ppIyDuLJ~t?SKyI#a7Ot>Zz+mISz<jp(UxQ0?Jp+UOY;akmP@f4YhroW^
z$H3wJ|9`Iae^9^m|D8rB28oGI3=-b||DJ5#*WeM7%%IjVuffM+0Rv0@UWowvz5joN
z?`2T4pZkx&`p@r#`k9X_CO=|eu&DVxV|wLp0qdCGDw8Y!|CwC#I{{?Y<a!2?$@L5p
z6XO|J8l4z;Cd)I(OpIsHX>?)`XjEe0m>ADsFwvgD#DjrpYQwyS0E-0-3KliL=XfwM
zwSwFa(o^FiTv6|Qxng2GLkvjY#CV2;$%_~aJQ$c$Eh_*2sCT(sQNI+_|9-ibfi)A<
z&w!6}AeUF5yax&&P@U2!*T7QW>EPfvmqDS?lYybWO9C<`lnEMBVGyv?1c%E5P`Ut>
zB_1q>e`*yNmVw9F6c|-N<y1`q!?KV}mbh94MwO7{{(m4b2G$ICdk>VSu-OkPpF!!v
z`~Q!(pg3^Y$Dq<^&%mJH3638QaQ%d27m^z)7+5nvWeZ;adH?_E3ihKWs+o;(4J;tP
zG-@$0Sc3Ai76XF^i=hewYX%RlbO}<A6mBeynhXpz$sPe7ECz2FSktc%s}GcKJXj1s
zWe(Ww+Re<*LG58s9SUj_JMLvr@L-;1XsN*bq9)mUTK(gn*R20DeyOSVo(3AL@L--M
z3M!8iHQN?|<Si8#xa$9VPpe7(c@5-74;BMZxcmU+5$L$-Oyn_04+f?)pm40IbzW9e
z;|w0N0L7QZ;{X3GTK@m<VPRkdjjPXLWncuAH6S@1Rt5&&CI$u2Sg^%mG<9qYj1Ely
zzkt-i&0vL?;n4K|hs9FtX2R8`GBD~iGcbVctx1pw^lf8MaBTYj25eq4LNCaynq-9l
zka$3gi(WuWgPg_T|9>=C8CV<}7!0PgF|dH#Sa5)Wxn_ZuNX-F*fRF_r_JQUAoE#W<
zK=Muu|Nj&$Wnf0}&oKt(Ic*G}as59avuo0%D?np{HAjp=V+%Yrpm~8th6N$ZU;GEz
zXVLQik7E;q2H2jL%*z~_7(yDJFtD_;FmOzG#=tU_4csRCP_UGN9qKlL78V8;i>3en
zOkrbSL9x4qf!X3112f3)bJ)Oc_yKZ*0s{jJ$lV=J7+5S?7#L?fV_*UG^_&>~f2diY
z5dd<FW7Gd7H7}W$dH?_40^-*k))J{{0nfc4yUnNJ$^SpCEdPH@c=rF#RJQ*=KxUx2
z?f)N$+y4JSc3Th2|NnE?{{IJ!`Ged9a!=2b|NrMagNPxyV+Yh7GeG(s8W~hj(n%Tv
zBglWCxOIf3lLW}z7gW6rSbg&U|2@nMj5Q1j3=T~He}Li=lup5R=Q=H`>2X?Cv({-@
z4YLM=L(~5cAn{rbre!th(x86o!<r`+A~lB@r+EMWf3>E?LZBwuP|%^_|Cd_mxcd~v
z{}(`cqPBrSZ2}{M$;3tmiT#NTGN62C-SYpx^%4eF>qG_)J$VKOkiCwRAZ;Abc(}y^
z1_2LdmA4_uY<6>M7#Klv%?}wkI+4mM>;DXl^>bc0IL!Nhps|rb!ZMM;pthk=!GlEy
zUJiou`FwESS;T{3;#5$Z7u1jKsApg($OPp#2AfWM2F99X?}|=)1|}%Y45eA1G%JV(
zxuqtV;X+6<|3B~;P67i1B>(FqFt8?r#<)*_{0l03Yf_~v_b+77fwsMDKy4aWS?18h
zz|%0Vfdgbl!@LF-P#X|bCVMdJ^MYtlJK6jHe@Dwi1`7`s?LQU?|Nn!+o`E$9=NKo*
z9We77?HYI*GC}35_7Miwq%Fwhq(#F2|Jdq<M!N<9Q27e22Xq?a8hAi)(&)v&P~RB<
zYQsx3YBHEuBr`CA)Huxh{{|!vve$z}JBEQZ3FLpgb1R_wuX$gCKw~Te1E_CO>ls|(
zu#dr`d0qq0gjxoM2{qvMjfe+B|J&xe1`%leB+@X4fuTMb)NklF^k85x0P(&5|2Bol
z|9=9SV{7DOFsbhVyOXDu(;1XLKTLkfU;^zAC``0xkO8^3(UyS$T<5cB&0%0ooH0f5
z{{~o`fz*Q1>b{5YcnblgRZzHEBrrHkY-G>?`=PEu0OaP0)(i|2Z9wCa&p168-u?x}
zo%jELp<s7`#$_J=uJB-<z}WnofdMpL<FF4rF0TL@-}PYFS!<E-|9}U>)3Y87j88!A
zN07L+BZGw1Lk12HhQ61ec9lf}gQK1V$d0E=LG43O`t@Mgndvx*K?P)AJ<H(=@BhCv
z!FKKgw+9U-{{gArDO(R}n?U9UG8^VKn1I?b77G~Iy#N0`3sUd6k0A#nZf(yXP_KL%
z)Mf+8ZG_4>fW$y%K=sUoifc5~HCRC0vEyMwU4u=%%IOLZh8<TM>KYtC>OB~CoJ7_8
z%d*j)!2pzQ9Op5V=+A|WGd9cv&Al*iG|X#|0JWj&9`CO3VAkOT(+s^YLH0S!V{qw=
zXAmg#1m{(YPJ0HyT2Jqa&UgkP(6~rvJcBTl7J<^DAUaeNJaz{fmo91k&tL)?7i+X;
zV5pz(0h-GL&1Y$NFl_(n{r}&ZMjJ@FgSyYagP}JUY&Rr4!RZf_#vtkL$6kos{}&z%
zkTEU~hMt*_{?PVD4+aJakY7P@0~$y0YhY3I{{O$Bv5`T;GLazw)OUfDQ5rl9tnm`a
zc@tZ{Z2s54(*SBeH-p<}GL6chu>?pP8q{vHbO87FWgz)b{R#tX9LgL|O@=heTpK7Y
zgVHdpi~#w?aUO#PXlx8L=icbdpi;}?44w-C^~XVDW6-e!1&|$}^238gJ%@ocE{2fX
z(d+<^4K^w>Xn@Aw;AU%r{eo<^00V0r1FU}tDoc^a=|STSFh4ZZHMn>%bRPuy0W?Pe
z3M){UfZ`F9*E|>)8XD#`czFN+&IwjC@Baf228J9^`fHxo;Nv)tfdiC(LFF1~esdyt
zj-k7-c^^{QGoOJ06lWd`U0Xq8Ck^u%7`*>~+X*&r-~T6|w9^<5E+av0c!5T{h5%@s
zfa(Sb4;D2G2G&@EDT@E$b;Eu|1{qkr0P_o)+d=75!GmFIqz41T98lR@Qz>0xoxs3g
z?a08<ypn;T*2cR6R3?J*oA>{pognu(?qd+KsAUiUi9z!0w}Z`l8BDCJ85lwCte@+_
z;4tt1ndbcr44^ax%D0Wq3<}WrRRo){2b_KxEFBn_K;`8`PX-xK+6S?{|NqMcg)h{c
z1E913siRaq7+7O)mjBrN=s1sIiU&i}-sXJ`AvM*~70vS+B0yy`DDE8RF$jR&+bIFc
ztDrex5f6sWo0Dr87(n#|OdV)02{eubiW5-$fzlLc{v9-a<iXI%(mWsH&xX06IQt47
z*8q)4f&2i9^ZGd+4xl)9nD_sV_y7MpAoJBKEex#D4Wy)PhkXnj4RsAMp#0&%q7uNs
z8odBnKPW7b^EOBwEKERsrHP)Px>^M~R~4OttQU_y7D&HF`2hoKG$?(6`!=Bb0-Ene
z)(5vMu7Sg$iGgQA7N~xJta$*%>x3>)_<X7b<yVlIp!7ERC9G|u+`zyZ1scNw&q;vH
zhmF&K#%y3_gTmi~p~JNKUxP|bEqH7q22`$l|Nq<zPFMRFd_d(rC@*>c|6FP5z`y_%
zU(+zJK>;eB2+BK9@hKoN(0Br9jNXG;>S0Y5c<!+V6o248q&>*pzYaFqHE4j^J2lA+
zCLzf;>%9N}KH883lKa!!7}uZ!>T^QVRRpMx2aOYf##7+!oqY@zpn4EA=HvbU-%jZK
zxdmtr5tODt^N8O6|K)(}1-FIf{BQ97|I5?T0o-5b0L3pT9zo+?khoOx@c#d+1{RO{
zEes46$^ZX>?6!1aU<CC!LGk0ThXJIQ(bVhzf6!RYQf3CGT1_Vr@BjZlgetSxg=)6g
z)oMzKgete#fznJ(rj!V1KFEVb@eORP4oZJBnSrq&^Z!5C+LxLH2DOl6dFa?cB+h;|
zEDjs(8f+G1GBD(1{{OGv`TxJeJO&Pn1pfaa$*gu6$^8F8ZZJp&tud1n2uWtJvPfnS
z@?cR+U|@~dfU~@Yt}Ce70~sF%*|B&f14I5wgdNrk`2T~-D^Q*3{r?kh!@LFui+Tn&
zkXZO$Ry*(iAAf4k<^S)nk3nGbd<Iavln+$TS}HU$Y~Ihnx6vLfCbW4zg8(QFJXjQt
zFtA3*!1^DcG;6VdgALU8fR?)^Fh4i%Yj6S85zTWM80woJgW8RjmI@4v^?#&9EFCx)
zYHg(TK<?NW&%k8qz`!;$o`D4v?=#~WSS{)qI5yfduz}p`{r_Vqs7|R-;jXZ#XW#>k
zS%J#1sVWRS-v2*>%w%Y;YY3QW&mc6@o<Vq~J%h+hdj`>&_6%Y(?HR-y?HWQFV;C43
zr5PAN>9ToVLqaWAP(`h~hb5@*+i2Gi0TKtLV^BDN${P=c^_HME4X6$S^(7|CFff4Z
z1iN7Y1B*pHgTz!7&{)!koei}N3^mO^0xVh>WW4`>e+cR;d9cXOU|<dV0!yc$Z~~=E
zXc&pW!U$BS!R&V2$4~+)Gra%5^KFc4NCD-oT1|-n?M~qihq(+9&HoxQK=}leKlM8q
zSit4$UItK`F~@^pT_>oW0m=s;aZug@wFN+J4DbKH7l7nId{FrWl7oo<vjL?$4;Hx}
z46I?GF-&+ps^7xEi>)qgv}-7UmSZIoIvE%o=CZJW(%nK%28LYD|Nm>*oh#t!`vL#|
zM!SZJ1t%F8a!w-Bq{RXL{|l8Fc=S72UpmfZ5Lu|qAY%QPLCm7%|0_`1%hme-U%#sn
zTt8VqX5h1E`Txn%f&ae;1A~r!3xlA;T;>U(9ISTw9sK_t=P|b|bY|eQe#{`WP?<r%
zqUHa)P%l=ykQc0W+F*GG3GFU$`sN5Z#cEgI<>273k2yfUlY_0MR=NUIXF=?1Fm;^A
zI77dagTY}Rvw;T#lYxE<gS5k3#-4?celerNK4yu9_6$r=H9Vd63@rMc3~Ubjm>D|l
z8CXGa;;@hD3n;CE(h4X&IqqY6Vja&Q0qTpx+7zJl>;3;-BREYeGH^iFtugIcXwSf=
z-^suTs-yKg!D|j`JQ$dkSj=T$1DDqeIM}S~L22&yM@t0;CQ$wWwOzn{`g#T-P+qeB
z&%o#X|D7tR4*~6yuz3G}Cko0(Ap1dTy#K#rt#5f;0V)$9Zh89^Z2nA8`u(a1@_X~V
zh5)!9<}oQW?`vp)wGABSF$sXpnh(i~-v8fjZM17h0FAdc!u`Ye29z%><}+|W?0h@1
zxvrrF)LsDb8>&Hd$lKcHe+?ZVHmIH9{r}5SaQd|Y_ahl5+Jfp*#wDP5aNG;-f7Mtl
z0JoXeK*Nf~VIG49B7PWT5b?txun-(SY%GrRz-!2QJQx@@fYxqV%x92*`1{S@hPs9c
zjmnVmR8ZcxfcxnUsQ)zu;r=%l8|@lcK=~6^Z-UmZfby;f1H%Pva9Uybv0y&~Q+<mD
zgTo%MduMnstd{g(V0Zu;TM5--Gt=*4aB$eia3NHa-A=ocfz@#@!x3;iG%#?%+L|DD
zG}JZB@nBd5Y8NlDNMzu!n9l&3YiIHP|HiX1uE7Ts&Y<xFP+uQ32MDe^=YjIne^6Oo
z01BT%E&KltO$;fW_6(fbkaT6D-N_*6u#X`C?3a25nFaS5Bo@qP5Ci#R!F~o2i(~(P
z!1`98bw!=_3?llS46F|G7-Tx_8AL(p6Y9PNpm6kHSY-)mr%EkgU=3oKqWB*^pHc9V
zfpNbhg8;P5(}DH(Yj$f_OlV}_sJUefo|kiMVi2%YXOIE4TWXy>*I6nsxHiT$ESYH!
zo-<~cY0tnI@|VTV(w0HSx`BaVqdfx?DE>g@qeVS<yvJwrd<HH{P6oz}_6#hR3Jwet
zxxnh!EEWF$pJ~s)VX43%IMbei)BFExPK!oxngo^M0^a{${j~VYz_B@=K?D>Jo9h|G
zEE*WNHvDIh*gT&>%KQKKnU;wR8a2rhKQ`1eaCxvu?qOgJM5+JwA=X=()XY|{1eNVI
z+q5fct{Yd>{IZ7mQAB_C|Nk{L(x7n}0Z^S{o$&vE^SlO+hItJuK=mUiUsy|l^5E;v
zX1fL#P+QGmAH$O7eGM(3{0gcoEEaGuH2-B_n4HM~T1V9Ya`WU)P+t0exBkDBNZqsD
z74`0y!Fd~0F4P^}TmkM|*fKCQ%w%AwcfAa%LuG0;e*{=+GRV}lc!_xbfB6-Zw?XYg
zQ2MTa`2&<bI_iJ?5&^YU8|@l0Ky5GY|Ib1BJOxz#d;kBz2%3-dU|{fQ-pRlKav#WT
zpmN0f|Mx(U-SvB=L_qd~#9;37{{Q!3LnWxbd=XGHLrKK@|A&nrJ0W$ZL_nts0|RKx
z2vl$CcQPo!+jILEctB&vpz(K8*Z==P<%Gim1`Ue^42+<8gjyGmb<n(^pxwow1e)Um
zrzK4WMw6xg|JO2mi8wU<zXQ?-s`F-Qfcgaz3=FLP0U*0Tc7p0?P@f(&ULMNoW`|r~
zhqATVf#Nlk{g@qS4HKxJ52{le<~6JV)vK^N)q`1TNlhlWjqcN_$-n@rw=6aPUjU7n
zXm>JjI__lv&0~S*Goa-N7pR@-!OS1qz{tQ8lEq?I>l|DGYiEMSCP8L^#6WE1wy6h0
z4QM?od_6W~O|u`Ue+8ct2j{5<2DN>N@zNOU2MmlLzkt#rXxy!N5d#CrKaF+`4UKXQ
zF3oif8ld<FrMKp|27`&w3=B|y!o(;zTLqLh>i<75XtZnC5vs{xGEswp!Qv$wL!(^7
zo(V5NY#xRQFBn)XUJ5Z-YD$3E91}GdcpB{*4m8R&w7~Q<+BI~5%=iBPF3|h`M@dk6
z@&5lo7nJ^sUor|8|7YR=t;O>G|IW~Zfhj?^lYzmSfq@Y;whbEB^Zx(J6O?x>n!#nR
zgZKaEs-U^JrbP@4ljT8mNb$y|e+@@!%A_lr?HU{!%|T-d;Qnt3xIUQ5pa3dQy#GG~
zt-n6u!BBP5gPFM#)Gh?2^@h5JGad|8TRoVWOF?Z(sMrM$hN^`g%*=_6b`2AtVpqKX
z{{!(WHbCZ+Z+QRz7YJ$}O}fs&020%l!@%h{mvM<hAA^PCBu3Eq!vs*-3u-HX*1|Q^
zHQe!FV2Ek7Yw$r62aT_Q+S5-!<9{IkdjEf(2nr*IeT*UA|6f+>H~;?++J^#4`(W{T
z;4#rR9t=xzLG7xBx`r1X3`-Kd|Nq<3P}lImgJDUn_y3QrAUW+h49uWDi3bA*Xx{(N
z<dvW@<!!A8!&26oa_LIPMGPX||KDtEsB2{KU|1sS!N73C`~O$fX1fNCMoUQj={S$U
z0+g4%|3B^p^>-WNAmiSkHf%!{ILtxo`9(nLC;en#fYmdgHm!aqXl*5f45$s|IFF$Q
z)c$dp_rGDXG{_zQ6q^4vfY#qLfckrm`xpWm>Ka)<V`|n5LF2iLw>E&rUFJ1%fYOc!
zv$$eIT_X=@tlxv7BC^r0QJ?`T*RYa-!Gl?xv7xRJy5_#Z()<7Go1ifp4+aJw(71~S
z1A~k990tb8QVgJRCz(dOh998t0L2N2_F!OG=>7lS9fvvp&NSLJd;y6e<an-n|NjS?
zGXafBM$|Tf=1hc37+8Hk<8JVA1mv;>lovty53=^9!WT5g;Ml~V(g|so<blTDK=rky
z0|PUt>;mN#4;En;Q27HYdq8b@Q2FD*z*fP)>J1uqM~o*Rt;2=c(`eTK8dKqE=wx63
zm8qb1ya&Ug!sdAmpf(0W!@LHOgryCp&3ho@bKd_yHiG+Yf2BlfZKd@r6*xd@BtZ4B
zr2+%nOmLmcz%tXGfz?uhff>{;1@+$`Y4q_-(AWg5-{$@QaVKc(0wiZq&miRe|8ZqQ
z4XB<6*V7U+?HMFNeW{uD3{s%})J%H@Y486Z1VQ5%774-~-v8f~LdOtPc7xgw9L&og
zV+ijw7+AgLAeZIX!WiUtXue``0Ii#;YtZmuSm=u$mfrv0fyVC@pms81%Kw|g!0Hu&
zt8b1J)(p+y`uY7sP#jt$Gsu9}$kp$W5&^lxQuF_R?M?<3$GMCmjdBefp_&3#wHh9J
zwVX~OwVcrLTLlKjhItJ<p#HM;Uj`;no$vksp(1GCiTD49Ya2lEmdwBis{f&Kte`jq
z_46V9fd^kfYk5H74w47u0q}hMQtxRV%)(zmV&4BBrZ(C&sDS36Kw%9s3*=5v-wh-W
z87C4xSyL}1Qu9|Lz=MGy#ZrNR#o_@23&>rdaiWEq3``qs8JIwA0!sx3kQ;PBa^N&!
z%fMs--b3*q)8YYxum=N!3RH~&R1H`!RE?{}18~3H0vgvQptK4qM?vWv<o-sx1_x05
zH=JZ(fW-f|0tQx(6Ugn){fdx%D-#$Qbdci10Tk}_EglRG`<ON~*EO(!`uU)CEvOw0
zvI8vN3YMRs4O&+}m#Jf+G6O@+9b@oXJWxB<TJ8ToP`lW19uug2%m(eVF+1#Iit%7z
zC;<7*dNBhNXdX-XF#{XO+zFtuW&2km^_?di9Oi(>#auw;mG}SqN5SRwJ_Z?!S_TeS
zyTF5)-LuiI!2?upfaX}d|NlSIz{sGpTM@hmO9K=Z-v9qLXwPI|bePNdWT7$xQ}ezC
z4NzSI>N`2?V{icV6&mUqLO^Y0(6|9~e9ogWt|4GSCup5L14BqlgB++G2pX#lX-T#7
zV3?N*Dg!M!|NpmiVBo6t2%aYE#lThH0p4E)TC=R|!7%qDsNH4hz|>Xi36f{(g7jm-
zeXR%&hPgjM;To#Rz5^7tjdl$&4*M8fz~gyx4L+bYMPpop4X8gj*$dQ8VqgGm>eFsv
zU~H6Y2mqCFAig7Ho+!bCVeUl_28K6{vJ4EMekRB*j`J8kOymUX<!ZERNU@&t|4+j_
zNLv-0-ZMdU$1B(7x&{wW`_^JU0}IIC^{tO97F2`Q%KZOdtL%9VR5vxoHROQC13~Qi
zJzgT9@j&nY_wF{vH57otuD<gHD9$)0uL7C*hj+nk28Q}M1`ZB;7;+lw8cIAE=5m6{
zXAcGjlZLv68jxL}zMu!gTuD%$6q?T&LF-`}>KYn680Osc{{Iv-CJP!rsQ~#G6rK%r
z4J{rFbM|7!^UFJ+euxJPuLT3E>jQ%2TwFs3$ldTb2aP8|=9?Ly<z9~m!yND)Amlp4
z`~OQ&n`nXu!yHR+7|v_R0FD28|9|lpvkd&r!ocbpLMYEQ)HO`;U??mFrEyT(1d+a3
zBSB>jD1A57HO%l}C=6_#*B}E`CxWET5Ilc9hk-%6h50#X9XX_bJbN#w90QHfHP<yP
zX|!ut(7dm~qT3oe&KK9PLVqR$18DvSoFC>fcr;2efa)&LIKY}vwqtgo>}__TtZa6n
z9By_V%zQ6F?RjW<*WmsC_RWU6hAp76l-c&6b*Qs_Js225z+)c`3|1aYzf5Z?r7Im4
zG01@QfciY3^@862Z!d(XXV3tt^<esGYcZ375j4L7k_V~v{(rj`)EAj)&rt9E|Jg@S
zyRD(FVTT99td|XS4SPUs7f@f#gJIUqhItJK8dczJER#mNh9ixf3=H}m;CV}xMk@ve
z(7Zo*tu$AF1#B#!p|0VC2g5Ar{OK%5P&*dn7Y~M6t<C=$E-aYO0BcWy_E%mBY4OnU
zV3?H&5^vboa0Aqq1B)@ey9=6wwSE9<OV9k-Xx9Kr^LIdHvIoN~%Z9p!2ObQwI2-L6
zo`CWns6GefQBa-)rEBm1&klmxp5FhTwSvk)O9uv5kl7$PP@faj{s;9XK=mU?%=`aM
zUrPlZ@ZO+WW$$UAwt}oC4?|6+1gKx?V3Ewi0BUc8>KxFTO^{yi|F^(-22@^JIxsPS
z%1BW8xX}|_KWKRW{}I8!>g=Q6!r<aFk3m7ZmBATIw=ul-naiL6YHNYYDo{R!_SG1D
z_kzViYcd!?YCDxdV}A^6Aodi+{|8`wMo`~j-$VGkqYJ2hXpsBA0@OAImG7Xk091E?
z+IZgoZ-M$1;4%y}h664$=P^wI_d}p#Jl6G~w)U+=kX~q-V)6ceD-fg}RJMcWB0=k+
zk>o&ab{<eTfz~)%$1~)B;>Mx{v>xG>BxoGa`~S_>=DG#}aNgR-AOcF4(7DV8@Bbfq
zJFTJV3sT;SfXwz_$dv`T!D2qc8;~Ep|KB_da)Yfya#NyLa5Bj4j`J8)KyeAmtKR>g
zfbxrk2SaWrs156|h;fbw1LGF!{|q0j89?g;9*I~xfanJf4txHe0gZ`icQX8U-1q+g
z$Y0j=ps`QJgpU0TjMk|PO!f7*MCxZhaB$qq=+hY2AXBqfyJ9mJ0|Q8(ekTKu<2;4}
zZ4f<|K?T}>umFw6g8Ct#I>%ujBWQk80X%Np$sp)BkD*7ulR?9A9s{UO;&s@^@CB5g
zLF+?6<1wJM#Ykg;H!S8u#+khT-?-|*z;L43u0f~Ml7XS#{B#A#y$<^rw&=Gq$UE$1
zn9)$zV9+oRw0@YO0kr22)RzO5`=EVk`mGEs4*M878toaFKx?2qK*Jw)4Hjr-W$3pu
z*gNcH@Bx`+ae%?0VO|4hzoNYd!!(fnCZN76njRCV{h&RxAp2cF=OI`xV37A<n6?nK
z)&t}R(E1PW|2G8dBVVqoufGi%4{89Vcl}O=JcoS@B9J`8zzoWJpm6a1|I5%ak-@=(
zh3yCfs{?5LC3vkFXnbV9BZCBVJkJC)7KhZX3IMe;py`eg(x;dv+Z@*r0ZJPd3s~PZ
z|6*W(lzrDh?fDq+c+unE72f}!DuVkL|D{AgX=$cCgN*fl2AP@m46@Mvg&ef3l=uFB
z)euzXgVu_I=3=I|Fo=NC=7xF(6^nWX4e$TgHKF35z6@xLPsjWJby27oD35@|47~qe
zXM~D@#-~AICf@(Ay#>t;f%1_>J%a^kOw0TKHBk8rGONL&o}t70|Jy`M1%~9A_KX~s
z4*#2G+B0%P#uynvb7u^lHVjNN;~7D1f#8|(j9j5w2lzT|7?_*u8W=(~8|1+2YhoB!
zYqf$aI&BzOLNy)qKw_YFqWAwRp`bPsDDQ#%1lq$mp_+lgq8_x5>{=kGoVR$u@X=xc
zgR{i}1{Y9R)~|dKVA1gZfBjx75%2%6S{vpyq*x?y@9_Tr(6^zkA;bIsL&1hB1_n@l
z;{E^8Nys=G%MS)tJDmGJkmD5876$dnp>2j74~8kAF((n!Hp4?uT1|oUl^%fiHKWS^
z1+5v}09yYADl<XrBquO3gzSCDz%#Ltfdh0l1$0k~2&kL{?RT+a0M#`N0<|*E6*UFY
z;Bizth4%@T3Je@chU^?O4MF=6*w%p73xmcHK>G_i4H5ee3bhy*LF3Ax{X`ZC3~U|@
zOd7SK&K0%{?-Rgdv)`>NKx@DfIoR33dNmMw6EztQfW`-F7}(a>D!flf)MRI!=?SrK
zM(6+kAaT2f_X&0m?-T42-Y4iWgWI4Cp!yLs9+fnOogpcRoh_-DowI)K0|v)=i~-;^
zYV#O9>T4ea=+9<gahS`%VV%IhVrl*Vf1(!yW2mN@8E9>l!z2ct`dJ%5YXSvoV{eJn
zcY*XXa3pFnu;@-;U~ueX;7Qa3_pvNM>;6G|tt_J%7}4gtWomxC5~+Faux`c|h`T|1
zFF|`3XBt8I4;TVK{_X~anIvQ%D5#G2VESTNtjWL%nlEse$G~Iy9=u26MzJOXi(?am
z4M<O?F(RxAwHR3HA26te|Cj$)sKvmf{GWjdbk>IT0|sVL95^(A_JK3V6l*dtIy5oN
zaqMFdDAr<7aA;z1v3|h73i50H-diG|aY~1I|E_?-%VFNXGj)4bSJVp}uBiL9yTWl2
zcrKp<6t>>~|7`%Jdk+Tiz8ppmrq7)qz2LC0hK7Rz1EZ<t|NoAQ{)5kz>G*=!pIa;S
zN~GpR;5th$21f7y|L<5o0Pl~ev3>xmEB}`?HiGy31VF}Z7(uIOLF+T%YcFe7YFB{D
z^Zf_m<)8{Izc}oL?8T~CqFv#^FcGvLYzb)JZ%wvzMa?PWiduQ+3WvE23LzbCb~73o
zxMwmlaD;TU*v({Q;0)<F1fsb>W7r`tSnNP^R-pDBsC)+X^F0_QT!fBwYt*dd2nc`7
zW@oXKfhRPD&n8rj&92rxxWfDYpShs5v5t!v3>uXf!2Lk*zVrF;HGwRk^1WeR18A>{
zfCs~bT9BEbwK<@(bv#%YKEU>*fzmyw@0X~_&avN-fde#F3_8mLmJci)82V>=g4Q>)
zt+7u4=S#-qYIgpa){yjN|KNQ>@_%*#aC$-7a}JvKg6{jx0GH`d^|lW06B51HS!ROw
z8L_Pa#Sapj6~>;a1+mkEIa?IecC=Lf|KBEoVMapow1!$u>1m*P*>N62My-~2g$Dxz
zsJ!3-%_D*GthEC}3dlX(`xzKud!NHsvD<~OWU~XE58$}(e?g`ucpQrXq#l$X!uPV-
zc`$ucoxLC8FY_pHe%Ryv|Gx_;j1o23d0=4z@&m|EiC*ly=<c;tVE6zF8<0Lr2ZjTQ
zn(XW_y&!jWaxyT$_TJk(U|>t+Vh~PvE>&MY$AZCeE(1p*7Xvd)J=6?_L``-!m>4J?
zJ(&N4=BB{oe;~Jnr105*#%@4!H8two;C;?>)fqTIbC;G3pgiy^6EwzRsQmwbO{Sy(
zsLc!-PXWy}K;-{|_hx(l|MRC&nb8JR*7`NDC^RZFIv}xKkk}qbY#$_c0F2GRYJv0I
z2UuPLt@#1<Awc;7G`0d-&kUOH1g+lzop%Hp2L<&3JedF4FtA!U5bO`zHGtQCK+}gx
zqbCDPeRBYV<DUO-8a){}!0fsIAArt20_71<I|O8h2lL-MurWT+T1n8Ffso`jJJ9;9
znmNi9HT%K)%3Hzh>Uj(*ps)nhwV*ME`e(l@Kx0&}Fa?bZgW3w9bu^$f2_9=^{#!zX
z`Km;kp93?0qdjQd|Ns9U%zs4)oB!`9k>*Rl%m=M8fw=z<Xbn6#y@A80Ub+G$eD;FE
z=U*y{`Jnxnt&c0}m%T;{pT9>yVFNW6v<8-txx7T0TY+RQXpWkIxqr73X)b8ry#&O)
zzt=FZnu7L0?EtlLKyBrH3*mi2pPDMjKE9f1%8>Jf6dAaz85uaN9y0KN`h}qM4jL!c
zp9AjGUudpj;ApgAV5y(&!QeQDVTaXj2FCFE2Dz}U4RZDKS1>rtVVG0=lAXa}5oE2p
zMFRt0-P7F_-v9rGb}wY$3E#_L04}>27<lyOg3U|;wZrRGPgj8IPw)SKdqK2C0|Qe%
zD`=hj-`a(Y3|tEyGH}#;U9JF)9YOPoPJM?5Xw8C5BdD%#2aSs|2<T4(t^Hvzu)6mD
zzoi#wP0IfZ*8dqn=QE^OSO5PHDj%EYfX2%H8-T-yfq?^LpJgJ0hX?bo6b4okls(wk
z#_B=iO`tIWP+Jm|hd}uqls_kQGO&Q^SkSzO_y2zr8j=}Jpz+ny=nUEa;5d(=LBH$&
ze^5PI-=zU^e@3G-0}DdT03;UD=*+-@5K{n&IW#&m@F2u2Kw>(L&I|$wG0++!28l*z
z1`&{$?>q*D`YsO#5N(kR>Vy0*0hJ%1GL(VUcuJ!(sGZ*+2N`o_0G(BXYaZwUC@nP9
zHAr|c#JPgjT!P9V(7H<x=AR)jGaHgY=hlG6Y^5q{S{O`1T5i^5G&3+l?K45%6Afx}
z?{j2OfcDv9LgqKffy!7=IX1D8K?YQYf!01J|N0M}1GZLV;J0RE;IVqhz-4uifx~Jc
z17H383k(i(7;8Xd0if|C@BjY|LE-H%k1-+q%kerr5e5dwNen!oHkji)MjwzGiv<jP
z^=hXpKzh9Y|2zqzq2dhnY@qb^^WZ{91|CbV|Nle1SnRaB{{MBH%P8P5i9w({k%2$F
zn!zBvn#~TXhp7&<t^vH?;%6sRjH~Y0X0Z9;pW5ua|Nkspu#kagK_df4_~&*1793>Y
z0@+#TKDnYUV|GPd=VDOaxCw3_H8JQksxnA`<UwXZ>m|iTTgDX7x@Cts3@V^C;GnhH
zFf|?w9Io|qB*0_9ptew>EhA{G0lY>HrUqsXjPL#bUnD4;9QQGR_jG{vz1A&T4R*8l
z{~udH=VL86$iP$QGPz>GLk6z8)Y%ma85uY_6&d(E7}_2}^3%VT#zqDi&^~m~8WHgR
z2IlYZy$zuC5#W7T_0kof^xde;m{Q;60ov2fG0~YZ1(fGJ7}zvHd8uJOgbzAD1eBj3
z`RDHy4`$~HpnL;Lr?np5pz%x|P@CFPL4aYRGlRlJWd`uRSVOn}|7%qluhgn}S2Qv+
zC^RZFsDRp?hM;pAI2f<goN}(HdF@?cn9aag>%}+)tT!2=7nEOXjv80gq=DB)fX*m+
z(a6T2(5S|s0;)HRm;V1>-@<qWW>$Tdb44Q?14I34?}|n>29}021_7A4wVE0NwH%59
zwVDwkwH$#W_00|rj&m3+>YE)v^R)tvYz!ixGRtuegG$ZP2$7nWK#>V;3<{w9GhrEn
z%0zbthKcFm^~DmF4*&mKCj9>o5(AY}AaPKg4Q~Tskq70oDT@CaKzR#P)`Qwvdk->L
z)Lb^Ms8QptnApf*GJ%ny1+>m-su}}$e4^%)bp<HTfzD&A6$I^}`UV<H6S1ylV9^s|
zU<j`ku(EDo5D3*|u$Y|4paJUdSurw5OjKkLv3$tDVR?{2piz-Q1D3Yx=Xikfqz|Z_
zVQ~Od-hNvMmur1oQODL?;r;(xW}_m51f(2ilqghZV6=___v17|H5sfx=hN0|di<zU
z?yd+mXR!m71IFeIjP+uSQ$S->p<3)U+FjtWD-TdU0gXq4>;l>2{r?;ItN@sJ?XhCe
z9tuY9|6jj?>}+ae5C}D8FjF>VV5k>ioB-P25vs{x1|A30WVisbt1fvqsBb6I=*S>Z
z=*a*Y2jHl4o?HQ{k3eNd?el6-o;?Z5Lk{~GA{q`t&f@{w*$P@u{B<q3%mMBF0<FPX
z{JH`x=X$xKKIU?T_y4cGAhSX3*hWPLkwSNHAC$wAfq|)()4Ku`w$^h%{l9-J8V*9@
z$@~9T$XPcF7<eoWFo4$+c>n*Z3-U9_Y>Nd9ycP!-8od91m27NeFtJQzXn^F&&!Bc3
zc>U}IMg|*;gA5#?^|PR{;F_J<p#5JgpnZzX&Ws_=$&4}0&5RM=|G%7UxX-{+zp||W
z)Mm6;zyLmnqUM-KK*%vRJMaHrwu0rCyawr)1m)$LV<%v8GeLZ)J}HX>4FA3Ve`(d9
z1+MEYKx4k3cE8O5(3uK<JR5F7+6hqg3L(c@%)I}9Nd%4Og2odjDl%|@!*U*j4QOl_
zNiT21Z4|vKP`#?idO>5XP_tDm4hTTU`MxkBxls+&=kWgj`7N}K;{z(sK=y#td;kBv
zwBZf|_<TUn8c&eEkYmTpy#IgRxBw*n_;&@=d;{<QpI1WdW(2vr0TlNLd6tA@pg8?J
z5xg#u`4jw{6;S^b+?TDFt^mbF!(j#%SbWqR(*T`OAO#9{NZfq3#2%Kv{x(K2C^S}~
zgo%=2_W%F2UW`{l(^~Aj|9|F$hNT5+SpGWL7|o#2SdF4r4OQ=_v(WI#K@Fc@t&K4Z
z3XL_8Fam{-#R3LdgkDfseQE{m*#W5o$-~rw%6jnGFAErq5b9g(EEGZGil0DxYZN?~
zKRki;p+Myss9piJ$w29MqB3JhBQvAHL}kVZOJxQL(71%92Y9SS1Jnlx&098dGDv85
zfX43`6ddO;L}+&~aDc|!Ej1Z5KzlG8n!x+Rb~OBFjL>ffr%|0oP6mO7;|v1z9R{HD
z8f5A_3>X~t{lC!2$sp4398`u|I5_P6e_*0LD6jkn=?x*EcM6)`mWlR^A>RN0*EIZR
zj3J;m0!^>SM0>^<(0OAG^^75)G6=M%&HMk4n+^4hF-ZKA4fTu>P`(7Ho&~j6L3JxA
z+`a$*SOIFoc`(190-Gnb0G)vXDjymdBqlI2=zzi)lpaIofZ8!1RxSkP#ZK_LWfyG_
zy_Z2izmt*CaUa7R4+e$@`kid-4fh#CKz?eJXN+*1$FN4flUu=I9%L;sG@r0}Ffg2H
zw1?FBAoU<|kRFQ#3{0STVUXU5_KYds|9_e`?1!iWsqy~*+Y;7R@c#dGYkl(rhMH9A
z3Wqri9H9CJl(r!1{;X`C&zR!Dz>onGvsl2uX>ky=mihhFPDKW;LQU|xcm~IP44^am
zAp2?|<r#zb{~von?gP06<PK0e0=x6^?+TDRL3V)L2pW&~{{I7%pEW>v!h`vp0|To@
z4lKQb`dXm#dO+*JYE`_k?#Tqj3ut{6C~iRU0*W6GhT0kiRt=RYivQt#wh4?3KKmCk
z*nry0p!qvcTN!j-4zyj)0a>U1zY|n0gU01R<rirEjR!-mA!wgg!+daGC==9%Z<r6-
zpYlHz)Xr;|4=RWM2ZGMEX_yb1-}~<hns;iL4?2_OKWGkBqhUU1?eBlxhWQLSp!&vx
z>7H)GyaoeM*n{>bdoa|TZJ5ts0Ftv_$e`iDbdMJ_=Y%8=S_@<WlK1|<mk~sJFa-Vu
zwRs&DF>o~OYhVHIDF&Z4Thj>I695|j1FK_t{}xO$1fB({2dRVU0mXv{Lk-C7E*A4a
zXYSO1-0smZA9TJ;4an_24NVLN-v9p<g8Fx$c9sY8n+2da0kw%i>uEvlKhU@l1FJf`
z{|$;a&{>$E_8%y`!DA|Wwc+R0g4X<dFqD1-tycxD&8xX@45|kOTIv~CKz&&crYD-9
zwm2wWL31@84ApBb=KlX*|MYhSD4lr!|KA9jR|k!4)xVSk?fYc$V5sf{jRk<xs|WMz
z9}KK&HB%J-!N+&^J2FDg&Siv;>w?VpU<laSJg<SFQHg;CH0JHt#4rPt=Rx}`LFoiE
z7YRCVz=P@b-<o=G8`s66fkC1E_m2P%rdzz${~0(yV*sGJ9Z)!f-01y(cV$iOFA-2Z
z1DcC<*vDW}|L~W{?0C?cMg|?2TJQh6O+jZGfb@C)-wj&JDFCty%9jNB6%t4Oxt58H
z3Lea_B^X#$=Y(Xk<vT250Iko!)!%&4{EQ(1nzngB?Hdn<s!WRn27V8QWfMXB{OVtV
z*Ptna$}rFvq6hOU(0MD+zNV@L)Q$|4J-CRq#x|hwu?D&SFF;`ga&N;jsD1Mq1U#7D
zR)W@kg3=2pK0)P@#X)eJS7P!)&^`~LkDxjnYHt9D2DQBzSXB-{?FH@UTmWi=gVNIe
zgA5VSbd+KZIs5AcD4x;mWCi6@h+q9|k?dvwwNE@4gmo<w84^Htc`&~Oof8E0tBMcU
z&L&1s{~bQ}k23Fn+ZdE~Ux55vGfTOmQ;k6h6t>N5;JJ11J`_;<7qs@Rp7}87yfH?L
zg$z8PwxS2abWmHJ1Kd{M_y3OmECwcrxeN`U^P52P9`!$eS6DYNFtt=NuvpIljoa?r
zT0iFk18BV-Xq~;oy#Fsi;cKk`nj31k3DN_~8&(e(6hP-m*VMccv9<*1+wl^#*46v}
z&eHms7Z^Z#9p^FV=+9(ea@_a-M%|y6>!54R&Op+=@7|gk@ERA6=6MYg&A%BEK;;=E
z{3<}<$M3<gBo%a40yw?2J+5fj*C2tEZX6(C`Jw_uL*h>v)FuPBmBI1G2%k%_sg-gD
zh2aO#z9!IEPt6R-7;DX6Yw$jb+UVel=0*mG2?s%WWX4HQ-T~!t&=|4yEO7e+v^H@;
z{oE6vaT`#cSMXpcp9-#9>Kar$7|J^v7DC$fAV1g~0PP=uggt2fA9S8CXfD=+q1+O*
zpB+-}mWP7E)~11x0hDjS@x^o=w)YmacE-T^!T<jr4CSogw%b020*i$IzdRTggVqbB
zfZD1EbHV3bn}G7W^@IO^Js8S<dN43Jfb8~QC_4((51LD6_h4AeTR-=J1882+VGe@~
zcy9RR34!|mKLzUl|K1V)pM8(@|Ns9$c?6WsJ(!<MFt93u`quFI`hB4BMaVhqCZK(y
zp!&>W0i!`pxpW06je_!B&27j&oaTQG79ex1_cKiJ{=Xf1=GoNP3H1yeApd(XUCi}h
zm^u*@Hy#XAAA;(gdKJhRj|bDmTCf`Cm|QT;bj4MF4g;g(Tn5m-eFxCKdeA!ahH6OJ
z4L*a0>0TzNPYg;I9t?{V!TK0xhJxCk6YUv7Kynl983G{o&G@O`3_AOq(F1fg0i?Vu
z-3waR*DTM_k*lT7s^29U23o_}P}kt$!BAQW>d$*HFltyNfbzt`gAns4L(et=&(-;O
zFq8&bB>ey9!N3SQCx_XCVc|@Ox@lkaXMo$OCJl8B0Uivcnh^2HzMyg+IxiRE!BA>x
zkpPNEh69i|ECub0Vew#C7}znFK~}p3bcQ?Q5sL%{Ru6`Sww<;Na-g;Cj`P50c7VzR
z0mxbvP+iI(1F{1YCl>n|0xa$`gm^Ga4g~eBENvM;`{@H3Z5en#VFM1!x`v2`>7aS?
zlC2gA|9^WhFxXhsGq8Zd26Psp_y298pmi0X`R~d5!F%dlJQx=21dVHf_P9dzg2HKv
z2g8De)(Q*^jrI&7pfbn-a*loiXfFb2zkvtC^h!|pgW?2yZipp=+)R6h*v?1>`I+$y
zF`beOGBf2F;u<3vcxoeqL@d1+945vy_%uc`2uzG;h-i#wZ~@KbfY!2u`~x~8+=HR`
zsx@T)&X&e_1_?{e|NlT|z!hpS{B>BwPy;#x1hj?$G>@m<!NBUUk0GPJ`EdofUVQqy
z!r}k}yTyNo6ia!A3=f9s;Qb<w5O?Q*>;UzFLG1$2xtO527>oZ5IhOJa1s)8uA>;dy
zwN3>d48@>)YS2*6kmJE1rV0wP$@UB$6YUv#K;<ZC?4kj@#<SShBH{lZ@BjZmXA*<k
zVIItn7eLB1IncN(ydAkek--F77x{qN2%vli8v6m|L5l?p91Up<EH!r_`L1DJLxl%J
z4l8KQlw%WvLnCN!EGGk_!!8CHQ2!BBPFd{v|KH*+s9*a>)q{aa0F+l7;~9EDV||W$
z!23LEJQ#}Bg4BC3<m`pyDaIF|bta8+4Gk0H!E2v5I^!AQLcIj6>N5iL9Op60fX>Z@
zrpE-(IuFNr3`-n#F|P4oV4S1h$)MmkkI@0t4%6>s5OCbb$m7AlI6=RY!2!Icp_8G(
zVIE_H_x}wSz5oCF3l8h0uPZ=d4LXa^B7va+bViE@10(3%4u(#7hL}!!hS-UY3>=n@
z3<3@H44^ioPs4tOfQI`FAr1c-BE0|qd<i<^z+n-iLc@H92#b1#2@MMw1VDGacrcxl
z^<ZG+XxPt?0T!RnkYaJ4p~T`pLj_o#VR|A&FT<0D{R}16jSQf6k^m^pcrZN$-Ms+b
zN9V!d<_c=FH|%Esw-Y^>o_uVmYv=&E--E$T(}RIwi3h`kl@|LMazJ&9#eIeXkbNEu
zGXg>B--Cgn1+=EhB7s2wqzC3-kY7ReJ1$~KX{c)e?Kcg8s#CzB&IYvq6tvG0s?Gt2
zI?y_{DIN?3XF+q5pfm|8CqQga`vuhI_F#Uf!N4jFIx7I)9s-r4;Py2mg99`zrhwMG
zfYahk$hoqhvVWo?g8`_W;xLyX0F*8*8o_%_1w5E;oNQEN5CH9C1C<G&GE2LY!3uPy
zjdmx4vg1Am1yDN%TnB*0+|od6%l`ZYwL3f*m>4kSer7`25{wVL|F4@1O2eS>15lWv
zr43MC#F93?p9SR+hX#fk&|W9Uc?=Hv&Hw*__p{nFxIo<q+NY`nO3M!W7(yWHit|Bj
zW>CE`$Ack1(IVl0zX!wYjp*+4V0Hza%c-E>{Qs}RJO&Byyczf$&9x6L68?kg=@&?8
z(g2+1m`-<s(lodXpT|&uq-SkIUBdzo2A5h;ec?Ed!KPte!xHcR>u-Yi4xsa2=QV)V
zhzd09X9xksCulvL2h*d}hPs9|pfcQp!FjF+1H+C+dxivys{j8jW`oXyhqT8%7#J2<
zB!JpLvtD-EGsJ=RB7n|H@&5nW6vS_gYiI!NC8_W7&;zw8Kz$1&w+VLCGsJl?^fPws
zXNUu(@rJsF4IT`6xfThaJCSCA+DkUx|9@+O+9|N|v%Zsg87RGh(z!*#|L-0QvvM)R
z(D|cv1NfZU1aQ7%zSq*}%)nsj_5VVsCmU$bGpFNR27^vz21Zc*4Bi{5!Dgr3!NBP|
zmq7uv&j4gct(KR_L>0)ndLVV6G8T5`1ZWK+s4TT;V9*1deFsWE9!zIeg34J?IC}qI
zHxo4e21<vH^B8<U`M^4wff2O+qSop~Kz*~9i2fV~CWm<p2cYURL3@Hh>Opme_y7Na
z;5eGcumIF{1I=}V^4et3Sy6KsctHCY!22{B!F_%3+`Pj)h7yZf1}=+6aGzfgsy_jw
zU)GZW)CS}M`^la`1XNG!&tc#K#Yv+*gNStkLki5i`pnzcy#N2Z2-U9u(l1}lkWydm
zB?3Bg)q2kVAKG&mKzo;XtQUaVoD3&G^;NCS1B2pD22saF|KC`H_I!cH!dpON<p02H
z6CC#azXCD~yl!^y{}U7K83Zh9L3`D~YM}cF|8HotXAo#~WZ=luWMBf%#b|nh<|J$^
zH5uf=b<N)YJrm;@ctHDfKxLKp|9=qw@B3c@HDBCu@BfU6_6!^rwG3=fHH@Hg(P7d5
z0H_*k$G!huCfYNwfZCfL%&RVf)+K`C!h`uv3<Ik;Xdf56E(MoijSLphGRy~5eu2s>
z$9W7b;I+2%818_|EzsIQP`}vw{~GXK0|)5Y*d7eoxgN~x_JY>>T0`6Z9?WYTLH%@x
zCI*X!8c3VT`~TmCpm2w_Awc&Cg2z%knAbqg4c-TCGlKVSgZhvj4B4U<i3}Vb%&S57
z22_I1_=kvR{q<mA0Qps+p^-tRVIhNrb|(WHXpRAN-bG_vg9IpV*1Yo21Es5mf8h04
zGL4MjIUXKR_<Jy9Jp{FXJQz~I;~$_h9uii!U0~ygps_>H9w$)y7&LweYFpI17=h9g
zL;c(fpt;I~`o9+fK<k^d=QA`YYBGZ71+5=2G}O=cZ~(1AthM*92w!=~4piRMLe8mU
z1f9iL-}blyboY_>|J#4TVKNWAUXihW&M%Sry}v-`=qv#3M*+7tm~Sn?>ZbY16)0|+
z4|Y>b_+R$ATKfwD%6l0&>gPh;Ve4HH{_+rbz8AwC%Ry%V--eZ=pmmdsp!0<4=e!cB
z|NlzFgXwgu_y7M(klZ6;lfb|RIy*ceS*pSN|4khRR#DIx1^jFR{Z<AxP}o7!lny8i
zVd=_YAH$!9H26L&0noUU2h+v9pmsTE45y)<0kn=-z=P@HO0ZasbVWlwtj@eR71Xx@
zl|>Ep4B$O19!wV-L1mQp|Npt5yLUkA@4Wx7yx6dxfdv${pmG4bo*#6kASm3^Z&%c>
z0Nn?baTin`f!n*#^)lZ7|FMGh*Mar}g4XPL|6d6{pA2-?Bg_ntx#0Lim@^fNIf0;Y
zXV88D4~7h1aN1&koK@(-kW>q5KZ3&3gZTz{PaSNobAKa)1W4b+Mg|ek+5u1+1g*>W
zU}j|nt%G&k1j-LAUqNL*C{4k}0US3m2uuLy6_%R~i3}W#jSM0n^C5F*HwqY7g>RsY
z=cY)5)~bns<{&_E1d1Eb+I&#H&(*4T)$j6g1Fh|Vj8QO1fX{wO0H2=;x+4bE?`QE~
zNS_O;OF&~+9?Uo3>!3j6jG!?`P@I73+=aFb29WtwhJxn53<|O~3>x)+e~Hxp_Y!He
zXW#&>Yjtd5@Bzg;D84}Lj)wgV;5%I$=P{Txg3lRY-~gSA0ZI?v|5t#{(i8xV`PR$@
zopG>YDo8JA+}DHI|0rbq=6_E^E%;nj2@mG$1q`f0ApgV1A;D!H@*QfsA>*Q;G7c05
z(0(;X^Gi_wk3j-d{(<ZUr9BU(^Mar_0>vq)f93uE-%7B%_c1tt#JvCi`w5b7sB3_Z
z`K6Uw%>Mr$BxkV))W`TI2x=36$4ys)$4v!17}5ek>kA=e^tC+<tU?-76#pl{#@?Xr
z?E%Hr1V)A>pfNB|oT0cCwD+2UAq3g2HFu0FJebZU>d$9j0>y{JJO&d`c?{aW>ivJ&
zT9CUzXVF<CFfe=n-w!#9b1vfs(D*tieR(jX?gWiTSvNQ_crc{4g2vZ97_7l(5`xA8
z5Mgo_+%5%;xqC2Jy#$y2ix{pn%xloF2CaDlohQn41GM)_$AiJ@WKFenB`7=`n?Q49
z%RE8j@D2MKOhEfz>(g#mcre`n)h80(|CfQr=q+G!9!xhtXNlT)Fj%#M%mA%z2btsj
ze;H^$tOHm-=$;0q8?~Tu3=amYSX6aO?}E<ELQ)qB+8gA-U}cJ?ZY$_qbtHAV5PO!+
z)oy0^4;q^R&DU5gVE7N}Kh}fK-&zJf1K0ci(n_$J6v&*8MFYcskh}-8FL;c@`~M$M
zUmw1<#ryxClc2Z()kmN`9v%!SvJG_&5#YI?7SP>vDWLQ9V<7R7qFKKZ(nf8lYe?{5
zNCu7Jg4(K#9?Vx-7+3{B<Ix33>4s(BLxvn^x|sqhYvJi;9zzGX?+Lo^X&-|JsLiY2
z%E0P4j{&p>o6TV!!-R%3$T^{qbbm$?6yM;o98~r$U=V2D&miEzbcPYs?*YwIfyxVe
z1<-v+7EeKG3pI_Lz6sV_*TCYzU~v@cXBChgpta&48e~4iuG4ElW`op2$8>o-7-C&P
zV+EjgHgtT5!-FB|Bd9F(U|@XHP|v_&(a4Yh)t?KkBUnJ?y9aYTXH6A&oE5Z}hX>T=
zZUEl{m~_+o|NjGxiVO*zp76D8CfZ%#ei-PkLjmvq|L0g_GBCp2HX)HA!Gq~EFQ~8O
z2pLD=0JX`%bwJDG3JcJg3CxM$dIP$@Rs_^e1NB2ed&I3CGMLmo-VK^-QSe|o2yV+l
z_ngVpJ=tC1!I0$Y{r|rXD6fIy99-X|-L9x_e_Ub72x{LZsY1u6!1MVqc@KspUYHv^
zn4`ew<U+@pG(h3z!5j%a`x88#p#$<iC>%g_nFm86X#Z~tr2Gk=2o9?S;P#jS$PFG0
zi5o$Cmg{GL+ZY1Su{(}>slyeZ@heb2#)CQHWqtDnP`U<<*_wd#!Q2LNy9YyJt_O4Y
zTkrq>0z8<*LH9yffabwKdaWNagiO{1m9>eWvcLhf76z2xJeaP4)^WLj@|XvM>04-h
zGr@!TVg~~&FR0A{ABzRGRY83hXj(S`tq+2y^}P%{9t_c-y8Q>Z?EyKX2-@~I=?LnZ
zfZ7h=cw&yZ3-<pa@K`c<4G<`-JQxzzg8Pe#3>;X}3aCyD@L)(t^k86^f|g!5JeW@0
zg{F7VJ_|<h9+iCzJk9kWcQJ5)_E3Z44m5Yj90^VnsBsq#ZYP4yh6Rn8gWLlyAC`gI
zF$toeF-J&SG1L=O_Buk`9^%0e|I>pxtP(oM$Kk;omJ99+fXZX$3jqwQJfO24!RvLw
za|NKj4P-nUeCG<NegU2J0-DnR<!7jyK>HjTJQ!|Pg6cm|K5$sTP~pMw<{_wFgS2_#
z8};Y>|K>1{Ap|rB)zHZxqTRy4@3<EnrjYg>Lwqc#?+EJufzF`?jk`2zf!p$e4tv4p
z?t%7&2{v?r(tNxjXp9xK-w)CUh*t!u2hTMweqG_ge7=W)l^ZlZ1Fz#z?ns>rIX4RA
zAIB!fDYeS4L_l?PrzYs!Jn;SvA4})||3P<`T0Hnay_buD5ws2iw4b`+UV}m{o5Q+V
zHVaFKMGQAUa~+_u5Qn)8cR=G3j`J99bVAjG?kFr?$-wN;#1H|BC(ym7^?St%>i05E
zv91O6C*v|fZKC=)FF<RIb?WEbU;xb@InH6=Y1junQ+i(msEjfIwPQRO;w-)Y|Gxs-
zhYN0()-_mw^h3>(MK-5q{)2UndoawgftVBf5o(SDXblVOtXa@py$3_=6|jHy{`Uaw
z&-MQQpT%L{f6&;O2FNZChS*-vnMF{$9KhopbHV2jsCY2M7J~9A)Q(gT+x!2#%KAA{
z;Pbw`|If<>&!PR70`+MQfb0gPQ#AWQ>%0{_n9m+zVC4jz4+_uIpn7)yK?V(2p0<X}
zJAMGgBWO)`!@LF;(7I)iy&g;#K=;>x*V1_~7#;+ra}VaTH4Lnrpfg+GbBdt0)IP-i
zA{THyA@~0SxG#0!lL)9z1i8_JA?&IL17iZHJp~#|hVJQ1bePAm0aVt2+D+d7|3KFE
z?_;z8yQi)p2DC>LG=>Q-XBrq7AobCayWao*YkL3xGZmDN9Op4|=+9wbcHGD1&`=BM
z?||wT52hnqLH9v{=Jr8nB{VE%V5#ra0G)#X8ly}At-tVKh*9-m;Nk$~wOUosKAh)J
zH*kLOV0ak|5{HccNB{L;;CukuGY*>j^<dhy6jU}iG%*|j+3m3Rzf1$-JPZL3rX!Zk
zaSaR;szB??e}nH>sgJ%~;kb_>2JA+JUj+5%FtC8?W(UxD$DsZ3n&9=GHVw550w8}t
z{CxOjV-y1e$UR{HtOD%`f%_%LgCRN=QZ8{8fX*lcjdMc$^Xw})jP`-@{fl0Zeu#fq
zEhbxo>IhCyn6ZHT)G)81z=LTgq^_IC-~;j3KNoPBHJ5>-8I(@zL3-|h&H$)%Y+!i-
zD$77+rw7B+s~~$E_HgX+V0fVlwWq>^f#m||K3Y(GYj-jfJM3c;fSCLD4anckwhSE2
zv7r6Yj2jwl83e3r83aIQV}RDmf$9bAE(RNieGCgg>uzeyxGScbF>qKvU|?wa*Wd#x
zvzi$hI67v4&RSrwbDYOm0N#@~ha&}a_7Z4Z)Os%iWB5t|t6FOhJ&>8+|NmbAjRV#l
z*$iqkFj#$OVDVr&)C(HxnNa@!4`>d%Ho_y&aUlb!4ypmo6?-tS@POn&?$PgJP;l7y
zzX#+VsCh56yBMM!_A#shiPe~MS4=gBxUpFd;zqDu$UQi*;I$Wt3>?t#Pyod_C{Kg>
zo8JHbzW|pV^B5%1-3_|$pfRpNp;pUdU7;p?{8$Cl#(|`dgC{}vV9cmsV6c{8U<8GO
z<DCB;AiFy{!Qm6@Fpu5GgMq=Pd0&GMC=5YuK~Vn|q~81gEWw6G1`eyo4B)jm_1{5b
zC%Z(v|IbWqwPs+cpYebJ<X^`*|1W^Xfk673_cbtp(i!ONOb>=zcfog2H85QP@j-2l
zhI<V@pm7-wh6gJlX@hNn2g5T?XxeD;U|`y!-N{e@YS(IaGUQl0faXk@GQj3LFere=
zJwa!lg3=2poq*Qig48zGg6nynX1j&}kQlN%>i2-^@LQnqf=b5*CJ)fqs^dI{6tJ5>
zdwEiCSAgfl8E)o+?hygCBf$Gz_kruu4v>F9?KlsH2wo2cHWknwNYMNUxZTST{u2~N
zpmv@2{~u317??G{WhDcn2q-ODCo%|t&XWMOuOMbziUiezApdH2F>pA}Wz1-_YnTF>
z)2j6h&;yOJg4P^?)*6BIf!1e%^m;H{+gU&N0(c#p<6H*tei6`kdBeVjkWN+b`V7#0
z2B0-k5sh{Ya}?$>D1hb;YC4rfJQ%`5L1_nc|F*+kMo^o3fd@mlqxb*cPptp`{}0|D
zF_(d-{_pP!4+e%e4f7i2DDPzeozJwSrsb6gWSll!5ELek`xwr6|Nnmj<TjAIEEa&m
z{h}qPt_O*M){l8GTqy<BE1>qCJ~IOYC>=ZO0F^aQ6hZ!m&KaEn`Nv@vgM#B;h6*G%
zuYkBYY$0gg)NwEPEIF8e)<ET2L17L$JJb9B_d>|ne^?<nKOp?R1*#TwPQC=lE>KzM
zxR(Vqx3$BAfw@M1?*ISI4;cg;=KV|XU|^AGnAfleROWdwZMh3hoBJ3lVC5XBO!Hv4
z!3#>y4hukc9zPC+`lZB!A@r;F|6emeX%eK)VJ?G81GqhWKN4IYEMVT_!SEPX{vGgO
zU}o@Oc*qEqTj0U)7?%EzcrY+Mft8K=oeUWc`xu^p-B8zX0@}`FXkG~l%g{zJzpmj-
z186@{t8#@0Ln!zR{)W1S3k{v1xs}jZsG2JcouGIM^@Z|pG<1UckfFAq^ZG#j2oHu(
zL#W(?hE9<GLKU?^cjnGzaDj?HY3Ky4X$s}ko(n$PR|hKoqM;MCrY_{8_FM)5hq(-(
zF(=Ue+&2xKp!@Gapl8!vx(W@i4;~C5p!@MeJQzaudN438XqeaV#bN;ivj@}WRB)Iq
zVo*V?H}^7v>VD8({t1~NH!v*#g%K#O8s;_p@L<{uo;wG%g~9q3K<Y>jroCT5<zNkH
z?^-PbPt9y)(3&L%52n3$LFR$(Dyr#Ft^k!wpfM59IYAx_xxOGbI4)%3@L*uFK(gnL
z2h*mbAUTI7M$mao9H4ncP+8@$k6{96Z5=qjJ2D7ZD>86^@`4A$#fRXw5BSW%;ESL$
z|2!CiPu9=90owa;2c!lR_F((fK=-6v^sT9ou5<vO5&Yn5z5L+{NSHNpcrXM{^k86I
z0Xr8EG^Y&8)1Wc=hKCFsjf|l94bBCPBWrguBs%P4NC3Af;9;@nB~n-jAi`n~=v-h1
z>|t^9DcHXY82)%LJV=GQ1vG!)pxw!k;xO+Us6E1iXpig$oreT&k3hom7N}eR`Dc#@
z!vkpgZxr!h2s-M)z;Fi|w#*Il8YMiKHfDnDTErj$ikpTe1_p>3&uqcx9@jFkfa*v6
zPKIRATotq)umH6e9QJ+P0*-fh`)Sujkek4LPH5ZDgK5`ZP#Fap0|M1kpmsN?j<9H8
zU<B0z9t;^<K{Tj;3SJ`xURRa&6QmYYt~AVRlmVqT52g(V!R~DO>Hu~p=q@FOJkZ@P
zpmMdr`~UARptDE7bpZ1r2L_h^b5O>GmupwlbSqcbG^|<$8yg0#RZnPHwHnlyt~p^`
zQJWSGUMp6UAPp)PS!!6BD?sBupf$jt^}n^s9s!{BzqOij1)%;#O{d~D4+g~fjFt}I
z^MV;bcXxoy2H8{V?6FR}i$M?6rmj`?0-saTsmZ_yn!f~{J>#$!l&=_MKx<q;<I<pZ
zixb2DGvK*7WpB{_Qvna=gA*87{(<h+!`=sko##JWxx%{jKj_?kE>PRvdKu(?PSCu8
z2ZQHb9cBgw$0h~?&^i%N9SZKVfc8H?=LkUcAE^HV@*8N4Kd3GQhbMy<=>AmDJ}5>H
z<^w-qXUQVZm4MEo_5Qyfbk-MW4I1cdJr0mLp!rt@mVfYlXW+g#Xx{~-FD?R#XHfWq
z`aPg|2oDDTpP(}ey#F7B%*8?0+HipCJP(EdR{i-5^`N#D=zb8;K6?)a|AnA&deHcZ
z2lIgp2A02|b!_naqd@(ceTne>v>~ANYashzeWGT$22k5YpgFEVq`9s^qH6{N1L$1h
zrd<pSO}7~sKxc-5#<V;bJQqU8<2(vF85kWFF~oqv7?j?@`TIU-JbF7g{fCsW*@4IG
zK=-9FZQl!O*MRum|Nq{sDFvO0`hNqc&T<5`bLx@DA-7Kioi$r`XLE&BA_J%&B~U;A
zaRq3;&H4d@Kwa}<@Lra>rK>CI(q=>F*$zPaUEnsdj0b}sXq{FEY>dqceD;>#+4|`}
zK>c!wn#nuXS$$_<gp6nVZ3VS+>tFu(0a}ArtNE`0q#ksSc>P{45f28xT&O++kUmS5
z{|~e~8R8t~g6-1rVDJO2e*)z{0}lqjOpv*tHa#R>{5b39KL~Ve{BJXB253(?1H<H<
z3=ETYF)&QJ4Zg=Dz=L^T4+G2ZKger<LGiU8X<a9{ECKal_d@QfaG1-m2Q%EaMS|i1
zT;_wuO2Og2%@x#-gM|B^L{Rze*u>BPnoj|#1;v>M(>6uzW(EO}9pEr-U=Yxs%fM{y
z!2ALlH?Te*mj~0<ub}!Yyq?VtJQobgH=s3)tcSt-(Lv*Y-v9SQ<_{oi$z(hje04!%
zUmi^BWkKOm-wYb_c8>(Dy9B2t=DiCTSbl;056{=2aca<BBj~sQ=-w9ax>ivB0IgL8
zwRb%j+(F}FJ(%IJH4x-CkUK&ChWK%-Ei7ET|No8zjcGY9`o9M?9JWHnziW}_Be$}G
z$_UUskf1(gxHFqwJ$OEKpDMT<Sp-f4G9C;*o*=(~=6F1q_uOD$`K5z=e;a82uV5tu
z<Gw})*k0n0nkmX)KY_;BKzoTneruL%0G(51(OlPH)AfUaq4_5RLvu6(XrFotC{Hw`
zF@Vl>V+7CpFnHL4{Rwh!4FjmZEa1VkB@`qUQqE@APy;@v9V7;ttFHj@z5oA;g^qoS
z)E(Yj;lbc~5#(+U21W(lxeSa}2N`&DWf_>P7BX;v_9cVwO?v`rmwQhH<$qB518OgT
z_YQ-@VXrKxtqL6ncky8Gb_CZ~jSM^v>%d{-5z^vj2O7_ISOw<$gtWAP_@Fa%13VbK
zLHi#<Abq4t$T<i57(izzM$|1?4eAdIcra~l1f3=Aunu&-_W{uTDk6?u3_KGOL2V9@
zScBX|M+Tl|(AZ|@gFwec3@+H+x(6~Z14)-L9t>VnLG$1qOlw*}XXJq9!og!-^ZxV9
z`T@<WKN%P%M>8-$_YeovHa9AGFz<Sx-wHnOS)`^D+@@m$jca)S{|CB{7<@MQ1aN!E
zr4)1~IVgOQ&m(7G`2kXQ0yc+Zsrvs9=)9o)NOy06%4Jab3`!G@dl@{yc{mNR_7^l>
z<-xQm6BO6rbPXEk0q6Hkp`dmKs6FES|3@J#u0dn?9t_S;L2mJ2VCVq1&EV~oO^W(+
z7+7b3?ny{sU<A*-pp5fuVg$u|crBY<{o`LEp!G4eDn9}p8X0Ur`4E&IKywTh4;UD&
zQ$TCvcZ0{bq3b|mJQzH6EfTbTcrdM&1?460|NlYjc^N?Y--CJQ3I>+%ptGIf;Q<O;
z<gyPI4i0k}JV0d>N`Ai!s&6(Xg2MsQ&gOvR_l=--bOj_FzGs5UJ%>dMB9OAj33MJK
z=-m4?$l(BPKPNCSghzqStl7wGu^)2Z0B9brX6YjlP#A#LZ-Cm@9t<9hwe}A{Vc-HP
z+rV<5GEnVw1t=W6|L=m`>BRwRCxgZtLH&5pej!l3?ZGq$G;ayI(`OH8z6+XvQal(u
zK<)yK^JIX+%7ei}5>%%{!fFR--VSumI4s>UK+@fB(D)}(x^slJKNykI9jKiGTF(J$
zi{vCTuw^7mHGs}Y0G*EjyE_Ra$H4Nn0J+Tw8czka;h<$P{O%plT!r`l|7$^Q7f9Q@
zA;*KkJrlehACy)>`}7(Z7(AHP9|Wh#x`qN!IC(I*yMo$N-v9sCg4(jsbw4FgIZaSI
z1|;vnyd88`8F=mjR3F0D9XNvfwvM2CL2f|HLl#JR=&TD`C*|0{Z~!z14oVY{w6NY0
z#0I+oUM8;B)n;a3)St`1;;@TB12pde>Q931BiEnHzy#ti1mEHH{}1TAM36YB?P}@F
zz*ztCcLk_z>*VnN3+Rj;OHI(6|Nk!_eYMQLM6jt_=m|P6mx0Oq|Nk$w_6`B{uYOm6
z+PI*$rjx_}51pX9ry*x*f!gn&d+ixLn77SfVEGaQTek;lGlJp*+nxkaIngNBzyP|-
z8gxc?^9u%s=2Z*~&79!2n}7#{{Yy|=8Z-x7Yvo;0EACuT8yQ>yZo`4*G9dK|3ury7
z2ZQ5NkXmS1g2rya`^6w(xfXO5HV>%(16n%)Di0h%?YC;gdLIv_wHHD2#TE}31VHgv
z^ZfNSP~3vn=z`9!@L-xP3pyLV*7o2vP+O?}<u4J?JkjLu;P#LKXy1wl^VSXqmd~KG
z6XAQWKz_%T4ngPBI?P31!?D(PLOuBIOwc+K1`h@o&>A_=*~<(b%v(JeSU!XH(ZS0c
zQ2o5`ApEWs8<1U~atE|FXJRAdj2VZyj2S3p4|wgxnx~+62eqd`XLmG!(igm3U2_uD
zjsn%&j`J8n>oVYdRnQor2h*CBp!5eym*9D*8pyZ-B%Igug35J0X$A(+7^JlV10$$>
z@?da*t-S~Jp}0I4oL552^aqZU7&Pi<-hiD?EMhV9|9?=JdoVa(HM9ktPxTViciz!Z
z*B}9k56FC!^G;A&tb4h;qP}y3gTovK5zsl7wO*G*py~PzxDEZ|cSYSF(A>3iV*MPj
zI-3U2`Sz^`KxgfN=7UwheOI=_6`=CYgTXn`gTV#d4s_V}KcZgZl880<tbqSVK;w9z
z`zY%FGl0i!>;M1w0oq$tAH{IN`~QChy9W#ob_W;^fXWq6IC=m7_ouOufd^CuLe@KN
z&R}5q2wKMnZ!cP^{{IWELme5Q`wtmZkn2!TTit`f2Ar-v7#LQ-%MDQd!C?0loZhRY
zD;*jcK<kQ-()(&w&|M6m@&gnvurv><S3H<jy#)3DLG4UX96;+$cpQ5$tvU%BM+eOX
z*JLs;)0bvoa&mx_HIw5(a~2FD4!an5HbdAPvq5)t{=Ws9M}yt7q5#PYn>rX+K7iJJ
z!2Jt8Ll0?v6DX~M$^cN?*n`3PFKDdMgMksW9v#$P1m|mrm>nm$?c2a;(ol_PPk1n`
zl5O7C0G_u6ohe@bSV^P-nx{RORxyJ13Bkgkez6xwj>m&(<x5aHvILc*a~N1a=k0^;
zLDZLFU;@Qmt;&mlnv+T*P7Vw$4*M818kR6H)Vx&Ct7)}xa9jpn<8R@?;Aja-e-O7Z
zlz__O1z>ebFm<4LN*fObM?oZYAst{f3hSU|f#y>kJQy6_BB@aT)w4A%k3iuGI-d}<
zZUMY*88lwsu&+S}JlDJrbbkSOZ?A!N7kK|0Ps2U%IkX%N_ZnnCYm91Lf-5{296<Z0
z6+q>g2lIwM3@q<JciF<{96{v=s4U&j2yfrJfZHl^|3ARn_H_*&&2bGrpgWhFcY)jV
zHVvuZ_B;#dj0+D2n_O@@1l>{Dz{t{2i5x#Gz;|H6(x2{J1{P2|1k_fqmu0x1Cj&0)
z0zmQM!C?Os+V&0s?Y9Q49e}pIBS2?UgT|mh`<FWAgVLZqX#H1$2Se^laDS!=v^Ri(
zv3XuY3TPgv(*``Yuj@FEAp+EPg0^7<JeZch1<m8s#&`reHZkac+UB707PJn<VHE?<
z2JoC51ILVd2GH3?9H6$fL(~6+$-fyGz-9d|klhRlj+_4b)N>vNjr;RBZu;*4nx6-)
z8}$DF-vrv`b^zr8NV|JIsQm+4cMdAY8A0dac>n(gTHk=w_OWEd-sXM_TEB>ze~`)w
z)cj+y*E#{TuaV&lyqvgW3_hO)ytb`My3(<MVFPL#W7%DB{(+YLp!`z**h>UdA9ye=
zI|w>o9Fc#5K;k?eOv_e6!(0JWPJr4K`m-2VYU5u7=u0s$fyxZfS_H@*F58!&b?>14
zU!b$gYq>o2YBev3I5GVH08-<yi$P!^Cj&z*m$x2hECX~FVl9{FI?%c+P#Fs9mx9`$
z9?a`(7+Btb_KzZm1rthNdp~5YB)B};3mT_4UkmD^Lg&2UWh1z)z_b*!&IexRfzDv7
zZ+-+SA2>XimYxLF2{pCSpuMXM;JS!uVyea7|NlW{W<y;=4p<)4wsyM=KG)5I!B$g$
zK4{*YL874=c}!?&?PSnCh(rePeXJhLYfC_FLQon7wT~fb;SZ?Yij)@2zG6!Yu(j6v
z7c$6z*M0BTt^n;{0G00(7#Vatn3f8H(l%%v_l#Nw2Iw5CE-36V*ZnMc3QFUkwYVP4
zYu+%hyp};fKWs0eT@h1L3O&beiZbY&Bc7Vg+F*Z!;s_Mp^;2#*IL>8~sh>T=!ErB>
zNV8poN_ZxRP5oCdJy6~N)y1GQz-u~B<$=bD!#^DVrzgO`5dP`<zlM_xEFmo{cHtlA
z|MOt5e%LJ6pi%r?!NIqIfuYv+kjO$!2A29+9u5w37`N2kc%diz3%tfdr{?A>z52c?
zk%cx4EDPo^Fx9Fk7}S4Lun1{ku>;*d=D}b+wKnpV-a;D&CeZk-!#swLP%Y4zV+?Gd
zy+hj5LHpSlB($e1fXY}2$36y`Mmf+LKn4j=n-o;eHp(?{faXve<r=`_WEKtJJ5+h=
z+$LAlsdra+FjyOUFfj6f<|G~VF`NON<J)kr0kqcxR1SmsLnamt3><Z=%^<a)bzToZ
zXDik8Rp~j*WAFgE2kN#73+_O|q5heH1?c_}P<gN22A(q#Y4`_rmq5cm&>3+I91Z`#
zWxNGw4qCeld{18hl36Zfm<2vB)Punav`)+h<i1c<7Q6Zu@ELj_e>iwBSh+&WU>6St
zD@#zAH`FzFH0)vEs5_!&;K5*}3R<&j9R(_btR%hv|8oKHJs7Nb^=C7%TJL4x0NtDI
zFz@dbXuAk<PZIMg0|u5Cpz;0*u(1VDJ9aN(eN9PC2{ipd#}PqmVL;=l9t_4OJs6ln
zn&TQ03g$2{HtlOj0j(u%y4R4=X$4-}kkc&JP%u-GL88-&fw9@Hp=72agJh#A1H(*3
z2Kh!aFf9kV8*HW`gKVP(m@fmmt7@Yng9vCpDyZ!Y+RHT45p-rpm8mvpKQd&#j-^wR
zfe~aLD2>c+WRL{4sU7z*c!0<68X4p*7Ba|r|Nr9&YEOgq(KUd^iyIkaEf#{#{P<%C
zYDa_H(Dle|=!Kpe5<zp7c_%v+86-gMY3)viOox38H$diFH!#S9+9{y<hVF+9^4*OL
za@GqOq^%kmq(I}&_46M%IL>930F|4ddKGlO9O%r=y7t8t9t;KGcDTbnh6a!vNKNBI
z297R92I($E1}P7QqS%@uX~=n6$+s&!7z)AbZ9r#2H{NRq0r|7>UPAy#A4tCkLosMy
zwGPNFjd2YzVEMQP&>Aza8MRNV!Do_z@=Be@<civp#T6b5=6^wLobdmkv#$P!Xm>Ic
zIqYM2(7h1iFRO<C|E&@kL^>52<UseYIL=`T=x$_??PO$-sh{HjIy0yRZ2ywi74@Jq
z&(daBY-$9BS1x$|*%5RuSY1O6c#g33aRsD}X5I<v-*+l9$agw|%ne`w?Gx%$WRUH2
zWRR)v3;>k@ptVd5Fnt~j=Abp$EepVAn|p%Rl7-I!ySbv%kwG5pzAg`tJ_(RH^_>nN
zHmIEN@nA5Q1obCCXK{M}|8Jq)$x!YvkD&nON3h<`7Y>ed7)!u@1C60|J^-C(=dj=)
z^qvN&|2!CS_d>@iLG8s3nEN39GTVscu02S0g64;NtQ#35K<yvM9Nbh}kU0+X7|wv)
z3%-YRE`va)B7+Qw4L!$tf(L_HET~`L!N4fe-N+zsmB7FVN^e$<;4=#4>LKpj)4h;E
zwytD$MaM!0nflfjpz}&S!k2M?&k+OFkDz+9=8}<!2Sbi4$X<B7fbO7O`ntlZfdO=O
zIwNTPERwso=ucr_sGGbPw7yHAqme-tbT*v#|DT}!kv=fLdN7#o^#1?9q+wpe6omh#
z#DeT`*!TMdD4&4FLOd99LFYN}fbydULl&ri!2rrrp!V=gD+Ul-a;6mnBPd-=GzIhJ
zCYph1*@@<0T4tgJ1H(c^29b%D;C_CA2lLVf29_r+$ma)v+R^(J8FZjyO^9<}XM^iY
z4N!j^R4&yY_ykI03?2+zV7G$uKCFG^!88|iXCU|vdXW1;cWgk*jTHU4;5I%u-Fq<T
zUA0K~zX7zK7qnKyq7i(Lp@0X|T*2o33@pu!3<{ueSI`)z_y5w?np!Cl@EMl-z-KbB
zK-M!efYvy3fY$4R&Lshx18oC(FwHp$I)4?kCIz&H5wva=bbpQa{~l1f0Iem?1&tkg
z|L>g$+WQ0QFF0&q5V1)3zuto(ArP8&wpb)E1bQ$eID-12pgCz!+<?*mc>ZO{>k9Ax
zJ&g@@4FaI_?7_gXveB+V1c$mvaNmCkXgv}K==>rX(0!qx^<B`hS_KaVj?9L64Jv5j
z8XgQBpfJ_JVJ>JM%>Zh@W}{t$33heep!-cMpz1(tDr|75+X$X_0K1bNbbo{kntMDv
z7}yUwYyyYXIuC|;RZtrcG_KveuYm=WXFzl59?a4+A@wGQB{<CHF+_m&e0cvao(gJr
zJ1k=G0If>~^>;yY381|hpuP1T3`R>W5*UI!7~;-?%13CrVg#+x^8SDDA!y9fp@Bib
zBH=%1y*LjjPg^8_&YFmu3(60TjSQf>3q2rX6^l-Q#zsNz^Zx%=0?KCg{{NQ;%4YQb
z|CfP*<soQZ8$Q;BZJZ07mg*W9AnQ+!7(E!A!DCvWeMU8zk^&ygiwYQ69^yO~7&NX5
z>*s*R2ti@*!Mw-@c4qwqMg|qonrhJAVC%*I|M$;j0G~hT!QdEaUC+Q+KSu&o*2{F-
zGBAMdLDBDIum#OOgTe@OUIa)SmX<(!jzM!ipz!cuaFo<<X0UbG_x}w@EvPTz!Mtz>
zY<>)s=Rti!(47{b`&2<~jC~Ioz<UZod*ndjYwZZ02L{y(TOejSK-R?0W0(UPiv*3m
zfaW+rbt&k4-H;mbJ$f>bF*B>bFn>5qtY7#_M1MMiz>Hc34r_S^Mo^oe?(c5Uox<St
za*i7rctCm5gTbH@v`!DS2F79D{{!H&SoSi=K*#D~YC<7%yauWs42F<-uzCMupneCB
zeS+$7P~1b)L;xgBELg+9avyYFAaWlJbk{Rt><YSH4OGs7+OMGb9&k7`fZBu%F%}J=
z{okN<y#Mxs>Mzi`FvkW4(A_sY77LjFfYf?0=->5VV6bS91&<>zf&AtD{~zq!9Z>lx
z0N$JNA7rLJxc&pJR|l=91jP|JoS7H!FtFSQ-MI_jPYm)8D9-kQ>MO|l1s~8kL!h(;
z+P5~bkwKza334Z{2ZQ}Y@cpMv3>u&^)uMsH7F3>kF!jOmB&aTi-X*H93+ZPvpJ|M1
z;Hdky8+2w91L&S-(0SUHnhcDf`}aD{z+)1iv|s^RBLE$v0P%T1^&04mdypM9(>DZo
z|NpBB+V|zqz`$d52Q)YJ{|IQ04oKene||40-GR%7eatMNdp4osrJ!*bh&U5yJtDZz
z>HR++TGudL0i_McISgAs<vnN*ocI5HN3i;N3?iL2;C+-J_khk)Dgo7*&@zO}gK64U
zO9uvS(ELH8T!Rj%9}IE>Xsor?!%L*m>;IqnS)eu)Q;QSBf6&-#04R>U|NnbZKWztS
z&oK|^%y7^g>r6B77>WjxeKJ<p7#Mq@_Jiad_Wl3h{r~?1kR3D47#Q_uFff7cQ1)Q3
z`Rc*IXacI6K;tVO4Em7$Ond%;)&_8RFl2$w3u18G^REEpSBE|SB|v*QA^H3N5zu%s
zv|kMJCl4rYK;ho$$-oHdhyDLh-?>Aee$GPyP?*-w@d&Vv2hEe@+17_%uCPvKV6r;E
zz|>O8zyfkJs6XTVKTolK+5v|8YAF%NIsac+eP{kt_h&~y{p=l}`x|(y_k#9UfcvZl
z-v9qz=(UA}^GqA?IYY3xe*?NBG1HTQsa1-B1-1vjP?JH{Qj<Xeq}Ed7|NmZ2$o`MH
zGNARn|G$9l%c$=<z~DIN|B0D0p!{Hc6&klD-v4vK^U|QUJ7f%=Q3on#;r&0?6Esia
z(8Q3@{2#o>n`QD&1_jXiE>M{Tx?>rXUmPbv?nej3CFuN052h(=!{<2YfyNkWY952m
z@s$9r{RPc6fx{TIU;IA<qj@#tzKqE;L2Df0>CMLbf6hg)y^9zWkkXfc2h)^L(A}P(
z_6B&ork(+mu3fzU=PU%PZ~6~9E6W4a4gtlz_y6XLpfidr6&RSnX=Co+51=(M-v9p;
zfa*?=dp#Jmr-J;DkbF46gQ+)ivJ(SGqY?wdWKYnUOPQekc??iFTMq`Um-@{NybkmJ
z|M33*=SO2Bc#p0JC=Ec$zS%1nSZ=+5)j8lftri9b<ojSi`|Chu38+p6**l?;K>$<^
zg6@t6t@j3{WzgBfpmGt^F0g1|U<QR5=>BEUdHml0e}{s~FAwI~384NjXiX^W3`NK|
z(QnXMLrCL9Dra$w6M^R*Ve^il_8BPtL4E=C;i36GqJIBt@SOl23|8QC-9hfspU?c?
zaV~=msDB2!Hwe_W2DN*<|Nj85Q*xNYz+=51Tpn!!-FX2!GaIy4%!9!Sbfzq54v@iv
zc^2s0Q*b>2uAf17$y7;Kfa++_{x?uM1DWl?U<vDw@<8jKj{3Qe!Dpp=Fj&rnx>ZDf
zF7toKz5gG8`UzlnIbW^-wU@mAfBy?^6D?riv7QTd*P8nHTi`mee!fIN{rn3KHT91~
zK>9#!Z4U-ZSCHR8=FX`9|KDNW{|EK6Ux3aJ=K;kJ=zb1RI6>lJ<_QLtn?A^M%G%8g
z9N5}8j`J8!IL>A8&~66bXFUhBpA0lk;5d(=!(lJO7f>78gMs0Lb~6KLA8U`}9EJw%
zW(Lsxu^rmY4D1f`7*2rpGlR}<)oy0sbDYO8!*MQyhITUpm*YH!8pk;d1=`IF+@L+M
z+RY3+4)Y*)&v`H~%mJ-|0*O1$VaU;L2H$sA0@~*bTJH&(2k>BE0Ih=r?TrKF4bb@(
z8K8DIXq`A@&l-47m;~tT3eY$mbU&90sJ{$aR|cw!L3_qPWjA!cmqtTf18D3Cv{v2*
z)LsI$dqLx6pz$D3+X1xh64Y+<V4g7rbaxVL%^@fqgYG?^zz9B1g~$8<9MBm(3fi6E
zxod%tqbzpb|L1_#67Yl^1@*OO&xNLOv^9y>LHCcq>vnLxeh@x~;R8zZpu7l5Z=iV$
z-8KdWP#?_NkwFNQC#@A31fcgFaMT@TxBxCQ!0Uz76G7=xdoBYDs7(eMI|ZFf?)`rj
zXuoGbLnC<Yjsa*bH&{;fbcOeS@LiZ83mQRV&I}@;btT^aXM)yhM|3nY2zfB5gU+Ce
z@n8tG1*KKTCWai)nQF~-4GExeVCWr;pt%YUP&*T`52fD`G@c7u!&MvY5unG#z~H!v
z!2#qxklR50Yw!R6mOAz^K;|hX{RhQ`g5$dXCUqx4Yor)>9M}EV0FA#w=O$#Ja}yq*
z@(Fy`74x(!3@q0``&Get6;!T)>U`vK4K&XS3QLQH3|yeF^Zq~66I5P-$~#b7%lrRK
zON#~uZi|Hs(0%4JPFgfDaDmRagvig>*^$V=>;3=F&IOGOTp<4}SjYfcN0rj?5EP!O
zZz1_@S_T8l)jP=R20-_l>_@EsG=aIrx{-m$Vj%;c^+E=Ih?{1Fg2sYCZim_l+K->H
z032Vcy-+#m9ojQM`|)z1a)nSi7N|bZ`G*BiIhdJjP&v?9xFt|IOHlZO#&#ic)2}wv
zHB@vog3eG?l?8<dNFFM;6Lhx)C~m#~|K18(9|PX!QP)so4LTcxLFFw-Ehx;O>Ot;n
zfS9Fn5h}+Cl>@o21uC}{D#rtr1G%pQDmN1<2aS{Irl7qyP`O&D93NDlBxr95R4x%J
z#}AR4_7`-IFI3LeqJcpGv>yi|H+>;!uS`QDXwQU-W~U+pU#KSgKFHov7EqpMbezMq
zMjw>7=drm!&4up2oVK)~t`Ri8!|%bM{1zGqVi0qufzD%i0SRYinE%0N<a__02J-&}
zh<lV_{s*6t@BM#TU_)J_2viQ{e<`S$AphTh%EA0E4V9B@sB4sf$|ZvQXVCz;+t>U5
zw7m^=jWQ5FD!W4E!1Jlz|EDc%sA~kB^~2%8psWd%1D|#6{eN0(LtUc^R39%?4!p<7
z`~S4ehPp-#h@8?#sNZ!UZkhVFp{`K};&-L1P&qxQ9B40u0aR`$RL%e@x3!_J(F7_t
z7b<52m7Cd6*JuHiYlO;~K;>#1>KbjJa;Z=`GpJl*LtUc-RL&DB2R<v*`~OtehPp-<
zsGKfT&I+nev!Slh11cv7jdvS}+!WCHXa^u+t@srxXA6~^*ihGS1S)qEYNj1j?kZ>x
z2gFRpy-+#mxh7L~Hq<rxK;;%f<(#1U<~Gzd20-OnEgGQrXQqPAtef(%p{_9m5)aIC
zpm79EpHo2P_Z*0vqAyeqng*w=Y^ZBk0F^U@%7O2K_WnPmx1p|K2~<uLDhEw3Q$TyJ
zRzTzwenRD->17INta%Mo?k-dgnqH=W)|zgB${mFI51L*k?*-je4e_7CQm7m>y-Wt>
z&mB;?PN<pC^fLKrLtVojsF}IYc!0*yWX^`V251~91VZJYaWv^IB90VHp>ohTnsgC#
z_cSE_6hLc|?Llz>Qse!95~%(>1Ce7gfVu@5){{Zwd(g0!e+W`<(ZB!=>q)hseOVBF
z@<*X^(EL6rv7xTv3RG?-R1TWoCxOl?hvs+rUZ@;2zfaNx?cajxD}>5H<8KnEu6_WO
z3x&$bg8bqAe<J9-$R|)aOK4cjLF6WZ$`@#vB`*t=gU0(LQ2F`>5)bl>P&p-tzKNjn
z^#eps?kQ9bnkFVbY^ZDa0+l-nl~aT21EtR&P`S0x@Pww9Nuc=q1BqL?iBLIcdYK3+
zUl^crrBE}WX<}j_Xs;F2%t)vlv<#UT+ECZX0hP0bnh7lnCW6K*p=n7@5gKODv@`*f
zKA~wzjuk2gO-mC%=@XjYWnWq}Fo4q$$X@UN6P_aSyDaGZOP+?h#t07vS?K=xJ_81p
zv!HVoP}_jWV>{K*Im7wjF?b13pB7a2g4zoWb&W9|46>z;n;1kI>KYR~7-T_Za*79o
zY+`t2gB+;81lrSU^?-o^dLI_oY(@sI@Ldran?UCVMV$uCD=~!sanJ*|Ip$oh0L?jr
z+GgJWCuoB1a<J6=|36fd#ZJ5P|6j+s3^CyKW1u^@n;(Pr)A7|UU0vb*zkjadBnFj+
zx<>H2Sy1?Z&K31wkhuvl>l<iYszO6uV-DEuOCjg1dN9cBgvwvlpU=P!>eGPwZ=kyu
zYBkwQK>bR`IsZZP2J)c3kHftGF0ei=q(9qpgMsA?Xx+gK*qp1S0z)yV-?<MlkC6jf
z9|&sufyT#bZa~hhb(qV*1G<|Dw2#kH^Zy+1z3H3`!j3Z;r-07&to8ITuytVINc3W3
ztknpxbZBCbDAZyQaBN~M0j&W5oi_}+$F-q?0kkHA1;UpAub%*oD>>|CuxY43tf2tK
zg$GlMss4P(-hR+Iqzx6w^QA44ptTyH{s-thDTlpGH$ZxtZb0^Pf%@JP6&ZNy4sQnC
z{UhN0Kc-N>nSlc|&*?aqX$z<?3W`He|Icb6gNRil1BX=t14Di11O|sW3^BD~9_y?$
z!Q(@qePAy2DINiJi&s~G@<7cr&^cc*YimtzfzNyciG$W-Sl2Kx&dOxq37;ci<-yck
zS*OxnQB(3zufFDXMV)3hX#MmO>qG_-kbX$JFxnHchMxg)W>4~MP#OWB(Ev5W6qF8Y
z${y-9Dl+hd+C*r8`Uar8rRzJrE1DY_1VH05wKk6{^ymEl58B7*!N7RKVJ?G9_)7sR
z(D<aK=Knvn79M(_c+>A>$N`N#gTf2c7XXD9=v-H5oPh21U}`!Dn(v3oGeX7z{!9d|
zIcT(C0L^_f=yx*YI?iL%&<4?S85Hz88B#!Jqk;F}&SM0xz4HG51#~VN=sv1E$9bT8
zOc=@?_c4liFfdwx%m$6;fySqy<5UjydoNG3ddQ$qzxU!baK8++PiF^c?nm+{bgwLj
zHR#Mb`_mP*mOldOI}d=?e<o<p0-fXV7(DL`>YIV`qxb(FQ281FDeo8zv_a?V?_-bv
z#T|713Dj=`t=ABN+@sh7D*r+KHU$p`$<X@$mq6?A<}}nb7J$y;uix<^z=J{3)`LOv
zDX1^!(8N#zar^%W(7Ex@H9%m0gVvmZ`ht-A1sG(YayFoRizLVB{r@9qj?w^>zCrs5
zk>x@2_TK+LfZ{;_v^T_qLFguEe$6tGA;W{YlZAohl)@Cn|H$WRG3`6ZkO7^CoC43k
z(7X$tQv{u>HID(jRv5Gn2Gm!#UjVwN<n2jt-ygIF9zGY?0NMXm*TCTY|LscfSy8C+
zb3u8pp#szg0QKdBKz<Pcjjw>x7i3SM_*2kWzXt<Ti$x<t3@CqiFg2ut<}f@M>LqI`
z!S`kebXqcS>vuAM(k^Jd2?waW1C5z9S~7sns0NMEfW&z`7{vE_|Np<CQIR1AX)G7C
z4ia=mF=+lBbT(EG+M1^r52pH$pz;MYJ^@;r44!v!xePuR%laXMi3hV-F38=WJ8MAa
z&{-^CV29MT;U__3?-q%$yTZbEg31cecnzp*u~c9Jo#!B6sle?3DrY<x#AQMHL3%9~
zFerF1mBQwHbQ<P0fZGI6aqu~J&@;AFKz(`-2C;{rbH+jAE+GGd(+_Apz;n=ECb6TS
zumF`8p!5vdlL1N}ptbm*vw1;d3ZOAA&{z#juLpzJMDPFqT0mo39t@Ts`#}5WD;(xA
zfbVtmU@!sC|A5XgY^ZB6@L&)F#orx>dh?eJp!?@+8F*lJTDLLS*U#}10lQ<4@idDT
z2F9AZMj{|LSl#*mAC%`nZmDnH02*HhjSpEMxdpWTsR1;G<o*Ben+DMM=;GI)y}C9v
za}=*l2Avbg^lvU`EXn)-Yw%iy35g6bpm}`Aybyy6=v*D||6#q5y!Zc2V+7=m`w5BQ
zF)WXXj-dHW(Yc_!0xHu%VPtWTA;kOt643l7Xg}@*P`r3Bx87l3IR=``g3n!o#^G>`
z?Il3R;usz0F}OI+VW`k<2CvI<0FC!K%md$z0m}a=+RY4{j`J8m>o`oHV|O;tu{h9r
zV9@#WpmA)_{0eCP9kiatprH=DZU!`_mH=842{}^+e1=8_s7`CBYbXGvSx{LB8B=R@
zU|=~0I)@QF&I=l|0l8!ULIxgazLx=wdx7h1*m|jX3^JgxOVF7qpfv8V4}6{l=nNAR
z$Qkz{nV|Lw=-zPc`JlN4h9?bm4K*GNB7vau3_xp_93bb-SAfTTLHCz{)+TW<FY{m!
z(E*Q#&0_$a&)DMq|Nn!Ax`qbuc^7pJJ=XvK{|Bx0@n8^P)t=A5>NuCdr_ruqLim3H
zt6I+=sAqT7HGu9Q1ck{Aa9LB=Fb5hY3!vkSOQ2!00vaYA9t^^uKIIw@2H~Ypw@Nt9
zVUW?D%Mjo&j{&q6dWZM_|DZX>4WRpJLH#A~|NlYp(E(bo>;3;PXy1_xXkHuCC)&M`
zfd@364Y~``gF!fef#t{+&>1+s`xq3aDE@<|7mEXo4Eqnl?+p^MhMWQQ0<^vn)W-B+
zh=-j21KDqT0Fu9j87&hT1w5FWYZzFLM06@MGJ?iSe86V^hmXO5=Ch%3sRAAIdSX4F
zfy26<L8Eyw14BnLqaw%-@Be=t7yM^rf{rI00oBpg`x!h!o*l9adCq3%!5}oT9()F5
zFzg&%P<WgGjh%z)Kv4PN!5{=0gH-|Laqs`Zq2Tl}??1Q<@cthRUc2M4@Bf)jdqx&;
zyK)}*474*I3__+I^^7bX^BGw?_A|11|Njf>-(K)w5RwJORYyIeqWAwl3!&k9#e+cz
zbO+Ckj`@u29s3ytJs1Q*>s(b9{Ac7@FrSeF6y^)|Gjf6YW+3;2_OgTg0NTs$!60~o
zf#oo0{sW%oQPMkX5B*%_ijMgVte~)IsB3uR!5}!X)1HC7V?Ox)CI^Qm2GDtCPrzws
zU&Dh!Ed~X!*ga?-yVvld<3D(8@<YgT4jT^!!N5*?1~#z2_c4Id<rfbILEDb`3~Zn>
z()<74m!SLr>Z78j8$k)s8E_uVjT0DH4uRHs6XR|ssJnl7FbLf2n9so6v7dpZp|0VN
z2ZO-L2Jm?p0tY+l8CXH~ckE|i_x}GI)V{gk!62}*)1Co(j}XY6jVvAv0#iHYL+-o*
zr4#J#6exhWv*85;%R!uLIiP9qL#HwW*o~no>~@7(3=QD0+t&!1Q{ZUW*T?}H)AL{u
zknOZ*V1|wbg3jet0iBfqZhLfs*D-<ma-cSs1Zdn1lAjx8z;RO7sNliCe-|`%wg7w%
zCjUhwvzQ_ERHFvS{~iqdTR~?#fW!VE133LyD1ye|`R6dO97I_wj<QZ1npP~58HGT3
z(z>2e2Gj=tg+1sj@J@S1Y3RAYKJt4QYC!n{tj+<vZo$%eFQZ1MH3Mh;EYMx73^FoR
z4D6saub_2SpmSNh|NjHEPac5g^sTEIYCvrj&{+*&cY@}@IGC3~(lp-}29^V$y<+h5
zsrNI&_W|j^!W=vYI9IvC+MZPfw%*$NzyDfLUI))})HPaoFz~HxjAxap*En4Pn#Z=(
z0^idp16mIN+S}0T0lEVlJl_mHN83~rJU{!UQJz%=dY)iQ!wXg!P`e1!wyE#50QG$W
zEIk=Lz-KIZ1c@|yF>us({Q$MY3~D_s0zh-mp!EQtIdmrn2ANPT0jpZDI#vyk8yx5T
ze*x<6f#ktqP}gYV!NA7|y1NN<7FDh7BN0mn28EfPu=(*u2M-2b(3qSHWd8^6RZ9g1
z1<*Wxt?k2gmJSRxmNpDbpl}7vnS%7z#)8EeYGXau)ysN`K+2pSx}dX}LFEo;>>1QA
z29>cOx?x|V2{^s&YXt410i{`kj{A&K*7cw~-{@f-&!AyFpTQ&K7%1=ahJxbW`@bJ-
zjRdG4?gI*UaM|g08GQDs2LrFJ2Lpo&WSxqiD75^%0V#L=!24+(_WeHr8ixew1*J7m
zJbEzjd~LL6l>wD44s#g{Kx}BbQvu!g1u_S;FAAi``~Tm&vq9&Pf$sqOe*>~^zZTT?
z2k!-hwsjQtFJ#cMe#pQ9YLkQ7ITIKeY`p*bg6}p0rD5;?f2Ud|GFW&p*Zg2$*$Zm_
z!0Q}P-ybEPfc7PW&TiNPIlBS0<{IQj4+geS4+d5S(7I@g1q`eW^BQA7>wG+zvcT(a
z9p*6@cre6)#?%u$7<dFd7*Zg0&m4vfP~XLap{20Vt}z2T*B=5s&jw^piU(5`bk6tx
z0r31|E%<x@=7xEVJswP1;C;8CbA-Tar{*zS0ksQ3{`6poYz40qSj4adB<8`uk^(iC
zrD0xUjt5f~=q!Oshb9Iau-<*3vznl5UqJgn>lzC@7#Ke^%xf(1VBj_NV8~Z(sB5h7
zVBik)V2JhgU|<nxv}>$^_MJg_091xGcrY;TL9(aCgDLYSc%5C-e~*T`#tsh#Zb6F#
z1_lp?h^OBF|Al%mFrV@M|AQA&cl-vOe=QFhyK$KJ-^Tm@e-F_9JZM}BfcoSfOvRA%
zAL<$>fZEX>3|!FrtRkj@_ro<YC^XuD#wu=r+S{OYUa;|=JD|RMLtWz(4+duN8es4L
z->24t+XBB{dN44%Ah~;n2UDgZD7}ID&7iUhd~d8Gg94~d_FyO#K~g)%gDC@i?|}p8
zE=0(E8jv&a7BDb?{N=$==n8dPPNxl|PX}sOg8IoIze3k+UhrVx1fLi0!OR&68lwX3
zuSfR32UC%w2SdTnnoRKd$e{2BwE=xPHKAti`~Sg%nN!w-fvE!2c6FHdj{~%C2;|m=
zd5ufF|9ipKzwBwQYs>)MqXy1vdqC$oG_LSq;4B55RRuajz+oT53{<-dkAmU>)L#Ve
zwFjS3P`D8+20Hh@7IyA`;oOGV3=H71x~_2zXzUU)e#a>ZIy=&Xp}-Q<)@oE{NC349
zL1Oi8mn%U1B}hN%hXW|Dg4WMB>;sK&g7)+^hBVYQg4XvQfcj;N_kT}tz5uNgK=zB{
zp8ue;oIrPEZ9sEBE7+}|JPbd}so*1648{Egcahw`1L1y-NRV4S81gHj?oT1n{d?;7
z{{o+PQ~w{d-iCuS{Qu3mZ19>rh7%xvfzB>#nAdo~gDGt(IL|Ely##cwj>A5N0<d4;
z`|t}aL1ENT*9dOkdN8o>g`~5*yP$ODun4ras_}&P|9=Jzb&Y30<)sG$`%F+;_h4qR
zL`s7`pmL|7uJHo6ugSn(3fi02{I4+sWHzMEVNV2|Md!hg*9eMJ4`$|{-TxW5v;Q;v
z2l)f!2T(f&G@b#Pvj&$v%;gIhSazY@ON*@^2^wbs-BaSh!1fo^j{}zr%;li_!@>1G
z=w1p?zYTQ14Jh4#_H=>v0(&r}g2xZ)t0V$I?H^DX?ET+;Eol5iehz~KXj}?ZR@Bdb
zBm&<10lIT&J_7?t9jKo2U`mCy;TdE=e)InCURXa{0#sgTfbtz!|9{Zlmj6dU>&!v!
za+t>;02&_w`4!|x%R~kZ59YEh3@kfQ*6G?TShXr)>8jOO{maN8(lD=q0kr-XRF3RE
z$iM+=pVg{(1k`HE71XTMyypG?KMMoPPS83{c)tqSEKnSP`mvz60kzK>_Ji^+XipX^
zX#Xb<NZf;gb!|gE1M--YfCmF>A*8MW?F(T|g{*gFH3j(%6!sp>rGFS$b{s%CyQm#}
z&JAoWt4)nPcLnG?0MJ_AnxEF-GjBj{0JS4(rJW)B-yA?|?ig)CIt8p69l>WM2!YNm
z1>JcM>ND1AGF-4^U|^_q^vttV0iRRDVQu#RPrdr-3Wq)5@o7d`4+aTPd#pAhNW`&;
zL13yo1B)dGcrDWl>zM!l!R@8J3_PGX2CWsZyS*7=Hv<Dh({9KarERkrSQ<(h7#gO4
z+NiGJaV*f@@kz7){{hAEq}>b*^)oIoIL!Nh0aOk<?)$&RI_m#_(7AW*kqj)&RiJh=
zEBO2q&|M6mHWzd(2{f+F(Xfkw0d&@%2Lp>E$UNwos3$<-2}&cNux?ajU;yozsC&2@
zv@h1DrJ8{Sbml9lO!5Bz7d*}cYWI2n|0i0%SGoe!X0D%g0<?DV2B^OXTH_BIrv{Zr
z9t_N&^Y0&k^0{R_sJ&96!oac}bp8zXeiY~|Ay8XozB2d>IPd>1p!LF_yHp)&Z6Rkq
zcY6N+rw=*H%>Z=1HfX(>rRM*6;Q0&C9ZGW<BpTxyWNNZJ*3~4lmw@~QP5Tla%*7`d
zShj)Yo8b0aD*XSi!@|IT+z)M#`wu<?+OY||E{n-=F2j^Y6$S}Vz6O<Hp!x?C2C(uU
zROf=uAO@W)0J^6D6rP}SmO*g@I%~K7m8TwfJRNkV<U9tKMkfY~MtKH>iChdkP`1iM
zE(QVc`58(K785-|>779aDyK7%i-Dz4iNT^Vo<U=xCj$q_E>M3Dympqk=*twv{|=z}
zpNWbL8$f-9nTiYzp!WadhYWkHA2M*vRAgwhRAe|Yp^;$@s69PlA;SVtm`qe;Xt7wx
z&|s;^Fk=EE!;uLG8J0|V$gpA}Bg2}BjtpBSDl&9<Fy)*Dsr6uR(zQ%vIN-rt)Wg8C
z6{VciZ)RXZ&hPN>o6DdBIwvqBS-=X^#{-oewVD!opmL;9lR*buj%b4Kn@|AdXHZ;v
zFc)bsux#Z)Uav={`5M^GFFe7(vITTL9lWf<Y5raY15iAMWJ25z>cfHkpydJcg95r8
z9?XRq3@lqv)*Dh_z6uueLF->Z_gFJIE@A+m^XL8lUx^2Uy$|$$Yh>{~9t`$#K;ocy
zFVtXQ@d33pA@^Xz)G>Ph|M$g%!Tt_mb^mod7#u)%uG28RWyONhoA>|!rI7Si0NT@B
z07~<qG!DBbe)2<x9#Gl_shz;cFvWu@OBKZS{{P?BGLd0|2Xp=t29`~ra}wb3j4h3V
z_M$YuWMBZbJwa_+NWX)@qEU%K1Cq}{YuKT8@XY)F#QQ(^PB!p4NT5AYpt({|I|6iW
z2`CMN+~C2SpTfYh$pbkJBijv92g@TMGa!3m@(mbRHi6CwfV<by0lYRDR+oY9ToORm
z2eQ+HIS+IeBv{YnhYUQRx)zj9L1$ljFxb7U$pFvG$TWf$fP&^jUj|r$>Ze*}XHfah
z0V=CN?(tyG1Fgjbn*(aAgY<*Ub8KReaBN_30QJE^ckw!a&p%=?0M!+s`^UWh|8E8F
z|7c>60p)R!|C=8&@PN`SD4%=(|1||<J|u7F1u(E|G(Zj)Q1~H-4ak2JoftGgbu?&w
ztM~s)ki7u&7z9A+Gf|U)Wug)T3&czY1`p=kACPmSHh}J60=L0HW9gu^r28G=XX@yH
z;uT~zsNW7cQwLPGg6wFNYXI#<(EyjRat#t7@rhgv9F1}f;PMw-M$0uQK*d32v<j#!
z29?p?|1ZUY>I2YRjradcfuQytX#U0f|0P#YyUv4QBY4k-!#)NZP<s{>W}yBfXk9x<
zA1FM%|NnCZ^$9^^Kv2FZsNMj@BY5s@UV{l#pDaiZXnq;A1_Io^hR88_|NqAb(y!ah
zz~HcnA)o;+{ugvtQiWq5XulW(Bd8DH{r@NE{7z82Q2=BgWIW-=N06PMItuDe2Jinr
zK>K%89Q*#?0rlw|CjCEvWbQ<e`@H}EUjvO3CQzJs|NmDB-4m_>N>{awp!4c-JQ!Hk
zgWAX7v;~SA^!NtF1Lz(-aQ(;5z|iQ$z)-8~1lo)EzrHg7G!LTy+LHrHLm)Y@*jxsl
ziRugtpmYpM3m(kb9~fBHqtqL<%t|7l@&eRf!fGcYg9yk@P&%EE#Q-|Lien-dm}UT#
z^B^%$I`;l=Bg4S54yE0&A9UUyWdD&2C|!a4&^)h!r_qLiqj@C*OZZ*}tD58&0oITC
z--rKaP_zF3fkA&h|9^+Q;QQ$ry#N3E2vS?C`AVd|*#k5d;Zai$I)munP5ox@+&}2<
zb&$G~jWG-ywOSGZ`kf5?p!3&3X*LnEABm-rgMpzYLn5G2u0dcz2ISm84+aJeklFS7
zUj#J9H3%f{1@G5loV=2O1+<r`{=Y}S<X7N*uo523SsNHw)}o9VgXZP1g_mO!lR+c%
z|34Ow|Nm&X*T56X$zT)8!Tzsd83RX6yO&6#3j<4iiv~le7lW0<K86&~m?Y>-cZYcl
z3XRVHf7HCP2&mNz5@}>-;AnJb;F;*bzyr!_iCPSd6WtkDKzA!nc*ej1kK;XzpgTQ8
z8tocnK=A>JCs0`liIaaNAoC}>fX9|Vdjm}xng9Q=NMqorc>%J=32aY&2e^+U(vZ%;
zGa-Y4XCgCrj+?_`0Rv+#OOQw-2LnqXGXtYT6N8I>D+2@AeJ%_f4)Yi^EZIO~r4FFD
zk(uxeJa5c6;TeO#M3CFv!R81wvVi>n@(Tw@Kg=(+>YjQI^B5VlI~o5w?qzTY)qL>}
zRMypMh!uotN?6o-IT$puF|gFCd5P3=1y@XTV_<3YWZ;;n&cHL#oq=P*O9qY!uRwG0
z40}Q~cGZPyUEHVL!N6ka#b5zi52D?{AY$pk5bZFR!9u%(AtY35v7MzCL!JX@zd;9M
zNT^o#KT9u$a?sgi+8wMRmJSScj&m7!LbXcvS$Z+lgt|yr)U+vyG%R7@sBcwps9B*6
z+J~qEYCqO`i51jp1sH(V2Z8RO2DuG1HrmL+z)|0!06KF^q|t+c1r*QVyg29oi-r{p
zJQJ2P@JwW9;F$1~fn&l8@R?Zx9?TgL3@ocb`5%7o%09%|!zQr21L|KkLhghB#ib0W
zUWW7cLE1SU46Iu~ZEeRr|G!uyGjN0Qn|?Ec7-)}8NIipv_I$?gj(b6K$Kd-W1Zrb`
ziG;s=@vk9^fv3JXzyUNaX6ekp(U8mlI$w+lB<8q};Yp)1152Yb15YC}14pPPgB9qE
zXjt0xU|{I6RA8_Vf3>ULv56r>yNiJ({N=@cmYUFb=wcAD)PlxC7eh$+%f)t<n$URY
zVhjm?+5OK_6B-X)tRa>Pka!4xSpqVnCR9VhqE^O9q#*+w*CzVy3=EEY7&JiVLxbEi
zQG<bJA}0e!t#Xh^qbCDPq89_>L{HFtC@f1Fl0p7*0L6z)qcbEvYW@cV=(mH)iT^u5
zYu7;I_6;=*0v3N5IBK3+SJXFKFgVU*Oo6Gdl@AEe?_l6}*vnv0tNcqOk&A&b`9A~W
z<i`vw6KxnoCfYCvOnAw_14@q|duurz^*k6@H1s<d7$*E-5Sj3YLBMeigG8-!kVvBz
z14|;bT=HOGVbShl1nom|2=#jL&ys<GvDRIzAk<63qL#zLpy3Y#OKnV$NX-l9iit7|
zER9?Y921=(`Ex=R0|zLtdN45T33cC97wU0wpLRRAKMhIy?F=H8?9ec8X9x-PSZrs>
z0S)tZ#*k2t?thjX&@gXj4Y6c^gn6h($v#UChMG_|35%LLMj{Q*7&z+N4M6F_0Gu~D
z#0qLX91I#`7+7jOoGWTxS%cjMO8X7ZA!<S6294|tETJ3>R`p#D4xqh);Ihn_foH;F
z1`e>>(;0Zc{?!sIsO1VUXp~`K0jr(MXi)3!0A5Q6N@t;79H6^-SwLcrP5-}u(}Ie3
z1t>k#aywTvWP{>20u;X;4UZXELY^~N)!erT&~F3BmjfuilK(R>g3>N1zFL_XIAG~E
z;S>WSJpNWP@Jv|AzyXTCnv;fl9t=!5`fZSOR;z4<lCD7MuGN`=W1<!V52&x{!NBAI
zN@w2x|5t$4iCAVca1^wI?x6agQmD?r3_91e(FSz4bwI^L8&JArkg$01{|BgE0;RwD
z4hsjzdH-*K)PVe3-{k>1`vW?+#Gp{?;Q<N{0gDz;`sDzPpML<IYYXa=G|Mn>G)FM7
zghw%0)!JVG*ME+C87F}1gZhd~B2E7qL_lRkV>kmtt-Y6se%Js1)++`0!}l_%f$j&f
zUdaI7|LOhzdn>3;g`S0IQQv&S0kj7Wbcc(>K1PjZy9R;!X*V1iEkS1$d4bP}0F@Qs
zI&|+P5m5aJsyjUx7%qV90@(vv&ob#cXik7ZpuT!TKz-&dk;#<|3`Hjy*g^9`j!g_a
z%9#utb=Pi*)NgwwQeS%`z<MwLe~{bit6zyg=A^#81-Z*{9>bExNCt*lGl>9@n<m|1
z;HZrb5&_*Com|bpI5CoeVR9J*i{m_o0PR`ed(H$v<@7`|aCm2c*6~?K{r?gk#b9CS
zz`zPp6ROGnuin$UVxk2DORdEv(7B2%p!fu}-z_RYcVGVyYy`DyEg2X<eFIQA4my8(
zq6Py)qg;auhL{ZlN24YK3n<;z+IxWG!eQ^PoQ4_(j^tMijG%lEI*)UrGXu-yKMWk8
z`=Kq888{&KWF?s}uq*|wQ-#k{p{$L7t?^A(yasAVf%-(voeUh!;QLH}o&=9$&0*L8
zYIB0xmEgYGJccC=`~Uy3wEzF3evXGj$Wm~dLnM49gH?U22WYP{2k3lSi>3enXtOe?
zIL>5<(QaiBu7CL(be6k~b}NH4sDCvvo`J#Ao`GXxJOc~p?vjb|U^b8AECwD+d(e0q
zgTTai1_4WZ28oIB44}DA22j5Xl$Su^37Url^?5*TOz;1OUqNipm=nmIps{5S=0qO`
zmL*G&`#c~y&^~!=Z7k4u38+760h%{wa@lH`$RGed+m1O=fPrO646->B7#ZMq>^3Sf
zsDSEHP@fePhM>M|qY`-EE(fS?t;v*F2QtfpIpG8Y%Mz4+CYm`cAae@U85qIlfbRNZ
zWDo(hzd-FSP#etq|Nk10eIUEQ=dYs4doVB>fb0a>2eQ|LIU$6BWijYH-4CEXJg5(V
zW+z^^gUw0y67gV8;9+1{9Dy7Lpm4WXzyjLC3-2d`+z)a)`0ki`&{(QLENILeG;VLP
zfXUn<nSsUozrkMb|NnA9<^Dt`1{IJU9?bD;7+4m;`_mwIS|ngM+x!1_Lr`2bIx(n#
z=0HJxVbFXz=v-pZK2h)g@3vYb{6FHsAkFIi|9>DTO?WUc1cJ`_1=$7Kb3YLjKg{u<
zadYr^q(w6Wi^TzOTRjA{FAuc$7qmwjwC1A&bUrq8trn!ey9gyMSR^onfWzVdcK3q%
z<{<Zi;t>>w4J#QydocyP|2G#fuq*<N$-?7?0<%EpYJkuG+V98^VV%IhGJ%ny#QT4X
zA>7P`3?3E-K;hr?6Vw;C2Avn-$iSgJm%#zFml;$BSwCQK0QHGM>n1_-a3H<j|C>(M
zH$Scb^_@X;SRPD{GwZ8=iPZ0Z5eVx0Iy8arS@o#zlmNBYB`h5nSSC6#D8S+uG><xY
z5re|yMc}wD0Odgs=GZl$u(U{EU<1(%EDKTkj}{3G1;}}{CSDjmf8hQ9t6?MPKD&Ab
z3s8JQ#{@uqNbp!KsC)qRS)t+_jd2Y;P&N;!PX=X!#uG%KY*1fR0?G!DVMEz6pnJ}s
zY*0TKHvXW}7}uZy6$jIeaSb|+at$sMJsETw;~EU0a-cCx6DZrHF|GkLwgnnvwrGrN
zuz`x(fcEW!$2hbY9KbXegG-}ag9nuD(J0s817-U($~6Q)*`R)B2$T(>wHPA6d@Y6;
zD4hVMQ=oJPl+N*Bjsczj0v@vg&zn_)?+w=h&6m~OGOhs4*VM{_#;I~a;|-v5FGHZ?
z6gmxz3_74X6f}MTnwtR4$Aac#KxuooB6$2s!-JvN0a*=X4R;PBs1E@;R|S+OLFF}M
zUMzYJ1Izpr*tsyEyuS}|c3lW){s>gAfW}}z=cR(qp9GaLpt&&*h8)nEWYAqdG9C;S
zmY}g#(3)xQ|F3R>=I=Zh7(GDaHlQ{GINdQYTIkONt>gLs1vEEe4Za^FW24nW1_97q
z6=;t@{rm$A4s#g5XBU9{2wK+;y7$0?Aw#uMkwE}d_JYp(Zd7CtsqcIMO7kKhvp{M+
z7z+1-(mQCL-uwUm9hQ=iJM6&sskJ=@oe|GaE8`I0!B7ZVM+|behzCP?Bh1|%3=9(*
z_BC*T%>%8iJ^*UxWcz}|Kw$@(=LXlw`~I8MSaXB-`A?tCAOXso77rL$AahKGko%$*
zfaWsFq4ys(fYz9qH0)~tx6454L25yICM$y0aukB&*`eXz9S?>w(4C5)J?|pk|6fjo
z##4X?bL0yKmbrUi=V*fB36yrA>nwFZ<8I)1ngy9d@?c0d1kX!@-BC6d>POH%`7NNh
z1EmiShHOLd9P|PPklSQHVxY3rgP}waDlX%}P?iX~2L`HN!TbM<za9(>pt~Yey#MbD
zZQj?Q0$l^20MZW{YXj{Af~2`D@SGet+-8B|oxuh)FYEnZb1g`n#bX9WkXo=l@LgC1
zod`FVzJ%JT;r;(bCn&9g!oq_&;td1KoGnun|AXrea5x~Z9i9uh-=k(fWZjSV|3Bch
z2afv~bUYYJr-JGf&>n8kcpqr|5>%#w^A2=Pu=oELGN3so59SEa84%#Qq2`4(DDAM+
zXmVG8>hCEh88~Xyyg~b5YC-i2tbG6~OF?t8pfOlbeGfX@yk@p?Ma?elikh3o6}2(J
z6*WJsD=ZrR{|C)&!}2a@To#nSK<k~rXT+O%SLn%r(q7h7P}@&`{{R1u^B58wCqd3(
z1*LV+zW%yryDRFBgZ9ejgX&rEc{wmSNcd;)g3_(Sy#Hsw;)`E{_x-@^^<c;{1)1;t
z|NjE$_@xD8e^oeW%_rFJwOZa4mI@3kHQErrPvvIdsLhB5`CSs-?+h%nL30-1HC^C%
zLB2}|HpjVBy8={()cmrpsFiUB&v$w-B(y@~UBZK*_#<e%6}l$az=MIIpkZEv1t?E?
zFl01>?vwzr9TqU?H0*1zfuz^MM2LRI4iARnjnH)C;Qjwupa%nENyEMd7tma8!@UL@
ziw6ws9t?Sk5cLc)9t_2xGud3A_IY^!e<tg}!06DhufYdo56FB-Sf;y%r@PsK#t6eR
zTI|BJ4%s<2F}O4;gU>|*-CbZ2uIXksTakf#rXmAJxMqvpOhpFHaLq#?n#=kD1ILVq
z3_LR#8F*(pGVsk#1nsqFkeKlhJZ8f(laYaQrXvH_>_i6chJ6hIAUk39doZM(ta<oL
z1Y|epJhbpuH@onT7Q65+up2y(++Y*#>1H=m9h5$QiG;hi*v<B2V4m@kfic|ukll=z
z3``dP88~LFWMG-e$-p|(lYwn^Cn!7^WNOuZiOg8ez%i4PfzjeW1ItWL2Bz7a49uXr
zCPD51g&(B6&Up%6s|LQWuE@1vUPA~h>_F`p@BdHkg4XCk@@l9J1ItX%T2}ZzJy71*
zw~)aGT5jcl?ll3ITUFAavw1B*bxWgN1L(}Sm|9PlRkbm$t3Y$Q6BQW*K<CeRFr?Mi
zl!4EJ{s5Y9w`OFJuv*AqV6DiY0ct0K?r`@0zY}!tTcu+Y!<mM84GG}9#(WrbmNbJ0
zQ}|9$-2}S#6_kfS;q1YXnh8BGs|7U20II7TCqee`*1_+?@hJqK8&rLA9Z0VEA%g+>
zxk2D_Vyi*>5B~3I*w>H&w&%(2ih9WXBy6Cy6yE=Tdp7KA$iX7V=>7k<Zo|BW6mXf?
z{1|ekKT|lT_y7MIjg8>;Rt6-027~5&E`Z7y(B15y_?W=RVB*-su)%{NF%c9`ptd3C
z9#YVGNcHm{pwy}0@Nm0a;lYq_5wlJOpC^M<r)GinaPq+F)W%o_p78ywc8#`>vItza
zE_)3s9~nSn-j<pI^0k`3L_#$g)WGBIe;HWnUx4=iWP<m-ID*b#0Ns<$zyO<rGw@&z
zmSJF-j?%wDX@5f3JcH5(XdROG|3`tK^yU5kkte7O0<}3{?R!vJ?EU`{Xs&GqD10my
zFgWaA$lwDi=fGz-g6@7@{2Ek_$9Vr&UI|KDp!f#W2OzcJJy1+$rj7RCxweR!WUmU?
zeJvi$K@G4zn9TtOMo?V<nkxjEZ84t#Ja5skpMl4N$xOD<9()Fq0GfXI+^D59gAK@D
zkQpGqwrVlJ_9yUw&Lsz(>ji3GdoTxq`Y7P>1JKw3Xe|clOd?Qy0d6neHU^c&YwPDr
zfW~$LEM*xSz<VbDGceX_I_TBEWL{>ym%(PDHRKF<CkF<J)>!a(Ix}b-8#M0k{r~?P
zke#6Q3N^`2BA{_#P&*0~Heh{;3<?u%Ky!|P6|l2#CNMJac>muP3M!L8bEO^03=A2`
z40$!l3>QL@`Tv31n4tMP@cB22koE1L`jLTUDrh_eT(^Mh2*j8;{Eiz)KXNN<{!;-I
z$Dnc;6vv?bcc3^1)!80Q9(N#N6!3<DWh%~l{y^mmH0|(s|KGY0R40PQGr?vxfbPoi
z1np4-^-~xcI>GTS0GdnoU=Em4-y*@_JC8xZ`@doh1IrXpy92A+L1_SN4=8;>&Pf&U
z{(t`>$nBuIw_#rcWGo?pfdS-pkRLplOe~;fH|YFXnfgu*P<xiAA(?>#6jm0=pfLXb
z0OS@BpMhlxXb%b8eo(m!N;}Z96cK))wQF?^pu25lKz4z{O%b$5^8XYDmdPJrX&4m#
z1k6wXolA;lMgRlLWR!Iz1kBKAnAf0#W(E%f%Vf~GJ;eIO0Nf_vU|xps%fAy0ER#WN
zGQjy9<QIzt3<~=d;dM(4EKV%$Gbn)0ssW{e=6wyIy;I=xP`&@(GX(9|1Lb}1|Myfu
zXS#v<-yY1ecR~A;LHDaREM$;?-nR<czv<G@2s-=v?oZHJQ4oE1-*(i4#QtT1=D|Da
z8Dzcx|62$;!?vRybbj`~o1n6|qn<(D`~QDI(4AeNdsjjG;lTZT70?+>cR^=z1VGK3
z+fWaR_rIWX2|_??2BG4u4Rs9>4f`3u=Qeu(zgyaA&mdQ*$?#XdlYzxyA43bMOazTB
zc>n)B7o-Q|9?<?gYefbf@BepQ>*rhm&40&$`W_&)pf-3t_zbAu3qkj7f%Jg-l-~dE
zN`meK_x}G^6l8~fC-}^H8Bkvily5+L{6K0O7J|&Z^A@zH0kjs+GLa#|gW1;yl%{jF
z)LHerB*Q>^?~uz34~DRrpfUkgriLVQ*dX7R1u8Q@X&r<?<s*m&&B%b-)u8em6wjb?
z3B0xlbnY}{F4_iEE`stO=$tIj{5Yt+4Q^vfL)w_2@m+_#3@QyN3>*#f8Y;a1%d&#X
zE{7%t1<;vyp!=#l7#J&R7HfmbQ^>iD^B6TiX#!OCfXWIFCKu3MyP!L3L25v20>SGK
z9Of~A&hM)M<#X@<w?X%uae6Rtu!6?Cn)fnvAcX~J%|(Ov|JxHS68?V!?F|IQgZKZR
zkbP_5wfqe&-v4hGS|t4c3Oa8WG^Pky|H-};qV}&KbSwb0_p!tK|83~KUOzKI<r;YH
zL|sFV_y60v7772qc>n*u2XsD?_y60n76}a89t`Zco%Rf%eH*Nx{e_+O46^l|CqQ$L
z0?@c-cHGCX2GURaeG}T2p5p!gHmgO#|Ign4|L1_tO|otPt?|5d64YmIw1wY8AJb{e
zpae~i0Tu}iyrA{M4RsB3K<E8>|G#w*bVe}v992+%>mX=6{wJtk&jU)gpuRn5|7oKm
z1II)w25@@<RR4g^xwS}O;PYT$+X#w#P#q20yX^h{{|QTb2JpV+Mte}6`Tqvo_5|H^
z$?SE6fu$dG-xPS91(a?;ZBOL2G2r|GT6Z}Ie8vV3DD8mGxvu$b4epnK`e2~5a=ibq
z&jp1o=>B*_T5w7P&0&E0lAwEbK=(k^+Po5(JfDF9<YrL&4xGQ1zOL|KG6UV4CgL!O
zK?3Z4dx#oP`UahW2cDCf2f8<#0dybB1B(Oy|AX}}d0k<#K!Cx6$vhOa4+>3eB4~UZ
zl*T~e295V6-v4i!g4T<8Ffh1SBrx!JFtFA(>}OzTsB2hJvsX)G!fplz(7I!gI?&iK
z%#EP-jQ9VaqL8$5<D>Wg|0&Qup$4SQ=~=<R(hI8p!0k>@c!JuTuzS%!d!-uH7#Ki#
zu(=i7Ct?7Vw~qT5-hj$NP}>~b@7u3k0lNRggCS@l=$=H-TE2$5hBcsb{+fO>FxcE>
zWUv-DV5qe@BvRjL0BY0l)X#b0;IN0G0+c2}{SZi)m^p&ly$*}OYpOSR|GxpcGa9rn
zd5gt%{r{lysb=Xb5%2#ud_i`D_@MT_2Sf5(a9r*Kot@IK!~6f&UeLZVP<TQ7e*Np@
z{R|9~r9u5~1`SYr*6%S00NV{c``v@d#1j<mpt-Thpzs8bwO4`e0yY4}kq5Jf0|QG>
z2l82Ppm^7BVPFQe*P->b320mZ6kaudtSdle7HC~IsGI_Yo5NfNhlVP|IU*iR_8-0f
z|9T6m)4c!x0<~cnLF<-4<sh{DxdADEuE%;XF#M@GY+M0K%ijNgfzCjvbXfF%iw6Vv
zEXO@ib*7N=<j28=x`qz#|JVLP_+L(f!Ur^F2RcUyv<?6w{uO$!7-+vj!x88h&;;-Q
z*N#HV4Gz%U3+N0b(D^8x_6+i%bO{wZ0}5a3{R|GEzN8030Qfvks2u1%G7V6>xzV0M
zpf*-Z1T-gC%c&*eFo!{<zT<}j=v)cVSxMgiKR*PWF$vmZ>;3;4=>FdWptZoDxCPBa
zc>fm%opt^I;=gO4Jk!%?4=<aRblStqrWp-&4NoBX;F>NdA3)Cp<N@`sz5joi2&(^~
z?$2pn2=?;}kUfw-?$w_VfB1v<NJIUx#{2*OghpEi7Et*Gy^{fSp2Hi^-Y8Ii0<;Ex
z@*hav2jyo_ngI1-L2YYLnE{$J1e?q3#>2qU1?nrn$GB{cF)|>py@HR+?$rjJwUT17
z0CJX~2a~ZTXl%o=i2>Bk`QrV56=*!9(qR#}-unQFOVODicR<);iZ#i<L?+b2*HCeQ
z$`8mGm@9n0gw0V#(77u7;Qr2h@cpX`Kz$bvCZnC8^a3i2z-#WC7(nV4c>fmzozu+#
z=?DD(4{4{ndN8nbf!clG{tT!L=~VguA9>%NekTJbI8T7eiQC2%)-C`4gZnzaAZ4<{
zJcb5P-mCAtz~C?!yg#17`~MY3kQiv*eIn%k$OoWvi=k`%L1jonr!BZl;smJ!mDiv?
zW2h#3T}`r=i1+_1j3Dt)O$G}~P4FBpgZKacM?h;xK<0JSg67gLgYK&aoe{v`{r~bs
zkb0PXpuJh3IZseI0~WIe^_5&aAZ?dUP@f4tCI*Ug<a<^@aRv78TxHPtKHz!~l>Z%@
z7(~4Pi?o8;j*xh|96K4b_HO^{3TsCO9?(5xpfjGl|6h6=lF4SL-w8fzHNX*ajt#Tp
zJcbzkP6iIgc?>ro>G(frpTZA)&|ZOg3<041kouhryr4S`JQ%>|+K4;uW603&WT<!C
z$FKyH&p>W%sB7Q=oh$48|I*!>+8+TP42&8eaZnnWX$vYN86`k@1w0lHkB>_mL1N&r
zPz2TS{~t_dWZ;41o&N!iiVQqpH_c;E0Oi$s(72@P=?d_;Wc%X^@Be?n=Uu?mIqdx}
z108Eo0PO+s{{No`Cg-^CKLZXk=0eKKe-EH)6CLL=B!pD6*@4=&+OrurLFoWAUmKFl
zURRSTCF1@6;!lvf;pspTyw*(w)HepT4?*M9-v2MIon6ns02&VgnF~%MilDZ~KhS+!
z?B4$`_Im&Smjh~tcrZKJFtD_P;ve460fimbKHIzoo|!5P450oZtd9fgGkO32dxU|d
z9i`uA@#Oy>(6|+{IiN8gP&xvoola#22JKD;1yC6dayw`&LAw)lw#WZ3pm49rkOr-J
z69|7LU{$LUs0TWWdP+J23&>BM9t;ei`CQPRN9`^K1xpR^o_7W9E|7i(iCPWtxc42<
z7(=a#CrGb?{(J@jP&qu~1OsS~P77%LGU%*L@BbITcO`(*uLrZE2Lnr6&J@Le;5GE1
zyubG$V-2J(WIO_jE0FtZra|T}y#HVP2wm@>0gZc5-vxTkonWqZGea`;&KD8y{}&uV
z>CuCM*}<xj;Q}Z<fbLfUtw-_xFR&KWR<%}S$gx_$pkmF)zyWHjSUqGk=`;bC2@H<&
zn4Z+lT?`uMX6THC`#(Xui$UE|7JN6eL}%>(|N31FF^=;XEHX7g`=%HSKw;@Hk3mJd
zi@_Q+CsjXp0cgz<LhU|K`-=g*W(72#2kIk%@(hR#a-Wq0LyGr*frXY2AY(J2bs6>c
zrz`ZC85r~@F)%pJVqD`mk8um=`~fQy2F9)u1_mo;&|Cmxi1uXg*)kg1U^g+D=uco^
zut@&@&v71OO;-s6qm>B*Q%!+%g{1?y900WyY(Q(-L1(CFPi9cJQ~;m#ETBD^K?Srg
z545fZWEN;$(5!j}2CJa||3T>ibdQeqWCjgK(3;N44AqYF7=GwaVql!L9~9RNA|N%O
zG;QSoDhn9i%&KQ#v<mwF&-y<DlLrIC4eiMcnxOd~?a2(a4*M7m)V`?r0a9P{(Mhz{
zzas!N9+>OVz@Xm&8aHL&0L@#Qdj0<oD*tNvJ=WDqc&-EGG0+%Qt)iDmJ@es;*`A;>
zW${f={|$8aB&e>l3}RrcbDs>pBN$|UEwjhEI!}v$+ITM!(3(9^-Q?uJAW$n0H}3(+
z&9(8t6`-@BL16;QFOV=`P(Td>29Y}bZczFF`H2H$ejRgjMP1hHiaHa}d1(IvKz;<>
zB?_wVX2<{k4{9%h&O!#=pH)*LUFo=pp`;;^(Zu`zanRmOP<;&Q3raLJg2c|Q^k85J
z0ksk8r+9$sH6HK($Jc`Pkc0X)pt0(@*2NW|`5xrGSB{|b>J$F|Z?tFNsGs9u;r;&{
zq~E#^R382L0J_7WehcWXn!ggDc}r0J1lqsl{r}Gu@R<Vp{#k(2#J>L;-v9scSSB(a
z@L;x0VPI(j?H_@+J&^Z^f%bfW@+qh-11f7kXF`F_lJfq)5Oij-iueCTpnIPgz5o9K
zog1m){r@+lpWVm+8jk|ChjhIE^McOT1howm^g(OB=YiYs2HyYARD$->)if}ug|x{3
z1I^EQ|NngvR5pOig1P@UG}<-j%w7qqkN+=WU}*x)H^JKy;4=V_?q>zfy@A{c9w)tP
z3_9}=vbJY0D145A+K(PBwV*W_3qkwsKx1#9I5C0rRnLfm){}$AgS`L$_64~Ul!id*
z9Xy^s??1}^K~Vkg!E6)3z|siXmx(Cv@$Y3}n5fAB!YrVA2(-S+gV{!bfu#{N|8@g5
z-hndD3)=q->a)&N2G1*k;sCV1rFkW2EueQr{oEg*a#91d2N~42^Zw5R8m9pH4HWjE
z`v7&C_kzO@dd35fB53Z|BAG$d`~PLoJ@%lq2|D|V2fWsx<#7dUT>+#%I`s$K2i^^8
zpK$-RsAmwF{GWjVWY^^X3@o6zg~|2|Jd@+W>$f<(|8s--N}znrQ0sYf9cbSHsEs`N
zF9Qpxp9NYkH~A$41899dxIEp*zyV#Oui?RL&A`CY02(hwq(x902r}j)18N(A;ujtU
zFG1@Vy({YHzW{}S4(P50P@4Dt&n*cmD?oikko_R@LHDyZ{|AS|6;OQza=-WgQ;MMR
zCrI1ZY61gG{TJl1Qc!;#xz0thn+3EU6XbqSo@~ejum2P9V73ZjV5tY~pFqTAB7+E|
z&STI4&9TGG0J#lxp1t?~lXF3RVNjfc(l2ODT&*qKPoTSHIY54zu#kac!a-0v=CW;A
z$iM+=gEt%mpG&U+Dl<T8!10%IyJB}D1Ne+H3q=MEP#pR-uqZ(Nz6Rm<ld7OOc98!)
zm@OwTu+;rPS!+Ph-6x)s=5EebEbbN{-Q6d05$?9Q!N5}IfNO04EUZC$b-n+e;01*-
zTE3BJm<u{fr9sB~{|QlOK6wGUSHS!K@w=criWJYFc?r;YR4NUfkogVJ8A_mYx4i!!
z2c2;u;lXSX02{XiwfRBwPoO?OXdDD|egNqFD$txiXzfc4C_n$P2DN>!g5na?r-Za=
z7(y05WZ=ku`TxIuC#dfK{{~bCg3e$B-HQh@19a{WBz^zC06M!BbgpKt=I@G7txfwT
zMlmpiYCYQ*s>yCQGn#<`d>0G&3>EVQ3@o*v^^oxK9MD`I^7sU3?hqViZkH=Sc@2~v
zL3z#l|6lN(8xHdrDnRyGFKA!@#T%%s1esB*_PQeE80ap9zXw768;2%_fXxdTIII^i
zeqE^uIp@h?4ugaFUT{6HgRB?S2k`#?=OQQ!9Of}dSR^pN@L<x21da89&K30je=OAc
z0k}U2KKIvy+3W!WOATn>DZCy4^@Wk|008yr!Tvb#NyPjApHh(7&~poQy#F851?6i{
ze|$kA14l?QixO-O3sR<=O<-WDeuI)15a;yjfcmB&vq9s}kg)k*2{wNoXzvE|3l9c{
zBjEncliwAfJ7_>|@&5n&BTNlw-yG=dO;9-IYJu9Apg3mWDb(U&0Ilsq(#v20&hNj$
zcaDJC8=$iYL2Z|XiXim@433K!z-tyj?O)K@HWmjNxV-=WZiU(fy7S4x`~OkfhPnnD
z@Bc?lLF@Y$Dl%||YO-zsmtFfnce^p9fY$aFYAG-{Ec*WiH1-V2Umnb+EetGGpfh(6
zWf|UZ_y;<t7E}&vAo+n6;-+87{&xVm14#`RB#eGR##Z2MgCnh=JLJ*ANuf}Sg8{VW
z+#&(AzK3CoMFN9Zp%x2+!y<+bBr~C5_X{33(7Qzpkirf;Hia5?zdWH~2b%lw@cw`J
zCdjRzFe}t#1nmuF0QH}}|Nn0()M5mMKj`dE(Aq5@@BfFdg4_ZLI};BEmP$~03U3!6
z*CU{@5l|Wer617zwg<C`3<FE$3FNv5mwIrS<jKGQT8lf;nE|wClEH)7_znY0C20I{
z0lW>7$lwF5cTzy*5Xe63Mg{@v1O{f1y&!Wybq%<kHID%_o&;W70}4a$|16@QZ~^60
z@BhrPpt)_3_~b+ej){s43XS#*G7}XUR2uCWbS5e?fa)KEiHZz5jrI&G6BQXu8toZ0
zCMtr?RbsJh{?B0I{r~?Q%S46*4`yQx29}BkxXNo--ooNO@Oj{%@i_1Q%;0-TK=mhR
z-6^zg7l7Jx1yr9w>T{zb3@jC({a9Gz02Ce|dqCmu{r?~64htUd|Nk1j|NryF?34cw
zU|^{LonZ+#3p5r6i=##*2FO}+E$CYECI--6KF~e_(3!)awwQqT|G!@wl|gI&!21g%
zKz4xI_Q-vIP(97SQjXG|B*UKGMrG)FcufXSods?SV6g{f{RJ8Js5UBt=P*G2RKe|^
zGL-pe((U=Pw^5lv1JuuI)MU`WV-G0(V~rnBe*zTWpm+ksd7%~qBdEWLw)YNHR|GaH
zGl0_?)IQMqTO8q6hO+(u*<Zxl_xoX^G6SSuV*sZM1Kj>A-GO|c7pVRRtq+0baqzwZ
zkl#S(3qk8Qhvs<=44}4t`yU1qP#?x|-~SgD_5ZJc>TU0T|G!%A|9=Kl-hukTp!^M5
z0|IR)UV+qw`V}C1K>Gn<dDfzV!3NYn1o;t^*C1>6&kBP2$e{Td$0i07P}yOz0Cbic
zgQG<)1Bb<Y2GBlK0q=kRbwT(0fa)8Nde9gWXv`FpUqNgSW_<w$mXZs&%0W;Zg8b<H
z|9>vjUEp&!EFLqMG;)H+a!n?@WMG-7%wRH+nE`xW_k<S=pnfN8j9b8iS#JXaO9|*)
zj}5T0(k6j{Eg@N|!J>hoe*ZxR4``T%SVPW81)q@uYCBqbGMG$+U<>d6y0subg8D|F
z@h<Ow{~m((T_iFHc>nvSX{*q{kf_PP43Y!QU4qgYxU95m-~pGFb`7BQZ6=_5WI<)6
z_y7OA-v56&S|&1p=200unDsb1RTx00W-~2xVPFC6K?~&++ZF1?Vh38U1B&N~o(y|H
zbESps;Il0y8aWyE)OR^B_{?Qc0Lg*Ewvm&e21%?2BnAs#P?`mg@7GI%&m;rQ^@G}9
zpfhkinB=a4#$Z5ol?StK0|QGjsBH_+U$FUnSQ!X13#1knN1*Tm)lnYIx(*)9;yMg0
z#RACbx8}8V1$cfIbguFVre)0w88kp`PS9E>kQtygvU;+R`z;+NG01@S%{QboFu>9)
zs7(kuUkG&9JZMZO)a#I4ee>gr;8!ks8{HY$Y#kaHCdROe%s9@#5Sn(#ZpLy3M$kT~
zz%&=V4aXUnLfH=41+szJETFv?9?Sw09VanZfX1vFZCFJ>VE}3)Im`jKkw9mMoCVdD
z4)gv$0m*~q_WiGE{=+H(oi_!al?|CY)o}sO@y=lYr896}7L*=9^Ese84wPqV<((@g
zDzl1!<^nyK1;A$&G}^L?fW~V;W`pc^m;*V_!2AEdK+rkGjj^l}pu93MhJnG*^Z);v
zEKdPY+tq_v`wFP<0E*j!PKJh%mhOKcE$nunG-A;LZYObAv@pnov<O($BrAzDBs1`U
z)WYHe6z2OuXMNU4gV#)U+AxaM&jz0t>LP2+Py-(OiSZJ#e#xlOX~n2eKNl>gATyVN
z9TeuEd6$~`N+LCLK=%v$^#z@42f1tV{|-<&0xpl3wKW)63PJl$;BzDU5bL;YK;;Q2
z-a+$R6BaZ40p;^f6$VDoU2BezbrKx4Dxk6GUAZ8?dN44mbSwdlfient|NDK@(w<Rd
zVLYQqt%E;kZ#P5tenz30_Keb23;zGNX88XfGzMIE=aq=H0s|vRouw@UBWTXfVGhHM
zPSBm5oeZFThavi%44`!qD`YJgYHH@Z5~+>%66wxjRJD|5V3e<BV4umws0!MzX!V;>
zpuYZ=NX?!X>+1gR60s;}knsNZJJ2$mL1v*fqfV_tIOxpI9FQ5EDhy2Zohv|XV~cKi
zMrlh621fY`h8mFjYU*!^SR^ybfXwm!_gk>m{+7sWPe#?*nv7~)D;ecLV^ScufcAZM
zdNQhk&M}?o$*2Y@Ly_)i6#=p9_j-wd{OJAvzXGUihRjK5&Vj|Vr2?Z4=sW<60}M<S
z4;UE0@!rTF5HhFVE@VEN0Vr)YIx}R{cl@qMb!lK|bY@@(^>Waw=?boBXl7smm1CfC
zJEY|TSFMXOXsnsR`~M$Za9P~IU{U{s!NgMG|G$uyn{~085A49{tyW2-(V3y7*2}|U
zqBBEDqccNJt*3{@L}i8?P`Uu64-aNdP`?yhwuH1e=+&GwuBc7X60tbI&;Tk|EEX`Z
zH8L|~fZWr-%)pY$(ExT=A_qf5Ek|%g$SW2*iw6uTAq*F|COl-|sAXZU2u)|PgRZ~r
z1=Xpb^>>i55C#PXmORjX=-_+_nwPM6z`zO0o6vF}eja(qUN$?>+Fa0FF{q3Hl~15_
z>HYsdX#EZcXdRs6Tm~I*nY0JIzJRA;4y%aw|LrHC_Y(?OG%#>_|KGk7G`73Yo`ES;
z{g7Rtx{F@Oa~3=8b|%oBtDrWG3@9Ig>;l;XzNfN*feGYZ$oRs)C!l-}PWQ~}pnE;R
zVP&ZRZnv|7=7vCi1%(x8P5~5G3m!8tA;(ur3+PUSUyYbykqeryf`>&-hjK;Da&2(j
zg377=2O($6fbwRiGNTyC|Df@CP}|kXfuTcIi=hToA9b8$l&fz8pCKUuPNxdsc@;*`
zTmxuLKPcUL|NnoXQJEpb(t+`d#R3Ly&>lcgID~Sr*rlp8Fo4#Pg=#wJ)pUA8(wifA
zet-d--c*!9<M9mM|9|cUo!jHk$N)Mo7*w}|#&AVyS)41p|8ENfopS~Xt6F963J+#A
z__($u14BwkJByvg0tQY{c!B&j`5}V{sN4a$DOC$$f32r?1?b#>iHr;!pl}WKy1-Sd
z5)8H<6u#d7e_Ddlyh9U%$b@=^oC);|1)#JHYBPf32xPwpvl?iO0vt~k2N+U9mV@o)
z2E`G`K9KpT8W1}t9Aw}C*<o>jK@sHtT2AkZkPa3*R6BnhMUOjJJsz^uL9b@HaRta8
zkoll-2T-_@X-_N`d%$Bxp!Gld85smXVFoIvLE~E13mBNKU6~m|ezMqEGccqy)-z;)
z@+;`>UQqt6cfVXw-|@I2HM@bKKJ#`(Vgf@$V?6`IWJU&#kdzBt^;)OF_qv8=JLuJL
zM_1IQC|7v@{|=t(acpGZ0gV|sH2q%#S}Wnfta68eB@5I~MvVPDVEB*R4i1^aVh2jA
z;Jgc6zXNImgVx4?(ysUa|EA!(C-yS<faZ5W<G`?dXYqi6$@~9*(3!}f{T(tLpmFZx
z+u*xfVQRep|N9EoKNmFK13nA72R2{nFpnXn(;jkPvco=x2+)1MmJI)=TY54u)^|yO
z*5pex{A-Y?jrUkr>mINUbRL4kA_mZ1GoW+FH9+(3;B?EtAOos*I=#U6_%Jx^`~SdF
z6YRDfAiKcl=*$J3mEm0xlFVQOa*xB_|0R&JRQZSw8v}!56Qc;|oEFD<j69&T9UbQ}
zvP@C@3l29>8NT0<34HGI1V$#6nmfi7GgTQFKzpcaW+_*I*3LF6v-|<ILmcKY_<-8D
zpm9FXI#TGlU<{x$06}TpgMnd5ry>J~b|(X~!`}ZNK>2T?Ez6%yMF#FrEeE|$MFuWV
zewt{@%Fr;E6@2C{cpYpS=uW$T;C$rRz>r`)=l_3@yFm9!TRdQ}ukQk{Z|AA+eBj`?
z2eKa>6gIW-p6ftkV71agBApxzjL^A0o|^w)ah_V~fOX(GKQ9I*P&ozO7nsPT;K8i4
z0_0v$yN7`#162Nl^CqbLmsMu<KyJr^(hn%DK+ae65~<bl&;yOdg3ek1<#SLw*MnIp
zgMlRjw67Cx4h}OEpmQCd`FYTooQg#QXnpy{r699F^MIiFG>elAjIx@n9-w*|6xOxO
zULrMzJ@qEMV3o0Wz`#-Sl6e`ZEUJ0oC1T0Jz*6(rN@T)vRt+bH{~thWT0n9WnORjP
zoC2SBB;diU2+Aj5w}Hw9&{-3pvH@O?K8Dnzkg~@?4_=o(xxf{&ip8#$MHw`H$!2kY
zVS&X1O$Lzp-v7TiVksNoc0kKG@IDDVWsfrMGVb$3BFtw7`$HMr9$>*zhT=0HqyB^S
zYeDq^s0{$B<E<YsFo5o@XtZUOsh<yS>uP}K0YU3lAmh5Avzs$JY8W^{>zTd(f7<B%
z|39eDEaAbd09wZd36lp5DWGr%#V05n!R~fu$Vl~SU`X^}XaKcmK<z8gxk!!73@o6w
z3n>0WSuSva!W-JgV)6d}=_I~z0o_>)vIAy5=nNHPJ3w(9^85mq#Q}!JF#Evuiwk(4
zBLip;x%dB1saWg)x79&&7W)+$!1HgQ`3&m>23G4O42+;PNuV(~iv^Ioti1pK1FZo&
z;r;*PLU4O#$?FQpdUJ4l3AxNj0gdY}bY$QPwLfGRXz!vI>Uqd6{6C9bpr?x-Xne+D
z(f=F8FBupe7yZ9b{EC4IbT6Al0t3iwSLl81p!-m^!0fSDz#!uN|8ME$UyyZekhZVf
z1_qXt8L)a1l-EJ^H*!7&<z;w&w`%~MJIdg}EZ4)pk^;Kx0344XeaL#?>f;)8I<=r{
zO7<~;&Vm5t6UK?0ko6riwZQX@t)Os49)I&-<^=VNK<Cnd>{4K0Nk*A>#A=sag9hkK
zF#To*e#f~CGM3H^j3LPiW}rFbM!N<B(0V4&oCau)0J0Wmtt+T}0r}5^S$2<13qws!
zvyw=s3ZtS$3nOS>HE2DQL#GOZkT&R^i@gjcohsn{)}S_<MyCpcR4w#wK8HOF5}hgx
z($G6HK=)d3crdVo?@ou5r^zN$6#s(T2%xaCRA68LulZg8>SHjOSUg~G*zd?B0cu}^
z>K0J@0UU;Dw=0^R85kxigTu>VrZOWtXr0PLP#aN!!C|5@Lk*}Lo~X>Qr+G1}iueD|
z;4}Lj=P(s?Dl+hc*2T}XXJiN6C*By#3ceS^dM~RAXg!l9`kfN7ptFg<bLAqS{R^No
zj2)W(zX6STf%Z8#fX`WPu<-uBhS!6ENuZ&gRRz>Guvo~%;r;&)cyAI^jSWZ~)TZsU
zXJpszWDuBW&rmbbo?#DY?}OuB1`+K}@VROxpl|^7-#}}#K>d2{P6h|i8hnr+LH#$-
z8XQoY5!6nYXwQ%_Ii7(5G+yNW{|n@Ndq|(cp<zC#PqDfbv|j-<KjZ!Xog*l}gVch<
z`933q#RCQ*@Bg3n>Nhh8Li;5e(0+*kXzrtC33#6aXm5arMFU9fYE|&sK6^%{h4G9`
z;C{0`BgevcMh+;OYhgSi7nIGjFrJYI#0J}&avR)c1KC%favM}nK;8WTdN%3%l^ydL
z#X;`#{{N*BJTABhymr&adcpty4f9zg8uo+yv}z$}j>kHlfdkscPynr`wytN;@c#FD
zBIs@lxOnpI3h#ffYe9Tao(Jvy@&5NZw_`pdAGm!3x~uZ>?+Q@c!r}m^e*N~hV?HB4
zid^b#P#amn`~SCx9rGClP~=)4!{m;F+zqnF`~M%%U7j4EHM^FHOa|aFQf8?H29^XD
zSf3h{-jUm%pnVOXv<<35K<jam=d1*;i*Mf7AX8KO3v@m;gT(??5AT1kHrCg_)U*E2
z>H!*?1&u2;|7%bHr5Vr~RPX=aS9<^d1G)nZG;RQj!vOF9D+@vCrlGC@v@U?b`~S*B
z(7IGxhyM(TUJQERwLN<oOKKQc)-2RwVBq0oVDMpJ)B)Y=nW)LY1QOq<1>PGF;r+j^
zv-w{`3@D8_&ST^NnFDI?Iqqfn)9A#&QV2RcyNN*q#0KpZ3iV>&G0};E#ryw?qo8qg
z*!iTO`~%t_<o$oeT96sm3z!%|?JkHPejTh|$J}PAz`#+f&)jB_0KNy436zFFeK7k6
z{~5gh-FTb)pTPj+wuSZxHy3LD{|yq`Xb&pS8NYb{f9;E;pApn|^!|5aBS;OhKB!+=
zK;j_1Q2QA`_S-5v;suA5CWA+!7Xu?mO|643Xq*PL3^E7gSFpbqF{pspsQzAl7TMph
zc=BLiFaeo^65d)Yc7+-YOpZ;Udqo*oY!&{4#)9=g>Na|U*L<pg?u!E5s{`uedoXZn
zFtEge=1IWqbBr|g0J6^llnz1VVWVAxLUUb126!EfT?519-wX_(I|97_{{*eU%JKfc
z+|z@Z@oe+F2FTdNJO<GEo&xXx%MC&M7rg)fb)CHj6t3X0aZvxc#QXnp(b<1MV&J)U
z1rKKN8U~iw7?gSNMh0*h4m#`Kx`lxel+Ho(;Gi>nKxHCm{0QVe@BiPycUd^jVR*C9
z5pt&!NFKDO3RKU7>iCV|HMC!kE_7tzDfDDuc5Gshv9xFO2-Os@s<rh3op%PgA8H<0
z9yDLG08;<IbOq%@@EpTJ(0Z8fkh5nYWhJ<;=KX(}C#Zaesu%VC|0NbO@5=(7I|h}v
zpt>?tlXXp@7I;kpc+KWSW$-y;p!4}ytp785fbM*&|N9Hn$LE*~u77@l*H(en5`f*%
z@)%V1F?#?10=gqX!-HAOXNuxqaGPmABa;NEo}0kPWaIt+hbpKH1dqoifclJ#4<`R*
zU;yof2bDF@uwn83|0NKdANTyf)3K0&119JF|BEG5{0LYaWG`qP+rMWI7dkR<TQo5I
z2dxdUsAb@Whp#OIyZ66mz819%yfAt1f6r_?Z5h})9U1s7H5oW+HRTFs#)9uB0j(G1
z>2zcem>J6eq6I-^2}llf&uOP3gV0P{1|Cpf4(6tb_N+4A|G!E?-K7Hx56~E^_x~>&
ztr?j(!1n{q0=Jz%SX(hLg7ty!MrA!*;r;(B_>Kq1ISgkODl&0|S|73tw06;3sK~?>
zUd>_`YIDdg(8fhCd=86UF{o{_h(Q3X-{mrBy-Z<oCj;nAZ}5HU&~-6_-v2*WhG(+x
z1Fds(*vFs}4oXM%pmf9vy3Y$-h9a4vTb#+j;<$(be5W_m3?}dYpG}KFYv>m-fY%*E
z#f829f0hOL&-?%9tHqrR0%-a~y#IgtTW<y0*ZCiOPPt_wlZ6Mfhyepj6iV9@N4pMm
z4jt%BRM0wXdGL9Bh&9<3p!O<g-(aIB0|WT1K`+o)f&<7uG9WR~xEi<(7}o%rhh?bA
z@>~aL^9i3|V2MJRqr_&v2h-oVpt%~59#H!dv@QU&<_UQpdqy$?qX)Ba1p`YYyiW-(
zqp<AdZvNK*I^Pz&zONC~p6Lu=0G~xS542DIuc7z<|4%^T`dthlzw$u+#{&|B`32+_
z(A+-Q9a$dhJeY<4Ft9{|#?#>Al$Ol@|7dqGNP^Bw2hB%<+LoX`9B8i@s9XZIeL-cB
z<6H)tM!5zaOHYQ_P-ix~P7Vgp+G9}oaTFvo+%I0mpaj~_UXaD009sc95(Bl#5|SAd
zEII!_((Yi82JNwcsso>C1(I)!YY?gR@)GID`v0g=u0aCHTpml$|9?Stf!3#j?yl7C
zWbkvG$It^BE7tA=ua8b}+{?hD-3gx8_R#KRaCMx=P@>(*;O)4NA;yD&VTN`mL!je4
zh6qqwU%QjRAGG&NyAymzWDV#%YiPSN$Z;Nnj&>(Q1ZeEZ0=)kcJZHoTawBLC!2AE-
zMo?SCg8{r&h6S`Yz#@Tx+57+h7ohtmL2?fJ7%C9!dP~nX)HSFy%xlo_{$F|!wEh-U
zw}8eev^yDsL372RGq*r#QoEDE63PdicO;<Q$>0t;7p^g`!35MV0<9gc)%5rQ>IZ?!
zTTod6vd?iJXg&9zm!NS{P@eQ)7L;IM2@h#>X5|32-5usJ@iZ#4g7%DXIP7C$fUT(m
zrMZ0%;p-`F8sz@p0L5|hzXl7?xELt!gXS>7{h2x7zKj59{28>yywR>fVx}hpL$h3i
z4XB<1wbQH<7??nJrq|54v94b7aD{dYXbg)%qdBg@0W^jQZi_}Suz4^stgN2}K5vbu
z(XPQ|(n|)0n)x@@LDicy$2EAMsjq~pm#C?~u?{rn(lH;@7yRp3KS#Pke>MX<XnxFL
z-v5qHdj=-(*x6hLkB&+Prut?N&^fI(jd2YwAU&Y5BT#z^v`-4Ohi9S|sE&rz+m;Fp
zT%d9vB<B79&(oS3(0$tA{R^OV(>|cQ1@bdEKD@x=@!)hnyAyo&B@gI6Vo<sb_2RPu
zse_HBf!anOexqE20YNpf3>ly?i%wZaIZzo19bZ=j&mYAi%^%H$jc+hP#`7WbM~vS8
zAHD^xod?(F3m7=O|2^OZ_1!^f*Mphw1&D_9F+)N5AF;m45k60!0-B!$<#|wA0F9-2
z|1Vw(I<pScMgxuKfWil~4j4p(-01!P4J&A!qGJ=|9Z;JUG`8nBkMT&SJtL^zV|3WZ
zxTDjaQ4zEc!(kuenofI0&>m-y_<~M*MrBYsbJ)i?rPH1fbcZ-dyra{eQ47&uW~}J6
zXVgaYml-oU<}=EH+P&WYpT7mO4}ka0ae>mm_x~4`4Rs9`pgxBMI1KJh1+Cdb;<tj*
z9VkAV_cLUG^nlC!cm{^_y$%eZeFVvS85%%iJN0{mD?&9daMkbi2Dw2iRI@?>#0HJi
zc>jO+w9&310DPZ(nsmiPdsfg{pd1zlK=*hxfX_(i_|K>ZGT;0E1K;L-4d64Ty#L?r
z1n=E#V&H-HSyzDi@$mHz;J(@2hafvF!0R9G!qz`9g2vcE^H7a;4Iz^q88jw4g4c|J
z);&Z_e#l?}S^IEL5Im=|h#>&fw*#5u{qHVljt#WGXo3erz+X_=;V|!i3s~;|JV%f_
zKyxslb|a_`0GBUw8RS88(GK(e$$-Y8L2J%HW5yoLJZoU-sL`2Kpiv7v<_^jWApbB-
z)B>$LWnciMGuU__bdKsjXif%{zCm>hY`&-=nSr5Go`C~2#!39V)qPg5ALcMffYKaj
zEV@yXRisc0Jhs(ik-#v``~SU6(B9OJ`3#((dDxJa3WZd!0}P3tNMnUs!4;r$yg_jc
z8dtAX0nL{@0<B{Q>DPqn=Ys3^JOH1^1)Xt@srTVih~0PJg6d3Ane4&LJps0t8QON_
z*}srM#d;xR?gx~IKyyLf|8Bnp*=MQ1AUjhLyzhx+rXqu&r2^v@ko}<a4hkn&7=p_L
zEOW~BD_>WD=lCFH0+09qyEiQoSnqiMzZ(fMpY-r}C<xVu2nV9V@xe{dJQFA!Jeav!
z7+3;9`|#jx4rqSl0gV&G+Z)hx&Ol`k=p0s1-f5oC5aIpr)<w`b4`@!uQh`BeCg^-2
z1qPvs_6#AQ^L8iNgXf2MX4*3ZgY<yXb)zkV0cc(obl2YG`3w=DxPZ8Y^9ut@zzUQx
z2T;EXvM)jfRK|hIKkEey+@L*h)(#9jF!#XR46?)f-!0qO@eIMBa&dM&0|Uq{An`^U
z1_MwZ1ZFohUnzj{qWAy*j1~!?eQUSRLg(T(fYL5xu8A{*fh7R6uIB@6EfuylCag^f
zp0}C<SsN*n%#Z^evxJ=sCE&r#DFVua3@rYja}VL`vq0x??R^NpFFd4Xw{|7Szcn+I
zD?sOdfZ7!Diy3l2es)*{T@%Z|=mA=DRqOdmq}Il}qLYh(6Lh9EXe|`@Zr}L~;JYkA
zdwf7);QjyUN6?vI4o&~hc>n)@090Po?*W}BaGMttubs9GTn*){0yFIyf<X6wfb;Uc
z|1;{VZdcUrd0k<(fI-8mfq}sad<Fx<lyD(8yKuoayKsSHc2)-%n6>9Jh=Asgy#N1K
zY_ws3jsr39fb4Gk&MHuA>v?UmJwpU2PQ3r!m^!N-k}g2|?rNV@SImlMU~1H7Fqmb}
zz&uNyfn~Nl11l)LX3b|{pS>S+eh>>}%n&pVZO;%=AA2FNUgDKVy`>lEo;CyRSqvf|
z^Q{*!h&b;3pAsGmTCe{<2IMEueP?FZz<2D%)K}dAuRrtte@hfpc7xWVc`&m(FtGT6
z*1zJ8lf7thlEA<q{}>V{j!g_xKxTRWf6@yIW5*_jmgad49JMyTL^?egI2+ADcY+3h
z*2#K+!+p*#5%2#ur#9C$Fm&2L!o9x!cEwC<P}u*0)&&eY^}AkI)X#nl3VSW2us@(b
zn?WAhzUqP8<=ep1F`GfCV>g3L$8FGgJ<~KnZ3fVOMT~fw1B<7>m5tU|;>iX%p02$m
zDW2wIiKiG)JUzmUrv_*|#URJi?^1X??Ro)?ryIH2a~Xs|=beN0_IUrF>I;f9P#NvP
z%-X@g;)A-M3bE!&29$3=`3RJ6z<JaYvY!gv1_$+<Y#A6}^IxF7N}x8H_x~wxL3_ky
z?HO`Fb7G*mM-QfnjiC82a9PCw-rFbP{eQ|)P+Wq_Fb`%{3kDW%(7Kf!@N!}y{M;rV
zkQ+dIm_hF7Sj-R%x|1kW>%~9Netqp$27y|SfOWN=eg>ek-W}&MoM~i%%(;NhZf}0U
zkO6A<r2jv_Q2#%;0&-u+1uhV~(}jU6)T=@P#I|(^4NmlOa-QhO06L>sp^=M$!Qur2
z<AhfX453_Zc7a?+^a8n@<N~=4@HH|sgiLf~;6WFk=*S>o>A=tcz0a9prXzz0sK43i
z%n$@RH^(B8L43wS2C<or45HruuDXKGz5#_9Xnf4#0E4{6Lk0~?2GCgMb<o}^4rn>*
z;la!z!NB4L>RZFxxBC<sRG@WC3g|o)P#A&jQiiOFL=GcZ_<-ik8eJF|nqM(wfWpHO
zG=9s)z>xf(p#gMfMJR`ZUj2V(Nc-@mcSZLT22M~v4ipwR<hjECS14FLU|_4Y|6Kvj
zV+R<&SS@4_F#8S~H)G5J`4L>t%QAr4k&2y>48frG60Ww<q=O6`;JRK#xuRYZG-h)3
zEoi^2!vY4-9ls3Ck6A^EUxLPW7zJ>d0n_jO|E6Z6Ed#^km#m=s*&j5|WC#Jx<v7k`
zxB_w)DD0ae86v#@Uwa!;s9;t<r-Pw>)??7Q_#Aas-4*r0mn*Cp7`R|+>s%*S)TPa?
zs9V0e0uoQxY->uSD?swi$*dxvJ++SW7($A(K<;DE0GaRo|He|V8!}l%KxZq~PX^y{
z<O2#T&>1MjnG6D;dz@i%pf%X~GZ+{wE&hYfcvY#j@U8&K)n(2ItPAoIacKHqQa|fK
zphMID5YSmp#aSTz|3G((C4lyjdoVNZVPNq9t?7feOF(U5ls3tH=$W`R(iIa`7$ht}
z_mHMAFjy~Oe%a8%pa9Ni_Zd_={xhh0Fuk4#s@Fk#JV4_h;5mSK;4uU)@Bf!U_gX#y
zi|qr?->7*1pYRscewYY4?@-}C=-j`6&UgkM{VwpCWE!0@3=G;`;JxM++FcAnpgFOH
z_6!2GnhY0eHUAZW(%XW11_98T6;NM2Ba?xtR+GUbRP$z?rRM*Cpz;FJW@ltzU~vbX
zKV$(bGxjwy%z);JGoZ0mSe^ilJA(W3iVPgq3=H7?EmjX0gscuQ2w5#=5U^^1)U%*A
zmiPZZb31JrctLA|K>h;t<3M#VMDE{O{btafdWMjNu?zyBHN`XI8Dv20nehy=AR1gY
z&ST&K)&Gw37z03Q!eI}C4k!)4+w+SUWEyQ5z+<AIIvUiTvq%7i6{88rZjil>`xp}7
zZ8PQ572f|YEbO#r2m<$om%Of+%?P@qN5f<m=nPp!2F^(b8Db_aWJs9R$Pn%Q|MyLh
zIS4;6=)m-O|Nr|EwAU3h9s(LyaGb}mM!S<i$YI|9DIN?A3!v^5L3Xd>qW>u!_Zfsh
zYnC16F^GWn_mpb=|L?Gf!3DHeO}h<zCPa#M8v_&QzI6Rr3|!V#42;k^2edas2h>Ic
zwS~O@UtC(>`M3hq=JNjkuLpErwWSRMqr=?)9~$Z!bU<So9s3ysI{q`rbjpM3;=Z|{
zauBo+99DmT!q#EVKhPb7Yb+BPPIxf=gWua_@qqCQXpJIhOa-)#6}097)E@(v6<F5r
z!Pit^tl_&@3YwQkT^H&Kn%9HZQQ-CIiVQl?H0J{f?}?2J8lX83P}=KuhL*)~4Km@L
zFaFhcd93sP51AtX%@u>vmG}RT8$B2pLHo2=z5ie61ocZmb6*XQ!RuE*YaUrro*!VC
zaF9U)RF5V6WoUr);Tvu<gw(I_uIS#+zzK?*@VylZwX&}(I^`L-K=A}l^NtKMpmi9a
zdDQSI_Bv2HuAg(wAiS0RpB^g%gTo{Sk(yV*6`?E@3b6iS!)}HMi-!ynkTULKBqY55
zZvpj7p=nsjanXMl$4Lx4puQJqEU{xg19Yt7A9zol!<_#upmoNe^44MBe{i1`tXGu*
zq?ZGv59EK)Ssb9d|3G#)?)mot<bRO8V0WsX2F<zhg4PIv&JL-`0G;#uA9R;E4>V1b
zfX-G5^>nif^gN;$=;<UE=y`xIS1Z^_zbiP@Vcx$5pfg!QwcP9iwT|coYB|XTY8~JM
z&5t!|g6=o|558B=Vc)-sPDSv%Jfq{@e>siO3?U%%8x<KO>Nx`(9A`4{IPUvD0d&V+
zV<UrxWg>$IcpX2}p8^IJXVBTQh&_;s@P3F6tl!n`%*X;NQ$cqhJIrI)BEN*82DHDo
zKKYeMr!}LZbv1as1qbNf_D*XCA<#KF(0hDY9p^H%fY;qE2A}H$I!npK``?+Vlj9j!
zX4^AxfX*YE9nZiA(l^tdfv3}&K^Qc?In$nj7j$Ne;~WMV=(sRwOvPfNJ$N084QQSi
zv@Qh7H<@V9paVLu4!o{N&AS4+KH0(hf43~8EzIcB>B*=a>czfKzl(thbS@tfAGGEJ
zw60ex)QjD2W;_FTrzfM{%y<S>(B03LnhflnZj1``9RZ;GkwJS>R60EwwF=!qV^ZvP
zpflfQ#)H;D|KBh(9<)dG|B8+_MmbRb64Z9^{(l*~M!;dw|B6m~22M!%_&=x9o`DO>
zPUy5};03WkcYSx-gXgRm9QXbA=$OyIW2y504``nN=niSnS_kj{U7-2D61ci~3<;g_
z464ww8+10oe~{ZjV`Gi-4B)-Y4IK;_p!Q@+ivxIVc|r?ALrn{!Jqcphw0Kucm=9W8
za1JzQ;xVJ1L1m&1E6e0RtOB69S<v23aJ!r7mjwfh18D!}0eIbYkO4M#>H;c9K;;K$
zttIFT!bW9A4p92Z)nfJ0?_!(>I&&shi!EQjOF;lMzMreb-l*Rd2$~O2fUrZ@Ky_!M
z3WE;ltXNnb1L~(*D=-K(&uj3pW?)bOol|A?fI$VcUd!qL0}p6SVWuquC#WwA>c_(C
zpU1x|y#Jk2oOPcec(y%c4a#hJ1{To01&vk=29y3Xguv_o=i_+{GSD?x2O8=c0=)ls
z+yvz(4+chy?ivPApN%m*iw$&tHF%B(Qm!+~6lyUvfYJh}y#ks~w3q|l7sg>x3)(wz
zO4I_h-(>-VfJH5XqxZj4tQK<^6hLdsENU6Ty#Jm23Tk)E1f4_ee7Rz#Ekoc;TZSm_
z|L-8@`^{sJ=(Gi&GsWmI@Bf6^wV<;v8J1Xp?vrT%kF|14sAq_<ZeU>X{&&*UT7f~;
znt_4C>H+-BJ#b&#``<~)S^p8?Fj<}<1QrfxVW46@2i#{q0$PvZ{lERHr2;qTY)TGG
z1ttd2nU$ckr9kNc<QC8vK4=_tqAh~}sLYyZ%OK*x)D{TsBRP05egDD0Vs`|2z8w-j
zObjUJfuNp^?c@FLM5g|H@R&d7ypIU)|Lvf45{#fc?fw5$VDrBQ4r>MQ{udTdeNq4W
zH+bz1#B6XMF30=d3Drish8X?13@nrP|DQ42{{LLiIO;_E|6dyI8WJYQ|DQ5@{{J}>
z?f?I9nD_q(XpRpQ7a%)8>pVby^!|TkBXo?o26X-;$o%Gc4Jk598BA*SXo-N%B?PCP
zeGDcbdC=U7Oe=$l%u<FN(7vIX-5@pKa{xf=&jdhq5jf2385lrp@V*?#8IBni4GgT_
z|JzbQWt={I%=bTNUW~!}|H;^fx`rIcS$}PibK(*iG%Paz|F22*uBb`=SKz_)Z3bxV
zWv-|GC;iTUZ$WLEMrQ^QONIa6w7Woe3WCr1mr&GX5Ukbo6sXno-chK@z-6fkKEqWb
z*F*o4rNaO3`W=iypfd{^of%X>;Q=mR_Azi+D*XQmYQuuYvKp1a^^O4OKGRwkEfJ8q
z`Yr{~U9TFA%nT~^pu6?vGRQP4GjP-_)%a1f^j|@(iWm4y?pjR^3z#_!EViJzT=@DB
zONIYGKzp{JZ4(vHnK$4v1$3^yDmcBfAkJ_2Uke@6+W}hFYN_!5tMzZtDZ2~|ma+f;
zYj-hlIL>951DXd8^%AhE^$gIf)$#)Gdj;)D2K945@davgdH?@!2<rDk&C3Ay+n@Zd
zfRxSu?||kdL25yIKzSE5eh5`-1KQtV{hNWO{=b(9SWU|9ikjU&0=)nKgRJYD#~@+-
zpMe>ap2Gh#Sb@$g1hqXZ5*Rqa<Bd#TK<5#B0F|jVoywJ<w%>$C1`dY>;I;UFKz)ls
zEe2-rIR*<sbBzB$=Sna-?EC)&bOs!Hdk-|m4Qk_o%mc*>Xg%2eM94Z<(D*i}Y@XQ2
zAOXs^puKpYIS<gDM35i7|3l7w0G$)(Fz5dZ@SJTk_{_8v?PhR$S*7_Q1NiI~&>1<P
z@bLcs&r!P>)P@G1%_jp|zX<A2g4*KXv<^OBkHN)p)Bh6?vH$-;;X2Wlfx%(U|1BUt
zfY!c)Xi#2qn8N@%Pw59}&J|=9=uBA9dMr@83leVs|2H;*&!snjv}ZoU$B;p5)<AtI
z(D}!paRty`u$tZ472f}jFj_Y=FxKyR5m3MXl}P>k7Y>ed8B{=Kg4X(h&x`(d6nuUX
zs15?91<-y!NEr`VvjT~$&o;2R6j0w3H0KJMLjms_*$-Na_@@z+E*zQ|R2ud&uvjGg
z|6AYs17w#7s9gYRAA0{g{1ap@s88s@^yvfW&c>P+FA>llMo`{@jfaE%QVYIQNd?q4
z2l)fEr@{OGA6cj!CXKcX0^$D^%s~6-YUYCP@MUOBVPKgU&A>3Rnt`R!g@L0ng@FgO
zw{l_)_)K^O52jC`y;0!w21;w7vF%1>(AjrhB4BrEG6*zs{{PYF`TtKXdobw!2_ESA
zdoMt17(AFhf%+3CK<Nu~9t^172d$+ByAgCp%w5n~{=X}sZroC1!(Cx5%fL9LhJgdL
z*A!HLIP75%0i^*@{pzrXp$Bw6D~Rv7=l>hXJR}479v;v=dZ6=ez5oB72)&=j15|I-
zFMVC%{qHb1e>u!!FsZeCu@0<%AA<uZ4_Y)ZI6&3B1gEKe3<6L!ptJ2{K<O4Vb_<U8
z|9`+|bAiqZ2BinkJgo=QM-Ny$fbtS39f9Lxk2dIj4-Rk|o2^{Yycm=pe}V6W(34>R
zo!4OlG6R&Ryb*f{HR^Z25~-<wC1U-UfyHqWWZjSVzk|6GY9Q?rP?_&IiGc&e2gN~S
zBlzqk1xWh-02)IB_uuwCWB|{LOlV|~sM(<ny8pokG*<vR>)HGNFV>n&>B@#i1__5n
z3@bqC&HMlFl^`+428J0mR@@a+tr$4q`PcPw1t=W6|Nm;#Zf0NxrDagtTf3Qo(_tP%
z1Sp=sVLFE)22{3!)=Gfy)NFoS0WRzQ{1O43P38UnuVYQQbcOf719R(}Pk_d|W$GU9
zt^l2J3|=Sy?+|Ej5@=ph19YA#Xnls`-2XM8xlB;M9pqn-y`ZyWLH%Wr80cIW(EKk*
z3>2QAzKaLbd(atF;JRY}LIx3#d%^kqzA-2qR6u3s1kl>Ke+NVx7#UP*(xfXIK<8{N
zeqGT38XtcCyP^hk_WnW!5zrb%@BjZm=l}lzrQ-?Udm#SJ1*KWgdKu821(33a0d$rn
z5AxaWuyldn4f`h&=Z60c3@m1#IuJhY1u9pd^`8u=3<KAHHPRKJ{uHP^4cd?I!N6c!
zlLG2jg3pe?+-La!em{eR_y7Mgpt1%O&K^wfKzDyY!qAa{19WzHO|vpM{6Kbj|J!#H
zl%GL)$ov2It)TF5Xks|h2^ur6y#>m%`i}D;=kr)JFz9<Q-dPJe{|j_3Z+*?}3Q+k5
z(p$6lL4fsx|G&Ne|JMY&vx%VvBwjxkbS~<D(Aj|%pzyVRz`y`98=TJOF(iQIoH}j5
z=YHyg*63N!0iDnO{{vLs0hFep_L@T19&*&z-Ug>*u=%ZzD{Ah%2=M;@8*-OY!~Z29
zdqDXWRDOffk_XdU(D^CgKFoea1{F{`0_UgQ;QZtQzPk>5hSfK)|DpM*22_7T`gK1R
zg2pC5W`fEy$2pMmph0;FTqml5#()2U%O+4i2b7P%=gRJ5Pym-*t&c0b|Ls?VmP_FF
zIcRJPtbZ}+taQ+tnjf|x^S%H7UtpQY;NZdZW)B04F=#C<d_Tf|M|j`M1XMSG(h2Cy
zA#fVm*TCWZ|8HdTLIzM-1v(3l2jqSa28I++x##_F&qq){-`bghv3~9Y21n3cb)Y?g
zpnE@DFIRZ~+Xt@4z~^2({tY^tnE_Is?wbip6QD8G`u`FE_5XkTsNeewRIV|C_M}1E
z{RSRPZ$R^>kaX6_AOH<x4p4gzRF-=G{~8H02b4b@pyxe7!uC6O4JF9$j&m5mYtzBu
z0t&PL|5^2$|NjS#4S>SVaUSG;V354`|NlooaSMuL52n|18l4#wbXXZc<4`=Hb7H~m
zK4mWv#|DO!nkQN!7773V)VF&$_|9ceXvkn-sdY67sPzmIspXIY$^8YjUqN!PJ0EIQ
zJOXM`j6`addIZ!wu?FQA9`Ap93_*85fbtb``2aE-T91SCG$=oV{m;lC1M)v;&!+eP
z|A`>~gYIo;v}I7Kx$`5SR?|piqAi0;qb&nZ%}FDX33tJFuuFI_y*dLcb3kDSY9E8^
z+FI!f>r@7fhGqr<i+TnPP}`tB+DN2ku9ArNzui+U6&N%?=fHvLxQX_lH4e96a+M8p
z8F(hwgVM$&&{_YWwu%B&Uo7ZOq{;DMyA>wdGbng4y#m$u;PwLSTn$jW!TbN`sZc)@
zG|Gd{llcElyMqDLCrALDfeyO2p)sC8MZ1$h-C-_+Ps4o%4ogi2f%-NNP(Q(@;XeaU
zty+)>C>|W=fX`V{sCD-OjnlG#&Q5on!yuvE!5|2#3oI2F1Si^q>|kJkv_W3N`;_|`
zLH+=@lXSp!;STKz&>8fgdo#TM|MvvDaS=lTD1CVU|IP_=8)%OaD7{%60Hq->$a+~&
zyKu>C&|2K1U_DJ>H-X(e(VhXcmw*T4{)wP-A!QjDCfhQwOpayXm|P1ED-92(m!SRr
z;5eVa$RGob_j+mYJps+lpnGfn?FE~=h#>;vmT$G7I<S5&cn_^d_+AAwka*49M<Sp#
z<)E`CKx3-j|NokT>Tpn-vN4{4!_w>j2hcsoji5M!utDn-IY8@$K;=BBZ{@-CV#XB3
z|KKui-$4cmX!>&jw^O%kSJd1vu7HHkKTU|67!yF{18BVj=&njoIpY2Q$5c>Tp{80I
zQhq@0yV9`O&%kVP3(}vln9aZgy1O~#7=xAf|G$DDvm6&OJOSlXhkXoBU}k#%{|vsX
z&ar{vOS3Hl52$_M{clHZ!(0XhP<;ckv)=ZU2xz?D`~MeHusKZ(JoPgr0zhMWO?Md-
zKy%-qbPF;Q6nCI~yEW64AZhylAIM#gP2l{aP*b@{1axjKs64K_v$>*H^A;#?DR}?e
z(Fz*db)3VH(QM1W0rCgP?JzSfjxq4m+n*AtuRSFKZNq`e;Y!e47iir}t?fy@$+H<a
zCP#zU)Pv_sK<lzCsu_5|?HzF0xdXIri2>Yang19(E&(aSpTW=Hn+$5l)k{}^>YWJ-
z8Dv0v4?uG`Ab*4En}&r9G7gIvz->uLTzuzj0F~t_khlP~dq8!D#Zt&wJfJuLr4@^%
zpuGdXJ3(W19!$>`z}A?8+v$+L1o(~_P}>odSG@oKfyO_>6;K#}%2H5!8+6y3_x~@l
zpmQ%kZgOZ~*a3=DP#SXp-K+BCcZD^m9|+nz`t)~&_x}&J&56)G5l??tK*H{WrbY7q
zzo34j!`%N*n&&cbSXwf$gxWJ$f$Rdsp~Za$j{4b;MCxN7iGb=x@BhEfg46mU1`p79
z8t7ijTHA+u*1H&3Kw~c;ef7V7iFp6p<_TuA9Ik-0F}JM+?SBBB!wTAu53chwr7J*f
zc}RYE3hMKK^CoP)8z>Ax`4rJ^+<F&wuO_Ho0_8<eyAjl8Y<>uCGfH^>{|9P=g3SS~
z&xYnJ@Yx#P|9{;Dht(nm_`R<l3`~(Vso-`R=nO0wkefkea?O4X@ZE?YvqAYBRQ4jy
z-TZk1<Tg-V_F#Gfnj-@DwLpC=a6CfG6wsd4=48;`rFXp0HrN7?o4x;kQf&m4mB|c@
zA(aYdpuK#cF=XgDcA&F!4Qed7E2ht2;DGrP6zAUm-+|^pI34Ewe*^1_JI-O0X^dwO
zXgJ8g(LA34bbdOhEH40^)m$4H1is_KaSlTQs4S{g^Af4=0+;OpptgIh*CVhzXwJxk
zfx)I8be|0a!x@kp!R<s)Uitq4+{SWfV%P#I<0r>5uz<!8L2V{bT?o2Y#(EBe2Dl$R
z$4I1p&MA@lS>X0cOReoAk^1=_pnDNCKxfv}&%FU+%hXyw5~+>71hyNb4>X?#>bunM
zehtoxptK22Gyi|A1;q!L4{Bfh+mdLjaDg{b^WR&jI~YK20=dUhfk9xREo40<XdZE*
zErSdwZFw*~R$yS!0^K_dt{*{bxj|_F)Tf5F;o<k0IWA-{0JWzq9sYl=Zw>(6aSyuN
znWt8n;R0xXP)(MH9;jUd8utLL`vjfg=K)!F!U9Uqp!F$`y6+LZ?gNeQ>|e+rQ)3Ul
z*A#q?=Tv(J4$zp7;~WMRP&k6y&T|+fz<vei)wd5p>pDQ=8=!Im)c*HidX&S!q6z8`
z!TkZ<-=&4kFQ7eN3pEk@+CclyLN(az61^C7LN$-sf#tmz7<jm#d-dGe>_FpGAx|FK
zg?b&clWAe#3VF_M7wY=ZE|l$|T}_LXNT~WlJDH`RwJq#+GRGLWLOIy&WS)c0^<=jL
z<r7eNfc6{LEDaK=Ip!o%^V~}$q=n5cWGS0n$T2p%kmqc6pm|U4|Ah+hF`9)8JfQt}
zpnRVEpFz)h0RunCZJYOl)|)fxc>mvg78HgcG0?s`iv+OPP7ohS4d{MF0gxC-jRyk*
zgG~YxLqal#GN_$rli&beV{7T~|9`E6F=$^PL#>i=n<WDSYb~>JTdj+6Tdk^bTdlfr
z8%Vx3z__i}$hfW6*tpG>;r;(aj{pB_MU2~OO^w@X&5hf@@($K*wMy1)waV6QwJz3e
zwW`)_wd&SwwIJ~T>$X}W>$X~B>o!{s{tvYx)@`+>)@`-s)@`)`)@_y!4h*$^%x$&&
zOl=_A)?vW|(AxJ}f95tz2S>1+r9=IHD4!9erdA&$$9Mq5wsly*0Fh&Y%Yn}MO4MZV
zu2s=)t5wx*1GRZUerI4&2bHVv^>d&y8g&08*7N2-`&dC|*Z$kk3);Id(Ft;<9_S7e
zkRI><uAvR{8o>L*y#H;`1?Po%44}O<Odz!lbqze;|MO)Vl^9GwbA_OBI`I71Jn$Js
zptUj_khNlYKcQ+s=bbcIIzaqktH8jNsL8+x_A3K3e=Q$#Tg`i>HV|#A@cw_I=Knu6
zFFh=f)bN4iYV{#%5;Ymv!Fm;#xoY)5`#%i@p?q!#pOFQ`2ZbRhO@Y{;HEW=-@?g3z
zz`%kyI|o!wAm=Mkz6SN*Kz%pRo(|9%bD+MI2h%;!9jV~@1{AiSHl=;Ty%WiE7z*qc
z+&cj(Q<L{Hw1CpL_rIwhL3tdc&imigr#1=qP9!8VOn~yQLirgs4Gj$5|E3;=@^dU2
z7<jz@P2CFRmq6v0+CTWf01`|7&%l_F%mD5KdjFf+3$nBR321I@Y9mNKA(^4ZreOle
z%t9z1bmkz)%tR=^11cW~<@Z3{<Onjy{=vNyAa^JK2hCwk)dkfL-v6eWCL}Ykge0?o
z%aWRe|2mNR@a}<zBnFd=WCkYKS$&{%SZmX@tk$M`87Qnld{}?UQo)fK)MuLfkU<6%
zNA>TS+Pwcw*=XzV|A$TTn|~I`&*MO2*P#9FiC+Kz)xQh?#XsnN1fE2%|9?PyO9w}0
zP@IC}6PlL5X~K`WEmV_j14!KZA$YGhXx|DW=&UP?2MnO~#TnlJ?pcD)k+Dc%0L|~f
z<w5#DYCv}^d;hy93+lIm-0s12=M4jkiVDpA&~yTuV^sn5i(%=+gUQ7Zl+Hlo_@FQY
z&CS^={Qm&DV;IzCY*b<Z?VlHDnAad<$-uzau&+U(QIi35PNRtT{|3mJ!23YwOZ;>N
z)d!&cQQrTvpCaWQ3($Tkkl79U8gxMCi8b77FaVk5{l5WxkCr1uKPyzfiTD5PrBMB#
z`7V%t3+(#q!S{1P^#3@Dq(2oD79LEuLFegKfX3!5mNKw_#$ZF13Rvwu$ly?G23}h>
z1=Metz{t=8ns1)y$e>em-MFGDkzs=M1MnTo23Cp;A`=!eXjm~aNK9;Gu+d{@V5s?I
zU19l<fy443c)n5tvJRB70MzybwKeP1x+@^#BX?H9#4JGf*n#(g+}Q~et7B`1scQt?
zs|nHrlk@&}2XyZi==>uF&^bk*^@|Qoj4YvA>^0W%3@qA^HD!=-Y}UgSNajbv&0#%U
zQG2Yo0(7pQ_rE)`pfw#$jSK>zrVM7vTNxPYr!Y<cwGl!!8O*@*pDP(ISSv6vfcjOA
zlNdm2_9P0m7&t(Cwd<TGSJY2?0GfknsGs%#d`Ds<X#Gzocn&0|e$EUB$Gr?G^>b!G
z<Qy3c>gNW4!~#HL2cWarYoAwFc>jA0z9Y+FAA?21K?WYUTS0A#f4ArA&tw3fBMoXR
z!sS>GSJcZNuJHbMyVe?%zyJU1X>4S$u}oy>fQ)V5+`+)22-=STzyA~z*ZUIT>qKMh
z7R>$+O7oz#hZ7qa6hQN{u(ffZ@)EQ+090mLD>6t}Gct%-J!BBEI>;c9wDtc#&{@z)
zQ~ra`aR9YBz5m?@pV{p&kKs=E=HqpG!VC<c^+3=u=Mx|`77G~oK>Z(3y7m5ds}n>+
z#Tn|^Kz_N^xKNQn%u@6Jf6%^s?au#y9p^IiI80&?=uTvi2(M-^2(M<dL(<0uy7R>Q
z-!0Gjm2m~odnFYdCNYA}ixDZ*{9m7`#mu1S#lTP-!w6c>2D;;h4HV7}n;1+$Wurv{
zgFxNU&7g1u-AN??x|bT1&p~de^;{uP>lG+a>-8X@HYT{jdM_hG{oDnhJw`m*b3kj<
z7{U8~LFoi^PKEcs=TjT*Glu9%F)%dzXN&>4vr(Qg!lFTe0dzMPXwTo|h2T9=47LuS
zaf?5dj++<^KzcxGL3%726dAyJ7BH}Z^nl7CkRGUdPmo&s1q}QkwIDrUwG9TKbwF$&
zcO>uq|KI!HBTJAvR5h4x0PPR+{{Q={<0gg>kb01LAU(L;09Ah!bjG><WYB#)|2`~K
zWB`Y=ekU`7!@PeFKzAj2|NnQRv5`Rmbl)o^EnatEV37mOB_i502}1dx^k~t*%D69)
zK?d5U4*~UEL1_{+j|xhI-v91w1n<3TU{C;^C2X;Pp~U;&tyGX(EgBejA?JGB3T>8a
zkN~A$(Ed!TgA5#23mJH<8X35)5*fG}Ef^RYH5oWS=a4$iWq1RclMUb5AO{MsSq~Yw
z!e>Qj=+0qatB*PjKF>6~-a!vkkJkUcTmecOAiKQ(-82N9K?F({NNKYGl)gdps30{K
z4GesBsk1A*|J_*XFo}V~v5z6ZqJe?CZs}@p|H%8_jb5laThM(y-v4gYg3dhy_apW}
z_Lf8asNntYW+PNB)Q>j{Vf#Qq?K9Bcdf5I!$2tE4^ye_hgU0k7=KVJSt;GP}fo9iW
z)4Y;_19bOcqbCDP{oDWshrJ9Y;d>k8EE*VW!Rdb?1Go3T>t9ja0U9fBV6d@Rz>whm
z@5awYd&Yvsc*Y#?`KNmsOhWCU`a$E@5dB+G^n=79`qRAs-Pj48Qx2$YY*g@Ix@y9}
zA_H2Fj94RwbWZ>%?m_WhYxHWFtpWpMt<mdc-v2)x1@(hKXO@8a3dm<?6l(te3lf8#
zQ{v$L-|}JezXk{B9EL>0yapFgIC}rLRQ3K}2ENn4``=PuP}{^|@Bb$a^BTZo3f}*g
zg3j>+tr5Eb8Y}Vs|2Nd8K>(Dm7$EHjM^g_5H_(1a3DCZG4+b{H=6?-7pm7S&nkG;_
z1?}DP{%@JsFs~uR``?nIjdl$Y(6+V=XkRR7y$5J)9n?mj84uo*D}f}=1Dca}-1q-U
zXFLM~_^g#K2GHDIL8m5U{{raVJ&Od;da~@ZAag->L+@4W0j;|MtziV6jpV`L{&hkv
z155LMkR9$HLFcJVsAb>)@h94X?i_Q!+Gy91GNBf{KY;<XH`Iec{3>YuImitTa~W)q
z>@;ZJ*8pl`v4Hj^fY!Eq|GTETU?Bqsh;7lpz!I{Q#cBg+{lvfPs-U$r-v2FPLGA;s
z3G`r)hqQ<0F@WwPF7W<u;Ruxj?HMlt-E-o>c(4&923o6!d}a!0k3TfbmVm?y)freE
zLF15G3@nxm44jQ#pmFd20hV6>FNA9TsH^pIo(8JB8|py!Hz)am$}3R3G}JZJfYvcu
zJYX;Yjpc#P#sjVQk$Lt%pyoNKzbhruu!Mo9GhHE|;R(n;FaFgmwY*mIEJ(!S7y~1S
z-SC8g0n{%Bsjp4fT<65_|A2l6!+OwqMu&O-S2WZ$G<g3{youCC1Ff$TfQ~PSc>hn_
z3ra_jG{wT;!DROoPnw3DWuwIaI%|!gMvc2-sv84`Wdit|EYR8LjG#0AKyBZNX$&mZ
z511Ie|6Mk$e+TM2LC?-<U;v$)13vc#bPkU9zlmER=bJ1sh1v@_LkIKRAIMoaTA+SB
z==`)LtWa|qK<#n+2akA@|FeMm?6nGibYN!&!Ojb+Rrm{9+s)<ufALw+`8kQ2EFqx$
zS?l1V0~@nQ^b%lzi21_QE(G)On^y}m5A1fd^LQHSKzCxB!qy}BG=k0}a%W(1T*S}-
zVmI0~bb#*e4TYXbWa+>l3rh2r4h%Alb`3osw)g)8Q2&<&>6{`L4+fcD`Ns@gpt(qg
zxeOxu^Vu&r%w-U;e!zYK6tAE;R#2S-zEf-8{~n73bpcS>>%n;NB<L)3@BcdzLFw9Y
z4rs1tS879D!xZoTrm*x6I{Sms`~M9`kQ>p?5t;#WtM~u-R#4hUxXUsU90pztdY~{v
zD+|Aa#6V>s*i1+mz|JO`gJh;5vYDW<Dp1<=U^)-FO9I>{293emFZd5S^I0Z&FT}3J
ze;F8f<RRluptJXqUowEx!A4tfT9GXN|Np)B|AkjUZrJ=6Jf9@t!E`={fkhm&7au%l
z0_t~JItVa<=1!n>K74&Es6GbG|5`ILaDnOo(E2h^+|*imgU&zzm4$Oa;oWG>z)`>b
zbp^COZwTMtAO{Nf@NErp_479{IPCfVp!g*_Xw3+C9TKQs29Lx3yU5$!$iNjohru9x
z4x1fl9sxXOF^|CnR7Zg8d{xliii@tGy1p@rfdO3S?E~*YWdW%Ho#g;pOJV(=5p)Oa
zl;&#Cobvw^(0UulT*SEq1{Sdx<aL>#aYU$Jb&&g+pm9g<|FKI!=6e7C_Ygb}P%mBK
zIFE4#s9Xh=x8DCQ>|DGM+y@5R9}X{TFYdHxV6d}T$iM}PJMVuN3_Cz<kXQl(L&8!9
z3DEf6jD-wb-v2I|CNE`R2AK)A>)*xN=6wx377Yv%AU<UN`NBrf8Zr>yqJcpK)c*mk
zBLnU8Yu?u&0IFNS?UZ?7w<tjM)FSBtwVlmCdYbn&h(P5*bDrQnf=$E!A22gL7*jjJ
zZMr6gC6K$eViwvmFfb-^=rDrJtL0=~1}?ib|Nn7vVBneR2^x$4{{wPXLrkef0wbdb
z1CuN0{4-Ggg4Tf^kbZVdC}{m>qbvgh=)4=){$21HiwukpEFG8{CUP=>&S~bD=*hq`
zk&}UEq9=oZ2ZI2p{sWcS8s7h71VLw!faZZfdr-Xp$1p<2iw!_|-ur*_M^K&tg_Q@>
znI6y@E>JyFlgYdcbcbZ97LQG$CwP6u7w~xTJO-XxO$7r`yAd>J0v$&I=QGgw5-6{M
z>T=NBGwAM;i7E^XE0r09CaN&7tW;(YnW)0R(W%TJIZ=gyXQeWOz(f@WfsSMbd4*=s
z8ma%S8|oQEI&B#gHrg|Yb<{E_LdA18)PvVJD{ZuAkm{&qP=<<!g2sC`)HBF*+A^qY
zv}cg>U^;!GRzXguhJkGjDDQ3rov*0Oz*4K=hb+cosm#EJCdOu|%)o&r#$l<<z=bBp
zWvR@-Q>)+uH*cac1CJ$WZ5*l{0+z}QLTGx0ER`8V(8NS6l^Hb9%+s(`X3#+s)3H=$
zFhJ9501AHw79r4_Avg}eWfFq{Lr5~4oy7qK22gxJ^Q#Q3Jqjv|Kxcw%<OJ=>WMF7`
z$>6w=lR;@CCxcL}M{vcAECv?)<qRw{vcP8#OV)ZaFWYdELC02|ff>|isCD-Uu=V=?
z7j$M3X#eG0PX<OOhW~H8|INtsU~pjc{x>5K)E)=z6^FF(5?_M$ql3~nXbcB5ZV76~
zgXZiZ>i!-C?~O@hknmtS#lgTL1ln&6Z&PcxGqCJO+IxcL4-Qa%Zp>m}XyjzzY2ajF
z0p;^hju-!GI2f<hBs*TKX<@up(;_7TYU?)IHSp9lD~U8`GJwvXj{uDYhddXss(Eao
zSCcL!0!sIwb-xx5KxdUP=-50sa3JCNfdioRwIDIjo>`j*4Gjs;8yZ0EGZ-5r4%+)U
z;UxnDXgtBPfq|jn6$1l!@9=Z0iV2Sy7-U{Bu-Eq(fYuh))Uqb51I;ru|7(z_U&*{o
zmV<$>R^CYjly59K{{MG!VDRZ*!NAyT*B}$V=i9FEy<)rSBOmBBH#0EQM?J7;?qp!7
zk9kx9+9Ojx^MxL0ZFBvc7Z#v9{_5wxs+hc=fu;UGlL%<N4QSrPvIm@pTP9{PFw|#9
zRZL6<*J&D)GZ`2>m`=1Xun2(m8^Y&xkjI@-!dtFE0#p_?YBBIMdNHtsYQFea>lt{h
zCfV~EDBNpW0^woZ2|8E1SxH1zlYy^R!%M`Hfq@@f9%_R97t+hgz}Q&V0J>LDB$WNz
zu7-ULJT<2+^g=nrb~QX^V5m7}VbSoEfuZKORmB8QoAtGWUL!N8?do9B$jZP_^TMfO
zA`1gcO-m5SpBq5q;~q@M&oHp?gZ5j){Q{bg#_FHA28B+<*+3?ZaSbYP{yqlqy-uLH
zquro=yU_U~&>RzJ{>X#Drl2vdL8B3(pRqBnLC0Y(g9hl#qL8HlS~bgzD?(Zph}9fX
zuCVk>nF1<{Y8pa8=PlZR_8f;QH^|jwdRJJyVAueXt5vYof#`M6gXnFLgXm@00+I*m
zh4}B-8;ceOMvLVCe`-3xWi-!}#gIA$QWo%m$^v-au~cACK&i7;xhp{NIaiedyzi#@
zUxP{Wz6JwO9|F_|l4)V!lSyV^2i@5Pss})Iprr!?XkQrvXunXyO9lo|KVhOg14E-a
z14pfA@U;4l0MI$*1&wwM7LDu-EZ}^m&cI{w`2Qbp`p|T|21+9`oeX@nngIcpEdT$2
z(*(1VNT}9_ec*D$6YLj(Ru2Z2sqSF^d;#sR4{7<Z4>XPfx+4fw7g}om{}0-C0jje+
zn2z3IVB!4(TfYD*`#|ebLG$0xGS3FIehuVbP#diIUxPvOz6O)#x&|A^c?=q$Go`ef
z88{sGF@W~w{?Tp*-zy)Z-3+=bp3%dDf#C(XTvA|A0Ns;Yqsm<|SCxSm6h5GE0^QvR
zauetd^+ZkZ-g?j($m}5Zfzkyie}MXN;B`uS7=C#F|Ci~(!0-W!nLJ2l)`H9g`4iMe
z0h#5nhrtF^W?MQiu!GAwO$L@)&ERPuH6VFVJHyoT|9{5@2A+wrpnfuBTn-d>AiF^B
z2Du-U7Urrla3k3z=)u5{&}j|slk+<4W6%Mq2dM+82kD!u%D{zC|N9|0P1rLqfYgEH
zLF(qWGH@cP*$Z($sJ!|2q1mp11Ej7wu7Rgnu0f>Hl7Ru#76s{_XvM$)(qHT8RWZ>5
zd=9b#C|$zLnivUckN(bu=>g59&z{Y|0MZB66Uo2;(&xc+7}3^mWZ(eBIjAk-{cnmP
zs4W6&=YZGp&tnj&srj)EvTpzHSx~<Q)PC?_Iy?c??gZr@5QeSigRJ)r0<Cx8wNzjL
z?K@M@Z)T9TRA68Qjaz}vlCo4_0G+`MURMQL=Lc#NA+PgeVBrR}pW$T@sQnH~&)CW%
z(A+mDo<U_yBPRm`=sbr;4F(=rF9tqvKJxOs)~EqGyHa^tO&7SlwE&e(p!^2TCyJnP
z*xyeWSh!HiKaicEbCGFiC-@E!@BjaM7+APK_dbEwqJZ)vN?x>qls%w1nK^$LIBKPw
zD?s&Ky^4_tD1X*7Yl+m)KLNTcA^^NzckTfY8=Uq*a}1z!Z$bNIp?QD@6ecp64D6tC
zr6&31HBi5)rsd}~@BiPAg4TLM;`u+QUa;_BIyi@cg%fnY8oX>oZd26k)CQM}uyws4
z_khk|0qrAfe#yWS{{O{4`TY#+^8Xq5>i0@stN*Wft<wseZ$N!H@VFajo)UTnGh@9v
zXnpT@TabSJIsgBI=F~v$mDOZm2i;W!YWslp(1F&GTStNN%Kt5({+q*G28)J$4T$?W
z4={ku0^Jee{r}rrka_54f$ocil!piQFtBid%6~-oE5gU4Z9r@LL1kghPwR>~w-`7;
z>w!W31f3TLs(V250x+}XS2D1J%4o1(Un*V$jSYkLW`f#l=>D{>{{P?m|F^(K8}QgP
zI9_1>gu2bbgXw?*0}BV}9yRbD1yI`9hiKFJ)S7xj!hf!EMGa`};brihE{wGy!4)7k
zg6^*e?eVm_`u|_EU4sj#i~+6BY4&8`vDEtiKRoKiKlv&KcKIj<zWQp*YxT=tSJZc0
zyjJgd@fvuZsRgvA{44mJ=K82dA{ILtSi#~hmqGim8A0lsIYH~<zIKAl4wrcGuUV6U
zM_z(~y<Yl|NVw&TfAW?L?Df{CMCvDP0Hw=}Cc6d?@cqP~GigEbwET62RS*MXooYAe
zoLBJvJJ4E1(43#eMh4JbMU0^E1=$5p3ld%;-v7Ufg6ssz!Nn~>;{Rtf#Wna~*s=Bh
zf6#dyR#X1}^Zx(kCftrq5IaETd;kA(5M(B3z7J-uye9)6I9_5diPWuJd96O;az)+l
zRU-8>7eM?I*AM`5D=1vRd2RXY3TsOSMvz_J|GyN1%mb}otXsUg!eSExcsvedHpo7x
zyZP#)K<@tH3Q`M_gNuXx`G1D~bkI03lY;(a$lgYWeGG3v>OgBso8uZnVD>`wv4ipx
z=*}^ao4o&jehV@eoIjAl9HbwvzS>I!sut{j&|D|Fy!XF8NzlFzkewj4;B}?TL2G(H
z_kz@W|Lgrp$ex-^$!qn=w_tXG`{^L_EOtS{r6H4nCnWjBKTus(Q!ORp!N4d2N>3pB
z8um3r!2D^=z`y`aTQc=Fr$j*K?t1_K%nGs}l(xa?I*Nh4KKhbK{frF^;Qb3Krz;%h
zFc>uKYlwlHBLONyKAi>WL-8*-KK`F**w>H%SIYpZS3fNTscq<F;0bAY@lRfbfgRMQ
z0jKX6C9qu%bD(9B^63gtx`6A4*p&#<k75@j&7J^>gTfJ1ZhHUgSqlnlP#A;D(Ekj4
zHPydFYUcbBX<%gV0i~T?iVQp!iVPm0de8g+Cl1Iyp4}H<but4B3ux~PeC~JuLiqi@
zF`)7cR6c;}&E|a#;JfKT^#iEw(`eVA0b+yqip^#00G;Ow8jAtdtrjm*4uIO#wGOsA
zQ2r4#{s}bx85kej24-Mj0IkWgIG%C=EY4u60}{75o^l0^e*?yc+S35$BkXNK;Xh!o
zw>Xh92P9VWz*Gn1eoM}j4iLZA!Bq#;mI;3%U<DelscBWNsA&V8f%sWee?G&1P<;nF
zOCNN8Flfy<NG<G~O3?YAjd2Y;pgV&>=l6p7u?!5L`;kHIc2Kzv8lME6n*cpq-2_B?
z|LbOLnAea3Ioq<!*HVFj5weB^e8(pfSf3&TN26Us#^i?#29qB$m`nuSi)`1B1G?+e
z`+v6~Xsx5eB8D2!eVrgTf!q$RLqKbQpMll|e+or*zxV(D4h?k;1>XPV9)iXUK<Dg&
z>;<h41-ZrhUl(|<7-$Wu_kYM98i#rRAAsaQ>!G~=d&`2<gY0!|VgR?zEE5?bKy5P*
zrkyJoSeQWjGvRGA&^`rN+X%Ez7nG)QwVeF*yZl2yX$y4sJ1DF{cguw={jjgTMFX@>
zA||AT#SYXD1EncYyBM^$*<lWYL@P4`3#d;6zOPi%3Dh@z0cy*G+~&BC!N4Mc0W@a`
zn$uta<tguf6;DCy7QO#_^n%85L2KQ-|9doo(m$lnx8nx`3nS=`-vZED7f{`4>A=9V
z&ygVl+RvE+ax=)Spfukc*PsH5OOU%jX@0R419)D{`~TNUu$c;=wOS1f8?8Wn1@^6=
z{@;XJ@K}Y3_kY=3(0C^3ymnArf#%0O7}#n-@!+`c{|8XqfyWaWmm7l4Wd)7pfX;9A
z{x53^+5_O&1R8&2^98AQ*vAYyAHc@@zpNyZoFP>1Oha9RgZF>;LeQLq<38pG&2kMc
zRu36MKw$|we;%|pA2k0Bs{d*&e(HHJu#1A)_Mmo><2<H09dj7OwOc@KaYh^M7KTR0
zd5jl8W0Vg2m?D}VGK4_PWl8|`k3j1`KylzWk13$xE&~Io90sL9(7tXD1{Ua^UM3Sz
z9~dO={r@jG?Sby!Y?=#E4+@V(3mL*d=}><*BLir!fy2E2TRa#T|A6$>Em;lP7qSxM
zKgW5DFB(c11S~;!qJj1!&0|mjjd_9W2C0ME3!bM1oh#tMz__EKgn`9s>;E_PUw>W;
zNfxlONdEt(Ci$0$2LpR+(_RLKMUD(%pfPvQxm;GI3?d-2K>nz6nG8OQ--ChqXmcq8
z3+Sw@x|G=!*46)ihgS<&)u-OBsGD+2#QR_S+U8OQ0sYzk|3mC#C;-j(THIksvY5l5
zVzGz8*ZaR4Cur^fv{t~P26S$@D<kO4hK582ftqB`YaR@2KO1crazO5AXk_4Ms9_KQ
ztz`q94*^;S4?6D&q#ktMC1`#aaz2DBC|&OWr5*2ocR}~GfYuO!$LqcSd*?RPHF$Xc
zcb(|Lz_6vEuEEFqziTV#ye69j1}+Z<HqiJw=$`oq@BdO4LFovzkFdF}0kn=Y#{0jk
zAt($$apu9mTnU<Y0L|4x?E>E^0J?Vu#0SNn_kXXyQ2P|2c@1QrDCoWm@Bc1OLHpZ5
zcY1)<dwc(P`3utL{of08rzPnAvJCJ4E}%1}ctB|jY;N=83Q#)rU|=i+rA_bue^WsA
z)PvWtGrsj;V0;Tw>o|{L4k#UaFt8p3^-00z{=2gglvY6H8)&W>bZ-Mx{3mG43RJd&
z!W9&z7Rd~(pmmPg%?vEybKUJ43P5S3)>8uIyaLd8Ce#n0wXUGMFC;*7JfQgo=(xWE
zXuc1!PS!;h8U`ia|D9ig=9)KKf!YSncfJ2RgN}p&-xFv(pMlYXaj_#Pzk~8+_#76y
zn#`Yi_47e(>OTsg@Q13A#i2&RGLZq?$M#^_3>vQim%WzE|Nn!^qX~=*BB1iOSA&7k
zQuF_XP%Sn)?JfpR$GHpwGRX{Fpm8A3+4+#NaPu1m=0BkGWx!@Y%R=zIYalZ~<sqyL
z-{=gPPXdisg33nd{5xp;QUO#KOmtyj0QG%9bs^O32@K4CK<hc+X2Z+`xe=rWshnj1
zm3^Qx-Gga!1Zdm<gd36|XDKr<{|Q09dkc>_EFg0{m^O<rF#mzCNeB5$hlK(6_`N6S
zo<jzaMlJ>gP<dJ3p#a)bZPTd5kONL%OI}wrWHAWT?ANY<r6EwASl<k}2MRP_2U@S@
z{ohFvq#ra60tyokrcI!F2E5<dBAI~&G6v$M2^!n5NM>LTNoKG@8Q)<34eIa1!wZyd
zEfz2|Ao~~8#|MQQ=ni90Jb=^QznMFs;~gxZGx<SnKTvxEG@bz(U-kYs>kb3+Z_xfw
z_`C-4Tn5OGATvScHQF@@fZ8;m@)cC?HO4hafabwKcNk9eWKd{~YXIE|ZU7qJo#@Hn
z02;TQ=*bWO8nd0~$&dg#(|@8T186)KbjNu^V_bv9L{EkZp!##7C&PkH&|Zm72GE&>
zHK1`)P`>p3*9gnIp!1nP=cD|Co@>SCIG4etF|NS|v|j^se<FC#s3-F>(7ZyUU4sK?
zE&-HJK>4!Kt^qX8D9~uv-~-B+pfk$B`;#F1=mf0)gT{3JH-Pd9D2_asHoWlu|1ZJ&
z|GyXp=AR#s$39W+l&+Gl1ceVsA1I6*n;0!Xb)(}vM$lbtAt1kj&Jeba`v1r30P7vA
z1^*kZH5phy^N5o*85nA<y(=baGH|q1F|dHjD93pWcf9}qD+SG2gZ2?QF8cqX(}sbw
zzVn5H!`}aQI&Hw`Re{dRGO$Qsr~vI<1=S-K3m7Uub%po8hP@y)lkPJp%-YW&zR{im
zw8to;(T0Hq6rQj&3Oyq?rO_O6_5<i1h)#0`?#>tn4(R+f=$u@T`HUd*L1u&O@c!2j
zYf;a@11gIx7BJ*^|7$o1vJYg>WY9S})(jk=a0R8Y$-fymKx0MWd)e%~|NpmXsAgaQ
z^&dd_uu+)-bgn&UOoszBwg?(?^k7;a;{E^68wTbdpndW1v~KCZz=E94(aMJiXj+V!
zkjcOU%3GkYZH#M3nCJ-}D-MCCQ3lXh@kCDsk;b@&l!=}U5{+>U852DjWE$fda-iwA
zV4^33N@H9@$wW^EjmEf!iiw^KI*oA+H4{A<K<T<+q9+4r{-R}~Cxb;}Ttml1PX-%M
zTA%32;4;yZ!DFH)gHK}|czp;c-A|b4$q>>Q*Dz(GCqqnQT*C}#KA1DnlOd%su3^DM
zPlk-fxP~PYJsENu;~G{#^T(Qro(v_8aSa<LdNNcr#x-o2=*dvi7}v04BIum<xQ0Cw
zJsDaW;~EZ3^knF0jB7YD(UYO4F|OeRC_gpEHJq8~$uOlcuHnK&Plg$daSc}{dNRyu
zjBB_7%4Z%->jXMg7#P9#K+Iu~X;cB1|KPK-8<iOnK<zi5eGH)cy}^5FVCAcJD+8mY
z>i_?svx7k8G$>9S<}ysFS)wIU>*5h$$@>34s6Afa;s9#5^FZz<VUPf=T?5sLre2`)
zTp2__^D3R7^L0BI6ddRMe^cM$;b8IP|9|k_aCeUY$GPA$wm{{q4pgrSRIdhTPGqLW
z|Noup;4wi3$9W7KpfmM))uDId&ij7@TFwg0R0hqttyN)Q{tmhm9-f{+?grIgAV0v$
zOi<o!m<QU6Q43yc13K>@{IS|MP+0-W+n_Y(!L;TE1M@e~7&zRlnk?xGaQ%Vho|=Yx
z4IGXQ3_gu=4J;v<8YZ<IULu_u42<<H9-ui<lSU2(0a+D>oLUVpkxotqZv75$*(cMe
z3D1)P8`{9@WI$^P0#>Sl*$klgah${805Uh!OT(nrBS@r^3v}1K1IS#^T$zBZCPNNr
zpM9q%1Gjz`*j#~zOa>7{<^TU{G9?9|{^4L?{t7DF;Qk58WU<rkWMD=PBT)GU3Lntj
zGNAcvuwT49)`7wqUf0_-@NCEg&n<x5$^nuC*#XLr9!#qjfYu3gsxmOwBzsS5R0WOM
z2w2r>O6b*eDv8*%++gTPfz;=)y%wN-BA_!~<exBbfyS{xd-Xx>ABzSCcF-8L_y7MJ
zL3L9>CPRZ`6F9A=creaswY2~LAKDJ&0o7C9|Nox>?O_0weI87!LFwQIsBZ@vlLqZo
z0FBLBG%&H%95t@6U%&ur-{^qOLI&;MPu?q72->p_8uvr8*Rm$_f(58Ntna)5D!*ik
zUotQ{G=cZSgWSMqz88FE8^~S_P&?CuX;lx{|7uYGt6}<o#uAAC8JNF-?gWL8D}&ZM
z?}Oft4%%}HvKJH|Ah$Q9Gl+oN<28S+LFeFr&*QJzp$$H-9<={EB$e%-MFRsH$PEcg
z86JT44tW3nUkTz{G_YR)uebUCZz4Dh7cqd^-2x!<tPX(Mrk0r=3`{K`e_JeIcnZ=B
z(&zpEzokV2gOLa0Y)P;gpnYVZ^MC&T^Q=jct|-W2XmD8ce@8(k1L!_A8_>Kws88tq
z-%>K%i-E0P>X1mS7Q==5n9CKlo*ouf5B@&@oy}{h`Ts$v7XLpzE>K^Y0lZJeqJe=4
z;>N#6YpNMc!mDrAfzB%ixdY@bkQ`|JviJYLOF?$j&pF^wck4lb<2*+2zE-gNz;64y
z7V1Y4P`e%ENALd@ogNH~OF-+`q2__d2|)e?-7yOlV-9b1vxAB`Ld94>^GZ-L@ct;!
zS#d~Wl2COZ^BAG(SfOIf;jL^?^ZtH>im`;Z9)pS9g^IC;x3<B=PBzp+;@NQ$gMs(|
z-<F^_tx4To0Wuq;9<*l5`~TmCAT}smEEX`RfbI<R{{Nddyw%;VX6bIwelfP1rPAnn
za*^~XfXoA(Qv!+KnU)|q(0qhNgK!7vJaR;M{)sKfWatEqH|m4#GTR4EI})I9h2%|h
zT@MBZk4{?#=EhhCP(GXnYol2@Ff@YJx!7vnU~qEyX93C=3q2VaHbycqz}VK73@jTX
zL1XU!A2c?C&vUS-JG{A~wgI#je7Ok&^GB3%C2VCCsLk8(uYqOvK?V*`n-|>H{r_hL
z1M^4FT~F}x4v$_LG`%?t%pX8|eTmVlfTq`gf%yZdy$>#XKz$C-IT_G82)@1#)J_D2
zVXdrlMMDOI2<S`*P`L{#`)Y0*S6D0jf8hQ9Cp7*~qs8U#h2S&@Sx4UiiOb)j1(^&T
zpgBp<{8vL=11Mcw0L3f#PS*tt3{Z8jy%C@^3lj^3s$&M5y9_jL|JxQS#uDxdOUJ)8
z!(Aci7b?f<{r|TpEX{iV|IrCaujuam^%0s@7l7OV(hJ(N4@rB|_JZyx0*P5PFm!_C
zz5oC61gE)F=?ZX~o5ujUuM~Vfx(5Tp8CY7YpTk#BKZkKjt-bd&P}xx5$-E4n_9FiO
zgQPnK5l~uN%EiF6krPzb{r>>67qphtgK?T8=!{)ZyTZDGfdiDDQQh(LAj}>0oex0e
zzXYhPb7*4t0$TUiF#}wF*;q6%u!71bkY4ZqKUqQRC_`!-^ble{KGw{U5~**wz~C?!
zoPP{Jb1>fjjXzo>F#PvmVA!GG!T=h-0k!juJQ%001es;gz|e?@kDsPcyDLC#6b}Z5
zmKu=%A!z_wcK+xD<-vkX1}0D#fx^V%_Wys7aAC6pg%d1%Kw$&A1KY{r{{(ROxG^wo
z^n`?ulf(ZSkQgYhZgpc|0^RWjbq^!RPu~B3D260IvxCf!E}p@_{1$ZP3A|4U>O+9~
z3!pu-&~y*J>l;*;fzmi=eGJGv?|;RAL3<BC>n%WS2vA=F<hPmj3>-7<8Mr}b=YY>X
zwFj@S1)W8l;K3AB3R2_26b71$5&*Rez-^>?;Cqlj=VXEQ!a>e<Vls3D?N^xmhd}^z
zRvq;GUQnM?19l&l_kW{Y(Ag6WH4Fl~LF*hin3q{7g4WFG{ekoi7oA{WezODCE(Ygk
zZ0$cr1`*KtV5nummktKzH#J1+MJt28_%JZPaUfE!1Dd@849ss>h}4T#eto{e!2J5e
z6vh8DKy4?GfA=vmXh7pJ2Xt;3C?0F3DOc2N)vl<yVq8)4*}9@u(iuFb462(UXC|{%
zLi@Nf(DcA%pTNNE!8j{2xtiCZKKbS~(3qZe0|S@!0)`Z8Mg|$HhYTE64h+mz3JgM^
zIk~zcn=3$jqw3lgSJb7?uBg{IUE%%z*Ge5`@Oghc;B>&i7@*w@YV$I>K<(iHjR|`H
zD_jWW3xVd%y#EzW1kJNrEMVXP?Fj^#54z(TWacbK2ANrkpnWsHd^;T(xH=Xxh;$re
z5G{0J;CEc~e-3Co9CVMSb}NGlhz6aV?y!#mbgxf?b_;k7i-0BT{~OvJ42+I@84UF2
zFfdrj{QnQi>oy4t%ylx&6$#0_4jzmXFM9v~4@!HWJF~e!W8T`W;Cl{iKxg7R>|?M2
zrB^FiB)zh5y;Hsa|9b-(%e81=Nb&x!zZG;ok9I4AmE$}H5A7BPZpV2HD%vfe^FSF4
zz~;_l&;Xk|j{!WM=)pKKP<uWDGidzWaV~=hq|N+q257w6`@eoFs4TKfWXSMfn!jX<
z;(zd(f(eWaKKnpt9+pGSQv$W2LFd=he6y|q?FF@3@P7rUEVXK6-~hEBK=<l^%hLx8
zjNvQY?81LUXv|b(;0j;aVmDKffg2PT;VTc>)wL`Jjj!|6tDUZ>XFps~cVctJtc465
zvl|&WXDTxA%wEXAJG+sAZ+0UC|LjHvf!Plk1ZOug2+eL}5cdB67jz#mC?8AI*WU=N
zkNPD7It#7d@(}30iyF&B1`kmDdN9p<!@&FkJ~j$U%Xr!VXzhpp3=GUKQ2Kv(^rGe6
ze@7UYU$hXF|Nb?g<-dO&49qV)rYQbxfaO1n1xyV44l+UKrI=c*9T_;lc@TOY4al#c
zv<@m;z5nH{Y^Y^mX`T;S@5cl><C+PY4`Fviad|LKy9ydp4AtbYsh{HkI)hFCG`9&V
zb3GVXc7W^imd6#Kbq=8XY|Q{_i+orMs@p;R3{V{n?qf8A#;QMy+9ZJHzS<UeF!p@}
zjnPBvdJd2}@Bg2^BFTg9Fk=Lj_fU1rkox2!^juwr7^pZ4R2;PL8FbH;3sf9j&wBs=
zxKO{D;WcP&9q4Q*kQ~TNsJ#oJ_SS;LEgGaFKx2atHUqoG0){tG`B;b;tZ($Ov>=l~
z6V~3)pA9;*o_P&uA9zDuLx}f(M(7+A_-@k(?|-?F`}gKCWa!Ui0PVR?fQ6g)|M!ic
zu&PNt3~sl9+Uy{^y#IfEi3p3{qaZP;o1tO#@g$P`Qji-U^I`w4fa-J5T|uDsG-$6{
z{T%OUp!4d&=Yaaw5A;CwIjGLAdElp0?{&GN=9P0EjKAR(1Cu2O1B(;G{|DCc3}F_H
z3}&D*5_Gqw)qMsD@Bi<3t^PAOg4*2{jSO}c3m7!L|G)hS%BvQQ3^EoA7(~7QzkLbX
z^Af7bW`KOhHRuij(74IWcm^KO8U@H5mrM$v^kkjL<N-=kptRW>&j9L6@mM!9ae(^v
zjkXLj6YW9!N3(x|<U!|<fWpK3U-nDz{dS5>;5-aEOAj<}1S+@d+a6a~JYdkMU-7zP
zrXrJ%_y3=<ptETm7BR6v+|DEbYD;?me`^bIJCg+HJU8$EZ*{@`ZDi80SO7Zf`>kxJ
zA`{1Kdj_t__6!1{nr#0j+cSuO+}f$g#0lFs3pzguG`<h><7|7Rv)#ex5@g$=xn0*%
zfkApE!tKmxZf8Ka{Rb!wGdS#H1l0wgeWc)h{oenwUZR?rbrY1ov6<uj{|9&<rNcf(
z7N{PW8B3vj@VTAd|FWi9Dln*GF^2={9uM#TKfq_mIW#fs0ENwrdIsK5tpj|Z@Cemx
zkOPk|IWlpB#@#y=nYcnV9l&#Bpf*~kA`=f(EiaN<eyCbLB(<RVGtl|A4WXJ1b|AeA
z6&corYO-cQ)07G{ym=QYGF%GPYLHu~$Z!F4&j?5@G@XIgjWSp|FfoAQYhpY&-nc9i
znHoHpX0k9aKL(Ba!1t0(U}SLFmk7CI12&%0kjwzSU&H&~->cBFQ34uXTpo-QcY?-*
zKz4Q8GcbY1=0WR;Kw}qH2N+VU7J$y}JOMgiLZ^E^17rAR4$!zqO#PhG)9U9wyarmY
z<o#bm5_C=%EHBq{&ero_?7Z4g&maPkf1L;^A9h!O=6Mn2!&{{M-?<b#fBNsQp``+Y
z4b+`TW%xwU9j6s?oeU|UG8(+Muo^U{*qIB;N1$>AbgqW?|2L)evllpk+HDSd8B{>?
zu-^aG13~Q!$9aqjAa{c1Eowby>v=FRMCi|ENOqXZAX96-`I@XILrVQ@@cmPuww9jv
zf3=Uro(v5RP5-A9donBltxIUAYsm2auMQdq1dX@kc>h=X3No{9<!n9Be1P}=e^)FL
z7`Q-T=>1=9qjduK?f^z`-O|9o&}q-WSU&@Nulp3x`H=EE7;<VgUy01lWZ(v!e^#sY
zN~GTFrQU2!29C*`3@i=x44||8B|zsf)+E0YnW)T=5YEY9Q>*2*ZgMk&$mC}5J<Xs#
zfDNdB?fw79PLLjuS`Q{=O&GgT8LAF+KanzY40ay_hX<1?uQhlr*8dF1e!Xc+7?>Y`
z+W+uzI*SB`oc%~^KtXjesP1k4*TB*-AGBu7B(P&X1Ji_h@V!?o-v3P;p?pv{GI{?u
z0j={Wm{1SeD`zNVksvS?)XxL;e;Vx?N<imrdjFe!Q@{EDe^CF%0X#l0Fx8^LR0yQb
z``_%nFgeG03`;=$O^XE#?4WT^?|-u-LHhzhY>Nia{l_zYg7)5n)<%H(NfQ+rIKbmO
z3mE=`&L6UFWB{K}>-}%0A?U0Na36Rv=#1|f2SIBNK<CRr&5{7gg=#Wbf#!C-|IJtk
zlZT42K=UqW-lqa|pI4(@L(N2c2APie44`uvbG-i>TXxK6P?}H=Ua!OA{ohy<$_MT9
zW%B-SEZJz+&@iE%LBpcKPy{JlR2uCXS|-{vn0Wu2br8w#XJCH!{x?$*&EJf~`FjRv
zj70$CH;_NQ|4ly$^%wZQEep^d$kxXdP(Lzw|C_!NCJz;3X^dw8?=!K~WCGp&%K_!H
zK>46MfmvqSGbqipXHbNOkwT+gL&rpW1`F{1VtWP~Q2)1MK7-Rldj`-wj7$^l8GO9|
z8*w(;HB4x(YnU>jp21_HJ%bBq|M=v3h7j=iTl*L!pyoM%)|-LufSqX15YsWAArWLA
zD4os(uU|Jj*fF0WX+k{%XiYhb_kY8UP<{^R?sxD1h6@|*8fHwW2c4C~)_@f5DWEyL
ziT0o~HD-Fk!+jrPighC>?J|JF&HLZ9si5=j8siyqVBrM{OKA8oc>kMLiX;y@Cjgx0
zpz<u<|E7h4*13S<5~MF-DFX}SJn`wi77YvypfnE>_x?An*P?-;1&Lp4(ZJAUu@H2Y
zEGW%R_3c>5AOI2rsZUtSzz8Z^LFQXDFf6iIVAKT?_x?9+uFV3YE{g_+B?(L6Vh?Q=
zI8U-@U|5l`)OiwA-C3Ij4xqI=YZ8_^a6-jE`)W5KnH2~%YYUQDQ=w+<Kr*WlWERK_
ziw1^0AoINcP0NMGUqYi@!<>os3>A%b4GSjPGt_|QLF-@st^l?7Iz2&aI2aT<IsZQb
z?R}Z)`TsF!Zy>1u1sW#=-OUEd+m8DfuYl{Al-m{F|B^s`B=Fu^(EOJ7|96QV42)a6
z|NnRjs?)&b?p)9rj*JUH<*ckNWDW^FAGMFM0c;ldT;3-eA@$X1aD4^x12|m&KbHit
z!DGdsvxxpbGX#yjJ2Zj&;_TqLglE4iKx(}IKLgzdZREk&bQZ)%=z01VJde=CC;;k5
zg2%WPF@VqO1kVY8&3(GDriQ^Je9p}}G`$BQdKn=8hPV|p{>E05itg5Dxe&b!kTK3@
zpf!@uBB5fSwkZRsF82Qa%oQre3QlJbb%szeMvDau%usc*P%+RrDi2f)lvcpyu*Cv~
z_YkqCUqR!I9*m7wLFz$c11MwcVE;Y&36ew9*-s8a>&_VcSq#k9{}~iO`xzYO{R6G}
zvG8D;puxa=O9gokIcUBXWt_QM8nX6(uQqsG#$hhQf@U@b7SLQ*b6mp;(AZ18{Uwo_
zSwHj^>||gAwU0d*>m)(#4A424`g0kWR{vxGt&7qC#S19SfaV$W=QAi+{|D6}|Bryw
zIP7Kcuzv9We?tvuukr2Lnp$>~h8obC|J#K%HS8v!^|PR}0JP_W%wk;AXxFd?wBD)K
z^M@X&O$lA209sSEq+vE_U54CU4+h2_P<VL%e+<5}-Ekg+322Y$icAIueb9X;`@rMD
z4&MJ?_j)ieg7OYaNV0|r=>BK#|KC_W7#MvT>KZ`zzO_Kj;RX52ao_(pAag)|X{c-1
zvic=>jRH&fe+`rRm*6`UM7;mY#e(w&Xbr|(1_yAPWG<*p@<^mp6MRn?Xxss`zj6m;
zt&f~8q)qWi#DhudBq-j(_p*T2K<sI#YuMxcUlz3fZ4bm9k6Iz_U|7@quYm{D7F<ye
z8gqR(7b-qwC1_nmTmwr(UBiJ;O$`%J7=hLvH>_k3S<wYjE4vqTha%KG@S0u6eGD;Z
z=7HCWI?iKoftiPFR--0^z=|ve1{vs`*`3M^9FXz@bcd7-Xk8v?pZgK-|FVIgF<!`e
ztlkX_%r`)1P9ny66NK_X=QDxw3GzB3SbNC(-(=C|e+>+vdIP!#A9T(Ji}!z-pP;?V
zp!xopo}e*w#!BdU0|KBuY~ZvBn#=n)!L~7$fdRCS27K<87Ua$jP`eJ)wgu%c4+bV%
z<aN%Va{@qXQxiF^90a#(L1zU(&IwR~pA*2y0E$0>-3u9bpz}o%-v4D%AmhC~cVK6j
zS|IrkviEJ0E66XPx)pTKH|QJ$P@BX1Uq8713)N(>0gWYt=D|T@$RM*p>(_9bH}NZ)
zc>+-LTtW3EF7rTUGB97qIkyFxi-*MlXbrRnQxA_t0#gG>pG5-W0}#!?d<`_Vg^0@r
z@EuPRu*D;&T?-knkMZ^X|L-X%t%Bkcw8j!L2FtL<`~QDgsJI9ypLzfPKXF1mg9V5N
zh1Z071{=_s_MrN1qCJC3qdkK~t+MAeP&*Mc&kSnkg5nLF4(Bl_G|GbR@L_%dI^)NB
zF9Sy{XP}-3W6ebG|NrlR(unu}e}6%D%r?q{_tS&UTVx2;{ICyn?-8g>adKb~3H21P
z0<BT0dFiMJo5O&_an}z9=Bpt8!{_%xmOAK#v^2<p_6Z}8^VJ-K+<hBz#7QpX)DgXq
zV+Z&^clUwTiGtevHEqVAI-3O)=AeBAwwj<bhgcYDPD<)|Fm+8~V7>~P<A>XWY&J*_
zES^B^tVT};%Ndyr7N9d@CwekidN6f`Ffd;QtzU%CC4#~dxtzCGU|0Y$15~CZTbeJh
zW?*0hxeJu<n&TQ+CfYMt!uHgG?<KQq0PpSB?*yGs$DjZzuj=Q5?~VbT|8F^4ih%)q
zmW(}vWurZVB{V)(fY^mv3@i>!3~!)p(44<Wr#*v3p(ev$s5(&JOr=nZiNT?Xp#(`?
zMn^rkt;-VvT07l&Ll0CBg4QyF=B7YvaY1KGEvRQu^I(YD3OX-)K|O;;s3w~hD6M!f
zL@l(aW?=GQhzi|M&!DlOo<YfjA*vTNj^x1*<v4jhgXM;L1|`s%MUWh5ZR$dM1`SJQ
z2F8u@3`(FjRH&wc8K`~$*#%nH7?LSq1zty}$qZUUsMu)FU|XsMTF3D3N~k6aXl%+B
zRQ7o=b?jhZzD(Tu)wl*wS!D?hKP^!FbxdJkzKk>eLGcEPE6{q`MlH~t#cXx@o!~XP
z4xn*JhdB&2pz*X?kKhW&x!^T)Ob&A(YqlKcF$93(&~YC_2B<y&-)Fa%0d!9%Xib+Q
zRK0@390mtV&Ho?3=l0HJa9NPWU;qkhOU?fWKw=Ji8Nm1LF34ce0_`PPkOk(eEXZO2
zjR(jq$YL-8oyo8uivhIHp2z$DKiC~w0v=55TNs!xf!6QA%MomIexUnpYW73gAz;7S
zH3%%oVo(C@?OCYBpkZ;CfpNnr1|`tBTgdSQ%BwY5W(6Uc>~)}fv_i7p*G-INU;vHv
zdN8#cFfd;tILC!-A84--*uKXMj2m7tD1pvRfY}FHLjamX1Fao^l-n!{49pin^B`FB
zE-daq`3$r+7L?w=Y0ry+0cIvB-GS2ELVE@!P+qsxWMJB8&!FVN)K<g5e9?o@`~cK!
z86wSQftszrz<dF;UlkE2pgWjOFf9YsVW4sr=5|ni0iCPi{r_(wsNM=mRxksNlhnUt
zUWQyZ`Za*U;sVMXFLFJBW~KzxOkN_)1l?~!j5}o@X8r-KZ<fLD&hsCT!xf@d3A`2_
zI)@2A7akPnpfCW%J1EXU<u@q)LG=g3&*xF%p9r%g@R$`rqPyU8N?6<l8sh}t@dKXI
zTF4**^&9w3C8YRO0EHXqo(1p!ziUDFVuAbsieJz^6Hr|52Hoey0iN?#fcW_w=$-{)
z%vM1%Taie!LF@O4F<S#+_OGMFnSB;z{{qOLpnLslmS|TX*SWB;fyO<2?hP}H&w|b)
zh39=D%~Qc0|7WqrKLPh?;4zN_IX!7NGq7Xxr{i3P5YRe!P<sW-z7}v@&`{T4;=#ZG
z8ppN(_3=P!BS3WlXfGLPuNr7RA9~gmXkERC_x~TDJ}u~;70`Ym(D~p39!!lZ7?{t1
z?)QR+838vX;BXUYEx!xYPLP{Gc7o1^1l>oY1DcD2x(PI|2WrR1fa)jj|34C;ZBdY$
zY(V9$2UDX61M}$zB!p7~4mYKM>P*mBH#D4bpy5;i4W|;Qn<}8;1lpG=;{E^oStK_x
zK-|>Oz`%SOblx3uII-f0I~UNn5DqtWK-~bk!x0oNpmV7~<NKg<j6vZt0}?LZJ(1kd
z0&zqA9|q=Apfw%{H?-hPKcM#Qf{+%_J+2BUeRfcrwILI{=O6~k<_SsW0JTAUpnMjY
zWCmtXm_hj>GRX|ApfH2-C1jEr*g#<h<;#Hfc6%^@#t*(t1i2gPULOYLQ=t9Ih_VAZ
zrvq9$j9mYC|Ns6GRBwXX3^mne1)%d>LTcXEA?+gpt-W6YTL%T2qk`7c3eEq)eo1Kl
z4>|*tA)@&|_^zRV=KrAmmkb{IbHVqpN`S^aK>a_^913VX2*kbLD?#htz5o9Jt%v0B
z{{Qu2^M6p^mO-HTKLcpL7)SGe1{qMB71Zzd{{OEPv{t#MUP{D+sV;$m`J@Fg=@b-B
zjh+l9g&r&nj!g_Tj&m8lfc6rA(+HP@9%y|y%s-$rOgtDE?m*+{3TXd4X#HG6CfHv`
zKxH5(j6r1#sNMtBf!_cB%>jv{ihYl0$OQXgLPI8lj0XclhvQs^nnt;XH6VLyUP$QG
zvO9@@+Ebu9WI-l4PE|nkLQMv_nq)5#&^|lRdKFOLW<e%{7-(<BLQMuK@BjawAd7kb
z|9@dYCW90xKP|{)kOQR+@BiOwL1`Ie9we;4fY*RQ(nhTT1M_jv8V`c)2vE9cv}Z6W
z)B=ZHk3MMM-#mr@@Bd%-YR_e0ugPRDah%Ht+B32te6N62E!PXw@T>>NCr3j)X#X?l
z`~mQ}Lp<L9|9@$y2d%gG|HdK#H2?EA5;WK7{r_ufO)`54IF1<@j)2BfL1%X~)Pv^S
z{~u_mXOQv!|9^+~|F5<P`@wrTwqUb=K|MHJWuUZ9V?2Y&f_erqQ20%ZXE0e94-Plb
z+!(sJTupKiXzo>KK|NTF%7S`G*rJ;On)d{mj}&J-ptBP|=>*gs_h72t!@zv32R5bw
zZGZ4U+aEH>c@ZtVJCMSg6XIX#3dgyOpnYaLu=y9%&j+~&DZJk_)Pu?fl<;Qq{{Q<W
zB)q?DL<{RP(69!DJt(aAc>n)m2(g>p#BnY-toLBE8x#hhv<Ic>7}g(WBEq^VfPwia
zO8pg*$qw4H!HKQD0F@1({hf`R3@U|O3<99LA{#v!R4kGi*+BU((Tf3eHWiPh!~b`+
zTmhi{cq#?y|M@{`LOs~>LcQ45IW#eFByur0fc8e&GEB=%<j9;BlErRU%N1f!=)u4U
zQtPmYfhW-mT!wIf&y4kCPyyw|n#a}^9!!-B7?_XhAeUw2x%uBO`nkE{4FmHL(AXxt
zJ`Bk^WGCyzzy&(<5jm_a8NR;*wIOT0q(nlU+3X747#hHRc)JGBnU5+pFB~iqIY4vd
z3_O+$-}6BHiJS~7ps_JfynyCn5;+(^Z5)nJ4z>-Tb?c#CZ2v%NLNea{s%3Z3BPOgp
zm?|t7m=A;Q?&1Q4b*-}ZG?0BDx5CzqLGz@DtS9I$Cl|d2x&IGpvLpgPege6<CfU0Z
z)IV-`#Q=7<LlXl}A}82wJeCUI^+0#>Ow?jfu~nFs8Ir;FFHtjdTCJvwL7@f%W1|*>
z3OF5TLeqgJ`woy=%R~kN52o@t49tf?=S{-Hv(_1V9}JXcLE%!!4jOx5;IVXOV6630
z5-D_N1l4ami5v`|wFMlZ91J#~Fe-Fs_zzMKb}Ldig5^9I8bETO_3xlK0F@n~9Bg?F
z_ZnD2p1=DAQWNUI_OIrdg<j1I7Xy%;AoWnQSRm@zcYxH@WGGkEas*V=q$pU_vM5)C
zbX@-z(th$^eTN0;OiUHfSyPD|9N;!^C<kjANKZir0|&@FM^OIY0Jj-9LOIw?KysjP
z0i_oYrm_YG=0l+V8`)t~>JAAj^sou_V6oHh0H4{Zf}YMmZYcC<fVdqL&m0U55dT8L
zC)AzN@R|NEq`jNM@L{p@U@A>uU_JmEzkr8NNEeG;NCt}?C~d>iG$;>((l99fG`wU`
zDR>4B6A93GZ>^V;h$RaHBj`?9P<sK~CSq0+2}x_Q3u$e!t2w4666)1rSL+reQtAfQ
z$CL0JlFmY&GuTXc$)ExbM^6SwIC_Ee1V^YB8)%QF3b+j111<w0Vdw=7L-u#SK;>pA
z7c`B%3Na{jhnAV3Fh?shYqFFpYP}pFY0O2rBBV?FUr0Ouzxpl<29O=#H0A|OV_vLj
zAhQd)7&yRkpfu(MO=Di{pgq<qpfm>BAL+qVBE!JEAEo~a%736dg)0of=@#V1VVB>E
z1sIt3p^V>x!UB|sNDYhOk-v%<7?}5h+HZ*b)!AYflHOtm%4e`J0o`RVfssK3v_}+_
z*J?F`L~5CpL_#%N>}u7$z-J4VsxvTx@*g-og3^u`BoBppf%i!x=OKYaFG!mLv_Bt~
zj~ozrhzDdw=%C9-1y>lD_n?g5TRMDySCgz@0ShNk7!{;5G=RbgRvv-!5~zKZ=ml;E
z$bjm8ONZ}yATe;c3@J|pK=~Q!?+u`K0I2>4iG^gb{Ug2|P+-8oyn7F*4FIe6vAeN>
zVc^`D-^0MX8`OV?r#VnNswP>%5;+`^-3KbuL2W081q=e9x*Sx0f!gDsaIAS1U;(bP
zsTz)XFBq72p^RVEx<~|o+IRTe81jO_2IM}Fdn_6L*MZy&ax1QO3VCf2i66D>$`!RN
z3Kk&0*SaWIfYMDt2Y5d;s4Wg@BSG_BNXNx}Azdf`)p|Kq6uLp`A8?xpy)J3TUzd0=
z<z8W6-iea_!C~Uwz<?`EKxrRr7gGBI6dw4>PEeST-u}Q9CJm5wBU)J$(lL2oNLM!`
zOrUi#*q!KM0&2r~GN^#ta9HYB52l<049q)F#_wubBm!}U2dE9P0Nz#*0hMu}v;ry*
zLE}ZB{0@psP?-o02a?+m5<hC)l`Cpp6f8h#ua-->5)=mxAUo0O@=$mFf1w`Yc-v@&
z9)!|F_5lXw?I`{ys(<Inpi<}o?vsju{A-cSz?SI604@Wyn;GVV`>hZ);CW@JngsCJ
zh9`pxXq^{G3=(J1wyPIg9w__@G8q1Y<dDJ@+*SjXsi7Q@HW?{pDyV<t!IX7_fq7dB
za=A*PKS5_AsaPcc{{=D+k6&Tx7C_Z8g8h`m&;ariG#xg8>P=8R0!}~k!08FphXjWo
zNF6x+{A*w#uMWw4!@#^1rT+^$N2-tw^~@pU@)=|&wzw!{#}OB>KA0zi3i0h@i65Z&
zuXT5@2+3mqm+8g8So12lBGm2Vzfkv!`#@*d7d&HN1l1KFw<J7=w3S1iv!;RC@P+R9
z({d;?o1F(!#s>!GEhu|5A%4eG#(~NQNP7nqFQBvrPKTjfEOwwXGC*O2RL_ItH;|jR
zvHQRKU#R<JD)=AN-%9_$z`Pm7|DbbDOp^cq$62OvGN?ey7m)u&Kz(d*-h=eV1wiFJ
zs0;#+Z-C-G9n!Z1jUf=z_YU=7|5xi3@FSChff4L~FA0lUuHXt#*##=Y@b$q7mtW}&
z49uHQ+P|Q6BA|4O)4!lH91`E4JO_?XP#!Jhg62_(94IV6a)|K;64E*-eb;(9TO=fd
z#y=!1Lfx<b1Eur&b_4LZ5~wdoUiwZGU|`;e(*FVZH<S~#KMh*HgPy<9(=gc2><y5<
zDHcD6l2~^oWP$wZP!W<0if`$PQ1|KoLfyLmQRZh*nogBrVBUbz|AnM!21cB53`)~Y
z;I^g%DE)%UTTuE1v60d`4>Vmv;+VvA4O)O*%OOz_>c#$#dg(dEfPr~EmiE7L1+rfU
zwvUqB!@#^Awfzt7N1?lMAp0muFBq8Dp|t-YeH7(N<ZwjJBcOT*)aIgJA0^3!fq5<H
zynT2-swPVsr~5!@6;v;xj}z8pF<dA}#yyS-N-JQ!pfM(-c08yK3n3xR*JK4(fbvhM
z`^kTy9@i;scP4r;Ft53S+#Vy}@BeX*As3`W$4IH>_wIk89@8oGdx8%G^J>t2^pwW?
zMNqst(6F3C#5pzk8u1}D$r3+6?PAcHWeA(a4#o!249u%Qb0D0cbWy9~Jq?ssVdEgM
zv0_<G2F?b#|4(W)6#@!18UBODX&jrtXHha*oc#Y^VI>2n!b=8@S~mlOnshsZnhXyE
zOSk|3Ym)U0LOIy%YMmuO=l?O(Bs*7xJZJyc$i<*i$O;}e=BP<FuF!7>oxjh3GFJgw
zTRD*nd|rf1Nap!}^_>==J&6LKd6Ps<a66R;#17SDO@qywfc)vf6qmrjyz+si0)rp{
zKM4}>lc2&&1_A7TVxfYc`ib-ts6LMEVPIYf+6Sjdz)y-;{L};5Cjg2kkY5yDGAJl|
zGAM%Ls3zUUpe8v4bXFsS#j^kZYZgmbfZ_)fPo&2YKT-biV2U}wz`Vl2Qh|ZwGzXe5
z1GPgu7#Nm-(nq6Q1L)jCk%kovDk16Y|3a3s{{yXauz30ZKWI+{C@q5g1M<H@Cj&>V
zi-JK-mY;#ek^lc|js;jKdNOd<WCa-1oC>aJIKiM&a2k>(YrT}=X)@s$WK1^X7=sPS
z&Iu>LX;LL5`Q*Pw4F;9^W(`of<bkG14sd$ZfXwGY=BuJFFfcC<ASXRi=wAUW{uLzO
zzuiRm7nD|`9xyO3OR!X6ASbPE0EIE=Y)R0a-wj6?R6;V?|Aicb#H%Ie|Nr3og)>|X
zLOIy~f#Y>0gF>yVh5<-lO_q;=#nb=)L1TQNwebos85C>MEevYCtScIxFsKx~hQ+UT
z1!#T>(kFn%?{jGUJ^{zCPDnEUzeW{M{2E}!uL}6gI1W%+1kV{c2UmD7MZREQUW(HG
zDd@t!CJa=6fX=IO+{XY~YgVAB#lTUM5nxc0>}OyJx|3TozyP%FswUY3w7(TxZWg37
zFoNnH^!A8$3j-sljR4wn7Ls)yJog3iJE#wx2pOA$&J954zcP{L96)t6+BhG`Kag@X
zQi6eb3CjB2f-VMrQ2hX_7hr8UEdCLoj(_^8<R4JFjPPJ!UX0TIDd=L5$L1f$CWaD4
zEd~XMAABf`6UcldzBmERu|m^>3TXc(d`<{Q{CF^h*Dx?IMp?gF(1|^*IW{p=D1z=|
zbpZDj4QkRI3@p7sb+aGn%w+~p-CUDwT~UyM(iex1hlA4>sQ<nXlov1V3(10xi+h0c
zk^oXVGXb$fy;##gXT5{{Gmin}p9Vtyfuy&v6%5RaOhEM;to>2Yi9NkR{UiX&|FvEY
zc>ILY*T&(e$@@aGpyS#^`>6r6M<3FU#}P-MwKpD2p;s7~7ov>+7j)uGa|NKf8R91k
zgPKeqNIYd&7}Pq$%YjNz7=!!MNck2ijub*N`2U4uiT{J%%S$kRKyd>a7X_OOnNNg=
z6KK2wR33ORh4L^kF97XdfVZEuajbU*nddl{;R7`OS13FI-v!KA%VA+qlciu#%PwJA
z>lR#rtt<nTV}<0bPuYjIKIJL?^(o-+;$%>9+y|cjHvyf^30_mn$)FPIb^c!{J3Fl0
z;Xz-c0$PI!3M)`L2ZfIZ1A~J_%YX3rc}=o{0Vp4V%V?zd0jaZO_+AgHyFhwD^O%WV
z;4`pQK;av57&ML=yn=ywK1%x6Zo!`Zp<xWW`*@AQ69xfG2GDv9;=&l;ToO1AaIJIM
z*T8}@&qPr;_fr_o*ypM6hcl=i2y$Rxo_hwloB`G2+AY}gB{Zy`K-2RHg(nOO@UTt>
zrRM-kP@H0mb9lZ&%r}6>H*v3lAvFI088d{ev+`o!0ZzxDvUwhZ4#*9lydUb$4(=<1
z+BVSop93kahJgGE%6qlW!4<G|SD^Lf@HCvRV2ED6z|(I6_|9(?^z`e&6!3<Dc@E0_
z2Z8e82sAt=fX*_9mw6d#2DNSymbI+T;Q3jsVG3HG1@SXz-WEQd47#5vl<fs%{SZ6b
zzna4adY~|=Ic{SBn)3n8bAZR#k=78w!Vg*wD1gp>1&v#R^o6ot+z&dR2O5SbZ75it
zuSr%jD9A#dABMCgVe2=*X>kGeFbi1>%JcqP7?@|HoKZ<2&(kQ}Aai`7R0+4q_`*#F
z6t<QO->X3VGiW*juayOtgNs4=({BL-^DLD0uLSbu6=+)8W6ARWKO`+V7}R=6Skxq|
z7{KO}Ao&3`e(0D#6+m?|D1U<LWl$J^+JiXK79xxi7#PsQ$b-qZfq{7@%KFEU7WO)j
z-;vw0+8qpR@b>v!1|HCP<Dk2Y6kQlV=gl+LY6Te7YC0IyYDidu$~bVFFh$J(G!G6c
zAHaDJZT=ftw{g_81X~nz;FzcU*T4dwGw#B&4hO9a1C=cWT_|nO2JpH{=-f0oT{MI8
zicbdv^9&K>ayz7j-42Vt`LOtVhoTFE0Jv{OmcPMu4cOnHHD0hZg>8PPpbMqV3HJ+V
zE<L0JlFvej3>S#sS?oNRyn7g!r=yJjhqSQ$!{T>2nBN`eGHg+F0pG)eBd%3&#x*Ek
zfZ72La~QyW2IVhMn#JZ{usEdMNReMbaSlqOAV1eMD_3|hdCg#8o(4Lj1<~eg#al<e
z(QgHhBVJHsWl*Te(lDrLaWMd$H2^OYJS1?})h&>6npS=Uoi77Q>khEGx`Y28!MeH`
zvQ7yUE=YB_jm6Uc|7)@|48dU!TBm}ot=Rza548LM-M6BG2wP7Z2IeWK``7S??E`4o
zo&eul0_{tJ!Wmr7wm5*x*_vb>gPLY(NZk!-^Pu!4K<NtXW{4cT?goVmSR7kA%7Eq>
zY-{?^$`Yh7reb;PA;7>q8D;)g8*f-Kia^8ahIT6hzr$Px1xwfeAGBK;1Zr9W3_`k?
z?>X#a&;ZR>gU(e|WMvS5q*XW6wCW{c0V`*))m;S3p$_VlL$EM~wvjYIX%XaZP<(}S
z^dqNX0UY(2130~=Y8Vu(LU9vH+5oqeaHQFgW>6XE*1^C$38nle5DyBFcwpp!#sla~
zXMvDp28EC;7CXmz3?de(|KCH(1_^^&F9i#W)c+r9n&m)ydR0Jed`s8=|7*Dd3_x)N
zOXr|D4Nw}#8#h_F*Rg=odO-$CI5dFDK2RGKTt|?X-c>>}P{%Pq@q?%Rinomc8M|<m
zU|^nrGX4izyNKMzfYmji_5-NR0NM`%y4w`gmMC<GuB}9x{{+=3xcc|txlt1Kn1JT8
zK<0t=nSl40csPLfnSj=Gg4}|w{SwlCabHNs$$zyRRuv$(BGiHBlQ>}gA>#I-IR9W^
z?ngPJnzZl%w<$n#UXb|bV9Nvf2VdVD6h<ihZvy*paEB3ejuupYqP6it+9&S|>FB0H
z7=iMv(-j8hK9upVnkNzgc+(IUcwCXg;`#sopm{;?8h1z<k^rxhnuoH+L<AIOptKHJ
zzX!@&pfCz~@$Og1E4F{NY-oGIK>kJQ|AExkWJ&y}^&oQnryFce)&Q~(2vm=u?O`Ic
zehRY3&v6d}b1%yIC7`qe$}{-F2AZZ((hJS<6Gs4@^OM602Id}=@h?c2;8{lq8p8v{
zDI|S>_5;#B55dEQUU|rV0t0im4068*G=@`?f@jS%Xe}0~T?h#ms;(~ttt$lOIar>l
z<p8ZMr1hF<yB-GSE|mTcsLU^D$Fsf`G?vT7ng-uP(!#)C>F~WC)E-7^<D;zq1>F$`
zDicDw-u(jguWB*^^lDO63<|m+V?3bwSZw=tA>|Kb&yEL^?E?npPSpEHQxq%;+VQ93
z(1CHQ2?KKn$~kT|DR}mjoMcc5InJ5}TCbJxoS^}<Mi{!Mq`u}9?mZ=-a1Ci@`v(i#
zT8{v|T4x#f*cox*YSY2M+=0^mt4UU>0IjvcS7xGwYct_AK(Gx4neTy*!Gin*+7Axu
zTY=gWp!5Y2^I)>R!NA;(vi=?7UJ}v)ech|Uz}&V4rJPAt!nrmMw01A#1tcwi_V0ko
z1bAAY_WmM=|L-uv*Q$bnxeev~GSFEOxY9zWCj)b>7kf!fmgKb!nG8&z{Scj=3{0Rg
zVNhEh)CLFL{Rmoj0E$OThwuMDaS5861?BHVFAng&0+2gAm@NM=Ft>v4D1(np)FiW;
z;IezACj%46-jJ*oJCNNQJsJ2wc7pl=j*Gx^Hw=j!|Nn!=28p!4rsk;OwVIRv3ML$8
zV3?=^yAQGD3rhT@Nu#V`g|*i~=Sno}X8@mVY%w2v9t7yjKrkP)j=9mEfyZ$U<X%y5
zxOD#i4|bO`gNmiX_kW<f2*Kf^%%GB}$-y{L8M5BRgUR9v19M9OvKz35Nn8U%rxpWq
zO{V0v4Ot9KA<4(=Kw|@7JGh{BaC(5wQUb5>0^6Ylx1)i9xdmnX6PFzewHTNXcC>))
z*pS7*N2EOx49v|a{U2m|K<NM$p5XqECuHAvO>*Eh(7CA-JsEglX$W+OFQiN`Kf=J=
z9DscG2k0&)<TL+ZW;X9@U|49&z~r!qK?ZaV9Oz67(EVDlb5XtjuX$6e$!=0p&t6jB
z`TJV^pP$!2_ZHOu_XzM{I1M^WwBB*={}Z$4GBAVA9hv=?fysl(+=hX<3AFwde%1?4
z`~NjCEZ)z+w=f>B8#2Q8Hptbl46Xp3TU_7y`da;-mk@XC1-awYRQ=}q|BieAA8CvS
z#q0k%(7BbM^pmK`-~bxeuvGYO2jYY3i11bKeu2)b3}4Ci4_rrh`WO^yF))J8vjpW+
z(7BMH^cbqizGL%z1}2cdHt%QP1L^T#GD~1!ZUm)&_*tLG=X}=GN`vp72CZELrT=Do
z2A<}4@I6=(4U7yryBQfcEEE|uAZPfjo>0I0UjgWzoBGt-6`(s!>s>BacrdB<!o+GS
zq$_IXC?m;fZUvnI4LYk4bUu*>!^xSTduGB{ve|+9B%!J|>jGJCaMZHs6@;u1uxj|v
zpaSZjfc$Fd@IMc<W~r9L$DoiCd_O8rq9=n3Xn&if!v8GLITE1onmnHYbOx5j<oygh
z5I>v7FfccQ&aovNpP=*<i!Ux$&8hE_o>prk35ma#0RbKiCqVamfa320YC1Cc!ob`B
zD*p)EOH?{qr2tDu^_|kw>i0n108T?E0zqfCCTjlwU*GJ(;JEky0otb}6A=dHdeHs{
zL|RgW+<`KIkwFI|EyXkNG}j}gB}E1vL|R(u0!lNW`7YS~F&<3XcR^yHds0AY2vtu1
zBq+Th($VoiQ2Gg9@$MHW&A`$NDD9A!W{h<hnCn3E--xro92q#EYr0fwYNWyEp2PA9
zDDOefd*Y~XX1D-4{|R)4c%c?!gJTn;3Fxd^P`?y(X9*~8F0^Oha-7Ei+Oy5#IFDhC
zelz%Przf?x-k`JHc%ZZo=<F}Yc?@Sj=U7|s{r`VKJp<q3cm_StIf9Gp8RVd6NGgKv
z?E%fpg2K-G|N6v*_6%~hHeMnd?HS}i_uE3vX#t;0PP{pp80K^`fY$lhfX=f7yQLoL
zmi<U>S@OC9>=w}7MgP~Ag3PF&<0Z0rK7$-6jc&AO-~xpYEKI=lKs*CSs3u#^M0*C%
z8G#!>XNp75ams;)%>+;w5NGGQL=OfA(0T1VM5=G}U|;~P^AaFZ{X!H!B{C>@Fc~s1
zFxP;_zp0U4G+<$aBfTtvhRF?RI)SAZ(AjaI`$G>j+BJxP)60AYsRi{6dd-;(42$C#
z_`LtG_63bi*Jm;>1Em${xv^5vv;sOO?Eo~b)HK>PNZ>Fdl%N@qbOKtJDYF3PhLsEq
zi|fH|NCfL&$-E47P94k*&@>`NWExrGIFG>rnnqHf;Q>nDBAE8AibS^$bO#a0e^}I3
zVo|HpXxD(nAFF1ft6gZ%AO-gaI9=$yU|_C78UI9XAHmu&ptJBA?GShLf$}%#tUPG`
zR$ySRLRtR+vKN~<pmUZQ<r-8LYB2~kaxgGhYX1Khs>xypIx}yh7K6}2F9scuU7&OK
zLY*OJRfFnskX@iN^%$5dQTKnOU~d~k?a@H8=MRbY5N!W~+8>Q^4GIhG89?XB2{mFr
z^H>Pf#<YZ-c`W3?q}##3T#3^E#THIbvvr6x8+7I|$ZQ=3=86|YwA)!gZC%jW(~X=A
z47kpM2Bmw@oeQ8d!eMa&Ix8F&ABecGKv^%1>>rTdVQHu_u7L$~zIUP~1II)y1``h^
zof-z_3Y7C6iO|ag)$72(Tn;+#5Z-qqLazf<FAD>6Im&nm5qeo5dbLk5Fqh-ZFF5=w
z0M*;Wz+8?pUQC3&3Q)ZP49w*?`%BpE1>eJD;=!aX!oXYx>MxKGRxF@9oJ>5Jv~Dmk
zmrX%VQ<e%p8}PcDi@~Ip)58MdZmk&%%w?eSj<MPePaAd(ERCEDCWTx~433K!KxYAf
z_WN>7^km?e@DhC9q{u=~2Brls8MrojGH`8p$-rdk@UsErZ&3dpbdIJ6la>wxb1C8U
zkKHaFP+t$tE<R8nAG=+e2N;-3QTB@?hY10Hu}t)2U_rBsZKEdx8xFfd7??{1kmG;^
zyFg>30%&##ZS-Ui!fuzw3kK#Aoc(12{t}t!$smGem)J&61~D9V)i5xZ;LQI7?2?%1
z$smDdm()g21}PkN2{14hgWAjFq(hmBo(wW*cFAq@WRSydm--S0=3<ojGQ9D{&ICHE
zMFTXx1R75Q-M0z4yCK!<Kj=<$4p6$E2)-YNK?OGc1yg6~@c;izPtctZ3>-7C<_UEP
z2IeA^{SrjD1$4F>1Jn-CIhkO0fZM^I;4^_0klhM$11O(>`VAXiGVo#MOSLHs%tfH_
z5_s5?R)(mBFfbS4O#h%V041$>GN^QNGBAaDG3bHzmxIa`(6|lAU5K(mje&u=5M{qO
za=2hK6J$=J7XuS0yiv_k-NL|JNU*&C>f3<skO8%wK<#*F{iz5#dv-=W12ZU0K=y*h
zQNaBSCe;`Q=0cSD5@a{R{0ue|e4a13>;&DZ2ks|;?19+<x~B#-t_x~+gX~6@+fdKI
z1abqW{VI1Dm<v$$3t+P!)J_GvL6d<2WOm1V24<MOILvKfU@kyuFJdznY$mF|Kxh8)
zHOyyVKz2XWUkV_*7tCj1LYBi}KMMnMK1%%$@;kB{K=A+zUvRqxrA|{m!oZvly6*##
zo*4+#iCU04F;SBdTCXZMFfixaAeZTuM4Q3T0I6G*Z5WvIP|o|u=?74q=gFV~O2eS@
zV=(iB(gz0Syfw(~A;v8D8fk~04T!v@w1j~<4`=y@61GV00-bS!#a$5$%y~H5%ec%6
z^<sU6#Vj5M=3JEZa>V#C(Tj-z(=5dU49vMW>wi4%T7ku^5(eg615(32(TfF}yEMH2
z&xm1Q&OtdZ8QGt(bnX3rhAAj*gVH|8y^SboT;Tx&a}H>{06sQ|eAkKfg8%<v=0NkQ
z3TS)@bZ)Zs0`OR`31n=E!2>jw1e%X<oCoeFNqPUDl?xIBmwB51|AWR`K>gBMTkv=g
zsE-dGpF$dM0p)v;K2wl7kUp4Nr2H*`C^r=p7?`sO`XA)(h4u_=9rX;%uyek>|IfS#
zG81G6EL;%g%Aa9i&IXN_BE}OJGRQ#3+;l7w83aIKVgb4n6m-|jflngd|EIrgR0Q9#
z%jh_dA;fVng9Ion9Og0fG$exNY!-@w?o`n41l_aFkOR8s$YCBs0Yq-DCg?oxhD6Yv
zf^%g%ni&{6!1v^>Hk<)DgWUt7ZV@j?o%jElqTqAK!RqI{1*wPJkGGl;)E@`mUG{(0
zMbLOOMBidp&^hc#X+Q%t4anVKV9o-S|A;Z8gA5W-|Egg3@3g;Y{#Akcw*%sjIiVo8
zLhN54>A}Dd1NA%Tt|w-Pc?=0qb-D<3a}+^-@nB%EfXWFX<Q9U?@|J*z&;E%JUzF+n
ze+Dba-;gj{`4<#sNPbm7^{ea$2Ifpq`A0(BP7_4)D=cnXApV<gi4?af(74Tj$j$bJ
zx|PHG|7^$3cm{?}Wd??s&J3XYyg}zFJ3!PeFa)Xd{y*Ik5x27iLE$lbF=Xz~`~Qr;
zh&WwX2)a7}$)9L(D$ByaoN;7|;(rq2bgCwjKYftWFf^Uc3k2;wg2p50J}yu^hCtju
zD;4B^Nc_x-1pCn*+@CXn$j=W%lD7o;3zAM}Xd?WyU@qvsJ0w4$#hr`^19Lj)z9SO+
zG$j<tPZ5rL8DQxY6n7ln|7Wg+x{JsA|J*_k1_lqP|9qhF7z6Rs%vOZDnUzTXvw_OP
z{Lkb4e_pEh|EYzbbO>s*K;>N#`sZ);{{R00ZhuPqFfgZs_6w8X&&jz+{!BoMyE%~X
zpEDJ-7ZU2X8mQkIAaXN6cRX`6#x<yb+-T9jz}S%ty4MT!&N!%ld?0$}HiFc8|DVzc
zy1Nmi2c#c<&j|FMIZ(cY#Pc*qL_E&}`Tq!R|4aEWFsFh1kI18q@bU;p`8x^he^6Nu
zx+kuCKLfYpJO(V`FuNCbI7|oK@eK)w8tDqqeWzH%p$43;q2Vy65;O<n{eN;JC>%g~
zaE3$k;|lNpQ$b~g05lBOdjAK{wVFWdAPqzvB<aAwoC;bmfvA@o;qyK+p!x?o=feV;
z!vM{(6>5O{mlD<u|NnsQOL1sokg;w6pI0wp-SGb(RE)#Afq@BBXM^f*$0h~`P=60p
z2QS{wzy<1$Y>a2%0__P0nG3o<18S~@_y5VRp#BA@ZibE1gU0Bs_x}IyFz^2rQ2cuT
zpL7<~&j9D+cm|likm_uS3<l;D(0(yQ+!Cx?CrkvTZCKnw<5d7u-#G3A-Os`(0!`N)
zpmgoHkKup^10w^-{h+)Dox_mu{y*&{v~1<^{y(!7RL^+-pXP`p2Fm{xX!;bq|4-Y9
zP&2F3`~M`{3ANxfFvt7<G)5%3T#%V)`a$*<BGk;@>HYuz0q_4)Pa=se_5MF`>IR6J
z9w_=3F@WqhM5vvn+NjLHFwqulzl`_)sf`G^sig~*85lO&GBAMJHkfHj>;nUH66$?t
z1nc>JQBc@}@)W3D2MuQ%P}n={V*up=4)6a{{({N^NSdAjx(~<z6z<;tr#wZ7&ji&S
z(E5AIS%mnkl^g0A7;u*bVh#+<iJ<XcM0&wq7Vv=Xk_F`n@Be*?AU7kW7acTrgW4WE
z-v6h#g7PlJt<y_Eb8iqoOwmP%&zK3?V+s`)MTpP*2nu)a|NVD2)G#nu)G{!6|L?!J
z0W=SZNcTwjS+szGIT5s8mIQzF&LqwslWP&~nzk0<kIAVB@#&!UASnEKy#G)3MTpPT
zg!)4i$se2>>KU}Kry-FQ49p3j^^ypG5X`?l7t#CyDwmP-FQ`sta-7F71)6`)crY-6
z?p6i09XJsAcQV+mkhqw76qMJz|4%|r{~J9R7+O&BPZNWV_y0-YxPs`LcGCNQUoEI!
zYN!R>FTL<3G%qjk{y)hS6c$i*3qj_inI+-<f6`Kfn(1%7|Nr0O{eR+LB(a;`|9ek@
z%m?i|M$x|rbpO$$RD{||kqyltH~g>g{y%XiLVV)d1<ec$3&8GMU<oQ0u*Ze40t0g#
zsQ-hA3+#D=!(t%=4<v7NgYH@uK*}2)j(frV7SMdUj0XcFEG}xGaRDkzVR69&jSFzz
z0qraD{y)VQbRR3!pD=j~@BdR1LH_an-z$hnYZEg;{spaj^8UY|5EMp`eoNn74+hYk
z%2PpQhXR^eJl_AOwL-#qS}nxPo=k+96B<Eb1u=6zFOr!cvm#K;TEw8?{eQw!kQtCX
zKj9|GJ&<%T{~<ITsCfUMpo^qN5oA6jF6OPp9T$QV7?@*2kngD9PcSYzccSGB^tgc4
zYbDUQ*nm{8!NQuy`~Re!khquxO8+S+er{qg@cuvfD#$<H|GQfe;nsf_<oC(V3=EJs
z=#BJXU|8b)fAUI@S!ibPc>kZu2wK14{eQ|&h*@1v5oY!M1%=UOxLG|QcVG$o{!EZw
zNZ9wsHiGUt2i0ZH@cK-}`+py-uI2Fl-?wyOECU0$PIJaruL+1SFh_&tixK&NV42im
zi$Clc-azY&3~1Pc?iaj)87>n+>0iP7|3p*pT)sU6sLX=Jjf(gGNs$OY_d(MC;@1`4
z|GQs;?v?ZYKMB+x#FFMGgYN!5;r)MdCqjSkR8TlW;;Y*i)K@`q54f$+$BLx>Cu&=v
zHxx<E6CAEM+X{R~7?`6#^PePyY1>QuVan(N4bui_n4a)pU^GDSLlbDMq#qPE3f}+w
zA9^q_6rjo5c>kXW_M`Xzj;)|JH?;4efwk`e4(l$^eR?On|4%rJJ#9}?_5S~VgZKYQ
zvY_zs{@=lgWUdZwb30FBxNi}IiTD2=a9^M?u0aE29>{$SSo%}Y^2WgXfA?OHeT{Jq
zptWihAoUBdsK;IQ@JcW+N1&#Ef@M!DO8STPm(a@}BIBzMoQA#s_Zeb@M-zjM_y7J-
zP+8&qznvB2PiP+rdwhZWNFAVfI^q4lUlx0OO(=!L*MwY%xowe1=3<X8h`FF~DAe=>
zj;}6I`vlbQ(*T(Vav#?Cg7o_gy#IIcg6spw7qp*<HNI+awZpkn7?{H~aE$}Q`gY#`
zTSP(iG^kDkja_>GpN?k^iCcn!IgH@^pZEXfgN@L!_=TJdN`>wmpgBna&|3VO3@MQf
znG8yxxdYI=7ig>)G1kwugMm2==lTzXo0}8S%?F(~M}+wi49sCT$N!Pc2i?KL0$Sq_
zaX)zfArbE9{K3E+in3n<`&fC?LR9xNFcRl}&KV5Mp`iL7K39apd`C3%9YFhj35O4-
z1p{*kXuUK6^BW(cn@^nkIc_j8hoG$g!0!IWMv(a+_b&8gPy*ev35pBQ9^^s~21n3-
zV%%wnqlAGu1n2w*B90qnL3V)5g~qWXk$w<iU=GH){sm!v!(KG=8;FYo_ALy|!35`j
zz5h4FqMJ{g``JSnn1gZ7e<R#q{};`C7UJB`_Jx5t2-N>4kcR5#qMJ{g``M;2FbAQ`
z|6@->^|m1Mv8AC<kMsXRz1IJ$?+5^`ALYQEme@2Hm;;{>E<@`sg6smNr3Eh;l#tDL
z*v9}VH`4Kyd#nc-m;-Un{~_X}E)!%APCvPW{A2+-|CXoFg8`K1@%W9^hk-c|H2z5-
zo@&2>>_qXK8^|65kUbJ0d*Jbg*N-fB7?=Y<^FJiC^=gpke+-bun~y;H&uyxpGy0(I
zJsD_wF9X!afXKIl#)Ekv?2e_N@gVR2b+(}PlK1~wSy257s`nb>8Vo?~UGz2>OkTf}
zf!%Q)LjYuqxgOMybb*-Jcokx14Y+QHnFX37!e$oK91hSJH_})X+MEjW1_ow-Q2r+&
zoT{&a+QiWDGc4iM0-Do-jZa|-r#4WV1sYE6wGcnmg6IFd|5ty7g+pUpg9-8BRJRp0
zUj+%L2Jrlc_y20}8~`+&OehN{rVa*XKhXL|L^u&_k5;V(g%hZ~0}U(mw&)yaS_02I
zIqqZl<H5k#fz~(R@&4Zo8vk<e{@=V5)W5=%ZvnO06}<nq9Q0sd$Uu`1@&4Z?2}y%B
zk)XDq_x~!;*fU2>3VTUoT!RH@oB><<0fieh4SfN{gZKYBP7el#7vBF{!Q;H%|Esq`
z&2xmr8Q46VkQNp@BFtO>F|!ubN1uY`W*6`O4T2CiS3X5D+X6JMfz7Q@cltp4A1>bi
z>!JCsaw(F2u-ic69(c^)z}+WdXkcLWaUonjR~mxKFj#vN)b^Z_$-s<gcQQCIFnfc>
ze+iU@6)&-v!wolw@&6A7W^W?ee-+^NADVmkk<8h^!0Zhg|0Lv|NG$GQM=~daf!Q17
zye#Z>WrZLXbC{6KQD9*9x<fde%THo4hYMlOzZ(q9UPQG2%E9eFwD93WGG_t<vlq&J
zY1sW$4m!t<1<f2bBy&6%n7u&rUx+e<;FwNXCa4U7mLDldb<!G0Syw;NgMlFgT8{L9
z>LiDG3=<%7)zCVq3_J%2%Fm#AJZ$A4sEz=Q^+5DBR6@$+GVs_Iq#i0S1?3}<eo$W$
zJ^z5rhN!CqjZs490vi{4|Np-OXWhg2*Mx!D1JwRUga^SgwG`AZ#y8drTB`sWcL#@s
z<35H59t?~DXypr!_y0Ojxuf9yzYa8qQ-db&;r+k96jJ__g6A6`WmUN(Gz>IA`zx`A
z0eEbt0yM^R$NPUhXzT#XI9Nlc_y7M(y#F_V$N9bgmokFNQHUL7pm`opzg>rb9f}?d
z46u1U$k^N>1`F^1RW~8-E&<g&9H4jsjoDx;H=$*viTD31XjxlQ3GyFQj}EqS5@*@S
z_&bGx*&WpXCt-fSxEEv}Xx`0nA84IW5y<bLITX-(BNwE!o&rgiHK6*>1e(@C<2azT
z8qjq_6+0nmws<QvEraIkc)b7DLfZnxb3y)sq|vfY(7Z0h%(}mL*DWyqn!>>BMnwC+
z7~K9}=*hqZ>fc#<{r?~81v!HYwB{eQ9}(21Ep%safVW@qjZHBAl3`$W1&x0ZD3gnh
zg33T*>?Nu{#rSgx1G6j6^^b_YL6I*3dm;T0yng&?!NBYS%KrrXSP1U_!~6(d+dU83
z&%tZ{j~fikE<}|7g`o1E2h`t3S$}KSfL@j(>Tt#%H4Mxy1lRw2|1VSpwg13oBh~}U
zfcAJI+XY&K0Gg8pt#L*c2dz6mnkN&0uccu8{)d6tc?aP-vS2A}jWgH{nhXpC*ElnN
zU%<fZ97BZJo;ds_gJqqw1ZWQ)QEQwTzbh~>I}uU;=Y#8iQ2!J(t_K>s0kyS2<2Rr>
z7}U>3)V<%%FfcoT)<5D+YasuC>H@@^U;(I{<?#NWzZWD9Dnr0>ix@;2!0Q=XYN2r_
zvY?)U3DoxW{@)ylJKnyzFfcnYkT$25mkMeFfZPUc2cY*OKy%EXIuF*5_~F68*Z^`b
zsEh-<7d!`1o(h`3_5NQTi@hIF0otpp;Qha%5_><Q@*<>eDFDxZdjHP{k9~u}q%p3+
zfrvK$8%P~j2<oRi@cv&3t^e|&W8Qh7x*b+$xe#IA9H@Dqb*K~2{OjWVzxXV~y?L>q
zdIsiBY;_?>9@>ZSfYyr+-v5iB^MbhtLGn=jF4*ctkUUgB?*0Sg7Y7Dr2T=PDZyNOe
zpBw1?KaUkuzJk&*C~bq%HA)|X@$(-BW_u#?e=aL1-GIUdoDLQ-2zdX`3xuXw9`FCT
zA91JE&oda9?THxw%~=St15~bf|IgROUS56nVPLi=V*Dp36l4~%dqHK1_y2s*8aEzL
z`QiOPUlqF@pI$I9+Y#LVg<?K9U*y<=_WyYQ&%OyVx6l*37lj8JMjW8<fv!73Dt|xK
zFfiK@EdMd>$_A}j;qd;Sor`7{2gnT@>KVAO*d@TgY)f$e7Z$rf`5j~zBbr@2P`mgr
z?fSTcf!UT|{f}u^)=!X`-v6_vqS*yLr)onz0~;2*EEt$=2-g2t>;k0)4)6b2nrL<j
zfZVX5o<RuHt`BDzm~F@?|FfXwf975^yF{RNiD9uTfq~fu<-9y>{Y6ZFWrD`AIK2O7
z2BO&|0kumC)2{bl7?`aIj(=mZ%M)a#_y3HiXm-hf#5dG~&Xa)dQT6n&0Ii|)V0_=f
zz-$c~|3LKD2=-so!DDcUHhx+y{<@6e3bcI>>c=rV?qitX!N70;R34z#Wd)!$Yzp50
z3&8zfG<gN@|Akv2Wq$_bJOpsREF0wK67T<oV7+L1c)b4?ef0kS|BUzlBJi3@@BiuG
zHBXQ_CJVIw!vaOmA_fWX|GD5kviJY=pU`?k#QT5FL5SVyow)l;?<^RYEphIDLbS8f
zUBUH0B7?w6Psltb_V&%&Hw?^{pz~q~)GcXWA^oJZw_tOj`;bBP%jTC1N*gj6G!Sj3
zw=)=+EeV$YptJ=#2gCdSK5!nvOrviD7?>?_?*E4Q6>5%#_y2vRpfria91aF%3()$1
zynck5qvQR5AC9`{%>f2x3xe|>P;<1r|L+Co5lr{IsbFBX0Ih$->mKj_sfwUBDyaSK
z{eSOFr11~|lzkkGZ!{Q~%|Y`&c-KdJ|4#+4o%Q~ostIx<XzXA?J!l=+UfTur3`(2l
zgV~0lFx<SKK?&+^#Cm1M*E<-P%|ZT0*aKQicY<lz1V#q<I&AO%DJMbZFSG~EiF%2I
z)Uw#sDtlLW|KD>JkJ$+f%;pM&`wn}-bLz<Ln+=(uJ+A>4;QjE7uVomR&4}p#?v+GO
z#~U&kbP#Fy)fEP2vk8RVvj;q<hUOkEBy)Ngn9V@r{{-SXc`77-?E&>ESwL;Kg`NyT
zp!@~ukJQu$iGb|bkjWr~WVQhVv*{Zm+^CDiuSy7WUcO*pHYKY4v(TPFY@<DckoW)H
z;5H8^jcllA5Cgdv(Z_r_gMrx;l>Z5&lca@^@@{u8D7|c`XHfF~zq@gvJp<_c5D8FP
z*-+1*QB&(B0<}j7$qoYsW|I$u{l41}$!vK04`eQ?n_oO(U^ZDm*t}g25$5f>3Npw0
z|E{wjw}RX_p&oM9AHtn4dKj2ZK=DsP-Io9wgM*D{Vc9>Ic@;Eg1+DMU_Rpoh1f?U$
zy28}EpuI()aa-^I&3B>WThMW@EbzK>@BfM5^^j2YYeDKE^;Yv*P`?E-?v)IxE1_ev
zIjng1&oMrq!N6=BLE2ucc+i?JWdDNJ-7+}LV}S0TOBIFsiO2hY#!cM&=ThDx)TKNG
z`31CY8REB;iwL<)P+J<b{+q-5e+qc~57b8R{-3Ss{XgL-$ls7KYg!2kGo*4Cbq^Nf
zvkeT)Mnuei#7BbC4Afj^@BdBUb{f|GmW<D07?_Pf``;1ih2YqB9D%kGvFn)AL2CmQ
zy#J?z*8k_Av{{-!W5gLVA^A1I6I6FV!*wBO?JTIz?ft*$Ajpr9^pgbYTd(o{p8@Ji
zU>VEK+zVO9oC$4j#V<sdnY<IcwiCQgtr4j$l?XBm%UaqL@LENvdjvu50rl0r|2G*z
z+g2*x|C3>B%{jdPCr5(J2ldCj|2JmhZfiX`!N6?LgEHnqu-zK-5v`p{=KB6*Pf%Dx
z(q-yXP&)Sh4=FF9VxTmPWqp4#cuXFmChev7|2XjYH6%P56`|p=!25p^Z2c>b_y07|
zxC*R|inPZd=_tYt8N87AN`i$o52)?x{Xh04D9%CSL(udB(GOnVpVW%bpHvBo7w`X|
z_5F$9xdw<E6VD>zqW&)KxOnWqz^o4%|H503g7O*29pEtwa34Je)Mn@K{vTrs5(l{z
zEC(NlYv6_U*OA8I>O(<&cUYN@T2DOM!@#Tux-SlqKMAIZsJoyv0Ud+GQl6)<;x5k<
zB%$RNhxh*kUQn3^DVwqug32b)x@Sl@rhxYydH;_AuLp+Yg?MoJ56O>NkUa*Ee^+?_
zj|Igyv^-BU#b2I3Ji)-M3+n%pFh3KCzW*DoJda1(|CtP08-Qa!bi6Fo?>yfB<H7rX
zLHPjcH%5e93g|u-Xn7t7tN(bs|EETJ|Bw0#igQSqW#)py40n0{-~j`(4ru>B-ZbX@
zKe7{)&Y<Qpd;iZA1*H}2<@tji24)@9`k!EV9s#cZL3TjX4Ene&C_F*qwgmR2B!bp|
zD0u%*1kHb8DbJIj>oKCh`!*rr8g~(tPa)-b7UbMLa346v6|yfS3AA?>OL?9Q-T#ve
z-c#cJKk_1?Jdb?|%Ht3-Gr{}QA!#xiWEPh4JkA$dZg6=2k8=dM2U31z!uBVrc>j-`
zick~V2{Ip2o@Xq@U54EI!N9BqI{$`*yc@0v%DYH$L1uX#TM2b9kN5usP~B+Z{XYgg
zE)L1R37|BLr96*C+LM_m>HR<AEGXSU!Xx7*qCAg5Dr*xyg7OKdyaUB4xV&oujXA`8
zMYti!7E+$az`~lx`+t(A_x}h<konll^B8bl4RLSGN>IE&%JUdbgt^h+{V$NXNSDMN
z7k3L7m^BHme+7j*$RAKY@Ob|Z1Fc!&@cti`3K9po6)XoY&(n`$mgi{`ahK<J-Y_t0
zfW|*aNE4x;HSfsnRoEE_(DN<gK>J@n^UR<;iq<}l@`RRK9Nzz<Y!T)8^iWXQgecGB
z!Dm5u{||%h!vm=Ym;aEwGhG$rcS!p@92DQs@;o6Ge|diU2LrP@X#Agq@;n5z1`*l6
zpz;T)eI8i~^%IZx|5(ue2OQ;jB<%bL9`FB=jv&8-(kUp7djF3EpZNeuTXCTE576>F
z5?23#>VQt~|Dj-iL(21Mil8vVU7p_-U|?1wIR5SZKX@l7oq@s=vbSLBN!;c6tvw9P
zYN+);!SXx^T>pdYpsYNP2CeB-@cthS>i=OW&tstTP9ZB1Wp5-SD4#;g-sz?wKSI(^
z7^scE#`}K^XzwVN@;pu!Qa;2%*H?ys*P1}$Dnb%e-a^crx))()D99`<<#_~nuOd`$
zA;>+D@@v{sX!)h${XZPm*5vU19}aH+L&}h;vAD~Sn;HzvDxmQX67p_fAa%;~@Rf)%
zFA7vQT6q5tN80}$1xmwM%JXof{qND9-v5LCg2E3H9#f}6!()N>|1hMoHX1aSfTevN
zu8MF&OfDq8!eC*|<NZG-())jqC&+y4<#`ymu7>2fF!26QNO>LxJ9h<C-s*zl8WI<i
zFXE1i>kAl|mC2a@34qT31Wd(Vo=<7SEYBx<;x5mx%P=r2fyVzxNE80x{a?_$iKTrW
z0qS?+D9=N{Yu+GfJ0urWra{W4)RUmH2~nO$#)8U7@BaZv{m>9_`47pDsgQGv!R_-P
zP<%tn^Qfu#%kyg*49tq4^FK)_&;5Ksc>u}3Xyth@c>NzFU4&=i9&ZT-ufc|>3oZot
z9Z{YKCxZM7k&6JG{S7V8gJJa_s1Dfa{ofyaZZ#y#Ql^5!40m~c)q#Oo;Sb?4I^UO|
zvKEx?A?10BE$;IC${Pk|1=RYVV0rEfuKz)HK*NyC_IVgDXiuN_|1ePh4@-F-4&LMM
z{on5<qC5{a1eKqVvNr`XMh9-62Y}l6YrOx5eFd2b%1fZI2e*yD{on{+Ncj-q3Mw<a
z|N9vt%nb4b<#C9a$y-6;21%3tAhWQP=Rs>hW<b(>5P19tQhue#Ld!1|@Be|YwkC)7
z|3Gm2A5w-ShvF_nE=Mph%Y)`WNyxk2p#7!D>pID7p9dn1NrZsvMhox%f#CTPP&j)3
z4*{iNEaiD1cnlk&CbZJ~zppMR{2<|x%nJ>V1>XMykjmOn(ArTf<#`~|m`oVx{HHD6
z{{vuQ4JwN}z5n}w`()V5^FVN24RK2#Cn%jj%JTs5Tq8t0AQlwYkhn-Zi90SXUSMFB
zB{=^9$^)RZhDc}LpfjvEy#IS01&M>g0xSn_pC|srEYA}iahK;8eHfT!39kPDxdW2d
zQ&Vy0^@|J)%rYeQ|2)C{KWIM3Qa1#F=7w?94SwJ<ACgb}0zu^?q@3$J3M%IibwjWt
zsI2t<?*$w4<M96P2R{D|k`Mc)g2EBf*7pIG70|jNq!NGKaDj(`SsK*-C82KcFvMRs
z_;!Na3Q0?Wpndl^+WNjo<-czz$nS`{!53-#CkWJbg4PYb;64w;?BKcH|2-{1{)U8E
z??h0T;jSCbt1vK2fzJORFm~g97L-<?<}!Q#@3q98Ud~-$V3tB1|0P&AxS@~#l36$S
zgZgv|-v9kU`~R`j4S~F%GT8gS$6iD^?kft)^N@19uNUM;Nc!;tty^B>{XYOScY>v@
zA7lur8-k$qjR(@%K0e^~AH>XFMTD82AhWR44L%b=?t-LwpH`52AZ20iUuapV;{D$n
zR@QQO|Mx~3|Lr-5yF5B;!@w*F8viAsZg53k|43%t;Jp{>Cm!$rexUXL7T*88k;+;>
zP#VTkH+UnB$@s^5|92Mzg&!n5dfr0AV}bX7FYq`VB;EUi#tyL54c<s?@_<H2e0jmb
zn#cQpK(6<Hw^)$**y{!_aNiJOhu2$Byg=#(FQoAwFGob(&~1u4E>3S@U=}C1{~eUi
zKy?7P{0Fx|TtV#}4)6aiD?#EQw}R#1bwl?}%(|g#E$+JEv;hON7^wgEp@xHLnbUj*
zR$S|)Aaz3mcx?mraoST)7?{OC^S>mdFK1S?vJ!0^$Op8i1xMZB0WR|)`NYE%R6at>
zIkb6NUsX_f>;2ya=^P#pR*-r~-tL980m1zSS5R32tsDGe@z)I}KQJ(hg4TbLP&YUs
zpMM6b3(@)w?ztehLeiKwsQ-(jZg58`|J}joUn1%Tci8!_Jl_9(Ky3+V-QbRN{;6-H
z_kU+uQ2K#{Sr37E+LIg%%pwHW|9Jm*+z3juP;;5R|M%dTr#-QSfmsA~|0}_|!2!Jg
z6=VmrJwayO;0YT4QSkon2|61DOWoiFKI6;#zZ24&s@qRco`;m<JvTvqgrpxA&^di;
zy#IUc#oll55rvdBKG6Ec@h76baT5fU7Z5YMuOiHJ2APGWZg2zdje?|kH}LsC(6Z1I
zS{AB!|96FzwH)66T{nWvhqP6@OL3P+#}ycug+S|{NXWbPo}j#o6c=RH4X#M-e-F@l
zU<>d6E=Xmq2Ph3=sT*98+T@;&-v1rI^Hh-V=(dE0#{%#FE=cWvPtg8nEOmn`(wwXp
zX#97J_kR~ySo3)Q_X_m>@8AfEAMAC5%UwkM<^rDofz%ByNc|rdRYY8LzQi3DM`tiF
z3xd{v5G<2HbpW{h2iFaDp!N=j_kX)ykT}S#U^#f*(4~r5H*_ZAt{aYuFfa=cJpTd|
z|DgRB-v7O3g4%%~^FZr(Q0IJ)oM2!U0G<CtLRo18KK}`t&#{~z>;^i+8Fs#|1$6%<
z^!#8aaG4LuCr*-}vK~~<A<i;%2kC|GgZC)){%;2>8#%oHJH7;|hx8Rf4RN=Z4}W1`
z<|ncIx4~8ZL(dO(L@NJXv6cVO^Mf6c%6~_+^4}4u{C5N89ccOQ2=gP4_kZ_B@Bg+)
z<$s7L9)I#MF!SL&{~or6)ce2nR!~|1r8`JlA^0mOJz%DVLwgvQ`B2CI3C{mp5g7kx
z_=3Ea%W)sW91jMD2cUcas!PH70Gvmhq2vF~pz=QkO<n_3?s)&Vft44aw7?23^TFdo
zp`gB6kN1BUkX|f(05@IG`Mci#-Bi8*+rZkk9NzyOAnpIfuR(Vp!p>ub?Hg6_{_g-Q
z|3GS|g6xBoVgDz1|F;L%Ly&ZA{}fSv1g}L3Tg17bj0a;Fn0ZMY|FI-A{sTHk0yGad
zLBErM*>N8O=$thUXxKs4s(|N4?O}Zq9`FB7(D5I8r1H-RH2wqI8wJy+;r-tp=6@dV
z|IU@(|E-b6e}X}Mq&eRI?ZE58L2>E*-#HZ2*1=*w>})(9@Bc2~{m<V2?O^Bsfy8>f
z|6762>cn1#+k?+)fY@Qr3yKHt|Nm>e|J&sv%67X%L>vTx_dr0?H&Ptzzrn!F4LbjX
z#PZt`l;1hL|67~|`3;nh!0C1og8*c|TM($N0=lCGy4NjmB~ltd+8?t&hJl$IwEm5t
z{g86o6})c*d%3+|fPt9{H2y)*ERdU_?uG8pi#!OeZ@_N${vWXyWCwOP?_0sZ%#}iD
zTpCoqpxMLW{Xa5tLOla$4-d#5F7N*lptVO_IP7s?VCEz^{*A>R9`FAVA1Bm<?=b?|
z!{_}!{OyK%20rZe?7hLj%t>(nD;9fLy#GgZPN-)9?cD*{!{+@zycM*E2Zucc49uLM
z^RG#b9|7<G5sDM)89@7XK=ufE{|}c1?cc#+4+jG?2f_9~7XOHN{}10ep`HP>X9r}D
z7-(J&wB8xJJ$n`~Fmn*x|BA&P3Ge^mpuKgV{W>6fq`d!!`EICZkiub)1p_nt7c$bD
zjQ9VrmlNti=Y%tW?2+^SANmxuX9v4IyDu;>vxCOJNR1x`@BhJTQS(pGT-^C*cLoD9
zJHhimu!I|j_y1tfIqXRJC&(1E7Y>Ji7#Nt@_K*>7Jl_9<?xN<OK+xIlIP%Y~84S#9
zp!M&hh8v6b|DaOT{1cdpJOAu5U|?n?YWxGO+!65p9|T(Wh?IW<{^HI*J5Mk$vx3^c
zr20q1`+wk4)cg}L6?gvGnZUrz3abA}wMWAHf1vGzdIqHY6QGMb|Lpj|z|2DM{2MIk
zO~(6wz*W@z<9`%){@F2sftiKi`7dbpK<mpca2p>|$92xdo}PCYFfcQd8vh{kIlTXO
zg7&3>?qcTh{@)3nABDCBkm};?7Z{kCNzMNt^Lf1gcY@})K<4v#|L?eq-Tm7O7?_z!
zE&oC0vv~jS0QDC^=CgVK@2JILz5oL=6RGt-$b13s{~e$`4<Pe}y#IH|VmE)=1_ov(
zg6sdW#IK0={|-=l31q&Q_y2Yr``@+&FfcO_wf_w%e}mjF;r+iIv_2eUzLfX>_E_xh
z-}-@pnGtmV4=MQ#WWJ2||8~&*5FqpAy#KfT#bN#g24+T3`p3Hu2rYbkK<&lm{h<Bk
z?Ys^3pz~eYSsUs>XCb%!ZK!8p@&4cT6*6|!_O_v(LB#ui+tY@6(E7%<yAAcAbLHDW
zeH;%^-dVgKv{$Juc0oM@m-qj+P|$sO-v8Tt7t}MbdH-*7g_;A}|0d@Bzs(eM$A|a-
zHr)mFpgY>z;QNIv6B&^9!EM>Xz|26#__rQ({96}1{taz!@_7FTpAQH=N5uPo>qhKh
zxy6NnnE^Eafj6!|`@9-58B}WRy(=0$8B7Y2`L7mwFfk+~GcY+W0)=5K=zMez@Bgiy
z*zMVThk@xosQr%^OT#{{iFC(=Hu(HQP&`7%JCM%yV}jm`VG3H)f_Anaqk#tllMbYR
zXa*WP1C42Lc>gzF*yzZ>1M0VEcQLRz&Sm0gv}^DP^%AhE^$gIf)$$U7-n9ts$AZJL
z36x%RH+ui~1Fa{w@&2zH=>6Z96VwlZ#Ie4n2LmH`KQKr==qw%Y|GK)~|Gij2_p^Ba
z*Ddw_@AVT&eW(Wm;{@;jy5O~~p#71cGl)U^B0U%wE4=^fd<2byT7d7m&;ifwL-tZO
ze*~%BydSievia%e`3y=P42&M$|8)+6_P2R3Fxq(k*8!h@2i3b0qz1H)%!7du**`qq
z|8+p;LH+RluhR-X>)w%p2NE6(KN{^Cd~k&aC_F)abOiTn4IyjNl0kPX_`C)6J-z=M
zfcu&Yz+&E@y(KoF@&ieqjQ4*7$ea{djVJ6rfClgX2H>$qh+Yry`T@|HA0WNn{|&%)
zf&B0Nzv<;d$h|C}`3Mg0|N2kCXRO<U!UMFINCUJs9d_P1q(8j~l$Q+xLFY|-|8EA>
ze*)hB_18k|Y66eXLF*`_{^~{*2Btrt^-p;71t@KT{0I&g@L3kkpmrAM&N0wAiM+Vm
zrW?*MF#Q4Te<0O-QE0!8$NPU1XbuZUpKe1A1JfT365FH#-v67nLffMt^Fe(D9Bt7J
zJPb^~366hZhEG!{v>nRh{l5{^S7gIpUaVik!1OzVboV!YodD^-fz0p4-S%AX!@%^L
zsP!MH@!L2R+U^9I4{8gFVR!$!Hw;X_K<mFqjNe96XnT{#`+ozdFMy-3wyuYP=@)4K
z2Z`o4z}lH0^K)^xG1uuZF#RMo{rh<TZvdr#8SnoMxgdXd|8D@TrxyT)nWZKJ%S3xn
zdD;N#ld^dKZ}0@AHShloj-WK{{lCEy+P4FpcL%!XN6!0y{Yg-J+xvh0LD2qPP#fP;
zlYt4cSGXRO{@J|$*DnQ)Ie7oC2lWNHy#LpO`U2SR;bmMK!oc(sbpA7<9wIo-stP`9
z5OHRN3i=!m+I$<aXGZ9O)_*E^|JMVZe-r{rXP|L5a9Pp>x|2#DdLB_d()tKZ&>oKx
z@BjK>y=Z!Py#E`3_CKES{%-(Y=j;8yt`kxBXn^)%!sdBkW33Y2|Fyw;0lfd$?S#$`
ziFp6l>IK!4-v8@7anH%DVPRnUPU`pv=&VCf8=k}af9+dX-of18ym}1-(|1t*KLMYE
zZ)DJb-j``(k;otc8e_L;WDu}e$RGl_cSrebqauR@sLX-37trS3m_YOBpfOwM-587t
z9t=$2yWJWR83dr=F5&%O3%34Q1XRC*?pyHwuL-;V2_y!pV|t)rkEBoYEhx+y5<&Hi
zE@;iVh4+6=S5SQp6$AB+VDSvoXX5=|6C76%HF|%&|EoHJ^mzYQF|A3Ht^nVGn#jOY
z-})FdR=&jhzXrIC09Ak1`@af!Zqxg}@=Af^*8v5Y4GbZfEp`q~3_PGT3p!iSl7WFC
zk>mgW`c4PXxz!?#@(e1L3g7?La(Y;JFfi~m+B2vmYH~16v}aHO-BIPi!0-mme<j}k
zHNkVW5PLPj>-N3>D^G0L!@z*-PVfH(m7sPO_zbEp1_sADaCdO%cmDtHFpmMR{S#xs
z_par5|JMMwks$V||AmB!($SSM3=B2N>?XBdlGh478yG@8$@lBVSO(;K+$<3L>sP8U
zFnxJ3Me#og=}*y@K>AbAhulpIOMe<33{0S~2c0DYOAiv>|J7mlUxD%==nU@y@BeCG
z|3kt;3$*?NOZroXjme96|JMes9kTHLuXYp^ZV-LipuQoN^rsHa{}44gwch`g4ubS}
z|5x}~lg3_xmj2dw|5qyn$wSrqdjD5~o^7mf5_GOe{VFQOO$<04U`dB+u=P(O-v8CW
zdknq*EBHdvA;P_&v&5*A4pqVBFvP#Ar69k1|ChfDO@}44O^3_oFfe^W+5cdXz`%%Y
zJ(BnTVn?L;N&(cfT$aT!Fny9hZckYxFtA`V2ULE7@;<0M1l>VxkpQ}PuL#GPGs{>Q
zm_DN1|Bl;zB^PnKZ|NQerjMZcPk4KVH20O@IHPB23Io$e(D^SU%(2V1g4S?A>kuq+
z>}sI$AIBWK(n082B@XZZN?Sp5=BRV*>L9(K{wR<4e@#K}|8i@Q)VG4vL+04iG?Bsz
z?R<zO6Bw92fW|-IVTCOoz5mNvg5nZX|3l`UQ^DutK>IpK<8ezI7?|FJ=6^_N6Uiik
z!U$wOG@Q`eKt#?xtAge~6}<neg4RD`nR`~N_5Lphn=b{0X(wn764Lih1GSray#K3#
z^n&}iNbM&c@Biu>A#=~_E4}~Ag3p+M^d}X;>wiFIfYwTb(mGrp_<k=XSp5&OPZDGw
zV(wWHw*G~~`@do)V%{?qc}xeXAGzoO1JgUu`aisJ1qw%yJ3x8P5j-a^1KRJ%;r(Cw
zDo7j@hhRDQyk{yX+(2_J(0R|4rLeXX>Kc<pDGW^SNKF4y1k%4UC=G+|Ck3^oz-N3q
z%wvGAF;RfsNe&91LTKL{)E@@baXjAtRgluVVjw8|An9EeG$sM+)AM-$SN#bZJHeg)
z7fxVcdJ9VbB;;wyjiB@jO{-Y$s8%=%&4)bR|CK;<%CP*6c1N|sT!cFLOeFt7@2FNl
z+PkED(EGo%BIxc_#2wWNu(kUje+uG1>v_Qn2BtTl`Cr61C(`}I)(igs2epAgZC_~m
zQ7P17VE~ocpnHcw>BhQ&fe~~MF=)&Neh2Y<#2v)pds*!C=P)o>&-wq~aUO#OWSmk;
za>0BCxtdhz3dlKXGJnDM5!-r+Y_w;PT4>K8R|{dwf$|qpx<eYvod1M@={2bTi*P&A
znO?-W9qMkMh4u_wpmwa|JO%@hdq8gM*w4W1{a+>(BxkAl|NlmN1}-#rodNkDbm#I!
zdj=EG8bma`n#k&L_(6q%=@n@GAHokv;g1sb@eC%QHg%yp<bG&Nh5vsF*}-ukW2pe1
zw-&Kf`2P<o#$l<zz*OkL*Z_(jaNIC3Fob%s<tzrpO+16iMtKIVP+OF^0hf)S_yLy#
zO`!2;Nwj#92JNeo@cu8c78FK^_>=C%6MqY^`+c4Y1Jg@T`<Jla?HNocxEtFAo-R@E
z#?}GFA1uyb_hUEg2aPvM^Md2f2Am${knYF60P5>3*bi#2NX-P7A&7f|k<#W|4+f@}
zp!pB1ej_ezGJx*0DgosmP#T1$&j?Wbc>fo>2@d}nSpE?QpZx?`&#L<sq#h~FN<s4y
zO1=X1#|pJTXS4rb0t$yvO}0GH`TF5|SnLY57(w^Rm4M7avo{fJZ!O$jUr@aPs^`4_
z>(+wQqu2`xKZv~$wj9h}$0oSFI?(*%0`eQkzux~ve}e6S`%mmC*dFk?O1h%xX{~;*
zm&oS*4071h+3Y<GOwSvpDE>#p1<B<EI4&YU{)2{x1IT@#wB!9>47^Vn(*Dt@1gSv^
z19&+G^S49O|2;_I9Rm&P7?3_pvqj&6{0%i*7NiEB*^UUaVPUF)aHr@(gjw1bLFpTR
zxXtQdV0s1`|3icuuCfW5KSMS4|I_baU~rtrAYr`#>Hhi!kn+iT0n+{T3qbeRgTr+R
zD9%BCgZdwQ9}p-l!1AQ`f02nGe}MW$kT4g`1^ES<-a&m;74QEdkg^J%W<<dI(;;fK
zNzD@_NO9Csr~%FoE705tzM~iHPAzbmoZ|go_$8`4MUe8PPAkZdNb!d|UuuBv7W+Q~
z>IPU`PVoLOY>H++_{<ZiA3=5f0+4$g=Yi&Mgk#avg7>6B)q?h}t9btxdWxz>7;<JA
zIG<^O#zUn*enu`o@TZv>0Srt}K=(f)(hO2wL#fXwOEVRqu!N?U1W-7E(gnyb&@?0A
z{a+ZIFF|v%-v6~hb88~r|AoM3eu3s!z5i=I1et*pAK3Eh9FW=2vM~di4r)O9pmzI!
z<l%Nh(t(Hfe<8?OH{kQ~wLo<v7fyR1alHX#PN*guEUrVm{|niI(m2$uptG*_!0Z9#
zFYo_CnIL(H|Fl5sjY0kc&l^JZFcQw=)0QwWJp#4=5baz?1`g;Ls0yf!2a7ZB|NLuf
zs-!Et|MR<o+JZIJ;5tCe`+xe*#q$}2^k;+fy+!@p8w?I}7(nHYnDt%;#s&2ZIu<Se
z|AFoa*f5_#%=^D!s`vkN&|Tm+AZaljRAz$C%~SxD-<#(%h}Bei1c3UGpt%*qc-ho9
z3``F}=fA-FITi^FeAxS?X`uTv0zmF;)P#%;I?iJdu}ENGhR(l&=5!qv)HA4g|4;h~
zDw{!bprM*<TA=Ys@Be8}L1ugZPn!vv--OHyrd_m1U;v#t2U-`X1ad3Lji`O0sSylJ
z4?*c45uTuNRmeHBDu}S;V+^SkumXjl^;`xfNI0Z{&N>CVxmNRq9yEQ4)F<Drz~W|C
zEN(W0n3D=x7pDPrvn-@;P6f?%AiG%s5w25aFfctp8UMi+rr@x&XHY5B;$U!G#E@Z;
z09v1rTG?pV5YVUzy?Y)K#w?ibO$D8ip@JI5sf|!GK<nP1?oG|LNC3^>q=Nc1$nHfN
zOPKtHf$2VI{XaY%U~{kcf1bJe%?w<Q^FZq`xPF4%52;6`TS0LLnm5IazsWNgnC=r?
z|K|Ol#}Q;6B%et&;xW&If$2Wz{sR)mJ-9QG`jHD9_d>&VA873((+tS?E+c3?0<+^j
z#v>jKOf8L$3>?~B4D60`nJOCX8bYwmuY<-Py#I@U)&|Hx*`6K@jL<%_2xtvM1ymd~
zh6}w<O9XWP;|!>{qz40|1C-6{!N9Np$zFy=yM_qd_KJe`|15#%6$R<t17(BH!t?&m
z!|DBB{~@S6gY?yTZ+b8=Lht($x$FI(`=$5)NJS3@MwnYpdjIFX>is{w(u08!w1<Po
z`@ab2Ecpcxb46Bq|L5N7!N8b;a3f<(qg_J`9yfy5LU{k@N(J@5A^C>8u>Q$!(3}X=
zUQzJaoA-b2NbmnfpmT--Aohu_^#1?f0?G!Re*hB)-Txi|6>s(a&kZVfV15VPe;tEx
zAH$wTyM_eZ?&CWNa+mjiPH>w7H0J01KL|8O*W&%30~EeB5PSF*g4A_@*FPA7?ll4J
zL*eoM&j;TB4iVQY1?@=(jZH!I<U+*%&4Kb`p?qj~^7%se(V(~!fvT~Dh()YK8b{GU
z9TT45!oYL~HT`2>lfz*FY9}1{B;x&_1DyUr`3o|Z!l;9q2UtPp<TE+WV*=64j{BJR
zcrdUAAi|N=rO~b-1zR|R>R6E5q5WGP@Bf0X9t?~u-v0${Js6l^^A?bKOYj((psEK0
zQ;zq4L0Jz5Ce*vfAo8rB{OA2&;4f?q466A8Pdylz=6L@Xxa+~dh&nF{)-Q0>gMn#*
z_kV%CpuC0YK7pkk3`|SB{|n3ot;NA2-|E4@w8HzpK&=M@(;7q=usAf@HDnMG1{&V~
z1;O)<-v2o?L34|cI)qaZbmyJ-|G-!e2Ieo`{{<sKWd)}Ff{q>xj6UA~1uZ=o7*Y34
zg8e55%Cjln{{_K&JiPyNlzRWy0q+-t<S#B?4+duRyD)jY{|meX<z4Up0uR0ab2xhc
z5AF0|U`F3B3Q~8_gMl%@`@g_WP#*C9AN<sVf!PJqodPpG7#L%`{|ij?{?Go=`+vk<
z4+dr#Eb0nD{_y@UkO@+c2v4RDjdl$=M1&_OP0jWG|8Il$f5EAs{)+d1Ht={ZBwX1`
zLE-Abz=(clsRXE91PXue|LjY>|LcPG-&lD67Yu}o*?Rxi-Rb@R-w8A~t9btx)P<_a
z_5QCj6<mgb_f2v7dN447%;5F@{|~m06PC6Gy#EV)_5RNeinkh2czgf<2kvhmrC*Sm
zi{Ag)ML}h(_kV$--v9rB+rwyT)_VVE`{=>I*yH_QV4?T_e+$su2r{SB`#;-R4+h35
zptS1!pDh<umLtNKaYCbALje)tE93p23%n=E`#&rAJeh`C(0I+?2=D(~&^ba@@Hw53
zy|=y~cbRzqXZq>Ezz81iL2|o<_kXUrps;HImz6r8ved%+KPUM7AIRD*9nc&nY>gQ#
z>_BdSoP`C}r>zKG({RT7Kj%)6c@Vu?yr6Xr9t;dy(85E+`#+Z|#Li$)xjn`EKW8IE
z&tC~lwVXd8Y6Itj)~k8{=M06a6~UtREJSS>XdknU_kT`Js9FIOwczz?oC_gpLqL8M
z@cz&77os*e64ai7wvCYH8M;asn682D|3S2E4>Cx=`U)0_3<99`twkdP()voKxkzmp
zq_vd{pt_yI`#(2m4Fjkx0~+TC?RNw1bBpj`U;v#*$>IH<2Q+36n#<zw{?F&ysK~$r
zs@tG#W6&OcMu&L}3EuyiPkR5Chpd4FpC`ZyIy>3J`#<wW&{(_o|Nk!<5<%@i_Et1A
zK<hO?X2?M5GI>xNf(OD@B5<ZxXAT3?RnYo3cwg7jfq|pelX;n?0t3T-P<;kz_si5I
zGh6_L4R{=VUxPvOzXq4ac?}MYbqyvB^BQa#_BB{E+-p#2_}8G*DA%A->-j>j)=NsH
z*7K!at>+IY`=?&5X9AR+s8{P50cA(()p{yG*@}9#o*GcLre3Y50hDd1SL<m3Wn1di
zdOASaj(V1w3@lCz|0jUf341VhOtDB{VDM{TP(Y_aVla#@2jj!!K{Nx?70{R)yp7)I
z%)o%$P6zdyU}4f|*T68*lYybpnSlkg4j9S?t)1n7vUwWq8hD^=0nlB7P__u@{y-4h
zgR%V%1Jf1Im@Bb%N`Ul1?UaGCL3S!Y*&sVrplpzx8c;UKP8|^2gRwn>f$1`6%`x0g
zO9n=UT25#hI0)}ci&#8hV1WBKuEC(@m8V{<M{or+{J-coGcZ^>FfxGB4k!(Q`m43h
z9(uJNp0GIj0tzz^#<njEOqW4>j^ODIC9Ty;SAgsZ-z#7RPH+DjOd$Q-2tmv~WB6al
zTHf%Dh<<MPOGw=uJ{RN`(Ar;6+L&n1VCliwR>Ht^3FWLJn}q*ACNMIHz~Z)1iNOG5
ze@&)D0LXq12A0%@x&{Uh2Bx{-HXYcX3=E)kc#iWJbUYXmO+jNA9t@nSAi7~5NG;Do
zP@3{!5CGlv$<gS^zyR`lt#fdN2V?6O2Bu3f$m<LUyMg&(LtO)p2LqF2^S=fGP*_9l
zH}PPIUkb9<gMkA~H_U4g@nGOlY+z&%*?o|K1GLt_LXknBhJ$&T2ZMkK$Q>SxtpyBB
z7eQw=!s7sRkIa7P_-LaN0}Ch&3bhzmKw;q6!~nYgQo_=Kff1B$K=PrQ>^mkZfz!JT
z=>AJkndY#M0eokqMZ*98Ffqq@j4}Ex4B$0YpfK_NcL;Rm5vvCSqd`MmgNFCtmq$VV
zaoEQo<NZ(gtwk~eV@)!HNl5a|x{PE7(Amsyy#HO8SyLlj>A2|s1B(O(F7JQBcR_b#
zg2ENF-X3(nsN+5co`$*x9q)g_FB|F_47~pdKWwyTU;w!bN$zYzU4x1B0|o}~f5Hdr
z=RW|A^(<(pYp|%9{~*A60rLy*f5I2N{|Tpp-87Fu#v+0Fg$F}vule5p{~enCzp(z#
zzz90u#rvPIW=Jxdopv(=D`?(LyP2U7G;XQg%)slg5467R?_B-n|KA+;fzk+rfOa#3
zg2TN3TRa#TR2u3UY`p&oJ2uocI5f;_aPj{8LKbw!fPOOrqr*N10Z2F<<n;dk_pbN9
zgM}Up36TwT4JzLMgn1!y2i}5cP`dVDYzCd14vt4qJ_6O>76}YfK=JAQPujAkUb+$#
ze-;f43>FI*rg;Ai{yTX;1A|39LyreT!d8$OpgyYyV>9UN2(URIy`Z!JYX8;DRjz1$
z!eF95A3Q#$(P+;As_#H!<RYMa2I^nJ#!H(2gZ7C0ztO<RAOmVIPTs@7vb&Li1C;hG
z6hV8$I2tUH!S;gYrV(~6WZ(hY^O&IrYL7z0d<G7X`QCqn1wnBEDo>#1KLGh1bmtk!
z-5~dSFgAh009>!{cVyrIjq_O~Ft|)$WKgM@tz1#FN4uitu5pF;KPk`|2cYn90F@1(
z^gKD9fybhr!DMnh1IOg~3=R|R86+m!Gl)#IXHb}E&mc1~o<U<`JcG{U{R}n}?HLR_
z7~&f(6B!ghc6%^3N$4;$F!(kxC`?$)ATptuK>}2F!1DIwhmiW-BALMiRK|EP#D`ic
zFo4z&YC!T~;~NI1bExI70|OVR`~<lVRwjY;g7PCMFE-q3U})Iaz*4K>T~Vv$T~YHw
zBhONkfurV?VO}E#1It7%aDDg$YJLX;(>YL^=Ky?-=t2e)Xq(3cWadOg1`SIE1};z>
zPI$<m0J3AkLI#Nm2N`50GBSYbbcTtJ3_9RBNKXliT6Pb;`VI+DevYwpU|_0M_Y#@u
z$iM-TZ`5R9shO`_G1HNO)6$W_W1=GikEJ7nKuxo9#Y9I20nj=*kUf44EQ+9b2BlTU
zd62LK^((yp{{x*dE@0`!!05#Ae~R@2aJlIKN(UZ{4Ld+#GEtd9Wuh{J#zbXESi{2~
z8uks38ANJ2l`9%q7(nGNPeU_<L`}MrNW)16n}(MR0yQl`BHsV@9U)TP9Q{@XHlKM6
z3XLiZp!E(6zVjFqK>h*wqoIYtp<ywDi(dnag2mGR|Fv5gSbgU*D1hR)R#n5GU?qdH
z?;-|;hGYf@kXjE0whjiSGoZ0QaM}l*n`M!}-~-CH&^VC+g&!zhK=I)HPrMT3=bBnj
z9%j_={{Nq`GoFD#yNiLtVGaYR|Hom;#lQ&acg&P$V5rp$0`He@v}a(k^kiU}7|*~0
zDu*Z9GT4x*&x1^T4&>+qmCKX=GMG&M%b+vSmH{*l!q8C5U^CH{!2sN@vSqOF{_C$g
z`7eXQgjxpBx&g)swG0B2|1zjdv}F*fU-`NMR33otJo8|z>tJ9y?SedS3Mvy&!g{VU
zxUB&RYcXDMSVPLo9p3-{PVJ0E3Ts;iL|Drrg|#g-tYe{JZO>psjy_OYpS+*JWb%Fn
z&>RYA{DY&R9#ZCj+m7}izx!!U-p`-_+6N0tW1xK;llL>IfXb`-m%owxUfaXKbP80S
z!`pSpWeKQkfTb}|+jYW91_lqtT2Pw=oG!uTKd4Num#zTiQ^$D>HqHAPOhD@hKy_TB
zErSWTUY*Av0xAdVm%N6L@i*^<)B(`4`UogKJQ!>KFfg6Oxfce_JuDM4LGGzJ1Iyb}
z6#p#%m0uPO3?dc_82l^_FtAuWU{Kia$mjuDw+-r3f!a9}7#UN%|LyW^n9m>qYI8Ww
zWB5{I&s_nE*SYo#9H6x%)(#8|U^oB$UE%%L#}#B|{j=W{owf`N+MNsvpt@Us4!9l`
zsoxJidxZz24^-b+H!v{Ny1f9c=VH+3VsLky$-v_{4}7*mgTp)q4v_lU@eB;0^`I6D
z7#J)b{QqyA!ocYLZ&xVDd}x>@Slnk|tpEQapnk4_19<KCTyXnH#`*!cy(7}825z?~
zILu=ZusFuRX#OAE_ILvlueonr0X0XWKIL|W_y7MMpm{1#J?H)Z{|C!N#sm+>YEa(=
z9G9T<4r&8{;?%K;;YXuAg9cdtKG4}0k)XLF9&p@tGB7#pW5@vQ>jZ@@C=5Yi+pwQO
zrr|z=f<^NG{}wI(|9k)20ou#v&}hq`VzGdMxiOZ(05Z<WAkna&!JvMrRz=NH29uDb
zH|s2xGBASD1}MBibsDJL2c-{CI&zrzAG9YBwEiB{=8*xl85-&t40eOk9S8F=P<z4q
z|33zhIH<mF_|G5$YQr?jGf05Kw$YwJ2Gp)-jAu}=IKaRF(r5Af|9?x4|NlYzUo5>C
zn89ZJ+Z6#xgH`agv$YKjYM?q5R6kE_WZ-Ci%)p{2&%od~i9w)YKLdw;D>yzl8WuA!
zfb6t5z`zLV|A4~7Qh_1B(t$x3<R<TbJO6@cuo_T&9{|NU1A`?4gD_MboA<w+HytN2
zIDpcpMFRsfH2v~}!Wd+p_rL9PL2dO$P}}?Q?}}znn*ri~f!c;f1@Hg=EI@LgJObi-
zFjnqhU^)i63leMIhUIIpnRX2<pgsU7oEkD27(o31@BjZm>sY~hLH-Bj9Z*<!|NjQM
zrwG(G0>uS5UxVBN(gV`({r@YpO;Kr4lPO(M)2v(xYWFlcGw|qlF);b;V^C-W)j6IF
z9F1NK1`{$FSSEUc<{SUQ!yU~&#+npRy~cpUzW;MTe)eFjIMJxgzyeCMpt=`29}2b)
z*3JUCA7pl;G6M%l-9%*u7Erzfxox5+g8|5o;IL0%V8jgnZL*-f&CoWc1Ss54{rzVL
z)Ey3u$_ys@oD2-$vSk*7h{Ie40Z^U*wR^n(|9=5$CrngkFaWgy8JLcs^shi^6x61M
z*Yh=yelDo20PR}=)j<vO8aTZFe}%Q#E1LH;2!Ptx4f`5+py`hpl#c3`y{_>7|4p}H
zUxNrp9>j;rgUTL8@BiNf8}>Cwpvf_U^m_mQ`n6$SgA9m`CePyi|LaXqyB#F%{r^iO
zDBoH%FtAxH0PWfSDhbL*ATbZdat#Ki!=Srx!DS4n9i!jEz=F+x&~`nfA32Y~Lcayv
zUkcH0VPI~U&tTxNkD;S^2?GnLOmLjX*Z?Y5K;?<UJVqN(Spf=Hkh<n23=B{;F-U48
zn)ianPyfGYv<J_VgUT=-@Be=<g2wwB<}=uU<7yrQXz#p(_y50~9t@12zAOtUtU-Cg
z`~Tlm4+cgKs5*&86$T5CAM2MQ>NNei3~Ubj7@i>60iFB*n+d8vn_n_8=+FNTS|55q
ze?9}F<2;56$Gr>^pt{px9>bc38ipS4|38*`Ffc69pU=STIFCU<e?9|?<33QIh@l56
z-|GEO9JCI?rlGDu!Tay6waxz;6rkx+#`~|Eu68p6lfzyH0g!ydyapA}zNChE4H_W#
zdjGw76V!eJpHZd4U;q-cSirytYNvwA-9}r87^pn9Siryp69=`ez5oB1Ie9;W0jT~#
z#Br$$1JfbUS^#ia0g7WwhyVXU?%9ttE(9xYz~S((0hH$%!2NCT+L6DEps@*%9#A{q
z`~R;-?|&P?Yo9>k-v9p|1j#wf`~L=#$4YKAx-j^F`t#ttuEO8~sy7;07$O={7(!$<
z8F*?syhK3lZ3d=;DEFp<$^e+VKyBzo6@~zi+d$<3C~tx62blr#cS8$91Sm}Oo569$
zF`*vP)&#i$w3ZLlUYKalpyR<<;xS<fWIU09=^*IdU~nH36c(Vq<$mbe2#|d>yR|DC
zRTwxxbyIUQgGlpY$o{+fIbI@-Dhxag_Ze(Jd8^?+g8;}qpmj)~xbXhB$r5ySLc_fV
z4iF!tAJlHBsgV-#{<ldMT+h{bfyT;RKw~2y|2WQJ5NV8OhyaJjDGxnR+oa)M14{!V
zg9^xuhW`u-^{KZjb|*6MfXZ$QMFs`$e;Yw(GJ^A~ek%hLxLr^yT>)wrfZXpmk6{9+
zuLDk-t>E_09uEd^xP$sGF5drtvo_i@a5U^?5NVjp0J<ZVr)DYGT`~>z3=W`v6^IY2
z^S%Fncnhkx8|E`OG}JOUfZPDCpA|u8Mf^O{sKVgV=)&Mp-x<K*u!kW8lpekR|6AH<
z&){OI32p<)fYgBe>M)nV#QXohPKez9{~&WgX?CJLgA1sf0-L*lfeB;>xW51YF9wu`
zJs68R7?}2h+Chl53ykpbOdZhJ1}J@4Bry7b{11u~?|)pN{dAR%O-vHr|36M8rw>Cx
zU(1C|`$EXn=R>Bx0CMz!>bZtJ3=ZJ7(g6krP&<60EkgvT%(9kcaPj{C&at_cA)=;I
zx}teD0|RKyz2iIv2T-2z{_AL1KT85MRtFy2Y1qxcQ2*k0MZ>)Y9&kOTa=N0P{cr_n
zY|gqG)aG~(T1yC8k04<E|NsBVe;GU`+cG#n`;j7(=Q5Z;`;``;am0zX3_9L_9nOOL
zRJ9B;pgtuijZKbaPyqESC(mU7m9?O;RM0rCh6iJT1OwAv2ju%nL3wrpBZJO<MFt*F
z9S=%VH9L{YgvAUZ&CSp<VK1aiXij1B0NDdB8xDLD0hJZ?DYr!GTOL<<|68XBEf*L-
ze0aG~D<xuG&EVqwZyh73Y-p%w@&M%-P<djg{QrNwr=&nly_ASWGJ}ivU;Cem$_(nY
znw|o+nim3Ut-LE5?U}&i7>@fG6hLJL$bOLd^{S^UEFLg0g8CBP|JE)Ammz7lD`0XU
zbv3^%0=)mN?F8A`T+g6@WY0wHW(IYKy$l8oj0`$8RW|}^YNf#b0GSIa+d%nqw;}_m
z9m8m$$e`i<Z>@u6B7=qpW8MV@rrlp)Z8>P!3LlRLg(E1RHl#2()PvSn{JjjCBd)Zl
zXK-;?#K6%opUK7huU&1UT>}qh`JLAR(r3{E3X4lSK;@p}JcbBpIp?6?%D@O}x5DmB
z28|tByD+$b%7%L9%b>DRrDm^o1;`EFf9=*n{Wu47XJ|tTgN?-kCI*n%9t^%u8dV_S
z>M)mq2eejlq6(7-R1DO=;Q`kvDoh@rvd)8nA*8vU$pd7E_g}kEi{$?|>Ss$hIL>8o
zfW;4}KRJ0nlLxp=Z+;ApH&A&8(hmwtP@GS+XY$zX$iM+E-~azD0gX#~Fy^)}Fzo`>
zjo`8#6rL6dOg^CU9+WP@<vq%{2dgN^ZJ<7)V-sjC$(y<4j9*M7bKGO1J%a-|_BF;e
zfZB966YZH?K<=Ljsyh@I7(ihHs>8waYViyP6YUuwdE6e9$8BC(Dllk(#!oDg88kuT
zC!ld&P`<|;L&@;~wc|m!Ci7oGt+G@FXif;kXJFcibG;!b4T91uD6KZsHAr|c=CCj@
z?L@h6(UyUM(N_8YH_(1_SepgZeyQ(tZ~*D8$&#)B=?AqTLH!X>9}dwE``=-!{QrZc
zCIh#2Cj$paO`}}{cn-!^6C&=xz+jV;`Tv7{=l_2W^T6{W3LXp$I#4mt{&LV<38+ky
z0JXIo=P-ch2OBjR9BZ<?L_mJ<V9W-M(f<IAyG&pNm8t(78yFdQEEE~Q<N4lyRYBv*
z$nu~$CnR|#P#7W0GotEO0<Fylw=E|$GH`(W@BRPZU66kp8o_BAJZI(oR|V9MLRYsH
zQ=K9<b-h^B?O<Tqj<Vkn)SpF;2T&Y<!oM-DL8sA+fdLdo4s#ha8si!aK>YgV0MNJ%
zN3E7bKx15kNkbL`Lrta>XzW$T()lxsO~Snc+FcCH3CRpB4tp6SEImJSz{DK(GH}>r
z-T>7j0v?Q+p#4M0VU&v+M#@*FDE>#5_eGTl-^qn6uZt!R+M9(IcK<ms!$cW=rWR6M
zJj7I|P{P2p4Yb}GY$m8|!5VIM4Hlqr=lW(3&^(a}xcvP8Zz9M%P#K1jp8qO9=Rz{>
zFfeT+c-~B7T!T%c7I=IN)XzEr%DWBs8XP8SLFS)9{RLZv|34b#8eD3UJpyVTGh6_b
z54CO{dbM6wBDHRyd21*eF*p4Lbk0>{T!RnDjo>-XxP|~wIXlslfu%97A!H(GTqCX_
z0yL)47}pRp(UU=-F|HwDq9+4rK0T!|t|0@eF9)ip0IH`1s;2^~rv~JIkUmhJ_Wpmb
z0g~U+?=UcJ1^FM*UPW4K2ns_`x&+OcfYPS-|KF*gKA!jge-}Zt2Lo$v^S=fSaQkWj
zgD*(T`>%zd4QM^`-~WcT3Jl<RW6=7l3H1z)6YUvXL1hDI{K|uY@dK!Sw`pPE@nGPZ
z3F?zM?gRI!9W5RH&$4*Hz}9fDp`qp_^D<ja2IiTd`D_O;%?O(Jnd!;EWXZ|EI@6PZ
z+0x<vftj8REFkfkX94SKUIea#&gXowbol?Jp{~JWrY8fprGf#&MtcSgO9ut;nt_e+
z3_2U_8I<Z*#T9_guBl(yRuJkXVKLL5fhm0D@w!^g;EI{{pgoQEavSOzQoR4)y9shL
z*uM)Ic)b5+sxDLnjR6RN#sGY*A20}5gT~YrzpenKInWr3_uov=o@|anEe1x%MGO*+
zaSaxsnhaK!nhYkO^aI)hsXw1V#ri)3i^IJCCqR4U8tob^Kz;$mtp@{hE2zEc{r~4%
z?|-)+g2K-G|4-1|e2e$rQ-8tXHjiOJ!@PzL@4se|Ail#sh6xr4%qOfLF#PlW|GO9D
zUhlsOtQHBNH9x;=A$<9-P<}3y{}jrPh4QaL`Mwqn4EElC<&Q%7wov|7C|?)KUkV*F
zK4X!<e8BtvZ&8Z|1_kfG^1UGUL)u-bDGW@TajwGvr8Q7GYyQ{3u+W}?$x_qrf2byl
zopvV!kK<g%5YU?0P)z}=S}hN~TF)R6P`>kPU;)j2F@WO9RzbltQPVkKqCEqTr2><{
zMtcS}O9ckznf46apz#*ad4LP%GjJ`~&miT&z_Jz87YC(n$9bT0R~SHMFnKVrfbLpn
z1I4ok1IyeQ^$hHwII>ju-v&w-9t;d34RsA1FuwQSFQT3H3{0SYBWSIN<2;5XiID!}
zf{uCywvPD>><jiY$ayfZM9!!Oxr3nsO}r3vhOGw!LjsyO=<YNQ(0XHJ@s9f-Ggv_P
zco-myFSyUZ<-x$x>%qVvfh^u|A2jC9au-w{f!q&rW2h#0jz<O3XH5o`_a8uYE@(Ux
zG;SG^EMNty8!eJSdp3Ve%*p)!U%&JJ2ZwnKm}8ayZe0MCU!c5?I)-^?3Io$dP<;(H
z8)vy4*TAq)3lx5S91i;!dOEon*!4RYK<mpYYCVH1I=vX!3OyJ&!259>7&vBnGO&a4
z#!OEJHc;O0^kiTw^kU!w)t8_>KA`zwY-&Qi*sY*yG%Ot$Sdi6#%-iV6zyuoG0__2w
zsl~tyDIb&eFfeT>nWFd`-mcxhkOkb=n!v~cnmd87Pio%R0Gc;+v}ySN0n|tF{wsMD
z)IZRl&-}+Ck%6PuUQ!R5$M1mFVl~D!$V^mZ@Bp_N9T{RKDl!y+`-O^(0uvP(_jv!m
z_0TerMZ$wI$%KJv{RiZ}3fB5Bu0a7>M}h8YwgA;pjdBetpfU!w#tu|Rf$AqvTB!B#
z(5rP02tZmZ^#S7N#1jlm>p^1}@Np+ld63Z3zyKS20*ym~(g`TPg60rGdA8B60n}De
zsqd6n7m_Jp1uCcNvq0lSH#b@&FyHY0|DCnCg~8nWuXL?N0`nE`|KGlbFJZIu{wtkp
zk-&V_`~SD6HM3u=^ZqLxt3Q{4AJivwnD_q%MDMqgpgy7ZUuj2+1m>Ii^TA`I0^a|>
zZ3LA)pm_8C|81#71Gq1!0vdw?^-n-`srO%L9tNg$p!sit>97-=4#D#<;Q0Yio!ODa
zzzi}6Qg8l)ju|F^`Z{3qu;-btv7j(c)cpSe)E)ul4bVCzP(DG;BmZ+S#csxgbUJ8+
zBsa*_Doa;{w79OTNmi}^^#Q#9rmhJ|ZnFciLz0hyX;?pU@<Rrhn*G|~{-gK*{|7<!
zkHta;4)4E7iXDjz9FTrmJSZK3;}uQ)L?rcr3lQo-XUKrlKBzAT>X(B1a`%lvbAYkn
zaj_+@E5e_$*@4Eypy4Fp{Wl484lgc!stA27==wnC8)I?bzmG`n69lbGh583{h6WCM
z{_Ta?Q~&gL1)BTrz{XMbFJzDb?V|wI1EBT}XgtOHZ{k|8eGC5o2h{`Kf0H2mg|PKO
ziM<V=wW`p1-urJ-FX&t?&>A#QJ>a;HK?GFaJ1k=03DsmUtI1@z0IC1tGC*+$x4V%+
z0u)CedqH^&Vt2yDg^COu`kml5#h>OT@Z2s>O{{Q*_usE~8*LdFCe$#9bjCAyHgYnE
zblNj`gnBvX)oKM-Sb8xSgnF^q)!GM%)W!#_>(pdm4ApedtM&A*uz1P97xJ9Nt~TCE
zq~^cHx=t_98V(1&npeRfIRWq?Xi#~O97qkwT&TRzM$l%D=PY(L_pL-MH5tS}^>U{h
z10z_StAk#r8v|3QSA$&5s^E%Rck7ByHwNZVuL32I{+j<@A`?9rSUTMq7;Ei4)`hw`
z=yke7)t?HksP*!$=u~H54%IAB0=adf1~|QHcreDAbSg7Qb~-aibUbEY0Q*JDOQcrW
zOGLk&A+*zzL9mmPK>*~=T8|)+PEH1qP%jT1hj|PR9gi6p_1hU%Im}})0qw5_&9P5N
z1&1Z$L^sIzdZ#9XXssrD2{_K?F!0nQ2Z?z9|33j#c0uC_e9jmsFIz15|9}5N1|3kj
z2by03l{FI;86+kuGKfr6WDuCB$iOpEk%42QB7@8XMg|-2zX_F~d=FA*v5-N+`)_<C
z=o~U|x@ckmjUh64FfgiwYBGT5Qff6BE?6{x&5;1j4~1m1*JyV#usG~v;IUO$06MG1
z0MuRqt^Wj>Q{U|2;J62}jtQg>bl#r#-?*=hiVPy4GzW4Qhz<7JzW-A|^|#}`|2<H(
z0wA|}|BX8e<}ZM(Pw@U5f3#sCc+ML<my@uRfzkVK{6^3jTMdx3%42a5v?lytE~uU9
zIPbqrLn8xtO<n`ok2;+ob3tj@Vj+W!_un|yg^CO^(6kJ;6Es)g{r@kc_y0dX!C`~2
z+p}RI16U2nP2PXwEurm33lGL<0|us*DCcB>&bGr^585@bG}JXPELh2)w4jqg!(!?G
zf8Kvz6@toHP<ak2$3f+k_rFUL3`{FP=Olv54^aCgBblK=yP1I>RMx@9tw3YNpn48e
z$2IS3U~!xa-V?_GY9rNpN}!xi-29h8CHz0D258?Bh@JhPgCYF?`hOk_j2a+5X#XFG
z4*$>oFZ(}e&Vf+?!e=W2?WqE>v;Q+VcrY-00kMn!GdLRB|NmeA@+au*{wH9uR}7Bz
z4;a+K|I7dLU|_fa5)1#&X5hiVa0JB8{?E`5{{K8kZVQMX{-3?dgMncMh@JhPfhGL^
zcaYo+5Wn~(NbRbBj!g_4AoqaW<-x#E1Dfju&C3;PfzKMq3AG3Lfgz<amO%w9?#a*)
z>d6XO)6oQ8kKzHE4+7=8(D>^h^DRJX3!&;9n;1ku=@1l_j`Ki!G9mjjL3~huFf*RP
zA^iXKf8PHt)h@JUPy)?ig67ge;~N`l8I&4h8BCyiD<J2E*fN-SFh<HSFfB*fCufn&
zPykvV3o6s0@uvfdPf+}U>_Uq}p3yj@ejI}Kw1C!Jg6dT7f9EeE?PYNRjT?f}fx|q8
z6wsa`?|(NyXDWcsasusT0i9jN>@bhP10)Aa_ul`mvd(@CK6B6jB<}t179&Wmrt_zO
z_rFV^^Q<9zHUHg?G>rfMzozS_0BHUmDa}Ck<ABpl*b4@xC7?M;aN7-(=dqO`pf&dk
z>KP2Y|7!>$?dw6>PaU>|foVwxp*A_x93$`l>L+oS6T`r?1T?3E*FE0<H6lT45iK2l
zg2!zdIT=hgWHK1kas^mS^aSOFFcAi(#h|qjgv=4dVvZ5QoX|52Op8Hn<qM$xAUJ#y
z8DyY&$pjR)pu7Z&Ur>JX{&)6m^Fjv5o$PbL>kw9e_nyvW0L{tEcrY;D(Vxozir)wN
zb3u1<F@|_BFe3KkX@JiGvGM+Q?JZ~y1k|?k{&&T)c`*Y+{YrL|@V#vRYL)d0YLXv`
zc>g=U7u2t*)qG)4t0e*2hnL~~?;7}gb%?&pxr^cY*zIbS)nNJzLH*vE<aY)I8Q^l)
z1Z8hm6N8QSzw0YOXA3~h+1cF8z);`GZW2BRVt@VK2L?6Cw?J;N1esO80%SkK8}EPD
z3q2SZ0x-?HaT4L5%bD2ybM7tNKN?{3W_bU*F%hBf(p>ERIhP3bOD4!K4B#_WKzReY
zN7umn-zC_clpNmwE`jX;?IjBJV*6LC6<`2rL)LnDfX=eh@cwrRcGoaStuE*s_l3@&
zbFbL#YBj?QK<yQfe;u0`c%b7N9I){Nq%>`SI2$3jhJk4z=$;I$V~R*=2(jnw-|3a0
zasrfJK<jWoZ5(~bnXI5P0krNr0pvgLe;0cZVRHqvUk_R)Tm+y035mO_p#5*qGT~w@
zLj85HKfV8*RRx`;YXLgT|KC~34fPB<NdAD76`-@p7=v~&Ff9P}^GNW=sfWb*;{xpb
zR}Sxgm%oDcVL<$MVJ*VFS3&z6q5il4-WLn;-?c(eU&Z_1nOKBB&IE3#XE4C-kH8NM
zO!MLW9dMpT8so(tAEzXV^T&DE`L`f{=py`a{wcyAS3u`VL;Z37EJFP1N{ByBPeu6S
zbmxY81|uB)&|qMi4_X@p?jM5vfqgF}Vqg5flYt<AK+_cF`GWt>Uj()1Az^<BG^Pfc
zrv{Z(pgIXu7sWur{QOFUy7Qc%^93i`gX<*7`GWt>gU<<om~%PN``@X9puJM?^9BE%
z&qV0I0y_Wl0cb1}+NMD}M>N2LfoUG-o*Y8y4#}S<(Dwf``~a81ov<>P8MJ<w$#EXz
z27U0oh)fk849qt0G7C}$r+ELnn2Cs=bKvu@!D}J@odTbo0$LjlI=?zm6Wm7S2-RfU
z06O~x)IXYN%fJ9CSF}4B<Q?ZSJ*dg@F#v50cW7d|0-84lovG;k?;<C{{Idr^@eeWo
z<U~*zgU|epwhRoQvPrv>f!}d1Q$tObAI$s`nE7!3K+Y5b`R6K<ec-byp!Ss#vJcHa
z0!aR0f!XK%54qeq1HS(fV*ZJPgv>|v590=ee;Aj*%*XW4C8TohEco6|sC}SyOe*-o
z57j@64ha7+n!xPy{&z_f5ng8$5%F{UBWeC&c!2N^13doG{FC7Q?+kdaJ|vHwaRsFx
zQ2P*M7pPx=HJvFlFf=NI*Uig2&Sj`*jAdY`^@61}h771*?s)$@od|M2#O%|dptM8C
z?2XC{44}LXNn;E$3&Cc?(iv!t1$ZCc9qi?kPX`0jEYO@L3HkO2`216(dXLO}dv+rt
z-cJ1m`5Tfhj)Cr1#+NSSVd(-CHjeYq^X>otkbHYK5XpSddbJ9O`A2Vp;tEf?<A<el
zsQGC57GgeHx=8W<cTN_`KJZx$Q2X{0un*loX!#ampZCABdlBZJ1h)&I=5rD-AI(4L
z`4(b67XKjI7mJ9WBX0@Vhvpyjd<(J9``<aFcFqa#UE>h{909jgiH{%jd<!uj%|8j=
z|4tyzZT@$nmxz2TKM|U5A?W~Hz6INL$NS%LaJvAKZ;#I<BH!}E@-5VCEcq5<Huik$
zae;wp+8)?AI&tla13z)JD>|U=u0+)Lr$Bduz}gj{dKlEM0JUd1y#E~!M5sHqaiub7
zEfKg~0Xj1ZByWh2Kh5d=?@%V_js?`V#c^JQnlqu^|Nq~?-L`Ol!@x8Z)c+-+e|LZv
z<X5CJ3hhjB#t>**y#vy=V7P(xT%La?LFXVTc>g=e3OX|tEls(2|2qXfO9v8u$1Fj8
zG4Fo|ctQCTJO=;o;K7F33=H5o^?!dr>+vce;)g-!R$TD@ck(4@o)*nq9`Apr9lihm
zU*Y}lG&r9_%s=W1F@Ha}y$vzvAnyXW`TzEU)+|8858VabHG*R9A_f!he@CZ+@-fuB
zPLMmj|Lu<jo$uQ)hXFJf$l(3&_gm;WCkEdCj$A~jKLT$5d;i<73sS#e4g&-D?3I82
zTtVlbAf;2JewCXF1Je{x`<I0JWgocxizn_td+I>#-3Dmff$q!3JhT1ZaZnpx!TaBF
zPmHht_nl9`?zrIa{&xg?HWDQ44)B7)qGLY;xA(ta4-sK{5HxPH!~5R}Q|xheve*0n
z{|(;%PPQV#>@c`r3^8|qA}Gut=Kd8#G8c3X8~AKXP+J__A6~?u<Nfb2`1~74Tphj(
z(g#03{@*W8XdG#H|2qt>YoO{BLFzzfp+n;4&q}noLFy~I^e`|@0_{0M<SR$`IWIWI
zP4;X>8#ieIx7p$2CQK(F<0gzYkZ}_x0S^Wy#JM<-HoJ%SzoSUwABP#6lNlK5YuQc0
ztJ(h5@6{`)-}?wWKJWc+Un69!;f4Vyyg=h8p!1<YXZ(2oI|^#5Bkp^Ln4RMN@7PpO
zK7oYCp{32v3=H)#>?Yw+Z2#)#fXu#NP(SCE2&Asrr&zyI0(@R7s7}K+UI0>8)AFLi
z```Yj9t?~xy#F0DMVNnZ<6^k^>~{5Y)C%hNBAdTAw<hz21!&$0RL+C#n1?zhQIqnb
z0@NP?+2g^$a0MmLHZi1l|2u99%BK+j9K4D<toDNU%-3q(0QIR=YBeDK0{h7eJm$g?
z>cwC)F`hvMlpbqZJV5iII^O?|A@w&7JX{Qq3wFEuy&(U<;$qK2&^Z9Lo;M6?vOFw6
zb9SJ$3844@je94e*-?|?0WRx6=Ye|v+vn@Sz_13*Zz10Q4zeQh%7LGtHgc#I+doL0
z2N;0c$r=HcU^_r#IcRo(<vl$rK<z;f1_mGRe+R(re@Ivz5M3w>X&Z-XvD?AStmX2+
zYF;g;M+GQsKy5$lWtn3L15-a}EhZwrAdNGE{UP`N188glb*yn`BWRu#RGwLS{{I77
z@940X!J^?IgFvXJgvEmW3`(GVX$$5vXoNgBFlwl45U6?SUD5E6fyZL$|G%~B))n4=
zFQj_^+aU|ed-{;^O2~PU@O;O-0h;foK=a)a4+dt$8D5aQVd4Gn5ajHve>=f_W>7lt
z{<m8eG+qb_A8;Pid;lJ&1cf>HJg|R<z-?#me>=hH5Ta+-)bKg%cHs2j^}rz1g~hI>
zL&6etZoLNsBYGO{@cwrga>vuZ9Unn?2b9)9dENWpu7&k`A$c1#HVMujpm>I?MM8|(
zf#;SP*g$)e^g9{YL2IA%I~iC(=F~4yu5j4Lv;nk+2*d~FRnXcB5W9YfQib=wJ-QwY
zOcT8S9Rio}-v4&wBHX}k=lyTzNst>r{taKkVpr2CVTmozfX*<}2i^5Kk3mMi3+x6E
z&05nU4YD6Jmn8to%b+=>nieT=U&Die5%oN-CI(PgfX@{3{<j@G-UJEHoikx^0CGpI
z<^xE1r$Nvy3Q)JG=yx%&g3PK_0fh(S0`LF-!RLZN^7+3%5ILm^@BjZkc>g=}5R_iM
z|7}kMl`SAS?|(ZE!r~MZkF~IPg@p$Pv<%^3u$d^&pwh_5z@gs(juRRE4rq9EFhIit
zbRQanKut;j=uAxxaCj_!T>&Wzc7e_kWI!tm8odAQ0gwNB|J!yJl&?dQVda2?K`p*A
zz>$Fi8ZRhe;joWk4(QCdnoMty8zdlX4-lIN!uEod8ztWVc7y9$?|<6@Lz1Cog_eW?
zs2v~b&SF>d!ULSP!Rdn7aCqrm0a`x;S{qrb2@QvrUKO~@7n>gpOkJRL&WQ4bV12w*
z6;vjG$`)w3Z~(PFW(MsA1&yJVK+6Re4+bXKJy<-@GqgRt|Ls!+r2|O0xw{Z|9kcBt
zsGI=RG2pU7O9EV$dN6>_6WIF@VaBeRuzCcw4%rq9Dl@_}+3jjQJ;3!8sBQ$+RUQnC
z4QOd1#rxmBlc2l`ao4V!`0Mg*p`h{uRE~h$297JVas*K(>;Ro{`^5X-zD$JqJD=jJ
z%Ry(OgY<g;+d3E2UI5vHZhrj|Ddc+m0;XT~=OTp<FYYkj+6xO~a9Kd09<Nma<>~(h
z-v9Q4`yG(5+9`=W{I}di4u5diL*o$aAGG?lRz(V_4&T=4!N34MzZ~37h14k_-v4$w
zg31!8y{6>V;qbf|;Qen0c&q_p-i|<!dqLw{p_-610~+4~yBky{$TO&b-HntdYc+!^
zK;;wed}i6hz|;;}D~QNvNcA|V{>Gdy+_;xI{mEUR`5y)Ef4e~E52Bwl>*D=y_f14t
zZhr|%o8JF6g2!PXW%TAkM1S%<_?`!d_*PIK=YsdY-JpJ@0$SSR@&32xBcwmM2VBlU
z!gkwNsQKV=7>GHW_9FU|9}(xb{@Vgtqg#MtF1SCr-4)5bmZ0?Q{cj^LsDB9RLxIX!
z?|<)pLi;KP-v742?!V*k{<jT0F6{kp!(EViP~QmBXZcu*)@MQLPnut0U}`-ATZ;xB
z_rN|cgf!2vfssJm5!s*I2|8m<!TaA1(ELAYSb+PJyJQhzu}v2g7LYLAxEB-_pnjS6
zzqjCfJ|N<or+P3j?C}1#6V$K75@)+@A^pkSusanwy#H+l-{%R@zflkrW)O2ffbT$n
zh;IVTC1UAMZbcgZ+S&`!hv-kf4TZ*$hWEcMcM<;BauK8s(Vu+(5G`(y`jcih3`{Mc
zb27o}&%klBkU<AJ50Cwx)qm?!LF>Z6^;ai&9v<zURmK+RI1O@N9~SnAdoKTN0pD8+
zTJz=oZ#(D?w*v2fTflP-P%&4e@f&1)u)ewosN4bHJ^pVq%>N)UP`+}2rhAw^1@C`b
ze4$|^;{9*uRPTT5Z-Ul#LHZz@A!p5k?r#0Jv(o$D`plKF(0fL;B(HfeFo5qpLAob4
z#{1u9@c1{xt(!kK9A;o>*vr6Rk;uRU>PvY4`&|g?L+FF%#^y1A+LYisRzYnGP#poj
zf7R2&0@RNLoqG!H4|#b1+boE1=Vn%rJ3!-gwOXFnv_bc$&Sek)=}+|H0HtjKP`l64
z;rl=E+KPAv6|^!G=}uFV5C*0u8<c!V=<efxYbw$5A$nYc)?0zbbvmHqItRda%G)!5
z&aUSGkBflri~qL?HYUa6{ckI1{?o$y-zL~N97qfl|FE(Zrcc59-zHf4=kflxt<d}5
z+FEFupX2>+BdlBm$%TT_0W{8G`X#*oZ35p(532jT|7~CB{r~>~?|&ONLc^EG```9n
z?|*AGLHPr;{{clm=q|v2o4{vdL-cQW+6fvrh1@?c<Na?Vc>EhGcM>Fr7WPQ_%;*LK
zQv+y?Gh$4QVA!wvOCan)XY7K)z6ToipfNR2IztQljiCttZvF@gC+~k7)*^|4#vN-=
z{NBW%;{9(UtZd}*{<r0;_rEoaHOcHH(C}a3{ci)3|F>KPnTuwIg!jJ<u(}ZxM~dG6
z|L^hsw*hvaBS?(b``_x7AakK{09)SziNi%8cWi)-fAV<$Tb~FDXV6+&Xns-f{<j|7
zFM`CwdPkT%?zk}YVPL8UjS0ZlFoEXBk=JK|_9uYa6QFfRjd2YOja&>Spu3VMYB892
zFd7OlFx7+hvXQVpV5K1_E}`oK6rklJDE>fePE;Un-vmm-(De(OTS5I{i1?P5AUA;A
z2wIDd>K20*2BtdDc}XO=WyMm$ZrKPrs}SmzO`y6Hbj~v<9mL{xi~bJ=rds&Ae{fww
zaNWcT@cIw@;j$5Q{{_q~pt1w%md&91WErrBi+&CRQ!QvOCkf%Q9JIDx0KZ!{fR?XA
z-Lml^B91n@;tm(R2MkO#p#8g~xCPw)A>bC!{U0#5fYJ^$TsG~*<CYKxrW(-RXA<19
ztdwwiSr2N%Lfx_fly+cl(Z%f+-4hH<)u1ww1h*`GNrYQK^FJ`RfYJ`sEgKi&aSNzk
zd;mH-4YVF{e<OncXzl&PMg|_xdS1{zB=5fyf9f$aFo4>Kpfk^8?HPDLcW*UxGO$3;
zSJKgM0iU@88K?g9*A%jLoq-2*c8B->|7SpJ)<I)Up#2+-jSQeO9TXtvp6P69XklRS
z{yX6V15*`fT_k+1IQVQW&>j%jdF9YEq(N)eLFYJu$|%se%-;W3-i4fVz)%7@LlwNQ
zB!PjcW|?+{_y1LQL1#jF|6jckblw)4+`)!<4FcZ(S5JkVxdl4U1gdXo!@LFw@BgbS
zLFa0r>FaEm*P!72e|0RV4GWU<{=bqDwAT;pPe$!03`~`vJ=$=;Ag^}^*FT`K*8~Pe
zB!BRL&Vcp)zfutD7lQ`aIbr`AR6ut`HOe(;fWoBFu0aR1XWje%D#nI+4JO|IS6xN8
zV?`yBJ7O4^Dr1n($|S-aED(3B0IjzIof{VeItLzPZ^OR^8<1bY?nq!@hPuPS`~S*H
z@Oj7oSNS&VYw&3J*WiP$&f)+AQ)661fcO8Ez76vlLcIU4Qbf3U`B8+MwN@}NRp7io
z6-U@bG~8<t@&3R3Dm3g|8um5BfZWh<uOR_+pLWAP(B9$|7aQg^WO)ByxwK(lLr%lJ
zh61pfe+?-hHQxVMY;2g<P~!c6Wh;`~G?CoK!@yJlI?J7ucm<tj19BVe{I?wq`x<JX
z;n@JPA1ypvy#KGz1n)Kezv6GhzJ{KLe+?7B;V0Li0akC<paV`1aSbir|Cj%5nAb4H
z`~QlI4gVVEfXzApKEGQBtTwKp1*EoNU&9RV|I0!CU*P?J1<3zPK=Kv|46NS&m+x%Y
z*RZ1DUc(xYSi`@D4Uq6yzOZ3l!xr!VD@qaJu}l&X9vXibn9BZ;n7%|H>1!G6%;q%>
z_Zs#f+uN|OVTbqs<*E(y8V-2>U;eXUUjwpRc^mdM9BH`Ma006548*O=zBbHjxZwSN
z`N@WR4L2J8HQWKq?`yaMmA~3Bui=6B|K%%D&0Ds&VP8W8NG&4oF9WH0(r~Y#0we~K
z^ZvhVDk2P)iXy^59keDKoE|`V3zR-V`}e&6{0Ie|>*f7-e=jsm@__f{{Q15TN$(y8
zrc%(lhyYO83vM?!GR%PXLAQX$JHTzR)Y~9;Fha{a8A$jo0rvqw`(8a5Ch9`Z(2MZ?
zb8n{gLxzZu%oaOPd9B?k%mgZvz-#{JHM|I)!(!*bpyjAPM`AH(FR%U_i6sv67-T?d
z8s;^80MAQ2{$0^9ui*{2j-S`?1tjPF=R0T~S)gHF!w=B<01pPuzYT{Nc<dV(_><>2
zfzCVs1KI-!Qd@KE@wA#K;R+81&6^;;_y2znL4F5~n?TarQqVpmiH3QN;4@ommOh^5
z!JxSos&*@yT3JwEvSD5$3rIdxmBR+Az81vy{{OEPRsE8;;P_qg8Wd)%-v5`}ZP?cc
zIfD(H)|Z@Zv|?arnAgYy(%-O>fhA;Vs+|XerY?x@{r{gSnt5|Ucin-+y#FtjwM=B#
z07?fQjH>XnjbQszLHoJA|Noi_G3OU6g#Kv=p?|~ZqY(a|v!MM_AU5iL)xTdDm`Zk_
z<SEd32e3L2dcGv6jt1>Tg{BGcek||5oohk+<{RcUuz3INTnIh0P)C10cy9oR2DP~Z
zKzpV^<HI07fzF?r{1Ut#Mg_D-8&pSw#xT*;fbRzY?e*LZIm1N)yua)Ja`4&29*im<
z7??^x`-H&x0F;hF<r^qJK-01eC|`in@=|cTz|yjS_y0wTjdl$Rjd2Yspfxs)at$&d
zy$$~$=Ujs7Wl;I${eQ72=uAZK|BGKX>}vp*ZIHCI2vkNIG~8=20p-(%e+?Fp{J!WZ
z=nfO_|BH7v{A=)NxYqzaSFT}S1L(|F7VrOyjyB9|@bUh?cqW>8YeDe~GRyn_LfwXW
z4FRA!8ssKWS>XMDVPV6*hLDDP4G|#sg4Cg&(YYwMVO~Rw_y5I?4f`4rK<bdxFoD`G
z-v1YQHp~OnM~h_}_BCXnsezv7xd>GL<#_*J^b?du5a)F+%ml>)%#A2}ZvQW+VPGmk
z?Gr)IG6c2bz~O)36X<M(67Rnqs^IdauA##FZwI8WU)NCM{kMa+`CkKQ{sr9LbJ)kg
z(Y&vr0D6z6M#H>@22g$gogM1IAP8>ff$lZ{xv^nhgAVu}gn11GAoqFy`K$|S2ZGML
zY6git{tZ5N40QGt>i+SzFW~jfpfLtz1{To1P|&zMX#5B?CpDp&fnh>31It7e28M|$
zaCz`qBw%qDh}?uuh#W{iap%A%OkrRu1g+IVq}v1r2b6S+e5Tglod-eggqG(W-v1YR
zl6uA!=xkEZnVO*WV-uj~fP>5gooxj=n{r}2gN65>Pm(p6d<C_dj8i~oS%J={notk9
zw*WNP0y@(QG<Jr1Hn?IzqcQ^z=-dU+nYf^SHfUcfC{Kg-iZ&)Qm{@}DieLcW7r{`Q
z84Wvc+NP0{L7=|X0elW$Evs`yBPWAQeFK!w0Ol*y_dxkP&K1yeagTt^0Obo%JT)>i
z=s3<}2xxf8AOboUXF?|fM=ghy2<Y7AS}!LN{VoOp$GHpw4KEoq^xMJbP{Q1*Ghroz
zK+Q2HkqMj(G7~!)6rkp>X;fw~s5xN(TF(bMZ%AOmVg{KBhZz(=@jEe@!JyHZ!2q<T
z1AL~976WKZfze^#|2vIZ3@o7YdO_=IL1hOhJS-M4cv&1^;6R+u9Q%iXDIc_F1AGQK
zsLZldU|`+*5WW{HrDhuB9C@n+3=CEc3<_3>3>;RVbH)#R5^4I^z|dURz|tJoz|m~i
zz%!wofuVU`gGjSn1Lz!AiHX(>3=^#wKxg2%O|%5lEE6pl7$(eNVDSF)erZDui2h*M
z{I5Z#d0zwQ>~{vx_>%Yk|A7tL!F#A-XH+v-JYZn9WME*nRABJ3bYS4{{udwH^shmp
z@h<~|l>!4pqXh#){X`E?{8d;nFfcS)GBDIn0P_=S4Lz^b8hDA+cUCZf&aj)+2s*2T
zL7*`Pw5Ho*-AqRYj)wgV40UO<D;lc7=Ug*3%wk}uRfU}QT~i<>0y^`%W}=cv$Wjg)
zD*@2C=drQg|NqaiG6b*HZt?yXU1;h2|Gze9y}?|D7maoeDxkXyYCQu`_U_g_*<De0
zcyopKpLa{W|NqPM{=ZZdv=7{afsx1i|G!A@|4Ugx<)a4!!=FZb1_sc)I%usq=sZ!-
zUJ!@9|3Q0nLF0T3rk?-*J2o)zOpFJe6a4STr2Sy}14thzJv#3D_XMn;^Z$R4eo#5m
zXv4rTQI>&WqC5jbou}hE@BjY}H2eXb`5zEa^V~_K=9zUx&2oc)`c4f7$2klFJ<Avv
zXDkD+Ykgzs_5VLe-^5t3Jsp<H{~u^~GQ>O1{Ri61%g}I#fuS*;fuUxZmq<;QM}Wms
z21Z482F6-eCz1LV2e5g)?EnAIWCw@Yi<-2+bs)ci&QJo4=Ry5pV428};K3-H!@!iA
zfxP!IB-72Vpo@VSd8`gpo(E(e(F@3Qk_*T@zz1pzI5si3fX+Dwo$X(<l6hIfzXk@2
z76!&nm;e7mHQek#`};w6TGVm{Re<BjJwUJ4)2qVCfq@5PzC+XhD<P}d_k}F|u+P$!
zfzhJn{~yp9KsC+EAT=Sa&I~LdGePr~p<1E4K<3r52k6yucvXaQhVBaGaL}uD2c5&^
zR1xYKx(j@6fVzhshI&pf(0Z;7`rQl+Axj0U9Op5Z)Mhd-Ym{qXuvp5#T+^Z@((A&&
z7^)6&bImKLdp)4;W%v(1w>(tY%`Q;+h+d$wlU$(k0X`2#8PL8s@Y!iK$r7MDpg?JB
zC+Pe%5Fd8V9jFZP{{R0515*yD-SPq6{>E|!GH9<mq)oND*D?`ukB<kV3=0EOHt6mH
z_`K{sgkBR++W-_lHFK0JYIbQ?SSv6vSTA6(0mTuht^}R60%})yFmfHO>6EUlnXOy_
zKD)}Ufuru_iFNwZ!DpmcfaXlh_x}H8ZOOps(DeUA10#b8sGSYEH>$qvaYeoR<%(Sg
zA!qklC^8s$|6TP0RBnOtl|=(&e8Gc}YoTGv|Nphlj8|&Y9$3`I|F8hvc~Jk-7}US_
z0o@ZL|DS=Yp3^|gV(<U|^_qs)VER26xl-%p4~f*YoDiu=J}3fpv!Heh11HFDpfbg}
z<^MOU+YF4LwP1BeHdlE6U6l$x=XD<gs4N7Z7wY|YRUpXibx(FzG}JXn)VpH1+kk;7
z3$(s-0xT|S)itl}d&uAeZ9|rT&X5I#sdguWL(L53iW<-vp0|xFYW`b;&s7Aw<pG03
z{eSIgp#ANj{VkyL!s`FOo@Vvn|8!^@=0`(agG{~3=?d?^EBDsVzv198mw}_c{&q#Z
z)Zq$nxXk$hs&8Vn=Q6NZDl&l1Op*YViQ!!WR-iMwYdQl#XEW<)&jsJDAhBQ;14DQh
z2k3lnm730AkeoorECvS9Jy<oJ57&ABT^U**^-9Eg4mj^GsgHko4Rog!*e;1nBHn*j
z^48C}0J75pWFKg3r&ja9I*SAby;?7ib+sNlKx@1NKxYLwG%;|1?m_YXyJ92Myc3|i
zv+6A$iFp5AF}J?{Mu7L<l@mejF2{NQ1wi9%pf)`yJ}na&3OpDk4QiGuUb9GL;15Y=
zF!TPq;SDHnd;eY6!oZXX+7mYe7XJGg89bn2p98vU2^99$4<Yw3fy4i{afL<0|BtXV
z4Qkg|9AE(58^}@f*Sexs(zyb34-sfT^h8Al9dJ8Gk-@@)L0uJmN5CR*`rz^Yy8_g=
z3}}o7-^;*KKj#$qo`T7Z3>>wQ0RfX88AL#L4ozkRovW^W6Lg;zc+Jc_1{KgcBG4UU
zptR@xclldT-tu73V1@cy26R3LNUYY%BLGw<doZZKgoZ_i2cv`r15*ad`B|N+3{0J_
zsO7AFCj$q_?;wAI(o~@*!vn`f;PW>@XG2z4GB9uzdNQzp&d=&(W#H;mW#G2t0G&(Y
z04f(n3O%7`YjH3z)~Y&*bZUam`eI;knD_rfp(ld?NS`HkIVRA#5tbYbOpR&`4D}u0
z^GGB>`N#Y3vYU{y=>LBYM)3+zUlMfAFUt8F|Noi5`jIv1kTbzSXZeHXYqi_JZ7=~)
zn-N@J&SOxpbYoz&OlRPzIcW^?6GIJ)7Wn)((0ObVni)7IEC!t;$S4DHtCItRN250b
zLqj$LOMRDu1E{T8->l)_IFI2^eHR0mu5}I)vCL-RsBZ~yaG3Z1Oem*>MNP7nNUge;
z$b?LgSqxvmapCs=e|<-QgTovKhfod)3(HIf##(kK5zu;5klMx$295>}2A<}Z3<Axa
z3?lUll0@p~zW~{Bp#IM<k@}t=Aodn;n%@UL_l41ef#HXC8v{Ei9XQTqcw@=Mz!Y*)
z!UA*$BFIc92L=mE&Hq0dIYI7o0NE`uk&{6HRL?hZGVn~~WB{F0a|d)*VXb?R$b>Ei
zfeEV^L>kpW>ODZ}c_y?oa7<Xvz+-WYfpNldNSn=rfuRB9&sx`j0FXW4vm!kicxt`0
z!0qB%PG``#1f%!=|2#D^Od|E&0S*&57<g*A0|G2L7#JPrGFX7ywDTAYOd)rkfX`)X
zILRO|;Uoh`!$}5_2`9nlwmzBY&cFZ~V*-uSSTcai7SI_;5+01A381_N>c>x1X5g5p
z%)m3znSlXxf5t>*hKPyE3^5a(83HCMGlW3u!M}GJ9y0{gv?*6uCNo5U>RwR40d$Xv
z1v>*H$gCPp=4DO}3_6Y43=ECj3@r7X1`f5HP9lzT8F=bj96)6#_<k=?e1q!M`YsDl
zoGbyU3-y$+aM;HXQ{SQB06JI5VIPBs#qt0DYq=}}>bnd;=OgoIL;3_9Ab%kHyU~*Y
zbT(%|qbCFCY|aqx|Noy%ILr_L>Ss>qWQYLOk05hFWdO)*kUCJ<PxNGn0i`XF|7xAR
zL~52e1T<<fL|7y<1k{`~2$*n+A;$avpC_R70a61J_x}IqO2cCY21{iIj+!M}A|U;i
zp!1YGnU~cwTR1p5FqkxQGBAMdLjj$I1Wwm;7)0tjG#niEF!1>9U;v%RD*%cU(A{mI
zc@LQRQxyM$*O}Bp?x?ZZ2f7cZQn~_kPmLZM0|V&n0#F+O)K;juZd_rtm?5C<D8mJ7
z+5i8;_exmQFMcJWKZ60(js%@E!_qvLfdN!^InH5N;4q1S2b2#$^U(Ekc7W1mPyPQ#
zBK7lkfZ|1^?*DGkI#L-+Wd<&Ap0e~3X@1GT0o9*S|NBQk{r?RXpgI%OhpV6S0~9A7
zb&FR+&e%)^-ADBAC3ufp!~Z=NyZ-+N%cb5DsoBMF0W`i*pQ>Tu{r~q=P#$#H!yo~g
zI|9XxwZ#Ab)_ec|@c#eb1$y5N_#O_(+>g*42Bsv?*@*D|H>iAq);Thu_64Zi1>Nxn
zDto>E|Jw`ddpj%wpAQK>KONK_@&3E;D`HGlC<W9f_5S~V4JclxDE_|y3Ug4Mwm*>p
zG!9icfsw&vVk3iuV-rJybprzn$gS3i3><p0kUZ=-33A>N=pH7E1)wt@xfsL$JLrMV
zy{W1HUEw&1L85sf0|(OGPaL4L^vvgg?{nG%s&8O*Zet^Zgk>Uw0mQ$8M?m)|fbtfo
zZSLg2pi#>lu&!1mU|p@ILqM%2d#OVcg9PX-El|I}Vc!1-Aag+Z4^-!a{1ei`W(S(*
zukTa<wHH8ZP(U;|&4JEj0jU9{TQJ?izz8}6xu%nOnG*x(>@AM~ka(vj<m_X|ec*GY
zL1htqt_oxqX#4{d&Y*E@$0i01?>`SaL226i?+VEH2l(DP2Jjs=-hUq4M7^I);04Hx
zn#UgN^xMIAOR8A1{QuwU!N3SD*F@^u!Sw;?tZR_nH(-A2WM*Ih`5kl@nWfAB|Gioa
zjL^DC095yZ>PwLO!EX8gA2hBHz7v>%DPaoA-a@1?FVG!(;50N_8Qex}p4Y(Ou!upR
zc@ON~8HNPVSQRL)z5oCBthJR`SN~TE9Il{ot%){}Gy%?Apz$ln-CU8Nya2j?v(p(G
zmh%_{K=BH4+f3*G|0mQy&iewbTkv4yKLd()Xq-#H;tzBe3P`>8|Nn15{(`Mf0^KzL
z8oLLz%RuMV)y!0`@c#3FwWeCSvcCB-sGs2B{pbEy(0!Poan<^{HyG;wUI+k{0giJZ
zXPtrCxAm#FE3Eha|L^_hVI??U&ij7@Ic-AD%j4HzV2TH|fnL}wVBoh@Vf>P?)X4#y
zUqIu|FSW0M(g7$hg6sl~lYsIkxDO)t{{kpqg63d77zE$iD*XSDsJZt*&3?~omI}--
zYW8S}SS)4yQnS?i8n{mi>JQ9oU;*7B;K3lc7o2Aozpn6L<b%)qg6sm70rm|HGeGtw
z&zaUxKlgzH=nghe``-Qm!;Iwr(;7hj@cwg8vwr`JK!>LP4?t#lF!E)Dv_H2C={jx~
z(z)2KW_geZ=<bq`7Ir(Cr3`GKHE%VoN+Pl>3}-_*R{fJ%!N671st_Qvl7Z8rg~6ca
zsg;P#DhAdW%?u1R&$UEqo;!(x&KCs55h#9S*%{7;dU4pm^wx3&iPUm=SJphW2(Wn0
zU@+q`10z&D6Ii_m125<--B7QS|72b<aMgNwiPo|^fa-aJnam7KP_@ipwOkN4$!aig
zf$~7DXFvextihSi49uXml|?dSY}1m1!N4M!fpsPugwMbf3pzgqv5o*a?axuJ1gHI4
z=?c(XLCtSyKWPyI2Phwa(o)S4&^eR8Zx&}U2!P58hbGY796uOpoqq&aJYY}&l|!I$
zyPS*$2K|ozpflz{cY-pSdj0<ox`V^9i9rBV_RaVU87BedS5Ujb(vyMFVGsEJP_SCi
z`D8VJ9M;wRbzBE(=YZ0Dt(M1+`pzE=wO;=UEEyOSYPA9^YHC4e4*vl89n=;Q$W?D(
z&~Hbz7i1?WPG&NL?F5~vs^G!M0~#*@uQA)7$RJW<%MCiGQ^&r6fpN-S1`hiK21Zby
zJb6yrg5>J9`4jFkuz=^48bN1EgZtVh^({9X9QQ)*KJ@<ocPAu&@CekpJe~$Rcd#bw
z;Wbb{q^4N`)c%mL0rjsJzphAVX<OjIU?vIblYrA++jB_zOA8XIN%j%}r@v$dHtYWk
ztToNh^vAyHpDZT>r%XDiP8P7LIbkFs%f-M7N?#!JLF1vIG+E1LB{F0F|KBn%7|w<~
zU-eJsI0F}`JzC2KO-J(o|HyJN@P=}n{3r8*fvZ--OQhBvns(y<|CRLwrP)>gWVsl)
zK<TMg!y~{_lfhu7{r`V6<3Zu~?+*i0H0VtK0#Kd@<!?}Zxv!BS0hG@tFfvT3jSdFi
zr&;sM8q{8i0fl3&jB`b;xi`2>1(kcn=?o5_IL`J0rE><8P_LVHnO+Qx;gxJ#iZd7l
z!Y$eCKz*6;Y6cr?1_p-WOa@Tj20T{fFo!`x;TQu$%~Hk*)^q;<w`O1fopYm6oDS|&
z2|&fPLH&^83~*nH2P&qZ$Hl-<v&tA$C#&esVh{lB?E}ey)Pm|8>pB1bf$ly6wHHBr
zhj|PlmI@38)(aRIXDTv)&VH`ZpT)rCIFBI(q~B`S|NmA8z<G|t>Hq@^=<HpqMh1?C
ze+?`lC)w<3HCI@G(tEAQE0LPT+7-3#9_v7PsP5?Iih8Z!ikTk&|9dd}_z0To1huDY
zRw!3GH2psUa*s9aY}5aLBkT7{1k}&n!BD^Ib%nzm29CN{yDN&*83b#!9t1cvG5FMa
z1pKhL59${^0^N<Npg-sTe~XupJO%3KnLPjhAGDWX&N6Vj|4Xfg$B$Z$e+9J~4xoO`
z|N8$<BA~biw;AU#@XVHHU;wSfah$}U0rICM1A_tRZdq`6fzL@~5J<LUh_L?8z%<+b
z|Nr821_6gA@EuMD#Tg8Ypm7I_1q=!nFaQ4sxeJshEjc0XfwkF*aSzB|P#>#)ZU6(Q
zTmiXhraUMe{(ocf7h!h&iq{pEu~73J7{Fx+Xf6Si#w<W%5HBp&&3Oj)`-}R;FMe2Z
z{{LT-{I391M%C|?u&_A5piuw+l?bRDvH;z)iCPx%%sCF$`=zmwA*NQ@;|EA@t+IrL
zWg^3bntCY_NPCU_2Ln?C=&o7#_#mi^1kLlp#$iF_E2s?sst5JE7(nxopz$J?PG<&2
zOJ;DJ2ehwBrPG;#sn#uEU7;6)3n(3e(xfFb1Czx92GE#x1E_v<n8#3Iu>hPV3!r=s
zQ2P_qo&&YnYS{wT6|#fx#}UzQ0k^FJKyzZC^}80Y{$D8MW?*q>Vvw<T_5WlcH#mQR
z`m+y0z1ZwPV)gBye#-w7HOZRSKx5A}=~AFR?g~(!6f~X>8c*<GWY+=tN56|f*I^$6
zXgml!mI^9wA@_y+`wAILWw?Mkmiq4w15-HY{7`sX9u!tJJ<1iJ_9V0{kwFfx=6?+w
zpfGdT$ACS&;&F!83TXH&fQHu$C?6hPpgAuK1_lOjxXA~sE98cTTMszg3MT4+=e#p4
zv;JQwl!b(wW!C?bg|evO1`?}H`&Uq#9$iu2V8Gz8@Be}N)(8iOz5jRAvPy!(vDQUH
ztTsjS8mLcL(;gvGlNJaH*A8g7mO$DjtQQ!VLP2Xq8erw@K1K!yXt=b1+B%@H0gc_(
zY}c-+DVDCVR$x%Ie#pQ9N?X<r3|64=LhD2Z18W8by-qXmT^S6H^EgtpI~i0R_Oa=J
z=Bawk7#OuX8MGbeF@XATGN8L}L307xoeatj^B8QBwlX+?&acq!WYBe-#~`BJ$zb3x
zk3l7AD>y$KN!rQ)I@@ti(pK<&zgv>Fg3hA-zsAz@{{>LJuHD7J>A06c17tr)49uU)
zkR!{%z-4uffw7ju3pD3<0W|lf-N~S3$?*Tb!#)O|&Ts|>kUad3YjdP~m&HMIFwi@$
z&7t=$hcmE%`r4qj5U6im%fWB~<TjAKb;mbXST%sh(DcCP*_$yiT6|+*v}#~rfV&Cg
zMt24VORfJGv^yC%9p^Hn$W3A3vUtwGST`j|#A?caxEn#^5g_+jd}CljcAv#5(D}^*
zRx_?+cVAN{14CWsf*-Y-{|f4+cvy6*gU?LL0QFxAwHWSecQN=l&SQ|#?qZ07hIL8J
zH|q+}eTxqJ!1wj$fbM#?Iu0I-lju|j_jhtY?LDjG3`~{|3_c+L>UT2aInHA~p$($v
zGJwwOOLm;cP@>(*knA{@K|;TiLDg{{i;l$u2GAPb2+&!H`kf3Zj`LVRbE27!`&eW=
z7+64SuZtb$F<jB^WGIH}%Xgf|Vxiy3P~f<ak;8+5`Hy}lL#g9D78(6chKi)E3<@AK
z9rv+FcrY+OC|VA#6AVmV{Qqz1z@Pw1-wq2HI6!mKrkapDdO>Y7t6~PmnZb}U9UQKo
z85l_kSI`|ZGmRM-YCc<6fbCLXPypM*z`zI^8**%7%>dhB47TF~$PN_qUqR#TJN9^M
z0L5GK><Z9acU{}!in`^iE4=@I+3Uf;%0sGIO`yK?ByjstrY?ClXx$VKvbi1%j9WU*
z!13w}I&)FGlff6f=e3i;({Ud|iw6Va0{u>gOi+C4cQWKU%wwDY%A-Zg85}_Ovw-eq
z0j~pn`MUzt&Z_wourB1;L%WdY>~=Lr4c65>wOBXfBm;xRNd~4Fp!Nai9N;eSU93E_
zJsFrRPBJiq+VG(HJ<zx=XdlSzHc;8e$N{pa(~N;hyOY5TbYClIZn@!Jg8*p0um1UO
zP+i1Ow35N0(};l~RO_J~cu%8Sz`9yBk99NM85m}&Gca}<F)(70W3qH-V411T!0Z5W
zPb+x8HP38!1{O<q23AmC*eZyD3FM|)_h8UG;DXs*AUA>2v<b*9^&fwO=dx=iHLL@z
zH<`%DVB!7$lWHR)gGEiXM1W=B|Nj<`q2n7b!DEvmp!?ZsetWE&^9o#+ebAr4z+7i2
zB?4;W%ob!|0L@o}#6WY{4)gx6m_3n!0TgGT@he!Ig)L{>;Qjv-Xsx?R*jBa;p!P)4
zD)9Z`JV~n<6fGGTI6!(p>!#}5CWG$Q6R7K43`#!-8|4}}K;?Gbsm&F&VZjxk@rzmw
zk9CFW4D1d~|37#zFm2H9V#ukLoe=;^XAb)qY(hQRKzFZjILu*?X$)uJ0JZTzea0D}
zwCm*snqLrT3};}m)M8+nXwJX_x_<&R76Gc$NlEjdJT;LM6vj+Cpu7djKOPKB3Q1eR
zcXH^=HfCUemNnq<q?yJHj8?@UImSOAwN}?a?OMhU77sw<Vc>NXpt{?qvmBiEBSN#;
z>_W5H|7mwKu+@48iGbWUGn@g`#*=9@XW+0n1v-l!r7V?b1eNug4D6wr3>KE23>*`~
z8CV)tGB7lpWMJ`NU@QQI6{zk2nXTQ;00|>dz2VKk7@93$1v0-jGYS$$<qRyA+R!l4
zW?(2<#lTdn=3P;%`meyDiBSb~KX9lg+b57&`kf3>4*M7^NHMeFG$`yCZs>P0lz`%m
zRJ}Dv{}p&JFwD{KV#o+v$-W2VFSr??cs~vC6S%I)Lh_S00}CizKyxjizICk|y9vlF
zhj|PEp>CkHoD44HnG;-5>-w(%v^EQzmXl{!fYNc@Do|PY@hd1DgX(MV|KDeT(u-vx
zLqkpNi~tXYKcMm23!pX(Xl@UDmy05}4q%w6$iQi-$Y3#HA>_^l(0ToqiVOmv@zx0k
z8Du6rWKfvM$e=ROkwFJ^o<Hb*640D5Xx<vMo)9z+0vjivsK{Uds#idLG|+e=)NF?d
zjSMoNJ%&)TB|!H8OjyXEFySDB%7lju8WR~AbS647n1Idy+v5wG8}<I%-D;D-z?hKS
zw!r)U+nJ#DG`M}ZfPn!tR_wu$SlhtJU}K@kU;%SSO^W6<@4u5TfX3jw|4z(cVDbr=
zqWFIU$lstoa$_=sOrtY{z}|<DdqF2KGK5$wFffAKa4i7=jm!)T&94~@8k-rwcVvU+
z*(|vJ{cn2BpkcA%|No}b3?`s{Q`2e&9Z<Q|=*?hZ+4KK*!)XQ^eR&3k=4=L^+SVkI
zW^aaonocE==5B_N8crsW=G6=l)?)wv*UjH0QY-VopjP&U0jR$V8t2n)W8ia~%b?N8
z%D`x`l!2+^DFZ{Tuz`Uk8v{qp3kL&>V+;bd!cHQf^;oqY4=h4C1gvU)JFKg#b`t3n
z2H)ktu&9`Usn*K{yzUCr4w(f$|Cs4Z!3zcf$3@I41)muB>oR6nI5sg@)VECl%{53s
z?PILvFaX)X0cr==YfLbxxnvLk>a*2)I9SwrO)&u34Rd41Q-~Y8QW+R(J{cHTJY(Rf
zOSb^&7pVDUB?7+F&HaT%$a4X!x+*J?nqL;{x`G)PA?}+3HoM>x$W2TM;JWaVaYcQb
z1;{-XU8)R>R&ER&^^+_d>I@AGY6F8r9Or<}rvaY{BGIMFzyu1PI->~&wO*4%tlSs`
z>eWDY|Nmd>W?)h4Wn)mMHcO=D_=JF(CmsRy6D=GZ<}wD<JnsmoZ(rfyu$O@cv`)o?
zfr+JF_;7{8ECz%6b_a*L^c?|p6|+P@^O&G|8#LBeYvf(gC(OV&Pl$ohiQ)eb(3u4F
z^TF<HsAFFcQ1jm+0IXM{3FJnZI^kweox)u6!g?C0tqL;7gMpz1M8nMM{lLID_Y=gt
z`uPqHwVGBU4txHesej45tXAG3z$$@(p)PF3x|)}>L_lTtEO)Tl54D=VMCuAX0=)nK
zUjVi<{RhOod;U*AHXqr&AhSX9SlS)n`dX#qGXtX~$N#^ewnoQiaGQgv=Q9KIoR^?G
z-2UIu>0n@}RrjuNY-2P5rKy>qF@kvvTRMe7ca1SH&147HDH0%e6sm*A6(pc${s*}g
z)GwX!l7T^cA_J3^=l}nq>_6&2cSVETXI1?Fe_i0@in@Z?6-x~mn6?@+FoD7}<T-~8
zD6DFYtVHUHtw8mGiS|SW#)X>Tz6VdJp^ILSCW9Wx43K`PzCR%^Icz}o)f#z;6bdmg
zIyNyhz}yTH2c5%K@QJ|zG$&K9Zed{Y{Qv)&=K&Tq&u58v|NooODA&L;k(oill7T^b
zA~(2x2q<^~R<DAt9-NM=twd^mTdec`|7VIN0|R%#Ck6$FMgLEL+6~_S|L>@8O#r1|
zp88G(2gf;oOhS&o_*cuW5fJiR!lLH6L4d^p2F99WkaSveD!{_x1OwxQ!wd|y90>sy
zCqZ|@Gl0gHSuHggLE=0UnZfHI1txkkSWI}$U}KpGnm7F}z`*3*GDYz}e7p}-zJl78
zdk@0bdrYxTWY7SWWuU&N1p|WsX#Tg>^R}L)CM3))RT&tqm;C<+x_7;P_3H`?Mg|Ti
z2L^?u+6+vgnjAK@3SJ@$Jt5=A8$B5mK=Zbi2@L#=>I@8^bzY%a95%JlL3*IE5C_oQ
zN%sH$P7MFwcrdV-)OSXJ<}Eou>q|lF!z>Rl@LM`CFxH-AUgofmApo=%!eRk~1E~D8
z^kiTG-8BPp|BRIk450J|x@QcmrjvnXLK_1EvN)(t@nB%y18oz_ggS88)JQYw={JDJ
z1^&OO?+gIV<#K@TMYB?1;J094V64+*US{3Ez!)OWVH4f}QD4LGBhaydxdF5W$BE(p
z3rEnrT{8oN1;hXUj`Nsnw7Ws~t1*{=#vnj__zjE<Tow!re4uay_2cV*{H~~vek8I)
zo`Gp`6a$m>90sNuDJGE(^5F1&0cs<I)IsNr43@|;FhShNAQQsCVN?HuNzY<G17rAq
z4x5@C%zE`5zx6<F@&5n+3TUne-0y4#pHZM<wc!8%X1fNF=C}q44+aJe(7K#jDd!5S
z1q{NV{T`t8t5ypb8Jgo71gtIp{<Dty`_Hn0fl<4efw8v7!=Sm1fx+qxBrj?Au&#HU
z%W%h%<Nv=}WA6&<1^@qp{rG@^!Ri3GeEk6$i*cOC*kh&o|9_nVgGCL4mPlwIhfSSD
zm&k&R3<{w2hapQ@>_F-^Y-CVyoX40^-{k>{^F1{pJ1pv_ya25o*Z`W32DMLW?Y%2%
z_6G#icSShVFO3KY3lgxZ-~S>Y{3C~r^<D<X`Z<$C>Mm;-)LD0l)URY-<~Wzp0F-VV
z=P_zHIWUNX?B%ej-}p+eE_Ozs<3dISkiY8gY8cdP)~=}Sc_jk6w+Q4fP`M6@Zx05>
zJxy*53}JHxtZFvBT-UG+G&cQ8WTq+uBZytU^p!}>(gy)GOT`K{>}6o8o4dGTnFa$>
zoqRw*m<XGl<pa=q+!dg?dKHJc3=(0695yvOyY%X;y7WTUv)O^xYk=16T0US%sJqZ$
zP<LsDf$W9<e`;9&7}PACBvR+eysY*F^Rk)^8UdiSk)V0B+7nF6W<F(LnAOU_xJi|P
zsb*=BNbO0cWwjRy0>SyB>Hh<ZRsa9j9n~<X*~nn&xaeO^$kHEm-v9r90mYB^|9=gj
z@B{Th7kYr&;v6=$E<t+U|NnJ>#==42=KcTQ6;Qeh3+Ax#{{Qbps4APCMFRt9zXXGI
z0s|v7{S|=X#c>{kLJijri~25bT#10vNX-`Qidt>&3ebFd4c8w7@cL4jAd#9mf$L^<
zFfdwz4hYF$V5-jwFsSul0Ig}`3H5@w5mXL<#z-u={{OFK0HqnoJyDHr3=E+?0#>zM
zNg@;57#Jq1gYp=-td#)eHP9LZP`lV+-|s8l|9`&#kKZygS9madQh}|X1<loh#%w|R
zbR3%)rZg%u$XGx4{|}_kaUMelsO$iZsZaC-i8C-vc+6k|+S4)7nL#Asc>}{lX9kXm
z&I}TuyFx*Cz=GDdPxNF^nCQu%G0~GjXQC&A!9-66i;12LHkO{O1`{A_;6eAr22Av1
z@Byu3huS4$kpN!f#sDfe{Tf&lLG$|{w}8f8L35fO3?DZzFge2K<3Vjr9aaVg^f6RW
zx$M})$k3?@9tSjZn8)x%zm37hVIIR9Q2qza(KyayfXv0uRj!z*%plRI%m5k#0__0;
z-Ek{3QJFzwqB8^NEEmu?5lEZ|v=;}ox1iCUK>@UWw4t6s!(xG|0nEMNb$d+=GeG;z
zCd_A$ao7W%PhqIv%Wz?$3V7^VrhcVbf&N?ueNY_=5_6o(z!AQe-OkeX{}1g>26l(N
z3@V^AsX+Y>kohpPLG{o?d+^;wp!?=!K>W!|7*s&vGEs%W1k^SM?RT+IWRURw|4+pt
z;r}mC{97da2i=FnVUh6v4|uGV;X?{+-5V&}kk&GEH1B7S0jUSM-*FxT=<Elu-yP>M
z6g1j0fX>zd^?xlI?HLT9aRy!o1nMuq+==Y=hPezTSjFcv$iT!w{s8$46!)O`2H6jB
z=lea{tqhDISuJ)UnJjjoeq~1rXv|7VL>qJ$=v)RKThO?gCIdg{E>`WX{~sJcVqX9M
zTY53@hk7;0)jE4ufcj0K`2f(`dC-~y?N$bUP`Lx@OM%uISsh?tNV@j_Bk0a7Q2qvu
z<3j5diJB)4;Q3fkJFnKu3p8&12HkFu`b3WZA8WFlr`04oUIX1}8R`tVI}v1e*AoWN
z8gqfJCI3Hmv;6;5_i~p=x61#|b=y~obi4fjQZIT)q&wyR*SfE}MCvV0iFCL8|5h)4
zNTfdUl1TTG|KCAk^;Ne-x}W_20TQd9{Ya#<<^NBRSpA+?A{{LMe}Tm6|Nau`O!@yC
zBvv~=Nu=Y*|34tH8XhK*jwk>Bg2ZYQqC`4b{{I7s)tojG=~VguA0$@u%t{2r2dygv
zvBC4C>`o$}@oG?i$cf><O)cl<X|)_1uYu;xYPq0nkAMK}R?+nia~VV|85pB2mc9xA
ztsw-h-viZOHSNk3j`J9GLRLJq1I=rL<eVHB&UCUs!ldKK|BoG@wbvS6Aa{MLIcX$P
zt7#+xiqBd#Cy>}@P`KA>g4th?*k6&@-;mhfk=Q?w*guijzmV9!k=TEb*ng4O|6ptg
zEhPe?z5oBW2wA~k7P6Gx4wP=ddn8seF9W3qCkF<Jn&YsvV+2$G1|$bgD=(d=)jW5+
zR;%t2Q1i-pS}nWdwOWsW08pCUwUB`alx{)&ZBY7QV6p-2rG(Fmfaag~9%QhnhwOQ5
z0kuOXHZqvh<VaUS%000O&2OOjcs{7zCf3vVhJm3ehk-@Ep8;Hs=}!i&uN5nS?g!xp
z^<^y;7<eYyGcZ`%GZZxUK<)vwjAsb3v}cHz(8!?Bti!;g$HKtcyr03MwlBG&=|6)_
z{jA3o6CD|3Kz)vhiVP~CxohhL25Hb-i`9Hq1FLw394mXK4^{^mI2!&lFle_k$T-dw
z{Q$Zb7S!gid10XkN^_ue0lG(7QJg_kdpd(?D94L`p!DLfm-7Iq9qYlsxkFK$L0x+~
zgE~Tv-2fuTuAwN-Ag(=~K^!5+H~}KZ*wOHxfkPj%)=B|W9b}xrgMmTEk^!{lmTimv
z1W=d>i&(yAVC*>m|G$;M|Nk||b{JTFXW*#cYa{|1V|Qr!f2ZIjcrMH*f7Sp0`d!`f
zpu6Wl<shis29;&r|If{|RA7*wP|qL%TK5kctFc(Xz+|cLzZ*1O<Ng0!B}fj^=4RN?
zD9@lUX+MJiXif(-CTnrv|NjXm7z_$tGJyJCD&fly*@drg(F5%pvv|NDU-QCxn#^+s
z`T7nEP?-$sb8C1o2pNR0V7Jrm0I$nm62AALUBiC{6_A)E2Lnfa2dJ;kAYk?V|DQ&=
z1_KWUA<!Ny(4I<$S`7ySkozafGl1sQ8NC1hYPD2g-~_p`coh@Fgggcl&^))L0s}WF
zomf2p@7ZAR{{K${5@v!Az+v_t8fMR7VP*vnv+xycc9S7~<N*1xQ4X{xQn03Y<pT!L
z{CJ~WgNX-&U=FB$h1M@T;VX{+1C7ms+~Bx~L8Sp2p0gJ+faWuq!uKAso4t^M)BFEf
zO^{nbV{Ra~f!qjMpMaTez;O*)1FZsew+111Be{oT@=6AlMtcT<LeL#Aix^Bm?g?KB
zb^`}Ao;fWRFtCKLY_SX9>t;7ok%4RWLI!T{|7SX(?qf!CA6nW)cb`B93GNdCh4DmA
z29EF*hwLVDGVma|6;IfmehYOQ3$oi9{xb*^JYxaHO$U~|1IjZ<;m8k(e>`~x6poYk
zGdMuw78I5u1uvNx92YUzfWi?JewgukIuPVGP+ts`N1*vbWWovX+5jGqdqMGR$-ux0
z+Jn|8&md691$Oh6hW`u>bsWtV^%KD9o}=c4bp=#^Ps4r&1yCL3IFG@lA(cS@)Gl<K
z$6(QLltHASl|ceD=TURqAfV=jkw{Ilkw|^J0;mthQL{`Tp!P|11!yeQ`_B%^Mn(o5
za5zEyp#bs+NH1K?|5Fn|YCwK~xThhY_C2U>wFsCf&*0D~&)@)Zlfyi|1(pm9Y?Jmg
zIKchE&H)Ph1(0;g*HFg^sb4^D2bGUC@0~<C(*OU5`a`Fol|cs7)&ccD8tyYVG%RIM
zsBhB%jhhHqEMs7tu%E%9CdF`_ZZiXeV;=*D6T|-<4fh!Y3QmFJKm*zB6QJY8-v3Wt
zguDMCgGL=kLqN@Y>k7wpp#3JiZ;;}IW5Npt8A}ERc2qwIAo+oJ4-tM)LGyzKQGPgy
z*AKjS{Gfs62Nlpf7AOwD@%oAh<o*=G>7R#S`d=u|AXPut0n~p7mDd&?3_K06^o!&M
zk&x&6|4n$o0GhLAobZCd092oV%4SgA;{E@GBPcC_%45(t8OWX9|9>ojq!FGNLS;qx
zN;kXk6$ki0ZM*Q5NAy5#z3{zGa`h`;f!2O;P2SHS0dmvibqpq;d<7~;8|4{zz-e?J
zgUVz*@E#JT$$bn06W=i~OyXl;nY^FDV$y#G8xICP1yr|waRj*$=3bCn9Vc<`Xq0DQ
z0h>3E0aPb*X-{Y1Le$-mu`AF#Uf2uvy0GsI7WI2wKy|%@_y7MQ5Px!)5cKB?_J84f
zf7DHsXJ83m!M+bPMhnX8+8qqcj`J8iv^&7#KRlKU44`wN3>xJcKxbk5STZnhPLyW|
zX_RXK<--7Ixe{T?z#s(bpI9<5@PqsT>RUC+HMmUVW006!&%hAA_rpG`@BjaL|Nkz5
z>~2t-MNu5N-GW}ebFCokmlnJ5<t%oY9RL4=#-^clr-ugvmxHAO1K))I3=W`p0>v9B
z&Oqf1xXrWg?}Pd|77q0tk1Ig?_(0`feMbYh90Qe$pg3@x$E8uPe7XWuUV+LjNV&Gz
z5tLs*=791$sJyE0co0x;i72<c|9>-p#0BRIg6?0=_Ah+Jy?++Z85zTuZMV~IXOsh#
zUlzw0SSI{uNSG+kkP^Ok^1cc88Dgxy|NjKqH>2IbAP4HtHOe*kcrb8+!e3z0eufNC
z*f-o~h-vuGkWt@m04m#R6vY`((vag^h6GSM&9R9A+BV^I0lRTMv~98!);7@s_33U{
zvNJG-Jm&z#e+DQH8|4}TYB{X*!k4qxh3^HoMJ+-(IBaVEJL`G>|K9;>TY}~ZK;s~d
z@(dZ;9SlOCxh2q;Gf3Tp`wXCSD*|fSob)U?7?AZ|0hf>S8FD~r43t+U&1dkjSim3*
zy5AZ!XWsCTL8eZlyTbeb%i5X>Y0w^2P+1Y;!N3t>$-p2uSsoe&`xz2I<8cl33@J6K
zQX-J>kZ^FA!}z6PK0}CQ00SdvtwN(cgHH{Mf`LWL|Nr&N6f8oH30Q&pS)FVQj0=u2
zFx7WJ_Q5zga43MnsFNQOMztKUFmeKg(FyG~(7ksI0rk_t`@x{$%KiqVr=uUDr=|s_
zM+v0o1}NXwz1R@|3SW!o3>L63uDNdw3daELHU<HU4)8wFg!<_UptyvYI|XbmmbL_F
z{}d=~!^{S)*|B72Fb`kGz7G`k7RMNvYvw!YLGvSM>|>608-t)l2LrpqK875N4hCj4
zyCCg99Cm^1QRMjlH+&f+Er87TU|?{7q<uDs|FP%=+2J_n{~f6QpW(~c>caP){AY2D
zfxGUzlL)9h2lch<+a*A2(F8#I<Z4bbF9WTGZIo+>fR!ttwYg3X|5QNf%;E)TehHGE
zCj4i}sF@E=k53xq!Fxlb9rt~j11i5JA<`EkD1Cv`RU?B0C|!Zlm-qkYib!cI#)E<N
zN25GL4(JS*hWQK$VD<YMQYOkXfXY9%iSi5)7A@d=E>uEVIBaU>D~W*2^8WwqCXzV`
z9t^A-K;<MTk2dl#7(mJw2E-T<C-XAUxSsX|23Ans)}F%%TF0)^aGwE`wizuA7#JJo
zGx&hUhHBYB^QEA56$}ZWI;Zw<aRsQ(sdu?tfnM);|9{xptjEC9+{Yl$_>O_0iI0H=
z)K3NVQN90v>~L~m1?PWkX}f-f0c5UsiIYezi^Dq5-0Ol=2B!M<9S)9j|DOQ)q2{S|
zMNNWqh2uPiib5`i4-QQX1t7PA`>vYI%OG=4pgH9K|3T)}a@ZKuaxjU2=a5sN<}PMn
zT#(GbRI9EfQr`*7b1Z8>=^UH8z;j-EZ4Bz3?+5_7p?<H9LEY0G0Tb#O96<YQEg2ZZ
zz5oAUDdYmplYReD$O&F!4k{}+JQ!FsLOIy&CdxB-STZmOgW{v%KZ6G--#E@=2&tbA
zo@0gPH5PFC$Ki$>pt26smaOHl0J{Y=XI;O-!J>YzjX^D&lL)8{YstU>q8S?YGep43
z9k9On3<0&Q8U~;_jrtWDkZ?W%4UcCGj0@5r;S4%k!eK6hijxEL96aH1ppcW{11KKA
z;UB=jShL&-yayLFK3($^VNWfG31;{|hK9eI6;k*!>)^3(NBv$CgSuxs0ziHR#RF0p
zvv@Et9RY>$gn9-SXgG`F4`-$Wc<h3OvkRVZc4?Fc_cdH<rJO`+WgNhB<Dh&5oo@%N
znGgfH0err|Jf?s~c?Or7KNkW(@dxeun>6faFaXV!H~eQX0q@P6%fM61>JZSdpFyL(
z!@!|tg+@Tlb1e~vx#0d4N6m{90W~L#E9yHQfZGkAwghOrrsjk}z=Zn@4xn~{#Q_F}
zT6TkVwUUPGK;@Vd!~ZX!eoeilkq9X5I_!JL0xB20|9=gExQ%fONFKa4!;*n<rsV(s
zAbF76z5l<x(I^kTj|4QX@dng(0=1!#+J|WUPR0ySxOU(fcWC5e5UJU7Apq1*s^!oU
znaIZ=(kRa$17^!J$bja3K>fy=))N7sJ`l*wpf;BG|2?4di#fdizXXrffZE)kJ^^U`
zJt!|Z%wtdpUj}PW8;OK3JE8~bFNUvhk^_|u4gVP=pyM+VjdBes;PEnOd(r#<n-3s9
ztj%Vrz#s`~!y);-0^}yBTXG18149DAaFAz^sh{fr3RjUvxrPi_9pnA~O$yu{3=C4B
zcmU1ASu_0q3u^OPGcYhV+B0Z?%3)9$4C=q5m%$G67$iXBiQ1hE;-ERk`dJSgKy!@E
z>lkE^<_>fkZNY1M864&@L^R4WfX-E8oM_8nFwvGlr`F5CU}7wTh6e+KO=B#B3TTd{
zQIA2vVgUnVLmq=hO-lfLt_9RzpHRzS;xO<321^A78Bo}HFfh&m)d3BA88jOD7<lUE
zTnK2WWiY9qqv7DVhd~0gpUwNvid68NgDnH-o*$paSO$aonU5=KwKM|i=YZ!~IchDv
zD{7KKb8`v-^{S^Uy#K5)tgn0!=(q@KZtCp{khwLp6#~5ftPq`C%K*C5Tm$3>4+aL4
zMq38ZeODT_mY}nR0vtg81DzEHRi^`<N1wyMQ*Y@dGTD|vr%{iArC}X|KwajHfJQwA
zj(XP%0kxX5L?-Gna5U;Mh}3Fc0<lFJ?LqS<mqbAGC5`qB9H4jrtzXxl1sbzt0Np7s
z06IGa<acm7?qp!7nWYc_Nz1!9L2>E*|Jhntf2=W{0hBL6XX4v{<`_Zq$)GW6&{;j8
z{$Zvk19z<^gGs37&AL!c3j<JJaiSiBPQB-BP`gy5(UC!+p80Tveis9a!#)NT(0&>a
zACwj>68`@N^^rjHIUsvM^G}V93?`tpa<z?(3LXqs7l77*)pRR^&NX=fnrCcOW?%vB
zR|oBJ1kLY*`ZA7l7!+z&C{F{mwL$!vql(u+=WW!gdkECBISPQv9#HuYazAM8u){nC
z3&{L7g8}&5gt-h7wb>COwO)ZDHP0<XYK|F#+NM|PI|4vykO#D$!g22Z2lZVJpmvx_
zeU}47yxRlB7pc|u5UAyH6sX^8AyPlbP$bml2SaG;kGfEYA9Xd|+7%&3elUbQ{ZUuL
z#avO-u3Zsw;745zt94}!8*_z2)BiP-n;94;FJ@o??c;@=4+t99uVG;C@nK-p0kJI>
zFv!;=YgB;uwzX)9gtXkO_ibWOsOe;0R+A=OQNtjSW0B0D09wye!@#lzEY4uQ#^M-4
zj3~3v%pqtugTxwSdkL$T##G-RzyNZu%>o97hExX7`9*MlfXzF=z+m%$fg#~J6GP2Q
z=4CYu#y!aX0;vJv8fIqjTpny6@Z^UK;4={?G%|qJIqG=-xsnMg6F_+z)RzM7App&d
zg31nygWxr}jNX5)fbQdA0I36|^-j>*%tQtaP~3PhTn=GiQvNbU@jvpJXA1idGDJY<
zT2erBEucA;S_9^`T0^F`QY{0}*d<RxT>}FsjW^VR&X!Dyg`7KTv(-|8;bE;Fb6c%G
zQya)lp_=mh8tNK2KyBz+70+un4GjDVElv(Koyya^|0elbDll|_%&wWp)CM}kD5T|i
zo%i1)Q}DT043|LrfWiBXz<Z7U%zMkgr0fEl#|O=YYd14E!uDQ)=Ja9ib)3gw0NT5$
z-3)F!n$#o+wSmf5?Pdli=vo+O&^f0y$zXAnnnW-yQ<DUyML>HuA!o=Wt_1a2LG$q*
z43`ubn3O>Gw;X`2`?OSGP~3;uW9tI5ALOUnK&CcJ1qKl?+mNXZv<{-w12n$L7y{0_
za~OR>H5r&}9U2%QXOc16fXjdc1_o;f1_tmMQ49<Wpn3{4XA7QVYG7aht>*)k3(0eS
zFeF$1XGo6v-;iwi|3I?DABLpw{}__49bib>`hX#6$_Iv|;s%EBl>%0lnhXvwcNA(d
zFgh+`IAT!?+WYfwYe))<QGLq;P#rl(yX6OHjkZaB%LXX_00XFuvHmZ>P~S2G6z4wm
zEh|8B71sZm80uRVfW$27TW)~Fe6(BsgY-+(w;TZRU9A5zIMlc70I3nFZvmfaq)^{-
z0<`y#!*L&jLqlDI2q;{<|0XzkFfbTc{|C3hG_3zKfX>cPu>Q}`02&9k{?7<9L%{k!
z3y9{h{?7rr8;lvW-p66ye+A1#28Zy+3&cDaE(9<zDJo1+{D+*T3-%sllz^mZMwB#d
ztI)uZsL5baYsd_Wt13_!)m>z21Jwy(*S^_JI>;yh3jc|Wj69&Y0f#*UWF82#zX%j3
zpt!PfU?{OtWZ<X^U~a1~WNHh~WYCzX$Oz`wYF@4YnGZTYyiU2h!eRj<Xl)dO_n!r4
z!%hiUS$Z)z)CMrOfzk`;Qc%Z53_C2!KymX|(pG{0e@MN6K%(aV|Mm01<?|ft1O^5x
z`Tu_`|1-$c#@`62lWeZ2y%;1?%Xdnok%NI{sw4voXnf0q!MV16W`%>py#FsiWvC?s
zg9Auy%TETDn!XcyAT{;v3Ji|>Kx-_V0~;L~1*|0)80%*QI5^H>nBl>|P%@E`QN)A6
z*%V|>BO{}T!@U1TKxTo)njD(`Z_%I4@W8qnv>)Psh5j@KX3!dOhk5^XwC8~LFnNI1
zRe;K!`rykIpt!Pnz`$5PcYy<F-qc|(gGF8G?25^bj6C&QUW3jg(SWp-86>o)gY|><
zLMnj59o#l+U|<BLd;MAL|E;4y>*@YYX=G&NsWo*Hsnz5wbZlS{(eGsc?=Y7^z*2$z
zKd5{Hm5r7T3?-oOZDeHRsMT}^$AzT=130chWtyb|Ljfq>L2QsZ5N)ZzPyrLOOk_;(
zU^x4Pfk_T@z8lKkPom4824PV7<AG8BG=s$rY8t_`Mokl#RsfyfRIB0*IvY)3H{v`u
z0q?)Dpz}inJQ&VSVPKL2ozvieD2tdFKy&5$7#SKMX`SH+s63k3$WQ|=!}XZkY(e|9
z{F&Q8Wi%*kYW11hY!VpQEE*W<6OyGGy#JgD1dY>JBrpVc|Nq$uYL9}}4ng^q(6wGX
zkorXI1?cQFP@H)GjcN4${|j{Yf(GbJG>{qIe`9hR>KatM|Hh<(&OY=08x!mO|Cb?X
zeVH}rEQ#jF6&?&`pgVHGbw+(YQyb{am1ai<3CB&0Ye05dG=Szge=>&Dv)hGaGMH)4
z2c4nt9JDq@Kvt6>#rh?KH|X9X?fDEmpz}GPVosp3bnW>Jpm~0nIz`a9lJ<NCE+lo5
zp!S-qCqs&?Jp)($D=(4oH2Hlt4IX7R$1Z}-yc17odBFghgYaND;%ceFzy;dF4a$e0
zHA@Y34IVP{8MtJQF>ry@c>j&AZK!MT@%|fK>iz$xr{gAu7Zwc+pffB3y#N2OwP;{q
zLWJcH-S8*ucKXfWd21ffnT(+H3Odh4yM=+p0o0zaYY2dvtJ+Z45Mt2)x)&i@5)zit
zg5LjsJcWi4hxh;QceR@tSRLmw#5CG9M1&*@Sk-z;pq#haP}dOS{Wt1nLtR4xD14y&
zlMQtZ8K8BbQ2x$_x`rH3nG5BwY^ZAh?N#A`@@F>GHKah|H>%hB|BpmV2L?rOz7b?<
z1JSk$-2Xx473iLrRLvF!P}ygxz@PxiPoT2VR^b4Dq9*_U`f3l0^m-Pi<o^l`j+;b5
z<AdBF|9JoZE(oG68W;q<|9@xIZ)RX|oX5bEUeBTgQVR-4ki7T*Z!awx7(iof0p9<=
z-L+_75CxrK43#?zJ&%tg{Xc_%_H4-9M?nU74FgB|e-6-js%%iT3oRNL*pc*33`us-
zt7*O^qTRxv0qSpn>Ok!l(Arc6P#+2;4w}<a&~9PyaGb{gI)kmm`)?#D{wuuyMwWUo
zh`6NxX9TS^fcX0(xPDOshrvgtw($S#C61dIY7pt;n=Hs*NN(T-rH$}pc2HW^0Ohyj
zmkf%aeb=CVNBVz;22lS1BxdUXt{Y20=MjO%pg?Oow3`{2K=PnIhQmIFi1hzV4Ym%f
z3?TKO{o$bc4b-jy%?TyHWMD*6s{>jO3tArovICSqKxRSsOby6tEg2ZpY6U>;La^VI
zKz^$Y1hbVvY;gGks#hHtR6yyX1{4Mk45}bDC{5IZ^S=>F{s-Ns7G5pCufE#zn&T#h
z4p979G=R=G`|>v=nXL|*#(f&?8frqaKxrKHOj(Nreo)>Iu}F|>0hJ3D300suEEkYp
z6OzBEfYLo=@6QVlP&hTzH8eoda`-_=z6#&z{r@ZIzCa#}1Y2<b5u_J%Mg+)D^&gqq
zKy<D0&1*IXtY_6S-w*@k(S&2C7{dQE*MZ9HT4v`84~7GxAuSCOH7&m@Y9=zbLHues
z71lnk_h)Jg_mtlUD(mV!FJ5z;#00vRA;6-6LCE|67eP=R4=O7_XH-JNfD_zqoy`DR
zy8==t4$2cyIZ5yTpYMibvD;~PF>r$FRqZYYUQqisB=fmlc$R<_s9dyUWQefT1eccv
z4RsAI5PyfA^#1>4F6d5pkXl(U1}>1=@C*T~TFoF4OGk!?T8%(G{n-pm*43ao_kV%*
zTn5JQS8U(HU$9#^%wrTNehD6j)o4y+hyb}4>P{}uITqFl3|v+T;4|Yu>m~%i?WY6=
zE>PM4w}Iy|n1pHxSk=Y^i8OjK1VF_Uw7VF%YTbgtXJJ?zVBi9+9fhtZ2kmbLx1T`b
zj`P5K&6uELMh2l80#>y$P9jY&7y>|Nrh?rvodN6?s|QeX7{Ke&A?85Z*P!!0I6!t3
zzhYo<Y+}^V?gY)5GAe-fUe?-pi8OOE1c3Vbj`J9Kv}Zufvu0r6vQl7Rv|7NxXsrO=
z2l=A-C4&NJ4z5{|Awqv9c#J|udnQ!90z^G@{gVJ_%{NFNQdk(k!lF5gApl!gg4_rS
zPf+;`8ViAiCt5gEz}(&F2@lg0^e_d5rxgRl{T>VqAz;5GFfbyEgWLy-Lr_?Q!Vm1{
z25|TpfYmPm_fxn)XN`gTC{Xjz)Pu^w4p6=U<sVS}YN_zC-y(qlUcc7=_ptC_*z-_(
z3In5+3%HKnqCFMd1~dVwM^VdmxWa>B&sK{T2Cn*93ZO9yf#m-T3f2h>A|4EkN3<tk
z*H`xpbne}rS~PtL)(H%t`*eG>r-9NpgGBwT2{1DatP>dIKzmOc>KZz%6BvxV{|1BV
zzaH<u!4n(m8YX!E4es>*|1s8sfzb!7e;+pe40|yAkaoMmgJJha?a2&`)+}KEO4QFf
z0JGP@IsrT;*n*)??KDW=PSAcP>l6kq(D^m>vu=R&@g)BT?dM_e0lC%tZ_vkvx`rv<
ze}i5&)HTfT{u}hLp{`*LXuVNg>g<X-weAY<zd>gk>KYb+=9lVRCs)+79j>TPzYP-K
z>iz#iC&<5!n|K<aWsHjV|M!(472oV?DlUkD%D$Qz7q7v}J`aZ7s<sZ+vl6{dG1N>~
zuBg?Lyaqa_tR_nVTt3!xDP9AaUy~^%;=!=%XZ<Yjd37At<_wJ5GePw`4~N4Z?k~yz
zS&-5SxGrggr5g}!lfc3d{-5!P_uq%1^^c`1Y6`(>8bETOv<0F;<#qUfhJD_DAKD_R
z0r!7Fc@0$eSUNDc!0I7O2L=x$whxT$Fo~fAbax7<oP>_6D0u&ww6vkFVF~E$oBAie
zE4=@zmp066SOJpv{xiw9rbHTgce?gU<g&i`A%ld&Bt{Q-pZ)*?1E}u^%D+~ib%o$O
z#W)4j#sh`7_y2dipteCxnKbBp&;alMZ~ubZ2la6N+whl&_M_EHaGvA{HD|K}>4&tP
z-k!8}U<Hl+fW|60K>bu}vHw4;b}=%9OR(8l&0=D(s$yoaiedqcH85E}U|<Xv6tL2s
z!NB4;m%*XYu3=5BX9r3fvi|>NP(RJ1{{Lza?NI-JF^IOP|34c<8`S@w45C4OfDNE<
z^Zpx<*-+Q81(fc*{|3ZD>ezr#@Bi;KwP!-wWT1Vr-v9siSbb+;1hrS{!29?Ab%c5%
z#x3eWZ3i##K7LS}S{CF-@BeQ=?LV22;%{I-d;foP)1rYvI;0fNKWWjxAQw^&=kK&=
zV9-Q_>6?|=dl;B%Dx@nc8W^-dX4cPPF!BEXW@7l9n{}Y`r7aa0T0v<F)Hk<PsAtfh
z!oUD(yViPoSb)mhRLus4@F@9xmJST9^}l{z1Erl*O$LQTO#xWD7t&rZWNND^{sGB1
zlYb)Ro9%Dm`DO|<-^^03K+ZRyv-lzTX8XbV`Oth5!oa9Ki-E;10dj6qqg}&}@F)SR
zy37lD(7v~ZtpfM!v>GOcM9qW$ljj&Qfch<ta~UJjY8V-k=O{6N$}GoCoS=3$=svLk
z@Bgo7S~M`IhSb2q>outVrxsEK=U0Z5e6y>mf%;<(ia!wfe<F5&)VDpZfcRtEPq;q<
z!Tw-PDokK-*vlbPQv@}860+IbPQt@z7S!xHXkp|w8D{oexY@H97`5jxFr^tYF*xjF
z|4~x{HG2w**|~7D=RnOy5C68sFtZ)uX2*ct&6HHb#NfD>eNRm()a<D!W(&g2#uc~A
zRzuC+`V?+9ByO40=P(F>+TF=>7??qQ!(`B&z;dWP(~<4jx)N^BR2+VIwi{+oE!>_^
zupiixLFc{9Ww2<pYd8Q(L$#h4Q1X0oC%Dfek=)7P0O}7UcY^B~j^s{;1WN}7aGwuc
zrYbPBgYrt<N2a!#vL9l$3J)ICO#2CLCnst?H~_0F>b`^O`Ym7KZpIa-$2LRVyyYa^
z&9fL7Ybu~&Far?=;d2h0OZv{s;K8tEF5KK{*uw%*4{a%gn;XW!SW^i#cP7Hzx<8LA
z!lRn*c`$5og_&DF>oTN%1D!dar62}A3$sfRoTuy6PQ%<R3O9QOxcv(boA5bo`|4vJ
zSJY2rZnJb?=meD)wa|XErNZwWpgwaVXsp(dxee6L2AvBA>Blne@L*u*u~c9P0EMxw
zLgNl-m<K}n6B0F9AZ3mNLlDSZTZhI*aDU8!AsE8{-;n6Vm;@CI0f|A)2!)u@#sTI#
zFoYq=g+t^TLF1%JAbHTfA??`=8rBcM=Xx7x&t@>Pe!u{lb5qft%^+v}fWZLTCq4o?
zM-?)@>y_yJ|Ai^S{ae9ft`-T*FTDS+5w%oc0Q<wfp-BK7HVO<uP<xp`c3LVh1Vj1E
zP<{xAZ@-|CF?lb8L;Xf@I{@sD^p{T<5;a-D`XJ`72F*)^fz(6IhWe?e18kN9Lj>Hv
z4h)e<>?k-}fgu{CKmC6rL-KzXCUAYEzz_oxvsGwhOw?pP05(g3Ar>SCat|o4G}JYm
z@c!$W>iz$@r9}ec1n>W=H611~w1C?oTEd_)XO3C};kH^=p*CBE`u~ZV4E3P81yrvj
zYRWX!stUK&dc)+H|0BsU)M^X2)#?kirD}38)ana^(i7S^Ofb?oi~=lefZE7Dptc35
zzVrV7bSb!9Q3GpNJe?Xo2hpwo?I8x0J>hfU?FxDC|4$1+V}9Dr3>=_7DrjscdGCMF
zc>fW{y$lYZ@dA*%r2+>-@?P*fz#8pl$k~aO3IYttdmBJ%XF$}jFeLANzyKO^0QEt%
zn;8@!;tUPRd;fsc6*%r?kbsIgB=7wPQVSXv)&R}zK*SjtlJ|n|XmA1XwVN3lEESj-
zlJ|Z9jctSax@SOb5s;ksUw6>>7x;{7@4xP#_OFKbU-zTl|DS^Pt}uk!FAxLuy+LiI
z`q>X09QXZ;2zU7~#iE+Qp{C_^MSavS5%2#m|AP9$-v9qUfTRzmHc(&8Vb1?A@UbvM
z$XFOSZXjbIRWP-s8ld&n|G#+uf4b9FL4cvY*~0;J-WzDWs{H~122lGI<X%vDS-<Qx
z===u;>jw-K9t^69^&ddvElh17I#iQk4>Zkz$FEW5GN5DLu(HKgp}rwe^9KW{d`Z=0
zhzIHO{{QT*r2@l7P<jQ8d4uMmK=V<MxhMt=kR4!gh64<tS`18}d16p`1QNH^bO5I(
z@SSl9p#8T>Q!(8QnyXP+TWiy`tk$M`nfL!ECmS0XYAh2O4uH>7WY{)CdnN-bs1K9;
zpM$~s{}+zr|7;+dA^ATSgZKZ>KS1*Y-v2*OXtZnCgRO2#DpX+b{{Q_<QlSBeK9W@E
z0HXIK6$XIlEsk>-B(&!+FsB(aGdS-1!H{Om0uuj`X3PkpKWNWlU{0z5%Q+;~faHEy
zfai5U^KT8HyM4Zc#}`3)#QXoFN{i(G|3Twy+Rfm7tDtc|2T)vj|8;F_sB3WX{{K>>
z(XQbNj`3F=@Bc4AW9A0l|6e?4r~}>A`r<}IU4w=9{}&e;>Kbgk|Gzk4y?}uUDu2WK
zudAl_|3`nl|G(Y=+Rq7^7q(@%cLG#?Byup!0L{hJD!A&{I@~*v=*6%E!VlH4^kU#a
zu>Ut8*bF&HY!(>1(TPE#){Egnq89@*Sj+)#rU00)5UOLVaPNergMdh)CW8)G%)ws=
z)LsXj0g>o+>K|N8^Zzvn+fRpwi-7?&PoL<;zyuNV2haaAFtJ4-&*Os4NdVuA#eh7Y
zYqQ|q0ni)<sGI@qxwdt<0os4908&5EnLz_|4#dP{1{vD~Mv%AxSUj0Q$2I}HPul^M
zra|`{faX6YDl>4{G~7EdF`2=|HbDWT-UF;&nIQtShialTLqNh(29}A*3?UPh84Wxb
znpDC4y1!QyLF2EWI|U%~-Of`%bK2g2oqIv&`Fk)hOaZI=v$YmX|Nob0lW^~ZO#=%<
zLNbFxLJLEJ_n&M{kXS-8gNyf{+`kDa49y6BHZNG;-z(tzO1%I7lLXo4xR1dCG$-!;
z*I5;+mc{!|*2jbt1{N4Uq=m)K`%f0+4#_`zY$wz+a5U62a6sm(Hy1E4v3x)dXXLO2
zg)1mr!1LVy|CNH~oIrC;pfP3(MFs)T{%Q{f{tdNePHm~0OboSV&TX}3UQo7o8z?P;
z<U%zWPr>9MY=|7pUeLTeXs<me4x#f$BA|L1bY8Ug|0R;3v!5aE-E@S3i6sQK-T^ef
zzrT?II&aIM1JaM=W(M!S;)T%t=UZU&N#1{&BAfR$uz<!}L1mNo|Ajw6_g;d|PY2y)
z0KNOt1mq5feGE0=aGu9d0=^UaPg5_5?=TO%-vcyWnE)~ewDuWPwn5EX2~q<(PZLRO
zDrir+V-tf8)Erlcn*ZRl{~P8t@Ob}eGOS5vFbPS%SqG|5L3+XGNi%FbVyo}~R0n|f
zse;5o>!EEG9wLh|djJ3T1|$axbJ*GTpgSD*Co=FfKW1PF|KA{2GhZPfq_YilejLB!
zT!tA1UF-}FO`v<cet`D#@Mw23Fgna-XaL=x5YnPx2AXTAf1)K)^T)cv`~N>#(A_x=
zyBR=dCWG$LVFIlys(<=R1e9;<AN<qdk%#1E(0VVJc&9xB0}m%e9CS9m2Lpo)Os@XH
zAGn^$e?VpF->cyB?-@3n0o}s@nzsa%W1#cE_Ai92Z2`FrbhdUwGJ^nkoy$T78PI*P
zptU5RFl|`KAOor|K>5Yu00T4V>|gKy|2~4w?grhf016|}{b?Qy8w!XFrwSb5lmK!I
zW;p%%iWE*V`k*_X<}s+i{oL>$bmyf4h(CKi149i1+Zs?i5X1+EW5Zt^@Be?!Lc(GF
z5fnErWDo(Rage=G|8q=O2%7u&`>>&rfdlG)9wh%W)-QhzIxkTYWFE-x9t`V2Ys<jr
zzk|~UZZmsvn8^$=^B?FAZt&hF4~F%ivokIbA76hBal{uRB)<MSBFEQETTuI9-2u|l
z#GkV`>|lb}@#ikG9UCEbfbKpgB5eK?;s_fiNZ9-Z-PsHcn{^x(2@H&&d<mmLYzD^v
zJ+Lz;K;@XF0y7Kf><Q?+JowyWP}vKbhp&GRS|`Np0%osgYAb)q2+FSlp!h6b$q35B
z0^l<GudOVozA1<7kLD>~2|h0iBq!qi*On0^SHJ&vMe$4U{zH(sg!f;Ymmu+SgqV!?
zUz@8Sv6^It3*|2v1VFSS<nAp6@4q%XL2{7uDAt0`dj_B14BDS)tH9tefssK5<PXrA
z4qFAt9#T+xOw<x!uw_tSuvB0Mt<TZWXJ%kb)N%lc3DhbusD*0Y|Ch)i$XKh%a3NHa
zt;kZ7nZe>E15?dA=C)esdW2ej<~Gpz+_iq7bqb7%AaTce3>!dZIm}{sVd=me0FtwG
zFfstiSu!vO*78C0TQV>QA+dwuYzO8Lh#p2GsGd-`90PM05<48uc3@6`=wV=k>Pdvl
zF)$|~v6JC!2j&#e+@hreGZ#cJ)Qt|z+z>t^#LW)Od=Ng=YzJn35Z~58fB|He^-Bhp
z`ghE2APibVm#WFg03J)!XKn+H1z9g(2K9YJKzE*5FJMk}oW}r~)3m8y2U&9mTHEE&
z!~nVvp3D3HoV}oV88kUix&p~91k1tf@@HzZRrvQWQS&{xj|sCAlny}Y(1T&M0t4e8
z&^^>AK;-}=O*4Sko9s_yP=Tgv8&Ew9s-r<=_{2sA1yCAq{?`CH--Q9(N1Df=0V>zM
z|NnUkD$gtx{{IK%V~2T6pmS#!K=WImb<NrH85luzukru?|Lgz%6bS#%R^<KvZ>jZv
zW>EhqMNbAa7W{pobv*-XeICT`AUi>MzElfz4j_X>1L%DHmdBtqG#cK2EgyO?Fm_nl
zGcbel87ORF>I=05KzG1^+VVP}dl<d{T5h#e`2W^}fw9Mff!|V}nSlYcF3DjR!wJy3
zd2Ja6Mu%Ap9-#9hYK^?xY!x^d!Qo}>-Das!z*uYI4O;61I<JPO*2ozwUu*0Pl>_lD
zA`&$#G-^$q+rm2&)NCC%7;H74FeF0T?4WanKw_Z!VxlL*1X~6s1~8kGVTP>(3xw^-
zkO7*r2Z>L3$)EtDCvq|rfN4*L3R?$;4^Z|FTZe{*L@$OkD1QN{4`-{O0BUc5(vl9S
z4hF4_ahSwVVClfXTkGK6R;vi|*8|X)4`Zzo*gqi<Ip?-oMUWq0a?T*XT7cSf-v7S|
z!s4P-3tTp7nC}JOf%K%IuE78jwic0~I0vuwTfo5W{r~?3>;LF!o<RV#F3BQ+A;tUu
z*S#S3H8wJU*7#X~)~!PNjw?DqYm>bH|1ALbzyANtU|{?OI&U7nK1+v%0i`dY-vT+0
z6O<+!?HWubDl^(N+BH~ARAvOtb=XW)W^`$^YjBvT%;?c**WfZynGv+kz+<8^V*u!G
zABTAi8lZOBL}dm6TZPBqd<mL|1-0K`VxYDi$i1NT6*D;*BtZ2)sE;z!lR*;1p6SUT
z1)?4HF(g=eGPi)@q?RF6$JSv1gT+f`NI%WNR>$Hc^Aw1jt&Sxp^8_&4!4<R*gtwN>
zyRFvUyUo_2{(qv^|NpffAoc@L`eCm11jki^LlZ*`%>0@LkogA~EIDE3yMoLFn_tra
zW}}(!+*a%EjATBD{Q+vebDJgTUOWd-+lFOLEyzur4B$2*h;7Tj{@>yylSm@R|Nme&
zGuVRM%wh483DS>bu+_0;0Nq`|90Hf;WDWqc!DcZ#AhBJL*dB1U0|SdCC$kR{pV5+&
z*#^$%WPtQ*9o&%npX?BMcO6il&ytggA<=8iKDd}C6S#j`(-5v>>%hih$;rf#=*7SY
zk$2Sr^^HJlyFmRTP`?P&Kl1)-+QY#39p%0q(E7Xm3mHV9<)I2F4T8(VMg{>r76$M=
z_hhBLNhG8_Pv#a&2KgUgw=;z5STYDOSb9R^o*`7nv5CRNVG=_GI6u3A(#{43%=83{
zZ*Y17g&A+H8z>ztU?4YbfX@E6c!`L2TZTWNG!Kb;aJs0+NIMWUOah4<&^QI9Cr%~_
zu;0Mxg-Hd84K4>k>CloBM>=v~ATzC;S_`oUo_?4Tz5cz0iP<`EE1;(t>jezlj++>G
zplu=!O9f^JOHBq=Sp8F|1#a6JfXhh89d-fUe~m3c?JrPy3@TG6G=lD1_^=by9`*kJ
ze+y_Gp!Z*6@IBd$jSK>yc0Z&%T-?CG_!U(C!OtY#i@1L{q^3X`d}j}6EiGsq6g0jG
zx&sL`z6L4}?G+9%c>g_G3tGcbQz%{G{r{_J<G+Rk`HzelHF?q%b`JzVcb+rYEm*)%
z|G!EEbnm%cf&xSR!~zD#xr_~<b<N)Yzx)K%>5lstQy}~gmLNWe4Vn*tl+$0Hg81J5
zfBAy?xsWpa%SEV|p?>rKw~q4|RY3Y2_c0hi#NU4e@j?CahJ6h&pfa{$Uqb|F9b%md
zXdQzQs|N$a2mOf*jFaRUSSHCca7>bCOaZNvvsGBYFsYxhVbXfWmWld|9h3YSCrrv`
zoH8Mw5wyNp!B*h_!(@2|iOKfh{ZtB*?lWji`p=*<p&oqRG{fZi;By8*bv@%md+0ck
zJ);4r|2cU-gUjT2hJeZS3?bfs7B@oO>I!lb$h{ynpfy_F|9?O9U;wYD1+9b4@czrT
z6C@96OMt=zbf=5=|Cwt+YuiBa1Uh#Tv<B1ruc59?0rLy*|L=B!%<}%TDi$=pW5vwC
z2s*po`afd^=p0ALIj##`K<Nh5_pnr8JOD~#HTg_!A;}DoJMkDlgYLn$fVJKBH!|#i
zmQiOw<r63kc>jsW1=U?pH`##tq85n^G0lq@cqS?`M0o!xT<QJ)|6K5xO9S|>UJmcS
z2A!a_*^qH6gHXsm5U#b5{)&MsXnnu;UjtiP1qZ=IO$NvM`5p|8^O$X*bI~2P3c^f@
zni2~j;w%#&;tWS@6@(@xYKoLX#F;}t;vg}{y$k_~nj(czaTO$Si9}720+6`FJeCQd
zeB!~tQj(}CQUnrnoX0GY|59k8ey2#W!#tLPhPs9T4+fTyL`{)uh&<B^xLI=<R1!5s
z%Aw*rp!zBu=COdr<9s|ASY#44MQWk)E1>fA4)a(*ZAcFf2Idz~e=UWmVQv7K?YNi0
z1}eS?DxLrqpTpde|5BJqzf)qd<2+^;D0_*+JmwRiHAWr`%r3SH!Xb&85=>BiEg*d$
zF-NdlB|vlgpm0see<>WI-zmZ9Fps$hwBE;qfw>@2Q-T?)FCqV>gP?vVXip4t4(Q%s
z(0voO3W1vvH6;QeYM3%WW;@Ph*kh~UAe5-d(g+b}ECGw}W$>|u#N`pFI9NSM47A@S
zQInwwEWVG?#e;#FBT<v#D40KwF(Ch?gOGkF3uuqz6b}ZbH?|4^6B9K#q4qLbfX$!F
zppyU6F;Kr#B*AeWqe=ctCnfz(i2#RrOnX3i0+i45Uj{1bcX9@R*5c*A4BP~jp95N-
z?7_fr!B!#IC{a^lBGld;P;+B!6@rx#H6;R|;;^))0ySfj<2=R^D0_;-JSHFLy6A@d
zm%$)6Omv*bn3Df8*a&K$P6K#dG-HdcLU2%`rUb}52FH1f5m5V7@?Qo!>32#@aGb|z
z17%Nin8)}9wDuA-hnoK~I7q)!0%WdD{>%DL`kj(O4)YkVfYxMz%ecA*8SlTkj2;Y(
zXFzM}L1(vu*VF(1{|3B{=Kp_CyIKcye-EgA?fw5hNUsU#d~VR3f(HX*LPK4Hg9ig6
zD6Ty`7#LGPZ5R&*Mh{5(X9VrP2?4nUloq`I>P)RQNNTGMNooV{*PO>7QfrvhRvQZ8
zJI-TtX{c+6@cyflYm>mhpOEb2;QhZZ5~RM?G^wptI;ky{qk*ATI=QVjAi1s9FuASP
zI;kyGlcBEGI=Kzh=cqOD2A%it2eby=`~QCxP#Nz1|Gx|*EEz!j8qgSGLtO)i2CX9k
z?f>Bct<wdywY~ppf3!$sh-jGCP~ySBumBX6-hZ|4Ld8I9k3i|(0yIVm2?OvRqZ!_R
zwRc)7Ff@b8MNr=lq#oQ)Yyz*d1C5nT@&2nl6(rs;uc5<(fdS-KkXR#BtOwL*f#fL$
z=vsK~RH&Q{s4fGgKkvWVferH-TtMR9f3nYl#{NL-#UN|Nv|~YI$QFqVGra%zENouL
zAOY$x+dp97_h4X~+VGHpC;7jV1E`-=zxVgFn!~@RHPkh%0NrU@^ZfTT@4woz4RsA`
zy#H#8c7oQIb~1qGH$iUSVA04B;r&<ZFKA94Hg?b$*RUg0Q@#$g{;H<SW1aV3t-DBa
z2SPRVel^rJ?5XMU(DVMQbr5nlf>x&Y|DOjz^%J<ho!7tuPK)yzK=;=l@&2m?x-Wst
z`>&QGWNurl6ROY9GLZpv_dJ6K!z|F81Jb^|AW_gAVYUjvP9e$6BA~oklk8Pd!@;}^
zHYN_bI}B8JO;P-h(D%1S*Vf@bsNZ1#YG*CfLX0&RYW{x>65FT+zK=D<`+xUE@4u%G
zg6si}!-32LnGZE{1*qNw)lCx^8DcybSa=&48Dbg|8B{D386uF>!R_{7NZtrFivigz
z2F5oazrn{qEE@j*-_Ho2qp+!|g0{01A@_7O>}z1~{=4>U^S%ZKP<^UD|Nno-d5jJX
zpg9WX%i#NzLHl{V|E_8Tol6Y5ixx7sq-p5Ez{t?t%m4~^9`8T@TEX>h6T=(OzAf)R
znT5@D4FVuGXpM#U|4u>uIiR&M;4?cs^ye@zf!Y_~af^KnJ3#RX8cS=K*C68kCvz#7
zzmFjSw09XkzX86>w&NsNZXN?@Jvsx#?2fH9HQ;l33ZVK^!D{v~D1gRjK>OOf|6~Tj
z;u0zc%0DvRe==hm_BALp+-r~l-OmHc2ldXEE4=@1umq`d*ux;>{deokhItJNpnbof
z@(q;Uz5i+$!qh_eYdS&U=l%cR0n0=N3lGrLC*y0-xxVmoLP2ep{fP`Y&~{A=NIj@+
zQ!`t+0u=Y4HVmkp<H5kh3$m|aUxNmyUDfcfLC4|%152Yc186LS(fhB%!sdMq1~5KI
zEm+;Y1`Uup@EGu4huVgD4JHi-86-e*AUA^cWPAU$&ulozAkZ+c0er7Dk~pYbumP#{
z{<|`?d0vAB$o~xo8F)Zqp!+Bq<~4xI5srp=4Gu{9BpYrsFf>Xtuz=PBfW~}4>a7z&
z`Q5<~Tvj{=twUYO2r5fp{CdzG-G3LI1;<+hgHI#0yl|My06L41(P7^I8x8v!TtH@l
z^mzYWRSR;D!@U0oU}9i590H%o#^U{VU8nc||4Tq}-hUm>g6aQ%euDP4doWD<!@&4T
z12*3W9vgIE0N)!0juS*bL<AHcpf~`X-%;z~u?{reSKl1q02<o_jqQNilA!bRL1T`P
zIl*ab7#LrI=8NFtI+hL$|3T+G;W3+qNV5ZAWAvakETBF3pfm#-;|A3e_5Gl6c?Lx=
zdp%QIc=K~R@Bja0C)6|8gg3K;*n*(5X~LV2f!K+lv@xNc!6ba8`F_ydrl9+VCfsLm
zft-!$4iQuJu9&c&!61COd_CxFQHuu*9Oa!742|{-HlVxGYTZ1q)p}`OtI4vwX3N0z
zD<tJdT_VSa2GBTct+V5`T9+V^S}pHs6XO|FKxZP<YFbaLIcYp?qCJBEXxwz7J%hxA
z`wSd4$F!$SxDUEFX(}j>pp<{!|Nn!_zeYy}(7I0sQ295}iGiolkwIdj6N3P#OvF}h
zdjJ1-6<ThB)qwOt)q(HX1>H>zzN@-Qx}s*Tas}wjf|}dL6*WJt!DqmO)65@#!-7oE
z`WFTX{rL>`p!+^S`%^)E7tp?>@F;e>@VyLL^|7xjK;?UKH4{U43xgI&Z+!~r-fO>?
zVD^&N72bdR!09kqg~8tYkKabnIs<6B(ePlH0=mN%Jl6v{2MjzHmdL;Zn)3v$M+5bN
z>szEmKzDt6|M8m(b<>uREC#Lmt{b5JuPZ__*~~!qAv(@u$Z_1uprYN$0Gb;OfZm}P
z03OfY$B<(E0JP49Ax66syavt#)DG4Lx3L*K>>q&QfWbi<w8nBCgNb%0!vu$U3<mZO
z1i<qo)(~33`hf$8FJb=xypCJI{sDL&G>82IMg~jJ7@yZKk@~I&p!<jgKyC*0(Y*io
z-qoMWU=P|?>oD)X1<3!P@c<8o$)LU-I8H$0QBeQuOl)M}(F2_w@5ms49u5h+80<mj
zdjIjA2n~x1NMUhg(1eB7|No$SYwA0}XY=rY!o*<?gNoxM&^+lrP+ye8`~SX$Aise2
zHF*E=nF%^~0x6tiK;hKb$iM@de}{~nOtN5Ld<vQ`hS%%+K>Jf6=S|z#Jz!u4m0NZP
z82IfLF#NY`;QtR!-!;<U`;KdNYFE_UH?FApVO^2*{r~@@YybZzZT<g0Y0Cfqpmhe0
z^O$AAXR+Ib?`B}DpY?#jVIM<C{p=SY+NXa00?_?IE}%LQRM&#eUa>g9Frl9PaE15(
zKj5_n4)d6{*jfuP*#G~)P(Ry4pnlFn0nj-wwYJ_B_LiV@#IylwJ|Cv};QNWt%`bqO
z?+GdMnL=!>85!*V|HooJXm24?0MvXjO!GHjbAJHD{NFDj<}-e=wPp~o|Ns93ru#wZ
zobdzHd?`%xcVIK$0cw6H)ch&7)(kB6|NsBNVm|2ZxCv16<<QO7p8x;9!(ImT@G*dz
zuL(8Z#MYXD(H=Axg%SRs{K{wmHD3v8z6UgZ9kl1$gUq);i(dtZ`M<zzEr)pwSFHaZ
zV6e7yU@+e8z)(Mnaf$~6!yTxZYM5s7V>43#YGx_K%?u6J|35HTTM953?-qcW*#R|E
z3vA{*28cW7F*s<?XU1kG1Jq2&`lopeI@bUHFj!l%Fc|M<fthInIt!$}^>GDgt)ll|
zxk}JpLeM%X(78PIX`uZ?a;f#Tw=3#nE`!oE_zbA}-QaZ#Zy;^Cz6Dbh|IYxm(JdJm
z74|P=0N*J-fsr8xJin^X)YiO+fg@Clp(T8;f?4>=A9c2x3@a@)4=~iPd_67Ilc6C|
zlYtSU7PPLKQ4ut!3YtT*bYN6MVk^Vgp!T5m{~xTj4h$<2y$*o(95qaIV$hjs4_g1m
zwkCWfi``6n&>RQbn()2H>}Kz0U<A$ESSm0u!_<J<A2aPi>)P1X%(MrMPqVE7)mfeK
z46LwqZ%{r1j6c(!fgNPdOnaz#i3}N_I?IEh_kc~p`-FsKX3+WKUm$GIdc=P(y#N1u
z0^x(?{v*l#e*tU1XtywMf!i;&(x7|pWk74vL2W9F1_oa5|Nrk=Kj2*rc8e_oD{Q?^
zp%#OJ<01x;*>fTO1hp|d7<x@0^KNyG=KsNScV|HBTtVldAi1Fj!3VkVe+|qXptcie
zeE?`ZtM!xr|9j>$FoM<&faV-QWwQ7G|AEl;UJ@P*J!cT+fc>@y!3UeW#?pa74(x7a
zBzJ3o=N2UjH5lX^oBltU>CC_i3RBQInIN?t$qWoU%#bxnptYKyHVTs4H$d26^Ou0s
zcOsh&nYUCZ)C8H$0Gh*<o2d*j9~9r9zA$M2CaA57X6_CobJx@`NUQ<L*Dy#!Y56x0
zJ`0%7z<8enxxKs}sf`S3gM#WCP&?WCuT^2AJwpMst)T<zBU#L6sIjPLm|(G=p~3sF
zYbAK?8D#!|!TYb&MUWdoZ5&Yh8PrztVCc?ZV7xa27Du4=IVg^x{UjMQ`#|TOf$am0
zU4z<59t;dIHL21S7V{ZeK=yk7b?vOFm9B)Y8Da7MD-{b``vB^<Hvea6@&5DvCa4T@
z-1q-TV?2Y7Edv8T=>C*M4kw3NFXw5sn$Dp1tIkAw1_Mx<1EmWOhAz<hAMjcea2jfa
ztSxVDX2@w?%#dJ_z`*bQ*UcByp9P)uZF9gi0Mz#cwSz$YqJ(3P0X7dnbrpj|Lp?)F
z!+eI4hW!i`4fh#p8vZjhG%zyAfbKK`oks<ln+3%ssQn7MJI1epMS+3wE_~e-ID8V}
z_c*G6+DeG{uy_dSXL<j%Gz6t_?>`|Y>*q>1)bD={Id8aLy24h$05l#8K0DC<0f_wq
zbcYydY>Nlnr=9;u#QU#gAm|=jP~WR&|BC?c|D_YX|Ac_<om8o@=dJ*i-5~eX?3V}t
z>q)*{u{)80$3hWwcUox*1LGagStJ)gWhThI1(^&2`x6;tpmAyfYLCF&42q|k!^Rcf
z|Nl+|jbRnkg7duqRO~HiysaP;bWa^)PC+e01E@@Z$o(sX#6M$*_h0jupmYcd3s9N@
zt)1}x|JM;RX2GZc67&B5cOjH7(6FB&!+Ji$gogPHDd2dz&ro9VpP`~=iAI3;Upr2S
zI))b@IZ(UDVn0I;=*%kbzxK9Zxh94)ptT&Jbnm#2;Y>q4Lk@VZ=&#;fP}*|X10E|B
z0Npp{{a5@hWS&9%Dr6i}95n8>prMI@0i@6S@9NHm`3yNAyBd}-uz3G3R)vV0M1t&c
zY+y)ejAtmBkjMbK!xpsXK%z08p#r)WoySs{p#kJyxETvUb8^KGL1_$Hw&{S<ntm&I
zJPvdoeh%n-RPVn!o}lqRkb6OC1ymkG!wIxr&j6C{+Yf|fF_?hb=rt))BA|Qb>N~;b
z<4S<WU>)Z$2-Glm<XCEg;vI614|X;FYmn7|+PI+dCM46%t|m*m0#sfFIv>#sbas*p
zbUwfbl4D@J1*&&<z|zouMg|RN`tgB}W2OB64{G0n&TMH&X3zkaN&o+^t^X}Ot)U8Z
z@6!K;p#789%?w-(RSY8admb2o_D+J%5%T{3zZJAkwr2k0Y2Y=*pfaxI;kBA%C6Sus
z0|qs7eguTHXqb2~@Sg?8LlZ*<)J)$-y9Ng9#|&Jcyw;G&AW*;ehe0zZ0|RJ3iueEj
zy7hk#PXmQ%LluJts84ROfT5w*T6!9I|JCf@*J?5)uhlBw2&mQkJ+1!9&ucZAuS9B+
z9~jikzY$Q=a`2i51AnBU^8f!enUbJ6R1Xh^HXR1Wn-g%A$*{cCXxG33x;xoYli>nr
z-v+2Gs&7_s0L^cL)(C*s2Y}WFfby>QUug$W8SKH(`htP+rU|T#1In+Uw$0vy3<{v|
z2JJJg*{faAsLa4nGhZ1zPg`@*xB_&?U_&N@1SHJ=Sz0PHFj^!taMjO|FleY`;Fze$
zAmaW1pJILU3kOhqf%cEo?|NNP7ytNLUDYoUOJh)9>5+(41BiY+Ei6>P%4+NX3w6<x
zD{3Y^yar0spu1)#Dl$mawEPH|(8wSF%5(LzJs2G3FfVDeWMBZ<@BRPpUj5k&+>Ub@
z1Zpi;i8N#~#DK;oLG>Ugj%w|H7+5c6V66WkR!}d&IK|R}fxEu*2I#)KH_dVl9E}#>
zJIO%(9q_!V_g@)syM00h14s-sw$J0iz_g;#u0de(O9qBUy9SX-oeT_3_ZkG6{xyg+
znlXUNQ&7G%X{cae@ct|L5>$SJ^3p^L28M}d3=ET|gT!SFL3s^iuH(M{YbJkVU}&gh
zi1Gga=WnAq14B*n3xoP*(EKBVO~Vbyy=(PPe^+=g@cM%Ef$sf-lpn%dA#E}y8L0lf
zAiWdH85lr*smWZS2k)EhVf^92z|>%A!N6E+;d#wc6XtiuD^33zI23>U|5E$AN@U_g
z1|E<bK;@akJ_cwwNH>D)1(^#f8$f3%f#&0|hJzehIFy6@EAbE>4(8Bsm;e%&2KQS)
z<|2hdg7^R5UmFcj!oj5BI&wJhfY+@<-J;;Zz$nsC$pF#^@qYn0PE<hgf$9$_@O<`!
zGI)G~&NIEyXxE?vjZXtmd^Y}T&}r0%$E8I>8OW^?vLHWz;t(94`r!BntM~pZl?V=>
zGElktf6e6g3=EBm3_P_j4^IPyW#~HrtD4LLJ@5a&Wzqa)({K&hU);GMbD;h*0i6Q~
z(ht%5>tUl^g8?{xGa=^J^B=rcFX0gY@@KdN$c_V`dl5nNEEe8>1!sCNFidDvWDo)M
zd1{h93_xerfb+~g28o)@kEhiveR!>A>5M?o_#Q}2{p<;#{afI)-u#e3pk}{D0LVR{
zvq?a8JLoJ14+btsUvMAjjuFVZ2T<FlX8(f#?>|9?_5U9PfcBi#8U7Nn+6t<}{zQQK
zl%TdAXza`~ks-r_q0xbX@d~J206zN;H1-26Yf|<;gtQGNHZn+n+82$=3>~1l9CTJg
z%{FaNne(RRs&NG<UP0vz=w2Am`6O1Lv+f)i7_90UI6!MYtQr^?bwwE%k_;Cx=!r8h
zBndPy=uTr`0Nrs3nn!3zW?-<`&A`$yo1w+~|4;BdgTuW4puMXB9s3#hKy{?UJO-bI
z@eDkno`>uLJzexdHCgQHqr5~KszLSY&%pXwpfmj$6u|8xm&+9v3m7;+d*HqQ{{qiT
zInMnL+6x8Rzy85el|i7<k%1vplfkUUlDh)5z8Ivh*3mQ1Vip63H6sHDXumJ$ZYNNf
zJIrM)u}EO(@%}5p3LYD8VoYhY2DcM9K>HWG|NpqyY0tnnp@yLa)EB9X@Lbnv&%h4~
z7sq)F2HKqrOcVbwfbPg-0?q4!?k}`nz`*V}kI^90mVvQ;FM~<=UeF#7MumoI1_p~g
zpt$-0ZnHSfV`x}t!@x3W4ns$%?IF8BTNl0Xy)0__bHV2mE7Z^J0F`kH^?REtVCFb%
z0;h)v(4H_*T!ZbJ#K7a&$Kc|yis4A34MPXWZ4UFm_cC#K|NkKfvJ>QXkp15Oe?a=~
z`xpd3?H}*IB5OhS7=zpZ+PeTsgZgtp?q>k)WnhHvadH98wKmj&=OaMr9<=WpH0SBz
z{g-cMLk%dNzOSrjJzN2{rw(-H8DAsReBVYz28M~23=H*(r$PHlBtT^;vKXkZ;IN4S
zG;bXMnt!T$vb)0jkG~)|e&+q(GkGg`PLFZ&GzJFm|Nl=o^!=9r%@teLGbA*2|KCyD
z3_44<E`ova;)5wjcd+k6w0}cDX&h8%gXVrfZHSuf+7&g|jKSk|-hcc~g3^pdGK0Y6
zdIk>AxpE-4gVGKt-B>CxFio^);IRg^^ZxkFwE)#^EsrZe?KST|exjYW3=G<x4Emt?
zQP9|{_y7MNz;UpTK>&0{@kDdbeg?)L;PXA^Gw^`&4oI&>1B1Tz|C~VR{Q)YL7XSZ)
z=07?;85n9Uyg}_vu$i+~g8luX(Vl^)8FJ<^XfI9zc&=~B>k9DsEp3Y{y#N1^thYK{
z0ckriPS9@#&n->>>C*?@t2vL+rZKJ|pm{z6N23-41IRA@P6m#NTHtb80_0~<+uQs9
zcV3X$pgJ9vo<QvyNIZW%2x_}|{}s6k>hn1)0<Sj@X{dpu?S?s^eExMWH0~~d;ufl}
zQ@feL2GnnKn9HC8vI|t6fyapce*>=*a{$dBE`D9%{Z~j5($8R!0f*BZ1|9D|K5L=o
zIM(fzTnF0I265}RM9`U%j{E)xfZ{<P6c76tWI*nR$~%JEXw9As4AxN$7eHgcu<!zz
z?fw7nMNoPGv;PV%1obCD^**R9h3W_G`+|=LdjJ3W5pwPmgG48^9RunY*UN&&XaDKI
z;u{p^pgIgR_Y7+DgVH=Gzk<u=deC_Z)jJp%&l|w@`+&-2P&xyJ8)!Z1e$YH3WV~4g
zlx{(7Gf+9)Xx9L`GZtKTK+W{2xo=zn?koNO3pyK*!ExXJ7oa_E4*M7+8WI^eGLjh>
zVRNydz8z@K8^~Rta}Po7JN-@uCWm?dw?O6!s(lz3&w<7Uz;h)accHrl<c{Wl4J-}w
z85p4bodAm#h6@&;`{)jU_NxBZ1?@)w-Pa3Rcjf(;s}y7(_<XfQ1`bfXgZk*;dG7x|
zQ$gl{+zB$n`~R1TAb&yJQgwiV@f;8G{y%WoEQHiup!p?m*f>Jw)<N;y&<S@_N%Ou2
z(48GHcQJzQiJlk>%1i&i`}#n8_CR|A8dV`>CaBHc{1CEV()<6Xo0I>7@-2e_^vq_K
zhE|3K@Bg13g5n4~Upk+G0pae?H^Fh62wFc<#lpaN7PM~>JbnQV!-eqi1NdGako&;l
zSjzx9lLuVZgTewDrXrB=_zXG^k71%MxK4tp6Y&1a_Z8euvS(mu{?`E7;|Y^f@&3zq
zvoWqg045L0-<A&l|AX4mpuGg3{TB`Oa63WjS2o5qfabaxz;lM6vH_wVbZ;>OXiNqa
zCmsxyIt+|wKx2FGxmV<IDo|X2(gr9VKz$-m8R$5V!KBfyAp$f`)sP9d6MUX&O{;PR
zxPR2Z09sQa0PZ9G{{$KX2JJ~<@L;Goz`%G06#wvWv`Ao#K_07u+3EdPz!l_Q@Yq)q
z!vTu~1}11aJ5&D*)TU>w1nmO_#hv3kh6xMf87z?78@XDbJ1pM^JAn3n)-(9P@{9NX
z4;L*J7#cwO8si#3=c0=&lxK(t<ve5;$O&nyfWsGDM=*w1>}R+F>IY5!&v0R)J!1r@
z4Le~!1L(W~Chz|rmV(T2+{YjQN?RaxpmjnZHQs-DRYC3t#WN_pLH%<NhVnfOjHfdQ
z_CezsKxu$wLKXu<O_y?|Llc9{#CQgVMr8((MrZImFvrAr@Vui0q<_Qu7GxL5Euei{
zjrI&IpnfUTP9FxwQ=l`z;c;xSfWZexJTpuHwUO-_z-POA|MB1jnbVLAva6hhf$`Lu
zDT=@0V^aGbvhaZVw-XpyOhEHxptu9AVF9HX#|8$S#<&KST3am<P#?5rzjj5fre8rL
z7XwSJikC=jL~uoYrvvB?0|C&uqW51m(D|(z&2bG3^?UpZ>RTR(gzshj*JuUrTZ%x|
zptAmiq+Lev*~6guXUBaEDGgl=3|0@BI2t_}5-dP>D`YaTfX;)fnWF^0PX%;G53~#e
z^+yFjchM-@GBMQ8{J{Y3SO5H7QJ;LfqGtLl5zri6ef233??3Lm^*?_EfW{;s^Lz{!
zK<)|u$)M}7h{2*^1_J}A4S{SYsQyE?6J#c6O&BDe7<xc@!fkief%JgZUo>Pguz==J
zQ1pQM`zg{Dj{6uuZUvp~&r`qi2k5SbfW{~W25XQ%Ef_%O)-r<fLPHh<OZ^-#kwz_s
z1h6@pkUNQx{3`*v-@T^#lnAIl0<zcpkDDQ=47W^VG4Nn0<zZkv@doGkaV=!c6KL!L
z6t|%HAn(5{o{gZpbv6J02epwM=Q8+!;v0M}p_Ydp_`YLLusak$@e3N41jQfp99q!6
zB#^iWv>hq|s#78TWANHL1@FJiFF|9v4f7dTK<)*t8v>Ol@cY33GJjxTJOMf%8Bwo+
z>J4Ze3u*&^)8lMqaGS9CUxP;Teg@E);-GTb2h=`jj%Q%;{^K$i6hEML45$s`{XZ!X
zoR9V~fXXzLdQawMpg7#^$iM*_n+3T6G@fkzAJj(vzX4RQLDFOK6$ZxRE0F6pP<;kk
zF9FIUAh&cXGjM~#PrsAlKeVr^13J&Jp_zd}yM=+naV|pvsIMB*B47m?v#<43Ksl!g
zbe@F8eFlk+`3#&E{}~)R_A_u<$}@y{|7CjW!2muN5VS55)Q-2Yn9m?#v7aH#;y#0;
z_g|)?;JO;JRx|{3js@s!um;dQpLGo$yA>IDK>o5&WYF;b%QOSDhSd8nQ)Z_<0}r^&
zhor**@4rl;9rGEuLt5DWX}5sSb~ACD!yu#G!oUjZXK1%Du!Htcf!0Yv<1+-*MuMy<
zWs(GyjnH+Wpf$27-hY{NL2Gcm|1$n<t_QcRMQS~7UUzI_SQDzbs}9sQsLi~2E!2Yp
zbZ$OZXgdGD&`b`Snpe&hwc6elp>6_Jp_=0RYSoM@LemATYO^gwYP}3aLOoZAgr=|h
zSF3Ja(P_`XTd)3j8pt2=kqlh*Q5FFq&o}L>Z+|>Zeh&jz{a%XzXg<sF{>wNQ6ejg5
zrz;xm8AR$`FN5|L7J$z+<6vF}S{GKIak~N(UXZW?ue&V)>4AxX!qNLLBWPbOxV(j(
zivT(!!GnQY6_mC>bBvDr7<54Oga-rbMp!%15p=fXV^H133pyJZR5$ThDlo9jw1=Jd
zP}qXJezH>;d|wLa?nfE@PS6>P3?Q1xVIQc?!X^re0}lo+P<xldgMsHKY&;aS9~cxb
zp!N-T4WuFi2gu!!G2<goaMe$sGzm?|9ME(OvfBb`cL=!MxsL&~_8z?M(fj{z&>Bk-
zkUzog0{EE|te|zjHK4M{`~UA=(6}n58ct9;ZGfuD#IA<71tbnyBMdSh<Ok5$toNV)
zYdW17m^+mjm_oe{@P%qN$bs%R?^I@B1kD|WYC3@P73i!wke@>`+4A%|!D(0|Bbk98
z)>Z(?fyzh_&A@mhWQyW<`1%ph*vkY)4x4=oIly%wXdGf<BL_#LGD8A*+*<DchZ<0y
z^p0@_sQv`iNuY5GP`H8af&-nMiBu<n>NXBgz0)ukRM#>FbTl%tX}2(hI?Q9V=~QH5
z*Y9Ll<uH%Y0Cd)bMIwWp#R3Lq>xYcztQ{B_^dv!T;Mkd<v<2$xfc9oI%w-VhSjZsj
z!NADUUH|`&{%p`$wTujolNeM$<r!#=7)U*+P2T~MZwB3;&XC~2z>ooo3-AB`4%Y3I
z60xWUjc@$h3OZ8}qVL~TkUmh~xKR$Wb{MqQ4>Ugmn(L}ty1Jt7*k;H%qksPSI&AvC
z1XO>5(xUhOe_%H{?)(2ie-;BX=q?DzIsg9?K=YZk7QaL~G8qqf|NmDAvI8_8V^Pm|
ztfoQ=G!AZ9)4WRrv<|55Dd?P61`ber6I70a@~8Lzf2sQOA@@r_$D=@N&Luh)GO>IA
z`3oxlcpNAF2c4zR(b&krVVTHb0a+WA$HBmOr~+Tyg6?{U$89yVF5IeJQF8+kw_raX
z_#^_3+xf~BpffjWrJO6^alDTK630(}S2WB9#W8~kD2_qygTym~Ovp+$JF5o_ETFiy
zUdVV%PaZTb3O;*WB4jC>o%f$Vf2|cj_Xjd&fcnOTS`45yhC4cH8CW3U#pqE#1GN5#
z(Zc)xU)`EY=}L!1j3%J7vMg#DI3`+w>a0I6YwD#$CR8ynSk!{nRQ<UL8Xucb#lT`w
z#lX|Bn}G$?UW3-@pz#G6tabXl2JrnI4f7g6`_m;F<~4xEghA_KLFZ$D*0>s2EM-W9
z#7+J|&{|rHD$tlv{#FkLh82#J7-SIc2F-K)fv!(w;INipU^M&w|G)KK1_6hr|KPL1
zYRz7WSlcr01Er68vr{78|Nr=c{k)IC#-bAJFF{Znt)_XE2q;~E&h7-IMNpar=ezdD
z74;sV^(p@(LGv-7{df9v84SR7%=^E@`~SZcj+_2>c>n)j;kfC4gEwf~Iy9Yt#vUMP
zCHu}4#qZ!X<j}qd;{-+y9#CH$l<z_L92EbsI0w~*or+9spmJ8f6O@-3WI7U=*fWwD
zR)Nakn&f}rbN4~=4IpzAIgrZX{RGS5`U9UpY0AR;&#$MTauAenLFFLGZQ!zS0RsbQ
zo)TOp{{QV#)2>`mvqBqm7AmOi2$u8y|CfV-asL+NcFTUym@1?lr2{X^W-C{K<_SS#
z6Cl4@G%yH&?N4T40kzpd<r~QF^=_BpY2INT)0Iw0`<)R~&Vb^_aUatG(AptzyJubl
z2WZU@s0^@Jz`zO`qw)S9aS<G^^T6vz865X9f%bawfW~=1^A(LY3_aEi3<9BA2lzs*
z-0bS3f<!{KoaDf?<`F&6IP*dqhNg*@3>@_{E`aV|1>IeiP|tF>qM?=nw8okdlqNxL
zMZ^=6PNxmLpP|w)uR*|ChJhV4c4@HybSGtmZA}#@FM;Y+@ET80`%MJmAI1-$vd@Eo
z;R`6;g3h^xii6Jm0<~*nI%62TK;hGA!{7<ByIY3A9aJxY+yk$hY#2OX^-?|OA(2K~
z2C$ov-3dAi0%~>*sI3h4(_Tpb!TZk-(D?@`mJSR8p!E;1_0zR6;QM-+LfswoLcI>z
z)w&0XfX;mfjmbMP{C@&!7a`(?Q3bRQ3DidKv|*3~r`dfB0-ZJt@}M#a)W(C@&j8xr
zqXMd{K<m&w7#LoF^1nqTD1T>PZ3K;N>}6oFsAS+lDoY|jV-h&Z5=dDAT1)mn8+3-g
zy(I$!_}n#+|H1PP^FU{*{l5cRckd0_2Q?3LmfHU_ptbbg|NkEW&E<o}$f5TXrGW0+
zu;gG+aB^U<sEu(FvDEngpwsLB1JGIT+FcAC4)gwB0GVT{#ZVBc$p$)8iP2&2{|nk(
z3@(oI{-1#Q6O_MPK;woDdqI7L@3qzrpz@bt0muw^xXlCa*YW`E)9U180H1NJ-2pyh
z*`qP8!3T6_YAu(8UadzEtS_q2>B+#}$;rSL>ID%G_4=|8)EBaJV2S|Mm6i^y3qWl&
zO9!S46C)W|Iyo7*J3T>niXY$$^=go-<p>h#^km@d)MVg*nE`6!OpIgzjqhlH@{$Kb
zx&<izd;kBV!oaxu!W6~-6JTorKxG7Iyl#IYLky^YGJ%ny1k{%WweLXvEl~dnl)t_I
zgVuQd2d8(?p0b8Hpm6wB3fk`q8Vdx~+t!H;Cf<L(C4$=dp!OPQ3=Y&z2JL+St^aO#
z$RObT=bIy_e+7~UnGdoX)b<07X*<mOf5I}6p}>P7ZORnI|B$uppfRKa3=E(#NYI`h
z@BhCOL2J`NYu7<#8>meNYo}T||NjGOUxUUpK=<u|`eUH6a8TNDa$pc>)nZ_&N%jKu
zqrZU0Ghppt4~8@Y2FBeY$YZwqk^7L)y51UA)`9Lq`*Z3pw0r`cs|+efxxD|!g2$Zg
z9fDjy;gK8_>|H<q0fWOFhK%NY4ICgpH(Eo-C8`-%Kw|_Tx53MweGC?$JX7C!0W=P*
z18UQF|Njr}D?sOK7(jhg(7jULf6OXD{clhj0fnvi|Nk?<{!Ikkr<EGOz_`nWME`*M
z8lbccP7@0lK>h*mHL-Va@`w1xKZJ7s{0jwz8`M8M5dSbSc>gg4-9N*F-9IS}usBBU
zM|uDM2kxVT+zhJoy#N0P-6sQDU(W%mOF?n$!H^Qcz_=4MK5zq;=27akN@zQ7zjlSS
z%m4q7wEp*}4l@JjtQa1UIUWp*63xjBGWHAsj>!^1A^Nlb{|Al5H-qY}l-m`Jme4q@
zWMBc6>-BRVSD?h}y#IR|Z5SBpI}b2`?(_tufA9Z)eIa)I-vYhkQouUu|NrJ12GE$)
zg2otzDGhfRmVoNHnpcL`YB>Y1)japS)@Z}90(5rLg#Qc-wQ2zY;J&ej=QT@tNEtiP
zo`D6lrlwI7GCtU8!=Qqc2PA53gG4$t8B}XE0@qnW&RKs0+G|wvB5+-!EyIBs{}~KJ
zwcPAx#xv-IYPErA-B7J#AX?8-lL2(@V$4i?27{UL4EmsT^&SjKcNiGA-<YEK4>2Bi
zkdXsYmN1&Y+6|C!{j;zp6STjKu>{mNu~!IiZ0KYV0Iz>p$>5M|85GiRlEK9~k%6P(
zC4&d3Pt)|0LB^VaA;$a9Cr(iP>iy>vqyBX8{Fel1d>k~V2&yAN^(v?y1&xE%fBTIZ
z{`(l-fX1lmJ5PY})dNUc`F$3g4(EZ-T95$sSwQ_0?>`?GcG`pQZe_6KWMBl{2khj)
zAW<t8B+|*jpjs=92scpOTdU|L0;(5gdopl%|M{5OD9_N-u%BT`V?4u@Mtg=8pn9~X
zOY>T-M<8g;2xG0PM?g)B<F%Sqp4UKkM|=PIXxM1a0BQ@VfX!iK;0A^NY)1y(nT`w`
z;5cw(-~`11DEwzSGH}gQWZ?1s^Wi6GZ*aqWhCSYYKD=%E4@x)xUO>u>Kb#=Hf#$Co
z>Kb&s|9m)WnaF71!H}o{S_cd2`=YO#WnkO}DlcBZ^9a(s1}qLi<9-dv3?`7c{J(QX
zJ%eDQE$HkUmNlK4h&`J#?HRZmZ6RkBp^5V}+A@I8@jw&j1>KzsavPdBU!yJL3{o_4
ze$YL%Sk!~&Wf?$cV>vc4Txg7CZ~(Oj9Op5t>9l8H4b^0;OVng&n5hL>2aUt+Y&hJ`
zj>GL7INZ*O!|hz4b>oe;3=T6rA?^UVZKf>)XbqtZc&xLofdMqW398>f>sG!0ya(-J
zk?>%M2aWrH;|RWXwpO|Vv<4hBt`6FtYyJQKfA9YRYe9GTdjJ0?s@=@+A5=cpWInKT
zY+~R6wP!$cT%frK4~BRHiw1@civ`Rty#N1S!N9o1VT$5k_}In-Mkbs6icH|Orl2&?
zoXlX;sLbHd=*-{&Y9BN!GjP;edj!;Xc{qUXy9K3-a7%Uz(3mD@Y-^$hpFpQAgQR{Z
z_?&PHZ4kYe0dyaag5x{}4gF3A70_HJc<!>3!35+^{Z58Apz$wjM+Od1JE%F9Ap_K=
z2kjSZj%#4Cj$)8$v}*vJ#g`IZ^P>)wXPaMw`i=fOLHF=jTK)f5-^siTG-lxBz@V^{
zlYuFe>yTX_my2Gg7mFPz&D1*l2dznXQk==a=&%TU=KUNehyPz7a{qK-YxqIxLp=`J
z1$wyXZRG^df8ME4;jRG9u~=9C|G!m*iKD*imI%nMnr3Ct`V~e{9`^pDcXy#969@7<
z6xeJ9@R^a|J<iDIY=X+J@c%4!pgwB&%R_d-FJ1IDDl&0+|IwS;7|Y<%Xv<(@naE^O
ztK}s!(U!r(gCRDDfpHV4jRYQB1kXc))?7mRYT&aaLGc5M4^UV&YVt`;RAvC3A)*Q@
z2OBjRz-K5S=P6LX5j4gH?l(fm=e+;>r7$pVf{$T>>;bhgK<z6?`ObjY=V{l#ve1)Z
zPp;?x|N5Pv@|gj2ZX#bzCiAjdPdS4^$Xb3L(7DP^4F5ks>gJdo42&C5_k1caFk&+w
zG@rUKo<Szp<NtsCj+QP^`tkn%KNA!epmWF_<}yeulxH}Q%LSV61KZCL%K7~t$R5c2
zSBwvAUIR4G2rA1!X&RJ|!0QHW84L{O|Nmdpq9_p3!eD06!mwcm=#FUywl$#e2gM(9
zc!9#o`@gR%D8GWrTu^=m<yBCg_5S~74a_dkx*3oiAUhkC8GM=-gU5A1a}NTI$_zTG
znhcB+l^JvzRTy*{QWzLYH5eE{=gT&_Fc|1}F~~bY<{xAlRTwxxc7V(W*)vrIbk5AL
z0FXZlA?M%;fYd<6Ej#VO`R<v+JO+VATLz9q%?8k1GY9BiY)~3#c*VeA>+tJ$qSv3l
z6Wtj&8a;WRfc76w^yGa4TFYPP0lwc#qLGu20d&thI8QS$Fihm+V`!9TFbMTxu$dUo
zpkwLq9~8zCv0e^#jhws>YPkX|CVKKd@L-6#!N9m4w1*yCUV+jMEF3^-r%{=~p!qQa
z11O!!YBJ>1)O(45(yRGmh8V{thKxpKh82Zc3``D93?7~K3?7Z~3=V~w41Yo8`AmBT
zkD2xio}l^-R+dBSbW`l{@ekDA;PL+R@+fFdG*Od*1=LQ0lz~wO42<hNrYQc0-}P&=
zfPp1p>Es8<_x*y#ia>4!&2L&XFf@SN+FaMb0-Domjs}gp{>lWkM+!0^>*_)68}C0a
zLqYk)gMqySWN)D|1B=5V76nUr-aEFSyMP-UH0s-fD{3A%>N+(2|584ufx%%BJLn7|
z`N{RXB@^v=7l6xAd)^hGvAc=(ylbrMc`HEk{T2%tL?-{|EdZ4nljrl!0kzpdbMuqu
z^X`~DpLa{Briaet`MgUe+VgIhJfC-u_aDuxmJ0tD%(Un2uvB1hm}$>@(N^Kt@7eQt
zYZEp9{GC0Y_jJ>J-Um(ld7m^(F>o~fV&DOd6HcDRz%zM1?}N$nd7sqmT(YWW_tI6M
zK3k(a@0`i=d9O75=PgO(WDuCVpLfMXd)_&n_PjNX@w^2M%R%dq{{MsasX_Nu@-*CQ
zkf=H4v991G=<YQJlSWm@yb>slHk{&pVsVUtal$FyCk^v?7l8V!HOCYTYEF7rOjKn6
z^$R2#wRoR^+OiY1c%L-d^DdaE%D|Dx!64Xhiub`pdEPmodG|(n-UYQ94hA(RoGT`B
z@jhsDXW%IGXkY;CjR2jq<^A7tq6Y)xo96wz1&y%`422%xJ<0~1@w_#l^dIWQ2D)1h
z<X)Lt%>aW!Ee2!Ie(gqk-U`rt9TV+&D;nAvSU`CmG_L{jFJ!)hu>z!~Py>8No<L_j
zZ*8I%1JlfS-r7)W_B|ker!9jg=*)dk*#)Zqp<^yQh;{&PEy!F@TfqDOk4(r|J;MgD
zxuCn8n;1eGZ5d=b<9X{~dO&TJ&UoH>B)&>#JZ}RMU!yagw-Jf2(;3g(gv1A#*Nnth
z=#1xWLE?kVYenLN%xgp9gUoA(^X+*n3N^s-3mUrug=+^)4&*oQ|KBGz+A>&l#`AW<
z#BrCe?oUB;ViRro1R6o+YJtO6#L}L(V4^J_C{1u!H!wIf+Vk$IpW|HtTH^&u>!5i&
zi+bJy@BhER=d^?JtHpv+1MmOej)Ka3XdVU43kZ1sdAbqQjtBKaz5hI23R*MSJfFeF
zdI2-|F6CN<Cpt*`=r|mjK>PSW?Im|lbI6&OcR+jk(d!3j8&svyo<Rm(4wNS#b7jmH
zAh#zfGcru5=iTGM!0cm@0J?jJ8GK#?#ND8N_&45yOmMjZS|cIg{pZPF(0a+{{d_$2
zzkgR)H88M%$^oc)R`35`?}El{p#E&JNMOI<{oidSk{T}W|6g~4)j-Tmn7kVlo{SqD
z_cEk_&kvu+xFo#m{lBJK$X=P^P6kECc?>boG@H_B%K+LR!BeQg1Uk1EG)Jca>O*<|
zd6L*@%ixo!$-p$xmceJzY*5_s34qqqI?VgO1T<a*xpR@>i#BMkavvjT{W)mvkO8F6
zaUR1Q(D?wJw&1b>G=~Y^yFbyMPXKgZENC7J(x-X+(}RKGM|kJ^e;_x3+~+WlK>@^u
zn!^LyD+;nNQIm-YWF|<?aUO#YNFF2yav!K}EYx7&a9G430ZE_V)`G&x`~R1hpztZ~
zWat3re`G(+2f5`xbbRJpZKE}xfPN<fv%|iBHDL3!K<51em(AY)zbpiq<Ng2NpW;r2
zm!LDbK<Bj-cQAm;VJ3$~3?ju{42qz#3$%{hQh|}7F_yun*3%m_M>Pf1z5%&wqBY3Q
zAD}rCo}vuU9<G0&JTV8H&K5DKfYK3YT?M3W1C{rWZi4C@2%mwa(Vlk>v~A(iY0rDH
zP?JFs8Xh2X_JG5~o_7z(9FVxfJkWWDj0_W@Vxd}Wx}dWzCdTvbv6#<$pk~RERW&=8
zt^$oeOpNE9({P`60Z4D7Ja2(^8-u*#Tm~Ib`@-S{?;UU(Bc68w=zP>#F9U;`0~Q)J
z#{w#94p@Tgy~cP322dMqvJ?Zyq+bj?r5+3olkW3An6#hwiDMIkMW`2(U!pRD18D6N
zcud-!w-elVnD^%hsDJJK=i%E%y9O0Y2L@))Iyg}K3v^Gs2Sbn!1LJbg842+5&b<fW
zd!I@`^*N{>2k8aXouD`bo!J9g=LYUm6-$HW{W)rOYgdF%bF*vcWMBy|KV}y`waqSk
z$}v08UMXuw(45oPm7u!c%7KB=N`XPeT7f|xbl##B!~X-84;UOQ4=^x+#$iEqG^pP8
z{-fjxYST=LXW*Dr&nGcck%1S~CYz<mAURu+fiF~($#1qIgD_~#9;mLL^^k#ob|Qnw
zWYC%{MFx)9j0{4v85sm;9b^yy?d_elkU@M_BZJuNMg~!bCI+6F55a56Ic703NF-`9
zghTCSnt2d>z8~lgY0;Wg&^Qc3Ou<SfP~8YxUj(}ESVy}Rd^e^+ry_%Jp%%Ct2i*|>
zYOnHu*6w=${|`DF&&2!BgG!5p|NlUJH_-W8pfhc}|2#;Aw09Ul{WC_$SZ=@+2F9f?
zrYQb{pGj!3fU#x2BI6oRJ8%Lc;~CJM4&b<Gehglt10Ku&qc{_EHm{{4<C5mO1`p8r
zDWJHuRd~dks40*#QIQc`-%nIzTmtIjO!VaA0H;My-Zv9HdH+oGWZ<!MV342a$>3w@
zz`#DylL0hVRzJ~`A;i{!p&`+WO|FrXfdy=)!z12AF9C*$n!GP2dNP2{AZ?iF$sl6s
z1(uhX=*b`hW^*#IfX+6Z=*ge}<#WvBWbm|Q`1O0DCxZ%D%#%SQk>k%_Fq@P2!$eQe
zzSu{+Abui;fXYNq1_Ka#A}52(L}>;FOOEe%X1rwZn5f9OVxlL5MRQz(&qPlK6R;Xj
z2AheV3=R{eK;r}~YdXCc;QPx#?G#Xa=yx&HTPrZ6)Y^MjK<E4eJQ$cN^ye}pJI)2&
zHLNb+{oi3OjykHrVG)xJX#C#$&%Kq6@eD4OpfPd=mNm5sKJa?a(t#ng(Vjs8R$p5x
zFsy2nXHc1`0dg1HnnrmB1thi#XyXiMpEg+B1F9yTK?T-U2bl$~6Fm|BX|%^27XtZF
zzY9EHDgdoBSApi9K=TXUfA0PS<y%V!1}0D(dN43N0qs4ubYNHjb7!MHgF|OLg9nUn
zk-%`m`@j7}P~HReCqQK*$XuAapz@%7*eLpJ5*U~gl083o|F;iqs0ZI0xfhhq6Os=H
zc>lL|go>?%(hI?LbrS=qeG%jR=WZa9T2b%+|3U2q&^RixJHhAKBKI$`g$HQOp``;O
zgC!?3cnqNyd@e4t04OZMYzGFA9OSMb2Und&P#$q$;IRasPYpT486;-w!2dtdi=Ww&
z6Vf&T>20*<;{c6IL&_+|mWhgtQ@sDkF0@o+?6GuUPynq{2hAsf>LbvcBIw*a{kh@=
zpnVYz^Zrf&ujl%6ClxJD0%~nfUjyAUT|d`@!C~HCP(Lii`_CO)@Be=@YGb@aEJ1xS
zE(R7ShW}qc>klkFLFX&5tf^%P(c$5M?Cl5p4|Kk9A|v$NIiDN`#)VU+DE@|@2?laE
zXf2M#0w#vN2U#p2WeZCSsJ#a&TR`VPOl)K^f!_I*0xI{t|HvF{p4XrP8k+~T;T`8O
zcvvKW@{4UQs65A&XB?XteDr6F7l8I@LFX|Ny#L$=jYTkl_7+(ufX)hG%g~?AknFJc
z|At!Y%aAYt?YErwA9R*siua$}mfrvWPl5DFZ2p4Awm^MYNE@!ypc%a9_KhegE!78K
zt^oC4AbrZ)j2;Y3Ee*36SU~DQ^^7&B-Z{v^VYL8sR{ncgs|WwVb*+^H1CzBP6Ni<;
z|B0aeTviPK-&;OlV7CO#r-A0x7BGm^9o}3q(UC>N`;YY2MtRV^O#k12#6b68P1?`E
z5z4{jH|rsb#6)=phE90~kC}=rlCvCHcxE!P@HR5Cfcjr<6B$`J8s!>9CanPVgFoy9
z&1*C|vS@(934F%TBJldv4A5DPp!?q(_WgU%$;cvH$jQLsxai*%P@f(&_E%rcU=m(^
z6TIHf`~QE?nU*Hre{KnS|NplE)Gh**@1S{=n$JO?vYBbYaR!-?6Nl^qPPpi8WM_~8
zohP<3m_bHQnt=giro$u#35PwPy~}SGg2ux^V;J85|D`zW`Ii9N>)`;}rxnbgpxtE-
zI`5xHyQ{dzVIKo%|2b$rPXx5y!~2iaTu>PTVp}vYFwc6(Br(&GiMP>_iDMQcljO{Y
zOu~s?3~aL+nRq5TGI7j2$Ry(Z|NT~weW0^276vmY=!4Du`v%0eW?*2{2idppzYKKV
zXN$umh7I2T-^|r+W?*)h%OJ2Yn4zxF6Wp$zu~3*nV{tHplBLK0|Jq#){~YK3T>_dX
z3io0G^;7vB=l%uVB@B1(L`G0tO1=cSxsj1YqdsbP1<dVmcPlbUg4_#o_e@465s<rQ
zJ2FXl|9|%v5<d(A9f?fB8OaPRA<5tWf&AjI@2?JMJ_ZzilZ!!N`uZ&>FM;m+gSz<|
zD9jz_G5a(IGjM>$2te~n6D~6dO!&+oVhtJ(^<q$)7|Z~vr-PXkCI&O9Yz$`7*%-{E
zw=tN>!2AE}pN+u`5+HLN<}t>A>;<)z7X~vX6nZi+IzrM>j`yGIe;ejC6j&s(a5U^|
zDDnR9oe5f3?EU|BB>29zxeO``gBfZ<Jy?|VI~+iBJ|bZKP2hA0(!bZDm_f#afqCP?
zV1`K(iWvkZOlA-%^kf9x$HD`ucP0ii$-v^lv5DbC!)FGL1(z8PCA?x_1o<K46pNC6
z7uf8S1)CXOEfi*WwlJ9CNyzF3xdodUUW9Uh)*3oj)TU}z)T|7ybZla<DLBOfGT#K`
zuY^|&%ph|>cd9_j<NyEbTLK&$<}!#BoKyg*<4JhVAUxqS1INN(hAp99tnUgvK<BhD
zaLi<6;%E$J;3@P3<sSwSP*{N4cn$j+D!l)D#e&+?g`Qx$1VC|-=*7SRvJ12(1Qh0t
z!k{={WSAJtq)^Dkzy#{wfbv$N*Z=<@v1Vfio?=ag28SkwfCZl!wphCV{|_1q*Y5iN
z*KsZbPr)njm<dlJ2P4BoVFr$c!VEh==@VH^AtwU|$Xtm1Obj6V8{-)w^t%|?KxL-)
z|CehaX@^l`VK4(Y?KtdXlqm*{b3o2Gsqy}EO%!w<toNU5yw;$*vlSRpAmy|9S&)B0
zWj<)^-249*(B4PT+9D7A`79ei^WmU*1xTHA^&+^95Ch)xqoY3`Tqf_SjX!-&){7yf
zetrOGPIe9WeA+)(mwNyIzhFWQc<)V%{9c9}>&Xl<ptV2Xy72%5XU+Uqp#3{x9t?~x
zL2R&i3xkBk0tRV|0}PrT42&0%#2rCrep?)15cObS+_})0;ZS2RgGl}US0bUBtXUId
zLGAbd|3PItsQ)+9mVp<Pj%UV#Y0#Z_Y!l-dBE0|q+0Yowq!H@Hwr^rElLn{_0E#E?
z|NpKuHnNylCbBeu`mB((X|5^^jI%&zoFL}A72$i7bU<|>sO|&R)6hN-XfNoTkXkl7
z(E3@BpTXz(-7>BK%_-F{ekB4rJFB^tLBwG$gGP8}gPgqz17m%)M*wKAm#zK(|JIiO
z|69LgU`$vFUK1lyUw`vjy}gnMXs-h(-av8X{r?kaT_2+(Wc_1@_n#}4HT4ey!0Yek
zGceRg-2%;{@PO7_d;kAG0TiyFbuXZ{6J(y*rDCBoLsCtqbOm(GE@mM!!?I8=cs?{)
zkj!vyK_|nhg`Ny&7QAFQ5t7^>7t+!oSCbrEQS$_JkF+u<AMzA(u`u{7Vo+Gn$xsC{
zf1xHr1z25+cLiuY2}lf-wm@vyx`U9V95$e~PffCx2yBfBXzbmh?f?IpE@jZ3PEa37
zqvo-fUj2*T6_#HA|Ajn1WLNXT^BqVGba&#67oht2{|!*R?fu^<w$@%s1hnU}e!hnT
zC|`ljjCI%t={uPu|NmdB;ave59{|}4n#TaOu{{`^TY5orEL{u=j`RNC@&5n+2?OIy
z3)r1npmBCkS_0j*w(lV%-a%_ctr;2^njbS*SUrG@xlgobm;g=(_6#|enhcP&o%UWL
z%_|vr^ymHu%^6OqcVJi+?#U8YtH1~v$5IL3EnyM9SHP-P^OnfsP6j5>o)vJPcn+(b
zMa%y`H7$=sy#MFz1+71@nDhTnP38+d??1{<8{-*NYPD{ytJOSQQLD*rQmb`auMuRg
zCwQGYbEubq6=+<yHa<vXvK9jmXk34yJwpyC{wMus$f<W=RPp}*A9QykXibv=$nB7I
z8BU;kzQFSfpmYJAUjUsav|k%MCu*^PfvtHlgM~#31Di!BXzh`(tNwh}cc6Vf)(=?U
zHPkZLfX1vq>D2p=uqKFKGha%?`+x4qMp*{X_^^V-0bvIH4hDu$P6>;eS6(7Dr@Zw*
z<JGlXUh5J$92jc3y!Gl|u$ydTXJE2qXke&$<+ZNng>ywM2fGPK4%Bu9t?9AVe4hYj
zd-8F><`+}F8W=!gpuQ_8&3XS3=mm`xp{Up7<A9Ang2!d%fald1y#EL!*3?J@Xg723
zaG3l50wg>bI6!F&GOytnV(H+>3^@mlsSQLgbY@_%<N}rb42-p24hFTF!4;sh(?IDQ
zx7z>zKyy2_ngJFtwXnG@P@Mq_b5Pm>jbXt2Ink3(VqrXk1L&^WTFnrHT2;t7;noY(
z1?(Fd7-|EO+7{X~IMjFg7}R=rfaa#bcSU;tH~a`4SAAf;pTPk%_T~Nmza`jg2L%Qs
z^BJIWo}lzT(Vk%nx*tL{S(QL;hJ=TM3j^ac0pxrF%O9Y;0&2^E%0_zyCI)+l1_pZu
zMh2?~4Gf?>;{8WN5!8=pZf39mg>$W%Ra^ZttF~G<tF~G;tF}^gW`^+p45u8L7{F^m
zL1Sly9t@0*O-ve~`F6*B3?{XTNo}=?ptI2rFx0Ap=mv&b<K#BbSa?GwgMs%S$x>Sd
z8HQQ~>o(B+$c66U_D%?>Zvyjkb0?n&j|`+w)V!C$0(9mCXbtUxxeN~8f6l!`PB)V~
z`9whB0y3}ufpr_m-5v~#GeB_$xtEwhqSh^`t=28MtzH2n&%gj0pDR@dw}C#?3MI8I
zv|(@v)s(QP_w+HSW%sajT*Pn#<X*6xCxb(%mxM*VSBOC^djKf@Hq;6wgYKqgZRBK7
z0re3ZJsDC$-6Sk(UKp*b%`g(tZ)X6V71QD5z|gYbH3L(~b5=Wx<^TU{x3a!<oXgNr
zv%+Xy!4l^GpfNwtzPOqdMtT;n7!vfm7&t?obJ&2^E7iQT64|gET1I#>fc7Z_OwI(;
z9t|fMGD40DSk<i55@|>U-TC?dzvDiJfJRM*381_Knil}g*LnXrySJVJ;%D#w|4bn5
z&3~Zv>J_yfM(b+5c30GTv76L-80$59GRy$kJJAz#mivE$hD?Sz`fUu%pt&kg**zhX
zVNOFP!-AT}Rw5H#GAw9#&A>9zm7xYyhD|uh0P6E_Oz33D(C=bk2AKmApXdp?@9N)^
z$(dmK4(L8h4+h%_mI{vWJIibx7??vfndiagi$L=rwhRm$6IB={Byuo>PE=t4j}1>$
zVVE&d1w3Z1V5z{s3F@PR)S%0w=M7N4uvK`Ukf<pNDT6o}7(itN=*)Z&ov3NR08#@g
zmq6tM1LLGCQxyMaz}5$W%GP}g;b(BqshOn=I$PueD4&4NTWEd^IYSC^jyT^(P@5Oj
z|7xgfknmt&`U2{Yd;edSTd%;dEL;;($AIcNTZi`vi|ZL261{jqdzND++A}0fv}Z_}
zXwQ%VsuL#KGZaj;XDFFy&j3C*7_>(hbdF(t`Rxkt|GHa2?I6$^aqs{CwkldPu!m|1
zSb_6_W`F_6>_jhK@SRa0eW0?}dOm{#sIB4s|JPNlWlZzq3hM^Ye9y0kV0l<MuE__#
z54BW70eo+qV-te}Xs<b_Pj5X3v<^pC)%*YdGf;oac>g)=+Nj7NVC%rZpXlY}P^%d{
z4U`|XI~j}|=7P^0ak6w^;Bc4=K7%+I)LwU(%OIhs$&ga3=_ydF>AfRVi^0OuivfIx
z9;{rL=*h<d3cKtY2F8tw3=#En7)&g!85F|j+^hqwv#y`zsRz2(z0sZ_0+bIx_vL`=
zJ@A<f%&nku6vX#nP!9yT-TS{zt~Db=1WX*%#s=-3@czrNccCIfM4={l?GA^-K86m^
z_`B5s<`>?7PC0`70+!ccP;h7hwe^KNL1z(w_H26pIi(01Gpg0ve9dYV1EZ`a^Nac}
z4^ZEX$0C72&->5Gn-IITKVq@hwQkjF(0s@e(3&^zKPRu+BrvciBrjC({;z!y<aUrA
z@4w6sL2S@DWe`3KXbxlws7?j>8?;VGyO}`@6jq@60+bgU_BDX^po035pfPYA&|3Nh
z_d(_9$(h=-89?{wa#;QT|4(}c^9#`UYS?!P3(#J?TFo7x@p2RG84RHNheX0&N?3sU
z8MU4sAaNP(84O$?dq8`_!FP82ISE?d<pW8BqVP0mtH5BMsCl5RRw20!DSjL*5)>G`
z|6KI6Nap_^lF6VBnx6vg`vk9h|8wFmq&#POVd=>M$|oA2wHOoa85BV0g@eXdL2<Fs
zlYwEQCj%3bxe^u$0t()LE_}2|W{?j_W-tMraSl>%ai5{0F`mH&RDLwpHGsww7%UQ6
z7(n+PO!Q=6S?S5Zkm%(AGLHdtuir#_h8{>bFfRkO??M>_tiWv~ZU#O54hCj$TWOWI
z-iGB2OcU4{SRD2-2!Pr~3C|rEYF>Hkf!LND42(6;r7LQlvzvg#rnG^_0e5u9g7<(j
zgnBsWb;dFXg3@^{S1=^Md-BP2+A;`r#xe+Z$})(Cg7)xf23K^(GKj#~p#Cp}?Ob8&
z1!;Fp)Z$YB#b;wYgGQr0gO0;I29;XJY*2m0Q0tl8RvVh!R;y9mW~soCP^(c5s)H3k
zVNuJO+*T`^+*a$5-Bzmrl~<^4LuuQnB)8QXfa8zB)<FWLjRJBD%nglNd@QiG94I}7
zYOn|`sAmA5iJ!{JI19Ai4V0cjHCgylH5sHpeSuU?#whJM3_4)8W+SAm*5YFUmqiW?
z0idt}m17e<LG!GjH9aWyCqUFSFeG|SKz3IOMEpkzl71eL7-$X+NsI$3#(^Xj0dk|Q
z0s}wDO|}XQ@}TqS!RJueGa%a`0@B+U&me=OR{}XLg651ul3DC5k{JR(djY(E|JSTn
zU{nE>*OTKJK<)epQ2k?>$S}i$!7PJ;u_pleY&~clWCI!NWyk^Ty#%%4K=~cCXUBRW
z10SgWX>|Z{AD`8O|NlYtk<|i*@7{mdEkSIM8Q`+w54$Gl4joYb_x{5f3ECSCS`#q&
zA%g;Fp2hnQrz>a-a-t#w#C?Al8Ycf?m@v_Xp=I(PhAGW;4I=Wk3~ZqFe_%5$PC>^H
z*}sCuLqToB@Rb5qpnWG3G8ra#FffK#Brw=`|2dlqI@<!&&uge_@BrEA{pYAGXsi^}
z2enuLQo|-`k-+f4`_EZR=>8+no_QaL+9Mx9ZGP`Rr}je11V#a<z6aiaSRYzCGAMxT
z1@)_IH3RfOZnLOo5SVDiz~KFd&2;lF28T(vAotog%xi$e!+#6OM!SZPX1j)z$?*&p
zpmGIt*2hG92AxK`hM0-=3@VLw4WN2i19WyEsB8s|o7O!{ZmWBq+*bEFxvg$da$9p;
zgN;Q3gEOdq1+J5S|Mj#;U~mJmL1Ny&|5{okFt{V}H7ybtT#)!6f4d^_IVas@V1W3S
zQ?p@SLq@~Ch8zh0M=0pNZcv#HnwRzd{||Kj7pT9O;lW^{)2PhA64KRX7t+F_SL+!N
z5bD_=*XYc^Q`6#I0lG^a<cE-zY*sa$-W92u4WPa}=uRuhy^so_ApHU%OWF5<+LoaF
z)~SkE?+i+#Gu0sXuTjaKJurJ}7U=2lutM7WAbU0}gWBWFzyfkN$Uh-V*{o`{JOV&_
z$YB1dY1OU(`6*>-1L(XEP@kG3VJYY=YL+!M3w*);0r>-Yo)2XHMC$qj99}byLgoNL
z=7ZXjR1c#A`k;G|!S~-aQYl<&4*0^&WMJ$7tq=SFYx^RvPX&$3fXbW+%?vyf7DM(z
zg2q3fch0gv@0{g;-Z{$yy>nIodgrXjL}kVR4+g^x42<o6kk=quEMPF$e~<w>kHz3(
z*~q{FvIn&HzP33THc!sr{fDWrQJz7>(&7Iciw4FCH9681mI(|D7AyY$Z@AAOQ0p3e
zt!AZIL9Hg^6!2Lbs>;_u`@;%38JHcK7)&f4Fr?JHu)ZeqoFN6g&T}4vNKJ?GHJKL1
z3H2QcptA=A^xGJiY7-dLLbJdBlUd4`YjN!V|Bzz>Ry9k5L~4Bu^gwiDJOfXyYmi8-
zc94jr0|R@lXYe)98Vp%426j-|1l?ES!C-KLfwAoe=$u-c1O~>0<iG|?20npWE$M5Z
zaW+u6g2EVdrYmS13pCCKD%)$F0|IKfoUb*={l8Lw;FHKi76uMk4nBcekAMJ61_m3D
z+(Z@z7FiAk8<5yU7f@f8eN&+a*pDLmos7AlHnk-KV;*RKk$xv*4rrX+l7TU|R>LCz
z)Gq_=0i5W<AOhOU4q8KD>A)a6(Sv~n)F%#g7qF^%VI|V={QsZ&P76>UR-jfLuI~wW
z?eqf%8PFKkgcl4fpf%K>_24xe%*!UaFbGUkVc>!6z5S;E+mi(?qZvW#8YVwvkOA!-
z2F0yK0z(Gq4ioP`275ad88~6*iiB#h+l6XAuanhe-~z7$w`XAJRAk`7BF@sO2--se
zR=*EPJx8Y^120rPvN%ttA_GsTCVL$yjygf>Pat;vL((hIsmQ<&(fiO2CT^+8eqo|L
zgNO%%-WLYORu|;G!^r;Ik94jVY;PgRub};JApe5m)ccSASx{RE)Mf^W%~WLIuvB2+
zs^#*Y1~Ut!K9pU-OqPRz3lz_tj0~JLuYxN=IT#FTy__p%Ix=vA);ELnpsC|RQ^(a9
z&%l929XC{+5!5{HPDciwP!9%+#&`yaP%rj6P&;&{BLfdOy>od_L$ik$O+RmAJc9rh
zd-y==Kye?+!C(Ti3zUavIx_HCIxwWvdIW>#CThJL0zh{Fg=#36fx}!gAfT4hyJDsy
z1Hbnly``Xb1?UWK&_2M1c?~SyfA%~DwE-aG<+>4|vKIfj(9NLp;NayNXs<13zY{2b
zg7P9L?}73lsN4a?5vW`P%^B1xdsj4Sg2!&b{kMtEpt&>#0ZU~D2hd((P&p4O7d;qs
zZh-pzpm{)0TiW9A|NoZG42%wYAY+iGUjIR3Jqk6QZU!|g3<5$m+5dt11htwP1~t#Y
z>)#&KJhldp$uCr9V6kLoPyzL8K<0t!Hqf48P@l~E&%pzrJPhhjI_~}drR4+zi+&sE
z%!L1MCOl)1neYNMFa7_4r80v@O@faOC|oRB7zDuQ>m)0I#^6P25@f*Q3)LA|KxGhU
zoUp#lgJIu629BCL#-O_vOdRJjtO&U!VAb@TfuY|0k_c$-z1fOEqoz!{qM@9D1+-2K
zv_2fv*Pbj1S{L@O6|{yoq@KZS@-Ogxvm&57XlKu75T3lBK?QV17pQFsns4|1|1WYv
zJp*)1^PjK&Tn2^-^$aZF@r3IC|7&VN<I?|3C)9)2LUT;s&%gtk*9Dym4Z159bWRN@
zO@sPskntpK8wSQk(0+dKzC6&{2vC{2pOHZzV?ILzXv{PG|M`EQyMn@B30Q&Rx+XbD
zq~?}!MMzh_UBh99oLU)Y(3s8}kiS6gtT_>407?gioZx#IWGopN80{A@G1PJe7}S8)
z^PLK=nCQ%qqdN;!{xUFZjA3AN=wsjjjje`sithuh0d<_mZ~(gg6SO9j(P1BBiw6Uv
z4d{%E`iRRF#-O`b{{IvR|IaL8|NjGrwE_c!zJvfn&5R2HHM5mOKzn=~W-^$7##BJ<
zcF-IFD7}Ht15f^4VX;7fp}zew=sZ$OYYEW3DBwAl1EBLlY!W_z_7rj0BzyqPHF1Fa
zRKHldqMr3|1xP<sA0z1eszxpF`cqK-_oPvaLB!SpeD_mN%@gYin}koG{xNut8>9#1
zcJKdxPdfB67(nd#3|^aTlkiytw2mFrCjgxx1X2q+JKy2}186-eNIxS~J$MYlCgC#&
zNG)hy4XU;j%`FiSw=gkG^ke|}#iP-NK_Gqc2aZB5@O-U710#b8$c)BD1|FE5yBQe-
zKy^`VW1|9iUS5&G!2ADSiS)%EKzpGtfYgH03`pLCL6e7pu^zPF7Cf&4PBTb*0bykU
zXg^M4JcEcO=o~i%7o9>4@EzBnb235oe}nY`208E=ItK=ZiSZ0;K<U!fff43zA6o?u
z2I~b3MiaFdKz&RROHBqAP+Jsaj^m>Ldq8{Hy#M@qYYtgs{Qy+1fzGZ1@f{ca|6-8<
zidRX{eh!dc4v1b*y8QnDlpY{s{u&_+jCG(q0N>lO53#S?1@4!94J@Fs^JZBF(3$5g
zpfU@zcEkJsucHMSpmBT#8%qlYo_Yr#9sODV!F%9A>wH1={X|=EJOo%qFo4cB{9mgO
zqEl;i!P0RND`-5K!`gv?DLnf6zv4&+0psfb|Ld!73M5xEfaZKvKxTl>GlZGr{paUj
z@BjZgA%10fQ|!UO<hY0h)Q@5E{`2#ptpXFnL<<Iy=DFbW$weA!KxeZ4Qk-nV&|=^4
z=|8BP0p*wEIsc*eQ86rN`p+N&S|biR7qaO(gNpb6pC3aq)$JE;1F!AOXf$WwDAfXw
z`Nwp|GYCV<(G?61dl+0SLmAjZH5q$A^K-RfK_ZP_3>+XF>czwcnmd|k&cLzIjDZcL
zuhtZ_mh1n2P+M=K83P+=zh1580}GIv$@UBq^_90P8tOr1;?F{mJH7w^PXLt*pnJ&e
z9xyS0)-Hkaw&OhJiiS!ChNhXIH6}k@n}0Hh)PUCERx<E3&j-8Tuql#(1$3r$o%7@h
z@Bcp)8)Fy*7RoTNgnEhZ)9zvbtr=J7_{ks)o^P1P;1bHoVh5@#>f6C*!kd7~WYD^j
zMjHkN{YeZA4L=!FK<zou7!@ckK=YfRa-~*NN@Su9gTg`^1~!me!_w95LGq!REOr}h
z7}!AT8$vz{ST+1>;HXcZp%==*Vprb*9@CuBY0m(<w}#oViJ_;_23(ea)+aP*cQG(F
z+cJR4A0CH2;CYLbh8hNrMrT$Q&^!d(U7ZXJ6O~zc9QQHEO!^7AW3kbaK>&1Cz@(oH
zB8`>|B9rbgD1hohkpB9P#}y587z7&jFo-nV0fpT!PS7|C$RD6K)kGTxm2P_m2}l?-
z@qo$=(3xqVwf>It82>=x=KEF9*hxb@155ZE1~c#f-;dVMkzjDx$9PA3CMaAPuYksM
zQZ*SIKx>mhd(5C^x(c*RUjQ=CVISiPP=2!R{Qt*VlcC0gfe|!b4O$})YA-~9&d>$b
z-=K3k8e<vOH2h@{3H4+*33YRl3)KLfYjH#mynn}*VGXFg6{_iG2U-t5QJsOMp`L-K
zc`j(b=XXu(ISdLl2~R=!47Bf80MsS}t@~}XWmr<*`2#er2HJxyFwvG_3HZzydj<k-
zVEaUx8@?^Ip2MJl!wn0dZUDP&qAdgH9FGYg_j~{UmfHxr$5EL9RPNVU&tYHz&GXey
zep~?x7f>3gOP*cf{r{V5{d@_KKR{;iOf&|sVG*!OX5eX52A$dT|4RLw6AqxeJUinV
zM8W$7=Q8Mk*6?=xXAlF8{ny%hi8OLDaMZFp1We>);OMkx5C`@DK>eLr`xzwaW`fU`
z?tqpp0*w|7BE{gjO9la31x5zzg#Z61S}+I{dxFag(B26KP?=?&!0>;eCPPE0{UN(R
zdlx;>{#EZkUv0zxv;PCtmDc|mR3=6+h=l(au&Uqt3$z!A1L`-9i4hC}))EXn;JF%y
zqdK5|q6dRg4Fh8(=&mI2xgVf<2h?WSdyqi@)HVT~{m~%z{{yJK(sUSdE^sq5g8--=
zYD#7hX<E!6(e$5zqsf^;Mt?f!3^T@za6$2X;Zpr}+7lU=COu|Q36F)W;Q);hWpgq#
zgleAuS8MyaqPebtM}9AZLA~uQkxokn3DCNChbBf1D4WBfiBSf`u9>1-0m>gBe>m)8
zuz<ANz8v)a|7GrkN(PojO9mFuc|)LlH`9_qB21IbZl)!JWTQ1>1E}1XXwBGAr^R3r
z&UvgZJj%i#)azy)$Zhpe-W8!<6`=V$hWe=B3Q(Iboa_8QL-2i&fdZkP3>uc20t_H^
z;hg6CGBp_(LF1IQnhYi&H-u_}=6NzyK=R&yzD@<Ld#QJpuJHc<g|*iDl}JtXOVHU3
z0-$qZK;;i;{Z*$Y0|%5X5EjH{H_MZOWu_+s8^}G5p!+K)GB7*rWAL#K{r|r{Dy^VC
zig60)d?x)_40<3lCxiBG?`3cRjj4JtFgNH=Wnci+b&mV~KS0yN?EU}$8SROnb0V2N
zKzc#z2toQm<<evs27%2n3@lbQ3@Vdt7#Kiz4}i+t`bif+=cZ_Y{OA4ub1bM%o>B;&
zN8s5M13ouR$0`Wa2KaxY=JzWROLYc;PEH06&{_>p-5tusURCG?u4f_V;s5`9(EI=Y
z5bX}oeaTD<EEyP>W^yuc%!Hi3!wC^*(9!N-0G(yHL%V~4(P1A`g{1=nTgOWVHqd-_
zCuse@0w@nMnl#5VESc!ez@sO{z~Hcn0W{Vv0=k!{Ucnb!9zojXpIRqWG4RyyekC$F
zmO;Q_69cI1n*mKfK8^MabD(Solrk}%VNJt-29ZQh1_6xn$R4vyoNNy+-_A70Gc3U3
zCJj_Kef&tFn-qw2(*n?a^G*&7pm1TV<?;jVXJ&Mq`~L%Iy)vjjSRdtK07?(xUTk(V
zJsHG7ck_bQ_k#L(pfW6!4Ro%jfK|<XBavErFOi003=)l+3>@{H2H>-LYq^{&K>bB0
zhW}UUye?l0cN4Ix3%Yo%E+`-%%u~Rs&TDc7NM9o-gG8;@B@s~hSj%B0G7-erG!k)`
z`~O9l7n>c(4KqC%L@g2+*g#{=p!+bq|9|vs{LjEpQy^VYKd}Ln7IQ2T7+C96x+}c@
zf7G=+06Kepl1NCVfK~l_FOgb(4?R#^g7$WH%x4g<Z@B;(Cz1h~Y5gBmR)6>jsyl1)
zK>70jjoRo};Q4`xS`0jOhD9RY|385Hf1owtpfnH4-{AA?m#wa-YhPRes^7i;e=-G~
zoeFX<C=5Y)$ov1FJ<#@hMBU@v6_7Q6vI-20#d|<~SWsUURF)#Ibph>d0+prUb182b
zSJX;4SAg16p!<74{X6eJ9|OVj_z4Uzy#H)D3LSrW0UERM{{6NWd~Z!X1IOg~3<99>
zfJy%uL?*{GNYr=UaF{I5AOq@?gZ2!7`d1S@SwUy}t^w5<-hbZ9g8H?fz8mO1FAoOD
zyaQ-%!u$U($eAU3{=W#HBfc+tE(5di-v9sW_r4S;-pjwhdM{`W{);7e%%gz;w1yV6
zMh#TwtAN@~p!q!Wz2NZ#P&=H-`_H?L-v9q!0F}j{`3j2!289XLtRf(HOpay+pC#!1
z=UuP%98kFgxtrVj|NFV1eh{QzDZ>D2TY=K4_y2!87#NE{`^XUe2*f%5E}(UQ;P3?9
z4-2{n`LA^a=$<A>SbhNAKT-j**Za>qSy0;^v`^J>9_x~(dkrk%FOStVhA|q{-Pl|K
zTI=DkkJSUDHvGT%zR6*XCf<MEzSN%2z-W;GI=7RxU|}o+Q>QEgLn!o4m4&ekETHyi
zX#63&z<3wEg|Q55pt?9T{E%H>xC?0hlrii(iyioEFs|SV{Vqn(*&9E!LG)bk+L|WN
zn4IH0h85af3{8%p^EtX08XV^_OwjLQXms2MnyX>~t<hf$+MB80#mMA1j|FtD$^wUd
zEPEQw!1+4>G_GQ+Q2#$sv;KcgvIpq=;Truewg$&}OflMBYz?42UXF7?YvGxd9p^DN
z=y$O)IL>3T(C=bYcG$;K;=#bspx?#O;5d(YkA4>?gX28rGx}X@AUh&F7?`er=H6g!
zS<oGP8x<Kqdw)TFNG1;k<_isF3?dfuL2EAFX?p*E%L`Hiy64ThfdQn3#e;!)4XABu
z{g8pfVIFf2*xe4`esq8b19J_ie*g+c?M?<^$GOZIjd2Ys;P#Ui>KWD`eb)aO_`&U(
zm%l_nZ6wgVEv7hlUS7n5fmsGq4t$o#6LfKqA3=2`rZ^Mmev~bk;^4b2=U|F+fYi5O
ziVJ|mbD(W@(EZimF&M{v3=JL(OeNs`xbql1v^zmz#FWw)#vo#8&%h4~2hbWD(73a$
z0|O(dU+?|rb)W|WlLN9HpmrbV&Snn=h6qG_yqQ^$3F<>Li6EN?F-rh+R+kQv+FXcQ
z#uu1s!Eq(x!N7QCq8aEcBgP}4T8HfPyFm3hg9T`PmE$~y5dAJtz0J5qdp3hmeeLZE
z@LJCW3_|sDcYxN`bJYFaUD5on0c4Jk_G|`8BsG#~Y9u@u7&WvznL&LP4ei+sEJ$iu
z(A3I!Ffjbl?qmjyXIW^^W{^QrD}$z1!GnPToL;^Ezb*u=*@BLBYtB?;;4H{wWC+P(
zvjd&;1ln&4D!*nbGH@4U3V`+mfX3mu6E(s829bhH4rDP7kUCJCO1q1JZK5IrPe`(x
z9jHA&BawmEQj@_4G)4j%I|kkF23o^0QxR;ALa633J4*)!ZV(?V?#KW#OK_$lgHWd;
z0|&@2^|L*|;Rm{l8reVf^FiyQKy4xhACOx?e2{;j`3`jEv<WDUfY+>hg6>CQ-~r`L
zP+kV91*rp#6@c=kbprzvsLlYDf8Kvye5{{)16<F8?VtGrboU;(&IFyK2U#!hymay|
zR?xjeOp|A^ig^EdvA4eYaRq3vH)zc{Se@$W3edUwpfkH6W%&=#J(wCGJ3!`o|9Q~~
z8V`V`69%vw9)iXx{?CB)OGLlays)kS)dk-Fe{Asn|8@%lV-D!fdHDDkq<&=d0Nu+A
z?W@Ru>H|>u59*(Q=cj)^3kBVi*1WGl1Ejv8u7Ss50pkSFy%65NpIJ7~YXF_a#9*;N
z0J0wK_cK+{czZ)F<bE^InSYZz89?p>jSDk)|9-{_3h&AD8F(gw&IMQa{~vUw321*T
zXilcluE7LUKTou0bn*WG#uU_kcG$xp1G>k?`T^*S9`M~jTfG0j0iDObrlFoer2g;k
ziduy~I+N!!a7=DyP?+4zpfORILBdu+Uu&W=Xf5x3y+q9l^@++1CbkM1Y!j6kTr3qB
z`X|~mtg%(-XPBtWz+$UV&yc9eaA2Y`g9w!EFj1L-$5tU2Bro9o|3z&`z3(6W`3wx8
zv#LOCb;!Ce)}P?}f)yCR{mY5Aj0WC+o`LptTY%=^K<hX_`#3@4dZ6(1U=S%`V9dG!
znm2^Caj?x<H2-U`=(LBN=?Yql<^BJ)CMb{01l?JX2p+Rz@L&)zfURkUt!D<^zh&PH
zSv%DHhcAXlo`C^$*Cw=$0czKAdH-j1Eq>X+;L!B{4yb+xrD;(84sxRhgD_~l<PDJ9
zK=xTIU|_U3$iTP1kwIc3=$w7X{mnX{wuASdo2d&G8Tbl8<8aV(2taAqVgUoc#X-<n
zZ#P{RIx_Hp>d->Z1E4&w5$d*WOQEL&h|QC5lEEQVjl~YsZh`7!0hLEEw#7jPE|8q}
zpBsM{Dni&$IZn`dg@u}H<TolZaC!f^ad)9214pPPgBGZMg}4cFcFICW2ChUeCWeiU
z3|xg;V0#51VvJBR@SY{87()X@9i+^HsAF(|h(XFMkUJ7J85BVFE`YiZ>LwQNKR0<7
zDl+gCYQfFqfZEMbs0B4s5p<>zBLm2t3l1`Hfcyv5&*}Z=##tzv0pvfBocEs_jA-f@
z5{?NmgdAhB+i(zccHfPepm{S$JPLuz6!3b2DT@EW=b`OSWKaRMn<p?b*nsZv+;EUV
z0^A<{|Nkba?d<*kFXYa;eGELHG~mI&5R<&5fg$|AhDptw#})c>IT-5a|E`z}YJcow
z5CN@!wP*zI8)EYQ{b;SN_4|ZIM+Oeinv98_d@-Q05%2$hq4yd7-vGLgC?t9MKhSy6
zmWd1&9t?s7u(@Q=T=V`!1|HDd6KJjmG=B`5v-1A`-xlOX(0l+W3_x=upz(juy{e#g
zv_lhviv52`8gI1ci-E083)O4^jc<bLX4pBJ3LXrC3?O@ImS|U4EC97H{=Lv)Wnl1a
zVo*?Y1-0uKKxMT|O;&(GO^c2}O{R`Pt&4I6Xs!@6-&X6z0BVaf)TD$Mz{IfX?+P)f
zN!Bo^>C`Z&b(XHERe|iuf$MJ$Fo21H$}~_ISTHa!Om1Wln7oidWb#1<3DA7H;~Zuc
z&>e&|tF$X>P8(M^&S7Q&^%H8+q$_G&gDYxtqAP0Cqbq7Ulq*1cM;zuc+^FxCaB!H*
zC{vroU;<JL+H0<Gib0_!Gr*vx&BUNKJpg<jQB6mHLCDh<yO75$cJ(i{r-ib$*wxI}
zyjK6}cSUWz<h7a>j{xv~qE6$A`fhN&sZy(HC1M%>|9^cuc(0ELRGh~${{KIaT&=c8
z0BHQUrc--b%@NIOptH+sQY5d{s(A#2sx`>f9CNOyZ#Dqc!3s6UtVAr9fXp%g?Hdw+
zigQ>j`Tq}eCNL-s*Q^W%)q^7SU0^?f=F&msDrk*AgCWEJ|Fs#60t%}^_X;sisA-d`
zs9Ek+QPUnFQj-=a(%i@((7cdAr1>C&L^Eh@f+B+gC=T_zLE~!Ra}^kCUPVu<dB$J@
znrC&G$9MuXehv<kCoFcLxfxKHfWoGJKP+4nuhrT@)+p6#!ox)d<aeZS;Q@t<<6Nc$
zSa{TCYEP><t$D3BHM*jvTM;!pT9CqHHBxv$#5pWh{|AQ$C@j4H|L3UnW-!s`W?*of
z#rQ<gn?a#wX@o&-bBICBT~M0SuBhn>F$k$|u?tCOv8$i^ds@x02!mQT<BE_YEq1j%
z5eBt3Kd;qyJ+7$PV|lH9<%@vuy$y2pE0rtiTVZi5C1M%#|9^cmG>#$SJeDz_IF=Hr
zS?Uo0DsSqS{+?F<_vf|xm9Hym=2~6@-4hzJv_Y<Bxp75(iv=i-Rcf9~iCEf#%(4K*
zu?SS0$I|xyKad<Ko@<_11c2sYYCRLg>e~YxYC99JInH4aahUf{qLw4VpuQu)!C}uo
z@Y&nm|NpVnFfja3%w}My^<tdh{r}Gwg%;2qv5XTe7(o4|KUZp=8yG0MF(}lkgn-j`
zO^Wukkk>4BwOk<vwVDP7wHyWppmF$6trolb#hTYZWlPQB$ZIuo6~O7e)=Rmfz74#G
zRi)O;O2qmxC{6+(?uUr;SU>*%4<uJ}EFd6Mi^Z;fnfA0=Tg_{r@~LKS<h7cU1_2=_
z8{|O#s&9dXtCfgFEyyfrxI)BvENVgFY9$i>zd^26#Ur35`FBNaN;K&H^A?9Wpz~`$
z<AZ;B>U$I%9QXcZ0JWFA|Nr>|%X8lU|IUGyAs1?vYgbHWWDuCF$RIM=kwIc|B7@B2
zMh1n+3mH@<A7s#&{E$J%aSjvsek;%zFsKa&nx_SoJ(dj&3?Z-i|AEG>l(QKa>b)2z
z)V#P<QFHQE1!x|(Hrqp_*2_@@R2PBDmHOSUD{AYbE9zIgu5g&gaHhWd0jS)usLf<B
z0gWMn+Q6WD89{ArMNI~U`b-~#`t}zFwe>FyKzG^HXS^^7f81gh{*uM6)?FH0{?ukk
zUaR%;yjJrXbgxZ=T+MUiiux{aT9T=G{!65OJ~$l-K*cyfVl}TUz-11|j2e)BEzfH;
zkD>ZsIfKR{Kxt8?)(fN`9FGE^yUIarWsn$X9VMt;T<iG;wB}u;z6<0J1|N{0!D;&y
zQ$?+IQbnz{hDa@!qDU>XGq^l&W@Hd(R%8%qc4UxfPGpd2Ze&nsUdW)*e2_t-`5}Xj
zg(8CisJy9-XE4#1XJBxc#n|F7hiOi&wu3;;D@%b|4eyFtPG``5fCaEJ$@&2UWBvc=
zY4tB5VdyZAVM$HBML_s#NH~GQ6jUbFJdU1L-yV6b*4^_OX#X5&th^?jl(34PR+|-h
ztriqku&{=O)!u&}K;cq9Kfu9p@4qLY{kh6Z7#QlC87F|-f1ooL82<maYyjoAzZVov
zGAPvl_b{mWZDIg&XZ`HxX`na<$1AgmLCv!l1~qBM6(Pr4>}ok)7}Ul@UaOzud96O{
zMnHHqD2{Je)X%{Z#}F}a9M{jW0GBy6f1;<=q(_3!kgjij5D?znAO|wLz8zeK%G4YK
z#WA!#frxQ{#A?zF0zh|$Datb_)O!9fsI7G|sGs9vP`}r^qCU&TAbfd?UCpr{2K6%5
z(?Dfq_(~SLki#u@wN*b1>Z^Yk)J9ldtLHvkQE%aSt-k9)K=_;nx%w{Yiu#$ba^jVU
zWySyh^>e}LO9U#;V_5+zCtiuvMh1Z0U$137t>&lYwR)S=6*ZNf*J|AZ0zhS8t*3DX
zsJsQO@2k~(C1O1jWEQlXXa<)bJk~Qo<-{wIT4j%b(Ch}e`tIn8n%5V^>N_nQYO^n1
zbC|=RQyUc_Q1jPPpw>IMqSpI{K&`r`K&{sw1JGH5wd#KiYCS>e?XQ8uy#G(?XGb_V
z?)iVARvo-X=}LX~3kQe2e^Vf7@-Gjl-2rNsAh$;x<}rM!Z<BDSIbd8-)2&?LFqe^|
z<|HJo)?`V8=6qxnJsA{0_e_K8p_&682DM(&6*b)+1|e)Mb|I`RcC}r`(?Zi*>}q)o
zuhn)YSJd=?&XtCSgNJoReTxGqzpB)7Fo{^|{QqCy-~cImA>uriI{*KH<Z4+Q0z$J{
z>}oxXr`4P?yjJTHTv4-1^I9#NLqI6#+yaj1iuzWtSqdQa7F}?&1fb#^7G0pT9UJ7p
zZH*T1ie@bBh5A+rko`YuRzvDthgpmq4s#eDSTsP!Gd&m>o<Q0U3_KPLptZ@y(`wid
zZHk%)5&<y3gWD7tEq1l-#?xwj5dH_1VIj{O<Un_ULC;T+sr7>SADpImK;n*bnL=t^
z0s=xaSnO(E8BeP@Zg{QciFHNIa?NYCZqP9Fa;~Uv1*b~|kQo;3Ab*3+5P*tvShPd@
z4O(Z7)z57T4i0nwD}d{V1O^6dY81I4ZI7ChE(SF@E(W!#+7&e&E(ReBTI@nrve?zH
zVV+i#9AQw)EL{<j0m@$y2DPz_*Fa+!^?yCD)pjKWg!VMZ)pj{ofXW(h+V|2DvH1J{
zKggYqa~VXS;yf0ALHS5aq&7Yv0JPVl{uT4I8hOTR^>2Px)XIBat95|--BY@vz5|?J
zRBAP~L@ein%!1}4h&Yesd{92p5&^B51%-KSyLCmayMY*}P5_0c;~a(uj`J9PfWj4&
zF1-K$XQ^Q@Fi?2Lpiq-xV-UjCVpsnncv?-efk92XjR9!y4=7#NbQ>6iylk<nsSmsc
z>bKS0*SuEC3{8ug&K31-Fn2M5$9U@-pzeZ*^H_l0#Uui1D~CJ-waJ60)%*{<2HJ;T
zQ?GfgRvoF`2`Lj)YBiZeEagG*3pEQO&SNPL@*|T7xc&avBcRqTxT2O>8Qi9@RR8}U
z)c1h+?VkoXKY4-9d-=PfrZd8zzSF<~q{eX$XkY%nKd^EDbUr{$f^@}XM+T0`i3~jG
zeHDj!3>Uy<!)aqsxxfP}7eH+Q1x^M?nb5#uP^;=)QFGeEpoT%ZqNdBkAT+JTE;NP3
zu9m@gTBv)AT}_7JwOS3uYc<Ra0U-<xay1;*kh?YKGP2ZiIs|~u=cv^%o>p_x@LEl$
zA|k(Y23J7aS~9hoQQ*D_Xp9gl#sLxowXZ<_u2s=7Xm(`aXij9{!PQRy=li|?@6_yv
z)!z&Y9Of`J)Ve7M)UZkl)G#wwfXW;~=D^AZ%LE3-+HB)#wW$mypfGiq$5>L6EfE0o
zKgjR3%*NAdIH3MdkO%<R>lqOLJM8_>Qp*AImjkF?{sFpg)B#jib3}=F|Nr+wK^~MJ
ze;Cx9WHG3z0fn=6MNP&JgOI%~b|Jf2>}q3PPpfHWF{sIKt_bA@<;NceH7!33YF@p(
zR_ha7QSWv0T75gTZflROsGkL{lT~V-Yl&Eb%Fb4B+e-v0&STjHYQt-Z)ck_Azg|zP
zU-j}@ZA@@QZPv|eHGiRPu$RtA{YNbkYp_|+^a|-$@>q9)(yNw8t+xlbOsMZkuBhcP
z5UcNUaH#Du1l4U{YSj`1YFQlxYIVFTYIPI@YCQr4YBm2D)VeSj)H?q$s8vy}AQTt1
z*%}54PeJQ#Y{2OboaQoF?7)3>P+sl=t=W~X2zd<3<A&F2Iy|q{$V1a%1~aT~l7Yv=
zTm}JXeZ>J11Jy|(&spqhGK{CyG#g&4N%p)35(C#q?A8_a&EPPVsd)~HM{sxwK*cyf
zVl~MY0ie9;{r~S5hk5^H>RS>(bu>q<M=+?J$Wsq4m;W|+|Nq<4c>4d2#@GM%G;#kw
z(4_tUNR#*f6HVFw&op)aztFV$|COfG|8F$C{(q;L`~QPx?f*}jz5l;x&i?<Vx%>Zz
z=GFhdG@t(eqk)@&rTO*$Kj3whiP7LS$_!BO9}1vc1}GO!p^L-#tDqnh3ZUFoP%fN8
z7l-keLO~Q1K)FkyTsVa;4&$#1g+M5^3c_0z3gg3Qba5CT>JNDa1_sd5=qLsTh6)A-
zhUp9p3|ko(7_KldFnnfUU=(CvU^HN0VDw{zhX@OV_3!`x|4a-Fj7)4CoLmeH0t^tW
zz`(#@z`(%Zz`(%p|My#+|G(cJ`TzUvga5zZv4GfVDJAh~nH8l4@wutF`9+l=cNCQ*
z#}}uTFccId$D34C#HW^I#AoJZmVo3K7#MXJ7?>g$7+5wiFmNU?FbExBU{GyfVDM&O
zV3@|h!0?cPf$<On19J<5qm#3XtDCzAL>~jlDIjNnXeN-Oq0Rz{u`n<&Kt1yRKZp&&
zAT=Ni(m&0By<8`e@7=CI&Y6-&a@qU8WEGe$O@6s}YRWvLj@x`ocHF6ydwKOi$IVOA
zwSBg6?ycEa$F95M`9#_M6H)}W%YIVWkmXUh^YcB&eJ!<DZb`j<ayK_{>y<CZTQ4_<
z&Bzfxup&F9>Sxm5Hz!lO{9_nJZsxEhC)@J>`pV1EdqN@4I!++d=ZRy&)uO`mMHini
z+qhq0@&4P&dntP>*V11rwwmV5*yMEW<nG%JKliM8oO8pdH0HkRdERSxB5g0OUSn`m
z&5Ge(U_;>b6Jm)M_HX^NMN#?4=CGMlcb(^7x_8IC9ZVV=9jx)2Zt@&cdC9%8y(V8@
z&?h5ewQS-+Tivv66CCf9u@&BC+@o-5hL*t9_noa93+1<NV_W)U|9s;sJ6<e0$zEad
zlYzf)1?M!08GH|S^JdlS+U9ah&q<lc7?b?$OJH_(QeuwG4TIEHKZc}FZ>O^5R4-+e
zKKO;BDf|fk*JC#~qz1g)F7#^0zV4cioqz7j-c9n<y(Rj&=5kM}&z0X1iJN@S1#Yz}
zVc4_yk-_dOj!W-*U7vcxHuuQICBMI1yPWkh)A`TMJQKH$^tBguB-|?2WpQ~b%WNF)
z!?o&U4ewo>Le_v)j!fzT0^IxB6nIXmZp{ea+?ubzc_nS<{3nU$_<r7tn{o1{rqYZH
z8@8;teq7vkb7Uj$7Cq~jz1!F3>^h*(yyNY*&HHEZJle)Q>(a&&OZTg<)|X$JE2?&z
zrCIDwu@HCi;}+|bDRx=8yep!zs<_YdJ(>HTbF%t62Cj|s*lS%T^MAOsn4>-86QkU}
zLu{F`;Yr_5r>8a)n&n77XUonjlfLrrf%fIjsH$56XT0vF=ilG?^XL10ea`!~i(l>A
zknm#hwQF^gFD^WC=!Qkmr~CdN(|2D?58t!wF56anZ?jDvx3qb0_(*fD|K`PPmQcmw
zc=&z7{m}dAE8h3z8CLGgbnDricv`ACZO?*B`Ko4*GJ>X-^PFLJ=ia?jj7dpfjWu+i
z^{%5D+<P}oirS*hlC?Qz`Ty&O49{QK+CA^4j_kU7(Hjn>%vSr9{ASMLtWvJYxlAkB
zIOo`#@x5+MXD<>CXJBpe+CNpKYR98>+8e7aq_^?R?z=RJci+{g+uz@*QM`Yf`^u%u
zZBCD_eEhNbZbn}7E%~!z`x>Lwc7A(Uz9GNdeY?c7D2|STEdKwetl83HxETfi&r9vk
zT$l9Y^8f5a*Yi1I6_2<Uyt~AEJ*1h%@6cvu%S5&G<=@2;F8I1<dfqP2v-8Tjxb9BW
zwVP?&_Z>c1-!Knew`b+idAsk`pWo#E^8Z!?nNNH7b{*Pv%3$*5;AM-qsIZz{*fp8$
z`dQ8Jdm;PNZz}6mrET8fm3V|nIwN+9cD|PRKJG0G`*;pZ-)D{Leb1!(|8Mn<|9`6w
z{Qp~h;{V_33;+LC-}wKx`osUfH7x)C*6{rQTO;uQZ;izNzco7l|JFGC|63FA|8Gsi
z|GzZ}|Nqux{Qp~X;{V^83;+Mt-1+~v=E?uRwFmzHt>yUtw^rc)-&%?Pe`_`V|E)Fn
z|F_oS|KHkx|9@+9{{O8l`Tw`J=KtT?3IG4r{`mj5j^Y2`I-dW3>qP$lt$XwTZ=K2i
zzjZeM|JJ$u|63RG|8HH)|G#x9|Nqw2{Qp}w<Nx2f1^@rnt@!`9ZqNU}<uU*NmP`Eq
zTdwf`Z@I?*zvTx1|CU?)|6A_x|8Kd+|GyO}|NmAf{Qp~_@&9jy!T-M%7XSZNIQ;)x
z0g?;&|F`1A|GyPe{{O9*^Z#$flK+1z*8KllvE~2Y@)`gCmWM#iPx=41Jm>%4@{<35
z%WMAsEpPe%w{pY(zm+@w|E)am|8M1q|9>kl{Qq0U@&9j?!2iFMD*yjh9QpsZ;==#G
z6%U~N5C8vGGW`ErDe(V)tHS^PEkFMMZ@B@XTN(cUZ<YA}A51fV#0(6Lj7?0<%q=V-
zCH?=u&ISMfI%oX<>zwfauXDuzzs?Q+|LA}C|HmNY{~v>%|9=cs{{JzwLB%>I|Nk--
z{Qt{z<o{o$1yK6K|G!Mg_{jgiZgc+sbpz2LyygF2w<Z7ox~=*D*KN=L|6M!&|L-~g
zrBD3--*w^t|E?QQyyO4>z9;|x_j5pLf&c&eCI0{KSAbx!+>ZbM`!D?e-~ZtM|Na{w
z`h5a7sM=v>U|?VbF-9n#3FLPWhWZ~A79h-kgHNh@kXay%%RG=A2-8X)-MuhA<NE|2
zkhh89gVP99J;<#fJ_8OuNDgc!R35|zVVHd&{UAQFevlZ<|6n;#nncnMm4~|*nGa%v
z>_j#XnGZ4#qy{EWh!0i^3K*#Ug!mxyK+2K*2jau*Bcy-8<Pl|CVp4KSY8uGV|Npa}
z`Tw7N!~g%BXa4`^%K87Fo8$j~?mhqi^R)c`&+GC3KOe{c|Ljx#|K}I@|DQkR|9}33
z|NjLX{{I&^@c%!1#sB|;3;zEXTJrzDsLTKVVpsnE7q|HTU&7}9e~APC|4YXF|1a6_
z|G!kt|Nqhg|Nl#K{QoZ-0%`|?>;|=!{UyM`>B7h*#mT_H0Fnbqc|gT|VB+9F<6vMB
z->q?kfr9~@Fc>%(1R9tcm>4)1L>L&rv;+gg14af81{shc3>*v!4NPFZN<GsrkUEV9
zCNBmC4hEh3j65K|!E;6?1_ln08=y8YfZOyS^X(ZJ85A_ai&Pmn7#LU#8TlDF7(PJF
z1-0)Xoe_|L00XG458`uxxC{bN_X&WzEFf_asJH}_hPY1vY!^sg1uCuqrFEb*sG9?l
zH-Yj&(@P+}4U`XahYOSs>6ZvF_(1sqU>ZvN|F8Pv|9>@(|Nqq_{{L6g`2Sxm0D?6I
z{{PoF^8dfang9PauKfS6ap(VkjTis_8}R)9Zy@sjzk$sE{{|}m{~PH1|8M*T4S)In
z-}uk}|0XQ||6AoC;gbLVt!n=Nw`%$SU-`xV|JDru|66nX|8Fhu|G%}w|No#<C{;jw
zjsO3;*Zlw2edYhZ9-06DdY+(Rm;e8IV*dZ@Df$1er|18_o+bbP_3ZioH&NyP-$axD
ze-mr||4m}~|2HY*|G$e@{{Or9;s3u&B@ldZ#s7a7kNp34iN`e{#N8Lvo%>(+x9V%w
zRjn(Um(|WlZcaZZySw~d?5>iRK})@->D(}U?A9y2J^!BV@3Oa1TeGj}-Zpy^xhdtO
z&=QY{%E$TUSbRu4#M&*sK7L=#&!VSZQ?;+_-Ld?fc2;Uj#zmzgoRihh%k8Q7m~@nD
zipB-S!)!eg8xjsOwQx*OIKbG<-Y>tu{$K5{(pRCYLRJPZ^O<S<+;6V+_q@ASUotPL
zo)%jZu`&4=?`-q;aeJ%3<=!%V9kw=lTh2|RC!Uj3P6#e`?~~b4@X)E1d%FI8yFZnm
zQcsDl4qq3uv-p|sERz?3i(EQ|m;2AN`BC`DwM%40z(VIXo*4!Y9Gh4=1Qs|nGPm>3
zw`X8r<Y(dJ;^kxJVdY?F;%58*zpCc{|Eiw<|Es3_|6eud|Np8b|NmF5f#R0`|F0_i
z|9{ou|Nk2~nD}Z4rWmrit2zJwUj>;l=l}n!TmJvQdglM1tb+f4vMT=n$!hrjC#&QC
zpR5W0|76X8H@ggYr8zhibZw(!W0bAc6Lj?S85A9qRaE2Dv@|rqa`D>LwKa8CN_94N
z_6-03s)8`b|G%mt|Np9LfcUWF&cN^=G(zwnLNWYj0CmHmo$vn)ARb5xBJdw13nl*l
zo4n-zzsVc^|C@Z^|G&v6{{NeN<Nv?OPyYX#{New<DJ=j0O_BKjZ;HzQe^X5U|C{3Q
z|KF5=|No}s{Qozl<^R7a8~*>Bs`3BdRFnVzrn>z9H`V9=zo{|*|4q&K|8Hu^|9?|E
z{{Ndg=l{Q{EB^nRy5s-9sYm|*n|kH{zo{So|C`3~|KBu||No-C{Qnno;s3vAhX4Pf
zdH(;4miYfKTIK)0XoLU%qHX^Fi}v~dFJ{C4f6)>D|3#<#{}<iy|6lZ+|No*vVtfAo
zi@xyxU(AI6|Dr+W@cjQ5Bk})VjLQFiF$Vwt#W?)`7ZdRRUrfROe=!vhbunxH|BKo4
z|6k0R|Nmkh{QnnQ@&8|9!T*1;GyeaJ-SPil?2Z5bVt@Sq7bo%mU!2ANe{nJY|0M?e
z{}(so|G&5$|Nq5(`2R0n;{U&RhyVZLGyeaJ@A>~P(cu5T_#^-S#sB&LFTv#hzl4bY
z{}O8c|4Uf#|6jtH|NjyN{{KsqfS8jw;s3wHJ^%kDzWDzyN#y@O%a;HDEVumsXZhs+
zKg&P=|5@q$|7T_K|DRRJ|9@5$|NmKS`2Wx9!~cKQ3jhCE^FV2hX_=YRGN*yaX_+7r
z#0JqI3}Q1dGB7bPGq5nQGO#mnGVn48GDtEgG8i&AG9)rIG8|-NWNc(&WM*VxWMkxD
z<Y5$Glwed~G+=aKOaNC7450EHgasJ{8H5;w7=#&w8AKRF7(^LF8N?XG7{nRG86+4a
z7$g}a8KfAb7^E4b8Dtn_7-Sh_85|fK1Xvju#aS5{g;^N{rC9|S1z8zbC0SV*MOhgf
zWmz2<1y~uFC0LmlMOYaWWmpv$g;*IlrC2!_#aI~{9atF{1XvlE#90{|g;^OSrCB9F
z`q?E}*+BXeWmywI`dK7cnL+vuWmpYB`gx^Tc|iIPg7icE&c?vbz`?-Dz{SALz{|kT
zAjlxhAkHAoAkU!8pv_>+V9nsn5X_LwP|VQGu$bX6!(&ht$-t1n&H$=813<N|2nR#4
z5IciB0|!F^0|$cv11G})0d@v11`dV<P_4_r$*=%aYcg;!G%#>5I52QBJP=@KU}NB5
zh+yDgkYM0sm>|r~V9mh6P{F{#V8Ou2a6yorL6CuiA%lT~L4$#lVFLpP7<MplFnBO<
zGJFtVXJBFAU<d)#_M#jNkA>M8v>7-UN*Fj8Oc*#BP6)Cy@G@{Pq%d$Ws4#FctYF{(
zt8Zc8U~pmJWOyL}@-+uT47hc`$uL8NogtWkgQ13jgTaP@li`LCJA*g_2SX01b-=*M
zumjx6;9%%s;9&4!;AHqAz|O$Tz`+p2z`-CS%E7Q$n4LkHfrFulfrG(_fs^5gAUgv$
z0|!GA0|$c=11G~01`Y;L3!{mFgTaY`li`T~J2>2<7&sWD7&sZGh_Ev_GjK3eF>o+g
zF>o?m5n^W$X5e7RV&GuVV&G)h!oUFz&n^ZI1}_FqhA#r_46F<s3}Fl$3}Ox(3=G2T
z48{x`3}p-)3}y_R3}*z{89*(RGzJa^H3m+GH4Gf!@NQ$^U~psLWOyS0O7k2HaSR*`
zatxddb41t~k{LJ{>KHf}>=-y1?g+6nNHcIS<S}qC=rM3I>|x+w;A7xm=wsku@MGX)
z_ydjqKn4y5K~WBdW@!8uGH@^$GH@~+g2sO$0|$d511G~G1`Y;LORSNBgTax3li?9G
z{v#PU7$g}u874vFzmkE2!IFWK;Sx0dGZ{D-G#NM<Hi6S92SX<V2ZJXAC&MRb{D(4d
zFo+6pFfu{ozm$Q4!IXiM;S@CfQyDlIR2euKRxxmZ!>g5ngTa-7li?LK{$m+97-ShZ
z8D>G_zm|c6!IpuO;TAOha~U`obQw4qb}?{((^D@42ZJvIC&Mpj{DabruqX$^VQBmp
zGjK2%GjK8-gT_B7OqCfp8J00{fYVDe0|$dM11G~XX#7Vra4<+Sa57AT#(y;f2ZJ>O
zC&M*p{AV+8FlaMyGHheu0H>#J1`Y;q22O@=(D)B$;9w9(ivMy34hC}uPKI;P_)llx
zU{Gh^WLU?*0Zwo23>*yZ44e$_pz$Biz`-ETz{xNV8vpeS91QjhoDBD%@t@DY!JyB;
z$*_-s1Du}v88{gH88{jKLE|4+{yzwfe^~xsh?f5!LgOEn|0hD@AC~_wLgOEn|2Kkj
zKL-OW|9^zWKd$_L5*q)o{J#<{|G$LBKP>;xgvLKC|KEhhKP><6M9cp_q4AF^{~v|M
zKP>+*Ma%zBq45vP|5Ksy56k~oq45vP|69@W|5s@I<I4YMq45vP|7+3m|66GM!}9-J
zX#B(S|6OSO!}9-LwEX`U8vnTR|6yqS!}9-PwEX`V8vn5TKN%YTu>5}+8vn5TzZot6
ze}=|CuKa%*8vn5TzZxz7zlO#?EdS4j#y>3o--gCNEdTFD%m2Tj@sBJ2ABV<2EdMV@
z%m2@z@ej-Y)1mPX%m3G*@ej-Y+tKp>cWC_M%Kzt~@ej-Y>(TQ6duaT_^8b8j{KNA9
zeQ5l{^8bFc{Qn=``VoM#K&>DU2DOAh7}Od9VNi<*gh8z$5EfuK$#8^00NiE*wID$C
z5E}y*11keJ0}BHW12Y3J0}}%u10w@JwB-(^QcE%tQ&NhcJO+j^cSi-!yv&l!#GK5k
z)D*b5b7D@8LQ-OKc1clUa;lXAgQ|f=PJ{x3pJ#xT0)!pm8U$ndz*#}A?!i_Hss#!m
zL5^URCOH)fF0PI+1zZfi!BBREf~zaY0K*D}0I-l@g@PMck70#^FHFiaNZ$o2t7>3a
z!NuSn5Tt5glwzg8;G3A7k(rmO;GB_~oUPzmk(^pkl9`{U$Hm~BSX!K#qL5UnppjOT
zpR15tT%>8Gz)+N$UJP;@gJ)iGNl|GsNVP(6WnOYdQGQ;2X|V#TiK#FXxll9&r6#5*
z1o${9xE2-V7jZGTB$gy9U=<86$}CAmRvO~tq!5r;lvz><)9k71oS2-EiYDp;6%9^J
zEK1J6A?cP=T8u7-!vhML#R{3Z1x2aJnZ>DG47t#NO9llTgJVu+dR}g7UI`)y8ML$%
zJackV(-U(Pki$w#iwh(bP?TAgnUk8Hnu1L>q$sffLp-1;KfNe17d@^RoDx$MN<bPC
zOB4c}trS#qDs&XUDFnnQOHD4xFS1q5so-L8NlhwEPfsm^D|Y}X=3?+oEY8l%OIJwB
zPcJQ2$jmEAEh;K4C{cjuRZvX<#U6&Bl|n{hUP?}Ck%B>mYK1~kYC%q7GRPPZmy5yE
z$k|FkL4hGDu{5P9u_TqjCCJg&N<o1^OG`^3Eip4EHAO)S6dJJnlv<Ku2+mlU1z;*C
zKQRT&NXpMINz2ShW$;Ta0UN2TtgPS~6yzVI0AdB?q$U=pDg?O(yM`!~WTYx2<tG-U
zfTXw>4E2l{LUo<;^Gg(r3=9qQ49xTlOc_)Qd>K+pGE^bPgX~W(fe7R#CKqRC7JxWN
z%z~oK+*AgI=zt(kU)NX$uJFX7yv)3GD+SeJ1z$&J1&}LKi;Gi>6;kr^)Jqg{6HAga
zthg8)Q&Ngji$Ni(5FF(13ra!?P@r1iiz1(zSC(0n4@pCr#R>{w`P7n(qWlt2*yZIj
zl;&mU<(KC%<fWDrrIr*`GE}A(Gvwzbr!pujE5Kcpo>-Dvo>-Y#ppciEngYter6me^
z`6UX)sU=(tT#i8j3PB*<3d#AUc_j*<{0UNKtx#N&SX2Uvy~Omy%seiJq{I}3oYcJZ
zk_-ja6a^b_BFM}uOU%hkQ3wJVlaZR3l3K*YkdvCH08$KB1<n%1rMVzcE(QfpXWsw?
zkNn~ig`m`w%%arf5`~g{1=Rvi69op<6g?PX$ji@5Wq>;$<jvf~;%tWE)S|M~qRaw@
zyt16cJaFOxN4=Fo0!&IB;XzQ^f=NS?5q3$xe1+7KjMSpM)DnfX{L;J>Jy5RHf}|=d
zg#=KVNJ%Net{Ef?NjpgLT#iZkMI~GePL(C8#h?t9SDcnwRFs;cV5^{-lcJ!Znp2^W
zky@e2#h{uK!2n9n#hF#9U<N4tFeH|i<b#qt12}Y(it-avk`s$dzyZ%iT%6@6m!y_3
zB;{m-Ojb=+O;Jr|aLdd|RVc~NSI9{$N>7DwGZKqIk)x2Cn4XyoQ_sM~si2xus^IIS
zP?VaSnpu{b!o{h;z!l;a5}=R@DyOX!+%k)bOB9lF@{_Yci5ZlxARI%G|57x$f>Bcu
z7Xw#HeqJgUswwKK#p((gswtXW41W0~3gFb7nU}7or^m$*qQFp+R#E^q732#ruOu@!
zHNUik0qhhg2W+82Zm}lBbNS^upd_x4o0*rHTbiq2t6*qgV4#p&%*CK;V3ZSqM(Abc
zri0TGJmci$D}c%w1yIB&<R#{&S}T+mgYpB&wOkCLV76+pLP}~`W^yVQ#4X^O5t0nS
zDcV{gzqClfGXPd1fC34W(iyB3ic|AaK*oWxbZL5q0yL$AwSi*=WTyhiGCc-`;LNI2
zkX}$pssKq*wh9bB`H3koldV97E~rcg34+TaEe?o>9E1Ek{oKK2Q)V$VaPrbY;jN&n
zkegUxrJ$Oksi3P+QdF9koLG{Y!o>j2oqmbAsSH7&k}@E%B!j`vGg!eTKQ}QmPXR3B
z<nJF6pn#ezi&7I)7|KC4G^Df#rDIT`0V**-X`{Hbpdh~pY(=I~a(qcqA~;i6ffHYH
zVonaYmQYYFwt`g%psJ=IIWs;Zzc@9%AfvK4z9c_BskGQi0ao^aWVjgcs{v`uOis*!
z1s0O}q*AbvAQd>x#Ht3Q1H;VZ{JgZx^o;!C5(a3wuApjQRG|PTO~7nq(x`%qK~>k#
zsMr=1gP;~67lQ^kuu@Aj8FEu|!38mr5<QEYoCq$k47j|=Ni5EQs7V7e;ez>TX`rQK
z#YKrwGr%m6G$>)G<s_yT!;DomD^~FJsN!PC%qvMNN-bnaDlG=nP?xC|bAhTr)l5)~
zGC<Qa*oU^@1PiJjAhkM3&{jd!EGI=Fsi2sPp(r&cKN+kmDJ3&6EuW#FC^N4_!3kU?
zd*-F(D?pl!rA6R+3sGJa6y#(kCxV-ki6yY0Q2>_-%E}6kNYW*#MY)-Ipp>hlP?W3y
z4o6T31*8_G<rn2b8v^-h;I@EsKqy0cJ_9(w6cUk4Ni2b-4h40Pd(|00q(XFJQ98)h
zST2yybRpFuevM$23JL{@#o#hRJ+UZVT_LepA+adE6x1dxW&nkMVo`cAgF<qCUU7a-
zsx7F_4uNKeB2clAoS#=xl%E5t8iPVyeS;M=kQ@l=EL3QMoCT^pD)4FcOD%B<b^$p%
zJyq980aT%+7U48ZK|vwHGXT_#(bLmY0HtAQaRL|e_vQi#hvp^cgBrgOFRB)U+@iqX
z9_kkb>dchFWpxztOG|X~({yuFa~1N76!Obbi@*g0qy_<%K&7CT0JyCNX{VLsgX$ZQ
zLN12Tyv*E!oK#S#rKTvrt<29;D5)$+1y_Zj#z0ynC<s8UI#AGMgR1cy1#nsHlbW8G
zT&duho0y)ekXQolW>tV3%LQ&G`+_Pw1;5hVBv8u*)Nu9yw_+e|>f+K|uxG<ki!#$H
zK}LhSMWCh(ICwzn!95k{AZIRy@S^;@bf`@sAlIek7lDE;IX^cyF)syGfm?o2ZX&3u
zfvN=BR7p+*wHnh?OBA4f$ppDyk&6K;4{iD>fQ1!6i9E3c93qNb49@wbIVs=<P+DeQ
z3e14iypp0yg@XLdyb?t&hM>gUl+5C6sQ%1ih2(rl13$kAR<2?gl&An{>p|)}g_5Gw
zR8aiDi*yCYqU4OslGNmq(xOyQey!kQ2q^-GT1mb_YDH>tX-TR=A}A6;!2wDa3i)XY
z`9<JHBWR6lQA#{GTQWd7sd*_3$+;;xp#EraX%aLX!Cr&g%EgeBQlfxcwxB4r0FQJy
zta1eP%aSW$L77{cQ<4dCX+eG-s1pYXXHb#^rQMR$Ja|mxrIy1qVJJdP+=z|{asmf6
z@*tjuMlGml0Hw72VsPCLs-`tTH9xpUKvbU~Wx3#T1f?v3xB;B<p=*kxQA;scF$U6)
zMQ3qIKB$G7nWq5J&cz8U#o&dP0;oI#<sfxyh4KtgTR%S^(oazE$;>OQfTlPdE>4g_
zb%o@_JcXoGaM=rT3aI;&pQezQrvQm%NE+ng499JhLU~4Ja)v@tYGG++QEIV5qC#3u
zVhOb2r3+4ooQVo08JR^X@G=$@WKaz$Q2n6BPev-dkcZR<T%3^f3^oSTkWJE42!Xcz
zN-`4R8L&LFBqP7H1l`>_T%4uFpj54{s}4#BU~d+uCg<lNoT8`TnWj*gU#gIj4^F$F
z5LJM>my0t|At@yuR53#9L51>6&?r$VxcW#<QOL|IE=f&H;o=G|P11#C0Z=OrWLiOD
zQ3)syL6TN}Nv=Y1YGG+=UUI6Qf<j0}Dk$M2^yGpH+N4yj%;Mrwu)$!*g7cq3Qff|q
zxq?P!iF&a@em1Dm0i`#vN(IoURWXv~npRw#;3TVnk+wKN)k}V{f`Tr%qEYY<hDC1?
zw8YU>fHVk7Qlaq=X{D#;l|lKCB0wLKIO0?DQn)zNQc6H|uL6=@qyzvdi8x^eg)Yd_
z;)2xV%(Tp8P!<LkHsCU(peR2%6<lHI7pIn#7I1Nb$_|jxsG5>e;!6||in%z!g@^*k
zSN_2YaI?XpNvUc1MX4}PW#;FBD!KH0F3$9Pkij55kg)O(W`G0^12iaLMH{F9V*r^2
z>(DDO1f>?ImM8>;IKx^ypo%6Xu_P6g#Bvi$xIndCaB7JHL<~H10v2;e7jsE0Nwrc?
zHA&G0jqia81r62Wl*CF+kn=(^b3xKZDOMn9Fu}zDGL#`bwFDGM`bA);fP@s(6hJ*K
zhG<`37nh8T+}!ABXXn_+$k=GT;^Np?F0dM~axRds;TZ<j=&@3OwEV#8AZEc8D&&>s
zrWR!;!?UjyxbFr^*Tt2^C8@a(pQ7th2V19(qzfznPS-&p&J4k&c?`b!c?=<?sl^Q8
zsVRA>#S9@CrA5UIZbg|4!HFfMMGRc7t^uH-7zcw2)tm@$*8@~cK^qDR`Dtkiss^9|
zSLgtVYEBBM@Kaz&O)V(O&t-sW2W1e5QyD;=AO%qA1U3gufJ{lwE8&9ZQ2<pUsn}J3
zVg;PiK&I$J6ec9+m8dHufyWWRMSDU@Y8lAf1O=$=iJ)Qt)Yw-@$WKdC2PF^CfJROl
zB>RCHJ|Oj=ve%#j+;{{h7f@$AQNh?qHz~73A(fD7{7rLcql%cOc?B1^6VKpST9Tie
zSdy6x>1gMtDTGyo=NDyz##N!sH8fX)LmupOSJ+?;(r_ENbWP4L$V^QEm0*5h3PFy(
zT;NI)WDY}WZep^AfsTPDgKDvrYOw-CaZwqF3GU%Dq}qanG9YAraS5pV%}|mD<|`{J
zfWs<J!PUnN5~ex|iN(dGxuB{#DKjszs1ocf$f!V4etrqK#L;j7HH301G(o*@umX4>
zmO;G=@7o{(5GIA_*FZc`R>1&j;wr%8!D%58$xRH95;?WFI2Kj{gFFt3_WU%sHn<n`
zz(JFmlLj#s!#D+aGXTHANCs+YDfmHaPjINFq^4!&fyZ@0!)Xejatu^yWrDkPs-W>+
zF6eM9crXJLnqYlOs>Mo>20VO(ML{*iN)<G0re|zatjR@;dMtM8f?DJdlR!hwT3TQ?
zrB;*}DIgq{U!(wT9%CwY0}Y;msz&e_p#rE|tfi$8nwOXa9#m5R<yr+4$0O`g1x=oS
z#sWc#xENF;7`Q;zgU8MwjSz_2z{wb?feTXQ2_0w!r7Tdvk(r#TqX24ofQo`>E0EJ;
z)fJ#V0?(l+fc%tJ9G_FHp$V1%@j*2ZxEfM`q*=(|79`>oTtR^V3VmofW&<AgPfJWr
zwNtQ3NiBm~V+ToOu?o>3wV+%Qs}Kz?oM3HBkS!<{sKZpML*i6DCACalAwN$+9d3m>
zw9{OY4{xABdf^ZqAjg9p3w0ZapHs|`lUZB>5eB8zL<Puja(+>zf<{VeT4HHViGsc+
z18$GN)x({RFc2In*jx&+N*%6OodML;Lds~MY75k60ZkA=<4waa)W=6tkBcEEGYKRG
z+WH3`7LSLFnrnbd2nNt7Tz<Yneol&x0!SHj2puM#ms$=Nw^L9}VNlXhP-3uQ0F4T&
z7BfUMfX13siy6{VN<hwG(AQD`*$e6Rr4~WE+*<m09IRTv#o(7(4jQzBkMyTjWEO*4
z`0(L>9fi#FynN6&1*(_w3sUpqGxJLFA^zcF$jwJK&7eXxLcvA>-8_)6jzS`6xEwU<
z%f*nJjT}w|i6t5Fkg+TcP0-+QX%VPM0p&fU&`eB8i7zfq%F9nlg;^e)UsP17qu>du
zxuIR+<ovv{)S?n_76tWQQ!5HmlS@ED3mJ(;iOD6YMGESw$?7QaRGeB;P?TQ)GZo3s
zbW|DDV%1`WYEbwUgNy`?v8SY_7NB@dwYb)rivgq(N-5YXFsK%TV#+^2K}#RxDDbq7
zLP=sesPZtdh(K{oN@@<wHQ?e0$vG*hIq@+6gXO@(`Bt2qoS+24#ZZ!8l9&S;L$`v6
zfcutQ4Ebqk@hK(okYPBe6tZY$UV1T#aBgaDd{J>(ZejskxGc4(I5R)bijxyGV4IUz
zToMl&tciz<gM>kaSA23oX=Vy|B-aY+ERc(!4uDt%aV?T?X>tkNrabUi4XAqxasymA
zDL<bfGcP5zf|FB00W{iGR03uxfQ;c{&?OO|1bKRD3228d$Uaaa00%9oou*pBscK*W
zYEK~;C>lX&5*k==jcD<OE}fL0$N=ixl%#^vIJ8;-b#WC+OEPmnliaXAAY^z_LBR%;
z)$J6bZ6LYRE*9i85Y|-ybrE2N5oi<^T<ezPL$z>$N*M5v8@M+F(t?R~6<k2|d16tD
zF1+Id>YS7ofVJo5m!&EwDA=T>l-McQ<fWEF90PNUg06ydenBO;K@PGFZnr{WUW!6)
zVs@%RW{E;#a!F=cD%iZDR8V|jIs+!6s}KZH0W}S*T3Z1$KMZO+l;kUzWP>XZuxXGE
zhk^~L1ObH*DB~c)2h>XmN=+^;D$XoRg?3KBeKn9ti6u~NV1vN*i~>|dA=(DhpaAfw
zc79%}LQZN~Y7Qg?Vj2VrI#75)Tm&&kA=;)aF$dx<NSuMiQ;SL}?G&OxK?arvJ0v$7
zl)+&Ru>o=HU||EIbrqb8Qb8TXL<P{u6i8knF%49#K>`76NKr0GDa;UTzHv#-NiBhl
z*?^76FH%6b32X+W+5(${mC#ji$t*6&Nvu?Wsss&jfOUdOf#iZx1)Izi6sN<Cfdm0a
zl>)e|0BeGbMnMy<f(<CzQ8eo+IHsiNhZcZ4mr%tZmxDEf%Bs{{Xbi)wL85gPf-~~V
z6_QJfia>*Xppj}&KeDJSwHR4{VoC~j2Y@YCNCcHh3Q&#6`cfc)X#*~vkX@~-01amp
ztq?ntLDO1!3eh&;6ltemlbV+TNg@!3gYDEWg?Jd0$MvB)l8O@Zk~2VU6p$#W<bbxU
zAo}o;P`mWOb}8sW2V@{gSwA%oGS$fC=O5x~rQniUl$w@W1R85nNX*Gh1g&*Qs#M6&
z%>=g;Kz8S(CW0q8)%DeN6jJrl^}tOUNS;iEcHa#27{Izg0~-qJ8L2r1>I@(fI!gpC
z>l9K_i<65o!7GvUON$fJQyI88b)gZORFs*ThO7cKA_f|>f@&`20vQM&2?7nN!1bo2
zmVgIO6u^dpG^#^&sWXIuS2iSPWEOx66!3BmD+bU+UIYWAg$-)QgR(ftvmkYPps8h(
z3W%Z#@anD#D+Vs?igmcaX600XC=&=}0ix^`pvHqb|7gZL2RR!Xfx`;ii3fLwAuL;4
zI|T-3XbMg$Ed~u!rKZ?|s@>q!5^$WrMM0fo)f5HLbe~&dW)5h$J~<;XFCAnVLJ?#>
zKGP@}G?fb;Nrbk&lZ%p#jTAs0h6PNto`H^no}rF{o>45Qv6WY%pbHA{0?>#*#LeKw
zE@(a_(<oUXCqKUcw*k@0poqv%%1TWxfp%o`3qWoIg*QkFQY&(SOv+6m!5pxDaI@ai
z$Qjy;f|!zv+Z0{sXiZ7J0z#L9258(~H#0A}2s}5HnU}5!F{vE4No9#SrKt+h;B_{j
z{y8XqK`Sv(%uUP8$$=P^N4ldxlZhpXdGLu$h(QHK`AMk?x(dahLJksk#h}g?DA|I%
zlvG*_b~`wDa7HVnbpa~lKvg_wNC7k)3tDNG4-y3RxuB+i>Nt>`E@%uFT=j!&afZxi
z=A;&Zl@%AHrlu%FgDFs8fE|}#1RnMSDTk*+25@p?03{iQ++2p-a)!KI2C$bHoItC*
zpi8R2%O4CZKnoy3Qo+q{)f9!ylGGyb46;VCrUGa{61<)TymX~lkBfmfAhDz*wI~lf
z))%3m09slI>VW9!sTvv;bHD)uXdxm*f`Q97H5b~C0*~z&SVUMs77Rg5(NTbRDL@%B
zf{OvvHD<_2%t<THFG^tm5uo8X=rEju29%+xplGXrQ<4jA0ES+Z3b0m~1=!>vZorT+
zg6IUf51SkpLr8u}Vh$+7sph08fVwOS<*7xGRzY!MZYsC{vw)Oe6%0|SMftE^qrJU7
z7Xu{UgXcg&@q$)XfdZ$3iy^lpwYY?#7(B@f8m$8lpg@N`!BWxS`cEMmRQ*I3K;tVK
z9<jx-v9YlXnR#iTw3Z4fSn~5=<&r{CVqSVGL$qF!j)Gpfj)GoJEL;lGkBHAti-(pp
z3`vQ_snB`{nh;?r9n$$^09T~2Y6n#gTqZ-?9nc!2m<wbeXaE_i50ozm>jD+d>iM8S
zTv(B*kery4T$%$;$lyjlDD#0!5$H$^)O=8f3$wsgh%Qbn15bT}?2ctf&Mg2f9RcN6
zkcPw}Ea77a4kaT<QO=Nzq@kb^H8hL!ON)|I6-q!$$x5K=p}_zt-Za1k8mcCcLqL8&
zDG*_f%FR#7OsiDTz$nYGnt`qhqgV#}B(=C0ypjgw=@dw_6su_ps8tVxy}dnyp@9K|
zp#ei$X-*C}6Eb+Zy1FV@7#QgpBbb&7p20qje!7NcAq=Xedf-NuhN^){Mg@491<Z#L
zy5LboU0u-10*D$bs7lpRJqA^yQXN&JQUzND1%)KlQq@wBHgGAaP@I~R3Rzxl3mPc&
zO)4k`DF-RARZukrt4t{^$VsgLtuO@3=|YTxN<s|CFG80FnE<s2Yz2}E(0W}}qf(GL
z3?OX~TU3h~+*~3UJX|6e0z4wYqZCFFRto;1o{+^i1||_Y3cmR%sX0)-QG|{{P-+<x
zPt`aDls#07b->+e)HV{hjs{gvAk#sq#TGQMrBIZb4rXwHa{-tM7XwWYCE7Bm8kj_I
zp|_v%!Icm$vr<aI!(qOjo(d_Yxdoth3wX*fKQ9Ni9-tU(KygW8UJ7U-F-U1qYI<gI
zNorBCj)H-%sU8<YZe}I}NCKmq4ykcLVT^%w6~G<K#InT99PkJ-L~SuwZe}L5eF7eN
z1r4&Ib{s%u39P>Y(FE25>STesm!L31)&QPSf~I^0kSjrf0a6Us1+Mtv0|_=osp)XN
zpn5zpMFFk{I@kd7y#iP<*bqo|hj);`hS;PemL%FKz?x7ni*XwQjsRRPDJV)UDXG+j
zbReK+fbCb%Fwiws0L7Ok7pOS^8eGuNF9M|vh1|qS(CPzlMNkawh8XFZ>oMe|R+K0d
zfTx*~a#9%*lR=|yIjJe>sSHJ_x%r^ER?zq{g9fxmm!ip#SX`N#n_2>zrz`+%hEM>-
z8K{78atwCW4KYFGM<{^G3<YS8L{%CAQwq_EO(j$YtgoV?0#q%e<TJn=gW(nih>KFe
zGZ6?kVRZ!5XazjhDnJ|v%F&<&o0<7}47rJUrD=)a)jdVvxf0N%ZBl9xszgz0nI25S
z(7*s}RRmU>;Bug*3tBKKfC@KIcEJ*aa5*gcAZCUbVe=VW4ntpRMM-KNXlZ<LNn%N9
zF@vw0LP1e#VlHS-2Q&{;1X?tZpU2>+?*}R!3P58cU=BEPax(L>L49P9&aA|wq|_pX
zlvL0%C<eH>$%zGtNubfY%+z9VOBS>Vhykrs2b&0uzk>Yo)FRy!(CYro;`|)Yg8!ma
zNK433-;W_VKPM*>G~TKJY9lE?HG%RpY}FtvgM!Ovh_^u50bFE(#XMaU3^7EE5F((t
z*}T;B{E|#?yF(!{1vGA+Sq$#(;8q5jh{{VXQh<9Gp|mJJzXUYw#gLL$oLRt-0$xgt
zWeym!gbBLX5nQ)`Hc5fH?F>bUMFpUNA@IB<WExhXEE6=;RZ^Z`l&t_+pAA|ruMb`s
zUQm=@lAoNP!w?Ock^&VC;HlB*XwU*(&j3&<X%!1H5H>#*3!az;iQu;a)pU^h0{j}l
zi>1*V6`WWG>ead;ZS(-`gD3`jl?z!IG~5MRrL7NYh=bbe#o)PQaHVMlp34Bw8A2yp
zk>xU>8;+6@(;K$xpuwTC#G*`4@&&JK2OGh~P+XFdnFk_4OY4hEQc{bG7@WZ?5urm^
zpovXn(~<Y6fELH4<$zY*gH$O%bfkb)2bX7-BxfkV_Wgj0GSFOTK{2SH24%J4Vg*;f
z5Z5439|5ex3A#lHv~E19pcw2sP)>xd9WPETNzE%`C@ReZVNjmTP0ULHZ>venQ$ThV
z%$p2liA4(0dU|@WiN2!JJaDBBYpjF91k~cdrWw?GR4+>`QfB~FyVz6|Gk~gS&;rTQ
zRIn#NWtT3vGmA~Rf;vdKIw&C2A&p=?Jw0_Uh_}Eo0&UVmLJ_Nvpk_ciETGVU)Qi}x
zD@N_PfNd-W_3J>RWLPzDfeiyK$^tnQ$wy#us6X@5@H!0C?Etw8L}OJ5Ud2`bnm8&h
z0gbzY)*ga}_MA#HL5s&B3#$U0JwYu;BRvDqrnF)Os3Oq1Y0&cMoYW%FCNOaBhn9UH
zA=ub6l8`TGNoQ_qN@gOoWyRnNK6Dk?B&VXxlyvaIoXq4@hG0mq6qG{rP*j129Ux<2
z3I(8@NExX`i8&0Oc?G4gMTrb9`N`l7bfBUaRCxwKmY(GoF$AX;WhUk*fW|kFT<4ir
zlA4o~nGOmEB;nvhuy9E#vi;6Ql?5fBoqq)xnaMEExC93<xa6lovPv3gQYEiaAvq_p
zxEM4$tOwd~pr8OMO<_z`T_fXSumETSf`UR>YF<iyk%FfSxa$E*zsT62LRHVC0@P)J
zv^EK=0|gssk_T23p&E-Y4-`VB#qeqZRT<cQ5POSK%OF)ARu_WIgZKmNXNBbalvFgM
zz}|tV11*8m1bL>oGzk(&ST#TtgVYs3c3Og0`@okhz|BXfO9t;d1uy*pb>P5OA_#;!
zP>r6KTnS!K2R8<;5TOn_cLHAPj%gr5os(y92&OqO0}<*#T`pLUSit~Y2S}X-IFeD+
z84{_^h)8wDM5;3(Qk^Mob;*fEDNd!u3eKLv@I?@aa76eQln$Ud8cRL^se>d!Bz0Jl
zAwpehML}X7xPb;*T8I*wwvb#131@Ix0`IKFmS#ZaK@v4WT|s6Zx_7~u1fniCGf%<2
z2s8qW@Fgr2K<tI8ORP}vNi0bPr9n)U2zx>MToa2b!KD>szzo@PggVHIXIv_g)RiXX
z7o~vr>R>SwNga3vHOM^VoB|rS0Qm-?&eLB39JrW%z)+WynVVUH?0S$22u7HP@CUS5
zLNOSm4w4R_LtHrQ#!!dDZiKo5&}15@jfB-;-0Dyb#;p$Q(9(i}RB#Z2)Iri8y1fwd
zU<wiHVBrjrF*H+1$}A~{2PQ}zBwRfG6_AZUQ;1NP1gU7DH67d_NOXYHGsHaPjuW~n
z<n-(e&F7eD6l5gGUP!u!sl%44u$hM(9f;x*WF92^VCF&9LHrI^h*KRnIuOMwPIVCT
z;0iI-!QusOCCIx-;RkacOkGB1dIqB02bl*6XC!qHJ5db8qYlMDtm@GG3UVNBbztLA
z{ENeVa5Xs1gZKl*K!m-;rAb)Id5~EkjG_)tdk3K|z*zwlgbIdcpq12MFM~Rlph0e=
z@*cKp3sS3dF$5<k=7Ek4PyjV@A@+bL=0I&j(8R4%X|YRcnOkX|f<hR$b>^9(prGIa
z-fxV=RB#40^FR()P*4Ev5&`qM7~&}bps8%53O&%cE0_Qc1arB8HpU~l7Bm@-q{a%o
zt(E~YrkR(bkeCeGZUI*B4Bi)83Ym>l2rfuWPGyKrDlLvxh|bB+ONaH!iZk*-J6ehq
zK!T9L(fl;90cgRao>W?_&Q*|{30q#0q?e+X2JJP0=Mo`-4C>_|LRSH#O%Gy}URr4$
zcr+bi40Lc5WvU2lCS;BUGH!q}F%7j0suAo+$nIa5FN;CGRM2pCbJqmB6g1+9#e8T&
zff@&y{?Gx>gMqup*{P`o3eIlsux1<BD2OV8hABYQ=_r7vMHJw()fmQs$8K?(2I=oX
z9SBwn>bWAh2|V@z30Cl$X4n#Nh!A-7F_)GWH06T&^q>{g@KJBjz(al!Xe1V@9weKI
zI6p^EA+$JEp|m(jp*T4)543r)oB=$C3l1dE5DIA22{f9mr>6(n<yZn*u?9LvAhDc_
zAt1mRv}hjeF4!t+uzJX1IM6;#B~{RpawP=~$keTZ66AmoB~2~{F4*>0@RUSouoJYu
zrJ$Ok10Dp0tz@?XZ;H2402`&C5K>tH+E@cJmkVq)XyrTF)>3e|fLD)$hMx1F<5{4#
zK12&>))_k0oSz3-{m#V@oSLct>MRz4)@3s|mZoIpGdSnx=9cC`H%l{kl;$SpA*lhc
zOiL|-bf1Guz#+}xQJTcy?Bc8d+P%sEDO^A+M!=h<&`r<*6)NCvm6Za6ALvjHP=G2h
zc&Ao^R}V7y=9d<yqL{Cvz!2o*tiTZL=B8_5U}TV~py3$e7~rYN5a{WwYiMe&pb?T-
zkgCZL>gEYmWNyF!-v3;nrx5HM><RW%VqS{AQ)x~%3P;~FuY>_43Lf!i2rdCFLxzlk
zF{q}1Hd^Q?D1c%r2-ag%t<X~ib!)&AZ>q)M2`2?zNU>?909srPE-|g32OGhIR}-c(
zATc>RwFGnq185XZK>?*SD+Y;iflPsfqZO$BH2`(E1B&ufN|Pab*G(!E!azeE;F#0{
zmF~fy4L1Rxf!@><1qM(r1<nbAOhAMuW~Y`GfOlb|*a)={w0;rpR<J9;lk}=7xsISd
ztAYX|5x{kT^f=~#7CnF#3BpzeffBQ8UJ7`3FxViderOnhT>#R_;F-tZUkW|iKvw~#
z1(c&fduO0aJQzHS^I@kyF@PNi>ftab_$F3B0ur=x9pbjK#2f|Hl-yzl6AJ?c-z5EF
z217klD8mRsb7<=_sHP||fTlb(z|(~(xsIUDyDI2V98hF}W69qevNxJRBPdl9GEyEI
z>;xW4EiTC~U;rfuP`Lu)6r`qDfy$HYq!fkX63})_$iQ)EuoD;Pc$v(^90ssDP}u@D
zg$t}d6FmG>P>`CUrvN=;2(m*`9b7npPC8LnNCTaSqQ}JmT6xF71*xnRLW)vTtw4t>
zq%kCeYeMjP0cddtN(`W5YW)0RB_yb51P{)Fk3#|tc`<P1<%1J7L{G5-NC|k(kc%NN
zAHH-EA`6`<1|8(V1@bp&e$NU~aDjHYCTA-sgHEB*fy~*1n4nQU1qM~n&>Lt=3TQ|s
z5uBa47{I203w|<;f$9S-*H1|;gO~+%Cn&qZcRfPHxER3o3^d%p3P4-!GeHAeh$WgZ
zwWY;Lpuu-={R7!30`f0J7QD{|H0BTTIe3Q*LuqjmI3iIt>w(5}LDQTd8Z_CLoS3Hx
z4r*xc1hira62JKc3ejn?po{=Y9bh%lX|c9x`Jg2bAR#W0I#9%e)qs{;A)Eu*rV3I3
zs;LyBQ&P*|>z?3|2{ser{9>?SptuLsjELo1paqNI!CR2gFll5hDXC?srb8FAz^02a
z^?_{y)roL@kYQes5Tt%90jEaLZvDJe&<0n~z%iyd5GR9D8@REekd%|HtdI;|3<ws4
z?qkf!PtFGAB-rs%u=9fwK<Xj;fJ)$N%Al<yg#-`-oX^1N3Bv-2DDgIc>vL$g4P-Q^
zsSdFNGNP`Ko1d3il3%0%-NC@1TC4!7Ke#|A|0JfTT5*9&JYCRkx5Shba403_D1cX*
z!ebM(9#mJW7_5yU6mnV@Y_bBfxgT`sP9=2RD|mq#c#An~$1J#z0Jo+=8|HIz6d>&c
z=*Vg@7Z*cuW=?8e3FMd`$Pr`;y5O^PoP(S}`@=v57;GaH(m+2K7j)Yy19a6eXvYxv
znz15ij?V$@<ktZ;!axiEK_wdl{HTOv_yH53EQ6_1K^3&P4n;gQFNG-mpjBRA-H`oJ
z`NgSupbDJ}o91N5LU*VSAeQ2ABdCl39k&8egxIYIT|Nz3%@0~_58C_-s$o)#iflo}
z73dfu5UmeMC-@uzQ2}zR9v1^7H^zfna@h2MLJiys(c@xJhNeB;<kXy;Vg_Z<Odph8
zl$y?<4_+LdS`0dS2Xv@OiE0W1Xd_3CZf;_-E>tf=N^YVqWPt;u4urI6azWeu(a*p`
z96g~2*;ASupOaq>E<bbQL6(E+TKM@=ur%u*3{SquhkU>V!KbUhdCstdVe<1BRExoK
z(8jTXf~uYt=m4%_$S#Ex(BXZco+auAbp=)A4e1J@A<m#3QxJn74QmC^o+(g^K(!b;
zmake2YRZDo$pRb7pjr%Sx`Va_fTr(3XJUeeY*dR~!3UuPfDS^j0v*c)5d}3}Qu9iR
ztw1(`T27$zRzPiTutf?A3jW};l%NZkz{^aPl@&lXWag!V7s@NZ&Qt-HEO?Hc@ymyv
zlc8D+*8}z&?0^`UL0~}zH}F9*;8{`J*5!gGw?IV;^t=*0)<g1iJZNA9b`pVtF6fMh
zeCT0I;I0+80SL1X<{;4QG-xTOjsiHJf|!s-17yk`Tt}CHPUlD|f#v~lrANqkXk8C#
zBZ2yr;FX~mR)F^VfHxaK4vGZraCgfAEe8c{lR`EDckpw8N;%kg0eo>K^cXR)9EM;i
zBo0t~h7bd-p9CeY)D#A&AZWc4=;RSlOEVF)-2rSYXlfi(Kb55B;dXaYPJR+-87|oS
z@Z)7%GLeq*NmPIxa)H(B;5Y+y%|J;K(xL^;XoEryW;kSLowBk5Rs$d{DD<=h2?FTR
zNfCG~Nd)(FDj>lODoa31njuL8#A84l3YD6|kW`gfU<4t-=@uG}=~bBp3?KqoFsCXv
zkpV=Y3g$E9ROKTJ!MgWg7c+piYD4FAAOdNbMY-jm^{#F(2IO!h25(T&ngcnxi2>|=
z2JmdLF31R|aFC;~3+Tioh*6N;C=9{iO(~$W#PU)Sb3i@gVDK725K{qqIxBcLUwldl
z11QL04SY~qXUHy30*4NRcV<y`d47J10x0sJ_GRW)KqTFYQd5hQ6LV4(GWC2Tkd?r^
z3p!Z@R9%Bk$V@6u0nLXy1-md5m89ktGl0(yV<^>4%Fi!hD9o#12=t3!D60TXm=`lZ
zk6U1XndBJc?7@(jQ;?C!;0PuYi*gwpgM7igxEzHF3p0kyL^BfxPe(HohFmj?YzAL5
z3vY(p%;ci{q@2X6R0dxV(+SMX%`7Np@bwG`W&p9wOu%dfGZO`;%o2vY%=}^_20u^#
zU<FT42JmvHf@B782ROhPbonVmv9YBAgQt_PLNJICTw0J?<iSu}kXV$=5FFqb<P2e(
znLv0jbCYrsle5z@^BA09jKs1cV<QH~upnb2243)i03rGL3b~1Sm7rroiWM|+6D#z<
zCm@1$&nqh{fJRe56W5^ayP#o6MZ}g|Xv+(;?Z(AWmRba^MU!(=7-AI|Y&=2hS%N|X
zLhQgxLklu0<6$%5RtkCfc?zX@nT4gWwFcldA7Ep#s0NJ^=a;~W=v3Hl3((4X(CLt%
zGcy&6OOrD|{hUnDxzeCE3wYl*q#*(}T#*aBIu#;PY^A^e(y9R8F$58}f;s`Tk_@!c
zumn6oodP<liwnGJ48EcbIz0w%)<a5Ur1LQH^1)|qLe~C4G=k3FbP9njlLMI#Ui}6(
z)X@(#^pu*y03OeS9{h-8oFR1O9v5g?BZM8H05ZbS54vm+Yz$<fB`!md7X5KCz)p4b
z^A7>_xZ<7t{oFj=<6T^XofSYMMWx_Xl%UE8bOal0^I3k84s<w96?D2Fv?Gs@1s|;m
z8Nr5*B&Mb)sAlRYr016?sAg({#umUUxWO$3$YE;WiCxf89%xJid;*vb*cfp71of~W
zRa>zR=%7yUZZ5DQE3mVD9V6mBLY=_dxItl;oB`_cmlh|*=cSg%L!%U$dO)ql5?FFm
zFIE7p>ePdFwiUof#^tGlPF@8yPC;@Cs+llZkX_KU1zv~+8rClW?<fOpF@-il6*R!@
z23ysf2u&^q^Z*2%kP6?TmtO=|3_9@@<V%QKkySv#5uCno1STZefg%ayW>_x=5-YGF
zc+gSApusI@as|hmA7mf}60nf1J6xbvFUTDbLC|_H@cABGpb>+3@Nu*ZTA))8L6a;X
zb)fnk<hDwC$l=M5%|YN%B2ep-0W?qzp4kCS<$y9O#Dk!vebC)~;DMK%6i}dpT4V}7
z`Q?y}!=O$#7XvibAej&vABy&1_hcufFqEYyGC<s_07}DPr+~&yf<VWA6_+Rkr{)!d
z4y7uA9+hBV6akv6fe?@a12PZ{jn`rw&`PF^MCejGa6cP7h^C&JqNiui#lQ(`h=4K#
zIMIT}^gz4FoSi(mKu1}DM?H-q5a%<1HZ~bWz=TnG8X#8(xjMQ;YLcuO9LfsNfouiH
zm@#P92sXQ>4^E_&sU@J(*<nXVaxp*;gMcjw1&vvPViBYczOqn{3p%lo2|Aq)blO}c
z7X!$d@y?C`kU|68{sAQej3`DMivf*VG2|vzfO8Mbwa_>#N(HSG0(G@P1CaRzpxuq&
zG>EDWDIG$3(*=<8)fqqy&%}~U(7JWd*73{~&@Q9m)DnHjCOta_o4kBTQDw(q0}B^$
z{<LFoa|wxe4GN0)^AB<J5A}0_3%Evj28RU0xqkk^0gleDaK4kHi@%#&uxkjiNPuIA
z2Qoi6#4!Y+B_t@+&)G4=6=8>yql>SjyQed<o-o&-U{8NPWTD`Ypit+K&>)0SPL3`<
zj*<SMAq;K-?v7Rppf!Pz<zS$L%M>(>3{;Jf&Nu^?wM8kZ#SF!XC5c81;L~QU6oM0T
zP0S2ZD|A4!b*Ty_6$;u43<1ubsS2P=5P}^;9CeMj81xHrlJxTnlJrxPk{NIh7WnxG
zDdZ-C;|^RefQJmgdJB>>Q!5-&44{A^C9@bbewKpAFlYglnFnzhXzMzfp&*YqB&DUL
zfT~i4+|;~MP?Ihm)ZPFw5*hOHK{P{IW=d*)Jorcj(6aI3TvG!hhK$nU3<fSPF3_Q#
zpaY7nAl5(v090Y5q~;`6GJr0v0Hs%O+65)>c#s@4VKcaZPB+j6-)x}(3M;TGkRTUB
zaYktgc(r;lWT`LgGKBoJG={W-^h5^mlq@LfK;z@!R=5IeK_5dHI6@T|47nJ>T!TT8
z3mL{xaE)+v4h`}2b60Tk^bh7@@bg!2b_{X}h8*1r@2r()WafYhJIHQx$PymtDGZ<x
z0WJN89qtM~MI3t2B52z)QCh7Oic52IQ&T{VLC`RCi9&jQJ}C3%l)_GD1Whxm=9F?V
z_y?PS8u1W2AxE*oig?IvAPNxo=|T#7g!>dUKtq4|X|UFvJ?OBYVDK_148MSSn4s2a
zeol(DLILEmgVKWZqQn%?aT<D{NkZ@elo)nE55xqWpqZCio>~MBSJ((Ax>0)IdIGgR
z1+9};09TEm_0pg=G^n})kA8y2{6M?OQ&Yf4KZ5$8knWX&Mt+e(c4l%mxI)o{PIH1x
z(kKRb5;n+GlnSb?APX_Uop?w{ffj)wf(bfmWe9F-8-Yn<21oy369qRPC(t3(DTou=
z!0t#*u~q<G-~cLO6&WB-2dfVTsfVw?aCXsm33GvtD5(}hTan-*6LQFD3H&5mP~0jw
zyFeon<~&de%S$Z*xilW+HwO4YZ+@vI;PdT3Ap$;BGNrUAm5U*`6udeDw85nk>QaSZ
zA16p3JTJ8b)I$Sh*HTC$0hGJIHmeq+D1pQhWMCL%xk7GgNk)DOc<30?=m4J!3_d9t
zx?dnKAJkaPK?*3)8Ka3gp!+vK_W<PQmw;?aEmGuSaPx5jbypxR1F!zb%u@ixJLL3K
zP>U@y9engQ*pCX3{h-Cx&}IP0&n5W^knX1*7efH3n-A8XomvTMx`F0cGV@APL2Cd&
zhnYI&W~L|l2SW^lhZcjLf;uQ$C8~paLFM3;<6z&y)F<X-W~VCn2d9D;&;%#uLe7UP
z2H$mJ1*r=m5eaH5ft&?SVvzCxoOAP1OBhO%Q$R;L78hq`GJpsu*96Q5kr06b5FbQ9
zxS*2RNY}*7fFU?D)4<HafWgzn6%@oN$g^dj#s<jlN^rIU_jHRP8$fbFYn4^u+ZHwQ
z@)bOT0yRNRGf*ofDJL5=J!b{&JV6>%6<iG93H5l-;NVbKtoFdvgG@$I3r+?KaBH9^
zn8L0jNKQ_I*$l0ez)d%F3qjglK(2(GE`zLFL$yK^W;skRxYwcszXbz&n5Ak8_)uTS
zetppXJ#aDw)h!?=WF~_S_y$dzrliIvr^JI!AI&c<0i6k6qTpBp+B1-up9eA&bl@Xs
z7S*K)bdnD|q!Ci!erz#(R1H?-K$^**q^JsNAv=P)e^5psxV_B9keQMipOO!5hckd3
z25rKDXC^_CU@5rUv=l%`s)CAgEzrbl31XgBfx+Kf0i3Gha}z6)N{d0M#n{l$h@lvi
zvQPz0Ang{opks(5B!z)e9ZWP7bPx(?9tu?8gF2R=W6a>EEGVSprxt_i9`I>vpfL>4
zlFj@)q@4udiF2^0Qow7<AmiO|4}x0vs>SfhWId1>kb)*3d=iTu7uc1MU_qKv1?30u
zIXEQ>(G{RMPH+bYY!4{A7v<-Gt_V`EQ0D@xgiMEm6@ps{@aZ#fBLkWcz}Xs`Zm7#a
z7Qv@f!JC+&8WrFt_+irxs=dIDgy}5+AL9fP23Kkd@QF{TJ-AF`2=+BKFoK>0!3E=i
zQX;s@fgN%Q8NLe!I}mj4rN4g&=#Z|`0tMgHyi%A*0BAKZ_-LJCh&a5p2Wh5(x*y0G
zTC9TG>)?VPw5+#S2fC*U)cpjPm5}Y<Itrjs4v-+|_}T){1vQZKyFtx41qB8U4h~hL
z6fmujRFs;S4Z4H{d_EG$RLF@x#R?!7F@QxuL(J$h3gDBoGmAkdRDzFU1>2vPrvPfj
zxmIMBK)e+UI+&msaykuUFIZ|tW(fmmwHI6z<j|4~(8>$QCQQhpAD>i^R?vwapsWTd
zM;XBP?LcY{(D+>{=+-I)$Wkta;*8Xs98k9?FV&8r!on=Rs5Gx6qo@?j&dE>D%!jc+
z(_tV51&KMSB_*lx;QY;CV4-hlqHkct;08KVKdBPBYXlU*pdKV>rx4_h0?-ch3ebjr
z(6uU{vc%KJ$JO1@N5M5B#MRHm)kPt~!c4(Gz}er$RS~qv(gayGxER8t17ZrOyQIj)
z5C&@LEBJ%+Vle|GQ9<^!L5~3fcLfwcdmv!40nVPft_p?~3i{y8r3>mA<%5O`Ag6{i
zIHqKQW(^AxixP8FLA%?*$q5vDpehp_fegWr1DQcrcYv-i$jr}UKw^WAaV#wXJ0l~p
zC<Qd$4sIkvnirsZ8$gi>?H@2WXXNJ>gU`SLbyz@`&wx565GNMr<d=Zf8h{d5eqJ)@
z941g1qH6>myHe1AH)e}cK@J2jmV_T;<Yj0ED!y{_LFY_?SE*?t9desqlnB~8RSXFm
zs3XcVQbCHrP7iSQ)Q5ysei2w8KM!n(0*X#hI~?ThGSJl{7!J~8aE9FN!4O<pPylZD
z<bp1}0v&9Tp931kEd~|f;F1mG$KvFo)YLrCS@k)f8_U3F>VwAeK@CAjxdDr6pM20&
zHX+Ud`kn!>2~GwSLD--iDEC0ylHiO1+I?1*TBLxcH#ik^r54gPMS2QQp<GaMNJ>>G
zDut|6PE>#omMB0C2BnN7&@DlrYmY$t=KO;dz|$w778^Wyf;rHt#SoSp!E2?!4uh7~
zkT`-WGlD6DbOdm!Glr>y+yDS}3#7Pa@DEmi<cmyD%7b1S1yYa*ud%^rx8{QHJ_EIB
zGjkya+<*>x2N%;IouJZAp*#^(fkInLATu)a(iuR-HY9Q&MKcc5Fbx3JMwxk~pumGJ
zSB3Z;am@lK?i~Gt8S;xwKxb)!cDRBz2{ELA?(741?Q9Jg9HDDPKz&+}Sp|v3pi3G{
z@)bZ@!GVryBKV312GCw?Tm6*OGX3I|L}NUrK$OE`6y$4oj5-H|f|t1}C|D^t`Z_x+
zfZMbI&I;fm7SI5V0&Gcul|n#R5V+xL5dm6AqYrA(g6<n)0A2YAx@QPvh^k3W3Ruv^
zCCEqtEDAch9x4dgtqDDo2vqxl?lnwN@O5GUHMtc6977xxJY0}CE@3VV#ubJ};F1m`
zh2Vgt3=K^XQg9AP%EZh-0W4(%(gqsu1&M-a4;NUDWC%+wO3E(=?Ggnq!SRO_5TMZ{
zNXY?WfeSLw)l|Bvkl2N!Y*?`exz++4sF3suI-(17c}o)Lyq=QO+=7zS6wrW4aS28g
zff5b;jtFRUBVsieTdbmMfy6C1jeu)dl&(HQNNR3Deo<mkW=<s}=V4Lfo)7B7q1XP<
ziWpR;fy?7mNZp<eRtyrw&;VL}0qO-R<bf7D<bdtNVG1<gz)MJQ=?v9|>H$!=#zT6;
z;Bf+2CSu^?QU$G@Qq9RJg<PekTFjuQnv=qypqiZNqzYPt3Od{e+)V;q2?jcjH5D{8
zW`uJ5a0>LC8MqQ0vY?gUpc(Cg)D-X`HE?a|rFm7E1qz@ROnw?z3N)w!*|z}isz8TS
zK*wU|K<98k7Zp@Mdr**jJHR4(Tnu`u2F5ul3^t(2KRX7EywaQ;O$O)!2hfS;C5d^U
z!<zE*719!mz&Fui%7S*z!bNky2W{m*$CbfjGYpw|$@xV^pj#UuPE`O8#KD(wg2tvn
zl^vwq1dT<&O)JmLOUW+>pU4YW4mAUO85wB5JOfl9xhPp7H?tUgaVFdVNOv8)t_tQW
z(BLHKQcKXHLg?{h#SEaqG4Ko;WIP<yib%->9p96js!&{+o0OkZ3^x<xUzkR)17IeD
zcJe^=7o`@YCYHdppoR*lhlG%W*#i@Wg%x;Z2qdHs0SGl7A`H5oQz0c2yeB2GsFI<$
zq$o8p7qrv{d?h4g3<E9-x_%LKQ%53HJTtGjG%YPNITN&l9I_gXA*nPi4R-1`INEXx
zAhQOrAwLEM4OeGp2nm`sVSpYblA;3|c<}Y8V$e}=_EAmIWN>i~0ttcIyU<f6Kxs7@
zyb~UDA1SEutEi}mv`{ZJ57AOcN(3E|0=mLbBiJQ4$`+hnHDT9TDS%f|LfnjKE9!x-
zy9F&YO;m7k3DOM)-4?6h;_2(F2U@-ey6n|T0kYhpC`G{ybTMWCXr(OZ*eM0LTIf+M
zsi1pw6u>P?RnX0z{-Cp+TwH>{jYe>FgD@U+PaEjw9OzAjdRz=a;EQY_?E;VkK-+3c
zb5g+zHWiRtL?B5d*SWg*gB^^+5#TWqD}{i}f>cn&o}%EFnFKm=24o6;EeOZrR|jr}
zfer*qO;G@CL?*&y_aH}KA{-4HLBV4pEQ}3_3uI_$V2L?UH%}qCGC3y|+-L)(!vgSG
zAJF(z;DR=qVdvz5#z8>J!J|H)M!IT>LIG%e8a*O)KqUjDjsm4IaGL{keNrX(RGDJX
z9m=3_WAJWQq<F>UM$l!cMTvQ!`%Chmi48PG0GTs@=LS7425``T2EV|H6N`|N8@R&-
zO7)<S)q__9U>zW#Vz5Jv^i0D*ZU-k_Lp_Ty1r$R-*QSEHSs)D{|C{O=D1_zbl<0?q
z_~1#;nJ`zU;7-~h$maTlK@3C@1nuAeS%&TiV?ASJN5Gfrx_}Q$N=;EngrqxgbSFaU
z!}83Ok__nN3N#iVfd}$gF~pU|Mxc-|GXcqi0tZ@BfVE=gWmq!v^z{WLq*A0(swg$B
zD78340dzODKB$sG1b=XV3+Os)@bNPWA<31=pio7W<DjNG$VH$s5t=CBG3T6^2P!qe
zckv;Y70!;q3b1X+U@wDOMu>rUka3_SiyHBU5HBP2W`YL1(-e$A2k;u{nd*S^nz5b%
zMtbl~%m$@0=<%JPW;b{N4#*!M+cP1j;lL9q<m60H$b*~(bqqA&f_b2jHp1Z=V~}f1
zKm=$U29)^FQztcC!;qX<Y;3EVqL7?eYyzcC!AoR{Q;HIE<3Sw=TTqq+7ahh3rU`;+
z3Sx3`F{Gpv8O0~%gRX6b*ELp<<fxjW;8fx41{yX^%S?wZEJ36U<Z2Flunsr_L-(QQ
zrzs@o=alBc4<t<m@2*1VE(NzfAk$3wdGMju_~gW5$fis9vLGu3WVMOK3b1K?P%Q>Z
zte~_9J*EV_lD{CQhyjaVpw(<)X=*9>P#NO=1WE{?iX60-6SSWU;S1PasJ!A5P{{=z
z$j6Z@!D$Cnlm<9^f+wLB9E*}bjZ9GU6g)|;$OY;-SwSv{Mcg?68bb!pphAu#gDn05
z%_xD)LD?M#8i4{`F$|MbPyp?%b4e`&ZKC!}0WHDwOo43v18qVB?^#Zb2Tj5-xCVgi
zcC}Ja2zCiFh!1eB2yzYvT_RspT#{Z2X=#C-hh0fZ4nZXam3jEpWaOk2<Rsx&Q<PGP
ztN=6>5#Sya90FZB2Rewj0^&@N6!?5P=nCf20!XO1f+WJ64M2@P*!2rwuY<&kk!L1B
zYpW8A6+m4}&`pA%#stD>Ctp{hO-P0AFXRFbKETX^TZ$IHiQtWWkXQ!C5NI_5WQYZN
zK{xE6Wsn0hlR-%bbmkcNv`6rbeBfmrAYBS6rQi`p^@8L~5Fc!cIwX53a)B0SFgOQ<
zf;_GOVu06gp^j%TxCelSGxQXk;4Ei2%Z0%?2qNnUXMxleK?I!`T;ZBsqab3A46YFf
z7F3}lgI~TvaB6aC5$KW+Xh95D=*-|60aXZMLUg+z1YJOvwL1qm8^i}k23IJ!I0wP+
zbOr5J1Yal!Ua|)sM+I+-bceeE#&TkSv7F&7H@N#98G@lcanyGLIX1}A(?!7yHXsO>
zb!G?-NQF2Mqy@?Z>wtMr-#Za>bsAhNEI6DP+(TeGVJs(xV7NmoOclaBgF;**Oc@kH
z{k;AB!~GOA0>Xl9LD#ToGJu!QgYU6c&<OBx0+sCw{s9o$)yWyehb`g*Es+HcA}J_<
zNAJK*J?O}mf@-pYt^#Dd2GnQ<4XlFqii4H~K=gn&wdN(}fCj4-5}^f{Ds+(#M2Uj2
zkwUhUf~T%CXsH*J=K|p|xH>s2Xjp(6EXA4-4)mlHO;CPd@N@KYLCAwnL)QTBV>GBR
zHPHm0#t-KkX)<Ic<?0mVB<X@z9bwyV1a5kO*ANyI<rjc9I)QVPE-Xi4(*w%(pp^#T
z8;qgbnvx4j8A>v9Q$fdD=z?lja8sEf8PxSg;)9kz!Pihh7@&nzdBuiirltmX)<A(m
z1-hULbW$sH6Be|=mY1&(;^PD!JAm9DRSd3ZA(c{bDtJF2Xb&H#YnfAlsGFerK-V9G
z+DeGYMNpd!MK@@CG6$g*(zZ#247z{@GeDI&<T7Gt+YXxw=#rPD6fQ`(6vt=g#ph;J
zA;LHjJjDVUt3|j4S}B9}*MJVNhiz#CtpZbkZgYbag$!C+(0kp$>kFVec{MWgQZkDa
z3^f&U!S03D1A4Fn20)jkr9t-dV(5UFOIWE98ODS45O0AI$?i8&Fw(@~*%avPH?$yC
zC@IP;C;)Au00k9j@CrPZR1ERBjf-cHodSbRaHKDYQm|LBQ(#avGyt7?58g81oR|ly
zXB5C$34ZY#M6&`sPC!epK}$Tq1A&R)W%I?EDWFl>q7uk-GGsjpc$I^emI7?sg%c<T
zf!ZaY6%Q`Zt4=_xq(S3&np_OHZGf~KK^qqcsnLbRJYmCh6+pLlfzP(!V&Dn@ZPEpo
ze!htX;2Z~9+yb8Rhb%w=?WbmN@poo`md6axnH*5(N<mjwK|ujw1Z3|Xc<@yNd@Z6T
zs7aQRUj!;(K>KA<^uVm3)G`pw#Q+-1$pJAHKwEaejNsHFWe|f4dTIrT4XQH0bU+b!
zU0yM43npaglZ(GIssOa<3|h|sSx}n-b2O+SZ3SNX4lTvO6vW*Opi>#jzzq!s5705-
zp#4A$&Mu&l6$a4M9B5JwI=~M)+=4+Fyo5wS8CK_j%>vB@<`<O|E0|b-Z(W7X)Me(S
z!&erA)j1~?BqnE;RDx$YK%>(NzD}S6*mF|A9Cy&F|C|(s3eZdnD2aeIK?sCaP{$Kq
z%5X8b_y;q12KzHO`g*!MGAJu6z(#S<);oYUNK}-hfC?MP@vopn4Neh|R194d0X>rh
zT*|mPhJd|k2)T3(><|M^RYQZE6i!vp*;}fnDV!jF3Y0La09C<BiJ%#rAkbPm&|d3e
z@LDp^!c54zA<*eVTnrg0s>!M;48;(tv^WXENXbuzFe)m*@`!W>vK_qq4%D6knF|u|
zE6s&+i$PrQ)D<{yyMYdD04-z#Z|2G`0(FT&%hMA<_Y38M*7t$7cz|Y;!D$xkU1t{q
z14B^wgcs%Kr7L&_`zv^+q~?`?Qz7_>571SmpnU1-qY&aB<Qd|x5FFs@?CIv|>=*)C
z?F_jn6|xBgG*h9FoLG{Wlb;S<U5R3bmX-p<9@iX&ko=;|l6-|s?6zrXDImodcxnf-
z-xaidFDC-k6ClMIsma;JrMU{=$qrB#666+8<pgsM*oBZj7pM-c#4y4;wNk;L!qim3
zpu*7+(k;PIgNPbc=ypc%Qo{T^SiXba1goWmR9b-UZ-ES*f!qYnci1$*&Kg3bVepC@
zkQ-89tD3-Z266=GfGp5vc5n&^22}$U;4Q<@)BxIete|QEy6pr^n1NW3Gkg+33lrl(
z{f8XTL4pjyrMaNAVWj}N=PVmsg2T>-0d2$pTcDueT$uy9^{WV+<UpNfBsq}v`9;P0
zAw`MF*=Ta0lY+o{K<0quP)i4pFsMu{23?HqSDLG*z~xt@2Ptdyz?-cV6u@o*wQqCs
zld~Zw5`ndWgh12v0Y#ahv{cE(psH(<qQIc4YiLl+plX)F3BnAVs-`Ji44^U&lp$bI
zzy)6N6`xX`tWcg<1X&XR+t&tel7JS4rItXJXrvXTrdFluaWOarM}l@vLuQKfz{9fn
zr6qb?42d}<&_#x}pyn5--3BjO;S1PcRk)9nqlpC<gG*4LEp!|V8o}UNPzRKjK$pjZ
zccDgbf$j(bAN~z;KBypc3~`JP2=Wh!5AgI?fNtvuc6AQ%4+>WB^LKF#gI<(Z06JVf
zFC99vo|&Hq+9+R=q2TG_>KEea7Fi4%U_jcU2G-BT0BP%h=0ri8MigMCgO9CAEh>u7
zO)Sm^O@35paxr-7`$KXIqB4OrF+f=ZvZ@!l+y&}OaI)q?QVk8c%wh$n(BMctaA5{o
zedr$=0#5MIa4S}D3G!8dopuJ9iv`_^01A_&RPagpmC&QwK$%RBi^18=k-^V75VS<J
z1iXYxlL4}_vM3eQjVM+~$xKYo%P%g;OfCjDze<Zz^}u7mAag;DQSeHhM1>U4dQ4ET
zfG*+%m8{U)a8q-k*V*WSW_}ZsOCTy?XApy$=Ac!9(B(y-B$Zf_2u^fX3gGkszMUCd
zD}m!)4`fFsX#H|YzCw7AXNW8Qun*Sv1C`WVybPdr1$d1T^q3E*FsLB`I=KlnDwG4g
z&HyR}s$G*n7jc4W=A0C0)m6;J%aEB8ZDJW~rGR#5C8#Phso=^?i8eKkwNgmSOwCCF
zjXq?ifbv9zssTjO3?!Lbo|2o0Dr^#KrBINWk0NMp8f&Eh8Ny3REhx!ANP-+;ZWe2$
z0A5-Nb_vL>2nCrb(dHH~`Lxu;lG38oVpvB!71c@RAm4xuf-8hvHGnV<WS@mWtd&A;
zViw}C6oh<cO0<O`NIEkQm$VTm$ntY@L1V?BZYMO^rlu%>4tYd`o&_j?U^{S86@pG4
zMp6h0GGv9|U8~^Jc)_I%D8Rw)28AMuI>@$9G;2YjiA5Efo#tr1fbB<w+XxB?P{5a>
z$FL>HU+}eZMX4aK6{Qw~vJ6}^gR8HjvuX;Yz);9fPA)A1ZOqftQ}7H90yhgQV4YGc
zg`m{rRM0wT$n-B{3Iw#xK#_~V!_mi$!7bFs2eQM)N+Go*1JnWqmpsL(C5oUXKWHy^
zYA$32FL=xdWI1SRHxY8TBPe@<w%>ve70g4rBccSd8y|c<hC+y^uPdk|QsiP#NXgGj
z<zjI4a}7}l2H*RZSq$nQfG_y~osI+D#tRx_&x2lZqye&26|_GT-ZTkv2VEcoHUM-=
zhZVHZ0`BrAf*tDX=!4vlg9d;i7idFyyh%kxd}>JscyK&3F(<Ps)e6*D0u_T$BT_-Z
z0qVqo`eC5;<OK!EL}@E1$^@+eRLCfYOk06M2xJws<W@~Vc7SRMcnAk{AVey-^n^@K
zs}^f$f*opNV!(hX+Q5CTqSSN+RnW*lKt?6#q;wER0d(V|D(HCB|3rbmDh&Vsy6pJ>
zLy_VC4@QRnKNOby|DpKh|KHUN42=2=3=9kc|NnHi{QvWg?f;+dssI0U&-wqS``-UQ
zJ#zp5^gjCkr$^)epB|_Ge|jSS|LIBk|EFj2|35wJ|NrSZ^8ZiIt^a>|-u(a5%k=+G
zul)Z%z1IK#^d|oQ)0_YQPjB=8KfUw*|LNWH|4;9g|9^Vl{QuJ@_Ww`Wn*TqHTo@Rb
zLjM2h)BFFYFYy1LzUKdbKDYk=)7Sm~Pv4aPf418E|I;^zfq{_$<j((p`qupa)3@dS
zpT52S|MVUC|96?e|37_a85rI+{QuK;?f;*?d;kAN1%UkX|4%>1|3Cda|NpLP`2TlR
z1p@;|1Oo#{$p1h6a{vGID}l^nVBpALVBpC4|EFK)|DS&2|9|=&{{NY%@c&Q0_y0dv
z^8WwX<@^6nf5`to-G2Z7^vC}H)8F?0Pye$2fBKL8|I>egfq^51fq_wmfq^4|fq^6D
z|DXQL3=E7R3=A9%3=AAA7#KK87#KKt{{QK}{r^w@6Of+&fBIiAFmQm}Qv=mo@c)PB
zp8r2QKm7l@Oo4%c(S(74QQ-gIWhx8|j5Z7mi~$S`j1mkCj2i#{^uJ|bVDw;MV9a1(
zVAT2lXM#8b17i#W17phnzsr>V|C!*#z`$t0z`*Fkz`*G8|IdUl1_nk41_nlj|9>WA
z|Nk?g=Kr4wT?`D25ey8B9RL4JSpNUdgw6l|EZ@z*@Wq~i;cWo}!#jBf29B2he<tks
z|7XIX|9>W&`u}Ib<^O*sT>1ZJ!p;AGCj9vSr#tljpNXRX|4cOb|7T(l0|R3T0|R3Y
z0|R5i|34Fp{{NX+_5aVrx&Qx6TnLGyiL3tqnYbAeHjFv{|4iJ2<VTQyZT|m=zVZJ@
zRLTE86VHR>7#KKJ{{P8uU|`^M`Tu9)xBq|sGXMW8$nyVhRL}oE6aW1G8`Z(Uz$x?p
z&m^w@e<n$S{K&w-slmX&DZ;?Osqp{LB%S|%qq-OvI3*YuIBov_nPl?+&m=bn22O|n
ze<peT{~Oiv|3|_BkozF+p416)-~T_8Cj9?1X~q9PlPVY(I0ZoN`Tu9q&i{WV?fL&_
z(y9M{CS8Ms>DvZK{BY|0|1+8A|DVaK|Nl%5{QqZi5-6@farXbu<O%=(OkU5xz$o(n
z&*XiO^gQ|M|38yo{r|g6=l_q`8w?DL6%g|nL2(}gP0MGY;Uxkx2WlP*0|Q6L|38zz
z{r@vXkAZ>X%>O@AEEpI#*8Kl71r+Zg5ce>a{Qolr6eqAWWb*$<Cd>aH$v+@|nUePZ
z&y?){f2I`v|1)Lc|36b!GB9u+VPN1q@&C`1J^%kqdGP<wRDu70rkec!Gd1P^pQ%Ov
z|4g0t|IgHQ|Nl(g@&C`%ga7|bz4ZUj)LZ}mOnv(Q&(!z-|4jY;|Iakm|9__O{r@vf
z;{Ts%8vp-H1Le&%|Nl(0`2S~`^Z!57eE<KMmiYhAw95Z~rY-&dXWH5Sf2Q~S|1*8Y
z|3A~G|Nk?6;r~C=Z-MhQINwjd_y5lf_5XinnEn4V!}I^28NUDj%t-tHXU2902F@G*
z|ID}rio5@RW<31=XQuG~KQmST|Cwp^|If_O|9@sC|Nk?y<^P|V%m4qGdHnyMnXmr;
znZ@`2&n)Bre`baM{~LAZ|DRc9|Nll!`2T0tg8zSJt^NOJ){g&wX5IS#XV#DZe`bsS
z|1&%A|DV}2AbA#=mjBFN^#9NNCIA2YwEX{P{@VY4=I{RhXa4#Bf95~_|2KNh|3CA;
z|NjFD--VL@|4izFg!968|Nkr!g1B{&!~Z{vGXDQr)c^m_qACCXEIRxD&!XRua9GR&
zD$D-=S<LtU&tlR4e-=wZ%DKg$e0}QwpT!#g|18$~|7WrJ|38cE{{LB=^8e4`*8hJN
zuY`nI-`W3vmZbmxvvk`3KTG%g|Ffj||DPqZ|Nptn^#9M2MgRXSx%B_flJEcjEEWI%
zXQ|8oKTD$^Zd%&>|IgA%;Jo^01<(IKOQ-(-vvl|WKTBUSFfi8q|Fb;y|DWX@|Nkss
z_W#fFeUSQLk_R{~|6P3G|DWa8{{LBi^Z%daxBvfHe)s=h#*hF1EPwL<&+=#g|MW*g
z;&l021_o}9|9_+J{QtB3>wmC4EBOBZS)ud)&x+{(e^!+L|Ffd%|DP3W|NmLB;s2i%
z*Z%)m@#X)Ym7@RutTg!l=i1Hxe^yTa|7WGw|39T5@s$66qj&uOvoh!ZpOqc||E%o$
z|7YdY|9@6a`u}I;-2Z=8uKNGyiTVFOEBF2Xvl68D>;FHiSpNT6CH?=;D#QPOR(bsY
zvnu}opH;d4|Ey~H|7X?g|9@6(`u}Iu$^U;=J^24;ivRyV3wi$kS@q=qpH=_=|5<JL
z|Ig}x|9@6z{r|JN^Z%dKEB^o4A^HFBvK5f}CHl$#KO2qy|Jmrlz`!rUz`!rTz`!r_
z|8Mkz|9>|6{r|Hu{r{hhx&Qxszw!UiWKcQ6&cMLW!@$7L!N9;T@c+-o;{Sg(R{j68
zamxQc8)yIjvvJY?KO0vvFbX;R|Fd!J|34d#{r|JE`v0G86aN3%`1Jpujlci@*#s*4
zTNoG^8~*=YX2QV0ukioRmMj1NY<d0v&sGs|{QTK!`~S~YP+T?t|FgB~|DUb(|Nrdr
z`~PQa$NxWD5B&eL_22(L+d$=S4+8^Z2gDuQLjV8S77cMP%njQT|Nq%m^#9M>Q~&?$
zH2wc)r{(`YJ8l2}+3E2A&ra9>e|CEP|Fbjn|DT;%|Nq9>{Qn!r^Z(DzDgXcMT=D<U
z&g=jG?EL)y&n}_=e|DMt|Fg^b|DRpXkaV<k^8Y_OGyebC74ZMhE>QWkfPsN=2?GP;
z3<d^9P`y8afq`+#|3AAT{{PuE|Noy|=l=iM_5A;zU2p&Y*)8?|&u-cOf0?ww>HqIC
z15nusDl0*C7pU9>)nAY@b1}5MJkSIxBSHBJROW)}HU<Vpmj8babVJI~0~4Wn{>lG8
z2WI^Lb8zzizsoHC|Bc`C|Ifh<|Nk7k`2WwrxBvefQu+Vqkk<b{hYbJ!Ib;E8ujC*3
z|L2f5s9gavALb@do(8$=|DQvZ|Nk6X{r}IQv;Y4bS^fXdk;DK09J&4f&yjck{~Trf
z|L3Ui|361n|Nl8^{Qu8U@Be>}CjI|&H2?pfqxJv)9PRx7=ji<Ze~xbZ|L5rG|9_4?
z`2XkV6G&Wu(hjybJNo<opJVd>{~UAw|L0i#|3Am3|NnDr|NlS7p8x-IT;%_s<2L{Q
z98dZG=XlTmKgYNH|8xA#|34>K{{K0l^Z(C@kpF*9)cpT*V#)tMC(iu;bK=YYKPP4W
z|2gUM|If*s|9?(S`TytSp8tPNKKcLW6wm)Zr%e9;ITiE&&#9LGe@?CW|L4?||9?*X
z`Tys%%Kty7eg6MBUGo3W={f)ZoIdjZ&*?Y+|C|x||L2U&|37C^{{K1C^Z(D8E&u<V
zx%2<eS(g8Q&g%UCb2jAvpR+ap|D0X&|IgVo|Nor*^8e2{ng4&zx%~fgF6aNBb5s8R
zIk)HkpL0+C|2fa||Ic}o|9{TM{Qq;l<^P}aQ~v)szvcg*^Pm6!xnT7F&jlAqTDuhY
z|Iek&|9>tu{Qq-lE~JbDm5-NB|NnF8{Qp0fe*XV+neqRh%jW<8T;A~i&*hr`e=g7X
z|L5|0NI40v3!v%Z@`?X{E?@iq=klHZe=fiJ|L5|r|9`G9{r_`?|NoyW!vFtVk%8pD
zD?0!GT=Dq-=Zf$DKUaeP|G5(L|Igmz|NmS``v0fi;Qya1h5!FtDf|EDO2_{{SEm2}
zb7l7bKUbDO+MZW7{{M4j-~T^X&O_RvS8o3QbLH9pKUbOm|G6pv@zYi5|9`Gp{r__{
z@&BKzlm7p?y5Rqxt84%Nxw_~7pR1St|GDPy|IgJA|NmTL`Tyq{s2sKX|L2<9|3B9}
z|Npt>`~T0il>dLO<^2D1W#|7t*DC)1xz_am&$S8v|6H5@|If7*|NmUu`2Wu?pZ|ZZ
zf!aSF|NmUu`~T0iga7|ryZHaFAm9H#*B<=;bL}ytKD_qw|DQWH|Nq7x`2XkH@Be?U
zGyMN^UGx8+>!9}Nj{kqIJN*B1z3~5^>t+A{TyOpV=X&S=KiB8~|8sr!|35cDY7ao_
z&g-}T|GEDC|DPKgkoxn6?f*YF^8f$2(fa?-jn4mnZp`}s=f<l4e{Ssl|L5z?|34U5
z;N|e2+m8SL-1h$e=XTitKex;O|GC}x|4+UT1A~CX{~v!F7#R397#R3f{{Ojs?f*}k
zg#SNnPW=CAYw-W4?SlV5ehZ-H>+6~f42&xn7#KG&Ffgw9|2O^u0|P&(EI9N3Z~O@c
z27XYPYrw$3uk-(J{1FBQ{saaF#x4K<Cg1q~=k{GN`=>y_{~v!D{{Q$3vftqUkG~Nh
zcl`fh*7E;{Im`c_tXuy7WDfcNJ3iq551SYNfBgOM|Mz8&|35B0`TygR!~dTGKL3BG
zzWM(<?au!nb^-r?<m>$Zk+1Uq&mHmqf9}Zt|8qzG|DQWf|Nq=6{Qu`p)Bitr*8l%=
zN8<mVJNqGRiaXE#|GCTk|Ib~M|9|qQ{Qq;;=Kr7BpZ@>3>+=84-JJh_?pFN&b9egx
zKX;e?|8sZK|3BR^|Nq?G_W#e_{g6J=-3$N!+&u-UukYUZ|L5-W|9|ej|NrNn$p1h0
z<o^G;rwLAnf72rV|G8)S|8Lrk|9|c|{QsLi=l`F3q5uD;3H<+aFZutUd*%QCe82hs
z&%NINf9}ou|L5L;|9|dX{Qu|Pga3c-ef<CDKKuVa_htY8xv%yA&wZ=^e;(id|7SYq
z|38o3{Qq+=`~RP7yZ`^WAB5S?1GNk9cm4l!f9d}}_YeO6^MLdJp9iA<|2#1K|K~yM
z|3423{{ML};s2ip2mb$gaN+--hphkqJXHMu=b_pEKM%eB|9Key|IfpU|9>8K{QvWC
z!~Z`IpZ@>zi0A*GM_&K`Jj#LO;pu(<|7Pg?|C?d(|IbraNS*wY<Nu$h>i_>dwf+C+
zX#zM6{&|}6|IgDL1_pi*oe!!j7#R4^Ffj0+`2Xi=&Hq17SN;F<^v?f3Pe1(s^Njib
zpJ#&Lu>12&{QsY4y8r(?bNc`1S@r)v&wBs=c{ct3pJz+{|9N)w|DR{~{{MM);s2j!
zFaQ5t3TiK0VPN3D@&E5q2L=ZIJK#J9OT*AK&A_nJf`LK6;QycJy#N0^*Zu$JdC>nq
z&s+chU3`FnK>#GD@&C{BB@7HZLH)}e3=E)p{Q1fMf1bbk|L2AH|35EG|NnWB_y5m}
zS^xjMxb*+eORoQaUdsRf^U|DwK|tmIpO=pR|Gac&U=Yyx|L0}e|35GD{{MN|{r}I)
z^$ZNVau^tPxiB#7@?c=t<@Engeaino^&oZuB!9g;4yij|o?~EOVqsv|<;cLW3)G)I
z!oa`?>K7hkU|>AMz`(eVfnk@!|DQ1*{{M`c^8aU)3j@R6ISdSYr!X+=uK54w<t0e?
z-B|no&nw>le=|H781~Ni|L2wc|39zd{{MM3`~S~emj6GKYX1MsFZus7vE=`sS7-kJ
zdCmC$XJQBg!#<t=e_m_+|MS}F|DV@h|9__Z`TsL*0t3UYlK+2Rm;L|qdh!21WfK4Y
zyxtGV6R*$y|MU9B|39za{r~g&=l{PM8UO#hIr;z3n~(qhy!r9}&zpb$|Gbs@|L3hT
z0|VoQ|9{?U|NnFM!T&#RE&l&`oBsdLv$p?#-q!s8^S1T>pSOD$7$rRZ|9N}<|DU&a
z{{MOVh=GCe%KtxaU;h8|_6Gw469)qW;~fSDCZ7L)m)ZRPyDZ@UpSS;D;r9Q}JLdm?
zGv@sN^N!>HpLfy>42*vm7#KhN|MO1u|DSh8|Np!LwXY%=7!K%w_5XP{n}LB5)Yp8%
zz`*$6|DSh@|NnWn3}gqSZ}l3ae%=2+?~X7qiZA*9w-eO%x&xADU|@X1z`*!}fr0VM
z|3CGhKJSbFe>->l|5HB&<YtgtL3TjR{{V3d69WUo0Z@P2<Nx1f4*&lybNv5znbZHj
z%bfrJUFQA&?=q0M=l{RUy#D`rdG7zu6*~Wat}=l5@7=lof8I0w|MNcm|DX4z|Np$-
z`v1@SxBvfqF#Z4ML+bxOA7(KyFcv`UVf?_raKPgKpAV=0|M_s?|DO-n{{Q)Khk@aM
z&Hq0ip8fyxk?sGVk7ED-eANH{=VQwMKOYPK|M@ua|DTWB|Nr@T`~RO$EdT$MKKTFV
zlllKYpV}B04g^5z`cI$0ZMMJDcl`hJS@Hj$&#M3b++_X#=d;fLKc5Z%|M_hF|IcT~
z|9?LF{QvVg@c*CB(f|LH+5G>Rvf}^G(>DKqp04=+^Yn-RKTmIAU^o!Mz;GY|Qttm{
z`2TaS#{ZwY6#oC*RrCMnt_}Zx?%MMI=dK_Bf9_s`DED{Qfa`^yyLSBlx$4aSpKEXY
z|G6gO|If8H|9`G3`2TZN#s8nHYX1M|x$*yp-H-o2cO3!OF`#<ncfp_kzrP*$|NFDg
z|KDHk{QvzGM6>+=^EvhZ-x(SI|IT>v|L;tZ|9?K`{{Qp2=l`G2OaA|z(eeN9j1&L=
ze7^Mm&*y*t|9o-&|L03R1EbK2|9>=A{QvW1_5Z&!K=hvff4-dl|L4oo|9`%+{r~gT
z;{TrozyAOE>hk~3*U<lezNY{G^R?vvpRdjT|9ox#|L5!E|38oI`2X|VkN<zZ&i?=B
z>x%zBkA3<76VzV&y5awyuY3Rh`Fi~S&*KLFf1WS+|L5!F|9@w^`TwW3;{Tto_x}I+
z#`yowH%Ul7|EBf-&o@^{Uih8>N_XJ=@#lNq|3B3x42;4eptQ@ta1hiUuwh^nUh@C%
zvYP*YXU_QlcUi&zzsq9&|6LaG|L?Mj|9_X|FffWQXJ8ax&%h|YnSoJ!H3OsgG6qKR
zbqtK+n;00ySN;D}@`Hg<d>aF!_$~%U@qG-8;)nkKDGgv?6ko%@D87M#QG5jhqxcpE
zM)4gCjN*G37{w3#|5GZ#z$ku+fl>Sn1Ecr_21fC742<Ge7#PK`{r^*H@&8Y0&;LKA
z1^@q)Sp5G}67l~}NyYy^B{Tm2DcSM=Pst6C`~UxG?D_w9S;GIn%Rv1)(70a7|G&#J
z{{LMT0`&*j{ZRkZfc5;H2O0|n=>e$+=>zEjsn7WTcc#Suzw;#i|D8MI|KGVg{{Nj>
z@&E5ki~oP;{`miQX2k!$b8r0r(-`vqPh$Z%%>Fcl{QuKX^8Zi6l>dJkw*3FoaOMA>
zhA;pBG>ZKH(`W(-Q_S$h<z|qXU^o8x-oU_cP=JAfN#XyW?~@rA4s!he^L;4;!$BTU
znFNVT(Ae|$z5oAwKlA_3_q+f9{E+_t=ZEJ1KR*m1W#uFf21fBO|NqXj`2Xu|!T(=x
z5B&f2cE<l-Z(scXI}em51pfc|(e?k&k179ueW>~W=f~>*e}0_%|L4bJi2k>az~$|)
zp9cT`{AB(AXQSKyUq280|Mm0C|6jj){{Q+J0~P~~Wq`&pe*JIw|LgCa|G)nC{Qvb|
z<Nu$ZJPZs60~i<%iZC!74Eg`(r^Nq1Kb0654odw0yR7B^-(?*P3{0Rj07`qHx)oI3
z-e6#00;%_bq{Vqh7#I%9{Qu3g=l^e}JO6(({rUf!S?2$5W|#lJnR6Hz4x0S`&7$!C
zH;cpn-z*9Lf3r0F|IM=E|8JHn|Nk!Q`TysqE-24I!nD@q|DT^8|9^8C{Qu3H^8Yu-
zg8#pHMgITh>S17DlKKC49w;5m`2Xi;CPaNbC@w|*|M@u`!vDVX|DT_i|Nr^<@c*A*
zZ2$lK{Qv*YFNyzueyRQc^ULf1pI@=y`t7%)&;Q>JXa4_Pbmae^U(^2o`OOTjtNt$L
z`Tys)^#4D<OThKh-$gI}|M^|>|IhF3|Ns0x1L+5Y#_)eX{Qu_<JE*_?|IZ)U|9}2u
z|Nrx+0bFkXU2O3G&!4{kfBr0ol;MB2{{Qpm{C{v+{^#!hKcKOuKcMkn?*D)O-2VUP
zujKzff5ZR(0i~0_>Hq)yUHt#g-(COz{5|#m&)@6+|NQ+5Y5V@;`~T;k?EgRiZ2$lH
z7xe$HfYblK{7s-S`u~6amHq$ouj~Jxf7Ac}`M2i(pMMAc|M_<UVn4{eAFe^uX~X|N
z{~N*Xgogphz5jb5?n1Wv{{e*E|DXK-^ZzqAE&gSY{Quh{;s0L-!~cI7LjV6|$oc=5
zVebFG44c4d5!43w%kb&{Uj|V7;nDx!-V6T!_MXGQa4>^`;b05{!@(2=hJz6d3`YwX
z7!HEcM*#!F(GmuRg9-ot)b{-UQ(*D`FC#ak4O+Y6|6fKS$T&Hp{Qtj<DwtzB-*150
zf&YJp?D_vY<jnuSj5`1SG8+B=%NY9qFJtllzl=Tq|1xf5U|>@D|CdqW|6j(Z|Nk<+
z`TwW%0$AT)#?Sx%RIT~{m+{yCzf2PU|1#<Q|I_vA|DUEc|Nk_;`TwVJ&Hvwp5B~oy
zeDVKJ)q($inY{l0WlH@2m#OCeU#1EF|1z!o|ECG0Ug!T`roI3FGF|xpm+9^QKiwMt
z|1t~y|I4iP|1Y!4|G&%$|Nk<V{r}6{{r@kE*#EyQGXMXwsQv%TV*dXxi~aw<EE)g*
z<blMd{r}5y{{LTAzW;w&ZT|md&HewEb@KnetjGTUWqtSmFPp;uzib}=|FRYR|I4=U
z|6g|2|9{zC|Nmw0{r{(C&HumbJO2M=|M34W2hab%93KDwa>V}s%TfCOFUQ3He>qP5
z|5J11|6fjy|9?5n|NrGI`u~@6$N#@v4FCUfx&8mk)%X7|*X93zx!(N$%Psf+&!3+E
ze`@ah|I4lU|1Wpo|3CRT|NqqT{Qpz);s0Om{{MfucmMy({q_G}9@YPUYE}OK<q7@&
zmuJHNzdURH|K+*y|1Zy128N>*|NrtzL&~A~3;+M+RsH{$SL6R*Uhn^ZdGr4N<(>5Z
zFYh)6hGP%@|K+{@|1a;S|9|<o|Nq|i;Q#OaF8_b;HTeH~pT+;*`&az`y|3s0Uq0pk
zfBAg>|K&^l|5r%(|6jgtaNF}Q-;Do%`S$+*%XjMkpF1-D|ME-z|I07?|1ZDV|G)ft
z|NneF^8YWt?f<|0?*ISt2mb%dAN~I?f9n6g{Q3X?@>l);%ir?<FMr?vzx>Po|K*?Y
z|1baI|9|<n|NqN>@c&=_GynhcU;F=;|Kb0?0z&`)3dsEbE1>rOuYke-zXDeO{|dPL
z|0@vu|F1y6|GxrB|Njc){QoOZ{{OE))BnE$t^fZD%>DmYVEO;Q0vrGT71;g%ufWm&
ze+4f5|10q1|DVey|Njbd{QoN`{Qpn>hyQ;C4gddL^5XwrLAU>Z1+)JD6}<KTuR!eo
zzk)9?!%>JI-0%G>B=i5Tkn{h)Lhk?n3Pt_@E0p#BuTVa?&Hh)Y;{RWvMsVBxuTbaz
zKXn`a|Eb;Z|F6)_|9^!({{Jhi^Z&1~-~YeDMgRW_H-P)Ze}&h8`o#<k$DS}SFj+7#
zFoDz@XJBB``2Tm=lK+2&fByd~qVoT*NCX1|lg<CXBCQMzOrUo0g8zR-cK-h>^6dX#
zQQ7~0MOFU)`F`#HUs3J<e?^TL7?=$H{}r`nU|=#~U^s5Vz;Nuv|G%P9|Nn|k{Qp;U
z&;P%o5B~oZ<NW_u%<TW4x&#0Jih2G2E9UqA&y_X*|B40w|0@>x|F2l=|G#31|Nn|*
z{{OqQ;{RXqumAs)g5>-E{}tQ%|F77k|9{2a|Nkq_@c*y4=>Nas2LJzxJOBSH?)U$%
zc*Os|;_?6gis$|RD_#t4hy4|=`TrNxM-adN|E~ng|GyF(|Nlzx{QoN<^#8Af9=Ol^
zSHk4~Uy1nte<hOt|CMO?|5sw#|376B|Nlzt{{L6v(Eq;@C;$JIxb*+8#BJ~##b1d>
z3=GFD{{NK}|NmFg@Bd%PkpF)rEB^nLobdmz<evY3C7=EOD<%B@uT&UV{hzW5tY-a{
zs`~#|YU%$!Wi$T&mAdx-uQb#DztXA<3^y(Q|CM%NV7O?(z;GVK4*369`q2NsGBW@F
z$|(K+E29A(WBV&(`2Vkr`TxH%o(v2xA22Z7vibj4Cj0+inOX*h7ZLye<fr`qD>Lo?
zUzwE*3`{Qn|H_>D|5xVI|G%<=|NqL`{{JhR`v0%&L<WWzF$@fEBp4Xp$S^S6viSd3
zb~YsJWH<i*D|_<)U)d+%d4RvNa{vFzg2u*u|NoWK`TtkW;QwDa`~QFCYQSypzjFKj
z|CM|2|F1mn|G)C$|NqMC{r@ZP`Twtc^8df`FaG~ki1`0kQ2;b=`~R=v{{Md!AOHWW
z#P<KM68HZ<-L?P!Dhd4mtEBn=uafisze)xF|0>n||Etve|F6=n|9_P({Qr}`;r}1q
z1JE(+E&u;2{rmq{+4TQk<@*1B4F3H8qs#LDkM@NBf3#*WFuYOt|0kyB|DTvY|NmI-
z`2WXB;r}12j{kqGUi|-K?ehPR^@9I@@@4-2UAo}^U*+EafAUu_FfjQrFuVcH<Njb^
z)Nx>7VDk9?cj=q|f0thP|92U~|G&#v{{N|az`(#1z`&>no(}*2S9v)D!`qzyf0ft$
z|EqlL|KF&9|9_)G{{M}N`2RO5=KtTQg#Uk|QvUyq%J}~`D(C;-sDl50qe}k&jjH(n
zH>w6Q7PxH7|G&$2{QtXb&;P&6Ky$oj{{LMDvJ=#Xy7B+-vM2xlE_?C+@3J@l|1JZ~
zyZ`zBcR9oVzso`M%QOD}jau^mZ`6tZf1@t^{~L7!JYV=X>dpVZQ6K*Qjr#KcZ#2vQ
zztN!iES~>=qe1gL3jhB`tNi~PZSwzbw8j6w(Ki48M*IB#8y)cfZ*<82ztN!is*L}C
zqjUcMjjs9sH@e~f-{_YAf1{`T{~J96Ja_mvdcps{(M$gSjb8EpZ}gh~f1@}2{~NvK
z|KH^t|Nkx*`Tuvh#Q(p`W&ZzNuJHfwa-IKwmmB>5yWHge-{ltn|1Nj=|982^|G&$9
z{{LMb@c-}fnE!v5C;b1rJmvr2<r)9~E-(52cX`GCzsqa>|6Shj|L^ji|9_WH`2TnL
zl>dL1&-nj$`I7&Cm#_H$clnzCf0u9g|9APG|9_Vs`2TnLk^g^}pZNcG`IY~Fm*4pR
zcln+Ff0sY_|9APD|9_W%`2Tk~C@h}*{~P_`|KDg3`^W#k(SQE`jp6wJH-_i`-xz`a
ze`7@c|BX@j|2IbE|KAvm|9@k2{{M}!`2RP?=KtRqhyQ<LT>k%!3HbjvCglI$n27&>
zV`BdQjmh}`Hzw!*-<X2`e`8Ai|BY$*|2L-P|KFI7|9@k8{{M}c@&9kkod17g7X1Gk
zv*iEZm<|8`#%%fjH)hBGzcG9M|BX5E|8LBh|9@jH{QtZB$N#@8SpNTA!SVm^3ZDOe
zR|x$7yF%vw-xUh~|E^H^|96GP|Gz6t{{LNJ@&E4%oBw}TIQ;*+!sq|r6#@VMt_b=6
zcSXeizbjJy|6P&s|L=;N|9@8${QtY6=KtRn4gdeHX!-wlMaTcYE2jMayJE)wzboea
z|GQ$r|Gz8N{QtXR!~ef4w*3FQV#oi#D~|mCyW+(EzbnrC|GVPC|Gz8l{QtY+!T-N2
zp8WqCbLaoxm>2*5#(eqzH<sc5-&mgie`6*7|BY4o|2Nj)|KC`f|9@jW{{M{)`TsXI
z;s4**od17gEB^nDZTbH<cEbO^v2*_aja~8oZ|s);e`62){~LSe|KHdf|Nq85`TsZe
z!~egrfByfC;{eae{f!g(|2IzN|KB*3|9|6j{{M|L`TsZ0;s4(_kN<z;0{;Jvi}?RH
zF5&;*xQzdQ<4XSjjcfS-H?HUZ-?$n7|Hdu(|2J;K|G#m2{{M|T@&9k!mH&U^9{m3s
z_vZiKxF7%j#<TqY8!zzxZ@kR^zwsLX|HhmA{~Pb{|8Km{|G)7O|Nq9P{QnzY@c(ao
z&Humg9smEvPx=2he!>60@u0DFP#C@V|98cg|9@A2;_J`<zbhI3|6R%R|L;nH|9@AC
z{QtXB;{V^3D*ykk)cF5*rOyAqD-HhtU1{_G?@EXNe^<Kv|GU!T|KF7%|NpLx`2Tlh
z%>TbD6aN2Qne+ee%7XuYSC;($yRzc{-<2)@|E}!#|9552|Gz6I{QtXh&i}tF7ySRb
za>@U{D_8vgyK>9_zbkkA|GRR}|Gz5_{QtZ1%>TbDFZ}<z^2-0eD{uV&yYk8Zzbjw-
z|GV<d|Gz6g{QtZ1&;P%x82<lV1@ili|9|7}{Qn#O;Q!zFC;$J(zxe+*{>}ft@gM&G
zjsNohZ#*cB{`~)&!0`WX0?Yru2^|0bCh+|Kn;`K2Z-U7GzX=lm|0c-%|C^xj|8IiI
z|Gx<u|NkcF{QsL^@c(au$^X9z7XSYy*!=&S;PC%%g3JHE2_FCdCiwjSn-K8-Z$ilb
zzX=il|0cxz|C^BT|8GLd|Gx<t|NkcB{QsL!@c(Z@$^X9z761Px)cpUO(D46nLd*ZZ
z2_66cCiMLOn=s-3--Idu|0c}%|2JXI|Gx<f{{Kx_^8atbivNET*8KmQu;KsTgf0L7
zChYkCH(}5Jzo0cU2}l0_O*rxYZ^D`Xe-keJ|C?~-|KEfg|Nkc3`TsZJ!T-MrPyYW+
zc=7*l!khnp6F&U^oABlT--I9k|0ewT|2L80|KCKG|9=xX{{Kzn`TsXj;Q!x5k^g@a
zCI0_Sl==TRQQ`mJM3w)46E*(-P1O1SH__n#-$axDe-kbK|4p>{|2NU$|KCKH|9=xb
z{{Kz%`TsXD;Q!ymkpF)ZBmVzQjQRgJG2#E;#FYPk6Ept*P0acKH?iRV-^7yte-kVI
z|4pp<|2MJW|KG%x|9=xZ{{Kzv`TsX@!vDXCQ~v)=obmr};++3~6Bqpdo4Dlv-^3OF
z|0b^a|2J{N|G$Y_{{Kzf@&9k)p8tOn5B&d|c;x@z#1sGjCZ75KH}S&%zlm4=|4qE{
z|8L@*|9=x7{QsNy<p1Bq7ythzzWM(*@x%YWiC_NzP5klyZ{nZ-f0G#g|4m}~|2K)_
z|KB8@|9_JN{{Kx9`TsXb;{V?yng4&26#oBBQu+TkN#p<DB%S|%lMMd<O)~laH_77v
z-z1y=f0G>k|4nlF|2N6w|KB8^|9_JL{{Kx1`TsX5;{V^InE!v168`^9O8NgcDdYd&
zq@4eMlM4R-O)B~SH>u+P-=v!Vf0G*i|4nN7|2L`Q|KFsZ|9_Jv{QsLY<^SKL8UOz#
z&H4W~X~F-$NlX6!O<M8)Z_=9of0H)+|C_Ys|KFq?|NkcK`TsZR!2iEVNB;j!I`RK+
z(wYB%lP>)Kn{?&>-=rJ=|0dn}|2OHu|G!C3{{KyS@&9kqoBw~4KK%ci^yUBGq#ytP
zCjI&UH<{u8-(;5mf0H@>|4ruk|2J9S|KDVh|9_Ju{{Kyu`TsXr;s4)cmH&T}HU9ri
z*7^T8+2H@*WRw4YlP&)LO}6>}H`(F;-(;8nf0I4_|4sJ!|2H|{|KH@0|9_Js{{Kym
z`TsXL;s4*{l>dK|GyeZg&iVg0x#0ib<dXk?lPmuJO|JR>H@V^e-{hA6f0H}@|4r`s
z|2KKU|G&vo{{Ky$@&9k~od1857ySR5yyXAi<Q4z_Ca?MbH+jSVzsaC^y&eDmChz(G
zH~GN-zsX1b|4lye|8Me{|9_J&{QsK_YFAkN|C=WA|8JVa|G#Mp|No|`{QsM#^Z##}
z!T-N$AUT`=f74w4|4sAw|2Hk*|KGHb|9{gG{{KzO`2RO8=l|cdlK+3xD*pdXYxw^+
zt>ypUw4VQe(<c1?n>OSB-?TaZ|E4YZ|2J*L|G#M){{Kze^8atzf&YKgPW=CycIN-z
zv@8Grrrr4eH|@dyziChY|4n=I|8Lrd|9{hd{QsNw=l|bymj8d#IsX4m7x@1-UF84Y
zbeaEu(-r>zP1pGUH(lrd-*l7zf731g|4j$Y-MRe#o9^@fZ+gK0zv&VG|E9<M|C^rj
z|8IK6|G()4|No|!{QsL?^Z##p!~ehO9smEP_x%5xKIQ-4^cnyErZ4&bH+{|jzv&zP
z|4rZV|8M%9|9{hu{QsMN;{V_D3;+M7U-|zx{m%ct=@0(@O@HzKZ~B}6f78GG|C|2f
z|KALT|9>-B{{PM3`TsXV;Q!wYiT{5yWd8rnQ2GBiL*xJ744eOdGaUZ^&2ahuHzVi&
z-;9F)e=|z{|IMiQ|2L!N|KE(3|9>+&{{PMB`TsX#!vDV+Q~v+WnDPJbDvtkuSBd=p
zyGr8!-&HdI|E^N_|96$n|G%pY{{LNN^8fEDi~oODx%~gT%H#jvRX*VH=f5+){Qo=S
z&;P$OS^oc>30gxM@c-|snE!uQCH()pDg`p8I#cHV-<b;k|ISqT|97Uw|GzVJ{{Nk6
z@c-{j6Ug}LOq>6IXFB}<JJaR=-<cl&|IP%B{{{U2J2T`zc-(bn%>TbL6aN352{I2f
zPMh=p@63Y#e`l6J$7n%g*A4&w&TRSrcV@@`zcYLO|D8GE|KFKYAmfNL=luUWbHV?=
zGnf4TJ9EYVzcbhT|2uQT|GzW0{Qo->G|s!{|KFJh{{NkM<p1B9C;tDPdFKD$nHT>5
zoq6T|-<dc5|DAc~|KFJp{{Nl%<p1B9pgDmz|NqYX@c-}3FaQ6}{PF+q%s>DC&SLog
zcNWY4zq2_0|DDD2|L-h;|9@wR{Qo;k;{V@SGXMY1QuzOOmdgLXvo!wyou%{t?<|A=
ze`lHe|2xa#|KC|Q|NqW%`2Tm7%m2T#JpTWk<@5jVtbqT2XNCO#J1gS<-&ryL|ISMI
z|94i(|G%>`{{Nko^Z)Oxg8zSKmHhuZtK$FPSvCLv&T9DocUH^)zq302|DDzI|L?2`
z|NqXK^8fFw8UO#zn)CnftOfu7&RX*S@2nO7|IS+T|L?2~|NqX~^8fFw9smE%+VlVK
ztONi5&N}k{@2nI5|IRw||L?2||NqXq^8fFw8~^{#y7T|<tOx)9&U*6y@2nU9|IT{z
z|L?31|NqYV^8fFwAOHW(`t$$qY=-}TXS4kOJDcPG-`PC>|IQZp|97^?|G%>({{NjV
z^Z)N`h5vtNtNi~vTjT%V**gFK&Nle}cecs@zq2j=|DA2~|L<&v|9@w@{Qo=K<Nx2;
zKL7vD4*36fcF6y~vm^fhogMT4@9c#Ce`lxs|2sS5|KHg;|NqV|`2Tly$^XBzEB^nT
zUGx9%?1uk;XSe+SJG<lm-`PF?|IVK9|L^Q6|NqXO@&E7aIsgC8Uhx0#>?QyI&R+5V
z@9Z`I|IXg<|L^QA|NqY3@&E7aJ^%mCKJfqV>?8mG&OY(~@9Z=G|IWVf|L^Q8|NqXu
z@&E7aJOBUAe(?YA>?i;K&VKR#@9a1K|IYsK|L^QC|NqYZ@&E7aKmY&EVfg=d4$J?)
zb2$G0ox}70?;L^uf9Ht&|2s$G|KB+>|NqWW`2Tl~%KyJ}H2(jcqx1jo9E1OV=a~He
zJICVx-#Iq_|ITsv|96hd|G#rQ{{Nlh^Z)Ohfd7Bzg#7<IC*uF#IWhnL&Pn+HcTURx
zzjHGF|DBWb|L>fF|9|I{{Qo<r;{V?{HUIz4Y54zlPRswlb2|S2ozwIG@0<z$|IV56
z|L>d`|NqXJ^Z)Oh1^@rfS@QqyoE887&RO&S@0<<)|IXR+|L>d~|NqX}^Z)Oh1ONZd
zIr9JSoD={5&N=h{@0<(&|IWGc|L>d||NqXp^Z)Oh2mk-hdGi17oEQK9&Uy3y@0<_+
z|IYdH|L>e1|NqYU^Z)N$hW~%(vi$!$m*fB6xjg^>&K3Cocdp3)zjHzJDKh{6&Q<vT
zcdp9+zjHPI|DCJz|L<Ib|9|J2{Qo-_G{0i=|L<If|9|JY{Qo=G<Nx2eKL7vD4fy|e
zZpi<?b3yYiG5`P0P5A$JZp#0^b2I+`otyLj@7#j_f9IC`|2wzh|KGVa|NqWy`2Tlq
z%m2S~JO2Nj+w=eL+zJ2x&Yc3C%bD~4@7x9d|IS_V|L@!t|NqWi^Z)PM4gden-2$2C
znY-uz-?<0=|DAi}|KGVM{{NkO=KtTh7ykd9dj&k_^LOr@|9|H``2TnAlmCC`zWD!l
z?wkLA=YIJAckUO++|b-V|NqWo`2Tkv%m2UgIR5{g$MgU1Jc0jz=ZX9W&nL|T%`YhY
z|2t3R|KE8U|NqX@`TuvG!T-PWKyyT(xhK$E8)(iAHZKL5!^(lqVS(l)K=W9j{yJ!V
ze#Za5t4cuY^#A`|RrCMvJe&W2=ehj<JJ09;-+3Yb|IP!M1Dao%0-4j8SMmSvJdnDE
z|9|JT{Qo<z<Nx1zJ^%mCoA4hz7dG$2|G)Fj{Qo=e!vDYXuKfQy@5cYX^X~lrJMY2&
zzw@5_|2q#fU-ahx-+3SY|D6Y#Px|ry@4P?%|ITOl|93vi|G)D&{{NlN^Z)OBf&YK!
zi~RpPU*iAY`7;0i&R6*VcfQL1zw<Tz|DCV%|L=T*|9|J3{Qo=O;{V_IHvj+5cliHz
zzRUl=^F99mo$vGi@BD!Of9Hq%|2se8|KIsB|NqWU`2Tl)%KyLfGyeabpY#9k{DS{~
z=a>BdJHO)p-}yEF|ITmt|95`N|G)D){{Nld^Z)Ps3IG4jpYs3j{2BlM&Y$!D@B9V-
z|IT0X|L^=2|NqWk^Z)Ps4gden-}3+O{2l-Q&foL@@B9P*|IR=1|L^=0|NqWE^Z)Ps
z3;+Mlzw-a@{2TxO&cE~j@B9b<|IUB%|L^=4|NqW^^Z)Ps5C8wp|MLIu{2%}S&j0iO
z?*fMZe;2U)|GR+W|K9~X|Nkx!`2Tl-$p60!B>w+hAoKt40)_v77pVOIyFlar-vv7V
z|1L22|964O|Gx_?{{LNI^Z)MxhyQ;UxcvXSz~lel1wQ}(E(rMlcR|SizY8M%|6LIC
z|L=l?|9=;x{QtWk<Nx0UIsgAIDER+(LCOEW3o8EqT~PD??}CQ^e;2g;|GS{$|K9~Y
z|NkzS@c-|EDgXa2nDPJbf;s>HE?DsY?}8=&|1MbZ|L=k||Nk!7@c-|EE&u;6*zy1G
zf<6ELE;#W2?}8)$|1LQ3|L=k`|Nkzy@c-|EEC2s4xbgq*f;<2JE_m?&?}8`)|1Nm(
z|L=k~|Nk!d@c-|EFaQ58`0@Ymf<OQNE@b%scOlFFzY973|6R!Q|L;P9|9=;X{QtX9
z;{V@;GXMWBRQUgQq00Zi3pM`#U8wW_??QwBe;1nk|GUuQ|KEi+|Nky@`2TmI%m2R%
zJ^ue)==1;Y!hrvO7l!=*yD;Ma--R*%|1M1U|94@^|Gx_}{{LN=^Z)O{g8zRPmi+&_
zu;TyUg*E^GE^PS!cVWx_zY9D5|6SPg|L?*H|NkzW^8fF`8UOz-ob&(h!Ug~TE?n~e
z@4^-T|1Mnf|L?*L|Nk!B^8fF`9smC>-1GnM!UO;RE<E!8@4^%R|1Lc9|L?*J|Nkz$
z^8fF`8~^_<yz~F>!UzBVE`0L;@4^@V|1Ny<|L?*N|Nk!h^8fF`AOHU@{PX|sB8LBe
z7qR^RyNKie-$gwC|1J{v|96qd|G$eQ{{LMh^Z)N6h5vsSsr>)DNaO$CMLPfgE;9K4
zcah2ezl$vX|6OGB|L-D)|9=;`{QtYi<Nx19KL7tN3i$tbQON(liz5F2T@>^G@1lhN
ze;1|v|GOyT|KCM9|Nky3`2TlN$^XBLD*pdnRP+DuqK5x}7q$HVyQt&;-$gzD|1O&F
z|L>wH|NkzU@&E6lIsgAITJZnxq9y<TE?V*b@1iyT|1R3_|L>wL|Nk!9@&E6lJ^%kM
zIsl%d{JZGH|G$ea{QtY?%74(D<ljYa{{LO{<^SJBKmLQ}EdMSR`2TmY#Q(pGW&VTa
zAO9{k`TuvZ&HulP9sd7a?D7BaVxRwi7l-`+yEx+i-^B_4|1M7X|95fD|G$e1{{LNE
z@&E7Qn*V<nxBUORxa0rd#S{MjT|DLg-^FwO|6RP`|KG(c{{LOP=KtR%2mb$Ea^(Nt
zB`5y>U2^9C-z69R|6OwB|KBAy{{LNa=l|a&5B~pM@&qz>vE<GFze_&+|GVVN|G!Iq
z{QtY;&;P$m8UFuW%JTp3QicD2mumd~yHw}@-=zls|1LH8|97dy|G!Hk{{LN?@c-}9
zl>dL1X8ixVH0S@{r3H{N{-rhl|1NF#|95H2|G!H+{{LOt^Z)PC3IG2tol?WWv}}sv
z{|6Ho8C1M~-8u-`_|?G3pi;xZyv#z8LBX$qK><z8Rcvbh|LnQ(|M!hK|9{w?`TvuD
z&i^0gC;tDmp78(2{{#Pj2cG%=`^=L6KYK6y|6yM7|A&PI$P5Ms1}@e;ptV859Z){Q
z{~s+TaQ5#fB``KF`u~sS10cEoKbk!tbkh^ix>FFF0klz!fq@Y`2LawgGQR~$oC!(1
z8%dl6A^s3%KO+MJ0|!EU{$wQe0!ZSsk;D~{#OEW4J0QfT^CF2iAjB7Z{r_jd&;NfG
z{QduDA=Cdq3pxM)S;+tY&q85N0sv&5K8OJC-`lc_fq{V;6b}D?YzaV^zXcR#Q1SI4
z2=TW!5$e}2L5OcT%D}(?iYUhaKQ=QUiJw5I-;Ct1EvFIcw^ksjKL>Fd1LOZ6Yb_As
zQ_>h17+4|h+<@espO#4Kk>cgqJdj!t{{Lg^1DH7s{0#gIj0_C_|LhfH;A7x}vK1J3
z8F-;=9R?l-9w^(Aft!IF%64JkV&H<Z{TVnJIHBw)1`Y-eC_9URoq-+7Ze?I&V1u%!
zGO#kRLfPvXSQr=><iT#(%fQdT@c%!Ez0VBcwx5;=x9#s@;ALQAXauR*KN;b+{fiN9
z+rJLsw*5O1Zrgtl;kIYj5pLUm795iHAT#$`GVn8SF@V|o%osQsSfFetaH;^g@6W#I
z|9@i(7`PZ1{{M~p!yo{nV^hHX`5XHJr0)OUxEux^ka)}$5Dkix|9|#B2CMnA{|6{#
z{Qq-+2dwtb0Xa|@{Qq;n0OXGUe-4Br{EiYY$8p5VafILZUO@PL??Z&&_aev3JA~i&
zBE`!-E=0WSQv<mPDPCadBnlB1`$`b***5_Z7yH&A+_Ucl!ae(*Al$Q`0TCDbWsuxs
ziAX2=br9~^@4~>szyb-sy*doc49pPr{y+vM1|}#wih&Uf8UFv-56U0l((M1A{h%_5
z5wyn_6z(7lW`iPy0Tf5^7eH&%|No5#jX#4hX#5$3LF3OL3>tq1VbJ(9XbcuK{tUvP
z@n;YQjX#4hX#5$3LF3OLtN|T^Huw)2g9eR1gD`0P8H7RO&masMe+FUD_%jHD#-BkL
zH2w_2pz&uA28}<1FlhW4ghAuaAPgFR24T?nGYEsmpFtQj{tUvP@n;YQjX#6%0q7Vs
zX#5$3LF3OL3>tq1VbJ(92!qC-K^Qdt48kD4gT`P%<If-r8h-|1(D*Y5gT|jhSOGc)
z4H|z2VbJ(92!qC-LD&I01`Qg224T?nGYEsmpFtQj{tUvP@n;YQjX#4hX#5$3LF3OL
z3>tq1VbJ(92!qC-K^Qdt48oxCXAlOBKZ7u6{27En<If-r8h-|1(D*Y5gT|jh7&QJ2
z!l3bI5dHuig9iB>GzJSAe+FUD_%jHD#-BkLH2w_2pz&uA28}<1FlhW4ghAuaAPgFR
z24T?nGYEsmpFtQj{tUvP@n;YQjX#4hX#5$3LF3OL3>tq1VbJ(92!qC-K^Qdt48oxC
zXAlOBKZ7u6{27En<If-r8h-|1(D*Y5gT|jh7&QJ2!l3bI5C)AugD`0P8H7Q8{{bC;
z28}_3#-BkLH2w_2pz&uA28}<1FlhW4ghAuaAPgFR24T?nGYEsmpFtQj{tUvP@n;YQ
zjX#4hX#5$3LF3OL3>tq1VbJ(92!qC-K^Qdt48oxCXAlOBKZ7u6{27En<If-r8h-|1
z(D*Y5gT|jvBqf%nfDWv-H8eCeGB98O-P~9lpPHPJZ)?bqkzZVrmzbMs8w|bpmZ7*L
zCBL-97Ic4faY;&Mo^5Gy66iu{&;_x!1`MDJ?NT7O-Pz{nfw|xVDZmG>gEShNf&~$`
z@!1*~Fn~^;j0YW+VjC1-6%+vCC+Fv-Wu}Adw>4zQEC8J`VQXk<q-SVmp=YFLYQO-x
zEGV@ovj9od$jFERdLD(Xfq|8&ft9n7m4$(oi>Z}?0R#9lEBL*(wgt(Vh)Zz6N4nZV
zt^<YN>;vT|=cd?#uHUf+-C+d2w+wWaQG9Z43Rpi(8q9&o*n${|kXu6_H;5pK7}^#W
zXJ#gYZ;Aw|GXnF$ij6_R$$)lYk1fiDJs=&4Md`)1Mfv$9h%0y$ptnNVmXuV211BZ5
z*cNp3iV^q<a>%hO@g@}pwuWGVqSTV2N+>%&BRMm^Aiq4dC?0f6XguVKBFM#Mwua!l
z$m5aj@wGLCRviqGz5kDzL2bAHe;!Tv|L4&(a2xB-qvikqJX!;4>;3=pXwUyYk3jtd
zmj8bqUHt#&(N$3W18;*t4g3G+@nuk(?*E_1_x}H75Qdof_{sl2k6$w|FbMts^Z3*M
zKaYPfFfa)I|MU1CXdMsa%!wzg|NlJUWME+6`~T+&@BcqfM6sLyL>A(<CtCmiJTZWn
z|HSP7pC?ujcRq3X|L2Jv0|Nug|36PW{{MO6%fP_E^Z(D2p#OiKghS1b`TyrhI>en%
zivIt3QqI7@!1n*olbZj3o`AxE|NoyS{r~?wnaaSx!2bWwlez!@JXs25uZ6NX{{MNh
z@&BJE+ZY%aIRF27$MFBpll`E+&Hq17j{X1h<O~A?1NZ+wPcHrc^W+xPkI(=AdGZ0`
z_a{I9|9JxTB4!vqdIGU)na2M=k3K=%`I!0tpT|59|2`J||L3s`#E*|P|NnUmYWg$(
z|1-b)|DVSW5WhV3`~T;0C?u>N$Nc~E8024$|9>7={r~g03F79*lmGvDJO|?D#~c3t
zdAt+sAaI{)s||+&2ly~Q&~ag)=!NXtf$VqHXcQ4qV4P6SqX2GUfuuq06i|N&!UnZT
z{=DJ*|L2X=|37au|NnVo`Tx%wZ;<5wKX0P{|9O-1|IeGc|9{@}|Nrx5(f>bhwu9t`
zF6I&z6%&(@S5Q&a5*-S@5Rg|?R@c<gH8eH@rKCacWL;Mm7grY-XBTH@jY02N1_lmG
zH#av|S67gmLAjHBC-W*}(Ti0Oi#no(gq_^o-N7z)bu~xH#zY$dRT#H356VKKVt3{v
z@u<L5a0dZ5u#;^#2pOmh8*qUr<S`J3Fu)}5cQ7T6EXDv81j{h!gQGx&n0Q1n8KN6R
zGU|JJdU(2fcz|4O#|IL^h95!%ckVn3s==0><DImVfq{Yd(XyQk49d$Ok_-$xLC(oP
zdo~tDP=$ek0iu7|&SeG+3~}d{#)5SioMkXr#$d3Nfgv^yjN|ec7{t%UE{kPgn6wOJ
z3RoEm!ENQ`<>~3^0d}#I2#OpMXBjw1^uIGGpJiZR*g3i3Y+ft_gB{4x3=EK9Wnf@f
z2J*~z1KzXZ=z?JVJm0~wvlFBWZ1#7MGV$*WU^g2qW3XGwz!2BK;MV|>HGudL#6-d(
z?%v*BUY^0B?j9Z<E-pwiD9na9P|z8CXJ9yI0J7w4J?~jw27`yo;y{51b_N3jLo6uV
ze&{na#4<2ELJ^z<cH{S@`MeAaOLx|T3}awmIIGO?U7X=NFE|vGcQP29WnhR~3JP=v
z2EVf)qfs0I;wbw1_;`Ezw>JB_dwO_4%>hZE;<$6m&iXMhJQQbGYQP|Vmcefl$Wh{F
zc_+s*Fn|LOq#hhFll;K$2E{x`jKLQaT5%wsFq{>Oo5aA-;HUoxEW@zW9%LLyB`Au(
zq0ONDh=KP91A{Usjv%U#NfrY?Ute#(^6AslJiWZUw2|eI+4_?i#J}@0`0b4SA<m!=
zj=6?728R6nNpTDe^*iD~Zen1l-)X?ZpnNv=oF4;2!%nDR!wv&p2ERwKOBopKm&HzE
zU=ZKw2X$}U*@lNZVjmhXFq~6nV0bvm50qe*O^W+2&Y*nOAQsdpLUshG-Q^JA@8ef8
zeae*n5HD|U_|P(%G6v-x3=H257#PGs*;ZVffmfLUTnzZd@iH)oDf>Yp#^Ad?F9QRw
z0f;A#5H#Rr;8nH*r3iyKP}w0K3u=xsFffRV+xaor`7tms_=z(xC@cGcm<)b?pb$5R
z1!+Kchp>O3pMUX`Z5Jm@uk-Wvv0_740ONm;oxB6a#!WA40NaSFU|9pGC5$SD&I6}>
zxL`dv^}xAE45i?Jpt7mUzx-R@H7ncO*8xiuKvWxm0}aB)P4a?65ltSeAetIwXoy3E
z#XzwDVWN_3#zCRg)0e#d|NqhC{wZ<3t^%m?gN?`S8r?i&(KAqE{BY;Ao-i+o!RA6#
z_Xs8S&RX;o<lO)N7In^U2$DmUA7nf>*Phu+UVxqZ|NpDL3G++U2AK;{oWpNFbJFTJ
zQ0M;tf2nc$G;lu(MbV()aA}2?Pu=tp?%e<Xx7SUX0&1KL8Ydz<L^Y-;z2fk9B<KGB
zHNSdJnjo^GLBtmENG?C|6XM*jyRL&7@4D*hgM_d+QY?JclkeXz&h&tk&${iapR8`z
zVenjiai*A9S~_S%fPo=BEnN(x*CRa*OoP}AVsdiOMm3*?p@W$YOooL8#DjNmJ!Y={
zv8r8{fq}s)Jsn~UgH;;TK(Ij!>>03}_W!=`B(Qt`->=Kf2<L~$Bavy}Vc-eKNDmP2
z$M^56zkmPnT}Su(chIO20|STy(zNQwcO4K7#)hu0kVdsKsMF=@=4uF<kYnJs265e7
zAqsi+eg6S6^Lqy`gTj;V-&cdQ>U@VXKpajUqXp2w{r~^pRMXTC5C@-63eO9MwFE&5
zLAd-o$YEduzkk<d5CfULZ`DPxz(qyf@83bKD+Y$|AV~%WhE?COx!2Xz)y>Qm<Y3Tn
zj+L96o3(?htE&>og1z6rf4{i;;*THS+Zh<bzkmN8#=yXH@%s<(Fc3%qgI3rhhyy|7
zb3glt9U#X4|NqwqMdt^hreTmrpMc^>EFEMn1Bed_7b{Q_;bFk$UQjH6?O`x<gM_bx
ztD6}I1B1Gos~aduxVpLuF)*mRy18*MFob>o{v9+32Z}dc28Nm6e>@gtDF6Qb2W&PM
z<U`{XzoAb2Khf4ZwiZ^dEenh*j6&&Ww8J8rfg%0J_wS$p-3xY1`Hvr~8Bp8{@&+V)
zIrt#J%+=MEkAp$T)y)B%5DdX-z}nRfTr*j_x+yU*?EU^7k^?%ve=lcX;Cb@>`zlZ<
zRDf-P5j=rcAP#;M;1rUcxD~?r|9`G`Y+;-<OcetI!^Q94XF<83pw(4?1_wjh_wTD1
z7<7L?)58yFI#>;&<=kAMoo-h*S6K#SS7=fdb9J?5;Ba$uh2%n4S2G5l??1kS!W?P`
z#KiC4e_TXMm#lf)zkwXt<>Zl&lUM=Iebc?73evR^Ez2K2en6%d85pd<X>{-R??3jX
zh3k|<+>4Zc5#cKbN~*4IuApq?D#u{x>Ix1}20k}8R|X+hSJ2=i0|TF%t1E-fkMG~p
z($dq?)6>$@z>73M8Rq+UMYsnb42jf&zN`QL-wbl~&(6t8TKx~?co1IX6Oo_qCWbi}
zVfEz4_wQm1JRRVy1|n87Fz9^$0ncv`_kzj?IX72rSy@?GYgbowIX(t!S2wU612}x;
z++3l9;I6K29H6KN=jb2be|*0Pb{i-!!@>wG03wWwi*ies{hS@(9#xQ&n^E`x<W?}=
z<P(sYpJvYvQU$|e9_>#+E?fl?;L%Mh2Nw{l!0v^YXW)Fc`uh)E1};}uYfyrPmS=8m
zuF&)gN*HpkZqW9wtD7sI;`bllSAoFlOVAR`3RD7t3pJ2sFzjDmURqe#SXq#iQB;th
zmp=Iq*s&nuP?%Rzp&K(yC4*x7#qZyLfK1uP!@!`cqXVut%71{<FM4{o2rk!T-P}Ok
zBA9z!-CWH$7+BO@LFI!i!o8s4`N@y(3Sg_+zyFxYz`!5|4j53O1{Q@9Jn5B{73F0m
zC8eds#YKhr`8h{HPKDq{B_1)51P4+LNl!n1e1DP#$^(19e+NgF?vEd!@cr@qJ7~Bc
zoD4xz0N^yv07|laAkqy~Ux1P^2)nwu88R@)fk}|bpzvjYIuq<pPX-2t)jz&JnfV<(
z0m~NFR9971RFs#Mm6n#26cy#wy@NOwME=`c01iWtp%CYOpBV<t0qx(vKM50Mu-f<i
z`%DIKcKII0qX;VWe}wUfwf_KzF9U~zt2Hy!)eP2dZgLLb%m=F9<Xl~m(gTCo_wV0l
zDl%AI`u=?%1EkROVA%Hqt$^Uwjj5^uIk^(#=F-xV;@r6)m%{KDSl@^jlx)FuJIL{n
z`1%2@@pQoDFF5{weE+@=q!L`GfK&>)xhlcjYv|@G$0Dg?s0<2hP^L2jsbJuCb#-N6
zVDJE?G?0mp6(Rng#lWBl@&s5BoZ!-osI050sj054tf(j}D=jWM0CVjB|Nj@kvKuJ>
zg5#fo!6O}9;3%$!IP3|i^wIhLeU%5uvhRC&KsD5l?@yrdpyTSwXXpw}4|1^b0c<&+
ztE($0Gct&|x;cVGtS*8Z5UUj#7<ey!|NaCNwV+xLlsZ82FwChMTwPaJQ&U}C1xn0C
zb%-+Je=gWW25<m=2WNZ+hJD}?mw|ynF)S@D4OE9RF!1Q;C^CqJr-Qko;c02mMjQhJ
zi?yqR8N|I@Fc<283t|UXS8xrX?glO9K+Uo=us3;hbaf%kHXU6Zun5etV46eTx4OQ*
zwzjsqs;aW0a1x^Z9tU$TD0xA`*XsNCAMIdm#1VY1ps{dp60ml21q~i?Ik<sbs_q6Z
z?YLasK+Oo^41=lS;P9+!tgo-DtEsN8EM5jL)FR<E+^X;2zqjk?=$3;b4b#gogRszY
zph_9+UQiM+kX3eY1((C13fWp#$-&JHl8&)x#UsQj=3d^|P+wP9S6f-O4O-3pi2%)c
zf^{i^@)IOWKpQ4tVPXg~aDfF<Ddq;Mq1{~F!2JO+Q1img)zyIuBu6?Haw%zSXsEBR
ztE$`tX&3*DM;HamU*EwQj1<#396%KUScjmstE;Q4Avm-d7zC|BL2t+nmLi7`aL8|J
zYHVmMcW4GDi9evBTDU=qX{%PPE(a9{a3RteTzq_xRvB0;Hy<CY1OoF(CIoG=nwy#$
zEIGTurCK>8my&D@9W@A;W;8eZaj;eV{r~^JJt95O(Fr74#cP<6&BeeL{^<XIQ1L^e
z?txIwqs-30z^J$Pe>iCU?LfGIEIawiiZI*jWSK-KO)}O<d6`aj;;?21lmBj^gJ%VH
zFgWxb*w4VQgVBE{i2nsseNEG<rlwt!nrgsOHUF;t`*-Z!zkd)e14B;DzZwe(XhTlG
z0>p!IEG#VEy?ZABI{X#1B*miU-@h6dkAZ<f!o~(N)cg+wo*g>$3`G9}+hUR9k^^49
z4;DH$Y1gD<AQpohpOjR^nKNh3fcwohX=!O`HWGCbU~}xu><kPH3<^Fx02xu2RtJ*J
zd-n#k4xK?j;F`rdi)#X4r!^dS@Zryg2L~WCL@YcqHh*kncpz;L37a|z35hzW({dny
zAtwiH=9Mc~N<>6NL_iIniZcloImeFWSV%w|15&{7=g*%%AO_r&Is{Kb0^&{(jbsG_
zgMq{!3257zfq}sw;ZFjB$8g}l0kDZ6a~L#o{^cMRBp4V}R6wi)N&fj$QDK0j5hMo2
z5;itAAgdv^=j0%nz>t&k?;iw%Y&NJkbL2n;PtO^sK?jcTNEjrX=>ZvIk&|OlaqrBT
zJ7plAfq_8+h=yPu2~fZr7)XHHs0;=YJYWF#Q;x+y3vl>>RSO8zKw<&R0}&DuaHR|g
zzk*~ysRSIipwS$VTOd(pP;utWoi}IBRDiuJVNn4IQgDi_IKv|$VUTd(4A`WKGdw&N
zJUl#*DB_W^$vN{6<T#Mwe-0ct@B=PqkZ|C@4|vM@bA|_Gi~%G-K`9P|A*O&>H9R~#
z5(OYr7#P6e3MN2&Fazcx7Lc0_B%n!)fuRPBK*|^x91;v9K+@n*jEXa7Kw-!Lv5$cP
z<iR^P4uDfR$hT+yfSd->_#-DLrvj8J!5w;woFfMg95`?Ul37070I522<_2il7eh@>
zN=8LSLP`!eTxwDhK)i$mu&crP?wmQ31D>q}=>l5-T1LhIN-W?2wE@{D0}3u4SdKdb
zG8}9TNDgE*$aY9rg9?Rf$3OricjnETKX>kcOa}2lVFqGDLJ$<rKfs!i<?d8S$S^Q~
z<-q;`$<-V=a3H~gho=YZ+dqG{KoS}_T)^gm2xMLbBu#*X&zw2)=MT8~b><8xYgAO6
z0s9XmR{=H$WW%2`J)rb*1mcH^1SkNT$-vNX;6Z@}v}k~)G6@NgoPb5nF_3ml{EvYl
z!2p(Mq0$vRHD}J80q2|p2M&P4?+n;S44|k!aNqzWTx587Y;r)(1FHnf{ej6@<fJ5g
z067jEw+svnWgvxTYCuW*z<~od-hjCv`wR>i3c%h2xs!p1hXE3WJfK1oWYvuiAP0a{
zLX;U87=TqWFfhFNcMSwUatsU%JHSSQ!wl>e5ErHrA_s~@km3@M)EQ8w0P%LbIRlDZ
z5EHB~!2nuB3K$st0l5sm2n?(Z5-to33}7B4{ume-jvc#p?b<(BxdF=T(D;L?JX6CX
z0S=5mXF#PCIKRsn7#KVNSpi;V24X-k$SnmD5)yo%gbmICZ_uW;K@ocF7_9bz<tk7f
zKLd3c*quBQ1`HKvV6h@#k;8x#w`UlTc%Vdpkh93KK#~JFrvem6ppy0h*c7;#3?NhB
zyaNfy_A%rzFj#=RAOXso1{G(JVj83p5~1KYI>P`eH$b@>RI+<`7*xQ^5D9}nXO3L>
zZ~>a;LGf;8R(InDcqx@#&Y3g+KrsQ@Mg?&hhzB(jR4_ry0+4->Yz>kFxdo&SlFC7T
zNAN&Cg79j1Bnr+z%>X4w28J_`ScjTvU{C`Nl^Sq42v73Qz;O#o0)M~>hyh$o{5W#v
z-kCFJK-o~n%m9+KHh}7W34;Wrum<rE;R50zTn*wuTn5f@Wp|L$eAyiaa2a+6QfgG(
zxKV?soeFN;C}4o)U{I-T0IG5zxfm3=pt=Rz?f`KZ{(#C*5G&z9Qd$nEcG}@1VNe6*
z<=oj)$HT(_F~y()T7oe!Fqq}s$U*e|Z{(Qe+yEKE(4mA3LslWfce{`wB=Mt?ACR~o
z3}8G^jgph|20}qI-5(?#s>(M!FqKdxPzvO{KPYl<c))STz`y`e0^@-k@xcI`eL<SQ
z80Hp`oPhys=?aAR53B-4{DTNWNpQ0dT2(VJz*IsckyY9mz*Iuqk_Vx{WL^Ter3SU2
zE&*BY9o$Ti^go7oU>y)553Uj-2eTa{`wp%W<d%PMQ$TV#IWUz_eIO+WKR}c~Ntnw(
zO6=g_0@8=@5s1gYPzTikq5eUr9FV?$2FM{{fEMzwZ~?Wk5g1}7jQ;=y$e{p;8i;xb
zS$5~fjT?}*A}G7vICJdSF>p=t=L{%^!|Ml7^Aqe$khVW(5)43<F{CbLU|^`b0RrIi
z8eZ!EH~?-0mfZoDgW!tx52&aE7Y`s)EOO3(i#kY~2-HSD2D0HDNX{m~Kmt@1!*goQ
zwQJYF?IX}acAlDR*PhiRfHSU)K|(@JLPCN8xF&&@SztdffC_>?U=m~~1GwygaiPsR
zkP=Yy)ga*js5Atpdl@rOIR%Oi0|Nty^Ccv1fQk}`F${kgz%5!Zuj~#(*&Q$o)bs{3
zkO*)A3FpIf$$<^MapOh>sPl9K<ZWnP2DLLJ3{t?(fNHCO04NU&)yRmLtpQ21vZ4(S
zp!1pF!=WJM46JB;1{T!8D^@f<0}E(-E?6s=U`69IFrs#!|ASS5b}68_3nmVuSs-0I
z7#D+PBruG?g5P||{#)=qV&?yUrnNFKGBE%DbK?yI6NtVE+8xaT-gohzff20smx#*$
zUt$yf|Khvx|CgZ8|6h^}|9{CUKxl=Y|3Clm{Qt$R^8e?LHUEEUTm1j|ui^hMy_)~O
zjGp}e#ppv={^y7Pzc}yw|M{)p|1XU%|9}3q`2R~M;Quefmj6HhtNj1v=kWhm)QkVW
z{0;v9ij4XHD`~<1U*!(}e>If+|JAhO|F71D|G(Nd{QuQf@c&n*&HrERG5>#co%sK&
zVbA|x4iEnS>JIq-tGD6*uO5g0zxsLp|LWEG|7*gG|Gyep{{L$F@c-9Dh5x@M2mJpv
zN#OslDR=(=n)K)YuW1?oe>M92|J7{q|JSq+|9{O?`2TDAga5x~t@;0J#+m=W=2-my
z<rwn+*PH|Yf6e9j|7*U@|6g<e{QtG!#Q$IOUi|;HDCGYy#|i&`ExPmn*J6$Tzm`V)
z|FuNo|F30F{{LFa^8eS0g8#o9&;0+j;>Z7AD_#EoS{?BJ*D8tszt*hz|7$hF|6l72
z{{M2~`2TC&hX23T{rUfEeain|>(BiEwZY{7uMKnl|Jum%|JTNx|Gzd~`TuK^&HrDU
zmi+&<ndkqn%_aYTZNBsW*A|!mzqYLT|7)wr|6f~c{{Px~=l`#5HvfNZoAdwIwm<)W
zZIAi?Yx|!6zjny{|F!4A|6h9@{{Py$;Qz0E4F7-aOZfk5-+}+X_AC7VwZGy2uN^i2
zf9-$p|CbLGJGuP-<<#*1m(!mAznp&j|FtvZ|F1&{|9>@3`Ty(4ga5ydXZ-(le8c}=
zCpiB9IuY>ySJIdNzmh}#|4QES|5u90|6eI3|9_=i`Tr}`<o~bK8UKH!{`mhZE#m*L
zv>pF{rAz$(m0t1xSNfCxzcPIO|H?S<|5v8L|6k=N{{PB~`2Q=r;s37_EB^mFdFKDG
z0Ga>4VoLu13S{~JEB3?xUx7FN{|cS+|JUgi|9^!`{Qq^P=Krq)JO2N2Hu?X{x#a&Z
z=Li3Px%mA5<+9`dFIScSzg#E$|K<AU|1Y<U|G(V6{QuSX<o_@CivPcMp7{Uk5X=8x
z?mPbf^5FUZtMbVIUsVGCe^r(I|5bJ1|F5$t|9_o(^8eR`J^z1QZutM}WX=Cyr#1fn
zI;Zge*ZBwkfBEYC{}poN|F26P|9@TG^8Z(E%l}`wXa4`n6Z!uuFXsQRye0pC<-Pg;
zE8pb*ul$<-zp7RK|Eiww|5x>&|G#Q7{{O1E^8Z(@!~b8kYySVLllcED|H%Je1y}z6
zYHs-dtNG6VU*Tu||B9IM|5wq1|G(;5{{On3^8Z(h%Ku+2CI5f5-1z_NhQR+{H@5u$
zbu;7tuU3u!zk&|@{}u1@|5xyV|GyGG{Qq@J;{UH(C6M^^eewUd&7S|iZT|fKZQJqx
zx1GrU-*yZB|F+lp|J#1Y|KAQS|9=%%{Qp(_;s39ajQ_t%uKfR1YV!YA>4g8k$^`!Z
zD$Du*tI6m8ulfuBe>Eul|5f(p|1Xb-|Gzvo{Qu=?@c)-*$Nyhm91y#_JpTXk>iPf6
z=f(eDUKjrVx^?9Lue(S7|MHgk|I0h$|1a+?|9|-~{Qu?S^Z%F6jQ_tLPx$|9m%;yE
zB47Uh5>NU6i+|1kUqUwje@UhM|0Ndzp%q*H|0Ga;{QULj|1YkF|3AO?{QspT^8Y93
zz6#xx|G$h({{LdI_)kdwm*|oIza%XF{}O2U|4Ufs|1aq?|9{EnKxie<s2t<}U++K*
zbeR7CdJp0=|Nr$HM6>+=%>e3du>Sw;eFijzkr)ufFUck;$;8VI9(?-$cit8#Uh@C%
zJP-z*-vq-c78(j%^=v5xOpI*c%BV0Pic6kNQih2g!ne@SMdAPdEp%fPkK`~A*7^UN
z5-jrO|8GjLxWfP6;u|1oP{QH=Z#9Mgzt!(R_@H<Z&-nja{0D>&k~b;%|JzIl!Z$ww
zp+V}TTK@mmtoZ+1+UNgo8Ik|LEw}vtErVo^&WiuP4LSb*mOb+Sw_?rz-_{2If2*1x
z^n=V8f%wlaLC{@m4B$Pc|BL?r`CkoUBjf*n{s;d5a|E<snc@GR|B;|OIgsT+?EioM
zCqV951D%=jKjZ(O3y}4IAW10x|L5Or(EVN@?*BjkUV!fTg0jDX?g4|a|1*Q`1B0>!
zLHB||*>a%!!Jup%(EVUgwiW0uF(}&!bf*}U?fL)DXYfh|$e!%2pdlrY6dZHFfCdP_
zI0$-y04iXC1E{zo7%*Z15Cu+Pz=Q>W<WU>@a91H1==Os&A!97|f`kM>1S2CO7Hh#m
z0$`GfiRu4e=0*SiGH(L6-TyN0{r{Kw#Q(p{SO5QIe(?V<^OygBSs>>={T1x}|5tF<
z|G$DOpcuqn^Z&2luK#}pPZg&YWhUmp`e+Ocp^iZzAm0Dq4_rXL`TzSt!vEh77ySSI
z@W=n(4<7vg{SefBV}R&`t{P;3=mYWo|9%hv)tB@C_ro>+e?MaR|NFs*|GyuChr2;>
z489i*bax!+Zn!_6t^b4WhXdUi_Y-tK97s19%QG-AfI7G!8no68nMP)V<v5un85kKE
z92huR7#J8qOG(&S8=09HK>aWwMgforEY3iu$}q4nbF#=V`!jejI5T)MC@=&u<TK<m
zlrShTcrcVQBr$;MZwLmvg$r~p5Ca2)!~Z{b1VG}qj_lvO`M{BzhmUO8au}5VK!U%X
zZu$S~X~+LxPaFRKdOGF*ucu4?|9ZON|F5SL{{MPf@&DJ;HUED-?fL)fX~F+rPv`vq
z^V1&G>D|Jxf$1#h+@U|+IXW7;np%2tnjquA_|G)ZK73Fokn#VI2A=<argeei{13QK
z2NGuh-;w%f+82m8_)IO(R3hX5AB{Et|4bM7|7W_%|39-YfF?S@``|(M<o%g_?f;+I
zpfk2W3jsi#NXGv^CNB8@XMw^0KMTD6|5+FW8g_uFpZw+jpM{bC|18Y@|7S612m+*@
z;s1~6F8}{5KK}pD;%EQ=ECEeCLdB;|`Tu8$-2XpI?En8+1`-2zzW@K2S@ZwTGVcF>
zmKp#5v+O)*;tXQ`oQ(f}mR<Y*XW5_sf52ysfufD!|BnR|{{LCM=Kr77m;e9SX^wC|
zNNmF_h<`VL7J5Sc3l`t-|IdaC|Nm?PrBjf-jQ@YEsrmnBlg<A>o4o)3*)|<?jsV2o
z9Y_BE**5q8pKUw-|3N+zY+J_vKils9|FiAS|3BM7%Q``RVEq4MN5=m@+cp0G+3xcH
z5BO{`Q0JZT|Bw9#{{Pv&`Tw8oC;tE00ZM#O@!ci=|LoxX|7VBH|35pd5&qq`<^P`@
zcK`qE@cRE}3+N0nsQO(k|NrdB{{Lr3{r^A6XNVmDi7)#9XUF0He~`~2+gI`b&yE`q
zapbehw&(o+vy<unpPhpL|Ljgg`1kOf|9^I;{{OSP>i?eupfk-tgD8yuf1Gyt|L4HD
z|9=kr`~T-4Xc8ADZt?%mK|`o`4Cq`5NVuKW`Tyr&5=8va6?nY-G!*&&=g^J+e-1N%
z?)8R>GyMN?X~q9Phu!}FIh^qS&tcFRYtZ;Q>+=84;Ya`f9RBzJ&ygaK*`VC^|HtW&
z|9_5v?q|1w)<vMf7smfT9t!;bb0Pcxp9_=!|G9Au;hrZ~{{Ojg@Bg10pF!md!oME{
z{{Okj`Tx&NiT{6DKr5?2`GxWSk8d&m|J>Gwq@Q<jaC?9Dr2PN$E**-i5aQjSyG85&
z|9Mvrx}yvs4!T$V)58CMKJEMe=UW)u-k+d*g1<%o|MM;T|6hg~Q1y)ef4!LV|IZJ*
z|9^gjfb;e!F&YA+Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqhK@yMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ON
zU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU
z1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0q
zLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(
zGz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!nMnhmU1V%$(Gz3ONU^E0qLtr!n
zMnhmU1V%$(Gz3ONU=)moz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kW!5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7
zfzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S`WG8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiSYL%@Q8fuTl@dsz(w
zdru7mb59Ke%Nnql6!WqgY35}$QrydGq`8;XNOdo(k?vkrW7D;)#-@9jjRJ!~f?@(g
zjq&ScH6~umN)#Iy9GVy$YK&hkOHgcph>LhHs}c2HRwL%UtVY6nS&gLkvKlGxWi>M1
z%W7o3m(|F5FRPLFURGn^wXDVf#O7XRp}@#cW01VeLV<~)#t=j^Gt?M?XcmSVV-U^C
zP-6n3*%)d}K{Pu<jTwmMV5l(%(L4+_79g67p~ezKb28LefoNfd8e0%8!cb!eq7@iw
z?30((2;5#)BY1mRjnM67HNv--)d)OZRwMX$S&h)+Wi`T&m(_^eUREP|ds&Ux?PWFM
zx0lt3JYH5K`gmE5*yCk2;*UY$z?h);gQ3Rq@v<5VkiJ*TY!v?gPf+~NP{Y7sQ6uzv
znGFL2gGB=aqlE&4LyZbYK#eBzvKkilB{eMkOKMoemsqqgFgh{(|KP#E5L?5_Tw$TW
zU=LDb(ZIl9vGo6+7FGrp9R>yl$0i1a7F7n87FPxquznT(B{eQ^{dYVV7&yIu=o^6J
z4-|JAOv`Gln3wr5Fr?IIFfH?7U^x1LfoZ}A1_l-e21fe}3``Rk7#MgM7+9qn7?>tB
zK-m)*m?lhsvKKHgO<2Idzzb5dfq`kl1}OUg1Ji^9Q1$}`rUC{i`ym5UfdZ8Mn1P8w
z0L~U-Fo3e3Ffb`_FhcBo%D@!B0Co?H{d)$cg7;uHtNkMerhxq)K<;F<XFviq98Ak<
zG?<t9H83cQ;A}hU_0bR*4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@RASndA|9@Zs04K51
AbpQYW

diff --git a/pc-bios/u-boot-sam460.bin b/pc-bios/u-boot-sam460.bin
new file mode 100644
index 0000000000000000000000000000000000000000..6663683ef1aab1af6e284771acab98235ea03811
GIT binary patch
literal 524288
zcmY#ql?)5jb;{2#Q7|$vG}TL1(C|+#Q82PlFfuSQRnS#1G_^7^u`;pHWEhs9Zi4f&
zx{c1u>KYi-tQP)fm^77P#iXkY8I!&;<kU@YS~h7aLqgp}r)86_GNjaXFoF0B>P|9&
z_;czS!Tcq4bGbm`Tk39cEvx&@wQPbYgTMq+29XJ&3=$Je85rsouCAC+${;ggDucp=
ztqdv?t}<v?Br*tiFfg!!%xs#%pitMryv(YBfg$J%TajM_gCYZit^oss(gX$u#V@oB
zc<TDUYgygzE-Lw7TW09_pJ`d$Zzc--FEGU8f7Jifi+>}R;hg?!CNnLYFqL6T%_gR0
z6Sgw!Kr0VbAmt$_Kd>ku%0!(IYKIAR%RjQyKQ8|+ptgU}>ykm@e`x&&itnLZ|B)U4
z*!(|Q|IwlSgPtEo8h@nc|B)8oqy8NYfzc2c4S~@RfP}zEum486{~@VhlpGC#(GVC7
zfzc2c4S~@R7!85Z5Eu=Ckr4vaZU0ks{=0+Lb044>wqRgjuu=H`zebFCS&fYIvKm?E
zWi<xD%W6b|m(|E|FRNi>UItOaz>uKGz)@qs-DcxZ|3AU$|Nj~-uC^LQ0gD<f?zS3r
zC|jMo%|@Yt!A1e3p0lM!0mNruOi<)(sZj*8nZRr%Fq;|7Rz@<@N(*A9m3CW=Ih1X#
z-Dab}zyell0AfF7NKoWw0J&=l<NrTktoZ+j4a5Kc2@L=LOi}#*V*(=s4`_WsZ3ok`
z1|GJC+J+<%4+geY4+hEHNmm&r*d1VCsr$a6V$xTJDHFaj=u8x4Fqmk{U@|e3!D3=5
zgU!UL3=R{wGPq2<%HT2aD}&D@QHFp?rVJsILKz|^l`_Ok7G)@yY|2nFIh3Jdaw$X2
z<f#k|leaRoOuov{G5IS)Pu&ZqWko;i877M|Y_K}Oz%c15!=AcJ&dZv`85o+rGqBW4
zF)yo|&AhDc1@p2R29`BG42(KH3=Apt4GhaH8W<Q7S{fMY=O|Rb<mww3RbcD}M}|2K
zj0_8EJeil(a4;`xaAa80z{s$o#*ukh4gW`lhC~LLhDHX3hJ_3&4F?%C8Xhv}G%_+6
zG%7NfG&(X^G$u0GG&V9gG%jRtX*|f_(fE+Tr-_jvph=M-q{)#XqA8Ifrm2x3p=lvQ
zO4C7xjHZVSIn9g=1<i^KCC!cu70rnZHO-9-4b2M~TAB|sbTmI?=xK0dn9#t;Fr_An
zd0CA#^Rfm;27v}g28jkm1`(LMhll^Tm(@sf<MLnH(2u|FWi`^>xcui+Q}49QuYo~f
zLo)*dh^}dn*MZQoV0u9^R6Icr%&$q1fzS->Jv9u>J+QP;W7D;)#-@9jg#rUZ4WoEU
z0s{|-UILd-l&+}hRIaF5rCou@$4q-b`M74Wc7;vD{~rl03=9ox8YF6#XarasU{I)i
z5)e?^QzcS=uS%q*S;4`Am4P{g;lqB%HU<aBCWe|CPUd9}EetZ2EdT#lJpTWug@b`*
z3OfUf6T|->9t;dJAq)amwJb~`HIJD@S~&jynZo}64@gdjje((Nv6hHq6N7~X+yDPH
z$qW@WDbf`+3<^0lEk+_WEE*1u4gbG@+zt^}UxO|V%HI}TY89aT3JNa^29C29ISmYr
zISmXTchzP~1Xv{h|I@<Ez@o#zz~I=#z*EBzB{G4Tfx(I4{~HSi)_Dy%4PZHtdXQSj
zCI*?7W(JlTmWVu%+KJ8#3=>!&>Kk$z6dHOOWNMfdKz_FXm6Zjp49p-sHLVH(H7l8y
z)wC*C%wT0;uvp5#2=XV$E{kLa7LXo?rvG1RmAxx!U4kn-7=(IjI+&Ir;(^fu6b}t=
z8h9Fc8U!pA7#V8V9UOcb7!(@V85kyTGB8*?XJE0^WMBb_J2d@&WAT7#h9v_Vg9iiu
zU5n=s^`J1bc)+&CgMt5~#RK*^9t`{kEgo>p@L=HIY4Ly)L~pcszy+dLT09T|(F-je
z2!rUE77r9a^h6H^22N1iSv(M6NO{h{RP&p8S<MTkWi`K;mx0Qgnhs`gdJSo1`ybMJ
zv(B-Jfdk}Uu>Tq4-&iCwD1iJ9iaSuebU@SZ3~2hE0HqtC;x*0UOF-&slEqWNbTdDc
z&kyCZL;37rJ_8%00t4&c2nN>Q7eMMkbyE!o(=v+$1_n?a<^BKvTMq`dla>k$0<}iW
zZMF(*tcjXM4z<S2ZI%iQ3=pyZ9}_hj7@%T85V89HM9qH<P%$Qm*nj3k%>^)Z$`G*~
z5VIVZ3u^tC+iLZh+CnwiHh|cPnhXuK`pj*X4$OrhK2%N)#7@+7VF1b1Dk`<5YO*oZ
zDk`_tYC_qX%54pd3_KQ~_5cSYd_n#J`HzA1=aDIj{~v(-=ro^!b$=oQPyGp|WfK?~
zRBGy_D;nhff3R*~V6Q*$Nu;5!fx&~}b|=W6`tunW9Op48G(2KpXmny=XyjsGX>?~`
zsPzaEsh=O<;INlLrh$<`rJ=5YWp^S24=5j5C^9H`Fx>X2^?ZD-xt@W=dL;v+tQP}&
zeP;lJ!#)NckXjFh+nNn^4IK3;w<|mtZp-S=Wl(h7_kTz8e+Gv7m9Hzj|Nrk`VErjT
z$j$Z7e^*#9U|_KR|Nl?Je1;aV`}Z@<Xt>WXrBR+?Nuxc(iiWxd9uJ0FI~(RRbTrg8
z2!you{|jlG{x76`{=blp<^MuD@Ba(wdj8LY;nq}$+ivwX&ud^Q-p#=7u!upRp{_xs
ze#z?!4~AQ%AUC(nXJGMQxRt3tn}HqVpZey<Ah}5WxeW5wdl?uV=KVimnaH5v!O~L0
z!1}{yisJtduyC(wR<788kbwgl_98X&mBC>Ta<}*Y|Dp}`3@qON|3x-1GJxViV)sD?
z4rrJPcrg9XVPO3ZYDc|*nKyxvL1zC#NL<#`LgKL@nV|t>o(F@Vs}3``%#xT;%g|73
z)3vPDrhA!XB7=knOY@6{x&|2!hMNl;>KYV07;esNsB2Jx`159O{Xec{ptyI~!ywU6
z*Ps#ppP|l!;bv+5KW<QY(^LPaYgzeA2L{JQ;P}+>V7M7s{!#(PH}GJ%=~@0#0LC}*
zV7O^n{*nX6xA0)NsagJ#1;)4WV7Mt+{*npCckp1i$yxrA5yp4%V7T$K{3SyJ)IJXn
zh8r*I|8y^_UkpksfA2Qbg2L^uVgn<COha9R&+dirv?$@h^v{HW_1h8TctD8*X!-|*
znfL#{6CrW%=PEP~0#M`N?+XUjZxuwE<yvdUwX9SN?(Yx}1_p&vEx5lUJQx@RO10qr
zj`3i)AqcfU6l#A0n*ABJ3LFfz2EpL6%7a0`fr0hw3qtN`m=8%44f`2d8tNKS8tyYJ
z@L;&U6l6#Jliw8}J3wUxEUkI}|LeoR`gH=)=GHZ2craWCySe@`)I3E70g!p#|Nq!b
zQT+cxznMY4CQG^kRIY&1tixOe9!ux{4?y*leis9ONHT{FC@(wAWe~8)`v1Xt0Rsz2
z%r>Ec!M5{#g3W^i47CX%1~t!R46NU9vw-S`Mjvh#9xet3P(5D5!SJKj%fSL9KGBDp
zMZblCsn*s@q~?{y4_nRm2@d-h4uIquI=MM`SRi`zTN#*Yx&kafWt={!9-habqTkBE
zX!F2<q2{rifx|uq2@eJaj@o1ygIX_XP@9LNrpp@K{-5Z{&7t4Mz~C^C0o(^@)Zu2}
z;e?o5s{wTf4>yAc1A~Ts8v~=mJ_ZGl{V3`*nIUHBa5I4A>=_Vdz~t;1KxXKG<vF<x
zcsQVTa0OV{GB_~QGRuM829lrX$!!2i`xc4}5|DELiv=j`VdaHo0|SF?!U2Z;jqox^
z#{Pi=1E~B5rGFcS28Kqv1_nzX1{RA03=E(?k0k>GL#>yWh@}F9LaiqAvW8a-42@d<
z|Aahc|E1ju_E$>7Dh3wqRt6@=c?>ezkZ=Uij20;jpfGd+rE`lE1`AMFTBI;I)FgX>
z`yb8C3=BLn5dVa-a@f??>KN2N)ibD{`=X+LsWv!lCM*WETmJvkZf9V0+{+l#@QQ&2
z%$~<^!Ep|Qf_6LDUIFcP24=^3j5Qt%j21QvKy?_y7EqWpykubDVTah!u!?~L>Slo&
zRuhAo=iqj%h<+<L9(f>Q8W4M5GJxZxVI>0#4=Y4}4ZDd!&2mWmPk70|Qmd&1_D91?
z1`e2-P<9TR+H@O(n&%cjYL;4n)8mAd3>;v$tYi>?sjFEIm3s+ZbKhdKz=5GA6JlQT
zVg?Q#S%{sXG9dGw7}P9%0yeXLuZ2a;-q&C^PF~Ew(Y%U*Lw_zf9y&mFG=tm=)eG_u
zJRDatK=O<-g8)38szcrIm_fjjgMl%WgU!y#fk7qYB%7UnCj&pIezRy`U;(88i(?Fo
zmR<}3-v9qG==U%&SoSb6IPCj-1yY~XPO({VfWiC!e+RG|IvH4C@meEm0*+6R_+(se
zc&-hq^Fie*xNfsZW?&0RX0Zd66E$;{D?s&}2kWYtptcIAUIL{vhdm5Dpz_~?f%$6q
ze-0Z^-Ru4T{}ZTtIACSh<cADA6Brpp>Yo|46~AO)c3i|DV3ELZ!J>gd!TbOJiRG^t
z44`5UEE*Uby#N2NEq-|bRQG_?eXwX?NbvsuKhsu$!5~rd0CW9I4~tp_<2GA`|K}4m
z?f=xj^00JV#Gn8wODz%@4m3Yx-~r_u3wZhWU&j)(uY#qfhJp3N8koC4?J$c3204ob
z3=GKi5iBn@|7&0XmCYUu%#|S8B7s33q}GFhITOm~g7PDwd~PV;6UrBW@-0Db1BpS)
zc|lOQ43Y!6(Sw0mLc5tk-f=I3h^;~cL#?umK}~{j8>sxSRQ~@UB#Z5zb|;d&W{5$p
z0Yu&+`Tqfs9+3W8%@6~}y$n3H3f5q~wFVFxB<Hx7L8jKps12mHR#V2H*4ewFCJAB&
z*p76#9Wu2>Ms2nX4GgthHU_nt!4<Ve5OpBC;ASaVp{h}W*i|cJ)n@C^z)<UDV^GTp
z(hCuX>qBva2a#?FAi@m+6}4F10MZL_LrB8Ce<8`bTWXS-D?*Y3v{I7o3=)zVok4XR
zs2?{W1ytTB<bd)?4TCy(><JVHSoAq0Br_fc>s!IJY(gqXp9WN)K3pFI>pK_Zv<9ko
zEgmp1fbueWdYh=sz+kDs&;TmmLG=K*4sc*#sO7ZGvv|(HGm(>lWg;g7hZDp97qucm
z%WM^X?@!eH|G$>g!=lzCcv)>2^Rn77?q#sHNuv_T9_AN~nhZL%n$FW|&A6A<nlUe{
zH3?dls>$L2))UXY%=`bJub{jEYI}IFR7QaO%fR}!2ie`S%nUrp?gf<rusqW6uYsXf
z-ASa;lYzt1i-B>XCj&>VyMvy77r5Ud(vZo(QtJuo3$ZAAFffRC|Nr|F)W!$p1rLUE
zkoFH|d*urQ>swIyf#@$e!s|;F`DO+lko}<ccFk<%ike;86`(K!<=2|~5A;B70#Nx>
z-=^T;I1k*8=K!^<>r+8}opXku{!*>|Ba!<0hkBs$YqBQ;3n)MCc4XiH^_{%`|GB`x
z`lbUp3~>41`~P3f#<&IsnR*5uQ2c_zvX)Cqq*hB(Z=wbRiw8>u3#jj3!yqLxft`V&
zfgMx_fY~5%4yZT>B;4O9;Ib3sUyvUgz<tBBt~Ln_YzfIy4HgXy^&SkCwxBTeU^uG_
zvL6zc<vk3nuP;nd{J#R$_OMvM;IMxogAcUt6J!05fdg#rli%R*1NE&u7?wP=RbXJ$
zZ)RYqi50F$)I7xCFqc6B)TRWNsS6mmJeZ#StjUzFm}twuVVTGf0kuzpf%SF56vh8L
zVD{~AWUzqR<pZ<Jx{*Pnc@cvN)Gs_93}-5l%vSJVV0#JbBZAV0#R5=2c1a*e-h*-e
zTZ;w;zD6Zbo3sH`W;52eJ+82Lz`$6O>0M!wz>qOf3DhsNvh9AzpaHI<_Ayw1)Pwqu
zp_(jG5cxBlHEP@ymJSR|AU$*47&JlVS}b5-1exW*V8sg3quu%czr$VzlZGY+mWH|p
ziIA2SI}e7_Uo90F7(x1AdSGstsmP$=!C-k3l%7186;eTTO^k4b2eU#XC@d$`Fi1G=
zW6)`6VvqoZSHr#r84sq5XF+TaW~oYx1O_e-hSRQKJ_CaQ*v|~7V=WRG7%dYSJUm!R
zw=^m-NZ2F@Fw}QSIQZ^mP-sYkwJ~2lfweJflB6p@^%|(Y2G!l5@CVi3&7koEB?guT
zx&LnxH5nK|VF8K*4@NFgkXya~zqRyWOw?_(Yfx#7Yfz}Q^$3`#1uEAdWAHW&Obj-)
z{}?Qi|1c!9urPQqoNu*t_|K5&#h?c&FBfVd+RdSwEOv>S4E!MRjam#0)(aT8EE3cO
zJecmOn(zJpA2fzGc|QZs<oygBllOz#Gw<$tFx*)Q>gQU_XHfBAU<Zu@=vd5W$n#)e
z?`)`RFz{elc+i9CmhFUkP?~UD>cPl&)q~+)p$Eg6pB{_}tsV?akroLIA|6b44?@C_
z*|edq!Nh}MVJ9g39p^DfK+~^)2h$VFM!N=!37HHG4RsAR9t;apYf_{u9h<;o4GtCy
z7#chn<U||l8eBXWPTqvX1*fJ5W8zW|hJU=?|NsACV0}?SL|*mqU^qF`BH{ld4~FlO
z9-xUO))%0@*bP`7v2l3Hkl@76u%8iLzUkCdK*kY3@dI*mjk9ot#R3K!4+iG5&HoyF
zn(G-D^k;+1SB3gaNZAVZ<30us@BjaEt^b4i;{We7Ix$F0bYhV3{{Q!6^S*|FkYon6
zhItJk77G|y>i0?n*zf)SBYZD|n*H2=4Ay^sC)Ce;Trv3(1A|4)?-|o8e+yX0{8pJ<
z`Tx)4n%@Z^vnJOwh)k|$keC?Hz|!c%z%yB%L1tn+gHEFpgFvGa1INU827`(A3??27
zOj8@?HAH~&uSL!8IUWp5tswV<^whWrSJXRSu9z6l5ChUTF`gk|@*)NU4+iE`i^~5$
z>Rm2Z)Gq~%DZF^e!1_FgP#A;i$ws*bmikTy2gkV#3XPr&4E0?Ska4a|P<g;0V5tcX
zmj|G90V*FoSc(d26&RL*#|{-3RX}BLO#;KRkW7}iS_MXxkmUY<ATb8kXI}`}52|xO
z>BIZ~4@poQIP7CkX|!ix(C-At4+pr;MY0RwhQc=ttk0$pGT;0Ek3z5?HBrrMjB8*4
z`K3{dfx!}#pS2hmJXi{6Ft9#zz-1;#J-EC-@JXc6u7RadlYyZo*(1P%r7(ek^%<zX
zg^!aV*LUdpK>5alrBDZEk9ITjb5I)})Gh$E^BwmxD0ndY2U;pHzo<#}o>u?(=QZp9
zj9+T%y{Cc3Up$!oO+j@`qGsCyki4Y=16Tcj?`bv3Kd*u8@?a^r0viv8js?#|9#{2X
zU^)W|$C_H_Wi>U<;BgpGd|531|KFnJ|NkBq21d|a!5mfwMo?J;lG9;jVDN2XPymf@
zTO3AH$Hu_u!1VtMNFCe^R)`r6P5*ybEX8gnTx}`?qfRpe1IXT*1c^Z3HU<U9rvGoi
z<~1Yqg3PK(RtNxz2ei281++BCSsecVM}w7t#j%0GU`iVU3&@QH2N;-Z7HEmo954t7
zS@2;WXkNp~fq@4k@5J!`Pr*_KW)%M%V_=@s#sHeD_yaP#CQZ5mG|pLb#27SQ!czm9
z>u6+H5VHKme~^6^E&u;GHZf>`?Rm+(%%O=Pq~QqzODhWl$Ao7LEK}LQ?aU7aOBvXq
zZWCx>VPLUX`v1=qHU<_HyIUBTEsilTgZw^+4eW*=AU7y5FtC8!-SLEh#iE6QamF(S
z7Eu4yiQ)f;ngtpGAh$R+{a;e^l6jf;|Nku@e$8Pmk(w6pd=j$Td>Wqo|I^Cy|Hp)9
z|Nl&7`~L%E2CCcs|ADye{~u(x^|1W^KZouAf6zPz$W0*k^gQ|hf6g<A7?L}7K;1C|
zq~D>DK?Nn9q%kmp{0E9#M_4*ZfXwGX)ysg@C;$K7!_2@~!=S+6!1VtIC@w+i6l`~{
z)3TZ#r)4#3otD)wYcM!8{r><GujOD`R+BCb>U%$|d14__bC_|8_y7M_Yg#M>YLX2F
z9UA_BsfErZOi}!Q0aS0)HZZ77U}P|v*vKHUKaoKOl<%xt{{OdL!oX^s$iSf|&%gk(
z*Krc0-3A)tw^+a+;K6j)F(jGIZcYsYBS^0KAp=JzQdwpFpMkM{&I<>JdH)YIHZn+9
zCNdb*HZ&@Du;iM+@;W%5&j*hOh<Gr}(gn5CKz;L$dIpAqOi+Gfu<5jCV5~{@uIRL9
zV1m-jP?`lwvw~=lTWXRSE`%iW{{xRpB``2R@_)`12G)lSQxyN70Qncxo~cQduH3(n
zK?l^HnZU?k18UR2$})#02A+m_4ICgd8s;^yfZCd%GTDRac_N4gwf(*S|97-ZWU%mH
z$tkc%`2Qai_6)2KWnlgS*@36b<7vnQm9IG#46F}O#(F_!A?t&=snM=M093w0>j9m{
zxCS0joHTkdFw}Pjfchm8jhYN57Rd~ZAT<v2{=WgqL;Rn8fr0e_$p47`50?2NQ2U^H
zUxPqnECU0mzg6oQT;Z^f!J~Oz1J8t728IbW;P#D(2g8ik=DG$EX#FJ8Fo%JmJ{i;(
zntsxQfx!U8_x}Ie6e9os325H1k(0rsz60z|o?1?4Q2P8Z`6Yu1w2z}O(VjsD<laVG
z1_p4Q&yp>`z<U486vh7=U~vXg3ref|9>U`-1e8`mVPuiO;4ra~K?CfEx&{G|n<rW`
zFif-ojkUgg>%s8#At>&=|NjdGy9+ed^!Rs$2eYSQ^KS+QQ2X9tA9$`o0W@aq!EnIP
zBH{l54~DlJJs23DfaX#_;?|A~5>^ixI6N4pH-g$#76}ZFdJ<qeK<!E$Q2O;?I3Vjd
zi9rQqUp>p=3h)2FG{JW61GfhaCjSAc-+!?l)HZ?4cVsrqYcK(|V=NXhuzCOgeHNtN
zaUVktNZi_<L7-mwG^ou6lG_NCa{!5f%z)~d2^H69sB5r*xMM%4-D^{?a=OBUVL!-y
z4j}a&4Et+Q_5QMKv}Z5?r5ne23?=$=A!DZv^FZ@S3>*#f8YDn%sJh3yD?FH<#DZyt
zX^kNJ9Of~&bjC9X6ncX5szs+ggJ7+vcSUDBgAiz}r!$^G7)pykX;BazstF#C1dX+q
zH2-HX0gd%FS~D=z&-Vb$PlD#?G&~sgt@Zx@Z%v~OB;7&XXW+pwjTLM+Bs{_C50u6r
z>F&o~h}{1d9t@CiI}e7bhLHZyK2r|{1__W~L2&~b8}VykQS|=*zoD^_LBleUApq2O
zfs|1h4GgSzQRe!v<;&)O4Ll8?_H#41eJ0bW3>qJSw4p)mHcJQa7={caA7*$ku-^HB
zTt?JnNTbXjg3>Z54L8~~fXfJwUmWK#Xn@B1K<fw^of%YWS)9T1JD@QJ(0CtoJVXIx
z2dMn;U`c<#z<LMgTn`RAz~h~b$_yHyF-5r9nqa>mo87{|dIwZ~gU5Bj<s8!71858d
zW<I39GX>mV1<kvF!U_~7pm+r3H4g@chK6|!9^U`IbAtToFz^2Z4+e%DQ2J}0*Wlwg
zkAVY}e?jFMsLwqSJa00Evw0s<*)yMk0TgE*43m99<3SDc85q3(f7=N*Z{PnXptRE%
z4=y7?ZFqr3yM_R0oPg>E2@jUEH4Ln`Q;_S1{fZ1SuzCUJ7c{qn(x-w4!yaA_28KDH
zvbm;Gy23hvfx+65fungP14FHicLk_S1m!pH|34vp#(fMT7PSllATdau{dTZ<FN2A7
zH3K8ao%M4)7#!yPKhwOQfdQ1JK>4=OnLz;>zltC~Iqm_cUk2!S1H(j51{qM=2bG=P
z|NrHJ!WU}J0Z>|i)KRH>7+7!NEdR0j(QzKb6c2{((B^#&AvM*~70vS+B0yy`DDE8R
zF$jR&+bIFctDt#p5f6q*g_CO-7(n#|OdV)`3^X<diW5-$fzlLcO#x_3%!6U#oaXru
ze>Tho#o1SIo(7Gxf&2i9^ZGd+4xl)9nD_sV_y7MpAan33KNwhVZb8mN*zzTE{&CpH
zz|m0G5Ch5|9xN$G7+7zD`UCL32`DU)%>b!`g$byyG|>}OSEuxV>UdCJ*Zcoh4hGhn
zp!@}|Pc51mctCRd4>CwV(~gQoA_HVR?7$}x@Bd$}g8N9G3=EBm3>?t46QJ}6ic4mY
z9Z>(NFtFYP<uADVklhAzm-qkQnIN}WIxv9yZ6N&~EXgkzSZ|<|FUWe){KWz3cO`FO
zV7-AdmkwHEfUFN@C#cQg(8RzqAq!N0LDrdo(%pnEQ2c$o3(5x|GaKz1L?*w4wY`!<
z7+7zB@)x4KfUa)<jVZy*Zm4UJ@L-sr+x)LVqox)-b`k@sf4u*HdJ9hX`xty0<~1mQ
z^1Ao`Pd6<c7#N`9YZ~S?s6fRJg7P+0d<sYmG~NN47x7@aG_@uRJl|UbN?+hUu06=z
zzZ4to8gxMIv6^HClaS<_b>9Dft2QKo<bJ<xjB79e^@*YBJ_6JR0gYod+BKNK+hh9}
zEE?uDSb)Z)y#N2(30<>b1Ddx5rFqcYt@r<bIUsw%ZM8Z78@&JjTnUOhP#Y7J{=jjW
z$RGiU$0Ql=|3B}*(zt#L1A|5K|9>F6EnOHGL49IS{5b4k-~jp8)a(C$&{)$_W(KBO
zO(zlW|NlRPDzn&yYPQ(bYD$TOD!15y;=U$RN+cwi#m<8z@c`ETa54j9LFWH|u=PeY
z2@Gl>$@0*#i)#yD?g5wiNNZkTaoA|r;IJT*fgvaJ|9^eZc;`F@4vPf-{~^h&b{Wb1
z|3PjrNCvIzlN1O^X0WnIW)SjVNi<<#y#|`sK%@`k`UJX`qh=3eOde#%;*|^x`7052
zSTErJ4=PVVb-MTekGT!=8eA;u8Q4H#;d@!_y#IfU)Sk=#-(eqvz~=c3pmsAKs2yOb
z(8#cPKLg)Jd$5?$=J^Z)kh#W$84RpfH^BNwApcq{;9vvwji7nk1m@@FeGMKB^BR1b
z=Q1$VH$MioYb`-zy7hmgL@XUR7;0^#^+4{}7|+0D>A=7?GoFD36z?<R8CWgq88|lD
zGq8c&>;3=3*5-K)0W~Vz6&Cdje4w%fRK`wKVc_xp|6wL5?wjixLT1`C2+g!-5T0qz
zATraQL3E})gV;=a2JuF_hKR-(28Kpy1_n^NY@XMUQp*)oQS0tu3F@0S+BL+0#6js8
z6b=n_4GA6$TYW)oE>Il{N{16=7#Kiyg59uyfyJVpL1L;3XsqjlWJ4_jLrwFK0E-p|
z8Snq!L46+s50>~G2G%P$=QUtq)M(cb0<+t3A43VK%<%sIc5P!^Lk1{s)oMxvXm<*C
zILu{;X#Up#&L^P!so%-K0xtjeGJx8&1s)7r=7QQmps)amgYp)rtpaKTdH?^t03-+E
zgUTn697Oz|4Jh4tu*98VV7&~=Q;0Hq0Rt#b;p^sL?rr|pP|`53p#qYg-pe-EHLx_#
zYiO`ozyVrI5dvykH%2osH1A;m)xRLI8c<mSD)YSm{{_XrYyDp-ky=~Hbs)FSv}a(n
zRA7*4jB98C^&vLeGcZ}ygZr2PApcu(GBAS1xHsA}uvjWMFo4p8rNaOJGwm5TKxt{F
zJp<?F{R~_axj<#o&qj-S1_4kX-24B}Qji-h8W^~||Np+)7}wBIlPvMWQh|d3l+Qu)
z{2S^SxGd@!L^j$ph=9h_H}7W<+q|DaVxv8S6v*C<U^9Qu1jjo_uLA=kNbiPv2C@2=
zKLQ%<8hWh%L;7YQ|25h*<bcX3@BgpgHrh30fXaLC|9@_R>MqdSf(J`%1Ow|O&{#IS
zudUz0z`LIjUN73f!nx6|VFE~hqg}(437rfK4s%)7fb#c3P6mct&j0^w*_|uk<;Vm6
z|BZGHGZvg=V8}U%$om!t`2R0dX5i89WPRy4mqBEqGJ}ZqV+JvcmjACnc|2F^|9}0i
zMsPdD`Y{8aMa%zBmJa;?Js22t^jjDN9p<uFgmSRj>38t|cbvzfv(TA=&-yWg&_ZPf
z0gIOZ??Sy;?LuC#+G&I386>p3z~u->$SGF4`Ys0thkeXH^gB7&K<!>o+XZ4@gQ?>@
z#vc7n4hDyP%r`t3m<04&7^EHMGBzxPjE^un>|;K#(4K(_s%A^4Jp+q=Cj*<qKIRpj
z_6)3`wC}Kwc@C&d0L2X`-#YGN?y-(%kN}Ozz}l9ea>D!nn@Vurhqo)3Qx@7Yu<3U)
zFoN1@`kmnQGzA_E%sv)#LFFO`8z{Y6*Msu*FVMPBCQzCKl~bU0EGTVR)H4WK|7YOy
z{{Kc6)Gr04dGG(<SwUqLNFB(2@BeQYLFuo)1yt^RdkHerVkW3P$~2{UUPB1n-Se2P
zH1BJufwc=A=P?}t>9?2<Dd)WZzuwts*N_4lYe%$=m==J_9E<r393cC=|G%EvT-VS5
zYAb^H4b`B$@Vc@2UqcUw4QgY0|NpcSl;1$*8K``iXbWnmFhzjE-f=Iu?>)z20myv}
zbD-hF;xLav0}&?-GKe@~5LgI~6E+sddEhmX3p^MY7Bti~1X#=m&4GLc%{wn?RECVB
zgV)u}2Zh(yhYfWND-iB}1!@;@fXX~j8R)^l@IV`q77i?~XJD#txxwJD2Rx^|1~Q+#
z{-Fm0;}Xy~TBsJAnSK|8gTp??DWRI|cG{f`td4sbJ3wI$$@4#KL2VsqdA`AeVSTL!
z17ikgya3ep1oa;v>El%-sNd7*$iUIa$-q!+<z1oQ0q(DgfYLC?fBIej|2yns)LA^A
zfvtFs{eOohMukp$22Slx@H(V3o%ReO`XKw~F?`VPWZ(exNkM7SVIRYfM!N<MkefjM
zgSEFnYt1|u7<O38g3=oU8)zH^ls>%wzdQ?1L(GROtmQ%V+smDs=QD6^p3lGr9+v=*
znS7a9&wRK7)K~KU|D_k?UyvQ%|G&Kj#WARy1J!}x@@@A2H=E}(h=sKLr~{RC-v7Uy
zw3yAn2T}tr$G~GOA9_6)7<{xl83Y~nF}Q%-Y*Ei3v*131#De(@Vj#CK*v}whaqRyO
z*th_wU)5>PAPUMy&@kQtihB=+b+(q^vA>7}2G+Bn`VT(;R`8O6ala#j0JNQ;0~?>J
z*{xkMp^<^3=9V#dZXDEJvs7o00kvamojuoCDloW$>W7*3;B^}epgJSuFN>X}ErX18
z0|Tf|0M{9y`l4Z8LjWkez~wiz&H&X7pgfFJZwP|w4e$S-13~qLMI$J$e|EL_%fPWY
zo<Rf@mYeGt#6aP?;Xi}K=J^a#-v7T&v`l2sfQB2F2TOPd1M8U;$nBtgh<2Yz&1~gL
zP+4BHO}nDzx^YF#FKd|JMD%C>|6fxh4H`cb0JSZw6aN1P_36R&YV%|8SeCUEs4em0
zVY6L>2Q(coY2Me+04h&FZ3a+%+x(Y-VR9w|q>g?3yJB)DDBpj*TK`{4r0&`7ihB3U
z;CdQVX4M_tT;cuyUn!`ZX_(2tQ15yf)RvN|)%+1)smUNy)8ZxK{r|ZyNFLN~2IWau
z9asP37r4)YsNbIQBI>uVKf!ey1A|BNP6h^$`#^4kr01`mAiL}LN{N8%2Z_Pl<^BKf
z%Z5r&yXi$h%?u?G@Bi;OL3V=1!97^QWI9zC7(ip2pmw!>Cxa5aUB8ck2Q<e4nkO=K
z{r?}7-W?V&Xn@uffabeuT|Cx-#%DomT(!Fxlt6RQ;54Mkz-Y4c|NmNMFA;~P|93$8
zKy9Cy8le7b=otpqQ=s+_yk7|#djietgtEHXf%+5BG%FIy)@BEa*HHFjcA)ixpz$bB
z+p1w+!wyjU3f8vrV7d@clL_vt`E+VBFo5b+OU?fmKx2E_oeZ3gdl^7$Reyl|2rU=5
zK=W@NOh-8z7#Vm%vRLeDor5c2{S8q68e|4Y48%t6qj)eh34-*%)I#<XoZ>-Vj{?q1
z4Ge1g5aaqW)(;pML4E<%&!F+)W+w&)kbfHO8fqHl8bD*)I-vFpD7`h;HJD6{fw$>W
zCPu^A8ql`Skx)$rlZhG(3>Gih7#igoPE2?KV)HOec)`G8@luGvQd0uN=9s9#z|&~g
zaHdhNp#i1`)RqF-<^BKlTJQhwN<sCi_y4!xu_4gfM^GK-!NAm0|MG=_H3I`<p%$aC
z^#cY5-v$PTLM<kaP_6s_^tc!pd>KG_;Q35YJ!sJkuGd_=|34{hj%#3OTExIGSqfC|
zRnBbs*KnbxOuC}kuEC|z95e<79<M0?*I`pZYbD=<)-+u4U})It!L-v5)JFid#~SJy
zZg?;>Ec9U7DGTaXK*jEOFf{afFzw`Qv};%b6?@?Q|6gpQUBiqGkhKp_y#N361-0QO
zU1wkbiD}Pe;B=hJc)+2LA;h7JLBVkn;}-BZ2z34#G{4<Y*8m!;EdiMeDu<!<3TR)+
z8xIDC7;xQ%P!AIS;K9J)(lD>#3#h&Tg@gD1C*bjKhkcA8-v6I%)NlU(AGAjdlsCX-
z%RKPd{vQv96_KEJVMATR4-bYFzTW@;^)%EqGI%ho$n^gIJ{BaWJ(q#mVIQN92LnfD
zqg|r}DDJ)gzuM}-u;OD)xpbxDA_fuf|1V!Q)HTX@FsuOWi@M?c|I^=Qy9S;{OGtab
zaUO#OD6f0}e{d8uF47p+AOi9msISwI1&#~QUK<gR`bj?-7+`fyqZL>`GpH>IY6CjX
zW2gbO-yG)sZ<s6tiuZpU&HoxDK<ypSxPaq6hJc2;Mg`E=u=PUFyu|W_4WRMEd5z#P
z5f7#_Ya8ksH9&J#9t?GwjdqPX4N$p;l?)6XOlNu<>KYB8@|@oPUxM~4fYzrsfW{9!
z7#J$F=Q1!(mSzBrpUO1aHFAK$0~9A9+Jk}Ns`vkYcO2&YJJV>_$N~~W$nkP||NnPD
zdoBa3!@hqzy#K%P1;t52T_cYN!?K?Z^BM&pV<vA~8|oTGy#K%T^#1=T5fmqljo|V4
zh}ve*d||*F2G-*tpmGvamVo->$mJC%e}nQgWG!3mOVIe0V-tf)C!}qb2O4_@r8!Fn
z24+xs2+D&VECG8!Wg4hF1N9R@Wts;ATLlB_u{W@_PhfkH#v)+$fZ7hAJxC3m3=E)h
z8q|03U|6QvJg)(~KDS|BgGj>C22)V~5L6#{|9`Iv>c>I)gwlGT{uyXa1=J6;RA6A6
z39iE#SZ3NYuv#iGFoWuG(AWSZT|bx$8V7@o33&g1&<oNFk^{BTz5hR`ZKwgY8NmHT
ziJA5clAwP2OnU|?P+xtfJ%hCO|F>H~V`ml#!X4iK-$+8or&M->+9Mpy%OK-Zug@^B
z9{oTlj6r?}rDIUqbO5axt838kU|7nE9+uw!-v}V=e7zJ?{@)x1)}x@c(^$uSkiwdw
z8C>VTZ3V@lMKXg7Xw7T=9w~5svef+lU%Qim#c?j9NTXZ>N2sQNRjr1HUM;7SNG&IH
z?m~fqv0+{V4`?jL`Y!_$sO{tZ|DGx+4!!^1+t>h#w`2xJP@4iO#|er<&=?Y=4|Mlu
zqg{gxDBMBvpnL;fi?Y;vng`QKUyzvh|9hbESQXIxE6Cp<vq0_y^;bdikTJ-UiZ%68
zA~k;{0z4QPQY;l1SS%heuz=jvXxE^zP?Ldaqb&oI2LpqLr2+$}ucZT$1E&dF1||#e
zo~XOI77rMNJs22NplS@DYQTD-YCJ6-fX9R^pmA*iN~?`_4K|>34st)Jj0VMj!$}4P
zNc?}3VPHK1n!kp(W%nyW_MuH+WY9s14+l{E*SB~uIP7EE02&(sjUj>B$e^{cAUnYF
ztzh{H+Ms<hbD268Dl;(D+%X2Ptp&A-t=0bjgY+kuK>Z3fXg`(NVINbB2LnR^$Zyt*
z8JIwGxXO<i*g)n^0L`n|zY?kMJmKIl2R!EL0?A)@PJ+w$eGD=dwG14vwuT4Oo`sEe
z4IZF+2sFRw{r~@w21W**-HPBnl^US1@c#d|L3<_xqr+UrCkvGsn40%BXn^V;P~XvE
zAA>_<T!T+TT|)?{-3=O(f{y)qG{!XqEa(L7n_*xGX=#uHwJky8;2|xkb{-6iWI^?l
zCFlSDmJSSDwI0FKWW5-;>N~*uB|&=-lsy<0t^~E^EFGA-YCS>nOkL190Z{!G;lZ$Q
zBPd)$HQ9H7!WL9FgZeF&4h&3<at%J9wn<}LgAJ%ZJlPA>_F`ZFZPL|lVPI^OYX|_9
zaUi}UWR5fev~JOZf#FS~ECU0mpAB-0<2;5B6FI?pxj_AI>pB1bG|X$r0O<v%_e@ZI
z^ZaFVU4uuXEdztad<GVfzw28cS1hOotrPqIzgF4v8mK;NjBCgNjWvVV^?STTKx56`
z|8GBRjB6+Wg<XB;3s9VKOkM>t^AGQW+YAi#a||3D_Aul$)HRfNFf0I#-7|YIFqkyd
zHPnFYTCg9K7ZzLu^~s_6oDsAZtf8)<!GmGJMDPEPQbA*>jdl$cAUA`;v!Sk`#e-o%
zDP}xBZvgdeJXpLoFt8pZIKKiKO9QzZ9_MilDbTeR4A63~$Ae)3FJ`&+9JIf3f(OI=
zkKizz*N_34Tk!t>Y$2xF-z*HQ2SEKRym_vnu3?G?L%AR*jf2`Vi1fW{BWQgsD1A57
zHO%l}D0|yHuR#W?P6SC^CwT3~90msM7Ut)meIX5X4Rbsg=9hxXG0=EPb6vxdM!SXu
z&HEZGx~-vO$Z-uT^k*_KfaX5I`C%S|N23%2L&Lm=4Gnb-YeLzM*@d#V*@d#Q*@ber
z*?BM>acr2^um)P*HF*EOakrtaVGC&NXtq6QUHN=g4+e%1@YqiSgOvx<`revK=}L!1
z3^E`+pneo+t*rO|8%rVT88kp@J($)_wV27k2%1|2$%E8-|G&`)>fg+?XQ=o7|M)AU
zUD2?^gJIsnhPsA5p!N)?|L4IlZ(_r|h69Z%;C2;g9MGiEuHgu190WQBq5^7jf!4f$
z_dak1Sb*nfAY(o!JQ(H$Le>t<1&#Nd0r|y)VV-UCzlIA7<})xr+hCym(pN%SJajx5
z<|%^28}>Ea0JZ<XVoXa+L1uv3@*WIxL2(93^LIdHvIoQ5j}3JV4?Gy=9&EI0cmm3Q
zp!yt?M?rZKl&-!1KS>3(k-h&v(FB!)mJSTyb=@F2P(QZOuAu|k?qUIndH=r_XsN&h
z-s@MZ>^%+CR*==?VW`QJ0FCE5SR}JBfZFe%ItR3-8Kl?y|Mi2QJOe5(EghH`KxHJT
zeB9^>t{*hK|Nn?!VBNPszlFiYXC8xsb}NH3m~LZu?K77_0o2w4l~tg83hn<fg4UFG
zDudS}F@n@~Duc#58Q4JVDT@COz}j-4F{*tJ;dAaTp!%Uf?*9r<dlpo_gUSL>-2rOj
zdH=uO3z{nfhYxJLa~{(a&>mrn`3#`;7mIa0sC|ANyk;JnrdYiHUk?S1ErQB+$9>@O
zHWnl~(E4p2P&hTzHE>wRGvt8c#-atZ7Uw#6{L}mYwa(_c1_5y1+Q%RQN|&IqDNuU!
z{{O+U(;Aw-AmyzH$ZQXWqMcCpzXAEt`~S6zAUD`LBsV2`1t){bd&hYUDxh=%%B$Z0
zAJszUL5o#EZCHmzjB`8~7`IseXZT>v09qUKNW|I!L_ctF*z+GWCdZ)N$?)HC-~R(3
ze_7Xq#(NnPI`%U#TBkBF)z{w=sh|D8!ErC6Ph(tzOwC^Hip^XM44|<^{Z0lR$9W6|
z+8}x^gNlA9Xs;!M1!xQ!)OP{ZIS%_6L38^G;IZ;f20_Pp3_bdt3>uE}7(jIrufslu
zFQEJkS{nr#;{mO=M;Z^kVKJY93F7aoH$4~_PBhy!=yX~#Fw~o$t^m2$VIRX5{Z<Bf
zhrJ9lKx^_F=7HANGc<tq@PfuuLFGPZpQ(N;1B=5xhK@#i1}4z@e-F@*id};Rnpqk8
ztqk@Kdl^9WwSmO}28V`u4WRwU_8ttgKx2O<&2|kAXnIVb_Jhi71Ms-y0S3_eFL@7!
zS&^W1P9Q&k);@XvzbaZE`Ep%-{cX?~Qv)cy>vuAM`WB$I&mN$@1t{-<!omChFGI^j
z1_uuo7aIoF-JrD!7hq|9zaxAe!~`_1ht#eL0JSrq>5dW7r<i%QIj$iBlr}6Du)b^l
z#lQe5`>u#K%xj1Nk3l{DUE%%z(NS>!;=hy#C@syjXOOYp&mc3?o<SDczmS8LmGa*I
zFPVbMe9$^+&^+Jt76uVe9Brs)P_d|I(D43$MHea#&Px{c3_9NbuSi10KzRf-FKFQX
z{|YNq3^YCu5;O7sfB9qcyoLl&KC-B1umFvddH=tB7u>#Hz|de(&(Puh|1Gbj0z>jl
zdqxgRhyP78?HRctW0s7dd0B=|8wRGC@r<074h+FF;~BX^wGQxg+AuIT*EKMNYBtD$
z*OtXFu-0k?S9IDiu!L$l=z+vQ?L_bY7b8J!CQ#l3`3bZqc|tV<gGD`PtmAShsGPTW
z!0^#x0fV!}0R|UPSk|w65n$2q|9|~nD-rMiuPhtpHKbT1aPRQ`e-BhHXL$d=x3!^)
zfdN#Xc>jNp3mLm}DqvvUi87Xktv?Ft2ZP$eNPVRo4~FSCG1~$6K;?c4q<?m=5>x&!
zXuf_!Z3BZEC>?>;2v1;S2-*9PfoEbP0|)4=8R#B05l}e^+P`MS02%{g5U7=LuBa)H
z29M3!DZEdxRAAspGGynNX$abj!?p&rRvt9=0NPvAX^7Z!Q>ewj2pXdX?GLm_U|{oL
zVA7}+b*`{wc%J|s@BMCF0b2i<$idDI)~kWgo2bcf05s-U!@#!2R^fd@q9!}*Oize?
zGdlnO2Z`G?yic%mc%NXG@IFD08QcbC0M(D6`O%~)><mdk>}*NJ?40#;A22x1V+;VV
z&z#5TQD6HYKz}v^i^E(74(kL47E9~@{}a7H^QUTNpml`~lNfmFXKetjhZU%ey(LoL
z1=7#Jk*LYQqC0_s!Lg5lCs7mBu4J$P?Rf$1owST*U_@I>Ayf0~l}OEVhjlZ)K->-5
zOAXqKJktouf4~p`@^?2V%p@WEx<Pfk2h+-l#hMJP;CYjI3_Paq!TXbL6l*fDI5siZ
zfb?`4Bf_dsi-D#70fSojfBAofS`19e{~4G-XXjWyU|<HtfkPAMTn7f3VomV+$~lgG
z3<AYk3<?fS3@+9W7+67mt>1e~1T^;PFz??LP<T1a`*)^p&+3YLfx{JbzjjwRP6DqJ
z;Q)oL_y2zzK<VCt0ld$S(SvElLy%r@SXe{DL4kqMRP+CT$3_3a=R|dULF~7$m3k#o
z^CEB^Xm6(X|NnQaAAt7;)mT3O)s_EC8XLiT_yTGhLE|>|G7PNSRglkosadIA0V>at
z*Ga+3K!?5HdYPkU31|=h6i}V91hkL8CR@6q=9F<ot-N!E!(0Z1kPbJy8I26wGZ`5;
zLONRPW->BxhIAYP(OjT$@sJlRcHlX!4)B;2s1D=tV3^Vg9Y5EoS;-L){+P|qVkrYp
zXbPWAs2ZDHt$T2V_y0e0LF>XD7cm$#DlvfjfuJ#VNZJF>*Rz1i_l9{5pnYBf9t=}V
zL1u#HzCmYYd9c`J!2AkI_n^LCq9!}Xen$ol&|C=UY#vxXuykPPpXmu&+t0SfJ^`FB
z8I!Bo`Da=~(wF^%_X)}W*#*Gq1?db4&^#b?AAbh8Ooytsb$FkU=*7-56THWcZ4D@X
zkl3s+_Dn5^ogU1JmY}wyrSkv(HVF(f5|XDi)M`pk1J%op^B6K}wY)1l7#Kk11rKOW
z3Y2H99T-wT?&;pozyLeTAbb_OUHD2iJJ5L_j{E)>WNL!Pu^2$=LHQwkFPohQ)3Vyx
z`yu`^j{@h1J>LKSyMV$dQInkq7A7D+fc%u`#m<ZFUP}dr53sNS>9cfTIFP8x&JNQH
za#trO0|V?V4VwoHY>8Y9!U@l%>g(rNFgVU-;7H_RV1}uOn!%8$$<7871I42Uiw$TG
z6?jYv<d%>WJ{!>34QT$SMx7gcZoyo21`g2trX>Rdqxb(`nV>NiL*@VfYceGTKy7Bw
zcnWC#0wVtxeAa^Z|37~kl^Jb7WvyQWi$bF^qXQD#1&Qr}#P&gA2f)}2teZjmGvV_%
zIO-m7KOdAIKw~SQwfvy|D`;&P==?I!I4GzO;K5?Og@JW5$j^k$gO0(2+N_P93@r7{
z0Su0N{=aGTWZ(d^=l*{HI?D`{M?mcmkR2W@)}V1)aCm~wC;`pGge14wf!6-j%u%kW
z*$+M^q7~e(p2wg93QJI33mRjnfA+fqG)4srQ_xs4sI356qXkNn;PGh|EBJUV9`jX+
zG(QJs{ziMyo|pgsJy@(jd)EoL|KCv}&6j|g4_co9bw6m|8^Zj0=?awa*$WDvf2k<u
zgZ5XqKCY-=_8KjG{vH8^4a8ha&>B}l=JFD0ZUvILHL&q<aCl>N@87LNnhQEdLjvkv
z6$aLgJjnaK_br6?34Lm+AbVJArYS?t2UBF=vSwu9uzJYA1L_xo`h=iyV*NSbbqyDq
zYZy2hZ5UYUXL~R>&SBVLwVQ!4yuLv$Y-@vD{rnXS4s#gh6u)F=a99M{rvci3UH5c%
zh4=rzq1_7^c*6HG7=X(z1_mC`dUVHm3@M;?c)jXr@O-oP|G&MUdeowUfvKJqw8!Ib
z?LtNdt_2SnIO@GFSAfQjpk=8}eTRnwXuW$QsIG4Zjf*k}=uZQ!cVaNGy7vFSr59*!
z{{IE*|BRsXR#L31|NjS-kIi#HV`cvhz~RHd0A6DO*}H9ihk<qd143i<pmro^%p5ew
z0m?(5{0_>W6FM1KKy@r=-oyL<Kkzzci)ID`P&)urS2ZtYGywV8vKHJPP_ay4U<9p&
zXkcMrsFAg*DBjNiY8y&`>KKa_1`X3}aG4I;=TlN6?_lY$=>Lo6mj5rBm;8TIKS#sC
zaqs^d^>Z{pdp&sS=Nf?cCz@UU|7cG6|EIqCg-CtWLy`Jf8le5QAR4p=entIk0|$q>
z{};%5fz~4giGbF@gUXbeQ$`{+cMSq2oCLRTLF;N5VdpG>%3KE4btjP5D}c&y<UUtT
zjdUfby)h9qc5vX6hy&!jGte4^0PBYg9F`1>4D~O6SJd2wj#dA)2KDzIg46Rp27~(M
z#}%M)rTVnn74^$sSAg1&Aobq=|AF_NI6}_D6Y*f^{@9QRZVMTBu$VbCBr}?T&6vl~
z)94J@U*$NDp#ik+2Gmxm@6rIJk&H%X1{Q>v0Z1&Q(V2k*A*KKlb7*vC;6aF4fW&kf
zof!lWVxYBY3=)mb3?d*g-+2rQ^<5qgAlf1s)X)200t!z^n5}JTR0j2>8ss43`V62w
z<+$pD2cY~08K+391+AF|mGhu=(;h6Q889;&k|F0R)U-%d)U+^|gtXkO%V=g`gxUvc
z6T;7t0QGD3IWj0f*B``$%x{nb#Sy5knApf51F9!Ldn=NE{Rhw8TPrf~TQf57SUqIm
zvO37XVYQHfuYUdo28TI};B}awF*@)6{|!Om?J$oqA^gknIz15v2FFPZJfL>2<2*(m
zkQ$2x41D!!rz=2XG~WMzK*o!n{06N}VW?*V<>?=>3mqAFEWQ5!5A|ZP)9(8J*KsbR
zfWssPf$l^G{_tuBgYarLJE&Pqb)fYq;I&3SRH0&Ab;mY?%@6<7X6OC?2k(M~3_J@O
z892f}ulu*)AOjc3?mG9$6?GZ2E9yEIgUX+q;5KLzgHEF=g9Jz(WEQmUS8TLpOabkS
zaG1lO0@`B&%9k)T9t<3=^>ZY^<LsdJW}_`5Xgmir<|zVG12YH4_x}G6yg$cr9|L&L
z7-(O8-LlnSH+%p89tb*9aKS+ao;sJw6$>6RaMh*Gu2{&(z|pD5z~{lxX$mQ`{<SnV
zGRT0=?f~Tv$o?r~P`w6DL!fmn;C-I;(iNce-Kfl%Qs3nPItPSfqBCO(s2ufRVABMZ
zR}J$ae9)OopfU?mM*Y3w!SwwFDBpn6X|0DhXv~-gR9;ys2rx`^W>A=@%mChZZ|L^_
zf2}Ixm0C6LibiGzg+^rt6;RvWQ1k!)S`Nl5HK&{_YF>L+7-lmt)_O5c0qaeM=mnLD
zHAjsrYSO@KTEKIYjcg1GjcN=kpt{a@>Hq)rEsR%SX4Q8&S2VIQFx0R1u4q(aU};EW
z5P+FmtEnMS%b_Sxs~I6u%MmD2-|XPvIETTazS#jZk1o*2#vlT!7aZp>sMIWt5UFVi
z6q(S*pa9B06P7WkOmt^pn3xVeZ$QG*;s1Zjg#Z6RVxYPJBo1m9Stvrz>%b-t%4bs)
z|2Kg07HG@>R1WSv$Y4=(*|-99UdhBp29pVl3@tUgwJWBoF@VQ_YCc(4fbtyZ49i+U
z&>qdNnT?7JBG%OmEP6r=4B^!RR@My+0->4=7LyYhG(df7D@F#1iHZy&mY}lpAcH`o
zB7+7jZPm~50Od&^P+QL80H{v;Y73WZeOyt;)?DHJ|0`>wB7+2^u4I%bRA*qcjsf?T
zH9|ERtUzaa*J^tFs8jB)2sLN11C;~D<_wJWVvJKj<A9-B>^0h5;PF8ZP(A^b%^<r#
z_IUsQau!6x#A}ZggZ5}KdjJ125oBjmBZEMwDTA4^DFZ{j2;&6M{;^O^1~c$jt0uz*
zkX?1jvqAl5kw!-bi9%2CSPMs;^W+LpoewHIYM)nw@+@rrF{0rh<P0;govomCv0psF
zWe#X>DQNB7;@1^mIoHb-^)Z(#y#IgE1ep!$D}chf&>h^*=dfg8V5;Txt^kFt^&C(i
z``?O&gOGUg{{Q(a$P9}G3_KPG7&t(F^#1=Dd{zupoY&$2LxcDK&s!TC8B8n_85$sY
zQXjNd5xg!NwCCC4AOi<zuN!E*y=JF2sN7=#?SpQ1W(;XgW{hcWW{mLu|2ehcJ_Aer
z%C-VfyWC;{WDj`FF^_<dV{CSy^@U*hC9gsHB|&+)=GY0CoGFM8)hA_ffZ@OQ|Idp0
zv%qaM3()!}P~Xbt0O-t?Kb{S@AZ;<IdWDc<EoPu~HJ~wb(3lOV&IX6&JO&%k_&btb
z-iF&KdR3r$4<hRYjblU2R<SrB03A#HG#AN@YM_3d_y13w&~~H`s5}GN15)q(|M${{
zI}G46RYB{BLHa_D9Rs=1cL7NJ@$U+#`3BzqKe<BfW(2vr0TlNLd6tA@pg8>mI$z1c
zgGCQC?+)IV02(6zwZXt~GFQ2x;V=UWEIw+EX#`j-V2}cZJ0xyCUd0}kzy3BxF(@=v
zp@fN&VfO$3wO))@LepA6dt#PC!_opZEPowrjAl@1tVYqRhNd?Y8a_Fw;q$AtF@`~*
zu?7-GpzyI+z#xmz3ks``il9A#Aax*lm|9R-4{paTU@$_cZ?Usb1dZK(_yOsg>%jN6
zfyy&by#ng{g2HN|GGj<1Go!&oWyT0gWd;e*+@7Texc#aD8s`Ab4L5Q!NN9I}=13S6
z9Op1ZXm^0uG51(%GH953f!na4{iiz`{xe4Cw}aEDP9rCSK*Mncf%*;uQ2SJ-zQcgQ
zVc-7?jhqZ34bMSkxP^nm-v0+C+Jo}Se~{h~0(z&Q>1~;4&luwU|9?%xf5sRBdLz*E
zdQ7xui~*g|*ig?H0&4Go_RM<!|8cXSo-qcAf3l&TF#^h$0M)agJ^`q11%<o!{~s$r
zZ8#4WZTMWY1?Y?=Q2EfvATfcFK?fAZpt2!k4yYaT-gTiO1BZSmcx}9kHi+KKAfVsL
z$mqC_VU7m_!vp<JHui@5j3FRDHOezaIL>2Oqu<G`;4qKj2q@m6`Gn1bf#FP}J*3VD
zsRxOJ^jIulU;@p(gY-_cXH4<_|I@T#KSUi!jrafGmaw*h_y4b3>zf}i)TByRILu+-
z0M$1zJG}q@S=l_FF~x&{Ap<66v4DZo;vi_x%)7!)MFy@yP4IpT2FHC2pmR+j`}QH_
z8H4x#AA3RW1Gxp{4p2G*yYuny3XnTNZUMOwH0R;{{|9*eG$>DauxN!aur7*0?xTUu
zI0LQIt5xyFy5}1dFQ7GSptu3W3n+d(80s%Dur3lo?iWvBWboO)kiiDjUIxvPg4)WU
z^SGexat_eiK=1$mJ3-|#XpIx7`~uCvcretrg7)Dy%m?>3GeK?mhWViN_y1!-?YxHh
zpmO*>sLiL)FdsCB`rj2ax7PsP@9^IeG{4s{AGBusziz{P1|3kn<H0mZv0+|=0VwPn
z>Kb%B80r-p<}(<8<g6DmXm~J90<FC=L6QgYEkN?#|930|(H;z8rl2;j!y*QbhJ6j7
z^U-WT;p)LqceP<&1L*uLMzA`j#Sg(WLl`SaJ?N}0m>#J5rJz0M7V|-8dewo>zxHUD
z4>~`pt`{^v+|a~e;Qjw!A*c@xYG-+{Xlwz+38+mBS_chk|AEHl7+4p8&S?UVoq*N=
zg3b>Hwf{ij4Ia1Js|`Qn8?>*)gQ3C|w9Xi`zo6#6F{mCCXsKsl0gV@UFwKw!wZ%d4
z3Yrh|V5noXnEU^K{nOtSpmgH>|9>NB?E+~0u>PeaXkR&t2Se>$(0B_dy?U@{@G!70
z$eE(}4_rTh+_T@2kptouMio%pL*t#ngCPX8{)3@WiGc+)ui)6kFawn5LHoBs=>#<2
z3p&rlgQ@>xO+C1c>tfNspiuw&M}P-YAEWhu1`g0T3uyif6wV+wdjH=pSyTH<1XRy}
z=DQvCF__dp{3S9w9<<h!K?kPR`~NmjTtV9++j&9rwjjGe=6L_#wiD!6NE`((wM=AG
z@L*BbVPKu#6Ozf6@34pgG)4&SD}en6sw*L9*^4yD{eRK?j3EK)M;=i7#)F||uSEg_
zzX!uAQP4i!`j_B!eu|(n3^Y#b!J-B_n+w|4oUZ}312i@dZu@}kK&%nB0gXX|>;Z)l
z$h{5Ap!Usc5b$7H2;Nf<N-v=J1eHq`2f=M#iOCB=dx?ZTg7$(y?M(sEptd&y>%0w6
zdqI1j7l7K}V0#ZTL_p$>A;lVUUg8T-JfqsV0JPRb1mf4AQY5<>K<yI`24PUUApvBU
z2aD<#5Dm4{25e^&BdGrlUtfW;w&J!iDDA!g`MGA6az&>agAyogo7uqY7r=X+K<!`9
z`a;nD8;b@8MvH|EJfOCs2g9tlpf(M-t-kO79sOAhOb&Ay8bIg6f##O#fBvqpZeU<)
zsbpZWo&y>i-x^v!=K=$0O(bZ4gu}f5FF@gItpJ*TYt{wn0p$&=2Mh|JGx%$2UWr&+
zg7j_a1f752{eP=y{mcstAia+B7<BY!GB7#r`+uYE&&zet^?YYQ`O1SK@GEFs2UHd`
z&ufrq{>_j8D$gL{S2YomR+hg6?Lh*km$t_h4f`4-kkX9<C=5MVRC+)(BrNBE+8T)T
zg0z3JR>~O^h95wC<v`<UH8UXN*foEx!TVooqk}7&8yOrX90cW&IliF01Ipu|ad_=n
z;PwY-{pW)ExhFv5HUg0I`YT_8>z29(6%U5WyA2B=?Rt<OYz~0N-ymTRDuY31po8YS
zJs2u`LFZ*a%H7J9ps=-RU}OO0TX1|aHG|J+aoh*K&%wa@!T<jr43&}Kw%a}i(78pw
zJQ$W;1g%8{#Vf*G@Erjrp!{zA;QwC_hDy-c8V(@4Js2t_q547d_3R!D%O=*(J>X#d
zfB`h7Dg&N>e|bWn{{K&b`v1Rog#TyXWBvdCKTsY4rE?D!WgQ0A*>jM`==Ooea3T5K
z1hmf^RHj)hU^J*Hm#zS%QBb}EjmLr0>AwaGkU7@-876rD-^>fD13VaJJe*L^&;jzl
z2UBaJ2g6KJP~3Ph%uEH<JM}7%F&+=5)<UovW<gyr&D3G3KZk+QaV`Vs90mu_xgDVO
z{|(iUvKw;7)udQZpBR)bJQ$WP1?yv&a}(75oM_Jw0+O3(&kz8yZ%(a#Gw8kuMh{Ru
z1S#(-1VL*jo8=iga<$Z1^}8g)K<i{1>KZ&e7|PFr`tu$Pj2adRpgghE6=ME0==mk!
z`A{DZhVrEr3IG3jFffA7;bQh+SSkxqH>*;A2DqJS0@~Bz!BAcc5ubJuRPH-K);WcE
zFqHRNB!J?P;Q%BK%R?;^Kw}F_u6E32kkxJh-Fv}!#3F%#)q`Ql!A@HSInbU1$9dp0
zfk0(~0AxK7s4iuY0oehH6N~)}0T%ZeLOd9zT?O^6ENvM;=XC@$+A{Ef!Ui0cbqx^>
z(?Mgk<(w7?|9^WhFxXhsGq8Zd26TR`_y3JsL2Fk)YYZmuX8@i3<l@1w#1=HJ1v;|>
zqPGkbPE$M>mZ(}QFfcUQGlYQ3AP2};YXWGG2xuRO2g9ttpzsI93HV$hO9r`__6)I|
zkqq)P;~8Q)B^hL9$}_|@Ml$f!Mh1ykdNDXmjA!s^jARg)7|#&V7|-AWnlA(G7XbMO
zbgzO3Lz$-a0#N>A*wPr!AYrNb{~zd#$wDoLzYdESYCvZUHGuC*U`WvJ0PS;N$f$3A
zTmh~ZpZ>0}IKaSe@t+~ZQl25hgJBlz>?Y6}-yDz~pgu6DT>#qq37YS+_|K4IDbG;g
z!7$$v6o=6Dy9FK$r3*bkXKU3n<ajVh?gfR}WP1jWiS`UVpmG#6cF_P{M_ankBH{lZ
z@BjZm=eUF0VIC~<TOeiH3>D;d<o-kk6KGxJ18O6H@*QaG2b2db7BFx$q%pA6+=c8{
z1nt}NV91LEtxI!kVsK~#?YZV;V075UAOq?@g32k2J^%k(+y(V(|EPlYJU9PquxN~D
z=mCxOIqm`Pzp3$HC}jkx_h85ugybp47ofE~pnXyk<H768I6C7Q;zGRytm-oY^c?3g
z%7D%qho;8_&{`VDc??S&b}_E;U|^i1-^rlhIFHc*)DF|{WDs!N$H?Qsz&Js_lfePJ
zZlsf;!C@X_gZKY6h2H=F{RM~h($^KBum+uVYLURu06GK8gMkrrE)YYfJVQ*UJwxn7
zM+Oc{M+Sk0dInG%(x+iRLqNlQhLDE;3=!V{f4&5rQR1+O5!6nOu&8I4(6Ep}0CYc=
z2UC-v2LmHV!+wSgu=sq26pQ-|B^Lh~D!}p#vz|iqGCXP6&ro9B$N<_WAplA<9!xVC
zLF<=6ZuDUAss**#8}>7R+ld}bGoCioHFQAb5<M6gmUu8s(Y4smkOQh)EbcQDfb8>N
zn0*zL{yi8NT0ra8ED{(5Kzd;Q1^E?ZzvCi?l!m&79uEeF0H`_z9O`Tu>KZ11?!17i
zbHJevw9aCR2Sc$UX#N+JCPC!{hz)ALfZE(1EV4EXtW!bfh``%JpmG%4zGh@_fTqP1
z(7GaUTAT?viyKt-PgG<u0G0m^a~T3a>C&PRyw+2|gQ;h4qauR<X#XLoOaPTx+MNtm
zp#90(oeav3`xq2J?HF(!02*^k1Fhft^B2_a@L*tKz?A!$3293(KJfm(3bfAG0yKUA
z3RASSVSqhtd_N1yBMuD=HK09cj`J8C^qc?xbJ)ia&}h%#0(GNIr#*ubC@nkeV+et)
z-7Y)`+V=rjmtDBkBH@3(2g7_*boY5M{rn1QC+Ii-|LZW1K>{>S=LkNhcV(kR!vCKh
z3=A(C<}<+3qyae1G1b?C(lodXpT|&uq{p|Ru3>=(g9mKB)}~=z!xHcRt1Cfej|1p@
z>3I#Hb+`fz`x!z&@d;Y9=)p8C614ssREB#nxP!|69gX%32^LlV|69xk-Jt<#kAwEh
zTO@$mK=X1t?HS@g`#nHsF?s+0YzpEx#)0-m3Ru;5dFX-K6rjEZ!fh)ycGNS(c`!_B
z?by!{2TJ1&bqyOl7zz$rB!KRbn+H1o*v9++Z%t4;1y+96cQQlIZ)H)mNcjI9w7wcM
z41a92ZUCQyodC{vEK)N%of#M`z5ZVa^<)F>v*&c2%U}Rny9}zI!FyUY*zB}B7&v|B
zGAMxda)8owt(KR_L>0)nogj6fG8WdZ0nIsr%2JC420hT(nxORK!PGDpRL+9J(fj`@
zOVIcmC>=V^WAFjx1M6r8M$j6UTB{cU_03))`g0hV9Of|`fU4&N?coNg2h|zg|NjSq
z<7ghk0#Mrxw4MNz*CvC`qMO6O1KKMB-U|cX_x&Hd{=s1$Ly1K#1D8c3xX%yXPv9_*
zApxXc){`NnQIUZM>?eB$5l}s?KZk(}6eo@L3?kME3@I@4>N9U&^Zx%2(#Dv_pa9Y@
zU(JwGU+pCVI@8&D&i^0Ua~N10_A>BTF95YU8BT!et6G}}2F0BWqK=FHzp)1Gs{@UN
zgU^om2VVc-u<!pBkXhih$$S5wm}t)+U{MP?BLOsy{x1>i-+li#G}<!=fX*_=)MQ`+
z&&6nZg61S_EHxSA!FA2v|2-4q8F)Z@p+IGo_y2zo|L^->0ySUUaqs_(iS`T}7PSm)
zP&JI8a?xSY{{W~OYsbC+T_)Nyuz=c|9?V}3g4TY5;=+SPqJV*QB52JF{A_w~8HRK|
zJ*fNwl~<1Q7+S#VnddRw0hL>z^_if4vG@NKqG12b1Gn)wJQ#8hdNBW33tCTY4Q=~-
zFn==y_0t`i7%UoUAZ;e^|9=;P^g-vDL3gi$$5K3)zrp6HLFF)LJ{xrAnTQ8NZl*;d
z1BVCm*QX$}K=-16#(+E+asxqSf1@IULPH~iOv6G33GGe>Hqaac=p2>CxCRN(Ub>oB
z9(tg3)$k9z=1r!N5j@Ak0}6i+hFnun`^SSJ9X$R4D&xUn#UdUtMe#p)PYY=55VVgB
z)IJ7{AA;Hz^)5!B^u$m<_X23HGNJzOg#geRGVS>c4T_qK;CVso2Mi7M^F16u>pW}i
zy(_|39<l?KH?@#+Fd0E-y@Jll2i+Iv{r?tt?=NWV(>eik=Ik$#`n|tE=U^=W?fC(>
zH(11WV0F`c<q8xx%?G<FCj2jZU9J6v0Oh?59QAXd?y&W)2!DA9Jl~7qj^&^;#&1c2
z<7OUsZ7L&ZZ)^RWS0eTQUx|1y)mM7||GxyuJsLI%3~ZqL77~)B8od8sKf%D-54!IF
z9B!bo0{vD7Hc;3>>qQ+<7{bz(!#;*T4QcSbZUUfjCl999ji7cpXbh*J9(*31fCp3S
zT(DS;bVWlwtj=r&t%Vc-l|>Ep4B&l29!#yJpfbw)|NmUjePy6Ej^6*57B=i>U;+6F
zR1SddgaDVdZI3JJ({ESQuK?Ylmu(0tkHGC+=$a(&|NlVyd_d=7@qpGvdjDSvJO32a
zFJb|i0WudHe{gfMUScsP5H#)#+LPhIkhKt;wiqC1p?WZ+Tm-crLE-7aB60^5x3Ia+
z{f!I~Abk@X8AL#92S8~MwD-Y-X~$2{T4Tpe3>+RzJ6?jyeo&f%jRQDtVi1@B$}3De
z&Vtr%G&VAbfXs)?or$zCu=axPzxV(f%K_C%usH}&9D(8nwEqE=?{l^4UG=+s+(2tP
zAY&8^65un162SXmK=*2a`u!{(44EH6bqQ$f%7aBj1GcsbG|mVba|Fc+sLowz%U}SR
zPh}`*{>z{sYr~*X|M!<j{eLf!MtcSh(Ar_gCI%l+yo2Hk)b425&j7v$%W)oqNhA0y
z8wL*0IVPa=;QfCwsNXLD8uP803p$%(i77}gXx!I>nWYsne)GSlp%#2@vxEnWa0>%#
z56J)UaY%5PhkTCkZpgSOsEh-J0kmJu(fktB|6`B<m46_+A^qxRR!|&);uO@s^8WvC
zCD`5j7#u)i-v9so1j#qlH9*JwGEQ2|{{J5&XR!y=$M`1*3V-mp=}PdpselJV#!}Ec
z5u}V3y1>BN1G@ht0Ty3S_x6C|Y62s}63`eJD9%va3fdFTzz~A$R*-)@n3_WM=QA*Y
z;=^Gcg9)fS2JI2{{=di<<ZjSemlg>O%-;X^7J~V688?8&*FovagCPSnP9bC6;Kbm;
zkbV;~-ed0wQU@9fK!i!-M^OC^8gutxuvY|?*A9yqt~AVR(69!rD+8TZ%+v$gQ>Wv>
zV9!`nEnNu;5633Z9NEH`pmF$yeGMix^-?0B^+_H~JsUxNaPR*ML1*q*z~nrbdO&02
zHXaOidqHM^_78x}@&3PXDQLVMtUvX3g$GklA!r=KgTZbpnmSP5!~;p4Cun@#gTXEr
zO<gGHtQsVBicouOwVN6KgT`h+^EDO=82*F$kM-d5^A@g!s*wb%NrBAiSTr#F2g!Rd
zGlI{V^8Wt^+(re3A1J=P|Nl7&iW^XU1lmXA!H@=Wdjxncs0DPNXBz1I;}}SMq}A51
zgtSp1=isHeS|&0q0F@^mECMqaSi3;y{uUsm8<u?!8FHZMW(ugRg{PZ&3?1OUC+Lp6
zeGDF;Hm`mw1FPda2GBZpHivl(6B^PW=MY2EeFHBjzQJWVsO(+9Ake%Ybe4MkS5UtP
zG*1O8FYFZ<1UwjQWiiu8{aLWyx&{^x2AjW7KdXT30IkOd(IE37cGWKgnGI489n<CU
zV2Gay8Y=*`v!UZd93Bj*p#6l59t@0c8tNH1EE*X=dw2vqnCcUubp&{?oCmYo&6+Ck
zeofGRDIQRpy8(Q6YO1dH|NjRX6&VsbJsH4fhl9!-?JjUX3^dju;Qjyq9E(f_Mwr_s
zBr+s;Fx4}H`dW^VaTE?vn;cvRv^=h`0G(yQtO;A21S%^<K<zY8KNPeN-|8WQN!{b!
zpt%+W52jMc*|CuEE}6O~yDK~xQf7Mp|E~keYoIs>*EgUwd+m=aEEz%V+muRB-T>t_
zWO)yUlth>tJeZZ{g2Ep<&ZGefHxFh-$ayWG^&E8#Iw1dp!U0s5c`&4?g2qxo>CuB(
zJ`o&N3&8C===mBcpnB1zeg?RWApjk_<EWQ9Tmc%t0@aHi%nCc}n=gRYY=QQanjpKa
zz8#c~lMi|@%kTC6|1ZFUS$-?%-WkvsC`hmMLxzyanhXpc49TD~BOE|$VL*AwgQ){_
z7mf=kk9jaysY2_U2_7uGa~N3LL2VBB{xncq71Vcurgan0`XG2(-^;+`!4L~NKjjCw
z?a>H6n+@9bs5J$bU7)c&P<~@pSqt|6BJfx;cnuIJtUMT!L2F5OfZEtt(h4Y^13Va#
zwt6ryOhHR893D(H7oq7Lw3meuybov}15a~3$XyH^pndA#xC7no%d7xy52MDNJosF7
z&{|y3m^sKj;PPP^s2!7(2^w<*w-uRXB|&AcBgE|?9t=so9?Wu{&^bO14`w-Aa9;pa
z9<%VIFtE0P&O1a7Lq=?8g+ljTGk7p0{sqN>2Lr<flyJOjT;ah~{T3XKwG1ra^v<lD
z3Mx~f>r_GePr&^xq_DGq<}*;cpTmP85p?$xD2ziaQ1csy2UGP#P@M{D&x8B|@+&w^
zFte-$rE^C}n&tt8NyA(Q7SNcH2SZ|@_y7MJJec{QXMS>5FtE0^AfJ~F-p_+{W;R-y
z0mZ3+2SXyK2LmGy)W4whX3%s~^%vS+1-A=5n3X{7Q1JRbP<s<J)&W`<h2&oosDDA`
za(FN#bb2r_Y(ev@hzC>EQcyU8{o23)o<D|!C-Xs2KhJRycsx=Blt;knpbeC_5>mnC
zFSP9pDyux0s$xO&=lZi5*g)kdXlxkVW?sM`0F}1|)nlNxHE4{<gPAW9H0}c`H=$=6
zNz}Vtt^l>OK=~I`4tX%d{{^*qz~i}f4Kkp%vo-imf%vE3vqM1ZguwN03uq6b3OJ4!
z%s_h&A$>g-&NmFKEex=+254V_2_@g6&QXKXhK2`2d@D5FJ%Gjo2dJI^)n^_|m8Bpz
zgWCQe_joWXyoKgpQ29+nx{GH7*PjdwEogDU;lWfXi4qsimn$G~!34e|0-El0K;<YR
zF5+&2(w+WX@Y+7m8T+8VE~rmy;K9uE5R{HVegW;xf{u}!cre5*1(kQ8yy?NhafX4l
z8MJN!K93J-PeaQ!8CaPHx^D?I*9c1g(6R#L*9H%UJDH$30@Y6r3m7Uq7~Wq5wKpMs
zkvLoZIsd;o%wq^?v}a&w=wuMlZeiee+zT%2Kzn2bJQ(66L1Q|gaT(D0^Put2MlEn3
zThIY=o-Js9tzbhJs4j|q3!3`?&zaXXh<Gr>-UX=#uK`&6y268ngM)#!$pf~x3>4oe
z_r1@BoWloh$2Kuesa1X@0t%l_&Hw*F<BblW@g?W~|3UY#TRiwby_buD5wt!Ebe2TJ
zy#|F^Hivb!Y!;Rdix_Tz@*7ysT!uTK@j}OW3^zKV>OuD{7q4Vsc4%UV0F|GhJKF2_
ziWSuFWt?JN3mWH%RR#4`>gT)w%?0Yz&$+<>n%8xl!@vW+pN;{%z5~>DFaY&0JQ!lW
zdjJ1_1#|`hbnMdtq#t5d%uQr-YUV#!=eP&M92=-PYoX>ifYz45&X@<Sq48jd0nG(4
zIPCrJ0Xmz&`~QCyhkgG+W7--ZyF3_TJe%tpG@y1lfX5-{g3tR@@nDG21*Ipb9niMx
zw8r{5QsDCwz5h=u1<!5&mjaD7901u3DpOJIkA4B_lX$SOIWVv`fXYpHJpn2=_8(->
zfTl?kP#FMAm!SPDp#A8eJsTi5crZ19#{a=<Ts;_!5+P}v^#=oMg8}kc3ZOpDKExUH
zF5o;Z_x}TUjN`y35l~wd<VFvM(1{)lj0vEA4rq=Cx}QDKVIIQ<P#XZ$pYi_x2ePke
zAEO1>J#`H+p#ABfxdm|f(ZIj}DnC4!N-e$r|JU^X|7R*FA34rr<j|kP!0fn>%b}qb
zG7bSLD@z4IcUywi+<?xBX;{p_Qs1coIs*n&J|%$GMR_npJ@jDU;sE8fT2;^<#8;59
z>3y7EJQ!f-hc%>lFhuS2VBmZJIxhpXCc}d%n-NrJJ2WvI0om=a_rFX7;w&Hm52li-
zp!4x2RDt%?{05&XUmtzB!f_u%4A_luzm(+a&tYHzm-V1~4y?dup@7N+n}%9QnGf-E
ziECpN0|UsNVE?QF?T3T=CC7syN)lAZdN6PnG*mM%fa(T_e_lQXhtWPzzJFZ{(hr$u
zWVM)V4Qjh_g2Idi<fn#t4Fw)dS&*@lc?>=ffBka-msxWeIGRD}v>v4A{zLG6gAFV%
zKxG-I{`O#a0ggL|Jsf*H7+#A)?Wyo!V7bsx%fJGPZ|zQoVuyW90uXcmz5)5W*_MH$
zITmy_1mlKATLuB^S_T2oxj>*bte`qryNkibVIRW+(0aHUGwzD1W(*wG4;UDl{x$f3
z%B*Ha29AyypmSyz>>TGY7J&C7&*4Y`os$BZudv?Bz!<(#z^c~TLl0!8_y7MFK;!du
zM>d1n@(fnr8CX1+ie7@+hZD;G{{gKnsg3XmbX*8N=dcE}hQot_g$E=La*uu&gM!1p
z|DZLT;B~g%|Np<x?qY~`*vGI2>_&6$imB!hH#W;b+z8eS*~=IUUK5qbzyS>p(E3CH
zP@V>j1A)u}mxc2fB+%Urs=LAWT55T$E7XL~>!^VG9+31=qzbzKYDNVEgS7+$BPbjk
z=lt&g+1=3z4xd<udF(zO3=BTa`x<;eVF>D@fySLc>b?I@l5A*X;IMiOZM%F2jcM)@
z@%}$Cx7C_~rGCZ(22l7p&iQ`<+{Sspz|g#}0i4bnYC&n@?pa8hV7db0gWEax8hk+G
zr5+5A!Q-V4d)O9uFueE)O&cv93`|?JI~fWb=P`(AcQWKyJAl?QFlB(vcVJKe%}0RG
zC7i>+3`!@U_3<FJ&9&h6H&3%&LjXt&*&X$JKyB;0j-b5h*udlgn)3kdr31SOw2v|M
zb_IB?3d5aP(EVYc_C2Uh2e-38^PQlz8=$rjL)b|V1~wJY{%_E{CAf{k5VjQ*Mxg$d
z_x~SHJs6lZz-1)^qX;N1S|>6HfX>nZwVyz33lD~?o|ev#b0M|67&si~GG>6z9tX`e
z*Lnu%f#yCyYXL!P073dd?LLrR4~Cm7>*roz0F~E{a~Z(<xEw%titK9$=~M-;n*!}^
z1Fc<*XtZmXqcE320W_yq)2Srl!4M`0N;~><LFb$>g4$9GJQza%djJ3Z#QN|5|KNQ~
za~XK*|NgG<U|@LDFt1^b@?HkThPs9&H7&11AoC}oXF*}&xR2qC_y7MlKyCxM3$*^<
zgW-xMsICWzf!1|;FkA<(c>%TK^qCnLK<U_F2dJ!h4jwOq&gGr~`Nv@vgM#B;h6*G%
zuYkBYG#0e?+i@@W>`j<|)<ESPL17L$zux=*chDHi1`mc%U2uLt_<ajhtthCE4YCVV
z7CP=_0nIt@@L*uB(VzSOfAd2I0f%}25<D1KBpT*5>;aW|9!#m=bq@~v7%E`p9H>n5
zV7T=cl%5?HFi3bXJadJn*%A+ikd5B|f6V}uVIXx5a~V_`!2Q%mo}e`6uz-1w2g5U1
z`FFsBftkUB;qgbP+yW1Vr?B*Y#Djt939M|??_|hu*vIe$?1s9A6VP@ZL-R^dSccew
z`E?Cv8bEs~Ta_z37(z6mViy`ZL35rVl2HDYhE7oa2;qeCZ!~m*#&&{1Yy9qj`u83T
z!Ed2*4;nf_{tLbfI&;%uE`tkH{7FM6Xsu!JQSG_lv)px{;x8IHL2F%u*J{sY5OA2w
z02&JholWqjp%ZlPZSYi3n0PQ;Jqiu44;~D`jga}D;7Sh$rUjrgR4o=TFncg19|VWV
zA_f)IdNUVvzAN}ni3yn?H-OJ&ht*F%JeZOp<011HLcsdq{i3`;P&rrw+P7QFzyrEh
z8`1{I1D&<R0J@{Frb8LNmlAYFng>I!CCCkq3z;}P7?><TaREvb4f7iQcrYbH#zUJJ
zL1)o%fad!_WtGD|h6&B{8bEgfgYI4uuvTQ?0ObV_hAS7rZ6EO2u0fzPPFXw{f?Dh6
z-T>`Mx&u-J3VTqw2-?Tv!EnX4rb4>X0en9E<EQoVhbtgq*2v+(5ajE@z_<c*ZYf9)
zXsrh*PlM*l8XhumG%|wXH%JpSzoXsBkm#_FApzW`fQLn{D^gepAi^RSbU!kVu()#-
z6c!E(82)%LJPw7r1vIbcpxw!k;xO+Us6E013R95T9!%Mwu^@1J1QM2aLFEF-KYKhF
z9z)ZAqlgDXV50{E!yRbYGB?a?l<;6mJPNjJ5rYJ{o!7*`05RkFU+@?Ow7sC;$&d`1
zLx$D^7NGWm!@jRu!0`@mKV|EJ+yv_H!NS0UDH}AN0xI8l!1Y`Mq^<(3Ed|vB9t;@^
zK{TjO2wuAgUhkOp6r>hZt~AVRlmVp!52i#}usfT+I)L2?x<ip6FBdxI+u;5G_ZQ1V
z$ozo^^RGP&tYs+Y{M9ViuBho&uCQrXwF<Ov1lsNvNoZNM8r1HtIbmE;n-&dT!&#Fc
z4JsE|YFL>oK;yBXwfUfR`L)U(0ibpHwVHATp#DWor{Xma2CqG^b^ewP;5$1QKzDY*
z=7wsWJ=SS=G3bHX)V0c9BA|Y2rzQg<Xk7v5+%1Q_pnSz316q3qnlA#iTbvmFp8?OA
zD|>_X-V1mz|Ked_Ed||Q44;2N=>x*<$(gNOVcq&4bRP~EsBLe(jDZEzF9gl!c`$g)
z)L~{|aBN~Q0IlBw)uG@%3uwFnI(G-E|3Lj0kl#RiZ$Nb+q)zor1odOUeSGGhpz*FB
zpz(3!IZV*m-roOrGlI|QP5_@9#{n`2v@U{ywFGpZ4t(wmIs8HK3<`g+JHg}Hep^B3
zvv~jC10LfC%~^r^-Jm+pgTe2h{(OddP}>T0FBs^I5f28xSkU|#C|o_5e>`DeEpb7<
zHxksJ*_Q}EOCSWat`uY+tWVS|*8pm}2sFnvh&0zVNOa9$U})aSz|gddfuZR(0|RK>
z4m8&6!QcVDKiz|Y(W9V~fze?RLkuX4LFpZo2O;Aq8Q}CEQo?2j9!m$`lbRt3YS)1H
z-v9sJtSJSZA^m>?sLpcS#~=ZkcY~SX!Ib_MbY^$moy`?ii435AltBIb$Dng>K<#XS
zy5_~;J!W-FS69@f&8`5o=e+;#2Dj%N=YiYEG9C=Rr5+3n9k8))s|TR=pl@gW^dF#p
zxkSz69qX*VGl15bsdzB>7J}Nj^)G+?0IdzJ)%;fgQeXel!=iq#mxu?0uO?KV0Z5;v
z%Kr!2oeXgfbHR4$crf^a&c6n=YYaRXd{sf_g4*<uc=0(}KmS3XW8;6DSu;TAX)rKM
z-pRl)X%_>-q}$;8!2&#(zjH9K7J=4MoB*XK(AWkjzL4*W0hcA9KI~q|9Z(K)8TMd?
zd)ih|7=p`u&>RLh+|w3<`f-qO|C0zR-yNG68c@SKtya64K>%b2XsrQgf2;mn24-sq
z<`>Yo0gv;6_Ct9vr3KbhNmqo|v)O^yXn^t!sC~+M7<?87XnfE6|1QXx8j!WAG9C=x
zFF|9{9!&9|`Tq;`&7g5cH&M`fXh>cHox58I@;^LZgXWJwdjO&3lL|QP$o>BS${(OO
z2DNuR7+gW~w>_BQkh&He4xoA$9uBE9Vd3Ka|92#4Ov`c6|2?STkXj1XSBtz(AT<$G
zMu6^r2K6b!o!RU_XC8R}->C^MM;3w80LYK5Aisdh2M^}2Aq=bqp!?+D_qKxO<qK9a
zFz#z)fbH=QshOe-UPBKWV*~B+2l=g8t^ssLpG9+BgH6{D28QOJ3=GZD44^YQQb2j4
zA&miarX?eIK9<4lC)~X?450RifCp0wc>P02Ih$QW4P<V@gDGV$w0+Fs{r^`ibWBsE
z?(pUc4+fWBkh?t?7!`EqGB8>lWZ==2Wni*e$iM+QFQB2W!2wd{c=>|zKZp%#FM#*-
zgV%fPfZWLlIrGuQgTWJ2Um7$tGVnO81BZ=ANQ;{ts159}3e5KjX=wrRLF1SK9t@se
zL35RmK2jxkJs0SHtcJRVh`J@KLH%I?52j?${V@>^>p=G<901*0CgRw|z%wBc)aC$*
zHONhLWZ-EAt*7dI5a_sw!3Dcpw}aNEgZ8+A@@k9+gJ&RUeToND%tO%mV4yWB;IXfH
z|9NKpfacYo3=ET_85p2@`vbsdu`_>;(Qjp7c9_Q?Qq!qiVbQ?A2pZS${{K$^^}YsY
zLufs~2)nZZQV-;T_87wRx~1y>KcKVH_9M?9?18K!0Hq1Xy$l}UJe-DDlMfoN@?c6j
z3XcD3=?ZZB1DxNJHiF~27PP<ZM<Fb(L33*!3{DFnam~;HZkNE@D@nEba~N1>B!cd$
z1K)Kcf;!HV6bp*?@LD#z`p3USK<n0ORel6IG&0zL@*yZafad-z9xyOkr-1gZYy+?B
zg09bs@nCR&X_27y!-FZh5|o#`|NjTAvu6P1e-GwQDh#Z-GtlNzn32mqP(1|-2Zy-~
z9-uM`CBK8`ixT&O!vU1vLE~NEa7bK<2#4>PpmNV)5rYV%>~Wk44Tm+z;Q;P0ConLC
zM}f}kO3bv_54pbuG(TRm^bvS3QvIA?BB1uQ2ZOt9t^ET~7`TASHc<G$_QQk1!TbMK
z@O`e}^;mlu!0Ww1<6oe&(m?gL2b0fEP<iD2|NkD)JT!FtKE;E<Z7*~TJOdO~9t>_*
zL3KJLtUi1}OLq*AboUz+e&Dvq1aLdt0d)T&Xm1Kix&yUSK<lhPX)q_5fh{9hssVI%
z3FzDs*qwwRIR@4o4p>_bS{E@Qw^iWru@AftaxJLs0%@B!<ajW+f#!c5z;OiHKidGh
zUm*e1W(Bn&3qaxI!QckIGt2w`|5{L67P=m<1S0496x5CZx3`!-fcAug=Pp3?A#6R6
zBe-vC4_b4316m%kK*~c$@S1eT28IKmwJD%90cw+YFvUaGe}USE@G>#JQ=6HA5j?lD
zi$Mc4?*ZyhdjJ3bM}IB@6NnGG6AQ!#ofQkBL2Xw{X9h;lSvR1zt&_w5FQ7AcEj2-F
zasGb+>8oY_C4x=eLQl|H;S5aP|NnofwRZ@pfAzZp)W!w1HJu#(f9TW#t-S^1o&TWr
zy979WGQSsLV9f&U!-S8QgU7b9>=gp#k4Cu$hQ_!C7SR0!%`X@jnpZI}G;@O6ZUP<*
zc1uBRY0%n?S}X60T5;!!+Q{Gva2pOZmjS6)SU~H{Js2Dog4BZN2pbqcW4GXaoRF}L
z3k2OO3+n%X)--|214mH%ts1co&x0vW7qpJU;sJvIC?0E`zrF^FThQ8h(3vtGOx~5C
z`&nvj4_*Vch3a4a5&_K<P5usU4;g^=lX)<|V_{&;1nobAx0gYF$CeI3XLCEuMPFML
zyK+K3_|9z5`Yr|!2IpQ-x&q}T59YT=7+5psAeT9y`gz|$_?=ZYAiF^69JFR`Vk6{y
zEr+>`8Q^pcEjPhwjw#j=6z`z+H0Vs722lEf%6l-ys)E{4pnBVJ9wTVI6uhqr8YA>z
zie&|*KTtUZo`<SI9$Sxj2`V4-q!}1MW02Mg42+=i$%DZeytWE-elw(f>68jiD+~+|
z949eo)X%&DJDXj^V&?z<pfLAfaGGdn3p$(cC8+Pb1H2~d$#2m9KN$}Or&3T_tb4h;
zqP}y3gTovK5zraFwO*G*py~PzxDEZ|cSYSF(3%n_+4?zPbv6xq7#QkX4}i`Y1+CLi
z0ry?m4p)H21w0s>WIY(1Ami`*{zueHToSPcpW*TU2xuG+bk|S)e+KZlZT<frKR|mP
z>!TPhc>n*eVE2H*!R`RV0Z_RD3McRX|Nb;KGVp-PK=3+5=GRXcSkpo49pUXoOV$5>
z!F8x319V?7g9@l`1BydX-T<}LJs7OP>Dq&VVFkS00M#E1wj06ey;{1`p^*W!-VZ6g
zM<;^PJFF~$rFl?&>%kQ53hMuZ+QXnY0Iwwi&Go?JKUx(ujt*L*QIpBMOkbLT$;kmy
z)=Z8E^+y;)9Ck7AY=*EoW`pkN{(lQJj|RK9N&%7=Ub8T;rh(4*gZme}-T-OcA<Unk
zwy_6;)lSe@BWOPl+@H6ND<EPvN5O6121b*HYD9a&gDI-Ad0zu~-WGJ9Lj7YUkp^g<
z_F#&N1?}I1g+cvdFOVFM2UC<QC|_HG%F#ItETFqaK=%vl%P=s3;;vTZML^9-B@rhF
zh8Bl?3>pnf7#M0^D(Ka;S~xf^1Mj`D@L;h23QB(vw=tAB>|)SZ09L02QwN%-wDDlD
zKZ~R;qywx*VI9;g(0r<c2ZQ}eBsB`4dbXzJ5hy%CXS0IV6M^>=fX3?^_JQ{4GYB;7
z1Kr&Mo|84u?gH;i<!QJFK7*U1;a-CbXzgFEOK^n;gS{`PZ4WBXJeXfrFtDb^AkR61
z$`4Rkx}Oo=zIOq)RpkDEfVb`I8a$fg8ho06GcYvo0=MaH8dAaSc^1&wGad}qn&5N@
zy8F3-k)@#$IesE;g3=)@{prqSU;(v5KyCGUS%wRGGT^c<02Ch{40a2lZSN4!IS8ON
zJ<zsy#De+YbO&z#c7WM-rJ(kW2Se^vaDS!=v}cEb5p;L1!#oCoP8;ypzOLguh6qsG
z3EGAc@L-DY1kK~r#&`reHZkac+UB707PLOhVHE?<hI+6)95d<}Kxd9|fZEm$P5%=n
z{|4RD!@w|k7g%1wanpaFdd|b(aWThD{~bW{^Pu&--v9rbK-=67pgaI+cRvTUe?a>|
zK=+3*g3hV({{Ihj79&#I$9ymLHg_`UEGyLfgH%?a<{$G)&>DKsxg7BPbH^BbZjuLs
zWh<yn?byJu0kw@0ZVApm(7X@IFZGYTL_qa{2UEB#=xzl>{s{t!^LQ|YvqHmM0aQ+a
z+7<e<7+7lKUj*n&F))G34A5Ex$lgkurJ(&NpgAGXy$!Woo_e*KmqeTx{)6rTQ*hYD
zAg~a0uO*ka9%w8BbPjASm*+ardPq<iYMIEO0G{(^ezt>wH3_u;3^^=7>t+z;=6;mE
zhkyrz8F(ECbj}-IHiFv<Oks|obP4kt=={n0=0~9Nfy09-Ochio)YM8>fa+avUBu*g
z&|>fZ|DZCnp{^kZEDvg1yIlsKY3adW{ZxNGXx^MbqM;gj&1mS&$)Np7Ab)_?gD^k+
z0BRG0(kRGmNLu()fZG2u-H0tMOo8sp*uRiL2D~3*zjg&^UlFK%16n8V!4#ScO533Q
z6*FoX7@%{kx}dPfT-Ouo2ukCiHS!+JPcs-;6G3O)qnzuv7tyYWsVRk?;W<UQ0@SXk
z*{lurHz<xk^;G?o8xD?hnPlo`&v0<u%Ouil*Ps%f$zfCf)k_bQH$ZhU=>CJ6&Qp1y
zapLd~$N%XGFffFFy8f@>Bm+xG3yWR&$NB#}7_8<t%Qa{ee^+n--JMr!dq`xVCId_T
zEDr~VIgDFsZ@kcx{RLj*p;L47m0o>cmB>OH29^bL7?^5R6b$OWDOiNGu-Jj_bM#=a
z3apKMrMJ+AfeAD|>oAX@BUB4?79ax~XiuN^bkIIi1_|xy3ZODp!m*D*rcn;GHkUyH
z)FuV>XBy=iI6!l#jdBg3vd6%p0emMaZ=KuZiaPb~3J(U$x1hCgpgBp0eGF$nXP7tK
z1FZvM0F}d_b#5jW4GbK0tj!>`pnZZ5KxdxS^i}CO%wzBXxd-aD2@CE(!lC||fd%O9
zB~W><-3FdB5^4Acc9%fIzXl1Adm8?M%XkaW9JF>91FOS4h5#h9T*xpBd{(jtgC*$x
zBO8$WLRDGp>RZ5PTY~)I;K5)CTAK(82Nw?pi?5(CZ>VeVXxPKRQFlbmz=Od8bbqdo
zbrfjNwFT&IITy&<a*LDtvl&>e_cCx;SA*uI|6YN%iz2{hjWa)5!@wF38t<QgG>*u)
z7qPykq^1O#{-EQCptUfd@l+26qgD?F=8)#NhJ=DS42(_t8d5-GxlQ*PGCHlmYa4Q!
z<r)fRDl$lPS}`y-+clKTRAi8BG-Y6zsmLJTXa=U`KzA(8RAi8Cv;gyEKzI9XRAd01
zF<Jv^JA?KZ&U6Ib9b5!j|IP@VuVVqt1%S*0#mVeO21!tx+HoI)2WZ^VqLD$~Vj+W^
z_y0ehp!PIqe``ZM1CK=`gRI3uP#^S<A*dY<ZbR22x1j@<Zb$^pRpxE&RAi6<wWqZ^
z88RLAG28%|Z{5Hk4{E1?<{P>nGRSu~GRRpkWRSLMWRL=lJJ-*D;NUoySprmUg6dV!
zxsRaphU?lFS9mZKfcKy|>|<yE$$``~K4jqNVq}o+Qe=?wU?}peDUybqbC-O(!h@mk
zCTPuz!#oC_#(NDRAb&RAYX|`81L+6t8P;!R&;hxnF|Hv7EFaeZT4M$_qxNYv_^d!s
zUa9k#Tv2<nxWa?MY$vFV6aF7`2HpP<?M{XwhkXnWx)(zHW!3Qizf~fGNT(u$9O&*T
z$2m*^-Hi;gos0}J^>Z9RXL+@N?O*b`0yMS>8cW~Q2nw%U@L7J)HHkH#`96?5q>X0g
z>cPO^(5c8E-{}Z4H-G^&4%Vs2AlvE4AXDEN04f7OYnd8g`aBrS1VMYc7l6$+V+E}x
z3!ejab48~kgFM)MT^=BP5+HNxI~_o5Q2y}oU@*N3>Q8{qA@=_N-$J{Sq1<5}LjlZ>
zV7;9$931B`mVo^R8bj-R06J&VVZlKL$Q?CM|9LRvt^~yaxW5WoR{<4=_{%gG$z6Mp
z>;%mZ_gFVFNPyZukU2P4@LYq#JcctM_k!=Fp35N6smLG$VnfgHpWwk@DhcWrcrY-E
zbT=}{TO}|sg3_CnBlzr4xq65@_jE60kgY43UD2_SL8iX-1?a41kMLz2;Pd@J^&_a>
zthr<);=zyuKF<{%FD;KNKyp?M44``>7(EzFRwB83i~bY_hPug%LF>B&IvN>dL1#94
z|NjZPN681~R}Ti0Qt$u&OB&`iOhNe11$y?z?-!ta0vZePV8{iH>wwmva(FOgy#)CK
zl&3)L;h9zp44sM$k~6Is7(wY`qA8d!H_;4C%T6>0(=rn+7#J2RGKfsH1o!g`JecqP
zVPK60jq$+ukb>IL`xO~<pyU3CGp}cZ>q`w#e;iaU)gSl-N@ENj3|xP~aXODd0@eoc
zVDeoHI`bK{ZV=>t&{^%!awA25F1U>kPWK)Rx)UuD{%-)Svj?pev1nva0JQ-;n0#}a
z_cO3GH!>)I#$7>UoZkO)duwW?M8Idu?gO8d!UEZ6z+eHImjkWY1)UcJHV4`U^kDK;
z1-S#XCI#dckUGd+N$tEA2@C-q3<;5-u|x0w9gd(qd7%D+!v+Qsi-iB{Js1*fp=oD}
zMFK;h2SWmAo}33XCk^)RJ_Z@^{L7Np72f~b4IAnj1VH)CgMrht(XK%RhdNGh-+u{c
zJrXDA%rfx(%b@jL(6L$t4+c)qy^kuOdzq2MH9QzNJ~rAl=wLUuZ6oOJB8dGQCmZb=
zOmL_J?LV@Bssr6iXoEvtB6!{b>`snK&>B!Q_jq_Pa3nfx0*BQ)4~BTqIU1n*T05He
zHGuaFfacOYn9dx8)SDdOvKQ2c0qw=|{+~S;)b4gz#NYv1mkjFfg60xH^AMmjFFY6w
z6D<-Lf;<@Fc7n=BXu4tqt<m!SzYnserh!4gBH=%1uQGT(-y#8Y225NhC_g~&ZS{bR
zRor#~jg5lZsNVnoN<i7n-v9sdK-rAm|Nk;DutxBJ#+)4HGJwt}1&?`x#$NX?gx^0Y
z18PTu&gcTAe^6Zt$^#xu4z-PO4d8PPCuBkH`T(U@4+bsJ`3e6)Wi{wb8}I+EcR^_s
zly)5UfcN9XcrX~i_DO*Hxd|Q&2ALptg4Pni_VR<)Uwbg$n!vysegk<-7~41;IIY(;
zfYyRDcrX~qdN4T4g2voH`x9$2B?UZ~Z}~8=hJ(&phmYwYn*&k{>xY5HFhOa<gZY*O
zY|S_LT+l=Y9?+Qr){FoD@1M&69!K_Ia9C<x58CrA0ji5+I&B#k>g#V;=yx*Mg679T
zaR@qR1|$wk(;)wW=A=OJ<-y<px?8~3Vc-8ZAhn>rk_Yom(0n9#{ti?ofyO5%FfxRI
z?#~9bf%ZLQ0PjTx?X3lsh1QPXd1_F-wFPP>_-p~kc?@$vW2K<6A<!HQsICW{%N<f9
zzDG|6GNxzs7v>N9yY&lSiRe#f5SUTRz+o-V0NUSJQTKN@=ni@CdOpXE3_PGR!-GL@
zDrg;Hz5L+{hk5@GfX{H+%OC@tOMs~<gp3jDIeIYYTY}==ao+zJsNcb3v!HecD9)j2
zHUN@lZ*(xQhQ5G>J18B3(k9A$EOehMC=G(z*P!_*a5yx8+N=yQpgA#+xu7%QLG>$W
z-I`+q1L$5d9*YIce?V$I7<55rby&2=g2y?SK>qUn|F0M9&VArCDgfTo^&e!W?paWs
z1zJxJTJH&pBXBq~Uw^^C8ft@lrVq$oP@L@p)u)g%wR}M5lY!C}Xus>kMh1yyCCDA<
z9t?JOYe4r|H!)~{%6y9k2JrdJ9!$1h!S0v`-p?QcDYJAvL36bp49sU5;~F^XzU{66
zt)I6}`2Qbt*8yleA9Ocrrx|$61e6vmKx-JFV<;d#56BOo`$s@|v}XE-0Pp{QRl$3k
z8W?!2?tsVtkAU{}f#kjar+o#bJFq+UF|&Z~K!%Fn1&tFy#F;?rB^99J;PF<+c}!P8
zX~S_2!xm6|1ll|6{XY%T_L;{Z(rE+Ue+_aE=nS?Ja2p#^XK{HjxfNPEFmQwBHyY&{
zbU^)dkQ+c_!L=S<B8^`E|J2U{wegr*oEZLt#)bnxape8~-;?@jJ3wa@@PO`f0IgY?
zX$BtS(Ll0K#_AdaV=vTxki5gb{~x^n|9=3oW2PAcqy7vACda)D79I>Xjvfq*CZM_#
zH2&kkpt}_8-#!08YZpLm5LYO_0OVJPJ^v*@d%z+2`~MNpcs8`(4)P}tC~iRE-s#D}
z2<a#O|4`q#L!f@nLjh3O)z9$=u#N}K<D@RF54~Jroy@>wb%24XrIdjM<YrKR%lm(7
zXZ^GT4E5DgB93$Zzp(nw{HN~Ej)3~vJ3x2q@L2B!?f(GxsSUjU|Gm&_3km0$HsJHg
zU~&HjbboE8Cj(Qf6a$MP=uCD^Pk};B23bo@1_h8>OO5~kdpRNdQ|8Km`g#AqfbN;7
z?>fNXIOqR~nKGdKV66y^TNCg9DUdyV^FU{ffWn+n2P$Xb{Xb<RXdcI*i6Nu;Kln@r
zmdQIA6u{}$k%2=`9x~7EIEewgp92(^kaZp|nc;IB^gv@EH8qbx=YLCp)+U4I!oXn+
zI^W?x1EYC0_{`uvlV^g~V8YXzjrac)OR&9*7!;7wmw*S8iy-LUWl(zvJf2j~07};`
z-v3iL!Rnj-gU;CV0JW1qaqs=V_95tOGfM>qCUDxA`}YHAzpD5DKLwz=9pqjQ2F;D2
zJfDz!IKYF+R&=rx14pA01H)ub&{=Jnpmr1kM9$`?2ZJVPpDeG#y#GJE|Nr^X*a+U+
z?*U2!kh1S`3j=Ea>R5XV0|WA1U7&rrpt1ziW&qhcp^-rVR1P-UHH3iHql3~i=*)6Z
zxd>{vSTry&gTl;V9(az7$@~BBP*C~h!F(A!&jjiN!_HoXjAQ)<_2H4mG?iZB7{>y)
z6JYbAp!OqZjtJxz4+hJL;QRp^x8465d|!(PgC%7B!#oBN{rSxQ9p^IGfclT1JKaES
ze^43c{r?Ae|BAyL1|IAE;PPk-=sqIYS^J>1Y#t1jptF)ebCe7o%$Go8Zs4&*aQzIr
z=c`J(0#rwX_CSKt8OUtVm<Px`puPmO{^_Wn`xt!3f(L`eQ;-}ey!7WX|99N`{{g5U
z19lg5pPcvq?|;E<wgn74)^ow`T2mi?3tT7G&zA_OpMSxjrv8x#NFQh%z=OeJBFJwb
zb7$25|L-vG|AYG3FF^MW@POh6baxUcoFMUVaR~#fe*kj(M!T7T1G#Miif>RHJI-S`
z;W(GUL%SJ#SLhtjemCuAaG#>XVK2iMP#fQaf#HL8GXrS<dynHBh6e3s2GHH!9oo$d
z><;r7PJqtk1dT0gH#6`#&SRM2IF~^~yP1K@aUMgB;~a(p?PdmU(B66NW(FRId60WS
zJs23~fYxY%#2x1_<Y+g8?;<S$oeuz7j|!Tn@L*s7&9Q^_>45SEXs=)fs9ykD#|~NV
z4BoRQ0Xp*rG>!<}Z>9ojBZAhwd4Q%Oz~>h;7(n-<X*AR|fX2o^Yx!+J?IlpV95kK>
z8m|Ji9YE_sLG3mV<_iU&d+lK3ub^}cx|4naBlsL99`FCtKx?%Wv^&9b>jEK1S?s+3
zPXp~W<q0_o8Vi_)W6h*5=**fOu<<N#y?zir$KnG@^Pso^r8m$#i*6eO1E`N^?Z_Ym
ziZ5$L1_5ixJt-V@M;R`F%Zw+WeFmzvpmeDX+T;7=H>iCj0b0M|{eP+?=p0GV`Xx{u
z23l+Gu#Z6kbmx)x|0#1peS`&#ptb7^;C-{+|EFkz)+%*0G6;DvsDjur9t<I!ptS1P
z#E=6zi?O+`AptZ_4ZR;1G?(H5YG)$$$=Lk`jW>hVnAJvm1n6-wFgR{vZ~(av)LsPj
z@xA~5Tk6=y0GUUb^dA%#3Xbdko79~It>I$eaa{Lb12jGiojZ|%&YgIG$|uO!;JFP9
ztUf4fXF>fM<Z=x(4-E=Si-inaps@4)KN+-+jtNxWf!bQ$|0jdiQE*!<WZ;GJLF+uZ
zKxgAZ`LZ2}47}d||Lk1Q$iM~i&w_;vpmkm;9S=ckwNyAE`R$ww1FJXa?k4!U2GHG8
z$os`%Zn17;;IUZ9z-PUXfgj?gNjpJfQ6RTN?F98{GZr+0%vW9sm1Ba)O?nHOV}Q!_
zLgiSXau*xw8VaCtg-|&*sN7c2Ig(JhP*C`T#-5>apfkWLIvPP|FDqMGG%#?3<e_r1
zpgVCuaqIp6_g2vQ9ngN6hPs9tYtWfG49c7!wH6HwToCmWLGEjSn5Fa<D#r<x1G%pS
zDt8eo#{-oExvv8%w-qV}jgyI>b4_}nax<ZFd{BM0puI0pxmu_kKU5CX=bi$UOSEWU
z5CH8Lg2+u`1?}Z&Xaw!)P;%{5WZ(<cWZwtb8_NR9(~ORDnAYfn^7cG77pS@5_JsHU
ziJT2}jiB)-eh&sEPG~rbLCl>9I(zR0B%Bpt{+EErO#u1-0>nLvF#m(^*6{v6VQWKO
zqX<+E=6@-uK9K)!K;>ZmmxjvKHq<prK;>#d{<CO++`I1mf1+YTU84-dkBW&<IR%Km
ziL4EEji58aI6N2>U7>Q|GxELvPk7l-*Qf&3rwNq<@4@o^KjCacU84q6ju+~89f+9|
z0vqZYbs&CM_z0ELgUXpU)HNDF<*q{I44`t74RwtsP&rs$FoMYS|81yiw1CRZh3Yeb
z$~|nTYqWvNHA3agpmIkW>KYxOa;Z=`@EOD2|NB=q)HS+5<vgKsR#1Jt4RwtkP&r*_
zyxTzKKx4iKAYrW_2$i#i$n}BNd>(<w$$y2KX$O((w*>7mftV?O6DkKi52;_ap{~&f
zDz_IZ=LFTq*ihFP0F_&4(Ez>MI2Cl(Wxs1fU1JC&9+>Aq;|Q8Q`$1*)9EhBJCR7fZ
z2Kzy07A=6v`9kGnAolfv&Lvm^l{19OLDNg$)rPu;6;L@*s2nuC^z8(l8wrt<`w5kU
zrk6fY{jvcncNgkEXnN@b?T6a}@t@p5s2nuC^nvo{4yfExsF~38(g!-1Xb;rPPG~$p
z<ES^cp{@ZMM{>DPIcOa9g6=?o#*thgR1O+Py`~Ly4JRP+CueHWz+evw6ObD3|Gl94
z^9)3e$pGpWXju2|1)c2)af|F<ka~*-254CKfabiQ`CaxQR1TWodyY2LHC%z1DSH$u
z2hHz2pmSZI`CWD;R1TWodq8&{+=1%rg~~zW4}7lE1E^dfR8AJ;5AXjyp$&BnPoQ$4
z(6E++%7MxkXqhEz36+D!dk?65eFKRHSy`x@5>y|keEk5GV}!~<(?k#Gj)^Z2Ihm(W
zIW?$0Q2P7<l{*OyPiT7S0ma`RNO;Pug~~zGOAn}gVSvg_gqjIW6Wv!E>Ka*~W|l(b
zpk+w+&W5^14yart)J$ku(EYcet^t~sWNe{f22D%dp!5k%OEQX3IcQqy2BlAET9RS4
zXkY-RBapq`|GPaA`Ca-YXza0}t}()cK^k=bgMkP0F&+k1XV9EFY8w!FYzMUd8MHTI
zK6s8m0@SAk)xDthLPK3+j0c1CM8{2_@ubEC4+iPhhPuWS4+iPl@X7``P=5)u=h*52
z0|WFPJ+9e|3|!&6A~ZIE&Krw54O%zF5dOzO58URMbGZUECk|?xdH?U~1>FH-srmnZ
zs3wb@cIW@Uj&m7e!0X%gLDm|B+BJ1cS66ud?_zYE1UiGh5xlM!6h4r%Wu(4B%=!j8
zdq<(6t}zGf_N9>XnLQY!u0rLn>d$9j2lZ({{Up$xEw!5LC7^z#<DCDXc@23`-^XFz
ze-~Jv7Sf+RvW0=w3A9&f2CNNjslZSS8qeE@m}kiWtzQJS{XpYmH8&vVT|3NW-~rv~
z2HIz6sri3Ss3x18HYbCy<4ndWp!0xhJv|I;9T+$gz1SFQH3BRhniwPswHO2(n;1(#
zYZO4|l!NZrZm3`Ytr=l~@Wos~>pMW>N)CG&Y#J&MYdk=4;lX75QGY(<>;cgE#SIn6
z^SQ>bbDaf1=g>LqWx4^<({ux}-wf3Eo~X#cQ+IeX=*}<!@BhJ|aeofbJgnnfrY)ep
zC@2m={XeUP3?f#I3>;Po3=H+16Br!kFvQe`d91V21dk7a_Nlqlr+5U^EnZy#$^$ji
zK<5L7h}N3i0-qHL5(mu{S=TTy&dOxq37;ci<-ufZTBp)oQB(3zufFDXMV)4M1!zB{
zbs~cZNI#@q7_<?x$AAHH)>rav(Eb7N84?gPj6Q<WVNKaXJ<wUSp*9g3puRz<W`kUP
zr*}njBZB~FT&C9MafSYz|NlYzEIk+)Z-Dm6hQAcB0*y~vYX1LIYvG{>iZ}gEh8)n?
zGbp@3eF0E-fzE@5#tGP74<@5pP`-o8GeX7z{!9d|iD<N70L{%a=yx*YI?iL%&<4?S
z85Hz88B##!n}PQT&tn9y4fFp0#Sqj-)bC`-bDRgd|A?X7aUY|I2Lq!8$ZXJf9%y_T
zGzV_IfWe`D@8xM$4;d8d_g=gP?w5h~5$yoYO^H8*?&amM2Ay?jf4ZX9@<%{@=K;|A
z)CBEWpmQc3gXhITeKSyg^#0!tDqjO2<sE~8Ht1dsP`?da|F?n84GDqFKQo9x?zn9O
z?c0v%XatR0i5J%YzXVz*IH#emu>f?3NBxc$0UiwEksb^ZjG(@pLlZ*@#O?nhK=)06
z(y-$`#F{wJ9tg<2Bn&c8IU7*E1+ABZ$}xKX|7Z#7Q-abrXul(}JZN2k_x}%|bu9v*
zy(=CJ0$)M%f0l_186M0B9x$*vfX=Ol&zpe85^#)9BtXX#7#-&^xH!&XsL*Z(uYGX<
zjah)sItHC5>A}E|qTS5E={S!8G*@l{9e=QajwgWDTq;1v1wi8o;5kl^+o9tLpm71v
z`N*Jg0nm5?X#J%ObX)*5o&f6eF+j!z4n#1p+Jo+$0gqLI<`O{eK$+K?57`F=>bHZ+
zY|!}%pz#;bxfG!B8;5=1GXp^LdnS-^3Q^GhN6@&gg7$pS_$b2@(EOtZgXl`oo^jCn
z5C_Ov`#RvUE7097p!FXd%*#9&L|edp`gshXvnee=W6z+m4)B=*bqx;I|Ns97t*7u{
z5RKKI&%o+9m%*peuE8bzzkpS(=MU8L5y1CXfX7NeXIOy31T>xw3KP)!4p5kY(h6wJ
zPYiUd#Kwa`6jT=`crb|kg}PP3aSnrw_FRSlhj|R3dAJ<!|NlYrBq^Z#k3nnyy#N0P
z#fJ@OO{Dk#zkfk~0?i$Q`meheGVp-L<UsdedN7E9_7#D{89XKklB<;l*I%Hvga<>i
zASf+^&bkEMBU<0}0u+WK`tup&LG=n~t_+k<A#;BF<}k3@g7&N4fYlrO8R2WIbzuE-
z@VMn%<qB(iP8HZ1Ht+v_iJ&qBJT_C;(Bi=$BG?$uDO0a;x&k!zZm9*nlTHRShXGnI
z+Ufzi?-x8q&H-9?X{rexQ-0GZ&#3}Eqp79g1*Z&X9XzP)uJ5z}mDd55o=hI#b1OW8
zL>j#qIO@B8fX4R>YCSCiK;z}0ISkOazmo%lOsJNCRV`Q@rv}Ikj`RM%0M$_-dC(bK
zpnC;87=$xH_tb#WU#;yU5laUKg_)l4G5sD724PTJdIDrkt+1`70)ql*?xEK9;W|qP
zh8jy71}4z_4rrVgq_;K}EY46H>$$F8)=Q+Lo>9^J{~yq~2`r%a1MPbT*#$Zi9=t{Y
zw4W9<@3pT1bf<<y!@dU4x>(Q}<pyy2+1F6gai3Ajx*j~HGQ~QcLBo1JgGb0Q4jT^!
zp|z0u#RoQ)3QC7FK=A;ozd+}&f%ay4FbK7JFfgb<=GuH9>pbTDzX2+Xy#M=v=ZGBk
z{RfRv&H?EK)tR7p^<WV4ZM5f<0kt<A<}w(7*wC|hRX}$gf$}M6?Kwz~_y50VXM@gs
z0pEZ0{|01j<Q@wKR_h4R892WC7!;-`{sYggg31Gn1B?v&4>Ec{)_gFASU+S?2hDSb
z|7S1(t#JgE2_6jb;B(SI>-a(E^@GO6JQxIbS|&0Ecrfq&!oX_H0$bM!G85&@XwZI6
zx&I$J<}!+d%xb7>*x|t-SlemKDA_TWQLIpl!NH-40dzjs3TQYlDb!+60E^uN-9-dm
zgSe*SFQXKw{TuQe6yAciowkgSJ6rdG&pJ8a!62yFF_#g1U$OW9|Db-*5f27I(dM{@
zBlY`VgVql-blNgX*Utvu2@5JOPISy?l=EN^_}DR@QNCk8BPh<!crXZn`$8TJ0yjZv
zrei*%QpbKqW$*vL_JZQggF)b6r#+(zC@#Qtd0oR54+ep?9rGDgKx5k8|NqT}s+(E=
z=XV9D-PLK&s9HZ0WG};#P8&w8P!)E&LM?^{upjp|Y=Qb4R3_f=U=T>`v|-eSj`4ub
zX$INF3`?V+HEIoY4R=6weM4OX=)Oo$83(%i98~VV@L&)C^#$H6n8T>!!5|=tWEL}Y
zANz-nIgEN94E#Sq?gZ`q@L=G7Ydwd7)BFGb2+&-c^?wHN{VffQ3_1;U4M%n>!pk`g
z4+j1N46K%*bM3(M4&eAk+6w_Io2=(Ea9GzfXjt!O@aRZpR0PF6=q|$r{~4LU<8t%C
zYv#X%JUe6;@|?}igMmL2k`Fu=Len#-JpKV*gOz$4yuaClfgiN~O$CzIJRy7Y=l#C}
z33ty-kUocf|Ic*VGqQl=XC4D6p8t3-@bh-mGqQBdXJqZz&&cNe{|9LN;D`qU-&asL
zg5ufx{|`k_xzGSUuY>O{sE^h$pOL*|Kck=r1K(NDIRy*;Gx98$&&UBP^B3%A<O228
zK<)>fR{-(@=)3|C2EGLhtmdG7WAHo%8aLnX$Y24<V+<jn_CKh-54r;x6fU4Wb&$KU
z*fl_FOTc?)<~4%OsAL7r?RzlEf#+XA=U0K+B_0fAYax60*v^30sMmt`AG0>h1D&NI
z2M!m<dH+FY>G6QZ)xdKQ5H&0f^BPq=nB+piVKtAz1hhT^oTlbAg5nl*uN{L2Lzyqg
ze1}E<k2KUZ?(tyYJ?p^`-08u<*3oF!r~_@=g35al&{&xV121SFBBKWbTL$!850E`3
z9!#=tq4uPJ#>PPF4y+e~#_xGUA$4Lj=pK|x(AlCOIS&RljYb<zP<jWMtpMsTfa2C-
z0fU0~fA@u;^Z_a3e!N7gH+O*cv_kD=ZkX3-<H00b3U+@J!vc{19Of~A?+1h0*$JBK
zbX@d*LZ>YwBWN7e0epYSUqg^x-v57FBAE@^69w`U=$uL}kb69s)Xsv}0@XD-fZXE2
zz_Sse?*}W$T##QtV|E@4EMJh!=YgpC1HKR1`~R=29t^CY^HV_k#zA4_;lU(x5aMRW
z6QF%f4txK80PS-E*$J5wRtp8y>E8dpgYNJEhZ$%*4z#ugX&)_@2a}p^qcx`tNNvMh
z27&r!573@8P&@^I@{$Jw52N@0e<7f`QT<MaV8?k3Q?x-e=v=8z1~1UrSlS>Oe4i?V
zo8vwP&^^}+^g9{6L2J15I~f8T_kr$*0^gOC4Ql6VcQRx<&IRA0od(jc-^q{#S|<rQ
z%Tyn7o|l7uCquF0J_ZdB(Anm7jUk}Ek_Q7f=$r^2(3peu0?_?q+^L{_7NBthYtWfM
z4BVk$|J5}nST6wG7sd_B|1zL41nUK$yTZ7^_dhh$HD-AK|F5AZ1K#ff@+)|6g9igQ
z==>*89w_i&;O1<Y&5!}QA1<Y(fgx1WL9eF88#K2rU~zy!+2R2MSS_d@Vex>0$x?wK
zC47Yg_>8z(j>i?CG6!@{Q78wC9jF}yy8GROA<z(X)+%UTwV|%D1T?4JP}f-D!NBwb
znjS%MTjRkb1#TCB%3lwL#z;^Z>A}E^9RCd-Oj6MJX8@fg1=?o=Ig@Px0|O}ScrY|v
z1n(VdV#w*VVc^#9Wccqmk3j*{F9Nk6p=$__crb7&g7S$6(|JbFm;^L$a6r?MfCrNb
zuLnazYfUEj9Bok8w0Qsj<It%IHFMwp4<1bCj(RXK%>j?4%=-fhTkv^34f7g1y#G7j
zh34rU&2^0mpzs8hwV*wP4Rwt@pfhkl``I1#G0Z?pzXBdi%2PpZ0F6C>(<^wNxN;*{
z40Ja{E$nUx<=lqZ3=E(!YN%_R02-%)jMZ>@g3dAYV5mO{O2>`L3<;q22}lgoz5?y#
z1>G%G-~7V?ls~~`+P+56o=c8~eT^W0g3|E;P`otEYn<Wz-x<759yBM6><`C1|81b|
z-+=0VrK@1KLiV|X_v(2tDIElhp}1dZEt31^Al%Q<3396kLp>+d{V626e?k5JU*NM>
z>i>h*R&ZE`|G!z64PKwc04gg$WeKSKTjIea0V)3${agb&<HcbgLjl+?@IB#5p!FUV
z4RwtxAY~Z)TSywK%LSz|Xc@M~`~NSEhPuWLP&FqZ>FVTDc>3G-i>J}95j1YLWit5Q
z0(Q_osg&k_V6hdDwmSPn$QfXDf}l9{U^=<9`#%GB_J4-|Ab)`T0P5R<&UtC5Yuw?%
zz@F&A5DQup$l$o==Nm|U*W3!S2eNJ@w-kD(d;q9Chm5mrOkiL&azI`~fUSQHnlA_4
zedEEv_7~JYwn$)L@L=8uTJHhwXYB{IbLNB3l+XjEQ_y}SP+jc7Bo1~@eU(H2C=Y|$
zP2T?<euDNi$j@Pr0F7CI#&+uGKN11&TbRdS1M)ja9jN{9!6XLD|1zMk@c!?xw|=$+
zsQ;${%A;WY|3UjQ{vQFYkp{U7G-nN3vj}P%g8T_-$8RWMU^N7tmku9`uvxHbRl?F$
ztFii*kwK(kUIPPYZ78VC0y;m+LXknBR>dO#e16nQ&1>HO|FbZ#8uH)@J5Zc~+A3iG
zfYyEQ2cILt;laQPnoHpUiF+`xt_7V*4K5czeW<zy0S^XN(E3NvUK<e)23F8MX)X^2
zR#TAQKw<B}ynYV@s{v@8C;Ti9{dVvfEwH_CHZ}I#6*U#o6`*yVH9xJv=e2;_OY;~+
zYNeead$$}w>#-PZLOKPk8Xdv={Do@Fxhq078O%Waomx$X3ziHF47HA)d6p{RGgdgP
z&Hn$XS3h0hum?PL$tdf=AOY(4)<y)0I5sf|Om$~qvE*Q21nuRsj`{x|+%E;+CB*<5
z2kEH0y%}OR0|P_TZpitXZL=9z8cG=$8m55GceR7`?dCEFOq%`w4=9c&?Pg%8pK*b~
zVc!1>pfcNW-~TPvQUCvg#wgn(8CaUDK<y${@VZsd{T`scEodzbXzd7S{<~op0|WR@
z4F(oRka^JaJWqha6O=|k`J_>ifdRDMzwY5~P~X+3rJ8{SbY3Z_4D$Z}7j~C}jQ9V4
zqV;>FD?odk>Svt*t!o3d6+vSr5}<k+RDO9dFoVv&egG;LEbAF8Jeb!$VPMsJ0=pju
z-0sI*AN>Ke76cSW-v4bu<G-N$c^ztPA?Fo$dj9{X4>^a-0CYAqXf2YZ=Kp!%v2D=3
zTyq&D8si#dYO*}m)g-f*fcynb`w||^YdaWN^+4wrgU47v_FF3a|F6Tsz<@lS)c`xE
zs0qAghskj+!<0r91__Y6K=lHst^)P@Vf6(l&4SL)1=U}m_6jIGL1zSm;s|t3Z2c=w
zJ@8oTT<}<zOQREmMWZ}}!bC0x9w=L7A{T=I`0NKI28)TFpglYcGEh04iChdUjY<rl
zdnh#~dNOc;>;jGPfY((ruK~@iIDp1@CMq&)0FBAaRAguXwJ#<=WY}Z<kbz^SB15C4
zBEyLZjSO=@{gVj`85V%TWTGNNi^W2Q21`YT850;8j!Zbnuw=qRh7}VT8P-g6WY{uM
zk)gwbNiG+p)`P(rbUxVu59T#K46M2+<)nTy0~5Bg!*MQy4(N=#kYoWX_}O!s5_+I=
zq*0SW2V9P5GB5LMU{L_&XHZ;vFt2{Wz^VgUTLLei$TVLAhxr{0tU3+IWfe~I_c9oO
z;xQx>;(pLr8L0fL)$)M(K>^(k59ZYx46Hf|R5D)$)BIH@pm(D)IWA%Voe{&}{r_Ky
z2ZKWm7V$kE3=U^N;-Gjh)L>xoX<|?S@xga3LG**#@?Sg{9C<+E_|^T_@nCQanWFfg
zhUrcEFDSiv|NmcVnaFU!gLx(BoQMKYng^xvnpWis&>7p4A2RfS(l$u#1V)A_9!%0l
zL2U2;|3UX!Oz>b{xrBjL3v{jyJRM<6qo92X%`X`kK<!je`xnxOWUy#dV$gu(bI|%`
z=)F$!{y*{l55DIQe0CIQ-!y0*4YWQUbmj&q4TId^!Msw1fmI8%FAA&OAa$@Z24n_g
zpTvp}46K@<HT!Tqp#A}}o6+@w?DSw>0a{-N)-(Ab0}rUK1*KEaxs4tS4w^L?(v{%x
zV$kBi1O|rsmjRZb`l*)L8C1S=fXXV6xgN|bKy!>>b3pBSkbaPPj!g^_jtvZ;z84ed
zerM2qh@iF>sICCrY3Kd_e=B%zKof%uD362u-~5n)2b69>`P}>euPGq&A$fa+00XNg
zXq*ph54ikwV8A$=XrdE?2B`c8%~g2+zXI+nfW{_4=`&H2fn}l+0}I4VP}^(y4#=5D
z8f%cp5252F0?_di9Z<Z2!W=Xn3fi{~DqBHzG|DxA_MvHj%UHPv36S_iE(VT9xdw3g
z3ofJO8Wf=7pfXwoR2GBEXz%}596|K~=pF&@|5r>w?LE*uhWGy~nxJ-_2g7mjIeHHJ
z7;Hf8Ur?BN|Nj>XTJsFj2MSN`|NmS;^TnXPHk5A)sy9IK2%7h6nAcze)h7$m1DbmT
z&5wiI;}AI}@BjZmcMw(RHZw3dY+?w2>S6N!|Mw-x9LGM;UMB`dP@lp3|4&wMTAv3N
zV*-uCg2u8yc7p0Cs5=?F|NpoP8fSLw`+o=2|8to1{{WJ?;5%5n|NmbDjT0tNoOu8L
zR|(zE47v-P0kUp!83zNaI_Ta9c$_1rX;7Si;sJCwBe?!!XJBabVqmCMb^`6A`(NJ~
z0Gi)Y0PWWRr6G_USZpo>&qQ?w22eT%r3DY>r5hMn)llk<T4p5?P<a9BUtzVAkwFAx
zCn%kQ_FjSPn8?KdI)jM;RL+CMK<U`~zi9>os~SqXVL#}sI>_D>8JHiM=QZ#&+Awf5
zuVi2e-^*ZCll&sU`Z53e@c#^I*8e{+=+Ec>@35C40hH&w|Nr|4Qd_I}N(4N<vX8-|
zrXF;D&cB<`@c;*?x|5AD3>>vu5&`<14E&(8!$D~_QImmjq80;7BL@RRO@>53qg;c)
zgbc`D0MPwXAhYZDzX)iIYY<4@%K*ODWb#S|7SKMI`u`pQlV5@Na7uVEFDYPPRRzsE
z!Q%%s$Am4s9GjR78kzt9v3UIdN5j1ao={E(n@|q+e+|nRIBMFxL>gT{_x)%vgnBVp
zIqYLd0nPn@&LejK-LLBW|3}R$i-20qAdyCP298E|2A+u?3_PH`mZ-(RIMJPf1$1BM
zgl7yK@HpPX2)d6#q|vTH1{5ElcmkD`kU05Q0y2N13wYcTv~SF$k@^1*i!=s~nin8@
zoWS<fcYymyA`R&bJQFe)cqTG~)<A;KRb;GX2@+}KU|=a^W?*z^VsO!KWncii&xL`*
zVIG5qB^zi?$^kTvC^O+1186Ljal$hOfr%iuyMxUUXk-EV0pu4Bkban7YSlgU9Of}H
zXm>LHcihY15UTm&AE>UV)etKP)s(QP^>Q$1WMg2dRr3<5<qEEt=*Ga(=*hq_QJsNj
zqB{e}gqI8)6JCMV#4_v&)!0=Rs&#Rnb_WBCr5A$*Xsv*D2ZM;E2Sc>OTm}p64u+6W
zt;KehUJQ8-pta~7j3J>~-Ty4T7|KECYH4?{hFCf<)H%*&;0e_#*=Om+P!sARVNuhj
zB+{^ifup`v!J%e_HfRmC4ygTD>m^oDs}*1XS~~)|*Bs<FP+8E(!N5`9p#VBBN~F<)
zfdv%L;Ji5J|BHqd3_KH-Gw@7gXW*Fdl!0Ty3-EbQ0v^nZBp6tgLHQrPR(Rh*_&lTu
zEboB&myMA73_x)y1FDzd{C$vijt2wl7EoK;anJuR7Re0Up!}xa%peBZe-Tp8V4*#q
z@w?+*&^}J^T?qoUF~3B@U%vR)kj21L-yGloT5DkG%)rr*%m6wYiwPv=xR2pUqcQ_a
zqca0fBQpa>s3wCI=zL>X+Vo&x=&@8_un&K=tKPARAw;{2fhGLq#eJ5V(0J%#5V6#P
z#zPlFNchXec9xpZc<5pb34huB&r%Z_4_&MwmI{z~2!B}uGNUF`L&Bm~#z~|h102^T
z`t1x1j(Zq18kHgLnW(|QGm(>lqgFXcq|uXsCDDt4aiS+^9Ft{9Lo&!;4xspuX>^9f
zN6r6$0R47QIq`o7Xk8O%ezXB}F4-Rjj+&>|74^*)436^{Q()?A<pTorI~e#K_A(gM
zD*qBm<YHh<{?EWT`7r~_L>mT?i8c%Z6J9d#fYKw#-davaJr4#J4N%^j@P|QU!XE|!
z$2klVwa!5zjam#WiO_P%gMo!byNeODN5vu3>%~7y1_s7jcd>#{FA0lU4hw^ZKMX9j
zF+n0VFPtkT$}q4raxrjBbcW>530VvrpuFnAz_2IOeOFzm$Hjfx?cn}2B<;5|h*+{i
z!@Qj#B-CTEoh1h}%-b15LOr_wS#m(byqz_~k^vItp&ljsEIAlzLfIrNYVH_`G(2PA
zsBbp_r3(Xa-sBJ~sP%9#XpCWCsr7KKsCi`#b{i<|H#~=^1+Cp`WM^Or<zTR??{aVe
z?IQ!1WzGyd6CN{gfZd+XzytQLmRLb8SAapI3<C>T?OaBKT6YKVIxA2*3-#gv-S^A_
z5_4?&{{@^DRJ<!d>7ka}xuPK(6u%Lm`0Z$T%)k=zoWZK*zD0n38#ulkK=GCQpMepS
zc0uvg%FMt4OScK97#QL4w~~Qp!b%1XQ2f=LG}QB8V9L>NgQT-sWh<0)1xk0V&I}wA
zwHSCneN7JrCI?VD^Zx(8!lH$N(K4HXqo5shf71VyLUjga(3zZ#HlX{`11cukfYK#{
zgvE>hKS1>oDE-xUSU7;@kw9ud{;luw0G(R_ox^8PsP*swg@=Ge3n=|^fYwNS0G-L|
z{r}&WW*G*K<_HFs@F)f=&^^YW`p<DM;{;HBP+xILr0HLS2&jx`3};}dwf7Ry@B07W
zdZhq=_+ADz(0q*bN(S)WK=1$GTS0Xy^c+8n`sN!Bp#4#x`$ru1F={m1H3-yCyW!Ai
z$-q!+>jggF0900h>(ITIL_qZ?sP6P&V7LIX3uF&yynfPk@K}yOef5Tb`pjD*lPeh*
zicT`HgXY^En;3YMGZ{GQuH6!;-}XwRzV=3d^<Mt}Ah*?5zXG3Y;r;*HTaddP=P@j4
zjAUS_HIoPcxoOfJ29Db3AQ8}A<jK_xj1wan7$%o7usF_R2+*DdzN1S3R8CJc1BZ78
zXpNV3)c-HxQ4AKA4h*ayHKCg9|LQ%xD<)bnu+&;y0-XuS0*X&i``w}fe73A$BdA?#
z$-vO)0a`;B0NVS>F;Rnop;4|u1w+h+fum8Afd!OqYwbNCZIQjdavEwFIFes6FoN<u
z=q$;J&I~M*|1fZX?i{yBX5awd@x(m)3j?bx=sa`m^S!Y3pUH~XKy5)#pQyQ$fuk9G
zNA6G1nK_^{H8z0SvY<8*wEeoIVgLU>miGUD)X(v72w4hlbBKhmWU#7lh2C|o>Rn;6
z^#31iRt6QvnG7-7tqj8TFMos1A-B<PWsnB-uO`MbFj(3%a7>J6U;*8`F)<#@=5d_G
zz+-6-8c$;om>AC>U}?`FF)^M2w5Egs)b9f2B~W;R)=Yu=JfJqF_kV3i5F0e+1ac>2
zugq-FxG31)ptJ5l?fjZ%<x0?AJBJ0ZdX14odkzB!XfGOQju<o-44MZ9wRgP#|2UyN
zhk@U5E_l760I1%xPGAs#)_WWw)eIIEH4FkZ$)Ixwe}K<La9s3%O|A0dY1WVb|ESe`
zcn#FPbezYKVZG=7|5_V{3-ya%iPZ1)u(00y|3|I;ivaCTi23z<ABi+7|Nm3}|3v^S
zo<Z#yaGr<-w@={p4@ez2js5qonEd$vAJF;;@Bd%-g6?Pr>$QfZ5eAK#`dcEP^f6JH
zfd!N%AZpnE)n|HFfYOQg|F5kU_29Ik;K4le4g;$+sJ-w3)ZYj75kX-I+H;PrO$r)c
z0`=c5KzFz@epR(hWDo$KW5+ym0RyWv=zc-CITIKeL||q#Dlw>l+8&@jJ}AwB`u>ed
zptXby9H6#HO{T;;kXatgGb0#SrQm&RkbBU~VF8&_sLsF$HV1UyCL@CgsJ#kmr$XZJ
zKWJ<QJSPo4y9Q0(gMrZiWGBczki8zvGoCQ8N`dkVS#AfLlk6qp!8~IQ1FPg8<gqAF
zI<;890@@D?8zUD1xgX^A=6?+gkhukoN)Qd2=df77<Ytk~z~cR1<EHojf4QJ~a-tK1
z3djx*<{35&tdgK}SmExpNWgBk_y2E<ptx#uVo(9i!GOjNK<l`m_n2~c|9{(Rk?{YB
z2ZJ=L_y7NapgiQkzz_&J(-&kHX#e^|Q2a1YKLHy*wrFNxu{Z$k+k}AjxPjKpdH-+l
z1+A~^0G)*mT{8$7ACN>z3!w8pz+rI!yL&-n86fw9;t>>w4J*NSK?r#NuYbe9DzOD6
zOcNMF$TO<}G;ahx>ubLwLxgn#1Iq+Ph7#}p4Qt`<Tgc#HaR3zl^`)S(3v1BX3yusN
z+H)BkKzR;)-v0vz2hbP-Xq_r(o)e_k`+vP_ee>fA&{zX#j?jbg6K8$(FOmBFF9Jbj
zkV6yru49k-P6<%|M#9p8fn}l-g90pmLF<VpFJe%bya*iE1)x0W!92|d6qXhV3~V5p
zfmIx|z7Q$y846(e3zSD{;)UV!E#CjXFgC_DFifatumHs;bPNU5*9MPmgUVA-{~IdK
z(HPeN8jl2xh4X;=uuyT(_=^aX4eGl~K-m(YF@Gpq26U$xlnoj;fQ{FvG{!Y(K*hmy
zV_btyqg;c_L{A2t#<&Ips2pg_*96KoX^d+CjRk_-VbK`ZU;`Dm0qubYj|pipIDly`
z2A4*;1`jCPqfxHG2g>$olxqlpvO)dy5GWf$YcWKC`C1GyP&xrhr$FfpD4pZMJmm~*
zj0-%^SS?)vn_sNCWn2N8->Q`bjq4Rm1+4>dY+wk1j_ZKd(dvNKAArVtKyx{u`R;o4
z(-ok!y;~7HUZ>%~Q09WH2DFaBgCU<4)aL@7Q3A@7p!y9mk2pn#fmIB2&NzIH(mupF
zbs?bnHc+_&8nXhOjS4zz5>&>3<`O*^^1p)4;Dp>$RBa0ya|Yd$>;3=bO3-{K=x!3w
zI2Wjm1x|Mij28McLF-HZe*w)US%dEa$=+)9kU^lPLb?L9-oAeR0nnOK@Hqe=KZ4eX
zgYG!+V93^NRAdkUmGhu;y+QZz)^|PtrFjvMSs=9@3?-m-+dQB(5Z?d)@354F+*fA-
zS~t=5xWeKA14FHhLx2ZE2`eaE9TtG*XR1Ksp0NGe6B_n4aDdHoxm*DWx4b}*7%1#O
z>j=Pear^$8)L3(a_smb9%^(5Fn-&ikSRiw9B`1;0)`W%$Xb-qa!@dS^I~JrKq!y%S
zvLfh?trBoNJ2d>e<H1n*6{<(X`~QnXXgmdYFi)yrU=;z)_k!oALG>3X?ZC!GLF1I*
zc$%dQzB9;!A<Y!wj>?5lGeK*_w}9dfls-Hd@=U>V{0kUBZj%9tfyzG*hH_D;xQquw
zWh&^-7pQ&(@Bh!wdN44QK+b;H&)K}ML8Yb=JT{#G(hnM&1nsGTgk3IpT?IJYW`W|J
z!3H#s?fqX7yl%q+be|w-e@*i33dp@z#k~kOSG<MVsp0+qc_b*Ug2KXsd14I%t8fIY
z?f{1a^4#NG=o<F@ko#G@|NjA>5$Cv%LC1rkVkW3g0qutdjgNxHdqHI?IPXB$rhET?
z_69U3=fOM?zRthqg*7Pcu+(UBgYv1!l#>h`wQAm=JteiE`UTcL0F|Ynv&=zb)}S^I
z=p6H!*~%3)yR<86ZW>qA#spW?{IIUDX!!phv=#uCcR}OWp!_v~k--Lh9=w@%1!(<}
z2Se^mP+M7l{(sQ=o&?894B+!+KxrMcN51aa?uxqOpnc~>ptVsba**)PhRz}XKLggY
z_%(PB4a{EX9cLhaEP#&pT0quNOaQfY!Sz9{mUo4v0s~8pHpK5!xfwWWGonFyB+>oO
zz$$nE<bROg!STY#AOTIEHX#3j)8|g@3Q!qR^UJ!TR>m2cR+BrS@h;)PQ1%rxJ`G+M
zTGwFU!N5?^Fs}h}*EB<RE9m|RQ2umSz@XExufYbAUQ1FT`WZVs7|OOn(~X1o|EG!`
z42&fW`x;z8bKed38f+{cFtB?t6skhhGst)_l(mA+HG|sc;r;&!==@WMhJ6h_AbUXO
zL&7r4Gd$hR4m743p3!0#o^{C1v5CQ@Q5k&35a^x)i*QXhyV;5i+%pv!IKnks>}D!5
zaE5Ch0?}O74;VORJY?XR$;iMv(~*I1b|PrsI)lWFhu|?TmYIwUoHHF6xMn9Za5wC0
z2msj$v)_Xu^K8w-Um_s8L1&+Zx4PMdceL1rcY)pDf#e38a8Eb8nd+eQ`Aa0+y~S>}
zCj;}0mkf;I?uYDVykuaq_|L#GV<iL2Oil*YnVt-6vpYfI!5~ws_Df{Oat4l>oD7T>
z{~1_jdNMH0?qpzY*w+vOatA2<Amw#F_-+SCnP2MJFs~s57IvU^jQ9V?Yb_HQ!21+E
zn0wDKu=0cEbKra4KzU=|LIxXXy2t_DVFFGURnnkycr8G6OQT&wM8mv>m|9PlRkbm$
zt3Y$$6BQW*KxeslFl08?lu1`QHZXhutxvFKWRS30$Y5Zt$e;mgCxPy3_Wr-C5EQ?T
zO$=um<~1aM^BVJE@VajgCJs$d-2}Sh6_kfS;q1YXkqbS0ss%JB1FEYWCqeeZ*1_(+
zVf^zDd<IYT$#o#P=7$Uh=x6ZggU*Bnp9lMYPs6^346r><c7w|{iw6vBptUF7|9^Wn
z>}$xuBFE_c|F>?#yoMA|`3d&RUIs=FCU($WO&X1j;PzGqB!BjR_VIwnVL|t-gVvf(
zU}P|HY+~5p!H|*)iYHLp5On7#=sdLg`43R)RB(8>U9Rw8NWO|$r-ILBL8?=8!FSrh
z>eR+q2A=T!tagpIkg^C|w=R1PDjyj@a|D)}0`j$*zeGYc8Pve@6Mq?4>R*7)`N)|F
zO23Yv^9&w?_~1Kk7$D;c-D?<Fc~SZ|DD6+seId}b9H4bu-v1v$@4tQsE`vaA4p{ph
zR2F;xe+cR$fX{xmSis=0e<6bps2l~K(+Ilfb@6LZIUeKvU-~F0ZGqw&R3CuUg7z(X
zFg{xf>f2f-GDOrQdsV>hX7OO|2Hh(JE*EVMFffAJ#-O=Xkl7aV8Nl;A4f`2*JQ$z#
zHrj*FGZH}6-vvLr&(fK}24pYD43J-2wHRRQ)OjqD!Rw7afZEp{%w6y^!olMX^OZqv
z2j9a5T8{=QOTGX9Ut2$40yGvDU@6Ps0N#K2pMkMf(?PHPCG#@ty$m)Jtr-|VesywS
zkZ6qs&p$AO#{EI_B;No3zX90^THjHV>?8sjHwX0_K<dHz5*ZXG+JNS0yFl$k_<2a)
z|F?63<FtuEq9d7sAtRX~uO^w{LP#?IKTsPJG~Wq6FG-OByiOieKQgfLfc6W3!w_6Y
zAm$L@{a4W0J>LJft%bI^6u|XN0|R(2546`46vv=C+k^3^4<w8_YZzF$;rAZmF_*{t
z|2FV?chLAR*sKNy1`ozxp#74dehTQ!MDUz6XztyExl^USMS{V19%#+E<O~K@Zcw`e
ztJ^_o091~F>sip+xVi=b@BjA}g4_-gYuMKS8B0iDU;w!t<OdJNCo7<3H)vc;roK}H
z)Sl&ONM_&wg_T7z0}p6l9LOyoJ_9QkJpF+D2r73$X$M-CBEk=})~~JsbdRkJ$SzRc
z0NLmL|Nj&QRxZ#wJGdVRn4!=xuR#UPi~t5!E|fEx2$-SKFt0%e%?us}RxWrOg9yJE
zfZGHd%*zmd`FDbWl@m0E0M6$iGeCO-_AA2cmKa!^Slnk&0G;~+s#}`(HGuZ;fzLkm
z{(l#A?;v>XzW4t-UqR=if%@Mb%qieI6+m~XHY{Y2fZnYN+FRq&&<Hx``p(IQx&{wW
znc@Ba&fboCkl4RW(7J(+dInkV|Np>u{dLrX&dUCG6I2#=)HBF?|Nk!tx}OVl-z<2a
zt?T6q(7sgf|92`uXB|P!%LSdO?fw5R=zN2ahW!lS^JKmM-vOP45Ye!o0el9c_y0St
zo%RfJg_;b1^*b3@9QHA^fZE5Pu?6q{zvqI?0=cK5t|7)+kwM4%{~gi#ITt|dOk+TO
z50F}LTV3^Zh4=s83qf~Jfb@X+l-~buzXaX=?fw6+D98@|PVo8iGN8U3DBpnYhzF@{
zSO_xr_Fm9lJJ8xiP<iRW+<FI;rgOE_S@pXl!$5mLVP{cI0N;rfITutWz{=E+WDXnT
zJJ~>G1}LqAFsOV4(G0BYp!ERowV|ML3B1+|bjCDf?%oEprVo_=Kzmm~>j^;ZZEzb?
z8q&rDjfXqzWl(8IVc=+(*HGd8UsMrPb~!XLD1gq71KmyS!N6EivsfF{wgulK4BBT6
zN)zBVAZU#`<CnYM|Nm!#(v|oB|DZLL;Pn~~^B6#9;njfhx%dBDpfMj#4+aia(3n^A
zUWN{&umG)5Y4HAkE72n1|2NQn9Z)=Y|NjXtlR$G74RsAI-v4hoS|t4c>cPN%5HzL;
zIXjenD@5&ILFiZjXb*0O_y1d>5b>YTJx`$X6&iZH|KI#;k?{Wu=w36>Swr6cZ@#ri
zVBq#(V9)KeX8`RV1f8)j(`nBjTi<yCG*>GCjcaDdeGF?L{j}dVp>63Y-v4i2wMh8?
z+57+h9MBm=)(xOK>gG%j28IcZw(vXWV>)dal%VM`z#@Tx7qq?_eAdWZ&|27=6G7(z
zgU=)d^|ua!<}ZG#g7(*g(k-ZO584Oa=*Yk^(TV}wo&eQ9pnV?}2@HH53~ZqLfk1c7
z^MKA6@c#e*grz-$1E|h!v<H`!puU?0sO{vz+#JHd%DMtJ&H^eQKyA<cj_|vsz-MZL
z)65+3c@;dMv;#WRx8}DsxL*S5gMs!qdjH=5xm$4_Lkc1-e7Xpl^8xiGL3iqa?tH4X
zc_lJ=J_7^D&7k%jIDajDUE#s_tP`}q)?pHZ1SsuJw1=nxrEk!Aa^N|<d7wM88F(Bw
z{eNI_;QxQH{w1#~EEWhbcrZRc3et}%_JR>KJ`PG_pl}1PF{*1=;{E>yD`<U<2LpqP
zMFMCpnzgoJKX`xLikiJzA`^BqFo4!+gVce>hGA|5wP(El{}hF!mFow+|Nl>c_6ap0
zZO$eR238hO{ReJ$g2EHj=G+Ip0}Zr?w^5CO0TiCit>8Wp1E{=p+{f?+e0F#9V@SVm
zzjg)at`84}(5axYBhcDM&^bJyGxM5$GcefPWn{1xH(;o>IV4iwX#i@|@YK(F;oz``
zp#qd9LH!U&m^|AEYWF%o?)}{0{r@^IXlYzSUBecO?fU;g<x|blS0dj3ugikc1Bef5
z?|U$$eFV2FAZycic>n*}3);^N3NMJ?uN|GdpMhbrG<Z%>0~DY2dkg}=c0<p3_h5Xo
z6BO>Cxx~q!@T>==?W(Pywk#-)JeV6UFt9S~Oi}y~4=Yf->$fm4gWBuR`q~6EE&vLz
znm^VRpfU@zjvZ7^fx^vUE`viu72-?|55^CP-v58Sg_J$NK>H#==L(pB%0X!Pa|2TT
zT+{VnVE9vW*ti0emO*<}A>s6Yiw6VvT*N(4b*zwb;|J($?hfz&SI<KDUrvI;2Q+2}
zI+F;rZUQ3yl@m$)2y_f+g7^QcQ=#Ps2WajEbRH4ttdUN826<4rgo=UoCc0SfXK(=Z
zB|R8|VPi6&y9GdZk7<C~&5ia90=2PPBK4gC4z-+GA`WvHRO&l^IDpP*0G&JJ{r@xQ
z4AL{8J+I#XugZEbFdP7_od(4%Xdc4*KR@U^s|OJOT?L(!-_vLhFPoNh+QZAH8K858
zAo<|RUr;`<XkY-Hug3%GUwi-mG7)sv2h{yJ%?rV2$-V&D1L@;lISKJc&_z&~K>fJJ
z`~UxhMq36JQ27PDe*xsbH{SpMdw}{ApnV~e|3LCSC_jVJ1gH-SYFmTK3~>4Z->FkK
zhk=y=boMEHeY?#uMh4`yYVdK{z1pC2OHwQrK+fg!V0;W3GXkv@1+{a&c>iCW3R>6c
zun1i5eSpLz?^cjIAZ$L{n&e+16KdgW&Nx8j2V@Ma4!-u)<|rfRj1qoue+RNJW&x=0
z;=%Y>6BGuZvIx9Kp@{*cZh`lIKG2>I&>jhxc>*5HwKo`88A0tn@H{H04Cz$){~!50
zYyD0JPH>(8l@p-5(pvui2aO$p>T+<tn8(ln%6s*l7Z@Dog3oDS@cw^U5F`d#rvNHj
zL2YKx8NkrJ5uh?8q0<&zCUJt)fy!%8pD|REy{;zNOT_#CrHdf(P)!C4OHJ^cH-q>8
z|3^S;Zb0UB)PnN&rB>+q1PtE)FD(SAhuH_(_Xe6H29+~lF>6p?spbZx?ZN;GLzK1)
z@|~)naSE`1=PHBF%HaXkgCKu8HZh2J|L0i<YCA&W>5}eb&{{>%{&hzN9&1Gg(3va@
z-v2M|4asD))9(bITN>a9ITME2aUMgAekTKm<2;5NkaP^*1N=iDw6|g&LjdT$8U0QM
zUg+M;2l|~1;*R?mGW0tc>K*qnECHR13QC_1bqyS#Gg`g>UtC*L`y;@Efl&h_4oV|4
zZ9!!uqXa0gfXCwD@o}*cBnA!(MNl38|G{KN1|CS>`5yqP@4;@G$DjbptDw9DI@c3C
zF4_LL!u$W<hoEu}rp{sSe^5IGboPw`XwQuI|NlHNImdnf8E}{ZzH8b0|Gx)NwTX^%
z84^OO+3Y}VTkY8loS<|7ny(E>X0NNsloIj&f8iv^-SBjv2woc~0_q!s+J~U=ZSVgV
zYG>CoFo4EGK<0weh$5)%@eg#j7Q6TV3$fn+|K)(jz&x0%&M>h21I0hQzXb|AtbMk5
z4Lmbd7#KkPMOYsP)MxVk|Mv(3%U_g!pT(2^e?a3_$mW2?d_d_4ly*9m85p!X85BTe
zILPgw^R~4+L1)bT{{jm4nha^s8bN{ZR{~bGDuH^SbDgK8Gq8aC1Zt>&=5s;&NwvEe
z6f8BsXX+|wcY*XXNYrY8$Gz`>#u#c{JVAOD^yf1OfXd++Cm29`np!~Xy+P+zdjCJa
z5Y#^hrC$%`${P$Ue+8x}{sZqh0OkF?4;gD9bs^&sP<(^jUo#Cdf8qWA0_<!V4Ww~4
z=$Ubxo!ZR|$<X^<M7;l>7X+n84+drjt44+kp!5K`O9`}o$NN9WNl;tWT9F~gY5{|a
zH6sHDsI6l4kkO>m1Y9OCIL>2wQa5)oXq=m&GnRn?>i-1oE(Uc=S@1o~5}mRC|Lb=#
z#5m4lu*lQ|?K5LA0EMN)JO&l*E(UARoK*eX1)w!v2(|k_?JoxK8XwSn9;lB5$}=D~
z$bD803@P6KIrdsUfQ-$6*0I#vpRUknW?;~t#K7P<i*b$PJjN}c^GU2s7#O=s7#OUW
zL306&A=;A}VnFFv8|)?~6a5Jc3>L}%|2fWMtm!IYV6-w}V5%vQuCR0fmjj@-f(__g
zP|#UE+LIa7Efv7$CJSg!W>5j`V+5^30+|I`M>VUSfx#;1|9?<=@L*sR(Vonp;Rsp-
zJDH){aUR1D{Yearv-X4Hnn47l29&0)96)6O!<$+442)Jm|NmM42kqfzxS>6nK@&9p
zqdl3S)?pvRf!Y@pKS1hhK01lk`ga6?#shOb8W{9Dz<a7VK=an7UjP4t%D-BEk9D;Y
zp6ft)3^YbntLP<C&wRLIwkN1eS<(yYzk%+VbZla<u?%8htaG1S0X}O+0kodnV_lu6
zML=!5mk4N$BdBh2a$pdsm4}=60OaP{c+j1a3<jVu0p%A+7%(WHh5>^}oqjhceK3K>
zwLtE#V{Wdf%bHzLX97A~>|X%LkDz-)LGrWX|NjTI7eVI=gYL?zDUq&pT*Oe)kjQA_
z{r^}XsLThgw*%b))6fVKJ5veT3lC}|)KBpM)oVQ7|Br#r0&@WMYd~Ywb*+mlK=VDw
zd)2^qT7&L9uxH??pW|WS{r_wvs4fPzN4)?4`2e~Pp?(YKUYfrWpm|GB{RG<Y=KcTA
z70_7+j{E*ufYZdj{~F%^|M6HRG9K_?F8#v5@)I<^3~zfN@2LarkpbmXP+JC6)-=p(
z0G*X0<Nbe8BxFu-(N|Fa&inr#(77ub-v57t?^bkZWB`pvf!ael-v3!aXH|mQ1`7Jk
z|Nn#bw?g(?oc08r!BNw|pcc|1{|_`j=l%cpMNruQUMn{D{|3<AH?voQ>f`@Q7+8LQ
z=9}Pc3D8*@pfOTNnZlp~ntKDe6+BLQ7jo|^$jzWLHoX5I1+^bNT53USG8Q?4!VTJo
zG6CH~<Ng2CQ_%W*(0Gvd|KGkKcY@LoD7}Nn)93w1*>4G||2>#XUNEryNI_mx0?O0K
z<us@~1i1<14$!)kiJA-y6Ezt?cSVEN^)Yxbmuz5Q`2pH@b^|_-rU<`#MhDa$0O_xp
z37J=fnbW)yw06?FqJHiV&=`*fXpc9jZ|D7=#S-c_P}qa+{?lpR3l2Z%Swk$gpt)m<
zWCl_1|Cb>1VxYSM>Kb@JXTE^UfUPTl)JG@JfcwC^LG2S3NsD?0k;(rV7(nVK|7TzU
z%`Hr}XW*F}4_?2;;r*XEwb7mdl&=|TJ#Vf9?b86YkthFUU;*{BK<maPzhqzl?Pma&
zr~4Q<pnDoLJeZ3oFtB_FjTa-*BB%`n8S{ahYXO}X0EH!J{aCH7cSZgD7oafE0o_{w
zO7q_TnN2}u1*oqGvL9qV=q}dg|KM=A0;;b-?)UzG;v;DM3DWj0R$yTHhO+Mr)L%!A
zOHe#O!=DATeih_?P@Zha1h0V;@L(=_!ocz^1bGZ%e<FhjG<|~NvJz$n$Zeqgz25&%
zfaY5&K>h)xUo<~~?vdpH`DwyJ295~_LG2Ev$cBXs9H2OEI0!!DT?15RfYgBFFXeW{
z?nDL=P`P2D$e;m=L%#+V1*qTGApCy(D`<`#<bMz5A_WGPub}l{h%`vh-N(0r`tZcN
zn{go)cMFi=Zd-)A3o{s4zTn)K3=3;ex$FJ^*j<oY(ejN%!(8y0UNYYQk3EIvlNX>f
z`n~@j1K(wa6wjb}3DCJjDh-{G`3=w+aG>+wy#F5q-^<{^TmT=p1hx4=^G~2YKWNSd
zbbbivtU=J6KWOa>I6wcf2DN>!g5nZXhC|vk3?YjjGH~R-{QqCS6IA#Ae*>xmLF2}t
zJMchec>n*q5R$(CUjUth3Ob{*R`Yj7sMe-^6QdXyLbaal3)N(|n;Ff(0KV5G5wwT9
zz<`0}^A6-O3ea30^7sU3?hqViZkH=S<qjx4g3`P9|G(h-?;PeaRDkTWUeLe*iZ@VM
z2{NNr?R7=SG0?pNe_`jC1Z-Z&z+t_B@#{)O1`bd@ahSv4V7?bz&+8!T1@!^E|NjB^
zt089`F~9I&ym1mV*4I$ipyB=hs4D1uBye9DG>^!fU%<ff=>zf|Nua(k@_G88K0VkU
z2R?~-|Nm184PVe$td95pBY#2p8q^<OkjTIhlFXt6o5O;X>G=u_ET2GkWg+qc;>=qe
zP~Q|}Hfa1A5;p%U!RF5ctqEp+;laRg1l+%Q^1A|bb`Quc-v56?#-Qeb#}z<p9CAS6
zn5zY9V}jzCfu~T5hXJ&<4@obB1vtO|-U>4xbY3E859dNfka__I$3+a_H4C8juf+le
zR*QoST;BhGw?fr}_VinL|33mcOWVf#{}EQueu#yN3|yg_tQ$aa0=>&V1+*5rP)mWq
zVbT9Dps{CA{_<eX6JcQa2)YxE$Z+^q2(?!O$q!IB{X+J?1IQgnYPcX_^b35K4rsq9
zq-}5*w8muxS~w{bYH=`t*63R#fY$dgOtDB{5G&MTVQ^T)(1BzoH0*xC;|6+9hXGR9
zfybs$!|s<S)DNJ!9}n;UhgO2z3JSAAO-9gOS_V-6+57+hmO?E?Q1}ag_E&)BcD(-|
zS_*OtB<yl-FtB_8m8bB2AaXr|+$I3cZ+kH3tYKjJ0J<ZBpn6dMwb7G-0kjr(qBDaD
zI4v{h<S?*&0F6H`fVUwM8GNAiP70_T0;O5&Mg{@v1O{eMx&@g7s%yaQEYLXj0tWEf
z8c-N||NCPI3Kvj5_5Sy}5;V6B5}%yNz%fygL7~x}L1v;NgG!@4gU&=n22lNDFj0{~
zr_r84WuhX3Nuxc3#zaL10}lok&*uLOCf@)5&#_EoNbq3J-oe1~9(6w^@>(wFd4X8m
z2R>UHG#=;u?{_4m>;s>>0B$>g(l6AWE1>!eQlDpsFtEG_-C>6{OhMrRvIi9Y-v9rB
z?nmVD{{OGh`~N@CI%LS)ts;W}sQ&c+|383%<sE1ZC)_O1SQso$L3?RI<`rr|*OE6e
zfc8Fu_FaI+FhFy>0^a}ser;3+t^EV<$B+Q^`$2Uya^D|RPcyK*LupTvVNY+PGITw>
zCIhI>0=ES)?Rkr`{(=m9R2!ASa~L3hs^Ip|Ta@`{((U=Pw^12<b{NPW4LtUM(m&St
z0re+9@dJt{P@IF}3Dn<2+p7qwD*_vp8Ng``)URvQWB{$d#SwmQP}UzH`-^z{em`tf
zW&ocJ54Fz#m;XRxiy#cj?;x6i<&6(=9SF)3$bBJ@e?fi)o#zD7<H5k-&^)h!0o3+y
z|HEJc>eD#x`~SkC{{IzFJ?{PQ2cz}=|7SquAE;jp%I}~xA<%Z?6-eEf{sUwWXg?)v
zJ*GtigAJ&^2=X&1??Kk`pS}p{GuPCD*NK{d$`XqO3^v~Xe)w9{GH_VT2k+w*@c#GR
z5_ESCDF1@ggT|CVegoxS5Zi+}eF6i^Yn1!|%X6UchWXL^|NmU5yTIp`SUhGhY2*Zt
z?V3z@$-pvEnZaZtGXwZ6><KTx;}%F`)aeEcEU!W9hu~!=c;1ka!2!Me1o?4dBZG||
z3j+gq+;-P%@VsGjT?0$a><4=FmA5PETYiA{B}zC>Vp!5J53;t{``<UvS#{twRu(OA
zzdP#BVc@Xd%OGGqhk*sOPP@?_d{&GJD4sxj#6kO&K;bgcp21|IJ%a^2-auy>*8e{P
z>XTc`|GyHxM8FEvMy#2oB;x(=8>Ig?kAb7U@}-_WX#de(u=#hOad`lm9>8JH*vMc5
zDw`p5ercewdT<_^(8$063S;m8f9HbI1n7Kk@LB*y1`*KO5=goD?+hrtS|t2`3ljsy
z9|Oxv(EbAWIt`ly2DXG`sRoM%hWh=D4AApt8Dgv-GH`(65L7SOFKA#$-V3jr7%V**
zOeR9Gh4+7TO;Gv)^+Q2pi{AgfPHdRhz*FD+xWfD2mz#~CeSnXDS4>_AuAekO_wa)2
zBfAC(aD8Og0IIJ*cLVN3GY7Pu5!}D>{`X~Kqg?~|J_#gqK=m0YO@Zn&6HuMz{r_*N
z_x~R=L2Dnt;mDlwLS`ugr%VgOpPHpgA~lP(L^@R&wL4iEwHCTE>VWoIhH{GS0<EzE
z<;97f40}NH+lA~5pfg}48aWyE)OR^B_{?Qc0Lg*EuaT3X21%?2B*wt<0@M}*#|>yK
z6<a<4?bGPgf{t<SW3T|#@u2;z6FDK{jWe}CX<t+q;_jfApm=rM2RYLV6t>>~cRmEQ
zO(60q5)3RaKz(tzov<|=$aaI&gW?cW)`0rjja&>26S6?#an2PU%*j_gn4`8ZusjFV
zov8V%ks$z-znT{^WLPFLs83*INT~sxr6>3Q!^B1gA3a&fJ)t!ZtSds(8B81|f#-f$
z8j=|pK<);WQJ{VSXuc9OrWfjU$S(Mmi{3_e1~yxV28J2O85ly?4%y9E&cFytCjo3O
zdK->2Fom)mvI~T;S!z|iD<;Npih%ascrb^6&ntD@^M8%wBnAu6+(n}er-=1`P(O?T
zw4PGLA_3GlIim||Gdaxr{{$otYDYWl`(M%ghf|`lkpZ+mEdi89A^9l@<Zp2Jg|s;6
z)tof0s7=ulu{glc0Lohy3mDiMof$G3m>C#Sy&4!2Js287Ua{C&JYYx(VQ|o!@Q{I{
zmW8<@G@Zo`vX=DUUT}Vcwo5?i0@j}c&CTy;WDo%LPe5~ppgyPd0|sVmS7wHgpDcFP
z3=AoawG0^`JHcx*4lp!K2AwPJez_twyMdv;<8eh|HbX;5ii2KliZXbwLw)A$ih3>3
zdZB-=;PSPRfyewm_>Ax!p#GQ#bK)HamZzwFu?GzQk?Wz5IV^Ud^bxX`%?>o?0$S?|
zs)Imt)u1%v{r^8`ERNA}FM|(gz6GWR6epmwIKBV>2d%{bt+$rx0F66=_6|Vj<w0t^
z|NmzM-Sq}KBLUif?t#r8ILu>6>9mL31?sSmAp&%lr6t4v>6V@hjP+d-pg5Ii_}9Qw
z8}G5M);(YyXg{~ZA_mae(x9`KH9+%V;ChIGK?XFg-020rqk_R<-~R`enhZ>!JtrW$
zK>IX7`?)}BLy{S6K<;ta`@aNIXC@p0ulJb4PywqmZ50~8bGx9p0@atb^3D|#l{rN~
z>jFHOgTQ?dhdm4mQ2&6&Y#Bi5&|waP1SAcfTnS2pjkcU3;B*+vDKRmIfx*!8|NojS
zPXSPW7F36NFemtc%mAg6f=-5pke2R$Aua57pmNBf1>Aq)uxMeB3270qs!3K70qqwD
zsfD#GEEO1aEEX^@S{z_t0_~*%?S0+f$RH3hr{6AQKAQo^{SD0w8TB2%D?sPkgVyMP
z>MQUWt6rcpR)azF5e(k{|A5DY9UB-d>Yp%}SStMg7t(UGE>`n_9oX(#C6PvFhLTz@
z4~vP;3?+@u3^}!)9u^ao8FD~n5hNVr8yHv~gZd8e@n4Gv44lYm4b&$Gr?ow7cA#}_
z77YwcpfmzXZ;-SG9t+?AtzUGU%U}R5M<91{3pC8;6!HGQ1+?A()b|73HNxrrf6GNs
z_<`1nEVO4}3bj3C7ijCE7rvauPP?56dbVzZ1n7JQ&>g|v|NmbArD3qWt&b}}c6<N-
z!?<}r0~5p#aXT1T9)ZTN;p3Y%9m*9o%eBGb1WF704?@-}f&9^_%qRwOH)uWt)K_qF
zV5pJRV)z59OFB+6%GI}l&p46j^kh^6g}Z(ic<u^x?r93>9Da~{K=EVg!1x8UM$cja
z12^cNb<o~RP#lFkXR!mFg$p{@7IYpiXzUtfj`#mxp`f#*92yxwcLjjP?LlKF3bicG
z72f|h?**N`2TEU{^zOkN3(EiCGS1=vLrTbU7Q2uR7CVq#pfavenIR)ptAPPz|Ad1K
z92N%{6hU^@x`6kYFo5jz{{QnSmU0bjX2?<pJ&<`d%Z)+%vr<52g2q)qZYR?0PAq1F
z!yjaJ%}eWwnx{sPGh!GSWGoIaES&t1K_p~8iyhbwXNHW%W@!2B&Cn3a1ulzILVFza
zCNeT`)TSg?fY!Tv|Np573KI|Jm?u*d|AOl}9X1Ar{f<l?pmX&nFfyfp&eaF!y#(;x
z1|LA@&N%M-{{?hbrQ^Q;Z$M!Wssm@LGBAM3Z}9rGS;`fS${c^d^~^j57f?M78gqlB
ztzVFJi+lcW0F^`9oeazld;c#1#m__=jz69D49uZg4tkyT3{174GX-oo85-trLdNbu
zYf+#5uJHc<3sSZ>FeF%4|Njqi1L&S)iw6w$^<CgK<~;SCHyj-IK=#ms;=DH2a~)_L
zs+Q}QNGAv6zGTpRSj}IsI8QCtk9D=Op6e{V7??n57gSDKCNd>>Fh_4;V7U)U|KPX<
zwPR$JITMiE6QFbtO7o3z4JtKRULv3~`#|HMpmQNC62NC433xC^*D$c$2bHIAbFi9W
z*PsC!E79))&y9n|!*nbfKx?}<`~;Z=IvX8yW<ssHcZIALXM)8la9PIy3gcQ2FOixR
zo_Z5bae~qWN6ks*WuUZLbIMD^(u;wm=7f>Rgf>nMCx-tYYBjt>K=t!PPEM5x%Ryr^
zoF1TX0=11in4>N*u-pT+1Hfqx<Y$oi77I8NK>a3A8wix|Vg7FZ*Pzk7uR#U8Mk)FK
zf6zJ`nPkp{np!Cl?|-jmg4dxq{QnP1YqFZ03AM4FdLGPC86f|F%5DahdkIq%{}#Z;
zf%Y{rB|z+8ngZ&-fb6ke$e<s-m%#)S&ffq3p9JmwbA+s`Gw}Yu{;mfD>lsT028U*Q
z28NmTjO?Jf<B9eR86Yw6`nboxLHqw}K=XbR?HTrf(<5Y0h(mKdr;7Lg@8I*(9Otm+
zblNhogXSVZ=5*RJu*|e)1f7Rb(HITBSA@a3no|Wd|89wXH%T<;>=p3bmI&yqQqUQ#
z4o&~xfcm7MGg%$>fZMGm-v8I@dN8oEG}Lpdfc9BhEMyAsVBiAZw+vNd0TTCMV0hDM
z&&aOb$sjP%o}mWhZqQm~$Gr?9+MVEYqf9InK<#4&&|OOkpm|g6P6h|i-7p~kL;I+p
zGi^CQ?FdkKG|XpUu~cA4nQYI%0BZAr>OaspY)H!mF3@@nP#GJp4lXaidoe)i$2x(5
z+x!2Quh6;&RM*%v%;yB%>Ei>s(;IZgAEb^ycoejb101%Ge}mS1F@nbaEgmokdH??k
z+AARlt;ckrW`W9Rhngjz^~~!eJs6ljfW|y68bIpTae6Q?Kd`80WB`q!Su9`>^8WYY
zprt({)53U0rdkJo9ZP#gj)n1z98fmb!gxk5D4S<tJR=W?4RZ^~4DbIxz+<ZpkowaD
zbT<O%UIY&Y=AOy*41YT2GB9elFff7UH9+H|pu3wo<}xs7w=i%*#XxuVL|D`_3W3bC
zSirz()$sqn_rDjK-SUh=v+Eh9tseaU51P}qI>5kCZ+l3@Y5{m1MvAO8!yiz4%+iZd
zpz9TbsQz>Y0f)Vep!Lx?9bF83-v8H1g8IfD42(xQW->59%hwN`mf*G^tK&R|3;LZ5
z29EO>L2D#H=~1QAl7XRK!b=2X&%$^{5lagOM(~=xIsXrM|Np-Q>~6^TJ?M_1IhGa-
z9ANo9;4%FO&^oD3O9rO;&IO>k$bjy8Mrr-o4D1ej!Ra){`~R9)&{}FsYX(O7Xof#C
z?HQ#(b2>Hkmq2w7r$sWOjQ79iy0!L~L}s02RGqbwQLU?!QO^7S{|x=v|NlGg`=0>z
zx4oALxW4ydV4Ug6s0LbVsNKTA4jng7@czF>7Ia^cr3C{UlKVho{2d^39OnHy0=nA>
zG<PQ-&cJCY&cHa6i$N6Rmij0!kXzV6ZmN&JBw~@wsNwzZ+02Dej5?v7hwK79UGz3u
zG3t2#|93^Z1$?(QXpXtS`~UwQOA7{8B>PH0^ZFqBK=p$DboiWqh4=r}q2B-hO_3>Q
zU<26+@)M{}0$P_>Q!fRwbBFi8XR6-+{}q7N^L5%Yiq+2r-=AV4AItCuw8jVIwoWTX
z1@L_?d;Z@6%|V0mA1EDx?lAHG|Dh1HCa_^XLx!aTLkg(O1j%>&XA}peGf*1{ls7@`
z5Kuk^w|y8OePmD`_5S}c6x82wXkyqhp`IbfI-Y@JLOnwPq}*mu0Im78hTd=D{qHI0
zUPaIvNCi;a&->pK(0T~)x&5I1Dc=8{Jnfjz$OlP-4B-1XLFYYK901ir-*0xzXXHnb
zOT7(h=O}pp|Gu|lKBEAN+|t)DxrHGAfZXH3zy(^ur2ty<1PXJ|oyQIHIVBqQbBcKX
zUnOYW0IDmPCV=|D9?T&!3@kT5X8@zDQwFWUL7oS+PhemK*AojE7_1%s|4**g0k7=_
z)lH!Fk)Uw}(Abm*1Ixo^(0-wsSD^MX1E@~({`dH6ee6R$>%E)_^>c54)`x-a2m_7%
zFnIr8*$AqqK<);e`{BXtw6%F(1A~6^|F@3wz;||o_9etL)HSq#)HKfr&DXE=1+Cxn
z{{I8Kx7=YLg9&IIZ~YtvP(G7ssB7q`nWGTk{ePt@XiXDny%lI3M?)QGPsECspmju`
zb27dE{|Bujo&XwWZK!LQ;{AWcSx~yLb@<Pa=*6H1UKg{Mv80B9Wz9k@1_mBZ1_mDn
zMjg=ol8KrOOd#=%THtl{Gra#dFgE{dm;)+z9p^D}fXo54&m8wM{AqMzU@7!qU~z0>
z&;YSP`w2q5*mq2H0<Ak)5eXWDhMk29s>>R{Yxq|<g3PdPU}6Ndmq20c{r{b4eIIk1
zr2+#-tv+*`MFN8Ws9ympgF$K5{=t6+?|&D5CjVzJ0J&|UJ;Kd}n*V=;#5UT4*7!1h
z@nEoyMA8rH&oO%cyRa9e23a4}uPh*OkY1?$3?Tb$6&~?|!%CCEBhib25u~Qp!B@xo
z|6kBLfE<ut!Tw&vpaNo}`g?gIvcEy~EXa=@3=Ae9b5O!ti^Z-`gMrDh33R_D1B<P~
ze}+U&20f6vjh+k)owgu9LB_a1>)1f|{d)gj&IszKLB=Ek;d|B4`XkJsz5|v%gEFWb
zK<$sb4aL%D0Jk+kX4b6Kt^oB(Kyd*!6EueNn1KP>zge6L8q4uwXb5@kpjYbxK1%@9
z&tdWY{|0o29DMu~)Lw(F9Rit))OP~!H6_liZ&u=UYbSXBD5!s((SUH{0<arF<4sQ-
z^g>p#*wwNqSAfc4iwBwvpth{{|2KiS%mw)wye_<6x&kx~0U8$uwOK%86dsH_c|my&
z()RTStz!lEh4v>h_*g^7`NFFiOhDu3-HRDGn;$bUgzx3BLAuvW2DHBnRK9`6f-Dw*
z*8cqi?ZX0}M-S5H{r`U@F7=?g!2AEdP*C{~Qj1F+#N5B&bM7r_nO}JS{|`EYD#3%<
zUj!5{3@n$Az~TnfW(U;^$bAfu|3GCVs0|HTR{|~%nf*X(QNVlOConSP>{n#)v0lia
z4jO*|ouvY5b6Yzwuv)i3&h)idz`z2oGyeY#v`An$0oq3h;)DDR8YlDq|F;)Z#(>VJ
z2c>Th1_qCXwhRoR_J`~O?OpW3|FhT?zhqzn-Tw;JpJ*Nh9-mtR>ifgYvRJ?%0@`1=
z`6ndrK<>8mQ(<7a1X`~$0oGU8pU4mc=_@dlfZ__|KX6>NFff9~RzP73cH4nZBA~G!
z@Be=wW2SQ$c@{=P?y3RFgZA0N+Y5>e9-#XN7CJI`6nZi+gU+<Jv}f`N)fBJ-oln-N
z30WTkY9|zWGB7$eF@WYLPI&+SI~6ns1)e)v2r>h5mN&G$$pW&+`~PClKHdoszyD2b
zsO9wV{{QhU$gWT?)*SsV7Em3bqTj^^qDAz(m_T!}GNAenR9Aw|+yl4k9T=EF^#Z8h
z3%YL-bQWIy-(MmV>NzzgFXmL4+{~%q{r?lF%?+CW2eC~dWf&)9twYOWP~Ktm{{P3+
zGLfOcgW2Z-1IxvhDT;qRU}3xOA=4B{*fQ+_^}oPjyBE?21Ers4PX-2k&>4Yq8El&8
zHE>u)F))TlDVTxUG@x_>>bup{T-2+t0iOxTP(K5-ZvKxXG=0GC0Of(K!(Jo_NiR$(
zpz_jMfq`2av|nH@14pf;cLg|aEqPs057`R}S%0+W|AqP)m%w{XLE;uQ3@qON?#x{n
z%fM{W!0;cm_Q;}!fg2vL)(q_4|L$;F)G+YE<h}ph{@H26z}6Ydz;3C@z)`CyS1>aM
ze76v2Ju**cECa{P7zQ5DSQaQh)!GJ$baFCq)@of6skH$2s~Kl<GVnSv{D0AD%fJL`
zyMfwpAoqgGT8je=3ntog%7DfqLG>l54F_t=CA2U!fXXb;Sy-U59MqnxUkO?V`y8Bq
z9QXYD0?G@ZK7sfD--X~Z0n(-v0kttf>CF58A5gjV!rGB3A5?CHM}gKcaLRz%E0FsZ
z86~{`-7K}1VPFK^*$i?MXm1**Ee9IE0>y*l9ELRutr!?WEf3iRTDs^hv|?Ziw`8${
zj~nh~v8!Ksssc9u47zXD``=AP?Phg;hq?bZ6t84p1ogwgX19RjH??>rIDf|!Yca4m
zE`qinSq_8J8<Y3{pGS*VGH^I9VgRp`2f4>$0fVsj|DVu1DSx#VuVN5D(<kEn|7UN#
z%wf>JSMYonRG*;t|DUDdn(X^PYlR)={htutDPUD=?<LZx$q6}Af8YNagxh|D)@bEe
zCNk~tVD`KKp8slA66sW7RJ3Se1fAOi+Hc{|slp(n-N^tN-#6)00iWl@2wKP9slp%y
zyGPq$4}(Of3WGHC-b2t`g&f}h{~Q5@J*X@Ooq5}+%)p`D#UKybGYe{Kf%fQw^Pn>L
zEKLc}-V@LnrC@O{21ZaG2AvNK>Q~HYX5ayt!@zP5G|vkkhp}|||3|xvK@xOsDe_nh
zXxt5yKS6EKPG<%SP#Nzym%+rMlOeXygMlfeg$;BT3`ao=!~NnF3`(H0_6s@~6hP~e
zKw_Y>B%y^t!IJa;Bkc|bY0w@Ws5+iTxdza9D(IYgmRb%kk&cf4k1RR=Z`AH!V0N6#
zAkZk+zyTHCXvz71jdllvFjSleD!wMvi_NakgMkBNpGD{YzaaPMw}Hlf8CkSD8T=gQ
zG4z1$@X+oAuf<OQt$)_;1h1j+(C%b#b)3ggq7Ay!Z68C72Lr<l?M{Y3(EV<Xa~Wi`
zI~n{z=gDh#g73uzjq!liz=Os_f*j{D=xBE`M1ba1EE+(2eZg%~(7H0v9b=&TC?Y}o
zQb2QZ77d{G?*9)K4GhenyL3Qz?t<hTK=)D21E1Y5;QhY@wEq;ePF%+Oe+egO{&h0=
zE-3~d(7kk^IlfFUaGzg6yOY5Z$_KeeK)aK{9khNs(~E&+rZa;DXq`G}O&_Sg1hU5w
za<AV>&^Q?=&3Z7qyG&9153cJ#XZ7u8WC#G&Va<;@1wiYV;P)ENV^HX{XRrv>WG|a(
z&tL&63#=0um_T>cgYJj{r{#GJJfLwT(A*11ZK5Wqjq?ABMHK@Rs14=8xbCHO6az>7
zEbtk99Frv(7@A`_1sbgwbZR<ptgF|&C8FH|j&Jb#EzmeYP0iy9P~X*Y9z#g8EvG=O
z<t>rsNCusbP6h*zT8Fvdafk&LRSZT@J6bKR7%af&0M7fr2V^#=UkV!U0FCc=fY;3b
z6$R}<X^dyk>C|Fi0*?>RW$@^j&tO#F;sIKxU;`>gJ63`3PGSV_8QKdTA7cRJJ#ZbV
zz`z9xKTvxeG!Nwc|Ia~?TlMFF(i=laV=SkDr6PlVs3wC6s9Xk>rJz1`rx$|-c&y)x
zy$;ki0?lPwJYZsIn9GpS7|X!WDa$AaD!)S!^F)l^{~z9Mn9rbNQO{riZlC?TCJU-h
zLF-C9m|Y8C^JmaGDNs8Vv_?S&ly^b(WAkE8fsSTIxrV=>a|&L_Hq2$vv8aWc1s-z)
zt>0^4gp`-C^}CR@41b@1(uxPOs|*9nNl?2L+};PZ{Xk)X-1Y;N4WKf?``_i%M!N>^
zxtNf(+;<8ak{Jv@Y0CTm|4?unv7UjY(Vl?=`COQcWClhLW|tidEGOZ90@(xd2c(U_
z0Kc06YOZASVg`fezu>gW(HIXJ8}$J7mBHuBdH??h>gT@D?gW>QJfLzBR0cu&k{lp^
zf!t94A9NQo1CIx@i$$X{CuCjjJO+_QWlkQ@-a*h9yZ8S;cR=9{DKAf4n4<U}+@1xy
zPZ7SRFbA}!3KkBaHRay_3*Lg-xu7)Y{r`m`bk7S9XfDEof$;?>oq@*jL1S*6_Kbqy
zI%XfEL8m>VB51#p!#+lpPJ2esSptj>`xqrU?HQG!YIr*B8A12ngTxs+?HRR@>WvSb
z_VD|1LG{K1iv$K6@Ba&ZL1)xK*Vt=#|DVYTT9*r7`=NZg!u#K4U(j5DMFMCXW`!hZ
zpGot6hKvc7ko8{^?Kwg5#*n_(0kkfqVX{4^0H|$Izt_70<c3hq3Iz}w)IRh6|7a=b
zK4H+@4XB+0$}gaE#Xw@9xhhb99U}Hrw_zuP4rtvE=v)xcoUz3L29A#ZjCvq>h*|d_
zYoYfrs5I0y7{JC=z5mZ})t|*64;l-1nD=jv_y2z@K<hf;ep>vx!u#K)%7%FjA{L1Z
z0^a{F9t6!ZCu%~@L<EgZH`+CrOn%5<0bLUVq7A(N-&zWu>s!R&0@4d=Cwc$72+1q+
z7(i(WH0G`0!I1b9)W&g`_x}S(o%jEly`b?H&^Q^WuMWEB2h^_s&3kw-JDy-*Ifk<C
z4|J{swmbw$-?w`~ZUE&o(D=80CwM%F17sE`4|y;<_B1+k3N&hg=jK6ed62spCTfA^
z!x<PrX%$vBfaW?a7BKt=l|7*H2sF0>n$H8351_Rpo$?GEpgGY-Wd;UN+Y!_b1(!q6
zJ3&Et$NT?X$oU*|7$iXH7Sxt*)Z`Qa-M!?{#L!@qz`&G{?D@fiag`!yo(9}c*F3<G
zsKU?yG8dFiYC63uI_5KQhO|^D)T$^~c>jN}7NKwDOSnFj1K_z)Bt2Y6dMc6hYz2i6
zC@*_3JAm%N0*~QA+ul6;7c!`T?$-tR6I2F+)`NKeyO3$Az#t2<Yo;Q2Un0v)MFv4j
z1;#I+FaV`hP<VjC3N(KY3NKJP0fh&s{ftyL^LYQi<7kt>AeNB)IKhK)r6$Ns;{1Jo
zD*?4g{=MI6naE%O@}~#0Jv{wbJYf6+nkR>r`%Iwm2e93+dF6);93Z!Y!Vq;F=XNjp
z7zP8&5sN8`|G{GtpfYWrB7+LF%uNBETLCK5YUV0efcDga%6L$FEmZ5pKhWOsT91Hr
zwVr+kp!R#C3j;&*D~62p{|7+p(PcpUnUeoAG=SVt|I)jn`w0W6%mLl4z<?yi75=|M
z!Ri46Tdn=?3abPL2CD;%U#u1~2$+5U|KG8RF$BCeX91{wWB|{VcSbS<gZu`HFHqW=
zbdZ4q6h9y{!TlUf(E6NPOKXayD;*XvSb+35KjsuEe#yY(xQLMjtk0Q&0jvjF*LwfI
zr`TxAz%cnGc;4wj^Gt>i=vhBkK>9&_?xskF2=D)Q&xRB#nAOkeV5pz<7<B$RN1au7
zMSaNS3Tp-iE|}Un*U1%iZHp`Fmand`WMKT_{r|3DO|f(ZNWM9lQv@{s2Wr<8XMx<r
zpaC-9`~Tg!U^irPih$0f1Mh>}$KV4B6VQ5#;!Fkshb9Iam>g)Ws{RZH21|?optCVm
zYAw7gKyr1R3j*tcyhI$D{+HCxdJyQ)^gjf222ODnNdLbzptX&4$+Igwm~BNESPt31
z$_Y^1gUT<IGZyAU&l0VXu9&F8AYlQz?=ppf!FmDn%Z3&P1yFkExX+-{@t;A}gW32l
zXg>>RZ9J&`59*VE=3p!m)CD{kmx1n6e*zZU2U)k~{eMy`sBD=CIwwxyKj^%)fX;XZ
z9{nx`&{<9zoiPjy+Fjs1x)$193__r}$%Xa|0=1e97iu;C6@bnTT2K!@KOWSV7RktD
zV5-$*FbUPXS!b#F{~xGa0F{>>%r+4WEC)lTDE_yAk3BRp%z&oxGobPTmc~JKIJkWa
zIa`1k<Ugwi3_?~17=)}AGYD8UFz_Jir9WpoZ5en$bv(#l4*M8qAmsk7)o%vvMP>+D
z7|S34T8lR`o<Ro0o*B;|3!*`DybkjictCZC<2=R?P?~Vq!=M971MsqS5ra&lErSlI
z`~r;;fbR6QNC1TuqXo!rkiCxk7!pAJGK&QaJfJ<d-v3UwcG@!pf!Lt>b2cOBE*K4y
zS)j8w6&W}u9b|}^w2&cTRwF~S_y0efAaf9YV9<f-1Kqg=+9L>CN8vb+VS{!jgOJ0#
z|5H2|7?wcYD}wA^$3_2BI_@(Ff!239fZ9>^3^Ju!|NlEIV(<W+W2)T--b<gM-NwKK
zzSnaW1DACb10(1z2hceSpfwaW2@H(&Rkte=lG_$|FfP7W-}$(r)&{ia{$B^^E@Dd?
z21bXu|3P!PJRS2H7&`Vd2z2~skm-~MojW$c5L7pT+UejjlL4GQ7#!yOdjM)5SSB)@
z@L;ymU|`t~>ifX^y|C~@N&859FPi@~2!P_Yc|Jpg_rFu1c@<{RS~!pxIINevt_aoC
zFqvu3z-Xz!AT-k+JP$53(Vig$boatUd+=I2o|*Ox!Hu>I2C%rCJf9%~lup5JWwzYF
zz_Jf?R_G2`It87#xev4^5whRYr)IY{c)uiguiSO;eqILo#SA&1bn37Oy7z^F(FL^L
zx7PEO2q@e-UNLZj>azMS(0w@!DzN+9L3?>Y?)UzGw-wZ8acKH~#{2*O1I^5w0`+@d
ziGbR?pm^~9e^n6V|4v&5uKGQ%E36hUXo2#<OnZhP4+e%Q;l^%u;YMwC;fBZT!Z#eU
zvpT@Q+-So9o&SR5mr4H_B5G|tuYtnD``?MD;4pjqyJFUShG5WG3urGrDEwyCGcbX|
zu+f6SU{*W>^DKJ?mf7|Utf26kCC|V<dq3!0Ko-#YN6@&XL8CoGNPX;uz<SG9B6Z)r
zK=;)efX1|v_x}H1KkJ2q<KF)%;jy57c>iNS>%qPM|Kl~g1|APisIR&a0J?7k6!xK-
z3^t(qMZEuCQ3bX4EE5?#JebWtFtF?eon1la__+NQe|%hSM2im%%HrdA=)lFtpIZF!
zacL?dKFksrSa$bJQT(p}%OB8v2?wBM`4j6zhW3e#450C3b#R$pBV7R+rw5JMcRGXS
zRUqTb9g7))!R;8&7ym-N*z0OFJl54}g&BmbWU~W}V}yFK|8tznaH3I#fkBUpfuT9B
zL84icA)`@~fuT`~fg#=U0Hh6L>0QyO0@^=Vp-^w>U16&b8l0%<<UG-qfdO=G2<QyA
zP);|yK+Yq2ft*fqft&~U8kreFCfYKvpo>qm1>e8i;4leHGt9JQ;0aj@StD#w%fN5V
z$grZ*h9PLiUIxCIwhX-9|BeZQ+L53&1E9GPivtYu_3VeC?Tss-^RXB}>wO@3{PS1P
zIToPv6+mq@$eKIh4iCn8g&;FPW5o@37(zPj88~6>BTyL*>eGSN^rf^MU;wp!6Xr5B
z)b9<h0QK`a?HRa0^_MkdjnD*#Nem)2UBML~J)kxxsJ{)We;W2ML|8mz;DEG)u0YPv
zn)Ck*$lgX}NFTy+(f=67NerO!9MneS=$H@MxA_$^zdh&w0`LF-Z9wPdJM8;!f~HRe
z)Tgjk0G-A61$?i#<DUNlAT=QSK=y;?Xe<se@Pfj|`~T%m@I9gp;IqJZpmjw-V>AOp
zsHdA<pyv_2Ku;&RK+gkwxmv+a`dz`H4)gvUXtZWv3Dt753)DKI7pUbV7pQfBuh9xL
zM)V(iucO1he{(vm89-xTjE;N%O=yf^2mzVhsK~%k&l%w0IFo_Lao_(bpgSHL8yWUk
zCNeyzZD>^RU^ZUEz_J6h2N^!Lf~`*ox+e;h_Q30^=YaRpiO3`~<bclX0fjTD41@Fw
zjY}9<cHld^0(?FlsJ;N3=?S_g%DV#G7MaUn1FFmG=Y!XlXn^*7L)xVscR_tpS$l>Y
z(Af{5@na7rueaX+|AY1xg2rw^YqnIp|961;V~n8s%!AqJ1p~`=&|Df~uPl}`9J-wu
zSwL<9uV0(Tutk0e!yi!HR-gPzq|=&F(YhKuZqDJbk6}iqHG>dnOdEPXHml=YhL#%8
z8Ci?L=YN6Lo0xe2JJdNj9$aT|fY#;Bj%VNl>6>ZKz|(2XAPgF-oN3R%3p(4!aSnKF
zHvrTQX|!uFm}t)cy1T{%H2>9T*PsFA>rAv~&;gxm2+AX%Gw(eZ7y=sV8Z5m3w;u)7
zH69F%7M-4q+M!<T`}DgQK<nfkkocf67|?oTtxzv^yP5F}+?}3`dNbo0R6%#DTWT_J
zcDgYt)OQ4c?j7F)+FRS{$*5K6&d>l-4>}ugW;_F^?Yv=TJSb26U(wOVC<j`*0_v-J
z|G#t+w5QBr(f<li-i5RW|L1`6CX}7fY0tn5VuQ{Y>9hyWJux`$`wtrP<grxw|3|x%
z0dy}pC=PAB|F?Yvjp@SG&0`4ZjAu{<r;mByGc5jt+z!g)jqwcNb+Zj!3>lz%E>l_@
zAZ0`gLqknVa0RF@Heo(!Ea}2b&>bT)>KRlf+HkT={=+E%I`a**FBsIW^<Xww!@#l?
zbPtUItX$uBkYNS1OuvFW?+V_>u~)kS)b9h$8-vo0wE}|>s6Mo2U{JAoz@TDvfPrUn
zJwwDyRR+#ZRR%6lI|bIh1DA#W4y1zWyIJ=cf<gS*ptXuEkHPJ?+47+Em<)`KHVg)n
z{xgJt+8v-aH>8cuAOoFC-U3=j=>5O-C@7DE#`3zO85laP85qO8*g$u>gXUzw_gQ-|
zFrF#YVrT%xBdBi$D$^}ygZH~}Sky8|fXYtqe+N7*W-|zY=7=q7863U;9k8^R&7fdW
z%Mb>d=k)$}KoitYnrX|R09q?K)0QF7nt_35rY%Dhs=xO4g8VgG9@AelA?;EIQ2Pty
zH)MY~>|<~M-DwA^J3;j%$V^b33mR_*jg?s|fbUOav1VXU1%<2C0|pLI7<>QQFYCd;
zU;|2v-v7UB?X+hQ0<9T>rZdp_s#cEk7<Pc#^N_au3|7#3PKT!dJ{}AV3qbaO`z()t
zS9t&1cM;@vc$~;X&Qk%k2|@7yazDDe9p^Eqm|KF|ayvk05qtk{F|}0Sb^xCvsK5j|
zgOmm2FHjl-x9@BiSitAhX)-W^)J(Kx5CE0yvtt>!C)zTIcrbY=g4(>GzC))i18Dr0
z(P7>{8<0F`zQ!_<;erRV?iU7@&7d>DJ78%Qw6|s7LCD^%35*Oipmql+U4rIjK<hlc
z|2NMCnF}f_y#Jp(+WfCU1Qe#Ab$g(-X!XB-gXf>2;gMtgpCQNl-`<0bb`1gga~aqt
z@Bcqzvi<)lpn2Je_W!>$+BJmCuKz!0_Wb{IXV3pXf1>^WAE3RG&Hox?K<UJ~kwG71
zSNI$T6Ke&=FQ9n}P#Adszc?3kcZ6dT!w1lLs37~A>lz|tmNJ;s?A8(i?QsC5a|h5J
zxAx%mM4)mP6t*!I4WRj)rmG$d3|qkCe+wA?f%XM}#$iBfQDrq5Olqn<^y+?liFAsC
z)`30-?SIK=Xl7uTtjNFtURwiN|I-3m|Dz1r+rjAl|0HOi66mZaj;=cl4507;xl6y5
zf!%TM{|1?*3^|}SJLn9lnq68Vvr|Fk-*3<z+MxMT&>R&5bUdE{G*47NdjkV>PRK=n
zE`vNMyd38J2j2_s{r`k7=zM3;IyvwEO}rpKSSB)5SY-bHUz6-zQIq_yz=K&w0@P2+
z_0<2Q-}&#Y!#oCqMrQ^QONIa6w7Wp}kb>{JkWkcQ5Ukbo6sXno-chK@z-6fkKF3%i
z*F*o4rNaO3`W=iypmRGKof%X>@c}M7_kr4U|9^tUBS2%bjmqFP)&ihAkZWDEL_q55
zyA(k8Lu)iLGpN*q?&F-xAOo7?ty!w^qh{&9f?5?X@VWH0ni>``a~N1Qfa+NI{vS()
z|3CIS!tbP20iF8<N{^s(uqUd5&!uERoMH067SzvhY+~5ayco3B^Z!@t-{8E?U>W=W
zzjhY`hvQs^IiR%|p<V)3wVnZbwOU@_z2BgH`JlD|Xl?^E2I>9(zagk?05vZIJXZMR
zcLk*0`F{tr{t%=Vqz7E4{r}GhRciw-%YQTQfaYSrYEo`j)a?Ed;Qjv}D6T<c+Y;9Q
z8JIz7IQ&0@73kbfXq$%<vWG|uG-m{EKh<=C?;{ie?bU_cN%;Q{Xq>1}i-8$@md8R+
zI{pWmPhfP|_x}lK9VPmBC}{s6s9yof-=KH_&7ba1WB{MF1R6sI&4o{FWB~1><#3q8
zAOJd79ke$S<VVmtEKnW-ot5Y?=RfG|lNs90;By00w41?WA1cic8NmB%LG4mdczFN+
z=cwHb8V>=VPbmXE+d2f)76Yem@EMZ~E{>c2pMZ!#_Fsbf7!Gs(ZvpuMG;RW-L3TUL
zVE~;e_5*Yu9mp)uoG@rzC8(~0gxmlBjg8>D84Mt8P)*R?ZQwKn+B*gs4+EV64jS_X
z?Qg5utzF^$Z>OYnGXrD&o)-c2`(KIF&wt_IIF~^MWF}~@JZNv3_rG0BLH2{zzJbz$
z_y7N(c{5P^kOQO+5?30a^XkFlE}*d%(0ns!J_1~??+2~Z|I-Lc7Y<DfDh+!XSS%9$
z|E+KR0kTU3RL_9g^WOh<3PRhv5+2MNHK2Q5Yg)WSK>PJTc?-5z5A2s(@V#OxpgthT
zA2oN3E4=^zk%ih}(rC*d5dL4m478@BW-j>NZ-&Mc29}A@3=9*i8CV)!7&sbJ7<fQ?
z2`APtfbK<5@L<+pfvtlBjk|-|>y63`0-!x;V0URU2sCp3|Iz6A|4%J@Fz6gw*nJi+
zAZ>JY&>SN8JXFw`NT9Jd@EJ(+A?KOZ+y%MucO}$~TWV~$E39Q17^l=QaDdhpg8CGo
zHD92-1!{jd>|y8utuFxa9ryfy1DPXa0N+Igx=Rvt=Ck+z-xERee~wKI9-zG+p#Gxw
zza8K?El~Tn*7C(Vu>O4v4xl_}(ZJvUQL__LM(<+~fT{tV?<fOGx1crxINtyN0iRC?
zIxia<&lVocYFA+K0Ln|CbOer%J=&l<ZaBbcY_@Vm^I}kb`~^P8P)~*dbY_hW$P7@L
z^8Wuv7Ze7L4GbFfyI+aa)V~t3e$2q)IEeu~7U%tMTkC`x$UYNLo855|0|$r?ii5^R
z@cCm3ko2tv8v6y0;p}_JpaPncoY2T1QL{rEbdQJ+_?-OTpmV2wv4ZB@8X6fS92POG
z0HrtY|G!s)#2gzKX4F`5S4_2H;DF~}(0;Ke;QeBa+RY5iptKC?SAg=n!#suvP&|Rd
zbPhv|r2^<IdxjA3J-p42E5K#lpI;)N^Vz)r|8)edpYr~<b!&a|3DCHf3}_t`Xj}}m
z?#%n&c3)_|(g2<53tBhgIQM@IXdW3f1`F~p$X-yJ2Gn)|iGkJ*g8KR(F;I9y#<NsG
zWBrhPzK}r#<X&(-zi$i*2Nh76Ibk6KkN3Z=x}dvTYtp1EKxZ6)%H0OgnKaLTL+;pH
z2tMyX!TbL|&{!qXT`2z`ceXY$fYLkYzBh2)3%ct7`F;afy4a7`4O>8KcvT3y;eP`I
z%Suok2rg4Va~Pm<1=@Fz0hM9k`VTY?1icRpbQh=x0|V%;KF}RXpz~8?KyeL9@1Q+|
zyBi^MXP`9@kh9GG%Ygc{pm6qJRso#{0SQA#1`bfYTGI?(Ppks6%lqHvkD&Yv%0u4&
zzi$PlUxy}!BcL^h^|iM|^g9{!9p^#LsIq8a(Dz{Mk_7EF1D#D>Uvs+xRK9`q*6e){
zVEy3#Z}0#AH9==rJ2o-2fW+(Pg4V$OZv^EZP+4yM0J8oYoX+MkB!I?eJ8i&c-|B<M
zX6As#MgD()$~%Dk39+|xA*A2Pz)@d&y8@h_oiA5_@^j6d7XjY?e<y<1D>VFH0<s5W
zAE^8Wr6mt$Wzd?j1EBhGzaj(p9v*Oh+6~T6F5vqc!RNSr1N$GEpK3tq2-0W$u@H22
zGssL(dFD6=awa<14XKcO@Vx*3h1LB!pnL>ATX`RY0=VpI1)XuR#S)Y!Ky7TWn-~}%
zWzu5MeF3075<hG~=6nDDzrZq)!NG%B$%BDqIcS^(JVy*pCyorTyV*=Ybpt4!fX>|l
zwcSDY9eV%&8`->&0aR91g2u~0?)P9|NCB05-v2gng31wVX9mXlxeq{h*LZ-$!G3VP
zT;ct1^Gs0OJ2o+xfZPXaYlG64_rJ{>q2dzt|0M$I|Nr<=zxNlYTw?_72?g~NK=ZvG
z%!+g1`J@qYh5;ylg4%PSvef(kSMZrnp#15u2%4T2fc*X46%;NYzdO!hFaWt3>?Tl{
z{r}IZ-~9hSXxsy&1~fMZlLwvk4RR+ajy;$aH5#266m(b_K=bfCptF*}?LK8M5yu9G
zl$s}6A{Gh%|J1j8IQY(GP-w_tV5xOA2&nZ85~<~o0?GXawO>JUQxyM$%ZFMOkARvK
zBaxb=9sxB^tU=`skN3Zgp5U?}0el}V2PnUR>Ti(QAR0C=3Cho)vT6b&gAB<3pmP$u
z|Nl<}g(K+hl15twm6|(00%|plL?+rYs5II#@YI|%5}9z9fd`atJ(v|hcQ%0YEGX<i
z?PG9zpjNuVI+a1Ap_xIzqMktm)HbM(HWI0s3pz7q!&*xP1`W_zh@d<%(Vjs7boVn<
zZeqh+@E8LJXkXam`QWyS0#vRPbT8QCc(C0H6YUukJecJ{^*y+K3fm(9YBzZQ|2!4y
zhk{0V22i+t)9zpZ^$8L{_W*$IE@_NsP|@yWP<NQi;L~uQfx}XhL7=|P1JqBjY532;
zQ>zvv0*VL6IpDL#6l&eQL_p;}=>7o5ISdlo9Snk?y1-I_L2#ly$PU<kVR_J=5b)UC
zenxN_2gQjFxGvnGT>-j>0d(HH_y7N%U^gye0H5LE{r@}Y{CI(oWCb%&UbZ*@x|iMy
zvWE-QE?fdyWBm6hSWgq!O<*@qv}XYA3E}~{e<J8?R9Oaw$+iqElVce;Cf9<)O2dO$
z4s_2KxEu$?H8|eurNMV)G&eH{c>n*m7i{h#h6qqv_5S~@7E}k;&jp`b;Ss)9!3-o`
zGxrf_&z?Zdd?nDiA`IUD|C)m8a8R4FF`j|L((C^R(B0^bpg4lC!F3gMy^aK^Z{@)(
zr!qzHKe&wBcaT8>n*LnC?bPks6*V`ED<I+XPZQ!M#sqL)YI$5y_jGp!s2uVB|6?ks
ztx!`f4JkiBXEib~XjtrLV79mg>Cafq295DEScM#8u=4)@R}f^D<06J9pnU4EkKqZ-
zOz;1n!RyBy8yLPc+cNNg+6UhM*0wgxWl#XsHy}IfZBL1S=5D?Je*vHM3R(+WKT`s<
zr!=7HE`tK7j|@t;ATvR62f72PW||Ttz5o9s2(E{k!1+g^rgD=AsNW6hqtxBmTv4le
z3zWAMy#KA83tks7hasccmVpE050KkoW?CF$;HkGiB~o8|N(9=51C_&-pmhtNJ;SxO
zC-o-JX5g3{4PK)Rp8Iy#$Dm?S&A<b0?|{qBwU*$zmVto>bnhxCP9bHu3}}BlIL%H5
zwd3lgD?s(mgoO+;pu2;;|NjBEKS1?O!$JlbheZtFwj?AjzH@@kS_Rdmpt2m)?g7nh
zTP$T@2ALnSl)(zLCe30g=selqpfxud9?UYJ^V1ORbVy$Ue9sc7?Fh;%-v9qV<DcOQ
zC=9@5E$d<MeTUxvzsQ2l^#H}GLj%JOP@IC&m;>l;p(np9tU>+2#jh(s_pf^Y|6tpk
z$N;%__v!BnNZ5VQv`GH{7u0WbnEU@p^IQfFOG^fpP<sX|kX@iSw7Ac}Q9t{UNPX-h
z5m4Re{r}fla9Ur)-~k$M1eslH`%uq%7Xu5p4g%Tt>z9c4ztxE#Gr(aE+Vk*lHRv8d
zCeT^Lpfhg3b$+IF1?UWaNPdt8^?AT~6Sj5?6o#OD3aXbN?Z#DKLF-82ZMMh1D?sf=
zP`Tdx5Zq>z@c#b~bPg8S9MIZMXugsGmB-%yf87O#)glJ?-NzmbOp!II;JYqC=fKH;
z+zcv{YxZk^?*|2$4a(=BvKO{?)%*X?6Ck%i%6_Q?*nO;^J{GvY1uauR=g>BT?}LBG
z3r_os7#4uig7^PVs*RwsGMRxfq*B2QG#}^yT89of%aH@r*RHYPu9!Z9fdf?kg7iT8
zSnojlzd0S|{eJ`Ni#yI?lxd7-5NJ5az|lOP0d$7|s4Oo4tv#)c3<BTt;y8yP0aO;%
zs(Fck*6TaYVF&<~;k90m!1ACuJlHrZ=uQf-eW1N6puF<`1GtR^+LsF|<0r>5uz<!g
zL2V{bT?o2c$$Ach2Dl$R$4I1p&MA@lS>X0cOReoAk^1=_pu0gd>g#Wb)X%*EV$0N8
zKN6{py#%%!qz|+<19Ucf{qEP`aY|6y1oun+|5yu(4=^9pzWBGY(pKRDZ=&YEw@`P0
z_V^2e++(T0ATZGuvNjQXR;Dcjs7-C*!7Q<cfn^>jpMmQ~P`eD220(pkXd51Wr=R0O
z1_Mxg%F^Ng=lbRV2Zy-~p!>~vYLyu-fc8$+WO?X;+BKkY574@I&^eYK4B)-yETHt<
zP}cxj_bcGRECH|kK;t|67c$7y*n{u()d8i)srC#UpfMlEISeYGa0IuV=P*cs{rVKt
z-+TKIw009Tz5$xU0JZ-;n8klEu*@xijSGPM0o|vmh0QOZy_*X)5&Kg?`$$7I*z6L$
z7<584kJ*9cy%-pHxS)G(-P!Cyy^h(1Jb7pr@|@jHriFnk)b*iVDBD9jnWYR|H7!;m
zq3RFqWR5X#f#!{5o-=TTa<JQh&O8Q%L(S44k(y&pA~nywL_m8ZK=aBW$Jp#bp0n9`
z|Ihgg8kYc<xy<6Au^@0<fXXV+*q%iKLx#lz2F4mSa2ScqX=C81Rq?Ly{&#C9ma#Li
zUQqi6*46>H@#lfs9?UNw`yuQ9BKAXyA;yCiGVp-*@Pf*e<o^tM)(aT;LE*4@KWL90
zXpjB>rJ(o%iGlXwS|otQK*KU?kkmAS(i%*S2Ll6xO#%}`LNbRks7+~;-~e75Yw7U+
zf31TtXfH8Ct&(w@B?AL%Ewgc3t&4G6t*UWbt-5g=NWM0}xUJU6xUJUMxXqT~{r^Oc
z|Nm=6jN58WjoWI?joZNT4%Th8O4e<)%GPbQF4k?es@83_>eg+wAn^d}wpt_WwpwHB
zHd_w<549rJZMCM>ZMEjsZM6Z`ZI%uW47GmDZMFPNZ6Mm#VZj5?UgBDR<~B<QN3fiw
zL;Zg!pAn>{Rv#qCcmTw<by&avkz<0(LDx8Y*Q#i@)v9WP_DO^N%)l}WG$sST;~rEW
zfbM(Ue-M8DU<jyA0`-HyWen)7=zmKsL3;xyIx&FHtOVT|1k&UE-)Uw8=qyL@+|81k
z;Cu&K8|}cr1X9~j*TCcbKdZJ;iNORk=L#AV1kW?h1K-UDI@^N-vPM1&wEr8V26UcT
zgQWw+AGQh%Oo^Hdj9|YqF!R^)F}KycXKDk{whHh6Cu;uxQ}fcp0!a-YNUl~Nq9#$3
zfgP+@ftjmT54308P!P)JhVU6#KzvXbg3=U-ZJEdby04GHgIUC&)~0J&txfkbP@Vv#
z8(6-!RB&X5rEQQo_3xS5y#IARwRQOa!zTI7Ka1q&aiFnW&>1R;UjP5qzYGAmkqI>Z
zn&|ca4~TE+;K&TJ7i=fgzhHO!F}H<kvTXp1Co%|t?Dk+5UctaJ6SM{i+<yU;E6C@1
zgZg>k_&V@O#DnqkOpsqd>y<(A2f7o`R^k5#(7n;1Hc+Dy1B1l_27!io4HBR;5F7S2
z$TVs)fbJ0#@%~>2KNH;h|F2R|`39Q*_x_*p5E_S|__1i1*8m>#ZP?eK0Xl1};a-Cd
z$Sm*wb*7*+06IV0`~NRfsD1<Q{}~IR`ayFxApPL}FsA-m@K_{7|Ie>T`V%32QlU8v
zEHgl7FM5E+9YEm#E|(e@_&{aUeno~k(E4HzJPkkl4Z4$=5!9de{&$VFQ;~rKoCYE5
zPkp@qr-Rlt1c35^_kX*&-v6sWXCU!G_`m+v8ogR(tH8imYxH^<NDSQGIsht*K>h4r
zlAtmhbWQ@OtU=zdU#R*2FGvh}HbRK^f4is6`x-)^Z4A)ft_V<F;{D%F)BAr_D`?K&
z``^NypmgJ~_x}^nz2EiVb37L|Lc;X_1rG)uP7emYi5?6BQ$gv%ra=I--hsh`@!MVx
zhJvM_xh;!^#ETvbg^>GC<}rkLFce(%U`TiiTEp$Zko>dJt|0|9Ue%BZI@3p3w0U1c
z2B`1QP}h(HN;jZ$BE0|GSvJgTDDeKbkhOVULk-yec?_U=j6WU>Et;S)4-basouGQs
zgQ59pz4FUzATuESj=Y!6aSbICsu&o;l{sv@|L5IoxW&NG7}rn%T1x~v1JiNe{~WNH
z`~IiM$TBcnJpTVLd?yF^oNbE)hX3^~Hyl7~6F_$kf%;dqoXpEW{cp<z1_mbw2A@vQ
z9M)0>=32GLb(Yx-jGe6i|H^7G$jfpt*w=bWU#sPiz82~kp%KcVVN$E<Tv4kTTv4m#
zRsdQX4m$5^s}<yo!umN(A~nZeiCBR4aX&vL;{E@B2WZ?3T-VP7?+aiAg$HO(2T5F}
z(XOEZX<r-<c&v5b|0|&Jz2<!l6QKHA;Cl8kR5U}*?qIQ4$k5SH&A{OO@5;jkP&Q~!
zV8T)c=8&Z<b{iHlba?-}dbcsIp#!vb9%L41e5=u}p=Y8NINhmu|IY=VWe>Wm&T$^Y
znZ`&4kw!@dn~Ba042_WtptAx&ZJi#lyY@1yL3Xd>K888XbqzB>b|SeY6pvd1vAAUp
z!Yw)A{V!0rI5b8vh%`z;-4X?H%S2`d4oe0Gj)~3;0-${*8=V;xK=edr2A)Q{hAE(Z
za2^bLdqHPoc>lNF3r-vJ7#utp%pv1{ptDWD=Yd#**Rz4<{2S&qtN`5|;lWq}K8F{y
z-T?V54OrMW+BK{J)jJ^jn&&lG%=84Md$2ngo98vyfcT*KG*CD@&SN~&7}rqJ&;>mk
zX&&PqP`U-3-C7$RTmiX1iE%}vCwP52XkJ{RVI>1cqbCCkC_mLK4ZP<4Z(bwFJg6E0
z(0y19D;ZcCJsCJaY8qxUFo4vBEakBA{x>fa<mN&x@Vz%19GbxHg4}<@!06Bz*RTUL
zAKq-&um@BYG{-e;nViJ{Ix~Y26lRtR3~CcC85ky4f&3&3y7TdX2ZQWeXgSpYD*q=}
zg3{XD%7#M>JfJ)TD*r*^4f7g~)JI;fXm|-aON4<xQPatx=9u@ikmsp(9*iBJyAcAs
z|676Yw{V;XTDNT$XsP`FKd9_<oXcPVx^EK{uKLXk%%C;i4fh&A_ZJ8>+-m@>@#bi_
z*8ti#bpm7;sQ>A~*uJyTuA!shBm)De902KUnAdOyNq#0M+(7*1Owb<tIcq_DP+27(
z#Q?sevw0;0hxflZQ$c;pnyMQCA;~}LKxSL-{r?R#X70ftdlJ;&1%*jNUBd;)SqMq0
zNOceBTqe*tkf3&li1+`*hlp~Ng~5aIV=12U9CCIHC=V`RU<Az(fZD?r4GdhMI>`C~
z6QlRP^GiEG^9BhFTm>x*`@R2v*=v!&0NMl0;Qjy0MvDXnPEg!<|NjEI6M-Abo(a02
z7Rv4g-4zUFgU$rvhq6oS-+|gM&@*p9cXUF|A7uocU*r9+ixYCz!<SB|`yprFV4l|l
zIl~6z2k^NXUm~IAg3q$CfAEMm`9F&QsNSko_@e_m>j!quPp!gV9nd`(-v7TSg3i53
z)MN<(t99_vf%Q=my#yE_V!lwdpTC0nc+LBK5o8|N?P%xdK<+y=UkNG`Ky%pO{G!1C
z+VejLv>(QU!FZ?qV+Jlz|H5G|gNXio_6wkXy7dG03!wfUXl?|w4hDQ5)V}{mK>JWY
zYeGC2i)%ss4~qsyHj4#}|11tL>Ve}kfuYIz0Rxu@gOXySUBd=T2k<_X8{qurz#!LX
z*RTh~_F#}|wMbz2>%kxqYmvb4&x1iC)EsgK@E7m@TX%xo>o^Cr?(OK!hPsA3-v7-Y
z>r%n@p@8ONZXbpD#i5D8$Aclj5$u02$eBK9ZHe!oFa)(FKxYVn&l7552m!IJA24vk
z&QSu5Wm!J}-M0dAkN8o9d;TwhxKVr~Ow1yI;g1J{IH+C50y}rfGLc~iC_i{GbAs;O
zf{)MGFZj;@?vL$-xNY%Y1_mB^NS_pR)=KhA25_3$2swjDviSf1_ul_Mg4;iv|ANPw
zB|Mlp?l7?QgZ7w#`-Y&l8*-l*)c1t7VL@w6K=*in=0QA|Iaa{t06=*GG#+f<aPLI&
z9EJk>1@}&X%Ejcp3@sq{dH<`c1huI^>b(Ee<=Q0NJCTsgFagSsh4M3O8X6e9|JC_I
z`8gI1p!v=^TPVK-Dz9t*-~$6lEcrhJV?r_m=&V7IK2eaJ^`JT5e|4N7`GjPK8k>d*
z4Br20e?s}7bG>-H|JA;P@;jjNH=+C<h?{Cpg3PghaPI`j-O2w!<zDSpP#Ng`uXb-j
zG6PFUG7ESdpeEtJ4rDBgeL_PLgGoj*0~74racJM90@Nn9SjxZxnrjbPDqywuAcI4#
z8F)X~6j1wY0wY6D%`D}LiH;09HP?+Rni3f%SU+G80G;1%rN|&MVIhNt6(fTL_$+^R
z28NnX))khZHQNUn1R50?G$3n&84EyTjG%J2POZBFG~ea@@6=V8m<8z0?&RAQ-v3TL
zg^AU%HN(`cZ8*pv0@4GM^Zs{gZ=)h?|0*L7cwKrEBTJ|jdyTa`1B*6f9~fl40_))l
zB=cM0=CB^Fs6AF(0bc+8@02IVyrxD5flyNhGv%!e4E0kOLFb!^glaOFf%bLPuVlCY
zT5|~+KX;tO0NQ6KQK$tzH-e+id2&Vlv<INICJpt|9)S0fH!3pd)OUi{y5!W)nc?8L
zmm#Ho&J2j0BZEQx+yIbR0H}Tiokdyuyc)ER8ggFsJ_ZZWePnRAg2s;iojeIz#}3|e
ze~^I#E(aPjmOotK{qN*TYfxJF|E~vn4?zcH4FhWo155XpDT@E$cL;#udS4=ZuV#$h
zg4zE;`N*n)fnj1Jg951RgY9Pn^?^X`2~hsBR%DQ{W@HevddMJRb&x?IY3u)gpnGqU
zru+w=*$Jvoz5ksD_dOiuG298?e7sIin1KPbJ|En!oX2niq{d<a17E$`Y4Dh!_rDY1
zv<nqysAmKD<;2>BiVR|wn*aZU&Qa6u{QuW+E<=yQBnE-*L<WiQY6gSwYBoDinuqG+
z0^RTE{qIC+{mQrk{Z8;cKm~_Mj42Bh8AJ*-|JP?~F*7K7F)-A|FoO1=fzGOAbJ)jV
z;joFp1eA|JXZ_S2-3$uHyP&<0p_&Y8p#Cq&4Yi&t1Zuqk1!}z>1k}a^S6J_5WT>CJ
z0CXN7kM<nUo-#)8nK7VrV!Z%#?&fvXhWm^mdQuDw4gVQqK<;dmXN<6DP+$PvLkv1|
zV)8=pesBg`2hjY~pGwC~3<e-QAhjSp77dCFU_A>M*g$$f{Vb3ksCrM3TKfeI{2;X;
zJz%vB2B5wj8^|4?eN5i}E}jIbLsf(622eZK`~UB+j++=lK<Yu}f%M>V162J{4+aJm
z{mG!aNB@0*g|mJqGlRpte-A+S!h8S!ccZb9K>>8X10*dnJz-$!1nn_Ej3p%q<%80r
zMFT72zC;EYXkR=8)Mo~zNzi&ZP#X09cj_)^U4df*g97ND6pIB6CEou|Oa!?Vbbbot
ze8>}x&2kM4p!93?fPum4AOnZhLIxhIMh0%HL<X)#3kC+z8Cjq+FdgSIyaBDf3*Xrw
z2MVuQ4;i?^XGLh}&S7Ayk2+leO7r3M4tk(6xBma-3Q*br+2#H3cr551El|2ZN}C0s
z^bKljfYewtF!0r-&aUwOckCi)PmW_B18A&(yKd=fXqrE^6ROS@bT_H@zhf&q6=Cb^
zA?Ff7{ixvm@Az7%T3(1BkIx02aRQo?1GR@c6&bi-XE->{`5&M^hd~~6=9|O3{|2Bo
z3;4cgy9O3eI~a7&JE-4LKQ{n$-nvQn-Uc~~1_oPj`d`Sv?fvhVB8odeYa$vLY%CTq
zBzXTjuG(nNSkM^Hm;*YS)L}1!NvJ(kKj=(du>PYDQS^hvA^Ow2{~db@T{{?1+X&jf
z!T>)P1Qf;=2?ARaS{j8w@eUgQ1&x(?|2y##8s{aT`WCd#-TU9Mxk%yh-}~ROUMOE0
zbXI})zhkvfzK6vE20`zC$8w?k7SNh;?|;W)L1WJ#vF3*iJT?o?Gl1rTEE*U(5|%b7
zfbL%L{&x(z-i{$<isJtrp!5l<CqeTI6BrqM_8nwUnAixOCxq<-`qOlnfu+7>1B2t9
z{~thWZ|hq;7##Qhe*zls0L}e^(v!6#12<^>iZvqx7pR_a-1q-T*!>2%<nR9(>gVqO
z-J!4obiXI)4nk19={S#JLio$$b$XmAWoQkk{s)(#ZkNG#OL+e~TnLIos5k?tZ1w(k
zI1@`cbpXYW!z2ctP-{pT3fdC`UH7MgWQHW996l@wN?)KgG@!I*{htwZw|j)uHBejh
zzXK=?8$svVCo*_|^EcCf0S1;<(0za4`EO8r&C)@D2{aE5&DSoVHU%hOgYq0aEDn4U
z0o5;{Hgc_%cLgXfInHC41IovZ)(jl=+h12e^K3)-{suWvx(?sgAXh(s1B1h!{||~^
zvV+$DfyWm?c@I3N_U~|LcOwH=_#6g<@HuRDpm9|2{PR4dbv5Am%fr2(aB7TVU;wA<
zec(M(EFiy4dI{<yGe|)FJ*62m2J`=a3TW*lcwU+5p8^9*3ux^Dd~FaYt$^12Lj7w3
zihq!QVdWTTF3J0U@LW(>d;kA;6Fj$DFJ0j{k68wMCh0;3KJR~rep)IpE(GnhSn!a6
zui;(;52(zQ)nbqV&Gj{MGO*NlSb*01DKu&_NHoSZh=As?YP~%4K==26!V%<O(7gpt
z4F5sn69Q=CLK5Jym<9&W*b;bOy7#|Bt&1BOKxf{8{T|-RVzmLhrtfeo$gSZ|+U&gl
z|M?1bZ!P!^bPiDbfaEM180;(-g3d`f_^@LkXkEu^P`lSIVJU+IXufC$SnkkM(D+eu
zD`ei>``=;R=6wy|defqTK?1VI=};o5{|*X!P`eAXP8oDQF6i9(T5IrLGtk**A`SZ*
zKy`qK_rF7+GYc~;8W>b8K<l&r9a03%yIDH?{|hn$boM)_oCdFHnaiL8QU|f;;7^b}
zpfm`x2UM3K+;Q+GNFF3-tI41MatG*4;O2b|8X$8)Z3U<~8$s$oVj#63b)bDBp!v?`
zeGMj{eC4>8LC2=y{|^s_V#pmq^B4>ucQXgh1f5Ca{XcM`MFJz}T$m}~a&Q3yg9noa
zXq`E@tq9pK76`i6wg##%5vmV#XS9v?e~p8B%nS^m@qEWg3>x15x>rKRgBd{S3Dh0{
zuX*)g%#QV7ax?{vxq;ja8M|WOaM;A40?ii!V0SP%3WCy(MFOLs2a{7In)(cg8v^cv
z&YiMkU|?$0VgT)36ad}b3)<(lk&8hgRP)8ZMlJ@9MlS}IT93eMAn{r)&uiellA0g(
zS$h5d16rRBO5aWn3_Mf0z~`I&@L-U73$nYRuED|ke?TR;F9(^2b@BcmkO}H%LhBI7
z`g5jVTNqdxLG1~6{;N4{T)FQd{LW_+P~HQz9~>H4BtT^hC@q206c+<a!z%`!m0k=A
zH7$<UKzk%Z9=rhU!D6aOkrJs%X1rFbDJ9}KkFiC+ive`bIp}-|28Vsj7aHRlI6|Jk
z_}9FzfyX}Kz=7s@4Fa|7j@LkY*<_wGuz}WtBv&6eVC`_=KuwmENUf{Ex`sIn46<Gf
zT%h^k+SniwOVB;-pt~X&7`Q=mqBWe%%bXk-cJy#DFgDI>5NZ0?AQ2+}ZCA5ggG{~7
z54{iucB|&^3=H*_KP;MmFfi2H|Eie$gn^;{4TD~TI0Hlde+G*N2?mDx2TT<kSQuDp
zTAW0@|Nq|rzGJ)vGByd?TVlb$zzs?(FgraM7<@otFus!mg9*qD&2|kcAp1e~*8lvW
zS0l-wSO5QpMGeCR3y{4?c3h~{v;xh``8YW+IDqxaHK>G0e%l4oTleFH9_a3ax}PU3
zCaW+o)LSs<HOMot)c<!9saIgIKr-hD$efyFD-nxh42<<{5e^RX{+;k(U`l9=YtXQN
zu=jhzyat|H2FGiS^BM$X7#P?<;SCP!|9ii~!}$#~oZA@~YF*&ryv5=H12^bQgPND1
zaAus-pT)q~9M_-&3g7Vb=T`N*Ec6;c;kw+yBIK`&UdYd5cJ-F8D?<J{@YUPCt_XR4
zNUnalb;X1~3=HAv-@)peelRf9{e58(zSBi7e8(}ndWq8&;X57p>LpKCgzr5h2hulr
z4+BehExT3CuNQiC&!J}jK4w>64K=$K#cYoHIpBCpX!zHl(D0mrLBE{=R1Qd3H!yI6
z>JrfX8ugvb%RCqu9)SI1>s<ly6T^xAE{LDP+n-z2{Ibw1`N{CT;P+mJa7zch@ajW$
z^_I6QN`CKUsCoXw0>lTMsa$V;y8?7KOMSX^#e}~M4B_qH!Ft2zuv?L#pQYy41HF>p
z4Brd>>}3eAcF+r-bI7i~`f)|cAE>=^4%vb2t$7Tww;gORNBv%~zinzYnLueN!O4Lk
z1ni%>2A%L(&#mgMFX%PLGBDIzU9gz!&cF~p>pNHs<j(r)2Ov2Xs2mGuy%Wg1`kDt8
zliL|MYMz75-T*SYCYcE-ef_-vUNg(|Erx-m7BqeZFGu!)`q+@OGvH+ixcsPVFle0D
z0J>|A0aT7Ozh+=)^kCp=;9y``$-$ry>h<DZ4Hx6Jn&iN1`W*~RH7$(SYFea3K;!tJ
zebY6~N+O_pvmNI#e9-TJmMa|$3=aF4RJ7X}SRCgvIDqCwYuPOf3SKZsJ2WxK6oB?F
zG%;v^?w+${IB+15<G=yXIu#fjBn~QLCvr0|G`s|-f3`+$28Nm!PM~>AhKW234E5~>
z4vzB}57e?+tOKPb&^$XR9m#SqaMdz9iGbFkSaSUT51K3M?_gkTwrdaxpZ#qYID8{-
z=r!jsFw{rguxQR?V5pD2RWUi4fuX+gfnIYD14DiF1B>QP28Q~YM-`i!8CXDJ3|f<1
z(-I_N@f_S%Y$48Xd%q`g?EMb$8-$JSH<>I3u-`!KX^{WGewz*Q8^e>Dr#IGt#;O|Q
z8hAkKSZZEbiC8)?aMyY=FSB?K_S=^JcCg<}!n>YZ)k+5FHTp0x)N%w^fa-->uAqug
z4;Q`A2vA;jt_byT;H&3wt_bxyBv;E7Trn|<fg!x>yH#yufF3AZn$9pVG;%U9)SU{j
zsP%HH2#s*j3k^SJSNHvJMQDTrU)_(xV7>Jay)3nn5A@(_LH5KPv#Xy2wWkBc9*+7b
zCQ$hu07^TczMl90|1y(bGceTe|5X7x*AtX(C%*x;6+X{lV5tK2Q?QPa!s@?9y9Nu`
z{3EC>-)Prh1LHf)V`u^Gvqs{VG}<+|fa*k08>Z2&!NXxLg9eBnvNS-eW|?tCNXr7T
znq$fpmYyk7K;z6c2SRl~Yt2C67?R!~SMyl9!jg+&16VG>RR^NiK@Xz0L9XTqNH4<{
zuzW)(Xq-~OgXz-;ixvh(i{$@*YC1vXGy~6+#gMiEXuOhvrLty<;(zcuPH^8sfk6Ru
zJ|}1$7PP&sQ=`gV0rK-)RR#`Fz2E$=A)t9*gAZu`Cg=<;(E2BtWCk|x|KHDo##BIU
zHcJNvE^ywKhvXm7{`!gX3=ECx3>>wd!PDwH0zh{*f%Y?oG_phH?Hbh?cq|_O{{w34
z)M`3jtMv@LCesP(iw6W)vi$!es|m?hp<1B!4g(`74LUh62()@IuuOFa`{_$#T!Reg
zOoWh@5BorM8942^9<!@i3P}@S+Ut;9&C=is@BjZ^g4*_$4h-OVJn%kL&Hw*Fdvrl-
z$vl`oZeU=kh=HwH1ceW1KM`o%A~bAlKy&b*uz`k)PxHQp0MI^O$9W7Ij(Zsdw3`_?
z9QQGlcrY+>Xg4!(InHB9&~9enb==1YI@|UO_-qUX28D*X3=E)fo~z2h3krWwc!I*!
z`~Nr4{niYjnhc<|D;%IZG%Xnz*g$Rs`48M4^m3jCZjbL_<naFg&(wo~kpYXjJZR=B
z!u$(rw}Q-b*u!80iZe?G1~yRIYSd(4snragW(f@wP#f3O^Z$Rx1_qvqvEY6j<eWoW
z2C#h~_k;XlslcExSCxSq)xNJA!Dks*gZDD?I_zUGz~V;Gy+n)%zkjU-rzd+<^Fij$
zZ)M;_QWpyG3#eTD_n_IX!2slz=C}sX-B^sxat#uVmJAG_{wT;!&^a(5ch-7(RZO%1
z?X?BFmjh<r#7NMZlCO*~J)m{Bvu86ffb@a&L^3dd^m#D7uVG**1MTAi&(VO=2WVad
znl@xWZ9-Vu@cvhy3SM*4$glu3-vsLCf##bX7cta;*O-9Dbrvvic`$~8&vta&$57EQ
zuOR`{53*Rm!0*8rY73sr+Q*R4Fs~s6DlX{37^(^t_h^{ckO37J^<WHz+;KIJ!Jwx8
z#X3;`-uwSw%lf$w96)Deg7&5%i7Udy!E+l-@3t_ol!D4Xc)0-DmjLybPR(88N|?VK
z8W}<58bhO80}H60Y~%pvah^tZ29_1iA^jFmKCVgjyr$m{s=EWhb$2a?l8ECxh8g<p
z(E1wGCfmoT(eST<LspZ471S>QwL_cJ85nAwO02VBVBl=5Ysdk$>Fc`;0zmVLA<rc&
z>SL5dYF=B3fYzkcW(SElIWQR1u>V+BJNuGIvs{Bpy~ZOE(EisDhHty-B^dN-cp~)b
z85k^TBqQ~_|Np;Wk<7qYbIePmzWD_xTxNjIQfv6vpaF72b6tZDs6X2PaznF{NNwwb
zb(RSXpgHxN+DztUHSNk3pfhAbdn7>TJ2TX_C5hDL{8$IFFEs7BRgJWPUc+$)h8i{l
ziwTDr7(&y&Th-h)&<o9Gw`yQ#V5vF4U{P~BLT>^y150B%s7)0lQgb@OVq!7_M@@2&
zh!eyAEue8n(7D?6b6z-r_SHJf`(Fboo8E%YKn9iJAPn2vGl3DbX5I<3AB)#g0elCN
zf_^iDw50+#oJI7T88|Ez!1pn6)MQFmfcE@=)|4af31na?jsc}nQ2O*~VgR+_aMgoP
zK;<5&%mCHdD>WEE=iq|QTv5^Q1ltEXXC2gEJ^;EG2h>(;fSjKVx&s-s-i;wt%SA6#
z6;wV4SA=Rg@PW$ZP)$(z>|N350bVE1)u_S11M262>jf{*YmFM9v-_2&)pU7Y1D(GB
zY6pVKd++~0LFeRx*0zAoy%7M9*)YBSz`#<}Gc^74!xL6Nf#zkQ{!xI&H)IbjXuY&0
zcrCDxybA-@oSzIF^2`iupn9oR+_?g@mcQ<Zkx1QQEfMh8-W&#(dg;RzpuLOrb60@I
zM>XK{UaF@-_ct-tJ>OjcDKEabT33VW_5U|OY1%ppbmqf<(0NH79!#%F7+4BHcQql_
zLL!}YAitP_4OB+Rr!a7V*7k$;bJhH}2H!^xTNC6skHG>o)&*O$4l38{-7kaeX7m34
z`K11Q@L8JRJAFa>XFz!Yv^NgA#z3QCUqb;*KbqcN(AsA2|Nn1**DEr;yaPH%05smb
z-;qHAw1*pXb^yqYbM7#3fZh1Zx&m~55y)&%-3>DrG?$2Gwjq+)1|Cc=8yHv$aL%WL
z!T?7e0nL{|#y~njeHDg=Mhym*S{2W04IK<TptGbveW8$+7yoLK6|aHn<C>L{pnEMN
zWK|jDEgmrZmstv0XJ>t_W~nuJon6RM&^kM9@H#tC-l=s71e;Z>0bO&)>0JTp(}V88
zhMNnTztfV|1EntyrWZ$G`yA_=6&S#K#6kOd7#YC(X~FybZX1KnS>*wxD^TCLe*Oyv
z$GMR6%0cUV>Qir5fYOTh|9>C7|NjS_S+3y0^a8Z+1DsCkTQnf%)*zh)uvfbRbf2ih
zTm~Lc9Dw%j!p(j1y8=AVk1%&8lDVL>U%>s#`W6EQ&=?hHEF2WKp!osN*$|-piC}Z@
z7=!ZysPA7t^KpgM-~a!uqZt^j<-uu8qkiTA28TI}0-(JVpuN4I{Z<wS7!H8^VQmR&
zSNwlqQO&>v_T$svpnP(``~QDkaNb$+y24@)0~1vJK_oF|sMuPI+W-Gi_5S;4QTzWN
zn%G^7+W&vi#7<h&GB8=pVPLe_55E5s<fg4~JNEzo1GU2wN$f9F%oIrsbVdwFuOdtg
zG^P(##|sm)*bno^-=8osXdVFV-FpfbgM<M{>>^kUbmui(?4Kw&|Fk>?<z+@tz6GsQ
z0M+M^wDI>VD2ze#%uuucd;kC22^WKy0}?9*iy_PgiGlVxfajNC;k4@^0}pt<=>Wrj
z3q=M4@Be>6XETG_E};0{ugJgyO&2<#v;|Jb_l+y89T@&wD=>h@f_T7l^9l_A;eJ{A
z8oF=n&qufzXfK%CWzd-wcfn$yeLo;EwbS6c5kU6{fz#@e*A>=t{{IJ+p&)<PyIrn;
zlo@~ig7ty?gD`(0TnuCu#Qa*Y7?Sy*dkq>G8FXOg!^{Qwd$%G3kA)(GhWGzJa~N2%
zLFWL#&%}q_^8{+Uf$Bg|c?7E0L1mI-6Jw5bBLfF0Y(V)LWHxlX+#G!F#lMo1ptd|{
z9q~-i8N3P%jNm&kK<6%6f!p!m`4Wo+h9-*!1`WviEr$P~^;_Qm|71=EshQ2d>M)PN
zMt?p7=)M&biv~tMXq=l{BrvS={{M0&D6M$^D{%$Mfz}j)<^e!*pfm9s<~4xl<3RJ2
z9*ka~b`ALMLdSUw4c`As1i@|Jc?>J8|Ns9b|DQope?G%g$Gr?Q8s;_BSS(;*0-5c>
z=*4Jpp8?eNVF1tPB`{30SitxSv?m|rR?zx1(Ai1e|Nou^srUX@ywhSn1FOa1|NkuZ
zGBD}4F_=Qn!Z)=@V3_T}z@X#(uXrlDd%gd^I16&OMFXP*%#YsxU+e^#@BRPBP0;!C
z9!!sY7+A94<rcWlfS98<so4)XQx+6I4vh>eKx@mO>&#~8w=rx4&BK7oT~PTp(~$wR
z_7&6zQvlfk+TUnBhe5PqUqgfZ9PoO`bruI0xUBawD1-9KOhpDxNIHC>D!-S3%_4!}
z6-XR3&jYUG{__=h|9`=0oyfomss}-8L2G<LVFFSID%(Noy#GIcYP}cSF1X|U|Hn$u
zxQPeTqZ$U5OqGTt29|<s1{R-1;C3V8o?pb>T~lhUy+Pv%Pip>JSAf<NfbN$EtpNeG
z6F~m9Sis;7av$jI!MeknLGxY=^3@D%ptVx+{~5Tf_A)Sg|0~i3o#7xG!@y-N{r@j0
zoz^X0T~TvCNCXsj;Ii%5|KFf^1*Ki@|37bn&NXzL$9SS)UIY0228#s@;vS6du=Rif
z^)Z)0Wdi7o9Pqg--v0_WdjGdy2<o>vF8UAJ3((>HuaL80UPBMKT$=T`!h_NCAZQ;e
zsC@#;Ki>Zeb@it+Fj&oH-~ru318Spy$~<toJHWtLuYS6su6c2V_y1Qfq3V6D_c929
z(><uJ1KrCG+83%0Iye2*QK%YCkbY4A6l5MK4r-ELfyQ*7Sk;5i0T;LW%fJHiKWGmr
zsGRlw|HBfrUc%x4!++5FDv&s+Jo5hkL$NMpb_GbS#R7%{R@MLid;kCL3W{Tk{S1;I
zIY^!G{U=mR%6dP8G?Ms3kY12^;Cy-j)K~s~)?z;csIQH%>p!Ti_<gHI_5XjMavo%t
z_y2EqLH+=(`>;5`;0+1~P<VL%e|Z<;&jLq~JUA>`AA`dQD!&&JcMLqBaQFUiz1A|3
zVS)$K{THBqBB(vgz>)?!vk<->YyU#{T_7=_G7prlK>d{FeGM$2wiIYgZ6#<PG8R&f
zfzDrsoR`PwW9zW@d!iR;%#=~5F|NS{G|mFPyM8VMXne^7v<}_kMalutI9siPtqzob
z1dV?JjeiElZ+OK3x*LW8w13Uwc*+H^ID@GUNZjIh$`v&J4HzG4PXm~bu(t(;|A4{X
z;zY_EkXX$FQyq}oExA%UK>S(-R~=BlIsA!$6=<BGrd7G3rVVuW!)s8v`5%-{L3ak(
zIvhBV=mj1R2df9E1;q=v&UpsfbNT9}{(J_wdQd+a)VBlmPe60(;PX2@89-zCG9ddb
z7BGPKlz_q<BnJwA&^StCTmyK{95n9<x+?_Kmjk6akU5QZ4L*}!g3Sm3(cb^^Y#Zh^
zOn}@Sk_$Sko)NOAssVKWCb*mj?X?2!W0?Gq!C>-329t@344{7IjERb%`*zA=p?k4I
z8tNM6c>m`D?`Z(->9AA)-{E8fGT-}O?o3df0@^q1{r@lc3@wLw{~v(lKy#<w|4mIn
z>Ot#PknR<U0QI3gnC><(u%v+QQiu1KL2GVc>uW)0tAWyDu9lO(ewTj;C`~%dW2gYd
zLqjtIOUTj>`|4XXKx-ajLRwhtKx4L`@C1#4fzG3In8P5^%FMt5T7wYk#bQ^h=>!_j
zegPW41G&v{AA^BK0t0CM5$K*L22eTS{V%!{wCB|OztK|YJTQy*e<RRZcLqqC|IP&l
zmK2F8ivJO1wIf3WsJ$?OkzoqRy`Xjj$gRzB4Jw5i3@nSS7(i=7el*lIXn6nUoC*pr
zNASKR)~#UnK88DxIc?5LFn=DynTB}{pgWV8Js6$9d)pl5G3)@D+Zfki0$cZ78yj2!
zTT=lV8)}Seut4kqVd!X#Yp?<3f!cW39uS5S=>85+J&0uwNKP$i%o3^wa}UUT<UJrc
zfuQkvP<TVyGpOs)L1_|nMhK|90mXkpas$IgE6^Ay`^V;e4KAQLeaN|&9Ic@BRiJYX
zKxrSe2Ev1Z4YCe>-~SJwyac`rjM0e|l-@z>t0Cu7a`=MIrU2b9<H5kz2?{rdeJr4J
zU<17Wa~LAY<wE5oKy|d^J{FT^xrPv{hYTU0bQ1nwzzWoN0oAMZ%!ey#Eq>~GFtA60
z#seU05|~;#<}iqBw}8fH7;Us$7#bbtF&+WUp*!qja%g_Y5CSom$paL2pgAE>`f{Ad
zWYKV!fdSkuee%1)0({pw3pjr`&SR1R%>#hS2=D)YSwZe|+{Yl%G#8>C6b_3PGK7KV
zGW2INg3pI^m<KxZnehooU)_?`pf>ecu)cYW7aB?!1T5_t7(we|K<y9E8at5PAaziC
zbwO$!=KVk7!N9nnp@f0OYU}?u^<RHp3rQBRvPk~_rY8B9hzA4v$)>#w42v8Y!a!rO
zH6_v&R;3IgAhSUJsB@VN^#}9a=28Y0P<;fd=d7#${|>JfumZJr>ZaTh@&1=(+FZ&Y
zpg$XQPdLa<hJuE=h8T-G3`rJq7*s6wF!*}^*LMZAoxycm4Fit{<L8}?iVQpri3|cY
z$)49d7}#waZ5VPu?r3Oa;Ap5}5CH960j<{noy!0^*A}E6bfz@uEFjPxLht{2CqZYk
zg3^rlza!wVcG$<T0?hw!va+GBA;SB=-dWJO0yYT@4IT_^H^JuDHKcg|XZ;IGGoZ7q
zn(G=s`)o42|LawP{0)jH4+iFw(C`KC0rmcO1bkKz=>9^G`Jg!S{%_(6wIdU>FVXwI
zo+W4xUPE0&0cgy|`@dcwNUisO6IsxBazkB1iT8g!TTnRzN<$9w7{F(FfzqP~1LIv#
z8ub4Ew+3W3sJ;iCCjr7BwT|-`u7J|32LqcdsC^4I_ut`-;CS8#zQex4g8}OIe}{j9
z#x6m11t|PLVP}!dzzSNUuiXru?*+|c)PT}Lt)~RaIhmk+&QL#q+D{4%bqx|wx5Mrz
z1-GR^bGb-uZvzk;w0|!YdRMlk1A_vnOaSG%#<+$S(AqE1{yY%v{a+UpP7WYF(6+k{
zh>cBuqg_J_sD1<O$pX=kd%<-sHq<pt*lY!ATj?D2{;!h>T2lgwJL~xjj2?`(CqZQg
zD6falVX>>p{HX^zo5lP8?<+`Zmf}(aYCD0-F%PC|OW=E{ng9O>iA`W+5CPR!y&4RR
zmYV-Bgle(bX?HPjg6?>fNoL>z&8<PlUj#guu1#TJiG!c_3F^yOIxv9mh6b4dszYFP
z-bQC|e}n<l1_0G1pmSJ3ZLUU71_e;vInf2YH<bYtevo?Ungs((oCwT)AhTg+g4_sF
z1FD-qW`WvupmG#c2YN7F1Mjbgv<YKDd+gzLF(}RGurM$nn*%o^u7Ls6R&s1&5NYIM
zPymHReTM?5f2#vp$J40AkkgRGAW*X(G`_~X43y?-l7Cge_I}hPvzvh2<iT{cp&<!!
z=NAJ@YzUF=X92n2gXt>h9u)8yT^7j<EReB$V@1#yy+twub4W6S73w&B%ok+yLH@H?
zz|er~KTy9O<VTPnKw$-5EBUW(DQLYeXnfHkfq@w`h5$-?yALvOK-TKkpI~5#nE~7H
z0}gx8nS+qE8#18$2{IF8UZY(DPh(tz0H}-x<p<EZ$%&o}0^qitCxZfLK6auf_-qhR
zegW;JRGH|>5CB?#G|`g*v<^vUq9;Q^V_bv5L{EkWP<vpaC&L6#Jv`BqVL>P8{Etos
z(49&(p!sG{p7;Kj4Bnsau#W+Bo;v8v-+!Prx7wWyY>smoTtMvx@Y+o+4?XZXXrAEs
zQUJ}*gU+7?)$^b{51Nk$ok;?kiwE_eL2XX(nLCiPp#-e|gZ2^pZvdqQ$h_F)1>XPv
zC3ye;7sJ334Lbkm1ZYed6h8Y9;bT)%B@Lb*1L*^Wkz*611*m>?oW}?{(>?&?x0)Hs
z71mMz|5zPhy<@fDf1|Y~18Bb~%VbRk22lTaq9y}JOBDkPsQh!B$8g8{|G!euoFTL?
z`l8c@ffKYB#$oUOJDoNRT#!2o!R<fLy}5~?y2xSyLj|Zl@cx&~2vRfYK7+!n{S4w8
z?HNGl=48Om<A#-?HRaNv^HEb8%^5&vBZAKQjp#II;O>k8ogp0n$_pMA2@D|f8A0ZQ
z%m&%v{V!>uMLh!#sGPT006H%_nH6Lo$ezje3=E+4#-MNorLoDs88|@w(D1#Wvrhio
zfc9X+@^7Ouc>V}vF9&FT6*TYa!E}ko`~ROe3@lNgF%x)R2HmBMoX$ac4=GKCK+|Hx
zgiHn=aQWiNz|t7k5Hrz}0W^mm08OLdJU`KsL8LLRAz`8?c-?QxL{A2p#<+%ziIDW0
zGtrYlr7^CdV4^33254XML{A1#zpw(Du4^WGGMF^RH8f20WUv6&1)dBx6FnImCVDcs
zO!Q>%nCQvi1Fjn&>Aq*8CqqbMT*HKko(wUKao~N|pnNc6q9;R2V_d_WiJlA@jd2YN
zCVDdDG{!Y7f##1D6FnJ98si$)O!Q=^XpC#vFwv8trZKKz3pC&CnCQvS(ijKc7YS-B
zADHOL(9;;#a0HZ}8si#HO!Q=!(iqopW}+v<jK;Wz3llvV<}}7NTmj`X52gzzI#n1L
z>zl!65Xm&EFbK#%@3d%CW=H_F0e$vC%0*Dw3M+TCTNxNFRsa77oreu7mqBsjFqdIU
z%@Qq<S{IK1OV<DYLH(8b76(wjhDW~@d@rj6sGb1jJyXz{%_au$-v3S(1_pi5J;n3>
zzX9F<YVqX%fAD#S?j8Y-bHQi8gVLZ5RIdtDuLfvs$xMy^|2x&eeR&1Pc?=w&dD&id
z21by(9p?SN0jj4#X=J7{XnoK5I}9ulpf&aI^aOG@sJ;UE0aj*$@@~UC&>qEj@IHUg
zcwzWswQr!Z0+hEw=6NukpTNKp0V=oQX4Pa#SKz8=8tyf4I5sf&fac3XGBr#<bGw}y
z42<Bt4RaYx8aWsQWK|e)YBjt>Iyo7*^*g|2A84)=mL~-^w1Lkb0IhEhSg8hPGl2Z*
zIETRjWNxUJhDohQkVq#N17m%s189CmqtS~&Kvt6>2XuC1rzZoqeiztWfrd;55kuww
z|7$WO1t9)8cYuK<9Odk!kW3cPJv_|FVFb%-pnIIb^GP7TczLV?g)_Wvw`<_pkO^L2
z0dgy7-WlBI1m#B$rgITB3~XyURT-FTlD(%jsxt6^+iRK<dNrL&A~r2I7&=lQ^(bsk
z3VdE<A_I^769z8unDriQ@P0;%1_pM}c&qpS{~JMdQ$Z#}gJTmot)_S|n#)?+|Njqd
zWAcFNDewRP&w%CyL3N1-(^=4**9}lP4xT5NrCb3zf7GIZiLK_SafST?aC=4vbZ!S|
z4l{YLU?J!nM$j1>NcLLRWL~fUm5246H$df=Oz}$wMh8&3PGCs!U^JU)z88Eq0?1zQ
zdUp?|vo2u&t3my*hUxzqOCbJdU<rMKyaoxhA7bA@1_5Y#wE@`+iVx5_y@qrK5m5Uc
zG`2dik%0%4hHG|cS3u6k`zsid%J$Eqfq@OwzD`)m@Bp+=5_C>Fh;PxregQP5=l%cR
zL~s}`Vvqo}mqF%%?iKL<uaxM)z|;crx5Wa6ry#u`ecu27gU$#v@?bRG2sY#K?+U0n
zo}ja13bGg)92WiGQIN^N=-9+y1G>Kk)UWjZuOt}m#lTiCbx5REi{S!j{I%B8!@}yp
z{|BJE11&ZGKM2+0{|CDB$%BEx0%R9xKL^C@zej7T8BD^fZ`OhCQ-sQ~gXFBi=j{Gn
z3bLbq&H;zITMq(2XG%cS!2I}kE!2-9Fh6?#S8ViPU|a&)vj<Vj03JsH`P2LVzfh<c
zb9k$p9aPK_D#ilZV+9q{g^IBviAh4mK;|(*)q&4a0Np<x-pU3w@9#&bI+pO(V=%G1
zP%+l<);5^f$%a};JUdPT&3FB_1jT7h>h21V*&y|xJtE%!|1Jcvq4A~S!N6eR{r@*_
zc&ocz&C=bVadozurPAnnV0*jRL3`ss=7G-MwMbwv@?bQ+2r>_}m&l?)xWi!{=u8Dz
zc>akk$YkgQjopIoY6kWH8|oS)Kxqe(Hx*Pp7#KV{Z5fywV;MmCa2l+QX6eAt2wKZ$
zt9gUL$>E;`C|@k}WMJ4B$-n?(TU#=)Y>fQ>&-?%X2aSykptEExKyw4NpnIE`PQGDa
z2|56)lR)h;Y-JUw&D-#=fo1nW2Jrc|;I{7nKPwnmf?9~wD}$ythk+%?gGjv!XnGA8
zSb{+3SA)wQu$vKg3+ll0^bBS2dC;}8&J_(A3?iU&c))pj4`j~VTH*f#@Bcrc@qZdE
zE`Kisr$Nx#vId3@NL>CFEy!f(s7aNs0L@u6)HQ(8#RX8jS~M^)g4Hhrog4c*6)FZw
zvkXwZ;Ql@+%_6C@g{or-cZH?n-<sjBkn{_cWA*<3TNIXNz5oB{grrw=_x}0_O{)t)
z_JQ<*&Y^^)J;PAY9XKE{iw1^Hki7T*U!LGJmnvNWPIL1ZK;vcL`&&I27|y`bTKycp
zg8Dg(Q)=zKr-8}_&>C%c+Kc%A50dT}L_le6DHj9NMov(_`~L@!y`c499*hRixg!P+
z>jnl6P<lpn$IpW>cR=^`Nr1{ahbD$EpmETS8K7}O@EABNsC)wH_5S~p6|{FNq{cxH
zA@<{A%^WF_`j!izdsskauR%TdTuGUi76}ahJs22v=(m99s|`SI^I$Z9l|PM$`1olG
zwYvh;M)6=^XsH4DACd-`Kz4z`ACw0RG8vdaVFU^ji`)PILBfU24irwX@BxL5Llc99
zlf(ZB;P7!{VA|*j2_Gki|1}^nP+r~Y20qIPJiZA^M^JkdLz17_LDs7s3t(XJ2c4Y;
zUn>dfLxB1VC~GEbq(O6oA3$lm`CkKcY%0vrQh|X3v_=)wz5w+lKz^HP&%iO$o`D;5
z9<-$b6X-rA(4I$&iS`T$9!$-kvsf5BnA$;WLj^$X0&p8?9{A2|NLy+j<UULf#`{}A
zcXLes!yw==kHG|b-xjFP3A%R;Ja^&!UplpckwK=RhCu*yCOxRn3_6eAgYj+wq;Gh%
zfq}&jv=$WJ4#Zgo%|kDPzH~6K_<_!GCq^$?8T7@6fyEcph9O3;18N!cMSy|Dw}Yti
zYhD9d`Stk<1B<WE6vhAWwFdhb88o16k{r-^LEtvYH06q#t=bheSBxuaK3iARN;-qr
zfPv~}@V#CCK0?;J&V%o*<FZd+VD?}%`IubI>rkJ3^BQQp(7J(v%X$GriZvsHjMYO1
z4l4%+W-A2-A<%qa-I2`|pnc%rJD$^LSJZ2O=1zaD)L{nCQ^4;23eau_wRss`py`eW
zG~Vd_FBr6k60}B92sBUX{V(_`Xl@g<uNidy0myud2Mj_WGiNz6$jnj%oh9?jx6_e<
zt79R9NXJ12(Lxsne#b@s=YYo4LF1>|tqdw48g#yr!#)PkJ+2MfE#S470+y`*Z)kTg
zfc9J(fX3skWd8qmn9Cqxlfb}SC(~S!kj(4g!Kjnz{r^8G?RkLCH3E&BYqx^WU$6n)
z+3T>6!3LCGtz?n(%EI;PdjJ3T1~jK&(ZG=6{a<3O2LnTZb}Iwu{x1*h76xw6n7Vcg
z=#Co(1F*UC7&O4<&SOvjjURe2YQNN;&%g{CgLj<EAOdMK|C`ZJ*AU?SAAHWvf5=*f
zL!h<s;B|=LJ=~ysJjx+wgoE19pf+dCH*4^my48aJD?nwbRU-ojsQpl1f4c(IPqTi&
zz!<*L%`W^$gvLxo2CndxEp{^%8Mr}l5x(+}U0us!&=@@rX#X|n&d9nGn=585WZ;<H
z$iO*Mk%4FSLI&R1jSPIV8yWa#H!=v!e#js=yOBX?b|ZtZ_y51C`rtTckf^V}5m+Df
zO9XVjf4$`)(0$yXb+jI!`1N2qxP*bl3v_2a;XH)Ve)!M8z~Y6{|HGN@|23fH-G4_I
zSiDfiHSp*~%YXkm7+5^dOi}#X0P4Gd+7A{Bm>BjQWP;A!F|}AbGH`(NAoPr7kY7P*
zA5^w_{|k8AP|Lv5JRfw{&D)EX3Jgrpu_oAE!CW4UhPj|I#ZXNSoBBB(pnDYrKxe#z
z%3KcymL1^w9JIzu0dilMH3O(E@?kBgZU^-<Ky@^@j{!PA@&9L0#NBh6ouKi5XkE_%
zQs@2u(^n+<Owb$~sJw@&V}{fxA3=L~L1$OSK*d?0;-L985r=&YE>LlBJ?s7dBj}vE
z*ADv_bU^2wgXBPFLhW4$wYL@|ZqXne0U8^Guo*yY-#1YCScn*`o%^x0Ad^88*51&c
z4Z35Jc@5~yn})iE5bu9)z+(lD^T6x(BfS6lL(ZR>$B>~v6Fl~j01G$o|L+??VO5iQ
z7~F0Hwb?;-dH?_T5)l>}Q2W7df`-+{lSuNmAUA;aGdaxr2Ri$Z+0ucb0o0xb?O&^(
z<2?;@2SfNA0jpZg2YR6T98_o5Jn+-0_qtqB^U667#^3OYfyt7CfyIg8{{w4zhA@jp
z1~X6@X|aHT)9OBhg!lh<yjK4i96{}Fi$(@Jiv<jt-v8hJ1m#tWMg|#+1q`Cz|KGj@
z?fnncWHTt#`u`s^p9zY~nf46ebNy$=Gw^`+YCy&-nG`_j$vTnA1C*vfX|p+=0o0e`
zv2J7npU2Z^%OC@)&%OWo*@EOj=iP$C=%1f1_-=1SCU71G-46kplLD37^=*$qd-OEw
zSG=y6smSEx{r_hy=)NU~MNBLZw=;q6cjWN?|JD}bb|wkX`ZDkTZ*{@`ZDi80Sir#Q
z{r|0Ory>)_Y<mW-$@UBap_**}CfhTJfZW=t$ixXdBgA13^o&ZVA7|Tx_xywE6dq7{
z>iy3b6we?&_|6yaf4+s53JlUS5pHKjb2|gV?LR<in89HmBd9I_nE^9X7d1S5WkLBH
zn>pV9f5d|Fw!=O~@VWEgFan<q<?|BN44<2p3Jj`P%;A8#$HV*o5AeMR4owU@Kw&eZ
zo`E-1>i{1pJV0k`fX9~{nYcmY?wyKET;Q`lwY)??ZM05BCLX9-UL>{rP_=wWYC&^z
zpgWryLNy!gKzbJ{GOP>LWX*!6DHUj%;$5i7a4A%)L2jWU!v)Zpq9C=P@wu7t450lF
z43-W|450X$7!Qs&F3Uuw1`np)dl*<;K;wV#Gc_hKGPvwZgzRyL^}QOB8Nm19djER?
zo`(d@S3$#z%Y#uT5HuzPva8#kfeAD=Z_U8K02;fnI>3-(1v;B>?g<9Rd5k*U^BEY!
zH*<i-J!0zToSs%c_u)0rdOGj_f`Xv4=V5udo^!UI2ct@ELp_5CME*5s9G?x`uYdNt
z0#QD^Mausww&1zqe=k7(wE@L5XfGndo!X!~vnu2|8B#!PF7UZ~)u1^<6;@C_0+ofJ
zbv@qy-;~zRUf=*~w>j)(P-y_qAq#kd+8K`X7!^S71kGF2dd}AKU|@*QpUsf$Fqc85
z)_U_bSxttN`q>_!u~|@COV9g1|I1=eh6abG|5J)R85V%bfQGt;4DbK^KSBFYA#=(6
zZ$W0(t(>g~nh)^){||J3F&8Kdz5nyCv`+Z{A9UUkXniiI-Oy>zz*s*6d>8T*(0wfO
zI~a0mHD8I$&Sc;Qo#|hz^-84P>!sdoO$Lt1oD3`t^$egpDJ4L6jDXh4O;lz`2<K$5
zsnzmYH@TTXWO6eDcyEg1J_Z}m7=`!$A3H&MKx#c0FV2Or8<nBz<}rwX?ui8VA@(tF
zcradWw3Yy`3(tU@Te35TfyD{b{)f*AStKyz>{o=Jzhncdi$Qg7^S=g`j`<+HvYs9D
z8JH&2gU^>{@%}Gs3FU*rk;(hNtY)KKL&1c4&^U{skVS&PR8T(;)c<L;YbXKTA>;k8
zQBuG8|9?>b26V<LSWSZ|_{<;ge+_?Oa*p#DmVo-377G~ILF1m@|LP+_>pnqj@O`5H
z>MTL$*nrkofcywrO9dX^S-|igbWV^pXe@E@>k99Gb%o%wI-u(mz5mrQg4Qj7?o5E1
z1z!6as>xsln#=Y6SNjkq4;5p9=3UVGu!@QH44^Y4Y9`t<$aKtS0NweT<NaU8uwy=h
z(u8{Od=`uMe;Gw6A9R)_llOlaLC{?Kgn9-Iiv~jxu%8z&fck$bp!xKP_6#Q8{~EyS
zM?m2MI-3{fckh37iKzarbtKN;wUwy;uH}UKO9#8ZYhJ?SVg7E6XV3wyZ?e>60?l)C
zK=~|CK4={;%S?L)rJ42&iqJ3u%~^I#v}dpYpF3>NU<2y^cFbpRnrII`A02c@h>!Pw
zY0$dt3C(p4Qzq0icucfsZ~>jQI=P-91awX;s4oIF&jGY&d7?c-#6)|Bn2z}ji6HYp
z>2#(dXs%OgXUBYoqzUy51r`aQ{j^dmq5K?+1W^B83Uqh$j0yD&85Rv}4M^dh0-D2{
zXb(C+tgaKD=JqkBfYz78!p-|%^;OVWGL7*JIToPvX`pEc8a@o(|Ejkl$wSW3S^T;J
zD$nBmuX-wItqdqGL1CV-lz|0u*GWyUMFT?vC~ttoz5i98wP;`folON^EAIWTdap$T
zLl@{g9f*8YFX&7ikQj)cu#|xjRJMZ5w`gEkWU;`g3ncFSullad0;4XA28JaGOJQO)
ziZ%<JCs{NwtVmeuJPD$%hSz3+1E)m;!<vMp4xA9N>Yo-344aV5ng}&(3&O1Gt5CCc
zAk3;h2r>&~hD8Iz9*}w7|EfXvUop<KXGmzYYnU_9o}r@Au3^DMdxjd&JZSyP-xZ+t
zUZ*E$%?5))C+Gi1wO-ECW_tdA?8NZ@4P<Y_{|B9rdxRMr_c2}p*D)!e^C4ZpXS#yM
zq(Jjq-v8evdN43<@&5ngDX2~Zm%DR8bApTuK;^8gEo2U<Q4=~xypOQ~Y!>*gsV5sD
z?b*{6ptVgPKY+va|8q$Y8$34vI(PB^GegkWyF(MWFU}60OL+Dhyw2bI|FgG{u`StD
zR6S4sg69#M7zIG}0eFmS5d-)R8t|L|*xaWZYibxw!spzqL(_W@qL%^UZ-`q#<8N#=
zspxKfmJ89#zzj}L&p_*4pG88&Ky6b7kl(!jKZC59ZeW0n^F!1bLe+uBQJJCYWT9f9
zaa10t7$~iP%VCQJ4DTUgPrpL^Ed#b6G&X=T#t!!16Udru(0mt!e-K)C#^}#tV7C6x
zpkN&ZK08nXGIze|0RxLQ=-gKL7&B<T7G*DQHDtW4X0JAQT*hH8!-8fu1{Tm<S94s$
z3eea~z5OMTnpr>e7VKnT1GSGm7$v~%A<*3}`g0kWR{vxGow1<-iWg9t0nIb$&u37u
z{?EVxTB8S2<FJ>(!}`Jh{|z;uJ4SE!*3`0_G}M6hs@`s_sbMz(tvv>vVXHkKWELan
ztn@XY^-Z;&KlDItO6VE|(0Z*U4YNUI75h~W2F4yx*n0ne3>!l-0j)<_k;%ZI54yv5
zA9y_2!TbN~UJnLFP~Kq)N!Bm{?XC0v|BcmyfzhX-u3-acj1+1PWY6@z|8GF%fc(->
z*RW+ZWF0a~_<s$P`j_B)LPfm)vxkE7M&}FA-8T;4HpyI2o8*y5rzZH^LD2Z2OhaA6
z4$%5{@Bi$okT%655f8?bwxD<m-^*eLn!9SKYuMxcpY5&(1H&GOJ03y$koy?cH2-Vh
z0ks8J)Pu%cAA-+VcihJ?WhH1`MO*_*LtVoG(7o)SFan*S)Uc94WJMQ9E!$QP28JA{
zd9eE+V$jU<g|-)6VCEs4)u_oJup*0r0k#gHQ<;GS)HVR!3*o_d8obW0p|0VG_kT7|
z&=@ad{ndsH1{TXd$Y)A`&Y=Y5C5r^1eB^T_VC^CAe-)w4{~8!3)H5)E?lkfK&w3Hk
zNBj>8Lr@%Xc>ibJ>%qVXTGPe@s?$OH_(AIcKy^8&J^-B`@BOb-biqOf4v-v3EMzJ8
zyfqH*e`TVewFaPhK2V%`|7R@(xfc{R9!%>&>$SmS(jfQ2+zL6zxO^|DE(6t((6+w_
z$Ug6XrM#eeDpZrf1~euNn$HG}1%t+fp=%>>nU{-Zo&dzW642SZ9JtJ5V6nhCw*{KB
zhlL|(owo<mdIpOGrUsBZED{(WfN0PzYUDBAkfjcKAuSDZpmRfz$D2TBkATbyIpQQ2
za_Wd)$gu-_H7&svpm}*vyS1jx7*y}Dfb0aV;kVUf;IPzWVW>GNsprA8u7iQa0<?}C
z?04{ZR0H^q^9i84#h~NDG9dFoW`WwkpgPC<pIxf=|9_33bO?%n(0Y8(*uDn?!wK*I
z|3Kq9pmZVPxbOcP(EY0u>KQCRG$>9c)HB$C?sNpTZ6?|?s5II$Skx+eUIVo$z5oBa
z2udfQHO$~NJC8x3Q5JNEHS>$ccm@XRy$l?+oPl~CjAEeskM1<uGl15lFf__Dh=BGC
zg@Vph1KoL}2|hDLB-B&D3bc-;=A|R(+<*_DbQHdX%?^}?K<oD*`zZd+)t}1%-uDOE
zM*;F5WNu(>1_O&Z3v!;YRImk)XJE?@pm?093|=?EK2e#0#Zp1QXQDD_-@Yw~&*S~C
z_$Mg*K;Z>m&-b5cAzFUn@&3=$3)?#m${QXGj59&u0nQr>LH!BPxL@H@?D?hWDKx)`
zfc)wGpUDxCU)IcFU@-&T*@btk6x1FBt@X6@Vvqo}dFwkRK=+yPfcBwy|Ns91l!iQ*
z)`Woa185&OY^@=vtq95!ko;E&TBj(}kO*FvC;`e}HlTapk{N73=^B(yKs3}0&|O*J
zv}e)40M4gSGZI006xocBWCk^mKA3(67E{pJFL-}4DBXhgJwwy03TT}PD9wV}!=OEP
zpn4Ltrx=umz5oCF3-jmXEC=v;`yfA0?sDJ&`4h}u1!Ze8Fid_4VT0D5crdN@VPG)@
zjs3#yh4$GeAlnbJ8)O%#d<3N@?|;^&pgl~Wb@Sf;{~g85H*6=Ma&Mt>puF<}R90Fl
zFf~k!XHc<qU|>n~+5qY=Sxk&)kg!x>d;rQ56QTVJP@V$y-N1f`XJ7!uA2<)q`Tql)
z*R&Wiz;Yz!8BiJpjUj;6=7IGine8x#0g*No{{Nq-B?t-6cm{@vT7nKp>I(`r|Noq*
z#ZUmk$l{5h{anc6_TW1@<R*GT<HjC5PR%qq(;)z?4<av#BENuvVe(28c{XHuG`as1
zJsrSj?t}a`c_qT0$twjQZU))ez+f=BQvkeg3#880;jLq$SB%j_PXX{AGLYEhm5}=y
zKzC4h|NpZTBxbA0z&Lqj7eXJH-+|7TfcXWYzHtF6zZ0Dg-V25>zZuQEwgOcBZRqk9
zsPg@gc(P|;fY{&u03>gbz`*VO|My*lJ#7;};s|~RJlr7qIy6w_dmwoTWUd1P3rNjG
z&rUSAG@|hv(EQp3-dhK<bMi_Cc$`npWQYLS1qtilmJoRZxIZi%7y>4G8o=$hbYM6?
z(bE9p-gt1i%rjBT0ODQ{pMgPPB9{U9t`AT?n%rfe05TuShQtq89TWRRE&~ggoOJ>N
z=j1E{4;X)<mI2(2mJSRW6Fm*!X~@!nNpqs70nFW;-v56!g3Py6U@)4f1x<JH3=ET3
zLDMdX-GvahWMHtG$c2!zWMD9y$b}-$iYyN|)1H9=mS1cc7#J-b7>pA+7#Kl!L4m>z
zmN%Rn7(jO&Gc;;C1Qcp82sk$Ve*(H^1+?!L>P{uNnc%QsU_iFd5*&so?#V!tS449!
z8?rpyY)GEwp6ChjE9lNJO9uwcL}*=3gquP0%naWDe}d1)0;RjjD;vRkIYD|M{0_7{
z)PXLKme#w_)OVrFgU@tBGJgj+O@RIK|3ApiiJl#hGzH2JnxON_y1-=zBn|&41?jbP
zV32^t2b3=W3kN9Q0a+fcEOW#o=Y&Vj8IPO`HaX08(~njx?Ir~erX?DnJ)4dV;Cm@R
z`&0gd?lBKlX0t=BzjaR_w{Q0&&Y6VYR|>7CSsFPRcxt_*L?(JNu+%a;1c2^?ng|ke
z4hR6PTLrBTci6)KIvbi5R8K+LDT~)Iu;_x$!@}R@k!xURc)`F?%jR66-wvMR7Xh8S
z1Ttfy8fe||;uO#sFP)wY44s+`jG<l*dZ0Ve>N_nMCTcM7IL`fl1++#DG}g8ox)%e~
z=JEdjUxk512ebwhZog#%_I)fC3=FKGGvaKu7&sa^8TZt8fbZiz)3Azx!{P-4hkh#q
zgX3NXnMO{=9TQ$M?g`~^&`acC_&<@8aR+E0Z^J1D7K=6p#tB^vEEcW*|97S_Fo4uG
zyky*=-OccSLKg!E=&aFN(AlOh8Fx6$`#%S?CJA&ml|>r^lf}~i|3G>>jxjJ!SjE7h
z-NtYe)OXTuWBBj5?|%VwO@x5=|NkiyyFg<B|6@XqvRUZ2GF$-NjXr@3)OY>w0kXrA
zgF&F?xpBorPR2bGUV`0c(CEpy1Jniq#a*qYgn>oo|NpffZU&$*u4R_6@L*cRz`&xt
z1J<4dx91RhGf?)ffZ9~{|3P=5Gw!MHlwbhO<AK^tpmhn}|Nl*Gv}XjJbtF-1>k%-~
zo^g){)4~M|EZU$o58!qt*z86I4rp5ue%>4CE-27BBcOJh_y2#sA;}yz_4B1fYU(A{
zfy@V;84OB~mJST8p!PK=op~@Y#CZSz@7w){fe|w2!oV^6F9SpIe+GV#8b|2;+1~&E
z{spz;!EM3+|79)X|NjSvhh~5Q=sb6aISeA8In`SG9|oW?70`MIP#*-;Pw`+{aEF0K
zYYuW=u~`7_3os-sWjcW^-+<C1s6PTqkD#;&UNia6U;_h-7HDr1)^Grg8Nu7F^BNdx
zZGMS>&YNn;WC#KI9~{2_euMUqM_B)7&;jkQw%^OZ(NN2D1WEoRsNKFBbdQ%Jg9ONK
z@BjZj7+5qxXE}lI*a3zA-h&Jd(D3hpt=k8O59q$s|Nj#~;T-;ip$;@Qq2B^(Pcg7e
z=w#q<m@8D$DGRF4{@(z}fzB!Ilx1M3^>Vfd^<uLFl?4v_gaT@fyg}>enCy!{Y4!J9
zOKZjhmW~V@pgrYvVUt03_!!iMPp)Vv0*^T{ILzaI&?v^hq2B?z!$gRsQH+75lLNf3
z;lIN?!7re^?fw6EC`A1Kf9(#2TaNQswm9x(P|)sRIN&&s!A84-;fTXL?i%m^zb9HR
z`2WU(f$4~L2g6;*c`OOq9Sr{*=W&N<cQD*`*vB2={r`6^Xbp`A1B;IL|KEv?VhlX`
z9Sj_xvnN4i&qO0|eo6t^*YN^;_AzL$bU?=o2GE^lY#k>Um_T{0=D2mmgl`NY9WNM|
zJ5DgLAc+Zdaxkz?6a$?v^J{LS7=s4LZ=g9w{SF3ZP@V;yS?<BWc%|VJ1CJ~R19N@5
z1L)3%mbzcNE9(C5u7HgTg6HxW7#JIc7&Pi<I)Kg|ThZ{1fu)n3fnlONgH9(q17j%1
zLp#v@eiP*x3>^3Ucd$6||9{OX2TO-V|K~vD*<tb~j{E*AfaOnu<!d_G8JG&W82(I@
zXK-;?^q&Q^x6S+i&zFtz3@-KT4hD^43>#`*I9E&*W7yCr&tOnL7wiTO(AwHYc?OgE
zIZ(cga|P(kCs5k-{{KG&<X_M|BooCLOh9MWPZVP?uwKBx*zk!#Abf>{#Y7<nh43~B
ziwTz)R6uFJ=7p6A=xp4Y=g!v}g&0I?*_=c`=K$Ao7+;(4i9uqb5CdqhDF-Njg2Q4y
z*xoG--xvfMb}<+<%wjO9d1`sB=J_kAIj^rx_{CrWIzO>dj6tN9#qnA#$0MkjkFQOX
zVz6l_V~}XL#-LDh*zj7-G0kf=$6jBXaEk#nHt7O7GZ{4g+EBzGV;#ky(<sECQj_d>
z4Ro$pP4eSwHEEL9y#M`zjI~rTXgJLKpJB<sz&ue1ly?4V)VIE1aGdvlkN5w767?+)
zK<pjf|Nnu~8MDJajwcOe3<4l`fy|Ui2A$3F3%o~tLN(J7hkYDJy#N2-(kKK@mjVuR
z87DMcV_@lIV_>M|d|~OZ=x<CR7Xy>SqQ84UcSYCA%N2medO_>7>t8rmgvzt;1D)Mm
z)8??QX1S9{%^&Lu(0-p8t^fan<~G9rcgR>IFbLLv`X%E1|NCF-|BO5A9T*rv>v8NE
z7#M41PKne@@D+4q{QnOvTWUaV0o99+d;UC7lw=U7$#5{J_qY(~xZux)hG`5e;jA1s
zpfP#S`Wedz2FBVHhjpO&m73$m6`*$RY;^_(i{}hXGt)t5r~Ll_a!<`MEfKJpbN*kj
zWd8rZmgC^HT8={^p&T4GpmW*1|9?-^pUEHqN>>i^{^x+k=|Se#dxFN7{yhn0=K#;`
z)!JLG1DOZ96AzSUJ2@B_Kxx`x(I1nBZwy;36&M^q;Zy(2!61~wzzCFYYsH*ICV=EP
z7<PcpGitcRz*4i!VqMJ%P&#B_oUsfNRu%~ij^6*j-30kxzk|WSaqj;GpuFZV@AnPw
z|Gyo)|9@9(C}ZH!Z)RY0*!%kkEN^x^2jxo#J#gNUW;)=(!1kpvn(4qqN6?y}Z*Lp6
zF=#Y=W8kqk%D@zIjKikB-GISy&+itP`|CS27#!yPz5^;}LFIw>|8Jq7It`rmA$c$a
zWLLv|a2dc*-(kSuu<y4ED8E}O{C@|^hqas@mJW-48-U6OP#HQ=o<RXLh7M8_%EA6G
zk%NJ0qCA6)_y4ayz5oAT0kRuf-hs?Y0F`(8?F{w~^L~ePaxgGK{p|truhjwu25SaT
zTK~EiJU-#bpi=j9cZHP#0|VHN6G8ctRR?sJSED3@N&OTsU%)DXfuVUPgF*e|7Yq(_
zSbj8GGK7G}a2g{S94r<vGBhMIfX@$|sK_7#8n2w_$e;i^i>Uc0XntBVx1o~32c$kE
zxkIL=NJ_*a8Pvx4zO+%2A)qGN33QjN%Y;gX08l*F3OR{%axm-w<*^CXj0YMj89Xc+
z8931NW_B`y>mJZr4A42<9F2?&I-s-*nhPl8WZ(y_<<{<C_~5t?e8(y4#30bxbQTRz
zxPsCh=&XGGISlrodv+RrGPpF#f$n86Fsk`vB~r`rU|r4gM<N~18FtumfY*u@)FfM8
z3*`{7swr~R1Ep*4|Nna$PcTR{doXY`zF=T!?qHB<;$RS|cQ3AJI00(URfG01@YFni
zTv7A9xuRhO14GEM2#uQO(iJr?jVm1%G3bOWm9Utwf<b1&3I>S@D;Pv3tY8qBu!4bS
z!U_hC2`d;_CaeItnc+_j|05BZIiEJkHZYlnERE2xSjx~K`<~-T4UdvY%>*eC`4-NM
z+Ba1qGR+_SYpRMw<OKdalzGe&QZq+Mq)w(uM5c;Op}y5fq~@4LfXup&7WMv3A~oq!
zA~nmkL~1@%1k^DoiPW?(1k^rP5~-1q5|Mq+u(jriML<pRg8-T53|s5lv_vf5Gc?p3
zH3+C#a7m>0y<0)eQnvz&=L`)XH`eT_5~+C(5vzUwAOPg{nq^iZAT>3|4M2R38YzZ=
zn#D~bH3bp@VDV(Pf|_G)1z@un+zP<{&R`IjaDqW(;tK|e2^<VEmK+QUP7MF%fX=&U
zbYxJd-|_NVqatMebp8KDBK7|Ruhsv5B~t%?mPq)22@BAiRm~+Ok^1+)D{PK2a5T?k
zaA;V@)X>1j#L#$*@j<g2(}G4eri2=1?TRKgCWo5j;);f6ObRv0mn&+Loh!lw9Q10E
ztt)D>nkyZe7%Upn7!OQnWU#SFW>Ba}HY>15W@zyK|0xo*Mjuo*H8e8V%*bb8sD1wk
zbcXE@4+h2^&C3`M)SSB{Qj=jNB6Ez%R6gp{CXgAj=Qy5N9AjXSN#@K5-|L_!^ZbK<
z?Xe;eS&lysYmQwK0qujYchC~C-mAa>I#XXhiX{YepM?wqn?g;xTtQ83lSrMwivanh
zA1$n-7+7kK$raR|lPjp@kSnO)^-2VE=6h|QlSu6|Q2H$hsCjM>P#+~%P_y`wNPUz<
z0LVSH><$4k$qZZT_sSK>axiSI4R{5zw_(CU28)_xw*pHJhK31=3<@==Ng_4LWd*ey
zZeTx8WMt5o*vMc~zqcV^q9ds6`4|d{k2?8Bpt}rZYA-wznNiQcP?H%1)&~ivkA|Q-
z9Bb+yuB)l_LKc^-DR{W9rm6}oR_}iy0HnT-?~#c2{||p_@*b|McP<0l3o^If4=nz)
z(UCy|q_2L}i-7vYWd-%S9)aEN{r|&BP?`X_2c)+q%Oe2fc95Cg|39p)sd~7sVIhM>
zV<Uq}ZI4DkZ8OAd@Bber*3>>+2Z}@e76utm8^xl9fyH6o-vf<8;C3v7!@jQ~R>h$8
zOTSsHrhw>QZ>$U%7_BWq=PdoY&?v?r0a_bXKf?jEW>}(8j6ud~D+6QwR8YCe&|}TO
zz|bhobO2NaJMQ~619VR$=v;A7ed5sctD{kxaSx~u70SV8F;SXvkN5wNoS-#%ATjU%
zpESc?uvp}B{{OGv`Tv5$yst8ijtnZ{|Jm#6=Ldk?#$&C;zzC|J!Zq3JCMq(hK+9f<
ziDnD|6U`WECYmv<@c#cx0ep_S7^vL;;^O`PgDR*l0G$gE%E4x)-@)*}VIG^0_x}&P
z4Mm`N>h}x1|9_FuZf0O}*vDo8s=Mp%Zw9p`8LS!@m_hp^8-o}$>Zb*O>VgLi^$Zq`
zLJR_p@eDTg%^-iXY_Vqk{}*(J1*kvh{qLhEWKAjq&!kD9@{I9E^L~bqdYjV~&G8I2
zkn_$MPju8WFo5np>WpPzw0Z!Zi|v;6`u`PlKD0$LgF{WSU4i%icXwyhFff4Bg4D?*
zGi1nmF-U{dbjC6;$$Ek84FaVLnEJIdY8V)i)XT_vG2|kt{|;g!nO{4jhJmSmI_Qj4
zhAAD@3=CmkIcz$k85pff8JMlMGO$>EXJC{`{{J1c4q4WVAs?h4Brog5APZ$<bBAh8
z&CGQj)&Ku@MuYtJ|1XkyMkI4UdePkU_GL}Y%5~oV|K~KuGdNgB{r_LTH%O#0p24D{
z_W%D-FVLFxAd$}4|Nmr?8Ib%3vg1FxS#xL9{QnEm2UU+0eqi-~Yn_8cEV5wX{Wf<-
z&HsO$vH$<eWHEGu^nl_7O^xS_8c_T2p9RQG4fPBmAU92nX8_H)IC%ei^K!C1Lr7x~
z0|U6PIgj~5Lp_5{V-SN#eRBYV!ycxR=6D8+=KTx~HC2+=!nbqSK+?^7!I}#2ISmT3
zQ4GxCp&T}K7OO-+eJoJ^sjFoG-M4%MlBSppYHz;02HM|M^K<33+Pg&}wE{&VH3bFh
z>TMkYYQ-G_IwKhv>hrBcP{PQAfnfsZ{4_=e3t2DpuzFM2@Q}fzCf{;h?e9xqvp{Av
zGBQ}8q&pALohj()?u}_p^~H6y0R`*8;T8#2^A$DR-U!y@UtCu|=K@2sJwu4Y97dno
z$Or4{D<6r}Nxu>S>8p)?u?{o5U*D{$c(|^n^1(WgJhEGAqj!MRqs8Itm9-I<L~627
z^uW^zNKc(~a|NdVUl)SPtD3@x>uUdai8R|Y*wp^05~+PxU14qc|8Kp<X~_Nb`~G#*
zRL@ukP1oOHX&K};SQ-b}F%c5Re?fT!k>6hP&d6h6K++G-7f}7+`~}iqU;Ro1(~Ymr
z*5qAWS9@-i2q<1aeNSjUu>tK{ho(atP`aEL&*0$w?^Wz%c|=-tocG(sgMrbZp@>1G
zzDt6^an9cu(EWs<cDVQd-!l4L49pJu7*5y*F>o{+F@!W{F&$|ZVrXdk#IUC65`&2T
zGzJF8d5jF8G}#!$AW%OCR3<W1)Ng;V&bpd`85BqLKOU?DrAzC*{~JQ89Q0&r8Pl!*
z|8J1r``@#s3e*;6XaLo{-v3`Q&Zz$XSEl~|3i<zx$3SxRi(iRY)WYOnKAchg|6fhj
zFHrdg)${V~4Dh*@|63Y^7#ysw{r_KY86?se#E?@j0j6iveGd}x{{KIsF^IvUc@u*}
zeHW;Y%iz=ei6NwU5`#_seo*@<NCb3_FK8_m=uGg2O^`k4;PpKJ<P<?>gUg&C28;Ut
zVDqkk%$pd*017+MIidm<2@I^DHR7N?i)A81hX+%y0t1UUXq^OnEEjp)4K$7k8#@Dy
zT{UDf2zW5{>M*c~p^X0$&?Dl()boRZMQj7|SRb+;WIGx?88q~}z<X18Kx1^E^SeN6
zI~p>Xj)2_b!PK*cfkh1EoF`<nKx$y-fyN3wn0jg$Sj0eQ!^8aunme*p{{Ibh<|VS;
z`c4N2kY3Q48KCh}$Gr>^pfN|#c%y|Pg8+2guftaP{|8G=25#+6@Yoh;%`gjO4GKiu
zgMq;&C-eUY{m%dYK<gMm>moqs^g_k{L&ZRQP$WR*t>YX90nqx0Mok9Cnk+97kRLpl
zx<UIW!RIec0N<nV-w}NFk|Jckxc5Jn4AgrT{zJ}Yg3B|4_7ouNXGGP{2s$$e93~SQ
z88{{|GKhHp|92PUU(lIwaR2^e0j&!_SGN^Y9V0e%y_o74UNEqTpri#$=g%z2@c@bg
zQ2006HHd)1RlgH7e#zjW-NnFctMHg1QB#1$VJ}0BrSoSFOU?g(K;jO28GIV;8YDpK
zLFdLe&SBuF$&?5HodpUKt5x;_?c>k@skK$OcK~$Gqr+YX36L2eK1keQF9V0I@(rYO
zLApTc2009UQNxf4ln;>Qby4LRKzr(u<#|!$|Ne)cnS~SwFEPW634SI3lDdN!>i+(3
zVPFvkjfI2b3p6H;BV0lEiZVdY_fr9lReS&cR|ql>wEqAlz5o4h0ZEUYCJZb>KM3aG
zxCRyI8VyFrc?>5&^8pR_8Z<y_I4m6)89@DiTZR8W8s!>vYLYzyY92FO0JVv0-8}Sa
zy{trP-8}VbJ)mq4Pd!Ub@E))y;Imre8caZL1kF)^&ea0tN6_3E=qygqTv=mW1L&M1
z&>3K$vyMRLeu2(A0`0>Fop}U0XNjRPt^sr&6X^V<2&f*=IZPlu3D9$xQb7I(ox=pm
z10D=#N+AC4FkxU31o<DneszB%g9LQEUk4P1pmYlw?+4wr21>u)|NmVD&5d|4u-t6^
z*B}5IU$I!g;0qG-{wMy^CINJ(>eI8f3Je0E@j%e|Bopcx94Fc{xPr<E(3&6*21fAt
z@-{7?J!_nhJ4W~Yf6-{q;ArXaf0o4q2DXNK4H=+20&O)Jm_h5SEFHi!XnvewrY8fF
zB_{*xOiu=8ONajlW_mKPfX0<-o&~I{c@ek{w2sV);r|y)hyS4S0Ssn(GH_ce7%*(K
zXV9>8P+$PX&Bk~JosISkO7*Ma3O3p^2-UA_D+u+Hu$XDjz!bjncpYfoaHc&2vj>ym
zRnT5v4<;i=&>Rogzu-G&eK;2?GVthk3NShBWAL$lz#srxiw{x*N^hVu47~sOxPsO(
z7HTmtIxb=W-Fd43T5E5q$zTFXJD~lL`tuo7tp9`hfB#Q_)`Wr1e+T&mlpZ`7m_B+i
zo+|{6>w(sXc`&urFt7-K&S6H(3n9(Df#M1jN1%DPh4u_gmYROhyXZl4pNyb0u~=Z|
z4uJNAfzqvC1B(JEJV1W6RZ#Fu)N~G*Xb-yQok?J$Jp&tPUngjPmj?qQ$AWqWz6J9c
zxEAbZkn&()IS5)821*;C{mxJ`m^>I**3PJBU;~AN2LsE>8TAb8Ab(ma{BHw=Ep&ep
z2aNCi?{;pdJp&VH{Zpeog9>OL4QMR^=v>Z@dIq+R`3&p}_A|(NFtDV~sAu5zU|^^~
z6R+J+&%ouuz>t6{&dLhf*8@5e1zEh~KFAD~N)HAG17z_9_d#Z`%mnpMk;NPCgU)he
zc?t6$$c><Nq@eYXpm{$Jrj|Fb@&j}SIH(^DTF(ipdn}Scdpdp^=468V(jP$clAyc}
zy2Bfk4?%g|gYjGdNDP#JP{f%Gb}+E;5uSICYhYNY1qweu(7aPmCl>=dcs^wwLq)A;
za7CvV16!d71BYW1c>N{EOiu=OQ2Ltb$-oB6Kb@WoY=xjZUb{eTO0XIxY-&Qi*sZ|z
z`aDn`Vqig512S);Cj%3xT?5+ZJX4E-8B)G9!_S9Al<_|>>*K$FDi~OJ?@Uqrjg+og
zcp&8v3;2v{c-r3Az|c_3;AqqE|3gi^l!*7=pShs5<offO|5zk4aMapM>Ou3<9dP?2
zu0dv^B7+C0-ks>k5HnGcp#W5;PE=$Rn5YPvbJn|SnaCpH!PKn6z``2=i%XpKOk9Hk
zv@QVMYheMZ3mWAbR6zOJ(gAe$9`iC#T>z>FKxqbC?mGtr)FR4#=-SMt9SkfyFJNbH
zf$Rg7EeS0R;QL!3erHetr6-WzLF4(LyxnNm06HU2rM^>QT}Y;Y6{tL|&+^doU@Z2v
zNMOEE+`?e){r_JtXbp%(0`nEn+TWVlFV<NkFkc0oai~9+fgd!k51JDOsRyln_x}Gc
z)*^xVrv7{eHj4%Zd(ix`MFWFD10#dV?nLn27Yd-X>iz$p2?GlcXdNj2x;U<Zp%a`Y
z!T0XSfYLXp{^`hqoP`NW``-Wmb3oEaBfQ;&J^y_D2nxqU&Ho=jbvr1Zfc9H~%tX#F
zp#B%Sm<N+?Nl2%IMo4mlT&=QnMM#V5x|(F=3eegX?|+^SA<1pvbuJ;v$G|i!E+#)@
zkg3_PT>&}|&HMlVgP`&pv}V@(pX=6+L<W$%6+D<4Kx^>9YfI78PefAxbOAy=d>uS!
zy*6l_D`@>JXsxUF|NpU|xp+{&C;Ta!-R_0Z`&JYgB)tE*f$sJJ=L;<QR1x}E(DlLB
z+@iYg-$x|(Ed{OHg{+rt(1ES#z_jPzUYI?gy{u^N1NB?L?FZ0WYYULuYo)<=0Zm|J
z(DDA~3cho|V!{9apgO_(pBsd~kbwijcU1)KIRmjl?(+WU2EGp+bYDHFP5|wN0M(zM
z^S(j%mDgl4fbPH5@L;Mh0mUP1%{Qps0*WJ0n+24QAa=W?g7(To>*zntP2jWqcxqyW
zE4=^R)oiq7V3<(DAkrDn;MvH@Akt~i-~nDUq!nCY>BV3GJ_Fu9NTfDCU>$fpk*0$l
zXb-f-O9npB{lm5KRw6b3E!K5<LDm}8yb7+cc*!6Dx`+`b50V3^0htSx7ux6nS`)xx
zS99M=#8Q(%EL4-luG5Wy5v<PDL9f$|fhp9hL9S+1a7C@Vbw#He19PZXff7i6&3`YE
zi5?6ro$d^bwe}wCLfstnI^Ch_PX$-hdU;oLsxvT$Y8EJg+&WPMoL)6NnCcull^G;E
zof#xL9y2h&_JV`@5c=&5p`D%#f}NZU0w8yS&o<;_5DE42&~cc@;L!1yfl<GmVHN1?
z9?+OFXs&)jDmW||C%Qq-(CgG>5QXj6cLc39P6qeaCxFT)Xgq=U?Sk?$C@t(?$e;r%
z+d%7hKxNHDMFxq9iVPwX6&VCT_YQ#e$8J<)keR^9VB`JIg%_0XLFz0Pg7SpZThJI0
zI9)U`fcEk-crY-kglaN?&;F~`WVirY=MFLxbVf-?CVP!`C-{699$SS4pm75OP}{|E
z9)k|Z9B|)i4}${K4grgW3?knDoH`p78AL#74&*Kn8<HOXPtouE|G{zJ{~nMX;60Cz
ze^+?_bBYA>7cek@%<=x`9NDmt0d&@f0f-OU1L^(G*|i~&L8PIPK?0OdEDnO!y!->t
z<vY&%Z`07oAOgw<4PZa=DuVQZ(z3-u1{v>vjx!f3GRQ#FvH(a9R9<-h|I6t8{|{&{
zB<TEqsNGI?8x}Hv)qvdO{m%(>Zw~0rJ_`?~8XE={Hk36=p!y2bUV-(injbM3fa;w3
z{~iILI|M-W4(LuJ$0qQ74-BBS?x6N5sNM&iaSURE)P-uY@0h3r+Sl5z3UZ$Z1KU){
zI04I9(7q^8e*mNhw66jb_8ttUCW7`$crb8>g6M{M4ICZ}d>27!#)Cl^v<F!Lw8kG)
zPt-aGS9ma0w=l4<K0vOcZ4&<fKz4hh62$GGelp129t>=P4RsA79t<p=&HoxCKyHBA
zZ{Wdj;wQ*n4+gHQAi7~*gNz3QUm&Qx?ZF^45i~vo_iG|(oT!?GfrS-R9)s^h1J&7}
zJJFzZHR8@~q&9-%Jcc#3k)XS9Z@vYc1!vJ9CgJ`67WB*sh8pkxZx4d@KzRRu8wfeS
z{cSC1JPdSBfa5%d7?68Gb-&yn@LC{HKZC(qmVpg)cdBeW12gC>rJCIV>p*wOT5A6P
zSyKa=hx!G+lhgbEgtPVY!S|6~0oD2S)w@LM=UxEa!?~w{k--FXuNUY(FG$^fa|-01
zp(+*z7M2>=eSRQ6g34kXcZ-Aj+@P@taNd~5bO*Fn(P1Bh1}F}_|M$KH^%uSW{|f})
zW%2KPBvkyW2Lsa@(AjO?|CWL8v;ggO^!|75C-}b5WCoLv<ePOF$)I~fm`uF?FWL*b
z^TBb^{|BISR;bCq;@HFx0otcw-M}E*T-N~V(@8hfH5g2u%fK+v8Z_tBdA6ah!NgL5
zK?X@|XG2|s1&HtczjLic0_d!%_Ew7ohQHqb+iO90Nr3v@pmVb(YB7NN)ea!q``@{R
z;JYXOotvpYpMeXMw!!yRC4kP%;&~$P%#c#QR~mATmI6bHH3Nf&)dO{b`aQ2JK<=%d
ze}MsXuZP1Nh82!Y3_5jpc7yKKWC5KQF`1Krp?>xT&{{1Oiv)&$p!pr||81bV{od5f
zzYqZGd)Bm^zUKY!oU3&L1DE%|vsXcB!eJih{8h#;9t;oXnpgk-@6h!B1!yj@e$Fe<
zxNDF1zq3<AlG*IEn;AfNAkNTkW+-%=$1nkOH!`UF_Wu8eQNQ{BH-~);S3rF#?PdlA
zhk5@&do|BEE@F5C+W%y|fI%H}Ce`Hqpz!Rd1%(rY-4<xQ0DP9fKkxr-uI7-lS3zs<
z{&@dyGi?U7(IH_k4Zf>dfk75@E|B;C4olEIQXnx828IsEc|K>scOZc7==J`$gcTHC
zps;dmVvs?}e-7ZgYCvarGl0(eFZ2MX0Ra#jc4vV1|1Qv3T%a|Opfij#KyujBLDFD%
zp!fgZJH7w+h<Y#_p9o2xXLds6Ordsz)-i+cfraFaGSJu<qAgY{4O+W61=No7{&xj*
zHw5T>Zy9izy?|kg_dm9mpzyM&XXx=@IQ|gSUj(Hc52iBs`dN@((D{6zybr1io1ZY4
zK+n?EXtZb0f#fSly#Q(-f#&}~XX7{j2bHt`Z-Con&5tW4?_pp8t>pyeWeY_H2@eL2
z28(2{y`V8su$#elf!b$tl`EPbGxR|1QD~SCYm2e|1*I*}+C!-M4?y7o8ea#w8{~cu
zrc!vjcfTV82dJE~NMLXQwUujTD_4N;{<~{j;r;LONpPNRVsHS}`Ji%iay$c%MLmPb
z<a!2<$@3W;K>G+mXKaA?L)kOPOpIsHm>AEXGkHIF-=TpA!!gi3RN#8qgQ>Ivbl#kA
z6NAEp#S9`7ni(XZ?Fw*T1lD)3NM<kr)dwC7#~ML>vx%TFA8^@S>chao0NNu6Ru3xI
zKzFEv#y~*sgVlW?z2Lg<z$cN0dkqW?`x;nkHM}cowY)28UTEZ5YBF%tyfVyd<X~W#
z$ORe41JzF+OeHTEnE!+Bdw`#LvwtCj3AAo-0hu{bkwL>!0d(Iw^RfvK85BVE(}aZ#
z5)%$G$V_BpP-*zrz%bE~0d)R0L#U^OMJ>CB9%#**!#;)>O9uv~T6HfG(4BOkIuumi
zgW9??9T_++9T_|(Ix_HBIx+}=#_1+HG6;ayF2T|YD4wC?G~lp=v>X0`?miKKj+IRT
z)iI!RRzU3!52g|cP?$_qW>A@^%%Cw*84}j;@P~$d!(#@Knoi}4MivGR&>cVx%?uJX
z=}saICmC!SUNQ*Ow1C=xoeo5*lhAKvVDka(BUNGW0Hu51c?=35|A73_(8A!*u$aLG
zG+t$~^#6bDRt8qkUIkDb*Q#n56s%-W_FcrF(2&gF08;D0z}CUQ{15d!%mfA>P~Qd`
zCo-V$1H}s{9=!iulmz*?rWQ2!%c$Y~|371AJOhJv7XydG90r+2dj<|mE>JsPz-p#E
z14FH55NPaOpwXUz#nO|3Wnw%7c)nz!ErSi2`aH<g=Rl4=&^p@5e;G_B|7FmbXv^RN
zD(@O<8EhunGJx(-V3}ykVB!6bNpSLC289W=;PrKk6KWX*CjVtnnP|%(Qor(b1*kj#
z?alUJDty7f{0G#J2bVLTyag%~P{MkyGW^_8?|<jlg2TEV6xIwoy#N25+8K)!*0xAt
z4O%k}3u{|wSjR%c+MdCN9DSg)K6yWb$>jYEIuq>~Kxejq_OyfcI)nVq13C}J`yZp|
z<oyf^6Y8OUuV)aLyq`e@R9=D313~z`;0*)wZ_vCJyj(#pOF(4<ERBJ}cmn8tZl;1g
zu)a3DOs<!%0OeEA`t;`g3?}+>!Q*injkXLXpu7MolR;%LDDQ&u1Go;@3#kL3Wi@Cn
zQNn|%AcleYH_kB{H1|O7MJdpM<?Sho{}$A6Ff9Y`@m;{+XK{dm#o_^j!hT0a573$%
zP@fIdKAynHnBx7v<!-}#1_@A`&v72Zml}KS3Q)YxwFjT$%LqCb1?=X(zbm}|{x<}f
z30n8tY0JQ%-N~Q;YKQ300ndwy)bD={x_^iVwEi1Z-+<<}Yu#Q1fc&n{#o+EZlYs}c
z7T$w_p#gMm5=i~*cyJ$-34Hd!ga7}nQ$TB_S}uaj2kCR1$B<xgpMkOd|BHb7xdslP
zekmwiL2XUQntle6PBjM5+5QR+^B4pyjxjKr{|C3F-hjkGV>3{5B<ewDx%~g{0cuBs
z>N&_BYsLf*raVx81f1?c=^a$(f#TG$iQz}1J%a{VKj=IwhJ&h&_6$7Wxb0*B%^75X
z&UFEWEhr2@VcW2uL8jq8gMvl!|Nj;(ptUW{pf;&Pqb-Aq#RBlT-Ugs~L(qPohW!i%
z^-HxXYL+sXge<*TXR(xl5tKGS;SH+OVCe(w-+BKJfb0h81^FG+W@xBqFhCi{`Tvgr
zBo3<Y8~%g)t)RX7pmX~e8toZmK<$dgcm@T~-IpMJp!N5lbq|)B3`~|@49uW5hxh;P
z6i~kKV9LD#>!X3r(g)S4p!#`YBLheCV+IyIc?Jf@NeluF`yu<K9QHAAG%N<kB?Gwa
zbbx^obVdLuOe_@`0xTUEguVZFgU=fV%P(MH0J#IIMi{Dw&HI1XQ^!dR4xsdD(ZB#Y
zUj~$Z`9Wa}GRyma6KF0|q!F~I=<)9g(D)(9U!d{G+J;62@BjZm>-9k6djcT72UD&D
z1M_##7%kSk4a?V{aYs-;7&OKSGOr<%fdOQu_y2#Owh~w`$p4_c0}2c8|KAFscbbC7
zMnQ1~atlZgNWb_0ub_Lq1w5E?W`NEIt!Y-S1hsn_of&xayBL^2_k=Wp>KxErD_#r+
z6EeYf+wge*{|jpCVY81BzkUDbfXW3ArW}n%Wd;^dng!LpjhdkOEr@-v_yoBh<d;V1
zStX$J6F~VA<TlWKEg(OF!#)9g);U`EH>_=_hu^saUWb6{?>{>r?#N!ysLWuZ&&j|5
zE?Z_Xh&aq;5CG)~P`k(b|Nj@DcEUtu1_MwVkb(Id=zLgk9t77t2N)PYZEAQu4?Xi5
zv_=FpF9)jcL1PWx|G!#-@~dMLLq+qx1_4m}x?x`f4>VmdgVGV?jM8tq4f`6v_dbC5
zP<c?lfYJN^H^GK|&~x~gy#}3&3A%d}wD*V6`~TOk4f`5E`zIJdW+Ulk@&5nyCg^-X
zkhu5%FOi@$06N>rVgcyh->;IOd;}8nV9M%XVEzi)8wvNHehUK&HvfV9504>dDuT{@
z&<Ec^$Pl96!ob`xpTWRkAH$O7B@8T}GQn{k;~Y@A0xlEgF-9~)>XH{Ab<Il{7@%q@
zkkpto?*;V(!Sl2{;JaM+f!1yQz39Qf7|<}E!3G>x^B4pg>KPoo|NrImU|_TWg(0Zi
zw?L{(AbGKFAt=v);sKOjy#N381kEu*&5&qRfvyEw`nm#E-|5c<tqo;(0xioxW#|o1
z7<&Kz>kFz|n_n_8=+6hAX>&k-J_Bg3z5=w~1yrv(%wt&7P{YszI-A{tfnkaMeDHXR
zfIjFvq<x_N5<?GEKGXZ(MbKG6pz|aZy#GxTZT{Dwpx+Fxk7d07{`jj6I{RoZ`0OKv
zhI!!g{dpSZHGsz+z5h*h1huU^7#JKHRT#iye-;ZE7-4>Bw1tR)%4*R4*)VZXyW9K!
zkJ`!m84N&m6C(aIIvAKggW?~YuR-bC(gCv92DzO9D~rJ4@UH>fPj&>|>jys9=+9Ho
z_!iU;3f}*JrF#FbHU!PhgT#^UVSNM1e;G23E(|`P`95$tpu*q+s#6+S7$O={7(!$<
z8F*?syhK24aR%m3@bw-bw}HwBn7csj>qZrZ0Fc{2WeO<YInHBH0GR>ucS8$91gM^Z
zj>U3JsE4#eL2dw@F$ii)Otfdv@nA~tnE<=1h4~X`-3WNz1!|uP>^u*UeV}u(8&w!M
zKy8BNW(JYw#S9W4`|Ia;i8QJ(@HE^9trvb=(eR%^0OX$fy<Q@qxbXg8Gqa(dK?Zbx
z5Qq=bZ}H&&|C$;p5%2#swct9i#tXCu-vu;A1@e#M90t&O*a&cVobmvj+sV;zuYm<L
zZw4}>;Xi`{=#ER!92%%xw*a4QUSj}j`{}nbFoD|)wbG!uCUAemaUR12P(KKCM<w(w
zr#+zaKpRrP{TdhV|G!>>`XUW`8AKZ9GJwwC<f&N-c9#q&-+}sEAU>!);Qjx@MNpmI
zFrUGpp_ah`<OXov4VqW_|8qs73WH0d3xh{}Cult^LkK86djJ0iIvc~qQWG@x#sIpf
z$_3<Chq<7;P5yN@+B3LVYX1KZG8dF)L1!U?$}q6G3mBL{c0k$!|6)LC*n=tc3<L9r
z3$S?_P@L^YzJ~)|HZ%Hw;tv!j-v18wLi%A$65jtmR+7`dp`ah;LZ*EoWa{%FQ(pi%
z`apGH!yX0)a69S%0|TgyKGBvT0#s&M%QCol|9_|2T+0wqQz>21Jez?5G#2eRj{$P7
z^4~9v^|QeH-NEBN4Z9f_>R<e>Xt>t^nuB4iS2<k)Izt{b4ryHtsvF*Y_5S~V4`?19
zbl3glzYHFeZ5bS(eN2(ba~VvaeNNE%n-UXk8Fak=ex3{J(}Vh)p#CN(jZKbaPyqEg
zC(mV20rd?)ZB)p5nB*7+=64g2(-tVtg697AD?-m2p08X{vs1eQUM4JN5NU3PmI-?y
zWkPcblLyEiaM^I+lL)A+s86{CJtMfH5n3)Vfac2K<wC8Lh;=n6yebkwWkW+flLsiz
zfXWlleP8vSk^-Rh2^Pr=F5Z7Xom5n2P_NbW6sXm_5KwF7UD0UI1RmpX+{d5*Dl<U#
zgUqj2Jq>C@FoOCS-v29D!DUF=?FyJ2NL|e@ivaKc<u5^YHrF#KAlZ|s-OQlwuopac
zuTxWXBcP@hbl=J23Xr*=vJI3!cPlc0+Bl3Bil9Bm<qIHTnIyu%{1()Xg4Z+XWjUxE
z1(idPJlgjc)TXqk2kixB;Aoi7<l_DJBd8t*-5n%=T7D;<0qL`7VQ}&O*QWp~_Z;Uj
zL_o_q2T(Z&YSY5z-$CPw)-DV#pfS;U=gXk7Q3W(#4k{nK|9-56`f-j21A|LL3WE*k
zTz-(*9t>N)G^#+t)nP6J52&1)sKVp{6$6b4gU*0u0EvOhIu8bhkmh>G`R3k#KdM?J
z|G!Z`Tf)I{E`tLsen5TA$@`f+z-4;#V{p8I$~%yLP*{TEe4;&*$8JaP8CnY7|NoXi
z=F<~SFfhLc)s66Wn?(YX52(C{w@XpRME1=D)pwBgC?kva|2K`~jBS9<m?Bf313CIY
zcawtlRZO&Jasj!2Ca8W;0G$=g1Ue@dbY7&$#CQe+(3lE%-HkmckH6muI!_)nwqlXY
zpb0vk88ikA%J-P#EAc%H%&&-92gL$v`z**}P-^640IiAAuz1YCxZxFp66h?QP)!9h
z(7BYL_6F!2N6^|CP`?e-XRFon&;!LKsQ(3Omq6MzuR>sb9&nw7bmj@DeFDl0pnL$j
zo3Bxe0d&VY$3!g#6Az}i2Mo-wh+BUi*T4eR%LLWCgn{|x9TM#Y%~65u&0t`Dxqw8y
zEKqxO7?@w8v@v0AI8YgY!@mL$y|Et{m|tp;Xs-fP?-mB;7x49S#Dy~x=xk>b52n}(
z2Id!_F-LfLMcB<OFugVm%r8*xV6;^DiE^(mhM&0@OlmnjEFkWV`NP2c0_PYTJZ;!D
zfX>4)Ddb{e0I&b_WMF7`$-n_xqdVaxXipl0$U;vBrUfq<xHft+aBX<Wz+~z0vjJpx
zEmwdA=-yKgrkDu~%+Cp@f9!VgO!Q>nL9>f*qbCC&4!cwsn4g2rU%?ut1pEc+bFiS<
z#kSFtfepJ|(K{HJpMAiUZV1>V09x0KW|z=LPX-|zcKI+cKLhm}$nh6w4p0QmF0qZC
z3}V>rih97n{0wLQC*Us$&>gvGc1dmYWRSvPR|y02(=}v<p$zCAUNpPpHhMD1;joK?
zf%z$D?*MUO$j-z7S}(HFlYt4;j|83l16s?G>IFJvhJgc=?m_EDKy&V$o(#;jUhE|>
zb)fz&XpJ|htv3T}o`|erV15Ex2Th7wR6zDa?cf2~0Wu#nmj=ospf$?KZUxDM@(D=I
zhL;R{nE5i|2LtmHP+t!22GYuqh#d^fk8!4dP#J)dRy-M0Iyph>ycqOqxq>SiIT=hq
z_a=kfg(xc`QW%&Yqpa=0Stf$Y3(&pGoD3$3UJRf$zu>Y5$t(#5=EuaGL&^hMD*##p
z0$Lvqtv?kT;~7k5)H5)H!UW`(T2Bwqy>TWUOyLI@m>+@m9Kgd3*^MwigUz&OFe%gm
zmz|(<`UODdgY1FXF`*t@hJw}!h@i`DsApgTxdDs)4h+nX;Nzs|bq>saP+JA;22BPA
zkl7vc8JJ=AVmCMJ1q1UV1wwfdY$mF|WI*PF?p{asn+F4U{euEXZozy8CS*Ar_Gd6K
zKSZhjL4HRLTTnc}{Re7$pwww$8Vt-2L2H}f@nXq9pib0+)QO3jjL>>D^a%s=L(rTn
z8D=mvK<d`e1q{p&;PVIQ@q^+Aq%@rA1v;~jK?OBGgoZFMKj^^~C%DWC^#b27j&2qQ
z1M>r%<sUAy60y1~WDf)LeNf*39!@yp3CWM4UaYS$^L$7F1M_{*8T2HXmFUI9fW<5o
z2Il)X>wjE+4E16K-JOmWUcomQnC}aa8up1^ELhwX+~dJGSA&819?o;RVd>g~aV{gM
zO%6)?Aon(+r14-E2IhO9wQcY|8FGKjdcptyFms^!RHaahg~6eTfdh0NRU<gxGJ@{D
z_E>1ozy%r?1Fd6RP|qOc!8qR%BnB??H2?qKXwSg4(4Il6*49g8qdkL^_y7MFK>9;9
z*>XUAV^IEv>SF|{1L=dQMath2h;lQig@O4lLH~o?z0jV4t)m`v@3ogmNHU9^2jjfC
zATvRBz`_N|TmuH?yP$oS;5FRf{I(E&r;d(AB7*=ZOhD^NKx<Y(eI5_SIXfE_!T0un
z#@Iu^W9*&adsBNF5*c_r7?(Z-_02(Z1dj6<a=>?y&0{El$SwQ|nj-?OJNIB*__Cv!
zfuRFbjx(N{2|CLIv|k6JZW(AjRfPxR+=rmGD^T@2LFz$cARdh8GC||l;5ib;`Ex;g
zry%-P2zvkje*!5DXrQKnKpO_;JD~C(K8C#iAbii83U>d_2A%aG0GcatoW}t2uL>yc
z9p*7~K;5MX^%IW=;}X!>-Z4<WJ3#%O08zK#CqmtVw;;cO?%jsU-9^YP1<gN5K*f(D
z#Fv|TFwVIM@;4;R&Vu$tfz~OqK;u;b)vo~|49vGd<sS)gJL@ivxNU)i?-I~{YtWc5
zljA&w6sZ3)AaV;Np>E~yU|hfp8lUV`W?-1<%)l_y9$Z&DK-4Yy3sUF7IENJxxAX6U
z!ejPg$ogpy#<}42Nf7nRY{B^_t^wvxv^e$8U|_xlT6;x8oX-4;<WC=@Gz?9ri)BH3
zo}uvwT8F^wFpnVw;-2}2AooM!XTB=fj}ZTvK;)OmBFVFY`~^v;bG{<d=~B=gq<4_g
zDO%k5&0t`@2^u#i#ZREU6R>m|;kcIpmQF!&$Kk;^uM+Am9uLMvp!+32W00VD^nu1>
z48%|K0uk!wxgz<`1}YEpKaU6FVnYwcS+>x;3qDKUgK?f9LjRIR@SWm_xI^=&?*<0u
z8=yIM68t&C5-IKykm7C*B>Wd9g6?F6#$656Zw(N+xuu{znT>G`Dj+w4?o#eZ2JMFs
zumX((!P<CG|M)=kEb;}Z^<bPC3epSG1JV!QOR34c3^c9;%9oIMp3RGh=fxoZAHf~Z
zJ{uUAuY>%L$fHPmaIu$1)4~1+mGz)9se3;I=+0Rz;jkbQcR0++1^ET!5AZnalGhbj
z!=VP8Z=vC^&=sWCgK>s0NH1uP3#1=wI5a=5@L-$;Dk}t_VOZ(?|NjwCJp?VQG!S)=
z_Ywx?Yw)$T;5rDjM&kt2GSFHYQ2hg{cR>CH)uD~?3@U{h;QpnAb;JKZg&yEKTE@D8
zfd#a`)VksSKd2b!K5?c(Eye~={p|=^i|PQ1Yqp%l`x&@E_3*}c(7sOw&{|s)P<;$F
zSHpvGh9Iba0jis8Z6I|xXinT3wAOjv|0|&Q^<bPn6V%V}{{R0DlE0AZY_Bs6%-2Bs
z<q>g9ux_0i3rgD{zk=cxw1x?E)+ngHaoh(w*OE~Lnyx!Q>DqB0!vPNlM$j4^P}#!)
z?k_blNO&;L-U=;Sc{~{B1%m1s560QNNMfM;UjYhFP@abBQ}AG%U5ijNKh%S9I_HF1
za2lB7!8q$IlAI;TOf>x<du<VF7PNZ*|9`-Pan@8Mu|f~VX^9&kW_qCLU&Nr`!8q$L
zLhY=NjmiuR(DmXn9*nbmk>nf~Dl;%_v}IsG3VWn9<r%`jd<8T&L_)bT8FZH(to#J6
zy#|$yHlVNv?ePYMlLzBW(7NUdNSdAlx^K|{D!vg^MnJ^pf$9!u{XKIgLVSMdhI;V6
z0$4qURu+0JVPL)t8vjM47wlyL4`{C&C{K7WPS!<BFX-+DwLN$|7-tHC@-D=!a~whY
zpCN9Y@e?6FHx;!187lq|AwF*}DBL|5r>xvi!@yus%fRHpIA!jJdIml0Vefv0f%&os
z^1R%Bg8rD4N}NAtcp}_28@!Jj>Rv;H_#9As5ETAA9*i?25#n>dLi{oLA;KS%uWqPk
z(8A#l9tP%1pgY(R@j)>EPMnM84^X)bN>dEb{0pj+LFsA=H2<FQU|<BTBSy==)4^_q
z_-)oiP+s$3oQ|CSL2CnBQ1VX`gN_H|bZ}fj^v#~?!8q9yR4;+<Eb(AGd=Z+L7kDsE
zX9R@>R9!B}d^EEpJQ$}JBGk;;2|8!igK^qPB(bF)jFYB<%m=S`v1dT|VG)Cj2jg@@
zgxcw<4b9;7Llqv3(^?VY(<&D<GcYUwl?RN69)ijR>~Z1R!oYk1)c--m1@<(>f#|19
z5JZa$545rr78f<pxB!)<u(;rXmWklJ0~#OnV4TSbI_DD_PB3{355`%#ApdwUPP~gq
zYtu|Y{spa1@?bm^2?`@fzh&}D4+e%c9*i?VWe4cqS5TP2%;NE2oE-=W=h>c6Gffd@
zPW1(a6~xSgTM=eX0+|(o;;uyu8Xk;OH-gN7<oT&fLGFR1gM%lb=|IJUamr7GnkjEV
z=0oD*U?}dmaQ?!;d>%CaK|);gwGxO6SiM#Pjf)LP^%_$6OmBt6#dJ{mPeJi>6N7;V
z<BWwM|9CJ?0Pm-R_<hPskl!aaGcZ8nV3I0m4VVYxj8c$UXl8)o`z&bPf(PTwqY$(D
zHzML-@<~t_ZHAjQ5#$amVL!zbq!((xW@9V^1Gp}8hSz5*9*mP=buEVn<K)7Hu?!60
zI?Wkhz2;QGz<d_8e+Uuw1k0pe&|RtmNNozVe8BJq+NQ{WhW!i=28J7$;W7=B{uMkJ
zr!j)oB%#TxcrZ>^MfiC#B>gXbUE#qv0d!YhhX><yP<s$dnx7F1>a%+=&Im>5pOgp+
zXGnZakOYkjpx6g)D@?kGr2Z&4d~LyP6&Vl4Ns35vqTq1F*;a7WU|>Fzf>K`*4Abtd
z1ky9CkK6za(-R&Hj0PxvXabFuOaX<Bf(PRi(B8EIG<h2j#;IUGdNB4jg4*2BzJ~_Z
zHa9q|`#nK-yLm891)XJrC9J1`_7-mNV4U_66h0n|J>WZIq2}t~Hn(r82Ll7D`xY^n
zcrZ=`_XQf`8Z<!Wfy`;Z(w~BsHwGSz6F~c_IU3^{bYSWiU{Q~|?6I$5U_OPK{t4Ct
zT`1`v+FwG;1B^t**JN-S_F$a!7b85H7;HQkrznET3J=Eai=g;|_K~p17r2kq3yP-`
z9*mP;VlRuPI(q;AzrllXswLE1RU~t<#~0Y#9?&=xmiX!iwNF6duK_X-<UXwN1?l%0
zcrf<e1lb3UuNvtJkb11~RfDS?ZhL}(`6T=tHE`b!X)Oh;Z|A|-@eou#f$B8S*rf;K
zu1-)p0Q;DwZ4CqS34-%~9*iBJJNj4}JsDIMaxy3tx^sZ$Bn4`c*-L6Nq(nAkg4c?e
zfaVN9W5tNMFIyP~<`W^f#;%dvtP5JhjBLI`69W<E+w5UrK8|zzA7Os`Syb~G7(sWv
z6L!B%3<LA=DTLkM4mvvrDSQ|hiF3d89|q>*p!y%{oCA{kdC}bOK%D!n=P)oIgP$FQ
zJI%DMMK_;F_uDWqA46IHfjs|$aDN+UJsS%sycc>hD1pup1;sUJOuf*9!O^jafdh9M
zvbw>*d<^IO2f~ilmuP-)B+d_36%5Qrajt(sGQShee9-&_5oy#)f`R!c!TDbg##T*q
z^NDl6<qihsBRJ>35$<m}iDo`%?>`alw~Sz5J_73h6G)>inds&d=YESH49rJR=Kry$
zp%zY%`PkA>sK@z#p<e6%)prCifX-aPot7+m7?=;^++&CctLC{NyFh7l!Ak}uWb+;N
zLCd9deC3{n3Ip?Dob!K3_JH=sW6c*}JKaHkvH;zYz*FeK0Lt@t@`?Ed2IfPc@lOKr
z)N~NTZ*CxaKzCU%NPz5t#~WThnmaHs9|Fz)kkEc^M4taKKpJm80_i_@eFU9_3T;En
zK-+s6pgsmfz6UfO%mZQf7J|luJQ$lfLG2$8#>SVR`V~~~HO4g<fZDt0Z7`U;ekTLF
z<2;4{$QW}As2}M9F|%zU#LPx;-3~JgG)IKZET}mgpfPTwacQ(U6*CbA=7XU8PeM2~
zECjWQq2rcV!l@H9rvn?G!V*qhpf(FMoO(Q=ege<`c`!B{goQ(6Tm$(0NNj!s`5o#%
zXgD=Dg61M2;nWJA|L|aJ0M7w{)Pl^SESyZ<Ffbngt$##>6T$XqeI+QIK<yo9SfRH?
z=RngEc;3lzAHyFH2F4Dwz5$O1V+Uyb%fW-OqY!kS2Bv%`sLih6!PwdB!N8D#CLiL#
z*!2{e230|AK@Y}y(AYCaO$vJn=qysuI0Jz&{sKy`9*j*_Js22XcrbQ>$9X*%8ycbJ
zf$#B#nr9Qz!eU2+nG2w1g8JxF(A@0e!Ps&a;^w-Ikn{j?D`;E;n_Ho2!3Wy^0O^P3
zyE@Q0<1oL1-3A)>z+(mn?mmgp69(peDumlxwV?ZqSzzr=&>F58nGDQ`cBj!22Ijq>
z@m~UEVeM8>S%_v1H<CFq49t6pX#drM+ka^0@FSTc!oa*2H2z7*J*rsT!;Ub=@C*a<
zUX-&pu-BC}cd?kmgk(+&1M?ox-gyG<shNt!94;htY#5mL5Yhgt0k{9q!iNuGj=>iO
z<~^Wu^9Z?z6^nb=kjz=bz`PqY|Ai<+2#!Bgn}W&^X!((XR41*0lyxn!p#2Tda-;`T
zCppYxm;jM$fYw3P;5k5OIjDlI90b)7ps^l^zE)RAnOqGX+k(_XHIATs2$}~3^$pSU
z56EnYx?0c}C3G&ZE!X@1{~fsN9{m{%%)3DCe?)i?EK{pM{bD?0T#TT#3ZQX!a9B9*
zV|W1Cw~AK2@OUsbgUTHR55{KD98L|IyoU#4izB4`sRGY8K+3A>r_eCa0PWMk8V2C8
znOe{o&m9lOX3*FHma&=EQ1Ac$mv}I?g2(wi7%R_$%2B8tpm`opzg-8v9W`%3=Q*Lc
zdl7?$2V?zGh`TF6bq@z9UO;0u*vd_4S!v?ISO+a@E5YX&L-pujD<^T6jk+fon0JEu
z|0K-ARYZcq6EyGU2s%4~u^i-g&>RYAy^#x2T2Fzb%SKTB2RbJM6u+Qx9MD<~4~SfC
zD<sWUG(yudXugiegRu$P7N|g4M^qgOn%9NsYd(p8-Ga^!2Id_^wEru>?f-?I3|ycw
z2urX3|3T+Ug4Q8}*8DrpV~_#0*9+Yl9N_I&ykiqO4GhfNLE~Qp%A9i0`E@MB*h^fW
zT!({!c{|SakBGiOxg@Bp!(%TIeK+kn49wd=`JaFv%fS7Am|dVS1)bvo>TBU2-_f>V
zVBSVV`CkSq|9L?DeU$aLb`5yyaIFUn%-aaA|My@l{RnFRfz1Z5D+I4|2CZclK(-6C
z1_3lD3p&3TSsb+P05m=ZT}vT=SWBUmz`(q92I00yX(4QlGuRE93=D+VIBT&mFmJUX
z!feo<c^0s_sD6{dvd$TF*MtIbYn(M(7?`&ZQU8~K>wi!>0FCQ`#%@4uEztN4s4fTf
zvk`T#rU3)<7SQ@fylD*-SD-Q#F(+68DrY%77)wBVqD??$BUo+`g9vC(y$9p6RA}6R
z)}}Lo+P)r)%NTLTo5l(T=FOn9WJsv<ia~ds;j8mNbIhPJ5!R0Y-4)jW@&~Al1G^VI
z2T@}Pn!oj6tkJ~YkErzpjZJ$n*1BTvN7T)Q)Ga08`A-kVV({2EC`=mT8o+yp(d$G|
z`3{nYw$I-{>bNpcKjnc3V;!{qD}j!A7lZ0{Se@lUL?2=f#Jp0_I@Aeh{&n$Ste6RL
zZ?PuK9UymNs|!K$P&ax&>qQ3-#&YPqU{Nnf9^{Y4xCR$&^&&_fsvl4PL2U^G^F~nn
z4{sXuU@VgLU@W=_DqlhA7?id_=^C{Up_ahFypf3fUw9EEO)p{)@L(*Kg{D~^55}Us
zxYMfY9|q=)M2!Cy=7Q`1l`9^M#Xqr^SE?Hrm^TnH{!^$3G7A)!;B>o)K>$>icrccL
z*0}M2$`235;*U7&@L^!yKyd#TiuvGtQ3#sv<nUlDSPC+?&=Xun^FYIh0~9`(<*&*E
z2IdU}%YRI}3P5XCKz3Q8*~J0ggH+GJg~hHC2Ilny_kUrr3zXkEJQ(xOqS*zyzX#+m
zJ}h=|FfgwtSpQ?%m46iEeh<d{L^QiVYxO{Ov0>V!JcogK9l`n^i(R0!z~RA|_Z7`9
z0gxLu)H4WSvCDvgc^w($e;%~_&+A093v@0Z$X{ZZb}1cUU|tJ96AIV72ByFAKx0@S
zf61cRB?0x96c)Q87?{@*9RJ2*mng_g560Y$Xm)|`)ZS3fActv};u{9$wV?42MBPQO
z|C$3HgG03OvpqrmS&)06eOk0JF@`J9zAUI8$LzR|VS)z(1L#~cwDmKkpfzj?9*m{n
z{x7J!K&tB$JQ&LwA!UEAE~wmw)Ds0DKbLqgmVx!6>EZEUEZ^(>|Nj{e#&YnQN)N^y
z@R}!x-h9yd4+|7Mi$Loyi@<$k55}CM(0W6}gRu~Fu1SRlV-B9RH41YWm{;T6|Ac5~
z=YY<~W&za!D?K6enAqDl3IPnvt2+p{*|HBp`bpV4(d(DZFBz0JWHM+V+D!6)7?@WR
zEdN1qxuBjw&x7&AK~P%4OgHjd7?@Y#-2V;pE7Tkf55^OfILygmU|t1U|Btu+gqow{
z!Fa+DhdC+?%&Q2_e?ZOA@?bpv61zEacNmygf!06bb&m&Q=37u371U1lU_3q-X*@&#
zbsvXZ4+HZ`(EJZ#-x8Mf(H@MM;I*?JjG13SZUl`TET{*q13T`xpq@c#^L#Md6y)a3
z`x%s=@qx5nSx$z5c_qmI2z#*HFXX|PITd97LVM7hsFz4cEsGua98kt%H*uRSdxU{`
zB?IAfcsvz7{cXqu?RkamhnH<&U|vB)|M$2o7ISnEX;{{Rfq4b!?g|2NbnGe?bF>iV
z$b4X6UZFwQUm1yz{B^7qY+fRRz(P+3AyE4b)E}v-4-x^j={96C2qBq0g@JiF=-v=Q
zZZrg&2|YUiW+sw3J`BvuiE95Wv}X_l-G}ADc=RqPE<tHzLp_5SsGLFcF{S@7FfRw?
ze*)<wJr`2e9-RnEFB|F^lsp)Zwl1`15CWYI1u}m_J%a}5o@S^$LP&N@VPIYc+W$hp
z??+9M%+>^%2{lUt&CMPR%*#M`q7X3e$Ww%QM{a`L=fQa7BFx+g^$aSg=1P5FU|t4_
ze-i4xRL~e4Y&;9JpG*Q&4?4_afbO5mTL_x7g4TCv`{%N@g3=LWU18Qr(B2}@xUC1{
zoL=bo7IfSzAH43|gE0-f9ulg)5~LndZ_SAX*ME<HS9maHfa*%<*lfW?&{{mCvIuQn
zQ1TB0^HK}gSv}A;j0E&d8yx%RQb23Iko^l<cMG~d3A%qS^C8qvJRXd>OFbAEaO|JU
z+=)<^xfbLX(7I)a-!kVS<nlmmY0&y_4iCmm@c1974dB6;|J8#rbt1^$kT9Da2?{eL
zzoM<jmlR=OUP8qDM~W&a%|Oj%_F$aN2ud&5*DgsMU|?Ph+W(G7F9gT7lL@qq7(w9)
z>gN+!$D9LN8>ryHm;+k>pM%n7X#$NA=cYpPYpN)y?tq4CE@<s6sL$=eII9xmM@aff
z1NE)fcrfOI`Vv^ivhzA2>zMPP?X8qtgqazw;I*CLb!sy~=SWpR%><c+Wi4&SOOU%D
z?#Z|dau2Al?!h?oCA4j&;=z~!TWikY!I+^6G9T0*_h6hk7x&n-xDEsJq8!rJeJ1Wj
zYp0UAzCS}0>L(r##w^g4K^7j2kn$3eR<l597|Z(pbnuuwL{0Wq55{Eh_%$RvX555^
z#{v(=blCb=9uLNB(6|b$jf%8KD19Qr4LLU<@s$P(YaUSB)q^n!yv`gnJ_JoK5dGlw
z{po=S{pqftc=7)Kzruqt4LsKXabwy{L|n`e#2pu+OBk3JfX2V@md~Jk266{@3;^6m
zPXx8uIXoB>8A0Np^a+-OkHbwr3hl2Wjl)gv1ohoPc@$JvpqA&N3JlB(K=;5Q@+ZN*
zO#Dhvnt=9Ou$1Q+7jc*8DNmv07KaC8%1uz21}U5Rzk<pp(7I<xIA((P9eFS&T!e->
zNIkgxhvc39qaeRS=Gu}#@eM7{vl;Q1=OQ``%=1D0UlQhL;?VbhgUTPI@;n7;|7SXA
zZ2*q)JozQm?>rui$>9CJi1Ix7EJ7~hENBcIlK+!o^&cqTsCqEQ9|ZXu5@vk|L1Biw
zJQsFhV4ers|Bp9~c`(L>g3=k(TxJi(zD!VB!CsyVePCdohg$y=EYD-X^*_iCXqrLm
z>k?a@r-9agD0ncYf#$!kl;`Qt^%(KseVfqmn+wXPkn+3_sXR{<gzQU62ko83Ql4i(
z_y1&o_mp@r#?3{P=Sf>Zc^qP9??zC#LDFOb$Sf@7d9oxT4JY%0+yg1UdXdWWq(p?8
zq)?Fgkn+4Y5O*0O7{kCk2Xy`o33)gAEhz6I#RZw=d6FyCy*wU_DWJO1!h<mpJT4B&
zzbT+JjHNtJLfVs=`qYClb|xtNAmP!2RGudym9?pRLHPt!-htv2T;75Ad?p@5xFMYr
zQl2Nm!kWi}G3~1dW6V>K`Pj?zL~vaVac^QNC|)4tdBRnMxe4I?FOazCK8iao_^&W9
z&nCG36%_6ue?a}f<G~mWTC>FA!5D1_5(l{zEC(;oyRnq#-L|;PbN&DZ=2@We4-(Qu
zBxub$a(fl6eVz>3{{ot42DQ1++UN12&~l5zgE5{HQJ$~R1eHyQ@;n)Q7K8_5G;ALp
zhX-RExcrCYo#j74eutFjF`)Q{mglL4_{(#?7zXB<pz(ha%JT@&8boCOqLt@yj!-}G
zcrYe`_CMe#&*LN!>f(4oeg~yfP#X1Mj0K<h07+X(p!E;X_IWI<{sZNkP!Gn)k05_T
z%JXI5IuLhx&RfF3JcHo)w+CZHD=3{o&1LprTs9YXdCsfAz&r!B{wG+ThlA^XkR6nj
z=Lw)SoeCa|384NTmhwCiI`0%&iYR+y&w}zPr0iXu3i2Z){X~P>_-i~E6G3}Nv6SaY
zFCpba5_ElK1bD3pB(7qfg34QnnadmzW=4U`!cv~cg7+#y^v2qP+yg1UmR*ImM^!u+
zV_<Df4iCl{aQh!phAhRi=aajKfq5Ee{DXwN8zxJg@;s&#QRc;i>P8C>#%QGd?{T0s
zjHNt}LE8VGAnL&wei9UZknmUv8w+0G!5EEH*2aV860o$-qdy|tkZ1{suV`3U^LQ{O
zs(LVni-OF@UY<vT>uN}ziw5uigp}veuya><JQ$;Xg5nwy7fbMrOLMU>Fi$08{wEYV
z{}T#2CmG8;`I3#8?eoQFahK<u4GhdvK;wTTq=^vl{x4|W#L_;G1@${|l;@G)HE)o#
z9cc+F(;#J2J1c5=9;XQ^`#cy!k@}&L;PM}mAKR{i;t5iohk@c7TAs%z;xErRdKj1|
zgU<gXp*#<k1myuF|Du)W5#aTIkaQ7aihH~z0=xzrqAtP~<ab1Q9-#~JFGMa@7tubC
zfYpCI9*l9V9*iN1Ab&%`to0%&%y5_I>`NG!ClRs!HE1iStc9A(?7`Ryo)^I0K4%YL
zV4j3p{}U|F1Htt_$PQ>2lG#3wx(Qh~5e4f1VJXj}!F&8Y7=xE0%JcBQpz;$^_O^iQ
zLP+`v1-0?lcrZpE1epnH8-c<e+%^LDgJUHj<wL9>sLb$S4El>?rYI<nL(MD&g&V}o
z5Rh3|%Jc9_kQtCP9}XV>fs|h@iHPz%4A$1<@L&uBxBnq!NQ)@$HX-XC2IdK%`A-t^
zZh$W+EhEJRneFp1q%ny|P~B+Z!59jjF9C(42V*2C4Pz<K!@y(M5H(S*9*lwDb{Ql*
znggNXvA}~d6sfF@0<9gzQl5t)jmboV&VSnC!59h)Yf#%a)Pph56%;?%%kxlhT@7(d
z=v7cUft2T=;JHSqxF#sBA#u^vi90S>Oc<E^3C@3j!X1>>5b4YxbcPj&2c!Q)kT}S#
zU^#gEyvY``Ja59Y?umH=19Kn2^&cR2K=y?;J;dF1V@_dU?jy1P=L_!tLGwA5x*;4i
zH;kih2nLt=kbDv>3o0KW<=ni5pmGk;){o!?m6aZh{;)AW4iCm4@cD0$d^ituA5;aT
zZU_LC70|jN(iMN*z*NA%+zV>|l2AAJ`~~GFB>$q-4MCwGw?fiV7--);j<$XfQu!aG
z2=Y6kZU{me{|N`RouF;~KyaT2Vs=EP2csV=DE&afY;G<n%y8EYj2#TjJ)rYH2#nqM
z%mk$ssJYA@jB`bCrx!*O2Id~r@n3><gE#v4FPU{i2&hk|;K3LI+W(KGZV0^zDuX>3
zeLE55c;G`&o`;m<bN7P$2uVNwpmob@JQzbkb0=8Z`eA<|bwe1mzVSgi+b00r{)3n~
zXC=Z+Kag2i>W08rkh>shJ}?mE9!Oa@R~K3qs(3I4z{*+<55@qb@!vU~ILjl({|gwH
zyFlZ=B-9OF=<6TJtQ!J4p?>1=U<?MW|F`g9^hYXdgF$H+OWhEFG$s?G>A~oI7ZiSw
z@R%bD4UYvLjQ-$pI7qq=0gWACsT%^2+T@|WkofY4g*A@{W2mJEqqio=eC&0DKe%rQ
zvBQ5SC|)3SgFn*vk3TP>ZkV+fcU=6FU|{Yfxc?oL&p>qmxcmpVK|De29S#ph&r*;$
z$gN;Gc-=6Y6SHoZWs0+{&-ix=19Jzc|A#lvgWLhB8)^e_=5@xu9t_MKp!r`C(wF;1
zw6YRy94G*^rv*pd;0rGEA^F6Y5mY`x%DLG~LFF8xZV3DcDsMd)J&?}f@wo_656RoJ
zA?-ErJgpa~tbo=H!J2sM2F5=j49xAI^<N~^4Q>z7{EJpM_<-)qgPwin59<Hos2hBc
z%6}j5`Im^g!5en|D~|_b0H`eitsA_N&OZ(E^<Z>=2}(bZFq>5f3NxH_1LN-;2Ie+`
z>wi2L-D*K;1!^v{2jeVB-09`F1Osy$>i$=Pb%X0dQ22rDfYz^M)(w83@gD^bMnBNm
zAXw@KfAAS!9*pitbE@7)L3tihj?V<oaYNFNC+M8MH6D!qo!I*g0S_T%O#rmMaXX5r
zZ@lh;$_uEO;Bf|snI0gsu+$CS;Js0hH17>Q{|8bQ&IH{Z%m6y;--FQ$R@QQOFnZO3
z%!jm9XKck?9{p@#U~U1ee<C68x`?911(|h&7gGD*7qlMO!h_KhsjT$@rC}^}gBMbp
z+>h6T(G@&T1qqMo9}#tfCsO<07qtHwOWoj!G$-p18votm!RQGKYaS0qe_0PkS6)!M
z#$Gpgu0+&tp5XZ(NZsJ^7a{KP5fK;DHF3wq_dg8G&7k!k1j}Sl9RM!>!F7W(sJ+AC
z!RQ<b5(l{zEC;U}rrpJ?8>TJ9T{nEMU|?<{c>V<_FD|GDomW`s2+Hdq^DyRo8Ncf=
zFgJnDe<Go*bleI`U(kGx<@{hT&>7CK^K~tt`!AvA2fKmGd`LcVdkQM+!Q~tS19Wei
zH%KpZAH1)l2cr|LY~=7@blVD259uqE{KQ=*ev4pWZX~h%cfeKtL(dO(Ln{A0v6cVO
z^Ml=x%6~Vs^4}Gy{PzOo9ccOQ3iBh62cwU#2csiW`ClT4+n-+x7?>Myo_`NpL+Zik
z&<IKkpmYamD-`bqr3cKk@Ku3<xdC<jpWytzJ%RCmhA+r#xg7T~fbK4P0Lljqi3~_*
z+j&68|2;tEe+-(u2B_TeV046)7aSgpt{1^&K6r0wF=!ofj|ZbCNH3N?fY(pZ`MVyB
zULQRe9bj!+4i82bNc$gT1_J}^JXVOCz-O$v!pc98eTg9ZKxLTs|Nj#_7+t{i5F{PD
zY($hFMJtiQ7I7vk<L3hm%ylG=|JV^4{{fvN0h))K0Lo*I`xrpytZ_iY4zgASJU8kB
z>yz+!FuFs>f1HuZKX=gh4{UD~OrM4aqYKRcJRXc5t{#l`NaH_6p!#5r2ct81T{tK%
zJs3R{L2Vr@_NyYwT2Ju)XAeea*!h1v9*mxm9*p+jvpTVt;m+W*8X$H!-vq^j_y7Mj
z9*oYG2y>lv5phtciaicK*)TBIg3do7vHZ3L<#!GbM%$Snzk%`*wEPC$_sihHSOAg-
z-O&Qw>jv2~gPFfR9$;Xu`9WyCEGVx+%IzHRS~~3I_Qw(i<{HrW2l0M^*EhwI(E0}K
zW)H@qgCIMQ!VIyelJO%C19OcFF>VHh4K!Rp`v5sS7>hvj8=yTrAbYqx7>gn|)H85l
zx97tW2Igvl<KLjLL9++6U(0hsJp*X}4#*xp55~fe8|oSOaM)wRz+6pm|0@=ISUeaD
zA5N$TpR*0Jhs}er5VV$x4ZA(>uP`uIgU-JuHGTv<7z-;w_X2|UV=t&@5b|IwR0Qqc
z!C_Ah19KI@_CFT?fc9j7&iMxI*#Y@S%!9FDCuqGh4trP_n5zixf5l>tga>26$_e%0
zd!|A5NO>?81a7Ejkiu@yyEzQZm89)|f~0F155@vV(7lS#aFg?3%zp{mvxCDP69(o=
z(D)ar@x$Q3n9quufAZGi&OdL@FfdmVJpThrxPkUO&7DxsfRumoTyf{0w<!$F6`=87
zQvJi@!I)=?ntyWd;?6&B{xC3CfY!g0Y7dJCWA0hh{F4hh6C6kWc{7E9xtyr+547??
zz=JUtwEq~i?+ujRggh8?d2#2TH#!W=<)HR2ss0i1V9fbDp`HOL|Ku#ioqt{*VPGx;
z)&Hd0BLUiTg_?hIKx=+*<e%3u49sN&&%eQv-ef!&b97PjPd4a$a5?Px=hYVm<}!lk
zzo6LztuLp5<`sA#b=>5IILx2Iz+6gd{DaH~ohJ+$D*~C%<-s@^-1ot(i(i>AFqe{=
z|3T*ScrZ=|jX8tN=ks8k1fG+@H2>ul2If*y%YTshEFO%LKz##{`D`AHlNzyy&&v`9
z<`Pote~|eCpmWPT7#Kk23xUoG#$mn)19OQFiS<6nd=U@ENuYUkkojUBj1#f%e`9>H
zg@L)4sQqt9`5R=uga_k9(7IZX`BEN?6Ty3HF~k2w2m^C5=>8v4@*Bu}84t#ZptG?-
z=F537P6W5XFwKAdg@L&kl>YJV142vxKA`gvn)fpZcrZ>BYyg$*j1xH<Ky4SsiHr@P
zwguyapOA5;2_G9kWeekkmkpr0lX1dB&|Tafj1xfP%pRb;vv@zKZ7?BmK|KSP2jhfD
z(0zHJv%eSAGq8CuPVj`91KR&4=D|3@5_HFh2jc|81@#Pa9*h&<`-MRJk>Goe7@tcp
zFc*<A{%r(u7l#L<5qSI?+79Fa*#k;zA>g~X`nO_FYtL3NFc*U6Kk&vCXrEU@CWA_?
zy>~^UCxb~rGXK>=4<?3$WCkY3MWFMf`=R43{k}NtabRFB1hxMWV`<pOHF*$sOc;RA
zKLo`ibi4!UY(FN@-7p*;jFzA^Eof)^F&cO<FzG=0ht{CJ5@<|=!-LT#x6zS-2h?xT
z?qXnboXf<~XxHEo>Lp-R>lvU|tK}sEy@v<fj|GQg6DYkH)p{_3*C*R}FdE5vFs6gY
zydZIG{MCbj5xgH5q#ksZjt8URPY=d4QPBM?9*jng9*k*$pneNPy@{d+1LFh_Mnmx0
zR?z-P55_)8(7s3y2F3~xM#H_JaZt!z7lz=ueaK$Q-mf6FoA-nEQue;wJfA_ygMrb*
zgVC^e189F61EY-xqapbGJE-1LkQ(qlG6qIu|L}M)8iLM)`r*N77zjS=-jRU^5*`dc
z8toc<aD@jbJVAbR1ovxAA#2i-85lem(?I8QSa>j+g8Q1FbDBLEQ$goS+knasBz-a-
zjHZw|DX_j&OXzrHg9oDtc&rhkH|6FA(7g-{450hHI6N3lz;=QB@4?vfb|K`fb<lhS
zNNywejCFfZc!2g2>4Mg#!_GU0^rsgwh<GrX%7V_D_F(J<)qesWj3$*3yL#p#rB|de
zgU1~V%z2>oPk8eMC~boL2o4wUSr)yZ{sU;tna6{%R}gpG^sxa0a~^2_1F7bN`j4P?
zDUSzZ&qmyB(nl8<nDapAUy*2j&rWE26l6ZAuYjX3_o#q@IhWx07iReML_*u4JRXeQ
zpuQrGHs~V(2IgE3QtLnu#_pfc{u{{riMZRI4>vF{=Mc6212ulTXF}VZAoC4zw>cjM
zFfiwU)_;*0{@s?)_9l-9W7kF8eYFQ47?^WF`#(rDzw0Knoe46(5O*K#!2|~8Y*N#|
zj|XEHDE-TLFm@G!{lVCk*=Wxo017ipO$L^U_Mq~#D-@gt7`uGIX^pYV72MZi?1HV~
z@$g{m1h;=Z7&}30GNn8iJCB0)?}EbHQj>uRvRAkhl>XT~7&}*j`b-{-ouF}hE)T{|
z@cmdw`5I|V<^B!^=By8-?Y+|ipEU^DD+@UnP7{5O2W`HM*fS%HLF+#iJQ$5Z=O2ZD
z(iv!+4P2HqF(`O2nn2GZ>QqJ4AG)AD9wi=(CSbj2dU!k-O+ot~&v-DJg4g+i&Z0-s
z3)+VXo9BUzwMuv}8i4l#crbSCg_g%69*p{tpnB4SvBMWs79)ivQW<$KgMm4d)bS6{
z`LUojJckEkJN(=njQ!1w_XHT2GeP<PL=6YiGVp%iMg|S&eqS4lL<R}a7`sIygMh_C
z1`)`eR2nlI6&WNzWe&8xfHwEW1e!+&joCu)#$Z(NU|?c_hM@p7+$B61^<e9tML_i{
z=)MIHMm^a5ParW+9n*tF-%e1NH6()S8zaz~bqfzhJ=pzMA|8xJps{jTJj3iW@nF;g
z#}!1M@ktLxEnZL?z=Khfu_jHr0(=K*A_Gr->*EU0+0Gt}y5KefRQ*g3MosYCrU#=&
zsX+4UfP%~hhLFq_JBKC)9#EPEjmcOtFfb%?{QqCy=>R$(TclB*LB&$x`@dRF4+~Hm
zvC*DEB~g=uaiTqg3h0h14+e%eX#OklVAKWA)k5sm1+UxpVAP0h*u%hp>`o8Hnzf*I
z7WfRRE(Qk2IdFGy=y(4A?=X)6ul*Ba!FQ?TcrfaK+ei@mbWTFTM1A7Q7zT!#WOkEU
zFUf0#o(&A4p5*&=Bj|pdcm@+_AHxFC7QfxWz?=pu|42xGYLW!fp8|9~2A2LbJQ$dG
z(85{5gHZ=|{}m`7g3j<R@L<#i`yUb(dZ6_mSkj*kY)oFngV6xAcF4kmQF|gN+#ve&
zL1X1u(w`1E|3lOmdU`Ob_k#3zFsdG{Nn<ZTOMh!T7`1Id@=*1X9*pYHvyD}!)+Do+
z)UTpa+{A#>0hV;A4O{;t;=!m5-ec&&s459bhY0t2FjlEjCmm{m%VCIrwH!fy_h3|6
z2~CG3v`vRM85o#TQ1(AqBrq^yKgYO%7iqo{^(+_08wVJelTqeBED{)4u$coYKS5~{
zR33uvpteW=&12VZM5+Uj>eCw;49v+W_rK$DpDrHvDKIc6gXTZs?HLl?2R|zVWnVSp
z^%D%t$)NLJNSI?+3dBFht_>>xam=x+_kz|{f%-fijOvY`IdjxGb{&vjP=A!igHiXc
z2ct6hJXomuK#+RK9D6AzQdps$55ait3j=c!X#4{nR@mavgHeeU6qlg-A2Rn`f@2Ke
z+7brlM9};XqHj)c?paY66h<KPp>-{K8;HocXD!hDr-BEg7HIt=mbqtbPY*^V*nBC6
z2cvo@Xbuw6mo5R_$=2h+s14E!?&Bi0pLjeNb!s7V&pM?Zj7s1$CLrOg244RIHUsP2
zvl^`a=kQ=udkV4-G54$nTmJ%*GeyjM7UP(EzUsojoB&$?hc~W3;Rwrfj^K4GilF_D
z93G4c3qj(bI0WTKN6`6$;Csu9L2IEvW9-m*&tgsN`SZ#N2Id43)4x1{^sfO*!=U>~
zL2W7U8J~zds#Rfkl7qs>7TPxl^@qXdrFk%FBBggVSy1>v(z_C9Oaj!W=kZ|FItm&)
z!JYmue_>#b2c>@!^0ZtnD7`|{DwaE{RVPC8EsqDII%xeHEPtcjQLUPZP^V&w<Ui;g
z)v8E)mo$1k80FuB?q2m^V1V9HtqNPa&*Q<Uc^B_l&y1IO7?|Tg^S_93PNeg<tQY+M
z4{8I0+P={Aqf)2^zLS^(bnh@I-B>p;FoNzO294QR!tNlRkGO+4d@qZg{u~Ad>pB1b
zJI-UUfQ(bhJzX%LL9QlMx&m^Jn&L_DeZ;nq`-m6XGsx9K*m9u!g_Q0j5bdW+9t_N}
zp#Cqy?MP>O5#x5KyL}egGjM_0v5xZ?3_$JyxvgVA1G5LCq9I7mQuF`+jrI&&Xzn@#
z@_(o%Th2s#1{2U4L{z;BUy;>g_rt{w2Id&h`agspkis7&?Bf|sKyB(mcgX$FmJ0v>
z6taWkLdH@7JZ~*xsqp_FRE)z?fq|*egRub=Kj64wU|<OKV#`?!iko-_la2BWT%ooo
zaRV+JLGc4F2bw_loXVoblLBa8m4pYQY$Yg+5b>uFi6{ORVE6ll4hH6EQ2Up#-|ZPp
zD7YKj1)eTZ@5a^v#UCurVE1D;><5iE%HIUX9prv&Ii&lsFM#?w3-*KBEApw}G6d1K
zM@pOL*Dx?gf#yH3`i;1>$pE^~ssxmOKxq(~J|jT!<H0Ds6de9Fu>2zfSr-dFcgS}y
zNIg=Tm4fCaDX^cQ`3lq@E7Ss=&HjH0C>%mH+44Z=>xb`Qu`ASK1l=cB0x}29UR|)g
zwQzeSLG=c>o@4ZN1*u1|7ZQFDdm(H&n7xioaC>#2`Nsw1H;{il7^RMa?ScDG8gljq
z*nd8E(bHP}UN4c&`x%huGLhoqoB{)LWWp51|A@FCxtsvUMFhxy(C}~oxet_fJQ$_H
z>xUujA0J1M8l*6Qmt!!0J2d^@gB0E|(6EjH>BBTzY9}asA!d6&1*ySjwj;u9SeR-c
z+$oidWY$bjTEHJ}XWlR{M}Wrv5aEWaY=Y*`P>ucn^g9?B9Op4eST8`jzkUIve6n7E
zbbtK<2BtzSaJVi3#W~1tQ2&GP0|KQ5Sf2D?l#B)W1Jo~qgt?R@$S;uf+uoov-c&po
zB_L%LJk3ag_oqYDczpz!j}&%<@<a(z9JLf`fb+u&G<SmU=mon|3tT3rcrZ$AMRlhn
zQoi)sO0*j^KzED%p8<6PEG{Q_FiJ3@nlAx9^91TgUhn_^7l7R3I1e<3BcX|^Rua4?
z4XPG29;o8MD83O@jl@($xO#%h5h;+Lk;@PKY39@x2If%E{f~$=gOt}$>NCpHOa&+`
zq3I<76i%RY0rCqp%}97KN`UhvXinCH5xiGG#Dh^BeC8Kue$|7~15}Q1A*Bgyd36rR
zY-rh-0Zj)rNOt>x<l%Nh(t(Euqd4TO8*n??0~C(9?SaJg29P<SnryJR4)I_V=LE$C
z)UBYk@q1wQfby3Iqqr$Z9^yX_(D~3J9*kn(z4#D4?tcmA@sk`3%psumAEKS>$iM*|
z162XF@nCW0!6;H$Qzc#D!6+gKY75p>gX;h>55~g1i{~>4>CXn|dyD$HHy9k|Fo4P(
zG3&hyj0@@+bSzr_{{!6<uwg!fm<OYnA!u!#_y7MlAZf9%7Buc|naH33YA0--&mdM)
z<q-fHF9Xf3AliE;0vMQsLFd1~`#BZ~41C!8r3FtL?HU3=?rhYAj14-@V-T@OU|@#M
zzk=4XIxMJXPy?;+1eML8InYo|HZ9Qjqz7ZcOOV+fj0JN+^P7-)!Gfz637~oC0?@iZ
zC6HS|ZbTgmIKGF0IS7>g5#b3MS3SYBYyu;L3L-3p&W6+qSb@UOdM*PKBpeDrXPtuG
zT&wv)51O_`>XUC*U~#i27B`zh%mJ^9(}22J5mGnjgXTJr-K>BJ*JFPen1fKpf3Srq
zI4tcMR0_2?7#tTdWLPAC)+glGg2K5`lL2(b4yfD*g)s}Jd-FkSYgJIgIKLHYh9x45
z^9wB!K=U{Gs-QV%>|uN?f`K^@wEiES4zRh`gHbS3znOsxbpNCWBmYs5`yutHBlwJD
z(7Y*T{2l$nz#K?${hJ4)ATP)~NIr8|3vwq8^VTph2Y~KBAYt4?z!a$;xxjHRG;H@V
z$apX?&47&WGJ@74FgxyJJmSH?)Y9n4z@gp6!0tGgsiM)YAq3m}I%wR&gHaN+HUQL5
z<ndsX6!l<Wg!Y*wL2DSG``;u$W4O@!v?M_HKhA*Ym3ZpGz~}&FgVuvAK(d#i(XJr^
zkG-J%KT9BbB|&=kK-u84@H`j=u6i)KgU{1|^wouydN43T@B5Nm>A@(l)q^n=WIxm`
zl2bhx1r~ZRCa?8iU<B>q0Qm=Wmiz*!xuqVA0*xLFj422=GR8F8HN@a{qZD{8ga;$P
zA*lZi$u|PF^-q3-=0u?ON`c4TJQxL3Js90V=g9^@?2{_>{{P<s$_AZ(022q@{~iGq
z5A<N<2dyQ6`dtci|8)$)eGGdV?HUqryH9v3$Xy<ceBd?(c+8J65wtF%#e<Ot6uvbO
zdxUdA>N>#dAHZw>LHkg6JQ#(+``;nru3JI-4iS4bg)Kqi-v9s2ftsNS<wL_$SQ5nd
zU`z+i3y46~utLOAcOs3Wpq{DAcxVL!voC7;$G#?q!vfS!IPgitgOL}U{z3T*GM2)q
zgPI3eLFeQ%InHAO(aetfnD=-vum&K)k=3Qqt|0|mID+a}klUgCTOJQaF+mRoMivi7
zF-{K#CfK|MWZn`yMke~vgMlf>gHiOQ2Ln?Drhd_jp#0~-D0<QZx&{W-e9?^_3`}!8
z7)4ilFfgLdi$ctw=)u6Wz=Kh=6O^~Gm|y6@z_i4JQ8W{@76*%bpa%of3J*q6PY(vB
zHHa`^acHz_$RHvNG&~r^!1InCj6C2y^pHA)_buqoI}gVARu2Z|FCL6ys-Ut0(|$2t
z4+cgb4@NOo4+cimeUlLXy#?h#4@Ob&9uE&jUPli`XGmWTv@eH|U($nt8T~Fy9uG#*
ztx$byJs5d;Js6XGJs6nL_lttm^?EQcCU`K4wu18jV*<!L7fg4Grg|_i#&|G_#(FUF
z?Db$wUFpHVEQ3XzEyy1pjH0F>^@#9f`p{_CkV8axg3?r`_y2zzJQ&3iLH!jEMsDzU
zE+kxe9Kqqrz=(clsRXE91e)9RVB{(EU~~qZb86wiC?*RP<Md#3&h`HP?*y8gRXi9)
z!TYN{7<nu`7@f|7+Jum@i%-&nfyu&yQS_$w|9`N3oUpVl;K3+*(1Vc&6mK;ijG|k;
z|NjH`H;~dVNX=XiM(&58GS-7pbRwvHK(imDrqY9vd#?urV~+=;D9DWqu&4?3VC0_Z
z!N52LoK_jREj<_*XCT6taYCbALje)tE91e)58jjH!N>(ZPX;n>{x`ydksmro$axVI
z29UkCF{Pk%>%qu=)PsQ$Jl=!kKM4;;{!CE#Hh{}YC(xN779Naz2SH+xwOfv$@(#Af
z3>J1EH$cw90_$^(gsy2g<H5++iqPwD611+tgMncST6l<fF!Ftb*clJn4>`qyk<S-o
zpZEX25?It8g{X}KojID}!N{iwRV#u;?M#T;WKdmb<H5-L6{=PMMJ;%}8ec9%Z6auX
zM8JcQ_asQI2V(;GOju~!2x%?Go*N9z9-#Yw5N+Fo3=*)uf<+>O0H}Ry(a3<bzLGr?
zsV#%Fwvqu<w{v(f3V_xyfZ8&kaemN#H_-hj5grWS^Wr%?7zIIN_Mo{e4i83Q!A3;}
z9#Gu|Z5xC3@H0BhV@U8|<e2KgXahMn1bm(V7wGI{4-ZC;S`S9sO7H*wUqI$%ctG<G
z$Yy}nYk<s<fz)L-pm_%#2;0^XR7WD!ZD@03yDu;>yMxxh!TY+F4h$T%p3KWE6&M)y
zgX%L#yI-aznc)H`Y{28_`x*?I|24QY&TDXJtZOi7nAc#_u&=?Q;a-DE!@mZdM!5!!
zTF)1HwO&#pwVp5aYCV5I*+2DaJrkhpM7>(i2q-&Juhvrm%2w2?_0)i}HT7ye4WMj8
zy;@HTDBDu6*3$vXcGR=fWMFY(_&))(PS}HS7ij+WL2Uzr8fZ<-{ze9Ynz_mq6B`+L
ztRFBifch}rf1lsgV`g9gm2Hlb7#w8n8F)bB0}Y)FEcz|rKA?_%3wW$w1XSjE|MhCr
zZw8C=SpR2W1l>0SZsRd9a9AY#|KHfizys?0)iyLLcrflNX=q_!@&5bl3Ins70`i!h
z#R0T1t(C3-g(+w*xPIyD3Q*WK%xhrq{_kR2Q!icV*u=1)VP69asQm_-U#?lEUE%%T
z)wW??1Bds2H_#n3Je`^h44|~+u#Z8ZVPAs)np(kzc?}}o|6QLp>}!xfm2>&pFt0(z
z`@ieShJ6hRXmU3j<~68z|94&6u&+S_O>S?)yapZb|E?23Wi&|6`@gd(DD1&u!nm`7
zf!P&x%ndmmVfV8@!#$9{ok8dMf&6XIu&+S`WOl>91_Mx^w^6Ra1QdRab`2JdaSb-!
z|6NQQ<~2BY|99m?xWj2J!W}z4FfhA-=G@_F8zntscZUST9Zq|p;SX|$3)CGRSlr>`
z{oi?Q!@Pz7@Bc21NbXQYaz_ROvkR!qA;ldmP<NO@-7%xlt^ql&LGB8Hx+?;UyJEcm
zJBv2VYe?|^@BFf1UqcEg>>B<xWPtR5!!m(^85)*3-v6CmHq2`%@c!?-w_#sHNyEQ}
z3UqZA2N)O|;~Hwb|2u)=zrp*zGgACJBE|pq3I=9pQscj+;a-D+_kTxN{JS*lYv=&E
zq2XRb4`_`;!@q_J-v6B(8|F1k0sC!V!;FS|4RgS1{xwVhsqy~rq}VX8VS)F5r>}^(
zaF~gRi*0upn4Lg-E=Y-sB@nkctc1qJj)r{=E1==I24p{4cy93i?>MtzUc(me|4z9L
z`x<sM{A<`_ae#pdqz<g!uE7EvXK@W6wYd%R8V-Q{_OIatNR7n-1{P4<fYrt|Yyhck
z*w=8x`@bW||7X1aJBc>zYq$WCw@6@M_5Sau*|4wSO2fT|8z8ZUe+_pa;o%6%{|~(X
zJ3d8(hkYj^Jhq-;V0HwZxlT%WC_vJt{Y+?htZBH{@B-Q1hJ6iBy#G5)ZJ5{a#{0ix
zCaPN<Y8&=7d}z4W@CB;p2gI!osSWcQ{&@d)v~0N7$kOnykpnEhuaN;N@7gf0k;nVL
zqa>Pnx()jpT0m+MWu${-!@fpPnX&{V29ops@4$)(1G`p47;J&h-+{^pP}^q$BZG|h
zUzd#*$qbC%|Aatymw?J79#Fg2`>zWtlHMK$W(Uxo(*RIi173gW$S?!ip4b8!8v~W^
z^{KZjz-9b_Pa+NT8Z;o`X9r$8YLN)qKRInBXnxLd9^)JDzgmjc4;dmrYZF2BlXj;t
z6R2Eun8)DJFt1T0d=8792ZP>6{W%hgL1U=;b0n5H%wv!NscD$k2)YMO0?L*EtyyfC
z*QfyEd;fKw2%7h6nAfNRStF^p79?)pz`*bQ|34$hZ=ktQNP4onnLNkIp<xjN4@gbJ
zyhe?hDB+5lrH`k1FzA(n#JvCiJBy}gX~RMWiH3QNIv{zdT2Bz$`~Sa%Xlg-c>~l2C
zYcv4KhpKYeK-Eiv_}>5j6{4y4Y?#+*VzGe12qf>pp!*R-d;kCEiKb2woHmxc28B1P
z_kTOVhJB3|AT>~bF*aH;Ff`0-v;paFSjoT=vNYAsgF$y8i0}RX?@y3gL^#-9Y@XNX
z&}ajxV;$!)_@J6^yRl(kqYFq6#C+R@4f7g3Kx^zk=6NvaLjC_2&HuKQ^~tv@K>ED@
zTmQ67WY_>on;wjt;CEI}eh6tNPGDpZ@&5nwD9AkT|3AQS=KcStE`<MmDTMwt6+-{k
zgwTHs8yFcxK<ws+3_KQ!3<5PA%*(w0|BYZ^wgcT?hsf_p^I@R$21>7>_EOD$ZCHDR
zrJ=5Y!Taw$)`q$Uj)r*+EZ%?b{?wn(0J`s6M}Iy8sND;qL2G6MK=l-;%>?qB#R3L~
z$uGg{6IDR-*Py!#Egcvb(bO<b^kiUYU}TWl-N?XUp~xTsajSz5D4%&SZd74lwgcT?
z2zN86>;>gjXg-qx<ynxsL2W3cd?w)i-|B0lU4uenT!RXz&D|*1AOq6d@DI`!0<|$f
zWvlmpYf$~C;r-tRRR8IK$_q$*T3>9~*I>|aufYT)*6<HpZnJp*x84bA^Lqcc>23Je
z;L&ie0n$d;*WdsttE@rgzmNBS8&LU=Y#ve@!HN;oZUDRa00XFuWAgrQ<=U{XA*A76
zLj=gZAUiD{Fff4DC4>Cs{ofi?{>OO#w*i&^2_SVyYM7vEWE<u+q<H_g{@AduAp=bf
zBSekW&xUyoIo|)R&w|p3MFRty#R3L4@Bdb|pm+eKMUc6>7c%gG;sO*W-v2EF7?^G5
zpxiBmWnQ46uA#*H@10t3*;m(4;r;gxWSwqZLyh;}JE_h88cINA9Vo3i>|@|)-q%n7
zop;e_nAgw%$`>HFcrb{1g4)~;`xpd3ZUnVCL1$Ef+9@FSdH=P03znb9z|lOfp#Y?&
zzU6U610#dV?nH2!R{*))`|oWZP+w-EG6TazWd;_%1_p&jWk`N@*vB9-p_zeULNf!)
zL=^^xi7Ie;7EpQxi@QMNCUipNK>8aVGl<l5DpxeJFmN<_GVnAsGf32=JBc)$WUy&?
z$skbE5+vgN@9+}_X6p|q?f(P@2b6R>R~g*?2etdX|M8fD+zG8yJG}o}$#%vvFlcu%
za5&6ikZH7K;IQOkU<8dX%#>wdsMQP-0hQ;CwhSzmo(wD#V;NW)G8sT)*bJcl-h_Gv
zn~C-e1|Ty*YZE5gGw4i=XRz@8YkRXMldqswlW_`Y4^T~}M8Jf428D_C3^JAq44}2`
zBB1%B`j@{eK=}`Hci`G3jmiu>mJSRo77Yx{pz(W$ePBL=MFRsvV={w@Wdj3)1p@;E
zD9_hsMpuCPB#!eKY#KQk1nOHIK=WxFwXDt+jhqZJ^$k!y1DLN+-vj0II9D`kGO&36
z|9=Ez1}LwB%xPq1&~co{5YX_FL1dyQ1J8s`298<|D-lbM|Nm>foJ91y7z7;WG6*!h
zWYExWXJCZ74dhmx2`d={YK}RHOyFdYnb^so05yM2qcVd*%?Sh0x;)UFkHCb*3^EfA
zGbn)KcVaSwL8CK+0qD+p$9?}_G-@$G`sw@r-)YohV40}QU;tW^1}Zy1;bF0W!OP+R
z1Bb-}1_e-F_5OD-fq~ib&lJV~3t;U6O9ckjy$=~=pk-D{%``~dTP<K<uxemXuu5d$
zuySBv0HuYde+>-Hbqy@daSa^Jb`3le${84%=QW5l%QXlz)HO&<v}RzKXvM%_slebi
z(GpCvOtfHNm@tQd!TYauYC{c}{@DDlL8f_Mg97L*2+;VB_y7Na4cozG4LIIF;cM}L
zf!UIQf!R`l!3)&)_x^X%w&`DkMB`ru1}g;yhDHkphWd#fp!ln>Vqjosv}9nYp8)13
z)EatTt2OWvsqd^{aG1-$GpiBQmSGTRjA3A?_3~IZ(~*G#v=*r@ZFWUNH3Ngi0|v&1
zSqu!ds#+B_OBqaR3Zz6rmfozZnW!WZvXsNdN&wW}I<VIJ|Nl8whTwj7i}$~Ms+P|G
z|3mj)zG$>-Pyyuu^u4HcPj*+-9o}5w{nskh`~Sa8@Bg--`A-H921Xw5|NkPr|J&XK
zm3<xz41XH!85kO485k@z85rw30~jXSGcY*p{SQ8m0VHSY`TxIT0|U>*cm@XV|NnkW
z+7G5bfaE~w(Q)6uCt&@YpuHjipn6XN)JB*n%fK*Eo`Ipx({Y{m|9=M>{($mnKtRoN
zCy|<G))h6&4Fc*rH9&hk1bUV+FwR)^|G)SD|8Fe4{{IK*1MTVX{{OGTQu+S_?M{Yx
z$GQJ%8f_UE8tyPKG{!S9)GYH7sp;|vuz1SAsL0O1Sj*}pQs3eLHm{fc|Noin;4php
zlNPuR<Tpz%2F8iD3=B|z7+5BP#+g<wU|==}tvQ6xJ%Yx`kmnyQq2pknwAdKez<_e!
zDdWmH49w=BJx7Gb&=B(>3|~NZ#DnHnL2U-u{ti%{0)?FlXgt${;V)?46=a@=;U9Pm
z3nKpiF31faH-g4k(A*-xz-+b$rB1>=o`>X?&!GKJ1l;lmv`-uAmcO9+E*_{`0&%-#
zMGFJ78L0h6Lb!b9MH*Yg5iWl~d)Q!ZNd&j)6G3MQ{X2@=Ez5r}Fq?w*oRQ#`PmP4#
z@*8ySFw`x7z-Jsl!sVYO9=GH$Fq?wLKS*%P$FD@V1vJ(Ta|<Z#K;!7|THJ0~_JD!e
z1l0d0#VyF=zc}LP7ig{n>XzT2v;%XCA|AJdFff~tw&tAS!(GDR@{19A-vf^a!*5X9
zfx6|-RNQV^dV+!37<BFcyi5qmbh9hyVqiut7eH<7fXpL$0hvy60htH*K;?sD6N8I>
zD|l?wre-DcvW9;R3>Ga6jGZq3|A%V0*@bF4=vgfN|G$<ir~+JWy9emidU{njIWX{m
z%y($|e<fr!`@WE+ANE<gGB8@S{Qm<Qf39g(2B`^Yb!K1znOUnDR1vBbx(j4pEqj1o
zEr(Y{C}-%dP!0#ZT6Yh<S}&)HP|wg^p<WJpwdx*v80tB_D!l*y-=N>kz!0)jz{+tR
zgGp^B^Rh;{1_q0z49qnxS|YtJ42+@b5I5Jng1XlO>RyKbPeA2jsIr?~pz;yDKxHSn
zK;;8`9*j#s>FEckp07!k_%VTz0aV}YY+z*I0r4#q88|@gP*A%9v|fmT*@)oX)1dwq
zq@VTkEyzxb1kifkB`OTehM>ON1(02!v4(vI;p?1CK>Y<!{M5`*uBh3iU16=jz+k<A
z!3GpZu(mO%ui?QsU$mxEy0T`ra)sj}28l+y29COyC)VjtX8@JOpnZ-4=6nBtv$kYl
zbZGj2qJfdYr2gseiiWxdp8B@O74`0yD|Q`(_{l<%!NB|PPY+OA2INMI1_nlm9rHdK
zru_e3>&$qiHtm5$ZTt@l>jnmf`j^I_aTHK{oJ;;c16Mt#ftbbK|NrYX4X?rUdoa%1
zS}%V{q^9MBNKNuV5vX~I+AR#6Aisgy8P+ZTzggX8U~H&s5U4u>s`Gyw1+C9_+{XZF
zABlka0p5RqYy`Qz?#XVD+a>B<(cS%H0t2%Fs2-dE3(s10&1?G}GWbB-XeBk3knwr#
zP6mgX8Ojwkd$lWSZW~wB{I>@8jlphtz~E5-UwfMVd<M`Ri=a6Mf%^Zir&&GtKONey
z`O#3<AXBe$y2AVK583+pHyj-1GH}$_->#^aI$Qw`mpMN`ZO|C)xeP3piVPf}ehH|Z
z6y7CZ)lk=<P}3Qx=fS|Bqdk{_2_&~*76U_g7l%zlU4u$ZXD~=kpko#TLqlDIMos6#
zb>4r!Z>^7dC1O1X+#Xm`AOG@NLtTRo*e;1nBHn+$=hn};0J75pWM5-kgF&t4gLM`O
z40@n;Tdl_qOUEV#0npl3(B3vsAHe(XcR{FmCoB>exaut*iFp70_P4(NMu7L<?;k;Z
zF~@oT1wiv5png6mJ}na&3OpDW2GlH7yk?Qgz#o##VCMbzzYi#Hd;k6Ogn?NfG<G%v
z7XJGg89bn2pHs6(8{9Xte#pQ9TC)cZ|J%kD77hPD!qRl3T?2!~0S3_A6GzQo>xx=Q
z=ZcAn3>u(wSSBhm=z#k^iVPMW4C<i0;g#ThL3Is0-haP=?y(DKjAj6}gIVh5oC1%P
zOm1Z0sErH=nC!?PGSQKNXEGz`OgQbE`ppcCp!rzGc?>H0bHV)!8Bp5u{`<`rl(#$>
zG+3ejmT6RkjJwoYc?5vk=^hN~;C85GB147;;{p!`W<5~b30}^2sxmNjx}uh|`kf3M
zpu7z7r^7r3o<dKC2cYv~8tNKAeZC4y1_rJ|PX-pyo`_CX2Chz325w6Z1|D$P$l)bY
z=*hqVlC$JsV60Vj66w_Z{~y$Db(r`6L!l>w03JCe$0i02OAZF6Ml}Y8`VJ2V$2|-Z
zpgxE9->;UCvgrSR561a3K;uiG_WbUH;4vHM_|iYnx-;-NO-;IV1!x>~e<K4&!(j#n
z?KW_@34r>MAh$TqV^FYkV_>vQXW*zgX$<lcLk)|T2&nA$U|<lL(9FOwVKJzk!zcst
zhm!+?N250bLqj$LOMRDu1E`Nz->l)_IFI2^eHR0mu5}I)vCL-RsBZ~yaG3Z1Oem*>
zMNP7nNUge;$b?LgSqxvm>C)~0|N4#q2ZuQf4xt<p7M7U|jJ51eBB7cR79h2a9Sj@|
z91J|oFBt@yI~hdk7bJ<)&wl~3<3RnNUn2EAKS1m);55IFfd|^J_@Uj#zz#|Wj&m8_
zSaLBig`AYIsO4l{1~Svhfx*I3^Z$=VPLTT?Kz2(^<YW*4wf!488F(ggGKhfoVuX50
zSk$@)iA?BX5SXxvL8MU~q}~Iho@YWk1IL8r3_KRc7#JrUhxFq-7#JEr{;YKk2mskL
z(GxNzQR}4z?km@FI)lbS8NL7i=c$ol5~=SFaG1csz*EZ|5Mar{!00%a!2;aRoyTBc
z%JKidr6wfpG@N7*m~fJTqv0fj$b^%iI_>|HiS7&xpfPb!8`P2kT((>QjS+Y-&TRnY
zHPG1JL}dn!iOLK-6P+RBEfbX)A|@&`#7uN%2$-nM5CW+O|K4eM%n(r1rd(l}%n$*p
zdqLwZpuV#OI|C!gtQt<{WljzZI*r;442|3jEcKlR4z-+4B93zzc<NgmKxL=^sDA^B
zZ&1Bj-(>-clO-T^p`H>J4*M8l>N^x1YL&f29QHAISR4nnK`a95y9^vaW@tmk2{=Ih
zK=yZ|Cqu+UPlkX-PllL@o(v)0|NlRkaF`(gH1;&1lOX~$<^nR;VIPAG$ZU{0P}ooO
zWQYN!Es+0eoxMbAmN*17YB5AuBr^omoHPiSaEc+u`~ROOp!5M!0}}WC|L01>V+ICG
zWd@F#C0d|$rwo?v42+;WP|s}P;N-wy(#Xlc(CEp)QtJ^U0#4U+7)0tjG#niEF!1>9
zU{C<L2NWlucmvH#!_1$e_#eC{A2bg>fsw&xA80JEQW`W5&Y{P~z|g#yfdSM80JRlr
zt{YcaEoKO)JIZjuTK50{@Vyci^^0GL=+6M3OR%E(F9S>STm}YE-Q_rkVS&RW1|Cp8
z0G*{<KW7IhZT8gve<V^re+MXDRO<fk2CX-gu~cT@0_Q19FOlY#3>;AX3H85!1l0fE
zU;(N#LE}30bAEv0#G`KUYVf=xXuibz|G$?y%nS?;4gdF8?E3#7ESGvqq-GZbc;2f%
zRl~yj|L>`wJm|28K>{?l4+;xwiU0qt_x}Ik{r|s9V<Q8HWg>$GsEmfp&ClAyz^nmU
z%Lgu_Ky4^c`2?+VWI*i;P`O)k*BD&Cd;k9jo(FaSo!?p4zyNAjfZ8M8e?NqR(mlvr
z55`$7pm7xM|Nqy3;&qDR{|lfn2i0l&6B$5b)0Gn#8B8WNGDtW!F(g<wFtC8!YMscy
zp(hK;!;X^}L_lMj^(nV2EEX_uc`$G>hW~fa3rS|PtEvB8;W&vwqIn?$N2e`h+!C}N
z7_=_ke9r&>puIR?cYxO-FfcSWGDuh^G8jPoJM)RfQU*p)-U7AFog5f6YMBGp)v5%n
ztJQP}sMTaIb!cLc0PS}H<t2xC{~v(rZczRM)%hU*gtV~Pbt*G3)ORX?+6yAkvReR@
z=Dh#^e*sbhOZT95e@&)zMNKF3GA9O5``04?B;V=DzyK~|_Wl0=8kYd&DcHCu$S%;B
zC}`XhR9`qYF=%-I)ied0|M$BhNWP{PycPnyw!!<aMr-}b*GOZNGeP?V8EPJTtkZ7?
z_d`@HS^obAEvf_CIgdf4z8zd2!0f&O^IIn~0|UtKpuHxRF8}}cYB4av{0FN0K=mca
z{b0BJ|9=JMPX=Z+)V?*+I5^0y;50N_8Jvci=QS`mEMgF7-owBE8uxab$B+PvYw!R6
zJ!@?x*46)&0*5PTtb3vjBu#+x*5lt5pfutA|9>PXFE}<a$aFeG!*U*j04QETZky@+
z|Nn#<1_n?%0F9A&Fiw91ig#$7OTgmKcOHWRNIhuG3FI%>`9AwWYm#cDD?shC35*On
zH8Yhfy#K0itf`i+tZ#k{>L+-3|5aZIZim%MSAh0M)c?H@04f6<=P+o1>;<)N>r-!6
zSnvJ+-}|qoDmY)x`+ox@2TD_*u(M1A?dh5B!N9BvY6HEnS-`+=slxarVX2b?IKP1A
zqF!oW1Em8{UIfkSfbu9Pe}elUa{n)Y+C-o=G9C<qZ*3L+e@N8ad!S~&=QT?O<`*@4
zv_veHGJdI9>U|B|Ck6Ef<~6X?)JlnXFbM7i=UMQY&1n~4=?`QVs0^@gV3+~2FL}<i
zhWfb=9P0PKt^l>~?H@4ANd7;q0pt(wzp7X3_rC~qX!`#EWR?fxw2qMW=XN1o$L&Ho
z7u(e=4-%<a>Ln7=!fq$Clz|O&-b+oZl87t|!`V=dRsUpGFmTnhDg?-^WZ<-DVKAt9
zY9%7Gih*@TGXq1-b1jjY=T4#yix_x7aRiDVS$2lAp<Wy|Fuk=LK_azW-jy{^Ednf_
zGZ@Tx%)kg$&jeQQ!N41;DPR@qb@HFgD+aDwFE7zrb_Y;BZ!nXYfeEUX8LXBI;wD)Q
z1};z@sPzm8u=HXunCZ;G3~F0hBtzyqEIAkqERq>mXR<-~49v<~P{!Mk)BYUgN^sh*
zm97BIAJ+Va_LCNY=V%x}X{qLjafSE)-#3f17z99Ng+mjALw)lPhFa$z0T!U~b1!h4
zL?9=lfkD6HKj<7B4oe3HMpLi<|E>T3{}1YyfXcoZe<5S1p!^DIH&}WyFgomEfU9+E
zVi2kM<FKyguj4vUI|r2JYqdOn)OY@1sP+0+V9CIsP^%SSQBxZvQtSBx<abb8NFZ0e
zfkD3=)n1UDpg5Vy47T$FB#%u2^&P=`BK9XTh}76}gW9_~_6-b-Q}!}&*e5VBg8Jmi
zbJ`XpSGUcdaF>Avbk<KpBV;d+!#)O+`j#6Gj(Z{f1@HfVcS7>V6oXoq$I~W)#tpI_
zUIX<*YMK>5?GFhXQ2%=I>xzVywgnyxX5f9R;I!BF9FqRhf<$VPq3JJ~fzA3q18Yq)
zH2tx!`X|fDz$udss*?q*YEBr5$Z|2Tg3=ere9#;TC{5O~S&7V;|Npnl3x=~H&sY7E
zInKZZYLC{kLDP}^|39)^47{NnC;!R3VBo6N@DizYho+tQ|9@pYL1}i?KUppYE>L=^
z)$j<g)MPN2Y5)J<%y>}v{rkhftO&Z>umF_jLHQe0U+!yUNC4&Y35*O=YNLa}eZQJt
z)}Z!E3@99HWt=N&&Aq{8DyZBmPG@ic#c{S5D4jEygnHeq%k*Mk46kI{Qk=mc5N^q4
z2kOg&S2NgHGcYg|XEK2LHsG-;hdB%q3da~2YL+ri0PX3wW?%rVAJr&M2luH2pkmsf
zen@c!xIN4R6;sgTVqmCQWelp5RrF^u2sqAT0Ly{Yg6bRVIsgAT&SL=0C8&V-pmUro
z6&MUa`_N`8GJwt`tkItZ-qVu;(r>lv|9`6k;5^4+b%24z8Z;jS>NEXoU<o<NW>>4Z
z!UB}uYeim()GXGnsCD;P2g*ZrM>kj0YXw)#^Z@n8dL2P)7C`Oknia~G4o&}$fZSuf
zkbwhK*LeT`8(F_sBA|Zm4u<+wuPYqpFmTkp+Fenc&LCK;^&r5ZiNUAVBjAU{eNeyX
zk%+|t1_k{&|NmROgybnuKhNYjIPdYySq5(Rf2q~*_)*L8ub@`L0o1SgU;p1p1Qgfc
zHsd@7p4svY44}1=j*}QPK>oC3U@({|53ZlVYbZf&wPZ_%2<!h0OtbC(|1VBw5O8Q>
z2(eheU{IXFzz7<50J+2B<^TU6cY*SxB`3r^ur|A669Yl_fb0eJvFhgrFo5O=L2jBU
z4@!ss-&p)bm|ef(b%kXt)O=`p1Dan1r7;W87{m*Ub#tD9{r;kU@rxgpod5sVB>yV_
zl~MJ3B`hosFeudje<cDchb;d8|BqG{@yt06*88Qgks+p5+2aRDZ>_R~g=HecgqnIO
z5lDM&f&>Gz9Lm|YpfVD)1_U+^3o2hhZ2(X`sNcl^TAKhGFLLR0W?-~rW?<CsVyJM~
z$Dq>b%)nIZ7O<|+i@^ny4nb+sl9_?YVgWd9Hh}6!hj|R3_9iGz7C`wNp!O%It_HQ)
zYS{wT6|yt9fZD&%b+G}Ud2-O68;e)}FBEb!usAd^$XLAkf3lDpoWDT**$1IsY<3{A
z`gTx1<^PGAWX)@!c3(}p6sV880@No3&GCW86FeCEeL()v?_$t(*v9}muLL}n3My}*
zW2s*uW2p=mP{&gL-C<ys)qvIGpmGEhRy94!6`=Mcv@DT94zK2a4IH2_bJ)j#J-p&^
zhSv&c_$;tk0M5fRpnQ0Ef#$(M^WWfblMh%|$PEp*9&nm3n5Y9@2a{o$_5VVlEF|14
zv;Lnfltm3UkXUWnzk=HI=!*IV0|tkE{}0r+MmRX^{lBA@RT3PIwJsWBwJDm{Kz+iR
z_6U)hv_Md}c0j|m1kyI?{lLI116teN04rzrF)}zn!=(k()&YeLXzaFTyLLrQv2=yC
z0)wjcLk12|+Ol?FumX)2S|>6XSTiu_b(+EY9vms!oeZiD``C0qbJx9Q42;^H4BC$K
z7(jhE8SPF61<<^|b|-_f!#oC?q^%4Npm7cDP6l1ac?=@joeTyJ^B7c;wu1A+k)*8*
z0^a}s?@8JUp7-C9w3UGa)R(gK{C@#duWNTPa60Z~&;Z#F5(D$+GUUi|FmPF2V_>Z1
z@B*y^xB!}u*Y0G{vSj%G-(eqvPiHs-14tgee!?7S{e(DZUKYB3!W_DOBAkH*)Yk^J
zg+P7lS`LN_Ah&_+tvkNC!m0s0hNkDRkD;g2jDgYO8v~<N0|NuxO&~YAGcZ_c{lB2y
z$-wD2mmx)N3ImtLa|Xt`DM2DuQ~tx<2pW$7xzFMo0~50QEKWhzcg(ns-F;1+3=DOh
z3x3pU{wt`P;$hLL&cLAE$&dl+zZ7aQ+}G}6@Nt~SAfw&I5CskElA3SU6_yU*FwxNO
zWXP%2@~*Ht4jzk>=u`*ycXB}OJ*(pkOqLD|J|O?<cQWKT&SO5I4Wj2VfX*;VcAUph
zqTR`m>^PSJwBJD0aUP3~#RCS=JZgjo0|RIsMT+A*7SNn-rsF;q84m^)&|F!u<2;5d
z+MNu=P<{E1^H@OlZ524~W90B)VE&`u$x!Mzj|H@Eq9SQ4g96A*$9*gk9t_M6ik5@x
z1Ot;7|NmP$Ferf1x5EMkP=AlnRP+CTX!$H)Rm{LRGZ<2)gTwVR10yNn+NjCEFw>ZU
zq2{x71=ubH1_iJ^3=E8*u_4DM)(o&6#$Y=>fb2jq{}nXezGIKK22i{u&#nNif2nI*
zTv4}tb%po;FMB;0Sb0b_s|nPXo&=t&k*Q0bUC}VFfd|=K4+h39p!BKV$>8fak3mNp
zL__x9dOGf7Xz^fRT%g~{kO_)U{Z58lhk1+>KzX!iIfH}60|vI5m(0t+`v_kCt^l>O
zYCZ+53wid?F6248UCmL0bu~{d*3CG{z+iEbfoTS)ebB@JT7Sa|Y6s2sWMHy5$-oR6
zO90L9fyQ;c|NlQQyA4$KF>-+H=`>?t((Yt1bJ)kw0a|a;aIZlCJl^&EH>fURC|b$j
z&}qcL5UTaiE>x4<4pfKLs(GxN>CV6~Q=Nga(};l)iyV`sI|Iv1bp~b!kb7Dg*um~`
zXJD~(XJ7^Og{^`Zm_Tl-bq@y311^}|1#%NOO`Cw+QvdNcczsLFq=t2%HE0tV87#d2
ze^PB^WU#2ImI$y6{QuwLF#{vGj(G_ln-l?^yHNAnW8Iur;Iiz4{sac*IzuTDu-$?T
z44^eEATiLo7KeHNSInNszyOLf(Aqj!oP{lC+u;5G(?$;l29vO@Y#TuBiKJBw3ZOih
zw2DE|l7WE(qzAOFs?Ke41t@>ibuI>_pM#BZ4IH3yyYAHHirTQ?3efmPt%k?CLUjgq
zho=7@JQ$cZ=yx&X)XL5X0HrgBeGE3Co@{p7ozOL9;S3z0HXf+YI0KY+y}Us43j&Sd
z3@nyf3@j7P8CV*%z~N*8s?$kH^PoI6krSksNe7g-K>5dmfk`20D+3c~E^D?i0|T_I
z0gWpO%rs_Tv?>P4G5!ImwYv8IzXt>32a5-w@i6e(Dp1|+(^(Eq`w^kpY<8hp?Ekd8
z8Q5yQgG4~?n;FgkYU9Z?nlo@%oMK=C%{L>Jr4o&xvR;#cJyesy!qSt0V`4Z1OT$VA
zhK7@%vt1YqKw$-{J3wY@cSFMnRBw1QFotFeSb@y1&5VMCQ8@#Pr8YE-v>6zRRxvQu
zs(Dw`s{Si*Xkt|HU|^I9^<?`5GE2XcA<AJNg9RyOHk<~99m5U%E`}0NypgK6=IFly
z4+e%g`dtheVJq49fcynF0~GJ4A$|gfPZpA&yct+P;R2d#0rjnG-Plb)W;x7b2nclp
ztvzROA<vxPidxry1rGBVKy4;)J^-cTx>caE@Z(odI<~q7%17U4fYOU)B11z>?Ti2q
z#um_76c<2k7|`4v=u9wBKMFK1I8%{<(^8SaV!}cO3DA8A6BQYFEEO39K;x|w4l>A0
zc*vkIk&!`Vq9cROL`6_L;~S_gX#$$JhRw;t#>potg4aqiqM7Y5p^-rbbhazhYzfd<
z`h<lH3KI@8s7!dspfQn=L1&^Pg9+IDzqi(c=0?5$-h674z`&T0+_u2`|J#|M_B6PC
zxPSpPU&-LXkmT9G$Y5ik$Y23;M@@?6HSfQV3_xRW-hc0(U|<#ko%gf><Zn>hwlSGO
zrqP)}VDCc)9%vgb#9D!Y5!{Ar2?%IpW?*Q3&0x^j%)kO_zk%l2EV%ytZ+gw3VX@->
z|EALnCZK*((`p7CP`TCU&0t~K^Z$3lX$Bj8c?O2&YzCj&)+CW;Z-#)HP9>4%ZibK=
zP9~A&)eI5VV*mfw&EF+bEAzmhR`!JfxG%i-|9|Z^20q8R3>uxR42%{_8JIerGBDH%
z8yHx!F>utpa4@hq#vo8D>?8tOqgm_mz#^1Gz^dlA!@9a^Cy`EJ21fmM28Kn&3{16N
zF5tD8pfYb(CIh1f1Jjp+7YqW9i<ngkJ~8muWz4Q{Y+|seZ<_#`Ymk82$5_i@0J4Jv
z)DEuKm|#$I$shpKCaCpru&DK#VgRxm=Ejbv5I1(EGBDJ9GBB`s#=udRZUNFSQ1i)3
zq}Izyq}Kg~MaXjjtGX&Hk(yr?>$-v&7$NSP0yewg6Ua?W3E;Z$l5s_Sn+3={7G0_g
zj8<+89QBhd9O?`W3~B>|L_p^`gX$g7TAVIb1}0GW)EP}MsP&p8V&%plP_G8E`~Ux1
zHv@}WFB^k8wOJxH$0r2TJn;yqpJ?IWFqbi)=6OdzeftUrhrJ9upmi#sbGYk;4_7$M
zVlb$0cW|gn-w{w(F-rtAj|r-`L1TTjM&1>D!VHY_gcul|82<n8U|`r#KOgMQhC22I
z0X6?E0>FADnm}%psS|Dn)hWz1FRZ75+NvOPJQx^SKs3y}-VY3nb3Z}MtDo=SP^)Pr
z;;`rcnfjN^%WCBv0<01k80x}itgCrBO9WJQ&vFN={ZOm<OQf#QBLH-!6WGr59}xHM
z`9A^Kd}Q~6%m&S4X?K9@Yn6`A42+f>|Nny88Xcd(Z4RcM&kW3SUNSI)`V~4I3=FmE
z-W85*j3%HoH4`*OFpptNr!WJPr6vQ@Om=XcA^~zop*nb6K>}*#e~?>2{n8mP85p!D
zGB8<r{{J7!{-e%eE`tfkeOAT)|JMahuBa=RU9r@FfoZED0~07rL!NWkfWoTQ$V#NH
z*a}o1m}pOAU|gsPZfEm^8oKBOX)@@6%mC?!>iZM&lEVgMU#*dsNTCn|qhk|81I*1J
zanKp+1)o6Y*)d4et6LaYJpcc{=6Qfc&GT6z-v9q*G|DxwOk`$|uw-D6p2!WZ9|8(q
zfYqy@s|Tm!YAcbN-xlk<|Nog{$-ux}@QFdeVbOok9y3rMYe#)+0x13R)ORvCIL`TF
z5_0^-zgl*UfRN`B7B$Ze0ziBIYK}qDY0aqs3yTvBj1vwsFw}A+1X!G8V64?-0F5oP
zT52+a#Caw%gV#n2O!Q{3nDCmx#xjv1z=N^gfPtA8bl(?zybn}%gW8sR55m`bOtDU6
z&;XTXpt8$?fk6N?|6A*M8??6<9Ojm)42;%G{{I7=%TvGlb%g~Z1Ba6XgThj62BuI=
z4x3s9FOh|w3<{vO=SEKk1<)LmWdZ|#qdEfvXq{JR7Kcr3bdVlsEW`mccar`8zZ1j%
zHy#WuCiR^Wpm|FU(3*45`Y_7_4E&%m=h~CZ%N+JG1c25;SS(<00F|HMwf1fd3?TQ<
zSjoTuN^cuIA?qb9IvH3dv@tLsi-XqGdoVEX0lCY`fk7tJfy1Uonn_Q;0W>b~|4n^o
z0BA0kqt-LH!b*XG--3aGu}+hD8R*Q*5P1%p@CJzb8ipT%jt$HWpfxy74F6v^g68d-
zL2K^+|970nT%+C1!00fKxdb!@0qVnVU}WI3U|`?_g(IjRU;pEGMSb)mktOmBOpBu!
zn5^e8Fx5ygiENMur|B1<vI?XQI%j0CM3#XG;zkCU5C#sL`X5Ys7W)|(!~b*G)a+o^
ztMB-&2Xc$||NmD&b3NdGXES(Dkc!oU|Nooq8bq4o8bEu{G(hWeYNebjtQIf`gUUnD
zns%!Nj10|j4FcAdfB#uW{rzXzz`&^8%)nUN<6+R;#=v0p29lSwdsx>y&Skh`$?^YR
zt+96n=-f%LA0IF<SRDY>6%0Q>V=<2N7<;T#|NpO3V6doR&=Ls^<glr;=n`45kwF2p
z{xD=IiycVahK-={3C4{2E)P(g@2L^lVNpNj1!(QS2GD#osC@#uzo}+_KtO$0ghTz(
zh=8yl0jv7`F9O0pa@bh!WniqIGfAZGvW7vOb(cu}O6Fyba~Tal>Bey$qlS|MgGk6;
z4x9Rouk`9-X9PMfWK;n8tM0CbLCt3EirSu6p!EnMAb)|%bx?eJFfi_Ea${f!n=4>d
zv+3o!hGn3!=~p5%RT&sT?E0mzL~52k2&h>qR<L0&15@4H#TCmm7?|qh0|LTC*z7DH
zfY#`*0IdU8ahS^>5oX9?Q?s*6ug<DVFJwKN9caA<Xf40x1BQgU3k?Q!mu48qUikl~
zhV_p@&C*FCb)L-2YELjPtJ$Ct09qRfnn$ZW!L)4VQwD}vtqhEtR2i6RmKKTBo@829
zd!Zl@oG+UGKd@N!|9{<44TGAE43>_I{?&vm{ZZ%r|Nj?I{CNNW*8mDXP#<)m2dFL1
zVN>f8qz78x4jKywg`4;Pe^)^1E-aYC26Qe+s4APCMFRt94;6!T0s|v7{S|=X#c>{k
zLJijri~25bT#10vNX-`Qidt>&3ebFd4c8w7P<y{tCP<`aPT;y(9Sn??paq{93{3S|
z0S2`m44^e_JfU6?H-gFm&=`p&*Z=>u44^a<1R6t|(CEg%5ZWVPRoj&$GO>+;VWK)H
zkAcft2@3{Lp9DPS!Qim(_Z9E|zh8jIZ<(1ZJQ%B7VE6EV=4wG>wxB(Hj!g_x8kHGj
ztRMXU2Wn3{&I9**!FwSldV<6m7$!VsFahoJn&`|RlJLBNVWKkw$3$la3DCZ{iJlBB
zpgk`WJsA`xdNOEC^kmSP=*eI((UZYqq9=omr6;Sw1jxRa9MHOziJlBTpuH_nyJRd9
zz-!zXK;@=i0}JTPI1Z3oKx40<IZY47$_ot4?4UL_d`*N7E9yA~uyWb4iIJgG6+8}T
z=rE7ri+&q}jl(>KH=z6vnxk=?$M6DFwuAN$PE=-)XjEnZjRAqyl?pV*HONd<X3&`E
z%m6xr95hY@66XQ!&jal@YP4ri0IeTwsAtfySfFYEb8k%wc<z4&XzqN%d<GeZJq#is
zJL>l`T$rc=9*dQ!U#V80KbJutREL7Z9Op7{gzsgyv$XyHL%WlK-C-|-3h1mkP#+p(
zKFn;8IiP({9-zD38NvIX7$z@aPyvO@L=^@TP}>}|2M)6T?VpN8!v9~Oc?*k#|NkI!
z+W-GR##$>{VB^rBv1g>U3?0q;8Dv1}LGE{)$4~=u2Q+R98f_U&plr~&N(N9icpVU^
zzW{S5NDs{I4RaYxu!_%Tkb#NA`~`}8s5}2b+*y7{yOn`4B&)?PB$LGs)UWJF0gYKn
ziD-BJ{{Wirwgru=X)^HFdIpJTcR|Ix{{Of1V&D(;YLKgS_O1ZUAA{xtK<nN>YYMbm
z8Tdiv4yZ2$T4!W+fPo?D+W(KB^P)ic8#Im!tyd&!o;ZN#V?ph_S}!k9o_m9CH%NUV
z$N!HtS<cgHk{z$rItK)VIycDGDocay?s~!iT4OHIwdDWDZkGR_>R#>==~nswxo-O^
zk#3j&U+P5<iFBv@|62ETmq@+EDUt4$|KIAx4~f)AUJ~hE^8Y(XtiI}&NcWTfKR{yj
zvmc3cw*3DI606_yN~DA3|1XeO{oh|Aohko+gT!j*Cy8_%`TqwbR>Q+2((&Z~UyxXB
zLX=1+%m05Mv6|CHBAqJ#|AWM8o>_^2_@H%#AU1fOl-)@LG+qtr4>>XXx2fgaJgt^v
z<2BH{SuGco?GX^5-731?VJ?G+B?Du$#nM*+pf!Y`^?RWDtEOGK!f_s>PRNRfcA$A}
zkerhP!<kMNNSJgS`Twy4wDwxV3*@d(H7AWkYBh~SK=E0t<^&S^3<~#JO)&cl68kF>
z`x_GbI}-Z`68k3-`xg@XHxl~~68kR_`yY%Ap`}DXH0b=fkQEGOAxqiqK<Ng&Z)zp;
zGEjPOa$u0CISxxZMlkhnKyu);^3r))&2z_Vwdx)LHLskf)v`NYtMv#70HxVo3mJGo
z=@!)A2BlpFW@gZR$MAU((ERh>gA5k+kh5-DK;_-UMh26b9O+6>d(^Q>Y(n!JXg;0~
zYPX5?G`?YAXv$$=(eDS3NAc)S2Ce@V1D&}GI*)}L)R(nXVBnc(&%j`5&rs0Z!yqtG
zkwL;To*~52o*`mFBZES-4g-%K3j=HOeg=!$zT}Fg{|q+uvmRGWbYzeL^*JUgGN^#&
zuB{Uoq(O5nR`Xd6tl}ARtn8USSRG{GX!y^-pxw?O<2YCJL!(@S3aHIr^TI+8l;%L`
z!moivK~bDRRC_vuXeh^vf1vc@u$S`ys2%IUz_~+FoIzcCI)gewj@<wv$F89$&LFNm
zok1KS$2b8Z$Jo*EpMe9^cL&wUnCc+o44^SSO9s%ITedCw6F^}mEMobdfwANK|NmA3
z|Nqw<+hJh!oq?l%uaO97jNPH>|DA%D;JGlL{8j(|>vwg_JIrHn0F{HFvJX_2dH+8*
z(^7#!9&~3KXx%?(tj1yi1Cyn~|8CG&koW&{pnKIMAZ>1j4UO^)3X}FT2!Q5vKx48N
z2mb$`aDu_0;3Wg7@1+vH{E%Jv3Ku=lUQ&w(4DvNEtf$F5XOOS&umFuog8JMV9t=VT
z;Vanfv^&7-@|T3~eQ4M4pFssAX34?8QQraTt1}2#egFTbQLe$jgFy(iFB7!SnxR(1
z!2sm`iSi7fIdul_|G!!-6&N@{?k`@&#4sU`!2~qVZK=S(4N50g55Rji7`*@g(}0AT
z-~(`&y@!U`b6A*J!NV+k1)JSuh#xsXer%L$(D7gptSMgk0CfI2$PXqS41%C@=fHI_
zNKN>P<NrWovmiG(E@Dt=sArG>h3D*r;ITQT@V$rZW-nym^!|TV6XaIVm>bA#AUA^6
zCt#)<1|3M+U{Ha&TZ53hLG?YfzT=p@k^ywTm_Q-u?BPWWCLs5OuLQe+1LQ7H+*&MP
zU<qH@Vi&&G&2FY51J~?@4BX!T&vZiF$BgDaw6u%vK7kGr+$RDG<B6OM9N{Yt*-hkR
z0Nq6eb1R;(JN*{wHWp;JHT-7~D0s#Kikl8Bc?T^V`62O-C(nSwaq@l!2c)nRDR{}m
z;JApv1{98<@WYJP(}5tjf%;;gJOa%hA`?!4*9P!_+zX0lO9lp3(7x10c?N+(F0h-o
zH2i09sN-m^sGk5%_Z&4ZtSg}Udm8pLD1hoH$9W7c4XF$QpmrhXzKn*W3?dD!3=*I@
zkDB8K0W~j-L~4?aMC#iWKz%Tdnq>+BwNI)mKx3)ifBqkBWMt3*hZDpf3Lt-g^upEr
zKQ$4g2IL2bdl~|2--GH_i-3vp3=WO*3=SYSIn3i*V9CJ1HfcYD1Kc0%9H6jY07<8O
z4RxH5`UT{6Q2AK%-bth*{r`WcKXe*e8Dv0h9Z*@<aG$}UVJU+`eVYbo+(f`)83W^l
z{R|E@DTeEGLFa?@F>p9B{NK@VpFyDD6gUnvklj83I$rGk|Kvru`yVoB)NwQf)V#N@
za9ju4Z^HWqDNZ;hykL;AWME)N^@9MCA9(i=;Rh8oKWGr;hm&~yz>CKZ8fbn{0nKB9
z;s6}4ub4pYPa&NCc?hQeh4Kti^>ZCS{dZ7VXW_xX(*R4qNNx}bdA|SOgcl5;IcvrV
zFBl9!^$DnK2GuRz|4%rA(h{gV291+}-0A)Q#}Y^y;fWzsR)nu~vkPBwfDhER3txFe
z57gER-|Hk-zw#BRufjEXKZ69wO_SF#n1J#Xs2pvSXW#*+(R~amll8!RNSG$~F$he2
z$G|X&kAY?Keg=z4{~2sN82A)W-TK85<VKi#L2h-N#J!_Yo`D5y-aH0SozJB`oq-Ec
zcSFXmKx>M_Ua;4NeP^(!-|GUZ>m|JZ{}+Myle>hVKUc8-3*Y;rZlXK`OZW=*eV{Q~
zP+r&WU|@Ef$Kave0UrP1v1DKX-N$FpDA!;!QJ%ral7WG9qC7)Lqg(?h9|l0nl?Y1)
z1|d-Y#FBx5ALI{E->Olr!DS*JgT&-|28QsxANE;&|Nqzf|91&wcZ1q2isH!a7WDF+
zYXxDywAh6&XR*r!-S^lIPd^?W3|tPD3JiP`{xdj$;t3RQpg04SGvGGQzP}IZ=U6z@
zcRU8I4+fWi^&Ji1atu^1g5tn&9+yVF^63gtc?BxBAm!Sxx1jt2G6$63LFH9_$Af@+
zOGLTl{r{T*BrZ5#5On`?wtwL(?)|fP&d3<PY`dLyJEI(^{IWR4z%t=KL&8LPhLrHV
zllM)y&k$qv{r@NMo|g^=IZz+3QLe$qgMkwi{sNQsGh~3mzTrMYOv8VMjQVy1P}x?a
zD9(VAh8*WIB!Jp!j!g{Ewh5;T*p2I<ZIh+2wuu&~Pj|zToq;jrIR_~IGeB|JDAy2B
z%VDJ#zMQ=-d@r~yY7xr8VN>(pS<n0b{|-?50W?nl8V6~VXUNd*U=RY$ErG_ILFy*l
zX8@gL6Hv?Mq-V*&fUNflxO|+?kON9%pu93^K7)_N0tVrRMg|GcoO#1T2AMjI?h5b!
zFKcTmz~c#^vLeKTfg{9{fkAMxJTwgUGbDh<;~MH2QfgAAL?GcI;ovZb@k_&eh7ijD
z$ljbrdj_8x76k)~mjD0jmnm3;922kt^|LzJ7#J5EV_>T9fb4^Da^O$^g;6IzB#de~
zU}5A03ZoO+Z4CU5a~T5ar-S!{LBo~(4M<N%KSWPW3rvp^NY4#WzO8$)BLEb>7S9<h
zU}0Qy-x?H-0orX00u~+MeWD5V(-lB*2{U&J*jy}a3DEv2P}+u>4O+8f$<AONzKnez
zDC{kcF)-K6chZCAN6^^E9PKs+L5mIsc87foITjrZ%xHE&+J89g0@<U;@&9l5GDung
zneV~C-~dVcY!Lrr(F?M}anAocQ2jr{m$B7_?>+g?;ur&W-FGJuP<amOYuC3+fYzc3
zfcDANoMc`GS_|7K*AM|KS3rBYoE-kCfYO=83())$Bt1>|&yZ0wADkYaG|GebhDbZ^
z`!okseoaE8FGf)M0;elb`qJpG0HrVQ|IZbX(pHQI1M81Qd4?R&`Ew2P84|$i_cNqS
zlxF~ye{2)w86qrN7%UndGN^>KaM;w$R}z7w(PuZ2%t`QIVBG*JCqa3%k&nRuQoexi
zfdK7YWq|hc6tyQXu!8co_8dmgI(C(Y`wXD8&1h-Bz}PUK!3Q)pRLcgMF9nZbCV=Xk
z+QY>apgO1C<#Gjjz2p7=VQaG<15a}wgFxdu28Jd+1{P3171T%d{{OMV$$=G||FNa*
z`V|I{x!xsCBDE|I>p*j_3sM=F>f3iXIL`fl0_2C9r`8oU3DOmg^B5`$xfnh;G%*x_
z+zRfyYBDc_%sqkTkpKS&nODnUV^GV%Bm$m8PJx=cn1OLYG6Pesx|T?NCoIpgtO2ES
zZ0_>@|9?mQUK@kD=Q{#GZm8d@V^H^W2k87G2hcuSO9lpU@Bcqo3b{b@WZ!=ja)Q^G
zgUSjH4+a*EP!4vxiSi5{mJAHSp!jI`&)@;dH;(fdLh7f3=UAb6jRl<kak$|IsH_9E
zC2Kh>z-|G}S=X;{umHKOmd!~7)P}WWU;xn!4f`1)VC4>2-+YFET2>7M(40p73Jpj&
zAAyF)GX};5X^?ORoj2n!mqEqJfq4#|@HkM&$?yRb58&_*U|_6S?gZY03tIDC^AurE
zEr$ta_&<h*znT?N_%rL^v2REHUK4}5XFCEweg(w?QW&#%Ffbhfh4F-X1{Y{Ji{cMw
zrUQ8Ff`zjSo^W<)ln3`UTxzA9L~3Omz;olEd<30u2d$Y91GxcwzQ8=DfJS)+mzqBp
z0zmNx?faWF>}N0l&6PL&XD|Wp&78}?Q_JcQ(6FCDqrStyp=O0fK+SV45r?_p{uM{f
zixUAgCyXoVJ05`B4WPCJC?D6HFbJ4%pTPmtF0eSjz);I>u&!3pa2==|b7J`a1=O#p
zw=@y~rCo=8?^r<Pg7^QgArQAQZUM=I*JfBUFwT_x{~sg|a=Z8cw>KK)88|@t9Op5-
z0kxe#Z78JnAzHtaF#{B?9eBna8u=JRYW7?R0QHk<IkZG3@-cw!tCj(?<r!o^^FE+{
zV@>Oc08k$YYB!Jf|2?2{V>rD3zXXrffZE)kJ^^U`Jt!|Z%wtdpUj}PW8;OK3JE8~b
zFNUvhk^_|u4gVP=pyM+VjdBes;PEnOd(r#<n-3s9tj%Vrz#s`~!y);-0^}yBTXG18
z149DAaFAz^sh{fr8ZQ!QlxxU<)iK`x-=x6Z!N4E|iU-g<oHfIL(A^{))(i}cjrI&0
zpmG>g27~(V=w-0OJO<EN>Yz2g;-ERk`dJSgKy!@E>%iy1!R8Kh8f_UsYkL_S<}pMx
z$})h?S_GZ@WH8Z|L8sQs!C+!6gN6qKgH2;Bg9>PlrBRPT!D0aeV?!Q;Momiqe69u5
zU!PFRVB#?E{{~A11{qM;c`z`}0o4Hwdl@tu`WSfX=UfPAsAVvzpQ8aj8vwMQ&HK*>
zLGYY|ErWpv1A|XvEQ3M)%*PeAS{ecMbHMYg9JQ9-6*bAAxjBV^dezev-hbZTt*?9#
z=(q@KZtCp{khwLp6#~5fygxX(mcanzFOVNVYa<(N84Ma@88m7wLFbJHI83x<FaVt&
z2vw&8o=2a<z*BGOB{JETL8noVfu&&`gFs#8jDSWx29A2y3jwv7vqUE9F>o~MF^JS^
zUIMW}=g-T4+4c;eyA(J;@c>%Cu0IPjX31dEXwM)3Iy(g9cW^rHWMHV7r4RrbNAv!_
z3v}lUhxh+yYhnGd#&`x$zI14`XRrayF@olkL1WaQ^SeO(!%R;G?pjR-lTgi@b)lLT
z2B5y;L_G$bde7OQvr$AE9T^nrnGaX!cQLSl_Hlsr(}4J(v|y3&|2L?Q1e#9*^_wgb
z{{LxgWH14(m8)%RRPbPoJpft<R@1Fq0h*5jtx;%HW?%vBR|oBJ1kLY*`ZA7l7!+z&
zC{F{mwL$!vql(u+=WW!gdkECBISPQv9#HuYazE(a5{G#V7LfUE1_SW933C}FYO^Cm
zYP|wQYMxt&)EqMewN0<ocLadaAP;Cgh2z}+59+%dK<zM<`Ys2Ec((_LFH)=RAyCWZ
zC{VxGLZp6<p-8C94~EdxA9bM)Kk90_wJSo7{9p)q`lGIfi@BnvUArRWz>m5bR_n?d
zHs%V4rvGauH#0CyUd+G(+Q$n!GZZwgU&FxO<HNwH17ce&V34m#)~EpQZEMjI32C`m
z@7u(nP}9l0tR_vmqJ}{t$0C_Q0koc{hJj@bSe(Ipjm0s97*S@SnM2TS28lJu_7YYv
zjj6stfC1!Qn*|IE4XF&E^NZmA0GoG!fx+eh14F`dCWe}q%*$#RjC+v%1yTdTHO$Q5
z`83!*;K>gez~`h+Xk-AbbJX$vD=!Et6F_+z)R%JD2ifZjDmyGd=YBk3VD$bg4?edN
zqz;tUI~Bou?lnMh<G~nR!oc(jG}nTB4x+;TgA5VSxt0{rTnlK9rPhGCt=5pKtyIeZ
zG<M0;P}cyu51FH(4s_n^hP{w;l5HC;6&N1Y>M^&~>NB;0+!U%QzptULfdkZru2u28
zX4AmHpU~puP}8YA&HL|$wU!DD9U!x7CNi~w&M*pTd0yxJcf(Z3S$I(wrYQag?>7SP
zHTv^xCIiz;l>JxQ%?ysPy;q<)eVBVe_w0i9ZfZ9(fZC2GH3>p(pfXmwnZXIV7RDKL
zE^|#XSX`wh5lqX}B!OuW(0MYDGh{Y!g8HnW`FIb;C<g|n7gwez{yzX)_i3rXptujQ
z$JPaAKgdtDflO_d3JfA(wjom+XdOhU2WWhgF$A1<=P>$&YBDg{Iy5kV&N+10$7lmC
z0}>b*tQ{B_z-L4;Fff4XDbSoPc#f%ofdRCh4^%EB&-uZST>YORIqH8yvgQ8+$r67U
zlD_|ANV;}_A!+LahNLMU7?O$`7{XTySXpW^IKbRdsKvnOxQOA1MJ;IW&%do9DJ(|y
zEe}9-<Q(mmAD}hbCiN{Fp!@?2pfbk#zW_sh%M4JQ`_#9r0LfKY|7T*TZ&?5mv#4*m
z0TT1kZut+=FHzre0K|8({?Fi0-?9UwMx?$4e5R2?eai{Z-a`(@eGCquGjl-U;{A8s
zLeM<F^?z_1OvCy=1L*7w1?&F|4WMyw>;H@(GX$*vvw&z0>;D{}{rb$H^*#>s{wr7}
zGB|`kULfYd7*W8$^xR;I;y>gxU9k5cBlI2-MwB#dtI)uZsL5baYsd_Wt13_!)m>z2
z1Jwy(*S^_JI>;yh3jc|Wj69&Y0f#*UWF82#zX%j3pt!PfU?{OtWZ<X^U~a1~WNHh~
zWYCzX$Oz`wYF@4Yncpz4L84B%yTW1tBWP_DgZG~om0_m@tSr449BKoY+d%21&;uMd
zJ1ojTar0NwR)PP2NWFkSqUQhq_4C2y^Bn601_mqn|9>q1Gsx7&-w3FaY_6!i7$j25
zcS@v@gMnqLBm)a*e9MEu#j}29g@ePq|1Usgs3ik~14wPlPX?Bnz7u*NHTCTZ437Ii
z_rAHvHaap2SW7T4*3SrVaGb+1!-IjLWFjM@hzElUBgmXaMn(~bdH;`q%mR%yIW+y>
zqCcDAfps-#Kg9nE{b>x$pf%zS^Zx5-&jIgY@&K)?0F^uS!IvvQab@*@fw6w>0te8%
zsl!|bi@MU;6_XtqdFr>k2AxTw0ck5UNN7(7>j&-ARRD!MxNX+Jzz9nB`m@;oTStM`
z)BT&$$jHc3Yw9FYtI1dB*uWs7-^u>pVJ?G!r2_kZP#p{^8!a6eN<iV;$jHc1tLY4m
z3rhtCa9o4RG)o1B0#Lkz*dTQv+ERg`0w!je2)h3%jD>;e3Fv$`_}NgPy(UDLKMlg5
z^2Y<C{AmV@8`Ly{X^omDFs%SOzo}Nm8+10Bz;48OZUWwaSA)*h5b$6O-NL~11awYA
z0HQ2nVgSvR?_*>rfR^7|K;_ZIMur@48Lr3NW((S<<<Hy(Dx*PRQ>)M1W|P3cX3@Y<
zpO7ro;Qd$ZCup3;B7q^m`~S~QP<s@#b_mL^gs%1Cfz&7BKA^MHKyl*zchy7h|Gz>#
z7#K7_XQF}3@cz5%Ea(h0@4u^#g3dnk{<~_g_y1ppp!H?eptB@EcP%rR`@-ss`h2D~
z(3vaEjtmlxn;6%C?6hbA&2#=_45??g3&~_K)1D7HL*Y4SZH$1dCPRw#O9pRHn^t>1
z0}tqY4yc$DXe?cOJ_Bf;AEr(bG_IsQpMeWWog}EeChN(NB5TjURsYIMBs@)ipG|{D
zS<SJFpfm5p6Ixz?&rJ4U^#5zA!oUUE!wt%ZpfyVkbqyXe^BK5gjxlh7=PCZKyxUOM
z;N$&w<yG(hKRq2cF}$#7U|<FL!~6daTZ;w;CPY~N&<%gWZl~W2p10-!oy`JDub}f>
zv|AWh96;^)x`qI#xvdR#4Ivf{pnGdpRzkvZWuf=~A5TGMTQq?7WPZP^-ORx1IF|u*
z2Vq1=vVc{sr-WXumX`=<Y{{>IMWLatA;$afO3Q}2h6GUfK>3;tbqyKNcmv5xHq<rb
zfXZB`JZD2)18A=bsIHIk{=4F5LtR4(Bz{-C_5S}O(b9oI5u9%Xnc6_KtpfLdP<d6$
z>0yzo*}?!S`z#e06hQf@{v%VHt-=9*TL%W_L{0wx_5VFA8kHDW(*LtCg=#X-gVciz
z0?GdmFgR`!O#$Wm<o^l`;B|`)4BR09djJ3S5ky-wFbI18|MpbBnSlj#=1%&5@ESGH
zIqL!5|G%BJXkY-X)dH~(S~M_-g3de#>GS^oZ6oxoK92PN3<BD-A@d>y8Q}E|9O?f#
zKx21oP_?ZV4Gio^dP_r+9rS9NZ;5EPFlac=W3U0$kJ>Gub*l`Z{uM|ZG~cD5-NNAE
zI1hY2TZ#AI<p&$;K<BM5-|4|1(v$w55ws2g8YbYnM-3J};s4o795*r4Akxk^MsV7x
zmIj>_7U2E=E9g8wj__o5P(IKA<;CQe42qyV*`Pj2`hSK7P~QP0X6pd1H%mZg6@kX5
zK<hrVn;Dou@}T~Q!#;+H^#4o^whpWeAoZZV<Dj|^)aC)r7bU-BU_?@@16nH!S~~->
z1C)0_W<mH&4ajOO85q=R1wd^^u-}wGeya@xvz0+?aM=T@a~&8|KxwAtBXgUj1A{7v
z4N5Qd;IhHk5V>q<RAi6{ua@6eU+sC#aT7xaD1Iy&KxdzQc^Hz+RtHW0K8<z_H6dA`
z^dEqd{w)&tLFGb-MS@%lsLZfPr~=Jzxq$qdko-jjlqVqjf?jxl!l|LIp#hT4mx1n9
z(D44d^so2-uZ5sAX^~(H?puQNg3gZs`3aP^L3FM1&1*IXtY_6S-w*@k--KhQ7{dQE
z*MZ9OT4v`84@U2eAuSCOH7&m@Y9=zbLHuguitN|$O!<Ayi3}3;nK!RFPGV|-`c=sL
z|L3ou_6DdN0ri2Q;+)_%?JNe+x|RTo1_p7*dEhxq5L?pw|L21tS?qS&T@0L{I#;`k
zffv;F4at0N7w#os1u8Qw85trhHNj=6K|@_b3&h_`dA<LC0p0Va08%UK#lQtp8}1=s
z1v=l}(vcyeRwGbPe-;B1q(1&%pgos?G5i(Vx9}J277p_m1&UvS$7nU04l+dOPXqVa
zWwfU;aDmRausXoNWt9LvPY!e@t^lZQ1rh_L4RHH-9)n4!mVi}lOpr*U7efG4OhLPg
zfveUn7<^8K#Q_E`(7IC4UMo<U1sWd!wVOfWpfUlpHU>JLWDu$$U{x#QB+}Hu5THK=
z>Xs=`w=_V^v0?zPSqJT*X0QUay&J%1fpCEAD1ODj;@HHfq1_3ZPi0g9?aQpS@e*nF
zWC#Goh2uO%9_?8W^Q;{hxU3Wy7(wGmR^T(k7+w^=WKaOj&owP%h|r%3wSOu^JxC2m
zJ#=l90BAipNDL_~3}9i=bc!JWTUdhJ2ntVFIKaXaEgULf?rsFRy9?}&6!b6!g(oO1
zK<@WoU<d)Z4P-X5ILLjV_yUEsRRaST*v}8Z;b#C+4{GCq)PT+*1H}o<JT&#7a<BuG
zZ$SA6RQFmceC)SKV1U=XpgO{X(W4gBCbV(^*WX*TXMo#>CLr}FYTYhZcrbbdTC^~5
z)z4M{jb{iX|7TFJc3=<z?XA|HfL$MG-?s;&ha{T51ZxKdNe>3b4DFeq_9lZw{p<-a
zGYzaA800{AlQz^fbXYqu7<vC)2&(^ky#Fq|+ECXp!TayRv)=zdI(jfLYJm0c!=|5M
z54s=fj%}{+V07=*p3J~#%>wqXME&doFnb-W9l+y-Eg1Titp@1}1?_dR289#oY_-`J
zK>B!+|AWs+1hv;Xy#FpVZK!LQ;{A7_ZbMze4DY`SRU7IW=77!!t4p0-QK!~j;r(}^
zU_)KQ0?_$pb*_^u>e&v1&ldLnyWpqy{|~t!|2l5s(SepfD&GI!$A(mVv#Y7NAqFb@
zYG&NL1}pnK7~Kwn>iC-J$`zoq%SyFC^(^-s?U|r@oBM{t9_}N_|5=dI0l1!Mgrx}(
zZIi&l5dNR>i1$B}*!suP6*YxmH4Pv+P`Uxppt3mpKf^xne<rR-YQX(oP(A|HE0zun
zF0eYr(t*JPiR}YpJ4|A5fRxEP8<ET8=7$Ut4wD!?KxrAAwn2Mb7C`#rp#C{%PY~$-
zQBXS#6fWNX-+6-S@R~AMz5UJ-T#who`I_M`5p6)Lm*Bj^5o*q62htB|-@IeBPGDsK
zwQ)e>si3}}wb=h3R=XJ)!X?=3tY$MYSXDDKSVgmd#tWFNA22Y63kq0i&tPD2oXY^Z
zqjyQIX9r3>SpWYvsITQw|9>@zcBucq7(`pt|DO$_4eI|-2GO8){0c}tFdtO^tpTl7
z^Zq;UC#3y3@1ytscd4Ls4XSHE<%0MB|2<aUA?F#^f%oA5+Y{=E7<;G()$v}SJ;eV(
z?P6JwAHDy-RkdhfkO?XN2KKY}|F@zR4GhvDrEos0MFWFeNEwX(=Bq^mgJw-REDYZ~
z&ECVnSW_WgVbQ>#1v0aK4ugsJ|2JpD=iICVoe^!Rz|aaxAE5rVtwKEmsND&=o4(PB
zfu$65DRL77N2+E61E_6b>A=uh|NG}PP+CaUWKc-d6o9o~+rVZRGPTtd|A3_N$v=_O
zxbt0G2kTjhUZ)sprYKj`YDr$JnXOz=lcfM|1JraWUIX2;QIjbp0=l2Lem?lTMh@!|
z21f1K3@mmHkn@ik?HV?OR|{Cxb>7f}_MtUw6}Vrg&0%6l)I9h<d5#eSsQ=+Om*GR&
z97cxZIZB}MkSC6tI5$`{FsOk1@BRPvMT-Uo)sSjfn7szIf7L>Y;QWmtHQ(%Ns-gav
zjp7eca9*9DTv0PoxuPamxB`-2IXtu{GO#AiPGE4@%TZ8M1l2nUS+CR0Mq>sRkpDq?
zOEp0GoTCP`cQd_&iNRqX$C8>FsJ=NU`WAxqO;WA^g&EYo8QQZMn3Co&F*xq!I8ajx
z)i)JIUnbbClOg(QLWC<ob~-dMn1JE}RQ`bCqi)%1NPJ`|h=Jk(5(iGY@Hi+2#{qNt
z90mbUTQ+$P12d>EmJHg1R|d6r8nV5P9~(^=SZbz1>;<_O!_H%yvDoRj6K-cI*iN?O
zPKE-|8NZEo4Ld;bUh8=SC9fuTg8LK_$(;-ip!RlhC%7EvNbY1vuykMm_qV|1ngT;R
zD1FvXWNND^{~>0p@Zdqs^q=5%XrktW1E8<~wL|OYcvyHaIvRrAKMm@B4F)C*_dnZ>
z#r+OH;qEU3<vD2B%s_-qc=>^I$#ZxaJQy9$qS&E@X$PoI0p}BxcyXADVn-#^j+qEM
z>gVjP2(NCs=fUWZ35sV>9M{jj4RJ5%9C(m<bCfGUaSif!z1rytNSr%Z!p)umZg+yi
zEPM{zzWSQS74;LreUMI2-miuBWi1tc?*R2<6G7vrhRkiC_AThFE=d28aR=xgVM_&u
z08rT5Dm3nZ#zi2MKOs?*1yX)EFa&|jwRLE01owj+7=j`E{|$*=j7d<j5Re$uj8KRf
zZ5&{}149^+TsTCo5j1w01d<2s<<XwSpke(0eAc#s_ACY?>jw;=c`z02SqyU44;T!f
zebGIj^(2rn*O|KB|6eRbxPL2n9MmF#`GxoYHK4J4us`e@ngqaMqreaZwU-HGr=<cz
zFqF>><%fXy_6r&rllL+>)NcgW(O`e1zkI@wsL2Y}2Q?pbc5E0(J=AQdpL#mLW;rlK
z!2RpM5Q)T&g0mGEqCxu8|2Hxu|7T$W*DneTF(5Hpg+|6iP38k&vlJL&L1G~Hfbvj7
zUBdzIzcUQI|36=9k-#{?`~T{x4wD#Kz-<IAVbC}*N3DTyTdk{5o2^3q|3poOdQg1<
zsv{CLWg2Q#h1+VqVRFp>k>nU^wT0Vi^@Z9}H8~h+^@TxwTC}l|V5G4T1z6euwM~6M
zZ3RgA{Y((tPN;#^anBgT=OEe%pnbid@+o`{yqzHL{r~A*&^VlSGXn>xZwMN1N#6S(
zGzNdfaW8`dsGkm!w^ZO@NZtz`n_r{d3^~uxQbB+rd2a(q?F@(-7KY@#4;VmweNfw9
zyO}`&BF@l|y!Q`CU4i3X1_`K`L-O8#Ahn>eS`E;A3q+ieA$c$O-UJsAU%Q#1!BT;V
zA$jiy2FHC2pg!giP}>3|=lyru(uTT*6ZKDiS9t%OHWSjmm^RV-|1(xloP^ph5CgY+
zK=*IWe&FD^?_Wf?%ZDiz)eH_bEw3x;qkf5a|9_QfT@7wqJb<JRrZ!Mt&|%L1FYxgx
zL&*3PIBp<g4^=R=r5d0$&;P%8|9_@xt02Ho-|XQ4I)e>#7li!+0nq(_pfMrvSYZ9K
z*Pt^Q7_1*KRCq9`&8+_b8s}hY1JR+H411ty4m_reGQR*FhlZ6cwhHwPiJCtcK;=uS
zCPO?(pZEXgo|Xy>8$sz6G!6}#8v@M{LC3{3Kz4w|84fUnYB4Z@=59gd5lGxt(*c~G
zz;`=>?j&JQJ_~9SgTfhH4uahcnm<u}T5Hp_tk$M`nfL#vrj3mZIiNc(A!i)gtANT>
zka}>r%61r1u7b+cF2!q*a@6W${cO;@!50T>b5NLnvCy8$zzRA`Gx<LUgZKY07RmqF
zK(s;fe=ZQM0ctOM|Ns01#q2a_nT={Tr2OCaeTtO<$n5Vujd2ZI!ZZb}YPCG{!29Gp
znU{gaGm~b6#s$AuB+WKp@c#e3AZfM(h|Wlw9RQ*eknIAk@58KXtTe&(!M^VaRwiJ(
zA{^&1NN7)FU`{V#W^mm1JtVz^1!R^_dI=+lc0o3?z74d7Lh>4@jR&f0AYo&96>6r7
zbrIN18|~Q)%t>>==Gi380h?z6n$rN?CkIN`-v7UW$MryY-uwR}QH$jN|3Tw*+Rfm-
zv7q}M!27Jc|4y!LsB3WX{{Lb_qg}%p9AmsX-v3{;G}JX1c>jM<(@@u7;{E?cNkd(O
zh4=p#ISqB7ySZPaSTA5;g34d;{ySOK`~Rbv-v3`0fcA`n=ALaC?wtVTy+jU%8KC)|
zS_M}fTZelm61^CfK=`3LmR<}z2=@O51e+lTiOm9IH##v$)Os;oNc3W028%hs%@hFh
z6+(4v74Ds|bPy0p)MU^Bi#hn~fW|37XN4qso%#nC)BJx8!uHeQ;bLF_tp!N*Vqk)Z
z`GeOOFfg44-SG#XuK}Br0KSip0eQ~YX2HD!pm`Edxe40WZR>CYw8vWkq<*3^g9hlV
ziHXS!GPVhfAaMh*crt^IZ31{NxC1DUg6^&a&9O{WX5g@CxOZS;GJ}h4f&xgr2Uxu_
zLj-6nYN9hkK*CZ6mWjy>ArqAu4Llgd_k#8_d;c@$1&!l^?k#}KsZX2;nm70UJFydV
zXMhI-!xXT(KmQMc>Hq%{Z4&OCuxVgnNJwUINN8b5@cy%LE=VjPnZd>T&z8c36ozI5
ze`6z9-#??9VEX?*NsxVx`xq=5z;~`pRD`N!@&2<hH6ew81;!6)VX^c6v(XZ)?=Sn)
z3H1yd4fWu41Ogt6);bJKr$Fb2z{43iY(e1)3K#HP`u~5Wpm{COd=_Y|8g}ok2ZMk_
zt(j9>swNXdt(kLMt(g~;?cD}Siy*mBO~z9&IS3mf2iwyRn)?Us=Lf|hbdE{{)Xo5%
zN$vfA@mA3J(vUfPs|E(9lRsc<DnMs9?Qdj&&J8o@fb=7|nZf&SdLVR<`xe-omG_^M
z3!C>fuz<!0KxM7>|AkXQ_w9o2Oa<MS0KIe91mq5feGE0=aGu9d(lD=q!~4(4t02Au
zWPBDh?wJ5G2eiH#R8~XHa|NjZo!N;bW(eB1?%2ej12v}?qUQe|P`rT78T9^hva%+b
z!6YR4W*w+~0MZLNv)Z!3R^b7tP6O}h2Z@8$T-z!<L>6Q8{{Qa{NDdU{urtIbFfyp@
zPh{X}e$2oU{=Y%4X1+o|NM{@9j5^TT_!$LV><kV~pu56;fc6aWXm>I&I?QEg0Nv3L
z(xPAnnm4I`q9s!E$GXD%|36vK{X7l389?VUgYN2K0<B%DfBH)VlyB=F{L|r)hva3@
znlhMpr#%A$4<|$%bpE~v1A`1quKvLvxSq*>K=(lYy$U)1+oA(>*8^y76jY9Z&K%pn
z5VC#-<TlXx-3`eM0^qeY3mIg*|NnakTCV~M(}sl%GN8H)6s{Hr7??rl3w!_n_YrhH
zIOy&MP#A&kZS-KY0G)>mzN?NvI91>Xrv#8&FvIE3SEO)~(FfftHIG3B?&pU8IvxxR
z3LyUM`3wv-3~Xya?OG5Y9F7ftb-e%oISUB~^9Gc-T*x2-O5-4Vq5kKXun;td@)zWP
z4ygZmko?bBzx*}mOh!qNc_6=gFq(tz5kmMIx0$^SjSSe#WQLge?<m4dvj?Qb*Iz>%
z@x^HI5Huh9*AY3sX4-=8XfvxJ&5l23aoE8GvEvWuzCR9Fn%D@j1AdnxI8ERTn?Hp(
z!iEVFHh)(l!p8K7MFImOC||;85SxMNr~zmlAt;T5$}vj?W){%-7SOqW@Y%|svKKVh
zU;iGo7Kzyf%wEsbR{oL^lwSov@mao-5tN5Pce4q2|Lv9p)i>pkJ=i?uE5T=Sf#gKI
z|91Ta$<^=wT~YiJyvGqFF5&&R>nTXQ93dv-{kQ8PNUSEA;X*m+&gEo=3()($6ukd-
zZ3W3e&b%;r0rLZB52UREgTn+y1{sh)K<h?q6(IXmLFqA3OMt<aL4m<iff+RBrJ>Kv
zz?i7z01^|ZRbWsH)x7^NkwXx4?$w1*O|~LSO=bp*mkdlb@0i<ap=%y$`I*~5XMorG
zf!0DWDuTov=P_&mndLBx;f19Ga{x%r(!t08BxlLM99YW-(QnDX9E8LUhO-@*Lm+w>
zji7o$;c^VjVMy$7INO0a0iuV24XP&*F2}%}gv3sUvmKaIKy#Fq4$NE-y-+tgFmprr
zj1V_FF!Mq9P_rGF`9XYJ2LT3<UDhudSnA&~w}CKdonERYBLjGxQ=hpFH2!71fEm=6
z69L_;X1#zp6?Cr}Xzg76I>@>{(E2flCI-;hKbQCaIgz0G9W*&mx&q1Bg5_X#`Ge;E
z|NTqUd=Kt3!|Vj515i5jU^KeJz;q}EbWRB(O*4SkwCqo0P=Tgv8&Ew9s-r<=_{2sA
z1yCAq{?`CHLk4uV186O)2B=*3{{IKGHh{rW;s1Y7K6aSLqyxGm7&K1?T05ORpMeon
z_Zt8I|G)nKPl53NY(?Jx|CU<+X9o56QuJiN?e~S&^$e`_c@V#Y>;#o7rCOk~1{ow8
zKxg=a?lrG#(D44-eit<UZ)wlK49aJqu!X5F)Di&QGXrYN>wxYl^8VYt(Nf|6TMq`t
z86FJ$3-y^97(i>E9Ck5W0qx1wmSJFYn8gqRI-{c2$h*x}frAkoUdG;SmI?)owI(1j
zi-<(c3XNJ*Z_wHz4TxH2u-aN<XQ(<5AEwT^Exa>9&DMc~!B+DLLn5^O4m!uk)<J;*
zRCi4DWS9V@XV^Nhz{D~@YXZRHoD2%K3``JlPKE-om?uMptpmdcD0_#kLqkKN7egA9
zzW~%fwN+36wLL)TN(WRQgVy3WOkyaobYS4Eb?|PhRRsCx0cbpnu~rG}pAd+gb6c$<
z$PX|%XOLelKy5qk|KH&8QmO?mr!>s>g6~{<0_y)j!nw^86#wA0g$o$Cz5oBeVErFG
z{WA!F)<Ib$Fr;|@{|cJ(0o~ICT2p8NS|<zX7aLfB)<Svz{|j0B^8arP1JnKuu=XdY
z{MBJ$K<QV2(kLixHrh3qOjKsHX|!vwn5fJMnv=1asLbfnXxHE{QJK-B(XPQ|qB0|B
z-GawNWyS!<CI$ul7Vvzd2B?iTQJF!&R^c%?kAmiQZ519cz{Ei9JWzOo`WQ1k86-e$
z0nj>+nVbxgAofg71}PA2$;sRTijP_cR~?%N3m7apnZf<Fng^~rmYmEzFgZ(3<_;wG
z6eKn{U4ZmEHZkNt-FL*2fq}P{&AYAUxp$kbL;e3mumAsRJ-pj&9(-U(c+S9F^U}Mm
zmJ7t+z)<tryRFs-#Qy&w;W-0i&0FubT0ZYKTZRn^wfx>~wE-YA{{IK{4{HO#X&?n+
zzH^(c!vTg`cMuJ;!x_mA=eAld5dVNe&1>hjS|1P_W`}cIEuV9nEyDqaT7KuY+5nIl
zFgu*vEJ1htIe^+wENei1v*cs|w?#p0TL$+37B87Z5;^|=2ZsZLEodJOhs8@KNPm^V
zR>zhBbPoq}2wa|%IRMOd0Eeps659od?Ez;yFtAv1GW#I$87(=PZQy)P21x(e!40{e
z%MOuu*8#=5B_|U@qSu;za4}CNa6h=FAza7SfsMtIlZhkIi-8d$@2UgpgMrqmf%;*f
zGqgbcFz>(33JgqpKy5H^yAG6|L2C*3FJusbmb)sT^bJbW6B`)>^jH`e$xPca4wD#&
zPuHHzEtU-OKfrEh2-UG<5MZ$MgrwbChEN^HCI%CSNemI-vce6Nel{@Fx`Sv~Isvgi
zfXX`NT2FAA0)-iGts5vEEWk)pwhl10_|t|ZTD;pb{9&+o35|Pjx~RuUI}kNY0*M^Z
zI0dCAP9_Pk-@xgGNd<|mfM7FYPe%?6WTur<YawRC(+^Xk*T1(gF<S?21@tsyy?}w+
zaT5a%wC%-Vsle=DsmZ_!tLF-}z->qaaQO?lk1xRcZ^KzoI}cRWgUag(ji7e<hd@xf
z*ZcqfEub}x-hUfbg6jUpMg{>;dlypHYF%Mq+7&WI@jv{0<-LfzltXF?q`~(OfyU54
z<Hw-&P@wyqKx2%cG-<DJfWiBpG9zeCzNSzbbQb&B#(xb7@*f#9YVxEj>>da(fYxr?
zEm*)%|G!EEG!AE%pukW+v4FvGE@J~|jkfpyFB3t1A;*1;DG>hqiy%IT4Vp&*jj4M7
z|56L$d;kCW5!9cC)DK@Wp<-9{oBzLcoX4mF(gzyzhKRrK1o1)r|Au`HF`)9hVP8W8
zXia6E3TWL${Y(!Ah7bA^85k$YGq6mOXW*D5&zRz{k3q#&VFAOWe#VAL>ls@n>N9ps
z@@JedDW7r5gnUpNf<eJn;Q+&Ac?OBe_Tar?3X|?LXiWOgpfjN!e0Da&<oVz;6Fe*x
z7#JtoL&u}+84W=F+{ybHTqege1Wc}H2=V^&HWuR6cXvT<0=XBY1~kv_{r~qv4+iks
zV9>hI4DY{Th9G&+enL=~fbOU9{y*a(Xe}Nno<L`4g4UCI|E)VHQ^5Sf`~SN@kXhb;
zzRm@WBUv#sFoMqExBkzV0XmZsawe_D3{biO^>Hi}7!QEbSWP}tTSzhk14xX4X~&8w
zivKNOZN&YJ3_GA@)EQ9u1WE(mf96$!>P4uVY(RZpi$sQ)=0yxV6BQXEy#MUz^#1>U
zE_iIG0emkthxgw)S<u=($aq-oOURxUuC?H?tG~53L3<Uv|JGi#Rd5hY)MRk1pYOro
zIFH!|G9S;_VXGj_l&C4O03yyZ0V2+D#8yFQVxp!<DMXw(1SAd;bKJ`ikf<qA2o+aB
z5|>ES6e$3SJIrI50LmvG3@jyynj%FYF~@n#68SHMChB*J6g$jgDQKu`2=HKF2}#rx
zsfNfiy?~oFmq8^_Q=}X!z5}YS(qSG8Xxz`ogMmdRQB$NAD!&3MU+*xF1=Lpc@L*tm
z0rl5Xh#KYwklBuV8El~9i=g5OVDUN3E%`5nne;m)7CX*kc7d{&ILu={0a_E~!NBZd
zs~{Ybs42k&)z<>j2NH7xyHx_Tz5x`jDfusjL-ac(K<DQ6fYv8@FfbP+YDzFe^(ExL
zbP&|<1nuu(290Y=fYx`}Dg<sy)RYK>sA0+gne8~2VUMkXgHWO-OCv;_u>>r>m%+yt
z5|>Ay;$Zb4G0@(jL`{Y!u=qYk7Y_zzjzmp{qhS6##(?~n4nq2!EDnzI7^iqJFuk!=
z2$-0t$qBWW(E@D#Tn3f=myUt@ogxX2^B7I?Upgu2cS-~}%wyUE$`hb`p8qmXQNNQj
z0JL^6|7GANsQetz+G`I6h6}a|!A6Oi5)+~J?tq#bW2+FXl&C2Y02PO&H5I5ClN{$U
zmO$B49Of~B)_sB2csJy~3<kMjqT@Wql>C>$Mo{~7AZxrCTWl4AgAz3*K;|(x&SQ*#
z+NYBLGT2GKQ(}VSJVqNRd!oZU#xJ0?qM*6w{FlK&`kfLWb8Yfp)_>CPloWE9$9M&_
zh74TB)iua?|E-$p!N7P1v_Al}o*TS3;Q#+O;Q7A)|3Phb9nhKKptd{c++xVw#ea}`
z3l9dygoe5X2M-2DP+WU>FfgWo+Atmrj2@8m&j{K}6asQfLtTS}_unebT7#sv+K{9+
z@ZQsT3?j9LNo}>E5WeF)Mwf=Vh6wM!Rg5+X4EzbnP7dDxdwW6ZYfY2dYNeCfQaKtJ
zYNeCgY6FtnY7LXyYORynLNyucYORyoK>e9o6K~Mj6@NhM>AnB|R{@pb-v9rD?j8rN
zmk04{Kx35+bqydIw4MsImx%|ot{Bvg_x@YiYLUng(J-%}#Djrh0VpiJ|5g@4#XxJY
zK<VBBG!_b)zX6RAL)Pn6g7!=_gUUrv9}}b=+#hWMuL}f?$xQM7Td4^WZ<yE6;laQF
z@+(M86e`vO>JLHk6a#c!f5lIzoDHZh1EoLjzZFj#<~6v0#J&G)S_>LuY^ZBk0-2|+
z_y`)Swn$`{;r+k+YV$${2~fY>{s9BO2Ls#GhKCG1$^V@kKz*?Ky}zf`9R5A6p{`*C
z=ziXs=f9_U|E<{AP}i`=`)|d{PDO?Y&|Iw}=swW8h7A^t3=!UcD<*>0GQh?t8si#v
zglfvyHPkh1sp;}q=l!>$5J~PpsHWbphPsA5HC-Nh-hV4XA@@9#|MmX=^B|~x0@t_m
z8d$(-ab5#MLtVoW@4pqgP<5d7nkT&fR)E%|ae4nO2aQXf0JTdz7?oU5_aM$t1l@OL
zs}SrIlFTdu%9}OGUKKSQ%*$Y7@1T3oK=l-gzQ21LZ5{rD+Mx!ZcGf~I#F%!W=Kt3q
zv5i{byJb_n|97)`|C3k>vIjKY2Qm+2KGe(=pn4BfH%(w<i1A=x;cZ}Kh-pY<P_a;C
zh(J;Y-#6*O@Z%xWECyt=7??JJ#;;F+%mcOeEgJs+-_Ho23$dxGg0{01A$N{7>}z1~
z{`-Gw^S%ZKP<^UD|Nno-d5jJXpt%s|%iz1AL3@+E|Nij=ov{qMR~IseRd&>afsvuP
znE@2;Jl=nO|AOn?CWbelJ!sy4HUu`;H3)#%p!KHS|2tgu=YZB1fzKcD(4WJ=1ZrP^
z$4B-t>;T0lXw0r*UW17DpAD^G{yv5T&^~NX9s$K0#GLlOV7Yk=p!M?%P_dUaHQ+Ob
z3ZVKSb1nNA6hLD^pgnrte>NDx;u5TXA2|QWc>md8+pw=eq2XSG4Ct;QP(G-4zFgt`
zkBJea&S4LOjQ2nG#D;kd3ZOmApz;lr-o5{p9)+oe@c#vZ!q5BvzXO(u3>F@Y@)sDG
zHY}K;_#b}eDX8tTKan8^+OBB<sRy-fK<nc`aSv+4fZ9183{1Qr`x^E&fbaQj_}8Fg
zae#rPQJMiX&cf*Zw?DOcUxNXR4^j(ie}UA4)PcvE|MojJ%xf@dILIIYk^{LBw7=Z@
zZ=Y_%K?Z?_c@5w@x{<_18|F3GfYf^b{Vm%(ufYQ3|AvDMJRmX9-5MZyXkK$b=<B`P
zaGQalQJR4Tw7vkeuLPvtIuVrL`@Vw9ipQWeAiqw6$`TmAKJ|8m_uns5!SU9>;L`{#
zFC6AFfX-E9beQ-5M#H`a7m!&XJ>Gx+faBC*-v0wIF|ZpBfzOv?@&3mU=>7ly5|Ett
z-w6}J^#4CULHqPQ807*OnAWEtkLy@EFo5sC0>{Zg1`cSPh=Ae)6bGQQNNPPi)`7+q
z>ze}{Kx3$&aU)P$5_A^;C_O^v9_1JqnAU^t{DaSxS~@WN2i>oQ$7~kj%$5b+dHn*E
zmqBZPK<5d7(hO)U9aK-$_k+g&85F_n^-OKy&Cl(;|NobrP|si!-pmeS3r?tKa0qWc
z24W|I(#C{(29xlW=KDeSw1VzVnsA@N1#-@(J48&?yJEtA27~bB^7Wu|QY{`ZaFlmS
zFo4ch0Nu%3>*jf_)=TqRO_t>~TLz|IAt^uV5;;CJfW~`kogJ^$x&(>TYI#qa7|);r
zI_JAq(|TIXN#kh~?HL3><Fga(86+m$XW*zgraf)KeFhc}MwuN`6#t`?f8PK9gUi20
zNATKL22lAo(TRbl(UC!7q7#Dvs7%CGZhHU!cNJQ0g4KZZLDhlp3<lk^4Ze4~O1c7c
zUOMRfg__&O6*WJt!ROh7)6Ac#wgs7>bwdmi`tup=L3fve_S%B_E}(r>;Zf{%;d>dh
z>SJG5fXeseY9@y876vVl-ue{f3hzHtzJl3HUW3@+dHG}&27B*6Q}%+^GeFagh6kfG
z{7z@knP%X5r9=iE(A+9$9UrI<T;C!EzN6mz&y<x=H*E>YV$iDZx&hkDyCNi$%}l!!
zyaq7GaW8|4b|-iaHUN4bB<OxX28VqNDb^1_>w_3#v^&9T2R%UTU~O<4o592W0q7ns
z1_y1>n$>v>Cfc106CCC-7}!4$0MEx*Ludu-2M!><ggs<0h=BbA@SbiC`v;5+mZ0%L
zuU{hdT@OHaD+_?`zXkQty#GvosXv#&9<)c;VcvfWkpDsB0UnG}2Viscpz$cE|8*ud
zGVthu&cSzN5I_%ygk22wAalL{Or8r3iwj6$ab(bhh1UQ7pgVZ#JHh7+@qog_VGe_e
z<0R00?B2bg^3(hO-m4(LfYxk!|CzKDbcO~}ILUy*sj-oP2Q<$Q89R~eVPIOd26+x;
zA84;F<m_x4y9W%+pmNLZ00Y0>0*3!~4gCMX>AOZ6e0OurPVI`C`^FVDKddW~zW@K9
zbnXBDq^<w|Cr$bPAGDsqaUQcw_$+q2@ZAh-^|Ky;(o9JG>=z)~r+)qd&|OF_pgIv$
z*MiQGu{gjmp`QJ4h4=qID?xRH!#t)fw$=g+_WwUH)X(-1sGsvt0CZ+et*v*3y(K6e
zF>QdF&xdI~_^u^%^9!KndqT|*v9)Gou>b!bi}{QU9t=zYQ1itw&EJ5{{Q(g3f4_v7
z&-lgGnnA$+|Njq|?gyoF#t%^Qr7+Fkfz5mesQJ)wA;u}T)(kB6|NsBNVm^xp1LFj!
z`EuyyYtR4x-(fEUdiWSX&DVsw-^A9Mfzci`=Y<je42&KOj0RBim7wN(K;zdzd%iu$
zd<(SrRe+fP>m<Z{hAY<p4=`9;IxraTc3`NV1?nF&+<}^@hG`~0HZujFW|l(DY_R_S
zfx+5RfWdgT0L;t|sF_+|Gv_ft+&PcIL3=(kHZvKZW-3C>)Up2mhr!yCg~50?3(QOt
z(77h{t&b}}YdpRG=77#g1?`(=0i7{ap9X4&WdE$My<Jfsa~YJT!RJ}k?*^}rcmrw6
ziGG=)_<sht9%f)v*uRhgd_VdGMur^lJgz=dTk|3Yj!-Rzmhim_X5lM;)Y)n>thCfT
zz)-*P^|Vw^hK58<21bZl(0X)6MbO+WXnxAlfl&#Gtqfy>+JoNzf3Vs*Fsw-QIsn>7
z)iBYCL1(5tXq_F~n(&n@b~Eika~y1I!uKAto4p@27r?g0Qh|XPrUumhm}w7MKgYIa
zrafqUnr#iJ&gzV3V1=!(gYp?*{F(L)?4Y@&nf6fg5*ac;b(ROCsEAF%`-FsKX3$yb
zUm$GIy2pPny#N1u0^x(?{v*l#e*s$upxwg21#Z98N>_l|FEw+NL3d{JSTr#3djJ1_
z*ZKkPYOq^u8CYTKf(o@56dV^Zh|Hb~@h7N_;lU`<0h!aQ-D(cH^SkN)8Snr9AArtw
zL2^S6f)8@zf6y8ca61ZQH)tIKXdSTilmGvF<})yY)+m7HGeKpt_y7N(b|fg?B|I2K
z6cFZs{k8|e2b;Ub(t$w^>~3WwcWZ#>EhP#y7~~wA{y&-N%)kl?Q_z{8AhjLI3=BNX
zkhM>sHKCw33X<D5K-ggOmw?oFBAX4F6ICeG1ep!KKSge)GQ@mPe1qy2&{#02t%_#u
z4kUBe)G$b_0m;`eNJDA)HxNDxn9snp1k^`{w`q~r|AE?|p!x>XPWJxWY1(MdPyp)d
zJM3f70rinA<}=h-)H6)5*w4`5{dbBjc#Rum{(!;zZ$>J}ji5FTsQnCTD|s*q?O|YA
z3_61c97mvjD=3bjZE_h@`#O%o>;sKmgW5?R3=A<fsnQh|^BGz|_Im%F;#*TIT?t*A
z!s7im9W<5?8XM(k{?E|j{ntJaR9-ml`+uY{o<YZ!fq}o#p1~lI!^xr6%XwO@rZcGh
zsx#4^!2p!zK<UDRQAh-qmcePL5wa$~xtSrSc`-wRMFIoA_ur|4p#CiA+;W=(t^uIF
zC#W3+>K7#(a}2O~0II7PBpT`&S{mjvlr-#TsA#y)P}A_Ap`n41K?Za`6X<L$(7Ze-
zE<x>A&^<Vyb<qq=i{R}=aQGy`@1#@#wUrR@(Y_Sa&+`7;{uPwQz5mQ!SwC08p??2s
z$l1yD(iOG}2B7g+@HvR~4?ye}p!?83V_Q7nKJENRBHn+~o`UY=1@*mZ_P+@5{$Fy`
z`_Jsy21W*z8hh>vP}vP~U(J4r0I;6q+ZDSL8F(xdLHEFw%wS+z1UiH20;tRcxwjyb
zL12F(gA6oIO+f7tn43ZIRCCz4!u$W<iJ&p8f?9CC7l4Yr1&y~AWP<M8W6UY2WoQ7E
z2@tt|g^>7X4DtTkwic8wKw$w&Qxg?I^HP5uA!8Pd3Lr7>|9=-k`2r3588WQrGfZfh
z&yWI+r~3>g7XKM4YL;jOc>nD=3sJ}L0wf1&_gL&_$N`<d<^8vh5iHlla0awy1eER_
z_c5GlsAtFl&lUZxO$4Pahdm6S@Du>uo#y>FwGcATkeUe@$4pHGj}104Fo5)V|NW!b
zFrOg@WLLuy1{UxCMUfEkW?7J3jtvY6jqwa66A~Ff_wj=EYDhH3GgLtL&huC*Gc<tw
z3pZmS$nV9Xpfm<8+jKx_O}~`^v`<3;WH#umSMR^opt=xzX8<Uzfcm)5a00ChG=QXg
zevyzY1`|*ly(UFUq}DUIqP`P+)~^I;4AyZDgFp>~M~<Z?DBdAw5@A>4zXn+isErFM
zZ(x0L(E51LdS6gE)2j@=BOT;V8B5Rq`?b3mBpvtue*@A#QyH`#^#21;+2O&+*8*Dy
zX|aHTW4|K<2Ppo*ZQo|)3Q)X(`c>Y4<~;@Fr<t}49H4vvT6<b(!*JiRiGc^yzw`e8
z|3jxW14sR@-xY<L4EMotI*-A|Qh`AaBtO&s|9^|w3>=`au~@*s?EPon)Y-EbSit5W
z)Wghr1Dd~|8PCAbX$!t9{wXM2XU2l>GZWG7WMBpHEfxMh1+8BM<tI=$?{;M10OcJ}
zo&v4ewNzkW1(^dn=cQITNTidKfw57QfuWYga~*{CSO+=-0b~|vJP{O@ps@-|F9xQG
zstgQH4FAtqDlo92nZXCqi)x1BzW)c%^j-mlSFN*`NGBJAOrtBv-oSMbIsk01<G%kr
z`kf3+pgR^Px-u|;*77^-`+ot{Rsgw$foYxsEN(&hA9RNjC~l$oA2H4n*TB+f*TB%|
z#lQf%zZ#ULYnr`4_j#K%axo-;{OCB3K?AhD0d!s~czwe%?TUsh1{Uyn#vIJcKx-X9
zWh5v~fcxo;JUI+Za~Die{0m?Aus@LrdWSEQ3TVwYsO$mNE1<Ern!Vbfy&9msK;ZQc
zpthp-|NoHjrahoDH$dk%Gn#<nA5<QK?xpnpGiRcuJp*5@f}hStdj>vBdj_#u2S1%q
zPZqn4@eE>?@eJVeCTbnRbT-C=?;w(bvZXBJ85C+ALUbm^Gbn)Wc($}>P_c|>(5O}L
z(E+Ie-OXlc&!7Y1Z;WTqu#9IgfQsu_+A|n|?TlwI*l5pS1R58bXv@H0{g454zKH-R
z-mL#KsDQ*^<+8;B1}W?R3_{+2X5VeJ1>YqHy6YTNK5>B5fbx#_|3Y6w=l}m}vLppS
z>pP+I3*h<yDz6JFiyWFj>jgk}3^9P(&;m&MdBO6F{(;ht0LXsJL?#6fMlN{04y!jC
zm3csG`UD*3F@Wx0Qvl7q>vw|AdSbK*nX~F&$Xr&?T6Y!e24;r(mdDfN_kh=i3RpL=
zLHTS9^?MZp8kKnjKyg?<2Q+8PV6&i^hef7_fo-8Z4_p1y-xVP(9y$sw46HRRiUKvs
zULqka>^0v1|K@_i2vkNp&SAJPc|MOoqdnX`pgZzF?h$~vhXJ$(TP1w2fK{#i8_@df
z1>t)+Y-;0Q>4kc_=!JS60^ReNA#2OP9KM%*A87w*sOFCv(D^~yb3x~cFoeMNme$&P
z>4j>6)tl7+_Y$df_@`t2pMj}X;h#>Z*J8U+O;s~cJ%=fG$SzdVRj=058#H&M05Qi!
zFI4lGS*>PpMX2UOkQ+Eaegd^sK<z#cM$Qyi+6S%g+3(22QL{_CVge(R3aH)%-DA2?
znTM-B#q-)qWgedTYVaNO9E+2AIKuzzs)N=0p#G8f|39{%wRX_(@+khx_#b2!=&l><
zhoJKI5$FtfMo@Tr|NkS1q*f-p*+U1EK5D9@L_lM;-hXDsg7kvY1;m{kTNs#Tg7$5|
z=PN+v73jWi*qp^gP?=sUT>)}$%}rzQ8WGUG1CT#LH9d4{mU@YFsxdHt+M<P;4EyWn
zgYSvaftKMpo$(9|g<cH%>$^NaYe+*t_i%&GAq>@I1C5DZ0hPVp|NnyOY(`Mq-eE3-
zMq?}wsK3RKsQLecei!H*JO&=nnSCIBeTxT!;~s`7ka|4!Ah^6?V0csi`*(%)LIw`&
z|NkF=$_Q{-u@uyY{ACFWJJ9{No%Re2g<7DqbN=4}wH-iyt&Q<q*J*=PPsCuUCu|rP
z>YE=|c>n)#6*iw@v4BCr`_BwsP<iXYz>u@xE)N&TFAe(|L_&^v=y?DC$JiX#09x<M
z;IQw1OnvO-3Q&DyUCW>V-Os^OUwa$02jGo0BLheM+zX&FMH!G8VE3~guCU(w|AF`a
zpOv6{eL?>6{trHr(ZYj~?F$3b43kD>h6HFh|Cplq7u-JvmGz*rN<sD3{zfL~nWIcO
zpgOrh?*9`|eg(IQL1XR*K8ZBOHLy&`Vqj=UW?%u`l?mFP3TnSP?qd)EokQ0!A9Oxi
zOr!?`Lr13~6Ptb~L#V?%hMG=ACU*T!hE)#p7z)5)z2tR;#X=?y4+e#e;Bu&mL8dXT
zfuWI+iDM!c14Cn6gTmxh;IMURnAf0Uk;q^NuFL=DghJIzfYo$?)iQwG1e(tU&0~Y+
zL>u;l+z}04|8AMcl;Oe1#sG?YNL@GGWQyV|23T7cG^V-tpeS_xiWm#X&*1t7v^Rf)
zc7;WvsEkFUXpO}}9u82to!BV4rREN({rfYpCR4g{qN3;uhbA_WMnxXb*~p->nx|1w
z6m(Vq$3jI>qm7C@JlzXLbrw2`YAsac;o0cO!&kr8^IE5(sAm1DS0Wn~d4yy&|Njf$
z%VM{AA&)?<Ex10F>2ws;>tqzw4fS%+1Ko!h>h-7&bmr4WMII4QzMZJZBLPaI+MNvg
zpmqhQ?E`8XX?HTjIL`b3#afX^29%#cY0&%6ltM85|C?i{B99Cx9e~cCg7kk_BS3o~
zoBuWFST}&~0%xeHw?AD0G8?4MaUMeg)DDeWOVAz53;~vo3>=_-59m%p>z53SGr4#~
z>VN(M-SaI0wtwIM8&LP`0ns3{KxR1Z`~L+jKkxq=(EYWb`D~EAhB5#D*JnKx0IdVl
zlVM;2o#|=yfPo<?=>LDvIZW1!qA^yDA~Kc_88{X+@(6*_eZxM`{>tyZjrST1KzY`2
z4$B0q1O~y{Tg4S-#sB|1HZgALjAG!Pr6?j(=*ht0*u+p#=*htE*u<F78O6X*=*i&V
zxQH>N_Hi}n+!BV`qs0~VZkH?S+80-JMS;dSeoH!RVpsw)qtKH<z_E!z#A+)8BWN8!
zT?_cUmIIxRA~K*h5NPd)WfX%9=<F5H{?5AA#T7LTA)q?w0LU(o8i#!h3J#l?L2E4>
z>YnVbs9U<a!uxL|X#ShQgMp31VH1M|=$<=^U!XB*=4GJrCe-6cU8t9xL9Lf_MK3!8
zBP1QL*@5P?>boX@+T2sXV}UH7@!c;=9VRivz}(yEC>j&$#byVx8?>I;aUMek$n79M
z)UzC}uvoyL@BKFdw59-bMu88={UEo4+zs+aJ?r5LivtV_-hU%HL1(dn(ho?V_n%2q
z!QnlRK>;KN3JdQ)lNzC7Jl0X5zQw-={n-o*pfPjMSWTxD19u^4y?ztZ8_>B_x^oy9
zKyhi6C_2N+QA9>p0+iPoOF(lE-v9q8Xm>H_JI-UQ(e47JWyTUvd$-e*fdS+fhk5^>
zSUvdv-=U9j3Fuw`@L50!3=EBqJfQqm2C4%>Z9#SJA-np$-W8xa%wZpc#6m~W0$4i$
zQWrPK)$jEZ0m&z7{{OGX!N4$4QFIMB?KLnkEI7y`1WFqX`x;C@WeTL6{t*fCr^7rJ
zndZ0#6Uze(3=183ghIU(%<B6B9318_?*PTyOh*wJP`qn*F+6pg$2_A`ih;Y3lYzsb
ziD?c<9OMtjdCV-1lNdn#7H(qWyirkf4XADet?L5CdtJ)x3h)1));errx&SIy!TdiH
zzJlGjkC_KF9}kKHNc}Uh*RhK^MSnU2gTo%?0#ICn;s}&3YL>99s@cK1s{Z9~&>q1V
zb^kpA9T)st0P+iHfB8&L28Me3Q=t4U0Ls6hv(~LG85lb)!F8d&!@U1*KxL0(A2ayO
zeTR9>IvxznD*6*acYZQUc>n(wVX49(vv?toP<?`r&O#Lisqmd1I-y#ScmlPTK=B8P
zJBNJ?G7DW8L_(t=ZMOQT;EM352D!<OqAMC5MOT3Cz^V5P0`)lr>Ssgmm6C3*sJA^`
zQ6F&`JU0mHGt|$$0lM2K1XLG;!od6gS4~Uj|NrZ|E`ZLXo&l=69Og1yX=LQ#0Qob~
z>;DJ+4ru$qfgiMv{sVX}c@D#d`n{(_Kx;9)|Nmc8zw-rntOyi-bw@Wt#;N~*a|DGs
zv>tTv{u>$!s&70Pm<;M`Z$Q+$T&}3u_DTdihW-B=_}p-ZegCi2)cz8wNxmiG!N3IB
z&&qPR0%7h~$ehQ%|7#Hb_>x%v|CI>H{UEdJuDucg%@IP{I3agI>A-`5aR)(v?fHKJ
z6lS1vn?P%)3OPY#Bf}d=xybOOGm3#1IsJpnM)%1T6CFj@c>n+U*KyNd3s_l$QZ~AP
z&#sE-gqMvBGeBjF)f8~qX#+aT3{=K=Ffb%IZejqfPjdj3A&~MgMAn0W0aRvkL(5#y
zS}qGvnFUJQkTNUyC#b*E=_on_l8+cHK<2~Ct|<(Rpfl7UWmoW7P`dyWCUq{8E4=^o
z-h{-{pBJEV%JLj&f6*TYQ2qw_)%*WvR#3Qt##caRibBFP7+n5=(kHa6z-(vE^>A>U
z^ZNp5ZwshS1;xGNJO-1RYK9A-va?fBG#y<2E&BTgRJVHn|I-30w?K6ps2&B?h2H;v
zJ2W<mZm~=hW2kLzRPbQ<E5g9k2iikh0c)%5U&v4c?UVO_+9;s*Nb|o2mPUJUKM^zs
z2wK|)>RYY>t<CfP8*~;V2kNVX+R~uAz8&W>gfzxA1c1*V)IvSa0kX~&ydOORG`81J
z2VNfyS~mweuNKsYOaX-_^t@WoI=39q_%LYgqW9mRM37w#bqysAouKwtP+&tns9YDx
z1<j9GG%|QtEMzF~{{KM|X^gqT`)`mY=*%?GzB=oL3@H|k4E`1i7`Q=oy!W4;n~io2
zAbV>p7BWPE=7eTHWXNymWMG*6kRjgtZ{S<YM1~Gf{CY6_0o{)dJ|6@;UiSZ+3<Fay
z=zM0xxB}8%3V1tjt}=Mt)CABzvICz$?brtIzkyRhV?E%#WsiSXfYQfq&^}TQ@V!f*
zHCzhb|G(}D$#k=;$&#)B^^XFbkLU$DJIMt)AK-(uGkXK3DE{98k2^*N4QSl?fXWh3
z{8^{`{|}n)1)ay-kj$U~icjzV|JT<4mY&v7#USDR|NlZz{<Lmp;A*I15UJnuzyNfn
znzaNd-TrR{mFqS0A5R1C<p;IVTOMAkNmdf6Nj_juGv`M@NQ;Jv2LnHNd=%9Fftu+H
z8pE-E%)kX|yEh~<2-NTWVbILUzyLbe#{2(&-TJ?Wr-AZ7LluJtXpM@+0)~cKYw2m=
zbDU=XzE+bdd97CYMnJ9R?`ic<eqO7|d?iwo{J@}Q{*8c|mV?(k82BR%mH+>*$&?hZ
zOazT}{3>8z>Ty6GW5PPVWY@p~NvjMOK<B@J#^&pr6+mbCN`S_cK;ucE@gwlK+uzV5
zpfMy5hF>}iOx;glbAF&c4QQ@!??DCyP<VsRp975<H7YYO)XZ0g^hqxoS6DYNFg9c|
zNI=5;pQWWT1EWPU16TbV34?}829Ak}3?knD|0&itzi<G>7w8<C`dzOp>f#??tE>7Y
zVrdL&r#%v}Y5>uXr-g+ISXpiTf1xgVaz)Lghu1)3yr4V>y3@L*<wwATMg{>;KeB$d
z2ZO^L<|U1m3=AOqz5oB+t3R88+i@;~K&|B}k%ml$7|>ch(7X^Rj%w|H7+5c6V66Wk
zR!}d&IK|R}fxEu*27}`qhBwV}4IGUY@VpP+N8tT89DI(&gbD^&dBEerz_g;#u0de(
zO9qBUy9SX-oeT_3_ZkG6{xyg+nlXUp7eH-ElZFZg2JgQi;4v3ao|<UEz%bE_fnm~g
zka*ZuP}vDG*KyzfHIu(FFf>#$#CZSz^S9BQfuSb(g+YC@2gn?oh8ql^@i_+2ID-cR
zuP;cS1Eh~A;r-Xo64DQ5l7Z^q3(`BGoPh!4mzvBKdhoRhdl-LsFfcV(S}-uyT6kWw
z)P(t+@k-Ob1`fp^|G(7!t`eE}kbwu}22g*+VIKoD9Ku*Z_JYg>^^ZXPQ_%W!tl=Ps
z77pbg{|2Xm%6o7)m_x&10!Tb`EzDe`a7gg}|NCpB0ZKTSG+ajx2Oh{6<vs>b8Li;K
zz$nsC$pF#^@qYn0PE<hgf$EP?Td;j)@c0DXRdl1#u0aPHp9Y}#Z2Z@t)2I)RON)jw
zkXwU5XN!U35bO_qaQuVSd;bjq@6DZ12AXI1zh?4#28KpO2A<lNho^zUGW4B*RZV7r
zp7;OXvS|LYX}E^$FYa8B`=DWL0@|kx(ht%5>tUl^g8?{xGa=^J^B=rcFX0gY@@KdN
z$c_Vg-v9rB>Jkg@zdoS)e?p@og9vC`w<g)c0CeUwIM3{3kf_=Gcv{WUhu3PB&Ikmp
zcLS-ZpFII|4iq@8H$P+$sM)U(0CErLJZ4b;7j%}Y2Ll&mZNxs%{lN?db;{k~K3~oL
z2LaxH+8FEqKL`MwT~%lJ3)IJB@&5lO0@S_+)oq}<+%l0N!-L^#3j<R-=-wdky%wNx
z187;3viBimu54l>g9K>4tx=hw13b3@I&XEGHmJ;bQ*+h00u-;H@&>fO7*zLz&NsGp
zU|_JSXW#(!eXSZ87<EM%7?KPZFzAUhFeC{yFz8NWV6c1usz(_d8j=|pEOs-nG|Xmb
z@&5mFDafA=^ZtX*zzgWu&%g(oGjf>6;IlBEfhW}SkX;~X+*6aqu0G03q@kLD!~6fw
z!1`GdpmwnWc-+wCGN>QO0Xi4c`~NTSI&H_f|93$0C*uc8RR)1ZM+SyaO$M_XOYVwV
zO@<2~eYK9Bc^0!6IKX33Y@oj9FYp>*hq;U;76}YJ-hYES!D~gE7*iUp!SiMupmRgK
z|NpqyY0tnnp@yNQCPliUF2ZwNr#%BdC|p3}%i5g`OcVbwbb!uA0_}4EwO6bcFt9t$
zV>HOLWniq|%U}||7j(7?qe4S91B1mL(EQtvxu9@xoX60x(1w9!(j114P}@UxfwnGs
z;d@!s^yh-_9#g2F+W{(@6zcajRlv+~*aS`w5g_|OaSgU>5(AH8AA^g-DuyGCHVhpg
zw>ivX0NuIH;r;)IAjnRT+d=kw|NjA5%d(F_0MtJB{_Ah(!N5=eas%kh5KtP_p9^w7
z1LzD9Mo`}dbbb`H4Fy`~4@&pou_Dl22Ht-?WgBWh@$`KqsQ(SN2YjD_Co9B!zl)8E
z3=9)385rsnPlNhu5}>$376Y}T95yk4_HhJ&`hTFY2Jb&j4?$t%Fz^4K$y>o|+!-fN
zV_@+9|Nn$T-+xd$L&dV5A)&GR{|-po^V1v#rj`j)koN!WL(B(<fYLaq{Q{nksgbUz
z*{)qtbIlmMe$D$&(@apBu}EeRm|V}m0lG5+<aSWn0i_#D1qP;x_6$6r@mKFZO}Q4J
zx~=7L1*E;#_!Knm2^uQ`?H7QI2mJp4j)Q#+0*&?z923n!d4cf<xSu|sfd`a#Kzc12
z81%jWN0dVE234`N`2Qa^ZcuCC4Vr(|2bno*CD`9D8toZ)n(Y}tV|Ji3a1uac8K8C^
zsP6zei`x7DAIW;F(-olcM#m<`3Hr_8we}N0`t&;)*d69E+JM^8&GQ*J8nwW4YK;1w
z3>*`+z~!_A$j_iTP4EBTc|m4_>U3Co0<~)(@%;55sO{$c*FO@p2Et(x1LzF=kcJva
z+HRNw%I9DALgNn9m#~29>(p*$umP>3aG1-W1F{P=P77)ud;kCT6RaMzo__J`3h%!@
zb0PEY4B+u%i#ZHB-hUcuq2@T&?Uh^yI!g-T)^CZR`(hmT{SN@egFa+zQ3m9GsJvsN
zT?0$ACj*0Z6vG8jzZw=^pg8dU|Mw!OO$lcI^-%@&g+TQ_s4Ru*2c5SBUmpj)M_~r|
z{Bwy;Xgdb9PNZHIRHpm`ofQF&Z%~+n+99C1Q_z?pD9wZNE4XZ~2c5_I{tp9FBg)=s
zP&xyJ1E_DmAGEF>vi?#9lx{(7Gf+9)Xx9(`I(q?BcR|hcskv`l0bV=s|1Y@x;JEMq
z3((n8pfRL|L<WwGWCljq-UQGb5a_Hakh?&4nt<AOpm|n@dH=V7*UmD$pTNM>h}s81
za|_5Fpgvr~d<F*S{C|K&3&RDAg$x`P2S8`U{nrJZ1L8OjJjNd4{nzCu$UacN6679G
zyo1)PSR4SQ>z}D0bHL&)3>QFqXhHshx`l;-sbLRnEib6<0*B2)NZkcmZw(F`N620i
zP&|YBSx`5XH1BHw-Ny@a7h|oxcg4h5ke&aa=U_27fci^~s*o}hG*8(45OPkL_y12f
zC;tWITLuH@eQYcZtqcv`|3AUXr5mX3{(KW0w~3(rRPR7dK+yUWtm}<HZU%?pzJ>^J
zIMy<N&gur2^&m5$?iT@tsrUcSji5FiXucEFHwC2+(D<bHUr+E}RnVIE=6?;Kv(;c`
zsCfVNjBSi-0MFHe<U#q{(&7JqP&*owc0lKzAejYHuiF^c0NVS(fTrF6q#iWy2Z|F9
zhPMR_O!c7sKUmjo!Tbe^2T-2~R0e{^6dLUsB0%f58Zwdm$;cp5)2dtn?jJQUfcmEb
z;6Bp-PoTANptE2YJQ&`xFfi4D;vXK4772_o$ZNM?c6$HyItdCVa6i3?;ebT~0~0iz
zovDBJyTXHkv9ftz0}C|#CM=9+ut08a<ZAu@uiy1P*a39rT0MggEWddF|8UV#fuRAU
z4>aEcI#Xz&JVQh%=OMd5PS98&iyb(8!F2><h{b*e(EK#x<o^s8CfYMbfZDJV_A{J;
zoYVMWDaahqo;6U~0`-?b`{qDuy#Knd1i2p+&!F%I_0K&R-Y_sQ)q&22!XMso4Gf@k
z1e#N-=~AwAXkw6=7|+1asLUYJ=nUQ$!7(u&ybfOi(!XJS3$hF37SMS~jrI&IpnfUD
z&eszdm})`$Lg02<EMV}#(f4JT0BR%KHGuDJ^!`(Q7i11-uFZqtwFd)JZOjzK-|#hB
z`yR4D*GRCKK<Dc|fcA8O@`7UngAQn}uGUsd1k?wu*{@wutLazJ$i=`?tKub68v$Au
z<N&&#6x9CU@c!$t6m<Vkb6f*M{T{!9`j$r`;d@#CHCn;@mY{JF9`C;nwUD&S2)<Vg
zv>(H9A45t*7XyRULne+!Plf~w(7mad3@mlec30HQQ3BtU44Ny1mSLd2j{xYNX=Pg`
zhWeR57{LANpT8^WlW$klOn)T;TC-kXeM-dpPu1P}pFaXXV-k>c?+h0}?g{_NpzE-R
z!J=UX0|TfHfovzJ{zJACWG1Lihr|;@4@ghA?XEhI9?%?jLnZ?YXgn5052(MNB3<DK
z>8FA2?c}N7`2%zhYd~WZXzd0QxX%spCnzs~*0$8o@e*m&Vn_g+qX|A671S<d1l45?
zpuMpF|DC9*J|zO`kAUp;{!<0ICx+27k;TA+;bi~=Q}rC!dPPvVjGQOI<1ljnKY+$A
zKyeFNAMO3u4m_?0id#?{*>Ns|4=BEIjOlSe$MSeUaSYl^4?4RJw8jnE4wV4asgV9L
zcrU7g_g}kQ&>Bb3d@jhnpnY_p@?`fy@R~sh@4t2>3`|v^^}>j;HBh|)tz$uL08m*1
zY9E5!-2AUWqj^6A=)OQux$FaKA2i1^uz3He$OXj@s2u}p!+8JqgRD2-#{jy2O{LzG
zc^N1Uk=I-KHL!s0B;@e^|9=ChUW25^7ZMCiRT0Q_8>l`5?H>Y-0fF4osm#C)a*KW^
z!+%hH-%!_}<H5jqq@kICLA!;4!*MP{0jRGU(js658XK(jR6scg9<&$Q;y!~!$9x7(
zi~kIc9s3!$Eae%(y#Lx}dN446_IHE!34`|X+E~nIkg(X#5N2_o!O{D#ttYsyhU}dV
zfwcb_eHs`UKzqJDb}KUQfWp>7kwL@zuPtc2+sFH_&D&0U1|D#k4@rjs-hXXwcFbqs
z4ryWgr`-a+FU!Pn4ugz#3j-^tpP}6XYLkNRegmCp0m|1Qpf(a@kG0KQP}vCGCk@&&
zp5p!22DJY-!~3sIV{<*YZ7ovkdGoqs6T_NN&0Te%wn1&?&1<0^9H2WfxkA(V|Al69
z*wnmouBg@at_XD#unN@_-&d<<ToIZsU{#xKAyVsQC=%+qLL@YO)xTPGYtS4rZ@v2C
zX&`^dM>25LM_B}fJm0jhz8$nqh=HqquSEbfpXGS}wE^wx)dAgs(rC{hQtx^hboX8X
z=!{=b_<;6F)@R(V0EHJMtgJsYfX12`8FXM`Aa&k<t>I@v!OkNEtyT13;8q2d(V#W=
zj{6vNK=p(N1M5auJJAtzH_T&D-Np+ZKLhm@EEO17X4*4wfXZPHhNmZx_Y-$2gZmE5
zps?5P1l^;;0Gd~4a@YrIv#^PR@{|Vy7pT3<;laT36E+?SU9ZIfYTtnO1S>LdfZPok
zGcLz@jw>ilLenvL9fCgi4kQK(sNEspcIQ3@&{-7V@oew^zc+%$OhNtxw+j>*z-<B#
z23F8`ehsKB^8Ww37rPoxP&#dZs>#HzhPMSI4%#yhG9Tmz(Acc^Un_%7X9ng@Wd^2D
zuLFFcnhkQGbpoBr42+<)^r4y#;Cux-s~P0ykW98b{Z4Qi7Rg9v;D@ypKysjVE{JAe
zDrcFZ_#M9P2sHLGfsw;z-$D*>9S9nSnApg{0b1h%FE2rT(mTc#p!ySBR)g-(Iq(U5
z7a!;j9Hcr4RJU<}>YawUpn9D#pretAO}hoOc7@Rfv37;g0CdJHY%PlQL&kHUu^T-}
zP#f42(no`gaSAldWf16C$RO*%z{t{F|NjqUo|TcoaT0?Hs5}GhnFOUpP@BF3B;O30
zCuK<RU|`4q#h3U0e+TP!N{Lw1gT^=hZ3W$51JU;nes*o69Aqy&XzweiEC;Ov0?na;
z?k=iN2kn!wxahFy{}NFB2}+CJ|NqSd+qv)m2mM(L%%FQ-p?8KQSU+H3sI~Yd(vit{
z$ov1lLa@4d3<ehUjK^v!q(I}~hBeK*L_quE>Ynbd0F^7C_9mzt2jx%i|Nm0;=Q9|9
z%!H0dfyyz7j)hF@-hVAX<sXmZr2nAxOC61k92}O392Vfcatx1r7??^m@WrjwK?V+Z
z+*U*O!`E!puBf?zh+D9qVR1WOxdOE2tX9go0v^YZc;NuG0~%(7;+Vk%6vrU<LE@P~
zCS)a>oz(*d7SK8+>xGQR^yER~qTss&B|?_6*?IppZ?skbuPx00^^FU)7(jb&cXZS;
zK-<BL9`!Ro`|%hpy#N2zt*Ml*bXde_0y=ZwqLzVUq7`Ud=g-TUdMS|!RSXOkwV*wQ
ze{O=t$0k%Uuvk<v@HFgZU_q+WLE{TDSnKq84dA<ZL2IMHb@;pn(3mi2pEzjE2}i@c
z1_O(w42h7qiGB*&TW(PW8WW1X>A}FT!f_IV48q-@d5%A|pg0G$UqN$AX5at+x8BPj
z;L!9Re8)ho*((uiTgH8$^igkiO2qsBA77Aq$9)Vo7L{Os34+>aHO;HQ{SeT7XP~qQ
zO0%FlM(W!iSJZoe_G|r<1kJ~Q&ZE+w%U}SuW8VKI-v9rtaNP92!~6gL3dc?V8@xfs
zMMBdFXzT%!Rvsu!QTz@*Qvuo+VVuCo!2{~6gYrEnpM%!1!Q$Lu9)kvG4H~GNg|0)B
z=}2T^&q!ui1uBDUlK+9u2!WQv96T0^97yGG5y5h}9x_*G;r-VXwR~(~0Plf@_Q@H+
zW#a$eE;a4S6*Vig!Q;*_Iq&~}IT)CVKzrT6d!E5<KhXL<NIOagUY3FGF@o+31^LyY
zfk6Ole=-9LsLc*4-#~r`&Cw(L&vc~|(tZcELq$OG<G7FM0O)LUaJy$-0|#gi9jFYj
zSiryv8l&<4?*d*s0_wX%)q~DH;sK5GfaWV2Z5Vp285jgYwGQxwTDjTPM+J$5YB|Y)
zY0V>gpmFAfHVjP@Eg3lKXIub{Gn+KpG9-Z3N;K3muz=hNN|PYBBDqrsw5Af&MgX0$
z)iAF?z*>fZ9W-`nv4BC``@c(KO%*6Ff$CN8o@Y?|4eB38P#XZWF69d--Gc7Fg1DRU
z2B_T)+H2Gq!{7z7x6_8f6J&R{41+tUUIMuXUN_k=c);qVdd@>4FgGK+6LbbE)NIh1
z{xV=c?S=Foy#E@fdN44ifX*oZ&F90;6R3@G(zE1XU<!420Ixr;bq^8&t>FvRWU+H%
z`2PgtXHXpgHCF|6E)S@U-f6=i2Trs57z8?P800}^61bf)A6zDZ&bv_o)m5N#89W#m
zUNp>W(6Fck<?ryHpf%$Sdl^_PDj9f?%904sm;{cp1X5Oj_E!E6-)X79U~kF50KV@4
z<bTk49-#6Ad@j(u1`F^1|F3|~mhk@n|4hTY1_$r||BryyVSvWSp?8p{fbP<@<X}*6
za$vBijd2pO)cF6P)9e2O&|Qt%T?`!#^ZtX@N?ftjVkiKu?FFxK-TVK7b{B(-<GlYT
zAmITX?{Wc+8-o1f{nv=m+5uGlGAsa@0S~u%;PZ<-K<)$Wy8yLYwL8FfuX!}aHTZ;b
z2w2r}Iq21T1i|{E3Z0$|?46tpY~Zz(9zi0ZUSIZs%27)PCeXSE0ZRwg1)w_4(t+v1
z#7G8~PEH2yPEQ7|P>ut9p<WGgwH!erot_Mwotg|BFf%}HoQaVP44{4BpuFV4aJvSw
z4&jdq15+O84DboCwE*Dq>i`48{zQftQ2%5CBSQ(OFAHklf%;pZ{u3yFd;kCa5;X1%
z8bbx0vD7dJw64McwEiUkv{nODZ(Aoan0Ws+cnWIggW7ALF*r~=8FUs1XzgXgLk0ow
zzXnG^{VR|>$b86H;qP9s+4KINuuNnq@L;$Fx?6h%$c-@ffyN*~XWV%I|D6artHA>G
zd>inXhNbiWKcMzCXiTF~nSlk=9|MiMgVK(Z1A{=T76S`tJwNEYDNs8a)(-YyxK+Zy
zlzRlWCkR~jA@?Dnb-gvLtgCBa@&3yWo<jx2J=l#47`VLudwvClm%T%f3n)C2qk_Hb
z=RaU@n8T3KysrVgXQI&>IxbPozyca00J#lb{_JD00Ogtb&I_P9L>*9@#{2(&a9;sB
zU&8?Eqk`^?_x_XR3F?1?+Ebvg_5S~V2H3xe3<@3$H>WT#<$(4cWA77V^$#1kzl-J{
zRfvC_{2~7F524&Y|3X3aHPk;m5dSbSc>l?)1f8{q-9I-#aRZKH<bIU*|9_DEn4r5Y
zL1)GM|1Ss%15kbe)wQ5F_F%X%hk+>@G(Ld6UaN$*<MwM;SiAiH4@v8Pf9fzZfX-;<
z0h!~$z$nq2%phaW5a5_B5fq|7`~QE?SbQ_6-b%S$(P#;c(@F*wP`O?|_i+VEyw3Z-
zr_qLip}z9~gTuW48$jvb`~P2Gh#mj8K<<lW5U`H=|G&A00W>DHpfQGFO2Zw7C7^n)
z=9S^KTF$_0HP1b-HQF$&0G(Mr;XeaIty(|;sEn!A@VsUz4=H0O+A~1*MQK9D2Rm&T
zRFLw3M6GR*NT())YOO}#I?x_0&|Mgyvv+D<1g>keWjHY7KZ9YYmYdzocm|zNtu_#?
z8>)2-MC(~<GJx(oiJ587U@$YDK_67UcraX7U|`DXn4<U(F&=o35qd5TqY13t014MW
z3qkAD9h(?IchCsfD+D+;bTSBl*T1Y}a7eZc3TZgW;9{M~z|ruM!2{H%X?n>ZW6i)2
z<Na5s7u2`#{;SifKOH>(B>@^A2hAyh>PS$%3aUpz<6!mQexru}K881-^<ed#CqVh?
z0i<8^`z$ye&I6x4Dgo-Vfchuie|1zlLHnv47#J)$85lu($DAA(Bx=QiL^?SbRBNRX
z;RYI~s#Ww70o4n$JsCK>|7yQ%lxOH^*w3(}F`i*cqdmh4P(51HrFpH^BM`J^gt1oD
zBcP_m@mkF)&ubP-|Nr;?tG%_+o&nSrQURO8$iNK>|JjZVyfYmcIKXk>$iNAT15o(S
zbY$R~smQ?N{a3pdw8x-fKEodGzuJXO|3T^I-wQ~Y@rM)SH|Ut3j`v^fK+8l%0}qC)
zISfphJg|EYK;@i81B1bSNBB8kCa}IeD89gFeEpeq5_F~)xSa>eV}EAt1f_e>ed?fa
z1g(4U{xfT7!@dU4o_z3`QQm)MfzAaJ0Lfc4Fere^dG9~78bNsg+RktQof{8Y3$ESy
z|DVHN28mEr7CVso346fnIYhkw%ucj-U|_Ufz#w4V$iM?i6UkBFI=28+MuPP(`u_l|
zfA0SqaQ%D1`W3wY|33gJTmJtCnd|*$wjhWGiGkWG-hXC-@9+rKWY7c62iJFAZ~)E4
zInHG;(4Wg7V!f9EbdP)kTu<xc3hzHN_kz}?fb4c?`hUm!|NjNei3~j9)eQQMO$;I7
zkK63L|IDZbjpKsy6sT?O{b#Nv$WBl>3gUyz^ZqjnbdS72aw-EOlwS%OU-15KD+z6X
zhJwbTKxf*5=Jh&l7#KnAE{A>pKXlqKFoDBx-~T6;i3|pyvc!Yo@)8E7bkIE<;4%^(
zub_2!koG(Ho)2)H4%$0o*TB#KntT2;^Dk&l2jm7&{6fWEHrh2n_N+EAh(N`zHrh3S
z&-1cqV32@{9R!WJfYva9^n=D-KyeKkdjZLV`x<{{g2s{;fa>vm2N^6t>rgBb*c2u(
zGNgd-|J|Wo;r-X(C1h@gF$7YNvMG4~N&0EizyRJG25KKb%5)}OP#@0w|6f<o{Ip{e
zqe^!y15<dEhYqNX<NeoQA*i40*u)5~Q$S;O-hYx+L17QlS6>@f;QjyK!}^-Gg7B4W
z|H8|T*MZ8)@J=?nN%t8*^J5&7>ls8Q+cQW^j%SbottW@Jd-rr&!or_ngEeTsEofeA
z0fUS+=pF*+%N5~s9Q3^ZB)Qhzc?|1Q@qp|M-z#U~{U=Gce(viEP#A4q$iU?R8s11?
zU`R+l09u#E400zZy?8J%=YrIDFffUBS~4){&j77;@z4RCh2^*pG#Agz*ig?P0nOJO
z-hXw$XXk?IW$(YbuAsH_pfm)UL!A5_Jio~S3OCC{h6E3WizN(9sT%m!JT^K*_QHYI
zV}j-e8=V<gCVDckG&(bIO!Q>nXmn-}ndk|gcaoUs$sp0_%pd`3YlHe{6Fu1!8l4$r
zY`qwGEWN;aRHD(7O~clUfe9pM>%hR1=vDuJq9>aQsC?<QXHWp8VbFO|oyrV~P_{~^
zGJ_J7EzzmWpbTd3gPbGh!63p4N^hWcBPh*UEMQ{*r8#hV%Vcnbq_;#92Bs9y+D=5f
z2l>2%xzIJ2)zTH9GrS<_jlmaG)`8~PK;iHGC!tn<uK$0>z2LQRp!o{$S_SXFdf;{S
z6Y3cpp>1Fu@4u>``EStqRw0x3Gq{50-azLe+9WVAO|)fm@&2m^9>1MX%ckK7+T&cq
zpfI_f!PbL8*s}Rw1Gs$jV5r(_Q4d=CQ>_Wg%ijP0#e(7yG@szXaQ*@VQ*r@vyjdhO
zD1iJ9YU4uN>msmx4GJGn{DH!x(UXB;qVxX;jh+lF6P^D*Y4l{^nCSffMI$H<H5nu(
zI{*JNQThK5P*{S(v7r+dhVdU5n3Db=+ZmFqU}mepz+Ka<B!X-&Xs-&`?iLRRP#8MQ
zWl#Xkr8a7@snoZ4fY0=5$YN8lN&f!@H1A{Uz`$y&^8Z_+*Z=?EGXVB7h=APNkjbWD
zll=c1=!`s&dm1ts96@b2(E4EyhI2O<n38gk-Gl4~u>FuSjRmC7`>&QIEF3`o0)++0
zd~o{st0lw0lmyye{sL4cfyznHzIIE8|Fb}6%s|6a2DC;OWG-lL9mrpxv;mqwZ&YPq
z0hJkzstg<x?HM>4RT+3d>xUXu!EG&xMpXt8P<~yg#=y4Go<VD&8Uw>ddj`FQY7873
z?HLRfsxfeZ_FgyIGdRxlbYQS_`2TT6rvqb1%OSfNnGVb$$%pJ_bUHB2$aG+t>FEHz
z@3JwT!F8iOgNCJo1IR2TORfL^HpVjug=#)j+i1_A<G~<0vk}x@No0@+)nxxS(Uw61
z)YbvbH-qMXC)zTA*5q?cv}ND`uU)Za;AymHkeF!809wN&GtrhoWT8ES)<zr9{$~cg
zjW!Gn3+)*UHrg<7EVO4Z+GqnRv(EZ3FeQN6(1>tTVF0=REXw@gUhw+D4=7=#0u3`2
zXqc%$!%PJlW-5>{LkW{i2gaG64osl@gzWc5dj?laPtaPb|Nlb0!2TE77!L{qk*WB?
zU_mV?KN1cH4~8=t3`_|q=hs*y{{h{XDvB-5InD*&<G~P;EMQgZDFL2KfVTS;K<T*A
zlg$fMMuO&VW^}Rzf%^5GoNPhb9SkCla~XJQIh{mibg%_ydND9g^knn$U|@Iy(l?`%
zEyII>;Q^Eln$x=inp5r6V$0O-1nWIgtK}s!qmwPmgMncOR9(IY1H&2+Tc(A9c|s=}
zXiRYq62Am=KQYLhMlH4y?M|luj&m7mz-?SDFOi8{Y$Y=~*+Apz86Z6~Iyph?7?Ao-
zEzSz<PVl^>55!*1N)HAG2Z$V7Mxh1+qhk|;!Hh1>CeWA>nz%%#7H5-oCxbZH&tP|R
zHiPoF2g9j93`}vLeg25@`XIb53SJ)tN=qQ~8nxK`8eTClglZhGtM9M?wc}SboMK=J
zRbTfHG|pAuZU7RS(Qt}^BUHW34$AM)Ze?HvjqB8OD_4NehnUMy0&3rcEEBM5$YKzw
z<uuT%)$jt(#en8>LE{YGfBHo`85uxjKWLu_hxecU)P)ef1yp`(BZRLJn#yM9{bvFz
zC~iYjL3blg2n3a5wW-k+-hU>{1-T7Wme(>nS9ma-;$dKl1?>-jx6?r7DySSqPG6w?
z2B7i>?035c7KgbEGL4>WDxf`JpuIqinrsTTn&2{Z2}~SR_Co5}|Nr6Y>>5C8_#HhM
z7$(><FfiIW|NjQMzofp)0bDjWYO-nAYJ$t%7+dH6A1u8XxV5_&IKXz;HAvKCf%o@^
z<Ya=@J^ud(I-dZ_{tsF=+zeW?56Y98AUi!k=h+E(FbJJ&sAmA#DFe#Wpt&_rpB~z`
z2hB-?_F)KkFq~vyV2S~a^T5LbISi2f->Avv0%{9@#vQ@_P=@#e)c39LbO4=4#N++{
z-`Y-R@R*lCt#fdN2g8X43`{YgHPWP;4-F?!`2z|ohq<8rFaLaz=M8Hzy(>Uz7_zqJ
zgb4#v45(j44Z94y|NngmvMW@}K@U8437WU`^sWH;uU0F#qEnfHIaKoiU#%yy8;);a
zV2TFq(ZcG68t8r#Seil#QwduK21Z*@m_qAihq<8npue%RA49^^gW-4x15-54^<gBM
zE#m$EFC)n8@c)PGW<O?N1cjpq!?6zxOi`eDZECn*#ryxCx#2It<}=JxW?&3|*<u&|
z-_35OG6U1>#|+F+J8Kx2qCj_x!0ohD{^I}|6Gu*q+MNtiu=MCSmvMu3GxK4Gc?_U3
zUIw%t4t&;{Ci7v~`Ewo&Ogx}70kDm6gUd25HZT1S@H{I|rxv(gkm-2E7G$Zw@L#(f
zT)y+vys{GMRA&p$<X~W&$OWn!7>|JFSwU(#J=lV@yBI_q_cCq(jU{(#u?2fDFfIX=
z+nt)Ax`S~Bl%46pz}SPNFB7V-0;(?ybcQ}uZ9eE+eJH!wgMl#w$}aa{VDx~Q(dfZe
zpxwpv-*GRaiKP|;BgmYI8f*ofTA;dv5fmmYotmJ!gHZ&gr_+P80#dFpGJw=~YJuyI
zF9><Ij6!z?M#n`A4>~o#b;u12xh94qogSP`+FcCdj(Zt)K+S0e*LiUbETFtPQH#y1
zQ;TzUrUnD&OfJsZpmNXB`TqfsoOTxjv%_452JL2sM8|my6_(EbCunzp?<dW%RQ}8X
zUc0oH!2;yxMo%_BkREW|y@$a;yP4;=!(0Xni{#HN&^`l$_y3>1HJQ?&Iuhh(NIFRN
z0^b+asf;+!9aQ&##v?)T21;{~^5O^!15@}N<TfqL4an&Zp62#4fbI)pL35V^)Ljxt
z?qc-*|6?o2U7^Y>pz~c+8tocT+*Xqyr-L{{ki`z<CJ%<gB@9gAJ|ws&K)aa-+;;%2
zUux83^YdU}h(L3nhjug1ABTMm4xsips4u$vAOi<9{Fp%Pa&Vjc{}0f3r3|RQ0y?h>
zl$Su~7s2up$bFD7J9L48DGYSi3nH&N|8danVvxcSW|;f*{(sW|r3YwQ$bqJX6r{8e
zVd?ytL%WNC-4T=)Kxa&OvH3yMfekdgO~C$1{>%dQ&jJQ!kUv2F@&5naqA{*P26QGB
z$S*TG;pa~ZcrY9iU|<SGX+wj`8c^AS(uS^=2JO-L09r>0Dytp$GH8UffX<xx3SI|i
zQP02_zT}V{X#E?=PS81j-v7S_z|s%c-Qc~8Y<{3R(_s$-vb$wKX$7PgbappLFUSn<
z|KA#5>7@QKBn{Uz{MP}kSM^{x7{b653c6bq5$@3Zf+O5Rz-dFSfd#Zq-BzLDf1>99
zKQ&z*785<d>BOT^1I2BiGy)0J1O{-Q9yAAx2-B}mU~U7=-GI_ZO@l1RZ2}$)2lg;9
zg@DchM~v+w-QNt$KcGH2s1Mg@%fQh*mw{oyd<G^^-P&l&z!It{VF9W~Yi%A^SgQE_
z2bKNdb67xk8uK{LWin}uYv90Ej@vpYc!J7^L@(z6(7CA-;~97?9hd}W+B0x(jAvj2
z^+!Ay7++W_{BLWFW#9pwr@GLdfv>(ZfWcuO<Bo;)3|x(|3<6O8iiP$JQsDTS$2bSH
zZ>OP_0d%%Xn?(Zyr^P}BE|7ljKP|N&af=29E{lZ>oZf$0a-n=~NV~Kpw$q-0yVH?@
z3u<mar#%B#ry~O=l<&}~$iUGV59b?z`~Wh0^Lz$24+cgBONIaKApSyo2DbW6@EQ^x
zkR2d(3+6M(S?p)v2FZK>X$GB*`2kZs!yPpBFt;m$_S0igzXnY`2gLjqP&;}87WFmA
z>O0`>X=w!Q<Hw@j2U-1s{qV3{2^y2YqFx4BeZzhRn0r9`#lT~)ptuE%ttV=N&PZn9
z2-Re;0iC@DYWIWMx!!+;A429v_KCpCRM@-~sILf`qqIl{?Wg#fnv?nezkcWc503K~
zWI*K#Xbh_PA$V;obd6l*4^SEC!LauV15@A`n0cVF3vBrhRDX4PGBD|PF$g*AW5@u_
zFY9+P7&+`?i0Ra1U<RkLeGH&_K>$?dg7Q<R7V{Zcd7G#SK6gh0JP*E)K?5|ti%ngj
zCd1#ETFi$)=hH&n2QMSA`}GTWUjz6otY!}ekUv4?1IW+F{so;Cg)Zj7knx3qDd55s
z#ovfB$bpdow6*~>&c6R33v|AT1$>4IDBmYM{{WuLYm{pc0i6+4^Vn0bmNO7EhsEN=
z@c%=jT!Rd#pU`O6ATg1Vp`cN&L1CgIgU3Wg#yt}m83jBTGI%W$Sp+;7_C$d8MS;?P
zO(yd)&^&Ue7LQG$CwSlc7wDc2o?1->15nuks;m4O7~o?};Ir!%GVp-r!9eZgMr8(#
zi7E^XE0r09CaN&7tW;(YnW)0R(W%TJIZ=gyXQeWOz(f@WfsSMbd4*=sdZz!a8|oQE
zI&B#gHrg|Yb<{E_LdA18)H6tQ+A=6@v}cg&sAW)wiid*A?G5z|GM%;zDjV$?<UAO5
zPgv;8zyRA9vCx@;Wur0*pKYTu0}GNo$3|raHY7gRMr8&L7{Ae(foG#K16Qc0n_Zyi
z5xqc9C%Hh+1AGfXdlHlp`#l#rGYD-|W)OhsTj<OnvQe2q2*z)8X3*HE%pihpPNOq}
z&O~Jf4RrB^&I|?<l^Jwk`Zp>w7(m1NhNXf(BWO&|qLG1Pqap(rD84o%G6;e9ytgV>
zSSlzmSR^nAfYxG9R0Q4e{?-)KCb4KxVDSF`S`@Sf8nl)dR3C!OWMJ|Goe>IO=efTT
zerAG=HE1spXdQg5G<bb0$Xw8RK2UuP8qaL*WN@@p@MnOz1LOvf{SbTK>|LnHz@^{G
z;P0@H;Yp*70z<A=n5%wQu%p8~hAWLR3Va}c*Q$6|1iBp23v_Xk3v@Za7t;JhEu@9T
z&intXOwgEuMe_fDpuT+ga@KuIof(+wyTE%(r@+DnlosndEkN_lPb?MunLy*_5ceEl
zs9)?|0dnt#L<T;P+r9t4(X>?XX9lSOiG##IYQ6uz5nPbSz~}w{-$GFO1)UFIk-(th
z{a4%+RL+3rB0&2>L3>3&d$2%dB4qyYFDqyt5~$q^3S&#qy*3OxIT)CHL1hFyOhNA2
zzmP!(I_?S&SCBhE_FF0(V5mukxD^z(2=~6O#O~hLi4gbx{Rnk0=$tzh@4sTL_}%*_
z6y#orJ9nfoF!{{DRnCISI#Brnat|o38$B5;XJj&1fbLYC=*eK|!LUPvfyoDD{XcB&
zKPc_N^n%vDdH;C|zAFfHzLfXhhl=(K7-keCGyG59JFUTS5rYco{1?Z0j0xJ!3{3V5
zn0_Vi{m=j!OSE6WXqdcL7qmABeBL1F%rwwk;Y51|OVIjWhj|Ptpt<b&IWIu_YCz*K
zmY}<r5;ehNv6kL{c^yILyflK;cY^mkt^lzMwHR0&ni&2-*`P5!kxqLC3s6}Psy9G$
zOQ5>1P>Tt4M|=sAx{Qu`aNmh1q*B1D-t&YWY)u1b-vnrV3+SAj1@#PS9t`n+L1rwd
zXV3`MWYdDwoAEC#Dna#5{M-%o3>pjS8I(L2;=yMYdN9OyPL5}=+)&S;1geWba-jNX
zA!tmTnSpVmJcAOb9thP`FawP>f$VCGYY+*^6tJq*^3a2h$0|13GuVReg?4QE_aIc0
zMP{NsXdZ?^z<vS4ljOY*4|xCo2ihm8;lZ#ign`M6xcHB2U})50ump#z7AWqw=`b*P
zf$l7a*Hc*QXox<OP))Wv{Z0l>$GPCUi#QzSFw}t7(${(fS2)fE&yg`X%wd3?l?b|*
zh0$>zX#YP$jy~u-;Jpl>ecK>;MW}iOhdB%mmYV-Rfa-6@xeP7~vKS0J7#LhEHUA#~
zi8<^AuU*txkinn@+6%HE3(Qwpkj0<}nrmK=#b5;5pRphdG_DRB2l@w|;{v674~DHi
z3{0NzGx5P~5X5~VGN3tbQ2GY-T|oQ1z<C7ZSGxv*1z8MA4KEoO7HTnQSR7_x+;ECP
zspci~GURvz)mt@LW(6Uc>~#}k7#Kpb-q(Tlb%N$zJQ%i|U|{lOz?CmS_M+R@$O*OY
zF$3d<R}4y^wHz?}Ky3_g{|&kq0W|i@z~lkCcMEUaHUDb>oe3!cN`K(A=mnamg`_=D
zIs~P^h4u_epzs2nZM@MQl$N)MFfe(b%qw6^7f`chh%}o8V)o`83{37Q{YsSnWG$pW
z2@V^(27%_6pgjVAL2Kw_K=XPv$*)A}UotNP^$9_BAE-|V2@7}7x?}i!4<0impk{*Z
zULs^BXl|AmGi4xV{@DrI`-R_~Zf}s&1Vk<BJS8k`fZ`lfhJfN7<X6zx9jKoPEh7{d
znA}j}p9r%g@R)@%u1JJgGI-1a-4lkGBSAhp3N?NeK;Z_tTlse_=-eofy`cC7-Lnje
zYxvnwiVO;ncy<Nd4@8XFDoAF7_D87@VRit@no8X6)<Bs3>nL&Vb^)z#gy&U|TR`*0
zHA}QBu;ndi+$-P?V;7XYu|%4ug2z0p@lU{g8hFeD?K_A2SG$>k9h*PFXR6sX_<;JE
z=yQ^wyHr7S0cigq=xiL&8Jy7jL_zfkXb+$RXg>sGUm$}F=o}DGUEuxy$5&804%D6l
z?NtPoZ5|Bk9T=FLQPw69a8m*fH-YQ~-AU>Kbra~!IMCfY0igN`w6+-PCeV6lkegzl
zZc0RQlMTd8>(($ZIiZZJ5^z%k4mYJh!wEDGYXiNX7vv_;oGK`sKy#^}HS(bGUyz$X
zce;vr|Nnj#$xRGUH%TxsIf2eyK#n_B9C7E;XxA_YhnqT}an%D2mkH2tnF6Y}L3hDI
z!sWXsk{eneZdf~ofywa*aybdwqlv=}6^(Wc3qX5M(f6H#+Pe*z;Cay)D4QoFnFEw|
ze4u<5nPdiLP&`8UA~MMgpt(^UC|^P*88ptsAOq#g$RsncgT_s~|9_hZayP`iYo0JL
zIfBMc5akl`Iv%7l&-?%PkDz)J)MluuHY)(_GYF}9Uk4g@*Y0FsbDYbN(-_yV1lt&1
z^M9~k5}N;m&!vxO{tw=d70~>jK>&1TpZ;9%-c||d`8gmOG{+3uqs-&||9d59Ueo*k
z4_#2c@c#exV)K9Sx+{U^|Dg3e3>?k>8Dv1~z(8wDz5oAf1<eD4_FQ=|tp35k<bbkX
z4_7(`g;S#^gGr$W3xi`5LyhBHhA)kA4J*KDgi8WtF9GNr1`h^?JJ2|~(vS)E*BQ{>
zat{WEBcL)66vm)322}5X>Ok-R|K@<iQN_MTG-QJPFrgunLB@lDp#!v5pi!=24anY_
z7ZQ54>`o$}_7tcNS&#{iQxy=sP?JFpG)^0m44!`o0QHL&WHN|N^kgtusL3D&IujgO
z40KNAf=mV}P+DG)2^y;a_07N4g3>a`JV@I30$Lvl%}=XNFfiGH&VDD@jsT^LMtcU6
zLM?FE_2@T)*K`JW|NpvIdoBZeO(uJZ<6K72S>hYOXZ3TvKn+junURolLqL5C&>h_k
z^`JKK|1S;T{gD6PSR{bPf&NB<*0p*6|C(Bp%w7VCV}>IQ^$egr`zJu__CV`V8|p!R
z`@h5c|5sat{R~qY;~KVLvwuN7I9z3*v`%9@gUNz=1~E|hO^jzSSr`uvH_)9f=;CrU
z$w8pKNIDDZ!D>_%)I-7+-3(CL1(}Z&XFQ;@M?vWX)E@U>SQ)~=WDA;CCN;b}kiwf2
z;$P_s$GMCGp!=J#`4`j&2f3%Ao`C}z-fyskHxp<t3M9P0Y(xud(0w|fGo(OaFXR3H
z{~quEUko93vzs{11&8$>Y<7df091}bX*!1W$C-$*Uj72ICxC&crdhed`~U9;`ppcC
zAhyFk&{*JK&^m_-1|}QOoCmx<sY#Q@+U5a`d4TqaELh2)w4jqg!(!?Gf8Kxox?<+{
zk0K0AHYvzw7FZ-R6oe$R*@5;q?_Y>Gmq)vqfgjYK2CX{<oiPXMSAfo6ah%HtsuMUs
z<pX-Vqxmm`O89?P4bXk;Aa?eD4u<gm>;HK$FlvDKpgWB~bohVvf7$;TK=%#`K=^D$
zpnc0AcJ_Y;P&?rZh+X`j!O_tE|Nr`zKSAa66R_AT2FLmb3~J&3<^OpwFkAqMh5u&*
z^?i?k*xCOX8p8jd2gz*#@x%YKSAq7Qg4o&r8Cb&qe+S9U0P%}og4C}12fFJP<Q|Z_
zJQx^i8f_U=K<C32YB4l8HZkOc+JpSSkkS|n758Ll2=!#u0FRY4G4MFf1D!X@z~L~D
z!67vMI>>yBhPezX1zijcA)TxmptFiWYC&NM8vh5?Con!}oF`*GgG2cL>;Ehg83aJ%
znidNgctCrBz5jn`1f7-I(8$1}-^{?|xEEBe{5@IIz@Qe=GXGyj3#d%`d=ZqMAz?EA
zA1DoZ|NnXr<R8%5i^f<66HA4k4ULTq5}>(?T2Bv)iM9+Tko~Po6BwARP};B9+6tgK
zwFUK{@dZCkP`Ls!4^)4H&9Y}O@nBdAIzgY{x)`WAMji~l53!rG<O&0mB})4Rn|nMM
z{0c#7-qPVG=w4xgMotEk4VerEwOj!fp!&yyVMz}IlO<^U0-kqpn4^is93v!iTo{-v
zLG?G*c}Gxuf$|6}&Omv@`~SPMus8$x7aDIRpu0~%brg8)B$0umPy>92umPx!XkN^~
zP`{GhBz!O1zglIzf|}$<BHsT$9JEwmV64@AVNk0jVF_B};Qjwg?P9oEcDq_-HJDmQ
z&{$hd@;ifq3{bve$N<~btXu&a!vn3^^Zx(kDrl?}bWWG||1Y4kmKZ^6!9%^+{?%#)
z7=ZR#)OvV;?9uT4|3wr@E$2d81_toFf)~48t!9`3XkP@#KG6MG$a7=hI89{G0FCv5
z(g-4bEc(L0WDe@T6ADKj(EKJO9N)G!Dl!Ow!>|*a_DvcRL3Q%yN^l>yM!EtN&ffoj
z?F6~i`~Q2}4WKjZYC-dD?+rK9Gl0u>kUQY%9-LMeWiT+ACm@%B`;q37k>V7|EpL8e
zcgv@@Xl~JkxaHkOgj?P%-B8b901g`kaC+51gv-J^3`}OAb&({5%bQ#rZb?LS%TMT7
z{ySA9w@7ZNXE4IymH-AOGf@8p(H2KqqlpwQ9H8<E5=XBeg4_a1Q=qdzKzB@g|NoQ=
zDz8BGHY9$2N_zi)yKn-ejV0s#|C29Nj>r4|$F&QU!Fw`5V{I(ZxKe23Vlb)Y^stzy
z1u9z>9AIEF1)Z-#D2$NZ<q5JI<PLE9fs~zhy#N2`1?LM$+JWW40`LDH!D*--e230k
zPf*$h*UwE1Jc*j%`iLV`lWhYeT{AF%*Ie6z?;((PoXa3kljUPj=mB2WB!fL{=YIk1
z%>$i%>HYr$l3i~)3E8y~l=mQZ@jLGQzoaJ14{VpiqW?3XW<CJ>36a+my#IfA2}*~c
zc=7)K0d}Vs=#F+3P<?~dPs-r)#u&6a8RQ-J{<mq2WnifFg80i}(SIGNU3a|yzyFCa
z`~6!`*#N4`K>omGHfRnK6wlh74E&CJ|2<d;HXG)Te-~h8GcXy0)&-If&o2|P$Md(P
z;4s06=l2&uZimG4YtY&8DtO{q9v06a|AFR22*>k0@cws5JikM->(xR~_~5aN9~RGG
zyY`{S^Z);#J8Z#zLW$@1j3EC&;`!ZIP#F%=53&nKT*yy^#xqEr<34Qh47Tfz_y2c-
zNM^GV5zqXvc!rpbEuJA}GcXyVoSTV!Rwnjx=6NMrIiunI{~aqRe?!X>0q_4`HhTYm
zX<3uZZh|Ol-adrN^LYP%>$s9&Su-bufyodweh=T{ihL(2cDFsdizN-Vc>n(bnu~($
ziv`v9THyNL!u$VQU(o(I@BhygL2UuZJnD<94WPSgS|3+<Fc_tR=2{`*uhx1nFf8%@
z|E3k9=h<5%J-!RzdJJ`u^vHtN6``b+MGPk1|KA|h|8Gu$%<=yJY%b^=w1znh3=OrQ
zF%83)6Tmcs0ccJb5&v&kq3Ux%>KDvmU|0ZFXRvicEdv8mnP-5g+h+Y?VA2Qm-$}^N
zPbXpt%M$PZpRR)a0~!xPgeAz0j39SG!s_`%kUv1{ggh7w6%pa_611<P$NT?lM<lg^
zAU{CV>VHJ2een>qwg_w&ET1g`opJGcCL%0e_k#3+&TxZ-nZZ_Qm}z+be{~n3?$t$*
zx&_U!u+r~D3oE2{z|1QQOnRU-KO}_JlT<8Wb;bMt$CY6B!@>&E&W!Q?|LSUUGiYx*
zyGi&QwtuyndIj|>Ux`4%?pY|Lt@*$J6c)8w5|)ke3@YIEofo)0$r0+sU;|QH)8bJv
zF`hxi`~M3;4+cga@Bc4fE{2;6Y9Fd0nfr95r2_+Ft>*)Snk)~CP%jqn-B4h&=YjSL
zBFwHy@c^I43|jjDG5>iec+Iapg9)fl18pydc>jOJixkF;pgR^qwb=ea+#g^7uD3J-
zu(}^)E?C~vqXJa6doVEgc>jN?i7@Y_>_S-v22foUs>N;xGqaY<1FLzpoRF{pmEA~r
z04ZLl|6yR#0nJ}vjaRU}a{oVo$`#Z;#G_8oxxS#bi>2rPKiZ%*&3hRvK<8?J)-f*F
z&!7Z4Q=*}+fhXj-fzg8b3>q~ry(=0(>&ce>{|h<?&->3?SMUE1Rbgoa(hp(e@c#e4
z6J)RV|3{!Y$pn@spy6BL{r`z4D1Ct94V)HY9vIYQKClGUDd6;gwiXWLPJPh$>pbv0
zHaqytnob5*NLqPZ;joVpG=41s;XeS4qw_%6k1D+XKRxTgz*yk@|8ZmZ9CkZP1_s7j
zt_KF7J5p;hJS-dKp=po<noc+vY$nPxsDSq5=yx!%f%?+=9niDRI~Z7NQoKR-fzGKC
zs7VO`*~L+l;ssAv-v6J1#vDNHAV`{ml*tX=|DS`~WZwTD_JYz!NHQ!vNf^}POG}R6
z`<6lOP|ydhC7#EiqTdC+zjqF(Yyj;Y0qqxpusuNT0j;rQsLAw#rN0vI|Ib!J;^U!U
zNHR3dX-OD>>f2Cv7Q31kWQ4;@P&k0cbp>iQq2ch-s{(gAof^Wxqy<_Rjy0Wv(kEs=
z_x@8@+5)9hNcv*9;QjxtCie2@St#!E=iyaIUL#!o)T$^!%b&*+A?450Oj!9-tBG9p
zJk$lH;qXp&yIM~VQ2$E>v{tHCL&6fAj*-f>S`{gH8Ud9N-v1xn^k87v0QLv09%y0+
z@&5mGA}FpP?X9P+<dr?}xDW9D|70z~yeA7m?gf`Unh-aG+Q|?%2Vl($wVFW{p!|S4
zUMJTuFlm$^p94X-J#&v2OT4yt|9>3_4i8wp0?9iT-v6J}LfR(x0%2u|_x}g1i1v(j
zE2ta+<$3S_5AQ<SGmp1I^~fUh+^<EnXS6br^!Q?L&pcs8gx%wxAalI`-#rUzpMcr{
zpgiZnpv?)bn+?4GKXyb?ZwgfpZvTMV0+9BM=0~(T8mT=qNr!<+U4w{m1EhZFor74y
zvc&uUD^@IF338($$X$@Ix_1!d4^SJzgF(v?5grd_g7$ZM|9@17q}CDS2Z&ltq_*G#
zLG10BM<)?s@n|ndAEG^@c@-LF8s7gOA=R~y7(wa~?HP@uXkmp^?@eT3U{VF`Er+iG
zL|*@Ak;otcEl&h2Kx+jKd=l~ge|swE-W5<;0tz$GcmgPlz~fhQ83G)eKy8jkf(?xf
zB2c$Wc>jN~*Zcq7nV@lT&^)g9|A(<?@^iia-&I{1%fJBY7u0G=UIUHqIyQms5PEnN
zYL1Ba|A#vp4l^(`fX)<2WZ(hS#U2a>3!!xz==@;N9%_|DO%Bl6ssf<)i>1Q%f6%tB
z3h1m5XnVrL`~QQR2y-8t1=$VichqWmUeoUU|KDLQ16Y5e7t}0y1{F((@BhGKj`0jC
zXnENJYKMsjL;n^ACKb@W7(^M3G+vLrjK1Xv>Ni2dlmjhHJs@HFU@y2I1<BU}-v6Ix
zdjG#Y7n%lQy#GJoM3eXQ{(rj`6!)O{U&lqDyEh+HLjBC+{r|ozXkQdGJY>B8--o3&
zkent+4$Y59>89@j1Cugn{Fekj-i*cLM^L)a@cw`QCaNEvwR-=*wG%Xl2lZ!$_y7Bf
zXlfF@|KFMlQUmp?3uvvT_y7C72*2Ko1o@{{lf4A$Uj^^~_h9kQ<Ng1hB}^W-pL_2x
zFezO?nX_+Z;KMdv4H~O<oXe;Ix*GsI|AIL$tP+w8nSW`>WKhXS=3od(2F+bCYJm8l
z`4<o!lFa@Obf<&|1ET<h51D@fu``mv<6U1s?1E$lN5t7_3{SvfSqzRf2@Gl>$&mRM
zkXT4EWc~%j&PZlx2uX&_zkv85$&mRM5IZB8fh8mvGXDbN7i5CeLgrsU?g6<Als_9a
z8B{>?t?>C5Wsn~jQW`y>;-0AUFQC0?p!^S>e{qJ)zkt*hLe;_MUqJJ3pf)3H{sqJb
zjgw?LGdP4KU;hW1)9_&E31DDS1g&3#&mDl;W!U1w`~N@iSf=;?>svu_13E(xbT{9E
zOa>*;8fnnn?1oGRCD8l?Y_0;F&pkoon%yrLm=r+k`M~znv?%-lt+TA@)UK#$)v$os
zSF2`VF#&Yf!ZGlf3vVoy|NpBw>0=P8^`j0n23zatRRJE4w`*Vk`5Dr-;Q*ag!V&7l
znl{msL8agn0|!D5yyk%;)QjCjzny^rB=0znK?l_Kut@&@zt&m8pyrf>C0P9;)IJ(W
zEhLP(br_fwKx@3gZU?zLB=g-bP`erCZjhTnWjx4@puMo*HM+_&1_hZ6jL@|XDh?3y
zSwM5ap<e7e5axHCVPKL+$rGTog4Jx8zaeHdfZE%j_3EKsY<Zx#P4oh%X91AeAU}nA
zv2B3Oi-N>JYa>8wB)tFsH(_9sk3r6dmI~kBVY3sYA9Vf+Xe|Xue<K%z3Us_$1!|TD
z1CzV}vRMV04Gh@Kf`x@6#qR%C!oVa4I)@1!CzQEg4z#8ZZWd_l5}*4W7J$<VDEvjh
zVGkNRCpzr^?qFb&1&s;9?W4f$J`7B<pf#;<vuai<SJY}6RMad{fafbv`m9xfoD&4j
zQ=O1J1<FsLG)pi~brH-{8lXG{&QDne1oBh+9R?;DkpJOpFF@-7kk{hE^O9Wy!{U_;
zdW&B&$T@({k&J8LSdhuU2i}Y73AqOXw3Zgs4hHS70JSBN*Zg|_zqSR`SA**1AyMxM
zP~AhKo+k`UGN3h$MET8OAA=2OUH^hk2B`&^40_G47(o8z^ZtJYbS{((XpJkZEsX3h
z(E22(zd-sWu;>>Ag$q9Ypgp}<^r;fkSCjd#pjKI`q9#)!0J5h@8nmVjp8i5I*+KhE
zIdSD5M^KxPlR>4Bi$TC~5rYJ%oU%w}WCN|OO7vm?wc&Xz9sa)q)g1-(|M@}X7HD6c
z_y6AuLFF-s?ZMDGgMmp3CI6FW@4sI}*sF<TFK7=O*sq}dfFbpV?BxG5aDnny{o`LE
z;s4pd=lyyA|FsgKr{#mC0s|MQe5_UWo(9qf+S4Wfl7TB!(?t)g_rF8{Snq%Ditxvv
zebK)%k@Rn1V3GvQ2_ohy8yN(k`-@aS{UUIFd8{M?%FEy~R+B*ml&3*!JwWHEhW}-=
z1FfG1<qz-wKWBpGPAw7`I6&tdg3gw-cmP^k@p~_5EgwjY2SbYi1Cyi;$~tF~?PNi=
z^C{F$0W>>35q383VPKL#nG*}iVzCS9WU<?y$RGmsuMX&}9*}=Qed_vVh@U}wp+W0a
z!1Iz#pff`m7(si5Lb_V)!s}b?LN#0L>i-9cfab#L|9gpm!ovIiFHrvqbe^0-ed_HB
z&>5$oeV5+<e{C&)$-oF&7Xz-RkjDUR8B{>?>mYMH7@Fbh*Y|_MX0eh;_<lA!P<(*W
z=mbUv6^K1QG@*Wng!i)76_D`$<qP&Z_)d(b1F*10n8kw4thrFLAmNBG3v}Ly0?1wu
zhNcn*CUMYt$nY`<`5dtN$4cO{)j;k9?P&q&0i_%7|35)@<|x!Jd0l}NN1!tymV(k$
z{rm?GpuFlhhk>Vl{tE|(J>WVJ)JFu5mxJ;tXl)(HJP(G(51{l8O6TD8Uaw#Q5(lMq
z@BiO>5ox;-v>pJSpK4Il{ZK_x2U^dMOWjT+b)fx?V1I-CyhI`ZG$&RwN4X+=F`L~4
zM$np~Z=khl;B$+?{)C6&*Hk3;gW7vI%wd6=^Br_9uK>8-X?+a7rydfoUu6;IG=SQ?
zSj_?DGl+Y>cUmMcC}5iN<tman3mBM0;b8!2gA!5BdNQaKdN2rp`UIf3vq)xOOY~v@
zw-2?O8Rmn_Vu%{>zBs6w1n^o+PX?8cdRTb|4jbs%eho4VOrr2|5SLp(;SS2DptJ=_
zKS*|g+ygH6t^fc31uFO8ZkmtbCYZVfP<4!;bOuUG-v7T`M8tbNd@Uy^-mMq^|Bsdz
zWxW4?SqLukS{{S$WM!;}#5;rc|IfLIaIUw2-4lf{2PGfMc>n(@3EE2vTK^0>pBKp-
zP<jQQ73;xJ2TK2tcwflCWBvI5e^5Uf<Zeiuf1L`B^Chn#Zh7__R3<Qh?(0Lir4Cf)
zL(FJo-~ioGjp?V)ptboNm~Q#{5y>3T8b~yA(Eaqq6}z9lg6c7tpJd=+1NIXGcs?HC
zr!NPw`w5(Opk~y<_c1`q1!eFVqL6aob15P|YeDzuA?0^ubzgXq)WO@nnC5*!YA@90
zFfa*$&RYbB11QZRw>Lp&uOg>aP(A>c{Yc~H^?w;IfYKf)9fJJq{r^)SC_RDBegT~Y
z46R2Qy#Ieh%KtTQ7?=b>b7EAm7jl-c_y13z@=E~I-VaL=ab8oxz$6G-6G*YWP`^F}
z#Vr;)4Uz0*s7aRi0a{-RY8OJ-EOsz9h-P3CxMQinzzM1wYE`_af!c_mIsz0Q(E43O
zR+E9VLGJ&PT1|z3LQMwnc?XV73==^83yYKg|0}Fy;8b|Yz)|aFU{I58XHb*jVPNU@
z|9?%go<S%Fn_aE51n9gPhMHvOije2*|3LlKLRRouejGK)#ucD(0MK|vBGNn?Xb<T`
zE(R6Q`RyT@=l_BBn1k*;Y}8@^je~;57kEJIP)*jfiCW+`fB?v!9t_n23`_zXmI@4l
z1pFjOz)yk-FBt@|`-z1Le(EREPoVt`RW=Mv{3ezP42lH&q=>~&J+OEJ`9<L+gMy+b
zgCZ!7YSL{CYLY_?Kw}9O%l`kbSu9}ziXTuskse3<MES>qp|XI1i7$hkGzS{50gZ2g
z=5Rpi19T4*_>9~Y3@Rb%?EgZRvV+z>i&(t;{~vS)HYhEE`~&j8LMH=9t&4&IX#JYS
zk^lc|js;jKdNOd<WCa-1oC>aJIKiM&a2k>(YrT}=X)@s$WbQZQ7=sPS&Iu>LX;LL5
z`Q*Pw4F;9^W(@|=8QO`O&@nGidenfV$53ZBI}e761_mbH3UbmTh5i-5;$K1X{o751
ze?e)rd;$X#PY0Q4bpt4j8|F2D_CJX<9AQui$zcB%atso$mYo0pgU;!$$#5|U<zW8@
zj@Ok83bn2p1|WT)^>G$Y|NpOf6<`5cFQ@R5L9r&?!l2g6x}xC;gG#|`So~^NfX>AO
zl{pE|q4E118oy7#@v9S(%>S=Z1r)yqnDMIuIwzZf1C$m)^&aSa7Y~NA84OI^DE;4p
zF6?_J9hw*fz~{N_V*u@`D^S#8;Hb$6FsMoP1D%t^SgRRe0NP(xlk5RHCk|Y07Nj#U
zHgaOFM*!W6IFS?VW|@$z^Z)9*EFkkmo(w99Uf?vz1FAdWW3fo%pXl`|s4fNh2U3of
zo?u|&0<8%G*ZH9OprDI^A5=fU>IGQ+jKx0!)bUS0mHY!rmnA<Km^eXmg2?`n$L1f$
zCWaD4Ed~XMAABf`6Mlkz0PQ`4rUw<|@o8M~<H1m(!@$G|>JK6O(uqB-IW{p=C~`7z
zfbvSMmxDn~x`TnG7pQLbGXV7gKy`CXvUNp4215fVoj}I#A$bC{<_es?Ji+NpB_!kG
zzL2bw|7yLQDxm#(0gxVOIx_*WLFo*1HZRye^B6$>0iF2<nHzwNF{AfSq4jog1OpQX
z%J_FdC-(FP^^*W$KOxUa;PTVteIZ%hB>Jg=0Tgy1|Kf@x&={5nLs1I@6FaCMgd9(}
z(p&+kZie{D!k{M82NF*i76!G>@N%FMWG8g28y=2GaikEE!T&ELOZ*@7oF0Pl1M&xG
zz5;A6_VEJ&4~D`$3`}hB@eoj10N&S&v{x2Z7J&9bI?iS2fX2U%q6-74Ee0;rYHAd~
zdr9hNKd!*Go(nYg5#G#Z2U_Ru{r_33HfUe$KJa{z254*vbcZiUU-+E!|3bCc|JBb4
z0GD;px)*fbxC*#EXb&!*9V}Y@|F20=FevC`XaMO0r)}i1BhY!~4&UoR=h}eeL37=S
znhY)=`$6MC;mM%-yI>0g6Dw#=7(Ujg-NL}XpE$pR?ocPe?<_FCd*b$cKZ$;C0IfHJ
ztfeH$@1Qa>e+L5-3uycg-e&=w`KjH)AP?$`L+b$<P`u%Y{~S<y2F1HV3WEY<F2V!r
zT0YSD9Vpzr|3Bje`Q2e2gAOQ8!n^qYg=(<F(lZY<t~rq6Ii$YxaRq2iM6Hc?1*rT1
zt)T*~4X|GF|3Ao#nyeRw;5>uP{|yY_@Ii}v36Og{81nWoFfoJtj~w^xc;dbRmhLTG
z{{M%pDGM;DsZk>#-9PRH`5)BR0i}0nx|ay=ytp6a7sn<B0caRtP46HzH7RNa1zq5_
z4ru=fq?~}B9cW1~z2_cbU}6G|0V4YuUwWs&&#?6VI1;;`Clm5B=*%h5`jskB9)`xD
z11KFq@-HY2=X_ycVnUh!!AQSzAoFmbaWQE5RRfAg(D;z!Jcb06xU5w%sMVAJ-9Zda
zH=s6TB2u~njUj^U_x}IbReKHtBk26*@Rj2K!dHR%M*%QBxZ)7up9KsIX#N4OVfA3h
z(O_U=1nmig*C`<_>~)qb|NkSmWwbjO*g$y_H0B5L7wEhWMHOf}z|+G3)E21qkgx>x
zp}=j;6g7iddj*R|4`>?`X`E%E2ZKsM7I-fzNBw_q3&?!PgQuXjB8ct5kUfWii2?OY
zn-+FEEN<e%;wDHvPL`V*KxY*|-2^(b?x7&WO`v$s=3rp_|0kq{?H|Y;+8qpXzH`Cn
zCBnl^QH4PPTt20!7$AooXuW2G-2Vr#Fam`SC~QFC2nsK3VFao}LE+>uhXL#!$QaE-
z@ckknwg*F21q0)M(D)A`U$x?`M<(dEg3n9~QFLVxsL9kYsA&l^sF~vp>Pv#_6i_`1
zUMp`8jWeWl2)bJ&ycw3i?*Bx}UubnHk@d;a|Nm=JH4F+?Qc|B}W-u`R1D%zRTA#F{
z)hBzwYfWJHdoVc8Wq^f6Nlli9fkG;SLQRW|LCu`t3Q+tJSFhaP3JL?N)GJFVtyeNq
z7#RP8&a@#mEzE$Xg$U)PptPW8P}B0lz|!^q|C+f->0$Tl3Y_U-k9I})Vpw{(`w~<(
zLF*VDXdR;xzOwsY_}<C;YHeRt6t84p1l1*Y>KjB^m4H!JDTIU1<w&n!VEhAW|H9*2
z8$GV~V8nF?$gj|{HwWZLSUsxf%Af!$duwWS3_yFlYFYveYUaL%v?W3NIgrvnq8z@v
z7vxv!m&0ib7#M$p=6~RExZjZhdOj?J3Mfp$W!+rmiux9b08rThs#`!|TBrrCn>noK
z{Qn<5i_NaS`o<6N-D3Z5PpnUQT~XhnU{PQD!lI_-bp^h*Ye?6{eIcDE|AE$FgUke(
z4Qb<o`~C1XQb8y9P97C-Uqut#p5_SEWH$lTQ=obhWVZ)H>InwMU!b`F3jM=^?4L$V
z|KKh^Lb@jJ3+e2pl7CWuFfjfCoe6;O4^o?**!Tgp1HJ#>uB^|z@uODjbw#c13yb=$
z0E=4B*Oj0)C%9dSTvx_3sDx_p{|nWE^ua)Cz-<J`SPW!MTs(L!0O+11+;P$j+KZQB
z!NB+vbx$;sA3*5}oW^RUE5c{9*@4det>63N2ly-?@S5hEj`d4^gU(rEsA+j%QNRC(
zMNP}^ih>U8eSOgQPe{kbeIZ?lK0c^l2u@ST?gy>ugRMV;^yxw8V}RH6fy@A>spQ)g
z9t_D942(ZO`5$W>pt_%h1ova_*Msa1>6pAPqzloXr_B9HI~W+hgWCV_@(a1&gY14#
zIsu12B-}mgSH1XA>-oE)HvWf2t>y!ZTCLxepuRR}3=f=Ukmfo-<9DI%{Qp8d#Q%Zr
z90I8Urx^}tKIULe1F0$WfUfz%9_G+KOA-eI<9C$xKQ+my>&`%F2Dv<f^`*T3Ul#<G
zA)q!C;;iw+0}PDcK>c5MyNLwz8nKvHz`*zov?qid^FCrR4?gb=nQv4=n!miZ733F4
z`zrxH_J^tNI%wSobS^ys)b|0q4U0O^dFwEBYZw^6g35oeTF{sXXstGKI}#Sopm^`}
zWMHoKVlS!5lDxJdlYt4;o(7$t?$E@*1G@JCv<6kbivfJkJ1G8PYw|&3gP=4FTCWdE
z-yr{ZFeK<OFn&cD{{!tWz-9MJPX;ECy&+jGb|AYqdNS~V>@3J=U~pW-AOJe&8Fa=o
zXv_#SpF-IF_%$WVA#LxPr3@EJPB$=wtYonZS=wR;THjQ2jNwAa2^PDMV=Z>I9-h}~
z)jY4&a%f(wZ;x=OS*CdnbRSu$XNz5}hL;FvPiCk_gB)l*P%T$*Ma@brk%`U>3=@_x
zF!+M*zHtV%EdqYjdNEu8i8s11Fx0vS{0P-zu>;*J9O}_x7pes^D@X)vhPoH%oO1^7
z+$Q4}Q2CFD9~|cwf$HUk{S4r<;w|Qb&iMGR3cA}4lx{%n4A6acpfxriHaMO@`zZE-
z@2FIP?ZW`alQMX2l5wIkWd6s4A+Cji@iVCWgS!E19K|&-bZRj$*JMgw+mOY;6q0<*
z4%D9j#|0My#12jm3$PuK`A<gJoTmpvoB{*mXBE)AAZ*?immLeW7?==tw1Dl{kj219
zoISBS7#Kgn*8qUhdq^sa9ag*K8W<Wi7#Kp;Sio@;lG$Qc^VINK%}K*+HA@4p)oKP_
zt68Qc67sCYuI8wbNXT;*yO6^zb|J?a<Z6|@L~4#(SAfEL!V3n5i5d(%VE1`I!@(08
z4jRy~hR(HlFvLnQFn)rshXA<`yk;2b++bLK1g%Y5Xv@Ilu!unhw6+qo4u5we0|)3#
zTF`oG@Bd43YBkwSYU<fb>N|g5tN-)!8mN4)|L+mt{r}oj{bq)G$G!hg%$~~ty5C7+
z_FvGM(lHYl7(asMf8ccmPW%5gFf88Bz_&0SpBomx2;bWvSHCj2qNbMJq`vd@wfa3T
zA@0}<b_cJ1bNzqEz5kDZ+8CA!|LgSUfbxom1?YSYQ2k-4@E^4I&;rpGzHo8#d<Le?
z`x*Ew6G8hkqwg><et@rs0)<&f216Yv?SbytMXu{Yxqj4v!Y`Ed2ZLn-gB*Asu9JBg
zQa!@cJfDFfRGp#DVIKqNo)sC)a9u1?-})e+=7~i>4J&g+!Z8L$%k2OEog5f+YFZx%
z)U+rH)U*Ty)VC`*gdF3r3HAC>SIZD#;IQZa8IXGK|NpOm)(SZ6`@f`qj)Q~a-2Zbx
zds!_V{^x~iG8_ZNQO#X%aDM=K?8N*3`J0pXgYOuVm^>eJR$<f=2FCaB^*|th<BY3)
z4Garo@x{|3hx#t*X|*<zkhpmn5a9j)N}+x;11N4Tpr(<i90tbsDE(iY_7asw79N46
zk@`;QY4v-cZUCo`%Wpw<6M*jgt8eyTaNPU<0P*SM+)C7R61jze@f~RVpQyCm7|+1d
zydQk8J&ydfkjIjNK@l{T3_9D<VgZ9ZXq_kMZ26kwF9d3i84A=K^9ZQ#GH?i=!(kJu
z`J=8TMZ>^h4g*h3yE14Wvq=5&7Xh_y0RbR>@*D<6&>iPa4F8XS>NSUb|9k4^N`TTw
z3%I@D@IMcf2T;?**`t%^L({~5P@0Iiz`*zxwf}?E)&{N31f_pazX2)Dt3c0u<fu<(
zxX=hb1CkMRW?Kw+-(V9s96<LwaxC7@z@<MIJf5QfN~hL)L1&R%n7GiML9W)?O9XU(
z2JDQL&HEX+p!zu`?+4xc!j>};e0CHAxQ*xi|3W0PK2UqxgCT;4f$=S<{KMMTrjh&C
zg6<Q7x*v4rCipBMBHUk!tPkS;a32Q7Hz@Oe*y<MW-WR(D+~+GZzL7w#3qfo3v6%x}
z^U^5Spt4YlL8y^~fx%Mq|3C0vXHMp28?_jO7J4!0fb80RkbxuA8FKDAsBQr5uK}&~
zXJC8{S_=rT*9q98fn?7g672!?|KRpu^9!i`0=frqp*;iW98Mw7UJTgz^GIjK3xV2>
z(6i!&JQzY>FfhIXory+_**Zj;4LU0xWOfgz><6{M&}onu45Q1z_%L}8&A|8yR9?c}
z2s$$kISfF40_96ko&>eCVRwpy_QOHh9H4txp==(|{qj(@0O*W%C>wM?H0a)O1`mdi
z3k-~}K=TE}+6lU+oT1T~0ert4)I5-#3Q#u4P8BE{WTys{4YE@Q#P(naiD6)TIRQD{
zS~4&)fXYTt8IJ5<P&o<rZ(M^x%_~nm&^->8nhc=(hQ5I6Zc7J7@O>SixObe#AX4k>
zp;znS3A>Z%3n<Jy7=m9gFunwp7w|G2ZT%(qemKw>rl7EG{?`CH`&G^R{~yrVR-kiU
z;rD8I|Nk@50(|b>A6MAD8s7i^)Pl-f@Be=cL4Md!55B8F0(5tX2Sad14Fk)Xj${S~
z#2tZb;B|=%j4x2?8EkF>^|Kq28B9R#^8WvS=Zty=!A4sK36Pncnut3QL3gAz+A=6$
z5$6HzCBP!i+i1(6fkm9J(Uw66i#UIyErS6TanOEk2GE$CV-v%L##jaiP`%_hk6}%x
zJ@}sBx<pNehM8KBd;4&>oehWE*>Sj?1Bcr=ak!nUGoFF9(U!qsrYFQ5Ah*r5W$*-@
z=Lu>TH`FySAn$SV{<FLQ(ryd{?E?p=8_?QmP&*McUJF{&54w-TB7uR+`v3p`-v4%O
zY^VjD{q#>%8`K_}#~=ba%LO!^1lp_WFz^2jsCgk44GbL?3z%Pc|Np;&f$`a%DT;qj
z!1^;27@2JLD>BJ|=9@wGG$%9IG%7PVG&(bQfbv4KG6P4gHK@Jd;n2v;zyL}Y;g;+c
zpnbWP3JlB>HTVQNZ5br>I~fc>_X%r*=)DXQ`kf34j`J8m=ct0#nS##SmeKEIFahNm
z{Z58Aj{6uStR2B;cS|(KGGx?8fzLYTX^v}Pv5o?tEe_hNk`i9?qYkvUrTHa;i1)vp
zd-Z2BFj!js|5xA1yv%VPgMpI+gThiy2BuK1Lw12&E_$FoFDT8_I{eoGol{+$$-wBa
zhyiql>>MYD|6d?-|8#h`7#MsQ7<EAELp=`J1$wyXZRG@=FZusYjS4qt9*DuZ`v3o}
zDoh;pRkuVyc7e_+0<VEjxn1G?`$6wQM<)1vTA+FdY_`IG9nhV0Aa?zOe>yz!5PLxS
z!vC|_fyNI(ciINObkW<W$i(6O`+;j?EQ3d*ErX3^B9jGZzt2Ql(3!LT6BrnuqU<w8
zE~`LukD&Mg#RsSiZq($Hn5fK<;r;&~xPRTK$zTI=19F}P)w!U(*PwbARM&#)T<?E7
zG8h=2fYKbiOa|2z$aW#w!?MtmVNb3n_`W;P{m}{*2@HIoJJo7E<qQfn7#KlgE}*@}
zp!?Y%Wuf042F52S^(<)40h{@tvkVr-Gsxt6{Qs}t(b5G<Ki>cUXM)N&(EUjca~UKS
z$}=3u<@*0$zw1B9evVMi@8G@NpgY?<82mu<KH$6qD%(J187NJI@{#xdKYu~xiNXB;
z|3Q7BkQN3rix!3ru=_nh;g23(ps@1(x7`zzUqR(9D8C~5v4240Q((J5?Gun4AUhkC
z8GM=-Gq8aA*r0Wijmiu<shSL+aSNSB6$YJ#6b6P;$X)9?jV=rZ`dtk2j{6uCKz1~$
zFmQnE0L2T)o~bGf0p9<A1%Uifs0H3XC;(Ce6}RlP2j{zI4)YiUK=)!MYBqq*ujFWq
zXJ7%1v4HMcw{`gSJJIXU--+&^@lD<*p!I1JJ$aur#xv*?dN3$BHZe#va`G{N#zw(;
znt_2~A}1e1qdbE_s279H#CXvD@&BMOmWcIouxsSxeE{04IMI{$fd_-n9|p!pDEkax
z;Q%U68kHFgnjbSTfYOhwCPPk5y%%`Tp7~;i7{?}tj7DXK6@^+1Ob$&99-a0K9*yw~
z4&ZyLx)>N{+B0~}v}f=H^|fJTIcUtt`~PoKP*`Ec$G;NLnOWX{7J<$vVgcXhWY53?
zDFb~%7#JUd##s-*$~~I}3@iytCqLMS=!dw}R7!*EWzd=%iw1@UP~K{;YhY=pYv5>(
z2Hm;yE3^4u0|#h5pW`A1k%qbk0q;KxcY^YZ2Ln6kE-jWqWd;_9MJx)I^1OF!9U2(w
z8yqz1+k-1=9ysbcH2wclKBs}fVG+BBr2>Qe<a*wciT1n;z~!ht?+Qx=CWeXjylbrM
zc|r3EA{Gl6L?-{|EdZ4nljrl!0qsX<)MQ|oJfC;R<oUc?LNz^fCeP<xGSQxQ!{qtA
zd%S<&ZnaeSzhI_4FKCUh!%TbLi?#~Ce$SrITbro)=kM(Kyr-M)^FC<W&-<iVih-l)
z7X!~kD+Z3qvlw_L&*yzGc|Pxxnw?8l)$Crn3N!}MD9<}*@_gPa4gYyd5;++JChzB6
zG0~oPPNzL@O=CQ7LBn!b+nx=y2bR@wE(1@)y#|SzV;<`YPBO4KHZhnqsxt6^@&YK0
zHk{&pVsVUtal$FyCk^v?7g!u%V5~W&U{G_?yJDg$sGrCn(Wu4y#1fQWw0NI1+Vd`$
zsLH^R$iX1kaEkZAM0wshpt7S;o_9g5hJ!)P3FnH5T)Yn&-5EFvJs{()775HRy#H;U
z>cPPHrg=Ya0qD%HLJ#oyj0T<YyfvWoAL_+sr`^Q>a<2?%J#e8GgE43>w$Yxq0yMre
z(Vn-Wp`C#Rl*YXO|K14lFX(&~hkc9{AT@;=3=Samo$<W2iCzp$Gvj${L#^5OfcTxZ
z44$BST0vzOsQw4}9h`>Y?EqeI+YQtf@c#cJ6Li;`<2=xLRJ`D`9vqt(LK<xuWIE${
z>tJmMP+O%lp0^%}uhJRM+knK^=#1xWMB?jo#`88I@j>P_Bk>hF<9S<<_#pFIk@z6<
z+K~7l^V;Ejd)|sd4RHL5fXdX)c-{_}93;%XPi(Yhu;`5E?SzTrE?+mkv{YbVnrO=>
z&<HYD3mmp0miD{_6K(l;Kx4wz4Ga#A_Pl%Q=Xh6u#^FF|9kegNqMo<F`~R<6P`Log
zuNDhR4ZQz<1E2i^&7+`uT?D-U%oA;>Ymfo$_4NKTj}vs}RP%fW8|wwkFF<8}t-=!>
z*xjjxS_~WxO$-^3bhOdeeDDAN4o&~>G}>d<r_eU2N~1l449Fbhx)yYIiGC;Ot_o%g
zklPcL85t(j^X~CrVD_;{U~uqYV0J;cn}N&w|2JOHIT)Zh14y|tHxYE!Z1a9Tp8DUv
zE36tASU}|f#GeeT-v7Ve1&upE{n=uXz<$B|--fwJYPh`rf87aIlgZHFxQHQP@@`Og
zGH!6(%a8(E)9)~kaY=aB`+rTf;Ir-+iaQw;9p^E`K+|jr=x*gkO$Hv&`GF2i3?U75
z4H}@mciw;I9Bs5^@B!U3JJFWGXVPp?-0=x$cQP<J%=^E@gMlGHyOV+0aUR1LZBQ8O
zV^jd$8vrsFq|b341L%Hak4{@~*}w!Eg9fFWiS~Q~-v7UY&YlF7xjNo|=EQn1F#HJb
zeE$!m7vw(BS_2RpY7T4-UO=KI6BGEp7sy?RJ|KC}+A)y(Ky_oG1_Ot~A_nj}FYo`~
z)`G&x`~R1hpztZ~Wat3pXQ&<~ke*5NL2mi419F%5|8KR8)_ek>d;J{t{R7=0zyVGt
zi~fPjX3$<skU8G}|NSZMWO%9H$>0Dwccr+40aOly#==F4yBHKfWtT$}Xw5DoLt`w1
z59rQn@Bja&fZ8`8dnQ_g?EJA6G#62n!QkM~^beFL=77`LA_f&uIs(;kkh+a`kN2P1
zwvF}-@Vc(io_7wkZQ;^s&wH^@lR*&_R^WDsJ?|cHc-Zsq0ht35cbLb(W2wLhs&l|%
zp;~OZpgE?A@w|I1=JOt?S+ZnR&CaE(EFBmaCdTv5X}Hh30Hn83p0_}|jRAB%whpL$
zVex|Z4!DgG&$|G;X2{FHpyq&uM$NH+ikbtK;Cinyo`C_>Mw=|fz%l6;15c?3L&K!|
zybmVr=Y8VX#9$HX#pIW$%-}FF9&}bMgGQ%4Z>N4IgNnnvKSvts8Wg<$%nEF@Yf!Ot
zU|<II>%IT~S!0<9%115%42(BlOi}zl0amx~JqW+&wFK1m0M+9ly`Z`i6o-!U7#%=k
z7~notv2+Efey`cBT@gOb&90%7fhD~Bm|ghPHoNdC$Ly>ZFfdv>g6{43x)N0PTRAW=
zS}8E7SSv8dTQe{)STX!RVEKT-!SVnD6KJgmsE!8J+upw~{{*#ZCdD&wOseOTn5oFX
z3u=?iQe=>vt;oO^s>$RxTaiH+bT49~U4zK1hYb9)6B$G%XEHE=&L*49$RISEkwI|Q
zK?Z?BEe3^I3mL>`H8P0JZe$PzwXtVD1kEupaLi(4kVw>I2#4CuH1i+>&qPI#d%ug;
zq)JzU&O<9$$po5<<bmEDrlZ{oUOQ>fsmLG<x-S%TRv2{rl*f7jsGalQ0(8Ha_n#Se
zEfW5N_I-iMQHzFo4L06?W}JkycNjqZGe*lqh5`=;ryUH8H&Ui3{<DC^fyDyGmi>y1
zYe4P535<+qtQ#3Pz;V(1xB?U(4f7ftynkQzY_w}|v2<iy(p=ZzVex>00~EKm3Xgab
zH3d>8Dl&rW`-zH-OF(^`iJp9*y%r1;J$c_u^yK|B(GzrEJA?d0PX-@L2L|?uo(ut&
z4h;1ZJsCo59T*xCz1ZX$IT={MW;#6LP4p6An5fD7VxlL5Kq3c2!$eO85lb(yJZPLr
z2F&JUV6kNQ|9_$<g94P#F_V+Q)0W}aZ}1#3M7>5L$Dh9tdEO5bJsEUt86NS1_=y|>
zpz$aJ5PKpggUdu|1_n!x?{{XrWB}buy<(y#gGF;(gAeE~3$Pkb2AheV3=R{eK;r}~
zYdXCc7!Z9^Hc<Lw(C=cXw^m?CskH~6{RwJ!26!+qRp`%UNOqjd)MAmKF5vxd73j=Y
zj6NUeoGph%OrZPELcIS>=WUE<aIw^4U;))vwF*A)de72<A+*t+K>=1@TPiTD0-e!1
zQv>8Kwl$6N3<^kW70^M2pnJo?;-G`Q7}(Z;=0IR=b&y#gJ32iP{sGMwfW?r;kw9%R
z{Vs-3Q2P*CXRZRB<JC~t5aIo2S}Z8vS~@T=f#T4Ef#FG`J%fRz1H%HCI~(m896I9}
zJYal_1cnpd|5i=~<vmb;0#sIl%!RoNDqo7O&nAI^DIwYOgZICckqz~rag{fFLFqgp
z`EY>uzm={~v6WDIA-Jw?0^hF}<NasqRwT8O-v7bv1$1{}jFn*vk47s72JjdoCo_2L
ztJc9)$C8s-02FRuwgUr$B`5O?7{3veM;sV<EIA=#bRab#F<S@z|A}7w%$A&xwh36=
zo{s}GKLRPE7+WSPGEVXSeLm1qkrA|yRRL6PfYvL3>LbwjCg|KX{kh@=)_Xza#os9n
zbqxvLf2N#7i<5v_+tb%%H5pRs=Xx+W%=-)KhoyM`nX=IP|KE(-7%vgf_~}G0$QWv)
zH3NgCCp7&rgy`^aK*mSF{$U8!u}ow<0SZeG2D=Fij8_DvDE@AMmnjVl44}J=EEX^^
z>^;b00V!KpT0nh#P}yRU$iOkNk;MeGUftS(Aq7;<c>g|E*gUU6rO}3g0n~;E-RA?z
zFUt!-<vEUa9cZ4(M}M|>fps+lBWRyA#P5^Og4?P#3=Gx@pgm7)8Tzvsk{$N`-%x9P
z84?DwL1FNJK|@_biua$%b3yexq%FCe5j3`iX!DgCG*>Z5c>jMR3Q9}$!Ivu#ZNJH>
z9t=z^4YL?nK<YvDj5Vm<Imp6cwE%Q>&3jp^2mir!t(5}<leHofhn2$riB=5^j8+W)
z-&;OlV7ENLzyOJ729dhMn=2+dvS@h!KAYMo&%j`*@c#`+%%XvTX%c7-jDyK<)<YJF
ziSi5#o$?GGGZk4RXF0O)%w%NYZDeEt^}pOEGO}<q$~A~gS^=sbKI{a|tu{KcXgD@8
z_!MNq>le^nizeF5pfLOQpp%hBxR8^9#c|QUE6_1ok@{)|lkn=Bb)Ytd_y7M1ka}iP
zsrUbX8$fLlkT~cr*P72kpt6~1!EpwekQ0aO0#3N-ZDePVabo!YVr4LcjGi<Ds9a=l
zn8YCAum=>5Zx@2b=Rso_-v9rlIPCeCpg)6w!C@Xl!@^(&1??{L6QF*Wc2{wa!#;)_
zSlHAnpRVx!ea075hJe@>4Ghe)9x_SHbY$XfbY$X~#mFQ%^C6RPq89_(tVSlDiH=Mh
zGY>L}c>jOD6=WZ%Z3Qx4A8hX5Hz2k(0|TQz$i995WuSLxZ*iE!u)+KPo4MM}49pI5
z83YyvGt?D&g74s-u~3*nV{tHplBLK0|Jq#){~YK3U1A;e|9`j_3#gyU?>P7G6lC{K
zWCX?K>6sumH!`wl)JN^EfVmy+Zbc?Zkb6Pyp2^500&@3kM<xmH|L^`n;)g+?BaulM
zc5WlcFAn?u>R3B~;`d+5<YG{mzJ3eJOWMs0EKoOJgTy1VPh&6x2WX4{G-op5GK0W`
z&kQ2gpz%;I2DOR7;JpwG6N8x)CI&O9Yz$`7*%-{Ew=tN>!2AE}pN+u`5+HLN<}t>A
z>;<)z7X~vX6ncX1Spl_Ea=iacNNkwbP+*bB!qKp=p~U;&)?CoIs`vlbk)V4P9p*Bq
zEDUC-3H4x6((iBp?`a0>Z(@MySF|W*knvz(-ncNBVbX+R27w8a8AJ*_8A1CRctG{e
z#9$^FSUfm3F`Q`l%)qhWGQ**SR}73GKZKlOQPS@Mo1L;?GsCNe!VJ$A1~WVfS=}JF
zU^ByuP>u$<S}*5{+End|nw7zzww6u7DeygoCLn($ykcMmnd2~zK?G7B|Nmd#65!x4
zmqDc9qypF-3C|gXCwyk$SQyN(CDe=cU7-i4zsbNclaYy|F_?j;&=Zt@7(_r}0cztl
z>}#m-{<kF&)SfQ%1luJ5ii<=q1`d#2mJSR8pfGO~2E_p*I1UQA7??o)8&KX#^!ooF
z6fe!j3_Qh}3=IxV3;_#1Gi<SR|NkE}7Ovg(|1W49r{EQM%!DVAgOOpPFayUzVTK)`
z^ogvdkduJ}WG=*hCI*oGjqwZ-`dticpfc0@|I4+Iw8N;eFqi?Hb{zIG$`pgvXhX)&
zYP|pSRW{T$G<g5%E3|&VzyNCJK+5NZ7eW4orh7)vog1KY^FZad{(P1VpmV+)_Ay96
z%H=*&a2p{8+;`B?pARmR_teIpz9#F%kWxQCfWcwj|22>@xsTKP|NjLOY8V)r|24G8
z?`6obp3ER)v4BAwTsIzI;H;VdO2ndtA<Tn;@g;~27H?sYuvow#ZE=7>(}RKWB9geH
z#R3K{ivtXz9t?~-7aB7hY7Ax&so(!fBvg|%Yho;@{r>+ysB8!I|7O}U@Pg9u%vdlD
zI!BOgVmw2H_y0c|8iScMLcQ4bO$=tz0JQ-?@#Ovg-<8Hj78A=vmIhFt6>_(mxd#K|
z8PGW^h_iGR8F(P|A%hO6E(Fzmpn4kG=K<AWb3$s_>>BDIey-W0T~Tw(xB@h%RKNI@
zi1z&d|C?(WL>%TaXoP1r$l0qfFxFRl1XwI!V6e6S|KHm3|9|V342%g&|NjTw>seoa
z^IE;Vl1Tm2-xZ*E1I3m1|4+5xINApu8}0D^(=)fG{y~5T1A_`^PO3f%JdeUtuX4J=
z`~Uw5pl}6^?||xi&^cos3}$l{Ix{4J)~-Ou>|z!&Gb{_`g6Bh%1<4HO7IZS4TIk7e
zX2DB_6CueBav?1Zay7}p6*W(kD{8WoLHUrUkc)-EXAy(Kf=-4ikogNW87jc)TD&Vj
zbKf8_P}%~qVROSFOF3*nZJ(NCEfLTeJ)k)X(Ac|0+yDPHUCI@pG7B`WSM%6Qul~jF
z3QMp5|3aQ0va5OF`3@uon*X2i0#rZ$zX7VZz5mTgthJXCu}EfMte@}U0LoYT^Z$d^
zp@REPCZID}HM}bv7BPr`>;=u2fZEs|45ll3L31o!pgFYvcR=%442-9@AfNRPN=p+M
z8BF#)gv7hG!vFu)3=Is;j~Ohi9ze$2C)zVi0H*_ch8#;x1{v`Ex%OTn%_|vr^yh--
zPo~s6Ff0rAWQnU)U<8e0sf6#AumH_V*J|DpS=`CM)R4)*0`3#fVYRbp`TwV;<&lW@
zzZ(ZZ>j5n0{Qpyv`9jb8_w~7;wtubGt#!4Uhbutq`)ajr>otPx^<)6e`!R=l30Q%~
zb!+2;L?&y2?^WcPXwQ%XivLOf8FK0!7*)Lg|Brx%g8|6x773uVW&%Ik4U{gx^9zj(
z9H4Xy>c3koU|?%r%wS=W!oX(H$spkU`^Z=Q`K<38<}z?tKVW^=P|IKg8nXhWQ}5qL
zZi4tV^QA<*|6M=ZD9ZpEA6Bq9Ak3iO!N3s8DPd9b%1fl?l(!zJKT^x(wJwpvfuWYm
zTd)2FyU9j&1|~~}28NnfUh8UJI9Jqiu$zG7Ky6ph{Y<u+?-RgmPd*M<A1>9afdM22
z>bru{ocHfTwxF>h6!n^X9I)|6@VLwz2GG13gZJ-4f;BY~0ou*nI~?ZzzW@mj1`bf#
zg3N0eS6DhYGS~Vsx7F%1wSj2RU4E8apt7HVvDVAMpjI=uqE?@|4V2DttNs5EG`CZ$
z8DIfZ3p@J?RA<1#9F(>|V;C@hPW0rHSQyXXV5`u;P^%eYP^+5UR%@8tX1zdNz`mh@
zp*A3?ZJ|AbLw%=@0qFig(79}ow(#t)&~eoV*83S8Kx1Ft|Nn#bE;HCVC@>(I&j6M4
z1f}<h_6$?d{Sd0jsswT~Bs`2V7#L6VAm<ZU{s83_P+JC6HrgvNG1xmaFxWFNGFUxm
z0MBWA|2_)7)2q3e!2%S{wQ5#v_0O!@YTc~bYT2yXO4XSe!v8aza%f@@0hMK-u`|dy
z4NMv!zT-XylUl{3wpzvHHd}=Q47KVYx`CnAIJpfp7T%D_VBr1xw5qLw3`4Dgb(;qR
zLr9@J1Eb?2h7eHS1m@@FPCgMH8AzX~c`t(n=*+%`x(1d7a~T}G|Fruer<=*0e4uiJ
z5oBKd1M4=ByFC~fXMp0Y6mmC^M6Fv=TdiAiTfG8E9@MvFU@TP!w}C#?3MI8Iv|(@n
z-8)n7>0?mK?qTV;h~Wmvy<j;{28U2D35$BK5QAFw0MOkU8)}7;+bkUzSV8O9L4CwV
zPll9GHwlZH7e?!9GmJz)Ye*gEFmyOMFtjXq&A=4$oYl@^`Tzggt*mcBXBX70Fj`lz
zg!w;c%&*atA)#i4k)FjXh6MdC2F{S@95$eJ=QS^_L^dpkmJyx|383-h$(dl<qv0e&
zM#xbCE6`f@hE#?c{pSDw9rrN=G-@(T0OcLfyZ~rC&-+iCVm$-I&))z4nSjb}hk5@%
zbMqCo9!BeGy>?gBda;|-dKl|9dNRxa**npbVTSkr{{{`240H6`7??qGRiLtaLMFqU
zhD?S9HIJ=CCcI==(D0gpWuhxX4X8gc;Uoj7&%-gHlOaRDi-8$r4oG~WCqs(&|9?*=
zXM*WFmWiM>2>M$r6&#ss^&t7x)`5XJRFiogY`zH8x3pzo;FzewFd>nHA#|b&19)tB
zq6))|i7MbRa|O`ZPM|(INDaC?dfou#3tNTv35lAbkTQsqfdN!Tz{-k5O#=py8c?|e
zDjygaj|NOp{GS2uZ!chA+qaM*2imTfQ!`5$GCx`?U15>TAkh4nL8Jb_Cs5l|#QXOF
zc>k-Ru0g_sf$0mVKkofs(6(NIVOh8)q>cfV@3s!_6BgGqI3#-UGEB5*h?!{5kTB7n
zA!VXHLk6f$m}t*XFwvf&WTHJo1-R_gVqmaHU`VMizg^+|Z~9J9JE-2}a)tN*e_Iu;
z8Q4R$1gt>i186P}WOkw#FL-=wB6tlD%NpzX3=W{ShWGzppu5H}%b4cJ71j-)^)bI5
zBA0KCntTkfa=BDPfdMr41ez~*oW~#mD#t*3488wN*Yy7X{|u<#37TW_{?oh?bZ3FB
z0|S4emy<)SX7Dsne$?({Fmjm706I&_$<l#=1Jr-f?qmoCwbvcyGDs+DGNjaMdJ5EP
zdhZC;Vz99EVo*SK%S2B;7Est_*Dx?{RAh*#pTl5cY0aPzKIdi~s9vw1<*64wht00h
zo*@F14;=O}sDSIe#jh*8|Lm0nm7^fO2ZQQTklVfgO)Io!WQc%?gVv|ivmLJR{<AA^
zp&~;>p(c3k4u``&h7Qp9yVU{a7v6uGmV*2Ome*iVaA*Rx^@Tef_Av-F)HSGh|7mIk
zjTzNyZN6r;ih)s9llet`mj|eC#$%Ddpy&Ok$rfVw)UTNK?z~yIYBi``xCAuM<o&0~
z(k6j{Jt29ag7?3vM?r1}>GA%vw-m&#sgMTW>*M`rUv8s4!xT`R3i3B-osM=hgBU2R
zK=lPEFE;FJ0Pmq|*w+B+8|u`v9IjY!A5@+;{?(q%zzAw9SpEM0PkRRQ3(#Ct*mnsF
zO9cj&TFo7xbweiFGZ<39;x8pEK>ZBR9(K?=F6|i%Tp)WudwoG;>)wAFL3jH3K+>Qn
zJPq0^FqkK59%!poNNz)l9|wyB1qSawoog+U`TvJxGN^;*r$FN&4f7f-y#F*NLdtWd
z7nYtJpnReMT8lB!o<RY01_x+-6%-d6JsB7_dNME}nJZzDAfVv=r!&+dnL$1znE`ZX
zq76vB#eD|QSspf^@}se?fdSOEw@7GVuxJ2}ceAYYWMD}2asZhJ8YB8Y(Vn3P5)RDE
zK<&Fw1_3K@8;P4iPrrkK8QfM{<*m12IRn!Kb_N!QeGCGiwo$@!2Zowg-g+RmB?kjz
z&2#CBn&<2$Ah9WJ;Bmkmov{o8p!6N;;h@(U%OD7<|G;~c7+BU!^yHK2v}F+LjAan+
zlw}YN)pXDUwPQMC8AM=gQ2!UgcCN7Xg0#CPYVj$6;<GWHL8H;0LC0YpgG#MqHmJU0
zsP#;4s|`(VtJNrOvs7S6sMV+j)xip&u&CusZmShdZmV_3ZmU&*$}3d2p|ovOlG|zx
z!12dm>mY&BMgh46=7vTsJ{DM+0ZLDy8Z1H!>KPnB<wGhb<1Ek}2B7p5s>#Bas>vV)
zx)VN?lQBwr4ucMut=R}EtF`#RYj|uO7y>|H11<+WLG!E(==LXo!V$FAB++XEvb$0s
z;y+T5^n=bdVF1mcA&G(Z%7Vl=ki;TDZnRZk;0L+MR)Il&qCJC*r2}|xKC&GmAUhi4
z8Dx<3N+732(3}zIye5leh5*pHq29kYu+}Rus({Mt$?*)Jc76n?{;^DCnBl>o(Zj&F
z4|Fct4757P23iN@STjQAkwE#qp80Tv^+E<dQ2*2F00SeaF0y*?|9`{01`(?T4Bx$f
z?|2DfgZc>Ivg7xTn+<gh4xs$+{d+fOLtTRlXidQ6hYSkfd9UBQzJkUeCn|#WLoqN;
z{=?8P`47W{i8c%^lm9SGX|8J!k+)@Ft53OI0XEa(ln7|t&HMMxrJ(UpP}?wkrGQnf
zjhD!TOoj;_42&Tb2@E#ge_Bu0)Js=_`gsj?4IUsnz5moUdN44Ufcl^o3m9y?e{ToP
zt3B}k(>k}N3anP4p{~IPsx}nV=J)>7tOzL+7{TYES}b6A;Qf31L`z2o1(3a<es!&8
zfF8(g7WE7Q6Rj8+ynk<hx_K9a!=zgbQ$S`k%xi$e!@otcjdl$o&2|kblj9jIK;=rK
zT|>k~dj_3GyM`Fh{`E$?22j1M(P#-CI|r5HIdu<{+v=Vtx7B@4ZmV0A+}0e|U}KTM
z;0)?tf$QYo>r^cg7~DW?keK)Hb)pst4DLvLR*M7%7X*LpSBnG&S0w(^NjD+;1-*ao
zy4f(VA){emLk`I8-hVc})CZkgHID%_Ps!;0|6d6-?PPc`s0B1CGq8kowb_NVu;|r#
z1_Xq9Hpn$PGw{^3cvpmUw%LK|hme(QRyCd86{(sHp!2ObKy%`tyj80Zs?(^<AP};Y
zeIKZ82@>m6MXYxQ*)vm(0lfE-O7`r5*;BJXPltyU(&h)*vtb$39%lv?kh?+t30cZ!
zRjcI@5USZA2lG!&t9Av*Pbo_q7#fwq?PZRHr3{Q9x7RH21^WlYMxN&bnLm-b{s4#9
zjH8fwLXi2Owj|ZV=zzWs+-xd^OU(gaxS0%$yN<xdfk1oKKx049GDie7E(7W}PH1M}
znXs5a094L^#y=)1GunXG5lmEO1g$6Fn5fL?0^S3m%;*8$|Deq11De~PsLUAP!JvGF
zfpHgTzXf~^qQwFR(AhZ9c`ODOOXwUqXl-w8b24n6oWc9|7R5$+1`$h#|8p!F7$?-^
zNLN@UFfdrG`2WA*K7&B5Yw)$2m0|_8nv7FwJ%dDQRh6&RdU=TyaxySGG%=W1JYYzv
zd0~A`<~c(Oc%3I`t$2s>HJKL13H2Qcpg9r&{Wb=s+5`r*(CqL3WR^1KS{(cTKjfHz
zRn5{Mky;-EJrE7rdsgcjBvPv#Bx32nz+USad=0b)L)MFd9h5dF+Jn|4D7|4|+*txT
zztbjxfiWRDu)&gnPoP#y`Wh&FLE#E2+d+F}LE#J<X9I<Et#d#?Etm7P2D$%NK;b))
zg@HqsgHNE=BOt(%fx!kOH<5*bMV5oX1|&Ao1=N>i-&E)U_M?b?Cu1(CO>N1*m<PE7
ziZKT?&Th%Tm|Lsi5di9!f%Z5~bYT!_lxtuCt)Z}VV33{Y!N3Aqvl8kqU{&+NN~GcW
z|3BdKkmoQ6)T+bvJpr$se!w6D8pE3Kf`J9Jh8naU9JE$<q6>q-L=^@e(3)!R|NlUH
z=E3{Kpk+HFXkEkPhYT_n2N^g(achylkO8_c!Ta~q%uYoHPS74LP}&CFOB<^ByiQh=
zfvZ-_O9Zqwq*IZB3yU~Qry>J4RD2(jdX7#-23{=UJe`URJfWKGb)Y!v1g$^OVz&#`
zeEttfuRy0F13yIXLpzwbr6&7@iS`U49t?^S42;`B`$yno&dC1Tk91$1^+ISJT`vu}
zCm?|#0~Dv;zn_54^#Jdm0foU#MbKI(2CiBz?`bfzK<CScvMZR$axid#;<=NNfwSgS
za78EwgF&sAbHz+Y22RlWW{@5<bzErbxEkXbIIyVWhN?4yn#bMg$iNfo!C=uC&ma-%
z#a;($ht70l-~p$1F7Ih*_VA+V2d$|Pz+w*{NF6BdLpc~sKz4!h@JvSrK1&CNlv<Bq
z@Z3bLmqS3UmiM$!4FxlBm}>?E)N*=P%v5CH_x}Aj5Y(=Kt~F+8nAgDK{ioCu)CPcz
zm&@0H%G!`jH#<;%t5x={2y{N87wGIH7wCL|4<rY>X9JYpKxgQH+D$dHl`Cp?X;;+T
zHLhr=0nPXQKL|~itls}RB0*!+pgwN>{~H$d^DltbvWb}Q{r}&w@&6T&-JmgBP<jQW
zTMq`gHw=thLHqT<YvDn88suisz7<fu28|tp%1%)HJ2o*K0IiL;RQUf2y549D$X?KW
zp5FiegU3ZflG%;C|Nl1xr3cXceKrRe7%gfUSQ1(efcq;6$J!Qn|NpNGI>X+fi6No+
zKLblcJ%fw)|9^iIk{KGj|Nr|sp`O8|p`O9R`~Sa}P_c&->KQyN68@j7Z<es|{{Qcy
zMS}nX=q`DS1p*8f^$aW)2jm^R|NpxR>d%492Hn*I+N0zBr+8!i%GaQMu^b?GgT@&_
z;q1X63p(=xoX^4GI$ycMqLo1&v=*UezLE&2y%N&GU;+wv(AqNVxeOfM{|-i4?`4ny
z&9Q>yz5oC7w6qss2-Rdzn^MET0@?##KmUfq<QN7KhdB%~^>bc0)Ysn#0I&O*hZz4w
zguN_izrzPmc?v2=!DnjBSFUJO=2QW-3moS$*fe@Fuz<#;K>c8lyFqgajh+k)jmn$~
zp<YdKp~^cZ)H+L7c>n*q7u1%oRhF&*g$t<8^I(uwnWFgb2grQTx{C>nj64$?8TRP0
zGcfEu$Z)`VA%i+-&u+~u<%*hZ+7&f7j4Q(TGMF?y=JcrfX<gy4iIoS`HZMBK_`g<x
zK`m5M{vT*9NT_ClTCIimHPCzs=zf~;{{}{&^Y%e^f_VRFoN1}>|9?#lXzd!y9Z)*3
zSiq0~YQI~BGbnifUb7G+25MV^$8>(LnHcVQ{-16q14EKC15<c#znv8W0|Ugq`hTG&
z0#*|h8P<6J|8uv|nt`Qm_9Brc6NVhnIzUkR0)<Om0fR}Hz|A`NxYD294;ybYuuMo~
z*bv5bgCiupF%C2~r`-o$(<+d8l7X>SlffiZ^JZPR$FaJw0tdZRjs}KM<ped*e1YY;
z|Nm<Rnk(uAf-C9-tSjo6LE-x+)>47NLA#HEaY8Kv%S2lS4#&L=0w6mrKxyOuKTBKC
zT1;C8fr+*ZA`Y7vB<j@W7+C&g5CEOg4e}Fc9CV@$0|Ut46Kxn+Y!w>#5;Zv(K<)mC
zHVhmV3qb4s{^o+_o*m{fH-OaD_dl-i{{Q<SXf4EqS_T1!xePBr>+Y=>7#Jr$WLOc#
zWnff$CrG4T^l(Mp#myCAmaKNlmH`ammJB-eGgmNx#zyLPuC4&NE#$}#hT8MR6%+Ls
z7$)j5u!L(j#3i)wG=Rnt95yj<BrI)UsA-9=aOh(IjrV}=5#X>$U}ONbQzsl`*iy3?
z6b`>b>r}ccCgd@2)T^GZs6AX<;r;*5PKcYC&Vcw<0-!mx-@1*83@aKAGHjUuSrfUT
zW~cYGf|U%QyIVLijxjLS?OYL9XLw4)@*IN$$S;nK|6Lq5f%g&kfc)2}$gn1i-N2~c
z#!AH2fsvs$#!?Stw$aM}|LeA{6qp#vz!J8VLC>bNfzcwlx54}WubmSr892awy8pk{
zPRM6qNM6jqWNpNd;QjyCT&ukd2@}d06hPr!=RCQh{?9KF?|*w+L20vY$?6L4e|sxI
zX&4ml-v9RIHkmW9fYf>a|CKnQkU^rMkb%Yf|F6)HWVU_Y|9|;TC}d!1C<K+izZ?^i
zL3geGvIM2=355&{2`vo_;Iglffu*KZxdKw|{W1lGlj9u5CE-!x`#|MDb`%4%_wVH|
zjidhmuaCMY5XNa>R2;>>z*6)7fto_;iaHrD5$h=C7a(_l-0l5uFZlj;h<o?^1i2OD
zX77J{-Zm6~($CMWp!G-&ix?s-rZLEa)(O?L91;PQW#0exoNWFME^isU|Nra_NoM=x
z{r_hx*v<6}5ck%D%4*2i62#3v8$oV%*aKRN!SJR|xx2#q_j1en<_ivvbN=Ue|NlRy
zp%%2(<fkpz-X?}6A(?De+K~N&367AxgrL3}XzWzLaUMg62LnTdb|*ssXf1$tC&L2h
zzC#Dl9igCn>cPO^6OzUMuhwIRfu+O$f3d+c>>5KDa_X`IEI@Vp#1QbjqXuYf3v>>w
zr2+%!907@fOwgKZ(3)rl&^_~@vz3)Xl3VH~T62ojGam?;EX@hp$H)V!BPLpNLe2~L
zQ{3BV%_)+r*}!0^`Tsv?3>P%t4GLH9KgEThvJ5m|uHVMMVEurB$#L$lFW&!u3p6$|
z?6FK_<N%e)wT+Dm9t`5}bDQ90dA)Q+Loz6R{7?)@W;gNv|3ea#CMMK_)^<5S>a7I~
z43KdCA!(`be^O2IKhQo>0nqvO9t`53yKp{$%5O|Fzn@J=W&o|XKZ<Fl1Jum#M?rDt
zIEO(5GH%;o3rcey44}2Y|0hA}2yxKZypi{xV;?|gWjoGgkg#ZB5C~}zu&PN`0?mE1
zfZ8D-eIS~Fac#pC#sA<w&_Z<v7EpU(-$4cmP+Ot<IRite`60VNbMQTJE;TjM72z)(
z^tzujFgD2je*<o_+%~QN)h+e^y(_}Lv)O6SS7xq1@JXb3F{cM;-Dv(x(B8zwp!6c3
zJztp-v~~`(7Nwz<fyH7v=v;{Zv7k7qsQ}k64?y}I=P^Y%?qx91p3lJPIFH2vq|b34
zbAk4J23CiCEGrg9GBAaD9<mGcbkPgdWU&L4-5v}q5}<UDsJVcle!d6Dz7L=|evp{s
zUIvjw%?38G_&(5i*(@oEnhPNOc??UC+<3!-fyD#e{8}xy0{t!qCdYXU3edXSLca^N
zrjA7hv}Un?KLfW11M>zDyVIUQ&H6usZ1;W!hWfo;BAxaOLLl0Mfq4RG-K%~l10%>B
z(0&icIm`v1HINSTn6FqbV9;v**TCb!z?=c1trsxxS^o#kQ87oLy5|^Z+(gr19`gc_
zeIR>07??r#r7&7AU|^c52+l7Ip!Mz64?$%wvxL<_1|CqEV6lLK1yp``|6cO8p#qeS
zzeY|-WZ(du!w*_F1nQH3#$P~Y6l8+;6M_05pgkR6b3x?+k~$WsI?#PuFm)UdG4OmQ
zOiTbGCIDJr1rp<h+QAFz8-dmXgWOt>30V^b>I*^T`3f>2>zSZpAUA--Kzk%X=I|wI
zGJx#kTWHI`Q+I!Jh4lgkmRj?D21PGHbrO>TR3FHGJ`V;a0g#`qAN;@S{r^iMC`@bW
ze^^X@$bhnE7`#7b9zzZ&&4A)4`7r~F<35Hv9t=#N@{YrC9)pQ?CxfWNJSGKDJ>&iV
z%glwA3@o9_hwK8CUGzYE1wxXY<w7-C#A=egLG9E9pgCgDx()CDpI;Vag6~6{k^EQy
zR3En#Wb&|Tcd~%i1Mwt3Rse|=SStL#SYyv!0V*>Rk{KDM)Pw4Q&ub@CFff3|Si$wf
z|39(~i3}Ve$!t2_|36Q(XkcUj$%E>CkQ$2v>=(TMf1U~|FC6AEfXY_JTJs$S;IR7c
zU9sseC~YtZfa2f#|K~uEUg-WJkQ>f`!pi&qXUm0>3`~{||F44j1vOa#7NMMn>?S%g
za0GHf@}71l11L;F9QQKFfWiwJKFo<;3<{3>z;nbuv^yCDLF;t1I~hRxwnMZ#83Y{m
zF+5200-YtrU}KT+|6=`P3DB8e8i`&EpgW2+5MlNSRR4j}n1Q9j`>XYjJuE<O2GtWF
zcYwz4EfxO%i#6Y22l1PS1;}rpu<`!?UjsCb3~KX&#vq{iipBargEn|C@t=cd7e+F$
zA(thfHPeoB7&vNey({YH-T=3^>T7RT=+6hAXCnjZCxON>K<leO@c<b^UnB@BXD09A
zl$dD4DFSg51H(icPEeV|1QG+4aiFmoQ2pY;AZWqBxPk{X{sO8CKxJ-7rh^`6ECy8W
zg6alPc*FW>p!Ehd$zCGf|3B%1#yvoN70`GGXnX@S-r>Q($-=<6d=IX579lkbdLXlE
zc4$}BluK9C%v1)CWr6m0*T+8+v94lZsdv3xQJ)4n$C9HF)L(RHVhYio2`a0YY?^m5
zut55RA2mag8LSeLLHqJQ%Gw-YU<S3>LF<-5c>$F65{_M%0J?(=obL93=OG2W|D>sU
zFfcJV%wzmh_jq?jy~^ndB>MzGeKc^m&SQK~YyUv6Arq9|KkS8;OFWHM3@npZG6-1L
zFerfg9`(0GK;;>ztzN(Xk%;&21+vLtH+|@|bzs<F4{Eo^GN{-(I5148Wl)$H%V1$K
zn;~JcErSk7&tzK$gUPlGCf@%xM>hS1?Blbp0rgcsc!K8eCX_Qs)Ysn<nHbCP1Y{4`
z&g9z_-oNK>oovg{Fxi%20@R!-AalL{Z3dmm@c`7v1I<fXBnU8o`m^4DN@6F}GCZiY
ze<Wg&@c&EmN`?m@e>%=%_yKY6`<s>yEDWG^8<w{J|4hjQ&&B<*m@5ETXY+5<PLSS)
zOoj)|D?x45_bWl+GohA21X7;7p9$KB6OzSlH`9}WsU!<j?lA}~^ke|#zlM#T49o>t
z;PM70#t0IF#N~TXz3U4pV?gcu_r9RGY^Y^$@c#cE)c$4k{{P-`LM?-XMFRNj3<mE%
z`{sh|2Zeb<CaC^+FA2K)xS_5=BxH%3UC7clJMTX!mY}=<s*@*2fY%9t$`cOII0a<Q
z1)oDmr}#e5enilk9ngAZ@BbflK=PpW2uQ9bL%IUAcd@2RxuP+d)5BpNLr!Bh14l^b
zvAX)s2+;Uw1T61>!o22;aRoTfJg}|+_qq3LSAfh0@8ecxV5wnet^ntor@t$jA2RUN
zGCNm*@=dKva7Arfas?<KdH?_R$NT?>B`|kPQTz{{^8&dCRIW{6WXRcjkU^mt>>j2c
z`fc|A9p^HAs40`Kut;DKsQF?I9=`#%iDoKSc>l>x1<f%zHZh%%+r^Lo>Q95)_<xE#
zL3snzW^|m#G{e&L|AGni3@o7h9Uf?4G@+h>1JoY_srUX<Bnwr`<2a8grUBf}WMHUU
zy1K&q_gu|}dPu!qrwVGr&y@_<JgXP3b*!#fgQ1~TD;Ruc2B?e#?I8rsqk+z0318J9
z2bQz?|9_$*1CQ+iMuv%s3<7nN7gvDRDcU(OG9;d3aHyYtfx%%8qYr2<Ro0v#q47Th
zPuK?oqlt<PBK2HeA`=}MBrGZz66*V#L?GqCTi!-S27yLJ29ZWb28sIV4h%I}o_e79
z$~rGkJ#hQ`|C^VSA{ay_R4@pD$^dX%<j)$`#xMpJ(7I7jUm+pcfkC?q+OPLS^y@)m
z6d*f6bt<Ti1<~IB-^>KrHKBrm#nKDBRv)x>fM?<jaQ{KZ)`3w5G`9%4mmXx-R2NXW
z@-DH?zfsTXI|JjS7zUPxM9>+SZvrROFmTi*&#v(P|HgGf4FgY20ccH)07FPJgPQmM
zH--~x7z8W|6kvSC2{jBN76k?{zTku!1__G-2N<7mLJfn=qzZ<By5d(N-v9q?so(YT
zT3z$v3hTWL^5IJuOlqbmiFp58cM}w+HB&+BAJ?4)#b?b#F#BLbH7LJ-2KUt*=P)ER
zS~E0&>Y?WO3>+Xmpm7ICxWAriF^3^xN-YC;e8KzQI&lBjVm8AA?|<tmq2~00(vjmF
z28l*%h9{u<12k?v(VF22Xzeq|Ua<T;1`h8(X}%!yk@&VC_1=HdOhJ7H%S6!nDlSm|
z1CK9)#uGtfi_I+zETHu`pm}wWIu8bhoJJMU-1w?hiC(K#gU)cMfB7Jw{=Z&9{r|vg
z;V%u0nx8Q6fX16Z=3C5XaPa=O_GbgQt@G+&K{7*w!=nE?Kx^?p`)xsUxuEumr6xnd
zL|bqhfde#d(@?_@02%}IU;y8D1s?wcjq!oU0Ou-KG(YC_Xs8E;<tK1o9dvK7bpvP}
zE5npVdxj?<w_49<XaL=NFwvgjiTCdry4KE&UqIuqC7Fy2p!N9P|6dt`+9M&=3?}uU
z{Y3j1R6u)}L1`Kk_MkQ0p!fit>F51#Ei0&P0y5Y8_w<M0e)Zn}6Y6VjgVxfl0oe_*
z7gTP6_HaPl_VF#KZ`DxCz~lWV<t(^-{*!VPRHu6XNrBvp4L&2A6LkK}4N#k5zaj$<
zXuNm=BLnzMd(gUQ&>C{@KP$G@&y@h(Bd`Y4J^`;ITK2l4zWs3psLt~K|68-B3S4F}
zc>kX682(axU#2DlGpw&%s0kXYV17~mQc47*9yAZ^{r{h6O{H|DLlc99_wVVv_02yV
z9OnLiV*TL%Bv9WI)V`{p`M|*<;r}a#c?=eyG!7cG0jKkspme@Q5y`ArQ2WBMfdP89
zFu3pfA2NQ<p#$1$3JSYKO%?{wxadSx28K{iH@iU3BYJ_JPI7^s2lzn!C|k`(yq20Q
z46wOVkRDL|0b3^vOPAIQ7})KbA?s0^|M11Y&i?_ApEogp&h6y#{#Wp|_+<kF=v)Di
zIUqlQ>H$c)VqY>v@jp1sLG>CaJS`3~@a=D8kk|-{gIZ}&-J=5vfA2q2mM&Ce;49Q(
z1nuty?`?<10l&pTP~1*wUFgWb1KN9A=y?FtAJPbQ+qR|9(*eZhNjS;i06Iq&6z@=d
zptkTI7~A3?0~bin`_B~Hg^Cb1RE`sLe|Vwh8u^Wi3|!uSrpPW-1f8YGptVtvfdk?u
z$ax$K9T~V1y_gs_I)ct!1lubB5o3gkDS+Gp6=P_CsDt#~AnF(#AYvR4b&3pJiJA-w
zAbS@;-3N6Oi}#-?z6%u@cnY=PW^zF7<|x#HnyJXZk*LYY0CMMogA5!X|3US0djFZi
z3uQBa{0EZr{xjJTO&vqRF(HPKV=Q(X4uZ<B$u~i12@;R2FF-UjU4YNn+Mmdv0$Qg&
zfsw%mbZ^LpgA5X&wzl{G|2IKn=idMS9t4+t`#@u+;Bq1+c}W99_<s$PnmLav^yhLg
z)X)D7YG;7f;)#IPR9ZBG_o6U)|DMKaYyCc<(UE}zG|xZLlP?C8?!Es*$AI_!-vH{D
zgd|V@SCh<e!7`D-!h?a;0X8QDn!nti$iM?CD?xJ<pmMC{jxng*um!mhw9W+-2H-i8
z1EBWTe_c>sa%f^uvHuTA<Bj%wF|hScpfjR3+JN`qz}jC59t<oOK=#xu(XOyqz`@}C
z|KAH8Rt5&&CI$sXSMc}-sLvx)lNDf4)1qTglc{4+>!Mr%>bHQx5p*^+C?C|Mgc!iY
zu<Gv$F{nw_FsSL&FaXVG)T(%c_j$neHwPHN#6WjofWlz%LI#n^2N@(lbF&Wf7{1iE
zNjTITFs`WSR<3ZE%g9l4lEDO2Zi434Kx0dao(u{#$sPtZAiEBD7}R=6SJZTS7=*C3
z*oCmN*wuC!PYX?Nv8&}VyjI(pTv5}bc?~p&8S2#_SL<P2QQzVK+WVza%fTdKsq_DT
zeFNy6T?P@TIFF^y|9>F4S{8?Z&}<gFS`XuCHKz=(f!d8Vt2D3GvN;5Vg7%zoL|4?e
zg3VF@ski8Yn<W4h=dkDkow?Z{2TG5i^&-s+8AO^7GDtLo=AjiC6hL8H-wHa%mElLt
zY6cU1ZUzR2S&SSGa~K|2G%zrN^m#BaJOPbcg4(tg44`!-#?xxp7)&5yj3;UyNCd$A
z4(i{AX0+JVwi{2Y^+EW*=9NW2$nyrdnpe&h(7kUmwO%m)2Y~m)fW#f=GKJK-1O$X;
zu-MhSGM-j*-0)h>6YGka<(k((XVHSg(95}^z7@QGP61?wMLWpfU^4`u;v5$35P#$J
zbDILFE>QsYvl18>u!V~vH-kdW(g=f^lP(4|IW7jZs@fGb9WDkT3tH?zXR+6>VV+i#
z9AQw)EL{<j(PCF~EW)5RmhoEs^4Ashe?70&b|nOa_B6=Vb~#tn&j-6#rPfPJ#NzM&
z{~&id&SemRit||f{r?XnR~sJ?09q$k|B889jXdME`ZvETYUMqz)j9+Ofc@?%T~XiR
z0ZBiaS|XP7L1uyX6p28^c`WDu|5vN2B?4OS01ETkcI%2-cLTBd&Hx8ccskBucmV1P
zg2ELPzuy1<v(zvc7$`gg-N$KT5W>}BSN|e-T1~QnK~1}j0chPOC|%cd8yJMVY_Y4U
z54;8{A8YPwUaMt>rbSKXiuyK~yO=~QK<;XQx(g!CV*z#-lSr+aM?lCk7Q6bF!P9E~
z2VMj1p{l9ZyjH6YS=UsnX<Sj?j4;bm9u&V&vmoL;mhvD!GKqlqay|A4sC5gjsAX0L
z&0n@ys{j8F%Ht5f{nG&FCoj-m-M=epIwK6~I}IE_Y8>Z)_Ei1*(|G#-j>gyj_cU?;
zKhUK8|45Vf{}WBw|Iaja|G&_*`u~-t)BkTYz5aivnfw2PX6^q^n!W$OXwLrsrn&q7
zhvwD)zcioz|D%DMfu;HN|3BdVU1Bu2%wd3n|4;zsGC;X-3SAt=Uj+rBPypqwf^y*$
zx;Tu#6bhoC0Lono<-#d+aTtG9C<H>ORS@2)P#7OZql?4%P=ClXFff3I-=i297%CVT
z7^X8YFl=RDV7S7-!0?%Yfl-iwfzg10fzj{(f0Ka!|4kD9|2HZ4|KFtH|9_L7|Nl*9
z{QqwO!dL$Px0(RKpp!W)dH(+gm7bOs|Nnz;j|+gvfz()hfv_zr{{OdZfv`d1Fl@Qx
z|9{H^Sj68j!efO6!ut3B|9>V121X_}4o)rx1_1^LR$yRYFkoO{aA06y`2Tyo!T;au
zPyGMA{>lH}8#uu1|AuG&|2KN`|GyCnlot5^-$>^Fe<O?k|BYP!|2GQx|KBJDDhE;r
z!yW(s8%@C?zTy9WqZ4T<CGlyQ6{Q97xv9DNMU|j1E-FcmFHS9CC@oHkPfsn0PtMOv
z%S<mVN-W9D&x_B?2dOD2NRBtDsEAK3$%xO)%PawjF)%RdFfcGhFfg!eU|`@(U|<kB
zz`&r|z`)?mz`!t#fq~&60|VnB1_tI921h4n7gslT50JiT2JGcJiG1&N1#-@mJd(@a
z|0S!ybZPR-#Zyz}8Fk#|Te9O$rQFM_4?1pMny&4$jdO3!#yWQ09nUAq?w^n%uwC|(
z!iFr5!kwS*Iqqwzy>d(H^^?1~fm^S9Io^7?Ic!Fb@PQTCDOEp{{=PYx+T|a^C~`B0
zEjihi|JPSuj@}ardDd|PnLbY(6Rs8&rZ2kqgxSXZ3XAvOR^Ch5Te+70TCvqMXT~O{
zYbST#cKEqx&EuRKMx`<LUC;AgyAx@9arGL5n`%}J_W~ONub&W0ys&@kmo19QM>dDe
zoVx2g|I)oX=Ivn8;OJnD-*l7bn957;jqNr0`hq?g5vyer58CRcZJXeDr;M%eHsc<J
zOEa_tuD<VV-B>8UbsO8#C;R6cU)k|u(Mk3Slb;OyeJePpNzCATxSKbtUe`94V|q@?
zM8=rpXI}!dvy&2YWNsLww)!z7eR?~UEvI@Zqx8Wq98KXz_`e>zxgj;+<#wT0JN9+g
zbnN_dU-oX2r|vD$&o!5OQhl!cj!4|(doFORRSCnM#g7bjUvXS|-|PC+8@9PeE-v}~
z<=W+}mzmCgZswV|b)>Joup{ACu`Y|tQ(0!?cpt7+Cu?}`+7z+|ta4;h7ZBjy*QUU8
zQgv%a_~zDp1<osJJLf-1JjeI*Ufhh6H#L=JT-dN>#r5OjwwogxdAI0U$L!s{HfPrX
zh2|Y^w{6}(i|5fc=2@3EmRP!9eYL*)(p*us+bqpucZ!9$lOMNOr%bWS%H>@Vl~u)k
zp6|)r|D2Q6*D-KyoX1}4GMWFwrNtcW8J`&C{vBe=j15ovemXt1q0lTx@;O^}UYYcj
ze-E@TcScp+5;)^^H$DIU&YwTu@9T5kw_W^d--d)2i?3a)n|yKMkwZ5uf<E2%|Cqk}
zVtV+VWp~-O+IyRA^0=kVd&5VXYyCGbX0wDU7RSTy6YhuJPhauAFVC=YU#45n=ET!d
z&1riUT*_B9dz2A0wVdY+vpe_honlN%`f9A9`>b~z)!^Q{X;Rb{ZI-OfG0Xp7KV*3R
z!q)D2H+5v!-HYCEC}p<Vr{p(t7H5@mP0nRn$;LUy-i+^cYdU+8a5w{Nlh^*KB2_yc
zt<&CEZ6UplXLjGENxb{6KHdKQPL1OI+uT<!U2b!FbmilZ&37~Mns3RU72DSst+w;q
z!}1OJ<?h=ho<(tV6lC%LKV{997Q@Xb_<vq%f9ATRAD91UC%T@`5vzE_wcy<)-s>UF
zEPjVJGg~IAr7!<3mT<w>J=61cd7hnD*2Q&qqORRc<G%0k!TN@I@VY%KkIvhDum1cd
z_m}^-8pwRwySMAmu2Tk+HwQ0UyhVl8?82_eY}e0fhTjX>pMFzWuPSZx4zI)`Owt*#
zQ?&E7%=d9`S=h&OSo%I|RPTEx-T(i6GyebgE%^W6x8nbQ--iGHeLMdD_g(P+zweg+
z|9$uT|L=R?|9{^T|Nr~m`TyVd!~g$&4FCW8as2=9C-DEjpTz(Feii@!`!)Rk@7MGH
zzu%Pq|NRU8|M%PR|G(dX|Ns3?{QvKF<NtrZ2mk;3z4-s%pW*+1f0_UP{Z;<|_t*LV
z-{0Z?fBzN#|NC$F|KESl|Ns6+{{Ih{^Z&p9lmGwy-~9jY|K<Px0G9v%19<-b4-onP
zKS1aI{{WBw{{sU4{||`x|34t-|9?-O|NlKs{QvK9;s1Y+8~^`%Jox|L<Hi5~9v}Yy
z_xSPuzn94W|DG5A|M$G{|G(#h|NlK-{QvLy;s1Y6kQ~GR|6UdU|9iRo|L^7V|G!tr
z|NmYw|NncX{QvLi@&CUk3&ea+kQp-n|9h(Z|L>{u|G%fn|Nq_z|Nnbu{QvJ=@c+Me
z#sB}_4gddp@A&`U`@sMIURVDA_bU1S->c#Of3FEp{(}Giy*B*+?{(n+e*u;M|M~y?
z|IdF1LJP3`|1Ti(|38>!0f`wH8X23InweWzLQ3lYf903_|0_S||6lnj|NqMO{QoPz
z<^S(*d;b6auJHf&_lW<$zkm4u`v(Uq{><?I&l#Qnf6g@g|8ph=O0W6<=L|A#`2X*h
z!T*219RC0N<?;XDuYmvmentHM_bcK5zh4>u|NXM~|5usk|6gSjC|3FZS6Sr$UuBv9
zf0cFq{}-L}|G(%GD81(Yf6*=f|BLQ{;yM5SOP=`uU-Au<{__97<e&flrC1;sBqufJ
z|9`11|Nl!J`Tt*P4~TxBzzwRFm>C!t7(t8?%4Y)k9fYC&2ZaR)GvMHpsvcw(2;(vj
zBnQH@l1FzhjL-N!fd}MmLVS?hK$r=t9>fM=Tzrsu$nxlXkQ@l3>t}$P4^j_u7qa_6
z>XGG<`5-nZ4a4No`5^N^Vla6^e6U)O1EB69#0QxNQVw%3A@zes9#QrsCMBn&rhz>1
z|6kpe|NrWC{QuW*<^R9NlK=mj1pfbPI`aQtbI<>OEdl@kwF><IS2ySXzcz{g|JqXi
z|7*+m|F7NS|G)MV|NqrB{QuXn;{U(SHUIzh`27FZd*}bZK8OGR`d$A2>p$`T--ML^
z|0Z<&|2MJa|G!BR|Nl)A`2TN83<CoL3&?Izx4>Tl9GotUTvD723=APqaSy1t4@?{!
zh#U+o;=47DFmNz{6EXt_gFpjQ0}}%Wg9rlyn3iB*c)-ZO!5{-Rhl4?(feFl4sb~5H
zQm4_t<i)_i!Ju=Wkq5*#c+SYgz`y}=1Jniv22hs;WIpJ)0|kxnB2@+s1_l;GMt%kk
zh7VA4LERZh2L~h|0QHXmNF})A1JVzY2X%u$v<OHUg8+jBl!mxZ0BjdXUIi+y0i|`I
zG^pzYk~e|!Eugdwl!m#(1<D8aI~W8Qe4zXQFbyUC|C`J3|KD7J|NrJH{Qo!C;Qzn5
z5fHq<<p00<FaH0V|Kb0?`9J>uTfp%D-vXZh|CZhO|8LoY|NoY~`2TO&hyVYU{rLZH
zRRJ2V`2TNJ!~cJ)I{yFLSb&5p{{P$9@c-Y&j{pB=efa-xQ_lZ?n@axw+f?)a-=>!T
z|2Fmf|2JFU|G!OB{{PL~^Z#$=lmCCSbpHR%`htc-{{PL&`TsYo<^SKTIsgA=ZTbH<
z>&*ZE`X&GW>(BZBU;oPg|AsxN*udxie}kI;{|(ms|8H>T|9?ZC|Njkb{{OX2`2W|o
z;QwFS9smE@IsE@?H{t(3mnr}Mxor6V&(#EiT{8avb7}ei&*hA3K#039sEfzQA;8JR
z%q1wHASuMn!pb8orKn+`sU$7J%f`+pDx<7rXklrjts*PNFD|F5V{Bz@qN^sau4igv
zYo>2*XV1VOz{J3i4j<2eMhBDv%fY+TP(dgKmSci+u>b#u3PLHc95Ws{XvZ9@K2|*X
z*zm})<B{XQBgctHP6CgdBpx{#JaV#l<mB<lDPWOfgvOsD9yujEa>{t*RPe~D;*nFs
zBd3l>P6LmeCLTEpJaU$J<m~XsIbe}vf`+vt9yupGa?W_<T=2-b;*oR1Bj=7s&I6B}
zCmuO3JaPee<O1=?Mc|Q(#3L7tM=lnRTs&^M3_S6kfhXQG@Wguto_No|6V@4c!ZQO;
zm}TGzvy28TerJKC>x>ROa-DeOy70*L;F0UaBR2z&+)O-jv+>By!y`8biySL7T;}4D
zTYyE54XSS;9=R2G<W}O5+ki)I2Ohbdc;t5Bk=utyZa*Hm16btPq2Y26kKA!QawqV}
zox~$|1CQKIJaV`2$lb#u_W+9=2h{Hm@yI>FBli@K+zUK%FY(BI#3T0!kK7MDazF9N
z{lX&$nxO$pLmQAF3L0kV31Er;C~ZY%NO-0v;*m?jBbSUvE(MQVDjvBsJaXxH<TCKc
z72uI8#3NUPN3H^oTqPd4YCLk->J?6C9JOH42b05A=fLE!)hjT$33$w$h(~S`9yx4v
z4$MAmbq-8!79KOP)kiRW*y<yg+<e?-W?<{9fo3(C7#K3J_0?c<*!pTPIc)tZm>jmg
z6HE?U-w7rsfW;3mIYB&fVtC}l@yKE8tHJEU)>nhc`QSD)4O>|AK+<&@wy=iDVGC=R
z9JYQjOb%PW7$%3UUksDO7Jo1~Z2e-G9JaWH$zh8>m>jnFgUJbF2~U_Dw)lg|Ve8+*
z<goQ`VRG2|urN78+-}LhW*;{sZZoji2b06rpN7d{a|=ukTYnlRhpj&ilf%}ZhRI>;
zPs8M}^`~KS*!t5jIV~(<29wjqBd3E$P8W}yJ{~y(JaX9L7UoV<Jo?P>$YC2xfSHMH
zECD75y2cf3EU4iE#V|Qrumo!R1tw>YTP_V-yN4H&KGU$ZUtn_B+AlCUZ0#4A9JV$J
zOfDabJE3yI*vc$^h&zR`m02)3Y-JWq4qKT8lfzc$z~s2FxDzJFjYp0Lj~p)^IX*mc
z{CMQBm8~#$Vk=u=azc2_#8&RY^oiophpoPa>BClD!{o5lw=g+rJoaH58-?k^HZ}^C
zOT#uc!v{%cY1qbQU~<^T$Y65V#>ilD*v4jHa@fXZU~<^Tx?pnH#%*A7F<8P3CWmc2
z3nqtcJPRt9j%|EG5E5qT*v2Pda*MFI1ty1W>;fi-ZR`Rjw+fG$*v2(r`ZnUxhi%LQ
zrVrbg2TTszm<LP_+n5JbZU(mcNB|O^GqBZ1FgYVEet^jt<B>DLBZsYygPCcDM<2HO
z52g=W{Rfl7R{z1|tnk=}t!{+rv%#YeTfGU>hi&X0CWoy~g~?&dw?feP!<KJhazR+!
z36l%PBNu{4E)<Vk7#_KBJaX8|7nnP-jSIu%qVSlBZJZsZ4_lc9lfzbK!Q|rb*oUn=
zgX+t~)*lmw#9t=1{uoRSTYn5Dhpj&blf%{yfyrU(KZroxg024mlf%|7hsj}Um&4?+
zwY_0-*xJxAIc#MXOb%Oqhsj~f?@+m7Z1Erp@q010b`Ml;2Db4mF^IkyC0Nn~Os*7<
zTp1p@ay)X_##_Z9Zb`>BhARn`dyK_Qm>jmTSeV>vJo?__k%LJg&#}YI#5SG`lY0)+
z2<?x6D3~0!abcJowy}E&sNb=T-NWP#VX+S;cLa|dwlRO0z6*Ht-Nz$`ZLR=jCbqc(
znA|BmW}d+#cOJJ~J|1^wVjDM=f`oNuBNj7Za;<pe+VIG=<B^++M{YVEIc#H<Fn3}b
zTa$+R&ku{4FgbtRav9kA#WD~xGqBAEz~r#a2f*a8^`~KS*!t5jIc$Aqm>jloeVAM(
z7XQKIvhc`d<B`k3BbSRuE)S0!wthd%o%Oi&Wn$}h$U@>M6I;InCWo!x0h3#d#Xgwa
zdfakp*xVuqaZ4IDx4`7ExdkSN%`GswC0N`7lUt5Q4x1mK`b6(y(I*e_gDAH7O{iQk
zw)uAjh`wTMb1yKtJ}maZ<gm@Xz~r!vYbZnQ!!~vSlfyQa0F%Qub`O)2!s1St9JVnC
zn4BCQec0Au!SrDpgHVO~58D_7Ob**P156HESqGI9#a4$aLhKX6*2ja%VQbgH<gk^=
zP`P4kWvd#*zG7_UCrl1o9#e<v!<NTja@g`1Ob%NfgUKz$5`Qo`Y~vF!Ic(z-FuB!u
z%v^&<ZY>_Ub$H~k<#(7{u&u3t%8B`6F;fQ;)?(P&3{bgZZ0$M?h`wTM?K+s;VJ!B+
z<gl%gfXUs)qwfwLIc#Me%uH<SE?{!l+F39;Z0&h1sNb=*p<!~5u(%T@hpis~lf%{z
zfXQKNd&A^j;js@}{{g1&4IX`O@yKE8cfibqX+!RJK;=rX%^NB~!m|Y1SUOA&Ti*~S
zhpp~_$_ZmzAEE-WPXya|4^*xMTOVB;qOSy79~~x#ZH^Bnhi#4zCWmc~4<?7ro!X#I
z8BYAa?r+uCtgBjAG%u^2k=&eqPIh<syVzYNFN2nPPt&<!_}HyidVBso+uvnxqqb&W
z)4gr>CUR5CNuebk6P1ti&9V59c!;%Ie0}`Bnx92ay{2kk*Sll+Iqj^}mW+!^M>r>|
zpO@QH@iFNr*A$Hliig>HBsL@*WNP7<pm2b(nY~|rfBnDOU!|`?SB0z$Ugk5?__^O)
z>+gAYt-fSlQavrUCSqgqG2Yqc@8kAXf6KjP`Z{cF^tPOvMo&B^shkj8?A|A{qu`-a
zEBAE$`*wdSKc$`$T^+tIW@qs;-&rOv0vEY-3NQDcXY-@*k!zR8ihzaAZ9Fp!9ym6!
zbO<bPXk>2ZpKs5=z{t<S$;HdZ%)`pT&cx03|KIh1|NpKh{Qq}7<Nv?w1^@qDulWD(
zdIJ<kXf%q5C@@Ya=TU&}c>o10BV<1ri245y!-D^R7*_oM!?5B1ABG+O|1cc*|A*lO
z8xx;^zLu^wFMR)<fgS?`gDrx~E6u^Fplcf)8>4Kko}i<r&!Fg_tfCsHrlp|?mW$V}
zuC1xFQmV57EvW}t1|A_{0F#i61QJA9!}Onl0hG1=|A$Zv{~18iAjP2l=pd~iA+QM$
z4rmGyBn`zN<sc!DDzG6S13@N&w16Z*5@55T9Eh<Xvm_Y)|CiwT|6fAp|9=UU|NkXS
z{{NS7`2SzR=l_3+g#Z5~O8)<sX!!qMV#5Fb5_A6lmss=vzr>0E|0N#$|1Zh&|L@N&
z|Ns7;@c-}61ONa2JoEqW&l~^${(SQP@6Qka|Ni{*|L-rJ|9^iM{Qvt);{V@YD*ylf
z^7#MvSIqyvzd&L&|Ns7)@c-}cfd7AgZTbKA*O~u+f8F^1_t%sEe}8@W|Mxe;|G&Ql
z{{Q`L@c-{`3y8YkIsgCuuKEA>chCR7zZd-f`^Vz{KL&&UfB!`M|NE!n|KC3|{{Q{6
z<Nx13H~#<q^W*>DzcT;-F$nzs`#0kM-@g_A|Nh<Z|L@-$|Ns7D`2Y8x#{a+neE$Fa
z|Kb1Ne=Yz2{@e5a@4qkq|NfWw|M$Pm|G)ne{{Q{o^Z)Pv3;+NAzX3MqA49<Ze+)JM
z|1qri|BvCy|Gzg}{{OvE^8fFRCIA24*z^DIjW_@Q-uUtV?@f{ae{Wj+|9i9G|KFP%
z{{OxC;Q!y7XQ1?p|Njj*{{J@+`TyTQ<^O*Jo&Wz0Z2tc@@c94VAmsmlgAC}tkdFWV
z4QBlRZ?NS5e}gUm{~KKR|KH%nw9L$DnbSbzv`i2QVuNT92C*3!8JHND8CV!t8Q2*(
z8F(2486+7L84MX584?*984fZsGBz?XGBdI;vN3Wn@-PZ8N-!!g8ZbIACV)2=F$h4R
zAcG)-5Q7kdFoQ6I2!jZND1#`27=svtID<HY1cL;FB!eV_6oV9lG=nsQ41)}VEQ2hA
z1A~JAD+8lAD<h*YD}$gks{o@QD+8+}D+{A2D}$pfs{^9|D+99xD-)v#D}$m8s{*4C
zD+8w#D+i+(D?_6LXr(PH1Cux_W1}!DgQPU81V}%-Br6+8f1)gF0!TlL1S>O0zo87P
z0Z2cu6e|x%|3Q#`sNdNb*cmt&I2pJYxEXjE_!$Hlgc-ycq#5KHlo_-cj2WyMoEd@{
zk{OB_ni&=|9A<b7+G54PkigCW+IbZK+O;LZ!B8y3&LGdg!BD`!!C=6^$#6h`oq>yi
zgCT)|gF%6TlVJgPFBJzv0|N(x0|O_+0|9mhHU<uc2nG%Y2?kDv3Bv3Q)(jjB6$~5<
z77UyW7X;ZE1Q|FOG8i}*G#EG;HZX92VFv>Tg9igA!v_I&1{MYmh7izhF;NbN$HMFk
z+6){FB@7%4CJdYmCj{9Uco{etQW!WGR2VoJRxogY)weKkFt{*qGQ1D~`I>_v2E4nB
zlVOGkJ3}x72SW`52ZId*C&LXPb_Q_<4u%}i?lJ~Wh8^HtY8(tb3>*wT44e!<1lSpv
z88{e%7&sV&L^&813$rsQGjK2zF>o*#F>o>*5oBlJX5e5*V&Gs<V&G(0!oa}*+M(9O
zz`@|ez{&7LfE^s}Q4AamQVg67Q$*MqoEbP6su(yJtQa^Mt_ZO+2s3anWHE3sXfbdy
zY+>L4hi4Z92ZI*_C&L#3b_P}k4u&uW4hAs?4h9Bcb_Qbx4u&!Y4hAy@PKGmr><s)2
z91Lj;91Lm<oD6FiIKbiE#=ybg#=yz&MgWxNIT+#?I2hy@I2q=Murnkxa4^&{a4^_0
za5CHxVrP(M;9$sO;9$^W;AGgtz`?-Bz`@YRz`@|hz{&6j8vlU|91Mb@91P9S_%CGO
zU@&ChWH<zk|3n5321N!=hD8h<44|ESjSL(Njtra(kD&1%$-u!N$-v1l2^#;E3>*xW
z44e#?pz)u{z`>x&z{#))oJKhqIvF?^JQ+9{K0)I@l!1dmRDgq#2^#;U3>*xm44e$7
zpz)u|z`>x(z{#+Rfdd>~tqdFtt_++Eub}ZC%fP`P%fQJn3mX5m3>*x$44e$Npz)u}
zz`>x)z{#+SfdibLdKowvd>J?yenI0OlxBoQIT#K@<G+}JgTa`Ali?UN{y|}?%)rU8
zjDZ83UYZ#=7@Qe68J<DoKbnDqL7IV+VH!04s~I>LtQj~Nu0i8Jn}LHtn}L&I8v_S8
zJ#{m1FnBX?GJJ!^e>ejNgE&(BmosoMm@{xPoP)-HIs*rTIs+%eItC7KdTVFkU~p&P
zWOxUS|9A!t26+ZfhI!EVuV>(3uxH?8xCf2@d<G5%eFjd3eGDAn^wiJ5!Qjup$?y*v
z|G4u1L1_HL^8Z4#{QnRd|FHZ&5gPxn{C^P||FHbO5uE!u7-0GTBQ*YT<^Pk=_=n~H
zm1z0@B{cqF`F|!f{$ct5CN%zG`F|%`{{IP$e_Z+hC^Y_I`F|-|{(lOMe^~yX3XOkQ
z{=W*1e^~zCikAPsLgOD-{yz(ie^~xsi<bZ2LgOEn|K~#EAC~{`LgOEn|M#Nh|G&`q
z$CdvNL*pNo{}-d>|Hshyhvomt(D;Yt|I5($hvomxX!-v$H2!hr|I^U;hvom(X!-v&
zH2z`ve>OD!Vfp_yH2z`ve>YnG{|$|QT>1YvH2z`ve>qzIe-4d*SpJ_5jel7FzYdLm
zSpMIRmjAy);~!W4KM#$6SpHv+mjB;F;~$p)=R@NkmjCZV;~$p)_oL<i|IoIN0GtN3
zf<PG55&~gRYY2ovEg}#GwTeJkfZ-&=5e5Npn+eo{0M$cm3|tJX4BQMX3_J|X47?0X
z415fX4E&(>KLV$gWF)4f6d?p4EG=eN1`h^j22TdiasK%X#SA433JlH+`3!jsB@9Ij
z`3yM>ISi=`MGOoq%!~{Se9WZ`x(rDS`3(6CB@7JCi8(n6Nr}nXB}IwJsa6UMss<K0
z5ef``o&i=05O#!X5RB;qX9c;s2U{tq7AS-SIf7N1<WwlQxH`fVa54A>L)jGyuC5>h
z3@a1@z(R%<3T|LMh7}6FFe%R<eHW;#s)1nz7lV61kg9=Eij@L`Z(?#rW?rg-b4F@%
zwt{O#a%w?IW`3R?7lU(RX>n?bLQ<uIMp{vRu0n2ck*1XbLs4paG01HUo_WP3MWx9g
z)e6CtdC3_?`FZ)J#R{k<rov3*LeUVEnwX*x;Nzs=T2z!@#Kqu}SdyrKRWQ6Lvm_N+
zX^4-LLO^0sW=SPXv!||eVsb_*ny3p@G&nV}C^-X%q+3pDF}fTM4=7|7D`e&t6s0C-
z7N>GC<U#{385D2~jyaj>dAX^1C5Rwo(9%-y%*jbjPs~w34l6A!E|63}QD#|YPHK8;
z3O3o0qQn9W@qnWI^rFOE^tfVhN=#8G0cl7qQ3!ChQc%sQ&`|)V5D=p*HMu0e$W}F{
zf{Vc=HK{Z`J+%m~+ySJRi@`UsI6E^hT_Gtyy|h>%Gp{7IsHn7{L;<2#K{W*wdl-UN
z3K@xcDLJV{3I-Lb6$(YE1v!byAY(vWE(T8{XDbB-1%{-=(v+gal2itlAV*&-1qFtb
zlp>?}r2PEi5+tTVN@j6lQch}$LP}|>LP1e#Stckor6p$Oloq9ODL??ShSWT;dL4zF
z)UwnZuty+@6c}LnIkhCi5S+0y3&2!Peqsukk(8fbl9rj1%HWq;0(PXbva*6}P>_F+
z0*DomlbTqZsu1KF>>8p_l98&Al%H6X0+QllFw`?*2-S7U&o5ChGB7mNOJ-0l@CDhZ
z3NadFcXA0tAU83&I6Jcd#6e;f6lLb7GAKj`1bO<p#xih)Cl=*p=A~OHs1_^uIyx(W
zT$oy1oLa1qlAotuqL7<dlAK}1#o(BdQj}T@iXVmGAb(#_f`oclLAAgaMLspJEVC#d
zk|HyU6(I7dB^gEeC7_td%V#Lf%g)O$&tu3-Eh$PZDXL_sOf6=}&r42aP*zreyC^-e
zB(*%TGP6J-FEup<R2-C+DCFgrC={oba4~Q>1_dYtfpjY*=a=S{D1dT1NSU=laY<rP
z2`DWjrYC0RaWNz%rYPj3=B1ZpD5$0=*npE%W?orhPG*Wi5XhK})Wnq3A})rU)I0@{
zVz?@B1}iSj1&MMoD0n*i1}J#s7ndjmrKV&Sr6!jsl;kU@7I>N{FsP>J!4N}UeqJgA
z-1#7H<|Y<rGZd#5m8BMC7BJ+M<s{}YXlZFdqTNcN0PI?55QDs!o>`Wf2g<8(B?&Oy
z>WDBvG9dwy%CJlN<twC?WTY15rIsk9<(KBA=%E@7N;WAeMc6ebq?Tkrk{6PEXfepe
zs>KQ^sb!hTsi5dc$}cM6VsNS~Ni7Ct@x0=+)S{x)6a`xa)tnRs4b_|qg^bh+O)du2
zoCpR``Y+C`N(D1OX^tVWv?L#tMHs*_l2nwRn39}WTmp_PF5==jKe;5egdr&>8)UL-
zvTBNIGJ{)YPO3sle!fCZVo`c3gqx9A42n>N+{E<EWSDveE=~p2oKgi}CxxQa<kZZv
z)D$jG1qQAVw~zpZR8UP}rQnuXR9vEvl#`#F4axwZh=OnoLH<k8<O)Vjd0Y%!DfxMz
z&_OmuUA0(UK|?h~lZ(MGzeE9?12Xf{_4M?(7(x^nO43RSz@~zH0p^ut=BDPCmN0+~
zfpWkWD&!VxLOhpWt^>*z3b~ninYpF83bqP{1_lNSxy4)zss=_m5om;7W^Ot-{lPO^
zUcLgTTv7l<j6z;wZmP9HDL9TnuH}MQ4X%nI$q=0AtrhZ1ixfNqV1))KOhB1|!CIj>
zH7^B}LO{8`G(AHBni;^_z>xs5LIGs99)m(~W>qRkFR18NfFvMW1qPq|#1xpxR-jTI
zREdBD!Nrvp2gLo3L4KZo?%?7pvlto{dFi0wRnS$)O{}m|P)*TP&{ZfYD$PqyEJ;n_
zVgP4gzr@^Bh9FQu8jx6$!Qkf^tl*NLo0yrW0G4s`_YVnBKuv{3sfj5J<)9`3q<R4*
zTTr<IDpWv8p}4f5AioG~MW#`5d`VFvI1gBX(^_(3P7b(QQcx|nQUKK~sVU&JU67m^
zpOIgj8efo6SsY)IAD>iOY^4Azo<K5O4EWW6G-f6z=D-3ANqtf&*hr8HoMvKG1JZ$E
zCgdd23{c$(FZ&IQDijn{p`;0zjZ7L<a51Rr8X6Vbf?^QV1m$AT00&lTi6%pCYA(2}
zMpB|@k&_d_1(pF94>^g&84xvTU?yBJKP?S(N@{UYBGe2p3nUFn$7wl<>BTT(Rn3YO
zd_AhT7&7xp(uz_G8Inqi!8Fums>NKOT2eI=6r&8#^bGc)EjYn~Y7j^>0widwplX(r
zqL5Tj%*9ZYnv<Ul)|Hf!nU|K&P*9YaSEAqquCYDy(()A`?bOmDaMgw=9tsL_GLyk4
zx+)}=z=B2rTm&d9D>x!am!uZuX6AuXu8u-cvI009K_L{7T9lSwlnZSq<fnm~3eEwc
z4C(m{-~dxdL^36@1eQ7!)Isi5X8@53(TPRrAX{U>Z5&-l&52(lSfzqOL1Hnact|Wt
zS64_ZR!A&LF9kJ1iy1)SpIDS$%%G5*pI4lplWGg9)<dA#p$JqgB<JUq6y@iDYR{k$
zSKnX-4I~GGdM6c{AZLN<iVA$1{ZdPuf?Yt)PEXY}QUKK-sYN&qQ&3Qd@C*R8boBJ}
z6c`i~6rjZkT*%*>3nUzxmz)o3Z9}}MS`2cF0)u;~UlgeKR0@~XQOGYX(alfO%}vc!
z$S+dJFH0=~7Z8vN15^T)f*K3prW~XhSCS8^UO)=D7((+ha|?1(L7|qKq5!utKTn~g
zvLF>)I)K^>X_cTL05$qRL6;4x#&Z<FWwB3cdSY^=f@f}GdMYR#fkO`DST1n8+!s{8
zDfpG<CV?6^pq9D^xS<1S#21(5f;}6ST9lbq2{Ibo4+FJ!z`+Aj5AGT{2RU;wgcs%K
zr9*8B0l6+MzX%j;$@#gtiFqlg3f%IGauY#K4OAuIHm;RIaw4c<nVwpr0QE~I$o-03
z3{ZJ!>reqKtN=>ni6!6=QRHH9&M(bL0XKlsGV@Yk2BhYd6jdq|<Y(rUC~`3bCFZ7N
z7H32CXBI0Y=R<lF`9-jD6~mxJ1xRxc(wtE!DN0QR#SgqlS8yy!&d4lDO)e=dN(JTD
z3ND6_B5<gc<SV3Bq$Zb^q$(tWA`uiEpmd>-pQeys1a4P?j%Y4Qi3ev(1}G;rFNGmF
zHzfzu0WL00f`%j5Yj9h+7?M&-6mZKH6r~p6kq(Ddj-ZZUawRM%b4zndGC?ja$j<}y
z8X@5fN|K<oTLNl#LSrH?wH&4iLlJ7?M)XsV6F8_%2k|u2Kv2;DN@@AU;JP1FO>2T`
zesGO|s6HJ_OY(CQOEQxoZIb*nXk0=I2~hZhsuD;_2bq}*E_6@|E{KD{*#vsFb~I{{
z2P^YH`myLNF3AVAUNiF)AlkV&VMQLiq*G9b7N6?Y3gsD~zC(UKq~D?7lbKgq0ZpDd
zT$~_<>Y#+Lkdz88s6kEvb*J*v6cY0kAV~t^NiNQC+(s#sXJjU4C={g@mSz^E7Aqtw
zq~#=*KpWw@;8e?*s8EuTS(E}VkU`-K)sO<!4{9l8q{3?iNaexB2}%55V?d4EBt3-?
zXsfU!BN3ik%QH(d@=Ht5-L1pLSy~Lr0_wWzphN@qW^rnAejdUpdJ3Lt3YGb#3Mu*E
zgboT(1*m(uI1?3;QsP0iD74a4D9;3qVWooWn$#49%)H`~)Wj4nuHe!nU1)v*HTgiM
z6(kmwfHE8;9p;zhDio&{mZs(<r|Kyvgk+?GatT6DE~r#aO6AHdE-nQd40bFyvnnK|
z=H!<vXk?bC7c1mvgK8*H;smQy0F9{?BU!F##l;Cu-wGIMixX5A<rga`=z?n{1^-}J
z^cF#jCtU?d>!BnS8vl?Md}>}9ln*H{^dX5OJ~c0ei!&{y1k?mkK+=np03gK{C#+P_
z1zB2LkeZyCmYEF7@8FUNT;LQG<tL|tYd8Jk)RNKyE>2KE12P&_Q&LKNi2_0~7bm#H
zQ2_bMKUe{7Hdr(%H7&m=73QhT{5(*Nn4ZtYnVt_a7^DXhR{p^ZkicPp1_i7f1eJCS
zAhTct1PTm6sl}-!3PB;xu%;2HR!T`MNd+ab+{6+tP}LZmTA~0EOU%pxweXdd72MIq
zToOxCtrS#EQglJ1k6=PUL$x?1u~HM{ypYUXkhD>X6-XLPa4~=kWk^pg0R@tN5!fjp
zAq6!BP%n%j+Sk{`B_ks@H#*wcIW{sfHd?Q^I5w6GtOl%{3*>8fhJm$^tP~*4M6f!D
zS#X64d8N6jMVZO)>}v(?*MZV?ab<ByYA(d5=(^Ow)~O@u0t<lCbx?>iLvU#xgKvHw
zLr7_AF++H2N?vL)Lr6wxQ89yCQ6@uhVo7Nc1DC670BC5(!JtAlCj#700Tol=(c%gP
zh5WQM1yuvka4>YhMKvb{R01n7q^1@W<>xX$wSzJU#HkFR9+Lv7bOM_LCP1bn=aq0l
z^eBL8oK);8K(PW&X&_VdAqo?c^GehelE7mO;G#VtCAAD>Zh`{T_C!!I0O}biB;=>1
zse_USX!IiotqK8^y#^KF_7XS=fjZ)e3dTmdNtq=Isf1MHZ^u`FLIrFp!FGHF7r2AZ
zfLY;%RfOjkWrIe2p=~>mFOgggvO@uEi7RYm2Wj{YT)HOb7i6ZUfJ!jGFohsTUoLPZ
z2{MNvH8(L?!$8MClR>rEO0`&lp}43F#02;L8B%RQLKzS;zqka{S7#{61M`)Y6~JMY
zr{L=21}V~X6cUSzOLIZ>dQxUyVo@d7S&$K;r2PC6aEYVg0IIcfDl|b|b+7_>AeKSB
z3hxLZ0uUyJ=mbGLQC7hKY7Z;G<iTkn5y?#qkP<nyxHuM80)spb3c&m{xHh;K^uR%r
znv(`G7Q;9NcryUM!AJ&bX({+YYfo^frlh82=B1`6K!@N#<rt{a$^_40s6xacL%X06
zdQa%^Bti+eOQ58xXKYlgq@a;nQ2-i!RD$SG(&PdUmw=)GY?+d3u@a<<03V`LP))H?
z1&zajOdw7@Xpm3=)uFneHb2B9B#)$4lo%->oSI(*8c@$xz*Ou88jS<hr{GaY1yILZ
z6*SEQ8Z!iCb1nwe2nH@KEd?j=7#pNP0<jXDq>)<2AXTtX0;MugA(EM#s-pmEg@B5M
zXe*G5V%1?G4xa5%068_SI6kLXLlZ0k;)7}<aFwJ0NxzUmFi0X$a0U4d6sXWL%?3O}
zk(QX8YNue6l3E6}#txF;Vilr6YC$<BRv{W(P{G=nAX`u@P=~2hheVZnN@|(9LVlit
zI@}6%Xm7hDAKqAlbl)L5K#m7H7V0(-Kc|=>C$qQ&A`D8mi3*UR>inWg1&x%{w8YY!
z5(Rxt2HYNjtA{%sVIVkEu(=dsl{#FnIzwr3VtOiQtg8gvsKaF+7dXPPL?t+WK+zlu
zo@@aXWT3cJErup#P!BXM5n?zfF(T{(2Q@DH6l_2xft`X4Ecor<5e0S$e%ruCgKR@}
z7%1^7pyWD4CgB2Al;EVG08++<6fil(3OJn^4G+p#NDvWlSTQ)f{PGpt5=#`^f)!Fy
zLETkQa|jwp(7`ECWPrNopcYzU5~w8)3J7Ql!sQxpI@E=>Tkx3xNtoCY2t!(8Nlr1C
z%uh_gncq_Kiy>(j+}gpNO7TP^sO11{b|YtK%JUnV+d%yaP+Ef4DxfwRsDTcetA!Td
z8h)WZKAL)53^|!eASuv&PvAMFc*vBK2Dmz80F6)Q=PTsrr06JsltJg8VB&eH<#2I3
z1=SP=B^?DN1{(&@c)4mZLo@?u{8hD>AuXi@<QxWlEd`LhkO7g@BIsb0mOcY+2dfrv
zG5DpHgNC!=(`2a?nZ@AlEPU=vM<FvkFCR35hw7#Lg4DeD%)F9(h<~^ka`TZ*GpJCF
zP_R)zHxDGNqmT%iHv&z6a53a&BZpH#Vo63kWRzD!6EsUwS_G;;L3IXFXeOql#21$)
z<>jZO!YmKYFDk0kQSbycQ=x-J$@zI@sYNB=910rOfmENMLAQ*=qQvBq)FK6S)ns*)
zcq&dUDJaS>fSHP9XF95kYO!juLNzG-ic7%lt$c-))YJkLuc;Q-T5~agR6;2QTLlKy
zVo*%^2PkOigB%5(6ICclOb4};3@jp0T$7TT19J_y+C*|rN@`9#%>Q6H@Vu54CnqN;
zfp9UD<d-DofF_fyAR^#V7cPeUw6yq?l6c4fHB<^&G&3)~7)3ZYH8;MfxGXoZ04`jX
zT2!2wpJ&C%37V$QNh}6kSC(544;KdsgKFpa<bu-76!08}71UWE7eO5Wu?pf^B;nHJ
z61Yuy;89G_SPaMwaN(r<e1^=tl++4NP6Y+fIB-!3n56(RhKoU$M1T_Hpv%{weg-81
zaL|H^7S#$)RRar9=K;Y$(FjVD=o-=D3tc)XKal~{lP^gHrEzGx2Q;3eP+F3i16pqa
z8}NV(+$+F}zi1ms?zD>qISqt$6+r!ASYZU3p8z*8OY)&wxIiTgcrY5=^#^Ie#JUPD
zpvG%rQHn0Smk;WRmllAv=jNBCDkvz}q@|SDDcIztmV?S2I|Z0q6m%7w^9w4$y-$#B
zaJv-}^HLOY6SGqlGD{Q^lS?woQo-gGrGnxM(-|-kU4<Zs3aDvd)!GW6g%zMSZ%Mv_
zNjA8J1U3!QyH>CPl^}Ks(Keurg9sl`mpmvnxwNP_vkbJ@12ka+9+&``lvo1Q1~v%X
zkWzq(U^OTJJl~U_mkM17g2NzC(1F4W;v$HH6ryd)5_2H#g2WkEJhiB#(oP{76l7p&
zutRdQK^Yw85E~H34i+{bT35ljC>1m+lBfV0vjxd3B&LCiHAo<U4Jpb6DTNt=Em&Mq
zb5ctn1C(GR@{1G@ZUUPDskXr8U?p@FTr!IbauO>QpejLa1+Y#~DUe)Hs$i3ug5q?T
zF_0htsZs!!6<|$}p;u_aRj>g?JBnsq1;>;W{m=sNND5Rj$mL+opt3487usflS%XCD
zDg<Zbmn$Tf78QYp!9jC4ph1(OveaT^{fQ|l*c|}2Tp<xuCMiHQBI`?m1f~tRctUoy
zt^zciQM5wrOa@K(<|#zmfD@9Pf=y~(3M7d@91gZqzZBwOP#)KZ>PRX|%uCJyHNrun
zpppaJWP|9!PeSd|2iv8f3mtug6sG#Ad5}qXE<gVeS1SdV)S}e1)FRNpszPE;W+G^z
zP*SBrer_hXr2w)!Cp8f~^{=k4uA`8um#znH(m?WLDs-&EK#u{e8#Icipq`PMQ=rZO
zBB4!GXj!L_l3JWxlnGuGs1I)4GjMUj8lg!=nW<^WDnP@(paEK_=3*|8f$(8Z(D)%-
zZ%S$jc%)DPY$!;hI#icBLl}5jP;y3Q0k}W`uZ6N=08Md6FhIJHphi5XtN?iyq)rdC
z#=@imqNoDA(6YjcfeX809WJn0ITawv1VUMWD0>B{@t~0|G~=CvoQ;jZVFezs0+0Pb
zShluy3JlKB6r5CA3>uS7O|b=4yTPd?;5dPcf;v#DDGH#8a5u=xHihJj#JqHnWe7!(
zg(;av$)H6J;9+xU*C4ql+1N+{<Y8FAMC%#oDCimLDCil*f*M<SB?`Kr051T|g+bg5
zZtQ|)8Z(WO6>{?P3ve3{tqh8Y{G_bZ<PzwpO+I*C6ezqwQjl7a3uIDm3JK<b^@IDZ
zo<`2lVFHLLxwuWyg$_-Y<SQU_DQJLZv~)A`l8eBzwwZb9nh=x9ahp_@m{Xdn5Di|W
z1{#b4#V=?{5{kKLnK?NSqw+|16lj{gBry*@#Sby4peR2nRY6yw7*xnX!mb!Jx&TVH
zATK4A7K7am4j!D*3Ta({$~aIJ59;ZF<{m(cKJ!6>pg{$wDWEzIB&Q3SumD&6AX}Uv
zGyOTKMPOyc1*xei3ejK+6c}K~<rjg+xIxO{>5u`O+!#Pfh9NhXA-9|%FP8!AB?c$Z
z@<`}<MDW5O0}Ig7ppaB>^IJ7VA+sbEa$BxOv8DoO^c}pg3%rJ_SdWW=Hz2X3B(*3H
zJg^<1pa5Fs3+jOA>8TnT6?4D=187Y!M1q0KH#Ha9j{*;58dyYFL6*`%Owmz*cPT&_
zGlGi&)Zu5yNX$tq&o4@001==Wdgz$5f(DeKsi0`9fK!qSZUBZ}lM1j_m<8D6A#T8s
zF@op>xeuEh7eh#XNn#Et!>Q(^D1f>w3gxLqkXAu)Vs0w90JDIUUlj~dsYUs)UZcIe
zJr@Hc--E_xKmh?B$^{2eg#xIo0*i4m<d&osmoOBAmp_1projUv&@q0nR5ZB$Q-}st
zKhXuy_=<){Y;kOCY%D`&UK%K^r9ujp{5)8>q)?QYm!8THt(T;upjWP=pqCR1mxA;o
z;`7tup(PDNQetr`wBCUxL|96PbUqot6)CLRL6rlS$<THOv<4~W0vQOJErIF-<qN{P
zK!vk<K4``QR%9w9C*~xV=71LofgAmx%m*$-phJyN^FixIFbiCT=;FjO@S+fq-LVYG
zxdos_RiOL|(vVn$C43CQp=1Op${CW8G!#^#hGuboX;E^jLJ4S1WeHS0G#DVon+CW*
zL)8Rw2*?j81tQE*x%nxXX_X2Z7-bn&GthNm6w6?rq!t&0*O-AkodRi=Vl_<xwd!H8
zx3_07G%#RDE6vFP=RgKeS65dB3j-rPV+7Mu!86#$(NEXVEQCR|R1e(7(oi)p$*2HN
zD1!MgLKi#~uB!`La05|e1y!k9s>h&eRH~zDRH|UBprDYXTB=$K(grRf6^c`HQX$(M
zY(c}|zDWheAmtzhwhF4IV3jGQ1v#k|pmnxjIbDcRP)UdZ`9<i`AQPY#fvrGN0a`b&
zYE%j`hXJGwVvA}qgPThPgNI85Lx4vlc!<I%!b-tE)DyBM&A=o=N5MBgB{c`iH;T|v
z2udwO;;9;^fbxcFu@1N|joLs0SJ0rk31m7bsn~)>wG@g{)4>cba25bF;bNev&_r7X
zRRfa<F7(DzKDY+LWmZZlcr47<(^Da(G`9fMXaP@-=jY|XmdO-@4Ja;2%u4|+zXvHT
zN=?r!E=esa)=@CfHPz!{$j!`T07+o<(IM3>D2y?%t^&AMnOK&XnFHEG0Bw*IbLD1c
zLfPPX1<(`%YOeuQkia@C5DUP1Ks_u_-x3sN$Qr<Nr_f}t0CFWLFhGjIy1=zQd=$Z^
zC^a3f7gUKSrYOMmK*!5rzE=P%1{(s&>+s$Y*btkP#F9ii1z7tDW-)F<z!8AUB?U#P
zB_)-*klq8-46ywQ8V0(i3ZVGX<N~z?KqCwK`9+|#p^%$c30h|Zt_6yreGnsEb3KN<
z)QS>?0`P=tQcfyEVlrsREhjZ4J(Zy-H8&r$ssJ=Q!k_`|&ZTHFBo<fZ=BAc_X5<S%
zo01ejaRw?KoE(E)bwf;0`4I}BGD88HBT<z`z?4FCVp9o~0qd)%r~uUoDftXA$6&aH
z0pcRaUKE6zusQ;2v;rP$6(9}-<!I14=FI#&hTO!w(zHbIqPHUO1RrR5LQ-lGszgz0
znI25S(7*s}RRmU>;BugL3tBKKfC@KIcEJ*aa5*gcAZCUbVe=VW4ntpRMM-KNXj4gX
zNn%N9F@vugXx~p_Zc+|ttx!Qh5omc#ejbCPz8|P`C;$zNfH~mE$;r&i26d1@I<pd!
zl2VJH(=7~ebCVMb5|cnfcbTch;ASjnGadt4sSY*~8h-`(<*7xwDWH8ZnZ@}zpsg}R
zsgP!nqrM+Qa(+%uCTOr#0n|WJfNBEeY1m>~SOx``&k%2cvIDrt0*iUNC>Uah7$HPJ
zs}S;1)ALI*!Ho`u#1zn=d1f)VuY+3|Xqq)IwMYT(U4+u2{QMHom={AzUU6mtLkf6>
zJp;H`2U!AdtpHk14yxKRi@`Izi8-J#K?WpIs0c_C187?TWEYOBvxk3tkZWM5Yj6lC
zpX8;Ml;;;^gN*}Q04fwxi;EeG5{n8zqe|cze#n9ag|bZ0I2l9(WS0YI(}_NKe?>u2
zeo20Eehx!4XsQotN~}V3G{{Mw0iaUWDi&lQXx0o=NXLSgaDYVcTY+jiNPPi*4d6Wp
zXpRa_ECY4dU6Hm}fp#DjgN8R4xR8ZGV`ZSt5Bi{1JgBi>3|@5su5_)y6CvR6hAvA$
zmdk{0985;cjo7M#MwZGFi!wpUAG|*VYy=lWaY;&M9*6{OP$@1+Ni8a3a0V~%g^quL
zCPk4=N8TL<T63C~1KPU+Ql$XVkpfm7T%K8yoS^{QzXyt9&`N=VVo*U3%Bsc13a)-3
zu0f!|5U>s>=vF__c8sI~NNPe_FHoFXlA2e>P*j=+!k|12s`0@a+7j~=kX;4yCPP_b
zkwUbdo*rx(yr?t}+$eyx^g&?)YO!F`4C;ESmn9adGk~gXY$}QwK&c0`?zl7+><LiW
zrwi^0V^gl64pOcT3J7&b3tCT4Pn`?mEpUuL`vZ_r#Ofoc8Iax%C^R7TDmLqiQM)~0
z8;e1mLeLN!Rt;QW!$8XyK@LUo5m+4R&-^sJ4g>XBK<)z3SQUcTdlrCZor+69gSMbm
zx{2wj3{It)pgkFoC5Qpeo}iYek)8o)b7`>xR1s)90%+GkPHGWo>m|6jfR>#gA=tn*
zl8`TGrF3p;N@gOoWyau}nhWYpAgOUG%1lWIFJa3}PGty&bZJ2;L=V|M@R$W;AWfkF
zv<EOFwJ0%%!85O*6t;Yq!6iQ#yb%^ubb~720LUWE{33?n)S}G990kze2$Id7c_pbi
zIhpC8a6l3cP6P{=q$1nzTvS<50@}e_kdc`T^NdSy0E0_@DkQ6<fo5d#DixA*5{rvL
zQ_FgweLM;Zpq4(2sj6#aTnrWf?dwrcC`-*t$uCmybOCo=K<O758&s(3nN)zfJdoBZ
zVRfKj1I-Y@YBE$~5$1tHsI(Yf&7dj+yANV7Xd^GU%EanIka-Y)fc>nHoS%}4W)#>v
z5Otu%qM9Jj6qhDJ0tu@Ih+>es0?3YO@VYqof*!c}2zANe{o~+8a-a?%*h&O}PzP!e
z<Rw>vm!86nfh$C)gHF7F*Nb5qh*0O`861LX4$MG=I#8Dl)}2-`K-U3MX91366m^C~
zsxu-|oiUN>Oo&uxid$WBVo{1yX|aN{XE1yP1tJ^~{spB2XpY8`4?yZ5i4aL0mSl)f
zms(Mfm<LX+phdVSp=k@rg^+LtrzP+Xd2DG0WF90@Bh(dS=AnBRoJk<+ax?Q3+>1cN
z#|U4-QUSzXsJg@o1)s!{R8ShkREe+`w8K2Hs1jUSK}Oq<Ek~$>><z%B5=mWYQhrei
zcncgBGm+GR_ZooAL(VCnfe(;x5b8Yr6~KXu=?4sTIhnbcCCIJ^seoXFc?f?%izO6;
zLFyps06IQ~!)^?9IP6BKD*(;Jf!at|4aThw)nMG}zz!`fC`bhdAxIr0{h`|nF%PB?
zp$-<#5E(-=g`~`qVt8PJ)Iq|<(_aDE2sDKVbxDwl7FyH64T3}mI6XtmL+*H?t3poC
z&d_|0nMOfIg6xH)dzd<GsS2BU$kBl)E<xr&!VhL1R2{_caD_P4fujRatm0G$F%PZ~
zQynZ`;8udXixhq^_rcU<WTs~z%6*V|kZ?v)2eA{yKs@SD48*Dq&95K_;#LPX4#mGX
z+y_^K(>#bjPz*%aTU?rirJM(u1;Qxm@U(Xj>H?e<KtZTrXa?GI0QNGda|s$DM=I}O
zn;{{!Iu}E5a$+9nzzzjaBNt*1cvcV8HU!Q3I+Yf?q?Wmr<|!zIfm>&uDGCY-F5pud
zkeCY2pk^M(;R*^0p#4-}J{LngB>*%JZd9QM8n*=#pn+sAH_&+#NUjCVq$8=Z0`FF5
zfQ*Uer6?pOgEl6C)jQ|srDdj<LZ<Q*f(sIpQyHR@N{eF^qI2@|(qX-_;*5OI-mfAB
zkRW7mH9rk(09x><CzTefa}^|K!q%oF>80qUL3>T$iAYEwgL*lL&{Y6w(}NhLmsXkw
z9*u_>107sNnP&o<37Mb)Z$3bsT7X&x)d+SZWK%uNm&G7oDrh*nxod)53L3G*Vm>sX
zK#haUo#=ok(ZJo~?9|i(1!p&RShEdm6hsw4!xSLubQC~yDhlwaZVcnVW52jfgY@^H
z4g{+O^<0tM#1NdCssQT36oJ;#GdPx}WacwC=jY~@=0SJHGkBEdCgvfj0WY>nErN9F
zf=lv?Ks`T?(j*3F7iR^~R%HfAk_Rn<0B?FjH$exK)WMB?D+LBW&>=10T_g<Nsg>Xb
zaSXosrNyZz=Ibah1UWe?Fa*1~=~@^V8DuJGIEFX|cxo~PdOGVGnwl$Ugd`TEYBGen
zc|sML8!&)3yBFvw1Um<Nf<2X(m!j`fnv;#f(f7<NVE~DO$FUhq72K2biy2HT3>17p
z3`0FrD8mRsb7<=_sHP||fQHL7z_TbRxsISdi7M!nonnwMXmxCG3222bWQ>O)7_^xw
z05r6inxen}YS+R!L69Nu@WkxY(gFnr&pZbI(h|`2ca)3=8bbngXB2c1F;NT>1WygC
zrsO(;Wfc&zAW5j0u7YC@XsR8wG!3>MMKwi7!8I=hyjvS=5L_*|3<B@V2d&WqxdcSR
z)Plx!K>LzBi}PXUeKCO352!87px~QW5s;XioeDZJh5_Q3vcwz()s);~2GtbMt|J`<
zh0tIp(8vH}996YKPZiX20ng2Wb`=zJfmU3DU16nw#Dttd2DS^7RyD!1R|>ic5c@!<
zmw>#ipnwu?Ft6!C%V8@}6>9+MQwJ2~r<5i`PJJ+`PzVE!X5{B7fKLzNV(|Bd?1N_j
zxfQfkrnn@(pddBHN};qkDLW}ep|}LJEfz9t85-;a8iLC&0G%zAnV19ClnEa30O`?F
zfF33V*}ke?TATzLwJs`AS4aaLWuwQ%09q*q)&(iyz*|VIKqqCSF(iY_U+@$+R1#Fd
zfX*E91Fdido%^GJn8wlqZHj=@GoYACfsHGGSAFY&j{gE{01xvjWRxa>c89_hWq{_Y
zRZ|o|^A4aT8nCniTGJ8l1uBwK8BoN$v4{n`8pQiKVv~VH6c#OR`9;a8@ve~lCAs-2
zsSKfcMXAa8>3Nw|przcY#U)@}pyb2l2%oY8sVufq@X}H6)=>zKhS(dcqYw}cPJyvH
z3U1LzCdYCyfEM0>hW3j~ic%AE71AJQm4Unqig(b-KOhyQ1(@>SkzMeptwKsEC}S%G
zyN1NOxjKe~2DySx41&2)p|})WcY>x*DnY}DdJ3V%sS3!E4&IwzQd*P;DvR?#hcx6U
z<QG5}%jkhqQV|1aIG=$lFCUy)Qos#|VnjT1G34dLmrO!rp_A00ohDqML<^c)w1SQ?
zfsz9FFe3$J&@oUtkhKCJCTM_Afk72CY6sfu1scss1ZPt&2CymMI)e;jp!z@sA=n(K
z8$m??d|NR@jEezWJ;Bqgl>!6k;0tgHMJx-2snrNd)r8E(ga$i-BL$o>L8I|t0noOd
zBydhb+5ijD06SMjqc}M+PZJ!j&|VB^SrjN!f~NRDi{~ITX!;SCN|2=r(P`kdQziKY
zV8f!*Vr|nv=?yf}S-=G{5R|Q9YrjBo0`UbncZ20Y^S}zxDXC>(gFq|95IGs4z8I_)
zJl_OS8x2aau?o?k3;@=dS^{=~k)8o$S_&iq4pj}vvT@L<97QDx2A~9&nU?~p*&!>5
zAP!P5R)D8@kkOi8y%c0Lkl$g$z3`=Ppv9ixv1^deV6qSgKzx{zT80`J(1k#-*>+5Q
z;D7<;6u3UfC^tw5vZb>GJW~QX10*jMRMvsU&5_Mf0B?-WOiqP30hDRL%{7IjoNQ%<
zWbj%_upo5Lb54G8HmG2S9c>3Yhb#f49<ooc1imB>+CEfB05R0Tjs@on3>zS##9IMg
zr2*}^g3Jc>Rv?x@CKVKN^Yb!G@{1IpJ3tszi^1DKxwsfY!P^13KvlRdXlra@N(wln
z5_1&5D|O)s5VW3FSF0FQEhDzYz=noFM}~p6OBGc@*A0Ug_<?q@A&%t$Ej|NxC_txc
z<m4!TX8H5rGd^5g48@r_sd*)k1H>TbA1dgAPw8?Fat3W61!Zd3PD!M>4lXX}9(M-l
zs%y}WtN6^k%#tE#$&~{-_Cp6Eq6^Oa4Ddr(lHo_!fM$d+RVt{0YCaV4)Vvg;^n+H(
zfptUnm*p3y=7DQ0Y?_lH8wH>~fLMydji5P7&_PZRMM&EZA<NG}+bTf26+kBifLf!e
zMMbutVi$D48Hm=0q!WCOfT#euRga4Sk|X0m1J~H}fI<!2O4H+FP==;G-Q?7qoMHxL
z&}1i+U6h*6pbuVLo>~k#)eCf7Qi&>PzhQD>j&5#ZvMy9FLrQL<E@X`eq{Rhk^W}oh
z20=f36I^j7gQhF>AREwg<8$)M!PB?7@gU1V?Q;0Zb)k^sEfxHO8DLE0<AdOW;B%Yc
zJZIREQ~7xes>NVA@L6=ABSKa6v_L2M6+?D;q=1A#oom$7EEH6cPp?o24RHqTID;4z
zQdy7+(gn(o;6Q{<XQ&o~`c2>y_(0O2J!zmbu|V4@Kr0|X$NPdttyGI$!AC3wfR0$Q
z0v-4U5e2R8P0cGQwgTCtpa4A|3S8HM`XmYp{@_#EpliUu%XF2M6+kv*=B0x-8YsX{
zYXX-ncn-Ak%ZDDSqgo8t1NIy2=qZ>%U_k{pQ0oSAJP2;<azXQZpn?H<5)vNkA$d9;
zG&Te~wnRY}bRbMV^cXkr@?vmT24)}3L7)kG&=O@G1#mtEF(Hi~$Pq>0_C^WlD4&!P
zXdVF9(}awNwp&7qQo*aq!7FPqtN`to0&muWEVlq1hvAk3T22evW`=A6?%?MFm2$8l
z6Zqm(=mCXbISj#4NF1Q}3?T+ue+o)msVNLlLC}&h&@n}z?oJ|Ty9n4=P<8{=PbH~&
zxZRzUlb-}y#tim8{0K3ZOr%4?5*1)4;$ZbUIL<)h0H7oZ=~jUz^+6#AGaRxrQCV35
zs{xQL&**6h5(J4Q;Kk1ocq~Z-_XH~-!3-)(Kuf|QNdv@VKpZ!hn!=D&m04f}A;IYu
z8jk5znFS0W0$DJpDmRe<M4$@hGvrj|BMZT{-h*At06L-pI;{l}NXsnBEeEX^c7rh>
z$F?zegNoK1NS<c^d!GS3VXg}@0xBHj=<5PHiw$BFWH%2(FnCiB=#;{|l*Am+FibFb
znI(v+06l0Lyc;q;rGx<#<k0a;1yEXN$SzL;hYo{xW>I!|etwDqDDt58W#(2uB;ATq
zQ;U-mb5a#D^?W0cmB73UI)(^TU4xG2O)5?SEeUW6c3~(gNzE;00G~?8P^z1hpI^dI
zm{-9N=oi6IRsmWwP|N^5n}q>pl4Fpw2SZ{`K}I5jBbZDq%4Kj2@&yl1<S0~Fm@#A~
znwc<oI+~d<<eFJzGx(ZWcr)Z?CKu%=<s??6GWdd+PGDwkW<fE7uV+9o1Bhj20%j|i
znJ74AmN4XH<`)|=_<8yVD|mV`fLDwaBr||VbOM|i3JQ`Lij6G|7(AVP6@o#G;L?KB
zA`gb*g2bX^hTs6lAZG~M%ml)NnVXc8n4F!KnaAJ+V<eUp85=P;h6NcLG4O&90tv~_
zSIAAws|1}fRIH$pn^>U-K3f&k?^jk<01e%N=I+5~?dIpDD-zLm<6<aFEdtk~$+;;E
zu?h?}o}eW?L7@R5cHq^u1sRp`u*CpY3VHc?3Z;3Og{83N7T{$s;FILAs0Iy`=a;~W
z=v3Hl6;R_4)QAKfz6<IyXFz+ZphgH619;y&q#*(}T#*aBz!xG?Y^A^e(y9R8aRm{#
zf;s`T7!T5e104^Q0y+ec3%u|Sz9<knLkMoyLrP?%!*lZT!H4!jmQO-7f)4R@3IUDT
zfL0oU%m*(Z1RLt;2O8&0O<{nH`(hYp2wnWh1zH&jVMi!{jBxaWuDk>r16iwz%Mhe>
zlUxjWr8zk%sbvfht3X{kaBmdUt3mW<!N*pXLPk_d@)bbGJi@l|<rnEd_t2<<PB4Xz
zFCk>X$M-^p^PvaafX>Lx)KN&!FHum<1RWiXI6D`^Y*4QNbk1`=_%!nrE(XZbcTlMg
zt*ju2%Y%mSK!+%Rk0jIq+X+tAAa6iw#9|%L$-&@Fbk2!+;7Tb6ypI~5?m*rJttEy!
zBG|`2B;L~nJOmJ*ms%bVO&8E4h@w}$7(B|Q2OWJ-0H0`?rw%#?8q~rC^@0^tGhwpe
z-ZjKD@NzxS^hg1CTOVkjFSI4ApaE`t*sA74XmT;2hdp@M4JnXeib3a3gZvCN9Z3Zw
z3c!gJM?91kCn5V&0UAtTEs$u1PH5;TfX<)?t=)uXGtd!Y6`;)zppjQ_6j&+v`G<h~
z8Sm`x=jQ1i@8TNltN<FBg-XMUS&(Bv69~{PX^@SISk!pB!8Rm8lz{Yky1}=KLeFUh
ztvdvtDW8^>TBHct^#m>6K+3^uCqN0M7;!8qvNK!*Fs*P6AY=u6BpWHLK|NQ{AOYy0
zP(|oX2Ox_<181Of%0a~`IC-YRhRkuf$QhfHK>HmbwJr{Cy9S^tDFvOM206D>kqbGe
zgU-`~9v*}e!ysD~Kx6vQvJITILxY__od5*|2GEcfc)k)cL5Vb)3|g}aIyN5^_0S3)
zv}h81G8DLQ21NuULqc}iaWUlNmqYGb0JX-UhiG##1c2uMz_}DQK&uDIiQtpf8MGi1
z36Q~mkTOszt+a>S9RS(h#|0j@17{*DP=$fCa;_L^jRK0@Tnx~x4Jq!SnO4yr-T(~^
zc8d3PjEMILbpju^0V<=DGeAS6kWqYwvh+l-rQS|1R*<_yKo)~L6M5;NJ?mwlITKLB
zn2Q0lTNgAM4Jl2tp_5hMS|JtE_=M(RRRa@P-r|Hcfk6c@I5~r+NkD_l&Q6|Opc5Ct
z^ASc7h?7-7TM~^TV8W<84Nx8pa&>fx)FfFmI5N?O-E=^!ATtu7%XE>(s8dt)^z0$=
z0iEGffJ~-=A{jOrt`9B?D^p8Am!iN9Q08KQ9{d7Z!41knp!f!<gD(Wu<6;2EGidE@
zW*+Dm)k-b~kjLVk9RncOF@W3Zps8_q+69d&g4zveo&b#&Gvp>#fKxEcwa^q>lnPqb
z2O1Uv&Di7@fQmpa&?o__I;0d28Tl!ITx-Gr>LewWWP-M-fR2gCOabjEEKV)ahm?MH
z3^sZBkjm7K!3GvCV4vABxVePHy9Nct`}v2s`G@+szy(|*JcC1m;aore-~dNwS2*9v
z(Z%1*E!Z^#StP(Q!~>Zh9O4*)&=L|9>gVhj;)<}t$<f8v(cRM-Sx=a2P_U=JAF@zz
zNKmLVXbJ;a(8n>-KQx5FEx_H;N&#u2&cG-|LBq&E)d=bEPEAk+UzCzs%ut+Il4!&L
zK6BklAviJD#LPekG_{_pU{ax=t-uiA?3t<nx_KzrF~m{Vh>JnLASX#bzaU9JH7S_^
z_pp|qe~?0MA~@#2?H2Ih7FcgVa%O6ULy7?uFu<;l!DAS-bj-|yxD0ei1)8BCZ#X2S
zrKNxxeGCwPq*g!~$wm4(so)LC+Mw;q5GHuj5_mrV;#M2bs%eF?#3IlU`gx_G?n^wV
zZ4F{1GUVlhXoj-Pl+^rq@bN34T_(l3rUpg~!I?Rk$@zH-zWJczVi*Eaiy#Z1jTkaY
zi!&G$Toa3ODiwl37hIGUfTlV@OQ{(^<9@0s3ceXtI-u<4>jc`(3mRn7Rd8_$G6MCx
zia{&rREr^k&Ka2n#h`0%RErtFn*~A5Zj{&pH7!z7a}p~VJo7S36g<K?p|wanNCuh%
z8HzJXOF;8!48@Rr0<asA^3&27(hAZO8Nll~KnV#n(+TdsD!^6)GlYSYmjXjjVoGX$
z9z&RGFete}1_2dZBV3(BLp=T56`VZ%gF!u%;>38+v<8Epzk;)4kV`NZgR^6#ucIG>
zlVeawFhfXakasYHv!kc8e=vh{WI&K>a4>_1tFMp0vp0iRsGnzmYY;<_t4p}QzYBx2
ztBYe0Lx`h?XNV_5fM<xaqi2vGLzrujiz|b_kE5RpgNLK1AINNfKS$3XR|ap#FxMbY
z25(0vPd`rv565svPfrHlP#+&pzhH(C{{Y7*h7f;0cSi;{PcKgfXUCu*&nSO};1GX5
z*GPr{e;>yn&tO9XILi>uGGYjGb$9dylZFNm3L<7?z!2mZ=IY1b7zE0pp}`D6u73WW
zK@5&QF0M|FL5_Y5evV<Dh6W7Ik&b@x!QP%eK5m}D9uQFz2xY_&?CI*~=NRwo>FnX-
z=>igsjCb<^l}D~Y3}KFb?*8r`3@)C&?m@1R@y?E6u3$5qTs_@g<K6w8A{ioGeSG}G
z<DDIY0zj8CxOfIT`-iy(MKbs}28S>>8Y%>XSA6O+1iJ-;m%Vrf`&*is88AQ&-v%Xh
zP~$(fq6B=ZCy0&Ga)FCNItr;N47zskV>A^Y7m$E7WoIU5gU9kA=hDHIAjH8tIa0u9
z?!(8z$}=)^K&K%?4nu(~5``WT1acW@a}n%Re#itV<RC84@$y7zwNfZ9&CN|s0j+w1
ztl&@2&j-~vIi;|ZvOx=(RC7wX82p1xKw~5jJ0WN2gL)jGR#awU4(Rq3i2HOQtt*84
z6f~giQ^-KQf<5RgJ4mo&_ysh82WqY6=cHIG6hJPqDlJGaN=yNr_N2$ffJ-0raB|RT
z=6R{*sYT$72b(}bH%brOnm~z1aI`?0h@e^>G(-WPh67EhK$}k>--DwQGHj)hU!(w!
zK~3n!FwmYZjbe}|VFUL?so?o?@ZJFM7%3#AK+B8~!33QYFa!@}7=cM+@U2tu^I*Y;
zfTyNd!@EO@h?RWKF8VHEE|Aqb3aZ7>t~j_Zha4+k0>5Yg<Oc<37X?&DfYMQ3Y6-|a
z@gN^CfJ<qRU;R=`z(?qV*x+NlQ$Y8bF$5#86abl-nxYWw;{<6-LU+<ZuSfu;6Hq}5
zQU!7%I1HdlAaMbiT?1LJkegbPk)MLp#s^>903HzluV4TT;ecAgIf%o9!D%%y2Xyxu
z=vJou{1T8&;2xQqj}uq}*k#~Vgqe8?pxA|+R}boKWu}8~MgjX#0dgoou{E?s3-WVG
zz5-+nPmhZs05nz#)}NhP2^zcrb>cJgN>f4W9ze&(JLYDlC;A6N41<RjgPwvqDDxz$
zgB$4O;2lU{-@?=<=4584D)<Mdf)`>2C+2d2h7=h}lT$#aViy-@W-@>XDAxqc2ayng
z0uUcWK)9e*fRV0=nE^v^W~PCeg#m-7iz_J1Qjpg|fSR@7ZVWg#fXDxeAv*&>HI;%Y
zd_TNKUcQ27P@pEL_YJC`lX9{_i!ZFeorlt5NMpZ(ivhf*E#5OYIMfxZJuvkklTp-y
z<5dA}4fGIr&^}F2_$MbP!EA;$fWX}fbPGY+T|lmcoLPpfTSK)%6J|L~FSyUI1HWVp
zdLFoH3iw_G$SE+Ojp5*Q2Ws<yoRFCex=;nQvMD7sJ~<^GG(wkOS^~O*r9{E81hknf
zGd~YxDCo>=&_XAdBGCD8@Q_AGfp_2(Bf5If*}mY^yy8>^P})*8Fp5xc1Px+98G)ch
zuMu1fnJKC9Df!?&BLmoB(9Qy=uMCz1OTpcyr2smW9#jHrftKBrAXechF!*~bfKyd`
zZem4JX)!3Z7#kWIF%*MR7OJ2Lq=gI@bPREXq%csbgNedt=RxH(=*$Vw;h6BVdlXXg
zQ;R`G0eCeRXk-_(mOmdfsSdu#2Xqf3Xv!DtsTA;<A<!Yc3Jh=$f_k2+#qgy<dLT0(
zB}YE^d@s=Iqr{R#NU$KUpaEUZ2@V#8=nBx16Huk40JaB|e~a>SKz6HFsB?jGjsj#|
z3s@nz1qfeM0MP<*8aSU~(+!aZTLf9}0@{uV3Jh2Zf}d-PO*g30LD5?PJ{%Av3|{D<
z0ACUUwFj4J48gvp21Zs244}jZ9S;d`4f1s{vSKi>&^I*EH!xyw1Kod<R0-XR22xoG
z?GHol6N23n2`al3g288efQ0=0LqO+4mKG@ZrskExL;^s2Nx-MN6+^^xQ=y#)NK+i#
zPgJl4%jqb9#^>^j6ap1&L9;cv1tp*bouI=8Z9(n*5@<mT8+HNpq>09$#z`KeWe+K@
zAvS|L-ykO;*$ol`T|0oV9V7xSm?0GbxB`Qir3db*b8v8|8iAJ2CKaV7W`mb-fe!!#
zZ)kyf9%KmvSQIn|h%Tc5z6T|<7<9%s_+Wjob%}WjppJrTMP>;&fEa>7s~L+S$FD*5
zE2maumN0-;<H1EijxEUmE!Bh^Gyquw?2`)83Oce1l<OfyI)h^pXzT-ORf<9?=!R4U
z$ieRl#TltNIiRtCyi_}eFi^iv!5^HTia{%XK}W=c`~h3X1n&4LfHt_nWCNT%bzKz<
zD-`s>8AR8J0o-j123-mQT5$>K#leh(rX|S5Dh!S(S)jEN1&Kw8xv8LIQNR^H$eo~~
z9~>$S!QfMz6+l;^LC>6KKw^Uq|1B*6@2Sp6EJ^{*G9tAH@<F?;Gm90VeLDu{jQsrK
zR8Y+g>$-ya(h%nt=j4}wR#}03o1d2qI=v56M(7%W2ip}i;BCyJRFDI~-39pJcV32O
zpyDYvA9Ok)cp<nIG&B@!6_RuEi&Im;T~vrwwxA`Gd7ALhiFX3uCJSCf3i3E803l+K
z)$`yp5`!FlK_gz^%dGN}Qx%d*L079*!c{=L4L&cT62rBc;GPPkb(UU~2-?D142eZ(
zkd$Ynf}9Qx$N*<geMqe47l8%x^T1wGK+y?mtiwVv1&f8wkek~eSs@X=h8u1Mq>BOy
z%FMiUh6)QaNTWS97j$4%ei29{HMbNVWf`e3>%r~@O^Kpv0PXuIElNzTv;w<17j%;h
zXb22+?1m0ls5l3-h#h_>5GbNSRROsF0y(Y%+AK^@tAJR79_gB(DPGVFE~J!#C2F61
z(A|k4&H?(K0kCy13@C!IX_mD7A_ZvE7u-k$?aMApEmA<!8=MNd<`wB)Og#mtP%bFH
zB&8}8l|uILBr3qiC1D1GQcx1;T1wD8o1h)#{=o|1S#@yUgSi>Zf!3{tu)GXj(hYVP
zw7P;M8>liPm@-J;0jD}+m^#QUQed}0>MI8SU}!~>3Cfz#OG!Zr65&l2@CoC&;QM$%
z(UF-8S?vkBEC^f$fpmh(ScURLPzwUuTm+c`N=Kk72@*MwY6pjDm<E8V<IKELP~eq-
z&MnS|booJ3)sRaG!9|m!e=tLSu}M61Eg@+8EJF(DR%&p!*Vcf+5qd)p=mIK`Sp|v3
zplirW@)bZ@!GVst$`Cx#zyLbs#8y8gwM@S_CD9m<DG=qb7zOznURo<S2ZSnsR%t0H
zSSdLAIy)<XTlE3X3MOU-sTH8XPz44@1qLSt1_fx})Jh>BEC}3!w}?<+02=_h)e>ZY
zs!2`?=*mk5@a5&0qM$NL0W1u<5(%c(*~c3qsDLaAIr4x(0dg!Ls3r&9@|~jK>%;)s
zHw-F`z#G{Z6rh893Sbu$Gk|(83IUEGjtU+wNF0|i7Y5@BLnCkz3z9-`z*2^WCI~4w
z2P9=;W}pC;G6HD>PY;E;fM-!WTwr;d0lefv!7Z`4guyp8C9^b_AsDn&FD$hvDZdzW
zKm&N`r$3}n1dR<tN=pV8=oR1~A#gztx^-1I6*&*ViZjS1Y~bjF<P6Xmo1l9MlRyXV
zm89ktfX;yjXGe_007{<l8_l2z3z2?;v85k$Es#_MPL1Fe1j=9tLr7|FL4HwUQD#mh
zB#&cJ<DL(yMbTR~(1r%6WCd4^p!?<WQWVm`ib0|n8bHhcKs{&$=w1R)kl-){nnOXi
znM3Z#0~rX_hUx*3A@Pur1n@`-EW0vraj6z_fvyD2DTUk;tXj;Vr<#+(prD$Z>7-f=
zx*c857;+FC=(bzXdFrX4L1ZJ8`vX#-XT`yl;E)Afd;?liRRFpcKCvVbt}VSZuPU<u
zw7LT{zy_M40}VSt_71{(h0sAK(8VpVwF97QwJM;URmd%KU=cko20c{+<D3)*8_?<#
zI|dEVItxt(*rJ7$Owb{8pwkxf^A*w(ixj{INnyx>MyTL=a=<5L=0GQlzz0<@WacI3
z7Zrh;gb=4HfQKsKdm=!!Eog)UQbL2qap0zvXXd5kmxGVghbxDg0lsG!wAq9KDv(^1
ztdN^o48ArVZUAI}6TGk&=5EkHK4|(Kw5%O8g`8fJQOp1uJ_Jv8LngUE4LZ2*iz{=J
z@^gyeW`g_+(+G9|%w*7RTB!b_)PmH+61W!BP(jrNvj-*$3oCH+LP81=fKcNh!l29P
z6;d+6`$7|oDjA?#cvACHz?YjtCh6d!po_#o_sS(g#WVAYOViRalQTi5xIji(8Inpt
zYZBlJKrsWE3WN=cGAL-cIy*y1&{QY`^f<5-$RvzM6@!j~vyW<uCWDJ}5NOy3)IEfr
z^aM()$)FQ-K?5?WpuVD_q9PY!!F6aJqD_*N2s-8rG(M~m>=GPh3r??^umuPT;AQ*}
zH$&R5pkX{c1<$<V63}jkL{R5JH`oQ#_I2^}_0<EdpAQQ153&MHBSDT;1eMbY0iYB4
zK(j##aJA6m)F78Lf*bd$piArhLFY5NxCDXQ@8C)dVLa#xV#wKT;7hpmxEO*`3vv=c
z87CuE0ptMCR<6>VRPc@g1?09DND|3)t}gx%^{^{+Kw*Y(1bFz#N+BS#AQjYvNKx?1
zOadJn2QmeRyP;YTj>WGI+~5Np>Y19N06GkW2$S7mp^V>TXww0o_h4acNL(O8y@n;`
zK;2k{<jUlnRB-bUlnx8P=WRiQQh^I}9cfM~{GeOVkP}Ebcz_MmLjmmw1dZUMN2Cs@
zWPsFBpfm<<w16)AtOTFzR$Nj9nY9I<IDr(exZJ3kQwlmV7<AiSo&v;iph*<StO`6g
z=y5TCg9bFtn3$K1mfXM%Oi-!^#g!hs8UX762^E7KYNTfx268(%=^E-;gefEzp{Cgo
z(3k*71IYiTdIkz%`8g%}At63^(sL%v)hW1>Hj24EVGsjR1VP)4L6(8`6e2sqSkD;Q
z5%9etF3|g>6cQn+2^`&t;4@hj$}>|+GC;K>C}=_Fe!v0`<g;RkD~*jnAz@|$iX~9s
zKuZd+R<yuHgeOQpC?S<1l~P5iX+^2U845*-C8_$LN(P}kIKV}rC>69kCpASOB)Kvf
z6sm}F9Mqu$n}`TOc+5eUw1KagMlLIy9fK8MM}dI73~I=LuBL@dVt|YTC0W#nH-vZ@
zp*IsWS&*h+1Uf<ANY7LUoY#!?3^3AzZ(=qmfk4mS4)Ae;Ecyib17v$9Xp97;paAMg
z@P-yp$b*~(bqqA&f_b2jHp1Z=V~}f1Km=$ZFDUV$r%r0Ph9Nnz*w|JzMIkw{*aS+O
zf)`sBrxYdT#)G;gwxDzaE;@`6OcMmt6vX7>0u5F{l8qH44XUOnI8`{iDWJ3{5y=6$
zZUdia2hO$717Pyg6q56EN^{}Ih^K<La3ge=f}0$WdAa;N_)vCya$+&$v;+96QY!^y
zwTZ<Fumw7xstc4tK@|%0d@%6-v4Wf;Y<_{(t%aqjrQp-t5XWI4T!r0Fpx6i1-k==>
zpv~zB^{^e`&`KISQGz2Yf)fm={0wmRv;vK_DL57-fm)WJ>m5Pc8&edyK;0!P1@Ph<
z#7#kH12d5I!k{TQkU1#3<Uu2VMJ1`Ax*cqZf&%D>0+-Y>(5`vU6wtar&lKokC7yXD
z;KM>vA<Hpb13-4WS}7<5y961;2e?)QIR^*3hA0#jm!y|MT2El-VONrpLr_UUWgdPt
z896BhIZ61{6s1%mD*#RP1h@wUhrreqg07N+I1?lVK3EpIZ>F>W5@fC*i7;maP)iSX
zX%g7$AaV3f-wKJv3ZVWZ=(1~23j$%Zldmh$CcqY(a)HM-U}nKBMT_4=@X-^HSO&)s
zXyF`W1ScG_y%Kgk0>}ZG$)KbII_wjCOf&e>Xz&s(kS>LkQt$|`dO>m~hz~YJ9g@8i
zxj+l87@Pw_K^|8CF+h9P7*Iz`7~BIugC%+jPH>hpoaMsc90ZYdgtI{EiXehc46bm^
zu2B#%M+Vmj1PiLrk-;w?wEU#B2y`_Uw21&$=*-|60aXZMLUg+z1YH=oI2D`&oDJfG
zBZDgxT%3c76+r!sQqZ`89_Xqo$lL+sP7&}#g*)60FqRVojO7exxxwA<$Pf(miKD&~
z$gx3=o-PVzu<=H?tTRJ!Kq|z6AT3ZPSVwSbGT3|i-ie^wec@VR!QsT<9s<(|V>vMd
z!yQ^-su1QG6yh3T%AgSH=k4bo?x&y;5Ef($O7WTu;7wb_pg}4HjQ}4fP=T)C9{{0U
zot!~@*bEYAW)U>*q@VyE90a%TpaW+Ls>uqv3Xnk>P)iv!ZVOt!23|)2(E~oWBQG%r
zT!1A)3ozAUP$Eo$*<fs>knN=4sp||{w5b5$xj=Xfu1?Mh8Wx~dO0gz{13jWl6O<nq
z{2cvU5b~fqOf*1;1}hj;n3`yU@6dtsjWiiDlX7(ma*}kxD+m#tF2vqoaC-w(mxHcd
zF92<?1?MPTSdPS|2efZMwHRENLH6G2aWNzplrofL=B9$qmC^-Oso?f8Lo%qpjl>5n
zXN0eZgfKvhBJ+w3%}h-V@T_M9g$i_WB<P5B=+<9oXCN<MAq3P?0rebHLAOXk90#eC
zic`V6&_O%LLH)^`3Pjxm)t8!AQUq!sAtrA@4K)<qpkdD(gjPs{CJ{2y0vf>pRpz-V
zpzay8L5EF6He@AGQVJI&T#Dl}^Wt+est{qE2%h2s4Fx0I0<DxmyE;MF&cHTOgI07Z
zKsQ%Iib4iA#}H#9&^}!^#}Gp}!we(>+f3l*7y_Em1KpXer3KnXp$^&zl9&RS?17Fh
zLT`t5a|{7p4IKbF0RWQ5A)6e_z&BRq=RrsPLCs^(o-9b}hmfkps>z^xTP$)wr-4Cu
zT&gMHl~WqUn&4rBl*}THVogvV9W+J(UUCBRcydlD=*|Q1LKE0LBE(%tyA`Yy6hP}#
zz_a&|wIrZnSq2w>X9iziXV?~J(0Los*$7Yx&cNlD4=UL+QxrhKkOoR5rFkh_49GsT
zQUL8HgltFztrdkHI}KX=0&*RwXwcGv-s%i?vjSwWNdt7+M3I7_ra~?_SwO2>J@6&D
z1av^6kFZiBGK>f7A>INblHG5lV5Et|vnkL;9MJkop`<9Ypa8T(G7oaqFeK=TAs)AJ
z@eHz4V6X{}^aW80_6l|i4623(peupE`vIL3^FY<P0=UG27?5973DK+o4`I+&C{Sd9
z2U!!rd*X^SQ$Qo&MJ13`5yh#=paUa7OK!BZ6kr(xasfCrwYWg<fy*yafZV9d#emxe
zNCO?518}+mqDB|uVZw&#DuAvw1z&)`#lVF~p1z3%;8K?XTE8(MWkCg9T?GXNgj&$t
z4k!V0aWQCs?}pX{HE~n&i$H>)brdOjU{+9S8HnaWERR+IZM+4Efu<3aK@2YFL1!Q~
zs0s$t0Y%{DpT)3)6d-HwT>PC;1)yCK(E1z5R)Z9nqd^@LEAZYkNTC5CA?{`X9Trvw
zsxuWBJV5uMfOhpVIJ<y`rx-x9lAt+MNNh2H&O>8R1}}M1P=?j8V8en-!QIqi1rrNh
z&@e4@Vl^`_9lqxRtj;;HATc?!q!K*Q1RCO3@O1*+M3a*O=D36Q)a0ZnRDhPUY2wlf
z8uNsg+FT4S{=p2M!Tt=6zMk%m49d!|Su}90LQ*1leGV4`=*ssLP)Q3p#~ze=(G`J~
z3xFdLT%3U1YzVn_7Q|FA;8Zm<$VuT;1sx!&YMR0c;-^3fqY6-&m6QmYKnnsb<OC)D
zV(>yn(Ar<f8aL1pid+mCDXPh;DGbFBs<b!>!br(ahA=8B!19PR2C^Nz_7l`L1(^#H
z@GH%Qa*IJ+@FXKR1G|Ba00XU}1aHUAF9MAzfVTN0g0>&!f>yYK_Nk$I)!D_szz`HR
z;YIm*=?b2~{tBKcsd**f6bL@V%nDjtx%w!C_y>80_$velxH@~fc{)3WfcAiBX@L%Z
zfz(-`sUC&o#FE6E{B-C7UKBI5v=kurxaKH?<QHX@<SS%iw+*%O1ka5@POJcJz|V<5
z^#n+9Mrv|)acM4e>s4kRc&-doqrjX4b|GY80jNDviD86yY9*+VXR2UO;phnI;$f&k
zM2#w>t_H8>0x3&@Es_JLAT2GVk^*#t9c1hg6h7cQhf%phLJ=g7lr(V|4srzOluyvs
z4R8tw22BE0fDiqErUuZ_AquLX)&Ybt1Ks?lXKYl=#gGVE6&nxgi-Au^We6_K1*Huu
z1<*~e+2CRtb^;#w@FuVg3eJ@|pnFe?z)21?0D&Y2vOd44SU;pFF*zGe&LcH31*`{T
z3|I~|dxL~Q<zaD&f`WoyX|A3EmtT<{q@2|QAD5z_0Cp3ouaJ|UoUH)%Ay^wo2(+>y
zpePfRmMXazRCP^K6c|)>4GoGJRLxR2L70J4)ii|*G##7`$`GI+21NlEgDZ4x3wV`j
zW)Wz1v_t{4%)Lax$iO=ZH0B0r8Y*%zIA!J+r{<Pg`9ro-LdBtr_be?Lk}~s)U2{wI
zL9||GUWs9%6?}{ccE+fJV}z}$vH|EYTktidRtjaQ#fb_w8L1VZiHuax9ZRVdiMgN}
z94uo{VQ6Rwx_dn(6&!L5o_--g@g9yoA+9c<qgkPQ1Faw>v!{=btGlC*f@?&GtDlRj
zi$a8jnSy_Sv%ib0B8F;J&_Y%`Iv}Qi_IN3BfmfTxr<5lvlqVKJ*15p8@Piv@pp~Af
zC6IMlX+^22RjGPh3{Jt3phIFHbCP=C34r|45<M=4#GDe)L{%y1<Y>?_9C}=c`Uk!$
z71p5fadI@V;9_tI3bciexI(iTxW3l`Rdn$n(?Gq42rkfdlHjXeK=BN!EgVA};{$^H
zL*fHG{S~0Q0)t(hL;Qn+75w~NT*DL~>yryWSMlVfLuXnt^YcJw0+nPac)Gayg?PF}
z7Q;rhkT&;&^&@Yn1?@RhfSC?H%`>&AC_Xo_I2$z0R-wto;HmEqDOQkt400won?u&#
zL)W-LeF>I84j+(TON&9?a|#WP)B~6Lpe4orp&{U62O4h03NAsu3b1qsS+NMZLknbC
zQY!dfrAp8Ot<++0uUU_a!P(7`!OuAmwC=kEycklG0kT{gGT2_Mkdm30o|j)-l9>$I
zKwDarst2BJ0GSJFnkR#{w<ap2fEHPUf~7PEynYWhi3?dsmYJWY2U=s0m|Ox;3A=Fu
z)E@*b^@Xk}1SP4&l0<N#vr+)JPf|dqj)1FfaNO&G?8pS|GAPMc2oLfMam63@!TNrn
zDvgVm0o3>cFHD4<Xa*GqwYETqc!Jj3=RhyNf=Yo}FG-*~+d<8joD^ssU(ChJkeL!~
zVi{|tfObSVsLnU3;L1#iHZ_j5Qb@~8%}IfFjBG(k6;uXfrbL^8By-DCauY#Wr2@3s
z7o^9`B-ToyATu9D(A+fEN&zx%oRV5ll7Wx}Il|m5)=B}qUK;EYkXsQ7GE<_>EnxC#
zsfi_}pt25{R8mt=6@q*NHVCc|axoP`705mdgIFtt+{7%zxo`;i%#>&gLy&Z49xiDk
zP>|*4=7MG=Kw}*Uw}6iHMueUPD1e}gyFg0<U_(}^DGH!_CXf_@f(%(9_<#=Z-3#yl
z2fG^-iYV$J=USjy3kppvs?h8-NAm^jfH}C0ppXCsd?|ViTY~%rUm#nQ3JQaw)M8MU
zfoo=P^>uVsO@R~`3i-*&rA45v)Ovafp20!jwsQq+B*aP~C^b11w7CJY&;T;o20AuW
zk&D5@(Z`L!E!4*cvK`V&A+;m})Jz9=^@>wV6hR#z(6KeCx!_CBA$LrJEC($jNQ7Ji
z4$7XOlSaTtNarElC{_YFcnGwrlR+WG)7KSL5-D;qD5T`)rE)R2`niTE1cR>#&MXFv
zV}P%O104hiJ+TBdv6BbA5K{wWsVe9c3&<Xn%sho4chGf%U;{u0l403c@9XG;+~S1>
zfFc*@?3{R$ii-Huk__;SOeT0=oE2zD22>1!#}Gh87Dygi+=6<n1qI1OX)7qo1aIii
zD2Ggtf<g$zC}anyrhvx{L1$m3Lc8*y2_w~F4NWcvR}W`Tm|#i10%#+w0%(I4_~tWE
z_<;81=A;&ZM%7?SL94yM$p*5q9&7~Y^kV~12L(|`g8Q;Xsp$%;pn<J`j7rcAJ0Ok%
z`08FzOXU9`1%DSa{QrB*<o^#vhW|ep8UFuJSn~ge;+Oybx)>OER{mgMU=aBK=a10;
zzZ1Ow|M{c*|IZ(-|9}4E{QvW3&Hq3D3jY83v+e(%KNtT0`Sbk$pFbb||M{!<|Ic6B
z|9}1l{r~ef<Nu$(Rsa9|o$&w9-?jh${5|>q&)@g||NQ;?|Ia_c|9}4J{QvXM>;IpB
zN&o-+tNQ=v-;)1-cAWYD!^nk!fidU*pMQJ)|M_?S|DXSY|NrKG`Tys?<o`eamHz+v
zul4`Wf7Abe{-^!_s~O6`z@Pwf@Bcsld;b6VKjr_Q|8xKU`M>1<zm^^U|NLLez*&9a
z|DXTc{{Q*E@BiOBUqJr)|L6aU|9}3!`Twue;s3u*3kC-E0tN>5od19R|N8&u|38pf
z3=HfI3=Hfo|Nk;@{Qt|q|Nk$8%>Tbk^8f!bsQ>@#9`*mPUh@CH3<m%I{9gC}FN5X(
zzYIzL|1vcF|I4uG|6hhR3=Hfw3=9l53=HfQ3=Hfg|Nk<qXJBBcU|?WKU|?Whz`($M
zgn@y53IhX&!T-Mu+yDP%H~`Z3|1Sebd<Fvp`y8nL3IBh1f$)+4|5{csFffELFfbVW
z|JSmHfq@~0fq|iffq}t<fq}u}|6hia3=9l83=9lC3=9lD|Nk<4W?*1{!N9<v!N9-}
zz`(#zz`(#z!@$4}lFwjZU}#`qVCeY&uVvN$zl?JK|1ugeFfgPrFfcg$|I6t9|1V?2
z|G$iB|Nk;J|NqO_|NpP_6$Z|xeg@9!0}Pxs`3wx~9smC_PWk_rao+#GjLZK2WnBON
zFXM*)e;K#_|I2ve|6j)M|Ns2n`u{JJ$p61g#{d5^1u`%&%wS+(nDGBEQ{n#~-Uk1F
zcwJ#&U}*XOm#OLhU#71Af0@?)|I4%y9DjeAcK!d$bQl_LAU$W0{0<6-nEyZGSN#7G
z=kotA(|wQ}0|ST0|34dj7#KJ*{{LlW`~SD1`2XLY%m4r0HTeIRndkrCyE+UE91j2g
zGE4pc%d83VD+2=uNWBFE1Bc81zsxrO|K8POVBoM}VBkpj|Cbpg7RJE9k@Ej9bJYL8
zcQyY1NSOd~AH?0vGePeA|Cf2e|G&&T{{Lm}U|`@d0lDY@U*?nl|1zKX|CjmJ|G&)7
zz+uZ-eE|}090C9TvdH}Z%VG)+i@z+1pg07@<^R7d{r~^6tYctcu=xL%WiKe5|NqN!
z<^Nxnm;e8@Z2A8q5tI%<=>r^B;CO_jb5PiU!pj0=4%9pq1_t&e|NpXl{r{I$mw|!(
z!~egm<_rw%C;tCsbp*K`;vR+>|NpXr;s=(tLjM2Ax$^%<`U!|%SX2N1WzG8km$l&k
zU)Bl#|FW)NVBmPcz`*h5|6kVK|NpYy|Nobb|Nmb$<NtrzlK=l@EBybLZSMcSY-|7j
zW!wJ$FWZ6tf7ven|I2ps|6jHz|NpYR`~R2i*Z;rlEdT$q^Zx(KF8=>7yZZmX?E0Ym
z_x~@u`TxJ{PXGV1`~3gQp78%Kd&U31Ab+r*`Tv)r_y1px>Hq(7O#A<rW5NHw95=yv
z{;y`}|Gyk}|NrGw`~R2I^#5N@kN<x;eg6ODO#T0ta~lH#$DjXyId6jE?*CuT2mk+a
z3H|@erSktTm*xMzTp|DeawYx$%hmk<FW0jFf4PqR|I79A|6gw2|9`oS{{Q6;`~UZD
z!~ehBrT_olHTnOSd;b5w+-v^-<=+1PFZa#=f4RT^|H~ux|1VF#|GzxbA$b{^mjCiB
zgye6Y^Z)+}T=@Stf9?Oj0yqEv6?p#tufXsBe+Bvf|Gnq%|F59(|G%Jc7IOXnmw6T>
zyoIIy{}r}_xLG*o|6k!L|Njc_{{L6_!2iF(KmY#~QHO+whykd)`~O$O>i=I6$Nzst
zT)}1GUlBh@-V_P>|5qgH|6h^h|9?fY{{I!3@c*yK#{Yjsu7bnv&;Pam|B6oj|5xnX
z|G#2i{{IzS|NpP(@&A8CL44-_f5nXd{}qe)|5vQy|6j4C|NlysK-?s@`~P3DQ{X)N
zS4Q>!U$L|Q|B8M7|5se`|6hrz|NlztgYYG8{r@Y;`v0$_$N#^Q#sB|G&V}dozmn_z
z|CN0BAFN-Bi-Cb*!T-O~W&i(5FZ};kdjJ2w($~Rt&|l^Va9;RV7xDkE^!xvRr9b`u
zEB)pFU+HiE|7Lpp|116X|6l3<|Nk<WgVV%c88!w6E}j2>?=}4YE5ipdUq=1^Um4f`
ze`QMk|CO2W|F6vC|9@qU{r@X-^8a6%_y7OO^8WuTtM~t}tmpr~9&G>r%5M1oS2p?o
zpY31%|CO!%|My<Z|G%=W|NqJ^{Qp;W`TxJN>;C_hUH$*B?6&`ZWe@-V8#&?sU)k&b
z|H^*)|5uLh|6e)T|9|C7{{NNp`u|rh@&8}BivNG*+W!BQoBRK-+?M};<xc<qEBEOC
zU%8+E|FZi1|0`ti|F7KN|9|Br{{NNt`u|rx^Z#G@=Kp`?7ybV$fAIfb9i#vMS{1-`
z*WY^`|Np9b|NpC+$iTp7!N9<0!@$7j@c-|<mj8cM)BpcfZTSCJweA0(|B3(qvh4o<
zmsy;FfzN<}flr5lfzRasU)7%fe^n>{|Es$8|6kQD|NpA){{L6?5Ci9e3IG499{c}S
z_5T0As#E^|)mr)guj;@5f7L|(|5Y<!U|;~1KcG5x4+8_A%m2R`Z~y<*WcmMBQx_aR
ze>KDY|J6+V|5tO)|G%1(|NqsT@&B)0%KyKb3;+Msy!rpHmiYg_TD}Yn3>z327}h}C
zp_TXluT}}zy>K^ZRsH{~)&2i(>e>H)b^ZST)eZXpH^ct_U)`|(e|4k(|J6<S|5rEr
z|6kpP|9>Am`2Y98hW~$cSN;F1yYK&B-M9b$>T&-6tEch*ub$Wczj}fH|LR3T(vjHd
z|9^Gs{{PiW`~O!ji-7@D=Q5mNU|`t8z`$^Tfq`KQ0|Ud3|9|!J{{Pk6`v0%qlmCD9
z{{H`~&;0+dzQO;$`o{nN*0F-~&A*l%pf(1mtOeDDpmG;fA41Apktj%cYXYkCVnF#3
zR0n|aBLf42%KyJ63nAsO$#Q6!ap3=7p7WqK!vDV}>;C^Wx%mIDDX7dp@c-|lg#Uld
z*#7@DQ~&?h%=!Ocv#S4p%^LpyHEaL>*Q^iHKH9|c|F79XaQTU?9rV}i{Qtk^jQ{_d
zEC2s%$@u@TrR4v=mWKcTTDtuIYZ?CkuVv={zn0bi|5|qb|7*GM|6j`;|NmMZ{r}hU
z>i@r%_y7O3{QCc|70>^_R*L`sTABU-Yh?wA7f?FF7JpWO|NmN*{{L$=_y1q3qyPU}
zz5V~!TJ-;4Yuo>St+W3BwVw3<ul26~f2|+=|7*kb|F4bF|Gzd-|Nq)F{r_vT>i=Jx
zOaK4c{QCdbR_Xs=Td)6rZHxZ@wVn0<ukE4#e{Em=|7$1o|F50Z|G#!g|Nq)`{r_vX
z>HlB5TmS#sGyVT-ul4`0ebE2E_ErD?+AsS5*Z$Q1zxJR0|8<c1|JT9k|6hl!|9>4O
z{r~H*>;GSeNB{pia{d47X!QTDW7Pk@j!pmnI<ETv*YVQ-zmC8D|8-LO|JTXu|6iw~
z|9_ok{r~H9=>K1*SO5Py3;qA=Z1w-IbJG96&RzfiI&b>_*ZJ1}zs|4z|8?Q||JTLy
z|6iAm|9@R(LDHSumj8d<4*mb@cH;kEw`>3Zx;^{<*X`Z^ziz+(|8@KS|F1g-B>%We
z{Qv82^8c^9<^R9#_W%F7d;I@vc=!KbcfbFC-W&Y?>mK|6uY1z}zwRaf|GGE-|LflV
z|F8Q5NW0X1?*G5;tN#CW-wkP_x*z@j*Zs`@zwTH6|8>9j|F0fM-?RVVvef<6|G)0<
z{{MCV_y2Ft-T!|*c>n+Pkoy1EL*xHn57YmDJzW0(^>F|H*Teh&UysE9e?87a{NYjm
z|F6g7|9?I9|NrZ8_WxgxtN;I|75@M0@#g<u_oe^;di?nR*OTf0Ur&Mme?8^@|Mj%_
z|JT#=|6k9L|9?G;|Nr%z_5ZKu>HmK{&q3<Kz^VWLdS3be_fg9Kzn*{p|Mg;GU|_iO
z|F0M4|G!>V|NnZ~|NrY1`2Vk0=>NZ7+5i7)o%#RQtK<J)uf_lWdR_Sc*Xzmuzg|E7
z|MeF7|JPgl|6gyf|9`y~{{QQJ`2Sz;2mk+i|Nj5i$Nm3bAD{n!eF7nMtWVDWzdjxR
z|N88N)U!V4{{Qu5`2RO1>;GS0vHyR4)&KwXHUIzD*W>?R-{k*)eM|rUE%5mNgMkH6
z{szqY|2JUC|Gxq2|NjlR@c(bXt^a>EN-!|++x-8@%E7?E=fl9j=kfn<p#J}#t`h%$
zx;Fg(>H6aTPq&EwKbdBr=3%g(LG4>md-%ftzmG~782DoT|9w>O|L>z51_r(e1_r(m
z1_r)>|9>B4Ffj17FfcIO`2Y7=&HulFW?=SDNsj+NSvvmzWLfb4C(DliKUp4t-0}a1
zS<C+)<}Ckz^4k3W$#v)dZ;6WkKWz8>|H)eM|97v={~vb({{OhW=KoJgmjA!yMgIR*
zVEO;UUgiIfqCfwC6n**sH?ZLU-@uChe*-)I{|%h||8L-_|9=B-|Nk4r@&9jN;s3uu
z5|B1Xkp2I^K`H<L2KD~`vvJ4&zd=*~|K*kY|2Jsv|Gz;;|NjlT`2TOvhyQ<r{{R0Q
z%>Dn*?>+zj2J`>_8!Q3tcl{04{Qoyt8B$LNoBsbB?C}3@u*d(u!MXqc2ABW;8{7m*
ze=m9d{|)Z@|Mz9i|G&XA|Nngz@c(b{y8nM)9Qpq@7-S}>&zJQ7Z}7AKe}ljO{~IFt
z|8I!a|Gy!Y|Nn+~{r?-1@c(Z}+5f*G&Hw*~O#c5j(&YbN4vznSBV7Og4L<V!ultMt
ze?wMdwhuw=$&knY|Azeg|2I_X|KHH0|9?aC{{Ic_`u{g{+yB3zC;$Hqefj@ynB@Pz
zVVeK{hQ<B=8&>uIZ&?5TzhR62{|(#m|8LmE|9`_C{{I`!`TuXY-T%MgssI0mFaG~G
z{3s;vgW9&Q9{m6N>dF7VQE`yEI4be~->8QFf1{@T{~NUvoCg0!?fw5Z>L>#PU&sHy
zQ71t40s{lz2L=YdH~;@eUH$(zn)(0VXw(0HqdousjgI;MH#!RvcF_g@|3<g{{~JB~
z|KI2<|Nllm`~Nrk!~eh0fB*lDk^BEQ#{B=^7|s8GW1Rl~t6#vt!1sfJf$z`%fAu#Q
z82A|&KxzALOd2SUBGNJ}ZMz-$|I_Wn|DSH4bbN<_(K_M(-<Z7r;PzU~g#UkIw*LPc
z^Wy)XjaUBvjTL2J;7?#+;P?3dH`e6;-`L3ie`7oT|Bc=H|8MN&|9|6n{{M}$`2RPq
z;Q!yaZU6tqUHktx?$`gn@v{H_#ykK28z1}sZ+yf5zwyid|BXNS|8M;J|9=yN|Nl*}
z`u{f};{V@-3IG2l%=-T~Vb}k^377u=O?dwQZ^GaIe-nim7_C$O|4o$n|2I+Y|KCJM
z21e_Q|9=yU7#OW{{{Kzv`v2#B&Hq2|6aN2s@A3c7dml(XO<WDBZxc5$Ffi&cFxr6B
zZu|c;Tjc-W#C!jLX3hEkGt1=vpZ5a)|0W6j|C?m^|8G(r1EXUD1EZY)1EXUJ1EXWX
z|GyJf{QsLY|NqaTFaLk$UHSjBV$c7dxljK8O}hC1Z!+8epSef=|4r8Y|2NtG|KDW)
z|3Axh{{JkU!@y`$@c(ae_5Z)gEB^o4A@TojGAOO{|NonO>Hpv4yZ`?tfByeB`QQJ)
zum1f1n{w{|-;{6v|EB!?|2LKS|KC*E|9?}}{{KzY`~NrC^8epd>;HdKv;O~$zW@Jk
zYW@GesU83Srtbg$H}%s0zp1zX|4n`V|8MH2|9?~8{QsN!9X#gpH%;XK-!#Slf78_e
z|9uT=1Abs&V0iKWZ<^l!ziGA%3=D4=7#N-~FfbZ0Ffbba|JMR)Pd)hmH_e%Wf#J{p
ze=VT#i!=ZKrUm`~n-+@*ONP4)42&ua42(Ps42&EM42%;0|E4AV|C?6%|8H9V|G#NV
z{{Kze`u}g*>HmMzK=sT61_p)?44jK@Ffcj^fX)4zuJ`}X0T%`ah6n%u`Lg`~n+_@u
zzc4T`vM?|({9s^UWcUy63#NnI`RD)Nbl3lX)1&|YP4@WzH$4^PJ_ZIx5s)AL|MNWn
za>xHa?{_dTFbXg*Fv@`3_W#d&(0JIB|9{@EU|?WW`2XiUs7?0*$-hS!7#KiyN<jUi
z!NBMw@&9ke=l_2*{{8=($@l+nro#V!;Rir<F9V~K%>TccX8-?Yy8r*1>Gl6_X6XOF
znYsV}W;Xo)o4D!!&%F!&|J;875>A<I|Nmz0`u{ge{{P=B-T!~Ha{vF$TKfNQ*4zJo
zvt|GP%?@H<V3>jyu75!OfyN031EZ6||G(Ky|Nmxp{QsNX$H3^M^8au4l>dLTxBUN`
zefIy~9H#$&bNK)N&C&n=Hz)M}-<-<-e{&Z7|Fiu8)IT79@%;arbM^n<TondJCks&j
z57hSk|1bW)|G&8t{{PLL^8c@I>;J#Gv;Y6iUGV>J?yCQPb2t3|o4fn}-&~NIQ~&?$
zi247sdcyyoFVFn{`HJKJ&sPoqf4*{IV05x!V07{T*H_>=?DmfTKW`lP|MRBI|DQJl
z{{Org^8e?}nEyX-A=Ov6c)<19&zl$i|2#D1|IagL{{K7`@c-xOFaLiYviSe=ki-9<
zhg|;un8fq{hy9uVKX2Xv*Nwj=D*pf0Qu+V;@R9$&4+Q-Geel8m--kdn$N#^%SN{J?
zDER*`;luxbpfV!&&i}u;zyJTu6aN1%VZ#4^2^aqV&2#+!H!t`9-@Hx#|K`18;9T(I
z|DW<R|NrJo{r{J+;s4)!?f-xCt^WVb5BdK$zx4m#{N?}u3aS17o4@)0-~1#0|K?x&
z|2O~f|G)X4{{PMY_Wy4I)Bm4OJ^ufE+wuQz0oVV(1>*mIK5hB`^X-xUe+%UQ|1Hq@
z|F^*G|Ieof{{MW(@c(at)Bk@7U;h8uf9C(+0^k3C3kv@KE$D!h?*%je|1H=8%76d=
z7M}nAH{moWjsE{zc>VvMy&(*o3sV>vo!<Qa*K+3n-@->wc|(vq1LwjoAaMppXC4Ml
z*DL@39AIJKbbayvU(1F6|5~mvFfdv$@T^<`%5%`X1xoKG44ke{{{O3R`TwuMfq~QY
z&HrD@J^z0xulfH=`ON=c%5VPvQW5$8OT~tP(~af-FI9p6zf=wW|56S3|4X&t|1Z@U
z|9`21%7z<Yv;XW*`Tw`@^Z#F33IBiTF8KdT<HG-6x&i-xY3*TPV6^%FFA+381y7Uz
z{}zcbaJnflFfh9O|68Qa!09IQ|8J2cC{O?Ym)HOalcK=?e~S|S|1FyO|8LPLQ2qwz
z>Ayu+{{Jl&`~SCC_5a_ZrT_mH>;4CqbIcJ8oQqoi|0|#I|Ce>d|6kTC{{OOW`2WlL
z!vBBepz^`t|KH-4|9^}7{{ON|`Tw^Vr1!-Czr}YU`axx6n&SUo?k4~L7XSbMxA4XP
zU+zc#|8l?Z|Ch&v|G(T5z+&LBi%gIIzkFN%|MGtD|CjHC|G#{7{{L&00EflD28aLu
zTK@e1*UIq!U#rajf32YM?!*6ott|ill^^;4uLgu&{{O2<`Tws%<^R9(C;$J|EcySh
zg603enwI~6K34qy^Kl9T&(anD|9q(U|L4Pu|9?L0`2Xj_jsJf>{P_Rpqs0F|A1(g>
z`4|BTv;Tif*#7@50hNPy|Nkwq{QtMa=>Ojm@Be>G!v6m)N&o-1r1byal9~VimaGBS
zFTcKA`Ty%n$p3#ePyYWcdHVlvX$iQl_*bj*|8HsY|G%Z6@?Y=&zuJude@lP-|63La
zE~Ea{a{T{W7Ww~gS^fXNWfTAZtCRWvw`|7$zvb%x|CZZ;`pJ;CP<i10zvbni{__97
z<-Py^mf!yWxBLUR9Q#+>^Z#%8zyE(L#35x`h3fym751RA?f>5jUr-tQ|8GUw|GyR0
z|NmBa|NmRj`TuXl@&A88X`$l!|G$;O|NmBM{r_8O_5W|B`~Sa{sgO2oW!?Y3mA(J}
zR<8a3xAM^czm?Db|E+ul8Mmu^`~Pnh^Z&n9lK=l!>Hq&*<@*0`RrLSARmtGG=WkW{
z|G!nO5chz_BD4FT=~CqX-|A?vyWwF5a({I?#GS})sh)*!OZC40f2+?z(pvTB|G)m0
z{Qq0S{r_)`{{O!<ZvX$*l>h%*(*v!SMgIS-IrIN-%?)rJ{hMLS|KAK77&zTb7&zTD
z7&zSw7&zTj7&yH^`Ot!a)6Ir~)60Q@(@p39pZyQO>Fv)Zi~oOXo`Tz#fA;_R|F`B1
zWbC}==l{Po|1idB{`^k_x9xuOKKcKf_sjpkwQT?Y*7E%STdV*7Z>{hDzqM)q|JHUh
zFfe-j|6B9x|KHmE|Nqt=`~PSA1+c!qwP*kT*>mRq-`Xqx|JHu`|F@3g|DWGp|NngE
z`TysW&;LK4c>e#^=J@|xTj2knJrDl>tyB5`x6b<i-@35>f9taT|E+8O|L3#U|39C4
z{{O9;{{L^?s{eoMj{pDjyW{`gy4U~z*0cQoTQB$jZ@tz3zx4tC|JJAe|6Bjz|KIv=
z|Nk~H{Quh^`2TN%<o~}7PXGU`Px=41q2T}DhL!*SHoW-%w^8i>-$wWUe;afE|7~3G
z|8L`o|9=~Q{r}sf^#5;@&;P$o)&KuC-T(i$S^odu=Jfx6_MQ3vw|Ub4zs;xq|80Ku
z|8I-Z|GzEf|Npl5|Nq;P{r_*vlK+49J^BB)<<bAYt%Cpmw)*`4+dAq0-_~3I|F$Xo
z|J#=F|8Lvc|9{(#{r|J?&;P$|KmPx1SNQ*Dqs9L}`$2Ie@c(an-2cDrUH|{KANl{c
z9aR3i{Qujb^8ar~{Qtil)&Ku?EdT$v;|K$%m&gCV9j_o|jKJCde>=YX|J(8X|KCoj
z|9?Ae|Nrew{QtMJm4VZH!~egX%l`lEJox`_=dJ(0D{}t-uDJ03ciEo*zsryO|6OVF
z|96GN|G%A|{{QWg`Tw`e<p1B^NB{qJMS<F1|NnNS|Nq<7^Z#$x%>RD_OaK4vdh!2n
z*PH);yT1Pa+x7SV-vZ<Rf4h19|Lqq0|F>J=|KDz{|9`tp{{QW^`~SDw^Z(!O;QxQS
zWB>o{F8%+vJN^IP?xO#HyW9T%?Vj-eZ};r~f4i6d|J%Lc|KIM1|NnNs{{Of8>;J#q
z|NsB(;r#!%NBIBW9;N?(d*uKB?J@lSx5xVb-yXOBe|rM||LqC+|F<XS|KFan|9^WL
z{{QXi`v13Q%KyJT^Z)<t+5G>n7{mX+J=g#L?RoV7&nAQae|s7J|Eq8K|F>84|KDEA
z|9^W|{{P#f^Z#$}cFb_>y$9*b_P+lAw@>K*-#)SbfBQ85|LwE<|F_Q$(#Gy{|NplS
z)F%arMg0Hs?!o^*Zy)^s+t=~`Z{LCcfBSy_|JyJ7|8KwJ|G)kIkbZ7|HK?!4!0Ek(
zfzx}(|G)jy{{QWt|Nn3Q3I@)lEB^oO-}wJ;|B?Uy8U+6T?SK0JZ~seB8OgxCbOi$!
zNPdFI|GyK|{{Nj|^8fDy-~WFnr2PLoq5S`!9X9{}PH6f6cS6VizwR^s|DDkL|L=s!
z|Nl;y{{QcU+5i7enE(IpgysMLPT2PU?}T&z|4#VG!08RDYhxG~7z6(Qo$!}|fzjvx
zzm_-u|4!8Z|94{4|GyJK<yyl3zY}*eFfgY4|JU;3|KEx4|NosN^Z)Op;QxOoMg9Nt
zKmPyUNs0gePRd|lU<~>HcTyn(17idOrw<PUr}u&Xe<w}&|98^y|9>Za`u}&b*#Ezi
z?f?Isob&(ByAQbCJGtTi-^m^S|22sG|2tLW|DWw^{{Nl4?*HG(SN{K<{PF+aDSZF`
zPLcorcZ$jXzf=7G|DBTb|L>IC|9_{H|NlFs?*HE@z5oACnFMJQOqu=v@07#;|4#Y$
z|L;`g|9_{d|NlEx`~TmmhX4Og^#z6P|G!g%Az?kW?*HGZv;Y5{y7B*?9ToroPQCX3
z@6@~h|4x1K|L@ed|Nl<?2AM0F`j>&zN8tb8X-5D5PRsoNcUu1cztblF|2u8<|G(3&
z|NlFk@&DiHdjJ1UF9fUqvttH!v!+k||9AR<|9^Ju`2TnM$Nzt4$o~I3!-0V_PT>FF
z8PN=!VFC=CAs}}4|GzWt{{K7E{QuvXw*UXmbcT%i&Gh;IcV-X+XS@glXS@IdXS@Uh
zXS@OfXS@spXS@oytp7VR<^SKA6aN1_%<=#CvylJ4pKba7`?<pZ-_Mu)|NVmD|L+$m
z|9`)@@&EVhfd9W=KluOqP0Rn^Z(aWXe*5SDpN$D1bN>I?Fy;Th1{(&>i~~?JmxKCS
z|Nm@Q1Cj@e{n<a`|KFLQasD6we}6Rj|NE1||KIOs{Qv#21tbq{r~RFI|Nq}vJRm-}
zJ@9vy7`V;yuT=ulu59J`|F7l8|9>rC{{L$g`Twt#gMnw|Y6hN_n;CdkZfD?Gxt@V%
z<thfAm75rNR&Hb9S-I~2pKU)FcvkLW;90qkfoJ6*2A-9mdMAK^XXOS4o|Rh|cvh}q
z;90qYfoJ6&2A-85_aFKHXFI6fb&Y{%<pl<wl~)*eR$gM@SqW;F-unM%yT$)M+k5{1
z*<SGf&o+zyf3`*Z|Ff;)|DSC${{Pvw<Nu#+H~#;fr407NpAQ!Q|IP~h|K}sft`-0P
zd<3<(LG3tD8xGW#6M(egT0m_%9+;mXegyd$)4$MmAclTWIDzf_JFAz0v!Z~3Gvmbn
zzq8i=|2yj-183Qj|9>_b{Qo=a*8jh=-ZC&SX8iv<oA3YM*=GO$&JO+mcXs3dzq42V
z|2z9C183O_2F|J#44hSK7&tSI{Qo=qJ|v&a{`&v#9Nzzb=V(CYkY*?S|2xMVlFsH7
z{Qo<r<p19}&Hw+-IRNel{hiD7|L<It|9|HO{{K5S`v2d#MgRZK?fw6E?(+YC=jr_a
zJ8#bazw<*tYY6`TUBLYR?*jGze;0WD|GU8d|DWGy{{LMN^8fFG-2Z<UwEzFRV9Wo%
z3l9AMyWsf$zYG5T|GQA+|DTN?{{N|Y0-fWS^8fEbr~iK!R{sCH@bLdX4GRDN)M)(w
zQ?=#)pUOQ9oK+kC|5?TI|IezD|9?8}{QuMG^8Zign*V>gc>e$C%J~1M>&X8<8$jik
z!~eevFaH0t@y!3f3tuyERvq~NuchGspWm1N|6L^Z|L-EL|9=<R{QtWs1hj_a|KB@5
z{{Ox6=l|ck4FCV$W%>X2F311BcR_0l1pfcMEAs#EU5WpH@5=oDdshK6R@@3|(;NK%
z*J|?rU#rFcf2}V6|FwGj|JUmC|6gms|9`D9|Npfn{QuXQ^8a6J#{Yk<CIA1mR{a0h
zTJ!(!UC??2kN<z~=KTMAx8(odyCAWK|9|gJ`2Y9rl>dM4&iMcL?u!3^@2>g(_wI)O
zfA1dn|M%{Z|9|hE`2Y9rjsJh|-ueIc?t}k-?|%6I_wJYffA9YI|Mwop|G)Qm{{Ouv
z@c-{Uh5vu=sr>(YPvigJdlvuy-m`(sMc;Gz|M#B9|G)Qq{{Ouf@c-|<kpF-0Mg0HQ
z+VKBhYtR3GtrPzLYn}4{U+awj|5}&)|JS<W|G(BX|Npga`2VkU&;Ng|2mb$SJ@Wrw
z>xuvWTCe>7*Lvgszt%hd|Fu5&|F8AU|9`EZv=7S9KmPw~WBLEDjpP5nHlF|g+64ap
zYm@o^uTA0qzc!Ws|JpSE|7$b(|F6yB|Gzey|Nq(?{{L(9`Twsi;Qzn2kpKVMBL4qt
zOZoq=E#v>cww(X}+6w;vYpePHudU(#zqXeD|JpkK|7)A_|6kjT|Nq+N{QuXs;Qzn2
zHUIy$ZTSDMZOeb~9O}I(|Nq{b@&E6=IsgCOTk!wyy*2;;-rMm1?>&(Gj{kq}9r^$F
z-iiNz@16Po_uhs7fA8J-|M%X5|9|g2`TzIci~oP`efj_Q9w=P@{QrBO;s4+JJpcdR
z7x@48zR3T-_a*-Sy|42B?|qH`fA8!3|9juy|KIyI|Nq{1`2Y95%m2UkJ^uf_AM*e2
z{fPg6@5lWAdq3g--}^cL|K2b7|Mz~$|9@>e{{L$`^8a7kiU0rF&iwz^cH#fOwmbj-
zwLSR%ukFeIe{C=R|7-j5|6dy@9RK|P*Us?&UpvqLf9(SQ|Fw(!|JN?@|6jYx|9|Zo
z|Nph?{QuW(@c&=C&HsPx4*&nPyZryx?(zR$d&vKP?GgX~wa5Jb*PihIUwh8~f9(bT
z|FxI=|JPpe|6hB{|9|Zr|Npi3{QuWJ;s3w(IsgB)FZlnjeaZj7_Z$BIz2Ecy@BJD7
z|K11jH~jy5f6xEF_fP!)d;iM+zxN;f|9k(<|G)Qt{Qvua<^SIY0{{O$koo`jfyV#8
z4^005ec<r_?*pIze;-8r|N9{2|KA4%|NlOy`TzGp$N#?%ru_f=V8Q>t57t2Db|38c
z|M$Ux|9>Bx`2Y98h5vsa-1z_Z!IS@gAH4bh_raI{e;@q$|Mwxw|Gy7;{{MX_@&E5b
zmH&Sq8vOtJ(B}W&haUg`J`DN)_hG{SzYlZ%|9x2T|L?<=|9>A&`2Y9eod16xuK54=
z;g<h@A0GJs_u-lUe;?lX|M%gO|9>BT`2Y9epZ|X!as2=LNaX+DM+*P{KGOOB_mRc_
zzmHu0|9u3Sj{$|-ivR!GxBUOtzT^MD_C5dqwIBHZul>ybf9)6k|7*YU|6lu!|Nq*b
z{QuYf;{U()H~;^&fB65e{m=h@9Sr~fb+G*Z*TM1sUx&#5e;pG4|8>ax|JR}L|6hmB
z|9>3@|NnKE{QuWs@&8|k%m05J9{>M!`27FZ5%B+CN6i0!9SQ&cb)@|N*OBr6Uq{LR
ze;pP7|8>;-|JTv*|6fPX|9>45{{QQk^8a7QjQ{^Smi+(MvEu)~jy3=Pb!_<muVc^u
ze;o(@|LZvN|L>!k|9>Af{Qvu?<^SJD9smD6>iPfo(S-khA5HoH_tA|1e;>{H|M$^?
z|9>AX`TzIPivNEft@;1=(T4wjA8q;n_tB33e;@7n|MwASo*HD<iT{5eo%#Rw5ojLk
z%KyKQZv6lI=+6JYj~@L0`{>F4zmH!0|NH38|G$qu{Qvvt%m2TRe*FLY=+FPZj~V{|
zea!Oz?_-Yte;@Pw|NB_r|KG<V|NlOg`2Y8@%>TcS75@Kytn&ZwV~ziRAM5=8``F<B
z-^V8Z|30?(|M#)Y|G$qN{{MaK^8fE+kN<xk`~3g=IN<-^$07g!K92bR_i@bszmF6C
z|9zbD|L^0B|9>Cn{Qvv7;Q!ypCIA0EuK54=an1j~j~o8~ecbZ@@8gdDe;@b!|ND5t
z|G$r?{QvuS#{a*M=luWsc)|a_kC*)a`*_9wzmM1a|ND5u|G$s7{QvuS$N#^N_x%6+
z_`v_akB|KS`}oBFzmL!S|NHpD|G$r~{Qvv-#{a*M@BIJ!_`(0bkDvVi`}oEGzmMPi
z|NHpE|G$sF{Qvv-$N#^N|NQ^^gyH|+CoKQ}KH>QP_X*GczfT1I|9v9z|L+rt|9_vz
z{Qvtz;s4(!D*yjJ(fI%OiO&DOPYnM5ePZ(e?-Psvf1lX=|NF$@|KBGr|NlPm`2Y8b
z&;P$q0{;Jf67v7=lZgL+pTzwC`y}E2-zO>m|31n1|MyAG|G!TP{{MYa^8fFXivNF~
z)cpVZq~ZVHCoTW~KI!=X_eszHzfUIo|NCUh|G!UW{Qvu8&i}tp7X1JFWXb=(PgeZ@
z`((}kzfU&&|NCUi|G!Um{Qvu8&;P$q4*dW7<jDWOPfq;*`{d03zfUgw|NG?1|G!Ue
z{Qvvp&i}tp9{m6N<jMcPPhR~0`{d34zfV5=|NG?2|G!Uu{Qvvp&;P$q8UFu$%JTp3
zQ;z?CpYr_w`&8in-=`w~|2~!Y|M#iP|G!Ta{{MZd^8fEsjsJh2>iqxv)ZqW$rzZdZ
zKDGG&_o>bQzfT?h|9$H6|L;?e|9_wQ{Qvtj;Q!yJA^-nAjrjlfY0Uq>PZR$CeVX$B
z@6(L`f1l?3|NFGy|KF!2|NlO%`2Y85&Huko8~*=&+VcPJ(~kdtpZ5I!`*gzpzfY(9
z|NC^t|G!V?{QvuO!T-Ncm;C?xbjAO_PuKka`*g$qzfZUP|NC^u|G!W7{Qvv(!2iEb
zkNp4p^u+(aPtW}S`}D&9zfZ6H|NHdD|G!V~{Qvv(!T-NcpZx#(^u_<bPv89i`}D*A
zzfZsX|NHdE|G!WF{Qvum;s4)fEdT#L<M{vg8PET}&jkMeeJ1k%?=y-2f1k<x|NBhg
z|KDdS|NlPI`2Y8r&i}v94F3OpX7c~<GmHO!pV|EX`^@40-)AoW|335h|M!{C|G&=y
z{{MXz^8fF%i2r||#r*&KEaCs(XDR>xKFj$3_gT*Wzt0N(|9w{S|L?Pk|NmMJ{Qvvn
z#Q(o9&iw!T;>!QOFK+z*`{Kd>zb~Hr|NG+2|GzIj{Qvvn$N#@C{`~*@lI8#3mmL59
zz7+ZY_odALzb_U3|9z?P|L;qk|9@Ya{QvvX;{V^54*&nYbou}HrO*GrF9ZJneHrop
z@5`9~e_y8j|NAoI|KFD-|Np+M`TzH2!~ef8JO2ND+4KMJ%PIf=zMS#@@5=@M|Gr%E
z|L@B+|Np++@c-}29smEn-1GnM%On5)zC7{&@5>AS|GvEP|L@B?|Np*x@c-}27ytjh
zeDnYB%P;@`zWnk3?<<D?e_yfu|NDyP|KC>v|Np*{`2Y8n%>TcyRQ~^crSbpoD}(=k
zUzz;>`^x73-&YR*|Gx70|M!*8|G%#y{{MZI@c-|tl>dKU<^2Eqs^I_MR~7&NzN-2E
z_f^aPzppy}|9v&#|KC?r{{MY7=l|bV3;zFowc`KZS8M+NeYNHP-&Z^S|9y4f|KC?f
z{{MY-=KtSU7ykc!b>sivS9kvZef8o0-&bG$|9$o2|KHaP|Np*b`TzGd$N#^tdH(->
zE%5*EYl;7VU(5Xe`&!}u-`6Vt|Gw7v|MxYh{6F#kU&odI|2l5`|JQNn|G$n0|NnKo
z`Twuu!~cIBU%>NS|9m<A|MTVf|Ib(8|36=m|Nnd?{{Qop`Tx&X;r~BhmH+>IHU9qt
zjVt>a{Qu``^8cT&#s7c4Hvj+mI{g3V>+=7fugCv?zCQo|`3C&|=Nt0>pKrwff4(vQ
z|M@2T|L2?X|DSKh|9`$Y|Nr?G{Qu`$^8cT2#s7c4HUIzlHvIqR+w%XPZ^!?CzCHi{
z`A+!%&v(lIf4(#R|MQ*m|DW%I|NnfK{Qu{>;{QM2HUIzlZutMtcgz2OzB~T^^99vC
zKmPygWcmNEljHxtP9E@_#=nF=|NkYj{QsB8^Z#F>$p3$x0{{PY%KZP=30m`}0-1{d
z%>g8u{Qs9|@&8{UXimW4|Gz|+|Njy_{{Kt#`Tws|<Nv=-6VTf3|NlB|{{JhV^Z#G@
zlK=n8*ZluizUBYF@;#98^YRn_|COKl|F0Z0u7BnKzw#UZ|CQhQ|F8T3WGub>#s7ch
zZ~p%)|M34``IrCy%76U-SN`Y!zX}G(7<&cB|9=%c|Nm78{Qp-W^8a52sJ|-n|6hdy
zWIVn?<Nv=3o&WzT4F3PCF!}$l!s7qG3Y-7`DjXpF+6s^V|0;a`|Emc2|F0tC|G$ce
z|Nkmt{{O2;`2Vj0G^U^N|6fJU|9=$)|Nm8#{Qp-`@&8{%&HsND4gddDwEX{9(eeLZ
zMbH0#6%+pdtC;ftU&W07|0?GE|5vf#|Gx^*Jiv<o|0>q}|5vf$|G$bY|Nm9&`2VkB
z&;NfF2mb%7IP(8r#fks_D$e}>S8?J0zltmW|5e=h|F7cC|9=$^{{O20&FQ@O|F7cB
z|9=%9{{O4^^8a7OkN^KF{`~(}$?*SQCCmSRl^p;7Rr37*S1IuSU!}<Zf0Yvd|5eKT
z|5vH-|6irb|9_Pl|Nm9${Qp;J@c&<>$^U<q7XSZM+Wh}l>G1zwrOW?+l^*~9Rr>t@
zR~hjCUuDSuf0Ysc|5e8P|5ust|6gUw|9_Pk|Nm9y{Qp;3@c&<B$^U<q761QL*8Klh
z+3^2gWy}A6l^y^8RrdV<S2^MTzsf29|5eWT|F3e+|9_PW{{O37^8a7uivRyA*Zlui
zx#9o6$}Ru@RqpuzuX4}-f0YOR|EoOm|6k>a|Nkn_{Qp;Z;s3wNEC2sh-uVBo^3MN%
zl@I>^t9<hRU*(Jc|0>`7|5y3p|G&yF|Nm9~`2Vl+&;Nf_4FCUCvHbs6#qs}N70>^F
zRRaJ2Rf+unS0(ZPUzN=Ne^m<q|5d5{|5v5)|6i5P|9@2m|Nm8){Qp;F@&8|y&HsN@
z4*&mEx%~fE<?;VtmCyfwRRRD1RfYWjR~7O9UscTie^m+p|5c^@|5ugq|6f(k|9@2l
z|Nm8${Qp-~@&8{{&HsN@4gddDwfz5A)$#vdRnPx_RTKXItD5rvU)7BN|ElKv|5vr(
z|G%mw|Nm93`2VkJ&HsN@8~*>R+VcNj)sFxFs`mW<2kPHe9r^#S>cszlRcHSHtGe+2
zU)7cW|Eg~M|5tVA|G%mS|Nm7z`Twu##s7a*Z~p(Q`tbi>)tCSOs($?cSM}%rziNj6
z|EgL3|EuQs|F4?o|G#R1|Np8*{{O3%`2Vk3=KsHHh5!GmRsR30*7*OgTIc`2YJ>m(
zs!jg?tG4+6uiEDSziNm7|EgX7|Eu=+|F7ET|G(;h|Np8({{O3v`2Vju=KsIyg#Z7l
zQ~v*}&iMbYI_Lkt>Vp6Os!RU=tFHL}ue#>{zv_nn|EgR5|Euo!|F62||G(-9|Nm7_
z`Twta#{YlSbN>IUUhw~4^^*Vps#pB~SH0%{zv>PD|5b1K|F3$-|9{nc{{O2!@c&=+
zk^ldyPyGK^edhna>I?t>RbTo4ulmOSf7N&X|EqrR|6lc!|Np9A{Qp<|=KsIy5C8vF
zfBFBf`p5r&)qno~t6}*6uLd;7#_|7O4bT67H3I+t)rkE6S0nNNUyaQFe>DpK|JA7c
z|5u~&|6h&H|9>?G|NqsP{Qp;D@&8|q&HsNj4*&nvfadKy{{O4-`Twsb;QzlG&^%hi
z|9>?x|Nqq_K<4ynGXDRo$@%}Urr`g-nv(zjYAXK!tEu__uciS!zxS`E<Nv>!p8x-9
zCj9?bGv)ukni>E9)y(<-uVw*c9<XM`|9>@W{{O4l@c&=UmjC~1cKrWWv*-W6ngh_e
z!xR7i)tveNuja!4e>GSB|Esz2|6k3W|Nm+pfamo7)x7xsuja%5e>GqJgXZl1)$;uR
zS1a=WU#-M{&>Y{tT7&=pYAyc%tF`(6uh!-Nzgmy~|7rvN|EmoF&-wkU&H4YYw&ef6
z+KT`GYJ2|wtDW%wU+s+l|7z#_|5v-@|G(N5|Nqr)`2VkV%m071d;b5cJ@Efu?TP>Y
zYR~-tS9|6EzuFuB|J6SD|F8DR|9`b_{{O4}@c&=!kN^K_|NQ?~$MXMQ9S3;s@L!$6
z|9^EF|NqtL{Qp;H^8a6*#s7bG4*&nvx%~fEAMyWRea!!V^$Gv~)u;UbSD*3!UwzL1
zfAt0b|J9fL|5sn}|6hF#c>MogearuU^&S8J)%X1WS3lwZzxpZv|JBd<|F3?||9|y6
z{{O2#@c&=^k^ledPyGK^f9C(c`V0U6)qnW^ul~pXfAxR<|7&3Q|F41N|Gx$f@EG;K
z28sXw8f5<eYf$+AuR-PizXpx}{~C1u|7$P+&6WTE*8rL`_xS&>!RP<KhJgS78bbd6
zYl!&&uOa6DzlMbW{~A*M|7*zj|F0qE|G$QU|Nk0F{{L&J`2Vk==KsHjhX4N>TK@lQ
z0F8(D{QuW5;s3t|(0J^O|Nk21{QuXm;QzmdCIA05toZ-0Va@-44IBRdYuNJtU&D_7
z{~GrE|JQKf|Gx&%e8P$U{~FHx|JQKg|G$PS|Nk}I`2Vlr&i{W65B~pac=G>W!;Am_
z8s7Z>*YM&0zlJaW|26#h|F7ZC|9_1P|Nk|z{QuX;@&8{V&;Ngo0{{Otiv0iADDnSa
zqs;$*jSBz&HLCpo*QoLTU!%_de~kwJ|23NY|JP{o|6ilc|9_1R|Nk|*{QuYJ@&8|=
z&;Ngo0ssFshW!8681esKW6b}5jS2t%HKzRk*O>ADUt`Yye~ktI|23BU|JPXY|6gOx
z|9_1Q|Nk|%{QuY3@&8|A&;Ngo6aN2eobvx)<Bb3R8t44~*SO&Szs4p1|23}o|F3b)
z|9_1e{{L&-^8a7sj{pA}_x%6Yc;NrP#v}j#HJ<qYukp<Pe~lOZ|7*PR|6k*c|Nk2A
z{QuYZ;QznIC;$I7zWD#I@y-8#jUWF1Yy9&6U*nJe{~G`N|JTIu|6dc!|9?#!|Nk}d
z{QuV^@c&<v$p3#$694}-$^8G<r11Y=lgj^pO&b6IHR=5S*JSYjUz5rIe@zzu|25hC
z|JUU3|6h~K|9?#$|Nk}l{QuV!@c&;^$p3#$5&!=+#r*%*l<@ywQ_BB;O&S0HHRb&O
z*HrNTUsK8de@zwt|25V8|JT&;|6fzf|9?##|Nk}h{QuW9;s3v;DgXa9&G`SXY0m$D
zO$+}2Yg+REU(<^J|C-kP|JStP|G%a!|Nk}Z`2VkI&;Nf-2mb$SI`aQt(~1B8n$G<H
z*L30kzosky|25tC|F7xJ|9?#n{{L%w^8a7ci~s+c-u(a9^x^-%rZ4~hHU0Siuj$YK
zf6Wa4|24Dx|JTg%|6eoD|9{N_|Nk|M{QuW1@&8}5%>RGQ3jhB#tNj1htnvR}v(Ep2
z%?AJfHJkkZ*KG0sU$f2sf6Wg6|24b(|JUsC|6jAu|9{N^|Nk|I{QuV+@&8|Q%>RGQ
z3IG2!r~Lodobmr(bI$*N%?1DeHJAMV*Ie=cUvtg>f6Wd5|24P#|JU5{|6g;@|9{OB
z{{L&9^8a7+jQ{_d=luWIyx{-8<|Y6CHLv*puX)Y?f6W{I|7+gz|6lWt|Nolz{QuW{
z;QznoBme(3pZNc;`ON=+%@_XvYrgXTU-OOs|C;ao|JVHB|G(xZ|Nk|=`2Vl@&HsPR
zAO8Pq{__7{^N;`kn*aR&*TV4sUkl6se=QvU|FwYTCqQd6ME?J4k@)|wMdts%7KQ)+
zT0repjsO2zbpHQqG5G(l#pM6L7K{J?T5SIR1C9NI<}<+a8lbrW(7XU>Z869Hf1vSy
z&{_}hT!#c`?MDp<)3Paw{~t_XWKi+`6(P$2+VsW9pi;xZyv#z8LBX$qK><yTAvQJt
zf6iq1|9jGe|3B;&{QoHt^8bhViT^)cJpTV=_xS&t>&yS&Z8QG=ocZJb5A%xuKP*7|
z$Uw$$vF-sa$rkPaaX|S0k5173K@gMS|L=KlHdp`)@&8B17m)D(A0425kqrNTbV&UF
z8#omt#sFHN$H2e{nR5fJn-Boa7lEW085kItki@rx1fl9d`%OY2a$#qY#Gz~G!RG8o
z5*L7|1&bd?5?4SHKaC{rfDq^4K@x93hzlwH|0|^W|F4kd|Gz?d|Njb^{{Jgv{r|6!
zJtqMGGEW~wfcDt_)ws;Sz`zXh*Z&`TWf10T+(d})KyqiA9723s0h0QApzwm2v-=E^
z_(O#HJv>O_PY~+&xgd!@hd7Oa@&Au)Na4&1S}Vy4F@GnLd-B&J)Nj3jFemyuNG%Be
z|FLfkOq_wAfuDhqf#LsOLv;o|20kd;jDeSd7s_^G;9=l_vi%vj8MvYBC<ZPDE+{*d
zfs=s~$}V8wVBmnV8yMIb*rDv%3~UT+Q1)sDRt8om`zQlwWvD#Z4VOX7n*aX?v5kBX
zZp&YbaGUW023`g>hDMMY<CO@v8Sg~6&G-nyZN}#jZZp1)a9fN4!fnQn89*Uv4>Hrx
zpMjr&ivi3w@?qd)V1cqDz^Q^Cq{gW5|KA593|t`g!vzciAo>9Z#6J&uK<fVgeJH@d
z0}{Vq0ir>1^8c^#Ply^5J_aU`oQV=dt%(UJ4F3N$aRa&I|6h|_gx^u(<t~nRxr^|-
z;WLEa4ZkD&Zio~wMl1-w8zRMvkpd!KjBG$|VnD<TES(e};=-s4;U1%9h`2C1gm911
zJ%oFVej(grEQW{+V<RN@_#@JZu@k~Q#!(C`3@niFGjw8LW?+V}jnf&J7?_~!0tQAf
zWcdHr7+khN#k;`i{{R2~pl}Ca&?x|*I00eM{thSxjk|*|XxtryLF4Wq3>tR_VbHic
z2!qDmK^Qdd4#J>ucMt}RyMr)j+#Q5L<L)2~8g~a_(6~DYgT~!K7&Pt<!k}??5C+X{
zfX3cI<L)2~8g~a_(6~DYgT~!K7&Pt<!k}??5C)CAgD_~^9fU#S?jQ^rcL!n6xH|}g
z#@#^}H0}<<pmBE)293LeFlgKzghAu(APgFJ2Vu~-I|zfu-9Z>M?heABad!{~jk|*|
zXxtryLF4Wq3>tR_VbHic2!qDmK^Qdd4#J>ucMt}RyMr*u@1U`F(6~DYgT~!K7&Pt<
z!k}??5C)CAgD_~^9fU#S?jQ^rcL!n6xH|}g#@#^}H0}<<pmBE)293LeFlgKzghAu(
zAPgFJ2Vu~-I|zfu-9Z>M?heABad!{~jk|*|XxtryLF4Wq3>tR_VbHic2%mwDy@STx
zK^Qdd4#J>ucMt}RyMr)j+#Q5Leg}=cgT~!K7&Pt<!XnVIchI;y2!qDmK^Qdd4#J>u
zcMt}RyMr)j+#Q5L<L)2~8g~a_(6~DYgT~!K7&Pt<!k}??5C)CAgD_~^9fU#S?jQ^r
zcL!n6xH|}g#@#^}H0}<<pmBE)-UA(b2aUUfFlgKzghAu(APgFJ2Vu~-I|zfu-9Z>M
z?he8rzk|l!LF4Wq3>tR_VG-!qJ80Y;ghAu(APgFJ2Vu~-I|zfu-9Z>M?heABad!{~
zjk|*|XxtryLF4Wq3>tUONlGkD0bRXdYiMX{WMIGmy1%(NJ~cTb-`0>JBfq#LFEKaO
zHaIaCe32PLaY;&kX^CxFdLoFKnP*#CoRpoE!jMr~oMCGKz6BS0MXqgr9+(S0xg@>>
za^IY-p($7}IR!3aWB|IV3vw#FZBT$!PymRZoS&DLnGUkw){r5y0Ca|pt)Zono}rnA
zo{^rZ0R!lQz0{)20whr*BO?arc{jEO23Dp9R?bFN76w)>rd9?94B*={<6*ZZ+7={d
zGUTFMlWGgO`Wt>59+aP)n_>%6XbrmePXWXN9V!=}oSOpH50eISU^2EKMj``<gx-aP
zBw}cbxKA3S!U)U<D>eoNC(0$jwub0;-r1tuc?U8eu_(RRwkSWp1aXTU=p>oq{G3$V
zl9EbrSf!*EgS@Pp%1~OI6rTz{2r1sA!ob!LEKrnMQd9|L=Vv5m#utFDYm5h-OcM{e
z<u4u_kG6&kptA(yL56_tfJ#hHwFNitK~)I@<ZO=cJD|4Q|G(ic|Njkt53YOuMlk&U
z8v$x%F#rD>A^QJsgcJh<1Iz!v5nBKMM(Ba+BY2w(Y!aw_5UIn!z`*+dZ>0JEztwLc
zW=7in{~HO~UnBJYZ>0DCzmcGGA_V{cjSL5^V*{TP^EWc?|KG?Y1_lPc|9>OX{{M~4
z!(o0I#BGty|NlmILe200|2J|nsEzvnZ{*zne<P<u+!?v>|KG@E3=9lB|Nlm={{J@;
z)Gq*;zxDs$NYFlQkULNR{~HN9Q-kgQ-^i=~|3-qsf&c&C$QS?rM!sWUU||3MH}c#6
zzmfkS>?n{r5S!!w-zcvCf1^N~+BpCJO^g5kH%fwmfdM2Y|Nn24Dgy%p_y509+W-GX
z8AJRS<?#P+lqUlNgW&(aQ9=LzMnz!vV+3fQ5&QqY;tBu%MtDQQGa}~y-w06qnd$%E
zh`j%QBT6BDjA;7*Hv-hJV*dYEVEg~S5uo!#*#7^GSpNTS1n3M9#{YjKw*LPc0rD?s
zkK*P3e<N-)Ffefb{~Ph<|KEtO5I0A1{{I^(gzO#;1rGQ@vY_aN>|=xM8Heyw`2PP*
zk^lcUMeqOL6ubX_Q$T0LF#P|UlJNg;O5y*%Db4@?rcC+&H)Z+%zbSkE-}rx<!I^;(
z889(1Gl2jLGcyx2D+?<tD+>z?D;ql-D=Rx23kw@38#@OGu(EM-adL2hI3PnnMldlk
zu`n^QaImtlf>e-({~urw<Y0Wj)WFOr$iO7X$SlbC{|Knz$jAyZn-SD;1o@GHk%<}P
z9u7_}?*B&^whAyXF)}kVu`q)i%D})_%gDscz#_;hq-f~KCLEZ^u2d*u)Hrb=hqBYg
zgQ7tfKd2Zd6*X~kiHS={N~x-;YiMejn3|beSXw!|xVpJ}czOkggocGjL`Eg2q^6~3
zWM&nYl$MoOR8}>&w6?W(baqXeJZ0*%=`&`|TC{k{(q+q6tX#Ee^OmjKw(r=v>(JpN
zM~@vpaq`rq%U7;myME*5t%r{uKY9A>`HPpYK7RWA<?FZaKYsoK`HPW(8R9KQn9tDs
zCCI?U$i%|J%)-vf!otAFR1WgEAPcLaA)An6AbVn=u#!<Dhlta}g&PlYDjNrV5KSt&
z$R(y?@=*07$ZKGq5$CZcvU~>j7{Xt-7<iZ&8JGl_1sUua{>^{3<=X<D&Nsh4I!JuJ
zRUN=)b8T+L0-nybRu|Y@uFbo`IMH<Zb`i#Y)8%m%aCJAoK58(0w&nFvhLrOewY&@|
zzM0p%7>>`ne5=7oeKSbdKcn(dgW>bd-xlyxuKD%RK~flGcFF{!02UF307eH^23k;(
z&t+dQ8d;^JHHbBEF=#L>U~1rE`1@ks`SlPVXfP{f`)y(DH=Q4+!7P{UpT%%u*5&mg
zj1$2EV7ZB=3%@Mj>3nMi3J<V9pMyOF_TdSbNn06GeABOYF`SqO@^U&zMY4bTTL+2H
zQPlyUaJzGXt@>E-O9#OVRQD^(<Mkqphbyi>if{NQ8`=F{x?;8ahbKBq7e{y2R~x*4
zdc^4ce+I^22YH?vxBm=HjTzVKGdBK6d>Hw)^JnN4)10GxwP7sQcjUj#<lo9r<NoOU
zt?<X~J$g%bT(ML7(eK;Ye>#6zjOmoX{&%hIdG5cD_U~nIf4KgZ^W*+j^{!m&NAX>G
zq4iIvEiB1TPJFqo_OZNA0Q;@~3_Sbue`}uIH~VA!Vc+E^56$)V4Ep$=VXx|Lp;NYA
z#_2X13;6f#k$?Q2?Z<xxU#b1gHJ(d;bRF(Jn`@BPGXLR3i;UYh8%!9lL&A&kF9$fl
zkI%b&0UVy-bO?(mxoUe@%=OzYk27|V6psA*sKH1LoFaWQ-#SPNgQM;lIAYF16X$vn
z#>uwJ;|xKuROldS42mjfYJc;01+!eW-5!u#wczCMaZZD2vS!>ChFh?71Wis9P#n)@
zX;-A~nCJ1Z$yD#%*{z}ODwC=h9pp7?T>oyi<E@Z>D^``Z+Pv@U)KfpL{NzOQzpaZF
zeEj$9ld1srgY|;-x%a#G8UA*i-}YqlkLtzSLUjAz>vhdLTku%n_o9Uh_$Qk3dIw&8
zuV*S7_V0V}{weQfJ$jTj$&-JzwUFm`wFcYy53j$u`?2{^M%#0T4|DHM>-(V`c%}Yg
z?zZ`l!V-5m{%44}x`O#_Jnz4w`?>67GcQ(5f85@`cD;iC%!j`nF2C7cdh?m#=Ty7d
zUcxUO1S=+gTl06mo%GA|56`#M^K98KwCGRIqq911<+nX6cbgXc?v(N0R}4R^V}30D
z;Qpxe<9~*h;|~RY6qhSL5C5?CQoqixlPNEhC#17X2t9F*FN1mQ$MiSrKc0Wc`>5jZ
z!)uFIRLnZ0`Z;m`g<Br_$vvMx-+q4P`L2b9uN`FD58L0qd~BY)LFRnnl8l<fg#Fra
zx3zBHTktjYktV;aLHpHShPw7Yra#_)*#Brx#y)|Mwo863yL)zdOx?3jHazq1Y}a8g
z^F96ELGIw3PnIGK0qkE2ZRdkBG&tQvm4b>kP`XL+hX@3)xqJhq31~SMRae5;Zwo3w
zl(PN62?kO~Mlqb21u19dZ)HdZr@52h!lmDIc@(H@1SLOkIU|=1N@zCU>aH+Ov|S#j
z!K?&Mc|O~YS_QBsaXh%dM5O|fedeFgEB~a9KFmJP_b1@`7hnFvzYf_picfF4eg4D~
zWg!mb=6TIM7ucVt_t+=&#y!tl`(gR<D*28rmhCf{vizU!JA66kqxNzA>m0T#nD#gA
ze=vWZ>Aqc_HPw&avO8X$x-a9)+v~w6Y>f^I+U+;L)L^?iV9Vc${~1y%TlYSjFW>Q}
zl1rz_Qdz2P!IGZUH8<Msb{v#{b&_3K;R5^ldcpd9|Bk5t4D(Yz{AcjEyoW#GX6Vkz
z;^i$>O@~kW{K`$THf5;Un7zCv?8ntdYLjm9i~n){$X&BmTT(Ad)YjbNrl9(jRb33f
z{xdwh{)Y9@UZ10tAN7w+s}tY)aMp4E+r>rh1()hq_5AKP2w>k@pZD+h{LSuvnigHI
z@qcVx|7iQ|mGSRo>#L5RYTT8=EPtuNuKGvs@5(<;AKB+7Kaf@T`(QV(BD&MCyrTB7
z!Kcf1jS_ul9pri9V(-2(pC11Gx^P^)zp}5%CbMS~Z#<pZ`N~se@_PrlwI9wuIDd3~
zNBOk!dCVWqZTYaITPZ8@x9J`o{(I4FTIPKFHFaNTFn{kp5S89p63<>y?D?^8t9Zwr
z!2C>^@ar2_au;gIY&geVCf&ihaT24&0=``h_RBQaBI+VYo$H(V_9&>%z1Co)22QEI
znLnYmH6&%qRof?{*2lh?$GuQ1J8+t_fuwAR4WOiNl!ji0J_ofADxvLzDlUeTpeoN;
zrEyY&0=RmmpgaWC&Kk_0g8y-e7FOIBu;I;m^PeH1-#t@F^6{DMcK#m^mHuilKk;X%
ziTlz2;n4H*AN;#beWk>5FGaNpMf+60Z~fHr`?1XjSBBdE3?DB4<6>NPm%G;b(fYQO
z%V`#2SGG(@>3;R?O}WN*xBAot>@^{O=i2c9c8$xb7qR20ak!xOb@v+2+H{qp3n%&R
zxN}1;bx(`F*2|{KpOq)r58PAzQTq6N^FHOvDj%OWF6~s@=_zLYqGwuEL)e|<&&k#)
zVazPrc?aJ*$S2;ayLTbOPO{tOL;t~kzKXm@rnh+t<CD&b{rk{lF=67{9km(EPvblG
zZ!tf*zw=+|{?0wIHM5+b|5Lpd|Ki$?e=mCt_tfu;_<ezWYQ`_Qt&eow?t5G)nd=>O
zHT6G3Xm%#Eug?5;i<<nOI>;ydVE!iiW9B1?@X(J}|4sdH-#PTN%I{##b)i=8K3#2E
zaQypSk9Qi(mwWHON&LW5zsS-2*nCOXKklhdJpMDhm)&-X@!i6^h4&h47C#byyZ2-G
zQE$EZ4<)|5Z;w(lbK91DcGu0zY~}L$Ih9#0RTtR$-%R{?`1ppJ<cl`ukL1NFnvYnC
zZMhV6UT$Hf>Vdx8o{OjEC0a)pwOYKAcy1xV@OJ{cf)vBQMes!GASoPGx_}3octFg~
zwfsv#DHqgqnss?ClzAN7teOZeROPDuvlxzpOHxRyObuMh+FYBP!7K-6`asewG)0y^
zHesA>3Mxgx?YZN#F24_8^Z7RK3bc@xtG3$#YW#r;Y_)8^EsXO%ZYo{C@dDB|q#*I~
zPqfe0zxg@n$K?eXyXLp1Z1I=KREt-WoSzi$^g~zfU)O_0Q`Mh7ZB#CEV1InP`w#nL
zeTG-=o*$>TeXZw<|GYJCp_VH1%HDr(n(unbePKLtfo)y)y4P_sS8~7BGKXE+;v1&_
zwcKp7Nzm~xr3zgPzl{&v-}b&oS7-L&`J#Vp7ySwNaAuYA?DK6F?<DPS|MUs!W9Mm@
z_trt~@x%P4`<vq5O7p&3{^3`=V1;#f52wD#>*z+FZ9i=cn*z0RUKk7BzTNB~W_tgo
z^0%BHj?3nY{qgzO-mO;>GQn-b-IztXhd<S9^-vbtEx>t5=7I15mJ95&vgNmhH~nEw
zG;gm@zu#JA-~Q&~mizHe8)tGnE^IU2<$T9vQu@^l=EwKtYm$FV|7ez0FIBNS?CRU{
zyy)0_v0Ku&-4N#B_<F4N1@oCr{!t8;Ul#DE{hh}tFJmYASoxp&wE4db0@%L@?Jo&n
z|C(;P9M;x@Hp-W8Hv#oTK+SeY!3FK5*sg%qp5VR;q+zcFtzW^F_F9VtJTuqYu7D+;
zYxCzaB%jZ`-gAM?2W$qYT0hE=?3;PLF9X@EiO@s^s^fjW&8;}fkbEB0<cB6!a80fh
z9mFr2!8Dr+?L?d1kJcaKXZa&@;qBJ*lJ{erWslr*-MV*AUCwtsHov1M9`Jb!F`SS*
z$<R<3C-UR$2j$1d=G~L&4!%&je8(eS@rdmq)11%WZHrS;zGige>jHlMAJc!cSFj&(
zdK~bhd{tb9e6VHyrqjEgo$X)1Q*+|;n=|aG3;561ch+y7e{_9oT6MqRkEBPhU48yD
z969fQ_UJnHkH#y`B>&sRx`3Zgp>I)xE%(Fl{;l$DarPh1_k4NzwEIoD$90b7-Q7in
zIyu&DPKR$i_{!8^x9RWxJ)Y(DAGHs~$$PigDqVK*J`r9Px@2CaxtZ-XiS~yM@~i=D
z-`oG_Ke89gGJGi~d0}g9eQ@5iZ)I<dA75G3-1x3y0soeLvULaN3)VO!?D_a@_3{dF
zKa1qN8M}8Uz6j;$HGUN{@oon5o4?ZEjDJWkt|$(;aQpE0sCx?w^Db;#T3c|wSX%Vq
z<J()66Dog(RLOKP{8|2YepmFLk{?mBn^v!n(kr|&lR<u^2;*NCzNQBIwL3wLf2C}{
zAK*IGLDD!9(Yr<JODu;}jOn1x1-K}CYxNOS$6f;WJC2Jm!pbjj;|`p(X1?WL2=D)b
zdK-|2WanE@as>5ZpyizHa!}(D)RTnvU_j{%xixtn)Pp$zDlk($b537s&=zoK3818v
zC_j1shk)C!J8g15{AchjPtN9>YVvV?!h17`e}U>x9pvX_omnEPB6$9>gS_t_lfP^K
z8P-_*ww;|l|HF(7&DP&y>!NbI|1<bJJ2BC~g1Ip8?=6PE96vID=hUcu+|hRYsF3f6
z_fa{T(ckW89RE9eDg)ztr3DN4`XA}PS^pvW(b=9|$7U|S`6D}GN6$&V)r;OnJW-$U
zUg+Pe0DqMpL&?K@TNr<=f3%)AD~|u8-u{QaiGrrKcJHz+zs*@$lC)&yyXBJX7rGe!
z+Wq+cTmQ%Y$EMd0$BX{34!Dr}G?wkU-@fRd_iP&-OD1})e)pdt>Odbq^Ey8UGf;|(
z=l>$F^!<_8<`q9~2S_C6^5yC>ezEqP`tkKn$9G#8zvyj$e7>=sp=9EcyIFQZA6&F{
zPxsx}TJy8w;lA?%dPn{<RJPaoGSno06#vJ?S*S4Y@Wb+!pu3i#S4{h7ZoI6WFL~fA
z>zv=~vlyP(r^(;qe{{dc&MreLylYS7svqrMS0_D_?v6C;P~>EpwEDPI!^8>6%vx-Y
z3eOts5`QRm{ImL_%VYSTK~!zt{>~kaf6g-0J05OeWvEY>3~rdIBaNj%`XI}<GNhc(
zyv_t0it)|7)?f(j@@CY6$2!3M6HqzWiPXeP2c_iXv!Fx<E6hOkC!`kw?GPizY#`Nb
zCMc6YIxa5PK!st7Z|2*xp!yr0AHWszWl+BxItB#JJpJ72dl{S^$Q|#IpD6z!piKQy
zdyBxF#sv%Id(Zr5c%Z?&{qKDHwD{)#4C4P-GpmlR*tK?lkIJ6iea{0n?^g0IkL2+9
zv+b^&&3?@d;p&A7Jr~#~)p-AHuhaZt|5p5-Ky`damC@5}x7JUtSpDznZsFaRpQNe(
zUesV`zW?%8UbRn;{ja>qH@W>II_E-++r^W@RYu#m<|jMI{r+uUll0O2uztrr$?e;(
z=FdJ9e*I!pR#dgeF;3;FO_D6NES)<n5}Q9gwonn^n!i<QQQZZ3;cKQG`}25@uWaS~
zo5B3`@zHp38_N&P58kytwio17*G<giojb>eW%_nrrm4N24|v#;j=x(qxv7AI{b~D=
z`rF)(&HHCPyLLW0p5;aVRIy!dNkx0N$JDP?zn&RTzuQ4x&)ej>&}oxPo+g(J)6*<<
zj;~bTxq$ESL3!?f3N;>k#Ns$V%-i^g{qEK$Z8pxF{~4A|HdFThA<V__*X8fD{i(6x
z59Kx&KYlM4_tN-B&u!^y>*!4GrCr;9os@H8FiOZh^wdH3<aq}9+4DJ`h5vZ@;a0``
zD)X)_-+BK&{I=sPL%mZ7<KL;ayLO!V>>ybTE;zycg-%fVk@yTQCm|{CR_TESJTt*1
zAGj6gat)L$D?!N$(vJqW@RYLs7K=bDdWbNj$b>f`AAw8TqYNqjnb&(jgOzhYLpG2e
zc$^`4+~;u@!*Ng_1=2Tyr1KNtp-EV02{cZ3^EXI0$PJ*ezAjMT=vIUAEwi}AT@0yY
z4NkH@dHzSl*lV7=bOm!vN@0HCQtzy_w@ZS>lwWtZF5vIqC;cbkN9Tum-=fbm|LA+~
z*%!uJm~}8^`_AL?dpa9~3Xi>$C{t>%cdC=ByT6NVfx_i|S`|gHT+bVBwar*-y3_Xb
zfnp{8?>_Ur7=G;!xKPLb@1hjb-Shbm<2$4Z0=i3C8tz1;tLM*Z@#g%`kTUhV2;=A0
z`EMj2@+u$y#oqa4y+qdWL)XeZEA^(A=56xUbmLPN=L%s_VJK?d)?_?+2Sbhc@8J5A
z2mbi|XITIAKf^^$2f6dVGhTlWzE#8h;okFTjT(L4fA`L+EDV_Z%Auhy{aS;~=?B~2
zto_LS*lfOh$C_oAZ7d&(&0HA$`dC_K*BtZ7T%Uf}q)d%zGEWh7kY8la_n#rDzxf`w
zz}<?bYp);it=o}wYZ~i@{BOC_pDN#S`oj1!&iu#658)5qF8^k?@{z67rDs=bc6_Nd
zGM$$3@uJO)eG&T~RJ$_N@P4fS_Ua>hkICHV!}k1tY;3fb+;#f)DL&To**y~<j@+*O
zDmsqJmPN)B91k+cYyIKx^W10jN6X{N?)pQn%Rj#T*77g5o{QmMdj|7w>9+Ux8cbX^
zp0Z1H5ICK+B&A4$8QR}K^dOW#<HXRK+7#4{Py%&PPRzT!UJ^ba9{IZ%)Y$<K4S@$F
zjX`C$A$V-P5|ja8tqO1<4iW%mjz<lU?lx?+2s(TOZsgi$K~r)1me-9AP}OQ%UW2TG
z4lxI?fx7P|(2foyyZCHdlG5xT(lzy!p#vxBrLMf~zf18fkAK{LAb#=9v+bKcx=xv&
zbLsi?md|Dn7ftAy&}X4iq8QCCp&;Ke&*Vq_WBc}5t6$tR{%~*g!`BavhUO_BI>R2;
z=Qwp@{VgZ=y$pp{7`HE|n0!P|?8<^`Hs))yX7R0-zq4cW+(i@JmpxT@@LiU_is5(h
z!{cvXKR(N5vE@HQN0jdL-Zu@mzwPkYx?Aq;7K!`+eg>cOmSXtH{V2S5`H$Ym??r#y
zdvqbfZfT|Jp@X~YC(RW!Psmer>UoeZd0+wm68oIy{|v(QP0#-=>E{2-<;C!BpJd&w
zD*was&HJQ2xVAUxZ;cm?(7Et_(!-=JshN`3d=D2-`}s3=@$!4m8~B-jbpH;jN&PYT
zTX(MeQQ-_LlbPq{FL`!NM*d+M%ZbM~Z?<n`sQKV&!Z3yLyZRf?57iML?T={7cbb0_
zI{Z*qbV)_p#DeYRtzL`Nzi-Ra^LP>J{xN|4O@ssk-xS8bl?N*?&tkaI_I|ku<9gov
zdl_Q>UOBwMgwYR_z#tP5kPZxNBzoQ*P#HD10-R31fot2J7r>DYPk6VAFM+Cm*c6VW
z@h$N9C8&l^0gpjKYIx|d5K_qtE}<ob5v@{a5eurn4WDoM0v;;|4`hNWcu>g>8eRvb
zK6x(&NN#{Q7Lx8lroGv#!L*a5z?DIj)Y4Pp*Yox*`ofu;U;I<L_~mS|=k&j+YoBnN
z_<s#!No%lE{xS16+Yd-jrgG)I3h7|W#9X!4v(4>hBtLVXpO#>)%TQNc<NbHeKHVB^
z<2x1IhlTIH=$!v!=F6Wuw;umKb4r@we}-7m4Ccd@A`FWf?9Tk%tT0VB{lSe%=Dzzl
zH~Q7@k@M+a@%Zxs{+<;~SEu&ATU^T8H$Stuwpu&4OCnkCllh_*C)IBRuwR=GD#X_J
z#F-l0&7M}apMOi+!Ox~Pe-}>wJ3IB~=Qsai8ET(?c>PWDhwX!ftoL@Omwsf9h!Iv>
z+L$K|QsMD!!d`~j+|<<c<x#h9+=#k;Gty;|#lkj&PN}}GRR#>-L>RLg?AOf5`}=}9
zj{Dr43v5Tk>%K5<<h`GBfo)5;Lyw#*gHKXl;HL|0CD%ZS!v#Dlg3=)djj#Aay9?l%
zEl|@AlAu7P#R8s6P#p~EBD;VJIoRL{sGn;C?zVs`M9_pCC?!4L^7>c?WY!GYA+Gj!
zbdWR#&E`SPd-Ll7D49a4QgDCVZ%<l-Q5tAu5>m2(XUQNfQ>2+f<2bRnITu(=NS_XD
zVZIW;e&#=e(0_)M^UeE(c#l4QVgI2k`~2i@Z<TXcXJ7N!kX$ow$%^E^4;|#yGWUP*
z&#k(D^qYF{$9=8!4^rkvJzU%t@m{S%W=h0{KyUu(<ueNBJa{a^_+|ZD=ilac|KwfT
zV_EvJ`meUfN4M$EoVo7idFbih&otbuv@vL@WAK)~2)UgMa<U&j|Kt3+{I-ete&Idw
zYKxWTY;EgXs`ShBNOLjszf+pu7x3@0;r+1w;rqkc@tc0AABwVToO<iCtK7?H@?S2c
zo$3FvaRI*rvn;e}EPs^+5!rjpYc;@0;8}y2!k+I7csoF8B2Z8CnDi_LmF?k@aT&~7
z+0HLP4W7xjKohO6k3uIMAO#7uGYTnLK=le_Fb$dzt|7OYK=TiNTfkEh#-Ld-P_!?H
zMjj~dgGvM=HP9$9v=ad>4Bq#^XGTCxfA}2SpBM0{H0Vq+X!;kV$q;NTsLulGIA4}s
z!PKm*ALzhC={Pd~%SY1t=3HRgW1ilZ0S>kcY)8!N=Q3m;2A8-^pYJu8KG^-mgmEM5
zeZN8nDQ=ab9`h)Mrsx1ShZC^zA!s%Nr(>i6Bk<4<sJRJkBN~F|gP~(V;0d0|;8p>o
zbL0b>GKZA5;AX<{dFO9|3TRlp4IOiW%&tSMvbO@2r=Um#m)hWYPe>#}&B^w&f;V#K
z2X-+W1DOeFIiz@Jg)bLj^jR6VScG8;={X58(IkJVMSQM726LSB{wjv+;5up}?{mKl
z<|yfXb3QsqeTe=2tiklbo|k7Ca=@W_z3qJ$Na4K(y}EaWH>4PrnnGsL5S`G>H{haU
zPXHT|w;^Q=bZ7*Wa3ns1+T!5xJ6Ng(l|_&aLg!o1I)rbPZ~uYYIiLy&)Ncikg{1gG
zdbyBk{Iv`z{vfGi$b-q~=^xs-!zeaEw!}<3vsZ&@E2*^?H2bnLh%o*Yb}oPKAT1DA
z0?M|#U!Dio^L~DyP~A6$aXmOZ<D~a#Feh<?Lb>Vla!`_d{yPSgc55vc@Mf%Q<^dJ*
z7gZKNJ<5;<uEC)LLC`r$$U2L)(98~*VT6>-(EdB}=y+7^E699};j=A|5R*mVp3}El
z&<clJrDqvZAVUG*v^>!iG^zj&NN}IY@Hr?^LOW6OF0Yq>u8n}U9Inl~30f-xO2Xh^
zhcpS0vcilHo2oCcgpips>;5x1mS2YC>}w6C4|l(Wg|6c6mkv@N?*0Y^T-_H?bIJ>p
z7(wC5dmj|w+-J%c@OJ2dYEp37u*h!`kGToMq-b_X+3B~15t47EvhDLSnB}U`i$HMO
z9bDo;N;bo1NNsmeX=aqZ<@GVpG7>L_li>LZnCHPwcTkx-*>-sh7j)`(B4`#E)M)^P
z;9A=q3wSC)g$y*(!1XS)qi{>!*+Jqn*ak?c3(X`*qmmi!j?E4tk&;#yn8}&J;J=%Z
z_n*Ov;d&b=0j}k}FPp)f1kU$Optk8oR#3iA0tee3b5Q7l1u#m6IPUXR3^&@|{Q3-v
zicgjccm-98`U-d%!e?EO1C^_whQusT;Rb4m*e<sP4M~A!cfd&nv=jprdZ4@xEfY{Z
zidfb04ccl^tM&uU<v{0&z~ijo)ZV$)0#p-%x?GS>Kctm$V%CLUkUr7^o=i}mOA_2G
zGlC4Vg46hMXrhO7>%dL{wTb#c^AD4CSH?|Y3}~_<eLkM?cP#7ky$spV#4BF+a{+Hf
zzEv?OoW4A3FjL(9eF1NUzU>Q0L2#q({We$`!Fqo$L-yhF_aLReK>-_AV7Y*|L*J^{
zLE7N%muC&83wAHyuINiV$GCtCyo3d1galGqgKF;-|4h*QFudM|r{d>J!J{YOD)<(7
zI0e+I2i5w>&3;f(dVJpbb*v1K%nvDP`c0QvgX$tk&1D6u*ugD9@L&!&vp`lrK_e78
zM1C1ub*=!7+N6VqD?yD)P}F-doSt-d`cj5)5*q-2Tfp_xdQceWID@MA>!6OjnF1(S
zGxB~FJ4g%M{dN`<j+YwD6hU=X_QCQ#a7!8#x=<ZUK?=YD4UQAAGH}&)6Kwoy-V2G%
zO&UyLovQMB8q7xEStW3j8B#CHW&1%BG^n<QWb2)f;&B#eIB6|t!U#0f1ny%&LkKkT
z4>1TL0B(#!S{~4(Y`Ym09oR<_5E%qi_#n0TKw%3R{sk4+kctq}NrSfgvi+(8*ou#w
zeD5HLsPhq37mo6o{nZ`wxt0rfD?niiDQ?fe1OnLhn1iaUioEkO7ufbd+pe(Sy#a1>
zJ=_gyE;yH8p2cttQnc{i{0eH!{wj8mx)A#t)WHFn-;wvL<_f5v<CnqgsqV=p{Y-u>
zgPC_~;naf*cveEnNxwZwh;}Y~mIj>C!2`|U6<<c`p!5zNRg?ow_Cl&N@OlYQSELU#
zyaOsXT)@+SpcQ+P!l3dNG*Jy&_XE-mUJHrbkp^Xer=aOSP=*4pj{unkO4Fc19$NW=
zS{lfGZAiD+<=T?!09H1)xJ3=pM2^NV{z?ap4P=7{3$C}l2d7fdxIxqVJK*rb+DPNx
z@9ZEg5c}o12;*9CX`Lnw>Obx=uL)o~A`S{;XdK?F2DObr5tjifkfa6TzyhFBp7*}<
zEQSmGGK-%bFky_!c5tieg4Jxc^Y4L{bAmgAa-iWaSaAUAUBaelw}M(=^X@+eEhGgM
zC*Y|F<f7Q+8&Zb=R8m1Z1hAqQR2qRJ6uj~ZTv&rvnL0>(1}lCBu5Z<{y+9*l;K4UY
zGrH~yXnE>A_?SpkwG=4-f!15;ZiE!!T?}5tEaUsj1+Ed-gPRc08WB`Qf=6qz4};S2
z4X_GOKcW(pFTm}K{dJ(y8!5a&p$U$KB<}Oyc7oJ_(>J7SuLLy_K`oaph`Kci(%T31
z`jVvg*K{##3bS-i$YAOLbtj;$Vx&@{@~tf^XzmAGx)dTR%Ga=<0=L?rOH`p%9K2lz
zU8V~vC_pJ2yoeRluB*g8RSvEQklHuk;ZVpzSXl0Yv`N90Jg6d-%l6L$m5hE{7-y>P
z*7ssqOE~GX-!Xs`2Qxtha_pCrpi<&@8l=q!DS7sor{it|f)X?|g@Y<dNL5e)t~CWf
zVGSv(I`q!3Wyl7XM@YkPpopE9!3>Q9aAt{E=d33^i(%qJPs_LrW}|HXy`V7<NTLR{
zMnJ6zXd4Y&;((V+`+$pda4SyYb0lbf0a~Pk>q$^8fLtwt+JfMPDcj*w$Dk4mw9pz>
zO4)!7gsfgbj(w2rpb`tz^oE;_JQnn=wgNO-2<jfGfeNOx6*FyLFlph>0?e<$&E+KN
zeK*04lXIYM3OG?i%l79EQXlS>JcGoEv;ZiaO&5Smct=o;3Tg?$n&Y69o&)L(NnHRb
zgVn*Hq;GKdUkT${-uucZL!pr3?i#q_-3-Y(&<5$f29rxA6B2hWVDrpbW9L5u)|mt~
zE<wW|zXRAzu0h5~!DR<{EgWQMYUW!j(9je(7LbNFjnuY0hOI(EF2^9ti(EkKG9gWQ
zSQ!qQUV=0_kq1!U{CWVYkw8@jIP1VhR7*k8Vhd^sfGRHNhzr;aoge|FY$xL`hD9e%
zUkPB&z_SYJmy`5)SWkRCEJV&Vm_7uxQ*sVgz6aHyzobCDo_jD+aLNX^g`hokM`)3C
zufa?a6jRxbke22AI8ceT&)tM^J?nGkSqwM8UD3_paxV&6b3n4xUuYZkdefU<pz3EH
zxD^HNY%M&?5YI2O;Q9Li*37jQ7BcXLA$alp<(rSU{{W2;LCbv50!0uL91)VjQH7Tp
zjMTv;Iy8u&i5<My5j1fK&PdQEJ2;bpR_cIfLcjqGTG0c^mf%ebuo10(P(L~OJZ$MM
zQl5l$SwU@Aup=Ou6r69=qLcP&Fs)=M#XX9`z6Ba~;65iPa5_L0sMLknFV8{2cz++L
z2m$wqpjCzlXt-%FqP&5%@gd_Xaol^#7x03|dZWNe9aPolfMXEWRswg!z%|1j^P18H
zycMACEHr<D?fw9@`<eBBhE|3gM^OF}fM(GLDIXogx{hl+ewxK_9y0y81zbOX3nqAy
z1{deZO-0BMi3udZzP0+Z6Vy`$l`_WARR^H;_OQAcR2CvNN+JDKQ1Jwvu!41w{Xh#5
zz(#^2QBoLW7Nq*{M_a)FN)({R7GyU?DQwsx&68Q*i(x(Xnnd;sxYUO9k_7I40XJDe
zMg8IOOVGRl?^A&iajoT1h8$<G94J@hpvNq@uLfxvK`RbK0~lEVqX`RXIY7tmAtR8W
z40qw~$7>B{37~;oa2&>gv)Gn$t;4)07O?NpQ~*t%Peye4ks7ez4GWUOuxXv+BB0fd
z+d$)L{^uGDmxIP6I<YS^nhDN^pFzE1$k==Gc~Aou7Du4`2+9iJVoL(N^#`dZ394Q|
zEk1CO3d&8;2!%|cLmF)0ZajE(`^j0CZ(Lx@K63K538O6L02&*lr2}sJL+fPl5E-69
z9M=0gp}k&M<&Tu(AXUolC!qc`D7Bj@?)m-*R4qLMjh4SW3(s<&;pHB<mk92ZKs(=%
z2nFY#jTpt=3{clR4pIIto2=5zd;aqRj;GsrjP_h$3xPDtmTv{G8$|61Kxz@6Z|xUA
zAq+0@K%G2DAqNd%P!56g#~~e-nIHj32t$XL&w`gXxLlie2V@E;w}Quyz-_sH+vN*T
z8oQX;*XG+?a0>v`c!RXndO_tPXc!y3@Nvfr4W@2w{Xhp^jIOtiyS3u;Sqzuk-uG<*
zb;<TJK<Z{_!xtP@NJBwbn#Q1!kHclPkoGZX<O4K!0Uh>)v?oCQkq*5dufc;HpbQCW
zF!O@-fwId7NDhXy-jGrXD6T<+fM*#XITn)rz`amt)(5pAw}6@}H6}%U6()>f+5S18
z=(!B;jDy;#utXaNYGi?nCGglAxYGw2yKwn7rv$oa8I<oHgBoez<*1+*v@bYbe6CG_
z&bmW}Iw9>kX!Q>1UqYfR4m8XG5`Z*FD%XPB#d{#TkJ3PcFMrTxOTeY+Wze7sB(1E>
z?fSBSYl+|$jP-s@P40dgOn1Unt1hsufdm35pdrmzSSf|xga!xn{r%u!XFt%W-@YlJ
zNCu7bb3>+3K>4f!(jN!4;-Hb=^d6LzKuwSAgWwU_El?YOfyMzq@d;{upJm872#G*Q
zC8@z22OUL(Ow2$Az3+jF!ryy9{ZNp`jJ$&quQZrWdOVfayK{l92HXySjwOLx(O?1O
zECN|z4qC(uns@}){B?I=BYjYvpkfa;2MNvv;3`lZRGxub2awzb8Vdvsx4>6afLjBQ
zyb6mlaNP$ge?f}DV=nMnG4(Arph0xd`~{?~4qn=6<RPiS1mAuL8=z%8^=2<GLwwtN
z*$VKqKn`fo1k{=Wx9#FU69TY438>zWlLpTifJOsBK`ITd*3A@m+krDBIKDuk2^#l;
zWr?y{(B#+oDu$bF?>~b&oqu0|W^b%Ojq(yk$fz#Z*o}~ZGe}H<h7=!y2F^ec=m4?D
zbOB_t?BQeZ95g7FDnMx~%zA2J+rb6wd$<+u?76@e1Iap&!VBC*2hWYcC-^`;aM&tp
z(5_4HU;)y)SMa<UxB&twqab}B=y1Y3WALhMP*{WG5>oSk2DyyXw%AR9E)qkIDsarh
zcK(5y<>0CfTFzqb(F7IE-+Pu{YEZ@~164gEZC^0EN$;xyB~tiA;!W_N)<S5L;qsgS
zwk_hI?9!13X={MGu8`silu;mUIY^wY1!bii=klKy*tVG0^kp!oaqpW08p{PM1P?4+
z0}m`f8W7N-hxg!VOVI2us6I+UqzLHv@E63W@<*hJ5%9q0<yj1uBZC4zCp9R|x?*tR
zAh_Kis{vi%4o%yjiV4!*gO*^RWqYuyf6H;uCQHx|7r2fG4RVSwLh2saIzCWo1}WV@
zV=%U$0@5G6v>rNn2TB>xW;deo2g!M$fgRBHVQ_hB1DcSAOr3($ixN1IfQxF#_@z>I
zkZ~8ol2hSp8O#tnd!botqwHbzD26Ld?=OH-I%vTJa{2~^47ge_uP*})27d?Tj9&q4
zN5BJ_;4Uw$Is^5iz*9`128QWEaNIz;woUJsTY&U|t1OUdN6c$CgK95O6y*H^4}i{i
z|4)Q*Gb?!Z3EaMeOyWb^_6xzW0&0yyk`K7Y3@KH2e_z18voG+b|4Ro^wJo4^KHzyj
z$V6tp?R<7{4F(=w0WB1VE<A&beS!D6fbtb=Pb_E*4QXg+*5!SmRgqDkju@!5ht&Lr
zjAFz3xS-95kR}Es#_?=ov|aec1h$776j6|o49F;zT6EG}4W^AO1sROc*nv@uj>=0J
zqPt$Kk7Bq6nmWD#^1SJT-7i7o4A5Gl)-H<yA`UK*z>6Lr-O(fB^T4xwusRDimkKEZ
z`?fHy2j?(IY=K7+*7M$cJd5EvxMRDK_x^L#!3*%HCphzF=t1TS5al4Kmjy`@&@pRJ
zc?_AcZF?ifd13)KtMZhZ9c&H8%RnKWau&4v&IB}U07<NJ&;fo>697DH04d_2Z8yjW
z8K~ufG${_tFW`w(&_)1gMV0;rG`a^W{~+zc6kh`S_%5(Pax%EOM9F%fybdibug$M&
zFiHoNkWrXJLhP$IeObVL;qJtqIpDzs(3C2;ih?vOj(`R&*MeJtN#IltZwP>9T|lKD
zbc6yt`tt!I0G_M`jXXn|C9pmKc;p#efP#Co7h*xf8BOo+gX%|cn1hoAEb77IsQ=zF
z<T!)IK0e$9Wj#<-B}wms&Sb)dN%l=)TrGQ|u<coc=mSr-@L3F}!Q+?U{w8GM24;PO
zvIhe;jQR|+-claCbrO=ZK&=JPI3T2^gLZ^2gVuO}nih~DSNNb3cv}Z(ZU(9joV6f3
z){%SAYwf;*MsuOl@)h95=Ys(Dd62#E=yNkHD~;9nGGs!+7gSO~M%SRdfArC{wY>L1
z;}D?Wg!DQgvjO0&1#WaehKs=Y4cr2d`Vb464pRV^evm#gh?#x3{3z;t8Cp4J3N`|4
zE+or>i$CZrGAQ?M1W#*#t1fRXFM}HkI8wLr7+HcVCh#U``@~rckSUajpsFPKY$j+&
z4z%$G8lmo73mH}e4-tWS%g{;$Y5oV?yM-2VU=`4Kg06@I#S<dWLVHQz(iUQIuj%qQ
zOK9H;bqWY%03==?m7vE6{D=p!<Q*xm9i%4Qg^aI(<^^E6rdER)5*Cmq12m{XL(||j
zez2qq9zO!j`9NCPh%s--(5smOG}J*&4UlGVAjd)TN!=GlNJ9fM?+lG;NZx`Z6p-%h
z!{ryigSd8EK<g&<Lf7*^#$Gq_KHtj_`}fXcq;;vF>gW85qYU5^E<m9I?h-A<wQl6t
zJjjt6pjrvimV=IAL{%4phwmPPrW_zy0jV$qcbK8AXz(~Gc*Gkv-wI#&GY_(B6xJ-X
z%f@KDAzI#y&Vm;nHR!pPgs&F?c@^Ah28S?cgbtP-k4G_F2iHZ=*-B8&3>od*14_1=
zk?M|xyC1Iw4IH6_eiC>Y1lR=d@+jCy6DSucg0l{IP!BT13Ys`71UDQk!A^qZP0%VU
zP+JpR%RP65jmUzdBip%*pM4g?+{Jx?pS~{O`3Y)OK^jp;D4T*n<Dj6`3mD5zAmao5
zkdsZoVGFIHKuuuCmR#_XQK&j-odv3*Abn8CNG#-x4e&_pOh_*k((eIPbEcqUHRKhs
z7g+G@!5^ObB7^CVc?Ea|3{>GR0EG`^3janMXq6r~4zeLV9#ByR8D0R-g+c;wJu7IS
z6<U;m`=H>S2_y@ESF6B!H<v(b{=lt0q)9qRd!Y+D;0=lm@IW|ti4juk13Xd(8X}Sw
zxF=_MmLdCK`S~dDT9*rKYs$GE^PXkk&szr?3W@>uPAlIUf~p5l6_9)uGRg*8ka<4y
zg$A=4XucGAp$V+1204@lR7Zd^18g1{DcHfG3?9IPbUnetH}EbmG~6LgdQi@~RUN>7
zn24oTK9e_neb!*I5ah`YkSF0~3nH{2V*#MHG`OmVl<3d`1u`xJY6ZjUe$-KhBj9#b
zMLuYG3%H2@Eu<h}4_W*UUZS<X3K0*Wg#)0;3h2^9R?s>D*iw!!h@n8xI4XGcjG#_Y
z|BL_@qgyK_WkA!^pfaZ)Ty30(Y|#Ye25{U!dx4N474Wbaq&9}N37&)Jt1-5bgFCN~
z@(Hw{3(|T6_fEju$RT}IHE>1(ms<Sir7#;)Oc<S&0FRdrV#+&GUpq)`0F}wmY7-Ks
zcjrfe=5s(({@_vw+K>gU&jQ!gkSqWhuY}bm@Hm3x32<0LD;@BlIIMj;AC!JU%ex>|
z1f=;8`}rEEPXrn=MbC5KPAQ~u04~;Yz-?=2^nj{zoVypGlVqR;>Y&CbX!imrW27L>
z%t43SZq5hoC4jegu?!r5D*<S46;$p)d-LFG9z5RmSqUSEVLcAi$u($YaJ0mot-*95
zxJ3$ToPx%VL37QJG6Fo|1`2*iQhf6fl=VST0UJ67uV(=XTmyGEK}r26c%2t)HWO0%
zAcfU>P>l*13%CZVB+L|d|9Qb2Cw;ySH2el04~0zogR<NfaHkZdaR3^8fsSs1*EG47
za2$LRz;aCEsk|;jI;8Ca+8GRK*uu&g_#sx1-aMrIfGPp^tHF5%(p&{E&xfoh1{Yq?
zRu!a50IxL$&C`LV9Q?L0{&d7X1%q`h5r3p)m7E5%ll1=LUC_nD@Fm%xeg!BQfo9)l
zfl@uB_k9-Bz6Y%r0;hdQXgZg_2lbvo!46(^4Cx{+-2EFg7WRBEXyOa9Kn7$4q*MbB
zeL)JGrJx%7GPo-UAHxK<LO+0JWlSG{#=bi8z(p9SHUbTJf=9hTV{_oTzq4SS!JP|?
zs*qid!BLRz0I2i^*OZU}f0Xsh;1$V`LLFR!KvFSiki+HLTsP3D38a*t3p#NCvReYw
zDoutKOqXvp*vny0#i(f-iKpf{)Aj|k7ihEr5<HMh3+gL@rs_e17vLnmZw{oc0}aiB
z5+AsC1rBC-M8HdEXrC863<U}rND*)YJQEBn`avtXP}bqX+LK62mmq}(tcklHK8X#Q
zuax=#>h;}#46v|HvUHPP%iyTHLRldNG|>;L<G_I|RSga?(7X$@<gErR2!l)(g7zZA
zx@_R~K4g6s@~T|$G6+Z;AKba9Qzu~=9HarWVB)0)o#REPuQiw^f<gm25Du*rkrvdh
z=e-Y}9|xsIP~xh{0}VHU+L9YVgA}mV&2P|HAX4uaR2!H<x?SMn12S@m)Br+ip+j=f
zP4M6bL<P9GhRo5dWxekQni?Zw#Xh`^4q5OZ2iZ~r8gGD?2cSt4aOF1{GVTM84#+?P
zN}7knPi@5l{zF;BRD@{hoADHA_5G7@7r83XC?2TPgAEfvSJR)<V1_nBkeYqa*>O-M
z2p*(J19yeMQ$Xu^Z+->$bHMY2cfX)ExFLfV(D4Y+*fun=LmHvrF;~!%ThNj^Q0W9(
z`~a?6VYMvSM)2r7s8|A550G*AY}XQrgijhwX^>^3W}x*qWG&%e13Hrqy7H(xfc^7t
z5(-}A(wO<0oBys1&}jA?P>KVEEVMoW*MHDOv*3Z1^4p-H7f|X2*HqxnCZt%n0h?$5
zEv*H&+@W1baKQ?i9D=4?@CFEQMRgbyFxQ*jFGrb;ho*4Qzyfqh3Zx|h9?pR@M(@r8
zuXr}R*I<?i%0J*{pj4-ohryi-OrAM1sg<Bbq2PTXkRi>#;KeqOu`|%RK=9xfWHJxb
z09n8@6Ev<Z0a=p;nzP`49!6xV0jY$A_bcbBr!L^N01Z7sdu`x$7PuuXEdXj3gS#Qn
zYzYno@X`)QrpC;&@HQDVq?<l~7uta037P{C9U<rP<KSi-Xkq|V20=??a9s(t5Ylo1
zmD%9F6r^)?9W-+RnmyVB%3O7SF0ge>vUIm#YtTNM!4E2GK}$11OU6K>Eyw3wo(G;^
z*$P_0e7y^_g#=XFfg8Wj9s1x>;OA;Qoo{R*hnnXDJe~xw&UokbbpdY#@*-kTjSlHD
zgQrAbgN@+!5x8pso^OGUcY)F{s5u92Hz4|zpmfuLR3^jL+<<3Y9_;>()SiGhM4-J)
zP-0fx{T7t#K?5<+rUH0E6BKYq#OLsV=Gj1%=NWKGl%e;6>E4ZJvW+H;Zs6PwZD2vF
zeneXUG{guQLV{FbKbt8EJ`IKi?AoF)9mErNDNDj<f<WmHQYBU7{RGWRfW~XrBM$<C
z!f}r|q_Ybi2LV?~harQiU~krfJP4X?g7h??`#eBuq0>{K$;xX@@0a<4npUtf15)`w
z7v)1zAyf;ZHiS2y!38Fy0LVIAB9ZW*i(%>_PxsSZ3}+zyGH6#0Qu}~Lpg_F@HSl_|
zpV5?t8>m}0Q6=T2gOtEs@Fok;$^ytn%Nd}a7-&%!xat6Pj1HGyeg@x41X_{@&ccuc
zl?0i_gG>p6$~4H}H*5&#_XRcr>*Zn75)jM54S#8YyP&-^Nc}cwFASWfLC%9T=)eVz
zl&6)4!F_|j8H}5vwR_g_GNk%uUP(e<SvR+00soV86cl;L8CTu&rUtVgxSoYnpB>=Y
zNl=<V8b^Z_W}u1_+E#=(9h_kwf(FvE50^t{EkQLWcu)+q#Sm1n<Q%NL%m!M~10In8
zPtbs(2r@4XDd@nt^(MH4KuX?G())LVCb8jD3s_dU?`6nf?+g5#AjPoObb+$1D{LSW
zoNfQK5E#Tlu38}tLtHIME>2mC1>Au#Q-5D!Tn)}-2SFVf(DuoBh|yqBLjv5*xB!lJ
zNUTCy)R1~5AAR2tsOEvpPl3yQL`np07lI55g9@rW(7xmkSmFh@m5zwde+z0H-u?1(
z1!VUTICVi*MP+~*LUG(@k`d#NpvFMk`}<uCTaZ?y|0%%bXW~N#N#)bDxV8p;=hD6{
zu<>i~LPlsxfg}OYge|DC431B!50J((Bu5y7YC|v+(u)K4?IBBu@*orQm!RvyU~B#$
zMnZxC)H4DnFi^?42NL9v5C#>LN5nyk&SCi*)YySEgpev<aB;9&^hE06Vh8zSM=_Vb
z;ZG$<;eahr8I?|*zSm#^ZU{j;5}=krhrTgrt21<X4YI077E~>P#?&C&$+*uK!^b(H
z9qpf>+8?AHY!alI0-msj4j4gK*n@%x5(JPQG`NNY&me(@x*@AeGQhRV5l97?2TEh0
z><wM+od6CVP{U6C_*W_i2x#&}__(#^vj$V}Kp?ctgiPon`3*dh4xWsMq<hF}Oi*(S
zvWx?~#0A%AGRU8xKB);KWCR|(jubpnP?2|jJ-Cs)AGGL~gtgP`p90Bjz~fIp&{F2k
zRM?0js8;<9$}XV5Kv~}a@7Tvdsx5Fk2-=PU7q1U@gO^c);vdu$$FYlUGdMMYS5$&K
z`8nXm+BKBPa!~6CY0)xdcpkjug8!)#l`0~5gB(^nL6%s>wY>qY2LKJbfyQ#+MH#eL
zjBAV)JZ{m0rAz>KCZR1MaDD?1nLt}Y&}tBz0YO97km4J%FcDIgfS1xiRD;KG|AQ`<
z`~NpR|Nr0gvj2b6YySUDZ~Ff?z4QOy^ojrfrqBHUH+|v%zv(Og|4m>2|8M%X|9{i>
z|NonQ^#9-V)BpdbU;6(y{nr1#=@0+^O@HzKZ~FWHf78GJ|C|2z|KAMe|9>+${{PJo
z`2ROU{Qut!#s7aZwEzFjF#Z2G!}|Z<45$BpGd%zQ%?SAaHzVx--;DVGe>2kl|IH})
z|2L!j|KE(Z|9>-j|NqUH^8atf;{Sg$Hva#cvGf1mj8p&rW?cRMH{;>|zZsyrJ-}By
zFfcGww47-<v!w#W`m^QFmNOt0gGNn_g#cKEfCY?YVUd#~0KU~wz@nxG!eTI}FaRn0
z^XJc*mNS3;{Q1McVBpc>0TTT4=ggLhEg(S#8xe&H7Z;FT3l|p)0kF{$A|e6;1qloc
z3^pn@Dk?cSpnF0>EOIPDKo&bB6jT%>IDqc?;E}PB;Q`$_CtwjG5CYcg0Rjvj3=B3Q
zAt5#*A|eb77A^__9x5UnU|Sd%e*E|WG7qAohJgX3S3m${vVed9)D#8*jv5Y-5CemN
zLX851#lYa;-~bK-kCs0z9w5&#2nbkM)PV0NtEsWD0Gk392NNLk1VDGnX=rGG1we#G
zjfO^z2H4sF3lXrRQ&Knt6nuObKmin>5aMCNzyNU&NIi#u0tg6jFenIsZ}SjPU|<jk
zfrJIfBLX!@)*2Xqq!}2%P6BCXU|^7tU|?Wj;ouMuP*8AiV6brU2}uEmg@8eTfPer<
zsf7y*hkyc<CBXug<&e<usNvvXU|^_ms9=GJNhml#W2=URg#+S9P`tro(1wKr6v1Fi
zLH2_DWWWG+703nw4p3}?oCmUt0pul+Fas!(SUA98#bDtQ6B6S9N)ZAYE-p1Lpc`^3
zR8%ZfR6t>G;o{)n0Cr!63J8G2Y8)IY92`I<LRg@*Vd3Hs196oL*btB@7T^d0nJmM>
z!QlZ;iY^`j2>~7;SqCrxnc|WY65;~3*Ci#y2g0&&0RfQS3Ky3O2M359E-v8MVgQLj
zOtElruz-YB4cInN(gEp&yT!#t11c60k^{0AB%lGY4a5XTW(_D*Kt7Uy7$P9S;NYO3
zARxfO!NOty6*FL95YPab0F7r5RRaoA5CeiOSZrKu7(fX(BE=;o0xW3Z0tr7B784&A
z9}}opjRQy>kAMIukicSKSr!Wh2T+uQ-6y~RvKkZy5SD;I0)vBtM?e8M{6KO7(7c}!
z5)u*uHYFkj5`Lf<hJ*nF1K2I#5QNwPN)r(&kT7LnuyL?p0mUlBDUdrtU0h%;bpeGD
z*kq6ukZk3m0SgCENZYW0Tv!81&!9A_ARr*X0m@MV5CY5>5P)P9289q%5(i}@P-+9G
zL~sfdP+-ttfZEF;z+mA54j};z23VNFSppm|F$on3m@LS@4lWh~3LqU2y$l*KQxxFl
zF=)WTQ~=IWfP}6E1A_}Z2N-x*fRix;g8(FrgVHGjLxo6904UyU0s<-m0%AZ3f&r9L
zK_LLL4IJWN+rTUVxQ`SBV19%6(#3|wq6MTAtgZtTj$js~oC1|n1|ALt4h}A$m~qjl
zffhOi9t9pT;Mj+xoCF32P*_1y9S7VWATbxPc^q(iO(H<)0F<sGka8JVC&+Igw^)FS
zF#!ev1xSho7ex->$Y)@vVF4u@g#;B)<a5X{Kv)qr91IMQcn0M%1_l+62_7n7EfYLc
zJSH$O2)MxDiVzsQQv!p~tOcb$Kxu&w0$`?whK9xq5CKkiKVU3`><bQvG*|{iFfcIu
zfQ!B00M$GUAaO7QlpH?@d;q(Sfq?;R1=vOzun>s(2h0Kye?VL?mI0GsF%SVVMF1`<
zBLJ2L*`Wg>Kv+isltw^mZ4_XFZx~=k|6zCoQlz1wp#za+U|{$Ik=4-9cmt6Y5D-9!
zX~49C)PWoWGWrkH5Dg88WdZ^MG6E2fFfc$}1yW}NR|nAnG8y4~cwjJqy&(W<H$X5*
zF9VqQ01jl}04xDk!oa{_;^6_RLnTyPJUm=nA{-bPYFt3o1|;d!fE)lyN-6>z0xF=i
z#=v0X0jUib7(mU35^&iBD!+Lc7%T)p6&$!+gJeNa-U6jg7Y$ImL_$GAMMVX4!x;mE
zMMy{pNS1-cA|%8DWSfnHgM|aQWCiO0rFKZ*f<sUMoQps%P!Qk{P+$P*<q%K+l_#Lv
z*+3zSj6n?|0frh-gMxtpRBnNbE(4g$LB5BypFk|ADh3t~j(`9K1&~lhO-&6b`!X=t
z*VotEgM=9BK>*CcBnnpixKY5sz)-N_#}5!4@Z(1T$RLFR2wkw^2iRbRf*&hD;tUF4
z=^sCCbld>9u@nM8!f?KYM8*P8peO`D6e<Kb9B2R)xE>J~Kr{nHJ%d96q<JS`P+$Pc
z#0muv^#K6^3<03V=!FX)CWA!61P=qy{cWH&9VkRV>IxV@&VaZ}0iusV;0MSU1_p;8
zAnQSQd_%Hdzz>jdV4V;Fh`(SVp`f6^0P;WpR8_zahz11%2ZIC!28R^^1{o7T4IGDz
z2^kCwU^_v26&xHKK>8dM6cj)fg1ieh0_q%y8c>D@u^<?v9@0ExU`UuSVFD<w6%s%$
z0Pz(ZK>6Z<K!U&nP(@`B@B!qZ4-F5%{Dg)FVD%paK+QXl`UEgPVM2ib$Q%X+h(Exz
z1E@vo0BO+{Fo2?!!9hU)?9K#Gbq<Q}jtvbUiG&FsCV>3+V8Vk5AbSfM8o=TYCQJbH
zKQugO0J#f9gW@k?Lc;`*z6nr$1quoZAijVA#6J@j99RG{uc4s<tPi9N#Gi0s1K1vz
zzaLC^&;T)S!h{3?1_qG*Aaw-|5dZ%GwTBrP7$!i&2}FVX*|A~;II1R0NC*I_4}d28
z4+;)o`w|=+96;*8Ehz>D22k*V_zK|2fy4vD4+aKs<bk*e0tEpK3=ItrApT`AaBu)M
zZUqV^fc?pk@Bthi1`ZFv1qMR_B)~!HCx8Mw0qlQBZIr;k&;ap2$Xal?Fn|I8WDh7n
zL39EnoESj%fdT+z4=ADo5}@WEFaX7a!v}~vKmh;>Uxo=25<vc700lhAoCygDApbK=
zfVhX@133MFQU@sBL7@jqs}2eRka%YZSOC(+z@QM&0m=v9cvfHtfS50!0P&|n0K)-=
z1py2UAUa_KD3lH;By0fr6GAh9!$(0O0HU4&N;^RHgZQBE0Lg=BkT{55zyL{S3Q$@=
z0hFFV>5Ab-#e*H7^tj-|f(;BHec<p3U;u{`NI!_L0ClH>0>r&wcY_i>R2^6voF5bl
z8X5`|7z_d&9)R-GjQ~)_WMDY3V8f3I9bnggaByf)a9{xY2jp*%`#?0v9s#KN0SiF!
zGl3ys!GsGJHh|(ezyO?&K&2NbIusZb9KiO0>V8l(f@lr~hK30XB04M>7&;~_@R(u2
z0m_uH0wDktt_%ze3j!7}tO$U>7Xdp0K=?)h1VW+>Og;dU3J(-OjDUauP;m%K!yf{`
z<swY{f&f?oBnTG&0Oel*H#q_V0>FW+05S&>{~+T)MuX}h1_cELP+|bdfHRzef`SD|
z6670@AV?m>2ML2D0s;aeAXY^{I>`(b4iJGGpiBkUb_1*+0xZtJ@B=I!5O9M5Bo49;
zWMM!+0Ehys2U!eafVBk#fGaPseIN%gSb!Y_st};^KR~pC!Vd+IJ_Q8@P-X$C1UXOP
z2NZw=KulO8LIMgvVjwvN28N6Ypz<7?EFUy56oC7MpmYc_o`K<qhk^q*pHzSf9*~v^
z6DGW9V3-jA3Jy>`P|#5T%3uW@KRQ4OqM)NA;08lNg9A9-f(%-*0wm5+u)<>lDBTr+
z^E0UU1DAsz7(kGLLE(o2D1^Yp^9N|L4bmr}0kQ~$7l3QO1cna`p!^@O0FskI2@&Kh
z21uy@%AsJcgn$C5{!IWEk_-$90+3ROfuW!PWGq+>f@ox9MsPrvt+Fzq@EOqgOl&Cf
ztY~}&7Isv5G(H0h=t^CL5>_-m10%Gb237JON;5E_xeF!^qrv?I7zYatyZaN16j+D_
zzxn_FgYNguUkkZsm%W97k%9UDU&|y0CJ^o8!@vx>8(1^+|9=KXklMt6Abv?UNl7MN
zZgAiB|G&fnC{FnQFA;<T{{KsaVFe2f1+IFwlmaG3HgEtI21Iemvq{P@u|xP48oDU_
zL3f`lLjps>=zX%_dvb^VeX<SU!FWr1i68F|&gU<Q{Nws~zGy}DAt{mis`o*A`flkw
zw%~b^+Mi(LpXeYz!(OWX!8&=?JyLpG_P12AZT*-W6|?H@$=&{!r+hj0J=kQ1ZA;eL
zn?KJo)FoG(|Hsw-JMPEgfO)SyKJM#$pe>ekGJQ$LwW9)M((i&Y`Tu_X5x^e%;qyPP
z{l5b%!rn1ImaI|!Xz%mDTlU+mX_GhoXV_@EqDQ-Wll`Rz`|vu}`h&jz8Pe^$kDd1X
zXtvV);C}|OldZq?b}DsS%6#kkkz`ZE{@%r9Uc&|U7rlGW?!6-rbL*_=(LEh1eI7TA
zPAo|=+VG%>KhQxKGGWa4@%*v*w~v2I{~`Zvx4uBdzspDNskLj}vTNM-?`1@3B-ca{
z-M7jszb)WD@xIsoLwJ7oJe}WZQ$OS%`elFUujZzeD`Io6n2O2Yi+$iIR%_<rp0<Gh
z^m>^Z*N@MSoXz~>`jPqQKjn|}cHETDys}<pM@jG>%^h>Q|DAfkcc{VoKSN9W=J4bC
zeb+VR5B+Coms9$vI_*D$p0D$1fg6Xa-|w2T#-Xn+_V$hkQVf5?e?<OgVClPPW4~Np
z?BAvPVmT&v)$SRZUhV5PI?TH3>)&q+3mBL;a!Y)x`@)$0$p2{m57qF4e@!Z^5B+Cg
zFY)iWKCxfRvt)(b1I2e|SKjg9etu1@@O&1-kG{tT=5PG|mibY3tn`Ea&YIlcHb3tD
zE8V{F;-6TFy%+P<%eZ9>;}5+z-Kg?)W~}D{mXrXtGgZsq-u=(O^83o9dk-p>AO6Q1
zxnaY(#X%pwepFwy;jT>1oq}bWwS^Ayi}y3tKUg=P$0qWduK45jw)b|DuX9^+gO1of
zo2^`5If2<m^2B4I#*=y)%wLNS*_nKp-d|$vFI=I1WS4lijjjE!*>|m8>M0f<bNix_
zl0KnQ_9#Qi6~+hkTlx>p*6*9oU3$J{^N-(QKdLL&utry()@+#M*7MGAOZ1fUg8wWI
zO3EH(sJFf^WdC6L{jKFqrjkh?zPFal@7!gOfA?O-t`>*4w&n*d`&{z_m>K^*zSdxM
zza{>Im;5d3<KY44Kk~eYXaB-`e^2$zN#8zBzh<2wv;Oa&NyZNHh5R>P|Kq&*Tf~+3
z{V{!km-FmD{?XX1yKdXzfSqZ|%BL?SN{jMKN2Mm%@4s?^z3orje}<;Luj<n#AD+MY
z{9#}FL%%|@pWJ>G^=Qqc;}Q=l!vZFXxRl-b#2>nV|IB)^KR$mK{%6Si&mem1#*h9Z
z@&a}`KPIK?W-mP`GkKNVKi4_ho9y<yaeVI}pZQ1pKSPuMpX!evwp_JSi+}N-fqjem
zVUuu+y;owZKIRJN`1HR&vBvn+1@^nw>^bZo%-z3X&9tiX{ic7lkJbylxvAd%J1TMI
ztH3imQZq_^xSim8BRcVds6yT6o(t?}>bKbc5nc8E*e>&q8sQJ^58GxZKYabVGUwS9
z8=sY>Iv;jT&52YrSb6Y2!?a$F=TjH(ALH|Uyq2Lh{I~k?-@%7JvRw}NJ0s^$ZsB^J
zi^t1yl9QL8*!fWZ=0^6Z=l^U~;9Jbj)?mM0R`P53rIO><g$~(f+&-2sc6H{$$Zx%m
zjBco!=N+_pEV+RHnejia`H$At{b%^L^XeNt{ru#u7fbe<-S;`t!Xdga^5)}zFO7U|
zD$k!%#l`S^ANzlXgWmO-`YlYSy{>&dQKwtsrK7p&BeThLj(HQ~`tPlLz_|ZR;LQx?
zZ{82e|A<`vmiJ?q&X@H9uZ908eoUDWoW0&??c)7Q%1{4ZWW|54(x;k>;m_m0YyUGm
zm>n;%|Do>3^rQ2ew_mDB`LJwbx!HzmuM6ZuwttQ|QNVfhR?U6wV@FRM&^-2t@#o?P
z`afL$aDKG+?0?*U_`Og?`(ZJ2UAe6b)*hLa`<Qo0u8u=VYSNmJw>oThPtQHT{4L%0
zKSR^3e<$y=)rgqPzxn)I?MJccD~$TTSnB4QoQQ3BxK1x=Qf6x6D`(;UJsQjp_<Q9)
z1m@o=e=L4$4SUc2hcQ2reAa)<Z@aqYu)2?D;f`}ZWd!$V{(G^2zaybJ;OhFId$*+b
zx(Du<%q^33UgeYF8#Zr4`_2XY`}T3yA2g}YT;Cm^d}V7rpW}z+hlLV*pLc9`wpOp#
zJL@=Oo}2latopqU^3nep4o&*c(3Jo0MEltvCqFXP-(r4by8qrK-NJ&2r>s_PYTUEq
zeEhUmNtQ1i<Ptv`|Kr;Ixc<%gA1?Ok_U&@QKlC43grC|vbM2!YJA17q9)w0`)Ze|S
zzBz#Xa{UKi{@dY?wjcAC{jvI?{xN;Q{|txXD@v|k{W8}nx?<5hW0{Ukx3^DOCF?Q8
zYLd}znUp4`hT{7lLh5faKeF%J6T7sg;z#Vmwcf`Jdd+ODV=sUCab|nLjF~;<np{tp
zI`s)QF@>KFZsHbY_#?Ap`;M)%va@HTZr{<{Q{?t4ba6sKXyXg_g$p<ul_wr$sO9|-
z{cY8cj~|#G>Hi43FJM}0?#{c*SMBM(%gfK6^UGawO4IhH+4kQdjKA!c{kvzs>HS;d
z<+m!5zn%LbzwBkyzKc9{Y8M|*3e3M>kfQYNuA}9RUZXihh7PiU{~4NsYb1YcU3~Cy
z{msYU`e%JU_}#~cw>VX7MdSW1dn@sl)p`Yim#e<mTwrzn&%m<jhxUhJ|Njgvm%mN?
zyEJLThn67Ll<k}Qy@l<Jlp~i-N-N8epQwD#-9L)q?C!t2?34d9+?;mrwaed$b}Ugp
z+T$b6*ngOm6}WfDl&YCa?^haq{mDOR&&Q(-HLM>Oe|zwE$v>;wb?1-H7g+zLp7-p8
zTV|cJxs{f$+O_b$(QmK!4)Urgk7ZXdYA}EC{>PcEef)Pqg<;^#&@X30qyH}a=5F!l
ziu|Dl`z7+-_HuRtHGG>d<=1Kd`0V^4CH#^}S$4^pOLwLodn{A9+A{Rc?iswRcNV$1
zGE}_pwd1HeS-;J{oxO9N$$91<e^X*7{^)kv<+`_Z<Dsor)C;x$GuS-6!}w|o<4@0z
z=l^lCKYq_&yFTIv@1xiL@-LfpcKNM2nYlva%}RR#pW53ee@QX?ng8+m;d;40`qxuG
zoIhgEQPF;I*Q=DjvjetPL|*@Wa!2Cji_^8Lr5GM%Fn=-s$GQ3Ae}>o}?!TRXL?8V0
zs<@x2V%IBM@qo?ge{bxX{B+xn&=)F^UW)d2CLUkLU~2zhWxR0ddC9sf|CB$}UVVGI
zqW;jeX}fY;cUttBPrIkxxrF<2waF>&Qf(pT@2(7W`2lQwQ<r4zdbcoh$%|dN|JJX%
zW6^i-+BLChnRmW~^g5>59SC55G5=uw57qN;RX^Ilxz*pj#^gUk^FG-c^SNuEu8-s|
z+2lXR;NP2NdQ%v`T?bX-^#}Xg<u@-sa$Yd=pW4T1+ds;?U(DOOVypMcNg9%CA7w@<
zW_7prUX`dhb7o1CbWZ^L!T$^&yeF;xom3%X%-}b7)vEstTk4K09)H6B)InDLk7)go
zU40vWhuwYg-S||_mbvVHTekJvYqf{X?T}l#%+l`gg#h*gbu2$7KEB^3^(IdBN9Cjc
z3<5vQV`KQYyu9wuZS|j_^xGV(s@19fg%0v-?3wEyte<E1;rmUK`hGisEg!$lFj%`f
zlWW?nroJ~HWE>5@#jC%{VE&qYuwHt9%KqEhhtm(6{hHroQ#WbdOB?HT(MoZLZdj&n
zn~`_wKg0Qm?F?0>3^kg+z3LCD)d<!us%Ss@pJDT{<*R>G9|`;5St{PPUd23Y`%%Yy
zwR>rQ-vpT}md_N~cGa3uhrwRZj^E_le(`_eR+0)k`j5;?)_if|&?_Um7Ac0m(SLW?
zC;Vr)#r<gd+rUTtl79?7WPFrwwQ-eQdi`5-eDq=7o{hJUv#d0q@#=IlM`3GDyTnNr
z27cck`u`bN$}g;OowxSm^GB-3wifNkG^yun=G|An>-(g2--G`hDV*=NfdArbUEyy5
ze|z^BT@SeZ$MlEkGLux_BbT(|UNIy;{VcQf>}h_7nBM{H2mUii*+1A2$8cfa)un%U
zKG-dNJp1F+*x-n}sVV$v9_;Uz%AI{Oi{X=eL;ZH~qyHIhsUQ5$u=V`m_g#}Ss#<sd
zG5pB3b=lV5rrW(XNAr>^!t-^dxf>jd&Ty4lF5sWE|G|titAA(wG3=RS9{uXozURNK
z9{guesMlhc|BtKTt@_*kkGv93ROd~V_$Hsw@}J?&u?D-9AJYE_Ek870^gl!T{MPw`
zHS8a~LoV4VWJ~d`TU#o(kjsC$x5>r!PvNJzRjkc(bZXA;{9cs7{CV@^@;9Zwo$AiN
zEiQiipMl{O@53D@|1)&noBeO*a)W=LeVV^VzES14cZKn@i@3Pi<imxzCfBYD?wDjL
z*tI2x&skHJ<EsecZ|naIED!!}->3O1Ud+b!gZ88C-KGB0KjI_$yld6o2TeY^>vFzw
z&x!7DZKqF4ugR6WuG?lfRm+@>;m^Z)*15*t*36R5__N!(zC$(H@sGx?X$*f_8R|ph
zxA?!6{qX!-+6R$&mLLCK`Lt)!>|Ar-tz6fmmLB8$^eD)Ifq&-Qj!?NJt2VGdSbuE(
z53ToanLl#e%iPbmc1wNpKKYteTc`huTX3S<^vde3bsLZM*za|apS4fvqkX4M{OY?u
znvX_(+xjTB>cO+@yH2mXJD=IV^?0)Jk1s>k5A}!d`}V244*XGkKu++Ze9zWn2Y>6$
zPFFqBwf|m1!`t|<9L75r*x#wY+4)=Y$N6vNf9Ka{{%7cn7kiUyk}s2WkNxVF*RiH~
z$}?VGQ@Z4-Vr(Vm`^oC)r<K-WhLfjhEs&qT|AVjC&EHuy3Jm`lE`-!S)q7DN#qi=k
z!-JK(LeI_p9sgt3r_|K`fJ<L?pC~fi$-3(B@fCNO|7~Gx|7}=*(0QNnzq7mS=08~R
zc1wMSJnz~kW!;`v%-wZo?G`WHw#$E(LB!;?ND-le1(O}*x5=~AKUfmK+5T9^+bzB6
zN8~@O-V<!5oNIl=HL)qpMzrru-P40M3{NFDf6rh#f9(Dbb^AAGKkk$6P4@lp;YaqP
z?$*!YAs_CYP@36sB2%{@VS?P!siCv&>l*Al|IYc(@L>8rn;-hWy(+vP$?bo9pYuom
z!)L9=_ivrf+U#6gYj@0Jl6P6qMus!89TR^9EPgMvKz_nL1#A1P+MHiC4zvF=__;OM
z9sJMGwB^U=fRE~L&BdGLD(g4dm@m3@`!Ji|)mabgF6uPYSGG*hJf3m=QiBci1Nk?a
zzg_AsT#Ksjuu*>)VWQ6xV<`A~*O~iiTPCn+`FOWYOW@jYCgb!3N2Lb)_&V<Y3<s6>
zasRN0%9<~}$9Zi{*tO|A*9xay{_@neaI3^wHU46yws&(LHQ3$wXn$n=&E{`jAC6Ro
ztzGlS>WAmz;}Vl})sBhuJ$jHVJ?R{)(J4R6+~s#ZJIGIn-zNS?l;7jW$_M(QHOfEq
zALi!!UNp_{?OV9+RnJCm)s^;p`tIH2&K2UHvU^*Zm^5R;DaKFp{|GzA{%6RQZ?O)Y
z{q!oo?EXj5#SZeT{xf_C{?Bkz`l!9s7Jj~(=pX5e@BC;!F2%e1W_;$hm%APZUhb9@
zIk0&8B=t=GX_lo^w>_Pr%}{TC-E6yA@%ijhmTT7yE&Dv41g({3Zd${y(C_RZ(B$sL
z@GJbm{I`|A9cmaR-IH&hFJNl1$EJ7Zmgx6i_F6gKsh#K3@%io|jpNrE?Bo6k|7SRu
zWGA0BEBN-G^dGg4__?z$9EyJ{#drI3^l_QDf+tR@=-g${Rr<AK0sj$S{Ub&d+aKr6
zf3z|oI<iz><oF7ctRiKjdz@VT%iaXAU!DIU_;LSj=SPY5pI<Ne&+u{|7sFra56}OI
z3V$p8;r~JTVSM`@{e=~)kKWVY_~C8ee6!x%>~9t&KOZ(GXFT0GA@}wa6%%hYN0x>n
z4d%~}AG`k%dH-$tkCor{S|6Tub@?HEUeBq~wai6#jmqv<-JD+Vwf~gd6~>>h>sP#z
zTKo3e(v|n_zOw3hmoo3sBezMObH1jRolJh0!8Dhl?qvNz#eZzCXYD^SU+_=aRg>4<
z`COS|#+g;Qhu4X{`<J`OU*|uAK%efzz0Vw9H}JoxUdvGP{Nws>0YA8ZJ2-0onE2s8
zgU9}BU2prtx5jUJWtfmqzvOsZfwlI#_-`4^AJ0FY|3`@X_&)jHaT`BKAN{t^_Hww+
zF1HOQGwT*_TJl)H=ib{V|4bNvT0cJDcF*od>^kp<>pSN0f8=jAy?XMu*}|+3Te|E!
z&3UY<jGp=@JIMGll+EW8o&SixF;H~oxy>mIGLve)Ea2Z<|6uvg{|s&Ce#|N;{1&VJ
zpTYM-0Q>W=43>g-rv`c(TF5<Xu)FpHRQ3J-yWGx{+xxHefz1`_hm8{cGh|gv*xKW>
z{Kw*sm9re&ohDATzbCnX|2luue})g9{7v(C#CFX;y0$v%$L6(ql54}u<}cSSJw9Dp
za>>DWDO`6i&k10EmEUe-{_sBo`-`gdwi@k4FY9DKe4Udd?Jccc+QwZXe`w+gM)%<3
zYZ-FEgEWQr%zsorsPD9r`6vDHKSRqN+sCq8{(G}mMyY&UdCXiRp=`sO(@oY=41X5?
zc>14#rS(VQqq05M>ewna{eF0D)y>pPrE1k@E&EeFE9VKm^VxSGfc^CS&GY{V^FMyp
z{_*v}sPji-l^rhrlY3FM#A@x)H&RQ?m4iR22&otxYd>>%*8(-yevXK*j2`S4>^}tF
zzmfdt{;~YdUHV7QH(T-U@6OBH@}uN#yubK{XkU?y#w<I6tru+)Np)h*3zo1@?7P6P
z0uINjk8SI6P2>CK*=_tVw>xpZ=Y_Jnu@mpcJv}~Ix_;ND{wjvQc|Qz)%l$iV&)B;5
zdV`(Ji;op;3igi*SMYDkV%@#zyq-_xJ7tc2R~WyXU?`Efz;uDpK_0v;mGS>CYtX_2
zrvJZeGZ+{cnE(IsYyqvK{Qt`jv<iXs|8Ir||3To7#h(9vtTq1sF)sN3$MnhnKejXe
z|8bZAp`BI!|IxYe|BvB;|9`Y6{Qu+S^Z$?TivNFnCj9^7*YN+3UIG#FHvj(^7X1IC
zwc`IDk2U}Q=tlhi<1O(2kDtN+Ke`wG|B6-l|10y%|6g$;|9@pT{Qp(h^8Z(x%Ku;e
z5&wTp?D_v|O3MFV)296YH8te_uNeyee@%1v|7+%&|G)Yd{Qu>D<o~Z(CjWoUN%{Y4
zw#xrsb3gq5HAmq8ulY6qfAzok|7+rv|GyTn{QtGc<o~Y)U;h7EeBl4Dg%AG!TI%!v
z*93$Azb482|F!hW|6eOu{{LEb<o~ag6aN2NzTy9`)iVEo1z7z5wR*|_U#ma-|Furx
z|F1O<{{LFP=Krs?Xa4`%Xz~A7K*|4K8xQ>dwTb8duPrwJe{K5n|JT+N|9@?M@&DKM
zkpI5|HvIp!{m%biJ2d|P+GX<p*N#8`f9;;||JTkZ|9|Zj`Tr~6&HrC}r~Lo5_rd>P
z`#k>t+PC5Vul*ALf9-Gh|7-t?|Gy3d{Qq@e$Nygk75@J^*zy0@!4Lm`9g6t>>(GJ!
zzYc5s|8;o6|6hlH{Qq?%;s38A2mb#$s__5U(T4xOjz0MR>zKp;U&j{w|8<<<|F6?W
z{{K3o^8eSFmjA!bJo*3YtjqsjXP5l{b&lo#uX8E?e;rTw|Lfe5|G%Q4I8fvNufUZ5
zzXBKh{}p)W|F07k|9@R{`TuJ|#s6QIkNp32&FBBGYg7LJy7uP(uj?lNe-+;N|EtL2
z|F5DM|9=(z`2VXo;{UJW9shroNc{g*QuF^;$({edN^SoCDxLHHSLvVszsh3%|0+B2
z|5v%e|6k=x{{N~F`TwhJ&HrDOHvfNBrTqVOz32b08yo)rif8!$D?8%<ulN`Lf8|{H
z|0`k7|6eH$|9{=;`Tr~R&;MVy6aN1?Kj;6iAc_CKf+GI^3Oe%tSFpkVU%_+!{|e#w
z|0|^A|F4h-|9^%0{Qnht<NvP-C;tBmi~0ZS#G3!VF1+~vD{RjHUtu5q|LR!r|5wMC
z|GzpT{{QM+^8eQzkN>~!p7{Uk{(}F%9;N*MbtB>buUkC-f8AyI|Lfk7|G#1c{{Ko|
z@&DIDo&Ud{%=rJSCgcCFnhpPd)%^JXtJdNFuiB3PziKc1|5YdP|5shY|6g4k|9^Fr
z{QuSU;Qy~~pZ~wQcl`g=qw@b(&xHTKdj9<XRkz~*ulgPTe@#mH|7+5L|G&~U{Qs3+
z@&8w2%l}`!8UKGh^Z5U3GROa4lOz8Bn!M-#uV-KW|9U>-|F0K5|9?&4`Tr|%$^Tz@
z8vlPKE&2Z||H}VgFaG@h^)dnypD}0t|7NZD|C@Ek|KDsb|9`Vx`2U+d=KpW@7yo~A
zl>GnA$?*SIQ_TNgO;`T^YWDg6t9i%&Uo8^<f3=kS|JCy4|F717|Gy?0{QuRr<^QjK
zmjAz6FZ}-%Zu9?F_>}*@B1HcGipcr@E8-2ru1KB#zak6%|B62I|5xOe|G!?Y`2Xw8
zivPc&82<l?^7;QOYR3OxQBVH=iZ=NFE4t?YuTLfaf1MQh|HrcD{~zl=|Noe{{QqNi
z<^LbMDgXaCwm@j-9smF6;4eS^=yd%5V>sjgA8ncce>`jc|Iuyu|Hu2n|37{a|NrPo
z{3j@H74!d(&4vGeOeOyRF+cMEkNt%If1E-fw2ROGza=jJ|EBx}%@6+nTkZ4zZ*?e$
zjg0^QtycQ~*HRoL_Wy6S*8jidpt2Xlh2#H!tDO;QQa{1e{QsN!=KtTcXpqAHe^a0T
z|6Ab=Vk6`Kf2$4u|4p+6iT(duZTbJN%U%#08UO!VHTD1B+}$9t|9`6%{r{VL0LtF*
z|8MSWD0}b!zq#NgApieXo&NtfcNJ9p#{a*$8=&lG|NrKmg0jE-|C>7n%Kr2JuWu`a
zUCsReZ!UP@$^XBM{r~@JVha;)gnz3A5&o?fL-@B^7Mp*;Yu`ZxX!)K7h=Gb1ATN~@
z5D;L21E_=}7%*Z15Cu+Pz=Q>W<WVP|K^{iK==P%nEcSwg1V98MBO?}T!9oIHl8K4w
z|KIwW|9|UyK;ioTZ~gTDf9n_h|69NQ|KIvu|NqvX`~SE8HbkyB=KtT`%>RFT%b^&=
zuKxeGxAXts-kHUzMVW~?pmj_T4}>}fg@Abff6oH1`}qHRR>=R~v#0$3J^Ri7-?Og#
z|2<m=q!Oaf5X1yykUkLa|L<AgHR%6;&r10Jd-j6=zi0pW|9jSx|G#J3fE6+@FoM#^
z|DV+pKxyv(&zEOFY3%>cR~(=;_5bH9uzrwQPzL$`hrMSMkK`~=X8Hez63qVK{~t;)
z=ZF7)xEdg7kXzvYA7O_7e?)vBd{De_S^WRQbppZ%$xC1O|3_8^!k6=a&>(d@5&!>)
zR{a0N^W^^@-h%&s<mdeV!}|vzFCOs!kK~X4fB2^S|07WI|Bph$|35-02zihhBM&n$
zFvv47Fo0H$gJ?M@A4X${acD9zFmQoN4+bGd1}07hM$npD1_nk(CI&`MCP@ZHMg|84
zP8J3RMotC>26om)W(E$>njKI-2aLgbxu6TC9sd6f%mfR=h`)ueK;_aFh7C+-1sE7~
zG;}q!^yD;Q(*OTNas2-idFTJ1$SeQ<M85d{C-TStKT$0I|3p6d|0nXy|36U-|Nlfj
z`2Q#J$p1f)AO8PkZ(?9zU<Bd+KUy9B|7Gull-uAnL?Cg7|G#@}{{LnF3=!wx0WJE4
zsBhcw|1Sss|Gyl@|NruUoCR7R%J~1sB%c3&d71wI<yHOvS1_D`fdRB=iShrBX;=RL
z6^!}+SFr5=U!gh%1_sa~Eyn*pW@`NZE7bb`uh8`We?{Iv)ieD6F{k4HUy;xM|B4Fz
z|10W*5TAYG|6ftB|9?fZ|Nj-Yf||qd|Hr%y|Nn|R|NkqV{r|57XnhiBQwHPz9}DOF
z|0}`w|F49}|G!e8xC1RFWBmVP(S!egrPTiamGb=mS86G!?+NkO(hwx|s}bfezVQFA
z)aL(xrEdNI8+Mj~f#E+Ww*LQE8T0?I{L%k^<=_1Os|#BD2n~lV761RLY=(rJ$`M4k
zfyGb$|Eu!y|6jF0sQHZle{A*m|5q*a|6jF~|9`bWZ5_}eG{*lw4o>+0S8Ln<zgidn
z|J49(>4ds}zsdi<THpTv)fWB#R~uBnLBsi=$^XCFj{pB^$NvATaT(#S6FvX`YM=T4
zSNq}rzdA|?@golZ|LUmy|EpvA|E~^crxY~YjyL@Os}uhJuTJv+zZwq_>JJC}|EtsT
z|F6!B|9>@}K;wn+|BsU(@!kLb>fHJNSK}T+{J6{izd9cw;%P|Xf577ZUtQ_{e|5F~
z|J5%CE$f4X|Cx;cfAy>X|J9%H|F6koggI9f{{J<3@&B(W|Np<H(x5Q|i25r6|Nok*
z{Qqkj^8c?XC|yCr=L*aJzozX_@l6Qzmw){KYq|p>ZmtE7m!Fnr{{J=C`~TNG?EhbL
zWvDpA{~vcm{{J<f^Z&2;w*P-E^r7O6|9@QD@c*xc#s9w+A^-ncoB+86k{+%c`2W}9
z0wmtS?O<p;zN-2E*X7{<zb-F9Z4iWizZLxd>)ZMNukVcif9qdB&0+li<L{IIe*;<|
z=A?auiZlHGIiu(Q-?U#4oX(37pC0l5Z@Lf!rzs-DFSY#tn`{67Z*I*0zXeC(_Wt~n
z@c(bYssDcqZvFpTQv_Ad`2Uxw$^XB_7XSYi`@zeVQO0NpjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kin
zXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeD
zjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mk
zz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By
z2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1JhQMeDjE2By2#kinXb6mkz-S1J
zhQMeDjE2By2#kinC>RZa(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c
z4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C
z(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R
z7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7
zfzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!85Z
z5Eu=C(GVC7fzc2c4S~@R7zLvtFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF
z0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*
zAut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?
z8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*O
zqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0;3@?8Umvs
zFd71*Aut*OqaiRF0;3@?8UmvsFd71*Aut*OqaiRF0wXR2EEpIVYUH?=)iAL4)G#pj
z)G)BD0gFj7FRPJeUREQ;y{tx>ds&TC_p%!4?qxMLUCU~0x|i7~Fc>5#CNR_(zg|{j
z;<c<qv4O#%iNT@9_|>um#RiDDi1)G@QSW6nV&2PYB)pf^NO~`;k@8+vBjdfSM%H^-
zjhy$g8hP(!H3nYGY79VZ?qwDVj0`mf$;&Jhm>6mdK{PW%jS+}uVW=?%(X0$LCLo%P
zp~e(Mvoq9~foKkf8gmfM!%$-ZqPZAqEI~9ULyZ-P7G|ii1<@i5HFh9cfuY7ed0CCX
z?PWEBx0lrj-CkBBe0y1qz~f~#f{&Ng2t8g_Bm8(-jmYg~HKMnd)rj3*RwI6US&hi!
zWi_IYm(_?pURERi7!(eS35q`$YAhcwtFZv-d$r6);s5^x#s3U73>+3ULa&$EFfcG!
zG%zq)C@?tGsBi?-XfiLWVPRiV!@|F$hDCgdMGFI?6T|-x9t;ezHLT1P777gZAT<^Z
z3=9@a|Nm)WWnj@^U|?`;Vo+#NWngJ>Wncm8SK(h$;{w-z$Af`^)BA_M0XY6Zai_tw
ztj3CYnGXX)N{t57G7koZqaPTUCVXIEU}0cjw7<Z>G=YJEfro*CRl0$JX+i^(J%NE~
z!UQOL0Rz*71q=+lAT=8pm?mt1vJWsYO*jB$KVV=gV1Tk8GB6b=K-rHOm>2}$Y#{~%
zDEkQmlL7}L#NMY2OaTmF_psQ%XJ9IL4`#F4KVo1C*#80KPF8ycBv8Y_w5&#hd6{1W
ugTjc*tfL+t4S~@R7!85Z5Eu=C(GVC7fzc2c4S~@R7!3h3L%{q02NnRDlfRh&

literal 0
HcmV?d00001

diff --git a/roms/Makefile b/roms/Makefile
index 4c8793c5bd..f15189a540 100644
--- a/roms/Makefile
+++ b/roms/Makefile
@@ -144,9 +144,10 @@ u-boot.e500:
 		../pc-bios/u-boot.e500
 
 u-boot.sam460:
-	$(MAKE) -C u-boot-sam460ex Sam460ex_config
+	$(MAKE) -C u-boot-sam460ex Sam460_50_config
 	$(MAKE) -C u-boot-sam460ex CROSS_COMPILE=$(powerpc_cross_prefix)
-	cp u-boot-sam460ex/u-boot.bin ../pc-bios/u-boot-sam460-20100605.bin
+	cp u-boot-sam460ex/u-boot.bin ../pc-bios/u-boot-sam460.bin
+	chmod -x ../pc-bios/u-boot-sam460.bin
 
 skiboot:
 	$(MAKE) -C skiboot CROSS=$(powerpc64_cross_prefix)
diff --git a/roms/u-boot-sam460ex b/roms/u-boot-sam460ex
index 60b3916f33..1e5f4a1607 160000
--- a/roms/u-boot-sam460ex
+++ b/roms/u-boot-sam460ex
@@ -1 +1 @@
-Subproject commit 60b3916f33e617a815973c5a6df77055b2e3a588
+Subproject commit 1e5f4a1607cc6713d27ffe48dd9de84e69cfc1c2

From 14e4390a3210d13cfc340dc3289350bac59ea2e9 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 24 Oct 2025 08:57:25 +0200
Subject: [PATCH 1769/2396] target/ppc/cpu_init: Simplify the setup of the
 TLBxCFG SPR registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The next commit is going to remove init_proc_e200(), which is one of
the two calling sites of register_BookE206_sprs(). This causes recent
versions of GCC to inline the register_BookE206_sprs() function into
the other only remaining calling site, init_proc_e500(), which in
turn causes some false-positives compiler warnings:

 In file included from ../../devel/qemu/target/ppc/cpu_init.c:46:
 In function ‘register_BookE206_sprs’,
     inlined from ‘init_proc_e500’ at ../../devel/qemu/target/ppc/cpu_init.c:2910:5:
 ../../devel/qemu/target/ppc/cpu_init.c:897:29: error:
  array subscript 3 is outside array bounds of ‘uint32_t[2]’ {aka ‘unsigned int[2]’}
  [-Werror=array-bounds=]
   897 |                      tlbncfg[3]);
       |                      ~~~~~~~^~~
 ../../devel/qemu/target/ppc/spr_common.h:61:39: note: in definition of macro ‘spr_register_kvm_hv’
    61 |                   KVM_ARG(one_reg_id) initial_value)
       |                                       ^~~~~~~~~~~~~
 ../../devel/qemu/target/ppc/spr_common.h:77:5: note: in expansion of macro ‘spr_register_kvm’
    77 |     spr_register_kvm(env, num, name, uea_read, uea_write,                    \
       |     ^~~~~~~~~~~~~~~~
 ../../devel/qemu/target/ppc/cpu_init.c:894:9: note: in expansion of macro ‘spr_register’
   894 |         spr_register(env, SPR_BOOKE_TLB3CFG, "TLB3CFG",
       |         ^~~~~~~~~~~~
 ../../devel/qemu/target/ppc/cpu_init.c: In function ‘init_proc_e500’:
 ../../devel/qemu/target/ppc/cpu_init.c:2809:14: note: at offset 12 into object ‘tlbncfg’ of size 8
  2809 |     uint32_t tlbncfg[2];
       |              ^~~~~~~
 cc1: all warnings being treated as errors

init_proc_e500() only defines "uint32_t tlbncfg[2];", but it is OK since
it also sets "env->nb_ways = 2", so the code that GCC warns about in
register_BookE206_sprs() is never reached. Unfortunately, GCC is not smart
enough to see this, so it emits these warnings.

To fix it, let's simplify the code in register_BookE206_sprs() a little
bit to set up the SPRs in a loop, so we don't reference the tlbncfg[3]
entry directly anymore.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251024065726.738005-2-thuth@redhat.com
Message-ID: <20251024065726.738005-2-thuth@redhat.com>
---
 target/ppc/cpu_init.c | 38 ++++++++++++--------------------------
 1 file changed, 12 insertions(+), 26 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 3aa3aefc13..12c645699e 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -850,6 +850,13 @@ static void register_BookE206_sprs(CPUPPCState *env, uint32_t mas_mask,
         SPR_BOOKE_MAS0, SPR_BOOKE_MAS1, SPR_BOOKE_MAS2, SPR_BOOKE_MAS3,
         SPR_BOOKE_MAS4, SPR_BOOKE_MAS5, SPR_BOOKE_MAS6, SPR_BOOKE_MAS7,
     };
+    const char *tlbcfg_names[4] = {
+        "TLB0CFG", "TLB1CFG", "TLB2CFG", "TLB3CFG",
+    };
+    const int tlbcfg_sprn[4] = {
+        SPR_BOOKE_TLB0CFG, SPR_BOOKE_TLB1CFG,
+        SPR_BOOKE_TLB2CFG, SPR_BOOKE_TLB3CFG,
+    };
     int i;
 
     /* TLB assist registers */
@@ -889,34 +896,13 @@ static void register_BookE206_sprs(CPUPPCState *env, uint32_t mas_mask,
                  SPR_NOACCESS, SPR_NOACCESS,
                  &spr_read_generic, SPR_NOACCESS,
                  mmucfg);
-    switch (env->nb_ways) {
-    case 4:
-        spr_register(env, SPR_BOOKE_TLB3CFG, "TLB3CFG",
+
+    assert(env->nb_ways <= ARRAY_SIZE(tlbcfg_names));
+    for (i = 0; i < env->nb_ways; i++) {
+        spr_register(env, tlbcfg_sprn[i], tlbcfg_names[i],
                      SPR_NOACCESS, SPR_NOACCESS,
                      &spr_read_generic, SPR_NOACCESS,
-                     tlbncfg[3]);
-        /* Fallthru */
-    case 3:
-        spr_register(env, SPR_BOOKE_TLB2CFG, "TLB2CFG",
-                     SPR_NOACCESS, SPR_NOACCESS,
-                     &spr_read_generic, SPR_NOACCESS,
-                     tlbncfg[2]);
-        /* Fallthru */
-    case 2:
-        spr_register(env, SPR_BOOKE_TLB1CFG, "TLB1CFG",
-                     SPR_NOACCESS, SPR_NOACCESS,
-                     &spr_read_generic, SPR_NOACCESS,
-                     tlbncfg[1]);
-        /* Fallthru */
-    case 1:
-        spr_register(env, SPR_BOOKE_TLB0CFG, "TLB0CFG",
-                     SPR_NOACCESS, SPR_NOACCESS,
-                     &spr_read_generic, SPR_NOACCESS,
-                     tlbncfg[0]);
-        /* Fallthru */
-    case 0:
-    default:
-        break;
+                     tlbncfg[i]);
     }
 #endif
 }

From 984432c505e0695ca64d4327e0d0502b4a7757d2 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 24 Oct 2025 08:57:26 +0200
Subject: [PATCH 1770/2396] target/ppc: Remove the unusable e200 CPUs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is currently no machine in QEMU (except the "none" machine)
that can be run with with one of the e200 ppc CPUs - all machines
either complain about an invalid CPU type or crash QEMU immediately.

Looking at the history of this CPU type, it seems like it has never
been used in QEMU and only implemented as a placeholder (see e.g. the
comment about unimplemented instructions in the POWERPC_FAMILY(e200)
section of cpu_init.c). Being completely unused and unusable since
such a long time, let's just remove it now (without deprecation phase,
since there were no users of this dead code anyway).

Note: The init_excp_e200() is used by the e500 CPUs, too, so we
rename this function to init_excp_e500() instead of removing it.

Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251024065726.738005-3-thuth@redhat.com
Message-ID: <20251024065726.738005-3-thuth@redhat.com>
---
 target/ppc/cpu-models.c |   5 --
 target/ppc/cpu-models.h |   4 --
 target/ppc/cpu_init.c   | 147 +---------------------------------------
 3 files changed, 2 insertions(+), 154 deletions(-)

diff --git a/target/ppc/cpu-models.c b/target/ppc/cpu-models.c
index 89ae763c7f..26b6debcfc 100644
--- a/target/ppc/cpu-models.c
+++ b/target/ppc/cpu-models.c
@@ -244,11 +244,6 @@
                     CPU_POWERPC_MPC5200B_v20, POWERPC_SVR_5200B_v20, G2LE)
     POWERPC_DEF_SVR("mpc5200b_v21", "MPC5200B v2.1",
                     CPU_POWERPC_MPC5200B_v21, POWERPC_SVR_5200B_v21, G2LE)
-    /* e200 family                                                           */
-    POWERPC_DEF("e200z5",        CPU_POWERPC_e200z5,                 e200,
-                "PowerPC e200z5 core")
-    POWERPC_DEF("e200z6",        CPU_POWERPC_e200z6,                 e200,
-                "PowerPC e200z6 core")
     /* e300 family                                                           */
     POWERPC_DEF("e300c1",        CPU_POWERPC_e300c1,                 e300,
                 "PowerPC e300c1 core")
diff --git a/target/ppc/cpu-models.h b/target/ppc/cpu-models.h
index c6cd27f390..a439eb37ee 100644
--- a/target/ppc/cpu-models.h
+++ b/target/ppc/cpu-models.h
@@ -120,10 +120,6 @@ enum {
 #define CPU_POWERPC_MPC5200_v12      CPU_POWERPC_G2LEgp1
 #define CPU_POWERPC_MPC5200B_v20     CPU_POWERPC_G2LEgp1
 #define CPU_POWERPC_MPC5200B_v21     CPU_POWERPC_G2LEgp1
-    /* e200 family */
-    /* e200 cores */
-    CPU_POWERPC_e200z5             = 0x81000000,
-    CPU_POWERPC_e200z6             = 0x81120000,
     /* e300 family */
     /* e300 cores */
     CPU_POWERPC_e300c1             = 0x00830010,
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 12c645699e..86ead740ee 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -1811,7 +1811,7 @@ static void init_excp_G2(CPUPPCState *env)
 #endif
 }
 
-static void init_excp_e200(CPUPPCState *env, target_ulong ivpr_mask)
+static void init_excp_e500(CPUPPCState *env, target_ulong ivpr_mask)
 {
 #if !defined(CONFIG_USER_ONLY)
     env->excp_vectors[POWERPC_EXCP_RESET]    = 0x00000FFC;
@@ -2782,149 +2782,6 @@ POWERPC_FAMILY(G2LE)(ObjectClass *oc, const void *data)
                  POWERPC_FLAG_BE | POWERPC_FLAG_BUS_CLK;
 }
 
-static void init_proc_e200(CPUPPCState *env)
-{
-    register_BookE_sprs(env, 0x000000070000FFFFULL);
-
-    spr_register(env, SPR_BOOKE_SPEFSCR, "SPEFSCR",
-                 &spr_read_spefscr, &spr_write_spefscr,
-                 &spr_read_spefscr, &spr_write_spefscr,
-                 0x00000000);
-    /* Memory management */
-    register_BookE206_sprs(env, 0x0000005D, NULL, 0);
-    register_usprgh_sprs(env);
-
-    spr_register(env, SPR_HID0, "HID0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_HID1, "HID1",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_ALTCTXCR, "ALTCTXCR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_BUCSR, "BUCSR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_CTXCR, "CTXCR",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_DBCNT, "DBCNT",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_DBCR3, "DBCR3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_L1CFG0, "L1CFG0",
-                 &spr_read_generic, SPR_NOACCESS,
-                 &spr_read_generic, SPR_NOACCESS,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_L1CSR0, "L1CSR0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_Exxx_L1FINV0, "L1FINV0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_BOOKE_TLB0CFG, "TLB0CFG",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_BOOKE_TLB1CFG, "TLB1CFG",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_BOOKE_IAC3, "IAC3",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_BOOKE_IAC4, "IAC4",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000);
-
-    spr_register(env, SPR_MMUCSR0, "MMUCSR0",
-                 SPR_NOACCESS, SPR_NOACCESS,
-                 &spr_read_generic, &spr_write_generic,
-                 0x00000000); /* TOFIX */
-
-    init_tlbs_emb(env);
-    init_excp_e200(env, 0xFFFF0000UL);
-    env->dcache_line_size = 32;
-    env->icache_line_size = 32;
-    /* XXX: TODO: allocate internal IRQ controller */
-}
-
-POWERPC_FAMILY(e200)(ObjectClass *oc, const void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(oc);
-    PowerPCCPUClass *pcc = POWERPC_CPU_CLASS(oc);
-
-    dc->desc = "e200 core";
-    pcc->init_proc = init_proc_e200;
-    pcc->check_pow = check_pow_hid0;
-    pcc->check_attn = check_attn_none;
-    /*
-     * XXX: unimplemented instructions:
-     * dcblc
-     * dcbtlst
-     * dcbtstls
-     * icblc
-     * icbtls
-     * tlbivax
-     * all SPE multiply-accumulate instructions
-     */
-    pcc->insns_flags = PPC_INSNS_BASE | PPC_ISEL |
-                       PPC_SPE | PPC_SPE_SINGLE |
-                       PPC_WRTEE | PPC_RFDI |
-                       PPC_CACHE | PPC_CACHE_LOCK | PPC_CACHE_ICBI |
-                       PPC_CACHE_DCBZ | PPC_CACHE_DCBA |
-                       PPC_MEM_TLBSYNC | PPC_TLBIVAX |
-                       PPC_BOOKE;
-    pcc->msr_mask = (1ull << MSR_UCLE) |
-                    (1ull << MSR_SPE) |
-                    (1ull << MSR_POW) |
-                    (1ull << MSR_CE) |
-                    (1ull << MSR_EE) |
-                    (1ull << MSR_PR) |
-                    (1ull << MSR_FP) |
-                    (1ull << MSR_ME) |
-                    (1ull << MSR_FE0) |
-                    (1ull << MSR_DWE) |
-                    (1ull << MSR_DE) |
-                    (1ull << MSR_FE1) |
-                    (1ull << MSR_IR) |
-                    (1ull << MSR_DR);
-    pcc->mmu_model = POWERPC_MMU_BOOKE206;
-    pcc->excp_model = POWERPC_EXCP_BOOKE;
-    pcc->bus_model = PPC_FLAGS_INPUT_BookE;
-    pcc->bfd_mach = bfd_mach_ppc_860;
-    pcc->flags = POWERPC_FLAG_SPE | POWERPC_FLAG_CE |
-                 POWERPC_FLAG_UBLE | POWERPC_FLAG_DE |
-                 POWERPC_FLAG_BUS_CLK;
-}
-
 enum fsl_e500_version {
     fsl_e500v1,
     fsl_e500v2,
@@ -3159,7 +3016,7 @@ static void init_proc_e500(CPUPPCState *env, int version)
     }
 #endif
 
-    init_excp_e200(env, ivpr_mask);
+    init_excp_e500(env, ivpr_mask);
     /* Allocate hardware IRQ controller */
     ppce500_irq_init(env_archcpu(env));
 }

From 552e3299109915d160ab40ddb6690b9ff2c46e27 Mon Sep 17 00:00:00 2001
From: Yoges Vyas <yvyas1991@gmail.com>
Date: Sun, 26 Oct 2025 13:18:52 +0530
Subject: [PATCH 1771/2396] ppc/spapr: Cleanup MSI IRQ number handling

Now that spapr_irq_nr_msis() returns a constant value,
lets replace it with a macro.
Ref: https://lore.kernel.org/qemu-devel/bf149815-9782-4964-953d-73658b1043c9@linux.ibm.com/

Suggested-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Yogesh Vyas <yvyas1991@gmail.com>
Reviewed-by: Chinmay Rath <rathc@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251026074852.53691-1-yvyas1991@gmail.com
Message-ID: <20251026074852.53691-1-yvyas1991@gmail.com>
---
 hw/ppc/spapr_irq.c         | 7 +------
 hw/ppc/spapr_pci.c         | 2 +-
 include/hw/ppc/spapr_irq.h | 2 +-
 3 files changed, 3 insertions(+), 8 deletions(-)

diff --git a/hw/ppc/spapr_irq.c b/hw/ppc/spapr_irq.c
index 2ce323457b..fc45a5d5d6 100644
--- a/hw/ppc/spapr_irq.c
+++ b/hw/ppc/spapr_irq.c
@@ -33,7 +33,7 @@ static const TypeInfo spapr_intc_info = {
 
 static void spapr_irq_msi_init(SpaprMachineState *spapr)
 {
-    spapr->irq_map_nr = spapr_irq_nr_msis(spapr);
+    spapr->irq_map_nr = SPAPR_IRQ_NR_MSIS;
     spapr->irq_map = bitmap_new(spapr->irq_map_nr);
 }
 
@@ -277,11 +277,6 @@ void spapr_irq_dt(SpaprMachineState *spapr, uint32_t nr_servers,
     sicc->dt(spapr->active_intc, nr_servers, fdt, phandle);
 }
 
-uint32_t spapr_irq_nr_msis(SpaprMachineState *spapr)
-{
-    return SPAPR_NR_XIRQS + SPAPR_XIRQ_BASE - SPAPR_IRQ_MSI;
-}
-
 void spapr_irq_init(SpaprMachineState *spapr, Error **errp)
 {
     if (kvm_enabled() && kvm_kernel_irqchip_split()) {
diff --git a/hw/ppc/spapr_pci.c b/hw/ppc/spapr_pci.c
index bdec8f0728..d596a9e38e 100644
--- a/hw/ppc/spapr_pci.c
+++ b/hw/ppc/spapr_pci.c
@@ -2279,7 +2279,7 @@ int spapr_dt_phb(SpaprMachineState *spapr, SpaprPhbState *phb,
     _FDT(fdt_setprop(fdt, bus_off, "reg", &bus_reg, sizeof(bus_reg)));
     _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pci-config-space-type", 0x1));
     _FDT(fdt_setprop_cell(fdt, bus_off, "ibm,pe-total-#msi",
-                          spapr_irq_nr_msis(spapr)));
+                          SPAPR_IRQ_NR_MSIS));
 
     /* Dynamic DMA window */
     if (phb->ddw_enabled) {
diff --git a/include/hw/ppc/spapr_irq.h b/include/hw/ppc/spapr_irq.h
index 5ddd1107c3..265d43e06b 100644
--- a/include/hw/ppc/spapr_irq.h
+++ b/include/hw/ppc/spapr_irq.h
@@ -40,6 +40,7 @@
 #define SPAPR_IRQ_MSI        (SPAPR_XIRQ_BASE + 0x0300)
 
 #define SPAPR_NR_XIRQS       0x1000
+#define SPAPR_IRQ_NR_MSIS    (SPAPR_XIRQ_BASE + SPAPR_NR_XIRQS - SPAPR_IRQ_MSI)
 
 struct SpaprMachineState;
 
@@ -89,7 +90,6 @@ void spapr_irq_print_info(struct SpaprMachineState *spapr, GString *buf);
 void spapr_irq_dt(struct SpaprMachineState *spapr, uint32_t nr_servers,
                   void *fdt, uint32_t phandle);
 
-uint32_t spapr_irq_nr_msis(struct SpaprMachineState *spapr);
 int spapr_irq_msi_alloc(struct SpaprMachineState *spapr, uint32_t num, bool align,
                         Error **errp);
 void spapr_irq_msi_free(struct SpaprMachineState *spapr, int irq, uint32_t num);

From 4a0ebccf92463549f75b82ec106889268156171f Mon Sep 17 00:00:00 2001
From: Shivang Upadhyay <shivangu@linux.ibm.com>
Date: Tue, 28 Oct 2025 13:35:50 +0530
Subject: [PATCH 1772/2396] hw/ppc: Fix missing return on allocation failure

Fixes coverity (CID 1642026)

Cc: Aditya Gupta <adityag@linux.ibm.com>
Cc: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/CAFEAcA-SPmsnU1wzsWxBcFC=ZM_DDhPEg1N4iX9Q4bL1xOnwBg@mail.gmail.com/
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251028080551.92722-2-shivangu@linux.ibm.com
Message-ID: <20251028080551.92722-2-shivangu@linux.ibm.com>
---
 hw/ppc/spapr_fadump.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index fa3aeac94c..883a60cdcf 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -234,6 +234,7 @@ static bool do_preserve_region(FadumpSection *region)
         qemu_log_mask(LOG_GUEST_ERROR,
             "FADump: Failed allocating memory (size: %zu) for copying"
             " reserved memory regions\n", FADUMP_CHUNK_SIZE);
+        return false;
     }
 
     num_chunks = ceil((src_len * 1.0f) / FADUMP_CHUNK_SIZE);

From ec2b08c74d76ed9245e6c87820eddc8921feae81 Mon Sep 17 00:00:00 2001
From: Shivang Upadhyay <shivangu@linux.ibm.com>
Date: Tue, 28 Oct 2025 13:35:51 +0530
Subject: [PATCH 1773/2396] hw/ppc: Fix memory leak in get_cpu_state_data()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes coverity (CID 1642024)

Cc: Aditya Gupta <adityag@linux.ibm.com>
Cc: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/qemu-devel/CAFEAcA_Bm52bkPi9MH_uugXRR5fj48RtpbOnPNFQtbX=7Mz_yw@mail.gmail.com/
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Shivang Upadhyay <shivangu@linux.ibm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251028080551.92722-3-shivangu@linux.ibm.com
Message-ID: <20251028080551.92722-3-shivangu@linux.ibm.com>
---
 hw/ppc/spapr_fadump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/ppc/spapr_fadump.c b/hw/ppc/spapr_fadump.c
index 883a60cdcf..13cab0cfe1 100644
--- a/hw/ppc/spapr_fadump.c
+++ b/hw/ppc/spapr_fadump.c
@@ -453,7 +453,7 @@ static FadumpRegEntry *populate_cpu_reg_entries(CPUState *cpu,
 static void *get_cpu_state_data(uint64_t *cpu_state_len)
 {
     FadumpRegSaveAreaHeader reg_save_hdr;
-    FadumpRegEntry *reg_entries;
+    g_autofree FadumpRegEntry *reg_entries = NULL;
     FadumpRegEntry *curr_reg_entry;
     CPUState *cpu;
 

From bd7bf827bba4349110fc03b547ef47640f38d8d8 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 25 Oct 2025 01:31:13 +0200
Subject: [PATCH 1774/2396] hw/ppc/pegasos2: Add /chosen/stdin node with VOF

Some very old Linux kernels fail to start if /chosen/stdin is not
found so add it to the device tree when using VOF.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/642ef77674d08ba466e7a2beb4858ab1e67776ae.1761346145.git.balaton@eik.bme.hu
Message-ID: <642ef77674d08ba466e7a2beb4858ab1e67776ae.1761346145.git.balaton@eik.bme.hu>
---
 hw/ppc/pegasos2.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index 3c02c53c3a..3a498edd16 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -561,6 +561,7 @@ static void pegasos_machine_reset(MachineState *machine, ResetType type)
     qemu_fdt_setprop(fdt, "/chosen", "qemu,boot-kernel", d, sizeof(d));
 
     vof_build_dt(fdt, pm->vof);
+    vof_client_open_store(fdt, pm->vof, "/chosen", "stdin", "/failsafe");
     vof_client_open_store(fdt, pm->vof, "/chosen", "stdout", "/failsafe");
 
     /* Set machine->fdt for 'dumpdtb' QMP/HMP command */

From b943bb3ce928e29a5a80371cfb7e726996a947e0 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 25 Oct 2025 01:31:15 +0200
Subject: [PATCH 1775/2396] hw/ppc/pegasos2: Rename to pegasos
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that we also emulate pegasos1 it is not only about pegasos2 so
rename to a more generic name encompassing both.

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/275cd2d5074b76b4a504a01f658e85ed7994ea3e.1761346145.git.balaton@eik.bme.hu
Message-ID: <275cd2d5074b76b4a504a01f658e85ed7994ea3e.1761346145.git.balaton@eik.bme.hu>
---
 MAINTAINERS                             | 4 ++--
 configs/devices/ppc-softmmu/default.mak | 7 +++----
 hw/ppc/Kconfig                          | 2 +-
 hw/ppc/meson.build                      | 4 ++--
 hw/ppc/{pegasos2.c => pegasos.c}        | 0
 5 files changed, 8 insertions(+), 9 deletions(-)
 rename hw/ppc/{pegasos2.c => pegasos.c} (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 0a620ba87c..8063eefa2a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1648,11 +1648,11 @@ F: roms/u-boot-sam460ex
 F: docs/system/ppc/amigang.rst
 F: tests/functional/ppc/test_sam460ex.py
 
-pegasos2
+pegasos
 M: BALATON Zoltan <balaton@eik.bme.hu>
 L: qemu-ppc@nongnu.org
 S: Maintained
-F: hw/ppc/pegasos2.c
+F: hw/ppc/pegasos.c
 F: hw/pci-host/mv64361.c
 F: hw/pci-host/mv643xx.h
 F: include/hw/pci-host/mv64361.h
diff --git a/configs/devices/ppc-softmmu/default.mak b/configs/devices/ppc-softmmu/default.mak
index 460d15e676..180ae31e2d 100644
--- a/configs/devices/ppc-softmmu/default.mak
+++ b/configs/devices/ppc-softmmu/default.mak
@@ -13,15 +13,14 @@
 # CONFIG_PPC440=n
 # CONFIG_VIRTEX=n
 
-# For Sam460ex
+# AmigaNG
+# CONFIG_AMIGAONE=n
+# CONFIG_PEGASOS=n
 # CONFIG_SAM460EX=n
 
 # For Macs
 # CONFIG_MAC_OLDWORLD=n
 # CONFIG_MAC_NEWWORLD=n
 
-# CONFIG_AMIGAONE=n
-# CONFIG_PEGASOS2=n
-
 # For PReP
 # CONFIG_PREP=n
diff --git a/hw/ppc/Kconfig b/hw/ppc/Kconfig
index 7091d72fd8..347dcce690 100644
--- a/hw/ppc/Kconfig
+++ b/hw/ppc/Kconfig
@@ -92,7 +92,7 @@ config AMIGAONE
     select VT82C686
     select SMBUS_EEPROM
 
-config PEGASOS2
+config PEGASOS
     bool
     default y
     depends on PPC
diff --git a/hw/ppc/meson.build b/hw/ppc/meson.build
index 6b7c1f4f49..f7dac87a2a 100644
--- a/hw/ppc/meson.build
+++ b/hw/ppc/meson.build
@@ -87,8 +87,8 @@ ppc_ss.add(when: 'CONFIG_E500', if_true: files(
 ppc_ss.add(when: 'CONFIG_VIRTEX', if_true: files('virtex_ml507.c'))
 # AmigaOne
 ppc_ss.add(when: 'CONFIG_AMIGAONE', if_true: files('amigaone.c'))
-# Pegasos2
-ppc_ss.add(when: 'CONFIG_PEGASOS2', if_true: files('pegasos2.c'))
+# Pegasos
+ppc_ss.add(when: 'CONFIG_PEGASOS', if_true: files('pegasos.c'))
 
 ppc_ss.add(when: 'CONFIG_VOF', if_true: files('vof.c'))
 ppc_ss.add(when: ['CONFIG_VOF', 'CONFIG_PSERIES'], if_true: files('spapr_vof.c'))
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos.c
similarity index 100%
rename from hw/ppc/pegasos2.c
rename to hw/ppc/pegasos.c

From 5795c7650e4b149e19020f95cc4892bf7b2beef6 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 25 Oct 2025 01:31:16 +0200
Subject: [PATCH 1776/2396] hw/ppc/pegasos: Update documentation for pegasos1
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/f86b90f6839a0cf9426c0d89e95e6ca33704728c.1761346145.git.balaton@eik.bme.hu
Message-ID: <f86b90f6839a0cf9426c0d89e95e6ca33704728c.1761346145.git.balaton@eik.bme.hu>
---
 docs/system/ppc/amigang.rst | 29 +++++++++++++++++------------
 1 file changed, 17 insertions(+), 12 deletions(-)

diff --git a/docs/system/ppc/amigang.rst b/docs/system/ppc/amigang.rst
index 21bb14ed09..e290412369 100644
--- a/docs/system/ppc/amigang.rst
+++ b/docs/system/ppc/amigang.rst
@@ -1,6 +1,6 @@
-=========================================================
-AmigaNG boards (``amigaone``, ``pegasos2``, ``sam460ex``)
-=========================================================
+=======================================================================
+AmigaNG boards (``amigaone``, ``pegasos1``, ``pegasos2``, ``sam460ex``)
+=======================================================================
 
 These PowerPC machines emulate boards that are primarily used for
 running Amiga like OSes (AmigaOS 4, MorphOS and AROS) but these can
@@ -64,18 +64,23 @@ eventually it boots and the installer becomes visible. The ``ati-vga`` RV100
 emulation is not complete yet so only frame buffer works, DRM and 3D is not
 available.
 
-Genesi/bPlan Pegasos II (``pegasos2``)
-======================================
+Genesi/bPlan Pegasos (``pegasos1``, ``pegasos2``)
+=================================================
 
-The ``pegasos2`` machine emulates the Pegasos II sold by Genesi and
-designed by bPlan. Its schematics are available at
-https://www.powerdeveloper.org/platforms/pegasos/schematics.
+The ``pegasos1`` machine emulates the original Pegasos (later marked I) sold by
+Genesi and designed by bPlan. It uses the same Articia S north bridge as the
+``amigaone`` machine, otherwise it is mostly the same as the later Pegasos II.
+
+The ``pegasos2`` machine emulates the Pegasos II which is a redesigned version
+of Pegasos I to fix problems with its north bridge. Its schematics are available
+at https://www.powerdeveloper.org/platforms/pegasos/schematics.
 
 Emulated devices
 ----------------
 
  * PowerPC 7457 CPU (can also use ``-cpu g3`` or ``750cxe``)
- * Marvell MV64361 Discovery II north bridge
+ * Articia S north bridge (for ``pegasos1``)
+ * Marvell MV64361 Discovery II north bridge (for ``pegasos2``)
  * VIA VT8231 south bridge
  * PCI VGA compatible card (guests may need other card instead)
  * PS/2 keyboard and mouse
@@ -83,9 +88,9 @@ Emulated devices
 Firmware
 --------
 
-The Pegasos II board has an Open Firmware compliant ROM based on
+The Pegasos boards have an Open Firmware compliant ROM based on
 SmartFirmware with some changes that are not open-sourced therefore
-the ROM binary cannot be included in QEMU. An updater was available
+the ROM binary cannot be included in QEMU. A Pegasos II updater was available
 from bPlan, it can be found in the `Internet Archive
 <http://web.archive.org/web/20071021223056/http://www.bplan-gmbh.de/up050404/up050404>`_.
 The ROM image can be extracted from it with the following command:
@@ -111,7 +116,7 @@ At the firmware ``ok`` prompt enter ``boot cd install/pegasos``.
 
 Alternatively, it is possible to boot the kernel directly without
 firmware ROM using the QEMU built-in minimal Virtual Open Firmware
-(VOF) emulation which is also supported on ``pegasos2``. For this,
+(VOF) emulation which is also supported on ``pegasos1`` and ``pegasos2``. For this,
 extract the kernel ``install/powerpc/vmlinuz-chrp.initrd`` from the CD
 image, then run:
 

From 5c7b8a6d61a0af15d531f82eef8ddd97e40c1ce7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 15:16:29 +0400
Subject: [PATCH 1777/2396] hw/audio: look up the default bus from the device
 class
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Generalize and simplify the device model creation.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/soundhw.c | 20 ++++----------------
 1 file changed, 4 insertions(+), 16 deletions(-)

diff --git a/hw/audio/soundhw.c b/hw/audio/soundhw.c
index 63a6855635..29158c115c 100644
--- a/hw/audio/soundhw.c
+++ b/hw/audio/soundhw.c
@@ -22,6 +22,8 @@
  * THE SOFTWARE.
  */
 #include "qemu/osdep.h"
+#include "hw/qdev-core.h"
+#include "monitor/qdev.h"
 #include "qemu/option.h"
 #include "qemu/help_option.h"
 #include "qemu/error-report.h"
@@ -110,33 +112,19 @@ void select_soundhw(const char *name, const char *audiodev)
 void soundhw_init(void)
 {
     struct soundhw *c = selected;
-    ISABus *isa_bus = (ISABus *) object_resolve_path_type("", TYPE_ISA_BUS, NULL);
-    PCIBus *pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
-    BusState *bus;
 
     if (!c) {
         return;
     }
-    if (c->isa) {
-        if (!isa_bus) {
-            error_report("ISA bus not available for %s", c->name);
-            exit(1);
-        }
-        bus = BUS(isa_bus);
-    } else {
-        if (!pci_bus) {
-            error_report("PCI bus not available for %s", c->name);
-            exit(1);
-        }
-        bus = BUS(pci_bus);
-    }
 
     if (c->typename) {
         DeviceState *dev = qdev_new(c->typename);
+        BusState *bus = qdev_find_default_bus(DEVICE_GET_CLASS(dev), &error_fatal);
         qdev_prop_set_string(dev, "audiodev", audiodev_id);
         qdev_realize_and_unref(dev, bus, &error_fatal);
     } else {
         assert(!c->isa);
+        PCIBus *pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
         c->init_pci(pci_bus, audiodev_id);
     }
 }

From 07af152c760ee0e651c3d579fbc0dd474d87bd84 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 15:45:41 +0400
Subject: [PATCH 1778/2396] audio: rename audio_define->audio_add_audiodev()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For readability.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 8 ++++----
 audio/audio.h | 4 ++--
 system/vl.c   | 6 +++---
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 89f091bc88..6197fa1788 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1712,7 +1712,7 @@ void audio_create_default_audiodevs(void)
             visit_type_Audiodev(v, NULL, &dev, &error_fatal);
             visit_free(v);
 
-            audio_define_default(dev, &error_abort);
+            audio_add_default_audiodev(dev, &error_abort);
         }
     }
 }
@@ -2142,10 +2142,10 @@ void audio_parse_option(const char *opt)
     visit_type_Audiodev(v, NULL, &dev, &error_fatal);
     visit_free(v);
 
-    audio_define(dev);
+    audio_add_audiodev(dev);
 }
 
-void audio_define(Audiodev *dev)
+void audio_add_audiodev(Audiodev *dev)
 {
     AudiodevListEntry *e;
 
@@ -2156,7 +2156,7 @@ void audio_define(Audiodev *dev)
     QSIMPLEQ_INSERT_TAIL(&audiodevs, e, next);
 }
 
-void audio_define_default(Audiodev *dev, Error **errp)
+void audio_add_default_audiodev(Audiodev *dev, Error **errp)
 {
     AudiodevListEntry *e;
 
diff --git a/audio/audio.h b/audio/audio.h
index fcc22307be..eb5b5d662d 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -168,8 +168,8 @@ void audio_sample_to_uint64(const void *samples, int pos,
 void audio_sample_from_uint64(void *samples, int pos,
                             uint64_t left, uint64_t right);
 
-void audio_define(Audiodev *audio);
-void audio_define_default(Audiodev *dev, Error **errp);
+void audio_add_audiodev(Audiodev *audio);
+void audio_add_default_audiodev(Audiodev *dev, Error **errp);
 void audio_parse_option(const char *opt);
 void audio_create_default_audiodevs(void);
 void audio_init_audiodevs(void);
diff --git a/system/vl.c b/system/vl.c
index 17bbc092c8..4814ef11da 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -2265,7 +2265,7 @@ static void qemu_record_config_group(const char *group, QDict *dict,
         Audiodev *dev = NULL;
         Visitor *v = qobject_input_visitor_new_keyval(QOBJECT(dict));
         if (visit_type_Audiodev(v, NULL, &dev, errp)) {
-            audio_define(dev);
+            audio_add_audiodev(dev);
         }
         visit_free(v);
 
@@ -3087,11 +3087,11 @@ void qemu_init(int argc, char **argv)
                 visit_type_Audiodev(v, NULL, &dev, &error_fatal);
                 visit_free(v);
                 if (model) {
-                    audio_define(dev);
+                    audio_add_audiodev(dev);
                     select_soundhw(model, dev->id);
                     g_free(model);
                 } else {
-                    audio_define_default(dev, &error_fatal);
+                    audio_add_default_audiodev(dev, &error_fatal);
                 }
                 break;
             }

From 635af5706833e6c818ce5eb31fad4b0a826e7b32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 16:05:00 +0400
Subject: [PATCH 1779/2396] hw/audio: use better naming for -audio model
 handling code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All the functions are about "-audio model=" handling, a simpler
way to setup audio. Rename functions/variables to reflect this better.

audio_register_model_with_cb() dropped "pci" from the name, since it
will be generalized next.

deprecated_register_soundhw() was actually not a function to be
removed since it's used for "-audio model=" aliasing.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/ac97.c                               |  5 +-
 hw/audio/adlib.c                              |  4 +-
 hw/audio/cs4231a.c                            |  4 +-
 hw/audio/es1370.c                             |  5 +-
 hw/audio/gus.c                                |  4 +-
 hw/audio/intel-hda.c                          |  4 +-
 hw/audio/meson.build                          |  2 +-
 hw/audio/{soundhw.c => model.c}               | 58 +++++++++----------
 hw/audio/pcspk.c                              |  2 +-
 hw/audio/sb16.c                               |  5 +-
 hw/audio/virtio-snd-pci.c                     |  4 +-
 include/hw/audio/model.h                      | 14 +++++
 include/hw/audio/soundhw.h                    | 13 -----
 .../codeconverter/test_regexps.py             |  2 +-
 system/vl.c                                   |  6 +-
 15 files changed, 65 insertions(+), 67 deletions(-)
 rename hw/audio/{soundhw.c => model.c} (68%)
 create mode 100644 include/hw/audio/model.h
 delete mode 100644 include/hw/audio/soundhw.h

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 828333b66a..9dee5bb143 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -18,7 +18,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/pci/pci_device.h"
 #include "hw/qdev-properties.h"
@@ -1362,8 +1362,7 @@ static const TypeInfo ac97_info = {
 static void ac97_register_types(void)
 {
     type_register_static(&ac97_info);
-    deprecated_register_soundhw("ac97", "Intel 82801AA AC97 Audio",
-                                0, TYPE_AC97);
+    audio_register_model("ac97", "Intel 82801AA AC97 Audio", 0, TYPE_AC97);
 }
 
 type_init(ac97_register_types)
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 772435f04c..d0b2817843 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
@@ -323,7 +323,7 @@ static const TypeInfo adlib_info = {
 static void adlib_register_types (void)
 {
     type_register_static (&adlib_info);
-    deprecated_register_soundhw("adlib", ADLIB_DESC, 1, TYPE_ADLIB);
+    audio_register_model("adlib", ADLIB_DESC, 1, TYPE_ADLIB);
 }
 
 type_init (adlib_register_types)
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 7931fcfec8..0979cf5f16 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -23,7 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
@@ -723,7 +723,7 @@ static const TypeInfo cs4231a_info = {
 static void cs4231a_register_types (void)
 {
     type_register_static (&cs4231a_info);
-    deprecated_register_soundhw("cs4231a", "CS4231A", 1, TYPE_CS4231A);
+    audio_register_model("cs4231a", "CS4231A", 1, TYPE_CS4231A);
 }
 
 type_init (cs4231a_register_types)
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 6b0da0746e..066b9906fa 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -26,7 +26,7 @@
 #define VERBOSE_ES1370 0
 
 #include "qemu/osdep.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/pci/pci_device.h"
 #include "migration/vmstate.h"
@@ -905,8 +905,7 @@ static const TypeInfo es1370_info = {
 static void es1370_register_types (void)
 {
     type_register_static (&es1370_info);
-    deprecated_register_soundhw("es1370", "ENSONIQ AudioPCI ES1370",
-                                0, TYPE_ES1370);
+    audio_register_model("es1370", "ENSONIQ AudioPCI ES1370", 0, TYPE_ES1370);
 }
 
 type_init (es1370_register_types)
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index 91d07e0f81..d5b1e62135 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
@@ -320,7 +320,7 @@ static const TypeInfo gus_info = {
 static void gus_register_types (void)
 {
     type_register_static (&gus_info);
-    deprecated_register_soundhw("gus", "Gravis Ultrasound GF1", 1, TYPE_GUS);
+    audio_register_model("gus", "Gravis Ultrasound GF1", 1, TYPE_GUS);
 }
 
 type_init (gus_register_types)
diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index b256c8ccea..6a0db0dd9e 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -26,7 +26,7 @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "intel-hda.h"
 #include "migration/vmstate.h"
 #include "intel-hda-defs.h"
@@ -1324,7 +1324,7 @@ static void intel_hda_register_types(void)
     type_register_static(&intel_hda_info_ich6);
     type_register_static(&intel_hda_info_ich9);
     type_register_static(&hda_codec_device_type_info);
-    pci_register_soundhw("hda", "Intel HD Audio", intel_hda_and_codec_init);
+    audio_register_model_with_cb("hda", "Intel HD Audio", intel_hda_and_codec_init);
 }
 
 type_init(intel_hda_register_types)
diff --git a/hw/audio/meson.build b/hw/audio/meson.build
index 2990974449..2154cbdb57 100644
--- a/hw/audio/meson.build
+++ b/hw/audio/meson.build
@@ -1,4 +1,4 @@
-system_ss.add(files('soundhw.c'))
+system_ss.add(files('model.c'))
 system_ss.add(when: 'CONFIG_AC97', if_true: files('ac97.c'))
 system_ss.add(when: 'CONFIG_ADLIB', if_true: files('fmopl.c', 'adlib.c'))
 system_ss.add(when: 'CONFIG_ASC', if_true: files('asc.c'))
diff --git a/hw/audio/soundhw.c b/hw/audio/model.c
similarity index 68%
rename from hw/audio/soundhw.c
rename to hw/audio/model.c
index 29158c115c..ddfefea706 100644
--- a/hw/audio/soundhw.c
+++ b/hw/audio/model.c
@@ -32,9 +32,9 @@
 #include "hw/qdev-properties.h"
 #include "hw/isa/isa.h"
 #include "hw/pci/pci.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 
-struct soundhw {
+struct audio_model {
     const char *name;
     const char *descr;
     const char *typename;
@@ -42,38 +42,38 @@ struct soundhw {
     int (*init_pci) (PCIBus *bus, const char *audiodev);
 };
 
-static struct soundhw soundhw[9];
-static int soundhw_count;
+static struct audio_model audio_models[9];
+static int audio_models_count;
 
-void pci_register_soundhw(const char *name, const char *descr,
-                          int (*init_pci)(PCIBus *bus, const char *audiodev))
+void audio_register_model_with_cb(const char *name, const char *descr,
+                                  int (*init_pci)(PCIBus *bus, const char *audiodev))
 {
-    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
-    soundhw[soundhw_count].name = name;
-    soundhw[soundhw_count].descr = descr;
-    soundhw[soundhw_count].isa = 0;
-    soundhw[soundhw_count].init_pci = init_pci;
-    soundhw_count++;
+    assert(audio_models_count < ARRAY_SIZE(audio_models) - 1);
+    audio_models[audio_models_count].name = name;
+    audio_models[audio_models_count].descr = descr;
+    audio_models[audio_models_count].isa = 0;
+    audio_models[audio_models_count].init_pci = init_pci;
+    audio_models_count++;
 }
 
-void deprecated_register_soundhw(const char *name, const char *descr,
-                                 int isa, const char *typename)
+void audio_register_model(const char *name, const char *descr,
+                          int isa, const char *typename)
 {
-    assert(soundhw_count < ARRAY_SIZE(soundhw) - 1);
-    soundhw[soundhw_count].name = name;
-    soundhw[soundhw_count].descr = descr;
-    soundhw[soundhw_count].isa = isa;
-    soundhw[soundhw_count].typename = typename;
-    soundhw_count++;
+    assert(audio_models_count < ARRAY_SIZE(audio_models) - 1);
+    audio_models[audio_models_count].name = name;
+    audio_models[audio_models_count].descr = descr;
+    audio_models[audio_models_count].isa = isa;
+    audio_models[audio_models_count].typename = typename;
+    audio_models_count++;
 }
 
 void audio_print_available_models(void)
 {
-    struct soundhw *c;
+    struct audio_model *c;
 
-    if (soundhw_count) {
+    if (audio_models_count) {
         printf("Valid audio device model names:\n");
-        for (c = soundhw; c->name; ++c) {
+        for (c = audio_models; c->name; ++c) {
             printf("%-11s %s\n", c->name, c->descr);
         }
     } else {
@@ -82,19 +82,19 @@ void audio_print_available_models(void)
     }
 }
 
-static struct soundhw *selected = NULL;
+static struct audio_model *selected;
 static const char *audiodev_id;
 
-void select_soundhw(const char *name, const char *audiodev)
+void audio_set_model(const char *name, const char *audiodev)
 {
-    struct soundhw *c;
+    struct audio_model *c;
 
     if (selected) {
         error_report("only one -audio option is allowed");
         exit(1);
     }
 
-    for (c = soundhw; c->name; ++c) {
+    for (c = audio_models; c->name; ++c) {
         if (g_str_equal(c->name, name)) {
             selected = c;
             audiodev_id = audiodev;
@@ -109,9 +109,9 @@ void select_soundhw(const char *name, const char *audiodev)
     }
 }
 
-void soundhw_init(void)
+void audio_model_init(void)
 {
-    struct soundhw *c = selected;
+    struct audio_model *c = selected;
 
     if (!c) {
         return;
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index a719912872..48ef830292 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/isa/isa.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index 03c82f2777..5faa3f5fe3 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -23,7 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
@@ -1470,8 +1470,7 @@ static const TypeInfo sb16_info = {
 static void sb16_register_types (void)
 {
     type_register_static (&sb16_info);
-    deprecated_register_soundhw("sb16", "Creative Sound Blaster 16",
-                                1, TYPE_SB16);
+    audio_register_model("sb16", "Creative Sound Blaster 16", 1, TYPE_SB16);
 }
 
 type_init (sb16_register_types)
diff --git a/hw/audio/virtio-snd-pci.c b/hw/audio/virtio-snd-pci.c
index 9eb0007392..613538e46f 100644
--- a/hw/audio/virtio-snd-pci.c
+++ b/hw/audio/virtio-snd-pci.c
@@ -11,7 +11,7 @@
 #include "qemu/osdep.h"
 #include "qom/object.h"
 #include "qapi/error.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "hw/virtio/virtio-pci.h"
 #include "hw/audio/virtio-snd.h"
 
@@ -88,7 +88,7 @@ static int virtio_snd_pci_init(PCIBus *bus, const char *audiodev)
 static void virtio_snd_pci_register(void)
 {
     virtio_pci_types_register(&virtio_snd_pci_info);
-    pci_register_soundhw("virtio", "Virtio Sound", virtio_snd_pci_init);
+    audio_register_model_with_cb("virtio", "Virtio Sound", virtio_snd_pci_init);
 }
 
 type_init(virtio_snd_pci_register);
diff --git a/include/hw/audio/model.h b/include/hw/audio/model.h
new file mode 100644
index 0000000000..aa237e9eb6
--- /dev/null
+++ b/include/hw/audio/model.h
@@ -0,0 +1,14 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+#ifndef HW_AUDIO_MODEL_H
+#define HW_AUDIO_MODEL_H
+
+void audio_register_model_with_cb(const char *name, const char *descr,
+                                  int (*init_pci)(PCIBus *bus, const char *audiodev));
+void audio_register_model(const char *name, const char *descr,
+                          int isa, const char *typename);
+
+void audio_model_init(void);
+void audio_print_available_models(void);
+void audio_set_model(const char *name, const char *audiodev);
+
+#endif
diff --git a/include/hw/audio/soundhw.h b/include/hw/audio/soundhw.h
deleted file mode 100644
index 83b3011083..0000000000
--- a/include/hw/audio/soundhw.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef HW_SOUNDHW_H
-#define HW_SOUNDHW_H
-
-void pci_register_soundhw(const char *name, const char *descr,
-                          int (*init_pci)(PCIBus *bus, const char *audiodev));
-void deprecated_register_soundhw(const char *name, const char *descr,
-                                 int isa, const char *typename);
-
-void soundhw_init(void);
-void audio_print_available_models(void);
-void select_soundhw(const char *name, const char *audiodev);
-
-#endif
diff --git a/scripts/codeconverter/codeconverter/test_regexps.py b/scripts/codeconverter/codeconverter/test_regexps.py
index 4526268ae8..fe7354b473 100644
--- a/scripts/codeconverter/codeconverter/test_regexps.py
+++ b/scripts/codeconverter/codeconverter/test_regexps.py
@@ -264,7 +264,7 @@ def test_initial_includes():
 #define SILENT_ES1370
 
 #include "qemu/osdep.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "hw/pci/pci.h"
 #include "migration/vmstate.h"
diff --git a/system/vl.c b/system/vl.c
index 4814ef11da..dc2ea4c298 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -86,7 +86,7 @@
 #include "migration/snapshot.h"
 #include "system/tpm.h"
 #include "system/dma.h"
-#include "hw/audio/soundhw.h"
+#include "hw/audio/model.h"
 #include "audio/audio.h"
 #include "system/cpus.h"
 #include "system/cpu-timers.h"
@@ -2732,7 +2732,7 @@ static void qemu_create_cli_devices(void)
 {
     DeviceOption *opt;
 
-    soundhw_init();
+    audio_model_init();
 
     qemu_opts_foreach(qemu_find_opts("fw_cfg"),
                       parse_fw_cfg, fw_cfg_find(), &error_fatal);
@@ -3088,7 +3088,7 @@ void qemu_init(int argc, char **argv)
                 visit_free(v);
                 if (model) {
                     audio_add_audiodev(dev);
-                    select_soundhw(model, dev->id);
+                    audio_set_model(model, dev->id);
                     g_free(model);
                 } else {
                     audio_add_default_audiodev(dev, &error_fatal);

From 341eaea215a963016f814bdd11c45c68c9bf1e32 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 16:13:38 +0400
Subject: [PATCH 1780/2396] hw/audio/virtio-snd-pci: remove custom model
 callback
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

virtio-snd can rely on the default code to instantiate the device and
set the audiodev.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/virtio-snd-pci.c | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/hw/audio/virtio-snd-pci.c b/hw/audio/virtio-snd-pci.c
index 613538e46f..b78eaff851 100644
--- a/hw/audio/virtio-snd-pci.c
+++ b/hw/audio/virtio-snd-pci.c
@@ -71,24 +71,10 @@ static const VirtioPCIDeviceTypeInfo virtio_snd_pci_info = {
     .class_init    = virtio_snd_pci_class_init,
 };
 
-/* Create a Virtio Sound PCI device, so '-audio driver,model=virtio' works. */
-static int virtio_snd_pci_init(PCIBus *bus, const char *audiodev)
-{
-    DeviceState *vdev = NULL;
-    VirtIOSoundPCI *dev = NULL;
-
-    vdev = qdev_new(TYPE_VIRTIO_SND_PCI);
-    assert(vdev);
-    dev = VIRTIO_SND_PCI(vdev);
-    qdev_prop_set_string(DEVICE(&dev->vdev), "audiodev", audiodev);
-    qdev_realize_and_unref(vdev, BUS(bus), &error_fatal);
-    return 0;
-}
-
 static void virtio_snd_pci_register(void)
 {
     virtio_pci_types_register(&virtio_snd_pci_info);
-    audio_register_model_with_cb("virtio", "Virtio Sound", virtio_snd_pci_init);
+    audio_register_model("virtio", "Virtio Sound", 0, TYPE_VIRTIO_SND_PCI);
 }
 
 type_init(virtio_snd_pci_register);

From 96da2b29f4c65db17aa491b24f50eea93dc885d6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 8 Oct 2025 16:22:40 +0400
Subject: [PATCH 1781/2396] hw/audio: simplify 'hda' audio init code
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For consistency, use only qdev_device_add() to instantiate the devices.
We can't rely on automatic bus lookup for the "hda-duplex" device though
as it may end up on a different "intel-hda" bus...

This allows to make init() callback bus-agnostic next.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/intel-hda.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index 6a0db0dd9e..c46b195b62 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -21,16 +21,16 @@
 #include "hw/pci/pci.h"
 #include "hw/qdev-properties.h"
 #include "hw/pci/msi.h"
+#include "monitor/qdev.h"
 #include "qemu/timer.h"
 #include "qemu/bitops.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "qemu/error-report.h"
 #include "hw/audio/model.h"
 #include "intel-hda.h"
 #include "migration/vmstate.h"
 #include "intel-hda-defs.h"
-#include "system/dma.h"
+#include "qobject/qdict.h"
 #include "qapi/error.h"
 #include "qom/object.h"
 
@@ -1305,15 +1305,19 @@ static const TypeInfo hda_codec_device_type_info = {
  */
 static int intel_hda_and_codec_init(PCIBus *bus, const char *audiodev)
 {
-    DeviceState *controller;
+    g_autoptr(QDict) props = qdict_new();
+    DeviceState *intel_hda, *codec;
     BusState *hdabus;
-    DeviceState *codec;
 
-    controller = DEVICE(pci_create_simple(bus, -1, "intel-hda"));
-    hdabus = QLIST_FIRST(&controller->child_bus);
+    qdict_put_str(props, "driver", "intel-hda");
+    intel_hda = qdev_device_add_from_qdict(props, false, &error_fatal);
+    hdabus = QLIST_FIRST(&intel_hda->child_bus);
+
     codec = qdev_new("hda-duplex");
     qdev_prop_set_string(codec, "audiodev", audiodev);
     qdev_realize_and_unref(codec, hdabus, &error_fatal);
+    object_unref(intel_hda);
+
     return 0;
 }
 

From b181226e4e7ac4b5136d9ce0c0ace46e50416b8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 14:22:45 +0400
Subject: [PATCH 1782/2396] hw/audio: generalize audio_model.init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is no longer PCI bus only.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/intel-hda.c     |  4 +---
 hw/audio/model.c         | 12 ++++--------
 include/hw/audio/model.h |  2 +-
 3 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/hw/audio/intel-hda.c b/hw/audio/intel-hda.c
index c46b195b62..758e130c93 100644
--- a/hw/audio/intel-hda.c
+++ b/hw/audio/intel-hda.c
@@ -1303,7 +1303,7 @@ static const TypeInfo hda_codec_device_type_info = {
  * create intel hda controller with codec attached to it,
  * so '-soundhw hda' works.
  */
-static int intel_hda_and_codec_init(PCIBus *bus, const char *audiodev)
+static void intel_hda_and_codec_init(const char *audiodev)
 {
     g_autoptr(QDict) props = qdict_new();
     DeviceState *intel_hda, *codec;
@@ -1317,8 +1317,6 @@ static int intel_hda_and_codec_init(PCIBus *bus, const char *audiodev)
     qdev_prop_set_string(codec, "audiodev", audiodev);
     qdev_realize_and_unref(codec, hdabus, &error_fatal);
     object_unref(intel_hda);
-
-    return 0;
 }
 
 static void intel_hda_register_types(void)
diff --git a/hw/audio/model.c b/hw/audio/model.c
index ddfefea706..7af0d960f5 100644
--- a/hw/audio/model.c
+++ b/hw/audio/model.c
@@ -24,14 +24,11 @@
 #include "qemu/osdep.h"
 #include "hw/qdev-core.h"
 #include "monitor/qdev.h"
-#include "qemu/option.h"
-#include "qemu/help_option.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "qom/object.h"
 #include "hw/qdev-properties.h"
 #include "hw/isa/isa.h"
-#include "hw/pci/pci.h"
 #include "hw/audio/model.h"
 
 struct audio_model {
@@ -39,20 +36,20 @@ struct audio_model {
     const char *descr;
     const char *typename;
     int isa;
-    int (*init_pci) (PCIBus *bus, const char *audiodev);
+    void (*init)(const char *audiodev);
 };
 
 static struct audio_model audio_models[9];
 static int audio_models_count;
 
 void audio_register_model_with_cb(const char *name, const char *descr,
-                                  int (*init_pci)(PCIBus *bus, const char *audiodev))
+                                  void (*init_audio_model)(const char *audiodev))
 {
     assert(audio_models_count < ARRAY_SIZE(audio_models) - 1);
     audio_models[audio_models_count].name = name;
     audio_models[audio_models_count].descr = descr;
     audio_models[audio_models_count].isa = 0;
-    audio_models[audio_models_count].init_pci = init_pci;
+    audio_models[audio_models_count].init = init_audio_model;
     audio_models_count++;
 }
 
@@ -124,7 +121,6 @@ void audio_model_init(void)
         qdev_realize_and_unref(dev, bus, &error_fatal);
     } else {
         assert(!c->isa);
-        PCIBus *pci_bus = (PCIBus *) object_resolve_path_type("", TYPE_PCI_BUS, NULL);
-        c->init_pci(pci_bus, audiodev_id);
+        c->init(audiodev_id);
     }
 }
diff --git a/include/hw/audio/model.h b/include/hw/audio/model.h
index aa237e9eb6..4d0be93042 100644
--- a/include/hw/audio/model.h
+++ b/include/hw/audio/model.h
@@ -3,7 +3,7 @@
 #define HW_AUDIO_MODEL_H
 
 void audio_register_model_with_cb(const char *name, const char *descr,
-                                  int (*init_pci)(PCIBus *bus, const char *audiodev));
+                                  void (*init_audio_model)(const char *audiodev));
 void audio_register_model(const char *name, const char *descr,
                           int isa, const char *typename);
 

From 5fb347dea0367609f316d10a3ac69018ce00d128 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 27 Oct 2025 17:44:10 +0400
Subject: [PATCH 1783/2396] hw/audio: drop audio_model.isa
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

That's no longer necessary, the code is bus-agnostic.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/ac97.c           | 2 +-
 hw/audio/adlib.c          | 2 +-
 hw/audio/cs4231a.c        | 2 +-
 hw/audio/es1370.c         | 2 +-
 hw/audio/gus.c            | 2 +-
 hw/audio/model.c          | 8 +-------
 hw/audio/sb16.c           | 2 +-
 hw/audio/virtio-snd-pci.c | 2 +-
 include/hw/audio/model.h  | 2 +-
 9 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 9dee5bb143..6b9013ebb8 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1362,7 +1362,7 @@ static const TypeInfo ac97_info = {
 static void ac97_register_types(void)
 {
     type_register_static(&ac97_info);
-    audio_register_model("ac97", "Intel 82801AA AC97 Audio", 0, TYPE_AC97);
+    audio_register_model("ac97", "Intel 82801AA AC97 Audio", TYPE_AC97);
 }
 
 type_init(ac97_register_types)
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index d0b2817843..6aae365f47 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -323,7 +323,7 @@ static const TypeInfo adlib_info = {
 static void adlib_register_types (void)
 {
     type_register_static (&adlib_info);
-    audio_register_model("adlib", ADLIB_DESC, 1, TYPE_ADLIB);
+    audio_register_model("adlib", ADLIB_DESC, TYPE_ADLIB);
 }
 
 type_init (adlib_register_types)
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 0979cf5f16..3b80a61378 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -723,7 +723,7 @@ static const TypeInfo cs4231a_info = {
 static void cs4231a_register_types (void)
 {
     type_register_static (&cs4231a_info);
-    audio_register_model("cs4231a", "CS4231A", 1, TYPE_CS4231A);
+    audio_register_model("cs4231a", "CS4231A", TYPE_CS4231A);
 }
 
 type_init (cs4231a_register_types)
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 066b9906fa..721c02be0a 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -905,7 +905,7 @@ static const TypeInfo es1370_info = {
 static void es1370_register_types (void)
 {
     type_register_static (&es1370_info);
-    audio_register_model("es1370", "ENSONIQ AudioPCI ES1370", 0, TYPE_ES1370);
+    audio_register_model("es1370", "ENSONIQ AudioPCI ES1370", TYPE_ES1370);
 }
 
 type_init (es1370_register_types)
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index d5b1e62135..45ea04bf89 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -320,7 +320,7 @@ static const TypeInfo gus_info = {
 static void gus_register_types (void)
 {
     type_register_static (&gus_info);
-    audio_register_model("gus", "Gravis Ultrasound GF1", 1, TYPE_GUS);
+    audio_register_model("gus", "Gravis Ultrasound GF1", TYPE_GUS);
 }
 
 type_init (gus_register_types)
diff --git a/hw/audio/model.c b/hw/audio/model.c
index 7af0d960f5..40929c6e77 100644
--- a/hw/audio/model.c
+++ b/hw/audio/model.c
@@ -26,16 +26,13 @@
 #include "monitor/qdev.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
-#include "qom/object.h"
 #include "hw/qdev-properties.h"
-#include "hw/isa/isa.h"
 #include "hw/audio/model.h"
 
 struct audio_model {
     const char *name;
     const char *descr;
     const char *typename;
-    int isa;
     void (*init)(const char *audiodev);
 };
 
@@ -48,18 +45,16 @@ void audio_register_model_with_cb(const char *name, const char *descr,
     assert(audio_models_count < ARRAY_SIZE(audio_models) - 1);
     audio_models[audio_models_count].name = name;
     audio_models[audio_models_count].descr = descr;
-    audio_models[audio_models_count].isa = 0;
     audio_models[audio_models_count].init = init_audio_model;
     audio_models_count++;
 }
 
 void audio_register_model(const char *name, const char *descr,
-                          int isa, const char *typename)
+                          const char *typename)
 {
     assert(audio_models_count < ARRAY_SIZE(audio_models) - 1);
     audio_models[audio_models_count].name = name;
     audio_models[audio_models_count].descr = descr;
-    audio_models[audio_models_count].isa = isa;
     audio_models[audio_models_count].typename = typename;
     audio_models_count++;
 }
@@ -120,7 +115,6 @@ void audio_model_init(void)
         qdev_prop_set_string(dev, "audiodev", audiodev_id);
         qdev_realize_and_unref(dev, bus, &error_fatal);
     } else {
-        assert(!c->isa);
         c->init(audiodev_id);
     }
 }
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index 5faa3f5fe3..e86aafd488 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -1470,7 +1470,7 @@ static const TypeInfo sb16_info = {
 static void sb16_register_types (void)
 {
     type_register_static (&sb16_info);
-    audio_register_model("sb16", "Creative Sound Blaster 16", 1, TYPE_SB16);
+    audio_register_model("sb16", "Creative Sound Blaster 16", TYPE_SB16);
 }
 
 type_init (sb16_register_types)
diff --git a/hw/audio/virtio-snd-pci.c b/hw/audio/virtio-snd-pci.c
index b78eaff851..230581ed63 100644
--- a/hw/audio/virtio-snd-pci.c
+++ b/hw/audio/virtio-snd-pci.c
@@ -74,7 +74,7 @@ static const VirtioPCIDeviceTypeInfo virtio_snd_pci_info = {
 static void virtio_snd_pci_register(void)
 {
     virtio_pci_types_register(&virtio_snd_pci_info);
-    audio_register_model("virtio", "Virtio Sound", 0, TYPE_VIRTIO_SND_PCI);
+    audio_register_model("virtio", "Virtio Sound", TYPE_VIRTIO_SND_PCI);
 }
 
 type_init(virtio_snd_pci_register);
diff --git a/include/hw/audio/model.h b/include/hw/audio/model.h
index 4d0be93042..c38b359413 100644
--- a/include/hw/audio/model.h
+++ b/include/hw/audio/model.h
@@ -5,7 +5,7 @@
 void audio_register_model_with_cb(const char *name, const char *descr,
                                   void (*init_audio_model)(const char *audiodev));
 void audio_register_model(const char *name, const char *descr,
-                          int isa, const char *typename);
+                          const char *typename);
 
 void audio_model_init(void);
 void audio_print_available_models(void);

From f991647ed49737a082131ebb9602a116b57fa435 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 17:38:42 +0400
Subject: [PATCH 1784/2396] audio: start making AudioState a QOM Object
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QOM brings some conveniences for introspection, type checking, reference
counting, interfaces etc. This is only the first step to introduce QOM
in audio/ (I have more in the pipeline)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c     | 43 ++++++++++++++++++++++++++++++++-----------
 audio/audio.h     |  7 +++++++
 audio/audio_int.h |  2 ++
 3 files changed, 41 insertions(+), 11 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 6197fa1788..e1696403ae 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1617,8 +1617,19 @@ static void audio_vm_change_state_handler (void *opaque, bool running,
     audio_reset_timer (s);
 }
 
-static void free_audio_state(AudioState *s)
+static void audio_state_init(Object *obj)
 {
+    AudioState *s = AUDIO_STATE(obj);
+
+    QLIST_INIT(&s->hw_head_out);
+    QLIST_INIT(&s->hw_head_in);
+    QLIST_INIT(&s->cap_head);
+    s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
+}
+
+static void audio_state_finalize(Object *obj)
+{
+    AudioState *s = AUDIO_STATE(obj);
     HWVoiceOut *hwo, *hwon;
     HWVoiceIn *hwi, *hwin;
 
@@ -1663,8 +1674,6 @@ static void free_audio_state(AudioState *s)
         timer_free(s->ts);
         s->ts = NULL;
     }
-
-    g_free(s);
 }
 
 void audio_cleanup(void)
@@ -1673,7 +1682,7 @@ void audio_cleanup(void)
     while (!QTAILQ_EMPTY(&audio_states)) {
         AudioState *s = QTAILQ_FIRST(&audio_states);
         QTAILQ_REMOVE(&audio_states, s, list);
-        free_audio_state(s);
+        object_unref(s);
     }
 }
 
@@ -1732,18 +1741,13 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     AudioState *s;
     struct audio_driver *driver;
 
-    s = g_new0(AudioState, 1);
+    s = AUDIO_STATE(object_new(TYPE_AUDIO_STATE));
 
-    QLIST_INIT (&s->hw_head_out);
-    QLIST_INIT (&s->hw_head_in);
-    QLIST_INIT (&s->cap_head);
     if (!atexit_registered) {
         atexit(audio_cleanup);
         atexit_registered = true;
     }
 
-    s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
-
     if (dev) {
         /* -audiodev option */
         s->dev = dev;
@@ -1796,7 +1800,7 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     return s;
 
 out:
-    free_audio_state(s);
+    object_unref(s);
     return NULL;
 }
 
@@ -2320,3 +2324,20 @@ AudiodevList *qmp_query_audiodevs(Error **errp)
     }
     return ret;
 }
+
+static const TypeInfo audio_state_info = {
+    .name = TYPE_AUDIO_STATE,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(AudioState),
+    .instance_init = audio_state_init,
+    .instance_finalize = audio_state_finalize,
+    .abstract = false, /* TODO: subclass drivers and make it abstract */
+    .class_size = sizeof(AudioStateClass),
+};
+
+static void register_types(void)
+{
+    type_register_static(&audio_state_info);
+}
+
+type_init(register_types);
diff --git a/audio/audio.h b/audio/audio.h
index eb5b5d662d..e41c5bc55a 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -80,6 +80,10 @@ typedef struct SWVoiceOut SWVoiceOut;
 typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
 
+struct AudioStateClass {
+    ObjectClass parent_class;
+};
+
 typedef struct AudioState AudioState;
 typedef struct QEMUSoundCard {
     char *name;
@@ -182,4 +186,7 @@ const char *audio_get_id(QEMUSoundCard *card);
 #define DEFINE_AUDIO_PROPERTIES(_s, _f)         \
     DEFINE_PROP_AUDIODEV("audiodev", _s, _f)
 
+#define TYPE_AUDIO_STATE "audio-state"
+OBJECT_DECLARE_TYPE(AudioState, AudioStateClass, AUDIO_STATE)
+
 #endif /* QEMU_AUDIO_H */
diff --git a/audio/audio_int.h b/audio/audio_int.h
index f78ca05f92..b2b4d2d10e 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -217,6 +217,8 @@ struct SWVoiceCap {
 };
 
 typedef struct AudioState {
+    Object parent;
+
     struct audio_driver *drv;
     Audiodev *dev;
     void *drv_opaque;

From 6334967f6cb3993dc19883d2bdd314689d0a0c96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 17:45:48 +0400
Subject: [PATCH 1785/2396] audio: register backends in /audiodevs container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QOM tree now has /audiodevs objects.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 8 ++++++++
 qom/object.c  | 1 +
 2 files changed, 9 insertions(+)

diff --git a/audio/audio.c b/audio/audio.c
index e1696403ae..c291fd3e65 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1676,6 +1676,11 @@ static void audio_state_finalize(Object *obj)
     }
 }
 
+static Object *get_audiodevs_root(void)
+{
+    return object_get_container("audiodevs");
+}
+
 void audio_cleanup(void)
 {
     default_audio_state = NULL;
@@ -1742,6 +1747,9 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     struct audio_driver *driver;
 
     s = AUDIO_STATE(object_new(TYPE_AUDIO_STATE));
+    if (!object_property_try_add_child(get_audiodevs_root(), dev->id, OBJECT(s), errp)) {
+        goto out;
+    }
 
     if (!atexit_registered) {
         atexit(audio_cleanup);
diff --git a/qom/object.c b/qom/object.c
index 1856bb36c7..4f32c1aba7 100644
--- a/qom/object.c
+++ b/qom/object.c
@@ -1730,6 +1730,7 @@ const char *object_property_get_type(Object *obj, const char *name, Error **errp
 }
 
 static const char *const root_containers[] = {
+    "audiodevs",
     "chardevs",
     "objects",
     "backend"

From ef8105e3f90157ca627d2e8bc63540bbeb82e0b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 22:09:41 +0400
Subject: [PATCH 1786/2396] audio: use /audiodevs QOM container
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

audio_cleanup() is already called at exit (similar to chardev)

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c     | 38 +++++++++++++-------------------------
 audio/audio_int.h |  2 --
 2 files changed, 13 insertions(+), 27 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index c291fd3e65..5bf4307fbd 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -102,8 +102,6 @@ static audio_driver *audio_driver_lookup(const char *name)
     return NULL;
 }
 
-static QTAILQ_HEAD(AudioStateHead, AudioState) audio_states =
-    QTAILQ_HEAD_INITIALIZER(audio_states);
 static AudioState *default_audio_state;
 
 const struct mixeng_volume nominal_volume = {
@@ -1684,11 +1682,8 @@ static Object *get_audiodevs_root(void)
 void audio_cleanup(void)
 {
     default_audio_state = NULL;
-    while (!QTAILQ_EMPTY(&audio_states)) {
-        AudioState *s = QTAILQ_FIRST(&audio_states);
-        QTAILQ_REMOVE(&audio_states, s, list);
-        object_unref(s);
-    }
+
+    object_unparent(get_audiodevs_root());
 }
 
 static bool vmstate_audio_needed(void *opaque)
@@ -1739,7 +1734,6 @@ void audio_create_default_audiodevs(void)
  */
 static AudioState *audio_init(Audiodev *dev, Error **errp)
 {
-    static bool atexit_registered;
     int done = 0;
     const char *drvname;
     VMChangeStateEntry *vmse;
@@ -1747,14 +1741,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     struct audio_driver *driver;
 
     s = AUDIO_STATE(object_new(TYPE_AUDIO_STATE));
-    if (!object_property_try_add_child(get_audiodevs_root(), dev->id, OBJECT(s), errp)) {
-        goto out;
-    }
-
-    if (!atexit_registered) {
-        atexit(audio_cleanup);
-        atexit_registered = true;
-    }
 
     if (dev) {
         /* -audiodev option */
@@ -1802,7 +1788,10 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
                "(Audio can continue looping even after stopping the VM)\n");
     }
 
-    QTAILQ_INSERT_TAIL(&audio_states, s, list);
+    if (!object_property_try_add_child(get_audiodevs_root(), dev->id, OBJECT(s), errp)) {
+        goto out;
+    }
+    object_unref(s);
     QLIST_INIT (&s->card_head);
     vmstate_register_any(NULL, &vmstate_audio, s);
     return s;
@@ -2249,15 +2238,14 @@ int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
 
 AudioState *audio_state_by_name(const char *name, Error **errp)
 {
-    AudioState *s;
-    QTAILQ_FOREACH(s, &audio_states, list) {
-        assert(s->dev);
-        if (strcmp(name, s->dev->id) == 0) {
-            return s;
-        }
+    Object *obj = object_resolve_path_component(get_audiodevs_root(), name);
+
+    if (!obj) {
+        error_setg(errp, "audiodev '%s' not found", name);
+        return NULL;
+    } else {
+        return AUDIO_STATE(obj);
     }
-    error_setg(errp, "audiodev '%s' not found", name);
-    return NULL;
 }
 
 const char *audio_get_id(QEMUSoundCard *card)
diff --git a/audio/audio_int.h b/audio/audio_int.h
index b2b4d2d10e..4187a2dbfc 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -235,8 +235,6 @@ typedef struct AudioState {
 
     bool timer_running;
     uint64_t timer_last;
-
-    QTAILQ_ENTRY(AudioState) list;
 } AudioState;
 
 extern const struct mixeng_volume nominal_volume;

From bfe95b07d2731c33e73785e17d4199ae43c3d240 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 22:48:55 +0400
Subject: [PATCH 1787/2396] audio/paaudio: remove needless return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/paaudio.c | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/audio/paaudio.c b/audio/paaudio.c
index f3193b08c3..93030f3fc8 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -747,14 +747,13 @@ static void qpa_volume_in(HWVoiceIn *hw, Volume *vol)
     pa_threaded_mainloop_unlock(c->mainloop);
 }
 
-static int qpa_validate_per_direction_opts(Audiodev *dev,
-                                           AudiodevPaPerDirectionOptions *pdo)
+static void qpa_validate_per_direction_opts(Audiodev *dev,
+                                            AudiodevPaPerDirectionOptions *pdo)
 {
     if (!pdo->has_latency) {
         pdo->has_latency = true;
         pdo->latency = 46440;
     }
-    return 1;
 }
 
 /* common */
@@ -844,12 +843,8 @@ static void *qpa_audio_init(Audiodev *dev, Error **errp)
         }
     }
 
-    if (!qpa_validate_per_direction_opts(dev, popts->in)) {
-        return NULL;
-    }
-    if (!qpa_validate_per_direction_opts(dev, popts->out)) {
-        return NULL;
-    }
+    qpa_validate_per_direction_opts(dev, popts->in);
+    qpa_validate_per_direction_opts(dev, popts->out);
 
     g = g_new0(paaudio, 1);
     server = popts->server;

From a9e0a4340ea79fcef54651ed1442a4980bd9b686 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:18:41 +0400
Subject: [PATCH 1788/2396] audio/dsound: simplify init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use dsound_audio_fini() on error & fail if the capture failed to
initialize too.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/dsoundaudio.c | 29 +++++++++++------------------
 1 file changed, 11 insertions(+), 18 deletions(-)

diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index f3bb48d007..c8745a3df0 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -638,7 +638,7 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
     hr = CoInitialize (NULL);
     if (FAILED (hr)) {
         dsound_logerr (hr, "Could not initialize COM\n");
-        g_free(s);
+        dsound_audio_fini(s);
         return NULL;
     }
 
@@ -651,19 +651,14 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
         );
     if (FAILED (hr)) {
         dsound_logerr (hr, "Could not create DirectSound instance\n");
-        g_free(s);
+        dsound_audio_fini(s);
         return NULL;
     }
 
     hr = IDirectSound_Initialize (s->dsound, NULL);
     if (FAILED (hr)) {
         dsound_logerr (hr, "Could not initialize DirectSound\n");
-
-        hr = IDirectSound_Release (s->dsound);
-        if (FAILED (hr)) {
-            dsound_logerr (hr, "Could not release DirectSound\n");
-        }
-        g_free(s);
+        dsound_audio_fini(s);
         return NULL;
     }
 
@@ -676,17 +671,15 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
         );
     if (FAILED (hr)) {
         dsound_logerr (hr, "Could not create DirectSoundCapture instance\n");
-    } else {
-        hr = IDirectSoundCapture_Initialize (s->dsound_capture, NULL);
-        if (FAILED (hr)) {
-            dsound_logerr (hr, "Could not initialize DirectSoundCapture\n");
+        dsound_audio_fini(s);
+        return NULL;
+    }
 
-            hr = IDirectSoundCapture_Release (s->dsound_capture);
-            if (FAILED (hr)) {
-                dsound_logerr (hr, "Could not release DirectSoundCapture\n");
-            }
-            s->dsound_capture = NULL;
-        }
+    hr = IDirectSoundCapture_Initialize (s->dsound_capture, NULL);
+    if (FAILED(hr)) {
+        dsound_logerr(hr, "Could not initialize DirectSoundCapture\n");
+        dsound_audio_fini(s);
+        return NULL;
     }
 
     err = dsound_set_cooperative_level(s);

From 952742ec6b257e60337042e25deb42a3fd2a40f3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:36:05 +0400
Subject: [PATCH 1789/2396] audio/dsound: report init error via **errp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Whenever NULL is returned, errp should be set.

Inline SetCooperativeLevel call to simplify code.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/dsoundaudio.c | 182 +++++++++++++++++++-------------------------
 1 file changed, 79 insertions(+), 103 deletions(-)

diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index c8745a3df0..d476e9b441 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -33,6 +33,7 @@
 #include "audio_int.h"
 #include "qemu/host-utils.h"
 #include "qemu/module.h"
+#include "qapi/error.h"
 
 #include <windows.h>
 #include <mmsystem.h>
@@ -64,162 +65,154 @@ typedef struct {
     dsound *s;
 } DSoundVoiceIn;
 
-static void dsound_log_hresult (HRESULT hr)
+static const char *dserror(HRESULT hr)
 {
-    const char *str = "BUG";
-
     switch (hr) {
     case DS_OK:
-        str = "The method succeeded";
-        break;
+        return "The method succeeded";
 #ifdef DS_NO_VIRTUALIZATION
     case DS_NO_VIRTUALIZATION:
-        str = "The buffer was created, but another 3D algorithm was substituted";
-        break;
+        return "The buffer was created, but another 3D algorithm was substituted";
 #endif
 #ifdef DS_INCOMPLETE
     case DS_INCOMPLETE:
-        str = "The method succeeded, but not all the optional effects were obtained";
-        break;
+        return "The method succeeded, but not all the optional effects were obtained";
 #endif
 #ifdef DSERR_ACCESSDENIED
     case DSERR_ACCESSDENIED:
-        str = "The request failed because access was denied";
-        break;
+        return "The request failed because access was denied";
 #endif
 #ifdef DSERR_ALLOCATED
     case DSERR_ALLOCATED:
-        str = "The request failed because resources, "
-              "such as a priority level, were already in use "
-              "by another caller";
-        break;
+        return "The request failed because resources, "
+               "such as a priority level, were already in use "
+               "by another caller";
 #endif
 #ifdef DSERR_ALREADYINITIALIZED
     case DSERR_ALREADYINITIALIZED:
-        str = "The object is already initialized";
-        break;
+        return "The object is already initialized";
 #endif
 #ifdef DSERR_BADFORMAT
     case DSERR_BADFORMAT:
-        str = "The specified wave format is not supported";
-        break;
+        return "The specified wave format is not supported";
 #endif
 #ifdef DSERR_BADSENDBUFFERGUID
     case DSERR_BADSENDBUFFERGUID:
-        str = "The GUID specified in an audiopath file "
-              "does not match a valid mix-in buffer";
-        break;
+        return "The GUID specified in an audiopath file "
+               "does not match a valid mix-in buffer";
 #endif
 #ifdef DSERR_BUFFERLOST
     case DSERR_BUFFERLOST:
-        str = "The buffer memory has been lost and must be restored";
-        break;
+        return "The buffer memory has been lost and must be restored";
 #endif
 #ifdef DSERR_BUFFERTOOSMALL
     case DSERR_BUFFERTOOSMALL:
-        str = "The buffer size is not great enough to "
-              "enable effects processing";
-        break;
+        return "The buffer size is not great enough to "
+               "enable effects processing";
 #endif
 #ifdef DSERR_CONTROLUNAVAIL
     case DSERR_CONTROLUNAVAIL:
-        str = "The buffer control (volume, pan, and so on) "
-              "requested by the caller is not available. "
-              "Controls must be specified when the buffer is created, "
-              "using the dwFlags member of DSBUFFERDESC";
-        break;
+        return "The buffer control (volume, pan, and so on) "
+               "requested by the caller is not available. "
+               "Controls must be specified when the buffer is created, "
+               "using the dwFlags member of DSBUFFERDESC";
 #endif
 #ifdef DSERR_DS8_REQUIRED
     case DSERR_DS8_REQUIRED:
-        str = "A DirectSound object of class CLSID_DirectSound8 or later "
-              "is required for the requested functionality. "
-              "For more information, see IDirectSound8 Interface";
-        break;
+        return "A DirectSound object of class CLSID_DirectSound8 or later "
+               "is required for the requested functionality. "
+               "For more information, see IDirectSound8 Interface";
 #endif
 #ifdef DSERR_FXUNAVAILABLE
     case DSERR_FXUNAVAILABLE:
-        str = "The effects requested could not be found on the system, "
-              "or they are in the wrong order or in the wrong location; "
-              "for example, an effect expected in hardware "
-              "was found in software";
-        break;
+        return "The effects requested could not be found on the system, "
+               "or they are in the wrong order or in the wrong location; "
+               "for example, an effect expected in hardware "
+               "was found in software";
 #endif
 #ifdef DSERR_GENERIC
     case DSERR_GENERIC:
-        str = "An undetermined error occurred inside the DirectSound subsystem";
-        break;
+        return "An undetermined error occurred inside the DirectSound subsystem";
 #endif
 #ifdef DSERR_INVALIDCALL
     case DSERR_INVALIDCALL:
-        str = "This function is not valid for the current state of this object";
-        break;
+        return "This function is not valid for the current state of this object";
 #endif
 #ifdef DSERR_INVALIDPARAM
     case DSERR_INVALIDPARAM:
-        str = "An invalid parameter was passed to the returning function";
-        break;
+        return "An invalid parameter was passed to the returning function";
 #endif
 #ifdef DSERR_NOAGGREGATION
     case DSERR_NOAGGREGATION:
-        str = "The object does not support aggregation";
-        break;
+        return "The object does not support aggregation";
 #endif
 #ifdef DSERR_NODRIVER
     case DSERR_NODRIVER:
-        str = "No sound driver is available for use, "
-              "or the given GUID is not a valid DirectSound device ID";
-        break;
+        return "No sound driver is available for use, "
+               "or the given GUID is not a valid DirectSound device ID";
 #endif
 #ifdef DSERR_NOINTERFACE
     case DSERR_NOINTERFACE:
-        str = "The requested COM interface is not available";
-        break;
+        return "The requested COM interface is not available";
 #endif
 #ifdef DSERR_OBJECTNOTFOUND
     case DSERR_OBJECTNOTFOUND:
-        str = "The requested object was not found";
-        break;
+        return "The requested object was not found";
 #endif
 #ifdef DSERR_OTHERAPPHASPRIO
     case DSERR_OTHERAPPHASPRIO:
-        str = "Another application has a higher priority level, "
+        return "Another application has a higher priority level, "
               "preventing this call from succeeding";
-        break;
 #endif
 #ifdef DSERR_OUTOFMEMORY
     case DSERR_OUTOFMEMORY:
-        str = "The DirectSound subsystem could not allocate "
+        return "The DirectSound subsystem could not allocate "
                "sufficient memory to complete the caller's request";
-        break;
 #endif
 #ifdef DSERR_PRIOLEVELNEEDED
     case DSERR_PRIOLEVELNEEDED:
-        str = "A cooperative level of DSSCL_PRIORITY or higher is required";
-        break;
+        return "A cooperative level of DSSCL_PRIORITY or higher is required";
 #endif
 #ifdef DSERR_SENDLOOP
     case DSERR_SENDLOOP:
-        str = "A circular loop of send effects was detected";
-        break;
+        return "A circular loop of send effects was detected";
 #endif
 #ifdef DSERR_UNINITIALIZED
     case DSERR_UNINITIALIZED:
-        str = "The Initialize method has not been called "
-              "or has not been called successfully "
-              "before other methods were called";
-        break;
+        return "The Initialize method has not been called "
+               "or has not been called successfully "
+               "before other methods were called";
 #endif
 #ifdef DSERR_UNSUPPORTED
     case DSERR_UNSUPPORTED:
-        str = "The function called is not supported at this time";
-        break;
+        return "The function called is not supported at this time";
 #endif
     default:
-        AUD_log (AUDIO_CAP, "Reason: Unknown (HRESULT 0x%lx)\n", hr);
-        return;
+        return NULL;
     }
 
-    AUD_log (AUDIO_CAP, "Reason: %s\n", str);
+}
+
+static void dserror_set(Error **errp, HRESULT hr, const char *msg)
+{
+    const char *str = dserror(hr);
+
+    if (str) {
+        error_setg(errp, "%s: %s", msg, str);
+    } else {
+        error_setg(errp, "%s: Unknown (HRESULT: 0x%lx)", msg, hr);
+    }
+}
+
+static void dsound_log_hresult(HRESULT hr)
+{
+    const char *str = dserror(hr);
+
+    if (str) {
+        AUD_log (AUDIO_CAP, "Reason: %s\n", str);
+    } else {
+        AUD_log (AUDIO_CAP, "Reason: Unknown (HRESULT: 0x%lx)\n", hr);
+    }
 }
 
 static void G_GNUC_PRINTF (2, 3) dsound_logerr (
@@ -359,27 +352,6 @@ static void dsound_clear_sample (HWVoiceOut *hw, LPDIRECTSOUNDBUFFER dsb,
     dsound_unlock_out (dsb, p1, p2, blen1, blen2);
 }
 
-static int dsound_set_cooperative_level(dsound *s)
-{
-    HRESULT hr;
-    HWND hwnd;
-
-    hwnd = GetDesktopWindow();
-    hr = IDirectSound_SetCooperativeLevel (
-        s->dsound,
-        hwnd,
-        DSSCL_PRIORITY
-        );
-
-    if (FAILED (hr)) {
-        dsound_logerr (hr, "Could not set cooperative level for window %p\n",
-                       hwnd);
-        return -1;
-    }
-
-    return 0;
-}
-
 static void dsound_enable_out(HWVoiceOut *hw, bool enable)
 {
     HRESULT hr;
@@ -621,7 +593,6 @@ static void dsound_audio_fini (void *opaque)
 
 static void *dsound_audio_init(Audiodev *dev, Error **errp)
 {
-    int err;
     HRESULT hr;
     dsound *s = g_new0(dsound, 1);
     AudiodevDsoundOptions *dso;
@@ -637,7 +608,7 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
 
     hr = CoInitialize (NULL);
     if (FAILED (hr)) {
-        dsound_logerr (hr, "Could not initialize COM\n");
+        dserror_set(errp, hr, "Could not initialize COM");
         dsound_audio_fini(s);
         return NULL;
     }
@@ -650,14 +621,14 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
         (void **) &s->dsound
         );
     if (FAILED (hr)) {
-        dsound_logerr (hr, "Could not create DirectSound instance\n");
+        dserror_set(errp, hr, "Could not create DirectSound instance");
         dsound_audio_fini(s);
         return NULL;
     }
 
     hr = IDirectSound_Initialize (s->dsound, NULL);
     if (FAILED (hr)) {
-        dsound_logerr (hr, "Could not initialize DirectSound\n");
+        dserror_set(errp, hr, "Could not initialize DirectSound");
         dsound_audio_fini(s);
         return NULL;
     }
@@ -670,21 +641,26 @@ static void *dsound_audio_init(Audiodev *dev, Error **errp)
         (void **) &s->dsound_capture
         );
     if (FAILED (hr)) {
-        dsound_logerr (hr, "Could not create DirectSoundCapture instance\n");
+        dserror_set(errp, hr, "Could not create DirectSoundCapture instance");
         dsound_audio_fini(s);
         return NULL;
     }
 
     hr = IDirectSoundCapture_Initialize (s->dsound_capture, NULL);
     if (FAILED(hr)) {
-        dsound_logerr(hr, "Could not initialize DirectSoundCapture\n");
+        dserror_set(errp, hr, "Could not initialize DirectSoundCapture");
         dsound_audio_fini(s);
         return NULL;
     }
 
-    err = dsound_set_cooperative_level(s);
-    if (err) {
-        dsound_audio_fini (s);
+    hr = IDirectSound_SetCooperativeLevel (
+        s->dsound,
+        GetDesktopWindow(),
+        DSSCL_PRIORITY
+    );
+    if (FAILED(hr)) {
+        dserror_set(errp, hr, "Could not set cooperative level");
+        dsound_audio_fini(s);
         return NULL;
     }
 

From ebf3a6e856358ce515dda5a36ff05f8116a4341f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:38:45 +0400
Subject: [PATCH 1790/2396] audio: simplify audio_driver_init()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Catch and return from error early to avoid indentations and ease the
flow & return a bool for success value. All driver init() calls have
been checked to set errp on error.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 50 +++++++++++++++++++++-----------------------------
 1 file changed, 21 insertions(+), 29 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 5bf4307fbd..087e1946e7 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1562,35 +1562,27 @@ size_t audio_generic_read(HWVoiceIn *hw, void *buf, size_t size)
     return total;
 }
 
-static int audio_driver_init(AudioState *s, struct audio_driver *drv,
-                             Audiodev *dev, Error **errp)
+static bool audio_driver_init(AudioState *s, struct audio_driver *drv,
+                              Audiodev *dev, Error **errp)
 {
-    Error *local_err = NULL;
-
-    s->drv_opaque = drv->init(dev, &local_err);
-
-    if (s->drv_opaque) {
-        if (!drv->pcm_ops->get_buffer_in) {
-            drv->pcm_ops->get_buffer_in = audio_generic_get_buffer_in;
-            drv->pcm_ops->put_buffer_in = audio_generic_put_buffer_in;
-        }
-        if (!drv->pcm_ops->get_buffer_out) {
-            drv->pcm_ops->get_buffer_out = audio_generic_get_buffer_out;
-            drv->pcm_ops->put_buffer_out = audio_generic_put_buffer_out;
-        }
-
-        audio_init_nb_voices_out(s, drv, 1);
-        audio_init_nb_voices_in(s, drv, 0);
-        s->drv = drv;
-        return 0;
-    } else {
-        if (local_err) {
-            error_propagate(errp, local_err);
-        } else {
-            error_setg(errp, "Could not init `%s' audio driver", drv->name);
-        }
-        return -1;
+    s->drv_opaque = drv->init(dev, errp);
+    if (!s->drv_opaque) {
+        return false;
     }
+
+    if (!drv->pcm_ops->get_buffer_in) {
+        drv->pcm_ops->get_buffer_in = audio_generic_get_buffer_in;
+        drv->pcm_ops->put_buffer_in = audio_generic_put_buffer_in;
+    }
+    if (!drv->pcm_ops->get_buffer_out) {
+        drv->pcm_ops->get_buffer_out = audio_generic_get_buffer_out;
+        drv->pcm_ops->put_buffer_out = audio_generic_put_buffer_out;
+    }
+
+    audio_init_nb_voices_out(s, drv, 1);
+    audio_init_nb_voices_in(s, drv, 0);
+    s->drv = drv;
+    return true;
 }
 
 static void audio_vm_change_state_handler (void *opaque, bool running,
@@ -1748,7 +1740,7 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
         drvname = AudiodevDriver_str(dev->driver);
         driver = audio_driver_lookup(drvname);
         if (driver) {
-            done = !audio_driver_init(s, driver, dev, errp);
+            done = audio_driver_init(s, driver, dev, errp);
         } else {
             error_setg(errp, "Unknown audio driver `%s'", drvname);
         }
@@ -1768,7 +1760,7 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
             g_free(e);
             drvname = AudiodevDriver_str(dev->driver);
             driver = audio_driver_lookup(drvname);
-            if (!audio_driver_init(s, driver, dev, NULL)) {
+            if (audio_driver_init(s, driver, dev, NULL)) {
                 break;
             }
             qapi_free_Audiodev(dev);

From ee2964259a9635f90b23d5ebe8f88f45ffbf2d23 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:44:47 +0400
Subject: [PATCH 1791/2396] audio: move period tick initialization
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Part of QOM-ification.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 087e1946e7..43db7380f0 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1582,6 +1582,13 @@ static bool audio_driver_init(AudioState *s, struct audio_driver *drv,
     audio_init_nb_voices_out(s, drv, 1);
     audio_init_nb_voices_in(s, drv, 0);
     s->drv = drv;
+
+    if (dev->timer_period <= 0) {
+        s->period_ticks = 1;
+    } else {
+        s->period_ticks = dev->timer_period * (int64_t)SCALE_US;
+    }
+
     return true;
 }
 
@@ -1768,12 +1775,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
         }
     }
 
-    if (dev->timer_period <= 0) {
-        s->period_ticks = 1;
-    } else {
-        s->period_ticks = dev->timer_period * (int64_t)SCALE_US;
-    }
-
     vmse = qemu_add_vm_change_state_handler (audio_vm_change_state_handler, s);
     if (!vmse) {
         dolog ("warning: Could not register change state handler\n"

From 0eeb7b0554d65b81281fbc06418674a536cd9daf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:47:40 +0400
Subject: [PATCH 1792/2396] audio: drop needless error message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only reason it would fail to add the handler is if it's calling a
stub. But this cannot happen as audio is only supported with system qemu.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 43db7380f0..155809dee7 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1776,10 +1776,7 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     }
 
     vmse = qemu_add_vm_change_state_handler (audio_vm_change_state_handler, s);
-    if (!vmse) {
-        dolog ("warning: Could not register change state handler\n"
-               "(Audio can continue looping even after stopping the VM)\n");
-    }
+    assert(vmse != NULL);
 
     if (!object_property_try_add_child(get_audiodevs_root(), dev->id, OBJECT(s), errp)) {
         goto out;

From 7423b3aae67d3d089bef13bad678dbb60a3f432d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 13 Oct 2025 23:53:06 +0400
Subject: [PATCH 1793/2396] audio: keep vmstate handle with AudioState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QOM-ification continues.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c     | 12 ++++++++----
 audio/audio_int.h |  1 +
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 155809dee7..4c3c3fd52f 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1622,6 +1622,9 @@ static void audio_state_init(Object *obj)
     QLIST_INIT(&s->hw_head_in);
     QLIST_INIT(&s->cap_head);
     s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
+
+    s->vmse = qemu_add_vm_change_state_handler(audio_vm_change_state_handler, s);
+    assert(s->vmse != NULL);
 }
 
 static void audio_state_finalize(Object *obj)
@@ -1671,6 +1674,11 @@ static void audio_state_finalize(Object *obj)
         timer_free(s->ts);
         s->ts = NULL;
     }
+
+    if (s->vmse) {
+        qemu_del_vm_change_state_handler(s->vmse);
+        s->vmse = NULL;
+    }
 }
 
 static Object *get_audiodevs_root(void)
@@ -1735,7 +1743,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
 {
     int done = 0;
     const char *drvname;
-    VMChangeStateEntry *vmse;
     AudioState *s;
     struct audio_driver *driver;
 
@@ -1775,9 +1782,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
         }
     }
 
-    vmse = qemu_add_vm_change_state_handler (audio_vm_change_state_handler, s);
-    assert(vmse != NULL);
-
     if (!object_property_try_add_child(get_audiodevs_root(), dev->id, OBJECT(s), errp)) {
         goto out;
     }
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 4187a2dbfc..4a4d69f2bf 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -235,6 +235,7 @@ typedef struct AudioState {
 
     bool timer_running;
     uint64_t timer_last;
+    VMChangeStateEntry *vmse;
 } AudioState;
 
 extern const struct mixeng_volume nominal_volume;

From c38e65a881e00f1f828920a96cba86bf72c1ccba Mon Sep 17 00:00:00 2001
From: Fiona Ebner <f.ebner@proxmox.com>
Date: Tue, 16 Sep 2025 14:19:49 +0200
Subject: [PATCH 1794/2396] scripts/qemu-guest-agent/fsfreeze-hook: improve
 script description

With the current wording, users might think that the -F option is not
required as long as the script is placed in the default path. Be clear
that the option is always required. Also includes some minor language
improvements in the rest of the comment.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250916122111.36019-1-f.ebner@proxmox.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 scripts/qemu-guest-agent/fsfreeze-hook | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/scripts/qemu-guest-agent/fsfreeze-hook b/scripts/qemu-guest-agent/fsfreeze-hook
index c1feb6f5ce..5b915af017 100755
--- a/scripts/qemu-guest-agent/fsfreeze-hook
+++ b/scripts/qemu-guest-agent/fsfreeze-hook
@@ -1,11 +1,12 @@
 #!/bin/sh
 
-# This script is executed when a guest agent receives fsfreeze-freeze and
-# fsfreeze-thaw command, if it is specified in --fsfreeze-hook (-F)
-# option of qemu-ga or placed in default path (/etc/qemu/fsfreeze-hook).
-# When the agent receives fsfreeze-freeze request, this script is issued with
-# "freeze" argument before the filesystem is frozen. And for fsfreeze-thaw
-# request, it is issued with "thaw" argument after filesystem is thawed.
+# This script is executed when the guest agent receives fsfreeze-freeze and
+# fsfreeze-thaw commands, provided that the --fsfreeze-hook (-F) option of
+# qemu-ga is specified and the script is placed in /etc/qemu/fsfreeze-hook or in
+# the path specified together with -F. When the agent receives fsfreeze-freeze
+# requests, this script is called with "freeze" as its argument before the
+# filesystem is frozen. And for fsfreeze-thaw requests, it is called with "thaw"
+# as its argument after the filesystem is thawed.
 
 LOGFILE=/var/log/qga-fsfreeze-hook.log
 FSFREEZE_D=$(dirname -- "$0")/fsfreeze-hook.d

From c741c087b8fb926f9e9e9150456784238c2e039b Mon Sep 17 00:00:00 2001
From: "minglei.liu" <minglei.liu@smartx.com>
Date: Tue, 23 Sep 2025 19:32:43 +0800
Subject: [PATCH 1795/2396] qga: Improve Windows filesystem space info
 retrieval logic

Previously, disk space reporting only worked for volumes with drive letters,
skipping those without (e.g. System Reserved).

This change always calls GetDiskFreeSpaceEx with fs->name, which is a
volume GUID path. Windows APIs accept both drive letters (e.g. "C:\")
and volume GUIDs (e.g. "\\?\Volume{GUID}\") as valid lpDirectoryName
parameters, so space reporting is now consistent across all volumes.

Reference:
https://learn.microsoft.com/en-us/windows/win32/fileio/naming-a-file

Signed-off-by: minglei.liu <minglei.liu@smartx.com>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250923113243.78244-1-minglei.liu@smartx.com
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/commands-win32.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/qga/commands-win32.c b/qga/commands-win32.c
index 8227480810..acc2c11589 100644
--- a/qga/commands-win32.c
+++ b/qga/commands-win32.c
@@ -1164,15 +1164,15 @@ static GuestFilesystemInfo *build_guest_fsinfo(char *guid, Error **errp)
         fs->mountpoint = g_strdup("System Reserved");
     } else {
         fs->mountpoint = g_strndup(mnt_point, len);
-        if (GetDiskFreeSpaceEx(fs->mountpoint,
-                               (PULARGE_INTEGER) & i64FreeBytesToCaller,
-                               (PULARGE_INTEGER) & i64TotalBytes,
-                               (PULARGE_INTEGER) & i64FreeBytes)) {
-            fs->used_bytes = i64TotalBytes - i64FreeBytes;
-            fs->total_bytes = i64TotalBytes;
-            fs->has_total_bytes = true;
-            fs->has_used_bytes = true;
-        }
+    }
+    if (GetDiskFreeSpaceEx(fs->name,
+                            (PULARGE_INTEGER) & i64FreeBytesToCaller,
+                            (PULARGE_INTEGER) & i64TotalBytes,
+                            (PULARGE_INTEGER) & i64FreeBytes)) {
+        fs->used_bytes = i64TotalBytes - i64FreeBytes;
+        fs->total_bytes = i64TotalBytes;
+        fs->has_total_bytes = true;
+        fs->has_used_bytes = true;
     }
     wcstombs(fs_name, wfs_name, sizeof(wfs_name));
     fs->type = g_strdup(fs_name);

From c5b4afd4d56e9c2251e6674d8c9ae530a923ecb9 Mon Sep 17 00:00:00 2001
From: Rodrigo Dias Correa <r@drigo.nl>
Date: Fri, 26 Sep 2025 23:40:11 +0200
Subject: [PATCH 1796/2396] qga: Support guest shutdown of BusyBox-based
 systems

On POSIX systems, the QEMU Guest Agent uses /sbin/shutdown to implement
the command guest-shutdown. Systems based on BusyBox, such as Alpine
Linux, don't have /sbin/shutdown. They have instead three separate
commands: poweroff, reboot, and halt.

Change the QEMU Guest Agent to, depending on the mode argument, use
/sbin/{poweroff,halt,reboot} when they exist, falling back to
/sbin/shutdown when they don't.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2589

Signed-off-by: Rodrigo Dias Correa <r@drigo.nl>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20250926214015.120338-1-r@drigo.nl
Signed-off-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
---
 qga/commands-posix.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 5070f27d75..c7059857e4 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -213,9 +213,20 @@ out:
     return retcode;
 }
 
+static bool file_exists(const char *path)
+{
+    struct stat st;
+    return stat(path, &st) == 0 && (S_ISREG(st.st_mode) || S_ISLNK(st.st_mode));
+}
+
+#define POWEROFF_CMD_PATH "/sbin/poweroff"
+#define HALT_CMD_PATH "/sbin/halt"
+#define REBOOT_CMD_PATH "/sbin/reboot"
+
 void qmp_guest_shutdown(const char *mode, Error **errp)
 {
     const char *shutdown_flag;
+    const char *shutdown_cmd = NULL;
     Error *local_err = NULL;
 
 #ifdef CONFIG_SOLARIS
@@ -234,10 +245,19 @@ void qmp_guest_shutdown(const char *mode, Error **errp)
 
     slog("guest-shutdown called, mode: %s", mode);
     if (!mode || strcmp(mode, "powerdown") == 0) {
+        if (file_exists(POWEROFF_CMD_PATH)) {
+            shutdown_cmd = POWEROFF_CMD_PATH;
+        }
         shutdown_flag = powerdown_flag;
     } else if (strcmp(mode, "halt") == 0) {
+        if (file_exists(HALT_CMD_PATH)) {
+            shutdown_cmd = HALT_CMD_PATH;
+        }
         shutdown_flag = halt_flag;
     } else if (strcmp(mode, "reboot") == 0) {
+        if (file_exists(REBOOT_CMD_PATH)) {
+            shutdown_cmd = REBOOT_CMD_PATH;
+        }
         shutdown_flag = reboot_flag;
     } else {
         error_setg(errp,
@@ -255,6 +275,15 @@ void qmp_guest_shutdown(const char *mode, Error **errp)
 #endif
                           "hypervisor initiated shutdown", (char *) NULL};
 
+    /*
+     * If the specific command exists (poweroff, halt or reboot), use it instead
+     * of /sbin/shutdown.
+     */
+    if (shutdown_cmd != NULL) {
+        argv[0] = shutdown_cmd;
+        argv[1] = NULL;
+    }
+
     ga_run_command(argv, NULL, "shutdown", &local_err);
     if (local_err) {
         error_propagate(errp, local_err);

From 38c5ab40031966943b05e540a8a09c9bd1ce7543 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 22:48:32 +0100
Subject: [PATCH 1797/2396] hw/arm: Filter machine types for
 qemu-system-arm/aarch64 binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Register machines to be able to run with the qemu-system-arm
and qemu-system-aarch64 binaries, except few machines which
are only available on the qemu-system-aarch64 binary:

  $ git grep TARGET_AARCH64 hw/arm/meson.build
  hw/arm/meson.build:31:arm_common_ss.add(when: ['CONFIG_RASPI', 'TARGET_AARCH64'], if_true: files('bcm2838.c', 'raspi4b.c'))
  hw/arm/meson.build:50:arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files('aspeed_ast27x0.c'))

  $ git grep -W AARCH64 hw/arm/Kconfig
  hw/arm/Kconfig=185=config SBSA_REF
  hw/arm/Kconfig-186-    bool
  hw/arm/Kconfig-187-    default y
  hw/arm/Kconfig:188:    depends on TCG && AARCH64
  --
  hw/arm/Kconfig=413=config XLNX_ZYNQMP_ARM
  hw/arm/Kconfig-414-    bool
  hw/arm/Kconfig-415-    default y if PIXMAN
  hw/arm/Kconfig:416:    depends on TCG && AARCH64
  --
  hw/arm/Kconfig=435=config XLNX_VERSAL
  hw/arm/Kconfig-436-    bool
  hw/arm/Kconfig-437-    default y
  hw/arm/Kconfig:438:    depends on TCG && AARCH64
  --
  hw/arm/Kconfig=475=config NPCM8XX
  hw/arm/Kconfig-476-    bool
  hw/arm/Kconfig-477-    default y
  hw/arm/Kconfig:478:    depends on TCG && AARCH64
  --
  hw/arm/Kconfig=605=config FSL_IMX8MP_EVK
  hw/arm/Kconfig-606-    bool
  hw/arm/Kconfig-607-    default y
  hw/arm/Kconfig:608:    depends on TCG && AARCH64

  $ git grep -wW TARGET_AARCH64 hw/arm | fgrep -4 MACHINE_TYPE_NAME
  ...
  hw/arm/aspeed.c:1939:#ifdef TARGET_AARCH64
  hw/arm/aspeed.c-1940-    }, {
  hw/arm/aspeed.c-1941-        .name          = MACHINE_TYPE_NAME("ast2700a0-evb"),

  hw/arm/aspeed.c-1949-        .name          = MACHINE_TYPE_NAME("ast2700a1-evb"),

  hw/arm/raspi.c:420:#ifdef TARGET_AARCH64
  hw/arm/raspi.c-421-    }, {
  hw/arm/raspi.c-422-        .name           = MACHINE_TYPE_NAME("raspi3ap"),

  hw/arm/raspi.c-429-    }, {
  hw/arm/raspi.c-430-        .name           = MACHINE_TYPE_NAME("raspi3b"),

This can be verified as:

$ diff -u0 <(qemu-system-arm -M help) <(qemu-system-aarch64 -M help)
  @@ -1,0 +2,3 @@
  +xlnx-versal-virt     AMD Versal Virtual development board (alias of amd-versal-virt)
  +amd-versal-virt      AMD Versal Virtual development board
  +amd-versal2-virt     AMD Versal Gen 2 Virtual development board
  @@ -4,0 +8,5 @@
  +ast2700a0-evb        Aspeed AST2700 A0 EVB (Cortex-A35)
  +ast2700-evb          Aspeed AST2700 A1 EVB (Cortex-A35) (alias of ast2700a1-evb)
  +ast2700a1-evb        Aspeed AST2700 A1 EVB (Cortex-A35)
  +ast2700fc            ast2700 full core support (alias of ast2700fc)
  +ast2700fc            ast2700 full core support
  @@ -20,0 +29 @@
  +imx8mp-evk           NXP i.MX 8M Plus EVK Board
  @@ -47,0 +57 @@
  +npcm845-evb          Nuvoton NPCM845 Evaluation Board (Cortex-A35)
  @@ -60,0 +71,3 @@
  +raspi3ap             Raspberry Pi 3A+ (revision 1.0)
  +raspi3b              Raspberry Pi 3B (revision 1.2)
  +raspi4b              Raspberry Pi 4B (revision 1.5)
  @@ -66,0 +80 @@
  +sbsa-ref             QEMU 'SBSA Reference' ARM Virtual Machine
  @@ -99,0 +114 @@
  +xlnx-zcu102          Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5Fs based on the value of smp

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-5-philmd@linaro.org>
---
 hw/arm/aspeed.c            | 27 ++++++++++++++++++++++++++-
 hw/arm/aspeed_ast27x0-fc.c |  2 ++
 hw/arm/b-l475e-iot01a.c    |  2 ++
 hw/arm/bananapi_m2u.c      |  3 ++-
 hw/arm/collie.c            |  2 ++
 hw/arm/cubieboard.c        |  3 ++-
 hw/arm/digic_boards.c      |  3 ++-
 hw/arm/exynos4_boards.c    |  3 +++
 hw/arm/fby35.c             |  2 ++
 hw/arm/highbank.c          |  3 +++
 hw/arm/imx25_pdk.c         |  3 ++-
 hw/arm/imx8mp-evk.c        |  4 +++-
 hw/arm/integratorcp.c      |  3 ++-
 hw/arm/kzm.c               |  3 ++-
 hw/arm/mcimx6ul-evk.c      |  4 +++-
 hw/arm/mcimx7d-sabre.c     |  4 +++-
 hw/arm/microbit.c          |  2 ++
 hw/arm/mps2-tz.c           |  5 +++++
 hw/arm/mps2.c              |  5 +++++
 hw/arm/mps3r.c             |  2 ++
 hw/arm/msf2-som.c          |  3 ++-
 hw/arm/musca.c             |  3 +++
 hw/arm/musicpal.c          |  3 ++-
 hw/arm/netduino2.c         |  3 ++-
 hw/arm/netduinoplus2.c     |  3 ++-
 hw/arm/npcm7xx_boards.c    |  6 ++++++
 hw/arm/npcm8xx_boards.c    |  2 ++
 hw/arm/olimex-stm32-h405.c |  3 ++-
 hw/arm/omap_sx1.c          |  3 +++
 hw/arm/orangepi.c          |  3 ++-
 hw/arm/raspi.c             |  6 ++++++
 hw/arm/raspi4b.c           |  2 ++
 hw/arm/realview.c          |  5 +++++
 hw/arm/sabrelite.c         |  3 ++-
 hw/arm/sbsa-ref.c          |  2 ++
 hw/arm/stellaris.c         |  3 +++
 hw/arm/stm32vldiscovery.c  |  3 ++-
 hw/arm/versatilepb.c       |  3 +++
 hw/arm/vexpress.c          |  3 +++
 hw/arm/virt.c              |  2 ++
 hw/arm/xilinx_zynq.c       |  2 ++
 hw/arm/xlnx-versal-virt.c  |  3 +++
 hw/arm/xlnx-zcu102.c       |  2 ++
 43 files changed, 138 insertions(+), 18 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 1bc9e534ba..ecc7272e67 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -15,6 +15,7 @@
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/aspeed_eeprom.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_eeprom.h"
@@ -1967,99 +1968,123 @@ static const TypeInfo aspeed_machine_types[] = {
         .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_palmetto_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("supermicrox11-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("supermicro-x11spi-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_supermicro_x11spi_bmc_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2500-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2500_evb_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("romulus-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_romulus_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("sonorapass-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_sonorapass_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("witherspoon-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_witherspoon_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_yosemitev2_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_tiogapass_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("g220a-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_g220a_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_firework_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_fp5280g2_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("quanta-q71l-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_quanta_q71l_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("rainier-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_rainier_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("fuji-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_fuji_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("bletchley-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_bletchley_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_gb200nvl_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("catalina-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_catalina_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("fby35-bmc"),
         .parent        = MACHINE_TYPE_NAME("ast2600-evb"),
         .class_init    = aspeed_machine_fby35_class_init,
+        .interfaces    = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("ast1030-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
         .class_init     = aspeed_minibmc_machine_ast1030_evb_class_init,
+        .interfaces     = arm_machine_interfaces,
 #ifdef TARGET_AARCH64
     }, {
         .name          = MACHINE_TYPE_NAME("ast2700a0-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2700a0_evb_class_init,
-        }, {
+        .interfaces    = aarch64_machine_interfaces,
+    }, {
         .name          = MACHINE_TYPE_NAME("ast2700a1-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2700a1_evb_class_init,
+        .interfaces    = aarch64_machine_interfaces,
 #endif
     }, {
         .name          = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast27x0-fc.c b/hw/arm/aspeed_ast27x0-fc.c
index 580ac5f7a1..b96ef3f97a 100644
--- a/hw/arm/aspeed_ast27x0-fc.c
+++ b/hw/arm/aspeed_ast27x0-fc.c
@@ -22,6 +22,7 @@
 #include "hw/arm/boot.h"
 #include "hw/block/flash.h"
 #include "hw/arm/aspeed_coprocessor.h"
+#include "hw/arm/machines-qom.h"
 
 #define TYPE_AST2700A1FC MACHINE_TYPE_NAME("ast2700fc")
 OBJECT_DECLARE_SIMPLE_TYPE(Ast2700FCState, AST2700A1FC);
@@ -220,6 +221,7 @@ static const TypeInfo ast2700fc_types[] = {
         .parent         = TYPE_MACHINE,
         .class_init     = ast2700fc_class_init,
         .instance_size  = sizeof(Ast2700FCState),
+        .interfaces     = aarch64_machine_interfaces,
     },
 };
 
diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
index 34ed2e0851..f1fbc774e5 100644
--- a/hw/arm/b-l475e-iot01a.c
+++ b/hw/arm/b-l475e-iot01a.c
@@ -29,6 +29,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/boot.h"
 #include "hw/core/split-irq.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/arm/stm32l4x5_soc.h"
 #include "hw/gpio/stm32l4x5_gpio.h"
 #include "hw/display/dm163.h"
@@ -131,6 +132,7 @@ static const TypeInfo bl475e_machine_type[] = {
         .parent         = TYPE_MACHINE,
         .instance_size  = sizeof(Bl475eMachineState),
         .class_init     = bl475e_machine_init,
+        .interfaces     = arm_machine_interfaces,
     }
 };
 
diff --git a/hw/arm/bananapi_m2u.c b/hw/arm/bananapi_m2u.c
index b750a575f7..0f6d98684b 100644
--- a/hw/arm/bananapi_m2u.c
+++ b/hw/arm/bananapi_m2u.c
@@ -27,6 +27,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/allwinner-r40.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 static struct arm_boot_info bpim2u_binfo;
 
@@ -144,4 +145,4 @@ static void bpim2u_machine_init(MachineClass *mc)
     mc->auto_create_sdcard = true;
 }
 
-DEFINE_MACHINE("bpim2u", bpim2u_machine_init)
+DEFINE_MACHINE_ARM("bpim2u", bpim2u_machine_init)
diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index 93bb190f1f..5a80b7a223 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -15,6 +15,7 @@
 #include "hw/boards.h"
 #include "strongarm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "system/address-spaces.h"
 #include "qom/object.h"
@@ -86,6 +87,7 @@ static const TypeInfo collie_machine_typeinfo = {
     .parent = TYPE_MACHINE,
     .class_init = collie_machine_class_init,
     .instance_size = sizeof(CollieMachineState),
+    .interfaces = arm_machine_interfaces,
 };
 
 static void collie_machine_register_types(void)
diff --git a/hw/arm/cubieboard.c b/hw/arm/cubieboard.c
index d665d4edd9..aa51c0a703 100644
--- a/hw/arm/cubieboard.c
+++ b/hw/arm/cubieboard.c
@@ -22,6 +22,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/allwinner-a10.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/i2c/i2c.h"
 
 static struct arm_boot_info cubieboard_binfo = {
@@ -125,4 +126,4 @@ static void cubieboard_machine_init(MachineClass *mc)
     mc->auto_create_sdcard = true;
 }
 
-DEFINE_MACHINE("cubieboard", cubieboard_machine_init)
+DEFINE_MACHINE_ARM("cubieboard", cubieboard_machine_init)
diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index de56991bac..23b596d0c8 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -29,6 +29,7 @@
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "hw/arm/digic.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "hw/loader.h"
 #include "system/qtest.h"
@@ -145,4 +146,4 @@ static void canon_a1100_machine_init(MachineClass *mc)
     mc->default_ram_id = "ram";
 }
 
-DEFINE_MACHINE("canon-a1100", canon_a1100_machine_init)
+DEFINE_MACHINE_ARM("canon-a1100", canon_a1100_machine_init)
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index 7304974131..89f0e94463 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -28,6 +28,7 @@
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "system/address-spaces.h"
 #include "hw/arm/exynos4210.h"
 #include "hw/net/lan9118.h"
@@ -172,6 +173,7 @@ static const TypeInfo nuri_type = {
     .name = MACHINE_TYPE_NAME("nuri"),
     .parent = TYPE_MACHINE,
     .class_init = nuri_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void smdkc210_class_init(ObjectClass *oc, const void *data)
@@ -192,6 +194,7 @@ static const TypeInfo smdkc210_type = {
     .name = MACHINE_TYPE_NAME("smdkc210"),
     .parent = TYPE_MACHINE,
     .class_init = smdkc210_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void exynos4_machines_init(void)
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index 5a94c847d3..70d3a99d79 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -14,6 +14,7 @@
 #include "hw/qdev-clock.h"
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 #define TYPE_FBY35 MACHINE_TYPE_NAME("fby35")
 OBJECT_DECLARE_SIMPLE_TYPE(Fby35State, FBY35);
@@ -194,6 +195,7 @@ static const TypeInfo fby35_types[] = {
         .class_init = fby35_class_init,
         .instance_size = sizeof(Fby35State),
         .instance_init = fby35_instance_init,
+        .interfaces = arm_machine_interfaces,
     },
 };
 
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index ff987467a9..bd60ab2689 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -23,6 +23,7 @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/loader.h"
 #include "net/net.h"
 #include "system/runstate.h"
@@ -365,6 +366,7 @@ static const TypeInfo highbank_type = {
     .name = MACHINE_TYPE_NAME("highbank"),
     .parent = TYPE_MACHINE,
     .class_init = highbank_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void midway_class_init(ObjectClass *oc, const void *data)
@@ -390,6 +392,7 @@ static const TypeInfo midway_type = {
     .name = MACHINE_TYPE_NAME("midway"),
     .parent = TYPE_MACHINE,
     .class_init = midway_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void calxeda_machines_init(void)
diff --git a/hw/arm/imx25_pdk.c b/hw/arm/imx25_pdk.c
index e95ea5e4e1..71a4606203 100644
--- a/hw/arm/imx25_pdk.c
+++ b/hw/arm/imx25_pdk.c
@@ -28,6 +28,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/fsl-imx25.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "system/qtest.h"
@@ -150,4 +151,4 @@ static void imx25_pdk_machine_init(MachineClass *mc)
     mc->auto_create_sdcard = true;
 }
 
-DEFINE_MACHINE("imx25-pdk", imx25_pdk_machine_init)
+DEFINE_MACHINE_ARM("imx25-pdk", imx25_pdk_machine_init)
diff --git a/hw/arm/imx8mp-evk.c b/hw/arm/imx8mp-evk.c
index b3082fa60d..fc880a1d44 100644
--- a/hw/arm/imx8mp-evk.c
+++ b/hw/arm/imx8mp-evk.c
@@ -10,6 +10,7 @@
 #include "system/address-spaces.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/fsl-imx8mp.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "system/qtest.h"
@@ -100,4 +101,5 @@ static void imx8mp_evk_machine_init(MachineClass *mc)
     mc->max_cpus = FSL_IMX8MP_NUM_CPUS;
     mc->default_ram_id = "imx8mp-evk.ram";
 }
-DEFINE_MACHINE("imx8mp-evk", imx8mp_evk_machine_init)
+
+DEFINE_MACHINE_AARCH64("imx8mp-evk", imx8mp_evk_machine_init)
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index b1d8fbd470..031380aada 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -13,6 +13,7 @@
 #include "migration/vmstate.h"
 #include "hw/boards.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/misc/arm_integrator_debug.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
@@ -693,7 +694,7 @@ static void integratorcp_machine_init(MachineClass *mc)
     machine_add_audiodev_property(mc);
 }
 
-DEFINE_MACHINE("integratorcp", integratorcp_machine_init)
+DEFINE_MACHINE_ARM("integratorcp", integratorcp_machine_init)
 
 static const Property core_properties[] = {
     DEFINE_PROP_UINT32("memsz", IntegratorCMState, memsz, 0),
diff --git a/hw/arm/kzm.c b/hw/arm/kzm.c
index 362c145409..b446dc1547 100644
--- a/hw/arm/kzm.c
+++ b/hw/arm/kzm.c
@@ -17,6 +17,7 @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx31.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "system/address-spaces.h"
@@ -139,4 +140,4 @@ static void kzm_machine_init(MachineClass *mc)
     mc->default_ram_id = "kzm.ram";
 }
 
-DEFINE_MACHINE("kzm", kzm_machine_init)
+DEFINE_MACHINE_ARM("kzm", kzm_machine_init)
diff --git a/hw/arm/mcimx6ul-evk.c b/hw/arm/mcimx6ul-evk.c
index 86982cb077..f47a265650 100644
--- a/hw/arm/mcimx6ul-evk.c
+++ b/hw/arm/mcimx6ul-evk.c
@@ -14,6 +14,7 @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6ul.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
@@ -76,4 +77,5 @@ static void mcimx6ul_evk_machine_init(MachineClass *mc)
     mc->default_ram_id = "mcimx6ul-evk.ram";
     mc->auto_create_sdcard = true;
 }
-DEFINE_MACHINE("mcimx6ul-evk", mcimx6ul_evk_machine_init)
+
+DEFINE_MACHINE_ARM("mcimx6ul-evk", mcimx6ul_evk_machine_init)
diff --git a/hw/arm/mcimx7d-sabre.c b/hw/arm/mcimx7d-sabre.c
index 3311961011..fc8f35c581 100644
--- a/hw/arm/mcimx7d-sabre.c
+++ b/hw/arm/mcimx7d-sabre.c
@@ -16,6 +16,7 @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx7.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
@@ -76,4 +77,5 @@ static void mcimx7d_sabre_machine_init(MachineClass *mc)
     mc->default_ram_id = "mcimx7d-sabre.ram";
     mc->auto_create_sdcard = true;
 }
-DEFINE_MACHINE("mcimx7d-sabre", mcimx7d_sabre_machine_init)
+
+DEFINE_MACHINE_ARM("mcimx7d-sabre", mcimx7d_sabre_machine_init)
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index 525443fdb9..0f3161fd93 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -12,6 +12,7 @@
 #include "qapi/error.h"
 #include "hw/boards.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "system/system.h"
 #include "system/address-spaces.h"
 
@@ -74,6 +75,7 @@ static const TypeInfo microbit_info = {
     .parent = TYPE_MACHINE,
     .instance_size = sizeof(MicrobitMachineState),
     .class_init = microbit_machine_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void microbit_machine_init(void)
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index 5dd87cc028..55dd68c57e 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -52,6 +52,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
 #include "system/address-spaces.h"
@@ -1463,24 +1464,28 @@ static const TypeInfo mps2tz_an505_info = {
     .name = TYPE_MPS2TZ_AN505_MACHINE,
     .parent = TYPE_MPS2TZ_MACHINE,
     .class_init = mps2tz_an505_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps2tz_an521_info = {
     .name = TYPE_MPS2TZ_AN521_MACHINE,
     .parent = TYPE_MPS2TZ_MACHINE,
     .class_init = mps2tz_an521_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps3tz_an524_info = {
     .name = TYPE_MPS3TZ_AN524_MACHINE,
     .parent = TYPE_MPS2TZ_MACHINE,
     .class_init = mps3tz_an524_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps3tz_an547_info = {
     .name = TYPE_MPS3TZ_AN547_MACHINE,
     .parent = TYPE_MPS2TZ_MACHINE,
     .class_init = mps3tz_an547_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void mps2tz_machine_init(void)
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index bd378e360b..fa4b200577 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -31,6 +31,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/armv7m.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/or-irq.h"
 #include "hw/boards.h"
 #include "system/address-spaces.h"
@@ -567,24 +568,28 @@ static const TypeInfo mps2_an385_info = {
     .name = TYPE_MPS2_AN385_MACHINE,
     .parent = TYPE_MPS2_MACHINE,
     .class_init = mps2_an385_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps2_an386_info = {
     .name = TYPE_MPS2_AN386_MACHINE,
     .parent = TYPE_MPS2_MACHINE,
     .class_init = mps2_an386_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps2_an500_info = {
     .name = TYPE_MPS2_AN500_MACHINE,
     .parent = TYPE_MPS2_MACHINE,
     .class_init = mps2_an500_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo mps2_an511_info = {
     .name = TYPE_MPS2_AN511_MACHINE,
     .parent = TYPE_MPS2_MACHINE,
     .class_init = mps2_an511_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void mps2_machine_init(void)
diff --git a/hw/arm/mps3r.c b/hw/arm/mps3r.c
index 48c73acc62..fcb8777caf 100644
--- a/hw/arm/mps3r.c
+++ b/hw/arm/mps3r.c
@@ -37,6 +37,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/bsa.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/char/cmsdk-apb-uart.h"
 #include "hw/i2c/arm_sbcon_i2c.h"
 #include "hw/intc/arm_gicv3.h"
@@ -634,6 +635,7 @@ static const TypeInfo mps3r_machine_types[] = {
         .name = TYPE_MPS3R_AN536_MACHINE,
         .parent = TYPE_MPS3R_MACHINE,
         .class_init = mps3r_an536_class_init,
+        .interfaces = arm_machine_interfaces,
     },
 };
 
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index 29c76c6860..c26feccb15 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -32,6 +32,7 @@
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/qdev-clock.h"
 #include "system/address-spaces.h"
 #include "hw/arm/msf2-soc.h"
@@ -108,4 +109,4 @@ static void emcraft_sf2_machine_init(MachineClass *mc)
     mc->valid_cpu_types = valid_cpu_types;
 }
 
-DEFINE_MACHINE("emcraft-sf2", emcraft_sf2_machine_init)
+DEFINE_MACHINE_ARM("emcraft-sf2", emcraft_sf2_machine_init)
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index 250b3b5bf8..a3494c96bf 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -26,6 +26,7 @@
 #include "system/system.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/armsse.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/char/pl011.h"
 #include "hw/core/split-irq.h"
@@ -657,12 +658,14 @@ static const TypeInfo musca_a_info = {
     .name = TYPE_MUSCA_A_MACHINE,
     .parent = TYPE_MUSCA_MACHINE,
     .class_init = musca_a_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo musca_b1_info = {
     .name = TYPE_MUSCA_B1_MACHINE,
     .parent = TYPE_MUSCA_MACHINE,
     .class_init = musca_b1_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void musca_machine_init(void)
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 329b162eb2..1ae7cbd95c 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -15,6 +15,7 @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "net/net.h"
 #include "system/system.h"
 #include "hw/boards.h"
@@ -1346,7 +1347,7 @@ static void musicpal_machine_init(MachineClass *mc)
     machine_add_audiodev_property(mc);
 }
 
-DEFINE_MACHINE("musicpal", musicpal_machine_init)
+DEFINE_MACHINE_ARM("musicpal", musicpal_machine_init)
 
 static void mv88w8618_wlan_class_init(ObjectClass *klass, const void *data)
 {
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index df793c77fe..bce0d6f87a 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -30,6 +30,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f205_soc.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 /* Main SYSCLK frequency in Hz (120MHz) */
 #define SYSCLK_FRQ 120000000ULL
@@ -65,4 +66,4 @@ static void netduino2_machine_init(MachineClass *mc)
     mc->ignore_memory_transaction_failures = true;
 }
 
-DEFINE_MACHINE("netduino2", netduino2_machine_init)
+DEFINE_MACHINE_ARM("netduino2", netduino2_machine_init)
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index 81b6334cf7..8594081fe4 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -30,6 +30,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f405_soc.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 /* Main SYSCLK frequency in Hz (168MHz) */
 #define SYSCLK_FRQ 168000000ULL
@@ -65,4 +66,4 @@ static void netduinoplus2_machine_init(MachineClass *mc)
     mc->valid_cpu_types = valid_cpu_types;
 }
 
-DEFINE_MACHINE("netduinoplus2", netduinoplus2_machine_init)
+DEFINE_MACHINE_ARM("netduinoplus2", netduinoplus2_machine_init)
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index 465a0e5ace..c1e100b1e4 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -17,6 +17,7 @@
 #include "qemu/osdep.h"
 
 #include "hw/arm/npcm7xx.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/core/cpu.h"
 #include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_eeprom.h"
@@ -549,22 +550,27 @@ static const TypeInfo npcm7xx_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("npcm750-evb"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = npcm750_evb_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("quanta-gsj"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = gsj_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = gbs_bmc_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("kudo-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = kudo_bmc_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("mori-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = mori_bmc_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     },
 };
 
diff --git a/hw/arm/npcm8xx_boards.c b/hw/arm/npcm8xx_boards.c
index 3bf3e1f8f1..b179eadef5 100644
--- a/hw/arm/npcm8xx_boards.c
+++ b/hw/arm/npcm8xx_boards.c
@@ -19,6 +19,7 @@
 #include "chardev/char.h"
 #include "hw/boards.h"
 #include "hw/arm/npcm8xx.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/core/cpu.h"
 #include "hw/loader.h"
 #include "hw/qdev-core.h"
@@ -248,6 +249,7 @@ static const TypeInfo npcm8xx_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("npcm845-evb"),
         .parent         = TYPE_NPCM8XX_MACHINE,
         .class_init     = npcm845_evb_machine_class_init,
+        .interfaces     = aarch64_machine_interfaces,
     },
 };
 
diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
index 1f15620f9f..c5f6038333 100644
--- a/hw/arm/olimex-stm32-h405.c
+++ b/hw/arm/olimex-stm32-h405.c
@@ -31,6 +31,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f405_soc.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 /* olimex-stm32-h405 implementation is derived from netduinoplus2 */
 
@@ -71,4 +72,4 @@ static void olimex_stm32_h405_machine_init(MachineClass *mc)
     mc->default_ram_size = 0;
 }
 
-DEFINE_MACHINE("olimex-stm32-h405", olimex_stm32_h405_machine_init)
+DEFINE_MACHINE_ARM("olimex-stm32-h405", olimex_stm32_h405_machine_init)
diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c
index 5d4a31b7ae..730525be2d 100644
--- a/hw/arm/omap_sx1.c
+++ b/hw/arm/omap_sx1.c
@@ -32,6 +32,7 @@
 #include "hw/arm/omap.h"
 #include "hw/boards.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "system/qtest.h"
 #include "system/address-spaces.h"
@@ -219,6 +220,7 @@ static const TypeInfo sx1_machine_v2_type = {
     .name = MACHINE_TYPE_NAME("sx1"),
     .parent = TYPE_MACHINE,
     .class_init = sx1_machine_v2_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void sx1_machine_v1_class_init(ObjectClass *oc, const void *data)
@@ -238,6 +240,7 @@ static const TypeInfo sx1_machine_v1_type = {
     .name = MACHINE_TYPE_NAME("sx1-v1"),
     .parent = TYPE_MACHINE,
     .class_init = sx1_machine_v1_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void sx1_machine_init(void)
diff --git a/hw/arm/orangepi.c b/hw/arm/orangepi.c
index e0956880d1..3e237e78fa 100644
--- a/hw/arm/orangepi.c
+++ b/hw/arm/orangepi.c
@@ -26,6 +26,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/arm/allwinner-h3.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 static struct arm_boot_info orangepi_binfo;
 
@@ -124,4 +125,4 @@ static void orangepi_machine_init(MachineClass *mc)
     mc->auto_create_sdcard = true;
 }
 
-DEFINE_MACHINE("orangepi-pc", orangepi_machine_init)
+DEFINE_MACHINE_ARM("orangepi-pc", orangepi_machine_init)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index fbf3e09c03..81d2fa1b67 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -25,6 +25,7 @@
 #include "hw/boards.h"
 #include "hw/loader.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "qom/object.h"
 
 #define TYPE_RASPI_MACHINE  MACHINE_TYPE_NAME("raspi-common")
@@ -394,23 +395,28 @@ static const TypeInfo raspi_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("raspi0"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi0_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("raspi1ap"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi1ap_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("raspi2b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi2b_machine_class_init,
+        .interfaces     = arm_machine_interfaces,
 #ifdef TARGET_AARCH64
     }, {
         .name           = MACHINE_TYPE_NAME("raspi3ap"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi3ap_machine_class_init,
+        .interfaces     = aarch64_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("raspi3b"),
         .parent         = TYPE_RASPI_MACHINE,
         .class_init     = raspi3b_machine_class_init,
+        .interfaces     = aarch64_machine_interfaces,
 #endif
     }, {
         .name           = TYPE_RASPI_MACHINE,
diff --git a/hw/arm/raspi4b.c b/hw/arm/raspi4b.c
index 4df951a0d8..0422ae0f00 100644
--- a/hw/arm/raspi4b.c
+++ b/hw/arm/raspi4b.c
@@ -11,6 +11,7 @@
 #include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "qapi/visitor.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/arm/raspi_platform.h"
 #include "hw/display/bcm2835_fb.h"
 #include "hw/registerfields.h"
@@ -123,6 +124,7 @@ static const TypeInfo raspi4b_machine_type = {
     .parent         = TYPE_RASPI_BASE_MACHINE,
     .instance_size  = sizeof(Raspi4bMachineState),
     .class_init     = raspi4b_machine_class_init,
+    .interfaces     = aarch64_machine_interfaces,
 };
 
 static void raspi4b_machine_register_type(void)
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index 5c9050490b..b940cbf2c1 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -13,6 +13,7 @@
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/core/split-irq.h"
 #include "hw/net/lan9118.h"
 #include "hw/net/smc91c111.h"
@@ -431,6 +432,7 @@ static const TypeInfo realview_eb_type = {
     .name = MACHINE_TYPE_NAME("realview-eb"),
     .parent = TYPE_MACHINE,
     .class_init = realview_eb_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void realview_eb_mpcore_class_init(ObjectClass *oc, const void *data)
@@ -452,6 +454,7 @@ static const TypeInfo realview_eb_mpcore_type = {
     .name = MACHINE_TYPE_NAME("realview-eb-mpcore"),
     .parent = TYPE_MACHINE,
     .class_init = realview_eb_mpcore_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void realview_pb_a8_class_init(ObjectClass *oc, const void *data)
@@ -471,6 +474,7 @@ static const TypeInfo realview_pb_a8_type = {
     .name = MACHINE_TYPE_NAME("realview-pb-a8"),
     .parent = TYPE_MACHINE,
     .class_init = realview_pb_a8_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void realview_pbx_a9_class_init(ObjectClass *oc, const void *data)
@@ -491,6 +495,7 @@ static const TypeInfo realview_pbx_a9_type = {
     .name = MACHINE_TYPE_NAME("realview-pbx-a9"),
     .parent = TYPE_MACHINE,
     .class_init = realview_pbx_a9_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void realview_machine_init(void)
diff --git a/hw/arm/sabrelite.c b/hw/arm/sabrelite.c
index df60d47c6f..5b4ab7d77a 100644
--- a/hw/arm/sabrelite.c
+++ b/hw/arm/sabrelite.c
@@ -14,6 +14,7 @@
 #include "qapi/error.h"
 #include "hw/arm/fsl-imx6.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
@@ -113,4 +114,4 @@ static void sabrelite_machine_init(MachineClass *mc)
     mc->auto_create_sdcard = true;
 }
 
-DEFINE_MACHINE("sabrelite", sabrelite_machine_init)
+DEFINE_MACHINE_ARM("sabrelite", sabrelite_machine_init)
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index 15c1ff4b14..cf6e6eb208 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -35,6 +35,7 @@
 #include "hw/arm/bsa.h"
 #include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
 #include "hw/ide/ide-bus.h"
@@ -922,6 +923,7 @@ static const TypeInfo sbsa_ref_info = {
     .instance_init = sbsa_ref_instance_init,
     .class_init    = sbsa_ref_class_init,
     .instance_size = sizeof(SBSAMachineState),
+    .interfaces    = aarch64_machine_interfaces,
 };
 
 static void sbsa_ref_machine_init(void)
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index 031ea3a24e..8113bbd5d8 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -15,6 +15,7 @@
 #include "hw/sd/sd.h"
 #include "hw/ssi/ssi.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
@@ -1427,6 +1428,7 @@ static const TypeInfo lm3s811evb_type = {
     .name = MACHINE_TYPE_NAME("lm3s811evb"),
     .parent = TYPE_MACHINE,
     .class_init = lm3s811evb_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 /*
@@ -1448,6 +1450,7 @@ static const TypeInfo lm3s6965evb_type = {
     .name = MACHINE_TYPE_NAME("lm3s6965evb"),
     .parent = TYPE_MACHINE,
     .class_init = lm3s6965evb_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void stellaris_machine_init(void)
diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
index e6c1f5b8d7..c11029f8bd 100644
--- a/hw/arm/stm32vldiscovery.c
+++ b/hw/arm/stm32vldiscovery.c
@@ -31,6 +31,7 @@
 #include "qemu/error-report.h"
 #include "hw/arm/stm32f100_soc.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 
 /* stm32vldiscovery implementation is derived from netduinoplus2 */
 
@@ -68,4 +69,4 @@ static void stm32vldiscovery_machine_init(MachineClass *mc)
     mc->valid_cpu_types = valid_cpu_types;
 }
 
-DEFINE_MACHINE("stm32vldiscovery", stm32vldiscovery_machine_init)
+DEFINE_MACHINE_ARM("stm32vldiscovery", stm32vldiscovery_machine_init)
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 5cf1a70d10..6fc1e62789 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -12,6 +12,7 @@
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/net/smc91c111.h"
 #include "net/net.h"
 #include "system/system.h"
@@ -431,6 +432,7 @@ static const TypeInfo versatilepb_type = {
     .name = MACHINE_TYPE_NAME("versatilepb"),
     .parent = TYPE_MACHINE,
     .class_init = versatilepb_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void versatileab_class_init(ObjectClass *oc, const void *data)
@@ -452,6 +454,7 @@ static const TypeInfo versatileab_type = {
     .name = MACHINE_TYPE_NAME("versatileab"),
     .parent = TYPE_MACHINE,
     .class_init = versatileab_class_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void versatile_machine_init(void)
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 60cd375fe7..f30923a658 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -27,6 +27,7 @@
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/net/lan9118.h"
 #include "hw/i2c/i2c.h"
 #include "net/net.h"
@@ -850,6 +851,7 @@ static const TypeInfo vexpress_a9_info = {
     .parent = TYPE_VEXPRESS_MACHINE,
     .class_init = vexpress_a9_class_init,
     .instance_init = vexpress_a9_instance_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static const TypeInfo vexpress_a15_info = {
@@ -857,6 +859,7 @@ static const TypeInfo vexpress_a15_info = {
     .parent = TYPE_VEXPRESS_MACHINE,
     .class_init = vexpress_a15_class_init,
     .instance_init = vexpress_a15_instance_init,
+    .interfaces = arm_machine_interfaces,
 };
 
 static void vexpress_machine_init(void)
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 175023897a..20e3f1094c 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -37,6 +37,7 @@
 #include "hw/arm/boot.h"
 #include "hw/arm/primecell.h"
 #include "hw/arm/virt.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "hw/display/ramfb.h"
 #include "net/net.h"
@@ -127,6 +128,7 @@ static void arm_virt_compat_set(MachineClass *mc)
         .name = MACHINE_VER_TYPE_NAME("virt", __VA_ARGS__), \
         .parent = TYPE_VIRT_MACHINE, \
         .class_init = MACHINE_VER_SYM(class_init, virt, __VA_ARGS__), \
+        .interfaces = arm_aarch64_machine_interfaces, \
     }; \
     static void MACHINE_VER_SYM(register, virt, __VA_ARGS__)(void) \
     { \
diff --git a/hw/arm/xilinx_zynq.c b/hw/arm/xilinx_zynq.c
index 0372cd0ac4..c82edd3bed 100644
--- a/hw/arm/xilinx_zynq.c
+++ b/hw/arm/xilinx_zynq.c
@@ -20,6 +20,7 @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "net/net.h"
 #include "system/system.h"
 #include "hw/boards.h"
@@ -480,6 +481,7 @@ static const TypeInfo zynq_machine_type = {
     .parent = TYPE_MACHINE,
     .class_init = zynq_machine_class_init,
     .instance_size = sizeof(ZynqMachineState),
+    .interfaces = arm_machine_interfaces,
 };
 
 static void zynq_machine_register_types(void)
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index 149b448546..5e05521a57 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -21,6 +21,7 @@
 #include "hw/arm/fdt.h"
 #include "hw/arm/xlnx-versal.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "qom/object.h"
 #include "target/arm/cpu.h"
 
@@ -401,12 +402,14 @@ static const TypeInfo versal_virt_machine_init_typeinfo = {
     .name       = TYPE_XLNX_VERSAL_VIRT_MACHINE,
     .parent     = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
     .class_init = versal_virt_machine_class_init,
+    .interfaces = aarch64_machine_interfaces,
 };
 
 static const TypeInfo versal2_virt_machine_init_typeinfo = {
     .name       = TYPE_XLNX_VERSAL2_VIRT_MACHINE,
     .parent     = TYPE_XLNX_VERSAL_VIRT_BASE_MACHINE,
     .class_init = versal2_virt_machine_class_init,
+    .interfaces = aarch64_machine_interfaces,
 };
 
 static void versal_virt_machine_init_register_types(void)
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index 14b6641a71..330f375f63 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -19,6 +19,7 @@
 #include "qapi/error.h"
 #include "hw/arm/xlnx-zynqmp.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
@@ -303,6 +304,7 @@ static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
     .class_init = xlnx_zcu102_machine_class_init,
     .instance_init = xlnx_zcu102_machine_instance_init,
     .instance_size = sizeof(XlnxZCU102),
+    .interfaces = aarch64_machine_interfaces,
 };
 
 static void xlnx_zcu102_machine_init_register_types(void)

From 4dc7de81c210bee904802d9117a9150f3a5877dd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 23 Mar 2025 21:03:16 +0100
Subject: [PATCH 1798/2396] meson: Prepare to accept per-binary TargetInfo
 structure implementation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If a file defining the binary TargetInfo structure is available,
link with it. Otherwise keep using the stub.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-6-philmd@linaro.org>
---
 MAINTAINERS                 | 1 +
 configs/targets/meson.build | 4 ++++
 meson.build                 | 9 ++++++++-
 3 files changed, 13 insertions(+), 1 deletion(-)
 create mode 100644 configs/targets/meson.build

diff --git a/MAINTAINERS b/MAINTAINERS
index 64491c800c..c7faa5672a 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2007,6 +2007,7 @@ M: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Supported
 F: include/qemu/target-info*.h
 F: target-info*.c
+F: configs/targets/*.c
 
 Xtensa Machines
 ---------------
diff --git a/configs/targets/meson.build b/configs/targets/meson.build
new file mode 100644
index 0000000000..a9f6b24ec0
--- /dev/null
+++ b/configs/targets/meson.build
@@ -0,0 +1,4 @@
+foreach target : [
+  ]
+  config_target_info += {target : files(target + '.c')}
+endforeach
diff --git a/meson.build b/meson.build
index de95da3269..df876c72f0 100644
--- a/meson.build
+++ b/meson.build
@@ -3312,6 +3312,7 @@ config_devices_h = {}
 config_target_h = {}
 config_target_mak = {}
 config_base_arch_mak = {}
+config_target_info = {}
 
 disassemblers = {
   'alpha' : ['CONFIG_ALPHA_DIS'],
@@ -3912,9 +3913,9 @@ specific_ss.add(files('page-vary-target.c'))
 
 common_ss.add(files('target-info.c'))
 system_ss.add(files('target-info-qom.c'))
-specific_ss.add(files('target-info-stub.c'))
 
 subdir('backends')
+subdir('configs/targets')
 subdir('disas')
 subdir('migration')
 subdir('monitor')
@@ -4365,6 +4366,12 @@ foreach target : target_dirs
     arch_srcs += gdbstub_xml
   endif
 
+  if target in config_target_info
+    arch_srcs += config_target_info[target]
+  else
+    arch_srcs += files('target-info-stub.c')
+  endif
+
   t = target_arch[target_base_arch].apply(config_target, strict: false)
   arch_srcs += t.sources()
   arch_deps += t.dependencies()

From 1e18e343cef2f7fa50ecd59ee6c751567dcef9f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 18 Apr 2025 02:36:09 +0200
Subject: [PATCH 1799/2396] config/target: Implement per-binary TargetInfo
 structure (ARM, AARCH64)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement the TargetInfo structure for qemu-system-arm
and qemu-system-aarch64 binaries.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021205741.57109-7-philmd@linaro.org>
---
 configs/targets/aarch64-softmmu.c | 26 ++++++++++++++++++++++++++
 configs/targets/arm-softmmu.c     | 26 ++++++++++++++++++++++++++
 configs/targets/meson.build       |  1 +
 3 files changed, 53 insertions(+)
 create mode 100644 configs/targets/aarch64-softmmu.c
 create mode 100644 configs/targets/arm-softmmu.c

diff --git a/configs/targets/aarch64-softmmu.c b/configs/targets/aarch64-softmmu.c
new file mode 100644
index 0000000000..4e1e2f64da
--- /dev/null
+++ b/configs/targets/aarch64-softmmu.c
@@ -0,0 +1,26 @@
+/*
+ * QEMU binary/target API (qemu-system-aarch64)
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/target-info-impl.h"
+#include "hw/arm/machines-qom.h"
+#include "target/arm/cpu-qom.h"
+
+static const TargetInfo target_info_aarch64_system = {
+    .target_name = "aarch64",
+    .target_arch = SYS_EMU_TARGET_AARCH64,
+    .long_bits = 64,
+    .cpu_type = TYPE_ARM_CPU,
+    .machine_typename = TYPE_TARGET_AARCH64_MACHINE,
+    .endianness = ENDIAN_MODE_LITTLE,
+};
+
+const TargetInfo *target_info(void)
+{
+    return &target_info_aarch64_system;
+}
diff --git a/configs/targets/arm-softmmu.c b/configs/targets/arm-softmmu.c
new file mode 100644
index 0000000000..9b3fdd2854
--- /dev/null
+++ b/configs/targets/arm-softmmu.c
@@ -0,0 +1,26 @@
+/*
+ * QEMU binary/target API (qemu-system-arm)
+ *
+ *  Copyright (c) Linaro
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/target-info-impl.h"
+#include "hw/arm/machines-qom.h"
+#include "target/arm/cpu-qom.h"
+
+static const TargetInfo target_info_arm_system = {
+    .target_name = "arm",
+    .target_arch = SYS_EMU_TARGET_ARM,
+    .long_bits = 32,
+    .cpu_type = TYPE_ARM_CPU,
+    .machine_typename = TYPE_TARGET_ARM_MACHINE,
+    .endianness = ENDIAN_MODE_LITTLE,
+};
+
+const TargetInfo *target_info(void)
+{
+    return &target_info_arm_system;
+}
diff --git a/configs/targets/meson.build b/configs/targets/meson.build
index a9f6b24ec0..cca2514eb5 100644
--- a/configs/targets/meson.build
+++ b/configs/targets/meson.build
@@ -1,4 +1,5 @@
 foreach target : [
+      'arm-softmmu', 'aarch64-softmmu',
   ]
   config_target_info += {target : files(target + '.c')}
 endforeach

From d4e3377c7441ad55946891415e244fc689eb3896 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:53:59 +0200
Subject: [PATCH 1800/2396] hw/arm/virt: Register valid CPU types dynamically
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the static array returned as MachineClass::valid_cpu_types[]
by a runtime one generated by MachineClass::get_valid_cpu_types()
once the machine is created (its options being processed).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021211135.61179-1-philmd@linaro.org>
---
 hw/arm/virt.c | 59 ++++++++++++++++++++++++++++-----------------------
 1 file changed, 32 insertions(+), 27 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 20e3f1094c..e19da6fd90 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3256,36 +3256,41 @@ static int virt_hvf_get_physical_address_range(MachineState *ms)
     return requested_ipa_size;
 }
 
+static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
+{
+    GPtrArray *vct = g_ptr_array_new_with_free_func(g_free);
+
+#ifdef CONFIG_TCG
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a7")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a15")));
+#ifdef TARGET_AARCH64
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a35")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a55")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a72")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a76")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a710")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("a64fx")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-n1")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-v1")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-n2")));
+#endif /* TARGET_AARCH64 */
+#endif /* CONFIG_TCG */
+#ifdef TARGET_AARCH64
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a53")));
+        g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a57")));
+#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
+            g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("host")));
+#endif /* CONFIG_KVM || CONFIG_HVF */
+#endif /* TARGET_AARCH64 */
+    g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("max")));
+
+    return vct;
+}
+
 static void virt_machine_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
     HotplugHandlerClass *hc = HOTPLUG_HANDLER_CLASS(oc);
-    static const char * const valid_cpu_types[] = {
-#ifdef CONFIG_TCG
-        ARM_CPU_TYPE_NAME("cortex-a7"),
-        ARM_CPU_TYPE_NAME("cortex-a15"),
-#ifdef TARGET_AARCH64
-        ARM_CPU_TYPE_NAME("cortex-a35"),
-        ARM_CPU_TYPE_NAME("cortex-a55"),
-        ARM_CPU_TYPE_NAME("cortex-a72"),
-        ARM_CPU_TYPE_NAME("cortex-a76"),
-        ARM_CPU_TYPE_NAME("cortex-a710"),
-        ARM_CPU_TYPE_NAME("a64fx"),
-        ARM_CPU_TYPE_NAME("neoverse-n1"),
-        ARM_CPU_TYPE_NAME("neoverse-v1"),
-        ARM_CPU_TYPE_NAME("neoverse-n2"),
-#endif /* TARGET_AARCH64 */
-#endif /* CONFIG_TCG */
-#ifdef TARGET_AARCH64
-        ARM_CPU_TYPE_NAME("cortex-a53"),
-        ARM_CPU_TYPE_NAME("cortex-a57"),
-#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
-        ARM_CPU_TYPE_NAME("host"),
-#endif /* CONFIG_KVM || CONFIG_HVF */
-#endif /* TARGET_AARCH64 */
-        ARM_CPU_TYPE_NAME("max"),
-        NULL
-    };
 
     mc->init = machvirt_init;
     /* Start with max_cpus set to 512, which is the maximum supported by KVM.
@@ -3311,7 +3316,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
 #else
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("max");
 #endif
-    mc->valid_cpu_types = valid_cpu_types;
+    mc->get_valid_cpu_types = virt_get_valid_cpu_types;
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
     mc->kvm_type = virt_kvm_type;
     mc->hvf_get_physical_address_range = virt_hvf_get_physical_address_range;

From 9f5791334ed83b0b25c17d7cac29d583848ecad6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Apr 2025 11:42:19 +0200
Subject: [PATCH 1801/2396] hw/arm/virt: Check accelerator availability at
 runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is not possible to call accelerator runtime helpers
when QOM types are registered, because they depend on
the parsing of the '-accel FOO' command line option,
which happens after main().

Now than get_valid_cpu_types() is called after
accelerator initializations, it is safe to call the
accelerator helpers:

  main
   + configure_accelerators
   + qmp_x_exit_preconfig
     + qemu_init_board
       + machine_run_board_init
         + is_cpu_type_supported

Replace compile-time check on CONFIG_{ACCEL} by
runtime check on {accel}_enabled() helpers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210840.60112-1-philmd@linaro.org>
---
 hw/arm/virt.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index e19da6fd90..d380975446 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3260,7 +3260,7 @@ static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
 {
     GPtrArray *vct = g_ptr_array_new_with_free_func(g_free);
 
-#ifdef CONFIG_TCG
+    if (tcg_enabled()) {
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a7")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a15")));
 #ifdef TARGET_AARCH64
@@ -3274,13 +3274,13 @@ static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-v1")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-n2")));
 #endif /* TARGET_AARCH64 */
-#endif /* CONFIG_TCG */
+    }
 #ifdef TARGET_AARCH64
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a53")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a57")));
-#if defined(CONFIG_KVM) || defined(CONFIG_HVF)
+        if (kvm_enabled() || hvf_enabled()) {
             g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("host")));
-#endif /* CONFIG_KVM || CONFIG_HVF */
+        }
 #endif /* TARGET_AARCH64 */
     g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("max")));
 

From cc08d4d1c31e8ff5ee3c70f33be989b2175137b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 22:21:57 +0200
Subject: [PATCH 1802/2396] qemu/target_info: Add target_arm() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a helper to distinct whether the binary is targetting
ARM (32-bit only) or not.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-1-philmd@linaro.org>
---
 include/qemu/target-info.h | 7 +++++++
 target-info.c              | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index abcf25db6f..984fba3f42 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -50,4 +50,11 @@ const char *target_cpu_type(void);
  */
 bool target_big_endian(void);
 
+/**
+ * target_arm:
+ *
+ * Returns whether the target architecture is ARM (32-bit, not Aarch64).
+ */
+bool target_arm(void);
+
 #endif
diff --git a/target-info.c b/target-info.c
index 3110ab32f7..40716bf405 100644
--- a/target-info.c
+++ b/target-info.c
@@ -52,3 +52,8 @@ bool target_big_endian(void)
 {
     return target_endian_mode() == ENDIAN_MODE_BIG;
 }
+
+bool target_arm(void)
+{
+    return target_arch() == SYS_EMU_TARGET_ARM;
+}

From 4306fc0f8304c78bd9b74544177ac24a56d80653 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sat, 5 Apr 2025 00:41:48 +0200
Subject: [PATCH 1803/2396] qemu/target_info: Add target_aarch64() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a helper to distinct whether the binary is targetting
Aarch64 or not.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-2-philmd@linaro.org>
---
 include/qemu/target-info.h | 7 +++++++
 target-info.c              | 5 +++++
 2 files changed, 12 insertions(+)

diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index 984fba3f42..e8fbdf19d5 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -57,4 +57,11 @@ bool target_big_endian(void);
  */
 bool target_arm(void);
 
+/**
+ * target_aarch64:
+ *
+ * Returns whether the target architecture is Aarch64.
+ */
+bool target_aarch64(void);
+
 #endif
diff --git a/target-info.c b/target-info.c
index 40716bf405..e567cb4c40 100644
--- a/target-info.c
+++ b/target-info.c
@@ -57,3 +57,8 @@ bool target_arm(void)
 {
     return target_arch() == SYS_EMU_TARGET_ARM;
 }
+
+bool target_aarch64(void)
+{
+    return target_arch() == SYS_EMU_TARGET_AARCH64;
+}

From 43cc9efdc341c960587d361be37bc0c6abf29749 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 13 May 2025 12:50:10 +0100
Subject: [PATCH 1804/2396] qemu/target_info: Add target_base_arm() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a helper to check whether the target base architecture
is ARM (either 32-bit or 64-bit).

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-3-philmd@linaro.org>
---
 include/qemu/target-info.h |  7 +++++++
 target-info.c              | 11 +++++++++++
 2 files changed, 18 insertions(+)

diff --git a/include/qemu/target-info.h b/include/qemu/target-info.h
index e8fbdf19d5..6235962223 100644
--- a/include/qemu/target-info.h
+++ b/include/qemu/target-info.h
@@ -50,6 +50,13 @@ const char *target_cpu_type(void);
  */
 bool target_big_endian(void);
 
+/**
+ * target_base_arm:
+ *
+ * Returns whether the target architecture is ARM or Aarch64.
+ */
+bool target_base_arm(void);
+
 /**
  * target_arm:
  *
diff --git a/target-info.c b/target-info.c
index e567cb4c40..24696ff411 100644
--- a/target-info.c
+++ b/target-info.c
@@ -53,6 +53,17 @@ bool target_big_endian(void)
     return target_endian_mode() == ENDIAN_MODE_BIG;
 }
 
+bool target_base_arm(void)
+{
+    switch (target_arch()) {
+    case SYS_EMU_TARGET_ARM:
+    case SYS_EMU_TARGET_AARCH64:
+        return true;
+    default:
+        return false;
+    }
+}
+
 bool target_arm(void)
 {
     return target_arch() == SYS_EMU_TARGET_ARM;

From ebb643764b013c19323079ac48bca73fa810c445 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:56:51 +0200
Subject: [PATCH 1805/2396] hw/arm/virt: Replace TARGET_AARCH64 ->
 target_aarch64()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace the target-specific TARGET_AARCH64 definition
by a call to the generic target_aarch64() helper.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-4-philmd@linaro.org>
---
 hw/arm/virt.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index d380975446..dda8edb274 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -32,6 +32,7 @@
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qemu/option.h"
+#include "qemu/target-info.h"
 #include "monitor/qdev.h"
 #include "hw/sysbus.h"
 #include "hw/arm/boot.h"
@@ -3263,7 +3264,8 @@ static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
     if (tcg_enabled()) {
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a7")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a15")));
-#ifdef TARGET_AARCH64
+    }
+    if (tcg_enabled() && target_aarch64()) {
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a35")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a55")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a72")));
@@ -3273,15 +3275,14 @@ static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-n1")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-v1")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("neoverse-n2")));
-#endif /* TARGET_AARCH64 */
     }
-#ifdef TARGET_AARCH64
+    if (target_aarch64()) {
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a53")));
         g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("cortex-a57")));
         if (kvm_enabled() || hvf_enabled()) {
             g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("host")));
         }
-#endif /* TARGET_AARCH64 */
+    }
     g_ptr_array_add(vct, g_strdup(ARM_CPU_TYPE_NAME("max")));
 
     return vct;

From e22ad85abdd3328ef966d7a4cc15812ce3a4ee39 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 22 Apr 2025 10:22:34 +0200
Subject: [PATCH 1806/2396] hw/arm/virt: Get default CPU type at runtime
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefer MachineClass::get_default_cpu_type() over
MachineClass::default_cpu_type to get CPU type,
evaluating TCG availability at runtime calling
tcg_enabled().

It's worth noting that this is a behavior change:

- Previously only

  ./configure --disable-tcg --enable-kvm
  ./qemu-system-aarch64 -M virt -accel kvm

  would default to 'max' and

  ./configure --enable-tcg --enable-kvm
  ./qemu-system-aarch64 -M virt -accel kvm

  would default to 'cortex-a15'.

- Afterward, -accel kvm will always default to 'max'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-5-philmd@linaro.org>
---
 hw/arm/virt.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index dda8edb274..d07cfe1651 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3257,6 +3257,12 @@ static int virt_hvf_get_physical_address_range(MachineState *ms)
     return requested_ipa_size;
 }
 
+static const char *virt_get_default_cpu_type(const MachineState *ms)
+{
+    return tcg_enabled() ? ARM_CPU_TYPE_NAME("cortex-a15")
+                         : ARM_CPU_TYPE_NAME("max");
+}
+
 static GPtrArray *virt_get_valid_cpu_types(const MachineState *ms)
 {
     GPtrArray *vct = g_ptr_array_new_with_free_func(g_free);
@@ -3312,11 +3318,7 @@ static void virt_machine_class_init(ObjectClass *oc, const void *data)
     mc->minimum_page_bits = 12;
     mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
-#ifdef CONFIG_TCG
-    mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-#else
-    mc->default_cpu_type = ARM_CPU_TYPE_NAME("max");
-#endif
+    mc->get_default_cpu_type = virt_get_default_cpu_type;
     mc->get_valid_cpu_types = virt_get_valid_cpu_types;
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
     mc->kvm_type = virt_kvm_type;

From 67b2ba55adf9a21e29dc5794366de0de99c724de Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 22:31:24 +0200
Subject: [PATCH 1807/2396] hw/arm/sbsa-ref: Include missing 'cpu.h' header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"cpu.h" is indirectly pulled in by another header. Include
it explicitly in order to avoid when changing default CPPFLAGS path:

  hw/arm/sbsa-ref.c:162:25: error: use of undeclared identifier 'ARM_DEFAULT_CPUS_PER_CLUSTER'
    162 |     uint8_t clustersz = ARM_DEFAULT_CPUS_PER_CLUSTER;
        |                         ^
  hw/arm/sbsa-ref.c:163:12: error: call to undeclared function 'arm_build_mp_affinity'
    163 |     return arm_build_mp_affinity(idx, clustersz);
        |            ^
  hw/arm/sbsa-ref.c:746:25: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_DISABLED'
    746 |     sms->psci_conduit = QEMU_PSCI_CONDUIT_DISABLED;
        |                         ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-6-philmd@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index cf6e6eb208..2205500a8d 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -52,6 +52,7 @@
 #include "net/net.h"
 #include "qobject/qlist.h"
 #include "qom/object.h"
+#include "target/arm/cpu.h"
 #include "target/arm/cpu-qom.h"
 #include "target/arm/gtimer.h"
 

From 3b958ed662ca6a7b89bd5f0e2ff82769564284ad Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:16:13 +0200
Subject: [PATCH 1808/2396] hw/arm/sbsa-ref: Build only once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since previous commit allowed the use of accelerator definitions
in common code, we can now move sbsa-ref.c to arm_common_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-7-philmd@linaro.org>
---
 hw/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index b88b5b06d7..531a635936 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -14,7 +14,7 @@ arm_common_ss.add(when: 'CONFIG_OLIMEX_STM32_H405', if_true: files('olimex-stm32
 arm_common_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx.c', 'npcm7xx_boards.c'))
 arm_common_ss.add(when: 'CONFIG_NPCM8XX', if_true: files('npcm8xx.c', 'npcm8xx_boards.c'))
 arm_common_ss.add(when: 'CONFIG_REALVIEW', if_true: files('realview.c'))
-arm_ss.add(when: 'CONFIG_SBSA_REF', if_true: files('sbsa-ref.c'))
+arm_common_ss.add(when: 'CONFIG_SBSA_REF', if_true: files('sbsa-ref.c'))
 arm_common_ss.add(when: 'CONFIG_STELLARIS', if_true: files('stellaris.c'))
 arm_common_ss.add(when: 'CONFIG_STM32VLDISCOVERY', if_true: files('stm32vldiscovery.c'))
 arm_common_ss.add(when: 'CONFIG_ZYNQ', if_true: files('xilinx_zynq.c'))

From fdda97b47e6c07372fd309062955a474b10a1bba Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 2 Sep 2025 10:44:45 +0200
Subject: [PATCH 1809/2396] hw/arm/virt-acpi-build: Include missing 'cpu.h'
 header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"cpu.h" is indirectly pulled in by another header. Include
it explicitly in order to avoid when changing default CPPFLAGS path:

  hw/arm/virt-acpi-build.c:903:34: error: call to undeclared function 'arm_feature';
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                  ^
  hw/arm/virt-acpi-build.c:903:53: error: incomplete definition of type 'ARMCPU' (aka 'struct ArchCPU')
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                               ~~~~~~^
  include/qemu/typedefs.h:30:16: note: forward declaration of 'struct ArchCPU'
     30 | typedef struct ArchCPU ArchCPU;
        |                ^
  hw/arm/virt-acpi-build.c:903:60: error: use of undeclared identifier 'ARM_FEATURE_PMU'
    903 |         uint32_t pmu_interrupt = arm_feature(&armcpu->env, ARM_FEATURE_PMU) ?
        |                                                            ^
  hw/arm/virt-acpi-build.c:993:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_DISABLED'
    993 |     case QEMU_PSCI_CONDUIT_DISABLED:
        |          ^
  hw/arm/virt-acpi-build.c:996:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_HVC'
    996 |     case QEMU_PSCI_CONDUIT_HVC:
        |          ^
  hw/arm/virt-acpi-build.c:1000:10: error: use of undeclared identifier 'QEMU_PSCI_CONDUIT_SMC'
   1000 |     case QEMU_PSCI_CONDUIT_SMC:
        |          ^

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-8-philmd@linaro.org>
---
 hw/arm/virt-acpi-build.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index 8bb6b60515..200e2a1da7 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -62,6 +62,7 @@
 #include "hw/acpi/ghes.h"
 #include "hw/acpi/viot.h"
 #include "hw/virtio/virtio-acpi.h"
+#include "target/arm/cpu.h"
 #include "target/arm/multiprocessing.h"
 
 #define ARM_SPI_BASE 32

From 2b12ce6d3984d2c47eff747c3097208d0a48c966 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 00:15:41 +0200
Subject: [PATCH 1810/2396] hw/arm/virt-acpi-build: Build only once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previous commits removed the target-specificities,
we can now move virt-acpi-build.c to arm_common_ss[].

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210144.58108-9-philmd@linaro.org>
---
 hw/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 531a635936..df4c1be3b3 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -1,7 +1,7 @@
 arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
 arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
-arm_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
+arm_common_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 arm_common_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
 arm_common_ss.add(when: 'CONFIG_EMCRAFT_SF2', if_true: files('msf2-som.c'))
 arm_common_ss.add(when: 'CONFIG_HIGHBANK', if_true: files('highbank.c'))

From 5ec0236f6384f89e0f356dd4db19284bbb8a73d8 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 01:02:00 +0200
Subject: [PATCH 1811/2396] hw/arm/virt: Build only once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previous commits removed the TARGET_AARCH64 uses in virt.c,
we can now move it to arm_common_ss[] and build it once.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210934.60483-1-philmd@linaro.org>
---
 hw/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index df4c1be3b3..9fbbbc9a6f 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -1,6 +1,6 @@
 arm_ss = ss.source_set()
 arm_common_ss = ss.source_set()
-arm_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
+arm_common_ss.add(when: 'CONFIG_ARM_VIRT', if_true: files('virt.c'))
 arm_common_ss.add(when: 'CONFIG_ACPI', if_true: files('virt-acpi-build.c'))
 arm_common_ss.add(when: 'CONFIG_DIGIC', if_true: files('digic_boards.c'))
 arm_common_ss.add(when: 'CONFIG_EMCRAFT_SF2', if_true: files('msf2-som.c'))

From 8299515d646690dd059c410bc1f3677589131f54 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 16 Apr 2025 10:01:11 +0200
Subject: [PATCH 1812/2396] hw/arm/meson: Move Xen files to arm_common_ss[]
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Acked-by: Peter Maydell <peter.maydell@linaro.org>
Message-Id: <20251021210655.59278-1-philmd@linaro.org>
---
 hw/arm/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 9fbbbc9a6f..61c66ee2d0 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -65,7 +65,7 @@ arm_common_ss.add(when: 'CONFIG_FSL_IMX8MP_EVK', if_true: files('imx8mp-evk.c'))
 arm_common_ss.add(when: 'CONFIG_ARM_SMMUV3', if_true: files('smmuv3.c'))
 arm_common_ss.add(when: 'CONFIG_FSL_IMX6UL', if_true: files('fsl-imx6ul.c', 'mcimx6ul-evk.c'))
 arm_common_ss.add(when: 'CONFIG_NRF51_SOC', if_true: files('nrf51_soc.c'))
-arm_ss.add(when: 'CONFIG_XEN', if_true: files(
+arm_common_ss.add(when: 'CONFIG_XEN', if_true: files(
   'xen-stubs.c',
   'xen-pvh.c',
 ))

From a1393a76ce23495e0e990bed52c32d7cde861e64 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 17:00:03 +0200
Subject: [PATCH 1813/2396] hw/xen: Use BITS_PER_BYTE & MAKE_64BIT_MASK() in
 req_size_bits()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Replace magic 8 by BITS_PER_BYTE, use MAKE_64BIT_MASK()
instead of open coding it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-2-philmd@linaro.org>
---
 hw/xen/xen-hvm-common.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 52e2cce397..258014370e 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -1,5 +1,6 @@
 #include "qemu/osdep.h"
 #include "qemu/units.h"
+#include "qemu/bitops.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include "exec/target_long.h"
@@ -448,12 +449,14 @@ static void cpu_ioreq_config(XenIOState *state, ioreq_t *req)
 
 static void handle_ioreq(XenIOState *state, ioreq_t *req)
 {
+    size_t req_size_bits = req->size * BITS_PER_BYTE;
+
     trace_handle_ioreq(req, req->type, req->dir, req->df, req->data_is_ptr,
                        req->addr, req->data, req->count, req->size);
 
     if (!req->data_is_ptr && (req->dir == IOREQ_WRITE) &&
             (req->size < sizeof (target_ulong))) {
-        req->data &= ((target_ulong) 1 << (8 * req->size)) - 1;
+        req->data &= MAKE_64BIT_MASK(0, req_size_bits);
     }
 
     if (req->dir == IOREQ_WRITE)

From 6e63a0052245751f45fe63f43b1ea467b63c15ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 17:07:04 +0200
Subject: [PATCH 1814/2396] hw/xen: Replace target_ulong by agnostic
 target_long_bits()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Both are equivalent:

  target_long_bits()

  sizeof(target_u?long) * BITS_PER_BYTE

Prefer the former which is target-agnostic.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-3-philmd@linaro.org>
---
 hw/xen/xen-hvm-common.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/xen/xen-hvm-common.c b/hw/xen/xen-hvm-common.c
index 258014370e..b40ae0b3af 100644
--- a/hw/xen/xen-hvm-common.c
+++ b/hw/xen/xen-hvm-common.c
@@ -2,8 +2,8 @@
 #include "qemu/units.h"
 #include "qemu/bitops.h"
 #include "qemu/error-report.h"
+#include "qemu/target-info.h"
 #include "qapi/error.h"
-#include "exec/target_long.h"
 #include "exec/target_page.h"
 #include "trace.h"
 
@@ -455,7 +455,7 @@ static void handle_ioreq(XenIOState *state, ioreq_t *req)
                        req->addr, req->data, req->count, req->size);
 
     if (!req->data_is_ptr && (req->dir == IOREQ_WRITE) &&
-            (req->size < sizeof (target_ulong))) {
+            (req_size_bits < target_long_bits())) {
         req->data &= MAKE_64BIT_MASK(0, req_size_bits);
     }
 

From ad9e070998cb2dcedeeb23b29a0fb67df01855d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 4 Apr 2025 17:00:42 +0200
Subject: [PATCH 1815/2396] hw/xen: Build only once
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now than hw/xen/ files don't use any target-specific code,
we can build all file units once, removing the need for the
xen_specific_ss[] source set.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251022140114.72372-4-philmd@linaro.org>
---
 hw/xen/meson.build | 22 +++++++++-------------
 1 file changed, 9 insertions(+), 13 deletions(-)

diff --git a/hw/xen/meson.build b/hw/xen/meson.build
index a1850e7698..dcd2b7e1df 100644
--- a/hw/xen/meson.build
+++ b/hw/xen/meson.build
@@ -7,21 +7,16 @@ system_ss.add(when: ['CONFIG_XEN_BUS'], if_true: files(
   'xen_pvdev.c',
 ))
 
-system_ss.add(when: ['CONFIG_XEN', xen], if_true: files(
-  'xen-operations.c',
-),
-if_false: files(
-  'xen_stubs.c',
-))
-
-xen_specific_ss = ss.source_set()
-xen_specific_ss.add(files(
-  'xen-mapcache.c',
+xen_common_ss = ss.source_set()
+xen_common_ss.add(files(
   'xen-hvm-common.c',
+  'xen-mapcache.c',
+  'xen-operations.c',
   'xen-pvh-common.c',
 ))
+
 if have_xen_pci_passthrough
-  xen_specific_ss.add(files(
+  xen_common_ss.add(files(
     'xen-host-pci-device.c',
     'xen_pt.c',
     'xen_pt_config_init.c',
@@ -30,7 +25,8 @@ if have_xen_pci_passthrough
     'xen_pt_msi.c',
   ))
 else
-  xen_specific_ss.add(files('xen_pt_stub.c'))
+  xen_common_ss.add(files('xen_pt_stub.c'))
 endif
 
-specific_ss.add_all(when: ['CONFIG_XEN', xen], if_true: xen_specific_ss)
+system_ss.add_all(when: ['CONFIG_XEN', xen], if_true: xen_common_ss)
+system_ss.add(when: ['CONFIG_XEN', xen], if_false: files('xen_stubs.c'))

From dfbf7775403db6fdd3e298bf7664b6149d7d6f77 Mon Sep 17 00:00:00 2001
From: Anton Johansson <anjo@rev.ng>
Date: Mon, 27 Oct 2025 13:35:11 +0100
Subject: [PATCH 1816/2396] hw/riscv: Replace target_ulong uses
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Anton Johansson <anjo@rev.ng>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-ID: <20251027-feature-single-binary-hw-v1-v2-2-44478d589ae9@rev.ng>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/riscv/riscv-iommu.c | 6 ++++--
 hw/riscv/riscv_hart.c  | 2 +-
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/riscv/riscv-iommu.c b/hw/riscv/riscv-iommu.c
index b33c7fe325..f8656ec04b 100644
--- a/hw/riscv/riscv-iommu.c
+++ b/hw/riscv/riscv-iommu.c
@@ -26,6 +26,8 @@
 #include "migration/vmstate.h"
 #include "qapi/error.h"
 #include "qemu/timer.h"
+#include "qemu/target-info.h"
+#include "qemu/bitops.h"
 
 #include "cpu_bits.h"
 #include "riscv-iommu.h"
@@ -391,9 +393,9 @@ static int riscv_iommu_spa_fetch(RISCVIOMMUState *s, RISCVIOMMUContext *ctx,
             const uint64_t va_mask = (1ULL << va_len) - 1;
 
             if (pass == S_STAGE && va_len > 32) {
-                target_ulong mask, masked_msbs;
+                uint64_t mask, masked_msbs;
 
-                mask = (1L << (TARGET_LONG_BITS - (va_len - 1))) - 1;
+                mask = MAKE_64BIT_MASK(0, target_long_bits() - va_len + 1);
                 masked_msbs = (addr >> (va_len - 1)) & mask;
 
                 if (masked_msbs != 0 && masked_msbs != mask) {
diff --git a/hw/riscv/riscv_hart.c b/hw/riscv/riscv_hart.c
index 4d51a93dd5..33cbc9873e 100644
--- a/hw/riscv/riscv_hart.c
+++ b/hw/riscv/riscv_hart.c
@@ -94,7 +94,7 @@ static bool csr_qtest_callback(CharFrontend *chr, gchar **words)
         g_assert(rc == 0);
         csr_call(words[1], cpu, csr, &val);
 
-        qtest_sendf(chr, "OK 0 "TARGET_FMT_lx"\n", (target_ulong)val);
+        qtest_sendf(chr, "OK 0 %"PRIx64"\n", val);
 
         return true;
     }

From 582ca26c991049c23c04fe499779657d8ba79561 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 00:01:42 +0400
Subject: [PATCH 1817/2396] audio: register and unregister vmstate with
 AudioState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Proper lifecycle management with QOM state.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/audio/audio.c b/audio/audio.c
index 4c3c3fd52f..853930bb48 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1614,6 +1614,8 @@ static void audio_vm_change_state_handler (void *opaque, bool running,
     audio_reset_timer (s);
 }
 
+static const VMStateDescription vmstate_audio;
+
 static void audio_state_init(Object *obj)
 {
     AudioState *s = AUDIO_STATE(obj);
@@ -1625,6 +1627,8 @@ static void audio_state_init(Object *obj)
 
     s->vmse = qemu_add_vm_change_state_handler(audio_vm_change_state_handler, s);
     assert(s->vmse != NULL);
+
+    vmstate_register_any(NULL, &vmstate_audio, s);
 }
 
 static void audio_state_finalize(Object *obj)
@@ -1679,6 +1683,8 @@ static void audio_state_finalize(Object *obj)
         qemu_del_vm_change_state_handler(s->vmse);
         s->vmse = NULL;
     }
+
+    vmstate_unregister(NULL, &vmstate_audio, s);
 }
 
 static Object *get_audiodevs_root(void)
@@ -1787,7 +1793,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
     }
     object_unref(s);
     QLIST_INIT (&s->card_head);
-    vmstate_register_any(NULL, &vmstate_audio, s);
     return s;
 
 out:

From f6d1f9b1b9d976b99198214f2a4f3bfb079bab8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 00:05:22 +0400
Subject: [PATCH 1818/2396] audio: initialize card_head during object init
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/audio/audio.c b/audio/audio.c
index 853930bb48..bdaee7855f 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1623,6 +1623,7 @@ static void audio_state_init(Object *obj)
     QLIST_INIT(&s->hw_head_out);
     QLIST_INIT(&s->hw_head_in);
     QLIST_INIT(&s->cap_head);
+    QLIST_INIT(&s->card_head);
     s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
 
     s->vmse = qemu_add_vm_change_state_handler(audio_vm_change_state_handler, s);
@@ -1792,7 +1793,6 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
         goto out;
     }
     object_unref(s);
-    QLIST_INIT (&s->card_head);
     return s;
 
 out:

From 914cb0878f83b5e7e9a94ffa5075fb349cd48866 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 12:02:07 +0400
Subject: [PATCH 1819/2396] audio: remove some needless headers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c       | 3 ---
 audio/audio.h       | 1 -
 audio/dbusaudio.c   | 2 --
 audio/dsoundaudio.c | 1 -
 audio/mixeng.c      | 4 +++-
 audio/noaudio.c     | 2 --
 audio/wavaudio.c    | 3 ---
 audio/wavcapture.c  | 1 -
 8 files changed, 3 insertions(+), 14 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index bdaee7855f..f334030d96 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -25,7 +25,6 @@
 #include "qemu/osdep.h"
 #include "audio.h"
 #include "migration/vmstate.h"
-#include "monitor/monitor.h"
 #include "qemu/timer.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
@@ -33,7 +32,6 @@
 #include "qapi/qapi-visit-audio.h"
 #include "qapi/qapi-commands-audio.h"
 #include "qobject/qdict.h"
-#include "qemu/cutils.h"
 #include "qemu/error-report.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
@@ -41,7 +39,6 @@
 #include "system/system.h"
 #include "system/replay.h"
 #include "system/runstate.h"
-#include "ui/qemu-spice.h"
 #include "trace.h"
 
 #define AUDIO_CAP "audio"
diff --git a/audio/audio.h b/audio/audio.h
index e41c5bc55a..3be0c4f24f 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -27,7 +27,6 @@
 
 #include "qemu/queue.h"
 #include "qapi/qapi-types-audio.h"
-#include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 
 typedef void (*audio_callback_fn) (void *opaque, int avail);
diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index b44fdd1511..908214a170 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -24,9 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/error-report.h"
-#include "qemu/host-utils.h"
 #include "qemu/module.h"
-#include "qemu/timer.h"
 #include "qemu/dbus.h"
 
 #ifdef G_OS_UNIX
diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index d476e9b441..bd00c50e80 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -31,7 +31,6 @@
 
 #define AUDIO_CAP "dsound"
 #include "audio_int.h"
-#include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
 
diff --git a/audio/mixeng.c b/audio/mixeng.c
index 703ee5448f..be38617e9b 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -24,11 +24,13 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/bswap.h"
-#include "qemu/error-report.h"
 #include "audio.h"
 
 #define AUDIO_CAP "mixeng"
 #include "audio_int.h"
+#ifdef FLOAT_MIXENG
+#include "qemu/error-report.h"
+#endif
 
 /* 8 bit */
 #define ENDIAN_CONVERSION natural
diff --git a/audio/noaudio.c b/audio/noaudio.c
index 1b60d8518a..34ff1d2a27 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -23,10 +23,8 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "audio.h"
-#include "qemu/timer.h"
 
 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index a8798a1c42..a098b20cad 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -23,10 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu/host-utils.h"
 #include "qemu/module.h"
-#include "qemu/timer.h"
-#include "qapi/opts-visitor.h"
 #include "audio.h"
 
 #define AUDIO_CAP "wav"
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index c60286e162..b990844d48 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,6 +1,5 @@
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
-#include "qapi/error.h"
 #include "qemu/error-report.h"
 #include "audio.h"
 

From eaeafe3074050e29e3d9d8509021751366ea0b00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 12:31:37 +0400
Subject: [PATCH 1820/2396] audio: remove AUDIO_HOST_ENDIANNESS
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c      | 6 +++---
 audio/audio.h      | 6 ------
 audio/spiceaudio.c | 4 ++--
 hw/audio/adlib.c   | 2 +-
 hw/audio/asc.c     | 2 +-
 hw/audio/cs4231a.c | 2 +-
 hw/audio/gus.c     | 2 +-
 7 files changed, 9 insertions(+), 15 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index f334030d96..18bc9188db 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -274,7 +274,7 @@ static int audio_pcm_info_eq (struct audio_pcm_info *info, struct audsettings *a
         && info->is_signed == is_signed
         && info->is_float == is_float
         && info->bits == bits
-        && info->swap_endianness == (as->endianness != AUDIO_HOST_ENDIANNESS);
+        && info->swap_endianness == (as->endianness != HOST_BIG_ENDIAN);
 }
 
 void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as)
@@ -320,7 +320,7 @@ void audio_pcm_init_info (struct audio_pcm_info *info, struct audsettings *as)
     info->nchannels = as->nchannels;
     info->bytes_per_frame = as->nchannels * mul;
     info->bytes_per_second = info->freq * info->bytes_per_frame;
-    info->swap_endianness = (as->endianness != AUDIO_HOST_ENDIANNESS);
+    info->swap_endianness = (as->endianness != HOST_BIG_ENDIAN);
 }
 
 void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len)
@@ -2179,7 +2179,7 @@ audsettings audiodev_to_audsettings(AudiodevPerDirectionOptions *pdo)
         .freq = pdo->frequency,
         .nchannels = pdo->channels,
         .fmt = pdo->format,
-        .endianness = AUDIO_HOST_ENDIANNESS,
+        .endianness = HOST_BIG_ENDIAN,
     };
 }
 
diff --git a/audio/audio.h b/audio/audio.h
index 3be0c4f24f..0af911fd9a 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -31,12 +31,6 @@
 
 typedef void (*audio_callback_fn) (void *opaque, int avail);
 
-#if HOST_BIG_ENDIAN
-#define AUDIO_HOST_ENDIANNESS 1
-#else
-#define AUDIO_HOST_ENDIANNESS 0
-#endif
-
 typedef struct audsettings {
     int freq;
     int nchannels;
diff --git a/audio/spiceaudio.c b/audio/spiceaudio.c
index 7f02f7285c..7e737bff9a 100644
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -102,7 +102,7 @@ static int line_out_init(HWVoiceOut *hw, struct audsettings *as,
 #endif
     settings.nchannels  = SPICE_INTERFACE_PLAYBACK_CHAN;
     settings.fmt        = AUDIO_FORMAT_S16;
-    settings.endianness = AUDIO_HOST_ENDIANNESS;
+    settings.endianness = HOST_BIG_ENDIAN;
 
     audio_pcm_init_info (&hw->info, &settings);
     hw->samples = LINE_OUT_SAMPLES;
@@ -218,7 +218,7 @@ static int line_in_init(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 #endif
     settings.nchannels  = SPICE_INTERFACE_RECORD_CHAN;
     settings.fmt        = AUDIO_FORMAT_S16;
-    settings.endianness = AUDIO_HOST_ENDIANNESS;
+    settings.endianness = HOST_BIG_ENDIAN;
 
     audio_pcm_init_info (&hw->info, &settings);
     hw->samples = LINE_IN_SAMPLES;
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 6aae365f47..45c0a458f2 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -272,7 +272,7 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
     as.freq = s->freq;
     as.nchannels = SHIFT;
     as.fmt = AUDIO_FORMAT_S16;
-    as.endianness = AUDIO_HOST_ENDIANNESS;
+    as.endianness = HOST_BIG_ENDIAN;
 
     s->voice = AUD_open_out (
         &s->card,
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index edd42d6d91..41472dc2e3 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -650,7 +650,7 @@ static void asc_realize(DeviceState *dev, Error **errp)
     as.freq = ASC_FREQ;
     as.nchannels = 2;
     as.fmt = AUDIO_FORMAT_U8;
-    as.endianness = AUDIO_HOST_ENDIANNESS;
+    as.endianness = HOST_BIG_ENDIAN;
 
     s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
                             &as);
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 3b80a61378..0a5d614f8b 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -305,7 +305,7 @@ static void cs_reset_voices (CSState *s, uint32_t val)
         s->tab = ALawDecompressTable;
     x_law:
         as.fmt = AUDIO_FORMAT_S16;
-        as.endianness = AUDIO_HOST_ENDIANNESS;
+        as.endianness = HOST_BIG_ENDIAN;
         s->shift = as.nchannels == 2;
         break;
 
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index 45ea04bf89..d13a95eb5a 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -255,7 +255,7 @@ static void gus_realizefn (DeviceState *dev, Error **errp)
     as.freq = s->freq;
     as.nchannels = 2;
     as.fmt = AUDIO_FORMAT_S16;
-    as.endianness = AUDIO_HOST_ENDIANNESS;
+    as.endianness = HOST_BIG_ENDIAN;
 
     s->voice = AUD_open_out (
         &s->card,

From d2b15ae4074f8594def26f4bce0a3023042c274a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 13:56:14 +0400
Subject: [PATCH 1821/2396] audio: introduce AUD_set_volume_{in,out}_lr()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are 2 sets of functions since the introduction of multi-channel
Volume structure: AUD_set_volume_{in,out} and audio_set_volume_{in,out}.

Use the AUD_ prefix for consistency with other audio.c functions. Rename
the stereo function with "_lr" suffix.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c         | 16 ++--------------
 audio/audio.h         | 21 ++++++++++++++++-----
 hw/audio/ac97.c       |  4 ++--
 hw/audio/asc.c        |  2 +-
 hw/audio/hda-codec.c  |  4 ++--
 hw/audio/lm4549.c     |  2 +-
 hw/audio/via-ac97.c   |  2 +-
 hw/audio/virtio-snd.c |  4 ++--
 hw/audio/wm8750.c     | 12 ++++++------
 hw/display/xlnx_dp.c  |  2 +-
 hw/usb/dev-audio.c    |  4 ++--
 11 files changed, 36 insertions(+), 37 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 18bc9188db..8723f4e66e 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1949,13 +1949,7 @@ void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque)
     }
 }
 
-void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol)
-{
-    Volume vol = { .mute = mute, .channels = 2, .vol = { lvol, rvol } };
-    audio_set_volume_out(sw, &vol);
-}
-
-void audio_set_volume_out(SWVoiceOut *sw, Volume *vol)
+void AUD_set_volume_out(SWVoiceOut *sw, Volume *vol)
 {
     if (sw) {
         HWVoiceOut *hw = sw->hw;
@@ -1971,13 +1965,7 @@ void audio_set_volume_out(SWVoiceOut *sw, Volume *vol)
     }
 }
 
-void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol)
-{
-    Volume vol = { .mute = mute, .channels = 2, .vol = { lvol, rvol } };
-    audio_set_volume_in(sw, &vol);
-}
-
-void audio_set_volume_in(SWVoiceIn *sw, Volume *vol)
+void AUD_set_volume_in(SWVoiceIn *sw, Volume *vol)
 {
     if (sw) {
         HWVoiceIn *hw = sw->hw;
diff --git a/audio/audio.h b/audio/audio.h
index 0af911fd9a..c8515afcd2 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -119,9 +119,6 @@ int  AUD_is_active_out (SWVoiceOut *sw);
 void     AUD_init_time_stamp_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 uint64_t AUD_get_elapsed_usec_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 
-void AUD_set_volume_out (SWVoiceOut *sw, int mute, uint8_t lvol, uint8_t rvol);
-void AUD_set_volume_in (SWVoiceIn *sw, int mute, uint8_t lvol, uint8_t rvol);
-
 #define AUDIO_MAX_CHANNELS 16
 typedef struct Volume {
     bool mute;
@@ -129,8 +126,22 @@ typedef struct Volume {
     uint8_t vol[AUDIO_MAX_CHANNELS];
 } Volume;
 
-void audio_set_volume_out(SWVoiceOut *sw, Volume *vol);
-void audio_set_volume_in(SWVoiceIn *sw, Volume *vol);
+void AUD_set_volume_out(SWVoiceOut *sw, Volume *vol);
+void AUD_set_volume_in(SWVoiceIn *sw, Volume *vol);
+
+static inline void
+AUD_set_volume_out_lr(SWVoiceOut *sw, bool mut, uint8_t lvol, uint8_t rvol) {
+    AUD_set_volume_out(sw, &(Volume) {
+        .mute = mut, .channels = 2, .vol = { lvol, rvol }
+    });
+}
+
+static inline void
+AUD_set_volume_in_lr(SWVoiceIn *sw, bool mut, uint8_t lvol, uint8_t rvol) {
+    AUD_set_volume_in(sw, &(Volume) {
+        .mute = mut, .channels = 2, .vol = { lvol, rvol }
+    });
+}
 
 SWVoiceIn *AUD_open_in (
     QEMUSoundCard *card,
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index 6b9013ebb8..c3e5f9c8bb 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -416,7 +416,7 @@ static void update_combined_volume_out(AC97LinkState *s)
     lvol = (lvol * plvol) / 255;
     rvol = (rvol * prvol) / 255;
 
-    AUD_set_volume_out(s->voice_po, mute, lvol, rvol);
+    AUD_set_volume_out_lr(s->voice_po, mute, lvol, rvol);
 }
 
 static void update_volume_in(AC97LinkState *s)
@@ -427,7 +427,7 @@ static void update_volume_in(AC97LinkState *s)
     get_volume(mixer_load(s, AC97_Record_Gain_Mute), 0x0f, 0,
                &mute, &lvol, &rvol);
 
-    AUD_set_volume_in(s->voice_pi, mute, lvol, rvol);
+    AUD_set_volume_in_lr(s->voice_pi, mute, lvol, rvol);
 }
 
 static void set_volume(AC97LinkState *s, int index, uint32_t val)
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 41472dc2e3..991316e984 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -489,7 +489,7 @@ static void asc_write(void *opaque, hwaddr addr, uint64_t value,
         {
             int vol = (value & 0xe0);
 
-            AUD_set_volume_out(s->voice, 0, vol, vol);
+            AUD_set_volume_out_lr(s->voice, 0, vol, vol);
             break;
         }
     }
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index 66edad280f..cc87557954 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -466,9 +466,9 @@ static void hda_audio_set_amp(HDAAudioStream *st)
         return;
     }
     if (st->output) {
-        AUD_set_volume_out(st->voice.out, muted, left, right);
+        AUD_set_volume_out_lr(st->voice.out, muted, left, right);
     } else {
-        AUD_set_volume_in(st->voice.in, muted, left, right);
+        AUD_set_volume_in_lr(st->voice.in, muted, left, right);
     }
 }
 
diff --git a/hw/audio/lm4549.c b/hw/audio/lm4549.c
index a4a77c8dc6..dccbf56068 100644
--- a/hw/audio/lm4549.c
+++ b/hw/audio/lm4549.c
@@ -308,7 +308,7 @@ void lm4549_init(lm4549_state *s, lm4549_callback data_req_cb, void* opaque,
         &as
     );
 
-    AUD_set_volume_out(s->voice, 0, 255, 255);
+    AUD_set_volume_out_lr(s->voice, 0, 255, 255);
 
     s->voice_is_active = 0;
 
diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
index d5231e1cf2..62341e5600 100644
--- a/hw/audio/via-ac97.c
+++ b/hw/audio/via-ac97.c
@@ -53,7 +53,7 @@ static void codec_volume_set_out(ViaAC97State *s)
     rvol /= 255;
     mute = CODEC_REG(s, AC97_Master_Volume_Mute) >> MUTE_SHIFT;
     mute |= CODEC_REG(s, AC97_PCM_Out_Volume_Mute) >> MUTE_SHIFT;
-    AUD_set_volume_out(s->vo, mute, lvol, rvol);
+    AUD_set_volume_out_lr(s->vo, mute, lvol, rvol);
 }
 
 static void codec_reset(ViaAC97State *s)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index eca3319e59..88777977a9 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -463,7 +463,7 @@ static uint32_t virtio_snd_pcm_prepare(VirtIOSound *s, uint32_t stream_id)
                                          stream,
                                          virtio_snd_pcm_out_cb,
                                          &as);
-        AUD_set_volume_out(stream->voice.out, 0, 255, 255);
+        AUD_set_volume_out_lr(stream->voice.out, 0, 255, 255);
     } else {
         stream->voice.in = AUD_open_in(&s->card,
                                         stream->voice.in,
@@ -471,7 +471,7 @@ static uint32_t virtio_snd_pcm_prepare(VirtIOSound *s, uint32_t stream_id)
                                         stream,
                                         virtio_snd_pcm_in_cb,
                                         &as);
-        AUD_set_volume_in(stream->voice.in, 0, 255, 255);
+        AUD_set_volume_in_lr(stream->voice.in, 0, 255, 255);
     }
 
     return cpu_to_le32(VIRTIO_SND_S_OK);
diff --git a/hw/audio/wm8750.c b/hw/audio/wm8750.c
index 2846b55fe2..7a36c4bd3f 100644
--- a/hw/audio/wm8750.c
+++ b/hw/audio/wm8750.c
@@ -145,30 +145,30 @@ static void wm8750_vol_update(WM8750State *s)
 {
     /* FIXME: multiply all volumes by s->invol[2], s->invol[3] */
 
-    AUD_set_volume_in(s->adc_voice[0], s->mute,
+    AUD_set_volume_in_lr(s->adc_voice[0], s->mute,
                     s->inmute[0] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[0]),
                     s->inmute[1] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[1]));
-    AUD_set_volume_in(s->adc_voice[1], s->mute,
+    AUD_set_volume_in_lr(s->adc_voice[1], s->mute,
                     s->inmute[0] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[0]),
                     s->inmute[1] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[1]));
-    AUD_set_volume_in(s->adc_voice[2], s->mute,
+    AUD_set_volume_in_lr(s->adc_voice[2], s->mute,
                     s->inmute[0] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[0]),
                     s->inmute[1] ? 0 : WM8750_INVOL_TRANSFORM(s->invol[1]));
 
     /* FIXME: multiply all volumes by s->outvol[0], s->outvol[1] */
 
     /* Speaker: LOUT2VOL ROUT2VOL */
-    AUD_set_volume_out(s->dac_voice[0], s->mute,
+    AUD_set_volume_out_lr(s->dac_voice[0], s->mute,
                     s->outmute[0] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[4]),
                     s->outmute[1] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[5]));
 
     /* Headphone: LOUT1VOL ROUT1VOL */
-    AUD_set_volume_out(s->dac_voice[1], s->mute,
+    AUD_set_volume_out_lr(s->dac_voice[1], s->mute,
                     s->outmute[0] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[2]),
                     s->outmute[1] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[3]));
 
     /* MONOOUT: MONOVOL MONOVOL */
-    AUD_set_volume_out(s->dac_voice[2], s->mute,
+    AUD_set_volume_out_lr(s->dac_voice[2], s->mute,
                     s->outmute[0] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[6]),
                     s->outmute[1] ? 0 : WM8750_OUTVOL_TRANSFORM(s->outvol[6]));
 }
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index ef73e1815f..882ae3c4b4 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1334,7 +1334,7 @@ static void xlnx_dp_realize(DeviceState *dev, Error **errp)
                                            s,
                                            xlnx_dp_audio_callback,
                                            &as);
-    AUD_set_volume_out(s->amixer_output_stream, 0, 255, 255);
+    AUD_set_volume_out_lr(s->amixer_output_stream, 0, 255, 255);
     xlnx_dp_audio_activate(s);
     s->vblank = ptimer_init(vblank_hit, s, DP_VBLANK_PTIMER_POLICY);
     ptimer_transaction_begin(s->vblank);
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index 26af709f31..f59e5a53f0 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -805,7 +805,7 @@ static int usb_audio_set_control(USBAudioState *s, uint8_t attrib,
             }
             fprintf(stderr, "\n");
         }
-        audio_set_volume_out(s->out.voice, &s->out.vol);
+        AUD_set_volume_out(s->out.voice, &s->out.vol);
     }
 
     return ret;
@@ -981,7 +981,7 @@ static void usb_audio_reinit(USBDevice *dev, unsigned channels)
 
     s->out.voice = AUD_open_out(&s->card, s->out.voice, TYPE_USB_AUDIO,
                                 s, output_callback, &s->out.as);
-    audio_set_volume_out(s->out.voice, &s->out.vol);
+    AUD_set_volume_out(s->out.voice, &s->out.vol);
     AUD_set_active_out(s->out.voice, 0);
 }
 

From 04536d704584127a971607c675516271c6eb4502 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 14:43:36 +0400
Subject: [PATCH 1822/2396] audio/replay: fix type punning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.h           | 6 ++++--
 audio/mixeng.c          | 6 ++----
 audio/mixeng.h          | 1 -
 include/system/replay.h | 3 ++-
 replay/replay-audio.c   | 2 +-
 replay/stubs-system.c   | 2 +-
 6 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/audio/audio.h b/audio/audio.h
index c8515afcd2..61ff900b7e 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -171,9 +171,11 @@ int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
 
 void audio_cleanup(void);
 
-void audio_sample_to_uint64(const void *samples, int pos,
+typedef struct st_sample st_sample;
+
+void audio_sample_to_uint64(const st_sample *sample, int pos,
                             uint64_t *left, uint64_t *right);
-void audio_sample_from_uint64(void *samples, int pos,
+void audio_sample_from_uint64(st_sample *sample, int pos,
                             uint64_t left, uint64_t right);
 
 void audio_add_audiodev(Audiodev *audio);
diff --git a/audio/mixeng.c b/audio/mixeng.c
index be38617e9b..af9ec3d4d2 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -404,7 +404,7 @@ f_sample *mixeng_clip_float[2][2] = {
     }
 };
 
-void audio_sample_to_uint64(const void *samples, int pos,
+void audio_sample_to_uint64(const st_sample *sample, int pos,
                             uint64_t *left, uint64_t *right)
 {
 #ifdef FLOAT_MIXENG
@@ -412,14 +412,13 @@ void audio_sample_to_uint64(const void *samples, int pos,
         "Coreaudio and floating point samples are not supported by replay yet");
     abort();
 #else
-    const struct st_sample *sample = samples;
     sample += pos;
     *left = sample->l;
     *right = sample->r;
 #endif
 }
 
-void audio_sample_from_uint64(void *samples, int pos,
+void audio_sample_from_uint64(st_sample *sample, int pos,
                             uint64_t left, uint64_t right)
 {
 #ifdef FLOAT_MIXENG
@@ -427,7 +426,6 @@ void audio_sample_from_uint64(void *samples, int pos,
         "Coreaudio and floating point samples are not supported by replay yet");
     abort();
 #else
-    struct st_sample *sample = samples;
     sample += pos;
     sample->l = left;
     sample->r = right;
diff --git a/audio/mixeng.h b/audio/mixeng.h
index ead93ac2f7..f63283f408 100644
--- a/audio/mixeng.h
+++ b/audio/mixeng.h
@@ -33,7 +33,6 @@ struct st_sample { mixeng_real l; mixeng_real r; };
 struct mixeng_volume { int mute; int64_t r; int64_t l; };
 struct st_sample { int64_t l; int64_t r; };
 #endif
-typedef struct st_sample st_sample;
 
 typedef void (t_sample) (struct st_sample *dst, const void *src, int samples);
 typedef void (f_sample) (void *dst, const struct st_sample *src, int samples);
diff --git a/include/system/replay.h b/include/system/replay.h
index 1c87c97fdd..1e63c0784c 100644
--- a/include/system/replay.h
+++ b/include/system/replay.h
@@ -16,6 +16,7 @@
 #include "qapi/qapi-types-run-state.h"
 #include "qapi/qapi-types-ui.h"
 #include "block/aio.h"
+#include "audio/audio.h"
 
 /* replay clock kinds */
 enum ReplayClockKind {
@@ -165,7 +166,7 @@ void replay_net_packet_event(ReplayNetState *rns, unsigned flags,
 /*! Saves/restores number of played samples of audio out operation. */
 void replay_audio_out(size_t *played);
 /*! Saves/restores recorded samples of audio in operation. */
-void replay_audio_in(size_t *recorded, void *samples, size_t *wpos, size_t size);
+void replay_audio_in(size_t *recorded, st_sample *samples, size_t *wpos, size_t size);
 
 /* VM state operations */
 
diff --git a/replay/replay-audio.c b/replay/replay-audio.c
index ed2ba2164b..3413801062 100644
--- a/replay/replay-audio.c
+++ b/replay/replay-audio.c
@@ -35,7 +35,7 @@ void replay_audio_out(size_t *played)
     }
 }
 
-void replay_audio_in(size_t *recorded, void *samples, size_t *wpos, size_t size)
+void replay_audio_in(size_t *recorded, st_sample *samples, size_t *wpos, size_t size)
 {
     int pos;
     uint64_t left, right;
diff --git a/replay/stubs-system.c b/replay/stubs-system.c
index 8f2b2d326e..7f85764936 100644
--- a/replay/stubs-system.c
+++ b/replay/stubs-system.c
@@ -15,7 +15,7 @@ void replay_input_sync_event(void)
 void replay_add_blocker(const char *feature)
 {
 }
-void replay_audio_in(size_t *recorded, void *samples, size_t *wpos, size_t size)
+void replay_audio_in(size_t *recorded, st_sample *samples, size_t *wpos, size_t size)
 {
 }
 void replay_audio_out(size_t *played)

From 6fcd22cfdb74bbe776513dcdedaf8557c860a0e5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 14:06:08 +0400
Subject: [PATCH 1823/2396] audio: move internal APIs to audio_int.h
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix some check-patch issues while at it.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio-hmp-cmds.c |  2 +-
 audio/audio.h          | 21 ---------------------
 audio/audio_int.h      | 24 ++++++++++++++++++++++++
 audio/wavcapture.c     |  2 +-
 4 files changed, 26 insertions(+), 23 deletions(-)

diff --git a/audio/audio-hmp-cmds.c b/audio/audio-hmp-cmds.c
index 8774c09f18..819f8fa9d8 100644
--- a/audio/audio-hmp-cmds.c
+++ b/audio/audio-hmp-cmds.c
@@ -23,7 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "audio/audio.h"
+#include "audio_int.h"
 #include "monitor/hmp.h"
 #include "monitor/monitor.h"
 #include "qapi/error.h"
diff --git a/audio/audio.h b/audio/audio.h
index 61ff900b7e..c0cad7d976 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -38,15 +38,6 @@ typedef struct audsettings {
     int endianness;
 } audsettings;
 
-audsettings audiodev_to_audsettings(AudiodevPerDirectionOptions *pdo);
-int audioformat_bytes_per_sample(AudioFormat fmt);
-int audio_buffer_frames(AudiodevPerDirectionOptions *pdo,
-                        audsettings *as, int def_usecs);
-int audio_buffer_samples(AudiodevPerDirectionOptions *pdo,
-                         audsettings *as, int def_usecs);
-int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
-                       audsettings *as, int def_usecs);
-
 typedef enum {
     AUD_CNOTIFY_ENABLE,
     AUD_CNOTIFY_DISABLE
@@ -88,9 +79,6 @@ typedef struct QEMUAudioTimeStamp {
     uint64_t old_ts;
 } QEMUAudioTimeStamp;
 
-void AUD_vlog (const char *cap, const char *fmt, va_list ap) G_GNUC_PRINTF(2, 0);
-void AUD_log (const char *cap, const char *fmt, ...) G_GNUC_PRINTF(2, 3);
-
 bool AUD_register_card (const char *name, QEMUSoundCard *card, Error **errp);
 void AUD_remove_card (QEMUSoundCard *card);
 CaptureVoiceOut *AUD_add_capture(
@@ -160,15 +148,6 @@ int  AUD_is_active_in (SWVoiceIn *sw);
 void     AUD_init_time_stamp_in (SWVoiceIn *sw, QEMUAudioTimeStamp *ts);
 uint64_t AUD_get_elapsed_usec_in (SWVoiceIn *sw, QEMUAudioTimeStamp *ts);
 
-static inline void *advance (void *p, int incr)
-{
-    uint8_t *d = p;
-    return (d + incr);
-}
-
-int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
-                      int freq, int bits, int nchannels);
-
 void audio_cleanup(void);
 
 typedef struct st_sample st_sample;
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 4a4d69f2bf..d1badbf235 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -29,12 +29,19 @@
 #define FLOAT_MIXENG
 /* #define RECIPROCAL */
 #endif
+#include "audio.h"
 #include "mixeng.h"
 
 #ifdef CONFIG_GIO
 #include <gio/gio.h>
 #endif
 
+void G_GNUC_PRINTF(2, 0)
+AUD_vlog(const char *cap, const char *fmt, va_list ap);
+
+void G_GNUC_PRINTF(2, 3)
+AUD_log(const char *cap, const char *fmt, ...);
+
 struct audio_pcm_ops;
 
 struct audio_callback {
@@ -187,6 +194,23 @@ struct audio_pcm_ops {
     void   (*volume_in)(HWVoiceIn *hw, Volume *vol);
 };
 
+audsettings audiodev_to_audsettings(AudiodevPerDirectionOptions *pdo);
+int audioformat_bytes_per_sample(AudioFormat fmt);
+int audio_buffer_frames(AudiodevPerDirectionOptions *pdo,
+                        audsettings *as, int def_usecs);
+int audio_buffer_samples(AudiodevPerDirectionOptions *pdo,
+                         audsettings *as, int def_usecs);
+int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
+                       audsettings *as, int def_usecs);
+
+static inline void *advance(void *p, size_t incr)
+{
+    return (uint8_t *)p + incr;
+}
+
+int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
+                      int freq, int bits, int nchannels);
+
 void audio_generic_run_buffer_in(HWVoiceIn *hw);
 void *audio_generic_get_buffer_in(HWVoiceIn *hw, size_t *size);
 void audio_generic_put_buffer_in(HWVoiceIn *hw, void *buf, size_t size);
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index b990844d48..0fbc695d23 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -1,7 +1,7 @@
 #include "qemu/osdep.h"
 #include "qemu/qemu-print.h"
 #include "qemu/error-report.h"
-#include "audio.h"
+#include "audio_int.h"
 
 typedef struct {
     FILE *f;

From 7d75c12ad113a71a8440f706121f53abfb907582 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 16:35:28 +0400
Subject: [PATCH 1824/2396] audio: rename AudioState -> AudioBackend
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Naming is hard. But in general in QEMU, a host "backend" is the term
used to fullfill the request made by the device or frontend.

AudioBackend will become an abstract base class in a follow-up series.

Currently the frontend is QEMUSoundCard, we are going to drop that next.

Note that "audiodev" is the corresponding QAPI type name (or configuration).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/alsaaudio.c                |  2 +-
 audio/audio-hmp-cmds.c           |  2 +-
 audio/audio.c                    | 90 ++++++++++++++++----------------
 audio/audio.h                    | 16 +++---
 audio/audio_int.h                | 20 +++----
 audio/audio_template.h           | 20 +++----
 audio/dbusaudio.c                |  8 +--
 audio/ossaudio.c                 |  4 +-
 audio/wavcapture.c               |  2 +-
 hw/audio/pcspk.c                 |  2 +-
 hw/core/machine.c                |  2 +-
 hw/core/qdev-properties-system.c |  6 +--
 ui/dbus.c                        |  8 +--
 ui/vnc.c                         | 10 ++--
 ui/vnc.h                         |  2 +-
 15 files changed, 97 insertions(+), 97 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 9b6c01c0ef..797cb478e6 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -41,7 +41,7 @@ struct pollhlp {
     struct pollfd *pfds;
     int count;
     int mask;
-    AudioState *s;
+    AudioBackend *s;
 };
 
 typedef struct ALSAVoiceOut {
diff --git a/audio/audio-hmp-cmds.c b/audio/audio-hmp-cmds.c
index 819f8fa9d8..1e56af21ab 100644
--- a/audio/audio-hmp-cmds.c
+++ b/audio/audio-hmp-cmds.c
@@ -67,7 +67,7 @@ void hmp_wavcapture(Monitor *mon, const QDict *qdict)
     const char *audiodev = qdict_get_str(qdict, "audiodev");
     CaptureState *s;
     Error *local_err = NULL;
-    AudioState *as = audio_state_by_name(audiodev, &local_err);
+    AudioBackend *as = audio_be_by_name(audiodev, &local_err);
 
     if (!as) {
         error_report_err(local_err);
diff --git a/audio/audio.c b/audio/audio.c
index 8723f4e66e..8044d55c5c 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -99,7 +99,7 @@ static audio_driver *audio_driver_lookup(const char *name)
     return NULL;
 }
 
-static AudioState *default_audio_state;
+static AudioBackend *default_audio_be;
 
 const struct mixeng_volume nominal_volume = {
     .mute = 0,
@@ -380,7 +380,7 @@ void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len)
 /*
  * Capture
  */
-static CaptureVoiceOut *audio_pcm_capture_find_specific(AudioState *s,
+static CaptureVoiceOut *audio_pcm_capture_find_specific(AudioBackend *s,
                                                         struct audsettings *as)
 {
     CaptureVoiceOut *cap;
@@ -460,7 +460,7 @@ static void audio_detach_capture (HWVoiceOut *hw)
 
 static int audio_attach_capture (HWVoiceOut *hw)
 {
-    AudioState *s = hw->s;
+    AudioBackend *s = hw->s;
     CaptureVoiceOut *cap;
 
     audio_detach_capture (hw);
@@ -798,7 +798,7 @@ static void audio_pcm_print_info (const char *cap, struct audio_pcm_info *info)
 /*
  * Timer
  */
-static int audio_is_timer_needed(AudioState *s)
+static int audio_is_timer_needed(AudioBackend *s)
 {
     HWVoiceIn *hwi = NULL;
     HWVoiceOut *hwo = NULL;
@@ -816,7 +816,7 @@ static int audio_is_timer_needed(AudioState *s)
     return 0;
 }
 
-static void audio_reset_timer (AudioState *s)
+static void audio_reset_timer(AudioBackend *s)
 {
     if (audio_is_timer_needed(s)) {
         timer_mod_anticipate_ns(s->ts,
@@ -838,7 +838,7 @@ static void audio_reset_timer (AudioState *s)
 static void audio_timer (void *opaque)
 {
     int64_t now, diff;
-    AudioState *s = opaque;
+    AudioBackend *s = opaque;
 
     now = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
     diff = now - s->timer_last;
@@ -921,7 +921,7 @@ void AUD_set_active_out (SWVoiceOut *sw, int on)
 
     hw = sw->hw;
     if (sw->active != on) {
-        AudioState *s = sw->s;
+        AudioBackend *s = sw->s;
         SWVoiceOut *temp_sw;
         SWVoiceCap *sc;
 
@@ -969,7 +969,7 @@ void AUD_set_active_in (SWVoiceIn *sw, int on)
 
     hw = sw->hw;
     if (sw->active != on) {
-        AudioState *s = sw->s;
+        AudioBackend *s = sw->s;
         SWVoiceIn *temp_sw;
 
         if (on) {
@@ -1137,7 +1137,7 @@ static size_t audio_pcm_hw_run_out(HWVoiceOut *hw, size_t live)
     return clipped;
 }
 
-static void audio_run_out (AudioState *s)
+static void audio_run_out(AudioBackend *s)
 {
     HWVoiceOut *hw = NULL;
     SWVoiceOut *sw;
@@ -1291,7 +1291,7 @@ static size_t audio_pcm_hw_run_in(HWVoiceIn *hw, size_t samples)
     return conv;
 }
 
-static void audio_run_in (AudioState *s)
+static void audio_run_in(AudioBackend *s)
 {
     HWVoiceIn *hw = NULL;
 
@@ -1339,7 +1339,7 @@ static void audio_run_in (AudioState *s)
     }
 }
 
-static void audio_run_capture (AudioState *s)
+static void audio_run_capture(AudioBackend *s)
 {
     CaptureVoiceOut *cap;
 
@@ -1386,7 +1386,7 @@ static void audio_run_capture (AudioState *s)
     }
 }
 
-void audio_run(AudioState *s, const char *msg)
+void audio_run(AudioBackend *s, const char *msg)
 {
     audio_run_out(s);
     audio_run_in(s);
@@ -1559,7 +1559,7 @@ size_t audio_generic_read(HWVoiceIn *hw, void *buf, size_t size)
     return total;
 }
 
-static bool audio_driver_init(AudioState *s, struct audio_driver *drv,
+static bool audio_driver_init(AudioBackend *s, struct audio_driver *drv,
                               Audiodev *dev, Error **errp)
 {
     s->drv_opaque = drv->init(dev, errp);
@@ -1592,7 +1592,7 @@ static bool audio_driver_init(AudioState *s, struct audio_driver *drv,
 static void audio_vm_change_state_handler (void *opaque, bool running,
                                            RunState state)
 {
-    AudioState *s = opaque;
+    AudioBackend *s = opaque;
     HWVoiceOut *hwo = NULL;
     HWVoiceIn *hwi = NULL;
 
@@ -1613,9 +1613,9 @@ static void audio_vm_change_state_handler (void *opaque, bool running,
 
 static const VMStateDescription vmstate_audio;
 
-static void audio_state_init(Object *obj)
+static void audio_be_init(Object *obj)
 {
-    AudioState *s = AUDIO_STATE(obj);
+    AudioBackend *s = AUDIO_BACKEND(obj);
 
     QLIST_INIT(&s->hw_head_out);
     QLIST_INIT(&s->hw_head_in);
@@ -1629,9 +1629,9 @@ static void audio_state_init(Object *obj)
     vmstate_register_any(NULL, &vmstate_audio, s);
 }
 
-static void audio_state_finalize(Object *obj)
+static void audio_be_finalize(Object *obj)
 {
-    AudioState *s = AUDIO_STATE(obj);
+    AudioBackend *s = AUDIO_BACKEND(obj);
     HWVoiceOut *hwo, *hwon;
     HWVoiceIn *hwi, *hwin;
 
@@ -1692,7 +1692,7 @@ static Object *get_audiodevs_root(void)
 
 void audio_cleanup(void)
 {
-    default_audio_state = NULL;
+    default_audio_be = NULL;
 
     object_unparent(get_audiodevs_root());
 }
@@ -1743,14 +1743,14 @@ void audio_create_default_audiodevs(void)
  * if dev == NULL => legacy implicit initialization, return the already created
  *   state or create a new one
  */
-static AudioState *audio_init(Audiodev *dev, Error **errp)
+static AudioBackend *audio_init(Audiodev *dev, Error **errp)
 {
     int done = 0;
     const char *drvname;
-    AudioState *s;
+    AudioBackend *s;
     struct audio_driver *driver;
 
-    s = AUDIO_STATE(object_new(TYPE_AUDIO_STATE));
+    s = AUDIO_BACKEND(object_new(TYPE_AUDIO_BACKEND));
 
     if (dev) {
         /* -audiodev option */
@@ -1766,7 +1766,7 @@ static AudioState *audio_init(Audiodev *dev, Error **errp)
             goto out;
         }
     } else {
-        assert(!default_audio_state);
+        assert(!default_audio_be);
         for (;;) {
             AudiodevListEntry *e = QSIMPLEQ_FIRST(&default_audiodevs);
             if (!e) {
@@ -1797,11 +1797,11 @@ out:
     return NULL;
 }
 
-AudioState *audio_get_default_audio_state(Error **errp)
+AudioBackend *audio_get_default_audio_be(Error **errp)
 {
-    if (!default_audio_state) {
-        default_audio_state = audio_init(NULL, errp);
-        if (!default_audio_state) {
+    if (!default_audio_be) {
+        default_audio_be = audio_init(NULL, errp);
+        if (!default_audio_be) {
             if (!QSIMPLEQ_EMPTY(&audiodevs)) {
                 error_append_hint(errp, "Perhaps you wanted to use -audio or set audiodev=%s?\n",
                                   QSIMPLEQ_FIRST(&audiodevs)->dev->id);
@@ -1809,21 +1809,21 @@ AudioState *audio_get_default_audio_state(Error **errp)
         }
     }
 
-    return default_audio_state;
+    return default_audio_be;
 }
 
 bool AUD_register_card (const char *name, QEMUSoundCard *card, Error **errp)
 {
-    if (!card->state) {
-        card->state = audio_get_default_audio_state(errp);
-        if (!card->state) {
+    if (!card->be) {
+        card->be = audio_get_default_audio_be(errp);
+        if (!card->be) {
             return false;
         }
     }
 
     card->name = g_strdup (name);
     memset (&card->entries, 0, sizeof (card->entries));
-    QLIST_INSERT_HEAD(&card->state->card_head, card, entries);
+    QLIST_INSERT_HEAD(&card->be->card_head, card, entries);
 
     return true;
 }
@@ -1837,7 +1837,7 @@ void AUD_remove_card (QEMUSoundCard *card)
 static struct audio_pcm_ops capture_pcm_ops;
 
 CaptureVoiceOut *AUD_add_capture(
-    AudioState *s,
+    AudioBackend *s,
     struct audsettings *as,
     struct audio_capture_ops *ops,
     void *cb_opaque
@@ -2220,7 +2220,7 @@ int audio_buffer_bytes(AudiodevPerDirectionOptions *pdo,
         audioformat_bytes_per_sample(as->fmt);
 }
 
-AudioState *audio_state_by_name(const char *name, Error **errp)
+AudioBackend *audio_be_by_name(const char *name, Error **errp)
 {
     Object *obj = object_resolve_path_component(get_audiodevs_root(), name);
 
@@ -2228,15 +2228,15 @@ AudioState *audio_state_by_name(const char *name, Error **errp)
         error_setg(errp, "audiodev '%s' not found", name);
         return NULL;
     } else {
-        return AUDIO_STATE(obj);
+        return AUDIO_BACKEND(obj);
     }
 }
 
 const char *audio_get_id(QEMUSoundCard *card)
 {
-    if (card->state) {
-        assert(card->state->dev);
-        return card->state->dev->id;
+    if (card->be) {
+        assert(card->be->dev);
+        return card->be->dev->id;
     } else {
         return "";
     }
@@ -2305,19 +2305,19 @@ AudiodevList *qmp_query_audiodevs(Error **errp)
     return ret;
 }
 
-static const TypeInfo audio_state_info = {
-    .name = TYPE_AUDIO_STATE,
+static const TypeInfo audio_be_info = {
+    .name = TYPE_AUDIO_BACKEND,
     .parent = TYPE_OBJECT,
-    .instance_size = sizeof(AudioState),
-    .instance_init = audio_state_init,
-    .instance_finalize = audio_state_finalize,
+    .instance_size = sizeof(AudioBackend),
+    .instance_init = audio_be_init,
+    .instance_finalize = audio_be_finalize,
     .abstract = false, /* TODO: subclass drivers and make it abstract */
-    .class_size = sizeof(AudioStateClass),
+    .class_size = sizeof(AudioBackendClass),
 };
 
 static void register_types(void)
 {
-    type_register_static(&audio_state_info);
+    type_register_static(&audio_be_info);
 }
 
 type_init(register_types);
diff --git a/audio/audio.h b/audio/audio.h
index c0cad7d976..1d56f111ea 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -64,14 +64,14 @@ typedef struct SWVoiceOut SWVoiceOut;
 typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
 
-struct AudioStateClass {
+struct AudioBackendClass {
     ObjectClass parent_class;
 };
 
-typedef struct AudioState AudioState;
+typedef struct AudioBackend AudioBackend;
 typedef struct QEMUSoundCard {
     char *name;
-    AudioState *state;
+    AudioBackend *be;
     QLIST_ENTRY (QEMUSoundCard) entries;
 } QEMUSoundCard;
 
@@ -82,7 +82,7 @@ typedef struct QEMUAudioTimeStamp {
 bool AUD_register_card (const char *name, QEMUSoundCard *card, Error **errp);
 void AUD_remove_card (QEMUSoundCard *card);
 CaptureVoiceOut *AUD_add_capture(
-    AudioState *s,
+    AudioBackend *s,
     struct audsettings *as,
     struct audio_capture_ops *ops,
     void *opaque
@@ -164,14 +164,14 @@ void audio_create_default_audiodevs(void);
 void audio_init_audiodevs(void);
 void audio_help(void);
 
-AudioState *audio_state_by_name(const char *name, Error **errp);
-AudioState *audio_get_default_audio_state(Error **errp);
+AudioBackend *audio_be_by_name(const char *name, Error **errp);
+AudioBackend *audio_get_default_audio_be(Error **errp);
 const char *audio_get_id(QEMUSoundCard *card);
 
 #define DEFINE_AUDIO_PROPERTIES(_s, _f)         \
     DEFINE_PROP_AUDIODEV("audiodev", _s, _f)
 
-#define TYPE_AUDIO_STATE "audio-state"
-OBJECT_DECLARE_TYPE(AudioState, AudioStateClass, AUDIO_STATE)
+#define TYPE_AUDIO_BACKEND "audio-backend"
+OBJECT_DECLARE_TYPE(AudioBackend, AudioBackendClass, AUDIO_BACKEND)
 
 #endif /* QEMU_AUDIO_H */
diff --git a/audio/audio_int.h b/audio/audio_int.h
index d1badbf235..338af38fd1 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -60,7 +60,7 @@ struct audio_pcm_info {
     int swap_endianness;
 };
 
-typedef struct AudioState AudioState;
+typedef struct AudioBackend AudioBackend;
 typedef struct SWVoiceCap SWVoiceCap;
 
 typedef struct STSampleBuffer {
@@ -69,7 +69,7 @@ typedef struct STSampleBuffer {
 } STSampleBuffer;
 
 typedef struct HWVoiceOut {
-    AudioState *s;
+    AudioBackend *s;
     int enabled;
     int poll_mode;
     int pending_disable;
@@ -90,7 +90,7 @@ typedef struct HWVoiceOut {
 } HWVoiceOut;
 
 typedef struct HWVoiceIn {
-    AudioState *s;
+    AudioBackend *s;
     int enabled;
     int poll_mode;
     struct audio_pcm_info info;
@@ -112,7 +112,7 @@ typedef struct HWVoiceIn {
 
 struct SWVoiceOut {
     QEMUSoundCard *card;
-    AudioState *s;
+    AudioBackend *s;
     struct audio_pcm_info info;
     t_sample *conv;
     STSampleBuffer resample_buf;
@@ -129,7 +129,7 @@ struct SWVoiceOut {
 
 struct SWVoiceIn {
     QEMUSoundCard *card;
-    AudioState *s;
+    AudioBackend *s;
     int active;
     struct audio_pcm_info info;
     void *rate;
@@ -150,7 +150,7 @@ struct audio_driver {
     void *(*init) (Audiodev *, Error **);
     void (*fini) (void *);
 #ifdef CONFIG_GIO
-    void (*set_dbus_server) (AudioState *s, GDBusObjectManagerServer *manager, bool p2p);
+    void (*set_dbus_server)(AudioBackend *s, GDBusObjectManagerServer *manager, bool p2p);
 #endif
     struct audio_pcm_ops *pcm_ops;
     int max_voices_out;
@@ -208,7 +208,7 @@ static inline void *advance(void *p, size_t incr)
     return (uint8_t *)p + incr;
 }
 
-int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
+int wav_start_capture(AudioBackend *state, CaptureState *s, const char *path,
                       int freq, int bits, int nchannels);
 
 void audio_generic_run_buffer_in(HWVoiceIn *hw);
@@ -240,7 +240,7 @@ struct SWVoiceCap {
     QLIST_ENTRY (SWVoiceCap) entries;
 };
 
-typedef struct AudioState {
+typedef struct AudioBackend {
     Object parent;
 
     struct audio_driver *drv;
@@ -260,7 +260,7 @@ typedef struct AudioState {
     bool timer_running;
     uint64_t timer_last;
     VMChangeStateEntry *vmse;
-} AudioState;
+} AudioBackend;
 
 extern const struct mixeng_volume nominal_volume;
 
@@ -273,7 +273,7 @@ void audio_pcm_info_clear_buf (struct audio_pcm_info *info, void *buf, int len);
 
 int audio_bug (const char *funcname, int cond);
 
-void audio_run(AudioState *s, const char *msg);
+void audio_run(AudioBackend *s, const char *msg);
 
 const char *audio_application_name(void);
 
diff --git a/audio/audio_template.h b/audio/audio_template.h
index c29d79c443..b3c10a0709 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -36,7 +36,7 @@
 #define HWBUF hw->conv_buf
 #endif
 
-static void glue(audio_init_nb_voices_, TYPE)(AudioState *s,
+static void glue(audio_init_nb_voices_, TYPE)(AudioBackend *s,
                                               struct audio_driver *drv, int min_voices)
 {
     int max_voices = glue (drv->max_voices_, TYPE);
@@ -221,7 +221,7 @@ static void glue (audio_pcm_hw_del_sw_, TYPE) (SW *sw)
 static void glue (audio_pcm_hw_gc_, TYPE) (HW **hwp)
 {
     HW *hw = *hwp;
-    AudioState *s = hw->s;
+    AudioBackend *s = hw->s;
 
     if (!hw->sw_head.lh_first) {
 #ifdef DAC
@@ -236,12 +236,12 @@ static void glue (audio_pcm_hw_gc_, TYPE) (HW **hwp)
     }
 }
 
-static HW *glue(audio_pcm_hw_find_any_, TYPE)(AudioState *s, HW *hw)
+static HW *glue(audio_pcm_hw_find_any_, TYPE)(AudioBackend *s, HW *hw)
 {
     return hw ? hw->entries.le_next : glue (s->hw_head_, TYPE).lh_first;
 }
 
-static HW *glue(audio_pcm_hw_find_any_enabled_, TYPE)(AudioState *s, HW *hw)
+static HW *glue(audio_pcm_hw_find_any_enabled_, TYPE)(AudioBackend *s, HW *hw)
 {
     while ((hw = glue(audio_pcm_hw_find_any_, TYPE)(s, hw))) {
         if (hw->enabled) {
@@ -251,7 +251,7 @@ static HW *glue(audio_pcm_hw_find_any_enabled_, TYPE)(AudioState *s, HW *hw)
     return NULL;
 }
 
-static HW *glue(audio_pcm_hw_find_specific_, TYPE)(AudioState *s, HW *hw,
+static HW *glue(audio_pcm_hw_find_specific_, TYPE)(AudioBackend *s, HW *hw,
                                                    struct audsettings *as)
 {
     while ((hw = glue(audio_pcm_hw_find_any_, TYPE)(s, hw))) {
@@ -262,7 +262,7 @@ static HW *glue(audio_pcm_hw_find_specific_, TYPE)(AudioState *s, HW *hw,
     return NULL;
 }
 
-static HW *glue(audio_pcm_hw_add_new_, TYPE)(AudioState *s,
+static HW *glue(audio_pcm_hw_add_new_, TYPE)(AudioBackend *s,
                                              struct audsettings *as)
 {
     HW *hw;
@@ -398,7 +398,7 @@ AudiodevPerDirectionOptions *glue(audio_get_pdo_, TYPE)(Audiodev *dev)
     abort();
 }
 
-static HW *glue(audio_pcm_hw_add_, TYPE)(AudioState *s, struct audsettings *as)
+static HW *glue(audio_pcm_hw_add_, TYPE)(AudioBackend *s, struct audsettings *as)
 {
     HW *hw;
     AudiodevPerDirectionOptions *pdo = glue(audio_get_pdo_, TYPE)(s->dev);
@@ -424,7 +424,7 @@ static HW *glue(audio_pcm_hw_add_, TYPE)(AudioState *s, struct audsettings *as)
 }
 
 static SW *glue(audio_pcm_create_voice_pair_, TYPE)(
-    AudioState *s,
+    AudioBackend *s,
     const char *sw_name,
     struct audsettings *as
     )
@@ -494,7 +494,7 @@ SW *glue (AUD_open_, TYPE) (
     struct audsettings *as
     )
 {
-    AudioState *s;
+    AudioBackend *s;
     AudiodevPerDirectionOptions *pdo;
 
     if (audio_bug(__func__, !card || !name || !callback_fn || !as)) {
@@ -503,7 +503,7 @@ SW *glue (AUD_open_, TYPE) (
         goto fail;
     }
 
-    s = card->state;
+    s = card->be;
     pdo = glue(audio_get_pdo_, TYPE)(s->dev);
 
     ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index 908214a170..49cef38e3e 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -458,7 +458,7 @@ listener_in_vanished_cb(GDBusConnection *connection,
 }
 
 static gboolean
-dbus_audio_register_listener(AudioState *s,
+dbus_audio_register_listener(AudioBackend *s,
                              GDBusMethodInvocation *invocation,
 #ifdef G_OS_UNIX
                              GUnixFDList *fd_list,
@@ -615,7 +615,7 @@ dbus_audio_register_listener(AudioState *s,
 }
 
 static gboolean
-dbus_audio_register_out_listener(AudioState *s,
+dbus_audio_register_out_listener(AudioBackend *s,
                                  GDBusMethodInvocation *invocation,
 #ifdef G_OS_UNIX
                                  GUnixFDList *fd_list,
@@ -631,7 +631,7 @@ dbus_audio_register_out_listener(AudioState *s,
 }
 
 static gboolean
-dbus_audio_register_in_listener(AudioState *s,
+dbus_audio_register_in_listener(AudioBackend *s,
                                 GDBusMethodInvocation *invocation,
 #ifdef G_OS_UNIX
                                 GUnixFDList *fd_list,
@@ -646,7 +646,7 @@ dbus_audio_register_in_listener(AudioState *s,
 }
 
 static void
-dbus_audio_set_server(AudioState *s, GDBusObjectManagerServer *server, bool p2p)
+dbus_audio_set_server(AudioBackend *s, GDBusObjectManagerServer *server, bool p2p)
 {
     DBusAudio *da = s->drv_opaque;
 
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index c5858284a1..4a549b26a2 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -107,13 +107,13 @@ static void oss_anal_close (int *fdp)
 
 static void oss_helper_poll_out (void *opaque)
 {
-    AudioState *s = opaque;
+    AudioBackend *s = opaque;
     audio_run(s, "oss_poll_out");
 }
 
 static void oss_helper_poll_in (void *opaque)
 {
-    AudioState *s = opaque;
+    AudioBackend *s = opaque;
     audio_run(s, "oss_poll_in");
 }
 
diff --git a/audio/wavcapture.c b/audio/wavcapture.c
index 0fbc695d23..b33a38ff45 100644
--- a/audio/wavcapture.c
+++ b/audio/wavcapture.c
@@ -103,7 +103,7 @@ static struct capture_ops wav_capture_ops = {
     .info = wav_capture_info
 };
 
-int wav_start_capture(AudioState *state, CaptureState *s, const char *path,
+int wav_start_capture(AudioBackend *state, CaptureState *s, const char *path,
                       int freq, int bits, int nchannels)
 {
     WAVState *wav;
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index 48ef830292..e0b0949918 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -196,7 +196,7 @@ static void pcspk_realizefn(DeviceState *dev, Error **errp)
 
     isa_register_ioport(isadev, &s->ioport, s->iobase);
 
-    if (s->card.state && AUD_register_card(s_spk, &s->card, errp)) {
+    if (s->card.be && AUD_register_card(s_spk, &s->card, errp)) {
         pcspk_audio_init(s);
     }
 }
diff --git a/hw/core/machine.c b/hw/core/machine.c
index cd63803000..28d2833c5d 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -760,7 +760,7 @@ static void machine_set_audiodev(Object *obj, const char *value,
 {
     MachineState *ms = MACHINE(obj);
 
-    if (!audio_state_by_name(value, errp)) {
+    if (!audio_be_by_name(value, errp)) {
         return;
     }
 
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 13cc91680b..4d815684d1 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -499,16 +499,16 @@ static void set_audiodev(Object *obj, Visitor *v, const char* name,
 {
     const Property *prop = opaque;
     QEMUSoundCard *card = object_field_prop_ptr(obj, prop);
-    AudioState *state;
+    AudioBackend *state;
     g_autofree char *str = NULL;
 
     if (!visit_type_str(v, name, &str, errp)) {
         return;
     }
 
-    state = audio_state_by_name(str, errp);
+    state = audio_be_by_name(str, errp);
     if (state) {
-        card->state = state;
+        card->be = state;
     }
 }
 
diff --git a/ui/dbus.c b/ui/dbus.c
index dd0336702d..84cff47ec7 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -220,16 +220,16 @@ dbus_display_complete(UserCreatable *uc, Error **errp)
     }
 
     if (dd->audiodev && *dd->audiodev) {
-        AudioState *audio_state = audio_state_by_name(dd->audiodev, errp);
-        if (!audio_state) {
+        AudioBackend *audio_be = audio_be_by_name(dd->audiodev, errp);
+        if (!audio_be) {
             return;
         }
-        if (!g_str_equal(audio_state->drv->name, "dbus")) {
+        if (!g_str_equal(audio_be->drv->name, "dbus")) {
             error_setg(errp, "Audiodev '%s' is not compatible with DBus",
                        dd->audiodev);
             return;
         }
-        audio_state->drv->set_dbus_server(audio_state, dd->server, dd->p2p);
+        audio_be->drv->set_dbus_server(audio_be, dd->server, dd->p2p);
     }
 
     consoles = g_array_new(FALSE, FALSE, sizeof(guint32));
diff --git a/ui/vnc.c b/ui/vnc.c
index 77c823bf2e..0094ec680c 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -1276,7 +1276,7 @@ static void audio_add(VncState *vs)
     ops.destroy = audio_capture_destroy;
     ops.capture = audio_capture;
 
-    vs->audio_cap = AUD_add_capture(vs->vd->audio_state, &vs->as, &ops, vs);
+    vs->audio_cap = AUD_add_capture(vs->vd->audio_be, &vs->as, &ops, vs);
     if (!vs->audio_cap) {
         error_report("Failed to add audio capture");
     }
@@ -2193,7 +2193,7 @@ static void set_encodings(VncState *vs, int32_t *encodings, size_t n_encodings)
             send_ext_key_event_ack(vs);
             break;
         case VNC_ENCODING_AUDIO:
-            if (vs->vd->audio_state) {
+            if (vs->vd->audio_be) {
                 vnc_set_feature(vs, VNC_FEATURE_AUDIO);
                 send_ext_audio_ack(vs);
             }
@@ -4236,12 +4236,12 @@ void vnc_display_open(const char *id, Error **errp)
 
     audiodev = qemu_opt_get(opts, "audiodev");
     if (audiodev) {
-        vd->audio_state = audio_state_by_name(audiodev, errp);
-        if (!vd->audio_state) {
+        vd->audio_be = audio_be_by_name(audiodev, errp);
+        if (!vd->audio_be) {
             goto fail;
         }
     } else {
-        vd->audio_state = audio_get_default_audio_state(NULL);
+        vd->audio_be = audio_get_default_audio_be(NULL);
     }
 
     device_id = qemu_opt_get(opts, "display");
diff --git a/ui/vnc.h b/ui/vnc.h
index f2dab2f4d9..e2137c5ed1 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -184,7 +184,7 @@ struct VncDisplay
     VncDisplaySASL sasl;
 #endif
 
-    AudioState *audio_state;
+    AudioBackend *audio_be;
 
     VMChangeStateEntry *vmstate_handler_entry;
 };

From 9628ad8a6efbf097046f84898a2409ac357b22a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 21 Oct 2025 17:07:43 +0400
Subject: [PATCH 1825/2396] audio: remove QEMUSoundCard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There is no clear need for this extra intermediary structure between
the audio backend and its user.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c                       | 29 ++++++++++-------------------
 audio/audio.h                       | 21 ++++++++-------------
 audio/audio_int.h                   |  3 ---
 audio/audio_template.h              | 22 ++++++++++------------
 hw/audio/ac97.c                     | 25 ++++++++++++-------------
 hw/audio/adlib.c                    |  9 ++++-----
 hw/audio/asc.c                      |  9 +++------
 hw/audio/cs4231a.c                  |  8 ++++----
 hw/audio/es1370.c                   | 23 +++++++++++------------
 hw/audio/gus.c                      |  9 ++++-----
 hw/audio/hda-codec.c                | 15 +++++++--------
 hw/audio/lm4549.c                   |  8 ++++----
 hw/audio/lm4549.h                   |  2 +-
 hw/audio/pcspk.c                    |  9 +++++----
 hw/audio/pl041.c                    |  2 +-
 hw/audio/sb16.c                     | 16 ++++++++--------
 hw/audio/via-ac97.c                 |  9 ++++-----
 hw/audio/virtio-snd.c               | 13 ++++++-------
 hw/audio/wm8750.c                   | 23 +++++++++++------------
 hw/core/qdev-properties-system.c    | 11 +++++------
 hw/display/xlnx_dp.c                |  6 +++---
 hw/usb/dev-audio.c                  | 11 +++++------
 include/hw/audio/asc.h              |  2 +-
 include/hw/audio/virtio-snd.h       |  2 +-
 include/hw/display/xlnx_dp.h        |  2 +-
 include/hw/isa/vt82c686.h           |  2 +-
 include/hw/qdev-properties-system.h |  2 +-
 27 files changed, 131 insertions(+), 162 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 8044d55c5c..d9a5695eb8 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -1620,7 +1620,6 @@ static void audio_be_init(Object *obj)
     QLIST_INIT(&s->hw_head_out);
     QLIST_INIT(&s->hw_head_in);
     QLIST_INIT(&s->cap_head);
-    QLIST_INIT(&s->card_head);
     s->ts = timer_new_ns(QEMU_CLOCK_VIRTUAL, audio_timer, s);
 
     s->vmse = qemu_add_vm_change_state_handler(audio_vm_change_state_handler, s);
@@ -1812,28 +1811,20 @@ AudioBackend *audio_get_default_audio_be(Error **errp)
     return default_audio_be;
 }
 
-bool AUD_register_card (const char *name, QEMUSoundCard *card, Error **errp)
+bool AUD_backend_check(AudioBackend **be, Error **errp)
 {
-    if (!card->be) {
-        card->be = audio_get_default_audio_be(errp);
-        if (!card->be) {
+    assert(be != NULL);
+
+    if (!*be) {
+        *be = audio_get_default_audio_be(errp);
+        if (!*be) {
             return false;
         }
     }
 
-    card->name = g_strdup (name);
-    memset (&card->entries, 0, sizeof (card->entries));
-    QLIST_INSERT_HEAD(&card->be->card_head, card, entries);
-
     return true;
 }
 
-void AUD_remove_card (QEMUSoundCard *card)
-{
-    QLIST_REMOVE (card, entries);
-    g_free (card->name);
-}
-
 static struct audio_pcm_ops capture_pcm_ops;
 
 CaptureVoiceOut *AUD_add_capture(
@@ -2232,11 +2223,11 @@ AudioBackend *audio_be_by_name(const char *name, Error **errp)
     }
 }
 
-const char *audio_get_id(QEMUSoundCard *card)
+const char *audio_be_get_id(AudioBackend *be)
 {
-    if (card->be) {
-        assert(card->be->dev);
-        return card->be->dev->id;
+    if (be) {
+        assert(be->dev);
+        return be->dev->id;
     } else {
         return "";
     }
diff --git a/audio/audio.h b/audio/audio.h
index 1d56f111ea..0a016bdabc 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -69,18 +69,13 @@ struct AudioBackendClass {
 };
 
 typedef struct AudioBackend AudioBackend;
-typedef struct QEMUSoundCard {
-    char *name;
-    AudioBackend *be;
-    QLIST_ENTRY (QEMUSoundCard) entries;
-} QEMUSoundCard;
 
 typedef struct QEMUAudioTimeStamp {
     uint64_t old_ts;
 } QEMUAudioTimeStamp;
 
-bool AUD_register_card (const char *name, QEMUSoundCard *card, Error **errp);
-void AUD_remove_card (QEMUSoundCard *card);
+bool AUD_backend_check(AudioBackend **be, Error **errp);
+
 CaptureVoiceOut *AUD_add_capture(
     AudioBackend *s,
     struct audsettings *as,
@@ -90,7 +85,7 @@ CaptureVoiceOut *AUD_add_capture(
 void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque);
 
 SWVoiceOut *AUD_open_out (
-    QEMUSoundCard *card,
+    AudioBackend *be,
     SWVoiceOut *sw,
     const char *name,
     void *callback_opaque,
@@ -98,7 +93,7 @@ SWVoiceOut *AUD_open_out (
     struct audsettings *settings
     );
 
-void AUD_close_out (QEMUSoundCard *card, SWVoiceOut *sw);
+void AUD_close_out (AudioBackend *be, SWVoiceOut *sw);
 size_t AUD_write (SWVoiceOut *sw, void *pcm_buf, size_t size);
 int  AUD_get_buffer_size_out (SWVoiceOut *sw);
 void AUD_set_active_out (SWVoiceOut *sw, int on);
@@ -131,8 +126,8 @@ AUD_set_volume_in_lr(SWVoiceIn *sw, bool mut, uint8_t lvol, uint8_t rvol) {
     });
 }
 
-SWVoiceIn *AUD_open_in (
-    QEMUSoundCard *card,
+SWVoiceIn *AUD_open_in(
+    AudioBackend *be,
     SWVoiceIn *sw,
     const char *name,
     void *callback_opaque,
@@ -140,7 +135,7 @@ SWVoiceIn *AUD_open_in (
     struct audsettings *settings
     );
 
-void AUD_close_in (QEMUSoundCard *card, SWVoiceIn *sw);
+void AUD_close_in(AudioBackend *be, SWVoiceIn *sw);
 size_t AUD_read (SWVoiceIn *sw, void *pcm_buf, size_t size);
 void AUD_set_active_in (SWVoiceIn *sw, int on);
 int  AUD_is_active_in (SWVoiceIn *sw);
@@ -166,7 +161,7 @@ void audio_help(void);
 
 AudioBackend *audio_be_by_name(const char *name, Error **errp);
 AudioBackend *audio_get_default_audio_be(Error **errp);
-const char *audio_get_id(QEMUSoundCard *card);
+const char *audio_be_get_id(AudioBackend *be);
 
 #define DEFINE_AUDIO_PROPERTIES(_s, _f)         \
     DEFINE_PROP_AUDIODEV("audiodev", _s, _f)
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 338af38fd1..c4453b3a29 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -111,7 +111,6 @@ typedef struct HWVoiceIn {
 } HWVoiceIn;
 
 struct SWVoiceOut {
-    QEMUSoundCard *card;
     AudioBackend *s;
     struct audio_pcm_info info;
     t_sample *conv;
@@ -128,7 +127,6 @@ struct SWVoiceOut {
 };
 
 struct SWVoiceIn {
-    QEMUSoundCard *card;
     AudioBackend *s;
     int active;
     struct audio_pcm_info info;
@@ -248,7 +246,6 @@ typedef struct AudioBackend {
     void *drv_opaque;
 
     QEMUTimer *ts;
-    QLIST_HEAD (card_listhead, QEMUSoundCard) card_head;
     QLIST_HEAD (hw_in_listhead, HWVoiceIn) hw_head_in;
     QLIST_HEAD (hw_out_listhead, HWVoiceOut) hw_head_out;
     QLIST_HEAD (cap_listhead, CaptureVoiceOut) cap_head;
diff --git a/audio/audio_template.h b/audio/audio_template.h
index b3c10a0709..d621008f38 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -473,11 +473,11 @@ static void glue (audio_close_, TYPE) (SW *sw)
     g_free (sw);
 }
 
-void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
+void glue(AUD_close_, TYPE)(AudioBackend *be, SW *sw)
 {
     if (sw) {
-        if (audio_bug(__func__, !card)) {
-            dolog ("card=%p\n", card);
+        if (audio_bug(__func__, !be)) {
+            dolog("backend=%p\n", be);
             return;
         }
 
@@ -486,7 +486,7 @@ void glue (AUD_close_, TYPE) (QEMUSoundCard *card, SW *sw)
 }
 
 SW *glue (AUD_open_, TYPE) (
-    QEMUSoundCard *card,
+    AudioBackend *be,
     SW *sw,
     const char *name,
     void *callback_opaque ,
@@ -494,16 +494,15 @@ SW *glue (AUD_open_, TYPE) (
     struct audsettings *as
     )
 {
-    AudioBackend *s;
+    AudioBackend *s = be;
     AudiodevPerDirectionOptions *pdo;
 
-    if (audio_bug(__func__, !card || !name || !callback_fn || !as)) {
-        dolog ("card=%p name=%p callback_fn=%p as=%p\n",
-               card, name, callback_fn, as);
+    if (audio_bug(__func__, !be || !name || !callback_fn || !as)) {
+        dolog("backend=%p name=%p callback_fn=%p as=%p\n",
+              be, name, callback_fn, as);
         goto fail;
     }
 
-    s = card->be;
     pdo = glue(audio_get_pdo_, TYPE)(s->dev);
 
     ldebug ("open %s, freq %d, nchannels %d, fmt %d\n",
@@ -524,7 +523,7 @@ SW *glue (AUD_open_, TYPE) (
     }
 
     if (!pdo->fixed_settings && sw) {
-        glue (AUD_close_, TYPE) (card, sw);
+        glue(AUD_close_, TYPE)(be, sw);
         sw = NULL;
     }
 
@@ -548,7 +547,6 @@ SW *glue (AUD_open_, TYPE) (
         }
     }
 
-    sw->card = card;
     sw->vol = nominal_volume;
     sw->callback.fn = callback_fn;
     sw->callback.opaque = callback_opaque;
@@ -562,7 +560,7 @@ SW *glue (AUD_open_, TYPE) (
     return sw;
 
  fail:
-    glue (AUD_close_, TYPE) (card, sw);
+    glue(AUD_close_, TYPE)(be, sw);
     return NULL;
 }
 
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index c3e5f9c8bb..a91bf52b95 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -120,7 +120,7 @@ typedef struct AC97BusMasterRegs {
 
 struct AC97LinkState {
     PCIDevice dev;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     uint32_t glob_cnt;
     uint32_t glob_sta;
     uint32_t cas;
@@ -320,7 +320,7 @@ static void open_voice(AC97LinkState *s, int index, int freq)
         switch (index) {
         case PI_INDEX:
             s->voice_pi = AUD_open_in(
-                &s->card,
+                s->audio_be,
                 s->voice_pi,
                 "ac97.pi",
                 s,
@@ -331,7 +331,7 @@ static void open_voice(AC97LinkState *s, int index, int freq)
 
         case PO_INDEX:
             s->voice_po = AUD_open_out(
-                &s->card,
+                s->audio_be,
                 s->voice_po,
                 "ac97.po",
                 s,
@@ -342,7 +342,7 @@ static void open_voice(AC97LinkState *s, int index, int freq)
 
         case MC_INDEX:
             s->voice_mc = AUD_open_in(
-                &s->card,
+                s->audio_be,
                 s->voice_mc,
                 "ac97.mc",
                 s,
@@ -355,17 +355,17 @@ static void open_voice(AC97LinkState *s, int index, int freq)
         s->invalid_freq[index] = freq;
         switch (index) {
         case PI_INDEX:
-            AUD_close_in(&s->card, s->voice_pi);
+            AUD_close_in(s->audio_be, s->voice_pi);
             s->voice_pi = NULL;
             break;
 
         case PO_INDEX:
-            AUD_close_out(&s->card, s->voice_po);
+            AUD_close_out(s->audio_be, s->voice_po);
             s->voice_po = NULL;
             break;
 
         case MC_INDEX:
-            AUD_close_in(&s->card, s->voice_mc);
+            AUD_close_in(s->audio_be, s->voice_mc);
             s->voice_mc = NULL;
             break;
         }
@@ -1275,7 +1275,7 @@ static void ac97_realize(PCIDevice *dev, Error **errp)
     AC97LinkState *s = AC97(dev);
     uint8_t *c = s->dev.config;
 
-    if (!AUD_register_card ("ac97", &s->card, errp)) {
+    if (!AUD_backend_check (&s->audio_be, errp)) {
         return;
     }
 
@@ -1320,14 +1320,13 @@ static void ac97_exit(PCIDevice *dev)
 {
     AC97LinkState *s = AC97(dev);
 
-    AUD_close_in(&s->card, s->voice_pi);
-    AUD_close_out(&s->card, s->voice_po);
-    AUD_close_in(&s->card, s->voice_mc);
-    AUD_remove_card(&s->card);
+    AUD_close_in(s->audio_be, s->voice_pi);
+    AUD_close_out(s->audio_be, s->voice_po);
+    AUD_close_in(s->audio_be, s->voice_mc);
 }
 
 static const Property ac97_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(AC97LinkState, card),
+    DEFINE_AUDIO_PROPERTIES(AC97LinkState, audio_be),
 };
 
 static void ac97_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 45c0a458f2..4e6c80b8e0 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -57,7 +57,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(AdlibState, ADLIB)
 struct AdlibState {
     ISADevice parent_obj;
 
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     uint32_t freq;
     uint32_t port;
     int ticking[2];
@@ -240,7 +240,6 @@ static void Adlib_fini (AdlibState *s)
 
     s->active = 0;
     s->enabled = 0;
-    AUD_remove_card (&s->card);
 }
 
 static MemoryRegionPortio adlib_portio_list[] = {
@@ -255,7 +254,7 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
     AdlibState *s = ADLIB(dev);
     struct audsettings as;
 
-    if (!AUD_register_card ("adlib", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -275,7 +274,7 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
     as.endianness = HOST_BIG_ENDIAN;
 
     s->voice = AUD_open_out (
-        &s->card,
+        s->audio_be,
         s->voice,
         "adlib",
         s,
@@ -298,7 +297,7 @@ static void adlib_realizefn (DeviceState *dev, Error **errp)
 }
 
 static const Property adlib_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(AdlibState, card),
+    DEFINE_AUDIO_PROPERTIES(AdlibState, audio_be),
     DEFINE_PROP_UINT32 ("iobase",  AdlibState, port, 0x220),
     DEFINE_PROP_UINT32 ("freq",    AdlibState, freq,  44100),
 };
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 991316e984..5c3f6c8f86 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -634,8 +634,6 @@ static void asc_unrealize(DeviceState *dev)
 
     g_free(s->mixbuf);
     g_free(s->silentbuf);
-
-    AUD_remove_card(&s->card);
 }
 
 static void asc_realize(DeviceState *dev, Error **errp)
@@ -643,7 +641,7 @@ static void asc_realize(DeviceState *dev, Error **errp)
     ASCState *s = ASC(dev);
     struct audsettings as;
 
-    if (!AUD_register_card("Apple Sound Chip", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -652,10 +650,9 @@ static void asc_realize(DeviceState *dev, Error **errp)
     as.fmt = AUDIO_FORMAT_U8;
     as.endianness = HOST_BIG_ENDIAN;
 
-    s->voice = AUD_open_out(&s->card, s->voice, "asc.out", s, asc_out_cb,
+    s->voice = AUD_open_out(s->audio_be, s->voice, "asc.out", s, asc_out_cb,
                             &as);
     if (!s->voice) {
-        AUD_remove_card(&s->card);
         error_setg(errp, "Initializing audio stream failed");
         return;
     }
@@ -702,7 +699,7 @@ static void asc_init(Object *obj)
 }
 
 static const Property asc_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(ASCState, card),
+    DEFINE_AUDIO_PROPERTIES(ASCState, audio_be),
     DEFINE_PROP_UINT8("asctype", ASCState, type, ASC_TYPE_ASC),
 };
 
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index 0a5d614f8b..ec9643b817 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -69,7 +69,7 @@ DECLARE_INSTANCE_CHECKER(CSState, CS4231A,
 
 struct CSState {
     ISADevice dev;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     MemoryRegion ioports;
     qemu_irq pic;
     uint32_t regs[CS_REGS];
@@ -328,7 +328,7 @@ static void cs_reset_voices (CSState *s, uint32_t val)
     }
 
     s->voice = AUD_open_out (
-        &s->card,
+        s->audio_be,
         s->voice,
         "cs4231a",
         s,
@@ -678,7 +678,7 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
         return;
     }
 
-    if (!AUD_register_card ("cs4231a", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -694,7 +694,7 @@ static void cs4231a_realizefn (DeviceState *dev, Error **errp)
 }
 
 static const Property cs4231a_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(CSState, card),
+    DEFINE_AUDIO_PROPERTIES(CSState, audio_be),
     DEFINE_PROP_UINT32 ("iobase",  CSState, port, 0x534),
     DEFINE_PROP_UINT32 ("irq",     CSState, irq,  9),
     DEFINE_PROP_UINT32 ("dma",     CSState, dma,  3),
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 721c02be0a..0628f03310 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -258,7 +258,7 @@ struct chan {
 
 struct ES1370State {
     PCIDevice dev;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     MemoryRegion io;
     struct chan chan[NB_CHANNELS];
     SWVoiceOut *dac_voice[2];
@@ -330,10 +330,10 @@ static void es1370_reset (ES1370State *s)
         d->scount = 0;
         d->leftover = 0;
         if (i == ADC_CHANNEL) {
-            AUD_close_in (&s->card, s->adc_voice);
+            AUD_close_in(s->audio_be, s->adc_voice);
             s->adc_voice = NULL;
         } else {
-            AUD_close_out (&s->card, s->dac_voice[i]);
+            AUD_close_out(s->audio_be, s->dac_voice[i]);
             s->dac_voice[i] = NULL;
         }
     }
@@ -412,7 +412,7 @@ static void es1370_update_voices (ES1370State *s, uint32_t ctl, uint32_t sctl)
                 if (i == ADC_CHANNEL) {
                     s->adc_voice =
                         AUD_open_in (
-                            &s->card,
+                            s->audio_be,
                             s->adc_voice,
                             "es1370.adc",
                             s,
@@ -422,7 +422,7 @@ static void es1370_update_voices (ES1370State *s, uint32_t ctl, uint32_t sctl)
                 } else {
                     s->dac_voice[i] =
                         AUD_open_out (
-                            &s->card,
+                            s->audio_be,
                             s->dac_voice[i],
                             i ? "es1370.dac2" : "es1370.dac1",
                             s,
@@ -784,12 +784,12 @@ static int es1370_post_load (void *opaque, int version_id)
     for (i = 0; i < NB_CHANNELS; ++i) {
         if (i == ADC_CHANNEL) {
             if (s->adc_voice) {
-                AUD_close_in (&s->card, s->adc_voice);
+                AUD_close_in(s->audio_be, s->adc_voice);
                 s->adc_voice = NULL;
             }
         } else {
             if (s->dac_voice[i]) {
-                AUD_close_out (&s->card, s->dac_voice[i]);
+                AUD_close_out(s->audio_be, s->dac_voice[i]);
                 s->dac_voice[i] = NULL;
             }
         }
@@ -833,7 +833,7 @@ static void es1370_realize(PCIDevice *dev, Error **errp)
     ES1370State *s = ES1370(dev);
     uint8_t *c = s->dev.config;
 
-    if (!AUD_register_card ("es1370", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -861,15 +861,14 @@ static void es1370_exit(PCIDevice *dev)
     int i;
 
     for (i = 0; i < 2; ++i) {
-        AUD_close_out(&s->card, s->dac_voice[i]);
+        AUD_close_out(s->audio_be, s->dac_voice[i]);
     }
 
-    AUD_close_in(&s->card, s->adc_voice);
-    AUD_remove_card(&s->card);
+    AUD_close_in(s->audio_be, s->adc_voice);
 }
 
 static const Property es1370_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(ES1370State, card),
+    DEFINE_AUDIO_PROPERTIES(ES1370State, audio_be),
 };
 
 static void es1370_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index d13a95eb5a..d253329021 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -49,7 +49,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(GUSState, GUS)
 struct GUSState {
     ISADevice dev;
     GUSEmuState emu;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     uint32_t freq;
     uint32_t port;
     int pos, left, shift, irqs;
@@ -242,7 +242,7 @@ static void gus_realizefn (DeviceState *dev, Error **errp)
     IsaDmaClass *k;
     struct audsettings as;
 
-    if (!AUD_register_card ("gus", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -258,7 +258,7 @@ static void gus_realizefn (DeviceState *dev, Error **errp)
     as.endianness = HOST_BIG_ENDIAN;
 
     s->voice = AUD_open_out (
-        &s->card,
+        s->audio_be,
         NULL,
         "gus",
         s,
@@ -267,7 +267,6 @@ static void gus_realizefn (DeviceState *dev, Error **errp)
         );
 
     if (!s->voice) {
-        AUD_remove_card (&s->card);
         error_setg(errp, "No voice");
         return;
     }
@@ -292,7 +291,7 @@ static void gus_realizefn (DeviceState *dev, Error **errp)
 }
 
 static const Property gus_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(GUSState, card),
+    DEFINE_AUDIO_PROPERTIES(GUSState, audio_be),
     DEFINE_PROP_UINT32 ("freq",    GUSState, freq,        44100),
     DEFINE_PROP_UINT32 ("iobase",  GUSState, port,        0x240),
     DEFINE_PROP_UINT32 ("irq",     GUSState, emu.gusirq,  7),
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index cc87557954..f7ae2aa1fd 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -178,7 +178,7 @@ struct HDAAudioState {
     HDACodecDevice hda;
     const char *name;
 
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     const desc_codec *desc;
     HDAAudioStream st[4];
     bool running_compat[16];
@@ -491,7 +491,7 @@ static void hda_audio_setup(HDAAudioStream *st)
         } else {
             cb = hda_audio_compat_output_cb;
         }
-        st->voice.out = AUD_open_out(&st->state->card, st->voice.out,
+        st->voice.out = AUD_open_out(st->state->audio_be, st->voice.out,
                                      st->node->name, st, cb, &st->as);
     } else {
         if (use_timer) {
@@ -500,7 +500,7 @@ static void hda_audio_setup(HDAAudioStream *st)
         } else {
             cb = hda_audio_compat_input_cb;
         }
-        st->voice.in = AUD_open_in(&st->state->card, st->voice.in,
+        st->voice.in = AUD_open_in(st->state->audio_be, st->voice.in,
                                    st->node->name, st, cb, &st->as);
     }
 }
@@ -696,7 +696,7 @@ static void hda_audio_init(HDACodecDevice *hda,
     const desc_param *param;
     uint32_t i, type;
 
-    if (!AUD_register_card("hda", &a->card, errp)) {
+    if (!AUD_backend_check(&a->audio_be, errp)) {
         return;
     }
 
@@ -754,12 +754,11 @@ static void hda_audio_exit(HDACodecDevice *hda)
         }
         timer_free(st->buft);
         if (st->output) {
-            AUD_close_out(&a->card, st->voice.out);
+            AUD_close_out(a->audio_be, st->voice.out);
         } else {
-            AUD_close_in(&a->card, st->voice.in);
+            AUD_close_in(a->audio_be, st->voice.in);
         }
     }
-    AUD_remove_card(&a->card);
 }
 
 static int hda_audio_post_load(void *opaque, int version)
@@ -858,7 +857,7 @@ static const VMStateDescription vmstate_hda_audio = {
 };
 
 static const Property hda_audio_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(HDAAudioState, card),
+    DEFINE_AUDIO_PROPERTIES(HDAAudioState, audio_be),
     DEFINE_PROP_UINT32("debug", HDAAudioState, debug,   0),
     DEFINE_PROP_BOOL("mixer", HDAAudioState, mixer,  true),
     DEFINE_PROP_BOOL("use-timer", HDAAudioState, use_timer,  true),
diff --git a/hw/audio/lm4549.c b/hw/audio/lm4549.c
index dccbf56068..c51ec0e66f 100644
--- a/hw/audio/lm4549.c
+++ b/hw/audio/lm4549.c
@@ -190,7 +190,7 @@ void lm4549_write(lm4549_state *s,
         as.endianness = 0;
 
         s->voice = AUD_open_out(
-            &s->card,
+            s->audio_be,
             s->voice,
             "lm4549.out",
             s,
@@ -260,7 +260,7 @@ static int lm4549_post_load(void *opaque, int version_id)
     as.endianness = 0;
 
     s->voice = AUD_open_out(
-        &s->card,
+        s->audio_be,
         s->voice,
         "lm4549.out",
         s,
@@ -282,7 +282,7 @@ void lm4549_init(lm4549_state *s, lm4549_callback data_req_cb, void* opaque,
     struct audsettings as;
 
     /* Register an audio card */
-    if (!AUD_register_card("lm4549", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -300,7 +300,7 @@ void lm4549_init(lm4549_state *s, lm4549_callback data_req_cb, void* opaque,
     as.endianness = 0;
 
     s->voice = AUD_open_out(
-        &s->card,
+        s->audio_be,
         s->voice,
         "lm4549.out",
         s,
diff --git a/hw/audio/lm4549.h b/hw/audio/lm4549.h
index 61c3ab12dd..1d858e2a04 100644
--- a/hw/audio/lm4549.h
+++ b/hw/audio/lm4549.h
@@ -21,7 +21,7 @@ typedef void (*lm4549_callback)(void *opaque);
 
 
 typedef struct {
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     SWVoiceOut *voice;
     uint32_t voice_is_active;
 
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index e0b0949918..a41f5b11f0 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -49,7 +49,7 @@ struct PCSpkState {
     MemoryRegion ioport;
     uint32_t iobase;
     uint8_t sample_buf[PCSPK_BUF_LEN];
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     SWVoiceOut *voice;
     PITCommonState *pit;
     unsigned int pit_count;
@@ -123,7 +123,7 @@ static int pcspk_audio_init(PCSpkState *s)
         return 0;
     }
 
-    s->voice = AUD_open_out(&s->card, s->voice, s_spk, s, pcspk_callback, &as);
+    s->voice = AUD_open_out(s->audio_be, s->voice, s_spk, s, pcspk_callback, &as);
     if (!s->voice) {
         error_report("pcspk: Could not open voice");
         return -1;
@@ -196,8 +196,9 @@ static void pcspk_realizefn(DeviceState *dev, Error **errp)
 
     isa_register_ioport(isadev, &s->ioport, s->iobase);
 
-    if (s->card.be && AUD_register_card(s_spk, &s->card, errp)) {
+    if (s->audio_be && AUD_backend_check(&s->audio_be, errp)) {
         pcspk_audio_init(s);
+        return;
     }
 }
 
@@ -221,7 +222,7 @@ static const VMStateDescription vmstate_spk = {
 };
 
 static const Property pcspk_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(PCSpkState, card),
+    DEFINE_AUDIO_PROPERTIES(PCSpkState, audio_be),
     DEFINE_PROP_UINT32("iobase", PCSpkState, iobase,  0x61),
     DEFINE_PROP_BOOL("migrate", PCSpkState, migrate,  true),
     DEFINE_PROP_LINK("pit", PCSpkState, pit, TYPE_PIT_COMMON, PITCommonState *),
diff --git a/hw/audio/pl041.c b/hw/audio/pl041.c
index 5d9d6c1178..fd3d09611f 100644
--- a/hw/audio/pl041.c
+++ b/hw/audio/pl041.c
@@ -626,7 +626,7 @@ static const VMStateDescription vmstate_pl041 = {
 };
 
 static const Property pl041_device_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(PL041State, codec.card),
+    DEFINE_AUDIO_PROPERTIES(PL041State, codec.audio_be),
     /* Non-compact FIFO depth property */
     DEFINE_PROP_UINT32("nc_fifo_depth", PL041State, fifo_depth,
                        DEFAULT_FIFO_DEPTH),
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index e86aafd488..8109d124d1 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -54,7 +54,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(SB16State, SB16)
 struct SB16State {
     ISADevice parent_obj;
 
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     qemu_irq pic;
     uint32_t irq;
     uint32_t dma;
@@ -216,7 +216,7 @@ static void continue_dma8 (SB16State *s)
         as.endianness = 0;
 
         s->voice = AUD_open_out (
-            &s->card,
+            s->audio_be,
             s->voice,
             "sb16",
             s,
@@ -379,7 +379,7 @@ static void dma_cmd (SB16State *s, uint8_t cmd, uint8_t d0, int dma_len)
         as.endianness = 0;
 
         s->voice = AUD_open_out (
-            &s->card,
+            s->audio_be,
             s->voice,
             "sb16",
             s,
@@ -880,7 +880,7 @@ static void legacy_reset (SB16State *s)
     as.endianness = 0;
 
     s->voice = AUD_open_out (
-        &s->card,
+        s->audio_be,
         s->voice,
         "sb16",
         s,
@@ -1287,7 +1287,7 @@ static int sb16_post_load (void *opaque, int version_id)
     SB16State *s = opaque;
 
     if (s->voice) {
-        AUD_close_out (&s->card, s->voice);
+        AUD_close_out(s->audio_be, s->voice);
         s->voice = NULL;
     }
 
@@ -1303,7 +1303,7 @@ static int sb16_post_load (void *opaque, int version_id)
             as.endianness = 0;
 
             s->voice = AUD_open_out (
-                &s->card,
+                s->audio_be,
                 s->voice,
                 "sb16",
                 s,
@@ -1401,7 +1401,7 @@ static void sb16_realizefn (DeviceState *dev, Error **errp)
     SB16State *s = SB16 (dev);
     IsaDmaClass *k;
 
-    if (!AUD_register_card ("sb16", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -1440,7 +1440,7 @@ static void sb16_realizefn (DeviceState *dev, Error **errp)
 }
 
 static const Property sb16_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(SB16State, card),
+    DEFINE_AUDIO_PROPERTIES(SB16State, audio_be),
     DEFINE_PROP_UINT32 ("version", SB16State, ver,  0x0405), /* 4.5 */
     DEFINE_PROP_UINT32 ("iobase",  SB16State, port, 0x220),
     DEFINE_PROP_UINT32 ("irq",     SB16State, irq,  5),
diff --git a/hw/audio/via-ac97.c b/hw/audio/via-ac97.c
index 62341e5600..019d296853 100644
--- a/hw/audio/via-ac97.c
+++ b/hw/audio/via-ac97.c
@@ -239,7 +239,7 @@ static void open_voice_out(ViaAC97State *s)
         .fmt = s->aur.type & BIT(5) ? AUDIO_FORMAT_S16 : AUDIO_FORMAT_S8,
         .endianness = 0,
     };
-    s->vo = AUD_open_out(&s->card, s->vo, "via-ac97.out", s, out_cb, &as);
+    s->vo = AUD_open_out(s->audio_be, s->vo, "via-ac97.out", s, out_cb, &as);
 }
 
 static uint64_t sgd_read(void *opaque, hwaddr addr, unsigned size)
@@ -426,7 +426,7 @@ static void via_ac97_realize(PCIDevice *pci_dev, Error **errp)
     ViaAC97State *s = VIA_AC97(pci_dev);
     Object *o = OBJECT(s);
 
-    if (!AUD_register_card ("via-ac97", &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -455,12 +455,11 @@ static void via_ac97_exit(PCIDevice *dev)
 {
     ViaAC97State *s = VIA_AC97(dev);
 
-    AUD_close_out(&s->card, s->vo);
-    AUD_remove_card(&s->card);
+    AUD_close_out(s->audio_be, s->vo);
 }
 
 static const Property via_ac97_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(ViaAC97State, card),
+    DEFINE_AUDIO_PROPERTIES(ViaAC97State, audio_be),
 };
 
 static void via_ac97_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/audio/virtio-snd.c b/hw/audio/virtio-snd.c
index 88777977a9..9101560f38 100644
--- a/hw/audio/virtio-snd.c
+++ b/hw/audio/virtio-snd.c
@@ -78,7 +78,7 @@ static const VMStateDescription vmstate_virtio_snd = {
 };
 
 static const Property virtio_snd_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(VirtIOSound, card),
+    DEFINE_AUDIO_PROPERTIES(VirtIOSound, audio_be),
     DEFINE_PROP_UINT32("jacks", VirtIOSound, snd_conf.jacks,
                        VIRTIO_SOUND_JACK_DEFAULT),
     DEFINE_PROP_UINT32("streams", VirtIOSound, snd_conf.streams,
@@ -391,10 +391,10 @@ static void virtio_snd_pcm_close(VirtIOSoundPCMStream *stream)
     if (stream) {
         virtio_snd_pcm_flush(stream);
         if (stream->info.direction == VIRTIO_SND_D_OUTPUT) {
-            AUD_close_out(&stream->pcm->snd->card, stream->voice.out);
+            AUD_close_out(stream->pcm->snd->audio_be, stream->voice.out);
             stream->voice.out = NULL;
         } else if (stream->info.direction == VIRTIO_SND_D_INPUT) {
-            AUD_close_in(&stream->pcm->snd->card, stream->voice.in);
+            AUD_close_in(stream->pcm->snd->audio_be, stream->voice.in);
             stream->voice.in = NULL;
         }
     }
@@ -457,7 +457,7 @@ static uint32_t virtio_snd_pcm_prepare(VirtIOSound *s, uint32_t stream_id)
     stream->as = as;
 
     if (stream->info.direction == VIRTIO_SND_D_OUTPUT) {
-        stream->voice.out = AUD_open_out(&s->card,
+        stream->voice.out = AUD_open_out(s->audio_be,
                                          stream->voice.out,
                                          "virtio-sound.out",
                                          stream,
@@ -465,7 +465,7 @@ static uint32_t virtio_snd_pcm_prepare(VirtIOSound *s, uint32_t stream_id)
                                          &as);
         AUD_set_volume_out_lr(stream->voice.out, 0, 255, 255);
     } else {
-        stream->voice.in = AUD_open_in(&s->card,
+        stream->voice.in = AUD_open_in(s->audio_be,
                                         stream->voice.in,
                                         "virtio-sound.in",
                                         stream,
@@ -1053,7 +1053,7 @@ static void virtio_snd_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    if (!AUD_register_card("virtio-sound", &vsnd->card, errp)) {
+    if (!AUD_backend_check(&vsnd->audio_be, errp)) {
         return;
     }
 
@@ -1330,7 +1330,6 @@ static void virtio_snd_unrealize(DeviceState *dev)
         g_free(vsnd->pcm);
         vsnd->pcm = NULL;
     }
-    AUD_remove_card(&vsnd->card);
     qemu_mutex_destroy(&vsnd->cmdq_mutex);
     virtio_delete_queue(vsnd->queues[VIRTIO_SND_VQ_CONTROL]);
     virtio_delete_queue(vsnd->queues[VIRTIO_SND_VQ_EVENT]);
diff --git a/hw/audio/wm8750.c b/hw/audio/wm8750.c
index 7a36c4bd3f..d399c335c3 100644
--- a/hw/audio/wm8750.c
+++ b/hw/audio/wm8750.c
@@ -34,7 +34,7 @@ struct WM8750State {
 
     uint8_t i2c_data[2];
     int i2c_len;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     SWVoiceIn *adc_voice[IN_PORT_N];
     SWVoiceOut *dac_voice[OUT_PORT_N];
     int enable;
@@ -188,12 +188,12 @@ static void wm8750_set_format(WM8750State *s)
 
     for (i = 0; i < IN_PORT_N; i ++)
         if (s->adc_voice[i]) {
-            AUD_close_in(&s->card, s->adc_voice[i]);
+            AUD_close_in(s->audio_be, s->adc_voice[i]);
             s->adc_voice[i] = NULL;
         }
     for (i = 0; i < OUT_PORT_N; i ++)
         if (s->dac_voice[i]) {
-            AUD_close_out(&s->card, s->dac_voice[i]);
+            AUD_close_out(s->audio_be, s->dac_voice[i]);
             s->dac_voice[i] = NULL;
         }
 
@@ -206,11 +206,11 @@ static void wm8750_set_format(WM8750State *s)
     in_fmt.freq = s->adc_hz;
     in_fmt.fmt = AUDIO_FORMAT_S16;
 
-    s->adc_voice[0] = AUD_open_in(&s->card, s->adc_voice[0],
+    s->adc_voice[0] = AUD_open_in(s->audio_be, s->adc_voice[0],
                     CODEC ".input1", s, wm8750_audio_in_cb, &in_fmt);
-    s->adc_voice[1] = AUD_open_in(&s->card, s->adc_voice[1],
+    s->adc_voice[1] = AUD_open_in(s->audio_be, s->adc_voice[1],
                     CODEC ".input2", s, wm8750_audio_in_cb, &in_fmt);
-    s->adc_voice[2] = AUD_open_in(&s->card, s->adc_voice[2],
+    s->adc_voice[2] = AUD_open_in(s->audio_be, s->adc_voice[2],
                     CODEC ".input3", s, wm8750_audio_in_cb, &in_fmt);
 
     /* Setup output */
@@ -219,12 +219,12 @@ static void wm8750_set_format(WM8750State *s)
     out_fmt.freq = s->dac_hz;
     out_fmt.fmt = AUDIO_FORMAT_S16;
 
-    s->dac_voice[0] = AUD_open_out(&s->card, s->dac_voice[0],
+    s->dac_voice[0] = AUD_open_out(s->audio_be, s->dac_voice[0],
                     CODEC ".speaker", s, wm8750_audio_out_cb, &out_fmt);
-    s->dac_voice[1] = AUD_open_out(&s->card, s->dac_voice[1],
+    s->dac_voice[1] = AUD_open_out(s->audio_be, s->dac_voice[1],
                     CODEC ".headphone", s, wm8750_audio_out_cb, &out_fmt);
     /* MONOMIX is also in stereo for simplicity */
-    s->dac_voice[2] = AUD_open_out(&s->card, s->dac_voice[2],
+    s->dac_voice[2] = AUD_open_out(s->audio_be, s->dac_voice[2],
                     CODEC ".monomix", s, wm8750_audio_out_cb, &out_fmt);
     /* no sense emulating OUT3 which is a mix of other outputs */
 
@@ -624,7 +624,7 @@ static void wm8750_realize(DeviceState *dev, Error **errp)
 {
     WM8750State *s = WM8750(dev);
 
-    if (!AUD_register_card(CODEC, &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -637,7 +637,6 @@ static void wm8750_fini(I2CSlave *i2c)
     WM8750State *s = WM8750(i2c);
 
     wm8750_reset(I2C_SLAVE(s));
-    AUD_remove_card(&s->card);
     g_free(s);
 }
 #endif
@@ -707,7 +706,7 @@ void wm8750_set_bclk_in(void *opaque, int new_hz)
 }
 
 static const Property wm8750_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(WM8750State, card),
+    DEFINE_AUDIO_PROPERTIES(WM8750State, audio_be),
 };
 
 static void wm8750_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 4d815684d1..24c835c5f4 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -487,18 +487,17 @@ static void get_audiodev(Object *obj, Visitor *v, const char* name,
                          void *opaque, Error **errp)
 {
     const Property *prop = opaque;
-    QEMUSoundCard *card = object_field_prop_ptr(obj, prop);
-    char *p = g_strdup(audio_get_id(card));
+    AudioBackend **be = object_field_prop_ptr(obj, prop);
+    g_autofree char *id = g_strdup(audio_be_get_id(*be));
 
-    visit_type_str(v, name, &p, errp);
-    g_free(p);
+    visit_type_str(v, name, (char **)&id, errp);
 }
 
 static void set_audiodev(Object *obj, Visitor *v, const char* name,
                          void *opaque, Error **errp)
 {
     const Property *prop = opaque;
-    QEMUSoundCard *card = object_field_prop_ptr(obj, prop);
+    AudioBackend **be = object_field_prop_ptr(obj, prop);
     AudioBackend *state;
     g_autofree char *str = NULL;
 
@@ -508,7 +507,7 @@ static void set_audiodev(Object *obj, Visitor *v, const char* name,
 
     state = audio_be_by_name(str, errp);
     if (state) {
-        card->be = state;
+        *be = state;
     }
 }
 
diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 882ae3c4b4..96cbb1b3a7 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -1306,7 +1306,7 @@ static void xlnx_dp_realize(DeviceState *dev, Error **errp)
     DisplaySurface *surface;
     struct audsettings as;
 
-    if (!AUD_register_card("xlnx_dp.audio", &s->aud_card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -1328,7 +1328,7 @@ static void xlnx_dp_realize(DeviceState *dev, Error **errp)
     as.fmt = AUDIO_FORMAT_S16;
     as.endianness = 0;
 
-    s->amixer_output_stream = AUD_open_out(&s->aud_card,
+    s->amixer_output_stream = AUD_open_out(s->audio_be,
                                            s->amixer_output_stream,
                                            "xlnx_dp.audio.out",
                                            s,
@@ -1392,7 +1392,7 @@ static void xlnx_dp_reset(DeviceState *dev)
 }
 
 static const Property xlnx_dp_device_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(XlnxDPState, aud_card),
+    DEFINE_AUDIO_PROPERTIES(XlnxDPState, audio_be),
 };
 
 static void xlnx_dp_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index f59e5a53f0..c8e032ab64 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -635,7 +635,7 @@ static uint8_t *streambuf_get(struct streambuf *buf, size_t *len)
 struct USBAudioState {
     /* qemu interfaces */
     USBDevice dev;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
 
     /* state */
     struct {
@@ -931,8 +931,7 @@ static void usb_audio_unrealize(USBDevice *dev)
     }
 
     usb_audio_set_output_altset(s, ALTSET_OFF);
-    AUD_close_out(&s->card, s->out.voice);
-    AUD_remove_card(&s->card);
+    AUD_close_out(s->audio_be, s->out.voice);
 
     streambuf_fini(&s->out.buf);
 }
@@ -942,7 +941,7 @@ static void usb_audio_realize(USBDevice *dev, Error **errp)
     USBAudioState *s = USB_AUDIO(dev);
     int i;
 
-    if (!AUD_register_card(TYPE_USB_AUDIO, &s->card, errp)) {
+    if (!AUD_backend_check(&s->audio_be, errp)) {
         return;
     }
 
@@ -979,7 +978,7 @@ static void usb_audio_reinit(USBDevice *dev, unsigned channels)
     s->out.as.endianness = 0;
     streambuf_init(&s->out.buf, s->buffer, s->out.channels);
 
-    s->out.voice = AUD_open_out(&s->card, s->out.voice, TYPE_USB_AUDIO,
+    s->out.voice = AUD_open_out(s->audio_be, s->out.voice, TYPE_USB_AUDIO,
                                 s, output_callback, &s->out.as);
     AUD_set_volume_out(s->out.voice, &s->out.vol);
     AUD_set_active_out(s->out.voice, 0);
@@ -991,7 +990,7 @@ static const VMStateDescription vmstate_usb_audio = {
 };
 
 static const Property usb_audio_properties[] = {
-    DEFINE_AUDIO_PROPERTIES(USBAudioState, card),
+    DEFINE_AUDIO_PROPERTIES(USBAudioState, audio_be),
     DEFINE_PROP_UINT32("debug", USBAudioState, debug, 0),
     DEFINE_PROP_UINT32("buffer", USBAudioState, buffer_user, 0),
     DEFINE_PROP_BOOL("multi", USBAudioState, multi, false),
diff --git a/include/hw/audio/asc.h b/include/hw/audio/asc.h
index 04fac270b6..a60c2f597c 100644
--- a/include/hw/audio/asc.h
+++ b/include/hw/audio/asc.h
@@ -61,7 +61,7 @@ struct ASCState {
     MemoryRegion mem_regs;
     MemoryRegion mem_extregs;
 
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     SWVoiceOut *voice;
     uint8_t *mixbuf;
     int samples;
diff --git a/include/hw/audio/virtio-snd.h b/include/hw/audio/virtio-snd.h
index 8dafedb276..0ad80bc9be 100644
--- a/include/hw/audio/virtio-snd.h
+++ b/include/hw/audio/virtio-snd.h
@@ -216,7 +216,7 @@ struct VirtIOSound {
     VirtQueue *queues[VIRTIO_SND_VQ_MAX];
     uint64_t features;
     VirtIOSoundPCM *pcm;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     VMChangeStateEntry *vmstate;
     virtio_snd_config snd_conf;
     QemuMutex cmdq_mutex;
diff --git a/include/hw/display/xlnx_dp.h b/include/hw/display/xlnx_dp.h
index e86a87f235..802a1427c9 100644
--- a/include/hw/display/xlnx_dp.h
+++ b/include/hw/display/xlnx_dp.h
@@ -84,7 +84,7 @@ struct XlnxDPState {
     struct PixmanPlane v_plane;
     struct PixmanPlane bout_plane;
 
-    QEMUSoundCard aud_card;
+    AudioBackend *audio_be;
     SWVoiceOut *amixer_output_stream;
     int16_t audio_buffer_0[AUD_CHBUF_MAX_DEPTH];
     int16_t audio_buffer_1[AUD_CHBUF_MAX_DEPTH];
diff --git a/include/hw/isa/vt82c686.h b/include/hw/isa/vt82c686.h
index da1722daf2..48c412ce81 100644
--- a/include/hw/isa/vt82c686.h
+++ b/include/hw/isa/vt82c686.h
@@ -24,7 +24,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(ViaAC97State, VIA_AC97);
 
 struct ViaAC97State {
     PCIDevice dev;
-    QEMUSoundCard card;
+    AudioBackend *audio_be;
     MemoryRegion sgd;
     MemoryRegion fm;
     MemoryRegion midi;
diff --git a/include/hw/qdev-properties-system.h b/include/hw/qdev-properties-system.h
index 5c6cc5eae8..45687be005 100644
--- a/include/hw/qdev-properties-system.h
+++ b/include/hw/qdev-properties-system.h
@@ -87,7 +87,7 @@ extern const PropertyInfo qdev_prop_virtio_gpu_output_list;
                 .set_default = true)
 
 #define DEFINE_PROP_AUDIODEV(_n, _s, _f) \
-    DEFINE_PROP(_n, _s, _f, qdev_prop_audiodev, QEMUSoundCard)
+    DEFINE_PROP(_n, _s, _f, qdev_prop_audiodev, AudioBackend *)
 
 #define DEFINE_PROP_UUID_NODEFAULT(_name, _state, _field) \
     DEFINE_PROP(_name, _state, _field, qdev_prop_uuid, QemuUUID)

From 2d18978b7fdd4b226fe9bef1a8df53c7dfede3a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 27 Oct 2025 18:31:32 +0400
Subject: [PATCH 1826/2396] audio/dbus: use a helper function to set the
 backend dbus server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c     | 17 +++++++++++++++++
 audio/audio.h     |  9 +++++++++
 audio/audio_int.h |  5 ++++-
 audio/dbusaudio.c |  9 +++++++--
 ui/dbus.c         |  8 +-------
 5 files changed, 38 insertions(+), 10 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index d9a5695eb8..3229829bef 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -2223,6 +2223,23 @@ AudioBackend *audio_be_by_name(const char *name, Error **errp)
     }
 }
 
+#ifdef CONFIG_GIO
+bool audio_be_set_dbus_server(AudioBackend *be,
+                              GDBusObjectManagerServer *server,
+                              bool p2p,
+                              Error **errp)
+{
+    assert(be != NULL);
+
+    if (!be->drv->set_dbus_server) {
+        error_setg(errp, "Audiodev '%s' is not compatible with DBus", be->dev->id);
+        return false;
+    }
+
+    return be->drv->set_dbus_server(be, server, p2p, errp);
+}
+#endif
+
 const char *audio_be_get_id(AudioBackend *be)
 {
     if (be) {
diff --git a/audio/audio.h b/audio/audio.h
index 0a016bdabc..08753f621a 100644
--- a/audio/audio.h
+++ b/audio/audio.h
@@ -28,6 +28,9 @@
 #include "qemu/queue.h"
 #include "qapi/qapi-types-audio.h"
 #include "hw/qdev-properties-system.h"
+#ifdef CONFIG_GIO
+#include "gio/gio.h"
+#endif
 
 typedef void (*audio_callback_fn) (void *opaque, int avail);
 
@@ -162,6 +165,12 @@ void audio_help(void);
 AudioBackend *audio_be_by_name(const char *name, Error **errp);
 AudioBackend *audio_get_default_audio_be(Error **errp);
 const char *audio_be_get_id(AudioBackend *be);
+#ifdef CONFIG_GIO
+bool audio_be_set_dbus_server(AudioBackend *be,
+                              GDBusObjectManagerServer *server,
+                              bool p2p,
+                              Error **errp);
+#endif
 
 #define DEFINE_AUDIO_PROPERTIES(_s, _f)         \
     DEFINE_PROP_AUDIODEV("audiodev", _s, _f)
diff --git a/audio/audio_int.h b/audio/audio_int.h
index c4453b3a29..d66f7aac32 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -148,7 +148,10 @@ struct audio_driver {
     void *(*init) (Audiodev *, Error **);
     void (*fini) (void *);
 #ifdef CONFIG_GIO
-    void (*set_dbus_server)(AudioBackend *s, GDBusObjectManagerServer *manager, bool p2p);
+    bool (*set_dbus_server)(AudioBackend *be,
+                            GDBusObjectManagerServer *manager,
+                            bool p2p,
+                            Error **errp);
 #endif
     struct audio_pcm_ops *pcm_ops;
     int max_voices_out;
diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index 49cef38e3e..c97c34b486 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -645,8 +645,11 @@ dbus_audio_register_in_listener(AudioBackend *s,
                                         arg_listener, false);
 }
 
-static void
-dbus_audio_set_server(AudioBackend *s, GDBusObjectManagerServer *server, bool p2p)
+static bool
+dbus_audio_set_server(AudioBackend *s,
+                      GDBusObjectManagerServer *server,
+                      bool p2p,
+                      Error **errp)
 {
     DBusAudio *da = s->drv_opaque;
 
@@ -669,6 +672,8 @@ dbus_audio_set_server(AudioBackend *s, GDBusObjectManagerServer *server, bool p2
     g_dbus_object_skeleton_add_interface(G_DBUS_OBJECT_SKELETON(da->audio),
                                          G_DBUS_INTERFACE_SKELETON(da->iface));
     g_dbus_object_manager_server_export(da->server, da->audio);
+
+    return true;
 }
 
 static struct audio_pcm_ops dbus_pcm_ops = {
diff --git a/ui/dbus.c b/ui/dbus.c
index 84cff47ec7..fbe108af1e 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -221,15 +221,9 @@ dbus_display_complete(UserCreatable *uc, Error **errp)
 
     if (dd->audiodev && *dd->audiodev) {
         AudioBackend *audio_be = audio_be_by_name(dd->audiodev, errp);
-        if (!audio_be) {
+        if (!audio_be || !audio_be_set_dbus_server(audio_be, dd->server, dd->p2p, errp)) {
             return;
         }
-        if (!g_str_equal(audio_be->drv->name, "dbus")) {
-            error_setg(errp, "Audiodev '%s' is not compatible with DBus",
-                       dd->audiodev);
-            return;
-        }
-        audio_be->drv->set_dbus_server(audio_be, dd->server, dd->p2p);
     }
 
     consoles = g_array_new(FALSE, FALSE, sizeof(guint32));

From 1e4ebc895ac41eddc67b123121aca2bd58e1d0a5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 17:30:41 +0400
Subject: [PATCH 1827/2396] audio: move audio.h under include/qemu/
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
---
 MAINTAINERS                                         | 1 +
 audio/alsaaudio.c                                   | 2 +-
 audio/audio.c                                       | 2 +-
 audio/audio_int.h                                   | 2 +-
 audio/audio_win_int.c                               | 2 +-
 audio/coreaudio.m                                   | 2 +-
 audio/dbusaudio.c                                   | 2 +-
 audio/dsoundaudio.c                                 | 2 +-
 audio/jackaudio.c                                   | 2 +-
 audio/mixeng.c                                      | 2 +-
 audio/noaudio.c                                     | 2 +-
 audio/ossaudio.c                                    | 2 +-
 audio/paaudio.c                                     | 2 +-
 audio/pwaudio.c                                     | 2 +-
 audio/sdlaudio.c                                    | 2 +-
 audio/sndioaudio.c                                  | 2 +-
 audio/spiceaudio.c                                  | 2 +-
 audio/wavaudio.c                                    | 2 +-
 hw/arm/integratorcp.c                               | 2 +-
 hw/arm/musicpal.c                                   | 2 +-
 hw/arm/realview.c                                   | 2 +-
 hw/arm/versatilepb.c                                | 2 +-
 hw/arm/vexpress.c                                   | 2 +-
 hw/arm/xlnx-zcu102.c                                | 2 +-
 hw/audio/ac97.c                                     | 2 +-
 hw/audio/adlib.c                                    | 2 +-
 hw/audio/asc.c                                      | 2 +-
 hw/audio/cs4231a.c                                  | 2 +-
 hw/audio/es1370.c                                   | 2 +-
 hw/audio/gus.c                                      | 2 +-
 hw/audio/hda-codec.c                                | 2 +-
 hw/audio/lm4549.c                                   | 2 +-
 hw/audio/lm4549.h                                   | 2 +-
 hw/audio/marvell_88w8618.c                          | 2 +-
 hw/audio/pcspk.c                                    | 2 +-
 hw/audio/sb16.c                                     | 2 +-
 hw/audio/wm8750.c                                   | 2 +-
 hw/core/machine.c                                   | 2 +-
 hw/core/qdev-properties-system.c                    | 2 +-
 hw/ppc/prep.c                                       | 2 +-
 hw/usb/dev-audio.c                                  | 2 +-
 include/hw/audio/asc.h                              | 2 +-
 include/hw/audio/virtio-snd.h                       | 2 +-
 include/hw/display/xlnx_dp.h                        | 2 +-
 include/hw/isa/vt82c686.h                           | 2 +-
 {audio => include/qemu}/audio.h                     | 0
 include/system/replay.h                             | 2 +-
 replay/replay-audio.c                               | 2 +-
 scripts/codeconverter/codeconverter/test_regexps.py | 2 +-
 system/runstate.c                                   | 2 +-
 system/vl.c                                         | 2 +-
 ui/dbus.c                                           | 3 +--
 ui/vnc.h                                            | 2 +-
 53 files changed, 52 insertions(+), 52 deletions(-)
 rename {audio => include/qemu}/audio.h (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index 64491c800c..24323e8800 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2977,6 +2977,7 @@ X: audio/paaudio.c
 X: audio/sdlaudio.c
 X: audio/sndioaudio.c
 X: audio/spiceaudio.c
+F: include/qemu/audio.h
 F: qapi/audio.json
 
 ALSA Audio backend
diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 797cb478e6..d1e4817081 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -26,7 +26,7 @@
 #include <alsa/asoundlib.h>
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "trace.h"
 
 #pragma GCC diagnostic ignored "-Waddress"
diff --git a/audio/audio.c b/audio/audio.c
index 3229829bef..19499abe16 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -23,7 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "migration/vmstate.h"
 #include "qemu/timer.h"
 #include "qapi/error.h"
diff --git a/audio/audio_int.h b/audio/audio_int.h
index d66f7aac32..8d4f4ca8fc 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -29,7 +29,7 @@
 #define FLOAT_MIXENG
 /* #define RECIPROCAL */
 #endif
-#include "audio.h"
+#include "qemu/audio.h"
 #include "mixeng.h"
 
 #ifdef CONFIG_GIO
diff --git a/audio/audio_win_int.c b/audio/audio_win_int.c
index 316f118f50..44a8ff24a6 100644
--- a/audio/audio_win_int.c
+++ b/audio/audio_win_int.c
@@ -7,7 +7,7 @@
 #include <mmreg.h>
 #include <mmsystem.h>
 
-#include "audio.h"
+#include "qemu/audio.h"
 #include "audio_int.h"
 #include "audio_win_int.h"
 
diff --git a/audio/coreaudio.m b/audio/coreaudio.m
index cadd729d50..8b3cd6db16 100644
--- a/audio/coreaudio.m
+++ b/audio/coreaudio.m
@@ -28,7 +28,7 @@
 
 #include "qemu/main-loop.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "coreaudio"
 #include "audio_int.h"
diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index c97c34b486..157d36428e 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -35,7 +35,7 @@
 #include "ui/dbus-display1.h"
 
 #define AUDIO_CAP "dbus"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "audio_int.h"
 #include "trace.h"
 
diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index bd00c50e80..8b773ded21 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -27,7 +27,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "dsound"
 #include "audio_int.h"
diff --git a/audio/jackaudio.c b/audio/jackaudio.c
index 974a3caad3..28face9989 100644
--- a/audio/jackaudio.c
+++ b/audio/jackaudio.c
@@ -26,7 +26,7 @@
 #include "qemu/module.h"
 #include "qemu/atomic.h"
 #include "qemu/main-loop.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "jack"
 #include "audio_int.h"
diff --git a/audio/mixeng.c b/audio/mixeng.c
index af9ec3d4d2..e63c76e021 100644
--- a/audio/mixeng.c
+++ b/audio/mixeng.c
@@ -24,7 +24,7 @@
  */
 #include "qemu/osdep.h"
 #include "qemu/bswap.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "mixeng"
 #include "audio_int.h"
diff --git a/audio/noaudio.c b/audio/noaudio.c
index 34ff1d2a27..b136b74e26 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "noaudio"
 #include "audio_int.h"
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 4a549b26a2..5ba91f6793 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -29,7 +29,7 @@
 #include "qemu/module.h"
 #include "qemu/host-utils.h"
 #include "qapi/error.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "trace.h"
 
 #define AUDIO_CAP "oss"
diff --git a/audio/paaudio.c b/audio/paaudio.c
index 93030f3fc8..8eb80ede45 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -2,7 +2,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "qapi/error.h"
 
 #include <pulse/pulseaudio.h>
diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 8e13b58286..8f6c0900c8 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -10,7 +10,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
 #include <spa/param/audio/format-utils.h>
diff --git a/audio/sdlaudio.c b/audio/sdlaudio.c
index 641357e5ee..4ef73c8dfb 100644
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -27,7 +27,7 @@
 #include <SDL_thread.h>
 #include "qemu/module.h"
 #include "qapi/error.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #ifndef _WIN32
 #ifdef __sun__
diff --git a/audio/sndioaudio.c b/audio/sndioaudio.c
index 8eb35e1e53..f4f53b1c6f 100644
--- a/audio/sndioaudio.c
+++ b/audio/sndioaudio.c
@@ -18,7 +18,7 @@
 #include <poll.h>
 #include <sndio.h>
 #include "qemu/main-loop.h"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "trace.h"
 
 #define AUDIO_CAP "sndio"
diff --git a/audio/spiceaudio.c b/audio/spiceaudio.c
index 7e737bff9a..77ba89ffaa 100644
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -26,7 +26,7 @@
 #include "ui/qemu-spice.h"
 
 #define AUDIO_CAP "spice"
-#include "audio.h"
+#include "qemu/audio.h"
 #include "audio_int.h"
 
 #if SPICE_INTERFACE_PLAYBACK_MAJOR > 1 || SPICE_INTERFACE_PLAYBACK_MINOR >= 3
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index a098b20cad..4d9c921305 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "qemu/module.h"
-#include "audio.h"
+#include "qemu/audio.h"
 
 #define AUDIO_CAP "wav"
 #include "audio_int.h"
diff --git a/hw/arm/integratorcp.c b/hw/arm/integratorcp.c
index b1d8fbd470..81ed051b98 100644
--- a/hw/arm/integratorcp.c
+++ b/hw/arm/integratorcp.c
@@ -26,7 +26,7 @@
 #include "hw/irq.h"
 #include "hw/sd/sd.h"
 #include "qom/object.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "target/arm/cpu-qom.h"
 
 #define TYPE_INTEGRATOR_CM "integrator_core"
diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index 329b162eb2..6032301bb6 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -36,7 +36,7 @@
 #include "qemu/cutils.h"
 #include "qom/object.h"
 #include "hw/net/mv88w8618_eth.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qemu/error-report.h"
 #include "target/arm/cpu-qom.h"
 
diff --git a/hw/arm/realview.c b/hw/arm/realview.c
index 5c9050490b..892bdc8db2 100644
--- a/hw/arm/realview.c
+++ b/hw/arm/realview.c
@@ -29,7 +29,7 @@
 #include "hw/irq.h"
 #include "hw/i2c/arm_sbcon_i2c.h"
 #include "hw/sd/sd.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "target/arm/cpu-qom.h"
 
 #define SMP_BOOT_ADDR 0xe0000000
diff --git a/hw/arm/versatilepb.c b/hw/arm/versatilepb.c
index 5cf1a70d10..cba77864e8 100644
--- a/hw/arm/versatilepb.c
+++ b/hw/arm/versatilepb.c
@@ -25,7 +25,7 @@
 #include "hw/char/pl011.h"
 #include "hw/sd/sd.h"
 #include "qom/object.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "target/arm/cpu-qom.h"
 #include "qemu/log.h"
 
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index 60cd375fe7..d26a07f0f5 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -44,7 +44,7 @@
 #include "hw/sd/sd.h"
 #include "qobject/qlist.h"
 #include "qom/object.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "target/arm/cpu-qom.h"
 
 #define VEXPRESS_BOARD_ID 0x8e0
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index 14b6641a71..4ed346a88d 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -25,7 +25,7 @@
 #include "system/device_tree.h"
 #include "qom/object.h"
 #include "net/can_emu.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 struct XlnxZCU102 {
     MachineState parent_obj;
diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index a91bf52b95..be7a39377f 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -19,7 +19,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/pci/pci_device.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
diff --git a/hw/audio/adlib.c b/hw/audio/adlib.c
index 4e6c80b8e0..19d3a5f128 100644
--- a/hw/audio/adlib.c
+++ b/hw/audio/adlib.c
@@ -26,7 +26,7 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
 #include "qemu/error-report.h"
diff --git a/hw/audio/asc.c b/hw/audio/asc.c
index 5c3f6c8f86..0abb106979 100644
--- a/hw/audio/asc.c
+++ b/hw/audio/asc.c
@@ -15,7 +15,7 @@
 #include "qapi/error.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/audio/asc.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
diff --git a/hw/audio/cs4231a.c b/hw/audio/cs4231a.c
index ec9643b817..98fdbc5b72 100644
--- a/hw/audio/cs4231a.c
+++ b/hw/audio/cs4231a.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/audio/es1370.c b/hw/audio/es1370.c
index 0628f03310..9873ffadab 100644
--- a/hw/audio/es1370.c
+++ b/hw/audio/es1370.c
@@ -27,7 +27,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/pci/pci_device.h"
 #include "migration/vmstate.h"
 #include "qemu/cutils.h"
diff --git a/hw/audio/gus.c b/hw/audio/gus.c
index d253329021..68f89e994c 100644
--- a/hw/audio/gus.c
+++ b/hw/audio/gus.c
@@ -26,7 +26,7 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/audio/hda-codec.c b/hw/audio/hda-codec.c
index f7ae2aa1fd..e90c9de046 100644
--- a/hw/audio/hda-codec.c
+++ b/hw/audio/hda-codec.c
@@ -25,7 +25,7 @@
 #include "qemu/host-utils.h"
 #include "qemu/module.h"
 #include "intel-hda-defs.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "trace.h"
 #include "qom/object.h"
 
diff --git a/hw/audio/lm4549.c b/hw/audio/lm4549.c
index c51ec0e66f..745441bd79 100644
--- a/hw/audio/lm4549.c
+++ b/hw/audio/lm4549.c
@@ -15,7 +15,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/hw.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "lm4549.h"
 #include "migration/vmstate.h"
 
diff --git a/hw/audio/lm4549.h b/hw/audio/lm4549.h
index 1d858e2a04..bbd73057bf 100644
--- a/hw/audio/lm4549.h
+++ b/hw/audio/lm4549.h
@@ -12,7 +12,7 @@
 #ifndef HW_LM4549_H
 #define HW_LM4549_H
 
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "exec/hwaddr.h"
 
 typedef void (*lm4549_callback)(void *opaque);
diff --git a/hw/audio/marvell_88w8618.c b/hw/audio/marvell_88w8618.c
index c5c79d083a..a483f4e70d 100644
--- a/hw/audio/marvell_88w8618.c
+++ b/hw/audio/marvell_88w8618.c
@@ -16,7 +16,7 @@
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/audio/wm8750.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "qom/object.h"
diff --git a/hw/audio/pcspk.c b/hw/audio/pcspk.c
index a41f5b11f0..916c56fa4c 100644
--- a/hw/audio/pcspk.c
+++ b/hw/audio/pcspk.c
@@ -25,7 +25,7 @@
 #include "qemu/osdep.h"
 #include "hw/isa/isa.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
diff --git a/hw/audio/sb16.c b/hw/audio/sb16.c
index 8109d124d1..1e3c4caf5e 100644
--- a/hw/audio/sb16.c
+++ b/hw/audio/sb16.c
@@ -24,7 +24,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/irq.h"
 #include "hw/isa/isa.h"
 #include "hw/qdev-properties.h"
diff --git a/hw/audio/wm8750.c b/hw/audio/wm8750.c
index d399c335c3..336fb6d20b 100644
--- a/hw/audio/wm8750.c
+++ b/hw/audio/wm8750.c
@@ -12,7 +12,7 @@
 #include "migration/vmstate.h"
 #include "qemu/module.h"
 #include "hw/audio/wm8750.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qom/object.h"
 
 #define IN_PORT_N	3
diff --git a/hw/core/machine.c b/hw/core/machine.c
index 28d2833c5d..0580550e12 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -36,7 +36,7 @@
 #include "hw/virtio/virtio-net.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "hw/acpi/generic_event_device.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 GlobalProperty hw_compat_10_1[] = {
     { TYPE_ACPI_GED, "x-has-hest-addr", "false" },
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index 24c835c5f4..7aa5cbb510 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -27,7 +27,7 @@
 #include "qemu/error-report.h"
 #include "qdev-prop-internal.h"
 
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "chardev/char-fe.h"
 #include "system/block-backend.h"
 #include "system/blockdev.h"
diff --git a/hw/ppc/prep.c b/hw/ppc/prep.c
index c2fe16e985..5654a60c59 100644
--- a/hw/ppc/prep.c
+++ b/hw/ppc/prep.c
@@ -46,7 +46,7 @@
 #include "trace.h"
 #include "elf.h"
 #include "qemu/units.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 /* SMP is not enabled, for now */
 #define MAX_CPUS 1
diff --git a/hw/usb/dev-audio.c b/hw/usb/dev-audio.c
index c8e032ab64..8dd9d26599 100644
--- a/hw/usb/dev-audio.c
+++ b/hw/usb/dev-audio.c
@@ -35,7 +35,7 @@
 #include "hw/usb.h"
 #include "migration/vmstate.h"
 #include "desc.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qom/object.h"
 
 static void usb_audio_reinit(USBDevice *dev, unsigned channels);
diff --git a/include/hw/audio/asc.h b/include/hw/audio/asc.h
index a60c2f597c..bb51e9a3d1 100644
--- a/include/hw/audio/asc.h
+++ b/include/hw/audio/asc.h
@@ -14,7 +14,7 @@
 #define HW_AUDIO_ASC_H
 
 #include "hw/sysbus.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 #define ASC_FREQ 22257
 
diff --git a/include/hw/audio/virtio-snd.h b/include/hw/audio/virtio-snd.h
index 0ad80bc9be..c176066584 100644
--- a/include/hw/audio/virtio-snd.h
+++ b/include/hw/audio/virtio-snd.h
@@ -17,7 +17,7 @@
 #define QEMU_VIRTIO_SOUND_H
 
 #include "hw/virtio/virtio.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "standard-headers/linux/virtio_ids.h"
 #include "standard-headers/linux/virtio_snd.h"
 
diff --git a/include/hw/display/xlnx_dp.h b/include/hw/display/xlnx_dp.h
index 802a1427c9..af859e477d 100644
--- a/include/hw/display/xlnx_dp.h
+++ b/include/hw/display/xlnx_dp.h
@@ -33,7 +33,7 @@
 #include "qemu/fifo8.h"
 #include "qemu/units.h"
 #include "hw/dma/xlnx_dpdma.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qom/object.h"
 #include "hw/ptimer.h"
 
diff --git a/include/hw/isa/vt82c686.h b/include/hw/isa/vt82c686.h
index 48c412ce81..ace9e6650e 100644
--- a/include/hw/isa/vt82c686.h
+++ b/include/hw/isa/vt82c686.h
@@ -2,7 +2,7 @@
 #define HW_VT82C686_H
 
 #include "hw/pci/pci_device.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 #define TYPE_VT82C686B_ISA "vt82c686b-isa"
 #define TYPE_VT82C686B_USB_UHCI "vt82c686b-usb-uhci"
diff --git a/audio/audio.h b/include/qemu/audio.h
similarity index 100%
rename from audio/audio.h
rename to include/qemu/audio.h
diff --git a/include/system/replay.h b/include/system/replay.h
index 1e63c0784c..68f91bdfbf 100644
--- a/include/system/replay.h
+++ b/include/system/replay.h
@@ -16,7 +16,7 @@
 #include "qapi/qapi-types-run-state.h"
 #include "qapi/qapi-types-ui.h"
 #include "block/aio.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 /* replay clock kinds */
 enum ReplayClockKind {
diff --git a/replay/replay-audio.c b/replay/replay-audio.c
index 3413801062..1b614f4137 100644
--- a/replay/replay-audio.c
+++ b/replay/replay-audio.c
@@ -13,7 +13,7 @@
 #include "qemu/error-report.h"
 #include "system/replay.h"
 #include "replay-internal.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 
 void replay_audio_out(size_t *played)
 {
diff --git a/scripts/codeconverter/codeconverter/test_regexps.py b/scripts/codeconverter/codeconverter/test_regexps.py
index fe7354b473..b00e9ef15b 100644
--- a/scripts/codeconverter/codeconverter/test_regexps.py
+++ b/scripts/codeconverter/codeconverter/test_regexps.py
@@ -265,7 +265,7 @@ def test_initial_includes():
 
 #include "qemu/osdep.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "hw/pci/pci.h"
 #include "migration/vmstate.h"
 #include "qemu/module.h"
diff --git a/system/runstate.c b/system/runstate.c
index 32467aa882..e3ec16ab74 100644
--- a/system/runstate.c
+++ b/system/runstate.c
@@ -23,7 +23,7 @@
  */
 
 #include "qemu/osdep.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "block/block.h"
 #include "block/export.h"
 #include "chardev/char.h"
diff --git a/system/vl.c b/system/vl.c
index dc2ea4c298..29f5389151 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -87,7 +87,7 @@
 #include "system/tpm.h"
 #include "system/dma.h"
 #include "hw/audio/model.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "system/cpus.h"
 #include "system/cpu-timers.h"
 #include "exec/icount.h"
diff --git a/ui/dbus.c b/ui/dbus.c
index fbe108af1e..d2dff33258 100644
--- a/ui/dbus.c
+++ b/ui/dbus.c
@@ -34,8 +34,7 @@
 #include "ui/egl-helpers.h"
 #include "ui/egl-context.h"
 #endif
-#include "audio/audio.h"
-#include "audio/audio_int.h"
+#include "qemu/audio.h"
 #include "qapi/error.h"
 #include "trace.h"
 
diff --git a/ui/vnc.h b/ui/vnc.h
index e2137c5ed1..4d8363ebf3 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -31,7 +31,7 @@
 #include "qemu/thread.h"
 #include "ui/clipboard.h"
 #include "ui/console.h"
-#include "audio/audio.h"
+#include "qemu/audio.h"
 #include "qemu/bitmap.h"
 #include "crypto/tlssession.h"
 #include "qemu/buffer.h"

From 98e901ff9b6dced79d12d6f73d170aa584947294 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Tue, 14 Oct 2025 18:19:12 +0400
Subject: [PATCH 1828/2396] audio: remove dependency on spice header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is no longer required.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/audio/meson.build b/audio/meson.build
index 59f0a431d5..37789437fb 100644
--- a/audio/meson.build
+++ b/audio/meson.build
@@ -1,5 +1,5 @@
-system_ss.add([spice_headers, files('audio.c')])
 system_ss.add(files(
+  'audio.c',
   'audio-hmp-cmds.c',
   'mixeng.c',
   'noaudio.c',

From 690c82a27168b4e23a5dad6159ccd899a6ad2990 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 15 Oct 2025 10:40:01 +0400
Subject: [PATCH 1829/2396] audio: cleanup, use bool for booleans
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use slightly better types for the job.
Fix some checkpatch issues.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/audio.c          | 30 +++++++++++++++---------------
 audio/audio_int.h      | 12 ++++++------
 audio/audio_template.h |  6 +++---
 include/qemu/audio.h   |  8 ++++----
 4 files changed, 28 insertions(+), 28 deletions(-)

diff --git a/audio/audio.c b/audio/audio.c
index 19499abe16..86e674410a 100644
--- a/audio/audio.c
+++ b/audio/audio.c
@@ -405,7 +405,7 @@ static void audio_notify_capture (CaptureVoiceOut *cap, audcnotification_e cmd)
     }
 }
 
-static void audio_capture_maybe_changed (CaptureVoiceOut *cap, int enabled)
+static void audio_capture_maybe_changed(CaptureVoiceOut *cap, bool enabled)
 {
     if (cap->hw.enabled != enabled) {
         audcnotification_e cmd;
@@ -419,11 +419,11 @@ static void audio_recalc_and_notify_capture (CaptureVoiceOut *cap)
 {
     HWVoiceOut *hw = &cap->hw;
     SWVoiceOut *sw;
-    int enabled = 0;
+    bool enabled = false;
 
     for (sw = hw->sw_head.lh_first; sw; sw = sw->entries.le_next) {
         if (sw->active) {
-            enabled = 1;
+            enabled = true;
             break;
         }
     }
@@ -475,7 +475,7 @@ static int audio_attach_capture (HWVoiceOut *hw)
         sw = &sc->sw;
         sw->hw = hw_cap;
         sw->info = hw->info;
-        sw->empty = 1;
+        sw->empty = true;
         sw->active = hw->enabled;
         sw->vol = nominal_volume;
         sw->rate = st_rate_start (sw->info.freq, hw_cap->info.freq);
@@ -911,7 +911,7 @@ int AUD_get_buffer_size_out(SWVoiceOut *sw)
     return sw->hw->samples * sw->hw->info.bytes_per_frame;
 }
 
-void AUD_set_active_out (SWVoiceOut *sw, int on)
+void AUD_set_active_out(SWVoiceOut *sw, bool on)
 {
     HWVoiceOut *hw;
 
@@ -928,7 +928,7 @@ void AUD_set_active_out (SWVoiceOut *sw, int on)
         if (on) {
             hw->pending_disable = 0;
             if (!hw->enabled) {
-                hw->enabled = 1;
+                hw->enabled = true;
                 if (s->vm_running) {
                     if (hw->pcm_ops->enable_out) {
                         hw->pcm_ops->enable_out(hw, true);
@@ -959,7 +959,7 @@ void AUD_set_active_out (SWVoiceOut *sw, int on)
     }
 }
 
-void AUD_set_active_in (SWVoiceIn *sw, int on)
+void AUD_set_active_in(SWVoiceIn *sw, bool on)
 {
     HWVoiceIn *hw;
 
@@ -974,7 +974,7 @@ void AUD_set_active_in (SWVoiceIn *sw, int on)
 
         if (on) {
             if (!hw->enabled) {
-                hw->enabled = 1;
+                hw->enabled = true;
                 if (s->vm_running) {
                     if (hw->pcm_ops->enable_in) {
                         hw->pcm_ops->enable_in(hw, true);
@@ -993,7 +993,7 @@ void AUD_set_active_in (SWVoiceIn *sw, int on)
                 }
 
                 if (nb_active == 1) {
-                    hw->enabled = 0;
+                    hw->enabled = false;
                     if (hw->pcm_ops->enable_in) {
                         hw->pcm_ops->enable_in(hw, false);
                     }
@@ -1152,8 +1152,8 @@ static void audio_run_out(AudioBackend *s)
             sw = hw->sw_head.lh_first;
 
             if (hw->pending_disable) {
-                hw->enabled = 0;
-                hw->pending_disable = 0;
+                hw->enabled = false;
+                hw->pending_disable = false;
                 if (hw->pcm_ops->enable_out) {
                     hw->pcm_ops->enable_out(hw, false);
                 }
@@ -1206,13 +1206,13 @@ static void audio_run_out(AudioBackend *s)
 #ifdef DEBUG_OUT
             dolog ("Disabling voice\n");
 #endif
-            hw->enabled = 0;
-            hw->pending_disable = 0;
+            hw->enabled = false;
+            hw->pending_disable = false;
             if (hw->pcm_ops->enable_out) {
                 hw->pcm_ops->enable_out(hw, false);
             }
             for (sc = hw->cap_head.lh_first; sc; sc = sc->entries.le_next) {
-                sc->sw.active = 0;
+                sc->sw.active = false;
                 audio_recalc_and_notify_capture (sc->cap);
             }
             continue;
@@ -1257,7 +1257,7 @@ static void audio_run_out(AudioBackend *s)
             sw->total_hw_samples_mixed -= played;
 
             if (!sw->total_hw_samples_mixed) {
-                sw->empty = 1;
+                sw->empty = true;
             }
         }
     }
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 8d4f4ca8fc..df13a466e4 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -70,9 +70,9 @@ typedef struct STSampleBuffer {
 
 typedef struct HWVoiceOut {
     AudioBackend *s;
-    int enabled;
+    bool enabled;
     int poll_mode;
-    int pending_disable;
+    bool pending_disable;
     struct audio_pcm_info info;
 
     f_sample *clip;
@@ -91,7 +91,7 @@ typedef struct HWVoiceOut {
 
 typedef struct HWVoiceIn {
     AudioBackend *s;
-    int enabled;
+    bool enabled;
     int poll_mode;
     struct audio_pcm_info info;
 
@@ -117,8 +117,8 @@ struct SWVoiceOut {
     STSampleBuffer resample_buf;
     void *rate;
     size_t total_hw_samples_mixed;
-    int active;
-    int empty;
+    bool active;
+    bool empty;
     HWVoiceOut *hw;
     char *name;
     struct mixeng_volume vol;
@@ -128,7 +128,7 @@ struct SWVoiceOut {
 
 struct SWVoiceIn {
     AudioBackend *s;
-    int active;
+    bool active;
     struct audio_pcm_info info;
     void *rate;
     size_t total_hw_samples_acquired;
diff --git a/audio/audio_template.h b/audio/audio_template.h
index d621008f38..7a8c431f2d 100644
--- a/audio/audio_template.h
+++ b/audio/audio_template.h
@@ -166,10 +166,10 @@ static int glue (audio_pcm_sw_init_, TYPE) (
 
     audio_pcm_init_info (&sw->info, as);
     sw->hw = hw;
-    sw->active = 0;
+    sw->active = false;
 #ifdef DAC
     sw->total_hw_samples_mixed = 0;
-    sw->empty = 1;
+    sw->empty = true;
 #endif
 
     if (sw->info.is_float) {
@@ -564,7 +564,7 @@ SW *glue (AUD_open_, TYPE) (
     return NULL;
 }
 
-int glue (AUD_is_active_, TYPE) (SW *sw)
+bool glue(AUD_is_active_, TYPE)(SW *sw)
 {
     return sw ? sw->active : 0;
 }
diff --git a/include/qemu/audio.h b/include/qemu/audio.h
index 08753f621a..0f224810c7 100644
--- a/include/qemu/audio.h
+++ b/include/qemu/audio.h
@@ -99,8 +99,8 @@ SWVoiceOut *AUD_open_out (
 void AUD_close_out (AudioBackend *be, SWVoiceOut *sw);
 size_t AUD_write (SWVoiceOut *sw, void *pcm_buf, size_t size);
 int  AUD_get_buffer_size_out (SWVoiceOut *sw);
-void AUD_set_active_out (SWVoiceOut *sw, int on);
-int  AUD_is_active_out (SWVoiceOut *sw);
+void AUD_set_active_out(SWVoiceOut *sw, bool on);
+bool AUD_is_active_out(SWVoiceOut *sw);
 
 void     AUD_init_time_stamp_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
 uint64_t AUD_get_elapsed_usec_out (SWVoiceOut *sw, QEMUAudioTimeStamp *ts);
@@ -140,8 +140,8 @@ SWVoiceIn *AUD_open_in(
 
 void AUD_close_in(AudioBackend *be, SWVoiceIn *sw);
 size_t AUD_read (SWVoiceIn *sw, void *pcm_buf, size_t size);
-void AUD_set_active_in (SWVoiceIn *sw, int on);
-int  AUD_is_active_in (SWVoiceIn *sw);
+void AUD_set_active_in(SWVoiceIn *sw, bool on);
+bool AUD_is_active_in(SWVoiceIn *sw);
 
 void     AUD_init_time_stamp_in (SWVoiceIn *sw, QEMUAudioTimeStamp *ts);
 uint64_t AUD_get_elapsed_usec_in (SWVoiceIn *sw, QEMUAudioTimeStamp *ts);

From 9cba1ce9360d53adaf48dffa4c5a3bbfcb59f333 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Thu, 16 Oct 2025 17:46:07 +0400
Subject: [PATCH 1830/2396] audio: move capture API to own header
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For modularity/clarity reasons, move the capture API in a specific
header.

The current audio/ header license is MIT.

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 MAINTAINERS                  |  2 +-
 audio/audio_int.h            |  1 +
 include/qemu/audio-capture.h | 43 ++++++++++++++++++++++++++++++++++++
 include/qemu/audio.h         | 31 --------------------------
 ui/vnc.h                     |  2 +-
 5 files changed, 46 insertions(+), 33 deletions(-)
 create mode 100644 include/qemu/audio-capture.h

diff --git a/MAINTAINERS b/MAINTAINERS
index 24323e8800..c78aa1f565 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -2977,7 +2977,7 @@ X: audio/paaudio.c
 X: audio/sdlaudio.c
 X: audio/sndioaudio.c
 X: audio/spiceaudio.c
-F: include/qemu/audio.h
+F: include/qemu/audio*.h
 F: qapi/audio.json
 
 ALSA Audio backend
diff --git a/audio/audio_int.h b/audio/audio_int.h
index df13a466e4..5834ebea5e 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -30,6 +30,7 @@
 /* #define RECIPROCAL */
 #endif
 #include "qemu/audio.h"
+#include "qemu/audio-capture.h"
 #include "mixeng.h"
 
 #ifdef CONFIG_GIO
diff --git a/include/qemu/audio-capture.h b/include/qemu/audio-capture.h
new file mode 100644
index 0000000000..a07412db85
--- /dev/null
+++ b/include/qemu/audio-capture.h
@@ -0,0 +1,43 @@
+/*
+ * QEMU Audio subsystem
+ *
+ * SPDX-License-Identifier: MIT
+ */
+#ifndef QEMU_AUDIO_CAPTURE_H
+#define QEMU_AUDIO_CAPTURE_H
+
+#include "audio.h"
+
+typedef struct CaptureVoiceOut CaptureVoiceOut;
+
+typedef enum {
+    AUD_CNOTIFY_ENABLE,
+    AUD_CNOTIFY_DISABLE
+} audcnotification_e;
+
+struct audio_capture_ops {
+    void (*notify) (void *opaque, audcnotification_e cmd);
+    void (*capture) (void *opaque, const void *buf, int size);
+    void (*destroy) (void *opaque);
+};
+
+struct capture_ops {
+    void (*info) (void *opaque);
+    void (*destroy) (void *opaque);
+};
+
+typedef struct CaptureState {
+    void *opaque;
+    struct capture_ops ops;
+    QLIST_ENTRY(CaptureState) entries;
+} CaptureState;
+
+CaptureVoiceOut *AUD_add_capture(
+    AudioBackend *be,
+    struct audsettings *as,
+    struct audio_capture_ops *ops,
+    void *opaque
+    );
+void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque);
+
+#endif /* QEMU_AUDIO_CAPTURE_H */
diff --git a/include/qemu/audio.h b/include/qemu/audio.h
index 0f224810c7..c56af895d6 100644
--- a/include/qemu/audio.h
+++ b/include/qemu/audio.h
@@ -41,30 +41,7 @@ typedef struct audsettings {
     int endianness;
 } audsettings;
 
-typedef enum {
-    AUD_CNOTIFY_ENABLE,
-    AUD_CNOTIFY_DISABLE
-} audcnotification_e;
-
-struct audio_capture_ops {
-    void (*notify) (void *opaque, audcnotification_e cmd);
-    void (*capture) (void *opaque, const void *buf, int size);
-    void (*destroy) (void *opaque);
-};
-
-struct capture_ops {
-    void (*info) (void *opaque);
-    void (*destroy) (void *opaque);
-};
-
-typedef struct CaptureState {
-    void *opaque;
-    struct capture_ops ops;
-    QLIST_ENTRY (CaptureState) entries;
-} CaptureState;
-
 typedef struct SWVoiceOut SWVoiceOut;
-typedef struct CaptureVoiceOut CaptureVoiceOut;
 typedef struct SWVoiceIn SWVoiceIn;
 
 struct AudioBackendClass {
@@ -79,14 +56,6 @@ typedef struct QEMUAudioTimeStamp {
 
 bool AUD_backend_check(AudioBackend **be, Error **errp);
 
-CaptureVoiceOut *AUD_add_capture(
-    AudioBackend *s,
-    struct audsettings *as,
-    struct audio_capture_ops *ops,
-    void *opaque
-    );
-void AUD_del_capture (CaptureVoiceOut *cap, void *cb_opaque);
-
 SWVoiceOut *AUD_open_out (
     AudioBackend *be,
     SWVoiceOut *sw,
diff --git a/ui/vnc.h b/ui/vnc.h
index 4d8363ebf3..ec8d0c91b5 100644
--- a/ui/vnc.h
+++ b/ui/vnc.h
@@ -31,7 +31,7 @@
 #include "qemu/thread.h"
 #include "ui/clipboard.h"
 #include "ui/console.h"
-#include "qemu/audio.h"
+#include "qemu/audio-capture.h"
 #include "qemu/bitmap.h"
 #include "crypto/tlssession.h"
 #include "qemu/buffer.h"

From 8da8bf74aedee100b9c470d58c3a5e6b99ef8d96 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Sat, 18 Oct 2025 00:15:57 +0400
Subject: [PATCH 1831/2396] audio: drop needless audio_driver "descr" field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Was it ever used?

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 audio/alsaaudio.c   | 1 -
 audio/audio_int.h   | 1 -
 audio/coreaudio.m   | 1 -
 audio/dbusaudio.c   | 1 -
 audio/dsoundaudio.c | 1 -
 audio/jackaudio.c   | 1 -
 audio/noaudio.c     | 1 -
 audio/ossaudio.c    | 1 -
 audio/paaudio.c     | 1 -
 audio/pwaudio.c     | 1 -
 audio/sdlaudio.c    | 1 -
 audio/sndioaudio.c  | 1 -
 audio/spiceaudio.c  | 1 -
 audio/wavaudio.c    | 1 -
 14 files changed, 14 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index d1e4817081..89f6dad1a9 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -956,7 +956,6 @@ static struct audio_pcm_ops alsa_pcm_ops = {
 
 static struct audio_driver alsa_audio_driver = {
     .name           = "alsa",
-    .descr          = "ALSA http://www.alsa-project.org",
     .init           = alsa_audio_init,
     .fini           = alsa_audio_fini,
     .pcm_ops        = &alsa_pcm_ops,
diff --git a/audio/audio_int.h b/audio/audio_int.h
index 5834ebea5e..b2b8002477 100644
--- a/audio/audio_int.h
+++ b/audio/audio_int.h
@@ -145,7 +145,6 @@ struct SWVoiceIn {
 typedef struct audio_driver audio_driver;
 struct audio_driver {
     const char *name;
-    const char *descr;
     void *(*init) (Audiodev *, Error **);
     void (*fini) (void *);
 #ifdef CONFIG_GIO
diff --git a/audio/coreaudio.m b/audio/coreaudio.m
index 8b3cd6db16..997017a1e9 100644
--- a/audio/coreaudio.m
+++ b/audio/coreaudio.m
@@ -664,7 +664,6 @@ static struct audio_pcm_ops coreaudio_pcm_ops = {
 
 static struct audio_driver coreaudio_audio_driver = {
     .name           = "coreaudio",
-    .descr          = "CoreAudio http://developer.apple.com/audio/coreaudio.html",
     .init           = coreaudio_audio_init,
     .fini           = coreaudio_audio_fini,
     .pcm_ops        = &coreaudio_pcm_ops,
diff --git a/audio/dbusaudio.c b/audio/dbusaudio.c
index 157d36428e..d729a810aa 100644
--- a/audio/dbusaudio.c
+++ b/audio/dbusaudio.c
@@ -695,7 +695,6 @@ static struct audio_pcm_ops dbus_pcm_ops = {
 
 static struct audio_driver dbus_audio_driver = {
     .name            = "dbus",
-    .descr           = "Timer based audio exposed with DBus interface",
     .init            = dbus_audio_init,
     .fini            = dbus_audio_fini,
     .set_dbus_server = dbus_audio_set_server,
diff --git a/audio/dsoundaudio.c b/audio/dsoundaudio.c
index 8b773ded21..7a03d1dad8 100644
--- a/audio/dsoundaudio.c
+++ b/audio/dsoundaudio.c
@@ -685,7 +685,6 @@ static struct audio_pcm_ops dsound_pcm_ops = {
 
 static struct audio_driver dsound_audio_driver = {
     .name           = "dsound",
-    .descr          = "DirectSound http://wikipedia.org/wiki/DirectSound",
     .init           = dsound_audio_init,
     .fini           = dsound_audio_fini,
     .pcm_ops        = &dsound_pcm_ops,
diff --git a/audio/jackaudio.c b/audio/jackaudio.c
index 28face9989..7a3fcaedba 100644
--- a/audio/jackaudio.c
+++ b/audio/jackaudio.c
@@ -672,7 +672,6 @@ static struct audio_pcm_ops jack_pcm_ops = {
 
 static struct audio_driver jack_driver = {
     .name           = "jack",
-    .descr          = "JACK Audio Connection Kit Client",
     .init           = qjack_init,
     .fini           = qjack_fini,
     .pcm_ops        = &jack_pcm_ops,
diff --git a/audio/noaudio.c b/audio/noaudio.c
index b136b74e26..4ed9d2156c 100644
--- a/audio/noaudio.c
+++ b/audio/noaudio.c
@@ -129,7 +129,6 @@ static struct audio_pcm_ops no_pcm_ops = {
 
 static struct audio_driver no_audio_driver = {
     .name           = "none",
-    .descr          = "Timer based audio emulation",
     .init           = no_audio_init,
     .fini           = no_audio_fini,
     .pcm_ops        = &no_pcm_ops,
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 5ba91f6793..ab8791bece 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -779,7 +779,6 @@ static struct audio_pcm_ops oss_pcm_ops = {
 
 static struct audio_driver oss_audio_driver = {
     .name           = "oss",
-    .descr          = "OSS http://www.opensound.com",
     .init           = oss_audio_init,
     .fini           = oss_audio_fini,
     .pcm_ops        = &oss_pcm_ops,
diff --git a/audio/paaudio.c b/audio/paaudio.c
index 8eb80ede45..6b9b6d219a 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -922,7 +922,6 @@ static struct audio_pcm_ops qpa_pcm_ops = {
 
 static struct audio_driver pa_audio_driver = {
     .name           = "pa",
-    .descr          = "http://www.pulseaudio.org/",
     .init           = qpa_audio_init,
     .fini           = qpa_audio_fini,
     .pcm_ops        = &qpa_pcm_ops,
diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 8f6c0900c8..0fd59d9fe6 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -838,7 +838,6 @@ static struct audio_pcm_ops qpw_pcm_ops = {
 
 static struct audio_driver pw_audio_driver = {
     .name = "pipewire",
-    .descr = "http://www.pipewire.org/",
     .init = qpw_audio_init,
     .fini = qpw_audio_fini,
     .pcm_ops = &qpw_pcm_ops,
diff --git a/audio/sdlaudio.c b/audio/sdlaudio.c
index 4ef73c8dfb..a7a9652d29 100644
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -490,7 +490,6 @@ static struct audio_pcm_ops sdl_pcm_ops = {
 
 static struct audio_driver sdl_audio_driver = {
     .name           = "sdl",
-    .descr          = "SDL http://www.libsdl.org",
     .init           = sdl_audio_init,
     .fini           = sdl_audio_fini,
     .pcm_ops        = &sdl_pcm_ops,
diff --git a/audio/sndioaudio.c b/audio/sndioaudio.c
index f4f53b1c6f..8197b8b0b4 100644
--- a/audio/sndioaudio.c
+++ b/audio/sndioaudio.c
@@ -546,7 +546,6 @@ static struct audio_pcm_ops sndio_pcm_ops = {
 
 static struct audio_driver sndio_audio_driver = {
     .name           = "sndio",
-    .descr          = "sndio https://sndio.org",
     .init           = sndio_audio_init,
     .fini           = sndio_audio_fini,
     .pcm_ops        = &sndio_pcm_ops,
diff --git a/audio/spiceaudio.c b/audio/spiceaudio.c
index 77ba89ffaa..7db2d1f0df 100644
--- a/audio/spiceaudio.c
+++ b/audio/spiceaudio.c
@@ -316,7 +316,6 @@ static struct audio_pcm_ops audio_callbacks = {
 
 static struct audio_driver spice_audio_driver = {
     .name           = "spice",
-    .descr          = "spice audio driver",
     .init           = spice_audio_init,
     .fini           = spice_audio_fini,
     .pcm_ops        = &audio_callbacks,
diff --git a/audio/wavaudio.c b/audio/wavaudio.c
index 4d9c921305..46460a5d57 100644
--- a/audio/wavaudio.c
+++ b/audio/wavaudio.c
@@ -205,7 +205,6 @@ static struct audio_pcm_ops wav_pcm_ops = {
 
 static struct audio_driver wav_audio_driver = {
     .name           = "wav",
-    .descr          = "WAV renderer http://wikipedia.org/wiki/WAV",
     .init           = wav_audio_init,
     .fini           = wav_audio_fini,
     .pcm_ops        = &wav_pcm_ops,

From b8afda670446a2c89e9964a6dd5a6e0f0c026253 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 22 Oct 2025 09:53:51 +0200
Subject: [PATCH 1832/2396] audio: Remove pointless local variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 audio/ossaudio.c | 12 ++----------
 audio/sdlaudio.c | 12 ++----------
 2 files changed, 4 insertions(+), 20 deletions(-)

diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index ab8791bece..86c4805675 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -493,10 +493,8 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
 {
     OSSVoiceOut *oss = (OSSVoiceOut *) hw;
     struct oss_params req, obt;
-    int endianness;
     int err;
     int fd;
-    AudioFormat effective_fmt;
     struct audsettings obt_as;
     Audiodev *dev = drv_opaque;
     AudiodevOssOptions *oopts = &dev->u.oss;
@@ -511,7 +509,7 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
         return -1;
     }
 
-    err = oss_to_audfmt (obt.fmt, &effective_fmt, &endianness);
+    err = oss_to_audfmt(obt.fmt, &obt_as.fmt, &obt_as.endianness);
     if (err) {
         oss_anal_close (&fd);
         return -1;
@@ -519,8 +517,6 @@ static int oss_init_out(HWVoiceOut *hw, struct audsettings *as,
 
     obt_as.freq = obt.freq;
     obt_as.nchannels = obt.nchannels;
-    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
 
     audio_pcm_init_info (&hw->info, &obt_as);
     oss->nfrags = obt.nfrags;
@@ -628,10 +624,8 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 {
     OSSVoiceIn *oss = (OSSVoiceIn *) hw;
     struct oss_params req, obt;
-    int endianness;
     int err;
     int fd;
-    AudioFormat effective_fmt;
     struct audsettings obt_as;
     Audiodev *dev = drv_opaque;
 
@@ -644,7 +638,7 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
         return -1;
     }
 
-    err = oss_to_audfmt (obt.fmt, &effective_fmt, &endianness);
+    err = oss_to_audfmt(obt.fmt, &obt_as.fmt, &obt_as.endianness);
     if (err) {
         oss_anal_close (&fd);
         return -1;
@@ -652,8 +646,6 @@ static int oss_init_in(HWVoiceIn *hw, struct audsettings *as, void *drv_opaque)
 
     obt_as.freq = obt.freq;
     obt_as.nchannels = obt.nchannels;
-    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
 
     audio_pcm_init_info (&hw->info, &obt_as);
     oss->nfrags = obt.nfrags;
diff --git a/audio/sdlaudio.c b/audio/sdlaudio.c
index a7a9652d29..707110973a 100644
--- a/audio/sdlaudio.c
+++ b/audio/sdlaudio.c
@@ -338,9 +338,7 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
 {
     SDLVoiceOut *sdl = (SDLVoiceOut *)hw;
     SDL_AudioSpec req, obt;
-    int endianness;
     int err;
-    AudioFormat effective_fmt;
     Audiodev *dev = drv_opaque;
     AudiodevSdlPerDirectionOptions *spdo = dev->u.sdl.out;
     struct audsettings obt_as;
@@ -360,7 +358,7 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
         return -1;
     }
 
-    err = sdl_to_audfmt(obt.format, &effective_fmt, &endianness);
+    err = sdl_to_audfmt(obt.format, &obt_as.fmt, &obt_as.endianness);
     if (err) {
         sdl_close_out(sdl);
         return -1;
@@ -368,8 +366,6 @@ static int sdl_init_out(HWVoiceOut *hw, struct audsettings *as,
 
     obt_as.freq = obt.freq;
     obt_as.nchannels = obt.channels;
-    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
 
     audio_pcm_init_info (&hw->info, &obt_as);
     hw->samples = (spdo->has_buffer_count ? spdo->buffer_count : 4) *
@@ -398,9 +394,7 @@ static int sdl_init_in(HWVoiceIn *hw, audsettings *as, void *drv_opaque)
 {
     SDLVoiceIn *sdl = (SDLVoiceIn *)hw;
     SDL_AudioSpec req, obt;
-    int endianness;
     int err;
-    AudioFormat effective_fmt;
     Audiodev *dev = drv_opaque;
     AudiodevSdlPerDirectionOptions *spdo = dev->u.sdl.in;
     struct audsettings obt_as;
@@ -420,7 +414,7 @@ static int sdl_init_in(HWVoiceIn *hw, audsettings *as, void *drv_opaque)
         return -1;
     }
 
-    err = sdl_to_audfmt(obt.format, &effective_fmt, &endianness);
+    err = sdl_to_audfmt(obt.format, &obt_as.fmt, &obt_as.endianness);
     if (err) {
         sdl_close_in(sdl);
         return -1;
@@ -428,8 +422,6 @@ static int sdl_init_in(HWVoiceIn *hw, audsettings *as, void *drv_opaque)
 
     obt_as.freq = obt.freq;
     obt_as.nchannels = obt.channels;
-    obt_as.fmt = effective_fmt;
-    obt_as.endianness = endianness;
 
     audio_pcm_init_info(&hw->info, &obt_as);
     hw->samples = (spdo->has_buffer_count ? spdo->buffer_count : 4) *

From 0d254317716ab3a7ba3760c1270db83274598862 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 22 Oct 2025 09:53:52 +0200
Subject: [PATCH 1833/2396] audio: Rename @endianness argument as @big_endian
 for clarity
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

@endianness is used as a boolean, rename for clarity.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
---
 audio/alsaaudio.c | 32 ++++++--------------------------
 audio/ossaudio.c  | 14 +++-----------
 audio/paaudio.c   |  8 ++++----
 audio/pwaudio.c   | 12 ++++++------
 4 files changed, 19 insertions(+), 47 deletions(-)

diff --git a/audio/alsaaudio.c b/audio/alsaaudio.c
index 89f6dad1a9..7d7da576dc 100644
--- a/audio/alsaaudio.c
+++ b/audio/alsaaudio.c
@@ -264,7 +264,7 @@ static int alsa_poll_in (HWVoiceIn *hw)
     return alsa_poll_helper (alsa->handle, &alsa->pollhlp, POLLIN);
 }
 
-static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
+static snd_pcm_format_t aud_to_alsafmt(AudioFormat fmt, bool big_endian)
 {
     switch (fmt) {
     case AUDIO_FORMAT_S8:
@@ -274,39 +274,19 @@ static snd_pcm_format_t aud_to_alsafmt (AudioFormat fmt, int endianness)
         return SND_PCM_FORMAT_U8;
 
     case AUDIO_FORMAT_S16:
-        if (endianness) {
-            return SND_PCM_FORMAT_S16_BE;
-        } else {
-            return SND_PCM_FORMAT_S16_LE;
-        }
+        return big_endian ? SND_PCM_FORMAT_S16_BE : SND_PCM_FORMAT_S16_LE;
 
     case AUDIO_FORMAT_U16:
-        if (endianness) {
-            return SND_PCM_FORMAT_U16_BE;
-        } else {
-            return SND_PCM_FORMAT_U16_LE;
-        }
+        return big_endian ? SND_PCM_FORMAT_U16_BE : SND_PCM_FORMAT_U16_LE;
 
     case AUDIO_FORMAT_S32:
-        if (endianness) {
-            return SND_PCM_FORMAT_S32_BE;
-        } else {
-            return SND_PCM_FORMAT_S32_LE;
-        }
+        return big_endian ? SND_PCM_FORMAT_S32_BE : SND_PCM_FORMAT_S32_LE;
 
     case AUDIO_FORMAT_U32:
-        if (endianness) {
-            return SND_PCM_FORMAT_U32_BE;
-        } else {
-            return SND_PCM_FORMAT_U32_LE;
-        }
+        return big_endian ? SND_PCM_FORMAT_U32_BE : SND_PCM_FORMAT_U32_LE;
 
     case AUDIO_FORMAT_F32:
-        if (endianness) {
-            return SND_PCM_FORMAT_FLOAT_BE;
-        } else {
-            return SND_PCM_FORMAT_FLOAT_LE;
-        }
+        return big_endian ? SND_PCM_FORMAT_FLOAT_BE : SND_PCM_FORMAT_FLOAT_LE;
 
     default:
         dolog ("Internal logic error: Bad audio format %d\n", fmt);
diff --git a/audio/ossaudio.c b/audio/ossaudio.c
index 86c4805675..c6cad47a01 100644
--- a/audio/ossaudio.c
+++ b/audio/ossaudio.c
@@ -131,7 +131,7 @@ static void oss_poll_in (HWVoiceIn *hw)
     qemu_set_fd_handler(oss->fd, oss_helper_poll_in, NULL, hw->s);
 }
 
-static int aud_to_ossfmt (AudioFormat fmt, int endianness)
+static int aud_to_ossfmt(AudioFormat fmt, bool big_endian)
 {
     switch (fmt) {
     case AUDIO_FORMAT_S8:
@@ -141,18 +141,10 @@ static int aud_to_ossfmt (AudioFormat fmt, int endianness)
         return AFMT_U8;
 
     case AUDIO_FORMAT_S16:
-        if (endianness) {
-            return AFMT_S16_BE;
-        } else {
-            return AFMT_S16_LE;
-        }
+        return big_endian ? AFMT_S16_BE : AFMT_S16_LE;
 
     case AUDIO_FORMAT_U16:
-        if (endianness) {
-            return AFMT_U16_BE;
-        } else {
-            return AFMT_U16_LE;
-        }
+        return big_endian ? AFMT_U16_BE : AFMT_U16_LE;
 
     default:
         dolog ("Internal logic error: Bad audio format %d\n", fmt);
diff --git a/audio/paaudio.c b/audio/paaudio.c
index 6b9b6d219a..0c06a39719 100644
--- a/audio/paaudio.c
+++ b/audio/paaudio.c
@@ -316,7 +316,7 @@ unlock_and_fail:
     return 0;
 }
 
-static pa_sample_format_t audfmt_to_pa (AudioFormat afmt, int endianness)
+static pa_sample_format_t audfmt_to_pa(AudioFormat afmt, bool big_endian)
 {
     int format;
 
@@ -327,14 +327,14 @@ static pa_sample_format_t audfmt_to_pa (AudioFormat afmt, int endianness)
         break;
     case AUDIO_FORMAT_S16:
     case AUDIO_FORMAT_U16:
-        format = endianness ? PA_SAMPLE_S16BE : PA_SAMPLE_S16LE;
+        format = big_endian ? PA_SAMPLE_S16BE : PA_SAMPLE_S16LE;
         break;
     case AUDIO_FORMAT_S32:
     case AUDIO_FORMAT_U32:
-        format = endianness ? PA_SAMPLE_S32BE : PA_SAMPLE_S32LE;
+        format = big_endian ? PA_SAMPLE_S32BE : PA_SAMPLE_S32LE;
         break;
     case AUDIO_FORMAT_F32:
-        format = endianness ? PA_SAMPLE_FLOAT32BE : PA_SAMPLE_FLOAT32LE;
+        format = big_endian ? PA_SAMPLE_FLOAT32BE : PA_SAMPLE_FLOAT32LE;
         break;
     default:
         dolog ("Internal logic error: Bad audio format %d\n", afmt);
diff --git a/audio/pwaudio.c b/audio/pwaudio.c
index 0fd59d9fe6..30f717ccac 100644
--- a/audio/pwaudio.c
+++ b/audio/pwaudio.c
@@ -324,7 +324,7 @@ done_unlock:
 }
 
 static int
-audfmt_to_pw(AudioFormat fmt, int endianness)
+audfmt_to_pw(AudioFormat fmt, bool big_endian)
 {
     int format;
 
@@ -336,19 +336,19 @@ audfmt_to_pw(AudioFormat fmt, int endianness)
         format = SPA_AUDIO_FORMAT_U8;
         break;
     case AUDIO_FORMAT_S16:
-        format = endianness ? SPA_AUDIO_FORMAT_S16_BE : SPA_AUDIO_FORMAT_S16_LE;
+        format = big_endian ? SPA_AUDIO_FORMAT_S16_BE : SPA_AUDIO_FORMAT_S16_LE;
         break;
     case AUDIO_FORMAT_U16:
-        format = endianness ? SPA_AUDIO_FORMAT_U16_BE : SPA_AUDIO_FORMAT_U16_LE;
+        format = big_endian ? SPA_AUDIO_FORMAT_U16_BE : SPA_AUDIO_FORMAT_U16_LE;
         break;
     case AUDIO_FORMAT_S32:
-        format = endianness ? SPA_AUDIO_FORMAT_S32_BE : SPA_AUDIO_FORMAT_S32_LE;
+        format = big_endian ? SPA_AUDIO_FORMAT_S32_BE : SPA_AUDIO_FORMAT_S32_LE;
         break;
     case AUDIO_FORMAT_U32:
-        format = endianness ? SPA_AUDIO_FORMAT_U32_BE : SPA_AUDIO_FORMAT_U32_LE;
+        format = big_endian ? SPA_AUDIO_FORMAT_U32_BE : SPA_AUDIO_FORMAT_U32_LE;
         break;
     case AUDIO_FORMAT_F32:
-        format = endianness ? SPA_AUDIO_FORMAT_F32_BE : SPA_AUDIO_FORMAT_F32_LE;
+        format = big_endian ? SPA_AUDIO_FORMAT_F32_BE : SPA_AUDIO_FORMAT_F32_LE;
         break;
     default:
         dolog("Internal logic error: Bad audio format %d\n", fmt);

From 05404916bf89867e613da271ebff1a556c206965 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Wed, 22 Oct 2025 14:57:53 +0400
Subject: [PATCH 1834/2396] audio: deprecate HMP audio commands
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The command is niche and better served by the host audio system.
There is no QMP equivalent, fortunately. You can capture the audio
stream via remote desktop protocols too (dbus, vnc, spice).

Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20251022105753.1474739-1-marcandre.lureau@redhat.com>
---
 audio/audio-hmp-cmds.c    |  7 +++++++
 audio/meson.build         |  5 +++--
 docs/about/deprecated.rst | 20 ++++++++++++++++++++
 hmp-commands-info.hx      |  6 ++++--
 hmp-commands.hx           |  9 +++++++--
 5 files changed, 41 insertions(+), 6 deletions(-)

diff --git a/audio/audio-hmp-cmds.c b/audio/audio-hmp-cmds.c
index 1e56af21ab..1ffb5ebc74 100644
--- a/audio/audio-hmp-cmds.c
+++ b/audio/audio-hmp-cmds.c
@@ -28,6 +28,7 @@
 #include "monitor/monitor.h"
 #include "qapi/error.h"
 #include "qobject/qdict.h"
+#include "qemu/error-report.h"
 
 static QLIST_HEAD (capture_list_head, CaptureState) capture_head;
 
@@ -36,6 +37,8 @@ void hmp_info_capture(Monitor *mon, const QDict *qdict)
     int i;
     CaptureState *s;
 
+    warn_report_once("'info capture' is deprecated since v10.2, to be removed");
+
     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
         monitor_printf(mon, "[%d]: ", i);
         s->ops.info (s->opaque);
@@ -48,6 +51,8 @@ void hmp_stopcapture(Monitor *mon, const QDict *qdict)
     int n = qdict_get_int(qdict, "n");
     CaptureState *s;
 
+    warn_report_once("'stopcapture' is deprecated since v10.2, to be removed");
+
     for (s = capture_head.lh_first, i = 0; s; s = s->entries.le_next, ++i) {
         if (i == n) {
             s->ops.destroy (s->opaque);
@@ -69,6 +74,8 @@ void hmp_wavcapture(Monitor *mon, const QDict *qdict)
     Error *local_err = NULL;
     AudioBackend *as = audio_be_by_name(audiodev, &local_err);
 
+    warn_report_once("'wavcapture' is deprecated since v10.2, to be removed");
+
     if (!as) {
         error_report_err(local_err);
         return;
diff --git a/audio/meson.build b/audio/meson.build
index 37789437fb..b2dca2c640 100644
--- a/audio/meson.build
+++ b/audio/meson.build
@@ -1,12 +1,13 @@
 system_ss.add(files(
   'audio.c',
-  'audio-hmp-cmds.c',
   'mixeng.c',
   'noaudio.c',
   'wavaudio.c',
-  'wavcapture.c',
 ))
 
+# deprecated since v10.2, to be removed
+system_ss.add(files('audio-hmp-cmds.c', 'wavcapture.c'))
+
 system_ss.add(when: coreaudio, if_true: files('coreaudio.m'))
 system_ss.add(when: dsound, if_true: files('dsoundaudio.c', 'audio_win_int.c'))
 
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index ca6b3769b5..4ee98d6646 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -169,6 +169,26 @@ Use ``job-finalize`` instead.
 
 This argument has always been ignored.
 
+Human Machine Protocol (HMP) commands
+-------------------------------------
+
+``wavcapture`` (since 10.2)
+''''''''''''''''''''''''''''
+
+The ``wavcapture`` command is deprecated and will be removed in a future release.
+
+Use ``-audiodev wav`` or your host audio system to capture audio.
+
+``stopcapture`` (since 10.2)
+''''''''''''''''''''''''''''
+
+The ``stopcapture`` command is deprecated and will be removed in a future release.
+
+``info`` argument ``capture`` (since 10.2)
+''''''''''''''''''''''''''''''''''''''''''
+
+The ``info capture`` command is deprecated and will be removed in a future release.
+
 Host Architectures
 ------------------
 
diff --git a/hmp-commands-info.hx b/hmp-commands-info.hx
index 2a7f5810d7..41674dcbe1 100644
--- a/hmp-commands-info.hx
+++ b/hmp-commands-info.hx
@@ -363,18 +363,20 @@ SRST
     Show host USB devices.
 ERST
 
+/* BEGIN deprecated */
     {
         .name       = "capture",
         .args_type  = "",
         .params     = "",
-        .help       = "show capture information",
+        .help       = "show capture information (deprecated)",
         .cmd        = hmp_info_capture,
     },
 
 SRST
   ``info capture``
-    Show capture information.
+    Show capture information (deprecated).
 ERST
+/* END deprecated */
 
     {
         .name       = "snapshots",
diff --git a/hmp-commands.hx b/hmp-commands.hx
index 15f6082596..5cc4788f12 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -764,11 +764,12 @@ SRST
 
 ERST
 
+/* BEGIN deprecated */
     {
         .name       = "wavcapture",
         .args_type  = "path:F,audiodev:s,freq:i?,bits:i?,nchannels:i?",
         .params     = "path audiodev [frequency [bits [channels]]]",
-        .help       = "capture audio to a wave file (default frequency=44100 bits=16 channels=2)",
+        .help       = "capture audio to a wave file (deprecated, default frequency=44100 bits=16 channels=2)",
         .cmd        = hmp_wavcapture,
     },
 SRST
@@ -782,13 +783,15 @@ SRST
   - Sample rate = 44100 Hz - CD quality
   - Bits = 16
   - Number of channels = 2 - Stereo
+
+  Deprecated.
 ERST
 
     {
         .name       = "stopcapture",
         .args_type  = "n:i",
         .params     = "capture index",
-        .help       = "stop capture",
+        .help       = "stop capture (deprecated)",
         .cmd        = hmp_stopcapture,
     },
 SRST
@@ -797,7 +800,9 @@ SRST
 
     info capture
 
+  Deprecated.
 ERST
+/* END deprecated */
 
     {
         .name       = "memsave",

From 4dea00368dc75189af1773e3a06cbdb320b1dc7b Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 21 Oct 2025 14:35:39 -0500
Subject: [PATCH 1835/2396] accel/tcg: Introduce and use MO_ALIGN_TLB_ONLY
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For Arm, we need 3 cases: (1) the alignment required when accessing
Normal memory, (2) the alignment required when accessing Device memory,
and (3) the atomicity of the access.

When we added TLB_CHECK_ALIGNED, we assumed that cases 2 and 3 were
identical, and thus used memop_atomicity_bits for TLB_CHECK_ALIGNED.

This is incorrect for multiple reasons, including that the atomicity
of the access is adjusted depending on whether or not we are executing
within a serial context.

For Arm, what is true is that there is an underlying alignment
requirement of the access, and for that access Normal memory
will support unalignement.

Introduce MO_ALIGN_TLB_ONLY to indicate that the alignment
specified in MO_AMASK only applies when the TLB entry has
TLB_CHECK_ALIGNED set; otherwise no alignment required.

Introduce memop_tlb_alignment_bits with an additional bool
argument that specifies whether TLB_CHECK_ALIGNED is set.
All other usage of memop_alignment_bits assumes it is not.

Remove memop_atomicity_bits as unused; it didn't properly
support MO_ATOM_SUBWORD anyway.

Update target/arm finalize_memop_atom to set MO_ALIGN_TLB_ONLY
when strict alignment isn't otherwise required.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3171
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 accel/tcg/cputlb.c              | 13 +---------
 include/exec/memop.h            | 43 +++++++++++++++------------------
 target/arm/ptw.c                |  2 +-
 target/arm/tcg/translate-a64.c  | 10 +++-----
 target/arm/tcg/translate-neon.c |  2 +-
 target/arm/tcg/translate.h      |  4 +--
 tcg/tcg.c                       | 10 +++++---
 7 files changed, 35 insertions(+), 49 deletions(-)

diff --git a/accel/tcg/cputlb.c b/accel/tcg/cputlb.c
index 631f1fe135..fd1606c856 100644
--- a/accel/tcg/cputlb.c
+++ b/accel/tcg/cputlb.c
@@ -1668,18 +1668,7 @@ static bool mmu_lookup1(CPUState *cpu, MMULookupPageData *data, MemOp memop,
 
     if (likely(!maybe_resized)) {
         /* Alignment has not been checked by tlb_fill_align. */
-        int a_bits = memop_alignment_bits(memop);
-
-        /*
-         * This alignment check differs from the one above, in that this is
-         * based on the atomicity of the operation. The intended use case is
-         * the ARM memory type field of each PTE, where access to pages with
-         * Device memory type require alignment.
-         */
-        if (unlikely(flags & TLB_CHECK_ALIGNED)) {
-            int at_bits = memop_atomicity_bits(memop);
-            a_bits = MAX(a_bits, at_bits);
-        }
+        int a_bits = memop_tlb_alignment_bits(memop, flags & TLB_CHECK_ALIGNED);
         if (unlikely(addr & ((1 << a_bits) - 1))) {
             cpu_unaligned_access(cpu, addr, access_type, mmu_idx, ra);
         }
diff --git a/include/exec/memop.h b/include/exec/memop.h
index cf7da3362e..799b5b4221 100644
--- a/include/exec/memop.h
+++ b/include/exec/memop.h
@@ -72,6 +72,16 @@ typedef enum MemOp {
     MO_ALIGN_64 = 6 << MO_ASHIFT,
     MO_ALIGN    = MO_AMASK,
 
+    /*
+     * MO_ALIGN_TLB_ONLY:
+     * Apply MO_AMASK only along the TCG slow path if TLB_CHECK_ALIGNED
+     * is set; otherwise unaligned access is permitted.
+     * This is used by target/arm, where unaligned accesses are
+     * permitted for pages marked Normal but aligned accesses are
+     * required for pages marked Device.
+     */
+    MO_ALIGN_TLB_ONLY = 1 << 8,
+
     /*
      * MO_ATOM_* describes the atomicity requirements of the operation:
      * MO_ATOM_IFALIGN: the operation must be single-copy atomic if it
@@ -104,7 +114,7 @@ typedef enum MemOp {
      * size of the operation, if aligned.  This retains the behaviour
      * from before this field was introduced.
      */
-    MO_ATOM_SHIFT         = 8,
+    MO_ATOM_SHIFT         = 9,
     MO_ATOM_IFALIGN       = 0 << MO_ATOM_SHIFT,
     MO_ATOM_IFALIGN_PAIR  = 1 << MO_ATOM_SHIFT,
     MO_ATOM_WITHIN16      = 2 << MO_ATOM_SHIFT,
@@ -169,16 +179,16 @@ static inline MemOp size_memop(unsigned size)
 }
 
 /**
- * memop_alignment_bits:
+ * memop_tlb_alignment_bits:
  * @memop: MemOp value
  *
- * Extract the alignment size from the memop.
+ * Extract the alignment size for use with TLB_CHECK_ALIGNED.
  */
-static inline unsigned memop_alignment_bits(MemOp memop)
+static inline unsigned memop_tlb_alignment_bits(MemOp memop, bool tlb_check)
 {
     unsigned a = memop & MO_AMASK;
 
-    if (a == MO_UNALN) {
+    if (a == MO_UNALN || (!tlb_check && (memop & MO_ALIGN_TLB_ONLY))) {
         /* No alignment required.  */
         a = 0;
     } else if (a == MO_ALIGN) {
@@ -191,28 +201,15 @@ static inline unsigned memop_alignment_bits(MemOp memop)
     return a;
 }
 
-/*
- * memop_atomicity_bits:
+/**
+ * memop_alignment_bits:
  * @memop: MemOp value
  *
- * Extract the atomicity size from the memop.
+ * Extract the alignment size from the memop.
  */
-static inline unsigned memop_atomicity_bits(MemOp memop)
+static inline unsigned memop_alignment_bits(MemOp memop)
 {
-    unsigned size = memop & MO_SIZE;
-
-    switch (memop & MO_ATOM_MASK) {
-    case MO_ATOM_NONE:
-        size = MO_8;
-        break;
-    case MO_ATOM_IFALIGN_PAIR:
-    case MO_ATOM_WITHIN16_PAIR:
-        size = size ? size - 1 : 0;
-        break;
-    default:
-        break;
-    }
-    return size;
+    return memop_tlb_alignment_bits(memop, false);
 }
 
 #endif
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index 23f6616811..2e6b149b2d 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -2352,7 +2352,7 @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * CPUs with ARM_FEATURE_LPAE but not ARM_FEATURE_V7VE anyway.)
      */
     if (device) {
-        unsigned a_bits = memop_atomicity_bits(memop);
+        unsigned a_bits = memop_tlb_alignment_bits(memop, true);
         if (address & ((1 << a_bits) - 1)) {
             fi->type = ARMFault_Alignment;
             goto do_fault;
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 3292d7cbfd..08b21d7dbf 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -3691,9 +3691,8 @@ static bool trans_STP(DisasContext *s, arg_ldstpair *a)
      * In all cases, issue one operation with the correct atomicity.
      */
     mop = a->sz + 1;
-    if (s->align_mem) {
-        mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
-    }
+    mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
+    mop |= (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
     mop = finalize_memop_pair(s, mop);
     if (a->sz == 2) {
         TCGv_i64 tmp = tcg_temp_new_i64();
@@ -3742,9 +3741,8 @@ static bool trans_LDP(DisasContext *s, arg_ldstpair *a)
      * since that reuses the most code below.
      */
     mop = a->sz + 1;
-    if (s->align_mem) {
-        mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
-    }
+    mop |= (a->sz == 2 ? MO_ALIGN_4 : MO_ALIGN_8);
+    mop |= (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
     mop = finalize_memop_pair(s, mop);
     if (a->sz == 2) {
         int o2 = s->be_data == MO_LE ? 32 : 0;
diff --git a/target/arm/tcg/translate-neon.c b/target/arm/tcg/translate-neon.c
index 844d2e29e4..e3c7d9217b 100644
--- a/target/arm/tcg/translate-neon.c
+++ b/target/arm/tcg/translate-neon.c
@@ -520,7 +520,7 @@ static bool trans_VLDST_multiple(DisasContext *s, arg_VLDST_multiple *a)
     if (a->align) {
         align = pow2_align(a->align + 2); /* 4 ** a->align */
     } else {
-        align = s->align_mem ? MO_ALIGN : 0;
+        align = MO_ALIGN | (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
     }
 
     /*
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index 9a85ea74db..b62104b4ae 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -744,8 +744,8 @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
  */
 static inline MemOp finalize_memop_atom(DisasContext *s, MemOp opc, MemOp atom)
 {
-    if (s->align_mem && !(opc & MO_AMASK)) {
-        opc |= MO_ALIGN;
+    if (!(opc & MO_AMASK)) {
+        opc |= MO_ALIGN | (s->align_mem ? 0 : MO_ALIGN_TLB_ONLY);
     }
     return opc | atom | s->be_data;
 }
diff --git a/tcg/tcg.c b/tcg/tcg.c
index 294762c283..fbf09f5c82 100644
--- a/tcg/tcg.c
+++ b/tcg/tcg.c
@@ -3039,20 +3039,22 @@ void tcg_dump_ops(TCGContext *s, FILE *f, bool have_prefs)
             case INDEX_op_qemu_ld2:
             case INDEX_op_qemu_st2:
                 {
-                    const char *s_al, *s_op, *s_at;
+                    const char *s_al, *s_tlb, *s_op, *s_at;
                     MemOpIdx oi = op->args[k++];
                     MemOp mop = get_memop(oi);
                     unsigned ix = get_mmuidx(oi);
 
+                    s_tlb = mop & MO_ALIGN_TLB_ONLY ? "tlb+" : "";
                     s_al = alignment_name[(mop & MO_AMASK) >> MO_ASHIFT];
                     s_op = ldst_name[mop & (MO_BSWAP | MO_SSIZE)];
                     s_at = atom_name[(mop & MO_ATOM_MASK) >> MO_ATOM_SHIFT];
-                    mop &= ~(MO_AMASK | MO_BSWAP | MO_SSIZE | MO_ATOM_MASK);
+                    mop &= ~(MO_AMASK | MO_BSWAP | MO_SSIZE |
+                             MO_ATOM_MASK | MO_ALIGN_TLB_ONLY);
 
                     /* If all fields are accounted for, print symbolically. */
                     if (!mop && s_al && s_op && s_at) {
-                        col += ne_fprintf(f, ",%s%s%s,%u",
-                                          s_at, s_al, s_op, ix);
+                        col += ne_fprintf(f, ",%s%s%s%s,%u",
+                                          s_at, s_al, s_tlb, s_op, ix);
                     } else {
                         mop = get_memop(oi);
                         col += ne_fprintf(f, ",$0x%x,%u", mop, ix);

From 170a39f8fbb50f6b74c82e4731d52da167c6d934 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 1 Jan 2025 10:04:00 -0800
Subject: [PATCH 1836/2396] tcg: Simplify extract2 usage in tcg_gen_shifti_i64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The else after the TCG_TARGET_HAS_extract2 test is exactly
the same as what tcg_gen_extract2_i32 would emit itself.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op.c | 22 ++++------------------
 1 file changed, 4 insertions(+), 18 deletions(-)

diff --git a/tcg/tcg-op.c b/tcg/tcg-op.c
index dfa5c38728..ab7b409be6 100644
--- a/tcg/tcg-op.c
+++ b/tcg/tcg-op.c
@@ -1818,30 +1818,16 @@ static inline void tcg_gen_shifti_i64(TCGv_i64 ret, TCGv_i64 arg1,
             tcg_gen_movi_i32(TCGV_LOW(ret), 0);
         }
     } else if (right) {
-        if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
-            tcg_gen_extract2_i32(TCGV_LOW(ret),
-                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), c);
-        } else {
-            tcg_gen_shri_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
-            tcg_gen_deposit_i32(TCGV_LOW(ret), TCGV_LOW(ret),
-                                TCGV_HIGH(arg1), 32 - c, c);
-        }
+        tcg_gen_extract2_i32(TCGV_LOW(ret), TCGV_LOW(arg1),
+                             TCGV_HIGH(arg1), c);
         if (arith) {
             tcg_gen_sari_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
         } else {
             tcg_gen_shri_i32(TCGV_HIGH(ret), TCGV_HIGH(arg1), c);
         }
     } else {
-        if (tcg_op_supported(INDEX_op_extract2, TCG_TYPE_I32, 0)) {
-            tcg_gen_extract2_i32(TCGV_HIGH(ret),
-                                 TCGV_LOW(arg1), TCGV_HIGH(arg1), 32 - c);
-        } else {
-            TCGv_i32 t0 = tcg_temp_ebb_new_i32();
-            tcg_gen_shri_i32(t0, TCGV_LOW(arg1), 32 - c);
-            tcg_gen_deposit_i32(TCGV_HIGH(ret), t0,
-                                TCGV_HIGH(arg1), c, 32 - c);
-            tcg_temp_free_i32(t0);
-        }
+        tcg_gen_extract2_i32(TCGV_HIGH(ret), TCGV_LOW(arg1),
+                             TCGV_HIGH(arg1), 32 - c);
         tcg_gen_shli_i32(TCGV_LOW(ret), TCGV_LOW(arg1), c);
     }
 }

From 1c11aa180714e8fb1df87923b6ddd0b17aa26204 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 31 Oct 2025 10:41:17 +0100
Subject: [PATCH 1837/2396] tests/functional: Mark the MIPS replay tests as
 flaky
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MIPS test_replay.py often times out (likely hang) under GitLab CI:

  2/21 qemu:func-thorough+func-mips64el-thorough+thorough / func-mips64el-replay   TIMEOUT   180.12s   killed by signal 15 SIGTERM

The console.log file is empty, and recording.logs only shows:

  qemu-system-mips64el: terminating on signal 15 from pid 344

Since this is a long term issue affecting our CI, disable the tests.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-2-philmd@linaro.org>
---
 tests/functional/mips/test_replay.py     | 2 ++
 tests/functional/mips64el/test_replay.py | 2 ++
 2 files changed, 4 insertions(+)

diff --git a/tests/functional/mips/test_replay.py b/tests/functional/mips/test_replay.py
index 4327481e35..747835bf00 100755
--- a/tests/functional/mips/test_replay.py
+++ b/tests/functional/mips/test_replay.py
@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import Asset, skipSlowTest
+from qemu_test import skipFlakyTest
 from replay_kernel import ReplayKernelBase
 
 
@@ -16,6 +17,7 @@ class MipsReplay(ReplayKernelBase):
          'linux-image-2.6.32-5-4kc-malta_2.6.32-48_mips.deb'),
         '16ca524148afb0626f483163e5edf352bc1ab0e4fc7b9f9d473252762f2c7a43')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
     def test_replay_mips_malta(self):
         self.set_machine('malta')
         kernel_path = self.archive_extract(self.ASSET_KERNEL_2_63_2,
diff --git a/tests/functional/mips64el/test_replay.py b/tests/functional/mips64el/test_replay.py
index 26a6ccff3f..05cc585f85 100755
--- a/tests/functional/mips64el/test_replay.py
+++ b/tests/functional/mips64el/test_replay.py
@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import Asset, skipUntrustedTest
+from qemu_test import skipFlakyTest
 from replay_kernel import ReplayKernelBase
 
 
@@ -16,6 +17,7 @@ class Mips64elReplay(ReplayKernelBase):
          'linux-image-2.6.32-5-5kc-malta_2.6.32-48_mipsel.deb'),
         '35eb476f03be589824b0310358f1c447d85e645b88cbcd2ac02b97ef560f9f8d')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
     def test_replay_mips64el_malta(self):
         self.set_machine('malta')
         kernel_path = self.archive_extract(self.ASSET_KERNEL_2_63_2,

From 34117f03edb53e37108845060c34af3aad8d0c43 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 31 Oct 2025 10:41:18 +0100
Subject: [PATCH 1838/2396] tests/functional: Mark the MIPS Debian Wheezy tests
 as flaky
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

test_malta.py sometimes times out (likely hang) under GitLab CI:

  1/57 qemu:func-thorough+func-mips-thorough+thorough / func-mips-malta    TIMEOUT   480.11s   killed by signal 15 SIGTERM

console.log shows a soft lockup failure:

  06:46,426: INIT: version 2.88 booting
  06:46,942: [[36minfo[39;49m] Using makefile-style concurrent boot in runlevel S.
  06:47,378: findfs: unable to resolve 'UUID=042f1883-e9a5-4801-bb9b-667b5c8e87ea'
  06:50,448: [....] Starting the hotplug events dispatcher: udevd[?25l[?1c7[1G[[32m ok [39;49m8[?25h[?0c.
  06:52,269: [....] Synthesizing the initial hotplug events...module e1000: dangerous R_MIPS_LO16 REL relocation
  07:17,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
  07:17,707: Modules linked in:
  07:17,707: Cpu 0
  07:17,708: $ 0   : 00000000 1000a400 0000003d 87808b00
  07:17,708: $ 4   : 87808b00 87808bf0 00000000 00000000
  07:17,709: $ 8   : 86862100 86862100 86862100 86862100
  07:17,709: $12   : 86862100 00000000 00000001 86862100
  07:17,709: $16   : 87808a00 86862100 1000a401 c008fa60
  07:17,709: $20   : 86862100 8041d230 00000000 ffff0000
  07:17,710: $24   : 00000000 77711470
  07:17,710: $28   : 87bb6000 87bb7df8 8041d230 801f7388
  07:17,710: Hi    : 00000000
  07:17,710: Lo    : 00000000
  07:17,711: epc   : 801f7308 kfree+0x104/0x19c
  07:17,711: Not tainted
  07:17,711: ra    : 801f7388 kfree+0x184/0x19c
  07:17,712: Status: 1000a403    KERNEL EXL IE
  07:17,712: Cause : 50808000
  07:17,712: PrId  : 00019300 (MIPS 24Kc)
  07:45,707: BUG: soft lockup - CPU#0 stuck for 22s! [modprobe:208]
  07:45,707: Modules linked in:

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251031094118.28440-3-philmd@linaro.org>
---
 tests/functional/mips/test_malta.py     | 2 ++
 tests/functional/mips64/test_malta.py   | 2 ++
 tests/functional/mips64el/test_malta.py | 1 +
 tests/functional/mipsel/test_malta.py   | 2 ++
 4 files changed, 7 insertions(+)

diff --git a/tests/functional/mips/test_malta.py b/tests/functional/mips/test_malta.py
index 30279f0ff2..7a734bc069 100755
--- a/tests/functional/mips/test_malta.py
+++ b/tests/functional/mips/test_malta.py
@@ -9,6 +9,7 @@
 import os
 
 from qemu_test import LinuxKernelTest, Asset, wait_for_console_pattern
+from qemu_test import skipFlakyTest
 from qemu_test import exec_command_and_wait_for_pattern
 
 
@@ -181,6 +182,7 @@ class MaltaMachineConsole(LinuxKernelTest):
          'debian_wheezy_mips_standard.qcow2'),
         'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
     def test_wheezy(self):
         kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
         image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mips64/test_malta.py b/tests/functional/mips64/test_malta.py
index a553d3c5bc..91c57c56af 100755
--- a/tests/functional/mips64/test_malta.py
+++ b/tests/functional/mips64/test_malta.py
@@ -5,6 +5,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import LinuxKernelTest, Asset
+from qemu_test import skipFlakyTest
 from mips.test_malta import mips_check_wheezy
 
 
@@ -20,6 +21,7 @@ class MaltaMachineConsole(LinuxKernelTest):
          'debian_wheezy_mips_standard.qcow2'),
         'de03599285b8382ad309309a6c4869f6c6c42a5cfc983342bab9ec0dfa7849a2')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
     def test_wheezy(self):
         kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
         image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mips64el/test_malta.py b/tests/functional/mips64el/test_malta.py
index 170147bfcc..e37463dc29 100755
--- a/tests/functional/mips64el/test_malta.py
+++ b/tests/functional/mips64el/test_malta.py
@@ -102,6 +102,7 @@ class MaltaMachineConsole(LinuxKernelTest):
          'debian_wheezy_mipsel_standard.qcow2'),
         '454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
     def test_wheezy(self):
         kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
         image_path = self.ASSET_WHEEZY_DISK.fetch()
diff --git a/tests/functional/mipsel/test_malta.py b/tests/functional/mipsel/test_malta.py
index 427e163d19..59ab4a6058 100755
--- a/tests/functional/mipsel/test_malta.py
+++ b/tests/functional/mipsel/test_malta.py
@@ -10,6 +10,7 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from qemu_test import QemuSystemTest, LinuxKernelTest, Asset
+from qemu_test import skipFlakyTest
 from qemu_test import interrupt_interactive_console_until_pattern
 from qemu_test import wait_for_console_pattern
 
@@ -69,6 +70,7 @@ class MaltaMachineConsole(LinuxKernelTest):
          'debian_wheezy_mipsel_standard.qcow2'),
         '454f09ae39f7e6461c84727b927100d2c7813841f2a0a5dce328114887ecf914')
 
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/3109")
     def test_wheezy(self):
         kernel_path = self.ASSET_WHEEZY_KERNEL.fetch()
         image_path = self.ASSET_WHEEZY_DISK.fetch()

From 0db2de22fcbf90adafab9d9dd1fc8203c66bfa75 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 28 Oct 2025 14:20:01 +0000
Subject: [PATCH 1839/2396] linux-user: permit sendto() with NULL buf and 0 len
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If you pass sendto() a NULL buffer, this is usually an error
(causing an EFAULT return); however if you pass a 0 length then
we should not try to validate the buffer provided. Instead we
skip the copying of the user data and possible processing
through fd_trans_target_to_host_data, and call the host syscall
with NULL, 0.

(unlock_user() permits a NULL buffer pointer for "do nothing"
so we don't need to special case the unlock code.)

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3102
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251028142001.3011630-1-peter.maydell@linaro.org>
---
 linux-user/syscall.c | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 8546f48a05..2060e561a2 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -3581,7 +3581,7 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
                           abi_ulong target_addr, socklen_t addrlen)
 {
     void *addr;
-    void *host_msg;
+    void *host_msg = NULL;
     void *copy_msg = NULL;
     abi_long ret;
 
@@ -3589,16 +3589,19 @@ static abi_long do_sendto(int fd, abi_ulong msg, size_t len, int flags,
         return -TARGET_EINVAL;
     }
 
-    host_msg = lock_user(VERIFY_READ, msg, len, 1);
-    if (!host_msg)
-        return -TARGET_EFAULT;
-    if (fd_trans_target_to_host_data(fd)) {
-        copy_msg = host_msg;
-        host_msg = g_malloc(len);
-        memcpy(host_msg, copy_msg, len);
-        ret = fd_trans_target_to_host_data(fd)(host_msg, len);
-        if (ret < 0) {
-            goto fail;
+    if (len != 0) {
+        host_msg = lock_user(VERIFY_READ, msg, len, 1);
+        if (!host_msg) {
+            return -TARGET_EFAULT;
+        }
+        if (fd_trans_target_to_host_data(fd)) {
+            copy_msg = host_msg;
+            host_msg = g_malloc(len);
+            memcpy(host_msg, copy_msg, len);
+            ret = fd_trans_target_to_host_data(fd)(host_msg, len);
+            if (ret < 0) {
+                goto fail;
+            }
         }
     }
     if (target_addr) {

From 92122685e5ed95c143fdfa223c170f11867db7bd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 21 Oct 2025 16:53:13 +0200
Subject: [PATCH 1840/2396] hw/gpio/pl061: Declare pullups/pulldowns as 8-bit
 types
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

uint8_t is good enough to hold a property "between 0 and 0xff".

Define pullups/pulldowns properties using DEFINE_PROP_UINT8()
macro, remove unnecessary range checks in pl061_realize().
Update the two caller sites.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c        |  4 ++--
 hw/gpio/pl061.c      | 16 ++++------------
 hw/vmapple/vmapple.c |  4 ++--
 3 files changed, 8 insertions(+), 16 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index d07cfe1651..b3ecd6dce3 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -1136,8 +1136,8 @@ static void create_gpio_devices(const VirtMachineState *vms, int gpio,
 
     pl061_dev = qdev_new("pl061");
     /* Pull lines down to 0 if not driven by the PL061 */
-    qdev_prop_set_uint32(pl061_dev, "pullups", 0);
-    qdev_prop_set_uint32(pl061_dev, "pulldowns", 0xff);
+    qdev_prop_set_uint8(pl061_dev, "pullups", 0);
+    qdev_prop_set_uint8(pl061_dev, "pulldowns", 0xff);
     s = SYS_BUS_DEVICE(pl061_dev);
     sysbus_realize_and_unref(s, &error_fatal);
     memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));
diff --git a/hw/gpio/pl061.c b/hw/gpio/pl061.c
index 1acca3f2f8..a3ac038c2f 100644
--- a/hw/gpio/pl061.c
+++ b/hw/gpio/pl061.c
@@ -79,8 +79,8 @@ struct PL061State {
     qemu_irq out[N_GPIOS];
     const unsigned char *id;
     /* Properties, for non-Luminary PL061 */
-    uint32_t pullups;
-    uint32_t pulldowns;
+    uint8_t pullups;
+    uint8_t pulldowns;
 };
 
 static const VMStateDescription vmstate_pl061 = {
@@ -547,14 +547,6 @@ static void pl061_realize(DeviceState *dev, Error **errp)
 {
     PL061State *s = PL061(dev);
 
-    if (s->pullups > 0xff) {
-        error_setg(errp, "pullups property must be between 0 and 0xff");
-        return;
-    }
-    if (s->pulldowns > 0xff) {
-        error_setg(errp, "pulldowns property must be between 0 and 0xff");
-        return;
-    }
     if (s->pullups & s->pulldowns) {
         error_setg(errp, "no bit may be set both in pullups and pulldowns");
         return;
@@ -562,8 +554,8 @@ static void pl061_realize(DeviceState *dev, Error **errp)
 }
 
 static const Property pl061_props[] = {
-    DEFINE_PROP_UINT32("pullups", PL061State, pullups, 0xff),
-    DEFINE_PROP_UINT32("pulldowns", PL061State, pulldowns, 0x0),
+    DEFINE_PROP_UINT8("pullups", PL061State, pullups, 0xff),
+    DEFINE_PROP_UINT8("pulldowns", PL061State, pulldowns, 0x0),
 };
 
 static void pl061_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/vmapple/vmapple.c b/hw/vmapple/vmapple.c
index 1e4365f32c..f3cff32924 100644
--- a/hw/vmapple/vmapple.c
+++ b/hw/vmapple/vmapple.c
@@ -326,8 +326,8 @@ static void create_gpio_devices(const VMAppleMachineState *vms, int gpio,
 
     pl061_dev = qdev_new("pl061");
     /* Pull lines down to 0 if not driven by the PL061 */
-    qdev_prop_set_uint32(pl061_dev, "pullups", 0);
-    qdev_prop_set_uint32(pl061_dev, "pulldowns", 0xff);
+    qdev_prop_set_uint8(pl061_dev, "pullups", 0);
+    qdev_prop_set_uint8(pl061_dev, "pulldowns", 0xff);
     s = SYS_BUS_DEVICE(pl061_dev);
     sysbus_realize_and_unref(s, &error_fatal);
     memory_region_add_subregion(mem, base, sysbus_mmio_get_region(s, 0));

From 65e3b1de55ed6625197a188469e52fe6c6096406 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 27 Oct 2025 12:40:47 +0000
Subject: [PATCH 1841/2396] docs/system/arm/virt: Document user-creatable
 SMMUv3

The virt machine now supports creating multiple SMMUv3 instances, each
associated with a separate PCIe root complex.

Update the documentation with an example.

Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
[PMM: some minor wording tweaks]

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst | 35 +++++++++++++++++++++++++++++++++--
 1 file changed, 33 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index 10cbffc8a7..e5570773ba 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -37,7 +37,8 @@ The virt board supports:
 - An RTC
 - The fw_cfg device that allows a guest to obtain data from QEMU
 - A PL061 GPIO controller
-- An optional SMMUv3 IOMMU
+- An optional machine-wide SMMUv3 IOMMU
+- User-creatable SMMUv3 devices (see below for example)
 - hotpluggable DIMMs
 - hotpluggable NVDIMMs
 - An MSI controller (GICv2M or ITS). GICv2M is selected by default along
@@ -176,7 +177,7 @@ iommu
   ``none``
     Don't create an IOMMU (the default)
   ``smmuv3``
-    Create an SMMUv3
+    Create a machine-wide SMMUv3.
 
 default-bus-bypass-iommu
   Set ``on``/``off`` to enable/disable `bypass_iommu
@@ -219,6 +220,36 @@ x-oem-table-id
   Set string (up to 8 bytes) to override the default value of field OEM Table ID
   in ACPI table header.
 
+SMMU configuration
+""""""""""""""""""
+
+Machine-wide SMMUv3 IOMMU
+  Setting the machine-specific option ``iommu=smmuv3`` causes QEMU to
+  create a single, machine-wide SMMUv3 instance that applies to all
+  devices in the PCIe topology.
+
+  For information about selectively bypassing devices, refer to
+  ``docs/bypass-iommu.txt``.
+
+User-creatable SMMUv3 devices
+  You can use the ``-device arm-smmuv3`` option to create multiple
+  user-defined SMMUv3 devices, each associated with a separate PCIe
+  root complex. This is only permitted if the machine-wide SMMUv3
+  (``iommu=smmuv3``) option is not used. Each ``arm-smmuv3`` device
+  uses the ``primary-bus`` sub-option to specify which PCIe root
+  complex it is associated with.
+
+  This model is useful when you want to mirror a host configuration where
+  each NUMA node typically has its own SMMU, allowing the VM topology to
+  align more closely with the host’s hardware layout.
+
+  Example::
+
+      -device arm-smmuv3,primary-bus=pcie.0,id=smmuv3.0
+      ...
+      -device pxb-pcie,id=pcie.1,numa_node=1
+      -device arm-smmuv3,primary-bus=pcie.1,id=smmuv3.1
+
 Linux guest kernel configuration
 """"""""""""""""""""""""""""""""
 

From f16f2586ec95da3c2fb06bad9047d9c43f76185b Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 16 Oct 2025 14:11:59 +0100
Subject: [PATCH 1842/2396] docs/system/security: Restrict "virtualization use
 case" to specific machines

Currently our security policy defines a "virtualization use case"
where we consider bugs to be security issues, and a
"non-virtualization use case" where we do not make any security
guarantees and don't consider bugs to be security issues.

The rationale for this split is that much code in QEMU is older and
was not written with malicious guests in mind, and we don't have the
resources to audit, fix and defend it.  So instead we inform users
about what the can in practice rely on as a security barrier, and
what they can't.

We don't currently restrict the "virtualization use case" to any
particular set of machine types.  This means that we have effectively
barred ourselves from adding KVM support to any machine type that we
don't want to put into the "bugs are security issues" category, even
if it would be useful for users to be able to get better performance
with a trusted guest by enabling KVM. This seems an unnecessary
restriction, and in practice the set of machine types it makes
sense to use for untrusted-guest virtualization is quite small.

Specifically, we would like to be able to enable the use of
KVM with the imx8 development board machine types, but we don't
want to commit ourselves to having to support those SoC models
and device models as part of QEMU's security boundary:
https://lore.kernel.org/qemu-devel/20250629204851.1778-3-shentey@gmail.com/

This patch updates the security policy to explicitly list the
machine types we consider to be useful for the "virtualization
use case".

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251016131159.750480-1-peter.maydell@linaro.org
Acked-by: Markus Armbruster <armbru@redhat.com>
---
 docs/system/security.rst | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/docs/system/security.rst b/docs/system/security.rst
index f2092c8768..53992048e6 100644
--- a/docs/system/security.rst
+++ b/docs/system/security.rst
@@ -35,6 +35,32 @@ malicious:
 Bugs affecting these entities are evaluated on whether they can cause damage in
 real-world use cases and treated as security bugs if this is the case.
 
+To be covered by this security support policy you must:
+
+- use a virtualization accelerator like KVM or HVF
+- use one of the machine types listed below
+
+It may be possible to use other machine types with a virtualization
+accelerator to provide improved performance with a trusted guest
+workload, but any machine type not listed here should not be
+considered to be providing guest isolation or security guarantees,
+and falls under the "non-virtualization use case".
+
+Supported machine types for the virtualization use case, by target architecture:
+
+aarch64
+  ``virt``
+i386, x86_64
+  ``microvm``, ``xenfv``, ``xenpv``, ``xenpvh``, ``pc``, ``q35``
+s390x
+  ``s390-ccw-virtio``
+loongarch64:
+  ``virt``
+ppc64:
+  ``pseries``
+riscv32, riscv64:
+  ``virt``
+
 Non-virtualization Use Case
 '''''''''''''''''''''''''''
 

From ac55e58c05241b50f64a4631a722a01db0af05a9 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 23 Oct 2025 11:13:39 +0100
Subject: [PATCH 1843/2396] target/arm: Add assert to arm_to_core_mmu_idx()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Before commit f76cee647c ("target/arm: Introduce mmu indexes for
GCS") it was impossible for arm_to_core_mmu_idx() to return an
invalid core MMU index, because NB_MMU_MODES was 16 and
ARM_MMU_IDX_COREIDX_MASK was 0xf.

That commit raises ARM_MMU_IDX_COREIDX_MASK to 0x1f and NB_MMU_MODES
to 22, so it's now possible for a bogus Arm mmu index to result in an
out of range core mmu index (which can then get used as an array
index in the CPUTLB struct arrays). Coverity complains that this
might result in an out-of-bounds access.

The out-of-bounds access can't happen because we construct all the
ARMMMUIdx values we will use for TLBs to have valid core MMU indexes
in the COREIDX field.  But we can add an assert() so that if we ever
do end up operating on a corrupted or wrong ARMMMUIdx value we get an
assert rather than silently indexing off the end of an array. This
should also make Coverity happier.

Coverity: CID 1641404
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251023101339.1983809-1-peter.maydell@linaro.org
---
 target/arm/internals.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index 6fbf7e1ca4..4c0fa28ef8 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -969,7 +969,9 @@ bool arm_cpu_tlb_fill_align(CPUState *cs, CPUTLBEntryFull *out, vaddr addr,
 
 static inline int arm_to_core_mmu_idx(ARMMMUIdx mmu_idx)
 {
-    return mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
+    int coreidx = mmu_idx & ARM_MMU_IDX_COREIDX_MASK;
+    assert(coreidx < NB_MMU_MODES);
+    return coreidx;
 }
 
 static inline ARMMMUIdx core_to_arm_mmu_idx(CPUARMState *env, int mmu_idx)

From b7c52f28bf5b61751a9d3fbf4961dc826068ef51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:40:18 +0200
Subject: [PATCH 1844/2396] hw/arm/virt: Remove deprecated virt-4.1 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-2-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index b3ecd6dce3..6cf8ed58d5 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3711,14 +3711,3 @@ static void virt_machine_4_2_options(MachineClass *mc)
     vmc->kvm_no_adjvtime = true;
 }
 DEFINE_VIRT_MACHINE(4, 2)
-
-static void virt_machine_4_1_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_4_2_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_1, hw_compat_4_1_len);
-    vmc->no_ged = true;
-    mc->auto_enable_numa_with_memhp = false;
-}
-DEFINE_VIRT_MACHINE(4, 1)

From 5eb33245f96c17de7616ee239569b09f9561b376 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:40:19 +0200
Subject: [PATCH 1845/2396] hw/arm/virt: Remove VirtMachineClass::no_ged field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::no_ged field was only used by virt-4.1
machine, which got removed. Remove it as now unused.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-3-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 3 +--
 include/hw/arm/virt.h | 1 -
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 6cf8ed58d5..4d03317b59 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2213,7 +2213,6 @@ static void machvirt_init(MachineState *machine)
     int n, virt_max_cpus;
     bool firmware_loaded;
     bool aarch64 = true;
-    bool has_ged = !vmc->no_ged;
     unsigned int smp_cpus = machine->smp.cpus;
     unsigned int max_cpus = machine->smp.max_cpus;
 
@@ -2515,7 +2514,7 @@ static void machvirt_init(MachineState *machine)
     create_pcie(vms);
     create_cxl_host_reg_region(vms);
 
-    if (has_ged && aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
+    if (aarch64 && firmware_loaded && virt_is_acpi_enabled(vms)) {
         vms->acpi_dev = create_acpi_ged(vms);
         vms->generic_error_notifier.notify = virt_generic_error_req;
         notifier_list_add(&acpi_generic_error_notifiers,
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 04a09af354..993872bb68 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -123,7 +123,6 @@ struct VirtMachineClass {
     MachineClass parent;
     bool no_tcg_its;
     bool no_highmem_compact;
-    bool no_ged;   /* Machines < 4.2 have no support for ACPI GED device */
     bool kvm_no_adjvtime;
     bool no_kvm_steal_time;
     bool acpi_expose_flash;

From c43313a0c7a1ba7e9ed090d76f91f3adb40d6975 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:40:20 +0200
Subject: [PATCH 1846/2396] hw/arm/virt: Remove deprecated virt-4.2 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This machine has been supported for a period of more than 6 years.
According to our versioned machine support policy (see commit
ce80c4fa6ff "docs: document special exception for machine type
deprecation & removal") it can now be removed.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-4-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 10 ----------
 1 file changed, 10 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 4d03317b59..751e22e6f4 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -3700,13 +3700,3 @@ static void virt_machine_5_0_options(MachineClass *mc)
     mc->auto_enable_numa_with_memdev = false;
 }
 DEFINE_VIRT_MACHINE(5, 0)
-
-static void virt_machine_4_2_options(MachineClass *mc)
-{
-    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-
-    virt_machine_5_0_options(mc);
-    compat_props_add(mc->compat_props, hw_compat_4_2, hw_compat_4_2_len);
-    vmc->kvm_no_adjvtime = true;
-}
-DEFINE_VIRT_MACHINE(4, 2)

From 725770c2cbaef07cb3cf558f02ac502503f07a49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 20 Oct 2025 11:40:21 +0200
Subject: [PATCH 1847/2396] hw/arm/virt: Remove
 VirtMachineClass::kvm_no_adjvtime field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The VirtMachineClass::kvm_no_adjvtime field was only used by the
virt-4.2 machine, which got removed. Remove it as now unused, but
keep the ARMCPU homonym property.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251020094022.68768-5-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c         | 5 -----
 include/hw/arm/virt.h | 1 -
 2 files changed, 6 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index 751e22e6f4..25fb2bab56 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -2365,11 +2365,6 @@ static void machvirt_init(MachineState *machine)
             object_property_set_bool(cpuobj, "has_el2", false, NULL);
         }
 
-        if (vmc->kvm_no_adjvtime &&
-            object_property_find(cpuobj, "kvm-no-adjvtime")) {
-            object_property_set_bool(cpuobj, "kvm-no-adjvtime", true, NULL);
-        }
-
         if (vmc->no_kvm_steal_time &&
             object_property_find(cpuobj, "kvm-steal-time")) {
             object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index 993872bb68..c77a33f6df 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -123,7 +123,6 @@ struct VirtMachineClass {
     MachineClass parent;
     bool no_tcg_its;
     bool no_highmem_compact;
-    bool kvm_no_adjvtime;
     bool no_kvm_steal_time;
     bool acpi_expose_flash;
     bool no_secure_gpio;

From d9b51fadecdcef8c8e42efc0e3c24b172e54f58c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:37 +0100
Subject: [PATCH 1848/2396] target/arm/hvf: Release memory allocated by
 hv_vcpu_config_create()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hv_vcpu_config_create() is documented in <Hypervisor/hv_vcpu_config.h>
as:

  /*!
   @abstract Creates a vcpu configuration object.
   @result A new vcpu configuration object. This should be released with os_release when no longer used.
   */
  OS_OBJECT_RETURNS_RETAINED OS_WARN_RESULT
  hv_vcpu_config_t hv_vcpu_config_create(void);

Release the memory allocated by hv_vcpu_config_create() with
os_release().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 0658a99a2d..83db108838 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -150,6 +150,8 @@ void hvf_arm_init_debug(void)
     max_hw_wps = hvf_arm_num_wrps(config);
     hw_watchpoints =
         g_array_sized_new(true, true, sizeof(HWWatchpoint), max_hw_wps);
+
+    os_release(config);
 }
 
 #define SYSREG_OP0_SHIFT      20

From 080b8a49ed5a50124ef18cc81c15362582f0117a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:38 +0100
Subject: [PATCH 1849/2396] target/arm/hvf: Trace vCPU KICK events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 1 +
 target/arm/hvf/trace-events | 1 +
 2 files changed, 2 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 83db108838..91bbd3a6aa 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -963,6 +963,7 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
 void hvf_kick_vcpu_thread(CPUState *cpu)
 {
+    trace_hvf_kick_vcpu_thread(cpu->cpu_index, cpu->stop);
     cpus_kick_thread(cpu);
     hv_vcpus_exit(&cpu->accel->fd, 1);
 }
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index b29a995f3d..538af6e070 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -12,3 +12,4 @@ hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid
 hvf_vgic_write(const char *name, uint64_t val) "vgic write to %s [val=0x%016"PRIx64"]"
 hvf_vgic_read(const char *name, uint64_t val) "vgic read from %s [val=0x%016"PRIx64"]"
 hvf_illegal_guest_state(void) "HV_ILLEGAL_GUEST_STATE"
+hvf_kick_vcpu_thread(unsigned cpuidx, bool stop) "cpu:%u stop:%u"

From 1645ebabd496a13d8603349e04d460341cb65930 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:39 +0100
Subject: [PATCH 1850/2396] target/arm/hvf: Check hv_vcpus_exit() returned
 value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hv_vcpus_exit() returns a hv_return_t enum type (defined
in <Hypervisor/hv_error.h>). Assert we succeeded, as we
are not ready to handle any error path.

Suggested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 91bbd3a6aa..4c98faebbe 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -963,9 +963,11 @@ int hvf_arch_init_vcpu(CPUState *cpu)
 
 void hvf_kick_vcpu_thread(CPUState *cpu)
 {
+    hv_return_t ret;
     trace_hvf_kick_vcpu_thread(cpu->cpu_index, cpu->stop);
     cpus_kick_thread(cpu);
-    hv_vcpus_exit(&cpu->accel->fd, 1);
+    ret = hv_vcpus_exit(&cpu->accel->fd, 1);
+    assert_hvf_ok(ret);
 }
 
 static void hvf_raise_exception(CPUState *cpu, uint32_t excp,

From 320496f4ecff7c290933e1910f6d93d7d8572b6c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:40 +0100
Subject: [PATCH 1851/2396] target/arm/hvf: Check hv_vcpu_set_vtimer_mask()
 returned value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hv_vcpu_set_vtimer_mask() returns a hv_return_t enum type
(defined in <Hypervisor/hv_error.h>). Assert we succeeded,
as we are not ready to handle any error path.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 4c98faebbe..bbe0b24b82 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1782,7 +1782,8 @@ static void hvf_sync_vtimer(CPUState *cpu)
 
     if (!irq_state) {
         /* Timer no longer asserting, we can unmask it */
-        hv_vcpu_set_vtimer_mask(cpu->accel->fd, false);
+        r = hv_vcpu_set_vtimer_mask(cpu->accel->fd, false);
+        assert_hvf_ok(r);
         cpu->accel->vtimer_masked = false;
     }
 }

From 963f1576c0cd4893f566572535edeed9d341017b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:41 +0100
Subject: [PATCH 1852/2396] accel/hvf: Rename hvf_vcpu_exec() ->
 hvf_arch_vcpu_exec()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf_vcpu_exec() is implemented per target, rename it as
hvf_arch_vcpu_exec(), following the per target pattern.

Since it calls hv_vcpu_run(), mention it must be called
on the vCPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 2 +-
 include/system/hvf_int.h  | 4 +++-
 target/arm/hvf/hvf.c      | 2 +-
 target/i386/hvf/hvf.c     | 2 +-
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 8b794c2d41..005e2bd891 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -194,7 +194,7 @@ static void *hvf_cpu_thread_fn(void *arg)
     do {
         qemu_process_cpu_events(cpu);
         if (cpu_can_run(cpu)) {
-            r = hvf_vcpu_exec(cpu);
+            r = hvf_arch_vcpu_exec(cpu);
             if (r == EXCP_DEBUG) {
                 cpu_handle_guest_debug(cpu);
             }
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index a3b06a3e75..32b32e1d02 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -73,12 +73,14 @@ int hvf_arch_init(void);
 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range);
 int hvf_arch_init_vcpu(CPUState *cpu);
 void hvf_arch_vcpu_destroy(CPUState *cpu);
-int hvf_vcpu_exec(CPUState *);
 hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
 int hvf_put_registers(CPUState *);
 int hvf_get_registers(CPUState *);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
+/* Must be called by the owning thread */
+int hvf_arch_vcpu_exec(CPUState *);
+
 struct hvf_sw_breakpoint {
     vaddr pc;
     vaddr saved_insn;
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index bbe0b24b82..9111c1d717 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1788,7 +1788,7 @@ static void hvf_sync_vtimer(CPUState *cpu)
     }
 }
 
-int hvf_vcpu_exec(CPUState *cpu)
+int hvf_arch_vcpu_exec(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 33f723a76a..b2bf59cb48 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -721,7 +721,7 @@ void hvf_simulate_wrmsr(CPUState *cs)
     printf("write msr %llx\n", RCX(cs));*/
 }
 
-int hvf_vcpu_exec(CPUState *cpu)
+int hvf_arch_vcpu_exec(CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
     CPUX86State *env = &x86_cpu->env;

From 1182ede151c4c034001a36375202500c5afe871f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:42 +0100
Subject: [PATCH 1853/2396] accel/hvf: Rename hvf_put|get_registers ->
 hvf_arch_put|get_registers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf_put_registers() and hvf_get_registers() are implemented per
target, rename them using the 'hvf_arch_' prefix following the
per target pattern.

Since they call hv_vcpu_set_reg() / hv_vcpu_get_reg(), mention
they must be called on the vCPU.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/hvf/hvf-accel-ops.c | 2 +-
 include/system/hvf_int.h  | 6 ++++--
 target/arm/hvf/hvf.c      | 8 +++++---
 target/i386/hvf/hvf.c     | 2 +-
 target/i386/hvf/x86hvf.c  | 4 ++--
 5 files changed, 13 insertions(+), 9 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 005e2bd891..3e5feecd8a 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -81,7 +81,7 @@ hvf_slot *hvf_find_overlap_slot(uint64_t start, uint64_t size)
 static void do_hvf_cpu_synchronize_state(CPUState *cpu, run_on_cpu_data arg)
 {
     if (!cpu->vcpu_dirty) {
-        hvf_get_registers(cpu);
+        hvf_arch_get_registers(cpu);
         cpu->vcpu_dirty = true;
     }
 }
diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 32b32e1d02..8fce627b08 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -74,12 +74,14 @@ hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range);
 int hvf_arch_init_vcpu(CPUState *cpu);
 void hvf_arch_vcpu_destroy(CPUState *cpu);
 hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
-int hvf_put_registers(CPUState *);
-int hvf_get_registers(CPUState *);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
 /* Must be called by the owning thread */
 int hvf_arch_vcpu_exec(CPUState *);
+/* Must be called by the owning thread */
+int hvf_arch_put_registers(CPUState *);
+/* Must be called by the owning thread */
+int hvf_arch_get_registers(CPUState *);
 
 struct hvf_sw_breakpoint {
     vaddr pc;
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 9111c1d717..f0a0e5d1a7 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -424,7 +424,7 @@ static const hv_sys_reg_t hvf_sreg_list[] = {
 
 #undef DEF_SYSREG
 
-int hvf_get_registers(CPUState *cpu)
+int hvf_arch_get_registers(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
@@ -564,7 +564,7 @@ int hvf_get_registers(CPUState *cpu)
     return 0;
 }
 
-int hvf_put_registers(CPUState *cpu)
+int hvf_arch_put_registers(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
@@ -692,11 +692,12 @@ int hvf_put_registers(CPUState *cpu)
 static void flush_cpu_state(CPUState *cpu)
 {
     if (cpu->vcpu_dirty) {
-        hvf_put_registers(cpu);
+        hvf_arch_put_registers(cpu);
         cpu->vcpu_dirty = false;
     }
 }
 
+/* Must be called by the owning thread */
 static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val)
 {
     hv_return_t r;
@@ -709,6 +710,7 @@ static void hvf_set_reg(CPUState *cpu, int rt, uint64_t val)
     }
 }
 
+/* Must be called by the owning thread */
 static uint64_t hvf_get_reg(CPUState *cpu, int rt)
 {
     uint64_t val = 0;
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index b2bf59cb48..76a58cb035 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -734,7 +734,7 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
 
     do {
         if (cpu->vcpu_dirty) {
-            hvf_put_registers(cpu);
+            hvf_arch_put_registers(cpu);
             cpu->vcpu_dirty = false;
         }
 
diff --git a/target/i386/hvf/x86hvf.c b/target/i386/hvf/x86hvf.c
index 3838c9f5a6..bb480311b0 100644
--- a/target/i386/hvf/x86hvf.c
+++ b/target/i386/hvf/x86hvf.c
@@ -236,7 +236,7 @@ void hvf_get_msrs(CPUState *cs)
     env->tsc = rdtscp() + rvmcs(cs->accel->fd, VMCS_TSC_OFFSET);
 }
 
-int hvf_put_registers(CPUState *cs)
+int hvf_arch_put_registers(CPUState *cs)
 {
     X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;
@@ -280,7 +280,7 @@ int hvf_put_registers(CPUState *cs)
     return 0;
 }
 
-int hvf_get_registers(CPUState *cs)
+int hvf_arch_get_registers(CPUState *cs)
 {
     X86CPU *x86cpu = X86_CPU(cs);
     CPUX86State *env = &x86cpu->env;

From d1a0caa0826a377fba11e79bf9920f8c301d2fca Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:43 +0100
Subject: [PATCH 1854/2396] target/arm/hvf: Mention flush_cpu_state() must run
 on vCPU thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since flush_cpu_state() calls hvf_arch_put_registers(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index f0a0e5d1a7..fdf8df09d4 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -689,6 +689,7 @@ int hvf_arch_put_registers(CPUState *cpu)
     return 0;
 }
 
+/* Must be called by the owning thread */
 static void flush_cpu_state(CPUState *cpu)
 {
     if (cpu->vcpu_dirty) {

From a641384325506d035490ce79d3c3319a829c47d0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:44 +0100
Subject: [PATCH 1855/2396] accel/hvf: Mention hvf_arch_init_vcpu() must run on
 vCPU thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

hvf_arch_init_vcpu(), along with hvf_put_guest_debug_registers()
and hvf_put_gdbstub_debug_registers(), calls hv_vcpu_set_sys_reg(),
which must run on a vCPU. Mention they also must.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/system/hvf_int.h | 3 ++-
 target/arm/hvf/hvf.c     | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 8fce627b08..0c335facc3 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -71,11 +71,12 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 const char *hvf_return_string(hv_return_t ret);
 int hvf_arch_init(void);
 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range);
-int hvf_arch_init_vcpu(CPUState *cpu);
 void hvf_arch_vcpu_destroy(CPUState *cpu);
 hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
+/* Must be called by the owning thread */
+int hvf_arch_init_vcpu(CPUState *cpu);
 /* Must be called by the owning thread */
 int hvf_arch_vcpu_exec(CPUState *);
 /* Must be called by the owning thread */
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index fdf8df09d4..8095cb0805 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2119,6 +2119,7 @@ void hvf_arch_remove_all_hw_breakpoints(void)
  * Update the vCPU with the gdbstub's view of debug registers. This view
  * consists of all hardware breakpoints and watchpoints inserted so far while
  * debugging the guest.
+ * Must be called by the owning thread.
  */
 static void hvf_put_gdbstub_debug_registers(CPUState *cpu)
 {
@@ -2157,6 +2158,7 @@ static void hvf_put_gdbstub_debug_registers(CPUState *cpu)
 /*
  * Update the vCPU with the guest's view of debug registers. This view is kept
  * in the environment at all times.
+ * Must be called by the owning thread.
  */
 static void hvf_put_guest_debug_registers(CPUState *cpu)
 {

From 30d277f2cdd85ca3a519d6c03b126d37bef29a60 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:45 +0100
Subject: [PATCH 1856/2396] target/arm/hvf: Mention hvf_sync_vtimer() must run
 on vCPU thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since hvf_sync_vtimer() calls hv_vcpu_get_sys_reg(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8095cb0805..bfccf5e9a2 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1764,6 +1764,7 @@ static void hvf_wfi(CPUState *cpu)
     hvf_wait_for_ipi(cpu, &ts);
 }
 
+/* Must be called by the owning thread */
 static void hvf_sync_vtimer(CPUState *cpu)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);

From 21bab557a9ad3209552321789c9feb4b5ad1c437 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:46 +0100
Subject: [PATCH 1857/2396] target/arm/hvf: Mention hvf_arch_set_traps() must
 run on vCPU thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since hvf_arch_set_traps() calls hv_vcpu_set_trap_debug_exceptions()
and hv_vcpu_set_trap_debug_reg_accesses(), which must run on a vCPU,
it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index bfccf5e9a2..ee04943b0f 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2192,6 +2192,7 @@ static inline bool hvf_arm_hw_debug_active(CPUState *cpu)
     return ((cur_hw_wps > 0) || (cur_hw_bps > 0));
 }
 
+/* Must be called by the owning thread */
 static void hvf_arch_set_traps(CPUState *cpu)
 {
     bool should_enable_traps = false;

From 073e7e1cbea96d2bd36310d9119faceb4bf58989 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:47 +0100
Subject: [PATCH 1858/2396] accel/hvf: Mention hvf_arch_update_guest_debug()
 must run on vCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since hvf_arch_update_guest_debug() calls hvf_arch_set_traps()
and hvf_arch_update_guest_debug(), which must run on a vCPU, it
also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/system/hvf_int.h | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 0c335facc3..241c668795 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -83,6 +83,8 @@ int hvf_arch_vcpu_exec(CPUState *);
 int hvf_arch_put_registers(CPUState *);
 /* Must be called by the owning thread */
 int hvf_arch_get_registers(CPUState *);
+/* Must be called by the owning thread */
+void hvf_arch_update_guest_debug(CPUState *cpu);
 
 struct hvf_sw_breakpoint {
     vaddr pc;
@@ -109,7 +111,6 @@ void hvf_arch_remove_all_hw_breakpoints(void);
  * handled by calling down to hvf_arch_update_guest_debug.
  */
 int hvf_update_guest_debug(CPUState *cpu);
-void hvf_arch_update_guest_debug(CPUState *cpu);
 
 /*
  * Return whether the guest supports debugging.

From 3747befb2a64ddd216ba01a4836100d7a4909fff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:48 +0100
Subject: [PATCH 1859/2396] target/arm/hvf: Mention hvf_inject_interrupts()
 must run on vCPU thread
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since hvf_inject_interrupts() calls hv_vcpu_set_pending_interrupt(),
which must run on a vCPU, it also must. Mention it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index ee04943b0f..0d8ff49ae1 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1664,6 +1664,7 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
     return 1;
 }
 
+/* Must be called by the owning thread */
 static int hvf_inject_interrupts(CPUState *cpu)
 {
     if (cpu_test_interrupt(cpu, CPU_INTERRUPT_FIQ)) {

From feee55d36a1c5d494ee73812d279b439bb05137c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:49 +0100
Subject: [PATCH 1860/2396] accel/hvf: Implement hvf_arch_vcpu_destroy()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Call hv_vcpu_destroy() to destroy our vCPU context.

As hv_vcpu_destroy() must be called by the owning thread,
document hvf_arch_vcpu_destroy() also does.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/system/hvf_int.h | 3 ++-
 target/arm/hvf/hvf.c     | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 241c668795..195d64dcf1 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -71,13 +71,14 @@ void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,
 const char *hvf_return_string(hv_return_t ret);
 int hvf_arch_init(void);
 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range);
-void hvf_arch_vcpu_destroy(CPUState *cpu);
 hvf_slot *hvf_find_overlap_slot(uint64_t, uint64_t);
 void hvf_kick_vcpu_thread(CPUState *cpu);
 
 /* Must be called by the owning thread */
 int hvf_arch_init_vcpu(CPUState *cpu);
 /* Must be called by the owning thread */
+void hvf_arch_vcpu_destroy(CPUState *cpu);
+/* Must be called by the owning thread */
 int hvf_arch_vcpu_exec(CPUState *);
 /* Must be called by the owning thread */
 int hvf_arch_put_registers(CPUState *);
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 0d8ff49ae1..d13ccf5508 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -868,6 +868,10 @@ void hvf_arm_set_cpu_features_from_host(ARMCPU *cpu)
 
 void hvf_arch_vcpu_destroy(CPUState *cpu)
 {
+    hv_return_t ret;
+
+    ret = hv_vcpu_destroy(cpu->accel->fd);
+    assert_hvf_ok(ret);
 }
 
 hv_return_t hvf_arch_vm_create(MachineState *ms, uint32_t pa_range)

From bddf353ab167e9c8c5664727b9822c3e906e90ca Mon Sep 17 00:00:00 2001
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Date: Tue, 28 Oct 2025 06:41:50 +0100
Subject: [PATCH 1861/2396] target/arm/hvf: Hardcode Apple MIDR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Hardcode MIDR because Apple deliberately doesn't expose
a divergent MIDR across systems.

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index d13ccf5508..890e9266f9 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -763,6 +763,7 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     hv_vcpu_t fd;
     hv_return_t r = HV_SUCCESS;
     hv_vcpu_exit_t *exit;
+    uint64_t t;
     int i;
 
     ahcf->dtb_compatible = "arm,armv8";
@@ -781,9 +782,19 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     for (i = 0; i < ARRAY_SIZE(regs); i++) {
         r |= hv_vcpu_get_sys_reg(fd, regs[i].reg, regs[i].val);
     }
-    r |= hv_vcpu_get_sys_reg(fd, HV_SYS_REG_MIDR_EL1, &ahcf->midr);
     r |= hv_vcpu_destroy(fd);
 
+    /*
+     * Hardcode MIDR because Apple deliberately doesn't expose a divergent
+     * MIDR across systems.
+     */
+    t = FIELD_DP64(0, MIDR_EL1, IMPLEMENTER, 0x61); /* Apple */
+    t = FIELD_DP64(t, MIDR_EL1, ARCHITECTURE, 0xf); /* v7 or later */
+    t = FIELD_DP64(t, MIDR_EL1, PARTNUM, 0);
+    t = FIELD_DP64(t, MIDR_EL1, VARIANT, 0);
+    t = FIELD_DP64(t, MIDR_EL1, REVISION, 0);
+    ahcf->midr = t;
+
     clamp_id_aa64mmfr0_parange_to_ipa_size(&host_isar);
 
     /*

From 710778695ddc4c3d8834a2d92d9e7ff6292f89c2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:51 +0100
Subject: [PATCH 1862/2396] target/arm/hvf: Simplify
 hvf_arm_get_host_cpu_features()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use index in the structure, dereference &host_isar.idregs[] once.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 890e9266f9..dea1cb37d1 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -743,21 +743,21 @@ static void clamp_id_aa64mmfr0_parange_to_ipa_size(ARMISARegisters *isar)
 static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     ARMISARegisters host_isar = {};
-    const struct isar_regs {
+    static const struct isar_regs {
         int reg;
-        uint64_t *val;
+        ARMIDRegisterIdx index;
     } regs[] = {
-        { HV_SYS_REG_ID_AA64PFR0_EL1, &host_isar.idregs[ID_AA64PFR0_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64PFR1_EL1, &host_isar.idregs[ID_AA64PFR1_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_IDX },
+        { HV_SYS_REG_ID_AA64PFR1_EL1, ID_AA64PFR1_EL1_IDX },
         /* Add ID_AA64PFR2_EL1 here when HVF supports it */
-        { HV_SYS_REG_ID_AA64DFR0_EL1, &host_isar.idregs[ID_AA64DFR0_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64DFR1_EL1, &host_isar.idregs[ID_AA64DFR1_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64ISAR0_EL1, &host_isar.idregs[ID_AA64ISAR0_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64ISAR1_EL1, &host_isar.idregs[ID_AA64ISAR1_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64DFR0_EL1, ID_AA64DFR0_EL1_IDX },
+        { HV_SYS_REG_ID_AA64DFR1_EL1, ID_AA64DFR1_EL1_IDX },
+        { HV_SYS_REG_ID_AA64ISAR0_EL1, ID_AA64ISAR0_EL1_IDX },
+        { HV_SYS_REG_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_IDX },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
-        { HV_SYS_REG_ID_AA64MMFR0_EL1, &host_isar.idregs[ID_AA64MMFR0_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64MMFR1_EL1, &host_isar.idregs[ID_AA64MMFR1_EL1_IDX] },
-        { HV_SYS_REG_ID_AA64MMFR2_EL1, &host_isar.idregs[ID_AA64MMFR2_EL1_IDX] },
+        { HV_SYS_REG_ID_AA64MMFR0_EL1, ID_AA64MMFR0_EL1_IDX },
+        { HV_SYS_REG_ID_AA64MMFR1_EL1, ID_AA64MMFR1_EL1_IDX },
+        { HV_SYS_REG_ID_AA64MMFR2_EL1, ID_AA64MMFR2_EL1_IDX },
         /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
     };
     hv_vcpu_t fd;
@@ -780,7 +780,8 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     }
 
     for (i = 0; i < ARRAY_SIZE(regs); i++) {
-        r |= hv_vcpu_get_sys_reg(fd, regs[i].reg, regs[i].val);
+        r |= hv_vcpu_get_sys_reg(fd, regs[i].reg,
+                                 &host_isar.idregs[regs[i].index]);
     }
     r |= hv_vcpu_destroy(fd);
 

From 299a85b4acf3368da75401d8072ec6a0364d42e8 Mon Sep 17 00:00:00 2001
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Date: Tue, 28 Oct 2025 06:41:52 +0100
Subject: [PATCH 1863/2396] target/arm/hvf: switch
 hvf_arm_get_host_cpu_features to not create a vCPU
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Creating a vCPU locks out APIs such as hv_gic_create().

As a result, switch to using the hv_vcpu_config_get_feature_reg interface.

Besides, all the following methods must be run on a vCPU thread:

  - hv_vcpu_create()
  - hv_vcpu_get_sys_reg()
  - hv_vcpu_destroy()

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Message-ID: <20250808070137.48716-3-mohamed@unpredictable.fr>
[PMD: Release config calling os_release()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 35 ++++++++++++++---------------------
 1 file changed, 14 insertions(+), 21 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index dea1cb37d1..fcb6950692 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -744,25 +744,24 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
 {
     ARMISARegisters host_isar = {};
     static const struct isar_regs {
-        int reg;
+        hv_feature_reg_t reg;
         ARMIDRegisterIdx index;
     } regs[] = {
-        { HV_SYS_REG_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_IDX },
-        { HV_SYS_REG_ID_AA64PFR1_EL1, ID_AA64PFR1_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64PFR0_EL1, ID_AA64PFR0_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64PFR1_EL1, ID_AA64PFR1_EL1_IDX },
         /* Add ID_AA64PFR2_EL1 here when HVF supports it */
-        { HV_SYS_REG_ID_AA64DFR0_EL1, ID_AA64DFR0_EL1_IDX },
-        { HV_SYS_REG_ID_AA64DFR1_EL1, ID_AA64DFR1_EL1_IDX },
-        { HV_SYS_REG_ID_AA64ISAR0_EL1, ID_AA64ISAR0_EL1_IDX },
-        { HV_SYS_REG_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64DFR0_EL1, ID_AA64DFR0_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64DFR1_EL1, ID_AA64DFR1_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64ISAR0_EL1, ID_AA64ISAR0_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64ISAR1_EL1, ID_AA64ISAR1_EL1_IDX },
         /* Add ID_AA64ISAR2_EL1 here when HVF supports it */
-        { HV_SYS_REG_ID_AA64MMFR0_EL1, ID_AA64MMFR0_EL1_IDX },
-        { HV_SYS_REG_ID_AA64MMFR1_EL1, ID_AA64MMFR1_EL1_IDX },
-        { HV_SYS_REG_ID_AA64MMFR2_EL1, ID_AA64MMFR2_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64MMFR0_EL1, ID_AA64MMFR0_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64MMFR1_EL1, ID_AA64MMFR1_EL1_IDX },
+        { HV_FEATURE_REG_ID_AA64MMFR2_EL1, ID_AA64MMFR2_EL1_IDX },
         /* Add ID_AA64MMFR3_EL1 here when HVF supports it */
     };
-    hv_vcpu_t fd;
     hv_return_t r = HV_SUCCESS;
-    hv_vcpu_exit_t *exit;
+    hv_vcpu_config_t config = hv_vcpu_config_create();
     uint64_t t;
     int i;
 
@@ -773,17 +772,11 @@ static bool hvf_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                      (1ULL << ARM_FEATURE_PMU) |
                      (1ULL << ARM_FEATURE_GENERIC_TIMER);
 
-    /* We set up a small vcpu to extract host registers */
-
-    if (hv_vcpu_create(&fd, &exit, NULL) != HV_SUCCESS) {
-        return false;
-    }
-
     for (i = 0; i < ARRAY_SIZE(regs); i++) {
-        r |= hv_vcpu_get_sys_reg(fd, regs[i].reg,
-                                 &host_isar.idregs[regs[i].index]);
+        r |= hv_vcpu_config_get_feature_reg(config, regs[i].reg,
+                                            &host_isar.idregs[regs[i].index]);
     }
-    r |= hv_vcpu_destroy(fd);
+    os_release(config);
 
     /*
      * Hardcode MIDR because Apple deliberately doesn't expose a divergent

From 7efc3819e8a2d2e15eea0ab0b1e8b02b7f4af70d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:53 +0100
Subject: [PATCH 1864/2396] target/arm/hvf: Factor hvf_handle_exception() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor hvf_handle_exception() out of hvf_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 123 +++++++++++++++++++++++--------------------
 1 file changed, 65 insertions(+), 58 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index fcb6950692..8553ce6adc 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1802,61 +1802,15 @@ static void hvf_sync_vtimer(CPUState *cpu)
     }
 }
 
-int hvf_arch_vcpu_exec(CPUState *cpu)
+static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
 {
-    ARMCPU *arm_cpu = ARM_CPU(cpu);
-    CPUARMState *env = &arm_cpu->env;
-    int ret;
-    hv_vcpu_exit_t *hvf_exit = cpu->accel->exit;
-    hv_return_t r;
-    bool advance_pc = false;
-
-    if (!(cpu->singlestep_enabled & SSTEP_NOIRQ) &&
-        hvf_inject_interrupts(cpu)) {
-        return EXCP_INTERRUPT;
-    }
-
-    if (cpu->halted) {
-        return EXCP_HLT;
-    }
-
-    flush_cpu_state(cpu);
-
-    bql_unlock();
-    r = hv_vcpu_run(cpu->accel->fd);
-    bql_lock();
-    switch (r) {
-    case HV_SUCCESS:
-        break;
-    case HV_ILLEGAL_GUEST_STATE:
-        trace_hvf_illegal_guest_state();
-        /* fall through */
-    default:
-        g_assert_not_reached();
-    }
-
-    /* handle VMEXIT */
-    uint64_t exit_reason = hvf_exit->reason;
-    uint64_t syndrome = hvf_exit->exception.syndrome;
+    CPUARMState *env = cpu_env(cpu);
+    ARMCPU *arm_cpu = env_archcpu(env);
+    uint64_t syndrome = excp->syndrome;
     uint32_t ec = syn_get_ec(syndrome);
-
-    ret = 0;
-    switch (exit_reason) {
-    case HV_EXIT_REASON_EXCEPTION:
-        /* This is the main one, handle below. */
-        break;
-    case HV_EXIT_REASON_VTIMER_ACTIVATED:
-        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
-        cpu->accel->vtimer_masked = true;
-        return 0;
-    case HV_EXIT_REASON_CANCELED:
-        /* we got kicked, no exit to process */
-        return 0;
-    default:
-        g_assert_not_reached();
-    }
-
-    hvf_sync_vtimer(cpu);
+    bool advance_pc = false;
+    hv_return_t r;
+    int ret = 0;
 
     switch (ec) {
     case EC_SOFTWARESTEP: {
@@ -1895,7 +1849,7 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         cpu_synchronize_state(cpu);
 
         CPUWatchpoint *wp =
-            find_hw_watchpoint(cpu, hvf_exit->exception.virtual_address);
+            find_hw_watchpoint(cpu, excp->virtual_address);
         if (!wp) {
             error_report("EXCP_DEBUG but unknown hw watchpoint");
         }
@@ -1913,8 +1867,8 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         uint32_t cm = (syndrome >> 8) & 0x1;
         uint64_t val = 0;
 
-        trace_hvf_data_abort(hvf_exit->exception.virtual_address,
-                             hvf_exit->exception.physical_address, isv,
+        trace_hvf_data_abort(excp->virtual_address,
+                             excp->physical_address, isv,
                              iswrite, s1ptw, len, srt);
 
         if (cm) {
@@ -1928,11 +1882,11 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         if (iswrite) {
             val = hvf_get_reg(cpu, srt);
             address_space_write(&address_space_memory,
-                                hvf_exit->exception.physical_address,
+                                excp->physical_address,
                                 MEMTXATTRS_UNSPECIFIED, &val, len);
         } else {
             address_space_read(&address_space_memory,
-                               hvf_exit->exception.physical_address,
+                               excp->physical_address,
                                MEMTXATTRS_UNSPECIFIED, &val, len);
             if (sse) {
                 val = sextract64(val, 0, len * 8);
@@ -2030,6 +1984,59 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
     return ret;
 }
 
+int hvf_arch_vcpu_exec(CPUState *cpu)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    hv_vcpu_exit_t *hvf_exit = cpu->accel->exit;
+    hv_return_t r;
+
+    if (!(cpu->singlestep_enabled & SSTEP_NOIRQ) &&
+        hvf_inject_interrupts(cpu)) {
+        return EXCP_INTERRUPT;
+    }
+
+    if (cpu->halted) {
+        return EXCP_HLT;
+    }
+
+    flush_cpu_state(cpu);
+
+    bql_unlock();
+    r = hv_vcpu_run(cpu->accel->fd);
+    bql_lock();
+    switch (r) {
+    case HV_SUCCESS:
+        break;
+    case HV_ILLEGAL_GUEST_STATE:
+        trace_hvf_illegal_guest_state();
+        /* fall through */
+    default:
+        g_assert_not_reached();
+    }
+
+    /* handle VMEXIT */
+    uint64_t exit_reason = hvf_exit->reason;
+
+    switch (exit_reason) {
+    case HV_EXIT_REASON_EXCEPTION:
+        /* This is the main one, handle below. */
+        break;
+    case HV_EXIT_REASON_VTIMER_ACTIVATED:
+        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
+        cpu->accel->vtimer_masked = true;
+        return 0;
+    case HV_EXIT_REASON_CANCELED:
+        /* we got kicked, no exit to process */
+        return 0;
+    default:
+        g_assert_not_reached();
+    }
+
+    hvf_sync_vtimer(cpu);
+
+    return hvf_handle_exception(cpu, &hvf_exit->exception);
+}
+
 static const VMStateDescription vmstate_hvf_vtimer = {
     .name = "hvf-vtimer",
     .version_id = 1,

From 2a21c92447407756d691e2b2dc4c4d97c1f88cd9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:54 +0100
Subject: [PATCH 1865/2396] target/i386/hvf: Factor hvf_handle_vmexit() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor hvf_handle_vmexit() out of hvf_arch_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/i386/hvf/hvf.c | 478 +++++++++++++++++++++---------------------
 1 file changed, 244 insertions(+), 234 deletions(-)

diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 76a58cb035..28d98659ec 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -721,6 +721,249 @@ void hvf_simulate_wrmsr(CPUState *cs)
     printf("write msr %llx\n", RCX(cs));*/
 }
 
+static int hvf_handle_vmexit(CPUState *cpu)
+{
+    X86CPU *x86_cpu = env_archcpu(cpu_env(cpu));
+    uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
+    uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
+    uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
+                                       VMCS_EXIT_INSTRUCTION_LENGTH);
+
+    uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
+    int ret = 0;
+
+    hvf_store_events(cpu, ins_len, idtvec_info);
+    rip = rreg(cpu->accel->fd, HV_X86_RIP);
+    env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
+
+    bql_lock();
+
+    update_apic_tpr(cpu);
+    current_cpu = cpu;
+
+    switch (exit_reason) {
+    case EXIT_REASON_HLT: {
+        macvm_set_rip(cpu, rip + ins_len);
+        if (!(cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)
+              && (env->eflags & IF_MASK))
+            && !cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI)
+            && !(idtvec_info & VMCS_IDT_VEC_VALID)) {
+            cpu->halted = 1;
+            ret = EXCP_HLT;
+            break;
+        }
+        ret = EXCP_INTERRUPT;
+        break;
+    }
+    case EXIT_REASON_MWAIT: {
+        ret = EXCP_INTERRUPT;
+        break;
+    }
+    /* Need to check if MMIO or unmapped fault */
+    case EXIT_REASON_EPT_FAULT:
+    {
+        hvf_slot *slot;
+        uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
+
+        if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
+            ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
+            vmx_set_nmi_blocking(cpu);
+        }
+
+        slot = hvf_find_overlap_slot(gpa, 1);
+        /* mmio */
+        if (ept_emulation_fault(slot, gpa, exit_qual)) {
+            struct x86_decode decode;
+
+            hvf_load_regs(cpu);
+            decode_instruction(env, &decode);
+            exec_instruction(env, &decode);
+            hvf_store_regs(cpu);
+            break;
+        }
+        break;
+    }
+    case EXIT_REASON_INOUT:
+    {
+        uint32_t in = (exit_qual & 8) != 0;
+        uint32_t size =  (exit_qual & 7) + 1;
+        uint32_t string =  (exit_qual & 16) != 0;
+        uint32_t port =  exit_qual >> 16;
+        /*uint32_t rep = (exit_qual & 0x20) != 0;*/
+        struct x86_decode decode;
+
+        if (!string && in) {
+            uint64_t val = 0;
+
+            hvf_load_regs(cpu);
+            hvf_handle_io(env_cpu(env), port, &val, 0, size, 1);
+            if (size == 1) {
+                AL(env) = val;
+            } else if (size == 2) {
+                AX(env) = val;
+            } else if (size == 4) {
+                RAX(env) = (uint32_t)val;
+            } else {
+                RAX(env) = (uint64_t)val;
+            }
+            env->eip += ins_len;
+            hvf_store_regs(cpu);
+            break;
+        } else if (!string && !in) {
+            RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
+            hvf_handle_io(env_cpu(env), port, &RAX(env), 1, size, 1);
+            macvm_set_rip(cpu, rip + ins_len);
+            break;
+        }
+
+        hvf_load_regs(cpu);
+        decode_instruction(env, &decode);
+        assert(ins_len == decode.len);
+        exec_instruction(env, &decode);
+        hvf_store_regs(cpu);
+
+        break;
+    }
+    case EXIT_REASON_CPUID: {
+        uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
+        uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
+        uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
+        uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
+
+        if (rax == 1) {
+            /* CPUID1.ecx.OSXSAVE needs to know CR4 */
+            env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
+        }
+        hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
+
+        wreg(cpu->accel->fd, HV_X86_RAX, rax);
+        wreg(cpu->accel->fd, HV_X86_RBX, rbx);
+        wreg(cpu->accel->fd, HV_X86_RCX, rcx);
+        wreg(cpu->accel->fd, HV_X86_RDX, rdx);
+
+        macvm_set_rip(cpu, rip + ins_len);
+        break;
+    }
+    case EXIT_REASON_XSETBV: {
+        uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
+        uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
+        uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
+
+        if (ecx) {
+            macvm_set_rip(cpu, rip + ins_len);
+            break;
+        }
+        env->xcr0 = ((uint64_t)edx << 32) | eax;
+        wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
+        macvm_set_rip(cpu, rip + ins_len);
+        break;
+    }
+    case EXIT_REASON_INTR_WINDOW:
+        vmx_clear_int_window_exiting(cpu);
+        ret = EXCP_INTERRUPT;
+        break;
+    case EXIT_REASON_NMI_WINDOW:
+        vmx_clear_nmi_window_exiting(cpu);
+        ret = EXCP_INTERRUPT;
+        break;
+    case EXIT_REASON_EXT_INTR:
+        /* force exit and allow io handling */
+        ret = EXCP_INTERRUPT;
+        break;
+    case EXIT_REASON_RDMSR:
+    case EXIT_REASON_WRMSR:
+    {
+        hvf_load_regs(cpu);
+        if (exit_reason == EXIT_REASON_RDMSR) {
+            hvf_simulate_rdmsr(cpu);
+        } else {
+            hvf_simulate_wrmsr(cpu);
+        }
+        env->eip += ins_len;
+        hvf_store_regs(cpu);
+        break;
+    }
+    case EXIT_REASON_CR_ACCESS: {
+        int cr;
+        int reg;
+
+        hvf_load_regs(cpu);
+        cr = exit_qual & 15;
+        reg = (exit_qual >> 8) & 15;
+
+        switch (cr) {
+        case 0x0: {
+            macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
+            break;
+        }
+        case 4: {
+            macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
+            break;
+        }
+        case 8: {
+            if (exit_qual & 0x10) {
+                RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
+            } else {
+                int tpr = RRX(env, reg);
+                cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+                ret = EXCP_INTERRUPT;
+            }
+            break;
+        }
+        default:
+            error_report("Unrecognized CR %d", cr);
+            abort();
+        }
+        env->eip += ins_len;
+        hvf_store_regs(cpu);
+        break;
+    }
+    case EXIT_REASON_APIC_ACCESS: { /* TODO */
+        struct x86_decode decode;
+
+        hvf_load_regs(cpu);
+        decode_instruction(env, &decode);
+        exec_instruction(env, &decode);
+        hvf_store_regs(cpu);
+        break;
+    }
+    case EXIT_REASON_TPR: {
+        ret = 1;
+        break;
+    }
+    case EXIT_REASON_TASK_SWITCH: {
+        uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
+        x86_segment_selector sel = {.sel = exit_qual & 0xffff};
+
+        vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
+                               vinfo & VMCS_INTR_VALID,
+                               vinfo & VECTORING_INFO_VECTOR_MASK,
+                               vinfo & VMCS_INTR_T_MASK);
+        break;
+    }
+    case EXIT_REASON_TRIPLE_FAULT: {
+        qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
+        ret = EXCP_INTERRUPT;
+        break;
+    }
+    case EXIT_REASON_RDPMC:
+        wreg(cpu->accel->fd, HV_X86_RAX, 0);
+        wreg(cpu->accel->fd, HV_X86_RDX, 0);
+        macvm_set_rip(cpu, rip + ins_len);
+        break;
+    case VMX_REASON_VMCALL:
+        env->exception_nr = EXCP0D_GPF;
+        env->exception_injected = 1;
+        env->has_error_code = true;
+        env->error_code = 0;
+        break;
+    default:
+        error_report("%llx: unhandled exit %llx", rip, exit_reason);
+    }
+
+    return ret;
+}
+
 int hvf_arch_vcpu_exec(CPUState *cpu)
 {
     X86CPU *x86_cpu = X86_CPU(cpu);
@@ -752,240 +995,7 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER);
         assert_hvf_ok(r);
 
-        /* handle VMEXIT */
-        uint64_t exit_reason = rvmcs(cpu->accel->fd, VMCS_EXIT_REASON);
-        uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
-        uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
-                                           VMCS_EXIT_INSTRUCTION_LENGTH);
-
-        uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
-
-        hvf_store_events(cpu, ins_len, idtvec_info);
-        rip = rreg(cpu->accel->fd, HV_X86_RIP);
-        env->eflags = rreg(cpu->accel->fd, HV_X86_RFLAGS);
-
-        bql_lock();
-
-        update_apic_tpr(cpu);
-        current_cpu = cpu;
-
-        ret = 0;
-        switch (exit_reason) {
-        case EXIT_REASON_HLT: {
-            macvm_set_rip(cpu, rip + ins_len);
-            if (!(cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD) &&
-                (env->eflags & IF_MASK))
-                && !cpu_test_interrupt(cpu, CPU_INTERRUPT_NMI) &&
-                !(idtvec_info & VMCS_IDT_VEC_VALID)) {
-                cpu->halted = 1;
-                ret = EXCP_HLT;
-                break;
-            }
-            ret = EXCP_INTERRUPT;
-            break;
-        }
-        case EXIT_REASON_MWAIT: {
-            ret = EXCP_INTERRUPT;
-            break;
-        }
-        /* Need to check if MMIO or unmapped fault */
-        case EXIT_REASON_EPT_FAULT:
-        {
-            hvf_slot *slot;
-            uint64_t gpa = rvmcs(cpu->accel->fd, VMCS_GUEST_PHYSICAL_ADDRESS);
-
-            if (((idtvec_info & VMCS_IDT_VEC_VALID) == 0) &&
-                ((exit_qual & EXIT_QUAL_NMIUDTI) != 0)) {
-                vmx_set_nmi_blocking(cpu);
-            }
-
-            slot = hvf_find_overlap_slot(gpa, 1);
-            /* mmio */
-            if (ept_emulation_fault(slot, gpa, exit_qual)) {
-                struct x86_decode decode;
-
-                hvf_load_regs(cpu);
-                decode_instruction(env, &decode);
-                exec_instruction(env, &decode);
-                hvf_store_regs(cpu);
-                break;
-            }
-            break;
-        }
-        case EXIT_REASON_INOUT:
-        {
-            uint32_t in = (exit_qual & 8) != 0;
-            uint32_t size =  (exit_qual & 7) + 1;
-            uint32_t string =  (exit_qual & 16) != 0;
-            uint32_t port =  exit_qual >> 16;
-            /*uint32_t rep = (exit_qual & 0x20) != 0;*/
-
-            if (!string && in) {
-                uint64_t val = 0;
-                hvf_load_regs(cpu);
-                hvf_handle_io(env_cpu(env), port, &val, 0, size, 1);
-                if (size == 1) {
-                    AL(env) = val;
-                } else if (size == 2) {
-                    AX(env) = val;
-                } else if (size == 4) {
-                    RAX(env) = (uint32_t)val;
-                } else {
-                    RAX(env) = (uint64_t)val;
-                }
-                env->eip += ins_len;
-                hvf_store_regs(cpu);
-                break;
-            } else if (!string && !in) {
-                RAX(env) = rreg(cpu->accel->fd, HV_X86_RAX);
-                hvf_handle_io(env_cpu(env), port, &RAX(env), 1, size, 1);
-                macvm_set_rip(cpu, rip + ins_len);
-                break;
-            }
-            struct x86_decode decode;
-
-            hvf_load_regs(cpu);
-            decode_instruction(env, &decode);
-            assert(ins_len == decode.len);
-            exec_instruction(env, &decode);
-            hvf_store_regs(cpu);
-
-            break;
-        }
-        case EXIT_REASON_CPUID: {
-            uint32_t rax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
-            uint32_t rbx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RBX);
-            uint32_t rcx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
-            uint32_t rdx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
-
-            if (rax == 1) {
-                /* CPUID1.ecx.OSXSAVE needs to know CR4 */
-                env->cr[4] = rvmcs(cpu->accel->fd, VMCS_GUEST_CR4);
-            }
-            hvf_cpu_x86_cpuid(env, rax, rcx, &rax, &rbx, &rcx, &rdx);
-
-            wreg(cpu->accel->fd, HV_X86_RAX, rax);
-            wreg(cpu->accel->fd, HV_X86_RBX, rbx);
-            wreg(cpu->accel->fd, HV_X86_RCX, rcx);
-            wreg(cpu->accel->fd, HV_X86_RDX, rdx);
-
-            macvm_set_rip(cpu, rip + ins_len);
-            break;
-        }
-        case EXIT_REASON_XSETBV: {
-            uint32_t eax = (uint32_t)rreg(cpu->accel->fd, HV_X86_RAX);
-            uint32_t ecx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RCX);
-            uint32_t edx = (uint32_t)rreg(cpu->accel->fd, HV_X86_RDX);
-
-            if (ecx) {
-                macvm_set_rip(cpu, rip + ins_len);
-                break;
-            }
-            env->xcr0 = ((uint64_t)edx << 32) | eax;
-            wreg(cpu->accel->fd, HV_X86_XCR0, env->xcr0 | 1);
-            macvm_set_rip(cpu, rip + ins_len);
-            break;
-        }
-        case EXIT_REASON_INTR_WINDOW:
-            vmx_clear_int_window_exiting(cpu);
-            ret = EXCP_INTERRUPT;
-            break;
-        case EXIT_REASON_NMI_WINDOW:
-            vmx_clear_nmi_window_exiting(cpu);
-            ret = EXCP_INTERRUPT;
-            break;
-        case EXIT_REASON_EXT_INTR:
-            /* force exit and allow io handling */
-            ret = EXCP_INTERRUPT;
-            break;
-        case EXIT_REASON_RDMSR:
-        case EXIT_REASON_WRMSR:
-        {
-            hvf_load_regs(cpu);
-            if (exit_reason == EXIT_REASON_RDMSR) {
-                hvf_simulate_rdmsr(cpu);
-            } else {
-                hvf_simulate_wrmsr(cpu);
-            }
-            env->eip += ins_len;
-            hvf_store_regs(cpu);
-            break;
-        }
-        case EXIT_REASON_CR_ACCESS: {
-            int cr;
-            int reg;
-
-            hvf_load_regs(cpu);
-            cr = exit_qual & 15;
-            reg = (exit_qual >> 8) & 15;
-
-            switch (cr) {
-            case 0x0: {
-                macvm_set_cr0(cpu->accel->fd, RRX(env, reg));
-                break;
-            }
-            case 4: {
-                macvm_set_cr4(cpu->accel->fd, RRX(env, reg));
-                break;
-            }
-            case 8: {
-                if (exit_qual & 0x10) {
-                    RRX(env, reg) = cpu_get_apic_tpr(x86_cpu->apic_state);
-                } else {
-                    int tpr = RRX(env, reg);
-                    cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
-                    ret = EXCP_INTERRUPT;
-                }
-                break;
-            }
-            default:
-                error_report("Unrecognized CR %d", cr);
-                abort();
-            }
-            env->eip += ins_len;
-            hvf_store_regs(cpu);
-            break;
-        }
-        case EXIT_REASON_APIC_ACCESS: { /* TODO */
-            struct x86_decode decode;
-
-            hvf_load_regs(cpu);
-            decode_instruction(env, &decode);
-            exec_instruction(env, &decode);
-            hvf_store_regs(cpu);
-            break;
-        }
-        case EXIT_REASON_TPR: {
-            ret = 1;
-            break;
-        }
-        case EXIT_REASON_TASK_SWITCH: {
-            uint64_t vinfo = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
-            x86_segment_selector sel = {.sel = exit_qual & 0xffff};
-            vmx_handle_task_switch(cpu, sel, (exit_qual >> 30) & 0x3,
-             vinfo & VMCS_INTR_VALID, vinfo & VECTORING_INFO_VECTOR_MASK, vinfo
-             & VMCS_INTR_T_MASK);
-            break;
-        }
-        case EXIT_REASON_TRIPLE_FAULT: {
-            qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
-            ret = EXCP_INTERRUPT;
-            break;
-        }
-        case EXIT_REASON_RDPMC:
-            wreg(cpu->accel->fd, HV_X86_RAX, 0);
-            wreg(cpu->accel->fd, HV_X86_RDX, 0);
-            macvm_set_rip(cpu, rip + ins_len);
-            break;
-        case VMX_REASON_VMCALL:
-            env->exception_nr = EXCP0D_GPF;
-            env->exception_injected = 1;
-            env->has_error_code = true;
-            env->error_code = 0;
-            break;
-        default:
-            error_report("%llx: unhandled exit %llx", rip, exit_reason);
-        }
+        ret = hvf_handle_vmexit(cpu);
     } while (ret == 0);
 
     return ret;

From 4d03dca5685f9d15fdf608d7093abc02cd540192 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:55 +0100
Subject: [PATCH 1866/2396] target/arm/hvf: Factor hvf_handle_vmexit() out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Factor hvf_handle_vmexit() out of hvf_vcpu_exec().

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 50 ++++++++++++++++++++++++--------------------
 1 file changed, 27 insertions(+), 23 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8553ce6adc..27c600148f 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1984,10 +1984,33 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
     return ret;
 }
 
+static int hvf_handle_vmexit(CPUState *cpu, hv_vcpu_exit_t *exit)
+{
+    ARMCPU *arm_cpu = env_archcpu(cpu_env(cpu));
+    int ret = 0;
+
+    switch (exit->reason) {
+    case HV_EXIT_REASON_EXCEPTION:
+        hvf_sync_vtimer(cpu);
+        ret = hvf_handle_exception(cpu, &exit->exception);
+        break;
+    case HV_EXIT_REASON_VTIMER_ACTIVATED:
+        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
+        cpu->accel->vtimer_masked = true;
+        break;
+    case HV_EXIT_REASON_CANCELED:
+        /* we got kicked, no exit to process */
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    return ret;
+}
+
 int hvf_arch_vcpu_exec(CPUState *cpu)
 {
-    ARMCPU *arm_cpu = ARM_CPU(cpu);
-    hv_vcpu_exit_t *hvf_exit = cpu->accel->exit;
+    int ret;
     hv_return_t r;
 
     if (!(cpu->singlestep_enabled & SSTEP_NOIRQ) &&
@@ -2006,6 +2029,7 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
     bql_lock();
     switch (r) {
     case HV_SUCCESS:
+        ret = hvf_handle_vmexit(cpu, cpu->accel->exit);
         break;
     case HV_ILLEGAL_GUEST_STATE:
         trace_hvf_illegal_guest_state();
@@ -2014,27 +2038,7 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         g_assert_not_reached();
     }
 
-    /* handle VMEXIT */
-    uint64_t exit_reason = hvf_exit->reason;
-
-    switch (exit_reason) {
-    case HV_EXIT_REASON_EXCEPTION:
-        /* This is the main one, handle below. */
-        break;
-    case HV_EXIT_REASON_VTIMER_ACTIVATED:
-        qemu_set_irq(arm_cpu->gt_timer_outputs[GTIMER_VIRT], 1);
-        cpu->accel->vtimer_masked = true;
-        return 0;
-    case HV_EXIT_REASON_CANCELED:
-        /* we got kicked, no exit to process */
-        return 0;
-    default:
-        g_assert_not_reached();
-    }
-
-    hvf_sync_vtimer(cpu);
-
-    return hvf_handle_exception(cpu, &hvf_exit->exception);
+    return ret;
 }
 
 static const VMStateDescription vmstate_hvf_vtimer = {

From 93ac765076a4adf676974353c542a9c2f02d3d10 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:56 +0100
Subject: [PATCH 1867/2396] target/arm/hvf: Keep calling hv_vcpu_run() in loop
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mads Ynddal <mads@ynddal.dk>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 38 ++++++++++++++++++++------------------
 1 file changed, 20 insertions(+), 18 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 27c600148f..79861dcacf 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2013,30 +2013,32 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
     int ret;
     hv_return_t r;
 
-    if (!(cpu->singlestep_enabled & SSTEP_NOIRQ) &&
-        hvf_inject_interrupts(cpu)) {
-        return EXCP_INTERRUPT;
-    }
-
     if (cpu->halted) {
         return EXCP_HLT;
     }
 
     flush_cpu_state(cpu);
 
-    bql_unlock();
-    r = hv_vcpu_run(cpu->accel->fd);
-    bql_lock();
-    switch (r) {
-    case HV_SUCCESS:
-        ret = hvf_handle_vmexit(cpu, cpu->accel->exit);
-        break;
-    case HV_ILLEGAL_GUEST_STATE:
-        trace_hvf_illegal_guest_state();
-        /* fall through */
-    default:
-        g_assert_not_reached();
-    }
+    do {
+        if (!(cpu->singlestep_enabled & SSTEP_NOIRQ) &&
+            hvf_inject_interrupts(cpu)) {
+            return EXCP_INTERRUPT;
+        }
+
+        bql_unlock();
+        r = hv_vcpu_run(cpu->accel->fd);
+        bql_lock();
+        switch (r) {
+        case HV_SUCCESS:
+            ret = hvf_handle_vmexit(cpu, cpu->accel->exit);
+            break;
+        case HV_ILLEGAL_GUEST_STATE:
+            trace_hvf_illegal_guest_state();
+            /* fall through */
+        default:
+            g_assert_not_reached();
+        }
+    } while (ret == 0);
 
     return ret;
 }

From 65e438d9ea3b2c5fdbf3a2255e95d73887d15e74 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:57 +0100
Subject: [PATCH 1868/2396] cpus: Trace cpu_exec_start() and cpu_exec_end()
 calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 cpu-common.c | 3 +++
 trace-events | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/cpu-common.c b/cpu-common.c
index 0eb5c7b8f2..988d057d84 100644
--- a/cpu-common.c
+++ b/cpu-common.c
@@ -249,6 +249,8 @@ void end_exclusive(void)
 /* Wait for exclusive ops to finish, and begin cpu execution.  */
 void cpu_exec_start(CPUState *cpu)
 {
+    trace_cpu_exec_start(cpu->cpu_index);
+
     qatomic_set(&cpu->running, true);
 
     /* Write cpu->running before reading pending_cpus.  */
@@ -319,6 +321,7 @@ void cpu_exec_end(CPUState *cpu)
             }
         }
     }
+    trace_cpu_exec_end(cpu->cpu_index);
 }
 
 void async_safe_run_on_cpu(CPUState *cpu, run_on_cpu_func func,
diff --git a/trace-events b/trace-events
index 3ec8a6c720..faeba6242f 100644
--- a/trace-events
+++ b/trace-events
@@ -29,6 +29,8 @@
 breakpoint_insert(int cpu_index, uint64_t pc, int flags) "cpu=%d pc=0x%" PRIx64 " flags=0x%x"
 breakpoint_remove(int cpu_index, uint64_t pc, int flags) "cpu=%d pc=0x%" PRIx64 " flags=0x%x"
 breakpoint_singlestep(int cpu_index, int enabled) "cpu=%d enable=%d"
+cpu_exec_start(int cpu_index) "cpu=%d"
+cpu_exec_end(int cpu_index) "cpu=%d"
 
 # job.c
 job_state_transition(void *job,  int ret, const char *legal, const char *s0, const char *s1) "job %p (ret: %d) attempting %s transition (%s-->%s)"

From 5f34a5b6428f86944342498adc67d56e876d1003 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:58 +0100
Subject: [PATCH 1869/2396] accel/hvf: Guard hv_vcpu_run() between
 cpu_exec_start/end() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Similarly to 1d78a3c3ab8 for KVM, wrap hv_vcpu_run() with
cpu_exec_start/end(), so that the accelerator can perform
pending operations while all vCPUs are quiescent. See also
explanation in commit c265e976f46 ("cpus-common: lock-free
fast path for cpu_exec_start/end").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c  | 2 ++
 target/i386/hvf/hvf.c | 4 ++++
 2 files changed, 6 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 79861dcacf..c882f4c89c 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2026,7 +2026,9 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
         }
 
         bql_unlock();
+        cpu_exec_start(cpu);
         r = hv_vcpu_run(cpu->accel->fd);
+        cpu_exec_end(cpu);
         bql_lock();
         switch (r) {
         case HV_SUCCESS:
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 28d98659ec..16febbac48 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -992,9 +992,13 @@ int hvf_arch_vcpu_exec(CPUState *cpu)
             return EXCP_HLT;
         }
 
+        cpu_exec_start(cpu);
+
         hv_return_t r = hv_vcpu_run_until(cpu->accel->fd, HV_DEADLINE_FOREVER);
         assert_hvf_ok(r);
 
+        cpu_exec_end(cpu);
+
         ret = hvf_handle_vmexit(cpu);
     } while (ret == 0);
 

From 7da8b562ae694039e8c2f36e87a5e99b1f4745ed Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:41:59 +0100
Subject: [PATCH 1870/2396] target/arm: Call aarch64_add_pauth_properties()
 once in host_initfn()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index 26cf7e6dfa..f81cfd0113 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -762,20 +762,20 @@ static void aarch64_a53_initfn(Object *obj)
 
 static void aarch64_host_initfn(Object *obj)
 {
-#if defined(CONFIG_KVM)
     ARMCPU *cpu = ARM_CPU(obj);
+#if defined(CONFIG_KVM)
     kvm_arm_set_cpu_features_from_host(cpu);
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         aarch64_add_sve_properties(obj);
-        aarch64_add_pauth_properties(obj);
     }
 #elif defined(CONFIG_HVF)
-    ARMCPU *cpu = ARM_CPU(obj);
     hvf_arm_set_cpu_features_from_host(cpu);
-    aarch64_add_pauth_properties(obj);
 #else
     g_assert_not_reached();
 #endif
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        aarch64_add_pauth_properties(obj);
+    }
 }
 
 static void aarch64_max_initfn(Object *obj)

From 2ad756383e1bcf8001696c81f64b26f35f1af142 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:00 +0100
Subject: [PATCH 1871/2396] accel/hvf: Restrict ARM specific fields of
 AccelCPUState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Do not expose ARM specific fields to X86 implementation,
allowing to use the proper 'hv_vcpu_exit_t' type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/system/hvf_int.h | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/include/system/hvf_int.h b/include/system/hvf_int.h
index 195d64dcf1..3d2be4092e 100644
--- a/include/system/hvf_int.h
+++ b/include/system/hvf_int.h
@@ -59,10 +59,12 @@ extern HVFState *hvf_state;
 
 struct AccelCPUState {
     hvf_vcpuid fd;
-    void *exit;
+#ifdef __aarch64__
+    hv_vcpu_exit_t *exit;
     bool vtimer_masked;
     sigset_t unblock_ipi_mask;
     bool guest_debug_enabled;
+#endif
 };
 
 void assert_hvf_ok_impl(hv_return_t ret, const char *file, unsigned int line,

From 1ada8eb7c90f7625196975231e68736173f703ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:01 +0100
Subject: [PATCH 1872/2396] target/arm: Rename init_cpreg_list() ->
 arm_init_cpreg_list()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Prefix init_cpreg_list() with 'arm_'.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c       | 2 +-
 target/arm/helper.c    | 2 +-
 target/arm/internals.h | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index d2fc17eab6..39292fb9bc 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -2141,7 +2141,7 @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     arm_cpu_register_gdb_regs_for_features(cpu);
     arm_cpu_register_gdb_commands(cpu);
 
-    init_cpreg_list(cpu);
+    arm_init_cpreg_list(cpu);
 
 #ifndef CONFIG_USER_ONLY
     MachineState *ms = MACHINE(qdev_get_machine());
diff --git a/target/arm/helper.c b/target/arm/helper.c
index ef6435c3ef..27ebc6f29b 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -253,7 +253,7 @@ static void count_cpreg(gpointer key, gpointer value, gpointer opaque)
     }
 }
 
-void init_cpreg_list(ARMCPU *cpu)
+void arm_init_cpreg_list(ARMCPU *cpu)
 {
     /*
      * Initialise the cpreg_tuples[] array based on the cp_regs hash.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index 4c0fa28ef8..75677945af 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -377,7 +377,7 @@ void arm_cpu_register(const ARMCPUInfo *info);
 
 void arm_do_plugin_vcpu_discon_cb(CPUState *cs, uint64_t from);
 void register_cp_regs_for_features(ARMCPU *cpu);
-void init_cpreg_list(ARMCPU *cpu);
+void arm_init_cpreg_list(ARMCPU *cpu);
 
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);

From 6d1a5105eeb7e1fc7f052007923306975f4f85e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:02 +0100
Subject: [PATCH 1873/2396] target/arm/hvf: Rename 'vgic' -> 'emu_reginfo' in
 trace events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In order to extend the trace events to other registers,
rename and pass the register group as argument.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 14 ++++++++------
 target/arm/hvf/trace-events |  4 ++--
 2 files changed, 10 insertions(+), 8 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index c882f4c89c..26bafee259 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1149,7 +1149,8 @@ static uint32_t hvf_reg2cp_reg(uint32_t reg)
                               (reg >> SYSREG_OP2_SHIFT) & SYSREG_OP2_MASK);
 }
 
-static bool hvf_sysreg_read_cp(CPUState *cpu, uint32_t reg, uint64_t *val)
+static bool hvf_sysreg_read_cp(CPUState *cpu, const char *cpname,
+                               uint32_t reg, uint64_t *val)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
@@ -1172,7 +1173,7 @@ static bool hvf_sysreg_read_cp(CPUState *cpu, uint32_t reg, uint64_t *val)
         } else {
             *val = raw_read(env, ri);
         }
-        trace_hvf_vgic_read(ri->name, *val);
+        trace_hvf_emu_reginfo_read(cpname, ri->name, *val);
         return true;
     }
 
@@ -1261,7 +1262,7 @@ static int hvf_sysreg_read(CPUState *cpu, uint32_t reg, uint64_t *val)
     case SYSREG_ICC_SRE_EL1:
     case SYSREG_ICC_CTLR_EL1:
         /* Call the TCG sysreg handler. This is only safe for GICv3 regs. */
-        if (hvf_sysreg_read_cp(cpu, reg, val)) {
+        if (hvf_sysreg_read_cp(cpu, "GICv3", reg, val)) {
             return 0;
         }
         break;
@@ -1432,7 +1433,8 @@ static void pmswinc_write(CPUARMState *env, uint64_t value)
     }
 }
 
-static bool hvf_sysreg_write_cp(CPUState *cpu, uint32_t reg, uint64_t val)
+static bool hvf_sysreg_write_cp(CPUState *cpu, const char *cpname,
+                                uint32_t reg, uint64_t val)
 {
     ARMCPU *arm_cpu = ARM_CPU(cpu);
     CPUARMState *env = &arm_cpu->env;
@@ -1455,7 +1457,7 @@ static bool hvf_sysreg_write_cp(CPUState *cpu, uint32_t reg, uint64_t val)
             raw_write(env, ri, val);
         }
 
-        trace_hvf_vgic_write(ri->name, val);
+        trace_hvf_emu_reginfo_write(cpname, ri->name, val);
         return true;
     }
 
@@ -1581,7 +1583,7 @@ static int hvf_sysreg_write(CPUState *cpu, uint32_t reg, uint64_t val)
     case SYSREG_ICC_SGI1R_EL1:
     case SYSREG_ICC_SRE_EL1:
         /* Call the TCG sysreg handler. This is only safe for GICv3 regs. */
-        if (hvf_sysreg_write_cp(cpu, reg, val)) {
+        if (hvf_sysreg_write_cp(cpu, "GICv3", reg, val)) {
             return 0;
         }
         break;
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index 538af6e070..29387780e3 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -9,7 +9,7 @@ hvf_unknown_hvc(uint64_t pc, uint64_t x0) "pc=0x%"PRIx64" unknown HVC! 0x%016"PR
 hvf_unknown_smc(uint64_t x0) "unknown SMC! 0x%016"PRIx64
 hvf_exit(uint64_t syndrome, uint32_t ec, uint64_t pc) "exit: 0x%"PRIx64" [ec=0x%x pc=0x%"PRIx64"]"
 hvf_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpuid=0x%x"
-hvf_vgic_write(const char *name, uint64_t val) "vgic write to %s [val=0x%016"PRIx64"]"
-hvf_vgic_read(const char *name, uint64_t val) "vgic read from %s [val=0x%016"PRIx64"]"
+hvf_emu_reginfo_write(const char *cpname, const char *regname, uint64_t val) "[%s] write to %s [val=0x%016"PRIx64"]"
+hvf_emu_reginfo_read(const char *cpname, const char *regname, uint64_t val) "[%s] read from %s [val=0x%016"PRIx64"]"
 hvf_illegal_guest_state(void) "HV_ILLEGAL_GUEST_STATE"
 hvf_kick_vcpu_thread(unsigned cpuidx, bool stop) "cpu:%u stop:%u"

From 4695daacc068cd0aa9a91c0063c4f2a9ec9b7ba1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:03 +0100
Subject: [PATCH 1874/2396] target/arm: Re-use arm_is_psci_call() in HVF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Re-use arm_is_psci_call() instead of open-coding it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 26bafee259..a3bb71e63b 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1934,7 +1934,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
         break;
     case EC_AA64_HVC:
         cpu_synchronize_state(cpu);
-        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
+        if (arm_is_psci_call(arm_cpu, EXCP_HVC)) {
             if (!hvf_handle_psci_call(cpu)) {
                 trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
                 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
@@ -1947,7 +1947,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
         break;
     case EC_AA64_SMC:
         cpu_synchronize_state(cpu);
-        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) {
+        if (arm_is_psci_call(arm_cpu, EXCP_SMC)) {
             advance_pc = true;
 
             if (!hvf_handle_psci_call(cpu)) {

From 06ddd61f81ea10da92743d4d0f0f88b8cfa8c5b3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:04 +0100
Subject: [PATCH 1875/2396] target/arm: Share ARM_PSCI_CALL trace event between
 TCG and HVF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It is useful to compare PSCI calls of the same guest running
under TCG or HVF.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c    | 3 ++-
 target/arm/tcg/psci.c   | 3 +++
 target/arm/trace-events | 3 +++
 3 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index a3bb71e63b..f31b6e54ee 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -34,6 +34,7 @@
 #include "target/arm/internals.h"
 #include "target/arm/multiprocessing.h"
 #include "target/arm/gtimer.h"
+#include "target/arm/trace.h"
 #include "trace.h"
 #include "migration/vmstate.h"
 
@@ -1025,7 +1026,7 @@ static bool hvf_handle_psci_call(CPUState *cpu)
     int target_el = 1;
     int32_t ret = 0;
 
-    trace_hvf_psci_call(param[0], param[1], param[2], param[3],
+    trace_arm_psci_call(param[0], param[1], param[2], param[3],
                         arm_cpu_mp_affinity(arm_cpu));
 
     switch (param[0]) {
diff --git a/target/arm/tcg/psci.c b/target/arm/tcg/psci.c
index cabed43e8a..2d40930157 100644
--- a/target/arm/tcg/psci.c
+++ b/target/arm/tcg/psci.c
@@ -25,6 +25,7 @@
 #include "internals.h"
 #include "arm-powerctl.h"
 #include "target/arm/multiprocessing.h"
+#include "target/arm/trace.h"
 
 bool arm_is_psci_call(ARMCPU *cpu, int excp_type)
 {
@@ -79,6 +80,8 @@ void arm_handle_psci_call(ARMCPU *cpu)
          */
         param[i] = is_a64(env) ? env->xregs[i] : env->regs[i];
     }
+    trace_arm_psci_call(param[0], param[1], param[2], param[3],
+                        arm_cpu_mp_affinity(cpu));
 
     if ((param[0] & QEMU_PSCI_0_2_64BIT) && !is_a64(env)) {
         ret = QEMU_PSCI_RET_NOT_SUPPORTED;
diff --git a/target/arm/trace-events b/target/arm/trace-events
index 72a2c7d096..676d29fe51 100644
--- a/target/arm/trace-events
+++ b/target/arm/trace-events
@@ -23,3 +23,6 @@ arm_powerctl_set_cpu_on(uint64_t mp_aff, unsigned target_el, const char *mode, u
 arm_powerctl_set_cpu_on_and_reset(uint64_t mp_aff) "cpu %" PRIu64
 arm_powerctl_set_cpu_off(uint64_t mp_aff) "cpu %" PRIu64
 arm_powerctl_reset_cpu(uint64_t mp_aff) "cpu %" PRIu64
+
+# tcg/psci.c and hvf/hvf.c
+arm_psci_call(uint64_t x0, uint64_t x1, uint64_t x2, uint64_t x3, uint32_t cpuid) "PSCI Call x0=0x%016"PRIx64" x1=0x%016"PRIx64" x2=0x%016"PRIx64" x3=0x%016"PRIx64" cpuid=0x%x"

From 31e1b9823056f4d1d95b5a76029411954aaaf2af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:05 +0100
Subject: [PATCH 1876/2396] target/arm/hvf/hvf: Document $pc adjustment in HVF
 & SMC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index f31b6e54ee..805fe75e6b 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1936,6 +1936,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
     case EC_AA64_HVC:
         cpu_synchronize_state(cpu);
         if (arm_is_psci_call(arm_cpu, EXCP_HVC)) {
+            /* Do NOT advance $pc for HVC */
             if (!hvf_handle_psci_call(cpu)) {
                 trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
                 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
@@ -1949,6 +1950,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
     case EC_AA64_SMC:
         cpu_synchronize_state(cpu);
         if (arm_is_psci_call(arm_cpu, EXCP_SMC)) {
+            /* Secure Monitor Call exception, we need to advance $pc */
             advance_pc = true;
 
             if (!hvf_handle_psci_call(cpu)) {

From 8b733be9f408f9b550fc998c790e32aded5119f1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 06:42:06 +0100
Subject: [PATCH 1877/2396] accel/hvf: Trace prefetch abort
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/hvf/hvf.c        | 11 +++++++++++
 target/arm/hvf/trace-events |  1 +
 2 files changed, 12 insertions(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 805fe75e6b..de1e8fb8a0 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1963,6 +1963,17 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
             hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
         }
         break;
+    case EC_INSNABORT: {
+        uint32_t set = (syndrome >> 12) & 3;
+        bool fnv = (syndrome >> 10) & 1;
+        bool ea = (syndrome >> 9) & 1;
+        bool s1ptw = (syndrome >> 7) & 1;
+        uint32_t ifsc = (syndrome >> 0) & 0x3f;
+
+        trace_hvf_insn_abort(env->pc, set, fnv, ea, s1ptw, ifsc);
+
+        /* fall through */
+    }
     default:
         cpu_synchronize_state(cpu);
         trace_hvf_exit(syndrome, ec, env->pc);
diff --git a/target/arm/hvf/trace-events b/target/arm/hvf/trace-events
index 29387780e3..b0d3d7bd32 100644
--- a/target/arm/hvf/trace-events
+++ b/target/arm/hvf/trace-events
@@ -3,6 +3,7 @@ hvf_unhandled_sysreg_write(uint64_t pc, uint32_t reg, uint32_t op0, uint32_t op1
 hvf_inject_fiq(void) "injecting FIQ"
 hvf_inject_irq(void) "injecting IRQ"
 hvf_data_abort(uint64_t va, uint64_t pa, bool isv, bool iswrite, bool s1ptw, uint32_t len, uint32_t srt) "data abort: [va=0x%016"PRIx64" pa=0x%016"PRIx64" isv=%d iswrite=%d s1ptw=%d len=%d srt=%d]"
+hvf_insn_abort(uint64_t pc, uint32_t set, bool fnv, bool ea, bool s1ptw, uint32_t ifsc) "insn abort: [pc=0x%"PRIx64" set=%d fnv=%d ea=%d s1ptw=%d ifsc=%d]"
 hvf_sysreg_read(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg read 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d) = 0x%016"PRIx64
 hvf_sysreg_write(uint32_t reg, uint32_t op0, uint32_t op1, uint32_t crn, uint32_t crm, uint32_t op2, uint64_t val) "sysreg write 0x%08x (op0=%d op1=%d crn=%d crm=%d op2=%d, val=0x%016"PRIx64")"
 hvf_unknown_hvc(uint64_t pc, uint64_t x0) "pc=0x%"PRIx64" unknown HVC! 0x%016"PRIx64

From 451e7b7aa74b9bc365afe98e2ad748177526008b Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Oct 2025 11:55:51 +0100
Subject: [PATCH 1878/2396] igvm: move igvm.h file to include/system

Prepare for arch-specific igvm code being added to the code base.

Reviewed-by: Ani Sinha <anisinha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-2-kraxel@redhat.com>
---
 backends/igvm-cfg.c                 | 2 +-
 backends/igvm.c                     | 2 +-
 {backends => include/system}/igvm.h | 0
 3 files changed, 2 insertions(+), 2 deletions(-)
 rename {backends => include/system}/igvm.h (100%)

diff --git a/backends/igvm-cfg.c b/backends/igvm-cfg.c
index 45df63e06c..d00acf3512 100644
--- a/backends/igvm-cfg.c
+++ b/backends/igvm-cfg.c
@@ -12,7 +12,7 @@
 #include "qemu/osdep.h"
 
 #include "system/igvm-cfg.h"
-#include "igvm.h"
+#include "system/igvm.h"
 #include "qom/object_interfaces.h"
 
 static char *get_igvm(Object *obj, Error **errp)
diff --git a/backends/igvm.c b/backends/igvm.c
index 9ad41582ee..723d45b755 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -11,8 +11,8 @@
 
 #include "qemu/osdep.h"
 
-#include "igvm.h"
 #include "qapi/error.h"
+#include "system/igvm.h"
 #include "system/memory.h"
 #include "system/address-spaces.h"
 #include "hw/core/cpu.h"
diff --git a/backends/igvm.h b/include/system/igvm.h
similarity index 100%
rename from backends/igvm.h
rename to include/system/igvm.h

From dd020b4e6baa27012d06fd7bee67c32f1cf78acc Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Oct 2025 11:55:52 +0100
Subject: [PATCH 1879/2396] igvm: fix off by one bug in memmap entry count
 checking

Fixes: c1d466d267 ("backends/igvm: Add IGVM loader and configuration")
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-3-kraxel@redhat.com>
---
 backends/igvm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backends/igvm.c b/backends/igvm.c
index 723d45b755..055bbba745 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -567,7 +567,7 @@ static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
 
             retval = ctx->cgsc->get_mem_map_entry(entry, &cgmm_entry, errp);
             while (retval == 0) {
-                if (entry > max_entry_count) {
+                if (entry >= max_entry_count) {
                     error_setg(
                         errp,
                         "IGVM: guest memory map size exceeds parameter area defined in IGVM file");

From 13abf2fcb7a63fe28766dbd9b77383aea8b9f33c Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Oct 2025 11:55:53 +0100
Subject: [PATCH 1880/2396] igvm: add support for igvm memory map parameter in
 native mode

Add and wire up qigvm_x86_get_mem_map_entry function which converts the
e820 table into an igvm memory map parameter.  This makes igvm files for
the native (non-confidential) platform with memory map parameter work.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-4-kraxel@redhat.com>
---
 backends/igvm.c         | 16 ++++++++++----
 include/system/igvm.h   |  5 +++++
 stubs/igvm.c            | 21 +++++++++++++++++++
 stubs/meson.build       |  1 +
 target/i386/igvm.c      | 46 +++++++++++++++++++++++++++++++++++++++++
 target/i386/meson.build |  3 +++
 6 files changed, 88 insertions(+), 4 deletions(-)
 create mode 100644 stubs/igvm.c
 create mode 100644 target/i386/igvm.c

diff --git a/backends/igvm.c b/backends/igvm.c
index 055bbba745..2ab7a9d965 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -12,6 +12,7 @@
 #include "qemu/osdep.h"
 
 #include "qapi/error.h"
+#include "qemu/target-info-qapi.h"
 #include "system/igvm.h"
 #include "system/memory.h"
 #include "system/address-spaces.h"
@@ -543,6 +544,8 @@ static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
                                       Error **errp)
 {
     const IGVM_VHS_PARAMETER *param = (const IGVM_VHS_PARAMETER *)header_data;
+    int (*get_mem_map_entry)(int index, ConfidentialGuestMemoryMapEntry *entry,
+                             Error **errp) = NULL;
     QIgvmParameterData *param_entry;
     int max_entry_count;
     int entry = 0;
@@ -550,7 +553,13 @@ static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
     ConfidentialGuestMemoryMapEntry cgmm_entry;
     int retval = 0;
 
-    if (!ctx->cgs) {
+    if (ctx->cgs && ctx->cgsc->get_mem_map_entry) {
+        get_mem_map_entry = ctx->cgsc->get_mem_map_entry;
+
+    } else if (target_arch() == SYS_EMU_TARGET_X86_64) {
+        get_mem_map_entry = qigvm_x86_get_mem_map_entry;
+
+    } else {
         error_setg(errp,
                    "IGVM file contains a memory map but this is not supported "
                    "by the current system.");
@@ -565,7 +574,7 @@ static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
                 param_entry->size / sizeof(IGVM_VHS_MEMORY_MAP_ENTRY);
             mm_entry = (IGVM_VHS_MEMORY_MAP_ENTRY *)param_entry->data;
 
-            retval = ctx->cgsc->get_mem_map_entry(entry, &cgmm_entry, errp);
+            retval = get_mem_map_entry(entry, &cgmm_entry, errp);
             while (retval == 0) {
                 if (entry >= max_entry_count) {
                     error_setg(
@@ -598,8 +607,7 @@ static int qigvm_directive_memory_map(QIgvm *ctx, const uint8_t *header_data,
                         IGVM_MEMORY_MAP_ENTRY_TYPE_PLATFORM_RESERVED;
                     break;
                 }
-                retval =
-                    ctx->cgsc->get_mem_map_entry(++entry, &cgmm_entry, errp);
+                retval = get_mem_map_entry(++entry, &cgmm_entry, errp);
             }
             if (retval < 0) {
                 return retval;
diff --git a/include/system/igvm.h b/include/system/igvm.h
index a4abab043a..3f72a40b88 100644
--- a/include/system/igvm.h
+++ b/include/system/igvm.h
@@ -19,4 +19,9 @@
 int qigvm_process_file(IgvmCfg *igvm, ConfidentialGuestSupport *cgs,
                       bool onlyVpContext, Error **errp);
 
+/* x86 native */
+int qigvm_x86_get_mem_map_entry(int index,
+                                ConfidentialGuestMemoryMapEntry *entry,
+                                Error **errp);
+
 #endif
diff --git a/stubs/igvm.c b/stubs/igvm.c
new file mode 100644
index 0000000000..c32058eb2a
--- /dev/null
+++ b/stubs/igvm.c
@@ -0,0 +1,21 @@
+/*
+ * QEMU IGVM, stubs
+ *
+ * Copyright (C) 2026 Red Hat
+ *
+ * Authors:
+ *  Gerd Hoffmann <kraxel@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "system/igvm.h"
+
+int qigvm_x86_get_mem_map_entry(int index,
+                                ConfidentialGuestMemoryMapEntry *entry,
+                                Error **errp)
+{
+    return -1;
+}
diff --git a/stubs/meson.build b/stubs/meson.build
index 5d577467bf..27be2dec9f 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -74,6 +74,7 @@ if have_system
   stub_ss.add(files('dump.c'))
   stub_ss.add(files('cmos.c'))
   stub_ss.add(files('fw_cfg.c'))
+  stub_ss.add(files('igvm.c'))
   stub_ss.add(files('target-get-monitor-def.c'))
   stub_ss.add(files('target-monitor-defs.c'))
   stub_ss.add(files('win32-kbd-hook.c'))
diff --git a/target/i386/igvm.c b/target/i386/igvm.c
new file mode 100644
index 0000000000..2ed6cd052c
--- /dev/null
+++ b/target/i386/igvm.c
@@ -0,0 +1,46 @@
+/*
+ * QEMU IGVM, support for native x86 guests
+ *
+ * Copyright (C) 2026 Red Hat
+ *
+ * Authors:
+ *  Gerd Hoffmann <kraxel@redhat.com>
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "hw/i386/e820_memory_layout.h"
+#include "system/igvm.h"
+
+/*
+ * convert e820 table into igvm memory map
+ */
+int qigvm_x86_get_mem_map_entry(int index,
+                                ConfidentialGuestMemoryMapEntry *entry,
+                                Error **errp)
+{
+    struct e820_entry *table;
+    int num_entries;
+
+    num_entries = e820_get_table(&table);
+    if ((index < 0) || (index >= num_entries)) {
+        return 1;
+    }
+    entry->gpa = table[index].address;
+    entry->size = table[index].length;
+    switch (table[index].type) {
+    case E820_RAM:
+        entry->type = CGS_MEM_RAM;
+        break;
+    case E820_RESERVED:
+        entry->type = CGS_MEM_RESERVED;
+        break;
+    default:
+        /* should not happen */
+        error_setg(errp, "unknown e820 type");
+        return -1;
+    }
+    return 0;
+}
diff --git a/target/i386/meson.build b/target/i386/meson.build
index 89ba4912aa..d385eafdf7 100644
--- a/target/i386/meson.build
+++ b/target/i386/meson.build
@@ -26,6 +26,9 @@ i386_system_ss.add(files(
 ))
 i386_system_ss.add(when: 'CONFIG_SEV', if_true: files('sev.c'),
                                        if_false: files('sev-system-stub.c'))
+if igvm.found()
+  i386_system_ss.add(files('igvm.c'))
+endif
 
 i386_user_ss = ss.source_set()
 

From 593fe98d745544a6a6ad66242633713d30a60d24 Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Oct 2025 11:55:54 +0100
Subject: [PATCH 1881/2396] igvm: add support for initial register state load
 in native mode

Add IgvmNativeVpContextX64 struct holding the register state (see igvm
spec), and the qigvm_x86_load_context() function to load the register
state.

Wire up using two new functions: qigvm_x86_set_vp_context() is called
from igvm file handling code and stores the boot processor context.
qigvm_x86_bsp_reset() is called from i386 target cpu reset code and
loads the context into the cpu registers.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Luigi Leonardi <leonardi@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-5-kraxel@redhat.com>
---
 backends/igvm.c       |  30 +++++-----
 include/system/igvm.h |   2 +
 stubs/igvm.c          |   5 ++
 target/i386/cpu.c     |   6 ++
 target/i386/cpu.h     |   3 +
 target/i386/igvm.c    | 134 ++++++++++++++++++++++++++++++++++++++++++
 6 files changed, 165 insertions(+), 15 deletions(-)

diff --git a/backends/igvm.c b/backends/igvm.c
index 2ab7a9d965..905bd8d989 100644
--- a/backends/igvm.c
+++ b/backends/igvm.c
@@ -432,18 +432,6 @@ static int qigvm_directive_vp_context(QIgvm *ctx, const uint8_t *header_data,
         return 0;
     }
 
-    /*
-     * A confidential guest support object must be provided for setting
-     * a VP context.
-     */
-    if (!ctx->cgs) {
-        error_setg(
-            errp,
-            "A VP context is present in the IGVM file but is not supported "
-            "by the current system.");
-        return -1;
-    }
-
     data_handle = igvm_get_header_data(ctx->file, IGVM_HEADER_SECTION_DIRECTIVE,
                                        ctx->current_header_index);
     if (data_handle < 0) {
@@ -453,9 +441,21 @@ static int qigvm_directive_vp_context(QIgvm *ctx, const uint8_t *header_data,
     }
 
     data = (uint8_t *)igvm_get_buffer(ctx->file, data_handle);
-    result = ctx->cgsc->set_guest_state(
-        vp_context->gpa, data, igvm_get_buffer_size(ctx->file, data_handle),
-        CGS_PAGE_TYPE_VMSA, vp_context->vp_index, errp);
+
+    if (ctx->cgs) {
+        result = ctx->cgsc->set_guest_state(
+            vp_context->gpa, data, igvm_get_buffer_size(ctx->file, data_handle),
+            CGS_PAGE_TYPE_VMSA, vp_context->vp_index, errp);
+    } else if (target_arch() == SYS_EMU_TARGET_X86_64) {
+        result = qigvm_x86_set_vp_context(data, vp_context->vp_index, errp);
+    } else {
+        error_setg(
+            errp,
+            "A VP context is present in the IGVM file but is not supported "
+            "by the current system.");
+        result = -1;
+    }
+
     igvm_free_buffer(ctx->file, data_handle);
     if (result < 0) {
         return result;
diff --git a/include/system/igvm.h b/include/system/igvm.h
index 3f72a40b88..48ce206042 100644
--- a/include/system/igvm.h
+++ b/include/system/igvm.h
@@ -23,5 +23,7 @@ int qigvm_process_file(IgvmCfg *igvm, ConfidentialGuestSupport *cgs,
 int qigvm_x86_get_mem_map_entry(int index,
                                 ConfidentialGuestMemoryMapEntry *entry,
                                 Error **errp);
+int qigvm_x86_set_vp_context(void *data, int index,
+                             Error **errp);
 
 #endif
diff --git a/stubs/igvm.c b/stubs/igvm.c
index c32058eb2a..17cd1e903e 100644
--- a/stubs/igvm.c
+++ b/stubs/igvm.c
@@ -19,3 +19,8 @@ int qigvm_x86_get_mem_map_entry(int index,
 {
     return -1;
 }
+
+int qigvm_x86_set_vp_context(void *data, int index, Error **errp)
+{
+    return -1;
+}
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 0a66e1fec9..6417775786 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -8770,6 +8770,12 @@ static void x86_cpu_reset_hold(Object *obj, ResetType type)
 
     cs->halted = !cpu_is_bsp(cpu);
 
+#if defined(CONFIG_IGVM)
+    if (cpu_is_bsp(cpu)) {
+        qigvm_x86_bsp_reset(env);
+    }
+#endif
+
     if (kvm_enabled()) {
         kvm_arch_reset_vcpu(cpu);
     }
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index d0da9bfe58..cee1f692a1 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2868,6 +2868,9 @@ void x86_cpu_dump_local_apic_state(CPUState *cs, int flags);
 
 #endif
 
+/* igvm.c */
+void qigvm_x86_bsp_reset(CPUX86State *env);
+
 /* cpu.c */
 bool cpu_is_bsp(X86CPU *cpu);
 
diff --git a/target/i386/igvm.c b/target/i386/igvm.c
index 2ed6cd052c..457c253b03 100644
--- a/target/i386/igvm.c
+++ b/target/i386/igvm.c
@@ -11,9 +11,115 @@
 
 #include "qemu/osdep.h"
 
+#include "cpu.h"
 #include "hw/i386/e820_memory_layout.h"
 #include "system/igvm.h"
 
+struct IgvmNativeVpContextX64 {
+    uint64_t rax;
+    uint64_t rcx;
+    uint64_t rdx;
+    uint64_t rbx;
+    uint64_t rsp;
+    uint64_t rbp;
+    uint64_t rsi;
+    uint64_t rdi;
+    uint64_t r8;
+    uint64_t r9;
+    uint64_t r10;
+    uint64_t r11;
+    uint64_t r12;
+    uint64_t r13;
+    uint64_t r14;
+    uint64_t r15;
+    uint64_t rip;
+    uint64_t rflags;
+    uint64_t idtr_base;
+    uint16_t idtr_limit;
+    uint16_t reserved[2];
+    uint16_t gdtr_limit;
+    uint64_t gdtr_base;
+
+    uint16_t code_selector;
+    uint16_t code_attributes;
+    uint32_t code_base;
+    uint32_t code_limit;
+
+    uint16_t data_selector;
+    uint16_t data_attributes;
+    uint32_t data_base;
+    uint32_t data_limit;
+
+    uint64_t gs_base;
+    uint64_t cr0;
+    uint64_t cr3;
+    uint64_t cr4;
+    uint64_t efer;
+};
+
+#define FLAGS_TO_SEGCACHE(flags)                \
+    (((unsigned int)flags) << 8)
+
+static void qigvm_x86_load_context(struct IgvmNativeVpContextX64 *context,
+                                   CPUX86State *env)
+{
+    cpu_load_efer(env, context->efer);
+    cpu_x86_update_cr4(env, context->cr4);
+    cpu_x86_update_cr0(env, context->cr0);
+    cpu_x86_update_cr3(env, context->cr3);
+
+    cpu_x86_load_seg_cache(
+        env, R_CS, context->code_selector,
+        context->code_base, context->code_limit,
+        FLAGS_TO_SEGCACHE(context->code_attributes));
+    cpu_x86_load_seg_cache(
+        env, R_DS, context->data_selector,
+        context->data_base, context->data_limit,
+        FLAGS_TO_SEGCACHE(context->data_attributes));
+    cpu_x86_load_seg_cache(
+        env, R_ES, context->data_selector,
+        context->data_base, context->data_limit,
+        FLAGS_TO_SEGCACHE(context->data_attributes));
+    cpu_x86_load_seg_cache(
+        env, R_FS, context->data_selector,
+        context->data_base, context->data_limit,
+        FLAGS_TO_SEGCACHE(context->data_attributes));
+    cpu_x86_load_seg_cache(
+        env, R_GS, context->data_selector,
+        context->data_base, context->data_limit,
+        FLAGS_TO_SEGCACHE(context->data_attributes));
+    cpu_x86_load_seg_cache(
+        env, R_SS, context->data_selector,
+        context->data_base, context->data_limit,
+        FLAGS_TO_SEGCACHE(context->data_attributes));
+
+    env->gdt.base = context->gdtr_base;
+    env->gdt.limit = context->gdtr_limit;
+    env->idt.base = context->idtr_base;
+    env->idt.limit = context->idtr_limit;
+
+    env->regs[R_EAX] = context->rax;
+    env->regs[R_ECX] = context->rcx;
+    env->regs[R_EDX] = context->rdx;
+    env->regs[R_EBX] = context->rbx;
+    env->regs[R_ESP] = context->rsp;
+    env->regs[R_EBP] = context->rbp;
+    env->regs[R_ESI] = context->rsi;
+    env->regs[R_EDI] = context->rdi;
+#ifdef TARGET_X86_64
+    env->regs[R_R8] = context->r8;
+    env->regs[R_R9] = context->r9;
+    env->regs[R_R10] = context->r10;
+    env->regs[R_R11] = context->r11;
+    env->regs[R_R12] = context->r12;
+    env->regs[R_R13] = context->r13;
+    env->regs[R_R14] = context->r14;
+    env->regs[R_R15] = context->r15;
+#endif
+    env->eip = context->rip;
+    env->eflags = context->rflags;
+}
+
 /*
  * convert e820 table into igvm memory map
  */
@@ -44,3 +150,31 @@ int qigvm_x86_get_mem_map_entry(int index,
     }
     return 0;
 }
+
+/*
+ * set initial cpu context
+ */
+static struct IgvmNativeVpContextX64 *bsp_context;
+
+int qigvm_x86_set_vp_context(void *data, int index, Error **errp)
+{
+    if (index != 0) {
+        error_setg(errp, "context can be set for BSP only");
+        return -1;
+    }
+
+    if (bsp_context == NULL) {
+        bsp_context = g_new0(struct IgvmNativeVpContextX64, 1);
+    }
+    memcpy(bsp_context, data, sizeof(struct IgvmNativeVpContextX64));
+    return 0;
+}
+
+void qigvm_x86_bsp_reset(CPUX86State *env)
+{
+    if (bsp_context == NULL) {
+        return;
+    }
+
+    qigvm_x86_load_context(bsp_context, env);
+}

From 541e7a2d987cf74bc1931bdd99d64b27bc9f335b Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 29 Oct 2025 11:55:55 +0100
Subject: [PATCH 1882/2396] igvm: add MAINTAINERS entry

Roy Hopkins (the original author) does not respond, so the new plan
going forward is that I will maintain this together with Stefano.  Also
add Ani as reviewer.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20251029105555.2492276-6-kraxel@redhat.com>
---
 MAINTAINERS | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index a6a1d36f52..ee058e2fef 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3908,6 +3908,17 @@ F: roms/edk2-*
 F: tests/data/uefi-boot-images/
 F: tests/uefi-test-tools/
 
+IGVM Firmware
+M: Gerd Hoffmann <kraxel@redhat.com>
+M: Stefano Garzarella <sgarzare@redhat.com>
+R: Ani Sinha <anisinha@redhat.com>
+S: Maintained
+F: backends/igvm*.c
+F: docs/system/igvm.rst
+F: include/system/igvm*.h
+F: stubs/igvm.c
+F: target/i386/igvm.c
+
 VT-d Emulation
 M: Michael S. Tsirkin <mst@redhat.com>
 R: Jason Wang <jasowang@redhat.com>

From 41a6620c91db5724ab44495294336d2a689bd2fd Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Wed, 22 Oct 2025 17:31:09 -0400
Subject: [PATCH 1883/2396] scripts/device-crash-test: fix spurious EOFError
 messages

When the QMP library was updated to match the standalone repository in
094ded52, I neglected to update the logging filter(s) in
device-crash-test, which allowed the spurious messages to leak through.

Update the log filter to re-suppress these messages.

Fixes: 094ded52
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: John Snow <jsnow@redhat.com>
Message-ID: <20251022213109.395149-1-jsnow@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 scripts/device-crash-test | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/device-crash-test b/scripts/device-crash-test
index 1ecb9663ae..c1576e8b96 100755
--- a/scripts/device-crash-test
+++ b/scripts/device-crash-test
@@ -527,7 +527,7 @@ def main():
         # Async QMP, when in use, is chatty about connection failures.
         # This script knowingly generates a ton of connection errors.
         # Silence this logger.
-        logging.getLogger('qemu.qmp.qmp_client').setLevel(logging.CRITICAL)
+        logging.getLogger('qemu.qmp.protocol').setLevel(logging.CRITICAL)
 
     fatal_failures = []
     wl_stats = {}

From 1a6ccf45eb372fd1d687fe47009151d004099985 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 13 Oct 2025 15:38:03 +0200
Subject: [PATCH 1884/2396] tests/functional: Fix problems in asset.py reported
 by pylint

The "raise" without an Exception was a real problem, the other
spots are rather cosmetics.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251015095454.1575318-2-thuth@redhat.com>
---
 tests/functional/qemu_test/asset.py | 24 +++++++++++++-----------
 1 file changed, 13 insertions(+), 11 deletions(-)

diff --git a/tests/functional/qemu_test/asset.py b/tests/functional/qemu_test/asset.py
index ab3a7bb591..bae40765ce 100644
--- a/tests/functional/qemu_test/asset.py
+++ b/tests/functional/qemu_test/asset.py
@@ -112,7 +112,7 @@ class Asset:
                 return False
 
         self.log.debug("Time out while waiting for %s!", tmp_cache_file)
-        raise
+        raise TimeoutError(f"Time out while waiting for {tmp_cache_file}")
 
     def _save_time_stamp(self):
         '''
@@ -141,7 +141,7 @@ class Asset:
         self.log.info("Downloading %s to %s...", self.url, self.cache_file)
         tmp_cache_file = self.cache_file.with_suffix(".download")
 
-        for retries in range(3):
+        for _retries in range(3):
             try:
                 with tmp_cache_file.open("xb") as dst:
                     with urllib.request.urlopen(self.url) as resp:
@@ -181,7 +181,7 @@ class Asset:
                 # server or networking problem
                 if e.code == 404:
                     raise AssetError(self, "Unable to download: "
-                                     "HTTP error %d" % e.code)
+                                     "HTTP error %d" % e.code) from e
                 continue
             except URLError as e:
                 # This is typically a network/service level error
@@ -190,7 +190,7 @@ class Asset:
                 self.log.error("Unable to download %s: URL error %s",
                                self.url, e.reason)
                 raise AssetError(self, "Unable to download: URL error %s" %
-                                 e.reason, transient=True)
+                                 e.reason, transient=True) from e
             except ConnectionError as e:
                 # A socket connection failure, such as dropped conn
                 # or refused conn
@@ -201,7 +201,7 @@ class Asset:
             except Exception as e:
                 tmp_cache_file.unlink()
                 raise AssetError(self, "Unable to download: %s" % e,
-                                 transient=True)
+                                 transient=True) from e
 
         if not os.path.exists(tmp_cache_file):
             raise AssetError(self, "Download retries exceeded", transient=True)
@@ -214,7 +214,6 @@ class Asset:
                         self.hash.encode('utf8'))
         except Exception as e:
             self.log.debug("Unable to set xattr on %s: %s", tmp_cache_file, e)
-            pass
 
         if not self._check(tmp_cache_file):
             tmp_cache_file.unlink()
@@ -224,9 +223,10 @@ class Asset:
         # Remove write perms to stop tests accidentally modifying them
         os.chmod(self.cache_file, stat.S_IRUSR | stat.S_IRGRP)
 
-        self.log.info("Cached %s at %s" % (self.url, self.cache_file))
+        self.log.info("Cached %s at %s", self.url, self.cache_file)
         return str(self.cache_file)
 
+    @staticmethod
     def precache_test(test):
         log = logging.getLogger('qemu-test')
         log.setLevel(logging.DEBUG)
@@ -237,16 +237,17 @@ class Asset:
         handler.setFormatter(formatter)
         log.addHandler(handler)
         for name, asset in vars(test.__class__).items():
-            if name.startswith("ASSET_") and type(asset) == Asset:
+            if name.startswith("ASSET_") and isinstance(asset, Asset):
                 try:
                     asset.fetch()
                 except AssetError as e:
                     if not e.transient:
                         raise
-                    log.error("%s: skipping asset precache" % e)
+                    log.error("%s: skipping asset precache", e)
 
         log.removeHandler(handler)
 
+    @staticmethod
     def precache_suite(suite):
         for test in suite:
             if isinstance(test, unittest.TestSuite):
@@ -254,9 +255,10 @@ class Asset:
             elif isinstance(test, unittest.TestCase):
                 Asset.precache_test(test)
 
-    def precache_suites(path, cacheTstamp):
+    @staticmethod
+    def precache_suites(path, cache_tstamp):
         loader = unittest.loader.defaultTestLoader
         tests = loader.loadTestsFromNames([path], None)
 
-        with open(cacheTstamp, "w") as fh:
+        with open(cache_tstamp, "w", encoding='utf-8'):
             Asset.precache_suite(tests)

From 9641b013573eed1830d8998953b4c4d984913b13 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Oct 2025 11:54:50 +0200
Subject: [PATCH 1885/2396] tests/functional: Fix problems in decorators.py
 reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The documentation strings should follow the function definition
lines, not precede them.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251015095454.1575318-3-thuth@redhat.com>
---
 tests/functional/qemu_test/decorators.py | 184 +++++++++++------------
 1 file changed, 91 insertions(+), 93 deletions(-)

diff --git a/tests/functional/qemu_test/decorators.py b/tests/functional/qemu_test/decorators.py
index b239295804..807418359a 100644
--- a/tests/functional/qemu_test/decorators.py
+++ b/tests/functional/qemu_test/decorators.py
@@ -10,136 +10,134 @@ from unittest import skipIf, skipUnless
 
 from .cmd import which
 
-'''
-Decorator to skip execution of a test if the provided
-environment variables are not set.
-Example:
 
-  @skipIfMissingEnv("QEMU_ENV_VAR0", "QEMU_ENV_VAR1")
-'''
 def skipIfMissingEnv(*vars_):
+    '''
+    Decorator to skip execution of a test if the provided
+    environment variables are not set.
+    Example:
+
+      @skipIfMissingEnv("QEMU_ENV_VAR0", "QEMU_ENV_VAR1")
+    '''
     missing_vars = []
     for var in vars_:
-        if os.getenv(var) == None:
+        if os.getenv(var) is None:
             missing_vars.append(var)
 
-    has_vars = True if len(missing_vars) == 0 else False
+    has_vars = len(missing_vars) == 0
 
     return skipUnless(has_vars, f"Missing env var(s): {', '.join(missing_vars)}")
 
-'''
-
-Decorator to skip execution of a test if the list
-of command binaries is not available in $PATH.
-Example:
-
-  @skipIfMissingCommands("mkisofs", "losetup")
-'''
 def skipIfMissingCommands(*args):
+    '''
+    Decorator to skip execution of a test if the list
+    of command binaries is not available in $PATH.
+    Example:
+
+      @skipIfMissingCommands("mkisofs", "losetup")
+    '''
     has_cmds = True
     for cmd in args:
-         if not which(cmd):
-             has_cmds = False
-             break
+        if not which(cmd):
+            has_cmds = False
+            break
 
     return skipUnless(has_cmds, 'required command(s) "%s" not installed' %
                                 ", ".join(args))
 
-'''
-Decorator to skip execution of a test if the current
-host operating system does match one of the prohibited
-ones.
-Example
-
-  @skipIfOperatingSystem("Linux", "Darwin")
-'''
 def skipIfOperatingSystem(*args):
+    '''
+    Decorator to skip execution of a test if the current host
+    operating system does match one of the prohibited ones.
+    Example:
+
+      @skipIfOperatingSystem("Linux", "Darwin")
+    '''
     return skipIf(platform.system() in args,
                   'running on an OS (%s) that is not able to run this test' %
                   ", ".join(args))
 
-'''
-Decorator to skip execution of a test if the current
-host machine does not match one of the permitted
-machines.
-Example
-
-  @skipIfNotMachine("x86_64", "aarch64")
-'''
 def skipIfNotMachine(*args):
+    '''
+    Decorator to skip execution of a test if the current
+    host machine does not match one of the permitted machines.
+    Example:
+
+      @skipIfNotMachine("x86_64", "aarch64")
+    '''
     return skipUnless(platform.machine() in args,
                       'not running on one of the required machine(s) "%s"' %
                       ", ".join(args))
 
-'''
-Decorator to skip execution of flaky tests, unless
-the $QEMU_TEST_FLAKY_TESTS environment variable is set.
-A bug URL must be provided that documents the observed
-failure behaviour, so it can be tracked & re-evaluated
-in future.
-
-Historical tests may be providing "None" as the bug_url
-but this should not be done for new test.
-
-Example:
-
-  @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/NNN")
-'''
 def skipFlakyTest(bug_url):
+    '''
+    Decorator to skip execution of flaky tests, unless
+    the $QEMU_TEST_FLAKY_TESTS environment variable is set.
+    A bug URL must be provided that documents the observed
+    failure behaviour, so it can be tracked & re-evaluated
+    in future.
+
+    Historical tests may be providing "None" as the bug_url
+    but this should not be done for new test.
+
+    Example:
+
+      @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/NNN")
+    '''
     if bug_url is None:
         bug_url = "FIXME: reproduce flaky test and file bug report or remove"
     return skipUnless(os.getenv('QEMU_TEST_FLAKY_TESTS'),
                       f'Test is unstable: {bug_url}')
 
-'''
-Decorator to skip execution of tests which are likely
-to execute untrusted commands on the host, or commands
-which process untrusted code, unless the
-$QEMU_TEST_ALLOW_UNTRUSTED_CODE env var is set.
-Example:
-
-  @skipUntrustedTest()
-'''
 def skipUntrustedTest():
+    '''
+    Decorator to skip execution of tests which are likely
+    to execute untrusted commands on the host, or commands
+    which process untrusted code, unless the
+    $QEMU_TEST_ALLOW_UNTRUSTED_CODE env var is set.
+    Example:
+
+      @skipUntrustedTest()
+    '''
     return skipUnless(os.getenv('QEMU_TEST_ALLOW_UNTRUSTED_CODE'),
                       'Test runs untrusted code / processes untrusted data')
 
-'''
-Decorator to skip execution of tests which need large
-data storage (over around 500MB-1GB mark) on the host,
-unless the $QEMU_TEST_ALLOW_LARGE_STORAGE environment
-variable is set
-
-Example:
-
-  @skipBigDataTest()
-'''
 def skipBigDataTest():
+    '''
+    Decorator to skip execution of tests which need large
+    data storage (over around 500MB-1GB mark) on the host,
+    unless the $QEMU_TEST_ALLOW_LARGE_STORAGE environment
+    variable is set
+
+    Example:
+
+      @skipBigDataTest()
+    '''
     return skipUnless(os.getenv('QEMU_TEST_ALLOW_LARGE_STORAGE'),
                       'Test requires large host storage space')
 
-'''
-Decorator to skip execution of tests which have a really long
-runtime (and might e.g. time out if QEMU has been compiled with
-debugging enabled) unless the $QEMU_TEST_ALLOW_SLOW
-environment variable is set
-
-Example:
-
-  @skipSlowTest()
-'''
 def skipSlowTest():
+    '''
+    Decorator to skip execution of tests which have a really long
+    runtime (and might e.g. time out if QEMU has been compiled with
+    debugging enabled) unless the $QEMU_TEST_ALLOW_SLOW
+    environment variable is set
+
+    Example:
+
+      @skipSlowTest()
+    '''
     return skipUnless(os.getenv('QEMU_TEST_ALLOW_SLOW'),
                       'Test has a very long runtime and might time out')
 
-'''
-Decorator to skip execution of a test if the list
-of python imports is not available.
-Example:
-
-  @skipIfMissingImports("numpy", "cv2")
-'''
 def skipIfMissingImports(*args):
+    '''
+    Decorator to skip execution of a test if the list
+    of python imports is not available.
+    Example:
+
+      @skipIfMissingImports("numpy", "cv2")
+    '''
     has_imports = True
     for impname in args:
         try:
@@ -151,15 +149,15 @@ def skipIfMissingImports(*args):
     return skipUnless(has_imports, 'required import(s) "%s" not installed' %
                                    ", ".join(args))
 
-'''
-Decorator to skip execution of a test if the system's
-locked memory limit is below the required threshold.
-Takes required locked memory threshold in kB.
-Example:
-
-  @skipLockedMemoryTest(2_097_152)
-'''
 def skipLockedMemoryTest(locked_memory):
+    '''
+    Decorator to skip execution of a test if the system's
+    locked memory limit is below the required threshold.
+    Takes required locked memory threshold in kB.
+    Example:
+
+      @skipLockedMemoryTest(2_097_152)
+    '''
     # get memlock hard limit in bytes
     _, ulimit_memory = resource.getrlimit(resource.RLIMIT_MEMLOCK)
 

From 72f6657402145f9019380c6d96e3f7f601bbb271 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 13 Oct 2025 16:18:14 +0200
Subject: [PATCH 1886/2396] tests/functional: Fix problems in linuxkernel.py
 reported by pylint

Use proper indentation here.

Message-ID: <20251015095454.1575318-3-thuth@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/linuxkernel.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/tests/functional/qemu_test/linuxkernel.py b/tests/functional/qemu_test/linuxkernel.py
index c4767527da..eb10a81335 100644
--- a/tests/functional/qemu_test/linuxkernel.py
+++ b/tests/functional/qemu_test/linuxkernel.py
@@ -83,12 +83,12 @@ class LinuxKernelTest(QemuSystemTest):
         self.vm.set_console(console_index=console_index)
         self.vm.add_args('-kernel', kernel)
         if initrd:
-                self.vm.add_args('-initrd', initrd)
+            self.vm.add_args('-initrd', initrd)
         if dtb:
-                self.vm.add_args('-dtb', dtb)
+            self.vm.add_args('-dtb', dtb)
         self.vm.launch()
         if wait_for:
-                self.wait_for_console_pattern(wait_for)
+            self.wait_for_console_pattern(wait_for)
 
     def check_http_download(self, filename, hashsum, guestport=8080,
                             pythoncmd='python3 -m http.server'):

From de52392666ac685e537b62d1d38723c568fb6a4d Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Oct 2025 11:54:53 +0200
Subject: [PATCH 1887/2396] tests/functional: Fix problems in uncompress.py
 reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- put the doc strings in the right locations (after the "def" line)
- use isinstance() instead of checking via type()

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251015095454.1575318-6-thuth@redhat.com>
---
 tests/functional/qemu_test/uncompress.py | 44 ++++++++++++------------
 1 file changed, 22 insertions(+), 22 deletions(-)

diff --git a/tests/functional/qemu_test/uncompress.py b/tests/functional/qemu_test/uncompress.py
index b7ef8f759b..5bbdf8fe32 100644
--- a/tests/functional/qemu_test/uncompress.py
+++ b/tests/functional/qemu_test/uncompress.py
@@ -58,20 +58,20 @@ def zstd_uncompress(zstd_path, output_path):
     os.chmod(output_path, stat.S_IRUSR | stat.S_IWUSR)
 
 
-'''
-@params compressed: filename, Asset, or file-like object to uncompress
-@params uncompressed: filename to uncompress into
-@params format: optional compression format (gzip, lzma)
-
-Uncompresses @compressed into @uncompressed
-
-If @format is None, heuristics will be applied to guess the format
-from the filename or Asset URL. @format must be non-None if @uncompressed
-is a file-like object.
-
-Returns the fully qualified path to the uncompessed file
-'''
 def uncompress(compressed, uncompressed, format=None):
+    '''
+    @params compressed: filename, Asset, or file-like object to uncompress
+    @params uncompressed: filename to uncompress into
+    @params format: optional compression format (gzip, lzma)
+
+    Uncompresses @compressed into @uncompressed
+
+    If @format is None, heuristics will be applied to guess the
+    format from the filename or Asset URL. @format must be non-None
+    if @uncompressed is a file-like object.
+
+    Returns the fully qualified path to the uncompessed file
+    '''
     if format is None:
         format = guess_uncompress_format(compressed)
 
@@ -84,19 +84,19 @@ def uncompress(compressed, uncompressed, format=None):
     else:
         raise Exception(f"Unknown compression format {format}")
 
-'''
-@params compressed: filename, Asset, or file-like object to guess
-
-Guess the format of @compressed, raising an exception if
-no format can be determined
-'''
 def guess_uncompress_format(compressed):
-    if type(compressed) == Asset:
+    '''
+    @params compressed: filename, Asset, or file-like object to guess
+
+    Guess the format of @compressed, raising an exception if
+    no format can be determined
+    '''
+    if isinstance(compressed, Asset):
         compressed = urlparse(compressed.url).path
-    elif type(compressed) != str:
+    elif not isinstance(compressed, str):
         raise Exception(f"Unable to guess compression cformat for {compressed}")
 
-    (name, ext) = os.path.splitext(compressed)
+    (_name, ext) = os.path.splitext(compressed)
     if ext == ".xz":
         return "xz"
     elif ext == ".gz":

From 45117fd75e55998528d63cb25e06f3ce05922283 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 15 Oct 2025 11:54:54 +0200
Subject: [PATCH 1888/2396] tests/functional: Fix problems in utils.py reported
 by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- put the doc strings in the right locations (after the "def" line)
- use the right indentation (4 spaces)

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251015095454.1575318-7-thuth@redhat.com>
---
 tests/functional/qemu_test/utils.py | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/tests/functional/qemu_test/utils.py b/tests/functional/qemu_test/utils.py
index e7c8de8165..826c267785 100644
--- a/tests/functional/qemu_test/utils.py
+++ b/tests/functional/qemu_test/utils.py
@@ -17,10 +17,10 @@ def get_usernet_hostfwd_port(vm):
     res = vm.cmd('human-monitor-command', command_line='info usernet')
     return get_info_usernet_hostfwd_port(res)
 
-"""
-Round up to next power of 2
-"""
 def pow2ceil(x):
+    """
+    Round up to next power of 2
+    """
     return 1 if x == 0 else 2**(x - 1).bit_length()
 
 def file_truncate(path, size):
@@ -28,12 +28,12 @@ def file_truncate(path, size):
         with open(path, 'ab+') as fd:
             fd.truncate(size)
 
-"""
-Expand file size to next power of 2
-"""
 def image_pow2ceil_expand(path):
-        size = os.path.getsize(path)
-        size_aligned = pow2ceil(size)
-        if size != size_aligned:
-            with open(path, 'ab+') as fd:
-                fd.truncate(size_aligned)
+    """
+    Expand file size to next power of 2
+    """
+    size = os.path.getsize(path)
+    size_aligned = pow2ceil(size)
+    if size != size_aligned:
+        with open(path, 'ab+') as fd:
+            fd.truncate(size_aligned)

From 356bc343e8ad01ed3db5faad8742717393bfab01 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 24 Oct 2025 14:40:16 +0200
Subject: [PATCH 1889/2396] tests/functional/arm/test_aspeed_ast1030: Remove
 unused import
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This file does not use LinuxKernelTest directly (but AspeedTest),
so we can remove this unnecessary import here.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251024124016.799687-1-thuth@redhat.com>
---
 tests/functional/arm/test_aspeed_ast1030.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast1030.py b/tests/functional/arm/test_aspeed_ast1030.py
index 60e2b0251c..d1822edd8f 100755
--- a/tests/functional/arm/test_aspeed_ast1030.py
+++ b/tests/functional/arm/test_aspeed_ast1030.py
@@ -6,9 +6,8 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import LinuxKernelTest, Asset
 from aspeed import AspeedTest
-from qemu_test import exec_command_and_wait_for_pattern
+from qemu_test import Asset, exec_command_and_wait_for_pattern
 
 
 class AST1030Machine(AspeedTest):

From ee7c35e77f214c39340679ffb335f25527d134d3 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Sat, 25 Oct 2025 19:58:03 +0300
Subject: [PATCH 1890/2396] tests/functional/.../testcase.py: better socketdir
 cleanup

TemporaryDirectory prefer explicit call to .cleanup() (or
use context manager). Otherwise it may produce a warning like:

   /usr/lib/python3.10/tempfile.py:1008: \
     ResourceWarning: Implicitly cleaning up \
     <TemporaryDirectory '/tmp/qemu_func_test_sock_4esmf5ba'>

Currently, the only test using socket_dir() is
tests/functional/x86_64/test_vfio_user_client.py, and it does
print this warning, at least with python 3.10.12. With this commit,
the warning disappears.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251025165809.930670-2-vsementsov@yandex-team.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 2c0abde395..a122acb560 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -233,7 +233,7 @@ class QemuBaseTest(unittest.TestCase):
         if "QEMU_TEST_KEEP_SCRATCH" not in os.environ:
             shutil.rmtree(self.workdir)
         if self.socketdir is not None:
-            shutil.rmtree(self.socketdir.name)
+            self.socketdir.cleanup()
             self.socketdir = None
         self.machinelog.removeHandler(self._log_fh)
         self.log.removeHandler(self._log_fh)

From 0468ddb27fdf782b0fe0ed916cdbb2c3aa653ab5 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Sat, 25 Oct 2025 19:58:04 +0300
Subject: [PATCH 1891/2396] MAINTAINERS: fix functional tests section

Without "S: Maintained", ./scripts/get_maintainer.pl shows "unknown"
role instead of "maintainer" for "M: " entry, it's confusing. I really
hope that functional tests are maintained:)

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251025165809.930670-3-vsementsov@yandex-team.ru>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 1 +
 1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index a6a1d36f52..71c86ee8ce 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4412,6 +4412,7 @@ Functional testing framework
 M: Thomas Huth <thuth@redhat.com>
 R: Philippe Mathieu-Daudé <philmd@linaro.org>
 R: Daniel P. Berrange <berrange@redhat.com>
+S: Maintained
 F: docs/devel/testing/functional.rst
 F: scripts/clean_functional_cache.py
 F: tests/functional/qemu_test/

From 053a106f67ad7553455868a6a4510a8b0ec692c8 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 27 Oct 2025 12:23:47 +0100
Subject: [PATCH 1892/2396] tests/functional/migration: Fix bad indentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

pylint complains about bad indentation in two lines. Use 12 spaces
instead of 11 spaces to get it right.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251027112347.54190-1-thuth@redhat.com>
---
 tests/functional/migration.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/migration.py b/tests/functional/migration.py
index 0739554483..2bfb1f7790 100644
--- a/tests/functional/migration.py
+++ b/tests/functional/migration.py
@@ -30,11 +30,11 @@ class MigrationTest(QemuSystemTest):
 
         end = time.monotonic() + self.timeout
         while time.monotonic() < end and not self.migration_finished(src_vm):
-           time.sleep(0.1)
+            time.sleep(0.1)
 
         end = time.monotonic() + self.timeout
         while time.monotonic() < end and not self.migration_finished(dst_vm):
-           time.sleep(0.1)
+            time.sleep(0.1)
 
         self.assertEqual(src_vm.cmd('query-migrate')['status'], 'completed')
         self.assertEqual(dst_vm.cmd('query-migrate')['status'], 'completed')

From 65530a2f09fd06359538411b67d3660430f85d6c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 29 Oct 2025 09:05:02 +0100
Subject: [PATCH 1893/2396] tests/functional/ppc64/test_mac99: Fix style issues
 reported by pylint

Pylint complained about lines being too long here, and mac99Test not
following the usual CamelCase capitalization.

Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251029080502.52938-1-thuth@redhat.com>
---
 tests/functional/ppc64/test_mac99.py | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tests/functional/ppc64/test_mac99.py b/tests/functional/ppc64/test_mac99.py
index dfd9c01371..a3261a8330 100755
--- a/tests/functional/ppc64/test_mac99.py
+++ b/tests/functional/ppc64/test_mac99.py
@@ -7,14 +7,16 @@
 from qemu_test import LinuxKernelTest, Asset
 from qemu_test import exec_command_and_wait_for_pattern
 
-class mac99Test(LinuxKernelTest):
+class Mac99Test(LinuxKernelTest):
 
     ASSET_BR2_MAC99_LINUX = Asset(
-        'https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/buildroot/qemu_ppc64_mac99-2023.11-8-gdcd9f0f6eb-20240105/vmlinux',
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main'
+         '/buildroot/qemu_ppc64_mac99-2023.11-8-gdcd9f0f6eb-20240105/vmlinux'),
         'd59307437e4365f2cced0bbd1b04949f7397b282ef349b7cafd894d74aadfbff')
 
     ASSET_BR2_MAC99_ROOTFS = Asset(
-        'https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main//buildroot/qemu_ppc64_mac99-2023.11-8-gdcd9f0f6eb-20240105/rootfs.ext2',
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main'
+         '/buildroot/qemu_ppc64_mac99-2023.11-8-gdcd9f0f6eb-20240105/rootfs.ext2'),
         'bbd5fd8af62f580bc4e585f326fe584e22856572633a8333178ea6d4ed4955a4')
 
     def test_ppc64_mac99_buildroot(self):

From 38e272e595ea85a4dd927253784bf8db996fa360 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 29 Oct 2025 09:18:05 +0100
Subject: [PATCH 1894/2396] tests/functional/rx/test_gdbsim: Remove unused
 variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove/comment some unused variables to make pylint happy.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251029081805.63147-1-thuth@redhat.com>
---
 tests/functional/rx/test_gdbsim.py | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/tests/functional/rx/test_gdbsim.py b/tests/functional/rx/test_gdbsim.py
index 49245793e1..d31f9a42d6 100755
--- a/tests/functional/rx/test_gdbsim.py
+++ b/tests/functional/rx/test_gdbsim.py
@@ -17,9 +17,6 @@ from qemu_test import wait_for_console_pattern, skipFlakyTest
 
 class RxGdbSimMachine(QemuSystemTest):
 
-    timeout = 30
-    KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
-
     ASSET_UBOOT = Asset(
         ('https://github.com/philmd/qemu-testing-blob/raw/rx-gdbsim/rx/gdbsim/'
          'u-boot.bin'),
@@ -47,7 +44,7 @@ class RxGdbSimMachine(QemuSystemTest):
         self.vm.launch()
         uboot_version = 'U-Boot 2016.05-rc3-23705-ga1ef3c71cb-dirty'
         wait_for_console_pattern(self, uboot_version)
-        gcc_version = 'rx-unknown-linux-gcc (GCC) 9.0.0 20181105 (experimental)'
+        #gcc_version = 'rx-unknown-linux-gcc (GCC) 9.0.0 20181105 (experimental)'
         # FIXME limit baudrate on chardev, else we type too fast
         #  https://gitlab.com/qemu-project/qemu/-/issues/2691
         #exec_command_and_wait_for_pattern(self, 'version', gcc_version)
@@ -63,7 +60,6 @@ class RxGdbSimMachine(QemuSystemTest):
         kernel_path = self.ASSET_KERNEL.fetch()
 
         self.vm.set_console()
-        kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'earlycon'
         self.vm.add_args('-kernel', kernel_path,
                          '-dtb', dtb_path,
                          '-no-reboot')

From 5684fb080528abbcb10a2e1c9aaceea13af5cecc Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 29 Oct 2025 09:15:14 +0100
Subject: [PATCH 1895/2396] tests/functional/x86_64/test_acpi_bits: Silence
 warnings reported by pylint

Pylint complains about too many positional arguments for the __init__
function of the QEMUBitsMachine class, use a "*" to enforce argument
passing by names instead (which the calling sites are doing here already).

Second, use lazy logging when calling self.log.info() with a "%s" format
string, and drop a superfluous "else:" that is not necessary after a
"raise" statement.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251029081514.60802-1-thuth@redhat.com>
---
 tests/functional/x86_64/test_acpi_bits.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/x86_64/test_acpi_bits.py b/tests/functional/x86_64/test_acpi_bits.py
index 9a2816533d..ec716d643b 100755
--- a/tests/functional/x86_64/test_acpi_bits.py
+++ b/tests/functional/x86_64/test_acpi_bits.py
@@ -57,6 +57,7 @@ class QEMUBitsMachine(QEMUMachine): # pylint: disable=too-few-public-methods
     """
     def __init__(self,
                  binary: str,
+                 *,
                  args: Sequence[str] = (),
                  wrapper: Sequence[str] = (),
                  name: Optional[str] = None,
@@ -225,7 +226,7 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
                                       stdout=subprocess.PIPE,
                                       stderr=subprocess.STDOUT,
                                       check=True)
-                self.log.info("grub-mkrescue output %s" % proc.stdout)
+                self.log.info("grub-mkrescue output %s", proc.stdout)
             else:
                 subprocess.check_call([mkrescue_script, '-o',
                                       iso_file, bits_dir],
@@ -287,9 +288,8 @@ class AcpiBitsTest(QemuSystemTest): #pylint: disable=too-many-instance-attribute
             except AssertionError as e:
                 self._print_log(log)
                 raise e
-            else:
-                if os.getenv('V') or os.getenv('BITS_DEBUG'):
-                    self._print_log(log)
+            if os.getenv('V') or os.getenv('BITS_DEBUG'):
+                self._print_log(log)
 
     def tearDown(self):
         """

From 8e833cbf119f88ca194ed2298758faa9edafc931 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 29 Oct 2025 08:53:42 +0100
Subject: [PATCH 1896/2396] tests/functional/x86_64/test_virtio_balloon: Fix
 cosmetic issues from pylint

Pylint complains about some style issues in this file: Unused variables
should be marked with an underscore, "when > then and when < now"
can be simplified to "now > when > then" and expectData doesn't conform
to the usual snake_case naming style.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251029075342.47335-1-thuth@redhat.com>
---
 tests/functional/x86_64/test_virtio_balloon.py | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/functional/x86_64/test_virtio_balloon.py b/tests/functional/x86_64/test_virtio_balloon.py
index 5877b6c408..7a579e0d69 100755
--- a/tests/functional/x86_64/test_virtio_balloon.py
+++ b/tests/functional/x86_64/test_virtio_balloon.py
@@ -66,7 +66,7 @@ class VirtioBalloonx86(QemuSystemTest):
         when = ret.get('last-update')
         assert when == 0
         stats = ret.get('stats')
-        for name, val in stats.items():
+        for _name, val in stats.items():
             assert val == UNSET_STATS_VALUE
 
     def assert_running_stats(self, then):
@@ -87,10 +87,10 @@ class VirtioBalloonx86(QemuSystemTest):
 
         now = time.time()
 
-        assert when > then and when < now
+        assert now > when > then
         stats = ret.get('stats')
         # Stat we expect this particular Kernel to have set
-        expectData = [
+        expect_data = [
             "stat-available-memory",
             "stat-disk-caches",
             "stat-free-memory",
@@ -103,7 +103,7 @@ class VirtioBalloonx86(QemuSystemTest):
             "stat-total-memory",
         ]
         for name, val in stats.items():
-            if name in expectData:
+            if name in expect_data:
                 assert val != UNSET_STATS_VALUE
             else:
                 assert val == UNSET_STATS_VALUE

From ec5a5f8b6d24adc94aa44afbfcb3063192424c54 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 29 Oct 2025 15:19:46 +0100
Subject: [PATCH 1897/2396] tests/functional/ppc64: Fix class names to silence
 pylint warnings

Pylint complains about inconsistent CamelCase names here, so let's
slightly change the names to make pylint happy again.

In the sam460ex test, also split a line where pylint was complaining
about it being too long.

Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251029141946.86110-1-thuth@redhat.com>
---
 tests/functional/ppc/test_74xx.py            | 2 +-
 tests/functional/ppc/test_sam460ex.py        | 5 +++--
 tests/functional/ppc64/test_powernv.py       | 2 +-
 tests/functional/ppc64/test_pseries.py       | 2 +-
 tests/functional/ppc64/test_reverse_debug.py | 2 +-
 5 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/functional/ppc/test_74xx.py b/tests/functional/ppc/test_74xx.py
index 5386016f26..219c7991ac 100755
--- a/tests/functional/ppc/test_74xx.py
+++ b/tests/functional/ppc/test_74xx.py
@@ -10,7 +10,7 @@
 from qemu_test import QemuSystemTest
 from qemu_test import wait_for_console_pattern
 
-class ppc74xxCpu(QemuSystemTest):
+class Ppc74xxCpu(QemuSystemTest):
 
     timeout = 5
 
diff --git a/tests/functional/ppc/test_sam460ex.py b/tests/functional/ppc/test_sam460ex.py
index 31cf9dd6de..024406d155 100755
--- a/tests/functional/ppc/test_sam460ex.py
+++ b/tests/functional/ppc/test_sam460ex.py
@@ -8,10 +8,11 @@ from qemu_test import LinuxKernelTest, Asset
 from qemu_test import exec_command_and_wait_for_pattern
 
 
-class sam460exTest(LinuxKernelTest):
+class Sam460exTest(LinuxKernelTest):
 
     ASSET_BR2_SAM460EX_LINUX = Asset(
-        'https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main/buildroot/qemu_ppc_sam460ex-2023.11-8-gdcd9f0f6eb-20240105/vmlinux',
+        ('https://github.com/legoater/qemu-ppc-boot/raw/refs/heads/main'
+         '/buildroot/qemu_ppc_sam460ex-2023.11-8-gdcd9f0f6eb-20240105/vmlinux'),
         '6f46346f3e20e8b5fc050ff363f350f8b9d76a051b9e0bd7ea470cc680c14df2')
 
     def test_ppc_sam460ex_buildroot(self):
diff --git a/tests/functional/ppc64/test_powernv.py b/tests/functional/ppc64/test_powernv.py
index 9ada832b78..0ea6c93e42 100755
--- a/tests/functional/ppc64/test_powernv.py
+++ b/tests/functional/ppc64/test_powernv.py
@@ -10,7 +10,7 @@
 from qemu_test import LinuxKernelTest, Asset
 from qemu_test import wait_for_console_pattern
 
-class powernvMachine(LinuxKernelTest):
+class PowernvMachine(LinuxKernelTest):
 
     timeout = 90
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 console=hvc0 '
diff --git a/tests/functional/ppc64/test_pseries.py b/tests/functional/ppc64/test_pseries.py
index 67057934e8..7840c4e3ff 100755
--- a/tests/functional/ppc64/test_pseries.py
+++ b/tests/functional/ppc64/test_pseries.py
@@ -10,7 +10,7 @@
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import wait_for_console_pattern
 
-class pseriesMachine(QemuSystemTest):
+class PseriesMachine(QemuSystemTest):
 
     timeout = 90
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 console=hvc0 '
diff --git a/tests/functional/ppc64/test_reverse_debug.py b/tests/functional/ppc64/test_reverse_debug.py
index 69551fb84d..4eef779936 100755
--- a/tests/functional/ppc64/test_reverse_debug.py
+++ b/tests/functional/ppc64/test_reverse_debug.py
@@ -18,7 +18,7 @@ from qemu_test import skipFlakyTest
 from reverse_debugging import ReverseDebugging
 
 
-class ReverseDebugging_ppc64(ReverseDebugging):
+class ReverseDebuggingPpc64(ReverseDebugging):
 
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/1992")
     def test_ppc64_pseries(self):

From 693bfeb8b2637782a2a5e3cab240765d9e5eced7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 28 Oct 2025 18:26:50 +0000
Subject: [PATCH 1898/2396] tests/functional: include logger name and function
 in messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As we collect debug logs from a wide range of code it becomes
increasingly confusing to understand where each log messages comes
from. Adding "%(name)s" gives us the logger name, which is usually
based on the python __name__ symbol, aka the code module name.
Then "%(funcName)s" completes the story by identifying the function.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251028182651.873256-2-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index a122acb560..d9d114e63e 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -217,7 +217,7 @@ class QemuBaseTest(unittest.TestCase):
         self._log_fh = logging.FileHandler(self.log_filename, mode='w')
         self._log_fh.setLevel(logging.DEBUG)
         fileFormatter = logging.Formatter(
-            '%(asctime)s - %(levelname)s: %(message)s')
+            '%(asctime)s - %(levelname)s: %(name)s.%(funcName)s %(message)s')
         self._log_fh.setFormatter(fileFormatter)
         self.log.addHandler(self._log_fh)
 

From 0271d73b85d66b6b2990b00e0b55a058d5636e8d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Tue, 28 Oct 2025 18:26:51 +0000
Subject: [PATCH 1899/2396] tests/functional: include the lower level QMP log
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We've seen a GitLab CI timeout failure in the test_pseries.py test,
where it appears likely that the test has hung in a self.qmp('quit')
call, but we don't have conclusive proof. Adding the QMP log category
to what we capture should help us diagnose this, at the cost of the
base.log file becoming significantly more verbose. The previous
commit to include the logger category name and function should at
least help understanding the more verbose logs.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251028182651.873256-3-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index d9d114e63e..1d773dd697 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -225,6 +225,9 @@ class QemuBaseTest(unittest.TestCase):
         self.machinelog = logging.getLogger('qemu.machine')
         self.machinelog.setLevel(logging.DEBUG)
         self.machinelog.addHandler(self._log_fh)
+        self.qmplog = logging.getLogger('qemu.qmp')
+        self.qmplog.setLevel(logging.DEBUG)
+        self.qmplog.addHandler(self._log_fh)
 
         if not self.assets_available():
             self.skipTest('One or more assets is not available')
@@ -235,6 +238,7 @@ class QemuBaseTest(unittest.TestCase):
         if self.socketdir is not None:
             self.socketdir.cleanup()
             self.socketdir = None
+        self.qmplog.removeHandler(self._log_fh)
         self.machinelog.removeHandler(self._log_fh)
         self.log.removeHandler(self._log_fh)
         self._log_fh.close()

From 0281105bc4c3bff5764b1caa18ee95c14798bccb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 28 Oct 2025 19:12:43 +0100
Subject: [PATCH 1900/2396] hw/s390x: Use memory_region_size()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MemoryRegion::size is private data of MemoryRegion,
use the proper memory_region_size() getter to get it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251028181300.41475-10-philmd@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 hw/s390x/s390-pci-inst.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/s390x/s390-pci-inst.c b/hw/s390x/s390-pci-inst.c
index a3bb5aa221..5841dfc4fe 100644
--- a/hw/s390x/s390-pci-inst.c
+++ b/hw/s390x/s390-pci-inst.c
@@ -396,7 +396,7 @@ static MemoryRegion *s390_get_subregion(MemoryRegion *mr, uint64_t offset,
     uint64_t subregion_size;
 
     QTAILQ_FOREACH(subregion, &mr->subregions, subregions_link) {
-        subregion_size = int128_get64(subregion->size);
+        subregion_size = memory_region_size(subregion);
         if ((offset >= subregion->addr) &&
             (offset + len) <= (subregion->addr + subregion_size)) {
             mr = subregion;

From df7e9243d540ee130f044f975af8de33c45f5299 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Thu, 16 Oct 2025 19:58:30 +0200
Subject: [PATCH 1901/2396] target/s390x: Fix missing interrupts for small CKC
 values

Suppose TOD clock value is 0x1111111111111111 and clock-comparator
value is 0, in which case clock-comparator interruption should occur
immediately.

With the current code, tod2time(env->ckc - td->base.low) ends up being
a very large number, so this interruption never happens.

Fix by firing the timer immediately if env->ckc < td->base.low.

Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20251016175954.41153-2-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/misc_helper.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/s390x/tcg/misc_helper.c b/target/s390x/tcg/misc_helper.c
index 6d9d601d29..215b5b9d93 100644
--- a/target/s390x/tcg/misc_helper.c
+++ b/target/s390x/tcg/misc_helper.c
@@ -199,11 +199,15 @@ static void update_ckc_timer(CPUS390XState *env)
         return;
     }
 
-    /* difference between origins */
-    time = env->ckc - td->base.low;
+    if (env->ckc < td->base.low) {
+        time = 0;
+    } else {
+        /* difference between origins */
+        time = env->ckc - td->base.low;
 
-    /* nanoseconds */
-    time = tod2time(time);
+        /* nanoseconds */
+        time = tod2time(time);
+    }
 
     timer_mod(env->tod_timer, time);
 }

From dacfec5157fb9e2249cf393a143bd545e80a6e31 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Thu, 16 Oct 2025 19:58:31 +0200
Subject: [PATCH 1902/2396] target/s390x: Fix missing clock-comparator
 interrupts after reset

After reset, CKC value is set to 0, so if clock-comparator interrupts
are enabled, one should occur very shortly thereafter.

Currently the code that loads the respective control register does not
set tod_timer, so this does not happen.

Fix by adding a tcg_s390_tod_updated() call to LCTL and LCTLG.

Cc: qemu-stable@nongnu.org
Suggested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20251016175954.41153-3-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/mem_helper.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/s390x/tcg/mem_helper.c b/target/s390x/tcg/mem_helper.c
index f1acb1618f..24675fc818 100644
--- a/target/s390x/tcg/mem_helper.c
+++ b/target/s390x/tcg/mem_helper.c
@@ -1959,6 +1959,10 @@ void HELPER(lctlg)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
         if (env->cregs[i] != val && i >= 9 && i <= 11) {
             PERchanged = true;
         }
+        if (i == 0 && !(env->cregs[i] & CR0_CKC_SC) && (val & CR0_CKC_SC)) {
+            BQL_LOCK_GUARD();
+            tcg_s390_tod_updated(env_cpu(env), RUN_ON_CPU_NULL);
+        }
         env->cregs[i] = val;
         HELPER_LOG("load ctl %d from 0x%" PRIx64 " == 0x%" PRIx64 "\n",
                    i, src, val);
@@ -1989,10 +1993,15 @@ void HELPER(lctl)(CPUS390XState *env, uint32_t r1, uint64_t a2, uint32_t r3)
 
     for (i = r1;; i = (i + 1) % 16) {
         uint32_t val = cpu_ldl_data_ra(env, src, ra);
+        uint64_t val64 = deposit64(env->cregs[i], 0, 32, val);
         if ((uint32_t)env->cregs[i] != val && i >= 9 && i <= 11) {
             PERchanged = true;
         }
-        env->cregs[i] = deposit64(env->cregs[i], 0, 32, val);
+        if (i == 0 && !(env->cregs[i] & CR0_CKC_SC) && (val64 & CR0_CKC_SC)) {
+            BQL_LOCK_GUARD();
+            tcg_s390_tod_updated(env_cpu(env), RUN_ON_CPU_NULL);
+        }
+        env->cregs[i] = val64;
         HELPER_LOG("load ctl %d from 0x%" PRIx64 " == 0x%x\n", i, src, val);
         src += sizeof(uint32_t);
 

From fc976a67ded4232cf0b9ae3c11fe051da01e4456 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Thu, 16 Oct 2025 19:58:32 +0200
Subject: [PATCH 1903/2396] target/s390x: Use address generation for register
 branch targets
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Indirect branches to addresses taken from registers go through address
generation, e.g., for BRANCH ON CONDITION Principles of Operation says:

    In the RR format, the contents of general register R2 are used to
    generate the branch address

QEMU uses r2_nz handler for the respective register operands. Currently
it does not zero out extra bits in 24- and 31-bit addressing modes as
required by address generation. The very frequently used
s390x_tr_init_disas_context() function has a workaround for this,
but the code for saving an old PSW during an interrupt does not.

Add the missing masking to r2_nz. Enforce PSW validity by replacing the
workaround with an assertion.

Reported-by: Thomas Weißschuh <linux@weissschuh.net>
Reported-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/lkml/ab3131a2-c42a-47ff-bf03-e9f68ac053c0@t-8ch.de/
Cc: qemu-stable@nongnu.org
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Tested-by: Thomas Weißschuh <linux@weissschuh.net>
Message-ID: <20251016175954.41153-4-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 target/s390x/tcg/translate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/s390x/tcg/translate.c b/target/s390x/tcg/translate.c
index ec9e5a0751..4d2b8c5e2b 100644
--- a/target/s390x/tcg/translate.c
+++ b/target/s390x/tcg/translate.c
@@ -5613,6 +5613,7 @@ static void in2_r2_nz(DisasContext *s, DisasOps *o)
     int r2 = get_field(s, r2);
     if (r2 != 0) {
         o->in2 = load_reg(r2);
+        gen_addi_and_wrap_i64(s, o->in2, o->in2, 0);
     }
 }
 #define SPEC_in2_r2_nz 0
@@ -6379,10 +6380,12 @@ static void s390x_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
 
-    /* 31-bit mode */
-    if (!(dc->base.tb->flags & FLAG_MASK_64)) {
-        dc->base.pc_first &= 0x7fffffff;
-        dc->base.pc_next = dc->base.pc_first;
+    if (dc->base.tb->flags & FLAG_MASK_32) {
+        if (!(dc->base.tb->flags & FLAG_MASK_64)) {
+            assert(!(dc->base.pc_first & ~((1ULL << 31) - 1)));
+        }
+    } else {
+        assert(!(dc->base.pc_first & ~((1ULL << 24) - 1)));
     }
 
     dc->cc_op = CC_OP_DYNAMIC;

From 0408c61e27aca56c2d40aeb6ca0e5c5f8b8c3845 Mon Sep 17 00:00:00 2001
From: Ilya Leoshkevich <iii@linux.ibm.com>
Date: Thu, 16 Oct 2025 19:58:33 +0200
Subject: [PATCH 1904/2396] tests/tcg/s390x: Test SET CLOCK COMPARATOR

Add a small test to prevent regressions.

Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Ilya Leoshkevich <iii@linux.ibm.com>
Message-ID: <20251016175954.41153-5-iii@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/tcg/s390x/Makefile.softmmu-target |  1 +
 tests/tcg/s390x/sckc.S                  | 63 +++++++++++++++++++++++++
 2 files changed, 64 insertions(+)
 create mode 100644 tests/tcg/s390x/sckc.S

diff --git a/tests/tcg/s390x/Makefile.softmmu-target b/tests/tcg/s390x/Makefile.softmmu-target
index 8cd4667c63..a4425d3184 100644
--- a/tests/tcg/s390x/Makefile.softmmu-target
+++ b/tests/tcg/s390x/Makefile.softmmu-target
@@ -28,6 +28,7 @@ ASM_TESTS =                                                                    \
     mc                                                                         \
     per                                                                        \
     precise-smc-softmmu                                                        \
+    sckc                                                                       \
     ssm-early                                                                  \
     stosm-early                                                                \
     stpq                                                                       \
diff --git a/tests/tcg/s390x/sckc.S b/tests/tcg/s390x/sckc.S
new file mode 100644
index 0000000000..ecd64a3059
--- /dev/null
+++ b/tests/tcg/s390x/sckc.S
@@ -0,0 +1,63 @@
+/*
+ * Test clock comparator.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+    .org 0x130
+ext_old_psw:
+    .org 0x1b0
+ext_new_psw:
+    .quad 0x180000000, _ext            /* 64-bit mode */
+    .org 0x1d0
+pgm_new_psw:
+    .quad 0x2000000000000,0            /* disabled wait */
+    .org 0x200                         /* lowcore padding */
+
+    .globl _start
+_start:
+    lpswe start31_psw
+_start31:
+    stctg %c0,%c0,c0
+    oi c0+6,8                          /* set clock-comparator subclass mask */
+    lctlg %c0,%c0,c0
+
+0:
+    brasl %r14,_f                      /* %r14's most significant bit is 1 */
+    jg 0b
+_f:
+    br %r14                            /* it must not end up in ext_old_psw */
+
+_ext:
+    stg %r0,ext_saved_r0
+
+    lg %r0,ext_counter
+    aghi %r0,1
+    stg %r0,ext_counter
+
+    cgfi %r0,0x1000
+    jnz 0f
+    lpswe success_psw
+0:
+
+    stck clock
+    lg %r0,clock
+    agfi %r0,0x40000                   /* 64us * 0x1000 =~ 0.25s */
+    stg %r0,clock
+    sckc clock
+
+    lg %r0,ext_saved_r0
+    lpswe ext_old_psw
+
+    .align 8
+start31_psw:
+    .quad 0x100000080000000,_start31   /* EX, 31-bit mode */
+success_psw:
+    .quad 0x2000000000000,0xfff        /* see is_special_wait_psw() */
+c0:
+    .skip 8
+clock:
+    .quad 0
+ext_counter:
+    .quad 0
+ext_saved_r0:
+    .skip 8

From 886898baad2183fdc304967bda98b2e03c3843f2 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 9 Oct 2025 17:12:46 +0100
Subject: [PATCH 1905/2396] Implement -run-with exit-with-parent=on
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Libguestfs wants to use qemu to run a captive appliance.  When the
program linked to libguestfs exits, we want qemu to be cleaned up.
Libguestfs goes to great lengths to do this at the moment: it either
forks a separate process to ensure clean-up is done, or it asks
libvirt to clean up the qemu process.  However this is complicated and
not totally reliable.

On Linux, FreeBSD and macOS, there are mechanisms to ensure a signal
or message is delivered to a process when its parent process goes
away.  The qemu test suite even uses this mechanism on Linux (see
PR_SET_PDEATHSIG in tests/qtest/libqtest.c).

In nbdkit we have long had the concept of running nbdkit captively,
and we have the nbdkit --exit-with-parent flag to help
(https://libguestfs.org/nbdkit-captive.1.html#EXIT-WITH-PARENT)

This commit adds the same mechanism.  The syntax is:

  qemu -run-with exit-with-parent=on [...]

This is not a feature that most typical users of qemu (for running
general purpose, long-lived VMs) should use, so it defaults to off.

The exit-with-parent.[ch] files are copied from nbdkit, where they
have a 3-clause BSD license which is compatible with qemu:

https://gitlab.com/nbdkit/nbdkit/-/tree/master/common/utils?ref_type=heads

Thanks: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/qemu/exit-with-parent.h |  57 +++++++++++++
 qemu-options.hx                 |  13 ++-
 system/exit-with-parent.c       | 140 ++++++++++++++++++++++++++++++++
 system/meson.build              |   1 +
 system/vl.c                     |  13 +++
 5 files changed, 222 insertions(+), 2 deletions(-)
 create mode 100644 include/qemu/exit-with-parent.h
 create mode 100644 system/exit-with-parent.c

diff --git a/include/qemu/exit-with-parent.h b/include/qemu/exit-with-parent.h
new file mode 100644
index 0000000000..c00b863fe9
--- /dev/null
+++ b/include/qemu/exit-with-parent.h
@@ -0,0 +1,57 @@
+/*
+ * SPDX-License-Identifier: BSD-3-Clause
+ * Originally derived from nbdkit common/utils/exit-with-parent.h
+ * Copyright Red Hat
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * * Neither the name of Red Hat nor the names of its contributors may be
+ * used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#ifndef NBDKIT_EXIT_WITH_PARENT_H
+#define NBDKIT_EXIT_WITH_PARENT_H
+
+/* Test if the feature is available on the platform. */
+static inline bool can_exit_with_parent(void)
+{
+#if defined(__linux__) || defined(__FreeBSD__) || defined(__APPLE__)
+    return true;
+#else
+    return false;
+#endif
+}
+
+/*
+ * --exit-with-parent: kill the current process if the parent exits.
+ * This may return -1 on error.
+ *
+ * Note this will abort on platforms where can_exit_with_parent()
+ * returned false.
+ */
+extern int set_exit_with_parent(void);
+
+#endif /* NBDKIT_EXIT_WITH_PARENT_H */
diff --git a/qemu-options.hx b/qemu-options.hx
index 0223ceffeb..fca2b7bc74 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -5467,15 +5467,18 @@ DEF("qtest-log", HAS_ARG, QEMU_OPTION_qtest_log, "", QEMU_ARCH_ALL)
 
 #if defined(CONFIG_POSIX) && !defined(EMSCRIPTEN)
 DEF("run-with", HAS_ARG, QEMU_OPTION_run_with,
-    "-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]\n"
+    "-run-with [async-teardown=on|off][,chroot=dir]\n" \
+    "          [,exit-with-parent=on|off][,user=username|uid:gid]\n"
     "                Set miscellaneous QEMU process lifecycle options:\n"
     "                async-teardown=on enables asynchronous teardown (Linux only)\n"
+    "                exit-with-parent=on causes QEMU to exit if the parent\n"
+    "                  process of QEMU exits (Linux, FreeBSD, macOS only)\n"
     "                chroot=dir chroot to dir just before starting the VM\n"
     "                user=username switch to the specified user before starting the VM\n"
     "                user=uid:gid ditto, but use specified user-ID and group-ID instead\n",
     QEMU_ARCH_ALL)
 SRST
-``-run-with [async-teardown=on|off][,chroot=dir][user=username|uid:gid]``
+``-run-with [async-teardown=on|off][,chroot=dir][,exit-with-parent=on|off][,user=username|uid:gid]``
     Set QEMU process lifecycle options.
 
     ``async-teardown=on`` enables asynchronous teardown. A new process called
@@ -5493,6 +5496,12 @@ SRST
     immediately before starting the guest execution. This is especially useful
     in combination with ``user=...``.
 
+    ``exit-with-parent=on`` causes QEMU to exit if the parent process of
+    QEMU exits.  This can be used when QEMU runs a captive appliance,
+    where the lifetime of the appliance is scoped to the parent process.
+    In case the parent process crashes, QEMU is still cleaned up.
+    This only works on Linux, FreeBSD and macOS platforms.
+
     ``user=username`` or ``user=uid:gid`` can be used to drop root privileges
     before starting guest execution. QEMU will use the ``setuid`` and ``setgid``
     system calls to switch to the specified identity.  Note that the
diff --git a/system/exit-with-parent.c b/system/exit-with-parent.c
new file mode 100644
index 0000000000..df65d2231a
--- /dev/null
+++ b/system/exit-with-parent.c
@@ -0,0 +1,140 @@
+/*
+ * SPDX-License-Identifier: BSD-3-Clause
+ * Originally derived from nbdkit common/utils/exit-with-parent.c
+ * Copyright Red Hat
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions are
+ * met:
+ *
+ * * Redistributions of source code must retain the above copyright
+ * notice, this list of conditions and the following disclaimer.
+ *
+ * * Redistributions in binary form must reproduce the above copyright
+ * notice, this list of conditions and the following disclaimer in the
+ * documentation and/or other materials provided with the distribution.
+ *
+ * * Neither the name of Red Hat nor the names of its contributors may be
+ * used to endorse or promote products derived from this software without
+ * specific prior written permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY RED HAT AND CONTRIBUTORS ''AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
+ * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
+ * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL RED HAT OR
+ * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+ * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+ * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
+ * USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ * ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+ * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
+ * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+/*
+ * Implement the --exit-with-parent feature on operating systems which
+ * support it.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/exit-with-parent.h"
+
+#if defined(__linux__)
+
+#include <sys/prctl.h>
+
+/*
+ * Send SIGTERM to self when the parent exits.  This will cause
+ * qemu_system_killed() to be called.
+ *
+ * PR_SET_PDEATHSIG has been defined since Linux 2.1.57.
+ */
+int
+set_exit_with_parent(void)
+{
+    return prctl(PR_SET_PDEATHSIG, SIGTERM);
+}
+
+#elif defined(__FreeBSD__)
+
+#include <sys/procctl.h>
+
+/*
+ * Send SIGTERM to self when the parent exits.  This will cause
+ * qemu_system_killed() to be called.
+ *
+ * PROC_PDEATHSIG_CTL has been defined since FreeBSD 11.2.
+ */
+int
+set_exit_with_parent(void)
+{
+    const int sig = SIGTERM;
+    return procctl(P_PID, 0, PROC_PDEATHSIG_CTL, (void *) &sig);
+}
+
+#elif defined(__APPLE__)
+
+/* For macOS. */
+
+#include "qemu/thread.h"
+#include "qemu/error-report.h"
+#include "system/runstate.h"
+#include <sys/event.h>
+
+static void *
+exit_with_parent_loop(void *vp)
+{
+    const pid_t ppid = getppid();
+    int fd;
+    struct kevent kev, res[1];
+    int r;
+
+    /* Register the kevent to wait for ppid to exit. */
+    fd = kqueue();
+    if (fd == -1) {
+        error_report("exit_with_parent_loop: kqueue: %m");
+        return NULL;
+    }
+    EV_SET(&kev, ppid, EVFILT_PROC, EV_ADD | EV_ENABLE, NOTE_EXIT, 0, NULL);
+    if (kevent(fd, &kev, 1, NULL, 0, NULL) == -1) {
+        error_report("exit_with_parent_loop: kevent: %m");
+        close(fd);
+        return NULL;
+    }
+
+    /* Wait for the kevent to happen. */
+    r = kevent(fd, 0, 0, res, 1, NULL);
+    if (r == 1 && res[0].ident == ppid) {
+        /* Behave like Linux and FreeBSD above, as if SIGTERM was sent */
+        qemu_system_killed(SIGTERM, ppid);
+    }
+
+    return NULL;
+}
+
+int
+set_exit_with_parent(void)
+{
+    QemuThread exit_with_parent_thread;
+
+    /*
+     * We have to block waiting for kevent, so that requires that we
+     * start a background thread.
+     */
+    qemu_thread_create(&exit_with_parent_thread,
+                       "exit-parent",
+                       exit_with_parent_loop, NULL,
+                       QEMU_THREAD_DETACHED);
+    return 0;
+}
+
+#else /* any platform that doesn't support this function */
+
+int
+set_exit_with_parent(void)
+{
+    g_assert_not_reached();
+}
+
+#endif
diff --git a/system/meson.build b/system/meson.build
index 6d21ff9faa..4b69ef0f5f 100644
--- a/system/meson.build
+++ b/system/meson.build
@@ -15,6 +15,7 @@ system_ss.add(files(
   'datadir.c',
   'dirtylimit.c',
   'dma-helpers.c',
+  'exit-with-parent.c',
   'globals.c',
   'ioport.c',
   'ram-block-attributes.c',
diff --git a/system/vl.c b/system/vl.c
index 29f5389151..5091fe52d9 100644
--- a/system/vl.c
+++ b/system/vl.c
@@ -53,6 +53,7 @@
 #include "qemu/sockets.h"
 #include "qemu/accel.h"
 #include "qemu/async-teardown.h"
+#include "qemu/exit-with-parent.h"
 #include "hw/usb.h"
 #include "hw/isa/isa.h"
 #include "hw/scsi/scsi.h"
@@ -783,6 +784,10 @@ static QemuOptsList qemu_run_with_opts = {
             .name = "chroot",
             .type = QEMU_OPT_STRING,
         },
+        {
+            .name = "exit-with-parent",
+            .type = QEMU_OPT_BOOL,
+        },
         {
             .name = "user",
             .type = QEMU_OPT_STRING,
@@ -3691,6 +3696,14 @@ void qemu_init(int argc, char **argv)
                 if (str) {
                     os_set_chroot(str);
                 }
+                if (qemu_opt_get_bool(opts, "exit-with-parent", false)) {
+                    if (!can_exit_with_parent()) {
+                        error_report("exit-with-parent is not available"
+                                     " on this platform");
+                        exit(1);
+                    }
+                    set_exit_with_parent();
+                }
                 str = qemu_opt_get(opts, "user");
                 if (str) {
                     if (!os_set_runas(str)) {

From b433ca56e1d02173aa08b04947cdd82045057695 Mon Sep 17 00:00:00 2001
From: "Richard W.M. Jones" <rjones@redhat.com>
Date: Thu, 9 Oct 2025 17:12:47 +0100
Subject: [PATCH 1906/2396] tests/qtest: Use exit-with-parent=on in qtest
 invocations
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Previously libqtest.c set PR_SET_PDEATHSIG (or the equivalent on
FreeBSD) after forking the qemu subprocess.  However we can get the
same behaviour now by using the new -run-with exit-with-parent=on
flag, on platforms that support it.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 tests/qtest/libqtest.c | 22 ++++------------------
 1 file changed, 4 insertions(+), 18 deletions(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index 933d085869..622464e365 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -33,6 +33,7 @@
 #include "qemu/accel.h"
 #include "qemu/ctype.h"
 #include "qemu/cutils.h"
+#include "qemu/exit-with-parent.h"
 #include "qemu/sockets.h"
 #include "qobject/qdict.h"
 #include "qobject/qjson.h"
@@ -433,24 +434,6 @@ static QTestState *qtest_spawn_qemu(const char *qemu_bin, const char *args,
 #ifndef _WIN32
     pid = fork();
     if (pid == 0) {
-#ifdef __linux__
-        /*
-         * Although we register a ABRT handler to kill off QEMU
-         * when g_assert() triggers, we want an extra safety
-         * net. The QEMU process might be non-functional and
-         * thus not have responded to SIGTERM. The test script
-         * might also have crashed with SEGV, in which case the
-         * cleanup handlers won't ever run.
-         *
-         * This PR_SET_PDEATHSIG setup will ensure any remaining
-         * QEMU will get terminated with SIGKILL in these cases.
-         */
-        prctl(PR_SET_PDEATHSIG, SIGKILL, 0, 0, 0);
-#endif /* __linux__ */
-#ifdef __FreeBSD__
-        int sig = SIGKILL;
-        procctl(P_PID, getpid(), PROC_PDEATHSIG_CTL, &sig);
-#endif /* __FreeBSD__ */
         execlp("/bin/sh", "sh", "-c", command->str, NULL);
         exit(1);
     }
@@ -482,12 +465,15 @@ gchar *qtest_qemu_args(const char *extra_args)
                       "-display none "
                       "-audio none "
                       "%s"
+                      "%s"
                       " -accel qtest",
 
                       tracearg,
                       socket_path,
                       getenv("QTEST_LOG") ? DEV_STDERR : DEV_NULL,
                       qmp_socket_path,
+                      can_exit_with_parent() ?
+                      "-run-with exit-with-parent=on " : "",
                       extra_args ?: "");
 
     return args;

From abf6e02dfb2c351f5fbc5f95451527722955fd89 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 31 Oct 2025 10:09:30 +0100
Subject: [PATCH 1907/2396] crypto/hash: Have hashing functions take void *
 buffer argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cryptographic hash function can operate on any area of memory,
regardless of the content their represent. Do not restrict to
array of char, use the void* type, which is also the type of
the underlying iovec::iov_base field.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/hash.c         | 16 ++++++++--------
 crypto/hmac.c         |  8 ++++----
 include/crypto/hash.h |  8 ++++----
 include/crypto/hmac.h |  4 ++--
 4 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/crypto/hash.c b/crypto/hash.c
index 7513769e42..6ffb88bf54 100644
--- a/crypto/hash.c
+++ b/crypto/hash.c
@@ -67,13 +67,13 @@ int qcrypto_hash_bytesv(QCryptoHashAlgo alg,
 
 
 int qcrypto_hash_bytes(QCryptoHashAlgo alg,
-                       const char *buf,
+                       const void *buf,
                        size_t len,
                        uint8_t **result,
                        size_t *resultlen,
                        Error **errp)
 {
-    struct iovec iov = { .iov_base = (char *)buf,
+    struct iovec iov = { .iov_base = (void *)buf,
                          .iov_len = len };
     return qcrypto_hash_bytesv(alg, &iov, 1, result, resultlen, errp);
 }
@@ -89,11 +89,11 @@ int qcrypto_hash_updatev(QCryptoHash *hash,
 }
 
 int qcrypto_hash_update(QCryptoHash *hash,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         Error **errp)
 {
-    struct iovec iov = { .iov_base = (char *)buf, .iov_len = len };
+    struct iovec iov = { .iov_base = (void *)buf, .iov_len = len };
 
     return qcrypto_hash_updatev(hash, &iov, 1, errp);
 }
@@ -206,12 +206,12 @@ int qcrypto_hash_digestv(QCryptoHashAlgo alg,
 }
 
 int qcrypto_hash_digest(QCryptoHashAlgo alg,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **digest,
                         Error **errp)
 {
-    struct iovec iov = { .iov_base = (char *)buf, .iov_len = len };
+    struct iovec iov = { .iov_base = (void *)buf, .iov_len = len };
 
     return qcrypto_hash_digestv(alg, &iov, 1, digest, errp);
 }
@@ -237,12 +237,12 @@ int qcrypto_hash_base64v(QCryptoHashAlgo alg,
 }
 
 int qcrypto_hash_base64(QCryptoHashAlgo alg,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **base64,
                         Error **errp)
 {
-    struct iovec iov = { .iov_base = (char *)buf, .iov_len = len };
+    struct iovec iov = { .iov_base = (void *)buf, .iov_len = len };
 
     return qcrypto_hash_base64v(alg, &iov, 1, base64, errp);
 }
diff --git a/crypto/hmac.c b/crypto/hmac.c
index 422e005182..2f0d044cf2 100644
--- a/crypto/hmac.c
+++ b/crypto/hmac.c
@@ -28,14 +28,14 @@ int qcrypto_hmac_bytesv(QCryptoHmac *hmac,
 }
 
 int qcrypto_hmac_bytes(QCryptoHmac *hmac,
-                       const char *buf,
+                       const void *buf,
                        size_t len,
                        uint8_t **result,
                        size_t *resultlen,
                        Error **errp)
 {
     struct iovec iov = {
-            .iov_base = (char *)buf,
+            .iov_base = (void *)buf,
             .iov_len = len
     };
 
@@ -70,13 +70,13 @@ int qcrypto_hmac_digestv(QCryptoHmac *hmac,
 }
 
 int qcrypto_hmac_digest(QCryptoHmac *hmac,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **digest,
                         Error **errp)
 {
     struct iovec iov = {
-            .iov_base = (char *)buf,
+            .iov_base = (void *)buf,
             .iov_len = len
     };
 
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index 1868d4a0f7..43525098c5 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -122,7 +122,7 @@ int qcrypto_hash_bytesv(QCryptoHashAlgo alg,
  * Returns: 0 on success, -1 on error
  */
 int qcrypto_hash_bytes(QCryptoHashAlgo alg,
-                       const char *buf,
+                       const void *buf,
                        size_t len,
                        uint8_t **result,
                        size_t *resultlen,
@@ -180,7 +180,7 @@ int qcrypto_hash_updatev(QCryptoHash *hash,
  * Returns: 0 on success, -1 on error
  */
 int qcrypto_hash_update(QCryptoHash *hash,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         Error **errp);
 
@@ -289,7 +289,7 @@ G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoHash, qcrypto_hash_free)
  * Returns: 0 on success, -1 on error
  */
 int qcrypto_hash_digest(QCryptoHashAlgo alg,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **digest,
                         Error **errp);
@@ -335,7 +335,7 @@ int qcrypto_hash_base64v(QCryptoHashAlgo alg,
  * Returns: 0 on success, -1 on error
  */
 int qcrypto_hash_base64(QCryptoHashAlgo alg,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **base64,
                         Error **errp);
diff --git a/include/crypto/hmac.h b/include/crypto/hmac.h
index af3d5f8feb..0885ae22d1 100644
--- a/include/crypto/hmac.h
+++ b/include/crypto/hmac.h
@@ -139,7 +139,7 @@ int qcrypto_hmac_bytesv(QCryptoHmac *hmac,
  *  0 on success, -1 on error
  */
 int qcrypto_hmac_bytes(QCryptoHmac *hmac,
-                       const char *buf,
+                       const void *buf,
                        size_t len,
                        uint8_t **result,
                        size_t *resultlen,
@@ -187,7 +187,7 @@ int qcrypto_hmac_digestv(QCryptoHmac *hmac,
  * Returns: 0 on success, -1 on error
  */
 int qcrypto_hmac_digest(QCryptoHmac *hmac,
-                        const char *buf,
+                        const void *buf,
                         size_t len,
                         char **digest,
                         Error **errp);

From 989221c0c7a7ce8809d7e10276facd7b221c853f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 31 Oct 2025 10:13:51 +0100
Subject: [PATCH 1908/2396] io/channel: Have read/write functions take void *
 buffer argument
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I/O channel read/write functions can operate on any area of
memory, regardless of the content their represent. Do not
restrict to array of char, use the void* type, which is also
the type of the underlying iovec::iov_base field.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[DB: also adapt test-crypto-tlssession.c func signatures]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/crypto/tlssession.h         |  4 ++--
 include/io/channel.h                | 14 +++++++-------
 io/channel-tls.c                    |  4 ++--
 io/channel.c                        | 14 +++++++-------
 tests/unit/test-crypto-tlssession.c |  4 ++--
 5 files changed, 20 insertions(+), 20 deletions(-)

diff --git a/include/crypto/tlssession.h b/include/crypto/tlssession.h
index 2e9fe11cf6..28e419681e 100644
--- a/include/crypto/tlssession.h
+++ b/include/crypto/tlssession.h
@@ -199,11 +199,11 @@ int qcrypto_tls_session_check_credentials(QCryptoTLSSession *sess,
  * These must return QCRYPTO_TLS_SESSION_ERR_BLOCK if the I/O
  * would block, but on other errors, must fill 'errp'
  */
-typedef ssize_t (*QCryptoTLSSessionWriteFunc)(const char *buf,
+typedef ssize_t (*QCryptoTLSSessionWriteFunc)(const void *buf,
                                               size_t len,
                                               void *opaque,
                                               Error **errp);
-typedef ssize_t (*QCryptoTLSSessionReadFunc)(char *buf,
+typedef ssize_t (*QCryptoTLSSessionReadFunc)(void *buf,
                                              size_t len,
                                              void *opaque,
                                              Error **errp);
diff --git a/include/io/channel.h b/include/io/channel.h
index 0f25ae0069..db893a3628 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -437,7 +437,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
  * a single memory region.
  */
 ssize_t qio_channel_read(QIOChannel *ioc,
-                         char *buf,
+                         void *buf,
                          size_t buflen,
                          Error **errp);
 
@@ -453,7 +453,7 @@ ssize_t qio_channel_read(QIOChannel *ioc,
  * single memory region.
  */
 ssize_t qio_channel_write(QIOChannel *ioc,
-                          const char *buf,
+                          const void *buf,
                           size_t buflen,
                           Error **errp);
 
@@ -475,7 +475,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
  *          without data, or -1 on error
  */
 int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
-                                                char *buf,
+                                                void *buf,
                                                 size_t buflen,
                                                 Error **errp);
 
@@ -495,7 +495,7 @@ int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
  * Returns: 0 if all bytes were read, or -1 on error
  */
 int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
-                                            char *buf,
+                                            void *buf,
                                             size_t buflen,
                                             Error **errp);
 
@@ -514,7 +514,7 @@ int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
  * Returns: 0 if all bytes were written, or -1 on error
  */
 int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
-                                             const char *buf,
+                                             const void *buf,
                                              size_t buflen,
                                              Error **errp);
 
@@ -595,7 +595,7 @@ ssize_t qio_channel_pwritev(QIOChannel *ioc, const struct iovec *iov,
  * flag QIO_CHANNEL_FEATURE_SEEKABLE prior to calling this method.
  *
  */
-ssize_t qio_channel_pwrite(QIOChannel *ioc, char *buf, size_t buflen,
+ssize_t qio_channel_pwrite(QIOChannel *ioc, void *buf, size_t buflen,
                            off_t offset, Error **errp);
 
 /**
@@ -631,7 +631,7 @@ ssize_t qio_channel_preadv(QIOChannel *ioc, const struct iovec *iov,
  * flag QIO_CHANNEL_FEATURE_SEEKABLE prior to calling this method.
  *
  */
-ssize_t qio_channel_pread(QIOChannel *ioc, char *buf, size_t buflen,
+ssize_t qio_channel_pread(QIOChannel *ioc, void *buf, size_t buflen,
                           off_t offset, Error **errp);
 
 /**
diff --git a/io/channel-tls.c b/io/channel-tls.c
index ce041795c1..b0cec27cb9 100644
--- a/io/channel-tls.c
+++ b/io/channel-tls.c
@@ -26,7 +26,7 @@
 #include "qemu/atomic.h"
 
 
-static ssize_t qio_channel_tls_write_handler(const char *buf,
+static ssize_t qio_channel_tls_write_handler(const void *buf,
                                              size_t len,
                                              void *opaque,
                                              Error **errp)
@@ -43,7 +43,7 @@ static ssize_t qio_channel_tls_write_handler(const char *buf,
     return ret;
 }
 
-static ssize_t qio_channel_tls_read_handler(char *buf,
+static ssize_t qio_channel_tls_read_handler(void *buf,
                                             size_t len,
                                             void *opaque,
                                             Error **errp)
diff --git a/io/channel.c b/io/channel.c
index 852e684938..8e8bd2efa8 100644
--- a/io/channel.c
+++ b/io/channel.c
@@ -310,7 +310,7 @@ ssize_t qio_channel_writev(QIOChannel *ioc,
 
 
 ssize_t qio_channel_read(QIOChannel *ioc,
-                         char *buf,
+                         void *buf,
                          size_t buflen,
                          Error **errp)
 {
@@ -320,7 +320,7 @@ ssize_t qio_channel_read(QIOChannel *ioc,
 
 
 ssize_t qio_channel_write(QIOChannel *ioc,
-                          const char *buf,
+                          const void *buf,
                           size_t buflen,
                           Error **errp)
 {
@@ -330,7 +330,7 @@ ssize_t qio_channel_write(QIOChannel *ioc,
 
 
 int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
-                                                char *buf,
+                                                void *buf,
                                                 size_t buflen,
                                                 Error **errp)
 {
@@ -340,7 +340,7 @@ int coroutine_mixed_fn qio_channel_read_all_eof(QIOChannel *ioc,
 
 
 int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
-                                            char *buf,
+                                            void *buf,
                                             size_t buflen,
                                             Error **errp)
 {
@@ -350,7 +350,7 @@ int coroutine_mixed_fn qio_channel_read_all(QIOChannel *ioc,
 
 
 int coroutine_mixed_fn qio_channel_write_all(QIOChannel *ioc,
-                                             const char *buf,
+                                             const void *buf,
                                              size_t buflen,
                                              Error **errp)
 {
@@ -475,7 +475,7 @@ ssize_t qio_channel_pwritev(QIOChannel *ioc, const struct iovec *iov,
     return klass->io_pwritev(ioc, iov, niov, offset, errp);
 }
 
-ssize_t qio_channel_pwrite(QIOChannel *ioc, char *buf, size_t buflen,
+ssize_t qio_channel_pwrite(QIOChannel *ioc, void *buf, size_t buflen,
                            off_t offset, Error **errp)
 {
     struct iovec iov = {
@@ -504,7 +504,7 @@ ssize_t qio_channel_preadv(QIOChannel *ioc, const struct iovec *iov,
     return klass->io_preadv(ioc, iov, niov, offset, errp);
 }
 
-ssize_t qio_channel_pread(QIOChannel *ioc, char *buf, size_t buflen,
+ssize_t qio_channel_pread(QIOChannel *ioc, void *buf, size_t buflen,
                           off_t offset, Error **errp)
 {
     struct iovec iov = {
diff --git a/tests/unit/test-crypto-tlssession.c b/tests/unit/test-crypto-tlssession.c
index d0baf3b304..0d06a6892e 100644
--- a/tests/unit/test-crypto-tlssession.c
+++ b/tests/unit/test-crypto-tlssession.c
@@ -36,7 +36,7 @@
 #define KEYFILE WORKDIR "key-ctx.pem"
 
 static ssize_t
-testWrite(const char *buf, size_t len, void *opaque, Error **errp)
+testWrite(const void *buf, size_t len, void *opaque, Error **errp)
 {
     int *fd = opaque;
     int ret;
@@ -54,7 +54,7 @@ testWrite(const char *buf, size_t len, void *opaque, Error **errp)
 }
 
 static ssize_t
-testRead(char *buf, size_t len, void *opaque, Error **errp)
+testRead(void *buf, size_t len, void *opaque, Error **errp)
 {
     int *fd = opaque;
     int ret;

From e52d8227162ba1fa53011f19e99b2f57705bc567 Mon Sep 17 00:00:00 2001
From: Tejus GK <tejus.gk@nutanix.com>
Date: Fri, 24 Oct 2025 13:15:42 +0000
Subject: [PATCH 1909/2396] io: add a "blocking" field to QIOChannelSocket
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add a 'blocking' boolean field to QIOChannelSocket to track whether the
underlying socket is in blocking or non-blocking mode.

Signed-off-by: Tejus GK <tejus.gk@nutanix.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel-socket.h | 1 +
 io/channel-socket.c         | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
index a88cf8b3a9..26319fa98b 100644
--- a/include/io/channel-socket.h
+++ b/include/io/channel-socket.h
@@ -49,6 +49,7 @@ struct QIOChannelSocket {
     socklen_t remoteAddrLen;
     ssize_t zero_copy_queued;
     ssize_t zero_copy_sent;
+    bool blocking;
 };
 
 
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 712b793eaf..8b30d5b7f7 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -65,6 +65,7 @@ qio_channel_socket_new(void)
     sioc->fd = -1;
     sioc->zero_copy_queued = 0;
     sioc->zero_copy_sent = 0;
+    sioc->blocking = false;
 
     ioc = QIO_CHANNEL(sioc);
     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
@@ -859,6 +860,7 @@ qio_channel_socket_set_blocking(QIOChannel *ioc,
                                 Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+    sioc->blocking = enabled;
 
     if (!qemu_set_blocking(sioc->fd, enabled, errp)) {
         return -1;

From 84005f4a2b8745e5934f955c045a0b4311cd0992 Mon Sep 17 00:00:00 2001
From: Manish Mishra <manish.mishra@nutanix.com>
Date: Fri, 24 Oct 2025 13:15:43 +0000
Subject: [PATCH 1910/2396] io: flush zerocopy socket error queue on sendmsg
 failure due to ENOBUF
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The kernel allocates extra metadata SKBs in case of a zerocopy send,
eventually used for zerocopy's notification mechanism. This metadata
memory is accounted for in the OPTMEM limit. The kernel queues
completion notifications on the socket error queue and this error queue
is freed when userspace reads it.

Usually, in the case of in-order processing, the kernel will batch the
notifications and merge the metadata into a single SKB and free the
rest. As a result, it never exceeds the OPTMEM limit. However, if there
is any out-of-order processing or intermittent zerocopy failures, this
error chain can grow significantly, exhausting the OPTMEM limit. As a
result, all new sendmsg requests fail to allocate any new SKB, leading
to an ENOBUF error. Depending on the amount of data queued before the
flush (i.e., large live migration iterations), even large OPTMEM limits
are prone to failure.

To work around this, if we encounter an ENOBUF error with a zerocopy
sendmsg, flush the error queue and retry once more.

Co-authored-by: Manish Mishra <manish.mishra@nutanix.com>
Signed-off-by: Tejus GK <tejus.gk@nutanix.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
[DB: change TRUE/FALSE to true/false for 'bool' type;
     add more #ifdef QEMU_MSG_ZEROCOPY blocks]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/channel-socket.h |  5 +++
 io/channel-socket.c         | 84 ++++++++++++++++++++++++++++++-------
 2 files changed, 75 insertions(+), 14 deletions(-)

diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
index 26319fa98b..fcfd489c6c 100644
--- a/include/io/channel-socket.h
+++ b/include/io/channel-socket.h
@@ -50,6 +50,11 @@ struct QIOChannelSocket {
     ssize_t zero_copy_queued;
     ssize_t zero_copy_sent;
     bool blocking;
+    /**
+     * This flag indicates whether any new data was successfully sent with
+     * zerocopy since the last qio_channel_socket_flush() call.
+     */
+    bool new_zero_copy_sent_success;
 };
 
 
diff --git a/io/channel-socket.c b/io/channel-socket.c
index 8b30d5b7f7..3053b35ad8 100644
--- a/io/channel-socket.c
+++ b/io/channel-socket.c
@@ -37,6 +37,12 @@
 
 #define SOCKET_MAX_FDS 16
 
+#ifdef QEMU_MSG_ZEROCOPY
+static int qio_channel_socket_flush_internal(QIOChannel *ioc,
+                                             bool block,
+                                             Error **errp);
+#endif
+
 SocketAddress *
 qio_channel_socket_get_local_address(QIOChannelSocket *ioc,
                                      Error **errp)
@@ -66,6 +72,7 @@ qio_channel_socket_new(void)
     sioc->zero_copy_queued = 0;
     sioc->zero_copy_sent = 0;
     sioc->blocking = false;
+    sioc->new_zero_copy_sent_success = false;
 
     ioc = QIO_CHANNEL(sioc);
     qio_channel_set_feature(ioc, QIO_CHANNEL_FEATURE_SHUTDOWN);
@@ -618,6 +625,10 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
     size_t fdsize = sizeof(int) * nfds;
     struct cmsghdr *cmsg;
     int sflags = 0;
+#ifdef QEMU_MSG_ZEROCOPY
+    bool blocking = sioc->blocking;
+    bool zerocopy_flushed_once = false;
+#endif
 
     memset(control, 0, CMSG_SPACE(sizeof(int) * SOCKET_MAX_FDS));
 
@@ -662,13 +673,30 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
             return QIO_CHANNEL_ERR_BLOCK;
         case EINTR:
             goto retry;
+#ifdef QEMU_MSG_ZEROCOPY
         case ENOBUFS:
             if (flags & QIO_CHANNEL_WRITE_FLAG_ZERO_COPY) {
-                error_setg_errno(errp, errno,
-                                 "Process can't lock enough memory for using MSG_ZEROCOPY");
-                return -1;
+                /**
+                 * Socket error queueing may exhaust the OPTMEM limit. Try
+                 * flushing the error queue once.
+                 */
+                if (!zerocopy_flushed_once) {
+                    ret = qio_channel_socket_flush_internal(ioc, blocking,
+                                                            errp);
+                    if (ret < 0) {
+                        return -1;
+                    }
+                    zerocopy_flushed_once = true;
+                    goto retry;
+                } else {
+                    error_setg_errno(errp, errno,
+                                     "Process can't lock enough memory for "
+                                     "using MSG_ZEROCOPY");
+                    return -1;
+                }
             }
             break;
+#endif
         }
 
         error_setg_errno(errp, errno,
@@ -777,8 +805,9 @@ static ssize_t qio_channel_socket_writev(QIOChannel *ioc,
 
 
 #ifdef QEMU_MSG_ZEROCOPY
-static int qio_channel_socket_flush(QIOChannel *ioc,
-                                    Error **errp)
+static int qio_channel_socket_flush_internal(QIOChannel *ioc,
+                                             bool block,
+                                             Error **errp)
 {
     QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
     struct msghdr msg = {};
@@ -786,7 +815,6 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
     struct cmsghdr *cm;
     char control[CMSG_SPACE(sizeof(*serr))];
     int received;
-    int ret;
 
     if (sioc->zero_copy_queued == sioc->zero_copy_sent) {
         return 0;
@@ -796,16 +824,25 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
     msg.msg_controllen = sizeof(control);
     memset(control, 0, sizeof(control));
 
-    ret = 1;
-
     while (sioc->zero_copy_sent < sioc->zero_copy_queued) {
         received = recvmsg(sioc->fd, &msg, MSG_ERRQUEUE);
         if (received < 0) {
             switch (errno) {
             case EAGAIN:
-                /* Nothing on errqueue, wait until something is available */
-                qio_channel_wait(ioc, G_IO_ERR);
-                continue;
+                if (block) {
+                    /*
+                     * Nothing on errqueue, wait until something is
+                     * available.
+                     *
+                     * Use G_IO_ERR instead of G_IO_IN since MSG_ERRQUEUE reads
+                     * are signaled via POLLERR, not POLLIN, as the kernel
+                     * sets POLLERR when zero-copy notificatons appear on the
+                     * socket error queue.
+                     */
+                    qio_channel_wait(ioc, G_IO_ERR);
+                    continue;
+                }
+                return 0;
             case EINTR:
                 continue;
             default:
@@ -843,13 +880,32 @@ static int qio_channel_socket_flush(QIOChannel *ioc,
         /* No errors, count successfully finished sendmsg()*/
         sioc->zero_copy_sent += serr->ee_data - serr->ee_info + 1;
 
-        /* If any sendmsg() succeeded using zero copy, return 0 at the end */
+        /* If any sendmsg() succeeded using zero copy, mark zerocopy success */
         if (serr->ee_code != SO_EE_CODE_ZEROCOPY_COPIED) {
-            ret = 0;
+            sioc->new_zero_copy_sent_success = true;
         }
     }
 
-    return ret;
+    return 0;
+}
+
+static int qio_channel_socket_flush(QIOChannel *ioc,
+                                    Error **errp)
+{
+    QIOChannelSocket *sioc = QIO_CHANNEL_SOCKET(ioc);
+    int ret;
+
+    ret = qio_channel_socket_flush_internal(ioc, true, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    if (sioc->new_zero_copy_sent_success) {
+        sioc->new_zero_copy_sent_success = false;
+        return 0;
+    }
+
+    return 1;
 }
 
 #endif /* QEMU_MSG_ZEROCOPY */

From c4b3d0074eba55aae6653b04637ecf2db4ca353a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 31 Oct 2025 14:10:50 +0000
Subject: [PATCH 1911/2396] crypto: bump min gnutls to 3.7.5
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per repology, current shipping versions are:

                 RHEL-9: 3.8.3
              Debian 13: 3.8.9
       openSUSE Leap 15: 3.8.3
       Ubuntu LTS 22.04: 3.7.5
                FreeBSD: 3.8.10
              Fedora 42: 3.8.10
                OpenBSD: 3.8.10
         macOS HomeBrew: 3.8.10

Ubuntu 22.04 is our oldest constraint at this time.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher.c                |  2 +-
 crypto/meson.build             |  2 +-
 meson.build                    | 37 ++++------------------------------
 tests/unit/test-crypto-block.c |  3 +--
 4 files changed, 7 insertions(+), 37 deletions(-)

diff --git a/crypto/cipher.c b/crypto/cipher.c
index 229710f76b..515165e0dc 100644
--- a/crypto/cipher.c
+++ b/crypto/cipher.c
@@ -142,7 +142,7 @@ qcrypto_cipher_validate_key_length(QCryptoCipherAlgo alg,
 #include "cipher-gcrypt.c.inc"
 #elif defined CONFIG_NETTLE
 #include "cipher-nettle.c.inc"
-#elif defined CONFIG_GNUTLS_CRYPTO
+#elif defined CONFIG_GNUTLS
 #include "cipher-gnutls.c.inc"
 #else
 #include "cipher-stub.c.inc"
diff --git a/crypto/meson.build b/crypto/meson.build
index 735635de1f..dd61ed9174 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -38,7 +38,7 @@ if nettle.found()
   endif
 elif gcrypt.found()
   crypto_ss.add(gcrypt, files('hash-gcrypt.c', 'hmac-gcrypt.c', 'pbkdf-gcrypt.c'))
-elif gnutls_crypto.found()
+elif gnutls.found()
   crypto_ss.add(gnutls, files('hash-gnutls.c', 'hmac-gnutls.c', 'pbkdf-gnutls.c'))
 else
   crypto_ss.add(files('hash-glib.c', 'hmac-glib.c', 'pbkdf-stub.c'))
diff --git a/meson.build b/meson.build
index df876c72f0..b67e14f630 100644
--- a/meson.build
+++ b/meson.build
@@ -1823,33 +1823,11 @@ if not get_option('libcbor').auto() or have_system
 endif
 
 gnutls = not_found
-gnutls_crypto = not_found
 gnutls_bug1717_workaround = false
 if get_option('gnutls').enabled() or (get_option('gnutls').auto() and have_system)
-  # For general TLS support our min gnutls matches
-  # that implied by our platform support matrix
-  #
-  # For the crypto backends, we look for a newer
-  # gnutls:
-  #
-  #   Version 3.6.8  is needed to get XTS
-  #   Version 3.6.13 is needed to get PBKDF
-  #   Version 3.6.14 is needed to get HW accelerated XTS
-  #
-  # If newer enough gnutls isn't available, we can
-  # still use a different crypto backend to satisfy
-  # the platform support requirements
-  gnutls_crypto = dependency('gnutls', version: '>=3.6.14',
-                             method: 'pkg-config',
-                             required: false)
-  if gnutls_crypto.found()
-    gnutls = gnutls_crypto
-  else
-    # Our min version if all we need is TLS
-    gnutls = dependency('gnutls', version: '>=3.5.18',
-                        method: 'pkg-config',
-                        required: get_option('gnutls'))
-  endif
+  gnutls = dependency('gnutls', version: '>=3.7.5',
+                      method: 'pkg-config',
+                      required: get_option('gnutls'))
 
   #if gnutls.found() and not get_option('gnutls-bug1717-workaround').disabled()
     # XXX: when bug 1717 is resolved, add logic to probe for
@@ -1874,12 +1852,7 @@ if get_option('nettle').enabled() and get_option('gcrypt').enabled()
   error('Only one of gcrypt & nettle can be enabled')
 endif
 
-# Explicit nettle/gcrypt request, so ignore gnutls for crypto
-if get_option('nettle').enabled() or get_option('gcrypt').enabled()
-  gnutls_crypto = not_found
-endif
-
-if not gnutls_crypto.found()
+if not gnutls.found()
   if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
     gcrypt = dependency('libgcrypt', version: '>=1.8',
                         required: get_option('gcrypt'))
@@ -2606,7 +2579,6 @@ config_host_data.set('CONFIG_XKBCOMMON', xkbcommon.found())
 config_host_data.set('CONFIG_KEYUTILS', keyutils.found())
 config_host_data.set('CONFIG_GETTID', has_gettid)
 config_host_data.set('CONFIG_GNUTLS', gnutls.found())
-config_host_data.set('CONFIG_GNUTLS_CRYPTO', gnutls_crypto.found())
 config_host_data.set('CONFIG_GNUTLS_BUG1717_WORKAROUND', gnutls_bug1717_workaround)
 config_host_data.set('CONFIG_TASN1', tasn1.found())
 config_host_data.set('CONFIG_GCRYPT', gcrypt.found())
@@ -4906,7 +4878,6 @@ summary_info = {}
 summary_info += {'TLS priority':      get_option('tls_priority')}
 summary_info += {'GNUTLS support':    gnutls}
 if gnutls.found()
-  summary_info += {'  GNUTLS crypto':   gnutls_crypto.found()}
   summary_info += {'  GNUTLS bug 1717 workaround': gnutls_bug1717_workaround }
 endif
 summary_info += {'libgcrypt':         gcrypt}
diff --git a/tests/unit/test-crypto-block.c b/tests/unit/test-crypto-block.c
index 3ac7f17b2a..218e585f98 100644
--- a/tests/unit/test-crypto-block.c
+++ b/tests/unit/test-crypto-block.c
@@ -31,8 +31,7 @@
 #endif
 
 #if (defined(_WIN32) || defined RUSAGE_THREAD) && \
-    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT) || \
-     defined(CONFIG_GNUTLS_CRYPTO))
+    (defined(CONFIG_NETTLE) || defined(CONFIG_GCRYPT))
 #define TEST_LUKS
 #else
 #undef TEST_LUKS

From 9e6ce4d22e5782bbd23cfda245978ef71d495319 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 31 Oct 2025 15:28:26 +0000
Subject: [PATCH 1912/2396] crypto: unconditionally enable gnutls XTS support
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The XTS support required 3.6.8 which is older than our min
required version now.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher-gnutls.c.inc | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/crypto/cipher-gnutls.c.inc b/crypto/cipher-gnutls.c.inc
index b9450d48b0..a8263fff6d 100644
--- a/crypto/cipher-gnutls.c.inc
+++ b/crypto/cipher-gnutls.c.inc
@@ -23,10 +23,6 @@
 
 #include <gnutls/crypto.h>
 
-#if GNUTLS_VERSION_NUMBER >= 0x030608
-#define QEMU_GNUTLS_XTS
-#endif
-
 bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
                              QCryptoCipherMode mode)
 {
@@ -44,7 +40,6 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
         default:
             return false;
         }
-#ifdef QEMU_GNUTLS_XTS
     case QCRYPTO_CIPHER_MODE_XTS:
         switch (alg) {
         case QCRYPTO_CIPHER_ALGO_AES_128:
@@ -53,7 +48,6 @@ bool qcrypto_cipher_supports(QCryptoCipherAlgo alg,
         default:
             return false;
         }
-#endif
     default:
         return false;
     }
@@ -241,7 +235,6 @@ static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
     int err;
 
     switch (mode) {
-#ifdef QEMU_GNUTLS_XTS
     case QCRYPTO_CIPHER_MODE_XTS:
         switch (alg) {
         case QCRYPTO_CIPHER_ALGO_AES_128:
@@ -254,7 +247,6 @@ static QCryptoCipher *qcrypto_cipher_ctx_new(QCryptoCipherAlgo alg,
             break;
         }
         break;
-#endif
 
     case QCRYPTO_CIPHER_MODE_ECB:
     case QCRYPTO_CIPHER_MODE_CBC:

From 8afd894781a781133ecb418506cce5c5a3c7581e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 31 Oct 2025 14:10:50 +0000
Subject: [PATCH 1913/2396] crypto: bump min libgcrypt to 1.9.4
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per repology, current shipping versions are:

                 RHEL-9: 1.10.0
              Debian 13: 1.11.0
       openSUSE Leap 15: 1.10.3
       Ubuntu LTS 22.04: 1.9.4
                FreeBSD: 1.11.2
              Fedora 42: 1.11.1
                OpenBSD: 1.11.2
         macOS HomeBrew: 1.11.2

Ubuntu 22.04 is our oldest constraint at this time.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 22 +---------------------
 1 file changed, 1 insertion(+), 21 deletions(-)

diff --git a/meson.build b/meson.build
index b67e14f630..ab1ff373e6 100644
--- a/meson.build
+++ b/meson.build
@@ -1854,7 +1854,7 @@ endif
 
 if not gnutls.found()
   if (not get_option('gcrypt').auto() or have_system) and not get_option('nettle').enabled()
-    gcrypt = dependency('libgcrypt', version: '>=1.8',
+    gcrypt = dependency('libgcrypt', version: '>=1.9.4',
                         required: get_option('gcrypt'))
     # Debian has removed -lgpg-error from libgcrypt-config
     # as it "spreads unnecessary dependencies" which in
@@ -1866,27 +1866,7 @@ if not gnutls.found()
         version: gcrypt.version())
     endif
     crypto_sm4 = gcrypt
-    # SM4 ALG is available in libgcrypt >= 1.9
-    if gcrypt.found() and not cc.links('''
-      #include <gcrypt.h>
-      int main(void) {
-        gcry_cipher_hd_t handler;
-        gcry_cipher_open(&handler, GCRY_CIPHER_SM4, GCRY_CIPHER_MODE_ECB, 0);
-        return 0;
-      }''', dependencies: gcrypt)
-      crypto_sm4 = not_found
-    endif
     crypto_sm3 = gcrypt
-    # SM3 ALG is available in libgcrypt >= 1.9
-    if gcrypt.found() and not cc.links('''
-      #include <gcrypt.h>
-      int main(void) {
-        gcry_md_hd_t handler;
-        gcry_md_open(&handler, GCRY_MD_SM3, 0);
-        return 0;
-      }''', dependencies: gcrypt)
-      crypto_sm3 = not_found
-    endif
   endif
   if (not get_option('nettle').auto() or have_system) and not gcrypt.found()
     nettle = dependency('nettle', version: '>=3.4',

From 4811ad2be983375102fba12fa265541e5600f98c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 31 Oct 2025 14:10:50 +0000
Subject: [PATCH 1914/2396] crypto: bump min nettle to 3.7.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per repology, current shipping versions are:

                 RHEL-9: 3.10.1
              Debian 13: 3.10.1
       openSUSE Leap 15: 3.9.1
       Ubuntu LTS 22.04: 3.7.3
                FreeBSD: 3.10.2
              Fedora 42: 3.10.2
                OpenBSD: 3.10.2
         macOS HomeBrew: 3.10.2

Ubuntu 22.04 is our oldest constraint at this time.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index ab1ff373e6..ad0aa6ccc0 100644
--- a/meson.build
+++ b/meson.build
@@ -1869,7 +1869,7 @@ if not gnutls.found()
     crypto_sm3 = gcrypt
   endif
   if (not get_option('nettle').auto() or have_system) and not gcrypt.found()
-    nettle = dependency('nettle', version: '>=3.4',
+    nettle = dependency('nettle', version: '>=3.7.3',
                         method: 'pkg-config',
                         required: get_option('nettle'))
     if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle)

From 167194d0874efd98f88f525589aabaf03caa489f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 31 Oct 2025 14:23:33 +0000
Subject: [PATCH 1915/2396] crypto: drop in-tree XTS cipher mode impl
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nettle included XTS in 3.4.1, so with the new min version we
no longer require the in-tree XTS cipher mode impl.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/cipher-nettle.c.inc   |  44 ---
 crypto/meson.build           |   3 -
 crypto/xts.c                 | 250 -----------------
 include/crypto/xts.h         |  82 ------
 meson.build                  |   8 -
 tests/unit/meson.build       |   3 -
 tests/unit/test-crypto-xts.c | 529 -----------------------------------
 7 files changed, 919 deletions(-)
 delete mode 100644 crypto/xts.c
 delete mode 100644 include/crypto/xts.h
 delete mode 100644 tests/unit/test-crypto-xts.c

diff --git a/crypto/cipher-nettle.c.inc b/crypto/cipher-nettle.c.inc
index ae91363772..1afdc391b4 100644
--- a/crypto/cipher-nettle.c.inc
+++ b/crypto/cipher-nettle.c.inc
@@ -18,10 +18,6 @@
  *
  */
 
-#ifdef CONFIG_QEMU_PRIVATE_XTS
-#include "crypto/xts.h"
-#endif
-
 #include <nettle/nettle-types.h>
 #include <nettle/aes.h>
 #include <nettle/des.h>
@@ -30,9 +26,7 @@
 #include <nettle/serpent.h>
 #include <nettle/twofish.h>
 #include <nettle/ctr.h>
-#ifndef CONFIG_QEMU_PRIVATE_XTS
 #include <nettle/xts.h>
-#endif
 #ifdef CONFIG_CRYPTO_SM4
 #include <nettle/sm4.h>
 #endif
@@ -154,43 +148,6 @@ static const struct QCryptoCipherDriver NAME##_driver_ctr = {           \
 };
 
 
-#ifdef CONFIG_QEMU_PRIVATE_XTS
-#define DEFINE__XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                 \
-static void NAME##_xts_wrape(const void *ctx, size_t length,            \
-                             uint8_t *dst, const uint8_t *src)          \
-{                                                                       \
-    ENCRYPT((const void *)ctx, length, dst, src);                       \
-}                                                                       \
-static void NAME##_xts_wrapd(const void *ctx, size_t length,            \
-                             uint8_t *dst, const uint8_t *src)          \
-{                                                                       \
-    DECRYPT((const void *)ctx, length, dst, src);                       \
-}                                                                       \
-static int NAME##_encrypt_xts(QCryptoCipher *cipher, const void *in,    \
-                              void *out, size_t len, Error **errp)      \
-{                                                                       \
-    TYPE *ctx = container_of(cipher, TYPE, base);                       \
-    if (!qcrypto_length_check(len, BLEN, errp)) {                       \
-        return -1;                                                      \
-    }                                                                   \
-    xts_encrypt(&ctx->key, &ctx->key_xts,                               \
-                NAME##_xts_wrape, NAME##_xts_wrapd,                     \
-                ctx->iv, len, out, in);                                 \
-    return 0;                                                           \
-}                                                                       \
-static int NAME##_decrypt_xts(QCryptoCipher *cipher, const void *in,    \
-                              void *out, size_t len, Error **errp)      \
-{                                                                       \
-    TYPE *ctx = container_of(cipher, TYPE, base);                       \
-    if (!qcrypto_length_check(len, BLEN, errp)) {                       \
-        return -1;                                                      \
-    }                                                                   \
-    xts_decrypt(&ctx->key, &ctx->key_xts,                               \
-                NAME##_xts_wrape, NAME##_xts_wrapd,                     \
-                ctx->iv, len, out, in);                                 \
-    return 0;                                                           \
-}
-#else
 #define DEFINE__XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)                 \
 static int NAME##_encrypt_xts(QCryptoCipher *cipher, const void *in,    \
                               void *out, size_t len, Error **errp)      \
@@ -214,7 +171,6 @@ static int NAME##_decrypt_xts(QCryptoCipher *cipher, const void *in,    \
                         ctx->iv, len, out, in);                         \
     return 0;                                                           \
 }
-#endif
 
 #define DEFINE_XTS(NAME, TYPE, BLEN, ENCRYPT, DECRYPT)          \
     QEMU_BUILD_BUG_ON(BLEN != XTS_BLOCK_SIZE);                  \
diff --git a/crypto/meson.build b/crypto/meson.build
index dd61ed9174..110c347033 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -33,9 +33,6 @@ if nettle.found()
   if hogweed.found()
     crypto_ss.add(gmp, hogweed)
   endif
-  if xts == 'private'
-    crypto_ss.add(files('xts.c'))
-  endif
 elif gcrypt.found()
   crypto_ss.add(gcrypt, files('hash-gcrypt.c', 'hmac-gcrypt.c', 'pbkdf-gcrypt.c'))
 elif gnutls.found()
diff --git a/crypto/xts.c b/crypto/xts.c
deleted file mode 100644
index d4a49fdb70..0000000000
--- a/crypto/xts.c
+++ /dev/null
@@ -1,250 +0,0 @@
-/*
- * QEMU Crypto XTS cipher mode
- *
- * Copyright (c) 2015-2016 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- * This code is originally derived from public domain / WTFPL code in
- * LibTomCrypt crytographic library http://libtom.org. The XTS code
- * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com)
- * to the LibTom Projects
- *
- */
-
-#include "qemu/osdep.h"
-#include "qemu/bswap.h"
-#include "crypto/xts.h"
-
-typedef union {
-    uint8_t b[XTS_BLOCK_SIZE];
-    uint64_t u[2];
-} xts_uint128;
-
-static inline void xts_uint128_xor(xts_uint128 *D,
-                                   const xts_uint128 *S1,
-                                   const xts_uint128 *S2)
-{
-    D->u[0] = S1->u[0] ^ S2->u[0];
-    D->u[1] = S1->u[1] ^ S2->u[1];
-}
-
-static inline void xts_uint128_cpu_to_les(xts_uint128 *v)
-{
-    cpu_to_le64s(&v->u[0]);
-    cpu_to_le64s(&v->u[1]);
-}
-
-static inline void xts_uint128_le_to_cpus(xts_uint128 *v)
-{
-    le64_to_cpus(&v->u[0]);
-    le64_to_cpus(&v->u[1]);
-}
-
-static void xts_mult_x(xts_uint128 *I)
-{
-    uint64_t tt;
-
-    xts_uint128_le_to_cpus(I);
-
-    tt = I->u[0] >> 63;
-    I->u[0] <<= 1;
-
-    if (I->u[1] >> 63) {
-        I->u[0] ^= 0x87;
-    }
-    I->u[1] <<= 1;
-    I->u[1] |= tt;
-
-    xts_uint128_cpu_to_les(I);
-}
-
-
-/**
- * xts_tweak_encdec:
- * @param ctxt: the cipher context
- * @param func: the cipher function
- * @src: buffer providing the input text of XTS_BLOCK_SIZE bytes
- * @dst: buffer to output the output text of XTS_BLOCK_SIZE bytes
- * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes
- *
- * Encrypt/decrypt data with a tweak
- */
-static inline void xts_tweak_encdec(const void *ctx,
-                                    xts_cipher_func *func,
-                                    const xts_uint128 *src,
-                                    xts_uint128 *dst,
-                                    xts_uint128 *iv)
-{
-    /* tweak encrypt block i */
-    xts_uint128_xor(dst, src, iv);
-
-    func(ctx, XTS_BLOCK_SIZE, dst->b, dst->b);
-
-    xts_uint128_xor(dst, dst, iv);
-
-    /* LFSR the tweak */
-    xts_mult_x(iv);
-}
-
-
-void xts_decrypt(const void *datactx,
-                 const void *tweakctx,
-                 xts_cipher_func *encfunc,
-                 xts_cipher_func *decfunc,
-                 uint8_t *iv,
-                 size_t length,
-                 uint8_t *dst,
-                 const uint8_t *src)
-{
-    xts_uint128 PP, CC, T;
-    unsigned long i, m, mo, lim;
-
-    /* get number of blocks */
-    m = length >> 4;
-    mo = length & 15;
-
-    /* must have at least one full block */
-    g_assert(m != 0);
-
-    if (mo == 0) {
-        lim = m;
-    } else {
-        lim = m - 1;
-    }
-
-    /* encrypt the iv */
-    encfunc(tweakctx, XTS_BLOCK_SIZE, T.b, iv);
-
-    if (QEMU_PTR_IS_ALIGNED(src, sizeof(uint64_t)) &&
-        QEMU_PTR_IS_ALIGNED(dst, sizeof(uint64_t))) {
-        xts_uint128 *S = (xts_uint128 *)src;
-        xts_uint128 *D = (xts_uint128 *)dst;
-        for (i = 0; i < lim; i++, S++, D++) {
-            xts_tweak_encdec(datactx, decfunc, S, D, &T);
-        }
-    } else {
-        xts_uint128 D;
-
-        for (i = 0; i < lim; i++) {
-            memcpy(&D, src, XTS_BLOCK_SIZE);
-            xts_tweak_encdec(datactx, decfunc, &D, &D, &T);
-            memcpy(dst, &D, XTS_BLOCK_SIZE);
-            src += XTS_BLOCK_SIZE;
-            dst += XTS_BLOCK_SIZE;
-        }
-    }
-
-    /* if length is not a multiple of XTS_BLOCK_SIZE then */
-    if (mo > 0) {
-        xts_uint128 S, D;
-        memcpy(&CC, &T, XTS_BLOCK_SIZE);
-        xts_mult_x(&CC);
-
-        /* PP = tweak decrypt block m-1 */
-        memcpy(&S, src, XTS_BLOCK_SIZE);
-        xts_tweak_encdec(datactx, decfunc, &S, &PP, &CC);
-
-        /* Pm = first length % XTS_BLOCK_SIZE bytes of PP */
-        for (i = 0; i < mo; i++) {
-            CC.b[i] = src[XTS_BLOCK_SIZE + i];
-            dst[XTS_BLOCK_SIZE + i] = PP.b[i];
-        }
-        for (; i < XTS_BLOCK_SIZE; i++) {
-            CC.b[i] = PP.b[i];
-        }
-
-        /* Pm-1 = Tweak uncrypt CC */
-        xts_tweak_encdec(datactx, decfunc, &CC, &D, &T);
-        memcpy(dst, &D, XTS_BLOCK_SIZE);
-    }
-
-    /* Decrypt the iv back */
-    decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T.b);
-}
-
-
-void xts_encrypt(const void *datactx,
-                 const void *tweakctx,
-                 xts_cipher_func *encfunc,
-                 xts_cipher_func *decfunc,
-                 uint8_t *iv,
-                 size_t length,
-                 uint8_t *dst,
-                 const uint8_t *src)
-{
-    xts_uint128 PP, CC, T;
-    unsigned long i, m, mo, lim;
-
-    /* get number of blocks */
-    m = length >> 4;
-    mo = length & 15;
-
-    /* must have at least one full block */
-    g_assert(m != 0);
-
-    if (mo == 0) {
-        lim = m;
-    } else {
-        lim = m - 1;
-    }
-
-    /* encrypt the iv */
-    encfunc(tweakctx, XTS_BLOCK_SIZE, T.b, iv);
-
-    if (QEMU_PTR_IS_ALIGNED(src, sizeof(uint64_t)) &&
-        QEMU_PTR_IS_ALIGNED(dst, sizeof(uint64_t))) {
-        xts_uint128 *S = (xts_uint128 *)src;
-        xts_uint128 *D = (xts_uint128 *)dst;
-        for (i = 0; i < lim; i++, S++, D++) {
-            xts_tweak_encdec(datactx, encfunc, S, D, &T);
-        }
-    } else {
-        xts_uint128 D;
-
-        for (i = 0; i < lim; i++) {
-            memcpy(&D, src, XTS_BLOCK_SIZE);
-            xts_tweak_encdec(datactx, encfunc, &D, &D, &T);
-            memcpy(dst, &D, XTS_BLOCK_SIZE);
-
-            dst += XTS_BLOCK_SIZE;
-            src += XTS_BLOCK_SIZE;
-        }
-    }
-
-    /* if length is not a multiple of XTS_BLOCK_SIZE then */
-    if (mo > 0) {
-        xts_uint128 S, D;
-        /* CC = tweak encrypt block m-1 */
-        memcpy(&S, src, XTS_BLOCK_SIZE);
-        xts_tweak_encdec(datactx, encfunc, &S, &CC, &T);
-
-        /* Cm = first length % XTS_BLOCK_SIZE bytes of CC */
-        for (i = 0; i < mo; i++) {
-            PP.b[i] = src[XTS_BLOCK_SIZE + i];
-            dst[XTS_BLOCK_SIZE + i] = CC.b[i];
-        }
-
-        for (; i < XTS_BLOCK_SIZE; i++) {
-            PP.b[i] = CC.b[i];
-        }
-
-        /* Cm-1 = Tweak encrypt PP */
-        xts_tweak_encdec(datactx, encfunc, &PP, &D, &T);
-        memcpy(dst, &D, XTS_BLOCK_SIZE);
-    }
-
-    /* Decrypt the iv back */
-    decfunc(tweakctx, XTS_BLOCK_SIZE, iv, T.b);
-}
diff --git a/include/crypto/xts.h b/include/crypto/xts.h
deleted file mode 100644
index f267b7824a..0000000000
--- a/include/crypto/xts.h
+++ /dev/null
@@ -1,82 +0,0 @@
-/*
- * QEMU Crypto XTS cipher mode
- *
- * Copyright (c) 2015-2016 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- * This code is originally derived from public domain / WTFPL code in
- * LibTomCrypt crytographic library http://libtom.org. The XTS code
- * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com)
- * to the LibTom Projects
- *
- */
-
-#ifndef QCRYPTO_XTS_H
-#define QCRYPTO_XTS_H
-
-
-#define XTS_BLOCK_SIZE 16
-
-typedef void xts_cipher_func(const void *ctx,
-                             size_t length,
-                             uint8_t *dst,
-                             const uint8_t *src);
-
-/**
- * xts_decrypt:
- * @datactx: the cipher context for data decryption
- * @tweakctx: the cipher context for tweak decryption
- * @encfunc: the cipher function for encryption
- * @decfunc: the cipher function for decryption
- * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes
- * @length: the length of @dst and @src
- * @dst: buffer to hold the decrypted plaintext
- * @src: buffer providing the ciphertext
- *
- * Decrypts @src into @dst
- */
-void xts_decrypt(const void *datactx,
-                 const void *tweakctx,
-                 xts_cipher_func *encfunc,
-                 xts_cipher_func *decfunc,
-                 uint8_t *iv,
-                 size_t length,
-                 uint8_t *dst,
-                 const uint8_t *src);
-
-/**
- * xts_decrypt:
- * @datactx: the cipher context for data encryption
- * @tweakctx: the cipher context for tweak encryption
- * @encfunc: the cipher function for encryption
- * @decfunc: the cipher function for decryption
- * @iv: the initialization vector tweak of XTS_BLOCK_SIZE bytes
- * @length: the length of @dst and @src
- * @dst: buffer to hold the encrypted ciphertext
- * @src: buffer providing the plaintext
- *
- * Decrypts @src into @dst
- */
-void xts_encrypt(const void *datactx,
-                 const void *tweakctx,
-                 xts_cipher_func *encfunc,
-                 xts_cipher_func *decfunc,
-                 uint8_t *iv,
-                 size_t length,
-                 uint8_t *dst,
-                 const uint8_t *src);
-
-
-#endif /* QCRYPTO_XTS_H */
diff --git a/meson.build b/meson.build
index ad0aa6ccc0..b8c1296d3b 100644
--- a/meson.build
+++ b/meson.build
@@ -1846,7 +1846,6 @@ nettle = not_found
 hogweed = not_found
 crypto_sm4 = not_found
 crypto_sm3 = not_found
-xts = 'none'
 
 if get_option('nettle').enabled() and get_option('gcrypt').enabled()
   error('Only one of gcrypt & nettle can be enabled')
@@ -1872,9 +1871,6 @@ if not gnutls.found()
     nettle = dependency('nettle', version: '>=3.7.3',
                         method: 'pkg-config',
                         required: get_option('nettle'))
-    if nettle.found() and not cc.has_header('nettle/xts.h', dependencies: nettle)
-      xts = 'private'
-    endif
     crypto_sm4 = nettle
     # SM4 ALG is available in nettle >= 3.9
     if nettle.found() and not cc.links('''
@@ -2566,7 +2562,6 @@ config_host_data.set('CONFIG_NETTLE', nettle.found())
 config_host_data.set('CONFIG_CRYPTO_SM4', crypto_sm4.found())
 config_host_data.set('CONFIG_CRYPTO_SM3', crypto_sm3.found())
 config_host_data.set('CONFIG_HOGWEED', hogweed.found())
-config_host_data.set('CONFIG_QEMU_PRIVATE_XTS', xts == 'private')
 config_host_data.set('CONFIG_MALLOC_TRIM', has_malloc_trim)
 config_host_data.set('CONFIG_ZSTD', zstd.found())
 config_host_data.set('CONFIG_QPL', qpl.found())
@@ -4862,9 +4857,6 @@ if gnutls.found()
 endif
 summary_info += {'libgcrypt':         gcrypt}
 summary_info += {'nettle':            nettle}
-if nettle.found()
-   summary_info += {'  XTS':             xts != 'private'}
-endif
 summary_info += {'SM4 ALG support':   crypto_sm4}
 summary_info += {'SM3 ALG support':   crypto_sm3}
 summary_info += {'AF_ALG support':    have_afalg}
diff --git a/tests/unit/meson.build b/tests/unit/meson.build
index d5248ae51d..bd58029060 100644
--- a/tests/unit/meson.build
+++ b/tests/unit/meson.build
@@ -110,9 +110,6 @@ if have_block
   if pam.found()
     tests += {'test-authz-pam': [authz]}
   endif
-  if xts == 'private'
-    tests += {'test-crypto-xts': [crypto, io]}
-  endif
   if host_os != 'windows'
     tests += {
       'test-image-locking': [testblock],
diff --git a/tests/unit/test-crypto-xts.c b/tests/unit/test-crypto-xts.c
deleted file mode 100644
index 7acbc956fd..0000000000
--- a/tests/unit/test-crypto-xts.c
+++ /dev/null
@@ -1,529 +0,0 @@
-/*
- * QEMU Crypto XTS cipher mode
- *
- * Copyright (c) 2015-2018 Red Hat, Inc.
- *
- * This library is free software; you can redistribute it and/or
- * modify it under the terms of the GNU Lesser General Public
- * License as published by the Free Software Foundation; either
- * version 2.1 of the License, or (at your option) any later version.
- *
- * This library is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
- * Lesser General Public License for more details.
- *
- * You should have received a copy of the GNU Lesser General Public
- * License along with this library; if not, see <http://www.gnu.org/licenses/>.
- *
- * This code is originally derived from public domain / WTFPL code in
- * LibTomCrypt crytographic library http://libtom.org. The XTS code
- * was donated by Elliptic Semiconductor Inc (www.ellipticsemi.com)
- * to the LibTom Projects
- *
- */
-
-#include "qemu/osdep.h"
-#include "crypto/init.h"
-#include "crypto/xts.h"
-#include "crypto/aes.h"
-
-typedef struct {
-    const char *path;
-    int keylen;
-    unsigned char key1[32];
-    unsigned char key2[32];
-    uint64_t seqnum;
-    unsigned long PTLEN;
-    unsigned char PTX[512], CTX[512];
-} QCryptoXTSTestData;
-
-static const QCryptoXTSTestData test_data[] = {
-    /* #1 32 byte key, 32 byte PTX */
-    {
-        "/crypto/xts/t-1-key-32-ptx-32",
-        32,
-        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
-        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
-        0,
-        32,
-        { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 },
-        { 0x91, 0x7c, 0xf6, 0x9e, 0xbd, 0x68, 0xb2, 0xec,
-          0x9b, 0x9f, 0xe9, 0xa3, 0xea, 0xdd, 0xa6, 0x92,
-          0xcd, 0x43, 0xd2, 0xf5, 0x95, 0x98, 0xed, 0x85,
-          0x8c, 0x02, 0xc2, 0x65, 0x2f, 0xbf, 0x92, 0x2e },
-    },
-
-    /* #2, 32 byte key, 32 byte PTX */
-    {
-        "/crypto/xts/t-2-key-32-ptx-32",
-        32,
-        { 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11,
-          0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11, 0x11 },
-        { 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22,
-          0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22, 0x22 },
-        0x3333333333LL,
-        32,
-        { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
-        { 0xc4, 0x54, 0x18, 0x5e, 0x6a, 0x16, 0x93, 0x6e,
-          0x39, 0x33, 0x40, 0x38, 0xac, 0xef, 0x83, 0x8b,
-          0xfb, 0x18, 0x6f, 0xff, 0x74, 0x80, 0xad, 0xc4,
-          0x28, 0x93, 0x82, 0xec, 0xd6, 0xd3, 0x94, 0xf0 },
-    },
-
-    /* #5 from xts.7, 32 byte key, 32 byte PTX */
-    {
-        "/crypto/xts/t-5-key-32-ptx-32",
-        32,
-        { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
-          0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0 },
-        { 0xbf, 0xbe, 0xbd, 0xbc, 0xbb, 0xba, 0xb9, 0xb8,
-          0xb7, 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1, 0xb0 },
-        0x123456789aLL,
-        32,
-        { 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44,
-          0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44, 0x44 },
-        { 0xb0, 0x1f, 0x86, 0xf8, 0xed, 0xc1, 0x86, 0x37,
-          0x06, 0xfa, 0x8a, 0x42, 0x53, 0xe3, 0x4f, 0x28,
-          0xaf, 0x31, 0x9d, 0xe3, 0x83, 0x34, 0x87, 0x0f,
-          0x4d, 0xd1, 0xf9, 0x4c, 0xbe, 0x98, 0x32, 0xf1 },
-    },
-
-    /* #4, 32 byte key, 512 byte PTX  */
-    {
-        "/crypto/xts/t-4-key-32-ptx-512",
-        32,
-        { 0x27, 0x18, 0x28, 0x18, 0x28, 0x45, 0x90, 0x45,
-          0x23, 0x53, 0x60, 0x28, 0x74, 0x71, 0x35, 0x26 },
-        { 0x31, 0x41, 0x59, 0x26, 0x53, 0x58, 0x97, 0x93,
-          0x23, 0x84, 0x62, 0x64, 0x33, 0x83, 0x27, 0x95 },
-        0,
-        512,
-        {
-            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-            0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-            0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
-            0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
-            0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-            0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
-            0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
-            0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
-            0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
-            0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-            0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-            0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
-            0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-            0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
-            0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
-            0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-            0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
-            0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
-            0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-            0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
-            0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
-            0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-            0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
-            0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
-            0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-            0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
-            0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
-            0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-            0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
-            0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
-            0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-            0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-            0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-            0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e, 0x1f,
-            0x20, 0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27,
-            0x28, 0x29, 0x2a, 0x2b, 0x2c, 0x2d, 0x2e, 0x2f,
-            0x30, 0x31, 0x32, 0x33, 0x34, 0x35, 0x36, 0x37,
-            0x38, 0x39, 0x3a, 0x3b, 0x3c, 0x3d, 0x3e, 0x3f,
-            0x40, 0x41, 0x42, 0x43, 0x44, 0x45, 0x46, 0x47,
-            0x48, 0x49, 0x4a, 0x4b, 0x4c, 0x4d, 0x4e, 0x4f,
-            0x50, 0x51, 0x52, 0x53, 0x54, 0x55, 0x56, 0x57,
-            0x58, 0x59, 0x5a, 0x5b, 0x5c, 0x5d, 0x5e, 0x5f,
-            0x60, 0x61, 0x62, 0x63, 0x64, 0x65, 0x66, 0x67,
-            0x68, 0x69, 0x6a, 0x6b, 0x6c, 0x6d, 0x6e, 0x6f,
-            0x70, 0x71, 0x72, 0x73, 0x74, 0x75, 0x76, 0x77,
-            0x78, 0x79, 0x7a, 0x7b, 0x7c, 0x7d, 0x7e, 0x7f,
-            0x80, 0x81, 0x82, 0x83, 0x84, 0x85, 0x86, 0x87,
-            0x88, 0x89, 0x8a, 0x8b, 0x8c, 0x8d, 0x8e, 0x8f,
-            0x90, 0x91, 0x92, 0x93, 0x94, 0x95, 0x96, 0x97,
-            0x98, 0x99, 0x9a, 0x9b, 0x9c, 0x9d, 0x9e, 0x9f,
-            0xa0, 0xa1, 0xa2, 0xa3, 0xa4, 0xa5, 0xa6, 0xa7,
-            0xa8, 0xa9, 0xaa, 0xab, 0xac, 0xad, 0xae, 0xaf,
-            0xb0, 0xb1, 0xb2, 0xb3, 0xb4, 0xb5, 0xb6, 0xb7,
-            0xb8, 0xb9, 0xba, 0xbb, 0xbc, 0xbd, 0xbe, 0xbf,
-            0xc0, 0xc1, 0xc2, 0xc3, 0xc4, 0xc5, 0xc6, 0xc7,
-            0xc8, 0xc9, 0xca, 0xcb, 0xcc, 0xcd, 0xce, 0xcf,
-            0xd0, 0xd1, 0xd2, 0xd3, 0xd4, 0xd5, 0xd6, 0xd7,
-            0xd8, 0xd9, 0xda, 0xdb, 0xdc, 0xdd, 0xde, 0xdf,
-            0xe0, 0xe1, 0xe2, 0xe3, 0xe4, 0xe5, 0xe6, 0xe7,
-            0xe8, 0xe9, 0xea, 0xeb, 0xec, 0xed, 0xee, 0xef,
-            0xf0, 0xf1, 0xf2, 0xf3, 0xf4, 0xf5, 0xf6, 0xf7,
-            0xf8, 0xf9, 0xfa, 0xfb, 0xfc, 0xfd, 0xfe, 0xff,
-        },
-        {
-            0x27, 0xa7, 0x47, 0x9b, 0xef, 0xa1, 0xd4, 0x76,
-            0x48, 0x9f, 0x30, 0x8c, 0xd4, 0xcf, 0xa6, 0xe2,
-            0xa9, 0x6e, 0x4b, 0xbe, 0x32, 0x08, 0xff, 0x25,
-            0x28, 0x7d, 0xd3, 0x81, 0x96, 0x16, 0xe8, 0x9c,
-            0xc7, 0x8c, 0xf7, 0xf5, 0xe5, 0x43, 0x44, 0x5f,
-            0x83, 0x33, 0xd8, 0xfa, 0x7f, 0x56, 0x00, 0x00,
-            0x05, 0x27, 0x9f, 0xa5, 0xd8, 0xb5, 0xe4, 0xad,
-            0x40, 0xe7, 0x36, 0xdd, 0xb4, 0xd3, 0x54, 0x12,
-            0x32, 0x80, 0x63, 0xfd, 0x2a, 0xab, 0x53, 0xe5,
-            0xea, 0x1e, 0x0a, 0x9f, 0x33, 0x25, 0x00, 0xa5,
-            0xdf, 0x94, 0x87, 0xd0, 0x7a, 0x5c, 0x92, 0xcc,
-            0x51, 0x2c, 0x88, 0x66, 0xc7, 0xe8, 0x60, 0xce,
-            0x93, 0xfd, 0xf1, 0x66, 0xa2, 0x49, 0x12, 0xb4,
-            0x22, 0x97, 0x61, 0x46, 0xae, 0x20, 0xce, 0x84,
-            0x6b, 0xb7, 0xdc, 0x9b, 0xa9, 0x4a, 0x76, 0x7a,
-            0xae, 0xf2, 0x0c, 0x0d, 0x61, 0xad, 0x02, 0x65,
-            0x5e, 0xa9, 0x2d, 0xc4, 0xc4, 0xe4, 0x1a, 0x89,
-            0x52, 0xc6, 0x51, 0xd3, 0x31, 0x74, 0xbe, 0x51,
-            0xa1, 0x0c, 0x42, 0x11, 0x10, 0xe6, 0xd8, 0x15,
-            0x88, 0xed, 0xe8, 0x21, 0x03, 0xa2, 0x52, 0xd8,
-            0xa7, 0x50, 0xe8, 0x76, 0x8d, 0xef, 0xff, 0xed,
-            0x91, 0x22, 0x81, 0x0a, 0xae, 0xb9, 0x9f, 0x91,
-            0x72, 0xaf, 0x82, 0xb6, 0x04, 0xdc, 0x4b, 0x8e,
-            0x51, 0xbc, 0xb0, 0x82, 0x35, 0xa6, 0xf4, 0x34,
-            0x13, 0x32, 0xe4, 0xca, 0x60, 0x48, 0x2a, 0x4b,
-            0xa1, 0xa0, 0x3b, 0x3e, 0x65, 0x00, 0x8f, 0xc5,
-            0xda, 0x76, 0xb7, 0x0b, 0xf1, 0x69, 0x0d, 0xb4,
-            0xea, 0xe2, 0x9c, 0x5f, 0x1b, 0xad, 0xd0, 0x3c,
-            0x5c, 0xcf, 0x2a, 0x55, 0xd7, 0x05, 0xdd, 0xcd,
-            0x86, 0xd4, 0x49, 0x51, 0x1c, 0xeb, 0x7e, 0xc3,
-            0x0b, 0xf1, 0x2b, 0x1f, 0xa3, 0x5b, 0x91, 0x3f,
-            0x9f, 0x74, 0x7a, 0x8a, 0xfd, 0x1b, 0x13, 0x0e,
-            0x94, 0xbf, 0xf9, 0x4e, 0xff, 0xd0, 0x1a, 0x91,
-            0x73, 0x5c, 0xa1, 0x72, 0x6a, 0xcd, 0x0b, 0x19,
-            0x7c, 0x4e, 0x5b, 0x03, 0x39, 0x36, 0x97, 0xe1,
-            0x26, 0x82, 0x6f, 0xb6, 0xbb, 0xde, 0x8e, 0xcc,
-            0x1e, 0x08, 0x29, 0x85, 0x16, 0xe2, 0xc9, 0xed,
-            0x03, 0xff, 0x3c, 0x1b, 0x78, 0x60, 0xf6, 0xde,
-            0x76, 0xd4, 0xce, 0xcd, 0x94, 0xc8, 0x11, 0x98,
-            0x55, 0xef, 0x52, 0x97, 0xca, 0x67, 0xe9, 0xf3,
-            0xe7, 0xff, 0x72, 0xb1, 0xe9, 0x97, 0x85, 0xca,
-            0x0a, 0x7e, 0x77, 0x20, 0xc5, 0xb3, 0x6d, 0xc6,
-            0xd7, 0x2c, 0xac, 0x95, 0x74, 0xc8, 0xcb, 0xbc,
-            0x2f, 0x80, 0x1e, 0x23, 0xe5, 0x6f, 0xd3, 0x44,
-            0xb0, 0x7f, 0x22, 0x15, 0x4b, 0xeb, 0xa0, 0xf0,
-            0x8c, 0xe8, 0x89, 0x1e, 0x64, 0x3e, 0xd9, 0x95,
-            0xc9, 0x4d, 0x9a, 0x69, 0xc9, 0xf1, 0xb5, 0xf4,
-            0x99, 0x02, 0x7a, 0x78, 0x57, 0x2a, 0xee, 0xbd,
-            0x74, 0xd2, 0x0c, 0xc3, 0x98, 0x81, 0xc2, 0x13,
-            0xee, 0x77, 0x0b, 0x10, 0x10, 0xe4, 0xbe, 0xa7,
-            0x18, 0x84, 0x69, 0x77, 0xae, 0x11, 0x9f, 0x7a,
-            0x02, 0x3a, 0xb5, 0x8c, 0xca, 0x0a, 0xd7, 0x52,
-            0xaf, 0xe6, 0x56, 0xbb, 0x3c, 0x17, 0x25, 0x6a,
-            0x9f, 0x6e, 0x9b, 0xf1, 0x9f, 0xdd, 0x5a, 0x38,
-            0xfc, 0x82, 0xbb, 0xe8, 0x72, 0xc5, 0x53, 0x9e,
-            0xdb, 0x60, 0x9e, 0xf4, 0xf7, 0x9c, 0x20, 0x3e,
-            0xbb, 0x14, 0x0f, 0x2e, 0x58, 0x3c, 0xb2, 0xad,
-            0x15, 0xb4, 0xaa, 0x5b, 0x65, 0x50, 0x16, 0xa8,
-            0x44, 0x92, 0x77, 0xdb, 0xd4, 0x77, 0xef, 0x2c,
-            0x8d, 0x6c, 0x01, 0x7d, 0xb7, 0x38, 0xb1, 0x8d,
-            0xeb, 0x4a, 0x42, 0x7d, 0x19, 0x23, 0xce, 0x3f,
-            0xf2, 0x62, 0x73, 0x57, 0x79, 0xa4, 0x18, 0xf2,
-            0x0a, 0x28, 0x2d, 0xf9, 0x20, 0x14, 0x7b, 0xea,
-            0xbe, 0x42, 0x1e, 0xe5, 0x31, 0x9d, 0x05, 0x68,
-        }
-    },
-
-    /* #7, 32 byte key, 17 byte PTX */
-    {
-        "/crypto/xts/t-7-key-32-ptx-17",
-        32,
-        { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
-          0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0 },
-        { 0xbf, 0xbe, 0xbd, 0xbc, 0xbb, 0xba, 0xb9, 0xb8,
-          0xb7, 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1, 0xb0 },
-        0x123456789aLL,
-        17,
-        { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-          0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f, 0x10 },
-        { 0x6c, 0x16, 0x25, 0xdb, 0x46, 0x71, 0x52, 0x2d,
-          0x3d, 0x75, 0x99, 0x60, 0x1d, 0xe7, 0xca, 0x09, 0xed },
-    },
-
-    /* #15, 32 byte key, 25 byte PTX */
-    {
-        "/crypto/xts/t-15-key-32-ptx-25",
-        32,
-        { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
-          0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0 },
-        { 0xbf, 0xbe, 0xbd, 0xbc, 0xbb, 0xba, 0xb9, 0xb8,
-          0xb7, 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1, 0xb0 },
-        0x123456789aLL,
-        25,
-        { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-          0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-          0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17, 0x18 },
-        { 0x8f, 0x4d, 0xcb, 0xad, 0x55, 0x55, 0x8d, 0x7b,
-          0x4e, 0x01, 0xd9, 0x37, 0x9c, 0xd4, 0xea, 0x22,
-          0xed, 0xbf, 0x9d, 0xac, 0xe4, 0x5d, 0x6f, 0x6a, 0x73 },
-    },
-
-    /* #21, 32 byte key, 31 byte PTX */
-    {
-        "/crypto/xts/t-21-key-32-ptx-31",
-        32,
-        { 0xff, 0xfe, 0xfd, 0xfc, 0xfb, 0xfa, 0xf9, 0xf8,
-          0xf7, 0xf6, 0xf5, 0xf4, 0xf3, 0xf2, 0xf1, 0xf0 },
-        { 0xbf, 0xbe, 0xbd, 0xbc, 0xbb, 0xba, 0xb9, 0xb8,
-          0xb7, 0xb6, 0xb5, 0xb4, 0xb3, 0xb2, 0xb1, 0xb0 },
-        0x123456789aLL,
-        31,
-        { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
-          0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
-          0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16, 0x17,
-          0x18, 0x19, 0x1a, 0x1b, 0x1c, 0x1d, 0x1e },
-        { 0xd0, 0x5b, 0xc0, 0x90, 0xa8, 0xe0, 0x4f, 0x1b,
-          0x3d, 0x3e, 0xcd, 0xd5, 0xba, 0xec, 0x0f, 0xd4,
-          0xed, 0xbf, 0x9d, 0xac, 0xe4, 0x5d, 0x6f, 0x6a,
-          0x73, 0x06, 0xe6, 0x4b, 0xe5, 0xdd, 0x82 },
-    },
-};
-
-#define STORE64L(x, y)                                                  \
-    do {                                                                \
-        (y)[7] = (unsigned char)(((x) >> 56) & 255);                    \
-        (y)[6] = (unsigned char)(((x) >> 48) & 255);                    \
-        (y)[5] = (unsigned char)(((x) >> 40) & 255);                    \
-        (y)[4] = (unsigned char)(((x) >> 32) & 255);                    \
-        (y)[3] = (unsigned char)(((x) >> 24) & 255);                    \
-        (y)[2] = (unsigned char)(((x) >> 16) & 255);                    \
-        (y)[1] = (unsigned char)(((x) >> 8) & 255);                     \
-        (y)[0] = (unsigned char)((x) & 255);                            \
-    } while (0)
-
-struct TestAES {
-    AES_KEY enc;
-    AES_KEY dec;
-};
-
-static void test_xts_aes_encrypt(const void *ctx,
-                                 size_t length,
-                                 uint8_t *dst,
-                                 const uint8_t *src)
-{
-    const struct TestAES *aesctx = ctx;
-
-    AES_encrypt(src, dst, &aesctx->enc);
-}
-
-
-static void test_xts_aes_decrypt(const void *ctx,
-                                 size_t length,
-                                 uint8_t *dst,
-                                 const uint8_t *src)
-{
-    const struct TestAES *aesctx = ctx;
-
-    AES_decrypt(src, dst, &aesctx->dec);
-}
-
-
-static void test_xts(const void *opaque)
-{
-    const QCryptoXTSTestData *data = opaque;
-    uint8_t out[512], Torg[16], T[16];
-    uint64_t seq;
-    struct TestAES aesdata;
-    struct TestAES aestweak;
-
-    AES_set_encrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.enc);
-    AES_set_decrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.dec);
-    AES_set_encrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.enc);
-    AES_set_decrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.dec);
-
-    seq = data->seqnum;
-    STORE64L(seq, Torg);
-    memset(Torg + 8, 0, 8);
-
-    memcpy(T, Torg, sizeof(T));
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out, data->PTX);
-
-    g_assert(memcmp(out, data->CTX, data->PTLEN) == 0);
-
-    memcpy(T, Torg, sizeof(T));
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out, data->CTX);
-
-    g_assert(memcmp(out, data->PTX, data->PTLEN) == 0);
-}
-
-
-static void test_xts_split(const void *opaque)
-{
-    const QCryptoXTSTestData *data = opaque;
-    uint8_t out[512], Torg[16], T[16];
-    uint64_t seq;
-    unsigned long len = data->PTLEN / 2;
-    struct TestAES aesdata;
-    struct TestAES aestweak;
-
-    AES_set_encrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.enc);
-    AES_set_decrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.dec);
-    AES_set_encrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.enc);
-    AES_set_decrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.dec);
-
-    seq = data->seqnum;
-    STORE64L(seq, Torg);
-    memset(Torg + 8, 0, 8);
-
-    memcpy(T, Torg, sizeof(T));
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, len, out, data->PTX);
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, len, &out[len], &data->PTX[len]);
-
-    g_assert(memcmp(out, data->CTX, data->PTLEN) == 0);
-
-    memcpy(T, Torg, sizeof(T));
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, len, out, data->CTX);
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, len, &out[len], &data->CTX[len]);
-
-    g_assert(memcmp(out, data->PTX, data->PTLEN) == 0);
-}
-
-
-static void test_xts_unaligned(const void *opaque)
-{
-#define BAD_ALIGN 3
-    const QCryptoXTSTestData *data = opaque;
-    uint8_t in[512 + BAD_ALIGN], out[512 + BAD_ALIGN];
-    uint8_t Torg[16], T[16 + BAD_ALIGN];
-    uint64_t seq;
-    struct TestAES aesdata;
-    struct TestAES aestweak;
-
-    AES_set_encrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.enc);
-    AES_set_decrypt_key(data->key1, data->keylen / 2 * 8, &aesdata.dec);
-    AES_set_encrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.enc);
-    AES_set_decrypt_key(data->key2, data->keylen / 2 * 8, &aestweak.dec);
-
-    seq = data->seqnum;
-    STORE64L(seq, Torg);
-    memset(Torg + 8, 0, 8);
-
-    /* IV not aligned */
-    memcpy(T + BAD_ALIGN, Torg, 16);
-    memcpy(in, data->PTX, data->PTLEN);
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T + BAD_ALIGN, data->PTLEN, out, in);
-
-    g_assert(memcmp(out, data->CTX, data->PTLEN) == 0);
-
-    /* plain text not aligned */
-    memcpy(T, Torg, 16);
-    memcpy(in + BAD_ALIGN, data->PTX, data->PTLEN);
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out, in + BAD_ALIGN);
-
-    g_assert(memcmp(out, data->CTX, data->PTLEN) == 0);
-
-    /* cipher text not aligned */
-    memcpy(T, Torg, 16);
-    memcpy(in, data->PTX, data->PTLEN);
-    xts_encrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out + BAD_ALIGN, in);
-
-    g_assert(memcmp(out + BAD_ALIGN, data->CTX, data->PTLEN) == 0);
-
-
-    /* IV not aligned */
-    memcpy(T + BAD_ALIGN, Torg, 16);
-    memcpy(in, data->CTX, data->PTLEN);
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T + BAD_ALIGN, data->PTLEN, out, in);
-
-    g_assert(memcmp(out, data->PTX, data->PTLEN) == 0);
-
-    /* cipher text not aligned */
-    memcpy(T, Torg, 16);
-    memcpy(in + BAD_ALIGN, data->CTX, data->PTLEN);
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out, in + BAD_ALIGN);
-
-    g_assert(memcmp(out, data->PTX, data->PTLEN) == 0);
-
-    /* plain text not aligned */
-    memcpy(T, Torg, 16);
-    memcpy(in, data->CTX, data->PTLEN);
-    xts_decrypt(&aesdata, &aestweak,
-                test_xts_aes_encrypt,
-                test_xts_aes_decrypt,
-                T, data->PTLEN, out + BAD_ALIGN, in);
-
-    g_assert(memcmp(out + BAD_ALIGN, data->PTX, data->PTLEN) == 0);
-}
-
-
-int main(int argc, char **argv)
-{
-    size_t i;
-
-    g_test_init(&argc, &argv, NULL);
-
-    g_assert(qcrypto_init(NULL) == 0);
-
-    for (i = 0; i < G_N_ELEMENTS(test_data); i++) {
-        gchar *path = g_strdup_printf("%s/basic", test_data[i].path);
-        g_test_add_data_func(path, &test_data[i], test_xts);
-        g_free(path);
-
-        /* skip the cases where the length is smaller than 2*blocklen
-         * or the length is not a multiple of 32
-         */
-        if ((test_data[i].PTLEN >= 32) && !(test_data[i].PTLEN % 32)) {
-            path = g_strdup_printf("%s/split", test_data[i].path);
-            g_test_add_data_func(path, &test_data[i], test_xts_split);
-            g_free(path);
-        }
-
-        path = g_strdup_printf("%s/unaligned", test_data[i].path);
-        g_test_add_data_func(path, &test_data[i], test_xts_unaligned);
-        g_free(path);
-    }
-
-    return g_test_run();
-}

From 3821a538f7ec0a7973fa7b751dcea65d0b9b3213 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 19:54:08 +0000
Subject: [PATCH 1916/2396] crypto: remove redundant parameter checking CA
 certs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The only caller of qcrypto_tls_creds_check_authority_chain always
passes 'true' for the 'isCA' parameter. The point of this method
is to check the CA chani, so no other value would ever make sense.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index db2b74bafa..847fd4d9fa 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -315,7 +315,6 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
                                         unsigned int ncacerts,
                                         const char *cacertFile,
                                         bool isServer,
-                                        bool isCA,
                                         Error **errp)
 {
     gnutls_x509_crt_t cert_to_check = certs[ncerts - 1];
@@ -356,7 +355,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
              */
             return qcrypto_tls_creds_check_cert(
                 creds, cert_to_check, cacertFile,
-                isServer, isCA, errp);
+                isServer, true, errp);
         }
         for (int i = 0; i < ncacerts; i++) {
             if (gnutls_x509_crt_check_issuer(cert_to_check,
@@ -370,7 +369,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
         }
 
         if (qcrypto_tls_creds_check_cert(creds, cert_issuer, cacertFile,
-                                         isServer, isCA, errp) < 0) {
+                                         isServer, true, errp) < 0) {
             return -1;
         }
 
@@ -534,7 +533,7 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                                 certs, ncerts,
                                                 cacerts, ncacerts,
                                                 cacertFile, isServer,
-                                                true, errp) < 0) {
+                                                errp) < 0) {
         goto cleanup;
     }
 

From 0de19c148a1d1ffda8f18b342adb6133237279e4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 18:06:54 +0000
Subject: [PATCH 1917/2396] crypto: add missing free of certs array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 847fd4d9fa..75c70af522 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -550,6 +550,7 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     for (i = 0; i < ncerts; i++) {
         gnutls_x509_crt_deinit(certs[i]);
     }
+    g_free(certs);
     for (i = 0; i < ncacerts; i++) {
         gnutls_x509_crt_deinit(cacerts[i]);
     }

From 2114ae9faaabe4ff1c455811bb38085324af17b7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Fri, 1 Aug 2025 15:06:13 +0100
Subject: [PATCH 1918/2396] crypto: replace stat() with access() for credential
 checks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Readability of the credential files is what matters for our usage,
so access() is more appropriate than stat().

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 9e59594d67..208a7e6d8f 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -100,7 +100,6 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
                            char **cred,
                            Error **errp)
 {
-    struct stat sb;
     int ret = -1;
 
     if (!creds->dir) {
@@ -114,7 +113,7 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
 
     *cred = g_strdup_printf("%s/%s", creds->dir, filename);
 
-    if (stat(*cred, &sb) < 0) {
+    if (access(*cred, R_OK) < 0) {
         if (errno == ENOENT && !required) {
             ret = 0;
         } else {

From 9fe991d0a490e18c64b02540b141ad8c3e2a477e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 14:12:47 +0000
Subject: [PATCH 1919/2396] crypto: remove redundant access() checks before
 loading certs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The qcrypto_tls_creds_get_path method will perform an access()
check on the file and return a NULL path if it fails. By the
time we get to loading the cert files we know they must exist
on disk and thus the second access() check is redundant.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 22 ++++++++++------------
 1 file changed, 10 insertions(+), 12 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 75c70af522..0acb17b6ec 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -496,8 +496,7 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     size_t i;
     int ret = -1;
 
-    if (certFile &&
-        access(certFile, R_OK) == 0) {
+    if (certFile) {
         if (qcrypto_tls_creds_load_cert_list(creds,
                                              certFile,
                                              &certs,
@@ -508,16 +507,15 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
             goto cleanup;
         }
     }
-    if (access(cacertFile, R_OK) == 0) {
-        if (qcrypto_tls_creds_load_cert_list(creds,
-                                             cacertFile,
-                                             &cacerts,
-                                             &ncacerts,
-                                             isServer,
-                                             true,
-                                             errp) < 0) {
-            goto cleanup;
-        }
+
+    if (qcrypto_tls_creds_load_cert_list(creds,
+                                         cacertFile,
+                                         &cacerts,
+                                         &ncacerts,
+                                         isServer,
+                                         true,
+                                         errp) < 0) {
+        goto cleanup;
     }
 
     for (i = 0; i < ncerts; i++) {

From 9d3343b00bee063f3cc7f5bee35c953fd4e7b6ee Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 16 Oct 2025 19:00:29 +0100
Subject: [PATCH 1920/2396] crypto: move check for TLS creds 'dir' property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The check for the 'dir' property is being repeated for every
credential file to be loaded, but this results in incorrect
logic for optional credentials. The 'dir' property is mandatory
for PSK and x509 creds, even if some individual files are
optional. Address this by separating the check for the 'dir'
property.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c     | 9 ---------
 crypto/tlscredsanon.c | 3 ++-
 crypto/tlscredspsk.c  | 5 +++++
 crypto/tlscredsx509.c | 8 ++++++--
 4 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 208a7e6d8f..65e97ddd11 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -102,15 +102,6 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
 {
     int ret = -1;
 
-    if (!creds->dir) {
-        if (required) {
-            error_setg(errp, "Missing 'dir' property value");
-            return -1;
-        } else {
-            return 0;
-        }
-    }
-
     *cred = g_strdup_printf("%s/%s", creds->dir, filename);
 
     if (access(*cred, R_OK) < 0) {
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 44af9e6c9a..bc3351b5d6 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -43,7 +43,8 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
 
     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
+        if (creds->parent_obj.dir &&
+            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
                                        false, &dhparams, errp) < 0) {
             return -1;
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 5b68a6b7ba..545d3e45db 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -81,6 +81,11 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
     trace_qcrypto_tls_creds_psk_load(creds,
             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
 
+    if (!creds->parent_obj.dir) {
+        error_setg(errp, "Missing 'dir' property value");
+        goto cleanup;
+    }
+
     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
         if (creds->username) {
             error_setg(errp, "username should not be set when endpoint=server");
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 0acb17b6ec..8fe6cc8e93 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -567,8 +567,12 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     int ret;
     int rv = -1;
 
-    trace_qcrypto_tls_creds_x509_load(creds,
-            creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
+    if (!creds->parent_obj.dir) {
+        error_setg(errp, "Missing 'dir' property value");
+        return -1;
+    }
+
+    trace_qcrypto_tls_creds_x509_load(creds, creds->parent_obj.dir);
 
     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,

From 916501aa0720bf78b7dbf39b2548f2d4c4e46987 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 14:53:34 +0000
Subject: [PATCH 1921/2396] crypto: use g_autofree when loading x509
 credentials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows removal of goto jumps during loading of the credentials
and will simplify the diff in following commits.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 38 ++++++++++++++++----------------------
 1 file changed, 16 insertions(+), 22 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 8fe6cc8e93..6640159a5b 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -562,10 +562,12 @@ static int
 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                             Error **errp)
 {
-    char *cacert = NULL, *cacrl = NULL, *cert = NULL,
-        *key = NULL, *dhparams = NULL;
+    g_autofree char *cacert = NULL;
+    g_autofree char *cacrl = NULL;
+    g_autofree char *cert = NULL;
+    g_autofree char *key = NULL;
+    g_autofree char *dhparams = NULL;
     int ret;
-    int rv = -1;
 
     if (!creds->parent_obj.dir) {
         error_setg(errp, "Missing 'dir' property value");
@@ -590,7 +592,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
             qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
                                        false, &dhparams, errp) < 0) {
-            goto cleanup;
+            return -1;
         }
     } else {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
@@ -602,7 +604,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
             qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
                                        false, &key, errp) < 0) {
-            goto cleanup;
+            return -1;
         }
     }
 
@@ -610,14 +612,14 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         qcrypto_tls_creds_x509_sanity_check(creds,
             creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
             cacert, cert, errp) < 0) {
-        goto cleanup;
+        return -1;
     }
 
     ret = gnutls_certificate_allocate_credentials(&creds->data);
     if (ret < 0) {
         error_setg(errp, "Cannot allocate credentials: '%s'",
                    gnutls_strerror(ret));
-        goto cleanup;
+        return -1;
     }
 
     ret = gnutls_certificate_set_x509_trust_file(creds->data,
@@ -626,16 +628,16 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     if (ret < 0) {
         error_setg(errp, "Cannot load CA certificate '%s': %s",
                    cacert, gnutls_strerror(ret));
-        goto cleanup;
+        return -1;
     }
 
     if (cert != NULL && key != NULL) {
-        char *password = NULL;
+        g_autofree char *password = NULL;
         if (creds->passwordid) {
             password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
                                                      errp);
             if (!password) {
-                goto cleanup;
+                return -1;
             }
         }
         ret = gnutls_certificate_set_x509_key_file2(creds->data,
@@ -643,11 +645,10 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                                                     GNUTLS_X509_FMT_PEM,
                                                     password,
                                                     0);
-        g_free(password);
         if (ret < 0) {
             error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
                        cert, key, gnutls_strerror(ret));
-            goto cleanup;
+            return -1;
         }
     }
 
@@ -658,7 +659,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         if (ret < 0) {
             error_setg(errp, "Cannot load CRL '%s': %s",
                        cacrl, gnutls_strerror(ret));
-            goto cleanup;
+            return -1;
         }
     }
 
@@ -666,20 +667,13 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
                                                  &creds->parent_obj.dh_params,
                                                  errp) < 0) {
-            goto cleanup;
+            return -1;
         }
         gnutls_certificate_set_dh_params(creds->data,
                                          creds->parent_obj.dh_params);
     }
 
-    rv = 0;
- cleanup:
-    g_free(cacert);
-    g_free(cacrl);
-    g_free(cert);
-    g_free(key);
-    g_free(dhparams);
-    return rv;
+    return 0;
 }
 
 

From 20ee3064186d3a1eedcac0a76cc8af0993e36714 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 10:26:23 +0000
Subject: [PATCH 1922/2396] crypto: remove needless indirection via parent_obj
 field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The reload method already has a pointer to the parent object in
the 'creds' parameter that is passed in, so indirect access via
the subclass 'parent_obj' field is redundant.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 6640159a5b..2519f7690b 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -772,15 +772,15 @@ qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
     QCryptoTLSCredsX509 *x509_creds = QCRYPTO_TLS_CREDS_X509(creds);
     Error *local_err = NULL;
     gnutls_certificate_credentials_t creds_data = x509_creds->data;
-    gnutls_dh_params_t creds_dh_params = x509_creds->parent_obj.dh_params;
+    gnutls_dh_params_t creds_dh_params = creds->dh_params;
 
     x509_creds->data = NULL;
-    x509_creds->parent_obj.dh_params = NULL;
+    creds->dh_params = NULL;
     qcrypto_tls_creds_x509_load(x509_creds, &local_err);
     if (local_err) {
         qcrypto_tls_creds_x509_unload(x509_creds);
         x509_creds->data = creds_data;
-        x509_creds->parent_obj.dh_params = creds_dh_params;
+        creds->dh_params = creds_dh_params;
         error_propagate(errp, local_err);
         return false;
     }

From 11ea2bffda50b44610efeb355e8a261760c5e360 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 10:38:51 +0000
Subject: [PATCH 1923/2396] crypto: move release of DH parameters into TLS
 creds parent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code for releasing DH parameters is common to all credential
subclasses, and the unload function is only called from the
finalizers, except for x509 reload, so can be moved into the
parent with a little update of the reload method.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c     | 6 ++++++
 crypto/tlscredsanon.c | 4 ----
 crypto/tlscredspsk.c  | 4 ----
 crypto/tlscredsx509.c | 7 +++----
 4 files changed, 9 insertions(+), 12 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 65e97ddd11..a9e0caf864 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -246,6 +246,12 @@ qcrypto_tls_creds_finalize(Object *obj)
 {
     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 
+#ifdef CONFIG_GNUTLS
+    if (creds->dh_params) {
+        gnutls_dh_params_deinit(creds->dh_params);
+    }
+#endif
+
     g_free(creds->dir);
     g_free(creds->priority);
 }
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index bc3351b5d6..1ddfe4eb31 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -92,10 +92,6 @@ qcrypto_tls_creds_anon_unload(QCryptoTLSCredsAnon *creds)
             creds->data.server = NULL;
         }
     }
-    if (creds->parent_obj.dh_params) {
-        gnutls_dh_params_deinit(creds->parent_obj.dh_params);
-        creds->parent_obj.dh_params = NULL;
-    }
 }
 
 #else /* ! CONFIG_GNUTLS */
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 545d3e45db..bf4efe2114 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -175,10 +175,6 @@ qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds)
             creds->data.server = NULL;
         }
     }
-    if (creds->parent_obj.dh_params) {
-        gnutls_dh_params_deinit(creds->parent_obj.dh_params);
-        creds->parent_obj.dh_params = NULL;
-    }
 }
 
 #else /* ! CONFIG_GNUTLS */
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 2519f7690b..d93905ec77 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -684,10 +684,6 @@ qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
         gnutls_certificate_free_credentials(creds->data);
         creds->data = NULL;
     }
-    if (creds->parent_obj.dh_params) {
-        gnutls_dh_params_deinit(creds->parent_obj.dh_params);
-        creds->parent_obj.dh_params = NULL;
-    }
 }
 
 
@@ -779,6 +775,9 @@ qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
     qcrypto_tls_creds_x509_load(x509_creds, &local_err);
     if (local_err) {
         qcrypto_tls_creds_x509_unload(x509_creds);
+        if (creds->dh_params) {
+            gnutls_dh_params_deinit(creds->dh_params);
+        }
         x509_creds->data = creds_data;
         creds->dh_params = creds_dh_params;
         error_propagate(errp, local_err);

From 7751083fa4ecd5ef31b83ed7c17dcf13f3e617f2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 18:30:48 +0000
Subject: [PATCH 1924/2396] crypto: shorten the endpoint == server check in TLS
 creds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This eliminates a number of long lines aiding readability.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index d93905ec77..7271b549ee 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -567,6 +567,8 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     g_autofree char *cert = NULL;
     g_autofree char *key = NULL;
     g_autofree char *dhparams = NULL;
+    bool isServer = (creds->parent_obj.endpoint ==
+                     QCRYPTO_TLS_CREDS_ENDPOINT_SERVER);
     int ret;
 
     if (!creds->parent_obj.dir) {
@@ -576,7 +578,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
 
     trace_qcrypto_tls_creds_x509_load(creds, creds->parent_obj.dir);
 
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+    if (isServer) {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_X509_CA_CERT,
                                        true, &cacert, errp) < 0 ||
@@ -609,9 +611,8 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     }
 
     if (creds->sanityCheck &&
-        qcrypto_tls_creds_x509_sanity_check(creds,
-            creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER,
-            cacert, cert, errp) < 0) {
+        qcrypto_tls_creds_x509_sanity_check(creds, isServer,
+                                            cacert, cert, errp) < 0) {
         return -1;
     }
 
@@ -663,7 +664,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         }
     }
 
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+    if (isServer) {
         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
                                                  &creds->parent_obj.dh_params,
                                                  errp) < 0) {

From fb8a0b0bfc816fd26ba62d7cae22db890fdb5203 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Thu, 16 Oct 2025 19:32:39 +0100
Subject: [PATCH 1925/2396] crypto: remove duplication loading x509 CA cert
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The CA cert is mandatory in both client and server scenarios.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 7271b549ee..dd28faf872 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -578,11 +578,14 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
 
     trace_qcrypto_tls_creds_x509_load(creds, creds->parent_obj.dir);
 
+    if (qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                   QCRYPTO_TLS_CREDS_X509_CA_CERT,
+                                   true, &cacert, errp) < 0) {
+        return -1;
+    }
+
     if (isServer) {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
-                                       true, &cacert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_X509_CA_CRL,
                                        false, &cacrl, errp) < 0 ||
             qcrypto_tls_creds_get_path(&creds->parent_obj,
@@ -598,9 +601,6 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         }
     } else {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CA_CERT,
-                                       true, &cacert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
                                        false, &cert, errp) < 0 ||
             qcrypto_tls_creds_get_path(&creds->parent_obj,

From e82fccb4a37d84d75ebdbd78d15578a2321870d2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 10:06:12 +0000
Subject: [PATCH 1926/2396] crypto: reduce duplication in handling TLS priority
 strings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The logic for setting the TLS priority string on a session object has a
significant amount of logic duplication across the different credential
types. By recording the extra priority string suffix against the
credential class, we can introduce a common method for building the
priority string. The TLS session can now set the priority string without
caring about the credential type.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c         | 15 ++++++++++
 crypto/tlscredsanon.c     |  2 ++
 crypto/tlscredspsk.c      |  2 ++
 crypto/tlssession.c       | 60 ++++++---------------------------------
 include/crypto/tlscreds.h | 13 +++++++++
 5 files changed, 41 insertions(+), 51 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index a9e0caf864..c302b3cd72 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -268,6 +268,21 @@ bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds,
     return true;
 }
 
+
+char *qcrypto_tls_creds_get_priority(QCryptoTLSCreds *creds)
+{
+    QCryptoTLSCredsClass *tcc = QCRYPTO_TLS_CREDS_GET_CLASS(creds);
+    const char *priorityBase =
+        creds->priority ? creds->priority : CONFIG_TLS_PRIORITY;
+
+    if (tcc->prioritySuffix) {
+        return g_strdup_printf("%s:%s", priorityBase, tcc->prioritySuffix);
+    } else {
+        return g_strdup(priorityBase);
+    }
+}
+
+
 static const TypeInfo qcrypto_tls_creds_info = {
     .parent = TYPE_OBJECT,
     .name = TYPE_QCRYPTO_TLS_CREDS,
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 1ddfe4eb31..5c55b07b2f 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -137,8 +137,10 @@ static void
 qcrypto_tls_creds_anon_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
+    QCryptoTLSCredsClass *tcc = QCRYPTO_TLS_CREDS_CLASS(oc);
 
     ucc->complete = qcrypto_tls_creds_anon_complete;
+    tcc->prioritySuffix = "+ANON-DH";
 }
 
 
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index bf4efe2114..6c2feae077 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -240,8 +240,10 @@ static void
 qcrypto_tls_creds_psk_class_init(ObjectClass *oc, const void *data)
 {
     UserCreatableClass *ucc = USER_CREATABLE_CLASS(oc);
+    QCryptoTLSCredsClass *tcc = QCRYPTO_TLS_CREDS_CLASS(oc);
 
     ucc->complete = qcrypto_tls_creds_psk_complete;
+    tcc->prioritySuffix = "+ECDHE-PSK:+DHE-PSK:+PSK";
 
     object_class_property_add_str(oc, "username",
                                   qcrypto_tls_creds_psk_prop_get_username,
diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 92fe4f0380..77f334add3 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -155,9 +155,6 @@ qcrypto_tls_session_pull(void *opaque, void *buf, size_t len)
     }
 }
 
-#define TLS_PRIORITY_ADDITIONAL_ANON "+ANON-DH"
-#define TLS_PRIORITY_ADDITIONAL_PSK "+ECDHE-PSK:+DHE-PSK:+PSK"
-
 QCryptoTLSSession *
 qcrypto_tls_session_new(QCryptoTLSCreds *creds,
                         const char *hostname,
@@ -167,6 +164,7 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
 {
     QCryptoTLSSession *session;
     int ret;
+    g_autofree char *prio = NULL;
 
     session = g_new0(QCryptoTLSSession, 1);
     trace_qcrypto_tls_session_new(
@@ -200,28 +198,17 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
         goto error;
     }
 
+    prio = qcrypto_tls_creds_get_priority(creds);
+    ret = gnutls_priority_set_direct(session->handle, prio, NULL);
+    if (ret < 0) {
+        error_setg(errp, "Unable to set TLS session priority %s: %s",
+                   prio, gnutls_strerror(ret));
+        goto error;
+    }
+
     if (object_dynamic_cast(OBJECT(creds),
                             TYPE_QCRYPTO_TLS_CREDS_ANON)) {
         QCryptoTLSCredsAnon *acreds = QCRYPTO_TLS_CREDS_ANON(creds);
-        char *prio;
-
-        if (creds->priority != NULL) {
-            prio = g_strdup_printf("%s:%s",
-                                   creds->priority,
-                                   TLS_PRIORITY_ADDITIONAL_ANON);
-        } else {
-            prio = g_strdup(CONFIG_TLS_PRIORITY ":"
-                            TLS_PRIORITY_ADDITIONAL_ANON);
-        }
-
-        ret = gnutls_priority_set_direct(session->handle, prio, NULL);
-        if (ret < 0) {
-            error_setg(errp, "Unable to set TLS session priority %s: %s",
-                       prio, gnutls_strerror(ret));
-            g_free(prio);
-            goto error;
-        }
-        g_free(prio);
         if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
             ret = gnutls_credentials_set(session->handle,
                                          GNUTLS_CRD_ANON,
@@ -239,25 +226,6 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
     } else if (object_dynamic_cast(OBJECT(creds),
                                    TYPE_QCRYPTO_TLS_CREDS_PSK)) {
         QCryptoTLSCredsPSK *pcreds = QCRYPTO_TLS_CREDS_PSK(creds);
-        char *prio;
-
-        if (creds->priority != NULL) {
-            prio = g_strdup_printf("%s:%s",
-                                   creds->priority,
-                                   TLS_PRIORITY_ADDITIONAL_PSK);
-        } else {
-            prio = g_strdup(CONFIG_TLS_PRIORITY ":"
-                            TLS_PRIORITY_ADDITIONAL_PSK);
-        }
-
-        ret = gnutls_priority_set_direct(session->handle, prio, NULL);
-        if (ret < 0) {
-            error_setg(errp, "Unable to set TLS session priority %s: %s",
-                       prio, gnutls_strerror(ret));
-            g_free(prio);
-            goto error;
-        }
-        g_free(prio);
         if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
             ret = gnutls_credentials_set(session->handle,
                                          GNUTLS_CRD_PSK,
@@ -275,17 +243,7 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
     } else if (object_dynamic_cast(OBJECT(creds),
                                    TYPE_QCRYPTO_TLS_CREDS_X509)) {
         QCryptoTLSCredsX509 *tcreds = QCRYPTO_TLS_CREDS_X509(creds);
-        const char *prio = creds->priority;
-        if (!prio) {
-            prio = CONFIG_TLS_PRIORITY;
-        }
 
-        ret = gnutls_priority_set_direct(session->handle, prio, NULL);
-        if (ret < 0) {
-            error_setg(errp, "Cannot set default TLS session priority %s: %s",
-                       prio, gnutls_strerror(ret));
-            goto error;
-        }
         ret = gnutls_credentials_set(session->handle,
                                      GNUTLS_CRD_CERTIFICATE,
                                      tcreds->data);
diff --git a/include/crypto/tlscreds.h b/include/crypto/tlscreds.h
index 2a8a857010..afd1016088 100644
--- a/include/crypto/tlscreds.h
+++ b/include/crypto/tlscreds.h
@@ -47,6 +47,7 @@ typedef bool (*CryptoTLSCredsReload)(QCryptoTLSCreds *, Error **);
 struct QCryptoTLSCredsClass {
     ObjectClass parent_class;
     CryptoTLSCredsReload reload;
+    const char *prioritySuffix;
 };
 
 /**
@@ -64,4 +65,16 @@ bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds,
                                       QCryptoTLSCredsEndpoint endpoint,
                                       Error **errp);
 
+
+/**
+ * qcrypto_tls_creds_get_priority:
+ * @creds: pointer to a TLS credentials object
+ *
+ * Get the TLS credentials priority string. The caller
+ * must free the returned string when no longer required.
+ *
+ * Returns: a non-NULL priority string
+ */
+char *qcrypto_tls_creds_get_priority(QCryptoTLSCreds *creds);
+
 #endif /* QCRYPTO_TLSCREDS_H */

From a5d2bf4a875cc83dd10bca2a294f2df9104d874d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 30 Jul 2025 14:31:49 +0100
Subject: [PATCH 1927/2396] crypto: introduce method for reloading TLS creds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This prevents direct access of the class members by the VNC
display code.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c         | 15 +++++++++++++++
 include/crypto/tlscreds.h | 13 +++++++++++++
 ui/vnc.c                  |  9 +--------
 3 files changed, 29 insertions(+), 8 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index c302b3cd72..0db9bf6eeb 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -283,6 +283,21 @@ char *qcrypto_tls_creds_get_priority(QCryptoTLSCreds *creds)
 }
 
 
+bool qcrypto_tls_creds_reload(QCryptoTLSCreds *creds,
+                              Error **errp)
+{
+    QCryptoTLSCredsClass *credscls = QCRYPTO_TLS_CREDS_GET_CLASS(creds);
+
+    if (credscls->reload) {
+        return credscls->reload(creds, errp);
+    }
+
+    error_setg(errp, "%s does not support reloading credentials",
+               object_get_typename(OBJECT(creds)));
+    return false;
+}
+
+
 static const TypeInfo qcrypto_tls_creds_info = {
     .parent = TYPE_OBJECT,
     .name = TYPE_QCRYPTO_TLS_CREDS,
diff --git a/include/crypto/tlscreds.h b/include/crypto/tlscreds.h
index afd1016088..bb9280ed1a 100644
--- a/include/crypto/tlscreds.h
+++ b/include/crypto/tlscreds.h
@@ -77,4 +77,17 @@ bool qcrypto_tls_creds_check_endpoint(QCryptoTLSCreds *creds,
  */
 char *qcrypto_tls_creds_get_priority(QCryptoTLSCreds *creds);
 
+
+/**
+ * qcrypto_tls_creds_reload:
+ * @creds: pointer to a TLS credentials object
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Request a reload of the TLS credentials, if supported
+ *
+ * Returns: true on success, false on error or if not supported
+ */
+bool qcrypto_tls_creds_reload(QCryptoTLSCreds *creds,
+                              Error **errp);
+
 #endif /* QCRYPTO_TLSCREDS_H */
diff --git a/ui/vnc.c b/ui/vnc.c
index 0094ec680c..50016ff7ab 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -578,7 +578,6 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp)
 bool vnc_display_reload_certs(const char *id, Error **errp)
 {
     VncDisplay *vd = vnc_display_find(id);
-    QCryptoTLSCredsClass *creds = NULL;
 
     if (!vd) {
         error_setg(errp, "Can not find vnc display");
@@ -590,13 +589,7 @@ bool vnc_display_reload_certs(const char *id, Error **errp)
         return false;
     }
 
-    creds = QCRYPTO_TLS_CREDS_GET_CLASS(OBJECT(vd->tlscreds));
-    if (creds->reload == NULL) {
-        error_setg(errp, "%s doesn't support to reload TLS credential",
-                   object_get_typename(OBJECT(vd->tlscreds)));
-        return false;
-    }
-    if (!creds->reload(vd->tlscreds, errp)) {
+    if (!qcrypto_tls_creds_reload(vd->tlscreds, errp)) {
         return false;
     }
 

From 51e24d46e0181c42a1be498dea1cc0b473a8a76c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 08:45:28 +0000
Subject: [PATCH 1928/2396] crypto: introduce a wrapper around gnutls
 credentials
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The gnutls_credentials_set() method has a very suprising API contract
that requires the caller to preserve the passed in credentials pointer
for as long as the gnutls_session_t object is alive. QEMU is failing
to ensure this happens.

In QEMU the GNUTLS credentials object is owned by the QCryptoTLSCreds
object instance while the GNUTLS session object is owned by the
QCryptoTLSSession object instance. Their lifetimes are not guaranteed
to be the same, though in most common usage the credentials will outlive
the session. This is notably not the case, however, after the VNC server
gained the ability to reload credentials on the fly with:

  commit 1f08e3415120637cad7f540d9ceb4dba3136dbdd
  Author: Zihao Chang <changzihao1@huawei.com>
  Date:   Tue Mar 16 15:58:44 2021 +0800

    vnc: support reload x509 certificates for vnc

If that is triggered while a VNC client is in the middle of performing
a TLS handshake, we might hit a use-after-free.

It is difficult to correct this problem because there's no way to deep-
clone a GNUTLS credentials object, nor is it reference counted. Thus we
introduce a QCryptoTLSCredsBox object whose only purpose is to add
reference counting around the GNUTLS credentials object.

The DH parameters set against a credentials object also have to be kept
alive for as long as the credentials exist. So the box must also hold
the DH parameters pointer.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/meson.build   |   5 ++-
 crypto/tlscredsbox.c | 101 +++++++++++++++++++++++++++++++++++++++++++
 crypto/tlscredsbox.h |  50 +++++++++++++++++++++
 3 files changed, 155 insertions(+), 1 deletion(-)
 create mode 100644 crypto/tlscredsbox.c
 create mode 100644 crypto/tlscredsbox.h

diff --git a/crypto/meson.build b/crypto/meson.build
index 110c347033..b51597a879 100644
--- a/crypto/meson.build
+++ b/crypto/meson.build
@@ -25,7 +25,10 @@ crypto_ss.add(files(
 ))
 
 if gnutls.found()
-  crypto_ss.add(files('x509-utils.c'))
+  crypto_ss.add(files(
+    'tlscredsbox.c',
+    'x509-utils.c',
+  ))
 endif
 
 if nettle.found()
diff --git a/crypto/tlscredsbox.c b/crypto/tlscredsbox.c
new file mode 100644
index 0000000000..b8d9846af8
--- /dev/null
+++ b/crypto/tlscredsbox.c
@@ -0,0 +1,101 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * QEMU crypto TLS credential support
+ *
+ * Copyright (c) 2025 Red Hat, Inc.
+ */
+
+#include "qemu/osdep.h"
+#include "crypto/tlscredsbox.h"
+#include "qemu/atomic.h"
+
+
+static QCryptoTLSCredsBox *
+qcrypto_tls_creds_box_new_impl(int type, bool server)
+{
+    QCryptoTLSCredsBox *credsbox = g_new0(QCryptoTLSCredsBox, 1);
+    credsbox->ref = 1;
+    credsbox->server = server;
+    credsbox->type = type;
+    return credsbox;
+}
+
+
+QCryptoTLSCredsBox *
+qcrypto_tls_creds_box_new_server(int type)
+{
+    return qcrypto_tls_creds_box_new_impl(type, true);
+}
+
+
+QCryptoTLSCredsBox *
+qcrypto_tls_creds_box_new_client(int type)
+{
+    return qcrypto_tls_creds_box_new_impl(type, false);
+}
+
+static void qcrypto_tls_creds_box_free(QCryptoTLSCredsBox *credsbox)
+{
+    switch (credsbox->type) {
+    case GNUTLS_CRD_CERTIFICATE:
+        if (credsbox->data.cert) {
+            gnutls_certificate_free_credentials(credsbox->data.cert);
+        }
+        break;
+    case GNUTLS_CRD_PSK:
+        if (credsbox->server) {
+            if (credsbox->data.pskserver) {
+                gnutls_psk_free_server_credentials(credsbox->data.pskserver);
+            }
+        } else {
+            if (credsbox->data.pskclient) {
+                gnutls_psk_free_client_credentials(credsbox->data.pskclient);
+            }
+        }
+        break;
+    case GNUTLS_CRD_ANON:
+        if (credsbox->server) {
+            if (credsbox->data.anonserver) {
+                gnutls_anon_free_server_credentials(credsbox->data.anonserver);
+            }
+        } else {
+            if (credsbox->data.anonclient) {
+                gnutls_anon_free_client_credentials(credsbox->data.anonclient);
+            }
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (credsbox->dh_params) {
+        gnutls_dh_params_deinit(credsbox->dh_params);
+    }
+
+    g_free(credsbox);
+}
+
+
+void qcrypto_tls_creds_box_ref(QCryptoTLSCredsBox *credsbox)
+{
+    uint32_t ref = qatomic_fetch_inc(&credsbox->ref);
+    /* Assert waaay before the integer overflows */
+    g_assert(ref < INT_MAX);
+}
+
+
+void qcrypto_tls_creds_box_unref(QCryptoTLSCredsBox *credsbox)
+{
+    if (!credsbox) {
+        return;
+    }
+
+    g_assert(credsbox->ref > 0);
+
+    if (qatomic_fetch_dec(&credsbox->ref) == 1) {
+        qcrypto_tls_creds_box_free(credsbox);
+    }
+
+}
+
diff --git a/crypto/tlscredsbox.h b/crypto/tlscredsbox.h
new file mode 100644
index 0000000000..eeb54d1eeb
--- /dev/null
+++ b/crypto/tlscredsbox.h
@@ -0,0 +1,50 @@
+/*
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ *
+ * QEMU crypto TLS credential support
+ *
+ * Copyright (c) 2025 Red Hat, Inc.
+ */
+
+#ifndef QCRYPTO_TLSCREDS_BOX_H
+#define QCRYPTO_TLSCREDS_BOX_H
+
+#include "qom/object.h"
+
+#ifdef CONFIG_GNUTLS
+#include <gnutls/gnutls.h>
+#endif
+
+typedef struct QCryptoTLSCredsBox QCryptoTLSCredsBox;
+
+struct QCryptoTLSCredsBox {
+    uint32_t ref;
+    bool server;
+    int type;
+    union {
+        void *any;
+#ifdef CONFIG_GNUTLS
+        /*
+         * All of these gnutls_XXXX_credentials_t types are
+         * pointers, hence matching the 'any' field above
+         */
+        gnutls_anon_server_credentials_t anonserver;
+        gnutls_anon_client_credentials_t anonclient;
+        gnutls_psk_server_credentials_t pskserver;
+        gnutls_psk_client_credentials_t pskclient;
+        gnutls_certificate_credentials_t cert;
+#endif
+    } data;
+#ifdef CONFIG_GNUTLS
+    gnutls_dh_params_t dh_params;
+#endif
+};
+
+QCryptoTLSCredsBox *qcrypto_tls_creds_box_new_server(int type);
+QCryptoTLSCredsBox *qcrypto_tls_creds_box_new_client(int type);
+void qcrypto_tls_creds_box_ref(QCryptoTLSCredsBox *credsbox);
+void qcrypto_tls_creds_box_unref(QCryptoTLSCredsBox *credsbox);
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSCredsBox, qcrypto_tls_creds_box_unref);
+
+#endif /* QCRYPTO_TLSCREDS_BOX_H */

From 70f9fd8dbf7233bee497055a9b7825e3729ce853 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 09:50:02 +0000
Subject: [PATCH 1929/2396] crypto: fix lifecycle handling of gnutls
 credentials objects
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As described in the previous commit, the gnutls credentials need to
be kept alive for as long as the gnutls session object exists. Convert
the QCryptoTLSCreds objects to use QCryptoTLSCredsBox and holding the
gnutls credential objects. When loading the credentials into a gnutls
session, store a reference to the box into the QCryptoTLSSession object.

This has the useful side effect that the QCryptoTLSSession code no
longer needs to know about all the different credential types, it can
use the generic pointer stored in the box.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c     |  5 +--
 crypto/tlscredsanon.c | 48 +++++--------------------
 crypto/tlscredspriv.h | 20 ++---------
 crypto/tlscredspsk.c  | 46 ++++++++----------------
 crypto/tlscredsx509.c | 71 +++++++++++++------------------------
 crypto/tlssession.c   | 82 ++++++++++++++-----------------------------
 6 files changed, 76 insertions(+), 196 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 0db9bf6eeb..9912e3ffbf 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -247,11 +247,8 @@ qcrypto_tls_creds_finalize(Object *obj)
     QCryptoTLSCreds *creds = QCRYPTO_TLS_CREDS(obj);
 
 #ifdef CONFIG_GNUTLS
-    if (creds->dh_params) {
-        gnutls_dh_params_deinit(creds->dh_params);
-    }
+    qcrypto_tls_creds_box_unref(creds->box);
 #endif
-
     g_free(creds->dir);
     g_free(creds->priority);
 }
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 5c55b07b2f..0a728ccbf6 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -36,6 +36,7 @@ static int
 qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
                             Error **errp)
 {
+    g_autoptr(QCryptoTLSCredsBox) box = NULL;
     g_autofree char *dhparams = NULL;
     int ret;
 
@@ -43,6 +44,8 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
             creds->parent_obj.dir ? creds->parent_obj.dir : "<nodir>");
 
     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+        box = qcrypto_tls_creds_box_new_server(GNUTLS_CRD_ANON);
+
         if (creds->parent_obj.dir &&
             qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
@@ -50,7 +53,7 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
             return -1;
         }
 
-        ret = gnutls_anon_allocate_server_credentials(&creds->data.server);
+        ret = gnutls_anon_allocate_server_credentials(&box->data.anonserver);
         if (ret < 0) {
             error_setg(errp, "Cannot allocate credentials: %s",
                        gnutls_strerror(ret));
@@ -58,42 +61,26 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
         }
 
         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
-                                                 &creds->parent_obj.dh_params,
-                                                 errp) < 0) {
+                                                 &box->dh_params, errp) < 0) {
             return -1;
         }
 
-        gnutls_anon_set_server_dh_params(creds->data.server,
-                                         creds->parent_obj.dh_params);
+        gnutls_anon_set_server_dh_params(box->data.anonserver,
+                                         box->dh_params);
     } else {
-        ret = gnutls_anon_allocate_client_credentials(&creds->data.client);
+        ret = gnutls_anon_allocate_client_credentials(&box->data.anonclient);
         if (ret < 0) {
             error_setg(errp, "Cannot allocate credentials: %s",
                        gnutls_strerror(ret));
             return -1;
         }
     }
+    creds->parent_obj.box = g_steal_pointer(&box);
 
     return 0;
 }
 
 
-static void
-qcrypto_tls_creds_anon_unload(QCryptoTLSCredsAnon *creds)
-{
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
-        if (creds->data.client) {
-            gnutls_anon_free_client_credentials(creds->data.client);
-            creds->data.client = NULL;
-        }
-    } else {
-        if (creds->data.server) {
-            gnutls_anon_free_server_credentials(creds->data.server);
-            creds->data.server = NULL;
-        }
-    }
-}
-
 #else /* ! CONFIG_GNUTLS */
 
 
@@ -105,13 +92,6 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds G_GNUC_UNUSED,
 }
 
 
-static void
-qcrypto_tls_creds_anon_unload(QCryptoTLSCredsAnon *creds G_GNUC_UNUSED)
-{
-    /* nada */
-}
-
-
 #endif /* ! CONFIG_GNUTLS */
 
 
@@ -124,15 +104,6 @@ qcrypto_tls_creds_anon_complete(UserCreatable *uc, Error **errp)
 }
 
 
-static void
-qcrypto_tls_creds_anon_finalize(Object *obj)
-{
-    QCryptoTLSCredsAnon *creds = QCRYPTO_TLS_CREDS_ANON(obj);
-
-    qcrypto_tls_creds_anon_unload(creds);
-}
-
-
 static void
 qcrypto_tls_creds_anon_class_init(ObjectClass *oc, const void *data)
 {
@@ -148,7 +119,6 @@ static const TypeInfo qcrypto_tls_creds_anon_info = {
     .parent = TYPE_QCRYPTO_TLS_CREDS,
     .name = TYPE_QCRYPTO_TLS_CREDS_ANON,
     .instance_size = sizeof(QCryptoTLSCredsAnon),
-    .instance_finalize = qcrypto_tls_creds_anon_finalize,
     .class_size = sizeof(QCryptoTLSCredsAnonClass),
     .class_init = qcrypto_tls_creds_anon_class_init,
     .interfaces = (const InterfaceInfo[]) {
diff --git a/crypto/tlscredspriv.h b/crypto/tlscredspriv.h
index df9815a286..4e6dffa22f 100644
--- a/crypto/tlscredspriv.h
+++ b/crypto/tlscredspriv.h
@@ -22,6 +22,7 @@
 #define QCRYPTO_TLSCREDSPRIV_H
 
 #include "crypto/tlscreds.h"
+#include "crypto/tlscredsbox.h"
 
 #ifdef CONFIG_GNUTLS
 #include <gnutls/gnutls.h>
@@ -31,39 +32,22 @@ struct QCryptoTLSCreds {
     Object parent_obj;
     char *dir;
     QCryptoTLSCredsEndpoint endpoint;
-#ifdef CONFIG_GNUTLS
-    gnutls_dh_params_t dh_params;
-#endif
     bool verifyPeer;
     char *priority;
+    QCryptoTLSCredsBox *box;
 };
 
 struct QCryptoTLSCredsAnon {
     QCryptoTLSCreds parent_obj;
-#ifdef CONFIG_GNUTLS
-    union {
-        gnutls_anon_server_credentials_t server;
-        gnutls_anon_client_credentials_t client;
-    } data;
-#endif
 };
 
 struct QCryptoTLSCredsPSK {
     QCryptoTLSCreds parent_obj;
     char *username;
-#ifdef CONFIG_GNUTLS
-    union {
-        gnutls_psk_server_credentials_t server;
-        gnutls_psk_client_credentials_t client;
-    } data;
-#endif
 };
 
 struct QCryptoTLSCredsX509 {
     QCryptoTLSCreds parent_obj;
-#ifdef CONFIG_GNUTLS
-    gnutls_certificate_credentials_t data;
-#endif
     bool sanityCheck;
     char *passwordid;
 };
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 6c2feae077..5568f1ad0c 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -71,6 +71,7 @@ static int
 qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
                            Error **errp)
 {
+    g_autoptr(QCryptoTLSCredsBox) box = NULL;
     g_autofree char *pskfile = NULL;
     g_autofree char *dhparams = NULL;
     const char *username;
@@ -87,6 +88,8 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
     }
 
     if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+        box = qcrypto_tls_creds_box_new_server(GNUTLS_CRD_PSK);
+
         if (creds->username) {
             error_setg(errp, "username should not be set when endpoint=server");
             goto cleanup;
@@ -101,7 +104,7 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
             goto cleanup;
         }
 
-        ret = gnutls_psk_allocate_server_credentials(&creds->data.server);
+        ret = gnutls_psk_allocate_server_credentials(&box->data.pskserver);
         if (ret < 0) {
             error_setg(errp, "Cannot allocate credentials: %s",
                        gnutls_strerror(ret));
@@ -109,20 +112,23 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
         }
 
         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
-                                                 &creds->parent_obj.dh_params,
+                                                 &box->dh_params,
                                                  errp) < 0) {
             goto cleanup;
         }
 
-        ret = gnutls_psk_set_server_credentials_file(creds->data.server, pskfile);
+        ret = gnutls_psk_set_server_credentials_file(box->data.pskserver,
+                                                     pskfile);
         if (ret < 0) {
             error_setg(errp, "Cannot set PSK server credentials: %s",
                        gnutls_strerror(ret));
             goto cleanup;
         }
-        gnutls_psk_set_server_dh_params(creds->data.server,
-                                        creds->parent_obj.dh_params);
+        gnutls_psk_set_server_dh_params(box->data.pskserver,
+                                        box->dh_params);
     } else {
+        box = qcrypto_tls_creds_box_new_client(GNUTLS_CRD_PSK);
+
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_PSKFILE,
                                        true, &pskfile, errp) < 0) {
@@ -138,14 +144,14 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
             goto cleanup;
         }
 
-        ret = gnutls_psk_allocate_client_credentials(&creds->data.client);
+        ret = gnutls_psk_allocate_client_credentials(&box->data.pskclient);
         if (ret < 0) {
             error_setg(errp, "Cannot allocate credentials: %s",
                        gnutls_strerror(ret));
             goto cleanup;
         }
 
-        ret = gnutls_psk_set_client_credentials(creds->data.client,
+        ret = gnutls_psk_set_client_credentials(box->data.pskclient,
                                                 username, &key, GNUTLS_PSK_KEY_HEX);
         if (ret < 0) {
             error_setg(errp, "Cannot set PSK client credentials: %s",
@@ -153,6 +159,7 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
             goto cleanup;
         }
     }
+    creds->parent_obj.box = g_steal_pointer(&box);
 
     rv = 0;
  cleanup:
@@ -160,23 +167,6 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
     return rv;
 }
 
-
-static void
-qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds)
-{
-    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_CLIENT) {
-        if (creds->data.client) {
-            gnutls_psk_free_client_credentials(creds->data.client);
-            creds->data.client = NULL;
-        }
-    } else {
-        if (creds->data.server) {
-            gnutls_psk_free_server_credentials(creds->data.server);
-            creds->data.server = NULL;
-        }
-    }
-}
-
 #else /* ! CONFIG_GNUTLS */
 
 
@@ -188,13 +178,6 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED,
 }
 
 
-static void
-qcrypto_tls_creds_psk_unload(QCryptoTLSCredsPSK *creds G_GNUC_UNUSED)
-{
-    /* nada */
-}
-
-
 #endif /* ! CONFIG_GNUTLS */
 
 
@@ -212,7 +195,6 @@ qcrypto_tls_creds_psk_finalize(Object *obj)
 {
     QCryptoTLSCredsPSK *creds = QCRYPTO_TLS_CREDS_PSK(obj);
 
-    qcrypto_tls_creds_psk_unload(creds);
     g_free(creds->username);
 }
 
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index dd28faf872..388ddb7f0e 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -562,6 +562,7 @@ static int
 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                             Error **errp)
 {
+    g_autoptr(QCryptoTLSCredsBox) box = NULL;
     g_autofree char *cacert = NULL;
     g_autofree char *cacrl = NULL;
     g_autofree char *cert = NULL;
@@ -578,6 +579,19 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
 
     trace_qcrypto_tls_creds_x509_load(creds, creds->parent_obj.dir);
 
+    if (creds->parent_obj.endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+        box = qcrypto_tls_creds_box_new_server(GNUTLS_CRD_CERTIFICATE);
+    } else {
+        box = qcrypto_tls_creds_box_new_client(GNUTLS_CRD_CERTIFICATE);
+    }
+
+    ret = gnutls_certificate_allocate_credentials(&box->data.cert);
+    if (ret < 0) {
+        error_setg(errp, "Cannot allocate credentials: '%s'",
+                   gnutls_strerror(ret));
+        return -1;
+    }
+
     if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                    QCRYPTO_TLS_CREDS_X509_CA_CERT,
                                    true, &cacert, errp) < 0) {
@@ -616,14 +630,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         return -1;
     }
 
-    ret = gnutls_certificate_allocate_credentials(&creds->data);
-    if (ret < 0) {
-        error_setg(errp, "Cannot allocate credentials: '%s'",
-                   gnutls_strerror(ret));
-        return -1;
-    }
-
-    ret = gnutls_certificate_set_x509_trust_file(creds->data,
+    ret = gnutls_certificate_set_x509_trust_file(box->data.cert,
                                                  cacert,
                                                  GNUTLS_X509_FMT_PEM);
     if (ret < 0) {
@@ -641,7 +648,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                 return -1;
             }
         }
-        ret = gnutls_certificate_set_x509_key_file2(creds->data,
+        ret = gnutls_certificate_set_x509_key_file2(box->data.cert,
                                                     cert, key,
                                                     GNUTLS_X509_FMT_PEM,
                                                     password,
@@ -654,7 +661,7 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     }
 
     if (cacrl != NULL) {
-        ret = gnutls_certificate_set_x509_crl_file(creds->data,
+        ret = gnutls_certificate_set_x509_crl_file(box->data.cert,
                                                    cacrl,
                                                    GNUTLS_X509_FMT_PEM);
         if (ret < 0) {
@@ -666,28 +673,18 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
 
     if (isServer) {
         if (qcrypto_tls_creds_get_dh_params_file(&creds->parent_obj, dhparams,
-                                                 &creds->parent_obj.dh_params,
+                                                 &box->dh_params,
                                                  errp) < 0) {
             return -1;
         }
-        gnutls_certificate_set_dh_params(creds->data,
-                                         creds->parent_obj.dh_params);
+        gnutls_certificate_set_dh_params(box->data.cert, box->dh_params);
     }
+    creds->parent_obj.box = g_steal_pointer(&box);
 
     return 0;
 }
 
 
-static void
-qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds)
-{
-    if (creds->data) {
-        gnutls_certificate_free_credentials(creds->data);
-        creds->data = NULL;
-    }
-}
-
-
 #else /* ! CONFIG_GNUTLS */
 
 
@@ -699,13 +696,6 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED,
 }
 
 
-static void
-qcrypto_tls_creds_x509_unload(QCryptoTLSCredsX509 *creds G_GNUC_UNUSED)
-{
-    /* nada */
-}
-
-
 #endif /* ! CONFIG_GNUTLS */
 
 
@@ -768,29 +758,17 @@ qcrypto_tls_creds_x509_reload(QCryptoTLSCreds *creds, Error **errp)
 {
     QCryptoTLSCredsX509 *x509_creds = QCRYPTO_TLS_CREDS_X509(creds);
     Error *local_err = NULL;
-    gnutls_certificate_credentials_t creds_data = x509_creds->data;
-    gnutls_dh_params_t creds_dh_params = creds->dh_params;
+    QCryptoTLSCredsBox *creds_box = creds->box;
 
-    x509_creds->data = NULL;
-    creds->dh_params = NULL;
+    creds->box = NULL;
     qcrypto_tls_creds_x509_load(x509_creds, &local_err);
     if (local_err) {
-        qcrypto_tls_creds_x509_unload(x509_creds);
-        if (creds->dh_params) {
-            gnutls_dh_params_deinit(creds->dh_params);
-        }
-        x509_creds->data = creds_data;
-        creds->dh_params = creds_dh_params;
+        creds->box = creds_box;
         error_propagate(errp, local_err);
         return false;
     }
 
-    if (creds_data) {
-        gnutls_certificate_free_credentials(creds_data);
-    }
-    if (creds_dh_params) {
-        gnutls_dh_params_deinit(creds_dh_params);
-    }
+    qcrypto_tls_creds_box_unref(creds_box);
     return true;
 }
 
@@ -823,7 +801,6 @@ qcrypto_tls_creds_x509_finalize(Object *obj)
     QCryptoTLSCredsX509 *creds = QCRYPTO_TLS_CREDS_X509(obj);
 
     g_free(creds->passwordid);
-    qcrypto_tls_creds_x509_unload(creds);
 }
 
 
diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index 77f334add3..a1dc3b3ce0 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -38,6 +38,7 @@
 
 struct QCryptoTLSSession {
     QCryptoTLSCreds *creds;
+    QCryptoTLSCredsBox *credsbox;
     gnutls_session_t handle;
     char *hostname;
     char *authzid;
@@ -78,6 +79,7 @@ qcrypto_tls_session_free(QCryptoTLSSession *session)
     g_free(session->hostname);
     g_free(session->peername);
     g_free(session->authzid);
+    qcrypto_tls_creds_box_unref(session->credsbox);
     object_unref(OBJECT(session->creds));
     qemu_mutex_destroy(&session->lock);
     g_free(session);
@@ -206,65 +208,33 @@ qcrypto_tls_session_new(QCryptoTLSCreds *creds,
         goto error;
     }
 
-    if (object_dynamic_cast(OBJECT(creds),
-                            TYPE_QCRYPTO_TLS_CREDS_ANON)) {
-        QCryptoTLSCredsAnon *acreds = QCRYPTO_TLS_CREDS_ANON(creds);
-        if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_ANON,
-                                         acreds->data.server);
-        } else {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_ANON,
-                                         acreds->data.client);
-        }
-        if (ret < 0) {
-            error_setg(errp, "Cannot set session credentials: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-    } else if (object_dynamic_cast(OBJECT(creds),
-                                   TYPE_QCRYPTO_TLS_CREDS_PSK)) {
-        QCryptoTLSCredsPSK *pcreds = QCRYPTO_TLS_CREDS_PSK(creds);
-        if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_PSK,
-                                         pcreds->data.server);
-        } else {
-            ret = gnutls_credentials_set(session->handle,
-                                         GNUTLS_CRD_PSK,
-                                         pcreds->data.client);
-        }
-        if (ret < 0) {
-            error_setg(errp, "Cannot set session credentials: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-    } else if (object_dynamic_cast(OBJECT(creds),
-                                   TYPE_QCRYPTO_TLS_CREDS_X509)) {
-        QCryptoTLSCredsX509 *tcreds = QCRYPTO_TLS_CREDS_X509(creds);
-
-        ret = gnutls_credentials_set(session->handle,
-                                     GNUTLS_CRD_CERTIFICATE,
-                                     tcreds->data);
-        if (ret < 0) {
-            error_setg(errp, "Cannot set session credentials: %s",
-                       gnutls_strerror(ret));
-            goto error;
-        }
-
-        if (creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
-            /* This requests, but does not enforce a client cert.
-             * The cert checking code later does enforcement */
-            gnutls_certificate_server_set_request(session->handle,
-                                                  GNUTLS_CERT_REQUEST);
-        }
-    } else {
-        error_setg(errp, "Unsupported TLS credentials type %s",
-                   object_get_typename(OBJECT(creds)));
+    ret = gnutls_credentials_set(session->handle,
+                                 creds->box->type,
+                                 creds->box->data.any);
+    if (ret < 0) {
+        error_setg(errp, "Cannot set session credentials: %s",
+                   gnutls_strerror(ret));
         goto error;
     }
 
+    /*
+     * creds->box->data.any must be kept alive for as long
+     * as the gnutls_session_t is alive, so acquire a ref
+     */
+    qcrypto_tls_creds_box_ref(creds->box);
+    session->credsbox = creds->box;
+
+    if (object_dynamic_cast(OBJECT(creds),
+                            TYPE_QCRYPTO_TLS_CREDS_X509) &&
+        creds->endpoint == QCRYPTO_TLS_CREDS_ENDPOINT_SERVER) {
+        /*
+         * This requests, but does not enforce a client cert.
+         * The cert checking code later does enforcement
+         */
+        gnutls_certificate_server_set_request(session->handle,
+                                              GNUTLS_CERT_REQUEST);
+    }
+
     gnutls_transport_set_ptr(session->handle, session);
     gnutls_transport_set_push_function(session->handle,
                                        qcrypto_tls_session_push);

From fac244b0190bbffa7ff6811549ff1cea1ecbb3a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 15:24:25 +0000
Subject: [PATCH 1930/2396] crypto: make TLS credentials structs private
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now that the TLS session code no longer needs to look at the TLS
credential structs, they can be made private.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsanon.c |  5 ++++-
 crypto/tlscredspriv.h | 15 ---------------
 crypto/tlscredspsk.c  |  5 +++++
 crypto/tlscredsx509.c |  6 ++++++
 4 files changed, 15 insertions(+), 16 deletions(-)

diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 0a728ccbf6..646574d6ae 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -27,11 +27,14 @@
 #include "trace.h"
 
 
+struct QCryptoTLSCredsAnon {
+    QCryptoTLSCreds parent_obj;
+};
+
 #ifdef CONFIG_GNUTLS
 
 #include <gnutls/gnutls.h>
 
-
 static int
 qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
                             Error **errp)
diff --git a/crypto/tlscredspriv.h b/crypto/tlscredspriv.h
index 4e6dffa22f..69dac02437 100644
--- a/crypto/tlscredspriv.h
+++ b/crypto/tlscredspriv.h
@@ -37,21 +37,6 @@ struct QCryptoTLSCreds {
     QCryptoTLSCredsBox *box;
 };
 
-struct QCryptoTLSCredsAnon {
-    QCryptoTLSCreds parent_obj;
-};
-
-struct QCryptoTLSCredsPSK {
-    QCryptoTLSCreds parent_obj;
-    char *username;
-};
-
-struct QCryptoTLSCredsX509 {
-    QCryptoTLSCreds parent_obj;
-    bool sanityCheck;
-    char *passwordid;
-};
-
 #ifdef CONFIG_GNUTLS
 
 int qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 5568f1ad0c..8879c84ea7 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -27,6 +27,11 @@
 #include "trace.h"
 
 
+struct QCryptoTLSCredsPSK {
+    QCryptoTLSCreds parent_obj;
+    char *username;
+};
+
 #ifdef CONFIG_GNUTLS
 
 #include <gnutls/gnutls.h>
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 388ddb7f0e..397ff4caa9 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -28,6 +28,12 @@
 #include "trace.h"
 
 
+struct QCryptoTLSCredsX509 {
+    QCryptoTLSCreds parent_obj;
+    bool sanityCheck;
+    char *passwordid;
+};
+
 #ifdef CONFIG_GNUTLS
 
 #include <gnutls/gnutls.h>

From d58f9b20c71caec2a4ce271dadb5d6a6d9444875 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 14:07:57 +0000
Subject: [PATCH 1931/2396] crypto: deprecate use of external dh-params.pem
 file
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

GNUTLS has deprecated use of externally provided diffie-hellman
parameters. Since 3.6.0 it will automatically negotiate DH params
in accordance with RFC7919.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c         | 24 ++++++++----------------
 crypto/tlscredsanon.c     |  6 ++++--
 crypto/tlscredspsk.c      |  6 ++++--
 crypto/tlscredsx509.c     |  4 +++-
 docs/about/deprecated.rst |  9 +++++++++
 docs/system/tls.rst       | 12 +++++++-----
 6 files changed, 35 insertions(+), 26 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 9912e3ffbf..3d25efe425 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -22,6 +22,7 @@
 #include "qapi/error.h"
 #include "qapi-types-crypto.h"
 #include "qemu/module.h"
+#include "qemu/error-report.h"
 #include "tlscredspriv.h"
 #include "trace.h"
 
@@ -38,22 +39,7 @@ qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
 
     trace_qcrypto_tls_creds_load_dh(creds, filename ? filename : "<generated>");
 
-    if (filename == NULL) {
-        ret = gnutls_dh_params_init(dh_params);
-        if (ret < 0) {
-            error_setg(errp, "Unable to initialize DH parameters: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-        ret = gnutls_dh_params_generate2(*dh_params, DH_BITS);
-        if (ret < 0) {
-            gnutls_dh_params_deinit(*dh_params);
-            *dh_params = NULL;
-            error_setg(errp, "Unable to generate DH parameters: %s",
-                       gnutls_strerror(ret));
-            return -1;
-        }
-    } else {
+    if (filename != NULL) {
         GError *gerr = NULL;
         gchar *contents;
         gsize len;
@@ -67,6 +53,10 @@ qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
             g_error_free(gerr);
             return -1;
         }
+        warn_report_once("Use of an external DH parameters file '%s' is "
+                         "deprecated and will be removed in a future release",
+                         filename);
+
         data.data = (unsigned char *)contents;
         data.size = len;
         ret = gnutls_dh_params_init(dh_params);
@@ -87,6 +77,8 @@ qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
                        filename, gnutls_strerror(ret));
             return -1;
         }
+    } else {
+        *dh_params = NULL;
     }
 
     return 0;
diff --git a/crypto/tlscredsanon.c b/crypto/tlscredsanon.c
index 646574d6ae..1551382e1f 100644
--- a/crypto/tlscredsanon.c
+++ b/crypto/tlscredsanon.c
@@ -68,8 +68,10 @@ qcrypto_tls_creds_anon_load(QCryptoTLSCredsAnon *creds,
             return -1;
         }
 
-        gnutls_anon_set_server_dh_params(box->data.anonserver,
-                                         box->dh_params);
+        if (box->dh_params) {
+            gnutls_anon_set_server_dh_params(box->data.anonserver,
+                                             box->dh_params);
+        }
     } else {
         ret = gnutls_anon_allocate_client_credentials(&box->data.anonclient);
         if (ret < 0) {
diff --git a/crypto/tlscredspsk.c b/crypto/tlscredspsk.c
index 8879c84ea7..e1b1e1a613 100644
--- a/crypto/tlscredspsk.c
+++ b/crypto/tlscredspsk.c
@@ -129,8 +129,10 @@ qcrypto_tls_creds_psk_load(QCryptoTLSCredsPSK *creds,
                        gnutls_strerror(ret));
             goto cleanup;
         }
-        gnutls_psk_set_server_dh_params(box->data.pskserver,
-                                        box->dh_params);
+        if (box->dh_params) {
+            gnutls_psk_set_server_dh_params(box->data.pskserver,
+                                            box->dh_params);
+        }
     } else {
         box = qcrypto_tls_creds_box_new_client(GNUTLS_CRD_PSK);
 
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 397ff4caa9..e28fcdc6ff 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -683,7 +683,9 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                                                  errp) < 0) {
             return -1;
         }
-        gnutls_certificate_set_dh_params(box->data.cert, box->dh_params);
+        if (box->dh_params) {
+            gnutls_certificate_set_dh_params(box->data.cert, box->dh_params);
+        }
     }
     creds->parent_obj.box = g_steal_pointer(&box);
 
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 4ee98d6646..03e29915f0 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -385,6 +385,15 @@ Options are:
     - move backing file to NVDIMM storage and keep ``pmem=on``
       (to have NVDIMM with persistence guaranties).
 
+Using an external DH (Diffie-Hellman) parameters file (since 10.2)
+''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+Loading of external Diffie-Hellman parameters from a 'dh-params.pem'
+file is deprecated and will be removed with no replacement in a
+future release. Where no 'dh-params.pem' file is provided, the DH
+parameters will be automatically negotiated in accordance with
+RFC7919.
+
 Device options
 --------------
 
diff --git a/docs/system/tls.rst b/docs/system/tls.rst
index a4f6781d62..44c4bf04e9 100644
--- a/docs/system/tls.rst
+++ b/docs/system/tls.rst
@@ -251,11 +251,13 @@ When specifying the object, the ``dir`` parameters specifies which
 directory contains the credential files. This directory is expected to
 contain files with the names mentioned previously, ``ca-cert.pem``,
 ``server-key.pem``, ``server-cert.pem``, ``client-key.pem`` and
-``client-cert.pem`` as appropriate. It is also possible to include a set
-of pre-generated Diffie-Hellman (DH) parameters in a file
-``dh-params.pem``, which can be created using the
-``certtool --generate-dh-params`` command. If omitted, QEMU will
-dynamically generate DH parameters when loading the credentials.
+``client-cert.pem`` as appropriate.
+
+While it is possible to include a set of pre-generated Diffie-Hellman
+(DH) parameters in a file ``dh-params.pem``, this facility is now
+deprecated and will be removed in a future release. When omitted the
+DH parameters will be automatically negotiated in accordance with
+RFC7919.
 
 The ``endpoint`` parameter indicates whether the credentials will be
 used for a network client or server, and determines which PEM files are

From aeac275c114b52151642488dfcc7894631256289 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 18:29:11 +0000
Subject: [PATCH 1932/2396] crypto: avoid loading the CA certs twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The x509 TLS credentials code will load the CA certs once to perform
sanity chcking on the certs, then discard the certificate objects
and let gnutls load them a second time.

This introduces a new QCryptoTLSCredsX509Files struct which will
hold the CA certificates loaded for sanity checking and pass them on
to gnutls, avoiding the duplicated loading.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 141 ++++++++++++++++++++++++++----------------
 1 file changed, 87 insertions(+), 54 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index e28fcdc6ff..911942a1a1 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -40,6 +40,35 @@ struct QCryptoTLSCredsX509 {
 #include <gnutls/x509.h>
 
 
+typedef struct QCryptoTLSCredsX509Files QCryptoTLSCredsX509Files;
+struct QCryptoTLSCredsX509Files {
+    char *cacertpath;
+    gnutls_x509_crt_t *cacerts;
+    unsigned int ncacerts;
+};
+
+static QCryptoTLSCredsX509Files *
+qcrypto_tls_creds_x509_files_new(void)
+{
+    return g_new0(QCryptoTLSCredsX509Files, 1);
+}
+
+
+static void
+qcrypto_tls_creds_x509_files_free(QCryptoTLSCredsX509Files *files)
+{
+    size_t i;
+    for (i = 0; i < files->ncacerts; i++) {
+        gnutls_x509_crt_deinit(files->cacerts[i]);
+    }
+    g_free(files->cacerts);
+    g_free(files->cacertpath);
+    g_free(files);
+}
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSCredsX509Files,
+                              qcrypto_tls_creds_x509_files_free);
+
 static int
 qcrypto_tls_creds_check_cert_times(gnutls_x509_crt_t cert,
                                    const char *certFile,
@@ -315,11 +344,9 @@ qcrypto_tls_creds_check_cert(QCryptoTLSCredsX509 *creds,
 
 static int
 qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
+                                        QCryptoTLSCredsX509Files *files,
                                         gnutls_x509_crt_t *certs,
                                         unsigned int ncerts,
-                                        gnutls_x509_crt_t *cacerts,
-                                        unsigned int ncacerts,
-                                        const char *cacertFile,
                                         bool isServer,
                                         Error **errp)
 {
@@ -360,13 +387,13 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
              * reached the root of trust.
              */
             return qcrypto_tls_creds_check_cert(
-                creds, cert_to_check, cacertFile,
+                creds, cert_to_check, files->cacertpath,
                 isServer, true, errp);
         }
-        for (int i = 0; i < ncacerts; i++) {
+        for (int i = 0; i < files->ncacerts; i++) {
             if (gnutls_x509_crt_check_issuer(cert_to_check,
-                                             cacerts[i])) {
-                cert_issuer = cacerts[i];
+                                             files->cacerts[i])) {
+                cert_issuer = files->cacerts[i];
                 break;
             }
         }
@@ -374,7 +401,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
             break;
         }
 
-        if (qcrypto_tls_creds_check_cert(creds, cert_issuer, cacertFile,
+        if (qcrypto_tls_creds_check_cert(creds, cert_issuer, files->cacertpath,
                                          isServer, true, errp) < 0) {
             return -1;
         }
@@ -394,19 +421,17 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
 }
 
 static int
-qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t *certs,
+qcrypto_tls_creds_check_cert_pair(QCryptoTLSCredsX509Files *files,
+                                  gnutls_x509_crt_t *certs,
                                   size_t ncerts,
                                   const char *certFile,
-                                  gnutls_x509_crt_t *cacerts,
-                                  size_t ncacerts,
-                                  const char *cacertFile,
                                   bool isServer,
                                   Error **errp)
 {
     unsigned int status;
 
     if (gnutls_x509_crt_list_verify(certs, ncerts,
-                                    cacerts, ncacerts,
+                                    files->cacerts, files->ncacerts,
                                     NULL, 0,
                                     0, &status) < 0) {
         error_setg(errp, isServer ?
@@ -414,7 +439,7 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t *certs,
                    "CA certificate %s" :
                    "Unable to verify client certificate %s against "
                    "CA certificate %s",
-                   certFile, cacertFile);
+                   certFile, files->cacertpath);
         return -1;
     }
 
@@ -439,7 +464,7 @@ qcrypto_tls_creds_check_cert_pair(gnutls_x509_crt_t *certs,
 
         error_setg(errp,
                    "Our own certificate %s failed validation against %s: %s",
-                   certFile, cacertFile, reason);
+                   certFile, files->cacertpath, reason);
         return -1;
     }
 
@@ -490,15 +515,13 @@ qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds,
 
 static int
 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
+                                    QCryptoTLSCredsX509Files *files,
                                     bool isServer,
-                                    const char *cacertFile,
                                     const char *certFile,
                                     Error **errp)
 {
     gnutls_x509_crt_t *certs = NULL;
     unsigned int ncerts = 0;
-    gnutls_x509_crt_t *cacerts = NULL;
-    unsigned int ncacerts = 0;
     size_t i;
     int ret = -1;
 
@@ -514,16 +537,6 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
         }
     }
 
-    if (qcrypto_tls_creds_load_cert_list(creds,
-                                         cacertFile,
-                                         &cacerts,
-                                         &ncacerts,
-                                         isServer,
-                                         true,
-                                         errp) < 0) {
-        goto cleanup;
-    }
-
     for (i = 0; i < ncerts; i++) {
         if (qcrypto_tls_creds_check_cert(creds,
                                          certs[i], certFile,
@@ -533,17 +546,14 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
     }
 
     if (ncerts &&
-        qcrypto_tls_creds_check_authority_chain(creds,
+        qcrypto_tls_creds_check_authority_chain(creds, files,
                                                 certs, ncerts,
-                                                cacerts, ncacerts,
-                                                cacertFile, isServer,
-                                                errp) < 0) {
+                                                isServer, errp) < 0) {
         goto cleanup;
     }
 
-    if (ncerts && ncacerts &&
-        qcrypto_tls_creds_check_cert_pair(certs, ncerts, certFile,
-                                          cacerts, ncacerts, cacertFile,
+    if (ncerts &&
+        qcrypto_tls_creds_check_cert_pair(files, certs, ncerts, certFile,
                                           isServer, errp) < 0) {
         goto cleanup;
     }
@@ -555,21 +565,53 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
         gnutls_x509_crt_deinit(certs[i]);
     }
     g_free(certs);
-    for (i = 0; i < ncacerts; i++) {
-        gnutls_x509_crt_deinit(cacerts[i]);
-    }
-    g_free(cacerts);
 
     return ret;
 }
 
 
+static int
+qcrypto_tls_creds_x509_load_ca(QCryptoTLSCredsX509 *creds,
+                               QCryptoTLSCredsBox *box,
+                               QCryptoTLSCredsX509Files *files,
+                               bool isServer,
+                               Error **errp)
+{
+    int ret;
+
+    if (qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                   QCRYPTO_TLS_CREDS_X509_CA_CERT,
+                                   true, &files->cacertpath, errp) < 0) {
+        return -1;
+    }
+
+    if (qcrypto_tls_creds_load_cert_list(creds,
+                                         files->cacertpath,
+                                         &files->cacerts,
+                                         &files->ncacerts,
+                                         isServer,
+                                         true,
+                                         errp) < 0) {
+        return -1;
+    }
+
+    ret = gnutls_certificate_set_x509_trust(box->data.cert,
+                                            files->cacerts, files->ncacerts);
+    if (ret < 0) {
+        error_setg(errp, "Cannot set CA certificate '%s': %s",
+                   files->cacertpath, gnutls_strerror(ret));
+        return -1;
+    }
+
+    return 0;
+}
+
 static int
 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                             Error **errp)
 {
     g_autoptr(QCryptoTLSCredsBox) box = NULL;
-    g_autofree char *cacert = NULL;
+    g_autoptr(QCryptoTLSCredsX509Files) files = NULL;
     g_autofree char *cacrl = NULL;
     g_autofree char *cert = NULL;
     g_autofree char *key = NULL;
@@ -598,9 +640,9 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         return -1;
     }
 
-    if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                   QCRYPTO_TLS_CREDS_X509_CA_CERT,
-                                   true, &cacert, errp) < 0) {
+    files = qcrypto_tls_creds_x509_files_new();
+
+    if (qcrypto_tls_creds_x509_load_ca(creds, box, files, isServer, errp) < 0) {
         return -1;
     }
 
@@ -631,17 +673,8 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     }
 
     if (creds->sanityCheck &&
-        qcrypto_tls_creds_x509_sanity_check(creds, isServer,
-                                            cacert, cert, errp) < 0) {
-        return -1;
-    }
-
-    ret = gnutls_certificate_set_x509_trust_file(box->data.cert,
-                                                 cacert,
-                                                 GNUTLS_X509_FMT_PEM);
-    if (ret < 0) {
-        error_setg(errp, "Cannot load CA certificate '%s': %s",
-                   cacert, gnutls_strerror(ret));
+        qcrypto_tls_creds_x509_sanity_check(creds, files, isServer,
+                                            cert, errp) < 0) {
         return -1;
     }
 

From 8031b5fb1a6efb57df36d41917932516894ae641 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 18:29:11 +0000
Subject: [PATCH 1933/2396] crypto: avoid loading the identity certs twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The x509 TLS credentials code will load the identity certs once to
perform sanity chcking on the certs, then discard the certificate
objects and let gnutls load them a second time.

This extends the previous QCryptoTLSCredsX509Files struct to also
hold the identity certificates & key loaded for sanity checking
and pass them on to gnutls, avoiding the duplicated loading.

The unit tests need updating because we now correctly diagnose the
error scenario where the cert PEM file exists, without its matching
key PEM file. Previously that error was mistakenly ignored.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c                 | 246 +++++++++++++++++---------
 tests/unit/test-crypto-tlscredsx509.c |   8 +-
 2 files changed, 164 insertions(+), 90 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index 911942a1a1..c016633d65 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -45,6 +45,12 @@ struct QCryptoTLSCredsX509Files {
     char *cacertpath;
     gnutls_x509_crt_t *cacerts;
     unsigned int ncacerts;
+
+    char *certpath;
+    char *keypath;
+    gnutls_x509_crt_t *certs;
+    unsigned int ncerts;
+    gnutls_x509_privkey_t key;
 };
 
 static QCryptoTLSCredsX509Files *
@@ -63,6 +69,13 @@ qcrypto_tls_creds_x509_files_free(QCryptoTLSCredsX509Files *files)
     }
     g_free(files->cacerts);
     g_free(files->cacertpath);
+    for (i = 0; i < files->ncerts; i++) {
+        gnutls_x509_crt_deinit(files->certs[i]);
+    }
+    gnutls_x509_privkey_deinit(files->key);
+    g_free(files->certs);
+    g_free(files->certpath);
+    g_free(files->keypath);
     g_free(files);
 }
 
@@ -477,14 +490,13 @@ qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds,
                                  const char *certFile,
                                  gnutls_x509_crt_t **certs,
                                  unsigned int *ncerts,
-                                 bool isServer,
-                                 bool isCA,
                                  Error **errp)
 {
     gnutls_datum_t data;
     g_autofree char *buf = NULL;
     gsize buflen;
     GError *gerr = NULL;
+    int ret;
 
     *ncerts = 0;
     trace_qcrypto_tls_creds_x509_load_cert_list(creds, certFile);
@@ -499,13 +511,60 @@ qcrypto_tls_creds_load_cert_list(QCryptoTLSCredsX509 *creds,
     data.data = (unsigned char *)buf;
     data.size = strlen(buf);
 
-    if (gnutls_x509_crt_list_import2(certs, ncerts, &data,
-                                     GNUTLS_X509_FMT_PEM, 0) < 0) {
-        error_setg(errp,
-                   isCA ? "Unable to import CA certificate list %s" :
-                   (isServer ? "Unable to import server certificate %s" :
-                    "Unable to import client certificate %s"),
-                   certFile);
+    ret = gnutls_x509_crt_list_import2(certs, ncerts, &data,
+                                       GNUTLS_X509_FMT_PEM, 0);
+    if (ret < 0) {
+        error_setg(errp, "Unable to import certificate %s: %s",
+                   certFile, gnutls_strerror(ret));
+        return -1;
+    }
+
+    return 0;
+}
+
+
+static int
+qcrypto_tls_creds_load_privkey(QCryptoTLSCredsX509 *creds,
+                               const char *keyFile,
+                               gnutls_x509_privkey_t *key,
+                               Error **errp)
+{
+    gnutls_datum_t data;
+    g_autofree char *buf = NULL;
+    g_autofree char *password = NULL;
+    gsize buflen;
+    GError *gerr = NULL;
+    int ret;
+
+    ret = gnutls_x509_privkey_init(key);
+    if (ret < 0) {
+        error_setg(errp, "Unable to initialize private key: %s",
+                   gnutls_strerror(ret));
+        return -1;
+    }
+
+    if (!g_file_get_contents(keyFile, &buf, &buflen, &gerr)) {
+        error_setg(errp, "Cannot load private key %s: %s",
+                   keyFile, gerr->message);
+        g_error_free(gerr);
+        return -1;
+    }
+
+    data.data = (unsigned char *)buf;
+    data.size = strlen(buf);
+
+    if (creds->passwordid) {
+        password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
+                                                 errp);
+        if (!password) {
+            return -1;
+        }
+    }
+
+    if (gnutls_x509_privkey_import2(*key, &data,
+                                    GNUTLS_X509_FMT_PEM,
+                                    password, 0) < 0) {
+        error_setg(errp, "Unable to import private key %s", keyFile);
         return -1;
     }
 
@@ -517,56 +576,34 @@ static int
 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     QCryptoTLSCredsX509Files *files,
                                     bool isServer,
-                                    const char *certFile,
                                     Error **errp)
 {
-    gnutls_x509_crt_t *certs = NULL;
-    unsigned int ncerts = 0;
     size_t i;
-    int ret = -1;
 
-    if (certFile) {
-        if (qcrypto_tls_creds_load_cert_list(creds,
-                                             certFile,
-                                             &certs,
-                                             &ncerts,
-                                             isServer,
-                                             false,
-                                             errp) < 0) {
-            goto cleanup;
-        }
-    }
-
-    for (i = 0; i < ncerts; i++) {
+    for (i = 0; i < files->ncerts; i++) {
         if (qcrypto_tls_creds_check_cert(creds,
-                                         certs[i], certFile,
+                                         files->certs[i], files->certpath,
                                          isServer, i != 0, errp) < 0) {
-            goto cleanup;
+            return -1;
         }
     }
 
-    if (ncerts &&
+    if (files->ncerts &&
         qcrypto_tls_creds_check_authority_chain(creds, files,
-                                                certs, ncerts,
+                                                files->certs, files->ncerts,
                                                 isServer, errp) < 0) {
-        goto cleanup;
+        return -1;
     }
 
-    if (ncerts &&
-        qcrypto_tls_creds_check_cert_pair(files, certs, ncerts, certFile,
-                                          isServer, errp) < 0) {
-        goto cleanup;
+    if (files->ncerts &&
+        qcrypto_tls_creds_check_cert_pair(files,
+                                          files->certs, files->ncerts,
+                                          files->certpath, isServer,
+                                          errp) < 0) {
+        return -1;
     }
 
-    ret = 0;
-
- cleanup:
-    for (i = 0; i < ncerts; i++) {
-        gnutls_x509_crt_deinit(certs[i]);
-    }
-    g_free(certs);
-
-    return ret;
+    return 0;
 }
 
 
@@ -589,8 +626,6 @@ qcrypto_tls_creds_x509_load_ca(QCryptoTLSCredsX509 *creds,
                                          files->cacertpath,
                                          &files->cacerts,
                                          &files->ncacerts,
-                                         isServer,
-                                         true,
                                          errp) < 0) {
         return -1;
     }
@@ -606,6 +641,79 @@ qcrypto_tls_creds_x509_load_ca(QCryptoTLSCredsX509 *creds,
     return 0;
 }
 
+
+static int
+qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
+                                     QCryptoTLSCredsBox *box,
+                                     QCryptoTLSCredsX509Files *files,
+                                     bool isServer,
+                                     Error **errp)
+{
+    int ret;
+
+    if (isServer) {
+        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
+                                       true, &files->certpath, errp) < 0 ||
+            qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
+                                       true, &files->keypath, errp) < 0) {
+            return -1;
+        }
+    } else {
+        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
+                                       false, &files->certpath, errp) < 0 ||
+            qcrypto_tls_creds_get_path(&creds->parent_obj,
+                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
+                                       false, &files->keypath, errp) < 0) {
+            return -1;
+        }
+    }
+
+    if (!files->certpath &&
+        !files->keypath) {
+        return 0;
+    }
+    if (files->certpath && !files->keypath) {
+        error_setg(errp, "Cert '%s' without corresponding key",
+                   files->certpath);
+        return -1;
+    }
+    if (!files->certpath && files->keypath) {
+        error_setg(errp, "Key '%s' without corresponding cert",
+                   files->keypath);
+        return -1;
+    }
+
+    if (qcrypto_tls_creds_load_cert_list(creds,
+                                         files->certpath,
+                                         &files->certs,
+                                         &files->ncerts,
+                                         errp) < 0) {
+        return -1;
+    }
+
+    if (qcrypto_tls_creds_load_privkey(creds,
+                                       files->keypath,
+                                       &files->key,
+                                       errp) < 0) {
+        return -1;
+    }
+
+    ret = gnutls_certificate_set_x509_key(box->data.cert,
+                                          files->certs,
+                                          files->ncerts,
+                                          files->key);
+    if (ret < 0) {
+        error_setg(errp, "Cannot set certificate '%s' & key '%s': %s",
+                   files->certpath, files->keypath, gnutls_strerror(ret));
+        return -1;
+    }
+    return 0;
+}
+
+
 static int
 qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
                             Error **errp)
@@ -613,8 +721,6 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
     g_autoptr(QCryptoTLSCredsBox) box = NULL;
     g_autoptr(QCryptoTLSCredsX509Files) files = NULL;
     g_autofree char *cacrl = NULL;
-    g_autofree char *cert = NULL;
-    g_autofree char *key = NULL;
     g_autofree char *dhparams = NULL;
     bool isServer = (creds->parent_obj.endpoint ==
                      QCRYPTO_TLS_CREDS_ENDPOINT_SERVER);
@@ -646,59 +752,27 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         return -1;
     }
 
+    if (qcrypto_tls_creds_x509_load_identity(creds, box, files,
+                                             isServer, errp) < 0) {
+        return -1;
+    }
+
     if (isServer) {
         if (qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_X509_CA_CRL,
                                        false, &cacrl, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
-                                       true, &cert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
-                                       true, &key, errp) < 0 ||
             qcrypto_tls_creds_get_path(&creds->parent_obj,
                                        QCRYPTO_TLS_CREDS_DH_PARAMS,
                                        false, &dhparams, errp) < 0) {
             return -1;
         }
-    } else {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
-                                       false, &cert, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
-                                       false, &key, errp) < 0) {
-            return -1;
-        }
     }
 
     if (creds->sanityCheck &&
-        qcrypto_tls_creds_x509_sanity_check(creds, files, isServer,
-                                            cert, errp) < 0) {
+        qcrypto_tls_creds_x509_sanity_check(creds, files, isServer, errp) < 0) {
         return -1;
     }
 
-    if (cert != NULL && key != NULL) {
-        g_autofree char *password = NULL;
-        if (creds->passwordid) {
-            password = qcrypto_secret_lookup_as_utf8(creds->passwordid,
-                                                     errp);
-            if (!password) {
-                return -1;
-            }
-        }
-        ret = gnutls_certificate_set_x509_key_file2(box->data.cert,
-                                                    cert, key,
-                                                    GNUTLS_X509_FMT_PEM,
-                                                    password,
-                                                    0);
-        if (ret < 0) {
-            error_setg(errp, "Cannot load certificate '%s' & key '%s': %s",
-                       cert, key, gnutls_strerror(ret));
-            return -1;
-        }
-    }
-
     if (cacrl != NULL) {
         ret = gnutls_certificate_set_x509_crl_file(box->data.cert,
                                                    cacrl,
diff --git a/tests/unit/test-crypto-tlscredsx509.c b/tests/unit/test-crypto-tlscredsx509.c
index a5f21728d4..b1ad7d5c0d 100644
--- a/tests/unit/test-crypto-tlscredsx509.c
+++ b/tests/unit/test-crypto-tlscredsx509.c
@@ -95,16 +95,16 @@ static void test_tls_creds(const void *opaque)
         if (access(data->crt, R_OK) == 0) {
             g_assert(link(data->crt,
                           CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_CERT) == 0);
+            g_assert(link(KEYFILE,
+                          CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
         }
-        g_assert(link(KEYFILE,
-                      CERT_DIR QCRYPTO_TLS_CREDS_X509_SERVER_KEY) == 0);
     } else {
         if (access(data->crt, R_OK) == 0) {
             g_assert(link(data->crt,
                           CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_CERT) == 0);
+            g_assert(link(KEYFILE,
+                          CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
         }
-        g_assert(link(KEYFILE,
-                      CERT_DIR QCRYPTO_TLS_CREDS_X509_CLIENT_KEY) == 0);
     }
 
     creds = test_tls_creds_create(

From c497a51481cf725d86d3f302a6397c2cb446d0bb Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 20:46:28 +0000
Subject: [PATCH 1934/2396] crypto: expand logic to cope with multiple
 certificate identities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently only a single set of certificates can be loaded for a
server / client. Certificates are created using a particular
key algorithm and in some scenarios it can be useful to support
multiple algorithms in parallel. This requires the ability to
load multiple sets of certificates.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscredsx509.c | 183 ++++++++++++++++++++++++++++--------------
 1 file changed, 122 insertions(+), 61 deletions(-)

diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index c016633d65..ecffde67c5 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -40,12 +40,8 @@ struct QCryptoTLSCredsX509 {
 #include <gnutls/x509.h>
 
 
-typedef struct QCryptoTLSCredsX509Files QCryptoTLSCredsX509Files;
-struct QCryptoTLSCredsX509Files {
-    char *cacertpath;
-    gnutls_x509_crt_t *cacerts;
-    unsigned int ncacerts;
-
+typedef struct QCryptoTLSCredsX509IdentFiles QCryptoTLSCredsX509IdentFiles;
+struct QCryptoTLSCredsX509IdentFiles {
     char *certpath;
     char *keypath;
     gnutls_x509_crt_t *certs;
@@ -53,6 +49,16 @@ struct QCryptoTLSCredsX509Files {
     gnutls_x509_privkey_t key;
 };
 
+typedef struct QCryptoTLSCredsX509Files QCryptoTLSCredsX509Files;
+struct QCryptoTLSCredsX509Files {
+    char *cacertpath;
+    gnutls_x509_crt_t *cacerts;
+    unsigned int ncacerts;
+
+    QCryptoTLSCredsX509IdentFiles **identities;
+    size_t nidentities;
+};
+
 static QCryptoTLSCredsX509Files *
 qcrypto_tls_creds_x509_files_new(void)
 {
@@ -60,6 +66,24 @@ qcrypto_tls_creds_x509_files_new(void)
 }
 
 
+static void
+qcrypto_tls_creds_x509_ident_files_free(QCryptoTLSCredsX509IdentFiles *files)
+{
+    size_t i;
+    for (i = 0; i < files->ncerts; i++) {
+        gnutls_x509_crt_deinit(files->certs[i]);
+    }
+    gnutls_x509_privkey_deinit(files->key);
+    g_free(files->certs);
+    g_free(files->certpath);
+    g_free(files->keypath);
+    g_free(files);
+}
+
+G_DEFINE_AUTOPTR_CLEANUP_FUNC(QCryptoTLSCredsX509IdentFiles,
+                              qcrypto_tls_creds_x509_ident_files_free);
+
+
 static void
 qcrypto_tls_creds_x509_files_free(QCryptoTLSCredsX509Files *files)
 {
@@ -69,13 +93,10 @@ qcrypto_tls_creds_x509_files_free(QCryptoTLSCredsX509Files *files)
     }
     g_free(files->cacerts);
     g_free(files->cacertpath);
-    for (i = 0; i < files->ncerts; i++) {
-        gnutls_x509_crt_deinit(files->certs[i]);
+    for (i = 0; i < files->nidentities; i++) {
+        qcrypto_tls_creds_x509_ident_files_free(files->identities[i]);
     }
-    gnutls_x509_privkey_deinit(files->key);
-    g_free(files->certs);
-    g_free(files->certpath);
-    g_free(files->keypath);
+    g_free(files->identities);
     g_free(files);
 }
 
@@ -572,6 +593,40 @@ qcrypto_tls_creds_load_privkey(QCryptoTLSCredsX509 *creds,
 }
 
 
+static int
+qcrypto_tls_creds_x509_sanity_check_identity(QCryptoTLSCredsX509 *creds,
+                                             QCryptoTLSCredsX509Files *files,
+                                             QCryptoTLSCredsX509IdentFiles *ifiles,
+                                             bool isServer,
+                                             Error **errp)
+{
+    size_t i;
+
+    for (i = 0; i < ifiles->ncerts; i++) {
+        if (qcrypto_tls_creds_check_cert(creds,
+                                         ifiles->certs[i], ifiles->certpath,
+                                         isServer, i != 0, errp) < 0) {
+            return -1;
+        }
+    }
+
+    if (ifiles->ncerts &&
+        qcrypto_tls_creds_check_authority_chain(creds, files,
+                                                ifiles->certs, ifiles->ncerts,
+                                                isServer, errp) < 0) {
+        return -1;
+    }
+
+    if (ifiles->ncerts &&
+        qcrypto_tls_creds_check_cert_pair(files, ifiles->certs, ifiles->ncerts,
+                                          ifiles->certpath, isServer, errp) < 0) {
+        return -1;
+    }
+
+    return 0;
+}
+
+
 static int
 qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     QCryptoTLSCredsX509Files *files,
@@ -579,30 +634,15 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
                                     Error **errp)
 {
     size_t i;
-
-    for (i = 0; i < files->ncerts; i++) {
-        if (qcrypto_tls_creds_check_cert(creds,
-                                         files->certs[i], files->certpath,
-                                         isServer, i != 0, errp) < 0) {
+    for (i = 0; i < files->nidentities; i++) {
+        if (qcrypto_tls_creds_x509_sanity_check_identity(creds,
+                                                         files,
+                                                         files->identities[i],
+                                                         isServer,
+                                                         errp) < 0) {
             return -1;
         }
     }
-
-    if (files->ncerts &&
-        qcrypto_tls_creds_check_authority_chain(creds, files,
-                                                files->certs, files->ncerts,
-                                                isServer, errp) < 0) {
-        return -1;
-    }
-
-    if (files->ncerts &&
-        qcrypto_tls_creds_check_cert_pair(files,
-                                          files->certs, files->ncerts,
-                                          files->certpath, isServer,
-                                          errp) < 0) {
-        return -1;
-    }
-
     return 0;
 }
 
@@ -642,48 +682,38 @@ qcrypto_tls_creds_x509_load_ca(QCryptoTLSCredsX509 *creds,
 }
 
 
-static int
+static QCryptoTLSCredsX509IdentFiles *
 qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
                                      QCryptoTLSCredsBox *box,
-                                     QCryptoTLSCredsX509Files *files,
-                                     bool isServer,
+                                     const char *certbase,
+                                     const char *keybase,
+                                     bool isOptional,
                                      Error **errp)
 {
+    g_autoptr(QCryptoTLSCredsX509IdentFiles) files =
+        g_new0(QCryptoTLSCredsX509IdentFiles, 1);
     int ret;
 
-    if (isServer) {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_CERT,
-                                       true, &files->certpath, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_SERVER_KEY,
-                                       true, &files->keypath, errp) < 0) {
-            return -1;
-        }
-    } else {
-        if (qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
-                                       false, &files->certpath, errp) < 0 ||
-            qcrypto_tls_creds_get_path(&creds->parent_obj,
-                                       QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
-                                       false, &files->keypath, errp) < 0) {
-            return -1;
-        }
+    if (qcrypto_tls_creds_get_path(&creds->parent_obj, certbase,
+                                   !isOptional, &files->certpath, errp) < 0 ||
+        qcrypto_tls_creds_get_path(&creds->parent_obj, keybase,
+                                   !isOptional, &files->keypath, errp) < 0) {
+        return NULL;
     }
 
     if (!files->certpath &&
         !files->keypath) {
-        return 0;
+        return NULL;
     }
     if (files->certpath && !files->keypath) {
         error_setg(errp, "Cert '%s' without corresponding key",
                    files->certpath);
-        return -1;
+        return NULL;
     }
     if (!files->certpath && files->keypath) {
         error_setg(errp, "Key '%s' without corresponding cert",
                    files->keypath);
-        return -1;
+        return NULL;
     }
 
     if (qcrypto_tls_creds_load_cert_list(creds,
@@ -691,14 +721,14 @@ qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
                                          &files->certs,
                                          &files->ncerts,
                                          errp) < 0) {
-        return -1;
+        return NULL;
     }
 
     if (qcrypto_tls_creds_load_privkey(creds,
                                        files->keypath,
                                        &files->key,
                                        errp) < 0) {
-        return -1;
+        return NULL;
     }
 
     ret = gnutls_certificate_set_x509_key(box->data.cert,
@@ -708,8 +738,39 @@ qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
     if (ret < 0) {
         error_setg(errp, "Cannot set certificate '%s' & key '%s': %s",
                    files->certpath, files->keypath, gnutls_strerror(ret));
+        return NULL;
+    }
+    return g_steal_pointer(&files);
+}
+
+
+static int
+qcrypto_tls_creds_x509_load_identities(QCryptoTLSCredsX509 *creds,
+                                       QCryptoTLSCredsBox *box,
+                                       QCryptoTLSCredsX509Files *files,
+                                       bool isServer,
+                                       Error **errp)
+{
+    QCryptoTLSCredsX509IdentFiles *ifiles;
+
+    ifiles = qcrypto_tls_creds_x509_load_identity(
+        creds, box,
+        isServer ?
+        QCRYPTO_TLS_CREDS_X509_SERVER_CERT :
+        QCRYPTO_TLS_CREDS_X509_CLIENT_CERT,
+        isServer ?
+        QCRYPTO_TLS_CREDS_X509_SERVER_KEY :
+        QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
+        !isServer, errp);
+    if (!ifiles) {
         return -1;
     }
+
+    files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
+                                files->identities,
+                                files->nidentities + 1);
+    files->identities[files->nidentities++] = ifiles;
+
     return 0;
 }
 
@@ -752,8 +813,8 @@ qcrypto_tls_creds_x509_load(QCryptoTLSCredsX509 *creds,
         return -1;
     }
 
-    if (qcrypto_tls_creds_x509_load_identity(creds, box, files,
-                                             isServer, errp) < 0) {
+    if (qcrypto_tls_creds_x509_load_identities(creds, box, files,
+                                               isServer, errp) < 0) {
         return -1;
     }
 

From 211fc7e416d5661a8f6bd3cc8de7d1a68e07426c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Wed, 29 Oct 2025 20:56:38 +0000
Subject: [PATCH 1935/2396] crypto: support upto 5 parallel certificate
 identities
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The default (required) identity is stored in server-cert.pem /
client-cert.pem and server-key.pem / client-key.pem.

The 4 extra (optional) identities are stored in server-cert-$N.pem /
client-cert-$N.pem and server-key-$N.pem / client-key-$N.pem. The
numbering starts at 0 and the first missing cert/key pair will
terminate the loading process.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 crypto/tlscreds.c             | 10 +++++-
 crypto/tlscredspriv.h         |  3 ++
 crypto/tlscredsx509.c         | 68 ++++++++++++++++++++++++++++-------
 crypto/tlssession.c           |  1 +
 crypto/trace-events           |  1 +
 docs/system/tls.rst           | 54 ++++++++++++++++++++++++++--
 include/crypto/tlscredsx509.h |  6 ++++
 7 files changed, 127 insertions(+), 16 deletions(-)

diff --git a/crypto/tlscreds.c b/crypto/tlscreds.c
index 3d25efe425..fb09e295a6 100644
--- a/crypto/tlscreds.c
+++ b/crypto/tlscreds.c
@@ -85,6 +85,14 @@ qcrypto_tls_creds_get_dh_params_file(QCryptoTLSCreds *creds,
 }
 
 
+char *
+qcrypto_tls_creds_build_path(QCryptoTLSCreds *creds,
+                             const char *filename)
+{
+    return g_strdup_printf("%s/%s", creds->dir, filename);
+}
+
+
 int
 qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
                            const char *filename,
@@ -94,7 +102,7 @@ qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
 {
     int ret = -1;
 
-    *cred = g_strdup_printf("%s/%s", creds->dir, filename);
+    *cred = qcrypto_tls_creds_build_path(creds, filename);
 
     if (access(*cred, R_OK) < 0) {
         if (errno == ENOENT && !required) {
diff --git a/crypto/tlscredspriv.h b/crypto/tlscredspriv.h
index 69dac02437..8f2d096c7f 100644
--- a/crypto/tlscredspriv.h
+++ b/crypto/tlscredspriv.h
@@ -39,6 +39,9 @@ struct QCryptoTLSCreds {
 
 #ifdef CONFIG_GNUTLS
 
+char *qcrypto_tls_creds_build_path(QCryptoTLSCreds *creds,
+                                   const char *filename);
+
 int qcrypto_tls_creds_get_path(QCryptoTLSCreds *creds,
                                const char *filename,
                                bool required,
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
index ecffde67c5..b8d0cd2f18 100644
--- a/crypto/tlscredsx509.c
+++ b/crypto/tlscredsx509.c
@@ -687,7 +687,6 @@ qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
                                      QCryptoTLSCredsBox *box,
                                      const char *certbase,
                                      const char *keybase,
-                                     bool isOptional,
                                      Error **errp)
 {
     g_autoptr(QCryptoTLSCredsX509IdentFiles) files =
@@ -695,9 +694,9 @@ qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
     int ret;
 
     if (qcrypto_tls_creds_get_path(&creds->parent_obj, certbase,
-                                   !isOptional, &files->certpath, errp) < 0 ||
+                                   false, &files->certpath, errp) < 0 ||
         qcrypto_tls_creds_get_path(&creds->parent_obj, keybase,
-                                   !isOptional, &files->keypath, errp) < 0) {
+                                   false, &files->keypath, errp) < 0) {
         return NULL;
     }
 
@@ -706,13 +705,17 @@ qcrypto_tls_creds_x509_load_identity(QCryptoTLSCredsX509 *creds,
         return NULL;
     }
     if (files->certpath && !files->keypath) {
-        error_setg(errp, "Cert '%s' without corresponding key",
-                   files->certpath);
+        g_autofree char *keypath =
+            qcrypto_tls_creds_build_path(&creds->parent_obj, keybase);
+        error_setg(errp, "Cert '%s' without corresponding key '%s'",
+                   files->certpath, keypath);
         return NULL;
     }
     if (!files->certpath && files->keypath) {
-        error_setg(errp, "Key '%s' without corresponding cert",
-                   files->keypath);
+        g_autofree char *certpath =
+            qcrypto_tls_creds_build_path(&creds->parent_obj, certbase);
+        error_setg(errp, "Key '%s' without corresponding cert '%s'",
+                   files->keypath, certpath);
         return NULL;
     }
 
@@ -751,7 +754,9 @@ qcrypto_tls_creds_x509_load_identities(QCryptoTLSCredsX509 *creds,
                                        bool isServer,
                                        Error **errp)
 {
+    ERRP_GUARD();
     QCryptoTLSCredsX509IdentFiles *ifiles;
+    size_t i;
 
     ifiles = qcrypto_tls_creds_x509_load_identity(
         creds, box,
@@ -761,15 +766,52 @@ qcrypto_tls_creds_x509_load_identities(QCryptoTLSCredsX509 *creds,
         isServer ?
         QCRYPTO_TLS_CREDS_X509_SERVER_KEY :
         QCRYPTO_TLS_CREDS_X509_CLIENT_KEY,
-        !isServer, errp);
-    if (!ifiles) {
+        errp);
+    if (!ifiles && *errp) {
         return -1;
     }
 
-    files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
-                                files->identities,
-                                files->nidentities + 1);
-    files->identities[files->nidentities++] = ifiles;
+    if (ifiles) {
+        files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
+                                    files->identities,
+                                    files->nidentities + 1);
+        files->identities[files->nidentities++] = ifiles;
+    }
+
+    for (i = 0; i < QCRYPTO_TLS_CREDS_X509_IDENTITY_MAX; i++) {
+        g_autofree char *cert = g_strdup_printf(
+            isServer ?
+            QCRYPTO_TLS_CREDS_X509_SERVER_CERT_N :
+            QCRYPTO_TLS_CREDS_X509_CLIENT_CERT_N, i);
+        g_autofree char *key = g_strdup_printf(
+            isServer ?
+            QCRYPTO_TLS_CREDS_X509_SERVER_KEY_N :
+            QCRYPTO_TLS_CREDS_X509_CLIENT_KEY_N, i);
+
+        ifiles = qcrypto_tls_creds_x509_load_identity(creds, box,
+                                                      cert, key, errp);
+        if (!ifiles && *errp) {
+            return -1;
+        }
+        if (!ifiles) {
+            break;
+        }
+
+        files->identities = g_renew(QCryptoTLSCredsX509IdentFiles *,
+                                    files->identities,
+                                    files->nidentities + 1);
+        files->identities[files->nidentities++] = ifiles;
+    }
+
+    if (files->nidentities == 0 && isServer) {
+        g_autofree char *certpath = qcrypto_tls_creds_build_path(
+            &creds->parent_obj, QCRYPTO_TLS_CREDS_X509_SERVER_CERT);
+        g_autofree char *keypath = qcrypto_tls_creds_build_path(
+            &creds->parent_obj, QCRYPTO_TLS_CREDS_X509_SERVER_KEY);
+        error_setg(errp, "Missing server cert '%s' & key '%s'",
+                   certpath, keypath);
+        return -1;
+    }
 
     return 0;
 }
diff --git a/crypto/tlssession.c b/crypto/tlssession.c
index a1dc3b3ce0..314e3e96ba 100644
--- a/crypto/tlssession.c
+++ b/crypto/tlssession.c
@@ -345,6 +345,7 @@ qcrypto_tls_session_check_certificate(QCryptoTLSSession *session,
                 goto error;
             }
             session->peername = (char *)g_steal_pointer(&dname.data);
+            trace_qcrypto_tls_session_check_x509_dn(session, session->peername);
             if (session->authzid) {
                 bool allow;
 
diff --git a/crypto/trace-events b/crypto/trace-events
index d0e33427fa..771f9b8a6e 100644
--- a/crypto/trace-events
+++ b/crypto/trace-events
@@ -21,6 +21,7 @@ qcrypto_tls_creds_x509_load_cert_list(void *creds, const char *file) "TLS creds
 # tlssession.c
 qcrypto_tls_session_new(void *session, void *creds, const char *hostname, const char *authzid, int endpoint) "TLS session new session=%p creds=%p hostname=%s authzid=%s endpoint=%d"
 qcrypto_tls_session_check_creds(void *session, const char *status) "TLS session check creds session=%p status=%s"
+qcrypto_tls_session_check_x509_dn(void *session, const char *dname) "TLS session check x509 distinguished name session=%p dname=%s"
 qcrypto_tls_session_parameters(void *session, int threadSafety, int protocol, int cipher) "TLS session parameters session=%p threadSafety=%d protocol=%d cipher=%d"
 qcrypto_tls_session_bug1717_workaround(void *session) "TLS session bug1717 workaround session=%p"
 
diff --git a/docs/system/tls.rst b/docs/system/tls.rst
index 44c4bf04e9..7cec4ac3df 100644
--- a/docs/system/tls.rst
+++ b/docs/system/tls.rst
@@ -36,8 +36,58 @@ server and exposing it directly to remote browser clients. In such a
 case it might be useful to use a commercial CA to avoid needing to
 install custom CA certs in the web browsers.
 
-The recommendation is for the server to keep its certificates in either
-``/etc/pki/qemu`` or for unprivileged users in ``$HOME/.pki/qemu``.
+.. _tls_cert_file_naming:
+
+Certificate file naming
+~~~~~~~~~~~~~~~~~~~~~~~
+
+In a simple setup, where all QEMU instances on a machine share the
+same TLS configuration, it is suggested that QEMU certificates be
+kept in either ``/etc/pki/qemu`` or, for unprivileged users, in
+``$HOME/.pki/qemu``. Where different QEMU subsystems require
+different certificate configurations, sub-dirs of these locations
+may be chosen.
+
+The default file names that QEMU will traditionally load are:
+
+* ``ca-cert.pem`` - mandatory; for both client and server configurations
+* ``ca-crl.pem`` - optional; for server configurations only
+* ``server-cert.pem`` - mandatory; for server configurations only
+* ``server-key.pem`` - mandatory; for server configurations only
+* ``client-cert.pem`` - optional; for client configurations only
+* ``client-key.pem`` - optional; for client configurations only
+* ``dh-params.pem`` - optional; for server configurations only
+
+Since QEMU 10.2.0, there is support for loading upto four additional
+identities:
+
+* ``server-cert-[IDX].pem`` - optional; for server configurations only
+* ``server-key-[IDX].pem`` - optional; for server configurations only
+* ``client-cert-[IDX].pem`` - optional; for client configurations only
+* ``client-key-[IDX].pem`` - optional; for client configurations only
+
+where ``-[IDX]`` is one of the digits 0-3. Loading will terminate at
+the first absent index. The index based certificate files may be used
+as a replacement for, or in addition to, the traditional non-index
+based certificate files. The traditional certificate files will be
+loaded first, if present, then the index based certificates. Where
+multiple certificates are compatible with a TLS session, the first
+loaded certificate will preferred. IOW file naming can influence
+which certificates are used for a session.
+
+The use of multiple sets of certificates is intended to allow an
+incremental transition to certificates using different crytographic
+algorithms. This allows a newly deployed QEMU to introduce use of
+stronger cryptographic algorithms that will be preferred when talking
+to other newly deployed QEMU instances, while retaining compatbility
+with certificates issued to a historically deployed QEMU. This is
+notably useful to support live migration from an old QEMU deployed
+on older operating system releases, which may support fewer crypto
+algorithm choices than the current OS.
+
+The certificate creation commands below will be illustrated using
+the traditional naming scheme, but their args can be substituted
+to use the indexed naming in the obvious manner.
 
 .. _tls_005fgenerate_005fca:
 
diff --git a/include/crypto/tlscredsx509.h b/include/crypto/tlscredsx509.h
index c4daba21a6..61b7f73573 100644
--- a/include/crypto/tlscredsx509.h
+++ b/include/crypto/tlscredsx509.h
@@ -37,7 +37,13 @@ typedef struct QCryptoTLSCredsX509Class QCryptoTLSCredsX509Class;
 #define QCRYPTO_TLS_CREDS_X509_SERVER_CERT "server-cert.pem"
 #define QCRYPTO_TLS_CREDS_X509_CLIENT_KEY "client-key.pem"
 #define QCRYPTO_TLS_CREDS_X509_CLIENT_CERT "client-cert.pem"
+#define QCRYPTO_TLS_CREDS_X509_SERVER_KEY_N "server-key-%zu.pem"
+#define QCRYPTO_TLS_CREDS_X509_SERVER_CERT_N "server-cert-%zu.pem"
+#define QCRYPTO_TLS_CREDS_X509_CLIENT_KEY_N "client-key-%zu.pem"
+#define QCRYPTO_TLS_CREDS_X509_CLIENT_CERT_N "client-cert-%zu.pem"
 
+/* Max number of additional cert/key pairs (ie _N constants) */
+#define QCRYPTO_TLS_CREDS_X509_IDENTITY_MAX 4
 
 /**
  * QCryptoTLSCredsX509:

From 2aaca8c6d22b18786ceff51189704113d0639590 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 27 Oct 2025 12:21:46 +0000
Subject: [PATCH 1936/2396] docs: creation of x509 certs compliant with
 post-quantum crypto
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Explain how to alter the certtool commands for creating certficates,
so that they can use algorithms that are compliant with post-quantum
crytography standards.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 docs/system/tls.rst | 68 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 68 insertions(+)

diff --git a/docs/system/tls.rst b/docs/system/tls.rst
index 7cec4ac3df..03fa1d8166 100644
--- a/docs/system/tls.rst
+++ b/docs/system/tls.rst
@@ -345,6 +345,74 @@ example with VNC:
 
 .. _tls_005fpsk:
 
+TLS certificates for Post-Quantum Cryptography
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Given a new enough gnutls release, suitably integrated & configured with the
+operating system crypto policies, QEMU is able to support post-quantum
+crytography on TLS enabled services, either exclusively or in a hybrid mode.
+
+In exclusive mode, only a single set of certificates need to be configured
+for QEMU, with PQC compliant algorithms. Such a QEMU configuration will only
+be able to interoperate with other services (including other QEMU's) that
+also have PQC enabled. This can result in compatibility concerns during the
+period of transition over to PQC compliant algorithms.
+
+In hybrid mode, multiple sets of certificates need to be configured for QEMU,
+at least one set with traditional (non-PQC compliant) algorithms, and at least
+one other set with modern (PQC compliant) algorithms. At time of the TLS
+handshake, the GNUTLS algorithm priorities should ensure that PQC compliant
+algorithms are negotiated if both sides of the connection support PQC. If one
+side lacks PQC, the TLS handshake should fallback to the non-PQC algorithms.
+This can assist with interoperability during the transition to PQC, but has a
+potential weakness wrt downgrade attacks forcing use of non-PQC algorithms.
+Exclusive PQC mode should be preferred where both peers in the TLS connections
+are known to support PQC.
+
+Key generation parameters
+^^^^^^^^^^^^^^^^^^^^^^^^^
+
+To create certificates with PQC compliant algorithms, the ``--key-type``
+argument must be passed to ``certtool`` when creating private keys. No
+extra arguments are required for the other ``certtool`` commands, as
+their behaviour will be determined by the private key type.
+
+The typical PQC compliant algorithms to use are ``ML-DSA-44``, ``ML-DSA-65``
+and ``ML-DSA-87``, with ``ML-DSA-65`` being a suitable default choice in
+the absence of explicit requirements.
+
+Taking the example earlier, for creating a key for a client certificate,
+to use ``ML-DSA-65`` the command line would be modified to look like::
+
+   # certtool --generate-privkey --key-type=mldsa65 > client-hostNNN-key.pem
+
+The equivalent modification applies to the creation of the private keys
+used for server certs, or root/intermediate CA certs.
+
+For hybrid mode, the additional indexed certificate naming must be used.
+If multiple configured certificates are compatible with the mutually
+supported crypto algorithms between the client and server, then the
+first matching certificate will be used.
+
+IOW, to ensure that PQC certificates are preferred, they must use a
+non-index based filename, or use an index that is smaller than any
+non-PQC certificates. ie, ``server-cert.pem`` for PQC and ``server-cert-0.pem``
+for non-PQC, or ``server-cert-0.pem`` for PQC and ``server-cert-1.pem`` for
+non-PQC.
+
+Force disabling PQC via crypto priority
+^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+In the OS configuration for system crypto algorithm priorities has
+enabled PQC, this can (optionally) be overriden in QEMU configuration
+disable use of PQC using the ``priority`` parameter to the ``tls-creds-x509``
+object::
+
+  NO_MLDSA="-SIGN-ML-DSA-65:-SIGN-ML-DSA-44:-SIGN-ML-DSA-87"
+  NO_MLKEM="-GROUP-X25519-MLKEM768:-GROUP-SECP256R1-MLKEM768:-GROUP-SECP384R1-MLKEM1024"
+  # qemu-nbd --object tls-creds-x509,id=tls0,endpoint=server,dir=....,priority=@SYSTEM:$NO_MLDSA:$NO_MLKEM
+
+
 TLS Pre-Shared Keys (PSK)
 ~~~~~~~~~~~~~~~~~~~~~~~~~
 

From 094fd7d36f2a7d3c9fb22254888fe7b99b39631b Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sat, 1 Nov 2025 13:01:29 +0100
Subject: [PATCH 1937/2396] hw/arm/imx8mp-evk: Add KVM support

Allows the imx8mp-evk machine to run guests with KVM acceleration.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251101120130.236721-2-shentey@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/imx8mp-evk.rst | 19 +++++++++++++++++++
 hw/arm/Kconfig                 |  3 ++-
 hw/arm/fsl-imx8mp.c            | 34 +++++++++++++++++++++++++++++-----
 hw/arm/imx8mp-evk.c            | 11 +++++++++++
 4 files changed, 61 insertions(+), 6 deletions(-)

diff --git a/docs/system/arm/imx8mp-evk.rst b/docs/system/arm/imx8mp-evk.rst
index b2f7d29ade..75c8fbd366 100644
--- a/docs/system/arm/imx8mp-evk.rst
+++ b/docs/system/arm/imx8mp-evk.rst
@@ -60,3 +60,22 @@ Now that everything is prepared the machine can be started as follows:
       -dtb imx8mp-evk.dtb \
       -append "root=/dev/mmcblk2p2" \
       -drive file=sdcard.img,if=sd,bus=2,format=raw,id=mmcblk2
+
+
+KVM Acceleration
+----------------
+
+To enable hardware-assisted acceleration via KVM, append
+``-accel kvm -cpu host`` to the command line. While this speeds up performance
+significantly, be aware of the following limitations:
+
+* The ``imx8mp-evk`` machine is not included under the "virtualization use case"
+  of :doc:`QEMU's security policy </system/security>`. This means that you
+  should not trust that it can contain malicious guests, whether it is run
+  using TCG or KVM. If you don't trust your guests and you're relying on QEMU to
+  be the security boundary, you want to choose another machine such as ``virt``.
+* Rather than Cortex-A53 CPUs, the same CPU type as the host's will be used.
+  This is a limitation of KVM and may not work with guests with a tight
+  dependency on Cortex-A53.
+* No EL2 and EL3 exception levels are available which is also a KVM limitation.
+  Direct kernel boot should work but running U-Boot, TF-A, etc. won't succeed.
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index b44b85f436..0cdeb60f1f 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -622,7 +622,8 @@ config FSL_IMX8MP
 config FSL_IMX8MP_EVK
     bool
     default y
-    depends on TCG && AARCH64
+    depends on AARCH64
+    depends on TCG || KVM
     select FSL_IMX8MP
 
 config ARM_SMMUV3
diff --git a/hw/arm/fsl-imx8mp.c b/hw/arm/fsl-imx8mp.c
index 866f4d1d74..ee6f3e42d2 100644
--- a/hw/arm/fsl-imx8mp.c
+++ b/hw/arm/fsl-imx8mp.c
@@ -12,11 +12,13 @@
 #include "system/address-spaces.h"
 #include "hw/arm/bsa.h"
 #include "hw/arm/fsl-imx8mp.h"
-#include "hw/intc/arm_gicv3.h"
 #include "hw/misc/unimp.h"
 #include "hw/boards.h"
+#include "system/kvm.h"
 #include "system/system.h"
+#include "target/arm/cpu.h"
 #include "target/arm/cpu-qom.h"
+#include "target/arm/kvm_arm.h"
 #include "qapi/error.h"
 #include "qobject/qlist.h"
 
@@ -193,15 +195,15 @@ static void fsl_imx8mp_init(Object *obj)
 {
     MachineState *ms = MACHINE(qdev_get_machine());
     FslImx8mpState *s = FSL_IMX8MP(obj);
+    const char *cpu_type = ms->cpu_type ?: ARM_CPU_TYPE_NAME("cortex-a53");
     int i;
 
     for (i = 0; i < MIN(ms->smp.cpus, FSL_IMX8MP_NUM_CPUS); i++) {
         g_autofree char *name = g_strdup_printf("cpu%d", i);
-        object_initialize_child(obj, name, &s->cpu[i],
-                                ARM_CPU_TYPE_NAME("cortex-a53"));
+        object_initialize_child(obj, name, &s->cpu[i], cpu_type);
     }
 
-    object_initialize_child(obj, "gic", &s->gic, TYPE_ARM_GICV3);
+    object_initialize_child(obj, "gic", &s->gic, gicv3_class_name());
 
     object_initialize_child(obj, "ccm", &s->ccm, TYPE_IMX8MP_CCM);
 
@@ -274,7 +276,8 @@ static void fsl_imx8mp_realize(DeviceState *dev, Error **errp)
     /* CPUs */
     for (i = 0; i < ms->smp.cpus; i++) {
         /* On uniprocessor, the CBAR is set to 0 */
-        if (ms->smp.cpus > 1) {
+        if (ms->smp.cpus > 1 &&
+                object_property_find(OBJECT(&s->cpu[i]), "reset-cbar")) {
             object_property_set_int(OBJECT(&s->cpu[i]), "reset-cbar",
                                     fsl_imx8mp_memmap[FSL_IMX8MP_GIC_DIST].addr,
                                     &error_abort);
@@ -286,6 +289,16 @@ static void fsl_imx8mp_realize(DeviceState *dev, Error **errp)
         object_property_set_int(OBJECT(&s->cpu[i]), "cntfrq", 8000000,
                                 &error_abort);
 
+        if (object_property_find(OBJECT(&s->cpu[i]), "has_el2")) {
+            object_property_set_bool(OBJECT(&s->cpu[i]), "has_el2",
+                                     !kvm_enabled(), &error_abort);
+        }
+
+        if (object_property_find(OBJECT(&s->cpu[i]), "has_el3")) {
+            object_property_set_bool(OBJECT(&s->cpu[i]), "has_el3",
+                                     !kvm_enabled(), &error_abort);
+        }
+
         if (i) {
             /*
              * Secondary CPUs start in powered-down state (and can be
@@ -304,6 +317,7 @@ static void fsl_imx8mp_realize(DeviceState *dev, Error **errp)
     {
         SysBusDevice *gicsbd = SYS_BUS_DEVICE(&s->gic);
         QList *redist_region_count;
+        bool pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
 
         qdev_prop_set_uint32(gicdev, "num-cpu", ms->smp.cpus);
         qdev_prop_set_uint32(gicdev, "num-irq",
@@ -360,6 +374,16 @@ static void fsl_imx8mp_realize(DeviceState *dev, Error **errp)
                                qdev_get_gpio_in(cpudev, ARM_CPU_VIRQ));
             sysbus_connect_irq(gicsbd, i + 3 * ms->smp.cpus,
                                qdev_get_gpio_in(cpudev, ARM_CPU_VFIQ));
+
+            if (kvm_enabled()) {
+                if (pmu) {
+                    assert(arm_feature(&s->cpu[i].env, ARM_FEATURE_PMU));
+                    if (kvm_irqchip_in_kernel()) {
+                        kvm_arm_pmu_set_irq(&s->cpu[i], VIRTUAL_PMU_IRQ);
+                    }
+                    kvm_arm_pmu_init(&s->cpu[i]);
+                }
+            }
         }
     }
 
diff --git a/hw/arm/imx8mp-evk.c b/hw/arm/imx8mp-evk.c
index fc880a1d44..3ddcf1af5a 100644
--- a/hw/arm/imx8mp-evk.c
+++ b/hw/arm/imx8mp-evk.c
@@ -13,6 +13,7 @@
 #include "hw/arm/machines-qom.h"
 #include "hw/boards.h"
 #include "hw/qdev-properties.h"
+#include "system/kvm.h"
 #include "system/qtest.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
@@ -94,12 +95,22 @@ static void imx8mp_evk_init(MachineState *machine)
     }
 }
 
+static const char *imx8mp_evk_get_default_cpu_type(const MachineState *ms)
+{
+    if (kvm_enabled()) {
+        return ARM_CPU_TYPE_NAME("host");
+    }
+
+    return ARM_CPU_TYPE_NAME("cortex-a53");
+}
+
 static void imx8mp_evk_machine_init(MachineClass *mc)
 {
     mc->desc = "NXP i.MX 8M Plus EVK Board";
     mc->init = imx8mp_evk_init;
     mc->max_cpus = FSL_IMX8MP_NUM_CPUS;
     mc->default_ram_id = "imx8mp-evk.ram";
+    mc->get_default_cpu_type = imx8mp_evk_get_default_cpu_type;
 }
 
 DEFINE_MACHINE_AARCH64("imx8mp-evk", imx8mp_evk_machine_init)

From 74bc6caea92de3cf6a6772d0d248a9e26aea2dd3 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Sat, 1 Nov 2025 13:01:30 +0100
Subject: [PATCH 1938/2396] hw/arm/imx8mp-evk: Fix guest time in KVM mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The imx8mp DTB hardcodes the clock frequency of the system counter to 8MHz.
In KVM mode, the host CPU is used whose system counter runs at a different
frequency, resulting in the guest clock running slower or faster. Fix this
by not hardcoding the clock frequency which makes the Linux driver read
the real clock frequency from the register.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251101120130.236721-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/imx8mp-evk.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/hw/arm/imx8mp-evk.c b/hw/arm/imx8mp-evk.c
index 3ddcf1af5a..44e0601967 100644
--- a/hw/arm/imx8mp-evk.c
+++ b/hw/arm/imx8mp-evk.c
@@ -44,6 +44,15 @@ static void imx8mp_evk_modify_dtb(const struct arm_boot_info *info, void *fdt)
         fdt_nop_property(fdt, offset, "cpu-idle-states");
         offset = fdt_node_offset_by_compatible(fdt, offset, "arm,cortex-a53");
     }
+
+    if (kvm_enabled()) {
+        /* Use system counter frequency from host CPU to fix time in guest */
+        offset = fdt_node_offset_by_compatible(fdt, -1, "arm,armv8-timer");
+        while (offset >= 0) {
+            fdt_nop_property(fdt, offset, "clock-frequency");
+            offset = fdt_node_offset_by_compatible(fdt, offset, "arm,armv8-timer");
+        }
+    }
 }
 
 static void imx8mp_evk_init(MachineState *machine)

From 7ed514fbe404a07d773ad7b335b83251839595e3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 22 Aug 2025 13:42:41 +0200
Subject: [PATCH 1939/2396] cpus: Access CPUState::thread_kicked atomically
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpus_kick_thread() is called via cpu_exit() -> qemu_cpu_kick(),
and also via gdb_syscall_handling(). Access the CPUState field
using atomic accesses. See commit 8ac2ca02744 ("accel: use atomic
accesses for exit_request") for rationale.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-Id: <20250925025520.71805-3-philmd@linaro.org>
---
 system/cpus.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/system/cpus.c b/system/cpus.c
index aa7bfcf56e..74f5a5bd4e 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -480,10 +480,10 @@ void qemu_process_cpu_events(CPUState *cpu)
 
 void cpus_kick_thread(CPUState *cpu)
 {
-    if (cpu->thread_kicked) {
+    if (qatomic_read(&cpu->thread_kicked)) {
         return;
     }
-    cpu->thread_kicked = true;
+    qatomic_set(&cpu->thread_kicked, true);
 
 #ifndef _WIN32
     int err = pthread_kill(cpu->thread->thread, SIG_IPI);

From fc2380b5686e8233f406a3e43be278fd9a2603e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 26 Aug 2025 06:54:12 +0200
Subject: [PATCH 1940/2396] accel/tcg: Use cpu_is_stopped() helper to access
 CPUState::stopped
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20250925025520.71805-5-philmd@linaro.org>
---
 accel/tcg/tcg-accel-ops-rr.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/tcg-accel-ops-rr.c b/accel/tcg/tcg-accel-ops-rr.c
index 2fb4643997..f84342e044 100644
--- a/accel/tcg/tcg-accel-ops-rr.c
+++ b/accel/tcg/tcg-accel-ops-rr.c
@@ -197,7 +197,7 @@ static void *rr_cpu_thread_fn(void *arg)
     qemu_guest_random_seed_thread_part2(cpu->random_seed);
 
     /* wait for initial kick-off after machine start */
-    while (first_cpu->stopped) {
+    while (cpu_is_stopped(first_cpu)) {
         qemu_cond_wait_bql(first_cpu->halt_cond);
 
         /* process any pending work */

From c89d1c879ab0281d481e460644eb5d56ace1a038 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 4 Sep 2025 18:31:58 -0400
Subject: [PATCH 1941/2396] bql: Fix bql_locked status with condvar APIs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU has a per-thread "bql_locked" variable stored in TLS section, showing
whether the current thread is holding the BQL lock.

It's a pretty handy variable.  Function-wise, QEMU have codes trying to
conditionally take bql, relying on the var reflecting the locking status
(e.g. BQL_LOCK_GUARD), or in a GDB debugging session, we could also look at
the variable (in reality, co_tls_bql_locked), to see which thread is
currently holding the bql.

When using that as a debugging facility, sometimes we can observe multiple
threads holding bql at the same time. It's because QEMU's condvar APIs
bypassed the bql_*() API, hence they do not update bql_locked even if they
have released the mutex while waiting.

It can cause confusion if one does "thread apply all p co_tls_bql_locked"
and see multiple threads reporting true.

Fix this by moving the bql status updates into the mutex debug hooks.  Now
the variable should always reflect the reality.

Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20250904223158.1276992-1-peterx@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/qemu/main-loop.h  | 18 ++++++++++++++++++
 stubs/iothread-lock.c     |  9 +++++++++
 system/cpus.c             | 14 ++++++++++++--
 util/qemu-thread-common.h |  7 +++++++
 4 files changed, 46 insertions(+), 2 deletions(-)

diff --git a/include/qemu/main-loop.h b/include/qemu/main-loop.h
index 4e2436b196..0d55c636b2 100644
--- a/include/qemu/main-loop.h
+++ b/include/qemu/main-loop.h
@@ -270,6 +270,24 @@ void rust_bql_mock_lock(void);
  */
 bool bql_locked(void);
 
+/**
+ * mutex_is_bql:
+ *
+ * @mutex: the mutex pointer
+ *
+ * Returns whether the mutex is the BQL.
+ */
+bool mutex_is_bql(QemuMutex *mutex);
+
+/**
+ * bql_update_status:
+ *
+ * @locked: update status on whether the BQL is locked
+ *
+ * NOTE: this should normally only be invoked when the status changed.
+ */
+void bql_update_status(bool locked);
+
 /**
  * bql_block: Allow/deny releasing the BQL
  *
diff --git a/stubs/iothread-lock.c b/stubs/iothread-lock.c
index 6050c081f5..c89c9c7228 100644
--- a/stubs/iothread-lock.c
+++ b/stubs/iothread-lock.c
@@ -34,3 +34,12 @@ void bql_block_unlock(bool increase)
     assert((new_value > bql_unlock_blocked) == increase);
     bql_unlock_blocked = new_value;
 }
+
+bool mutex_is_bql(QemuMutex *mutex)
+{
+    return false;
+}
+
+void bql_update_status(bool locked)
+{
+}
diff --git a/system/cpus.c b/system/cpus.c
index 74f5a5bd4e..ef2d2f241f 100644
--- a/system/cpus.c
+++ b/system/cpus.c
@@ -524,6 +524,18 @@ bool qemu_in_vcpu_thread(void)
 
 QEMU_DEFINE_STATIC_CO_TLS(bool, bql_locked)
 
+bool mutex_is_bql(QemuMutex *mutex)
+{
+    return mutex == &bql;
+}
+
+void bql_update_status(bool locked)
+{
+    /* This function should only be used when an update happened.. */
+    assert(bql_locked() != locked);
+    set_bql_locked(locked);
+}
+
 static uint32_t bql_unlock_blocked;
 
 void bql_block_unlock(bool increase)
@@ -564,14 +576,12 @@ void bql_lock_impl(const char *file, int line)
 
     g_assert(!bql_locked());
     bql_lock_fn(&bql, file, line);
-    set_bql_locked(true);
 }
 
 void bql_unlock(void)
 {
     g_assert(bql_locked());
     g_assert(!bql_unlock_blocked);
-    set_bql_locked(false);
     qemu_mutex_unlock(&bql);
 }
 
diff --git a/util/qemu-thread-common.h b/util/qemu-thread-common.h
index 2af6b12085..09331843ba 100644
--- a/util/qemu-thread-common.h
+++ b/util/qemu-thread-common.h
@@ -14,6 +14,7 @@
 #define QEMU_THREAD_COMMON_H
 
 #include "qemu/thread.h"
+#include "qemu/main-loop.h"
 #include "trace.h"
 
 static inline void qemu_mutex_post_init(QemuMutex *mutex)
@@ -39,6 +40,9 @@ static inline void qemu_mutex_post_lock(QemuMutex *mutex,
     mutex->line = line;
 #endif
     trace_qemu_mutex_locked(mutex, file, line);
+    if (mutex_is_bql(mutex)) {
+        bql_update_status(true);
+    }
 }
 
 static inline void qemu_mutex_pre_unlock(QemuMutex *mutex,
@@ -49,6 +53,9 @@ static inline void qemu_mutex_pre_unlock(QemuMutex *mutex,
     mutex->line = 0;
 #endif
     trace_qemu_mutex_unlock(mutex, file, line);
+    if (mutex_is_bql(mutex)) {
+        bql_update_status(false);
+    }
 }
 
 #endif

From e9048f099b3142fb21ed40cd3ce0557d44e56d06 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 1 Oct 2025 16:10:21 +0200
Subject: [PATCH 1942/2396] exec/cpu: Declare cpu_memory_rw_debug() in
 'hw/core/cpu.h' and document
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpu_memory_rw_debug() dispatches to CPUClass::memory_rw_debug(),
move its declaration closer to the CPU API. Document.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Message-Id: <20251001150529.14122-22-philmd@linaro.org>
---
 include/exec/cpu-common.h |  4 ----
 include/hw/core/cpu.h     | 20 ++++++++++++++++++++
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index 67e15c8e50..e0be4ee2b8 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -150,10 +150,6 @@ typedef int (RAMBlockIterFunc)(RAMBlock *rb, void *opaque);
 
 int qemu_ram_foreach_block(RAMBlockIterFunc func, void *opaque);
 
-/* Returns: 0 on success, -1 on error */
-int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
-                        void *ptr, size_t len, bool is_write);
-
 /* vl.c */
 void list_cpus(void);
 
diff --git a/include/hw/core/cpu.h b/include/hw/core/cpu.h
index e79e8e0a8e..9615051774 100644
--- a/include/hw/core/cpu.h
+++ b/include/hw/core/cpu.h
@@ -688,6 +688,26 @@ int cpu_write_elf32_note(WriteCoreDumpFunction f, CPUState *cpu,
 int cpu_write_elf32_qemunote(WriteCoreDumpFunction f, CPUState *cpu,
                              void *opaque);
 
+/**
+ * cpu_memory_rw_debug:
+ * @cpu: The CPU whose memory is to be accessed
+ * @addr: guest virtual address
+ * @ptr: buffer with the data transferred
+ * @len: the number of bytes to read or write
+ * @is_write: indicates the transfer direction
+ *
+ * Take a virtual address, convert it to a physical address via
+ * an MMU lookup using the current settings of the specified CPU,
+ * and then perform the access (using address_space_rw() for
+ * reads or address_space_write_rom() for writes).
+ *
+ * This function is intended for use by the GDB stub and similar code.
+ *
+ * Returns: 0 on success, -1 on error
+ */
+int cpu_memory_rw_debug(CPUState *cpu, vaddr addr,
+                        void *ptr, size_t len, bool is_write);
+
 /**
  * cpu_get_crash_info:
  * @cpu: The CPU to get crash information for

From 91634cc3311d28f39ad4b82a8b92c9aeae6e4c51 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 30 Oct 2025 17:33:02 +0000
Subject: [PATCH 1943/2396] timers: properly prefix init_clocks()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise we run the risk of name clashing, for example with
stm32l4x5_usart-test.c should we shuffle the includes.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251030173302.1379174-1-alex.bennee@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/qemu/timer.h              | 5 +++--
 tests/unit/test-aio-multithread.c | 2 +-
 util/main-loop.c                  | 2 +-
 util/qemu-timer.c                 | 2 +-
 4 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/include/qemu/timer.h b/include/qemu/timer.h
index 406d741120..8b561cd696 100644
--- a/include/qemu/timer.h
+++ b/include/qemu/timer.h
@@ -786,11 +786,12 @@ static inline int64_t qemu_soonest_timeout(int64_t timeout1, int64_t timeout2)
 }
 
 /**
- * initclocks:
+ * qemu_init_clocks:
+ * @notify_cb: optional call-back for timer expiry
  *
  * Initialise the clock & timer infrastructure
  */
-void init_clocks(QEMUTimerListNotifyCB *notify_cb);
+void qemu_init_clocks(QEMUTimerListNotifyCB *notify_cb);
 
 static inline int64_t get_max_clock_jump(void)
 {
diff --git a/tests/unit/test-aio-multithread.c b/tests/unit/test-aio-multithread.c
index 0ead6bf34a..c24200a712 100644
--- a/tests/unit/test-aio-multithread.c
+++ b/tests/unit/test-aio-multithread.c
@@ -443,7 +443,7 @@ static void test_multi_mutex_10(void)
 
 int main(int argc, char **argv)
 {
-    init_clocks(NULL);
+    qemu_init_clocks(NULL);
 
     g_test_init(&argc, &argv, NULL);
     g_test_add_func("/aio/multi/lifecycle", test_lifecycle);
diff --git a/util/main-loop.c b/util/main-loop.c
index b8ddda8f5e..b462598f76 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -162,7 +162,7 @@ int qemu_init_main_loop(Error **errp)
     int ret;
     GSource *src;
 
-    init_clocks(qemu_timer_notify_cb);
+    qemu_init_clocks(qemu_timer_notify_cb);
 
     ret = qemu_signal_init(errp);
     if (ret) {
diff --git a/util/qemu-timer.c b/util/qemu-timer.c
index 56f11b6a64..2a6be4c7f9 100644
--- a/util/qemu-timer.c
+++ b/util/qemu-timer.c
@@ -637,7 +637,7 @@ static void qemu_virtual_clock_set_ns(int64_t time)
     return cpus_set_virtual_clock(time);
 }
 
-void init_clocks(QEMUTimerListNotifyCB *notify_cb)
+void qemu_init_clocks(QEMUTimerListNotifyCB *notify_cb)
 {
     QEMUClockType type;
     for (type = 0; type < QEMU_CLOCK_MAX; type++) {

From 20aa05edc2ca547590dfa09909d5745203f57b43 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Fri, 31 Oct 2025 22:02:45 +0300
Subject: [PATCH 1944/2396] util/hexdump: fix QEMU_HEXDUMP_LINE_WIDTH logic
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU_HEXDUMP_LINE_WIDTH calculation doesn't correspond to
qemu_hexdump_line(). This leads to last line of the dump (when
length is not multiply of 16) has badly aligned ASCII part.

Let's calculate length the same way.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251031190246.257153-2-vsementsov@yandex-team.ru>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 util/hexdump.c | 38 ++++++++++++++++++++++++--------------
 1 file changed, 24 insertions(+), 14 deletions(-)

diff --git a/util/hexdump.c b/util/hexdump.c
index f29ffceb74..7cfc547261 100644
--- a/util/hexdump.c
+++ b/util/hexdump.c
@@ -22,6 +22,19 @@ static inline char hexdump_nibble(unsigned x)
     return (x < 10 ? '0' : 'a' - 10) + x;
 }
 
+static size_t hexdump_line_length(size_t buf_len, size_t unit_len,
+                                  size_t block_len)
+{
+    size_t est = buf_len * 2;
+    if (unit_len) {
+        est += buf_len / unit_len;
+    }
+    if (block_len) {
+        est += buf_len / block_len;
+    }
+    return est;
+}
+
 GString *qemu_hexdump_line(GString *str, const void *vbuf, size_t len,
                            size_t unit_len, size_t block_len)
 {
@@ -30,14 +43,8 @@ GString *qemu_hexdump_line(GString *str, const void *vbuf, size_t len,
 
     if (str == NULL) {
         /* Estimate the length of the output to avoid reallocs. */
-        size_t est = len * 2;
-        if (unit_len) {
-            est += len / unit_len;
-        }
-        if (block_len) {
-            est += len / block_len;
-        }
-        str = g_string_sized_new(est + 1);
+        str = g_string_sized_new(hexdump_line_length(len, unit_len, block_len)
+                                 + 1);
     }
 
     for (u = 0, b = 0; len; u++, b++, len--, buf++) {
@@ -76,13 +83,16 @@ static void asciidump_line(char *line, const void *bufptr, size_t len)
 }
 
 #define QEMU_HEXDUMP_LINE_BYTES 16
-#define QEMU_HEXDUMP_LINE_WIDTH \
-    (QEMU_HEXDUMP_LINE_BYTES * 2 + QEMU_HEXDUMP_LINE_BYTES / 4)
+#define QEMU_HEXDUMP_UNIT 1
+#define QEMU_HEXDUMP_BLOCK 4
 
 void qemu_hexdump(FILE *fp, const char *prefix,
                   const void *bufptr, size_t size)
 {
-    g_autoptr(GString) str = g_string_sized_new(QEMU_HEXDUMP_LINE_WIDTH + 1);
+    int width = hexdump_line_length(QEMU_HEXDUMP_LINE_BYTES,
+                                    QEMU_HEXDUMP_UNIT,
+                                    QEMU_HEXDUMP_BLOCK);
+    g_autoptr(GString) str = g_string_sized_new(width + 1);
     char ascii[QEMU_HEXDUMP_LINE_BYTES + 1];
     size_t b, len;
 
@@ -90,11 +100,11 @@ void qemu_hexdump(FILE *fp, const char *prefix,
         len = MIN(size - b, QEMU_HEXDUMP_LINE_BYTES);
 
         g_string_truncate(str, 0);
-        qemu_hexdump_line(str, bufptr + b, len, 1, 4);
+        qemu_hexdump_line(str, bufptr + b, len,
+                          QEMU_HEXDUMP_UNIT, QEMU_HEXDUMP_BLOCK);
         asciidump_line(ascii, bufptr + b, len);
 
-        fprintf(fp, "%s: %04zx: %-*s %s\n",
-                prefix, b, QEMU_HEXDUMP_LINE_WIDTH, str->str, ascii);
+        fprintf(fp, "%s: %04zx: %-*s %s\n", prefix, b, width, str->str, ascii);
     }
 
 }

From 6c5571e72aed54194a1a07799d8c23c90b5f229e Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 30 Oct 2025 17:59:32 +0100
Subject: [PATCH 1945/2396] rx: cpu: fix interrupts check in
 rx_cpu_do_interrupt()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 87511341c30 broke interrupt handling, replacing interrupts
fetch with a bool and then the remaining code attempting to check
individual bits on that bool value, which effectively masked those
interrupts.

Fix it by checking individual interrupt bits directly instead of
old 'fetch then check' approach.

Fixes: 87511341c30d ("add cpu_test_interrupt()/cpu_set_interrupt() helpers and use them tree wide")
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251030165932.138512-1-imammedo@redhat.com>
[PMD: Rebased on commit dde21df2393 "call plugin trap callbacks"]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/rx/helper.c | 45 ++++++++++++++++++++-------------------------
 1 file changed, 20 insertions(+), 25 deletions(-)

diff --git a/target/rx/helper.c b/target/rx/helper.c
index ef47e32add..e9a7aaf610 100644
--- a/target/rx/helper.c
+++ b/target/rx/helper.c
@@ -41,11 +41,9 @@ void rx_cpu_unpack_psw(CPURXState *env, uint32_t psw, int rte)
     env->psw_c = FIELD_EX32(psw, PSW, C);
 }
 
-#define INT_FLAGS (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIR)
 void rx_cpu_do_interrupt(CPUState *cs)
 {
     CPURXState *env = cpu_env(cs);
-    int do_irq = cpu_test_interrupt(cs, INT_FLAGS);
     uint32_t save_psw;
     uint64_t last_pc = env->pc;
 
@@ -59,29 +57,26 @@ void rx_cpu_do_interrupt(CPUState *cs)
     save_psw = rx_cpu_pack_psw(env);
     env->psw_pm = env->psw_i = env->psw_u = 0;
 
-    if (do_irq) {
-        if (do_irq & CPU_INTERRUPT_FIR) {
-            env->bpc = env->pc;
-            env->bpsw = save_psw;
-            env->pc = env->fintv;
-            env->psw_ipl = 15;
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_FIR);
-            qemu_set_irq(env->ack, env->ack_irq);
-            qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
-            qemu_log_mask(CPU_LOG_INT, "fast interrupt raised\n");
-        } else if (do_irq & CPU_INTERRUPT_HARD) {
-            env->isp -= 4;
-            cpu_stl_data(env, env->isp, save_psw);
-            env->isp -= 4;
-            cpu_stl_data(env, env->isp, env->pc);
-            env->pc = cpu_ldl_data(env, env->intb + env->ack_irq * 4);
-            env->psw_ipl = env->ack_ipl;
-            cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
-            qemu_set_irq(env->ack, env->ack_irq);
-            qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
-            qemu_log_mask(CPU_LOG_INT,
-                          "interrupt 0x%02x raised\n", env->ack_irq);
-        }
+    if (cpu_test_interrupt(cs, CPU_INTERRUPT_FIR)) {
+        env->bpc = env->pc;
+        env->bpsw = save_psw;
+        env->pc = env->fintv;
+        env->psw_ipl = 15;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_FIR);
+        qemu_set_irq(env->ack, env->ack_irq);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        qemu_log_mask(CPU_LOG_INT, "fast interrupt raised\n");
+    } else if (cpu_test_interrupt(cs, CPU_INTERRUPT_HARD)) {
+        env->isp -= 4;
+        cpu_stl_data(env, env->isp, save_psw);
+        env->isp -= 4;
+        cpu_stl_data(env, env->isp, env->pc);
+        env->pc = cpu_ldl_data(env, env->intb + env->ack_irq * 4);
+        env->psw_ipl = env->ack_ipl;
+        cpu_reset_interrupt(cs, CPU_INTERRUPT_HARD);
+        qemu_set_irq(env->ack, env->ack_irq);
+        qemu_plugin_vcpu_interrupt_cb(cs, last_pc);
+        qemu_log_mask(CPU_LOG_INT, "interrupt 0x%02x raised\n", env->ack_irq);
     } else {
         uint32_t vec = cs->exception_index;
         const char *expname = "unknown exception";

From 5848d2c3a6c4cc1b37234db462b1b36bc0a18bf4 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 28 Oct 2025 16:52:35 +0000
Subject: [PATCH 1946/2396] docs/devel/testing/fuzzing: Note that you can get
 qtest to read from a file

It is possible to get qtest to read fuzzer reproducers from a file
rather than directly from stdio; this is useful when you want to run
QEMU under gdb to debug the failure.  Document how to do this, which
was previously only written down in the commit message for
5b18a6bf44b9 ("chardev: Allow setting file chardev input file on the
command line").

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Message-id: 20251028165236.3327658-1-peter.maydell@linaro.org
---
 docs/devel/testing/fuzzing.rst | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/docs/devel/testing/fuzzing.rst b/docs/devel/testing/fuzzing.rst
index c3ac084311..c43f815f32 100644
--- a/docs/devel/testing/fuzzing.rst
+++ b/docs/devel/testing/fuzzing.rst
@@ -263,6 +263,15 @@ generic-fuzz target.
 
 - Report the bug and send a patch with the C reproducer upstream
 
+QEMU can also read the reproducer directly from a file rather than
+from standard input::
+
+    $QEMU_PATH $QEMU_ARGS -qtest chardev:repro \
+      -chardev file,id=repro,path=/dev/null,input-path=/tmp/reproducer
+
+This is useful if you want to run QEMU under a debugger to investigate
+the failure.
+
 Implementation Details / Fuzzer Lifecycle
 -----------------------------------------
 

From 112b55f0b012d00a50befc8e1aa4abe350f00b01 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Tue, 7 Oct 2025 15:42:13 -0300
Subject: [PATCH 1947/2396] migration/savevm: Add a compatibility check for
 capabilities

It has always been possible to enable arbitrary migration capabilities
and attempt to take a snapshot of the VM with the savevm/loadvm
commands as well as their QMP counterparts
snapshot-save/snapshot-load.

Most migration capabilities are not meant to be used with snapshots
and there's a risk of crashing QEMU or producing incorrect
behavior. Ideally, every migration capability would either be
implemented for savevm or explicitly rejected.

Add a compatibility check routine and reject the snapshot command if
an incompatible capability is enabled. For now only act on the the two
that actually cause a crash: multifd and mapped-ram.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2881
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251007184213.5990-1-farosas@suse.de
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/options.c | 27 +++++++++++++++++++++++++++
 migration/options.h |  1 +
 migration/savevm.c  |  8 ++++++++
 3 files changed, 36 insertions(+)

diff --git a/migration/options.c b/migration/options.c
index 5183112775..d9227809d7 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -445,11 +445,38 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
     MIGRATION_CAPABILITY_VALIDATE_UUID,
     MIGRATION_CAPABILITY_ZERO_COPY_SEND);
 
+/* Snapshot compatibility check list */
+static const
+INITIALIZE_MIGRATE_CAPS_SET(check_caps_savevm,
+                            MIGRATION_CAPABILITY_MULTIFD,
+                            MIGRATION_CAPABILITY_MAPPED_RAM,
+);
+
 static bool migrate_incoming_started(void)
 {
     return !!migration_incoming_get_current()->transport_data;
 }
 
+bool migrate_can_snapshot(Error **errp)
+{
+    MigrationState *s = migrate_get_current();
+    int i;
+
+    for (i = 0; i < check_caps_savevm.size; i++) {
+        int incomp_cap = check_caps_savevm.caps[i];
+
+        if (s->capabilities[incomp_cap]) {
+            error_setg(errp,
+                       "Snapshots are not compatible with %s",
+                       MigrationCapability_str(incomp_cap));
+            return false;
+        }
+    }
+
+    return true;
+}
+
+
 bool migrate_rdma_caps_check(bool *caps, Error **errp)
 {
     if (caps[MIGRATION_CAPABILITY_XBZRLE]) {
diff --git a/migration/options.h b/migration/options.h
index 82d839709e..a7b3262d1e 100644
--- a/migration/options.h
+++ b/migration/options.h
@@ -59,6 +59,7 @@ bool migrate_tls(void);
 
 bool migrate_rdma_caps_check(bool *caps, Error **errp);
 bool migrate_caps_check(bool *old_caps, bool *new_caps, Error **errp);
+bool migrate_can_snapshot(Error **errp);
 
 /* parameters */
 
diff --git a/migration/savevm.c b/migration/savevm.c
index 7b35ec4dd0..aafa40d779 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -3322,6 +3322,10 @@ bool save_snapshot(const char *name, bool overwrite, const char *vmstate,
 
     GLOBAL_STATE_CODE();
 
+    if (!migrate_can_snapshot(errp)) {
+        return false;
+    }
+
     if (migration_is_blocked(errp)) {
         return false;
     }
@@ -3507,6 +3511,10 @@ bool load_snapshot(const char *name, const char *vmstate,
     int ret;
     MigrationIncomingState *mis = migration_incoming_get_current();
 
+    if (!migrate_can_snapshot(errp)) {
+        return false;
+    }
+
     if (!bdrv_all_can_snapshot(has_devices, devices, errp)) {
         return false;
     }

From 1a4922a96174c2c4e07d9d4f15bde3500e1520a4 Mon Sep 17 00:00:00 2001
From: Steve Sistare <steven.sistare@oracle.com>
Date: Fri, 10 Oct 2025 05:16:40 -0700
Subject: [PATCH 1948/2396] MAINTAINERS: update cpr reviewers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update cpr reviewers.  Some of these files overlap with migration
files, but some do not.

Signed-off-by: Steve Sistare <steven.sistare@oracle.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/1760098600-399192-1-git-send-email-steven.sistare@oracle.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 MAINTAINERS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index ee058e2fef..12ec2d6860 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3114,7 +3114,8 @@ T: git https://gitlab.com/jsnow/qemu.git jobs
 T: git https://gitlab.com/vsementsov/qemu.git block
 
 CheckPoint and Restart (CPR)
-R: Steve Sistare <steven.sistare@oracle.com>
+R: Peter Xu <peterx@redhat.com>
+R: Fabiano Rosas <farosas@suse.de>
 S: Supported
 F: hw/vfio/cpr*
 F: include/hw/vfio/vfio-cpr.h

From e5423828d69e90a8fc9db90d8a0d7cf916370fe0 Mon Sep 17 00:00:00 2001
From: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Date: Wed, 1 Oct 2025 18:18:22 +0200
Subject: [PATCH 1949/2396] migration/ram: fix docs of ram_handle_zero

Remove outdated 'ch' parameter from the function documentation.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20251001161823.2032399-3-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/ram.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/migration/ram.c b/migration/ram.c
index 5eef2efc78..1384748193 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -3630,7 +3630,6 @@ static inline void *colo_cache_from_block_offset(RAMBlock *block,
  * determined to be zero, then zap it.
  *
  * @host: host address for the zero page
- * @ch: what the page is filled from.  We only support zero
  * @size: size of the zero page
  */
 void ram_handle_zero(void *host, uint64_t size)

From 04a191cb36e71f4bb44d28af2b56b9624b36b0a1 Mon Sep 17 00:00:00 2001
From: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Date: Fri, 10 Oct 2025 13:59:53 +0200
Subject: [PATCH 1950/2396] migration: add FEATURE_SEEKABLE to QIOChannelBlock

Enable the use of the mapped-ram migration feature with savevm/loadvm
snapshots by adding the QIO_CHANNEL_FEATURE_SEEKABLE feature to
QIOChannelBlock. Implement io_preadv and io_pwritev methods to provide
positioned I/O capabilities that don't modify the channel's position
pointer.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Link: https://lore.kernel.org/r/20251010115954.1995298-2-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/channel-block.c | 44 +++++++++++++++++++++++++++++++++++++++
 1 file changed, 44 insertions(+)

diff --git a/migration/channel-block.c b/migration/channel-block.c
index 97de5a691b..9cf383d4b5 100644
--- a/migration/channel-block.c
+++ b/migration/channel-block.c
@@ -30,6 +30,7 @@ qio_channel_block_new(BlockDriverState *bs)
     QIOChannelBlock *ioc;
 
     ioc = QIO_CHANNEL_BLOCK(object_new(TYPE_QIO_CHANNEL_BLOCK));
+    qio_channel_set_feature(QIO_CHANNEL(ioc), QIO_CHANNEL_FEATURE_SEEKABLE);
 
     bdrv_ref(bs);
     ioc->bs = bs;
@@ -96,6 +97,47 @@ qio_channel_block_writev(QIOChannel *ioc,
     return qiov.size;
 }
 
+static ssize_t
+qio_channel_block_preadv(QIOChannel *ioc,
+                         const struct iovec *iov,
+                         size_t niov,
+                         off_t offset,
+                         Error **errp)
+{
+    QIOChannelBlock *bioc = QIO_CHANNEL_BLOCK(ioc);
+    QEMUIOVector qiov;
+    int ret;
+
+    qemu_iovec_init_external(&qiov, (struct iovec *)iov, niov);
+    ret = bdrv_readv_vmstate(bioc->bs, &qiov, offset);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "bdrv_readv_vmstate failed");
+        return -1;
+    }
+
+    return qiov.size;
+}
+
+static ssize_t
+qio_channel_block_pwritev(QIOChannel *ioc,
+                          const struct iovec *iov,
+                          size_t niov,
+                          off_t offset,
+                          Error **errp)
+{
+    QIOChannelBlock *bioc = QIO_CHANNEL_BLOCK(ioc);
+    QEMUIOVector qiov;
+    int ret;
+
+    qemu_iovec_init_external(&qiov, (struct iovec *)iov, niov);
+    ret = bdrv_writev_vmstate(bioc->bs, &qiov, offset);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "bdrv_writev_vmstate failed");
+        return -1;
+    }
+
+    return qiov.size;
+}
 
 static int
 qio_channel_block_set_blocking(QIOChannel *ioc,
@@ -177,6 +219,8 @@ qio_channel_block_class_init(ObjectClass *klass,
     ioc_klass->io_writev = qio_channel_block_writev;
     ioc_klass->io_readv = qio_channel_block_readv;
     ioc_klass->io_set_blocking = qio_channel_block_set_blocking;
+    ioc_klass->io_preadv = qio_channel_block_preadv;
+    ioc_klass->io_pwritev = qio_channel_block_pwritev;
     ioc_klass->io_seek = qio_channel_block_seek;
     ioc_klass->io_close = qio_channel_block_close;
     ioc_klass->io_set_aio_fd_handler = qio_channel_block_set_aio_fd_handler;

From 0ecd28582477e80f867ea776eff34315b048d928 Mon Sep 17 00:00:00 2001
From: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Date: Fri, 10 Oct 2025 13:59:54 +0200
Subject: [PATCH 1951/2396] migration: mapped-ram: handle zero pages

Make mapped-ram compatible with loadvm snapshot restoring by explicitly
zeroing memory pages in this case.
Skip zeroing for -incoming and -loadvm migrations to preserve performance.

Signed-off-by: Marco Cavenati <Marco.Cavenati@eurecom.fr>
Link: https://lore.kernel.org/r/20251010115954.1995298-3-Marco.Cavenati@eurecom.fr
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/options.c |  1 -
 migration/ram.c     | 59 ++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 58 insertions(+), 2 deletions(-)

diff --git a/migration/options.c b/migration/options.c
index d9227809d7..e78324b80c 100644
--- a/migration/options.c
+++ b/migration/options.c
@@ -449,7 +449,6 @@ INITIALIZE_MIGRATE_CAPS_SET(check_caps_background_snapshot,
 static const
 INITIALIZE_MIGRATE_CAPS_SET(check_caps_savevm,
                             MIGRATION_CAPABILITY_MULTIFD,
-                            MIGRATION_CAPABILITY_MAPPED_RAM,
 );
 
 static bool migrate_incoming_started(void)
diff --git a/migration/ram.c b/migration/ram.c
index 1384748193..29f016cb25 100644
--- a/migration/ram.c
+++ b/migration/ram.c
@@ -4038,12 +4038,58 @@ static size_t ram_load_multifd_pages(void *host_addr, size_t size,
     return size;
 }
 
+/**
+ * handle_zero_mapped_ram: Zero out a range of RAM pages if required during
+ * mapped-ram load
+ *
+ * Zeroing is only performed when restoring from a snapshot (HMP loadvm).
+ * During incoming migration or -loadvm cli snapshot load, the function is a
+ * no-op and returns true as in those cases the pages are already guaranteed to
+ * be zeroed.
+ *
+ * Returns: true on success, false on error (with @errp set).
+ * @from_bit_idx: Starting index relative to the map of the page (inclusive)
+ * @to_bit_idx:   Ending index relative to the map of the page (exclusive)
+ */
+static bool handle_zero_mapped_ram(RAMBlock *block, unsigned long from_bit_idx,
+                                   unsigned long to_bit_idx, Error **errp)
+{
+    ERRP_GUARD();
+    ram_addr_t offset;
+    size_t size;
+    void *host;
+
+    /*
+     * Zeroing is not needed for either -loadvm (RUN_STATE_PRELAUNCH), or
+     * -incoming (RUN_STATE_INMIGRATE).
+     */
+    if (!runstate_check(RUN_STATE_RESTORE_VM)) {
+        return true;
+    }
+
+    if (from_bit_idx >= to_bit_idx) {
+        return true;
+    }
+
+    size = TARGET_PAGE_SIZE * (to_bit_idx - from_bit_idx);
+    offset = from_bit_idx << TARGET_PAGE_BITS;
+    host = host_from_ram_block_offset(block, offset);
+    if (!host) {
+        error_setg(errp, "zero page outside of ramblock %s range",
+                   block->idstr);
+        return false;
+    }
+    ram_handle_zero(host, size);
+
+    return true;
+}
+
 static bool read_ramblock_mapped_ram(QEMUFile *f, RAMBlock *block,
                                      long num_pages, unsigned long *bitmap,
                                      Error **errp)
 {
     ERRP_GUARD();
-    unsigned long set_bit_idx, clear_bit_idx;
+    unsigned long set_bit_idx, clear_bit_idx = 0;
     ram_addr_t offset;
     void *host;
     size_t read, unread, size;
@@ -4052,6 +4098,12 @@ static bool read_ramblock_mapped_ram(QEMUFile *f, RAMBlock *block,
          set_bit_idx < num_pages;
          set_bit_idx = find_next_bit(bitmap, num_pages, clear_bit_idx + 1)) {
 
+        /* Zero pages */
+        if (!handle_zero_mapped_ram(block, clear_bit_idx, set_bit_idx, errp)) {
+            return false;
+        }
+
+        /* Non-zero pages */
         clear_bit_idx = find_next_zero_bit(bitmap, num_pages, set_bit_idx + 1);
 
         unread = TARGET_PAGE_SIZE * (clear_bit_idx - set_bit_idx);
@@ -4083,6 +4135,11 @@ static bool read_ramblock_mapped_ram(QEMUFile *f, RAMBlock *block,
         }
     }
 
+    /* Handle trailing 0 pages */
+    if (!handle_zero_mapped_ram(block, clear_bit_idx, num_pages, errp)) {
+        return false;
+    }
+
     return true;
 
 err:

From 346479c304c712f79e7c378ae4a47ca661d1d563 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 16 Oct 2025 18:03:13 +0200
Subject: [PATCH 1952/2396] migration: Remove unused VMSTATE_UINTTL_EQUAL[_V]()
 macros
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The last use of VMSTATE_UINTTL_EQUAL() was removed in commit
16a2497bd44 ("target-ppc: Fix CPU migration from qemu-2.6 <->
later versions"), 9 years ago; remove it.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251016160313.25751-1-philmd@linaro.org
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/cpu.h | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/include/migration/cpu.h b/include/migration/cpu.h
index 65abe3c8cc..ca7cc0479e 100644
--- a/include/migration/cpu.h
+++ b/include/migration/cpu.h
@@ -19,8 +19,6 @@
 
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT64_V(_f, _s, _v)
-#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)                            \
-    VMSTATE_UINT64_EQUAL_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)                        \
     VMSTATE_UINT64_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_2DARRAY_V(_f, _s, _n1, _n2, _v)                \
@@ -40,8 +38,6 @@
 
 #define VMSTATE_UINTTL_V(_f, _s, _v)                                  \
     VMSTATE_UINT32_V(_f, _s, _v)
-#define VMSTATE_UINTTL_EQUAL_V(_f, _s, _v)                            \
-    VMSTATE_UINT32_EQUAL_V(_f, _s, _v)
 #define VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, _v)                        \
     VMSTATE_UINT32_ARRAY_V(_f, _s, _n, _v)
 #define VMSTATE_UINTTL_2DARRAY_V(_f, _s, _n1, _n2, _v)                \
@@ -53,8 +49,6 @@
 
 #define VMSTATE_UINTTL(_f, _s)                                        \
     VMSTATE_UINTTL_V(_f, _s, 0)
-#define VMSTATE_UINTTL_EQUAL(_f, _s)                                  \
-    VMSTATE_UINTTL_EQUAL_V(_f, _s, 0)
 #define VMSTATE_UINTTL_ARRAY(_f, _s, _n)                              \
     VMSTATE_UINTTL_ARRAY_V(_f, _s, _n, 0)
 #define VMSTATE_UINTTL_2DARRAY(_f, _s, _n1, _n2)                      \

From 6f190736bfece55593a07fe0e16195221346fc04 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 21 Oct 2025 18:04:04 -0400
Subject: [PATCH 1953/2396] migration: Fix error leak in
 postcopy_ram_listen_thread()

As reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA9otBWtR7rPQ0Y9aBm+7ZWJzd4VWpXrAmGr8XspPn+zpw@mail.gmail.com

Fix it by freeing the error.  When at it, always reset the local_err
pointer in both paths.

Cc: Arun Menon <armenon@redhat.com>
Resolves: Coverity CID 1641390
Fixes: 94272d9b45 ("migration: Capture error in postcopy_ram_listen_thread()")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/migration/savevm.c b/migration/savevm.c
index aafa40d779..232cae090b 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2136,17 +2136,18 @@ static void *postcopy_ram_listen_thread(void *opaque)
         if (postcopy_state_get() == POSTCOPY_INCOMING_RUNNING &&
             !migrate_postcopy_ram() && migrate_dirty_bitmaps())
         {
-            error_report("%s: loadvm failed during postcopy: %d. All states "
+            error_report("%s: loadvm failed during postcopy: %d: %s. All states "
                          "are migrated except dirty bitmaps. Some dirty "
                          "bitmaps may be lost, and present migrated dirty "
                          "bitmaps are correctly migrated and valid.",
-                         __func__, load_res);
+                         __func__, load_res, error_get_pretty(local_err));
+            g_clear_pointer(&local_err, error_free);
             load_res = 0; /* prevent further exit() */
         } else {
             error_prepend(&local_err,
                           "loadvm failed during postcopy: %d: ", load_res);
             migrate_set_error(migr, local_err);
-            error_report_err(local_err);
+            g_clear_pointer(&local_err, error_report_err);
             migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                                            MIGRATION_STATUS_FAILED);
         }

From 6a65fdee8a267436f3f18a35619c854bf255d8c1 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 21 Oct 2025 18:04:05 -0400
Subject: [PATCH 1954/2396] migration/cpr: Fix coverity report in
 cpr_exec_persist_state()

Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA_mUQ2NeoguR5efrhw7XYGofnriWEA=+Dg+Ocvyam1wAw@mail.gmail.com

mfd leak is a false positive, try to use a coverity annotation (which I
didn't find manual myself, but still give it a shot).

Fix the other one by capture error if setenv() failed.  When at it, pass
the error to the top (cpr_state_save()).  Along the way, changing all
retval to bool when errp is around.

Resolves: Coverity CID 1641391
Resolves: Coverity CID 1641392
Fixes: efc6587313 ("migration: cpr-exec save and load")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/migration/cpr.h |  4 ++--
 migration/cpr-exec.c    | 10 ++++++++--
 migration/cpr.c         | 15 +++++++++------
 migration/migration.c   |  2 +-
 4 files changed, 20 insertions(+), 11 deletions(-)

diff --git a/include/migration/cpr.h b/include/migration/cpr.h
index a412d6663c..027cb98073 100644
--- a/include/migration/cpr.h
+++ b/include/migration/cpr.h
@@ -41,7 +41,7 @@ MigMode cpr_get_incoming_mode(void);
 void cpr_set_incoming_mode(MigMode mode);
 bool cpr_is_incoming(void);
 
-int cpr_state_save(MigrationChannel *channel, Error **errp);
+bool cpr_state_save(MigrationChannel *channel, Error **errp);
 int cpr_state_load(MigrationChannel *channel, Error **errp);
 void cpr_state_close(void);
 struct QIOChannel *cpr_state_ioc(void);
@@ -56,7 +56,7 @@ QEMUFile *cpr_transfer_input(MigrationChannel *channel, Error **errp);
 void cpr_exec_init(void);
 QEMUFile *cpr_exec_output(Error **errp);
 QEMUFile *cpr_exec_input(Error **errp);
-void cpr_exec_persist_state(QEMUFile *f);
+bool cpr_exec_persist_state(QEMUFile *f, Error **errp);
 bool cpr_exec_has_state(void);
 void cpr_exec_unpersist_state(void);
 void cpr_exec_unpreserve_fds(void);
diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index d57714bc5d..087ca94c87 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -40,16 +40,22 @@ static QEMUFile *qemu_file_new_fd_output(int fd, const char *name)
     return qemu_file_new_output(ioc);
 }
 
-void cpr_exec_persist_state(QEMUFile *f)
+bool cpr_exec_persist_state(QEMUFile *f, Error **errp)
 {
     QIOChannelFile *fioc = QIO_CHANNEL_FILE(qemu_file_get_ioc(f));
+    /* coverity[leaked_storage] - mfd intentionally kept open across exec() */
     int mfd = dup(fioc->fd);
     char val[16];
 
     /* Remember mfd in environment for post-exec load */
     qemu_clear_cloexec(mfd);
     snprintf(val, sizeof(val), "%d", mfd);
-    g_setenv(CPR_EXEC_STATE_NAME, val, 1);
+    if (!g_setenv(CPR_EXEC_STATE_NAME, val, 1)) {
+        error_setg(errp, "Setting env %s = %s failed", CPR_EXEC_STATE_NAME, val);
+        return false;
+    }
+
+    return true;
 }
 
 static int cpr_exec_find_state(void)
diff --git a/migration/cpr.c b/migration/cpr.c
index 22dbac7c72..adee2a919a 100644
--- a/migration/cpr.c
+++ b/migration/cpr.c
@@ -176,7 +176,7 @@ bool cpr_is_incoming(void)
     return incoming_mode != MIG_MODE_NONE;
 }
 
-int cpr_state_save(MigrationChannel *channel, Error **errp)
+bool cpr_state_save(MigrationChannel *channel, Error **errp)
 {
     int ret;
     QEMUFile *f;
@@ -190,10 +190,10 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
     } else if (mode == MIG_MODE_CPR_EXEC) {
         f = cpr_exec_output(errp);
     } else {
-        return 0;
+        return true;
     }
     if (!f) {
-        return -1;
+        return false;
     }
 
     qemu_put_be32(f, QEMU_CPR_FILE_MAGIC);
@@ -202,11 +202,14 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
     ret = vmstate_save_state(f, &vmstate_cpr_state, &cpr_state, 0, errp);
     if (ret) {
         qemu_fclose(f);
-        return ret;
+        return false;
     }
 
     if (migrate_mode() == MIG_MODE_CPR_EXEC) {
-        cpr_exec_persist_state(f);
+        if (!cpr_exec_persist_state(f, errp)) {
+            qemu_fclose(f);
+            return false;
+        }
     }
 
     /*
@@ -217,7 +220,7 @@ int cpr_state_save(MigrationChannel *channel, Error **errp)
     qio_channel_shutdown(qemu_file_get_ioc(f), QIO_CHANNEL_SHUTDOWN_WRITE,
                          NULL);
     cpr_state_file = f;
-    return 0;
+    return true;
 }
 
 int cpr_state_load(MigrationChannel *channel, Error **errp)
diff --git a/migration/migration.c b/migration/migration.c
index a63b46bbef..c8a5712993 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2301,7 +2301,7 @@ void qmp_migrate(const char *uri, bool has_channels,
         return;
     }
 
-    if (cpr_state_save(cpr_channel, &local_err)) {
+    if (!cpr_state_save(cpr_channel, &local_err)) {
         goto out;
     }
 

From 89471ef237ca683c90e9e8d216746b86ba4c1013 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 21 Oct 2025 18:04:06 -0400
Subject: [PATCH 1955/2396] migration/cpr: Fix UAF in cpr_exec_cb() when
 execvp() fails

Per reported and analyzed by Peter:

https://lore.kernel.org/r/CAFEAcA82ih8RVCm-u1oxiS0V2K4rV4jMzNb13pAV=e2ivmiDRA@mail.gmail.com

Fix the issue by moving the error_setg_errno() earlier.  When at it, clear
argv variable after freed.

Resolves: Coverity CID 1641397
Fixes: a3eae205c6 ("migration: cpr-exec mode")
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/cpr-exec.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index 087ca94c87..d284f6e734 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -152,10 +152,10 @@ static void cpr_exec_cb(void *opaque)
      * exec should only fail if argv[0] is bogus, or has a permissions problem,
      * or the system is very short on resources.
      */
-    g_strfreev(argv);
+    error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
+    g_clear_pointer(&argv, g_strfreev);
     cpr_exec_unpreserve_fds();
 
-    error_setg_errno(&err, errno, "execvp %s failed", argv[0]);
     error_report_err(error_copy(err));
     migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
     migrate_set_error(s, err);

From ded3cf4aaf7af98f56822566cd96f3014fe5508c Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Tue, 21 Oct 2025 18:04:07 -0400
Subject: [PATCH 1956/2396] migration/cpr: Avoid crashing QEMU when cpr-exec
 runs with no args

If an user invokes cpr-exec without setting the exec args first, currently
it'll crash QEMU.

Avoid it, instead fail the QMP migrate command.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251021220407.2662288-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/migration/migration.c b/migration/migration.c
index c8a5712993..4ed2a2e881 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -2195,6 +2195,12 @@ static bool migrate_prepare(MigrationState *s, bool resume, Error **errp)
             error_setg(errp, "Cannot use %s with CPR", conflict);
             return false;
         }
+
+        if (s->parameters.mode == MIG_MODE_CPR_EXEC &&
+            !s->parameters.cpr_exec_command) {
+            error_setg(errp, "Parameter 'cpr-exec-command' required for cpr-exec");
+            return false;
+        }
     }
 
     if (migrate_init(s, errp)) {

From 8922a758b29251d9009ec509e7f580b76509ab3d Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 23 Oct 2025 17:55:24 +0800
Subject: [PATCH 1957/2396] ram-block-attributes: fix interaction with hugetlb
 memory backends

Currently, CoCo VMs can perform conversion at the base page granularity,
which is the granularity that has to be tracked. In relevant setups, the
target page size is assumed to be equal to the host page size, thus
fixing the block size to the host page size.

However, since private memory and shared memory have different backend
at present, users can specify shared memory with a hugetlbfs backend
while private memory with guest_memfd backend only supports 4K page
size. In this scenario, ram_block->page_size is different from the host
page size which will trigger an assertion when retrieving the block
size.

To address this, return the host page size directly to relax the
restriction. This changes fixes a regression of using hugetlbfs backend
for shared memory within CoCo VMs, with or without VFIO devices' presence.

Acked-by: David Hildenbrand <david@redhat.com>
Tested-by: Farrah Chen <farrah.chen@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20251023095526.48365-2-chenyi.qiang@intel.com
[peterx: fix subject, per david]
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 system/ram-block-attributes.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/system/ram-block-attributes.c b/system/ram-block-attributes.c
index 68e8a02703..a7579de5b4 100644
--- a/system/ram-block-attributes.c
+++ b/system/ram-block-attributes.c
@@ -22,16 +22,14 @@ OBJECT_DEFINE_SIMPLE_TYPE_WITH_INTERFACES(RamBlockAttributes,
                                           { })
 
 static size_t
-ram_block_attributes_get_block_size(const RamBlockAttributes *attr)
+ram_block_attributes_get_block_size(void)
 {
     /*
      * Because page conversion could be manipulated in the size of at least 4K
      * or 4K aligned, Use the host page size as the granularity to track the
      * memory attribute.
      */
-    g_assert(attr && attr->ram_block);
-    g_assert(attr->ram_block->page_size == qemu_real_host_page_size());
-    return attr->ram_block->page_size;
+    return qemu_real_host_page_size();
 }
 
 
@@ -40,7 +38,7 @@ ram_block_attributes_rdm_is_populated(const RamDiscardManager *rdm,
                                       const MemoryRegionSection *section)
 {
     const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
-    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const size_t block_size = ram_block_attributes_get_block_size();
     const uint64_t first_bit = section->offset_within_region / block_size;
     const uint64_t last_bit =
         first_bit + int128_get64(section->size) / block_size - 1;
@@ -81,7 +79,7 @@ ram_block_attributes_for_each_populated_section(const RamBlockAttributes *attr,
 {
     unsigned long first_bit, last_bit;
     uint64_t offset, size;
-    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const size_t block_size = ram_block_attributes_get_block_size();
     int ret = 0;
 
     first_bit = section->offset_within_region / block_size;
@@ -122,7 +120,7 @@ ram_block_attributes_for_each_discarded_section(const RamBlockAttributes *attr,
 {
     unsigned long first_bit, last_bit;
     uint64_t offset, size;
-    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const size_t block_size = ram_block_attributes_get_block_size();
     int ret = 0;
 
     first_bit = section->offset_within_region / block_size;
@@ -163,7 +161,7 @@ ram_block_attributes_rdm_get_min_granularity(const RamDiscardManager *rdm,
     const RamBlockAttributes *attr = RAM_BLOCK_ATTRIBUTES(rdm);
 
     g_assert(mr == attr->ram_block->mr);
-    return ram_block_attributes_get_block_size(attr);
+    return ram_block_attributes_get_block_size();
 }
 
 static void
@@ -265,7 +263,7 @@ ram_block_attributes_is_valid_range(RamBlockAttributes *attr, uint64_t offset,
     g_assert(mr);
 
     uint64_t region_size = memory_region_size(mr);
-    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const size_t block_size = ram_block_attributes_get_block_size();
 
     if (!QEMU_IS_ALIGNED(offset, block_size) ||
         !QEMU_IS_ALIGNED(size, block_size)) {
@@ -322,7 +320,7 @@ int ram_block_attributes_state_change(RamBlockAttributes *attr,
                                       uint64_t offset, uint64_t size,
                                       bool to_discard)
 {
-    const size_t block_size = ram_block_attributes_get_block_size(attr);
+    const size_t block_size = ram_block_attributes_get_block_size();
     const unsigned long first_bit = offset / block_size;
     const unsigned long nbits = size / block_size;
     const unsigned long last_bit = first_bit + nbits - 1;

From b2ceb87b1a210d91a29d525590eb164d1121b8a1 Mon Sep 17 00:00:00 2001
From: Chenyi Qiang <chenyi.qiang@intel.com>
Date: Thu, 23 Oct 2025 17:55:25 +0800
Subject: [PATCH 1958/2396] ram-block-attributes: Unify the retrieval of the
 block size

There's an existing helper function designed to obtain the block size.
Modify ram_block_attribute_create() to use this function for
consistency.

Tested-by: Farrah Chen <farrah.chen@intel.com>
Signed-off-by: Chenyi Qiang <chenyi.qiang@intel.com>
Link: https://lore.kernel.org/r/20251023095526.48365-3-chenyi.qiang@intel.com
[peterx: fix double spaces, per david]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 system/ram-block-attributes.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/system/ram-block-attributes.c b/system/ram-block-attributes.c
index a7579de5b4..fb7c5c2746 100644
--- a/system/ram-block-attributes.c
+++ b/system/ram-block-attributes.c
@@ -390,7 +390,7 @@ int ram_block_attributes_state_change(RamBlockAttributes *attr,
 
 RamBlockAttributes *ram_block_attributes_create(RAMBlock *ram_block)
 {
-    const int block_size  = qemu_real_host_page_size();
+    const int block_size = ram_block_attributes_get_block_size();
     RamBlockAttributes *attr;
     MemoryRegion *mr = ram_block->mr;
 

From ae00f0088ffd1e9ee6a84d79dccea1820ce873ac Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Wed, 22 Oct 2025 15:04:25 -0400
Subject: [PATCH 1959/2396] migration/qmp: Update "resume" flag doc in
 "migrate" command

It wasn't obvious how the resume flag should be used when staring at the
QAPI doc.  Enrich it to be crystal clear.

Reported-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251022190425.2730441-1-peterx@redhat.com
[peterx: amended wordings, per markus]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 qapi/migration.json | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index be0f3fcc12..c7a6737cc1 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -1732,7 +1732,10 @@
 # @detach: this argument exists only for compatibility reasons and is
 #     ignored by QEMU
 #
-# @resume: resume one paused migration, default "off".  (since 3.0)
+# @resume: when set, use the new uri/channels specified to resume paused
+#     postcopy migration.  This flag should only be used if the previous
+#     postcopy migration was interrupted.  The command will fail unless
+#     migration is in "postcopy-paused" state.  (default: false, since 3.0)
 #
 # Features:
 #

From c2a06e8f28a14cfb26cc442269176ae60d1178ef Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Thu, 23 Oct 2025 12:16:57 -0400
Subject: [PATCH 1960/2396] migration/cpr: Document obscure usage of g_autofree
 when parse str

HMP parsing of cpr_exec_command contains an obscure usage of g_autofree.
Provide a document for it to be clear that it's intentional, rather than
memory leaked.

Cc: Dr. David Alan Gilbert <dave@treblig.org>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Link: https://lore.kernel.org/r/20251023161657.2821652-1-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration-hmp-cmds.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/migration/migration-hmp-cmds.c b/migration/migration-hmp-cmds.c
index 847d18faaa..79426bf5d7 100644
--- a/migration/migration-hmp-cmds.c
+++ b/migration/migration-hmp-cmds.c
@@ -734,6 +734,12 @@ void hmp_migrate_set_parameter(Monitor *mon, const QDict *qdict)
         visit_type_bool(v, param, &p->direct_io, &err);
         break;
     case MIGRATION_PARAMETER_CPR_EXEC_COMMAND: {
+        /*
+         * NOTE: g_autofree will only auto g_free() the strv array when
+         * needed, it will not free the strings within the array. It's
+         * intentional: when strv is set, the ownership of the strings will
+         * always be passed to p->cpr_exec_command via QAPI_LIST_APPEND().
+         */
         g_autofree char **strv = NULL;
         g_autoptr(GError) gerr = NULL;
         strList **tail = &p->cpr_exec_command;

From 75e2cb144191ecdbba87cfea3608cdc0664c8142 Mon Sep 17 00:00:00 2001
From: Xiaoyao Li <xiaoyao.li@intel.com>
Date: Mon, 21 Jul 2025 14:52:20 +0800
Subject: [PATCH 1961/2396] hostmem/shm: Allow shm memory backend serve as
 shared memory for coco-VMs

shm can surely serve as the shared memory for coco-VMs. But currently it
doesn't check the backend->guest_memfd to pass down the RAM_GUEST_MEMFD
flag. It leads to failure when creating coco-VMs (e.g., TDX guest) which
require private mmeory.

Set and pass down RAM_GUEST_MEMFD when backend->guest_memfd is true, to
allow shm memory backend serve as shared memory for coco-VMs.

Cc: Stefano Garzarella <sgarzare@redhat.com>
Cc: qemu-stable <qemu-stable@nongnu.org>
Signed-off-by: Xiaoyao Li <xiaoyao.li@intel.com>
Acked-by: David Hildenbrand <david@redhat.com>
Acked-by: Stefano Garzarella <sgarzare@redhat.com>
Link: https://lore.kernel.org/r/20250721065220.895606-1-xiaoyao.li@intel.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 backends/hostmem-shm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backends/hostmem-shm.c b/backends/hostmem-shm.c
index f66211a2ec..806e2670e0 100644
--- a/backends/hostmem-shm.c
+++ b/backends/hostmem-shm.c
@@ -54,6 +54,7 @@ have_fd:
     /* Let's do the same as memory-backend-ram,share=on would do. */
     ram_flags = RAM_SHARED;
     ram_flags |= backend->reserve ? 0 : RAM_NORESERVE;
+    ram_flags |= backend->guest_memfd ? RAM_GUEST_MEMFD : 0;
 
     return memory_region_init_ram_from_fd(&backend->mr, OBJECT(backend),
                                               backend_name, backend->size,

From 986c3292c6b7dbd12868d06555c82757aaab43b6 Mon Sep 17 00:00:00 2001
From: Arun Menon <armenon@redhat.com>
Date: Tue, 28 Oct 2025 11:51:02 +0530
Subject: [PATCH 1962/2396] migration: Fix regression of passing error_fatal
 into vmstate_load_state()

error_fatal is passed to vmstate_load_state() and vmstate_save_state()
functions. This was introduced in commit c632ffbd74. This would exit(1)
on error, and therefore does not allow to propagate the error back to
the caller.

To maintain consistency with prior error handling i.e. either propagating
the error to the caller or reporting it, we must set the error within a
local Error object instead of using error_fatal.

Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Arun Menon <armenon@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Link: https://lore.kernel.org/r/20251028-solve_error_fatal_regression-v2-1-dab24c808a28@redhat.com
[peterx: always uninit var ret, per Akihiko]
[peterx: touchups on line ordering, spacings etc.]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/display/virtio-gpu.c | 21 ++++++++++++++-------
 hw/pci/pci.c            | 15 +++++++++++++--
 hw/s390x/virtio-ccw.c   | 17 +++++++++++++++--
 hw/scsi/spapr_vscsi.c   | 10 ++++++++--
 hw/virtio/virtio-mmio.c | 15 +++++++++++++--
 hw/virtio/virtio-pci.c  | 15 +++++++++++++--
 hw/virtio/virtio.c      | 10 +++++++---
 7 files changed, 83 insertions(+), 20 deletions(-)

diff --git a/hw/display/virtio-gpu.c b/hw/display/virtio-gpu.c
index 3a555125be..43e88a4daf 100644
--- a/hw/display/virtio-gpu.c
+++ b/hw/display/virtio-gpu.c
@@ -1225,7 +1225,8 @@ static int virtio_gpu_save(QEMUFile *f, void *opaque, size_t size,
 {
     VirtIOGPU *g = opaque;
     struct virtio_gpu_simple_resource *res;
-    int i;
+    Error *err = NULL;
+    int i, ret;
 
     /* in 2d mode we should never find unprocessed commands here */
     assert(QTAILQ_EMPTY(&g->cmdq));
@@ -1248,8 +1249,12 @@ static int virtio_gpu_save(QEMUFile *f, void *opaque, size_t size,
     }
     qemu_put_be32(f, 0); /* end of list */
 
-    return vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL,
-                              &error_fatal);
+    ret = vmstate_save_state(f, &vmstate_virtio_gpu_scanouts, g, NULL,
+                             &err);
+    if (ret < 0) {
+        error_report_err(err);
+    }
+    return ret;
 }
 
 static bool virtio_gpu_load_restore_mapping(VirtIOGPU *g,
@@ -1288,7 +1293,7 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
     Error *err = NULL;
     struct virtio_gpu_simple_resource *res;
     uint32_t resource_id, pformat;
-    int i;
+    int i, ret;
 
     g->hostmem = 0;
 
@@ -1348,9 +1353,11 @@ static int virtio_gpu_load(QEMUFile *f, void *opaque, size_t size,
     }
 
     /* load & apply scanout state */
-    vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1, &error_fatal);
-
-    return 0;
+    ret = vmstate_load_state(f, &vmstate_virtio_gpu_scanouts, g, 1, &err);
+    if (ret < 0) {
+        error_report_err(err);
+    }
+    return ret;
 }
 
 static int virtio_gpu_blob_save(QEMUFile *f, void *opaque, size_t size,
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 738b0c41ae..b1eba348e0 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -921,21 +921,32 @@ const VMStateDescription vmstate_pci_device = {
 
 void pci_device_save(PCIDevice *s, QEMUFile *f)
 {
+    Error *local_err = NULL;
+    int ret;
+
     /* Clear interrupt status bit: it is implicit
      * in irq_state which we are saving.
      * This makes us compatible with old devices
      * which never set or clear this bit. */
     s->config[PCI_STATUS] &= ~PCI_STATUS_INTERRUPT;
-    vmstate_save_state(f, &vmstate_pci_device, s, NULL, &error_fatal);
+    ret = vmstate_save_state(f, &vmstate_pci_device, s, NULL, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     /* Restore the interrupt status bit. */
     pci_update_irq_status(s);
 }
 
 int pci_device_load(PCIDevice *s, QEMUFile *f)
 {
+    Error *local_err = NULL;
     int ret;
+
     ret = vmstate_load_state(f, &vmstate_pci_device, s, s->version_id,
-                             &error_fatal);
+                             &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
     /* Restore the interrupt status bit. */
     pci_update_irq_status(s);
     return ret;
diff --git a/hw/s390x/virtio-ccw.c b/hw/s390x/virtio-ccw.c
index 4cb1ced001..4a3ffb84f8 100644
--- a/hw/s390x/virtio-ccw.c
+++ b/hw/s390x/virtio-ccw.c
@@ -1130,13 +1130,26 @@ static int virtio_ccw_load_queue(DeviceState *d, int n, QEMUFile *f)
 static void virtio_ccw_save_config(DeviceState *d, QEMUFile *f)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
-    vmstate_save_state(f, &vmstate_virtio_ccw_dev, dev, NULL, &error_fatal);
+    Error *local_err = NULL;
+    int ret;
+
+    ret = vmstate_save_state(f, &vmstate_virtio_ccw_dev, dev, NULL, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
 }
 
 static int virtio_ccw_load_config(DeviceState *d, QEMUFile *f)
 {
     VirtioCcwDevice *dev = VIRTIO_CCW_DEVICE(d);
-    return vmstate_load_state(f, &vmstate_virtio_ccw_dev, dev, 1, &error_fatal);
+    Error *local_err = NULL;
+    int ret;
+
+    ret = vmstate_load_state(f, &vmstate_virtio_ccw_dev, dev, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+    return ret;
 }
 
 static void virtio_ccw_pre_plugged(DeviceState *d, Error **errp)
diff --git a/hw/scsi/spapr_vscsi.c b/hw/scsi/spapr_vscsi.c
index f0a7dd2b88..a6591319db 100644
--- a/hw/scsi/spapr_vscsi.c
+++ b/hw/scsi/spapr_vscsi.c
@@ -628,10 +628,16 @@ static const VMStateDescription vmstate_spapr_vscsi_req = {
 static void vscsi_save_request(QEMUFile *f, SCSIRequest *sreq)
 {
     vscsi_req *req = sreq->hba_private;
+    Error *local_err = NULL;
+    int rc;
+
     assert(req->active);
 
-    vmstate_save_state(f, &vmstate_spapr_vscsi_req, req, NULL, &error_fatal);
-
+    rc = vmstate_save_state(f, &vmstate_spapr_vscsi_req, req, NULL, &local_err);
+    if (rc < 0) {
+        error_report_err(local_err);
+        return;
+    }
     trace_spapr_vscsi_save_request(req->qtag, req->cur_desc_num,
                                    req->cur_desc_offset);
 }
diff --git a/hw/virtio/virtio-mmio.c b/hw/virtio/virtio-mmio.c
index fb58c36452..c05c00bcd4 100644
--- a/hw/virtio/virtio-mmio.c
+++ b/hw/virtio/virtio-mmio.c
@@ -612,15 +612,26 @@ static const VMStateDescription vmstate_virtio_mmio = {
 static void virtio_mmio_save_extra_state(DeviceState *opaque, QEMUFile *f)
 {
     VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+    Error *local_err = NULL;
+    int ret;
 
-    vmstate_save_state(f, &vmstate_virtio_mmio, proxy, NULL, &error_fatal);
+    ret = vmstate_save_state(f, &vmstate_virtio_mmio, proxy, NULL, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
 }
 
 static int virtio_mmio_load_extra_state(DeviceState *opaque, QEMUFile *f)
 {
     VirtIOMMIOProxy *proxy = VIRTIO_MMIO(opaque);
+    Error *local_err = NULL;
+    int ret;
 
-    return vmstate_load_state(f, &vmstate_virtio_mmio, proxy, 1, &error_fatal);
+    ret = vmstate_load_state(f, &vmstate_virtio_mmio, proxy, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+    return ret;
 }
 
 static bool virtio_mmio_has_extra_state(DeviceState *opaque)
diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 937e22f08a..99cb30fe59 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -187,15 +187,26 @@ static bool virtio_pci_has_extra_state(DeviceState *d)
 static void virtio_pci_save_extra_state(DeviceState *d, QEMUFile *f)
 {
     VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
+    Error *local_err = NULL;
+    int ret;
 
-    vmstate_save_state(f, &vmstate_virtio_pci, proxy, NULL, &error_fatal);
+    ret = vmstate_save_state(f, &vmstate_virtio_pci, proxy, NULL, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
 }
 
 static int virtio_pci_load_extra_state(DeviceState *d, QEMUFile *f)
 {
     VirtIOPCIProxy *proxy = to_virtio_pci_proxy(d);
+    Error *local_err = NULL;
+    int ret;
 
-    return vmstate_load_state(f, &vmstate_virtio_pci, proxy, 1, &error_fatal);
+    ret = vmstate_load_state(f, &vmstate_virtio_pci, proxy, 1, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+    return ret;
 }
 
 static void virtio_pci_save_queue(DeviceState *d, int n, QEMUFile *f)
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index 153ee0a0cf..257cda506a 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -3030,7 +3030,7 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(qbus);
     VirtioDeviceClass *vdc = VIRTIO_DEVICE_GET_CLASS(vdev);
     uint32_t guest_features_lo = (vdev->guest_features & 0xffffffff);
-    int i;
+    int i, ret;
     Error *local_err = NULL;
 
     if (k->save_config) {
@@ -3075,7 +3075,7 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
     }
 
     if (vdc->vmsd) {
-        int ret = vmstate_save_state(f, vdc->vmsd, vdev, NULL, &local_err);
+        ret = vmstate_save_state(f, vdc->vmsd, vdev, NULL, &local_err);
         if (ret) {
             error_report_err(local_err);
             return ret;
@@ -3083,7 +3083,11 @@ int virtio_save(VirtIODevice *vdev, QEMUFile *f)
     }
 
     /* Subsections */
-    return vmstate_save_state(f, &vmstate_virtio, vdev, NULL, &error_fatal);
+    ret = vmstate_save_state(f, &vmstate_virtio, vdev, NULL, &local_err);
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+    return ret;
 }
 
 /* A wrapper for use as a VMState .put function */

From 74343a438c796cd1e679db94294c666469a8c4a8 Mon Sep 17 00:00:00 2001
From: Bin Guo <guobin@linux.alibaba.com>
Date: Sat, 25 Oct 2025 04:55:32 +0800
Subject: [PATCH 1963/2396] migration: Don't free the reason after calling
 migrate_add_blocker

Function migrate_add_blocker will free the reason and set it to NULL
if failure is returned.

Signed-off-by: Bin Guo <guobin@linux.alibaba.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251024205532.19883-1-guobin@linux.alibaba.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/intc/arm_gicv3_kvm.c | 1 -
 target/i386/sev.c       | 1 -
 2 files changed, 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_kvm.c b/hw/intc/arm_gicv3_kvm.c
index 66b0dddfd4..6f311e37ef 100644
--- a/hw/intc/arm_gicv3_kvm.c
+++ b/hw/intc/arm_gicv3_kvm.c
@@ -841,7 +841,6 @@ static void kvm_arm_gicv3_realize(DeviceState *dev, Error **errp)
         error_setg(&kvm_nv_migration_blocker,
                    "Live migration disabled because KVM nested virt is enabled");
         if (migrate_add_blocker(&kvm_nv_migration_blocker, errp)) {
-            error_free(kvm_nv_migration_blocker);
             return;
         }
 
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 1057b8ab2c..fd2dada013 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -1661,7 +1661,6 @@ sev_snp_launch_finish(SevCommonState *sev_common)
     ret = migrate_add_blocker(&sev_mig_blocker, &local_err);
     if (local_err) {
         error_report_err(local_err);
-        error_free(sev_mig_blocker);
         exit(1);
     }
 }

From 75a9f080c2195054cd6f37c75615fc4908283051 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 27 Oct 2025 07:45:01 +0100
Subject: [PATCH 1964/2396] migration: Use unsigned instead of int for bit set
 of MigMode

Signed operands in bitwise operations are unwise.  I believe they're
safe here, but avoiding them is easy, so let's do that.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251027064503.1074255-2-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 4ed2a2e881..478c76bc25 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1672,9 +1672,9 @@ void migration_cancel(void)
     }
 }
 
-static int get_modes(MigMode mode, va_list ap);
+static unsigned get_modes(MigMode mode, va_list ap);
 
-static void add_notifiers(NotifierWithReturn *notify, int modes)
+static void add_notifiers(NotifierWithReturn *notify, unsigned modes)
 {
     for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
         if (modes & BIT(mode)) {
@@ -1687,7 +1687,7 @@ static void add_notifiers(NotifierWithReturn *notify, int modes)
 void migration_add_notifier_modes(NotifierWithReturn *notify,
                                   MigrationNotifyFunc func, MigMode mode, ...)
 {
-    int modes;
+    unsigned modes;
     va_list ap;
 
     va_start(ap, mode);
@@ -1876,7 +1876,7 @@ static bool is_busy(Error **reasonp, Error **errp)
     return false;
 }
 
-static bool is_only_migratable(Error **reasonp, Error **errp, int modes)
+static bool is_only_migratable(Error **reasonp, Error **errp, unsigned modes)
 {
     ERRP_GUARD();
 
@@ -1890,9 +1890,9 @@ static bool is_only_migratable(Error **reasonp, Error **errp, int modes)
     return false;
 }
 
-static int get_modes(MigMode mode, va_list ap)
+static unsigned get_modes(MigMode mode, va_list ap)
 {
-    int modes = 0;
+    unsigned modes = 0;
 
     while (mode != -1 && mode != MIG_MODE_ALL) {
         assert(mode >= MIG_MODE_NORMAL && mode < MIG_MODE__MAX);
@@ -1905,7 +1905,7 @@ static int get_modes(MigMode mode, va_list ap)
     return modes;
 }
 
-static int add_blockers(Error **reasonp, Error **errp, int modes)
+static int add_blockers(Error **reasonp, Error **errp, unsigned modes)
 {
     for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
         if (modes & BIT(mode)) {
@@ -1928,7 +1928,7 @@ int migrate_add_blocker_normal(Error **reasonp, Error **errp)
 
 int migrate_add_blocker_modes(Error **reasonp, Error **errp, MigMode mode, ...)
 {
-    int modes;
+    unsigned modes;
     va_list ap;
 
     va_start(ap, mode);
@@ -1945,7 +1945,7 @@ int migrate_add_blocker_modes(Error **reasonp, Error **errp, MigMode mode, ...)
 
 int migrate_add_blocker_internal(Error **reasonp, Error **errp)
 {
-    int modes = BIT(MIG_MODE__MAX) - 1;
+    unsigned modes = BIT(MIG_MODE__MAX) - 1;
 
     if (is_busy(reasonp, errp)) {
         return -EBUSY;

From 3ca0a0ab05ca4c96c0e6c9cd39c328ffb068b539 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 27 Oct 2025 07:45:02 +0100
Subject: [PATCH 1965/2396] migration: Use bitset of MigMode instead of
 variable arguments

migrate_add_blocker_modes() and migration_add_notifier_modes use
variable arguments for a set of migration modes.  The variable
arguments get collected into a bitset for processsing.  Take a bitset
argument instead, it's simpler.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251027064503.1074255-3-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 hw/vfio/container-legacy.c  |  6 +++---
 hw/vfio/cpr-iommufd.c       |  6 +++---
 hw/vfio/cpr-legacy.c        |  8 +++----
 hw/vfio/cpr.c               |  5 ++---
 hw/vfio/device.c            |  4 ++--
 include/migration/blocker.h |  9 +++-----
 include/migration/misc.h    | 10 ++++-----
 migration/migration.c       | 43 ++++++-------------------------------
 stubs/migr-blocker.c        |  2 +-
 system/physmem.c            |  8 +++----
 10 files changed, 33 insertions(+), 68 deletions(-)

diff --git a/hw/vfio/container-legacy.c b/hw/vfio/container-legacy.c
index 8e9639603e..32c260b345 100644
--- a/hw/vfio/container-legacy.c
+++ b/hw/vfio/container-legacy.c
@@ -977,9 +977,9 @@ static bool vfio_legacy_attach_device(const char *name, VFIODevice *vbasedev,
     if (vbasedev->mdev) {
         error_setg(&vbasedev->cpr.mdev_blocker,
                    "CPR does not support vfio mdev %s", vbasedev->name);
-        if (migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker, errp,
-                                      MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC,
-                                      -1) < 0) {
+        if (migrate_add_blocker_modes(&vbasedev->cpr.mdev_blocker,
+                    BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_EXEC),
+                    errp) < 0) {
             goto hiod_unref_exit;
         }
     }
diff --git a/hw/vfio/cpr-iommufd.c b/hw/vfio/cpr-iommufd.c
index 8a4d65de5e..c244db88fb 100644
--- a/hw/vfio/cpr-iommufd.c
+++ b/hw/vfio/cpr-iommufd.c
@@ -158,9 +158,9 @@ bool vfio_iommufd_cpr_register_iommufd(IOMMUFDBackend *be, Error **errp)
     Error **cpr_blocker = &be->cpr_blocker;
 
     if (!vfio_cpr_supported(be, cpr_blocker)) {
-        return migrate_add_blocker_modes(cpr_blocker, errp,
-                                         MIG_MODE_CPR_TRANSFER,
-                                         MIG_MODE_CPR_EXEC, -1) == 0;
+        return migrate_add_blocker_modes(cpr_blocker,
+                    BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_TRANSFER),
+                    errp);
     }
 
     vmstate_register(NULL, -1, &iommufd_cpr_vmstate, be);
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 7184c93991..86c943158e 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -176,9 +176,9 @@ bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
                                 MIG_MODE_CPR_REBOOT);
 
     if (!vfio_cpr_supported(container, cpr_blocker)) {
-        return migrate_add_blocker_modes(cpr_blocker, errp,
-                                         MIG_MODE_CPR_TRANSFER,
-                                         MIG_MODE_CPR_EXEC, -1) == 0;
+        return migrate_add_blocker_modes(cpr_blocker,
+                        BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_EXEC),
+                        errp) == 0;
     }
 
     vfio_cpr_add_kvm_notifier();
@@ -187,7 +187,7 @@ bool vfio_legacy_cpr_register_container(VFIOLegacyContainer *container,
 
     migration_add_notifier_modes(&container->cpr.transfer_notifier,
                                  vfio_cpr_fail_notifier,
-                                 MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC, -1);
+                                 BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_EXEC));
     return true;
 }
 
diff --git a/hw/vfio/cpr.c b/hw/vfio/cpr.c
index db462aabcb..998230d271 100644
--- a/hw/vfio/cpr.c
+++ b/hw/vfio/cpr.c
@@ -197,8 +197,7 @@ void vfio_cpr_add_kvm_notifier(void)
     if (!kvm_close_notifier.notify) {
         migration_add_notifier_modes(&kvm_close_notifier,
                                      vfio_cpr_kvm_close_notifier,
-                                     MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC,
-                                     -1);
+                                     BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_EXEC));
     }
 }
 
@@ -285,7 +284,7 @@ void vfio_cpr_pci_register_device(VFIOPCIDevice *vdev)
 {
     migration_add_notifier_modes(&vdev->cpr.transfer_notifier,
                                  vfio_cpr_pci_notifier,
-                                 MIG_MODE_CPR_TRANSFER, MIG_MODE_CPR_EXEC, -1);
+                                 BIT(MIG_MODE_CPR_TRANSFER) | BIT(MIG_MODE_CPR_EXEC));
 }
 
 void vfio_cpr_pci_unregister_device(VFIOPCIDevice *vdev)
diff --git a/hw/vfio/device.c b/hw/vfio/device.c
index 8b63e765ac..76869828fc 100644
--- a/hw/vfio/device.c
+++ b/hw/vfio/device.c
@@ -345,8 +345,8 @@ bool vfio_device_get_name(VFIODevice *vbasedev, Error **errp)
                            "vfio device with fd=%d needs an id property",
                            vbasedev->fd);
                 return migrate_add_blocker_modes(&vbasedev->cpr.id_blocker,
-                                                 errp, MIG_MODE_CPR_TRANSFER,
-                                                 -1) == 0;
+                                                 BIT(MIG_MODE_CPR_TRANSFER),
+                                                 errp) == 0;
             }
         }
     }
diff --git a/include/migration/blocker.h b/include/migration/blocker.h
index a687ac0efe..80b75ad5cb 100644
--- a/include/migration/blocker.h
+++ b/include/migration/blocker.h
@@ -16,8 +16,6 @@
 
 #include "qapi/qapi-types-migration.h"
 
-#define MIG_MODE_ALL MIG_MODE__MAX
-
 /**
  * @migrate_add_blocker - prevent all modes of migration from proceeding
  *
@@ -82,16 +80,15 @@ int migrate_add_blocker_normal(Error **reasonp, Error **errp);
  *
  * @reasonp - address of an error to be returned whenever migration is attempted
  *
- * @errp - [out] The reason (if any) we cannot block migration right now.
+ * @modes - the migration modes to be blocked, a bit set of MigMode
  *
- * @mode - one or more migration modes to be blocked.  The list is terminated
- *         by -1 or MIG_MODE_ALL.  For the latter, all modes are blocked.
+ * @errp - [out] The reason (if any) we cannot block migration right now.
  *
  * @returns - 0 on success, -EBUSY/-EACCES on failure, with errp set.
  *
  * *@reasonp is freed and set to NULL if failure is returned.
  * On success, the caller must not free *@reasonp before the blocker is removed.
  */
-int migrate_add_blocker_modes(Error **reasonp, Error **errp, MigMode mode, ...);
+int migrate_add_blocker_modes(Error **reasonp, unsigned modes, Error **errp);
 
 #endif
diff --git a/include/migration/misc.h b/include/migration/misc.h
index 592b93021e..e26d418a6e 100644
--- a/include/migration/misc.h
+++ b/include/migration/misc.h
@@ -90,18 +90,18 @@ void migration_add_notifier(NotifierWithReturn *notify,
                             MigrationNotifyFunc func);
 
 /*
- * Same as migration_add_notifier, but applies to be specified @mode.
+ * Same as migration_add_notifier, but applies to the specified @mode
+ * instead of MIG_MODE_NORMAL.
  */
 void migration_add_notifier_mode(NotifierWithReturn *notify,
                                  MigrationNotifyFunc func, MigMode mode);
 
 /*
- * Same as migration_add_notifier, but applies to all @mode in the argument
- * list.  The list is terminated by -1 or MIG_MODE_ALL.  For the latter,
- * the notifier is added for all modes.
+ * Same as migration_add_notifier, but applies to the specified @modes
+ * (a bitset of MigMode).
  */
 void migration_add_notifier_modes(NotifierWithReturn *notify,
-                                  MigrationNotifyFunc func, MigMode mode, ...);
+                                  MigrationNotifyFunc func, unsigned modes);
 
 /*
  * Remove a notifier from all modes.
diff --git a/migration/migration.c b/migration/migration.c
index 478c76bc25..f613b95287 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1672,8 +1672,6 @@ void migration_cancel(void)
     }
 }
 
-static unsigned get_modes(MigMode mode, va_list ap);
-
 static void add_notifiers(NotifierWithReturn *notify, unsigned modes)
 {
     for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
@@ -1685,15 +1683,8 @@ static void add_notifiers(NotifierWithReturn *notify, unsigned modes)
 }
 
 void migration_add_notifier_modes(NotifierWithReturn *notify,
-                                  MigrationNotifyFunc func, MigMode mode, ...)
+                                  MigrationNotifyFunc func, unsigned modes)
 {
-    unsigned modes;
-    va_list ap;
-
-    va_start(ap, mode);
-    modes = get_modes(mode, ap);
-    va_end(ap);
-
     notify->notify = (NotifierWithReturnFunc)func;
     add_notifiers(notify, modes);
 }
@@ -1701,13 +1692,13 @@ void migration_add_notifier_modes(NotifierWithReturn *notify,
 void migration_add_notifier_mode(NotifierWithReturn *notify,
                                  MigrationNotifyFunc func, MigMode mode)
 {
-    migration_add_notifier_modes(notify, func, mode, -1);
+    migration_add_notifier_modes(notify, func, BIT(mode));
 }
 
 void migration_add_notifier(NotifierWithReturn *notify,
                             MigrationNotifyFunc func)
 {
-    migration_add_notifier_modes(notify, func, MIG_MODE_NORMAL, -1);
+    migration_add_notifier_mode(notify, func, MIG_MODE_NORMAL);
 }
 
 void migration_remove_notifier(NotifierWithReturn *notify)
@@ -1890,21 +1881,6 @@ static bool is_only_migratable(Error **reasonp, Error **errp, unsigned modes)
     return false;
 }
 
-static unsigned get_modes(MigMode mode, va_list ap)
-{
-    unsigned modes = 0;
-
-    while (mode != -1 && mode != MIG_MODE_ALL) {
-        assert(mode >= MIG_MODE_NORMAL && mode < MIG_MODE__MAX);
-        modes |= BIT(mode);
-        mode = va_arg(ap, MigMode);
-    }
-    if (mode == MIG_MODE_ALL) {
-        modes = BIT(MIG_MODE__MAX) - 1;
-    }
-    return modes;
-}
-
 static int add_blockers(Error **reasonp, Error **errp, unsigned modes)
 {
     for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
@@ -1918,23 +1894,16 @@ static int add_blockers(Error **reasonp, Error **errp, unsigned modes)
 
 int migrate_add_blocker(Error **reasonp, Error **errp)
 {
-    return migrate_add_blocker_modes(reasonp, errp, MIG_MODE_ALL);
+    return migrate_add_blocker_modes(reasonp, -1u, errp);
 }
 
 int migrate_add_blocker_normal(Error **reasonp, Error **errp)
 {
-    return migrate_add_blocker_modes(reasonp, errp, MIG_MODE_NORMAL, -1);
+    return migrate_add_blocker_modes(reasonp, BIT(MIG_MODE_NORMAL), errp);
 }
 
-int migrate_add_blocker_modes(Error **reasonp, Error **errp, MigMode mode, ...)
+int migrate_add_blocker_modes(Error **reasonp, unsigned modes, Error **errp)
 {
-    unsigned modes;
-    va_list ap;
-
-    va_start(ap, mode);
-    modes = get_modes(mode, ap);
-    va_end(ap);
-
     if (is_only_migratable(reasonp, errp, modes)) {
         return -EACCES;
     } else if (is_busy(reasonp, errp)) {
diff --git a/stubs/migr-blocker.c b/stubs/migr-blocker.c
index 11cbff268f..e54c7160d3 100644
--- a/stubs/migr-blocker.c
+++ b/stubs/migr-blocker.c
@@ -11,7 +11,7 @@ int migrate_add_blocker_normal(Error **reasonp, Error **errp)
     return 0;
 }
 
-int migrate_add_blocker_modes(Error **reasonp, Error **errp, MigMode mode, ...)
+int migrate_add_blocker_modes(Error **reasonp, unsigned modes, Error **errp)
 {
     return 0;
 }
diff --git a/system/physmem.c b/system/physmem.c
index a340ca3e61..a7e2a5d07f 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -2255,8 +2255,8 @@ static void ram_block_add(RAMBlock *new_block, Error **errp)
                        "Memory region %s uses guest_memfd, "
                        "which is not supported with CPR.",
                        memory_region_name(new_block->mr));
-            migrate_add_blocker_modes(&new_block->cpr_blocker, errp,
-                                      MIG_MODE_CPR_TRANSFER, -1);
+            migrate_add_blocker_modes(&new_block->cpr_blocker,
+                                      BIT(MIG_MODE_CPR_TRANSFER), errp);
         }
     }
 
@@ -4462,8 +4462,8 @@ void ram_block_add_cpr_blocker(RAMBlock *rb, Error **errp)
                "Memory region %s is not compatible with CPR. share=on is "
                "required for memory-backend objects, and aux-ram-share=on is "
                "required.", memory_region_name(rb->mr));
-    migrate_add_blocker_modes(&rb->cpr_blocker, errp, MIG_MODE_CPR_TRANSFER,
-                              -1);
+    migrate_add_blocker_modes(&rb->cpr_blocker, BIT(MIG_MODE_CPR_TRANSFER),
+                              errp);
 }
 
 void ram_block_del_cpr_blocker(RAMBlock *rb)

From 5777e20718c6e7088b3e1488857b7d7905c36980 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 27 Oct 2025 07:45:03 +0100
Subject: [PATCH 1966/2396] migration: Put Error **errp parameter last

qapi/error.h's big comment:

 * - Functions that use Error to report errors have an Error **errp
 *   parameter.  It should be the last parameter, except for functions
 *   taking variable arguments.

is_only_migratable() and add_blockers() have it in the middle.  Clean
them up.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251027064503.1074255-4-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index f613b95287..5e74993b46 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1867,7 +1867,7 @@ static bool is_busy(Error **reasonp, Error **errp)
     return false;
 }
 
-static bool is_only_migratable(Error **reasonp, Error **errp, unsigned modes)
+static bool is_only_migratable(Error **reasonp, unsigned modes, Error **errp)
 {
     ERRP_GUARD();
 
@@ -1881,7 +1881,7 @@ static bool is_only_migratable(Error **reasonp, Error **errp, unsigned modes)
     return false;
 }
 
-static int add_blockers(Error **reasonp, Error **errp, unsigned modes)
+static int add_blockers(Error **reasonp, unsigned modes, Error **errp)
 {
     for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
         if (modes & BIT(mode)) {
@@ -1904,12 +1904,12 @@ int migrate_add_blocker_normal(Error **reasonp, Error **errp)
 
 int migrate_add_blocker_modes(Error **reasonp, unsigned modes, Error **errp)
 {
-    if (is_only_migratable(reasonp, errp, modes)) {
+    if (is_only_migratable(reasonp, modes, errp)) {
         return -EACCES;
     } else if (is_busy(reasonp, errp)) {
         return -EBUSY;
     }
-    return add_blockers(reasonp, errp, modes);
+    return add_blockers(reasonp, modes, errp);
 }
 
 int migrate_add_blocker_internal(Error **reasonp, Error **errp)
@@ -1919,7 +1919,7 @@ int migrate_add_blocker_internal(Error **reasonp, Error **errp)
     if (is_busy(reasonp, errp)) {
         return -EBUSY;
     }
-    return add_blockers(reasonp, errp, modes);
+    return add_blockers(reasonp, modes, errp);
 }
 
 void migrate_del_blocker(Error **reasonp)

From 1edf0df28409cdf637e5f5ebba515fc63ed4926f Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Wed, 22 Oct 2025 15:26:00 -0400
Subject: [PATCH 1967/2396] io: Add qio_channel_wait_cond() helper
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add the helper to wait for QIO channel's IO availability in any
context (coroutine, or non-coroutine).  Use it tree-wide for three
occurences.

Cc: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251022192612.2737648-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 include/io/channel.h  | 15 +++++++++++++++
 io/channel.c          | 21 +++++++++++----------
 migration/qemu-file.c |  6 +-----
 3 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/include/io/channel.h b/include/io/channel.h
index 0f25ae0069..d6d5bf2b5f 100644
--- a/include/io/channel.h
+++ b/include/io/channel.h
@@ -871,6 +871,21 @@ void qio_channel_wake_read(QIOChannel *ioc);
 void qio_channel_wait(QIOChannel *ioc,
                       GIOCondition condition);
 
+/**
+ * qio_channel_wait_cond:
+ * @ioc: the channel object
+ * @condition: the I/O condition to wait for
+ *
+ * Block execution from the current thread until
+ * the condition indicated by @condition becomes
+ * available.
+ *
+ * This will work with/without a coroutine context, by automatically select
+ * the proper API to wait.
+ */
+void qio_channel_wait_cond(QIOChannel *ioc,
+                           GIOCondition condition);
+
 /**
  * qio_channel_set_aio_fd_handler:
  * @ioc: the channel object
diff --git a/io/channel.c b/io/channel.c
index 852e684938..b18fc346ff 100644
--- a/io/channel.c
+++ b/io/channel.c
@@ -159,11 +159,7 @@ int coroutine_mixed_fn qio_channel_readv_full_all_eof(QIOChannel *ioc,
         len = qio_channel_readv_full(ioc, local_iov, nlocal_iov, local_fds,
                                      local_nfds, flags, errp);
         if (len == QIO_CHANNEL_ERR_BLOCK) {
-            if (qemu_in_coroutine()) {
-                qio_channel_yield(ioc, G_IO_IN);
-            } else {
-                qio_channel_wait(ioc, G_IO_IN);
-            }
+            qio_channel_wait_cond(ioc, G_IO_IN);
             continue;
         }
 
@@ -268,11 +264,7 @@ int coroutine_mixed_fn qio_channel_writev_full_all(QIOChannel *ioc,
                                             nfds, flags, errp);
 
         if (len == QIO_CHANNEL_ERR_BLOCK) {
-            if (qemu_in_coroutine()) {
-                qio_channel_yield(ioc, G_IO_OUT);
-            } else {
-                qio_channel_wait(ioc, G_IO_OUT);
-            }
+            qio_channel_wait_cond(ioc, G_IO_OUT);
             continue;
         }
         if (len < 0) {
@@ -774,6 +766,15 @@ void qio_channel_wait(QIOChannel *ioc,
     g_main_context_unref(ctxt);
 }
 
+void qio_channel_wait_cond(QIOChannel *ioc,
+                           GIOCondition condition)
+{
+    if (qemu_in_coroutine()) {
+        qio_channel_yield(ioc, condition);
+    } else {
+        qio_channel_wait(ioc, condition);
+    }
+}
 
 static void qio_channel_finalize(Object *obj)
 {
diff --git a/migration/qemu-file.c b/migration/qemu-file.c
index 2d4ce174a5..4b5a409a80 100644
--- a/migration/qemu-file.c
+++ b/migration/qemu-file.c
@@ -343,11 +343,7 @@ static ssize_t coroutine_mixed_fn qemu_fill_buffer(QEMUFile *f)
                                      QIO_CHANNEL_READ_FLAG_FD_PRESERVE_BLOCKING,
                                      &local_error);
         if (len == QIO_CHANNEL_ERR_BLOCK) {
-            if (qemu_in_coroutine()) {
-                qio_channel_yield(f->ioc, G_IO_IN);
-            } else {
-                qio_channel_wait(f->ioc, G_IO_IN);
-            }
+            qio_channel_wait_cond(f->ioc, G_IO_IN);
         }
     } while (len == QIO_CHANNEL_ERR_BLOCK);
 

From 604bb1badcade5f49264cf8901c2f3a528df305a Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Wed, 22 Oct 2025 15:26:01 -0400
Subject: [PATCH 1968/2396] migration: Properly wait on G_IO_IN when peeking
 messages
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

migration_channel_read_peek() used to do explicit waits of a short period
when peeking message needs retry.  Replace it with explicit polls on the io
channel, exactly like what qemu_fill_buffer() does.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251022192612.2737648-3-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/channel.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/migration/channel.c b/migration/channel.c
index a547b1fbfe..462cc183e1 100644
--- a/migration/channel.c
+++ b/migration/channel.c
@@ -135,12 +135,7 @@ int migration_channel_read_peek(QIOChannel *ioc,
             break;
         }
 
-        /* 1ms sleep. */
-        if (qemu_in_coroutine()) {
-            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
-        } else {
-            g_usleep(1000);
-        }
+        qio_channel_wait_cond(ioc, G_IO_IN);
     }
 
     return 0;

From d4b3a3cc55845685c16d4313ff345c392262d940 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 28 Oct 2025 16:07:37 +0300
Subject: [PATCH 1969/2396] migration: vmstate_save_state_v(): fix error path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In case of pre_save_errp, on error, we continue processing fields,
unlike case of pre_save, where we return immediately. Behavior
for pre_save_errp case is wrong, we must return here, like for
pre_save.

 "migration: Add error-parameterized function variants in VMSD struct"

Fixes: 40de712a89
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Stefan Berger <stefanb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251028130738.29037-2-vsementsov@yandex-team.ru
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/vmstate.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/migration/vmstate.c b/migration/vmstate.c
index 81eadde553..fd066f910e 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -443,6 +443,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
         if (ret < 0) {
             error_prepend(errp, "pre-save for %s failed, ret: %d: ",
                           vmsd->name, ret);
+            return ret;
         }
     } else if (vmsd->pre_save) {
         ret = vmsd->pre_save(opaque);

From 3469a56fa3dc98549d87535a80bb4bddfed44936 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 28 Oct 2025 16:07:38 +0300
Subject: [PATCH 1970/2396] tmp_emulator: improve and fix use of errp

tpm_emulator_post_load() and tpm_emulator_set_state_blobs() has
error paths, where they return negative value, but do not set
errp.

To fix that, we also have to convert several other functions to
set errp instead of error_reporting.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251028130738.29037-3-vsementsov@yandex-team.ru
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 backends/tpm/tpm_emulator.c | 63 +++++++++++++++++++++++--------------
 1 file changed, 39 insertions(+), 24 deletions(-)

diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index f32b67dac7..da9c1056ed 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -308,22 +308,22 @@ static int tpm_emulator_check_caps(TPMEmulator *tpm_emu)
     return 0;
 }
 
-static int tpm_emulator_stop_tpm(TPMBackend *tb)
+static int tpm_emulator_stop_tpm(TPMBackend *tb, Error **errp)
 {
     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
     ptm_res res;
 
     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_STOP, &res, 0,
                              sizeof(ptm_res), sizeof(res)) < 0) {
-        error_report("tpm-emulator: Could not stop TPM: %s",
-                     strerror(errno));
+        error_setg(errp, "tpm-emulator: Could not stop TPM: %s",
+                   strerror(errno));
         return -1;
     }
 
     res = be32_to_cpu(res);
     if (res) {
-        error_report("tpm-emulator: TPM result for CMD_STOP: 0x%x %s", res,
-                     tpm_emulator_strerror(res));
+        error_setg(errp, "tpm-emulator: TPM result for CMD_STOP: 0x%x %s", res,
+                   tpm_emulator_strerror(res));
         return -1;
     }
 
@@ -362,12 +362,13 @@ static int tpm_emulator_lock_storage(TPMEmulator *tpm_emu)
 
 static int tpm_emulator_set_buffer_size(TPMBackend *tb,
                                         size_t wanted_size,
-                                        size_t *actual_size)
+                                        size_t *actual_size,
+                                        Error **errp)
 {
     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
     ptm_setbuffersize psbs;
 
-    if (tpm_emulator_stop_tpm(tb) < 0) {
+    if (tpm_emulator_stop_tpm(tb, errp) < 0) {
         return -1;
     }
 
@@ -376,16 +377,17 @@ static int tpm_emulator_set_buffer_size(TPMBackend *tb,
     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_SET_BUFFERSIZE, &psbs,
                              sizeof(psbs.u.req), sizeof(psbs.u.resp.tpm_result),
                              sizeof(psbs.u.resp)) < 0) {
-        error_report("tpm-emulator: Could not set buffer size: %s",
-                     strerror(errno));
+        error_setg(errp, "tpm-emulator: Could not set buffer size: %s",
+                   strerror(errno));
         return -1;
     }
 
     psbs.u.resp.tpm_result = be32_to_cpu(psbs.u.resp.tpm_result);
     if (psbs.u.resp.tpm_result != 0) {
-        error_report("tpm-emulator: TPM result for set buffer size : 0x%x %s",
-                     psbs.u.resp.tpm_result,
-                     tpm_emulator_strerror(psbs.u.resp.tpm_result));
+        error_setg(errp,
+                   "tpm-emulator: TPM result for set buffer size : 0x%x %s",
+                   psbs.u.resp.tpm_result,
+                   tpm_emulator_strerror(psbs.u.resp.tpm_result));
         return -1;
     }
 
@@ -402,7 +404,7 @@ static int tpm_emulator_set_buffer_size(TPMBackend *tb,
 }
 
 static int tpm_emulator_startup_tpm_resume(TPMBackend *tb, size_t buffersize,
-                                     bool is_resume)
+                                           bool is_resume, Error **errp)
 {
     TPMEmulator *tpm_emu = TPM_EMULATOR(tb);
     ptm_init init = {
@@ -413,7 +415,7 @@ static int tpm_emulator_startup_tpm_resume(TPMBackend *tb, size_t buffersize,
     trace_tpm_emulator_startup_tpm_resume(is_resume, buffersize);
 
     if (buffersize != 0 &&
-        tpm_emulator_set_buffer_size(tb, buffersize, NULL) < 0) {
+        tpm_emulator_set_buffer_size(tb, buffersize, NULL, errp) < 0) {
         goto err_exit;
     }
 
@@ -424,15 +426,15 @@ static int tpm_emulator_startup_tpm_resume(TPMBackend *tb, size_t buffersize,
     if (tpm_emulator_ctrlcmd(tpm_emu, CMD_INIT, &init, sizeof(init),
                              sizeof(init.u.resp.tpm_result),
                              sizeof(init)) < 0) {
-        error_report("tpm-emulator: could not send INIT: %s",
-                     strerror(errno));
+        error_setg(errp, "tpm-emulator: could not send INIT: %s",
+                   strerror(errno));
         goto err_exit;
     }
 
     res = be32_to_cpu(init.u.resp.tpm_result);
     if (res) {
-        error_report("tpm-emulator: TPM result for CMD_INIT: 0x%x %s", res,
-                     tpm_emulator_strerror(res));
+        error_setg(errp, "tpm-emulator: TPM result for CMD_INIT: 0x%x %s", res,
+                   tpm_emulator_strerror(res));
         goto err_exit;
     }
     return 0;
@@ -441,18 +443,31 @@ err_exit:
     return -1;
 }
 
-static int tpm_emulator_startup_tpm(TPMBackend *tb, size_t buffersize)
+static int do_tpm_emulator_startup_tpm(TPMBackend *tb, size_t buffersize,
+                                       Error **errp)
 {
     /* TPM startup will be done from post_load hook */
     if (runstate_check(RUN_STATE_INMIGRATE)) {
         if (buffersize != 0) {
-            return tpm_emulator_set_buffer_size(tb, buffersize, NULL);
+            return tpm_emulator_set_buffer_size(tb, buffersize, NULL, errp);
         }
 
         return 0;
     }
 
-    return tpm_emulator_startup_tpm_resume(tb, buffersize, false);
+    return tpm_emulator_startup_tpm_resume(tb, buffersize, false, errp);
+}
+
+static int tpm_emulator_startup_tpm(TPMBackend *tb, size_t buffersize)
+{
+    Error *local_err = NULL;
+    int ret = do_tpm_emulator_startup_tpm(tb, buffersize, &local_err);
+
+    if (ret < 0) {
+        error_report_err(local_err);
+    }
+
+    return ret;
 }
 
 static bool tpm_emulator_get_tpm_established_flag(TPMBackend *tb)
@@ -546,7 +561,7 @@ static size_t tpm_emulator_get_buffer_size(TPMBackend *tb)
 {
     size_t actual_size;
 
-    if (tpm_emulator_set_buffer_size(tb, 0, &actual_size) < 0) {
+    if (tpm_emulator_set_buffer_size(tb, 0, &actual_size, NULL) < 0) {
         return 4096;
     }
 
@@ -889,7 +904,7 @@ static int tpm_emulator_set_state_blobs(TPMBackend *tb, Error **errp)
 
     trace_tpm_emulator_set_state_blobs();
 
-    if (tpm_emulator_stop_tpm(tb) < 0) {
+    if (tpm_emulator_stop_tpm(tb, errp) < 0) {
         trace_tpm_emulator_set_state_blobs_error("Could not stop TPM");
         return -EIO;
     }
@@ -960,7 +975,7 @@ static int tpm_emulator_post_load(void *opaque, int version_id, Error **errp)
         return ret;
     }
 
-    if (tpm_emulator_startup_tpm_resume(tb, 0, true) < 0) {
+    if (tpm_emulator_startup_tpm_resume(tb, 0, true, errp) < 0) {
         return -EIO;
     }
 

From 507685984cf04d216661cfd927773fa53123a0a9 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 28 Oct 2025 20:09:25 +0300
Subject: [PATCH 1971/2396] migration/vmstate: stop reporting error number for
 new _errp APIs

The handlers .pre_load_errp, .post_load_errp and .pre_save_errp
should put all needed information into errp, we should not append
error number here.

Note, that there are some more error messages with numeric
error codes in this file. We leave them for another day, our
current goal is to prepare for the following commit, which will
update interface of _errp() APIs.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251028170926.77219-1-vsementsov@yandex-team.ru
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/vmstate.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/migration/vmstate.c b/migration/vmstate.c
index fd066f910e..677e56c84a 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -157,9 +157,9 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         ret = vmsd->pre_load_errp(opaque, errp);
         if (ret < 0) {
             error_prepend(errp, "pre load hook failed for: '%s', "
-                          "version_id: %d, minimum version_id: %d, "
-                          "ret: %d: ", vmsd->name, vmsd->version_id,
-                          vmsd->minimum_version_id, ret);
+                          "version_id: %d, minimum version_id: %d: ",
+                          vmsd->name, vmsd->version_id,
+                          vmsd->minimum_version_id);
             return ret;
         }
     } else if (vmsd->pre_load) {
@@ -259,8 +259,8 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         ret = vmsd->post_load_errp(opaque, version_id, errp);
         if (ret < 0) {
             error_prepend(errp, "post load hook failed for: %s, version_id: "
-                          "%d, minimum_version: %d, ret: %d: ", vmsd->name,
-                          vmsd->version_id, vmsd->minimum_version_id, ret);
+                          "%d, minimum_version: %d: ", vmsd->name,
+                          vmsd->version_id, vmsd->minimum_version_id);
         }
     } else if (vmsd->post_load) {
         ret = vmsd->post_load(opaque, version_id);
@@ -441,8 +441,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
         ret = vmsd->pre_save_errp(opaque, errp);
         trace_vmstate_save_state_pre_save_res(vmsd->name, ret);
         if (ret < 0) {
-            error_prepend(errp, "pre-save for %s failed, ret: %d: ",
-                          vmsd->name, ret);
+            error_prepend(errp, "pre-save for %s failed: ", vmsd->name);
             return ret;
         }
     } else if (vmsd->pre_save) {

From 8c3843638cbab2da66d3e9e662c03271d3a9490e Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 28 Oct 2025 20:09:26 +0300
Subject: [PATCH 1972/2396] migration: vmsd errp handlers: return bool

No code actually depend on specific errno values returned by
vmstate_load_state. The only use of it is to check for success,
and sometimes inject numeric error values into error messages
in migration code. The latter is not a stopper for gradual
conversion to "errp + bool return value" APIs.

Big analysis of vmstate_load_state() callers, showing that
specific errno values are not actually used, is done by Peter
here:

https://lore.kernel.org/qemu-devel/aQDdRn8t0B8oE3gf@x1.local/

Converting of vmstate_load_state() itself will follow in
another series.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251028170926.77219-2-vsementsov@yandex-team.ru
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 backends/tpm/tpm_emulator.c   | 10 ++++------
 docs/devel/migration/main.rst |  6 +++---
 include/migration/vmstate.h   |  6 +++---
 migration/vmstate.c           | 11 +++++------
 4 files changed, 15 insertions(+), 18 deletions(-)

diff --git a/backends/tpm/tpm_emulator.c b/backends/tpm/tpm_emulator.c
index da9c1056ed..f10b9074fb 100644
--- a/backends/tpm/tpm_emulator.c
+++ b/backends/tpm/tpm_emulator.c
@@ -962,24 +962,22 @@ static void tpm_emulator_vm_state_change(void *opaque, bool running,
 
 /*
  * Load the TPM state blobs into the TPM.
- *
- * Returns negative errno codes in case of error.
  */
-static int tpm_emulator_post_load(void *opaque, int version_id, Error **errp)
+static bool tpm_emulator_post_load(void *opaque, int version_id, Error **errp)
 {
     TPMBackend *tb = opaque;
     int ret;
 
     ret = tpm_emulator_set_state_blobs(tb, errp);
     if (ret < 0) {
-        return ret;
+        return false;
     }
 
     if (tpm_emulator_startup_tpm_resume(tb, 0, true, errp) < 0) {
-        return -EIO;
+        return false;
     }
 
-    return 0;
+    return true;
 }
 
 static const VMStateDescription vmstate_tpm_emulator = {
diff --git a/docs/devel/migration/main.rst b/docs/devel/migration/main.rst
index 1afe7b9689..234d280249 100644
--- a/docs/devel/migration/main.rst
+++ b/docs/devel/migration/main.rst
@@ -446,15 +446,15 @@ The functions to do that are inside a vmstate definition, and are called:
 
 Following are the errp variants of these functions.
 
-- ``int (*pre_load_errp)(void *opaque, Error **errp);``
+- ``bool (*pre_load_errp)(void *opaque, Error **errp);``
 
   This function is called before we load the state of one device.
 
-- ``int (*post_load_errp)(void *opaque, int version_id, Error **errp);``
+- ``bool (*post_load_errp)(void *opaque, int version_id, Error **errp);``
 
   This function is called after we load the state of one device.
 
-- ``int (*pre_save_errp)(void *opaque, Error **errp);``
+- ``bool (*pre_save_errp)(void *opaque, Error **errp);``
 
   This function is called before we save the state of one device.
 
diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index 09f1eefcfb..df57e6550a 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -218,11 +218,11 @@ struct VMStateDescription {
     int minimum_version_id;
     MigrationPriority priority;
     int (*pre_load)(void *opaque);
-    int (*pre_load_errp)(void *opaque, Error **errp);
+    bool (*pre_load_errp)(void *opaque, Error **errp);
     int (*post_load)(void *opaque, int version_id);
-    int (*post_load_errp)(void *opaque, int version_id, Error **errp);
+    bool (*post_load_errp)(void *opaque, int version_id, Error **errp);
     int (*pre_save)(void *opaque);
-    int (*pre_save_errp)(void *opaque, Error **errp);
+    bool (*pre_save_errp)(void *opaque, Error **errp);
     int (*post_save)(void *opaque);
     bool (*needed)(void *opaque);
     bool (*dev_unplug_pending)(void *opaque);
diff --git a/migration/vmstate.c b/migration/vmstate.c
index 677e56c84a..4d28364f7b 100644
--- a/migration/vmstate.c
+++ b/migration/vmstate.c
@@ -154,13 +154,12 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         return -EINVAL;
     }
     if (vmsd->pre_load_errp) {
-        ret = vmsd->pre_load_errp(opaque, errp);
-        if (ret < 0) {
+        if (!vmsd->pre_load_errp(opaque, errp)) {
             error_prepend(errp, "pre load hook failed for: '%s', "
                           "version_id: %d, minimum version_id: %d: ",
                           vmsd->name, vmsd->version_id,
                           vmsd->minimum_version_id);
-            return ret;
+            return -EINVAL;
         }
     } else if (vmsd->pre_load) {
         ret = vmsd->pre_load(opaque);
@@ -256,11 +255,11 @@ int vmstate_load_state(QEMUFile *f, const VMStateDescription *vmsd,
         return ret;
     }
     if (vmsd->post_load_errp) {
-        ret = vmsd->post_load_errp(opaque, version_id, errp);
-        if (ret < 0) {
+        if (!vmsd->post_load_errp(opaque, version_id, errp)) {
             error_prepend(errp, "post load hook failed for: %s, version_id: "
                           "%d, minimum_version: %d: ", vmsd->name,
                           vmsd->version_id, vmsd->minimum_version_id);
+            ret = -EINVAL;
         }
     } else if (vmsd->post_load) {
         ret = vmsd->post_load(opaque, version_id);
@@ -438,7 +437,7 @@ int vmstate_save_state_v(QEMUFile *f, const VMStateDescription *vmsd,
     trace_vmstate_save_state_top(vmsd->name);
 
     if (vmsd->pre_save_errp) {
-        ret = vmsd->pre_save_errp(opaque, errp);
+        ret = vmsd->pre_save_errp(opaque, errp) ? 0 : -EINVAL;
         trace_vmstate_save_state_pre_save_res(vmsd->name, ret);
         if (ret < 0) {
             error_prepend(errp, "pre-save for %s failed: ", vmsd->name);

From ac7a5f1b72734491318e113a3c64cce103fe93b1 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 30 Oct 2025 10:26:38 +0100
Subject: [PATCH 1973/2396] scripts/vmstate-static-checker: Fix deprecation
 warnings with latest argparse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The argparse.FileType() type has been deprecated in the latest argparse
version (e.g. the one from Fedora 43), now causing the test_bad_vmstate
functional test to fail since there are unexpected strings in the output.
Change the script to use pathlib.Path instead to fix the test_bad_vmstate
test and to be prepared for the future when the deprecated FileType gets
removed completely.

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Link: https://lore.kernel.org/r/20251030092638.39505-1-thuth@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 scripts/vmstate-static-checker.py | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/scripts/vmstate-static-checker.py b/scripts/vmstate-static-checker.py
index 2335e25f94..89b100e6cc 100755
--- a/scripts/vmstate-static-checker.py
+++ b/scripts/vmstate-static-checker.py
@@ -21,6 +21,7 @@
 
 import argparse
 import json
+import pathlib
 import sys
 
 # Count the number of errors found
@@ -382,10 +383,10 @@ def main():
     help_text = "Parse JSON-formatted vmstate dumps from QEMU in files SRC and DEST.  Checks whether migration from SRC to DEST QEMU versions would break based on the VMSTATE information contained within the JSON outputs.  The JSON output is created from a QEMU invocation with the -dump-vmstate parameter and a filename argument to it.  Other parameters to QEMU do not matter, except the -M (machine type) parameter."
 
     parser = argparse.ArgumentParser(description=help_text)
-    parser.add_argument('-s', '--src', type=argparse.FileType('r'),
+    parser.add_argument('-s', '--src', type=pathlib.Path,
                         required=True,
                         help='json dump from src qemu')
-    parser.add_argument('-d', '--dest', type=argparse.FileType('r'),
+    parser.add_argument('-d', '--dest', type=pathlib.Path,
                         required=True,
                         help='json dump from dest qemu')
     parser.add_argument('--reverse', required=False, default=False,
@@ -393,10 +394,10 @@ def main():
                         help='reverse the direction')
     args = parser.parse_args()
 
-    src_data = json.load(args.src)
-    dest_data = json.load(args.dest)
-    args.src.close()
-    args.dest.close()
+    with open(args.src, 'r', encoding='utf-8') as src_fh:
+        src_data = json.load(src_fh)
+    with open(args.dest, 'r', encoding='utf-8') as dst_fh:
+        dest_data = json.load(dst_fh)
 
     if args.reverse:
         temp = src_data

From c0c6a6ac7bd61f862d9c1800129c80dc2a93704e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Wed, 29 Oct 2025 14:52:24 -0400
Subject: [PATCH 1974/2396] system/physmem: mark io_mem_unassigned lockless
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the Bus Master bit is disabled in a PCI device's Command Register,
the device's DMA address space becomes unassigned memory (i.e. the
io_mem_unassigned MemoryRegion).

This can lead to deadlocks with IOThreads since io_mem_unassigned
accesses attempt to acquire the Big QEMU Lock (BQL). For example,
virtio-pci devices deadlock in virtio_write_config() ->
virtio_pci_stop_ioeventfd() when waiting for the IOThread while holding
the BQL. The IOThread is unable to acquire the BQL but the vcpu thread
won't release the BQL while waiting for the IOThread.

io_mem_unassigned is trivially thread-safe since it has no state, it
simply rejects all load/store accesses. Therefore it is safe to enable
lockless I/O on io_mem_unassigned to eliminate this deadlock.

Here is the backtrace described above:

  Thread 9 (Thread 0x7fccfcdff6c0 (LWP 247832) "CPU 4/KVM"):
  #0  0x00007fcd11529d46 in ppoll () from target:/lib64/libc.so.6
  #1  0x000056468a1a9bad in ppoll (__fds=<optimized out>, __nfds=<optimized out>, __timeout=0x0, __ss=0x0) at /usr/include/bits/poll2.h:88
  #2  0x000056468a18f9d9 in fdmon_poll_wait (ctx=0x5646c6a1dc30, ready_list=0x7fccfcdfb310, timeout=-1) at ../util/fdmon-poll.c:79
  #3  0x000056468a18f14f in aio_poll (ctx=<optimized out>, blocking=blocking@entry=true) at ../util/aio-posix.c:730
  #4  0x000056468a1ad842 in aio_wait_bh_oneshot (ctx=<optimized out>, cb=cb@entry=0x564689faa420 <virtio_blk_ioeventfd_stop_vq_bh>, opaque=<optimized out>) at ../util/aio-wait.c:85
  #5  0x0000564689faaa89 in virtio_blk_stop_ioeventfd (vdev=0x5646c8fd7e90) at ../hw/block/virtio-blk.c:1644
  #6  0x0000564689d77880 in virtio_bus_stop_ioeventfd (bus=bus@entry=0x5646c8fd7e08) at ../hw/virtio/virtio-bus.c:264
  #7  0x0000564689d780db in virtio_bus_stop_ioeventfd (bus=bus@entry=0x5646c8fd7e08) at ../hw/virtio/virtio-bus.c:256
  #8  0x0000564689d7d98a in virtio_pci_stop_ioeventfd (proxy=0x5646c8fcf8e0) at ../hw/virtio/virtio-pci.c:413
  #9  virtio_write_config (pci_dev=0x5646c8fcf8e0, address=4, val=<optimized out>, len=<optimized out>) at ../hw/virtio/virtio-pci.c:803
  #10 0x0000564689dcb45a in memory_region_write_accessor (mr=mr@entry=0x5646c6dc2d30, addr=3145732, value=value@entry=0x7fccfcdfb528, size=size@entry=2, shift=<optimized out>, mask=mask@entry=65535, attrs=...) at ../system/memory.c:491
  #11 0x0000564689dcaeb0 in access_with_adjusted_size (addr=addr@entry=3145732, value=value@entry=0x7fccfcdfb528, size=size@entry=2, access_size_min=<optimized out>, access_size_max=<optimized out>, access_fn=0x564689dcb3f0 <memory_region_write_accessor>, mr=0x5646c6dc2d30, attrs=...) at ../system/memory.c:567
  #12 0x0000564689dcb156 in memory_region_dispatch_write (mr=mr@entry=0x5646c6dc2d30, addr=addr@entry=3145732, data=<optimized out>, op=<optimized out>, attrs=attrs@entry=...) at ../system/memory.c:1554
  #13 0x0000564689dd389a in flatview_write_continue_step (attrs=..., attrs@entry=..., buf=buf@entry=0x7fcd05b87028 "", mr_addr=3145732, l=l@entry=0x7fccfcdfb5f0, mr=0x5646c6dc2d30, len=2) at ../system/physmem.c:3266
  #14 0x0000564689dd3adb in flatview_write_continue (fv=0x7fcadc0d8930, addr=3761242116, attrs=..., ptr=0xe0300004, len=2, mr_addr=<optimized out>, l=<optimized out>, mr=<optimized out>) at ../system/physmem.c:3296
  #15 flatview_write (fv=0x7fcadc0d8930, addr=addr@entry=3761242116, attrs=attrs@entry=..., buf=buf@entry=0x7fcd05b87028, len=len@entry=2) at ../system/physmem.c:3327
  #16 0x0000564689dd7191 in address_space_write (as=0x56468b433600 <address_space_memory>, addr=3761242116, attrs=..., buf=0x7fcd05b87028, len=2) at ../system/physmem.c:3447
  #17 address_space_rw (as=0x56468b433600 <address_space_memory>, addr=3761242116, attrs=attrs@entry=..., buf=buf@entry=0x7fcd05b87028, len=2, is_write=<optimized out>) at ../system/physmem.c:3457
  #18 0x0000564689ff1ef6 in kvm_cpu_exec (cpu=cpu@entry=0x5646c6dab810) at ../accel/kvm/kvm-all.c:3248
  #19 0x0000564689ff32f5 in kvm_vcpu_thread_fn (arg=arg@entry=0x5646c6dab810) at ../accel/kvm/kvm-accel-ops.c:53
  #20 0x000056468a19225c in qemu_thread_start (args=0x5646c6db6190) at ../util/qemu-thread-posix.c:393
  #21 0x00007fcd114c5b68 in start_thread () from target:/lib64/libc.so.6
  #22 0x00007fcd115364e4 in clone () from target:/lib64/libc.so.6

  Thread 3 (Thread 0x7fcd0503a6c0 (LWP 247825) "IO iothread1"):
  #0  0x00007fcd114c2d30 in __lll_lock_wait () from target:/lib64/libc.so.6
  #1  0x00007fcd114c8fe2 in pthread_mutex_lock@@GLIBC_2.2.5 () from target:/lib64/libc.so.6
  #2  0x000056468a192538 in qemu_mutex_lock_impl (mutex=0x56468b432e60 <bql>, file=0x56468a1e26a5 "../system/physmem.c", line=3198) at ../util/qemu-thread-posix.c:94
  #3  0x0000564689dc12e2 in bql_lock_impl (file=file@entry=0x56468a1e26a5 "../system/physmem.c", line=line@entry=3198) at ../system/cpus.c:566
  #4  0x0000564689ddc151 in prepare_mmio_access (mr=0x56468b433800 <io_mem_unassigned>) at ../system/physmem.c:3198
  #5  address_space_lduw_internal_cached_slow (cache=<optimized out>, addr=2, attrs=..., result=0x0, endian=DEVICE_LITTLE_ENDIAN) at ../system/memory_ldst.c.inc:211
  #6  address_space_lduw_le_cached_slow (cache=<optimized out>, addr=addr@entry=2, attrs=attrs@entry=..., result=result@entry=0x0) at ../system/memory_ldst.c.inc:253
  #7  0x0000564689fd692c in address_space_lduw_le_cached (result=0x0, cache=<optimized out>, addr=2, attrs=...) at /var/tmp/qemu/include/exec/memory_ldst_cached.h.inc:35
  #8  lduw_le_phys_cached (cache=<optimized out>, addr=2) at /var/tmp/qemu/include/exec/memory_ldst_phys.h.inc:66
  #9  virtio_lduw_phys_cached (vdev=<optimized out>, cache=<optimized out>, pa=2) at /var/tmp/qemu/include/hw/virtio/virtio-access.h:166
  #10 vring_avail_idx (vq=0x5646c8fe2470) at ../hw/virtio/virtio.c:396
  #11 virtio_queue_split_set_notification (vq=0x5646c8fe2470, enable=0) at ../hw/virtio/virtio.c:534
  #12 virtio_queue_set_notification (vq=0x5646c8fe2470, enable=0) at ../hw/virtio/virtio.c:595
  #13 0x000056468a18e7a8 in poll_set_started (ctx=ctx@entry=0x5646c6c74e30, ready_list=ready_list@entry=0x7fcd050366a0, started=started@entry=true) at ../util/aio-posix.c:247
  #14 0x000056468a18f2bb in poll_set_started (ctx=0x5646c6c74e30, ready_list=0x7fcd050366a0, started=true) at ../util/aio-posix.c:226
  #15 try_poll_mode (ctx=0x5646c6c74e30, ready_list=0x7fcd050366a0, timeout=<synthetic pointer>) at ../util/aio-posix.c:612
  #16 aio_poll (ctx=0x5646c6c74e30, blocking=blocking@entry=true) at ../util/aio-posix.c:689
  #17 0x000056468a032c26 in iothread_run (opaque=opaque@entry=0x5646c69f3380) at ../iothread.c:63
  #18 0x000056468a19225c in qemu_thread_start (args=0x5646c6c75410) at ../util/qemu-thread-posix.c:393
  #19 0x00007fcd114c5b68 in start_thread () from target:/lib64/libc.so.6
  #20 0x00007fcd115364e4 in clone () from target:/lib64/libc.so.6

Buglink: https://issues.redhat.com/browse/RHEL-71933
Reported-by: Peixiu Hou <phou@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/r/20251029185224.420261-1-stefanha@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 system/physmem.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/system/physmem.c b/system/physmem.c
index a7e2a5d07f..c9869e4049 100644
--- a/system/physmem.c
+++ b/system/physmem.c
@@ -3011,6 +3011,9 @@ static void io_mem_init(void)
 {
     memory_region_init_io(&io_mem_unassigned, NULL, &unassigned_mem_ops, NULL,
                           NULL, UINT64_MAX);
+
+    /* Trivially thread-safe since memory accesses are rejected */
+    memory_region_enable_lockless_io(&io_mem_unassigned);
 }
 
 AddressSpaceDispatch *address_space_dispatch_new(FlatView *fv)

From 1529ec8f5fed0fdeb686c3f235f1b87ff116512e Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:50 +0100
Subject: [PATCH 1975/2396] migration: Flush migration channel after sending
 data of CMD_PACKAGED

If the length of the data sent after CMD_PACKAGED is just right, and
there is not much data to send afterward, it is possible part of the
CMD_PACKAGED payload will get left behind in the sending buffer. This
causes the destination side to hang while it tries to load the whole
package and initiate postcopy.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-2-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/savevm.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/migration/savevm.c b/migration/savevm.c
index 232cae090b..fa017378db 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1142,6 +1142,7 @@ int qemu_savevm_send_packaged(QEMUFile *f, const uint8_t *buf, size_t len)
     qemu_savevm_command_send(f, MIG_CMD_PACKAGED, 4, (uint8_t *)&tmp);
 
     qemu_put_buffer(f, buf, len);
+    qemu_fflush(f);
 
     return 0;
 }

From 26f65c01edcf046d0dcfaccaa24eb62584510e44 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 3 Nov 2025 19:32:51 +0100
Subject: [PATCH 1976/2396] migration: Do not try to start VM if disk
 activation fails

If a rare split brain happens (e.g. dest QEMU started running somehow,
taking shared drive locks), src QEMU may not be able to activate the
drives anymore.  In this case, src QEMU shouldn't start the VM or it might
crash the block layer later with something like:

Meanwhile, src QEMU cannot try to continue either even if dest QEMU can
release the drive locks (e.g. by QMP "stop").  Because as long as dest QEMU
started running, it means dest QEMU's RAM is the only version that is
consistent with current status of the shared storage.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251103183301.3840862-3-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 29 ++++++++++++++++++++++++-----
 1 file changed, 24 insertions(+), 5 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 5e74993b46..6e647c7c4a 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3526,6 +3526,8 @@ static MigIterateState migration_iteration_run(MigrationState *s)
 
 static void migration_iteration_finish(MigrationState *s)
 {
+    Error *local_err = NULL;
+
     bql_lock();
 
     /*
@@ -3549,11 +3551,28 @@ static void migration_iteration_finish(MigrationState *s)
     case MIGRATION_STATUS_FAILED:
     case MIGRATION_STATUS_CANCELLED:
     case MIGRATION_STATUS_CANCELLING:
-        /*
-         * Re-activate the block drives if they're inactivated.  Note, COLO
-         * shouldn't use block_active at all, so it should be no-op there.
-         */
-        migration_block_activate(NULL);
+        if (!migration_block_activate(&local_err)) {
+            /*
+            * Re-activate the block drives if they're inactivated.
+            *
+            * If it fails (e.g. in case of a split brain, where dest QEMU
+            * might have taken some of the drive locks and running!), do
+            * not start VM, instead wait for mgmt to decide the next step.
+            *
+            * If dest already started, it means dest QEMU should contain
+            * all the data it needs and it properly owns all the drive
+            * locks.  Then even if src QEMU got a FAILED in migration, it
+            * normally should mean we should treat the migration as
+            * COMPLETED.
+            *
+            * NOTE: it's not safe anymore to start VM on src now even if
+            * dest would release the drive locks.  It's because as long as
+            * dest started running then only dest QEMU's RAM is consistent
+            * with the shared storage.
+            */
+            error_free(local_err);
+            break;
+        }
         if (runstate_is_live(s->vm_old_state)) {
             if (!runstate_check(RUN_STATE_SHUTDOWN)) {
                 vm_start();

From c9aac1ae106e58be1c4f714793ee9170f91c5e7d Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:52 +0100
Subject: [PATCH 1977/2396] migration: Move postcopy_ram_listen_thread() to
 postcopy-ram.c

This patch addresses a TODO about moving postcopy_ram_listen_thread() to
postcopy file.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-4-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 105 ++++++++++++++++++++++++++++++++++++++
 migration/postcopy-ram.h |   2 +
 migration/savevm.c       | 107 ---------------------------------------
 3 files changed, 107 insertions(+), 107 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 5471efb4f0..880b11f154 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2077,3 +2077,108 @@ bool postcopy_is_paused(MigrationStatus status)
     return status == MIGRATION_STATUS_POSTCOPY_PAUSED ||
         status == MIGRATION_STATUS_POSTCOPY_RECOVER_SETUP;
 }
+
+/*
+ * Triggered by a postcopy_listen command; this thread takes over reading
+ * the input stream, leaving the main thread free to carry on loading the rest
+ * of the device state (from RAM).
+ */
+void *postcopy_ram_listen_thread(void *opaque)
+{
+    MigrationIncomingState *mis = migration_incoming_get_current();
+    QEMUFile *f = mis->from_src_file;
+    int load_res;
+    MigrationState *migr = migrate_get_current();
+    Error *local_err = NULL;
+
+    object_ref(OBJECT(migr));
+
+    migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
+                                   MIGRATION_STATUS_POSTCOPY_ACTIVE);
+    qemu_event_set(&mis->thread_sync_event);
+    trace_postcopy_ram_listen_thread_start();
+
+    rcu_register_thread();
+    /*
+     * Because we're a thread and not a coroutine we can't yield
+     * in qemu_file, and thus we must be blocking now.
+     */
+    qemu_file_set_blocking(f, true, &error_fatal);
+
+    /* TODO: sanity check that only postcopiable data will be loaded here */
+    load_res = qemu_loadvm_state_main(f, mis, &local_err);
+
+    /*
+     * This is tricky, but, mis->from_src_file can change after it
+     * returns, when postcopy recovery happened. In the future, we may
+     * want a wrapper for the QEMUFile handle.
+     */
+    f = mis->from_src_file;
+
+    /* And non-blocking again so we don't block in any cleanup */
+    qemu_file_set_blocking(f, false, &error_fatal);
+
+    trace_postcopy_ram_listen_thread_exit();
+    if (load_res < 0) {
+        qemu_file_set_error(f, load_res);
+        dirty_bitmap_mig_cancel_incoming();
+        if (postcopy_state_get() == POSTCOPY_INCOMING_RUNNING &&
+            !migrate_postcopy_ram() && migrate_dirty_bitmaps())
+        {
+            error_report("%s: loadvm failed during postcopy: %d: %s. All states "
+                         "are migrated except dirty bitmaps. Some dirty "
+                         "bitmaps may be lost, and present migrated dirty "
+                         "bitmaps are correctly migrated and valid.",
+                         __func__, load_res, error_get_pretty(local_err));
+            g_clear_pointer(&local_err, error_free);
+            load_res = 0; /* prevent further exit() */
+        } else {
+            error_prepend(&local_err,
+                          "loadvm failed during postcopy: %d: ", load_res);
+            migrate_set_error(migr, local_err);
+            g_clear_pointer(&local_err, error_report_err);
+            migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
+                                           MIGRATION_STATUS_FAILED);
+        }
+    }
+    if (load_res >= 0) {
+        /*
+         * This looks good, but it's possible that the device loading in the
+         * main thread hasn't finished yet, and so we might not be in 'RUN'
+         * state yet; wait for the end of the main thread.
+         */
+        qemu_event_wait(&mis->main_thread_load_event);
+    }
+    postcopy_ram_incoming_cleanup(mis);
+
+    if (load_res < 0) {
+        /*
+         * If something went wrong then we have a bad state so exit;
+         * depending how far we got it might be possible at this point
+         * to leave the guest running and fire MCEs for pages that never
+         * arrived as a desperate recovery step.
+         */
+        rcu_unregister_thread();
+        exit(EXIT_FAILURE);
+    }
+
+    migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
+                                   MIGRATION_STATUS_COMPLETED);
+    /*
+     * If everything has worked fine, then the main thread has waited
+     * for us to start, and we're the last use of the mis.
+     * (If something broke then qemu will have to exit anyway since it's
+     * got a bad migration state).
+     */
+    bql_lock();
+    migration_incoming_state_destroy();
+    bql_unlock();
+
+    rcu_unregister_thread();
+    mis->have_listen_thread = false;
+    postcopy_state_set(POSTCOPY_INCOMING_END);
+
+    object_unref(OBJECT(migr));
+
+    return NULL;
+}
diff --git a/migration/postcopy-ram.h b/migration/postcopy-ram.h
index ca19433b24..3e26db3e6b 100644
--- a/migration/postcopy-ram.h
+++ b/migration/postcopy-ram.h
@@ -199,4 +199,6 @@ bool postcopy_is_paused(MigrationStatus status);
 void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
                                    RAMBlock *rb);
 
+void *postcopy_ram_listen_thread(void *opaque);
+
 #endif
diff --git a/migration/savevm.c b/migration/savevm.c
index fa017378db..2f7ed0db64 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2088,113 +2088,6 @@ static int loadvm_postcopy_ram_handle_discard(MigrationIncomingState *mis,
     return 0;
 }
 
-/*
- * Triggered by a postcopy_listen command; this thread takes over reading
- * the input stream, leaving the main thread free to carry on loading the rest
- * of the device state (from RAM).
- * (TODO:This could do with being in a postcopy file - but there again it's
- * just another input loop, not that postcopy specific)
- */
-static void *postcopy_ram_listen_thread(void *opaque)
-{
-    MigrationIncomingState *mis = migration_incoming_get_current();
-    QEMUFile *f = mis->from_src_file;
-    int load_res;
-    MigrationState *migr = migrate_get_current();
-    Error *local_err = NULL;
-
-    object_ref(OBJECT(migr));
-
-    migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
-                                   MIGRATION_STATUS_POSTCOPY_ACTIVE);
-    qemu_event_set(&mis->thread_sync_event);
-    trace_postcopy_ram_listen_thread_start();
-
-    rcu_register_thread();
-    /*
-     * Because we're a thread and not a coroutine we can't yield
-     * in qemu_file, and thus we must be blocking now.
-     */
-    qemu_file_set_blocking(f, true, &error_fatal);
-
-    /* TODO: sanity check that only postcopiable data will be loaded here */
-    load_res = qemu_loadvm_state_main(f, mis, &local_err);
-
-    /*
-     * This is tricky, but, mis->from_src_file can change after it
-     * returns, when postcopy recovery happened. In the future, we may
-     * want a wrapper for the QEMUFile handle.
-     */
-    f = mis->from_src_file;
-
-    /* And non-blocking again so we don't block in any cleanup */
-    qemu_file_set_blocking(f, false, &error_fatal);
-
-    trace_postcopy_ram_listen_thread_exit();
-    if (load_res < 0) {
-        qemu_file_set_error(f, load_res);
-        dirty_bitmap_mig_cancel_incoming();
-        if (postcopy_state_get() == POSTCOPY_INCOMING_RUNNING &&
-            !migrate_postcopy_ram() && migrate_dirty_bitmaps())
-        {
-            error_report("%s: loadvm failed during postcopy: %d: %s. All states "
-                         "are migrated except dirty bitmaps. Some dirty "
-                         "bitmaps may be lost, and present migrated dirty "
-                         "bitmaps are correctly migrated and valid.",
-                         __func__, load_res, error_get_pretty(local_err));
-            g_clear_pointer(&local_err, error_free);
-            load_res = 0; /* prevent further exit() */
-        } else {
-            error_prepend(&local_err,
-                          "loadvm failed during postcopy: %d: ", load_res);
-            migrate_set_error(migr, local_err);
-            g_clear_pointer(&local_err, error_report_err);
-            migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
-                                           MIGRATION_STATUS_FAILED);
-        }
-    }
-    if (load_res >= 0) {
-        /*
-         * This looks good, but it's possible that the device loading in the
-         * main thread hasn't finished yet, and so we might not be in 'RUN'
-         * state yet; wait for the end of the main thread.
-         */
-        qemu_event_wait(&mis->main_thread_load_event);
-    }
-    postcopy_ram_incoming_cleanup(mis);
-
-    if (load_res < 0) {
-        /*
-         * If something went wrong then we have a bad state so exit;
-         * depending how far we got it might be possible at this point
-         * to leave the guest running and fire MCEs for pages that never
-         * arrived as a desperate recovery step.
-         */
-        rcu_unregister_thread();
-        exit(EXIT_FAILURE);
-    }
-
-    migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
-                                   MIGRATION_STATUS_COMPLETED);
-    /*
-     * If everything has worked fine, then the main thread has waited
-     * for us to start, and we're the last use of the mis.
-     * (If something broke then qemu will have to exit anyway since it's
-     * got a bad migration state).
-     */
-    bql_lock();
-    migration_incoming_state_destroy();
-    bql_unlock();
-
-    rcu_unregister_thread();
-    mis->have_listen_thread = false;
-    postcopy_state_set(POSTCOPY_INCOMING_END);
-
-    object_unref(OBJECT(migr));
-
-    return NULL;
-}
-
 /* After this message we must be able to immediately receive postcopy data */
 static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis,
                                          Error **errp)

From 67474ebacce381e51fa3e9c71af37b68faf4860a Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:53 +0100
Subject: [PATCH 1978/2396] migration: Introduce postcopy incoming setup and
 cleanup functions

After moving postcopy_ram_listen_thread() to postcopy file, this patch
introduces a pair of functions, postcopy_incoming_setup() and
postcopy_incoming_cleanup(). These functions encapsulate setup and
cleanup of all incoming postcopy resources, postcopy-ram and postcopy
listen thread.

Furthermore, this patch also renames the postcopy_ram_listen_thread to
postcopy_listen_thread, as this thread handles not only postcopy-ram,
but also dirty-bitmaps and in the future it could handle other
postcopiable devices.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-5-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c    |  2 +-
 migration/postcopy-ram.c | 44 ++++++++++++++++++++++++++++++++++++++--
 migration/postcopy-ram.h |  3 ++-
 migration/savevm.c       | 25 ++---------------------
 4 files changed, 47 insertions(+), 27 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 6e647c7c4a..9a367f717e 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -892,7 +892,7 @@ process_incoming_migration_co(void *opaque)
              * but managed to complete within the precopy period, we can use
              * the normal exit.
              */
-            postcopy_ram_incoming_cleanup(mis);
+            postcopy_incoming_cleanup(mis);
         } else if (ret >= 0) {
             /*
              * Postcopy was started, cleanup should happen at the end of the
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 880b11f154..b47c955763 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2083,7 +2083,7 @@ bool postcopy_is_paused(MigrationStatus status)
  * the input stream, leaving the main thread free to carry on loading the rest
  * of the device state (from RAM).
  */
-void *postcopy_ram_listen_thread(void *opaque)
+static void *postcopy_listen_thread(void *opaque)
 {
     MigrationIncomingState *mis = migration_incoming_get_current();
     QEMUFile *f = mis->from_src_file;
@@ -2149,7 +2149,7 @@ void *postcopy_ram_listen_thread(void *opaque)
          */
         qemu_event_wait(&mis->main_thread_load_event);
     }
-    postcopy_ram_incoming_cleanup(mis);
+    postcopy_incoming_cleanup(mis);
 
     if (load_res < 0) {
         /*
@@ -2182,3 +2182,43 @@ void *postcopy_ram_listen_thread(void *opaque)
 
     return NULL;
 }
+
+int postcopy_incoming_setup(MigrationIncomingState *mis, Error **errp)
+{
+    /*
+     * Sensitise RAM - can now generate requests for blocks that don't exist
+     * However, at this point the CPU shouldn't be running, and the IO
+     * shouldn't be doing anything yet so don't actually expect requests
+     */
+    if (migrate_postcopy_ram()) {
+        if (postcopy_ram_incoming_setup(mis)) {
+            postcopy_ram_incoming_cleanup(mis);
+            error_setg(errp, "Failed to setup incoming postcopy RAM blocks");
+            return -1;
+        }
+    }
+
+    trace_loadvm_postcopy_handle_listen("after uffd");
+
+    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_LISTEN, errp)) {
+        return -1;
+    }
+
+    mis->have_listen_thread = true;
+    postcopy_thread_create(mis, &mis->listen_thread,
+                           MIGRATION_THREAD_DST_LISTEN,
+                           postcopy_listen_thread, QEMU_THREAD_DETACHED);
+
+    return 0;
+}
+
+int postcopy_incoming_cleanup(MigrationIncomingState *mis)
+{
+    int rc = 0;
+
+    if (migrate_postcopy_ram()) {
+        rc = postcopy_ram_incoming_cleanup(mis);
+    }
+
+    return rc;
+}
diff --git a/migration/postcopy-ram.h b/migration/postcopy-ram.h
index 3e26db3e6b..a080dd65a7 100644
--- a/migration/postcopy-ram.h
+++ b/migration/postcopy-ram.h
@@ -199,6 +199,7 @@ bool postcopy_is_paused(MigrationStatus status);
 void mark_postcopy_blocktime_begin(uintptr_t addr, uint32_t ptid,
                                    RAMBlock *rb);
 
-void *postcopy_ram_listen_thread(void *opaque);
+int postcopy_incoming_setup(MigrationIncomingState *mis, Error **errp);
+int postcopy_incoming_cleanup(MigrationIncomingState *mis);
 
 #endif
diff --git a/migration/savevm.c b/migration/savevm.c
index 2f7ed0db64..01b5a8bfff 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2113,32 +2113,11 @@ static int loadvm_postcopy_handle_listen(MigrationIncomingState *mis,
 
     trace_loadvm_postcopy_handle_listen("after discard");
 
-    /*
-     * Sensitise RAM - can now generate requests for blocks that don't exist
-     * However, at this point the CPU shouldn't be running, and the IO
-     * shouldn't be doing anything yet so don't actually expect requests
-     */
-    if (migrate_postcopy_ram()) {
-        if (postcopy_ram_incoming_setup(mis)) {
-            postcopy_ram_incoming_cleanup(mis);
-            error_setg(errp, "Failed to setup incoming postcopy RAM blocks");
-            return -1;
-        }
-    }
+    int rc = postcopy_incoming_setup(mis, errp);
 
-    trace_loadvm_postcopy_handle_listen("after uffd");
-
-    if (postcopy_notify(POSTCOPY_NOTIFY_INBOUND_LISTEN, errp)) {
-        return -1;
-    }
-
-    mis->have_listen_thread = true;
-    postcopy_thread_create(mis, &mis->listen_thread,
-                           MIGRATION_THREAD_DST_LISTEN,
-                           postcopy_ram_listen_thread, QEMU_THREAD_DETACHED);
     trace_loadvm_postcopy_handle_listen("return");
 
-    return 0;
+    return rc;
 }
 
 static void loadvm_postcopy_handle_run_bh(void *opaque)

From 468a7effdefba22ac905297b2aa02b5781587f40 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:54 +0100
Subject: [PATCH 1979/2396] migration: Refactor all incoming cleanup info
 migration_incoming_destroy()

Currently, there are two functions that are responsible for calling the
cleanup of the incoming migration state. With successful precopy, it's
the incoming migration coroutine, and with successful postcopy it's the
postcopy listen thread. However, if postcopy fails during in the device
load, both functions will try to do the cleanup.

This patch refactors all cleanup that needs to be done on the incoming
side into a common function and defines a clear boundary, who is
responsible for the cleanup. The incoming migration coroutine is
responsible for calling the cleanup function, unless the listen thread
has been started, in which case the postcopy listen thread runs the
incoming migration cleanup in its BH.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Fixes: 9535435795 ("migration: push Error **errp into qemu_loadvm_state()")
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-6-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c    | 44 +++++++++-------------------
 migration/migration.h    |  1 +
 migration/postcopy-ram.c | 63 +++++++++++++++++++++-------------------
 migration/trace-events   |  2 +-
 4 files changed, 49 insertions(+), 61 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 9a367f717e..637be71bfe 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -438,10 +438,15 @@ void migration_incoming_transport_cleanup(MigrationIncomingState *mis)
 
 void migration_incoming_state_destroy(void)
 {
-    struct MigrationIncomingState *mis = migration_incoming_get_current();
+    MigrationIncomingState *mis = migration_incoming_get_current();
+    PostcopyState ps = postcopy_state_get();
 
     multifd_recv_cleanup();
 
+    if (ps != POSTCOPY_INCOMING_NONE) {
+        postcopy_incoming_cleanup(mis);
+    }
+
     /*
      * RAM state cleanup needs to happen after multifd cleanup, because
      * multifd threads can use some of its states (receivedmap).
@@ -866,7 +871,6 @@ process_incoming_migration_co(void *opaque)
 {
     MigrationState *s = migrate_get_current();
     MigrationIncomingState *mis = migration_incoming_get_current();
-    PostcopyState ps;
     int ret;
     Error *local_err = NULL;
 
@@ -883,25 +887,14 @@ process_incoming_migration_co(void *opaque)
 
     trace_vmstate_downtime_checkpoint("dst-precopy-loadvm-completed");
 
-    ps = postcopy_state_get();
-    trace_process_incoming_migration_co_end(ret, ps);
-    if (ps != POSTCOPY_INCOMING_NONE) {
-        if (ps == POSTCOPY_INCOMING_ADVISE) {
-            /*
-             * Where a migration had postcopy enabled (and thus went to advise)
-             * but managed to complete within the precopy period, we can use
-             * the normal exit.
-             */
-            postcopy_incoming_cleanup(mis);
-        } else if (ret >= 0) {
-            /*
-             * Postcopy was started, cleanup should happen at the end of the
-             * postcopy thread.
-             */
-            trace_process_incoming_migration_co_postcopy_end_main();
-            goto out;
-        }
-        /* Else if something went wrong then just fall out of the normal exit */
+    trace_process_incoming_migration_co_end(ret);
+    if (mis->have_listen_thread) {
+        /*
+         * Postcopy was started, cleanup should happen at the end of the
+         * postcopy listen thread.
+         */
+        trace_process_incoming_migration_co_postcopy_end_main();
+        goto out;
     }
 
     if (ret < 0) {
@@ -933,15 +926,6 @@ fail:
         }
 
         exit(EXIT_FAILURE);
-    } else {
-        /*
-         * Report the error here in case that QEMU abruptly exits
-         * when postcopy is enabled.
-         */
-        WITH_QEMU_LOCK_GUARD(&s->error_mutex) {
-            error_report_err(s->error);
-            s->error = NULL;
-        }
     }
 out:
     /* Pairs with the refcount taken in qmp_migrate_incoming() */
diff --git a/migration/migration.h b/migration/migration.h
index 01329bf824..4a37f7202c 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -254,6 +254,7 @@ struct MigrationIncomingState {
 MigrationIncomingState *migration_incoming_get_current(void);
 void migration_incoming_state_destroy(void);
 void migration_incoming_transport_cleanup(MigrationIncomingState *mis);
+void migration_incoming_qemu_exit(void);
 /*
  * Functions to work with blocktime context
  */
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index b47c955763..48cbb46c27 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2078,6 +2078,24 @@ bool postcopy_is_paused(MigrationStatus status)
         status == MIGRATION_STATUS_POSTCOPY_RECOVER_SETUP;
 }
 
+static void postcopy_listen_thread_bh(void *opaque)
+{
+    MigrationIncomingState *mis = migration_incoming_get_current();
+
+    migration_incoming_state_destroy();
+
+    if (mis->state == MIGRATION_STATUS_FAILED) {
+        /*
+         * If something went wrong then we have a bad state so exit;
+         * we only could have gotten here if something failed before
+         * POSTCOPY_INCOMING_RUNNING (for example device load), otherwise
+         * postcopy migration would pause inside qemu_loadvm_state_main().
+         * Failing dirty-bitmaps won't fail the whole migration.
+         */
+        exit(1);
+    }
+}
+
 /*
  * Triggered by a postcopy_listen command; this thread takes over reading
  * the input stream, leaving the main thread free to carry on loading the rest
@@ -2131,53 +2149,38 @@ static void *postcopy_listen_thread(void *opaque)
                          "bitmaps are correctly migrated and valid.",
                          __func__, load_res, error_get_pretty(local_err));
             g_clear_pointer(&local_err, error_free);
-            load_res = 0; /* prevent further exit() */
         } else {
+            /*
+             * Something went fatally wrong and we have a bad state, QEMU will
+             * exit depending on if postcopy-exit-on-error is true, but the
+             * migration cannot be recovered.
+             */
             error_prepend(&local_err,
                           "loadvm failed during postcopy: %d: ", load_res);
             migrate_set_error(migr, local_err);
             g_clear_pointer(&local_err, error_report_err);
             migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                                            MIGRATION_STATUS_FAILED);
+            goto out;
         }
     }
-    if (load_res >= 0) {
-        /*
-         * This looks good, but it's possible that the device loading in the
-         * main thread hasn't finished yet, and so we might not be in 'RUN'
-         * state yet; wait for the end of the main thread.
-         */
-        qemu_event_wait(&mis->main_thread_load_event);
-    }
-    postcopy_incoming_cleanup(mis);
-
-    if (load_res < 0) {
-        /*
-         * If something went wrong then we have a bad state so exit;
-         * depending how far we got it might be possible at this point
-         * to leave the guest running and fire MCEs for pages that never
-         * arrived as a desperate recovery step.
-         */
-        rcu_unregister_thread();
-        exit(EXIT_FAILURE);
-    }
+    /*
+     * This looks good, but it's possible that the device loading in the
+     * main thread hasn't finished yet, and so we might not be in 'RUN'
+     * state yet; wait for the end of the main thread.
+     */
+    qemu_event_wait(&mis->main_thread_load_event);
 
     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                                    MIGRATION_STATUS_COMPLETED);
-    /*
-     * If everything has worked fine, then the main thread has waited
-     * for us to start, and we're the last use of the mis.
-     * (If something broke then qemu will have to exit anyway since it's
-     * got a bad migration state).
-     */
-    bql_lock();
-    migration_incoming_state_destroy();
-    bql_unlock();
 
+out:
     rcu_unregister_thread();
     mis->have_listen_thread = false;
     postcopy_state_set(POSTCOPY_INCOMING_END);
 
+    migration_bh_schedule(postcopy_listen_thread_bh, NULL);
+
     object_unref(OBJECT(migr));
 
     return NULL;
diff --git a/migration/trace-events b/migration/trace-events
index e8edd1fbba..772636f3ac 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -193,7 +193,7 @@ source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
 source_return_path_thread_switchover_acked(void) ""
 migration_thread_low_pending(uint64_t pending) "%" PRIu64
 migrate_transferred(uint64_t transferred, uint64_t time_spent, uint64_t bandwidth, uint64_t avail_bw, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " switchover_bw %" PRIu64 " max_size %" PRId64
-process_incoming_migration_co_end(int ret, int ps) "ret=%d postcopy-state=%d"
+process_incoming_migration_co_end(int ret) "ret=%d"
 process_incoming_migration_co_postcopy_end_main(void) ""
 postcopy_preempt_enabled(bool value) "%d"
 migration_precopy_complete(void) ""

From b1a17a519b20438fb3f8435a2b7fa702f393d075 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:55 +0100
Subject: [PATCH 1980/2396] migration: Respect exit-on-error when migration
 fails before resuming

When exit-on-error was added to migration, it wasn't added to postcopy.
Even though postcopy migration will usually pause and not fail, in cases
it does unrecoverably fail before destination side has been started,
exit-on-error will allow management to query the error.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-7-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 48cbb46c27..91431f02a4 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2080,11 +2080,16 @@ bool postcopy_is_paused(MigrationStatus status)
 
 static void postcopy_listen_thread_bh(void *opaque)
 {
+    MigrationState *s = migrate_get_current();
     MigrationIncomingState *mis = migration_incoming_get_current();
 
     migration_incoming_state_destroy();
 
-    if (mis->state == MIGRATION_STATUS_FAILED) {
+    if (mis->state == MIGRATION_STATUS_FAILED && mis->exit_on_error) {
+        WITH_QEMU_LOCK_GUARD(&s->error_mutex) {
+            error_report_err(s->error);
+            s->error = NULL;
+        }
         /*
          * If something went wrong then we have a bad state so exit;
          * we only could have gotten here if something failed before

From 0680dd185b3265a948e1863cdc52c65f72b994d9 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:56 +0100
Subject: [PATCH 1981/2396] migration: Make postcopy listen thread joinable

This patch makes the listen thread joinable instead detached, and joins
it alongside other postcopy threads.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Peter Xu <peterx@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-8-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 91431f02a4..8405cce7b4 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2181,7 +2181,6 @@ static void *postcopy_listen_thread(void *opaque)
 
 out:
     rcu_unregister_thread();
-    mis->have_listen_thread = false;
     postcopy_state_set(POSTCOPY_INCOMING_END);
 
     migration_bh_schedule(postcopy_listen_thread_bh, NULL);
@@ -2215,7 +2214,7 @@ int postcopy_incoming_setup(MigrationIncomingState *mis, Error **errp)
     mis->have_listen_thread = true;
     postcopy_thread_create(mis, &mis->listen_thread,
                            MIGRATION_THREAD_DST_LISTEN,
-                           postcopy_listen_thread, QEMU_THREAD_DETACHED);
+                           postcopy_listen_thread, QEMU_THREAD_JOINABLE);
 
     return 0;
 }
@@ -2224,6 +2223,11 @@ int postcopy_incoming_cleanup(MigrationIncomingState *mis)
 {
     int rc = 0;
 
+    if (mis->have_listen_thread) {
+        qemu_thread_join(&mis->listen_thread);
+        mis->have_listen_thread = false;
+    }
+
     if (migrate_postcopy_ram()) {
         rc = postcopy_ram_incoming_cleanup(mis);
     }

From 7b842fe354c63feaffc63c850b28c3610a0c90d2 Mon Sep 17 00:00:00 2001
From: Juraj Marcin <jmarcin@redhat.com>
Date: Mon, 3 Nov 2025 19:32:57 +0100
Subject: [PATCH 1982/2396] migration: Introduce POSTCOPY_DEVICE state

Currently, when postcopy starts, the source VM starts switchover and
sends a package containing the state of all non-postcopiable devices.
When the destination loads this package, the switchover is complete and
the destination VM starts. However, if the device state load fails or
the destination side crashes, the source side is already in
POSTCOPY_ACTIVE state and cannot be recovered, even when it has the most
up-to-date machine state as the destination has not yet started.

This patch introduces a new POSTCOPY_DEVICE state which is active while
the destination machine is loading the device state, is not yet running,
and the source side can be resumed in case of a migration failure.
Return-path is required for this state to function, otherwise it will be
skipped in favor of POSTCOPY_ACTIVE.

To transition from POSTCOPY_DEVICE to POSTCOPY_ACTIVE, the source
side uses a PONG message that is a response to a PING message processed
just before the POSTCOPY_RUN command that starts the destination VM.
Thus, this feature is effective even if the destination side does not
yet support this new state.

Signed-off-by: Juraj Marcin <jmarcin@redhat.com>
Link: https://lore.kernel.org/r/20251103183301.3840862-9-jmarcin@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c                 | 50 ++++++++++++++++++++++++---
 migration/migration.h                 |  3 ++
 migration/postcopy-ram.c              | 10 ++++--
 migration/savevm.c                    |  5 +++
 migration/savevm.h                    |  2 ++
 migration/trace-events                |  1 +
 qapi/migration.json                   | 10 ++++--
 tests/qemu-iotests/194                |  2 +-
 tests/qtest/migration/precopy-tests.c |  3 +-
 9 files changed, 75 insertions(+), 11 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index 637be71bfe..c2daab6bdd 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1206,6 +1206,7 @@ bool migration_is_running(void)
 
     switch (s->state) {
     case MIGRATION_STATUS_ACTIVE:
+    case MIGRATION_STATUS_POSTCOPY_DEVICE:
     case MIGRATION_STATUS_POSTCOPY_ACTIVE:
     case MIGRATION_STATUS_POSTCOPY_PAUSED:
     case MIGRATION_STATUS_POSTCOPY_RECOVER_SETUP:
@@ -1227,6 +1228,7 @@ static bool migration_is_active(void)
     MigrationState *s = current_migration;
 
     return (s->state == MIGRATION_STATUS_ACTIVE ||
+            s->state == MIGRATION_STATUS_POSTCOPY_DEVICE ||
             s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
 }
 
@@ -1349,6 +1351,7 @@ static void fill_source_migration_info(MigrationInfo *info)
         break;
     case MIGRATION_STATUS_ACTIVE:
     case MIGRATION_STATUS_CANCELLING:
+    case MIGRATION_STATUS_POSTCOPY_DEVICE:
     case MIGRATION_STATUS_POSTCOPY_ACTIVE:
     case MIGRATION_STATUS_PRE_SWITCHOVER:
     case MIGRATION_STATUS_DEVICE:
@@ -1402,6 +1405,7 @@ static void fill_destination_migration_info(MigrationInfo *info)
     case MIGRATION_STATUS_CANCELLING:
     case MIGRATION_STATUS_CANCELLED:
     case MIGRATION_STATUS_ACTIVE:
+    case MIGRATION_STATUS_POSTCOPY_DEVICE:
     case MIGRATION_STATUS_POSTCOPY_ACTIVE:
     case MIGRATION_STATUS_POSTCOPY_PAUSED:
     case MIGRATION_STATUS_POSTCOPY_RECOVER:
@@ -1732,6 +1736,7 @@ bool migration_in_postcopy(void)
     MigrationState *s = migrate_get_current();
 
     switch (s->state) {
+    case MIGRATION_STATUS_POSTCOPY_DEVICE:
     case MIGRATION_STATUS_POSTCOPY_ACTIVE:
     case MIGRATION_STATUS_POSTCOPY_PAUSED:
     case MIGRATION_STATUS_POSTCOPY_RECOVER_SETUP:
@@ -1833,6 +1838,9 @@ int migrate_init(MigrationState *s, Error **errp)
     memset(&mig_stats, 0, sizeof(mig_stats));
     migration_reset_vfio_bytes_transferred();
 
+    s->postcopy_package_loaded = false;
+    qemu_event_reset(&s->postcopy_package_loaded_event);
+
     return 0;
 }
 
@@ -2568,6 +2576,11 @@ static void *source_return_path_thread(void *opaque)
             tmp32 = ldl_be_p(buf);
             trace_source_return_path_thread_pong(tmp32);
             qemu_sem_post(&ms->rp_state.rp_pong_acks);
+            if (tmp32 == QEMU_VM_PING_PACKAGED_LOADED) {
+                trace_source_return_path_thread_postcopy_package_loaded();
+                ms->postcopy_package_loaded = true;
+                qemu_event_set(&ms->postcopy_package_loaded_event);
+            }
             break;
 
         case MIG_RP_MSG_REQ_PAGES:
@@ -2813,6 +2826,15 @@ static int postcopy_start(MigrationState *ms, Error **errp)
     if (migrate_postcopy_ram()) {
         qemu_savevm_send_ping(fb, 3);
     }
+    if (ms->rp_state.rp_thread_created) {
+        /*
+        * This ping will tell us that all non-postcopiable device state has been
+        * successfully loaded and the destination is about to start. When
+        * response is received, it will trigger transition from POSTCOPY_DEVICE
+        * to POSTCOPY_ACTIVE state.
+        */
+        qemu_savevm_send_ping(fb, QEMU_VM_PING_PACKAGED_LOADED);
+    }
 
     qemu_savevm_send_postcopy_run(fb);
 
@@ -2868,8 +2890,13 @@ static int postcopy_start(MigrationState *ms, Error **errp)
      */
     migration_rate_set(migrate_max_postcopy_bandwidth());
 
-    /* Now, switchover looks all fine, switching to postcopy-active */
+    /*
+     * Now, switchover looks all fine, switching to POSTCOPY_DEVICE, or
+     * directly to POSTCOPY_ACTIVE if there is no return path.
+     */
     migrate_set_state(&ms->state, MIGRATION_STATUS_DEVICE,
+                      ms->rp_state.rp_thread_created ?
+                      MIGRATION_STATUS_POSTCOPY_DEVICE :
                       MIGRATION_STATUS_POSTCOPY_ACTIVE);
 
     bql_unlock();
@@ -3311,8 +3338,8 @@ static MigThrError migration_detect_error(MigrationState *s)
         return postcopy_pause(s);
     } else {
         /*
-         * For precopy (or postcopy with error outside IO), we fail
-         * with no time.
+         * For precopy (or postcopy with error outside IO, or before dest
+         * starts), we fail with no time.
          */
         migrate_set_state(&s->state, state, MIGRATION_STATUS_FAILED);
         trace_migration_thread_file_err();
@@ -3447,7 +3474,8 @@ static MigIterateState migration_iteration_run(MigrationState *s)
 {
     uint64_t must_precopy, can_postcopy, pending_size;
     Error *local_err = NULL;
-    bool in_postcopy = s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE;
+    bool in_postcopy = (s->state == MIGRATION_STATUS_POSTCOPY_DEVICE ||
+                        s->state == MIGRATION_STATUS_POSTCOPY_ACTIVE);
     bool can_switchover = migration_can_switchover(s);
     bool complete_ready;
 
@@ -3463,6 +3491,18 @@ static MigIterateState migration_iteration_run(MigrationState *s)
          * POSTCOPY_ACTIVE it means switchover already happened.
          */
         complete_ready = !pending_size;
+        if (s->state == MIGRATION_STATUS_POSTCOPY_DEVICE &&
+            (s->postcopy_package_loaded || complete_ready)) {
+            /*
+             * If package has been loaded, the event is set and we will
+             * immediatelly transition to POSTCOPY_ACTIVE. If we are ready for
+             * completion, we need to wait for destination to load the postcopy
+             * package before actually completing.
+             */
+            qemu_event_wait(&s->postcopy_package_loaded_event);
+            migrate_set_state(&s->state, MIGRATION_STATUS_POSTCOPY_DEVICE,
+                              MIGRATION_STATUS_POSTCOPY_ACTIVE);
+        }
     } else {
         /*
          * Exact pending reporting is only needed for precopy.  Taking RAM
@@ -4117,6 +4157,7 @@ static void migration_instance_finalize(Object *obj)
     qemu_sem_destroy(&ms->rp_state.rp_pong_acks);
     qemu_sem_destroy(&ms->postcopy_qemufile_src_sem);
     error_free(ms->error);
+    qemu_event_destroy(&ms->postcopy_package_loaded_event);
 }
 
 static void migration_instance_init(Object *obj)
@@ -4138,6 +4179,7 @@ static void migration_instance_init(Object *obj)
     qemu_sem_init(&ms->wait_unplug_sem, 0);
     qemu_sem_init(&ms->postcopy_qemufile_src_sem, 0);
     qemu_mutex_init(&ms->qemu_file_lock);
+    qemu_event_init(&ms->postcopy_package_loaded_event, 0);
 }
 
 /*
diff --git a/migration/migration.h b/migration/migration.h
index 4a37f7202c..213b33fe6e 100644
--- a/migration/migration.h
+++ b/migration/migration.h
@@ -510,6 +510,9 @@ struct MigrationState {
     /* Is this a rdma migration */
     bool rdma_migration;
 
+    bool postcopy_package_loaded;
+    QemuEvent postcopy_package_loaded_event;
+
     GSource *hup_source;
 };
 
diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 8405cce7b4..3f98dcb6fd 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2117,7 +2117,8 @@ static void *postcopy_listen_thread(void *opaque)
     object_ref(OBJECT(migr));
 
     migrate_set_state(&mis->state, MIGRATION_STATUS_ACTIVE,
-                                   MIGRATION_STATUS_POSTCOPY_ACTIVE);
+                      mis->to_src_file ? MIGRATION_STATUS_POSTCOPY_DEVICE :
+                                         MIGRATION_STATUS_POSTCOPY_ACTIVE);
     qemu_event_set(&mis->thread_sync_event);
     trace_postcopy_ram_listen_thread_start();
 
@@ -2164,8 +2165,7 @@ static void *postcopy_listen_thread(void *opaque)
                           "loadvm failed during postcopy: %d: ", load_res);
             migrate_set_error(migr, local_err);
             g_clear_pointer(&local_err, error_report_err);
-            migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
-                                           MIGRATION_STATUS_FAILED);
+            migrate_set_state(&mis->state, mis->state, MIGRATION_STATUS_FAILED);
             goto out;
         }
     }
@@ -2176,6 +2176,10 @@ static void *postcopy_listen_thread(void *opaque)
      */
     qemu_event_wait(&mis->main_thread_load_event);
 
+    /*
+     * Device load in the main thread has finished, we should be in
+     * POSTCOPY_ACTIVE now.
+     */
     migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_ACTIVE,
                                    MIGRATION_STATUS_COMPLETED);
 
diff --git a/migration/savevm.c b/migration/savevm.c
index 01b5a8bfff..62cc2ce25c 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -2170,6 +2170,11 @@ static int loadvm_postcopy_handle_run(MigrationIncomingState *mis, Error **errp)
         return -1;
     }
 
+    /* We might be already in POSTCOPY_ACTIVE if there is no return path */
+    if (mis->state == MIGRATION_STATUS_POSTCOPY_DEVICE) {
+        migrate_set_state(&mis->state, MIGRATION_STATUS_POSTCOPY_DEVICE,
+                          MIGRATION_STATUS_POSTCOPY_ACTIVE);
+    }
     postcopy_state_set(POSTCOPY_INCOMING_RUNNING);
     migration_bh_schedule(loadvm_postcopy_handle_run_bh, mis);
 
diff --git a/migration/savevm.h b/migration/savevm.h
index c337e3e3d1..125a2507b7 100644
--- a/migration/savevm.h
+++ b/migration/savevm.h
@@ -29,6 +29,8 @@
 #define QEMU_VM_COMMAND              0x08
 #define QEMU_VM_SECTION_FOOTER       0x7e
 
+#define QEMU_VM_PING_PACKAGED_LOADED 0x42
+
 bool qemu_savevm_state_blocked(Error **errp);
 void qemu_savevm_non_migratable_list(strList **reasons);
 int qemu_savevm_state_prepare(Error **errp);
diff --git a/migration/trace-events b/migration/trace-events
index 772636f3ac..bf11b62b17 100644
--- a/migration/trace-events
+++ b/migration/trace-events
@@ -191,6 +191,7 @@ source_return_path_thread_pong(uint32_t val) "0x%x"
 source_return_path_thread_shut(uint32_t val) "0x%x"
 source_return_path_thread_resume_ack(uint32_t v) "%"PRIu32
 source_return_path_thread_switchover_acked(void) ""
+source_return_path_thread_postcopy_package_loaded(void) ""
 migration_thread_low_pending(uint64_t pending) "%" PRIu64
 migrate_transferred(uint64_t transferred, uint64_t time_spent, uint64_t bandwidth, uint64_t avail_bw, uint64_t size) "transferred %" PRIu64 " time_spent %" PRIu64 " bandwidth %" PRIu64 " switchover_bw %" PRIu64 " max_size %" PRId64
 process_incoming_migration_co_end(int ret) "ret=%d"
diff --git a/qapi/migration.json b/qapi/migration.json
index c7a6737cc1..93f71de3fe 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -142,6 +142,12 @@
 # @postcopy-active: like active, but now in postcopy mode.
 #     (since 2.5)
 #
+# @postcopy-device: like postcopy-active, but the destination is still
+#     loading device state and is not running yet.  If migration fails
+#     during this state, the source side will resume.  If there is no
+#     return-path from destination to source, this state is skipped.
+#     (since 10.2)
+#
 # @postcopy-paused: during postcopy but paused.  (since 3.0)
 #
 # @postcopy-recover-setup: setup phase for a postcopy recovery
@@ -173,8 +179,8 @@
 ##
 { 'enum': 'MigrationStatus',
   'data': [ 'none', 'setup', 'cancelling', 'cancelled',
-            'active', 'postcopy-active', 'postcopy-paused',
-            'postcopy-recover-setup',
+            'active', 'postcopy-device', 'postcopy-active',
+            'postcopy-paused', 'postcopy-recover-setup',
             'postcopy-recover', 'completed', 'failed', 'colo',
             'pre-switchover', 'device', 'wait-unplug' ] }
 ##
diff --git a/tests/qemu-iotests/194 b/tests/qemu-iotests/194
index e114c0b269..806624394d 100755
--- a/tests/qemu-iotests/194
+++ b/tests/qemu-iotests/194
@@ -76,7 +76,7 @@ with iotests.FilePath('source.img') as source_img_path, \
 
     while True:
         event1 = source_vm.event_wait('MIGRATION')
-        if event1['data']['status'] == 'postcopy-active':
+        if event1['data']['status'] in ('postcopy-device', 'postcopy-active'):
             # This event is racy, it depends do we really do postcopy or bitmap
             # was migrated during downtime (and no data to migrate in postcopy
             # phase). So, don't log it.
diff --git a/tests/qtest/migration/precopy-tests.c b/tests/qtest/migration/precopy-tests.c
index bb38292550..57ca623de5 100644
--- a/tests/qtest/migration/precopy-tests.c
+++ b/tests/qtest/migration/precopy-tests.c
@@ -1316,13 +1316,14 @@ void migration_test_add_precopy(MigrationTestEnv *env)
     }
 
     /* ensure new status don't go unnoticed */
-    assert(MIGRATION_STATUS__MAX == 15);
+    assert(MIGRATION_STATUS__MAX == 16);
 
     for (int i = MIGRATION_STATUS_NONE; i < MIGRATION_STATUS__MAX; i++) {
         switch (i) {
         case MIGRATION_STATUS_DEVICE: /* happens too fast */
         case MIGRATION_STATUS_WAIT_UNPLUG: /* no support in tests */
         case MIGRATION_STATUS_COLO: /* no support in tests */
+        case MIGRATION_STATUS_POSTCOPY_DEVICE: /* postcopy can't be cancelled */
         case MIGRATION_STATUS_POSTCOPY_ACTIVE: /* postcopy can't be cancelled */
         case MIGRATION_STATUS_POSTCOPY_PAUSED:
         case MIGRATION_STATUS_POSTCOPY_RECOVER_SETUP:

From 489946d01af13c472bbf1d8daa80e0bf894e6fc9 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:39 +0800
Subject: [PATCH 1983/2396] hw/arm/aspeed: Move AspeedMachineState definition
 to common header for reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Aspeed machines will be moved into split C files for better
modularization and future maintenance.

To allow all machine implementations to reuse the same
AspeedMachineState structure, the struct definition is moved
from aspeed.c to the shared header aspeed.h.

This change centralizes the common state structure used across
all Aspeed machine models, reduces redundancy, and simplifies
future refactoring work for new machines.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         | 14 --------------
 include/hw/arm/aspeed.h | 12 ++++++++++++
 2 files changed, 12 insertions(+), 14 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ecc7272e67..4c92f1e1d9 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -36,20 +36,6 @@ static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
 };
 
-struct AspeedMachineState {
-    /* Private */
-    MachineState parent_obj;
-    /* Public */
-
-    AspeedSoCState *soc;
-    MemoryRegion boot_rom;
-    bool mmio_exec;
-    uint32_t uart_chosen;
-    char *fmc_model;
-    char *spi_model;
-    uint32_t hw_strap1;
-};
-
 /* On 32-bit hosts, lower RAM to 1G because of the 2047 MB limit */
 #if HOST_LONG_BITS == 32
 #define ASPEED_RAM_SIZE(sz) MIN((sz), 1 * GiB)
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 6c36455656..9d34be68b2 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -11,6 +11,7 @@
 
 #include "hw/boards.h"
 #include "qom/object.h"
+#include "hw/arm/aspeed_soc.h"
 
 typedef struct AspeedMachineState AspeedMachineState;
 
@@ -24,6 +25,17 @@ DECLARE_OBJ_CHECKERS(AspeedMachineState, AspeedMachineClass,
 #define ASPEED_MAC2_ON   (1 << 2)
 #define ASPEED_MAC3_ON   (1 << 3)
 
+struct AspeedMachineState {
+    MachineState parent_obj;
+
+    AspeedSoCState *soc;
+    MemoryRegion boot_rom;
+    bool mmio_exec;
+    uint32_t uart_chosen;
+    char *fmc_model;
+    char *spi_model;
+    uint32_t hw_strap1;
+};
 
 struct AspeedMachineClass {
     MachineClass parent_obj;

From 59bb848ee8c0d0bd392e0894e81e0d459ca11534 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:40 +0800
Subject: [PATCH 1984/2396] hw/arm/aspeed: Make
 aspeed_machine_class_init_cpus_defaults() globally accessible
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The function aspeed_machine_class_init_cpus_defaults() is now made
globally visible so that it can be used by other Aspeed machine C files.

Previously, this function was declared as static, restricting its
visibility to aspeed.c. Since future machine split files will also
need to call this helper to initialize default CPU settings, its
declaration has been moved to the common header aspeed.h and the
static keyword has been removed.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-3-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         |  2 +-
 include/hw/arm/aspeed.h | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 4c92f1e1d9..f23af5bf8c 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -1339,7 +1339,7 @@ static void aspeed_machine_class_props_init(ObjectClass *oc)
                                           "Change the SPI Flash model");
 }
 
-static void aspeed_machine_class_init_cpus_defaults(MachineClass *mc)
+void aspeed_machine_class_init_cpus_defaults(MachineClass *mc)
 {
     AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(mc);
     AspeedSoCClass *sc = ASPEED_SOC_CLASS(object_class_by_name(amc->soc_name));
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 9d34be68b2..712014497e 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -57,5 +57,15 @@ struct AspeedMachineClass {
     bool vbootrom;
 };
 
+/*
+ * aspeed_machine_class_init_cpus_defaults:
+ * @mc: the #MachineClass to be initialized.
+ *
+ * Initialize the default CPU configuration for an Aspeed machine class.
+ * This function sets the default, minimum, and maximum CPU counts
+ * to match the number of CPUs defined in the associated SoC class,
+ * and copies its list of valid CPU types.
+ */
+void aspeed_machine_class_init_cpus_defaults(MachineClass *mc);
 
 #endif

From 670b0963bf3aefa725443b092cc2cefc6402e4cc Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:41 +0800
Subject: [PATCH 1985/2396] hw/arm/aspeed: Export and rename create_pca9552()
 for reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The helper function create_pca9552() has been renamed to
aspeed_create_pca9552() and made non-static for reuse by other Aspeed
machine source files. A corresponding prototype is now declared in
aspeed.h.

This allows multiple Aspeed platforms to share PCA9552 I2C LED controller
initialization logic, improving code reuse and reducing duplication.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         | 44 ++++++++++++++++++++---------------------
 include/hw/arm/aspeed.h | 12 +++++++++++
 2 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index f23af5bf8c..c6f272d986 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -537,7 +537,7 @@ static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp421", 0x4e);
 }
 
-static void create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
+void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
                             TYPE_PCA9552, addr);
@@ -565,9 +565,9 @@ static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54,
                           eeprom4_54);
     /* PCA9539 @ 0x76, but PCA9552 is compatible */
-    create_pca9552(soc, 4, 0x76);
+    aspeed_create_pca9552(soc, 4, 0x76);
     /* PCA9539 @ 0x77, but PCA9552 is compatible */
-    create_pca9552(soc, 4, 0x77);
+    aspeed_create_pca9552(soc, 4, 0x77);
 
     /* bus 6 : */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x48);
@@ -578,8 +578,8 @@ static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
     uint8_t *eeprom8_56 = g_malloc0(8 * 1024);
     smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 8), 0x56,
                           eeprom8_56);
-    create_pca9552(soc, 8, 0x60);
-    create_pca9552(soc, 8, 0x61);
+    aspeed_create_pca9552(soc, 8, 0x60);
+    aspeed_create_pca9552(soc, 8, 0x61);
     /* bus 8 : adc128d818 @ 0x1d */
     /* bus 8 : adc128d818 @ 0x1f */
 
@@ -710,7 +710,7 @@ static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "ds1338", 0x68);
 
     /* It expects a pca9555 but a pca9552 is compatible */
-    create_pca9552(soc, 8, 0x30);
+    aspeed_create_pca9552(soc, 8, 0x30);
 }
 
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
@@ -720,7 +720,7 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 0), 0x51, 32 * KiB);
 
-    create_pca9552(soc, 3, 0x61);
+    aspeed_create_pca9552(soc, 3, 0x61);
 
     /* The rainier expects a TMP275 but a TMP105 is compatible */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
@@ -734,14 +734,14 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x52, 64 * KiB);
-    create_pca9552(soc, 4, 0x60);
+    aspeed_create_pca9552(soc, 4, 0x60);
 
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
                      0x48);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
                      0x49);
-    create_pca9552(soc, 5, 0x60);
-    create_pca9552(soc, 5, 0x61);
+    aspeed_create_pca9552(soc, 5, 0x60);
+    aspeed_create_pca9552(soc, 5, 0x61);
     i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5),
                                       "pca9546", 0x70);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
@@ -760,12 +760,12 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x50, 64 * KiB);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 3), 0x51, 64 * KiB);
 
-    create_pca9552(soc, 7, 0x30);
-    create_pca9552(soc, 7, 0x31);
-    create_pca9552(soc, 7, 0x32);
-    create_pca9552(soc, 7, 0x33);
-    create_pca9552(soc, 7, 0x60);
-    create_pca9552(soc, 7, 0x61);
+    aspeed_create_pca9552(soc, 7, 0x30);
+    aspeed_create_pca9552(soc, 7, 0x31);
+    aspeed_create_pca9552(soc, 7, 0x32);
+    aspeed_create_pca9552(soc, 7, 0x33);
+    aspeed_create_pca9552(soc, 7, 0x60);
+    aspeed_create_pca9552(soc, 7, 0x61);
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "dps310", 0x76);
     /* Bus 7: TODO si7021-a20@20 */
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), TYPE_TMP105,
@@ -782,8 +782,8 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
                           64 * KiB, rainier_bb_fruid, rainier_bb_fruid_len);
     at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51,
                           64 * KiB, rainier_bmc_fruid, rainier_bmc_fruid_len);
-    create_pca9552(soc, 8, 0x60);
-    create_pca9552(soc, 8, 0x61);
+    aspeed_create_pca9552(soc, 8, 0x60);
+    aspeed_create_pca9552(soc, 8, 0x61);
     /* Bus 8: ucd90320@11 */
     /* Bus 8: ucd90320@b */
     /* Bus 8: ucd90320@c */
@@ -804,17 +804,17 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
                                       "pca9546", 0x70);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
     at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
-    create_pca9552(soc, 11, 0x60);
+    aspeed_create_pca9552(soc, 11, 0x60);
 
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 13), 0x50, 64 * KiB);
-    create_pca9552(soc, 13, 0x60);
+    aspeed_create_pca9552(soc, 13, 0x60);
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 14), 0x50, 64 * KiB);
-    create_pca9552(soc, 14, 0x60);
+    aspeed_create_pca9552(soc, 14, 0x60);
 
     at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 15), 0x50, 64 * KiB);
-    create_pca9552(soc, 15, 0x60);
+    aspeed_create_pca9552(soc, 15, 0x60);
 }
 
 static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 712014497e..9b765295d9 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -68,4 +68,16 @@ struct AspeedMachineClass {
  */
 void aspeed_machine_class_init_cpus_defaults(MachineClass *mc);
 
+/*
+ * aspeed_create_pca9552:
+ * @soc: pointer to the #AspeedSoCState.
+ * @bus_id: the I2C bus index to attach the device.
+ * @addr: the I2C address of the PCA9552 device.
+ *
+ * Create and attach a PCA9552 LED controller device to the specified I2C bus
+ * of the given Aspeed SoC. The device is instantiated using
+ * i2c_slave_create_simple() with the PCA9552 device type.
+ */
+void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr);
+
 #endif

From cf7155da296d7dacb64ffe8fd8923f36c42fb944 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:42 +0800
Subject: [PATCH 1986/2396] hw/arm/aspeed: Rename and export create_pca9554()
 as aspeed_create_pca9554()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The helper function create_pca9554() has been renamed to
aspeed_create_pca9554() and made globally available.

Previously, the function was declared static inside aspeed.c, restricting
its visibility to that file. As more Aspeed machine implementations
require PCA9554 I2C expander setup, it makes sense to rename it with the
aspeed_ prefix and export its declaration in aspeed.h for shared use.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         |  8 ++++----
 include/hw/arm/aspeed.h | 14 ++++++++++++++
 2 files changed, 18 insertions(+), 4 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index c6f272d986..59416eb5ae 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -543,7 +543,7 @@ void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
                             TYPE_PCA9552, addr);
 }
 
-static I2CSlave *create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
+I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
 {
     return i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
                             TYPE_PCA9554, addr);
@@ -1142,7 +1142,7 @@ static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
     }
 
     /* Bus 5 Expander */
-    create_pca9554(soc, 4, 0x21);
+    aspeed_create_pca9554(soc, 4, 0x21);
 
     /* Mux I2c Expanders */
     i2c_slave_create_simple(i2c[5], "pca9546", 0x71);
@@ -1153,12 +1153,12 @@ static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(i2c[5], "pca9546", 0x77);
 
     /* Bus 10 */
-    dev = DEVICE(create_pca9554(soc, 9, 0x20));
+    dev = DEVICE(aspeed_create_pca9554(soc, 9, 0x20));
 
     /* Set FPGA_READY */
     object_property_set_str(OBJECT(dev), "pin1", "high", &error_fatal);
 
-    create_pca9554(soc, 9, 0x21);
+    aspeed_create_pca9554(soc, 9, 0x21);
     at24c_eeprom_init(i2c[9], 0x50, 64 * KiB);
     at24c_eeprom_init(i2c[9], 0x51, 64 * KiB);
 
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 9b765295d9..16b24e6887 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -80,4 +80,18 @@ void aspeed_machine_class_init_cpus_defaults(MachineClass *mc);
  */
 void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr);
 
+/*
+ * aspeed_create_pca9554:
+ * @soc: pointer to the #AspeedSoCState.
+ * @bus_id: the I2C bus index to attach the device.
+ * @addr: the I2C address of the PCA9554 device.
+ *
+ * Create and attach a PCA9554 I/O expander to the specified I2C bus
+ * of the given Aspeed SoC. The device is created via
+ * i2c_slave_create_simple() and returned as an #I2CSlave pointer.
+ *
+ * Returns: a pointer to the newly created #I2CSlave instance.
+ */
+I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr);
+
 #endif

From 358bbc350d0e046c6b832b08b3223aa661eccc8c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:43 +0800
Subject: [PATCH 1987/2396] hw/arm/aspeed: Split FP5280G2 machine into a
 separate source file for maintenance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the FP5280G2 BMC machine implementation from
aspeed.c into a new standalone file aspeed_ast2500_fp5280g2.c.

The change improves code organization and prepares the Aspeed
machine framework for future expansion and easier maintenance.

Key updates include:
- Moved fp5280g2_bmc_i2c_init() and related machine class init
functions into aspeed_ast2500_fp5280g2.c.
- Added new file to hw/arm/meson.build for compilation.
- Removed obsolete FP5280G2 definitions from aspeed.c

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-6-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                  | 66 ------------------------
 hw/arm/aspeed_ast2500_fp5280g2.c | 88 ++++++++++++++++++++++++++++++++
 hw/arm/meson.build               |  1 +
 3 files changed, 89 insertions(+), 66 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_fp5280g2.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 59416eb5ae..3dcd5fc540 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -131,21 +131,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_64M_DRAM) |                       \
         SCU_AST2500_HW_STRAP_RESERVED1)
 
-/* FP5280G2 hardware value: 0XF100D286 */
-#define FP5280G2_BMC_HW_STRAP1 (                                      \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
-        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
-        SCU_HW_STRAP_MAC1_RGMII |                                       \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2500_HW_STRAP_RESERVED1)
-
 /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 
@@ -686,33 +671,6 @@ static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
                           eeprom_buf);
 }
 
-static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CSlave *i2c_mux;
-
-    /* The at24c256 */
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 1), 0x50, 32768);
-
-    /* The fp5280g2 expects a TMP112 but a TMP105 is compatible */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
-                     0x49);
-
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
-                     "pca9546", 0x70);
-    /* It expects a TMP112 but a TMP105 is compatible */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 0), TYPE_TMP105,
-                     0x4a);
-
-    /* It expects a ds3232 but a ds1338 is good enough */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "ds1338", 0x68);
-
-    /* It expects a pca9555 but a pca9552 is compatible */
-    aspeed_create_pca9552(soc, 8, 0x30);
-}
-
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1608,25 +1566,6 @@ static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
-                                               const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Inspur FP5280G2 BMC (ARM1176)";
-    mc->deprecation_reason = "use 'ast2500-evb' instead";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = FP5280G2_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 2;
-    amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = fp5280g2_bmc_i2c_init;
-    mc->default_ram_size = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -2015,11 +1954,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_firework_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_fp5280g2_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("quanta-q71l-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_fp5280g2.c b/hw/arm/aspeed_ast2500_fp5280g2.c
new file mode 100644
index 0000000000..858e038871
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_fp5280g2.c
@@ -0,0 +1,88 @@
+/*
+ * Inspur FP5280G2
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+#include "hw/i2c/i2c_mux_pca954x.h"
+#include "hw/sensor/tmp105.h"
+
+/* FP5280G2 hardware value: 0XF100D286 */
+#define FP5280G2_BMC_HW_STRAP1 (                                      \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
+        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
+        SCU_HW_STRAP_MAC1_RGMII |                                       \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+        SCU_AST2500_HW_STRAP_RESERVED1)
+
+static void fp5280g2_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CSlave *i2c_mux;
+
+    /* The at24c256 */
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 1), 0x50, 32768);
+
+    /* The fp5280g2 expects a TMP112 but a TMP105 is compatible */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), TYPE_TMP105,
+                     0x49);
+
+    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
+                     "pca9546", 0x70);
+    /* It expects a TMP112 but a TMP105 is compatible */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 0), TYPE_TMP105,
+                     0x4a);
+
+    /* It expects a ds3232 but a ds1338 is good enough */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "ds1338", 0x68);
+
+    /* It expects a pca9555 but a pca9552 is compatible */
+    aspeed_create_pca9552(soc, 8, 0x30);
+}
+
+static void aspeed_machine_fp5280g2_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Inspur FP5280G2 BMC (ARM1176)";
+    mc->deprecation_reason = "use 'ast2500-evb' instead";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = FP5280G2_BMC_HW_STRAP1;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = fp5280g2_bmc_i2c_init;
+    mc->default_ram_size = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_fp5280g2_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("fp5280g2-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_fp5280g2_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_fp5280g2_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 61c66ee2d0..ed637f2687 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -44,6 +44,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed.c',
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
+  'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',

From 594fc94d7b5f1f4a6edaf0f19625339c34d46dca Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:44 +0800
Subject: [PATCH 1988/2396] hw/arm/aspeed: Split G220A machine into a separate
 source file for better maintenance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit refactors the Bytedance G220A BMC machine by moving its
implementation from aspeed.c into a new dedicated file
aspeed_ast2500_g220a.c.

The goal is to improve modularity and maintainability of Aspeed
machine definitions by isolating each platform into its own source
file. This aligns with ongoing efforts to simplify aspeed.c,
which previously contained all machine configurations.

Key updates include:

- Moved G220A_BMC_HW_STRAP1 definition and
g220a_bmc_i2c_init() function into aspeed_ast2500_g220a.c.
- Moved aspeed_machine_g220a_class_init() and related type
registration to the new file.
- Added the new file to the build system (meson.build).
- Removed all G220A-specific code from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-7-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c               | 72 ---------------------------
 hw/arm/aspeed_ast2500_g220a.c | 92 +++++++++++++++++++++++++++++++++++
 hw/arm/meson.build            |  1 +
 3 files changed, 93 insertions(+), 72 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_g220a.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 3dcd5fc540..ed8ef6a2d0 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -117,20 +117,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2500_HW_STRAP_RESERVED1)
 
-#define G220A_BMC_HW_STRAP1 (                                      \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_2ND_BOOT_WDT |                                     \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
-        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_64M_DRAM) |                       \
-        SCU_AST2500_HW_STRAP_RESERVED1)
-
 /* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
 #define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
 
@@ -635,42 +621,6 @@ static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
     /* Bus 11: TODO ucd90160@64 */
 }
 
-static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    DeviceState *dev;
-
-    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3),
-                                         "emc1413", 0x4c));
-    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
-
-    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 12),
-                                         "emc1413", 0x4c));
-    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
-
-    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 13),
-                                         "emc1413", 0x4c));
-    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
-
-    static uint8_t eeprom_buf[2 * 1024] = {
-            0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xfe,
-            0x01, 0x06, 0x00, 0xc9, 0x42, 0x79, 0x74, 0x65,
-            0x64, 0x61, 0x6e, 0x63, 0x65, 0xc5, 0x47, 0x32,
-            0x32, 0x30, 0x41, 0xc4, 0x41, 0x41, 0x42, 0x42,
-            0xc4, 0x43, 0x43, 0x44, 0x44, 0xc4, 0x45, 0x45,
-            0x46, 0x46, 0xc4, 0x48, 0x48, 0x47, 0x47, 0xc1,
-            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa7,
-    };
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x57,
-                          eeprom_buf);
-}
-
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1549,23 +1499,6 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 };
 
-static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Bytedance G220A BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = G220A_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 2;
-    amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = g220a_bmc_i2c_init;
-    mc->default_ram_size = 1024 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -1939,11 +1872,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_tiogapass_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("g220a-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_g220a_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_g220a.c b/hw/arm/aspeed_ast2500_g220a.c
new file mode 100644
index 0000000000..3f979a78e5
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_g220a.c
@@ -0,0 +1,92 @@
+/*
+ * Bytedance G220A
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+#define G220A_BMC_HW_STRAP1 (                                      \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_2ND_BOOT_WDT |                                     \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
+        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_64M_DRAM) |                       \
+        SCU_AST2500_HW_STRAP_RESERVED1)
+
+static void g220a_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    DeviceState *dev;
+
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3),
+                                         "emc1413", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 12),
+                                         "emc1413", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 13),
+                                         "emc1413", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+
+    static uint8_t eeprom_buf[2 * 1024] = {
+            0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0xfe,
+            0x01, 0x06, 0x00, 0xc9, 0x42, 0x79, 0x74, 0x65,
+            0x64, 0x61, 0x6e, 0x63, 0x65, 0xc5, 0x47, 0x32,
+            0x32, 0x30, 0x41, 0xc4, 0x41, 0x41, 0x42, 0x42,
+            0xc4, 0x43, 0x43, 0x44, 0x44, 0xc4, 0x45, 0x45,
+            0x46, 0x46, 0xc4, 0x48, 0x48, 0x47, 0x47, 0xc1,
+            0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa7,
+    };
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x57,
+                          eeprom_buf);
+}
+
+static void aspeed_machine_g220a_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Bytedance G220A BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = G220A_BMC_HW_STRAP1;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->macs_mask  = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = g220a_bmc_i2c_init;
+    mc->default_ram_size = 1024 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_g220a_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("g220a-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_g220a_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_g220a_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index ed637f2687..91bdefd203 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -45,6 +45,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
   'aspeed_ast2500_fp5280g2.c',
+  'aspeed_ast2500_g220a.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',

From 3456dc98ac3e96cc4f13fc96bc3ebe2ed3ca0283 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:45 +0800
Subject: [PATCH 1989/2396] hw/arm/aspeed: Split Tiogapass machine into a
 separate source file for cleanup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Tiogapass BMC machine implementation out of
aspeed.c into a new dedicated file aspeed_ast2500_tiogapass.c.

To support splitting Tiogapass into a dedicated source file,
a new TIOGAPASS_BMC_HW_STRAP1 macro is added as a copy of
AST2500_EVB_HW_STRAP1.

The change follows the ongoing effort to modularize Aspeed platform
support by splitting each machine definition into its own source file.
This makes aspeed.c cleaner, easier to maintain, and simplifies
future feature additions or refactoring for individual machines.

Key updates include:
- Removed tiogapass_bmc_i2c_init() and its FRU data from aspeed.c
and aspeed_eeprom.c.
- Removed Tiogapass type registration from aspeed_machine_types[].
- Added new source file aspeed_ast2500_tiogapass.c to meson.build.
- Removed unused Tiogapass FRUID declarations from aspeed_eeprom.h.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-8-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                   | 36 -------------
 hw/arm/aspeed_ast2500_tiogapass.c | 90 +++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c            | 22 --------
 hw/arm/aspeed_eeprom.h            |  4 --
 hw/arm/meson.build                |  1 +
 5 files changed, 91 insertions(+), 62 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_tiogapass.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ed8ef6a2d0..42f4203f9d 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -495,19 +495,6 @@ static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
 }
 
-static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
-    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
-                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
-    /* TMP421 */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), "tmp421", 0x1f);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp421", 0x4f);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp421", 0x4e);
-}
-
 void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
@@ -1424,24 +1411,6 @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_tiogapass_class_init(ObjectClass *oc,
-                                                const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-    amc->hw_strap2 = 0;
-    amc->fmc_model = "n25q256a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 2;
-    amc->i2c_init  = tiogapass_bmc_i2c_init;
-    mc->default_ram_size       = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
                                                  const void *data)
 {
@@ -1867,11 +1836,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_yosemitev2_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_tiogapass_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_tiogapass.c b/hw/arm/aspeed_ast2500_tiogapass.c
new file mode 100644
index 0000000000..186dbc1da3
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_tiogapass.c
@@ -0,0 +1,90 @@
+/*
+ * Facebook Tiogapass
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+
+/* value: 0xF100C2E6 */
+#define TIOGAPASS_BMC_HW_STRAP1 ((                                        \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_MAC1_RGMII |                                       \
+        SCU_HW_STRAP_MAC0_RGMII) &                                      \
+        ~SCU_HW_STRAP_2ND_BOOT_WDT)
+
+/* Tiogapass BMC FRU */
+static const uint8_t tiogapass_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
+    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
+static const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
+
+static void tiogapass_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 6), 0x54, 128 * KiB,
+                          tiogapass_bmc_fruid, tiogapass_bmc_fruid_len);
+    /* TMP421 */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), "tmp421", 0x1f);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp421", 0x4f);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp421", 0x4e);
+}
+
+static void aspeed_machine_tiogapass_class_init(ObjectClass *oc,
+                                                const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Tiogapass BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = TIOGAPASS_BMC_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = tiogapass_bmc_i2c_init;
+    mc->default_ram_size       = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_tiogapass_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("tiogapass-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_tiogapass_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_tiogapass_types)
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index 8bbbdec834..f0ced29cf1 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -7,27 +7,6 @@
 #include "qemu/osdep.h"
 #include "aspeed_eeprom.h"
 
-/* Tiogapass BMC FRU */
-const uint8_t tiogapass_bmc_fruid[] = {
-    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
-    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
-    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
-    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
-    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x54, 0x69, 0x6f, 0x67, 0x61,
-    0x20, 0x50, 0x61, 0x73, 0x73, 0x20, 0x53, 0x69, 0x6e, 0x67, 0x6c, 0x65,
-    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xc4, 0x58, 0x58, 0x58, 0x32, 0xcd, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
-    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
-};
-
 const uint8_t fby35_nic_fruid[] = {
     0x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
     0x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
@@ -181,7 +160,6 @@ const uint8_t gb200nvl_bmc_fruid[] = {
 
 };
 
-const size_t tiogapass_bmc_fruid_len = sizeof(tiogapass_bmc_fruid);
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index 3ed9bc1d9a..a9ae95940c 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -7,10 +7,6 @@
 #ifndef ASPEED_EEPROM_H
 #define ASPEED_EEPROM_H
 
-
-extern const uint8_t tiogapass_bmc_fruid[];
-extern const size_t tiogapass_bmc_fruid_len;
-
 extern const uint8_t fby35_nic_fruid[];
 extern const uint8_t fby35_bb_fruid[];
 extern const uint8_t fby35_bmc_fruid[];
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 91bdefd203..870202ce85 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -46,6 +46,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2400.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
+  'aspeed_ast2500_tiogapass.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',

From 82042b7610a6f28f8ac7ea1b37ad519010a302ac Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:46 +0800
Subject: [PATCH 1990/2396] hw/arm/aspeed: Split YosemiteV2 machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the YosemiteV2 BMC machine implementation from
aspeed.c into a new standalone file aspeed_ast2500_yosemitev2.c.

To support splitting YosemiteV2 into a dedicated source file,
a new YOSEMITEV2_BMC_HW_STRAP1 macro is added as a copy of
AST2500_EVB_HW_STRAP1.

The refactor is part of an ongoing effort to modularize Aspeed
machine definitions by separating each board into its own source
file. This improves code readability, maintainability, and simplifies
future platform-specific changes.

Key updates include:

- Moved yosemitev2_bmc_i2c_init() and its FRU data into a new file.
- Removed aspeed_machine_yosemitev2_class_init() and type registration
from aspeed.c.
- Removed YosemiteV2 FRUID data and declarations from
aspeed_eeprom.c and aspeed_eeprom.h.
- Added aspeed_ast2500_yosemitev2.c to the build system
(meson.build).

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-9-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                    | 37 ------------
 hw/arm/aspeed_ast2500_yosemitev2.c | 91 ++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c             | 22 --------
 hw/arm/aspeed_eeprom.h             |  3 -
 hw/arm/meson.build                 |  1 +
 5 files changed, 92 insertions(+), 62 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_yosemitev2.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 42f4203f9d..731ca7a1aa 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -470,20 +470,6 @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
                      TYPE_TMP105, 0x4d);
 }
 
-static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
-    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
-                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
-    /* TMP421 */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "tmp421", 0x1f);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp421", 0x4e);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp421", 0x4f);
-
-}
-
 static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1376,24 +1362,6 @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc,
-                                                 const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-    amc->hw_strap2 = 0;
-    amc->fmc_model = "n25q256a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 2;
-    amc->i2c_init  = yosemitev2_bmc_i2c_init;
-    mc->default_ram_size       = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_romulus_class_init(ObjectClass *oc,
                                               const void *data)
 {
@@ -1831,11 +1799,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_yosemitev2_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_yosemitev2.c b/hw/arm/aspeed_ast2500_yosemitev2.c
new file mode 100644
index 0000000000..eaa75bcccb
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_yosemitev2.c
@@ -0,0 +1,91 @@
+/*
+ * Facebook YosemiteV2
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+
+/* value: 0xF100C2E6 */
+#define YOSEMITEV2_BMC_HW_STRAP1 ((                                        \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_MAC1_RGMII |                                       \
+        SCU_HW_STRAP_MAC0_RGMII) &                                      \
+        ~SCU_HW_STRAP_2ND_BOOT_WDT)
+
+/* Yosemite V2 BMC FRU */
+static const uint8_t yosemitev2_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x61,
+    0x73, 0x65, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x20, 0x4d, 0x50, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
+    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x20, 0x4d, 0x50, 0x00, 0x00, 0x00,
+    0x00, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+
+static const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
+
+static void yosemitev2_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 4), 0x51, 128 * KiB);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51, 128 * KiB,
+                          yosemitev2_bmc_fruid, yosemitev2_bmc_fruid_len);
+    /* TMP421 */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "tmp421", 0x1f);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp421", 0x4e);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp421", 0x4f);
+
+}
+
+static void aspeed_machine_yosemitev2_class_init(ObjectClass *oc,
+                                                 const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook YosemiteV2 BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = YOSEMITEV2_BMC_HW_STRAP1;
+    amc->hw_strap2 = 0;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 2;
+    amc->i2c_init  = yosemitev2_bmc_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_yosemitev2_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("yosemitev2-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_yosemitev2_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_yosemitev2_types)
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index f0ced29cf1..124277eaca 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -78,27 +78,6 @@ const uint8_t fby35_bmc_fruid[] = {
     0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
 };
 
-/* Yosemite V2 BMC FRU */
-const uint8_t yosemitev2_bmc_fruid[] = {
-    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
-    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x61,
-    0x73, 0x65, 0x62, 0x6f, 0x61, 0x72, 0x64, 0x20, 0x4d, 0x50, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
-    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
-    0x69, 0x74, 0x65, 0x20, 0x56, 0x32, 0x20, 0x4d, 0x50, 0x00, 0x00, 0x00,
-    0x00, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
-    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
-};
-
 const uint8_t rainier_bb_fruid[] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
     0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
@@ -163,7 +142,6 @@ const uint8_t gb200nvl_bmc_fruid[] = {
 const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
 const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
 const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
-const size_t yosemitev2_bmc_fruid_len = sizeof(yosemitev2_bmc_fruid);
 const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
 const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
 const size_t gb200nvl_bmc_fruid_len = sizeof(gb200nvl_bmc_fruid);
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index a9ae95940c..5448eeeab7 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -14,9 +14,6 @@ extern const size_t fby35_nic_fruid_len;
 extern const size_t fby35_bb_fruid_len;
 extern const size_t fby35_bmc_fruid_len;
 
-extern const uint8_t yosemitev2_bmc_fruid[];
-extern const size_t yosemitev2_bmc_fruid_len;
-
 extern const uint8_t rainier_bb_fruid[];
 extern const size_t rainier_bb_fruid_len;
 extern const uint8_t rainier_bmc_fruid[];
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 870202ce85..8d9f1e1609 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -47,6 +47,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_tiogapass.c',
+  'aspeed_ast2500_yosemitev2.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',

From 329949c1003b45d6fc88301461b4a68dfb485b46 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:47 +0800
Subject: [PATCH 1991/2396] hw/arm/aspeed: Split Witherspoon machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Witherspoon BMC machine implementation out of
aspeed.c and into a new dedicated file aspeed_ast2500_witherspoon.c.

To support splitting Witherspoon into a dedicated source file,
a new WITHERSPOON_BMC_HW_STRAP1 macro is added as a copy of
ROMULUS_BMC_HW_STRAP1.

The change is part of a broader effort to modularize Aspeed board
definitions, allowing each machine type to be maintained and updated
independently. By isolating Witherspoon logic, the aspeed.c file
becomes cleaner and easier to manage as more platforms are added.

Key updates include:

- Moved witherspoon_bmc_i2c_init() and related LED setup code into
aspeed_ast2500_witherspoon.c.
- Added WITHERSPOON_BMC_HW_STRAP1 replacement macro for local use.
- Removed aspeed_machine_witherspoon_class_init() and type
registration from aspeed.c.
- Added the new file to meson.build for compilation.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-10-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                     |  82 --------------------
 hw/arm/aspeed_ast2500_witherspoon.c | 112 ++++++++++++++++++++++++++++
 hw/arm/meson.build                  |   1 +
 3 files changed, 113 insertions(+), 82 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_witherspoon.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 731ca7a1aa..74eb8077da 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -117,9 +117,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2500_HW_STRAP_RESERVED1)
 
-/* Witherspoon hardware value: 0xF10AD216 (but use romulus definition) */
-#define WITHERSPOON_BMC_HW_STRAP1 ROMULUS_BMC_HW_STRAP1
-
 /* Quanta-Q71l hardware value */
 #define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
         SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
@@ -537,63 +534,6 @@ static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
 
 }
 
-static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    static const struct {
-        unsigned gpio_id;
-        LEDColor color;
-        const char *description;
-        bool gpio_polarity;
-    } pca1_leds[] = {
-        {13, LED_COLOR_GREEN, "front-fault-4",  GPIO_POLARITY_ACTIVE_LOW},
-        {14, LED_COLOR_GREEN, "front-power-3",  GPIO_POLARITY_ACTIVE_LOW},
-        {15, LED_COLOR_GREEN, "front-id-5",     GPIO_POLARITY_ACTIVE_LOW},
-    };
-    AspeedSoCState *soc = bmc->soc;
-    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-    DeviceState *dev;
-    LEDState *led;
-
-    /* Bus 3: TODO bmp280@77 */
-    dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
-    qdev_prop_set_string(dev, "description", "pca1");
-    i2c_slave_realize_and_unref(I2C_SLAVE(dev),
-                                aspeed_i2c_get_bus(&soc->i2c, 3),
-                                &error_fatal);
-
-    for (size_t i = 0; i < ARRAY_SIZE(pca1_leds); i++) {
-        led = led_create_simple(OBJECT(bmc),
-                                pca1_leds[i].gpio_polarity,
-                                pca1_leds[i].color,
-                                pca1_leds[i].description);
-        qdev_connect_gpio_out(dev, pca1_leds[i].gpio_id,
-                              qdev_get_gpio_in(DEVICE(led), 0));
-    }
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "dps310", 0x76);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "max31785", 0x52);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "tmp423", 0x4c);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), "tmp423", 0x4c);
-
-    /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), TYPE_TMP105,
-                     0x4a);
-
-    /*
-     * The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
-     * good enough
-     */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
-
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 11), 0x51,
-                          eeprom_buf);
-    dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
-    qdev_prop_set_string(dev, "description", "pca0");
-    i2c_slave_realize_and_unref(I2C_SLAVE(dev),
-                                aspeed_i2c_get_bus(&soc->i2c, 11),
-                                &error_fatal);
-    /* Bus 11: TODO ucd90160@64 */
-}
-
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1397,23 +1337,6 @@ static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_witherspoon_class_init(ObjectClass *oc,
-                                                  const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "OpenPOWER Witherspoon BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = WITHERSPOON_BMC_HW_STRAP1;
-    amc->fmc_model = "mx25l25635f";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->i2c_init  = witherspoon_bmc_i2c_init;
-    mc->default_ram_size = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1789,11 +1712,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_sonorapass_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("witherspoon-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_witherspoon_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_witherspoon.c b/hw/arm/aspeed_ast2500_witherspoon.c
new file mode 100644
index 0000000000..28d437fec0
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_witherspoon.c
@@ -0,0 +1,112 @@
+/*
+ * OpenPOWER Witherspoon
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/misc/led.h"
+#include "hw/sensor/tmp105.h"
+#include "hw/i2c/smbus_eeprom.h"
+#include "hw/gpio/pca9552.h"
+
+/* Witherspoon hardware value: 0xF10AD216 */
+#define WITHERSPOON_BMC_HW_STRAP1 (                                     \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
+
+static void witherspoon_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    static const struct {
+        unsigned gpio_id;
+        LEDColor color;
+        const char *description;
+        bool gpio_polarity;
+    } pca1_leds[] = {
+        {13, LED_COLOR_GREEN, "front-fault-4",  GPIO_POLARITY_ACTIVE_LOW},
+        {14, LED_COLOR_GREEN, "front-power-3",  GPIO_POLARITY_ACTIVE_LOW},
+        {15, LED_COLOR_GREEN, "front-id-5",     GPIO_POLARITY_ACTIVE_LOW},
+    };
+    AspeedSoCState *soc = bmc->soc;
+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
+    DeviceState *dev;
+    LEDState *led;
+
+    /* Bus 3: TODO bmp280@77 */
+    dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
+    qdev_prop_set_string(dev, "description", "pca1");
+    i2c_slave_realize_and_unref(I2C_SLAVE(dev),
+                                aspeed_i2c_get_bus(&soc->i2c, 3),
+                                &error_fatal);
+
+    for (size_t i = 0; i < ARRAY_SIZE(pca1_leds); i++) {
+        led = led_create_simple(OBJECT(bmc),
+                                pca1_leds[i].gpio_polarity,
+                                pca1_leds[i].color,
+                                pca1_leds[i].description);
+        qdev_connect_gpio_out(dev, pca1_leds[i].gpio_id,
+                              qdev_get_gpio_in(DEVICE(led), 0));
+    }
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "dps310", 0x76);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 3), "max31785", 0x52);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), "tmp423", 0x4c);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), "tmp423", 0x4c);
+
+    /* The Witherspoon expects a TMP275 but a TMP105 is compatible */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), TYPE_TMP105,
+                     0x4a);
+
+    /*
+     * The witherspoon board expects Epson RX8900 I2C RTC but a ds1338 is
+     * good enough
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 11), 0x51,
+                          eeprom_buf);
+    dev = DEVICE(i2c_slave_new(TYPE_PCA9552, 0x60));
+    qdev_prop_set_string(dev, "description", "pca0");
+    i2c_slave_realize_and_unref(I2C_SLAVE(dev),
+                                aspeed_i2c_get_bus(&soc->i2c, 11),
+                                &error_fatal);
+    /* Bus 11: TODO ucd90160@64 */
+}
+
+static void aspeed_machine_witherspoon_class_init(ObjectClass *oc,
+                                                  const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "OpenPOWER Witherspoon BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = WITHERSPOON_BMC_HW_STRAP1;
+    amc->fmc_model = "mx25l25635f";
+    amc->spi_model = "mx66l1g45g";
+    amc->num_cs    = 2;
+    amc->i2c_init  = witherspoon_bmc_i2c_init;
+    mc->default_ram_size = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_witherspoon_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("witherspoon-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_witherspoon_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_witherspoon_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 8d9f1e1609..c235c8aed3 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -47,6 +47,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_tiogapass.c',
+  'aspeed_ast2500_witherspoon.c',
   'aspeed_ast2500_yosemitev2.c',
   'aspeed_ast2600.c',
   'aspeed_ast10x0.c',

From a3dcf633584b50842b965e4f4896ee0e05e6eb85 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:48 +0800
Subject: [PATCH 1992/2396] hw/arm/aspeed: Split Sonorapass machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Sonorapass BMC machine implementation out of
aspeed.c and into a new standalone file aspeed_ast2500_sonorapass.c.

The refactor continues the effort to modularize Aspeed platform support
by separating each board’s implementation into its own source file.
This improves maintainability, readability, and simplifies future
updates to individual machine configurations.

Key updates include:
- Moved SONORAPASS_BMC_HW_STRAP1 definition into the new file.
- Moved sonorapass_bmc_i2c_init() and all I²C device initialization
logic from aspeed.c into aspeed_ast2500_sonorapass.c.
- Moved aspeed_machine_sonorapass_class_init() and type registration
into the new file.
- Added the new file to the build system (meson.build).
- Removed all Sonorapass-specific code and definitions from aspeed.c

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-11-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                    |  82 -----------------------
 hw/arm/aspeed_ast2500_sonorapass.c | 102 +++++++++++++++++++++++++++++
 hw/arm/meson.build                 |   1 +
 3 files changed, 103 insertions(+), 82 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_sonorapass.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 74eb8077da..df1a37ca3d 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -102,21 +102,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
         SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
 
-/* Sonorapass hardware value: 0xF100D216 */
-#define SONORAPASS_BMC_HW_STRAP1 (                                      \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
-        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
-        SCU_HW_STRAP_VGA_BIOS_ROM |                                     \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2500_HW_STRAP_RESERVED1)
-
 /* Quanta-Q71l hardware value */
 #define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
         SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
@@ -490,50 +475,6 @@ I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
                             TYPE_PCA9554, addr);
 }
 
-static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /* bus 2 : */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x49);
-    /* bus 2 : pca9546 @ 0x73 */
-
-    /* bus 3 : pca9548 @ 0x70 */
-
-    /* bus 4 : */
-    uint8_t *eeprom4_54 = g_malloc0(8 * 1024);
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54,
-                          eeprom4_54);
-    /* PCA9539 @ 0x76, but PCA9552 is compatible */
-    aspeed_create_pca9552(soc, 4, 0x76);
-    /* PCA9539 @ 0x77, but PCA9552 is compatible */
-    aspeed_create_pca9552(soc, 4, 0x77);
-
-    /* bus 6 : */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x49);
-    /* bus 6 : pca9546 @ 0x73 */
-
-    /* bus 8 : */
-    uint8_t *eeprom8_56 = g_malloc0(8 * 1024);
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 8), 0x56,
-                          eeprom8_56);
-    aspeed_create_pca9552(soc, 8, 0x60);
-    aspeed_create_pca9552(soc, 8, 0x61);
-    /* bus 8 : adc128d818 @ 0x1d */
-    /* bus 8 : adc128d818 @ 0x1f */
-
-    /*
-     * bus 13 : pca9548 @ 0x71
-     *      - channel 3:
-     *          - tmm421 @ 0x4c
-     *          - tmp421 @ 0x4e
-     *          - tmp421 @ 0x4f
-     */
-
-}
-
 static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1319,24 +1260,6 @@ static void aspeed_machine_romulus_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
-                                                 const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "OCP SonoraPass BMC (ARM1176)";
-    mc->deprecation_reason = "use 'ast2500-evb' instead";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = SONORAPASS_BMC_HW_STRAP1;
-    amc->fmc_model = "mx66l1g45g";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->i2c_init  = sonorapass_bmc_i2c_init;
-    mc->default_ram_size       = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1707,11 +1630,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_romulus_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("sonorapass-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_sonorapass_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_sonorapass.c b/hw/arm/aspeed_ast2500_sonorapass.c
new file mode 100644
index 0000000000..84de4f56b3
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_sonorapass.c
@@ -0,0 +1,102 @@
+/*
+ * OCP SonoraPass
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+/* Sonorapass hardware value: 0xF100D216 */
+#define SONORAPASS_BMC_HW_STRAP1 (                                      \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_RESERVED28 |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER) |                \
+        SCU_AST2500_HW_STRAP_SET_AXI_AHB_RATIO(AXI_AHB_RATIO_2_1) |     \
+        SCU_HW_STRAP_VGA_BIOS_ROM |                                     \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+        SCU_AST2500_HW_STRAP_RESERVED1)
+
+static void sonorapass_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    /* bus 2 : */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "tmp105", 0x49);
+    /* bus 2 : pca9546 @ 0x73 */
+
+    /* bus 3 : pca9548 @ 0x70 */
+
+    /* bus 4 : */
+    uint8_t *eeprom4_54 = g_malloc0(8 * 1024);
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 4), 0x54,
+                          eeprom4_54);
+    /* PCA9539 @ 0x76, but PCA9552 is compatible */
+    aspeed_create_pca9552(soc, 4, 0x76);
+    /* PCA9539 @ 0x77, but PCA9552 is compatible */
+    aspeed_create_pca9552(soc, 4, 0x77);
+
+    /* bus 6 : */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), "tmp105", 0x49);
+    /* bus 6 : pca9546 @ 0x73 */
+
+    /* bus 8 : */
+    uint8_t *eeprom8_56 = g_malloc0(8 * 1024);
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 8), 0x56,
+                          eeprom8_56);
+    aspeed_create_pca9552(soc, 8, 0x60);
+    aspeed_create_pca9552(soc, 8, 0x61);
+    /* bus 8 : adc128d818 @ 0x1d */
+    /* bus 8 : adc128d818 @ 0x1f */
+
+    /*
+     * bus 13 : pca9548 @ 0x71
+     *      - channel 3:
+     *          - tmm421 @ 0x4c
+     *          - tmp421 @ 0x4e
+     *          - tmp421 @ 0x4f
+     */
+
+}
+
+static void aspeed_machine_sonorapass_class_init(ObjectClass *oc,
+                                                 const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "OCP SonoraPass BMC (ARM1176)";
+    mc->deprecation_reason = "use 'ast2500-evb' instead";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = SONORAPASS_BMC_HW_STRAP1;
+    amc->fmc_model = "mx66l1g45g";
+    amc->spi_model = "mx66l1g45g";
+    amc->num_cs    = 2;
+    amc->i2c_init  = sonorapass_bmc_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_sonorapass_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("sonorapass-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_sonorapass_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_sonorapass_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index c235c8aed3..f59bfe5029 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -46,6 +46,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2400.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
+  'aspeed_ast2500_sonorapass.c',
   'aspeed_ast2500_tiogapass.c',
   'aspeed_ast2500_witherspoon.c',
   'aspeed_ast2500_yosemitev2.c',

From 1a1f476b74e6d42bbf9c7f57a5e755ffc83785a5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:49 +0800
Subject: [PATCH 1993/2396] hw/arm/aspeed: Split Romulus machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Romulus BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2500_romulus.c.

The refactor continues the modularization of Aspeed platform
definitions, separating each board into its own C source file to
improve maintainability, readability, and reduce code clutter in
aspeed.c.

Key updates include:
- Moved ROMULUS_BMC_HW_STRAP1 definition to the new file.
- Moved romulus_bmc_i2c_init() and related I²C device setup.
- Moved aspeed_machine_romulus_class_init() and type registration
to aspeed_ast2500_romulus.c.
- Added the new file to the build system (meson.build).
- Removed all Romulus-specific code from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-12-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                 | 43 -----------------------
 hw/arm/aspeed_ast2500_romulus.c | 62 +++++++++++++++++++++++++++++++++
 hw/arm/meson.build              |  1 +
 3 files changed, 63 insertions(+), 43 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_romulus.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index df1a37ca3d..c31b281f55 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -92,16 +92,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_MAC0_RGMII) &                                      \
         ~SCU_HW_STRAP_2ND_BOOT_WDT)
 
-/* Romulus hardware value: 0xF10AD206 */
-#define ROMULUS_BMC_HW_STRAP1 (                                         \
-        AST2500_HW_STRAP1_DEFAULTS |                                    \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
-
 /* Quanta-Q71l hardware value */
 #define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
         SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
@@ -452,17 +442,6 @@ static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
                      TYPE_TMP105, 0x4d);
 }
 
-static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /*
-     * The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
-     * good enough
-     */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
-}
-
 void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
@@ -1243,23 +1222,6 @@ static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_romulus_class_init(ObjectClass *oc,
-                                              const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "OpenPOWER Romulus BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = ROMULUS_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q256a";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->i2c_init  = romulus_bmc_i2c_init;
-    mc->default_ram_size       = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1625,11 +1587,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2500_evb_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("romulus-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_romulus_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_romulus.c b/hw/arm/aspeed_ast2500_romulus.c
new file mode 100644
index 0000000000..91b660e74b
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_romulus.c
@@ -0,0 +1,62 @@
+/*
+ * OpenPOWER Romulus
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+
+/* Romulus hardware value: 0xF10AD206 */
+#define ROMULUS_BMC_HW_STRAP1 (                                         \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_AST2500_HW_STRAP_ACPI_ENABLE |                              \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_MASTER))
+
+static void romulus_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    /*
+     * The romulus board expects Epson RX8900 I2C RTC but a ds1338 is
+     * good enough
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), "ds1338", 0x32);
+}
+
+static void aspeed_machine_romulus_class_init(ObjectClass *oc,
+                                              const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "OpenPOWER Romulus BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = ROMULUS_BMC_HW_STRAP1;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx66l1g45g";
+    amc->num_cs    = 2;
+    amc->i2c_init  = romulus_bmc_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_romulus_types[] = {
+     {
+        .name          = MACHINE_TYPE_NAME("romulus-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_romulus_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_romulus_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index f59bfe5029..ff6a856523 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -46,6 +46,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2400.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
+  'aspeed_ast2500_romulus.c',
   'aspeed_ast2500_sonorapass.c',
   'aspeed_ast2500_tiogapass.c',
   'aspeed_ast2500_witherspoon.c',

From 4121d4ee74fe27e0e7f55e6f39c04c6fcf1e76f1 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:50 +0800
Subject: [PATCH 1994/2396] hw/arm/aspeed: Split Supermicro X11SPI machine into
 a separate file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Supermicro X11SPI BMC machine definition from
aspeed.c into a new standalone file aspeed_ast2500_supermicro-x11spi.c,
and adds a dedicated I²C initialization function for the platform.

The refactor continues the effort to modularize Aspeed platform support,
ensuring each machine model is defined in its own source file. This improves
code organization, readability, and simplifies maintenance when adding or
modifying platform-specific behavior.

Previously, the Supermicro X11SPI machine reused
palmetto_bmc_i2c_init() for its I²C setup. To make the machine
definition fully self-contained, the function was copied and renamed
to supermicro_x11spi_bmc_i2c_init(). This ensures that the machine
can evolve independently without depending on Palmetto’s board logi

Key updates include:
- Moved SUPERMICRO_X11SPI_BMC_HW_STRAP1 macro and machine class init
(aspeed_machine_supermicro_x11spi_bmc_class_init) into a new file.
- Added new function supermicro_x11spi_bmc_i2c_init() copied from
palmetto_bmc_i2c_init() for independent control.
- Updated the machine definition to use the new I²C init function.
- Registered the new source file in meson.build.
- Removed all Supermicro X11SPI-related definitions from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-13-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                           | 33 ----------
 hw/arm/aspeed_ast2500_supermicro-x11spi.c | 77 +++++++++++++++++++++++
 hw/arm/meson.build                        |  1 +
 3 files changed, 78 insertions(+), 33 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_supermicro-x11spi.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index c31b281f55..e1fa95b2c3 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -71,16 +71,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
 
-/* TODO: Find the actual hardware value */
-#define SUPERMICRO_X11SPI_BMC_HW_STRAP1 (                               \
-        AST2500_HW_STRAP1_DEFAULTS |                                    \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_SPI_WIDTH |                                        \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN))
-
 /* AST2500 evb hardware value: 0xF100C2E6 */
 #define AST2500_EVB_HW_STRAP1 ((                                        \
         AST2500_HW_STRAP1_DEFAULTS |                                    \
@@ -1187,24 +1177,6 @@ static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
-static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
-                                                            const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Supermicro X11 SPI BMC (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = SUPERMICRO_X11SPI_BMC_HW_STRAP1;
-    amc->fmc_model = "mx25l25635e";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 1;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->default_ram_size = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1577,11 +1549,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("supermicro-x11spi-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_supermicro_x11spi_bmc_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2500-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_supermicro-x11spi.c b/hw/arm/aspeed_ast2500_supermicro-x11spi.c
new file mode 100644
index 0000000000..a2450aa962
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_supermicro-x11spi.c
@@ -0,0 +1,77 @@
+/*
+ * Supermicro X11 SPI
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+/* TODO: Find the actual hardware value */
+#define SUPERMICRO_X11SPI_BMC_HW_STRAP1 (                               \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_SPI_WIDTH |                                        \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN))
+
+static void supermicro_x11spi_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    DeviceState *dev;
+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
+
+    /*
+     * The palmetto platform expects a ds3231 RTC but a ds1338 is
+     * enough to provide basic RTC features. Alarms will be missing
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
+                          eeprom_buf);
+
+    /* add a TMP423 temperature sensor */
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
+                                         "tmp423", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature3", 110000, &error_abort);
+}
+
+static void aspeed_machine_supermicro_x11spi_bmc_class_init(ObjectClass *oc,
+                                                            const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Supermicro X11 SPI BMC (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = SUPERMICRO_X11SPI_BMC_HW_STRAP1;
+    amc->fmc_model = "mx25l25635e";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = supermicro_x11spi_bmc_i2c_init;
+    mc->default_ram_size = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast2500_supermicro_x11spi_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("supermicro-x11spi-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_supermicro_x11spi_bmc_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_supermicro_x11spi_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index ff6a856523..76a456c33f 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -48,6 +48,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_romulus.c',
   'aspeed_ast2500_sonorapass.c',
+  'aspeed_ast2500_supermicro-x11spi.c',
   'aspeed_ast2500_tiogapass.c',
   'aspeed_ast2500_witherspoon.c',
   'aspeed_ast2500_yosemitev2.c',

From cd311b2f3a004b622bc60bccbb3c234da48fd42e Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:51 +0800
Subject: [PATCH 1995/2396] hw/arm/aspeed: Split AST2500 EVB machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the AST2500 EVB machine implementation out of
aspeed.c into a new standalone file aspeed_ast2500_evb.c.

This refactor continues the modularization effort for Aspeed platform
support, placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future
development for new platforms without cluttering aspeed.c.

Key updates include:

- Moved AST2500_EVB_HW_STRAP1 macro definition into the new file.
- Moved ast2500_evb_i2c_init() I²C initialization logic.
- Moved aspeed_machine_ast2500_evb_class_init() and type registration.
- Added aspeed_ast2500_evb.c to the build system (meson.build).
- Removed all AST2500 EVB–specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-14-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 46 -------------------------
 hw/arm/aspeed_ast2500_evb.c | 67 +++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |  1 +
 3 files changed, 68 insertions(+), 46 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2500_evb.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index e1fa95b2c3..7d26d9241c 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -71,17 +71,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
 
-/* AST2500 evb hardware value: 0xF100C2E6 */
-#define AST2500_EVB_HW_STRAP1 ((                                        \
-        AST2500_HW_STRAP1_DEFAULTS |                                    \
-        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
-        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
-        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
-        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
-        SCU_HW_STRAP_MAC1_RGMII |                                       \
-        SCU_HW_STRAP_MAC0_RGMII) &                                      \
-        ~SCU_HW_STRAP_2ND_BOOT_WDT)
-
 /* Quanta-Q71l hardware value */
 #define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
         SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
@@ -406,19 +395,6 @@ static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
     /* TODO: i2c-8: Add BMC FRU eeprom@50 */
 }
 
-static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 3), 0x50,
-                          eeprom_buf);
-
-    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
-                     TYPE_TMP105, 0x4d);
-}
-
 static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1177,23 +1153,6 @@ static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
-static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
-                                                  const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Aspeed AST2500 EVB (ARM1176)";
-    amc->soc_name  = "ast2500-a1";
-    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
-    amc->fmc_model = "mx25l25635e";
-    amc->spi_model = "mx25l25635f";
-    amc->num_cs    = 1;
-    amc->i2c_init  = ast2500_evb_i2c_init;
-    mc->default_ram_size       = 512 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1549,11 +1508,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("ast2500-evb"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_ast2500_evb_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2500_evb.c b/hw/arm/aspeed_ast2500_evb.c
new file mode 100644
index 0000000000..8b5cb67be9
--- /dev/null
+++ b/hw/arm/aspeed_ast2500_evb.c
@@ -0,0 +1,67 @@
+/*
+ * ASPEED AST2500 EVB
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+#include "hw/sensor/tmp105.h"
+
+/* AST2500 evb hardware value: 0xF100C2E6 */
+#define AST2500_EVB_HW_STRAP1 ((                                        \
+        AST2500_HW_STRAP1_DEFAULTS |                                    \
+        SCU_AST2500_HW_STRAP_SPI_AUTOFETCH_ENABLE |                     \
+        SCU_AST2500_HW_STRAP_GPIO_STRAP_ENABLE |                        \
+        SCU_AST2500_HW_STRAP_UART_DEBUG |                               \
+        SCU_AST2500_HW_STRAP_DDR4_ENABLE |                              \
+        SCU_HW_STRAP_MAC1_RGMII |                                       \
+        SCU_HW_STRAP_MAC0_RGMII) &                                      \
+        ~SCU_HW_STRAP_2ND_BOOT_WDT)
+
+static void ast2500_evb_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 3), 0x50,
+                          eeprom_buf);
+
+    /* The AST2500 EVB expects a LM75 but a TMP105 is compatible */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
+                     TYPE_TMP105, 0x4d);
+}
+
+static void aspeed_machine_ast2500_evb_class_init(ObjectClass *oc,
+                                                  const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Aspeed AST2500 EVB (ARM1176)";
+    amc->soc_name  = "ast2500-a1";
+    amc->hw_strap1 = AST2500_EVB_HW_STRAP1;
+    amc->fmc_model = "mx25l25635e";
+    amc->spi_model = "mx25l25635f";
+    amc->num_cs    = 1;
+    amc->i2c_init  = ast2500_evb_i2c_init;
+    mc->default_ram_size       = 512 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2500_evb_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("ast2500-evb"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_ast2500_evb_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2500_evb_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 76a456c33f..021daba286 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -44,6 +44,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed.c',
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
+  'aspeed_ast2500_evb.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',
   'aspeed_ast2500_romulus.c',

From 7f162fe291c8c5063cbf0b74522d6d15d2dbf70b Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:52 +0800
Subject: [PATCH 1996/2396] hw/arm/aspeed: Split Quanta-Q71L machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Quanta-Q71L BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2400_quanta-q71l.c.

This refactor continues the modularization effort for Aspeed platform
support, placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future
development for new platforms without cluttering aspeed.c

Key updates include:

- Moved QUANTA_Q71L_BMC_HW_STRAP1 macro definition into the new file.
- Moved quanta_q71l_bmc_i2c_init() I²C initialization logic into the new file.
- Moved aspeed_machine_quanta_q71l_class_init() and type registration.
- Added aspeed_ast2400_quanta-q71l.c to the build system (meson.build).
- Removed all Quanta-Q71L–specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-15-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                     | 67 ----------------------
 hw/arm/aspeed_ast2400_quanta-q71l.c | 86 +++++++++++++++++++++++++++++
 hw/arm/meson.build                  |  1 +
 3 files changed, 87 insertions(+), 67 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2400_quanta-q71l.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 7d26d9241c..f9e6d8c4c6 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -71,19 +71,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
 
-/* Quanta-Q71l hardware value */
-#define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
-        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
-        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2/* DDR3 with CL=6, CWL=5 */) | \
-        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
-        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_24M_IN) |       \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_PASS_THROUGH) |          \
-        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
-        SCU_HW_STRAP_SPI_WIDTH |                                        \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_8M_DRAM) |                        \
-        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
-
 /* AST2600 evb hardware value */
 #define AST2600_EVB_HW_STRAP1 0x000000C0
 #define AST2600_EVB_HW_STRAP2 0x00000003
@@ -363,38 +350,6 @@ static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
     object_property_set_int(OBJECT(dev), "temperature3", 110000, &error_abort);
 }
 
-static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /*
-     * The quanta-q71l platform expects tmp75s which are compatible with
-     * tmp105s.
-     */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4c);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4e);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4f);
-
-    /* TODO: i2c-1: Add baseboard FRU eeprom@54 24c64 */
-    /* TODO: i2c-1: Add Frontpanel FRU eeprom@57 24c64 */
-    /* TODO: Add Memory Riser i2c mux and eeproms. */
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "pca9546", 0x74);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "pca9548", 0x77);
-
-    /* TODO: i2c-3: Add BIOS FRU eeprom@56 24c64 */
-
-    /* i2c-7 */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "pca9546", 0x70);
-    /*        - i2c@0: pmbus@59 */
-    /*        - i2c@1: pmbus@58 */
-    /*        - i2c@2: pmbus@58 */
-    /*        - i2c@3: pmbus@59 */
-
-    /* TODO: i2c-7: Add PDB FRU eeprom@52 */
-    /* TODO: i2c-8: Add BMC FRU eeprom@50 */
-}
-
 static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1118,23 +1073,6 @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc,
-                                                  const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Quanta-Q71l BMC (ARM926EJ-S)";
-    amc->soc_name  = "ast2400-a1";
-    amc->hw_strap1 = QUANTA_Q71L_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q256a";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 1;
-    amc->i2c_init  = quanta_q71l_bmc_i2c_init;
-    mc->default_ram_size       = 128 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
                                                         const void *data)
 {
@@ -1523,11 +1461,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_firework_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("quanta-q71l-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_quanta_q71l_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("rainier-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2400_quanta-q71l.c b/hw/arm/aspeed_ast2400_quanta-q71l.c
new file mode 100644
index 0000000000..42ad2a2303
--- /dev/null
+++ b/hw/arm/aspeed_ast2400_quanta-q71l.c
@@ -0,0 +1,86 @@
+/*
+ * Quanta Q71l
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+
+/* Quanta-Q71l hardware value */
+#define QUANTA_Q71L_BMC_HW_STRAP1 (                                     \
+        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
+        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2/* DDR3 with CL=6, CWL=5 */) | \
+        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
+        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_24M_IN) |       \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_PASS_THROUGH) |          \
+        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
+        SCU_HW_STRAP_SPI_WIDTH |                                        \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_8M_DRAM) |                        \
+        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+
+static void quanta_q71l_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    /*
+     * The quanta-q71l platform expects tmp75s which are compatible with
+     * tmp105s.
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4c);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4e);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4f);
+
+    /* TODO: i2c-1: Add baseboard FRU eeprom@54 24c64 */
+    /* TODO: i2c-1: Add Frontpanel FRU eeprom@57 24c64 */
+    /* TODO: Add Memory Riser i2c mux and eeproms. */
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "pca9546", 0x74);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2), "pca9548", 0x77);
+
+    /* TODO: i2c-3: Add BIOS FRU eeprom@56 24c64 */
+
+    /* i2c-7 */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "pca9546", 0x70);
+    /*        - i2c@0: pmbus@59 */
+    /*        - i2c@1: pmbus@58 */
+    /*        - i2c@2: pmbus@58 */
+    /*        - i2c@3: pmbus@59 */
+
+    /* TODO: i2c-7: Add PDB FRU eeprom@52 */
+    /* TODO: i2c-8: Add BMC FRU eeprom@50 */
+}
+
+static void aspeed_machine_quanta_q71l_class_init(ObjectClass *oc,
+                                                  const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Quanta-Q71l BMC (ARM926EJ-S)";
+    amc->soc_name  = "ast2400-a1";
+    amc->hw_strap1 = QUANTA_Q71L_BMC_HW_STRAP1;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 1;
+    amc->i2c_init  = quanta_q71l_bmc_i2c_init;
+    mc->default_ram_size       = 128 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast2400_quanta_q71l_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("quanta-q71l-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_quanta_q71l_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2400_quanta_q71l_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 021daba286..5467ee673d 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -44,6 +44,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed.c',
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
+  'aspeed_ast2400_quanta-q71l.c',
   'aspeed_ast2500_evb.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',

From f919ccc7e0f899e2c432ba279041c9b5c489dd7c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:53 +0800
Subject: [PATCH 1997/2396] hw/arm/aspeed: Split Supermicro X11 machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Supermicro X11 BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2400_supermicrox11.c and
removes its dependency on the Palmetto platform’s I²C initialization.

This refactor continues the modularization effort for Aspeed platform support,
ensuring that each board’s configuration resides in its own dedicated source file.
By duplicating and renaming the palmetto_bmc_i2c_init() logic into
supermicrox11_bmc_i2c_init(), this change removes unwanted coupling between
the two board definitions.

Key updates include:
- Moved SUPERMICROX11_BMC_HW_STRAP1 macro definition into a new file.
- Moved aspeed_machine_supermicrox11_bmc_class_init() and type registration into a new file.
- Added a dedicated supermicrox11_bmc_i2c_init() function (copied and renamed from Palmetto’s version).
- Added the new file aspeed_ast2400_supermicrox11.c to the build system (meson.build).
- Removed all Supermicro X11–specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-16-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                       | 37 ------------
 hw/arm/aspeed_ast2400_supermicrox11.c | 81 +++++++++++++++++++++++++++
 hw/arm/meson.build                    |  1 +
 3 files changed, 82 insertions(+), 37 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2400_supermicrox11.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index f9e6d8c4c6..fbd27020bd 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -57,20 +57,6 @@ static struct arm_boot_info aspeed_board_binfo = {
         SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
         SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
 
-/* TODO: Find the actual hardware value */
-#define SUPERMICROX11_BMC_HW_STRAP1 (                                   \
-        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
-        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2) |                           \
-        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
-        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
-        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
-        SCU_HW_STRAP_SPI_WIDTH |                                        \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
-
 /* AST2600 evb hardware value */
 #define AST2600_EVB_HW_STRAP1 0x000000C0
 #define AST2600_EVB_HW_STRAP2 0x00000003
@@ -1073,24 +1059,6 @@ static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
-                                                        const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Supermicro X11 BMC (ARM926EJ-S)";
-    amc->soc_name  = "ast2400-a1";
-    amc->hw_strap1 = SUPERMICROX11_BMC_HW_STRAP1;
-    amc->fmc_model = "mx25l25635e";
-    amc->spi_model = "mx25l25635e";
-    amc->num_cs    = 1;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->default_ram_size = 256 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1441,11 +1409,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_palmetto_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("supermicrox11-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2400_supermicrox11.c b/hw/arm/aspeed_ast2400_supermicrox11.c
new file mode 100644
index 0000000000..88cdb01fc7
--- /dev/null
+++ b/hw/arm/aspeed_ast2400_supermicrox11.c
@@ -0,0 +1,81 @@
+/*
+ * Supermicro X11
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+/* TODO: Find the actual hardware value */
+#define SUPERMICROX11_BMC_HW_STRAP1 (                                   \
+        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_128MB) |               \
+        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2) |                           \
+        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
+        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
+        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
+        SCU_HW_STRAP_SPI_WIDTH |                                        \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+
+static void supermicrox11_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    DeviceState *dev;
+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
+
+    /*
+     * The palmetto platform expects a ds3231 RTC but a ds1338 is
+     * enough to provide basic RTC features. Alarms will be missing
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
+                          eeprom_buf);
+
+    /* add a TMP423 temperature sensor */
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
+                                         "tmp423", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature3", 110000, &error_abort);
+}
+
+static void aspeed_machine_supermicrox11_bmc_class_init(ObjectClass *oc,
+                                                        const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Supermicro X11 BMC (ARM926EJ-S)";
+    amc->soc_name  = "ast2400-a1";
+    amc->hw_strap1 = SUPERMICROX11_BMC_HW_STRAP1;
+    amc->fmc_model = "mx25l25635e";
+    amc->spi_model = "mx25l25635e";
+    amc->num_cs    = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = supermicrox11_bmc_i2c_init;
+    mc->default_ram_size = 256 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast2400_supermicrox11_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("supermicrox11-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_supermicrox11_bmc_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2400_supermicrox11_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 5467ee673d..ea2d24af88 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -45,6 +45,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
   'aspeed_ast2400_quanta-q71l.c',
+  'aspeed_ast2400_supermicrox11.c',
   'aspeed_ast2500_evb.c',
   'aspeed_ast2500_fp5280g2.c',
   'aspeed_ast2500_g220a.c',

From 671c26a7d4109f7dd6f5c055f593ac3f3a5fcb93 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:54 +0800
Subject: [PATCH 1998/2396] hw/arm/aspeed: Split Palmetto machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the OpenPOWER Palmetto BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2400_palmetto.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future development for
new platforms without cluttering aspeed.c.

Key updates include:
- Moved PALMETTO_BMC_HW_STRAP1 macro definition from into the new file.
- Moved palmetto_bmc_i2c_init() I²C initialization logic into the new file.
- Moved aspeed_machine_palmetto_class_init() and type registration.
- Added aspeed_ast2400_palmetto.c to the build system (meson.build).
- Removed all Palmetto-specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-17-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                  | 60 ------------------------
 hw/arm/aspeed_ast2400_palmetto.c | 80 ++++++++++++++++++++++++++++++++
 hw/arm/meson.build               |  1 +
 3 files changed, 81 insertions(+), 60 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2400_palmetto.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index fbd27020bd..15d3b045ac 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -43,20 +43,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define ASPEED_RAM_SIZE(sz) (sz)
 #endif
 
-/* Palmetto hardware value: 0x120CE416 */
-#define PALMETTO_BMC_HW_STRAP1 (                                        \
-        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_256MB) |               \
-        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2 /* DDR3 with CL=6, CWL=5 */) | \
-        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
-        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
-        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
-        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
-        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
-        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
-        SCU_HW_STRAP_SPI_WIDTH |                                        \
-        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
-        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
-
 /* AST2600 evb hardware value */
 #define AST2600_EVB_HW_STRAP1 0x000000C0
 #define AST2600_EVB_HW_STRAP2 0x00000003
@@ -312,30 +298,6 @@ static void aspeed_machine_init(MachineState *machine)
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
-static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    DeviceState *dev;
-    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
-
-    /*
-     * The palmetto platform expects a ds3231 RTC but a ds1338 is
-     * enough to provide basic RTC features. Alarms will be missing
-     */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
-
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
-                          eeprom_buf);
-
-    /* add a TMP423 temperature sensor */
-    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
-                                         "tmp423", 0x4c));
-    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
-    object_property_set_int(OBJECT(dev), "temperature3", 110000, &error_abort);
-}
-
 static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1042,23 +1004,6 @@ static void aspeed_machine_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_props_init(oc);
 }
 
-static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
-                                               const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "OpenPOWER Palmetto BMC (ARM926EJ-S)";
-    amc->soc_name  = "ast2400-a1";
-    amc->hw_strap1 = PALMETTO_BMC_HW_STRAP1;
-    amc->fmc_model = "n25q256a";
-    amc->spi_model = "mx25l25635f";
-    amc->num_cs    = 1;
-    amc->i2c_init  = palmetto_bmc_i2c_init;
-    mc->default_ram_size       = 256 * MiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
                                                   const void *data)
 {
@@ -1405,11 +1350,6 @@ static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
 
 static const TypeInfo aspeed_machine_types[] = {
     {
-        .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_palmetto_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }, {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
diff --git a/hw/arm/aspeed_ast2400_palmetto.c b/hw/arm/aspeed_ast2400_palmetto.c
new file mode 100644
index 0000000000..776aa43a45
--- /dev/null
+++ b/hw/arm/aspeed_ast2400_palmetto.c
@@ -0,0 +1,80 @@
+/*
+ * OpenPOWER Palmetto
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+/* Palmetto hardware value: 0x120CE416 */
+#define PALMETTO_BMC_HW_STRAP1 (                                        \
+        SCU_AST2400_HW_STRAP_DRAM_SIZE(DRAM_SIZE_256MB) |               \
+        SCU_AST2400_HW_STRAP_DRAM_CONFIG(2 /* DDR3 with CL=6, CWL=5 */) | \
+        SCU_AST2400_HW_STRAP_ACPI_DIS |                                 \
+        SCU_AST2400_HW_STRAP_SET_CLK_SOURCE(AST2400_CLK_48M_IN) |       \
+        SCU_HW_STRAP_VGA_CLASS_CODE |                                   \
+        SCU_HW_STRAP_LPC_RESET_PIN |                                    \
+        SCU_HW_STRAP_SPI_MODE(SCU_HW_STRAP_SPI_M_S_EN) |                \
+        SCU_AST2400_HW_STRAP_SET_CPU_AHB_RATIO(AST2400_CPU_AHB_RATIO_2_1) | \
+        SCU_HW_STRAP_SPI_WIDTH |                                        \
+        SCU_HW_STRAP_VGA_SIZE_SET(VGA_16M_DRAM) |                       \
+        SCU_AST2400_HW_STRAP_BOOT_MODE(AST2400_SPI_BOOT))
+
+static void palmetto_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    DeviceState *dev;
+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
+
+    /*
+     * The palmetto platform expects a ds3231 RTC but a ds1338 is
+     * enough to provide basic RTC features. Alarms will be missing
+     */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0), "ds1338", 0x68);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50,
+                          eeprom_buf);
+
+    /* add a TMP423 temperature sensor */
+    dev = DEVICE(i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 2),
+                                         "tmp423", 0x4c));
+    object_property_set_int(OBJECT(dev), "temperature0", 31000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature1", 28000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature2", 20000, &error_abort);
+    object_property_set_int(OBJECT(dev), "temperature3", 110000, &error_abort);
+}
+
+static void aspeed_machine_palmetto_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "OpenPOWER Palmetto BMC (ARM926EJ-S)";
+    amc->soc_name  = "ast2400-a1";
+    amc->hw_strap1 = PALMETTO_BMC_HW_STRAP1;
+    amc->fmc_model = "n25q256a";
+    amc->spi_model = "mx25l25635f";
+    amc->num_cs    = 1;
+    amc->i2c_init  = palmetto_bmc_i2c_init;
+    mc->default_ram_size       = 256 * MiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2400_palmetto_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("palmetto-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_palmetto_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2400_palmetto_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index ea2d24af88..e52901108b 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -44,6 +44,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed.c',
   'aspeed_soc_common.c',
   'aspeed_ast2400.c',
+  'aspeed_ast2400_palmetto.c',
   'aspeed_ast2400_quanta-q71l.c',
   'aspeed_ast2400_supermicrox11.c',
   'aspeed_ast2500_evb.c',

From c52f5c16359f69bc603aadc039aac5171f6c7f72 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:55 +0800
Subject: [PATCH 1999/2396] hw/arm/aspeed: Move ASPEED_RAM_SIZE() macro to
 common header for reuse
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Moving it into aspeed.h allows all Aspeed machine source files
(AST2400, AST2500, AST2600, AST2700, etc.) to reuse the same macro
definition for consistent behavior and maintainability.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-18-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         | 7 -------
 include/hw/arm/aspeed.h | 7 +++++++
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 15d3b045ac..ba0c9a62ff 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -36,13 +36,6 @@ static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
 };
 
-/* On 32-bit hosts, lower RAM to 1G because of the 2047 MB limit */
-#if HOST_LONG_BITS == 32
-#define ASPEED_RAM_SIZE(sz) MIN((sz), 1 * GiB)
-#else
-#define ASPEED_RAM_SIZE(sz) (sz)
-#endif
-
 /* AST2600 evb hardware value */
 #define AST2600_EVB_HW_STRAP1 0x000000C0
 #define AST2600_EVB_HW_STRAP2 0x00000003
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 16b24e6887..84620f49ed 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -25,6 +25,13 @@ DECLARE_OBJ_CHECKERS(AspeedMachineState, AspeedMachineClass,
 #define ASPEED_MAC2_ON   (1 << 2)
 #define ASPEED_MAC3_ON   (1 << 3)
 
+/* On 32-bit hosts, lower RAM to 1G because of the 2047 MB limit */
+#if HOST_LONG_BITS == 32
+#define ASPEED_RAM_SIZE(sz) MIN((sz), 1 * GiB)
+#else
+#define ASPEED_RAM_SIZE(sz) (sz)
+#endif
+
 struct AspeedMachineState {
     MachineState parent_obj;
 

From 2bf16a24d61c1690d62f9bd2008a36f3db1e0d14 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:56 +0800
Subject: [PATCH 2000/2396] hw/arm/aspeed: Split Bletchley machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Facebook Bletchley BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_bletchley.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future development for
new platforms without cluttering aspeed.c.

Key updates include:
- Moved BLETCHLEY_BMC_HW_STRAP1 and BLETCHLEY_BMC_HW_STRAP2 macro definitions into the new file.
- Moved bletchley_bmc_i2c_init() I²C initialization logic into the new file.
- Moved aspeed_machine_bletchley_class_init() and type registration.
- Added aspeed_ast2600_bletchley.c to the build system (meson.build).
- Removed all Bletchley-specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-19-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                   | 77 ------------------------
 hw/arm/aspeed_ast2600_bletchley.c | 97 +++++++++++++++++++++++++++++++
 hw/arm/meson.build                |  1 +
 3 files changed, 98 insertions(+), 77 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_bletchley.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ba0c9a62ff..3acb45b22c 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -56,10 +56,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define FUJI_BMC_HW_STRAP1    0x00000000
 #define FUJI_BMC_HW_STRAP2    0x00000000
 
-/* Bletchley hardware value */
-#define BLETCHLEY_BMC_HW_STRAP1 0x00002000
-#define BLETCHLEY_BMC_HW_STRAP2 0x00000801
-
 /* GB200NVL hardware value */
 #define GB200NVL_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
 #define GB200NVL_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
@@ -685,53 +681,6 @@ static void catalina_bmc_i2c_init(AspeedMachineState *bmc)
     at24c_eeprom_init(i2c[15], 0x52, 8 * KiB);
 }
 
-static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CBus *i2c[13] = {};
-    for (int i = 0; i < 13; i++) {
-        if ((i == 8) || (i == 11)) {
-            continue;
-        }
-        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
-    }
-
-    /* Bus 0 - 5 all have the same config. */
-    for (int i = 0; i < 6; i++) {
-        /* Missing model: ti,ina230 @ 0x45 */
-        /* Missing model: mps,mp5023 @ 0x40 */
-        i2c_slave_create_simple(i2c[i], TYPE_TMP421, 0x4f);
-        /* Missing model: nxp,pca9539 @ 0x76, but PCA9552 works enough */
-        i2c_slave_create_simple(i2c[i], TYPE_PCA9552, 0x76);
-        i2c_slave_create_simple(i2c[i], TYPE_PCA9552, 0x67);
-        /* Missing model: fsc,fusb302 @ 0x22 */
-    }
-
-    /* Bus 6 */
-    at24c_eeprom_init(i2c[6], 0x56, 65536);
-    /* Missing model: nxp,pcf85263 @ 0x51 , but ds1338 works enough */
-    i2c_slave_create_simple(i2c[6], "ds1338", 0x51);
-
-
-    /* Bus 7 */
-    at24c_eeprom_init(i2c[7], 0x54, 65536);
-
-    /* Bus 9 */
-    i2c_slave_create_simple(i2c[9], TYPE_TMP421, 0x4f);
-
-    /* Bus 10 */
-    i2c_slave_create_simple(i2c[10], TYPE_TMP421, 0x4f);
-    /* Missing model: ti,hdc1080 @ 0x40 */
-    i2c_slave_create_simple(i2c[10], TYPE_PCA9552, 0x67);
-
-    /* Bus 12 */
-    /* Missing model: adi,adm1278 @ 0x11 */
-    i2c_slave_create_simple(i2c[12], TYPE_TMP421, 0x4c);
-    i2c_slave_create_simple(i2c[12], TYPE_TMP421, 0x4d);
-    i2c_slave_create_simple(i2c[12], TYPE_PCA9552, 0x67);
-}
-
-
 static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1059,27 +1008,6 @@ static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-#define BLETCHLEY_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
-
-static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
-                                                const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Facebook Bletchley BMC (Cortex-A7)";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = BLETCHLEY_BMC_HW_STRAP1;
-    amc->hw_strap2 = BLETCHLEY_BMC_HW_STRAP2;
-    amc->fmc_model = "w25q01jvq";
-    amc->spi_model = NULL;
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON;
-    amc->i2c_init  = bletchley_bmc_i2c_init;
-    mc->default_ram_size = BLETCHLEY_BMC_RAM_SIZE;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 static void aspeed_machine_catalina_class_init(ObjectClass *oc,
                                                const void *data)
 {
@@ -1367,11 +1295,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_fuji_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("bletchley-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_bletchley_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_bletchley.c b/hw/arm/aspeed_ast2600_bletchley.c
new file mode 100644
index 0000000000..b7e84db143
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_bletchley.c
@@ -0,0 +1,97 @@
+/*
+ * Facebook Bletchley
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/gpio/pca9552.h"
+#include "hw/nvram/eeprom_at24c.h"
+
+#define TYPE_TMP421 "tmp421"
+/* Bletchley hardware value */
+#define BLETCHLEY_BMC_HW_STRAP1 0x00002000
+#define BLETCHLEY_BMC_HW_STRAP2 0x00000801
+#define BLETCHLEY_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
+
+static void bletchley_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[13] = {};
+    for (int i = 0; i < 13; i++) {
+        if ((i == 8) || (i == 11)) {
+            continue;
+        }
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    /* Bus 0 - 5 all have the same config. */
+    for (int i = 0; i < 6; i++) {
+        /* Missing model: ti,ina230 @ 0x45 */
+        /* Missing model: mps,mp5023 @ 0x40 */
+        i2c_slave_create_simple(i2c[i], TYPE_TMP421, 0x4f);
+        /* Missing model: nxp,pca9539 @ 0x76, but PCA9552 works enough */
+        i2c_slave_create_simple(i2c[i], TYPE_PCA9552, 0x76);
+        i2c_slave_create_simple(i2c[i], TYPE_PCA9552, 0x67);
+        /* Missing model: fsc,fusb302 @ 0x22 */
+    }
+
+    /* Bus 6 */
+    at24c_eeprom_init(i2c[6], 0x56, 65536);
+    /* Missing model: nxp,pcf85263 @ 0x51 , but ds1338 works enough */
+    i2c_slave_create_simple(i2c[6], "ds1338", 0x51);
+
+
+    /* Bus 7 */
+    at24c_eeprom_init(i2c[7], 0x54, 65536);
+
+    /* Bus 9 */
+    i2c_slave_create_simple(i2c[9], TYPE_TMP421, 0x4f);
+
+    /* Bus 10 */
+    i2c_slave_create_simple(i2c[10], TYPE_TMP421, 0x4f);
+    /* Missing model: ti,hdc1080 @ 0x40 */
+    i2c_slave_create_simple(i2c[10], TYPE_PCA9552, 0x67);
+
+    /* Bus 12 */
+    /* Missing model: adi,adm1278 @ 0x11 */
+    i2c_slave_create_simple(i2c[12], TYPE_TMP421, 0x4c);
+    i2c_slave_create_simple(i2c[12], TYPE_TMP421, 0x4d);
+    i2c_slave_create_simple(i2c[12], TYPE_PCA9552, 0x67);
+}
+
+static void aspeed_machine_bletchley_class_init(ObjectClass *oc,
+                                                const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Bletchley BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = BLETCHLEY_BMC_HW_STRAP1;
+    amc->hw_strap2 = BLETCHLEY_BMC_HW_STRAP2;
+    amc->fmc_model = "w25q01jvq";
+    amc->spi_model = NULL;
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON;
+    amc->i2c_init  = bletchley_bmc_i2c_init;
+    mc->default_ram_size = BLETCHLEY_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast2600_bletchley_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("bletchley-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_bletchley_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_bletchley_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index e52901108b..6d80e2caf9 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -57,6 +57,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_witherspoon.c',
   'aspeed_ast2500_yosemitev2.c',
   'aspeed_ast2600.c',
+  'aspeed_ast2600_bletchley.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))

From 21dc5fa31bd68651d829d90bfac34084d99d2f45 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:57 +0800
Subject: [PATCH 2001/2396] hw/arm/aspeed: Split FBY35 BMC machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Facebook fby35 BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_fby35.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future development for
new platforms without cluttering aspeed.c.

Key updates include:
- Moved fby35_i2c_init() and fby35_reset() to the new file.
- Moved aspeed_machine_fby35_class_init() and machine registration to the new file.
- Removed fby35 FRU data (fby35_nic_fruid, fby35_bb_fruid, fby35_bmc_fruid) and their size definitions from aspeed_eeprom.[ch].
- Added aspeed_ast2600_fby35.c to the build system (meson.build).
- Cleaned up all fby35-specific code and declarations from aspeed.c and aspeed_eeprom.*.
- Introduced FBY35_BMC_RAM_SIZE macro based on FUJI_BMC_RAM_SIZE to remove
  inter-file dependency.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-20-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c               |  79 ---------------
 hw/arm/aspeed_ast2600_fby35.c | 178 ++++++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c        |  74 --------------
 hw/arm/aspeed_eeprom.h        |   7 --
 hw/arm/meson.build            |   1 +
 5 files changed, 179 insertions(+), 160 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_fby35.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 3acb45b22c..e44aec69bd 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -719,38 +719,6 @@ static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
                           gb200nvl_bmc_fruid_len);
 }
 
-static void fby35_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CBus *i2c[16];
-
-    for (int i = 0; i < 16; i++) {
-        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
-    }
-
-    i2c_slave_create_simple(i2c[2], TYPE_LM75, 0x4f);
-    i2c_slave_create_simple(i2c[8], TYPE_TMP421, 0x1f);
-    /* Hotswap controller is actually supposed to be mp5920 or ltc4282. */
-    i2c_slave_create_simple(i2c[11], "adm1272", 0x44);
-    i2c_slave_create_simple(i2c[12], TYPE_LM75, 0x4e);
-    i2c_slave_create_simple(i2c[12], TYPE_LM75, 0x4f);
-
-    at24c_eeprom_init(i2c[4], 0x51, 128 * KiB);
-    at24c_eeprom_init(i2c[6], 0x51, 128 * KiB);
-    at24c_eeprom_init_rom(i2c[8], 0x50, 32 * KiB, fby35_nic_fruid,
-                          fby35_nic_fruid_len);
-    at24c_eeprom_init_rom(i2c[11], 0x51, 128 * KiB, fby35_bb_fruid,
-                          fby35_bb_fruid_len);
-    at24c_eeprom_init_rom(i2c[11], 0x54, 128 * KiB, fby35_bmc_fruid,
-                          fby35_bmc_fruid_len);
-
-    /*
-     * TODO: There is a multi-master i2c connection to an AST1030 MiniBMC on
-     * buses 0, 1, 2, 3, and 9. Source address 0x10, target address 0x20 on
-     * each.
-     */
-}
-
 static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
 {
     AspeedSoCState *soc = bmc->soc;
@@ -1053,48 +1021,6 @@ static void aspeed_machine_gb200nvl_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 }
 
-static void fby35_reset(MachineState *state, ResetType type)
-{
-    AspeedMachineState *bmc = ASPEED_MACHINE(state);
-    AspeedGPIOState *gpio = &bmc->soc->gpio;
-
-    qemu_devices_reset(type);
-
-    /* Board ID: 7 (Class-1, 4 slots) */
-    object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioV5", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioV6", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioV7", false, &error_fatal);
-
-    /* Slot presence pins, inverse polarity. (False means present) */
-    object_property_set_bool(OBJECT(gpio), "gpioH4", false, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioH5", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioH6", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioH7", true, &error_fatal);
-
-    /* Slot 12v power pins, normal polarity. (True means powered-on) */
-    object_property_set_bool(OBJECT(gpio), "gpioB2", true, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioB3", false, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioB4", false, &error_fatal);
-    object_property_set_bool(OBJECT(gpio), "gpioB5", false, &error_fatal);
-}
-
-static void aspeed_machine_fby35_class_init(ObjectClass *oc, const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Facebook fby35 BMC (Cortex-A7)";
-    mc->reset      = fby35_reset;
-    amc->fmc_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC3_ON;
-    amc->i2c_init  = fby35_i2c_init;
-    /* FIXME: Replace this macro with something more general */
-    mc->default_ram_size = FUJI_BMC_RAM_SIZE;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 #define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
 /* Main SYSCLK frequency in Hz (200MHz) */
 #define SYSCLK_FRQ 200000000ULL
@@ -1305,11 +1231,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_catalina_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("fby35-bmc"),
-        .parent        = MACHINE_TYPE_NAME("ast2600-evb"),
-        .class_init    = aspeed_machine_fby35_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("ast1030-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_fby35.c b/hw/arm/aspeed_ast2600_fby35.c
new file mode 100644
index 0000000000..f624427070
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_fby35.c
@@ -0,0 +1,178 @@
+/*
+ * Facebook fby35
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+#include "hw/sensor/tmp105.h"
+#include "system/reset.h"
+
+#define TYPE_LM75 TYPE_TMP105
+#define TYPE_TMP421 "tmp421"
+#define FBY35_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
+
+static const uint8_t fby35_nic_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
+    0x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
+    0x4d, 0x65, 0x6c, 0x6c, 0x61, 0x6e, 0x6f, 0x78, 0x20, 0x43, 0x6f, 0x6e,
+    0x6e, 0x65, 0x63, 0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0x20, 0x4f,
+    0x43, 0x50, 0x33, 0x2e, 0x30, 0xd8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd5, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xcc, 0x46, 0x52, 0x55, 0x20, 0x56, 0x65, 0x72,
+    0x20, 0x30, 0x2e, 0x30, 0x32, 0xc0, 0xc0, 0xc0, 0xc1, 0x00, 0x00, 0x2f,
+    0x01, 0x11, 0x19, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0xdd, 0x4d, 0x65, 0x6c, 0x6c, 0x61, 0x6e, 0x6f, 0x78, 0x20, 0x43, 0x6f,
+    0x6e, 0x6e, 0x65, 0x63, 0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0x20,
+    0x4f, 0x43, 0x50, 0x33, 0x2e, 0x30, 0xd5, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xd3, 0x41, 0x39, 0x20, 0x20, 0x20, 0x20, 0x20,
+    0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
+    0xd8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0xc0, 0xc0, 0xc0, 0xc0, 0xcd, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
+    0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0xc1, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0xdb, 0xc0, 0x82, 0x30, 0x15, 0x79, 0x7f, 0xa6, 0x00,
+    0x01, 0x18, 0x0b, 0xff, 0x08, 0x00, 0xff, 0xff, 0x64, 0x00, 0x00, 0x00,
+    0x00, 0x03, 0x20, 0x01, 0xff, 0xff, 0x04, 0x46, 0x00, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0x01, 0x81, 0x09, 0x15, 0xb3, 0x10, 0x1d, 0x00,
+    0x24, 0x15, 0xb3, 0x00, 0x02, 0xeb, 0x8a, 0x95, 0x5c,
+};
+static const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
+
+static const uint8_t fby35_bb_fruid[] = {
+    0x01, 0x00, 0x01, 0x03, 0x10, 0x00, 0x00, 0xeb, 0x01, 0x02, 0x17, 0xc3,
+    0x4e, 0x2f, 0x41, 0xc3, 0x4e, 0x2f, 0x41, 0xc1, 0x00, 0x00, 0x00, 0x23,
+    0x01, 0x0d, 0x00, 0xb6, 0xd2, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0xd5, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
+    0x20, 0x42, 0x6f, 0x61, 0x72, 0x64, 0x20, 0x77, 0x42, 0x4d, 0x43, 0xcd,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa8, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
+    0x69, 0x74, 0x65, 0x20, 0x56, 0x33, 0x2e, 0x35, 0x20, 0x45, 0x56, 0x54,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x4e, 0x2f,
+    0x41, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x43,
+};
+static const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
+
+static const uint8_t fby35_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
+    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
+    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
+    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
+    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
+    0x69, 0x74, 0x65, 0x20, 0x56, 0x33, 0x2e, 0x35, 0x20, 0x45, 0x56, 0x54,
+    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
+    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
+    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
+};
+static const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
+
+static void fby35_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[16];
+
+    for (int i = 0; i < 16; i++) {
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    i2c_slave_create_simple(i2c[2], TYPE_LM75, 0x4f);
+    i2c_slave_create_simple(i2c[8], TYPE_TMP421, 0x1f);
+    /* Hotswap controller is actually supposed to be mp5920 or ltc4282. */
+    i2c_slave_create_simple(i2c[11], "adm1272", 0x44);
+    i2c_slave_create_simple(i2c[12], TYPE_LM75, 0x4e);
+    i2c_slave_create_simple(i2c[12], TYPE_LM75, 0x4f);
+
+    at24c_eeprom_init(i2c[4], 0x51, 128 * KiB);
+    at24c_eeprom_init(i2c[6], 0x51, 128 * KiB);
+    at24c_eeprom_init_rom(i2c[8], 0x50, 32 * KiB, fby35_nic_fruid,
+                          fby35_nic_fruid_len);
+    at24c_eeprom_init_rom(i2c[11], 0x51, 128 * KiB, fby35_bb_fruid,
+                          fby35_bb_fruid_len);
+    at24c_eeprom_init_rom(i2c[11], 0x54, 128 * KiB, fby35_bmc_fruid,
+                          fby35_bmc_fruid_len);
+
+    /*
+     * TODO: There is a multi-master i2c connection to an AST1030 MiniBMC on
+     * buses 0, 1, 2, 3, and 9. Source address 0x10, target address 0x20 on
+     * each.
+     */
+}
+
+static void fby35_reset(MachineState *state, ResetType type)
+{
+    AspeedMachineState *bmc = ASPEED_MACHINE(state);
+    AspeedGPIOState *gpio = &bmc->soc->gpio;
+
+    qemu_devices_reset(type);
+
+    /* Board ID: 7 (Class-1, 4 slots) */
+    object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioV5", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioV6", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioV7", false, &error_fatal);
+
+    /* Slot presence pins, inverse polarity. (False means present) */
+    object_property_set_bool(OBJECT(gpio), "gpioH4", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH5", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH6", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioH7", true, &error_fatal);
+
+    /* Slot 12v power pins, normal polarity. (True means powered-on) */
+    object_property_set_bool(OBJECT(gpio), "gpioB2", true, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB3", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB4", false, &error_fatal);
+    object_property_set_bool(OBJECT(gpio), "gpioB5", false, &error_fatal);
+}
+
+static void aspeed_machine_fby35_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook fby35 BMC (Cortex-A7)";
+    mc->reset      = fby35_reset;
+    amc->fmc_model = "mx66l1g45g";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC3_ON;
+    amc->i2c_init  = fby35_i2c_init;
+    mc->default_ram_size = FBY35_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast2600_fby35_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("fby35-bmc"),
+        .parent        = MACHINE_TYPE_NAME("ast2600-evb"),
+        .class_init    = aspeed_machine_fby35_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_fby35_types)
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index 124277eaca..53c9b0d56f 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -7,77 +7,6 @@
 #include "qemu/osdep.h"
 #include "aspeed_eeprom.h"
 
-const uint8_t fby35_nic_fruid[] = {
-    0x01, 0x00, 0x00, 0x01, 0x0f, 0x20, 0x00, 0xcf, 0x01, 0x0e, 0x19, 0xd7,
-    0x5e, 0xcf, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xdd,
-    0x4d, 0x65, 0x6c, 0x6c, 0x61, 0x6e, 0x6f, 0x78, 0x20, 0x43, 0x6f, 0x6e,
-    0x6e, 0x65, 0x63, 0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0x20, 0x4f,
-    0x43, 0x50, 0x33, 0x2e, 0x30, 0xd8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd5, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xcc, 0x46, 0x52, 0x55, 0x20, 0x56, 0x65, 0x72,
-    0x20, 0x30, 0x2e, 0x30, 0x32, 0xc0, 0xc0, 0xc0, 0xc1, 0x00, 0x00, 0x2f,
-    0x01, 0x11, 0x19, 0xc8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0xdd, 0x4d, 0x65, 0x6c, 0x6c, 0x61, 0x6e, 0x6f, 0x78, 0x20, 0x43, 0x6f,
-    0x6e, 0x6e, 0x65, 0x63, 0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0x20,
-    0x4f, 0x43, 0x50, 0x33, 0x2e, 0x30, 0xd5, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xd3, 0x41, 0x39, 0x20, 0x20, 0x20, 0x20, 0x20,
-    0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20, 0x20,
-    0xd8, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0xc0, 0xc0, 0xc0, 0xc0, 0xcd, 0x43, 0x6f, 0x6e, 0x6e, 0x65, 0x63,
-    0x74, 0x58, 0x2d, 0x36, 0x20, 0x44, 0x58, 0xc1, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0xdb, 0xc0, 0x82, 0x30, 0x15, 0x79, 0x7f, 0xa6, 0x00,
-    0x01, 0x18, 0x0b, 0xff, 0x08, 0x00, 0xff, 0xff, 0x64, 0x00, 0x00, 0x00,
-    0x00, 0x03, 0x20, 0x01, 0xff, 0xff, 0x04, 0x46, 0x00, 0xff, 0xff, 0xff,
-    0xff, 0xff, 0xff, 0xff, 0x01, 0x81, 0x09, 0x15, 0xb3, 0x10, 0x1d, 0x00,
-    0x24, 0x15, 0xb3, 0x00, 0x02, 0xeb, 0x8a, 0x95, 0x5c,
-};
-
-const uint8_t fby35_bb_fruid[] = {
-    0x01, 0x00, 0x01, 0x03, 0x10, 0x00, 0x00, 0xeb, 0x01, 0x02, 0x17, 0xc3,
-    0x4e, 0x2f, 0x41, 0xc3, 0x4e, 0x2f, 0x41, 0xc1, 0x00, 0x00, 0x00, 0x23,
-    0x01, 0x0d, 0x00, 0xb6, 0xd2, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0xd5, 0x4d, 0x61, 0x6e, 0x61, 0x67, 0x65, 0x6d, 0x65, 0x6e, 0x74,
-    0x20, 0x42, 0x6f, 0x61, 0x72, 0x64, 0x20, 0x77, 0x42, 0x4d, 0x43, 0xcd,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0xa8, 0x01, 0x0c, 0x00, 0xc6,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
-    0x69, 0x74, 0x65, 0x20, 0x56, 0x33, 0x2e, 0x35, 0x20, 0x45, 0x56, 0x54,
-    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x4e, 0x2f,
-    0x41, 0xc1, 0x00, 0x00, 0x00, 0x00, 0x00, 0x43,
-};
-
-const uint8_t fby35_bmc_fruid[] = {
-    0x01, 0x00, 0x00, 0x01, 0x0d, 0x00, 0x00, 0xf1, 0x01, 0x0c, 0x00, 0x36,
-    0xe6, 0xd0, 0xc6, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x42, 0x4d,
-    0x43, 0x20, 0x53, 0x74, 0x6f, 0x72, 0x61, 0x67, 0x65, 0x20, 0x4d, 0x6f,
-    0x64, 0x75, 0x6c, 0x65, 0xcd, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e,
-    0x30, 0xc9, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc1, 0x39, 0x01, 0x0c, 0x00, 0xc6,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xd2, 0x59, 0x6f, 0x73, 0x65, 0x6d,
-    0x69, 0x74, 0x65, 0x20, 0x56, 0x33, 0x2e, 0x35, 0x20, 0x45, 0x56, 0x54,
-    0x32, 0xce, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0xc4, 0x45, 0x56, 0x54, 0x32, 0xcd, 0x58, 0x58,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc7,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc3, 0x31, 0x2e, 0x30, 0xc9,
-    0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0x58, 0xc8, 0x43, 0x6f,
-    0x6e, 0x66, 0x69, 0x67, 0x20, 0x41, 0xc1, 0x45,
-};
-
 const uint8_t rainier_bb_fruid[] = {
     0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
     0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
@@ -139,9 +68,6 @@ const uint8_t gb200nvl_bmc_fruid[] = {
 
 };
 
-const size_t fby35_nic_fruid_len = sizeof(fby35_nic_fruid);
-const size_t fby35_bb_fruid_len = sizeof(fby35_bb_fruid);
-const size_t fby35_bmc_fruid_len = sizeof(fby35_bmc_fruid);
 const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
 const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
 const size_t gb200nvl_bmc_fruid_len = sizeof(gb200nvl_bmc_fruid);
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index 5448eeeab7..7207bb2cbd 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -7,13 +7,6 @@
 #ifndef ASPEED_EEPROM_H
 #define ASPEED_EEPROM_H
 
-extern const uint8_t fby35_nic_fruid[];
-extern const uint8_t fby35_bb_fruid[];
-extern const uint8_t fby35_bmc_fruid[];
-extern const size_t fby35_nic_fruid_len;
-extern const size_t fby35_bb_fruid_len;
-extern const size_t fby35_bmc_fruid_len;
-
 extern const uint8_t rainier_bb_fruid[];
 extern const size_t rainier_bb_fruid_len;
 extern const uint8_t rainier_bmc_fruid[];
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 6d80e2caf9..4abfbffb45 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -58,6 +58,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_yosemitev2.c',
   'aspeed_ast2600.c',
   'aspeed_ast2600_bletchley.c',
+  'aspeed_ast2600_fby35.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))

From 0f9a309b5071a160a357bf043b7f9a8d0e57fb7c Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:58 +0800
Subject: [PATCH 2002/2396] hw/arm/aspeed: Split Fuji machine into a separate
 source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Facebook Fuji BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_fuji.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file.
It improves maintainability, readability, and simplifies future development for
new platforms without cluttering aspeed.c.

Key updates include:
- Moved FUJI_BMC_HW_STRAP1 and FUJI_BMC_HW_STRAP2 macro definitions into the new file.
- Moved fuji_bmc_i2c_init() and its helper get_pca9548_channels() into the new file.
- Moved aspeed_machine_fuji_class_init() and type registration to aspeed_ast2600_fuji.c.
- Added aspeed_ast2600_fuji.c to the build system (meson.build).
- Cleaned up all Fuji-specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-21-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c              | 117 -----------------------------
 hw/arm/aspeed_ast2600_fuji.c | 140 +++++++++++++++++++++++++++++++++++
 hw/arm/meson.build           |   1 +
 3 files changed, 141 insertions(+), 117 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_fuji.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index e44aec69bd..29a036b675 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -52,10 +52,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define RAINIER_BMC_HW_STRAP1 (0x00422016 | SCU_AST2600_HW_STRAP_BOOT_SRC_EMMC)
 #define RAINIER_BMC_HW_STRAP2 0x80000848
 
-/* Fuji hardware value */
-#define FUJI_BMC_HW_STRAP1    0x00000000
-#define FUJI_BMC_HW_STRAP2    0x00000000
-
 /* GB200NVL hardware value */
 #define GB200NVL_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
 #define GB200NVL_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
@@ -416,95 +412,8 @@ static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
     aspeed_create_pca9552(soc, 15, 0x60);
 }
 
-static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
-                                 I2CBus **channels)
-{
-    I2CSlave *mux = i2c_slave_create_simple(bus, "pca9548", mux_addr);
-    for (int i = 0; i < 8; i++) {
-        channels[i] = pca954x_i2c_get_bus(mux, i);
-    }
-}
-
 #define TYPE_LM75 TYPE_TMP105
 #define TYPE_TMP75 TYPE_TMP105
-#define TYPE_TMP422 "tmp422"
-
-static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CBus *i2c[144] = {};
-
-    for (int i = 0; i < 16; i++) {
-        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
-    }
-    I2CBus *i2c180 = i2c[2];
-    I2CBus *i2c480 = i2c[8];
-    I2CBus *i2c600 = i2c[11];
-
-    get_pca9548_channels(i2c180, 0x70, &i2c[16]);
-    get_pca9548_channels(i2c480, 0x70, &i2c[24]);
-    /* NOTE: The device tree skips [32, 40) in the alias numbering */
-    get_pca9548_channels(i2c600, 0x77, &i2c[40]);
-    get_pca9548_channels(i2c[24], 0x71, &i2c[48]);
-    get_pca9548_channels(i2c[25], 0x72, &i2c[56]);
-    get_pca9548_channels(i2c[26], 0x76, &i2c[64]);
-    get_pca9548_channels(i2c[27], 0x76, &i2c[72]);
-    for (int i = 0; i < 8; i++) {
-        get_pca9548_channels(i2c[40 + i], 0x76, &i2c[80 + i * 8]);
-    }
-
-    i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
-    i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
-
-    /*
-     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
-     *        24c02 size is 2Kbits or 256 bytes
-     */
-    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[20], 0x50, 256);
-    at24c_eeprom_init(i2c[22], 0x52, 256);
-
-    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
-    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
-    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
-    i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
-
-    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
-    i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
-
-    i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
-    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
-    i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
-    i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
-
-    i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
-    i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
-
-    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
-    i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
-    i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
-
-    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
-    i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
-    i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
-    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
-    at24c_eeprom_init(i2c[28], 0x50, 256);
-
-    for (int i = 0; i < 8; i++) {
-        at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
-        i2c_slave_create_simple(i2c[82 + i * 8], TYPE_TMP75, 0x48);
-        i2c_slave_create_simple(i2c[83 + i * 8], TYPE_TMP75, 0x4b);
-        i2c_slave_create_simple(i2c[84 + i * 8], TYPE_TMP75, 0x4a);
-    }
-}
-
 #define TYPE_TMP421 "tmp421"
 #define TYPE_DS1338 "ds1338"
 
@@ -955,27 +864,6 @@ static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_ast2600_class_emmc_init(oc);
 };
 
-#define FUJI_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
-
-static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc = "Facebook Fuji BMC (Cortex-A7)";
-    amc->soc_name = "ast2600-a3";
-    amc->hw_strap1 = FUJI_BMC_HW_STRAP1;
-    amc->hw_strap2 = FUJI_BMC_HW_STRAP2;
-    amc->fmc_model = "mx66l1g45g";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs = 2;
-    amc->macs_mask = ASPEED_MAC3_ON;
-    amc->i2c_init = fuji_bmc_i2c_init;
-    amc->uart_default = ASPEED_DEV_UART1;
-    mc->default_ram_size = FUJI_BMC_RAM_SIZE;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static void aspeed_machine_catalina_class_init(ObjectClass *oc,
                                                const void *data)
 {
@@ -1216,11 +1104,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_rainier_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("fuji-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_fuji_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_fuji.c b/hw/arm/aspeed_ast2600_fuji.c
new file mode 100644
index 0000000000..37db252e27
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_fuji.c
@@ -0,0 +1,140 @@
+/*
+ * Facebook Fuji
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/i2c_mux_pca954x.h"
+#include "hw/sensor/tmp105.h"
+#include "hw/nvram/eeprom_at24c.h"
+
+#define TYPE_LM75 TYPE_TMP105
+#define TYPE_TMP75 TYPE_TMP105
+#define TYPE_TMP422 "tmp422"
+
+/* Fuji hardware value */
+#define FUJI_BMC_HW_STRAP1    0x00000000
+#define FUJI_BMC_HW_STRAP2    0x00000000
+#define FUJI_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
+
+static void get_pca9548_channels(I2CBus *bus, uint8_t mux_addr,
+                                 I2CBus **channels)
+{
+    I2CSlave *mux = i2c_slave_create_simple(bus, "pca9548", mux_addr);
+    for (int i = 0; i < 8; i++) {
+        channels[i] = pca954x_i2c_get_bus(mux, i);
+    }
+}
+
+static void fuji_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[144] = {};
+
+    for (int i = 0; i < 16; i++) {
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+    I2CBus *i2c180 = i2c[2];
+    I2CBus *i2c480 = i2c[8];
+    I2CBus *i2c600 = i2c[11];
+
+    get_pca9548_channels(i2c180, 0x70, &i2c[16]);
+    get_pca9548_channels(i2c480, 0x70, &i2c[24]);
+    /* NOTE: The device tree skips [32, 40) in the alias numbering */
+    get_pca9548_channels(i2c600, 0x77, &i2c[40]);
+    get_pca9548_channels(i2c[24], 0x71, &i2c[48]);
+    get_pca9548_channels(i2c[25], 0x72, &i2c[56]);
+    get_pca9548_channels(i2c[26], 0x76, &i2c[64]);
+    get_pca9548_channels(i2c[27], 0x76, &i2c[72]);
+    for (int i = 0; i < 8; i++) {
+        get_pca9548_channels(i2c[40 + i], 0x76, &i2c[80 + i * 8]);
+    }
+
+    i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4c);
+    i2c_slave_create_simple(i2c[17], TYPE_LM75, 0x4d);
+
+    /*
+     * EEPROM 24c64 size is 64Kbits or 8 Kbytes
+     *        24c02 size is 2Kbits or 256 bytes
+     */
+    at24c_eeprom_init(i2c[19], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[20], 0x50, 256);
+    at24c_eeprom_init(i2c[22], 0x52, 256);
+
+    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x48);
+    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x49);
+    i2c_slave_create_simple(i2c[3], TYPE_LM75, 0x4a);
+    i2c_slave_create_simple(i2c[3], TYPE_TMP422, 0x4c);
+
+    at24c_eeprom_init(i2c[8], 0x51, 8 * KiB);
+    i2c_slave_create_simple(i2c[8], TYPE_LM75, 0x4a);
+
+    i2c_slave_create_simple(i2c[50], TYPE_LM75, 0x4c);
+    at24c_eeprom_init(i2c[50], 0x52, 8 * KiB);
+    i2c_slave_create_simple(i2c[51], TYPE_TMP75, 0x48);
+    i2c_slave_create_simple(i2c[52], TYPE_TMP75, 0x49);
+
+    i2c_slave_create_simple(i2c[59], TYPE_TMP75, 0x48);
+    i2c_slave_create_simple(i2c[60], TYPE_TMP75, 0x49);
+
+    at24c_eeprom_init(i2c[65], 0x53, 8 * KiB);
+    i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x49);
+    i2c_slave_create_simple(i2c[66], TYPE_TMP75, 0x48);
+    at24c_eeprom_init(i2c[68], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[69], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[70], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[71], 0x52, 8 * KiB);
+
+    at24c_eeprom_init(i2c[73], 0x53, 8 * KiB);
+    i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x49);
+    i2c_slave_create_simple(i2c[74], TYPE_TMP75, 0x48);
+    at24c_eeprom_init(i2c[76], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[77], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[78], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[79], 0x52, 8 * KiB);
+    at24c_eeprom_init(i2c[28], 0x50, 256);
+
+    for (int i = 0; i < 8; i++) {
+        at24c_eeprom_init(i2c[81 + i * 8], 0x56, 64 * KiB);
+        i2c_slave_create_simple(i2c[82 + i * 8], TYPE_TMP75, 0x48);
+        i2c_slave_create_simple(i2c[83 + i * 8], TYPE_TMP75, 0x4b);
+        i2c_slave_create_simple(i2c[84 + i * 8], TYPE_TMP75, 0x4a);
+    }
+}
+
+static void aspeed_machine_fuji_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc = "Facebook Fuji BMC (Cortex-A7)";
+    amc->soc_name = "ast2600-a3";
+    amc->hw_strap1 = FUJI_BMC_HW_STRAP1;
+    amc->hw_strap2 = FUJI_BMC_HW_STRAP2;
+    amc->fmc_model = "mx66l1g45g";
+    amc->spi_model = "mx66l1g45g";
+    amc->num_cs = 2;
+    amc->macs_mask = ASPEED_MAC3_ON;
+    amc->i2c_init = fuji_bmc_i2c_init;
+    amc->uart_default = ASPEED_DEV_UART1;
+    mc->default_ram_size = FUJI_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2600_fuji_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("fuji-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_fuji_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_fuji_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 4abfbffb45..e6f6ab4245 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -59,6 +59,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600.c',
   'aspeed_ast2600_bletchley.c',
   'aspeed_ast2600_fby35.c',
+  'aspeed_ast2600_fuji.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))

From 98409d8f23853ea9591f7dd86b04f21781f7992b Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:12:59 +0800
Subject: [PATCH 2003/2396] hw/arm/aspeed: Split QCOM Firework machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the QCOM Firework BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_qcom-firework.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file. It improves
maintainability, readability, and simplifies future development for new
platforms without cluttering aspeed.c.

Key updates include:
- Removed qcom_dc_scm_firework_i2c_init() and its Firework-specific devices
  from aspeed.c.
- Removed aspeed_machine_qcom_firework_class_init() and its type registration
  ("qcom-firework-bmc") from aspeed_machine_types[].
- Added new source file aspeed_ast2600_qcom-firework.c containing the
  Firework-specific initialization and machine class definition.
- Updated hw/arm/meson.build to include aspeed_ast2600_qcom-firework.c.
- Cleaned up all Firework-specific code from aspeed.c.
- Renamed `QCOM_DC_SCM_V1_BMC_HW_STRAP1` to
  `QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1` to avoid dependency conflicts with
  other QCOM DC-SCM machines.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-22-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                       | 57 -----------------
 hw/arm/aspeed_ast2600_qcom-firework.c | 91 +++++++++++++++++++++++++++
 hw/arm/meson.build                    |  1 +
 3 files changed, 92 insertions(+), 57 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_qcom-firework.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 29a036b675..f72b1e2eea 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -635,38 +635,6 @@ static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
 }
 
-static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CSlave *therm_mux, *cpuvr_mux;
-
-    /* Create the generic DC-SCM hardware */
-    qcom_dc_scm_bmc_i2c_init(bmc);
-
-    /* Now create the Firework specific hardware */
-
-    /* I2C7 CPUVR MUX */
-    cpuvr_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
-                                        "pca9546", 0x70);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", 0x72);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", 0x72);
-
-    /* I2C8 Thermal Diodes*/
-    therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
-                                        "pca9548", 0x70);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, 0x4C);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, 0x4C);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, 0x48);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, 0x48);
-    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, 0x48);
-
-    /* I2C9 Fan Controller (MAX31785) */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
-}
-
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -1063,26 +1031,6 @@ static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 };
 
-static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
-                                                    const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
-    mc->deprecation_reason = "use 'ast2600-evb' instead";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
-    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "n25q512a";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-    amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
@@ -1094,11 +1042,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_qcom_firework_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("rainier-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_qcom-firework.c b/hw/arm/aspeed_ast2600_qcom-firework.c
new file mode 100644
index 0000000000..a4dbe6eea8
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_qcom-firework.c
@@ -0,0 +1,91 @@
+/*
+ * Qualcomm DC-SCM V1/Firework
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/i2c_mux_pca954x.h"
+#include "hw/sensor/tmp105.h"
+
+/* Qualcomm DC-SCM Firework hardware value */
+#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1  0x00000000
+#define QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2  0x00000041
+
+#define TYPE_LM75 TYPE_TMP105
+
+static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
+}
+
+static void qcom_dc_scm_firework_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CSlave *therm_mux, *cpuvr_mux;
+
+    /* Create the generic DC-SCM hardware */
+    qcom_dc_scm_bmc_i2c_init(bmc);
+
+    /* Now create the Firework specific hardware */
+
+    /* I2C7 CPUVR MUX */
+    cpuvr_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7),
+                                        "pca9546", 0x70);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 0), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 1), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 2), "pca9548", 0x72);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(cpuvr_mux, 3), "pca9548", 0x72);
+
+    /* I2C8 Thermal Diodes*/
+    therm_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
+                                        "pca9548", 0x70);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 0), TYPE_LM75, 0x4C);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 1), TYPE_LM75, 0x4C);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 2), TYPE_LM75, 0x48);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 3), TYPE_LM75, 0x48);
+    i2c_slave_create_simple(pca954x_i2c_get_bus(therm_mux, 4), TYPE_LM75, 0x48);
+
+    /* I2C9 Fan Controller (MAX31785) */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x52);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "max31785", 0x54);
+}
+
+static void aspeed_machine_qcom_firework_class_init(ObjectClass *oc,
+                                                    const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Qualcomm DC-SCM V1/Firework BMC (Cortex A7)";
+    mc->deprecation_reason = "use 'ast2600-evb' instead";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP1;
+    amc->hw_strap2 = QCOM_DC_SCM_FIREWORK_BMC_HW_STRAP2;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "n25q512a";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
+    amc->i2c_init  = qcom_dc_scm_firework_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2600_qcom_firework_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("qcom-firework-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_qcom_firework_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_qcom_firework_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index e6f6ab4245..fbe063cf0b 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -60,6 +60,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_bletchley.c',
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
+  'aspeed_ast2600_qcom-firework.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',
   'fby35.c'))

From 0c1b423ac238c10b064cfc88ac9249ccc0b4c52b Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:00 +0800
Subject: [PATCH 2004/2396] hw/arm/aspeed: Split QCOM DC-SCM V1 machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the QCOM DC-SCM V1 BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_qcom-dc-scm-v1.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s logic in its own dedicated source file. It improves
maintainability, readability, and simplifies future development for new
platforms without cluttering aspeed.c.

Key updates include:
- Moved QCOM_DC_SCM_V1_BMC_HW_STRAP1 and QCOM_DC_SCM_V1_BMC_HW_STRAP2 macro
  into the new file aspeed_ast2600_qcom-dc-scm-v1.c.
- Moved qcom_dc_scm_bmc_i2c_init() and aspeed_machine_qcom_dc_scm_v1_class_init()
  into the new file aspeed_ast2600_qcom-dc-scm-v1.c.
- Moved "qcom-dc-scm-v1-bmc" machine type registration from aspeed.c to the new file.
- Updated hw/arm/meson.build to include aspeed_ast2600_qcom-dc-scm-v1.c.
- Cleaned up all QCOM DC-SCM V1-specific code from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-23-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                        | 36 -----------------
 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c | 55 ++++++++++++++++++++++++++
 hw/arm/meson.build                     |  1 +
 3 files changed, 56 insertions(+), 36 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index f72b1e2eea..89a4632425 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -56,10 +56,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define GB200NVL_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
 #define GB200NVL_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
 
-/* Qualcomm DC-SCM hardware value */
-#define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
-#define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
-
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -628,13 +624,6 @@ static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
                           gb200nvl_bmc_fruid_len);
 }
 
-static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
-}
-
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -1011,37 +1000,12 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
 }
 #endif
 
-static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
-                                                     const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
-    mc->deprecation_reason = "use 'ast2600-evb' instead";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
-    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
-    amc->fmc_model = "n25q512a";
-    amc->spi_model = "n25q512a";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-    amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-};
-
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name          = MACHINE_TYPE_NAME("ast2600-evb"),
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("rainier-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c b/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
new file mode 100644
index 0000000000..bbdeb60236
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_qcom-dc-scm-v1.c
@@ -0,0 +1,55 @@
+/*
+ * Qualcomm DC-SCM V1
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+
+/* Qualcomm DC-SCM hardware value */
+#define QCOM_DC_SCM_V1_BMC_HW_STRAP1  0x00000000
+#define QCOM_DC_SCM_V1_BMC_HW_STRAP2  0x00000041
+
+static void qcom_dc_scm_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 15), "tmp105", 0x4d);
+}
+
+static void aspeed_machine_qcom_dc_scm_v1_class_init(ObjectClass *oc,
+                                                     const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Qualcomm DC-SCM V1 BMC (Cortex A7)";
+    mc->deprecation_reason = "use 'ast2600-evb' instead";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = QCOM_DC_SCM_V1_BMC_HW_STRAP1;
+    amc->hw_strap2 = QCOM_DC_SCM_V1_BMC_HW_STRAP2;
+    amc->fmc_model = "n25q512a";
+    amc->spi_model = "n25q512a";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
+    amc->i2c_init  = qcom_dc_scm_bmc_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+};
+
+static const TypeInfo aspeed_ast2600_qcom_dc_scm_v1_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("qcom-dc-scm-v1-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_qcom_dc_scm_v1_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_qcom_dc_scm_v1_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index fbe063cf0b..588a72bdf2 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -60,6 +60,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_bletchley.c',
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
+  'aspeed_ast2600_qcom-dc-scm-v1.c',
   'aspeed_ast2600_qcom-firework.c',
   'aspeed_ast10x0.c',
   'aspeed_eeprom.c',

From fb31e0348bf6c0af29b234503f4dc5b1a11ab54d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:01 +0800
Subject: [PATCH 2005/2396] hw/arm/aspeed: Make
 aspeed_machine_ast2600_class_emmc_init() a common API for eMMC boot setup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit exposes the function aspeed_machine_ast2600_class_emmc_init() as
a common API so that other AST2600-based machine implementations can reuse it
to enable the "boot-emmc" property.

Previously, this function was defined as a static helper within aspeed.c,
limiting its visibility to that file. By making it global and declaring it in
aspeed.h, other machine definition files (e.g., for specific AST2600 boards)
can now easily call this API to register eMMC boot configuration support.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-24-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         |  2 +-
 include/hw/arm/aspeed.h | 10 ++++++++++
 2 files changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 89a4632425..2f385290a4 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -755,7 +755,7 @@ static void aspeed_machine_ast2600_set_boot_from_emmc(Object *obj, bool value,
     }
 }
 
-static void aspeed_machine_ast2600_class_emmc_init(ObjectClass *oc)
+void aspeed_machine_ast2600_class_emmc_init(ObjectClass *oc)
 {
     object_class_property_add_bool(oc, "boot-emmc",
                                    aspeed_machine_ast2600_get_boot_from_emmc,
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 84620f49ed..87dcadab26 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -101,4 +101,14 @@ void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr);
  */
 I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr);
 
+/*
+ * aspeed_machine_ast2600_class_emmc_init:
+ * @oc: the #ObjectClass to initialize.
+ *
+ * Initialize eMMC-related properties for the AST2600 Aspeed machine class.
+ * This function is typically invoked during class initialization to set up
+ * default configuration or attach eMMC-specific devices for AST2600 platforms.
+ */
+void aspeed_machine_ast2600_class_emmc_init(ObjectClass *oc);
+
 #endif

From 20a785d631c352c03fbfbf7f1b46285e4b90f2f2 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:02 +0800
Subject: [PATCH 2006/2396] hw/arm/aspeed: Split GB200NVL machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Nvidia GB200NVL BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_gb200nvl.c.

This refactor continues the modularization effort for Aspeed platform support,
placing each board’s initialization logic in its own dedicated source file.
It improves code maintainability, readability, and simplifies adding new
platforms without increasing the complexity of aspeed.c.

Key updates include:
- Moved GB200NVL_BMC_HW_STRAP1 and GB200NVL_BMC_HW_STRAP2 macro definitions into the new file.
- Moved gb200nvl_bmc_i2c_init() and its related FRUID setup into the new file.
- Moved aspeed_machine_gb200nvl_class_init() and type registration logic out of aspeed.c.
- Removed gb200nvl_bmc_fruid[] and its length definition from aspeed_eeprom.c/h.
- Added aspeed_ast2600_gb200nvl.c to the Meson build system (meson.build).
- Cleaned up all GB200NVL-specific code and data from aspeed.c and aspeed_eeprom.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-25-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                  |  72 --------------------
 hw/arm/aspeed_ast2600_gb200nvl.c | 111 +++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c           |  20 ------
 hw/arm/aspeed_eeprom.h           |   3 -
 hw/arm/meson.build               |   1 +
 5 files changed, 112 insertions(+), 95 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_gb200nvl.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 2f385290a4..77a4095f7d 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -52,10 +52,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define RAINIER_BMC_HW_STRAP1 (0x00422016 | SCU_AST2600_HW_STRAP_BOOT_SRC_EMMC)
 #define RAINIER_BMC_HW_STRAP2 0x80000848
 
-/* GB200NVL hardware value */
-#define GB200NVL_BMC_HW_STRAP1 AST2600_EVB_HW_STRAP1
-#define GB200NVL_BMC_HW_STRAP2 AST2600_EVB_HW_STRAP2
-
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -586,44 +582,6 @@ static void catalina_bmc_i2c_init(AspeedMachineState *bmc)
     at24c_eeprom_init(i2c[15], 0x52, 8 * KiB);
 }
 
-static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CBus *i2c[15] = {};
-    DeviceState *dev;
-    for (int i = 0; i < sizeof(i2c) / sizeof(i2c[0]); i++) {
-        if ((i == 11) || (i == 12) || (i == 13)) {
-            continue;
-        }
-        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
-    }
-
-    /* Bus 5 Expander */
-    aspeed_create_pca9554(soc, 4, 0x21);
-
-    /* Mux I2c Expanders */
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x71);
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x72);
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x73);
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x75);
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x76);
-    i2c_slave_create_simple(i2c[5], "pca9546", 0x77);
-
-    /* Bus 10 */
-    dev = DEVICE(aspeed_create_pca9554(soc, 9, 0x20));
-
-    /* Set FPGA_READY */
-    object_property_set_str(OBJECT(dev), "pin1", "high", &error_fatal);
-
-    aspeed_create_pca9554(soc, 9, 0x21);
-    at24c_eeprom_init(i2c[9], 0x50, 64 * KiB);
-    at24c_eeprom_init(i2c[9], 0x51, 64 * KiB);
-
-    /* Bus 11 */
-    at24c_eeprom_init_rom(i2c[10], 0x50, 256, gb200nvl_bmc_fruid,
-                          gb200nvl_bmc_fruid_len);
-}
-
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -841,31 +799,6 @@ static void aspeed_machine_catalina_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 }
 
-#define GB200NVL_BMC_RAM_SIZE ASPEED_RAM_SIZE(1 * GiB)
-
-static void aspeed_machine_gb200nvl_class_init(ObjectClass *oc,
-                                               const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Nvidia GB200NVL BMC (Cortex-A7)";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = GB200NVL_BMC_HW_STRAP1;
-    amc->hw_strap2 = GB200NVL_BMC_HW_STRAP2;
-    amc->fmc_model = "mx66u51235f";
-    amc->spi_model = "mx66u51235f";
-    amc->num_cs    = 2;
-
-    amc->spi2_model = "mx66u51235f";
-    amc->num_cs2   = 1;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
-    amc->i2c_init  = gb200nvl_bmc_i2c_init;
-    mc->default_ram_size = GB200NVL_BMC_RAM_SIZE;
-    aspeed_machine_class_init_cpus_defaults(mc);
-    aspeed_machine_ast2600_class_emmc_init(oc);
-}
-
 #define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
 /* Main SYSCLK frequency in Hz (200MHz) */
 #define SYSCLK_FRQ 200000000ULL
@@ -1011,11 +944,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_rainier_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_gb200nvl_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("catalina-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_gb200nvl.c b/hw/arm/aspeed_ast2600_gb200nvl.c
new file mode 100644
index 0000000000..ad9a10110b
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_gb200nvl.c
@@ -0,0 +1,111 @@
+/*
+ * Nvidia GB200NVL
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+
+/* GB200NVL hardware value */
+#define GB200NVL_BMC_HW_STRAP1 0x000000C0
+#define GB200NVL_BMC_HW_STRAP2 0x00000003
+#define GB200NVL_BMC_RAM_SIZE ASPEED_RAM_SIZE(1 * GiB)
+
+static const uint8_t gb200nvl_bmc_fruid[] = {
+    0x01, 0x00, 0x00, 0x01, 0x0b, 0x00, 0x00, 0xf3, 0x01, 0x0a, 0x19, 0x1f,
+    0x0f, 0xe6, 0xc6, 0x4e, 0x56, 0x49, 0x44, 0x49, 0x41, 0xc5, 0x50, 0x33,
+    0x38, 0x30, 0x39, 0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38,
+    0x30, 0x30, 0x31, 0x35, 0x30, 0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33,
+    0x38, 0x30, 0x39, 0x2d, 0x30, 0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30,
+    0xc0, 0x01, 0x01, 0xd6, 0x4d, 0x41, 0x43, 0x3a, 0x20, 0x33, 0x43, 0x3a,
+    0x36, 0x44, 0x3a, 0x36, 0x36, 0x3a, 0x31, 0x34, 0x3a, 0x43, 0x38, 0x3a,
+    0x37, 0x41, 0xc1, 0x3b, 0x01, 0x09, 0x19, 0xc6, 0x4e, 0x56, 0x49, 0x44,
+    0x49, 0x41, 0xc9, 0x50, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x42, 0x4d, 0x43,
+    0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x30,
+    0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30, 0xc4, 0x41, 0x45, 0x2e, 0x31,
+    0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38, 0x30, 0x30, 0x31,
+    0x35, 0x30, 0xc0, 0xc4, 0x76, 0x30, 0x2e, 0x31, 0xc1, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0xb4, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
+    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
+
+};
+static const size_t gb200nvl_bmc_fruid_len = sizeof(gb200nvl_bmc_fruid);
+
+static void gb200nvl_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[15] = {};
+    DeviceState *dev;
+    for (int i = 0; i < sizeof(i2c) / sizeof(i2c[0]); i++) {
+        if ((i == 11) || (i == 12) || (i == 13)) {
+            continue;
+        }
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    /* Bus 5 Expander */
+    aspeed_create_pca9554(soc, 4, 0x21);
+
+    /* Mux I2c Expanders */
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x71);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x72);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x73);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x75);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x76);
+    i2c_slave_create_simple(i2c[5], "pca9546", 0x77);
+
+    /* Bus 10 */
+    dev = DEVICE(aspeed_create_pca9554(soc, 9, 0x20));
+
+    /* Set FPGA_READY */
+    object_property_set_str(OBJECT(dev), "pin1", "high", &error_fatal);
+
+    aspeed_create_pca9554(soc, 9, 0x21);
+    at24c_eeprom_init(i2c[9], 0x50, 64 * KiB);
+    at24c_eeprom_init(i2c[9], 0x51, 64 * KiB);
+
+    /* Bus 11 */
+    at24c_eeprom_init_rom(i2c[10], 0x50, 256, gb200nvl_bmc_fruid,
+                          gb200nvl_bmc_fruid_len);
+}
+
+static void aspeed_machine_gb200nvl_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Nvidia GB200NVL BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = GB200NVL_BMC_HW_STRAP1;
+    amc->hw_strap2 = GB200NVL_BMC_HW_STRAP2;
+    amc->fmc_model = "mx66u51235f";
+    amc->spi_model = "mx66u51235f";
+    amc->num_cs    = 2;
+
+    amc->spi2_model = "mx66u51235f";
+    amc->num_cs2   = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON;
+    amc->i2c_init  = gb200nvl_bmc_i2c_init;
+    mc->default_ram_size = GB200NVL_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+}
+
+static const TypeInfo aspeed_ast2600_gb200nvl_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("gb200nvl-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_gb200nvl_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_gb200nvl_types)
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
index 53c9b0d56f..85a2aa4036 100644
--- a/hw/arm/aspeed_eeprom.c
+++ b/hw/arm/aspeed_eeprom.c
@@ -49,26 +49,6 @@ const uint8_t rainier_bmc_fruid[] = {
     0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00,
 };
 
-const uint8_t gb200nvl_bmc_fruid[] = {
-    0x01, 0x00, 0x00, 0x01, 0x0b, 0x00, 0x00, 0xf3, 0x01, 0x0a, 0x19, 0x1f,
-    0x0f, 0xe6, 0xc6, 0x4e, 0x56, 0x49, 0x44, 0x49, 0x41, 0xc5, 0x50, 0x33,
-    0x38, 0x30, 0x39, 0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38,
-    0x30, 0x30, 0x31, 0x35, 0x30, 0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33,
-    0x38, 0x30, 0x39, 0x2d, 0x30, 0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30,
-    0xc0, 0x01, 0x01, 0xd6, 0x4d, 0x41, 0x43, 0x3a, 0x20, 0x33, 0x43, 0x3a,
-    0x36, 0x44, 0x3a, 0x36, 0x36, 0x3a, 0x31, 0x34, 0x3a, 0x43, 0x38, 0x3a,
-    0x37, 0x41, 0xc1, 0x3b, 0x01, 0x09, 0x19, 0xc6, 0x4e, 0x56, 0x49, 0x44,
-    0x49, 0x41, 0xc9, 0x50, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x42, 0x4d, 0x43,
-    0xd2, 0x36, 0x39, 0x39, 0x2d, 0x31, 0x33, 0x38, 0x30, 0x39, 0x2d, 0x30,
-    0x34, 0x30, 0x34, 0x2d, 0x36, 0x30, 0x30, 0xc4, 0x41, 0x45, 0x2e, 0x31,
-    0xcd, 0x31, 0x35, 0x38, 0x33, 0x33, 0x32, 0x34, 0x38, 0x30, 0x30, 0x31,
-    0x35, 0x30, 0xc0, 0xc4, 0x76, 0x30, 0x2e, 0x31, 0xc1, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0xb4, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff,
-    0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff
-
-};
-
 const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
 const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
-const size_t gb200nvl_bmc_fruid_len = sizeof(gb200nvl_bmc_fruid);
 
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
index 7207bb2cbd..86b97e4c6d 100644
--- a/hw/arm/aspeed_eeprom.h
+++ b/hw/arm/aspeed_eeprom.h
@@ -12,7 +12,4 @@ extern const size_t rainier_bb_fruid_len;
 extern const uint8_t rainier_bmc_fruid[];
 extern const size_t rainier_bmc_fruid_len;
 
-extern const uint8_t gb200nvl_bmc_fruid[];
-extern const size_t gb200nvl_bmc_fruid_len;
-
 #endif
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 588a72bdf2..d229e48500 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -60,6 +60,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_bletchley.c',
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
+  'aspeed_ast2600_gb200nvl.c',
   'aspeed_ast2600_qcom-dc-scm-v1.c',
   'aspeed_ast2600_qcom-firework.c',
   'aspeed_ast10x0.c',

From e777cbaf0b3798dbc12e4ed48b05f426a7f21697 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:03 +0800
Subject: [PATCH 2007/2396] hw/arm/aspeed: Split Rainier machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the IBM Rainier BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_rainier.c.

This refactor continues the modularization effort for Aspeed platform
support, placing each board’s logic and FRUID data in its own dedicated
source file. It improves maintainability, readability, and simplifies
future development for new Aspeed-based systems without cluttering
aspeed.c.

Key updates include:
- Removed RAINIER_BMC_HW_STRAP1 and RAINIER_BMC_HW_STRAP2 macro definitions.
- Moved rainier_bmc_i2c_init() and all related I2C device setup code
  into the new aspeed_ast2600_rainier.c file.
- Moved aspeed_machine_rainier_class_init() and type registration logic
  out of aspeed.c.
- Deleted aspeed_eeprom.h and aspeed_eeprom.c; their FRUID data and
  length definitions are now handled directly in the new Rainier file.
- Added aspeed_ast2600_rainier.c to the Meson build system (meson.build).

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-26-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                 | 133 ---------------------
 hw/arm/aspeed_ast2600_rainier.c | 198 ++++++++++++++++++++++++++++++++
 hw/arm/aspeed_eeprom.c          |  54 ---------
 hw/arm/aspeed_eeprom.h          |  15 ---
 hw/arm/meson.build              |   2 +-
 5 files changed, 199 insertions(+), 203 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_rainier.c
 delete mode 100644 hw/arm/aspeed_eeprom.c
 delete mode 100644 hw/arm/aspeed_eeprom.h

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 77a4095f7d..56600be916 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -14,7 +14,6 @@
 #include "hw/arm/boot.h"
 #include "hw/arm/aspeed.h"
 #include "hw/arm/aspeed_soc.h"
-#include "hw/arm/aspeed_eeprom.h"
 #include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
 #include "hw/i2c/i2c_mux_pca954x.h"
@@ -48,10 +47,6 @@ static struct arm_boot_info aspeed_board_binfo = {
 #define AST2700_EVB_HW_STRAP2 0x00000700
 #endif
 
-/* Rainier hardware value: (QEMU prototype) */
-#define RAINIER_BMC_HW_STRAP1 (0x00422016 | SCU_AST2600_HW_STRAP_BOOT_SRC_EMMC)
-#define RAINIER_BMC_HW_STRAP2 0x80000848
-
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -300,110 +295,6 @@ I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
                             TYPE_PCA9554, addr);
 }
 
-static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    I2CSlave *i2c_mux;
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 0), 0x51, 32 * KiB);
-
-    aspeed_create_pca9552(soc, 3, 0x61);
-
-    /* The rainier expects a TMP275 but a TMP105 is compatible */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
-                     0x49);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
-                     0x4a);
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4),
-                                      "pca9546", 0x70);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x52, 64 * KiB);
-    aspeed_create_pca9552(soc, 4, 0x60);
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
-                     0x49);
-    aspeed_create_pca9552(soc, 5, 0x60);
-    aspeed_create_pca9552(soc, 5, 0x61);
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5),
-                                      "pca9546", 0x70);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
-                     0x4a);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
-                     0x4b);
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6),
-                                      "pca9546", 0x70);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x50, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 3), 0x51, 64 * KiB);
-
-    aspeed_create_pca9552(soc, 7, 0x30);
-    aspeed_create_pca9552(soc, 7, 0x31);
-    aspeed_create_pca9552(soc, 7, 0x32);
-    aspeed_create_pca9552(soc, 7, 0x33);
-    aspeed_create_pca9552(soc, 7, 0x60);
-    aspeed_create_pca9552(soc, 7, 0x61);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "dps310", 0x76);
-    /* Bus 7: TODO si7021-a20@20 */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "max31785", 0x52);
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50, 64 * KiB);
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x51, 64 * KiB);
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), TYPE_TMP105,
-                     0x4a);
-    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x50,
-                          64 * KiB, rainier_bb_fruid, rainier_bb_fruid_len);
-    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51,
-                          64 * KiB, rainier_bmc_fruid, rainier_bmc_fruid_len);
-    aspeed_create_pca9552(soc, 8, 0x60);
-    aspeed_create_pca9552(soc, 8, 0x61);
-    /* Bus 8: ucd90320@11 */
-    /* Bus 8: ucd90320@b */
-    /* Bus 8: ucd90320@c */
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp423", 0x4c);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp423", 0x4d);
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 9), 0x50, 128 * KiB);
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 10), "tmp423", 0x4c);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 10), "tmp423", 0x4d);
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 10), 0x50, 128 * KiB);
-
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_TMP105,
-                     0x48);
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_TMP105,
-                     0x49);
-    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11),
-                                      "pca9546", 0x70);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
-    aspeed_create_pca9552(soc, 11, 0x60);
-
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 13), 0x50, 64 * KiB);
-    aspeed_create_pca9552(soc, 13, 0x60);
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 14), 0x50, 64 * KiB);
-    aspeed_create_pca9552(soc, 14, 0x60);
-
-    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 15), 0x50, 64 * KiB);
-    aspeed_create_pca9552(soc, 15, 0x60);
-}
-
 #define TYPE_LM75 TYPE_TMP105
 #define TYPE_TMP75 TYPE_TMP105
 #define TYPE_TMP421 "tmp421"
@@ -760,25 +651,6 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 };
 
-static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "IBM Rainier BMC (Cortex-A7)";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = RAINIER_BMC_HW_STRAP1;
-    amc->hw_strap2 = RAINIER_BMC_HW_STRAP2;
-    amc->fmc_model = "mx66l1g45g";
-    amc->spi_model = "mx66l1g45g";
-    amc->num_cs    = 2;
-    amc->macs_mask  = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
-    amc->i2c_init  = rainier_bmc_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-    aspeed_machine_ast2600_class_emmc_init(oc);
-};
-
 static void aspeed_machine_catalina_class_init(ObjectClass *oc,
                                                const void *data)
 {
@@ -939,11 +811,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("rainier-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_rainier_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name          = MACHINE_TYPE_NAME("catalina-bmc"),
         .parent        = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_rainier.c b/hw/arm/aspeed_ast2600_rainier.c
new file mode 100644
index 0000000000..8f0a412ddc
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_rainier.c
@@ -0,0 +1,198 @@
+/*
+ * IBM Rainier
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/nvram/eeprom_at24c.h"
+#include "hw/i2c/i2c_mux_pca954x.h"
+#include "hw/sensor/tmp105.h"
+
+/* Rainier hardware value: (QEMU prototype) */
+#define RAINIER_BMC_HW_STRAP1 (0x00422016 | SCU_AST2600_HW_STRAP_BOOT_SRC_EMMC)
+#define RAINIER_BMC_HW_STRAP2 0x80000848
+
+static const uint8_t rainier_bb_fruid[] = {
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
+    0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
+    0x01, 0x00, 0x50, 0x54, 0x0e, 0x56, 0x54, 0x4f, 0x43, 0x00, 0x00, 0x37,
+    0x00, 0x4a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x08, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x52, 0x54,
+    0x04, 0x56, 0x54, 0x4f, 0x43, 0x50, 0x54, 0x38, 0x56, 0x49, 0x4e, 0x49,
+    0x00, 0x00, 0x81, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x53,
+    0x59, 0x53, 0x00, 0x00, 0xbb, 0x00, 0x27, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x56, 0x43, 0x45, 0x4e, 0x00, 0x00, 0xe2, 0x00, 0x27, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x56, 0x53, 0x42, 0x50, 0x00, 0x00, 0x09, 0x01, 0x19, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x01, 0x00, 0x00, 0x00, 0x36, 0x00,
+    0x52, 0x54, 0x04, 0x56, 0x49, 0x4e, 0x49, 0x44, 0x52, 0x04, 0x44, 0x45,
+    0x53, 0x43, 0x48, 0x57, 0x02, 0x30, 0x31, 0x43, 0x43, 0x04, 0x33, 0x34,
+    0x35, 0x36, 0x46, 0x4e, 0x04, 0x46, 0x52, 0x34, 0x39, 0x53, 0x4e, 0x04,
+    0x53, 0x52, 0x31, 0x32, 0x50, 0x4e, 0x04, 0x50, 0x52, 0x39, 0x39, 0x50,
+    0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x52, 0x54,
+    0x04, 0x56, 0x53, 0x59, 0x53, 0x53, 0x45, 0x07, 0x49, 0x42, 0x4d, 0x53,
+    0x59, 0x53, 0x31, 0x54, 0x4d, 0x08, 0x32, 0x32, 0x32, 0x32, 0x2d, 0x32,
+    0x32, 0x32, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23,
+    0x00, 0x52, 0x54, 0x04, 0x56, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x07, 0x31,
+    0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x46, 0x43, 0x08, 0x31, 0x31, 0x31,
+    0x31, 0x2d, 0x31, 0x31, 0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x15, 0x00, 0x52, 0x54, 0x04, 0x56, 0x53, 0x42, 0x50, 0x49,
+    0x4d, 0x04, 0x50, 0x00, 0x10, 0x01, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00,
+    0x00, 0x00,
+};
+static const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
+
+/* Rainier BMC FRU */
+static const uint8_t rainier_bmc_fruid[] = {
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
+    0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
+    0x01, 0x00, 0x50, 0x54, 0x0e, 0x56, 0x54, 0x4f, 0x43, 0x00, 0x00, 0x37,
+    0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x08, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x52, 0x54,
+    0x04, 0x56, 0x54, 0x4f, 0x43, 0x50, 0x54, 0x0e, 0x56, 0x49, 0x4e, 0x49,
+    0x00, 0x00, 0x57, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46,
+    0x01, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x52, 0x54, 0x04, 0x56, 0x49, 0x4e,
+    0x49, 0x44, 0x52, 0x04, 0x44, 0x45, 0x53, 0x43, 0x48, 0x57, 0x02, 0x30,
+    0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+static const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
+
+static void rainier_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    I2CSlave *i2c_mux;
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 0), 0x51, 32 * KiB);
+
+    aspeed_create_pca9552(soc, 3, 0x61);
+
+    /* The rainier expects a TMP275 but a TMP105 is compatible */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
+                     0x49);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4), TYPE_TMP105,
+                     0x4a);
+    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 4),
+                                      "pca9546", 0x70);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x52, 64 * KiB);
+    aspeed_create_pca9552(soc, 4, 0x60);
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5), TYPE_TMP105,
+                     0x49);
+    aspeed_create_pca9552(soc, 5, 0x60);
+    aspeed_create_pca9552(soc, 5, 0x61);
+    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 5),
+                                      "pca9546", 0x70);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
+                     0x4a);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6), TYPE_TMP105,
+                     0x4b);
+    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 6),
+                                      "pca9546", 0x70);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 2), 0x50, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 3), 0x51, 64 * KiB);
+
+    aspeed_create_pca9552(soc, 7, 0x30);
+    aspeed_create_pca9552(soc, 7, 0x31);
+    aspeed_create_pca9552(soc, 7, 0x32);
+    aspeed_create_pca9552(soc, 7, 0x33);
+    aspeed_create_pca9552(soc, 7, 0x60);
+    aspeed_create_pca9552(soc, 7, 0x61);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "dps310", 0x76);
+    /* Bus 7: TODO si7021-a20@20 */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 7), "max31785", 0x52);
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50, 64 * KiB);
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 7), 0x51, 64 * KiB);
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8), TYPE_TMP105,
+                     0x4a);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x50,
+                          64 * KiB, rainier_bb_fruid, rainier_bb_fruid_len);
+    at24c_eeprom_init_rom(aspeed_i2c_get_bus(&soc->i2c, 8), 0x51,
+                          64 * KiB, rainier_bmc_fruid, rainier_bmc_fruid_len);
+    aspeed_create_pca9552(soc, 8, 0x60);
+    aspeed_create_pca9552(soc, 8, 0x61);
+    /* Bus 8: ucd90320@11 */
+    /* Bus 8: ucd90320@b */
+    /* Bus 8: ucd90320@c */
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp423", 0x4c);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 9), "tmp423", 0x4d);
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 9), 0x50, 128 * KiB);
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 10), "tmp423", 0x4c);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 10), "tmp423", 0x4d);
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 10), 0x50, 128 * KiB);
+
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_TMP105,
+                     0x48);
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11), TYPE_TMP105,
+                     0x49);
+    i2c_mux = i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 11),
+                                      "pca9546", 0x70);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 0), 0x50, 64 * KiB);
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x51, 64 * KiB);
+    aspeed_create_pca9552(soc, 11, 0x60);
+
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 13), 0x50, 64 * KiB);
+    aspeed_create_pca9552(soc, 13, 0x60);
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 14), 0x50, 64 * KiB);
+    aspeed_create_pca9552(soc, 14, 0x60);
+
+    at24c_eeprom_init(aspeed_i2c_get_bus(&soc->i2c, 15), 0x50, 64 * KiB);
+    aspeed_create_pca9552(soc, 15, 0x60);
+}
+
+static void aspeed_machine_rainier_class_init(ObjectClass *oc, const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "IBM Rainier BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = RAINIER_BMC_HW_STRAP1;
+    amc->hw_strap2 = RAINIER_BMC_HW_STRAP2;
+    amc->fmc_model = "mx66l1g45g";
+    amc->spi_model = "mx66l1g45g";
+    amc->num_cs    = 2;
+    amc->macs_mask  = ASPEED_MAC2_ON | ASPEED_MAC3_ON;
+    amc->i2c_init  = rainier_bmc_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+};
+
+static const TypeInfo aspeed_ast2600_rainier_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("rainier-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_rainier_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_rainier_types)
diff --git a/hw/arm/aspeed_eeprom.c b/hw/arm/aspeed_eeprom.c
deleted file mode 100644
index 85a2aa4036..0000000000
--- a/hw/arm/aspeed_eeprom.c
+++ /dev/null
@@ -1,54 +0,0 @@
-/*
- * Copyright (c) Meta Platforms, Inc. and affiliates.
- *
- * SPDX-License-Identifier: GPL-2.0-only
- */
-
-#include "qemu/osdep.h"
-#include "aspeed_eeprom.h"
-
-const uint8_t rainier_bb_fruid[] = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
-    0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
-    0x01, 0x00, 0x50, 0x54, 0x0e, 0x56, 0x54, 0x4f, 0x43, 0x00, 0x00, 0x37,
-    0x00, 0x4a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x08, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x00, 0x52, 0x54,
-    0x04, 0x56, 0x54, 0x4f, 0x43, 0x50, 0x54, 0x38, 0x56, 0x49, 0x4e, 0x49,
-    0x00, 0x00, 0x81, 0x00, 0x3a, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x53,
-    0x59, 0x53, 0x00, 0x00, 0xbb, 0x00, 0x27, 0x00, 0x00, 0x00, 0x00, 0x00,
-    0x56, 0x43, 0x45, 0x4e, 0x00, 0x00, 0xe2, 0x00, 0x27, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x56, 0x53, 0x42, 0x50, 0x00, 0x00, 0x09, 0x01, 0x19, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x01, 0x00, 0x00, 0x00, 0x36, 0x00,
-    0x52, 0x54, 0x04, 0x56, 0x49, 0x4e, 0x49, 0x44, 0x52, 0x04, 0x44, 0x45,
-    0x53, 0x43, 0x48, 0x57, 0x02, 0x30, 0x31, 0x43, 0x43, 0x04, 0x33, 0x34,
-    0x35, 0x36, 0x46, 0x4e, 0x04, 0x46, 0x52, 0x34, 0x39, 0x53, 0x4e, 0x04,
-    0x53, 0x52, 0x31, 0x32, 0x50, 0x4e, 0x04, 0x50, 0x52, 0x39, 0x39, 0x50,
-    0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23, 0x00, 0x52, 0x54,
-    0x04, 0x56, 0x53, 0x59, 0x53, 0x53, 0x45, 0x07, 0x49, 0x42, 0x4d, 0x53,
-    0x59, 0x53, 0x31, 0x54, 0x4d, 0x08, 0x32, 0x32, 0x32, 0x32, 0x2d, 0x32,
-    0x32, 0x32, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x23,
-    0x00, 0x52, 0x54, 0x04, 0x56, 0x43, 0x45, 0x4e, 0x53, 0x45, 0x07, 0x31,
-    0x32, 0x33, 0x34, 0x35, 0x36, 0x37, 0x46, 0x43, 0x08, 0x31, 0x31, 0x31,
-    0x31, 0x2d, 0x31, 0x31, 0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00,
-    0x00, 0x00, 0x15, 0x00, 0x52, 0x54, 0x04, 0x56, 0x53, 0x42, 0x50, 0x49,
-    0x4d, 0x04, 0x50, 0x00, 0x10, 0x01, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00,
-    0x00, 0x00,
-};
-
-/* Rainier BMC FRU */
-const uint8_t rainier_bmc_fruid[] = {
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x84,
-    0x28, 0x00, 0x52, 0x54, 0x04, 0x56, 0x48, 0x44, 0x52, 0x56, 0x44, 0x02,
-    0x01, 0x00, 0x50, 0x54, 0x0e, 0x56, 0x54, 0x4f, 0x43, 0x00, 0x00, 0x37,
-    0x00, 0x20, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46, 0x08, 0x00, 0x00,
-    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x1c, 0x00, 0x52, 0x54,
-    0x04, 0x56, 0x54, 0x4f, 0x43, 0x50, 0x54, 0x0e, 0x56, 0x49, 0x4e, 0x49,
-    0x00, 0x00, 0x57, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x00, 0x00, 0x50, 0x46,
-    0x01, 0x00, 0x00, 0x00, 0x1a, 0x00, 0x52, 0x54, 0x04, 0x56, 0x49, 0x4e,
-    0x49, 0x44, 0x52, 0x04, 0x44, 0x45, 0x53, 0x43, 0x48, 0x57, 0x02, 0x30,
-    0x31, 0x50, 0x46, 0x04, 0x00, 0x00, 0x00, 0x00, 0x00,
-};
-
-const size_t rainier_bb_fruid_len = sizeof(rainier_bb_fruid);
-const size_t rainier_bmc_fruid_len = sizeof(rainier_bmc_fruid);
-
diff --git a/hw/arm/aspeed_eeprom.h b/hw/arm/aspeed_eeprom.h
deleted file mode 100644
index 86b97e4c6d..0000000000
--- a/hw/arm/aspeed_eeprom.h
+++ /dev/null
@@ -1,15 +0,0 @@
-/*
- * Copyright (c) Meta Platforms, Inc. and affiliates.
- *
- * SPDX-License-Identifier: GPL-2.0-only
- */
-
-#ifndef ASPEED_EEPROM_H
-#define ASPEED_EEPROM_H
-
-extern const uint8_t rainier_bb_fruid[];
-extern const size_t rainier_bb_fruid_len;
-extern const uint8_t rainier_bmc_fruid[];
-extern const size_t rainier_bmc_fruid_len;
-
-#endif
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index d229e48500..d7e4d87dc8 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -63,8 +63,8 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_gb200nvl.c',
   'aspeed_ast2600_qcom-dc-scm-v1.c',
   'aspeed_ast2600_qcom-firework.c',
+  'aspeed_ast2600_rainier.c',
   'aspeed_ast10x0.c',
-  'aspeed_eeprom.c',
   'fby35.c'))
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',

From cd8413425846d22d704e85eec98f70a5925fbaf7 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:04 +0800
Subject: [PATCH 2008/2396] hw/arm/aspeed: Split Catalina machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Facebook Catalina BMC machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_catalina.c.

This refactor continues the ongoing modularization of Aspeed platform
support, organizing each board’s logic into its own dedicated source file.
It improves maintainability, readability, and simplifies future
development of new BMC platforms without cluttering aspeed.c.

Key updates include:
- Moved CATALINA_BMC_HW_STRAP1 and CATALINA_BMC_HW_STRAP2 macro definitions
  into the new file.
- Moved catalina_bmc_i2c_init() and all Catalina-specific I2C device setup
  into the new aspeed_ast2600_catalina.c file.
- Moved aspeed_machine_catalina_class_init() and type registration logic
  out of aspeed.c.
- Cleaned up all Catalina-specific code and macros from aspeed.c.
- Added aspeed_ast2600_catalina.c to the Meson build system (meson.build).

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-27-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c                  | 205 ----------------------------
 hw/arm/aspeed_ast2600_catalina.c | 225 +++++++++++++++++++++++++++++++
 hw/arm/meson.build               |   1 +
 3 files changed, 226 insertions(+), 205 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_catalina.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 56600be916..ad3bb8cbac 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -16,11 +16,9 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
-#include "hw/i2c/i2c_mux_pca954x.h"
 #include "hw/i2c/smbus_eeprom.h"
 #include "hw/gpio/pca9552.h"
 #include "hw/gpio/pca9554.h"
-#include "hw/nvram/eeprom_at24c.h"
 #include "hw/sensor/tmp105.h"
 #include "hw/misc/led.h"
 #include "hw/qdev-properties.h"
@@ -295,184 +293,6 @@ I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr)
                             TYPE_PCA9554, addr);
 }
 
-#define TYPE_LM75 TYPE_TMP105
-#define TYPE_TMP75 TYPE_TMP105
-#define TYPE_TMP421 "tmp421"
-#define TYPE_DS1338 "ds1338"
-
-/* Catalina hardware value */
-#define CATALINA_BMC_HW_STRAP1 0x00002002
-#define CATALINA_BMC_HW_STRAP2 0x00000800
-
-#define CATALINA_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
-
-static void catalina_bmc_i2c_init(AspeedMachineState *bmc)
-{
-    /* Reference from v6.16-rc2 aspeed-bmc-facebook-catalina.dts */
-
-    AspeedSoCState *soc = bmc->soc;
-    I2CBus *i2c[16] = {};
-    I2CSlave *i2c_mux;
-
-    /* busses 0-15 are all used. */
-    for (int i = 0; i < ARRAY_SIZE(i2c); i++) {
-        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
-    }
-
-    /* &i2c0 */
-    /* i2c-mux@71 (PCA9546) on i2c0 */
-    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x71);
-
-    /* i2c-mux@72 (PCA9546) on i2c0 */
-    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x72);
-
-    /* i2c0mux1ch1 */
-    /* io_expander7 - pca9535@20 */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
-                            TYPE_PCA9552, 0x20);
-    /* eeprom@50 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
-
-    /* i2c-mux@73 (PCA9546) on i2c0 */
-    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x73);
-
-    /* i2c-mux@75 (PCA9546) on i2c0 */
-    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x75);
-
-    /* i2c-mux@76 (PCA9546) on i2c0 */
-    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x76);
-
-    /* i2c0mux4ch1 */
-    /* io_expander8 - pca9535@21 */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
-                            TYPE_PCA9552, 0x21);
-    /* eeprom@50 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
-
-    /* i2c-mux@77 (PCA9546) on i2c0 */
-    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x77);
-
-
-    /* &i2c1 */
-    /* i2c-mux@70 (PCA9548) on i2c1 */
-    i2c_mux = i2c_slave_create_simple(i2c[1], TYPE_PCA9548, 0x70);
-    /* i2c1mux0ch0 */
-    /* ina238@41 - no model */
-    /* ina238@42 - no model */
-    /* ina238@44 - no model */
-    /* i2c1mux0ch1 */
-    /* ina238@41 - no model */
-    /* ina238@43 - no model */
-    /* i2c1mux0ch4 */
-    /* ltc4287@42 - no model */
-    /* ltc4287@43 - no model */
-
-    /* i2c1mux0ch5 */
-    /* eeprom@54 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 5), 0x54, 8 * KiB);
-    /* tpm75@4f */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 5), TYPE_TMP75, 0x4f);
-
-    /* i2c1mux0ch6 */
-    /* io_expander5 - pca9554@27 */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
-                            TYPE_PCA9554, 0x27);
-    /* io_expander6 - pca9555@25 */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
-                            TYPE_PCA9552, 0x25);
-    /* eeprom@51 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x51, 8 * KiB);
-
-    /* i2c1mux0ch7 */
-    /* eeprom@53 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 7), 0x53, 8 * KiB);
-    /* temperature-sensor@4b - tmp75 */
-    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 7), TYPE_TMP75, 0x4b);
-
-    /* &i2c2 */
-    /* io_expander0 - pca9555@20 */
-    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x20);
-    /* io_expander0 - pca9555@21 */
-    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x21);
-    /* io_expander0 - pca9555@27 */
-    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x27);
-    /* eeprom@50 */
-    at24c_eeprom_init(i2c[2], 0x50, 8 * KiB);
-    /* eeprom@51 */
-    at24c_eeprom_init(i2c[2], 0x51, 8 * KiB);
-
-    /* &i2c5 */
-    /* i2c-mux@70 (PCA9548) on i2c5 */
-    i2c_mux = i2c_slave_create_simple(i2c[5], TYPE_PCA9548, 0x70);
-    /* i2c5mux0ch6 */
-    /* eeprom@52 */
-    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x52, 8 * KiB);
-    /* i2c5mux0ch7 */
-    /* ina230@40 - no model */
-    /* ina230@41 - no model */
-    /* ina230@44 - no model */
-    /* ina230@45 - no model */
-
-    /* &i2c6 */
-    /* io_expander3 - pca9555@21 */
-    i2c_slave_create_simple(i2c[6], TYPE_PCA9552, 0x21);
-    /* rtc@6f - nct3018y */
-    i2c_slave_create_simple(i2c[6], TYPE_DS1338, 0x6f);
-
-    /* &i2c9 */
-    /* io_expander4 - pca9555@4f */
-    i2c_slave_create_simple(i2c[9], TYPE_PCA9552, 0x4f);
-    /* temperature-sensor@4b - tpm75 */
-    i2c_slave_create_simple(i2c[9], TYPE_TMP75, 0x4b);
-    /* eeprom@50 */
-    at24c_eeprom_init(i2c[9], 0x50, 8 * KiB);
-    /* eeprom@56 */
-    at24c_eeprom_init(i2c[9], 0x56, 8 * KiB);
-
-    /* &i2c10 */
-    /* temperature-sensor@1f - tpm421 */
-    i2c_slave_create_simple(i2c[10], TYPE_TMP421, 0x1f);
-    /* eeprom@50 */
-    at24c_eeprom_init(i2c[10], 0x50, 8 * KiB);
-
-    /* &i2c11 */
-    /* ssif-bmc@10 - no model */
-
-    /* &i2c12 */
-    /* eeprom@50 */
-    at24c_eeprom_init(i2c[12], 0x50, 8 * KiB);
-
-    /* &i2c13 */
-    /* eeprom@50 */
-    at24c_eeprom_init(i2c[13], 0x50, 8 * KiB);
-    /* eeprom@54 */
-    at24c_eeprom_init(i2c[13], 0x54, 256);
-    /* eeprom@55 */
-    at24c_eeprom_init(i2c[13], 0x55, 256);
-    /* eeprom@57 */
-    at24c_eeprom_init(i2c[13], 0x57, 256);
-
-    /* &i2c14 */
-    /* io_expander9 - pca9555@10 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x10);
-    /* io_expander10 - pca9555@11 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x11);
-    /* io_expander11 - pca9555@12 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x12);
-    /* io_expander12 - pca9555@13 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x13);
-    /* io_expander13 - pca9555@14 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x14);
-    /* io_expander14 - pca9555@15 */
-    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x15);
-
-    /* &i2c15 */
-    /* temperature-sensor@1f - tmp421 */
-    i2c_slave_create_simple(i2c[15], TYPE_TMP421, 0x1f);
-    /* eeprom@52 */
-    at24c_eeprom_init(i2c[15], 0x52, 8 * KiB);
-}
-
 static bool aspeed_get_mmio_exec(Object *obj, Error **errp)
 {
     return ASPEED_MACHINE(obj)->mmio_exec;
@@ -651,26 +471,6 @@ static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
     aspeed_machine_ast2600_class_emmc_init(oc);
 };
 
-static void aspeed_machine_catalina_class_init(ObjectClass *oc,
-                                               const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Facebook Catalina BMC (Cortex-A7)";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = CATALINA_BMC_HW_STRAP1;
-    amc->hw_strap2 = CATALINA_BMC_HW_STRAP2;
-    amc->fmc_model = "w25q01jvq";
-    amc->spi_model = NULL;
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC2_ON;
-    amc->i2c_init  = catalina_bmc_i2c_init;
-    mc->default_ram_size = CATALINA_BMC_RAM_SIZE;
-    aspeed_machine_class_init_cpus_defaults(mc);
-    aspeed_machine_ast2600_class_emmc_init(oc);
-}
-
 #define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
 /* Main SYSCLK frequency in Hz (200MHz) */
 #define SYSCLK_FRQ 200000000ULL
@@ -811,11 +611,6 @@ static const TypeInfo aspeed_machine_types[] = {
         .parent        = TYPE_ASPEED_MACHINE,
         .class_init    = aspeed_machine_ast2600_evb_class_init,
         .interfaces    = arm_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("catalina-bmc"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_catalina_class_init,
-        .interfaces    = arm_machine_interfaces,
     }, {
         .name           = MACHINE_TYPE_NAME("ast1030-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
diff --git a/hw/arm/aspeed_ast2600_catalina.c b/hw/arm/aspeed_ast2600_catalina.c
new file mode 100644
index 0000000000..91977a4d3c
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_catalina.c
@@ -0,0 +1,225 @@
+/*
+ * Facebook Catalina
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/i2c_mux_pca954x.h"
+#include "hw/gpio/pca9552.h"
+#include "hw/gpio/pca9554.h"
+#include "hw/nvram/eeprom_at24c.h"
+#include "hw/sensor/tmp105.h"
+
+/* Catalina hardware value */
+#define CATALINA_BMC_HW_STRAP1 0x00002002
+#define CATALINA_BMC_HW_STRAP2 0x00000800
+#define CATALINA_BMC_RAM_SIZE ASPEED_RAM_SIZE(2 * GiB)
+
+#define TYPE_TMP75 TYPE_TMP105
+#define TYPE_TMP421 "tmp421"
+#define TYPE_DS1338 "ds1338"
+
+static void catalina_bmc_i2c_init(AspeedMachineState *bmc)
+{
+    /* Reference from v6.16-rc2 aspeed-bmc-facebook-catalina.dts */
+
+    AspeedSoCState *soc = bmc->soc;
+    I2CBus *i2c[16] = {};
+    I2CSlave *i2c_mux;
+
+    /* busses 0-15 are all used. */
+    for (int i = 0; i < ARRAY_SIZE(i2c); i++) {
+        i2c[i] = aspeed_i2c_get_bus(&soc->i2c, i);
+    }
+
+    /* &i2c0 */
+    /* i2c-mux@71 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x71);
+
+    /* i2c-mux@72 (PCA9546) on i2c0 */
+    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x72);
+
+    /* i2c0mux1ch1 */
+    /* io_expander7 - pca9535@20 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
+                            TYPE_PCA9552, 0x20);
+    /* eeprom@50 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
+
+    /* i2c-mux@73 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x73);
+
+    /* i2c-mux@75 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x75);
+
+    /* i2c-mux@76 (PCA9546) on i2c0 */
+    i2c_mux = i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x76);
+
+    /* i2c0mux4ch1 */
+    /* io_expander8 - pca9535@21 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 1),
+                            TYPE_PCA9552, 0x21);
+    /* eeprom@50 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 1), 0x50, 8 * KiB);
+
+    /* i2c-mux@77 (PCA9546) on i2c0 */
+    i2c_slave_create_simple(i2c[0], TYPE_PCA9546, 0x77);
+
+
+    /* &i2c1 */
+    /* i2c-mux@70 (PCA9548) on i2c1 */
+    i2c_mux = i2c_slave_create_simple(i2c[1], TYPE_PCA9548, 0x70);
+    /* i2c1mux0ch0 */
+    /* ina238@41 - no model */
+    /* ina238@42 - no model */
+    /* ina238@44 - no model */
+    /* i2c1mux0ch1 */
+    /* ina238@41 - no model */
+    /* ina238@43 - no model */
+    /* i2c1mux0ch4 */
+    /* ltc4287@42 - no model */
+    /* ltc4287@43 - no model */
+
+    /* i2c1mux0ch5 */
+    /* eeprom@54 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 5), 0x54, 8 * KiB);
+    /* tpm75@4f */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 5), TYPE_TMP75, 0x4f);
+
+    /* i2c1mux0ch6 */
+    /* io_expander5 - pca9554@27 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
+                            TYPE_PCA9554, 0x27);
+    /* io_expander6 - pca9555@25 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 6),
+                            TYPE_PCA9552, 0x25);
+    /* eeprom@51 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x51, 8 * KiB);
+
+    /* i2c1mux0ch7 */
+    /* eeprom@53 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 7), 0x53, 8 * KiB);
+    /* temperature-sensor@4b - tmp75 */
+    i2c_slave_create_simple(pca954x_i2c_get_bus(i2c_mux, 7), TYPE_TMP75, 0x4b);
+
+    /* &i2c2 */
+    /* io_expander0 - pca9555@20 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x20);
+    /* io_expander0 - pca9555@21 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x21);
+    /* io_expander0 - pca9555@27 */
+    i2c_slave_create_simple(i2c[2], TYPE_PCA9552, 0x27);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[2], 0x50, 8 * KiB);
+    /* eeprom@51 */
+    at24c_eeprom_init(i2c[2], 0x51, 8 * KiB);
+
+    /* &i2c5 */
+    /* i2c-mux@70 (PCA9548) on i2c5 */
+    i2c_mux = i2c_slave_create_simple(i2c[5], TYPE_PCA9548, 0x70);
+    /* i2c5mux0ch6 */
+    /* eeprom@52 */
+    at24c_eeprom_init(pca954x_i2c_get_bus(i2c_mux, 6), 0x52, 8 * KiB);
+    /* i2c5mux0ch7 */
+    /* ina230@40 - no model */
+    /* ina230@41 - no model */
+    /* ina230@44 - no model */
+    /* ina230@45 - no model */
+
+    /* &i2c6 */
+    /* io_expander3 - pca9555@21 */
+    i2c_slave_create_simple(i2c[6], TYPE_PCA9552, 0x21);
+    /* rtc@6f - nct3018y */
+    i2c_slave_create_simple(i2c[6], TYPE_DS1338, 0x6f);
+
+    /* &i2c9 */
+    /* io_expander4 - pca9555@4f */
+    i2c_slave_create_simple(i2c[9], TYPE_PCA9552, 0x4f);
+    /* temperature-sensor@4b - tpm75 */
+    i2c_slave_create_simple(i2c[9], TYPE_TMP75, 0x4b);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[9], 0x50, 8 * KiB);
+    /* eeprom@56 */
+    at24c_eeprom_init(i2c[9], 0x56, 8 * KiB);
+
+    /* &i2c10 */
+    /* temperature-sensor@1f - tpm421 */
+    i2c_slave_create_simple(i2c[10], TYPE_TMP421, 0x1f);
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[10], 0x50, 8 * KiB);
+
+    /* &i2c11 */
+    /* ssif-bmc@10 - no model */
+
+    /* &i2c12 */
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[12], 0x50, 8 * KiB);
+
+    /* &i2c13 */
+    /* eeprom@50 */
+    at24c_eeprom_init(i2c[13], 0x50, 8 * KiB);
+    /* eeprom@54 */
+    at24c_eeprom_init(i2c[13], 0x54, 256);
+    /* eeprom@55 */
+    at24c_eeprom_init(i2c[13], 0x55, 256);
+    /* eeprom@57 */
+    at24c_eeprom_init(i2c[13], 0x57, 256);
+
+    /* &i2c14 */
+    /* io_expander9 - pca9555@10 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x10);
+    /* io_expander10 - pca9555@11 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x11);
+    /* io_expander11 - pca9555@12 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x12);
+    /* io_expander12 - pca9555@13 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x13);
+    /* io_expander13 - pca9555@14 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x14);
+    /* io_expander14 - pca9555@15 */
+    i2c_slave_create_simple(i2c[14], TYPE_PCA9552, 0x15);
+
+    /* &i2c15 */
+    /* temperature-sensor@1f - tmp421 */
+    i2c_slave_create_simple(i2c[15], TYPE_TMP421, 0x1f);
+    /* eeprom@52 */
+    at24c_eeprom_init(i2c[15], 0x52, 8 * KiB);
+}
+
+static void aspeed_machine_catalina_class_init(ObjectClass *oc,
+                                               const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Facebook Catalina BMC (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = CATALINA_BMC_HW_STRAP1;
+    amc->hw_strap2 = CATALINA_BMC_HW_STRAP2;
+    amc->fmc_model = "w25q01jvq";
+    amc->spi_model = NULL;
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC2_ON;
+    amc->i2c_init  = catalina_bmc_i2c_init;
+    mc->default_ram_size = CATALINA_BMC_RAM_SIZE;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+}
+
+static const TypeInfo aspeed_ast2600_catalina_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("catalina-bmc"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_catalina_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_catalina_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index d7e4d87dc8..6b79517ec9 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -58,6 +58,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2500_yosemitev2.c',
   'aspeed_ast2600.c',
   'aspeed_ast2600_bletchley.c',
+  'aspeed_ast2600_catalina.c',
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
   'aspeed_ast2600_gb200nvl.c',

From b762a67df05d584e1fae272ee7ac888c3854c63d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:05 +0800
Subject: [PATCH 2009/2396] hw/arm/aspeed: Split AST2600 EVB machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Aspeed AST2600 EVB machine implementation out of
aspeed.c into a new standalone file aspeed_ast2600_evb.c.

This refactor continues the modularization effort of the Aspeed platform
machine definitions, separating each board’s initialization logic into its
own dedicated source file. It improves code maintainability, readability,
and reduces clutter in aspeed.c, simplifying future platform extensions.

Key updates include:
- Moved AST2600_EVB_HW_STRAP1 and AST2600_EVB_HW_STRAP2 macro definitions
  into the new aspeed_ast2600_evb.c file.
- Moved ast2600_evb_i2c_init() and related device initialization code into
  the new aspeed_ast2600_evb.c file.
- Moved aspeed_machine_ast2600_evb_class_init() and type registration logic
  out of aspeed.c.
- Added aspeed_ast2600_evb.c to the Meson build system (meson.build).
- Cleaned up all AST2600 EVB-specific code and macros from aspeed.c.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-28-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 44 -------------------------
 hw/arm/aspeed_ast2600_evb.c | 65 +++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |  1 +
 3 files changed, 66 insertions(+), 44 deletions(-)
 create mode 100644 hw/arm/aspeed_ast2600_evb.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ad3bb8cbac..ce3610ce5a 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -33,10 +33,6 @@ static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
 };
 
-/* AST2600 evb hardware value */
-#define AST2600_EVB_HW_STRAP1 0x000000C0
-#define AST2600_EVB_HW_STRAP2 0x00000003
-
 #ifdef TARGET_AARCH64
 /* AST2700 evb hardware value */
 /* SCU HW Strap1 */
@@ -268,19 +264,6 @@ static void aspeed_machine_init(MachineState *machine)
     arm_load_kernel(ARM_CPU(first_cpu), machine, &aspeed_board_binfo);
 }
 
-static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
-
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50,
-                          eeprom_buf);
-
-    /* LM75 is compatible with TMP105 driver */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
-                     TYPE_TMP105, 0x4d);
-}
-
 void aspeed_create_pca9552(AspeedSoCState *soc, int bus_id, int addr)
 {
     i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, bus_id),
@@ -449,28 +432,6 @@ static void aspeed_machine_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_props_init(oc);
 }
 
-static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
-                                                  const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc       = "Aspeed AST2600 EVB (Cortex-A7)";
-    amc->soc_name  = "ast2600-a3";
-    amc->hw_strap1 = AST2600_EVB_HW_STRAP1;
-    amc->hw_strap2 = AST2600_EVB_HW_STRAP2;
-    amc->fmc_model = "w25q512jv";
-    amc->spi_model = "w25q512jv";
-    amc->num_cs    = 1;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON |
-                     ASPEED_MAC3_ON;
-    amc->sdhci_wp_inverted = true;
-    amc->i2c_init  = ast2600_evb_i2c_init;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-    aspeed_machine_ast2600_class_emmc_init(oc);
-};
-
 #define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
 /* Main SYSCLK frequency in Hz (200MHz) */
 #define SYSCLK_FRQ 200000000ULL
@@ -607,11 +568,6 @@ static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
 
 static const TypeInfo aspeed_machine_types[] = {
     {
-        .name          = MACHINE_TYPE_NAME("ast2600-evb"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_ast2600_evb_class_init,
-        .interfaces    = arm_machine_interfaces,
-    }, {
         .name           = MACHINE_TYPE_NAME("ast1030-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
         .class_init     = aspeed_minibmc_machine_ast1030_evb_class_init,
diff --git a/hw/arm/aspeed_ast2600_evb.c b/hw/arm/aspeed_ast2600_evb.c
new file mode 100644
index 0000000000..c43d2687c1
--- /dev/null
+++ b/hw/arm/aspeed_ast2600_evb.c
@@ -0,0 +1,65 @@
+/*
+ * ASPEED AST2600 EVB
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/i2c/smbus_eeprom.h"
+#include "hw/sensor/tmp105.h"
+
+/* AST2600 evb hardware value */
+#define AST2600_EVB_HW_STRAP1 0x000000C0
+#define AST2600_EVB_HW_STRAP2 0x00000003
+
+static void ast2600_evb_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+    uint8_t *eeprom_buf = g_malloc0(8 * 1024);
+
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 7), 0x50,
+                          eeprom_buf);
+
+    /* LM75 is compatible with TMP105 driver */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 8),
+                     TYPE_TMP105, 0x4d);
+}
+
+static void aspeed_machine_ast2600_evb_class_init(ObjectClass *oc,
+                                                  const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc       = "Aspeed AST2600 EVB (Cortex-A7)";
+    amc->soc_name  = "ast2600-a3";
+    amc->hw_strap1 = AST2600_EVB_HW_STRAP1;
+    amc->hw_strap2 = AST2600_EVB_HW_STRAP2;
+    amc->fmc_model = "w25q512jv";
+    amc->spi_model = "w25q512jv";
+    amc->num_cs    = 1;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON |
+                     ASPEED_MAC3_ON;
+    amc->sdhci_wp_inverted = true;
+    amc->i2c_init  = ast2600_evb_i2c_init;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+    aspeed_machine_ast2600_class_emmc_init(oc);
+};
+
+static const TypeInfo aspeed_ast2600_evb_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("ast2600-evb"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_ast2600_evb_class_init,
+        .interfaces    = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast2600_evb_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 6b79517ec9..dc7cde4bc1 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -59,6 +59,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600.c',
   'aspeed_ast2600_bletchley.c',
   'aspeed_ast2600_catalina.c',
+  'aspeed_ast2600_evb.c',
   'aspeed_ast2600_fby35.c',
   'aspeed_ast2600_fuji.c',
   'aspeed_ast2600_gb200nvl.c',

From 064f1ce95fe26ed5b4aa2bdd46830bc606c762c5 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:06 +0800
Subject: [PATCH 2010/2396] hw/arm/aspeed: Split AST2700 EVB machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Aspeed AST2700 EVB machine implementation out of
aspeed.c into a new standalone file aspeed_ast27x0_evb.c.

This refactor continues the ongoing modularization of Aspeed platform
support, organizing each board’s initialization logic into its own
dedicated source file. It improves maintainability, readability, and
makes it easier to extend or update individual platform support without
cluttering aspeed.c.

Key updates include:
- Moved AST2700_EVB_HW_STRAP1 and AST2700_EVB_HW_STRAP2 macro definitions
  into the new aspeed_ast27x0_evb.c file.
- Moved ast2700_evb_i2c_init(), aspeed_machine_ast2700a0_evb_class_init(),
  and aspeed_machine_ast2700a1_evb_class_init() into the new
  aspeed_ast27x0_evb.c file.
- Removed the AST2700 EVB machine type registration from aspeed.c.
- Added aspeed_ast27x0_evb.c to the Meson build system (meson.build).

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-29-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             | 75 -------------------------------
 hw/arm/aspeed_ast27x0_evb.c | 88 +++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |  1 +
 3 files changed, 89 insertions(+), 75 deletions(-)
 create mode 100644 hw/arm/aspeed_ast27x0_evb.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index ce3610ce5a..924c02bcb8 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -33,14 +33,6 @@ static struct arm_boot_info aspeed_board_binfo = {
     .board_id = -1, /* device-tree-only board */
 };
 
-#ifdef TARGET_AARCH64
-/* AST2700 evb hardware value */
-/* SCU HW Strap1 */
-#define AST2700_EVB_HW_STRAP1 0x00000800
-/* SCUIO HW Strap1 */
-#define AST2700_EVB_HW_STRAP2 0x00000700
-#endif
-
 #define AST_SMP_MAILBOX_BASE            0x1e6e2180
 #define AST_SMP_MBOX_FIELD_ENTRY        (AST_SMP_MAILBOX_BASE + 0x0)
 #define AST_SMP_MBOX_FIELD_GOSIGN       (AST_SMP_MAILBOX_BASE + 0x4)
@@ -512,78 +504,11 @@ static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
     aspeed_machine_class_init_cpus_defaults(mc);
 }
 
-#ifdef TARGET_AARCH64
-static void ast2700_evb_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /* LM75 is compatible with TMP105 driver */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0),
-                            TYPE_TMP105, 0x4d);
-}
-
-static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
-                                                    const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc = "Aspeed AST2700 A0 EVB (Cortex-A35)";
-    amc->soc_name  = "ast2700-a0";
-    amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
-    amc->hw_strap2 = AST2700_EVB_HW_STRAP2;
-    amc->fmc_model = "w25q01jvq";
-    amc->spi_model = "w25q512jv";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
-    amc->uart_default = ASPEED_DEV_UART12;
-    amc->i2c_init  = ast2700_evb_i2c_init;
-    amc->vbootrom = true;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
-static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
-                                                    const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->alias = "ast2700-evb";
-    mc->desc = "Aspeed AST2700 A1 EVB (Cortex-A35)";
-    amc->soc_name  = "ast2700-a1";
-    amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
-    amc->hw_strap2 = AST2700_EVB_HW_STRAP2;
-    amc->fmc_model = "w25q01jvq";
-    amc->spi_model = "w25q512jv";
-    amc->num_cs    = 2;
-    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
-    amc->uart_default = ASPEED_DEV_UART12;
-    amc->i2c_init  = ast2700_evb_i2c_init;
-    amc->vbootrom = true;
-    mc->default_ram_size = 1 * GiB;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-#endif
-
 static const TypeInfo aspeed_machine_types[] = {
     {
         .name           = MACHINE_TYPE_NAME("ast1030-evb"),
         .parent         = TYPE_ASPEED_MACHINE,
         .class_init     = aspeed_minibmc_machine_ast1030_evb_class_init,
-        .interfaces     = arm_machine_interfaces,
-#ifdef TARGET_AARCH64
-    }, {
-        .name          = MACHINE_TYPE_NAME("ast2700a0-evb"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_ast2700a0_evb_class_init,
-        .interfaces    = aarch64_machine_interfaces,
-    }, {
-        .name          = MACHINE_TYPE_NAME("ast2700a1-evb"),
-        .parent        = TYPE_ASPEED_MACHINE,
-        .class_init    = aspeed_machine_ast2700a1_evb_class_init,
-        .interfaces    = aarch64_machine_interfaces,
-#endif
     }, {
         .name          = TYPE_ASPEED_MACHINE,
         .parent        = TYPE_MACHINE,
diff --git a/hw/arm/aspeed_ast27x0_evb.c b/hw/arm/aspeed_ast27x0_evb.c
new file mode 100644
index 0000000000..0c4e9cd9cd
--- /dev/null
+++ b/hw/arm/aspeed_ast27x0_evb.c
@@ -0,0 +1,88 @@
+/*
+ * ASPEED AST27x0 EVB
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/sensor/tmp105.h"
+
+/* AST2700 evb hardware value */
+/* SCU HW Strap1 */
+#define AST2700_EVB_HW_STRAP1 0x00000800
+/* SCUIO HW Strap1 */
+#define AST2700_EVB_HW_STRAP2 0x00000700
+
+static void ast2700_evb_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    /* LM75 is compatible with TMP105 driver */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 0),
+                            TYPE_TMP105, 0x4d);
+}
+
+static void aspeed_machine_ast2700a0_evb_class_init(ObjectClass *oc,
+                                                    const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc = "Aspeed AST2700 A0 EVB (Cortex-A35)";
+    amc->soc_name  = "ast2700-a0";
+    amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
+    amc->hw_strap2 = AST2700_EVB_HW_STRAP2;
+    amc->fmc_model = "w25q01jvq";
+    amc->spi_model = "w25q512jv";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
+    amc->uart_default = ASPEED_DEV_UART12;
+    amc->i2c_init  = ast2700_evb_i2c_init;
+    amc->vbootrom = true;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static void aspeed_machine_ast2700a1_evb_class_init(ObjectClass *oc,
+                                                    const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->alias = "ast2700-evb";
+    mc->desc = "Aspeed AST2700 A1 EVB (Cortex-A35)";
+    amc->soc_name  = "ast2700-a1";
+    amc->hw_strap1 = AST2700_EVB_HW_STRAP1;
+    amc->hw_strap2 = AST2700_EVB_HW_STRAP2;
+    amc->fmc_model = "w25q01jvq";
+    amc->spi_model = "w25q512jv";
+    amc->num_cs    = 2;
+    amc->macs_mask = ASPEED_MAC0_ON | ASPEED_MAC1_ON | ASPEED_MAC2_ON;
+    amc->uart_default = ASPEED_DEV_UART12;
+    amc->i2c_init  = ast2700_evb_i2c_init;
+    amc->vbootrom = true;
+    mc->default_ram_size = 1 * GiB;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast27x0_evb_types[] = {
+    {
+        .name          = MACHINE_TYPE_NAME("ast2700a0-evb"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_ast2700a0_evb_class_init,
+        .interfaces    = aarch64_machine_interfaces,
+    }, {
+        .name          = MACHINE_TYPE_NAME("ast2700a1-evb"),
+        .parent        = TYPE_ASPEED_MACHINE,
+        .class_init    = aspeed_machine_ast2700a1_evb_class_init,
+        .interfaces    = aarch64_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast27x0_evb_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index dc7cde4bc1..1467a2034c 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -70,6 +70,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'fby35.c'))
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',
+  'aspeed_ast27x0_evb.c',
   'aspeed_ast27x0-fc.c',
   'aspeed_ast27x0-ssp.c',
   'aspeed_ast27x0-tsp.c',

From fcbcfb5afe3603b8edad0b046946b9b66eb26271 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:07 +0800
Subject: [PATCH 2011/2396] hw/arm/aspeed: Rename and export
 connect_serial_hds_to_uarts() as aspeed_connect_serial_hds_to_uarts()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The helper function connect_serial_hds_to_uarts() has been renamed to
aspeed_connect_serial_hds_to_uarts() and promoted to a public Aspeed
machine API.

Previously, this function was declared static within aspeed.c and only
used internally. Renaming it with the aspeed_ prefix and exporting its
declaration in aspeed.h makes the function accessible to other Aspeed
machine implementations that need to attach host serial devices to SoC
UARTs.

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-30-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c         |  6 +++---
 include/hw/arm/aspeed.h | 14 ++++++++++++++
 2 files changed, 17 insertions(+), 3 deletions(-)

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 924c02bcb8..7e9cd532d1 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -118,7 +118,7 @@ static void sdhci_attach_drive(SDHCIState *sdhci, DriveInfo *dinfo, bool emmc,
                                &error_fatal);
 }
 
-static void connect_serial_hds_to_uarts(AspeedMachineState *bmc)
+void aspeed_connect_serial_hds_to_uarts(AspeedMachineState *bmc)
 {
     AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(bmc);
     AspeedSoCState *s = bmc->soc;
@@ -189,7 +189,7 @@ static void aspeed_machine_init(MachineState *machine)
         object_property_set_int(OBJECT(bmc->soc), "hw-prot-key",
                                 ASPEED_SCU_PROT_KEY, &error_abort);
     }
-    connect_serial_hds_to_uarts(bmc);
+    aspeed_connect_serial_hds_to_uarts(bmc);
     qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
 
     if (defaults_enabled()) {
@@ -444,7 +444,7 @@ static void aspeed_minibmc_machine_init(MachineState *machine)
 
     object_property_set_link(OBJECT(bmc->soc), "memory",
                              OBJECT(get_system_memory()), &error_abort);
-    connect_serial_hds_to_uarts(bmc);
+    aspeed_connect_serial_hds_to_uarts(bmc);
     qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
 
     if (defaults_enabled()) {
diff --git a/include/hw/arm/aspeed.h b/include/hw/arm/aspeed.h
index 87dcadab26..714bbd326c 100644
--- a/include/hw/arm/aspeed.h
+++ b/include/hw/arm/aspeed.h
@@ -111,4 +111,18 @@ I2CSlave *aspeed_create_pca9554(AspeedSoCState *soc, int bus_id, int addr);
  */
 void aspeed_machine_ast2600_class_emmc_init(ObjectClass *oc);
 
+/*
+ * aspeed_connect_serial_hds_to_uarts:
+ * @bmc: pointer to the #AspeedMachineState.
+ *
+ * Connect host serial backends (character devices) to the UART interfaces
+ * of the Aspeed SoC used by the given BMC machine.
+ *
+ * The function assigns `serial_hd(0)` to the primary UART channel
+ * (either chosen via `bmc->uart_chosen` or the machine class default),
+ * and iteratively connects remaining serial ports to other available UARTs
+ * on the SoC based on their index.
+ */
+void aspeed_connect_serial_hds_to_uarts(AspeedMachineState *bmc);
+
 #endif

From 1d2a5f8f5d6478504e80be0fcee5ca88adac5921 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 4 Nov 2025 11:13:08 +0800
Subject: [PATCH 2012/2396] hw/arm/aspeed: Split AST1030 EVB machine into a
 separate source file for maintainability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit moves the Aspeed AST1030 MiniBMC machine
implementation out of aspeed.c into a new standalone file
aspeed_ast10x0_evb.c.

This refactor continues the modularization effort for Aspeed platform
support, placing each board’s logic and initialization sequence in its
own dedicated source file. It improves maintainability, readability, and
makes it easier to extend support for additional AST10x0-based variants.

Key updates include:
- Moved aspeed_minibmc_machine_init() and
  aspeed_minibmc_machine_ast1030_evb_class_init() from aspeed.c to
  aspeed_ast10x0_evb.c.
- Moved ast1030_evb_i2c_init() and associated I2C setup code.
- Removed AST1030 EVB machine type registration from aspeed.c.
- Added aspeed_ast10x0_evb.c to the Meson build system (meson.build).

No functional changes.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104031325.146374-31-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed.c             |  89 -----------------------------
 hw/arm/aspeed_ast10x0_evb.c | 108 ++++++++++++++++++++++++++++++++++++
 hw/arm/meson.build          |   1 +
 3 files changed, 109 insertions(+), 89 deletions(-)
 create mode 100644 hw/arm/aspeed_ast10x0_evb.c

diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index 7e9cd532d1..3a5071a384 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -16,14 +16,9 @@
 #include "hw/arm/aspeed_soc.h"
 #include "hw/arm/machines-qom.h"
 #include "hw/block/flash.h"
-#include "hw/i2c/smbus_eeprom.h"
 #include "hw/gpio/pca9552.h"
 #include "hw/gpio/pca9554.h"
-#include "hw/sensor/tmp105.h"
-#include "hw/misc/led.h"
-#include "hw/qdev-properties.h"
 #include "system/block-backend.h"
-#include "system/reset.h"
 #include "qemu/error-report.h"
 #include "qemu/units.h"
 #include "hw/qdev-clock.h"
@@ -424,92 +419,8 @@ static void aspeed_machine_class_init(ObjectClass *oc, const void *data)
     aspeed_machine_class_props_init(oc);
 }
 
-#define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
-/* Main SYSCLK frequency in Hz (200MHz) */
-#define SYSCLK_FRQ 200000000ULL
-
-static void aspeed_minibmc_machine_init(MachineState *machine)
-{
-    AspeedMachineState *bmc = ASPEED_MACHINE(machine);
-    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
-    Clock *sysclk;
-
-    sysclk = clock_new(OBJECT(machine), "SYSCLK");
-    clock_set_hz(sysclk, SYSCLK_FRQ);
-
-    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
-    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
-    object_unref(OBJECT(bmc->soc));
-    qdev_connect_clock_in(DEVICE(bmc->soc), "sysclk", sysclk);
-
-    object_property_set_link(OBJECT(bmc->soc), "memory",
-                             OBJECT(get_system_memory()), &error_abort);
-    aspeed_connect_serial_hds_to_uarts(bmc);
-    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
-
-    if (defaults_enabled()) {
-        aspeed_board_init_flashes(&bmc->soc->fmc,
-                            bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
-                            amc->num_cs,
-                            0);
-
-        aspeed_board_init_flashes(&bmc->soc->spi[0],
-                            bmc->spi_model ? bmc->spi_model : amc->spi_model,
-                            amc->num_cs, amc->num_cs);
-
-        aspeed_board_init_flashes(&bmc->soc->spi[1],
-                            bmc->spi_model ? bmc->spi_model : amc->spi_model,
-                            amc->num_cs, (amc->num_cs * 2));
-    }
-
-    if (amc->i2c_init) {
-        amc->i2c_init(bmc);
-    }
-
-    armv7m_load_kernel(ARM_CPU(first_cpu),
-                       machine->kernel_filename,
-                       0,
-                       AST1030_INTERNAL_FLASH_SIZE);
-}
-
-static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
-{
-    AspeedSoCState *soc = bmc->soc;
-
-    /* U10 24C08 connects to SDA/SCL Group 1 by default */
-    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
-    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50, eeprom_buf);
-
-    /* U11 LM75 connects to SDA/SCL Group 2 by default */
-    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4d);
-}
-
-static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
-                                                          const void *data)
-{
-    MachineClass *mc = MACHINE_CLASS(oc);
-    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
-
-    mc->desc = "Aspeed AST1030 MiniBMC (Cortex-M4)";
-    amc->soc_name = "ast1030-a1";
-    amc->hw_strap1 = 0;
-    amc->hw_strap2 = 0;
-    mc->init = aspeed_minibmc_machine_init;
-    amc->i2c_init = ast1030_evb_i2c_init;
-    mc->default_ram_size = 0;
-    amc->fmc_model = "w25q80bl";
-    amc->spi_model = "w25q256";
-    amc->num_cs = 2;
-    amc->macs_mask = 0;
-    aspeed_machine_class_init_cpus_defaults(mc);
-}
-
 static const TypeInfo aspeed_machine_types[] = {
     {
-        .name           = MACHINE_TYPE_NAME("ast1030-evb"),
-        .parent         = TYPE_ASPEED_MACHINE,
-        .class_init     = aspeed_minibmc_machine_ast1030_evb_class_init,
-    }, {
         .name          = TYPE_ASPEED_MACHINE,
         .parent        = TYPE_MACHINE,
         .instance_size = sizeof(AspeedMachineState),
diff --git a/hw/arm/aspeed_ast10x0_evb.c b/hw/arm/aspeed_ast10x0_evb.c
new file mode 100644
index 0000000000..7af2a77865
--- /dev/null
+++ b/hw/arm/aspeed_ast10x0_evb.c
@@ -0,0 +1,108 @@
+/*
+ * ASPEED AST10x0 EVB
+ *
+ * Copyright 2016 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "hw/arm/boot.h"
+#include "hw/arm/machines-qom.h"
+#include "hw/arm/aspeed.h"
+#include "hw/arm/aspeed_soc.h"
+#include "hw/qdev-clock.h"
+#include "system/system.h"
+#include "hw/i2c/smbus_eeprom.h"
+
+#define AST1030_INTERNAL_FLASH_SIZE (1024 * 1024)
+/* Main SYSCLK frequency in Hz (200MHz) */
+#define SYSCLK_FRQ 200000000ULL
+
+static void aspeed_minibmc_machine_init(MachineState *machine)
+{
+    AspeedMachineState *bmc = ASPEED_MACHINE(machine);
+    AspeedMachineClass *amc = ASPEED_MACHINE_GET_CLASS(machine);
+    Clock *sysclk;
+
+    sysclk = clock_new(OBJECT(machine), "SYSCLK");
+    clock_set_hz(sysclk, SYSCLK_FRQ);
+
+    bmc->soc = ASPEED_SOC(object_new(amc->soc_name));
+    object_property_add_child(OBJECT(machine), "soc", OBJECT(bmc->soc));
+    object_unref(OBJECT(bmc->soc));
+    qdev_connect_clock_in(DEVICE(bmc->soc), "sysclk", sysclk);
+
+    object_property_set_link(OBJECT(bmc->soc), "memory",
+                             OBJECT(get_system_memory()), &error_abort);
+    aspeed_connect_serial_hds_to_uarts(bmc);
+    qdev_realize(DEVICE(bmc->soc), NULL, &error_abort);
+
+    if (defaults_enabled()) {
+        aspeed_board_init_flashes(&bmc->soc->fmc,
+                            bmc->fmc_model ? bmc->fmc_model : amc->fmc_model,
+                            amc->num_cs,
+                            0);
+
+        aspeed_board_init_flashes(&bmc->soc->spi[0],
+                            bmc->spi_model ? bmc->spi_model : amc->spi_model,
+                            amc->num_cs, amc->num_cs);
+
+        aspeed_board_init_flashes(&bmc->soc->spi[1],
+                            bmc->spi_model ? bmc->spi_model : amc->spi_model,
+                            amc->num_cs, (amc->num_cs * 2));
+    }
+
+    if (amc->i2c_init) {
+        amc->i2c_init(bmc);
+    }
+
+    armv7m_load_kernel(ARM_CPU(first_cpu),
+                       machine->kernel_filename,
+                       0,
+                       AST1030_INTERNAL_FLASH_SIZE);
+}
+
+static void ast1030_evb_i2c_init(AspeedMachineState *bmc)
+{
+    AspeedSoCState *soc = bmc->soc;
+
+    /* U10 24C08 connects to SDA/SCL Group 1 by default */
+    uint8_t *eeprom_buf = g_malloc0(32 * 1024);
+    smbus_eeprom_init_one(aspeed_i2c_get_bus(&soc->i2c, 0), 0x50, eeprom_buf);
+
+    /* U11 LM75 connects to SDA/SCL Group 2 by default */
+    i2c_slave_create_simple(aspeed_i2c_get_bus(&soc->i2c, 1), "tmp105", 0x4d);
+}
+
+static void aspeed_minibmc_machine_ast1030_evb_class_init(ObjectClass *oc,
+                                                          const void *data)
+{
+    MachineClass *mc = MACHINE_CLASS(oc);
+    AspeedMachineClass *amc = ASPEED_MACHINE_CLASS(oc);
+
+    mc->desc = "Aspeed AST1030 MiniBMC (Cortex-M4)";
+    amc->soc_name = "ast1030-a1";
+    amc->hw_strap1 = 0;
+    amc->hw_strap2 = 0;
+    mc->init = aspeed_minibmc_machine_init;
+    amc->i2c_init = ast1030_evb_i2c_init;
+    mc->default_ram_size = 0;
+    amc->fmc_model = "w25q80bl";
+    amc->spi_model = "w25q256";
+    amc->num_cs = 2;
+    amc->macs_mask = 0;
+    aspeed_machine_class_init_cpus_defaults(mc);
+}
+
+static const TypeInfo aspeed_ast10x0_evb_types[] = {
+    {
+        .name           = MACHINE_TYPE_NAME("ast1030-evb"),
+        .parent         = TYPE_ASPEED_MACHINE,
+        .class_init     = aspeed_minibmc_machine_ast1030_evb_class_init,
+        .interfaces     = arm_machine_interfaces,
+    }
+};
+
+DEFINE_TYPES(aspeed_ast10x0_evb_types)
diff --git a/hw/arm/meson.build b/hw/arm/meson.build
index 1467a2034c..aeaf654790 100644
--- a/hw/arm/meson.build
+++ b/hw/arm/meson.build
@@ -67,6 +67,7 @@ arm_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files(
   'aspeed_ast2600_qcom-firework.c',
   'aspeed_ast2600_rainier.c',
   'aspeed_ast10x0.c',
+  'aspeed_ast10x0_evb.c',
   'fby35.c'))
 arm_common_ss.add(when: ['CONFIG_ASPEED_SOC', 'TARGET_AARCH64'], if_true: files(
   'aspeed_ast27x0.c',

From 71260a012013c249f3ddd2738fad0b43dfb8e055 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Thu, 30 Oct 2025 23:13:19 +0300
Subject: [PATCH 2013/2396] scripts/checkpatch.pl: remove bogus patch prefix
 warning

Remove the 'patch prefix exists, appears to be a -p0 patch' warning
entirely as it is fundamentally flawed and can only produce false
positives.

Sometimes I create test files with names 'a' and 'b', and then get
surprised seeing this warning. It was not easy to understand where it
comes from.

How it works:
1. It extracts prefixes (a/, b/) from standard diff output
2. Checks if files/directories with these names exist in the project
   root
3. Warns if they exist, claiming it's a '-p0 patch' issue

This logic is wrong because:
- Standard diff/patch tools always use a/ and b/ prefixes by default
- The existence of files named 'a' or 'b' in the working directory is
  completely unrelated to patch format
- The working directory state may not correspond to the patch content
  (different commits, branches, etc.)
- In QEMU project, there are no single-letter files/directories in root,
  so this check can only generate false positives

The correct way to detect -p0 patches would be to analyze the path
format within the patch itself (e.g., absolute paths or paths without
prefixes), not check filesystem state.

So, let's finally drop it.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Link: https://lore.kernel.org/r/20251030201319.858480-1-vsementsov@yandex-team.ru
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/checkpatch.pl | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index d3d75f3f13..d0f4537f25 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -1741,13 +1741,7 @@ sub process {
 			}
 		} elsif ($line =~ /^\+\+\+\s+(\S+)/) {
 			$realfile = $1;
-			$realfile =~ s@^([^/]*)/@@ if (!$file);
-
-			$p1_prefix = $1;
-			if (!$file && $tree && $p1_prefix ne '' &&
-			    -e "$root/$p1_prefix") {
-				WARN("patch prefix '$p1_prefix' exists, appears to be a -p0 patch\n");
-			}
+			$realfile =~ s@^[^/]*/@@  if (!$file);
 
 			if (defined $fileinfo && !$fileinfo->{isgit}) {
 				$fileinfo->{lineend} = $oldhere;

From 5bd89761a4b8caa53a0c26eff156455df8279247 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 4 Aug 2025 15:06:02 +0200
Subject: [PATCH 2014/2396] qapi/command: Avoid generating unused
 qmp_marshal_output_T()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qmp_marshal_output_T() is only ever called by qmp_marshal_C() for a
command C that returns type T.

We've always generated it as a static function on demand, i.e. when we
generate a call.

Since we split up monolithic generated code into modules (commit
252dc3105fc "qapi: Generate separate .h, .c for each module"), we do
this per module.  As noted in the commit message, this can result in
identical (static) qmp_marshal_output_T() in several modules.  Was
deemed not worth avoiding.

A bit later, we added 'if' conditionals to the schema language (merge
commit 5dafaf4fbce).

When a conditional definition uses a type, then its condition must
imply the type's condition.  We made this the user's responsibility.
Hasn't been an issue in practice.

However, the sharing of qmp_marshal_output_T() among commands
complicates matters.  To avoid both undefined function errors and
unused function warnings, qmp_marshal_output_T() must be defined
exactly when it's used.  It is used when any of the qmp_marshal_C()
calling it is defined, i.e. when any C's condition holds.

The generator uses T's condition instead.  To avoid both error and
warning, T's condition must be the conjunction of all C's conditions.

Unfortunately, this can be impossible:

* Conditional command returning a builtin type

  A builtin type cannot be conditional.  This is noted in a FIXME
  comment.

* Commands in multiple modules where the conjunction differs between
  modules

  An instance of this came up recently.  we have unconditional
  commands returning HumanReadableText.  If we add a conditional one
  to a module that does not have unconditional ones, compilation fails
  with "defined but not used".  If we make HumanReadableText
  conditional to fix this module, we break the others.

Instead of complicating the code to compute the conjunction, simplify
it: generate the output marshaling code right into qmp_marshal_C().

This duplicates it when multiple commands return the same type.  The
impact on code size is negligible: qemu-system-x86_64's text segment
grows by 1448 bytes.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20250804130602.903904-1-armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
[Commit message typos fixed]
---
 docs/devel/qapi-code-gen.rst | 25 ++++++++------------
 scripts/qapi/commands.py     | 44 ++++++++----------------------------
 2 files changed, 19 insertions(+), 50 deletions(-)

diff --git a/docs/devel/qapi-code-gen.rst b/docs/devel/qapi-code-gen.rst
index d97602f464..3a632b4a64 100644
--- a/docs/devel/qapi-code-gen.rst
+++ b/docs/devel/qapi-code-gen.rst
@@ -1809,27 +1809,13 @@ Example::
     $ cat qapi-generated/example-qapi-commands.c
     [Uninteresting stuff omitted...]
 
-    static void qmp_marshal_output_UserDefOne(UserDefOne *ret_in,
-                                    QObject **ret_out, Error **errp)
-    {
-        Visitor *v;
-
-        v = qobject_output_visitor_new_qmp(ret_out);
-        if (visit_type_UserDefOne(v, "unused", &ret_in, errp)) {
-            visit_complete(v, ret_out);
-        }
-        visit_free(v);
-        v = qapi_dealloc_visitor_new();
-        visit_type_UserDefOne(v, "unused", &ret_in, NULL);
-        visit_free(v);
-    }
-
     void qmp_marshal_my_command(QDict *args, QObject **ret, Error **errp)
     {
         Error *err = NULL;
         bool ok = false;
         Visitor *v;
         UserDefOne *retval;
+        Visitor *ov;
         q_obj_my_command_arg arg = {0};
 
         v = qobject_input_visitor_new_qmp(QOBJECT(args));
@@ -1857,7 +1843,14 @@ Example::
             goto out;
         }
 
-        qmp_marshal_output_UserDefOne(retval, ret, errp);
+        ov = qobject_output_visitor_new_qmp(ret);
+        if (visit_type_UserDefOne(ov, "unused", &retval, errp)) {
+            visit_complete(ov, ret);
+        }
+        visit_free(ov);
+        ov = qapi_dealloc_visitor_new();
+        visit_type_UserDefOne(ov, "unused", &retval, NULL);
+        visit_free(ov);
 
         if (trace_event_get_state_backends(TRACE_QMP_EXIT_MY_COMMAND)) {
             g_autoptr(GString) ret_json = qobject_to_json(*ret);
diff --git a/scripts/qapi/commands.py b/scripts/qapi/commands.py
index 7914227382..a82b5a2a5e 100644
--- a/scripts/qapi/commands.py
+++ b/scripts/qapi/commands.py
@@ -14,15 +14,12 @@ See the COPYING file in the top-level directory.
 """
 
 from typing import (
-    Dict,
     List,
     Optional,
-    Set,
 )
 
 from .common import c_name, mcgen
 from .gen import (
-    QAPIGenC,
     QAPISchemaModularCVisitor,
     build_params,
     gen_features,
@@ -112,11 +109,7 @@ def gen_call(name: str,
 ''')
 
     if ret_type:
-        ret += mcgen('''
-
-    qmp_marshal_output_%(c_name)s(retval, ret, errp);
-''',
-                     c_name=ret_type.c_name())
+        ret += gen_marshal_output(ret_type)
 
     if gen_tracing:
         if ret_type:
@@ -142,22 +135,16 @@ def gen_call(name: str,
 def gen_marshal_output(ret_type: QAPISchemaType) -> str:
     return mcgen('''
 
-static void qmp_marshal_output_%(c_name)s(%(c_type)s ret_in,
-                                QObject **ret_out, Error **errp)
-{
-    Visitor *v;
-
-    v = qobject_output_visitor_new_qmp(ret_out);
-    if (visit_type_%(c_name)s(v, "unused", &ret_in, errp)) {
-        visit_complete(v, ret_out);
+    ov = qobject_output_visitor_new_qmp(ret);
+    if (visit_type_%(c_name)s(ov, "unused", &retval, errp)) {
+        visit_complete(ov, ret);
     }
-    visit_free(v);
-    v = qapi_dealloc_visitor_new();
-    visit_type_%(c_name)s(v, "unused", &ret_in, NULL);
-    visit_free(v);
-}
+    visit_free(ov);
+    ov = qapi_dealloc_visitor_new();
+    visit_type_%(c_name)s(ov, "unused", &retval, NULL);
+    visit_free(ov);
 ''',
-                 c_type=ret_type.c_type(), c_name=ret_type.c_name())
+                 c_name=ret_type.c_name())
 
 
 def build_marshal_proto(name: str,
@@ -209,6 +196,7 @@ def gen_marshal(name: str,
     if ret_type:
         ret += mcgen('''
     %(c_type)s retval;
+    Visitor *ov;
 ''',
                      c_type=ret_type.c_type())
 
@@ -308,11 +296,9 @@ class QAPISchemaGenCommandVisitor(QAPISchemaModularCVisitor):
             prefix, 'qapi-commands',
             ' * Schema-defined QAPI/QMP commands', None, __doc__,
             gen_tracing=gen_tracing)
-        self._visited_ret_types: Dict[QAPIGenC, Set[QAPISchemaType]] = {}
         self._gen_tracing = gen_tracing
 
     def _begin_user_module(self, name: str) -> None:
-        self._visited_ret_types[self._genc] = set()
         commands = self._module_basename('qapi-commands', name)
         types = self._module_basename('qapi-types', name)
         visit = self._module_basename('qapi-visit', name)
@@ -386,16 +372,6 @@ void %(c_prefix)sqmp_init_marshal(QmpCommandList *cmds)
                       coroutine: bool) -> None:
         if not gen:
             return
-        # FIXME: If T is a user-defined type, the user is responsible
-        # for making this work, i.e. to make T's condition the
-        # conjunction of the T-returning commands' conditions.  If T
-        # is a built-in type, this isn't possible: the
-        # qmp_marshal_output_T() will be generated unconditionally.
-        if ret_type and ret_type not in self._visited_ret_types[self._genc]:
-            self._visited_ret_types[self._genc].add(ret_type)
-            with ifcontext(ret_type.ifcond,
-                           self._genh, self._genc):
-                self._genc.add(gen_marshal_output(ret_type))
         with ifcontext(ifcond, self._genh, self._genc):
             self._genh.add(gen_command_decl(name, arg_type, boxed,
                                             ret_type, coroutine))

From 4ce5ba92d44c979114ea84ffa034d0053c4b3485 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 29 Oct 2025 13:00:24 +0100
Subject: [PATCH 2015/2396] meson: Add missing backends.py to qapi_gen_depends

Fixes: dde279925c97 (qapi: pluggable backend code generators)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251029120024.1426996-1-armbru@redhat.com>
---
 meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index df876c72f0..f3108f1c2a 100644
--- a/meson.build
+++ b/meson.build
@@ -3561,11 +3561,13 @@ hxtool = find_program('scripts/hxtool')
 shaderinclude = find_program('scripts/shaderinclude.py')
 qapi_gen = find_program('scripts/qapi-gen.py')
 qapi_gen_depends = [ meson.current_source_dir() / 'scripts/qapi/__init__.py',
+                     meson.current_source_dir() / 'scripts/qapi/backend.py',
                      meson.current_source_dir() / 'scripts/qapi/commands.py',
                      meson.current_source_dir() / 'scripts/qapi/common.py',
                      meson.current_source_dir() / 'scripts/qapi/error.py',
                      meson.current_source_dir() / 'scripts/qapi/events.py',
                      meson.current_source_dir() / 'scripts/qapi/expr.py',
+                     meson.current_source_dir() / 'scripts/qapi/features.py',
                      meson.current_source_dir() / 'scripts/qapi/gen.py',
                      meson.current_source_dir() / 'scripts/qapi/introspect.py',
                      meson.current_source_dir() / 'scripts/qapi/main.py',
@@ -3573,7 +3575,6 @@ qapi_gen_depends = [ meson.current_source_dir() / 'scripts/qapi/__init__.py',
                      meson.current_source_dir() / 'scripts/qapi/schema.py',
                      meson.current_source_dir() / 'scripts/qapi/source.py',
                      meson.current_source_dir() / 'scripts/qapi/types.py',
-                     meson.current_source_dir() / 'scripts/qapi/features.py',
                      meson.current_source_dir() / 'scripts/qapi/visit.py',
                      meson.current_source_dir() / 'scripts/qapi-gen.py'
 ]

From 4e6913f16f5b3e71581beda8f86bbdbb23644e44 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:46 +0100
Subject: [PATCH 2016/2396] qapi/audio: Fix description markup of
 AudiodevDBusOptions @nsamples
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The description of Member @nsamples is indented incorrectly.  Comes
out like

    Members:
            [...]
	    nsamples (int, optional) – set the number of samples per
	    read/write calls (default to 480,

    10ms at 48kHz).

Fixing the indentation makes it come out like

    Members:
            [...]
	    nsamples (int, optional) – set the number of samples per
	    read/write calls (default to 480, 10ms at 48kHz).

Fixes: 19c628f2f579 (dbus: add -audio dbus nsamples option)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103082354.3273027-2-armbru@redhat.com>
---
 qapi/audio.json | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/qapi/audio.json b/qapi/audio.json
index 53142080f7..2df87b9710 100644
--- a/qapi/audio.json
+++ b/qapi/audio.json
@@ -76,8 +76,8 @@
 #
 # @out: options of the playback stream
 #
-# @nsamples: set the number of samples per read/write calls (default to 480,
-# 10ms at 48kHz).
+# @nsamples: set the number of samples per read/write calls
+#     (default to 480, 10ms at 48kHz).
 #
 # Since: 10.0
 ##

From e76ff1ee96792801f48dd8287ee35bdd3fa384ac Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:47 +0100
Subject: [PATCH 2017/2396] qapi: Refill doc comments to conform to conventions

Sweep the entire documentation again.  Last done in commit
01bed0ff14b (qapi: Refill doc comments to conform to conventions).

To check the generated documentation does not change, I compared the
generated HTML before and after this commit with "wdiff -3".  Finds no
differences.  Comparing with diff is not useful, as the reflown
paragraphs are visible there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-3-armbru@redhat.com>
---
 qapi/accelerator.json    |   3 +-
 qapi/acpi-hest.json      |   4 +-
 qapi/block-core.json     | 158 ++++++++++++++++++++-------------------
 qapi/block-export.json   |  26 ++++---
 qapi/crypto.json         |   7 +-
 qapi/introspect.json     |   8 +-
 qapi/job.json            |  30 ++++----
 qapi/machine-common.json |   4 +-
 qapi/machine-s390x.json  |   4 +-
 qapi/machine.json        |  49 ++++++------
 qapi/migration.json      | 123 +++++++++++++++---------------
 qapi/net.json            |  23 +++---
 qapi/qdev.json           |   4 +-
 qapi/qom.json            |  44 +++++------
 qapi/run-state.json      |  19 ++---
 qapi/sockets.json        |  30 ++++----
 qapi/stats.json          |   4 +-
 qapi/ui.json             |  15 ++--
 qapi/virtio.json         |   4 +-
 19 files changed, 293 insertions(+), 266 deletions(-)

diff --git a/qapi/accelerator.json b/qapi/accelerator.json
index 2b92060884..0cf5e0f9d9 100644
--- a/qapi/accelerator.json
+++ b/qapi/accelerator.json
@@ -87,7 +87,8 @@
 #
 # @enabled: the accelerator that is in use
 #
-# @present: the list of accelerators that are built into this executable
+# @present: the list of accelerators that are built into this
+#     executable
 #
 # Since: 10.2.0
 ##
diff --git a/qapi/acpi-hest.json b/qapi/acpi-hest.json
index 28af1266a7..88c53eaf1b 100644
--- a/qapi/acpi-hest.json
+++ b/qapi/acpi-hest.json
@@ -5,8 +5,8 @@
 ##
 # == GHESv2 CPER Error Injection
 #
-# Defined since ACPI Specification 6.1,
-# section 18.3.2.8 Generic Hardware Error Source version 2. See:
+# Defined since ACPI Specification 6.1, section 18.3.2.8 Generic
+# Hardware Error Source version 2.  See:
 #
 # https://uefi.org/sites/default/files/resources/ACPI_6_1.pdf
 ##
diff --git a/qapi/block-core.json b/qapi/block-core.json
index 2c037183f0..b82af74256 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -159,14 +159,15 @@
 ##
 # @ImageInfoSpecificRbd:
 #
-# @encryption-format: Image encryption format. If encryption is enabled for the
-#     image (see encrypted in BlockNodeInfo), this is the actual format in which the
-#     image is accessed. If encryption is not enabled, this is the result of
-#     probing when the image was opened, to give a suggestion which encryption
-#     format could be enabled. Note that probing results can be changed by the
-#     guest by writing a (possibly partial) encryption format header to the
-#     image, so don't treat this information as trusted if the guest is not
-#     trusted.
+# @encryption-format: Image encryption format.  If encryption is
+#     enabled for the image (see encrypted in BlockNodeInfo), this is
+#     the actual format in which the image is accessed.  If encryption
+#     is not enabled, this is the result of probing when the image was
+#     opened, to give a suggestion which encryption format could be
+#     enabled.  Note that probing results can be changed by the guest
+#     by writing a (possibly partial) encryption format header to the
+#     image, so don't treat this information as trusted if the guest
+#     is not trusted.
 #
 # Since: 6.1
 ##
@@ -406,8 +407,8 @@
 # node, annotated with information about that node in relation to its
 # parent.
 #
-# @name: Child name of the root node in the `BlockGraphInfo` struct, in
-#     its role as the child of some undescribed parent node
+# @name: Child name of the root node in the `BlockGraphInfo` struct,
+#     in its role as the child of some undescribed parent node
 #
 # @info: Block graph information starting at this node
 #
@@ -573,11 +574,12 @@
 # @backing_file_depth: number of files in the backing file chain
 #     (since: 1.2)
 #
-# @children: Information about child block nodes. (since: 10.1)
+# @children: Information about child block nodes.  (since: 10.1)
 #
-# @active: true if the backend is active; typical cases for inactive backends
-#     are on the migration source instance after migration completes and on the
-#     destination before it completes.  (since: 10.0)
+# @active: true if the backend is active; typical cases for inactive
+#     backends are on the migration source instance after migration
+#     completes and on the destination before it completes.
+#     (since: 10.0)
 #
 # @encrypted: true if the backing device is encrypted
 #
@@ -853,8 +855,8 @@
 #
 # Get a list of `BlockInfo` for all virtual block devices.
 #
-# Returns: a list describing each virtual block device.
-#     Filter nodes that were created implicitly are skipped over.
+# Returns: a list describing each virtual block device.  Filter nodes
+#     that were created implicitly are skipped over.
 #
 # Since: 0.14
 #
@@ -1693,11 +1695,12 @@
 #     different block device than @device).
 #
 # @on-cbw-error: policy defining behavior on I/O errors in
-#     copy-before-write jobs; defaults to break-guest-write.  (Since 10.1)
+#     copy-before-write jobs; defaults to break-guest-write.
+#     (Since 10.1)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for `job-finalize` before
-#     making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for `job-finalize`
+#     before making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 2.12)
 #
@@ -1809,7 +1812,8 @@
 #
 # @allow-write-only-overlay: If present, the check whether this
 #     operation is safe was relaxed so that it can be used to change
-#     backing file of a destination of a `blockdev-mirror`.  (since 5.0)
+#     backing file of a destination of a `blockdev-mirror`.
+#     (since 5.0)
 #
 # Since: 2.5
 #
@@ -1873,8 +1877,8 @@
 #
 # If top == base, that is an error.  If top has no overlays on top of
 # it, or if it is in use by a writer, the job will not be completed by
-# itself.  The user needs to complete the job with the
-# `job-complete` command after getting the ready event.  (Since 2.0)
+# itself.  The user needs to complete the job with the `job-complete`
+# command after getting the ready event.  (Since 2.0)
 #
 # If the base image is smaller than top, then the base image will be
 # resized to be the same size as top.  If top is smaller than the base
@@ -1936,8 +1940,8 @@
 #     autogenerated.  (Since: 2.9)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for `job-finalize` before
-#     making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for `job-finalize`
+#     before making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
@@ -2010,10 +2014,10 @@
 # @blockdev-backup:
 #
 # Start a point-in-time copy of a block device to a new destination.
-# The status of ongoing `blockdev-backup` operations can be checked with
-# `query-block-jobs` where the `BlockJobInfo`.type field has the value
-# 'backup'.  The operation can be stopped before it has completed
-# using the `job-cancel` or `block-job-cancel` command.
+# The status of ongoing `blockdev-backup` operations can be checked
+# with `query-block-jobs` where the `BlockJobInfo`.type field has the
+# value 'backup'.  The operation can be stopped before it has
+# completed using the `job-cancel` or `block-job-cancel` command.
 #
 # Errors:
 #     - If @device is not a valid block device, DeviceNotFound
@@ -2297,8 +2301,8 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for `job-finalize` before
-#     making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for `job-finalize`
+#     before making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
@@ -2348,7 +2352,8 @@
 #
 # @disabled: the bitmap is created in the disabled state, which means
 #     that it will not track drive changes.  The bitmap may be enabled
-#     with `block-dirty-bitmap-enable`.  Default is false.  (Since: 4.0)
+#     with `block-dirty-bitmap-enable`.  Default is false.
+#     (Since: 4.0)
 #
 # Since: 2.4
 ##
@@ -2413,8 +2418,8 @@
 # @block-dirty-bitmap-remove:
 #
 # Stop write tracking and remove the dirty bitmap that was created
-# with `block-dirty-bitmap-add`.  If the bitmap is persistent, remove it
-# from its storage too.
+# with `block-dirty-bitmap-add`.  If the bitmap is persistent, remove
+# it from its storage too.
 #
 # Errors:
 #     - If @node is not a valid block device or node, DeviceNotFound
@@ -2612,8 +2617,8 @@
 #     'background' (Since: 3.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for `job-finalize` before
-#     making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for `job-finalize`
+#     before making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
@@ -2939,8 +2944,8 @@
 #     autogenerated.  (Since: 6.0)
 #
 # @auto-finalize: When false, this job will wait in a PENDING state
-#     after it has finished its work, waiting for `job-finalize` before
-#     making any block graph changes.  When true, this job will
+#     after it has finished its work, waiting for `job-finalize`
+#     before making any block graph changes.  When true, this job will
 #     automatically perform its abort or commit actions.  Defaults to
 #     true.  (Since 3.1)
 #
@@ -3110,16 +3115,16 @@
 #
 # This is supported only for drive mirroring, where it also switches
 # the device to write to the target path only.  Note that drive
-# mirroring includes `drive-mirror`, `blockdev-mirror` and `block-commit`
-# job (only in case of "active commit", when the node being commited
-# is used by the guest).  The ability to complete is signaled with a
-# `BLOCK_JOB_READY` event.
+# mirroring includes `drive-mirror`, `blockdev-mirror` and
+# `block-commit` job (only in case of "active commit", when the node
+# being commited is used by the guest).  The ability to complete is
+# signaled with a `BLOCK_JOB_READY` event.
 #
 # This command completes an active background block operation
 # synchronously.  The ordering of this command's return with the
-# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O error
-# occurs during the processing of this command: 1) the command itself
-# will fail; 2) the error will be processed according to the
+# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O
+# error occurs during the processing of this command: 1) the command
+# itself will fail; 2) the error will be processed according to the
 # rerror/werror arguments that were specified when starting the
 # operation.
 #
@@ -3147,10 +3152,10 @@
 #
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
-# dismiss enabled.  In turn, automatic dismiss may be enabled only
-# for jobs that have @auto-dismiss option, which are `drive-backup`,
-# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit` and
-# `block-stream`.  @auto-dismiss is enabled by default for these
+# dismiss enabled.  In turn, automatic dismiss may be enabled only for
+# jobs that have @auto-dismiss option, which are `drive-backup`,
+# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit`
+# and `block-stream`.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
@@ -3183,8 +3188,8 @@
 # force ALL jobs in the transaction to finalize, so it is only
 # necessary to instruct a single member job to finalize.
 #
-# The command is applicable only to jobs which have @auto-finalize option
-# and only when this option is set to false.
+# The command is applicable only to jobs which have @auto-finalize
+# option and only when this option is set to false.
 #
 # @id: The job identifier.
 #
@@ -4814,9 +4819,9 @@
 # @cache: cache-related options
 #
 # @active: whether the block node should be activated (default: true).
-#     Having inactive block nodes is useful primarily for migration because it
-#     allows opening an image on the destination while the source is still
-#     holding locks for it.  (Since 10.0)
+#     Having inactive block nodes is useful primarily for migration
+#     because it allows opening an image on the destination while the
+#     source is still holding locks for it.  (Since 10.0)
 #
 # @read-only: whether the block device should be read-only (default:
 #     false).  Note that some block drivers support only read-only
@@ -5008,11 +5013,12 @@
 # cancelled.
 #
 # The command receives a list of block devices to reopen.  For each
-# one of them, the top-level @node-name option (from `BlockdevOptions`)
-# must be specified and is used to select the block device to be
-# reopened.  Other @node-name options must be either omitted or set to
-# the current name of the appropriate node.  This command won't change
-# any node name and any attempt to do it will result in an error.
+# one of them, the top-level @node-name option (from
+# `BlockdevOptions`) must be specified and is used to select the block
+# device to be reopened.  Other @node-name options must be either
+# omitted or set to the current name of the appropriate node.  This
+# command won't change any node name and any attempt to do it will
+# result in an error.
 #
 # In the case of options that refer to child nodes, the behavior of
 # this command depends on the value:
@@ -5031,10 +5037,10 @@
 # Options (1) and (2) are supported in all cases.  Option (3) is
 # supported for @file and @backing, and option (4) for @backing only.
 #
-# Unlike with `blockdev-add`, the @backing option must always be present
-# unless the node being reopened does not have a backing file and its
-# image does not have a default backing file name as part of its
-# metadata.
+# Unlike with `blockdev-add`, the @backing option must always be
+# present unless the node being reopened does not have a backing file
+# and its image does not have a default backing file name as part of
+# its metadata.
 #
 # Since: 6.1
 ##
@@ -5045,8 +5051,8 @@
 ##
 # @blockdev-del:
 #
-# Deletes a block device that has been added using `blockdev-add`.  The
-# command will fail if the node is attached to a device or is
+# Deletes a block device that has been added using `blockdev-add`.
+# The command will fail if the node is attached to a device or is
 # otherwise being used.
 #
 # @node-name: Name of the graph node to delete.
@@ -5078,18 +5084,18 @@
 ##
 # @blockdev-set-active:
 #
-# Activate or inactivate a block device.  Use this to manage the handover of
-# block devices on migration with qemu-storage-daemon.
+# Activate or inactivate a block device.  Use this to manage the
+# handover of block devices on migration with qemu-storage-daemon.
 #
-# Activating a node automatically activates all of its child nodes first.
-# Inactivating a node automatically inactivates any of its child nodes that are
-# not in use by a still active node.
+# Activating a node automatically activates all of its child nodes
+# first.  Inactivating a node automatically inactivates any of its
+# child nodes that are not in use by a still active node.
 #
-# @node-name: Name of the graph node to activate or inactivate.  By default, all
-#     nodes are affected by the operation.
+# @node-name: Name of the graph node to activate or inactivate.  By
+#     default, all nodes are affected by the operation.
 #
-# @active: true if the nodes should be active when the command returns success,
-#     false if they should be inactive.
+# @active: true if the nodes should be active when the command returns
+#     success, false if they should be inactive.
 #
 # Since: 10.0
 #
@@ -5945,9 +5951,9 @@
 # @BLOCK_JOB_PENDING:
 #
 # Emitted when a block job is awaiting explicit authorization to
-# finalize graph changes via `job-finalize`.  If this job is part
-# of a transaction, it will not emit this event until the transaction
-# has converged first.
+# finalize graph changes via `job-finalize`.  If this job is part of a
+# transaction, it will not emit this event until the transaction has
+# converged first.
 #
 # @type: job type
 #
diff --git a/qapi/block-export.json b/qapi/block-export.json
index 6878b89dcf..076954ef1a 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -38,8 +38,8 @@
 ##
 # @NbdServerOptions:
 #
-# Keep this type consistent with the `NbdServerOptionsLegacy` type.  The
-# only intended difference is using `SocketAddress` instead of
+# Keep this type consistent with the `NbdServerOptionsLegacy` type.
+# The only intended difference is using `SocketAddress` instead of
 # `SocketAddressLegacy`.
 #
 # @addr: Address on which to listen (since 4.2).
@@ -51,8 +51,8 @@
 ##
 # @NbdServerOptionsLegacy:
 #
-# Keep this type consistent with the `NbdServerOptions` type.  The only
-# intended difference is using `SocketAddressLegacy` instead of
+# Keep this type consistent with the `NbdServerOptions` type.  The
+# only intended difference is using `SocketAddressLegacy` instead of
 # `SocketAddress`.
 #
 # @addr: Address on which to listen (since 1.3).
@@ -125,8 +125,8 @@
 # A vhost-user-blk block export.
 #
 # @addr: The vhost-user socket on which to listen.  Both 'unix' and
-#     'fd' `SocketAddress` types are supported.  Passed fds must be UNIX
-#     domain sockets.
+#     'fd' `SocketAddress` types are supported.  Passed fds must be
+#     UNIX domain sockets.
 #
 # @logical-block-size: Logical block size in bytes.  Defaults to 512
 #     bytes.
@@ -373,11 +373,12 @@
 #     cannot be moved to the iothread.  The default is false.
 #     (since: 5.2)
 #
-# @allow-inactive: If true, the export allows the exported node to be inactive.
-#     If it is created for an inactive block node, the node remains inactive.  If
-#     the export type doesn't support running on an inactive node, an error is
-#     returned.  If false, inactive block nodes are automatically activated before
-#     creating the export and trying to inactivate them later fails.
+# @allow-inactive: If true, the export allows the exported node to be
+#     inactive.  If it is created for an inactive block node, the node
+#     remains inactive.  If the export type doesn't support running on
+#     an inactive node, an error is returned.  If false, inactive
+#     block nodes are automatically activated before creating the
+#     export and trying to inactivate them later fails.
 #     (since: 10.0; default: false)
 #
 # Since: 4.2
@@ -460,7 +461,8 @@
 # @node-name: The node name of the block node that is exported
 #
 # @shutting-down: True if the export is shutting down (e.g. after a
-#     `block-export-del` command, but before the shutdown has completed)
+#     `block-export-del` command, but before the shutdown has
+#     completed)
 #
 # Since: 5.2
 ##
diff --git a/qapi/crypto.json b/qapi/crypto.json
index ab6eda4c2f..72ac718147 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -46,7 +46,8 @@
 #
 # @md5: MD5.  Should not be used in any new code, legacy compat only
 #
-# @sha1: SHA-1.  Should not be used in any new code, legacy compat only
+# @sha1: SHA-1.  Should not be used in any new code, legacy compat
+#     only
 #
 # @sha224: SHA-224.  (since 2.7)
 #
@@ -377,8 +378,8 @@
 #     deactivate all keyslots that match password located in
 #     QCryptoSecret with this ID
 #
-# @iter-time: Optional (for activation only).  Number of milliseconds to
-#     spend in PBKDF passphrase processing for the newly activated
+# @iter-time: Optional (for activation only).  Number of milliseconds
+#     to spend in PBKDF passphrase processing for the newly activated
 #     keyslot.  Currently defaults to 2000.
 #
 # @keyslot: Optional.  ID of the keyslot to activate/deactivate.  For
diff --git a/qapi/introspect.json b/qapi/introspect.json
index 53100714a8..c8432c8ed8 100644
--- a/qapi/introspect.json
+++ b/qapi/introspect.json
@@ -22,10 +22,10 @@
 # `SchemaInfo`.  This lets QMP clients figure out what commands and
 # events are available in this QEMU, and their parameters and results.
 #
-# However, the `SchemaInfo` can't reflect all the rules and restrictions
-# that apply to QMP.  It's interface introspection (figuring out
-# what's there), not interface specification.  The specification is in
-# the QAPI schema.
+# However, the `SchemaInfo` can't reflect all the rules and
+# restrictions that apply to QMP.  It's interface introspection
+# (figuring out what's there), not interface specification.  The
+# specification is in the QAPI schema.
 #
 # Furthermore, while we strive to keep the QMP wire format
 # backwards-compatible across QEMU versions, the introspection output
diff --git a/qapi/job.json b/qapi/job.json
index 8b08350af2..0a301fc094 100644
--- a/qapi/job.json
+++ b/qapi/job.json
@@ -194,16 +194,16 @@
 #
 # This is supported only for drive mirroring, where it also switches
 # the device to write to the target path only.  Note that drive
-# mirroring includes `drive-mirror`, `blockdev-mirror` and `block-commit`
-# job (only in case of "active commit", when the node being commited
-# is used by the guest).  The ability to complete is signaled with a
-# `BLOCK_JOB_READY` event.
+# mirroring includes `drive-mirror`, `blockdev-mirror` and
+# `block-commit` job (only in case of "active commit", when the node
+# being commited is used by the guest).  The ability to complete is
+# signaled with a `BLOCK_JOB_READY` event.
 #
 # This command completes an active background block operation
 # synchronously.  The ordering of this command's return with the
-# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O error
-# occurs during the processing of this command: 1) the command itself
-# will fail; 2) the error will be processed according to the
+# `BLOCK_JOB_COMPLETED` event is not defined.  Note that if an I/O
+# error occurs during the processing of this command: 1) the command
+# itself will fail; 2) the error will be processed according to the
 # rerror/werror arguments that were specified when starting the
 # operation.
 #
@@ -218,16 +218,16 @@
 #
 # Deletes a job that is in the CONCLUDED state.  This command only
 # needs to be run explicitly for jobs that don't have automatic
-# dismiss enabled.  In turn, automatic dismiss may be enabled only
-# for jobs that have @auto-dismiss option, which are `drive-backup`,
-# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit` and
-# `block-stream`.  @auto-dismiss is enabled by default for these
+# dismiss enabled.  In turn, automatic dismiss may be enabled only for
+# jobs that have @auto-dismiss option, which are `drive-backup`,
+# `blockdev-backup`, `drive-mirror`, `blockdev-mirror`, `block-commit`
+# and `block-stream`.  @auto-dismiss is enabled by default for these
 # jobs.
 #
 # This command will refuse to operate on any job that has not yet
 # reached its terminal state, CONCLUDED.  For jobs that make use of
-# the JOB_READY event, `job-cancel` or `job-complete` will still need to
-# be used as appropriate.
+# the JOB_READY event, `job-cancel` or `job-complete` will still need
+# to be used as appropriate.
 #
 # @id: The job identifier.
 #
@@ -247,8 +247,8 @@
 # force ALL jobs in the transaction to finalize, so it is only
 # necessary to instruct a single member job to finalize.
 #
-# The command is applicable only to jobs which have @auto-finalize option
-# and only when this option is set to false.
+# The command is applicable only to jobs which have @auto-finalize
+# option and only when this option is set to false.
 #
 # @id: The identifier of any job in the transaction, or of a job that
 #     is not part of any transaction.
diff --git a/qapi/machine-common.json b/qapi/machine-common.json
index ed3d20a2fb..92e84dfb14 100644
--- a/qapi/machine-common.json
+++ b/qapi/machine-common.json
@@ -87,8 +87,8 @@
 #
 # Cache information for SMP system.
 #
-# @cache: Cache name, which is the combination of cache level
-#     and cache type.
+# @cache: Cache name, which is the combination of cache level and
+#     cache type.
 #
 # @topology: Cache topology level.  It accepts the CPU topology
 #     enumeration as the parameter, i.e., CPUs in the same
diff --git a/qapi/machine-s390x.json b/qapi/machine-s390x.json
index 8412668b67..ea430e1b88 100644
--- a/qapi/machine-s390x.json
+++ b/qapi/machine-s390x.json
@@ -123,8 +123,8 @@
 ##
 # @SCLP_CPI_INFO_AVAILABLE:
 #
-# Emitted when the Control-Program Identification data is available
-# in the QOM tree.
+# Emitted when the Control-Program Identification data is available in
+# the QOM tree.
 #
 # Features:
 #
diff --git a/qapi/machine.json b/qapi/machine.json
index c6dc6fe69b..907cb25f75 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -620,8 +620,8 @@
 ##
 # @NumaCpuOptions:
 #
-# Option "-numa cpu" overrides default cpu to node mapping.  It accepts
-# the same set of cpu properties as returned by
+# Option "-numa cpu" overrides default cpu to node mapping.  It
+# accepts the same set of cpu properties as returned by
 # `query-hotpluggable-cpus[].props <query-hotpluggable-cpus>`, where
 # node-id could be used to override default node mapping.
 #
@@ -686,8 +686,8 @@
 # Set the system locality latency and bandwidth information between
 # Initiator and Target proximity Domains.
 #
-# For more information about `NumaHmatLBOptions`, see chapter 5.2.27.4:
-# Table 5-146 of ACPI 6.3 spec.
+# For more information about `NumaHmatLBOptions`, see chapter
+# 5.2.27.4: Table 5-146 of ACPI 6.3 spec.
 #
 # @initiator: the Initiator Proximity Domain.
 #
@@ -743,8 +743,8 @@
 # Cache write policy in the Memory Side Cache Information Structure of
 # HMAT
 #
-# For more information of `HmatCacheWritePolicy`, see chapter 5.2.27.5:
-# Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
+# For more information of `HmatCacheWritePolicy`, see chapter
+# 5.2.27.5: Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
 #
 # @none: None (no memory side cache in this proximity domain, or cache
 #     write policy unknown)
@@ -763,8 +763,8 @@
 #
 # Set the memory side cache information for a given memory domain.
 #
-# For more information of `NumaHmatCacheOptions`, see chapter 5.2.27.5:
-# Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
+# For more information of `NumaHmatCacheOptions`, see chapter
+# 5.2.27.5: Table 5-147: Field "Cache Attributes" of ACPI 6.3 spec.
 #
 # @node-id: the memory proximity domain to which the memory belongs.
 #
@@ -959,7 +959,7 @@
 #     belongs to (since 7.1)
 #
 # @module-id: module number within the parent container the CPU
-#    belongs to (since 9.1)
+#     belongs to (since 9.1)
 #
 # @core-id: core number within the parent container the CPU belongs to
 #
@@ -1090,7 +1090,7 @@
 # @value: the target logical size of the VM in bytes.  We can deduce
 #     the size of the balloon using this formula:
 #
-#        logical_vm_size = vm_ram_size - balloon_size
+#         logical_vm_size = vm_ram_size - balloon_size
 #
 #     From it we have: balloon_size = vm_ram_size - @value
 #
@@ -1845,7 +1845,7 @@
 # @version: Firmware version.
 #
 # @log: Firmware debug log, in base64 encoding.  First and last log
-#       line might be incomplete.
+#     line might be incomplete.
 #
 # Since: 10.2
 ##
@@ -1859,8 +1859,8 @@
 # Find firmware memory log buffer in guest memory, return content.
 #
 # @max-size: limit the amount of log data returned.  Up to 1 MiB of
-#            log data is allowed.  In case the amount of log data is
-#            larger than @max-size the tail of the log is returned.
+#     log data is allowed.  In case the amount of log data is larger
+#     than @max-size the tail of the log is returned.
 #
 # Since: 10.2
 ##
@@ -2004,11 +2004,11 @@
 # @query-cpu-model-comparison:
 #
 # Compares two CPU models, @modela and @modelb, returning how they
-# compare in a specific configuration.  The results indicates how
-# both models compare regarding runnability.  This result can be
-# used by tooling to make decisions if a certain CPU model will
-# run in a certain configuration or if a compatible CPU model has
-# to be created by baselining.
+# compare in a specific configuration.  The results indicates how both
+# models compare regarding runnability.  This result can be used by
+# tooling to make decisions if a certain CPU model will run in a
+# certain configuration or if a compatible CPU model has to be created
+# by baselining.
 #
 # Usually, a CPU model is compared against the maximum possible CPU
 # model of a certain configuration (e.g. the "host" model for KVM).
@@ -2029,7 +2029,8 @@
 #   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using `query-cpu-model-expansion` while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not
+#   advised.
 #
 # Some architectures may not support comparing CPU models.  s390x
 # supports comparing CPU models.
@@ -2083,7 +2084,8 @@
 #   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using `query-cpu-model-expansion` while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not
+#   advised.
 #
 # Some architectures may not support baselining CPU models.  s390x
 # supports baselining CPU models.
@@ -2114,8 +2116,8 @@
 #
 # @model: the expanded `CpuModelInfo`.
 #
-# @deprecated-props: an optional list of properties that are flagged as
-#     deprecated by the CPU vendor.  The list depends on the
+# @deprecated-props: an optional list of properties that are flagged
+#     as deprecated by the CPU vendor.  The list depends on the
 #     `CpuModelExpansionType`: "static" properties are a subset of the
 #     enabled-properties for the expanded model; "full" properties are
 #     a set of properties that are deprecated across all models for
@@ -2151,7 +2153,8 @@
 #   `query-cpu-definitions`.)
 # * "-cpu" arguments and global properties: arguments to the -cpu
 #   option and global properties may affect expansion of CPU models.
-#   Using `query-cpu-model-expansion` while using these is not advised.
+#   Using `query-cpu-model-expansion` while using these is not
+#   advised.
 #
 # Some architectures may not support all expansion types.  s390x
 # supports "full" and "static".  Arm only supports "full".
diff --git a/qapi/migration.json b/qapi/migration.json
index be0f3fcc12..4dd1098219 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -160,11 +160,11 @@
 #
 # @pre-switchover: Paused before device serialisation.  (since 2.11)
 #
-# @device: During device serialisation (also known as switchover phase).
-#     Before 9.2, this is only used when (1) in precopy, and (2) when
-#     pre-switchover capability is enabled.  After 10.0, this state will
-#     always be present for every migration procedure as the switchover
-#     phase.  (since 2.11)
+# @device: During device serialisation (also known as switchover
+#     phase).  Before 9.2, this is only used when (1) in precopy, and
+#     (2) when pre-switchover capability is enabled.  After 10.0, this
+#     state will always be present for every migration procedure as
+#     the switchover phase.  (since 2.11)
 #
 # @wait-unplug: wait for device unplug request by guest OS to be
 #     completed.  (since 4.2)
@@ -238,31 +238,34 @@
 #     This is only present when the postcopy-blocktime migration
 #     capability is enabled.  (Since 3.0)
 #
-# @postcopy-latency: average remote page fault latency (in ns).  Note that
-#     this doesn't include all faults, but only the ones that require a
-#     remote page request.  So it should be always bigger than the real
-#     average page fault latency. This is only present when the
-#     postcopy-blocktime migration capability is enabled.  (Since 10.1)
-#
-# @postcopy-latency-dist: remote page fault latency distributions.  Each
-#     element of the array is the number of faults that fall into the
-#     bucket period.  For the N-th bucket (N>=0), the latency window is
-#     [2^Nus, 2^(N+1)us).  For example, the 8th element stores how many
-#     remote faults got resolved within [256us, 512us) window. This is only
-#     present when the postcopy-blocktime migration capability is enabled.
+# @postcopy-latency: average remote page fault latency (in ns).  Note
+#     that this doesn't include all faults, but only the ones that
+#     require a remote page request.  So it should be always bigger
+#     than the real average page fault latency.  This is only present
+#     when the postcopy-blocktime migration capability is enabled.
 #     (Since 10.1)
 #
-# @postcopy-vcpu-latency: average remote page fault latency per vCPU (in
-#     ns).  It has the same definition of @postcopy-latency, but instead
-#     this is the per-vCPU statistics.  This is only present when the
-#     postcopy-blocktime migration capability is enabled.  (Since 10.1)
-#
-# @postcopy-non-vcpu-latency: average remote page fault latency for all
-#     faults happend in non-vCPU threads (in ns).  It has the same
-#     definition of @postcopy-latency but this only provides statistics to
-#     non-vCPU faults.  This is only present when the postcopy-blocktime
+# @postcopy-latency-dist: remote page fault latency distributions.
+#     Each element of the array is the number of faults that fall into
+#     the bucket period.  For the N-th bucket (N>=0), the latency
+#     window is [2^Nus, 2^(N+1)us).  For example, the 8th element
+#     stores how many remote faults got resolved within [256us, 512us)
+#     window.  This is only present when the postcopy-blocktime
 #     migration capability is enabled.  (Since 10.1)
 #
+# @postcopy-vcpu-latency: average remote page fault latency per vCPU
+#     (in ns).  It has the same definition of @postcopy-latency, but
+#     instead this is the per-vCPU statistics.  This is only present
+#     when the postcopy-blocktime migration capability is enabled.
+#     (Since 10.1)
+#
+# @postcopy-non-vcpu-latency: average remote page fault latency for
+#     all faults happend in non-vCPU threads (in ns).  It has the same
+#     definition of @postcopy-latency but this only provides
+#     statistics to non-vCPU faults.  This is only present when the
+#     postcopy-blocktime migration capability is enabled.
+#     (Since 10.1)
+#
 # @socket-address: Only used for tcp, to know what the real port is
 #     (Since 4.0)
 #
@@ -290,7 +293,8 @@
 # Features:
 #
 # @unstable: Members @postcopy-latency, @postcopy-vcpu-latency,
-#     @postcopy-latency-dist, @postcopy-non-vcpu-latency are experimental.
+#     @postcopy-latency-dist, @postcopy-non-vcpu-latency are
+#     experimental.
 #
 # Since: 0.14
 ##
@@ -322,9 +326,8 @@
 ##
 # @query-migrate:
 #
-# Return information about current migration process.  If migration
-# is active there will be another json-object with RAM migration
-# status.
+# Return information about current migration process.  If migration is
+# active there will be another json-object with RAM migration status.
 #
 # Since: 0.14
 #
@@ -627,8 +630,8 @@
 #
 # @normal: the original form of migration.  (since 8.2)
 #
-# @cpr-reboot: The `migrate` command stops the VM and saves state to the
-#     URI.  After quitting QEMU, the user resumes by running QEMU
+# @cpr-reboot: The `migrate` command stops the VM and saves state to
+#     the URI.  After quitting QEMU, the user resumes by running QEMU
 #     -incoming.
 #
 #     This mode allows the user to quit QEMU, optionally update and
@@ -659,15 +662,15 @@
 #     time by preserving guest RAM in place.
 #
 #     Devices and their pinned pages are also preserved for VFIO and
-#     IOMMUFD. (since 10.1)
+#     IOMMUFD.  (since 10.1)
 #
 #     The user starts new QEMU on the same host as old QEMU, with
 #     command-line arguments to create the same machine, plus the
 #     -incoming option for the main migration channel, like normal
 #     live migration.  In addition, the user adds a second -incoming
 #     option with channel type "cpr".  This CPR channel must support
-#     file descriptor transfer with SCM_RIGHTS, i.e. it must be a
-#     UNIX domain socket.
+#     file descriptor transfer with SCM_RIGHTS, i.e. it must be a UNIX
+#     domain socket.
 #
 #     To initiate CPR, the user issues a migrate command to old QEMU,
 #     adding a second migration channel of type "cpr" in the channels
@@ -708,8 +711,8 @@
 #     QEMU binary.
 #
 #     Because old QEMU terminates when new QEMU starts, one cannot
-#     stream data between the two, so the channel must be a type,
-#     such as a file, that accepts all data before old QEMU exits.
+#     stream data between the two, so the channel must be a type, such
+#     as a file, that accepts all data before old QEMU exits.
 #     Otherwise, old QEMU may quietly block writing to the channel.
 #
 #     Memory-backend objects must have the share=on attribute, but
@@ -903,9 +906,10 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration.  The level is an integer between 1 and 9, where 1 means
-#     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
+#     migration.  The level is an integer between 1 and 9, where 1
+#     means the best compression speed, and 9 means the best
+#     compression ratio which will consume more CPU.  Defaults to 1.
+#     (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
@@ -939,8 +943,8 @@
 # @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
-# @zero-page-detection: Whether and how to detect zero pages.
-#     See description in `ZeroPageDetection`.  Default is 'multifd'.
+# @zero-page-detection: Whether and how to detect zero pages.  See
+#     description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1089,9 +1093,10 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration.  The level is an integer between 1 and 9, where 1 means
-#     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
+#     migration.  The level is an integer between 1 and 9, where 1
+#     means the best compression speed, and 9 means the best
+#     compression ratio which will consume more CPU.  Defaults to 1.
+#     (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
@@ -1125,8 +1130,8 @@
 # @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
-# @zero-page-detection: Whether and how to detect zero pages.
-#     See description in `ZeroPageDetection`.  Default is 'multifd'.
+# @zero-page-detection: Whether and how to detect zero pages.  See
+#     description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1304,9 +1309,10 @@
 #     more CPU.  Defaults to 1.  (Since 5.0)
 #
 # @multifd-qatzip-level: Set the compression level to be used in live
-#     migration.  The level is an integer between 1 and 9, where 1 means
-#     the best compression speed, and 9 means the best compression
-#     ratio which will consume more CPU.  Defaults to 1.  (Since 9.2)
+#     migration.  The level is an integer between 1 and 9, where 1
+#     means the best compression speed, and 9 means the best
+#     compression ratio which will consume more CPU.  Defaults to 1.
+#     (Since 9.2)
 #
 # @multifd-zstd-level: Set the compression level to be used in live
 #     migration, the compression level is an integer between 0 and 20,
@@ -1340,8 +1346,8 @@
 # @mode: Migration mode.  See description in `MigMode`.  Default is
 #     'normal'.  (Since 8.2)
 #
-# @zero-page-detection: Whether and how to detect zero pages.
-#     See description in `ZeroPageDetection`.  Default is 'multifd'.
+# @zero-page-detection: Whether and how to detect zero pages.  See
+#     description in `ZeroPageDetection`.  Default is 'multifd'.
 #     (since 9.0)
 #
 # @direct-io: Open migration files with O_DIRECT when possible.  This
@@ -1813,9 +1819,9 @@
 #     list connected to a destination interface endpoint.
 #
 # @exit-on-error: Exit on incoming migration failure.  Default true.
-#     When set to false, the failure triggers a :qapi:event:`MIGRATION`
-#     event, and error details could be retrieved with `query-migrate`.
-#     (since 9.1)
+#     When set to false, the failure triggers a
+#     :qapi:event:`MIGRATION` event, and error details could be
+#     retrieved with `query-migrate`.  (since 9.1)
 #
 # Since: 2.3
 #
@@ -2368,8 +2374,7 @@
 ##
 # @query-vcpu-dirty-limit:
 #
-# Return information about virtual CPU dirty page rate limits, if
-# any.
+# Return information about virtual CPU dirty page rate limits, if any.
 #
 # Since: 7.1
 #
@@ -2507,8 +2512,8 @@
 # time it takes to load the snapshot.
 #
 # It is strongly recommended that @devices contain all writable block
-# device nodes that can have changed since the original `snapshot-save`
-# command execution.
+# device nodes that can have changed since the original
+# `snapshot-save` command execution.
 #
 # .. qmp-example::
 #
diff --git a/qapi/net.json b/qapi/net.json
index 7f62f8cc39..4c6cc5ca8d 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -119,9 +119,11 @@
 #
 # Unprivileged user-mode network connectivity using passt
 #
-# @path: Filename of the passt program to run (by default 'passt', and use PATH)
+# @path: Filename of the passt program to run (by default 'passt', and
+#     use PATH)
 #
-# @quiet: don't print informational messages (default, passed as '--quiet')
+# @quiet: don't print informational messages (default, passed as
+#     '--quiet')
 #
 # @vhost-user: enable vhost-user
 #
@@ -281,8 +283,8 @@
 #
 # @smbserver: IP address of the built-in SMB server
 #
-# @hostfwd: redirect incoming TCP, UDP or UNIX host connections to guest
-#     endpoints
+# @hostfwd: redirect incoming TCP, UDP or UNIX host connections to
+#     guest endpoints
 #
 # @guestfwd: forward guest TCP connections
 #
@@ -569,7 +571,8 @@
 #     (default: 0).
 #
 # @inhibit: Don't load a default XDP program, use one already loaded
-#     to the interface (default: false).  Requires @sock-fds or @map-path.
+#     to the interface (default: false).  Requires @sock-fds or
+#     @map-path.
 #
 # @sock-fds: A colon (:) separated list of file descriptors for
 #     already open but not bound AF_XDP sockets in the queue order.
@@ -582,7 +585,8 @@
 #     mutually exclusive.  Requires @inhibit.  (Since 10.1)
 #
 # @map-start-index: Use @map-path to insert xsk sockets starting from
-#     this index number (default: 0).  Requires @map-path.  (Since 10.1)
+#     this index number (default: 0).  Requires @map-path.
+#     (Since 10.1)
 #
 # Since: 8.2
 ##
@@ -770,9 +774,10 @@
 #
 # @server: create server socket (default: false)
 #
-# @reconnect-ms: For a client socket, if a socket is disconnected, then
-#     attempt a reconnect after the given number of milliseconds.  Setting
-#     this to zero disables this function.  (default: 0) (Since: 9.2)
+# @reconnect-ms: For a client socket, if a socket is disconnected,
+#     then attempt a reconnect after the given number of milliseconds.
+#     Setting this to zero disables this function.
+#     (default: 0) (Since: 9.2)
 #
 # Only `SocketAddress` types 'unix', 'inet' and 'fd' are supported.
 #
diff --git a/qapi/qdev.json b/qapi/qdev.json
index e14a0c9259..974cf9c583 100644
--- a/qapi/qdev.json
+++ b/qapi/qdev.json
@@ -100,8 +100,8 @@
 #    process is signaled with a `DEVICE_DELETED` event.  Guest reset
 #    will automatically complete removal for all devices.  If a
 #    guest-side error in the hot removal process is detected, the
-#    device will not be removed and a `DEVICE_UNPLUG_GUEST_ERROR` event
-#    is sent.  Some errors cannot be detected.
+#    device will not be removed and a `DEVICE_UNPLUG_GUEST_ERROR`
+#    event is sent.  Some errors cannot be detected.
 #
 # Since: 0.14
 #
diff --git a/qapi/qom.json b/qapi/qom.json
index 830cb2ffe7..d7dceaf2f8 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -52,7 +52,8 @@
 #
 # @name: the name of the property.
 #
-# @type: the type of the property, as described in `ObjectPropertyInfo`.
+# @type: the type of the property, as described in
+#     `ObjectPropertyInfo`.
 #
 # @value: the value of the property.  Absent when the property cannot
 #     be read.
@@ -112,7 +113,7 @@
 #     Absolute paths are derived from the root object and can follow
 #     child<> or link<> properties.  Since they can follow link<>
 #     properties, they can be arbitrarily long.  Absolute paths look
-#     like absolute filenames and are prefixed  with a leading slash.
+#     like absolute filenames and are prefixed with a leading slash.
 #
 #     Partial paths look like relative filenames.  They do not begin
 #     with a prefix.  The matching rules for partial paths are subtle
@@ -917,14 +918,14 @@
 #     combined with information retrieved from the discoverable part
 #     of the path.  An example would use CDAT (see UEFI.org)
 #     information read from devices and switches in conjunction with
-#     link characteristics read from PCIe Configuration space.
-#     To get the full path latency from CPU to CXL attached DRAM
-#     CXL device: Add the latency from CPU to Generic Port (from
-#     HMAT indexed via the node ID in this SRAT structure) to
-#     that for CXL bus links, the latency across intermediate switches
-#     and from the EP port to the actual memory.  Bandwidth is more
-#     complex as there may be interleaving across multiple devices
-#     and shared links in the path.
+#     link characteristics read from PCIe Configuration space.  To get
+#     the full path latency from CPU to CXL attached DRAM CXL device:
+#     Add the latency from CPU to Generic Port (from HMAT indexed via
+#     the node ID in this SRAT structure) to that for CXL bus links,
+#     the latency across intermediate switches and from the EP port to
+#     the actual memory.  Bandwidth is more complex as there may be
+#     interleaving across multiple devices and shared links in the
+#     path.
 #
 # Since: 9.2
 ##
@@ -1040,8 +1041,7 @@
 #    behave identically to 'on', but will automatically switch to
 #    using KVM_SEV_INIT2 if the user specifies any additional options
 #    that require it.  If set to 'off', QEMU will require
-#    KVM_SEV_INIT2 unconditionally.
-#    (default: off) (since 9.1)
+#    KVM_SEV_INIT2 unconditionally.  (default: off) (since 9.1)
 #
 # Since: 2.12
 ##
@@ -1082,8 +1082,8 @@
 #     Authentication Information Structure' for the SNP_LAUNCH_FINISH
 #     command defined in the SEV-SNP firmware ABI (default: all-zero)
 #
-# @author-key-enabled: true if 'id-auth' blob contains the 'AUTHOR_KEY'
-#     field defined SEV-SNP firmware ABI (default: false)
+# @author-key-enabled: true if 'id-auth' blob contains the
+#     'AUTHOR_KEY' field defined SEV-SNP firmware ABI (default: false)
 #
 # @host-data: 32-byte, base64-encoded, user-defined blob to provide to
 #     the guest, as documented for the 'HOST_DATA' parameter of the
@@ -1117,17 +1117,17 @@
 # @attributes: The 'attributes' of a TD guest that is passed to
 #     KVM_TDX_INIT_VM
 #
-# @sept-ve-disable: toggle bit 28 of TD attributes to control disabling
-#     of EPT violation conversion to #VE on guest TD access of PENDING
-#     pages.  Some guest OS (e.g., Linux TD guest) may require this to
-#     be set, otherwise they refuse to boot.
+# @sept-ve-disable: toggle bit 28 of TD attributes to control
+#     disabling of EPT violation conversion to #VE on guest TD access
+#     of PENDING pages.  Some guest OS (e.g., Linux TD guest) may
+#     require this to be set, otherwise they refuse to boot.
 #
 # @mrconfigid: ID for non-owner-defined configuration of the guest TD,
-#     e.g., run-time or OS configuration (base64 encoded SHA384 digest).
-#     Defaults to all zeros.
+#     e.g., run-time or OS configuration (base64 encoded SHA384
+#     digest).  Defaults to all zeros.
 #
-# @mrowner: ID for the guest TD’s owner (base64 encoded SHA384 digest).
-#     Defaults to all zeros.
+# @mrowner: ID for the guest TD’s owner (base64 encoded SHA384
+#     digest).  Defaults to all zeros.
 #
 # @mrownerconfig: ID for owner-defined configuration of the guest TD,
 #     e.g., specific to the workload rather than the run-time or OS
diff --git a/qapi/run-state.json b/qapi/run-state.json
index 4757947ca6..2872bee06e 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -247,8 +247,8 @@
 # saved on disk, for example, S4 state, which is sometimes called
 # hibernate state
 #
-# .. note:: QEMU shuts down (similar to event `SHUTDOWN`) when entering
-#    this state.
+# .. note:: QEMU shuts down (similar to event `SHUTDOWN`) when
+#    entering this state.
 #
 # Since: 1.2
 #
@@ -281,9 +281,9 @@
 #
 # @action: action that has been taken
 #
-# .. note:: If action is "reset", "shutdown", or "pause" the `WATCHDOG`
-#    event is followed respectively by the `RESET`, `SHUTDOWN`, or `STOP`
-#    events.
+# .. note:: If action is "reset", "shutdown", or "pause" the
+#    `WATCHDOG` event is followed respectively by the `RESET`,
+#    `SHUTDOWN`, or `STOP` events.
 #
 # .. note:: This event is rate-limited.
 #
@@ -402,7 +402,8 @@
 #
 # @panic: `PanicAction` action taken on guest panic.
 #
-# @watchdog: `WatchdogAction` action taken when watchdog timer expires.
+# @watchdog: `WatchdogAction` action taken when watchdog timer
+#     expires.
 #
 # Since: 6.0
 #
@@ -542,8 +543,8 @@
 # @arg4: for Windows, third argument of the `STOP`.  For Linux, the
 #     RAX register (x86) or the stack pointer (aarch64) of the guest.
 #
-# @arg5: for Windows, fourth argument of the `STOP`.  For x86 Linux, the
-#     stack pointer of the guest.
+# @arg5: for Windows, fourth argument of the `STOP`.  For x86 Linux,
+#     the stack pointer of the guest.
 #
 # Since: 2.9
 ##
@@ -610,7 +611,7 @@
 #
 # @error-code: TD-specific error code
 #
-# @message: Human-readable error message provided by the guest. Not
+# @message: Human-readable error message provided by the guest.  Not
 #     to be trusted.
 #
 # @gpa: guest-physical address of a page that contains more verbose
diff --git a/qapi/sockets.json b/qapi/sockets.json
index 32fac51728..473be2ac58 100644
--- a/qapi/sockets.json
+++ b/qapi/sockets.json
@@ -58,24 +58,26 @@
 # @ipv6: whether to accept IPv6 addresses, default try both IPv4 and
 #     IPv6
 #
-# @keep-alive: enable keep-alive when connecting to/listening on this socket.
+# @keep-alive: enable keep-alive when connecting to/listening on this
+#     socket.
 #     (Since 4.2, not supported for listening sockets until 10.1)
 #
-# @keep-alive-count: number of keep-alive packets sent before the connection is
-#     closed.  Only supported for TCP sockets on systems where TCP_KEEPCNT
-#     socket option is defined (this includes Linux, Windows, macOS, FreeBSD,
-#     but not OpenBSD).  When set to 0, system setting is used.  (Since 10.1)
+# @keep-alive-count: number of keep-alive packets sent before the
+#     connection is closed.  Only supported for TCP sockets on systems
+#     where TCP_KEEPCNT socket option is defined (this includes Linux,
+#     Windows, macOS, FreeBSD, but not OpenBSD).  When set to 0,
+#     system setting is used.  (Since 10.1)
 #
-# @keep-alive-idle: time in seconds the connection needs to be idle before
-#     sending a keepalive packet.  Only supported for TCP sockets on systems
-#     where TCP_KEEPIDLE socket option is defined (this includes Linux,
-#     Windows, macOS, FreeBSD, but not OpenBSD).  When set to 0, system setting
-#     is used.  (Since 10.1)
+# @keep-alive-idle: time in seconds the connection needs to be idle
+#     before sending a keepalive packet.  Only supported for TCP
+#     sockets on systems where TCP_KEEPIDLE socket option is defined
+#     (this includes Linux, Windows, macOS, FreeBSD, but not OpenBSD).
+#     When set to 0, system setting is used.  (Since 10.1)
 #
-# @keep-alive-interval: time in seconds between keep-alive packets.  Only
-#     supported for TCP sockets on systems where TCP_KEEPINTVL is defined (this
-#     includes Linux, Windows, macOS, FreeBSD, but not OpenBSD).  When set to
-#     0, system setting is used.  (Since 10.1)
+# @keep-alive-interval: time in seconds between keep-alive packets.
+#     Only supported for TCP sockets on systems where TCP_KEEPINTVL is
+#     defined (this includes Linux, Windows, macOS, FreeBSD, but not
+#     OpenBSD).  When set to 0, system setting is used.  (Since 10.1)
 #
 # @mptcp: enable multi-path TCP.  (Since 6.1)
 #
diff --git a/qapi/stats.json b/qapi/stats.json
index 151ac43c48..a98624531c 100644
--- a/qapi/stats.json
+++ b/qapi/stats.json
@@ -185,8 +185,8 @@
 # Return runtime-collected statistics for objects such as the VM or
 # its vCPUs.
 #
-# The arguments are a `StatsFilter` and specify the provider and objects
-# to return statistics about.
+# The arguments are a `StatsFilter` and specify the provider and
+# objects to return statistics about.
 #
 # Returns: a list of statistics, one for each provider and object
 #     (e.g., for each vCPU).
diff --git a/qapi/ui.json b/qapi/ui.json
index 1b2f4a4769..804b1ecc3b 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -1023,10 +1023,10 @@
 #
 # Send keys to guest.
 #
-# @keys: An array of `KeyValue` elements.  All @KeyValues in this array
-#     are simultaneously sent to the guest.  A `KeyValue`.number value
-#     is sent directly to the guest, while `KeyValue`.qcode must be a
-#     valid `QKeyCode` value
+# @keys: An array of `KeyValue` elements.  All @KeyValues in this
+#     array are simultaneously sent to the guest.  A `KeyValue`.number
+#     value is sent directly to the guest, while `KeyValue`.qcode must
+#     be a valid `QKeyCode` value
 #
 # @hold-time: time to delay key up events, milliseconds.  Defaults to
 #     100
@@ -1335,10 +1335,11 @@
 # @show-menubar: Display the main window menubar.  Defaults to "on".
 #     (Since 8.0)
 #
-# @keep-aspect-ratio: Keep width/height aspect ratio of guest content when
-#     resizing host window.  Defaults to "on". (Since 10.1)
+# @keep-aspect-ratio: Keep width/height aspect ratio of guest content
+#     when resizing host window.  Defaults to "on".  (Since 10.1)
 #
-# @scale: Set preferred scale of the display.  Defaults to 1.0.  (Since 10.1)
+# @scale: Set preferred scale of the display.  Defaults to 1.0.
+#     (Since 10.1)
 #
 # Since: 2.12
 ##
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 05295ab665..72790bcfb0 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -984,8 +984,8 @@
 ##
 # @DummyVirtioForceArrays:
 #
-# Not used by QMP; hack to let us use IOThreadVirtQueueMappingList
-# and VirtIOGPUOutputList internally
+# Not used by QMP; hack to let us use IOThreadVirtQueueMappingList and
+# VirtIOGPUOutputList internally
 #
 # Since: 9.0
 ##

From 879113504c34939bcc4b121b88498f21e0afd119 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:48 +0100
Subject: [PATCH 2018/2396] qapi: Clean up whitespace between definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Consistently separate definitions with a single blank line.
Consistently separate member descriptions with a blank line.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-4-armbru@redhat.com>
---
 qapi/acpi-hest.json | 1 -
 qapi/char.json      | 1 -
 qapi/crypto.json    | 1 +
 qapi/cxl.json       | 1 -
 qapi/migration.json | 3 +++
 qapi/misc-i386.json | 2 --
 qapi/net.json       | 3 ---
 qapi/qom.json       | 3 ---
 qapi/run-state.json | 1 -
 qapi/ui.json        | 2 +-
 qapi/virtio.json    | 2 --
 11 files changed, 5 insertions(+), 15 deletions(-)

diff --git a/qapi/acpi-hest.json b/qapi/acpi-hest.json
index 88c53eaf1b..a01f1dee09 100644
--- a/qapi/acpi-hest.json
+++ b/qapi/acpi-hest.json
@@ -11,7 +11,6 @@
 # https://uefi.org/sites/default/files/resources/ACPI_6_1.pdf
 ##
 
-
 ##
 # @inject-ghes-v2-error:
 #
diff --git a/qapi/char.json b/qapi/char.json
index b07e3bb827..140614f82c 100644
--- a/qapi/char.json
+++ b/qapi/char.json
@@ -681,7 +681,6 @@
 { 'struct': 'ChardevRingbufWrapper',
   'data': { 'data': 'ChardevRingbuf' } }
 
-
 ##
 # @ChardevPtyWrapper:
 #
diff --git a/qapi/crypto.json b/qapi/crypto.json
index 72ac718147..2b55befef9 100644
--- a/qapi/crypto.json
+++ b/qapi/crypto.json
@@ -547,6 +547,7 @@
   'base': 'TlsCredsProperties',
   'data': { '*sanity-check': 'bool',
             '*passwordid': 'str' } }
+
 ##
 # @QCryptoAkCipherAlgo:
 #
diff --git a/qapi/cxl.json b/qapi/cxl.json
index 52cc5d4f33..eeddb58d1d 100644
--- a/qapi/cxl.json
+++ b/qapi/cxl.json
@@ -262,7 +262,6 @@
 #
 # Since: 8.0
 ##
-
 { 'enum': 'CxlUncorErrorType',
   'data': ['cache-data-parity',
            'cache-address-parity',
diff --git a/qapi/migration.json b/qapi/migration.json
index 4dd1098219..022ac0c4ed 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -177,6 +177,7 @@
             'postcopy-recover-setup',
             'postcopy-recover', 'completed', 'failed', 'colo',
             'pre-switchover', 'device', 'wait-unplug' ] }
+
 ##
 # @VfioStats:
 #
@@ -523,6 +524,7 @@
 # Features:
 #
 # @unstable: Members @x-colo and @x-ignore-shared are experimental.
+#
 # @deprecated: Member @zero-blocks is deprecated as being part of
 #     block migration which was already removed.
 #
@@ -1702,6 +1704,7 @@
 # The migration channel-type request options.
 #
 # @main: Main outbound migration channel.
+#
 # @cpr: Checkpoint and restart state channel.
 #
 # Since: 8.1
diff --git a/qapi/misc-i386.json b/qapi/misc-i386.json
index d1ce8caf25..05a94d6c41 100644
--- a/qapi/misc-i386.json
+++ b/qapi/misc-i386.json
@@ -122,7 +122,6 @@
       'sev': 'SevGuestInfo',
       'sev-snp': 'SevSnpGuestInfo' } }
 
-
 ##
 # @query-sev:
 #
@@ -418,7 +417,6 @@
            'pending': 'bool',
            'masked': 'bool'} }
 
-
 ##
 # @xen-event-list:
 #
diff --git a/qapi/net.json b/qapi/net.json
index 4c6cc5ca8d..118bd34965 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -1055,7 +1055,6 @@
 #
 # Since: 4.0
 ##
-
 { 'struct': 'AnnounceParameters',
   'data': { 'initial': 'int',
             'max': 'int',
@@ -1171,7 +1170,6 @@
 #     <- { "timestamp": {"seconds": 1739538638, "microseconds": 354181 },
 #          "event": "NETDEV_VHOST_USER_CONNECTED",
 #          "data": { "netdev-id": "netdev0", "chardev-id": "chr0" } }
-#
 ##
 { 'event': 'NETDEV_VHOST_USER_CONNECTED',
   'data': { 'netdev-id': 'str', 'chardev-id': 'str' } }
@@ -1190,7 +1188,6 @@
 #     <- { "timestamp": { "seconds": 1739538634, "microseconds": 920450 },
 #          "event": "NETDEV_VHOST_USER_DISCONNECTED",
 #          "data": { "netdev-id": "netdev0" } }
-#
 ##
 { 'event': 'NETDEV_VHOST_USER_DISCONNECTED',
   'data': { 'netdev-id': 'str' } }
diff --git a/qapi/qom.json b/qapi/qom.json
index d7dceaf2f8..6f5c9de0f0 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -75,7 +75,6 @@
 { 'struct': 'ObjectPropertiesValues',
   'data': { 'properties': [ 'ObjectPropertyValue' ] }}
 
-
 ##
 # @qom-list:
 #
@@ -244,7 +243,6 @@
 #
 # @typename: the type name of an object
 #
-#
 # .. note:: Objects can create properties at runtime, for example to
 #    describe links between different devices and/or objects.  These
 #    properties are not included in the output of this command.
@@ -1169,7 +1167,6 @@
   'data': { '*cpu-affinity': ['uint16'],
             '*node-affinity': ['uint16'] } }
 
-
 ##
 # @ObjectType:
 #
diff --git a/qapi/run-state.json b/qapi/run-state.json
index 2872bee06e..a6bc94a44b 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -618,7 +618,6 @@
 #     error information, as zero-terminated string.  Present when the
 #     "GPA valid" bit (bit 63) is set in @error-code.
 #
-#
 # Since: 10.1
 ##
 {'struct': 'GuestPanicInformationTdx',
diff --git a/qapi/ui.json b/qapi/ui.json
index 804b1ecc3b..e3da77632a 100644
--- a/qapi/ui.json
+++ b/qapi/ui.json
@@ -682,6 +682,7 @@
 ##
 { 'command': 'query-vnc', 'returns': 'VncInfo',
   'if': 'CONFIG_VNC' }
+
 ##
 # @query-vnc-servers:
 #
@@ -1094,7 +1095,6 @@
 { 'enum'  : 'InputMultiTouchType',
   'data'  : [ 'begin', 'update', 'end', 'cancel', 'data' ] }
 
-
 ##
 # @InputKeyEvent:
 #
diff --git a/qapi/virtio.json b/qapi/virtio.json
index 72790bcfb0..cd67c4f52e 100644
--- a/qapi/virtio.json
+++ b/qapi/virtio.json
@@ -964,7 +964,6 @@
 #
 # Since: 9.0
 ##
-
 { 'struct': 'IOThreadVirtQueueMapping',
   'data': { 'iothread': 'str', '*vqs': ['uint16'] } }
 
@@ -989,7 +988,6 @@
 #
 # Since: 9.0
 ##
-
 { 'struct': 'DummyVirtioForceArrays',
   'data': { 'unused-iothread-vq-mapping': ['IOThreadVirtQueueMapping'],
             'unused-virtio-gpu-output': ['VirtIOGPUOutput'] } }

From e67b5099b434216044d9de30e2c09c3e210f1add Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:49 +0100
Subject: [PATCH 2019/2396] qga/qapi-schema: Refill doc comments to conform to
 conventions

Sweep the entire documentation again.  Last done in commit
7270819384c (qga/qapi-schema: Refill doc comments to conform to
current conventions).

To check the generated documentation does not change, I compared the
generated HTML before and after this commit with "wdiff -3".  Finds no
differences.  Comparing with diff is not useful, as the reflown
paragraphs are visible there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-5-armbru@redhat.com>
---
 qga/qapi-schema.json | 87 ++++++++++++++++++++++++--------------------
 1 file changed, 47 insertions(+), 40 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index 8162d888bb..af75f12a28 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -2,8 +2,8 @@
 # vim: filetype=python
 
 ##
-# This manual describes the commands supported by the QEMU Guest
-# Agent Protocol.
+# This manual describes the commands supported by the QEMU Guest Agent
+# Protocol.
 #
 # For locating  a particular item, please see the `qapi-qga-index`.
 #
@@ -96,8 +96,8 @@
 # In cases where a partial stale response was previously received by
 # the client, this cannot always be done reliably.  One particular
 # scenario being if qemu-ga responses are fed character-by-character
-# into a JSON parser.  In these situations, using `guest-sync-delimited`
-# may be optimal.
+# into a JSON parser.  In these situations, using
+# `guest-sync-delimited` may be optimal.
 #
 # For clients that fetch responses line by line and convert them to
 # JSON objects, `guest-sync` should be sufficient, but note that in
@@ -153,9 +153,9 @@
 # This command tries to set guest's System Time to the given value,
 # then sets the Hardware Clock (RTC) to the current System Time.  This
 # will make it easier for a guest to resynchronize without waiting for
-# NTP. If no @time is specified, then the time to set is read from
-# RTC. However, this may not be supported on all platforms (i.e.
-# Windows). If that's the case users are advised to always pass a
+# NTP.  If no @time is specified, then the time to set is read from
+# RTC.  However, this may not be supported on all platforms (i.e.
+# Windows).  If that's the case users are advised to always pass a
 # value.
 #
 # @time: time of nanoseconds, relative to the Epoch of 1970-01-01 in
@@ -444,8 +444,8 @@
 # Returns: Number of file systems currently frozen.
 #
 # .. note:: On Windows, the command is implemented with the help of a
-#    Volume Shadow-copy Service DLL helper.  The frozen state is limited
-#    for up to 10 seconds by VSS.
+#    Volume Shadow-copy Service DLL helper.  The frozen state is
+#    limited for up to 10 seconds by VSS.
 #
 # Since: 0.15.0
 ##
@@ -482,9 +482,9 @@
 # Returns: Number of file systems thawed by this call
 #
 # .. note:: If the return value does not match the previous call to
-#    `guest-fsfreeze-freeze`, this likely means some freezable filesystems
-#    were unfrozen before this call, and that the filesystem state may
-#    have changed before issuing this command.
+#    `guest-fsfreeze-freeze`, this likely means some freezable
+#    filesystems were unfrozen before this call, and that the
+#    filesystem state may have changed before issuing this command.
 #
 # Since: 0.15.0
 ##
@@ -513,7 +513,8 @@
 ##
 # @GuestFilesystemTrimResponse:
 #
-# @paths: list of `GuestFilesystemTrimResult` per path that was trimmed
+# @paths: list of `GuestFilesystemTrimResult` per path that was
+#     trimmed
 #
 # Since: 2.4
 ##
@@ -557,16 +558,16 @@
 #
 # This command does NOT return a response on success.  There is a high
 # chance the command succeeded if the VM exits with a zero exit status
-# or, when running with --no-shutdown, by issuing the `query-status` QMP
-# command to to confirm the VM status is "shutdown". However, the VM
-# could also exit (or set its status to "shutdown") due to other
+# or, when running with --no-shutdown, by issuing the `query-status`
+# QMP command to to confirm the VM status is "shutdown".  However, the
+# VM could also exit (or set its status to "shutdown") due to other
 # reasons.
 #
 # Errors:
 #     - If suspend to disk is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the `guest-sync` command
-#    before sending commands when the guest resumes.
+# .. note:: It's strongly recommended to issue the `guest-sync`
+#    command before sending commands when the guest resumes.
 #
 # Since: 1.1
 ##
@@ -586,7 +587,7 @@
 # - manual write into sysfs
 #
 # IMPORTANT: `guest-suspend-ram` requires working wakeup support in
-# QEMU. You should check QMP command `query-current-machine` returns
+# QEMU.  You should check QMP command `query-current-machine` returns
 # wakeup-suspend-support: true before issuing this command.  Failure
 # in doing so can result in a suspended guest that QEMU will not be
 # able to awaken, forcing the user to power cycle the guest to bring
@@ -602,8 +603,8 @@
 # Errors:
 #     - If suspend to ram is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the `guest-sync` command
-#    before sending commands when the guest resumes.
+# .. note:: It's strongly recommended to issue the `guest-sync`
+#    command before sending commands when the guest resumes.
 #
 # Since: 1.1
 ##
@@ -622,7 +623,7 @@
 # - pm-utils (via pm-suspend-hybrid)
 #
 # IMPORTANT: `guest-suspend-hybrid` requires working wakeup support in
-# QEMU. You should check QMP command `query-current-machine` returns
+# QEMU.  You should check QMP command `query-current-machine` returns
 # wakeup-suspend-support: true before issuing this command.  Failure
 # in doing so can result in a suspended guest that QEMU will not be
 # able to awaken, forcing the user to power cycle the guest to bring
@@ -638,8 +639,8 @@
 # Errors:
 #     - If hybrid suspend is not supported, Unsupported
 #
-# .. note:: It's strongly recommended to issue the `guest-sync` command
-#    before sending commands when the guest resumes.
+# .. note:: It's strongly recommended to issue the `guest-sync`
+#    command before sending commands when the guest resumes.
 #
 # Since: 1.1
 ##
@@ -1048,10 +1049,11 @@
 #
 # @used-bytes: file system used bytes (since 3.0)
 #
-# @total-bytes: filesystem capacity in bytes for unprivileged users (since 3.0)
+# @total-bytes: filesystem capacity in bytes for unprivileged users
+#     (since 3.0)
 #
-# @total-bytes-privileged: filesystem capacity in bytes for privileged users
-#     (since 9.1)
+# @total-bytes-privileged: filesystem capacity in bytes for privileged
+#     users (since 9.1)
 #
 # @disk: an array of disk hardware information that the volume lies
 #     on, which may be empty if the disk type is not supported
@@ -1171,7 +1173,8 @@
 ##
 # @GuestMemoryBlockResponse:
 #
-# @phys-index: same with the 'phys-index' member of `GuestMemoryBlock`.
+# @phys-index: same with the 'phys-index' member of
+#     `GuestMemoryBlock`.
 #
 # @response: the result of memory block operation.
 #
@@ -1491,10 +1494,11 @@
 #
 # .. note:: On POSIX systems the fields @id, @name, @pretty-name,
 #    @version, @version-id, @variant and @variant-id follow the
-#    definition specified in os-release(5). Refer to the manual page for
-#    exact description of the fields.  Their values are taken from the
-#    os-release file.  If the file is not present in the system, or the
-#    values are not present in the file, the fields are not included.
+#    definition specified in os-release(5).  Refer to the manual page
+#    for exact description of the fields.  Their values are taken from
+#    the os-release file.  If the file is not present in the system,
+#    or the values are not present in the file, the fields are not
+#    included.
 #
 #    On Windows the values are filled from information gathered from
 #    the system.
@@ -1639,7 +1643,7 @@
 # @guest-ssh-remove-authorized-keys:
 #
 # Remove public keys from the user .ssh/authorized_keys on Unix
-# systems (not implemented for other systems). It's not an error if
+# systems (not implemented for other systems).  It's not an error if
 # the key is already missing.
 #
 # @username: the user account to remove the authorized keys
@@ -1862,10 +1866,10 @@
 #
 # Retrieve CPU process load information
 #
-# .. note:: Windows does not have load average API, so QGA emulates it by
-#           calculating the average CPU usage in the last 1, 5, 15 minutes
-#           similar as Linux does this.
-#           Calculation starts from the first time this command is called.
+# .. note:: Windows does not have load average API, so QGA emulates it
+#    by calculating the average CPU usage in the last 1, 5, 15 minutes
+#    similar as Linux does this.  Calculation starts from the first
+#    time this command is called.
 #
 # Returns: load information
 #
@@ -1881,9 +1885,11 @@
 #
 # Route information, currently, only linux supported.
 #
-# @iface: The destination network or host's egress network interface in the routing table
+# @iface: The destination network or host's egress network interface
+#     in the routing table
 #
-# @destination: The IP address of the target network or host, The final destination of the packet
+# @destination: The IP address of the target network or host, The
+#     final destination of the packet
 #
 # @metric: Route metric
 #
@@ -1899,7 +1905,8 @@
 #
 # @use: Route usage count (not for windows)
 #
-# @window: TCP window size, used for flow control (not for windows, IPv4 only)
+# @window: TCP window size, used for flow control (not for windows,
+#     IPv4 only)
 #
 # @mtu: Data link layer maximum packet size (not for windows)
 #

From 4a0cb75b31354acc51283654c41d07a544cc1969 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:50 +0100
Subject: [PATCH 2020/2396] qga/qapi-schema: Clean up whitespace between
 definitions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Consistently separate definitions with a single blank line.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-6-armbru@redhat.com>
---
 qga/qapi-schema.json | 9 ++-------
 1 file changed, 2 insertions(+), 7 deletions(-)

diff --git a/qga/qapi-schema.json b/qga/qapi-schema.json
index af75f12a28..5791b49dde 100644
--- a/qga/qapi-schema.json
+++ b/qga/qapi-schema.json
@@ -197,6 +197,7 @@
 { 'struct': 'GuestAgentInfo',
   'data': { 'version': 'str',
             'supported_commands': ['GuestAgentCommandInfo'] } }
+
 ##
 # @guest-info:
 #
@@ -322,7 +323,6 @@
   'data':    { 'handle': 'int', 'buf-b64': 'str', '*count': 'int' },
   'returns': 'GuestFileWrite' }
 
-
 ##
 # @GuestFileSeek:
 #
@@ -876,7 +876,6 @@
             'sas', 'mmc', 'virtual', 'file-backed-virtual', 'nvme' ],
   'if': { 'any': [ 'CONFIG_WIN32', 'CONFIG_LINUX' ] } }
 
-
 ##
 # @GuestPCIAddress:
 #
@@ -1276,6 +1275,7 @@
   'data': { 'exited': 'bool', '*exitcode': 'int', '*signal': 'int',
             '*out-data': 'str', '*err-data': 'str',
             '*out-truncated': 'bool', '*err-truncated': 'bool' }}
+
 ##
 # @guest-exec-status:
 #
@@ -1365,7 +1365,6 @@
                '*input-data': 'str', '*capture-output': 'GuestExecCaptureOutput' },
   'returns': 'GuestExec' }
 
-
 ##
 # @GuestHostName:
 #
@@ -1392,7 +1391,6 @@
 { 'command': 'guest-get-host-name',
   'returns': 'GuestHostName' }
 
-
 ##
 # @GuestUser:
 #
@@ -1763,7 +1761,6 @@
   'data': [ 'linux' ],
   'if': 'CONFIG_LINUX' }
 
-
 ##
 # @GuestLinuxCpuStats:
 #
@@ -1838,7 +1835,6 @@
   'if': 'CONFIG_LINUX'
 }
 
-
 ##
 # @GuestLoadAverage:
 #
@@ -1921,7 +1917,6 @@
 # @version: IP version (4 or 6)
 #
 # Since: 9.1
-
 ##
 { 'struct': 'GuestNetworkRoute',
   'data': {'iface': 'str',

From ab5ad24b1b1e5e8d18b23d5b61bc35ea05f8c098 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:51 +0100
Subject: [PATCH 2021/2396] docs/interop: Refill QAPI doc comments to conform
 to conventions

For legibility, wrap text paragraphs so every line is at most 70
characters long.  Consistently separate sentences with two spaces.
Consistently separate member descriptions with a blank line.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-7-armbru@redhat.com>
---
 docs/interop/firmware.json   | 440 +++++++++++++++++------------------
 docs/interop/vhost-user.json |  57 +++--
 2 files changed, 252 insertions(+), 245 deletions(-)

diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index ccbfaf828d..7ffa7697e4 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -27,18 +27,18 @@
 # Lists the firmware-OS interface types provided by various firmware
 # that is commonly used with QEMU virtual machines.
 #
-# @bios: Traditional x86 BIOS interface. For example, firmware built
-#        from the SeaBIOS project usually provides this interface.
+# @bios: Traditional x86 BIOS interface.  For example, firmware built
+#     from the SeaBIOS project usually provides this interface.
 #
 # @openfirmware: The interface is defined by the (historical) IEEE
-#                1275-1994 standard. Examples for firmware projects that
-#                provide this interface are: OpenBIOS and SLOF.
+#     1275-1994 standard.  Examples for firmware projects that provide
+#     this interface are: OpenBIOS and SLOF.
 #
 # @uboot: Firmware interface defined by the U-Boot project.
 #
-# @uefi: Firmware interface defined by the UEFI specification. For
-#        example, firmware built from the edk2 (EFI Development Kit II)
-#        project usually provides this interface.
+# @uefi: Firmware interface defined by the UEFI specification.  For
+#     example, firmware built from the edk2 (EFI Development Kit II)
+#     project usually provides this interface.
 #
 # Since: 3.0
 ##
@@ -50,21 +50,21 @@
 #
 # Defines the device types that firmware can be mapped into.
 #
-# @flash: The firmware executable and its accompanying NVRAM file are to
-#         be mapped into a pflash chip each.
+# @flash: The firmware executable and its accompanying NVRAM file are
+#     to be mapped into a pflash chip each.
 #
-# @kernel: The firmware is to be loaded like a Linux kernel. This is
-#          similar to @memory but may imply additional processing that
-#          is specific to the target architecture and machine type.
+# @kernel: The firmware is to be loaded like a Linux kernel.  This is
+#     similar to @memory but may imply additional processing that is
+#     specific to the target architecture and machine type.
 #
 # @memory: The firmware is to be mapped into memory.
 #
 # @igvm: The firmware is defined by a file conforming to the IGVM
-#        specification and mapped into memory according to directives
-#        defined in the file. This is similar to @memory but may
-#        include additional processing defined by the IGVM file
-#        including initial CPU state or population of metadata into
-#        the guest address space. Since: 10.1
+#     specification and mapped into memory according to directives
+#     defined in the file.  This is similar to @memory but may include
+#     additional processing defined by the IGVM file including initial
+#     CPU state or population of metadata into the guest address
+#     space.  Since: 10.1
 #
 # Since: 3.0
 ##
@@ -74,8 +74,8 @@
 ##
 # @FirmwareArchitecture:
 #
-# Enumeration of architectures for which Qemu uses additional
-# firmware files.
+# Enumeration of architectures for which Qemu uses additional firmware
+# files.
 #
 # @aarch64: 64-bit Arm.
 #
@@ -83,7 +83,7 @@
 #
 # @i386: 32-bit x86.
 #
-# @loongarch64: 64-bit LoongArch. (since: 7.1)
+# @loongarch64: 64-bit LoongArch.  (since: 7.1)
 #
 # @riscv64: 64-bit RISC-V.
 #
@@ -100,17 +100,16 @@
 # Defines the machine types that firmware may execute on.
 #
 # @architecture: Determines the emulation target (the QEMU system
-#                emulator) that can execute the firmware.
+#     emulator) that can execute the firmware.
 #
 # @machines: Lists the machine types (known by the emulator that is
-#            specified through @architecture) that can execute the
-#            firmware. Elements of @machines are supposed to be concrete
-#            machine types, not aliases. Glob patterns are understood,
-#            which is especially useful for versioned machine types.
-#            (For example, the glob pattern "pc-i440fx-*" matches
-#            "pc-i440fx-2.12".) On the QEMU command line, "-machine
-#            type=..." specifies the requested machine type (but that
-#            option does not accept glob patterns).
+#     specified through @architecture) that can execute the firmware.
+#     Elements of @machines are supposed to be concrete machine types,
+#     not aliases.  Glob patterns are understood, which is especially
+#     useful for versioned machine types.  (For example, the glob
+#     pattern "pc-i440fx-*" matches "pc-i440fx-2.12".) On the QEMU
+#     command line, "-machine type=..." specifies the requested
+#     machine type (but that option does not accept glob patterns).
 #
 # Since: 3.0
 ##
@@ -124,115 +123,104 @@
 # Defines the features that firmware may support, and the platform
 # requirements that firmware may present.
 #
-# @acpi-s3: The firmware supports S3 sleep (suspend to RAM), as defined
-#           in the ACPI specification. On the "pc-i440fx-*" machine
-#           types of the @i386 and @x86_64 emulation targets, S3 can be
-#           enabled with "-global PIIX4_PM.disable_s3=0" and disabled
-#           with "-global PIIX4_PM.disable_s3=1". On the "pc-q35-*"
-#           machine types of the @i386 and @x86_64 emulation targets, S3
-#           can be enabled with "-global ICH9-LPC.disable_s3=0" and
-#           disabled with "-global ICH9-LPC.disable_s3=1".
+# @acpi-s3: The firmware supports S3 sleep (suspend to RAM), as
+#     defined in the ACPI specification.  On the "pc-i440fx-*" machine
+#     types of the @i386 and @x86_64 emulation targets, S3 can be
+#     enabled with "-global PIIX4_PM.disable_s3=0" and disabled with
+#     "-global PIIX4_PM.disable_s3=1".  On the "pc-q35-*" machine
+#     types of the @i386 and @x86_64 emulation targets, S3 can be
+#     enabled with "-global ICH9-LPC.disable_s3=0" and disabled with
+#     "-global ICH9-LPC.disable_s3=1".
 #
 # @acpi-s4: The firmware supports S4 hibernation (suspend to disk), as
-#           defined in the ACPI specification. On the "pc-i440fx-*"
-#           machine types of the @i386 and @x86_64 emulation targets, S4
-#           can be enabled with "-global PIIX4_PM.disable_s4=0" and
-#           disabled with "-global PIIX4_PM.disable_s4=1". On the
-#           "pc-q35-*" machine types of the @i386 and @x86_64 emulation
-#           targets, S4 can be enabled with "-global
-#           ICH9-LPC.disable_s4=0" and disabled with "-global
-#           ICH9-LPC.disable_s4=1".
+#     defined in the ACPI specification.  On the "pc-i440fx-*" machine
+#     types of the @i386 and @x86_64 emulation targets, S4 can be
+#     enabled with "-global PIIX4_PM.disable_s4=0" and disabled with
+#     "-global PIIX4_PM.disable_s4=1".  On the "pc-q35-*" machine
+#     types of the @i386 and @x86_64 emulation targets, S4 can be
+#     enabled with "-global ICH9-LPC.disable_s4=0" and disabled with
+#     "-global ICH9-LPC.disable_s4=1".
 #
 # @amd-sev: The firmware supports running under AMD Secure Encrypted
-#           Virtualization, as specified in the AMD64 Architecture
-#           Programmer's Manual. QEMU command line options related to
-#           this feature are documented in
-#           "docs/system/i386/amd-memory-encryption.rst".
+#     Virtualization, as specified in the AMD64 Architecture
+#     Programmer's Manual.  QEMU command line options related to this
+#     feature are documented in
+#     "docs/system/i386/amd-memory-encryption.rst".
 #
-# @amd-sev-es: The firmware supports running under AMD Secure Encrypted
-#              Virtualization - Encrypted State, as specified in the AMD64
-#              Architecture Programmer's Manual. QEMU command line options
-#              related to this feature are documented in
-#              "docs/system/i386/amd-memory-encryption.rst".
+# @amd-sev-es: The firmware supports running under AMD Secure
+#     Encrypted Virtualization - Encrypted State, as specified in the
+#     AMD64 Architecture Programmer's Manual.  QEMU command line
+#     options related to this feature are documented in
+#     "docs/system/i386/amd-memory-encryption.rst".
 #
-# @amd-sev-snp: The firmware supports running under AMD Secure Encrypted
-#               Virtualization - Secure Nested Paging, as specified in the
-#               AMD64 Architecture Programmer's Manual. QEMU command line
-#               options related to this feature are documented in
-#               "docs/system/i386/amd-memory-encryption.rst".
+# @amd-sev-snp: The firmware supports running under AMD Secure
+#     Encrypted Virtualization - Secure Nested Paging, as specified in
+#     the AMD64 Architecture Programmer's Manual.  QEMU command line
+#     options related to this feature are documented in
+#     "docs/system/i386/amd-memory-encryption.rst".
 #
 # @intel-tdx: The firmware supports running under Intel Trust Domain
-#             Extensions (TDX).
+#     Extensions (TDX).
 #
 # @enrolled-keys: The variable store (NVRAM) template associated with
-#                 the firmware binary has the UEFI Secure Boot
-#                 operational mode turned on, with certificates
-#                 enrolled.
+#     the firmware binary has the UEFI Secure Boot operational mode
+#     turned on, with certificates enrolled.
 #
 # @requires-smm: The firmware requires the platform to emulate SMM
-#                (System Management Mode), as defined in the AMD64
-#                Architecture Programmer's Manual, and in the Intel(R)64
-#                and IA-32 Architectures Software Developer's Manual. On
-#                the "pc-q35-*" machine types of the @i386 and @x86_64
-#                emulation targets, SMM emulation can be enabled with
-#                "-machine smm=on". (On the "pc-q35-*" machine types of
-#                the @i386 emulation target, @requires-smm presents
-#                further CPU requirements; one combination known to work
-#                is "-cpu coreduo,nx=off".) If the firmware is marked as
-#                both @secure-boot and @requires-smm, then write
-#                accesses to the pflash chip (NVRAM) that holds the UEFI
-#                variable store must be restricted to code that executes
-#                in SMM, using the additional option "-global
-#                driver=cfi.pflash01,property=secure,value=on".
-#                Furthermore, a large guest-physical address space
-#                (comprising guest RAM, memory hotplug range, and 64-bit
-#                PCI MMIO aperture), and/or a high VCPU count, may
-#                present high SMRAM requirements from the firmware. On
-#                the "pc-q35-*" machine types of the @i386 and @x86_64
-#                emulation targets, the SMRAM size may be increased
-#                above the default 16MB with the "-global
-#                mch.extended-tseg-mbytes=uint16" option. As a rule of
-#                thumb, the default 16MB size suffices for 1TB of
-#                guest-phys address space and a few tens of VCPUs; for
-#                every further TB of guest-phys address space, add 8MB
-#                of SMRAM. 48MB should suffice for 4TB of guest-phys
-#                address space and 2-3 hundred VCPUs.
+#     (System Management Mode), as defined in the AMD64 Architecture
+#     Programmer's Manual, and in the Intel(R)64 and IA-32
+#     Architectures Software Developer's Manual.  On the "pc-q35-*"
+#     machine types of the @i386 and @x86_64 emulation targets, SMM
+#     emulation can be enabled with "-machine smm=on".  (On the
+#     "pc-q35-*" machine types of the @i386 emulation target,
+#     @requires-smm presents further CPU requirements; one combination
+#     known to work is "-cpu coreduo,nx=off".) If the firmware is
+#     marked as both @secure-boot and @requires-smm, then write
+#     accesses to the pflash chip (NVRAM) that holds the UEFI variable
+#     store must be restricted to code that executes in SMM, using the
+#     additional option "-global
+#     driver=cfi.pflash01,property=secure,value=on".  Furthermore, a
+#     large guest-physical address space (comprising guest RAM, memory
+#     hotplug range, and 64-bit PCI MMIO aperture), and/or a high VCPU
+#     count, may present high SMRAM requirements from the firmware.
+#     On the "pc-q35-*" machine types of the @i386 and @x86_64
+#     emulation targets, the SMRAM size may be increased above the
+#     default 16MB with the "-global mch.extended-tseg-mbytes=uint16"
+#     option.  As a rule of thumb, the default 16MB size suffices for
+#     1TB of guest-phys address space and a few tens of VCPUs; for
+#     every further TB of guest-phys address space, add 8MB of SMRAM.
+#     48MB should suffice for 4TB of guest-phys address space and 2-3
+#     hundred VCPUs.
 #
-# @secure-boot: The firmware implements the software interfaces for UEFI
-#               Secure Boot, as defined in the UEFI specification. Note
-#               that without @requires-smm, guest code running with
-#               kernel privileges can undermine the security of Secure
-#               Boot.
+# @secure-boot: The firmware implements the software interfaces for
+#     UEFI Secure Boot, as defined in the UEFI specification.  Note
+#     that without @requires-smm, guest code running with kernel
+#     privileges can undermine the security of Secure Boot.
 #
 # @verbose-dynamic: When firmware log capture is enabled, the firmware
-#                   logs a large amount of debug messages, which may
-#                   impact boot performance. With log capture disabled,
-#                   there is no boot performance impact. On the
-#                   "pc-i440fx-*" and "pc-q35-*" machine types of the
-#                   @i386 and @x86_64 emulation targets, firmware log
-#                   capture can be enabled with the QEMU command line
-#                   options "-chardev file,id=fwdebug,path=LOGFILEPATH
-#                   -device isa-debugcon,iobase=0x402,chardev=fwdebug".
-#                   @verbose-dynamic is mutually exclusive with
-#                   @verbose-static.
+#     logs a large amount of debug messages, which may impact boot
+#     performance.  With log capture disabled, there is no boot
+#     performance impact.  On the "pc-i440fx-*" and "pc-q35-*" machine
+#     types of the @i386 and @x86_64 emulation targets, firmware log
+#     capture can be enabled with the QEMU command line options
+#     "-chardev file,id=fwdebug,path=LOGFILEPATH -device
+#     isa-debugcon,iobase=0x402,chardev=fwdebug".  @verbose-dynamic is
+#     mutually exclusive with @verbose-static.
 #
-# @verbose-static: The firmware unconditionally produces a large amount
-#                  of debug messages, which may impact boot performance.
-#                  This feature may typically be carried by certain UEFI
-#                  firmware for the "virt-*" machine types of the @arm
-#                  and @aarch64 emulation targets, where the debug
-#                  messages are written to the first (always present)
-#                  PL011 UART. @verbose-static is mutually exclusive
-#                  with @verbose-dynamic.
+# @verbose-static: The firmware unconditionally produces a large
+#     amount of debug messages, which may impact boot performance.
+#     This feature may typically be carried by certain UEFI firmware
+#     for the "virt-*" machine types of the @arm and @aarch64
+#     emulation targets, where the debug messages are written to the
+#     first (always present) PL011 UART.  @verbose-static is mutually
+#     exclusive with @verbose-dynamic.
 #
 # @host-uefi-vars: The firmware expects the host to provide an uefi
-#                  variable store.  qemu supports that via
-#                  "uefi-vars-sysbus" (aarch64, riscv64, loongarch64)
-#                  or "uefi-vars-x64" (x86_64) devices.  The firmware
-#                  will not use flash for nvram.  When loading the
-#                  firmware into flash the 'stateless' setup should be
-#                  used.  It is recommened to load the firmware into
-#                  memory though.
+#     variable store.  qemu supports that via "uefi-vars-sysbus"
+#     (aarch64, riscv64, loongarch64) or "uefi-vars-x64" (x86_64)
+#     devices.  The firmware will not use flash for nvram.  When
+#     loading the firmware into flash the 'stateless' setup should be
+#     used.  It is recommened to load the firmware into memory though.
 #
 # Since: 3.0
 ##
@@ -262,16 +250,16 @@
 # @FirmwareFlashFile:
 #
 # Defines common properties that are necessary for loading a firmware
-# file into a pflash chip. The corresponding QEMU command line option is
-# "-drive file=@filename,format=@format". Note however that the
+# file into a pflash chip.  The corresponding QEMU command line option
+# is "-drive file=@filename,format=@format".  Note however that the
 # option-argument shown here is incomplete; it is completed under
 # @FirmwareMappingFlash.
 #
 # @filename: Specifies the filename on the host filesystem where the
-#            firmware file can be found.
+#     firmware file can be found.
 #
 # @format: Specifies the block format of the file pointed-to by
-#          @filename, such as @raw or @qcow2.
+#     @filename, such as @raw or @qcow2.
 #
 # Since: 3.0
 ##
@@ -286,22 +274,20 @@
 # Describes how the firmware build handles code versus variable
 # persistence.
 #
-# @split: the executable file contains code while the NVRAM
-#         template provides variable storage. The executable
-#         must be configured read-only and can be shared between
-#         multiple guests. The NVRAM template must be cloned
-#         for each new guest and configured read-write.
+# @split: the executable file contains code while the NVRAM template
+#     provides variable storage.  The executable must be configured
+#     read-only and can be shared between multiple guests.  The NVRAM
+#     template must be cloned for each new guest and configured
+#     read-write.
 #
-# @combined: the executable file contains both code and
-#            variable storage. The executable must be cloned
-#            for each new guest and configured read-write.
-#            No NVRAM template will be specified.
+# @combined: the executable file contains both code and variable
+#     storage.  The executable must be cloned for each new guest and
+#     configured read-write.  No NVRAM template will be specified.
 #
-# @stateless: the executable file contains code and variable
-#             storage is not persisted. The executable must
-#             be configured read-only and can be shared
-#             between multiple guests. No NVRAM template
-#             will be specified.
+# @stateless: the executable file contains code and variable storage
+#     is not persisted.  The executable must be configured read-only
+#     and can be shared between multiple guests.  No NVRAM template
+#     will be specified.
 #
 # Since: 7.0.0
 ##
@@ -315,39 +301,36 @@
 # and its accompanying NVRAM file, when @FirmwareDevice is @flash.
 #
 # @mode: Describes how the firmware build handles code versus variable
-#        storage. If not present, it must be treated as if it was
-#        configured with value @split. Since: 7.0.0
+#     storage.  If not present, it must be treated as if it was
+#     configured with value @split.  Since: 7.0.0
 #
-# @executable: Identifies the firmware executable. The @mode
-#              indicates whether there will be an associated
-#              NVRAM template present. The preferred
-#              corresponding QEMU command line options are
-#                  -drive if=none,id=pflash0,readonly=on,file=@executable.@filename,format=@executable.@format
-#                  -machine pflash0=pflash0
-#              or equivalent -blockdev instead of -drive. When
-#              @mode is @combined the executable must be
-#              cloned before use and configured with readonly=off.
-#              With QEMU versions older than 4.0, you have to use
-#                  -drive if=pflash,unit=0,readonly=on,file=@executable.@filename,format=@executable.@format
+# @executable: Identifies the firmware executable.  The @mode
+#     indicates whether there will be an associated NVRAM template
+#     present.  The preferred corresponding QEMU command line options
+#     are
+#         -drive if=none,id=pflash0,readonly=on,file=@executable.@filename,format=@executable.@format
+#         -machine pflash0=pflash0
+#     or equivalent -blockdev instead of -drive.  When @mode is
+#     @combined the executable must be cloned before use and
+#     configured with readonly=off.  With QEMU versions older than
+#     4.0, you have to use
+#         -drive if=pflash,unit=0,readonly=on,file=@executable.@filename,format=@executable.@format
 #
 # @nvram-template: Identifies the NVRAM template compatible with
-#                  @executable, when @mode is set to @split,
-#                  otherwise it should not be present.
-#                  Management software instantiates an
-#                  individual copy -- a specific NVRAM file -- from
-#                  @nvram-template.@filename for each new virtual
-#                  machine definition created. @nvram-template.@filename
-#                  itself is never mapped into virtual machines, only
-#                  individual copies of it are. An NVRAM file is
-#                  typically used for persistently storing the
-#                  non-volatile UEFI variables of a virtual machine
-#                  definition. The preferred corresponding QEMU
-#                  command line options are
-#                      -drive if=none,id=pflash1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
-#                      -machine pflash1=pflash1
-#                  or equivalent -blockdev instead of -drive.
-#                  With QEMU versions older than 4.0, you have to use
-#                      -drive if=pflash,unit=1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
+#     @executable, when @mode is set to @split, otherwise it should
+#     not be present.  Management software instantiates an individual
+#     copy -- a specific NVRAM file -- from @nvram-template.@filename
+#     for each new virtual machine definition created.
+#     @nvram-template.@filename itself is never mapped into virtual
+#     machines, only individual copies of it are.  An NVRAM file is
+#     typically used for persistently storing the non-volatile UEFI
+#     variables of a virtual machine definition.  The preferred
+#     corresponding QEMU command line options are
+#         -drive if=none,id=pflash1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
+#         -machine pflash1=pflash1
+#     or equivalent -blockdev instead of -drive.  With QEMU versions
+#     older than 4.0, you have to use
+#         -drive if=pflash,unit=1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
 #
 # Since: 3.0
 ##
@@ -359,13 +342,13 @@
 ##
 # @FirmwareMappingKernel:
 #
-# Describes loading and mapping properties for the firmware executable,
-# when @FirmwareDevice is @kernel.
+# Describes loading and mapping properties for the firmware
+# executable, when @FirmwareDevice is @kernel.
 #
-# @filename: Identifies the firmware executable. The firmware executable
-#            may be shared by multiple virtual machine definitions. The
-#            corresponding QEMU command line option is "-kernel
-#            @filename".
+# @filename: Identifies the firmware executable.  The firmware
+#     executable may be shared by multiple virtual machine
+#     definitions.  The corresponding QEMU command line option is
+#     "-kernel @filename".
 #
 # Since: 3.0
 ##
@@ -375,13 +358,13 @@
 ##
 # @FirmwareMappingMemory:
 #
-# Describes loading and mapping properties for the firmware executable,
-# when @FirmwareDevice is @memory.
+# Describes loading and mapping properties for the firmware
+# executable, when @FirmwareDevice is @memory.
 #
-# @filename: Identifies the firmware executable. The firmware executable
-#            may be shared by multiple virtual machine definitions. The
-#            corresponding QEMU command line option is "-bios
-#            @filename".
+# @filename: Identifies the firmware executable.  The firmware
+#     executable may be shared by multiple virtual machine
+#     definitions.  The corresponding QEMU command line option is
+#     "-bios @filename".
 #
 # Since: 3.0
 ##
@@ -391,15 +374,15 @@
 ##
 # @FirmwareMappingIgvm:
 #
-# Describes loading and mapping properties for the firmware executable,
-# when @FirmwareDevice is @igvm.
+# Describes loading and mapping properties for the firmware
+# executable, when @FirmwareDevice is @igvm.
 #
-# @filename: Identifies the IGVM file containing the firmware executable
-#            along with other information used to configure the initial
-#            state of the guest. The IGVM file may be shared by multiple
-#            virtual machine definitions. This corresponds to creating
-#            an object on the command line with "-object igvm-cfg,
-#            file=@filename".
+# @filename: Identifies the IGVM file containing the firmware
+#     executable along with other information used to configure the
+#     initial state of the guest.  The IGVM file may be shared by
+#     multiple virtual machine definitions.  This corresponds to
+#     creating an object on the command line with "-object igvm-cfg,
+#     file=@filename".
 #
 # Since: 10.1
 ##
@@ -413,7 +396,7 @@
 # loading / mapping properties.
 #
 # @device: Selects the device type that the firmware must be mapped
-#          into.
+#     into.
 #
 # Since: 3.0
 ##
@@ -428,46 +411,49 @@
 ##
 # @Firmware:
 #
-# Describes a firmware (or a firmware use case) to management software.
+# Describes a firmware (or a firmware use case) to management
+# software.
 #
 # It is possible for multiple @Firmware elements to match the search
-# criteria of management software. Applications thus need rules to pick
-# one of the many matches, and users need the ability to override distro
-# defaults.
+# criteria of management software.  Applications thus need rules to
+# pick one of the many matches, and users need the ability to override
+# distro defaults.
 #
 # It is recommended to create firmware JSON files (each containing a
-# single @Firmware root element) with a double-digit prefix, for example
-# "50-ovmf.json", "50-seabios-256k.json", etc, so they can be sorted in
-# predictable order. The firmware JSON files should be searched for in
-# three directories:
+# single @Firmware root element) with a double-digit prefix, for
+# example "50-ovmf.json", "50-seabios-256k.json", etc, so they can be
+# sorted in predictable order.  The firmware JSON files should be
+# searched for in three directories:
 #
-#   - /usr/share/qemu/firmware -- populated by distro-provided firmware
-#                                 packages (XDG_DATA_DIRS covers
-#                                 /usr/share by default),
+# - /usr/share/qemu/firmware -- populated by distro-provided firmware
+#                               packages (XDG_DATA_DIRS covers
+#                               /usr/share by default),
 #
-#   - /etc/qemu/firmware -- exclusively for sysadmins' local additions,
+# - /etc/qemu/firmware -- exclusively for sysadmins' local additions,
 #
-#   - $XDG_CONFIG_HOME/qemu/firmware -- exclusively for per-user local
-#                                       additions (XDG_CONFIG_HOME
-#                                       defaults to $HOME/.config).
+# - $XDG_CONFIG_HOME/qemu/firmware -- exclusively for per-user local
+#                                     additions (XDG_CONFIG_HOME
+#                                     defaults to $HOME/.config).
 #
 # Top-down, the list of directories goes from general to specific.
 #
 # Management software should build a list of files from all three
 # locations, then sort the list by filename (i.e., last pathname
-# component). Management software should choose the first JSON file on
-# the sorted list that matches the search criteria. If a more specific
-# directory has a file with same name as a less specific directory, then
-# the file in the more specific directory takes effect. If the more
-# specific file is zero length, it hides the less specific one.
+# component).  Management software should choose the first JSON file
+# on the sorted list that matches the search criteria.  If a more
+# specific directory has a file with same name as a less specific
+# directory, then the file in the more specific directory takes
+# effect.  If the more specific file is zero length, it hides the less
+# specific one.
 #
 # For example, if a distro ships
 #
-#   - /usr/share/qemu/firmware/50-ovmf.json
+# - /usr/share/qemu/firmware/50-ovmf.json
 #
-#   - /usr/share/qemu/firmware/50-seabios-256k.json
+# - /usr/share/qemu/firmware/50-seabios-256k.json
 #
-# then the sysadmin can prevent the default OVMF being used at all with
+# then the sysadmin can prevent the default OVMF being used at all
+# with
 #
 #   $ touch /etc/qemu/firmware/50-ovmf.json
 #
@@ -484,29 +470,29 @@
 #   $ vim /etc/qemu/firmware/99-ovmf.json
 #
 # @description: Provides a human-readable description of the firmware.
-#               Management software may or may not display @description.
+#     Management software may or may not display @description.
 #
-# @interface-types: Lists the types of interfaces that the firmware can
-#                   expose to the guest OS. This is a non-empty, ordered
-#                   list; entries near the beginning of @interface-types
-#                   are considered more native to the firmware, and/or
-#                   to have a higher quality implementation in the
-#                   firmware, than entries near the end of
-#                   @interface-types.
+# @interface-types: Lists the types of interfaces that the firmware
+#     can expose to the guest OS.  This is a non-empty, ordered list;
+#     entries near the beginning of @interface-types are considered
+#     more native to the firmware, and/or to have a higher quality
+#     implementation in the firmware, than entries near the end of
+#     @interface-types.
 #
-# @mapping: Describes the loading / mapping properties of the firmware.
+# @mapping: Describes the loading / mapping properties of the
+#     firmware.
 #
 # @targets: Collects the target architectures (QEMU system emulators)
-#           and their machine types that may execute the firmware.
+#     and their machine types that may execute the firmware.
 #
 # @features: Lists the features that the firmware supports, and the
-#            platform requirements it presents.
+#     platform requirements it presents.
 #
 # @tags: A list of auxiliary strings associated with the firmware for
-#        which @description is not appropriate, due to the latter's
-#        possible exposure to the end-user. @tags serves development and
-#        debugging purposes only, and management software shall
-#        explicitly ignore it.
+#     which @description is not appropriate, due to the latter's
+#     possible exposure to the end-user.  @tags serves development and
+#     debugging purposes only, and management software shall
+#     explicitly ignore it.
 #
 # Since: 3.0
 #
diff --git a/docs/interop/vhost-user.json b/docs/interop/vhost-user.json
index 095eb99cf7..cd3a768615 100644
--- a/docs/interop/vhost-user.json
+++ b/docs/interop/vhost-user.json
@@ -21,19 +21,33 @@
 # List the various vhost user backend types.
 #
 # @9p: 9p virtio console
+#
 # @balloon: virtio balloon
+#
 # @block: virtio block
+#
 # @caif: virtio caif
+#
 # @console: virtio console
+#
 # @crypto: virtio crypto
+#
 # @gpu: virtio gpu
+#
 # @input: virtio input
+#
 # @net: virtio net
+#
 # @rng: virtio rng
+#
 # @rpmsg: virtio remote processor messaging
+#
 # @rproc-serial: virtio remoteproc serial link
+#
 # @scsi: virtio scsi
+#
 # @vsock: virtio vsock transport
+#
 # @fs: virtio fs (since 4.2)
 #
 # Since: 4.0
@@ -65,6 +79,7 @@
 # List of vhost user "block" features.
 #
 # @read-only: The --read-only command line option is supported.
+#
 # @blk-file: The --blk-file command line option is supported.
 #
 # Since: 5.0
@@ -96,6 +111,7 @@
 # List of vhost user "input" features.
 #
 # @evdev-path: The --evdev-path command line option is supported.
+#
 # @no-grab: The --no-grab command line option is supported.
 #
 # Since: 4.0
@@ -127,6 +143,7 @@
 # List of vhost user "gpu" features.
 #
 # @render-node: The --render-node command line option is supported.
+#
 # @virgl: The --virgl command line option is supported.
 #
 # Since: 4.0
@@ -177,36 +194,39 @@
 # Describes a vhost user backend to management software.
 #
 # It is possible for multiple @VhostUserBackend elements to match the
-# search criteria of management software. Applications thus need rules
-# to pick one of the many matches, and users need the ability to
+# search criteria of management software.  Applications thus need
+# rules to pick one of the many matches, and users need the ability to
 # override distro defaults.
 #
 # It is recommended to create vhost user backend JSON files (each
 # containing a single @VhostUserBackend root element) with a
 # double-digit prefix, for example "50-qemu-gpu.json",
 # "50-crosvm-gpu.json", etc, so they can be sorted in predictable
-# order. The backend JSON files should be searched for in three
+# order.  The backend JSON files should be searched for in three
 # directories:
 #
 #   - /usr/share/qemu/vhost-user -- populated by distro-provided
 #                                   packages (XDG_DATA_DIRS covers
 #                                   /usr/share by default),
 #
-#   - /etc/qemu/vhost-user -- exclusively for sysadmins' local additions,
+#   - /etc/qemu/vhost-user -- exclusively for sysadmins' local
+#                             additions,
 #
-#   - $XDG_CONFIG_HOME/qemu/vhost-user -- exclusively for per-user local
-#                                         additions (XDG_CONFIG_HOME
-#                                         defaults to $HOME/.config).
+#   - $XDG_CONFIG_HOME/qemu/vhost-user -- exclusively for per-user
+#                                         local additions
+#                                         (XDG_CONFIG_HOME defaults to
+#                                         $HOME/.config).
 #
 # Top-down, the list of directories goes from general to specific.
 #
 # Management software should build a list of files from all three
 # locations, then sort the list by filename (i.e., basename
-# component). Management software should choose the first JSON file on
-# the sorted list that matches the search criteria. If a more specific
-# directory has a file with same name as a less specific directory,
-# then the file in the more specific directory takes effect. If the
-# more specific file is zero length, it hides the less specific one.
+# component).  Management software should choose the first JSON file
+# on the sorted list that matches the search criteria.  If a more
+# specific directory has a file with same name as a less specific
+# directory, then the file in the more specific directory takes
+# effect.  If the more specific file is zero length, it hides the less
+# specific one.
 #
 # For example, if a distro ships
 #
@@ -214,7 +234,8 @@
 #
 #   - /usr/share/qemu/vhost-user/50-crosvm-gpu.json
 #
-# then the sysadmin can prevent the default QEMU GPU being used at all with
+# then the sysadmin can prevent the default QEMU GPU being used at all
+# with
 #
 #   $ touch /etc/qemu/vhost-user/50-qemu-gpu.json
 #
@@ -233,15 +254,15 @@
 # @type: The vhost user backend type.
 #
 # @description: Provides a human-readable description of the backend.
-#               Management software may or may not display @description.
+#     Management software may or may not display @description.
 #
 # @binary: Absolute path to the backend binary.
 #
 # @tags: An optional list of auxiliary strings associated with the
-#        backend for which @description is not appropriate, due to the
-#        latter's possible exposure to the end-user. @tags serves
-#        development and debugging purposes only, and management
-#        software shall explicitly ignore it.
+#     backend for which @description is not appropriate, due to the
+#     latter's possible exposure to the end-user.  @tags serves
+#     development and debugging purposes only, and management software
+#     shall explicitly ignore it.
 #
 # Since: 4.0
 #

From e90ab557da7788b033645e73be8b7603a6a9401c Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:52 +0100
Subject: [PATCH 2022/2396] docs/interop/vhost-user: Belatedly convert
 "Example" section

These are gone since 3c5f6114d9f (qapi: remove "Example" doc section).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-8-armbru@redhat.com>
---
 docs/interop/vhost-user.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/interop/vhost-user.json b/docs/interop/vhost-user.json
index cd3a768615..29c84e86e5 100644
--- a/docs/interop/vhost-user.json
+++ b/docs/interop/vhost-user.json
@@ -266,7 +266,7 @@
 #
 # Since: 4.0
 #
-# Example:
+# .. qmp-example:
 #
 # {
 #   "description": "QEMU vhost-user-gpu",

From f68938c435332a6b80002145b3ec37c8907c8d3c Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:53 +0100
Subject: [PATCH 2023/2396] docs/interop/firmware: Literal block markup
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A few doc comments show command line snippets.  The snippets are
indented, which is legible enough.  Actually formatting these with
Sphinx would fail with "Unexpected indentation", though.  We don't so
far.  Add suitable markup anyway.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-9-armbru@redhat.com>
---
 docs/interop/firmware.json | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/docs/interop/firmware.json b/docs/interop/firmware.json
index 7ffa7697e4..da0362a2c0 100644
--- a/docs/interop/firmware.json
+++ b/docs/interop/firmware.json
@@ -308,12 +308,19 @@
 #     indicates whether there will be an associated NVRAM template
 #     present.  The preferred corresponding QEMU command line options
 #     are
+#
+#     ::
+#
 #         -drive if=none,id=pflash0,readonly=on,file=@executable.@filename,format=@executable.@format
 #         -machine pflash0=pflash0
+#
 #     or equivalent -blockdev instead of -drive.  When @mode is
 #     @combined the executable must be cloned before use and
 #     configured with readonly=off.  With QEMU versions older than
 #     4.0, you have to use
+#
+#     ::
+#
 #         -drive if=pflash,unit=0,readonly=on,file=@executable.@filename,format=@executable.@format
 #
 # @nvram-template: Identifies the NVRAM template compatible with
@@ -326,10 +333,17 @@
 #     typically used for persistently storing the non-volatile UEFI
 #     variables of a virtual machine definition.  The preferred
 #     corresponding QEMU command line options are
+#
+#     ::
+#
 #         -drive if=none,id=pflash1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
 #         -machine pflash1=pflash1
+#
 #     or equivalent -blockdev instead of -drive.  With QEMU versions
 #     older than 4.0, you have to use
+#
+#     ::
+#
 #         -drive if=pflash,unit=1,readonly=off,file=FILENAME_OF_PRIVATE_NVRAM_FILE,format=@nvram-template.@format
 #
 # Since: 3.0

From 201a38d12b9dbbe190c6b6c757d979e656ebeeac Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Mon, 3 Nov 2025 09:23:54 +0100
Subject: [PATCH 2024/2396] docs/interop: Add test to keep vhost-user.json sane

We did this for firmware.json in commit d4181658dfb (docs: add test
for firmware.json QAPI).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251103082354.3273027-10-armbru@redhat.com>
---
 docs/meson.build | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/docs/meson.build b/docs/meson.build
index 3676f81c4d..7e54b01e6a 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -99,7 +99,12 @@ if build_docs
   alias_target('man', sphinxmans)
 endif
 
-test('QAPI firmware.json regression tests', qapi_gen,
-     args: ['-o', meson.current_build_dir() / 'qapi',
+test('QAPI firmware.json regression test', qapi_gen,
+     args: ['-o', meson.current_build_dir() / 'qapi-firmware',
             meson.current_source_dir() / 'interop/firmware.json'],
      suite: ['qapi-schema', 'qapi-interop'])
+
+test('QAPI vhost-user.json regression test', qapi_gen,
+     args: ['-o', meson.current_build_dir() / 'qapi-vhost-user',
+            meson.current_source_dir() / 'interop/vhost-user.json'],
+     suite: ['qapi-schema', 'qapi-interop'])

From 8107ba47fd78bcf8c3206de42dbfb5ba8184d706 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Fri, 31 Oct 2025 21:31:29 +0300
Subject: [PATCH 2025/2396] qapi: Add documentation format validation

Add explicit validation for QAPI documentation formatting rules:

1. Lines must not exceed 70 columns in width (including '# ' prefix)
2. Sentences must be separated by two spaces

Example sections and literal :: blocks (seldom case) are excluded, we
don't require them to be <= 70, that would be too restrictive. Anyway,
they share common 80-columns recommendations (not requirements).

Add two simple tests, illustrating the change.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251031183129.246814-1-vsementsov@yandex-team.ru>

The detection of example and literal blocks isn't quite correct, but
it works well enough, and we can improve on top.

Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Comments, error messages, and test file names tweaked]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 scripts/qapi/parser.py                        | 50 ++++++++++++++++++-
 .../doc-bad-space-between-sentences.err       |  2 +
 .../doc-bad-space-between-sentences.json      |  6 +++
 .../doc-bad-space-between-sentences.out       |  0
 tests/qapi-schema/doc-long-line.err           |  1 +
 tests/qapi-schema/doc-long-line.json          |  6 +++
 tests/qapi-schema/doc-long-line.out           |  0
 tests/qapi-schema/meson.build                 |  2 +
 8 files changed, 66 insertions(+), 1 deletion(-)
 create mode 100644 tests/qapi-schema/doc-bad-space-between-sentences.err
 create mode 100644 tests/qapi-schema/doc-bad-space-between-sentences.json
 create mode 100644 tests/qapi-schema/doc-bad-space-between-sentences.out
 create mode 100644 tests/qapi-schema/doc-long-line.err
 create mode 100644 tests/qapi-schema/doc-long-line.json
 create mode 100644 tests/qapi-schema/doc-long-line.out

diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index 9fbf80a541..1bb1af7051 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -108,6 +108,11 @@ class QAPISchemaParser:
         self.exprs: List[QAPIExpression] = []
         self.docs: List[QAPIDoc] = []
 
+        # State for tracking qmp-example blocks and simple
+        # :: literal blocks.
+        self._literal_mode = False
+        self._literal_mode_indent = 0
+
         # Showtime!
         self._parse()
 
@@ -423,12 +428,55 @@ class QAPISchemaParser:
             if self.val != '##':
                 raise QAPIParseError(
                     self, "junk after '##' at end of documentation comment")
+            self._literal_mode = False
             return None
         if self.val == '#':
             return ''
         if self.val[1] != ' ':
             raise QAPIParseError(self, "missing space after #")
-        return self.val[2:].rstrip()
+
+        line = self.val[2:].rstrip()
+
+        if re.match(r'(\.\. +qmp-example)? *::$', line):
+            self._literal_mode = True
+            self._literal_mode_indent = 0
+        elif self._literal_mode and line:
+            indent = re.match(r'^ *', line).end()
+            if self._literal_mode_indent == 0:
+                self._literal_mode_indent = indent
+            elif indent < self._literal_mode_indent:
+                # ReST directives stop at decreasing indentation
+                self._literal_mode = False
+
+        if not self._literal_mode:
+            self._validate_doc_line_format(line)
+
+        return line
+
+    def _validate_doc_line_format(self, line: str) -> None:
+        """
+        Validate documentation format rules for a single line:
+        1. Lines should not exceed 70 characters
+        2. Sentences should be separated by two spaces
+        """
+        full_line_length = len(line) + 2  # "# " = 2 characters
+        if full_line_length > 70:
+            # Skip URL lines - they can't be broken
+            if re.match(r' *(https?|ftp)://[^ ]*$', line):
+                pass
+            else:
+                raise QAPIParseError(
+                    self, "documentation line longer than 70 characters")
+
+        single_space_pattern = r'(\be\.g\.|^ *\d\.|([.!?])) [A-Z0-9(]'
+        for m in list(re.finditer(single_space_pattern, line)):
+            if not m.group(2):
+                continue
+            # HACK so the error message points to the offending spot
+            self.pos = self.line_pos + 2 + m.start(2) + 1
+            raise QAPIParseError(
+                self, "Use two spaces between sentences\n"
+                "If this not the end of a sentence, please report a bug.")
 
     @staticmethod
     def _match_at_name_colon(string: str) -> Optional[Match[str]]:
diff --git a/tests/qapi-schema/doc-bad-space-between-sentences.err b/tests/qapi-schema/doc-bad-space-between-sentences.err
new file mode 100644
index 0000000000..479982ce22
--- /dev/null
+++ b/tests/qapi-schema/doc-bad-space-between-sentences.err
@@ -0,0 +1,2 @@
+doc-bad-space-between-sentences.json:4:47: Use two spaces between sentences
+If this not the end of a sentence, please report a bug.
diff --git a/tests/qapi-schema/doc-bad-space-between-sentences.json b/tests/qapi-schema/doc-bad-space-between-sentences.json
new file mode 100644
index 0000000000..87b6f6eb4e
--- /dev/null
+++ b/tests/qapi-schema/doc-bad-space-between-sentences.json
@@ -0,0 +1,6 @@
+##
+# @foo:
+#
+# Sentences should be separated by two spaces. But here is only one.
+##
+{ 'command': 'foo' }
diff --git a/tests/qapi-schema/doc-bad-space-between-sentences.out b/tests/qapi-schema/doc-bad-space-between-sentences.out
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qapi-schema/doc-long-line.err b/tests/qapi-schema/doc-long-line.err
new file mode 100644
index 0000000000..7baa5297cf
--- /dev/null
+++ b/tests/qapi-schema/doc-long-line.err
@@ -0,0 +1 @@
+doc-long-line.json:4:1: documentation line longer than 70 characters
diff --git a/tests/qapi-schema/doc-long-line.json b/tests/qapi-schema/doc-long-line.json
new file mode 100644
index 0000000000..c10153b0d5
--- /dev/null
+++ b/tests/qapi-schema/doc-long-line.json
@@ -0,0 +1,6 @@
+##
+# @foo:
+#
+# This line has exactly 71 chars, including the leading hash and space.
+##
+{ 'command': 'foo' }
diff --git a/tests/qapi-schema/doc-long-line.out b/tests/qapi-schema/doc-long-line.out
new file mode 100644
index 0000000000..e69de29bb2
diff --git a/tests/qapi-schema/meson.build b/tests/qapi-schema/meson.build
index c47025d16d..debff633ac 100644
--- a/tests/qapi-schema/meson.build
+++ b/tests/qapi-schema/meson.build
@@ -61,6 +61,7 @@ schemas = [
   'doc-bad-event-arg.json',
   'doc-bad-feature.json',
   'doc-bad-indent.json',
+  'doc-bad-space-between-sentences.json',
   'doc-bad-symbol.json',
   'doc-bad-union-member.json',
   'doc-before-include.json',
@@ -81,6 +82,7 @@ schemas = [
   'doc-invalid-return2.json',
   'doc-invalid-section.json',
   'doc-invalid-start.json',
+  'doc-long-line.json',
   'doc-missing-colon.json',
   'doc-missing-expr.json',
   'doc-missing-space.json',

From b2d0bf872d4a40c5f1e326b4bd5aa42ba98567f0 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Mon, 3 Nov 2025 16:57:21 +0530
Subject: [PATCH 2026/2396] hw/hppa: Enable LASI i82596 network on 715 machine

Enable the i82596 network chip which is included in the LASI
multi I/O chip. Since LASI has different start addresses on
the various machines, always initialize the LASI components
by their offsets.

Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/hppa/hppa_hardware.h     | 10 ++--------
 hw/hppa/machine.c           | 31 +++++++++++++++++--------------
 hw/net/lasi_i82596.c        | 30 +++++++-----------------------
 include/hw/net/lasi_82596.h |  3 ---
 4 files changed, 26 insertions(+), 48 deletions(-)

diff --git a/hw/hppa/hppa_hardware.h b/hw/hppa/hppa_hardware.h
index d422af0429..0a89c3ed52 100644
--- a/hw/hppa/hppa_hardware.h
+++ b/hw/hppa/hppa_hardware.h
@@ -21,14 +21,6 @@
 #define DINO_SCSI_HPA   0xfff8c000
 #define LASI_HPA_715    0xf0100000
 #define LASI_HPA        0xffd00000
-#define LASI_UART_HPA   0xffd05000
-#define LASI_SCSI_HPA   0xffd06000
-#define LASI_LAN_HPA    0xffd07000
-#define LASI_RTC_HPA    0xffd09000
-#define LASI_LPT_HPA    0xffd02000
-#define LASI_AUDIO_HPA  0xffd04000
-#define LASI_PS2KBD_HPA 0xffd08000
-#define LASI_PS2MOU_HPA 0xffd08100
 #define LASI_GFX_HPA    0xf8000000
 #define ARTIST_FB_ADDR  0xf9000000
 #define CPU_HPA         0xfffb0000
@@ -44,6 +36,8 @@
 
 #define SCSI_HPA        0xf1040000      /* emulated SCSI, needs to be in f region */
 
+#define HPA_DISABLED_DEVICE     1       /* add to HPA to disable */
+
 /* offsets to DINO HPA: */
 #define DINO_PCI_ADDR           0x064
 #define DINO_CONFIG_DATA        0x068
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index cbca0026ab..8c66eed5a2 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -50,8 +50,6 @@ struct HppaMachineState {
 #define HPA_POWER_BUTTON        (FIRMWARE_END - 0x10)
 static hwaddr soft_power_reg;
 
-#define enable_lasi_lan()       0
-
 static DeviceState *lasi_dev;
 
 static void hppa_powerdown_req(Notifier *n, void *opaque)
@@ -376,13 +374,6 @@ static void machine_HP_common_init_tail(MachineState *machine, PCIBus *pci_bus,
         }
     }
 
-    /* Network setup. */
-    if (lasi_dev) {
-        lasi_82596_init(addr_space, translate(NULL, LASI_LAN_HPA),
-                        qdev_get_gpio_in(lasi_dev, LASI_IRQ_LAN_HPA),
-                        enable_lasi_lan());
-    }
-
     if (pci_bus) {
         pci_init_nic_devices(pci_bus, mc->default_nic);
 
@@ -595,6 +586,17 @@ static void machine_HP_715_init(MachineState *machine)
         lasi_ncr710_handle_legacy_cmdline(dev);
     }
 
+    /* LASI i82596 network */
+    dev = qemu_create_nic_device(TYPE_LASI_82596, true, "lasi");
+    if (dev) {
+        sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+        sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                           qdev_get_gpio_in(lasi_dev, LASI_IRQ_LAN_HPA));
+        memory_region_add_subregion(addr_space,
+                                    translate(NULL, LASI_HPA_715 + LASI_LAN),
+                                    sysbus_mmio_get_region(SYS_BUS_DEVICE(dev), 0));
+    }
+
     /* Add NICs, graphics & load firmware */
     machine_HP_common_init_tail(machine, NULL, translate);
 }
@@ -638,7 +640,7 @@ static void machine_HP_B160L_init(MachineState *machine)
     assert(isa_bus);
 
     /* Serial ports: Lasi and Dino use a 7.272727 MHz clock. */
-    serial_mm_init(addr_space, translate(NULL, LASI_UART_HPA + 0x800), 0,
+    serial_mm_init(addr_space, translate(NULL, LASI_HPA + LASI_UART + 0x800), 0,
         qdev_get_gpio_in(lasi_dev, LASI_IRQ_UART_HPA), 7272727 / 16,
         serial_hd(0), DEVICE_BIG_ENDIAN);
 
@@ -647,7 +649,8 @@ static void machine_HP_B160L_init(MachineState *machine)
         serial_hd(1), DEVICE_BIG_ENDIAN);
 
     /* Parallel port */
-    parallel_mm_init(addr_space, translate(NULL, LASI_LPT_HPA + 0x800), 0,
+    parallel_mm_init(addr_space,
+                     translate(NULL, LASI_HPA + LASI_LPT + 0x800), 0,
                      qdev_get_gpio_in(lasi_dev, LASI_IRQ_LPT_HPA),
                      parallel_hds[0]);
 
@@ -657,11 +660,11 @@ static void machine_HP_B160L_init(MachineState *machine)
     sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
                        qdev_get_gpio_in(lasi_dev, LASI_IRQ_PS2KBD_HPA));
     memory_region_add_subregion(addr_space,
-                                translate(NULL, LASI_PS2KBD_HPA),
+                                translate(NULL, LASI_HPA + LASI_PS2),
                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
                                                        0));
     memory_region_add_subregion(addr_space,
-                                translate(NULL, LASI_PS2KBD_HPA + 0x100),
+                                translate(NULL, LASI_HPA + LASI_PS2 + 0x100),
                                 sysbus_mmio_get_region(SYS_BUS_DEVICE(dev),
                                                        1));
 
@@ -832,7 +835,7 @@ static void HP_715_machine_init_class_init(ObjectClass *oc, const void *data)
     /* can only support up to max. 8 CPUs due inventory major numbers */
     mc->max_cpus = MIN_CONST(HPPA_MAX_CPUS, 8);
     mc->default_ram_size = 256 * MiB;
-    mc->default_nic = NULL;
+    mc->default_nic = TYPE_LASI_82596;
 }
 
 
diff --git a/hw/net/lasi_i82596.c b/hw/net/lasi_i82596.c
index 9e1dd21546..b87cea411a 100644
--- a/hw/net/lasi_i82596.c
+++ b/hw/net/lasi_i82596.c
@@ -115,32 +115,12 @@ static void lasi_82596_realize(DeviceState *dev, Error **errp)
     memory_region_init_io(&s->mmio, OBJECT(d), &lasi_82596_mem_ops, d,
                 "lasi_82596-mmio", PA_GET_MACADDR + 4);
 
+    sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->irq);
+    sysbus_init_mmio(SYS_BUS_DEVICE(dev), &s->mmio);
+
     i82596_common_init(dev, s, &net_lasi_82596_info);
 }
 
-SysBusI82596State *lasi_82596_init(MemoryRegion *addr_space, hwaddr hpa,
-                                   qemu_irq lan_irq, gboolean match_default)
-{
-    DeviceState *dev;
-    SysBusI82596State *s;
-    static const MACAddr HP_MAC = {
-        .a = { 0x08, 0x00, 0x09, 0xef, 0x34, 0xf6 } };
-
-    dev = qemu_create_nic_device(TYPE_LASI_82596, match_default, "lasi");
-    if (!dev) {
-        return NULL;
-    }
-
-    s = SYSBUS_I82596(dev);
-    s->state.irq = lan_irq;
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-    s->state.conf.macaddr = HP_MAC; /* set HP MAC prefix */
-
-    /* LASI 82596 ports in main memory. */
-    memory_region_add_subregion(addr_space, hpa, &s->state.mmio);
-    return s;
-}
-
 static void lasi_82596_reset(DeviceState *dev)
 {
     SysBusI82596State *d = SYSBUS_I82596(dev);
@@ -152,6 +132,10 @@ static void lasi_82596_instance_init(Object *obj)
 {
     SysBusI82596State *d = SYSBUS_I82596(obj);
     I82596State *s = &d->state;
+    static const MACAddr HP_MAC = {
+        .a = { 0x08, 0x00, 0x09, 0xef, 0x34, 0xf6 } };
+
+    s->conf.macaddr = HP_MAC;
 
     device_add_bootindex_property(obj, &s->conf.bootindex,
                                   "bootindex", "/ethernet-phy@0",
diff --git a/include/hw/net/lasi_82596.h b/include/hw/net/lasi_82596.h
index 439356ec19..c46a4a137e 100644
--- a/include/hw/net/lasi_82596.h
+++ b/include/hw/net/lasi_82596.h
@@ -25,7 +25,4 @@ struct SysBusI82596State {
     int val_index:1;
 };
 
-SysBusI82596State *lasi_82596_init(MemoryRegion *addr_space, hwaddr hpa,
-                                   qemu_irq irq, gboolean match_default);
-
 #endif

From cbf62eef84ab6bd1be3a03269b4a4e9df529985f Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Mon, 3 Nov 2025 16:57:22 +0530
Subject: [PATCH 2027/2396] i82596: Added core infrastructure and helper
 functions

As a part of GSOC 2025 I have done a massive rewrite of what was the
82596 NIC. This has been done to add the missing functionality according
to the 82596 Manual and making the code production ready.

This patch adds:
- comprehensive 82596 constants and configuration macros
- address translation for segmented/linear memory modes
- error recording and statistics tracking infrastructure
- CRC-16/32 calculation and appending functions
- CSMA/CD collision detection and backoff logic
- bus throttle timer framework
- enhanced reset with full state initialization
- receive_iov and polling support functions
- updated VMState for migration of all new fields

Note:
This patch primarily includes placeholder code.
To achieve full 82596 emulation, the complete 82596 patch series is
required.  Nevertheless, QEMU is able to load and boot successfully with
this patch.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Tested-by: Helge Deller <deller@gmx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/net/i82596.c      | 663 ++++++++++++++++++++++++++++++++++++++-----
 hw/net/i82596.h      |  74 ++++-
 hw/net/lasi_i82596.c |   6 +
 3 files changed, 653 insertions(+), 90 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index c1ff3e6c56..859cc88b2e 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -2,10 +2,38 @@
  * QEMU Intel i82596 (Apricot) emulation
  *
  * Copyright (c) 2019 Helge Deller <deller@gmx.de>
- * This work is licensed under the GNU GPL license version 2 or later.
  *
+ * Additional functionality added by:
+ * Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
+ * During GSOC 2025 under mentorship of Helge Deller.
+ *
+ * This work is licensed under the GNU GPL license version 2 or later.
  * This software was written to be compatible with the specification:
  * https://parisc.docs.kernel.org/en/latest/_downloads/96672be0650d9fc046bbcea40b92482f/82596CA.pdf
+ *
+ * INDEX:
+ * 1.  Reset
+ * 2.  Address Translation
+ * 3.  Transmit functions
+ * 4.  Receive Helper functions
+ * 5.  Receive functions
+ * 6.  Misc Functionality Functions
+ * 6.1 Individual Address
+ * 6.2 Multicast Address List
+ * 6.3 Link Status
+ * 6.4 CSMA/CD functions
+ * 6.5 Unified CRC Calculation
+ * 6.6 Unified Statistics Update
+ * 7.  Bus Throttling Timer
+ * 8.  Dump functions
+ * 9.  Configure
+ * 10. Command Loop
+ * 11. Examine SCB
+ * 12. Channel attention (CA)
+ * 13. LASI interface
+ * 14. Polling functions
+ * 15. QOM and interface functions
+ *
  */
 
 #include "qemu/osdep.h"
@@ -21,50 +49,90 @@
 #include "i82596.h"
 #include <zlib.h> /* for crc32 */
 
+#define ENABLE_DEBUG 0
+
 #if defined(ENABLE_DEBUG)
 #define DBG(x)          x
 #else
 #define DBG(x)          do { } while (0)
 #endif
 
-#define USE_TIMER       0
+#define USE_TIMER       1
 
-#define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
-
-#define PKT_BUF_SZ      1536
 #define MAX_MC_CNT      64
-
-#define ISCP_BUSY       0x0001
-
 #define I596_NULL       ((uint32_t)0xffffffff)
+#define BITS(n, m)      (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 
-#define SCB_STATUS_CX   0x8000 /* CU finished command with I bit */
-#define SCB_STATUS_FR   0x4000 /* RU finished receiving a frame */
-#define SCB_STATUS_CNA  0x2000 /* CU left active state */
-#define SCB_STATUS_RNR  0x1000 /* RU left active state */
+#define SCB_STATUS_CX   0x8000  /* CU finished command with I bit */
+#define SCB_STATUS_FR   0x4000  /* RU finished receiving a frame */
+#define SCB_STATUS_CNA  0x2000  /* CU left active state */
+#define SCB_STATUS_RNR  0x1000  /* RU left active state */
+#define SCB_ACK_MASK    0xF000  /* All interrupt acknowledge bits */
 
-#define SCB_COMMAND_ACK_MASK \
-        (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)
+/* 82596 Operational Modes */
+#define I82586_MODE                 0x00
+#define I82596_MODE_SEGMENTED       0x01
+#define I82596_MODE_LINEAR          0x02
 
+/* Monitor Options */
+#define MONITOR_NORMAL      0x00
+#define MONITOR_FILTERED    0x01
+#define MONITOR_ALL         0x02
+#define MONITOR_DISABLED    0x03
+
+/* Operation mode flags from SYSBUS byte */
+#define SYSBUS_LOCK_EN         0x08
+#define SYSBUS_INT_ACTIVE_LOW  0x10
+#define SYSBUS_BIG_ENDIAN_32   0x80
+#define SYSBUS_THROTTLE_MASK   0x60
+
+/* SCB commands - Command Unit (CU) */
+#define SCB_CUC_NOP            0x00
+#define SCB_CUC_START          0x01
+#define SCB_CUC_RESUME         0x02
+#define SCB_CUC_SUSPEND        0x03
+#define SCB_CUC_ABORT          0x04
+#define SCB_CUC_LOAD_THROTTLE  0x05
+#define SCB_CUC_LOAD_START     0x06
+
+/* SCB commands - Receive Unit (RU) */
+#define SCB_RUC_NOP            0x00
+#define SCB_RUC_START          0x01
+#define SCB_RUC_RESUME         0x02
+#define SCB_RUC_SUSPEND        0x03
+#define SCB_RUC_ABORT          0x04
+
+/* SCB statuses - Command Unit (CU) */
 #define CU_IDLE         0
 #define CU_SUSPENDED    1
 #define CU_ACTIVE       2
 
-#define RX_IDLE         0
-#define RX_SUSPENDED    1
-#define RX_READY        4
+/* SCB statuses - Receive Unit (RU) */
+#define RX_IDLE         0x00
+#define RX_SUSPENDED    0x01
+#define RX_NO_RESOURCES 0x02
+#define RX_READY        0x04
+#define RX_NO_RESO_RBD  0x0A
+#define RX_NO_MORE_RBD  0x0C
 
-#define CMD_EOL         0x8000  /* The last command of the list, stop. */
-#define CMD_SUSP        0x4000  /* Suspend after doing cmd. */
-#define CMD_INTR        0x2000  /* Interrupt after doing cmd. */
+#define CMD_FLEX        0x0008
+#define CMD_MASK        0x0007
 
-#define CMD_FLEX        0x0008  /* Enable flexible memory model */
+#define CMD_EOL         0x8000
+#define CMD_SUSP        0x4000
+#define CMD_INTR        0x2000
+
+#define ISCP_BUSY                   0x01
+#define NANOSECONDS_PER_MICROSECOND 1000
+
+#define DUMP_BUF_SZ                 304
 
 enum commands {
         CmdNOp = 0, CmdSASetup = 1, CmdConfigure = 2, CmdMulticastList = 3,
         CmdTx = 4, CmdTDR = 5, CmdDump = 6, CmdDiagnose = 7
 };
 
+
 #define STAT_C          0x8000  /* Set to 0 after execution */
 #define STAT_B          0x4000  /* Command being executed */
 #define STAT_OK         0x2000  /* Command executed ok */
@@ -73,15 +141,60 @@ enum commands {
 #define I596_EOF        0x8000
 #define SIZE_MASK       0x3fff
 
-/* various flags in the chip config registers */
-#define I596_PREFETCH   (s->config[0] & 0x80)
-#define I596_PROMISC    (s->config[8] & 0x01)
-#define I596_BC_DISABLE (s->config[8] & 0x02) /* broadcast disable */
-#define I596_NOCRC_INS  (s->config[8] & 0x08)
-#define I596_CRCINM     (s->config[11] & 0x04) /* CRC appended */
-#define I596_MC_ALL     (s->config[11] & 0x20)
-#define I596_MULTIIA    (s->config[13] & 0x40)
+#define CSMA_SLOT_TIME         51
+#define CSMA_MAX_RETRIES       16
+#define CSMA_BACKOFF_LIMIT     10
 
+/* Global Flags fetched from config bytes */
+#define I596_PREFETCH       (s->config[0] & 0x80)
+#define SAVE_BAD_FRAMES     (s->config[2] & 0x80)
+#define I596_NO_SRC_ADD_IN  (s->config[3] & 0x08)
+#define I596_LOOPBACK       (s->config[3] >> 6)
+#define I596_PROMISC        (s->config[8] & 0x01)
+#define I596_BC_DISABLE     (s->config[8] & 0x02)
+#define I596_NOCRC_INS      (s->config[8] & 0x08)
+#define I596_CRC16_32       (s->config[8] & 0x10)
+#define I596_PADDING        (s->config[8] & 0x80)
+#define I596_MIN_FRAME_LEN  (s->config[10])
+#define I596_CRCINM         (s->config[11] & 0x04)
+#define I596_MONITOR_MODE   ((s->config[11] >> 6) & 0x03)
+#define I596_MC_ALL         (s->config[11] & 0x20)
+#define I596_FULL_DUPLEX    (s->config[12] & 0x40)
+#define I596_MULTIIA        (s->config[13] & 0x40)
+
+/* RX Error flags */
+#define RX_COLLISIONS         0x0001
+#define RX_LENGTH_ERRORS      0x0080
+#define RX_OVER_ERRORS        0x0100
+#define RX_FIFO_ERRORS        0x0400
+#define RX_FRAME_ERRORS       0x0800
+#define RX_CRC_ERRORS         0x1000
+#define RX_LENGTH_ERRORS_ALT  0x2000
+#define RFD_STATUS_TRUNC      0x0020
+#define RFD_STATUS_NOBUFS     0x0200
+
+/* TX Error flags */
+#define TX_COLLISIONS       0x0020
+#define TX_HEARTBEAT_ERRORS 0x0040
+#define TX_CARRIER_ERRORS   0x0400
+#define TX_COLLISIONS_ALT   0x0800
+#define TX_ABORTED_ERRORS   0x1000
+
+static void i82596_update_scb_irq(I82596State *s, bool trigger);
+static void i82596_update_cu_status(I82596State *s, uint16_t cmd_status,
+                                     bool generate_interrupt);
+static void update_scb_status(I82596State *s);
+static void examine_scb(I82596State *s);
+static bool i82596_check_medium_status(I82596State *s);
+static int i82596_csma_backoff(I82596State *s, int retry_count);
+static uint16_t i82596_calculate_crc16(const uint8_t *data, size_t len);
+static size_t i82596_append_crc(I82596State *s, uint8_t *buffer, size_t len);
+static void i82596_bus_throttle_timer(void *opaque);
+static void i82596_flush_queue_timer(void *opaque);
+static int i82596_flush_packet_queue(I82596State *s);
+static void i82596_update_statistics(I82596State *s, bool is_tx,
+                                      uint16_t error_flags,
+                                      uint16_t collision_count);
 
 static uint8_t get_byte(uint32_t addr)
 {
@@ -116,7 +229,44 @@ static void set_uint32(uint32_t addr, uint32_t val)
     set_uint16(addr + 2, val >> 16);
 }
 
+/* Centralized error detection and update mechanism */
+static void i82596_record_error(I82596State *s, uint16_t error_type, bool is_tx)
+{
+    if (is_tx) {
+        if (error_type & TX_ABORTED_ERRORS) {
+            s->tx_aborted_errors++;
+            set_uint32(s->scb + 28, s->tx_aborted_errors);
+        }
+    } else {
+        if (error_type & RX_CRC_ERRORS) {
+            s->crc_err++;
+            set_uint32(s->scb + 16, s->crc_err);
+        }
 
+        if (error_type & (RX_LENGTH_ERRORS | RX_LENGTH_ERRORS_ALT |
+                          RX_FRAME_ERRORS)) {
+            s->align_err++;
+            set_uint32(s->scb + 18, s->align_err);
+        }
+
+        if (error_type & RFD_STATUS_NOBUFS) {
+            s->resource_err++;
+            set_uint32(s->scb + 20, s->resource_err);
+        }
+
+        if (error_type & (RX_OVER_ERRORS | RX_FIFO_ERRORS)) {
+            s->over_err++;
+            set_uint32(s->scb + 22, s->over_err);
+        }
+
+        if (error_type & RFD_STATUS_TRUNC) {
+            s->short_fr_error++;
+            set_uint32(s->scb + 26, s->short_fr_error);
+        }
+    }
+}
+
+/* Packet Header Debugger */
 struct qemu_ether_header {
     uint8_t ether_dhost[6];
     uint8_t ether_shost[6];
@@ -124,12 +274,122 @@ struct qemu_ether_header {
 };
 
 #define PRINT_PKTHDR(txt, BUF) do {                  \
-    struct qemu_ether_header *hdr = (void *)(BUF); \
-    printf(txt ": packet dhost=" MAC_FMT ", shost=" MAC_FMT ", type=0x%04x\n",\
-           MAC_ARG(hdr->ether_dhost), MAC_ARG(hdr->ether_shost),        \
-           be16_to_cpu(hdr->ether_type));       \
 } while (0)
 
+static void i82596_cleanup(I82596State *s)
+{
+    if (s->throttle_timer) {
+        timer_del(s->throttle_timer);
+    }
+    if (s->flush_queue_timer) {
+        timer_del(s->flush_queue_timer);
+    }
+    s->queue_head = 0;
+    s->queue_tail = 0;
+    s->queue_count = 0;
+}
+
+static void i82596_s_reset(I82596State *s)
+{
+    trace_i82596_s_reset(s);
+    i82596_cleanup(s);
+
+    /* Clearing config bits */
+    memset(s->config, 0, sizeof(s->config));
+    s->scp = 0x00FFFFF4;
+    s->scb = 0;
+    s->scb_base = 0;
+    s->scb_status = 0;
+    s->cu_status = CU_IDLE;
+    s->rx_status = RX_IDLE;
+    s->cmd_p = I596_NULL;
+    s->lnkst = 0x8000;
+    s->ca = s->ca_active = 0;
+    s->send_irq = 0;
+
+    /* Statistical Counters */
+    s->crc_err = 0;
+    s->align_err = 0;
+    s->resource_err = 0;
+    s->over_err = 0;
+    s->rcvdt_err = 0;
+    s->short_fr_error = 0;
+    s->total_frames = 0;
+    s->total_good_frames = 0;
+    s->collision_events = 0;
+    s->total_collisions = 0;
+    s->tx_good_frames = 0;
+    s->tx_collisions = 0;
+    s->tx_aborted_errors = 0;
+    s->last_tx_len = 0;
+
+    s->last_good_rfa = 0;
+    s->current_rx_desc = 0;
+    s->current_tx_desc = 0;
+    s->tx_retry_addr = 0;
+    s->tx_retry_count = 0;
+
+    s->rnr_signaled = false;
+    s->flushing_queue = false;
+
+    memset(s->tx_buffer, 0, sizeof(s->tx_buffer));
+    memset(s->rx_buffer, 0, sizeof(s->rx_buffer));
+    s->tx_frame_len = 0;
+    s->rx_frame_len = 0;
+}
+
+void i82596_h_reset(void *opaque)
+{
+    I82596State *s = opaque;
+
+    i82596_s_reset(s);
+}
+
+/*
+ * Address Translation Implementation
+ * Handles segmented and linear memory modes for i82596.
+ * Returns physical address for DMA operations.
+ * Returns I596_NULL (0xffffffff) on invalid addresses.
+ */
+static inline uint32_t i82596_translate_address(I82596State *s,
+                                                 uint32_t logical_addr,
+                                                 bool is_data_buffer)
+{
+    if (logical_addr == I596_NULL || logical_addr == 0) {
+        return logical_addr;
+    }
+
+    switch (s->mode) {
+    case I82596_MODE_LINEAR:
+        return logical_addr;
+
+    case I82596_MODE_SEGMENTED: {
+        uint32_t base = (logical_addr >> 16) & 0xFFFF;
+        uint32_t offset = logical_addr & 0xFFFF;
+
+        if (is_data_buffer) {
+            return (base << 4) + offset;
+        } else {
+            if (base == 0xFFFF && offset == 0xFFFF) {
+                return I596_NULL;
+            }
+            return s->scb_base + ((base << 4) + offset);
+        }
+    }
+
+    case I82586_MODE:
+    default:
+        if (is_data_buffer) {
+            return logical_addr;
+        } else {
+            if ((logical_addr & 0xFFFF0000) == 0xFFFF0000) {
+                return I596_NULL;
+            }
+            return s->scb_base + logical_addr;
+        }
+    }
+}
+
 static void i82596_transmit(I82596State *s, uint32_t addr)
 {
     uint32_t tdb_p; /* Transmit Buffer Descriptor */
@@ -223,33 +483,199 @@ static void set_multicast_list(I82596State *s, uint32_t addr)
 
 void i82596_set_link_status(NetClientState *nc)
 {
-    I82596State *d = qemu_get_nic_opaque(nc);
+    I82596State *s = qemu_get_nic_opaque(nc);
+    bool was_up = s->lnkst != 0;
 
-    d->lnkst = nc->link_down ? 0 : 0x8000;
+    s->lnkst = nc->link_down ? 0 : 0x8000;
+    bool is_up = s->lnkst != 0;
+
+    if (!was_up && is_up && s->rx_status == RX_READY) {
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+    }
+}
+
+static bool G_GNUC_UNUSED i82596_check_medium_status(I82596State *s)
+{
+    if (I596_FULL_DUPLEX) {
+        return true;
+    }
+
+    if (!s->throttle_state) {
+        return false;
+    }
+
+    if (!I596_LOOPBACK && (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) % 100 < 5)) {
+        s->collision_events++;
+        return false;
+    }
+
+    return true;
+}
+
+static int G_GNUC_UNUSED i82596_csma_backoff(I82596State *s, int retry_count)
+{
+    int backoff_factor, slot_count, backoff_time;
+
+    backoff_factor = MIN(retry_count + 1, CSMA_BACKOFF_LIMIT);
+    slot_count = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) % (1 << backoff_factor);
+    backoff_time = slot_count * CSMA_SLOT_TIME;
+
+    return backoff_time;
+}
+
+static uint16_t i82596_calculate_crc16(const uint8_t *data, size_t len)
+{
+    uint16_t crc = 0xFFFF;
+    size_t i, j;
+
+    for (i = 0; i < len; i++) {
+        crc ^= data[i] << 8;
+        for (j = 0; j < 8; j++) {
+            if (crc & 0x8000) {
+                crc = (crc << 1) ^ 0x1021;
+            } else {
+                crc <<= 1;
+            }
+        }
+    }
+    return crc;
+}
+
+static size_t G_GNUC_UNUSED i82596_append_crc(I82596State *s, uint8_t *buffer, size_t len)
+{
+    if (len + 4 > PKT_BUF_SZ) {
+        return len;
+    }
+
+    if (I596_CRC16_32) {
+        uint32_t crc = crc32(~0, buffer, len);
+        crc = cpu_to_be32(crc);
+        memcpy(&buffer[len], &crc, sizeof(crc));
+        return len + sizeof(crc);
+    } else {
+        uint16_t crc = i82596_calculate_crc16(buffer, len);
+        crc = cpu_to_be16(crc);
+        memcpy(&buffer[len], &crc, sizeof(crc));
+        return len + sizeof(crc);
+    }
+}
+
+static void G_GNUC_UNUSED i82596_update_statistics(I82596State *s, bool is_tx,
+                                      uint16_t error_flags,
+                                      uint16_t collision_count)
+{
+    if (is_tx) {
+        if (collision_count > 0) {
+            s->tx_collisions += collision_count;
+            s->collision_events++;
+            s->total_collisions += collision_count;
+            set_uint32(s->scb + 32, s->tx_collisions);
+        }
+        if (error_flags) {
+            i82596_record_error(s, error_flags, true);
+        }
+        if (!(error_flags & (TX_ABORTED_ERRORS | TX_CARRIER_ERRORS))) {
+            s->tx_good_frames++;
+            set_uint32(s->scb + 36, s->tx_good_frames);
+        }
+    } else {
+        s->total_frames++;
+        set_uint32(s->scb + 40, s->total_frames);
+        if (error_flags) {
+            i82596_record_error(s, error_flags, false);
+        } else {
+            s->total_good_frames++;
+            set_uint32(s->scb + 44, s->total_good_frames);
+        }
+    }
+}
+
+/* Bus Throttle Functionality */
+static void G_GNUC_UNUSED i82596_bus_throttle_timer(void *opaque)
+{
+    I82596State *s = opaque;
+
+    if (s->throttle_state) {
+        s->throttle_state = false;
+        if (s->t_off > 0) {
+            timer_mod(s->throttle_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                      (s->t_off * NANOSECONDS_PER_MICROSECOND));
+        }
+    } else {
+        s->throttle_state = true;
+        if (s->t_on > 0) {
+            timer_mod(s->throttle_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                      (s->t_on * NANOSECONDS_PER_MICROSECOND));
+        }
+
+        if (s->cu_status == CU_ACTIVE || s->rx_status == RX_READY) {
+            examine_scb(s);
+        }
+    }
+}
+
+static int G_GNUC_UNUSED i82596_flush_packet_queue(I82596State *s)
+{
+    /* Stub for now - will be implemented in Patch 2 */
+    return 0;
+}
+
+static void G_GNUC_UNUSED i82596_flush_queue_timer(void *opaque)
+{
+    /* Stub for now - will be implemented in Patch 2 */
+}
+
+static void i82596_update_scb_irq(I82596State *s, bool trigger)
+{
+    if (trigger) {
+        s->send_irq = 1;
+        qemu_set_irq(s->irq, 1);
+    }
+}
+
+static void G_GNUC_UNUSED i82596_update_cu_status(I82596State *s, uint16_t cmd_status,
+                                     bool generate_interrupt)
+{
+    if (cmd_status & STAT_C) {
+        if (cmd_status & STAT_OK) {
+            if (s->cu_status == CU_ACTIVE && s->cmd_p == I596_NULL) {
+                s->cu_status = CU_IDLE;
+                s->scb_status |= SCB_STATUS_CNA;
+            }
+        } else {
+            s->cu_status = CU_IDLE;
+            s->scb_status |= SCB_STATUS_CNA;
+        }
+
+        if (generate_interrupt) {
+            s->scb_status |= SCB_STATUS_CX;
+            i82596_update_scb_irq(s, true);
+        }
+    }
+
+    update_scb_status(s);
 }
 
 static void update_scb_status(I82596State *s)
 {
     s->scb_status = (s->scb_status & 0xf000)
-        | (s->cu_status << 8) | (s->rx_status << 4);
+        | (s->cu_status << 8) | (s->rx_status << 4) | (s->lnkst >> 8);
     set_uint16(s->scb, s->scb_status);
+
+    set_uint32(s->scb + 28, s->tx_aborted_errors);
+    set_uint32(s->scb + 32, s->tx_collisions);
+    set_uint32(s->scb + 36, s->tx_good_frames);
+
+    set_uint32(s->scb + 16, s->crc_err);
+    set_uint32(s->scb + 18, s->align_err);
+    set_uint32(s->scb + 20, s->resource_err);
+    set_uint32(s->scb + 22, s->over_err);
+    set_uint32(s->scb + 24, s->rcvdt_err);
+    set_uint32(s->scb + 26, s->short_fr_error);
 }
 
-
-static void i82596_s_reset(I82596State *s)
-{
-    trace_i82596_s_reset(s);
-    s->scp = 0;
-    s->scb_status = 0;
-    s->cu_status = CU_IDLE;
-    s->rx_status = RX_SUSPENDED;
-    s->cmd_p = I596_NULL;
-    s->lnkst = 0x8000; /* initial link state: up */
-    s->ca = s->ca_active = 0;
-    s->send_irq = 0;
-}
-
-
 static void command_loop(I82596State *s)
 {
     uint16_t cmd;
@@ -330,17 +756,6 @@ static void command_loop(I82596State *s)
     qemu_flush_queued_packets(qemu_get_queue(s->nic));
 }
 
-static void i82596_flush_queue_timer(void *opaque)
-{
-    I82596State *s = opaque;
-    if (0) {
-        timer_del(s->flush_queue_timer);
-        qemu_flush_queued_packets(qemu_get_queue(s->nic));
-        timer_mod(s->flush_queue_timer,
-              qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000);
-    }
-}
-
 static void examine_scb(I82596State *s)
 {
     uint16_t command, cuc, ruc;
@@ -353,7 +768,7 @@ static void examine_scb(I82596State *s)
     /* and clear the scb command word */
     set_uint16(s->scb + 2, 0);
 
-    s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);
+    s->scb_status &= ~(command & SCB_ACK_MASK);
 
     switch (cuc) {
     case 0:     /* no change */
@@ -465,13 +880,6 @@ uint32_t i82596_ioport_readw(void *opaque, uint32_t addr)
     return -1;
 }
 
-void i82596_h_reset(void *opaque)
-{
-    I82596State *s = opaque;
-
-    i82596_s_reset(s);
-}
-
 bool i82596_can_receive(NetClientState *nc)
 {
     I82596State *s = qemu_get_nic_opaque(nc);
@@ -595,7 +1003,6 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
     rbd = get_uint32(rfd_p + 8);
     assert(rbd && rbd != I596_NULL);
 
-    trace_i82596_receive_packet(len);
     /* PRINT_PKTHDR("Receive", buf); */
 
     while (len) {
@@ -714,14 +1121,113 @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
     return sz;
 }
 
+ssize_t i82596_receive_iov(NetClientState *nc, const struct iovec *iov,
+                            int iovcnt)
+{
+    size_t sz = 0;
+    uint8_t *buf;
+    int i;
+    for (i = 0; i < iovcnt; i++) {
+        sz += iov[i].iov_len;
+    }
+    if (sz == 0) {
+        return -1;
+    }
+    buf = g_malloc(sz);
+    if (!buf) {
+        return -1;
+    }
+    size_t offset = 0;
+    for (i = 0; i < iovcnt; i++) {
+        if (iov[i].iov_base == NULL) {
+            g_free(buf);
+            return -1;
+        }
+        memcpy(buf + offset, iov[i].iov_base, iov[i].iov_len);
+        offset += iov[i].iov_len;
+    }
+    DBG(PRINT_PKTHDR("Receive IOV:", buf));
+    i82596_receive(nc, buf, sz);
+    g_free(buf);
+    return sz;
+}
+
+void i82596_poll(NetClientState *nc, bool enable)
+{
+    I82596State *s = qemu_get_nic_opaque(nc);
+
+    if (!enable) {
+        return;
+    }
+
+    if (s->send_irq) {
+        qemu_set_irq(s->irq, 1);
+    }
+
+    if (s->rx_status == RX_NO_RESOURCES) {
+        if (s->cmd_p != I596_NULL) {
+            s->rx_status = RX_READY;
+            update_scb_status(s);
+        }
+    }
+
+    if (s->cu_status == CU_ACTIVE && s->cmd_p != I596_NULL) {
+        examine_scb(s);
+    }
+    qemu_set_irq(s->irq, 0);
+}
 
 const VMStateDescription vmstate_i82596 = {
     .name = "i82596",
     .version_id = 1,
     .minimum_version_id = 1,
-    .fields = (const VMStateField[]) {
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT8(mode, I82596State),
+        VMSTATE_UINT16(t_on, I82596State),
+        VMSTATE_UINT16(t_off, I82596State),
+        VMSTATE_BOOL(throttle_state, I82596State),
+        VMSTATE_UINT32(iscp, I82596State),
+        VMSTATE_UINT8(sysbus, I82596State),
+        VMSTATE_UINT32(scb, I82596State),
+        VMSTATE_UINT32(scb_base, I82596State),
+        VMSTATE_UINT16(scb_status, I82596State),
+        VMSTATE_UINT8(cu_status, I82596State),
+        VMSTATE_UINT8(rx_status, I82596State),
         VMSTATE_UINT16(lnkst, I82596State),
-        VMSTATE_TIMER_PTR(flush_queue_timer, I82596State),
+        VMSTATE_UINT32(cmd_p, I82596State),
+        VMSTATE_INT32(ca, I82596State),
+        VMSTATE_INT32(ca_active, I82596State),
+        VMSTATE_INT32(send_irq, I82596State),
+        VMSTATE_BUFFER(mult, I82596State),
+        VMSTATE_BUFFER(config, I82596State),
+        VMSTATE_BUFFER(tx_buffer, I82596State),
+        VMSTATE_UINT32(tx_retry_addr, I82596State),
+        VMSTATE_INT32(tx_retry_count, I82596State),
+        VMSTATE_UINT32(tx_good_frames, I82596State),
+        VMSTATE_UINT32(tx_collisions, I82596State),
+        VMSTATE_UINT32(tx_aborted_errors, I82596State),
+        VMSTATE_UINT32(last_tx_len, I82596State),
+        VMSTATE_UINT32(collision_events, I82596State),
+        VMSTATE_UINT32(total_collisions, I82596State),
+        VMSTATE_UINT32(crc_err, I82596State),
+        VMSTATE_UINT32(align_err, I82596State),
+        VMSTATE_UINT32(resource_err, I82596State),
+        VMSTATE_UINT32(over_err, I82596State),
+        VMSTATE_UINT32(rcvdt_err, I82596State),
+        VMSTATE_UINT32(short_fr_error, I82596State),
+        VMSTATE_UINT32(total_frames, I82596State),
+        VMSTATE_UINT32(total_good_frames, I82596State),
+        VMSTATE_BUFFER(rx_buffer, I82596State),
+        VMSTATE_UINT16(tx_frame_len, I82596State),
+        VMSTATE_UINT16(rx_frame_len, I82596State),
+        VMSTATE_UINT64(current_tx_desc, I82596State),
+        VMSTATE_UINT64(current_rx_desc, I82596State),
+        VMSTATE_UINT32(last_good_rfa, I82596State),
+        VMSTATE_INT32(queue_head, I82596State),
+        VMSTATE_INT32(queue_tail, I82596State),
+        VMSTATE_INT32(queue_count, I82596State),
+        VMSTATE_BOOL(rnr_signaled, I82596State),
+        VMSTATE_BOOL(flushing_queue, I82596State),
         VMSTATE_END_OF_LIST()
     }
 };
@@ -736,8 +1242,15 @@ void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info)
     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 
     if (USE_TIMER) {
-        s->flush_queue_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
-                                    i82596_flush_queue_timer, s);
+        if (!s->flush_queue_timer) {
+            s->flush_queue_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                        i82596_flush_queue_timer, s);
+        }
+        if (!s->throttle_timer) {
+            s->throttle_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                        i82596_bus_throttle_timer, s);
+        }
     }
+
     s->lnkst = 0x8000; /* initial link state: up */
 }
diff --git a/hw/net/i82596.h b/hw/net/i82596.h
index dc1fa1a1dc..67b18f957a 100644
--- a/hw/net/i82596.h
+++ b/hw/net/i82596.h
@@ -6,11 +6,15 @@
 #include "system/memory.h"
 #include "system/address-spaces.h"
 
-#define PORT_RESET              0x00    /* reset 82596 */
-#define PORT_SELFTEST           0x01    /* selftest */
-#define PORT_ALTSCP             0x02    /* alternate SCB address */
-#define PORT_ALTDUMP            0x03    /* Alternate DUMP address */
-#define PORT_CA                 0x10    /* QEMU-internal CA signal */
+#define PACKET_QUEUE_SIZE 64
+#define RX_RING_SIZE    16
+#define PKT_BUF_SZ      1536
+
+#define PORT_RESET              0x00
+#define PORT_SELFTEST           0x01
+#define PORT_ALTSCP             0x02
+#define PORT_ALTDUMP            0x03
+#define PORT_CA                 0x10
 
 typedef struct I82596State_st I82596State;
 
@@ -21,35 +25,75 @@ struct I82596State_st {
     NICState *nic;
     NICConf conf;
     QEMUTimer *flush_queue_timer;
+    uint8_t mode;
 
-    hwaddr scp;         /* pointer to SCP */
+    QEMUTimer *throttle_timer;
+    uint16_t t_on;
+    uint16_t t_off;
+    bool throttle_state;
+
+    hwaddr scp;
+    uint32_t iscp;
     uint8_t sysbus;
-    uint32_t scb;       /* SCB */
+    uint32_t scb;
+    uint32_t scb_base;
     uint16_t scb_status;
     uint8_t cu_status, rx_status;
     uint16_t lnkst;
+    uint32_t last_tx_len;
+    uint32_t collision_events;
+    uint32_t total_collisions;
 
-    uint32_t cmd_p;     /* addr of current command */
+    uint32_t tx_retry_addr;
+    int tx_retry_count;
+    uint32_t tx_good_frames;
+    uint32_t tx_collisions;
+    uint32_t tx_aborted_errors;
+
+    uint32_t cmd_p;
     int ca;
     int ca_active;
     int send_irq;
 
-    /* Hash register (multicast mask array, multiple individual addresses). */
     uint8_t mult[8];
-    uint8_t config[14]; /* config bytes from CONFIGURE command */
+    uint8_t config[14];
 
-    uint8_t tx_buffer[0x4000];
+    uint32_t crc_err;
+    uint32_t align_err;
+    uint32_t resource_err;
+    uint32_t over_err;
+    uint32_t rcvdt_err;
+    uint32_t short_fr_error;
+    uint32_t total_frames;
+    uint32_t total_good_frames;
+
+    uint8_t tx_buffer[PKT_BUF_SZ];
+    uint8_t rx_buffer[PKT_BUF_SZ];
+    uint16_t tx_frame_len;
+    uint16_t rx_frame_len;
+
+    hwaddr current_tx_desc;
+    hwaddr current_rx_desc;
+    uint32_t last_good_rfa;
+    uint8_t packet_queue[PACKET_QUEUE_SIZE][PKT_BUF_SZ];
+    size_t packet_queue_len[PACKET_QUEUE_SIZE];
+    int queue_head;
+    int queue_tail;
+    int queue_count;
+    bool rnr_signaled;
+    bool flushing_queue;
 };
 
 void i82596_h_reset(void *opaque);
 void i82596_ioport_writew(void *opaque, uint32_t addr, uint32_t val);
 uint32_t i82596_ioport_readw(void *opaque, uint32_t addr);
-void i82596_ioport_writel(void *opaque, uint32_t addr, uint32_t val);
-uint32_t i82596_ioport_readl(void *opaque, uint32_t addr);
-uint32_t i82596_bcr_readw(I82596State *s, uint32_t rap);
 ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t size_);
+ssize_t i82596_receive_iov(NetClientState *nc, const struct iovec *iov,
+                           int iovcnt);
 bool i82596_can_receive(NetClientState *nc);
 void i82596_set_link_status(NetClientState *nc);
-void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info);
+void i82596_poll(NetClientState *nc, bool enable);
+void i82596_common_init(DeviceState *dev, I82596State *s,
+                        NetClientInfo *info);
 extern const VMStateDescription vmstate_i82596;
 #endif
diff --git a/hw/net/lasi_i82596.c b/hw/net/lasi_i82596.c
index b87cea411a..2f212a7ed3 100644
--- a/hw/net/lasi_i82596.c
+++ b/hw/net/lasi_i82596.c
@@ -86,6 +86,10 @@ static const MemoryRegionOps lasi_82596_mem_ops = {
         .min_access_size = 4,
         .max_access_size = 4,
     },
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
 };
 
 static NetClientInfo net_lasi_82596_info = {
@@ -93,6 +97,8 @@ static NetClientInfo net_lasi_82596_info = {
     .size = sizeof(NICState),
     .can_receive = i82596_can_receive,
     .receive = i82596_receive,
+    .receive_iov = i82596_receive_iov,
+    .poll = i82596_poll,
     .link_status_changed = i82596_set_link_status,
 };
 

From fec69f17be25db71f9cd4001b920da21cc71b283 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Mon, 3 Nov 2025 16:57:23 +0530
Subject: [PATCH 2028/2396] i82596: Implement enhanced TX/RX with packet
 queuing and filtering

In this patch I have added the following:
- Rewrote transmit path with CSMA/CD collision handling and retry logic
- Implemented flexible TX buffer descriptor (TBD) chain processing
- Rewrote receive path with packet filtering and monitor mode support
- Added RX packet queue for handling resource exhaustion
- Implemented queue flush timer and management
- Added RX state machine with proper state transitions
- Implemented packet filtering (unicast, broadcast, multicast, promiscuous)
- Added SCB RU_START enhancement to find usable RFDs
- Implemented dump command support
- Added bus throttle timer loading (LOAD_THROTTLE/LOAD_START commands)
- Enhanced signal_ca with proper initialization sequence
- Finally, adding self-test functionality

Note:
With this patch, and the previous ones in the patch series, we are able
to achive proper 82596 NIC emulation.

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Tested-by: Helge Deller <deller@gmx.de>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/net/i82596.c     | 1932 ++++++++++++++++++++++++++++++++-----------
 hw/net/trace-events |   21 +-
 2 files changed, 1448 insertions(+), 505 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index 859cc88b2e..37dcc0387b 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -49,14 +49,6 @@
 #include "i82596.h"
 #include <zlib.h> /* for crc32 */
 
-#define ENABLE_DEBUG 0
-
-#if defined(ENABLE_DEBUG)
-#define DBG(x)          x
-#else
-#define DBG(x)          do { } while (0)
-#endif
-
 #define USE_TIMER       1
 
 #define MAX_MC_CNT      64
@@ -274,6 +266,10 @@ struct qemu_ether_header {
 };
 
 #define PRINT_PKTHDR(txt, BUF) do {                  \
+    struct qemu_ether_header *hdr = (void *)(BUF); \
+    printf(txt ": packet dhost=" MAC_FMT ", shost=" MAC_FMT ", type=0x%04x\n",\
+           MAC_ARG(hdr->ether_dhost), MAC_ARG(hdr->ether_shost),        \
+           be16_to_cpu(hdr->ether_type));       \
 } while (0)
 
 static void i82596_cleanup(I82596State *s)
@@ -324,18 +320,26 @@ static void i82596_s_reset(I82596State *s)
     s->last_tx_len = 0;
 
     s->last_good_rfa = 0;
-    s->current_rx_desc = 0;
-    s->current_tx_desc = 0;
-    s->tx_retry_addr = 0;
-    s->tx_retry_count = 0;
+    s->queue_head = 0;
+    s->queue_tail = 0;
+    s->queue_count = 0;
 
-    s->rnr_signaled = false;
-    s->flushing_queue = false;
+    s->t_on = 0xFFFF;
+    s->t_off = 0;
+    s->throttle_state = true;
 
-    memset(s->tx_buffer, 0, sizeof(s->tx_buffer));
-    memset(s->rx_buffer, 0, sizeof(s->rx_buffer));
-    s->tx_frame_len = 0;
-    s->rx_frame_len = 0;
+    if (!s->throttle_timer) {
+        s->throttle_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,
+                                       i82596_bus_throttle_timer, s);
+    } else {
+        timer_del(s->throttle_timer);
+    }
+
+    if (!I596_FULL_DUPLEX && s->t_on != 0xFFFF) {
+        timer_mod(s->throttle_timer,
+                 qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                 s->t_on * NANOSECONDS_PER_MICROSECOND);
+    }
 }
 
 void i82596_h_reset(void *opaque)
@@ -346,82 +350,918 @@ void i82596_h_reset(void *opaque)
 }
 
 /*
- * Address Translation Implementation
- * Handles segmented and linear memory modes for i82596.
- * Returns physical address for DMA operations.
- * Returns I596_NULL (0xffffffff) on invalid addresses.
+ * Mode Transition of address functionality.
+ * Note: As of now the 82596 is tested only for Linear Mode as it is most
+ * widely used by Linux and HPUX systems. This function is here for
+ * futureproofing our 82596 device model.
+ * According to the documentation the translation of addresses based on mode
+ * are done for the following cases: ISCP, SCB, CBP, RFD, TFD,
+ * RBD, TBD, Rx Buffers, Tx Buffers
+ * Please refer to the documentation for more details.
  */
-static inline uint32_t i82596_translate_address(I82596State *s,
-                                                 uint32_t logical_addr,
-                                                 bool is_data_buffer)
+static uint32_t i82596_translate_address(I82596State *s,
+                                         uint32_t addr,
+                                         bool is_data_buffer)
 {
-    if (logical_addr == I596_NULL || logical_addr == 0) {
-        return logical_addr;
+    if (addr == I596_NULL || addr == 0) {
+        return addr;
     }
-
     switch (s->mode) {
-    case I82596_MODE_LINEAR:
-        return logical_addr;
-
-    case I82596_MODE_SEGMENTED: {
-        uint32_t base = (logical_addr >> 16) & 0xFFFF;
-        uint32_t offset = logical_addr & 0xFFFF;
-
-        if (is_data_buffer) {
-            return (base << 4) + offset;
-        } else {
-            if (base == 0xFFFF && offset == 0xFFFF) {
-                return I596_NULL;
-            }
-            return s->scb_base + ((base << 4) + offset);
-        }
-    }
-
     case I82586_MODE:
-    default:
         if (is_data_buffer) {
-            return logical_addr;
+            return addr & 0x00FFFFFF;
         } else {
-            if ((logical_addr & 0xFFFF0000) == 0xFFFF0000) {
-                return I596_NULL;
+            if (s->scb_base) {
+                return (s->scb_base & 0x00FFFFFF) + (addr & 0xFFFF);
+            } else {
+                return addr & 0x00FFFFFF;
             }
-            return s->scb_base + logical_addr;
+        }
+        break;
+    case I82596_MODE_SEGMENTED:
+        if (is_data_buffer) {
+            return addr;
+        } else {
+            if (s->scb_base) {
+                return s->scb_base + (addr & 0xFFFF);
+            } else {
+                return addr;
+            }
+        }
+        break;
+    case I82596_MODE_LINEAR:
+    default:
+        return addr;
+    }
+}
+
+/* (TFD) Transmit Frame Descriptor  */
+struct i82596_tx_descriptor {
+    uint16_t status_bits;
+    uint16_t command;
+    uint32_t link_addr;
+    uint32_t tbd_addr;
+    uint16_t tcb_count;
+    uint8_t  dest_addr[6];
+    uint16_t length_field;
+};
+
+/* (TBD) Transmit Buffer Descriptor */
+struct i82596_tx_buffer_desc {
+    uint16_t size;
+    uint32_t link;
+    uint32_t buffer;
+};
+
+/* (RFD) Receive Frame Descriptor  */
+struct i82596_rx_descriptor {
+    uint16_t status_bits;
+    uint16_t command;
+    uint32_t link;
+    uint32_t rbd_addr;
+    uint16_t actual_count;
+    uint16_t size;
+    uint8_t  dest_addr[6];
+    uint8_t  src_addr[6];
+    uint16_t length_field;
+};
+
+/* (RBD) Receive Buffer Descriptor */
+struct i82596_rx_buffer_desc {
+    uint16_t actual_count;
+    uint32_t next_rbd_addr;
+    uint32_t buffer_addr;
+    uint16_t size;
+};
+
+static void i82596_tx_tfd_read(I82596State *s, hwaddr addr,
+                                struct i82596_tx_descriptor *desc)
+{
+    desc->status_bits = get_uint16(addr + 0);
+    desc->command = get_uint16(addr + 2);
+    desc->link_addr = get_uint32(addr + 4);
+    desc->tbd_addr = get_uint32(addr + 8);
+    desc->tcb_count = get_uint16(addr + 12);
+    address_space_read(&address_space_memory, addr + 14,
+                      MEMTXATTRS_UNSPECIFIED, desc->dest_addr, 6);
+    desc->length_field = get_uint16(addr + 20);
+}
+
+static void i82596_tx_tfd_write(I82596State *s, hwaddr addr,
+                                 struct i82596_tx_descriptor *desc)
+{
+    set_uint16(addr + 0, desc->status_bits);
+    set_uint16(addr + 2, desc->command);
+    set_uint32(addr + 4, desc->link_addr);
+    set_uint32(addr + 8, desc->tbd_addr);
+    set_uint16(addr + 12, desc->tcb_count);
+    address_space_write(&address_space_memory, addr + 14,
+                       MEMTXATTRS_UNSPECIFIED, desc->dest_addr, 6);
+    set_uint16(addr + 20, desc->length_field);
+}
+
+static void i82596_tbd_read(I82596State *s, hwaddr addr,
+                            struct i82596_tx_buffer_desc *tbd)
+{
+    tbd->size = get_uint16(addr + 0);
+    tbd->link = get_uint32(addr + 4);
+    tbd->buffer = get_uint32(addr + 8);
+}
+
+static void i82596_rx_rfd_read(I82596State *s, hwaddr addr,
+                                struct i82596_rx_descriptor *desc)
+{
+    desc->status_bits = get_uint16(addr + 0x0);
+    desc->command = get_uint16(addr + 0x2);
+    desc->link = get_uint32(addr + 0x4);
+    desc->rbd_addr = get_uint32(addr + 0x8);
+    desc->actual_count = get_uint16(addr + 0xC);
+    desc->size = get_uint16(addr + 0xE);
+
+    address_space_read(&address_space_memory, addr + 0x10,
+                      MEMTXATTRS_UNSPECIFIED, desc->dest_addr, 6);
+    address_space_read(&address_space_memory, addr + 0x16,
+                      MEMTXATTRS_UNSPECIFIED, desc->src_addr, 6);
+    desc->length_field = get_uint16(addr + 28);
+}
+
+static void i82596_rx_desc_write(I82596State *s, hwaddr addr,
+                                  struct i82596_rx_descriptor *desc,
+                                  bool write_full)
+{
+    set_uint16(addr + 0x0, desc->status_bits);
+    set_uint16(addr + 0xC, desc->actual_count);
+
+    if (write_full) {
+        set_uint16(addr + 0x2, desc->command);
+        set_uint32(addr + 0x4, desc->link);
+        set_uint32(addr + 0x8, desc->rbd_addr);
+        set_uint16(addr + 0xE, desc->size);
+
+        address_space_write(&address_space_memory, addr + 0x10,
+                          MEMTXATTRS_UNSPECIFIED, desc->dest_addr, 6);
+        address_space_write(&address_space_memory, addr + 0x16,
+                          MEMTXATTRS_UNSPECIFIED, desc->src_addr, 6);
+        set_uint16(addr + 0x1C, desc->length_field);
+    }
+}
+
+static void i82596_rbd_read(I82596State *s, hwaddr addr,
+                            struct i82596_rx_buffer_desc *rbd)
+{
+    rbd->actual_count = get_uint16(addr + 0x0);
+    rbd->next_rbd_addr = get_uint32(addr + 0x4);
+    rbd->buffer_addr = get_uint32(addr + 0x8);
+    rbd->size = get_uint16(addr + 0xC);
+}
+
+static void i82596_rbd_write(I82596State *s, hwaddr addr,
+                             struct i82596_rx_buffer_desc *rbd)
+{
+    set_uint16(addr + 0x0, rbd->actual_count);
+    set_uint32(addr + 0x4, rbd->next_rbd_addr);
+    set_uint32(addr + 0x8, rbd->buffer_addr);
+    set_uint16(addr + 0xC, rbd->size);
+}
+
+static int i82596_tx_copy_buffers(I82596State *s, hwaddr tfd_addr,
+                                  struct i82596_tx_descriptor *desc)
+{
+    bool simplified_mode = !(desc->command & CMD_FLEX);
+    uint32_t total_len = 0;
+    uint32_t tbd_addr;
+    struct i82596_tx_buffer_desc tbd;
+
+    s->tx_frame_len = 0;
+
+    if (simplified_mode) {
+        uint16_t frame_len = desc->tcb_count & SIZE_MASK;
+        if (frame_len == 0 || frame_len > sizeof(s->tx_buffer)) {
+            return -1;
+        }
+        address_space_read(&address_space_memory, tfd_addr + 16,
+                          MEMTXATTRS_UNSPECIFIED, s->tx_buffer, frame_len);
+        total_len = frame_len;
+
+    } else {
+        tbd_addr = desc->tbd_addr;
+        while (tbd_addr != I596_NULL && tbd_addr != 0) {
+            uint16_t buf_size;
+            uint32_t buf_addr;
+            tbd_addr = i82596_translate_address(s, tbd_addr, false);
+            if (tbd_addr == 0 || tbd_addr == I596_NULL) {
+                return -1;
+            }
+            i82596_tbd_read(s, tbd_addr, &tbd);
+            trace_i82596_tx_tbd(tbd_addr, tbd.size, tbd.buffer);
+            buf_size = tbd.size & SIZE_MASK;
+            buf_addr = i82596_translate_address(s, tbd.buffer, true);
+
+            if (total_len + buf_size > sizeof(s->tx_buffer)) {
+                return -1;
+            }
+
+            if (buf_size > 0 && buf_addr != 0 && buf_addr != I596_NULL) {
+                address_space_read(&address_space_memory, buf_addr,
+                                  MEMTXATTRS_UNSPECIFIED,
+                                  s->tx_buffer + total_len, buf_size);
+                total_len += buf_size;
+            }
+            if (tbd.size & I596_EOF) {
+                break;
+            }
+            tbd_addr = tbd.link;
         }
     }
+
+    s->tx_frame_len = total_len;
+    return total_len;
+}
+
+static int i82596_tx_process_frame(I82596State *s, bool insert_crc)
+{
+    uint32_t total_len = s->tx_frame_len;
+
+    if (total_len == 0) {
+        return 0;
+    }
+
+    if (I596_NO_SRC_ADD_IN == 0 && total_len >= ETH_ALEN * 2) {
+        memcpy(&s->tx_buffer[ETH_ALEN], s->conf.macaddr.a, ETH_ALEN);
+    }
+
+    if (I596_PADDING && total_len < I596_MIN_FRAME_LEN) {
+        size_t pad_len = I596_MIN_FRAME_LEN - total_len;
+        memset(s->tx_buffer + total_len, 0, pad_len);
+        total_len = I596_MIN_FRAME_LEN;
+    }
+
+    if (insert_crc) {
+        total_len = i82596_append_crc(s, s->tx_buffer, total_len);
+    }
+
+    s->tx_frame_len = total_len;
+    return total_len;
+}
+
+static void i82596_tx_update_status(I82596State *s, hwaddr tfd_addr,
+                                    struct i82596_tx_descriptor *desc,
+                                    uint16_t tx_status,
+                                    uint16_t collision_count,
+                                    bool success)
+{
+    desc->status_bits = STAT_C;
+
+    if (success) {
+        desc->status_bits |= STAT_OK;
+    } else {
+        desc->status_bits |= STAT_A;
+    }
+
+    if (collision_count > 0) {
+        desc->status_bits |= (collision_count & 0x0F);
+    }
+
+    i82596_tx_tfd_write(s, tfd_addr, desc);
+}
+
+static int i82596_tx_csma_cd(I82596State *s, uint16_t *tx_status)
+{
+    int retry_count = 0;
+    bool medium_available;
+
+    if (I596_FULL_DUPLEX || I596_LOOPBACK) {
+        return 0;
+    }
+
+    while (retry_count < CSMA_MAX_RETRIES) {
+        medium_available = i82596_check_medium_status(s);
+
+        if (medium_available) {
+            break;
+        }
+        i82596_csma_backoff(s, retry_count);
+        retry_count++;
+        s->total_collisions++;
+    }
+    if (retry_count >= CSMA_MAX_RETRIES) {
+        *tx_status |= TX_ABORTED_ERRORS;
+        return -1;
+    }
+    if (retry_count > 0) {
+        *tx_status |= TX_COLLISIONS;
+        s->collision_events++;
+    }
+
+    return retry_count;
 }
 
 static void i82596_transmit(I82596State *s, uint32_t addr)
 {
-    uint32_t tdb_p; /* Transmit Buffer Descriptor */
+    struct i82596_tx_descriptor tfd;
+    hwaddr tfd_addr = addr;
+    uint16_t tx_status = 0;
+    int collision_count = 0;
+    int frame_len;
+    bool success = true;
+    bool insert_crc;
 
-    /* TODO: Check flexible mode */
-    tdb_p = get_uint32(addr + 8);
-    while (tdb_p != I596_NULL) {
-        uint16_t size, len;
-        uint32_t tba;
+    i82596_tx_tfd_read(s, tfd_addr, &tfd);
+    trace_i82596_tx_tfd(tfd_addr, tfd.status_bits, tfd.command,
+                        tfd.link_addr, tfd.tbd_addr);
 
-        size = get_uint16(tdb_p);
-        len = size & SIZE_MASK;
-        tba = get_uint32(tdb_p + 8);
-        trace_i82596_transmit(len, tba);
+    s->current_tx_desc = tfd_addr;
+    insert_crc = (I596_NOCRC_INS == 0) && ((tfd.command & 0x10) == 0) &&
+                 !I596_LOOPBACK;
+    collision_count = i82596_tx_csma_cd(s, &tx_status);
+    if (collision_count < 0) {
+        success = false;
+        goto tx_complete;
+    }
+    frame_len = i82596_tx_copy_buffers(s, tfd_addr, &tfd);
+    if (frame_len < 0) {
+        tx_status |= TX_ABORTED_ERRORS;
+        success = false;
+        goto tx_complete;
+    }
+    frame_len = i82596_tx_process_frame(s, insert_crc);
+    if (frame_len <= 0) {
+        tx_status |= TX_ABORTED_ERRORS;
+        success = false;
+        goto tx_complete;
+    }
+    s->last_tx_len = frame_len;
+    trace_i82596_transmit(frame_len, addr);
 
-        if (s->nic && len) {
-            assert(len <= sizeof(s->tx_buffer));
-            address_space_read(&address_space_memory, tba,
-                               MEMTXATTRS_UNSPECIFIED, s->tx_buffer, len);
-            DBG(PRINT_PKTHDR("Send", &s->tx_buffer));
-            DBG(printf("Sending %d bytes\n", len));
-            qemu_send_packet(qemu_get_queue(s->nic), s->tx_buffer, len);
+    if (I596_LOOPBACK) {
+        i82596_receive(qemu_get_queue(s->nic), s->tx_buffer, frame_len);
+    } else {
+        if (s->nic) {
+            qemu_send_packet_raw(qemu_get_queue(s->nic), s->tx_buffer,
+                                 frame_len);
+        }
+    }
+
+tx_complete:
+    i82596_tx_update_status(s, tfd_addr, &tfd, tx_status, collision_count,
+                            success);
+    i82596_update_statistics(s, true, tx_status, collision_count);
+    if (tfd.command & CMD_INTR) {
+        i82596_update_cu_status(s, tfd.status_bits, true);
+    }
+}
+
+bool i82596_can_receive(NetClientState *nc)
+{
+    I82596State *s = qemu_get_nic_opaque(nc);
+
+    if (I596_LOOPBACK || !s->lnkst) {
+        return false;
+    }
+
+    if (s->rx_status == RX_SUSPENDED || s->rx_status == RX_IDLE ||
+        s->rx_status == RX_NO_RESOURCES) {
+        return true;
+    }
+
+    if (!s->throttle_state && !I596_FULL_DUPLEX) {
+        return (s->queue_count < PACKET_QUEUE_SIZE);
+    }
+
+    return true;
+}
+
+static int i82596_validate_receive_state(I82596State *s, size_t *sz,
+                                          bool from_queue)
+{
+    if (*sz < 14 || *sz > PKT_BUF_SZ - 4) {
+        trace_i82596_receive_analysis(">>> Packet size invalid");
+        return -1;
+    }
+
+    if (!from_queue && s->rx_status == RX_SUSPENDED) {
+        trace_i82596_receive_analysis(">>> Receiving is suspended");
+        return -1;
+    }
+
+    if (s->rx_status != RX_READY && s->rx_status != RX_SUSPENDED) {
+        trace_i82596_receive_analysis(">>> RU not ready");
+        return -1;
+    }
+
+    if (!s->lnkst) {
+        trace_i82596_receive_analysis(">>> Link is down");
+        return -1;
+    }
+
+    return 1;
+}
+
+static bool i82596_check_packet_filter(I82596State *s, const uint8_t *buf,
+                                        uint16_t *is_broadcast)
+{
+    static const uint8_t broadcast_macaddr[6] = {
+        0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+
+    if (I596_PROMISC || I596_LOOPBACK) {
+        trace_i82596_receive_analysis(
+            ">>> packet received in promiscuous mode");
+        return true;
+    } else {
+        if (!memcmp(buf, broadcast_macaddr, 6)) {
+            /* broadcast address */
+            if (I596_BC_DISABLE) {
+                trace_i82596_receive_analysis(">>> broadcast packet rejected");
+                return false;
+            }
+            trace_i82596_receive_analysis(">>> broadcast packet received");
+            *is_broadcast = 1;
+            return true;
+        } else if (buf[0] & 0x01) {
+            /* multicast */
+            if (!I596_MC_ALL) {
+                trace_i82596_receive_analysis(">>> multicast packet rejected");
+                return false;
+            }
+
+            int mcast_idx = (net_crc32(buf, ETH_ALEN) & BITS(7, 2)) >> 2;
+            assert(mcast_idx < 8 * sizeof(s->mult));
+
+            if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7)))) {
+                trace_i82596_receive_analysis(">>> multicast address mismatch");
+                return false;
+            }
+
+            trace_i82596_receive_analysis(">>> multicast packet received");
+            *is_broadcast = 1;
+            return true;
+        } else if (!memcmp(s->conf.macaddr.a, buf, 6)) {
+            /* match */
+            trace_i82596_receive_analysis(
+                ">>> physical address matching packet received");
+            return true;
+        } else {
+            trace_i82596_receive_analysis(">>> unknown packet");
+            return false;
+        }
+    }
+}
+
+/* MONITOR MODE */
+static bool i82596_monitor(I82596State *s, const uint8_t *buf, size_t sz,
+                           bool packet_passes_filter)
+{
+    if (I596_MONITOR_MODE == MONITOR_DISABLED) {
+        return true;
+    }
+    if (sz < I596_MIN_FRAME_LEN) {
+        s->short_fr_error++;
+    }
+    if ((sz % 2) != 0) {
+        s->align_err++;
+    }
+
+    switch (I596_MONITOR_MODE) {
+    case MONITOR_NORMAL: /* No monitor, just add to total frames */
+        if (packet_passes_filter) {
+            s->total_good_frames++;
+            return true;
+        } else {
+            return false;
+        }
+        break;
+    case MONITOR_FILTERED: /* Monitor only filtered packets */
+        s->total_frames++;
+        if (packet_passes_filter) {
+            s->total_good_frames++;
+        }
+        return false;
+    case MONITOR_ALL: /* Monitor all packets */
+        s->total_frames++;
+        if (packet_passes_filter) {
+            s->total_good_frames++;
+        }
+        return false;
+
+    default:
+        return true;
+    }
+}
+
+static void i82596_update_rx_state(I82596State *s, int new_state)
+{
+    if (s->rx_status != new_state) {
+        trace_i82596_rx_state_change(s->rx_status, new_state);
+    }
+
+    s->rx_status = new_state;
+
+    switch (new_state) {
+    case RX_NO_RESOURCES:
+        if (!s->rnr_signaled) {
+            s->scb_status |= SCB_STATUS_RNR;
+            s->rnr_signaled = true;
+        }
+        break;
+    case RX_SUSPENDED:
+        if (!s->rnr_signaled) {
+            s->scb_status |= SCB_STATUS_RNR;
+            s->rnr_signaled = true;
         }
 
-        /* was this the last package? */
-        if (size & I596_EOF) {
+        if (s->queue_count > 0 && !s->flushing_queue) {
+            i82596_flush_packet_queue(s);
+            if (s->queue_count > 0) {
+                timer_mod(s->flush_queue_timer,
+                          qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000);
+            }
+        }
+        break;
+    case RX_READY:
+        /* When RU becomes ready, flush buffered packets */
+        if (s->queue_count > 0) {
+            i82596_flush_packet_queue(s);
+        }
+        break;
+    default:
+        break;
+    }
+}
+
+static void i82596_rx_store_frame_header(I82596State *s,
+                                         struct i82596_rx_descriptor *rfd,
+                                         const uint8_t *buf, size_t size)
+{
+    memcpy(rfd->dest_addr, buf, 6);
+    if (size >= 12) {
+        memcpy(rfd->src_addr, buf + 6, 6);
+    }
+    if (size >= 14) {
+        rfd->length_field = (buf[12] << 8) | buf[13];
+    }
+}
+
+static size_t i82596_rx_copy_to_rfd(I82596State *s, hwaddr rfd_addr,
+                                    const uint8_t *buf, size_t size,
+                                    size_t rfd_size)
+{
+    size_t to_copy = MIN(size, rfd_size);
+    size_t data_offset = 0x1E; /* Bypassing the header */
+
+    if (to_copy > 0) {
+        address_space_write(&address_space_memory, rfd_addr + data_offset,
+                           MEMTXATTRS_UNSPECIFIED, buf, to_copy);
+    }
+    return to_copy;
+}
+
+static size_t i82596_rx_copy_to_rbds(I82596State *s, hwaddr rbd_addr,
+                                     const uint8_t *buf, size_t size,
+                                     bool *out_of_resources,
+                                     hwaddr *remaining_rbd)
+{
+    size_t bytes_copied = 0;
+    hwaddr current_rbd = rbd_addr;
+    *out_of_resources = false;
+    *remaining_rbd = I596_NULL;
+
+    while (bytes_copied < size && current_rbd != I596_NULL &&
+           current_rbd != 0) {
+        struct i82596_rx_buffer_desc rbd;
+        i82596_rbd_read(s, current_rbd, &rbd);
+        trace_i82596_rx_rbd(current_rbd, rbd.actual_count, rbd.buffer_addr,
+                            rbd.size);
+        if (rbd.size & 0x4000) {  /* P bit set */
             break;
         }
 
-        /* get next buffer pointer */
-        tdb_p = get_uint32(tdb_p + 4);
+        uint16_t buf_size = rbd.size & 0x3FFF;
+
+        if (buf_size == 0) {
+            current_rbd = i82596_translate_address(s, rbd.next_rbd_addr, false);
+            continue;
+        }
+
+        hwaddr buf_addr = i82596_translate_address(s, rbd.buffer_addr, true);
+        if (buf_addr == 0 || buf_addr == I596_NULL) {
+            *out_of_resources = true;
+            break;
+        }
+        size_t remaining = size - bytes_copied;
+        size_t to_copy = MIN(remaining, buf_size);
+        if (to_copy > 0) {
+            address_space_write(&address_space_memory, buf_addr,
+                               MEMTXATTRS_UNSPECIFIED,
+                               buf + bytes_copied, to_copy);
+            bytes_copied += to_copy;
+        }
+        rbd.actual_count = to_copy | 0x4000;  /* Set F (filled) bit */
+        if (bytes_copied >= size) {
+            rbd.actual_count |= 0x8000;  /* Set EOF bit (bit 15) */
+        }
+        i82596_rbd_write(s, current_rbd, &rbd);
+        if (rbd.size & CMD_EOL) {  /* EL bit */
+            if (bytes_copied < size) {
+                *out_of_resources = true;
+            }
+            current_rbd = I596_NULL;
+            break;
+        }
+        current_rbd = i82596_translate_address(s, rbd.next_rbd_addr, false);
     }
+
+    *remaining_rbd = current_rbd;
+    return bytes_copied;
+}
+
+static inline size_t i82596_get_crc_size(I82596State *s)
+{
+    return I596_CRC16_32 ? 4 : 2;
+}
+
+static ssize_t i82596_receive_packet(I82596State *s, const uint8_t *buf,
+                                      size_t size, bool from_queue)
+{
+    struct i82596_rx_descriptor rfd;
+    uint32_t rfd_addr, rbd_addr;
+    uint16_t rx_status = 0;
+    uint16_t is_broadcast = 0;
+    bool packet_completed = true;
+    bool simplified_mode = false;
+    size_t frame_size = size;
+    size_t payload_size = 0;
+    size_t bytes_copied = 0;
+    const uint8_t *packet_data = buf;
+    bool crc_valid = true;
+    bool out_of_resources = false;
+    size_t crc_size = i82596_get_crc_size(s);
+
+    trace_i82596_receive_packet(buf, size);
+
+    if (i82596_validate_receive_state(s, &size, from_queue) < 0) {
+        return -1;
+    }
+
+    bool passes_filter = i82596_check_packet_filter(s, buf, &is_broadcast);
+
+    if (!i82596_monitor(s, buf, size, passes_filter) && (!passes_filter)) {
+        return size;
+    }
+
+
+    rfd_addr = get_uint32(s->scb + 8);
+
+    if (rfd_addr == 0 || rfd_addr == I596_NULL) {
+        i82596_update_rx_state(s, RX_NO_RESOURCES);
+        s->resource_err++;
+        set_uint16(s->scb, get_uint16(s->scb) | SCB_STATUS_RNR);
+        i82596_update_scb_irq(s, true);
+        return -1;
+    }
+
+    i82596_rx_rfd_read(s, rfd_addr, &rfd);
+    trace_i82596_rx_rfd(rfd_addr, rfd.status_bits, rfd.command,
+                        rfd.link, rfd.rbd_addr);
+
+    s->current_rx_desc = rfd_addr;
+
+    if (rfd.status_bits & STAT_C) {
+        return -1;
+    }
+
+    /* 0: Simplified Mode 1: Flexible Mode */
+    simplified_mode = !(rfd.command & CMD_FLEX);
+
+    set_uint16(rfd_addr, STAT_B);
+
+    if (frame_size < 14) {
+        trace_i82596_rx_short_frame(frame_size);
+        rx_status |= RX_LENGTH_ERRORS;
+        i82596_record_error(s, RX_LENGTH_ERRORS, false);
+        s->short_fr_error++;
+        packet_completed = false;
+        goto rx_complete;
+    }
+
+    payload_size = frame_size;
+    do {
+        if (simplified_mode && I596_LOOPBACK) {
+            uint16_t rfd_size = rfd.size & 0x3FFF;
+
+            if (rfd_size % 2 != 0) {
+                rx_status |= RX_LENGTH_ERRORS;
+                i82596_record_error(s, RX_LENGTH_ERRORS, false);
+                s->align_err++;
+                packet_completed = false;
+                goto rx_complete;
+            }
+
+            if (payload_size > rfd_size) {
+                rx_status |= RFD_STATUS_TRUNC;
+                payload_size = rfd_size;
+                packet_completed = !SAVE_BAD_FRAMES ? false : true;
+            }
+
+            if (payload_size > 0) {
+                bytes_copied = i82596_rx_copy_to_rfd(s, rfd_addr, packet_data,
+                                                      payload_size, rfd_size);
+            }
+
+            i82596_rx_store_frame_header(s, &rfd, packet_data, frame_size);
+
+        } else {
+            uint16_t rfd_size = rfd.size & 0x3FFF; /* SIZE_MASK */
+            size_t rfd_frame_size = 0;
+            size_t remaining_to_copy = payload_size - bytes_copied;
+            if (rfd_size > 0 && remaining_to_copy > 0) {
+                size_t data_offset = 0x10;
+
+                rfd_frame_size = MIN(remaining_to_copy, rfd_size);
+                address_space_write(&address_space_memory,
+                                    rfd_addr + data_offset,
+                                    MEMTXATTRS_UNSPECIFIED,
+                                    packet_data + bytes_copied,
+                                    rfd_frame_size);
+                bytes_copied += rfd_frame_size;
+            }
+
+            if (bytes_copied < payload_size) {
+                size_t remaining = payload_size - bytes_copied;
+                rbd_addr = i82596_translate_address(s, rfd.rbd_addr, false);
+
+                if (rbd_addr == I596_NULL || rbd_addr == 0) {
+                    rx_status |= RFD_STATUS_TRUNC | RFD_STATUS_NOBUFS;
+                    i82596_record_error(s, RFD_STATUS_NOBUFS, false);
+                    packet_completed = true;
+                } else {
+                    hwaddr remaining_rbd = I596_NULL;
+                    size_t rbd_bytes = i82596_rx_copy_to_rbds(
+                                            s, rbd_addr,
+                                            packet_data + bytes_copied,
+                                            remaining,
+                                            &out_of_resources,
+                                            &remaining_rbd);
+                    bytes_copied += rbd_bytes;
+
+                    uint32_t next_rfd = i82596_translate_address(s, rfd.link,
+                                                                  false);
+                    if (next_rfd != I596_NULL && next_rfd != 0) {
+                        if (remaining_rbd != I596_NULL && remaining_rbd != 0) {
+                            trace_i82596_rx_rfd_update(next_rfd, remaining_rbd);
+                            set_uint32(next_rfd + 8, remaining_rbd);
+                        } else {
+                            set_uint32(next_rfd + 8, I596_NULL);
+                        }
+                    }
+
+                    if (out_of_resources) {
+                        trace_i82596_rx_out_of_rbds();
+                        i82596_record_error(s, RFD_STATUS_NOBUFS, false);
+                        rx_status |= RFD_STATUS_TRUNC | RFD_STATUS_NOBUFS;
+                        packet_completed = true;
+                    }
+
+                    if (bytes_copied < payload_size) {
+                        trace_i82596_rx_incomplete(bytes_copied, payload_size);
+                        rx_status |= RFD_STATUS_TRUNC;
+                        packet_completed = true;
+                    }
+                }
+            }
+        }
+        break;
+
+    } while (bytes_copied < payload_size);
+
+rx_complete:
+    if (I596_CRCINM && !I596_LOOPBACK && packet_completed) {
+        uint8_t crc_data[4];
+        size_t crc_len = crc_size;
+
+        if (I596_CRC16_32) {
+            uint32_t crc = crc32(~0, packet_data, frame_size);
+            crc = cpu_to_be32(crc);
+            memcpy(crc_data, &crc, 4);
+        } else {
+            uint16_t crc = i82596_calculate_crc16(packet_data, frame_size);
+            crc = cpu_to_be16(crc);
+            memcpy(crc_data, &crc, 2);
+        }
+
+        if (simplified_mode) {
+            address_space_write(&address_space_memory,
+                                rfd_addr + 0x1E + bytes_copied,
+                                MEMTXATTRS_UNSPECIFIED, crc_data, crc_len);
+        }
+    }
+
+    if (packet_completed && crc_valid) {
+        rx_status |= STAT_C | STAT_OK;
+        if (is_broadcast) {
+            rx_status |= 0x0001;
+        }
+    } else if (packet_completed) {
+        rx_status |= STAT_C;
+        if (!crc_valid) {
+            rx_status |= RX_CRC_ERRORS;
+        }
+    } else {
+        rx_status |= STAT_B;
+    }
+
+    rfd.status_bits = rx_status & ~STAT_B;
+    rfd.actual_count = (bytes_copied & 0x3FFF) | 0x4000;
+    if (packet_completed) {
+        rfd.actual_count |= I596_EOF;
+    }
+
+    i82596_rx_desc_write(s, rfd_addr, &rfd, (simplified_mode || I596_LOOPBACK));
+
+    if (rfd.command & CMD_SUSP) {
+        i82596_update_rx_state(s, RX_SUSPENDED);
+        return size;
+    }
+
+    if (rfd.command & CMD_EOL) {
+        i82596_update_rx_state(s, RX_SUSPENDED);
+        return size;
+    }
+
+    if (packet_completed && crc_valid && s->rx_status == RX_READY) {
+        uint32_t next_rfd_addr = i82596_translate_address(s, rfd.link, false);
+        if (next_rfd_addr != 0 && next_rfd_addr != I596_NULL) {
+            set_uint32(s->scb + 8, next_rfd_addr);
+        }
+
+        s->scb_status |= SCB_STATUS_FR;
+        i82596_update_scb_irq(s, true);
+    }
+    trace_i82596_rx_complete(s->crc_err, s->align_err, s->resource_err);
+    return size;
+}
+
+ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+{
+    I82596State *s = qemu_get_nic_opaque(nc);
+
+    if (!I596_FULL_DUPLEX && !s->throttle_state) {
+        if (s->queue_count < PACKET_QUEUE_SIZE) {
+            goto queue_packet;
+        }
+        trace_i82596_receive_suspended();
+        return size;
+    }
+
+    if (s->rx_status != RX_READY) {
+        if (s->queue_count >= PACKET_QUEUE_SIZE) {
+            trace_i82596_receive_queue_full();
+            s->over_err++;
+            set_uint32(s->scb + 22, s->over_err);
+            i82596_record_error(s, RX_OVER_ERRORS, false);
+            return size;
+        }
+queue_packet:
+        if (size <= PKT_BUF_SZ) {
+            memcpy(s->packet_queue[s->queue_head], buf, size);
+            s->packet_queue_len[s->queue_head] = size;
+            s->queue_head = (s->queue_head + 1) % PACKET_QUEUE_SIZE;
+            s->queue_count++;
+        }
+        return size;
+    }
+
+    return i82596_receive_packet(s, buf, size, false);
+}
+
+ssize_t i82596_receive_iov(NetClientState *nc, const struct iovec *iov,
+                            int iovcnt)
+{
+    size_t sz = 0;
+    uint8_t *buf;
+    int i;
+    for (i = 0; i < iovcnt; i++) {
+        sz += iov[i].iov_len;
+    }
+    trace_i82596_receive_iov(sz, iovcnt);
+    if (sz == 0) {
+        return -1;
+    }
+    buf = g_malloc(sz);
+    if (!buf) {
+        return -1;
+    }
+    size_t offset = 0;
+    for (i = 0; i < iovcnt; i++) {
+        if (iov[i].iov_base == NULL) {
+            g_free(buf);
+            return -1;
+        }
+        memcpy(buf + offset, iov[i].iov_base, iov[i].iov_len);
+        offset += iov[i].iov_len;
+    }
+    i82596_receive(nc, buf, sz);
+    g_free(buf);
+    return sz;
 }
 
 static void set_individual_address(I82596State *s, uint32_t addr)
@@ -437,26 +1277,6 @@ static void set_individual_address(I82596State *s, uint32_t addr)
     trace_i82596_new_mac(nc->info_str);
 }
 
-static void i82596_configure(I82596State *s, uint32_t addr)
-{
-    uint8_t byte_cnt;
-    byte_cnt = get_byte(addr + 8) & 0x0f;
-
-    byte_cnt = MAX(byte_cnt, 4);
-    byte_cnt = MIN(byte_cnt, sizeof(s->config));
-    /* copy byte_cnt max. */
-    address_space_read(&address_space_memory, addr + 8,
-                       MEMTXATTRS_UNSPECIFIED, s->config, byte_cnt);
-    /* config byte according to page 35ff */
-    s->config[2] &= 0x82; /* mask valid bits */
-    s->config[2] |= 0x40;
-    s->config[7]  &= 0xf7; /* clear zero bit */
-    assert(I596_NOCRC_INS == 0); /* do CRC insertion */
-    s->config[10] = MAX(s->config[10], 5); /* min frame length */
-    s->config[12] &= 0x40; /* only full duplex field valid */
-    s->config[13] |= 0x3f; /* set ones in byte 13 */
-}
-
 static void set_multicast_list(I82596State *s, uint32_t addr)
 {
     uint16_t mc_count, i;
@@ -471,8 +1291,6 @@ static void set_multicast_list(I82596State *s, uint32_t addr)
         uint8_t multicast_addr[ETH_ALEN];
         address_space_read(&address_space_memory, addr + i * ETH_ALEN,
                            MEMTXATTRS_UNSPECIFIED, multicast_addr, ETH_ALEN);
-        DBG(printf("Add multicast entry " MAC_FMT "\n",
-                    MAC_ARG(multicast_addr)));
         unsigned mcast_idx = (net_crc32(multicast_addr, ETH_ALEN) &
                               BITS(7, 2)) >> 2;
         assert(mcast_idx < 8 * sizeof(s->mult));
@@ -494,7 +1312,7 @@ void i82596_set_link_status(NetClientState *nc)
     }
 }
 
-static bool G_GNUC_UNUSED i82596_check_medium_status(I82596State *s)
+static bool i82596_check_medium_status(I82596State *s)
 {
     if (I596_FULL_DUPLEX) {
         return true;
@@ -512,7 +1330,7 @@ static bool G_GNUC_UNUSED i82596_check_medium_status(I82596State *s)
     return true;
 }
 
-static int G_GNUC_UNUSED i82596_csma_backoff(I82596State *s, int retry_count)
+static int i82596_csma_backoff(I82596State *s, int retry_count)
 {
     int backoff_factor, slot_count, backoff_time;
 
@@ -541,7 +1359,7 @@ static uint16_t i82596_calculate_crc16(const uint8_t *data, size_t len)
     return crc;
 }
 
-static size_t G_GNUC_UNUSED i82596_append_crc(I82596State *s, uint8_t *buffer, size_t len)
+static size_t i82596_append_crc(I82596State *s, uint8_t *buffer, size_t len)
 {
     if (len + 4 > PKT_BUF_SZ) {
         return len;
@@ -560,7 +1378,7 @@ static size_t G_GNUC_UNUSED i82596_append_crc(I82596State *s, uint8_t *buffer, s
     }
 }
 
-static void G_GNUC_UNUSED i82596_update_statistics(I82596State *s, bool is_tx,
+static void i82596_update_statistics(I82596State *s, bool is_tx,
                                       uint16_t error_flags,
                                       uint16_t collision_count)
 {
@@ -591,7 +1409,7 @@ static void G_GNUC_UNUSED i82596_update_statistics(I82596State *s, bool is_tx,
 }
 
 /* Bus Throttle Functionality */
-static void G_GNUC_UNUSED i82596_bus_throttle_timer(void *opaque)
+static void i82596_bus_throttle_timer(void *opaque)
 {
     I82596State *s = opaque;
 
@@ -600,42 +1418,210 @@ static void G_GNUC_UNUSED i82596_bus_throttle_timer(void *opaque)
         if (s->t_off > 0) {
             timer_mod(s->throttle_timer,
                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
-                      (s->t_off * NANOSECONDS_PER_MICROSECOND));
+                      s->t_off * NANOSECONDS_PER_MICROSECOND);
+        } else {
+            s->throttle_state = true;
         }
     } else {
         s->throttle_state = true;
-        if (s->t_on > 0) {
+        if (s->t_on > 0 && s->t_on != 0xFFFF) {
             timer_mod(s->throttle_timer,
                       qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
-                      (s->t_on * NANOSECONDS_PER_MICROSECOND));
-        }
-
-        if (s->cu_status == CU_ACTIVE || s->rx_status == RX_READY) {
-            examine_scb(s);
+                      s->t_on * NANOSECONDS_PER_MICROSECOND);
         }
     }
 }
 
-static int G_GNUC_UNUSED i82596_flush_packet_queue(I82596State *s)
+static void i82596_load_throttle_timers(I82596State *s, bool start_now)
 {
-    /* Stub for now - will be implemented in Patch 2 */
-    return 0;
+    uint16_t previous_t_on = s->t_on;
+    uint16_t previous_t_off = s->t_off;
+    s->t_on = get_uint16(s->scb + 36);
+    s->t_off = get_uint16(s->scb + 38);
+
+    bool values_changed = (s->t_on != previous_t_on ||
+                           s->t_off != previous_t_off);
+    if (start_now || (values_changed && s->throttle_timer)) {
+        timer_del(s->throttle_timer);
+        s->throttle_state = true;
+        if (s->t_on > 0 && s->t_on != 0xFFFF && !I596_FULL_DUPLEX) {
+            timer_mod(s->throttle_timer,
+                      qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+                      s->t_on * NANOSECONDS_PER_MICROSECOND);
+        }
+    }
 }
 
-static void G_GNUC_UNUSED i82596_flush_queue_timer(void *opaque)
+static void write_uint16(uint8_t *buffer, int offset, uint16_t value)
 {
-    /* Stub for now - will be implemented in Patch 2 */
+    buffer[offset] = value >> 8;
+    buffer[offset + 1] = value & 0xFF;
+}
+static void write_uint32(uint8_t *buffer, int offset, uint32_t value)
+{
+    write_uint16(buffer, offset, value >> 16);
+    write_uint16(buffer, offset + 2, value & 0xFFFF);
+}
+
+static void i82596_init_dump_area(I82596State *s, uint8_t *buffer)
+{
+    memset(buffer, 0, DUMP_BUF_SZ);
+
+    printf("This is the dump area function for i82596 QEMU side\n"
+            "If you are seeing this message, please contact:\n"
+            "Soumyajyotii Sarkar <soumyajyotisarkar23@gmail.com>\n"
+            "With the process in which you encountered this issue:\n"
+            "This still needs developement so,\n"
+            "I will be more than delighted to help you out!\n"
+        );
+
+    write_uint16(buffer, 0x00, (s->config[5] << 8) | s->config[4]);
+    write_uint16(buffer, 0x02, (s->config[3] << 8) | s->config[2]);
+    write_uint16(buffer, 0x04, (s->config[9] << 8) | s->config[8]);
+    write_uint16(buffer, 0x06, (s->config[7] << 8) | s->config[6]);
+    write_uint16(buffer, 0x08, (s->config[13] << 8) | s->config[12]);
+    write_uint16(buffer, 0x0A, (s->config[11] << 8) | s->config[10]);
+
+    buffer[0x0C] = s->conf.macaddr.a[0];
+    buffer[0x0D] = s->conf.macaddr.a[1];
+    buffer[0x10] = s->conf.macaddr.a[2];
+    buffer[0x11] = s->conf.macaddr.a[3];
+    buffer[0x12] = s->conf.macaddr.a[4];
+    buffer[0x13] = s->conf.macaddr.a[5];
+
+    if (s->last_tx_len > 0) {
+        uint32_t tx_crc = crc32(~0, s->tx_buffer, s->last_tx_len);
+        write_uint16(buffer, 0x14, tx_crc & 0xFFFF);
+        write_uint16(buffer, 0x16, tx_crc >> 16);
+    }
+
+    memcpy(&buffer[0x24], s->mult, sizeof(s->mult));
+
+    buffer[0xB0] = s->cu_status;
+    buffer[0xB1] = s->rx_status;
+
+    write_uint32(buffer, 0xB4, s->crc_err);
+    write_uint32(buffer, 0xB8, s->align_err);
+    write_uint32(buffer, 0xBC, s->resource_err);
+    write_uint32(buffer, 0xC0, s->over_err);
+
+    write_uint32(buffer, 0xC4, s->short_fr_error);
+    write_uint32(buffer, 0xC8, s->total_frames);
+    write_uint32(buffer, 0xCC, s->total_good_frames);
+
+    buffer[0xD0] = I596_PROMISC ? 1 : 0;
+    buffer[0xD1] = I596_BC_DISABLE ? 1 : 0;
+    buffer[0xD2] = I596_FULL_DUPLEX ? 1 : 0;
+    buffer[0xD3] = I596_LOOPBACK;
+
+    uint8_t mc_count = 0;
+    for (int i = 0; i < sizeof(s->mult); i++) {
+        uint8_t byte = s->mult[i];
+        while (byte) {
+            if (byte & 0x01) {
+                mc_count++;
+            }
+            byte >>= 1;
+        }
+    }
+    buffer[0xD4] = mc_count;
+    buffer[0xD5] = I596_NOCRC_INS ? 1 : 0;
+    buffer[0xD6] = I596_CRC16_32 ? 1 : 0;
+
+    write_uint16(buffer, 0xD8, s->lnkst);
+    buffer[0xDA] = I596_MONITOR_MODE;
+    write_uint32(buffer, 0xDC, s->collision_events);
+
+    write_uint16(buffer, 0x110, s->t_on);
+    write_uint16(buffer, 0x112, s->t_off);
+    write_uint16(buffer, 0x114, s->throttle_state ? 0x0001 : 0x0000);
+    write_uint16(buffer, 0x120, s->sysbus);
+    write_uint16(buffer, 0x128, s->scb_status);
+    write_uint32(buffer, 0, 0xFFFF0000);
+}
+
+static void i82596_port_dump(I82596State *s, uint32_t dump_addr)
+{
+    uint8_t dump_buffer[DUMP_BUF_SZ];
+
+    i82596_init_dump_area(s, dump_buffer);
+
+    address_space_write(&address_space_memory, dump_addr,
+                      MEMTXATTRS_UNSPECIFIED, dump_buffer, sizeof(dump_buffer));
+
+    set_uint32(dump_addr, 0xFFFF0000);
+    s->scb_status |= SCB_STATUS_CX;
+    s->send_irq = 1;
+}
+
+static void i82596_command_dump(I82596State *s, uint32_t cmd_addr)
+{
+    uint32_t dump_addr;
+    uint8_t dump_buffer[DUMP_BUF_SZ];
+    uint16_t cmd = get_uint16(cmd_addr + 2);
+    uint16_t status;
+
+    dump_addr = get_uint32(cmd_addr + 8);
+
+    i82596_init_dump_area(s, dump_buffer);
+    address_space_write(&address_space_memory, dump_addr,
+                      MEMTXATTRS_UNSPECIFIED, dump_buffer, sizeof(dump_buffer));
+    status = STAT_C | STAT_OK;
+    set_uint16(cmd_addr, status);
+    if (cmd & CMD_INTR) {
+        s->scb_status |= SCB_STATUS_CX;
+        s->send_irq = 1;
+    }
+    if (cmd & CMD_SUSP) {
+        s->cu_status = CU_SUSPENDED;
+        s->scb_status |= SCB_STATUS_CNA;
+    }
+}
+
+static void i82596_configure(I82596State *s, uint32_t addr)
+{
+    uint8_t byte_cnt;
+    byte_cnt = get_byte(addr + 8) & 0x0f;
+    byte_cnt = MAX(byte_cnt, 4);
+    byte_cnt = MIN(byte_cnt, sizeof(s->config));
+    s->config[2] &= 0x82; /* mask valid bits */
+    s->config[2] |= 0x40;
+    s->config[7]  &= 0xf7; /* clear zero bit */
+
+    address_space_read(&address_space_memory, addr + 8,
+                       MEMTXATTRS_UNSPECIFIED, s->config, byte_cnt);
+
+    if (byte_cnt > 12) {
+        s->config[12] &= 0x40;
+
+        if (byte_cnt > 11) {
+            uint8_t monitor_mode = I596_MONITOR_MODE;
+            s->config[11] &= ~0xC0; /* Clear bits 6-7 */
+            s->config[11] |= (monitor_mode << 6); /* Set monitor mode */
+        }
+    }
+
+    if (s->rx_status == RX_READY) {
+        timer_mod(s->flush_queue_timer,
+            qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 100000000);
+    }
+
+    s->scb_status |= SCB_STATUS_CNA;
+    s->config[13] |= 0x3f;
+    qemu_set_irq(s->irq, 1);
 }
 
 static void i82596_update_scb_irq(I82596State *s, bool trigger)
 {
+    update_scb_status(s);
+
     if (trigger) {
         s->send_irq = 1;
         qemu_set_irq(s->irq, 1);
     }
 }
 
-static void G_GNUC_UNUSED i82596_update_cu_status(I82596State *s, uint16_t cmd_status,
+static void i82596_update_cu_status(I82596State *s, uint16_t cmd_status,
                                      bool generate_interrupt)
 {
     if (cmd_status & STAT_C) {
@@ -658,6 +1644,11 @@ static void G_GNUC_UNUSED i82596_update_cu_status(I82596State *s, uint16_t cmd_s
     update_scb_status(s);
 }
 
+/**
+ * Update SCB Status
+ * Synchronizes device state with SCB status word and statistics counters.
+ * This function is called frequently to keep the kernel driver updated.
+ */
 static void update_scb_status(I82596State *s)
 {
     s->scb_status = (s->scb_status & 0xf000)
@@ -678,21 +1669,26 @@ static void update_scb_status(I82596State *s)
 
 static void command_loop(I82596State *s)
 {
-    uint16_t cmd;
-    uint16_t status;
-
-    DBG(printf("STARTING COMMAND LOOP cmd_p=%08x\n", s->cmd_p));
-
-    while (s->cmd_p != I596_NULL) {
-        /* set status */
-        status = STAT_B;
-        set_uint16(s->cmd_p, status);
-        status = STAT_C | STAT_OK; /* update, but write later */
-
-        cmd = get_uint16(s->cmd_p + 2);
-        DBG(printf("Running command %04x at %08x\n", cmd, s->cmd_p));
-
-        switch (cmd & 0x07) {
+    while (s->cu_status == CU_ACTIVE && s->cmd_p != I596_NULL &&
+           s->cmd_p != 0) {
+        uint16_t status = get_uint16(s->cmd_p);
+        if (status & (STAT_C | STAT_B)) {
+            uint32_t next = get_uint32(s->cmd_p + 4);
+            if (next == 0 || next == s->cmd_p) {
+                s->cmd_p = I596_NULL;
+                s->cu_status = CU_IDLE;
+                s->scb_status |= SCB_STATUS_CNA;
+                break;
+            }
+            s->cmd_p = i82596_translate_address(s, next, false);
+            continue;
+        }
+        set_uint16(s->cmd_p, STAT_B);
+        uint16_t cmd = get_uint16(s->cmd_p + 2);
+        uint32_t next_addr = get_uint32(s->cmd_p + 4);
+        next_addr = (next_addr == 0) ? I596_NULL :
+                    i82596_translate_address(s, next_addr, false);
+        switch (cmd & CMD_MASK) {
         case CmdNOp:
             break;
         case CmdSASetup:
@@ -702,155 +1698,274 @@ static void command_loop(I82596State *s)
             i82596_configure(s, s->cmd_p);
             break;
         case CmdTDR:
-            /* get signal LINK */
             set_uint32(s->cmd_p + 8, s->lnkst);
             break;
         case CmdTx:
             i82596_transmit(s, s->cmd_p);
-            break;
+            goto skip_status_update;
         case CmdMulticastList:
             set_multicast_list(s, s->cmd_p);
             break;
         case CmdDump:
+            i82596_command_dump(s, s->cmd_p);
+            break;
         case CmdDiagnose:
-            printf("FIXME Command %d !!\n", cmd & 7);
-            g_assert_not_reached();
+            break;
+        default:
+            printf("CMD_LOOP: Unknown command %d\n", cmd & CMD_MASK);
+            break;
         }
 
-        /* update status */
-        set_uint16(s->cmd_p, status);
-
-        s->cmd_p = get_uint32(s->cmd_p + 4); /* get link address */
-        DBG(printf("NEXT addr would be %08x\n", s->cmd_p));
-        if (s->cmd_p == 0) {
-            s->cmd_p = I596_NULL;
+        status = get_uint16(s->cmd_p);
+        if (!(status & STAT_C)) {
+            set_uint16(s->cmd_p, STAT_C | STAT_OK);
         }
 
-        /* Stop when last command of the list. */
-        if (cmd & CMD_EOL) {
-            s->cmd_p = I596_NULL;
-        }
-        /* Suspend after doing cmd? */
-        if (cmd & CMD_SUSP) {
-            s->cu_status = CU_SUSPENDED;
-            printf("FIXME SUSPEND !!\n");
-        }
-        /* Interrupt after doing cmd? */
+skip_status_update:
         if (cmd & CMD_INTR) {
             s->scb_status |= SCB_STATUS_CX;
-        } else {
-            s->scb_status &= ~SCB_STATUS_CX;
-        }
-        update_scb_status(s);
-
-        /* Interrupt after doing cmd? */
-        if (cmd & CMD_INTR) {
             s->send_irq = 1;
         }
 
-        if (s->cu_status != CU_ACTIVE) {
+        bool stop = false;
+
+        if (cmd & CMD_SUSP) {
+            s->cu_status = CU_SUSPENDED;
+            s->scb_status |= SCB_STATUS_CNA;
+            stop = true;
+        }
+
+        if (cmd & CMD_EOL) {
+            s->cmd_p = I596_NULL;
+            s->cu_status = CU_IDLE;
+            s->scb_status |= SCB_STATUS_CNA;
+            stop = true;
+        } else if (!stop) {
+            if (next_addr == 0 || next_addr == I596_NULL ||
+                next_addr == s->cmd_p) {
+                s->cmd_p = I596_NULL;
+                s->cu_status = CU_IDLE;
+                s->scb_status |= SCB_STATUS_CNA;
+                stop = true;
+            } else {
+                s->cmd_p = next_addr;
+            }
+        }
+
+        update_scb_status(s);
+
+        if (stop || s->cu_status != CU_ACTIVE) {
             break;
         }
     }
-    DBG(printf("FINISHED COMMAND LOOP\n"));
-    qemu_flush_queued_packets(qemu_get_queue(s->nic));
+
+    update_scb_status(s);
+
+    if (s->rx_status == RX_READY && s->nic) {
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+    }
+
 }
 
 static void examine_scb(I82596State *s)
 {
-    uint16_t command, cuc, ruc;
+    uint16_t command = get_uint16(s->scb + 2);
+    uint8_t cuc = (command >> 8) & 0x7;
+    uint8_t ruc = (command >> 4) & 0x7;
+
+    trace_i82596_scb_command(cuc, ruc);
 
-    /* get the scb command word */
-    command = get_uint16(s->scb + 2);
-    cuc = (command >> 8) & 0x7;
-    ruc = (command >> 4) & 0x7;
-    DBG(printf("MAIN COMMAND %04x  cuc %02x ruc %02x\n", command, cuc, ruc));
-    /* and clear the scb command word */
     set_uint16(s->scb + 2, 0);
-
     s->scb_status &= ~(command & SCB_ACK_MASK);
 
+    if (command & SCB_STATUS_RNR) {
+        s->rnr_signaled = false;
+    }
+
+    /* Process Command Unit (CU) commands */
     switch (cuc) {
-    case 0:     /* no change */
+    case SCB_CUC_NOP:
         break;
-    case 1:     /* CUC_START */
+
+    case SCB_CUC_START: {
+        uint32_t cmd_ptr = get_uint32(s->scb + 4);
+        s->cmd_p = i82596_translate_address(s, cmd_ptr, false);
         s->cu_status = CU_ACTIVE;
         break;
-    case 4:     /* CUC_ABORT */
-        s->cu_status = CU_SUSPENDED;
-        s->scb_status |= SCB_STATUS_CNA; /* CU left active state */
-        break;
-    default:
-        printf("WARNING: Unknown CUC %d!\n", cuc);
     }
 
-    switch (ruc) {
-    case 0:     /* no change */
-        break;
-    case 1:     /* RX_START */
-    case 2:     /* RX_RESUME */
-        s->rx_status = RX_IDLE;
-        if (USE_TIMER) {
-            timer_mod(s->flush_queue_timer, qemu_clock_get_ms(
-                                QEMU_CLOCK_VIRTUAL) + 1000);
+    case SCB_CUC_RESUME:
+        if (s->cu_status == CU_SUSPENDED) {
+            s->cu_status = CU_ACTIVE;
         }
         break;
-    case 3:     /* RX_SUSPEND */
-    case 4:     /* RX_ABORT */
-        s->rx_status = RX_SUSPENDED;
-        s->scb_status |= SCB_STATUS_RNR; /* RU left active state */
+
+    case SCB_CUC_SUSPEND:
+        s->cu_status = CU_SUSPENDED;
+        s->scb_status |= SCB_STATUS_CNA;
+        break;
+
+    case SCB_CUC_ABORT:
+        s->cu_status = CU_IDLE;
+        s->scb_status |= SCB_STATUS_CNA;
+        break;
+
+    case SCB_CUC_LOAD_THROTTLE: {
+        bool external_trigger = (s->sysbus & I82586_MODE);
+        i82596_load_throttle_timers(s, !external_trigger);
         break;
-    default:
-        printf("WARNING: Unknown RUC %d!\n", ruc);
     }
 
-    if (command & 0x80) { /* reset bit set? */
+    case SCB_CUC_LOAD_START:
+        i82596_load_throttle_timers(s, true);
+        break;
+    }
+
+    /* Process Receive Unit (RU) commands */
+    switch (ruc) {
+    case SCB_RUC_NOP:
+        break;
+
+    case SCB_RUC_START: {
+        uint32_t rfd_log = get_uint32(s->scb + 8);
+        hwaddr rfd = i82596_translate_address(s, rfd_log, false);
+
+        if (rfd == 0 || rfd == I596_NULL) {
+            s->rx_status = RX_NO_RESOURCES;
+            s->scb_status |= SCB_STATUS_RNR;
+            break;
+        }
+
+        /* Find first usable RFD with valid RBD */
+        struct i82596_rx_descriptor test_rfd;
+        hwaddr test_rfd_addr = rfd;
+        uint32_t test_rfd_log = rfd_log;
+        hwaddr first_usable_rfd = 0;
+        uint32_t first_usable_rfd_log = 0;
+        bool found = false;
+
+        for (int i = 0; i < 10 && test_rfd_addr != 0 &&
+             test_rfd_addr != I596_NULL; i++) {
+            i82596_rx_rfd_read(s, test_rfd_addr, &test_rfd);
+
+            if (test_rfd.command & CMD_FLEX) {
+                hwaddr rbd = i82596_translate_address(s, test_rfd.rbd_addr,
+                                                      false);
+                if (rbd != I596_NULL && rbd != 0) {
+                    first_usable_rfd = test_rfd_addr;
+                    first_usable_rfd_log = test_rfd_log;
+                    found = true;
+                    break;
+                }
+            }
+
+            test_rfd_log = test_rfd.link;
+            test_rfd_addr = i82596_translate_address(s, test_rfd.link, false);
+        }
+
+        if (found) {
+            s->current_rx_desc = first_usable_rfd;
+            s->last_good_rfa = first_usable_rfd_log;
+            i82596_update_rx_state(s, RX_READY);
+
+            if (first_usable_rfd != rfd) {
+                set_uint32(s->scb + 8, first_usable_rfd_log);
+            }
+
+            if (s->queue_count > 0) {
+                trace_i82596_flush_queue(s->queue_count);
+                i82596_flush_packet_queue(s);
+            }
+
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        } else {
+            s->rx_status = RX_NO_RESOURCES;
+            s->scb_status |= SCB_STATUS_RNR;
+        }
+        break;
+    }
+
+    case SCB_RUC_RESUME:
+        if (s->rx_status == RX_SUSPENDED) {
+            i82596_update_rx_state(s, RX_READY);
+            if (s->queue_count > 0) {
+                trace_i82596_flush_queue(s->queue_count);
+                i82596_flush_packet_queue(s);
+            }
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+
+    case SCB_RUC_SUSPEND:
+        s->rx_status = RX_SUSPENDED;
+        s->scb_status |= SCB_STATUS_RNR;
+        break;
+
+    case SCB_RUC_ABORT:
+        s->rx_status = RX_IDLE;
+        s->scb_status |= SCB_STATUS_RNR;
+        break;
+    }
+
+    if (command & 0x80) {
         i82596_s_reset(s);
+        return;
     }
-
-    /* execute commands from SCBL */
-    if (s->cu_status != CU_SUSPENDED) {
+    if (s->cu_status == CU_ACTIVE) {
         if (s->cmd_p == I596_NULL) {
             s->cmd_p = get_uint32(s->scb + 4);
         }
+        update_scb_status(s);
+        command_loop(s);
+    } else {
+        update_scb_status(s);
     }
-
-    /* update scb status */
-    update_scb_status(s);
-
-    command_loop(s);
 }
 
 static void signal_ca(I82596State *s)
 {
-    uint32_t iscp = 0;
-
-    /* trace_i82596_channel_attention(s); */
     if (s->scp) {
-        /* CA after reset -> do init with new scp. */
-        s->sysbus = get_byte(s->scp + 3); /* big endian */
-        DBG(printf("SYSBUS = %08x\n", s->sysbus));
-        if (((s->sysbus >> 1) & 0x03) != 2) {
-            printf("WARNING: NO LINEAR MODE !!\n");
-        }
-        if ((s->sysbus >> 7)) {
-            printf("WARNING: 32BIT LINMODE IN B-STEPPING NOT SUPPORTED !!\n");
-        }
-        iscp = get_uint32(s->scp + 8);
-        s->scb = get_uint32(iscp + 4);
-        set_byte(iscp + 1, 0); /* clear BUSY flag in iscp */
+        /* CA after reset -> initialize with new SCP */
+        s->sysbus = get_byte(s->scp + 3);
+        s->mode = (s->sysbus >> 1) & 0x03;  /* Extract mode bits (m0, m1) */
+        s->iscp = get_uint32(s->scp + 8);
+
+        s->scb = get_uint32(s->iscp + 4);
+
+        s->scb_base = (s->mode == I82596_MODE_LINEAR) ? 0 :
+                      get_uint32(s->iscp + 8);
+        s->scb = i82596_translate_address(s, s->scb, false);
+        trace_i82596_ca_init(s->scb, s->mode, s->scb_base);
+
+        /*
+         * Complete initialization sequence:
+         * - Clear BUSY flag in ISCP
+         * - Set CX and CNA in SCB status
+         * - Clear SCB command word
+         * - Signal interrupt
+         */
+        set_byte(s->iscp + 1, 0);
+        s->scb_status |= SCB_STATUS_CX | SCB_STATUS_CNA;
+        update_scb_status(s);
+        set_uint16(s->scb + 2, 0);
         s->scp = 0;
+        qemu_set_irq(s->irq, 1);
+        return;
     }
 
-    s->ca++;    /* count ca() */
-    if (!s->ca_active) {
-        s->ca_active = 1;
-        while (s->ca)   {
-            examine_scb(s);
-            s->ca--;
-        }
-        s->ca_active = 0;
+    if (s->ca_active) {
+        s->ca++;
+        return;
     }
+    s->ca_active = 1;
+    s->ca++;
+
+    while (s->ca > 0) {
+        s->ca--;
+        examine_scb(s);
+    }
+
+    s->ca_active = 0;
 
     if (s->send_irq) {
         s->send_irq = 0;
@@ -858,21 +1973,28 @@ static void signal_ca(I82596State *s)
     }
 }
 
-void i82596_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
+static void i82596_self_test(I82596State *s, uint32_t val)
 {
-    I82596State *s = opaque;
-    /* printf("i82596_ioport_writew addr=0x%08x val=0x%04x\n", addr, val); */
-    switch (addr) {
-    case PORT_RESET: /* Reset */
-        i82596_s_reset(s);
-        break;
-    case PORT_ALTSCP:
-        s->scp = val;
-        break;
-    case PORT_CA:
-        signal_ca(s);
-        break;
-    }
+    /*
+     * The documentation for the self test is a bit unclear,
+     * we are currently doing this and it seems to work.
+     */
+    set_uint32(val, 0xFFC00000);
+    set_uint32(val + 4, 0);
+
+    s->scb_status &= ~SCB_STATUS_CNA;
+    s->scb_status |= SCB_STATUS_CNA;
+
+    qemu_set_irq(s->irq, 1);
+    update_scb_status(s);
+}
+
+/*
+ * LASI specific interfaces
+ */
+static uint32_t bit_align_16(uint32_t val)
+{
+    return val & ~0x0f;
 }
 
 uint32_t i82596_ioport_readw(void *opaque, uint32_t addr)
@@ -880,276 +2002,29 @@ uint32_t i82596_ioport_readw(void *opaque, uint32_t addr)
     return -1;
 }
 
-bool i82596_can_receive(NetClientState *nc)
+void i82596_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
 {
-    I82596State *s = qemu_get_nic_opaque(nc);
-
-    if (s->rx_status == RX_SUSPENDED) {
-        return false;
+    I82596State *s = opaque;
+    trace_i82596_ioport_write(addr, val);
+    switch (addr) {
+    case PORT_RESET:
+        i82596_s_reset(s);
+        break;
+    case PORT_SELFTEST:
+        val = bit_align_16(val);
+        i82596_self_test(s, val);
+        break;
+    case PORT_ALTSCP:
+        s->scp = bit_align_16(val);
+        break;
+    case PORT_ALTDUMP:
+        trace_i82596_dump(val);
+        i82596_port_dump(s, bit_align_16(val));
+        break;
+    case PORT_CA:
+        signal_ca(s);
+        break;
     }
-
-    if (!s->lnkst) {
-        return false;
-    }
-
-    if (USE_TIMER && !timer_pending(s->flush_queue_timer)) {
-        return true;
-    }
-
-    return true;
-}
-
-ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
-{
-    I82596State *s = qemu_get_nic_opaque(nc);
-    uint32_t rfd_p;
-    uint32_t rbd;
-    uint16_t is_broadcast = 0;
-    size_t len = sz; /* length of data for guest (including CRC) */
-    size_t bufsz = sz; /* length of data in buf */
-    uint32_t crc;
-    uint8_t *crc_ptr;
-    static const uint8_t broadcast_macaddr[6] = {
-                0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
-
-    DBG(printf("i82596_receive() start\n"));
-
-    if (USE_TIMER && timer_pending(s->flush_queue_timer)) {
-        return 0;
-    }
-
-    /* first check if receiver is enabled */
-    if (s->rx_status == RX_SUSPENDED) {
-        trace_i82596_receive_analysis(">>> Receiving suspended");
-        return -1;
-    }
-
-    if (!s->lnkst) {
-        trace_i82596_receive_analysis(">>> Link down");
-        return -1;
-    }
-
-    /* Received frame smaller than configured "min frame len"? */
-    if (sz < s->config[10]) {
-        printf("Received frame too small, %zu vs. %u bytes\n",
-               sz, s->config[10]);
-        return -1;
-    }
-
-    DBG(printf("Received %lu bytes\n", sz));
-
-    if (I596_PROMISC) {
-
-        /* promiscuous: receive all */
-        trace_i82596_receive_analysis(
-                ">>> packet received in promiscuous mode");
-
-    } else {
-
-        if (!memcmp(buf,  broadcast_macaddr, 6)) {
-            /* broadcast address */
-            if (I596_BC_DISABLE) {
-                trace_i82596_receive_analysis(">>> broadcast packet rejected");
-
-                return len;
-            }
-
-            trace_i82596_receive_analysis(">>> broadcast packet received");
-            is_broadcast = 1;
-
-        } else if (buf[0] & 0x01) {
-            /* multicast */
-            if (!I596_MC_ALL) {
-                trace_i82596_receive_analysis(">>> multicast packet rejected");
-
-                return len;
-            }
-
-            int mcast_idx = (net_crc32(buf, ETH_ALEN) & BITS(7, 2)) >> 2;
-            assert(mcast_idx < 8 * sizeof(s->mult));
-
-            if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7)))) {
-                trace_i82596_receive_analysis(">>> multicast address mismatch");
-
-                return len;
-            }
-
-            trace_i82596_receive_analysis(">>> multicast packet received");
-            is_broadcast = 1;
-
-        } else if (!memcmp(s->conf.macaddr.a, buf, 6)) {
-
-            /* match */
-            trace_i82596_receive_analysis(
-                    ">>> physical address matching packet received");
-
-        } else {
-
-            trace_i82596_receive_analysis(">>> unknown packet");
-
-            return len;
-        }
-    }
-
-    /* Calculate the ethernet checksum (4 bytes) */
-    len += 4;
-    crc = cpu_to_be32(crc32(~0, buf, sz));
-    crc_ptr = (uint8_t *) &crc;
-
-    rfd_p = get_uint32(s->scb + 8); /* get Receive Frame Descriptor */
-    assert(rfd_p && rfd_p != I596_NULL);
-
-    /* get first Receive Buffer Descriptor Address */
-    rbd = get_uint32(rfd_p + 8);
-    assert(rbd && rbd != I596_NULL);
-
-    /* PRINT_PKTHDR("Receive", buf); */
-
-    while (len) {
-        uint16_t command, status;
-        uint32_t next_rfd;
-
-        command = get_uint16(rfd_p + 2);
-        assert(command & CMD_FLEX); /* assert Flex Mode */
-        /* get first Receive Buffer Descriptor Address */
-        rbd = get_uint32(rfd_p + 8);
-        assert(get_uint16(rfd_p + 14) == 0);
-
-        /* printf("Receive: rfd is %08x\n", rfd_p); */
-
-        while (len) {
-            uint16_t buffer_size, num;
-            uint32_t rba;
-            size_t bufcount, crccount;
-
-            /* printf("Receive: rbd is %08x\n", rbd); */
-            buffer_size = get_uint16(rbd + 12);
-            /* printf("buffer_size is 0x%x\n", buffer_size); */
-            assert(buffer_size != 0);
-
-            num = buffer_size & SIZE_MASK;
-            if (num > len) {
-                num = len;
-            }
-            rba = get_uint32(rbd + 8);
-            /* printf("rba is 0x%x\n", rba); */
-            /*
-             * Calculate how many bytes we want from buf[] and how many
-             * from the CRC.
-             */
-            if ((len - num) >= 4) {
-                /* The whole guest buffer, we haven't hit the CRC yet */
-                bufcount = num;
-            } else {
-                /* All that's left of buf[] */
-                bufcount = len - 4;
-            }
-            crccount = num - bufcount;
-
-            if (bufcount > 0) {
-                /* Still some of the actual data buffer to transfer */
-                assert(bufsz >= bufcount);
-                bufsz -= bufcount;
-                address_space_write(&address_space_memory, rba,
-                                    MEMTXATTRS_UNSPECIFIED, buf, bufcount);
-                rba += bufcount;
-                buf += bufcount;
-                len -= bufcount;
-            }
-
-            /* Write as much of the CRC as fits */
-            if (crccount > 0) {
-                address_space_write(&address_space_memory, rba,
-                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);
-                rba += crccount;
-                crc_ptr += crccount;
-                len -= crccount;
-            }
-
-            num |= 0x4000; /* set F BIT */
-            if (len == 0) {
-                num |= I596_EOF; /* set EOF BIT */
-            }
-            set_uint16(rbd + 0, num); /* write actual count with flags */
-
-            /* get next rbd */
-            rbd = get_uint32(rbd + 4);
-            /* printf("Next Receive: rbd is %08x\n", rbd); */
-
-            if (buffer_size & I596_EOF) /* last entry */
-                break;
-        }
-
-        /* Housekeeping, see pg. 18 */
-        next_rfd = get_uint32(rfd_p + 4);
-        set_uint32(next_rfd + 8, rbd);
-
-        status = STAT_C | STAT_OK | is_broadcast;
-        set_uint16(rfd_p, status);
-
-        if (command & CMD_SUSP) {  /* suspend after command? */
-            s->rx_status = RX_SUSPENDED;
-            s->scb_status |= SCB_STATUS_RNR; /* RU left active state */
-            break;
-        }
-        if (command & CMD_EOL) /* was it last Frame Descriptor? */
-            break;
-
-        assert(len == 0);
-    }
-
-    assert(len == 0);
-
-    s->scb_status |= SCB_STATUS_FR; /* set "RU finished receiving frame" bit. */
-    update_scb_status(s);
-
-    /* send IRQ that we received data */
-    qemu_set_irq(s->irq, 1);
-    /* s->send_irq = 1; */
-
-    if (0) {
-        DBG(printf("Checking:\n"));
-        rfd_p = get_uint32(s->scb + 8); /* get Receive Frame Descriptor */
-        DBG(printf("Next Receive: rfd is %08x\n", rfd_p));
-        rfd_p = get_uint32(rfd_p + 4); /* get Next Receive Frame Descriptor */
-        DBG(printf("Next Receive: rfd is %08x\n", rfd_p));
-        /* get first Receive Buffer Descriptor Address */
-        rbd = get_uint32(rfd_p + 8);
-        DBG(printf("Next Receive: rbd is %08x\n", rbd));
-    }
-
-    return sz;
-}
-
-ssize_t i82596_receive_iov(NetClientState *nc, const struct iovec *iov,
-                            int iovcnt)
-{
-    size_t sz = 0;
-    uint8_t *buf;
-    int i;
-    for (i = 0; i < iovcnt; i++) {
-        sz += iov[i].iov_len;
-    }
-    if (sz == 0) {
-        return -1;
-    }
-    buf = g_malloc(sz);
-    if (!buf) {
-        return -1;
-    }
-    size_t offset = 0;
-    for (i = 0; i < iovcnt; i++) {
-        if (iov[i].iov_base == NULL) {
-            g_free(buf);
-            return -1;
-        }
-        memcpy(buf + offset, iov[i].iov_base, iov[i].iov_len);
-        offset += iov[i].iov_len;
-    }
-    DBG(PRINT_PKTHDR("Receive IOV:", buf));
-    i82596_receive(nc, buf, sz);
-    g_free(buf);
-    return sz;
 }
 
 void i82596_poll(NetClientState *nc, bool enable)
@@ -1166,7 +2041,7 @@ void i82596_poll(NetClientState *nc, bool enable)
 
     if (s->rx_status == RX_NO_RESOURCES) {
         if (s->cmd_p != I596_NULL) {
-            s->rx_status = RX_READY;
+            i82596_update_rx_state(s, RX_READY);
             update_scb_status(s);
         }
     }
@@ -1232,6 +2107,57 @@ const VMStateDescription vmstate_i82596 = {
     }
 };
 
+static int i82596_flush_packet_queue(I82596State *s)
+{
+    if (s->flushing_queue) {
+        return 0;
+    }
+
+    s->flushing_queue = true;
+    int processed = 0;
+
+    while (s->queue_count > 0) {
+        int tail = s->queue_tail;
+        size_t len = s->packet_queue_len[tail];
+
+        ssize_t ret = i82596_receive_packet(s, s->packet_queue[tail], len,
+                                             true);
+
+        if (ret < 0) {
+            break;
+        }
+
+        s->queue_tail = (s->queue_tail + 1) % PACKET_QUEUE_SIZE;
+        s->queue_count--;
+        processed++;
+    }
+
+    s->flushing_queue = false;
+    trace_i82596_flush_queue(processed);
+
+    return processed;
+}
+
+static void i82596_flush_queue_timer(void *opaque)
+{
+    I82596State *s = opaque;
+
+    if (s->queue_count == 0) {
+        return;
+    }
+
+    int processed = i82596_flush_packet_queue(s);
+
+    if (processed > 0 && s->rx_status == RX_READY) {
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+    }
+
+    if (s->queue_count > 0 && s->rx_status != RX_READY) {
+        timer_mod(s->flush_queue_timer,
+                  qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) + 50000);
+    }
+}
+
 void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info)
 {
     if (s->conf.macaddr.a[0] == 0) {
diff --git a/hw/net/trace-events b/hw/net/trace-events
index e82d7490c3..23efa91d05 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -421,10 +421,27 @@ lasi_82596_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64" val=0x%04x"
 i82596_s_reset(void *s) "%p Reset chip"
 i82596_transmit(uint32_t size, uint32_t addr) "size %u from addr 0x%04x"
 i82596_receive_analysis(const char *s) "%s"
-i82596_receive_packet(size_t sz) "len=%zu"
+i82596_receive_queue_full(void) "Packet queue full, dropping packet"
+i82596_receive_suspended(void) "RX unit suspended, queueing packet"
+i82596_rx_state_change(uint8_t old_state, uint8_t new_state) "RX state changed from %d to %d"
 i82596_new_mac(const char *id_with_mac) "New MAC for: %s"
 i82596_set_multicast(uint16_t count) "Added %d multicast entries"
-i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
+i82596_scb_command(uint8_t cuc, uint8_t ruc) "SCB command CUC=0x%02x RUC=0x%02x"
+i82596_dump(uint32_t addr) "Dump command to addr 0x%08x"
+i82596_flush_queue(int count) "Flushing %d packets from queue"
+i82596_tx_tfd(uint64_t addr, uint16_t status, uint16_t cmd, uint32_t link, uint32_t tbd) "TFD @0x%"PRIx64": status=0x%04x cmd=0x%04x link=0x%08x tbd=0x%08x"
+i82596_tx_tbd(uint64_t addr, uint16_t size, uint32_t buf) "TBD @0x%"PRIx64": size=%d buf=0x%08x"
+i82596_rx_rfd(uint64_t addr, uint16_t status, uint16_t cmd, uint32_t link, uint32_t rbd) "RFD @0x%"PRIx64": status=0x%04x cmd=0x%04x link=0x%08x rbd=0x%08x"
+i82596_rx_rbd(uint64_t addr, uint16_t count, uint32_t buf, uint16_t size) "RBD @0x%"PRIx64": count=%d buf=0x%08x size=%d"
+i82596_receive_packet(const uint8_t *buf, size_t size) "RX packet %p size %zu"
+i82596_rx_short_frame(size_t size) "RX: Frame too short (%zu bytes)"
+i82596_rx_rfd_update(uint32_t addr, uint32_t next_rfd) "RX: Updating RFD 0x%08x to point to 0x%08x"
+i82596_rx_out_of_rbds(void) "RX: Out of RBDs mid-frame"
+i82596_rx_incomplete(size_t copied, size_t total) "RX: Incomplete copy (%zu/%zu bytes)"
+i82596_rx_complete(uint32_t crc, uint32_t align, uint32_t resource) "RX: Complete (errors: CRC=%d align=%d res=%d)"
+i82596_receive_iov(size_t size, int iovcnt) "RX IOV: %zu bytes in %d vectors"
+i82596_ca_init(uint32_t scb, uint8_t mode, uint32_t base) "CA: Init - SCB=0x%08x mode=%d base=0x%08x"
+i82596_ioport_write(uint32_t addr, uint32_t val) "IO write addr=0x%08x val=0x%08x"
 
 # imx_fec.c
 imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"

From 56dbf087a8a2cec7e3aeb19defed2a19efc85faa Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 10 Oct 2025 14:25:08 +0200
Subject: [PATCH 2029/2396] rust/util: add ensure macro

The macro is similar to anyhow::ensure but uses QEMU's variation
on anyhow::Error.  It can be used to easily check a condition
and format an error message.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/timer/hpet/src/device.rs | 21 ++++++----
 rust/hw/timer/hpet/src/fw_cfg.rs |  7 ++--
 rust/util/src/error.rs           | 71 ++++++++++++++++++++++++++++++++
 3 files changed, 86 insertions(+), 13 deletions(-)

diff --git a/rust/hw/timer/hpet/src/device.rs b/rust/hw/timer/hpet/src/device.rs
index 23f2eefd1c..3564aa79c6 100644
--- a/rust/hw/timer/hpet/src/device.rs
+++ b/rust/hw/timer/hpet/src/device.rs
@@ -25,7 +25,10 @@ use system::{
     bindings::{address_space_memory, address_space_stl_le, hwaddr},
     MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder, MEMTXATTRS_UNSPECIFIED,
 };
-use util::timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND};
+use util::{
+    ensure,
+    timer::{Timer, CLOCK_VIRTUAL, NANOSECONDS_PER_SECOND},
+};
 
 use crate::fw_cfg::HPETFwConfig;
 
@@ -728,14 +731,14 @@ impl HPETState {
     }
 
     fn realize(&self) -> util::Result<()> {
-        if self.num_timers < HPET_MIN_TIMERS || self.num_timers > HPET_MAX_TIMERS {
-            Err(format!(
-                "hpet.num_timers must be between {HPET_MIN_TIMERS} and {HPET_MAX_TIMERS}"
-            ))?;
-        }
-        if self.int_route_cap == 0 {
-            Err("hpet.hpet-intcap property not initialized")?;
-        }
+        ensure!(
+            (HPET_MIN_TIMERS..=HPET_MAX_TIMERS).contains(&self.num_timers),
+            "hpet.num_timers must be between {HPET_MIN_TIMERS} and {HPET_MAX_TIMERS}"
+        );
+        ensure!(
+            self.int_route_cap != 0,
+            "hpet.hpet-intcap property not initialized"
+        );
 
         self.hpet_id.set(HPETFwConfig::assign_hpet_id()?);
 
diff --git a/rust/hw/timer/hpet/src/fw_cfg.rs b/rust/hw/timer/hpet/src/fw_cfg.rs
index bb4ea8909a..777fc8ef45 100644
--- a/rust/hw/timer/hpet/src/fw_cfg.rs
+++ b/rust/hw/timer/hpet/src/fw_cfg.rs
@@ -5,6 +5,7 @@
 use std::ptr::addr_of_mut;
 
 use common::Zeroable;
+use util::{self, ensure};
 
 /// Each `HPETState` represents a Event Timer Block. The v1 spec supports
 /// up to 8 blocks. QEMU only uses 1 block (in PC machine).
@@ -36,7 +37,7 @@ pub static mut hpet_fw_cfg: HPETFwConfig = HPETFwConfig {
 };
 
 impl HPETFwConfig {
-    pub(crate) fn assign_hpet_id() -> Result<usize, &'static str> {
+    pub(crate) fn assign_hpet_id() -> util::Result<usize> {
         assert!(bql::is_locked());
         // SAFETY: all accesses go through these methods, which guarantee
         // that the accesses are protected by the BQL.
@@ -47,9 +48,7 @@ impl HPETFwConfig {
             fw_cfg.count = 0;
         }
 
-        if fw_cfg.count == 8 {
-            Err("Only 8 instances of HPET are allowed")?;
-        }
+        ensure!(fw_cfg.count != 8, "Only 8 instances of HPET are allowed");
 
         let id: usize = fw_cfg.count.into();
         fw_cfg.count += 1;
diff --git a/rust/util/src/error.rs b/rust/util/src/error.rs
index bfa5a8685b..2a57c7fd5f 100644
--- a/rust/util/src/error.rs
+++ b/rust/util/src/error.rs
@@ -86,6 +86,19 @@ impl Display for Error {
     }
 }
 
+impl From<Cow<'static, str>> for Error {
+    #[track_caller]
+    fn from(msg: Cow<'static, str>) -> Self {
+        let location = panic::Location::caller();
+        Error {
+            msg: Some(msg),
+            cause: None,
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+}
+
 impl From<String> for Error {
     #[track_caller]
     fn from(msg: String) -> Self {
@@ -126,6 +139,17 @@ impl From<anyhow::Error> for Error {
 }
 
 impl Error {
+    #[track_caller]
+    #[doc(hidden)]
+    pub fn format(args: fmt::Arguments) -> Self {
+        if let Some(msg) = args.as_str() {
+            Self::from(msg)
+        } else {
+            let msg = fmt::format(args);
+            Self::from(msg)
+        }
+    }
+
     /// Create a new error, prepending `msg` to the
     /// description of `cause`
     #[track_caller]
@@ -311,6 +335,53 @@ impl FromForeign for Error {
     }
 }
 
+/// Ensure that a condition is true, returning an error if it is false.
+///
+/// This macro is similar to [`anyhow::ensure`] but returns a QEMU [`Result`].
+/// If the condition evaluates to `false`, the macro returns early with an error
+/// constructed from the provided message.
+///
+/// # Examples
+///
+/// ```
+/// # use util::{ensure, Result};
+/// # fn check_positive(x: i32) -> Result<()> {
+/// ensure!(x > 0, "value must be positive");
+/// #   Ok(())
+/// # }
+/// ```
+///
+/// ```
+/// # use util::{ensure, Result};
+/// # const MIN: i32 = 123;
+/// # const MAX: i32 = 456;
+/// # fn check_range(x: i32) -> Result<()> {
+/// ensure!(
+///     x >= MIN && x <= MAX,
+///     "{} not between {} and {}",
+///     x,
+///     MIN,
+///     MAX
+/// );
+/// #   Ok(())
+/// # }
+/// ```
+#[macro_export]
+macro_rules! ensure {
+    ($cond:expr, $fmt:literal, $($arg:tt)*) => {
+        if !$cond {
+            let e = $crate::Error::format(format_args!($fmt, $($arg)*));
+            return $crate::Result::Err(e);
+        }
+    };
+    ($cond:expr, $err:expr $(,)?) => {
+        if !$cond {
+            let s = ::std::borrow::Cow::<'static, str>::from($err);
+            return $crate::Result::Err(s.into());
+        }
+    };
+}
+
 #[cfg(test)]
 mod tests {
     use std::ffi::CStr;

From 0830ec94059b239b3f67527b58e52fa7cd4a5439 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 10 Oct 2025 18:17:59 +0200
Subject: [PATCH 2030/2396] rust/util: use anyhow's native chaining
 capabilities

This simplifies conversions, making it possible to convert any error
into a QEMU util::Error with ".into()" (and therefore with "?").

The cost is having a separate constructor for when the error is a simple
string, but that is made easier by the ensure! macro.  If necessary,
another macro similar to "anyhow!" can be returned, but for now there
is no need for that.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/util/src/error.rs | 160 +++++++++++++++--------------------------
 1 file changed, 59 insertions(+), 101 deletions(-)

diff --git a/rust/util/src/error.rs b/rust/util/src/error.rs
index 2a57c7fd5f..11b574ca59 100644
--- a/rust/util/src/error.rs
+++ b/rust/util/src/error.rs
@@ -38,6 +38,7 @@ use std::{
     borrow::Cow,
     ffi::{c_char, c_int, c_void, CStr},
     fmt::{self, Display},
+    ops::Deref,
     panic, ptr,
 };
 
@@ -49,118 +50,85 @@ pub type Result<T> = std::result::Result<T, Error>;
 
 #[derive(Debug)]
 pub struct Error {
-    msg: Option<Cow<'static, str>>,
-    /// Appends the print string of the error to the msg if not None
-    cause: Option<anyhow::Error>,
+    cause: anyhow::Error,
     file: &'static str,
     line: u32,
 }
 
-impl std::error::Error for Error {
-    fn source(&self) -> Option<&(dyn std::error::Error + 'static)> {
-        self.cause.as_ref().map(AsRef::as_ref)
-    }
+impl Deref for Error {
+    type Target = anyhow::Error;
 
-    #[allow(deprecated)]
-    fn description(&self) -> &str {
-        self.msg
-            .as_deref()
-            .or_else(|| self.cause.as_deref().map(std::error::Error::description))
-            .expect("no message nor cause?")
+    fn deref(&self) -> &Self::Target {
+        &self.cause
     }
 }
 
 impl Display for Error {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
-        let mut prefix = "";
-        if let Some(ref msg) = self.msg {
-            write!(f, "{msg}")?;
-            prefix = ": ";
-        }
-        if let Some(ref cause) = self.cause {
-            write!(f, "{prefix}{cause}")?;
-        } else if prefix.is_empty() {
-            panic!("no message nor cause?");
-        }
-        Ok(())
+        Display::fmt(&format_args!("{:#}", self.cause), f)
     }
 }
 
-impl From<Cow<'static, str>> for Error {
+impl<E> From<E> for Error
+where
+    anyhow::Error: From<E>,
+{
     #[track_caller]
-    fn from(msg: Cow<'static, str>) -> Self {
-        let location = panic::Location::caller();
-        Error {
-            msg: Some(msg),
-            cause: None,
-            file: location.file(),
-            line: location.line(),
-        }
-    }
-}
-
-impl From<String> for Error {
-    #[track_caller]
-    fn from(msg: String) -> Self {
-        let location = panic::Location::caller();
-        Error {
-            msg: Some(Cow::Owned(msg)),
-            cause: None,
-            file: location.file(),
-            line: location.line(),
-        }
-    }
-}
-
-impl From<&'static str> for Error {
-    #[track_caller]
-    fn from(msg: &'static str) -> Self {
-        let location = panic::Location::caller();
-        Error {
-            msg: Some(Cow::Borrowed(msg)),
-            cause: None,
-            file: location.file(),
-            line: location.line(),
-        }
-    }
-}
-
-impl From<anyhow::Error> for Error {
-    #[track_caller]
-    fn from(error: anyhow::Error) -> Self {
-        let location = panic::Location::caller();
-        Error {
-            msg: None,
-            cause: Some(error),
-            file: location.file(),
-            line: location.line(),
-        }
+    fn from(src: E) -> Self {
+        Self::new(anyhow::Error::from(src))
     }
 }
 
 impl Error {
+    /// Create a new error from an [`anyhow::Error`].
+    ///
+    /// This wraps the error with QEMU's location tracking information.
+    /// Most code should use the `?` operator instead of calling this directly.
+    #[track_caller]
+    pub fn new(cause: anyhow::Error) -> Self {
+        let location = panic::Location::caller();
+        Self {
+            cause,
+            file: location.file(),
+            line: location.line(),
+        }
+    }
+
+    /// Create a new error from a string message.
+    ///
+    /// This is a convenience wrapper around [`Error::new`] for simple string
+    /// errors. Most code should use the [`ensure!`](crate::ensure) macro
+    /// instead of calling this directly.
+    #[track_caller]
+    pub fn msg(src: impl Into<Cow<'static, str>>) -> Self {
+        Self::new(anyhow::Error::msg(src.into()))
+    }
+
     #[track_caller]
     #[doc(hidden)]
+    #[inline(always)]
     pub fn format(args: fmt::Arguments) -> Self {
-        if let Some(msg) = args.as_str() {
-            Self::from(msg)
-        } else {
-            let msg = fmt::format(args);
-            Self::from(msg)
-        }
+        // anyhow::Error::msg will allocate anyway, might as well let fmt::format doit.
+        let msg = fmt::format(args);
+        Self::new(anyhow::Error::msg(msg))
     }
 
     /// Create a new error, prepending `msg` to the
     /// description of `cause`
     #[track_caller]
     pub fn with_error(msg: impl Into<Cow<'static, str>>, cause: impl Into<anyhow::Error>) -> Self {
-        let location = panic::Location::caller();
-        Error {
-            msg: Some(msg.into()),
-            cause: Some(cause.into()),
-            file: location.file(),
-            line: location.line(),
+        fn do_with_error(
+            msg: Cow<'static, str>,
+            cause: anyhow::Error,
+            location: &'static panic::Location<'static>,
+        ) -> Error {
+            Error {
+                cause: cause.context(msg),
+                file: location.file(),
+                line: location.line(),
+            }
         }
+        do_with_error(msg.into(), cause.into(), panic::Location::caller())
     }
 
     /// Consume a result, returning `false` if it is an error and
@@ -326,8 +294,7 @@ impl FromForeign for Error {
             };
 
             Error {
-                msg: FromForeign::cloned_from_foreign(error.msg),
-                cause: None,
+                cause: anyhow::Error::msg(String::cloned_from_foreign(error.msg)),
                 file: file.unwrap(),
                 line: error.line as u32,
             }
@@ -376,8 +343,8 @@ macro_rules! ensure {
     };
     ($cond:expr, $err:expr $(,)?) => {
         if !$cond {
-            let s = ::std::borrow::Cow::<'static, str>::from($err);
-            return $crate::Result::Err(s.into());
+            let e = $crate::Error::msg($err);
+            return $crate::Result::Err(e);
         }
     };
 }
@@ -416,19 +383,10 @@ mod tests {
         unsafe { CStr::from_ptr(bindings::error_get_pretty(local_err)) }
     }
 
-    #[test]
-    #[allow(deprecated)]
-    fn test_description() {
-        use std::error::Error;
-
-        assert_eq!(super::Error::from("msg").description(), "msg");
-        assert_eq!(super::Error::from("msg".to_owned()).description(), "msg");
-    }
-
     #[test]
     fn test_display() {
-        assert_eq!(&*format!("{}", Error::from("msg")), "msg");
-        assert_eq!(&*format!("{}", Error::from("msg".to_owned())), "msg");
+        assert_eq!(&*format!("{}", Error::msg("msg")), "msg");
+        assert_eq!(&*format!("{}", Error::msg("msg".to_owned())), "msg");
         assert_eq!(&*format!("{}", Error::from(anyhow!("msg"))), "msg");
 
         assert_eq!(
@@ -445,7 +403,7 @@ mod tests {
             assert!(Error::bool_or_propagate(Ok(()), &mut local_err));
             assert_eq!(local_err, ptr::null_mut());
 
-            let my_err = Error::from("msg");
+            let my_err = Error::msg("msg");
             assert!(!Error::bool_or_propagate(Err(my_err), &mut local_err));
             assert_ne!(local_err, ptr::null_mut());
             assert_eq!(error_get_pretty(local_err), c"msg");
@@ -462,7 +420,7 @@ mod tests {
             assert_eq!(String::from_foreign(ret), "abc");
             assert_eq!(local_err, ptr::null_mut());
 
-            let my_err = Error::from("msg");
+            let my_err = Error::msg("msg");
             assert_eq!(
                 Error::ptr_or_propagate(Err::<String, _>(my_err), &mut local_err),
                 ptr::null_mut()

From 113a7f5bf3b0bea56e8961c63fe7e6abec32f53d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 19 Sep 2025 13:59:27 +0200
Subject: [PATCH 2031/2396] rust/util: replace Error::err_or_unit/err_or_else
 with Error::with_errp

Introduce a simpler function that hides the creation of the Error**.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/util/src/error.rs | 52 ++++++++++++++++--------------------------
 1 file changed, 20 insertions(+), 32 deletions(-)

diff --git a/rust/util/src/error.rs b/rust/util/src/error.rs
index 11b574ca59..346577e2e5 100644
--- a/rust/util/src/error.rs
+++ b/rust/util/src/error.rs
@@ -14,8 +14,7 @@
 //!   [`ptr_or_propagate`](crate::Error::ptr_or_propagate) can be used to build
 //!   a C return value while also propagating an error condition
 //!
-//! * [`err_or_else`](crate::Error::err_or_else) and
-//!   [`err_or_unit`](crate::Error::err_or_unit) can be used to build a `Result`
+//! * [`with_errp`](crate::Error::with_errp) can be used to build a `Result`
 //!
 //! This module is most commonly used at the boundary between C and Rust code;
 //! other code will usually access it through the
@@ -213,35 +212,21 @@ impl Error {
         }
     }
 
-    /// Convert a C `Error*` into a Rust `Result`, using
-    /// `Ok(())` if `c_error` is NULL.  Free the `Error*`.
+    /// Pass a C `Error*` to the closure, and convert the result
+    /// (either the return value of the closure, or the error)
+    /// into a Rust `Result`.
     ///
     /// # Safety
     ///
-    /// `c_error` must be `NULL` or valid; typically it was initialized
-    /// with `ptr::null_mut()` and passed by reference to a C function.
-    pub unsafe fn err_or_unit(c_error: *mut bindings::Error) -> Result<()> {
-        // SAFETY: caller guarantees c_error is valid
-        unsafe { Self::err_or_else(c_error, || ()) }
-    }
+    /// One exit from `f`, `c_error` must be unchanged or point to a
+    /// valid C [`struct Error`](bindings::Error).
+    pub unsafe fn with_errp<T, F: FnOnce(&mut *mut bindings::Error) -> T>(f: F) -> Result<T> {
+        let mut c_error: *mut bindings::Error = ptr::null_mut();
 
-    /// Convert a C `Error*` into a Rust `Result`, calling `f()` to
-    /// obtain an `Ok` value if `c_error` is NULL.  Free the `Error*`.
-    ///
-    /// # Safety
-    ///
-    /// `c_error` must be `NULL` or point to a valid C [`struct
-    /// Error`](bindings::Error); typically it was initialized with
-    /// `ptr::null_mut()` and passed by reference to a C function.
-    pub unsafe fn err_or_else<T, F: FnOnce() -> T>(
-        c_error: *mut bindings::Error,
-        f: F,
-    ) -> Result<T> {
-        // SAFETY: caller guarantees c_error is valid
-        let err = unsafe { Option::<Self>::from_foreign(c_error) };
-        match err {
-            None => Ok(f()),
-            Some(err) => Err(err),
+        // SAFETY: guaranteed by the postcondition of `f`
+        match (f(&mut c_error), unsafe { c_error.into_native() }) {
+            (result, None) => Ok(result),
+            (_, Some(err)) => Err(err),
         }
     }
 }
@@ -432,13 +417,16 @@ mod tests {
     }
 
     #[test]
-    fn test_err_or_unit() {
+    fn test_with_errp() {
         unsafe {
-            let result = Error::err_or_unit(ptr::null_mut());
-            assert_match!(result, Ok(()));
+            let result = Error::with_errp(|_errp| true);
+            assert_match!(result, Ok(true));
 
-            let err = error_for_test(c"msg");
-            let err = Error::err_or_unit(err.into_inner()).unwrap_err();
+            let err = Error::with_errp(|errp| {
+                *errp = error_for_test(c"msg").into_inner();
+                false
+            })
+            .unwrap_err();
             assert_eq!(&*format!("{err}"), "msg");
         }
     }

From 8abea41ecd9fe5614f39226c04600b177eb94b52 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 7 Oct 2025 17:13:43 +0200
Subject: [PATCH 2032/2396] rust: pull error_fatal out of
 SysbusDeviceMethods::sysbus_realize

Return a Result<()> from the method, and "unwrap" it into error_fatal
in the caller.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/hw/char/pl011/src/device.rs |  4 ++--
 rust/hw/core/src/sysbus.rs       | 13 ++++++-------
 rust/util/src/error.rs           | 31 ++++++++++++++++++++++++++++++-
 rust/util/src/lib.rs             |  2 +-
 4 files changed, 39 insertions(+), 11 deletions(-)

diff --git a/rust/hw/char/pl011/src/device.rs b/rust/hw/char/pl011/src/device.rs
index 5e9b13fdf9..04155dabe1 100644
--- a/rust/hw/char/pl011/src/device.rs
+++ b/rust/hw/char/pl011/src/device.rs
@@ -17,7 +17,7 @@ use migration::{
 };
 use qom::{prelude::*, ObjectImpl, Owned, ParentField, ParentInit};
 use system::{hwaddr, MemoryRegion, MemoryRegionOps, MemoryRegionOpsBuilder};
-use util::{log::Log, log_mask_ln};
+use util::{log::Log, log_mask_ln, ResultExt};
 
 use crate::registers::{self, Interrupt, RegisterOffset};
 
@@ -697,7 +697,7 @@ pub unsafe extern "C" fn pl011_create(
         let chr = unsafe { Owned::<Chardev>::from(&*chr) };
         dev.prop_set_chr("chardev", &chr);
     }
-    dev.sysbus_realize();
+    dev.sysbus_realize().unwrap_fatal();
     dev.mmio_map(0, addr);
     dev.connect_irq(0, &irq);
 
diff --git a/rust/hw/core/src/sysbus.rs b/rust/hw/core/src/sysbus.rs
index 282315fce9..68165e8929 100644
--- a/rust/hw/core/src/sysbus.rs
+++ b/rust/hw/core/src/sysbus.rs
@@ -4,12 +4,13 @@
 
 //! Bindings to access `sysbus` functionality from Rust.
 
-use std::{ffi::CStr, ptr::addr_of_mut};
+use std::ffi::CStr;
 
 pub use bindings::SysBusDeviceClass;
 use common::Opaque;
 use qom::{prelude::*, Owned};
 use system::MemoryRegion;
+use util::{Error, Result};
 
 use crate::{
     bindings,
@@ -107,14 +108,12 @@ where
         }
     }
 
-    fn sysbus_realize(&self) {
-        // TODO: return an Error
+    fn sysbus_realize(&self) -> Result<()> {
         assert!(bql::is_locked());
         unsafe {
-            bindings::sysbus_realize(
-                self.upcast().as_mut_ptr(),
-                addr_of_mut!(util::bindings::error_fatal),
-            );
+            Error::with_errp(|errp| {
+                bindings::sysbus_realize(self.upcast().as_mut_ptr(), errp);
+            })
         }
     }
 }
diff --git a/rust/util/src/error.rs b/rust/util/src/error.rs
index 346577e2e5..4edceff42f 100644
--- a/rust/util/src/error.rs
+++ b/rust/util/src/error.rs
@@ -38,7 +38,8 @@ use std::{
     ffi::{c_char, c_int, c_void, CStr},
     fmt::{self, Display},
     ops::Deref,
-    panic, ptr,
+    panic,
+    ptr::{self, addr_of_mut},
 };
 
 use foreign::{prelude::*, OwnedPointer};
@@ -231,6 +232,34 @@ impl Error {
     }
 }
 
+/// Extension trait for `std::result::Result`, providing extra
+/// methods when the error type can be converted into a QEMU
+/// Error.
+pub trait ResultExt {
+    /// The success type `T` in `Result<T, E>`.
+    type OkType;
+
+    /// Report a fatal error and exit QEMU, or return the success value.
+    /// Note that, unlike [`unwrap()`](std::result::Result::unwrap), this
+    /// is not an abort and can be used for user errors.
+    fn unwrap_fatal(self) -> Self::OkType;
+}
+
+impl<T, E> ResultExt for std::result::Result<T, E>
+where
+    Error: From<E>,
+{
+    type OkType = T;
+
+    fn unwrap_fatal(self) -> T {
+        // SAFETY: errp is valid
+        self.map_err(|err| unsafe {
+            Error::from(err).propagate(addr_of_mut!(bindings::error_fatal))
+        })
+        .unwrap()
+    }
+}
+
 impl FreeForeign for Error {
     type Foreign = bindings::Error;
 
diff --git a/rust/util/src/lib.rs b/rust/util/src/lib.rs
index 16c89b9517..d14aa14ca7 100644
--- a/rust/util/src/lib.rs
+++ b/rust/util/src/lib.rs
@@ -6,4 +6,4 @@ pub mod log;
 pub mod module;
 pub mod timer;
 
-pub use error::{Error, Result};
+pub use error::{Error, Result, ResultExt};

From 02d6b8cfd30b2da0a58a67206e9e48119b815731 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 3 Oct 2025 14:31:13 +0200
Subject: [PATCH 2033/2396] rust: do not add qemuutil to Rust crates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fails due to https://github.com/mesonbuild/meson/pull/15076.
The config-host.h file from the qemuutil dependency ends up on the
rustc command line for targets that do not use structured sources.

It will be reverted once Meson 1.9.2 is released.

Reported-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/chardev/meson.build | 2 +-
 rust/util/meson.build    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/rust/chardev/meson.build b/rust/chardev/meson.build
index d365d8dd0f..36ada7c454 100644
--- a/rust/chardev/meson.build
+++ b/rust/chardev/meson.build
@@ -39,4 +39,4 @@ _chardev_rs = static_library(
   dependencies: [glib_sys_rs, common_rs, qemu_macros],
 )
 
-chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [chardev, qemuutil])
+chardev_rs = declare_dependency(link_with: [_chardev_rs], dependencies: [chardev])
diff --git a/rust/util/meson.build b/rust/util/meson.build
index b0b75e93ff..8ad344dccb 100644
--- a/rust/util/meson.build
+++ b/rust/util/meson.build
@@ -43,7 +43,7 @@ _util_rs = static_library(
   dependencies: [anyhow_rs, libc_rs, foreign_rs, glib_sys_rs, common_rs, qom, qemuutil],
 )
 
-util_rs = declare_dependency(link_with: [_util_rs], dependencies: [qemuutil, qom])
+util_rs = declare_dependency(link_with: [_util_rs])
 
 rust.test('rust-util-tests', _util_rs,
           dependencies: [qemuutil, qom],

From ac561a3050aa642571735332e22d96334be083cf Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 21 Dec 2024 16:53:29 +0100
Subject: [PATCH 2034/2396] rust: migration: allow nested offset_of

Nested offset_of was stabilized in Rust 1.82.  Since the minimum
supported version for QEMU is 1.83, allow nested field accesses
in vmstate_of!

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 rust/migration/src/vmstate.rs | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/rust/migration/src/vmstate.rs b/rust/migration/src/vmstate.rs
index 5a237c409a..267f9c8e05 100644
--- a/rust/migration/src/vmstate.rs
+++ b/rust/migration/src/vmstate.rs
@@ -141,24 +141,24 @@ pub const fn vmstate_varray_flag<T: VMState>(_: PhantomData<T>) -> VMStateFlags
 /// [`Owned`]: ../../qom/qom/struct.Owned.html
 #[macro_export]
 macro_rules! vmstate_of {
-    ($struct_name:ty, $field_name:ident $([0 .. $num:ident $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
+    ($struct_name:ty, $($field_name:ident).+ $([0 .. $($num:ident).+ $(* $factor:expr)?])? $(, $test_fn:expr)? $(,)?) => {
         $crate::bindings::VMStateField {
-            name: ::core::concat!(::core::stringify!($field_name), "\0")
+            name: ::core::concat!(::core::stringify!($($field_name).+), "\0")
                 .as_bytes()
                 .as_ptr().cast::<::std::os::raw::c_char>(),
-            offset: ::std::mem::offset_of!($struct_name, $field_name),
-            $(num_offset: ::std::mem::offset_of!($struct_name, $num),)?
+            offset: ::std::mem::offset_of!($struct_name, $($field_name).+),
+            $(num_offset: ::std::mem::offset_of!($struct_name, $($num).+),)?
             $(field_exists: $crate::vmstate_exist_fn!($struct_name, $test_fn),)?
             // The calls to `call_func_with_field!` are the magic that
             // computes most of the VMStateField from the type of the field.
             ..$crate::call_func_with_field!(
                 $crate::vmstate::vmstate_base,
                 $struct_name,
-                $field_name
+                $($field_name).+
             )$(.with_varray_flag($crate::call_func_with_field!(
                     $crate::vmstate::vmstate_varray_flag,
                     $struct_name,
-                    $num))
+                    $($num).+))
                $(.with_varray_multiply($factor))?)?
         }
     };

From fdeeb448458f0ed808a62314b57974ab16d3592e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 31 Oct 2025 14:24:18 +0100
Subject: [PATCH 2035/2396] rust: add back to Ubuntu 22.04 jobs

Ubuntu is now including updated versions of Rust (up to 1.85) for
its LTS releases.  Adjust the CI containers and re-add --enable-rust
to the Ubuntu jobs.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 .gitlab-ci.d/buildtest.yml                       |  2 +-
 docs/about/build-platforms.rst                   | 10 +++++-----
 scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml |  2 +-
 scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml   |  2 +-
 tests/docker/dockerfiles/ubuntu2204.docker       |  6 +++---
 tests/lcitool/mappings.yml                       |  4 ++--
 tests/lcitool/refresh                            |  4 ++--
 7 files changed, 15 insertions(+), 15 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 21f6d7e96f..44df116139 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -39,7 +39,7 @@ build-system-ubuntu:
     - job: amd64-ubuntu2204-container
   variables:
     IMAGE: ubuntu2204
-    CONFIGURE_ARGS: --enable-docs
+    CONFIGURE_ARGS: --enable-docs --enable-rust
     TARGETS: alpha-softmmu microblazeel-softmmu mips64el-softmmu
     MAKE_CHECK_ARGS: check-build
 
diff --git a/docs/about/build-platforms.rst b/docs/about/build-platforms.rst
index fc2743658d..e95784cdb5 100644
--- a/docs/about/build-platforms.rst
+++ b/docs/about/build-platforms.rst
@@ -117,14 +117,14 @@ Rust build dependencies
   a newer version using ``cargo install bindgen-cli``.
 
   QEMU requires Rust 1.83.0.  This is available on all supported platforms
-  with two exception: Ubuntu LTS releases 22.04 and 24.04, and the
-  ``mips64el`` architecture on Debian bookworm.  For all other
+  except for the ``mips64el`` architecture on Debian bookworm.  For all other
   architectures, Debian bookworm provides a new-enough Rust compiler
   in the ``rustc-web`` package.
 
-  It is expected that in the future Ubuntu will provide updated packages
-  like the existing ``rustc-1.82`` package.  The path to ``rustc`` and
-  ``rustdoc`` will have to be provided manually to the configure script.
+  For Ubuntu 22.04 ("Jammy") and 24.04 ("Noble") updated versions of
+  Rust are available through packages such as ``rustc-1.83`` package;
+  the path to ``rustc`` and ``rustdoc`` has to be provided manually to
+  the configure script.
 
   Some distros prefer to avoid vendored crate sources, and instead use
   local sources from e.g. ``/usr/share/cargo/registry``.  QEMU includes a
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
index 70063db198..d303411391 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
@@ -119,7 +119,7 @@ packages:
   - python3-wheel
   - python3-yaml
   - rpm2cpio
-  - rustc-1.77
+  - rustc-1.83
   - sed
   - socat
   - sparse
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
index 4f1a49be34..4ee8630cc4 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
@@ -117,7 +117,7 @@ packages:
   - python3-wheel
   - python3-yaml
   - rpm2cpio
-  - rustc-1.77
+  - rustc-1.83
   - sed
   - socat
   - sparse
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index b393db55a8..602d419624 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -124,7 +124,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       python3-wheel \
                       python3-yaml \
                       rpm2cpio \
-                      rustc-1.77 \
+                      rustc-1.83 \
                       sed \
                       socat \
                       sparse \
@@ -155,8 +155,8 @@ ENV LANG "en_US.UTF-8"
 ENV MAKE "/usr/bin/make"
 ENV NINJA "/usr/bin/ninja"
 ENV PYTHON "/usr/bin/python3"
-ENV RUSTC=/usr/bin/rustc-1.77
-ENV RUSTDOC=/usr/bin/rustdoc-1.77
+ENV RUSTC=/usr/bin/rustc-1.83
+ENV RUSTDOC=/usr/bin/rustdoc-1.83
 ENV CARGO_HOME=/usr/local/cargo
 ENV PATH=$CARGO_HOME/bin:$PATH
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \
diff --git a/tests/lcitool/mappings.yml b/tests/lcitool/mappings.yml
index 8f0e95e1c5..a749cf8c51 100644
--- a/tests/lcitool/mappings.yml
+++ b/tests/lcitool/mappings.yml
@@ -70,8 +70,8 @@ mappings:
 
   rust:
     Debian12: rustc-web
-    Ubuntu2204: rustc-1.77
-    Ubuntu2404: rustc-1.77
+    Ubuntu2204: rustc-1.83
+    Ubuntu2404: rustc-1.83
 
 pypi_mappings:
   # Request more recent version
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 7fbdf6f340..df186caffe 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -152,8 +152,8 @@ fedora_rustup_nightly_extras = [
 ]
 
 ubuntu2204_rust_extras = [
-    "ENV RUSTC=/usr/bin/rustc-1.77\n",
-    "ENV RUSTDOC=/usr/bin/rustdoc-1.77\n",
+    "ENV RUSTC=/usr/bin/rustc-1.83\n",
+    "ENV RUSTDOC=/usr/bin/rustdoc-1.83\n",
     "ENV CARGO_HOME=/usr/local/cargo\n",
     'ENV PATH=$CARGO_HOME/bin:$PATH\n',
     "RUN DEBIAN_FRONTEND=noninteractive eatmydata \\\n",

From a362b19a39e458256cc7e3acd0dc7825b0389b48 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Sun, 24 Aug 2025 09:18:33 +0200
Subject: [PATCH 2036/2396] hw/sd/sdcard: Fix size check for backing block
 image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Alignment rules apply the the individual partitions (user, boot, later
on also RPMB) and depend both on the size of the image and the type of
the device. Up to and including 2GB, the power-of-2 rule applies to the
user data area. For larger images, multiples of 512 sectors must be used
for eMMC and multiples of 512K for SD-cards. Fix the check accordingly
and also detect if the image is too small to even hold the boot
partitions.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Message-ID: <591f6d8a9dc86428723cb6876df6e717cc41a70e.1762261430.git.jan.kiszka@siemens.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 69 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 48 insertions(+), 21 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index d7a496d77c..76e915e190 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2759,9 +2759,32 @@ static void sd_instance_finalize(Object *obj)
     timer_free(sd->ocr_power_timer);
 }
 
+static void sd_blk_size_error(SDState *sd, int64_t blk_size,
+                              int64_t blk_size_aligned, const char *rule,
+                              Error **errp)
+{
+    const char *dev_type = sd_is_emmc(sd) ? "eMMC" : "SD card";
+    char *blk_size_str;
+
+    blk_size_str = size_to_str(blk_size);
+    error_setg(errp, "Invalid %s size: %s", dev_type, blk_size_str);
+    g_free(blk_size_str);
+
+    blk_size_str = size_to_str(blk_size_aligned);
+    error_append_hint(errp,
+                      "%s size has to be %s, e.g. %s.\n"
+                      "You can resize disk images with"
+                      " 'qemu-img resize <imagefile> <new-size>'\n"
+                      "(note that this will lose data if you make the"
+                      " image smaller than it currently is).\n",
+                      dev_type, rule, blk_size_str);
+    g_free(blk_size_str);
+}
+
 static void sd_realize(DeviceState *dev, Error **errp)
 {
     SDState *sd = SDMMC_COMMON(dev);
+    int64_t blk_size = -ENOMEDIUM;
     int ret;
 
     switch (sd->spec_version) {
@@ -2774,32 +2797,36 @@ static void sd_realize(DeviceState *dev, Error **errp)
     }
 
     if (sd->blk) {
-        int64_t blk_size;
-
         if (!blk_supports_write_perm(sd->blk)) {
             error_setg(errp, "Cannot use read-only drive as SD card");
             return;
         }
 
         blk_size = blk_getlength(sd->blk);
-        if (blk_size > 0 && !is_power_of_2(blk_size)) {
-            int64_t blk_size_aligned = pow2ceil(blk_size);
-            char *blk_size_str;
-
-            blk_size_str = size_to_str(blk_size);
-            error_setg(errp, "Invalid SD card size: %s", blk_size_str);
-            g_free(blk_size_str);
-
-            blk_size_str = size_to_str(blk_size_aligned);
-            error_append_hint(errp,
-                              "SD card size has to be a power of 2, e.g. %s.\n"
-                              "You can resize disk images with"
-                              " 'qemu-img resize <imagefile> <new-size>'\n"
-                              "(note that this will lose data if you make the"
-                              " image smaller than it currently is).\n",
-                              blk_size_str);
-            g_free(blk_size_str);
-
+    }
+    if (blk_size >= 0) {
+        blk_size -= sd->boot_part_size * 2;
+        if (blk_size > SDSC_MAX_CAPACITY) {
+            if (sd_is_emmc(sd) &&
+                !QEMU_IS_ALIGNED(blk_size, 1 << HWBLOCK_SHIFT)) {
+                int64_t blk_size_aligned =
+                    ((blk_size >> HWBLOCK_SHIFT) + 1) << HWBLOCK_SHIFT;
+                sd_blk_size_error(sd, blk_size, blk_size_aligned,
+                                  "multiples of 512", errp);
+                return;
+            } else if (!sd_is_emmc(sd) &&
+                !QEMU_IS_ALIGNED(blk_size, 512 * KiB)) {
+                int64_t blk_size_aligned = ((blk_size >> 19) + 1) << 19;
+                sd_blk_size_error(sd, blk_size, blk_size_aligned,
+                                  "multiples of 512K", errp);
+                return;
+            }
+        } else if (blk_size > 0 && !is_power_of_2(blk_size)) {
+            sd_blk_size_error(sd, blk_size, pow2ceil(blk_size), "a power of 2",
+                              errp);
+            return;
+        } else if (blk_size < 0) {
+            error_setg(errp, "eMMC image smaller than boot partitions");
             return;
         }
 
@@ -2810,7 +2837,7 @@ static void sd_realize(DeviceState *dev, Error **errp)
         }
         blk_set_dev_ops(sd->blk, &sd_block_ops, sd);
     }
-    if (sd->boot_part_size % (128 * KiB) ||
+    if (!QEMU_IS_ALIGNED(sd->boot_part_size, 128 * KiB) ||
         sd->boot_part_size > 255 * 128 * KiB) {
         g_autofree char *size_str = size_to_str(sd->boot_part_size);
 

From 4a885312bec08f30e98d0141e0258ae048b9014d Mon Sep 17 00:00:00 2001
From: Jan Luebbe <jlu@pengutronix.de>
Date: Tue, 15 Oct 2024 15:56:49 +0200
Subject: [PATCH 2037/2396] hw/sd/sdcard: Allow user creation of eMMCs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For testing eMMC-specific functionality (such as handling boot
partitions), it would be very useful to attach them to generic VMs such
as x86_64 via the sdhci-pci device:
 ...
 -drive if=none,id=emmc-drive,file=emmc.img,format=raw \
 -device sdhci-pci \
 -device emmc,id=emmc0,drive=emmc-drive,boot-partition-size=1048576 \
 ...

While most eMMCs are soldered to boards, they can also be connected to
SD controllers with just a passive adapter, such as:
 https://docs.radxa.com/en/accessories/emmc-to-usd
 https://github.com/voltlog/emmc-wfbga153-microsd

The only change necessary to make the options above work is to avoid
disabling user_creatable, so do that. The SDHCI-PCI driver in the Linux
kernel already supports this just fine.

Signed-off-by: Jan Luebbe <jlu@pengutronix.de>
Acked-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20241015135649.4189256-1-jlu@pengutronix.de>

Enable user-instantiation so that eMMCs can be created for PCI-attached
SD/MMC host controllers (such as sdhci-pci) on virt machines, for QA
purposes for the eMMC model itself and for complex firmware/OS
integrations using the upcoming RPMB partition support.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-ID: <e515cc80de261ff03b3141724298f20313259a85.1762261430.git.jan.kiszka@siemens.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 76e915e190..e43e1a10eb 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2930,8 +2930,6 @@ static void emmc_class_init(ObjectClass *klass, const void *data)
     dc->desc = "eMMC";
     dc->realize = emmc_realize;
     device_class_set_props(dc, emmc_properties);
-    /* Reason: Soldered on board */
-    dc->user_creatable = false;
 
     sc->proto = &sd_proto_emmc;
 

From 8ef4260a3f53694a1680254d37901fb7dbe8acf3 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Mon, 11 Aug 2025 09:01:57 +0200
Subject: [PATCH 2038/2396] hw/sd/sdcard: Add basic support for RPMB partition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The Replay Protected Memory Block (RPMB) is available since eMMC 4.4
which has been obsoleted by 4.41. Therefore lift the provided
EXT_CSD_REV to 5 (4.41) and provide the basic logic to implement basic
support for it. This allows to set the authentication key, read the
write counter and authenticated perform data read and write requests.
Those aren't actually authenticated yet, support for that will be added
later.

The RPMB image needs to be added to backing block images after potential
boot partitions and before the user data. It's size is controlled by
the rpmb-partition-size property.

Also missing in this version (and actually not only for RPMB bits) is
persistence of registers that are supposed to survive power cycles. Most
prominent are the write counters or the authentication key. This feature
can be added later, e.g. by append a state structure to the backing
block image.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <d57388b599e47f5c95f30be7571b77f9016289eb.1762261430.git.jan.kiszka@siemens.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c             | 217 +++++++++++++++++++++++++++++++++++++++--
 hw/sd/sdmmc-internal.h |  22 +++++
 hw/sd/trace-events     |   2 +
 3 files changed, 233 insertions(+), 8 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index e43e1a10eb..aa57c858cb 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -117,6 +117,26 @@ typedef struct SDProto {
     } cmd[SDMMC_CMD_MAX], acmd[SDMMC_CMD_MAX];
 } SDProto;
 
+#define RPMB_STUFF_LEN      196
+#define RPMB_KEY_MAC_LEN    32
+#define RPMB_DATA_LEN       256     /* one RPMB block is half a sector */
+#define RPMB_NONCE_LEN      16
+
+typedef struct QEMU_PACKED {
+    uint8_t stuff_bytes[RPMB_STUFF_LEN];
+    uint8_t key_mac[RPMB_KEY_MAC_LEN];
+    uint8_t data[RPMB_DATA_LEN];
+    uint8_t nonce[RPMB_NONCE_LEN];
+    uint32_t write_counter;
+    uint16_t address;
+    uint16_t block_count;
+    uint16_t result;
+    uint16_t req_resp;
+} RPMBDataFrame;
+
+QEMU_BUILD_BUG_MSG(sizeof(RPMBDataFrame) != 512,
+                   "invalid RPMBDataFrame size");
+
 struct SDState {
     DeviceState parent_obj;
 
@@ -140,6 +160,7 @@ struct SDState {
 
     uint8_t spec_version;
     uint64_t boot_part_size;
+    uint64_t rpmb_part_size;
     BlockBackend *blk;
     uint8_t boot_config;
 
@@ -172,6 +193,12 @@ struct SDState {
     uint32_t data_offset;
     size_t data_size;
     uint8_t data[512];
+    struct {
+        uint32_t write_counter;
+        uint8_t key[RPMB_KEY_MAC_LEN];
+        uint8_t key_set;
+        RPMBDataFrame result;
+    } rpmb;
     QEMUTimer *ocr_power_timer;
     uint8_t dat_lines;
     bool cmd_line;
@@ -506,7 +533,9 @@ static void emmc_set_ext_csd(SDState *sd, uint64_t size)
     sd->ext_csd[205] = 0x46; /* Min read perf for 4bit@26Mhz */
     sd->ext_csd[EXT_CSD_CARD_TYPE] = 0b11;
     sd->ext_csd[EXT_CSD_STRUCTURE] = 2;
-    sd->ext_csd[EXT_CSD_REV] = 3;
+    sd->ext_csd[EXT_CSD_REV] = 5;
+    sd->ext_csd[EXT_CSD_RPMB_MULT] = sd->rpmb_part_size / (128 * KiB);
+    sd->ext_csd[EXT_CSD_PARTITION_SUPPORT] = 0b111;
 
     /* Mode segment (RW) */
     sd->ext_csd[EXT_CSD_PART_CONFIG] = sd->boot_config;
@@ -834,7 +863,8 @@ static uint32_t sd_blk_len(SDState *sd)
 /*
  * This requires a disk image that has two boot partitions inserted at the
  * beginning of it, followed by an RPMB partition. The size of the boot
- * partitions is the "boot-partition-size" property.
+ * partitions is the "boot-partition-size" property, the one of the RPMB
+ * partition is 'rpmb-partition-size'.
  */
 static uint32_t sd_part_offset(SDState *sd)
 {
@@ -848,11 +878,13 @@ static uint32_t sd_part_offset(SDState *sd)
                                  & EXT_CSD_PART_CONFIG_ACC_MASK;
     switch (partition_access) {
     case EXT_CSD_PART_CONFIG_ACC_DEFAULT:
-        return sd->boot_part_size * 2;
+        return sd->boot_part_size * 2 + sd->rpmb_part_size;
     case EXT_CSD_PART_CONFIG_ACC_BOOT1:
         return 0;
     case EXT_CSD_PART_CONFIG_ACC_BOOT2:
         return sd->boot_part_size * 1;
+    case EXT_CSD_PART_CONFIG_ACC_RPMB:
+        return sd->boot_part_size * 2;
     default:
          g_assert_not_reached();
     }
@@ -891,7 +923,7 @@ static void sd_reset(DeviceState *dev)
     }
     size = sect << HWBLOCK_SHIFT;
     if (sd_is_emmc(sd)) {
-        size -= sd->boot_part_size * 2;
+        size -= sd->boot_part_size * 2 + sd->rpmb_part_size;
     }
 
     sect = sd_addr_to_wpnum(size) + 1;
@@ -979,6 +1011,34 @@ static const VMStateDescription sd_ocr_vmstate = {
     },
 };
 
+static bool vmstate_needed_for_rpmb(void *opaque)
+{
+    SDState *sd = opaque;
+
+    return sd->rpmb_part_size > 0;
+}
+
+static const VMStateDescription emmc_rpmb_vmstate = {
+    .name = "sd-card/ext_csd_modes-state",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = vmstate_needed_for_rpmb,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT8_ARRAY(rpmb.result.key_mac, SDState, RPMB_KEY_MAC_LEN),
+        VMSTATE_UINT8_ARRAY(rpmb.result.data, SDState, RPMB_DATA_LEN),
+        VMSTATE_UINT8_ARRAY(rpmb.result.nonce, SDState, RPMB_NONCE_LEN),
+        VMSTATE_UINT32(rpmb.result.write_counter, SDState),
+        VMSTATE_UINT16(rpmb.result.address, SDState),
+        VMSTATE_UINT16(rpmb.result.block_count, SDState),
+        VMSTATE_UINT16(rpmb.result.result, SDState),
+        VMSTATE_UINT16(rpmb.result.req_resp, SDState),
+        VMSTATE_UINT32(rpmb.write_counter, SDState),
+        VMSTATE_UINT8_ARRAY(rpmb.key, SDState, 32),
+        VMSTATE_UINT8(rpmb.key_set, SDState),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static bool vmstate_needed_for_emmc(void *opaque)
 {
     SDState *sd = opaque;
@@ -1045,6 +1105,7 @@ static const VMStateDescription sd_vmstate = {
     .subsections = (const VMStateDescription * const []) {
         &sd_ocr_vmstate,
         &emmc_extcsd_vmstate,
+        &emmc_rpmb_vmstate,
         NULL
     },
 };
@@ -1067,6 +1128,108 @@ static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
     }
 }
 
+static void emmc_rpmb_blk_read(SDState *sd, uint64_t addr, uint32_t len)
+{
+    uint16_t resp = lduw_be_p(&sd->rpmb.result.req_resp);
+    uint16_t result = lduw_be_p(&sd->rpmb.result.result);
+    unsigned int curr_block = 0;
+
+    if ((result & ~RPMB_RESULT_COUTER_EXPIRED) == RPMB_RESULT_OK &&
+        resp == RPMB_RESP(RPMB_REQ_AUTH_DATA_READ)) {
+        curr_block = lduw_be_p(&sd->rpmb.result.address);
+        if (sd->rpmb.result.block_count == 0) {
+            stw_be_p(&sd->rpmb.result.block_count, sd->multi_blk_cnt);
+        } else {
+            curr_block += lduw_be_p(&sd->rpmb.result.block_count);
+            curr_block -= sd->multi_blk_cnt;
+        }
+        addr = curr_block * RPMB_DATA_LEN + sd_part_offset(sd);
+        if (blk_pread(sd->blk, addr, RPMB_DATA_LEN,
+                      sd->rpmb.result.data, 0) < 0) {
+            error_report("sd_blk_read: read error on host side");
+            memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
+            stw_be_p(&sd->rpmb.result.result,
+                     RPMB_RESULT_READ_FAILURE
+                     | (result & RPMB_RESULT_COUTER_EXPIRED));
+        }
+    }
+    memcpy(sd->data, &sd->rpmb.result, sizeof(sd->rpmb.result));
+
+    trace_sdcard_rpmb_read_block(resp, curr_block,
+                                 lduw_be_p(&sd->rpmb.result.result));
+}
+
+static void emmc_rpmb_blk_write(SDState *sd, uint64_t addr, uint32_t len)
+{
+    RPMBDataFrame *frame = (RPMBDataFrame *)sd->data;
+    uint16_t req = lduw_be_p(&frame->req_resp);
+
+    if (req == RPMB_REQ_READ_RESULT) {
+        /* just return the current result register */
+        goto exit;
+    }
+    memset(&sd->rpmb.result, 0, sizeof(sd->rpmb.result));
+    memcpy(sd->rpmb.result.nonce, frame->nonce, sizeof(sd->rpmb.result.nonce));
+    stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_OK);
+    stw_be_p(&sd->rpmb.result.req_resp, RPMB_RESP(req));
+
+    if (!sd->rpmb.key_set && req != RPMB_REQ_PROGRAM_AUTH_KEY) {
+        stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_NO_AUTH_KEY);
+        goto exit;
+    }
+
+    switch (req) {
+    case RPMB_REQ_PROGRAM_AUTH_KEY:
+        if (sd->rpmb.key_set) {
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
+            break;
+        }
+        memcpy(sd->rpmb.key, frame->key_mac, sizeof(sd->rpmb.key));
+        sd->rpmb.key_set = 1;
+        break;
+    case RPMB_REQ_READ_WRITE_COUNTER:
+        stl_be_p(&sd->rpmb.result.write_counter, sd->rpmb.write_counter);
+        break;
+    case RPMB_REQ_AUTH_DATA_WRITE:
+        /* We only support single-block writes so far */
+        if (sd->multi_blk_cnt != 1) {
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_GENERAL_FAILURE);
+            break;
+        }
+        if (sd->rpmb.write_counter == 0xffffffff) {
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
+            break;
+        }
+        if (ldl_be_p(&frame->write_counter) != sd->rpmb.write_counter) {
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_COUNTER_FAILURE);
+            break;
+        }
+        sd->rpmb.result.address = frame->address;
+        addr = lduw_be_p(&frame->address) * RPMB_DATA_LEN + sd_part_offset(sd);
+        if (blk_pwrite(sd->blk, addr, RPMB_DATA_LEN, frame->data, 0) < 0) {
+            error_report("sd_blk_write: write error on host side");
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
+        } else {
+            sd->rpmb.write_counter++;
+        }
+        stl_be_p(&sd->rpmb.result.write_counter, sd->rpmb.write_counter);
+        break;
+    case RPMB_REQ_AUTH_DATA_READ:
+        sd->rpmb.result.address = frame->address;
+        break;
+    default:
+        qemu_log_mask(LOG_UNIMP, "RPMB request %d not implemented\n", req);
+        stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_GENERAL_FAILURE);
+        break;
+    }
+exit:
+    if (sd->rpmb.write_counter == 0xffffffff) {
+        stw_be_p(&sd->rpmb.result.result,
+                 lduw_be_p(&sd->rpmb.result.result) | RPMB_RESULT_COUTER_EXPIRED);
+    }
+    trace_sdcard_rpmb_write_block(req, lduw_be_p(&sd->rpmb.result.result));
+}
+
 static void sd_erase(SDState *sd)
 {
     uint64_t erase_start = sd->erase_start;
@@ -1180,6 +1343,19 @@ static void emmc_function_switch(SDState *sd, uint32_t arg)
         break;
     }
 
+    if (index == EXT_CSD_PART_CONFIG) {
+        uint8_t part = b & EXT_CSD_PART_CONFIG_ACC_MASK;
+
+        if (((part == EXT_CSD_PART_CONFIG_ACC_BOOT1 ||
+              part == EXT_CSD_PART_CONFIG_ACC_BOOT2) && !sd->boot_part_size) ||
+            (part == EXT_CSD_PART_CONFIG_ACC_RPMB && !sd->rpmb_part_size)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "MMC switching to illegal partition\n");
+            sd->card_status |= R_CSR_SWITCH_ERROR_MASK;
+            return;
+        }
+    }
+
     trace_sdcard_ext_csd_update(index, sd->ext_csd[index], b);
     sd->ext_csd[index] = b;
 }
@@ -2378,6 +2554,7 @@ static bool sd_generic_read_byte(SDState *sd, uint8_t *value)
 
 static void sd_write_byte(SDState *sd, uint8_t value)
 {
+    unsigned int partition_access;
     int i;
 
     if (!sd->blk || !blk_is_inserted(sd->blk)) {
@@ -2427,7 +2604,13 @@ static void sd_write_byte(SDState *sd, uint8_t value)
         if (sd->data_offset >= sd->blk_len) {
             /* TODO: Check CRC before committing */
             sd->state = sd_programming_state;
-            sd_blk_write(sd, sd->data_start, sd->data_offset);
+            partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
+                    & EXT_CSD_PART_CONFIG_ACC_MASK;
+            if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {
+                emmc_rpmb_blk_write(sd, sd->data_start, sd->data_offset);
+            } else {
+                sd_blk_write(sd, sd->data_start, sd->data_offset);
+            }
             sd->blk_written++;
             sd->data_start += sd->blk_len;
             sd->data_offset = 0;
@@ -2510,6 +2693,7 @@ static uint8_t sd_read_byte(SDState *sd)
 {
     /* TODO: Append CRCs */
     const uint8_t dummy_byte = 0x00;
+    unsigned int partition_access;
     uint8_t ret;
     uint32_t io_len;
 
@@ -2553,7 +2737,13 @@ static uint8_t sd_read_byte(SDState *sd)
                                   sd->data_start, io_len)) {
                 return dummy_byte;
             }
-            sd_blk_read(sd, sd->data_start, io_len);
+            partition_access = sd->ext_csd[EXT_CSD_PART_CONFIG]
+                    & EXT_CSD_PART_CONFIG_ACC_MASK;
+            if (partition_access == EXT_CSD_PART_CONFIG_ACC_RPMB) {
+                emmc_rpmb_blk_read(sd, sd->data_start, io_len);
+            } else {
+                sd_blk_read(sd, sd->data_start, io_len);
+            }
         }
         ret = sd->data[sd->data_offset ++];
 
@@ -2805,7 +2995,7 @@ static void sd_realize(DeviceState *dev, Error **errp)
         blk_size = blk_getlength(sd->blk);
     }
     if (blk_size >= 0) {
-        blk_size -= sd->boot_part_size * 2;
+        blk_size -= sd->boot_part_size * 2 + sd->rpmb_part_size;
         if (blk_size > SDSC_MAX_CAPACITY) {
             if (sd_is_emmc(sd) &&
                 !QEMU_IS_ALIGNED(blk_size, 1 << HWBLOCK_SHIFT)) {
@@ -2846,13 +3036,23 @@ static void sd_realize(DeviceState *dev, Error **errp)
                           "The boot partition size must be multiples of 128K"
                           "and not larger than 32640K.\n");
     }
+    if (!QEMU_IS_ALIGNED(sd->rpmb_part_size, 128 * KiB) ||
+        sd->rpmb_part_size > 128 * 128 * KiB) {
+        char *size_str = size_to_str(sd->boot_part_size);
+
+        error_setg(errp, "Invalid RPMB partition size: %s", size_str);
+        g_free(size_str);
+        error_append_hint(errp,
+                          "The RPMB partition size must be multiples of 128K"
+                          "and not larger than 16384K.\n");
+    }
 }
 
 static void emmc_realize(DeviceState *dev, Error **errp)
 {
     SDState *sd = SDMMC_COMMON(dev);
 
-    sd->spec_version = SD_PHY_SPECv3_01_VERS; /* Actually v4.3 */
+    sd->spec_version = SD_PHY_SPECv3_01_VERS; /* Actually v4.5 */
 
     sd_realize(dev, errp);
 }
@@ -2869,6 +3069,7 @@ static const Property sd_properties[] = {
 static const Property emmc_properties[] = {
     DEFINE_PROP_UINT64("boot-partition-size", SDState, boot_part_size, 0),
     DEFINE_PROP_UINT8("boot-config", SDState, boot_config, 0x0),
+    DEFINE_PROP_UINT64("rpmb-partition-size", SDState, rpmb_part_size, 0),
 };
 
 static void sdmmc_common_class_init(ObjectClass *klass, const void *data)
diff --git a/hw/sd/sdmmc-internal.h b/hw/sd/sdmmc-internal.h
index ce6bc4e6ec..c115f472ef 100644
--- a/hw/sd/sdmmc-internal.h
+++ b/hw/sd/sdmmc-internal.h
@@ -118,9 +118,31 @@ DECLARE_OBJ_CHECKERS(SDState, SDCardClass, SDMMC_COMMON, TYPE_SDMMC_COMMON)
 #define EXT_CSD_PART_CONFIG_ACC_DEFAULT         (0x0)
 #define EXT_CSD_PART_CONFIG_ACC_BOOT1           (0x1)
 #define EXT_CSD_PART_CONFIG_ACC_BOOT2           (0x2)
+#define EXT_CSD_PART_CONFIG_ACC_RPMB            (0x3)
 
 #define EXT_CSD_PART_CONFIG_EN_MASK             (0x7 << 3)
 #define EXT_CSD_PART_CONFIG_EN_BOOT0            (0x1 << 3)
 #define EXT_CSD_PART_CONFIG_EN_USER             (0x7 << 3)
 
+#define RPMB_REQ_PROGRAM_AUTH_KEY       (1)
+#define RPMB_REQ_READ_WRITE_COUNTER     (2)
+#define RPMB_REQ_AUTH_DATA_WRITE        (3)
+#define RPMB_REQ_AUTH_DATA_READ         (4)
+#define RPMB_REQ_READ_RESULT            (5)
+#define RPMB_REQ_AUTH_CONFIG_WRITE      (6)
+#define RPMB_REQ_AUTH_CONFIG_READ       (7)
+
+#define RPMB_RESP(__req__)              ((__req__) << 8)
+
+#define RPMB_RESULT_OK                  (0)
+#define RPMB_RESULT_GENERAL_FAILURE     (1)
+#define RPMB_RESULT_AUTH_FAILURE        (2)
+#define RPMB_RESULT_COUNTER_FAILURE     (3)
+#define RPMB_RESULT_ADDRESS_FAILURE     (4)
+#define RPMB_RESULT_WRITE_FAILURE       (5)
+#define RPMB_RESULT_READ_FAILURE        (6)
+#define RPMB_RESULT_NO_AUTH_KEY         (7)
+
+#define RPMB_RESULT_COUTER_EXPIRED      (0x80)
+
 #endif
diff --git a/hw/sd/trace-events b/hw/sd/trace-events
index 8d49840917..d30daa2143 100644
--- a/hw/sd/trace-events
+++ b/hw/sd/trace-events
@@ -59,6 +59,8 @@ sdcard_read_data(const char *proto, const char *cmd_desc, uint8_t cmd, uint32_t
 sdcard_set_voltage(uint16_t millivolts) "%u mV"
 sdcard_ext_csd_update(unsigned index, uint8_t oval, uint8_t nval) "index %u: 0x%02x -> 0x%02x"
 sdcard_switch(unsigned access, unsigned index, unsigned value, unsigned set) "SWITCH acc:%u idx:%u val:%u set:%u"
+sdcard_rpmb_read_block(uint16_t resp, uint16_t read_addr, uint16_t result) "resp 0x%x read_addr 0x%x result 0x%x"
+sdcard_rpmb_write_block(uint16_t req, uint16_t result) "req 0x%x result 0x%x"
 
 # pl181.c
 pl181_command_send(uint8_t cmd, uint32_t arg) "sending CMD%02d arg 0x%08" PRIx32

From 3acf956ea1a3e991e8540268b73d8565b05a6056 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Tue, 12 Aug 2025 21:33:46 +0200
Subject: [PATCH 2039/2396] hw/sd/sdcard: Handle RPMB MAC field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Implement correct setting of the MAC field when passing RPMB frames back
to the guest. Also check the MAC on authenticated write requests.

This depends on HMAC support for QCRYPTO_HASH_ALGO_SHA256 which is
always available via glib - assert this, just to be safe.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <b6f5698c0ca017871d54834f0c7bd4b4b6316bbd.1762261430.git.jan.kiszka@siemens.com>
Tested-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 82 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 82 insertions(+)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index aa57c858cb..9c86c016cc 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -51,6 +51,7 @@
 #include "qemu/module.h"
 #include "sdmmc-internal.h"
 #include "trace.h"
+#include "crypto/hmac.h"
 
 //#define DEBUG_SD 1
 
@@ -121,6 +122,7 @@ typedef struct SDProto {
 #define RPMB_KEY_MAC_LEN    32
 #define RPMB_DATA_LEN       256     /* one RPMB block is half a sector */
 #define RPMB_NONCE_LEN      16
+#define RPMB_HASH_LEN       284
 
 typedef struct QEMU_PACKED {
     uint8_t stuff_bytes[RPMB_STUFF_LEN];
@@ -1128,6 +1130,67 @@ static void sd_blk_write(SDState *sd, uint64_t addr, uint32_t len)
     }
 }
 
+static bool rpmb_calc_hmac(SDState *sd, const RPMBDataFrame *frame,
+                           unsigned int num_blocks, uint8_t *mac)
+{
+    g_autoptr(QCryptoHmac) hmac = NULL;
+    size_t mac_len = RPMB_KEY_MAC_LEN;
+    bool success = true;
+    Error *err = NULL;
+    uint64_t offset;
+
+    hmac = qcrypto_hmac_new(QCRYPTO_HASH_ALGO_SHA256, sd->rpmb.key,
+                            RPMB_KEY_MAC_LEN, &err);
+    if (!hmac) {
+        error_report_err(err);
+        return false;
+    }
+
+    /*
+     * This implies a read request because we only support single-block write
+     * requests so far.
+     */
+    if (num_blocks > 1) {
+        /*
+         * Unfortunately, the underlying crypto libraries do not allow us to
+         * migrate an active QCryptoHmac state. Therefore, we have to calculate
+         * the HMAC in one run. To avoid buffering a complete read sequence in
+         * SDState, reconstruct all frames except for the last one.
+         */
+        void *buf = sd->data;
+
+        assert(RPMB_HASH_LEN <= sizeof(sd->data));
+
+        memcpy((uint8_t *)buf + RPMB_DATA_LEN, &frame->data[RPMB_DATA_LEN],
+               RPMB_HASH_LEN - RPMB_DATA_LEN);
+        offset = lduw_be_p(&frame->address) * RPMB_DATA_LEN + sd_part_offset(sd);
+        do {
+            if (blk_pread(sd->blk, offset, RPMB_DATA_LEN, buf, 0) < 0) {
+                error_report("sd_blk_read: read error on host side");
+                success = false;
+                break;
+            }
+            if (qcrypto_hmac_bytes(hmac, buf, RPMB_HASH_LEN, NULL, NULL,
+                                   &err) < 0) {
+                error_report_err(err);
+                success = false;
+                break;
+            }
+            offset += RPMB_DATA_LEN;
+        } while (--num_blocks > 1);
+    }
+
+    if (success &&
+        qcrypto_hmac_bytes(hmac, frame->data, RPMB_HASH_LEN, &mac,
+                           &mac_len, &err) < 0) {
+        error_report_err(err);
+        success = false;
+    }
+    assert(!success || mac_len == RPMB_KEY_MAC_LEN);
+
+    return success;
+}
+
 static void emmc_rpmb_blk_read(SDState *sd, uint64_t addr, uint32_t len)
 {
     uint16_t resp = lduw_be_p(&sd->rpmb.result.req_resp);
@@ -1152,6 +1215,17 @@ static void emmc_rpmb_blk_read(SDState *sd, uint64_t addr, uint32_t len)
                      RPMB_RESULT_READ_FAILURE
                      | (result & RPMB_RESULT_COUTER_EXPIRED));
         }
+        if (sd->multi_blk_cnt == 1 &&
+            !rpmb_calc_hmac(sd, &sd->rpmb.result,
+                            lduw_be_p(&sd->rpmb.result.block_count),
+                            sd->rpmb.result.key_mac)) {
+            memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
+        }
+    } else if (!rpmb_calc_hmac(sd, &sd->rpmb.result, 1,
+                               sd->rpmb.result.key_mac)) {
+        memset(sd->rpmb.result.data, 0, sizeof(sd->rpmb.result.data));
+        stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
     }
     memcpy(sd->data, &sd->rpmb.result, sizeof(sd->rpmb.result));
 
@@ -1163,6 +1237,7 @@ static void emmc_rpmb_blk_write(SDState *sd, uint64_t addr, uint32_t len)
 {
     RPMBDataFrame *frame = (RPMBDataFrame *)sd->data;
     uint16_t req = lduw_be_p(&frame->req_resp);
+    uint8_t mac[RPMB_KEY_MAC_LEN];
 
     if (req == RPMB_REQ_READ_RESULT) {
         /* just return the current result register */
@@ -1200,6 +1275,11 @@ static void emmc_rpmb_blk_write(SDState *sd, uint64_t addr, uint32_t len)
             stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_WRITE_FAILURE);
             break;
         }
+        if (!rpmb_calc_hmac(sd, frame, 1, mac) ||
+            memcmp(frame->key_mac, mac, RPMB_KEY_MAC_LEN) != 0) {
+            stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_AUTH_FAILURE);
+            break;
+        }
         if (ldl_be_p(&frame->write_counter) != sd->rpmb.write_counter) {
             stw_be_p(&sd->rpmb.result.result, RPMB_RESULT_COUNTER_FAILURE);
             break;
@@ -3128,6 +3208,8 @@ static void emmc_class_init(ObjectClass *klass, const void *data)
     DeviceClass *dc = DEVICE_CLASS(klass);
     SDCardClass *sc = SDMMC_COMMON_CLASS(klass);
 
+    assert(qcrypto_hmac_supports(QCRYPTO_HASH_ALGO_SHA256));
+
     dc->desc = "eMMC";
     dc->realize = emmc_realize;
     device_class_set_props(dc, emmc_properties);

From 2f00451fbeaf91c9a0cdcb8a860d27bacbbe7a06 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Tue, 12 Aug 2025 21:53:49 +0200
Subject: [PATCH 2040/2396] scripts: Add helper script to generate eMMC block
 device images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As an eMMC block device image may consist of more than just the user
data partition, provide a helper script that can compose the image from
boot partitions, an RPMB partition and the user data image. The script
also does the required size validation and/or rounding.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <eecefa8e-44ae-45ff-85d0-3f9b786948e0@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/mkemmc.sh | 216 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 216 insertions(+)
 create mode 100755 scripts/mkemmc.sh

diff --git a/scripts/mkemmc.sh b/scripts/mkemmc.sh
new file mode 100755
index 0000000000..429388213c
--- /dev/null
+++ b/scripts/mkemmc.sh
@@ -0,0 +1,216 @@
+#!/bin/sh -e
+# SPDX-License-Identifier: GPL-2.0-only
+#
+# Create eMMC block device image from boot, RPMB and user data images
+#
+# Copyright (c) Siemens, 2025
+#
+# Authors:
+#  Jan Kiszka <jan.kiszka@siemens.com>
+#
+
+usage() {
+    echo "$0 [OPTIONS] USER_IMG[:SIZE] OUTPUT_IMG"
+    echo ""
+    echo "SIZE must be a power of 2 up to 2G and multiples of 512 byte from there on."
+    echo "If no SIZE is specified, the size of USER_ING will be used (rounded up)."
+    echo ""
+    echo "Supported options:"
+    echo "  -b BOOT1_IMG[:SIZE]   Add boot partitions. SIZE must be multiples of 128K. If"
+    echo "                          no SIZE is specified, the size of BOOT1_IMG will be"
+    echo "                          used (rounded up). BOOT1_IMG will be stored in boot"
+    echo "                          partition 1, and a boot partition 2 of the same size"
+    echo "                          will be created as empty (all zeros) unless -B is"
+    echo "                          specified as well."
+    echo "  -B BOOT2_IMG          Fill boot partition 2 with BOOT2_IMG. Must be combined"
+    echo "                          with -b which is also defining the partition size."
+    echo "  -r RPMB_IMG[:SIZE]    Add RPMB partition. SIZE must be multiples of 128K. If"
+    echo "                          no SIZE is specified, the size of RPMB_IMG will be"
+    echo "                          used (rounded up)."
+    echo "  -h, --help            This help"
+    echo ""
+    echo "All SIZE parameters support the units K, M, G. If SIZE is smaller than the"
+    echo "associated image, it will be truncated in the output image."
+    exit "$1"
+}
+
+process_size() {
+    name=$1
+    image_file=$2
+    alignment=$3
+    image_arg=$4
+    if [ "${image_arg#*:}" = "$image_arg"  ]; then
+        if ! size=$(wc -c < "$image_file" 2>/dev/null); then
+            echo "Missing $name image '$image_file'." >&2
+            exit 1
+        fi
+        if [ "$alignment" = 128 ]; then
+            size=$(( (size + 128 * 1024 - 1) & ~(128 * 1024 - 1) ))
+        elif [ $size -gt $((2 * 1024 * 1024 * 1024)) ]; then
+            size=$(( (size + 511) & ~511 ))
+        elif [ $(( size & (size - 1) )) -gt 0 ]; then
+            n=0
+            while [ "$size" -gt 0 ]; do
+                size=$((size >> 1))
+                n=$((n + 1))
+            done
+            size=$((1 << n))
+        fi
+    else
+        value="${image_arg#*:}"
+        if [ "${value%K}" != "$value" ]; then
+            size=${value%K}
+            multiplier=1024
+        elif [ "${value%M}" != "$value" ]; then
+            size=${value%M}
+            multiplier=$((1024 * 1024))
+        elif [ "${value%G}" != "$value" ]; then
+            size=${value%G}
+            multiplier=$((1024 * 1024 * 1024))
+        else
+            size=$value
+            multiplier=1
+        fi
+        # check if "$size" is a valid integer by doing a self-comparison
+        if [ "$size" -eq "$size" ] 2>/dev/null; then
+            size=$((size * multiplier))
+        else
+            echo "Invalid value '$value' specified for $image_file image size." >&2
+            exit 1
+        fi
+        if [ "$alignment" = 128 ]; then
+            if [ $(( size & (128 * 1024 - 1) )) -ne 0 ]; then
+                echo "The $name image size must be multiples of 128K." >&2
+                exit 1
+            fi
+        elif [ $size -gt $((2 * 1024 * 1024 * 1024)) ]; then
+            if [ $(( size & 511)) -ne 0 ]; then
+                echo "The $name image size must be multiples of 512 (if >2G)." >&2
+                exit 1
+            fi
+        elif [ $(( size & (size - 1) )) -gt 0 ]; then
+            echo "The $name image size must be power of 2 (up to 2G)." >&2
+            exit 1
+        fi
+    fi
+    echo $size
+}
+
+check_truncation() {
+    image_file=$1
+    output_size=$2
+    if [ "$image_file" = "/dev/zero" ]; then
+        return
+    fi
+    if ! actual_size=$(wc -c < "$image_file" 2>/dev/null); then
+        echo "Missing image '$image_file'." >&2
+        exit 1
+    fi
+    if [ "$actual_size" -gt "$output_size" ]; then
+        echo "Warning: image '$image_file' will be truncated on output."
+    fi
+}
+
+userimg=
+outimg=
+bootimg1=
+bootimg2=/dev/zero
+bootsz=0
+rpmbimg=
+rpmbsz=0
+
+while [ $# -gt 0 ]; do
+    case "$1" in
+        -b)
+            shift
+            [ $# -ge 1 ] || usage 1
+            bootimg1=${1%%:*}
+            bootsz=$(process_size boot "$bootimg1" 128 "$1")
+            shift
+            ;;
+        -B)
+            shift
+            [ $# -ge 1 ] || usage 1
+            bootimg2=$1
+            shift
+            ;;
+        -r)
+            shift
+            [ $# -ge 1 ] || usage 1
+            rpmbimg=${1%%:*}
+            rpmbsz=$(process_size RPMB "$rpmbimg" 128 "$1")
+            shift
+            ;;
+        -h|--help)
+            usage 0
+            ;;
+        *)
+            if [ -z "$userimg" ]; then
+                userimg=${1%%:*}
+                usersz=$(process_size user "$userimg" U "$1")
+            elif [ -z "$outimg" ]; then
+                outimg=$1
+            else
+                usage 1
+            fi
+            shift
+            ;;
+    esac
+done
+
+[ -n "$outimg" ] || usage 1
+
+if [ "$bootsz" -gt $((32640 * 1024)) ]; then
+    echo "Boot image size is larger than 32640K." >&2
+    exit 1
+fi
+if [ "$rpmbsz" -gt $((16384 * 1024)) ]; then
+    echo "RPMB image size is larger than 16384K." >&2
+    exit 1
+fi
+
+echo "Creating eMMC image"
+
+truncate -s 0 "$outimg"
+pos=0
+
+if [ "$bootsz" -gt 0 ]; then
+    echo "  Boot partition 1 and 2:   $((bootsz / 1024))K each"
+    blocks=$(( bootsz / (128 * 1024) ))
+    check_truncation "$bootimg1" "$bootsz"
+    dd if="$bootimg1" of="$outimg" conv=sparse bs=128K count=$blocks \
+        status=none
+    check_truncation "$bootimg2" "$bootsz"
+    dd if="$bootimg2" of="$outimg" conv=sparse bs=128K count=$blocks \
+        seek=$blocks status=none
+    pos=$((2 * bootsz))
+fi
+
+if [ "$rpmbsz" -gt 0 ]; then
+    echo "  RPMB partition:           $((rpmbsz / 1024))K"
+    blocks=$(( rpmbsz / (128 * 1024) ))
+    check_truncation "$rpmbimg" "$rpmbsz"
+    dd if="$rpmbimg" of="$outimg" conv=sparse bs=128K count=$blocks \
+        seek=$(( pos / (128 * 1024) )) status=none
+    pos=$((pos + rpmbsz))
+fi
+
+if [ "$usersz" -lt 1024 ]; then
+    echo "  User data:                $usersz bytes"
+elif [ "$usersz" -lt $((1024 * 1024)) ]; then
+    echo "  User data:                $(( (usersz + 1023) / 1024 ))K ($usersz)"
+elif [ "$usersz" -lt $((1024 * 1024 * 1024)) ]; then
+    echo "  User data:                $(( (usersz + 1048575) / 1048576))M ($usersz)"
+else
+    echo "  User data:                $(( (usersz + 1073741823) / 1073741824))G ($usersz)"
+fi
+check_truncation "$userimg" "$usersz"
+dd if="$userimg" of="$outimg" conv=sparse bs=128K seek=$(( pos / (128 * 1024) )) \
+    count=$(( (usersz + 128 * 1024 - 1) / (128 * 1024) )) status=none
+pos=$((pos + usersz))
+truncate -s $pos "$outimg"
+
+echo ""
+echo "Instantiate by appending to the qemu command line:"
+echo "  -drive file=$outimg,if=none,format=raw,id=emmc-img"
+echo "  -device emmc,boot-partition-size=$bootsz,rpmb-partition-size=$rpmbsz,drive=emmc-img"

From 45423e247076c0680bd1936c681efdb81641088d Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Tue, 9 Sep 2025 08:13:22 +0200
Subject: [PATCH 2041/2396] docs: Add eMMC device model description
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <b9c3ff21e7170fef5d0e7d08698a113d2a64e649.1762261430.git.jan.kiszka@siemens.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 docs/system/device-emulation.rst |  1 +
 docs/system/devices/emmc.rst     | 55 ++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)
 create mode 100644 docs/system/devices/emmc.rst

diff --git a/docs/system/device-emulation.rst b/docs/system/device-emulation.rst
index db714ad47a..971325527a 100644
--- a/docs/system/device-emulation.rst
+++ b/docs/system/device-emulation.rst
@@ -88,6 +88,7 @@ Emulated Devices
    devices/canokey.rst
    devices/ccid.rst
    devices/cxl.rst
+   devices/emmc.rst
    devices/igb.rst
    devices/ivshmem-flat.rst
    devices/ivshmem.rst
diff --git a/docs/system/devices/emmc.rst b/docs/system/devices/emmc.rst
new file mode 100644
index 0000000000..e62adfd68e
--- /dev/null
+++ b/docs/system/devices/emmc.rst
@@ -0,0 +1,55 @@
+.. SPDX-License-Identifier: GPL-2.0-or-later
+
+==============
+eMMC Emulation
+==============
+
+Besides SD card emulation, QEMU also offers an eMMC model as found on many
+embedded boards. An eMMC, just like an SD card, is connected to the machine
+via an SDHCI controller.
+
+Create eMMC Images
+==================
+
+A recent eMMC consists of 4 partitions: 2 boot partitions, 1 Replay protected
+Memory Block (RPMB), and the user data area. QEMU expects backing images for
+the eMMC to contain those partitions concatenated in exactly that order.
+However, the boot partitions as well as the RPMB might be absent if their sizes
+are configured to zero.
+
+The eMMC specification defines alignment constraints for the partitions. The
+two boot partitions must be of the same size. Furthermore, boot and RPMB
+partitions must be multiples of 128 KB with a maximum of 32640 KB for each
+boot partition and 16384K for the RPMB partition.
+
+The alignment constrain of the user data area depends on its size. Up to 2
+GByte, the size must be a power of 2. From 2 GByte onward, the size has to be
+multiples of 512 byte.
+
+QEMU is enforcing those alignment rules before instantiating the device.
+Therefore, the provided image has to strictly follow them as well. The helper
+script ``scripts/mkemmc.sh`` can be used to create compliant images, with or
+without pre-filled partitions. E.g., to create an eMMC image from a firmware
+image and an OS image with an empty 2 MByte RPMB, use the following command:
+
+.. code-block:: console
+
+    scripts/mkemmc.sh -b firmware.img -r /dev/zero:2M os.img emmc.img
+
+This will take care of rounding up the partition sizes to the next valid value
+and will leave the RPMB and the second boot partition empty (zeroed).
+
+Adding eMMC Devices
+===================
+
+An eMMC is either automatically created by a machine model (e.g. Aspeed boards)
+or can be user-created when using a PCI-attached SDHCI controller. To
+instantiate the eMMC image from the example above in a machine without other
+SDHCI controllers while assuming that the firmware needs a boot partitions of
+1 MB, use the following options:
+
+.. code-block:: console
+
+    -drive file=emmc.img,if=none,format=raw,id=emmc-img
+    -device sdhci-pci
+    -device emmc,drive=emmc-img,boot-partition-size=1048576,rpmb-partition-size=2097152

From b7974ab064278c82de1e61196d5f1bb4a8c15a81 Mon Sep 17 00:00:00 2001
From: Luigi Leonardi <leonardi@redhat.com>
Date: Thu, 30 Oct 2025 15:32:04 +0100
Subject: [PATCH 2042/2396] hw/i386/microvm: Use fdt field from MachineState
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

MachineState already provides an fdt field, remove it from
MicrovmMachineState and use that instead.

This is useful when using the `dumpdtb` option, as QEMU expects the
device tree to be stored in the MachineState struct, otherwise it
will return this error:

  qemu-system-x86_64: This machine doesn't have an FDT

Signed-off-by: Luigi Leonardi <leonardi@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251030-fix_microvm-v1-1-f89544a04be3@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/i386/microvm-dt.c      | 96 +++++++++++++++++++++------------------
 include/hw/i386/microvm.h |  2 -
 2 files changed, 52 insertions(+), 46 deletions(-)

diff --git a/hw/i386/microvm-dt.c b/hw/i386/microvm-dt.c
index cb27dfd732..81eaddafc8 100644
--- a/hw/i386/microvm-dt.c
+++ b/hw/i386/microvm-dt.c
@@ -48,6 +48,7 @@ static bool debug;
 static void dt_add_microvm_irq(MicrovmMachineState *mms,
                                const char *nodename, uint32_t irq)
 {
+    MachineState *ms = MACHINE(mms);
     int index = 0;
 
     if (irq >= IO_APIC_SECONDARY_IRQBASE) {
@@ -55,13 +56,14 @@ static void dt_add_microvm_irq(MicrovmMachineState *mms,
         index++;
     }
 
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "interrupt-parent",
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
                           mms->ioapic_phandle[index]);
-    qemu_fdt_setprop_cells(mms->fdt, nodename, "interrupts", irq, 0);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0);
 }
 
 static void dt_add_virtio(MicrovmMachineState *mms, VirtIOMMIOProxy *mmio)
 {
+    MachineState *ms = MACHINE(mms);
     SysBusDevice *dev = SYS_BUS_DEVICE(mmio);
     VirtioBusState *mmio_virtio_bus = &mmio->bus;
     BusState *mmio_bus = &mmio_virtio_bus->parent_obj;
@@ -77,10 +79,10 @@ static void dt_add_virtio(MicrovmMachineState *mms, VirtIOMMIOProxy *mmio)
     uint32_t irq = mms->virtio_irq_base + index;
 
     nodename = g_strdup_printf("/virtio_mmio@%" PRIx64, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop_string(mms->fdt, nodename, "compatible", "virtio,mmio");
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg", 2, base, 2, size);
-    qemu_fdt_setprop(mms->fdt, nodename, "dma-coherent", NULL, 0);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "compatible", "virtio,mmio");
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
+    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
     dt_add_microvm_irq(mms, nodename, irq);
     g_free(nodename);
 }
@@ -88,40 +90,42 @@ static void dt_add_virtio(MicrovmMachineState *mms, VirtIOMMIOProxy *mmio)
 static void dt_add_xhci(MicrovmMachineState *mms)
 {
     const char compat[] = "generic-xhci";
+    MachineState *ms = MACHINE(mms);
     uint32_t irq = MICROVM_XHCI_IRQ;
     hwaddr base = MICROVM_XHCI_BASE;
     hwaddr size = XHCI_LEN_REGS;
     char *nodename;
 
     nodename = g_strdup_printf("/usb@%" PRIx64, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop(mms->fdt, nodename, "compatible", compat, sizeof(compat));
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg", 2, base, 2, size);
-    qemu_fdt_setprop(mms->fdt, nodename, "dma-coherent", NULL, 0);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop(ms->fdt, nodename, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
+    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
     dt_add_microvm_irq(mms, nodename, irq);
     g_free(nodename);
 }
 
 static void dt_add_pcie(MicrovmMachineState *mms)
 {
+    MachineState *ms = MACHINE(mms);
     hwaddr base = PCIE_MMIO_BASE;
     int nr_pcie_buses;
     char *nodename;
 
     nodename = g_strdup_printf("/pcie@%" PRIx64, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop_string(mms->fdt, nodename,
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename,
                             "compatible", "pci-host-ecam-generic");
-    qemu_fdt_setprop_string(mms->fdt, nodename, "device_type", "pci");
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "#address-cells", 3);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "#size-cells", 2);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "linux,pci-domain", 0);
-    qemu_fdt_setprop(mms->fdt, nodename, "dma-coherent", NULL, 0);
+    qemu_fdt_setprop_string(ms->fdt, nodename, "device_type", "pci");
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 3);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#size-cells", 2);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,pci-domain", 0);
+    qemu_fdt_setprop(ms->fdt, nodename, "dma-coherent", NULL, 0);
 
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg",
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
                                  2, PCIE_ECAM_BASE, 2, PCIE_ECAM_SIZE);
     if (mms->gpex.mmio64.size) {
-        qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "ranges",
+        qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
 
                                      1, FDT_PCI_RANGE_MMIO,
                                      2, mms->gpex.mmio32.base,
@@ -133,7 +137,7 @@ static void dt_add_pcie(MicrovmMachineState *mms)
                                      2, mms->gpex.mmio64.base,
                                      2, mms->gpex.mmio64.size);
     } else {
-        qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "ranges",
+        qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "ranges",
 
                                      1, FDT_PCI_RANGE_MMIO,
                                      2, mms->gpex.mmio32.base,
@@ -142,7 +146,7 @@ static void dt_add_pcie(MicrovmMachineState *mms)
     }
 
     nr_pcie_buses = PCIE_ECAM_SIZE / PCIE_MMCFG_SIZE_MIN;
-    qemu_fdt_setprop_cells(mms->fdt, nodename, "bus-range", 0,
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "bus-range", 0,
                            nr_pcie_buses - 1);
 
     g_free(nodename);
@@ -150,6 +154,7 @@ static void dt_add_pcie(MicrovmMachineState *mms)
 
 static void dt_add_ioapic(MicrovmMachineState *mms, SysBusDevice *dev)
 {
+    MachineState *ms = MACHINE(mms);
     hwaddr base = dev->mmio[0].addr;
     char *nodename;
     uint32_t ph;
@@ -168,18 +173,18 @@ static void dt_add_ioapic(MicrovmMachineState *mms, SysBusDevice *dev)
     }
 
     nodename = g_strdup_printf("/ioapic%d@%" PRIx64, index + 1, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop_string(mms->fdt, nodename,
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop_string(ms->fdt, nodename,
                             "compatible", "intel,ce4100-ioapic");
-    qemu_fdt_setprop(mms->fdt, nodename, "interrupt-controller", NULL, 0);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "#interrupt-cells", 0x2);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "#address-cells", 0x2);
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg",
+    qemu_fdt_setprop(ms->fdt, nodename, "interrupt-controller", NULL, 0);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 0x2);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#address-cells", 0x2);
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg",
                                  2, base, 2, 0x1000);
 
-    ph = qemu_fdt_alloc_phandle(mms->fdt);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "phandle", ph);
-    qemu_fdt_setprop_cell(mms->fdt, nodename, "linux,phandle", ph);
+    ph = qemu_fdt_alloc_phandle(ms->fdt);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "phandle", ph);
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "linux,phandle", ph);
     mms->ioapic_phandle[index] = ph;
 
     g_free(nodename);
@@ -190,17 +195,18 @@ static void dt_add_isa_serial(MicrovmMachineState *mms, ISADevice *dev)
     const char compat[] = "ns16550";
     uint32_t irq = object_property_get_int(OBJECT(dev), "irq", &error_fatal);
     hwaddr base = object_property_get_int(OBJECT(dev), "iobase", &error_fatal);
+    MachineState *ms = MACHINE(mms);
     hwaddr size = 8;
     char *nodename;
 
     nodename = g_strdup_printf("/serial@%" PRIx64, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop(mms->fdt, nodename, "compatible", compat, sizeof(compat));
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg", 2, base, 2, size);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop(ms->fdt, nodename, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
     dt_add_microvm_irq(mms, nodename, irq);
 
     if (base == 0x3f8 /* com1 */) {
-        qemu_fdt_setprop_string(mms->fdt, "/chosen", "stdout-path", nodename);
+        qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
     }
 
     g_free(nodename);
@@ -211,13 +217,14 @@ static void dt_add_isa_rtc(MicrovmMachineState *mms, ISADevice *dev)
     const char compat[] = "motorola,mc146818";
     uint32_t irq = object_property_get_uint(OBJECT(dev), "irq", &error_fatal);
     hwaddr base = object_property_get_uint(OBJECT(dev), "iobase", &error_fatal);
+    MachineState *ms = MACHINE(mms);
     hwaddr size = 8;
     char *nodename;
 
     nodename = g_strdup_printf("/rtc@%" PRIx64, base);
-    qemu_fdt_add_subnode(mms->fdt, nodename);
-    qemu_fdt_setprop(mms->fdt, nodename, "compatible", compat, sizeof(compat));
-    qemu_fdt_setprop_sized_cells(mms->fdt, nodename, "reg", 2, base, 2, size);
+    qemu_fdt_add_subnode(ms->fdt, nodename);
+    qemu_fdt_setprop(ms->fdt, nodename, "compatible", compat, sizeof(compat));
+    qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
     dt_add_microvm_irq(mms, nodename, irq);
     g_free(nodename);
 }
@@ -317,27 +324,28 @@ static void dt_setup_sys_bus(MicrovmMachineState *mms)
 void dt_setup_microvm(MicrovmMachineState *mms)
 {
     X86MachineState *x86ms = X86_MACHINE(mms);
+    MachineState *ms = MACHINE(mms);
     int size = 0;
 
-    mms->fdt = create_device_tree(&size);
+    ms->fdt = create_device_tree(&size);
 
     /* root node */
-    qemu_fdt_setprop_string(mms->fdt, "/", "compatible", "linux,microvm");
-    qemu_fdt_setprop_cell(mms->fdt, "/", "#address-cells", 0x2);
-    qemu_fdt_setprop_cell(mms->fdt, "/", "#size-cells", 0x2);
+    qemu_fdt_setprop_string(ms->fdt, "/", "compatible", "linux,microvm");
+    qemu_fdt_setprop_cell(ms->fdt, "/", "#address-cells", 0x2);
+    qemu_fdt_setprop_cell(ms->fdt, "/", "#size-cells", 0x2);
 
-    qemu_fdt_add_subnode(mms->fdt, "/chosen");
+    qemu_fdt_add_subnode(ms->fdt, "/chosen");
     dt_setup_sys_bus(mms);
 
     /* add to fw_cfg */
     if (debug) {
         fprintf(stderr, "%s: add etc/fdt to fw_cfg\n", __func__);
     }
-    fw_cfg_add_file(x86ms->fw_cfg, "etc/fdt", mms->fdt, size);
+    fw_cfg_add_file(x86ms->fw_cfg, "etc/fdt", ms->fdt, size);
 
     if (debug) {
         fprintf(stderr, "%s: writing microvm.fdt\n", __func__);
-        if (!g_file_set_contents("microvm.fdt", mms->fdt, size, NULL)) {
+        if (!g_file_set_contents("microvm.fdt", ms->fdt, size, NULL)) {
             fprintf(stderr, "%s: writing microvm.fdt failed\n", __func__);
             return;
         }
diff --git a/include/hw/i386/microvm.h b/include/hw/i386/microvm.h
index b9ac34a3ef..e73d1e65de 100644
--- a/include/hw/i386/microvm.h
+++ b/include/hw/i386/microvm.h
@@ -102,8 +102,6 @@ struct MicrovmMachineState {
     Notifier powerdown_req;
     struct GPEXConfig gpex;
 
-    /* device tree */
-    void *fdt;
     uint32_t ioapic_phandle[2];
 };
 

From 1eb18789f8863e7ee89c1dc06b2de806442b4927 Mon Sep 17 00:00:00 2001
From: Osama Abdelkader <osama.abdelkader@gmail.com>
Date: Mon, 3 Nov 2025 01:19:03 +0200
Subject: [PATCH 2043/2396] hw/audio: Remove dead code from ac97_realize
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove unnecessary PCI configuration register initialization that was
marked with TODO comments indicating it's redundant:
- PCI_COMMAND register is already 0x00 by default, no need to override
- PCI_BASE_ADDRESS_0 registers are automatically set by pci_register_bar()

This aligns the code with the pattern used by other PCI audio devices
in QEMU (via-ac97, intel-hda, es1370) and removes 15 lines of dead code.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251102231903.65409-1-osama.abdelkader@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/audio/ac97.c | 19 -------------------
 1 file changed, 19 deletions(-)

diff --git a/hw/audio/ac97.c b/hw/audio/ac97.c
index be7a39377f..60daa62ea3 100644
--- a/hw/audio/ac97.c
+++ b/hw/audio/ac97.c
@@ -1279,30 +1279,11 @@ static void ac97_realize(PCIDevice *dev, Error **errp)
         return;
     }
 
-    /* TODO: no need to override */
-    c[PCI_COMMAND] = 0x00;      /* pcicmd pci command rw, ro */
-    c[PCI_COMMAND + 1] = 0x00;
-
-    /* TODO: */
     c[PCI_STATUS] = PCI_STATUS_FAST_BACK;      /* pcists pci status rwc, ro */
     c[PCI_STATUS + 1] = PCI_STATUS_DEVSEL_MEDIUM >> 8;
 
     c[PCI_CLASS_PROG] = 0x00;      /* pi programming interface ro */
 
-    /* TODO set when bar is registered. no need to override. */
-    /* nabmar native audio mixer base address rw */
-    c[PCI_BASE_ADDRESS_0] = PCI_BASE_ADDRESS_SPACE_IO;
-    c[PCI_BASE_ADDRESS_0 + 1] = 0x00;
-    c[PCI_BASE_ADDRESS_0 + 2] = 0x00;
-    c[PCI_BASE_ADDRESS_0 + 3] = 0x00;
-
-    /* TODO set when bar is registered. no need to override. */
-      /* nabmbar native audio bus mastering base address rw */
-    c[PCI_BASE_ADDRESS_0 + 4] = PCI_BASE_ADDRESS_SPACE_IO;
-    c[PCI_BASE_ADDRESS_0 + 5] = 0x00;
-    c[PCI_BASE_ADDRESS_0 + 6] = 0x00;
-    c[PCI_BASE_ADDRESS_0 + 7] = 0x00;
-
     c[PCI_INTERRUPT_LINE] = 0x00;      /* intr_ln interrupt line rw */
     c[PCI_INTERRUPT_PIN] = 0x01;      /* intr_pn interrupt pin ro */
 

From 139fbddfd92a280b2eb5fd1b3fc2761e720df7b4 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 5 Nov 2025 13:39:43 +0100
Subject: [PATCH 2044/2396] qapi/migration: Rewrap to 70 columns

Avoid

In file included from ../publish/qapi/qapi-schema.json:53:
.../qapi/migration.json:1750:1: documentation line longer than 70 characters

Fixes: ae00f0088ff ("migration/qmp: Update "resume" flag doc in "migrate" command")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 qapi/migration.json | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/qapi/migration.json b/qapi/migration.json
index 6acd9e4b16..cf023bd29d 100644
--- a/qapi/migration.json
+++ b/qapi/migration.json
@@ -1747,10 +1747,11 @@
 # @detach: this argument exists only for compatibility reasons and is
 #     ignored by QEMU
 #
-# @resume: when set, use the new uri/channels specified to resume paused
-#     postcopy migration.  This flag should only be used if the previous
-#     postcopy migration was interrupted.  The command will fail unless
-#     migration is in "postcopy-paused" state.  (default: false, since 3.0)
+# @resume: when set, use the new uri/channels specified to resume
+#     paused postcopy migration.  This flag should only be used if
+#     the previous postcopy migration was interrupted.  The command
+#     will fail unless migration is in "postcopy-paused" state.
+#     (default: false, since 3.0)
 #
 # Features:
 #

From 9d1bccac8f1090a51468fddccfeb6e0c92bcb9ca Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 4 Nov 2025 00:10:30 +0530
Subject: [PATCH 2045/2396] ncr710: Fix potential null pointer dereference

The code dereferences s->current before checking if it is NULL. Move the
null check before the dereference to prevent potential crashes.

This issue could occur if s->current is NULL when the function reaches
the "Host adapter (re)connected" path, though this should not normally
happen during correct operation.

Reported-by: Stefan Hajnoczi <stefanha@gmail.com>
Reported-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Suggested-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/scsi/ncr53c710.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c
index ade951b1d1..a35c41b67f 100644
--- a/hw/scsi/ncr53c710.c
+++ b/hw/scsi/ncr53c710.c
@@ -832,12 +832,11 @@ void ncr710_transfer_data(SCSIRequest *req, uint32_t len)
     }
 
     /* Host adapter (re)connected */
-    s->current->dma_len = len;
     s->command_complete = NCR710_CMD_DATA_READY;
-
     if (!s->current) {
         return;
     }
+    s->current->dma_len = len;
 
     if (s->waiting) {
         s->scntl1 |= NCR710_SCNTL1_CON;

From 32878c6b4a2e399435bea0d0a2075c9379e55473 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Tue, 4 Nov 2025 00:10:31 +0530
Subject: [PATCH 2046/2396] ncr710: Drop leftover debug code

That code was part of some debugging code. Now it has no effect any
longer, so let's drop it.

Reported-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/scsi/ncr53c710.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c
index a35c41b67f..aaac31cbb9 100644
--- a/hw/scsi/ncr53c710.c
+++ b/hw/scsi/ncr53c710.c
@@ -1361,11 +1361,6 @@ again:
         case PHASE_DI:
             s->waiting = NCR710_WAIT_DMA;
             ncr710_do_dma(s, 0);
-            if (s->waiting != NCR710_WAIT_NONE) {
-                /* Async - stop and wait */
-                break;
-            }
-            /* Sync - continue execution */
             break;
         case PHASE_CO:
             ncr710_do_command(s);

From 343166a084c522e8090bea6e8ef0137e85759591 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Thu, 6 Nov 2025 21:06:23 +0530
Subject: [PATCH 2047/2396] i82596: Remove crc_valid variable

While testing and developing for the HPUX 10.20 the crc_valid variable
was used in performing CRC checks for the loopback. I expected the
CRC to be absent on specific condition and would skip some
functional checks for the loopback packet, so initially it added
a if-clause that would skip the checks preventing HPUX from
getting stuck at phase loopback.

However, we can remove it, and this then fixes Coverity CID 1642868.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/net/i82596.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index 37dcc0387b..fb6b54fd71 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -992,7 +992,6 @@ static ssize_t i82596_receive_packet(I82596State *s, const uint8_t *buf,
     size_t payload_size = 0;
     size_t bytes_copied = 0;
     const uint8_t *packet_data = buf;
-    bool crc_valid = true;
     bool out_of_resources = false;
     size_t crc_size = i82596_get_crc_size(s);
 
@@ -1155,16 +1154,11 @@ rx_complete:
         }
     }
 
-    if (packet_completed && crc_valid) {
+    if (packet_completed) {
         rx_status |= STAT_C | STAT_OK;
         if (is_broadcast) {
             rx_status |= 0x0001;
         }
-    } else if (packet_completed) {
-        rx_status |= STAT_C;
-        if (!crc_valid) {
-            rx_status |= RX_CRC_ERRORS;
-        }
     } else {
         rx_status |= STAT_B;
     }
@@ -1187,7 +1181,7 @@ rx_complete:
         return size;
     }
 
-    if (packet_completed && crc_valid && s->rx_status == RX_READY) {
+    if (packet_completed && s->rx_status == RX_READY) {
         uint32_t next_rfd_addr = i82596_translate_address(s, rfd.link, false);
         if (next_rfd_addr != 0 && next_rfd_addr != I596_NULL) {
             set_uint32(s->scb + 8, next_rfd_addr);

From 54c1e9cdeee71b84f1e78d01f3e083cf5158bd08 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Thu, 6 Nov 2025 21:06:24 +0530
Subject: [PATCH 2048/2396] i82596: Adding proper break-statement functionality
 in RX functions

Fix coverty reported logic error CID 1642873.
The initial issue was the break statement exited out of the for loop
unconditionally.
Now, the break only happens if rfd is null, out_of_resources or
bytes_copied < payload_size.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/net/i82596.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index fb6b54fd71..af1abd4996 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -1092,6 +1092,7 @@ static ssize_t i82596_receive_packet(I82596State *s, const uint8_t *buf,
                     rx_status |= RFD_STATUS_TRUNC | RFD_STATUS_NOBUFS;
                     i82596_record_error(s, RFD_STATUS_NOBUFS, false);
                     packet_completed = true;
+                    break;
                 } else {
                     hwaddr remaining_rbd = I596_NULL;
                     size_t rbd_bytes = i82596_rx_copy_to_rbds(
@@ -1118,17 +1119,18 @@ static ssize_t i82596_receive_packet(I82596State *s, const uint8_t *buf,
                         i82596_record_error(s, RFD_STATUS_NOBUFS, false);
                         rx_status |= RFD_STATUS_TRUNC | RFD_STATUS_NOBUFS;
                         packet_completed = true;
+                        break;
                     }
 
                     if (bytes_copied < payload_size) {
                         trace_i82596_rx_incomplete(bytes_copied, payload_size);
                         rx_status |= RFD_STATUS_TRUNC;
                         packet_completed = true;
+                        break;
                     }
                 }
             }
         }
-        break;
 
     } while (bytes_copied < payload_size);
 

From 0f1f73bb37bb9e93d108e044224ecad9e4ecb3a5 Mon Sep 17 00:00:00 2001
From: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Date: Mon, 3 Nov 2025 20:32:07 +0000
Subject: [PATCH 2049/2396] MAINTAINERS: Update entry for AMD-Vi Emulation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Add myself as maintainer and Sairaj Kodilkar as reviewer.

Reviewed-by: Cédric Le Goater <clg@redhat.com>
Acked-by: Sairaj Kodilkar <sarunkod@amd.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251103203209.645434-2-alejandro.j.jimenez@oracle.com>
---
 MAINTAINERS | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index be6efff80c..9cb181e1da 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3933,8 +3933,10 @@ F: tests/functional/x86_64/test_intel_iommu.py
 F: tests/qtest/intel-iommu-test.c
 
 AMD-Vi Emulation
-S: Orphan
-F: hw/i386/amd_iommu.?
+M: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
+R: Sairaj Kodilkar <sarunkod@amd.com>
+S: Supported
+F: hw/i386/amd_iommu*
 
 OpenSBI Firmware
 L: qemu-riscv@nongnu.org

From 27d6a0ec0beec45c35a70cd5f12c4530725dda2a Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Mon, 3 Nov 2025 20:32:08 +0000
Subject: [PATCH 2050/2396] amd_iommu: Fix handling of devices on buses != 0

The AMD IOMMU is set up at boot time and uses PCI bus numbers + devfn for
indexing into the DTE. The problem is that before the guest starts, all PCI
bus numbers are 0 as no PCI discovery has happened yet (BIOS and/or kernel
will do that later), so relying on the bus number is wrong.
The immediate effect is that emulated devices cannot do DMA when placed on a
bus other than 0.

Replace the static address_space array with a hash table keyed by devfn and
PCIBus*, since these values do not change after the guest boots.

Co-developed-by: Alexey Kardashevskiy <aik@amd.com>
Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Tested-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251103203209.645434-3-alejandro.j.jimenez@oracle.com>
---
 hw/i386/amd_iommu.c | 134 ++++++++++++++++++++++++++------------------
 hw/i386/amd_iommu.h |   2 +-
 2 files changed, 79 insertions(+), 57 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 378e0cb55e..5c5cfd4989 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -59,7 +59,7 @@ const char *amdvi_mmio_high[] = {
 };
 
 struct AMDVIAddressSpace {
-    uint8_t bus_num;            /* bus number                           */
+    PCIBus *bus;                /* PCIBus (for bus number)              */
     uint8_t devfn;              /* device function                      */
     AMDVIState *iommu_state;    /* AMDVI - one per machine              */
     MemoryRegion root;          /* AMDVI Root memory map region         */
@@ -101,6 +101,11 @@ typedef enum AMDVIFaultReason {
     AMDVI_FR_PT_ENTRY_INV,      /* Failure to read PTE from guest memory */
 } AMDVIFaultReason;
 
+typedef struct AMDVIAsKey {
+    PCIBus *bus;
+    uint8_t devfn;
+} AMDVIAsKey;
+
 uint64_t amdvi_extended_feature_register(AMDVIState *s)
 {
     uint64_t feature = AMDVI_DEFAULT_EXT_FEATURES;
@@ -382,6 +387,44 @@ static guint amdvi_uint64_hash(gconstpointer v)
     return (guint)*(const uint64_t *)v;
 }
 
+static gboolean amdvi_as_equal(gconstpointer v1, gconstpointer v2)
+{
+    const AMDVIAsKey *key1 = v1;
+    const AMDVIAsKey *key2 = v2;
+
+    return key1->bus == key2->bus && key1->devfn == key2->devfn;
+}
+
+static guint amdvi_as_hash(gconstpointer v)
+{
+    const AMDVIAsKey *key = v;
+    guint bus = (guint)(uintptr_t)key->bus;
+
+    return (guint)(bus << 8 | (guint)key->devfn);
+}
+
+static AMDVIAddressSpace *amdvi_as_lookup(AMDVIState *s, PCIBus *bus,
+                                          uint8_t devfn)
+{
+    const AMDVIAsKey key = { .bus = bus, .devfn = devfn };
+    return g_hash_table_lookup(s->address_spaces, &key);
+}
+
+static gboolean amdvi_find_as_by_devid(gpointer key, gpointer value,
+                                       gpointer user_data)
+{
+    const AMDVIAsKey *as = key;
+    const uint16_t *devidp = user_data;
+
+    return *devidp == PCI_BUILD_BDF(pci_bus_num(as->bus), as->devfn);
+}
+
+static AMDVIAddressSpace *amdvi_get_as_by_devid(AMDVIState *s, uint16_t devid)
+{
+    return g_hash_table_find(s->address_spaces,
+                             amdvi_find_as_by_devid, &devid);
+}
+
 static AMDVIIOTLBEntry *amdvi_iotlb_lookup(AMDVIState *s, hwaddr addr,
                                            uint64_t devid)
 {
@@ -551,7 +594,7 @@ static inline uint64_t amdvi_get_pte_entry(AMDVIState *s, uint64_t pte_addr,
 
 static int amdvi_as_to_dte(AMDVIAddressSpace *as, uint64_t *dte)
 {
-    uint16_t devid = PCI_BUILD_BDF(as->bus_num, as->devfn);
+    uint16_t devid = PCI_BUILD_BDF(pci_bus_num(as->bus), as->devfn);
     AMDVIState *s = as->iommu_state;
 
     if (!amdvi_get_dte(s, devid, dte)) {
@@ -1011,25 +1054,15 @@ static void amdvi_switch_address_space(AMDVIAddressSpace *amdvi_as)
  */
 static void amdvi_reset_address_translation_all(AMDVIState *s)
 {
-    AMDVIAddressSpace **iommu_as;
+    AMDVIAddressSpace *iommu_as;
+    GHashTableIter as_it;
 
-    for (int bus_num = 0; bus_num < PCI_BUS_MAX; bus_num++) {
+    g_hash_table_iter_init(&as_it, s->address_spaces);
 
-        /* Nothing to do if there are no devices on the current bus */
-        if (!s->address_spaces[bus_num]) {
-            continue;
-        }
-        iommu_as = s->address_spaces[bus_num];
-
-        for (int devfn = 0; devfn < PCI_DEVFN_MAX; devfn++) {
-
-            if (!iommu_as[devfn]) {
-                continue;
-            }
-            /* Use passthrough as default mode after reset */
-            iommu_as[devfn]->addr_translation = false;
-            amdvi_switch_address_space(iommu_as[devfn]);
-        }
+    while (g_hash_table_iter_next(&as_it, NULL, (void **)&iommu_as)) {
+        /* Use passthrough as default mode after reset */
+        iommu_as->addr_translation = false;
+        amdvi_switch_address_space(iommu_as);
     }
 }
 
@@ -1089,27 +1122,15 @@ static void enable_nodma_mode(AMDVIAddressSpace *as)
  */
 static void amdvi_update_addr_translation_mode(AMDVIState *s, uint16_t devid)
 {
-    uint8_t bus_num, devfn, dte_mode;
+    uint8_t dte_mode;
     AMDVIAddressSpace *as;
     uint64_t dte[4] = { 0 };
     int ret;
 
-    /*
-     * Convert the devid encoded in the command to a bus and devfn in
-     * order to retrieve the corresponding address space.
-     */
-    bus_num = PCI_BUS_NUM(devid);
-    devfn = devid & 0xff;
-
-    /*
-     * The main buffer of size (AMDVIAddressSpace *) * (PCI_BUS_MAX) has already
-     * been allocated within AMDVIState, but must be careful to not access
-     * unallocated devfn.
-     */
-    if (!s->address_spaces[bus_num] || !s->address_spaces[bus_num][devfn]) {
+    as = amdvi_get_as_by_devid(s, devid);
+    if (!as) {
         return;
     }
-    as = s->address_spaces[bus_num][devfn];
 
     ret = amdvi_as_to_dte(as, dte);
 
@@ -1783,7 +1804,7 @@ static void amdvi_do_translate(AMDVIAddressSpace *as, hwaddr addr,
                                bool is_write, IOMMUTLBEntry *ret)
 {
     AMDVIState *s = as->iommu_state;
-    uint16_t devid = PCI_BUILD_BDF(as->bus_num, as->devfn);
+    uint16_t devid = PCI_BUILD_BDF(pci_bus_num(as->bus), as->devfn);
     AMDVIIOTLBEntry *iotlb_entry = amdvi_iotlb_lookup(s, addr, devid);
     uint64_t entry[4];
     int dte_ret;
@@ -1858,7 +1879,7 @@ static IOMMUTLBEntry amdvi_translate(IOMMUMemoryRegion *iommu, hwaddr addr,
     }
 
     amdvi_do_translate(as, addr, flag & IOMMU_WO, &ret);
-    trace_amdvi_translation_result(as->bus_num, PCI_SLOT(as->devfn),
+    trace_amdvi_translation_result(pci_bus_num(as->bus), PCI_SLOT(as->devfn),
             PCI_FUNC(as->devfn), addr, ret.translated_addr);
     return ret;
 }
@@ -2222,30 +2243,28 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 {
     char name[128];
     AMDVIState *s = opaque;
-    AMDVIAddressSpace **iommu_as, *amdvi_dev_as;
-    int bus_num = pci_bus_num(bus);
+    AMDVIAddressSpace *amdvi_dev_as;
+    AMDVIAsKey *key;
 
-    iommu_as = s->address_spaces[bus_num];
+    amdvi_dev_as = amdvi_as_lookup(s, bus, devfn);
 
     /* allocate memory during the first run */
-    if (!iommu_as) {
-        iommu_as = g_new0(AMDVIAddressSpace *, PCI_DEVFN_MAX);
-        s->address_spaces[bus_num] = iommu_as;
-    }
-
-    /* set up AMD-Vi region */
-    if (!iommu_as[devfn]) {
+    if (!amdvi_dev_as) {
         snprintf(name, sizeof(name), "amd_iommu_devfn_%d", devfn);
 
-        iommu_as[devfn] = g_new0(AMDVIAddressSpace, 1);
-        iommu_as[devfn]->bus_num = (uint8_t)bus_num;
-        iommu_as[devfn]->devfn = (uint8_t)devfn;
-        iommu_as[devfn]->iommu_state = s;
-        iommu_as[devfn]->notifier_flags = IOMMU_NOTIFIER_NONE;
-        iommu_as[devfn]->iova_tree = iova_tree_new();
-        iommu_as[devfn]->addr_translation = false;
+        amdvi_dev_as = g_new0(AMDVIAddressSpace, 1);
+        key = g_new0(AMDVIAsKey, 1);
 
-        amdvi_dev_as = iommu_as[devfn];
+        amdvi_dev_as->bus = bus;
+        amdvi_dev_as->devfn = (uint8_t)devfn;
+        amdvi_dev_as->iommu_state = s;
+        amdvi_dev_as->notifier_flags = IOMMU_NOTIFIER_NONE;
+        amdvi_dev_as->iova_tree = iova_tree_new();
+        amdvi_dev_as->addr_translation = false;
+        key->bus = bus;
+        key->devfn = devfn;
+
+        g_hash_table_insert(s->address_spaces, key, amdvi_dev_as);
 
         /*
          * Memory region relationships looks like (Address range shows
@@ -2288,7 +2307,7 @@ static AddressSpace *amdvi_host_dma_iommu(PCIBus *bus, void *opaque, int devfn)
 
         amdvi_switch_address_space(amdvi_dev_as);
     }
-    return &iommu_as[devfn]->as;
+    return &amdvi_dev_as->as;
 }
 
 static const PCIIOMMUOps amdvi_iommu_ops = {
@@ -2329,7 +2348,7 @@ static int amdvi_iommu_notify_flag_changed(IOMMUMemoryRegion *iommu,
     if (!s->dma_remap && (new & IOMMU_NOTIFIER_MAP)) {
         error_setg_errno(errp, ENOTSUP,
             "device %02x.%02x.%x requires dma-remap=1",
-            as->bus_num, PCI_SLOT(as->devfn), PCI_FUNC(as->devfn));
+            pci_bus_num(as->bus), PCI_SLOT(as->devfn), PCI_FUNC(as->devfn));
         return -ENOTSUP;
     }
 
@@ -2510,6 +2529,9 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
     s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
                                      amdvi_uint64_equal, g_free, g_free);
 
+    s->address_spaces = g_hash_table_new_full(amdvi_as_hash,
+                                     amdvi_as_equal, g_free, g_free);
+
     /* set up MMIO */
     memory_region_init_io(&s->mr_mmio, OBJECT(s), &mmio_mem_ops, s,
                           "amdvi-mmio", AMDVI_MMIO_SIZE);
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index daf82fc85f..38471b95d1 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -408,7 +408,7 @@ struct AMDVIState {
     bool mmio_enabled;
 
     /* for each served device */
-    AMDVIAddressSpace **address_spaces[PCI_BUS_MAX];
+    GHashTable *address_spaces;
 
     /* list of address spaces with registered notifiers */
     QLIST_HEAD(, AMDVIAddressSpace) amdvi_as_with_notifiers;

From 637dc49a3ae6b72cdb6415dcdcdb22ff770f2c8d Mon Sep 17 00:00:00 2001
From: Sairaj Kodilkar <sarunkod@amd.com>
Date: Mon, 3 Nov 2025 20:32:09 +0000
Subject: [PATCH 2051/2396] amd_iommu: Support 64-bit address for IOTLB lookup

The physical AMD IOMMU supports up to 64 bits of IOVA. When a device tries
to read or write from a given DMA address, the IOMMU translates the address
using the I/O page tables assigned to that device. Since the emulated IOMMU
uses per-device page tables, an ideal cache tag would need to be 68 bits
(64-bit address - 12-bit page alignment + 16-bit device ID).

The current software IOTLB implementation uses a GLib hash table with a
64-bit key to hash both the IOVA and device ID, which limits the IOVA to 60
bits. This causes a failure while setting up the device when a guest is
booted with "iommu.forcedac=1", which forces the use of DMA addresses at the
top of the 64-bit address space.

To address this issue, construct the 64-bit hash key using the upper 52 bits
of IOVA (GFN) and lower 12 bits of the device ID to avoid truncation as much
as possible (reducing hash collisions).

Fixes: d29a09ca6842 ("hw/i386: Introduce AMD IOMMU")
Signed-off-by: Sairaj Kodilkar <sarunkod@amd.com>
Reviewed-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Tested-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Signed-off-by: Alejandro Jimenez <alejandro.j.jimenez@oracle.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251103203209.645434-4-alejandro.j.jimenez@oracle.com>
---
 hw/i386/amd_iommu.c | 57 ++++++++++++++++++++++++++++++---------------
 hw/i386/amd_iommu.h |  4 ++--
 2 files changed, 40 insertions(+), 21 deletions(-)

diff --git a/hw/i386/amd_iommu.c b/hw/i386/amd_iommu.c
index 5c5cfd4989..d689a06eca 100644
--- a/hw/i386/amd_iommu.c
+++ b/hw/i386/amd_iommu.c
@@ -106,6 +106,11 @@ typedef struct AMDVIAsKey {
     uint8_t devfn;
 } AMDVIAsKey;
 
+typedef struct AMDVIIOTLBKey {
+    uint64_t gfn;
+    uint16_t devid;
+} AMDVIIOTLBKey;
+
 uint64_t amdvi_extended_feature_register(AMDVIState *s)
 {
     uint64_t feature = AMDVI_DEFAULT_EXT_FEATURES;
@@ -377,16 +382,6 @@ static void amdvi_log_pagetab_error(AMDVIState *s, uint16_t devid,
              PCI_STATUS_SIG_TARGET_ABORT);
 }
 
-static gboolean amdvi_uint64_equal(gconstpointer v1, gconstpointer v2)
-{
-    return *((const uint64_t *)v1) == *((const uint64_t *)v2);
-}
-
-static guint amdvi_uint64_hash(gconstpointer v)
-{
-    return (guint)*(const uint64_t *)v;
-}
-
 static gboolean amdvi_as_equal(gconstpointer v1, gconstpointer v2)
 {
     const AMDVIAsKey *key1 = v1;
@@ -425,11 +420,30 @@ static AMDVIAddressSpace *amdvi_get_as_by_devid(AMDVIState *s, uint16_t devid)
                              amdvi_find_as_by_devid, &devid);
 }
 
+static gboolean amdvi_iotlb_equal(gconstpointer v1, gconstpointer v2)
+{
+    const AMDVIIOTLBKey *key1 = v1;
+    const AMDVIIOTLBKey *key2 = v2;
+
+    return key1->devid == key2->devid && key1->gfn == key2->gfn;
+}
+
+static guint amdvi_iotlb_hash(gconstpointer v)
+{
+    const AMDVIIOTLBKey *key = v;
+    /* Use GPA and DEVID to find the bucket */
+    return (guint)(key->gfn << AMDVI_PAGE_SHIFT_4K |
+                   (key->devid & ~AMDVI_PAGE_MASK_4K));
+}
+
+
 static AMDVIIOTLBEntry *amdvi_iotlb_lookup(AMDVIState *s, hwaddr addr,
                                            uint64_t devid)
 {
-    uint64_t key = (addr >> AMDVI_PAGE_SHIFT_4K) |
-                   ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
+    AMDVIIOTLBKey key = {
+        .gfn = AMDVI_GET_IOTLB_GFN(addr),
+        .devid = devid,
+    };
     return g_hash_table_lookup(s->iotlb, &key);
 }
 
@@ -451,8 +465,10 @@ static gboolean amdvi_iotlb_remove_by_devid(gpointer key, gpointer value,
 static void amdvi_iotlb_remove_page(AMDVIState *s, hwaddr addr,
                                     uint64_t devid)
 {
-    uint64_t key = (addr >> AMDVI_PAGE_SHIFT_4K) |
-                   ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
+    AMDVIIOTLBKey key = {
+        .gfn = AMDVI_GET_IOTLB_GFN(addr),
+        .devid = devid,
+    };
     g_hash_table_remove(s->iotlb, &key);
 }
 
@@ -463,8 +479,10 @@ static void amdvi_update_iotlb(AMDVIState *s, uint16_t devid,
     /* don't cache erroneous translations */
     if (to_cache.perm != IOMMU_NONE) {
         AMDVIIOTLBEntry *entry = g_new(AMDVIIOTLBEntry, 1);
-        uint64_t *key = g_new(uint64_t, 1);
-        uint64_t gfn = gpa >> AMDVI_PAGE_SHIFT_4K;
+        AMDVIIOTLBKey *key = g_new(AMDVIIOTLBKey, 1);
+
+        key->gfn = AMDVI_GET_IOTLB_GFN(gpa);
+        key->devid = devid;
 
         trace_amdvi_cache_update(domid, PCI_BUS_NUM(devid), PCI_SLOT(devid),
                 PCI_FUNC(devid), gpa, to_cache.translated_addr);
@@ -477,7 +495,8 @@ static void amdvi_update_iotlb(AMDVIState *s, uint16_t devid,
         entry->perms = to_cache.perm;
         entry->translated_addr = to_cache.translated_addr;
         entry->page_mask = to_cache.addr_mask;
-        *key = gfn | ((uint64_t)(devid) << AMDVI_DEVID_SHIFT);
+        entry->devid = devid;
+
         g_hash_table_replace(s->iotlb, key, entry);
     }
 }
@@ -2526,8 +2545,8 @@ static void amdvi_sysbus_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    s->iotlb = g_hash_table_new_full(amdvi_uint64_hash,
-                                     amdvi_uint64_equal, g_free, g_free);
+    s->iotlb = g_hash_table_new_full(amdvi_iotlb_hash,
+                                     amdvi_iotlb_equal, g_free, g_free);
 
     s->address_spaces = g_hash_table_new_full(amdvi_as_hash,
                                      amdvi_as_equal, g_free, g_free);
diff --git a/hw/i386/amd_iommu.h b/hw/i386/amd_iommu.h
index 38471b95d1..302ccca512 100644
--- a/hw/i386/amd_iommu.h
+++ b/hw/i386/amd_iommu.h
@@ -220,8 +220,8 @@
 #define PAGE_SIZE_PTE_COUNT(pgsz)       (1ULL << ((ctz64(pgsz) - 12) % 9))
 
 /* IOTLB */
-#define AMDVI_IOTLB_MAX_SIZE 1024
-#define AMDVI_DEVID_SHIFT    36
+#define AMDVI_IOTLB_MAX_SIZE        1024
+#define AMDVI_GET_IOTLB_GFN(addr)   (addr >> AMDVI_PAGE_SHIFT_4K)
 
 /* default extended feature */
 #define AMDVI_DEFAULT_EXT_FEATURES \

From fde5930cc37175cfcd0f03a089e26f4458a52311 Mon Sep 17 00:00:00 2001
From: Albert Esteve <aesteve@redhat.com>
Date: Fri, 17 Oct 2025 09:20:11 +0200
Subject: [PATCH 2052/2396] vhost-user: fix shared object lookup handler logic

Refactor backend_read() function and add a reply_ack variable
to have the option for handlers to force tweak whether they should
send a reply or not without depending on VHOST_USER_NEED_REPLY_MASK
flag.

This fixes an issue with
vhost_user_backend_handle_shared_object_lookup() logic, as the
error path was not closing the backend channel correctly. So,
we can remove the reply call from within the handler, make
sure it returns early on errors as other handlers do and
set the reply_ack variable on backend_read() to true to ensure
that it will send a response, thus keeping the original intent.

Fixes: 1609476662 ("vhost-user: add shared_object msg")
Cc: qemu-stable@nongnu.org
Signed-off-by: Albert Esteve <aesteve@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251017072011.1874874-2-aesteve@redhat.com>
---
 hw/virtio/vhost-user.c | 40 +++++++++++++---------------------------
 1 file changed, 13 insertions(+), 27 deletions(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index aac98f898a..4b0fae12ae 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -1668,14 +1668,6 @@ static bool vhost_user_send_resp(QIOChannel *ioc, VhostUserHeader *hdr,
     return !qio_channel_writev_all(ioc, iov, ARRAY_SIZE(iov), errp);
 }
 
-static bool
-vhost_user_backend_send_dmabuf_fd(QIOChannel *ioc, VhostUserHeader *hdr,
-                                  VhostUserPayload *payload, Error **errp)
-{
-    hdr->size = sizeof(payload->u64);
-    return vhost_user_send_resp(ioc, hdr, payload, errp);
-}
-
 int vhost_user_get_shared_object(struct vhost_dev *dev, unsigned char *uuid,
                                  int *dmabuf_fd)
 {
@@ -1716,19 +1708,15 @@ int vhost_user_get_shared_object(struct vhost_dev *dev, unsigned char *uuid,
 
 static int
 vhost_user_backend_handle_shared_object_lookup(struct vhost_user *u,
-                                               QIOChannel *ioc,
-                                               VhostUserHeader *hdr,
-                                               VhostUserPayload *payload)
+                                               VhostUserShared *object)
 {
     QemuUUID uuid;
     CharFrontend *chr = u->user->chr;
-    Error *local_err = NULL;
     int dmabuf_fd = -1;
     int fd_num = 0;
 
-    memcpy(uuid.data, payload->object.uuid, sizeof(payload->object.uuid));
+    memcpy(uuid.data, object->uuid, sizeof(object->uuid));
 
-    payload->u64 = 0;
     switch (virtio_object_type(&uuid)) {
     case TYPE_DMABUF:
         dmabuf_fd = virtio_lookup_dmabuf(&uuid);
@@ -1737,18 +1725,16 @@ vhost_user_backend_handle_shared_object_lookup(struct vhost_user *u,
     {
         struct vhost_dev *dev = virtio_lookup_vhost_device(&uuid);
         if (dev == NULL) {
-            payload->u64 = -EINVAL;
-            break;
+            return -EINVAL;
         }
         int ret = vhost_user_get_shared_object(dev, uuid.data, &dmabuf_fd);
         if (ret < 0) {
-            payload->u64 = ret;
+            return ret;
         }
         break;
     }
     case TYPE_INVALID:
-        payload->u64 = -EINVAL;
-        break;
+        return -EINVAL;
     }
 
     if (dmabuf_fd != -1) {
@@ -1757,11 +1743,6 @@ vhost_user_backend_handle_shared_object_lookup(struct vhost_user *u,
 
     if (qemu_chr_fe_set_msgfds(chr, &dmabuf_fd, fd_num) < 0) {
         error_report("Failed to set msg fds.");
-        payload->u64 = -EINVAL;
-    }
-
-    if (!vhost_user_backend_send_dmabuf_fd(ioc, hdr, payload, &local_err)) {
-        error_report_err(local_err);
         return -EINVAL;
     }
 
@@ -1790,6 +1771,7 @@ static gboolean backend_read(QIOChannel *ioc, GIOCondition condition,
     struct iovec iov;
     g_autofree int *fd = NULL;
     size_t fdsize = 0;
+    bool reply_ack;
     int i;
 
     /* Read header */
@@ -1808,6 +1790,8 @@ static gboolean backend_read(QIOChannel *ioc, GIOCondition condition,
         goto err;
     }
 
+    reply_ack = hdr.flags & VHOST_USER_NEED_REPLY_MASK;
+
     /* Read payload */
     if (qio_channel_read_all(ioc, (char *) &payload, hdr.size, &local_err)) {
         error_report_err(local_err);
@@ -1833,8 +1817,10 @@ static gboolean backend_read(QIOChannel *ioc, GIOCondition condition,
                                                              &payload.object);
         break;
     case VHOST_USER_BACKEND_SHARED_OBJECT_LOOKUP:
-        ret = vhost_user_backend_handle_shared_object_lookup(dev->opaque, ioc,
-                                                             &hdr, &payload);
+        /* The backend always expects a response */
+        reply_ack = true;
+        ret = vhost_user_backend_handle_shared_object_lookup(dev->opaque,
+                                                             &payload.object);
         break;
     default:
         error_report("Received unexpected msg type: %d.", hdr.request);
@@ -1845,7 +1831,7 @@ static gboolean backend_read(QIOChannel *ioc, GIOCondition condition,
      * REPLY_ACK feature handling. Other reply types has to be managed
      * directly in their request handlers.
      */
-    if (hdr.flags & VHOST_USER_NEED_REPLY_MASK) {
+    if (reply_ack) {
         payload.u64 = !!ret;
         hdr.size = sizeof(payload.u64);
 

From 48387ec49209a6aa0906999788129259f35c5d6b Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 1 Nov 2025 17:52:36 +0100
Subject: [PATCH 2053/2396] hw/ppc/pegasos: Fix memory leak

Commit 9099b430a4 introduced an early return that caused a leak of a
GString. Allocate it later to avoid the leak.

Fixes: 9099b430a4 (hw/ppc/pegasos2: Change device tree generation)
Resolves: Coverity CID 1642027
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Link: https://lore.kernel.org/r/20251101165236.76E8B5972E3@zero.eik.bme.hu
Message-ID: <20251101165236.76E8B5972E3@zero.eik.bme.hu>
---
 hw/ppc/pegasos.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ppc/pegasos.c b/hw/ppc/pegasos.c
index 3a498edd16..8ce185de3e 100644
--- a/hw/ppc/pegasos.c
+++ b/hw/ppc/pegasos.c
@@ -847,7 +847,7 @@ static struct {
 static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
 {
     FDTInfo *fi = opaque;
-    GString *node = g_string_new(NULL);
+    GString *node;
     uint32_t cells[(PCI_NUM_REGIONS + 1) * 5];
     int i, j;
     const char *name = NULL;
@@ -871,6 +871,7 @@ static void add_pci_device(PCIBus *bus, PCIDevice *d, void *opaque)
             break;
         }
     }
+    node = g_string_new(NULL);
     g_string_printf(node, "%s/%s@%x", fi->path, (name ?: pn),
                     PCI_SLOT(d->devfn));
     if (PCI_FUNC(d->devfn)) {

From 3149969a9f4d74ea8e568c91efbe4b2c4d336ba8 Mon Sep 17 00:00:00 2001
From: BALATON Zoltan <balaton@eik.bme.hu>
Date: Sat, 8 Nov 2025 20:37:17 +0100
Subject: [PATCH 2054/2396] pc-bios/dtb/pegasos*.dtb: Fix compiled dtb blobs

When adding these files somehow an incomplete version was committed.
Regenerate and update these dtb files to match the dts which fixes
problems caused by missing nodes in the dtb.

Fixes: 9099b430a4 (hw/ppc/pegasos2: Change device tree generation)
Fixes: 3c21f9dfcf (hw/ppc/pegasos2: Add VOF support for pegasos1)
Signed-off-by: BALATON Zoltan <balaton@eik.bme.hu>
Reported-by: Yogesh Vyas <yvyas1991@gmail.com>
Tested-by: Yogesh Vyas <yvyas1991@gmail.com>
Message-Id: <20251108193717.DADA9597302@zero.eik.bme.hu>
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
---
 pc-bios/dtb/pegasos1.dtb | Bin 857 -> 1975 bytes
 pc-bios/dtb/pegasos2.dtb | Bin 1701 -> 2963 bytes
 2 files changed, 0 insertions(+), 0 deletions(-)

diff --git a/pc-bios/dtb/pegasos1.dtb b/pc-bios/dtb/pegasos1.dtb
index 3b863b25288a59bcede9459ff42afad713dde741..b776861602055ed068cac103ad8b2e9faad1e6e5 100644
GIT binary patch
literal 1975
zcmcb>`|m9S1N(Lc1_lcT2DTgq1_liV1_nU}1_l8JFktj%U|=%=Gf@dfD3_Umfq@0e
z28n_AtPBhc{K*+b1yFI27zYCbgLFV@dSY>YF-RCB2EvMljvy`rh|SHwz@U{>kdv6F
z;GUc00T&19wM5e^!@$7c4i!^y_6Q142*@u_Eedc}2(BzHNzDamX3Q^0%_}I%2Xh!0
zz;=NA1#^dvfu3QKp^-62EfWI+17mVVesO9Zh|2)x=ceZ77gahKfJGqs*+G7Th=WBz
z?gqIp8q9+bV7<u&rC^Uj?FEHVJVYAo4iF#2g@qZ2pAB*Y0|UhFw8YGu;>5I6kRqrV
zV7rS`i!u{IF$GmukeumYVE_S0YC-1l7bItbgg|Zt@nLKjALJg8TVeb{#y<-}p>~1P
zH~#wo(gJob*pCei3=H*PA+Q)IhUS1g01;wf_y=P&KpY3+g7kneh+PZy9Ekmwfq?;p
zL2RfQAa{W5Squ_`V#dtkL<e&S2P6-2*IEV!K{h0JZf9U<GDPAZgr;AZ`m+pdU>jik
z8w?CmUy#&4g(P{fpF|iK7^1=10b(aI3DeJ?S)2$Ghw(vd<ZuLqE675a{7;YqB>M^(
z>NP|Wd`6I;KuQ=PaqEz2lx6|qgY=`vIY^8L;zkBW1_q`d3=9mQFawEmFfcIkL(PTh
z2bo<6;y{C*(ZayQ$RX1VIZcDy3epEs1~Lc9e1-%D1_n@m28kn^1>!R@FfdAiG(qhI
z$%D8c^FZ<-J}4|eVo*M#KGYqc@M6qPtxU>KEJ{Ih4<{&(!Q?=iq2}Xq7tG%vdqK*<
zW*3ztJ7k)Jy$Q9OfxoCE86*$lBbx;(r$Bl@;xMy7VG2_V@&_yoL29@e7#JN=iVck|
zOm(3~Lh@`$W^QVcL#7GXR!DgPN~io_agb>cF=V?Pkm3*79*}z&(^8ThGL6%q#(~o(
zNDY5l3O0W*gK{g#-5@u@`~k8bWHU$%q!;E7u=zO!B@UU!NnpdEVGL5kpHol*(}Uzz
z<~>Mmg_#dZpD?u`y~yT+?0{iT<;0YfqSWGI-Q?7qoMMKQ)UwRv)cBIhf>egw{FKxj
zhN9H6%;L=aJO*cf7gu*zKb^AFyp;SRI2W8!;JlR7;^d;tf)bF1qSSN-<>Jh$RH)g?
z;IcP4CqFq`H?1hOurxI<xst)c$kb9dGp{7IsHn7{L^m-xJ1@UHCp9HKm7ypxFFm!G
zA*r-j7tCaUSgo6x0(B>d1#=&Wot%>h@=1P5DnoH;QZcy30f{3x2oq8>ixYK=bMi}y
u89=0NUSe))F$3HoNKD=2{JfH){G6QBA_ir+0;s2w^K%OlOEQykQW*f+qWZl6

delta 53
zcmdnaf0Iq)0`I@K3=GVX3=9kw3=B+b7#J8d7#J7?85kG@7$9IR0|QgZMvZEw$;oWn
E04;6`OaK4?

diff --git a/pc-bios/dtb/pegasos2.dtb b/pc-bios/dtb/pegasos2.dtb
index 29c35216ec2d77e4083a3ef618ca185925fb5d61..a6935a8c23d85e0251e7f424cf59c8fe54fe593a 100644
GIT binary patch
delta 1271
zcmZ3=J6T-g0`I@K3=G_p85kHW7#KJu7#J8d7#J7?85kG@7{Gw3nt_4i!A6bK%=L_!
z#fc8dU{MBU1_lNe1_s8v3=D#73=DAoa|VVcLnQu3s7WyOe;L>qK_)=?OdJdhQeP12
znM5I$gUu6RU|@)5U`PO|XJBBchtd!VY5)U&W^p1&1jYxknGgmt#4|83fNX@yGiibp
zAmkbQ8R|7e5qu^Ss61nFYEfoljzgwVngvLRnPD<3vrs+A7#@hbK*lotU|?Y2fNJMp
zU|_O`vLRX^VbsqcqX6S`GcYiD7338J_yy>g8h}EIfdS-PMhgQIBZo{g1CT<f86ao#
zBk_3{7@R->0<st!Dy&e2por*4Qpg3eBsrs~KnG+hL;~b+Mg|6^(1|wElZzRJ>zT3`
zAXbB|&rYpO%1<mxL308p0|Ns;Ob%iYIBJlB0L3M+AOJZXq#R@`vX_kwj6uQ-OrY3g
zEGkKM$TSCg8KjT}WLZ%OIE8`u$d(j99SahNSpo`okZB+>^dJCRno?|NY+<SkH4+le
zC7HRYMGl!J^<Zlu2^W-r`N0w(;~-+lmOCItGFFSA5o%}vF%%r4X(`DLnZ{`l5r~;!
z52mGnJ&2x?m_Hy{0`norVIU{r^dZz@b7YHi3Q8O@jg!E(AQA`ze@;OO%q$)Th9Fo<
zV%~$rVs?;9gl0zM)CCS&sKq8o7Bg-Bz`T{IzAQB_CBH~FGld}~wJb9^6~rn^Ez2y<
z%+CX{lXDV_i*=LpQ&Jg<OOuK#i%U{-LE;Dw!i3b!;zZrzocxkv1`w&6mzbMc%#fK^
yl3G+$T2NBVker`ekXVwLl#>b*l`kmKP0r6NDay~uNiAYfhAY-hPR+?FW&i-)Se-5a

delta 54
zcmbO%zLZzv0`I@K3=C{b85kHW7#LViFfcG^FfcF(GB7X*Fn|H$T?Pi02^%#|GjDe0
H*u(??KgkOa


From 43b8c4339709efef153cb2cf21d23d1791890d60 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 17 Oct 2025 05:36:00 -0400
Subject: [PATCH 2055/2396] intel_iommu: Handle PASID cache invalidation

Adds a new entry VTDPASIDCacheEntry in VTDAddressSpace to cache the pasid
entry and track PASID usage and future PASID tagged DMA address translation
support in vIOMMU.

When guest triggers pasid cache invalidation, QEMU will capture it and
update or invalidate pasid cache.

vIOMMU emulator could figure out the reason by fetching latest guest pasid
entry in memory and compare it with cached PASID entry if it's valid.

Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251017093602.525338-2-zhenzhong.duan@intel.com>
---
 hw/i386/intel_iommu.c          | 141 ++++++++++++++++++++++++++++++---
 hw/i386/intel_iommu_internal.h |  17 ++++
 hw/i386/trace-events           |   3 +
 include/hw/i386/intel_iommu.h  |   6 ++
 4 files changed, 157 insertions(+), 10 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index 6a168d5107..c47f13b659 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3051,6 +3051,130 @@ static bool vtd_process_piotlb_desc(IntelIOMMUState *s,
     return true;
 }
 
+static inline int vtd_dev_get_pe_from_pasid(VTDAddressSpace *vtd_as,
+                                            VTDPASIDEntry *pe)
+{
+    IntelIOMMUState *s = vtd_as->iommu_state;
+    VTDContextEntry ce;
+    int ret;
+
+    if (!s->root_scalable) {
+        return -VTD_FR_RTADDR_INV_TTM;
+    }
+
+    ret = vtd_dev_to_context_entry(s, pci_bus_num(vtd_as->bus), vtd_as->devfn,
+                                   &ce);
+    if (ret) {
+        return ret;
+    }
+
+    return vtd_ce_get_rid2pasid_entry(s, &ce, pe, vtd_as->pasid);
+}
+
+/* Update or invalidate pasid cache based on the pasid entry in guest memory. */
+static void vtd_pasid_cache_sync_locked(gpointer key, gpointer value,
+                                        gpointer user_data)
+{
+    VTDPASIDCacheInfo *pc_info = user_data;
+    VTDAddressSpace *vtd_as = value;
+    VTDPASIDCacheEntry *pc_entry = &vtd_as->pasid_cache_entry;
+    VTDPASIDEntry pe;
+    uint16_t did;
+
+    if (vtd_dev_get_pe_from_pasid(vtd_as, &pe)) {
+        /*
+         * No valid pasid entry in guest memory. e.g. pasid entry was modified
+         * to be either all-zero or non-present. Either case means existing
+         * pasid cache should be invalidated.
+         */
+        pc_entry->valid = false;
+        return;
+    }
+
+    /*
+     * VTD_INV_DESC_PASIDC_G_DSI and VTD_INV_DESC_PASIDC_G_PASID_SI require
+     * DID check. If DID doesn't match the value in cache or memory, then
+     * it's not a pasid entry we want to invalidate.
+     */
+    switch (pc_info->type) {
+    case VTD_INV_DESC_PASIDC_G_PASID_SI:
+        if (pc_info->pasid != vtd_as->pasid) {
+            return;
+        }
+        /* Fall through */
+    case VTD_INV_DESC_PASIDC_G_DSI:
+        if (pc_entry->valid) {
+            did = VTD_SM_PASID_ENTRY_DID(pc_entry->pasid_entry.val[1]);
+        } else {
+            did = VTD_SM_PASID_ENTRY_DID(pe.val[1]);
+        }
+        if (pc_info->did != did) {
+            return;
+        }
+    }
+
+    pc_entry->pasid_entry = pe;
+    pc_entry->valid = true;
+}
+
+static void vtd_pasid_cache_sync(IntelIOMMUState *s, VTDPASIDCacheInfo *pc_info)
+{
+    if (!s->root_scalable || !s->dmar_enabled) {
+        return;
+    }
+
+    vtd_iommu_lock(s);
+    g_hash_table_foreach(s->vtd_address_spaces, vtd_pasid_cache_sync_locked,
+                         pc_info);
+    vtd_iommu_unlock(s);
+}
+
+static bool vtd_process_pasid_desc(IntelIOMMUState *s,
+                                   VTDInvDesc *inv_desc)
+{
+    uint16_t did;
+    uint32_t pasid;
+    VTDPASIDCacheInfo pc_info = {};
+    uint64_t mask[4] = {VTD_INV_DESC_PASIDC_RSVD_VAL0, VTD_INV_DESC_ALL_ONE,
+                        VTD_INV_DESC_ALL_ONE, VTD_INV_DESC_ALL_ONE};
+
+    if (!vtd_inv_desc_reserved_check(s, inv_desc, mask, true,
+                                     __func__, "pasid cache inv")) {
+        return false;
+    }
+
+    did = VTD_INV_DESC_PASIDC_DID(inv_desc);
+    pasid = VTD_INV_DESC_PASIDC_PASID(inv_desc);
+    pc_info.type = VTD_INV_DESC_PASIDC_G(inv_desc);
+
+    switch (pc_info.type) {
+    case VTD_INV_DESC_PASIDC_G_DSI:
+        trace_vtd_inv_desc_pasid_cache_dsi(did);
+        pc_info.did = did;
+        break;
+
+    case VTD_INV_DESC_PASIDC_G_PASID_SI:
+        /* PASID selective implies a DID selective */
+        trace_vtd_inv_desc_pasid_cache_psi(did, pasid);
+        pc_info.did = did;
+        pc_info.pasid = pasid ?: PCI_NO_PASID;
+        break;
+
+    case VTD_INV_DESC_PASIDC_G_GLOBAL:
+        trace_vtd_inv_desc_pasid_cache_gsi();
+        break;
+
+    default:
+        error_report_once("invalid granularity field in PASID-cache invalidate "
+                          "descriptor, hi: 0x%"PRIx64" lo: 0x%" PRIx64,
+                           inv_desc->val[1], inv_desc->val[0]);
+        return false;
+    }
+
+    vtd_pasid_cache_sync(s, &pc_info);
+    return true;
+}
+
 static bool vtd_process_inv_iec_desc(IntelIOMMUState *s,
                                      VTDInvDesc *inv_desc)
 {
@@ -3266,6 +3390,13 @@ static bool vtd_process_inv_desc(IntelIOMMUState *s)
         }
         break;
 
+    case VTD_INV_DESC_PC:
+        trace_vtd_inv_desc("pasid-cache", inv_desc.val[1], inv_desc.val[0]);
+        if (!vtd_process_pasid_desc(s, &inv_desc)) {
+            return false;
+        }
+        break;
+
     case VTD_INV_DESC_PIOTLB:
         trace_vtd_inv_desc("p-iotlb", inv_desc.val[1], inv_desc.val[0]);
         if (!vtd_process_piotlb_desc(s, &inv_desc)) {
@@ -3308,16 +3439,6 @@ static bool vtd_process_inv_desc(IntelIOMMUState *s)
         }
         break;
 
-    /*
-     * TODO: the entity of below two cases will be implemented in future series.
-     * To make guest (which integrates scalable mode support patch set in
-     * iommu driver) work, just return true is enough so far.
-     */
-    case VTD_INV_DESC_PC:
-        if (s->scalable_mode) {
-            break;
-        }
-    /* fallthrough */
     default:
         error_report_once("%s: invalid inv desc: hi=%"PRIx64", lo=%"PRIx64
                           " (unknown type)", __func__, inv_desc.hi,
diff --git a/hw/i386/intel_iommu_internal.h b/hw/i386/intel_iommu_internal.h
index 0f6a1237e4..75bafdf0cd 100644
--- a/hw/i386/intel_iommu_internal.h
+++ b/hw/i386/intel_iommu_internal.h
@@ -316,6 +316,8 @@ typedef enum VTDFaultReason {
                                   * request while disabled */
     VTD_FR_IR_SID_ERR = 0x26,   /* Invalid Source-ID */
 
+    VTD_FR_RTADDR_INV_TTM = 0x31,  /* Invalid TTM in RTADDR */
+
     VTD_FR_SM_PRE_ABS = 0x47,   /* SCT.8 : PRE bit in a present SM CE is 0 */
 
     /* PASID directory entry access failure */
@@ -517,6 +519,15 @@ typedef union VTDPRDesc VTDPRDesc;
 #define VTD_INV_DESC_PIOTLB_RSVD_VAL0     0xfff000000000f1c0ULL
 #define VTD_INV_DESC_PIOTLB_RSVD_VAL1     0xf80ULL
 
+/* PASID-cache Invalidate Descriptor (pc_inv_dsc) fields */
+#define VTD_INV_DESC_PASIDC_G(x)        extract64((x)->val[0], 4, 2)
+#define VTD_INV_DESC_PASIDC_G_DSI       0
+#define VTD_INV_DESC_PASIDC_G_PASID_SI  1
+#define VTD_INV_DESC_PASIDC_G_GLOBAL    3
+#define VTD_INV_DESC_PASIDC_DID(x)      extract64((x)->val[0], 16, 16)
+#define VTD_INV_DESC_PASIDC_PASID(x)    extract64((x)->val[0], 32, 20)
+#define VTD_INV_DESC_PASIDC_RSVD_VAL0   0xfff000000000f1c0ULL
+
 /* Page Request Descriptor */
 /* For the low 64-bit of 128-bit */
 #define VTD_PRD_TYPE            (1ULL)
@@ -603,6 +614,12 @@ typedef struct VTDRootEntry VTDRootEntry;
 #define VTD_SM_CONTEXT_ENTRY_RSVD_VAL1      0xffffffffffe00000ULL
 #define VTD_SM_CONTEXT_ENTRY_PRE            0x10ULL
 
+typedef struct VTDPASIDCacheInfo {
+    uint8_t type;
+    uint16_t did;
+    uint32_t pasid;
+} VTDPASIDCacheInfo;
+
 /* PASID Table Related Definitions */
 #define VTD_PASID_DIR_BASE_ADDR_MASK  (~0xfffULL)
 #define VTD_PASID_TABLE_BASE_ADDR_MASK (~0xfffULL)
diff --git a/hw/i386/trace-events b/hw/i386/trace-events
index ac9e1a10aa..298addb24d 100644
--- a/hw/i386/trace-events
+++ b/hw/i386/trace-events
@@ -24,6 +24,9 @@ vtd_inv_qi_head(uint16_t head) "read head %d"
 vtd_inv_qi_tail(uint16_t head) "write tail %d"
 vtd_inv_qi_fetch(void) ""
 vtd_context_cache_reset(void) ""
+vtd_inv_desc_pasid_cache_gsi(void) ""
+vtd_inv_desc_pasid_cache_dsi(uint16_t domain) "Domain selective PC invalidation domain 0x%"PRIx16
+vtd_inv_desc_pasid_cache_psi(uint16_t domain, uint32_t pasid) "PASID selective PC invalidation domain 0x%"PRIx16" pasid 0x%"PRIx32
 vtd_re_not_present(uint8_t bus) "Root entry bus %"PRIu8" not present"
 vtd_ce_not_present(uint8_t bus, uint8_t devfn) "Context entry bus %"PRIu8" devfn %"PRIu8" not present"
 vtd_iotlb_page_hit(uint16_t sid, uint64_t addr, uint64_t slpte, uint16_t domain) "IOTLB page hit sid 0x%"PRIx16" iova 0x%"PRIx64" slpte 0x%"PRIx64" domain 0x%"PRIx16
diff --git a/include/hw/i386/intel_iommu.h b/include/hw/i386/intel_iommu.h
index b2f1ef9595..ca7f7bb661 100644
--- a/include/hw/i386/intel_iommu.h
+++ b/include/hw/i386/intel_iommu.h
@@ -95,6 +95,11 @@ struct VTDPASIDEntry {
     uint64_t val[8];
 };
 
+typedef struct VTDPASIDCacheEntry {
+    struct VTDPASIDEntry pasid_entry;
+    bool valid;
+} VTDPASIDCacheEntry;
+
 struct VTDAddressSpace {
     PCIBus *bus;
     uint8_t devfn;
@@ -107,6 +112,7 @@ struct VTDAddressSpace {
     MemoryRegion iommu_ir_fault; /* Interrupt region for catching fault */
     IntelIOMMUState *iommu_state;
     VTDContextCacheEntry context_cache_entry;
+    VTDPASIDCacheEntry pasid_cache_entry;
     QLIST_ENTRY(VTDAddressSpace) next;
     /* Superset of notifier flags that this address space has */
     IOMMUNotifierFlag notifier_flags;

From baff72ca2a67974cb19499e7f8b7d87675adc746 Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 17 Oct 2025 05:36:01 -0400
Subject: [PATCH 2056/2396] intel_iommu: Reset pasid cache when system level
 reset

Reset pasid cache when system level reset. Currently we don't have any
device supporting PASID yet. So all are PASID_0, its vtd_as is allocated
by PCI system and never removed, just mark pasid cache invalid.

Signed-off-by: Yi Liu <yi.l.liu@intel.com>
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251017093602.525338-3-zhenzhong.duan@intel.com>
---
 hw/i386/intel_iommu.c | 15 +++++++++++++++
 hw/i386/trace-events  |  1 +
 2 files changed, 16 insertions(+)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index c47f13b659..cf0b62f29e 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -87,6 +87,20 @@ struct vtd_iotlb_key {
 static void vtd_address_space_refresh_all(IntelIOMMUState *s);
 static void vtd_address_space_unmap(VTDAddressSpace *as, IOMMUNotifier *n);
 
+static void vtd_pasid_cache_reset_locked(IntelIOMMUState *s)
+{
+    VTDAddressSpace *vtd_as;
+    GHashTableIter as_it;
+
+    trace_vtd_pasid_cache_reset();
+
+    g_hash_table_iter_init(&as_it, s->vtd_address_spaces);
+    while (g_hash_table_iter_next(&as_it, NULL, (void **)&vtd_as)) {
+        VTDPASIDCacheEntry *pc_entry = &vtd_as->pasid_cache_entry;
+        pc_entry->valid = false;
+    }
+}
+
 static void vtd_define_quad(IntelIOMMUState *s, hwaddr addr, uint64_t val,
                             uint64_t wmask, uint64_t w1cmask)
 {
@@ -381,6 +395,7 @@ static void vtd_reset_caches(IntelIOMMUState *s)
     vtd_iommu_lock(s);
     vtd_reset_iotlb_locked(s);
     vtd_reset_context_cache_locked(s);
+    vtd_pasid_cache_reset_locked(s);
     vtd_iommu_unlock(s);
 }
 
diff --git a/hw/i386/trace-events b/hw/i386/trace-events
index 298addb24d..b704f4f90c 100644
--- a/hw/i386/trace-events
+++ b/hw/i386/trace-events
@@ -24,6 +24,7 @@ vtd_inv_qi_head(uint16_t head) "read head %d"
 vtd_inv_qi_tail(uint16_t head) "write tail %d"
 vtd_inv_qi_fetch(void) ""
 vtd_context_cache_reset(void) ""
+vtd_pasid_cache_reset(void) ""
 vtd_inv_desc_pasid_cache_gsi(void) ""
 vtd_inv_desc_pasid_cache_dsi(uint16_t domain) "Domain selective PC invalidation domain 0x%"PRIx16
 vtd_inv_desc_pasid_cache_psi(uint16_t domain, uint32_t pasid) "PASID selective PC invalidation domain 0x%"PRIx16" pasid 0x%"PRIx32

From c9cf33075a4c8eb299e0ac3bb67ad96490499ced Mon Sep 17 00:00:00 2001
From: Zhenzhong Duan <zhenzhong.duan@intel.com>
Date: Fri, 17 Oct 2025 05:36:02 -0400
Subject: [PATCH 2057/2396] intel_iommu: Fix DMA failure when guest switches
 IOMMU domain

Kernel allows user to switch IOMMU domain, e.g., switch between DMA
and identity domain. When this happen in IOMMU scalable mode, a pasid
cache invalidation request is sent, this request is ignored by vIOMMU
which leads to device binding to wrong address space, then DMA fails.

This issue exists in scalable mode with both first stage and second
stage translations, both emulated and passthrough devices.

Take network device for example, below sequence trigger issue:

1. start a guest with iommu=pt
2. echo 0000:01:00.0 > /sys/bus/pci/drivers/virtio-pci/unbind
3. echo DMA > /sys/kernel/iommu_groups/6/type
4. echo 0000:01:00.0 > /sys/bus/pci/drivers/virtio-pci/bind
5. Ping test

Fix it by switching address space in invalidation handler.

Fixes: 4a4f219e8a10 ("intel_iommu: add scalable-mode option to make scalable mode work")
Signed-off-by: Zhenzhong Duan <zhenzhong.duan@intel.com>
Reviewed-by: Yi Liu <yi.l.liu@intel.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251017093602.525338-4-zhenzhong.duan@intel.com>
---
 hw/i386/intel_iommu.c | 29 +++++++++++++++++++++++++++--
 1 file changed, 27 insertions(+), 2 deletions(-)

diff --git a/hw/i386/intel_iommu.c b/hw/i386/intel_iommu.c
index cf0b62f29e..78b142ccea 100644
--- a/hw/i386/intel_iommu.c
+++ b/hw/i386/intel_iommu.c
@@ -3086,6 +3086,11 @@ static inline int vtd_dev_get_pe_from_pasid(VTDAddressSpace *vtd_as,
     return vtd_ce_get_rid2pasid_entry(s, &ce, pe, vtd_as->pasid);
 }
 
+static int vtd_pasid_entry_compare(VTDPASIDEntry *p1, VTDPASIDEntry *p2)
+{
+    return memcmp(p1, p2, sizeof(*p1));
+}
+
 /* Update or invalidate pasid cache based on the pasid entry in guest memory. */
 static void vtd_pasid_cache_sync_locked(gpointer key, gpointer value,
                                         gpointer user_data)
@@ -3094,15 +3099,28 @@ static void vtd_pasid_cache_sync_locked(gpointer key, gpointer value,
     VTDAddressSpace *vtd_as = value;
     VTDPASIDCacheEntry *pc_entry = &vtd_as->pasid_cache_entry;
     VTDPASIDEntry pe;
+    IOMMUNotifier *n;
     uint16_t did;
 
     if (vtd_dev_get_pe_from_pasid(vtd_as, &pe)) {
+        if (!pc_entry->valid) {
+            return;
+        }
         /*
          * No valid pasid entry in guest memory. e.g. pasid entry was modified
          * to be either all-zero or non-present. Either case means existing
          * pasid cache should be invalidated.
          */
         pc_entry->valid = false;
+
+        /*
+         * When a pasid entry isn't valid any more, we should unmap all
+         * mappings in shadow pages instantly to ensure DMA security.
+         */
+        IOMMU_NOTIFIER_FOREACH(n, &vtd_as->iommu) {
+            vtd_address_space_unmap(vtd_as, n);
+        }
+        vtd_switch_address_space(vtd_as);
         return;
     }
 
@@ -3128,8 +3146,15 @@ static void vtd_pasid_cache_sync_locked(gpointer key, gpointer value,
         }
     }
 
-    pc_entry->pasid_entry = pe;
-    pc_entry->valid = true;
+    if (!pc_entry->valid) {
+        pc_entry->pasid_entry = pe;
+        pc_entry->valid = true;
+    } else if (!vtd_pasid_entry_compare(&pe, &pc_entry->pasid_entry)) {
+        return;
+    }
+
+    vtd_switch_address_space(vtd_as);
+    vtd_address_space_sync(vtd_as);
 }
 
 static void vtd_pasid_cache_sync(IntelIOMMUState *s, VTDPASIDCacheInfo *pc_info)

From 1ba9a5220325dd5260a0c37b6299ce38364a5120 Mon Sep 17 00:00:00 2001
From: German Maglione <gmaglione@redhat.com>
Date: Wed, 22 Oct 2025 18:24:05 +0200
Subject: [PATCH 2058/2396] vhost-user: make vhost_set_vring_file() synchronous
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU sends all of VHOST_USER_SET_VRING_KICK, _CALL, and _ERR without
setting the NEED_REPLY flag, i.e. by the time the respective
vhost_user_set_vring_*() function returns, it is completely up to chance
whether the back-end has already processed the request and switched over
to the new FD for interrupts.

At least for vhost_user_set_vring_call(), that is a problem: It is
called through vhost_virtqueue_mask(), which is generally used in the
VirtioDeviceClass.guest_notifier_mask() implementation, which is in turn
called by virtio_pci_one_vector_unmask().  The fact that we do not wait
for the back-end to install the FD leads to a race there:

Masking interrupts is implemented by redirecting interrupts to an
internal event FD that is not connected to the guest.  Unmasking then
re-installs the guest-connected IRQ FD, then checks if there are pending
interrupts left on the masked event FD, and if so, issues an interrupt
to the guest.

Because guest_notifier_mask() (through vhost_user_set_vring_call())
doesn't wait for the back-end to switch over to the actual IRQ FD, it's
possible we check for pending interrupts while the back-end is still
using the masked event FD, and then we will lose interrupts that occur
before the back-end finally does switch over.

Fix this by setting NEED_REPLY on those VHOST_USER_SET_VRING_* messages,
so when we get that reply, we know that the back-end is now using the
new FD.

We have a few reports of a virtiofs mount hanging:
- https://gitlab.com/virtio-fs/virtiofsd/-/issues/101
- https://gitlab.com/virtio-fs/virtiofsd/-/issues/133
- https://gitlab.com/virtio-fs/virtiofsd/-/issues/213

This is quite difficult bug to reproduce, even for the reporters.
It only happens on production, every few weeks, and/or on 1 in 300 VMs.
So, we are not 100% sure this fixes that issue. However, we think this
is still a bug, and at least we have one report that claims this fixed
the issue:

https://gitlab.com/virtio-fs/virtiofsd/-/issues/133#note_2743209419

Fixes: 5f6f6664bf24 ("Add vhost-user as a vhost backend.")
Signed-off-by: German Maglione <gmaglione@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Reviewed-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251022162405.318672-1-gmaglione@redhat.com>
---
 hw/virtio/vhost-user.c | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index 4b0fae12ae..63fa9a1b4b 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -1327,8 +1327,11 @@ static int vhost_set_vring_file(struct vhost_dev *dev,
                                 VhostUserRequest request,
                                 struct vhost_vring_file *file)
 {
+    int ret;
     int fds[VHOST_USER_MAX_RAM_SLOTS];
     size_t fd_num = 0;
+    bool reply_supported = virtio_has_feature(dev->protocol_features,
+                                              VHOST_USER_PROTOCOL_F_REPLY_ACK);
     VhostUserMsg msg = {
         .hdr.request = request,
         .hdr.flags = VHOST_USER_VERSION,
@@ -1336,13 +1339,32 @@ static int vhost_set_vring_file(struct vhost_dev *dev,
         .hdr.size = sizeof(msg.payload.u64),
     };
 
+    if (reply_supported) {
+        msg.hdr.flags |= VHOST_USER_NEED_REPLY_MASK;
+    }
+
     if (file->fd > 0) {
         fds[fd_num++] = file->fd;
     } else {
         msg.payload.u64 |= VHOST_USER_VRING_NOFD_MASK;
     }
 
-    return vhost_user_write(dev, &msg, fds, fd_num);
+    ret = vhost_user_write(dev, &msg, fds, fd_num);
+    if (ret < 0) {
+        return ret;
+    }
+
+    if (reply_supported) {
+        /*
+         * wait for the back-end's confirmation that the new FD is active,
+         * otherwise guest_notifier_mask() could check for pending interrupts
+         * while the back-end is still using the masked event FD, losing
+         * interrupts that occur before the back-end installs the FD
+         */
+        return process_message_reply(dev, &msg);
+    }
+
+    return 0;
 }
 
 static int vhost_user_set_vring_kick(struct vhost_dev *dev,

From 3e6ad83f209ea8cf497e5d160e44c1bc5e518f1a Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Wed, 22 Oct 2025 09:06:37 +0100
Subject: [PATCH 2059/2396] tests/qtest/bios-tables-test: Prepare for _DSM
 change in the DSDT table
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Subsequent patch will fix the GPEX _DSM method. Add the affected DSDT blobs
to allowed-diff list for bios-table tests.

Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251022080639.243965-2-skolothumtho@nvidia.com>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index dfb8523c8b..e2fce2e972 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,17 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/aarch64/virt/DSDT",
+"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
+"tests/data/acpi/aarch64/virt/DSDT.memhp",
+"tests/data/acpi/aarch64/virt/DSDT.pxb",
+"tests/data/acpi/aarch64/virt/DSDT.topology",
+"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
+"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",
+"tests/data/acpi/aarch64/virt/DSDT.viot",
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",
+"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
+"tests/data/acpi/riscv64/virt/DSDT",
+"tests/data/acpi/loongarch64/virt/DSDT",
+"tests/data/acpi/loongarch64/virt/DSDT.topology",
+"tests/data/acpi/loongarch64/virt/DSDT.numamem",
+"tests/data/acpi/loongarch64/virt/DSDT.memhp",
+"tests/data/acpi/x86/microvm/DSDT.pcie",

From 325aa2d86a20786c308b0874d15a60d1b924bd0e Mon Sep 17 00:00:00 2001
From: Eric Auger <eric.auger@redhat.com>
Date: Wed, 22 Oct 2025 09:06:38 +0100
Subject: [PATCH 2060/2396] hw/pci-host/gpex-acpi: Fix _DSM function 0 support
 return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently, only function 0 is supported. According to the ACPI
Specification, Revision 6.6, Section 9.1.1 “_DSM (Device Specific
Method)”, bit 0 should be 0 to indicate that no other functions
are supported beyond function 0.

The resulting AML change looks like this:

Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method
{
    If ((Arg0 == ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d")
    {
        If ((Arg2 == Zero))
        {
            Return (Buffer (One)
            {
-               0x01                                             // .
+               0x00                                             // .
            })
        }
    }
}

Fixes: 5b85eabe68f9 ("acpi: add acpi_dsdt_add_gpex")
Signed-off-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Tested-by: Zhangfei Gao <zhangfei.gao@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251022080639.243965-3-skolothumtho@nvidia.com>
---
 hw/pci-host/gpex-acpi.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/pci-host/gpex-acpi.c b/hw/pci-host/gpex-acpi.c
index 952a0ace19..4587baeb78 100644
--- a/hw/pci-host/gpex-acpi.c
+++ b/hw/pci-host/gpex-acpi.c
@@ -64,7 +64,7 @@ static Aml *build_pci_host_bridge_dsm_method(void)
     UUID = aml_touuid("E5C937D0-3553-4D7A-9117-EA4D19C3434D");
     ifctx = aml_if(aml_equal(aml_arg(0), UUID));
     ifctx1 = aml_if(aml_equal(aml_arg(2), aml_int(0)));
-    uint8_t byte_list[1] = {1};
+    uint8_t byte_list[1] = {0};
     buf = aml_buffer(1, byte_list);
     aml_append(ifctx1, aml_return(buf));
     aml_append(ifctx, ifctx1);

From ccf166d89dcf57c9d333f05173851f90e416097a Mon Sep 17 00:00:00 2001
From: Shameer Kolothum <skolothumtho@nvidia.com>
Date: Wed, 22 Oct 2025 09:06:39 +0100
Subject: [PATCH 2061/2396] tests/qtest/bios-tables-test: Update DSDT blobs
 after GPEX _DSM change
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Update the reference DSDT blobs after GPEX _DSM change. This affects the
aarch64 'virt', riscv64 "virt", loongarch64 "virt" and the x86 'microvm'
machines.

DSDT diff is the same for all the machines/tests:

 /*
  * Intel ACPI Component Architecture
  * AML/ASL+ Disassembler version 20230628 (64-bit version)
  * Copyright (c) 2000 - 2023 Intel Corporation
  *
  * Disassembling to symbolic ASL+ operators
  *
- * Disassembly of tests/data/acpi/aarch64/virt/DSDT, Fri Oct 10 11:18:21 2025
+ * Disassembly of /tmp/aml-E6V9D3, Fri Oct 10 11:18:21 2025
  *
  * Original Table Header:
  *     Signature        "DSDT"
  *     Length           0x000014D9 (5337)
  *     Revision         0x02
- *     Checksum         0xA4
+ *     Checksum         0xA5
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
  *     Compiler ID      "BXPC"
  *     Compiler Version 0x00000001 (1)
  */
 DefinitionBlock ("", "DSDT", 2, "BOCHS ", "BXPC    ", 0x00000001)
 {
     Scope (\_SB)
     {
         Device (C000)
         {
             Name (_HID, "ACPI0007" /* Processor Device */)  // _HID: Hardware ID
             Name (_UID, Zero)  // _UID: Unique ID
         }

@@ -1822,33 +1822,33 @@
                 Else
                 {
                     CDW1 |= 0x04
                 }

                 Return (Arg3)
             }

             Method (_DSM, 4, NotSerialized)  // _DSM: Device-Specific Method
             {
                 If ((Arg0 == ToUUID ("e5c937d0-3553-4d7a-9117-ea4d19c3434d") /* Device Labeling Interface */))
                 {
                     If ((Arg2 == Zero))
                     {
                         Return (Buffer (One)
                         {
-                             0x01                                             // .
+                             0x00                                             // .
                         })
                     }
                 }

                 Return (Buffer (One)
                 {
                      0x00                                             // .
                 })
             }

             Device (RES0)
             {
                 Name (_HID, "PNP0C02" /* PNP Motherboard Resources */)  // _HID: Hardware ID
                 Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
                 {
                     QWordMemory (ResourceProducer, PosDecode, MinFixed, MaxFixed, NonCacheable, ReadWrite,

Signed-off-by: Shameer Kolothum <skolothumtho@nvidia.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251022080639.243965-4-skolothumtho@nvidia.com>
---
 tests/data/acpi/aarch64/virt/DSDT             | Bin 5337 -> 5337 bytes
 .../data/acpi/aarch64/virt/DSDT.acpihmatvirt  | Bin 5423 -> 5423 bytes
 tests/data/acpi/aarch64/virt/DSDT.acpipcihp   | Bin 6246 -> 6246 bytes
 .../acpi/aarch64/virt/DSDT.hpoffacpiindex     | Bin 5391 -> 5391 bytes
 tests/data/acpi/aarch64/virt/DSDT.memhp       | Bin 6698 -> 6698 bytes
 tests/data/acpi/aarch64/virt/DSDT.pxb         | Bin 7812 -> 7812 bytes
 tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev  | Bin 10274 -> 10274 bytes
 .../data/acpi/aarch64/virt/DSDT.smmuv3-legacy | Bin 10274 -> 10274 bytes
 tests/data/acpi/aarch64/virt/DSDT.topology    | Bin 5539 -> 5539 bytes
 tests/data/acpi/aarch64/virt/DSDT.viot        | Bin 5354 -> 5354 bytes
 tests/data/acpi/loongarch64/virt/DSDT         | Bin 4603 -> 4603 bytes
 tests/data/acpi/loongarch64/virt/DSDT.memhp   | Bin 5824 -> 5824 bytes
 tests/data/acpi/loongarch64/virt/DSDT.numamem | Bin 4609 -> 4609 bytes
 .../data/acpi/loongarch64/virt/DSDT.topology  | Bin 4905 -> 4905 bytes
 tests/data/acpi/riscv64/virt/DSDT             | Bin 3538 -> 3538 bytes
 tests/data/acpi/x86/microvm/DSDT.pcie         | Bin 2985 -> 2985 bytes
 tests/qtest/bios-tables-test-allowed-diff.h   |  16 ----------------
 17 files changed, 16 deletions(-)

diff --git a/tests/data/acpi/aarch64/virt/DSDT b/tests/data/acpi/aarch64/virt/DSDT
index 38f01adb61e6e4704821cee5e397888bb6b7e46d..35a862e44714d26ded01d40dc147e76cc73a1c84 100644
GIT binary patch
delta 26
icmcbqc~g_iCD<k8rU(NA)6$Jx7Q&1So1KNHF#-T`5(jwz

delta 26
icmcbqc~g_iCD<k8rU(NA(~^x`7Q&2-o1KNHF#-T`3<r4t

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt b/tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt
index 37a9af713b94a3fd34907dc86c40aaa79e93239c..7ce35f0d8606d17f3ddb9aa090c97c7ac9a38982 100644
GIT binary patch
delta 26
hcmZ3lwO)(MCD<iIUzCA?sbC{lpD-iC=9$9N7y)3m2K4{{

delta 26
hcmZ3lwO)(MCD<iIUzCA?DSsnZpD-ii=9$9N7y)3g2K4{{

diff --git a/tests/data/acpi/aarch64/virt/DSDT.acpipcihp b/tests/data/acpi/aarch64/virt/DSDT.acpipcihp
index 04427e2d8eb8d2db0a7ae3dbe546d9072406d09b..6d1765c31017dede80d1d87f8fa7c6dd055d1839 100644
GIT binary patch
delta 26
hcmaE6@XUbACD<h-O@e`esc<8gg)k$-W@lk#Rsd@^29E#$

delta 26
hcmaE6@XUbACD<h-O@e`esbC|Qg)k%IW@lk#Rsd@;29E#$

diff --git a/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex b/tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex
index 43ab60496e5a06706d4626d9e7b58b2d7e809e75..61cce30c7471faa4a9b7e3562dcb4ab9b3519a21 100644
GIT binary patch
delta 26
hcmeCz>eu3O33dtL7iC~z^4Z8`A<W3I*;)7uBLGsg1^WO1

delta 26
hcmeCz>eu3O33dtL7iC~z^4`d0A<W3Q*;)7uBLGsa1^WO1

diff --git a/tests/data/acpi/aarch64/virt/DSDT.memhp b/tests/data/acpi/aarch64/virt/DSDT.memhp
index 3c391674446167bc9c79fd5dcb1c37e80cc7bbae..ffc5f1c0d1090582672c60ade3eb1bc41acc5ef7 100644
GIT binary patch
delta 26
hcmZ2wvdV<ZCD<iIONxPk>B>ef3t>iv&CbHl*#KgY2MquK

delta 26
hcmZ2wvdV<ZCD<iIONxPk>GDP{3t>ja&CbHl*#KgS2MquK

diff --git a/tests/data/acpi/aarch64/virt/DSDT.pxb b/tests/data/acpi/aarch64/virt/DSDT.pxb
index 71c632cedcca63a77a4cdde53d9bc392102687b6..f98dcbfc6b823bce6d5710e8056a4e260fb92a02 100644
GIT binary patch
delta 33
pcmZp%ZL#HY33dr-kz-(B65YtPONfzS^HCu#E=GpU7i6|D0sxh>2=D*^

delta 33
pcmZp%ZL#HY33dr-kz-(B65hzQONfzi^HCu#E=I=97i6|D0sxhu2=D*^

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev
index e8c2b376df7bddc2392945ea8cbb550b3d3b5e26..6c12a7aaf8a6315bac968a685f5b6673e7248817 100644
GIT binary patch
delta 55
zcmZ1!uqc4bCD<iINrQobY4t{~T|$fun~w_haPlxL5oBg$h;H&^@iCZuLC9<Ka+$51
Mj0~G&)s8X(0J#qk7XSbN

delta 55
zcmZ1!uqc4bCD<iINrQobX~jmaT|$hEn~w_haPlxN5oBg$h;H&^@iCZuLC9<Ka+$51
MjEtLO)s8X(0Jzx@7XSbN

diff --git a/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy b/tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy
index e8c2b376df7bddc2392945ea8cbb550b3d3b5e26..6c12a7aaf8a6315bac968a685f5b6673e7248817 100644
GIT binary patch
delta 55
zcmZ1!uqc4bCD<iINrQobY4t{~T|$fun~w_haPlxL5oBg$h;H&^@iCZuLC9<Ka+$51
Mj0~G&)s8X(0J#qk7XSbN

delta 55
zcmZ1!uqc4bCD<iINrQobX~jmaT|$hEn~w_haPlxN5oBg$h;H&^@iCZuLC9<Ka+$51
MjEtLO)s8X(0Jzx@7XSbN

diff --git a/tests/data/acpi/aarch64/virt/DSDT.topology b/tests/data/acpi/aarch64/virt/DSDT.topology
index 9f22cd3dc81efe3ebcb8caf913842a8dea910627..208a3163a6bf2a59cf421418dcb16ad1156285c6 100644
GIT binary patch
delta 26
icmZ3iy;z&eCD<iou_yxr)69)rOd^a7n|Vd1F#-T#9R_9q

delta 26
icmZ3iy;z&eCD<iou_yxr(~ON=Od^bon|Vd1F#-T#7Y1ek

diff --git a/tests/data/acpi/aarch64/virt/DSDT.viot b/tests/data/acpi/aarch64/virt/DSDT.viot
index dd3775a0762ae1a5ddb89dd656d81eee581dccb6..f81e3e6cc794d77ea66b7e27b1afe56e248132b6 100644
GIT binary patch
delta 26
hcmaE*`AU<^CD<k8l?Vd^llw+43t>iv&CbHh83A%X2VVdH

delta 26
hcmaE*`AU<^CD<k8l?Vd^liNlv3t>ja&CbHh83A%R2VVdH

diff --git a/tests/data/acpi/loongarch64/virt/DSDT b/tests/data/acpi/loongarch64/virt/DSDT
index 55aa34f988d6ef69293e91c5fe45bee0a02bc5f1..09aa903c4e875f541223e36f59b28e101599df20 100644
GIT binary patch
delta 26
icmeyZ{9BpJCD<k8w;%%pW6Vab$vlh<o9FSwvH}2l69@SK

delta 26
icmeyZ{9BpJCD<k8w;%%pWAsL@$vljVo9FSwvH}2l4F~xE

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.memhp b/tests/data/acpi/loongarch64/virt/DSDT.memhp
index c0955eb60448cc5f4d38d410abc260ae54ea2e9a..a069d6878fb45fa6b0e6342eedb0eb3d25eb20da 100644
GIT binary patch
delta 26
icmX@0dq9`VCD<k8fEWV<W8y}x$vlh<o9FQ;aRC5qod+-g

delta 26
icmX@0dq9`VCD<k8fEWV<W5PzR$vljVo9FQ;aRC5qmj^Ha

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.numamem b/tests/data/acpi/loongarch64/virt/DSDT.numamem
index 61e47e7252155dcf9c76879c4f60f4b3eef63f86..78ece52f57a383db128c7d1a08526e15ab911bb7 100644
GIT binary patch
delta 26
hcmZovX;k5I33dr#6k=dte7=!uG7lre=6O8HtN>Vb2A==`

delta 26
hcmZovX;k5I33dr#6k=dte72EmG7lr;=6O8HtN>VV2A==`

diff --git a/tests/data/acpi/loongarch64/virt/DSDT.topology b/tests/data/acpi/loongarch64/virt/DSDT.topology
index b2afebc938ce45d798c8aa5f45a463f1617e257e..7ab23f47cc82dd7bc1975e17893a8cd61039e66d 100644
GIT binary patch
delta 26
icmZ3fwo;ADCD<iIQ<#B)@%%=v$vlh<o9FR#vjG5Njt4CO

delta 26
icmZ3fwo;ADCD<iIQ<#B)@!UqP$vljVo9FR#vjG5NhzBhI

diff --git a/tests/data/acpi/riscv64/virt/DSDT b/tests/data/acpi/riscv64/virt/DSDT
index 527f239dab13a00ad42e5a70b8dc2b89f12aa84a..968e1a15c87bb5753b3a84ddb357e26312767220 100644
GIT binary patch
delta 25
gcmca4eMy?jCD<k85-$S-lj=sUVqQju$#uLT0Ac+G$N&HU

delta 25
gcmca4eMy?jCD<k85-$S-lgdV}VqQkZ$#uLT0AcqA$N&HU

diff --git a/tests/data/acpi/x86/microvm/DSDT.pcie b/tests/data/acpi/x86/microvm/DSDT.pcie
index ba258f454dc0e59ef2fd67e0ce37e270e7c122e8..b646a05551c1ed902413a462442346ce246f8675 100644
GIT binary patch
delta 25
gcmZ1}zEYgaCD<ioB{u^D(~pf@mfVaClU=w|0bO|puK)l5

delta 25
gcmZ1}zEYgaCD<ioB{u^D)Ax;BmfVbtlU=w|0bO$juK)l5

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index e2fce2e972..dfb8523c8b 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,17 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/aarch64/virt/DSDT",
-"tests/data/acpi/aarch64/virt/DSDT.acpihmatvirt",
-"tests/data/acpi/aarch64/virt/DSDT.memhp",
-"tests/data/acpi/aarch64/virt/DSDT.pxb",
-"tests/data/acpi/aarch64/virt/DSDT.topology",
-"tests/data/acpi/aarch64/virt/DSDT.acpipcihp",
-"tests/data/acpi/aarch64/virt/DSDT.hpoffacpiindex",
-"tests/data/acpi/aarch64/virt/DSDT.viot",
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-legacy",
-"tests/data/acpi/aarch64/virt/DSDT.smmuv3-dev",
-"tests/data/acpi/riscv64/virt/DSDT",
-"tests/data/acpi/loongarch64/virt/DSDT",
-"tests/data/acpi/loongarch64/virt/DSDT.topology",
-"tests/data/acpi/loongarch64/virt/DSDT.numamem",
-"tests/data/acpi/loongarch64/virt/DSDT.memhp",
-"tests/data/acpi/x86/microvm/DSDT.pcie",

From 1c79ab6937ae938d3dfd4da1c01afc7eb599857e Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@redhat.com>
Date: Fri, 10 Oct 2025 16:12:57 +0200
Subject: [PATCH 2062/2396] virtio-net: Advertise UDP tunnel GSO support by
 default

Allow bidirectional aggregated traffic for UDP encapsulated flows.

Add the needed compatibility entries to avoid migration issues
vs older QEMU instances.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Tested-by: Lei Yang <leiyang@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <9c500fbcd2cf29afd1826b1ac906f9d5beac3601.1760104079.git.pabeni@redhat.com>
---
 hw/core/machine.c   | 4 ++++
 hw/net/virtio-net.c | 8 ++++----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 0580550e12..06e0c9a179 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -40,6 +40,10 @@
 
 GlobalProperty hw_compat_10_1[] = {
     { TYPE_ACPI_GED, "x-has-hest-addr", "false" },
+    { TYPE_VIRTIO_NET, "host_tunnel", "off" },
+    { TYPE_VIRTIO_NET, "host_tunnel_csum", "off" },
+    { TYPE_VIRTIO_NET, "guest_tunnel", "off" },
+    { TYPE_VIRTIO_NET, "guest_tunnel_csum", "off" },
 };
 const size_t hw_compat_10_1_len = G_N_ELEMENTS(hw_compat_10_1);
 
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 17ed0ef919..3b85560f6f 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -4299,19 +4299,19 @@ static const Property virtio_net_properties[] = {
     VIRTIO_DEFINE_PROP_FEATURE("host_tunnel", VirtIONet,
                                host_features_ex,
                                VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO,
-                               false),
+                               true),
     VIRTIO_DEFINE_PROP_FEATURE("host_tunnel_csum", VirtIONet,
                                host_features_ex,
                                VIRTIO_NET_F_HOST_UDP_TUNNEL_GSO_CSUM,
-                               false),
+                               true),
     VIRTIO_DEFINE_PROP_FEATURE("guest_tunnel", VirtIONet,
                                host_features_ex,
                                VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO,
-                               false),
+                               true),
     VIRTIO_DEFINE_PROP_FEATURE("guest_tunnel_csum", VirtIONet,
                                host_features_ex,
                                VIRTIO_NET_F_GUEST_UDP_TUNNEL_GSO_CSUM,
-                               false),
+                               true),
 };
 
 static void virtio_net_class_init(ObjectClass *klass, const void *data)

From fa4136387928749d5a1b4fa3606ae0ce6dce75aa Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Thu, 6 Nov 2025 11:56:40 +0100
Subject: [PATCH 2063/2396] q35: increase default tseg size

With virtual machines becoming larger (more CPUs, more memory) the
memory needed by the SMM code in OVMF to manage page tables and vcpu
state grows too.

Default SMM memory (aka TSEG) size is 16 MB, and this often is not
enough.  Bump it to 64 MB for new machine types.

Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251106105640.1642109-1-kraxel@redhat.com>
---
 hw/i386/pc.c      | 4 +++-
 hw/pci-host/q35.c | 2 +-
 2 files changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 4d6bcbb846..f8b919cb6c 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -81,7 +81,9 @@
     { "qemu64-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },\
     { "athlon-" TYPE_X86_CPU, "model-id", "QEMU Virtual CPU version " v, },
 
-GlobalProperty pc_compat_10_1[] = {};
+GlobalProperty pc_compat_10_1[] = {
+    { "mch", "extended-tseg-mbytes", "16" },
+};
 const size_t pc_compat_10_1_len = G_N_ELEMENTS(pc_compat_10_1);
 
 GlobalProperty pc_compat_10_0[] = {
diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index 1951ae440c..a708758d36 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -663,7 +663,7 @@ static void mch_realize(PCIDevice *d, Error **errp)
 
 static const Property mch_props[] = {
     DEFINE_PROP_UINT16("extended-tseg-mbytes", MCHPCIState, ext_tseg_mbytes,
-                       16),
+                       64),
     DEFINE_PROP_BOOL("smbase-smram", MCHPCIState, has_smram_at_smbase, true),
 };
 

From 97f24a0496be9e0a7216fea1fa0d54c1db9066e2 Mon Sep 17 00:00:00 2001
From: Alyssa Ross <hi@alyssa.is>
Date: Thu, 6 Nov 2025 20:21:05 +0100
Subject: [PATCH 2064/2396] vhost-user.rst: clarify when FDs can be sent

Previously the spec did not say where in a message the FDs should be
sent.  As I understand it, FDs transferred in ancillary data will
always be received along with the first byte of the data they were
sent with, so we should define which byte that is.  Going by both
libvhost-user in QEMU and the rust-vmm crate, that byte is the first
byte of the message header.  This is important to specify because it
would make back-end implementation significantly more complicated if
receiving file descriptors in the middle of a message had to be
handled.

Signed-off-by: Alyssa Ross <hi@alyssa.is>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251106192105.3456755-1-hi@alyssa.is>
---
 docs/interop/vhost-user.rst | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/interop/vhost-user.rst b/docs/interop/vhost-user.rst
index 2e50f2ddfa..93a9c8df2b 100644
--- a/docs/interop/vhost-user.rst
+++ b/docs/interop/vhost-user.rst
@@ -411,6 +411,13 @@ in the ancillary data:
 * ``VHOST_USER_SET_INFLIGHT_FD`` (if ``VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD``)
 * ``VHOST_USER_SET_DEVICE_STATE_FD``
 
+When sending file descriptors in ancilliary data, *front-end* should
+associate the ancilliary data with a ``sendmsg`` operation (or
+equivalent) that sends bytes starting with the first byte of the
+message header.  *back-end* can therefore expect that file descriptors
+will only be received in the first ``recvmsg`` operation for a message
+header.
+
 If *front-end* is unable to send the full message or receives a wrong
 reply it will close the connection. An optional reconnection mechanism
 can be implemented.

From 2dd1d20b0932fb5c29960fa5c1e57fb11e490413 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Sun, 9 Nov 2025 15:58:51 +0100
Subject: [PATCH 2065/2396] ncr710: Add missing vmstate entries

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/scsi/lasi_ncr710.c | 4 ++++
 hw/scsi/lasi_ncr710.h | 1 -
 hw/scsi/ncr53c710.c   | 2 +-
 hw/scsi/ncr53c710.h   | 1 +
 4 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/scsi/lasi_ncr710.c b/hw/scsi/lasi_ncr710.c
index b674a4066f..7e0076c7a3 100644
--- a/hw/scsi/lasi_ncr710.c
+++ b/hw/scsi/lasi_ncr710.c
@@ -160,6 +160,10 @@ static const VMStateDescription vmstate_lasi_ncr710 = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (const VMStateField[]) {
+        VMSTATE_UINT32(hw_type, LasiNCR710State),
+        VMSTATE_UINT32(sversion, LasiNCR710State),
+        VMSTATE_UINT32(hversion, LasiNCR710State),
+        VMSTATE_STRUCT(ncr710, LasiNCR710State, 1, vmstate_ncr710, NCR710State),
         VMSTATE_END_OF_LIST()
     }
 };
diff --git a/hw/scsi/lasi_ncr710.h b/hw/scsi/lasi_ncr710.h
index 3711233b0f..058718068e 100644
--- a/hw/scsi/lasi_ncr710.h
+++ b/hw/scsi/lasi_ncr710.h
@@ -46,7 +46,6 @@ typedef struct LasiNCR710State {
     uint32_t hw_type;        /* Hardware type (HPHW_*) */
     uint32_t sversion;       /* Software version */
     uint32_t hversion;       /* Hardware version */
-    SCSIBus bus;
     NCR710State ncr710;
 } LasiNCR710State;
 
diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c
index aaac31cbb9..ba064c6ecf 100644
--- a/hw/scsi/ncr53c710.c
+++ b/hw/scsi/ncr53c710.c
@@ -2250,7 +2250,7 @@ static const VMStateDescription vmstate_ncr710_scsi_fifo = {
     }
 };
 
-static const VMStateDescription vmstate_ncr710 = {
+const VMStateDescription vmstate_ncr710 = {
     .name = "ncr710",
     .version_id = 1,
     .minimum_version_id = 1,
diff --git a/hw/scsi/ncr53c710.h b/hw/scsi/ncr53c710.h
index 380e3959b3..6d30f9b663 100644
--- a/hw/scsi/ncr53c710.h
+++ b/hw/scsi/ncr53c710.h
@@ -242,5 +242,6 @@ void ncr710_transfer_data(SCSIRequest *req, uint32_t len);
 void ncr710_execute_script(NCR710State *s);
 void ncr710_set_phase(NCR710State *s, int phase);
 void ncr710_reselection_retry_callback(void *opaque);
+extern const VMStateDescription vmstate_ncr710;
 
 #endif /* HW_NCR53C710_H */

From 0336727f4859ee9ed1fbb7e88f4e22f6e08fab92 Mon Sep 17 00:00:00 2001
From: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Date: Sun, 9 Nov 2025 16:07:40 +0100
Subject: [PATCH 2066/2396] ncr710: Use address space of device instead of
 global address space

Signed-off-by: Soumyajyotii Ssarkar <soumyajyotisarkar23@gmail.com>
Reviewed-by: Helge Deller <deller@gmx.de>
Signed-off-by: Helge Deller <deller@gmx.de>
---
 hw/scsi/ncr53c710.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/scsi/ncr53c710.c b/hw/scsi/ncr53c710.c
index ba064c6ecf..47a6983491 100644
--- a/hw/scsi/ncr53c710.c
+++ b/hw/scsi/ncr53c710.c
@@ -550,7 +550,7 @@ static inline uint8_t ncr710_scsi_fifo_dequeue(NCR710_SCSI_FIFO *fifo,
 static inline uint32_t ncr710_read_dword(NCR710State *s, uint32_t addr)
 {
     uint32_t buf;
-    address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+    address_space_read(s->as, addr, MEMTXATTRS_UNSPECIFIED,
                        (uint8_t *)&buf, 4);
     /*
      * The NCR710 datasheet saying "operates internally in LE mode"
@@ -565,7 +565,7 @@ static inline uint32_t ncr710_read_dword(NCR710State *s, uint32_t addr)
 static inline void ncr710_dma_read(NCR710State *s, uint32_t addr,
                                    void *buf, uint32_t len)
 {
-    address_space_read(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+    address_space_read(s->as, addr, MEMTXATTRS_UNSPECIFIED,
                        buf, len);
     NCR710_DPRINTF("Read %d bytes from %08x: ", len, addr);
     for (int i = 0; i < len && i < 16; i++) {
@@ -577,7 +577,7 @@ static inline void ncr710_dma_read(NCR710State *s, uint32_t addr,
 static inline void ncr710_dma_write(NCR710State *s, uint32_t addr,
                                     const void *buf, uint32_t len)
 {
-    address_space_write(&address_space_memory, addr, MEMTXATTRS_UNSPECIFIED,
+    address_space_write(s->as, addr, MEMTXATTRS_UNSPECIFIED,
                         buf, len);
     NCR710_DPRINTF("Wrote %d bytes to %08x\n", len, addr);
 }

From 8c1fa9cbecba50ae7e732923ee567fe40551d1a6 Mon Sep 17 00:00:00 2001
From: Helge Deller <deller@gmx.de>
Date: Sun, 9 Nov 2025 22:47:31 +0100
Subject: [PATCH 2067/2396] target/hppa: Update SeaBIOS-hppa to version 20

This is SeaBIOS for the hppa architecture v20
and it contains mostly bugfixes for issues which
were introduced by adding the 715/64 machine.

Fixes include:
- Fix inventory for 715 Snake machine
- Detect if LASI LAN and SCSI exists at startup
- Allow LASI LAN on B160L if created by qemu
- Enhance error messages

Signed-off-by: Helge Deller <deller@gmx.de>
---
 pc-bios/hppa-firmware.img   | Bin 630056 -> 630644 bytes
 pc-bios/hppa-firmware64.img | Bin 699872 -> 700304 bytes
 roms/seabios-hppa           |   2 +-
 3 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/hppa-firmware.img b/pc-bios/hppa-firmware.img
index 74044a20ca1205c8463af66e6c8f0e48fd09ff36..4267fe4b387abdb35216043029561db4cf43310b 100644
GIT binary patch
delta 292635
zcmZ3nOYO@(wFyd0vwSA1D6xgPFfa?xo#+$BWMr^$NfM(KD}#w0LxXam9HV(PBZESb
z9-~PzFN4AiJw}rjcB_Ww`QLLA7&sIZ<QPp984oZXlyFeU;A1pN=2DpKz$7Net-#A5
zda_l){w)UslLNy8j+GZRq-qq5LCQHdY%XD%#3aSYpnOG-(fl4O!wYxG6!Uuw4GM02
zj3!Qe4Vx8MjafJkz--?f!|B8##K@rFB*0+e#L%IjuE%Ji$euBI1Fw=5Q-Xpz$W(3z
zh%n0s2+eAtpbApP!vN(sKxnoHF!hsp_>`C!873R>-Dk9zEWoeLxMH&nzc4dn*W>^p
zbH=X89boc+P!bcTz+@F+CoyRbkZ+Wg7#KKYnWD@s`4nHjVsn_>P$n~ZhA=;G2S^qq
z^ZFH!z~(K&dW=l$0-K+R7%?$132c@SKh4ajG5Lv9Iitel80qNH8Tp498v5rdC~z<`
zIV=0?F}{eG`)VG=;E_?oI%D#j0tOQq1}5)A_K`0f4lwv1wr}irQ3%jZ7hv$PVL4$w
znSm+8nB_!&gMt!B%tV+$&BKP}!eky9X~_fJF<ing<mIPk7_%J6FlM;`R-wppW3q!x
zx9Ezt1jPV;1tA8Is96mIhldHvhRF|PmNV{{+###YxM1=Y+1-o}HW$cUX5_TcPBdU}
zFlNix?4w}L%D7{4i|TQ~jIJ654UmLV3Il_O4O_zG7&R|0)(apZ6Gg^?$s5!<>k}9l
zOhgzMJd8OeaELI)a0oMnUE9Nv%srJw^x9UAWWLP|Q~MSuC|#ezk<2xRMTV<}>oUlr
ze5FDST)Qk9%;zvLHBV9S0O{cnV~POj<0|F4Y9h~&z_&tRFW(A*?fkMrE7pIEzsoN!
zw8Cr(0~1Kk3we26vug|m8rq2p4B3b5Z<<&!?*N6gi3AG+D5PJ+3;i^aWMD9nvHx$9
z$h>3n5_NaRgvoEz)fp2ei)esI8x3vEL=!0nkr(pvsyqt>=Ddg(b%gRmL41(8AkTvR
zK0!l?OXQ?UGJ}A}9JYkXdo-LGIX7uGF>;;%pMBgu(L|Ad!sH&U$%2vQw`>JXBp50{
zw!etyJ~`PyTZu{F<Kz%+Z^p>U3$*2!xK>U+puJl))BKi|pos({14JdKAc&uR+?p}_
zgf%AzD^ui)cp=5f3v}$51Q$+zpd-y_IQfr`6xaFx=JyyGOcePqOjgiMXAGFEplh^w
zm+l8fCbp%M*XXA+?wBlMFpG(0?&J*yw=EgXZ`n+QJ10)=D~Qj*&J^_`PBIi^arPa1
z!R)*Ck{}DS@7OYC-?im@5idS*@)1L8M#)J=QcSX6C(9VAF)>`2>|&J7xMT7LqxFI-
zS`OHoaxgM^fl`-;4a<hf1;)~hD>nBS8!<9Ttet$oq>4#=>tq|#&x|J~8<;sWZkSwR
z7R4mDbMgf<cg7u?CCvF583iV5SUhITn9O4-&*(Z?$MQF0#$*jEc}CvJ9#+d4GbVqq
zl4fk3%wxToF=O%pYbhq)r<?CsZ)Rf5m^{HwoY8ml3cJlrk{Q{D?G-OOOMhr@P&ko&
z!(K4^roH5gIHs+eOB~gic$a7=F)%1A@c%cl;8?VIg)=jgpeHy3GcY-T;?}{2Eo1T?
z*EA*`iODK%{frrtx46|ac1<>MH&^Tdr8IC(f59RG(xj}=z{EY5OUm4mG2!(y{v(rn
z+?5%-CU0=JW8(WW`GdQcn#@rSW~Qjg4GIh|7#Ol%#7XCZ`27tE86e9{l0n&;&0uqa
zM;s$8C#f(NY(C+6kBNy#V)F{0Dn>EZhoE>dKWYz3MhYCPptxe)IoZOmnRkQNHO>tg
zW-J~iCM+J4Px$GxYM2#so|yc{FJDpOMLhpSlPZP{peV_(VNrMy&%e>6iUC|KWZ19>
zOz!d5ms9{{lJ1!c0!)}0m_RByq?jT-tXL!_U-35w#YMm~CYF<vzXaqnT1-v}v}a71
zyd+Sa(PHwMK!3)B$udFejD?e3f{Z0IvX9v-W*@OP>`73#!NJJn3i9ZSIH{YHCj^Nz
zT1;LMq^@lNvc&wBy<o;-mW&tiav(L4-goQ;kKZ}K0kS+pnI!?FhJ$&s-*LIg7o1rp
z%LLD7be+5>xSp|LvQ0=ZqweGhAyP_W3%!rnP2^x<iZYR8FnIlf*#i_G*>~+7LB^P<
zuoO%_6LMO#p?m+le3N7bCax=7GB4!iT{HHuG)!I-8qSz7nI%k{(PFYeSQ(Sh%E>Fj
zv>7udUkTgKm@#=u_-WDH>|1s_O~e^I%x~BWnn*GUyoeJwoLmyo&1g6&Qi+N0>SUEj
zGbX;NlVc(mGcrty(q?3sJi%3DvO|<VW7p&fQL`DlChJ5WXB3?LCEA^F$7GurW5&SA
z1u^N2wUcke^fUTy&WJT<V&s^-AYPo2WAcvpHX+8fpb!J)fA5?2mM>x%&u$J#P-9_Y
zzB0KY#h8(2@|qNT#=y;QQu3J?3n#~<&teigIQd7q5|h};$ub#fe4;C}@7PbwzGFZ0
zMXcz<$rCcl86_ukWWJM=xBv+oyN?_)pzvb9@cJp&5s=u6SfS3zB3VUDf*&_`WMwfj
z@tvIfCHpYripe{2teAK>CV$B>6XN0MZ-{R-pJV_3g}i)eh7AwLWSd-NK?P4^9)^rG
z9uBi&2Bu779)`&Ux#E%%AY;2~>&|)~vb(9BD8Rt8Lm=2hna5)Cf?RFY13YO$0bED8
z#CU3iB0OwZ4_t5K-=AT_dH|%7gOSPG#DYg-@`qe?%>x{)OyN8=LIEDr7-pDO@MwT_
zl?a9K6bnUo{9!$Cy-9w5#vj%LlO6KJ>nlLEn(qa<P*yh6mWP37g+LT9hk)eeDESYs
zpL1Jy)bMbC<eT?6NO)B8aJ-0@u?3avAhvb_1B1B@15-u~4~K~{>je%*rVx)g3<@68
z7$$JHaLMp@2uNkkVZHGBDf1K4a5e?LTA=_>OCARPE&-|6Pnq{{9g*V_19`y2f+vBm
zRwx8yAYZzW2Zu0Iq=^;lhsj^^oEcY4w#Zio#alk8>|2oE#Kib;vP!{q(F{--h0?fq
z&b45(K;dgf(F_h@CTCPBwgsC7ij$dn!9E5TMbFt7CO4GbV-o+mIiXybiP3d)Nu@Ef
zq{NGO_LJsO%pNCd6lQ?)gcJi)h83H_<O4P8mI^Q8Sr=Z9;&9SVWMIg!;XcscplHD%
z!{m~&hfM*}C}HO`k77<ZQKPT`Nw>yig<5q+jmaLh@{Agj1*9b=H`E$4mQLPMn=hNn
z!NL@2GLwPhMT~?mIHk>G5CG9HVkC4oJJc;^WK^8|q~3^0X6IyyhG;=XP)WwY&J@nU
z!4&Z#Mn-dTOG7rVWcE4xnI@79B`;#6K2HAAAjc<j(Bv2clZhll%!?SQnUggd<rOnQ
zT3^UZ$C?}g%Ot#rkun5{nMg8xco8EdIXR=Tk4fU^<R6XUjGmJNn)H~&UruglTE!%N
zak5Tx9+Tw5$#a_3m?S4oKGGb`m^fLXrI?X(^OP2LM#hB6b6U3s$H;F5rK!_%lrDgx
z)_Xcb1gI6E%&*62BFP|OV#OoyB3@>xxdaEt3kC)clNug@YsH*B-NE+dph}{Bk^_hN
zWQIKR$qWgg<X~dM+Aw)ZTX;Q(a=#uUs30<*!=?ab>zdDDvw*Ti&F8QMK-hAB&F8Qc
zK-o{t=dewHvd@~&VcP&@Z#AF8b^*$sYd(kV1C-rrK8IZZ%FZ>P!)^d!N6Cen&tdm~
zaO7;w=ddS0*{bGq*ejrHUh_HZP|IY$n$KZh0TGwIYd(kl0F-^yd=C2!D0{8>9QF^B
zue5tJN=#PhP-dJl*`*_z@x$Z=9nyjlFXH%G74r2MO~e^kOsY5?CZFlhXLOkSr$bsY
z!K8vg!27zrq=_Vh)V1#%$)J>H9>v))*`V`1<BG`&UEz!;CRcR%Gk%zSqH8v5L52-W
z!Q_l?eMX7NGrFx+9r_y-IlK?q-UR7;5hoRC9>tY#;?9BxATdz=>Y>bLF!@Kfnh@tp
zSlMc_lgr^n3>W8QgC1$dj>$ef(To=+ujtWZ;`%Z9Mvpw>hsi&Blw~uTXDD<iz1L#|
zVYBaC6Ce@K#9%JL^<uI`ue#ue7xHqw+|69fFXZKG&AxMOm|W1SuF8>p*nTD`&3j+B
z7X;}sziBUMF2ODEBA!o|dnSt{I0^6RO=jentk5UUEAS$oR~8~Jv2e0WpEo1N<OzM^
zyaq4gd2FHLD<^O1i)W0OEYg3Nk#X{k{w^lgmy=T_#4#}}oP1=$L*{7t-pMN_dNU?W
z{xWeoqv+(GN#%^HlUXK*t8!!?fVhT(jVT=B8oP<+65Iwa;+d90Oy|>_+%S1NWA0>&
zDWGbqVM;!u@8l0tKy?zw)OAc^dpGZx8qLVax>;npIwPaOWSbewbqzpGh8J<n6G6=q
zP%v}IFgbfzv1z=BW6tD|VTuGbu|Pp%qR7@YSzu;1W5VQ`nadS(O{CO81%e9`1IHeY
zIV>{m4Gupz*qEYBBp4K4MDs44>@v%k(ROmhtj&zElXYfiF>(E!JY#km8|PkgOP-9$
zEOYu*SG<U0EL2#p$M_<e{jSL_o(G@+HxU+K;E-Vo&%SIw(PRhDgUvhUcr!9~O=g+*
znbCIgk9k#WOjp4sRLr;Md;xOpi)iN9$p_|#Gcs(JSg@N>w9)*Q-Nfv}b~6#qk&B%C
zVxhM!qxlKDgXXvFnO{W9MVg<qS2dAfP%^)1XZRvo_9O=fQ`C!SIZY64BEi6Ae$y`S
zMYQZp4o;A`?9a&si-H*iCLdW;#w5LQvd!WmCdrqRH!PN7lA1XA%;GLRi7lW)hC`Go
zibIwughQ4o^7Uge7LZu~0tE|YeLY67oCs4SsG^zNvP7BDWAch6RZQX!C#x(CXDpap
zvveJk=*7u8%k&v1OpaN0Pe^#9`4MwaL$Lr9J1?SzCvNsxF3-pqI5}rUI^%}PS5`PP
zHcXaSS!|m1BAR)x35Np1i)iMxCY%f^9*?;bI2Lm;_f%>(f!GR%7#K{F?SGnZD7cs$
zV{q)L)VVSFz)I!%4<^D23?LOC-5kwa%qCn62|blY9iYVEq0E-hlAsLEgUZef3@>6O
z6S<waq?8gE7MK+?vUE>YUIEIV3M~u_CQ=LyCap}aFJi>LaxCVOG?~R5_##?xrAZf)
zJ&6AzM(n7G6iA)Az>8?XN|SabTNA0xNvi}H>mfOR;v9nypbm3;gTgD57A8g$c6)A+
zixfE+7))3g7!*Na$in2x!NTMX>d~0rvJ-p}&2`d5f}y}ujgKSwxSe43Q9DNtHl|3B
zT=oe&&*UR^mC2{=s$ax&yv;srSJ>W=AOMno5z7_|Qe)D>z|_OsXP-Lx&FbX(P?M$h
zKOOck==3+)-{)B&(E1{l^DZa~+vnSFHIZcScoECA7gRT$sIi|9k!MRakz&v|F~`2t
zM3SL`XMsQzPpeRa2^#~$ix@dUo@Sv5AoV<Rgg9QrvV@v&F)ZMjATY~33RJa<Dsr$f
zd4Tw!oMs+1`P>>#&W9%491JgFL>^9lutu73<>WtWv;%!PxR|0&)F>%%a4|)2a4<!_
zh-P01Dg`sr7#cXZnIcW3I2c~Ua<pcoFeGHuFl2DZFa>gOGDW_K<%l(rVq(asVJP5`
zVG4qZnNF@)t5(l;lS7axih~noB->7pDux0i{!EW5h6;~zh73@x4hc2sTu?jRqnx3D
zgNG>sDh7&?D4rPtbJ`mcJUBR*!c8O?IG}R8AoWl&35b}~Q;?X4auq|ui&$w@k4lDy
z7x7G<ApcBmQ2+mefx!wa7Ay63vco#*(5)cfpR%!E3idrSsP8N~5#)3)ONNFQu~Ma8
zRtyQCP<Ro`#0m<DEE|RlkWWEAe-X=gH~Ws=$}Agj2snepU&JzQoxEY4zGWy#r<XYc
z*fS8*By~YzCK3z=V1A6CB8U%SbIE``X7D0b;^}0G_3DhClO5KJ*I(rjXNr6wFMAf$
zvT><lP-yN@5aP)YXnr9t;tR@hE;S4)-JSOLL1HG73<@t|Wlw_qdSZ|Lc90l|{UTPb
z5R}ACb~0#yG7<+1lmCkt?zbk~_Kb=R3>+LROaY4P^%yz$AxZm1G*hLC1VcmeX*N4S
z&t<$HCf`}FEZCcU)UFbd!eu{B7TBOxFZ31eiZ*0d$T)&*Ms<bEOQ<U(Or#iCI9Qnc
zUc_*vn(*2)D|Rq2fHIz<zaAsVW)413DrEQw%0$U$?F4xe1Y)w!*m;8aN9-CsBYA&-
zGFLYL9Xm%*&PzUR*Zd-0o^kS#4e_cAc^U*jy*-7=4HMWvy}lQ*QiY&Yabl0+3K0Dw
zR$6hg$3|twg_CnOMl%XdKCw}qapvR?8}%7;Co619XS_SPW0SRS>XidB_ALh#1e7uu
z7+%QBUNvE3;4@1TIrt)$eJ3d6U7jQTzrDd8RPt!Nh+{ixa?JjJ&jI_rpiKQjUbYmZ
z-ef0(!;2Wnvy%lj%QMDKHrQ<K$O#UbIZ9k0`bDhRPLp<q1W=p!MU2E<Wd{xhlbH+|
zFJdG><_dAJGey3Lkyr~V-JoiwPF}NFo-uUtna$FoD@~R%uyic52d8?7TJf)w|7@04
z-D|>b4;l>eQ_R<6<lu!yZIt9*PymBUGtV?WhRHTt<aIA*A3=^;QA<!Tn=EBu>RD$W
z3(^TnNH65Mu7aX^@`EKxOk#qQ*KCnvl4zZLW{WZ7+(}!dB?Vr@3A=*&lnxaPMW7CX
zLnTAOi#UPQ$#a%TF-d4n4%q4+s%av{P;jC~QOIK%LjtH|by&)fVIs-E@FGfVDJV2D
z5*Q3jWbC<lYJ?arOqc$l3`!WROc5D13>GF*3=0xc88Se%T|x>&mboRL!HYP-xs%^)
z1r=o++q?x&nn&?XfVA->HkwEA9hjW5t(;MF@||sy4K+bAW+K4=8Z=9I5yNy5#J?yZ
z^}|Gx!Rkc}%S#X+DxdNqhH2vD1>40v6G5UEB_uzXNHVy*h+%RB@jdS_SoF6ja$J}J
z7Wa4&!z2h2hpO{=5ySWq#OGjUiZGF62zU`AR5)pe9h2b4$qqZj84pg5*l|2@E~u7y
z5hE=NQmK@{z}P)m_YlbKCgKbXAa}foWiT|4;^9a>U?+Hasq_!?n|6XPVz@7YQbNlD
z1t}9&#(&PY>;$`A6&1j8abl{Vln1I?9aPyeCO7Q#x3x95WN<LK$x!ejhDX&zijl$O
zCc}XjF+9B2<0X_pt#YMS1_tjr{1z`57*=Fov5Pd1Vqm%)CH><?3|Ho4o?Y&Y29rZ}
z=}R_VcjHJtu}53rIvYnaD8@jpei6lUb@H5DW=z}*CtulR#l*94vcPUBF>X);Nzr5%
zgTsqx?n<!JqIn!AJM3<+_XIV7dUKQ_Ky`?TgaIQc$%4dQ#Bi-N5inph;bCAh;bmX|
ziGw4BgDHwbkO`#TA0oyT2~yv>Kq-TRm&w!QC#bGtnF$gzk+A>IA;aVa5#!<ni$UbU
zdN{cFzy?7zah{wUvL~PM?BpYR@)<cNo9s<i?FEf*g7AxI`M(@8OaUA+Or9Qh7!ukT
z6gl`C1fpI<OX*JDv)7%MHT#ZTq4!O@!WYrfs*?rw88ezrcG;&X4${ZY6lH43AOZ3s
z)U2zMTlT3lwoYENPn|Jw@|At+jDeH??CWPdI=N@RyrQJJggt2F&f`V2Y%XttKoqzt
zl40@%v0ub6-JE=8zdfVvWS#@jio75bO)VJ=K=g}f>9-(TvhUahnp!egyoi=QJGtXP
zaXqN@VF+rza>z2dyoi!F1?A`$QF2esZ`pywJvn5Vyk11f9R-QQ(i?{ilRJkjlLsgb
zzK9X9HIL#4HI^emg9k5SI4Z$uD;?Z`4)ri*Dey31so;=h3InyOOk^1txaP9Sa@DZQ
zaP8S#bx?;<O5&=C6dS{d8mp_IRvb@)K$M9D1KW!j(bmZa4vC9~f<#`(%dZ8|JP86W
zFQNr=C%-wQ#>D${vdH0X#-o!L9F}J6oxJC;5=iL5VR=T^Nk@uh1=<@FtoR!Q=75Ud
z{ssleFhs0Ota%i_!{iA^elfBAoZNHNo^j^nGe^}KV<&$(YR!0Yvca)-M@8>u4hPV<
zH8_ue25=h;7+x?i8oh{;n+hs_PS083U?R@pr7QsMzH69EFm`~$BUZfEJc@tA<R8bB
z#N_^Z-?Enk+1}oupa9bLB3kb1WP{^zVtR}(V#R#TqxgR)``dxorsh!$29uW@uU75K
zK4Nc~eZcM|$ZiiCwgg@q2ACISfjUAa%4}VeT~2rlCh**0U@?(k2m$4@7f}KyH!nCb
znUQhDWRp|+jGU8GPW@+eoSbs{9uxP?$u4K~n7At^mz;Ue3mO&l@Z{leco8MYI=SF%
z5uZRQ2M<%!=@<o&pT11~a8^!=<BPI@9B5=h!(4*j0OB=HU9i_Q&TZF~0QK1V;}to;
zV;EpBu=korF&cOzvq`*&7BB_*7VKD1k8OjyMat_(3_75c(NeF_pxkhP!F&$Gy5>Fe
zze4=aw$?m~@xY6C0bY<A6G`?9ub*&&hyFnFpnlAYShiI2D8_^r@^V+fmdMM02Th-V
zrYb<=Ngkj{s}<+v8E;HJabBBIaq^e*=Jm4XQH(c0BT}HU(8H2@$BS6jT#yZ*0TWQj
zflPl9%W~E{iiyKSl7Z=ky!=*B>BsLO&<vHEY97Vp@FGq$66B>5H3|kG^EjB9BBAo3
z=21)qFXZKxg3NQU;m&Gru<He}O{BaSI6#$<xh2nv7cr883jKDBFCyh@O=dCOfb=q1
zKp6+p%bdY<12kyyB1SyYM2dmqg}fXq$dDJY%peE+nEd5}I-}uanT!66wv%%%%5%n=
zM=@)>h~=!DJmq3MFSscIN-!phYz>nxU6<`Lv102=OJJX2BEcl_B2vZ{ltv&C!m(`f
zmrF)W(t9UsTvm2W1=YnbVg-JJgC$bd6hwnv63tQy3N{l-#w{<RSz@8=H7}xBTur1H
z8%!h_SG<U3(Vg6LSz0mEJc@Y-I6z{!W|~JazW}j0WI!D;u1fPL7KO<tF55GDPUg6x
z&!{-r;)=1Vs(BPkgmQo$BdGX!5h=lH9>rMz(go`0n@6!^yoeOPJ9)wtZ^ng_?_AO5
zjNqveVtNrNc6YMCRcY3U7jYbnlMSwlv5DoHMsXHQo^Vx+jkDlI9Q(w{8CT_5GhRfB
zKAqfiRhl*9MI1Zl<TY32n8ZpapSkL-X$Yzwz)j#7p-l5zwiBI?+Rk>qY&(;CGK;Xu
zPWy++mu+Xhh!HZJ>~Kw-v14+?HTn93Aa(r>3KNv|?LZArE^|wkh8K|{yymxTH}*Fu
zB!Kk2h!HFV@u71wRxe@%e}ZbiQ#A?-&Npmlo8PpZ_#%$wCWkOnR7MR;$BSqN@R0H4
zIr2aH8#0?f0sJDGLDc-D?L<(+_eHe)Pf!qoN=J?t(ee)`|G5^XCp5!^jX{rlFV`&Y
zC<wkD#gY8_2@7OSS)qXmR1SmZj~?;wnA~t(*>PgR9EK;_i2|V3LP&xQa|I~%zK9f>
z3K~^VHqc`P1-rQ=XTghD(TnC$EE7Qa38cnDm8IiF6yM3oPp;cB2|S&wa$~vbP4g(0
z1JJ7A1W4nH7>1wbQLGtYO^i&w8MbT&lRw-Lm%Ru|NiX8$A#@CrBFKZ_*p6Z1oUC%w
z*fIkeR9r7&<&J_>gUT7G*-S5@<<FW&aeUyAHHv+~z>qX~fdb1521%wDQS6SBC)`x#
z<us3C1v}NjhGoa(12@G*J6^=FomAMM$7sULz+l40z+tkKiDB}ao6@?RpedW40{i_Y
z;tU+1!NV6(j5|%L7(CkND=3+iGkAa+QlS3ti&*K<$tJg~0|QN@z$3v7FQS+%LD2#7
zpMwpX#bj_*z_92=3~wgL&669<LA}MM7cpFdCQ=Nb0q!hlU?*fKGrs_3ycdx?y^{~z
z()VRh)?i?G5yNp%IpP2VC_6eBbF2U*yaZ#86`+E}Lz&y4Cn3QL)P%o~EdAj{lzc3x
z;4u+a$!ngh04k(5nMg7!yoeS&Ioam6mzMMn^Lw_9FXV+vO<2K3Yl0m0LSCr;MI^tk
zi4=nzILM>LDkpEay$CeY7jnnAz7f>sIkCs$JTHd;DAYg=Zi5pw$^oE0C&a}ZTS4~n
zWC%?#kzrr~sZXe3P<Ro;BAJoOpy5%)pkX3u|Nljl_+9fT6#icGC<X}=NhXFDF|3Ll
zl1x!1QXqY-iJ&%DtAkPphs<QQyAnd|XF*+R`1n{P``XC{ccmGxPWHKLZ(C~~#gGBA
z1e60_L<z@&1}jX2Sr|ZKTs2JWApVOeF<DS<28q3h5*7uE#R!T{K5<u0N#F`7AV5;w
zbGf*|g?p4}uXz-M07&dblu+wrj(hU;t{_by5fe!k1`zv2lqfH^4U;5D>_wCiD_Bfk
z)E5*|5HXRn=1~j|pkV|kf30~GLjcG#FQNo%FRYUO1QG|QrYMn8P{nQ<Wf#jG#T9iu
zibL`BW62th1)QxQHP>w?FS{pN&#O2=kCD@h>(=YXq9G=H3|t^NaHSU|eAPUPp#j7P
zyCX{AsA&%`H1rwsKw{kLOp!05gj-Dn7<iD>m6`}LFhThfUPK9mng|Ji0}m7n;8YkT
zENdRcut3?O{``NC!WU6Of6b#9W?YPt`0*l!j}_!t6A1<nkVio!#fwO0*Na}#Ke7+o
zE(9lVMP`NUQ?@5Pcd;2{AGDqLB9gr~`;_g$>^rs_J5DJ`c;B%-*xsNW;eFip;tP5C
z?=NB)KpDj1#2%#?CK3!5kYvU*mt*qI`(BK5C$l_oW)z+5@j#tXb8^80FFBEq$p`E#
zPyA7+;#nauvt2<!0F+5z#IS(-T9X?dN>Bd$K!kDXWR8dOj5{Z5Jk*!nnSRMGwY@>1
z!}+qEKB_Ke#mOZPyBRqrJ+fmGd^y?Sku>Ad$uW<l87n7OJX+5vxmn|}H6!D~$th2a
z1ufGL*rjstgF9smFQR4kPG0e(SkMq8dfH}3ElB1?wDi`=I!~3Dn7>XAc&aQp_qu}2
zycaR78$luIk<FlCn#JJoB8oY5a?ex$`m?503?3jEa9=Kp6_j8iz<f4P<gtR1B}dN#
zgI=Cgp@tXo0=gi%7tu@)K}9CGkc}2OY97Tp16DYK@-#%8&DT7N^+ZpCf&hmsldD3$
z9ivGya{~vseWJ$*8XYi?vg3LI(J0&j(Zu@HJc{+hi)bcAP-W4xU#%8Yx`8Zv5zY8h
z;R2*e08P7@N3lsvp7Bgx^MT28HV=+0jfNKt47XlH@>~VwuJ#56A+U)t;z!M+*dks;
zGZapK@XVR9WU|V0B|qVvpmcLlQvL^r3{wQSClVvJ7c^qvk<6e0ZZjp@-vn9hVZ*YZ
zy+LIysD8~pU_aADoI%4xf`LU@fde$A%kUyn>h0ty&z+cfE>6Dj+>S|f?PQ4;WlSP_
zCr@}`%y@V5kr&CbqRB^XPnuu1E6hG_S7?62E;9RsJ!s%O@<pU@=wz3d+KjQ23tp~b
zV){E-=2bi6)X7U;Su?Jf{NR<bWCds-Z<4qHgNZl;6DZ??g5`x1ug7Ga*WrvdlUrWf
zGfGT8^4g9`WX5EcH<KA#C(n4J&Db#c$Qv^zsRNV$ys4J8XrDL3mE#WAWS$iQQ$SO8
zd?lc`l#opTRT@*?YS*6tO((pF;d}~ea&dYwdA*RAf1iEG{-*go#)j;}b{{#Un4Ggu
z+8xY3VRth7xZTC<V|F*QkJ>%VK4SOM+k?U4MWlc!s31PE2h{uE)IsWfYyefAFJd4~
z^cQggoS^9ONMSJOX;T#7sSs#;5m(Qv3Tlo(>)fapkpi_K!=QXCP(uJz;=hOy+G=je
zxM4zr0m};phF23B6xd!cFlO;&2(<7d2(*LDcoE0b%X3_)p}j#_L%D&Uk%NWFnd1o;
zJE(<g(!#!=;jyw2PlA9X2MbfwWlQ-VFJjpLn$#yVfZEr`Cp3U6a)zcCaXhRb!=Mh3
zdJ)MV3vy6<gWX$@V?Y+Zh~)hX5mS1_lOQnjMVw$M$j}!IOa(l5gc^E4ZEYDI2T(Wf
z_@200kiHjjTwg)vHn-TtLitxg{CY^u&HSsUsX@R*hCzX24k$G<-{Q#-n3H|SZX&q-
zEW^O!p~}WEp}~O3M23Ma`HtN}k39?){S68nph2dLJq#8+2?8BF1p-q*W^~L^VsP2a
z-~yhSml9xj{g^ibl-EGx<Ck|xf8dZ{ihBK!5mXn|JAf2<>|(IEyjc3f>&Lv{78_{b
zmZNq@1BWb=^9v{D2OJ_yQR#>6mS*3v+n9aVZYO9S=|!y2&g`Rhpm{)N?>ly&+`-^J
zi^0YHhTYN^PRtb`GcNDpn$wb?-~kGi7YqyzCNlQFJ7p9!lpFfl`8xzAD^Hkg_CdV<
zq}@U96Lu%PkK0}JK4y2*`>5SRZ&2zwZ1)kgYR>$gUE_;5j;)~ZYHzTgZX(0L010>Q
zzu<6}mrn)R(8{1-aH&Q5E2nTr1BWn^$3;=;uYC*bO-*F%--5(@8ti33Y>;n2zJC3f
zn*%gDSkJ-2<jEn+<le~AAi&YVBK1OE?kLX@p$1SGyX<6e;f~qS0GjT6{g`V-_F=n;
z*~jg6W}md%2nq&J5WI*LXiUFrx3s^(E*|7X_d9k=y&*vp>9UK#<@H0k8{F+&?A%MZ
zSU^koxEFIVw{+OCf;^&ZpclyqN#Z<LK}j4uRx4xw7nBD<DaG89F(UsMLj#8tlUw#t
z`_Akm_7g!JHE$ON3vX8jgBLM8sr(TF%`YN3Au|dxMlLTH7+<}JWBoe0=A*pq3jWCo
zb6z(bV0sb93J$OS2K%iho9+L;h+_+#yyK&m8btWSo`nLS)*iUEWyv|=MJ%77$1Mg0
zaPc3<YCD<Zla>_AQ=SB&1`}ZhCQ!(Oa*2sB1K*1{R^7=ypPcJ?%`F)<Ol0i;!j^WL
z-?MLo`{W)&!;2Wsqvn<jA8@L%WH<owEy#!9k_YNzZ&wBjZx@hnIbHc91lnFivc3hS
z2M!q{*B1;7r(VP{UFBe%%=cM?iRtcSi_hMI6Y`HRH1J0Vv}7N)?|c!%!8&=$=WN9f
z+V$uEn<#Q}@YpD{dZaTLcw{hW^h{8^;gJSv4>CTTtnfv-Uf@NHOlS6S`<Xlm0&_rh
z38-*1kK$OtlOZsjr$AuFix?SCo(h4PCNc~r9CKzgykKBl)Y8<LU?Rg{;8DR~VIs`v
zVJ>6;zj^WuWE*FC)G#Q3)-Qp~G>_uk;Zeh&0W$kVjPy#6as~s4ef4&XAVKpet_*~Q
z(wPtoA>~SYgQA9sy#0T0X)7-B-~|K619J(642AV}j4$NncukhFUr+{h?d9b_YaU*h
z$S`O%%$au{<TwR=J4O>lt_wUW3XLxm4ltRt*#B*qGjBRv&Rvna0WK-SsMRp1VS$MZ
z!@q_(^Ycww>={j3>>FFA%+ocI;WL}k!eGakBH?gA=AJmn0Fa|N<e6eXE2Adm$|#uM
zvu8AsVRY-5W4jzA?@_~G(BGhB04mo&OK&I7`Pyyy0Tdn}FTaS9NHmY)<ltEVs;1<0
zP2?FEx+mL-n#eGKdKnBndxSc8_6RlbR0zy?5h1d4a>6%xj~AdmiwPS;gM&K9Dv<dX
zp3DC*VP#6-cxKUH!pgFty-7g<6wi|z3_$Bxq+ZC&x|+z_|9v4Z_m`JdsDa@D$F3KV
zvXh^GQ_x+?D<jkZGVodnM~jIH#|Ey+EW#bn6f`&{b6xf-W?9jfprB+TWB>hyyqxc3
zlkdicnxJlxi3~$S#~%d&kZ~{MW%p(@u&j6?FS|CQfhhvCGzR1>4;79X?S1odC(rn9
zRxj-f@*5~Uv^ObOfGlipQHU@RVQA=Yuog9uxBuxehoRtwyv$LMe@$c<bR3L1R!vGU
zXfTmsaCjjvGZiH6V8gKr)K%}EVzm~e2ed94EFU3Y3d*1$HRdzGnKkl7gkUUBg}|&A
z@=~ED_3{i19wiJ49&;EXy5?A!n#kMVd?7FWHX{Ml29oFXn8Q#3iXu=>_po7exI9Pt
zK35IX9Eg~GYlaP*hsPX-2Cf<=nHTbMYp>6ju?P9Fy+OeN)Q;+JvFrs0aRi4isMhC@
zQHpuNz_9CuytFD$jZnkn4?jHXW8}|*<X*^2tOW(e3we1{<p#z-AanW~ELuVO86I#f
zc@Zfw6Xcop`3e#y!aNpy2?CS3YCxHe!3mQ7d3TsgFo0$&G$1VwAx+Sr;EPyE@W`D<
zF@pwQ3MfHIF6FBc>hP#!Fz8pXD&+yKLIgSXMFd~!<Rd@z<RnEiY8WPf>~C*t*x-@E
zpwZsc1YQi@-(Y!kvcNCtdJYa5reO0q3<cd&?azWkLxzFD!;}@iKD>Ksf&(Nf#Cky)
zp})hd6yy`02B8L?2BD4@42%^#4MG!I6cmJb6a=O<P18-_U<8{9YKhdEC^8hZ_q5*t
zE$QZ&A=F?Z!~BmYLtskRoT*Pu<oWEsYB0z#npkpkyoiyxI(f%0b>0L}Ao3Il%z6<c
zlRNp%FTFI8zo760+2~=zrob~tsDo#Y(1aKAVpDk<gl2dYGZ?fbDI|ajpGgVe231yH
zg2_~nD?vW;Fk$21YY>>iKUru7{}iDH{>fmyviy^UAZs6t**IRvOR-LF_^n?*7o-Yo
zV#c&wkcmqDc8q3IcslqdD@=LSaDWMvRZT=#7`SD)M4Pru28G32(DHQ?OXeNiGr2%r
zT7?%eQlTJEypR|93rc}#dU#Fb?ZJ9HDj5_&OWr}roO>3R)QiY^u|TNCUXVtJL#D=p
z90DokcsB4DLy9?6Lnoy|3>9E_AuspV#FBppn!GAZ9%ShYd3jM2EB+mz&i)H|;jR3W
zg&M%!&3XwI29U&y2##8C-%(z;7U~cUFbyv5Ol-m7YQv_`RkPVvgPV`hM3I4^!MH&}
z1GLl*%--k<iZkT~K4#D&RIZwi`6lw9wyB^jC>4RyWPg*vUr-!@JlEe~aMwhJ$6>O;
zUojVfo1icNm7$<+0%$hMJc={nMYP~q6Dj5wFCy42LGmx;1!6%~fXW&ZVTJ}++0i`N
zK-WZma@Svjdj7K@yTA%W7??l`JW3f1CN~%~n20d2wJqrf=gGbW3IZTEypR{v1*MO^
zMG6vN{~5D6fQnYG$xOmrbC_f<Pm%uL)}Ww}VZ-JC$)^HUFXY9pnoBTvFx-)F0F^7C
zvJq6ac$jj`$Wq?JknuuZpf#g}K?5Y=VZ$*)J3)cLM3F<HyHO8Rp!}bl@J~!lFBB9G
zFQNoRK?T~0JqrXtS^0%LA1KnkgUaI<5iCb1&-v$6&+p4~M+h|5;ObGupm1W3E-2o=
z^Hd1T0R=NpjnE8_Ees0HQ`Ultz_*ZrA4Y~35zJ>n(Fsz=v4?Ap_Z$WdP!sb-B;QJ&
z1p>1`4IhO@(8M}lFV7L74$uO)7g55QAUjUa(V1%^Z~vWtg1}_&$+7=s>-j`^?g-6*
z29ZEpf{rezmIOs<dxMocC@A}zbXY-N0@Vk62?A5D&*7B6G)4M9*Bqvp7jc}Hd^Mor
zi?<b=q$(H;`Wf^>IV6}OK}FPyC?QXXz1sC)dm98M^G^_%!!uc^fxkmw&Wn0^UQtjP
z0J89UgRFgjlcqVSDt;l)Eemr<e@oAKkl`=nxxRuN@*<9}5R_;<QW*?-7U<T39k0Tc
z(9o*26_hcQn-xF<HwvJo!`(4j(?RLxMI?73NKbRCRxU^l$YY>QG&)=<Tr3%L6eM5B
z^RR-)>A;ynLm%P@E>LavALO|9IX!Eq?qHO!F9j9%FBljtK%;yhs~v3EGTIw-Y(aVM
z1p_08hYkM*BynDlxQ7M*22g={U4o+p#0Mn}aGJN|*#K(SzF=UO;bFsh1CkVlKq>90
zxdej-sC)lHo}Jg+lKlcGzWW=PjFwN2U}Ti%?FE&ppq|(Zc`n`QEsTs_LhL_5Lk6HM
z!aav;vWYUshUpI&8O0e_P5;5jsBS0$HeHfI!(4(v08$w-DncqF4pva$ypWfln>_`z
z6qw<o=`7X>(*u|o#RYdN=G%d$lf6th7#K`-IaW=tU}AJ<<eYwhiBVbfD5z=F$!~AY
zyFfq&r0GSp{M_k3m>828uTGC)W|Wtl3RdB5Zx2%OB3iB#q{`8TW7YI2%#6XDdqL7*
z?gwT@XIE7a7gSt$>}1d|kK%jqB3kAz$Z?=x0@e6D0s?a~jJXuFK|42$nKzgf+yBon
zX5IkltTJYK7&C8}UctgRzdqKZf^h=KD4qg=nJ?t!OwFVCEj(<PH?)KLrl2`E&>&m1
zG_QFSf53}47Vzja$SM;V9tBVgf;tE0_m~*6&)IWkpS2gvK4UMLeZt-{`?$Sh_9eTQ
z*%$3TW?!)TnSI`#G5fT=V)iL}&Fqu*hS|sLJ+qJ2+XrSJv5(9?Y@f*AAkb<e!y^Ie
zbx)oH?kF>5*sw)_Ea6~e@<>o%%K%rMHryPb!X?9oqX9&l=&)bNoWl?RX6vyRWZr?Y
zb=d_n_dwa|Y#TEEFa(&$*#Bp&k#Jy4@K^|{v$dy7vM~yYt^(Nsnn?z=ia=~oi8tMW
zjZvwdd4o~{A0tT2M21HI<TegQCKv9>J3u|um<$^>1<*(n2P0Dqh&EAVv&wE{;Q+^j
z3<E><9QFndMkY_?hW`H<Hk{yDL-WZDCo+sVFPP6^04?J82dT}l;XDD_mSiHs;{mb@
zWKV_-n*|3mBa_?oCv1%Fj2hE**cqiG7byquF@naKLDQBeY8G&SQop$}{{nMM{sk{0
zgup9^+Zz-TK;^Eo0UxAm8X>gP+>){5^c+=iV-{qFc@*P>7tvy=ptyVyE9*FY4LhTG
zy*J4A%m|2UGR)Z$Kzy@e#s<&?42W$a!Jv>~&jv2uGp8{)a4<6YWEgWy0Qthiit|C{
z6$XdQEesABUl|-Se{x;`jTt5~uw}f65Ms=<;k*GF#xRj!VgNbeMHG{-c@*OZklqYi
z&I2am^$ZLkOF)t)7HkqPqL_HiqnN<y3?!Ce%O=3V$m9nZcNY{jk79~AJ!b(^<{dTx
z<rW17&j_{zkUH)eToUF{OdT(x7<(^^%gBSw1l0x^wrm_A`4>?FbIqfez$K80FpmSM
zbOwoY)H5=<XDF~$yolmYHIHJtaH2*b3lWI?7tJl1UVsK|z-i?VTLqHbOmj=7A5b}#
zj6ZDPjdUPGUqtaAHIHHz068MVhONM}hGPZ?Ba^T9Oa=$2d@E?$)w7smM!i=FgG19C
z1);1O1_w|KX4r5<Kos%0nny7^oVEc~)eH<KR$L4(BKQ+Q(E-X7%1#0dCYGEZKx`9b
z?iJk1EX*%r<SjvqfIxGfpwSO@2cZUb2c`z|C<cXws`=p6pDYPN4Gat{3?7r&6ij3o
zra$InbX4i9Yv=$^)Qd}9FqhzeU?Rx?X_rR}f{KR?FXW|;Pd~xSsKh39S7|XH^K>09
zMp^aCY!=yb7$#&-W|#pgg0d$wEbzR;CIG5wL9H#&SP96M=>=Sj()AmZ9rziwE8qV&
zQRZg=Rhl4WFBn)(y@-<ZRCZu+0JpJJ7#P6qD>ViNjy4vy3wLDXFVB(w!f}U7=JFi5
zoc0z438id4Mz0bchHG<pgtAI_7(Dl|6_`)9|KFF^AOJ2AWEhw-L1J_4|9cp-E-=w!
zUBG*%USUdx3F`vRJ6v-(7@7RR?h^!U2W4Gge!)(V_oBiiuA&_c970UNe0~Cwd@ce}
zd=3IJ+_PAuKueTfKj2EqzHIl<d@X~*iztp%4qm1x4qm1R4k6HTIcZN&XmiLgg>VUS
z%>gyA%nTWr`ZVl)y)WB6G!bNA;Hwu@n8V*EAj#h%5XIjh5W)pFm=m(rT9_#cWH_Wb
zD76x7xC~P;=S8kLAjg6XG%IGX<J`<8+^1n5do4jm+Vc<V0**N>!WqR33QBj*|K~j+
zFqwNYiwOS|p$TT!ID~jF2u$Ig!XnC7Dm0;<_Xb!}hHsA01P*4VP?J0M|1)YB3_zP=
zl_$tCde3220Ihw`sA1@U@-?9R4N$%Tl-~g5TR{0Ul)L#D&FAniK=~FX$LxPY)i^-K
z>L)-2JfH##Aey)jK=~dVhq>4wVmvTS0URPs!BBkxP<1Py{0Jz22b7-x<sX3ZGobtz
zpxwR=SL+wP;<+Q_1Wq94YziJ_43OS{B2P!wLxuvdxFs6{m{w#H;8z57oCFw5EO@|j
zT!*>DOsv>uJUgJkz#-4%1S$?dEtU)$o)w^Up54sD;V1)I1P5N=bLd3`$3{>&3(EQ?
zq6`e?^>Y{-_!|VK^ff5{GLhl2@N{8IXqciffxkhZS-FLQ0n{q<o~$6LJn#5j^Esxq
zO*INa%FYT5FCv6^xm~!Vl$*h7r1)DHCM!2EEHIzL$ih`)0h&hPdJ!QAp7sVg#IuWI
z0w^JZ`n)d~m<*JE^#A8uARs^e3ooN{eJN;L^7T0!il7B5m*+@-co8A|6y#1&I{@U?
z7ZCzm6;c=&K+by+AuyLCg-gn$iizPxgg`6E8875zpMunZhJyLh1cWaYOaGpfV8E2M
zg<SzOhyv<nH{4fH;#(mwm2a7V=%uaFzb7pKZ!#6SR#VTB44S0o4CcCg;h6M)jw@Uu
z%~KR2KzpjMU4iVy=9<PL#u>_Wl{1X%nu#n!0^bRN?R+N$cJOT%TCsj({9V2sLMwU>
zC~$#10-7DUwuK{^YbuNAwW}P-e5V-NdJfqA1?g`}Q{*raXFJ7LATWh*zEFcB3tPs8
z`WE>gJq-#HN-z5Vdzy3J;Cf=wp!B8xKVOBwR8Y(-&FKHn^@T;`(iEv2zAZw0N;lU3
zzcz;>*~FBEfqM#z2uKYF7n28P2-g)*caZBFix{ZO*HGW!!6CxrG$BEOVM{Xme-my7
z2T&Q@k?j~^BF@ePDq3I2i-g9ROYm>t5N7fQ`HVM1U?*>ez%HIhh|hSUgjVns2+ZZW
z&LzP&L#Tm&fxt`?MFt1HoklzOR|w4HU}SPK|Ifh0w^OKte}lkWvndP(e0zl^@Kp%R
z<=Y|DkTrFBn*gI$eO9CWO3+$Yjw%)@P!-4-#dYgN1jA3z(uIy}`=i&LIg(9dcqf<$
zGcfQn2ux{fP|)HP5SWrF%#Z=zGReRYz&Al)N~Q>df++_>L8pxUc91$yZ3ZeVKqDuh
zmJ66~!&m@Xy2T;G<iRyH1C$#1yk11`yfxwG5x72If`fOuqadRw8;`De6m!P(7(qt)
z`kA2g#+x882h@DZuwiNNwBft~X{K_%dJ)S9?iqs&chF|bxR@>f1JqdXP~lE!O;9*s
z(qjJ;obMF)H-H)<AhwAFGiWEhr->EMh8N*-cR`*8Wd)@LjL95qOz|8nOu?WmVXDZp
z!9=#6!N_bYgPe)D{eNW%`P+S!N;^QIYX0B;Kd45^oX@|(M1my&Y)BPj!HaM?TN54z
zfz|{Cj!XyE3nn}aBA~GlB_;+26J2ft6F~+q5Z_F|z`;bH{lJ6<^`9>om_AKR03~|1
zpcgT`kgj|LPwR!1@;_eG$MCj-Lf}P&<U-Jz{u4C{pkXkD7f}+1ph*R#1pd2RHC!^D
z!VD1|#rE$(QIIJE*{#RRATTGxhV6sLAGV72CiPv2Ng3W9=5rW$x@y#$Kxq`z2Lm@q
zEIABJBp437h-ANMBE{|ilB+k7V019CWWNB~T<{{2eWk(#K1NV*fw~0Qa~Kpr%VAzb
z%kSi1V{!%sy@@1)gNX$fxcz1x#Uk(`TE0=y-;NR7NQsuuG>>9=0b(n>w_`MqVmt97
zTHaBS-;NQ~KYGEy&S28Q!NC0&G)2Z>)ZU;_&jA{7&z!@*0hB9D#D!R1$n#D$m*DT<
zOAv_RF%@dKJV(0u`Wy}?r!oc;vupPMx$ZE<@R$otxITwl0@S<a%Mh5%V<Xf7DgsOt
z85DRdgl1lvBK_B_*#74Wd6`&H+5940&K0yQzkj}hf~Pa<1ru@BWgz=r$k+4iHJ9KI
z;9z6&GvQ=V0B@m)6!iovZfY<9Z7cyTwS*){2Cv=&3S1mQOnz4n$jF;&GB9--+Rp{)
zQF7qF%jL%<)aGFCYa-4HDurS|>A*yh%Ynm&YtGff9LXGcEW(_^T$lN3geF{X=2*)4
zhf7AgK9PZeuSN*mujMNeYT!ub>NJsHSdf*#pm0@_qXm@kI9GCUW~DGhfTq3qGKD&_
zY8V1ugiD%cB{O93Y6#4^-XNpOYa`TQBFY3hH^P|LK*)jDMhG+;$;4|T6yq|DL8I%c
zf`ExIqX@5!kcf#eBM0bMi|cbZTI#ubxnwx<SUCA73$d9<fR@-WFmQ5mo#ZtT=z9?^
zk;}oy6vcZ<2-Fmc;yobL@gjmb6jXNbS_pJrpToJ<M1sMA_m0p6kV9XDOYnjmX(GYE
zV<O4;??t%yTT?3rCSDyO4qgQzE}jN~7*KR(I<sEjwGrasX%MIf3H<FTauDFP5#oCx
zFLTvIob?k=hd|2<dC6W-{(cc5TxlZ3$8e&?axQ2IuZbiB$BQTdL(sxq@PfNY!H*y|
zD4N<E6hMtt1yF<aMWo<Cn0S8!Bv(PjCxXQL=QS9ZNY*nz6h{dtg0kD`ISV#$a4-c!
z4R!=61Q`r&*Gt0G3WE1gfU+iNQ!OZazK9ff2~yiXZ$2-`60rU#{z{0Mc27ZKAalJ+
z7$Q1K?BAOeLmC-b({sfb<?B1<n1lE6zK|COO^z~waw{lzf^w^gC40e(NQOXIjs<1d
z7xEINCYJ016A~r}y<lMSYDrKEFqP!rVDg=R2M04#1bFl%T0#>PQK04ps5{wFvwtoq
zW4?$M|7jk@F#|LL0-E%2u;5T!by-6GN4JdP4W;*Xj38|Go&N@CB0BqyeI+Q@Pd5-}
z6t91geaF62c><_)$2kKu3kI60FtOx(03MD2^-H7070shK7J#&P*l;i4U}SO!mEE8=
zkB1rS4^SCxKF9thNQ^^_Da1pU^#iDD&%w(S%puAYZz67glY2V2aM;wgK!GcB3hNIJ
z5vH*A2MS!7!V;_>IE0ye`3?xkfRb?Y<c1fQC(HlnOPGF3oKaSDt7#<r3(%B}X*vIi
z7xHqtX5aZ=@HYs|oxA|F)__5)FF}C|)KZzQAi*eU-C%zmG$_d5Aut8h{4o(_U@{SA
z<m#Smud7hN#|XlpQ&XHyF+_lD1C7fxPj0AiI?WI@y+nf1x1JBYnS<#?q})x<TkH*<
zw>TU)WSIP4M9S?1?I6lNZ{G+CKF2)_Q5@V%;h<&ppzw3t!w>=L6ocXd6o%$eoGV^L
z3t!AWVn5S!4(ksS5r$)pCJNwb3Qu9y51_EhFlJ+DZ%{A*Rj$sH86rU8JKaH&QC{(@
zi4^++&_ZxfX#+CyMYJ%dc@)<I5Z^?RdB^kyNk%0pR?smcQXs7f#*AXla~Pr$Y#1dx
zYS<X2?~!EGV-u1zkK$IC{y~yayB<<O$xC~Ks)85tvZ^L6pm9=JQIi(_ALf_sc7m!0
z?=E%*kJsD_OhgzY_!5LxteY7B7DR(Ec*~?P17GrGyMr8ETpWrM_!zTK*lkqYz{hBs
zZGY2*&;F)q5BCJqwcIB<^Aw6a{%|iaS!!<#N*N}iBK9{ytyL2-h7%_8496}kmHuIB
zJAIuLqe{JiCul`EZ-&4ePtZJq1j8)Q4uTiqJYStBFhp<&Fhzn^1igsn{|V}ld1f<c
zfD3<lxvwB=JIxfMKtr>AZHifZ83I$l0b9bx;9<iS(cYi}9t;3EQPF^pQ4y2^Hpnq5
zPLN|XUCaH!RFl8Lq@JI_$TXXOgUM2c0Mi}@29PB$qWKj~_!yReioF-n{G6ceGA5D?
zdM{#`*Mc1vEBX<1f`j>GJ3+n#0h!BF<bU)vD136hV<!ln_v=%Xa=v3HY$D9i1>$p0
z2Bm&RtrxN44?*pMPJ0C*kfYmL?B=t9T-~x}`ZZ}rZ~y*z*FnuQ^Evhh`D%nfb0Awm
zd=p`Y3Eh(woRH0Io@}QMaVxJQ2RBpH3wb$Nkb6yp8D?}(Rsh>Sy+DRh%n0m`4Ip=P
zPqwcG+5bXbEZRhvp{0AWeJs?>c~E&<^E-Be(|5=)YS)8KjnQzP$q;d=So%j>(fswG
zwz#>a{X)<(9dPuD*xv+2FZUFX_ZXyJL~|bm&HlfTmjTtEQJ`$;RLT(1Y^opx%9StV
z<(GogXB4wByolz`1jRcvXqjHbGO$8|R>%_+w9a?x?F3DP8QQKl$m|EXt$DKbcaZ<g
z=h*vSo+JIEy{Q2__yS4{88&PIpk&|QpdgWb$8M)`fE?osc@azVD25Xt4}kg6T%G1o
zj0_-k=C|xNzK9kFEu7ie-(dU`BnHyQ-yk3Z3VX2m^-T>IK&2&Av2XGnyMrKwCQ<?n
z?lVElM|fIHxEWYL8q@FE9R+0|(4G}grbs?*cQE^o-No#?b~j%{i(LhoapKQrO;9h8
zr;8!7*+#(v;wa8U^C(7#7xF@%Uqp-j1*rqgw}R}c_r7Dd)02hqh4%~wi;fu$5+DuW
zNfdd(o1iTao~(=yKng)Y4sj6wAJDQ7P!0uI3^L4<lko%CfyeERzK9k*3R)@#*2BUS
z1rm3k!{7oMj(Gi$zXjxQkVin~amX;$N4|c@9|QKual4Bk!(K#-x`GVmU}1^@DZ1Vu
zBge6aONKiJ9RH764k##i6tgja9Qq=feIsZ$1c(m`8K)A42$L2Dw(KeF8=Q(6qOLT^
z$Z=|Lab{0u-{C!nU8B80p@EZyiv=|HW^Tz~pd8>N2ij+^X&%KiBl{$HnICu*(Zh-@
zfJ2-q;)T4ZE+{nk9RwzW*0zG?3%Sy`*gyunke9CoZBpAlL!Qxvar*-WMt>p3i_;B^
z8RHoRw@)x;%w}Y?oc_mzF`lt<dW<P!KV#(dH>Qm3jGog=%ot}g3QiX=XPnIVa{Cf<
z#?_3B6Q>7QGNv;g+`hw-(VLM`b2^JPV>)Bx^c-u($&7~6Y#93)1*cE2VLZ;*I6cCa
zv70e-`x9Hn-;9hF(;wI~hBMBcZsEXa$0Q;;y~2S}nXz;F90x{uM&9Xr92o5xr%wOl
zz^E-*2x?Tc&$k0@z5?$o_E^G@@gj_Q?{o)8#>csHLDO5HWdkNl88|wY+g~-A$q?}(
zg5B{#mGlpjnG8`cBG@%AR7ru@F)t$61us-dg4l5vsw94xv@=M&h+unZ(!tPT(!$VY
z!pXq#B7$QlXvze%V(vu*$3oEBX>bE0f}?Z#1SdviM%C$CoEWPa6Q>(EGs@|)N}9AX
zNPyR*MzAu17rb{dXuODEyUD@D6a_NLq>TZxQ$2#^;Pe`2MrF}T)AtNay+7>l^S)+~
zf@oz4oW8}GQCaXOC@W8Rpuq5gfwAdD1nbS|FPs^T85^g|xG+j*o&+uX%D!W-c;T1y
zj~5Zl;I$kVeo2AYf}m4gF8q@G@gjohr^!r)0+X2x6JA7!S9;&Fmjt=vMTB^w$xMb0
z?>qLOZ3Jwf9-oO6BioAzrkN%)85%$iF_B_acoD%=Iemc(qZ|{H<@5tCjM9c5LGz3t
z{33!GR9!iPluk%6U@+llV0aP1c+f<OLFI+K^imFfrkEFDGKJH5Tp8sVGpFmgGRiTD
zznt#l%J`n~<a8T1MkOYG#_0)ejPi_}(;M6v`xzyt3%E1NGk%<I;La$eB<~5bhEs+~
z2HFQ%^ddqY+*So8gBKC<oYQmM8ReJ+EvNUmGpfsiJd*N4UhccYGKLKE<8}u@BgCNP
z>@OmC6sKQsXB215oc_X{ae4jR>^pXuCNmjgUW7}vLK8&Pi*Tu2Xo83UCx~tasTbi=
zuHbzSJPa%*ybNY0d<+j>gv;=P5(Fr6UW7}31+{!Y(fcA?`Yt$ufa;lW>7yJnOwJrf
znS>`LfJVX?7QG0Uo@+9TA<bl#97D>BaOqYK874QASqw=p!liRTicMxQB)kZh4xO&!
z$(YWVIDLvIqjI1iXzUBLaS7bZ2;=(*I-Co%Knb$C(4G-83B}OxB7y<36DvY!C8+uW
z4Jx3|&Af==-#DGai_x9&>+}FGMsdd0=^0*(>YP_W0sSIEo^kpNFGejUR^I7Hycqi#
z1Ga~FGo~{!7Ea&e%NWeKbGv{aBReDGj_DHqjQWg6w|n?AS~D>|+};w%=*Gw-uR8rq
z5aWB0>R`rjMQ|MoatO$QpjI1bHMI93`<odG+%sNCi`#BD31PJ1+1`-A_<sW9g6Rz(
z8Pk};M5e#^$QZ3y@qwX!3IsPvK<EY^2n`Z%bl9HqiBW=4$T=W1-Xp+~!PnK-KPVE!
z+&<|uqa_pLoatx2GF}&5@PW~3#Ro>0H6Ix5UVLD5eei+N-DmoaZ;Z!z=X_vTI_Cq!
z7M~9cTV1C2d}maaee;3Qd&>t#KamfN{x%;N{Ubgw22S|E7*z3rF=)f~Gv68c865*Y
zFr0Szz;J5H2Zj?*J}{h8fY2Z|A$)4b2ZmD@w#)ov+|R_9^MT>bmk$hY7JOiM%fL1L
z<8MacX@3}5ru|`z7QFF+;Zwl}hEFO`oUlFT4`T^qJp%&+gG0Uph+_D_@PEz+hA$PE
z`2Up;4FBJJU}Rtb%P}%=fN5m4j0`a-VvGz05dPPa4-8-5d|>#t-~+?=jt>k!7JOj%
zsq=y1XU_+QpY>NhF#Hzz!0>y*2Zlcq9~k~DfM^0a0;KWJhYt)O`mYa!2D4{;VE8BV
zf#H7$MD4d2h}`!z9~iz}_`vY}$_IuYIv*H*1VC}d2ZkR79~geG`M~h|!3Tyv6(1OW
zBz$1_!|{Q^?~lm`hCd-lf-N5y8G0ZFfegce85v%DU}X3LSI5Y(<O3tap6wd{85NlH
zgHscoJpF^M6kLmn@{6n#+%k)D%M*)I6%zAO6r2M>6;kpQ^72a*auZ9EGZeYDyE8Ib
zGBOz%OmAXhvSl(d*nW_SDW5IdH7LkG$V$OEF%P6TCqFSo!85=|M?p13p(H<FAt^Im
zAuYd1Avdu?p*XWDRUtnOB$ZTIl3J_>icq*S!X1PBJpJ6QK-v|OGg6bYi%WAAGK;~E
zFwo;-V3@AY$&|bO3MbPIrs*4an9A#Sd|=`{@qvl+$_FOSJ0F-hUwmNV{PKZ`^Unt+
zE{+dOTp}NsxMV&sacO*D;<EU_`1=JIGjVx*VB!javJ*ZqaTR=E;;Q(-#MSVDiL2uS
z6W0u=+zK!a(}zLVLk+}`po2IQ*NzYMOk5|xE@a}m^MQ#A;yZN5Fme3=t3em10>7SC
z1`}m26L&q!2PSTT4@}%LU=2*%DqtGqGbV164@}%PU_KLfzy~Jo6ezpm0~2@02PW<r
zADFmTd|=|<@PUc@zy~I7Xh?G30ILI;K@f`}#WNE(B>0)Qe@x%O&lIs;M}SF$kp+~(
zw>t<jO=6bgVfnzs!|{QMN8ke!kHiNi9+eMFJO&?_cq~3J@z_lNAj0Gyc!YtWp^br|
zP~iXn|NlXHKQOpL#WW=lVm=-abp-+p42+B*@ed4^b0A`cg2-aiCx|ks*B@YD5D;Nt
z02#@_08yTI0IFOV#D`ercmX1&X@C%OieX?7$Yx+*5NBZc57is402Nb06>DgN=wpVe
zOPm5Smw{n&Iv-yG7Z*1-0}G?b2PPhu4-AGM7`T}fJ}~k4d|=QrVc=l_1w_aP2Awku
zyc`Z6n0R77FzA{v2nm4Hq=1c4R{*hdz-$c%kopQRTeAVAzGeFoF{X3O_3EI-IAC!G
z26YPt2K5FGMg|TB1`t+nVPMd(;a~%?83Y&@G#nThG|q4^f%zN^3>p_07&KKlz-mEa
zni>oYngvik0|SF*2?K+c0S7Bc4y0epgn>bO0+esSz@R;ap`JnK1k{2A29R$UbPb>m
z5MTiLh(UJ-5`PW@gYE?=pM!xx_X-1p-U1G0m<4)E7#Q^TK;<1681xS?Fc@rs@+BA;
z40bRu7`}lzz=DCn@IyTVgHa4rfdB)85$Me077jj`fhHXc45lZb7FaMan4V!^FiQai
z4<yLUG8h=l8KCk43=HNh3=HNX2zhe}1_pB-M2MIhFff=$K=~Y?NzNDs2J;4}00RSq
zc?$!Bg#pw+4h9Ab69xv09;gFB{0R&U7BC-y_&XRFEN4K~3ow9FwIxyrSzcjau$qIA
zw_3o!V4VZyb1*Q}TNf}e*k~XGY;+hHY;Hh<NPvOC<_-gcEs_S?0tN;<0Yn<G6JcPm
zvp{&j&W3@(o(C!~z`$THz`)=L+9C}K6cC$(fx+<%)I$Oc^$eg)<P-tbz`?)(%0NzY
zpb9|z1q=+%9ULsMC~@v#U~qnekazyTz~Hh1A@8z=fx#8YJl7Zo2G<;f16>Ok7+ep4
zTmy>2dIoTT;g$jo0RaXEw+sdbw;eDA3=D327#Q51Kn>tvU~qfEz~CN$karJZU~oTz
zkas`9z~BK(QydHo9tjK#9#;_RJ#H{Cc%I<k0DGujfPumD3<HCY1_u{dK!Ab4M~8vI
z#|3I20|Nu7^zto0M2T++1B0Ir!ohw43=DpE5El47U|{g)fa>R9VDRT*VDL{tgqVK@
z1B3q#2)`a=ssA1Zh5%T$<6vM2FkxT__<@L$fIkcjfi_SB1sE6t9T*q__dw-A`~wUO
zK@w1T4hDuG83u-+3y3HQy28K^x&-QA2?mDH6$}hv0$>N!gA0!^5e9~^2B?7?3=Cl{
z3=Cl)A3;48_JDyQTn5TvU|;|hsNpaNf%py#3=s?n3nN$<7$OqD7BGMco`@6%h6qHW
zV~DuGz!0eck_R=FIT#osbr={TS3rFrz`zi>hJhjS3&KH>KNuLI3P2hlC1X?x14A?i
z)JGf)4ADFc4ACzT`lH`4FvLV4)W^gyFvP-gg#`mctN;T;tPd#vfjkA`1TZkfPJwCw
z@n<kF#F-#0h_hf|h?|3OP}~9rhB%myI2ah>E-)~}t03g#H5eG;K^A}#IRgVjd;kMO
zd<Dodh(LS|14H}-4hC@igM{LzFfhdLf%<@hfg%0?14DujG)OrZ7!m>)7!qJ5A&7s5
zfgur8(t*t6U|>j;U|>iLfqDSMk6>U(oPaP7RJSEvfO<%Pfg$M%14DWWM?Ji#P0wIp
z$WTC}@(dLQhKv}50T~Gl4A~4E+@J)@V8OtU&BDNt4e}w>0oefz4A~$bg7^#!4B0gd
z3^^$X^Kvp681nXTaDw#<Fff2B^t?OuPzx9s81f!4Fcfq^eUQPxP|(A`P$<IzsqF+9
z7zz~_7z)=Q)E91GU?}_oRnNh|Q22v^p$Jyca4;|w6)-RqmmnNaT*1IlB7rckM23N(
zq#jmVaWF8H9AIE5<v|!&D!{-{ij>Mr9T*r&JD?8WU|=ZiVPGgdgT%kUz)%LtC7=-C
zU|=XyU|=W<0dYVP%)n3<!N5@QhJzgz0u>(^80xD8pw+Jc14ESv14H#3XvrkNz)-z_
zfuSw}kp}8w7#Nz6YR9Gy28Je3Q3|qygMp#x2m?d&0fY~mk1#N_v>^B`9SjVu98eDm
zFfg?8Fw`@&Bh_y06BrmeWDp8E6c`wK44@7Gu}v5ldSR8700Tp>4g*8)1gLrg28P}#
z3=Dl5Pzwzh82WS=82VbEAq3)gFfjCsK;;D(82TmZ85pJnKz&@nz%V6*fniz+2M;)i
zCNMBet6*T5z5*&Qz`!tl4Fkgrn1uoi3^S%MFwFP^bpQtg!%PMShM5YW;D7}AOce%(
znK4icLGlR<46{CP2!PF(U|^V4|Am2JUJt|qMgazfc@r2I=C?qy35Y+xgMncI2h;!o
z28IPZ3=9i3pdli_z_3t<fnmuEXs%FTU|2GTfnn(kM50?dhk;?)0)+ZyOBfhd9D(M7
z2@DMND^4&lZ1I4)NP&T2iw^_CRtJOuTU{6!w*EmFu#JI%VH>E;2=XKc1H(2828JCI
zpdlu}z_4Qq1H%y=gn35{7#NNq<%%N(3=Bu+fHZ?csGi}-0tSX7H{b#cNA55%90k>0
zV0i|HqdW`@M~^^41XPwEJ;A_mj0YO03=9m%1Q-~O*&w3em;(dDF;J?98hI>&f#J9f
z!UM-07#NPjb5T75!|@&lhBFVKK`6n%aOMdE!?`(#>iFCO28Q#n%7lY~;d}}M!-XS=
zD7kQgf#G5S!hsh{7#QBhKtn)-f#Gce1H)U8k3kONU|@K=fPvwo4m2CqOE55eG+<!(
zR04G&2Lr>W3I>KxGoU^M@#iowd_pRkKOJCT_?&}K|G9vH;qwNlgE$x%K5t=QWORXN
zYeq&721ZsMc%zn)Re*s}UIXI5dIkjsM!OsaMo$9{UT~^ZU|{q#VPNzGwQ@l&7GPlX
z%wS;jTmp9xqvr|+Mz0uz1zrgZj9wu1kSJsH%3xp&u7EmFfPpc%hJi5{)X0U(2e&XV
z27|IC1A{b3h%vZ>fiW0X{W35x2CrdY3_daaiyG5v)(Z@bVItF)s57Z+IxsLWd4M!9
zfNOOIo&W#!Y8V)pz`aJOn8W{n-%F-{QHS*67)luY1evNKdPEo)7!3aZ=aOMyV3T2R
z5-xzsfW$ri{})hTU|_R>i!+8PFfc|a!0cmSl-FTkRLDW_BMcZAqn9A~h6@-NjRc^f
z#K6EPW+cMEXaQ^db1*Pk7%(u}Wo+M|!E}OYdW|;I6tKIe3(jNIpKh<ibcEIC1Cve9
zbPio61(x!n`KPDr=rS$hvJv>eWYh40$tGcXU;(4XG(9GE&IuowY#2T;Sw8>^349Pp
z0PzGqFj+TzV6uiNoL&G`Y0dC~$qKGA0K^mcz+~0%fyoN0@&Qz(6~hN6OSno0#t%%E
z0w0(x8$K{uLRALnLu|KX_`qZVSJ?pK34CC(X!yWn0abYbs?vht1Cu#a<sSwH#t%&9
z0w0*n8$K|ZLsc3WK+H5}_`qZaRrx_dfbj#9nZO4ovxW~$W>A$2peoH6J}{X=RsR3Y
z0OARJU@~p^z+?(lDPRaO)0E)@lgWeaiiS+fnYSM|VLHOWao_`!ufYc<-{}{PStKVH
z@CgX~{{b?>$KeB$&xQ|7J`=!!%K!g|0mBC-?*kv0d<;G?`5-Gl!1#g5+u;L~_l6Hl
z-Vo*D|1W?H@jCE<$=l!qleYi^0|V3l3kRkL9%fV&_<sQu>|PEZn7lT8VDf@!;s1XD
z6m6adJ}`M1d|>iIvf)Aj!v`i$hYw7i8$K|3LX=DYzo5YIfyv{*2PRL04@{m=8w42s
zUoe=Q$R{iC{{kq+JRCkSd2IN=<N?ve|NjCgcH9qqVDd2dz~q5!Nh8AtCU=JqOzs;#
zFu6mO{{lym+kp>E?gk&2+!4yZKqMSKFu85`z~lx|KK+9Z6ASkTCf5TWnA{9LFuB3i
zPZuy`V&il<@PWzI-~*E@TwLJ)4*`Y`OfCT*n38ioFu5!M2etqt7F``aFu88{z~njs
z6k|5b+dEvC!Z}0Fd|)W9_`qOc@`1tc!3Tyyg%1p+4j&kb3O+Ct{`kO9+Vg>-^a3P{
zgNCwA&wOAgk@>)&)bWAApXURE(u5BTB?mq*_-A}zFmL(5ptR)!L#e=a6F(*~79n$k
z4-BA|CrBfxE6c((ed0Doo$2#+m~^IZ31WK3bj)G<l3=D~tc*Lidq*;5$}_&0zO{nM
zit+9A4;4&DV^%Siu(ApZiwLtSvN5u9%d;vfva-vwYO(3F3bHY>YI(7;vYD|;voW$V
z>a%jPF<0oZ@~|<oa<UnKX<jycR(UXgA}be|Rs_)stc+~TZ>N8)WU^<RyWO;k=@BQ>
zB=PBzEli<|7q;iOFwGWZ^q9^)jj4li*7hmWm~<H#?`%Ibo#_dig+3!Is|bq-$gWUE
z7712)W^Dx!mpN2{MS@iVg(t|YtpJi_Wn&K5es3PrBqqj#(+d|e`7z$veqbS!6g%Ud
z>9<!fSun2HF0zv8h$63|7|3De3aqTmoC@0?onqo(WS+phar)cSOxlbuwo9I2;*eup
zJ6-7&lPTlE=@GA(G}&)3GO{u<&z|1#im5NwNP$&_IY5DxhuKbnm6JIGWKg&QE5E7&
z$i23VjEuspjLh*MFEBC+gV+%uHk%$BIPf$WS;d$m6j)i=6j>$N7{N3r8?zcCs|s_J
z-t@xvOcK*;UNc!S-r2tWHPa~$Muq83Uzjvvav51|n1#WCnytXfDq_nj$tKJyCeO;s
zrZ3DY#KtTHG9gcaRft&#<ib3N6+&#xf{e`haE<^YD?f7qoXZb#fWq_-UzpSwtEPK1
zGb?Z@vT`%Bh_W&=uh{PRl}VbL@yFCyW?ROIQ)e?bG5uhkF3-rU#J`{t;wKgfkf-lY
z4`5`j68>AwD9WnK#@xWd$jT_ss>Iw_GyN_jvm9gN^goQumW)59n=vu#Fdm$q%)~sI
zxw(RIdY~w?7MBDo4+9emBlB<e>AK9!GK{aLdoeQ`Gyd3K$IL9i%6MRUKL@if)6b&m
z_c)j>7=KR}=VVr7zgc9%%F4WRx;-be0^@<{37pKzOwGL0TRE9cIPVncu?ny;PvxC{
zh?Ci#>3iXJW-jIza*RsT-)Jy9@;+x%U}Y6%Wn>d%6`nucN|X5v3paD7*K|QG=Ja|{
zLKb9GWYuM3WED|j6=YLj6=7p!6=l;GXH{lnWR;u5s;t8*%BI9B2N7n~WD{Xkmj|g}
z)nsGTV-;sMW@J@l_ElgNWMekgV-;s(WEEudW)&4>HDF_84N7AbWK#kes>iCroDB+p
z<|kEpqO3}6jI2D<-)b?7*PjLjAoF_$1yH<Bub;;%2C@qjNP4V-Z2GLSATArTS_G>E
z8zZYGL_(C!5aa+>2?bVBHe;~!BotWXnKShCSXG&I^;qSZgF#ZviVDIatm=%cqRe7?
z!mKiEjI5Gu%vpNEBBHD^Z2YX2D(<Y3Y&NWxU<rLzRWNM;&f=16-e3*#x~!6Hs;u&C
zysWmW3apZBwyY{(Ws1UVjI63)Pl@PlpRLU-$;5bO`c_?LC9ZSjjI5lZY-!Bvr$5wX
zmT=ixrU2%%vNE6GWMpe;0eOQ>fq{vIiOq(UgN^x7ofj)7h-=Hr>QthTmS)2$!mMV)
z%E<hg0hH;U*Ug)5p~oD~_-*<GJ?0{jHdaPfR_2#gdaS%`%p!Vh!mP^j)5Y|emD&HW
z+pzL5Pn+(b&#cGG=EcgxtjGvbl&m+sQJ;A-`yqBcRvzXf)1?iVb9h-r*)qVM<z-{m
zoj%ooS&@ZRl+9=QZUbg5#S<)yteT9hyuy$O<Yi;tTg}KS2=cWw$VijzLWa!y7#a6Z
zzi7l9zz!;D=J4uG*EMEVVO%^t$e3A6;s_ffs{k8Fu_3D{m{tVw^`=iXW>#lxo4(hW
zSwrAGHzP>zq!LE3Z{BbJYRoLlD8M|O37j4wg0+m(rA?W=8Pld`m@>;TOS3Uf?=fYT
z<DXE-$jU0rrpF=y^5n<qJ58DESy)-wY^VE}F+X5cVC7}gpKf5z++^~i0F;fvsfYs<
z{LIt%^;m_qSy|cCSa}0k)!7(Xbre|D6+k2}n?9Q!8*|n4C+5si^&-qcU`H5(LT+L$
z$QTi}2#|g6m_S9K5i1Y#Oo%WmuN}A^5dc|i08Zxu3am;BtWW_VP=J7J2N`I{Y6T7x
zZ?s^(%>)TG5oRYFR$ew1=EDqn+jm+pmoYJ(pKf5y?4iKQrVmc^tZcU6x(Y-~feTnL
z-)8y-YvvNkziA++GBOH-%Vs_{Q1!yf#@s16-PVS=fb#&O9-AR6EA!#$+iaMvQb2_^
zn;xqqbLc!)AqQ3&c~&7sR&jk+F=h<~R&nMC1w~d?7?V|mSzUoujyXnwRfJhZft6LC
zRhl_ck5x*MRa%Lam5o_h0hHUALqMriM}bwCIS`bJ^|xo(GV?MrUY%ZM$E?n{aQZwu
zW)BrmvS-tSB!4#MiP?G#Of1Z7USLvz)s&6-y~w=juk4uBVkV`7JcJa5ZzMn!kv=P{
zD71dD1xvEBDYNo0Kga~D=4WGMg+%x~F_7v=7AaOX<`zbfq_D8CC^%tq=uOYDXHE#<
zVH0K*0M#>!tiqsZVq}$KlVoLLW3EzQ<%ZVxu=W5bK?|3#a<VCcjo@U{XY*oHWCg{8
z4%ko3m3q@v9GEr5I7?ZD<v|MBY}gcqVXCLcIxtHxDoihPU^d{9W@BDj&&bNde49aG
z`br08H4G6|4p5LXvP$Vq=XGQjSKwh|o>>p7D4#PZu*!gHIVDzUHs<N|jG&V6CBt-U
zN9JlaR(a;H3<}ftIx?FoakBBVDuH~(rp(I9ET9KY5S(nx&Gn2d8mw&0-&3bcIx*|l
z|B(b0lb}YAKD5ze%gV~k1xo!3L4~*os6b$q(O?x}u7KFf!^jE>W*!iaSy+#ak&XGJ
z2*?2DquGq0tiW6j4Q^pkRt`{!4swPbs}O|ZWQ$~FHDome@z@w8k%bl6jM7-7Ko##K
zQO4;zoS3WY`|9;rMc9~EXX}B4uZ!sE+k*JZvu#*8*$hR%5x@zu)R&csnTrvWEx=BZ
zhBW15K(>IgpEs)-8>0fNC@4`Vf^#hoh^YkiGpwPv7R={lGY|%~^jNjH*_g`|z^z9?
zo9O~B%u)g%Un{b5g3_5DD;Jx=bTb!bIc8R#3DYB7m{)VL@~|;0g50J&UEGy9oQEw9
z9Gc)jnqKe9EX6o|`Ycywea4T|Pq{M7@}DUKmEc=AL2lG%J~*ApjXBhPJ0~M6FLPfO
zC>TYeM8KJvjgeK1pH-S!!G=|wd2_u2t2Faj1_f47hGJxXTMOb(Wdh~hjbOR+3<?U<
zYuuP6Ro;k#47*taGE7)lSOgR$daSI>OPKWx*|bGPS$UZortfrPc2v^?wb>XML2iA=
z#0XNy%EV^N%ELSnoVh?j32OK%xHD_Yf^#q^>#@qR*?~E1Y{IOppoGu7aC)FSb0g#V
z>6hJ^v)T1Pb&i6<bQce1MPCm)R%u06DMMCCSym}!R!LA+1LY}D8=RGSQ@sMKB=bcE
z1y*TURtQ&``5c1+tFQ_yEAu+AEQrg=rYI~dEIfU+2eWhzE2|?bk1VUW3@a;}lCUs1
z0zqw1P#R@rGhpSkgXTd+VOBvlc~(y5vkW$@f}k)2r2yu$4B%Sbk&%^?*<O#8jg5I<
zy&fy8D5Q@7GD!qpPE6PHWVRJ!U}9l`77w5{5Xk-FY>d-eJej>1&rd(^$^1~gk(rT2
zm6ehCeF`YpMHm^u!EOU-RW6YLrBhxu=C9MQdof3|KVji#Wn<ns-O`&`#q20Jx*mc{
zb5>9d!m7~3s=>_32o7W><`zj%k;$gV$_grWj9B<V1=fk_lf0SzEtk~Tuxhv{fJ)z~
zlAwy1`C%HUNzEz*Y8fhkjA>$JWiGc-VAU{CU}e<-sb<w-o;_W{hxts(k~AAu4LeYY
zen}FP|Myohva*T_vx>0^vueq+nkumHv$8Uu&j<BY#F#e;D6pD_vx+IQn(BfQjwA~|
zt042ie2|Alg&9HCi?T?tiZQPj0BHm@co><lO!xF<F6CG#pvS_`#(Z@8F<<5|#<kOB
z{g~SryQeSlV@_v$FrCMrc^cn|d`1yrMn-U=Q&5=RD8wu*0B)0S6JRu8uF_-SXFfmu
zvOlvm<M!$N0nBd9tgH^xV*;4nWyRb<&S4d16JZrpWEBBb`jA4Kl}%B2`tbl}GY1uB
zX+2h1=0Z?rX69D_xA8bYsR7gkWzM%@6=N1xV3k#774=}1Rbu5<WR+!32P+m;0JT}C
z>jpBb)*G^ku*!o(<yqy~gjt34SY;JiS=n@j!R=U3H4UmoSlJxe7$Idgs22*ZX+Y6u
z0M1~biUeeYu`sI<8}n5bMpiWiRwD&g0p>N;3am!VS6CDjSp}F^S1YjcL#isMGFCQc
zkP>h@WWLP8C@caFDjQJZ)MImCo>N`I%FD*cY6PlU<yj3t6dS0Z6ow|G2P}F_%-f#^
zGVkYL%-Oy)iaCLU(PTPXGP5CL#&nBh=5)pt(-$N&KW0pr-jc$s#F(*tc?z=*t78rG
zOioZUjFl7A)nJxlWMX1qWMr{mWn^Gw`oI|6!fcNueUyQbi4i2v50mehE|SG;#kgj=
ze-?8V<Av$FvY79%Dlo5OVVwRki&<p)`fTRS96HQv*%=iT6{l~=W_FpD&CEJ|a}Kj7
zqrvvSIm}v&j0M{@@|d?WGA@{YFQ0ijqsaEM0_GX4j0W5J%b2~`IL@&!vN15E)l5&U
zVHRP0GQF&ZS*3mg0|RqWHv=np9ZT{hMh1rC*JYU*n8n-~7y^_T7#M^Y7!;N=fB{o_
zH3vHb!@48YEFkJ!H6sTDLt1e)6FUP#OoAH&!y-pp4bbpt$Yqdmt5$=AJZ#e?7#J8l
zv=|sNlI(277#J9eA^J~hF);AWd}(I~7Sm#2nE8FWdM&fALTM9Ysi7GIH%Omj6JxQV
z83PYU&BbaaRtAR7_0vmgnY9?FOrKxNtjj1c{cJ6>Cfig-28N*N)Bn^m%ZaVBmlg+E
zlfYrG$jQLKxQdB^!Ay0!K^?P(o4UO!F9QR^4F+Kb2EI%VdwC892F9C7AXN+uS_}*e
zfAKu#Wnf@@S`7&-eGprVfnn1Lo+ltT6l*asWc{5!uZ~%Pv3UCaI%YAADP~fv3=9mD
z7?>CsR<S`jj7$s+$Id`GOiT<62coC{tz&j%Y80RDP|qx;al}j-uB%D}$^q%>ZiR9{
zx>}}Aud8QvV)UAR5Tr@cOa`t=w+zYwX>xcA<$yF<y`BCaq{(`^Qv<Uu|8fg6S+FjU
z-29o->l&Dy7*9_>*ubpE_t8uaE>-I^{ci)aBhyil=?;y|dVGpz@^HC6zUeiM%ubA9
z)Au(r>+<j7FjIibZJIs(cO$bd<Im}uP0W7v*Uc0~85kIkDljoHR4AA!aWXJ4?9>2-
zx5x?+2U!jV1~x|~28K3f2RV=wIM|}I9OS_qkYDmPJ1BrSJ3;Q%HE@6!$0CxGl*r%!
zGLDgh2V|W7T>%F*ka4e>7#NJdIH-d)S%IR#_>Y4Im<KXKr^i7P#F@mx#K6$0;h+WP
zu!>|B6*4$zgE?$W3=AxrrW-Uft7)h^=!3*|axpP5L}xh|fH^!&3=B(S91KC6NqkHU
z42rv_*EKVXNgr|W0IkO20NHBR>EI~{N(meg1?wRSd<7X8*nOc2{J;tXAPOEdGpp9O
z=s9?EGcd5dE-o=NW^f4LW?*2K0r^kkLx_VJXmCCZ5?tmW%XfmzDK~Vm0CPaz<5}%s
z3F6!Ud9UoMgB6&=AyQmW!r)*H=73z!CFWoQ$_yMJyAMusum#ENlwgWyV2~AXumeY#
zlt^}JC4+-KSPHcHS^0p21Bf$81(bzK9UQ?NRS>7%!3o6Ksm8>>pqc96%*nvO5vIY!
zz`(BW-~!^L=`b-ca5zkV+`?>JpDN%G%E7?E2}%?^s~y6?T0veZyXp`QnzNY%@=9Qh
z18AiY!z5-<aJx7}f@MJdI{3pO3ap0}5-ZVQ8FnTHh7HRdKvV7vlR$yav&<nDtc;V1
zfuZbzLmXHcH&Z<WgZF-ic(4>GFqV2cB!HzLQR$Ef=J10;eal~Nhg6VL_kz;IN{2MC
z6v(OJ(GKZg4k(d2$2w$yIUsiz$2nwzIbe5tI%I)4Aa_q+=a9|8z~IF&3FPqOISx5s
zDNuTANp;8tb3ne}eCUt|=74;$*~lRu%mMjAh}!|QK8;}#7sz!E|E9;aF-z8)IFx}^
za5FJ5oLuZs4(5P-#$)XOT2a6-i5H|ilb_iEG>gS$0t%0-4vk=SAkVPgcW450K%U83
z?$8Y8Fo85BJr;0i<6vOmn!v=sU>@es4weFGl9qAkkYr%s{2vC=b;;bJ6D$StsOtlV
zF0d3UB%gMJ!ukftH+h>KdcYhWh8zY4=C4c)4*ek0pD-~n2wisoEx6!%!r;rmP#-bf
zr=3}v|EI$=2?hqPuZ;VA85nX8PA_X`)~~-R?68P~fq{D}BrhxmTMTm3#1IG2JRid(
zkdxG$9hQP+K(SKG=CBOR0mVw-DTn1?SAZP5Ny%Xah_e&qzIlEQE5RI4h8O5{SOw;Q
z!jenOVKtb;Co)~7gITe@l99(zjDvxJ?+X(H1LqM(2~H3j<cf0>93?p!82DL0CT@~+
zl!EAEVqi$?c9a2gK>03S*b!6!GE5R;Vqn-G?FcRbcM3BxFobY8f~q2hNuo>)3~~LA
z;2HTzVoVGSi+deGwHU)r@p>i(27WC^C9tO?nHU%rU363in=Qq}z+j`~r~>B5FflMp
z7Ip*`jr<~VObiT4fsX26J$9hf^3_oT%&});U|`O0)B<xHm>3wAnL28NIiTXXX^$gl
z9*|$fiHU(h*~?KEwDN~xk|z@b16Qh}9@ru;P$_2O2q`Xom>3w6iX9=vr5_Um!@^QW
zBT$f-1TZl$aECgYfb}FWF);LGJDP$mN@8MQ2zudY29`+%`8C+l94wQ{#K6E>><C(=
z$1o|4iGe{T&e5_STu7xeF)-|nbhHAi%V%O>*p%!DDdq~87#IR`9c{rfB}@zqGr1h?
zz?@Ph1_motM@Yd|#>Bv|WSOG_Sf+xBfx&i%qa&D8$;7}QmF?&R=2S5;FoZcdI)gdY
zAfxNgJA&7^h1D=IFr>IUx`GSm22ku3JGz5C(E_UUJ~?`TIc=awzV7G=Hlc%wfgx(L
zqZe4FlZk=Bai60%Sf-nafnnu$M;|b!hlzoqG|bT#%;{xfU|2WZ(GSe&1C?SYr#t$C
zdHqZb46!>M!HfDPfimh2ZO1^c%tTPxxxg_9%$dZ*z#z%v7!2l22FaXq1Qo;_VN;kG
z7-IAt!#Efi_+4gz!hX6Vq$Hlj#K6F_)e%w>&t_s^u+Mgk1O>gv(K#Sbta1bw#W$8P
zF)-A{Izmd{6-*2araK*DLB^@9WMW_lRdb93X*#+AREh{Y#)AWE2Z+-%y}g^cw!VN-
z)v*tx{slNsJAz6DNGr;$)DcuH@V@}%X;nkViC}|36;jIq$4OwnXfZJ`w48CA4CZJv
zF)(=YJ5B*v0j_qI7CBA>nfwD(?%C-%&J<=~5a0l%>!p>BpoI+r5{c8Bdzf9-3$+y_
zK*fqM1H;Oh9AexY3=9G>ObiT0nPNN=3=9H^pxj;AGW~rIvy9?Z7BPO10#L+C%ZLd;
z6fo#BFbHG|GcYLRP1osVmaM;G!wGg4s1RB?--b(^fkD6oRPJ0*wgEM21)V^p%hH)P
zeBi_YDj3uaZ1_MegPov)A#$Y+KUhYDiGksahz)3lo&j7IERC@d04bX!4$A%aYy`pf
zNPsenp^XrjBPlZdNH4QM?im{~kQrZP82A_%1iG~t7$jEMNJxR4s>Q&N)@UQi!@$7s
zRhWSxs9D5DnS+5ra2*o^gO9KcxD>eo^7rBkHmV>)z)g$Dl{RW%4ycH$QMCa#w{C!Z
z5>znVv5#51{<@QrFarZ))ig#1hGqpV1_l`!bq;w32EiLz3=B;+>KvL-c6pn+0Lb<m
zV81Xh2=R3?f*RlDi=BnJ85o3^v=|tUoOBkJVqg$b;{&y*Kt`tV3o|fCc(XWzvc3?g
zym2vfwgNTEZ-ATb^-+v2mQoB1+^oV33^pAGt_B<o48ovDxMc2X2o4;OrxMa#jldjG
z;_903YAnRSpgbF-Y^kR!sE}d=H<2`VxtfB#3kqG9E?00Nbpuqku3zm6DWpJ+8P$cZ
zAm=blQe={2U^qC*6<ieU1f|u2YF8Vu*`UVLfp610`kCeH=et-*Ffa%U^D!_8MF=x6
zC~f6%@dCLMR04aoxp;%^WDrTsOJQ*F0drVDmGUle1vg=ky1PuEO3_UOECuq<*=#pa
z5N9VSg|#uefunsVsD;6$>?RKODJaI8l-(piizgW-fm#*(o7_P46$7}HyZERZxV{2M
zrpHq^X^?R@K*=&X%MG+TuP+vq5*2s5K`JkKCI*JqHEwdE3=Dm_3ZRIaZRHX!&A=f1
zl8=Ew*g=?qLC{FU9pqe*La=k)LC$65U;q_iio4yx?gcm4ra8KU+^f|Na@5iocX5!_
zllVbJZ=^e@dSw8+qvxnQ*ts`A?uajT2RWCK0~9lzJKe#~odk-E=qz_oT`MQ62y&FK
zrc0y(1A|B{$WiaK7#M8IUFxI2=}wD*VPB04XbCLCPGJTHo-BC}P|g>P1H0CP2jmKH
z4p7|f!3z#TP~i3)_22_@KyA5zG7nH$z%U6E(s?ExkW30{%N^DC5Cj<jZe46K@POn?
zQ0pS<Xs!n+RNUl2?Y1e29wJ-}3^^x2A>Cr;AqqAdRR8zOd4NKNVJE2mXP@Z-4wV}q
z@2>Xu0Efy>P(oZ9=phN#BM0(s_->a(Wd;V(EItMXky%;{3`?g^7nsB>Vsyyer9_^A
zL9|+nfx&9MOFs_-10#nP14FieOTQG9y?(FD1eo}Ss_9{qm=(MOT_y@LFo<3RDc#_*
z6c%u)Aubyf7#KMBYB4Y<+;_PT690OQk%2*Qqsv1X1_n+AMlA-0({(P7xIsBri-AGy
z=k$Y<nC<ITJ*B~YZ$1VO28LQ)PZ=<ek<WvHVUvreEQH7J!N9QA)>96`6YyYQaDCt@
z58(-VFfjBS^;7`!_=Ffhoqhua7Eeij1_rS^VGIm$`kspH3=Cr7VGIlg3ZCG`(G3PS
z28O8_o+|as3=Cph^+8I785l&~3wVN>NaCO-jV!w-q=f{^P~C4mAuS|O0TFc06Wn<`
z3MwGFTs^^^$CsegFkzV|xbt`el)H}gc<O-S{06vZTEb=Hsn5Z{ApVSrfx#=<6Wl0z
zIsM;cX1UmWSx;k-%A+7{`I?@f5{Ka^D0OHtd4fxvqo6WXi^~&S;v5C_P|n(Uf;xZV
z&p;`Kz1b7o`Fm-=#K17?m?xz32de0Fe@?HQ!Yo_Ag2NNkxRI3dU|>j^;|cDx-CzU-
zdT@;=xYu?Aw8D;|%G?vwZDY8>2wJ1I;-V+0-^Or*k=cWRfmhGd739ntj4U1u4Dw>0
zZV(=;2LnTIohP`pbAyr1gMp!bzbCl4bAyrHgMs1Pb<cWFh*Ay@28M16PjHLp1|z2j
z1H<Y0o{;j5k;{XD!PCJLQou2CgDhO_=?l@v<H5i%J;2is!sGQ|U?}+Q=?~$7(n@Eh
zX8?o;N-K$9JOd#-P+D32!80ft!WC>~EJ#dY2nLPz@PVq;V?CZBU@35cx@0?tC#bz6
z399Y$c6vsDq$V+lfb@7qaxyST#(?5q*xVD`+5rzn9P63>ek!wU{Q?e8P|s2l)Q0kk
z_5}AUUxJd3?oZDIkU2NNRvbRf174FTd6J2NAz0iq6(j{#=N0Xl2Ihbg(y<=TbP(qT
z2dJQ*$i(3Z>Lg13hs0hkSc;JW;+s5>Z<ORgE<4uanGco&+jTIK#j}Wmfk6t?6*$&2
zeeE=6S-t}<o;4t`hhY1s-<Za%TAwfL*#Oc8OMi`E4mABWfjQ9h*9_)>(%<e0o-H8G
zOHle#PVsC7b3kRWSAu67m;)-DrZ4pb^%eO=K!sD|JkJi0%nchR1_s@qo}FNh!}OZz
z%=%$5tez9Vd`5W>1_m=G&xsHoXzgN(jprl?Ptk*cfs@;FGK8n(!N4Gr;5h}tQ}$qB
z;BWAp3gM}EFff>UO=q0JELHF5IRh-nZ0f<lpylT|6U^hV02Kpu3ZAo=85pD<>N7A%
z&k$x{kQO=M32G0@@iH+mTr&5Z3u;1!fueGztLHp$;R=ePH7cI-!5mP@ZyfKr0Mxj2
z0hRn*k)8`V85rbvLD`wL*K=__*g8-^>Fand0dqhBm2}i|DVPHas0M4#Wnc~{pq9M#
zgmgwhHJI`WPe^AJ)PN}c?+NaV-T*ZqIBPw@ozWYhF_!s<JlB8?0FANiVe?!E=70)>
zp!##3>p{Gopb}w<k>>`myUmyw7^diXZUl48LG3&p&rM*C1*lK>+;cMr1B0BbC8)=;
z%5w|I0C2=zIOVww%mFn|A}@Gu2XkCNebhsqJHQ+dP=CzGb0?VN!(_q0FhAXM7nld`
z`LTQM26IA~7#JG)JokV(5ljpWh6_FSf;pfZC_Z`mg_+Ef_0K&IfW<OEecgke2f>^i
zCI*J&-JXZQoC0v$$n!9m1M1~1xa)Zo90j1hTmq}-aj*=iTef+%=Ls+e)GhN|>v<B)
z0rkYDT=P5y=79QJa#^0I!JG*o*Ylfto&obfx%;@8=UFfZ)I%yS@jM6SfVx2|nLW>g
zISZH=7>=?{UoeZ=w!TTg6SQqg?kp&{+dQv=6o5zUqJ%xKfjOXRq`}woIyme>Noz)~
z=M69il(Y_R^1KP=fRfgcYR_9>4yaMVuIhOkWB|CfnUU-X+G@lw36xWN&v@PiE8}Gn
zVqlnA;du|7IQc+@$@Y}#d9#@%8B?Zr%x0FYZx`?c?f8+;V`5;Cu=acjHV~B9wfsC^
zfjCD&F51fP`5J5>$Po)PJl}vhAV+Z2dcFlK10{Bj7SDHJ4yf!n*5mme#DUa*KHE4v
zKXEWH$Zvv_VV}WLjBKDP$oj-|tvSq6^*x^7z@p&N%k?RT=TDG^Ti}w)^A|`8Tv8tE
z@%#<q++blaVqln4&EW~&>#5)v39j218Nrf_43P{BzRI4AOb{+(Bm<}hV`PSKnIah&
ztWS6{vOu`ZD;Nvv6H^!%K||O#WLWqa7>@OLGO~eX!S<Zf67ggNb>bAx@iQ=N<@aRd
z0tW&EKLf)84Npc;W07GJBR>O!_BT&PaC7k}6NvZ6laUu>%u$e`9JQW|;4a=#Hhu;M
zjuuZwaJTL#2R{QteS@zjqX1Yb7e52Tj9gDfaHH`k57ae6Ah{a?AYb#n=I~?$wGI`2
z@`Ec9Mlnze=q1QCAcu>Cc#r_9cH{75l;U7uPz;0y5V&=G0~|n6eV&Y<_A$c^M#lO`
z28Nhjo{X|!YZ#eUfGbNzIZ*u~%M5jcJQv6y7Elk8;iVA+!>St`o{XU3C&fm7aNC1X
z8LR^45EU>F9D)|&9G;AzHkINUsGGq9@^ClTYa-N2Z07J}1dTQ+K7%@17vd@gsH;Gy
z2;7hd1vkjM`UstFw|P7nLA^O8d42{4trwn*;I<XmmJAzDMsVZm1}H8-8co3(IY2==
zuU?45lMyt$q~ry4AGjR_)(KK;1y;+#5YNDHM#huTQJjH6dL?M2|0x55QgSCFNW!bq
zlhKKnfk7!eo`GRPo+qO-m?O-<(Cfy+3~HJyfr^cw0%j>51_q_g44{z$rP^jj1_q_+
zcJrB~boVm5N-!`e)haPCq%bn)fZ43fADDtOj2IY<J9wBGLBpBK{QL|ISy!gF&Sy5~
zKgZ-M3hFk4ixs)b>8Iy2Yt%<exPp?TGHA4Ba<eNBHv@y<5m3hF2y*2W1@$*U8QU}1
z71DnJW#7EbuHe+TlPigVLD@n8R9s|=aky%7Ffb^CI+;dHuHeQl*dqI8S8!t&+zfKh
zaRoPacd~$6ORl=$I&UW%s27sB#kBy|?$2N0S^%2Eo213SFuBIHkO$PA7iM5s-zwn+
z+AgC~4xYI2;sot+uL3#O_>UJCm;-XI$tf>xFoy#?RpSNDX5b>v_^1~+mrVlI+FOo!
z)q`^xcwR<d#S84Mub>)O$;k^eMkDAX0`i?rtA!V+_ocE1H2PNTB_aaqgM+MHJ;zH_
znt?%O4X6e^m*NE)<7Jp+0!sHPjKT~IP0<eC>>LaXs&hn&Qqvi{L5_!vRAue==7jXB
zK}|BxU~fn{0V?HpC3}P71TvXX<Km6zM+&d?hQtG?$k$oojp#?J8+ar7k!hQ}AzepM
zbR{)=gWL}3z3=|&4cf=ZFbP!jE|v0j02K}llR%wHE-`ONpC42;u={(1_P8>D!zq#9
z8<Zp&z`>-(=?y9+7{FcaMA7N`i<o7ddPKZIW6-L<L1V^F-k^aoK_>=q;Cq9IpdmA8
z&%Kqv=?mm6wol%WP8P_z2$$)7i<rf-guHdYB@!rTHP?CTf;lWAMXALM-g;mTNNa_H
zw?3Ey?lQGGG<buG3$<#Iw9H}#Zw*NX29=E<6Xq~`gVH3why%m~(110+2xuI6y54lY
z#mus%whG>$?Okf1%A-QT8{CNk_ufw)@&<RJz~fiJLf)WG6a%;h)m%3{VKK8-y%HmX
zH)y}2I;cwY;PnQL9joVotWD(i28|tagn`;<np?c>IT#q!>p*R^L{V>0_e#AF)WT{i
z_Xdp}tJi@VNQu(kps{0)Fi=}(_Em4t*fB>MsI9X|#TztqtUeFq?nFgz(9p5^x&_lY
zmoSHF%nk7N0G&+$8lQA5_V$#3rAzVY-d>Un3>uE0bXk0QdfO6aBbhnO-u|FmbpzB2
zTP^DyAj!a>%nxdXiOWvEvV>W&ezk%R3&^}rpyA^pA5gu<2%exklHtP+E?Gh0Z=2`C
z0p@_Bj%T$GCy28Xlx@nc`aqH~sMoaA(+84_L9-NFb$r0N5IhdEL&67=ra?{GX@7kn
zX<Cv=o`GR<rVlt5?gaHl7BBPxS9CYPvzo47r%ztWtjgEt3rUS23&mxpA6v?7UVlHw
z7c}poxf3+H+2;#RbKr;!%l8FM{4#(ea`qixaGC>;ub7AVf{t^5WCeFuUsZ5D4ay12
zt9?QJd-ZiZ4B?<6ja7k#6;!mQfOs!i6+t{^;W>h!(vg8d^R*bm^qOVNeD&=dtV)6m
z44PL#s)Lq*RDWd!trq;i6ttj(fniE0E8}8*&@47s!31Fj2JUYHexN|oY6lHO2m68c
z`a#Nv3I#t%7%_sU#r(hp)eTVbaA>t3BH!n2_5%mePIl1FFw-g1d6zS5X=Docf%3A}
zO^B(GtPDz<6$*ZkzylRJhvrX@U(PI5@5bRL$HBm$4H8@G=?9)q2M6B4Nq*q@bV#Q(
z%~QY+l+m<fA*MoxI-sV4G8$wi&D73M3!ET8ZtXeh2bmcH70agaexSOVVG=92^!EeJ
z3~9%*P5-f+S=4{2kRNE&Rr>=I1A~EsA7a#1V3HrGo`x7+q2Ol>jwg`eSyw=3G&3;V
z08P_Pbn$~s4S|}QyV|G6tYDUux!?z?s3E18*<3$xMSTO@z70s9K5+%Jq|<6YP$q;J
zZffTT%7pwbAj2oR_<=GZ1GwZejrRj(LOEGbxw~|xpDPywgH9SKFRWQU{mlwyFaII|
zKhVsJ&VNYQKqg+GVFQ_W0fjEdLO;m73&;i?Nk7Q=1IYP#oBe{op$2lk>6GcME1A_z
zGyOnQDRQzPb8=_;K_<09suiyKfyWlWshVS<A7oM+<er|R(;u#6mNdQU2O4L9_}t6G
z4>X4&CkyJ4TORWRO<>E(3NkS;6tnszf^7wLG$Z7v>#t&#V*E4RYZbF@eT^jp!-fY2
zQs86`POuf>3=G2T2GW9HUJ0lzF^Pde54^(0n4h79fg!!YpK&`21B31#u#yxb28I<=
zIoKG5_!$`V()bw|<ae_%3WIF~wfscSvoV6kcNunqn!swDY>eRX-JLA<i8<51tzwp`
zmt$aHZen8;X9np9nHgMD!oaYMm5s4jkbyx@9xPN+!oZ;C%*I%T5Xuo|U@&v(31H`7
zV9@&ro|OsU5NBY}`vwZjT|WajxfmGqeuGkF8*=~`$VE3mUA>J*1Gu>v81z*-KrJr4
z=@VBoThzw|8iIx@cY-VnO0r~NxR@1a1a7K;MG`F;7!Ilh8Y4s!EEyOy^aDYM(=i?e
ztBJ5=U{HJ>=zvfYV#&bZdNt4yArfrKz_9CIpc6tQ$dZA9cYaWyGeRiPl7Yc<VW0~_
zB!G>9VL3;jn;-)NM_LI3gGGBFlO{Jj4jf7t7`PJynY0i(Y*$X7wT4-%-X)L;)FNis
z$;Keaz@Yz^fx*BTG$~>%%D}?FU@aENWWdb8U|?*?z#w>0Ne;Awa}wA$HYE%U;wDOr
zw%~3MSjfVXf#GmkkQhkhD_F$Dl7XT1Uyueu#K4k)LCri!15^inWo54az!aoo$-pqn
zHE1)!Y%NO$hV&yrn?d~vh;5oB3=E2)L5yq&MH*}j3<oc9h=HQzh9v`o&`L!wggq+4
z3=A6r6f{BIFhkIs?b&QiaJ2+3)H<a!K_xE34J%OWM@-WMmAQ<dZRZRQs+yoO7cz}w
znym@0m%yXvQ{yzjW$toNonE0Z{m)uvsrn@Xnvwzx42G+j7#P$zH9=Dg3}7pIj%q?W
zPaqpCMKnQOCq@nq&^S`p5=~hy1_r}2Ee3}29!+_$540E<_PA&&z=qNJdo>k7;$O8G
z7<8X&8iC@ZIGlk&@Jw(94>)WUGFU=5>sc8XjKsqj7@S{*fMyDfD#92Tn(ITjr5G5D
z9)sGgOFTqEK%Fk5V$dw@y%1$FunZFe!)D146;LDAkVT{*Ig=qoRf2&*&<Rw4I9?7>
z12@t@mHQ?05KxKFFbP!GPP7Su6#0UnykR6R%LlSwn1R9jB~J*bVQX|RiGjiJD=3Fu
zGM{d^o>@X8Fa#WI;HeJVl_7{GD)*xhaIY0y6*sS)UbvoFy#BIG2&e&V94C@dn#2$y
zF2=xM`~YNJNpOe+*zKSIHC`10nbH9{_xOnrDP;x*lW350D;9=Gt1&Q`JO(-Ua7YL!
z+!?-t$~N1TA&?m;P>UlZFa%WJF-(#K1(L6$N(iW0GJY_feFL*V{qYbzNd^W}eUMeo
zFGKW&85oQzKvwa@g&2Ut3}n^Hsu1v!F7PCi@v0Eef&~U}<EGj!1l*Mbr<=s9A&{OV
zDBV=&hCo`F3ZVXhaU5uBc@}5LDh`nQLF)_}LRNEv4ru|eY@2a91Uym)UY-&W90DGx
z1NWk|O+&x~b>ONg>3qlrQ1Jy`CN%$A$VM;+GyvnUIb;)<1FBLC8bdaNIUHcSp9(WD
zEMLbNvJGVSV~E|`!SeN>@Sbrx1Uy6swtMTZ5b&TJc%jvTEg|4RIq*U&{iqP|pd8pC
zZAl^EK{>EP79J1T2R07m5Vq=&{a_BrAx8^Cz~gk2zz#7<5N2SopC%Au3A!c^G&Qg3
z&=_LH&A?#l0dh!iO^7v^1Bwl;J0Uh;4k$LZDo)?Kk=d=jog<_cq<0e&14BVaNFBI!
z0Mcq476Ll(1X8tU`G$bUuEF8wwlM@eb`75QOpXcxk6rI%1Ep%yWMKw|&_<yU(DDK^
z(Ao{FhLC=+<3VQ5I2{5WeFle%{<M%u;OGJy>QN8^9&QGQg^_N^6tE^xdm-ah2zam=
zoC!RHL#BacKw;s|7cw2h0cV2g&qBb%&)|tw&*G4oU>Q(a3pERw1>%7FUtTvuW`jAP
zsZKAs`j9zb9w@~pC4|fca|A)@TFjX}<S+*VgV}XR^d13AL45%l_Jo9tA4>>$*b^MP
z4x2;3!=B*Stuqe+4|{@xsbX>nc-V6i8_4YGdqqM)In~@4w6f@QcPOZ}32C>Q8ih)L
z;{ep&$(axe&Z^)Liq8y%6p^5~Tq_z1DI!5}xy~XKlvNoat23LoxP*dM6__7pVqj1a
z3q`Cd*!@2gv8tdxAXJSL)IbM!%i8%u5z7js_l1JTjKG;w^=>G59uAy2SKJH*H%`Hs
zGde32G&Es;7?e5V=7xfYCT@VbV{@yghizfjiHUFt1vQo|K#PiuGDE>_C2$E}>J^#<
z3QuqYtTZ4r8O#CsMfgf+3YY_mIiu82@N5m(AvteDA+t500;#2R`n@g8l8mdS|JcGT
zr+L-EA+#HG#Mv=WTO~CVvhEEOSvhY*d%@;`Lan8Ay8TwLuE?#-a`m<{VW5DwjACM7
zINcovp5FzR9i~QM;BW`0)0_!m;BW^=!s_#3kZ=bXxB6BXDBK|(+tp9QAVYc}hp!b4
z1FtXxJ6z*h7^F`CayVN^7^F`i!B7uc`XXx+2I^N^eg{WZ7$`s?mEi9GVUPd?*`#O{
z1{s+H1(B&y7-$)o952Wwt=VDVWnkdwQ5FmX&v=5P$1g7oQpAFy$J8ziRK%*?QUJ|5
z<b;8W*m{N=pziIeqA*Aq3+h!LKM@8gV=X}GbhVN|7^q~i0!>fMtqy~%a0LbHf@5Le
z^%md=oYWm=0}f-T>%c2qAp_D=HCe(yJp`)|(8{goFvuh*1IX~X^?3?mpoLggr<fQR
z4(o(L<|IL;bIk~YOi6<Lp7A&gG9w8!9Wo&a@_WeEFvxr)DEF?m41;tBK%qQkNf@|0
z01k*0qp)DG^T6F;uK<NGP@=S!oL;=0SujpJ43ZK-rqAvVgQP@|={-loASn@Kx~WkZ
zXcAFM3Ot~dV9yZ-T6by<8aPO~8kPk%9^`U?!(rKA4tR7u_5Jim+nLoEjiz(%V3w`F
zArJ;yJZgOc6c$&*%E1bux+=gNkblj?!YaWWkc-qf!>Yg>@K{Y(hCmpogth?<Kc!p^
z0}ua!GnByLFmM44j*m9xFmM44&e^6$Vc-J#22VXG)GJrAhl2*UY(Q)KEU$-ydlTS9
zKjU;bxHADx^ao4A!F>sEv9?n+9I`3`)OT9DHypew0$fi;d<uu;8gQ|et|Slv8W6Jq
ztw~$k9Rbz^cAlwLggCgY2fJ@=W&~Il*nLF~5#YRbg9lWB*rW+FFf`r}hyV>I*t}<A
zU|8E70a^V73Mkjk2uLvn3aFk%5s+dE6i|_WA|S;S4`{J#z&u8V2++Whtr2K7Vp4<y
z7XyQmtr5tK1$hyUT%gf*&_vZV^9Uy}2h@9s&YFI7C$nyS(u4>%4h9ChI?%Gcm<V^U
z0+3cU&Ik`M2V{MDNQ5Vt1F}BpSA-Xs14=o@-Vxql4k+cgGDY}+IiPeIusFgG%mKBd
zgilBKgE^oKy0tSR0L)PUEe!Y6iwFesKogK+dn1Ct9MA-$UuZ-ym;;)CY_*680dqk4
z*sU}o49o%LV=38)a4-in%Q!tXA_B|-%?QizO~0^<SyJPFL=0FAG=3$_84(NSfYx@I
z`$fcoIiN{Iqe;^RcQeb#i82T<M1s~++JW|Tl;=f)78h6?17~Eh=;_|OnI$#DA`8Gt
z6%;rvrICeT4k&QC{UVDXZDLRg6pWePyPH{(@#ysByP4&*<ro-3w<$163o$U*tAJYP
zVpHT87}9ntFkS;S;%~4re_$2{%@}u9O#iT(S<?7<6gcth1chhA^(aYE1_t|ypzsuB
zjgpc9HHW|}@9f_2F)-Nm2{SO9**M*153_{(x+r;&+Ls_Faaczwh%zu3)q>)y^LZ3_
z#A_$Wl!J9qpf*3lBq>l!&u$eP1H;0|s0e8W29p=U3=E6RrqABPEE%#yR!W?K!9hs`
zq{=o(n1Lbpp^hx5k?hbUlA6LGD<{IhV3P()H5}HmAd8J^LCIm^5?KYXMo^^d8ptYw
z0|rzo=WU+Ov6opsq(?RyY#Aslf&_#a7`jSSqCwfp;e|+PaS}tcm=LJr05X~FQ?xk9
zuos}PShyrw0>pU>@<pL?G$>#kK7p)pm^i(9FSCr4VoWs1fsU>sg&7RdAP1U10vWSs
z-SmxnnI-EDq7}fd0i^;C>uAvS52M-ukOwVF*%%mHwWC!)QSz0IfkE*|bS~JHmJAG2
zp0V?Tob(v%VjfEd2A6~E0tgWfVFm`)EDm<i_>$vpCI*HG9(K_73P^(|I*T2$sE-j8
z2(eSxK|@ZU@jPJ$hQJNX?4YvR@eOFDuITj4eay!7)7Y2uFfcg2VPjx8EyBKohk=3L
zB!PqdD<=bklPkpZZ=eHjz=axn8vA!J2h^O3ox=V@fPn#Icm@ai7gh!ar-VcX1}Bj)
z1_oUN_FtgwM;xFe>RrUa{uy+hXh{;tPzDA|28J2~_P@dm3{J)gU~hty?LFoY1DYFf
z0u|_v#W9F^jr0C7qTmh}C}Rffn(nusS*pH3J_eMsoDG>67$Wz@fQM4SrQ?csF_1<Y
zDCekW#XuTqpk!)V8v`0jh0HgnK8%6%CP9-g+h@f<dXu0*sjS!-&;X+DAMi$sh@HGK
zdK?T4&Y*5<XHX2JeZT-(JQ)5j2GT$P*|e-P2GT$P*`#%BI@<werHHIpZSY73qew|&
zIzy}uh_jOk)b*Yf7OTq*GBsT$7G$IgDAB1n#u|W>fCGENiC9B02Nc-H5@R8QJfN{U
zMd#@a2bk3upG{wWfLYe-e5^Uhr1j}?v7j+U7f?rG_MKQzzl8xj>t!Am3+lHpfUBSA
ztXNRLg<l0!{Y*X@YYVai+{`acn$CBSSvDaw)}EVz!Nnk*ITp0$$_13j)=Z5B4+VkE
z6FL_Q83Y3R#N93yGyvo>J)I{Ow7SX_)Xi|{h;;`U4E9NMR;&k@1M*4Yf$7}`nWe1y
zV?o=6T#jeR#rm@{Ft~b$F)(-r#|B6-Fu16MF)%EzjtvB{yTce5f}>-Dq!<`nS;H6@
z++C;NKgg_E-xV9m4bmpez+lSg5er%a<qDebb1aUH0CkKbKzXs~cx)uN{|rhwp24wE
z;A8|U(#^wSqZB{`5TGJmJ~K8-6T|@(>6YhWql`fu2a%l8Jcd}vIxH7Z675bE;5r04
zh*lo7O4c)&3)H27WIR(NF3?G|Zs0XdJx8Z6J;bcVSU&y2A!aEJMGmgBAYGvDNzYL(
z$l?o-^P;o3Ad4?R38=eZy3k=}HMTdx3=Af^)9ns3OV&#mLYC8m($vYthM+-RhDn^D
z0W!C_3=D3MK!Y*H9H0zU@W3!al!3wR5-2|fPO@ZRXfiT91Rtad1dZ<pALh}T$-%(j
z4qD5;D_Lt6xN8J*2$z`FY%m8DLp3g1ptVE{lbApb7GA3bT1^C*|I=Bbg;-6bZlHx&
zP2?G@1zJr6Sx355N(;2hg<%q?U&-#T1=;2T@<iGuEyy+(&_dayW-ZXXFl5qW_g5{*
zHWzNtcppo+7PA@8^w1;Bvh`QBm_I8sFu0!;W?;~IA`u4~BJ%)cm-WZuK=Y@NNuf68
zIMA#FWbEvcc^r7+=7s<$tlaN2FnB0H)@BzUixZb*VDJ#pVqnNy7bgKOf`u6vcCB&H
z1+8`T0L^_k7VClsS0Wfh3X)|q8FUT7BT}G5)cIT&)bwY#0ZK#%zD?&n$}Cm?+d&W1
zEcdtuo{`maf}}t2V3wXUl2$#)%0!4(J<#MC!z2rED$@fskr*afGOS``U|=v-*5zYh
z@RZVFU{G1gpu@n>R>Y{oz+jcnq{F}<wSyVN{>`Gpz);b~s>8tGI=highk+p=nq7y1
zAv%zQAzelp)cp4Z^%PIWD1&zHLAycS%6<Y24C;NL1n0q`><=0?2Y0KKUrm2~lv$Z?
zv2qAl43sKXFPScLj9G%;gGD(UEC{L#m0wMFKE`azyF)pM8|20?1_mL^>AlC8B{Zg4
zD1-VpUWY`Ib5j_UAq&bu1}*ASwuUFK(wgaKk1-qj+bM&>43c2D+m%6+9gqYwJ3<)}
zPM`#%oucdtZu)?l78MH0;1!$T>Ae(hW$=Pc@Lq$RtEc-PXO?07Ha+J!vzp5#<#bWd
zs$GybC!A2u5CyFY1C>i{%*vUdT^Jl3poXn<7z>9os7mw(wa)T3D<^_yazRd3)SQ0p
zIJ0?Dv2p<<HklY0^cE=>$}=!{?|~!)<sz`dK(V>$mU1zOvlCRB9QdYO0`{#HIBJzk
z!5nK)&F=+T)4x&3K_67x_<&k4j>XgSPk<JT=|eiJAkz+f(+7<K!qSF5Xle?SHdZq-
zFwB+IH(&wnQ3TEVF$MO3*4{6c&^P60VDP!k#K6$rrf&{P)8K+vzenE!%mHQV%9Hw*
zU=FAX$@ryj1?GTi0n;Y^C~Ghe6kh(H^=-f$P<T1S=-YxhY)lLcrZ@EMz#LGvuKBKS
z58{Bk9kM?94j|4>P%KTFr0)pkfGSf##_5SCnWgF%>$@;BF!+Gmq=6-%#R&66^g$C-
zzSAMD2A!1+DN6Nw^aDWp!Cj}`0{uWR2kPn|FbC@DU@!;j=nyam>gZ4~2kPiB&}p}j
zv{mz6KO7_lcJ-u5`Vk-w*wy84^drF>kgGFg^dT$k!Rtx5%nkHG=SKTQGcho1d8Ho*
zQa6b~#HqBHK|dbMfd+5_m;-fcBA5em>fSmN{Uk6C<kqvr`pIAp$gQVJ^i#kbs9RIP
z97q69UwevKvVNI<21x9Nh={X`6N7#x4`?<8loKar=x2dtKs}ibEB$ORM+elpIJ8|q
zN1B1bce*eG!<2~}`k?C<{6KrHcFxy_^dvxOyydk%Bnh*C^r#8y7fUlR_@xUoFccbD
z=ztan_}yi4XJBwF)^UVqg3jkUkYNW<COGg-2Qn{d0#52Wpm|A#Nv5EsNi(cD;u(uU
zhoFn{gLY6)?>WtEs<4KUfgzVifw78#!QY>sfkB@sp0Qe-fx+)CXbP@BX!^s`%u;M1
zRZD+QXFS7fR=+Bqv5g;8CTiG&)-=a6g4X6TT-4!bV2J-7&)5Mfm>l&OrZ6%v_{Zym
zh#QOy42M^9FmS{(f=00dL9^UBv*Q_i!N!2>u`G*c><9BeYpT4p;~6J{d7u?-XT#zd
zCxLmOC2S(~{qc-bz+3@-28I}cc*d!0pbbYN{0t18V)2aA*cccB7fbLnFl^r#&o~{d
zQUxR@AI~@gB)3@u#FL6=oDJd~b_ix*h!>7$oCo4vW&*A27I_-axDae8b3iZy!wP|T
z#zhcrNH9Y^L#9nU<6;OuBA9_eXj44n60kMQF~JNBJ+ASLEBF~00v|Ic1T!$i&WvYV
z36X6GW?&FI8PB*H!fgp=U<iB@&$t%C?FeRI$lnmpxDLYY31(n8vOJz~6NEb<n1Lbd
zNj&3bHc-3mEAy0K1_s~4>HE(zOX{y>WMG)Km2n3ssF@dlcr1??cY=8rK)jZ@jJrTQ
z7LebLOqkAoj#-v*=XBL`%=2X9HR2gBg3hVm$Irk}7#Yua3Dlh^X5eRFDBC{$!8vB>
z`YG{@SHXgy;O|=%&v*^Y1BL#|mUzbNU>+#+Z3N;OZ-9BA(62oj&v+Beli_DzIAs*i
zcni!^;AdcH@Qr7@4QeVCtAJ9b+A5ZKM$qcg;E+fL2Bk;wjE|W?=Pa;*R$taPzKv&m
z0^zenGBEJe#xp(zbD23J85l&*#4|nvbD6j!85qvYjAwif<}&g|GB6zJif4QQ<}&d`
zGBE56k7s-d<}wRJGBCso#52AEbGd{g85lO{#WTJJbD3p9&dTa#iD!HVnk5K66Uo59
zv?-qPy)ejKJRo-!?u}>s3|7s=12XGSJmVKIml0$W$GmvPuMjSOBm;w{e>~$iFc)kw
z%iMUz?_e$~$l}7M@r*yfTn-74#VZXf;u(K)FffGH^D_uCSjNON{so5}C|W%4Pw%|I
zEM0#no(XgYG(#~cT23a%GckgdfTCsH=XfS2Fb@<hq8af_EMOieT9!1&GqH*>Fa+%b
zMN8E8cqTTm94K0*)WkEfgL$9~Q<V|V!~y1kGK^(NJQHX=9YZlFqo3uhk7oicqGKpF
z;Addy+8WQqBf`KC90Iz~PF*OTi5INV0yMF|HJ*tN%(LNVVCZIwXW|F*9QYX+rhSZO
z5&-jD_!$_^KZ|D)1oJ%j85k5h<C%oOJRg1r2D$a|Ou}GZ0BBjIPJBI+D3}|<&%hwO
zHJ(WfY<&c1`RLquCULM_3}{I~Ks=KKn3urMz#z3Ko(VK5%TS!c&%mI5Ii5)hESJI0
zz~C4c&m;}z<?u5wtlAsTBm?FZfbxQOJd-S#SHb`)3uoy{1u!WxFocEiGcfdgk7rU6
zVqjpf0>w{Z<aFyx%u;%n%;T9<L1m#8b0h<UpGQ2C8aOMnC`2+aoNJ6{QU`N|RU#P}
z)`(AUzQnAhb2gqy8)S<WXz6aea6FR^m<LMOio4^Pbiq0V5+Xsnm8Rdk#H?#|jwhZe
zii3e6Y(8iyXGlC#G)M<H|H{vZXNm#yKxJymig+eamB~;HUZ?8dJKf<jvoz!U=`oj?
z&xnVy#4~|b>W9xwVqggS#lX<V$iT4g_jLO!%*yrC8H<Y;;+c+t3pGYiAu`h_p6NK)
zF^meJ67Wtu(+LPyC76Lh_)a|2NeEXXn1Nw2Q#{itDF%k{4n`fYxd)CjMZ`0mWnhTt
zv`+__d`^^sA?y~zbjD;5?>v~t$N;tWLNti~3S2OQ?7awTN9r(vify4g@l2N>To0(d
zm%;Wjfr@RAy;s2YGKGLTWI^WK;ME48AvdPL0$~P*(~i?^t};vTI`K*}GcZKV7G_}B
zC^J3rDzm!OMp-@ykk|pxSuzp{oZ!OBje#Lgar&aG%$oHD;S3BOI?}?dpx&KdjuHcd
z#C{n*DbNxUut)}|&-ihI4CpL}NYMU)i$XG)Vhjv=>p}Iru7OMzcqpm|)QQa(l1T(j
zkVjqt?-EReESLkSYhz9XuS@`s6F3GZf>tJQgfTNQ$TCD{C4#zLkyk)16YbfFpnewv
zc!aOTXL|ZIX4(3BiA2!oO%!PDZtlTE@ZdLiJZ9<4MDXA@c;-&sAW;n5PzE)3raeyt
z4}ODZ9M?=pgp5RjM&tcb5+N(YK<&x!>xqy>o}iJMz~zbHDWjdBW?I<lMDUc+P64KR
z28PfziQqXSaEIWMc_L(59n?{rZkz~O5ehk#AUZ1%JZH313=|qG(-aax^Lx>)kkEh(
z9f3k)X-pz$*qmV!i%3pt9z!Bz=m^wio4}X|9ybT?PBraF1U2TvASZVy?oI@a9YNN&
zF20Zmnco9>Nq#{hxP=dPc;M_r@N^WoBU56R2x;Mi)+y%vPXtXzF@R4~(BD1%#&u>R
zlk<t7872nsZpn`FMDPUDPB{iP1_n7@OVFZh2GA(tVslF=Sy0=Aje%i)-*meh%o_EP
zB1xdQjsfk%$vv0^j%#qNoXt*x#5Jfz+H*7s6xWc`Jrs8*fub7HG1GdH1X_5_coY=x
z(OF5LMJR6a;DIsK9s&Mr0S1Pc6eb3ST|fDAxIqgzK_QnN#Shu;#ZnJi))mg52a0lV
zllxpKKV-KT52(qh+QVPK%)k(%q{P55JB7bUf`K8X37nu)_&^3LF)&D-<}U`dYeCC+
zn1!b(F))aP@q_jc#H<D@OyC3As>HxxSIhqkp>Tp61H+7N{(8pK2(cbH1_o6Qe#SE}
zAtt{V76yh^K7PgvU?DjMh6`W#883o4VACVy7#K<n_!%!DghE&t7<|9-GhPM@?PBEM
zXZ*{`zz`d~juABO$@q_-fkE&Hh@-*6SpQ!VbcPU!=UB|dAPHWiX~e+b!Xm>Du5x2R
zZMRG2{EUA<LG+a&iGd+j15|*v{pV)_?*jP>s&Ml<`I(qOyI8A174FLU{7fw1-S{F5
zatsV!8~B;nz&ql>ZVmt~?|;L<5PMpT!H$8!SP?W66uVoFfk8`~pJ}5oNCu=(tiXtY
z!RjjqKXWqZ8XG=-(9SV_X7DWCS5VcW!7_cpEoPniH*yRNeH-|h!QBvWJP5szV_=AF
z<!1(UMi?MMPvjUF*6H#yXF?ZLeP9-PP{P2V@tdE;6TTYC&nJh0foT_`NHS<SRJ=4e
z&m}`vyn#~A+3aL)P(Xmo3ZDhZJfaK?$&5!qg+=tWWN@K#1C;TVy^{Gr-T0%REaPX8
z3?A&+30kFF&z%fef(ja{pS2=c5UdPzd`Na~vJjX9I_l>Fcd{^;qX#~SXZpI^%rf=4
z>WnPOpgHWsX3$|6yvg9HH1LpT<IH4883gLv8LA{pgZuQLzTI)|WJnnV%1E;dlOaVA
z$i;l~lfl#0;Nnf6JsCW04IXKgU`z(hmoS32$o4fRL*`5BK}D5|NHTaR8@y*)OD!2(
z9)Sy5-UG>y@(AS3MD=7yc?1eVuY_dCP&UZVyC)=r$|HtJvP=vN4&up>;s_J~IRVL_
z$#I5Bps{PCj%3JMSkOEHQ&F-GWcj}$=uD*SWJq}gDl{6?lR?8`43m_Z7#PlTCWDs6
zGJwxf@-j|_tcwMmqr~i)3|SWo3S8NwWXQT$b<pxz;bhRNc7{oyUg}zgWYD|?!z4{6
z28MkJ$&iT)&`O)*;mP%onG4V<7<1c`K||RLH$d}pW~IrHsd7+{)2u!jJXH?f7uZ*o
z44xg|X~x9Bz?7Q|TItR(2{Z;1(47pLuw<A7nrm-NNCtIg875hQ{J@k98F#V<ZEDs@
zhKxIb27ad>yUWby6rBv|#DWf)G2lst4AOxPnOXBQ88S!*T9dIaGT9xR1VD4vsqV?(
zk*FJ>LuR70ri<NU*5$lr9S<%cW=!|F$1G(!ImHgtW-|t*l3BY_z(=@z1r2be<fMSl
zruqu1>VgVVK*Q`wGN7R$U4!Yf?=dUYgSLmCbYe;IVrO7T@(5#Kh$&9-mSkW^>Iq|D
zSau-A2gIJvki)>R-chh61+=<03A7(jX-^7h7jH5XC}-tvNdYYwNfrVvx8LZNk|fN)
zkgU|=%fJw~JtbL)fg#z5u>~|lmE-|Bq+$kWJzdg7VFm_u#&^?g?=wqCe@h7xVPHs7
z1o@z5XG$=b1M-1U=JbO5%*Bk})1TaDHe!4-UHk#F7k_-XMha*#Sqf;)Bg^jT1rL}d
z!vwfe)^aj1q|D%P@MU0NO-We~GKGU5#LK#pvO$D_A-Rm-#g~CW_ejb{K?a7Db^H;&
z3=Bd4Q#OHk`}jM285jh(Q#K1TFr=L0|KSS?jp_FvFiY|0rhwOseGOOe1$FtRb3A08
z!&p0g=|g4>rV`ER=N~dlYLut)NiZ;^o&kjjYf36V*mjVI8hlg1#RfP^X5>y6c*HDK
ze}pAfPXMGGbe_()R7gGmX=RU1h2#U!u+N@1sgQgCDjH4|rb6-oGbk)myZRX!7`psG
z!xw4nYzz#kUv(H54o?OR=_W~mhIAKg0MDTuGEU<KrItw`^|Q>t>eK5%#~f<wFfioD
zfHdUigEZtffyRLIr!s>YFP1Dk?x2D+4Rpwl?{ar=K?)xEJF?9kT#$mt&{~At!P_0c
z?YihJcW^lhUR7l&;tm-!2QRSb`%~f$T0)ZX16(fGyZeF)Zg6v<=O~l|3aq6u5Dxh0
z3&q_~4roMwnj@H_)edU$EP4gzaHN3}b3Heh!vJ1GBCiGJKsKesJA*k4H$WxPMR9k?
z@)Q*&hI)n$Q+LSv6j0gWlI#v%pE3zjCb)ywr%cjiVqn;L*d4q+WhbaGw~um%tWN=z
z78jY^!F%N=freENeRmH9RW6fEL2J-D+`*@}O#&4iX7%pjU>VSsVo`Z_@Fw~j^`L?z
zBikLci=N>IsDxOU;tpBq4k`lFF1bUehL{)_;#u5dKqlM(EdZ!~;vNg;fTn%}AG^na
zIiMltLT7jIF8dpx1w1QQ+(G%1VG?L(P2x#+Q2u0?6bYKoY<5rLWT<Cgm;_o(#d5$M
zypCoPX!vo$S9fp?JqfhiSZty@XdMm1B+w>^U|x6d@~%ms(?85Q-NDPdCdGs5w^sKI
zkP~)-cJ1uk>7EJZfKIKl-0cotZL<^9hU0nY4qk1u6SSCR*8+Ek9FV$6pe@Wv@7=*I
zx=EQ#3=DP;-N6mINm-x+twP<w4Z2C$ObiU}^WDLV7AApqI-5<Np7NAgwZ1~Zy#!>?
zjRH`Tm9kcG2Oaa437VzMJ?LJEoWvj;Xc7Z+U`Y(ZfhI8!2cE=09C#7~ao|Y|#Ni05
z2UUvk&QOaKKyC<rtl|zjPA&_yzb5yfdlRx7ARMS0z#NzxARMS0KpeOmKpeOmKpeOm
znpnj_gY{51K%_wFe7)H8dC!<->h)CIL1UCzpmiX*2i<#-T>{}iT>|F7Tms=hT>|33
zT>|33T>|33T>|33GaQHm%5W?U4C}?F+dgNOsaJJy2c0#Q4XX5W54wX_f5Ngpc=acE
zvC*sx?%>s*;KsbuWq0uEPw;^|2j94Z7k`3hlPVP4!HYk^>*&_!xzFQdU`U({9&HMp
zZsg7gY6N88<OdxA<j!ag@^t+TP?NLgD3lA{?7B1t%9{ilm{r^j<8gw<avUK%t#;7h
z#iCab9!DCeeO%8C;W69*4ME9kL3kWtpdqMuX9$ns251PX@~S(d1!#HB&U(-o)J!RN
zMoSR)259hPd80ccX#Xtelo=xihNvq(?u?+;LJnx~A@`s=qYKF4aCbv^ptd{6-C!Qv
z-4Gtk-5?&q-5?%ET0P9+ATGk;ARfZuARfZupnX3KJ3;P_&T?mT1G#%A$lc~8?u?*S
zR*W2=k+kp!?u?LSR-mD?z3<%_LF=s4`#?iyApb%ZS~;-tGcYV~oF4U(S+0IDiw9_B
zOD?FteaYMd(vJq!dp$=zApK}iy~oPt0qIABPg~rTE#U#$!Irz7iGktN0S{Fb28JAP
z`YC?y0com&Qt}aF4@grL)Q_&Y=>cAH2JT1id+Gscs&arjjRt-mkhUr)k^61+0JT*)
z(m=IJdx!^Ua*W>v)byWt!voS(1vQ;F=zD+`YCwAVi&8xx^)=}1q0Ge|kosC2l>K*A
zN_&8sq<Ns`;Hd*1rf{eBntGT)+QA^VCYyLbTBIPi9<lHMEv13<irLsaKogyiDW%v3
z5711f?jKNF$icw_GSdl~pxL_J1GFiVVG`(&!#N2apk0}ul~ABczFZMh$)`K9F)-xS
z=rAx$6a>}r=f5!OFw`^f?E+Qu+(Mv<-gGU{MDGH3&_r*AC1{>E)`cD9jc|X7bkJt5
zyr)bI4Ac4213^Re;Lb{PRyt^ImI1uRHv2((upk3N-Ybxov>&C1fRur=Z`0j$&=Lv;
zaP}=;pB@HQ1|CW=%1aLis}lir9`kDW7#Q;2-v;d=mf({~2aN#cgU&CU&X*noQU<d%
z7R&*)gR&o_$8m!?!cbe|K{7B~6Tlo$d)KT!JrT?SH4%!}rze5*)E@!GrcqvcGFVCi
z<XI;>nRL(*rum>V`BZMCgZrW|Yr(xxuxBkFr$eU1K-S8iO9xGfsn>y5A@w}uNC%xw
znh$E+Oy^540JXPZCV=*ILxM}?M!IAXSPEo>S$#Tq^Z}eg=bxM2{f1da<0DHts0J$l
zwFp#hq*sDfgR)0-R(chf0}6q%gz4wsFw4}N%cR$FFfbGxgv3$<SOHXZBbWnHo&6xa
zNeC&Hnn5zK@M-~bK;dQlD7_WTfreKbSPwL~+QBjspcpIg7G_|W=+BYf1)5JN_|3$?
zpmHO<2c!Vz<z6rcWVhwx^ga;h1`ERs#*D;F27&a63=D;!V=<@mrB4P)!8A<)b3mH1
zAEZwOTMh~)?MLa;Kr&zl$J|Vx4(5QDpt=|Qp21j>$-t35i-DnVE+i1<faGCj&INNo
zW~$ssp9kiE%rvV{pAY7My3&dBryIOumZ+b>Sd!1clD?RMq3{93PvG;sU`8ziYXBL=
zdNCceuC4F^3upld!z2cV!uKhl90y8Fat#XUpsq;~sE^llH+>CA8@Q}8eww}(%mKMT
z{#^Px9?))SP{vO0Nng(cDq_KB=c(yUzxa+>hVjYtckh@b>zAhA0P6zTeEfX+O)!TI
zWR+GAS32m7lcMe56=3OiK~iAn9$T7z55xiQqBU?x2OmIo1FVTtR4M%t=pNfQA{i+~
z4C#-h85oMdCoebMO@9K`1S$#T&!s;FyN?~bi8MiDdhdH?$@+8YufU?<gLVsY#M0k#
zFfbH{L5z9_H|nBs`g^!hQ_a#pfH|PS71j;uAHf_UkPmb`#nS(POsIqS;4erD?1Ku0
z^nYNRm>BLbGB9|5Vh1fZay3q81f4lvd{T#jf#WHtRBK!h>bdOp0TpVQ*`Pwr%>`7b
zDL8-%wK7>yq1L|;w0LE!BY3)Cvf}it56n^#ZOrM6{2=>ofGYXP2I-8Tt0IfT_(0QE
zyOj9T89`M}iM2gAm>5+-o@)ZNBS0F};2Q1g(izo3yh&h<UG3BFz)aTx34=}N<w$4L
z<zZk@y9HKsew|c0BdF3SSqnAY5XE#OxW@B)(;1C<Ku1=AHJVSI?)Q;dsvhKoI#9cJ
zC&=wAOVSxZ>&rpAN{kp7_H5%xX9OKwTq+1Py%}V>FUakYR_To3W2$y?fxNkFgIGFv
z&b!oxA9UP!I%5aeRFKkczjQ{>*~RL0OdzGFvlY@AdqDRSr`u0|{*hV1qmVP5aUw_n
zG|kJ(md*${k_x1^PB)zqyhms!sL3MVl+Fk`ca&ig=!}<h>(Uv)yM%VKgUsbvHr@Xd
zvs67RQ#vE0^#}6O*?;Mbkmes~=&-6RopFvd14C)L5NI0gYC7XwQ3i%mL1~Zy4vVGJ
z89~d#$|9iNT?qGX)7^B&MIax6V*zC7VlWS8=n}Z0O!DWZzxu>18@5m;opA-|n&mxE
z(^kSw133|L*c8l(kkh7MrmcaScIZz!<67_#4%mtM0@GtZL;VQes0Mcqc&FM8m;qZL
z27r9!YOavZxSfN6p*#)hjvXlOfE*<Sa|d|W8r+!O5M%g3w<@PIg7>Z6kmhG#h{(N^
z&bSxsEP0R}+qJ~f89^64m&20bLAV{t<>`!&v!p<Ftn5x_gd8RXa_Um$bjBm#a1;U=
zqxEjO-xp@-`U~ldC&7k;bb$1Ow^7~T<_8U3r!$@gdFBgf5*Tz307C_H3b@ELVqlQg
zQBG$($HBl*0rTs5xH~{$egSM3$W%}aUIg<%?f@l=OK`t>=50=AybP8EdA6B3oe^}-
z6h|1?ui9nI>5QNgr7A$Pi<Um=j5k0^cY;!@-G+2V$dOW@&Dkm?(+$5e%gUOvq%(pJ
zjj8~3B|v8118D%a$eVelXMbgu4L4v)XZ*;)z)&g7&%gjO^Aku3*v!R7>5QOt$(6!P
zuu7s*3GU<I4J_%5-#|Kj`572MhJOd?1RE}YZu<SN%(B`>9O+C<ASF}z85o-GrZYhf
zY63af_-Q&5<eVmO_BuCR{Ts8a>^7EkCeVCL<#~PvhV-6vCg_9=KLdlB-t@$8pm{Ww
zbS6<A28Jq7Z^3p}IurPiB(Q@6zoavP4@uey&hFbD$fPrYwg^{sfO}HuOrY5r-9I4f
zk4;Z!0uPGc0QD<G9n+a0yInyu^jse4Opp_IK`V0-MAMl-TUZz-iSaWq*vS^BGlAyu
z7$%AHGcfGfoz4WA$piJIig!(y`pztuvQj3UNs)trq3R+(1B24*bSChKH8^BIegY3!
zgFA5Y=hB%#%dbIAFe3(rx&;d9OrXK(YEU-?q!BVb268Y+BY1uctT8%k`ke2~()H)k
znLx8)>UBH}=^_G3j0_Cbg`h1cQUaiD)sQuf%NqsMg+WL1fa+{LF##=M&~_A1oqcwz
zfG$`D)O1p*6EFaC1VFR18qWj_nHd<W)j%^Leilj$3}@2?rU-*Z=s;T}gzhLYFwFR<
zDKHgW%!7q)C^0Z7aSKdSW?-lW?Y?Igy28i6P_ZtDfuVQn^!OjlmQE9S1eS_2Fx0p+
zF)(yJ5m*LFFyN|kO|t;_*mm#;+#DwX@JV^#5x8AH1wiL9iB^MLACxow)(>W%sEGor
znHd;r8bOW|6OdzI;NcZuJ_vFOWUl2x2?GQ3P61}b`d&ZN5(b9DTLf6!Ky@&9tGb`b
zUPcB6mooxvCqOzUf%cNJO>g+gEK$!cC<ZeBK4=@ayO4k|$R0lf5HDCr5HiQCBh0{{
z@<t&8bmVp|=%Db~5gDKrc96xk6F+5uR@gxn+a8n62m{#w?)fWS&j2s518*qtKbHYn
zU?&DXV<Q8!z)p@=A_UZ~urBDy0G+vA2a23cdoyCeMt~Z|9bYoQE9}4n4n9&D;Bj<t
z(=zK*26#~&xX0r3Dg(Tx4s5M;@AT|n%#zYY8R=kiK)aFR?q-0y2{%Byk@9{{pZ|+l
zroKqDAp>+SWgV#fI6ERE7rf6MWUaP%Mjn_0N;(riW#of7poaF^Ng1Ht0wegO-ea;E
z;NAjwxUxba1Ke4-p(2u;lEjb!>MZE~0gYBBF=dp1TmoI+n^DRGIuXHgy47!HxrA>S
z6<|4MCI$w^`5E9I#3azbe5XbRs0UH^z!g>^)qMc11u(V(1(|mOPX=gvaXo0pMaev)
zPL6@0UKQka+XET(@(c|1TA)<q<T8E7Z)O>d2#1Vj&~f*m$t=g>j25INd>O5vj@A*-
z5b1$$)BpTtmaJFG=m43}Yyld$uKNJ$qjsx-ihuJ3d<+Z?IXVmscAlWtT%aqcH7EE6
z)S7G41-0h3SAbe`?UkU`ocjb&Yi{{*P;1VAK8Fqi!>L+M9R`L~p<Fr)3^lpjIt&cz
z<~%wK412fn>M$_qaPa9cFvJ_z^Xo7$BrOyGb%px`br=}@vxIaQ7)*tQbr=|Cv5M$0
zFf5Z1)nQ=RoF=Bjz`zzQuEW4!c1l8rfkE+yqz(gv>RQlpX`d_7AiYeoAeBGmbr=|U
zS`~B{7*;eX>M$^fyDI50Fz5y=>o73LB&&d?Od4ew70mB&FmNz5fKEGXRGKdRmswJK
zrl|RSDNs4WDB#P$;FWIv0KyXqNiJqEe+c17_%bl?#7&R?%Pd!ao5}ns2LnSRXslrU
zG4p5OS{4*Fd7I6jgE@?#D4baAWBv-H?g4oBk@;)T@d)A|b^52w-+_$<_2wd6%-@4K
zpkaj8HRd0{9MCADjl20r5C?ov^!jDypQIQV8ty8B21BN-HUA9efu`!%K27KQ$84if
zZvI!AfuZpysIzL2ZT=6$`3D-lmKQYt59WZ@LitUbUi6RIy#5TMjX5JT14C00KLdm9
zQFBHXkbya%MK~PR=8T|OW}{m0BAk>>=8WthhumP)31(oJx6YiA1Hv_!&X`o1#$e9K
zDGeF`U^EG4V3=%e&d3Fl{>o?pO4*{-3=B<8;FQe|TJA4?+niBAgkieIe`Z<6_UUf_
znSHYVFe-vJv4NHpf!4$`F)%QI7Ok<cFfg1_HD{a--Y^B)Jasa28kp_Iz)+KsB?-DS
z$x5Grp;_IHfq_>sOA0h0?dZn9AW)Yj4YtyafgzDI3$)y-*+rOvA^penzyFyHrG93C
z<`0@<K&KIW6v#3YU|?uI#Kgdm{%@)Wi+ug3EE{G9hUQtq3=F6CN|=DAgIn~$6D20n
zpn@LUf!uP<1UwrIF1v#KO~A9k;IixF9ux3vFu3em!(jrR4F;E8tCUT^18FzFyJ4MO
zB}_o`ye*(1`Sr(4K-)Dzg{~#2@oxfJcLFJOFPWQw2hVPRmne7M<uCz_gtg2B_tH#2
zwI-x`Yy;hW%%bV^mB$1$fYtIHq5v|z3QBlw%qEcORZ!V+^oI#}dKEm<9QEG>yb~FG
z)Oz%^>0OL0GG^ZdOhAL6t=158ASW+F&4Dc22bm-A(*(3^A9T)$Fav|N-1Iw)ED|nl
z%qF0H36S%zIL@2+f^YHx56`e4<S+r<_0YN$e2an!WDW;p?(QQd;5i&{kg}Ofw_swC
z6?Qa<lw)9MJp?MOS_{}17^Ln_&tPIv2sKkMVFWEnZj0n+U~s!?!U%B_sEKhl+k_G1
zC<bs7W7&5TM$mR8h8v*4<#cNkM)1~x8=&PD;(8{GkQrT2>&Z-Y`dua#nb3z4CXAo~
zx3)b{qe0VAj2sO1IjMOJCXC?uD6nCd%uN`<6H;Kq6nC32LVN=;%!Co*9T9#8279aN
ze#|Vg_4ad27(u5iwSxwwFAAA3MnV>E@iQ>+&N5+)5@%p&SLgw^(oGnn!DaUZeg=lt
z877R7X(!MU<q8E8#u(5f^NksxU}=jqVqg$xl`&y_%)!9W4r(KU9QFi~RzXAP9wv-W
z!8{RA8`VtJgz*`e3kr}WYSaHQvq;NLGhuuQ76cF8J7>$7FoKRmZC}dIz))j7-JFF*
zuHHL44wT2N+!z?r9%RQ$GB7ZJ@>|Q&>;zC|G<IWP*kzraD8s<O0BTk=u?u8_s<95x
z@_<sq?0PW<hW4|dsOG$x-2mo*k`QNmb|aVrs*j_yvO&c~`&sb1p_vo1TXYy0+Cc}0
zgmcsjWP{d(ca)0cmF6;JcY-y6jB8`g?gDe5#&v@^AmfCUvwOfCuyI-ov-^x07&?sa
zG74lbW@cdMSQ5s-FgYQ6sWJmYhk6(T!@4Kg%d{96I!YN5II_>OGB9+2HYpk`$UZN{
zz)%ly{6f?03sMXW?FU&H64<gYfv$K1&Gcw2&AuYZz|g)G<f4wP*;m0FM$n}r$Fr}2
zIiO)9;r#6DU=C<aiR_H*8(<E|;kMq{H^CfMh76AE)65JEohFGOH-d;048ja?4C~}7
zvOzbEbb&HYg+lgZu-`xyF6POe2IhcF;(n7o9n1j*L19z&EHDSu{yKdidoGv*YVMeH
zWG?`7Ks6E1yXgjOEaLV1vsZz|K$EX)xwBV;IiU6fb8z-LFb6cnTGX4p9?StvovIzp
z-UQ}=>Yla@*;~OJP~DSqH+u(|18VbRduHzjb3jw4x$4<_z#P!jDPKbNUJ&PC0BCui
z_q6PNU|tXt1B2R(?EPR4Xd*R2J^KKd1G-_1tuOl!h;tJ(tJ<KDeHg?!3!3>{w<-Gw
zm;)+VE7Y=&f;kyX3=BS2*~dgdaRi#T%$CkR1?J=?F)(y06o9JjqZ&Q}*<Uyq7`mQ=
zE-A6k{tng)3gO6Y*+0M>PzawsFg=%@MXG-HgdEUOL*1ZbQ7#JQ2taZ(=mc?t96@mQ
z?E&>d)VAk<26Y%fYeboa&VUZ;D$KC~9X16KIU&rz(6LA$7u03!2912@9?XUI7?~It
z%I$K&6aL_WvFB(mWC<TAZtIu*&xNev15KYO?#>1E5+U2{mI~&AdWn!zHkV4}f}9E2
z5F4G93+f}v$%3!kil42ME6TyZ&;ts&+=IE`Rh!@{uIFejWYs3f!<#g7AqT90Mrjpy
z=R#I()`M0HuJX^7f}cz$(VZ*J1u_kkz@)e5LMlm6gJy48F1V813Cb)oe{#W<B>3VH
zBlcWKB?;QL&sv)ct|WJY8rN%Bb3y%2hDo56L(y5eppC!`le9rC3&y7m3_bM);Ch}L
z6m^qwL~=p1M?Ik92QQiDf+mk3`;2@Tb3s)m<m8!!V!4pXBT#0Xwl)_sc?8Ogz5cm~
zUA`+{=OT9bMrY-M_5#ZBf{&Bv7vsnU&1?4Zfi{O;GS4*wH~T<o#Go%1GLr<#_CB@K
z7jm-5)^Fg*1x*$8=7NuG&xOnsfmHi2=0awQK&lst<w909f!tN0kPBJW1ajB9mAT-B
zLy+?jMGtc1g6h3q&>qA~=DCnXOd#WOU*|#=F@cQJFUkd1dOMjw)Bkx=xsX*%ps2K&
znF~6;lL34bh0wEH(D?)m;A4WU-E%>AyD&@w&pYi&V0L5UU|{I|2U>Jx=LR~}4icaT
z^4!2jaqa{+bz5Sl&*x%Mlg@MF6JucL^96YzyTJ{T;6UTd(OJ_UaIv`5`)L#~Fo+Zi
zXGpR!FsPgqKCI5bkfzPXz~J&)_y}kUXi_)>gGiI`QAp2J1;pzUJ_g|_9AIQ%5RDUN
z1nn$i7CMr{z%b_}BSRi&o54iT8Uwehd62_GL1A$=I}hwaaFz*b&jV$qddP`0VGHvh
zxd~Jr?uy9+ub2V1&zvgrz$<3Jli8Wfd7u?DkZJWSw>-!o3n(GG_2z*O5d(J&lZ^8q
zCtrio?$U-l@WCM9Gw-wC<UvMMKqaZn%RDjAurTE8n8`2lz&Q)NxAdHM9(X<U4Ny^f
z_I@6CEh2aoO8?_LNP`npltw(ugXASpQJUwO2hL02RVew^dEmTs15}g>&B+62pBtc6
zC<RJ+;1!49RVW4Zj(LznNkIi>p-moSFbA}}#KtBMG<w5u15^g61?7R7q6{}crKgft
z9;hYCa066&79Gfgv_wIr=boTE$e<4B7PI2AJjj?1=zRO)&OGp%=Nq8)=_TEHkRy0%
zKt=nK8F`>R@C-LV-S#=R^C0;R)NL=d%!A}N&}sK&nR%f6#&83)x~;k|&jj2s0o@vQ
z=u{r$pdHX*_qvREkmGVer&d=)=0T3j1s!&8_bLz4?gbroue>1--0rOh-vGAdaUQtg
zdjoXZN<v5;xZ!&Pbi{Jt|2#XeMW9{NUO9Q-rF%EFFflL`_T@oxAm}=<tol6AZh3|q
zdqB74vF15*GB8Z6KETAlaO6@Rq}lm{iGjhXKM$M%Z~Ot3Rtz^77^chdvG5wa%yVaE
zVCcJ=?vM{!Ek6;|zPKoq4?3M<;t5dF71zrb2kq|wrw8xj)1&!V)as4%K|4Vp3NG^H
zD+@6&OgsTfFlMUxDqz*1XlP^3R|R#WCY3OxyX1pHdJ?GGyeO1!0M-C9-b^*$5Uc^D
zd;PI|BQOV4bN3w0HwJSY7}9I<K|wKTJ`)3jfN{QkJzV=mzI+ET2c%u+UcMt(2gq_W
z#e63)2b2cdnDd>%E~#M1sLAJHWnh@}G>m~^>YIE?ZU%;l)591T#EbJmNB&K`5yrqE
zXP$4u&A>28ER2C+m0>>Un1M+l#h`6~`R;rS43nnU^RtN6Uv0<-EoGk!n(6lp&Ihl1
zy8&8BJ!w7*bU$^zHyZ=PWE;><>ieM4iwodYbUb@OqZjSx;HrW^s={;_7y{WqszR?a
zfsXVt+%5vTbo&Fd(1CCU2E)T5N}!^LS!f4{cV46(bba{;CO;WV28Nz^5jD`F5Xdmy
z7E1<(bMr*N+dv>98wwd1rkoWCS72b6yn&B_!4Nb!uc|af1iVvn@;iP8hKoWXj3tov
z0zU(TQ-=s+DJb=Q1-1SsT^C_21qJ5U2_TKqXCy=zZ-Hibr>KKQw?#x4L6<8qa)5d}
zJx4_t??C!j;FaAXjCVoiK#t;{_=`;h+%1@r2ij3|RD==SEdY-)tBQ*-f`&2}CV__9
z4XZ>LA%hv9)AYAAi7-9~8M707I{uRX4kAqTpd$*VYz0qFi7@$s=SV>gaOx0Y0w2!<
zo?wd35@7<L&$AOW!L;kA2ovalo{1+oz_%Zn-{O#$U}s>Mawm*|K}J;`)QsRr1DyzQ
zP9Ahzm>e&I5(7ipX?gHy8z?N9{3Jj_R4OS9^$ZNgqAF|*3{ydaLDBO-V^l?+p!h4$
z1dUM@{$~bdHPDd5R1I*ufC;p7;-a;vwg^a5I0J*|L{URfoHF?dfOvC7jUYUZ0tN=r
zm7>P1AbP8)39BUoL)HvYQ&!M*Q{X{U24Mzf2G8fyg@ssD>)V(`K_v>Le=e>k3Mx<-
z!MCvO4G{$wC|^P2IhV{uZKW6(ro02y8Y}0E+JTqygIA^*$Owo!axgGV16A<BLZYBT
z1l0LwU?@H<>H<=i4el*_U9=Dd)!frGMT!_iJ;WIprfD*OhMt^5r|%JBQMD7}DFy8W
zVPKdRZ2~$>(*(>@Vqh@7C|bzJz%VTr<b2;hAf`JT1A}*{=w{H6<X0932KkEV^1>`y
z333b!PG3bCLDy$bTLDro@`Z(gf%B{=BY5-@q;%RGQKnSz*$f9kqczhvg4WIdvrrOX
zV3-a*^?bjrg)%6?-T;+-$ww?8h0-5i28M#y(^m?!bn`E?P_qLMw0-eqU^t&L-C2ai
z)cl`?mH-38Oil*SjVVVgw82JzbnUmb&;fH8L07F7vRdeZ)JZb3_%bl4wr*c9!eYl*
zugk<>0a~XtGbxFIVWuVn!+k~u1|D?=Mg|58(88aYSD6?X@?Kk*iZL+E^aU9-f0cz9
zn8O6(P1tJzsWVtWJa$hD(7?&et1KW(=5bhnst`tw29VtLi58%>KQo^-aD*fmlrmUY
zi!m@v&k<wMsh{)`9G-_585pV<UMhjYzmS1p-u(hmPyunHfPo?6Yk?TQFayIu4}}6y
zBYGC7TFX6HAj!qRFsldT^`4^zpkXG+S@(*&3n04=K%ENTr~*i(4Q@{>6+kL&P>0R!
zT>+?S=76+N4*5-&7iW=W?3!*X&LYXUW_mb?H*b2WI7?6cQjQ`}pJ6uW8qbSDMLh5$
ziFFN%c)`6C@UmcGSC%4Bt8F$Yb{9n!K^97b+$S7TB&fi^Fnc3-mBs8t28P)O+dzYL
z#-Nt>?jngIP#0nj$c^H~MW8MOBr%(*7Kw8*OmC225v_kv1j_6XFRq+l1Ud&wz(fF)
zLtFidWWd{6gc%sbs|AWdXR6NuEpFv(FIEEGch12e0vdWL2JPR1G~y~0ia{#^7{ELF
zjWUZt18EF9!OJ78-?0>f=APz&t`DtHC<ZSt+sQCpM3O~7zEP<d)GwGb8SD{;oeT_f
z7C~kLLHA+qp6)EkqNcHpr5Mz{p95<5RwxvMTl6~_L^4w<7>YqD1hRmrQEB=_Nfueg
zhtt<fvPf92mMsS5@3{e>CbspLVtWY&hPk1jPMR`Lv4c1R!`vty&}hvZ89oMvIdLH3
zq#FZ6=Fw?VEHX(cS_;LWruSU%kxeDVpk+OC<3TA;;9;?kAOpi(J`GT+ly)ixpAEB9
zL&TSXA-Jg+bg}}&P7N_%28Le!V$i77+&3Da@oHtMV(|T{U$sEI@MF{Kq*!F@b7eS+
zLpc~2=7E~4obAP+rP0d#peXJ+S{x3lv5mn=VgCn_63~9ydCNhKoahp8QULb~i_=RW
ztzVEo`(KqnTE8HFp7SmNw|>EKQhlog-1-IYf)kok0&43p>|_I_5c9C<3eqf+^#&!N
zcCU+w2xy1c{tqRf&64v#(|wal1WG_l1m}Y`kJzp+0mtAZkR#_WECF@#AU!$DUnQWp
zgq(IX{X+?)kH;*Mlvu=20_o#{-00R?0_x*IPEj{gErGN-IY7<Po}(p@MklymH+Q;7
z38>VVA1IQXSin$XD$T$!Z!^f+l@2A4h9-Cj_LPuF320T|{7Q&AE4aE6w-QiKk0T7M
zF8Q@ZiJbrg!vfHOcutiikR~L^yj?LRj)-&pl8j3r2Q7dC(XF=xR2M+j>NQ;~0gq~e
zcMsZSlz>~8J3&(bdxA<JdsILrfm448sE&ZFhm?6)0y<<4au;J=O9}V_JMg}ucB>K}
zaFs5_#K6$2R9^xbm4)mz3_n%^UX8yKw0&sFj1tIVd{9Sy&g~M==qJMsP=euqR00|N
z1oh21RZ1XZpP>GY)#(z*&?ji5$e6PPGV*BxirM7XC85j=4D&0685m@DFqVK)*@C4a
znbS>WSp=+ilteN!Ff8cGU@1vrWnfrvKa7E4QgcZ%cynDC14F{rk`(Y+Eny4{JI<A)
zg4v)#r`vgYgDi`iW_=0h!g7X5oFKu}B`zhPwSNmi%dCxll;jJ8j06R_(4y(@WmzNx
z3`+7fKw=>8tWYh<Hvn-!j$Y|d0$$P%?s?5hDJcYZ>Onm(o82X#o9Y-QIfAUvGOaKI
z70(MHXHZR#kYmx}>y9u6i7f(+OF0%#pCHE~$#>aU4qUW?hRb&SoW5O-MTPO(^gD7a
z^7S7L#6jidVo*iS%ONht#lWzb739kEd&R}U98khl%n}EkTC`XilrF4}ii29ti`78A
z*4;MZQbG(2iw!~9N$<0`G&cjoVl_}w2s03u0dZVG?T_6?;<6x)8mRqI|3)0-p2cwr
zpizsQC*txTsd7*_Oxh_9I>BzS8Yo(&bf?ddXIa9yYPzigivr&YaUGCNJHX9?C)2YP
zSS0IjiG%K-U3?!b2AVBTZW9L`G9x7go<Cor#K16huQ=$S8MRwr5zubVO=05T17;ut
zUK5lU7}&mx+wp;Bj=*Yq*ccdguM>wHHKWA9u<(|+146b#kbz-QGy}tu95IIJ%!(}H
zl5^x37##V<nIH$Aft=zyLzsa<`Qdb9MHW@Z$Wl-(1j$AQI;D{Awtz@-GD9h-)L{Vk
z@!5q-A-!!-Xz@jtf?A*q;B|iiGp5f}WHAT@oi?&$Qi4V)sDHc^bo2EV!BRDF!vqvx
z+kcm;gE^r1Vizve5Ck<CLGh)#s#Fuq0Yy>ns!~wP1~RXFgl)Q<5{nq)#ObC=EQ+p4
z4yB+vZt1Bc28N~G3=9bZrJx?}GSKq;ErO+HVB<k{u?v@)gE=6(b_AAMfH>eShrVZ~
z&sJiQtPd--28;1AWC)ZRvobI&vkhZlm^-o5gcr2jEs=p?=_ybW=F$@=1#Mnh7MR4q
zuuKVj8s*A-j#5yAbXlcHN>UC(Dd>1lNSaKkF9nxKJHZu$t+PNWsN`7&>iru1D0LTS
zU|1H&Ad*~|YQs?KA;!S4Y!Ar)MoguUl848GfuVI$sXrfRikYzhR0S@x6=q<VZYxp>
zng?1AYULRHn4Yi9qM~lZR0`gA11|7vv`WFdYjz5OG%el6$H1@*REVtDGkupbi&}kE
zDR_enc+$;Cv@}hGfnnJ}Q1%d8QJN0oRDueyQ=FyXZ7|?Nd-ViLvq3TkL7DQ{ozff-
zr_uv#K4=9=@Ba&>`5X)kD?o=0Iu@5Aj)W4QURo#)k^q$z+*zf?kn$U3jtWmHsOQGW
z0qPRV*_J{Ms0EcAt4@_d4yXl<*_>Kk3OS$_H2mG|RayhyMhzOXSzJ;I85;tP+2pP-
zZ2*@Wpq~3$i_%6;28I=85g;cnmjtIM28I=Gpw{O-6&7p89n+;$Sya5|b1E?~IDAzT
z0`+@}!5OLrw9Mn1nlHGA<2yx*fx%Cw9K1^7h86=u^rdppA`J#Gdt-SNs0|BZA7`K5
zsmdZ<KcO77;CsavEe3|<wdJ6N+~8ZTx9uqht>cEUkClU#af8`2O3FctxWVk^kn$AR
zt=PeL%E9Y2K$i+MpC|_}(*WJ!&C$(M0cy>y1kJ?<U#<W*=D<~agKvc@cuN#`o%f8~
z3h-bQc%SfQy9&sj0?-)rq~jH!RvrWR=s6>~3Q&UqvNb>WM+JCfY9|+iJ_Ezb6k!Gi
zmPFPH(B8dOpz-Pog$hvWhYV%%B~(DR+%tl9(Hd5OhnjXWgAe`P;wn%H>Rzns0&RI>
zs)P)zf%0PVnM%;Ow45v`FUmSqf^sm#CGMe>Ab&wz;_g=o@fc`yzCyYZRER*Xuul0{
z3EC^c?*dA%lS3;Z{sIk_rb<_8a4^U-FiheH-A|UOUJ<6qz_5xP)L;E2p$&>nW}$}Z
z4(cps^`LXYw699&@i8#0I_Ur^11B|DGB7yLlrZ39U|?hdi-0Zx;fazk1f5_3?oj(q
zc*MvQAz{SGz_8jZjDf*#y@as@14H=SFb0NzZxSXF3=9!Mpq}(<AqIxkprpoN%+CO_
zOIJg}lo_Op17vbe{S8Y7hOoU7)@%$6j8DNrSHl??#6%=~!H1URTq$H=;0%!P2g?^S
zFvy*i@D~HAEo5NO|1S{$6EB@F5g-B*w`5?@|0xlm0Ahp9yIjb?U|cK_2v%vyz~E*q
z0UEo3*jAr&$&!J=B2^+t0<Pg=Ap=8hk3=v`L#(hws4@cs_fn8?*+(rI7-IP)!ekg2
zR)P;u%sx=Sz#zsZ5iVNDz_4(ML<AoL18YYi14Ck&1ZZNJp}3HN!SRGd6e#pSw_ylq
zNJN8gqDekr3EH>!U!oJ#%>xH)@*YbD2Bs8=euT&lO9qDZuO%k3F)-+qft=tAiXa6s
ziAe|%(3u~MHzg*sf#j1xV@Y){BtQ!d89*7C$u}pQfr0U(#58`8yl)1G_g7*%KlmyW
zU(oGP4CxXx!IH@vK)0Vflb8c8Y(dJC*MOqPM`A8QWQ8RILrJQ{e9%m;F<8wKO9lps
zUlI!tA`3txUbiI{K}?-v$-tm@L1Ho74Bv!s1_p*IEs3QN1v5b0Hi=~r9;m1>*eS7+
z7ZfR=VrRC*s_D{NERywJ%o3}485q{KfX-w*DX|8oVrPrQS}=P(Bj}I_iM!xZ4Aj3=
zVqln}C~*(W2fK9w8v{d^g~U_P@hqS#VkXa#c!LP;9#DFymUzp?z_1Q{XGwAg$kAU5
z85lZxB<eqcRa!DI7;8y<N2qC$V_-0plwkA%-*gYQra_K@q2ROxqc=jRMvj3&VUYx*
z4??H{G;-o6!RRN?z~HY6(&+23lF>qf5wr_)y|8^oK_Y_$V<u>wBIxLxdWKns5{y}5
z3=HdqK@;&ik|Y?jRT&u8OMoWg_Y_Mo=EyQItd|9?Ob~h}!3f@o`4zO7V0oqlBWNq;
zdL__ef(!BzjG&e+L$QWE=pGdb#scu!lb{on4z847ECgE!+6AWNC&36l`Ryy{a=_^u
zwOLf_i<uc1)>VTJ;yK&Oen0|rLfiTS{0t0J10@)%1wiQ(G^pniFTq$N&A<?(46?tt
zR)Vn>lm)(mj$Yc#B*9n*=7A<P+1^Po)`NMVqnDBdBp4e&38@&g+-Rkt1Y@HF1H<|Q
zpre;W=SeU&O%K&!(XRhcC8*B85S9iGGXo_C2BSw+Vu(-_P-0*(m#G4+=n1U{sqs0W
z#K17qr%D&D%V&cU14GDxDkHcqA5fz*Qo71a0(8O^SeJtm1B1o8Do=zikX@xL^;L){
z^8r~_ajgneh(Ij!23a=GqAC@x%^PGH@3pEdxMkiT%QPFS^5B+vgDf-KQq_pi1+uI#
zr>YI13uIS0OI3XrT$>ljvW+jR=EAjkfh^OstXc%u<^{4$d1BQvgf5U}vcIZ!B6NW)
z+x)m{A3_(%vYl~Nhv2$AL3Y`ms=8Va*X9Ybj5oCE7F?Sr$g=9Ns(T1+Aj>9rR((Y1
z0$J9*t?C;>7sxW^qgB7)x;zfZF))~Hsbb`XYxCG3$G{L?RmE5@1lQ;RI>9AoW)-6t
zLZ^cq0|ReW6{99Xr-2*;gFR;zqaH#dXuYg+Qx&5TT%$Y4%A)sGjIMBv?jS2Se5zvf
zf@^f2AXm@8uuY(f(GQ^$WTi}96=NboC&<cK`BjW*2%R7+=bouz%z|rl16gU;Q^i;d
z*XRbaa_`M5#wNH%H;^am^Q#!!AR6nLKQOt0tURtz#W)k86J(|F`YOhG2%R7+Etga=
zE`sP}{=no4vXcFA72{U8MpuxPE~~2;cfmEff~<6ZQpLCrp%G+bz@aL}i-`Dl1zFk4
zR>gP?p%Y}~#Di6gx8OQmKvu3jQ^oieZe?<g90P;YzbeL0aE&et<QN#_W>hhLLud?8
zVqlmwr<zfQfnhzkg<{i_%D|xNHoHa*Y!uJG3k)Ct>TNTmGB6lCtkDJ=sKD@ly1gNb
z9BV2AL&yK=2MkzZ7-vkEHDr-sRGw~T$fCn+S>rR^&zL2W$**Dh0YesXraYGEH$f6J
zYBIqR(naMpkZ9rgcew#%3utX2$d(NUrq>v;=rG@|X@jWbd|fjO>YmF7kX6p+pDu6A
zqRq5WZn}>#ON>-X&31^o|Gz=XKts(8AQLBFntsTbMTc?A^!FfTM`~_Cl>NI1wiD((
zSH9_~CM-IPebXnIu*B4BLIXyLfuW_k)&#5tRB+ieC^0acdr@l%4hpbHf)WFRPiw6W
zJZNn|IqsNRtv^B+Xzs+Ms5S(y%ld&51H*#Pwc&7G)}Y)SbGSAWq^llW{#t`9V?0}%
zhtLMHtbAQ<AwnC-va=^^TR_?%x<Hm$`_*>Bby<NdvpZGW1J`8*vaDcg?R>Z{E0A3q
zIBS=Hb%Bd^E0ATIn`@UNw1F(^{8GCMp$%kNpI+^Lur^S5Sb{98@u@`=Zk8a+*2LFd
zh3m2eStj<g7E!iYg6xvbsl5xa3zQ8lL6#}2)qX%|16igyqxLJ@G7FGp$<u0oK(sM`
zV6p(^u8E4ZjNEW-7N9o6uKTr&0tkJesTFtiT1H`nMo{K55wB$gCI5Oz1!w^}+^LYa
zmJyQjLEbZe06LIrQZ1t%T&Fq6N^9*}Mn|}n<{&FYcxxHm;8vQ0tgL=t%Luxa6;hp<
zgRHb*tYwTrXaw0<G_$^zF%hoQ3}j_RLM>wo+)6W$m14TJjAd}0W*{rAOlujd5gI{O
z+B?@W)*&>4tSmfS%Qz9C5oF~Bty;!uaE+$*AS+p3*D}t8>of&f+4ZKDaSdFjDaguc
z>9vd-5jsIup3ACb+=9>uvQneImhm`3Bgo2J&sxSaaE&G)8`C{&8P9_?f)k(#DB(2!
zgl0uh=<9&?T^yY!!3bJKxBEL-=nNmI1e0T6m@Y5DI8&T~VGp>qt8)S*ZUkDRdR2mH
zFQ^+0=?i2CGBB(M?Eo|fHC~N5!EX61!L(14fnkq2$jC&C`VEYrrV0bYo@j)khF}S%
z{UAkNAVqN!f}nO11H+y=gpwVR5=;j`O7cKTVi$mn@mFPF*s}<sW>1y`(?O7$i6AvG
z380Z7D+Y!=$CAMVG5<mCsh2$?!3tVNxo0a#QB;f^14AXN1S@FCBt$48Mv#F)w1I(P
z&mXYS?4U07o;M{73@hU$Sm%g<BtTk4X2>xxtdf`D_zVw$hzO9CHy9Z9LP8)OWaEZw
z5*%N67#Q|~L!dtFh8zP!hL{BReM!(svLKUmKqgILk>GxU5Xt}rFM|a4ON5Yx90P;R
zYYFam2q6wR28IRaCAdGsg|tC~leWwnLU2cgT~T6Sh+Cl{BFDfW{tX=c+Gms)80`0H
zC@3&6h`j|lA?%0}149XyhO!I;gSaP1L>rVumTcEhS7Kn01dVbsX?G|wF!V0a0A0i)
znFCe>Ds2v**3g${V33>w5((P@Dzmp~fKrD%II6TOlo%Ll+BMAN7#QSPSwZEGc7_rI
zgX>cbYk39+`AuMLpeEUzY7IM(2xtJ6NgGsbozv2Al4oF0a0IKFqr||#_gceMfq_Bc
z99U!uXmIEa1H-<>;F$Ukim82*H!?CXw4PR%1&OmVe_%{g5M*Ewd%?i4@01vLMjafZ
z`*wlUHJEFPgCxM}7(gQD>p;x|xw9aVI}Mu{85m-3GTMVW@*t7(2_O+Z56}(D5H-sk
zKq7OaSvJDdq=W3+Z^^*0-xBOB@Nr3UXXO|erW}!~=K(F}+^-38zc%PNJLx414EqzI
z3iTNn_6N!_Ff_SJ@f=qLNq{U(eE?brrsO5X1M)Uw0z)AKgHUyyoFD^3<dZ@MhK#Fq
zp`dQw&O!!;wc&Nyf}nHx3K$qx`qa$=P4BOasGAKsoc*MdLuEZ^z2yPWnP09dm7w#L
zAY($?msf(;nLuWljN~dobElA5Ci|C_;N@aFLDTlU6DmQ=EjhwK!}$3pD<R7*K|?)8
z|10@97#I%NgLZGTsZ@fNTdLQAc55u0UkTcgcfjAAL6Cu=9<*Qm0BA^r!B_$$0OrSo
z{STi0&!{k{1kDs2*bTa2TCh?Ke3Tt%1S+bjQXI?y4Yn>;tCRq9K!eTBXDUH=*f1Ui
z4Ql%wt&{@GfQCY&vnoNe6dY+9pi$tdjxN5HpxLy8%a|A#GSw?}zzRWzU+}I3O{N`O
z1~PnGT_tETO->ec;@i6Em7vKq$hmI$KPo{Rry;8|t8Ps{Ys(^8Z(L~%YV1q`ZL!!X
zQ3;w*W0(ZmK2Z=?37S=9m;@R@o!e9iSv3h7Xq}!{37%t}1iE!<Ay*}6j+NiVn2CYm
zz~4&HOdA9EB&W%tm7qCz2JlHvf}NG1sWyg5pp%@eZdQU;RjT({FxY?!ok<J~2e*Mk
zQ5NLWHJ23XSveRO4uQ^aJ9?#_O&r7qd32F>J!H)wXdF+ke)>W?7Tx&m{Po~?O#@A|
zWoOibmjQy$9CW!;58CSrnKRqQT@PLpxKj=^HVYnRTy&hJ9(1hWp%#$}hI-IcKf@#j
zkxGVo3GnJh&=4cX!s)v9EK(X#EcKwcICM-TIkAYLUIrXyASYG+u9pE#a)A%@s{B4Z
z-=0Ov>9k41Wex_0!=g+K3>Ul`KznJ`!MDC|t82K*0lJ$9G{wW0&~Obr!3UZ<Fj>)X
z9UP&c86J~$(@)#8NXHm}3xD?i3`ZCl7*+~2g3OeMhS*_Wuq5w)hM6Eq8AfgfhQqMn
zJe&oV<cCUXF!3=k9F7DlG+`ECV33TNIo-*D#k_vATQehQPWnhLKLf+&=w|Rn3WiCb
zAqAC9&5QwHe=_njFl6{NGlD0m!K;s^cr`PEW&;=|fmR>wN^WKZ?MGyo1R5scozTn}
z!T~y633PVNq&v-wpc!n2NuYhRM*o``!ys7=bj7(!eKRBIf*AEWWqt;Rh4Y)in=KCb
zoAWa;#IiOsMuLL}G)}SBshJUUya`8`69Z^0r0Oy=OEcqq28JU?K!-&8HG{XYLma+-
zYcu0QxWkX!Y-WU9dctI%l9<fU%($2Xq>VY4fnk09nPx`Fy(i4z#YmtGedH=Q?3n(;
za`=&_;Iz3PwD!U8UW*tv1H+N4Yzz#3&s#uOC_~sET0pn=K-fQ9{6T7turV+c^S4ap
z289J114Bk{%QS9KF~i2dkf6{qo11~5UcHWufnkzi%Y2XoXyCP2yk#L=!_<~VAaQ$;
zLGmrj;o@^!R=~s)%v;uSgAT(0nPb_q5hM;aN4I4&T>X}oEg*4_ISD>3JK^db>s$7M
zBtRN6_O$E=u|bLoKDU4t_(B}#*>VCT4pLK6-Es<MXcl|RX^=QbeWH8I1(=}=SX-`u
z#KG#DTdu*?^S4|FiG$Q<iMQMVvq4AcCHl8KglR6<Y<UV}XXUrN1S?`=U`T9jc?T0O
zIoa|FZfJSSXSkZ_Ek9st`2Mu~0f~bgQ9PmLABb&l#K6F$snfy;S|oiOG!*7iFVn&Z
zE>OS=?6R)3Fmi~2rXWBI?2g==-tWvJU0=|`2&qFrLwURtS{OlVj)l}f`>yj(wlG3!
z5zq-%M*mwFK_!fk8fdc+n@S5KXcdN#nhH2+w=ja1VF;;dfKt`5g$xYGeZZ*-yv@$-
zUkjs%ECa)F8x{tJ(p4>ti7E^X2jT@881~oiVPH63239Hq+L3qWdkbSSNNF0V9N5Xg
za2&L$gu$2*lsZq|YXwa~A8%%3U?^GHD#^pZ!1slXfnjTXE9f+0zArF6$H4~jfb{rs
zwaW4^FdW|wlY0!769mc08n@OfgCsA*B>#gY#X*vBXIr&Ea_`v~7z{49f{xlaei@X^
zkF<hjmyd(Qjdr#=gVcb;Cn>agf!HANu!>gD9U)-#I~-d<(^+8k<#DZ`y~AMfjW=2|
zK^KI8B`Wn>LA!gw5}RkWf)=`g#Y0nDK_~Zs#U0yPK}YR?#mjhF`$3k0ELNP>3OWS`
zEM9)J6?BvhSiNdWE9jIOuy}ubE9ih3uy}NF>lTn+kV7@<{aW{cI3R;+y;={0*dPh>
z9j&1AioqJDNw<Pd9X<}a7GV1ch1S~~3=Ahhd$V2YTR}@bA-8=c-)g-B8g~Uxlx1CM
z1&x}oOaawoc3iFZ!6lu5NO5W*L+b-BkbcnmfD7mATOWdXpw@wKR_h}$2YmG(!%jg4
zhLge!3@0aoBZVInDfMexpUN^YoNQ!aV5sJ8W#k2MgoPOxc4YIlv4GrliHU*1rM`_7
zY$2!y%evCW21)gxq<L}`1H;LCkUN>&{<d+}D>5*gyac*?T(pe~Jc<vxBX42547iOB
z+6++J0co$ZF)-N5b_h#?G7uXBLt9ga2#mc*vjcQ=0>ceq28NuA8Xe0y7#L17gEuO6
ztN=L#yi}=;xnm`m0}7L{xDL<>A&m9lJJ<Wabbzn92Cw^f$nF3gRti}Yz?<CxzVjM<
ze&y~79qYjbKd5?jV(Hib=70{|?Ks%65zGOtn9)(~*aYT)4%`*4?f@Nm&j8-IyR5on
z3s^>xiGjg3ykjdzJ?Oe3Pz7E7tpjuqHsrwF3XTrY0V52PR2XJ4GB7Ng*~<8zw~T=y
z_<!9V!N-gY4A~tLJd=1C7*5-QR(KX;BfvV_KTEK06MVwRz|b~VVjW0BNHq&+8SC2F
zj0_AqFZ1d_E2K|@3|JHfS}}Trp^SlH;&zKpkaZcHE*xwig|%B;4uNh8oDH(*h6w|M
zXf;TkO}a}KSbp_Jmlq)UZ6NtcASoB8P6xI!1_thlO21i;f{yuL<qVp8xxv72`We_F
zkkT6_fuJ>@3?Kzu>$^ZxJUbZ}PX7VPO=5V;$iN^FV{gH0z`)RcsN(@h`YQv&nOvUa
zqzs0R=i(qX8v{f0;f^;l3=C(A*ccc%+oyl@U=gqH?_gwvL^cD1kxK_7_)P5^EDQ{b
zv^yA~$93>AFf?E01Kk>;%fR6CqhmKC1H+jc93VqFc8i0SZtx}*6fkt`Rscm32LnTN
zf5&c3kb^nEhVC|nvKMK0>~;jPc`_L~!1s^We-&V3U^wQ{aZVXzCIhHVcyg5i0|QrO
z#{!r?esM4`9KF)9Kn>jfG+<!p;qGXJN}dJn$vJwZqfrSY2|9p9p`%eBw3?KSfkEG<
z1GK}R0W@pK?%V-7Ns?ib08f4aL&s!kP-B;&p22{DK|#5r5@uX2FX(Qrj!Mv6%vavx
z)O3c9O3+bsJ2^l{z;smVfL7jsGztIgD28bQUCeg$N=LCe$PK(@i8%}%pp?S!6{IlX
zMn^78A?QB5qgOg|!3sf=^_DUn=`h(h5Pzm?A&f~k2YCggQm?cl5vuSUsLyruN=G7C
zAxM%XyCWJV37VuodZi;;17S)uC<4HaX*<;s3R4JL^{9RHN=GPICCC_qf)0O}YzxFO
z{wg42I2affG)~v|W|4?0@9=~v0UZx?^h$>(LP>|GA=tgT3=Da<I<y!W7|sho0#OT8
zHi7~%^-hPD0;pW&U|?{4(4nObVzV(Y%q^R~(3?fP-lM}@9h4M6MOu9aWVH?h1ITs4
z!X4tmAlEQ3oCodLa;fhSR|i=KN=@LcJg~&108LD03=FHa+8Irt4!#i1Rg_x7(9Q^6
zl?Ym&9T?CK-PX*)z)*6qozVlb;)yFMC5@q-(G!$2K<X;1r~CP^h`YH6v@?QFecj2z
zz~Eld4w-A*$(75{&X_L`ayAPC!yc)2#sbhjV`EVUh6_wA3=B(WwljKzdM6-ly)x5R
z`>;qUfZ7-hzU_=fFo_wt?Tp1R&StymPkmU_f~K@HHt>Q@Zvh8^#*y|PFwcMvBRYDe
z{f8<jNWcld{f7}KI9M1Mf-ko-GJ*?G76t~8CE#6MAlql;PLK6v5m$?4ZD$0pLEXt!
z#?a0P>V7dy0)?{2u69r{$ncec;iAO!S-vbXo(Ant^g+p<2ON6fJ<y>06tb?gzv2SL
z9)mRlL#%H51*pp|hJmBJ{Q_u1GbqZluC!lJ11X&T-<L&7<x%@Sn92nZmHR+jqM<7H
zDT7to`mv}<h_-`n1^_z+)OS02rF|VZ$xpBLW08?~-o6xO4(I^3qgUFOLS)zbu}CL^
zHUb{K(mqWW6g=QO**?t*6g&bvpu(zs7AT}a-dLpFJ{!yihwy3jc5w0fm4V?>2RI9~
zcY%$7=;{Nf2sTjhI9=PHMWKF1dp*<<m-a)H*J~qethWH$$i~31oxi;qVN2-$_Hvju
z(D8Riue6tgwSi(l#Hl?CDtQ?+>T&c+dltCB0O!K?EKs5U72>0;>8JczxO^A2C%`m-
zy81`2v?m~GNC0a9MG{|mJ2>}GVqmx&#*>=I&<^R@F{m&wRGez}6JcPuTs>VefJL_6
zw%rpn9ln!+;qnaLqSSPTc26Y+28Nvsx(p0KSK5sk85l0Vg~XmQEcR0Gv>StC51h5z
zjrBk=$&<^_ZVJvCY~ZY62F@9vQs1S%-3r>CHDF+fyxpz_&D~cNK-IlVeY=_#DEL4o
zXds!O2{r-bpXh__a^Ut41H%>2cFdz!+U4{?p%1Z20iw{1fuZSLD^n0Oh_3X5OMzA<
z@M2p~?hXuSWdbcdV7LL!_pMBsoYQRrSvaJtTbV%12N-rT<T5bGincPjfy|i1z;I>z
z^!Pv)nffQKO!gq5ujUL4Tn}5BG#MEft~}rbt%+%6(v$*mKs6d`ha>~T+6}Et%8U#Q
zS3w<@g-cqQK;xuW9>_2-EE8s6xGD=$0c!a%z5($-#icR$gvhJBk_-&zWLueJL7Hu$
zhRez@FkGpB0J<{c)ZbPnagZG7SZ<KP;vhM&)R_~lOoAXO(Cv#LDM5tP?p7uakQC^Q
zI*=3xSc-*#L2_Cv6BlHxN0Nb|!?%_3CrI5kh|P>Y!RkO3x7N3|GJXchfetiVxTKZw
zGeR!8mGKQo>J3yIsO515>?pgvt&E^1%QaA!52WiULYHGJ<5flmhHIeBk07b5U@5LL
zhF0*&XAF}V%orFPU$ruV+8_+|Ul|y#fff-Sz0%6K8{7im1l^_A%D5Zc1YiMshVhUz
zNSOc&1B330R>niB3=G$*AT14HJ_d%BXC)aJ*57Pp1eG<{Kxf<a%xz^{2RfMnRAA<9
zZe`pE&h=cG46TeHd4{hHb3iRM-SAe%6^xP$3@aR48GAv_{=mt=AbzHmu~!RZBe)=L
zWrSQ0%axzU(8>t89TpUL>i(^aphnDf&~6l6gI2~yPz%3?lYzl_)%0`0EHb?5t&An$
z#KpjHJz@IyU>3PFgI2~8NDIV_fuU+oD<iD!aD65xsEyRh2x&YBf!ZLgjF8p?3uq9h
zl@Yw0b0;YL_SCd8MnO%!0c!Apf-eeOc7oMTuMT1Hs(;+d7ywfQ+NlLn6aa22Kur$-
zw<^FoS|R6ofK7L_Yh`qYX#_391Zi{!YlNx=SF7N#{oKk3+P=XsiG_h7`)4a7=yZKZ
z9Lv<Zv@+Vki~$`E2r|YF+|=L%wMJSQ?Z9mfsAKGGK}7|~cLg4;j21AB&!E9#fvnL2
ztdYT-fk9_-E2AnS1H(;IAy8AVl~EOx??49=rq<tSWmE+>R5(Eml~zVoa7zW82tZNB
z@D-GxT<TjHH9_V2P6m+O+DBU%B^W^^5Cg+a(0TPBdC(X$1E`#loYu-H1x||~wb74T
z89{jyRK4A7fVxu<oQOe%Y`sKPHz-Bk+zT#cyFrIYFo5dF8S}c=$%9%191INWk9Dup
zfi}AHHg~Usv=((47@GRJ=Y#z93!-^GsK*G^JYNo>dA>G6^L)^?3SU81&tU7G&Zy78
za0_(MU4~6J=qMqENenHF3=DN#-4j4zJ4u&;VSjOVD<cELEzr5cT7J_%gs~{q7j%Ov
zO@>K4WenY2;06fDK+BZwYLLq5pfOj!?rKmVPvT%;$gt_I2KO1*7#O$<x<TgvLmDAP
zvEBJ#YZw@Aoq}k}2YCV1kmoMwhU_Z<*#Wso7Gy^{Yj+x>C<DW7(5yi$Yj+yR5|Ed*
z{H8ApXVFcc-VLfGZ-Z8A$Fg>VPhNpYcPFSqLm|VaI{{R1fEz+GTe>5mZn&Mr0m?(&
zpi^hSaiHbb9jOA+1hP4$xEqvFZi5Cewfv@AMX>1lujuw-WMH@rI!sc_uiFdc7O024
zz#azG^HR0l&M*r=TS&G1x}CwE1R3hIu-l4}f#D8lQ<s+C^lcF=x?YOipqA_%P}^6_
zuiFI4P!qVJ$4k3)p@!Z`f`ptd+)%aq-D)61+otPAvdGkb=vDynK$lc!*mNs^%>&2s
z>h5kSupywzeqpyTNYznDe1XOlplRXU;ci~ADo~2>z0|@a%xK2I(D18;@i0jED+9w_
z&{3mDue2~8RtDt>aM|3#c-R1xRb?3J!4==#T_8Oy3=C51S{P4CGcerU&jPAHTNod5
zf)XlMCPNG3BX9xC!oUC;>iY~%SKzXwh4BkW22_>=Uv6Q7Oh1V-Fx)K$7xpcTC)L4)
zJt(VgNN-`h2yRM)v@U94obDdQqE){O<ZWYq(6ry(ReTH##}-O5FfjSIFoLG!?t;dH
zKpxnn0P+B+$PkWdVO-A0z;F+=A<Ct`g>gCf+%8TA2H~t0#^ov?H?x4s;ugl0;7Szg
zHPFebclU!FqPwC6JWUU(gv{$17~*nT7}FRT818GZFfcf6Z(+>k2XVk22j2_<Dm&bn
zS{NZ$28c2++$&{aV9=LuVaxyxQ5<Ce33Wh)vfx7ZC0Ia1Of8IMpaKeH$fAH2#!7hx
zhWi#!7gkBvgZu^VB(yNr!qm;kZDFi~ae^<mFxG=wS)fANNUjCk9|4zVpcw0x2gR5u
z1H*j|76yh%$6FX%L2bIP3^1Q|YlC9|%m)S6e2}?289*%^&?tZXeG6~|fQQod?=fd!
zIBC$r2x_a{p9wCLTNs1DRWT<6L+YIt#voWN>H46BF-Qm0!UP8tq%jAw6y&Nfu&bcn
z4~N=l#=s!w(ZUF7!yR&DV7PyYlYzm7v3`1942y*4x)$(Kx4ZipKyAJ4nJtWvh8+XL
z{g2?XxrNalQZ^rFWMEh^ubJ^KC>5JCFibz*%y^BFf#HD)Cj-NwKhw|0ut?OOY=*Q@
zzA`X8$Pxk#DKs<g2DOvFf<4s?ZmlqYDjHpbX2#vRpzak{L4GkqGb3mwK=25tiLh!?
zGvj8E$&;X(HiM470cpy*(#*Kol7ZpDBvAA6NUkIUgI;_y;|h@C{X)g5_2~@Fj4Px;
z4R%fj29W9%W?<El3=G|8ni*?B3jae*tp#0*2Q#(ShJoS1f38f1X7G8;;CKd20kwkj
z8OXN7+awtnj!HE%#xXK5JamB?5(ml!Fhk<FKyLdF%4e+8-^a2@)blnox<U(uhsogZ
zYzD73Jmd(f3e^gl;lcf|A1ZARZZd$Y_hv?Wa9abUwzZ&{(Gq49Xvp#Cm1aguuv(Dx
zu`SJv`Y>tGR(z1OKBP|uHA^4dDFZvMnGw8^5!`N>TG-48Djh-f@gvZl1&~fPaIXxi
z7JP~asI1{^Z)Vg41;|&Bm9w3i8Rei>J_2nO1ZkAh1Z6C!jdG!oy48$<p;o+^5!6@*
z+XC9<0#YmvR?G!zv^6tAw)=t%4!F?_Zy`JawLw8@1yw-?gPTCpqvBbl?9`hXxnZ`0
zjxYcz;zlTHX5<Es3V;lhNNi?g1gYK0!0=cM?5pXU;#t(|HJX1hGB7*_%~9K0H2(s{
z<s?uol(fG2BS-=?k7y~<{1KF*Kz-&|*5=P3|AV`O6^_j>L5eCl7#O%in_q&H6C0?)
zY<>+<WWd1CdAj))$mXvM439zgs2si0d<*PIP=!;^uy0oLMUeDPT?U5j5zYG;85o{O
zf!i+4phK;|m98FR^FBpTM&SURH{85W50t#YjiBcJpy4`DZEm5_ydTt01y#1oBb)bw
zsv1zEp;5gVd=&IfHU@_1PtAwHTZMQs8JfX|K-cdC^?=uGZw4*icw)#?#?ZVS;_`Mz
z28KD^%}W_|85p!enkR$Y1)5^jN^YJE3MFuRX*XYU4@d%ZZt5n@<{o&<pn#znG)DMj
zE5wzc@j<Xp@-{aYgCb=o$OUDb4Aa9BSwvEfH`hQ*DqRMK*~^-fL1uyulT$5gPF4if
zD;x|AR!^IgbwF%328M+p&8gtJkd1+%M!Xr+4r2gETlU`OU`7Upr=Tr0_I1s{piweV
zi0B$jKbOcNQNOd<7bFdu{I{=b_63d8fc3FiHameNvLPYw1Zq`)LUqQxW+zRMr6Bi$
zx7LFF-J{iP4pKe~qTC!wxj9@p=rjNZu=4ejn?X7A>0Z!8ccD(RKB!!u1Tqqw3BQ6;
z0)vNXGpG~I0BT?^=x7FYn4do8U|{f7ZdL|2(?H2`Q(?0hBLl-T(CCP-^7PF~EQ<BN
zn;3V1#6V~0EL_sW2s&#V(%;Ow*~AEn*k_<R0wlE&+%boCyq~2oFl5~XRY#zX_p=mm
zZ3Nx|^(;h}fx#@H=`YAw(A>nrB~5?9TB8{ljx1_o6b09!O^l#BjOq_Lf`=8Fz_X1E
zUj?8%PEeG7Wnh@g$iT4mSWmPr14DCS52y}$1{%^@xTMET6+BF!!oZ+Z+oR6N!0;Tj
zL917zM;$bL0m^L^3O$f*T5O<pMUO7HS;3QBz|dnL#=vmM4V0!sKlRvw6EzzHL*?%t
z(C8P#Bv7hWs_fwh8M+cYI@QAu?g)X7r_$)*2ls<`K?d=AK@H*#?Ey`YGJrD5`eW18
zQ&?o#wy`lV7|BidN?}o|ckN~B0CjL$7#N<v5lSv#=w$*e={n>F4vSu<F0kWRK)I}!
zX(D)dkgJTLmkE5Z{!UN>YUA==rXofLh8NZl?M0xrp_@>0B111zkr@NSp%$o7CCEnA
zf;}ft&%(ga(bmgU4+_?u3?TFTM0=USK<3p5m1pKL^fG}e|3jcdggW(mnZis#9^+(S
zu(jxA3Ks#@*$}J3LH*qpP&M1z*UJP-_AjnO4R8X55zGK5E06&YJ<cki<`T?(t}yrQ
zc-6}U-Ukk9V^#j{WdiR5-w86?@Ki4oDAB(J?P5>8)61j}_AMs^1MA;jCVjBkP{-+e
zfE)+)yCJgKphHu@6>-n=`d;wPUBM$P3=B0FdYP=@qXGLT^)i8~FTo=W3@<AnL8~SY
zayttH1IUHo+6&}D(~w>!aP4&iR42@P*UJP-AfU$B%bh|M482VJpggcss1n2k7v@k$
z35qi)F&uK_$_K@|DClI4ZJ-F4dA67FJ0k<bE6_Z<uk!S+G!~`$E4_?A!F~X%X8a3Q
z&BDMi`)x1e-1o1bc9#F9UPjQI)}a;#hF2%R6@M?|QAJP<2lfHuQER9VY%O{jkAvo5
z{;+@&V=p5}HN#hMPV8m;2(jfX*cPtj#3E^iUPe&+4jgP+&b^GFbwJ=@hGWdr-O^c<
z>UXd(Fz__=GClw|ZNbgc?J2#CZ@?GQGJxVvIkcB?A|nICYe?t3mvJJv0SIx}Bybu5
zCkw_&=Fn6NGGID*^$^58pq<qRw?Q2Y8fSw$XD(#GorQtn7;`V<Tu@a4YF^KNJN;ie
zi$r~3FXJY#yF?inUKes@G4wKSgEp(doLvwOc+5d8xfeW;#CVi};q`W*WQJbGMo`HC
zGB0X!FJm*PCIiJg$aO7X*MWS;s@Thz$H>6&29({8Ug>4b1Eowya2BZVWz4e$1w1DM
zL#KW(V?L5+^KC$$h4>G&V+!s+&^R2!SCG*~hP{ljAfrK3B_N|?!2t(u!S^!8f(!uV
zF4n)jjBy}KK^##0#(~QtuKa>}hF-=5a9l#e4!mReD=4w8Io%5$U3$|d1WJaC?s5za
zZ`wfZ(u3Q~85ktq^)lLmtlk8Xwv_=%Llc&*5h!7ST-dDM%gDpX!0^@>qKroxq>L*q
ziJ_N~kDH;M0i3}$+x3E1i-2QIM!Od>VFC)u=uf?j!r&4K)Xy~NWdyA@RG-I{$<WIP
z-aro?9P(A}WmEwbRG|4(J;q)}J@D}i44|QFU+G@(OwJ?*hIgPvcAM>be}D$uzk=#I
zRps6vpr-x}(3O}yy}!UQ$i~1>F5UYJbl3=}Qb@lw-8_pWs{ZXG76yj0iM@<0Ae+8|
z`hsskP6P?DLWDrQA`q7i!Ub6$BHIg^9%s10!0_%Y2Lr=qyWYp3MG+wDD}VPs26a_H
z?WWY8UhomPAREi2d!Hg~?|llYzQ0Zv$Y$}iUc&}<!w1mJHP{L7_CZ8GLPS8r{bdt-
zKS6k)YH979UQnm$z1Z{_*(@?fH+!#v23|nc?|9XF%?4Bya)1l%Yv5uLRO?T%>jjzm
zzKjFZ6`cMon?;MQj14s2J6$Y?MZLZaRBRcuf=u7;*t?LCf#LlQUQi+dU8eG;4OB~h
z>Rk+uHIRGs7<)HD<3ojkA?!ylsJ-=}46Gwr0+b%WQ$D@m8ze#gkN(t~2G^}?&<nmU
z3KU3sjJ?zO!HGtcf#HK38)&AuHy0FCAlZ38d-EXK6(nl|ku3s=fa=(JKYL3+Y;dT3
zh=R!0BI&Jz$bwv~YtY*a;z9MbfY@Id7(gBteArtL+L`>}AK3jy;Pedfu^HISYzz!q
z$-UrXo4~WAdW^l{VBdorbpc{6=+qVPT=~48z4j2pL9*{4vhGNZ@_@)f9Tf<c0VN+5
z28JCEdqLIE$KdHFb6GTW@AayITDs7P1s`PvV%u8us(FDT8RU5VwY~C;3=AJvOqa_8
zYmrAv3-Z<=WstNW?+#*vv=~+Pf<~o2{+(W&$D&bxvsc&{B*g))>VzGjY+H+7VIL41
zRC0LKHn4yO<vxMVc3ilmfyGM_)bI+0%)fjxWB@IBe#5}<$q<~5I6)&qpA;n-81|<(
zuz&{YKE;8jG8$N%r9m2@?Z;1f3=Dz$)8V@Fz`D7?y5l4n7;5G<uoy5hFnqcW)olRQ
z%>^27ZeRhQ*9huT>KZh#7=vSqg@Hll()8?n7RmZW4J>xxc4PyK1-J|Vm0jyA8(2U+
z$j_idE<yefM>Y_AFbBxMtSb#HpzH2GOM|k%zI+3VEM#N|R8}4UjYS9sG_bHRGBA7w
zjqZaCVgVZjvO_Yyf%zX}Jp;pMP-lJNk_P5~vPgdZT+F~A84vUF=VGvzc|l(OoGi(}
z5cjQt`5VY!(EUju&ELS9K?cXYXkdO1k^=SIK~nGGQq}Vsn6EQ3Fnj?`!Gol(*Mr@|
zm0ZBkz<d+j(q#el{2G{VfdT{MNuSjX%%CIvgw$9V7%G1^FoPyj872vUng9$9%-{>e
zCUGSvGBhwhl>pUS;EH{%P6IP&HT)M)=!0xJ0JaF^zVM|D%)3C20G+2%50cvjb|5se
zK^_lZ3R0N<pn-WaNMREsTA4Sat4jw@b|su@U|s`K2O0_mnYRXAUBW4lc?o+Om_gIo
zUyee}TPn*S#{lWTq;G3r22D790o||zGGh+djOp_VS!C*$H!y>GrC&jl`5?K;U^%dn
zGaHyebJ<@(=O2Njy1-IgWeg3>pj)uO&7tIN4a~jZP9#`McLQ?{BLl<NDyS<!JFBle
zU}0bYsRJDm1lBZTeFHP-ybp#+4E2%>3^Csum_ch(zAl35N(5U39$#o+2BjbdaAUZ-
zseu_Z3iK7U^atc1S9rMVpKo9W4Y+*;)ixk0d$18m!LENE<iG<q4a}g5`x|J02BfZ@
z2dq$(f#I7VS8+Z=1G5061t$REi9vWEz5BcynAsQ^7`{Q%J2M+tD@bZvYy&fBPvSSw
z!CoL^8Q@a;<QtekgCpMxA)aIUg^&_#U{d@7GO-6L_XQ$n&cGmWxq<06Nb2kKh+-Bw
z#@y-U#VjiIcN>^M7cwzSf@Vsl`_N1&$-uCWxq%5Z`T1QQY8q%x_{syA%IgS~)nyG#
zHH-`l-$6Ztg-aTkKwHisX(dFjfvF56l>{}U4D2LmK-Pm2aEKnr%hj3<OrYHVy%wqv
zk^8G<8^BY(-#0*{7=MD}37n4@|B8U}5jaya{sU)9kZEgl8yG)<tUV3Y@(HX3BvsAW
z!1x*@^$c`A$-*TKjIZHxRbLwzL3iW*0Ifj-N!@`<c`a%H53BwFbyYx8*N{B|@`u+V
zknvS78yNR9GBErA&2NI#?FSnHaqK}P$AV5huLt*2^ENj?t^xzMR#z@*VB88a0JP{4
zWWZJ=1GXa>06LN#t{*hi32E(C<~J~|1?j&4_4-;Q{h<5X4}p7`mB|f^%RNBqK!ai+
zdzORMf&5Sz-oOZIul!_#8UbptK;pA$T>~R%5b7uBCNhw&c5pCEzhBDYTJPDw*bOTR
z-F7rEf>)=2%0<`42F8gX8Bj}5dv61{>jG}Z+FCR)P65ksfqKggjG#mA!M^I$Z(y7a
zj!;Nh$_Uz~26el41GtOv6Pi028^KPm2fN+Afw78_f#DZqSwjP36<7|M;6Sxwr9DWU
z#oh+S0+2e;Q86Ho6oA!15)!BeIphXXR;k>;m<duA4GoG+BxTuP=Yf@pH!voHR^I$7
zgQ`mgs{_e#9Bu&5T>k<sTm{(_0G0yJ1~fn>szJe0q0j)icj7Ck8{EU&zz8ZFK;yE%
zL4oR0-@wQQ>PLMAPg^xGvVn%lKpKx;X<+08^=<1RLp}}QrRd<$ZSZYCbP{IdHZX!u
z_5*1OzTChl0xoC4U77|)@X3B(xiT3V7(vw#!&gxThTl%$Ig|!Qbx2DcBoqps*J)t1
zgk*n^PzF?}9<&&Q5j_3#yBaD68fRcU3hvJ8%QrBBj-Uc{3_)|Z7Iz!|gNAM#4Hy{C
zSv7$29oV;@!Al++?tp4>$dbo~JMz%6Rb7LIJ6fPIS2oZzLIdcQpWmNB%|5<_hWC&`
z81SG}188U%G^@hLz;Ni83IhY{p$1T<_~XZ00II*&Dlstp@#6*6#B0H0JZuaMk)93U
z3;A{m@PL!zaVb!jlMU46Y&Zd9SN?7|39Y$7M!TsnFl=1g0GiwWQ(g}-8#JK}HG4j&
zht~pXAa0$}0GdJm0~)vESlEyc8u<aW#*bcUC<VoxBWV1rp$eR!*cccrMH;HXxdJpX
zyRfhUG#_`!je+40Xbm~X!iF?Z-)s_3MI}Q+7Dyd<z_>nXTLWl4)t}FxF|>wI(71&g
z$npx02G9WOU(g)`+@TG=ppe}OGC8uS0X%oHlY!xHBxuq*v;kBZfk)eR?`Z%H$buW-
z>yI@+M(}u2^HLZZ9KZ<&JPOwUK13UA*v@*+25s=5IRnGrJ`T{TzXolvJ2@B_8hjhH
zVe3|B<Thx7RtbQ0t^V5}1Jd-Bf#EM`?ex(r4KmW8elZ)U7uWzfcnQ?ql1r?c$H>6&
z4|D+3!X<U{BtQ*7XlwbOBWNvPJwqL+8OQJyw&GfgfnoRQx?`Z8z$7gOh9IxHV<0z7
z;wdi8WvDv=_Jt?|!#^b+(E7@{WuR2PlL3^R^yTaJLJ~NvRr${m6l%sCpjPESLr@W@
z+*H@asKUTt*jEQy7xQmPeHjCT!=1Vc!7>I0zVmgJf@};7y9Da0z+)V23=B~(>#D(Q
zkeyT6KvSl5)p86Bp!@;h)e3=m;L+LCNp*QD3=Hg6brB$M-{vVwEoP{T0mb%>G6n|U
z9d(I<P^W^9Tx2{7Sv*`8Tn8H91NEf;gGS)nnCtXG#Rh17^w~vq`ruLnv>-0EP9L-;
z8q||Kwx$j|<b6Ycryw_%q0U&Ef#H7|sEhWZ&H~(EVPjwjm|1574j?uL2KlvhHlUaV
z_53On>TJQ{Jkup=Sj6~dOY#0=12tY)7#R4^PPeIHk*q%?#m6KB+C0j_z%X^C6d#i;
zl*8I9#mA%x;&5d$Nb!Lec!Nrw|JS&R3K*pL1cX5*fs2oVy;6Lj6?FSGL5p*iN%1Ly
zTmYI_?~0S+Qv{7q6oXe$iQO?}U|?G%#ruetk%5t+OsL2yKbJv@_mKvO$Cb<=#S1z;
z8{9_EHI?Fh0-J;vx-P{Fs!<p~Rh9y`6ffw$8Zc*r{B*He7R~xKQoQ%XKQO*oz`(%3
z!Z_yyBLjnYKkrTOG}H&i)Ef*83>=JeVi*_<=SuOO1{GRgKQN|l0riO)=P)ob3T1+Z
z2c&pUyMQ>1SwWe33{t#jKs<5A%%J?z5(X*Wv#tz`j53TFLCI<93{t%3KwL$}bSVY~
zrse$857e?~N^mpt9s`Ypf=maUU%|mR$AN*Nk!w0*9gC>d6sRrjZVZf!Q((4qfOs?E
zwsg8PFfz`A+tLMcgW~jnIu^0|WGUV%Wl%Tu17pe;1_lNmu-kt@O|9}^U}XFSGqoDT
z`wus@#*=}Oi3M(IEyzwq#&l30Py8Dn1A}A^h?wHQz;NN16t4?tX6ow)#)Jb542%{a
zTUb|SGSo9vC`j?Tcp+Qks=&a=h_J>@5ycvJIR-{XNDwXOm*VvVpS{VzzyR`uq7(x|
z|2HXK@M)@`2m<xxb)^{?1+qUdCK@m>f=LDj4k_M5P6kG%f6Uqpi~^Mm3=E*vxfaX}
zi~?;83=FOe3=Ga7&SVA#(DiBzfzAxf)``>m>siF=^BEWz5*Qd5;+Pqjt!o$<81fhx
z7;+dG#G$rWfcDccCra@qaWXJ6XM>CZSy0Wuz)%U|fGhyv77zzy!88U2hADm^3qCL=
zf(D!zm~*9gZm@#P2U)g=fq`KGhy${0Eod*wYJ_beVB0FCc#}c4-2s^ivTY{=1H*O@
z2V~O`1_p*hAP&g3D+~+_m%!fnz?c}rzyKi`SdeXez`($84`$<Q1_p+g3=FV9oW8h$
zMW{XyWE{w%@1Udu;<SMduVY|fWB_p{GcYg;FfcIk!7NGvTLe0_8QCJx2{VjRP>UF~
z7#J8e5Ej*dwSfH0A;p`<$-u~R3}kdA0|TR3Jp%)y35W->)scaL(H_JB+3L^0z~~FJ
zwE=7d=oA?gTca2l7$ab|W-u@?rXg&d08S$l7#J7?q<C{U85miuK}LgYEoNX~ECg}d
z80r}q>lhdqYd}1Ztvw73j9oBWXMk;;0V*Dl0+n$N0|VnMn61kh7#No_F!({!%mYxt
z$J{E#TgnMC5@g$U1_s8hAP&fjhZq<b4}drz%Pui6)H7ay+4cf#+Y5Bt9x*U5K7iTw
zmVtp06paoH3~~FUc!i-kF^PqNf$;(;Cvw$jL&_>)F9t@g8U_X?W(Eev-xlB!O9Uj=
z$iTp4$H2g31}?YMq<BTW85p_R;F(_xR5U<x<@OXQUI}moF#UQHiz1`%^q);EeoPHI
z(><G6WTf>JKuZmzc+Eid$PESt<^~1^<_c#}NK9{NW)ah<WME*P%fP@q8|2|O1_tI8
z3=GW6K%B`849wdY7?`(!JwJV4GbB4QA7o%)-VgOG^LYja=Ccgo9KzN8fiXz}v?Y#N
zM2c6DlYx;vfti7k3uO8o1_tIEAkHcV2Ifx;49xFfNjwQ0fglo8PH3_+FtT3-*<Q)O
zz#_uHz#;_Vv@tNS$TKjo)XRc+lNlITbQu^}w80Mhz?d`#6e}PSC1bHzFfg!~K^@BC
z#=yYh0(K{;bV}L)D%+V=rFeB%85lX-K*oY>3}j$n@dt50HpVb8utb44APaLC7+A9E
zVK#07+X$+CkkdL#IRgVrDa^(u1_qV}cv?@|1J<$!lGb%Ww(bU*4YIYDfq|tP!~xkl
zgMoo%8i)h3bp-<h%QBdyCm8e?J}@So0M(F4X`N*=0|U!On63L57+Cf|ZJl1<$|9<3
z05S|@%}E9Zmg67}$eJq*3@n#G9FR3n7#LU{fvuT-uoV)`EMFKHSU$l_{m;O_@)r?$
zpsI_3*-(mCpOt};b0Nr>N(Khd=5tnF5T}iSfmMoufmH&;nasezs=>g(ss^^;17p$`
z1|~4cfD&D-#taOshF}Zp85md{85mgY5jOq+m%O%8yauccj9h#mb3r!xFfg!sfjA%=
z!x<P@LqQynjp+;wtf|m)J{fcqFaxtEQlPPxGcd5iqKdVNfq}IFUO*&A3xI74mEtvI
z1(^r3X%Yhi>jV%7WYb&*23Bx}0ok;cfq`{3)Ni2Kgb$1$l7R!+ww(+NtlPnUn{Lp~
zA|<5Cz_3?YikAh{&iV?<7dxiMw6n<7Yj8{PJO>pRH$E^XUtwTiQ~(ti{NErA1fJ(^
z42=BWpbZ3`7a-nmSObCQr8}q^fRzzEubd$@H?%5Az5)t$keLh;Qao>185p^nLEZuR
z?E(V>>p2jo9^|>(3=FI{K|GM>UNbPTzJz)12`C9CKS3+~Sbs1uuzmx3j)8%VnSlY+
zxrW*L25jpa1_qF=Z$Y;H02y7$zyP|IiVYl*Z43--(hLl2lFaoCi~^Gx7}&HK7}zvn
zw*COy`UBKjLJCqgYX$~3OPH;03=C|D+?~P#ia(|UQatZi85ns|VK#;_FtCMyI3ODn
z85r2&K^%~Ug$xXA`F;%b%+`q?7*jx#91KinkZo&ZU|_3<+1A6rz}5v%n<+A2+ipnl
zya(BK4P++Be{&cZ*k*w^AlsHRFt9BJaX_|hXJBC43iV!!3dnmPl7U649?=kCJI=ts
zb`)mgB?bnz3kVxQ%i0*2o=EY0U}a$BbqARXvhfiE1KR@-2V~=01_rj*AP&gJzYGj)
zzhO37fZ`+tWCn8K1-iVfo}CS9BfBsI1G^x?M$p^}1Jeg7o{u0KcYw^TWME*IV_;yH
z0dd+G7}zx#7}(W8oXHFf?3N4+?B*~VeZV$?%s{cxg@J+H31*=`0|UF4FSO+Pz?f11
z4wnK*VfTfTfss!aWH!jwC<X@h2oMKkYbpZ+doqXvvbC6jfxQrH>-2qHEMl_x3=Hgb
z3=HfwFk5;U7}&d@mQ4TH#Ufh22&5Ne>U0JM_NgEa$kas)4D1U)9FVCS7#P^sfld9u
zn9>7wR}aKp@OC5nZUzSSoiJNYGBB_oM+6?YvSIoo#q*PsfsvmdWGu+SD+~<mm+C=0
zkd5~l7})QEI3OF}GBB{ehL&C_8$juc8M!=R|G~h(4$E>JYzz#b6}iwXmvRE^Ku|5g
zA;t3xWFxroTgkw{A;`eM0k*!4fq_E?)G~)<ISwrb1`Z9FAJ2e|ID_U#4pRmO4r8bv
zIh+|7I2;)mz)gt{j44mRT0mukfE3RkSi_3LkAZ>12jnY|jgbrt9N{3&WCjL~bOr{F
zRA&ZtNR|UPtWrP?E94ZyQN+N&Q2@4a`l=olx%x9wJhwr`<JS+2iQp0eR6GjAK#RxQ
z-VBTaF|gwC4v3csFCOpuFfa<F!HdUx&?Xe9|D^DfkAXok3`8`VGBAi-l;XK6&d9(h
zuuurxQRKO52`Wp4it1C-8KiiwX@HvH;02#jJl8-g8E!CSF)(=FmULkIz@Pz|lAHi?
zm*8Ak24<Ut4-6WhrZ@xB3Q1R121bDw%nZync?=93-3$yIoghv%0|Uo21_q8P3@{C#
zhByP$7D;zj21Y?ikQ$JNMfD5}9H7pL4M@jY1_qAR46Gj*Gzu7)%HJ|D3hFU3W-)Uy
zzW@tPU|<xS%fKk;3>IYk4;GvP6%1!&%wppB3Kp9K70UrD6!-uZTmluWXJpJ`Gz1H+
zVPLEWn>ZP)`3pnQ2L_Ej3{1~wGx#$wczR2ME`wtD`hh{cg@J)#4=4nL_Gy3?L`#~2
z78&ehVBpxxz`(KHn1R{a<O75H0R{#L$-p9M&dtCm!~lwEHwFfd2Mi1xci0)2t%DgD
zK%+7o{~#e#|A9dr)X`*Mnj>k+%D^ZDYA=Aol9QW(fs+#yPSp$yoMH?NoFWV`Yd}eh
zK^>g5B&~TF7=_ZH)^I8_FmTGltZ`;w;B*9QV*kLP{s-)~KcE~SY0JaFC^Q?S2{Z-9
z8Nk56=>yWG#=yW?z`($n2M!(;NF)fY1BI9s1NR384HJ+Mgv;R0z_5D1qygyQt*;D>
zLZFM#J%c3;Kmh}qC6B9@G*APry99-$^H)hBu)+@v$9otUSR+7TDK4&&JpE8Vi$?tt
zNf9B?A>2x!DN;#M(7+ZG(?pX11_rS@21b#KpyLTVHb~0KGcXFrnSjRf7-Siko}_$W
zIK#uh%D^DjBMEAqi%2jtFo6yP<2=d0z<FGpf$8b44-98SK&6e?EH*}V0R~19K4u1{
zr^gu>IBzmAa9+1zV0w0<9;}FkfkA8*+fG(y2Bv3M85lTUGB9vH2XP)UFmV24VBq`?
z;=E;G;9_N9;9_QHV0!kGfq_eqfq{#koq_2&NK}D=flE%Ff$6y*h>!&lnjpfIfk6Un
z3Dc8020f_LZ5Y@-Fr2Xgoe5SWsm2L)JC`8?1DEb*Mh2#*S3WSDabaL!C}Cq{13CSe
z7X#DNhtC;7ZiY*3V)X(!7(_e-5pQ7*3uR#7@`X99hJk^r0>lA1cQyk9*HjQkmVtq5
z7Xw2**Cr58lYxQjH3I|JOAyDDfr0B60|VC&h|66VKrRP``lHGZ3?~vm*R_jYkd)+P
zU=-WH%)s=hje&t%kb!}lU7UgG(V`CwCkjC6TuhyfDU6kYQLF}}W&;BQcP;}1cO*Ll
z)1$o%4BR&v7`XScGt@IZI>o>Mx;28w2_$u$fq|!$fq|zI#CgKNz;lLyf#(Q_^O1pp
zSD1l;m)Dhn>CwLr3@1RHa|s4UQIOvrGcz#o>N7C#>M}?(Fg<trz;LpKfeB19Fl4YX
zIdL*DiaugyV0s?Jz`$$8z`$z(@@X7HJp->R0|T!!h?m8{z#GEAz#9bOlrb>yCNnVb
zCW1Ik3=F&_3=F(EAWk0x1MegT2HpuEs~$IgU^w-Ffe}nHFvPGiG4e7nirF$VFg@;P
zVBnq0z`#43oq_4`90ms74Gavt>y#Oo9<OAY$ie-A;j{rmJ+n$6s05nG!N{1&Jkf-W
zkuie_RDZcLFg+Ihz;GHggc!iUD3%E_M2LZbcRvFI?@ka$o`He)4Fd!3Gf?_EWx~Mp
zc$>rrhSLoUj4>-2ycw7tO$Nsn1A~Av1Jk1^5GzmQFre62k7OmdyfFE|a2#A-fJg=w
zNeLbXMzN=$^1_XQfsc)WfsYAPTm&;P@ToB{@ToB9F)&-Re_%KP8V~}L3@nn8q96^D
z3=DjR3=DkwAPpeJjtmTZ_6(rvCFh$)GusD-oD41o1}1QcAXzm1&14o?QP7z9JO&27
zIqD1y+fy{!q!<__i>Av>VUetF$V<-8VbEv??F$2+x*66Y%fKjk-~&T$1gHnh@kwJ2
zF9V~5F*5_B<V^+!zC#QQe4w!p$&WCO7Xzc@S&;No1_r)!3=Di{K%Bn}416H<*O?g@
zL6^etfn*<pIHC*;e7_hN_`WbRFxE>c!ql-dFiPn%Fz~A}Fz_qYd|=4k!pN8fKGraS
zkuj60n1PWo1H=uR!pNA;1iG>h=1@>Ggn^S$V-d)qw?UTQWMJU8Wnkb34HkhM3gI9-
zl;4wqf!`g}xRLzJz`!5Qz`!32avUcE1AjRK1Ai%qBg(+Q-@(AZ-v;6+GBEJZU|`^%
z26N~#1_u5`H6IxAScq__RO|<ayckf3atdf{WMyEKO!8u2l&a4H8C}M}z`vJ)fgjZ0
zmug~Q;6KN}z<&xP)5pNT|AK*m{~5?qknLX?82CSeI7=891b7%21h_yh*a34v1tVi7
zD3G)>V4<~vkue=CGJye9<>YxVFp7&qs~kRtdImXLD+Y!Yg&IX{j0}vDb9syMa~U*>
zKo<al*3;Eb)F|O*V3gd=01EK0AeISeY#2oRHvtU<gIJ0Td?3As3=DhqG@?Nx|58>E
zgQ9gn<Nh2B4BFo`ASaK2*nc#lL2aO~91Qgg9JLxTpkZN99mmn45d&M|)!?fU3lpD_
zs}Tzt5eBK@)zgRri?e}kOW<Z;l!}14PAb9#)c*w$zfBkz1sLG2ld>{oU^r%@;Q@Bt
zMu_V?H0wdm<1NZBXVCC~txYrM(eMDff;X8#!^4k(f$<F+1H-0?8eSl~&VvqcNYU^I
z=OMVg=S@HZbs(Y<M6@C7-B`iE5b7_%Gfm(FBdY)dgOm)YuGWiE$YhY<nE|>Lmcf{T
zK|r5@K|oZBf#Ljd37#3C%m@;k%D^BnQHp`#qK^d6OwdR`F$06Zb_NE4%~A{u3R@(2
zW`ZUnK!Rr(7z99brhTg<cxHn3Mt}sLFfa%_QYbDdVvyjO1->eWfkEIm1B1X@DF%jS
zFA1JGT%eKLrwj~&<_rviy4j$U%NQ8-z`2h9gD3-|^lGk@)G`JM-aZM?X}w(F+ZcHJ
zL90EB8C*UvN|u0+V_}qjD8<0Ann{9B4kE=Mn8?5&7|;EIQL=)8S-TIKJXt4zJ5~l4
zJ}|PjfJSy%>p?9+2ML~qtPG4YT<i>t2KN{k1alY|1hYWne+h;k7}*>^D%n5@Mnr<=
z1W2LIJVpk_1Urz5=%x>hoGBm`oS-(eiUe;2NJTy~17mbQ1A|~C1A`zaFGtT|U=ZwM
zU=ZwKXJCw8$-p2ulYv2SdOc{KAZ*qLM!_YZR*md^3Eu6T42*K?*clkZRxmIKg76|+
z2F9@K3=DFN42*L5AelQ141y;a7zB@lI4>C(1g|qN2wnzpzA-Qef&`w6Gcbnde_#|b
z0X3-P<Rq9tJycl{W(LOa8U_YX>rIG}nW3IBypw@JNQ!|$NR0afqlg8pCaGj#WXxnV
z0M}dr3=H!b85pDF85rc8nQrnkFv=EqF)&6MvNJG7*)cE(SurpOnSnT73=Bd(3=BeE
z-VBUUp&uB9LA_8NkW3f@gHSjFgHR~<2S(v33{0oBL4|51X!-&a1mQLx7)3y1<P36w
z5=>t?85m_jUCnS$1_q%d1_mL}IBht{j9dl=A<!gBcp?LXPz3{nP#Nn7Mv*xnXEQL$
zo&i<6b#SLM+Ax4TwSj>#`~^s+2{H~GKJ^2m$PrL@%he}KFnt3BxF;xJ7BMggH8U^>
zHG(+n85o567#M_lKo*>VSRkhhG6p$p6u>sz0ZD_U7(w3R_|M3g0os7f`hk)24JZLJ
zFv_Ju5+URF8=#PNVUYO1D4bExz;sEJ!IgnAoaF<fC}>!Rg@IA7kDY-r9JJ$jHUopu
zbdU{#Tc9?8iqb?2kO`o;Vdi2oU|`5+V2t_yfsxAxlnlARgBTLLg`D{ej1j3H7`ZaQ
z!Wp2Rf&_0RXtl`y><^4w4WLPedbuJA-YQN8Muil128REj0NusFAhZs|nZ&>#9L2yO
z>;vM=XJ8Os!oVOr4a8Z)z##mJfkF5lh_jP{LBySbLBtR=L;t_km4V^^kq?Yqpzb{n
z1EYK-NX<zG29bFT3?g$tb7}vtePHAU?I<|Fz*sMTTA6|2|8=H`93XX17#Ku0FffR$
z0dYPuFo>LIU=TUX`hk(#gMrz+oPkk(0VtGf85lrf5e&>ld<=~8yFg*y1gf8zYC)9@
zBlilB3@Gi^LSh`GoaY0`!*Xp>d~vJ{j0)bMMRvmV3=E>G3=E=*><o+y3JeUQ?hFi~
zjv$UU1A}Nf1A}NXh-1OPAlk^lAX*9HxH2$^E@5C0T>#<)F))Z;U|<m41LDLpFo@|h
zFo>ywI9Ut~VwnsKV)3B(<C?+1?9%}1zdE?8I599zKg(zUDvRnFCCfiB^88_729pd7
zAridRpy)UPYDTm$Fo;cNU=W+g&cG-+fq_A6DFcJp!kQ0^ye^Q$#H4)&R^c|lD%>4N
z6|Oh~W9Y39jJ!EuuWys!?ErcGB|8IS=o<zGu>%bC3}U-L`7c!P10!z-Sk(~;-cD8q
zM#U4%42+@j3=Coq85qQFgR}&J28<XO#D0M|@eB;&3JeV5QXmd!zSEU~K^zovp_L2_
z;t324;$a|}76u0KP6h_?b`YnZfkAvW1B3WvTL#9^l?)7Wcj_4!70W<Us~8x>4>K@`
z?*~N{?*<0O&|eIUiam^sSu7<D4;aCsH=v@6Afg8tK_M#;0?ipb#r4K2#q~1ADisV$
zunfY)VF4+;LZ&b<$i3n1W@TVhVq|Av3|Yp&Aby9To<aNyh_{)60d!V|_+Job9|MDg
zBm;wlASh%U7Jgt9bODFVFA3hQybO#=Ti6*G9o922NZ2wkNSJ~+dl(ob3K<wAK#9fS
zI0J*kRt5%%^&pum3=9$v85ksPf;bNu7$iaGz%YO~?-&>)P3jpKB#mqt7#+D77~};Q
z7?m2?85kY;85ks;7#Jk&7(i083=Hxz42()s<QW(pl|X(LOo93tR2qbV%M(axz}Nta
zB1VJW4~&8@Kn0w<h6L{}P6kHhtDw4VHUooX0_db)5N8DggJdbl{z4FMD+7b%ECvS2
zE)eGs1A`>Ut+!b}Fp4TLFy0qtU{n?XrCu&}aMlwwVPFoZXJAw|1_iVUsI)V7VqiL+
zz-R!9DNzSd0nfmw>;{r{01HJxg(5*hE?}Vo2B!Mc+6;`!IS8>92F5#Q85osYLHQii
z=FVh<D4qe;KLex|V&nz}#=Dak7?syR)Pl`C0#&vjqKx|kqv#Egkq{*iK?YEtR`3Jp
zx|(`s1_pTt3EsV|42;UZ<r$bB$w_=*6#T)!93KpdeS`21j6xis-m$!&1n&`621b<>
zPza?mFo3RLmHY$Z6frPJ$ulrWNrE`_3=C3^3=C4%tREPKcpzb?;s*{pMsVRIBm;6b
z)IIf#nT!tL5*$=i3k86RYM}s7GhKrB1e-VmlU(EnMzJ5D<R>2^!3!EqSNXuqz$BN(
zz#tXNz#tU~;uJG5NYyehNP#-oat#a&Qu7%Yq-NSOFv;~YFv#aKFsfW(XJC?>#K0i6
zhk-$A2dF10x8MV#_y$n@%L0;H%D^CXi-AGv8aM$(TYX>@2d^cNua@Bb#LB>^Dhg`R
z_%JX?eP&>gdJ760u%Ztjx5`h3Dzbtql9pp&kd^=`GI;ZWQSu1b{YxbHG&va<H9@mF
z2LBisq}>@9>ZKi-85j+@85pF?7#O4rKpY7M2I<8N4AS%285j*!85pGZGB8MQ1#yfR
z7^LqoFi775acmhFq~9<wNIz3%U^Mh%o_GV4s|>>#7-YB@7-ZN$N>UgYWRw^fWaL1c
zLIwsID+UG`P(#JAj)6fYgn>b(-VY?z&A=d2!oVPtBhJ7i>-2$95<HnF|5JjyM2LY=
zU5A;0NfxAf1_Oi46m|wC*+d2gnT-q#GAluxJO&1t2Mi1{=WH36WUCn%6l53})j$Iu
zvJDIjvI-0gvN8-HsXhh<1#JdKwK>WROtO=iCUUTTV62x)fHV)(vOy`L2AsR3Dj1lR
zlo%M*z?lFvijcv?;S0+6QXL@GAeFVCMh+8bxCCVMaRvqjI|fFz?I8D@VPKH8VqlOp
z0o!_ufkDBGfl=)eNa{WV1IX>N@eHmEOtK3>_Jdkz91M(VA3^fV7#L(L85m@X!SZiE
zFiL|O*enc;>H;9?PYevQQyCa!CxR1@+6P8yP?HUuezX}FWY;h-$gY4Cw}y)t7!)G7
zD>xY#H4cM<cmo52>|q85+5Mo{+6%7k84XV{)HBFFW?+y7HC+v_GBC&~Gcd?0HZn3W
z8a@J(uf!P`jXXXuO1%LcbgWP<!L829z^J}}`varY7erWq5-pS5i4Tl2;Jerrx+J*6
zxEL5UL_xXZ76XHvAp?V)E{OA-fkDonfkDn2l<2>J`k%=R407?d3{0SHKMFG$7}bBW
zGcd`sF)+xLGcd>%gS;v)@_|tXe5VjdN|J#=ZZZRdTt7Inq!~cYU|`hH1VsyIvho9?
zG!FxFeh~wsh7(8(6oHwH?x5mHT7-eo|1$%lMku5QEK&b~Q91xLxWoE^QThqgq#}^6
zYOv`tOQ2$HAhA-2*afKAERYx^$;do_+PE1c2C>l)lwxFFfNX@=26BO{161=Za0{aT
z0~1FBSUiA%>BnsbMveENqH5v|uuZZx5J64Q2m>gGfmQB+3Q8iYyaF*+(*SJj2PTdM
zV6_hzm}dJiFlxFYsg-kp8W6?E=$8dER;~dmnh#UT{ee+#4aiuik(>&ku}em_6%33k
z4oiGsWZS^Nq$<VwfsyS91Cuc;1Ec1F>2sH{DAhlJavwuAGPp3ZrB7zbn9Ra#utEpa
z@MZ@`8tVr}b{+=izybzFEiRba4NeS9#xEfC7`qAsvnme*qn0`-RKc|o=>CfT7eIbv
zw}DE6+G610A@Ilt!;yNh4G|!hOMGBtPhen-<po*w0g|h=Dxg;R7J%BVAX76K!4(<@
z3&i1CbD=62e!v{g%EidALI-3mhYC~?Y<P-M04(glz^Iqcz^HYBu^uvP#i#?S?Ladl
zj2tOYJ<p*AL+VtH8i*ckW|(jUNDH_M=a>Tt7;QzETn19WaBP71UE2;hV3-(7Ku)RW
zI0Kc9MwP7r$#T4aT3QY>xC3q}CkIpx)?sIy0@A{%19c0iq6am37#AS9h0_5NuG%M{
z2G;w6+QN_^<xBwe1Q-~#L1}@R3pAyc!Bh-RN4z<pnIVY}jC=v0i8R&^jC?VW2Br=-
zsDbI=t|AYzoi76_ssu8>grS&02`pR!6}Dky%;G3!C}B`iZeRjMeZ9Z|21fVwpmqcY
z1LOJ|Ach75V;dug@dsp=1f)^H_6XEQs9<2!cVl4G=>?^GF6IT$2EEP<Q2&J^0c4lZ
z1gIKN%a@sp1)MpBR)A6%1EbDPkh_>aF#b9LR(qr#Dt;d#&cp;7hGybWfOZgk!TDVX
zT8QX;gQ)_?oe;DP(&dE;GpB$I6|;djK-Un>kroI?iWNZY)vfmiMSBUjKUQ21)()<=
z7#MYvpr*3;fQ7*&I0K{Z5}0rR)bqXtj7)t#AU8Ahd4OV^<qRWJp9?7S{r<wp+_$G5
z61@@;42<Es85ni9gVGQ<txII6Ld8ylvR55AtR&_@+@{9_v+2t8_p4as>Ol*6J}^qW
zfp||(4dT5EP-kf00C^8$ge17gU|`g<g&M&c0E%qMH4F@=ML|W?2apv|IZhw&p;C-*
zK%-gUwd0};`V5SEQ85e*)vF|Ux<Jd)i$5^bCxFI|eLy2}`jXlV47+|x@N}7ikLqTS
zTgAX2w@jOXVR@1SPnRbH14A(bgWPcj2D!t~F|{7(n3~)p1_rqYn;97x^(8+rB!Jek
z$Vl+?2{16~{bFWd)YoQUko(BMAorS`ff01zkUSp)gFFXlG`2qB1}JMWGG=iuW?m|#
zv%+`<11xJX_%JZAa7yriF9t0J8SW+o8Oy7eVPH_^2Okk6!P5vC7j$4?h`1ub69?+o
zfBnE<1{!Xd1M-)Fg*Ir5v;<F_B?F^@1p@<UL#@2JHUmRPy+l1vydndmfh_}rd^`h#
ze7H6P!^SQNo&<1^F)+yYFfhosD1e6md6GakRq-=0$Zum{kl&&J9tz}1hS<&^e~^Je
ze!mn0!=7RZo)qvEtPBkDXBimePs>0?6%B&GF8sh?*2BOU7Q_01!R!bFJ9q%WKy<pm
zS{8AEJD{=xl$%Q!m_IN@#Y{I}%c58x1a^!dDE<tbOc@wVSR{B{K%=+@y<Fg{TY20h
z7#IXW+hzEQBzWAx&SYU=;QA-Q;{lo*zQJJ1z~JL0!6OXTbpfhN6j_%TvMzD3r&t&m
z78pwK)Jt%IF5v~4;rT;?`zP3pH!KVc9NrS#zriXQR2dl7IZ1FsuI2_co@Q`@2W`1C
zbQl;7K^%oG65JWCP)@U#1a~IrcIl_!4ZRZF*&t_v_Www5XM?xJvoJ6m_$I-fBh0{9
zZ#WmUn7=}TJ6DW>K{=R(fnlwm1otA)z5-(w28Q0l65NYnoI_J3xR-!AT%c_h65OXD
zoPuHo3GUM}42*_zLCYB!ib1v*n=&wn&6D6(0C~yqGYbR5{6YzCC9qpq7#Qm3N^mQ4
zG1M~}e&$MMkl<DUr*;+wh9lD@xK+T;k7i)V{w%?*7R|s=93a813Er>ql!4KR860Qg
zpn&mYk>Gm82THJvpr)iyNks{R1lKEhkO(IOgMgL<*DLUH36LdRZ@_^KKK)FB>n+GB
z^<NoIGBPm8-Qv0$!@#gvO@gZeG$mgAfsxUJfr0r1D2<z(vM9*RWsu;iuwh^{ImN&r
ze}{oV{u(5Wa#cacq(KK9%7YH=*{m$VRR!9MQOv-gAi=<(Afk|5P|6^|RSjAL`;~z~
zL63n!K}(?$Bm^Fz2Z=>8Feo@G6fj6|)kuIMl7T^C2Lpq`1}O&6_1|2z3J|Lm9y2f~
z+>`>}1I|?k5<Jhqpy<uOpy)2ez>s@Mf(vwgLwE-RgJK;6gJKzE(4FBE_;ND=jsQ?=
zoPp6eP$9X9L4vE1AJjuEW?)d<%)p?y9#m>GPGDe+^=Du-1`TL3fmSJgU}S`r<i-;r
z1t4sY6I$g6a4<5aGjnnEfJ#gz255tbi3e0-GB6r%gld9RU`!fN;d5Z&`VWl%R)9)!
zNaL5O0V?|%Ec=1+-vf|jMFq%dOwiV{@qbVa1Sz+fc0e?kh(R?#Y+;sx3WFM~Oby`P
zR2A3|W*evsxLpUWA((xjf}kc1s2YNr0<D8hKuva#@P8GMJD8!tVbTe;^S=+s=PY0k
zvwmP?xdAn8B}^V%C$mDU7?T4q;S~&^9s(;5sD}W`IN_j6z$1iW7#NZ`B{<K5YLTxW
z7(Q=dVBnnsN{9}e7Kuga3=*7Y^&v?_@g4(%;xTOo27gNl&a+OCN<=A(fk7!rih&_B
zO@i}0qzGY9I?BMHG#j+l?Slm81*o8M2SYuBauXztFgi$rs$u~XX$D63{tpbF-!L$O
zNd^W93C_!$42-7L%nXd~3mF)cmoYFXF9OYvfE0eI0j*U5kqi<NTsf=^jHXLq3imKD
zDDMC%bddYN@O2Hy#II`@7#JKRxI9G|7)_spmY+EoFfb@zU|>)_2O2oDWnfUg&A^}x
z9#ZpSU{HR^z@YpTG}z$o{DI-?8_>9y%nAw4dm;>sW+@<xLKzs8|1mHqg9a|$lNcCO
zBpDb~_}Lj4-SZh3RGb(XRO~>U8U_ZHa0UjIVAc-|-$Ec!WL6&njf_7npf(9x2?N*v
z|5BjJ^IHRC6fP4qlq=4_=yvi0!?y*Xp$?g?5}Xf37#Ph(nHd<}ZZj~b<S;O(WUw<Z
zy1igvP-$dfP^krRzA`YVOl4qD0gdmvGchoztYBbJSq5?nKLdlxb_NEOjqLRdjG&CG
za*lyP<qSwloq<8+E(3$gbyo&Pcaskc-$2_lSQr@1zJg>;85mUA85mSqK??}Jy#Zxa
z?hg##Gayx4CKIGt2AWI-xj5hh!*}qgugq}?&L<!j?*zFxiGe{?gn>a-05n7Hme0Td
zI&WB29pvO11_sp#1_spt5T}!YLA9TOK@~JC?lz5qLG>L2gX#m2%wh%xHGKvKHEj@Q
z0|SGa4+8^eOoY*GF9U<x3<d_ZX{;X@ei$$?tA1r*G+zPAuO*=2F@_&5pyoU%PlJXY
z#2M-top?Sl{09$4$vlwY5*J}$v;ZyJc9LUYP+P*lptgvefze5ufkAB}1B2RH5XXXn
zLG3sLgW6%p%m_#~8`um61`Y|1*<2DI82(RSV2t?=N;GaP9~gc>qV2N;=W~$pxu8H0
zV_;Bwz`#(i1{!U0Q)XaL=VxG0=LC7kfPq2Xh=D;}55%!$U{Lp9U{H6F_`vXE4+Fz#
zcaW(L5g!;C3P6cLmPLZg31sR8W(G!wECvR35C$a%hjIq+QZ)4vP_k}eU{K%9z@WZU
z;se7^8Blz2e_&*oQ4dLES>Tw1&B#H9d0nS|VE74|;AW83mf(CP!oX+=T6F5VoPk08
zBm;x`QFaDK*DVYT>bDsf)Iqt$^&kU-`f~;b^`{`2a|{gXUl|zGLDTuJw;32fhjMAK
zx-u}je*M7k6TJGCfzh(w9i;Xf1A~Sv1A~SnDB=Hf03|DElz}|!wCw}K-x;8MCu=Uj
zB?xlJNoEE{rxOee8u|<j8oHoJxyrzxVavdvVF}_qVqnk+VPMbz4Zk_PXJF9CXJF9C
zX8pkM6WWWg+z-um^@#a0hMzT{ssmJ7xcYry_}K$m4fGQ<faM{<`BsF1(Mq40fzdUA
zfk9(B1B1q7ki&Bs7&NvpFlcN5ajF;?G)^)wXn+Hzoq<8)4g-V6E$$BtKNrA48QdKQ
zjfsH#<#P1{L;cSyV2_1JaDEVBV6;wTW?*!A&cLAYnt?&%IXeTR%NGU)O)drojej63
z7#SEetr!?IL8FYWd<+bl!3+$Vz91QC1_sSs1_sS+5J!W7L9>d1K@&9h;cCjjpgDno
zK@&7J?CQk8pt+2JL34>X17k=4$o?<jRFo;f&LPaeXa#D~ha@pDXl`R*&;<D^B%gsn
z^C|;_=2_6(MGXUk=1&F&&CeiCI|GB3AOnLIKgcuDO&=J3T>uT&%9cv7tMf82T3dpK
zYx@}(v}73=w4_0tISdS18Vn3tYS39~Ezk^wmJw+E;IAp5G|9kd?Z?QN!3??<Q{n@|
zuM;3ai4Tm779a-59+%l47=DA-=*c!paDE1b8EBod%UT8oEqewAEn85S?P6fi3SeN+
z@&Iv;Gcai7F)(Q5fVC%nVE8=&9OS(coZm$185pf!fWo|(fkCU5fkCSrq@{s@L2D)h
zgBB=`U3wW9w6-!ZXsws{!0<-^)b|D(r2c{7j|AADxe}Z|MHm=uKpSUVEEyQI&M`1(
zodTKT#=xNUlz~C(K8O>{z@YV?fkErH#0Q4oH$eX3{=iWGX9_fJfGWR;7*IzOGTFk!
z0Gh#LbbkAR;m-n4Qv9=kfq@}Fg7Xi^u1U-cjL!cV7_<c$7_>okjSCM01L&$*ZP1LF
zizEYswjl$9wmv8|JFob_@aF^A2+(+Xj06{x2m_-nXy1r){VoOuZ5sv#Z7X&LM(2wR
z4BGAt4BD=)42;hAJ}~?R9X86sz-R+npyPa>fk8W%fk8VEw2G~4;s=JmCZG!SFX++@
z4hi;yybO%C3d{^lW%C#qwBr~Uv}3qGF#NS(U@E%@?)Wl(0ga3>{8a(vZ`KbCe+?Lz
z>$UqB7;PP(x$(~iP`&ck1$2uQ*yYt982*A5&x1$?1|JD74v@=1Czv?*GB9Z8FfeFm
zfgC=IfkC^RfkC?z6g5t69~l10fRpu32`&*421dJHP<au-z@Xj2z@Xg#Dk4%D7_{dy
zFw|>L1@Vd)7_<*EFlg@vaq1ZuwC^!6Xx{*FdKehALE-#enSs%1CeuWYN(M$J&_MPv
zknC~>1|1m&1|2EZ4-Ef87?^$R85r$^oER8`H!&K3s59W9K8Ak<pjc*Lv@-&gYh~c}
zAh@p71r-J$&3mAl{Xn|VG{1pr&YeDCH;ZWfe-_Y+1MUwD{}mV*gFk^PGtiK11|w)G
zwlo8y<CYH$|K~6;gGmMk3kfbQP#An>W?*zY#=xMX&cL7pnnQNH%)p>y#K53q0Gbti
zz`&s6z`&qm1LC}8V9*I>V9*H!aegu|=)^NH=){65whavRjKQBkk>l9@f#E;6k@g=n
zCLkigWhBDDXs-#fW+nrJP8I`$4yYb-T*knlQ_8@gQw-J>^?{LrgMkrDf+nQ7tU$Ul
zK)P}m7<3vL7<B4EwpKDQ==3o#=yXYZU}UfXb*e$d#1{z$6~?Gk21ffDNJxSOp`*_B
zyI|>vV|vFP7VY{k(CH8Ri!g~0u=)*<)|WkK*#@Xx{pSu?7&>TW4{G0og#Vg=+SMS}
z#;jz3oSDVwAPMgL34l864xFkC3`<T)aDr|hWcbR+z~~Sm1Zg2#X)-Vx*3V#JU^w(a
zf)l)>9kidECs~5iRs`I5R%Ku?PL<#k0}p9{v@V2d6$5F7>68FBl|ctMCQEQif^|Zg
z%M723K_!NO2&n7s-6X;B4b;zdbbxgKIevh;|MgB>1q>1#Kf#-pSr`~v5+pc4H;gfW
z4ouv5N`m7TsQ(P&q&%14_yt;61>($$mEibgz`(#T31StaV*to1{v)CcjE=IPV*po3
za5AtmFgk`ZfP@TCg+QnH=z>+$gO$KS&M^QSa>AgHb9CSXUF4<;+5#uR0lLZ%9DI)L
zkTBr5tOp7sNa%4~1&0Bsw{1}(!2!At5u$htRPkXYB*jPJijN7_OK_}%1+No3RP{P_
zB-I<hs#zEqCYMTZY?NVObYka90fpHn@E{Llc^JoL@bC$!hZHtnm4P94l>`UqdPlG;
zoZO)1PSZj%7jzsZLvcMM-Z*B0;|=72R0|0Xces<bLAAOgYXx6M1WhX(USOS|o3@H2
zIJ}YF<O6mS3j>3emjs6|*c$>+=QhcJR<kiMsMa$ugnX0W(1cm&%mcMh6EsZ*O=2A2
zgEU|k>cA{ash8l;1se-Z1kN&`L?EC7i%w@5aCCxh2WNEV0gVwQO0a)`TNN#oSX7_R
zAi@3t$u9O!U=tz1!Vapu4QGIYrJzBA9ejcrC=WSTLtM#z53Ca;AJZ+teiCl<3aI=^
za7KX)GO>eBV`BIUQk<D2!4A4jli_PUBLk!JTd3+SDxmlQ-JJ-z0TGh8*tdgSB)|n4
zk6_=g1?j@7GBBJElVG0?v(iN!YRGi3l~ApaHH$0^44X_O*k^&w0oflmS%SSBtP^Cv
zOCnTjIkMJDuxe;HRDr`Bq%~^31bY}*D<cD=%WSC5Fg1|Np_WD<>x_i!?5dYww}I=t
z3ej25ZUYWNs8%~<t@d!Ovveice!{f6`a!g^{R9UWL?;_$AQ0kQHc<P+a0X<tBpc|o
zTLw_#sb4I?25v4CLsB8zKM{s{hCTd{p+q*&Ew1Z@L4#oI3?d8+NgN>Wn#`48dj_|8
zD%9p@NZw_8f#hbkmtZ%uFfgRlOR&8H%Yclzm?Xh=5oU}V3)Gm4%AmnLXd-933|0;G
z!4<GMP#-`_7p_bO2{!QE*k4i8yAC92u-yV1zyPvOTS0<t3fw+#sC`pZ5wXNJ4XhfP
z|JkO4?PFnJ*p@B9HbaJi(ajrFm;|3uWngfLmtfO?8+H<Em<HG|PVm4An+B+}1PbHY
zRT6BV7Plzq2&6+FB-oI%E*m`S29-*%=?a7DAJEupN4*4_9@qh3Kk9=<9l`m;#Y%$p
zJIrQxXNb+LpmvTSG}Kssg1rF=HP&AcL%<{BtdJA|GLiKU*hKJog%YfPK{X0!;P!Z%
z1Z(|Y&{(E1Gz9s<hJizH!hH$WD{!m3pjKZ&Dw$cYfmK7Tz7DpUg@K_}OM>+V4+Eon
z7bpN3E~+vx%(RhUT_^&Y)L;a)&4uzxa~UL97lN+)sV`=TWnhp!F2UNz`+-3n6pY}>
z5cg-?9~jhOE4x6&S`=EtJBEQlXRQQlDQpM~v<=e*Gz8{R02u;fEj0!YH#6ugW?;~n
z4;k2EEeAWAfk9^<1B1>UDIEp|o@5Eu3Q%0kWnj=b$-tm<9Gbi!%a8>;xIZv_?qOi`
zubF=S7>j7V2LnS40|OtU1S{ywQqXR)PoR|n8$fn@)<EqJH-XxHi-AGs5@Z~hH4<vK
zE~qwUf;uP)CMd|jpvx--aZfbVJ-TWP47y5?`483@aD7tGz@Tf(z@Tdmb){zyD0Bo8
zTs|;-2K5Da7#Ka(q!<|Ndn8!XpyR~4VGInqL7)cIr#B#vFfe+8_S_-ntOY=`j0~T?
zfZK44p5VQA;Nez=&nyg#k+KYop5Wyvr3?)9px`iIV2t<zYTbdxk)X{k&mM4XBL-?b
zc-F))Fl1hlU=4sq&!;&I3=AsZAo>Umq5v~U5P?>G>!w3}<HZQ}O$GM{hEHoiPGv-%
znF7tqO@DBVg(aZ^KE39}2)0%NZ0*Mw28Ibd60BY@Yb#*ZdZj_F^@64f-3|r@-4>{|
z(5RjQvbF<cEhMU^fTNmOK!Q~cYT!o$1_nkCkUzZ7Lk*OJMz!ur1_s@Q(5O~`#p-1S
z2HlI$sD_+b#K55Yh=D=(4m7Hjz!`^uLH9ocgYIu=R4c=xT2GvTK~E6sN@!HCVg11H
zF$UyH21aktpf(e@w*n5hHK0iTm;#AMZ!J(1l`w$CN+9v*4W6)viY)*|BLky%5R$qL
z42%);7#O|N7#Zt9V@_brcc6k*ND9Az`o|26-qS#_!u)~B*8{W)&;z9Y6X-ydFAR*{
zs}Slx=|C;p2NeT_wF}5xC?Axof)gZII-x=Rc0oM@12cG=s((5ptXVpZAZbR=k%2)^
z7ZTPi-O#Ys+s444w+<54EIly6+YAhP*CAoe(hJR2dLJ1W^xi_knxzjM)(i~#ybKKb
z%nG1uMI~7JK_w>WMn8RX1_pg&g`Ctp1__pa(5%&01_pg!1_pgkg=7W^mI>fVDFz1p
zTm}aHcqs-3{t5{e(B0e0!3+%g>lqmI=R#x8zZ@JxHv$+KWC|G=eYZ<7FdSf#U^xLg
zDXN%(!N8M&!N66Dfx(7Fg5@MgupT6u!oXk<1JcvL!05{_#lXP9Bf)Y8bhr^nb`ArB
z!7Pan4DZ)4Fc(QMfYkLcF#67vVqj=rC&BUxrfwwzgTYcM28OMs5-hJ(z_mMr!5#(%
zgI%DDjb-LYfp#iLu)G6Z&H*y_Gy{Xd(RwKchN=H0Sl+`#-!L#3ypjU#>6Bpk3lsdq
zz+mu;`vb#=2cY#kpvaua!2nKk?~i~)7#MxmLPbFieE@c-Gy`LV>j#GSppz58B!i3u
z%L+XPM&Iwu42%)s3=D?s4D}3#tdKSA44_ew4`7mkL4qk!6_m=}UVtQXKhSCorV6l?
zZ^4uB42*u}(C#F3@DMf+bpt#P#WD>vi1GFhXfToW1H(HWNYeBR0l5=W?!A*?V5|>+
z!NBO30TP6m{>}uF>-@m$@<1bn;1xdtH$cvL7XdY8CP)L+6zIAKKX3>@a^1T*P<029
z)U5%H7cemTT?L6jEjv)pz!*`?!07i9N$>&#qtJ5(M!&xxF{puGAX(dA5F`e%_&v1P
z_E$xSeE{XQFAR+SmPld|42*$K85sS2L1K^r_>U?eUotXg)gx69H{b=Xe>u3o6#*5v
z{^@oM44#uESQ^+E82y((S_v!-pxz$nez2ed36=(9P{j{wl<9j*uoUou=CT<X82#@-
znj<Vlpq%y<)a+y_2G701vdcTxMCK1n{4-#^8UJ@+d-=fj-m73>NGO(I$zc1ya169-
z!T?kz2l!Zk@??e-$PxwyLkR{3Ljl$g497GW7z2D57z03aeT=pYo*x*FS%8G57oK4e
zuiq@e63_dA;V5Xw0=R4sxC1sP9&`fLQw9b@dj<wWYjH@DJ$eE(qA0pjf+dlYfiYkc
zEV)K8Fc?NaQ|r+Op!qHk$-n|mtuGiqFdSn5ZG2;347kL|n8gcOZDF;7!9%6qLk+Z1
z{TL4eW569ybLi-12^KSugFx*s@GkYhr(g$}sX#qe$iQHjDh0apT!O^{bg)(x1B2l<
z1_r}b&_c}xTBsSmXJ9aVjkE&d=;i<h2GLmzjDal*ImJZ`5-eem`_vd1Ku5M4{%8Hb
zaC8O(v+XGc#=rv5px{IfHc)^aJ;1<h`;w6{leLe7%~S?7^2ux$_krOk=oB>&37T4A
zvE^i73|!01z-*Vzz+l9~z+l7$${R-`K*L}RjDev2In0nXPT;*oj0T_yPKKj7psdLK
zf#GNiC=eJKvlwj|7#tWFdR9xY$b#a%_yfZ+(0<Stpm+{m01ggWUC<mp1A~z~1A~#M
zHh3<dMb-||K{WDbU@!troN=~Gu*gHh$f%xy!KhpTbdIG23#^W=H`>I&V6+Nat|>w*
z4x<MQ3`SR=i4i*SdBo)d!!b}x#)N?}=n*uiRlqyb7#NHN85oRtL8)y4q+ALDtyTlA
zH3NwqfQ)Aa-M}oD>X|<<2^@hGOsb%Q>DU=iXn+cH(IX6u!4senr3Fe3lNcC4*BTou
zN;5E3x_@9e&H)<W1zkqMz$3w8z{|iGoW;z*R2j~|V64Z$V63CZz*Lz6R>uq`85mf&
zO@;IrnC&^heAW;3AVWaHdOY3?%=VICVeoNQ%=S{C=>m}ZUqF&XFzB=e=7~IPplP6E
ze?Wquf}@xLJau=hg@LIIv|f<W1>A|)A|}DYC=MFxU<AcKCj-L;c?lLqdr%B<GB9ZQ
zNw6?RFw`?J7;`c(MB7QQFeZb}t$=h-S(w3T7}SAbVF4Esph9GshXnH@n2{j?oD2+;
zzezAZ@?c<CFAFh}`7vzGOTUi<^JDNWq!1ICpTbRK2HnNV@RcjCh(V&B8PdZA8Q)kS
z!F(KU{1hQ@SBm*K=ss6yubKHI!Vu6g$WTL=Pk~|w+-p00TY`BZ+>A3&yB8z0Edl!m
zG%(~R!MubAw7>$aQA<dIxf5&*BLib7=qeO_CJE+F3#i{f9_@m0Kz{26pECjqAm(1M
zk)VOb=@JsmuDl=vK&L_*U6NpS1q~D$%P}w*oRna8*JfZ0-3e-mXf?<&FqkfoV6OL2
zW?&3G2@=z209_>?E5YmuaV^CAUf?Xj!oYCmjRdn7sFP6)w$vMJDQEzb*&FO^t`Y_b
zW^Zu&4VrNv4Qu`z0+6meb0Ksoj35I;SQ^MyG0<rV#{3K$7#SG+RYALzK)KzR9~2pe
zb`s3+k+INU(16qiI}KD$rkP1Fi}8M7P}{-4z|a6H7{Wm3tb|!gFpGiiV=HFNf;17C
zA!D=*48~Rr48|6qH8jlNy9vHBFc^D+(x0;e$mx<`UobEjr!X)WCxFTyb#)1*zu>t1
zz@Q2mLoWbZGb;!jGE9F#HvxjI$z+gV`VS5c1_t8_1_t9YP+XMFmS8#xii>b{$e=IN
zanPWz6Etwb%|T(#U%x^Ww7nD5DO@4JbPhgh8_vR2ke0|G!E_!RXrOzK)=4m(2d^7q
zVPN1Zl3=<3DSJd27{kR;^+ShvVaCBK(QtEc@JfR!(QtLp0e&+j>X|mPf%b|Dffute
zZ8iceW)mu4kYL)P%fPT+LI~oDEs%oMj)CE5hXm6skd~=XEwl9DT4u{JFsv75uw!6w
z){tOo1gY8$Rn=$)SJk8nO4Fb?UR*0t&r|>#90-2_$#F~tpuNzbd%};bmtZOYZ-xf-
z59EGHFr`4x9Z>^qW{&|yM}(^dBsx-{gM-Gc3=GDNkn))+4U%3Mj2AI57|-MWz@U}`
zDxVP@%X;G#3=E*fj=Jk5nBu^uGlF(bLY)!^S{zo)0J^;3kctFTBsh&YFfjD@NH95p
zIUg8QK_dV<V7JVJCJiUh9`RzvEReyW0uoGCaD$Hvf!8xKS!sbv#!!ZOhU1e#%S1sc
zJMK#`K~7)+IpGV`2?k&%K+->x5yU?}3=APQ5=`naV<Tmu#;R*Vj0KzOUk);L*ER_z
zdALG1s6u&k`^^{_xJxA%e~N(OiGeZlA;fydpP=c(Vn_;R{0&aQEDQ{5K1nb_29`t_
z7$YY_lOG#A`9|*J%1zB>kYHj5CtpyB!NdVx-v&yXob3`!T%e<Kiy7)cQxuUGQ4Ij8
z(On_I1T_zID!TMt3C53LUobF6F+kn+5i})I43b{+RD$s(Oj;f){Swkk@nK-7*eJnx
z1ynSFR<cH=LeeDT6>A2DdO;_y%zOq3M#z8`$f1m&`%ysm=7D{{coXacaD!ymR|&@1
z;N<#&p_PY$fvE))>(N?}6v#LmG^ka~z+ilcfx&naXp24MqTH_x3?_OE3?>?oM9B!L
zL>L%MKwF?poLxRJw1M`Qt1vJ|-IHTruuYR-JSfV*7_9{=A+#MBKng$^Uxk4&T0xG1
zVfsP|#?zt<3_S@T1z{cB9~jz97?`zSYwE+mYwB$v-5$m-EZ}L~HW5(52NwlT85pCj
zz(oNkL%k0JL&-%6#$aAhOP!H{F&cE=h-0w?W3UDTgRn5@zMAC*5{x!%42;oDLXaS_
z0VR?nLg0QeqYWgK?HCv~SxPYKg4BVotXzLgf>BqNfkBy{lYyb<s05>~HUk5r4i~uj
z#i$SIIiCXE?9y+_DEEQkE$A3s2T*v%tkh;;IJH!QQ4SO;#S9E4@eB+mk)ZBvDg$E-
z19)vBBY34KNV1-R!K4-xMsGo*fGiA*F-lMspp(`?D!LdLOgg|SK#Ph%DqNr{<U#EZ
zkdmnk3?`GoN<f1~ASG!~CD2mEWB~(%$vm(M(BW4g6&+9&;A((@!DKZ9gUL!z)9CFK
zP<s#B*882p$e4*(U(LX9ijjdKxQ0>i1H*9#Q2hrU@{IY;`hnp%bUHNV8dUH1KcM#W
z@f?tG42&^vp~62TKn=y?72q{YpyjCzyBRq^MbwU32}Wjcsq~UDBd3Hx;-~ZnhHao$
z9QcUkSbx?J4BHeSro~!=O{@RF_}v5K=xsV6aj@72#_tIX3=s?rrYj^M!@wUHR6(cU
zg8NyqU1{I~_X;?*GiE7fGDuv7)_x{?7#K{pfX+`o?JEI3(<62R`08(oB2Z-9;02xb
zDp4fQz`)1>Qni__ULqHC^hYdc-c!p@0(@814c^qm3I>T>83u;Mth}j7AhsHWoeW|d
zK-eiDwiSrY0J^dw{+vWMxCCH~V_*<?E|J9+$H0)BB$3Hx#lWCdFOdPVC(ek2fnnta
zi40{1#yBGe&=Dj;hE@y=hdU(F!SaC+`E*6FycGk(`b3E|uuL`w1B02FM4BQ4=rSBD
z28ILu5~*OBR)|ch99Sj}ba<RZ3dnZ7HxkJpx-dy12}CbDCXvVnax1T!L;@S=Vgp9g
zI0lAjQ;B$x^nqlFI1tU$ClSlm&B(w|rCs3+YJPpSW?(pdxo-lP&A=GXJ3Zhwi%h*i
z-vm3*jR>G?)FgBJ%3#uF;0reU%4|S~>4Ss3uMD(<;44TWzkgp2Od;t0*rQkaa=;2f
zk|uZhz!O+s85rXWAf`lsZiaLONqVpA15advB$sk9Fw`Ht(&r1hLIHG<{es3mUuRJJ
z9b%s!DBFPT+dH!l;s*xC_;U~=osl#-gEcXLe7ifX&k*b~YX*ki4}IWf+gAq01Qv)c
z2@{ZaI6y}e_enT1Ffi1E&0mq&#{;_Vz>$G5L6HM=&3GRVC`W!}h+|-AzM>WmN)9fP
zY5|N^3=GZl)La=E85k41wHO#e($zdcb;2Z2N{pSWW(Af3-D9h3paxnpAb13HELzDH
zH514+1&j$zpnD$;)J#CLC^zasXQ8c5Q3Ks_FL>kwLp*5bF1Q_#$UTvffuW6A4Ln18
zgE32ufk9kPO&3y9GML<FU@*C<$H17#4c5g3CK(ts)bv3obR<eMFqkqiFqnc)&rVcl
zU@+xlU@+xjW?)P-W?(P{$%?ZxFecX9GccGMFff?vF@W3|5~(Hya%V9EW1<fS1B3T*
zH7PkLyNy{*3e=3a!2x!N6zEpFV(?{ZYBHc8F9uE52;Qh=U|6uSpP7Tvhk=28V?Pt<
z>MZaqdg2t&?S%bI-;@~`6Q^+H6*KfR{jQf`U`(6|sjK^$ek(FCCW4N60&NrEV_;Z5
zg^z(j7<5du{UULuN=638L{PoT%OTEGDFMo~oD2--_lh%BYJxaiB`FNzOw|$~RUo%4
zihjk&z_4+KI1}jlV9-2^(jEo|MgdU$khEQ!fk8n)yq+l-<n~Dn45qdW45pSAMX7}h
z;!MGY42((J85m6C85m4KdrJ0Zi!+6Yfint&=?n%2(>`qm1~EZ#rVw?I)eH=#hZz`5
zcXKi@?CTU~3RPubNWG{4c25+<Jq)I=85m5TD`XZWGl(<AfXccX3=C#+stgQfl64;#
zloJ>jlO}<>!X*q0Abt-6W76X3%=cN;>ifi*d_ma)6r@7B;!Jjo3=FBDY4oITT$v2w
zOb(!=WGn#jzY{1#uY;Q!QkvpS;A1jwd|)Vrk8ve~sz#72xs5@tWMD80Vqh@y>tQTP
zW?%xTy0L{36gEttTk$4IF)#$Dc#AWEF608;3SpMZz+jf`$G}*`2sV_Bfr0a~IFkrh
zAOmBO5Ce!bV+4^-V746SV9X*d1_rYx1_rYR&kqcxHVlkKm#6=}&mvvFm5B{h)7<#L
zpaeQ+8gdUo&I57Aw@_ho(BV4ZiLn$vZ3c#JKXJylvfv{G8O-J~FqloX0JR^)8Q*F_
zV!`Yr1B2N?i2E5oftI&OF)-LZ5N8BmItdE!j|>cEZ&^Pum@i>qwy=J}z?cHwjU{-b
z;X)ax3bW7v%}RjdfekzaQU5}m5xj2U1|tJwN(U$CI>hN`AFxQ)3y3p50}WJ90`>ED
z>xna-gSxr|)R+$dC9_m_aIi97W?*1|1}h`zynIlw_NIw5g6q5+3=HNR3=HN>;*d}+
zc>`M4#(6}X@dg(IW2yltG_i!NxC1i-BPeLiRT&t}<v~Hq0S?-lhb#)LFBq6@Hcemn
zkVUxusyO2zu*)167{YYK8Fzp=9~hKC)iHQVEp-PZH!$u1H4!H<Fqk_qFqqpoLyq=T
zS^^r31d$9J;*5Ji*9d^lqco3ZU@(t_o=0h(#=u~n0#0>BdE$&Kp;q|wfLbTuK31AJ
z>jwsZ83txhpr?XXWic1u0S~$R>p%rTL(<H};Elr!{x%T7G$GIsV(|-zN*|~oXg4i$
z@e}Zvk$(sSV?j7*#Ltj{;S3`K!)^=4#loN*@_|9A17trWT?PCRXRL#|s|4iFC7>8e
zKcWE2k&G?S9BE#{z+he=#lUbxK%B7?CfLTnVBP{AE){2-!wGJAFqltdU@-58#hDD~
zga^*8;*2eP42<b&pr{dIU@%|Ez+i7aAH<V`@E{y51_txB3=HP0K{93x4CcET7|cNn
z=Zl;e7|c&FFqj|X{=iUT0glgt$1IBVHpU+qN)~{I>PkRsL<Phd=Lj$`rl*3!-<5&E
z{3-*3`DJznW}6@e2J@#34Cap|J}{JQU|@C-2DSf6A|N4`4q8&jD!2iZ+F3s^l+=Kd
z2?JyLbWn;fHUOPA=wJ)lfx=MI0hQVWlB$Qw*{gsuNy!wDY2b(fZ5?o6V9>1=XH16%
zZYgMqFgW>Vtk(t?h>YpbqQ?9?1B3ZzNS??6<q0WJNh8jf3&}?e7D5aR76MWX3@P5?
zjCs(|w~%FEsJD<7hor_bP*aqFOG2EnfR%wUBN`L{c?=8|8Vn2;Y9LNE1A~Pz1A~Pj
zXq{-0{|AOL9?*b0mx?%J5hnv<#!@c^#-apJz~?Y9SU4~+SlEGbScL$HY!UGMz)&Uu
z3U|<Cqyr;kI_Pu_iTV!=rFR$@bIn0{J?5!6V+72zpvB|hWdoV95P!uY`6~|QFK-40
z3r{Hq22iGthxsdvfx#jKlz{v{FqF;#JCaSD5i~2184Pk?0t16Z1_Ogd8t9a*B9Lo~
z85k@I&oVMF7FB@B7ErD~0d*}CM*|~cI%u&esA*q12j<+;$Ks6kQ0EqcP86;HCH$-;
zXn_j4n@~uNfx)7kfx)5~TA<oP3sj3G3=9?vdKl}Ak{Li_vJ5w*7#Pe{#Th}jFoNm>
zi=zw-7JC(nONtr989`Scg9V>3Fjzc-#;rRn48AZhSbUOZV7Bi1z))lZO3Fo`HUx_}
zqn8u|W0n%=aL73f3>N<x7%cvR4u@RHz+lP6z+lP2AYBjD23{y!1U{fjoY9A$fiVkw
z@5USk21`)}21{X>HdO`&OJz_n6mh_UK{Z?)beswU!;KFNMFpTd3<`#vcx_OLF3u>V
z$-q#P&cI-4!oXmu2Mq=x&^@d-7#J+;;~5w%!y!e5I5hq&`xzK4+o9nh0TbNCz+kyW
zih<$i6LCiH5FtqWZ3YI*tDvb@9dYnck_<Z;7_3+r7%YE414$YhNLJ<y3|6L63=DGO
z;*2s-Gp(E$>KUvYz_SkGjG$3!P#{}{F)&yK$uKZ16J}rlU9PAaF3!MI#`1xo2)vPk
zbBZ{lEI$Kd_8QQ7Z4m|rt4sz4t90mae$fmDh)U47eVhe!IKOBH0~=UBNEAMrUo->M
z#buFafDY$NLvmsf_&`t)$-pAcXvoXJn0?C&bnY`W7g|*_Fj!TB7LtSJ8HzzC(=Zf+
z+P56yjLM=6j5#jQc?PR41_rARsKbf_K&zU;>X7Cc>Wc$F#TZl=?lK4;?l6fD3`J8w
z@y-2#q1XXdMuFy^K-rdCU!0K%nh#1r!vf%5bFMig+p;5NTMk%kOl4rOnheUe^)cd%
zoUrIvz`$TN4_X|Rf{HN)&KKg0+^h_YIS)a8&tqV)TFt;<wGzYu1;RE42CFR$u$*22
z%ITb6#2I<G7#MSPk&7d%!wd{o2SEi<g#(CeaR6oT76!)pqRXI-<Q$*^iHXAjJQ`CP
z0P-rRkG=SxICxd&jSmckpo7@KbC9{K)xm`;=*UTiNem2DR~Q(q&VWvg?)tz`2s%L>
zOfs;D|KMX_%$)_zepcTZ7_2@+^N}?l1A{dW1NVn|hQcQdjJc~pbpdFuCW3)s#~*R<
ziad~|3JeSk;Dr|XQ`NwhUIbOJlNcDRr5PBk#T7wSEO_PJ4F(2lO9lpOQ^myOWCro;
z(15lMV_>ij;>lqUzX1y5uj&j8vbV)=g4iG(Sq$|I)@ibkGN8}}R0D8kiQndCV9fJ}
zIvaFxl64i#+3gGr)~%p}Ye7eo7e;`}nnKXzAB*^XUIxaz7Er|GF)&zzTsQ&5sb*lX
zp3A^sJsYkGbmkpHA!rjihxilLdIrWk(9!pxhL80s1_tXDFkM?27_2vgbb*Ss!UE71
zj6(1rlK3-_``*FacaVX>dOys4XBZf)PeIQ6{=iTOYKJj!mWjXMWMIsf2N?`<+jRy8
z>#HCR$ZesI7#OS{fY!)^YP3RdWx?4b{*n(`PguWaV6c7*;^Z(e*f29N*f4@P6$}hE
zd<+aWppIWr3ykCWfuV2>sM45z?KO*beU|uP-VY3>XBZe5!29j<|EMuA@N$SBmV-2^
zZKN3(Y$VmdU9H3VP%$+I1{)Q{lKf%@@e|;+=L`%sMhpx#28t=A#SG#nVPdun3^vxF
zG`g2rd>b_L`GFb@;7)EqxGY0G`22Xk2cQNN+Y#~ItPG3=?jV2XF)-M8GBDVHIn@jd
zHjxYrHsPT5hu<Gqlh1&G!H|JL$X<LYXqKb^v~XnCMe(Je>)gJIGB6f2v4Nevf)DI$
z0XDG5)<bw8S9K(d*Y`skix!|!YH(Y%;E7^UYC41XL}&uENoQcNNoM`PVBrEPR2Ucw
zE`u|I0mv~H;HDLrF9II%s#q?b3H50)Xe1Ea&MaaCXM%i~iM0$2Hs$IJ4DyBb;-xUb
zX$%ZDlhna&Pw@SXHy9XfRxvQxtdM13ESmU%p|}DRNSw>W^Z6JU3)g^Rco74G%~l2m
zo6R83ItB)tgA5Ed`$3#t3=B3G85nHNgE+@v98k$P2Nd_9Q98kfh6`oW|Gs6BPCo<j
zSRrUl33Ew<9JsW-0Tl!<Dk%Y->cUXM0%;Z&g4dLkfJ2}}03-$qff7gy(q4suL6d>O
zu~Ix491x%ei$4dbV3=P2jzzrwiFh(-N)a@YkWw$6YzgY9aWF6(6c$egZ7`k$(!BJp
zIQS?CP`9gSB3QF{9Jo~BU|_I+A|3}C2!Waq2QqCE#DqAoX&@6~UyFn1TEHe;hL{iu
zUKRyXYX3w$5;VXBH6jvJ(}Tnh3X4aAnkAD!$>Z1~aqtYyjSmb3poZQQP?Mn~Sp%Fp
zoIq!ug7U!=1_qluYG7A6f!0giU|_K2VPLRjQv)qy7Iy;ORym1*!B(Gv!B$(1fua7O
zusG-(2vDhP>(9Vo>j_R9?$BglTf)F#Tc8LU<Q9h>|G;3|!@ywM0j=ymfer$G<nn=`
z0MwV%VPGubRcBzxun`AOqJnIi$G~7a#~3ofU+@7`{1t!}Kyio%@G>wK*Z+oAytXSD
z7;KkAE8c<+po$l)4yocT0N<4W6@}Nk5WYODLBRcip#Yp#KwW}~F>DMBHjtJ`!4hy;
z9VG6-4{e0l?qFc>w%ud{SyWH}KC_lHjyul62C|@_U<v4$F3vb^J)TO?S^@?J&N#R|
zpjkn#xyFoKj0}t=2Ur*wPI^zj`+-H$8MFvmcZD&dD17p$WCM6Q2rdK}VuEu)SAv#b
zGk(U%z*wrr!NA~ndAj9C7KN~7!r+NChVpA{3=HOB#vi~HR5Sy_kwwOg%siP4#^8~J
zuRJCBB@D*DK&cx%f>?UkcoAse>?;FfX(ume9@Kb|4rmq(V)puvEQ-9}j2DB_Cg|2n
z*XrqaKe9;FUpKCV>M9f9%_+@eFs=kGrv{}-j;Y3#dZ5`8Hjp=stHBOoV_=x~-?&DK
zfw2r!mWj(6*MSlZ=oZfTEXF-xaY!OzbPQl%Sa}_Eu_=S`bg-g&urKC-H0rJ}uH|H4
zG=dJcEqtWHz%cESaS9^?V_69Y1H*h4;}mU>B@nNqY9hR{>=TQk%{ODvg^~<AA#P4r
z0}Vri#t(}x7^_1)RBp(dU%+6jt_2$HV*?wh4R+sj=Fco@68DS^6d4#aV|j|x8H^3Z
z85qkA*%%nkF->>;%%U8gYitL0G8+Sf%P(VlFk6&?v0Mo>-nhb8hZ8(b2=Yl{oUsRZ
zP7u7jZ0;Wh#&XD2t4yH8vZTm}k%y6iv3wpRvF!fLB3TbwS+Bdoh*2D#Sjzjri3KhM
zNi1+KD6vGw8XaR~V62b_N2t*;8PHfDIE@%VZh~cFV6byCIwcKK1C0Xzat4OTSa9Mo
zVr1nhD_}6XDbA3@uqcd;fnncSqg&vS1U3eSW=EsjF!oj*qdPG6YFVRykV!5+28M;J
z+!+|8LX9AUnGB2-4xj)w3f2S#FldTRWab3MHEaxw6(6T>{lcPE?>vEVy$Fa4zAJhH
z;|4*{^c)MQ|2BbfBPdL7urM$L3r%3$2pa0U!IfK@!!UtyBWSJ?B*WQ0fpHVqDJ%>O
zm&_+Hf^HvXm?X-;Sn-erv~+9&<44dr-!~XQ;RRCtOB@s`;A>PD+^;udVAyke0;2_Z
zLWO~`GDE1WfMEiog%Sh9BGAqB%2E>;EkH#u=uYYch6#+8njlqNpw;~o7_C7GekWI1
zA;SblI~fLsg?AyL%J3`&WG*;VConGKDl1}`z*s5Fz*w0J8uVRwmydyAE}uCA1J}&^
z6BxzV7#J&;Pk;WEMYdjb0;4o2ses1Y7#MsLCopn=WDi1|#i0mt7U)`Ik6RP|f^Jir
z#K2g2mlx#bzYsZH28Ipo6F#spFjg^w#XqQl^nk|h!X|vs1=V68{Q<rco<j9k$%55A
zRbgOQBo_usM`Cv;Tm%^q4wks60X1OX+35?vu_*D}nE<{xn1g|_s&o4JZ!Bu{trJQ?
z>VNPiCl)YFD3u3AC}^%obwVj@G`@{_La8yxcHXkYB8Ca2wxG_fC<9~Fb<pT+`-B>Z
zuR$U&AtJr};D`ccAkOv)^C0pdx0f(ZkOkdb%)!7|oei>5l3{|ZEW%D%P*w*OPi@T8
zd%v@YTYEtaRDl>F%D`9+D*id!Cs?9b;Rlfig@Cr!#7;H_#_EmJ?|)~Ja=tyW(;YOp
z%~MvyFtHmPk8BJK)?X&}NHQ?Y4F&1ger;kh8v|oaB5zqC!^C7AP-5U<U?@I4F+~j|
zJl*C8i*&u;#5B;#B2agy?DoVoP(}O|Y-k49P@YVNiJ728|CJ}PjA0_Ug$61&jhH58
zf=0bT?8?@OnPMQvurV;KmYtX-!N4##0OFc#uxp@6@N+Q(!}e>S<Tm$@0Ruya`b2M5
zP;&jsz*uu)`n?}4VzP6=R{MgjW@BJbI5yEw79`8Yz@W@CUGOK1UVW_)*gr<vQ2!V)
zO*8_vJdD9wO<-DA%T6=}I|SqdGw@J9D5jJdCn`g8R;?S@AZ1;UL0}6es)BSxf#PQR
zL^ZIlK{t74gcnCMGBDOQ@Rk)Z)E7rffpQHmD8Cg)gJxolK@*oH#nJYl_1!#~48>Ux
zUl}kkoR=)R0JH8l2k4x!q6-?J@&tU(bI~Og2FBXoY@i9NqRU|W*g)k>(Phx&7$|5L
zMHXEKt=0gsg+q$2C^6JC)`2e4)HNu&$_+}5kg#R+>;YM}h%vROh@prPT$W7w%E!Pk
zyHkaM;fz($Y+eS&x^~cn@Qb3^o*-K}7#M^@isrb3u25xTU=T1ang`nS@Qsau;UZtr
zd_|CYHU<WrdqoRC%kParE>kR8SP$cf7Z)u87juijmY!i^V_;YwTy#K<fw8U!;wpv}
zX&}o%F+MvH<d}mh3=E1ZiduLX80$f|%4xkQYVklgrqvDVn2SP1?Jx(JsTOs>>|B4W
zsJ;`-;Q`HH6m@~wpxVu#s2g-{yBfqX(?K`df*K{^<{%3}ktm)}ln%1C5E2II?g(o^
z=W~GrRlv9?3uf&_zM^ax+f20xbcHelC=BYwi;HrR{M`Vvs=g6?{5Et~PJJUNM;J>n
z=rb_Z7pj0-Z$%co42%uT5c@4$5cXR-LA~vLyvSMvG;aus1EC@tnEkp2MYiC`<|#^@
zZuy6Ww_c;j9_)39cavdmXb=WjRL{UL`%F<Hc)`gV2F3<quv5fAPHAA)WnhR+D$-$N
zU~EW+Btk=QjEOQZHaLMoaz&95yoPTGK@kBJe7Ycc==No628Ml`i{u$WNri#2VHzZX
z%PWEsI3#%~7=gUTlgUs7UNrI*)Vi4ebQ0r#Mh3>lR2Bw?^~WYLv4JaV$gT2>jsc(r
zkDQa3ctQCARH5#gFo}s5+`i)~WSGRn$IZYn-Q_Qfob=O4ObQ@HUs)I!qCQMwQh{+q
z3Z~coWl@TC169;)lbEz1#VDx0ojiFG6XeEQ5HFZ*5|ahE76)A<&A>3PtuPieSsf)i
zSqwBK-Sm%*f#LXx$#QZGj7|R_E@b!&n!e55J^jyL7UlZmleIysL2s}zFi1R`Yy@@z
z8w10kTazt8g}@{>1_tLPlWjy97@L`SK!=S@wlM&+GZ`k^!c@!rnd}K;`+S=015(Yw
zlT=#FFxf|ofw7r`je)_Sdot)|0tQe?Fs*iS0>t!s28JD5CMQZTFgEkDF)#?;oSY3}
z3$ZaUh#sAsZN|XZEW`s^_BJ^OW<mJo$+@5vA&xwt_V(m_@VYWK28O)2$z3otJx3>R
zgR%J)C-0GGVCXg$WngUD3{DS|L30S;E$+;WO?Rg&{Abaue~%&qNhvUOpaP(KB_9Jr
zPXUOy$;ZIZD+eNSbr~4)JqkM57#N#_crqCZ;4a9zQqV025@lmxaC=wKBhJ9s94^3<
z%1|&#8pH&baI=*87#Q5|>oPFd+x{x32AR^$#=wwurJxq3*Eg!5j)#G<xf^79J=jkm
z*9ac5Vqj=UEJ$KwWMFK5GL@CpMCEEhsssZ=BqK;=8fbdE7}Om;y{aGv++Sg2U~F-i
z8p|r{u%`gr#ResV*^FTJX;3~X{eWOEafGtLH<~-k6qti7YMI6cYB^5b#cExDu)vCo
zfw5&8IF~+UU~E|i&ZRt{vZ`-Nfi^D#W6NIN5{3e86HqXKG7i^u3q~f8GeEgQ-N1s8
z1LU8bpfwbVd=_s&3AP24VB7mFKEh(vNzme>BB&bzY7uaqv^dAcz}Tt}x_{@~LyL1t
zpjsO=FmT@D9BAb(C~;-jSX=~|djsT><qj5e7#SE_LH?Vu++w8!h|N=+o6BIa3d{xt
z=FB7&28NA0Ec!tz>)03=W-Pau1eS%UoD61zZmO#6vao0Tz!=;Dy3>pWG%C=>IQ<VJ
zt4e(cPf=<ag9T)M1e(#FrHC>xwmx8EU@$DU2v-1E4O+6;`iYH!Vc`;sBtZrS@n;O6
zq_%L0MX4YIL&Qx6P&lbf5@q?u$iUd9$-=<klP${1B?{s|>m<-HfXXD0yQeXmGBD&O
zi?ZzH1?@*~+r<f1&a&4Cq?`+s|3q0{fWiVaDAu-$g@Iw~CsCFo(hLk!Z?iBk7_Jj#
zIidpPG)9QBoCoc);b384IG`rVaskFUpCih05yqMHT$JS!m;-M9UosbEdBqEwZT-ps
zT3RhLSCnNr?+1o$77Pqb;6b%6P!q!^Ta;zF3CL9p47PU|7;LXu6fuahEca(%?22Y!
zuw!Omu>Gr$#~{kGQi6d&Ad!K=PK|-VPDP4=LF<Jm%PKhr#;ybg20If520McQ1_q%9
z2F7*=DFz1J6{0MwSs57X9YYxy>^vD5?A$^7AB1`s7`rsUGq<8FYaq^Lu#0D4unQJv
zVC+i$z_6VKG}|t;Sd;~HZB8fXO8Bl~1_rxj3=DRlQ-``57#Qr1F)-L2U}s?L>SbWC
z`^>;#_a4NV#lT?C&A?#KD$c;Tc;*L&?H?Fe>KPb>wu`d#axyS>^e{6pE?&mKU?0rD
zU=KPuXz?Zn2K#IV27AzTy^HrTFxa;;FxZ3cidlS$fx&(;1A{&2$oj?C7#QrgGBDV0
zmStdE{1|L78v}#TVbLgl2F4E1Wk8F+FfiC3Vqmb}$IQS88f3A*#lT>HMV=vzaS4we
zMAr@%(7Zi}WRMZ{0Sy6z6@Fr1u>SyZ8OVr#3=H<58wi&0Ffcf9F)%oAfalbA@Gvl4
zhz6ZHQwlzW7qsS)^#j9p8wRE`a~K#qHcn?`WtFM-VPHCE%D~uh0W|gpQklub0Xo?T
zav;w37^v#6aA`(gM#c<|3I@(EDx817d+@gBK+Na_T@JwnHNyxr_X-|v+};9}HiMf1
zI@6aigQbMQfgfVR6sVGj>8n{;B{|nXxmDB8g1CF2+&R<VgSclv9%Eqa+%sK}ja96E
zhX$B0&A@EY_kjV#1CtC4BBCriI2jnbKo@RW%w}M4kYQkOkYZ<Gwphx*;GoIC;GhoT
zY-C_?FkxVD0H1HQZ3XCx76!&HIoSOy5+4}0?E&w_arwZo1Jt-@U|{U>hNo9|$muB#
z_6!UTw%~jOOUIyO%m>PmAfm{WfkCNDl%)k!GIp&1ZBuz6%F<#C$_$*Kp7`{)Y^;*?
zF`_J!zzsUkY?n}sC<}N-{_6(@MbM^W@O^sS3oRg}LAo_06FLMiFgSQfF)$qF6lKYj
zfMi358U_Z33MmGLu&tsjSunxL3=9sv3ZPS2MOg|V_Aoer0$`;SXhoQ4J$Ne~BL@S6
z!y^U;hg+;47!+d|7$+7nFm^kDqOTadh(j?4DhA#x3E6?DID>(4!Z`-UZtz}7sJazU
zb)Y2+&|Of9ccAJffXsvJHdK5AQU~5`2uh}^3=C^ui?VpZs=DsmLJ%K&S%G}a!oW~*
zRFowg>?!aOv!W~!5YMPGFr>7IG9Q8I>;-ifeX>QFj~Ih=f|sw0GM@xjNT36>4MmyX
zz{=DfbryztP$9&83f|`IsfLui%;zM*`ZF0snXiBva9=?!woB%s%r`+THc+E)Z-^)}
zc#SxS)5a{yd<)e21{J_sFGQIis(~V!0aRu5Kt`%Wk*!$>9=sA|u7_GJz*Wp3%KQ#&
zDGLL`1!Ym@k1!6%*6(09a3!UrF^Dq%0C9G*Ffg2p7G(w>5du0MsC}s@Gk9<l#OW3j
zW&Q(F26nf&o+$G_nCse@MOi@W#27iaic9Nr8AMssVN(0DL|HVD{KsMn<A4fs3$T|!
z;h;NJl!XO6j09@q`iru#ih_nO7#P5-uQvV{Wrm;c)4LeF=w6h0ohhgxzzI4LQ<QnV
zIRnF#cc9~bgM~zyH-ej!pp7Bje4@;~u(<3KhNJ@KUU22Z3Gr_)C`W?4D1J$lxgV?(
z<RqaEQRYb?4}-$xl#eJg_#_aJI^+4G%-~~zK%8s~QRanUW#DyB>+3Z|nL&F4x)MGx
zOsimEU^D@>3;OFJIgYtl6O;-V7#u|y7##U5Ky6u3=3+;XPZ$^+Z5bFGO)ZiVix@<i
zOF(zxePv*9%w=G3OyvZ1szsSg)Ih<)3C?NEC7=uqYBYi3vjn`mg_EJ40hEkNTtQ7C
zNPWp%2CXk0=Q1!jPKC4^7(soj^_o%)43#aS%*~Pv3<7Bk4338w7##N~6y$@_P76%i
zJq8BHTP`0Mrh`US7#JA)1t3Kib1Nj3GdO-{U~v4*AkM&S5m*0#VLB*48F<c#GJ`IF
z>IY5ET4XaYIB_vBIB_sDFk6%|FgS@bFgSr0YFIQfFgR&3FgR&|CYz@1VPH1<$iUd2
z49eOZ8lb7QX%|4JqJj9}t<vBPpG+JY;08vDpeS=9?*|5jBMb}-IiQfPpKvadfuVVy
zD08ACs2pR=vM9-C5M@pR^B5SMtQZ)aOhAnb<`ih-!YPJ<!6{0Lfx-2GC^P8LZ%|Nx
zc2_xpHphbUUMe&woLU(eoEifd7?>t7Firs7bEvyQlsOF=3{Eo{7@X>-f|m9xf_hO5
z42%;jq`<8bgqk%B3{I;+nRtRXG{-`<Lu(&}KcI;k1<(o|0a4~0P6oyaeV{O#&A{Na
zoq@q=E2zR*%D~`sh=IZB0En}Zfx+o41B26P24@Cli~6_^42m3}324w7W(EmS=3H>?
z1&V+h3=B@!K!$-L;4uS((?gJcPz1bVU~qZ^PQY{ii!y^wCSv6Hz@PvsO2KQmCKd&O
z(qxz(BuF9UKQpw*WN`Y;z~J;9lG@UkBcXxiEX}~+EC~v%76!(Npgo|Vz>0zfma`fI
zgR=@KtU$+4Gq5l)P6Qn#jH1MZfx+1TRv|LObUH9Fs5ef(&&w)W{}t>i9|H!)u4u+A
zhy$4YVD@`5FgUxrd|*%r0o_^0z&P;|G&1~QZU|#wa1H@Q#zfFqEy!-D6sQ0|;(|(&
zy|$vv=CG1vQjJg%gJ?aoxi!dYXn|w_E093>(E_y34OEbG{S#%j0o4$oZVo6hxq#g#
z%D^}&5}E=)x21#opNx}oP=#RbfT{rP25guh%FGLD0!((cgj&q23MxN@Ams)xxaY&k
zz|g!-l$lSQfngmFCj-OTL{VlwWd_E{&Y-=n($ls1S&f}TM45#_E(19e<Yr+|Hxa~1
zsTXAy0oRA%)A>c2L8FI^93a;OZ4+hI1eJFn@93<UzL1|)xZYZn=?B<Jg)9sVi={=G
zK$|eYhtGLk6lDU96f#T#^#^PMMVXc|eqgW%ZKVDI%C6IrAO$1SQt-GS1A}uq1A{YY
zITlFgQWeNDU+3uz49@)u;L3_=IoQbz49>?H7@YS?F)&2duM}khwTD0ps+`|5FgU-4
zbh#MyvH}<wShE-yr-DwT-aAQ@X%8p{CowR%FfuSW|CeH5FtQb80$27RK>-E^7cMCV
zhV;v#OyFfLAVEC_1{V#GIh72IQ<g|EFf6baWx5U;Ee6T@gEk5{D}cu3MVW5EL@O8=
zTuNL%FgSn~0Xr}-P64eST3{{8bQ@gBF)+AvF)+A*_FFlCZyE!YZlFVOxIZvBbTBYZ
z16^<dz8jeJ1B3ks2BwpO42)CuLR5iH4z&UmmJSRIOvhUo7^l>Ow)sGs&5Ryk83{<E
zdkRvc8+5J;QyIAN<)8x5IF%1!q9<6N2SndgT_g$6k|Rh1%^?J;&kZ5%#lZT(fx#gI
zsu6scJGcSQ=mpZq@gHn%2?OKgLI%dE^&pL)^Dr|(CvAXyy8@(f`UgQ)@u(06rlZCT
zj8nHF6hYi;UjUUkk0G-L5;jxcFfwMb6@$;zhKG;+0g%}YjMMn1CknAj)n9;eL6?sp
zsRg+c(pRy+1F>fs_~sFCZ37B1kTbV{WI(o;gOBtCtv_{OV3_+@l&OXrH0knz!4|aM
z2fWH-daMN`rPhGflI&z)aGA-#;4-;hih&`hU6cttSql=~#lYaQ1DbMr!0iqO2A7iz
z3@(RVJ}}sRVPIfTU|^i~Rf>VZ@|P$Rr1`<X;PQZh!Q~$J2L{_epx6Mp2@;^iOyJ11
z?SKTyba3Q?r69hmx7`Aj0WF+{o&yc;ve@2WU^-^Qz&ITouMjPkpx7%0_XBNTpjpHW
z+ET(G`9qW`7qsAJ`Z`Ffm<clYCd$A#y&F=DF@e_FLQ1yj^XgH>K!u6!3Q?F6&<4{v
z@}f+jOA8r54X7DRkTwsKqZxFgfBh~|CPxQQ!-gx9L6pe_Tn>PY;cORW@&=V3#ay5@
z8KO)+!l1bXuq$(tM42o=uAITBJ-tGNRgQawjwq83SR`cnLJ?Lurc$Zt2Sr##gk~}Y
zfyNL;nN-1Bj2W|nrau>9m92Mq%fR6BQVMjerYIBWbZdsM3=FQq3=FRP;tb4|RUa4>
zK(1n7st{#T=VxG?afg|K*|M8~!PSz1!POj8EnCKb6|sOx1_lOECJh0QqFe?BS62oG
zS7)$WFFX)s;sv>ErZ#wUttb<(2?N9QW>Hp=`ZJ<T?4Yvi>jwq}&_Wj;Q0X~yHq^!J
z;Hrl)E2tndk3p1)9bEY^W<uQzUb6^tb07nQtG^!uGuSx>pcRNrIigIQaHpg*Fu0~N
zFi0{m7>kQCf>z1RyekAw%k_-+K}{M^TbQ$5l<^_Ba$o@^4^hTPpojof2a5$n86Sf=
zpo)t1nJD81kZ)$`LDC1~CUCDwl!0*;HzX}EZh_RqAR#$aAyB;Pt`LQ(NC25Qy;_uU
z1=z%TsEMoKCdNRugNA<~DQ;Fisu0XXs0xsQD*mF3lfVXUo&HsfRkz+nl(CvEmVqJu
zxhSJL?+1p&DGUsZ;Ju`CjzJphjOqrU%9eq_wVHv!wGe!wlqjRRH6+2gZf9U{1>I^L
zc3PBC6FdRMz~FkBfx#8DG1*K<lu-*Da*#$i!`)pVs{$Ap*e@_J&OR?y59-E?GU`EQ
zO&MGtGBCK_m1bZzoBM$w@dc=1nD~N$fq_SqQBRD4arP8u24=H$3=FQH85mqYf;hVv
z7~B{c7+n8ze_%-bz`&T$1X|3`1*(?nJ}@K+Ffh)B9;O8v)`4`flVli}9ab?g&fW*Q
z@(a|*=KjEtqyrif0V(46!vGpXW52_|IHwpgh6cV_RPYD`gBu?MgBusffu0{2k`h1;
zOakq`6%b`~6k}kVV+C?k6a#~s0t17a9Eg*~z~H9Gz~H6>vLgrLK+ySMAZI!_B&dLk
zu%sRaCet<s#yNhVs}dN&WmM7>h%4uStHxpm&|xx3JK&Ct0c%X$!oXx=#K1VG3$(C}
z`2*v}3{drxcm{HB*_^f0|4Xn+)jNPTL@=^tPG-rP%)&a6V;P4IxHoYjM3hm1_X7i{
zL%;xD&ObK-8tV#%kXU!KW?*nLhsL^s4J6jxA{ZFlLi`vQ=SF}vGcz!--V|k2VP$4u
zoD1@CF$05JA?pVQrv{LN>lqm5I)ch=NDafG0P>5|3{dR^4sZw1z!&I<XHy1-h!#;s
zAy5jPTLQ_5j6$F}?VX_3)R9P0Mo!)j4340!7CoTyU|y*OxCCS51Rtfqz~I)%z~EL3
zbuOnB#JTlu^BEZ2K=<j*D+TKYx%ZSPBM->E^O_hK+;%fCxb0;9z~J}><R}Klx!_a!
zz!d`%hYiSimY{HT;sAMvfpH%A_&BIE$n`A642Fte70`yrJX4T=p(;ec_o^9!<-y5}
zfpK2M^i@*em|;3I2TAEAh+W|Io$^+qzd<1}ub&rOB>e`h{oBb9#lVoZK=do`2ZnIa
z0%QeHILuep0Efd@@F5fo3~nbG7~GC(fKF@{{b~yd1-EAm3~rBXAcMBy3ZTM}y*^j;
z2PhCg<F)S03=D4n0~r_>Z(=yd$iTRGUqb@}1Bic$VF`$T4YW%n+y)c`pe6^%->e+}
zLASjzfE=Z4Bl@2A14ACD1qgA}4v3@P>p_x|y8;7)y9~rp?=8WO@?mhdWngf(gt{v4
z0LWFGGNPa0j*4Pna1R4H0`905Oh@J20Xb?qpA4&5eXi&W-VY3xa~K#HEI>iCz!~C-
z7tj>qUe3VaUJP-?3uppypTfZ4K0y&2%CA7>`A!A~_w@`6?rT{;Fj#JZjHNEn2E`LJ
z34=V(%+&zSm6m5f3cxAZiBS%8#y{wK(I^In8JeQEKz()4N=Wc*$%3-!2W40lt)fJ?
z^L}9P@c?b>2f1-ku?BcxWIMQ4V_<OK%fR5i6XM404&abtaKFvK;C_9&j4Z1}z58DV
z2KTRunMH*RqPxJABm;wo3<HCQloA6&F1zS%4h9B(7p93E#te*$ia#*;yaA;>pEnE)
z3@)OVSQ!`>mU%HSE^1)?z~Bo_(hI>u&Cmo3@*PWY4J1kXLX-5uFp&R2D(W+tI9x!@
zC5{Hrc!e)GO~WKJnK(W$GG?#}HZ~kDV_+}_m24jvd<{T7bYD<KE+cvc<bp5E3{0kz
z85le?7#KX%K%Dsu3?4QN3?5b>&T0k*j{pV+4?lSZCe!U8;xP9I244>bX4jhOMslor
z^;;lWb&)9CX6E7t;BkA%S#CZjpb8K^V=jJ<tl$plXf6iEMIeu{morRZ<oGWIDwnxf
zE`a>y13J73wBVP0A}5mEMR4ZKsy7h@ufAT?3(1{JA;nY_1B2N&(Mh}?7+gU^G~o8}
z;v`5CoCI!WF)(-}Ffe#TL85mOXejIm1A|8$1A|AEVkU#=6i@>E%D~{UfPukd1|*WF
zz#{oD1B1t2a3t4@PKCuX>jwrm9f)TatAadGd>`aZ9`K!uhB9EcgA#z71H{9NLAQ#s
zm!f*u^8<rh0!W^bF^jzq&BGB43@JNBv%s$Sz@PwX8L@MKQtslJ)1Sz*Dsp;@Mu7Um
ziyu$tQ(%>;Zx@XKFUR6w0FBN?K$be?rxi1Zg3icbxB;4(jo2va12Pb_P<e?Yc*&)x
zk2<KR;9y{wv`W+mlvqGBnwQK)LEG&aCV}QaXXePSVq{=kQo+W+aO$}H2FSXKjG_Vt
zdC1~E(0pROjHvuRaGxDC{oEkG4`kF0Q3l2(8CnbsZpQNa#K0%Q31~4eSftADGY9j)
zbG-|A<)?#uvII2suWld@S|h^%o}-P@mM;U#T;c&06!MVSXpnWCF7k~q+m_ChZ{iIF
ztqf&jU{E)ZZ-NxspaRm;Sl*BE1A{YYO)~g+x@8g?V3Yhn3-@<2FnIiAVDR{;#=yW_
zEAI!=cY}e!Q<Z_iQ&EY5A@I=jT18fgdQW!-22cC-j0_Adx$@A^<Y!<239NW79|ek<
z8w~sm42qcy^58vpUl|xYConL0cDQ_CZ~^Th<6vN1+NlUSk3>EZ>}&=G&&>=Bp6eOT
zGcqvStAm{g>RbJi4`gNiz~G_*xf^`xHb%xQcP2;)2+3nE7EmehTo^<K(uH-Y0Tsy%
zj7wjEvL{5Q6kJ@oECI<(k5*#UtbZwQ0}7EI1_p){P;y#!8xkTm&=B#w$iU!v8WJMl
z(^5bo@{@tV^F4U0f;?osECYj=0t17W3~0>a9RuUCZHk})U3nL%=e%qf7`&|185n{J
z<Xr_A7?-_aVDR!`VDR#)-wLw*3@h{d4^9i<?qmjUonrmK;JgIX4`g6m2D)Sc;%~5A
z(FX?S7YvNcJ~A{jf{X+AdO^eu20jMHWw)ak7&M>D%QJppa02aGeFO5@iWG>?<Uw`z
zP6h_A1O^5#sVIoo<TXLtuoxJ;+8G$U8X=KAN10Wk-fIm5gV!=pRKmJpULeOmQD<Pt
zN|x7!mK5H+3=H1fq7017yCBKi3^d&I6g1Z84BmOhz_@$~M8;eQoYY-DFgSyD1~D)&
zF5d^q1fWf*j88#hgUc^K)LLlQgB63?aTg%*yc`^xpgJHEG+G0ac><AH0lMlK(#Hl3
zA%H^91QgE<j4R|oA&acX*##<NfsiQ!b*&hjbD;asLC5ptT&f41o5=kBQx2$E#LfJH
zDd!@HxFiFfB@yruVVVIdK|qHBtT@cVz#x7`glU#61H)v{#K^H|5vJJ^3=C89SQr?b
zIz*U2TbLO@-L^Jn5vDodaVhX&nj%b~LpK?2aAh)xFwF&Z9d3Y@A#^Sj;bF>SV_;m#
z3RX7VR+Uw}-c*DMd}!QGQ11$41?W=GDS6<bWc|4!Ou=9WeP94>QDoQwiusk@3dNb}
z3?fWX;B`_A44~T%yrmUDwnf8Y(2#+_Tf00ng+YWV1tfL@e9bvSkPidnx{VBsE5XM|
z7c(&UN_=1l$^o4p$o+vKXbuD8+FDQ;f^JF41odP<oxBw?B1}S{l4=!bDs9;^5hl>)
zNk$N7GPekmJji^|py#fi(-qWMRiacyn80Twf>uea{J{lUnJ2=e1Ij!*!DG><4u~*W
zDl;%l0UfBpz+hk`!uT3&JZL~)>AVQzH;{>-fYn(c!o&{l?}0)`>&5hWYOIp=o+6B=
zLCfQJGBB>HWMN<^c_G4h7Ni9nh7;mN7(pv4Kx3K57#SG$^@%VZ1qY%T1H%y)5yo9G
zz2`xfa|($t?$Tgj(EG;1z;G;DgmI4y1LG>t;clSif}o}6M_fR5>#h)C1YO&+>Iy?W
zXsyWPt$Yj&dLLsM7&H<@7*{fWV2B5`Q^C9UR^I{NAS=QMT703*&%ogA%fR66t_@B#
zj4Q#5Y#124a~T-C)3q5GCS4a{TnQd?W?=B1!oc7SIuxUgS%h(=1!$;-fx&w>1B3Tg
zDTw=4%hZD$$iU$JfPumL4x}H<=pYGlh&Th2sr?6r1n|HF`!W&6ZLAE8tGhwXA0Gw=
z?@tU2-r#*G@h>2gM62h6;+g|=w=+ZhAJ8Nb1LJD&xzOP96*^Hg1=My);DOu*m&H^(
z-9&>`Bq3acaW*I*zcMhc(HAN%N@fsYoGlG%T0%p0wh<^)IYH}JMHpv;X0&dAkEs%2
zob3TBouDoUZLl~U4mvn&&twtCUYL=k(^qJ)%GIliF!q8ALa5eW&^XZz(8Rp^MG;2G
zu8$84VW9PE;1dDY>S;4DToe*vtW*Qp&cNWq%)sFN+ajg7gh7O{64aYH!oc98$H3sD
zrp>^RohHIq37Yr2!NA}X$-v+f2o2?0a4KMkWAN!_VDM=bWnf(M9XuE!!dS=4z_{uP
zsQDA-0m?26jBCLMAD4i4lZK^$GMK~%hOit4#<d5yKQM$<FfgtI9|;Va43cDE@R%*a
zn866rI(@MwtA++Fp?S;(B{Vfo5yos#Ubz7t(Gu+vVT=Z4j<pA-f7WExGzH1WA>=2W
z6JhiL%in<p5oqX+;VWneDr2b#qa7p2_UVCItg@0|i{3FXWGn^c>d1E@pa^DQTxT`C
zU5iz|K3s%Rj`0ISz#mYn9#qh*+o;XJU@0QPC?^YwR|W>3Wef~H3$#Iph>0-Df%Y7L
z!tFEzgU?aWwSSx<jB=o%Mv&k;1_qy3atsU+g(8d!Vhjw1tC=QpaDQM3RAFGY0~gbv
z&1kU<4D&aMFiJ3fV34oh!@$6h0kU`f%%C&|5k?76iMo?9%a4KCPUr)JJgE80z?2}u
zC<Qt@!%m)o!IztX!IvF$%B?m7gRe3JgRitP1GB@i4-E3)lYc=Z0|(E4GX}=>e#{Ka
z4%ZnNeBBrrd|mVym>n;Gl`(-y1_lmmCUYKU24=^H3=F=33=F>h44`pGkYNfUpm7-m
zP$J{tVPw~UnH0mo;2Q-tY5IL_R?&Kp&U6L_-&D}7yA=aN<y4WApr~2D4?3IT7yxSB
z`EZE51V!LiaJyeaROBG2Q@$RwWK_0U<S@9n11*j_94Ru7@dHE96$S>TE1+=M>;M|*
z3T9y3P_9^1%pkH3WXcT&2Hz3}2HyhK`VS1jOBk4rtYBc=0IniAOhBnLcmq@ne4!SH
zDOl_bR17>`&0zo*y8#u80v8H~pj;oq1L|$T26~tcR_K7olMERcWEmJYJAfU>#K6EV
zDzbo;p`LN01Um!cW?u#d-!=vY-xhfW#?9d%kwgXt--!$izWpFh4g-Vl90ms8S*#xz
zf}k@q8$b;rP-+BS;mP`eAy@!1(7plGTY`v#$FPEBAmSTA*N20}nK*Pn4h_~}V5&a}
z%4JYd(3!gojGJ$LU<eLiU<Z>73=Sd-Ss55NUI97dIRk_5as~$9rOFJ9n?Ey8e8K=?
z{AZr{0L0kB%{=i0m?6$Ikwcb&F?Ivk3~mMnb`=pjkSV*E85m>tGBEgVW?=B$$jrc4
zAA6F4!S^5ogD+^~XzW!62H%Se48EX^qp_f*ai4*~_by1&TLuPS5Pl7Ic?AQrDi0{g
z!F4X^GOdq3;P73M@_`|E0s|`p1G|~X8ZHLLO-Gd(7*~`*UACf`X(9(Z1LKMb3=DqE
z3=F>YKS8{?3=DoY3=DoIAhoMN-T{ejXJGKlW?=A(m-xUCJOk7OVg0}mq5>*}7#KGN
zgEt(4`ns8no}d9EaKZ_(02Lh!jGJ=dt^@6v2Wj+SU{>{IVBFLXmJtBAsy@^+evANV
zwgep*5t0Ea2SIADKurN1fC6$lXsE{nq$HFBl(-~5Fof!W7z}zK@&iK%_&&A}(0GfC
z$R1Wu<u#ds!EY7=gWn7gXFdai-#P{cKhSv$rmGnk{0=cN_#KdEU=l!d>qEAHyY;pD
ztood5MJhr0Yjef)tsw3!kw`H2*7UdftPYGe)AbBkB{*-1Sb{{is7&`aU^U4(C}IOy
zj0-v;?%YffeQ^7MxrLE|p(jcN(zr2aV6dJq%*4RRz_=w!2-HCkW?~Qm7nHRO4AHT|
zj6WDv85r7Cg&Eg?Yc-I<A1n+Ewl9Sl*MUd2Sr{06Bc{JMV3n^2NtCt=gLjHCfF=oy
zjf5FDftCP+I8D!l88?IXGk~;22{UdM2F>e2t58rYrCk+Nd2AOGW;_on6?THxL+66#
zwY6D=8S5EA?qXzM+&YhwfnohIVa9q%kO(IO!_t|;j1BVjpe6dCS?+9MM#xF=oD2*H
z%!L^nJU}vB1q{NBP0|dETYi8~jTB~V2Dd#yTjE-TA*cR;T6<eTn*!UIg&Dgbn_NU0
z7`K9!T7iVRAwnQ$g1Eg9E~sG~TOl04Xb*DTBd(I990p-VM`;Get&dn37@Xe;Gdh8q
zcHl)*u?@nEu7V(+gWBdhg&Exh7#MW_K>WJhj)7tRPhm!NMh3=h>eFM4SY_(_g&9p0
z7#KveAR)!@DG#Iubb>AK8(~IXaHxD>kOwWx0S~NfJCw=5F#n%0BQI!EP8MU9HUmRt
zt1u%kXrSc?1B2fs1_r+~Qjj1N1P>K3F!+69VDNhdK2}7SQ3xvNAH~4nUmvEBky6AU
z%qXYIz_{%Y1A~7a1A~7S=&A>%5U7;6CRD14fx*8H?3J7wx(p0+*9yO9WMJIR%ErK;
ze^mIR5|ll=O85&XKtR=nO^q;U(;veP0dNF?dg-7^1wICbv?>(_27&qw!cRbE=<|YR
z^@N|8FfeY{2cHTk`~=h>1Fw2c)7E8RD7-0r8l=(}wAZO!7_{J<kpr|pO8tlMR#57_
z!N9n^4C0jSFsJC97TyJ7mw_6@Sv&n17})L!gATt09l<9rz`$U_03OrX!3#QrFZZBu
z7pO+R!I;Iyz%c2NaK91*;||a+1=bnD6F_VsQ3l5C&!%gduqra`5TEX2!m6UVL!1E|
zCYjZI3=COPd<+a3KMWWcmWT`2u!B-C1LKZDHc)&_pJ~FXT%V-Hz`z+GTqh0gXo7}g
z<jx9%(mLZ)2GD4aWPorsBLm}(^}OH=n+-mTjt$hH5eA<r02&@T)h}EGjzvhKVf25;
zz#tg_I(BjAY2gr1V0>j@-0==#LI`*VD+g$CnQ({}=m>FRo&pBpFj)o$ky?nsk>Kb8
z+0LIPtk1~6xYG%uS6>9=1CVk<1&}C2xdm7`Xq@S^uqB8M+Ub0%U)Tw(2I400K{fno
zpm6Ut)@5Mmh!U0r8O+!`eYYvAR6@V73X%^P{yBn_Fjz4#Y<ieu4{DO^e8iKRl*y3e
zD8s<G^AS%bLyj-Vs;@k``6&!Jejux!LmMsr??8=~?1Y>EkmwsW28NACr<<CwYSe$5
z(hkYQjC%@r%ZeGMv@0_(?g1TEsmn2?LyCcMPbmijgNoji4lM?T<^T=`hMn)HbXYPl
z?x_N;kG?vk6MVlJ2LprkfhnD;P&Ii|r*xWv)bJEAOzGxgU}!$X#=xMKIi&}*BnPyQ
za4PGRUeI=;W_30OhQ({A^nnz)fHrk+p8np9Rm||xl*yoTXh4xE)i-4dOj>I4lqn(%
z49y^=QZuGZk%O`4PB$}WmD8$cV_@(PnKGT9fpHIr?Qmww44B?-ttm6XY*7Zr-MZ83
z%vq)DZFw>orYvO!chW#%w3>g)DjukNBiN>_2C+eQIf+kM0}fq~-gRsY472u6*#cVh
z04g$f&u3#`s7amz9$x$^z>}0&!Z76!Y`@?6vMGm!Kt?iv_cfd^n{rkF!WCsOW!!y`
zg@NIS#1uwQz0>Rh8f)3Z$-=<Ea(W7*0;n1Q^~%jur+{1F3?R<li_?8AST*%_Oks2a
zD-dO1++)U-$uNZxd~U*50j}f%D5v=l1Gu}sF@5?H3sw~-caG_&ELhd*_e{xyMf*_>
z28J^$rsQceFzx}dj|EQ2^Mb~E8}pRBNKn|YF)+j@PbmPcTeSkE*ycVv28QD<CQMq4
z42*kaSwI~&6DB=yjR>k8vJ*_0j1{0#_EsiLrlO!ahy}En)P%{bo*#6QF-W2A3KJ$1
zL2z#jTt>8=HfLa%S#QGl9c1u&P6h_vStg9%RTvoB6}So#D;Z1}|41<~?p@DSoSM#H
z!uVH-fpPB^0WMJI)r9dsc+QxGfg$yd2@|9!1@-uPO_&%#Aq5(am{)7U#8eOFi83(m
z1?`3pDllQ<5@BH6yPH7(e7~XzlQ^i9`wA(x+Cf_t+f`pP@-Z;(-D$_bP&LJbaWx|Y
z<31BEP}N|<xIq%cVPRlc_T7YWKPZ`iY}(6X!gv720r}#fILH^EEU6&Oz_`y7<bSuT
zCX7eHn=x1z7_t*g7*BvhZF;X2t4zHosO?}Z1lr`c&(ey4A<4t!FDU2l>*GpJ%4INN
zWEN*&XuZsp$za0B1+od0Jn}Z1Fmi$0Is#lEH9U$8jQje)f!m_5%fP^X-sCnL1LM9!
zyvYnEw?StIKV@TJ*nPwVw48wfR3%j?n1EL^DBJ)QH%t6XmV+$aZ_1OLl)+%KUYvp9
zOfL8Yh3OvFtTOeRO}2xrV`E?_RyR2!#lX1Vl#PL*U(n<<h;1dnlgnVT6YL5$(C&GY
zUEt6MyQmd(tWwJg0|o~1BPNp>K_)XW?$3bOG!<+UPjXTkgUJjDkT@vmwXzw2E*~%f
zHRJ@3Ffj7%KgJ7oSPN)ZZ0_`r)~qs&o2T>Hu&M~|Fv)|Oc|eo{w5(vdvkj|ueJ&dV
zgZx&LQm8wu85oW=o5X->g`EtH2SRw0O4ArjVgx{Gl!JjGZ?j1ZXshB^o&pAwI4%Z;
zlQle`rT-@2k#z8|;EIr`Ov;Q5j0g6CbHY?64RB6iVPIG*Kb1)n95vv@8dI4}B^ai^
zwP9tipAAZxE2c7;!B>AAScfVEN*}ri6`;jI9?DZ0B|r`Z4R0Q}E0kZrFqKh46@2c2
zI|D-`bLKp-ECb^~7Y+u7qT`wKlo=RI^})NiGndFSFxYT`55mZtUTn)MR=+B9AJ}oA
zqHnWZ=0;G6fQsA;%9)#FK^hrA4J~drbC#K4b3ZT!gU;&)Hwg~D2r6JOXPK$Uz+m*4
zF)I^vc$_)QOf67_$e0Pb3Deq~Wu7<#<G~l8BPS-Av&@%ZU_AI1JeX+CvXGO3VLFE$
ztFW=PIm=?OD?nL8n1Rv%ohSq2K~NUbU182LPmY1{;3se?2I9__XJ9<|eY&3=s}x^^
zIZF-LS&R&fhc-<wvt!k)H!x?Z1+9lU!pXp3RA|mp3m&S2x~37?HBAuLBquYNvw-g?
z`-*J;p?+{=n6orO>=$KVJhTWZ)C6_|xUeW>FlT8~2U!nJ&!+X8d>9y}Y%*stX9Nce
z1LNTmPEbUcvzUX1N<kM=22C_)0Uax91X?DfS!K>*VG2^l!obkH)||x&ya*1os_4Es
z3uvJ#xX|aYHfM1~cD)<e^-vcZ1aW2NF_^OiNYpbh9<Jm{1w~AV1OwyYIxevPK!;2)
zfU2s)DNsMSLc9e@W9BSw5HEo;m>H;<X6?wwz+iRCj)5WdmpRi6Mh3>iZ^0?poM|p7
zc%4AE7Th#v0!Q3VF3?Q1InxqJhI+=spG6rM51)cq!!!?`x)0w)6@uCfQ^7Eek%3`d
zHy_9%I|ha&H!{H8i6b6hTQeBl!M2JrFdk6_o0Gxl0XO=H1zac@yp0HAHe3nlJeH=K
zjLYD(!oYas4(Pa$jLYC`1KQ&HDC4>mNSKX*!CNWgraS{feKSunL&hyR28Mc7HU@?X
zwi%#PNx-G!*-z8|Ij}0%hh^LcC0bB{d5$RqvZWA|jdWLJ+<+X)0t(D}lUfFbdI>qE
z&5WiD4C*iCn3jSH)1%g4Z^<#OfO+ev1lSL9Oe^8uI;xE-1o0JAg?1=-Y_aT}920m3
z^5`b;I%qkjGEfEtMUU|+Ii?Cp2F9bCrk{3X)vkXo$5aPyQGz;N)8&|&K;zAhkj5yZ
zUKRsG**lPn)%Te)Fm&yeV*(FZ9tG{|(KV1`iUv9K2nz!P$k<r0v0O#T4023ypiuY<
z8qRI&m16`oo<QeI_e(G^u-bq|yv{pogEiGNt}*~QhJnF<HUon{Xf3e#bUDT~U{^3O
z_#bCr@IS0jkXOVY$G8?`<_!i0|9cD!{-9WJNtR<=$Hl;S-kEt~2b&z|{9`#rQ0rjs
z8>WdI3dy-C404Pcpt=Is85sOON-;1T-z>+t0ko(71_MJteGUUdK!!qU5y*lKpn*V;
zXdMGXK#f948b~{+kOzr%GcW|SgATZqgPaZXm4P8(Ap=9eY;gZjjuCXWHR#yMfI|!n
z0lOdp2wuh3)*HaUz~jTfcruWMfnlkq93yB?5hG}l#ha;Kj`1J3qL*S|h}bX3_@58l
zzhMY?$-ofsP>O*e!%2>b2UL?TXJ81FU|<LYEyDJCB*(-H6O3nI2n>~CV3_b)j)@N@
zIFErLuuqzSX@chmhKVMieU2cK!9<RUMT~**1TQlK(}WBLhQRuJ3=DyHK)h%MhQQAZ
z41q5}oKgmcAXx^6AZd06rU^|93_)593_%*=kRjNKHlQ7$JXu;y2jmzSkN<{_ng*FM
zFa(*{K*nDu+JH`C<H<q{y#~26Fa)`R=k6w^Ffc3jfrqB*JJ>)MoiR=5`@k?U1GMsE
zBIrm#4X8T<K#p0!zz`I{zz`G$a?Dx=hM-gihM;5+XBPuQPz7kVmO+|<@y_xO43oBi
zyb2;2B;-H~QW;O&XJ%l$vxR{nXeI+g&~y;z00TqN5(b8#MS2X(^(yjUT})t-fk8k{
z4m1X>qQk%tw2^@!XgxCnvx)@+L(m=uhM-*_jtc`r&<O^HAkYEClMaBURzO2#l?<TK
zFVNmj&`25sXxMe)76xX`Eewn&1waZo0w7~)j9)i^*293*r!!CN&}Cy}>T?0D_-6gU
zF!2Zjb6g|?<4JAM5}`5%Ck7_X2uAP`a+CfrFka1^KF5_+u^x0B;vNRZQ}aNPUMt7s
z35xVd3=Bcn85n{tLnD1M_y9`~$zUMI<R`|!cuEo!m>CQV!ORQ{!HghIGy_Ah1Or1b
zABa=Rz!2=jz!2;J3fU$GhG2gNhG1W4oKHRjj`N9HOb6=a7#L51#^ynT?!h1<BB7B!
z`3yMHCn6#}IER5DI13!<lfS?t9VyNy{{Y4LWYC@-4X86?K#p0!zz|%^zz|#wa?Dx=
zhTtv+hTskmXIDJ~L-1S%hTy57K%Qa&3FK34sDXS36v&{NWKbZpfrewJcz^;IHDF<9
zulDZ%%>(p<Zn@%+V?4ymz<8PidIVhXJ_d&1J<ucI`gbref2d~wD?~a2u73x}DNs@P
z8E_Cj{A@Ppb#fD2Kvqp~VPIh3kYl_GvZ@GX)ky}1;NwuMCb)o3n**yuvT1?~186n?
zDh#&@!bh?SoEavRfHDJ!WRQ?!e8|ecc!mj-{<knN1Ycob2)+d39AIDwzR$oAd{>Ww
z8I%_$lz<`xtO+SE1ixWm2z~`h{uT`N48h+S7=piocrFYKA<PU6A&lG~7$!8pGD8I@
zGk`Z;WI%F*I5c;<fD=)r9OH9N2F5d8Ap5s4FoXy&Fob{(>b!G+fgwbifgwcF2I81W
zF5m>!ipZ298VqU-A)s@tLAf%-n1Lb05atkj28Iw@?hg!;JU|Yae%FIlqF!6!1H)t%
zP&j}{h6p*PP*w)Uvm2Nhn6y0@7(zgoJb8gQ1`G@#5ey6=VIYnT14BqM14Bq6h!euV
z5R%8h5R#+Jz@(kPJh6j?oq<U^hk+rant>st(wKos_tyu8$vmKNn+(c|I{dFdcFbdD
zV5$doenZ+A7(!Z@8JP5}85lyQFffEn0&%z*7($jXFob~A=_xZXgdAjG2-y#k(Pv-?
zIm5sZa*CaSNza{uA>=v(L&#Ou4-At<7?`6UGBBR40~ekhEU+@A#fgDQ?>I9TBP6Rq
zFDlAlt!Mtg_;m&&V>;*tW2QbIMgxcf8wMs_(1vo5Z@`6Be*^>LtwRiqXU~K35o{+1
zXwV<LYo@=1f$`=J2FA1BFr*n7(^)DQ9KdT@`+FeD&dEZRO)v6d6|bKHy0nmi@f`Sa
zP%Cg=Spl)`TmV!dV<yOjj2WQai>x0QCNMzdK^J5)AvuQ$GNm;^1Zoj@pEDMD1*nxv
z85y&Tn7L}fo}6F;HT5WltqLGlO~`?o`ewS7H>(`y5>T1Tz<6GAdZIV03Tp<43t}qN
zGk|vSK4oA$9}Mn{Yk+pa)t;4O1kElV-NeYiczzZqxP8M|>jY}vaFyg1Fvx+%<{6J}
z;(|0x8o&(`NJD|qAc%pX_AF@jwn|ctu>>?_aef=rh!SIv5g;p)dgK^G7#SGrA$I%)
z?RK3m#~7l@z@XtM1ZgFOfUZRYb(4%&$uWk3n`96>z>Sfl9?<gW?%#5Z7K|SlvO(Q8
z@S>xO^R*cmKrJr|uvrWYA#WHMLLOK^%(MWT$-oe5&cG0=tx#5<n8P5)Xa)8F14C#X
z14C#Tv>60G>gEOmL+A<yhR_8_Hh2GqmVnt$KqX-I6VPgXIYw7r2F45bp(SAGc?O2i
zv(OSS`w6H71gk?T0kfYlfG*U83d2i42p?VovVLI5-T+Ag7eEWNnYkFhfMPiN2qXnu
z6b7XL@LCA)N~8?P=CJGskOXiMJfn&sox=f@b^xsdg)H-eYIgx0gb$u=&5?jwQHpMb
z186aOjt9t$>HChc$<;f6FU316Eyt({?u0NhFkajT>b=V`YJx9;0kxl3)yXk}icL`a
zxk`kAff2l%{qkCid{ByFPzU$&8A2a3FofRJW?-m#D96YEimtB=3}MO)3}KRxHY;ec
z4QO*tSS$lWSfmsK!>q^ka*P~epqpeE7{Y297{YQvcT_vcfzR;<9e5uu!@v+OA;rL;
zv0Dy2k^~mCWMBx_4`5*6n!vz#>75h<!<<q%Mgh<e!A=H-@D>J!@H%M*X5}Rx7^-DJ
z5nT;BlU6{EQHYm;@zM=u24>}r3=HAx7#PA;)_{0>85qJrI=6#3Cm9&RPctxtpXC0)
zPz}CmWV)I^t6aSg1LI}z4bR}IR7OJv(2BJx(22|*42+jMpstXDx#BhhL-=)Zs4F-?
zp~uxC$0*Osz<9Y3WX(qKIm8U%|3I9*3=9!M3=9#Vtv<>p85kmD85km@K@JdrE-_=D
ze%PN?O6CKKBS397P=r=hfP_I23fiL*!NA}eDEAf|ogWw~J}@vas(|`CR|Pac@%2_8
z5?v973=9#PYT)R43%)>=fgvK1fgvIiw5(N7?mal)GB8B+GB8ARDuN4)j}i<Fpv{&M
zOBfg;7JyE~mHPzBfnOOIB6cz`L~IYJXJFuRVqm=Dt`6E+E%zRjhUPIaL>yyah&TkA
z*uN9^fuT|dv~r%yPwopV1LKu1pgK64fg$29=ujOHr<{Qy;u`})#0L<kiGd+fh=C!J
zkDY<>P9Fn9q&5RXq$-Fri-93Bgn=P42wGKF>M*c@>@StmfHj~a<3Y!Jf@)_A28PHi
z28PHC5XXgqA+n5tA+m(~14E?&sHz5K6v)O%L<1Tmc>`47f+Qgg3Q#eh0jj}3RpJA=
zYtXUktC^sVyWBNh1_j2%DWJ2l1m$jn!;c3XZg;`q201)+Lm;bo{R+9;u#jP3n7K|a
z15{~${lHKb!N9;Y0~A{~cc?Ki2nxz&=z>dLhR9Y1hR8-pbY)n9hQ1jXB9}5SL@rcg
zV9>9U%K$H1W?+as%D@nLPz~G>&6EcXc`-0VK4xHuywAbFP--lf2|7e@x?2z{e|;1$
z14HD0b<iQYa@o+{Xp{p3LlkK7s_kz%&;%B!I~f(izz`Lr&cINiAeRj~ocRU=LsU8g
zLsYyv1B2>mxokDik}C#=sKpEnQL{m*r&ul<l>b5M4l^)B?N<jE>^aaLb<{HkhNvfs
z_28h%1qlW)FhqR<ovWspmRZaomj@E_W?+c=%fJu?+DKA-S}q?X=ElGPT7($Qt_ZFa
z3P5S^1_ML12m?d35co7^xptVC3Ijv59JKHUUA-`K9rUo}iVdJLp<)AQK8;6ih9Cpu
zbysNNAMF6Tq8M8ES8M<k{uQ9Z`jHC%iVdJb94ZPg`yqVfvcK#Fqzt~E0!lr|<+uaL
zfU-Xf_2A~r^=7Q{<pQ8Gnt}293N&dZ4hv8@58j_sE(57wu7ma-!&(^SCQys-py^};
zTU_n~G57}K^uQ2SnfeZh>Kh8^s=<w}@&!=U_SmI2Ky}Aqmp%iP2DKHD>ndmys{8>%
zDmV~s%tO-;Q}6+50LX*L20;8$!2)$1cCS{5Kz09_9vI3h##Lbe;op>*UKq+M&It{P
zn=aEQhO)}bgfK9b-D6<93B9L?^#emi2E_cEwICIuI?z?b6%|l(z<Z&PqZWL_V#NfI
zuIapCtm5_2a-j1svO(*b!H4PJIt02RZn|8e5vaMuz!2@nz!2@F0Zz?{pjmTJYR+b0
zh)xHeUoMyE3dvg0T?`D-EgGO}73C8BpknJ87@|QJNKEdMONOQT3k(d=CuA8IZ!i47
zkR4DDDrY&)$t8nAqJWu!@%APLh8SfAh8RT<XCDJYj2;6+j1D^k<Ly%n3^CRW3^C@Q
z8w_q=2WbZ#oW^liE(Nr|>Gl%_hL|V@hL|vr&JPR>G1UwVF~uOx9|ne)3k(b~XFNYJ
zWLH4Wna>1Wg(+UIvjTkYE<*$ZL+U!YXizD4;{$_v3<Cp$2B?&~4Jy6Fr^`hfK*A&D
zEdxW$OGtP`gG#v@3=FYc3=FYskno5GT_Xq*(_~<XRaR$UnA{~73-x<!5CcQ37u4_O
zF(9wkGyjx}6=7h!odt5|CI*Jsr3?(Qi$R=y3=FXw7#L#LLH!O|Z56u{<o7$AU>9<N
z?pKkE1D(lrM~Z<V_6`F>><v(bq{hGy`<H<s_G{4x2J;5+@%x}1BAY(QftOQ*c8J`*
z&I^uG!(h-LKj<u8wN|-cP{|7#m7Uxr7YcE+Ap?VotehXHseOkNbZ6i6>46cfD)oEi
zzym5EqwatXd=;NA=LrrW@LCHwPe{lZGBC{kDQ6GX9mxwWIqi)Y81F=KfKKU_vj?p`
z-3b~wRoQ6Bz#wBFrvz5I9HLao45SoXZz&stngkr+rhu|F1H<$$5v)S>!E&He*BK^(
zZf~$TA}0gZd={cv#u%iTgMq;_SWX6H&m_<#iAUpwRzjD(#Li$~U|0Z(;=7Z;`-y~B
zg6cCT28OsW28K94HPED&&`NzsQjTk4V2G<y1Raqf1fI>l!N5=-w~B!wZW*Km2X{`6
z#=CrAhy!g&5MW@uo21UbptC|~6R5#;gMlG#4+BHoF76KuaVnrS{-8mYQWkKRD|QP=
zfPwLD8CVe9`;6mZU=9E+*k?2Wbuf*b7?_SHfa-OB28Q)Ngr+hwFw`?vePD<Kt&#?>
z8@;Ck@y1l}X&wv=ac3DA;*LVRF%`7H8svsA3=DA}Al{e(+SO3Szz{FYz!1+1^#y1p
z_4*&I9~k0%Aa1$`THeOFn0curB&UGfUjcDieI~?hhH$rKF)&ET3H303V2E45z`y{$
zrS)DB#92My<KGz=;td!W;<Z4=?0^^pHN^yOiU9+|;g3QMpm=g(V7zyeH#4P}L8!q9
z%uXyyXAo)t@4>7GAK59?1R7p<5@le#w*xdIu|lXBJ`Hg16p9FBjsYeQN_T?m+!+}9
zT!iwW&7}Ln5X<rn!IptGfeICXX9ak{78iha6dnPkq{szA(;K5%h3jX7R`;|X7D@$;
zi|=I2QUq&C2Rn*^AwGzKA>I#kh>Z;c<NZ8vn^PzQ;y{M@6b6R)B+%|?CJzS2`#or~
zr3?)5h2Vt`x+~y%3>X-sXA4C_1Lpx#JqH7WkFZcAXx4ov2Lr?63qp~Kp#4&izyZ%a
zfCA_KLr74>K<pM}V7&hsMFbi+P<hY_+?YxsQN|ApQ$iRRn85AxN2in+7!Gj=Nk}j-
zK03uTkwcw<p}w+3ND6xVQ~U%5hWIwnU6#^9(xCF=D+5FP5eA0%J&K^y(}ZMTV(%Fk
z;z4&}7kdbSZ~gqrz>pxuz>okk(C3|y3@8VI!~z%?5<q8z=WP~}0cFIm&{S#=#J~_!
z37RojP|v{ls1v-^R7f6_(LmaA7#I>VK(gBz7#{^Ff@au+loUW);TRYa8W|W8YSkGS
zj$IMb1ue<|X_&#lkN~<e<$|)19!%Y428M+7>I@8>E<$!7bvGCo5{@%4Bpg*|U@$)^
z<Omh3Pq@UukZ?h<j6uj9wAW=414F`H28M*&E*}`Cfp(ASFfcv@-O*xXE941EA|M5C
z85j~?bAMo%roq5;yam*<05#h)89hN8Jee)xJ}^wJ05t)pf^L415YpgfV0;L=I0$qM
zR>BVkhJ<g>Q<xH&>lqjl8KK88few{U<N-C_rp7?FI6OQHGMocEa5J?8)Qw<ZeE1e5
z25A)3fHpQVLFJ*Fk{+>x<iQSNssWczQ(r*Jf=A#c7+8kU0&L9>hI;T3GLNhfdN^!B
zBgxY^P`zdcF^L6q4hjR~qasGeEUr2R3l*;a|D_CNK;>Q?xZIl-15yDp4Ky&F$yCPx
z);MJi#PN^7#}7cdI%OcoPv?zi<*Yvd+Mo~Jv;U2Sku7~POU7gtW`h-=>odR+&-myT
zcogbCC}n%s3N|r*U@!!29RzQjc-*E2nu8Z?5@2AcNn&6~lx1K@6juYSj1z2<f>Z&C
zjtmTm)}ZU3jRc$2K+7;07!p$%7!u?2q?1c37zEq-7#M1PFiqrO{lH*k!@&5sje+rT
z=JXBmtg7`s&|Wh0#1J-+XF<WA0lEt>ih-eOi(ok82L^*33=E9mJ=RafHNXaj3o|f2
z6=z^bY++zXtWjfN@H{6Nt^{@A76yjIH4qnuLreF>XABI9cho_9P6VOL?ifIa(I&|R
zDT2;t7X<Hb+{wU@<jKI0<f_iVAUjzQ)LjAfp^}mr7?Ps%${7S>I2jn9$}mmj$ScV$
zU=RegUKlx;C!Szp{lH)-1M&z1<CE~|d9PW;>LCaF7<w=;KGk7hd{PLCIPmZTv?Xd7
z0g1OK;4w(B3}}gZ1`~%3Xc4qw3InslBapcbP!l#|n6LqA<4w2>M;Sv2gA#{>4C8d`
zL{={OJy5-$;VMA3bAMnkyaBR(dP*Xzdi_%!aQyp&wvNsz5R_v4z#!|xz`zK;jpx~?
zv~mVPDM8Q$PmEb<;Lw+n1BE_greY?8Ah_hZ!N8ETg@GYym0}`;AZQO5IM|*uFeKeq
zOkxm}1+8hj!N8C#z`&5qqL|DeC<`i(Kq9UT4E4#@iYW|&vY@4HAfZAAhU84eR0cs=
zXhD)Zi-94zPce-_P!@EI7D&x$28QIrir`3)0~MVhv5yQ4$*&bNQz{q)!8^}xFfgPT
zFfgR3DKRiK1_~;QF)%FN0ov{-@IjV=*>3&^2H6I1Lz78DP)mS;@mV}G1GC+F28NUv
z28NU<5N9_7LrNI~LrMud1GC+628NU-28NUd5a%)jL&_oshLky=TgE_U$#H<pVp0)w
z;%8udwhE*hWYlX0hLo2e4#=o)3=An>K)R1JFr+duFr+eoIN_HW7*Zt}7*hEeY#{EE
z(*ey}Fc}DX@`ALkXJAMTW?)DS1aWpVFr>yYFr>zSw1UjZVqi$k0C7OZR5CE6mV=kq
zIIo-@pUf&+Z<)`)_-pD123hcEnk;BEjX{8uM_?%<RNMhHzQx2Nz{w}TP|Lu;&LzO{
z1+=U{*HnPx9B5g=^K2Fd25(~ljtiiW{>s9@(6>l{<Dw7)L(N6dsB&tS0LKLIh!rCP
z;|tKd^juQ`4$xgs43j|T_2y^^a7+TFFwmin4txR}pyS^eCV>_ntZ5eDm<j4wOybI9
z5a5^vX0k9aNNyA0*a+jKe-_}_1WGTUr6$ioyRGc&1UTk{s}vRn2Gtz`91A2t3jx8)
zd1ky2;Mf96IG}}grVRBAi#-H596<hfk<7xt0Fs8R8)so)XcrUUa1v%<1j~Rt<qY-|
z3j;&$B>@h|DM(<4xqzxCkk6w%1vtP*Pk#js;WK<?V0=*w@|rOlXzZQszW_UUE!_*y
zNou*51la$AmKZaD)?&Ad39$cF0i78KGLij1I4nWIr*TJs{SiF)9zZN-e*%{0DoA4x
zV1KH>z)&2<!oXmCM}YkqSOTQ6{;L2x=ssTX?cXn@IKlD4entTlFPsbvlKTYM&**{%
zO1^^E9}2LagKOp05MT%G<A!KW<SHpDWDsEAD9yl7wuh^zxPU=`eV;S~Ls1h81H;}`
z0_>3Ghfrg{%MZVTTyR!ffF0DvgBWv&lY!yT9|87>pq1I6gK|MGnEpPMRmFOh06Tbl
z`wgfO-~~QlBbHqjU{8Yi{^cL2Cz24JnC_RxDrTt4z|enMfZZOZ@|8a)1B0fx06XY*
zRdD!%EVBpQ*aC_s>pRn@rm-s3t1>Xm+%3Q^3D*X)cyX)%yClesplF%(T7X>=bh!(N
z12RJjECUT}aN!0EK5)4PcC=TI06Rb2%)6Wn3@)ky?EIi}vS7yWgO1{uZkEo<4|03u
z69KjlFb%H_I2jni3<TIdfVLNaG`Oe=uzdgx#DO@H`=*zrvnr{mGBB)IEx>jYuC0ud
zfuUDJfbAwI!9i8-NoQ4yx+uT~-uC+S1A_`^a^C~gb$k6*8=PR+PD_Il9RovZ9|J>b
zn;Zi}n79DjSycvx5+=|pm!i}X1_3r`(qKs4%)pSkk^2LK$_56;|C-ZnGFWBn=LxWt
zF@9k5%3xsN6akt2Q3iCU$`S##GIa)qD-ReLQjah&r0x-CV78hAR>#c1Ab47Ut(ujA
z@r^e#1GCji28Psk3=FAnK%A`%45>dE7*fA8<TEfP?fJmy^@agtKIqgC1_8DfK4}KV
zuM<BodT#*<d)I^RE*B7Bo2tpc_@<kgf${5N28J|N28J|d(4C)O3qLS=9|09&g0}?N
zrYSQpzS#g$)Xcz;Ccwau#s^aL>G=mn?>k^cF9q19@G>yI1s(JK=_dn2nj!;3nj|v=
zBdF1z7Rtbo7Rb)P_*s~NA+3agAuWSFoPqJPJOe}8S_X!+r64IC28OhU3=C;^K^#j4
zhO}=C3~66L95)7rbS4IdbOsP7n1LZ(h=C!Ur-PA!@pHllM&Bi@9~gao7#KfSFfhK2
zoW3rTRlI%ys166!&ZQin)=voss88zxTGRp#13%CfLq<PP`6D2}Hrtee@$Ed2?-nyK
zr0-&2NZ$ckx&jIUKNV15`GMNi0s?GvKnjn86gD$3q#tEqNIwh?hKvu4ekPz`5MmTy
z16}n}|1N}?f$>un14H^X28Q%=AWl02L;7C^hIG)ju}@PN7&62d7%~Lp85ln;Xk=ty
z{Ir&xf$`H;28IlK28Ik{Wd_Dihafx7KAmS^$e78%kTIS61Eb#!2F66t;2xw^Q^Eq8
zMxMw4-Y00pzyPX$K1F?~XY>az2NDt$U|S#xjd*|1jiQYHpmPHR1lX3CF)+TH2=dEf
z28N6!3=A2IKz;#v+CKyA7exWKr65JyK#H0f7&6u~Fl4L+Df;-~1EYTfSdoDM+Y(U*
z#`l^aFETMOWb9#J$k<U2;_)*uWL#!o$T$!3m<$6$252wrGZ06EfdO=5QKk@xW6Hpg
zsms8SsSS$IPfi~g10%RUFb0Z%A{6W`P!AN6bOR@VVj~cg8wCW|R;e>Ez7GO9ZZQKx
zrX>SIra8!QARp8RE&#jERe)`^A_L?5a*(QK28K)*28K*0kgAXSJ}?F@0NvUr6fD5D
zikE@${U&Ax#*Y^m7%~GH7&3i9oVyGRndJ-&nWYjR7=vOM7$4n&rHdd?cZm_S%!xrj
zfNg^&1LOPKFgv;#80s@SK`K9Xeqaph0J%A+gMooTM1XC*C<EgML6F(A85lCBF)(CK
z0dbZyFl4S|V8~n!avCU;25kVlKS_XXt1$!P2Q!e_AYX1_V94AAQuI;g17olTSW$@p
z+g5G{#t%C{Ch0LSWFBPjWystM;#o5=WZq(6$h-#PcrY+zeqdn8eB;Hy_%ReDlElD}
z#m>Nx#j4D}_%R=n+CJ7WFl31^Fk}gFe_#v-XRGNvxvUcPb3QNzr!X*qNd^W90k*xM
zb9zB#P?kIcLzXPG49e1CV93(YgA`i9DGV$y4QASmFePRT3|S^1&PoP`EGGtrEYLP{
zRR#tVD*-lewFMgH`v|(nzS~cL4K%DJqy{>!CF_a+TQc}y6;4o3Nq{W{#%a1Mz?KT*
zRPGUAOVa=~tyvft<QfFnGK3fy3g2@TB{K-Hfi4eXxB;qXU1tigfyOl$z_x7>D#>IJ
zV2c!CVEnj6s3af61_cXvxUkTlubzRSa1E&T_$I*S1FAj1x?T%qB!aa0C@?U7e9g(g
zu-Hg|%|{d5S>t11DD+ZgV9<3CU{itV_~gyWz%bEVfK5f6ff2&-7hqGdVqp9f0C6Db
z=vwG87XobRpvDDgOQIZKg8-X`FazVK&}asRH0kN<^H?QJ<ptPe!6vIRFwANdV0{hd
zFfuTH0#%<q4+U6XgRB8_J_@kDwqaoW^l18@JXQ(m?O<aB*o3)C64Mz3Sii$;vYjwp
zKc7_rRLh$<39xQ}8TlD>u)MCI0P6-*21YQ)$xeWEqb396=RB~>SwUMS!7i7J6ky#V
z!NB;rn1z9%c)bAYRzU`ayjLs?3`ThZte_PX5M>PltlPm}Vqsutx+}oC1LTGq5Qj}a
zm(MCzKVN_qwABD~`?*O60|O)Ykh`yi+TeI)oeU~HLm3#df*BaHytNq^xDE)gPBsGB
z#lVo&$iR?Q4ca}wM}T!QD23f%V8~j=z>o#nQm>{bz&ZuIDU*RA>m&n1)=^FdhH_s4
z)+wN}{%d(oDuV#)Y|s&?)%%zxa!4^Su+0}>oey&0R|bZx=L`&4j}^eRJnIUW;2#Et
ztY0o47)(J`s{{k%msF^V#o%@}14A}D14A||_Xh^k9Sn?r7(n$Cq=yQwnV8tNePA%v
z0gc0$g4#I(0<87(#TXdBY-46%VmraWkS)Z(kSze>Tw!3yR%T$xmIaw*0jujKf`(3+
ziV<}k#6%CUi5?6L3<3hI%UKy1zp{hO02ye<z>sYN;(!eFXJE+o1Q{3tH&7bYMAi=s
zCNIFnAmdll={1F{s`Wn@n2VGc7{7)hJOi38X69ln0FBC+_AoGU?MKLgj~y#k0H6Od
z>5~9!uPA6f7F4={ZY^H8M1Zx|0NnUdWnjqG5n%0r%Y#mb0?BvigXPT`80H)lV66u&
zy!m<s(g0=!4=sF!q#xF5&|cT%0s&T6Mh3=jpd&>&+XYx%6+y!pkm7^Y6+Hg{x}|1`
z0IM(fqDhdZiBSTqW*|+VyeeTVz-k8WAajBS=ml8K)R0W5H!}bY)<BH_joXQW?VWo-
zfK>`)1n96CkP)D+J_G2QaF8RURFI620uQD@O;Cb3!kmG@Nne1K6J!FY0|3&*DFaH^
z;8Q0ASUExM+8dzT8(3Egu<}VVFjQRx^)sjc6kz!X>St<l2(a7)_0PWjfdmc<cvU<!
za9BWjal%3Y7SI&9dL78qL0<(}wlgv?eiw(T-vde3pbe(;<ONt(gUW%gstgQ$?*v$C
z!5l^g#-Q)MQ00wa<&dyvSqv&)^#TQ0AlH6^j4g$#gKTersw)Ml+b<`;VhS_x`@-q(
zi&^FPa|BrALC*gU+MU3<a=J_jt5iLo01NnFobNy77#R441z1EtTh%UtMjr%0Rk_R*
z0Txk^J8pp1Q|&AjU}0zczz_@S(>j1!*gqPz85lr{*g-A78w?EDc?=BM8QKgCK1&2x
z*tNjjU54yV28Qfb1<*M<0xY0(0~&V8Uc$gopS_6n14FC|1GDN^2F4#*jEq^R6BV%z
z42(Y-!K(mcK%;J;h=^rikT@;C{EqPhLkwt=ZwtsFzu2|GB_8uT(8x2$AzK+3ve#-e
zFc{tzV15Tq5ey93j~N)U?`ktJsObqXzt>=>XArGsV94QOV8~(8W?)$NTY&jJsFQVr
zfg#6)fgwkS6I=o^gE~DmNuV^oM}YYQ_&gVIdBzMnni;7$WBv&WtFH_UIWY_jIbo2(
ziW$^f1g%NRDP>^DDTI!5#KbT#eXxM|fI)!y6Bp|ThL|aky#KQdk-y=2A0)qlfr%xV
zf$`_u>90#!<?0WB$~*?fpWETeK_?zbd|-&V!oc{89i-y}RL3K@66T3MY>bQ<%o9Dp
z>xE-kP|6eV1b7Byj5D2iB51d2ECU0_Zvp1hj2{@HL0up4aO<zBpyg>XIt)zA;tY(x
z+!-0OK<(#DCXQlI$G`xze!u|Q*aW%5fq^-Ihk@}|6389J+)fOPzr`5A3&~<Upi<y-
zn~E7>QrsUHVgf)?U>!U#VFpn45wI0tKFSF0MXNF}Oz06{o()Uxzd+UQgoOgkv*kc-
z1{MYe>C)-?<*bs{s|1)Kn<OClh8a};F+lpsuLYQ^VFvsL-Dz-si2yTrMHi@m$-Oka
zxtvw4ew6@oA1HpIqXW#4eN&(e7sMmL90xaGrx0ilod9#3D98n%U7R}vnB%|)xIqRj
zm=oj~7)otG_iEJ&FsI5hFqAxlj9@TlBU=D&S%F;`ts=l&4?3|PJcRKFlr>qF2rz?A
z)h$^IH8cQeB!oE-*_<E{2fRyV(RTr63$Q~!FzAEMd-?&&Jbyk}fNE!E3nd1|Kc5&F
zawan{<g{voYiMQ*&@nlnBn|2q=RA^TVEiZgfkFQZs1DQz9Z|kPfZ0ZXf$`4^F9ybc
z>dXv`|BM+Ja?KbRa*dQ382>piP2>R4zDyIfKy(!73=MV$#((Jy47ouJ47mZU9~cY*
zKs6)-<DdQ0c`8}uS#v;rvgrnutSa>z7#RP22hH?V?{i>aD0dfN76XmAef_|ow}gR#
zQ3m9JzyBc~5YvZvAUBbLAs2Md7~6aSW-;i(v)n!ghTIm=;=j29%n~vT3}ws=47n#6
z7;^W6_tXe5t8y?f{{0UcZ73;9We{LilVxD^`zOG_koT2=A@6NDc*KcW7aY#a6T6w^
zz@tvgdZ6IF!8~yWGc?14_PK#Fe7+0=L%tO22L^o`i1+?povv8LssLJIn|NosTNSH@
z(LaG?1_lOW#wL&#%a~Oe7*=r$Ff)PUh>?NuU#So{YM4|&KH~&M$@B$PtZLz_1ehTg
zN<vdJAIK43L8E($DFRF%KqdV@(Ei@@dj*(4>*u7TSQr?1IRuzM`9tj%DAn@(5MVk5
zx9Blge!6TmtEA;#0j5i!k(UzC7$6fU4?r>stET`H`1CQ*4$S|WkaW(pONoI&nID|a
zr{`C*s@1;{U|I$?_XC46Xz}6^P#pdLY5}?;L4au)bT%emlYt>$RhxmK(_4UP8R)Rk
z8w?Ej?hFk1&KBU1W?JUN!1(_w14Di~14DkIHUk6i5do%U-k|mY14Div14Dj?90Nn+
z6al6c(hLm6B1{uG<QN!sYi$x>g5-3ji3*S?VS;9MhWw2T4EgIp14lOCBxYB`ssd`5
zD^v<FfroX!GBPkRfI10tO$C@{fr=Ptc88pn2hNQ;X#z~(9kU?CjDnmD3?RiZpkXr5
zisa2a0!(pA3=9>_Mhpy%wrm1SSv(9(3_bh|43<6uOyI+@c7ir&+iehF%Hd(~VqloW
z#LvK>QX;^V%frARC(F#hRZ>vQAi$Kz&cMVd2#y8F@eZJ!hs^>^pfd`<w`<sc6kr0~
z01M{iXie9yWtFU7CBOt~{4u~>J{g=gKm*xbPXw6CL8Hz)LA;cD0VdE|TZTytplj2a
z7=js?7(w$7493i$HM#sB1(+<M5h(*&IRuJGCMLy91_u7$0!)_R5*EDqHMK^7$<hc^
z+%aY<)EB4bFbFU?DljlHDKaqRA7Nm~-=&b6m%<>x<OJS?$H0*Po`E6%E$AQ-#<x-o
z44{y31!e0=3=9RV3=H`{L3bX!7hrM&Z)#^?C@^DSC@_&?U;z2R3)K4G$-q$H!oW}f
zy7g~OvjCGfOnXE<14BWGLMDR%lRxB|WQKx#28M!6KL#eQ{0|H=J)llL6N3Pgw=^>Y
z6X?w1f=&j8f>w40CaxX^hJyJF3<WbG+utkFR2di=778$lfrEjOfr+V|1+?x_fJuS_
z#NjF_N@oyYl2l<}Vww)gicIy8;aE`dUMj!@z9$xxEZUd_m>^wI83qQ>QD*x*L1u#o
z=qG`+gT_mZ!H4seuT^DWSnn&q_!nj^vp6RMgL1h5<6rPbJx&IOmE8i2f5FFOa)P#L
z3o!l#m2)?Qii-IQ7z7yq>45SMC{rGp?qAO;S-(ku3DWd}x)QQy9u&=q=>m**z!rUA
zP`Sat06wLWi6vQ^fk8n)fbkBftqzKpy$lQmTeTS&j-MA`yaTGvZZI$uyk=l1c&g37
zAgdw3co*b@uM7-@pwR&yZ3c$8dI83}poaBMhI)oVO9qBQV@?K!eVqb~cbym*QZKG#
z<Pl)J&&t5WyqlkaL8(N5@qs)8Ly<2ibAa?d1V=O%LwQkZA%g(pBR&Qu=E<P?1Jqi*
zCBXQBgMmSP9;7!p)lh)(qYTK?3=D;73=D-)atsV6X#$L((vRWB^t1+6Vd27Q3=D;n
zSU)hRf>-1+FtM0T?`dF_V!Shbc>}9P{dxh$6VQ+_N?>4M(qNp!z{Iu<T)Qxy&;XUe
z3=D;v7#IqdK|05bC(J-S4+e(9j|>cjFF~P`A;5S7wD0K#14EG_14EIdHUopoKLJM2
zjd7q_p(vDrp~zF3fr;(W2L@vXP(2E2b211BFxH<HU|?c30QDcgFfbI&XJ9Cr%gn$8
zIt!#|6$3-j3J`~vfuU$C14Gef?hg#cJfO}asD%Wc(`N!rt7kA3b1*RYF)*=9e_$|{
z03~+j)dGy?LH%5IT?U4tBMb~h`#>gHGB6Z9Wnd_J2;#UgFcj7QVPGiw0pbNSFcgb2
zFckB%Gcd6yFfbImGB6a|gE+Yi48=(d48?IEP89<~aXAA+aWRO~&cIMSg@K_Mw115q
z#5m2sP<#|5vyg$I_yq$)@gsQ#CiZoe3{31h85o%NgQRvbFqAMeFckj>aq5pVFqDWh
zFqDXbcvl!0N=z9TO7z7Un7F2YU@*P{I+u?5rT}BFC<7Cl4k+`kU|=W-VPGf;0A=1S
z3=AbX3=Ab{Am4MI`@moV>Xk4szZGCyz{$+O#CeB-p`?R>p#-!`iSs1`L&+Qlh7!=B
zT%6w+7)mxUs4<j)PUYfaW?(2e!oW~+0A#8F14GF*28NO=bsrc^92l6`=1l+C#4282
z1Dcrz1${ku9~j4fkn2G8D(5Nz#slC~#0ZLHa0SkIzz~#pI2jncYXuk&*n<;|Dg%Sz
zb^*p6FtzN`5VbqBplZ1e2r%xH1F7X?U^t#3z_=4Mi~$~NldnG{z*q{``4FPB6j^5(
zvd%KFPEJTtECb&T!UZm;8LPqNGz$ZR<$D3f8gTgxJ|jzju?Bn^82CgH0mfRe4EW$z
z0mgdJHFMx0r_$R3jP;=Y;0>-a1_8!(3Jgr_4?&fS-39^1MsS(T!oaXXOn|W$l$pPR
zRZUf9U}As90BZ77D)BKeRJ?FtU|6|LfKdkQp$`ms4;UC2*MKq~=iWDrjJ*PkimVJw
z9QyX4Ge-m%l{6U`rnk1R^4IT`VUPoN=NMJk8JIZOK#ezuw{*eY0yV7}7)l;MsuM;%
zuqPN8N<lIFUjbYvG3tT6$-q!5!N5=|A_XZ;L6cvgZfdCk14F5n6axduqXuA)GBA{e
zFff#YZp*A+$0@)F>M(#Zc4->}Ln&yjNkzE;BWR%pXd_AKLI#G?`QY9nW1JKNL-ju9
ziBp*a7#KLU8JIXhJ5)dcWdsf=28PnD3=E|kr62)j3l1;_hSHM^45i1V7#Kj7fzNRM
z%D_<ioPnYAp$(``oBn~J0Mt-n;B*jRv=xPBi!u%dhBD9|KCUec44|Y?2HKVWfgxXl
z0W`qG#92B0Tq~<M=L0Br*7SF+tP-q$K;6OV+-<B%&gUR4(*jVV(tM==BR4N20}~gh
za<lXiVB`jMw0ClX7TpLiavQ@EX^sFRw=JlJ1|GVdUeLxW0%~8?pA`Ua?-8vAnE^Vg
zXHByJBLirqKX^`^kqNXpz!<d1wd<U~7f>?T2~wHQ!N9PlS>Ow3jq4<yOa_5(aCN4K
z1YUsDO#-Q#&H-**y#UQ^?gXiO1y?tx-a-IUy@3?&hbX)QvKg%K9z<aT1B05HKmo|W
zuOAq6K}F34Q2OIur3SilSfD_Sfr)z+14Ee=14EgK8mJ*IPyo83<0}J0Sv&(nS)>{`
z9Tv)h29+2X$~qVr%0P>ZqAIck3PI5WQn-wPp=^;l=&&t;N>HQh1_MLcAqIxB1L_P6
zfvN)4FtPIt3}vU)K}Y!rG(nSW*-Hk7vge8=3<52(3{2eX85qjGF));UV*S9NX9DhC
zFmcbA{-&K(qCNw}1s!`o5p>Np9|J>W42W2w$-rQ>M<597M@9xF?n`V840EytLX<#k
zP-e`&smZ{g87ANiR{}Z@<@7TFSCEpgU?oZs3=CVA3K)Y@?AH$r(x9tHK=&>(@qj{L
zd82@_mLjMj$iPr8z`#(>p~k>4Q%b-Dw4(6_14Fqr14Fqn_Xh@P@NvD<*LJW<)OVz2
zLRN1w@oeHv$}M0>%~WClu?sSj8B#ON7#NZ`I2afjd{Z;+LAz2o7#L>cre=W}cV9Ue
z7&hCbW`UX`Aa?56)GSb=2<+BWYh4Bgmx9zpHU=i1FA$Rx)j=jhOiMHbO*wPagN;kH
z1#x(j3JMrf6TLue(D89{Pg8xNZsYZZnBc1dH9^-P)z<>*wmsabzD^*wu`w`oHm8Dn
z+@N#M<_M%h)?u?TFxVNVf{Th9AcJEzq`HZM3}Rr4;mzU!``SYiETF=`P<ubsnwNoz
z_araqY^PLf4N!=3fYL*%wIP(<;G1d<S{4oR_Ke(A8&E3&#Gbq&)dtjL1F=)jPM7au
z7318H!otDJz{J-y-L8vOj?s5|Y!|DphFuB^H~0iI76u04V<{}$(jeb}*0r#wu<&q!
z!T@xepV;(GU98qzEvzZb?|B)R_^qdZhZrK(4K{@N6Otj!pO6e;{)}Wub~mdHr)~=K
zHINx!rf=v5JLEjnjGM@2+(b6x7Lpk%J*+n7FH)Ezco~=kc!dfXQkWy87?=cP!L8`8
zAQq?%YHZKI2T~x(z|hc?!fXms9W;G<539O#dkV8Qh&w^3Ff)%Kg;`q_<Y!I>hBM*Q
zZ}zY%t81q)fm|rqCIpgax(2>KQ7FH(gdv6LngS?HI2jlOxTh=kvd*X%;ALT8I4+&S
z1akg59<EG=6sB9CO#GEA3&aFx5*7xA2KE%D+h8Ap&NW`PGleOamw`!0L@1+_A%!Vd
zkAWcxbUIv9a0*kdIn<7gPAN=znjqJ)Ffa&RPhkRYMf%E>&5*)W09u6hm20|HAFG?F
zNeYuM$h0L87lYEL(30s>`&gCPR&p{hY~`B1ua7lG>t_m+6xclsOv1ttrBVtEOhQW_
zj*tQ+WsoCwx=(lMXSH@pNn!jCQ*Q%S&-h;rq@F96A%%$%>`R7R1_mCM6voFeg&h!u
zkHH2{KiJP|Tt6#?@is35lki%I)NMtO8A1gNDU7#GK)wSVot^$Jg|QEs&qP3%N_U)3
zVeC_3U=k@50u=%&jD40MwVa?*Ace6HoYgo%`8I{IAGB~9w9aI+T?%7AsGI?DQqQI^
z_Ji6ya$iC2WdwJKL2GXMLQ)tff}P94z>x1Wec}XGmHMYCj1xgs3`l_~PYUBikj}4M
zxrr4FDU6^sLV=q>g<tYPa|Q-6`4q+uHU=h<)tn3rAa{0Xg4_vpT89ZV`ex*&Fm^bA
zI3N$&#iTH5Lp>-8x&aKNQCkh9Q7EZ&y2(V=r26M6jH+TF5e6nvPZo&T>QZ2VTm}X&
zz7$3Yu)7(UM2n$TOBjNrLCKC0w6F?tY_|UE6h=N?1}4#&P*r>ea8&}3XtQQuIDI1J
zIMg^X(9wn+yysJn>wpw;FfgR>Ojnx3T2>#N@=}z6Az6qgn<3>TIDkOMCpx9Pl4oE@
zR$^eVW?)$QIb}c0oMsNNtM`KggeTdMA>|<0KAvPFhLnSl=8QE1L+SSv=p{W&VhbQz
zc7e4p#4#{v9<u()XvM%#^2s`>o{^D(Nqi;v<TUFH@Yzso3=F<+tU)uU44}GcWtepq
z_*_{w28MWTYf!idsj-1vVO;_aIv!BTYF!F0S=ksEoGYx$#Gq#8YFn2}Gcbv-gC8UX
z8aarxe#etk#9-YZ#K2I`3Od7M=}hY$@M*DZ3=C_QTla$5;Df}hK}iGbjs{=rNuY)V
z$W1eHttWxgBpU-mqM<cp^aXSXnXC0yaB#3OFhp;)-UF`K*+BJ|^<J2`@@Z?(;av>i
z`YW!!mJj4DD+UICHERuUV4MLvPFsk9fwcp)Yo@HgS_&-jlo#Y`DH-r&UIhb##|3_t
zaK;ae!D~R*NP?O&5~2`~GJG=h{J<D|f`Lf_boV-FOG*U;!~V1UEWRN1poJBn%>qmk
zA@y(#3dN~~4E!tsV0SVwlqWDSl*bi)U<_UXG6gg_B=nu1MUn9X!}$~j21d}`B}`JY
zwHX)^!}(bhAu-QTUdX^uo~e+T%D~T}CCtDiHJgE<d=Udf`MmO^A_jgI(6UC>4yK75
z(hN+}Js%h@)Ps-oxd57Qso`fa<z!%zVq#`slAguDP=0}dq5K>>1C#V}28Qyx3=HKr
zL7XiN4CU_`7|P#*I0qRR%KtGil>d=uV3Iy34Vtw4z;Gc0wB_;w==dEEe&%<q3`~-s
zl^x%d85k;f85k<KnHd<r889$ZNHQ?gSBQgnVhjuwpslH(9l_sh85k;T7#J$7pc6S4
zz!%Jc&0`Q?wE)fITxeln{Qi@HNwN|&En)&az2aL4Xu<u39`IxrlO$+4HR!PHpE;mu
z-3x1=6J4MUIhl;MpbMjzKh!h+%mGcJfM#Ww`aGDqm>_HEFW4|JYxglQNnU}jnEwgh
zA8^5if$1v~1C!(nP`4Cvb?1c`kW!d33((rFVg?2VaRw%7j}HtNc7TQl#18VaSc3xB
z9u&A?3=9=M3=9=s@(lG%(#hN(7%uEVHlqf7Pr&&e1}3QmtREQ8gAWH{V3JA)Sqhnb
z2TfWracF`3d;SMVF9VYlXn!Wizdzo9mW^K!U|^Dd4KiB+BoA{R3%E}h`#6??;mBNm
zmU>>s4-Dr(8<D^xkJ29C9veSwN|K=>lYyZkRh)t8y444U^PqJG3}RdPS;RFNn515M
zF)&^C0XgB^0gx38OwyqB0bnQ001KaCV7eZ~z$6ViAp|sW2J(ynR4M3cGgjvM4~#z^
zfSh~YhJi6=CHDu0^C2JwQ0M;G06vCHCzhXu8I%X5K{d1n3qK1ps3^F>Rh-Yj&%y?}
z$Nng&59M%)pZO<P9jKbUD8$eFQx<e6CP+?UB|r0hupDU3i(@fA^L-fxhI(OP76u0M
zFn;Ez;Ecz@z#w7F&-@x(60$HbWN7d+gU%>p04-=Ke9h1N5u^+}wyQ7C&-?{qHOTza
zQ~8;9fXtVP;e;5n1LQ_f`4!>C&%6WFZvs_*AQN|i4dF^EVwm1DgO#WLH9zxpu#hMN
zlZ+2nE-0@upA~0dl8FH?Wd>Pw3u+Y~=)?p`28Nz$e&&^o3`{apIT;u>sPZ$fRAgXa
z1T6^xc>ug8ZxYA`e&#ihqRftgLFOnwXc~@5<`WA81CJ3uGx+F`uk~D@qmKERTO}Eo
zWIlo1a2|X#96xg#Y$p_x4Ct(F-4$>l&;SGy7gTr0M#nNR94h2z&SCt(APvg?pgng?
zvQC+xb2<5$bHIfZcr;ssg`XL;kzDWyW2Qn<eQFs4KXVDRysD^WV5q2O@L^yu<mP8K
z6=Yx#7G`8%lJf)|?(4<RY^o1B*^GsO!F4%5vpFc(zCzt^1#`b_AJqNUaQDkD1fLGe
z&uqg7GK)c!fk}1?R8>8avg1%OB%xbSAvc6!Z&?@^cKYx$`+-LKzk&>tW57@)2TEF?
zFhXdQQ-i7sgPSF1$x;tGWr3d=Dh3N#C>PZ3W_-%PBo_&8cl&@AK6J42Gi$OjFv)?g
zf+)Do&#Y+<<xEWCXV#JfaiC$M0}B(m1yHMX5ms-82-Pz~#b8!Lxu8fD7WQFaIPi?0
zSq|K`Vq{>F2ZgzzBtNs9F328E28ILQ_?hKELlUrvP=Hw~F9NZFSrKljygI6o0BA)B
zD3qW|K>ice;b+>-$iSo!&ceXZ`i!3myzCs5dt4UtGo1rB4?yQxmh&@#Zs-9YVd?&x
zpXo9vHGpOUyp8#pu7WrqJ;(m@Gl5T^g*uPv5!iVw3=B4(`I#Pp3Sn@Du)ogF1U@+Z
zt0)7L{27QdnI0otejk#An4Z9skUS_O>8{{MQl$X8x(P`L6sCSx_?f<eQ$Gs>gQhG$
z(_b)0lz~aXn1z9%9^`#aPVm{1ATc+H)yz;KkO@dCz?(WeqxqQ@fyWR&Ft~>>Fff#W
z+8>IH+6)Z&+xVFlfxD*+3>8xt7%C=!P7wh)VF@@y>irm)K+OpE5YRpqwrGB)`X!(t
zEk$7lhKh|03>9nH8JH9m7#J$fFfde{f|mX6DWIJwZ0Y<=GkF=96kafc%YKH6>kJGP
zS3&iwdkUzqhpsP?f^38ZA4{{!hMx(%APzK_rwE$L1-WoCXfE$7co>v_df!}Dp88IH
zrgpH87?>1&z$F(`C#2-cWnl0-#m@v;K)}GHm<5rog~*ySFerWIXUb<}U{VAvcGETB
zXUYe!!Qup+2hGovuMS!y13KbJmY*pfGNM$$z`&Wq&lJn}fnh$VIo85hKZk)yX_qzw
zgJUs2Q>-kg)L~$#c*ej`@jx45POJgQ90mr^g;Ev&v>6!0W%-$6LA$uWGB8xiGcZ(2
zx_n@m4_Zm5!oZ{iIt8a@A3swv_%vz;hDrwphDtkW2F3*M4-E5ffMzA;gXV%5_?gmp
z8JOyoEW8*P6Cywr=lnekOrLKuFe&+h7v^w)*OAP>06L)#)C7PZ0r(Ac%PSM8wIR*G
zq<j=?EGw8~VBp|q%4B6=Qd-Q+z@&VgfuYiyfuYh9#CgKNP#MO+P#FR`b!Gtz1C#P6
zM#ijqMq|*Tl|By8I0^%U;8K33Fh&L@rT3hWAOW3MFDwiV(lBsPK!Y?45(MT94Be&t
zO#X}vOv)-yP5z3YaD-~|HvxqoRFgk=fSkdcfnmQOKa)En12dCy$@H1?S!GOC%kne1
zgJ!EiW1pZfcGm@s`+%~6zC1sZmn^8BV*qJAl*7+t3$pL%^q2ElW$QsYZ9$C`m`+>J
zvLx`u5FninP@Sp_4Bfr_Oy=NB0tyk(1XkOBekOC!m?fxhdtnzplR4N{P{VtcJU^2l
z;|GT6poabnP)1Xg(gxRQOoCuD7#J$E85k<-K@)l)2MfxA9L&H_Ih}!_a<VpP1ec#l
z5VX1b2m?dqRtAPj(7j0@*9uyL!i0gL@-hQM<#~mqR0e(~QE>6Zz)<;~fuZs(WGa*4
zb1?(MEO{vghRPOxCMD=*;wnZ4hRUA`;M$u>S+X8feKRmrsWUKCDZ6}N0PS990BuY@
zEd{P&m{cHT8AFu=14ES!gE#{-XdmqiP>3<`+~Q|4W@TVf<pS-S&1PVz3T9xa0_`-j
zC}m)%N?>590_`-jXk=ihDrR7)Dg<Tv>1RNDXhCgoP<ytXfnn1#e#UEz9~i0^FfcHI
zZk%LN?+2anG>3snb)OUi!)Y#l#`~bc?*;=yRXqbkRjooM13%+qkkD5KhN>P0hN=#i
z4-7S+c_jq~Ce>C2&~X|3j88!|ElAS>28OD6piEM|1AH41lj=-xp0EHPXjpv#DhNL0
z39`+$`VL48stD9B*Lwefp(X{?F6Uaw&-jUzfk`choq<W~4+BHhP6mdmm7sI^*clkA
zKmy;y8JHD+eqgAL0c$wI&nU^uz@(<g%)qR~&A?Et#=uYwx^`PhjG>;P+KYjq+6Cmg
znhXZ!zyby)HPD$WpeFIhB~A=X#xEERK&{=H6%5SgQ4${*Y6}>c75hMr(oOroP;&rO
z$Z}oaXZ*~{z@(nb&cLKw%)n4x#=uaW0^-y%FjOC4V5r_@%fO^Ng@J+VI|GxtD@bN4
z14DKF3kHVjM<CvO28J2|28J3IS*YW|y%27G{zV|S--f!q#*TrZ#tg&}15GY4Fx12_
zz%+nXl`wEi^DmWQU{VL&dIj=qO%nq{O$|)LTn2`knION`K44(dUCY1}udV><{Xq7+
z*1mxVs)KrGOeHL!<Wl<wBnDPf0p7A)a{>}d>dDXs|HlnTp;XHQ3MG)nnh?<D<>~hp
zv&stj@iVRhw?!D3)E|Hkzn;#!gjIrTwJbm5MlO)xbp0i)ijp6|?WO;q0W>ECen!wr
z2xWc-CJmG6nM+vB>u>Ng&VY`pXas|e;b)wo13r}8jDev~jGwUwYKz8nP6mcuKlvF!
z$1{k6W)OD%=V$BzO(}z#7a)5lg6-uhVBlw*2s#OkpTUfQLHY+jV*|{L+u-w)`57C)
zH&cTq_dtd;n1c!mNV9^m6=6s#+>m)G{EVRW8Vp|<m^5{uhJdC;1VNh@jaTtA7J!Ri
zP6mcW3H*$p1smYz5Xe<k2m`Ai2Kq2C2ng~sCb2RkFn|`iF=-Y<jZ6Yxz79Gl@F+iH
z63obRDg2B{Zb)v-1{(?TU6&+3V+7Q9nxOL5@iISSgcfLRG`LAP{ohhn2~dg57z5Gc
z!@$tS!O!Re*2Boaq{RTW+6Q#!9>_NbzVS2qfCt=#a!T_U_!)h`$6-N(Cm3Rk83TiD
z89$>l*cb*TEzk;5kk!thBRxPTNP~Rt4pm#vz@U)8&u9))909e`9PC@D!FCYEF$@e<
z-u#SuEDQ_`lRhv=g9a!;M@%zm%>pfk;N)inPfmViW&XgV?E{)%@nK-nngva`A5_5i
zaf(auGlDlxeEq;6b%LQDa>*={)_ZLR29a!jMip^Ld0(@gfuUw2xa<Qhg#t}()?8y?
zs5u8RmxF;xpO=v_i+N%U8~6q|(Rciy-K0#~3S4On{ESTC1~3<>;A8_g>5%FO(RZNZ
z$TL0oAAtN^|CNDByBvJcG5-T_Fmo_47$4<-01jmi28MGf{13o^%$uB1%)tLp7o;9E
zk|xXl5*#c%Neuk2MHv`kz{}^9XZtfSgmmzq0U7@F14Hi=1_lPuNoPztS2aL~dhnky
z1|KEBQ1hFCq2_bF8n}0G2DG&4D+5EV5d%Z5h6Xrt&wy6<gT!JP7-~Z`z}ACKY}77i
zV5se6V5kLMO1oN?|0>uSOcOa2lNk7~LtMg8yPkoecC9f3lU~pVhTb!v6H|LZC6)pI
zHC6^Dog>T)OnUhY47K&U7#M1IfOyFa47Fz%7;2A!IMoacwJ#YMYM+8Q?F<ZcEDQ{F
zOd!r=28KET28KF5(21$@85ls<1l38heqiXm0X{L6NoNtLA^{J=fJ*hREsTsApcU1S
z7OxZX>8ZUx7;Krf${_<yj9)t#8Pl03Mu5&~_F)2D^vL~zp^pK2ekv2_u0sO`hK(Bh
zd%<A~5})q7l2u%`91<M|!QlXkj>C{Zh+tqidUSf@N>-8jG&OMQ+AIS}Ty;7O40S4s
znGF2keJfuX80rEU80tV9C8Rc>r>)ru{B59N3*EImX$<^b;H1Tq$-oa@hzmPR1a#!h
z>;wUx6b63K4(pgEHU@?Z4*W|YP1|_T$xz3>@|Q7!mMMN<kOEcS4xo0D?k|nx(jo@_
zGC`0G14CT}14CV2S{?&`nKWp#6Jw@gE(3oBC=uUaV5nQjz)&|EG()ZTgFhN<7$Yc(
zrx&kc)i5~99|Ovgph>rLDf}^@GkrjJX7DF~oea|D-oWn<*R^W;=~b*6jNhhzS;eZP
zrO9s%lhNk|-@w6d4K5OSK{F8i*5HO82Lppq>~x3Ktd{ld{EA@p9~dO(FfcGwfIOog
z010MA$R2Zsy4?&6b=x(HONtoy6}6#3f02Qq?lfqWy?LVPa?mJywW;ZBQ26SXfKHFm
zmp5G`4r#yoGccH~G;ITQd2W1Q1YOPyz6*;<f7?XHdIp9w4W?~^3=Ai0z?Wgom}v?c
z(qh;N9u+qQFO0syFoBVQVXvqq;~Pdh1_l;gOUA>D3`_>HpgY%QS%Sxc7`}pU0<dJf
z20m;@lz~bA7r1w6$#@;o7!+k-G62o7>8^ka39#sb+KX^Ls7t=C+LAE`WcooC28IO+
zmW)N53`_<fjz{|RC2LsKObVgqRv^r6!4#T~A~gNq8dho3i=fez|CWr?psheb1_nkB
z1}1}x;2Jz0Gz<|n+ns@7-c-vgpy2w-z+}if-ES?ctkiVNyC6+Bz!N2IB9?A2d8g^E
zYgsjP587MWGcqt4rtyL<^s%%D4ax1~%`9NBv<GeP-U+&MOEkgK0;HyU`Yn)=ahA%U
z_%eLNTa=&6V5uy}zz}_q19V`>bisA3`t|ab2K<m1v|?bWSC;7psWwvN0JRZhx@AEL
zor8fP!$zhXytxl_fRKSqFBd4eL&|CJZ3y+spt%L@PMK=3_8f@zYDuVeT?3hFaD@iG
zH%z7)e6kN4=nkKHnOa!}CZimvS)gNnv^zmT6d4e~z_91D4Cqc8&>63~po9xLD}~9J
zRSk55l1!d5<i^{&Hw+AQ&ooksOBiJG^g%T?14F$414BKR8tB4XnLJS50v+CE#K2Im
zrw+1JrU+~)14Dhi3j;&FlPCj|(OZz$R>%}XZoB3Fz@U2ovMd65iwWo)DCusQP)1Ok
zeqe|MW#I-;ZZbZj1`e@MSxC;Q4`g7d_f=zHSe_&kst!`kz))Wb+QFg@c6>Pa&Km{>
zsrp3>4E6KWL9<jcklj-Z44|Fi^_!+&U(YIAU%#J$p?)vx2Zl%&1|}0D1}0-rUjR`?
zGt_-xh-_eBGCl-qh=NM;3`Prvq7Mv_Qy7>XghAEklrJ)7pwpv{fDC}djF}wBnH&rZ
zXA@=2G(nS&Y+z?ufStt#c8v|F9IFRSQ0W@TIDm^KXe@!s&naKPc~=IsG>73UC|u@g
z%jhwJqT~ZZ1Za^*3@BVou0X;?PYPrq14I1<28Q|*vJ6Zne?KrpfVKlLuy@E9@Gvl$
z913J$GF4*$U3tmJz)=60fua5_b3Fr-sT2c4gD?X_12;PZlc^B{LxULuLxTbL2Zl%q
z24+>rpaOWe4^uG<sM8O=eV+RRL&O8n)Cs)hVZgv3`&>o?>_m|L91ILPJu(`g>k_Lu
z7#J#BWi+fn&IgsfvQK5CzzXXbL03#elu9Xq`~W(#)IkQkXAD$$SGLMXd4sg^fT{)=
z8E^oCu7c9;mk|VI22;?{cNc|Z1m!`hKxL_GuJlw!T?U3|4(UFS@ogLo4C{|c_kjxv
za1N2~lL03gD+Ub))f(vlkU3^d5M=?Nt1vhq$^s-o$~Zus_vsRwSQYDE@}x3I$4E0U
zHixq@F!-&Mjs@SM!5{z<FG3P8gNTE2ZG@OK=!!fhGb5f%25C^smEkK`y$h0hSE%|Z
z1_n7rX$8g)44Nej3=9WAacuTnBa=Z|L6CtV4%G5%2xMSr@Kyu+NkIbSKn8|}G6sf*
zB8a0EltE%(M@uV!MkQ`Qk`=?JJdojvsSMIu;vgR|Ff>eMU}%`g{eeOA0RyvA+jOzb
zthTz(rNu$kYcMb{_<*c8j{#XP4(d^VWngHy$-vNX)$;>`W&v1B!)8`_#)9b!HnS?!
zcYqezGcbs~Rbg~w{J`kB0=9P9!djexamggG5a^`bX)27qtPD&RhU^TCOXf2$G<;)V
zX!vByz_?^J1B2ie1||z8kjxqehDHtshDJ6JX9ojAqc8(QqacWLgn^+^fq|h>hV=uZ
z=MV5%T1@8kPe6^WGSKQz@Kz>9F9in1WfBZb=06}33=$t0y>u9uEHxQG`W}GJ#bRKx
zkOs+e{%2$aT^7v!fzc}jBmoixohbzp1Z%WmV6w1gs9<2&;HkoB0P-Jb(gNIYvDB1i
zVBA-K=mVo?186h6X9H;MsS2YR$di-g85sAS2c3Yh?>30}2t>RC5kKS^827V)2m#P$
z`UFF;evs2Z`bAVgJrO30E%O)|7!&M3mqu6`ePHyQ0=5Cvl;%)jv|?povJ|UgV6t>z
zt7rbeaIs{5AOn-77lSeblVuniL`0r}$ub#46o80Y5YYu9K*ue3&R}4&0v&3~XaJf=
zWb~{6g^vW-C5-EDfVNy}`>QZ2F}`DDVCZ|G@*k8}tXg@~7*zg)hfTr9_^JE{-A*J3
z>QDt0s4z0}Ffdtx>TdZ>DvaPx2WXhRu1bXwd>%N6leJBSkpn#A4!T|Hpb8@=jMMo}
zg%P|g;-x49ljZh!28J+M6-GAD8RSnvb0?Ok;u#neCaN&9>4K(qz(RN985pAK!&DgA
zLGxY^Wgno*IN?H8%<&8iLVHyhg+SRKtjbC(o`E4)R)tZ>9A=o6W;_Ff6^9C=2tt)j
zJOcycFBL`+gew1d1_n1{6-F^3n8tdmq<98~G!+#_F}TaDO5+(APL``MibLEl0QHUp
zXmIf<14A<-1Ctf#jvT=w3{ybtRz8qG6a&K{JC&o1pa^APkOrNV&y;*gmVqh74=lvQ
zz#w*3<pe7OlZ_Hcbl(Sti%04~!$D%VR0>%cn5^EgGccu`W?*PEVPI%9U;rr!`@nE%
z4QN<O?4wE%NGqE%15-*e8}kRI?4$FSFfuTu<THY_RWmR&`Y|vxdVs~+8MZMpFk5~G
z>t+L!3=9k^ek!gEOevE;FkIRJO6&|w))5i&KxWJUS!UYyf#EXv2y}5qm3USLChJq6
zif1wdLt`leLt`<BGoOK>v6F$Ju^q%&&A`w&mw};iwmbt9;@;)U65xB61$MBiac%*v
z?`B}Kel^{G2djAf7Z4XTmS_OZxS)!Oi%}Jnh8Zp%VPITwSmFc2WfcY{RVffdhk@z&
zY>>lJY(6kt2A@SP&Z}~om4V4Q&zOPfa35Hd1xzw97^w7u!e=w<2ZqZg49vDK8JKK9
zn_<CQDj97-qgeHq9iS4R!<@kqOdPjBGM9az5_3UC2*&|XyMf~xXk6-Y1V{$vW+sj+
z;A^?p&-}n}IR<nsx45FpR8|Hi$82K;#`XI?FkA*5E&(DL7(_(wu`)2(a>z3<u0PHF
zf#Gs}322N9I-KzH4(b7YvJ8w{qCPNOu3%tiU=TMDc?L2y(T{;~OEOp#G^%bO%=n9w
zoq=%+C_Yv)Ff=X)ahezy8n-YoG;UI6VBFFVIWS|(YzBtL0}Kp}`#>s|GcYt>W?-mq
zJju?$xMd3i1L&})#vdTgK?a5<8wQ3ZGZ5z-14B~;14C1YD+A+}7atg|fcBARFfiGE
z0m;5(U}!32U}(x_{lIX=0@RLRV6r_4_0BIHP&i)kfC@i=2s4T700rWe7?3byJ!2NA
zNBzqLeB{lRzaJQ`>;X-ZT-gKKgec7TT8M$kzJ{5BajOgiLsJ(6LsJKcqshR~G@F5;
zX(otc#=y|DhJm4J6^O&nz|gdpfuU(PI|JiZX9k9*lMD<^$3YxF28O1)3=B<|L7Zp?
zhGupKhUR)kTL#9h84L{K_6$sRU`@FU49$uR49)T&KivVjl7Y!?HpKCazrfeZU-<)V
z^D-4nK$oHX(gEEWRK~!-;L5<bwfY0YRnR!21p|}40LZ=u28L!G28L!W)(;F<MWBX$
zU}UTZc^?`iSHbIzL8%RVoIPmBNn{7eRM26UAZPY5Fo^pxFxe-9OzdZ1Xf|hHXf_3z
z7y&WS-Vx?Z6Hpjmt$;ZbW+3A)(4o2D%LlkWFkGF%P|vIq2(q!53zq#DEx=K+_4x;e
zYv4oUu7M7Xs}Tl|PCKN7!uSgVL$enHL$d=r1LHPE28QNJ28QN*c?QO9JfI7@K{_))
zm*!jp)vN~KtGAgP^kF)eFfcUF11V-?XJD+~2D%M*KLbNEsPTR+hk;p5kAca73*@GW
zps-~sEdZsWYc&ka=2IA$9OOVUrQj1WuT6k>FB3eD!uo;XnhR9B2S^d9k)O%v01Aj}
zpu`4h0W*Qk1gAI$(1vQ$Wblae<pxljpMl8%wwmTA_`Z+J6QIIVVZkZ@>PK8Yz`*3N
z8e|1HSV6XfN|-C)acd?A@F^0d3}BUC7?>PxPdC`hDpr4m1$6&71Czshkj{x5AYWZs
z!@z95k%7sP86;K)cFWZ#AYU;sIVyw1z)ctM6*d`6l@R$45KlVVfaGDG1o@r^DgnM;
z1nf~z;7NR7xShekTyH)FT&P}7VPI@y1Qnq-r+#3#HUnH>#j4B#6`_Ib3`{o{F)%cr
zVqj=K0phG<U}%2Ez|i~z#M#Bb(89#P(82)X9AjW;kz-(Jk&$I!I-&_SiHCtfyiiG<
zm4V5roSlK`h$RC<ODO|GOEKv5{(AQh47YngS^IVm==Lf_3tk2$Cr9Y%{Vfd)3@vrg
z)BA7tfR>Vhl_8zpf4c`1Vo*`|>HQEs^6CB8<}ffFS;4^M1YU#(zAxx@0RvNgnIZ#|
z6KF9Nqdh1|+^zvB0~O*{pyHe97AOS4RiJpil7=t?lhbTw1}4zas4d+L3@x3Y5Cf|@
z0;(p(rzmNH)POEr0;`$Ez|b-Ut_CzJ$soQ!NlTD{$>}lJoO%X^mW2!qE%QN&DvLfa
zTss3=JR-hENn4PC$r*IgNo5lQL(3WlhL%+zpI+Mlav%efvlPgY;644<_CSSnK|)4g
zRVScA4j>_LuD@OY5&|U-4kHEzJqE^ae?Bl=uWw*r`M_`;)FNe2nae8AzzEv0EX%+o
zz8Ngc$G{-ITjdHX1CvXmG6R$N0j7x@vJ8w{=Y3$f4nCtw{F1c^NY({Z_^f7NX!*gw
z&;qIiw(ekHXys>MXypc#QAZgV#Gf%Rxd?-l9b;f<)nQ<0RZ(WBXWV+3dE!-&o3DQW
z^+y?)od1Iy2|5NQ6C?x5kKo*TV+PV<uwMz_RDXQ~B=@+0ybit`EE6;Z&i#Smjsi#q
zWD+Ddf+ogUKQLVH05vQam|Vb@I8-v!gX(WkZpr|ypyU3)aD5K4Egq0!98?m6A}Gb}
z1H+9upoW<ESCt!_3{2q<WEq&YEdz_PGB8LesWh@OFom;=Gcc`-`oM5w4=6Gv{1h1f
zvNAA*J!5BJT9?ki&>G6X(CY8Xz_hNU9;}FgfrEj`<pW5%l7XSMfPtYkkHMCKX<a)5
zgG3brlPjq6zOILXp|z2Lp|zGlnt|Cu@&m&i9Z<%(0~$sVkYzOEWngjz9ZO}Q#lX-y
zg@K`U5@=`Mx>X+-?)ZQjh7ujJjOL(A8rOlMW+4MZ>s<DF2BvjK85mkYB3nTAUt(Zr
zJ<q_<dJ^P?w;vepYyoTCAj_x&@<I|b1Jk-+3=FNW85mlhvokQQXJcS!V`5-v{RiR*
zF)*}AGcdG)b`-9cV_;}AXJBYEZDeF%T5k@Lw`X8z^I%|T16>EW-jji$tv;QBp)Iuo
zq#*PI!(C7itdC=0Xe(i0Xe%;iU^bfzb^;5SWMJTt{Upc0<Yvpvz-+dTfuXH|fuXGq
z#MuSofTDg617kuHXyk&65!77--(UuczV(wnFx(9Q`{#!2e|`ogj|2703{2}6GcdGG
zU|?wL0ddwdFtn{?U}#$ma_?>ihPIOo3~h%&oZ}1(ZLb&@+Cb5`{xSnYI|Bnl+aHk3
z8wQ4UVFreFL1PA{vWXuU?t%__1Cb029I|^^8JOH|GBYrh&0}C_muFyT2OWEKcM1bj
z**#E0hY6G)Wf_>tSUxb^odH^hBk^4J06znhyB$cA2m?dA4g*8G7PJ_=I|Gzs?}AR_
zXW@>s&|_e>=KyPD1CyXT4&cQgL>0UkbY);#|NR5QT~Ils!ocKyo}HndY5fldhIShU
zhITVhdF=jy;qC)as=E6CR2<75<7HrSKMF05+d~)_+Jj*3cmOJn!OD<|<GT+)Ss5yd
za0kdR7PvbkJ}}(90={NJqW%NJ-3Sm9B$feUuzp~;+W@+9f`Q5XD=2rCgDa@JJut}=
z5J?X~P}2l_Ysx(hsE{g1J*2+8X8{$ngo;UgV7TYP!0fOJ#0UXNvVLH=$Jqg5F)(?Q
zPCsyjRk3~vlsk=)F_XWF!C0k=L1~4t)e2+j6<}xF+X8jQy)#gi+dxG`IRnRbMbKpa
zy*nUzP;Y*H4k$f?W~1(cj?LDPW#nRIVDc0MrLjr|hW2;{hW1!c;%Q}IXwP9_XwQ)N
zz)*kp3rIi6i5wvFK@1U)2xwKnM)MC0_a1;tl+Ut^%z_L|A)pzojUEgP?JW!p?M>_q
zOdCN_G=YJky-%5eX=4Jov<4^1`y!xpFDWRS3vxvhC}n|?<5C8O_W9f&8192Eo&hIE
zwkie>RYMhU?YC|H2ZsCLvO`i<wv?5DDWsH{foa<w28Q+%3=HkZ*cq6%on&BWzrw)K
zehI|6#=y}2gn^;`o-G5@ws#B+l9miiA=x0A_Y4djEDQ`CAdhVO_krR51h9L86c}G|
zGBAbMGBYr3=V7R4=#XS!=l~TT+d&Ki28IqDb_S;HY77h=?hFha&LEC414Bm~14Bm?
zsNC4@@PXmM9+0pH14Bn814Bn4sJz)83KEKCVCa~`z|b+vmVs$|76XH1HUpEl6i6nU
zfuUn114GAB=mm23cYvCv^&pCYM}cvj1Ot=TC1|?u*v-Juu@jo^@9zM`DOep+y1%~z
zlq;d4@N^I1!_&Puq;$9szV=kITmf|FFOxT@jt3PD9mg3M>N}2tBI5$MY+%e{0-few
z^MT<$_|Bk8P+`Ud>Pv_-Fzw*_z;OQusI-u5R$$!E&A{Xfy5n?*3<E>QRR)HRi|h<c
zJ2V*>I^Hlabi7bzVA^5EJn;=^;An?4s9FU{2QV;nvNAAq{FjC}?14Z%DC<7}?Yrer
zVAN%0VDerBO(~r+3=Ex8+#eVoh(H|&n$Qx5T;BTtR0T0ePEuerlxAS^zV5}q>~I}=
zf9nHqcU*E3lR1wU1GD2pP&a~U_r(tk4-CMTfjW)?3XCS=3`{<n%FGN*yB{(zbZRg#
zbgF?kZy6Xm%^4Uv4MA4hFfi?zF}?N#t3>^=4-5|?zy^R01Z7ZQv=L%p@+pH}8{8Sf
zz|a|_2e~%*K?JCzdH`03xJ9-zgMpzl4dR;B9~d5h2Hrp<1A~A9qa!B+lg}rR{W};K
zI%^mhI;%jOBMc0k?F<Z^t$OtgOuIq4=73Vo1JLXWhe9qRNDWBCBnF1g2_Ozg!(0Z2
z&e<T>F95k7)*=DlIR+{xK=s9g3t*ps#{D@I7+qNzn0&Qh;l6@_p>r8X`xRKY8!>>F
zH$CWJVA^$^fyvhey!rGh1E{5B0BXcO_<~{+DBi()5Vlu+V0g#?DnKOXDKH)vWMB#g
z6$IOR7#KRYF)(y)Qf6S<J`<Wcwl8B~=)BCp(0Lq`T{bf?bg?lobb%7k_5;il>l;90
zN!!mdFmxF(Fm!2v)ZAiV=!#`v=n4jLo-;6XO=4i^>H%@SFfeo-Vqoan2FjT`7^NAQ
zc6<gqg%?aRFlZ<+M)ET-`GJZ7(CYfGuM7-bpP3n$b_y^sbh9upbp2CiVA?4I@(T9{
zhKDNkAisnC{RZT3kefkK$?Q=4f#D%&lomuXFmNa^#&R++`E`NPMGFH%w;}^Ww>&gm
zJZu1^i-(}LF9(wYXk8O1b$079Fm&sH!i(AA*awD(pmUoTBsVB9rb;s~`JD$Dbe(~r
zzT29Cq1zIg#vdL4XT%MN)Ya|Az|ajj7IDXn4-60QfFk(e9R>!52?~t4It)zypp^(a
zRx&Vj2Qn~p`-3v*R*>&NjDyS*e}H;ZJI*pNbjLF=bVq}7>rDoR?qUXp?tEhgW{3LX
z4-AhaK!!d7EuQ62_-)O=<ev|69mt!l3=G}PP;Wkx0C^Ll49T057#O-IfE&?|ctC;4
zz~ny>lsKzFr3}acpfR_JZ@{(QBMnd|miq(4BNvcTM#ik^d}mn2>f=5zJOU+J2FX1N
zjBVTuOaXq(3`{!;7#O<eGca_6PSe;?%fQgRih-ef1;}SzATL4-jYm(wfp$WHQ9y`+
zDZm`$_UjA`-CG$Lx;H}u_R$k?YCVAzum>0zy7z%Q`j6_rKwOgvG8K~gK{;wM*9V5j
zpaX6}Bm-lM0^>A(2BzRFW(KCkQVa~;rx_T!PqH&GEe74Gcb9>o`znZI#J~XRfp-5h
zW?<T>_krPY3n+9Sw=gg;IIvIFV_*sZT`0QKi-Dnshk>Doi<yC`erFg1LyrUlLys6J
zsoF6x^r$j0^eD44FzrlYVCXSmVCd0fFlJy{T>63G@eQzfpjEz0*k=ncFa?3`Az$3a
zz|dpOz|dm}a@`~bh8}kYh91x=zQywx7<z&k7<vL_8NkW<@e6Q`d4=7blYuEPg_(i5
z-l2top(l=kp(h3!UXNdZIwz7>5b@lT#lX;$0lFuJY4L*(3{M0=u6P0};Z@lE`5Bl3
zH-jwx%fQf6#=y{10^)pRVCZRLVCZR3W?)*v2?|^84-8KXkir_=I9R;8{sY4k@a@Zz
z57>jb8JL2YLE29+F!b~?F!XeTIC~fvdS)>&^vqCZU|M_`W>yN4S<raXV*pnQPcj(T
zJ}^81jSva2hl7@)gQ|m`r3?%`pvB9(-!d@tY+zvMSqE|wXq0r%3{av4_whi(v>8nG
zppLi=1Jh#r4-8MHfP?G}`&<E#V*(f$dUi7~^y~z2Vi*{DjxjLw905gs1_MLSMFxhR
z^U$z<0`A*N{$wxYWMB$93rd=xpuWSv&~pnK)K3;L)H5?MNd80$>lX|RJ<kwfeF7ZT
zCqU!r?3JJ-s0gwc6xLrD7<xd}%i@m=4805t3_YOY4H4EaaEA~0B)BJ_sb3EE`dT4S
zCG(Jhp_hk&p%;`SK>^e&&cM(s3JRbfDD?m&Xh0Rj!!sxn%o9PEM@d7fw1+03Dh)(}
zDnigCMDRb5Ejt((dX*R$dKEyNBMc0^x(xLUz1pC7Tm6CIp$%9UXl)l#Mc8Y>z|d<3
z)8Nd&(CY{)y&X_&X9TqX>OL^s|G>Z$0^S`4Z|Ky4nsy9KAzGj~hKtsGV0Z}bzN^87
zK%I{J1)xHTfhh!Z{WGHv$e;IHK)wCx2QRRS)dzrYRs=Pu-+&s_tREQeGk}`d3``-D
zK^2LEjSAQl0jS_gM#fAQ!G?w!utDGhjF4Rc8i3_c0aX)B8`wTDJe2?yW>T!Oj4Z4S
zOrf9<+aS!q(Cf#*(Cfp_z_g)Wo`In^ih-dw0>sm1VCYR_VCYS8WnkK1{(<2sXxoMh
z15@ZUkSr+FiWwMs^FbUJ28P~t28P~dV+N*OxgQvwf)23;kqitBvP*awm_k#S8JKp}
zGBEVcWMJr>4&rn&F!U~AVCY@MU<}z}@N_~wsMY!ubo4lf>@tw99%k?k1BTv>3=F;N
zL4B8}5e&=@5nz@KG>D!$KtdxF+{-Cr;5;t{miJ&_+K|fnf#K;2s66<xnQ9eKU#k>c
zsXW~Qm3a#hs|N++Q*hr6Bmio~vVLH=a{@Bb872rCr*Z&Az@0asIAdT617DY11*(m}
z13MYuZahd2_$&(srZDgbHF!c8q5v|edshO~$pb|d%#IKS#ye;08JNPVL872Tn?U2g
zAd^xcDJHBBWIOnJ%sUlO+t+~9f(C{%!Nm&XD(5>B7#Q#AFffH30Lem@E#FxH@o3l;
zkiR(pgZz1C14s<Y2iH|M>enF6==|COo6%w6NCDlsB+J0`Aol~qjR&CeN=jU%1vHAZ
zf}MfsK@|f-?*Rse-d(Z`%$5f~Fx>b8su87>RY5aG;h?*3EzdD9^xkD)=mjn1w!Fo_
z(EFN!q4y;_1GD8b28Q0h3=F-$!41Y6PZ*f}elReFcY?fY;Kac6U<M<YTEgf8a`uf6
zAO#?=6*Hj8f`(5X34UO>2}$SrDy<+Fo|R`{dL$?Df#IeJ19N;ZC~4fd!N4f6Py*~1
zX0}Hlee&iX7;e^^fQFQ%tW_ScGB8D}u`@8qyD%{H@h~v-ae+923=DnZ3=DmsuAh7y
z14Ew@14EwzNG6+sp--2Ap-&scsbFB}vtVH8GXrs285sI}K=;vsIFlF{`U)5r`tm@W
z`3wwwH4F@WRq_l>@@qiDW%c_$Fx&)BKY&OE7JjCqybMecJ)jK^=NTCKIvE)H+Ci-c
zu@xT}p4os(?q{IVjDer&3M&IsB(FRJlh{@eaS%j+d@gnq#Ci%MK7xq9@(fJkoS-JI
zxEzS73L*?Zgbiq4nYagt83G~_Ktv9Rr~nZyAYuZDm;)O1li$g}Amz!x6bWio%kN`g
z=$pyF&^H|{b%udKDuRJ2vPhYMN&X@e`0lLdA`Hw*N(@YqpnFc4KxJYE6NfJ-LZ53u
z2Q!(<!N+E?RWNv{c&IUej8b4_V35jWV2Zpa&%mU>1|o!^yTP7)0ktBeGWnUlNis7q
zDGD<%^sQiE=vyWa+6)HW1orF;0|x_xR4HT=SmbHQ24L<F4A0g;H-9m6F~0y$d@;%2
z|4`5H9Mnl<VPJ~<3yPs93=Dlc7#RAtfb#rJ7f|M4V2V<J&ZvB;fMpP7!xcK9bagX<
zf$<sW_??>#AU`oMMS+I4!BaLTKt?=$0NNtRz!Vh>PTXLjH;@elQJ`D4>cL9Sz;+a{
zeqeaU0=0As)Y4y1P%H&0QGwdE5vt^C2`Ez+gG;z)7Et}yppw6S!1S|naUOv<`<VmC
zS*#xz>Ys&xSPV>2pbb{w6)X(T5+KG$b3#q{%>(l4vl$?-f<kf$NFFAq18#Mtn0#Qk
z*#gc>?J7@L8JLpGWEmL09RiE8GcZV<RawHyz!c{$&A|Bm)CY!}Yd}f)<{Hp(5+(wy
zOrYGinw^31`)dY<zN-ujeW3Z~n^!>l;itd8&Z<*?`UAuB9FU&pISdSpcLZ4eaxyT*
zfmZB%yUD=N_mhF4?>p$Ki*L_9Fub%-W?=mG4%GXSW?=li6RedPOfoR+5Ma5@&%hM3
zQ<;JB_i4zvw7+kF)Pe+_g4%-Y42-`&F);LVFfjD9NP|Z*vlyPw05v5*Bm;{8v$r4v
zQ%txw1GBy42e1?aY#b4yp5gf%P|fxn)CFe|VD=MYV2WvjDF+KehhHQ<Fg#xZx;>5i
z1H<ztpyNoV-DFiwjrhRuLWO|?OfoPO2(UchW?+hqVP;_bUCzMJFT=plF9qUcF);M&
zFfjD1fgIlg_02?(CqM%8n87_Z#^0+M82UXK82a5=KQO$A0olU96l*uV>n5uLD|lXV
z`udx!k`aqPFua%o>Xy9#t@K$U!14rS>knoI#$Q_*82Td^82W>h85n;Zf>`wHJk+9J
zcc2#idda}hU&g@DUjnk|3uJCE_RMsJTdd-2F9kprPq)3rs;2YOfr0TCJ19HcTmd;J
zAr3TG3O@J%lqG(HOaA8xprfUy_upbwsh|3R;pPKyYvzH<a#jYWBv5{pS;WB5-^jqw
zU(e3KB(t7@p??AcLw}bo1Cz`i1_o&b2Bx@4Aen;<4E>-mSP9xtCb#ti!&~r8V$%Bj
z%u{(8nBqP#Gcd~?Vqoas!@$tL!;gU(G@bs|0dz01v@0v4IBQis1GBskXw^!v%KRz@
zW_dX_<`2xmbLKNMFw1K(F!Wz!VCX*!YIiZq&HBLbvIA6ON=NfE_wq6@#h(Kiznp=g
z{}}^A|08iomH84pOeS5+%Bac7z!V?M%)kt)Gy8usF!X;1ac(g%KscZ}v;G+a!vr=4
zh6yYnFMyo)vIFeAZdOJGRtBc{Ng$U9F)&OJWnh>f4C2T!FicQoV3?o`;%G52OfY9)
zm|)D{2elr&Do1)AE2Apt#u1R!6TBE0CU`)to)FH!Fd-CVHOS`VdIp9Gi4gx?_`vWA
zJZvkyfuDIIF9TCjHpqW>85kxMF)&OhU}s>Kd&R&op^kxJLJf%Xoq=IOKLf*rUU3Fy
z`Ntm^UYUU6QTjS7BR4ApQ(_v(eIFPYCd_4Em@t!_fm!|!1H*)U3=9)Curn|#a4;}T
z6k(`mnD7h46JcPO*w4T)u@b~lU|^WU%fK-4H;ALdz%VI}fnibvh-1OPFsX-uVN#VW
z1G7Rf*h<hT;Qv^Q#2A<o{g@e;6;c=&CcR-`nDhdqzJP&YG7|&Cq<<hz4FkhuNd|_=
zq99HO1H)u}28Q~{+92K(28PMb3=ESUL7W8)43qsC7$*CIIBOUfCPy<cOpXNEcpPja
z8v}!kAZsuu15+X>LKJQ=FiZxSUB%$az^t(21H-En1_lNV2Bt)7kO?~(7$&zfFidWh
z_`vWAJS_?;c3*+c=92);NW22w3L(Kz$-u1O!oVOS57Ohxz%Uu)rU~Gv0VRu95}=lt
zj14Oz2Pkltf&y2Ffno9{28PKSKpZ&+hRKH*7$zS8akLm1CSPJ;n0x`0EaY82FuZ;P
zs$^xnSQ+_PK?(vH7$)CmV3=GFYR1XOGB8a3#=tQ76DXE485pK;GcZiy1aV3k7^a9Z
zFia5vaT*yIrYJHnOaVDjzL$YviVg$A6fKa<Oa_K2<_ru|OhKHb3=C787#OBFfH)f&
z7^e6$Fii2bWnh-y%fKKL$-tBpEYH9!f9O0T19QFQ<_`>SCV>4G$@-QP)Q)(Q0$M`=
zno%o02x^csg03TRWnhvy|AFBp=#+XE2BxGgQ2xKdz%ZqVfniD>xWst@+7!jWl(Z09
zhkXEdv2HPdwiz=pB^?GeH90<jM*tWZ(?P}22bFq|&RaGNOfugYn38UTYI8%-Ob>Xf
z`<4e(9CURhqY*@00_+HodSeEr@83Q!-0}fc3AcP07#LDiR)OkB&_v4*W(I~SoeT_9
zK+%3Hg@IY&DeDJ@TcBR!6b7bb&>9&g4g-dI?hg#NdO*DZkn0dV0FWFgEN&fvg@vCz
zsK3Ju>NtY>SxYKDFx&zU^4tOq@|dVR2ibgroq=&lD+9xn*$fO*W`ZpIz`%4;kbx-~
ze2)Owe9#Uc?hg#NIT#q1Tyln3%K%!1emjJLDftrU23D>&D%(MeQbC9Fn1I&prkLa<
z6)~vn6#^Yi1a1d1dU}9d&A^l*F+KYMt0XJ<D$(hI7ubaB;}{qk4OJF0PGV$W$o{X=
z#mE@Pz!1Mir5;4DaZyQQG-P1#tX1)11g-Jg!jqJe$e`jU$H0`bg^hus&QJw>!u?k^
z28K<ND)8g>_*qn<)ft#lc8W4Er7YEAV9@`m5&~Tbsl~vM+oO_X23|f{589K!y_AoE
zfj`BNfkB*KMG<6Cng&lMg9`YRX3#MUDbLv$81&^;G&sRqDnN$*gouFl^)Vg=tp!cx
zhKPWU4uFctLPQK%VY*WFAtFX_k@{3eh>$T{C^Z-&VuBD!g@~9UL_piE^yO8|5F(ur
zHK0v|Q0r$yL@W?$)<Q%q5hC^bAwpINp^Fd^YlO&Sh=>hB1Qg!-@+!7)ku-LQ8asrD
zBt!(X@SO1|17ur~iW@{8lyDj(`R=o&ePGZ9r5x}XENNH4clYw$7l&;0owAC7VagKl
z&A5E`K?l0sU|^VXj)7sy3Gm&$eD`%hM<6mVO!>sXFy&2Na!CaP-$MZghKQHoWXGUe
z!N8Q>#K4rcefoxYR+W0)4p3_ZR9GP2-OI$`zyNYjJ~!V9whs(CpgCx;bJ9V_cIq1N
zoq#%LDnA3mRM7n}JxBRYK%Fzyn1NxcF2p$}pw5{Z&cHA=5aOIuNY3HX6@a)WJq79>
z1?=uIU;tfhyH12}7VifJ?J3a9gqbo$!Iug1%~EDy$`oZ_m|DibFf|W+nK0ihBS?@<
zUB<vLbsi+hW`PbbxWT|M6@<^JgZ2jT%>ixxxWT|MO^ksdVj3U#GGV^CAi<ps4AX2F
z7^YdMGcd?b=9>pf>KqIV(?S>+rupTSGw{vlWMIma0&Q^w-DAtQ0H&akfni!b>jwrM
z0g!JPm@?v~FMGnOT(4unz?7-Qz?4w|DmTFEzL+2*FgnoUAY(dQ20WC(#L)mMVs&Dm
z8bN&<CKQd}hAIP7#&x(x=ncXRGT>n^i2gYs{Zb4}86V-wKsIxKV9?nCDu|{hJ!Ms|
z&(s2M+yY-Cyd|8^miGgLXaNHQiw>v|%N0*6XW+AyXJDM{482B}&sGl<?u?m=B@BG_
zpdbT<<75VgY5j_c415l-@L12lFm1VF5(A$D4`@RK1H-g83=GpADJC=UIe@lgaWF7U
zH)LR_pRTT$!ocSMTE-0$Dq&!lo}-w`z~=y3Hx3e6&%iK!rD7Tbp96Ha#q>uE4AXBY
zrZez4NJEUCp~=87Ls2n<fzLq>Dw4*)Fe6Se#E^l{5$d8Da~T+B%vKCBV&HRxZugk6
zk)fVp#%l0Q!+dUH3{1J|pw*j#9I^~dxjG*hL_tHt42;}-*#ZnqS=*Qym~w3y7-kkS
zFwD#cDft6d!o<M9D9&fa!@!i)!OXyv$IHMlvyp*eCTQtOo;U-;%!v#PGy55A7?^S)
z8bFy}na>Jz+<sm?NcCI>hMAycYhcxD85m}+26rWMJw7mqf>vfQFdFe?>oPE9TY#Jp
z$-ppk7X!o09WW<=I|Ga^e5O1MOxd78X0Q`ZF)++L0dfz>3AY#+X5N51;Q^?7${4_B
zDh1ks1XlfwfnnwonCfo~3^Tt#oRIQ?L0kpYglCNBYY<{!%6<)ULMa2oEG7nqS)kD)
zkf+2|Ky4+)JU#=E6F|#!K!(l|VqlmB8rTQ<YnBoN!z=|P4Qvbyj8%N~2GR^n*?U1Y
z^D;2Z(qmwl1v<$btiz6hVU`Wd(c&tgMm}R3p8;s*6>Pj01H&v2kWO(1hFMVz46`C2
zZaxEcGbq_j;%ks+V9L=1x%n;w!>n`$hFPf~&T|HaS>+52vr0jcl>3o^VOBfnhC8tH
z8a^<Hp8$J#K3^jr15?f&kdBEA46~*)FwB|?4R!GoU@vds)8=7d%Bcl81LT3_3=FfD
zf;b>IZD(MZwH0jUAF!DqFCXU9mS$keSqD<X%fL`S>o5butb-sPNXKOchFKTkUOoZ#
z@+CfPxR)O=FwD9KQ~ZH}Vb(hau<AKr^Fdy|$JYo-Sh;H%7-s!tV3_qA<oN9j46}I|
z7-n;WI0qRRX3H`#%$5e-a#7E~C<03N&_Y0;fhkv9lYt?!pU*-Vl$AglJa{V@_$)vt
zmT@p>GBETV;WLKIrGVs&;c_lPe0p%X29TVdJjfW3zQEgjnsB)}AUREW22s%NQB4Mh
z)R%lJaLF^%MPIQh@#U!U$-~9|Om}_7s$Ad7Cj}GAQv#VG1=`BN!JEgxCj~l&W)i3l
z3*61SkL?44mI(s`V*;og%l`tdQhE15>#*6z3=Ffi!Sw_0K4={_JC%W9b~LyS<J||X
z!)7mKV3<7@T!--<0M%jjTbL(yFv&77<$w9Wpw$CPCCn3fFS0T)<zHiFU;-VOJ^M5R
z!|dZA4k*N*FfhypMOc9(1H&9P28P+7^=JjE3=DIe7#QZ*urn}$&WD(j%D^xO)CMlF
zWnh@o$-pqDS($;Uz!N;Wz*G>-JaGl+vU;rz9FWQ-UmkQ@y==@K2Bv~i2Bv&VL<tW$
z&_fG4NS_}8mx0zTHlVsiTL7xD2rdn3<FbBW(1u(+#FRf{`t#SUvh^`gg_}?ma(`gZ
zt^w5{jEq_A6B$Ywl$1gD;DW7S<*+YjkO2>>YopifC7`tcOdJXfpq+W$Yj`Jt&QLE%
z;03i=cqf6poWQ}r;CYUB61XDgV6b55Im$Z;T!XWLYHr>s;2MV~uQZo|7j&2&1L#<3
z*~z@qAmZf=ywf=um<m#-?|#E7RbL8D*7l%w#JO#}mb@PrgnJkm7@vUBL`hm&IRmey
zJZP^kv~J_I)MH>ONC4Muyw+e785riQVPKfENHLLt7rbTk1_Q&Ky9^9-t}7-n@Y;Yj
z3xGuaGBC{fs+i2cYXdrp_yz;RTond}x%D!NDGa<epp&^lLjDX4bDb4a8F+0#=b?f`
zS{NAS)+nYi@Y+a#4vA-An7f*RVeVqZbOv4<&>4gvHJ2C|=AKf_VBoa@o$3t|`OCmC
z_amro<F$plah?_f!#oX8-NtLn3o&V)DFZ|9JY#U(#_J@;z*JHOs@sG+WEq%Bsy{FY
zgX=a158h+}2BsobW(KB`9tMVajtmU*>}464?aIJPKqqX5^P2H6Fcn^AW?;5!V_=x)
z!@w}l3&fekz%VbIfni=KgC0o3bcc7WqV*sZ$qWqh5@9Ox7#QZ|fD7i5=^q$`K}X3m
zFeLLPYcVhtf%YDitYBc6SH-|EuL5T670{pvLlLhb4+B$CB*+|)p{)!I^O`{%khK#S
z80Pgc*nq4Bn+ZCGp^n#3g1H{*$T<uQ^Jc+RFK1www-n-p%^w&<z}F8mbn#XQF)$Td
zfqZ_1fnnZe28MYXp-vFV02S^GGkJADP5^cI!9L%|z%XwQ%+Qkz4D*hIj^F_Wl}H8y
z8v_HwQr>zU2?nNO&{`F+j;jm|^S}WIa`XcRhI#j3juy!P748fhd397lCW3tUhJj(;
zD-Z{y_&Wo`ysuz4mr8-%3`%Nyc`IZXn2IZy8JJ2n85rg>Gce2tEov$?W?-1l$G|Y3
z2UMSx+A=WAmt<g=FAl1EO3r^^5CKn@Go0kD<YQne(FS?>0RzK)6$Xa+N-!@k0DJic
zuR0F{Q}G#)Gujv!=Ib*s%-02RCNVI~w_;$JZvpr60<f2#@T!A+{1>FAje((lz8eF>
zd>0T8q$7}lVZJ}y%L~9>{=lma^YZ*y28Q|3FvS@R4D-{#^;yYlu$w_%{=-`-0dnte
z28Q`13=H#&Kz?UsV3=Rez%U<F?UwR0FwE~_03Qt}2s*^&2`H^YGrm3pQ%Ra81H<+&
zye6R2zixnxn$BCnz-t1@O(40qy!vpt%^*2_xLj2$uNGYHJV;Ipw5{d_s6MM|;8lgo
zy#~pt$}l)FFx+5R#^{@v#lQ=?65<8}Q>he4P63>sc`F%s6+lD%H+ZWUcojfr^MjN-
zXE5-B<r$btJ*H3m$f{ibmAj77pMhb!EH~_o0AbLe4tP&+>1~a22JSpr2By;63=H#U
zGBC`atj@qNXErzJ$W?}y3=H#kGce5GF3Z4Fneu@_*Z~~1Hr&M`3{0gbZNTIBAW=}R
zvEkO^sRWJQGcYjN$TKk8gYF~a{!q^#TmqVq2Xzy{(?om>48jst3=9*LxRXF*17$3{
z<qX_O@*p>GFfhn`<4yuyZFB>)CEs0~I|g*N!wrxL91ILzZQL=CBF~?JK}m@_94z^P
zK^Ro(X@CmjvWaS7Gr~a&Uv7Y6_bLO!{EN^fox&0fOi<M<+>!dwCDp<bpe3DPGg!Fc
zOFAKZm`6Zc)sJy;2eL6TFqN(5U|`7G%pC~YOML?*W5>+x2bMVskpZ6&dINmSMExIb
zZ#K|^K8TDrL{An2gLy2sJKG0_GEn4#4{RuZs|GgK9ioI`{wD^8`R{BPm?}lV%9t1!
zxXidcKqYLY5(C2meg=jGpzQ*cdJGH;+!z=ZxUe%YRa!AHEC^&^Sl|y@<el<?p}tH3
z<U6o6EZo+D3{2&1P=A*xfR^AuW#ImX@L~Q21)Tc_hB6mWz?FgSU*h1l1#K;;3};|i
z5W~Q*APS@;1+0VxOoA4sn+n0~sCNNd0@8^TxL}iD^E;q*JXs73b2zzO*gh}_fyUIp
z+p#PDKmx=C8XyZY85kC%LIXtT2DorH;C6)vNE-vg0?^WEaDW_SU|0aU38@|&B4-#F
z7My~Hh|mpCfPk%m1W3hHsAGk0fZPg|fd>eLj}{=pET8}Zo%PCq93a;j7#3WG28b{V
z$ewzz8l(lp!Ym+5prUX~Abgl53=E*OQ*O@f$OejjNYZhH1cM<11A8yGB`E7ux^plv
zsDI|R1k132juPO8v^ID^SMYFy+8Ol>;G86G$!!eEEMGx6nHMZ;4A#Za%gDg6co(-0
zNcIM!I|IW-Rc`RHuQwQ&D*JeIiy64(K&PgFjj3D9Edk2xAURMjm^z(X0+J!E7#QXR
zaSMZ;1<D0$K5+|!3bp#3ptBt2gmCjQ)-o{o|I=Z#0Npk#`CNw)JTzDZx-d;pLkDs}
z9%xH>=W`uKWpI0hE0aNo5qx71_y$J#&pM1kAPcHMg99LCLZBlTZ-7r8(_s|S0G;8*
z!oVOtM~6{VjDf*#HbVqMJww7*onIi&ef_|&6_gCY2NYHx10P7G^Gg!a%31J&fnmV|
zH3kNbsXD*(K<8I7Ff5c{U|1-i&cGmlSLcs715@=e28M-h3=9kHKw^({{=&qH7#J49
zj%INTU|>i9-Cw)wrw$`4H$y#xGCu>u!X5^Og<Vph(?fM2JL$hNFf5$Tz_4&C_$Eai
z$c}oD;1ULgg^NTPn5sc%a_X+o`J>Fhm^hCCWY_5r3|lKexka!}hmo0;fvGy5nSrVL
z1_Q&wjSLJ6*Mc}t7#J2FW?)zd>IqhVU|^_Uc#eT#;Te$B9|nenHyIcfUg!S6u(bi&
z>IR*G4mvRbJl<mgp6}iYS}ik$fvFm_C7OxD0@Tpox&w3$DFajWdQkhFBLK7)g82jE
zcL|U_(4xF_))EGe|5BiV^Q~7Hn5KZv_5+zcUHu2EfSQxeJ5a>caB?s($Uo9~rvVC0
z4hDwK=Q{6<Krz4pIx=i}><?Cn`f{Bk;OJsxV5;$ks5t_zN7)z{<}J`U0Ztlh3=HWj
zbWU+FFmQyiF)*Ar(76s~gKCXr5gpLUGoZusY6E!l3m9}lwHO!^r+|+7sL+W7h2$|d
zkbOGflVm^*f4NGXcn$^z-9Ky$^$h2jbP_<8fJS9IpX(%p*f)4mauXSJQow9B(Ba`a
zY2f3+*%%nKDs|Ff?8$$1GC3KTY6EyuiVGNY%3<nj=j%X^-DY4ovPfsYC<9Y1Gx#VS
zohVLl1cOF&r?u-e*Mk}>lh_y-j&IUwfwA3EbXwu;Y@IeR8>HhxkxqvIG!QnH>VOVM
z0bQ>JIzO7>1_M)V0=WIc4eBNZm+E+cBB8bl5~v=K?t~o!L-8klMgv9$rrJ|n1<Cc9
z4El_gu!Ey&mxGUP(g&ST!RQzY8kw)%g(?I(qE&YVTm|S@bj~^YjNqf&>r^>G=b-8{
zGJ_A903S=G&&UckorQtHK1rXEjSF<%6$>aW=!0^B9s~FSw5ECbj9fAd3_fqUKn?=k
z?ZNOB<c*YI{lB25YF#)714B^3^!dM7#p|Ez{{@}9v=gM@P=o#_kU#6Df{(z{{{%XM
z)d}op{ZEL*rvC|acr_@X8&~Ro5o2KRJ_tI|tcFb=a@^DhhAp6ZCD2X2Obx-{(n9|V
zC^SLY?G*#V!bjlJLjQ_3_&|9EhDA~g42y)+85sI2^sk9CFf{}-Ff8(5U|8e;606m}
z0TU}>U|5tV1G%gcbVg7On>y%FB>hL=!-E(Y7WFYOEb37Q6&CtWKndt81H+=33=E5=
zD;A}eFz7=Lt!H3Zw1k0S(W32)3=H*07U{qFz_8Uul!2)}4V<j>uS1fRECW+R#0Q2g
zpe4@?f|>evSs9q>Z!$A5HKZ~yEZWGxun1IaG!!y0EIQ1<un1IaG}JOMEIP-)un1IY
zG;}gBEV{|Su;@BS&r}A6MNb$Q7Cqwrz_4Wkya<_Y{D)O213JN0{}x<CfY<nKIl{oC
zUBkfCAO;cxl@pmvpoM%HkkW#YF`cQH2~@spc>*b48jL{-5#<X9Xu@{O4+bX9ouE=n
z1XQw2U;BquyneC%aZoHbECQ`5sntKO3JP&Zj32jSU=W1HIB2$k;Rd*P(LVudFi+wI
zokXY)nq6R+1S&4dYW25(3mgWfMiEePp}$2PT3pCg>hFXW3k>I&^uZ_igGvRz3VrT<
z;OGRGBh&r<vWjOs*FOY`tQ(+gsk=gdKP3D?4Sb9F`k+(t7(i!XH-gHk&gc4N;M@nc
zu1p7H9dB|<5`%uZ5NHkt;@omjOMWNBx#i&G&B4HMj%oVYzpUaig8HD-m|UuNGBPk&
z_E@m!*YGefHLhb~U|1wG?H{XReGAAPNAKt_2KVDZoQ3!FmqO}%2GHSdL7K{pHH-{Q
zP3qumsm#~{&X%GKOie7{9InjR3P07YNgP!OlIh_pK$*VNT$wQw6eUfdt7DjS4W=*p
z$Ep_kT$vGk$1eDK#TXl9=xsY7i=PV>Bxf=xGfG&4;)|1kAz`aBqXejq2DJlBE-OQB
z-vM#>U6mQ7z|9aA1_tYG(`Em&s?|p;GlKFDxWJ2IU<jU|{F(Oy!?Gm|3{2pgR$4cM
zkEc}rYyvW$fngCSBY|4kozIm&gL3~328P9|3=E59l^7Vp8I(cQwl`=>MxB8{Z;|ph
zc?JgWJq!$s0~r_=`$97;sD2Ng5Wv8|_n@AEsg*?m<N<C_7=LA8Se(YdusF$&fvI)#
z2Zj}(E(inPTV+N;&|bjSBMc0SD;XFTmoqakwO(LgSlr6Mu(%n-xx>J)crpXS;(ie4
z1p~w4l?)7vm$EZ3wSHk>SiGNsVexKu2BtO!28P8~7#J2`0C9L280r^;)Pgptwn;EB
zEdI>Eu=t}a1GCxj4-6{;K&@lGU&{A{8JJo?dxgzzFfc3uneY#^i}ncv!xBCQh9x}Q
z9~f4IKzGqHae(eI0k6IVWyuvHkRumbz^5s2fb;VT4N#tEU}^zvq?ZBJ@9?$*M7{u$
z-&=a8-eHrK=z(PFmc1yM`rD1^f{bhustZ85nt`e1E=U$qHk5<M^(w%Fek*o>GrJ!n
zn_|6+{0D|*e;63SBm;wh@?Ta4rq)De24)o<28Jcl3=B&oK^zMP2G9iO5)}}~g@Iv-
z5d*^#&>3jUIY15vSp=Sl2M;iUnl>PhE_=YhY?{Kr)LH}Xq=L5+gXCC0Ff984(#F8d
z)H-MSM@BaB`YjAhZOcJR10ky~L7UAr85o>zDxU=xA&d-6ZARciNcpS^DA9qd9p$s&
z^Si*gTKO#KoIOY(q<q#H)MRC2U@%ZuJ}(W@%Lb|mlrMm50ya<$pnMTjsC)&VBBy*Y
z12ifKJ)e`|?k<qcpc!}X1a}4oks9TNU`K$Q2r5{V7pj2@79LQ+qP!GQjwvq#8won{
zJw$mW%v!xg%B#T%9yIrVYx;X8HnI8@%B!HISOfz@RJw8nsNM1P14964j`;+rzuo>x
zje%j)E#(T(;P*}jh9!;+3`=a)z*)Hh>}v*wC5a3SOF#qSdW)1R%^`VeNe2VNk|uQq
z25lE*(BaCUJiKH*1H+P)`xzM+tR^eha56B|Gkj%KXJ81qrd$hdUokK&xx&D(<booo
z|Dp^&8WWVNUokK&c?Qj%pz<Ip9n{lv|G*G%1e9U|KqoeEC{Ge(U}^`=4}p5FOa3r0
zEcpfPs0ADWEzkoiL+Ymm9AN-W!$O7O9W@9a-ce)yzz~qZz-(v1z|;<!MP&pXW5is1
zgb`G41*`zcaDQM3*Z>;90H>~32@IeSgW3st|3GDBhZDH))njCX6}}zv;F4C4k)5?3
zb~!|c5nK!`1Sx$%O2AxDtH;+%?={%KI#5I#=z)&!6+FTNDq!{Ag3Sh9q4-?y9VqT^
z@MJRR{Q$ARO{(w-dJn;R_kfeG-a}}Msh*+px!yxWlS%I(sL+Hone-luF)(<vgPKgO
zoAe+p_74n8=YS?@KnbI(2;5}SI|6MoE#+lkSPD9ll4Gjg5p75ZYpEpz!%|aF>!?ES
zm^cGdR}lll(r^ZbrNJPvTD|%cFu`&LhNXo_QQW!-++@;&WE2L5r4tz#miB|2OnO%!
z{sOyY=`3)QNe^-@2m`~?<qQl<mx7v1M;7Vb{=l$ojwl0DXD_(Lq<0*W)@2!(y2?K=
zEPcQb2D+{Mgx*<J2Bt31fs0)&3=B)RFfc6Lz|6qZHGzR)=`jX|rJ!?%yXG)3EWOCU
zu=G4gW(5Po(t8XHOK*WVAoZUa7?!^0{=l&G1*kZguJ?yktbXYMNb%YQ-U$OKUY8j_
z3d}A$P)P-E1${dK?PW3bfe#S|6-*wGg0?FN+J=(&z_2U=RG@NyU|3cHDmg($fD1d&
zj0~uh@Mt$=U{EaA+Xjm3`YzD%rv0^g+f+dT4~h6~h=!BiHqZ&tkcN}qc2Fcj$}GL@
zpqvhFI2nA`gY~nz8$kt*UMQ^L<X52w>SuKof!jxVkbV{qsNtm-1B#xVZ1oHba+P|q
zpv3xz4b-gBivvl3T34OV^%6mBa4Jm#u|T4^m-Ldr#SggmrI!pY5kwi7x+5U5ht!Qa
zzFDslq!g4=a}@Ndz-&+pC~vb~C$z&a49Ya!^Yy?Bp}IlW*LFUi{+pdmxqhae7igo>
zS5P*sPtd&z3auV)a8A;_3(iR(TVH`~)x8IAA$5bip}PVm0<sRl16d{!ta}J-7HHH)
z*Fg6WxJv{v_XyZra1O241zqRF0P?&p<enRlW*rmV?O@HV;F!|g4$YzrozHc*BXX$j
zc0>-<-3iK}7N8v3cwBcDxN7*oumqGt89+I-&l#LUb!UMh_XY#QG7$!bWjt#2pfM2L
zS<o!H%!PqrnGGmAR_M+VXJG1cW?)!W#K5pD3nW&nI}au{kAY#?45S>|cpRKVbyt9^
zG6sfaI~W+2Z3E{}-BsW?Wnfr#n1Ny0L2wS$T@4efKgYnZ><lD}>TdkNuyl$j15+=k
zldro%cP>1O_IZ3@SOVH+%fPomcQGpiQ}0P;2BtpH&3d;P7?y#0D}9L!49ng!Ff0Qt
zHR#J_0M+IU%f5k>RWdLvXJ%kn4(dquwK6a)=VM@44r&Z7dB6hBqH<hp;u+8!+6!)=
zKyoPPW&}`&rjHGjy&#PitR0%AHju2`rwmev$jUoF6~od1Xii<41Inq>=W?-$*Pqnw
z0mX3NByfjDw?`Ee+K|}pLF7wa(7sV<heo#-6m^h%soM+BmuFgaEx@tOz|`Lf%9pwp
zh<vGQ1CB9pzSOk?1^P~KzSOM;ufc%~hUhvV@}(|l-3$0K#?I%uE+7q%u@GHXFq@5m
zVU>g~C`t3XfODoUXv~HIl=V{n>-umoFo4CiDs_FqIhKuqVe(&He@>9wz+)u3Ibd_@
z>p=q}y6vJ2O#Mlayk!fCY*0=*zDc(noQv5Q7%ac&g4-b=E3BAwAvqni1OYT-!qh(#
z6eh-^pv!=l#7~Qd1;kcRKun7Vw}?PFd#B|zQBZJC&;cLmJ59PCd?YO!1B1QQG&w=g
z5w@TMZ<wdagPq65z_4N0G(`~mD-Y=Em1!E_gDyeoO_+h<b1}GqHVraZ$;QCoSUk;C
z6jaNxfvypnW(COwb_@*R+FC3Ej0{W@JVBMXzPuKTtQdGbV?F5dv%Yg$pgXV_l=(qQ
zK&P?0Bx^D41|Ja3$-vOYti`k&ba4x4%(L51i)pt$Xz+w9lR=AVAJ}amLzX3KF|7gn
z8)OJ*ybPptjTA^J3j@Qk3N5DfAjP2l_h+-Um^OeT25kSS7g|i-Fs&2Ygz^g*w3xg#
zK+Q-NP=T$*6a*S_2HmuFj!BCNbcF`^;)yL4T1?>*3``T-K-VkG(PD~}W?)cR!@|H|
z{6&i?N&vJ(2gLcK#S{(Za3$xaFlaHw$}ljvvvGljHKwoQW#ds^q{Y+;zMD@AdM~di
z1JlGZaO+2lDO?3KQa1fAFPl{TFD)h=xI>RY9IB%PbtuR=hG6G_0$F#37Ly@ZD+4H1
zY`dWK60DPfX_7hz1H+aIt(Phwr}Ki{^wJ$94vMxpTCc&rU<3Q&4cOfv_8+ac0`(vt
zf#X~YbdM0j*Jx1k)na4?RkZGG)(i{@Z?sm!teFe3X0<HBn$->nYu3W7IhUff4jdUE
zYrbf$hgoSJrnLzaW1xCabd}at4u*OLa2DIPO=~+?1L(@wo-<lLFdKJqfF11vT2NC3
zmb|QG0+R#{K?DnFnMi>=0g~h>)>4K_PPXS@U`VOgQU)EG4l0T&6tt8<9d8gjSV&7*
z6Ql`rxp#`UmNMu%l%3$o1})G?9|Qc1VnYT7j$%;GH4oEL2j^Vy-A#Km4VkVpGB8b!
zVqsv2TyMy97vg$z28P65L#7iTsXAz$`eewJR#ePj$aEf}#*Bes*;7Mk%2s1wnmh*-
z>xN8gR6(&0irIuD!%Z-6fHbu+PnQ&6lddlZH@Q#0Hk=H~@lzB<8JH%&123mFoDNz;
z2VQVI1vCqN$=q;0#I>RfOjCrwH{=>Fg@}NBqc3l`7POx5C^#jpR5b+6sR|1-Fiioq
zM+}k-^FRYEUpYXfg<&4}egV*kvSYDfDY!I%RFL2!oL8zc#4s?N(d1$TT{-|dyM3V!
z0|RpbsA`_+2)>exi&0StRE97xESG0sST1f+%)rH{XbLKu7#NoOGcYW72VY3W#i(cl
zx~_$RVR<tH!}4-%(BL)~qoOOQcgeuOw)_|a!}3GZEd<%*Smi+DvD2dk*`!pKe_&u(
z{y>g_Vd+dRMqMrjrkRe+6B`-j7#P+p=VH{=WMG;ZIDMudn@ar(V+Mv5+ENS*>sNCz
znt@Xy1H+1Z28I=xatsVv>$n*G6d4$_ZZc2oVw3_EcwCH?kP?q!#cBqI6)RmnFf0O%
zrn)dNO=E|uu!r0u!LVW*1H+0ftREN_)j+DusUJ|Q%#P_cLTn24J)o=JKr*04Z3bus
zDuc@hhQ*)>kt+;L(>BX7FbGZNV$4uyV9@!`G*Jg62|BZ)hJk6CyA%Th&uT8lY*6&v
zU|?8rl!0Nzeg<a-rnzguW-x(C28IAG#!P-@2Bx|D7#LPOU|?7QYQxVx$-uCp{x1W=
zir>l%OmnX?Py7fPH&_fkVs6?3kgIAz`z4sb3zH!GlNTRhVEO^t*1$XwyhKKvfoWdL
z2Zn{<lfU>TaxrT0GcZk;VP;^OH<f{5B@Y9`N;VK@0Rsc*BF~lT$_z~N)-X-fVg10c
za0vrDvq~TX({!%siNb86^*2z=mS$j@`}_mLqBo#P$wi=j8WvoP{@e^q)4M=^`N6=j
zGK7I)CFsnKdCUw9D~lNzR_23@=Z6@-2r|sUG#$LQ7}TE0MDd9Nif!Vcd+T<6U|5m^
zTDHcwgp0A7m4Ru76f*;p(s2fcl^qNWE89SvD+~-PCo?dtoCxAPWMEhc^4c8et#wOs
zK)voIIiS<W_?aSD8JMPnHq(P{ty{U9fng=+>;~m03=AueF)*w=0-9G^(gE5|0@^2H
zG`&QGO^6db0L{QO!*Y7R2%8w^2gvT&8IjZ1iLi;+{{dgJ#WW+25p=0eBO@rv7V$vU
z^n#)cyhEI6B4`ea(Ge^y0@VZB#{xPf6_hGfpjyCN!9l}5nM@NkKwDW%!CG{nT0nOO
zLyzcO^nihBwv-<O(~Os3yH9|p)fVSKjy;^oGd)g}O$xL$NOKFw8HmQ=lIcC7Y^wT!
z;3f<QXc7l>3Fyp3Fkb*vw>z%nViW<*z=Fn-XKv+WVA$I+{edW(1XCj8^k1TE>h)8&
z?t$e$Ff0Hq<5U2ZC$k0AKnl6;X+VmTmA4rfR$f+PU`S--y63>apu3WRVHGz6!zyNQ
zW1I_g!xrd_`c=jZ46Ah285o#ixE_PD{S5|&RpAT_s{+*-7^FUMfoCT`VnqxLs|t8B
z8MvNIUm(V&Sih=~fnim(Is?PPdtC1n7?@@YFfgoI%D}K{F{A`!+~>)_;5%gzV}5A~
z0~aHo%Lj%9KNuJobQqXsz2*Y-6S){U!HcUmGcqvE7KKXla4~WUGce7%>BYb_8??22
zwh;rvs?7`xtJbqKFwM4MU|4mMfnn9rD2A<!9~c(OfN$Pm1Wh@BV_?Aq(8YBOOtT;d
zPl87o7o35nZO}2Upvv3LOOt^?=P=i0Q0Q@hZ1?0~U`Q|Lx~$2-G~09fEO9o4`kh>$
zTUbDa_RItZ2F59%K%Q%?kzc^TH9-+v9Wku>#K5rX6=)>+8rKX^*nMSSSgpXouv$u;
zf#Iwd*G!n0GXukFYw(a3*DR3O4F-nQnG6i8Q$d5wj0{Y36(Nzb5IV@bx`82_VRelX
z1H<xau4SqW4BEMn)8FQKePEacK7@-;k83$U1JfLDP<ax~z_5A}1H)?2IaTx07#LR1
zWnfr68<hKtm?lcGeqfko0_yTGFwL==K0$&_tUdx3BB0StSq7$giXRwe{s8B753Ys6
z3`}#Dfy^~xU|79^fnoJBkWsdfEh4iRphkgC%mvT%WHNzrSq7v?oCPaLKxcP?&daHE
z|G+Tw1*p`T3EDx<!8M1Mp`K|js00QL)2-gjz_5BFbeL}D3($HBusWn+x|uIP%PF9u
z@KHJlA3jRQ{efZD3-}ORsR20VXFh<72zM}muIAY2&DFukFnx(6n}Bt68YnV56hM*5
zm<5_A$_wDig|;r{uH^;E=7OV|1Jp3)%GCy4sRG{NG5x(Hn?(H?&<a~n_6A)50h$Hc
zlEM`R)(?u)M_>cO!2L2%U(0|i%!`3(?js&h8<Z<Tnt?%Q8YngD{0Ch-lF8)`(>YHD
ztkWIb=z-{TcVl3hCj-&xDaXK|HJyQvp`JnOrX~Z!AptH(UyzZ3X`UBYE2J|BQEny2
zz@W_ta^0CCF3_DH;5n*!^<ae>Fz@LaaA`O(FwLunXwrgc;sd2TP0(?#ToQ2C?F8$T
z0G;=mI0fQ72|EU+c{?Fmr4U*_xHB*;?1{Yr*2=&%KY)XQq3C$*4Q0@6d~6I16$@kU
zsWC8^JmyI)V2FLL%D{NIgpGm0GdT8z7z2Y5XcLurSnNv}TRt=P6^w0pF7|acjI&xc
z7Ic@lkQ%s!9?K}r!obkDDwa`DoPoi$1l;wAWdvPu%J3Bw%bRz{!upK!w}U(r8xQVP
zfI5ILV^bs;nC5TiDa~YvP3K`?aLoV@T}^*4%_d&ID0W3X1H*LJ*u|ihqV9^=6v)aA
zP&B%hxHB-U3y#?U_3Z*buy12FAbcCM4eVPs28KhGF$ZC;pC27_Pz~x`t&1^-V8O7d
zGv)}G4emC_++<^rW@y+Fa~4#9d<A#tW6puuYzz$6zosvcVUwy~5#t22{y4~IF-|a_
zbx)1)lwe?5aGWPOshlCkSBQbZ=>*toG5#=9P9BN@?+3gA?)AighxEQeY%k|YE-q(?
z$q-^-a5jW^KE@N;;o@UpaB2e;mRj|h?2HE)%@`Qu+SnQAL0z(ti4zp3?2Pk3eGJeo
zta0`1jPq1Lv!D#e85tPP@vt*a1vPFZ85kUu*%_M{8JHG=?n>scW@l^z2NSrDXTZ+b
z&BMUJkp_-YcE%oPX(`FTV585@Si;Cq&$O@wyc&U>u|$!9X<-Xj1p_-{1*mheoU0PV
z1g&HOt#`1mV`r=ciBAH>o#SpF28JFfcE(t+o0%Dy7J_bA^9*KZj0Nd{IXYGe?C8^s
z3=Cad?2Mp;e!enGGBD^=vNJj|GBAlQ{LR9^0CKh~lC!7#$gxRl>||#Ibxjs!Kpn^^
z%fPfKgDXELg@K)sO`L(jDS?H7Vb_i6{c>#Lj1kk9%dzRzt1vKxeqn#X$iTE{4hI9n
zp)mFrpy?q{N6mc$`wP&T$Vohz4D7GKQOKaez@U7U{VquPP2TL(N(T13pczW2a?r>o
z1BiVnjQuWnB^4V3!;BZ~;5)Q;f;7iYU_Z#nz_gf)11xc{9@IkwO^>^8U_S_&s)p)5
zs15FRxHB;1<*>spcU}zYRu&y+Z$~6}_Fh<m*Q{cn3{K3Tg6Oaedj>e5L3Wjbvk7~K
zDyUH4U|`U!V$U=Nl>|IRsbM7y?3EC&X)-XFJFwfqwSktV6&+`{16u~sW^V}9R>Hsz
zNz)+9n#I}G;JO}wRuEZF*HmCr7P4fQgo!T^gNVl|u&LBnMl*rBe4w>OOZEsAFhn!u
zDT1;mINqX}^0Yv;063bXnTo|3n3n9}DoJ68W-1Y5U~qJ0VPI$}jb<tZxf(R9&HX5v
z2{h3Ky09(3m?4^}79<0@U(`q~nyC&v!o<SBV3Zln)C4xbN|b?V320bFcSST)u^a>A
z!A}gJyGWL%Ml;oeE)06g07|kB-+dSu_Fao+g7oSc8JL#doo=njrde+g&7=YvYd*rs
zz>q#Mnn?w;Bm!h1hjlcQ2H3$Y3=A6X(M-A=AYEJ~DIj<0fo+F)MK1{I6_D$VKn?~C
zBps}aW-<nGK>kX-6U_u3TLf`(%%Yj>K<VQ~C<8mgGGPWr|98`0DYD6^tp$(kL^EkX
zJR-`#wDc?s1H-n((M+I=lo&wnGEAASqr|3I|1Oz<fx(z@AE*($O+A|N5F;qq85x+C
zEe7A?8qIh}9h68o85n{lMl&9A07-L#QcN`CVN+1tgYJ%B8_ft>GsZB9g@M8OWi;bi
z36KGxB?WxZjG&w6j2=TGkMTA*EFeP>j0QpVEDQ{V%F&E3MHv_zK8Z3gErVQh7tMH9
zo`Lb;cLq=)#9<xHctsi%=^&o&ifG0wO5iAhM9R!s1_qm}(TriBi~Htmi)Qp-WMEp(
z2%Z3pX7m9?ixbG?dyrrO-K_*&a<%Lu$bOK4zL5C_nE6mHgBb&ZprkC5IylWTFfBhX
zRKOt1q>f0MvP|lTq$$g!D-Kcwj$BzLJ&>Q8K<SK0mPsGRvC)!cGJtXN7&lKpt;{A_
zpDD{^3=`yjB+Fz4igHjqZGR%mWDQHOe8#d&Heik@1Jm;TVE@Q6=|Z9zl3rz*Y?0Ed
zdJF?YUA8RaU9bl}Fk~b!Ffc6vwW?R!SrjnHGTsGyg`u8d^$`Y!)q5;bGK)Z>pn?k2
zuKvQnu=<S!sO==nc-NAFA@3Cf1L!22H8S9PxMdmdNq{mY1H&3m28K1x;KVP>cn_TT
zr9g$UEaMY!kT5W;DPmw)lO+er1hS0JIT)B$+c8b#PypovS;qPoV9zr!tXajtux61$
zNeY83;|n(i28SjFhBfyY7}i{sVqoBYB+CeDb1>{=U|1{2z_6B6ih<!^oh;*9P-xv?
zU|4I(z_1o{VVj-2EaO{HB?1x*VqjS7C&j>!dPkNKJUI&z%w=F$n<~Y?kYgsx_(K|W
z<{?OQDg(pXUT9a!{~ajoz}22ClN`tf&>s7hkSSwX#wU<a4`5*6sAOPTxl#(0!DJc#
zL+i)2*BBVqUXWs7FieqUVt@($XJA<Sm-Pcf))CMdYYa>)K_{xQOgvD}#0Hwb$hra&
z2FX7GF&LOuf)8gb0k^BOK7hnPE#K05&>0#`JM%v<WX=HfA2_DSGRg5XFs-}|I!3de
zfngmN1H(EF5T~1gVVx)g!#ZKmO4rr?9~d&hr>Sr(faq8S+N!cT5u`<#fnl9IGXvA=
zTn2`9HVh2wtk@ZtR#!1Ftn+7JSm!Fvz*PDGtR0k-*UB;;W@TVn6$0Ar@s@#MT|WcE
zx?T|HI|IYIxeN^JW=niv$ON6k3_jL7ive^rp2P=+EE5oe`vXIk3j<Rr=%hjBi94A1
z!TrdLBamLssu|PYs<DZ?-T--+foT=^C^^VsaTzb5V&G8&$X>dPFHkY?P(cOwte#8<
zsMxRRp6YC}^*#{pYCcf-l?Z?WJ2M635|AqkK$5H<7&51TPMu?5S`E2n8+>wWRtD&#
zKG2W>!z2c#)&7v;QjbBEfg#RXmJzh70^GJ=Jyj?blxX)$GBB+MZG21dmSx-znmhW+
zm6}%%k~%01+M)qXUCuHf13;CEO_~n_gYa`%Mo??c=rJP$(;CqDf6;MS#tDd`SC(-C
zqUe=noQNoTWf^CH+f?A9SC(<M1jqnz(JRY1AKW5hVW?-|u$E<90nUn02N(o_Y=x9g
zj9a-F7#6dNGBB+%ffOo?vyqEmS;j@upn?rjJjyaILMndkf2lGs9JZHb41m=fYyH4A
zhb&`&7PRKjtgn(~477mO7S1na8G~W2lzuPE7z)l@po`8P$udTPIb6BL46=;iIc-oW
zn73ILbPh2CxatCVB@XNrNI}aO4=y}F4mXfxOaPaUix^XjKqXlR7dTexvqVAB!j;J&
z%a{kYfQ5k}V6iM?xi|yUT0c<+rnTB2{VQY{gCQOV3E8nQFr2z7%UA`DQ*c$pRUpd<
z+7b>L#o=RMuz4TLz;G%|meGmv1B1&N1_p)=pu%-sls2UBb5a5Y8v{fAx-|?8>y~MQ
zx?-}7PBx%$VPIHynSo*5d2LW-D$D3>1PUGohIOAA7}mX)0@b6kj9%biVqjP=$iT3k
zALJ&`^{%=rWEs66&J<^0+IbdiH4_5^8=EZn?CW))gK>A>VqjP=!@#f}G=5mW^BDuf
zdMyTq^%~3!Ogld@FswIYU|4Tr134Mj<pZb`Vbf69D9+5l3_28dy%Ph&dI#u9tu7xx
z`;*u-5C^rc_hVpK4;pxu_`u)_GGrBK<)a&?EO@>1x>ex1SC-KPR6Bs`-uiXz(BL(N
zRJ5WDOzUQ$3c(T=R0U}1qw9WIM({0`>)wKwG|Dmxf@)hQ76yieOJo^^#TghJl%VNe
z0vuG(#I2Xbz~H(cG{LWaMD{HsV?6`YdeE(~x(2du#XvO{8#sL5gY~e1lfox(N?-%W
z_-Alxftm%X2h@*5Gcd%?m1X4S$z+iI4NgJe{+jH6FdLTKI9V7NKxvg3EDEyUBu4fr
z#QsSfU^}16f$}FC1H<N1vd=-vz<bq9pUQ3q*U^j&OdHrBDmTl6RC0h_x7i$&PT3e3
z+=^sDqmv9bASQr%Obj=`Gexooz@|Z5&G0ORfx+}CPg*8}>?KanBo27}ta+I1VNhLk
z1H8dk$VYYxsC%>_0b=146_AB&3=H{aruXQuNz`Y`E&wNeHgIZQ3@HP^lgP4*l^B>d
zB!Cw3FfiDxh+<&au}HRo@dHB!Xd2Z9lnFMPtAV4bK@k*73=E)aN!EiFl>{u7ZH5JQ
z#}!#n=aJz?9%${EY%92kWSYnU_C-Bt0vKenF{JLvFaZs1XMh&TiO9CIGB9oA1l2fi
z85q_#FfgpI1984HFs$!oU|8SH{edCF0X`B1I!KZA14D)Z=v-C?rj2Thj9J`^nU_Lt
z8dsJ8je}?SKx-uMkfkQ*ph!#EWLT_h%!LF}vMMN$rti^ZldYd63+WquU`PiYxD4I_
zvuU12Mrjg*teqkQgYg3fhV}Cq7}n2JV_+~|C2OYz+LHm=PsG5m{(w3-Jve~VAOpkt
zmkbQ+pDPxZ6f?+z4x<6B+*|*Rfnoh8NYFT=1P!RM&rr{Ba2BZjk;}leNl=}EL3f3$
z1Eg4B0L?vbU;_;Wf-3FwHK2e?2bE6(vY^xPH-&-1>Ma8U=#1SBpk=hB-x(M-C@?T=
zkmLTqkiG>Pa7-L2;F>uddQ9!6EYKQF$b};5N9sX=$@+mI9khuufPraKJE(S@$N>t>
z^fwGlo92P|plK!0v<LXKn5`1BW{e*g>_C^AgEtm#R)GYU87PDvFfeS;XJFU>+WBw1
zO4bZ?QS%K3h7EoU3>!Qk!DRsrt_=kY4D}oGT%cw#FfeTf?GeyjA!`8(f*J;f4OI-D
z9~kVwSDAp$DCS~fWB@JPaj1~h1xM@$26ND&B=BJ>n|DE+qN@anxeZ+m3>(@&?ph_Q
z3+jA>oU)REVZ&mGQ}pX$ZaK}su;C;m>cA@%KnkxjFl@N$0yQ7xybX{T(uX<k5d*`9
z2cU+Cxd$j5L4A$XeNjyEV0SSvZ3z}CV2EOp2RG2c-QXxDc~I$h1l0brj$%?3j|Hg$
zbsnRb)I=E=>|cUs_@kKA!36=hQyj&l0pl2{MKS4vD@RbJpBcqu0@fqSz_i5~ToOky
zsY2Scke<Z!jRtJOd{I%1$G|RPWMJC5cKRg)P-i!a@i?ethjezM7>|S7`w(X_o)!nW
z3S5~-F+#@5SQr@E4n{FTR$Z|$FoXm~F<t;U3skiqtczm21mkG9M=@UI0NDht+M^h+
zf!)Z$z_64%iV?IrgW)UJ^eRI(fwV<YOyZ&pOj|7>Zf86VaXUyT0vslck0haCvY#u8
z@iC;>14&PWNWTY5gWLB}j2}SKAm<pSL@|DWarSdf|6s_bTfYy|>f-}-l6$(N7}H@*
zoo%3Fy^4-UF{UG0YEg{o4)9KL6k`UWr544Qk7%hyF&0TMFl`G2x74B-%b+ba1`g{e
z#yW5qqI8lQu17KUf&ybAq@IjoEP^H^J_ZJRe>(;S{`paipcOFNmT`err$#Y~fZ_;L
z`)+H7hLI?|^4&HKRS0G%R0Zf>Tlqc(#?PQG_4;}a1;(3<3{2bp34w|>1;(2Spd7-&
zz>s)Vf$=sd@@{ZtGAJ-Y=C{CQH>BuZ&jB*H=(qyoBUwnB$CQDg<%R;|B2c}vy$YPJ
z6&OKVe89Kkf>bV%1gYeL*tArPfx)=`0cefODh0-6V5_1T7z!d47|(#CPJwX;ND#D6
z<iK(TMo{x8Z?gj9aj>8ORLLrEgff5{?OE~)j6tvjy@LzfQdM9K0=HCI7#IvrD=<bV
zF))~JhiZ+4td|C-X9Y-u6f`WOS*5_3qQbynR?Wh|aQuV<W3Dm-gGn?C14G4J1;%2q
z?V#4<T?NJxSe~m`sK8hX9-9LXnS*8!RT&s2)+sQm!W{%!tO*JPRq)6hxM`!n$gLsF
zz+hCt0%|BuUu?prEDq{@L@6+G!}Wn?!Z@s_-!)-V7uu`vmJ#F_M$j!GkTEtfQ#Sqj
z6AHh<j)cSyBd7y#d@pFUE_<rNLzqcBHNiR*9x8*<Fb6n99=bCy?bPHcN-bnicr3%f
zV44i-x0r5sXJA+@qHvxO+;C;u2};~W#}&@QMh7pME1U<F;9q$`qY4W3=Pel+zzg0q
zs}wFm#wFbu7{r(rKx0mzk-wdwjtqyj!XX8y-A089hd@;(cm`qT0|n6PMX<uN;PFd^
z?JA(80v?D|*a2=ovoSF2e4zl@Py||z#$lwe5|q?-{s%3s;jmU%2{XIsxWY;+g!Wb7
zaZK<`g_pt%aQ<ds+6CI|<or@$21pZVM7w#d0_ZF&@EW0#-3qhBL25uF^BmR+bEH77
z1`kOYJ+@+CSbR;P7i9G=P{V=4TA{ud9Hiiur@};VjDoB?a802N9QX`OyQYDg7z%Cj
zpy-CgLz@}cR09SETYiOlm_pD>qs@W}^&odWh6XQaR{&^*jIMz~y#=U^3z}Y?s8H_&
z3Uvm5hI$6o9}1BDQXd$ySs0-Am+xK;+HYsAP^JyGh+)GA28Io9G{BKv=Fh-*XcGg&
zMt%l{ji4jtbPW{Bl|W`QFl;ntVA!Y&x=_gL14A}wDGvk3PK8PyW(KA`(F_b5Lm3!0
z27);03=A6!7#KF{<bim_3=A7P85lN#Ht6iBXJFX4mVsg8axVs^J)jm_wgUsxa!@yZ
zy1`L4@#)MKY$Elc3b~+Q+<g%e=b(&cst*aATpO^P-5D5mOjbyRM%wOQ5QV8oi6af1
zI6%$dQ_~b8!1MSFOnbyR7#KDSDnzJ)O)+3#$Prh7Ob9YC?eT(0x*LJR7(C^s;I0qy
zyFeKO1Gl9@umA%n^DGxpFak#lBLmYOPy*g8IQ@hLn{vH@g0VPAIV2iDM=&vb1+_go
zCnzX@o%(?x=?Vh_3wV<I;9fOQ-%vq84U{Aq7&hK!VAyyX5;F?+VD~X>a%W)Jq^|}l
z1r!ubz?qI=(=!H!O;>Cfm{!mFz>r)3>c+9ZR?rY&W~gUcy@r8dvo{07X3%Y*t9LRm
zY@W%$u(=g9#B+>+VT&vS!xll%5YJ@>hAkNk3|rzroCgdHTjnq@Y?%e(yk%h6vWkIW
z%Q6t>7X!nV0}KpXKv#vW5n*81a)W_k%LQo$rd{q}t69J#1A~Yx<5bXQ$i4HJ8JKp3
zFfeTS!N9QP8#@Ejt^@{#t;`GzTNy!vQEMVTFeJ|byZFB><17INrUUbt8JN~&F)(Zu
zVPMz_N=a+V85p((GB9j)XJ=qq)55^8wV#1uYd459k%3|BDh7tFi$I)t3=CUuGB9if
zT|~2HH3P%eKMeH@TYrG0wlgqn6K7!9#t-5gVPM$i$iT487R0&8z_2Zhfni$+h;xsD
zVOtUd!?py_m1t{Te_%+x0}}qiz_6`=fni$?I|I{N1_p+06B!t`HG??Z3=G>&GcasB
zF3!NTa|YNepl*_|EMuq$1Jk}spo3m^u3%u;_K1OD8|Z|oom&_fw*6pW*!Bf<z0Cmz
zhV4QO4BNRtNAo=Rz>vIwfdN7?I4JA^?X$A`$iT4OiGg9eoiYQn-EYvumpJI?fDa5Q
z2B2MN9E!4xv4RXt`@Vy2S)0eeuswl+VS60tZcET5PW36^n`%-(b5R_!j8UQtO#4B{
zzJPl7+jAHgwr4@FH%buzbq*lv5Iy|u6$}j9%fJWSuLTWe7&9>KuL1enfPrCq3j@RU
zCe{xOsUDz_GX|#p;A5(a!2@Qg9iU+~2G<-0rnPn-7}7w!wH5}Z{j))u?HL%hPh?=&
z-V0jdlj6a^Y<`Y`X+LD|JNQ=XlnAKUQAWlrmU;#g@PW4}pe?W<m3Khr;MOwKGsuAr
zSOFO?-2Z2KpbeWi=N<;8wZRNb2b8B5+OWyhL&s1Ln1gyDb>MzXDi6fL2S5Xl>}3ol
zDs>D>pf-4_4X6zc^3oruid>Mca<Hy6n65^USg8QW?lc*&H<=EAS7g+Iy`H84)(c7y
z|35I)r|ke8@Xz5a%Q#<wf$6|kP<G&FVA#Hzfnob{5J#GUVf%gthV7tTh`ZDo7`9(!
zVAy`Xl7VTLF#`if5Gco(FfeR?$H1`t6*wl=m@qJKBr-4^^aiC(QwD||Yzz!L7+e{c
z);N7&NP`^R#B@*(B<n21z_3G+fnkR{s5_Q+2NX8b=i9Q0*Qc{UZtXZ25AqHNINZ}E
zAVGN$bW=0R{zHhg21q*t(?O&j9eDi-Xt^M$2j~L!InzP#F=UX0kPeAT(1{zO{J~X>
z3`_?f@Fp_^*H?*w&a?$B#a$I#CjeUZ3OdRnKp;39bR%ARN^k_Iyg$Um#=wx`9Sj)*
z1evnBDA=Eof$5MW$P|CjVUtfm^QX%HgPlOaHXvaq(BX4WAv)c_tuRn4fQvC$4{T-?
z8v{dqyhN}uxE&5!dr%l`4B9aaTJ*lCJ=h#3uKy(19F%h=fzR=X4A9g99lG(A8FZ>g
z<}^)p1TXZsrZR*#myv<N|K{|35G}lSdWIDP!_-gHUBMPV<6vNz`g6Lg5P0_;WQV;g
zXvyzUHU<U_mg!y)x5hCrxb{!C1BC;Nz;sQJ*25wk3=CEL(=|cU!k{rEm#FEQph^8n
zpfKU<n=a4Dz;rl+H$N?nVY)nMMcYo^{5*!~@}O0+plt^WH&0iFdCOtWbY;+jd~gHi
zyx??Y&}a?F@8xr*E1QAmmvtE!a_pvyfedW~FIk>02C{7@LklAV!=%9Je4xs1XB-2=
z)Xi2_psR=E<*gv=R2Y~Jzvp0J;B2>&00kXrk5k@eD+wu3`-6jl!SI=tgen6AL;Y9q
zaFvxb$jcxHCLOhs0kJ_tTFaHJK*y*vfIW9ARWXW@f$0e7#E!hpilDYJ!&i{6&%`MD
zf+Q5#K*Mc{piUUWS5P9F(WvMEI%_3JMiH{=hJopb8`wHU6R;Hwx(xgb>AZ@dKs(aJ
z!N8#9H+{bYn?B!sMR8DQA6Wqr`{TeSVZKL^ALQ9d9~j*BfELk#MzxOesev>p@`Jh*
zlNcCw=rJ(t0Np<Cc7cJ}_9X+;k-yWu9oeMnJwGtGJz!wAJq6BWh2WEC4w`U$W@KPG
zs>)NwzyWHjF-&3r?JZ4a<#++I=_}|&sim(t&VV@|7;Hcralq|^V>TK|DQOHGXF#do
zD+9xh5C(=FUK&ZI#S9#0K=A_-t7c%>Q5wL&z$(nZlza4-Vi^O+Es!&JGBE6z$H1^-
zjxhtXWz`1;TkwT;wxER!3>?>a8JLdl03D^@&A<S<PjAO^29P?t4-B^8TU=~GYoHl8
z?t|1l0IBn5VA!#RfnmocP{CrW0XmI)dY}`VXuTcS#Y|ulwEXlOCj-+lC771|3=BK=
zg0-+PFdc7UWXxhKX5jk&UkY>xxgB_+m~tM+CQ!q4(gy|`&}Ap!!Sv%|5U+0n9qa}2
z$~gvx9VbA?QQhR&1WvyU3_CtEFzl#*tC5^oz`(Hy)ajVSz_3$-fnleRVkQH}7Es)O
zWnkE8#K5pqPaSm32nTo+btePEP7el#oi3~&7;GXyK4D-wb`ca~pasX7jAo#s-ewNS
zy$nppo<bzRVtb%s;3bb>#Z0lq;CVWm3m_?oQqX8wF(V}Ik8`YIWMDdO4bCDQt0X}?
zIypewk~vmsgO{FLF)*+fae#Zq$6I*8(Y*+qpTRn&A9QBZuV2G40UAKo1q=)f;1S1@
zf{*~30NR2F@=*c<!_EjbP)_8S02-RP!N9O{0t3U&HkS_!)}Z?`0vMQ1JXU95IJ%Bw
zGAQvBGcfGj&%m&AuPg)8#Wx=qtXF`VWh@Ukrg1VboseK=V7mB+fnnz<hI)pbpd)K9
zaWF9Kyve|@^E&7NyGwmw9V`qCEN>t>Jee7oF3o3P*!hHkVdo<dXEg)E&MyoMJ3oPj
zB*9jIZ|t-NEhJ~)m@dY^bOJPd3$kVxBLl<EzaUMZ&@o_O*af-*klDKH1A}$_15hi;
z8g%9^3&(T;2Bs66nHiX^=P)qrvSwh|Wy#LKY`v0!VV5@p!!A!yJXz0RV7esAz;xm`
zC_*3+WDUM~n2|A)w}gS?k5n;(qJy^zXq?T4feGvv@O2j~|2XD=rb9vg*cHaWunRQR
zS$}CY1H-OF28Lbn-~@a62S+`qH?i{rgVh2C28IiuBI2|*BtGgvCErd4hFwJr47;)*
z@c~*)0vg%fwTOXX*9?~r3|63B)FBK^r*=Z(qX`-xyDl;?>^cvP533vC_*lYG-^$6r
zbP{xaEjXm^Ffi-_Eu;s<$FA2547*;!;=}3&=>7qg4IE$%prcR0{`khgu<HvbXjd~Z
z>}F$N*v$fu4+hYlZfnpfNDLfpVhl{DKxff{Y}qZ$z_1&%a`X~td(3Vp28P`Zpc2A*
z`v(SV5paBfMsry>+5{MwPIZFf<0J#aZeIq5-QJ-1xW>S+JC=cAceFEPvdJ2JSe!Mu
z^x<J_1|7u+YLo8HU|`st25pmCgO84bs6n(zcNeQLFzha505{64PC#Pz)LcZ&TKxe{
z;7;drXA=kA?`fR?4z@!aJ%S8Or~X2xwszMsFzl{@PHkByfTp%s4k1}GnSo*VMDQtx
z;KX17YHPEc<LHJZhTSU|7<Mm%1>$A~hTR*%Y2knuM;<6G-1xv?X9L<ubOn?c&dh-%
zhCFCu*nNzFVfP+LV#rg5Ob6`YVqn<)2UKt?F)*D;gd~JQXhHyWruT$G6M|g{$VaRu
z93`9#Os984Gv=N$28KPLn<qi(U{5Op!=7e_dRa(fwkrW81Xc%#jyE7@&u3uRGl79&
zPalZ0nt@@@0tSXX^FS#FlrinVT{2dGj#4oOrZciID?sX2f;4b2FzngIz_4crD0|tZ
zKqBFcAv6+LKQP$M07XJQ1JjvsM#fB$#mq}3bygU!K*?%F9~kU*fLh!jTS38Ww+9pt
ztkE1*@(fI8CV?yhIrAt3!=A$+4#@fo3=DhDfo^rM`vGoyXE87wQRIka`@mocYWbc4
z1@}2qNN~s2Lu-pY4;dKt+=PU8EU5W$gMneMAOpi*c8#*c90rb9J#edsVXqql!(Ka3
zh6H7S00yRW?2vd!fX2h#0tSY?pd%eYfn+5BiU*cdj$}>-rn3&vK-yc)z_7Ox<Xlir
z+1mx$8vyg5l>jInSPCIJ3PFnIGcfF(%D}L9GKjO9fno1b28O+hK^nkTSb(i);79>k
z0lGyRlo|JKVPMz`I-434)q7tsFzkH>%8ND$9~i6xKsned0OWp-lzNb^>&y(yHhByT
zd%rL+?EM7dfL!>Wfno1oQ0!T;Kw|IgYiR6oe_*gO0mUBf!qF-RoFDo*GGX~)9~T3|
zKG0edP}#Uol!0NNFatwYJp)53Cx;K)2L_8B3=9n56MZj4Ln6lq8aMmY7#Q}+LE^>-
z8aMmG7#Q~XK;p&+RFUswVA$8qz_72`<pYDo69xu`7zU>EFClT`4~?6BTNxPkZHDF%
zi!Y#nt7nnr2;yX5ItMzF2^4bs4lpq6+Xo724hDvO=NTCGodpFoDDhc<uLNY#1Zy}C
zI-ng?Snj*Uz_1T=9x2#guNWBiy#Q$d#f_y5$O;w<4$zG`=dGd9zwajl!#>cR%b>Wa
z->=KSuwNS-Ih`LEEG<BhV+lH=gae{$Cn!3mGcfG8WMJ42y1UnA2?N7^7Y2s?PN0JF
z7+4Prm}Fq!;9)F~1(jdd85s8aGcfG;g%*^S7NBMN5OWcC{O*rpP-fT<y04q{1B1m2
zNGzW}i-=`Q2~aFgxAS2WukZW7U>O6BRCkUDc?PBnQlLPZ&%m%hm4RV@GKjO9fnk3E
z1H=A2&`GhNOPwuSzyT1+5vdPzRW$>{{z_=6YS{wH%`A~fE^1?7*x$kczQIDWg~OWd
z1A`-|Q*wf_eh#S30ZACv(1fvnHUq={en`Twh9->tPZ${X-+&|xYf!?t!N739gn{9J
z2B_d{Wnj9v5|SwFpo!u@Dg(oTWN4yrv;jGobqWXQV)6^1GuJ_B;s9t8@c?LC5)@?z
z>KPag)Pmv|lqei+KpB>G0a(XH(3$t3L~)>tf#Cq?76DMAI53NW;lK=#22i4K1Rq<>
zx}L*{lY!}CEHqIZSjxa~U@<5VLC4f=VPH7036%954Iq(nv9KN*E36+F98*BC!oYNK
zI?jUA^8<rp2S^oYHnR`ZF@l!!jy<3tXWh-=F3-Sp5!@)4&%kit00YATaH3z$z;NI+
z1H*xnpcc5}22gh$yoZXTo{a%C4883qhZ#EqgWwU6yFi;<S8<quj!-S;05=oOK*Ko2
zpv@c&r5w7T<<P|+7=%EFpQ(U~-AjFt2-F2>*~!3g02Db_lo%K^uX5;%F)-MxfX=oS
z=}-iBSip0nUl|w<d}d%cQ2$X6(kl__0gXd}&1B&);0JXZx)~S_vM?|lWCD-0_C;~X
zg2tI|FfuS*+5u@G%Ysg-1TB{4Z0C@LoNueiz;M`*LxK<F8Ia0H5S0>Or-7T&91@Uo
zea%5>vOWkjAH;O&FL;GX5MvN%eA|h^oPi<WRS+X+WZ^Ps3+}=tL5xn)3=CI5b5Z9f
z1TlI-`V{623}Nj-jE0O1OqYE*K?@#&7!8rtSwPfDGB6wv3IfgaFkQ}oTBWMNz#v%f
z#30GQVA&kRC=D{B8ES^K1jsIsRMEL0Mj?<C=&loxGlZmIQfn-O7&$>wJE6Kj3nH&P
z0F8<mObPl2lDPyv=^*Hz0t17f6G&qAjG%8IiPsQ`Z}kxWs(=o33VOrHz;uNLBJ)Nb
zrbT*n5NKK26<LVHW4Ku*azW=nI?Oo09zO?hm<j`f@~5C<APIkn#4#DLi&YpH(mn_6
z14(2+B=*TL)H6UF9I+&58%PE;=&*1}&^EZ1g)4)mgCv$fY@aR%au!btL(pvS{3e4n
z1B3dcAW$z0G&OYPAo%2upi;P`nn@6Bf6<kD5Hmn?2!c)^om)QF2gQSX+YC%sg(0%>
z5F3h8(;0%2K!p@&fF$Tt5a^I7jx<mh9()`W%*eoWRR`jWU`Sl4Ffbf_8w47dxata#
z@P!9R#K|Cgkd9`E1n3awD-YNh7_{^2gWv~2*e(ll1f@*aK~$hMJP{{B7Ve)PWCGF-
z+K;esNf2m<IV9A=U4pbh5?dkWg7y+aB-WG$fyOwl-iAoX%YtG6GV{mqxtM`rO)1#i
zM?v+Hj0{ZI7$M3e(Ut9g1j-34zDkUzK+0Bxf{#~Z_+-e!z~E)4#0Z*{0k8Vr$f3jt
zDnuD3fv0Dc7=MAzp?spm_yUyvZ-_E5U5nsKDq>J#ydeg<aSL?f<u%YORDIb*CB~Pa
z0i&;Au^FHR0_sYPuR$H;qoCY>TZ!>KF9U;+8fXpsdL_mWph930csU+O?>Eri<FDXt
z@PU>}j5|T@JPghcN{l<fIT4hLr1+H>H-V&HL!~xBz3K{DIu8yKDSnV&10$6fyBHam
zu7j3fFI=L;*abEN8g!rX7#IR0L9W`P#5fV0IKWH3ruPK1N!3>=F~ZjiU5^q1Eoo9>
zOa}FiZh)2!D9I}^Mu8F=s06zXn*5gero<Qp8a)KdPwiA<42H{tHZA6DR$>eWb?a|1
zfL4e4yDBj{GMY0mxP4Y))CW28I6OkQl8WjXlo(CH_nCowd_Z4`Q3|By5eoyurc5P9
z$RHcYkDgbR7}*&am~OB^1A|=>lsw>Ofwa$WQetEPsR7*-1_}oT^l+Hp1WH1iyp%wD
zW^V+7+Pn*wD18Mh1J997RQk=z08$g>rSt$~R2evxDLnuyVPjxeI7{gbI1Isx?3DI{
z6oE$I7A{fRkEG}{SP@bbMA?CK<Q!F60Mc;_V(fx?uofg`IiS(ig|n2lf%Sv6ELZAh
zWMH}p8kt|XM5!M`$8wOW241B?kSbM(!G&N|5cjqsjA~Je2Pp!b%d&8ZQoJ;{C_}cr
z1!PuEg%YT&xLE)(D;Q?h)agp#b+0!-ilW$++(2ecg(z}EQUtDNz^9?FEmQ&@?R<+B
zRB*ggf~@ReV_-;rtfUFbW%ZyD)R0^yEf5F9o;qDg8_X7EV7mE)je&u)Ldh7Cdq5)J
zz-KimSwT)-08L}-%PZM{^BuUtZTC?E@74h&*IUZGWr;ZqN|F%m<_rvCg@H`@j0{Y-
zKzk@S+XI<OR6urtR!5w2350CM0dY8=1u}sm9$ZZ1ZJvH4j7?pqAdo2qWYSj#rd#v4
zic<?20-4f4+P^a7GB7k;2xJO}Nnf8X9?qu2XBo)k%gexY8?<C2ns<6&IGb3#V0|Ey
zKSW(E1A}K<Ame{Fa|Q;xMS+a>7#WyuLy~SF<2`U*2c_!x+kuQXK*ofDQ+^=h4Ruh;
zM~b!h+aPs%N`Z`LLFx*j>du1Ifus~~2QnT5N%ho2<&MGSB&G&3ZUD(Ghf0AKeO-9~
z(#B^K$T%4!1zHBRa7iE|=tcl=Ya(xRAR}nSIKxhmI(ErG&?Y;k+pnNTfKIH17@@K^
zkg<}Nf$0t_M5>;#5^l4KX&_@ENKOGF$5;rL;yo3}m<^Hwona2LIU6p;b}5iC1tbLv
zjueE{u|P&skknGBfuIBB!0z>l4`c*Sl+=T^`?%BxGFpH$1q%bi{=0#UmM{)ib|9lA
zXuNt7$X~e?fsAS(^KJ<xXB066GOB^cZaEnkDt`wus)2@kCvh?`u$~BHR5Jzl$t4*W
zoLK@HB|)0LawX^IFa$D6gAE6n7wiyN&&b8gz;suDt0=#mA&`*=A~y$ga_iJUMpj-G
z(6MrXKS64YdBFOALzJj6Fx18dega8E@Paje0xdI{#0ypgKFoL$C|gc;4txMoRLcW)
z@*}WrHn58y@iH**Gk{e|&I>#OQnhIM$4EBGdKCtSqML!cK_bT?hVKS7OreJFhKx6;
zFfeSs7`Pgw=nXH}aL_Gh;At7I9f4~>IRU&mkXJBp0WSm7Jys5|tqVYnSg@tOb%9+V
z2@~G5bcVn#hz&{U41w}ppoJiyi6Tjpz%Ed;9jsn^X<#i#edP2NQEYO?Hv>y}L3;?9
zoC9;fjQop%X`leBSrrJ%X7@HjT;&UzMFO>dINPWHjABz4ITYvt&Tt@KJ_u9?8ToO#
zNi>^gy=kB#H#pvy?(>0<atZ{WHop_p%v$(5P#Pww4Uv?E__3Rjfq^SEPz)>!;_Sa3
zC<x|&TIZWp8A0uy`<dW0sLE)9Sx?Ewsxs;_GBDNOp9oc?3obp8vb20GD8YoiQDszS
zWMH}vX)LQUDudOrfX2yH89{A)NCpghpbBnp-v=G(xNwOoqY$z>5wNpaKy{ZYqXalX
zfKp1>m3q|=j0{W<KpA7<64ei2J)jb|T@`$g5#%%<)o&o}prU!<EY+W2-2yyi466S@
zVLFKc6jXEhR3Cxb06Q6&9)MO3EnK4d2;7W>dI;1goXZC>8Qiwo37X-Yu(@9K5@-VJ
zK|6R(OclIVawlkk%2XlM!(anJ&f5#_+NmA}wMlk@ruV#64}-c;p!AZrS@kfe`8f$R
z#pW?lbqz?veQ=GWx&|%aRTvn=E~+kNWMFy-N}3CosD>>Cdl~9VP&-NNA}C}QHmJ@5
zDbs=&Gz+W>;(YKekKkmknWx$SQj`f%)PPVleSIvOlB@~?!xT}~RFD!#^FTEfNy)od
zHYHHD<A_!TO%OkXw0Twi5lU3SQ-nJ~RorG5)kx^1m^A|f>vmN~aNsa7Jraai?uZ`R
ztlJ^ZbqB>AIJC`;Rdqmt{YV=U*ruEepqV95XrD<@6$2Z{$iVanwAtBsm8ux{KqyFP
zi-E>`A)!6}U>utYrz;y1sOo>TX!^T2Hidd;HpUYmqaTCnt{E@b7*Bwwr&$;n*0!)Q
zLK;FW3=HlY*bu8`v#zi)sfsZ$J=Oy$t7U_%`32Rzr(D>Wz)b_t4YQ90Sr`~req>`j
z2T5(9rJ43y*_iafT+r%5MK%Q{12B&Pw8BqMUXp=9d=VStZbk;C$DoZl?i;4Bjc1dn
z-_F9uxE>_f$O&=FdT;|C)WBzB+yrTYnldm<>t$n{1NIGQp909ub3h3Xw9Ync0~_N)
zaDYNIt$=8XWnfsu!p7Lm_<=zPG*}h_8eMo|l?kz>8x$5_8MErO85rt5urYRn0&^z=
z!$Cm?hJ(DB3=B0gY>eHY1>KVvGcp+%rtM>6>;_#<wv#bkih*HmEgNGm*iHt9gGLMt
z2em+gEo_W^;GD?7a4?90;h+y_CH5(6HpVK@X#P$HrYE4=2{aYiK>L6g7$$LLGSss%
zLbex!vYy8Vwr?OmJ^`H&yKo8HH*i(~U1^rk#P$T_5zvS%_$r#Gpfg`u7qEd=129Zt
zU^rOJz;G~Moq>U8E8BCJ8>TZb9P9_3Wg^J-0w(s9f#Kjo@Np$<pbe1xpzTM8SQr=%
zG3hZdJ)1W@Fp*8Pem&?|3I>Kle9R0?&vr8~9Fk*TI3xq=R4?52fk8+CJiG#`Kp5CS
zd!P&%7`RWe-2*xOX$Uy!v)u#d7^E!BeG;^X#Y&Rx23T1hMA;3nGLX#C8nz2ynGQ(n
zpX~xfN`-+TU5xEGBLmaZg%CZ*;SxJ|*g!)7PeDhiEnLF34<ca*TFAn-9c<VYh?ebe
zncyXC8^AK}ATk>uGAaxV+xM_7W@KP`CJ(iLF<6F;fg!G*4Rka!zYBPq4jXvo@K=zN
zw@qi81TyOxsGYKK3EL#F4p2!IsLR$3G7EGR-@+wq-4F>w28L~cY|UUTpe;lTm#{TM
zWK<X!wz;x_j(UFv>J`*4T*6j^kg;Sd1sOIE;^I<>geC*S>cea~paKHaX?k`7bemo<
zTMoDj%K>(E4(PlsHIPf!1hbigtbGnzg}QJFn>pAF&~icsHgnLZC};)2u{UhypwZB;
zpp#$2-?D*vt>8QN4rZ`{+IwL3DHk?yHv+WULQ|0qw6qc2)Ck+a20jNCBz~BM4SXZV
zPS9u|>s&VQ>1mS~n4Zt(U|=}q!lnpvBS>M`1~y2=&c?uSn1v0}=m)K<34hB5zKR;8
z=wJpLcozbQo!P?%DT6>)KXyN16K4DX8fRo+0B;j|zVAI_1p}KHIA6+vdZ#Q6{>-3T
zpPpYubV$uXha&qkJ!NEIdI7R=;SztQr{IhRR|D#XH2v~tf@B&{;nuD1&-4LQFiisS
z*4_4J`m6{!s0n0^pOQZl=+uT69^iI^Khs@Q^FVEerH1}YdqH-BiYkzudzC=l1x^MA
zkWG6*n?fc*vJ2zBdQS$1rH0_8-TqA1LAxP>{F%;zkEa7!&k^L$bW9Rry(9y})HD7}
zD?lcLDr%6)E6}T*sb?VjF#MTT>4O$bF@PN8nd#3onUR6%CFrI$khaNSM{_bTaMTC+
zGfmb9TOi56V8rXslnYV_>Lr2{=88jI4suAYE=-+twLeojNL?&66w=`a2Kh6kgUy5Z
zkl~Xd1A}xm$Q61${!GyzO|4K((UJ@d^;ba4|3RilgLQ!vnu+=|g@6=-R%C-*5du!b
zAm;}8Gldv}TmdsZkAcBV6r{<e&!5Q;r0G4>bU$QGe(0K9`aqhdMc4Z?fj0iXf+Y_R
zWL+NUx~4^gbRCrPX95lJz5*@t2e}V2#0zzw6S}5@QeaK&{!BKE3{0;;=ZJzdfv$qQ
z@&MEu1o_?uLl-+pm*G2qCeV=0E6CWCKa)OkK<k5p3>FlI3=D?vK$=V@`-2W2V0sN|
zc7m)@N7kec)&$<D;LoH9vY!DqbO?$olgXfTr!Vi%qzPIqcNCm}^qc&d6c`zpUV|>N
z0-30QY@!0#M3Bw8a{i2<0p!=yA(6oN4@n*4Kd?F^=jzI_)H5*5{^HLB8d3sp(@k&l
zXJQ9eV4xb_pGgo>!%H$S=x6vdf<~HOpMjeF2HEU4=w|C@fE*NB>dy$u{%;tenw}!X
zFXK}~hI$5JVVH~Z7#KoJLAt~?`ZL~PWMFy|0M&H|S=SwKRIz{^&Ug=00)d()>23au
zpk^-vG;4#8l@!|uGOppBKjUeTar2?Zokkc}@6UJ|**wUZK`aamAoI?F0|Lo;4dD1~
zc;pXmT)lzxHT)TOBh2$>+>LD9US#L(!!Yg<L%k#egJFw5<3>gXrnjKtbm0<z#*N4!
zyAd3+Ab;pP`ZI!7BfSNkCIV6iT8;$Ezl@;rMpzi6&UmUnBdC6T3mTgNsauR}-eS0U
zh9>@u^)o>h&xQufOk{;K!3tr%2c>Qkkm>68{TX{fnn0VuK&JO1YwAVUq<$ZyN#&70
zV>u%O(>u`ePLQT@s3r*pjv#-=a&%oPkEZ8jvANZM@MkOlX{&}h5Om=$+{Xpzy5v59
z>{4It&zK3)v;nFq6KWUOs!ViE>Z`$;7Wy-S3deV#t-&A%f(pkg_0YnR5mGpErQ{bd
z_%p_fF)%0xgSYMZGlHvM<P5C75M-W$nLi__41Et;!3Z)h1lbWG=#Ee@18Gv{@Mi?g
zM7)Reoc$T=eUWwfqU%!U0O^t_@Mi>dM&3iFn*15vkTtoXYmz7cX;PH;XB1{+VEO=R
z6@c6)jI2o*tcfdmx_%CuS@>puMk$n}3pzPp9#l+q>-#erLAxF*3=FF8{J(?DJOXY$
z`F{r+3EK1#<o_LPB2r>feK&ni4x35+X8(U+v)LFJ?3?}ngV~_1j!gcHpy6JINzg!N
zM-FseaJB+9{}lfFgL?2EUP7$=fMn$du$3T1s+av=GBPlI<bx=BiKM9hC0v!lYyU?e
zRiI_Y3zztVHX>dDpMn(R{|K%~^`QS{kRs3&)50bGmywLR3|7Qb#^8Sy><f_13a9-+
z?dgweAT}RIQhpq)+@A-WrcQ!=2R<^~A5sJ%1(m{SkWrc6{Xv=f6Vwxn<v}e2NZ>9u
z1y#x5R_S!xJT~$AIR9l53{0Q+poW0%M#=mRF&#9H!tfQ;QDpt3!oU!b?O(yj!1U=P
z#DNvy2|S3Y6-IDV{VPDXr0#^c6|@puIT+lB_6PNzz>QM-W`A&125LIGE9Urv?{@=n
zjF|jE-A#s_P`6x_1z9@%OCFm^eV9LJx`g2?Xat47*gqTG!e(Il^b~X;n}0U=xIvIy
zq>;ZHBLjo-YzC&!G7!gs(zviNPf=<ygFoo*Hs#r%VFK3s{(gw$$l~a4#K^$(*%#tB
zBXB9r!NA~~<!=OPiPwXg;vWC}jV!?{IYD<zJNc`FbaX*<sB1vOSnY$qI_zEnkAME^
z9v}^D3=Bfo{XskLAR~$^j`@RT<vt&WXqE&w4LKMX)IRu2f<{e2ORGKp`Ab^CG<#q7
zhmMSb2KAD)XXr4381+mulo?|f7_v?nFoH(%mH9s~%$vZ#zyQ8|?JE=bG-LxtN$6?F
zhs+ol4(UuUEMQZpKUBcLa418LfuY;afKiQuf#I+`(?kx?5yLG8jP}q&h!6EKFdXV(
z{lGA93uODimtyduf(`-DnqC9YVXhva)eiFxFfh&bV_^Ey0hI;`&KCilhsnV71+;*V
zd1426Tg7|>24+<r2B!KiyBHa>m?m;UFGT!i0@eaPLX&~%%XwsT3LwWDfB6VH!qyL}
z;cE%#ZjXrupydwpYd~kog3JS*yy?%tp!3b36`VpoFwFYGz`#5QG|KS(n;HXyW3fT2
z3<HC3y)XmAp@j?#ho<L&a+N^`I9GvOsSau_7<5944TeK^85j=T1ozAh`e9=K7#I$H
zPyz=X=&VL?$SLL|B{CQ+0V%n`z;M`zf#I-$Is?PR5Q77dEY5J)m4V@~tvUlkp^w2K
zNDg3NIGoMEa5!C^fuUoD0qDee(9uVSTNoG)*SLIOm<w9r<HNx8^_Mzm9lXIc(74uD
z28P3{85j;P=KjDiHwP5Nu&`oq`M@v_wCqxYf$5v9LT*wKg8?JAI0KVR3<JaA^9&4!
zK`Ww|6^%YH%&rHiW8jN3=oDaJ`qshBz^v%Rz;O6B1H<8)AdVjc!{O%)42PexGcYSg
zF)$qd!oYC&gAD_-V(JHm*#@A+Hhg8QM!X=kr3?&5*clj(u!1;^3=Btv85oWTGB6l3
zFn+!Afng4KmH8adDsvZuJ**5&-yN74>KVVjV_-NU$G~tzhM9r!>q7>HBRUKWN3_@(
z7{C5zU^rsVz;MJgpMmk$RImxmV3L7>L4ehri}eG;oDc@a?>`xszWo6u3eb5ztjr%6
zzlDHO(VQ3tX4S6@Oy7k;yNN);1)x+ir-p&?2WW>6qbVa}eI}zFBVz_wQvoCBewbng
zMy5UwX3!~ppc}R=4}M^ndj#yyR)bHR3{2nam>HNY&oM9@ac5vS;tJy2f^paxm@S_%
zFdPYCU^o&4a>DEoNPhVaOZ%w#Wp++IB*T0M?WX~yI<TfWpx9(!`VLyl3>Vx3$uQra
zfYLW|e&PPWF#8Wk2R#0*7#LVC8)SjT6n@BpFH<lm2KP@P1u7%xq!X6Qpk0!p78?vA
z!8wG1>4zn#3^j-Z9XvS&REBzdHjsnK-3H6a$$^e@1#PE!IsIS>o4Chj1Mo-y=v;lH
zlLnwJsF0c{1JjR1;L#WZJ#a#0V_;}iFffFavLM+55LtVK>~w`vHi`OH1%m*HDux&a
z2D^W(OeJ9ZKQPP$m4@J9grBY!`2`HDOeJ8aFfbfRXJ9yz2)+cCl?gP}4jM8$($2te
zq*aQ6L2xoFQx#}x>MH}okx2{;M<#H8V3=va!1U7<6pWx^0(1v+0xOdXBWNk_*AI+#
zISdS3pu4%4*?J*Xxq#1cWnegRnt|cSLU9IWw%!kn_9CD(!SjrjDO!MmnH7`{*yb}Z
z96iUtaCD0}=<3xEjP5?5<#xOxtV|XH3`~EdnHiXBq8S*Dfp9oG15-^J1H-XO28Lth
zAWl&|1H-Xa28LtJ$_z|3b<7hVFo1-+7#NOCWnefq8N`{!z;J9K1H-ZTAkHENhGT0P
z7>=z5sb9xDv567H*u^~Y69b5GjA<eVNZBO@hGV-K7>;cRaqclN9J|24aO_+o=z7>!
zwxDZN85np~8JK=&*0VD()q*a#xWmA3>=uY4z`$_q6$8UD&>eZTG7JpI{xdKf`wf!O
zU|={d!oYA`z?Ffi*5m`D2WY!N2m{lvm+}luwWc7#k@W+k#|+TU7zU<a8$iKbV$1*%
zTLKk30v0m@i)~<Fwyi(K!1U_|SkRDx`varL9*{yX-+%$M`mSvC2S!f?P`L9t>+IoV
zVEPR@{k?1l0|V%?oa3t89~eDV7?{dI7ifYmNd{S#05XGt>9+yM9Prs<j2<~qF&B_n
zC1{m7qele;vx)5~2BzN;Ai*jIumf5^3PJp81_p+r4~+IF7?|01uzp~4Pheo08_mG<
zd*XD1DmKx2_X-B4xyB4kzn6kk7ekCxfNT`{eF#+i6oYQ}1#J^4(Fc222P*l9kui&-
zn1S<)3g;hHu)H2v-U1^3hY2eG1}?7)cA5`Jo{=$&rI^7(wH~Zdhk-$wfvIoO2S$el
z42)osf$<0{lYsyO)4vqZwLOa%7>=7VFdR2zXJG1E%fN6vn1SJVAc(V*f#G;O1H<uH
z5a%cZ!|{9uhU2-)3`~6&p$W0?E(62ydIpB$wIC%g85oZDGB6zP1aUye*dAZXz;JxA
zG6PdTBQz!U^D<9t1trOTNobPnS7n~q0v0iZq|JU?28QFC85oYQ2kpk~_x!-<w8EHy
z+1~X7qvHk!CNRmsAfcPj%E0tjnwf#wK8}Im_&ElK<HtapAO?mL><kRY|JO@=V07F9
zTI<MQ3%dV?fq~bbf$1-3zh!?i1H%bb28I*L><mo(`3wvv3>X+r=z%!Z3=Ai185mAj
z$}%v4l9rPLIB6y7HgGa9{cU1qU;-tr6aEYgCw#d-Fgm%QCM_opQ0ib{`a6x$f-#E;
zyoHp}Ndzjm3X~AQ7cnwAff53Edl={_Yt|2p4m%*J=kG00>JhWL07*Q5-+}Z%5|85<
zQ2a75{o_VWJfK~gjE*;;lG@W7s@TLipFp|Z(-%~+iP!%CabZaVoHF#mDWmHkD11RF
z!)XNr1LGf7CL;j`W=7CePhA%o7*519Fr0{FXJG2O!@zK&g@NG&=rZ`O7Yqz1`WYBb
z^nzr*Ffg20$iQ%7t}+8tHv=RRLB|H4*vr6h0u<cc5)AbWCr&ajoH)+Tz|^h6z;NO&
z1H*~SAdVgb1E|w-k_p7IVqiF#$iQ$i-WGHP83O}vE(0^85lAMIf#GBU1H;KI5GR#^
z;bboZ!^uup2Bz-94~))R7#J8ptBw;vvPBFGCl@j>oSbjWz|`INfzkO41H*?LFvSp|
z*Coop%wWdMz|`Hxz;JR61H;KxAkHiXhLhVF7*1{lah5SKoIJw7aPkm{vx$M><aq{$
zlV@2!FgioS_&?}SLe_G4?geLUXK0B3KQmpihD{uFa{_2f;Qu$%9YNebplb^mm>D>y
zC)ThD*Sl~)`6{6J1zpjZ$y{;-T*A13lEzEW8sCxw;O#Dq&L_Z$ftkSzq!_%BiP6OX
z8ly}c6F~7<3OdRal4f0Ifa23-1_J{FkKSrd24;pC&~$t976Ze{8{8il>s{ucCS2zX
za2jQ10C^2^<pQH~1yl@t-eMKRmuo=QGB7jT1huUkp*FLAU~~z9N_+uH7%(zsvP|q?
zWCN93E|9X7nUMqJ{4$U^^^7i1!x?3ug4`b%U3x%ffb=^-4F+j<IsncY%#48`m5>vq
zsu@823()nbj8349mM<BY8M8sskb5>D<+sxtkZ}ymjG+C7jD}DnSwAp3{iuidj1hdq
zCe&v<P}OTd3c;>qbOr}912f|Rs2KMLMrRk0I*?r)a94uv`!xT+=&}YJ@M{<t7)@B2
zOavI1nLrt-&7Fba<TD0_lTVZxnA(CsIi#L}sV$Cy;p8U<hLa!I8JOC#7#L3eV_-P>
z2gE63U^vCaz;FswRkt-UFr1QLU^pcLlIde$IHkwHa7s&-fmucV1Eb3gaBHGPc|9uw
zGt)xQ4Xrv145u6!7*5%PI2H^Hr+gR~PI-YiE({E(B0xtLa(}32bh!g+g@U{R-oOaD
zV>1JEK`SW4UG_jioCzH9kPrt2Eab)kM%Ob8;0s%`m>}E0K_!?U15?AI4~(u4!0wsA
z%48-0y4!ja1H-9o28L6~$_z{mdqG7$I|Eb0NrrlcQ;QfFPR#@Ht}-y3+QPtaY7>a_
zkb&XUeg=k9dqJGH3=F3(Ffg1t2jcu>U^w-hf#KABS<s!*9~j+uz*f!IKg`3x%nCZ%
zuu+wP;j|b7!)eeYXrmzm!)aFrhSRpp3`~tS3=F4h7#L22PCRY&U|^^}J%xecG-#_)
zV+aGo>7@(|r$OuV8xt59PVZn~IK73PfvGWvf#LKi28Poolo^;BD?n8qh_Q}oB8M#l
zQ{yfM2HuSf%q-7AN_R6boW91uaQX^J<~Rcb?`Z~R7E6%K2?mDK4;dIv-)H^6==Onu
z*|wX3nS~p%@SoA`4^&Vd6d91r?Jff<9YCc#^9QED9!ADYCQ!2!as?}++X)8d4<M3(
zfkS^jF9S0RXonE!Zimxv7#L2!(qmw%OaUtZ*$KKQhlSfzNRNTpo&zk({(-UH4I&J?
z+yP=5i#!7}Xmv8YVdV~~{r2mx=VV}J0qrCN)qbbHGccU~%Kd@S9aj4>aTtM%F1I@%
zzkvKv1}VAR1VD$$F)*`$x?;>+uM$AX%WVOJIH+aB%qjp<3h}br0g#ucH#V{f*M9&d
zKZq2_>!AB#KuHgD@GaxT`5zeVE5K2Iot4QO)XpwuW?;Oyk%8e14+Fy)rlJpw4jc@O
z7xyvvF)&^g_`vAE1KJ(I`+}9pSAdy;@u~s?!x={ghBMae42)N`85qvQGccTq1aZt6
z7|zr)Fw~zZ2l1R47|twWU^p`m#PMffIJ1R;;mjsk2F5$a9~d1VA@f!42`d9LTOcz7
z;~fVEhBNya7|!ekaeNpU&YWUkICDY|l2IKTKyl^(8vhcIa|HE<L6<C_xyrzB<}xU6
zS}-u2dBDJM<{mQxbG?cS1H+j&3=C&paerWR@WGZ*K?Z?Z4LYEpVqj(~ga;RM$pLWT
zXai~zI`l9wUd;r_fv;5r=W<3v2JmTE(ITu&O5nZ}Bd7%ny7-HgNlBT3u|9E%0O)GV
z1;MOLwgR9{R}7xJS(yaEYCkXtf+`jr#yJekY>$HSLH#a4@C|^BSqv2n4Av>EjDHzF
zFswMiz`)%CQYE7#&cHPJJXnZ{fq|cmmGM6-12elqB?HssI}8l`a`FsJlOKX(_sGK!
z3@huwyKne)S(zAF8JKy``7tmadG&!|r40jU-JPx+(=Jwa2F4>l7#Pm{W?(q;-Ijsz
zC@TX4zc&Ljdl5SW<54aKhO_((3}<;6Tp1XTN_=2g1L{GtFfg-E1WC&>Fr1ZPU^puQ
zN+CzBKQOFO0X6dY!{wOPaWXS7)*tm`U^r{Yz;IR{q&$p);jAqK!&y*zIhxGCaMpu?
z;j9}-rhtLrY$yZ6*+3AdmVx1HCIiFSbP%VDf#GZg1H;)85NA3A!`WU2hO?d042*X;
zKQOGR0PP1`1G;2OK#pkwHv=<=9VpF6F)*B6z`$^}ejbRY#=vlPH3P%hl_2-GfcHyE
zGcex1{()gl2k3H_H608L3=(oo6ImIUIl7n`7;iseU^u&-f#K{{5a$B}!`VX&3}+93
zIDZ%z&R$?(IC}<U)*R3lA_kaS7J$tH?O*1QW11|)z|3*79%MbpF)tYy&OQfmKyLZM
zz;N~xNdFSBTg0J$0iP(%pC-pNMVNt^lLe$&ih<!A0|Ud^e;|$;1H(CP28MH-Agu>r
zTF-C$z_8{8IMhq!nC1vDFmugkW?(#jf`Q?jcs&EdIZ+VrDg(ngWd??GitG%G=N~aJ
zoHJx#IH$|{fnm)X24=I549uKiprj41zZup-uE}BMECY!_DlJI;1eF&7-$>5PIRPXO
zYCvQ%RfF0h3~M!@GT`=kB?GwU1a3kwthIqkf%~PPf+!QxIAU0v0?L*Q%$(q{mqzeK
zWf1G2hL%9(|AC4yhz!)s7KjX&1cuBE2F9B^7?_#4ET;Fiv59l8f$+H^rmqEYPe8e~
z)6cfC$*|r5ai_m)W0S4l{()ib15h!?-zvv6pOb-^w~(2E@#s+ohI4KV4CkCc$?y^b
z!?}0{hI8Q{&V2@kbBzoP=W4|n7|#cPU|0v<)yO|djwwxmftd%CgwCfjFr1spz;F(f
zY0eihFq~V(z;JFEC@w%Tw4Z_D+-_+G#`Cj2Fx0R814>3~|A3mDa*VB<49wiVpcq`i
zz;F%}i<c!nFsx%?U_Ad9bVQNa+z$-vTo_ouBm)DF9OFbG24?P=%nZzC>lhf$Jz!us
z2Pz27cELE@9~jp8Ffb-Gp~M}7I0G}-tojgeQkpNvI7yI!nfoEkpmz)m=iY!gAcMdh
zkU<GBgW&NAcT^6@8|!i)-k2=Nz|5ly(hhRe9|neVzd#(2Szr#xtP-$U^^93e2*X%E
zFsxGmUqsE!;|OvvBmu570o`82z|4~f5`&}|P%_P6ssf)Nw9Ww(J|N9YKoQHp%u@#%
z#s-g1Fs$1F6`KSSs{yCmbtf1YZyjP_=2=<~Y7KiZfE)x)6c8?`=dZNu1H-xxpz>zj
z2L=WP1v#c1UIu1fXVC3&#~B#Tb1^WS2kqZgy28M4UX+31yf8@SAp^sCB?gA`3epTr
z%16N_FoQ`31`dAEy>iUFy37nrpnK&&r~I9-2lJjVFr2qxU^s6Da>#lX_{DM{7dL_m
zs}BroUqJo1_5%as(Kigtya}Md05<_ZCss2l&Ij?Ks@Lc+Fe^L-<#!7P#ye*jn0cpw
zWWiM#69@Qos5PK-q^8s}F!L@4^&4D3W2I|SK!<QJF!SyPWiSp<MaZzGgn{v%4n#L-
zNuD$VW4Yr8hLs+mRJhUubYclB6AP%i`76)BSndZRq9r~stn^`E(ux3;mL<s_7*+;=
zcHFK6ZL{WJWnyJzVCK`2XJ9O;F94CXAoU?&_2LXn-TOZ<tc(C%fXTm_m5Gg&fmwhL
z)IUALz;ND|f#JL-sP}pUtcHPsgMpbZA0&I1f#G~21H<`v(7{gKuRbuW2d&~}U|{C!
z14+MUU;yRB^LY$<3`{-T9~jnqfa11(J;(=hbRU7vMDCGbU^w5-z;M2moq?%Gg@NJx
zWCn)w6G0pU28Qzs85qvb1#v)8wT*${{3cljrXKeX4C^~Utt$R~x)(VanE63BKlg+%
zFq}Whz;OOJGXqmk0t3T&P%60u;^Z(eoWIY&aQ?0`15-~$J>;^qJ`b=dpt|_1?rv5F
zW`58ug`oSR&wpTGIR64P+?2?`a6y29;R2|Q4!S=Yv}o{xBuJ)`f#HH01H%Os5T})a
z;esIp!v%eiAE$r{Oi<iS<N(EJJ*a)d#NhzW1nZA5FwLyr%D~LO8leJoNZ$vB^;Z~}
z1G$hzofw#AHZWR1GzKs*-krq2%nurEgPwW?>QFMQPXQ$r24?<mAg$1(3F@taE*@m!
zZ~!@>6tt98oPnwR(+7r?84UGI3=I5_See*a8JGn@y_NR=3=9|S85k~D+cGe9@Gvm&
ze`R16@MULU>JVgLxDd?1a3K&B!yWP;7}kR>>0@AE766?y*P+6|a3O_(;X(rFBFzq`
z4-6Z4Kry@l)Pm{IW8?<KaECtw!v#=qfyRhCq8S+KFMz@ebTnN@Is?On$qWn^`ayOT
zGca6O!@zK1i7W$CN8Ja84dB6N0Y<%FoD9r@pnEJkx)~TQoMvFS0E+L9=?n}Pt}!rN
zxWdf9)UlX>;lg7Eh70$V8JIfOLt?nA9Bc?H1A~CD-cyio3z!+0y6RgP7%u!}V7LG}
z=d5c21H(mG28N5EvF)xo3=9`F7#J?9fz+*FV7O??z;MwJ#M#2YaM6>2;i5bD2Zjw1
zs8L)8k7AHy2Lsd0t)R#N$3H9c2Zp6{z;U=i1QLh!f{Q`Ypwcvx5gdsdG$4^ExE&$^
zDv~zXKzr_tM&LLE1*td#Q{(jy3@aNzX<tBtm5GCufmsBUa~hv8FkFmeV7M6U%D~k4
z5v+!RL4tu<2y}2_<2MF|izN&U7mGm08P+$ce_+_~1XKwLBr7vc;bmYJ$z*0=Y65w-
zm4V@6BRd0AlM@5OMNn|e0CD^o7%pyQV7LgnWU(oRf#D*^x_jabOifuI7&d|rj1ZWh
z%vjFJz$_vTGOC7w;SvJ_!^J-!PA3DyC2<CZOTr+drZLnrT(V$bxTFQ*EoNZ2RLsC|
zDHp`qz`$^6Dg(o%Zd(SXro9Xd0y`L(MR-9n`xqE59b{m*v{#ye33OxN#wnnxZzE{P
zo=2H6RFHvL*aCF6U^oNArJD>4m##y4l?)rFfJ#iTIu>}ZvK}PN_5nmPFtBjLdX-Q<
zyjSVUz|?g51H&dzYg31TS$GY|A!isEF1=u2xby_Xxz50FnS+7hGK(|=Q`y8144bxq
z68|R903U}kXhjOM@NCdn);tD=%W@11mu0v=Fl^evP|s9$4^sSt;&~HjGNBt3@1Q|3
z)(;FDdmz0~;e(**Fi<a4;se9REug+C>j#ESKA@f_1G6y52qy5r55uMosMvRqvF709
z0_x#1Y`OxHKnN;;tM2-Zpn;-pQ024X1q0J*Z3bo$Ezq<ccm{mKA4n<{u>-jYa&O5-
z9!UBW34)4&Jo1Hssp&a{54DlOn}Ml`<paY;&|zRKpb+9@V7RQqz;Iau)L&w%t@^;Q
zatT8{GXsObGgc-pRt9Eq(70-CI|IXIX9kAL_Mq9EDGUq(Ul^E0j(}!qW->5b4rgGv
z913b4)SmjluvrHb#+!8*7#KzL8SQx)n8mj<GceWOU|_hM#=vkn1*GdK1H<Ja28PQ8
zpjn(xAd&wJ43`@i7%tbyGceWH@vt*6)k!iiT%O9naCxFM15=&q2ZqhyHr{3zP;*M3
zQIM5^S+ty)fvL`jf#LEB28PR^gLLZb7#J>ZWnj3x86@Myz;O8>1H<M0+#eV=gX0Ah
zV-8*_pzr{VGl@e@2A{Ve$e_<C1~Rq&JV-Oh*fR_amrsE>AY*SbFkA)=z}10_1^M7H
z$k+mC46^b#u`z(#?GS^RZRI~OY%T#61cE&Jj8d!&%wlrP49vDx3=EgQFfd$x2jaLh
zFkDe!V7LO7(Pdz`qQk&&rCtkU@C1m#kn`?A4h{dnu=xepJPCb99Zm*janPVxT?zxk
z6>|oLE2bcK7BDbeabjS&0y;;gu7-i(iZ27h6>nt*rn(MDk=qafHieaeK~P=)8^}?h
zb4eOf85pj_F)&;K9p>LqU&z34rH+B&N)2ext(Jk|N+$!um39yZ#F)asa0N8h)i9NT
z;mUjlhAVSH&i#T~<bv*6&VbdbTNFS=E(5dJCs1+(7rUUG!To_@ivgBOwH{upZZ?3V
zb#YCQMx+9HvjZf-i`zmZKzU_z1SrH9n8iWeI7Ulw9D~<-Y)*kn<b!e=XfPQvmBO$Y
zH2mDnz%1SjG6j;AHXmT9X9gYfFFprZHOPy1K*k^sqk+fRL7A#{`3HtApg|N+rm9`T
zz;I<P1H+Y-44_)K^6UqOm3u(N;mSP>42(ZmnYdX&rR22_3@e|2O23s)7#J8Y=rB67
zGBC@48Zz~jPZ$`k9ARL%a)6zIsq!NO!<9!23|H=fIR6+JuKZ?Txbjn)fvGkDYy=mW
zWMC-JVN_>jV3v#pWw%@ghO2B03|Co<!K3&LD}R8p<w{WFfJeuhm4R8J7gX}?U|_f^
z%D`|{nEM06DhB8vem!%^3TM!w3ecPt!z%FMud6_d-+6R=K{}7YbSg72TvY_=lz{4F
z<^tW*%KCv}<rh%p$iOV|7!<PLRt{@1Ln(t2D56$D$HpZ<C*FYukus6wbQqYOY+o`k
zOUi?SA5>Oy7BiGEC~?XClmTmYfS4?450VE(CQSa945+wX1)e#WzF{hxM12kC2ZmK4
zprBs`y6f?S4x=U~1G6-!CaRHQV7O|`z;IO`G-s{Gz;M-vf#Ir`JOfjW5s0v3{lKs)
z0y3^IxfvAc#SB$Y=cho0K@)DQ#SG<8;R2}eLx}1!hI)u^YoOvkAmXq<0MAY^FiVMm
z`~e#KXGPdB1L8+1@L5<K;58=*dqDNkO9o~sKXA~7fmSIMGn7Fc0h;9oNrI*?>X|qy
zAhIw!cR-vX1?u=BS$6^|JQLzVn1?{~Q>Pf1r9d<5tOzSWGgBa8(Ap8Chy%|FGB8Vl
zM=(H*>dbnC6{}ewK9XhxIl2K<P9j2XwE$F74kQU`tbq~)$Vc2C7*@-GBta6OA_XJ?
z@(hC?15*{(2Zq%N44|USUWd^b)Re7~U|_f!$-r<moSA{Cs$P|W;c5y4!__2Z2Bs<_
zrimQl3{2Ih!MeB^7z6`#z~#O4Rb~dJ>KhCUS4$ZfuI7R`PZ$`kPGw-Y3OY}#`U3;Q
z)ddU;S3!qRSN~yPxVoBw;p$3|({fPDJWx*(HtWH#dJ025)6A_5%+l{cjz=!^RxiO)
z=t0UnPzqiNI{p*X;9x0kIKarj0NO;x`-7G7If(t0fmy~+C^aR8ftB$&XfxnZ@D2l3
z#^>Obo1iW4Rm)i!mxI)Le`R2n&4nsnF2}&Y2vWS^B`f1{W6&x}76yhb6|9VFB^a0{
zwy`iUte(TlxL%rpK?QVu<+&7A#tq>0WGoB}#($>s&SaC+_`=G#8MN+fCl}~UNmfS4
zX_zbw3~a@$jG%)<z&rEf)TjH+WRt9~Wrg18z{0>FaE6ufHt0;I8=?%%vKrtkBUl;N
zf>r{}V*m+RvoJ8IE@Wlg32H}A0t@-YGcYVoWn~0y5@UP{KBYrno|W+-cnbn#M+=nq
zlz{={^TYhCjB`OgzrnyPJF{L0;>fw6t$v^trXWYol>%=p&ShY5-p$Hr3sU@*fmsf8
z<r*kRZIz&*#1X{GXlo7%B~Av0CEr;Y?Lf=eKs#*IWmy^RK#PSyd(1f;SQ+h%L1*uA
zGBDH}VP&*)264EGQ_~rwSQ#C_fyKhWP!-3@=qLfQ2y}x9^Yr>zY!XbD%%{(s#pX~y
ziIp(`rcg7Lm9bh7v>20xfq`A0m9Y)X0WFPXueW1ha5}`wD8tCWEC)Jt)UlYAQ3kT&
z(vE?_F^3hjdYW180w-woAuFS>9LW8k>$HO6Ss9ra8JOik+x<bhn7~q8Nhyg8to4kn
zatur<TR?k3i&+^VyDmVx#_HWzzcGSzxo|Krh%2#vlVM<zJIn!EAjtYn9dwKe2iT%-
zb|8BoE5E>7d+Oal+U+!1PlC1IgD5*G4N}Izz~ElYdJ?qD{3}mhPBH`Q^y{<P+*0&d
zuZb`)%ij}aV3t1*K23rZbQdGzQ3lW&T77xe51gQ=0q-W|C^KYWP@T<M05V=77-D>Z
zGRSx~a4ISSCtNlLhO(=y;Hz9gi+*`lPj8&VCSLE!S^+W&bmG-&S=LH$_=4=n<YMjM
z1;rlZ#EPk`fuPheiIIU>0knG7v6wXwyyuIJf#H%lYbcTx@!;5FV_@J}&6)sa^As19
zFt8?q*=!69OFdaZyW<!^cGh<$u!7d-Gjf0|Rb9v$0ZH+oEx(g^S-n7(eg#?j6yh&0
z6_CF`=Vb+~U^NGAB>nn<ArX`s9YFITibje_rD+VTpiMYJpn7aO1H;v=kjMaE%n`7H
z`vXIw3Ft6%Q0teg9^`O$1_s?zth!*+Kr1altAii2>VnRX0qrPuEN0c!0a?qF$-oLd
zW6Pa^VeKPU&|SR3!k|U45G`t;5CdsxHeyu+9WOHpw6N~@0v7O%BA`{mf}ryla==dg
zX^~W#R?on~$Sujhpv=#}aP=4i!_@-{IjMOJER4|g^9)z-Gca7etpGamhJ}%j8>;dv
z1H;vi+#eVOEkH{yK}9NP4%3H$Vci=R(9O&Y%KVHB%t}f^#SAQrj3S^MB$NzdN`nrK
z1_j@m^(@~Q85rt8juQC7z`y|7NXx9$Hjxo@p(o2XevnO!SsKMf$qX#t6hS61Fn|`q
zUSrh&yYQPX0|TQD1H&~328L@EiYW{%KcKF=R=~h;EdykUlrPH@M$ma-9~d-1C(=fM
zJg&^8k;1_8gdZf%V8(E5H3P%7*&4+REKlSh7olF~WMH`V7h=m34Tvq*eHa+7J8^$t
z(0BnF>7Bms7@O?$wE1iT9L+4J7#WzA&8OGRXHym1&jKp!1&@4Sm<bw+Q~_JKWctqe
zY#Q~~+ZY(GH-KEaAL`QU>lhfWFH<aLU^xI2dC0(U{U&JpaeoubY({1VX60)f3=B@2
zSY``?9L&MMkQ~Y~TN&h1UT`?fHUPU&mw~~;h^2!OG$qNwz@Tr&(gA8Dg3bci^NgiK
zmVu#O@CXM3gZB!S4$v*IAc^=BEFIPelR7-XCRs5s9Cc!;V*?o#$XifS#K2MqzFQA`
zPz+0*9H`9ZU|?utW~tKx>+ok_kj`T%hlaEO=+I8kB{<9~)6$9=Sjr(Mwq;Gfzkp3b
z<%R$Q!wnwLNd&82u%v<PxCn7>8n|KrokIF-y7WReB}rqJa7NG?Scr5u!Z*{y7P2YT
zFJ^&c&JPR%b709w)mNj~kb%VuoZuK3ZfGzt+)&UcHez4_<y+Be28J8a3=B7dL21J!
zlf?#{yFV}pq`(bW05-rz1QaR^3^)217;dzI4X{yx3LRu%xUo|s&z6D32DE)shk@b7
zHwK0q??B6I>)TlLz-EGS1qTCzLn@0N*xkG!XX$}sje~)KO>er%A~v0X5^)w~Mo<WT
zU=Z*D4Wffmi<%xN(3HVmV9Zi1U|>-P7m5rFH&q!JZYqM@uDF{;7G%$)4-E03$kYI9
z+&O*2A~uEkonS#G1_t(7Eb^dJc-2laFx<3cV7O_@%)qR6m4V@=KLf)}ZxH7p1H;W^
z28NsQ><r9mZy6YFRx>c%ECzADGceqo$G~uN2KW@glP6e&z!owvtFwUONRdSd7GEuD
zEJBK)v<XR%)BP8-Dc0X%X3A$|U{(j+c)D;2GgCfzp9CiZgW3mXrhM>52~GwEkAKWe
z`QV)rETEkd%uI!#;t+KDjBge*QxT}Zz5&|O8~dA?DHUYgBJh4KW~Nlwc3qHhsXCx~
z0%}~U6R4;F?HLxj&dijKY+eT3JWnZRrYMkkpsWsZUX(Iu8wV$7;|DWS6zHH8&@J^K
z=S4Y!%mX<>ZaXtm5F-P#1`pH`LEzJepqhfz85kH~nu6-B!Mf}i7`)FgGkJq_fp&R;
zeB})qUWO_3)_|!~-^$G73{nTW7XhTs8Cjh(T%BMFGm|w)9q4*RkUDEn8wzHgwI0O0
zdIkm|31%ikkU~&n3*<*b6(m0zf{v?!=`sX|8OV=SHq4-XsmvOXeT&RY>T*b$K$~6Q
zepI&sTV>9`kZZ#Xy4{XhQyCgC@-p>Ey5zyF3uyGngSWPTtlH(r%p}gpz^v&F)g=xK
zPEfFm>%&Z6xSN@Y52OyXRS_h`Ckd94WMGi?VP^aTk^*fXTDXLn@eg?O6oWZKJ%fWR
zGpLQuthq%fg@KvzxhN?63V}*YX2$2BrY~qmXx?UK#+RT}@fB20inlR?Hi0sLs-!;9
z4EzL8w$dus29<TpjHd-bS(Sm|<}L<?n_Dc>a!VMP8BZ&N9m8<*E(62Oo0Az8ic5+Z
zm>CT&K+E%+e;F8Veup#w82&jjFo?IwF);M5XJ))A$-tm=jcFo>90S9dhUv4Gu}Rh6
z5@BGtCB*uHp>GFd5?m_{RJTIziSB#Bz^oGw;)Bkoi(z1}kz{7v0m_wMKQOd_+zVck
zp{-*9al;M)P!-C+a7&qi;g&4a6FX!ep19@3z;Me6>Iu+Y2cW`H_Esqa!>#<uj8G@;
zMRj7payBXcThkaAZcX9-z|isl<ecf1%h}}Xmoqc2X8gb)0LqBql3%+elYt@Y3Nzzs
zX$A(Rb&Od-$qdYlpc|<epE71jK|)}y6a%w%3j@Qgg$xY0=7Tm1>aJjBT&u*utlbH2
zSt?!QV_;C4QNh5F`GJ{nD&q%+CXhEl`vRD?KSLcqRfM6Q0p$8y8yFaFtpYp#Oan9H
z3{YDrnrR{j_XmciEg-jo`qRuGn1VAH88bQIcZ7mwFek=<j~UE-%gk8M$iS?lBLs=v
zdT~(fPG)2QMG-S&FW5){uH;fs95>5?RDv8@&mg4zfsuis_8T)}9;g+p6Av{YPZ(kV
z$a5e^6@m_1hz8%7Iqf9#XT}c<bukPKEZ`M41_f#i3_EL?KZApef#KE_28LVbG{7$T
z49N}*w|+7(-1@2pcFt$e&YEZjhTHb_3=Fr06^j{|zd~z@+y59CZhufLO=e&QA58R>
zf#HrB1H&DY1&j;~-0F(S49q|HAZHKUiDF>5<Di(w!2Dkn<W>fTJ0}<z?yQqyU}$h>
zW&|zE0qwB3YsbKF7j&%3x`oV)j8MIIdl?w+wn{P7GwcmvW@Lr7obPU8V7R+R0d%Sy
zGov&p$X+rq+`YlTaQBQ90|TcqGouVI0|TQZ1H(O028Mf}t95(Im>Ffk){8SR8x(wC
zr~?nJau+c(atbjp>&|9oU^ZxEV7M2<z;G`Lv^2n==L18-70~!AcO7#*qrD&lv)+7=
zs+kN7_c9n5?xle^OBopM6*Dm0E0l#CMcZ%%boMWI7xPmQ24>wCUJT5Z-QZ0>F<{d;
z7#O&xF+Ue!VAf*+$>oAhdA79sz|imlG+x*6f`Ng7h502&UI(-f$e)4XUL6C&J^mWd
zSXjdv24+KH24+3q=?hn}Nht4NU^W49(?MAlG#Zh~#9;+icmt}i1Ef%7`iE6)ETBt`
zOhEgVm>?=^7(jCX%m$l2Ff_)1=AO70F*649GBE3FfIPOJf#F^c1H(Pg1}=ls3=H=c
zFfiPk1CqJUz;N$41H--DAkJe3hI^kG81B6Xao#g9+-GNCxX;Yaz-;h~f#JS91H*lB
zb_Qlc&><i9gBcj^`*MF^XxsvFH^R;J44}p2%*O9OFf={^1p{dEj6sK)F&^ZaJZ1)F
z<39`x_p=!o?q@PHFq?2NFx;<TV7Olb%6B{nvmmBy`M}Vm0y3ou)M-~?W=sZ|a)r5`
zf!X*V1H=6u28R1xUJT5}XW1E;jjuB>+@H<BaDS>d1GDiXuvP{J8Ia6l28R1v7#Qwv
z0@-4NYzrua>lc7T7?|~6K>Ps~y8;yhEmwqIZ`5D_5i<}2FWQ6zJ%=txd4mH3voQk$
zvw;@Eh(;Dj#2J7mdrHC6l#LQlBf$GeASP6Tr;{30Kr#^Bpy6*0(4sI+28L5-nL+nB
zGJFL^N)K-`1M^!Rh6DzNNuX}Jl{fQaPzhqN33L@lE%ReVQ27Zyzn1y24d{eikg5x*
z%vV9G422=8uF8W|fwLTF*&`zd2LnTcFY{H<0t3(%)^!V~2drgNs^82E8Z=?}3OdCo
zawhXZ#t#hqpkm|$sHQVo3MqgNf{Oih3=H>=GBDiV3qF~f`JgK3S`!9_`yUw??!Q$7
zn|=`7hG1ZLAi%)zfQJ`U+8hL51<Cq>fxiM0RECp40Z;<kW9P$ECI+HCK<iyWN)|9M
z8!csEHrz6ueI1)DD~Nf0y5>4IIWY6rbRQ_wNOpSuIySlbr3}nQ4p8G5Gg(VPn`l6#
zH+TmH1OEqzaYo4~N`9yyln5|Dm9(KK`2$np`GG+|1*C+LF$<-FVD9r^W2grO+QC-l
zEucUHwd%p8wlM=F(6)f1fPvwGIs?N4Wk{fH0i7drgMs0J8w0}w2MtgFZ2`v!1H*%O
z28IXGMIRXWEkLORWVHDu=0%Jj82CV&KX-uQ!*~nCXwWUHO6wTv86Gq+Fg&P$n7v31
z5+M(kF)%z>lm{AhU|!0_z_7xNX(ESW3Ip>pXba@Q2?mA-2V@z*IhgMZs4QVnVFs-!
zHwLXK2W8#|Zx|RJJcDN5hdc}n4_UZBFz~a0Tm~AYm>9#xz#yUWfq`!V19MS`#0Lhx
zJq*l6aiFAV#>)&kc8S>-bVbz8+Ua^5*mUcEGIxNIrwKH9c8G(MXE6hFhc>v5iDF<_
zUC&$!@+~Mlz`bOX4v23{!HO9e9_lbKJk-!gW?(K=fmBrwJsB7tx~elU1QjsXfl8K{
z3=9ub7#JQV)qG&!^Fc(~^jjO)r0ZvzfNV7Z>*Zr$HtC3BV9=P!oXq%v;TULkNCFhb
zreY9VljT5)85kZGF)%#L1KFCa4c5u<u%Ch9VK->4pcq&q3j>4bR_095GG9|=28M^L
z7#JR|@ch7VEQEp4|1%?F7BA#xjC!jT3?3>TpvJEu14Cdcvp*<EO!Yt+-XBtdPGV$W
zNY7@rU<57OU0unn4OS5Y$<x}hAQypDYlC{(PZ{DE7#bfiD>FtgFcf}LcNPV8xjrx?
zf|3ikMP%lw#=s!1r|t~0@&-da!^0B{3=ct9lC&|aJA)Pm-(X;P_=|zz;Ro=(W_1_P
zu=^1PhDVAF43A`G8JNvHKQJUFfW|G@x2n4cGBBGlgBHa_F)%zbW?*<^2;!tMFg&tn
zV0dH;8pkRCuaINRVxGvs2HMmzk%tX*!3wik@dpOI#2QdqV?Uzq4(f!OwJ<O|@@HUp
z<Owom0t3UN90rC*X&@UrK&DJzu!&8y-csEG>@ScS&<XY8dg>0K6Ffm1<J*|k9Y6<&
z-T;lwNgh+Tg{zzk8WGh~w*?(?2vundN>^Z&!t>QZ2jL1H0htLJIuzGaw*qz6pen7v
zol%gPdMoPH&EbZAgcu6C?4ALt)Ep9s5ey7AKhzDuDnBs9gO*i*ivsf~HBe7M9n{fc
zxWT~isF#7^Q8Og0jbLHDg@NJG2G$P@@e9D0^)Z`!fO8lJ8-wQuhWhv|49w=`Adx=M
z=%h6R!;y#TdSIJC65vr6bv;m*{|0EsuKxjbZI~ozM|vBxx;EHrAj$1M>KZV~jS!t0
zpfe4?I!h<3tHLBfXV|nctE;Mlblm`5W!k2st^}6-zz`2=iGZ_;g(Sp#N}!q><h>IN
z43Ca@eqe~70FJ=iEo>6?Gi{_n!<ILg8JI21!PS<Hv<a-*GW;Q?4;s?4h~&*<5Yty?
zU=T>;&0rAIw`5?phy;zQ3uGHIFbFY<seqOBft0Dpfs}DDFjTgPshBb_2&AzwFc@Wu
zsY!suK}AsDL@_C_`hC3hc?@DwU=0vOGGIk)V9m0UAkCnNc1jl$0r#6guDk_ufruId
zv&Aj23)(b6%N#kSK;8h|<zdOm3%cBZQwr3%0oA2COq^1nbO=6#Q}7t4I9#P2@AT%a
zZ0hy9IYmH&Ba=XF#2D}`1)L(FKm+U8W6B9SF^K^zTLqC71jP$jwkd;?1Fm-lM3w_0
z3pzyg<XY`&uyvsO3dLHqBN-W(Qg(uGFWe-m9SW9W7BXaD;BnJ-5dqo%nS+6WS8uxY
zHa3;|^V)hK^;?)3n5_i07#L!OwT)F67`T^$BA#dFOfJxgp~Vc$Ryw?83^Tb5KqU<5
zToG?BGcQI4W~)HZDDx6CFYsBy9H0>!GcN<sXdp-t`%g0$kfJPzA{X!o4M@WFlbJ0@
zq8T*Sy>N+{Eog}a_%4IS4l{F*4CM5CGsro3pcpl}ZKe&1QL94`!?eXf;|UxL3>9z9
zv_U5wg3kk)t32x_IF&LmTixR=&S#i)(;Pf2VamXe5W~Z`5flK{?3|!`{dgER%7I$4
zH-tcqBp$|%n&9eFm4RVG6A$AoSdd$raDtAF<zbwq0U9shf+z-^l*cd$bj$eU-8_s_
zL7@yv;MSlS1<rOJ#;KY}il>3b6K*h=GB89W@G$m*-OvR#wVsEuR}~bdP&a@MLSnc9
zGIl~64`VCb4co!0c^F&4Lyk~4w1G#mK#I>W^Ds7m+yF|Q)=!{{8&r|p02&Wr*va6)
zz%Y3~4<k6m-1xvyZw{KL0Ow^JV{M2(tHIhB7#=-kV0iQp+-c*1oPl|Rf#ER&1H+?#
zMIRW<b-))hsWLDuE9GG<1Kq{R0lMY}G`#`}fHJTtP?wg2=W{>-a72fPu?Q3ZHlSlQ
zI2qfg-`>F{S)VGx!<Yva-UM}g9(eo^8Z3FBR?|*~SO$iO6duMbkq-<O6Brm6z+;@Y
z+)#ICfpsu2JmzO$c+6=5iKi@(PLR6|85kbxa(`g3SOMB23~d-dZmVKos0SS+J)50}
zF+~K#Vpiv2OcXI?U@*+(VT=Sh%NBHgyYVU>#z;`37j(vet^p5YqyYoNV$h6T-ew-g
zNGs5gBgl`&?|B%Vz`D9Q85lsioIuSLm@X$h(99esXqJwL(Ft_&>5Y1Z3yhh0ISh;@
zphyHw>#u_9G*JRyn);D3Gq0S1hY@@k=}rb_+fz_^b%;DjdlCbqBsjr<=HsE#l8RvM
zrVI=XMm&t%AV=8=aWXJu*zhoNgND37bEL+r>UkKs^}s3(85kradH#YGf{yymu;KX&
zDgr=r1IDX({({E0t3dg2u`|zmu&Ou?uyOA}sz8;Z@hYD8a8<(HJa@sW%6O9*c<zGc
zXPz=FV=T%qV&DO78o9y1Y&V~SL7idlB%X7ii6D>(qUU+ef%*}~V3j!xJjcKx%WU^x
zy7+E3b!kOTp5vec9l&+Dfd|iOaG-&9gL6!e+|4Fk|Ba^w<eFlTkh%a*auEYh8)zh=
zn1KP*zS865i4b81vFZYO%%Chc9t9C*Lk5QKP^K7=i|w;H7#Jr1Ws1=R#W4qHe=t*w
zJp%(nF{rwjV8|2!OY-*ZycG;g5z64wLlbn(%|<40u?s2?>=%P1LzTfk&}3lnf6f#H
zaxN&N+V2O+1%c$i1--)oCV#l0w?T6La6?P(F!_M=fzA95lJf!S0|!Cj941eY9LP)u
zVcrTm1}0CC<W5k%9Z|vL3O4iugKG=}1A_>tiR%!dQNh6E3NfAGu^$7&V=vDSpo^TD
z9Ue{Ju!l{gK8Oi)zb?ZK&_#YA>zqI)f~~V|WU_}_*AJ4j2g!jC|DJc5$p&m2D3gJt
zY#?@MGB8ZzXR-uo1Np$=7)Z_%qz!E33{NIAkQ~?tk3e#YW*|wh4-P$N0wsG!jt>lc
zpgtD3Yv7nQJ!LPOc6}CD5Ohx_50e%T1GA$KGXt|@H3P%rECz<h8S)Iwj_shEtQ<iK
zRX|&27$lgqdAvZ1Ad;ZyZ2ih40kR+DHpeO8Ni8PuB|@O%yVEx^$$;{eF-WEBS|(Aj
z2SL_s;;jdjGEAb7nnRO;!SM!@5Zs^(5QBukZBUTr4O5x;L9!rkI=+L*@`Ge|GB`3Y
zJ8t>_YHctu2!Nu<iL;7<+3_%A7D&or)dvQ1kSD>h=j2<(!0fP_F-wo3o*CpZa~9AN
zDzE|pCM!_W8XN+p3=EHpp`LUE6$&31TtPR9f(}|{c3NJ=z-;@SF^idj*^Y&Q;c*)S
z!{a(<sInEHyB=LvfF_`z#fI&728PF57#JRJf@wI&!0@<!F9XPZwx>QYxMeUfFhGoc
z30gUMn}Ol+GX{poxBNiG)dvQ*C7@men>i1oq!3j8i6#TX6IGB2OxL46Ft~vR)4&ta
z&ZW!@OxJT57@oK>Fg$T`W&q2(%Ya-3A{k6Tx2rHSFx7(<B{MKQi5F*Jsx11z;4T9i
z0c3MlVvOTqV0I1yEoyFJV0co;!0@C7v?}R(6<84~0|T2sND;`U9tMUd-3$y*+8IEO
zVGQ5>fx#WLV|E58CR|LJ85qOQGB7+j#lZ070ElyofdRCl<;jnFaR$Z+SFma(1_rh=
z38o^Dt@oH27$d?N7@it3Fg(@GXJCv-{lMUU2kd<C(q0LsL{$cH2Cz*YpjjOTwpIzI
z0ucsg7tp5FaF7MA3=B^lLAIS`V0fC#!0<F3GzjJXgMl&p1p~8-3TVKh9<pD-gM)!F
z0(2f1XdH#Xk%2Mf%m)S!P`9lD?1N>@42&W77#N;TVqkdM0ph%7V0e0-f#K=VDh9@o
zAB-9742+?y3=Ge>7#N;0ePV=~0E#jN3Fb~7FOVt_aSueihN;%6XJB}y1rD>|PahaO
zZZI$~d;!_$S_86#g@NIjEd#?dPymJqGB7;LWng%g3X+jyV0bo{f#KOyb_T`}Z3c#C
zCm9%?9R_hM7#N<tU|@K555#eXapp5JFb02OU|^fb{79UE*)<j93>Ghjdd3hz5K|7M
zTAP94xd;Qpa{&;?f`Q?=9s|R36%fanf#G>91H<z`?hg!}3qYO&jlO~RxPw-jf);go
zYG4XGGBBC8ePHlB!@$6l0P>bw2Qvec>0}0m=hGP&o_8}dL@}ApXJB~#k%8g)V=o3K
z)79(@Os3lz7+&}>Fud>paSk&uyl7-#cu{T3z+`%sfq`uS1GAd|Nahj)!;3`>3@<?Y
z15EEQFueG~!0_S+_Xh^=90n#cqv;8U*kl4<GBB`hVqkWQ0qJ<f!0=L<f#Ib%i1USk
z;iU@$!%GL&4-DQH7?{kSGcdb(gAxTKP57vQ#GrhT54}Rb#-2UIrtaAGfx!pVd65D8
z>NV6?FH;y8UdDkq^BEXk_AxNL>;QX89^@$yaoF<%gO3XXvun+C)5B~^_0b;~d_k+J
z?|_VP2kj}Do6W%Rau)-`%T3G-OmoW^7+yYNV0d{C#A#w+c=?}!;pJyn2Bx`v9~gW=
z*WrpVFuU8xGce8V2W@eh3o`HqXe`(ll#~j%av4E7vl$p(IWjQ3vIlX>7#LppF)+OH
zVrFn>n%l&{@CqcI?hQ2*tdAXRAj7K(3=FSYSU)iMJ^(EQWMFm&A9n#g0Ra>yzTj2S
z(`ApaNz{jbVDJNN^#V`vd3Z20FczdRFub;6V0dlj%D`Aq@PWY(RD5bMFne&YGcXpE
zGBCUjV_<k4!l1{%SOC(#29(47)-W(I7>F<Bg_)4X!0<Z7n}M;Q=>r2q5~RDCf#G!(
z1H)_35U?WyV@kc>2L^w58S3$inSn7Sfq~(59|OZ{P?k-}Wng%{iGktu8hHlBlqzQi
z#uSi_7Lb+xpz9Vj#2N4Lz;s<>V0e82!~yC0#lZ0T3p+>`1H&6B28K5htREQsXMk3%
zFfe;OfXsbO-~O0Yg3W&gXuI(Az@u!U^%fr({6UwYgUb-lZcw@J%E0hOkAdNh3WyWP
z!0;xMf#FTOF=*ZO2L}HKV7EMAU|`_kc`w4i><Mat*@5&dW?*;&nv1am={dl_@MaJ9
z2L}HqpjHC3DK4c0x;Pd*N*<sA7OzJhaRrw#>jXbA1cJut8bImItDKpEah*H^!<)Md
z3~#Q2I64drZ-p2b-g4zLFm6%#zz`S#N=t#D@h}z<Ml()v21c+MpaBd9w#y=n28;~M
zUZAb3AamZjGBCWghnZ6p#lY}32UK~5eqaa$bvGE;?u#&5a)K(aWCn(}^BEZ4g7&c5
z7BDcp-NnH0b{j~hmVx2z1qOz<r?@{b1cLUQfEFQx2E!N_K*KqK6%35)tUzmpRO@R$
zFa&~*e2D@1#v4>FuI*-Ec*n}X@b)(|1LN8m3=HoK85rKFgE)&B7~bVDFuY4z$_Vw_
z0dPh4T7)qc<gc|L(?CJb!1i4PbSN#ew--ns$i#&V4DaTGI3N?ZF)+N_1mb9bjJ(Rg
z@a}vi1LN8a3=HgS><o-+H!?81`^~`c?z86yhQKdi*LEFe)2<I<U|?Lg(endCkO(Lg
z;R8~R42)|Jd|(I#H5R~?xAz;6>E{?2-a9fdyf=kLMd%(-RD^=k6N3n25ZK8eZD&BO
z0`^1^Mju87X75KZt<?++?@K*DFoZq;xqy)|Yr4q^HmUkAptc0K#nJtNAq<r2!GY%k
zI{n0U4g<sc#S9GZXG(*%`g~vrTL4OrAd-QF2h_D<_5m$-0joRD!0`So=z`%e(EXSZ
zpgJ>n!3TygPzZvT?fEoRF)#-2XUt+}U<|&=!0`SK1H=3J8z9~@28Q?V7#QBa31nal
zKEnVaH-XdV^mQK?!a?ct2q;E<!<iWvrypQo_`t%z@csuo1LO2t3=AI}85lm;2Qn~D
zKg&?bz&QOW0|R>vNbVT}!-oI{h7VpK&SwUO5BUrXA2L}#Foe$lZ=+}SdClm;n8jSu
z06JxdAsl?OIRmpV8z?498bE`spxPg#;RYxVGcfx~gQX@w)W3iV+DxBtl1&11LX-{o
z#6gHwmSP4&MM&%C-{TJq5iAT04B#ry_X{%v<G-&A3?KR!7(TQqGcf+=2OVj{!1!O9
zf#JhO28Iu-0~r|qGl{W&V2F@`l(W7YK{ii}0XYh^e;|X=4b*mtFkoQ(ugSpdd!4bK
zF^dtjY@V45bWBhN6KMH$I%tzG_Xmau7f{KBFo9{J7-)yH8#s(#8+>4h04>e}r!~JU
zW(LOBP7DkmE-)~BIHt_N_&NsSy4M*D3?JDU7(OxvGBCdOX9T&ff`QpLoPpWTi;+<@
zi)kW<6Ug0+ZlH=FVh;lov-tGgr`V+GEj2$dM1l%&A5b*<{cvVr0t=l0C8tPGyHG)e
zQHjx+f$2!o2ZqQKpvE^?SVDzSgO!<q=}12V!$&y=hL18J&TIyTkJ=0jA2nG&Fhqiu
zj=yAJ_PY<Nm^u1E%@7Xok(803vsA!aPN#>QW)rAy|G*Fl+6+<ya)W;{GXv9u4Gat)
ztr-|Tng%j3Jy;?FB4>btH41VH8MD7RXr}_`Fg=DS2~b0xf!W^+v@H!HqyiNJPlj=<
z0!e_6OpOAaLkB9Q7!5!n%=Ae614C3js9Fa%e*<`!8JHf~Ffe>fWMKFh3F3q>Fnk1g
z5wvgeQ33<Q$6X8zA9t`bFo6c}KOSXZ_;@&wf$5P4=yc8~&=#JT49x!E6Qsa9F^d_&
zt_By549xzZqxzVN85tx#Fhm_;V73L7oKb18-~c6`Opr7vi~jolfgu{ylYamTl>pGm
z6~8$d7(QNNVEA}WnSt@QGSfs35N*ITQ3FKVGEFpLXJGv8#lZ0K0|UdycYzFyzr{ci
z9=(BqG4amy6KB|z>#aX9#DZ#m50I&Wpi7~TdoVD3Vq{?W_>-A|>39eO1L)GQPoS;J
z$8#7MKDjb5d~#%GU^-sT!0;)Bf#FkJAOq8J&}laeu{jJ(Cj}Xp1He1`z&oPArN8F~
zhS&)VOy^9Y(?L=?D;!raaQ*);#W+3dEE`XK;s=H}_=40x&_3Il#S9FedKnl#fp&Jy
z1Tj`IFnn6V&cHNt76Zel;|vU+4uUw#85ll2XJGhrHxRVnnPV&C2ZneS=7|xYl7XoN
zbi4&Kc)HG!fywyH2ZjWYSHa0DNQjw%$@mTf!)IQGdWO%O><moCUl<rZ>o72UR%2&i
z0!^5Fc4lDs4Dzc94+F#J00xH7J|G!Y28Pc`3=E$W0vVW$Ux4B>A%lU*#E5}8@F{AI
z&ia8NVGd+sBk(6E)t4|b)O=t_*aKoiCdWacRG+~FN^*`2OwzAEFf<)uU|?imoWsBz
z4B7xI{gZ*=b0Gu6=WJ#MCK)ychR<^t7(P#6XJC>MW?=Yymx1B)b!7%783l0OXOhuj
zU;wQj{`}9Cfl0>l149#tC&9oR)Bw_A$H4G~kAdL}4`?qh$hKx42GGf$-0S$6cQ7(A
z2R&wHU;<hBMT&vpiv-llF9r+@Uv%U_R)Pox5TR2EGM|BgdoPG*=lOx5S%raFyAQIg
zi18C>gkPM2@tgMthGq>=b<KT-pZN+a19R{LW(LM@sSFHXd>I(Nc!Ex$`Buch@C782
z2$G6mVEEF=!0@G(oq_RNJp;p+tqcrbR_8+w!EM$6ZA)tg&G|40u*!h4S+fuL5M1V9
z(3%5A6HtUSM}U@`GB5{&cGZDSxBUd(p4wajI{TJ^IT&;vEw~J3v}I(>nEvrRn}kdQ
zRLd5a4}3s*rFj8J%XHNXZ0f8pKqdV2zzb~R^?yDvG=tjk;My)^J2M00D^Re0Vqp04
zN|}N2l?Ky91$G9;SEdXMUzHdbzKVeaotP$a1Trwbk_MH?&370WUzag3hXjKX!$bv8
z8PFmE3PIKn3@r+f;yMI0`Gr(kgQNl&n3!3`8JI&BPk(cPO}V}VqzC5aHK1aQ(ZA*c
zLp!M125!%Xf*M2qoeT_L{TUd(f&$!s8Uw@E5(b8^1<ni*#o*R^JE-7Kkzi?HV`g9k
zYna5q@U;)b0clvq!0>gE#0Q4<Jq(OdsjMFu+TSoRYuEQNFo%M2HYk|C@PNXsg9ph;
zUqDNF9T^x`9R9%2p}@ev0v^YSekjktxZ(ncxC<g)h(lF?PIqA7z9qtx$Hu@MeO(!(
zih1G$Ms^0q6?YjJz8+^___`k?`U1RVig9Iq_Xma!4{!qeA;MJ7%D@~Es?5N+awhY{
z4v?;uAZNc~VEFn1B)S<=NUl7<JaHOW_ACR#H)aNgub<f&7+2n4VEE?4!0^q%mVptp
z9g#<nfjMj%NZ(J88(2Rubb%Xy49sDmO`jk!Mj^&bMl(>F>#|{B)+%RU4)dA*;1ZjN
z-V?B32m|A)n+(ih;FXJ@njU<<nZyT%t`tz?k^2KfR|iNRSdY&S@EOdY!oZb*apltw
z44t4xvIhfmxE#n8uRu1keqiW40&0dbFo&H6w-hEYg6dMpcJ9sxAk!F_!@f*+xXdO}
ze}$1T9aOr2bp3$1B^<P?58Ud=1TU}30JWV!E@A+=2;}OH1gJ_EXuA3W+N%dXDjHNL
zr89zS)s7mdD$ssDaO{JRZ!2X2wO9-o8PgdJ8R}U-Fmz0Ss+$NiZ2_nPwudW&n6`w0
zacwOFb2w;6A1LlXYCyS@(E{wGEeuS?tPITIml1}rrB7zbn9Ra#umW^0C_~2us6D@6
zN;WV~54yr8QvU%W5g`VXI07~tWNs%5#M%f@0|JyNKtTyAn!%yM{ehuV2c!TT&eOo*
zT+9esLIc`wZ_B{A;wu9Kj|u~G#B5NS{Khnq1C&S>K%yrCbQ&YmL=I3j1ln#4itHUA
zr+{<30L&P12F6t!9~e5p8@+jqM3`Dx8JMFSlo=RTiGc!woq=(cG6Tc63I>L6W%&$D
zhpIj>bj|>EDLO&tld*^}{uhvj4A*on0Skl1u4F`*m^m4kBjcDEEWqP7-#Qo=zO_L|
zIKItcVE8r*#97V2@NEMF!?$&yL5}Sp;xNe9JHR6ybFQ-K)~_=7z|aLM>`WM#BbS4m
z1v$T#ag`kd!?yzr4BvKvJbeP<=}1u73Q1jz9-u<4>jlVd;IJ-$RFjeWpz-iA0xaAC
z3SkE3NKnHN<YCa-39bfaQ2H=oV0HPx(DjFb>BtHO=19<j5+;slkgjeHh*%UmC^R`@
zz+xg$F;MHDi6a(N7<IdVte@U<jZLBc(Fca^EufYxh-63+VVcOvz#JXH%)n&$o`K=p
zO$LT<piT6KzZn?5y<}kc20HN2h@FAq+cyS=Z=Z}An2Z!ZFmxXQHF~>20TLoJnU#S#
z+Jl*a$w-fZ;X4Nd!*@0i$BlvEy95KncQFvhih<#~8Uw?3r66_&CZiw*hVLK|Gg$^E
zQ~M7LJ>bI~c^qWgL9zY?6eT_k4BtW63+$&8khRaz9AJM=0E>Z7v}9n8)|g&<olU&{
z4QO)_NV=E>w5OK&1LIc(Q0n4n01qm3gO^W(8ptN#MS7hfkN}Sc)h?hS1(X{+p~3xu
zp*sK)P0_Hr{3{RG(h{gH@IVr{C<9fY8H`5tVCf#HuEWsC{i*;C{skamn2-SjC`EKQ
zFfguUWpHF*(p&X`p$F8|0^QWW91GeRtGAnh;d?v-!}m~T1}44B3=H3AGcbJb2XXE*
zFnk9IoMvZW(tFLo@PnO!;rmZ^hI%HwuM7-7>=_t-fDWS6XJlabQNzISqv|sw1C!oy
zM)11Tm=6p+IiR=)kqiv{?)(hQF-4#?0l5qeKYAD#esqD=*@4wDgGmMk7Jhd<2IiPq
zAa(u>3_oTtF#MPX@@`K819S942IiOpjEwbJOyF@fP#O3&!wF<3GZ!N`sCy<risKka
zOCP+qxP+mYK?Zv2{?{5t#&l476>R1Ph~ijDa9m<4t^gJ0kcE~#KcH%D5%z;Dg_&Cd
z3jAIPkRq62;A8&3R)AUvOqx4CF!X{(K{G%N%{WlkM)NcS!;e)A3_lhzGcal1U|{%h
zm4V^MSrF$b1H(@y28JKMlo^;bKQT?@kY-@g3;Mv&>jKIOz4f4DFAVq@Ls%J@<3O1~
zFQ0+or#b_}PgPK~B{MMmv}9oTX$<02Gcf#&U|{$e<i)_G2Ws5wO=e*DS;4^YvkVlg
z^BEX^HZw5%Y-Ihw&>H{=;y7K955Nfy9KtP(j2Vdah)xVl^?JuaUI+WQ0ODhaUpv6n
zDQGVq_XmdF3I-;vSrDTjVW9JYp$`-W;Bl1rV31Gk7#My|VPN>#1LAlyF#O!l!0>ZB
z$lIyl#v79+=!7gL-CrLV`fNa+@3R55pAGmKb66Re<DEcW6lY-g`HX?#=Mxaent|cx
z7Y2r(pFkXL28LfO3=BX2fjG(x48K5F78DYoo&I|63=F@V85n*!g0?((Ks+C>0dX-b
zUt@S)?>KWkD6w&WVCc(0_WTTx=Ry5ikW2xZ-yaEnV3+|~ss$cOhzAvPkK`B_eg!cw
z{PHnoU<Td$FyjE|2(THT7Kn+eEy#OYLD}FO1H-R;28Lg`AkHlYhF`Vy3=F@jp_f1W
z>Stj1)eB0^GgdG#`xi4X$DaokF9uGaUNIy1z_b~AKr*0;wwM7X4C>;xF@9j!F@=GF
zdk!d3<{gx0U~J<PXJ9(23Kr*NU=TVl%JPqsfjPmM^#j9>H=was2Iho%BhYc*4&EyA
zATvwBW!?_Za2aT$I%sV(==4jF;h?)>85o2fin4qIHU8T87#MynV_^6-N1TCivd0I8
zoh+bsq_C?fE9f}Rge&q4jFZEZ85k!gLn`*20+2>X0_gZeP+I)P!pN3BxgNO{vQveD
zadII8a{{Ow1htkjnI>|8lIG4EAPJBQK^s=Y85pO>eqh+?0=6+&lofQKR^nxO2FB^x
zehiE=n80#u3=G2QqD&R6%nXb(1Q-~8U0`7Nbq2(dg>j@A80%+(ROf)I{+*x${USs`
zhnX@bE@oz6oC(tPoPpujQxFHF3(R5tz_4=;B={2ZKq;&Y)V5&}T+mPeio2aFpmH4`
zIgSR9tII6FzSshi0hQ-G_5c5aPJCo8s|Sr7f*h^=fng{3Xei-oQ6_89Y~Bn@28Lgs
z85n+j1UcFb#sM$qXY9WHfniq;Xj!CiyC|ywCj)b4J2L}g_ge;r->eJ_zy7i_Fn0f9
zVEC=g!0=m@oq@53oq^%E4+Fz*7gq+x9ucr^1_qvb2IeFKkhCNN!|yx>hTl01whW9t
z3mF)M&oD5jfkqX37BMjVZe?KjT@6yVmVx2-Mh1r8t3jMy3=F?7Gcf!<4dNVUVEFxq
zf#El3%An^81H&I>28KVfAen~@41b&%82;FTIPVx3{-iQ6{E3wY?WCyxz_8Z=RJDLe
z1_n{)k6H}ONe4msqnm-@&msnfKMNSd85nyPe_+^K0ru}-QRYAL49v;t%nXdZTNxPs
zY+zvcvj)UD#K7?97z4wfL+lKUz2_Mi{@h|<_;bUSfwA`v1A_=R19LLy4A$Pe3=Dss
zGBEsk%+A1A-}{Pz;m-#KhClB>n!YnI{AFce_{+@Bz}Uya!0=a|f#I(#_Xmc(9iZ_U
zP+T@JfiuZI0S2aHHlXZj18Oc*F))Aw?l%L2h&TgtniR;Ze;644S}-vD)dLyL$-wY;
z8Uw@MHV{XQf#DxN1H(VgdJs>U0lcB>AL#7ZUIPY(e~k<b|G+Y~3=IEz7#RL_fr23O
z1H)d>8CMJ<)}ky7LJZ6)av)z<Gcf#{$-wY$Du~m;!0>M!1H->nAakcOF#J2n!0>NB
z>j#Ft7Z{k%%wb?o5dk@u<3Fe|vG)!`J=5_Pki&bu7#Kvn7?@K)6R5r33=IFyF);i)
z1u`Xqf#KgX28MqRSU)iAvw@sjl>**920oCUsgeVf?DqvgWhz0*9x4NF{OqfM%1lO*
z5di5qV8T!jJ_ajgEs~T7Sjq*e={S;%1Sl6B2m#3;iOMj563E1_9~k!AfD(vEf+&lr
z1Os#GX=Vn-N$d;^|AiPB{_}x2Ach(P!+#YJN1lP<zezm<!+%ivpQOXU@ZXDp;Xmle
z-bt1W4F6*o82(4OGB8eZ`@nDjv@e*2fjKploq=(ZHv_}}bOwh1si1(H6v@CKQpmuZ
zS^$!YV_^7S%E0iy5afsb5g?Z`FsHVF(hcM!%Ka4#Oc$aVm{URhI3^Ai(3zYpf*<}n
zgEh23HEe-u;Qqj{e+Ebcgb#{2P(lMm!~zD!iA4;|si1~GQzN*+wC@B1<Aiez%&Fj}
zej_-U?!Upn*azMXQ~^FLkMlnx=#HYL%sPzBeS7Merq?}U<KRpIrDX=@G|TDzkJ!ZO
z3m6!uB|$<MlB(4i7({9rm@~6MsTvegT?`EWK?%7B6jBQq82--z=jIO#yB$D9>2A<$
z28$^3Idul+G;jm3n}Ol~76yj@n?SP{JuVCkA~Qi|xiT>PKfu87e;<ew#K7?XGy}u`
z`ja4DJOji3YYYtkuYfo?3=IFDF);jpBF?}#spbR2?h4SF9FeV}%(r<Nm@{=i@d<L%
zX9kA<??IgD42%q142%q*;h0HF7#JB885kL4K{6W|7#W-x7#Zw9oP7+849N_P4Dq1I
zJI%nz(89pTP~QOJ-C$s3n9IP(Fdf8s%D~95i-D108;J9Xfsx@l10%y(5a&MwBO?z3
zBO?Pl1LI^6!-0X3(FVkkWME`WV_;-V5ocgr{21(JRt5%<bE3=w{0z+L|Ct#W7k^=3
zWCTS_2{QxZ63{VYeGH6@^<DA|j7xa*AlmkTdtD%sK|<6AG*b&!xQKy~aRJPTbqtJ*
zYuG`W7#JCMGB7f3X8;{)Jz4Do!|o>xptHG|GiHO_q|U&|c$$Hc5fs9cO&Ay%uQ4z(
zUSa*fu=@=p>1DVuGWtP|?9XH>X91<kJq(}}$iSSD0!k7f*Mej~X_50kSe^%}wGLSx
zlvVdAfOJlO|AbAVehO3(_=HBNA>dTIdjm)j19QezB<<j|+5nM10@VpVZwE!^4T#Q6
zesrCXw7(bZaERRWwx?`DtP?<)Vfx&sY*zKv9~kz4<{nu<$qRIF(PIWi#{1x+q)qPw
z!>&1?1BgWKh_Z^XGB9U@<|f;07#JCUF)%WIV`pG&^JHLT;%8uF;+1A#>|O}gzz!xE
z7;HpY_H!~YXK{ln<jo9>Oi~PtOcJ09`2YhWlPUuvlQMff17r7D21X_$21X`5?hg#R
z7J%|D$gR-Pk+v`f29aM3%-QRd85rB5nI=krXwZxo$o5hOMkYT7MkXInJFf{O($B!i
zl*quy6bs_aVPIrxWME{fm1bbpG5o-=TLPRbL5p^IL|M-AGBDR?fmW00I503W&1Ya_
znk&t~Y!6Y$0#**%p2%3q%D|kpej6hLv%NJ~lnqQWFtG4guz)I%-6{->vAm!}u<Hi{
zV}CsZa~5cfiK!HHyC2g;36RWg7N`uk8&|3TD#|8ufcw3>c^DYGRxmJUgHMkt1xNP*
zXd#v@3JMH}5eII70*8S)8#HnVY7(-3U^wsqQUGRyPl|)8`v4UK-vKg_17!U{9!R@0
zy9CtmV*bGRy#ck|De-~fpaKK4gD~p{hJzm%7~6I+FlSE(Sq>V?$^`j>`vb$lKOh+-
zQ4VkpYg_e!0kpE5L56`j`!*;tR&#$~I3$6pxVQjZ7Vo+P@-D=TdT>gcrT2m1kOin2
zE6O3t3Ob}P7qp~mmJI_V6DZ-Vb!A|j<q1~9z`(=6oC7*)eikU=L22hSsNS1Z|AFDq
z22i~xswB#|hLeFg*N2&baaJz_Bhx(wMy6Zr42-j8F)%WHV_;<Z0OBlXU}P4oXJBOJ
z7iVC+ckctkA#l4>)I^kVE-M3b&OT-a#(VD=7?~9q7@4J*85r-gF)%VaFfcOPfMk9#
zFfxZTFfs?%d|)^XJ(n32r_hS&&<@D4$~lnhxIi6oCJtMMx(^J8t}rm?fVWW=Gk^y-
z4?Tc1Npe9qRY8UUm^f@ek#;zTfjOX_fjJi(;ot!R@OTL`7bCM1Xv&NcJOz2U1EdTT
zpkO6T9H0yN7>!^m7`z!6XT^MAINSr;Z42^xA_F6H4g(`|217k4>}KBmz;Gx8RFjCh
zin4-^a?ERHXJDN9nt_qIn}LzJ-j;!J<_`u2(Fg|S+~pvdzYL7bTNxOcH-qMY46c1(
zI6MQaJzbP>D=!0c9_U<bgJ%qk%*PlQnGdluFd2MeU}V0*z{q^fmVwFO9|MDEEdz5N
zGkZM)lfi!mM&`#1jLZ+YKQJ6V0}3`!IC9v56U*T>&;}=?2{@(A0x1G5gJ5A`&NBje
zMu35l`6~k>^G8sK9V%g9yf4haoaY7#4oFry)B_402Ijm}P&3s8G)QF(3!8dSGF<|a
zhu8@!&MQDY%Hs*3ey;?$3&r?=iS+}+t^mj=THYd1SFw!2SOrwJ@5%tp=s+w384tS3
zlLagZ8X#bd`Tl|72xvzKcvVEcB53(Z%zv;L69a>2cfAB7H>WcLL|q7|0|2`EkU>C#
zk%O1@1H+LB&@>1Gb3Sa?`TGJ;d2=KMT;6~>ypggW7><C}RT+Rfy!kd&42+Tb;AO9j
z5nnzq908pkYXg=F2T8F(rRIHLI09NqSr5@xRK>s;u>m4y#QcHb4Cu_pJs@p``pgWB
zMxqRiECLLSEF2(?5(6WPH3K6HC=(j#GcdArFfg)Iu`@6lSurrO9A{u;*(=V#=)dFx
z!&wtho)%jn!S$V&fw^D{I|HNtHU>tPFAR(<ACwsw{SViJM}in5j(=b{y9QJ^p9M`I
zNl1XsxM41^04)T)$-v0U!NAB0T3!?JjDe9=n1PX1ko5z@*$oVgVKEHM1$v<1uK|w>
zo;||A81V&^63*Iy7IiW(7l5`gGC|IOKkLK5DD<3xxgZs!12h~|pUG$lR(*kiG4Lq^
za{;*W2FbuAK0soi0M=jseghQEE|5VoCjJ?q!8b0JDp0hX{R55`kkbsHx=w&Bf}Fg0
zP6M=^k%773HfR_XJR@<=pdKm)uGBfeGkE75Kw_*P7|vyY7!1sXpc~8}QyAw8phBS2
zBbhkB!=vXaKw=OxK`G+Z-46^GK+7!Ffa0$R)Zl;ho`I27gMpD%1~kj~hk=nbn}Lxv
z8FYKeYccSoFXL+^21eGI42-P(pambCjL;*6FUEi(<sxY5JBI)}8!rQM;YQH$nDZDI
zS@$q7vhL#kz;H2v0dk@+GZ*^>aOHL31!V5A@C?ZNh?OF&9~drLfL4kyFc-cBXSnHZ
z@7RRvp{cxx1zI=#oB|5Yi#ZI8F)JA^GBPl*?Pp+M+X_0GLuC#FgUTF`m~<WkgLKMr
zMz(n@pc`YCGjh&jFVam-&M0PB&L}XCFC)LWM7OxKpdcqRHH87B*G`my!A=y!DpF@)
zC{ka}s60<Gz}a*9jdyHX^{W{f7)4Y*Fa}>Z!NS0Bu@-XVG=oJ0Xk(iq11spv3W5EM
z42+_T9~i?FT5v163{rIV1Eajo5hk1_J!fQK6iffW7-8^(4Wy_Zt9`#285qSUePC25
zSfK<`g{+A2ImA(d{2UAnmpWyc8JNY~85k~kffRjUGz4Y+5(Y*|RZbSx%)Al?MizDk
zhIQu{Sy(}{bc`GzY6T+)3+RkwMn=$Hvb17GMm7e9v>J%glMr4hBNHnFL+5%%CUypf
zm;`19hD)l={0s~X+90M%ix>j~gAs^n+71$R05MHK*8nptVdMZ=d4!RLg@NIc3nK?e
z$_8SkA)^2@1H)xmE(V56(i}`o+{|1I3=E%G7#MU`Oz--@W}|RPhlvTKhT#)00|TQl
zA1LA(nFK)5(FgM0^k*N~+{G0w85kHBF~!H1GcbvWffNcbFeqA1clpSsq1?m>5j(~p
z!~tT0oKXv6FfcGQGk|y%)B8WNiPtL$Ffd&9M-M_H5e5b}83snly(|!q2(o}fk_8fy
zERc|7frKOrBqUiFIT#qyidi552~l|x!YgHg1SAV2AlcyoX%qlrLqgIL#Ds*TJBSGh
zNo^KL5Q0izhD$aOy9`-C!E;$w2pWWt5aa}hVCg565EKOkj2I}<GqQruom%jL(MV+a
z#ZPP^^{fvV7+J6Ir!dGfFfc4&U}V!_U}Vz}XJBA4{lI7hUM8XF!^kSa#m&IL;?BUx
z7RJEH<^<ySGcdAUV_;+h-C4sD&cMhnz`)4P#>&9Jk^myIK|~oN0|QGV10%Z|10%Zy
zh||Ns$llJt$PPN*jAc4QJtO;d21fS%AgM(Rj2!+9j2zk^&RPaWj_VAJ9A`nC9Sn?|
z5)6!-JRr_t21d>(21d>h5a%2NBWF7UBWERubAy4A^AH0g=N^#Nk9imvSl)eLGy)yS
zV8g(`WCara47%c;m4Sglv6q2?X)$9x0|P5710&}x21d?npeYwY21d^J42+yFK^$2I
zMlL}HMlN;`N0Wh(%b9_Z%M!#fWnkngV_@XU192P~7`di1Fmg=>aeNsVxz;f-axG)v
zVPIfW_`qlk%8DQd>|$kLU{eJNvqpVjG*Mt+U~rh8^o32RemMgJvlc4@1M6uJaUEpL
zV+Ka9I}D6mmq48N42;}-42;|?AkJ?FMs8;YMsAQhK-D655d$N44yc?IW?<x=z`)4e
z0rq4L1B2oo1_oxZs|pzyxpy!ya&G~dP|Lu`eVT!h`#6Zx$-r38{epp!`woaVm4T5*
zk%5s%9K>13z{nHIz{ukX;;dz0<e9|4$kPMj>||i%*~Gxevw}f_fq~74fkE*-$N}aI
zj663P7<oWGU~^(%<ax}%$n%hcfq~7JfkE*<0|SdZNLdgABhP0BMxNIoP8<VcGOrv1
zBd-LAm&L%y>%qXt3pz`Vt&D+@w~>L77nD}mniv>)w=yvDt^_ITV_@X{#K6e=2E>`g
zz{n@Wz{tnJAj!bMw)_L5IjF5G0SawU=axZ=f#I^#^s8Ul_5@tvWszcGU|{HCU}Iol
zjbdV8xWd7r1{MLanGx*E|B%=}k=V9KY>Vj+zp=@HOf>?V0XFp*$RrLHZ_p0YE)bg;
z!M^+tiTx9aZHvUVnC|<XO(y0F2TK6hREQaH_T_&F@ykDv*tSS)3n-g8K0cQL$_BZP
z%?M-~@ARYJ*|hDhaIk>(3Nt`m31?sahY-K~6Nzn$#I~5O_k+z=xrvblbY1}4Ee2T*
z5R;RE;ZiM#0S;vluVQ-N4>sBQtAf}HSqlRO1~wZ8M)@#kAuBW}3t3?-g>2PNHk*1x
zH3hDH#6fKgMpiaZHMQUaBgA)%a~K#{eE3TlL?A^hUnBz~pC^AAtjOit%fQIDQ=%Ny
z)a8aMxyiuDcUcmo?*pR+XnK@E$&!(k3tS4vF);E=Ffj7{<7TL5U`b<O<lo1@$iD?t
zCg(9Q3NSG+^8W&rb>$$U2}FRlx3kP(U=*-oU=%O{6_tw_7zI)o7zM&WoOKM00_zzV
z1*U>HI~f=SH5eELL34sEM;I6dXEQJgf{qboInTf-c!_~g@B&ELEe1xxhYa<Mg112y
zJOv58XJ8a!VPF&lTmFj&RI+|xv;egpL8YH7sA%H?mrUXe3`#K!3{2}lMTrapqmVWO
zqmVj?qrt!^<iNlvWCh}wFfa<mFfa;5fH)x0Vg^Q`To4D;lAp}LDAa8Y;zckp3hiZJ
z6xs^nq%bfF-D6-Bx&<m{*~~vMT7t>|2L=Wv(8YIbHXvcv!VipAI@9xhvx(KGGcYi_
zf;2v2U=#xR0CboT>pKQUp}!1_Lcc*WzZe*W`5736xj}^u8v~=T3In6C0*E8Tz$k3Z
zz$k1A;>a;D3WqZ=3WHA8Wz%9{6fS096wU>ExS4@Lshoj<8SLQ>21emY42;4PKxWrZ
zVPF)V!@wv!3&dN%z$m<ufl+uVh_i-)QFtE%qwp>eX9okL@Kpvz;qxHQ5e7!#j|_~$
zpz@RT0t2In5CfwK4}$;$1DhuUgVJn}Yy21(MU27MR4_2GMKUmoxG^w_IDv}d6b1&R
z)eH<QpfG03&tzZ}0ZE5~G?g+iiWD#~ie!N}jSP$;GZ+{}`aqms21b!n42&Y6GrQSl
zGBAq#V_*~kt@34C%D^aU&A=!M4ug#hjG~bYjG}>H$LwQZP`U>yhWCRuDnN?ikAE<V
z;X+W6L~$`J5z-7YhnEGZD8364p|~iPNHB+(122NFFhh$}CI$w|iepcZ$-L7a{-a89
ztS~+6KbtJPO#X<wOy0igKbruPFf*SOw>7IJx2G_Z1OtP-34@{V^s|iYK2qG4-0G5y
z!VC<mdW<kd>XM$q3f$X`nb>QX_&peF8Jid->xCH@yjU3wr|)B7&rslI3>61y3S?z4
z6qey;U<d-;xQMV~yBjNe1^9Lo6nnF#-(h2y;?6c<VCM4_Hj!kK*#3o$J&38El>uxw
zH_U;P81>*H>XHiF3=ESQLF2ho7)=>K+qkDPiZe3vadTU7TXS1-gIqF=QJ8_5&qk7g
zVLBr(12YHAEf%Z{3^N#o8JRhtsuejv%4af~Ft`g_DK;`%vsx<Fvw#ep#i++%F9~)C
zD=1VzhRtTwV}y!<L&^pmR&!v^1FK_Tn2XTKZK=qpF3G?!j}a8cAS328$}$=Xhl)oi
zN<^}TgB`no5fp$73=5(9>LLDsggXPnB1SHl4-^?07#2ggik}!jo@HQI0yY{H>Ps1A
z84QJk7<V|ahKfgUgN$cjSjMQw2=+g>rJ^v{NJVClmzOh|F@Pd}1tfeFPcneK&gm)4
z%PpGC&A_mdQJ4`NMy!w!T{Zn87rUs$YDQ3OK^*8QY%kft$PF@O&Gdg<>=NE<L5A^J
zDc%PgChRHP!Klaq3iEYP34TbbV_;a1Vh(71`UXZuMu-NG^EOUT<YpK1+5}OiC<Sty
z99UWbWZ!0RC<-zPu|fO^(y|4rRve_3!&6uWv^i%hBPhi-GfHef!OgynnGeJRr(ckc
zm(%C)v&%8Qn!cN#T{i4BqbLI?uHJxr&I(B}AXRT6=0Y<J=+wn`Xvv_RQBnaMlkY)F
zL5U5VbU|_QVY;3GyM+2jSS)~(h^H{f+)rqJU|{&XJy(GJ8_V=0QFdQOo#`7y*@NqI
z7#O%td|>nht#&i{z~~9u?&$D=(Gyg??fAgx1=_L9@qy7RgMool<O5@H4d|l24~)T}
zjb1Dt7=uAaeS!u!KtpVxt_P?{24T>iZ{}iCP)n160W<)@z`z7vL=BQ;U|@jAM}dw2
zW&kM&Q($0Vf~bb5fGB{=%Y$x50=HNo(oh4IK(v5{JQx_5K^r%r(op%6FnNUn1_nWJ
zzZ0qeV!rn~m;&g~22>X2!qS^Cd1${KO}^$HOy0s^yN@`#FAH~kd`f0<c6@P3Y0~x?
z((Jmt{7IE1sm1X{skw=nd6{|X+b?La*JyDkmlhSJ=9R?fBqeV54rX`fnLa0;U26L2
zcy?`(!qnW-_~f+o`0}F6lGOOrypp2I?aT@6UA!DAMfnBs83l>kdve)*xH&Tt^HOqB
z;|)@`U$0<az#;^eE=VlOEKZJ3NiEAvPTgKs%g!szXu7>(0(%4>7tAq<DcfJnV_(6@
zQBa(kT#{c@yuE(``%8}PeJk15F+-hPl935=cVfzRm$mGIY|}5yW0%|>x|uzgcl(wD
z?5nupen=`!+a7y{{SX&aV^L~hX=-svYRY!G>+GLcx69pS_u!k}{F+^4d-ZE}c}6DI
zBirY^VejTJPT^n#tqtP%z@U-B!DKKWoV*w`YIxwnH9Sm)AYo9*vwdJtZ<!wTm0hX+
z01E>PTMt78gVKB!78Wk%4@}7$*g!l61}2UV4C+T1U?!;FfZG9LhJg%X0-5xJfDvyX
zMlgUC|A8njhT5kHu@J<CSO_|TJ_j_-%)kIzpLV=wy399rdB&dUHs9Da>d){Puz{Lk
zXBiln7&tyKoDtE0@mX;2L4g621BC!LR2?hx2d3=%3_Qr(hYW0>!wx<$oUvhHsDYZy
zvVd^~BZM8w0Ge_Ic^u@nGbt<#CJ<v-Ok5aqSbRblb66@G7$IVy4joKc2w3PLT=F5p
zhi3|=TYP7iV=R~+{+-=Gy#;Jyjwb^v*kMqvHv<zpJJ?=usGLZczV17FG-JVZt{?2#
z5+y7QG9U|b;#p)=7&BN@d?38(y+7E)8D~s?`h(rt^CS-og9&3Gi-`qy4}-A^=xpE`
zrTHut4;UE(S$?qmVPOnp`NPt}iXz*>+Q7yb2z4yj>XQ-EGk>zXF{Vu4@RMEIt%rp%
z1QHb|TQV3^8NeZZvLyoS0H`NmTyIFCJUJzT5wy(_;vKdR3@4XN7yQL8tGC345wy^O
z;{(H~2P~W=44e&89RH<2X%-~($DA=4>JYXM45yb&kNL%}6Sjnf!GbZB#lnH9kdei~
zhcOjoDkz~HhbFX2XhMUeGY}7w&Q36ZQza;kpNIkFfHDT9`B15Z>GyuIi!o+Q|N4vF
zwLXJ|nTw5uff*DZIT<XxTx=|CAgnCFrZk^{5hR=&5d%tQ3=noS*n1ow7|?{-n;9Hb
z9MnJ_0=be6q=1D%fUSq2g+XRMi+}@T4vRxHKl2AB?P*h(KuSU4po6@?A)i~o!l1xb
z!q5itk%BX5;Re{gGZqNDVQh$oGb{`mj5#bC<}fosoAR0&WI!$eIq!@)dkfr25COJk
z21J<Wp0QvutOu!vnD>B%fdl3M4rRtPNPOnSM1x{GtO4XHP=e2kVPQ~V%w$oC=4AfB
z6xPCK2(vLSCWbK_G!YC|R=~pG05i_P9d2BKJGjIFo5sMvFn#AAcD{O$0~lGafRb=B
z%LJw+OpLiK8<=*3s1KmDo5Rw<K82kzm}QF80x2eg`7D1FW+*ZSv&>MOugI9eGGB3l
zB6D&5e3k`@OOzRdS=J~|QDF>bxu9|dMBPz&pu!jonh#@O`@kr0goQzYgNwO`jUz>F
zK8uYr2N$y~gadXH+XqIu3oHx{jFBt>F^rK6;445t8s#>C{2jrflE4_kQc%MPy7-IZ
z10yHT^uoXFqV?<oEDSu1IV?O5jKM4c6POu;Stc+qW@gM`S<JkEg)x|A0n26<#vGO>
ztUYXu!C<Q(1ltEj))W?oDa?$aEDM<5fT%yr2Q(N%S<Yze(PRu|`JlN&i!l_O6d5H;
z3}6<s_E<22*I$Ah$624k!ob18<-stYg+qlg3!<7cg#~OC$e9@mjKK_$LWb=Fqu>q}
z1`SaB`5Ca8$joQaFklQ}S;KsX4Q9IVnF~yeNnjVUeP9&Mfp|_rfiVYM9xw{0unT}P
zT?QM6g&gw-rusw+rTO6ElkEeehzSb=J5#d`3wsD-2(n-RC{#muiy4emiW!tlRBFMw
z64b~2z$n}UO3!gDIu49+;H1YW+~dF)31!YO0K10c1Ea_c9hf6QOsLv=5Ic#1i4mmY
zhz+RNf-xgO6Xc*k5*1)!U|}j@VPWB6E@6Qre6SB84&XY#!XUwz!y>VQnXin&UyY0Z
zzf>86l8xGYmKDr*nEA?>p<>Knu{+FLSfrRgFeXT_DKq*{FZ;(X#Jq)N&-Cnn?6NEy
z*gDv!uldKWThA@S!Vtrl#FEg@$e6>jhw%)EI>UH}kujO&4&x6-#uSzxj1QPWc}zQk
z<qGQ>HV6~!Fa}UX$ixbD-xn4J1;%6+1r??q29}6)#vGP6j9)<J{9$ZiVoYIaVd`K3
zYmQ<0!+Hf`PJIjmBRESkfHtOrLV;U^g@J`JnT10@teHW`!COVCi9t*RMC)oWFp3G!
zXAv-GOlH}`_y*+CH;gYJZVO<!!@31xW&p@QCMJ*z85x<t0GvzMJ}`m}2W3!}1ja;`
zgcPQFgZV5eD;OCQSynJ^U}SErpU<*^@d${2gz*X^NaYpACyY#n^I4uSeqdxWn$Plq
z@dY!J@qDm#OvaERn33xQ4;%9b#x#ccaBsM<FzjGvjAdEF+QP;d3-KP<N#MeSyMl$m
zm@%29-ob;dnE{l}SUh~#dl=ZjOrIFWWR{o~X2HgKBb7P^C6K7HJm&+c`7A$JF0f(>
zGcZBofae1X1K1@A4D(qUm~JqET$R8uAJiH^s9=GLvas;PFs6dlF{UywBNXs3hCxKb
zKvQAh2x9xd2r`@n6eKL5f~0|I1`}fr%K@e{OpG}UpxFng5*`-r77noO(>WM9<P$!C
zQnkT+78V}HWR?b|4kpHAmL8DiWR@9BD?nzfU|PY%-ppXAVyHNuWd+j)CiWgEX9Lp#
zkOHtJ$t-7>Zh-7!f>y-ffaK$t-p<HjS&w8(3QGgi5m16V!gPj-xut$SL}LoLdBDi?
zCj{z!P;7uw94`k8g8^GHq-ry;22}-&3`|U5sR~HJ(!n$b<c>K^OPH8@JYZRq?E@ok
z2Ma?6V=zno6s9SlQgj2$4pzosaG3&j9#|d}W>c6pfIPl~X$LE)B>}UWZw{zb31iXF
z;b~zoR%v07F;=N!P-3Y$!^{{4OH2GdEDQ;Z=`1;47#Y(+i5oP8%*+gOAb$!Ag9ek~
z{CXA*55|0!kSUCe`7BcyuP`$A*Ux9U0?NnvkRpn2&ICrr6mT^IT8+u}fsvnug@J{+
zhjBj39#A9(vz%eN!UV3Tt}s1eVhje^1h(S^3xf+|28&AsQ!Cg>FbRPSXqDr`Twmca
zpQUC3C`(RYoWTeQBuIi1*uuiV!I;8g-~(=%Kx!;dO_#yKAi|i;BBH=lVZx#i!kElb
zGlP*a8I<H;!6TS~Ru9;K5)bnoX2xWeFU)_K!A&;M;-zF3c6LTkuz)HLkR~=z<$q&7
zi-rwjAWIMP9%jZsmOadSn3)S%=CkZ!e!$FJ$T6Sg0rLxH=0cwNEH6NY1tQ{2(1nG;
z2NZ7)n4f?u$tTPWEYllVI3!hI5<UrxDJ&b9J6IS~SSGM6U|~!F>ju?ED%1C|aOmr*
zIDnc)%;2sBBgiK<pwiFJfTf4|54h0s1FipIU}XEiD5^4Dkc~rx>j|iT!u)|L(PFwj
z8;3Nb#dL2r4!3#>7KR8=85Ge0E|NMJ*MN#7P#`gb`ZbI~0xS&tj5#d)CZIM5#}p1w
z<S{WZK_o$!4uXOs(PBOegA8K?%OCbX?4Yx)!KF9b2Sy<UP|2MGD!D5RSXww*KwT|R
z`N{TyQS1i`gF_5RdveWumIaIt7@=%%N`fkY$X6iAS0LpPaf#^x>>M)nKUf%Iz#$L-
zHV49l86&;{R7~`UfGWQpk@;X@a1Ig=VPVh#sZFk7X<?iJ?%pKVuv}n#0cC=M0TRaI
zAD~^L<O&uauvN(wEC-mcfCD?Z9<($TlyuoXFiIX_VVJ@J>Q+hbWMG-WF@X!lKErhf
z#s*~*ND@X;ehx|bIR+NE@^g@!0W~{@F_dKj;|)f}P>3+dnEDTlvLT?Xki(Ku!kEKS
z(!$6X&N74X10%Rq%JG3wt_RY2h84JyKUf$Zuro%mJYm1X$r!;hgKGsBV+6<xplm67
zgoQzvx#9yOi$*<&0tXq}2S%v)7l`;5Mp*Nr9xCwzBJl%k3&>#~80A`67z9A6T_Aul
zjHQQh4kM`WK?JN^56Io2EF3b7Su8D#J)m`NJ&aQrnY(HrF$MDW4^T-K$`Z2#<ZBiN
zkhP2;cY=H&!(=djx)>*iy0R1pC=Eul$e1wZu$X|dvyBg^^V-447|jAQlQDXF0w;$Y
zD76SMMzaXWfa2aS0OUJ}W2IzR7%U)yEDekkz^TA5fMp9)2RNSnK-E9T2S(`(9<EC8
zvG5$}G7wjS)00#WD4|u0u&{72Mze4TFjtGr2e}pGROu3sTr(&Ux-vIIQz6?2M(G(K
zaYW(-MJn3|MwuQK25C@N!<{h`94nv{0}eGtaITh?nC`^IVPF472ec-anSl|M)j^s>
zz<H=)K8uP2l*Pb=BnvXqfiV-*W&rD$0Sf&b76}u^90oQdb<jXiaey!wm|0jrzK}V<
z!oa}PBf`SK!3@euoFFH$ePBp9Go6#0Lq_`ysIbUn;rHQ!9G`Ez0@Q2)_2v@p2tay2
zjG&lfNO&_nfSW^x@y+yHZVm;;jOl&c9QuqI)Aw<6=rCqXf6dLIsXjr6F$XeQV3xtc
z)Cn3r<oLi~Hpc^$^qHZBAEU=~YaR|2#-8a3JRG7DED|gXDU3NRS3o%gG;jot7{(>j
zdwDoCnV58@@8IExV~m(C&dZ_2c?8r@%3(3KnV!wdAvrynm&48E2n$0C3vVd{7gGeN
zai4QTX+Fyi))%a(LJaJnNCA6=k<nxNU0x0op&k~7DWGgOg>gP3BWReEVY)mYhh+U0
zPz{^Kl5hmnF*?Hhh8Yw#kh9a~v%Fzm!O9rSvVwI3E3)tg);Vm9!7OvwmariUFJb$@
z$r#M?f%69!vhWYC7u<}&EHAhh@E{8>;F%)L7z{d=7ZgjNfMEE%g@qxVF_R_z024?h
z<S^y=EC)cXpG=k;OjD$%KfK8yHa%f32itTz9VYI2Mo>}#VGx6Xh3x~w=O<u~hOkTk
zHL*fiRxll5Vkv20oX>KE=>!vF2+Ikk2TaT*O!HYDF#Q1We=xN$vy>cQ09B41EQ}#6
z9V`=AzzX)TzF`G3zOXJ}12a~zZGkYBuy0^zE@7&l&$5Se0~c8C0M`u&V+HpYZm`G(
zzAGYN#s{$-;$X%O@e|?@$9xdqA^~Cjkm!*Fvp{hMF3!PzFktGEU@<UfDwY8IgsE5p
zED!SG8&G#Bgr$RNiWL*M#{~|&FEt?H43-YbDUyt!Qx7;kFnnF(z!(e}LixHz17rqh
zyq66mF<nuBLnP`A3qt{8FiXW2MsR-=7Lp(ppehAaQYC<#P*TH~!&1}22x2c`+yJ6M
zMFD6$;p-PrLok%3U=67F1H}VK_m}At1vo@}7O*fFFb1<&ynva{_JQHs21uo=VGYT0
zAVa?G069K_Md1P?xSZ$s!0_z}J7X3oX@CnqhHr1Ce-z*lt^Xck0?J?@39!ZkEDQpS
zp)3+p7#TxZrZAoW&CwfhF-4R!lriW*`c2?wAk;jl`@VOuFx+5d3}$)2I0Mn(V}J-F
zr#+B75}#puZ#V~c{r4##FNCltfD0g<Gb|2g7#TxYt}yn1A_Qay*nJQJTo!<%2&7E~
zG};6jwR8aoY{m>wShCCj<w{U5^a!XSd4%x{So8|x6%ZHHm<0v=9mW?R?h8iA9wty+
zf*L9eP}8C2Pj?dHFs|=mVhn|r><l0~&w#=P>^RV91p@;_6Wa%d?`uFsWr@Ii77iZJ
zpo7jCHf4eNEIcAS%paI^&am|`D1rDQ5=eZJ`79C|NPGcM6~pm?;rj+~9nQqa;qZas
ze~1TTFsMBXI%N5Oh&@xW1jh%4|8qctf1pK{APz`W1jLxbz*H;(Y8^vj`p1Il!onPS
zj7z3F33Dh}E`cP`2F4Ch8Ul5J*gi1)Si-^}4s)@`d=`xY1P3z2!cZ`Mt}urrW5M+8
z!W?Gx1ydLqLtr`Rrw(ZNGMFVG0hT*{>WG6v6g-RyW{bep+JI{J5Eh33L{|Ih0*d||
z77GtV3jT?#4m?QycSZ}y#h^sM=JtW%?+Q>pNoC2%0oerZmxB^8NLYfYScFBwf-#51
zA_o){U@adQ{%!z`yQQ$0<cJy?Gk;*pxjOxV2!}Xh&-51}95UfOpr%W)1dD(;V<xl(
z&hQf=D8eED3V-k*>CYtw%p3<mkpxa7Kd-Pb9AIJ$X4%8{h7XqMK^8)ao}V|SM~iaE
z*YDta%m;QSOqhjX52&=<!S{j>8W0fUzJR(&DJ(HPpaGLPe8>5~eI1Su48OLBgX<Y^
zh59Rpg+ZG!nPmy@d0ucY5Y)+J0E;p;vw($}npq$*$7sXCq+84ZjsQ?=g5f93jta&U
zmN|TLKvsbA7znd{VEFlGx|$e=a>N%F22cuw%n8I)z-s58UqGUeGT_$*6>yA!oOeM5
zbb=3f?D*FW8OCJr@EOBzks72xVf(=FTVnb`F%B8Q-x44b!C4LzZNDc>KPSc^UJp_+
zfrY^Wls^Ls7?W8l>KT*4u>lUA-yk{09F~9r&=f^Ic#sY(@katw?*_BvfKxT7RE7)N
zfXuQ<U`%GoftkhjfdQf+2P6g=>0|h_Ab_zRGGGakUjyl|^SD5wjpGBupEWKpZ~gfY
z1MZxIL_ZjVRDeDHSB4!rB+2mCgoA~P@e3%OaC~6+>*E6s1`u-s2V*`sGT1&a{F4Di
zcQA|34p6Dd%rISBf`gOkpUiYK2@WL?9VNjbQ(pne9tt{4#R4n~7*{hg6@$)Mhomx)
zDG`u%oj?L(D6~s(091K^-Sl4t)D!~``~RO~0dw{LIp7S+21$<p=ddt{gEEb{1!D*U
zJE#Q*Rsgbv<AXcH|1BUhz{&sr8xdG0|Nlk=<a3ZPBLhbWSQr%Qj0_ws44^<^F%E&&
zEud<)V7iPXhm>pwXpEW>RE~Y_P=P0XkUoY_2c`#0a%d_)kwIwt^a9kx3t=hf02err
zBJI<Q>GLHy#PolF8lX8W`~i%iED06hv14!w|11GYyTu$V9FU1ai0N~tGfHuYPgmgP
zU}5@H0piFreKeS^B*md2_%TEV?iRKW3?Cz=M@w-?OMQ%BVW?mXW@%tt0E!@Zh=0tO
zK0%5@vwi^!gAQXBi_Qs9-FJfV10$$zgSGZPFn$3w0>3cdU_lnX!SV$(!1IM=0ZJoq
z0qYk~+wcqP2b4zO2et|9;G_e$`|TMPh7M-N2$nT0^(R;uBUrw$%wT1VU^&9}gbh^L
zv$KOT6i5{VsLjK`4vHkuyc^pG2B;_x3rG}nP9wxraQM8v!oncWn8PCffQd1bWeLjx
z7RFGPH!Kra8ADn2u-#!p#L4?Jpy8TemKpk>84Osvo8esms7DsgvV!>tGh;Z&Wbi-=
zhyk|XozL_u(i|#mUzlgGFosM{<P!#E_xC0&3<>O$SwbhXOcr2C$l!r6nQ|vHP3B?A
zD1q^V!TgdLjHm)L7}qoMO=g+MGnr*F(?lV#q76(lnBgYQU|!D*(*iMbJ@W>rbp2!j
zmJOgGZ&U-oE@u0{@IHivVGbi>1j_`bHB69k4rXT1R_6~4?_*dPf_YjPRv0%ktT2{d
z!7!htgXshls>lhZIn0dVENhszK*EFL1H=0{!i>2LjNmahh7a|i1q-0=GD8k%ARjb~
z_hCs2Xv~ELRD`j8VEC|wg@J*sf}sR7wZ<U8n8hLx0_8F=F>`<vz@#BX@<$dP##{*V
z{SO(CqoI+&_JQG;0BE2ri$w%9Tco1Rm^J;S42L-5iRp~898wY|IGDMZLFcG|y$>eX
zJ}?~RnQko0;mmYYV|s-whlODbB+ChC!wUYRb66Nb(=!|&7>*inK$@6f&EPmc7BT&y
zEQda0#B@P94t>Uk>5g(7MvOhvOXN6o8GEKLlH)K)SOQ6R8lVm!xX3#825cm#j5yB0
z0_yTIfY@qxG{94{pu&^w1B2QQ76uVe;ECuk=CIf_FoH&pA>|oDs)3O)Wx9Yohl464
z7$77lgS7I13e7AQ4i2QuIXzXLBb=#?W%@pO4soeA5f%nz#vGOpOkY65#SmYCa#6zc
z_wpR_x&`Xs8kyq*!`l*N#&k%izpapm1<l(UX>jEXQqVBnT7kouF<^SW0*8`*fCgwp
z58SMY571!D0u4%l92Fk`YPV;yNNBKhGRQ;b1Q_CTrXNt?I3YO)w6;NBg!u!L?~Eyo
z9RH;_3_zV$-#OD4DstHSmI|;iC@^NRC>S7l2-2f26=31+VlV>Dmit~{Q(|BPmGJ0-
z5buFw&Aes0t`dhfW6ShNB@Q(v3zq4PN*rR0Po~dM;sEvHw<>Y?)!Tr=FNZ}0?%k3Y
zWth)PHgK@zOlHZQ44rT;kx>A77+edL$SAOIl^TG?N;p0+l*lMBb520!G(hXjk_7^6
zf-f2_lz~P7K`K|Uvt>?Z$(jtx8Vn4evZM3@C^crW@CP7!8JvbnA4tF)Q~E(0JO;w?
zfuW3n2b@A7OlA%Rs9j||{4gb@bM#^9xpa;`2Pm}XuqksunllhdaJ<Q($btfo?E^#M
z4;BVt#w-@$is^#f9KuY6Kc<_ga43Mrpg_~xEEWNb$t(dO%+2-lSwbpct%;%l7PdB|
z3F{&r(6}ihs5mIHVF4`$05csJ7;_nzz)T;|RDTP2QW4A#U;s@vfE)ozMMVWH4C;(o
zEb0dsnM)YwvmBUyS%pKIv0(ap6%KvIg6Z<A99oP8)4fzV6c`JpXRC5(FcwUoqRL@Z
zKLZqKpbDL#XhsCg?~r<e?E^#66&8j7#&DL5C7_W;a3~bbut8SF@qwY}4+|^k@GvC?
za3x<HzyhudI6g3x28h6;Btab>-Z}6nDV5LRVdijv#z|=fC{9>Fb2Q*N6o$eL(^J$q
zlvGbZ=Ji-u*m@2`*{DF5I~1N_0B1IE0xndTzFLh#hN)0t`bjkonfekI2GCre1!!po
zD3m}^Wx~Qx&X~zkQ3G-b3&#hBLKg<cR0bv(6I!ShMt}<=P>v~#U;!r?Z~zr%a4@EV
zTi6VR85~ST^C3}FSOAZ(!V-v!I6l-f6i$HqvTy>DCky8YK$ET&Xz&airiF7r9)~go
zzyShI(xzuZV2RiC%nU}5vq7#hz2O1tBbeUl0L^=Vvzgxm5jMdNaQ0!=0;%(R04gm(
zz6Yfd3lC5z=CFv!fa3%t%=Uqyc)@gD4Gsza3oH!Wj5#daBFx2%&{C-Q2`G1ijV`VL
z7hf<o8xI3_;Ra|HF0RmE=4=3ES;!bB+Xse%p6MkT9O{fc)8}Y#C^7a--><;|S_*Yv
zgG0r&hlQa6G$R2Tu>}<oP=^#;VPUXg3}$hGx0?&@fHMWCA}II(neK<FT{7K6lS7GV
zo5l1TO%7EMJz0}O$*SiHGh;M(sT11=hHWk2Y1BBD1E86fI7qp;&4PuglLOqf2bl%J
zAf-Li-)nNXGHqv>Zl=W{2cpBYIJBj<v#>B&GgUCKSl@xPuA%C;^Gu(u#o;dbfrUYy
zsg8jqq=2c80n}NCR7TrBO#iLLAqkpTG++y!%n~x0g(ai_$^t86`@pdM188I?oF$|H
zmRoi(C@_YCrdvU=1(Fs(m<?*SgVQ-koQE-!g-3v?4rD5L_?Y7Z!wwf2CNoeZK-qN+
z3^w2dwZlb*qe5Z|BS*ayG@I?v5Mi!UfT`61HT1!$ZHEC5cnS?<g3a{v+8kFHE2b~e
z;m}~Ln0{7=L!Yr?`d<)rV7jg@hqBys0Z@eHuw+aDjj2oljr^y81D5Rr!*q%1dAc0p
zrqd-r4a5|dgejm2M6fN>Z3MuH7wntqpelu_ScQcH?uzLy+jr@5STi!&3rzp6$Ds$J
z)%7{_8Dpl0>vO0pZ2*<GIV>*0;8e`<fx&@A9K?jRpByx%FVN?ZWlWg9PoG19v1R&w
zeGUyJ@GL|QiwR`J45aG>#71b0+7?XLG~iHB-vKGGV4`P0V`ITA0^n9MXg~n$1v`f6
z1qK|m7^h6<Hsr9bp8{$#WU?rujJZOZ28l-+K%E%SVh6Sl42fSrgZ?=z(l($5A1H?=
zzTjcu5@3L4xWpIS;N}H5Xp#z`-BAOW;-mxt76%6vsN$pq0Z9La4U}A*Vy2%q<dD&d
z0XaC6MZg7A#z2REA;XtWF&s=?Ab){Pcf2rN(1=5p@xpX{BMxc)3oJ--;R@3?7;#85
zg)2-y3#B(0amX+p011Prvv8g?m*pI23)2Ez|7nBx;Ph#M>;iB~w44L61yZ*Acue;-
z=8$Fdn4WFSp~%=Uz1NsS&b8$MD5HUu`x?k_%>(UrWB7OR00X2pMu;(h?oEWL1C_-L
zOibYMdIr}c(?5U=J~ExpghP?>%X9-14khy+p!y(##XN);TvZv$fZJ2^Swd3yiW!(c
zFo|(1K|~-y1j)$GAEtMjaA-4rn7$Qcl+X0*CLA7&KGPLUIh5oBSQt21d&KQk=Cg1}
zu=a@AgX$%)Znh5$&OOr;O~EB#rzwXT<BI7UOgW@gw`j02zyIL00Gbh<5qz*da6~Sc
z{sE+8!E|vm4i&~f({0Q+>>2-ntQ46(!Hk1j%~>IZtr*gF09Q*v0STa02_IcR<uPbX
zne78ZP{8zqW*pLt2d3XO<B(@OF#WF?hZ^I7=_=-6%G;bnMdb}7BMF1XHNXLxU;vu@
zg}4NqNWw&>Pd4Y!WC|0Rz7I;jH0Lm23Nx85ZNVYM_-DGA1=x+z792{9f2P-2a5yo}
znSRiM!wIxJm!C0%#lRn&qB%Y=1bqRO<_xSH9~go)G{7BP5YqtE{s1@jgEPQ&40xGq
zaDW7hgO|#D1{e=C$GY(b1Dww?@d*P$mSy4t6y6C2!TAiF44{=5&>^ni3DYNAa#%1<
zn105RLzgK;WBPAP4n55|uq5{X4`@&qlqEypV&IY*T;+w#nI2@tah<7OV!F09hqgor
z3qucRDrgB~0~dG(793ptA=C4$IW!nkrcbx#NHJRj%8EHGKH;F!31spF7GW?GtayS2
zL|VlhBnEONDE23;m~Lppp};t2dXNo=D$_)f>6JDddW>hLudv~8V>~ncy$y#Q<C*Dt
zwj6fi6HQE*IW$1UICRp1k?jM+M3d>wwj3I<AjydwpcKIY5(E$6F@nN=q74K4L<Z2X
zv>gL8x&XNSHZenk8Ke~)DHC&4m?y4a1oc)x3!*@7oR~9R*PcVl6<icf+9Cm6$i^^f
ziv%<0duY<0v_*h15|U>pZ2`>>!`a~04amQ29~dTYn4WIOp)Gd80MjRvPfTB7$DtW>
z!T{_Va6C*t0a`=^+R*rcVe%P}M@ku#l%XC$765x>@((1BO#Xx6k;#8R9#N>@!2%jb
z0yQ%xxUj%{GoeHR)RhLuTZsfS=R&B*CX@&;MnF6>p#<Tv2_=wb8#qT!ashcB#$@Jv
z1C57CE*y-YC3_qn7$&)ZqXguudJqQ^Dj+vZW{H5bia0(nOlA=VWgn<8Xks18WG-d`
zMLbA}1E|Jg28;9Puy8Rl%x8e{K;|&9f@TXqVa>zBz`!!GgJnLbrI*FRtpnyTFd2gU
zIGG1j^?=qGGEC;t0oeo=m4I~hU}XY0<!0ARuW{h;Vyu~d+=0W5@x*jKM-ENK9n&ow
zIn+d-KsxVm4QwA6szjz2J95}DRf$aB?8srs_+|QAM{t?M>%=jS@xb&oP8>3fXQrQY
z;_zgumYFW%%%P!QEh7NVR~#Q0s$~Q?$`~wFN<e)daF|xh2(WN5fhV594yrmcJ=>W>
z*|?g6hoh_>MI{Fh+!ziXs3uPEq&6reSA3X$(3wM@@x%0w&Kz1nl?p5jcR+(bPe5xA
zK{r%^jjz;UVK@Pr|G5F0Jqm?X?3H(r#u?Eyg2uSnJ}^}3OwV=U5H|-Iz`&Tr!mxyq
zF^mOlN*E|Zft&!61NE&S!r=^{5qzkv(|5aYXxL5wwaLJ}_evcOaPyD@WHLDQz=Xkx
zhXFi;&rlWtE}ODgdKhQ0f~#bvvWV%Xt{n365uoXl43>-;;892k@a<lpR0OuKEMj`G
zD~Bdy&-A&j97Y;3pjsWYZ0-sZxR1s0fuX!+1`{Yn!Qz(f14G%K>EB&BtQDbEiBB?P
z4oh+YV<^i8&;VE{0~0fNmZCgndaxUZQf9{kNGl%H7w?G&m3yE>RyN@b3oOBvO$mot
zS2p7eXo)_gY-9VtP_6>$zOWo&W}3*sa)kK|GgBW2q{~^c0iNvGJ}_hlOuy&GA;TCj
z{kI#39Am(ADR&MP#(?Pw9vmXPkafafFJ}i#PjKf5vIt;c%w%9<=K$$sV9a1(VP%DK
zz}X2R&e6$WuA<z)1g=*=F_#@M{gpe10?1r<4j*u$g4mtl!6CyKGrbl<&GO)oV~m-;
z(}P2UF=l$NCx_2;Jx>lcix{}2<}pZ?n#VA}EH#f|z_8RjW_pe%hXTZ;2*w$pK^v)Q
zUL1mqGo}l9aj2{80kyY-SyUi%FdQEk;xrKLT(Ga>ET+eLaj4qGS+FpOGiI`gXCOD!
zK*0@B767TA1VHP;JOY@T86impBDrAt0WS_qCO?Dezr8qAxHhmbXn<Cu_!&&s^ybiF
zJTW~4Le+b7s4<?HzRa7$lJUg!2i_b~;!}A*28XctyaCPhf)W$k2ZpH$(*=Dv#6Y8?
zB8*`yBKnNUEJr{Kiou(8K*2qA3JZfhc;Uwr(6Ar4@|k)C+@t^{qN#8AVPiPc1VBS2
z;O-8%3Y(?_nz90y98)VmwH2HR8nNd1z%aE2RD^<D!VdPG;fLvKeK?dEKTN;q!=bG3
z0W|cT!J?AEG%<uFqkyRov^*Z98m!o0$8-^24t>TQ(_MTy3>kM!FZ1QFW!y1+i!X<=
zjG+l=_#~KR3gaHoL?$G2L$z)H?8}kB%$PAfB#=YXB*TF*3*1g;^vVFQ{R26Y(R+&k
zw4uc4eMADxgjvk!eP{Z{Kn`PtJ1h(*m>EM^UND2}G0?IZup02Z2}l)75QhaLSg{TV
zM9{}(dSMWUh-^j=C@4XNKBLcsDX{1OxsTCj!t_N!9Lr@z;12LpfiS^_gVqZ9nM_X$
z=1^lancf@BA;D-eeOWMv2IG?H=Yu&S!@$KO*bn{@5PcjU82vL~eqj5+=-<G?FdecO
z^9N`#CTKA?RQLunV+hL^P_G?)fE)v4_?OYYVR~H%hq_GzXf}kYnStdC^ABdGW{`tG
zhVQt~1f7aw44eSAlbPcKW8eY?#57glg6R)KI8?nC>}TXG=9t0++ExPTPB8{mfVF^D
z)(3Tna2B(`WI<_&F{lHSM8N(D+E4+F2(}N5!5Y&8LpdbGHCPyUm?mnl@TfC^F02Lj
z9zc=}p&Vkq8aB+uBB0#E@qsZIJR$~aZZig_fNX>@K|8!aJEuUxAU0?s9mIy(1@a`@
z2L_Xl>5oG>bQwFQ3x;v1Fm_Bg3*%5??3f-I#vz+&!@`ij<T9V7Vge(R3&cJK(+Th_
zV!8*!1h<S#bp*hTDo`^FJbh-W16syV%rT#ZgP$>zg<pWVm}5SqY&G>jSL-qTei(-=
zQ>?)Be_<Swda(k~g2Vx}AmRAH5UU{#F6BY42PG?pn3(CV;T*b*G1H5~In)?qrq2rJ
z&}596ek7bjopH<bH{l!-@<%`;yg4i?`rz?(h*k*6_JKkFz;xvZjwr?h)9WHQ+;zUN
zFnBO#vUqF&Ps73byWqmXpafKN!ZqqGnf@_?Lx*w6bh$_lE5;?;BO^Jq85y5UZ;j$m
zV=UOdCW>P!6Jx@3r&ta<#)RpOu^jr03DY;mau_ovOn(~7;ZbkQ0E#bg_<@+=kl+C^
zA?qr^9yFF<VQ2tN4K^@NVPvVEP&=Px4&w*VOd=?(**-9U6o8kJfra6FilD*~5Y=b~
z>M*9W=uBS|$Dtl*Yyg_|PG)IgTm#x3F$c6X9JG-HVtE5-fIgDNq=O0EjD-kVurQP`
zhOyLKU;@{&ps@&00|g@KFkK~{!;H~kdUQO8OuYkWts-c>eGX$NOUVh)A{dynD?n={
znweN^Qka^VAcLUBA6NvM8Eil^5@N!z-ZNyV9^}yvpqbJf7M&F4`nvfn4WOmn^>wgK
z4h+UuKs8k?WW{JKXxxaA0X&jnd}aEdcn+z06A{o7lUSCR67UuXuyY||;UF<k*^ML?
z0TP2Z*&yoTL1OXXQkB6(1l(c*O$LFRB>6dzaGb-q0~C%eOcR)(<LPW481lEUFlciy
zrm=+F039<73N4Um4rur|m1PcSW*D?#5R|sS;?oZ#a40k8On;KVVJLHgg+YL0q5_+d
ziZXa_9CNWOG%x0#nQoZKA#4ol7&0|8vBXrsgR;Ou07p<Vv3+1DaF|}6$RRILpaGgI
z%4Z2lVa$hw7^r3}(3rk1kwcpC%Jfr-94d@groT_*&|thWT_TA?R_h82Lo#DJOY#M9
z1`&t1`8Yl>=n2$-`aR&Xia}3cdVCUx1izkwIJf}@4q82j>1|0InL;!8!K2V1|ANKO
zr%Y!|<}ly`4XSZ>f%jxG3%!|cpUfdv{|2-f5mX~zFp+_lU2Gp1E_i^-h#VI20@z^I
zg$#Mn($k<iNM8!Z?EvqzV7QPG0BUN23PBJX(sGCL<hhwYFa^~?M{7W3GQ))q1JDr2
z&z$+HkfeEG2fN^6=B1E%dC;CwW}y#CVE40qU^sVS`p;wzIW34&!9H>i0Tnt~Ec_*)
zG7O>()Zqgcj_x7T9aA`@LQ-59b0B?Y_Y}}FEKpksyf$Zk2WX*b7K?EOsAXEw!U$@Z
zf^7rE4@5ST#Tc}#prRgLs<C}wnBOsdeF}$y&K}SRCaCmhn12H_st03&LdXx2szJtq
z23FTh|DD32&A4W|dMbx(*c#B#V+M=z3vl$JHR-2=Wz%7@D3L$?0%)Bac(562@(fVO
zgBx)H(`Th}NY~E*ZTn+x$(he$(!vO$VSN^`1Y-(F7(9~8@quB63euqN3>DB?j2;Ql
zpl%?fyEH?Gg{cr^5yuCH8WzydEi_ZrfHtl%bEM8^VQ~j1Jdgqjd&X3T=_Y9$B8)lH
zJ<~Xx7)z%2q=74nZD}0Jj4{)1rEzF8o|(>;&f&>;WqLq5xb~<3QFo><NaxUH+%f%J
zI)}2&4p6COHJ>FSgUM<>OAliYBa;;<H-cs=*gi1Sg2#8WSVCeLvshwMn7a^rMr+SZ
z*UjLFWt=j-JA=cFamw^V85~-SQ>MSo;Lv8AGF>v0Lq)!i1vGdC?rry;F#xyQ!C?eW
zHN9u1$7FKIFrQ&znEw6=hlIo#1Ez@);B9;iy=P#19T|G>OkbVJae;Bp^qMRVWyU$v
z7i4iLD$D^Dju|X6>aYQM-5sFH2NZ&A9~dHara#Q$P-2SIna-Ncp`-5t9VxbkwtpBR
zeT-p&8QB0zTacs*PU;aCrYB@`C@Fpc&81I_VG)sG>Wg8Kv0$1Q16tMyDj`9sHsZ_l
z#n~K6G9YD)!Qe?F78wI*js_c~Su*`$Hirsh$#k|H4msf$EDQnyC5$DEhAK*+9LMAr
zG2J|eLzOoITp~cUXiU${;gG3+!NTCf7z~>F0Ij~__`vA-2i!JcfHNUJW%ObICGcbx
z8&J29lL0(IdhrNoR*T~U!=(-eW{w1KHe~>>T)qTeA7D8jwA>+wMI{BajWg#m_a6o+
zE*1tE2USQ@kKuAWhX{0J8DtHl#JG$Q1DzQOE><pch=50yLB-kS9t-et7>*ANm#1t1
zwdTRCj4K?*;8{7aL6D;KipKQhTn+=qDbuIqa+ovTn0_XgLt1JL3&R}HqQNzwl?5PQ
zgLJTcV7O8+oiUF?B4p1T@P@lzIw1dWd|<c&5nvM8fhxfG%LM9;D|>oC?F!Hk5(AVC
zG83{46lC&|>A86vnl49J7;Hd`CTtu)vu++0pn?_R_9rUf76HcxhO06vu+gro2_PmT
zI30k@WBb5xO=kM7JPuu^YdX_8^EtHCL3_7A?MD_BZN^L%ZO8x}*vM-Qpdn6Bo0j3)
zj_FbP9MYCYG=z#7OjJ4kOIgVkGuVT6#w$U+bnOg>P!CM52QCL5*0^?N`nr6MFslk3
zP>lf^-n!ib9z6ifeqY<c0E!GS^9ZPY4?gnY+8I!(%)-X;f#KR228Zbz@;Pj$R~K;b
zNbF!?cmisay<vX?8sdhwX|C^>KEHrNhVjbuJp~*Zz9&G9rwEoOY!|o~BUo;5O_5@Z
zVBiGB{f#{w;F8z?x=n)No&;!{L<I|22LmH$Rn8q92GCM0ND{c?Gu^O|Lrfw9RIB8$
z@V9^_H9&z0&INZerpFg@NE>cpVR!;c5^tDR2*LX(40q6k5!#MSUtP!{Ep#S?5i)!P
zEyV7MOutdcA*c1=4=+4wpGq77P1u8L%sX2IAVm`+1Gr$i8!%m=h(m%gV7g@yhdg7-
z^vEI(1<;Da3dV4j6^t*K!1Iw1r3XNBl+i2+3z!(AA?@9J5gm+-QII@ycLE192WT1`
z6i9bxXh6$Ws5LjBrIG|=7>h>-sPPGIJKuf4!Wa#y^zVMqfEFlhwjUVo{$OF?Veet!
zVq%b*&%z_jm<g(pJ}}&Su!9Gb20)hF`(eUf#lZaybh-j47Qx|pUu3#zF^5v7&k1hW
z@alaKJBon`HYs>Nf`#D&6Jr?52c{oP%w_fSS$;6>;RdIEh!G{w$&dxypf(ZYERFjU
zSQvJIR>mD*Y5@r|!-S_FDCQ88fXGI&fMp{YSmCnoiaDehKTPK=;ZO{EXy5_~PEeV8
ze+6h%Er-Pfw7nhFuVlEtg9UU5KDe~Ge};p}6qGX{F8aa30NM}0a)Yr0)D8zF1GWzg
z4_KzxlyFGY_dwfI5{%(2E+w!*&IbY<pf~^<_rO2^<Q0%UklhaqSQuDXCca^q&%(mb
zn8Cs?0Oml((jP=Ha8(O}TU5%7^C4{<G%<*oQy^w?1bkq4Fa@+`0i5d}%mIx|LYeHa
z8R-WXz-uHx9Rjuw3=bJVNhy@2WC}zr*j-=(B&jhyxs=0*v0?hOQVvbVoaqNjIdm9v
zroS!aFk#G@u2cqI#1d4-VOal=L7g#&ffufmfrWvGW#Uza`7Au@j2SHI8ek5@TMru;
zm?vImfcOW-VF0c6cz6I*RDc(LK$u|fJ-jo45wv~)l8GM)KxS(#K+QgoeQX~X9%bu5
z1f?Aq;~|zjl3-w-_zr3bi~|mfM;Fw=?PiV-3?OC-0~4rddh~>WF@*tKN<o-ls~=bN
zFf)ciPBDNC<UX#Lo?FhLRDa|E6JtCizdUYn0Bsuw7q5?79GE#8pjE-+76<Tt1&$94
zAZ9!yt3JN51XS*Ta~+r+4{3}&F#(NTgJ**tzhGdhXMqF|lnplhiGT{IEMa8esQ<w5
zL_it5UX9}e!xI-3W)4NDtxsG);^5NyNd_okz?t!o^5Myp0&o%pX`E8P2(unCR0o=S
zda?jvJ(LZx{sheW5A_UBPH-@lf`-mO#(V*#9&m^~`N9D+@u3OGc5s+KG=Znehc+O!
z5K$XYsss&mF+7!k?9>6(C{I;ZfOji`*&!8-Q49<$ETCDmr!k<CJ%@#(fYBwC0d&$d
z+XsfHDWH`}IiN)kp^!C0Pg6j34>%P)O<`c}0d3>}rLLzFK-Cjuq?zpl!;J^i11dRW
z>c6P4a35fp4=L4deBt2eVJK!$vQq(VvFG@}aN~;#sFumT3W=qg9^$ZNolpNj#?3fB
zFg)YP0o8n<vhbM=J50edmoJRWoc}@7Opuly+XsecDJ%@2P-Ia#0Ghlwz&QPNC5MP-
z#ST#01za&aOSuBt6AZO31GKfD$u9uvnrA6s*Z2iM`p?h4@UU<(zW_NNTs%G3neI`=
zA;Y+4dTJGilIaVTDX_T#PyjrCVZ)fi@qyum3Iiw^fh*A$Dg~fXDe#0os6cw5GJQ`K
zhm1giF{oDs%3om7Dbrt6amdKL6afv|f+O$d8)yp_k}Yq^OjoGpkkq)v0^ZsS-m?jI
z(pv`>1_`E878VHw#uU)(FUY*N4$~8>IYjC^U~(?tjqDsB7+(GmVdiiIc?iORhCSG=
zFFRyFJ)xi_pwWJiG=v|V0^)-$dkHsChA{<_+F!0w02>HSoiEoYfJX7ajkA|)6fB{p
zgXLa{tN|VC0M0ESHpr^%qo8gH#|MU25-Zpk<DiE!FuXFEu3N*Qz}Pe0uZAO(amw^1
zH5^rpbEeDJa?~=;nLf9cBY<(v^mnx!x{PzC%hYj5)L&v?X<=yrO_Q>;uxw#rTfo3v
zben<Y3Ck0(*b|m75V7YBEMHh!SV0ZL7S<`OV0D)mpocLqyfR^7h+vFmX<*#J#25?i
z)UbVEcohO#?^MeGI`M<4793@uFn+azg+ZICR)s}-3!?>NB51T0Nmvae%$NWv!Cvjq
zW~$YIBq=ak0FoPC?U??$jzd26m5Bmqv<H+SUzLD5SD@s~_JQH`6wtXfxhxJYytN{1
zD~v(Qut7_(p}Hj?(e(rxo39}J96JP`5j?~Ma@OlN)AQ>&#G>A?Fl=FDjAJ>%bcKmA
z4ibg0zZ8QOT!M1f>o1@KVZiYR5`~-q!2n`{Hm7iW05ek|>uN!wY2dOO<kT<I@7HrE
zS-t^{rImvA12dO`M}NWT=2i)`{s1ij0w?cVUr>^_uF3TI4ID~Lx+c@(8aR~Xbxokt
z4+%^YLs$|r5YrEA9~gAbfD|h;o&l)^QO_GV<QS(+XKUopXPh$KtdYZzamw_JMh;uX
zDbtrVa;SnfRD;f(*Z|rW2i{%=$yC}?rax)q&|&o1F4)AefrUxSWcuMY4g(PVwT;6L
zM4PsAsDd^?gLY-G>;N@NLKql1I3TSat)A&6?Hr1XJ=3SPb67L>Ouy95p~QG%`qy?2
zWyYTEk{ulB%v@y(pyp2&i-^T^#vTq~rZR=;^Se1rCCXGlK@AR!G8Yk01c2hd%w_tU
zZjSDH7tokj7K_9R(Eh*`j9b7X9ncXPmMx%(6_ojytu8DK%8Z#T$|j7VEG7`u&~agi
zYUl<&h`+anfZBbTEW#>`p)4v(z-Gf#F98j)hC)uU0>|Cf3~1beb{w&Q&Z+>nUO7H6
zY~2GI=LTo)t$S3!B{A4LTcIb<L9|zZCf;*cxZzR1wZaD61O=H;VFN4IL81sRv9f(&
z*y1z2s+U8b(P#RqUhv@gjb09I&<a=Zva|!Bp3Moy3!rixZ0nW}@X>`We?Sfci*A(w
zb+JLCzaSHPSQywDb6D6-Kwbd#qqg*bcZI^3;SAs|6-YD;!9+NV?E^EzvL(}7`#AI&
zmrUQ<$Dz&mWctHC4w3pJpk{v<i%kot#Sb=Qg#f4_3o!-E1`k++1~yj+fVQQSaImni
z0d-fPj)RJFf<?ijUtqNops31W5nclEDCmF+h80twJuD68i4#Co3rFk+h80UdISSm6
zSRt_lT*W~+0iX?944@`9#|MTL0UXR67SN{5vOl2V6>tPD`vYFp0b_&JfQmY{4-5e&
z(=YaO$T0<&O#j%=p$eiUCUB@RMohP#z@cKbgN1>Isf39|#e}H@G`t0l^?)s)HTpR$
z8lW~mxG5HJ1hl*uWF!c)ePCERXZqX;9NLU?rk|X^A<H!fw3IuOMZJS*I%5)tX#LV7
zAb}hfbx;hm++chF@ju50hGjM`;3a?{W(+){msLO`8dTaXy#P(KpjBSrbg=YF1T3X3
zec%I5e_)3$eE=%3IxSdOxS>OoAg4WGQDAUj3}JBq@A#L}Spi<O401RKvwdJ#GH3dd
zi5&WjbEaRJ$f3))W;)X(4sFIG)Ac5CNM?Az6XMbkxcinCK-~w5)g^bJ2@#wrK&fxZ
z9dJ&7F`)?&BnnN4AZ7@7Z5PxD3w5TipTwcZv`}aI{Ye}~AX<1bha-p%o6MofcxQUU
zWDX}rm+6Nmb67LFO#eTb!`duI9y~L}@quAc18C|PWEMCa7Q_0j-~(n#pc@V$QWet+
zrf|pzR0P0!;GiI0IAi*pDI7|SGp6sK!lB~(hJ`_cW#S2j`79ddj9Dz^7GMsn3SIOD
zbeP%1F2?yR92ShRkZNa14(J3kaEe<3b{D8?3kutu=>}6dq!e>N&0BC)v?NCW)ROQ+
z&WH>Pc&2Ah<<MhVz%zaJR1P%|eRwK|lFkAi7KQ@Qm`}k3Pz!Ja;}cMK0GtRGJOOn9
z;C@~(WxC)r4rSFlBH*nz%*>#302cgUVE{GXK&cvZ04GdzdgL??4aS7&P187Z855>&
zn8u;Rm@xhFG!E667c2}HK*jVO$Tn_h<vmLUl5;H_z=6r}fnk;oXe1GwDM8FINHEO&
z0UGN8x6)_60I&T3ci+K5pOG*<WIA|Cu4Ovd+D+3r)EE<{-<-~&!MI~O(+m!C#vRkG
zW^kA=?wFoGgTs*V%=CpbIMhwgurL^a8aW0#SXew<L5pW0JFzmr5+?Im40f=92KhkU
zR0am{+)&1!>3?T%s4->oOjn)B;lQ|KdfH45jldl)uyK#f8K51J;P}d%A;L7#2ON-W
z9~d&%urRD(WG*h4&vJq31`~(@X<cWo0rgrz(F#@yN;a8$rr)2*VK28vhh^dpCTL3q
zq7JUcWzBS(SsZHhYgia2GcsnfOlCx%=mZCj3q(ExE)Sas01r*Ox`3t>z=7?uriGEY
z3)D>kHE}>Z(8?D$8+zt}%Lg5%4(K)>Fq;>Y5I`jw+XsdWmFe$haVRKen23Oe03l7e
z3=<I+F5wPP6Bgulwhs*H8PoM=bEq+9Ob?sQq2#`x1YG8TU7LOak{k?7U^y@yEDcWJ
z>1!af&2SD!3dB^l4-9r9)A!HjkY%zHnSO6Jhk}fq2n$meXe~bnNDj<~+HP(zU1|=8
zER(sxbjvv$3hL$tP+5)-4CX$d;s<O#To~-GY?kQ_AWhjU)926OP*TZe0qtAQV9~H=
zOlPqNmw&Kug@y%0hX^}3Y_nOW&E*hhg6d|<=9z9gmqVBF%Jl5H9NCOlreB}SF^}=e
z^s;#zDU1cvZ_nfKWh|JkIiI7Mv0(bz`5a!1Q>Ooz&ta^(V*?}TY(_}?B<%{Q$rQ|@
zFa=zVLA{sGGCg1chZs}3&h(509P+XSBCs)+<O)!}hNUyM4-Cn3rY~8*VZ%6Q`ojer
zwxFKFLh#^})j|$krWAwenF~1-L39sDIAHqng&dlUA=57|<Pee0Ilu@#u8<)Gbi744
ztYM$>VA>)Md8Sl_>57XuEInLU7-ldsMzVZh`~sSG23=ACwwQ$>gfW8U1j`K;#s~%!
z(NKtJDCiOcuv@|Er!QK>p&zh;g~5ic1iZYN#m0f7lnp#8H6PO9PBCBr<yCObOA$~2
z4GVxH63PY_ZK*v0;B*C!(=><aii<fUMR$PaQzBUmY#1XMAd6ra(soSuU(6vYwF9)Q
zERuyqhA{^u584_I(Yj}P-C_=L%`2dj&OkYug_|)8yg#M@bQ&bb2ZppOpke^D$e8T|
zgWI0z`xbMkGTxc~WHE;t<DKc;OE?sbY;{0&J$Rk1tpsSW06bP~YXf33fqKd|cNoB9
zM9`SE(U~5%ghQFhMrV5S5)NfA8yyw~eZ~wHeGA55mKf-?1K4>sD?t5%P!<&v=2FD0
zl?`;@LdO{t2GB8lwhs)}1=Bw)0S}@nEalJ(Sl|L0mjMl1Td!aMRVcn0kWp;w6`+v|
zX3#j5^$G^qGIJOoasGq#1r`P#o)QLQDbQ}Yl<D)9a)|k*u)&U%wY~tVvA~T#>jx}s
zB@CsY#hVcR6ZpuR^$&P3fS4hmeP5t(0F{nb3#KzI<IrbZFx_YwhhD%1(3wEsu(P^>
z;$W*Aa0gr6Ky@%k3VvXPHE5iWr-Z=>>fjB_IK=9a9LyjBDxkpr7C|@|%$ES|=>iYk
zS%aD2p*si@oDi)O1h_k42D2$KfKw#8AULwEEf5~IU|<wP)Z*YMwX>NXww%M6(PsLr
z<s1QwIn!S+=a9-NLGiC$2?JvY12{tLN>Kd^lFEccqum^crW80AqzN?QX153A1aN``
zF*A|F-15rw!WA6)j8~>FT)|<&cxC#v6&xDDRvh5nk)Xt4B>*uNnpms^Kv4;Hi<JPX
zTR>8fum}6h3bfcADY*o$<Ph@*g+7aj1UOM~d|<G$kN`J6K)J#y0OU*XNG*s79d5JA
z0l6I<k{~8Zda>9secMX#GQ4Li!EFHPRUDf2Z{SY1_=4hei!X4eTYN!vI!Fr1>6S7q
z3<8LR!=^N!ML<Fre)<(OJ%NNJK<5d7Q-r0A4A?6fpqkavf&<n_2Qfn-LlzJwcnAo>
z1bfRe2JS-;GXyfiY}o=@APSB%2os!1pak0o21kzR+N(L-nH)K$m#pUS1JOrTbLeL{
znt+DZz`4fJ2F3f1HgNAd+Ms$LBn3@Hju{Y5&{X7@!N4?;2QpUd*aLDX*h!8()1%jL
z^z+BF2&gb7v#3Ch0gs>la}9?XW5RTUwH%_t2~!w3e@OK(D9&e*QIKH%z?73PJz_0~
z9%I7v_O%?kLRL`EfGM^Q4D%*TKem>`lJUs2bsVxHkd=9$v00e>tS{3I*Kt@gdQ8t<
z$DzQuV0zy=4r7rM=FAh%GcYi+fKC(zr@J{F)32_B3|sIpP1IuH(Eu$H1y?y>`MCnq
zMb?8maMtTNl<Mc{$bg0`!ErcS!T?m&fUA_*5(bP};I$HL9~fp!fQAwc=Ceo`fOa^5
zlIv_}wFG5@gh4Ss$Hs+)ivzZ~YmSWzY!+)y1ZcG^<F^86?{n@E@W`Pwr0AG?L;+MJ
zgU5kE9%lQ%FjHmv_w^j|qBh_`QPAkfOal$}5(e=4#p!_sjM}Vh9~kX&wnuN^U}9vv
zF+FZ0M-QXV^w%3XWb1t<fai}uD;wPdRM^VEbt|}8%IKc50CZXu$diojB|Dg*36;@(
zMmHm4F0{U9^pF7!z6G;5Oke^x`9Oomj2;0zps)gK^~h*p1dqjo0+rFD1a!hlC`-v4
zaCZYVfWr2H(W3#h94we612lL7@)l?bsYeH-DVWd#T8Ih?cScVI@GKZ8j@UjhIxJve
zI072qIKp^@nG3$62Qo&@=&%5^E+66*hb1*|uYtVkutJ5c0_0V3Q2UYN1Ea&96QJe^
z$ZC+mXQs<;<`CEVvIohdjvGL2mSC2UEsPM4g7;1^f?VpjVS3zV4hzN&)2DCdkhK=j
z096+Z93L2+WI&UXP*a^$K!Z;?EZ~C;z}|6kfO`iVI8H03zu(NEBDVrO+5$FUO$6NG
z;6@*#(}wAWTR5Z@kGx=pPRcVnUAO~^97ZP4=}pkEaaNh0yM@Do(PR3uEgW6~C7@GQ
zK<)s|+%h`nOxwyKQ(prbjL88Xj0<WIfb4TVk^!EP<oLkod?o@G<IZOym?!ptOoobs
z*4KfVpw2PaD=ssjUg7w_=(1)DXzc+w_FWDv08JT#sy#-R6Enbx4P=qanJEddHN|Wn
z7+r3F#(GLESlBy2Cu^`WfCg|FU41~K4xlB6pfNyDLz>a$2B^S<F+qt8#s-hYfZE<5
zZ?b)0bbT=W_f`%w{V$+Z)?q9GDU6xmEX3&g2h!i*_`vAKaE6Jk8k7*A>A;O;dcrmi
zQ6@K@>E+uvbdl+++c-??-FR3SIza8&4#opaEE7LL$BP)<cn-h~0y_vSPz5m=<S4ce
zj3B)hjA1MmKHx<mAnRo|fC2{`P;L)EjX?<W2WVsj)IDQ#I|14*4-R2>2M%Uo$b>q`
zhmh_wqkYBnIommmnH+egU);_i1ESw==a2)@{5v?5>J311Rbeaw8Q`%TP)Y}{`30Nk
z-~h4*&J2SDkAnlKM+lBE2M6$I7mN+rNdiuW3@aT#28Xg7V0{6a{T2ijX)A3&d!-=0
zWmv-lio5z!@TudaEYQMijY<pn;26*V&e{i{Y69eAhBY0aK{?PBnQR{z)_^wjgL>sG
z4?tT#Km`iJniCILnEXMJ1j;B3Yiyt+dlMkTT@XPZ=xEj*R#>xPjbR1IGaxTAtf>%S
zGJy{7t?2-@EI<*(u%<%-A`CI3V|v0)4hhc%uvEsdW&vbvD9D3r)_}A@Oj{$tWCQcm
ziyxqUyby5^I}98_Ag_FwesCv;h|~j6XEB(?rU&F)RyH;c(5iK|4-9J`On<+VL(%>V
zC@^zaG{7wqCMM7<<2o5ouOyg726SjR$ULwhbg)Et4<lnDxOK+%fnnX5>HfPoMC<>6
z${KKJt#jdF;bMW+E$c!gAWJ;J{#}>D1L1+4yY7Pocut1n1H-xx;>?Yp`y)U;1#`|Y
zfKvp+x(@=(jYu3&1q2;rV*9|bG6CfHU>3g<+&#RE!3>b35CK~h!vq;oS#JUwCMX6i
zieWB>rH1t$;Ne<O`eJ~xK|W>sz_31Ky5VjP5o=Hp1xgA$1)u|QKrUO~5dgl_fa3!L
zh#3l*Is!2vC+<V?1;hG|=?%L%<m)@YM_hp_#q}MaHCn7NW(Wg}2`WUO)~+l7Z9fTS
z`NOjYba)#t$ikHwkWn=Q2AEgCLtkiK*}wx%ieRrm*&s9J*gi09fQ?Oq7y5v*2eenX
z!C|`19u7HUAJ8e1;K<qF1DdJ_DFNy80ac12EIJO%CH0_QCCETf`OUDwXL|1*4*7Z?
zxaT(bfISCUT(beD(E_3o<mC-MpaVz1CV&(A$_`NS3SpVT2U=6g@<8B+5Mu}f#KR4c
zqj3$ORXoFnCoBvvKqGfEnC5^+-k2dpzy`)A({=W8NH9K`?z)#lS8gK%G*g1lL;S<o
z04fbYBWG+M7&Zz_pRkuhlxd^D^yPaw<U#a_y&P7`9-!st!Qdl{b6B=8u3%;i1~;WZ
ztCzs;+$b<zbsq<4QDxvh4sn4gEX)%@H;pqhgT{w9Etp=hk3+tG1q%ZUYY&5=)O;53
zE?RKX-n4}SG^Gp;%#C+I#S!Wq2%yBffrWtwbY+In6j8=t20n0vFM&lk*qqHeQ$V#D
zIA)=2P%yH6VAyN|@$hu9{TzJtpld`xNtGjk5!#I3>;gI21Dq!}yMUWSFgC1&+ML0|
z%;5wrNH%BifR1T^SewDa7y{m8436^6B`gdApt<0{5>Ow5vlO%~J+MS+K8u6`nB&b9
zSfB(-B^)0ZHkSxM77Kydph6y;x;DQ6ot^<_hCs3oNHi3Bq#neo7oe;oT5rOb1<50u
zUw|fpz}W@FgytL&GZd}>l!>6}VhebqKry)B2W53=5?BdJMNF*44F?$Kv%Fxsz|2zI
zPzP$Of#Vr2dk88EIeU-e1H<YB&}AB2;Fx(*z*^jJh!GlGD}V5?a3!vQ@>U7(K!zEi
zF}^B<h2aMyL_Nz7(3msm9uSTX468yOFfsYeXJ7^OT30844sL)mLm0S0kqgR4ZXl~c
z8($_uHoj!B@T-6tek>}W_C7Z#Q>{(_ja0*#Aq+4kC^WzW8i^Lu-4AknX1p-n`VdDf
z<Av!n4{<m#UYLI85QhcROor)VhdI=kX0lATJIrCoG?Qg};bD$2MwfUE(8^?k`79#f
zP47(Ljadv}QN}D55%2*~$YPlwu}lVbP^|*VoADacxsP%vGR135*E`A~&Db&B>nM0H
zQ0`F<dG$S@QZ9!@AOy6`HU`x81No-!17b5E+Xsf0j_I3^a;PzOOuu!MLyNIvI_ohG
z1?d-{txn)XETE%+JUG?VG2P)9c=>h8F%A{RnCYFzI9wTHrk_8?v5#@j^uFU9=Byr|
z^DZVQ@=1f{E$fa<e|4NAm+`^$h!Y&8j1Q)tJHg?{_+Yy1Ne&f8o9Rv`IaC>Kre~bw
zux4tInZEQShg;AK2BsF!Fg(WxhK4ITjL@<l#0-IqWi-5CU@C!x0^0|M#u(5hkx&*N
z(5e_lM(~=t#uyd0^vNt4lR@3F#ud|TPjN_s4i7oSp{)y69uHC;4=eg0MudRG;JeL0
z6>($C^!2AWjFVy@^B*ic7L0KqMbM=JjZYvgcyQ8g1h0|~VG&UQ7sue--K3%dUXul_
z37S+uBe@|gA~GN)pzE$cqdy!U7@BmpyPW3O!^m|E+}_G!;gEoA+dbwmUH&YGB-1g6
z=~ibsWEmr-N1Wv_WQ>^Jb(TX-zl4QB9CV`#sM!o|U?nE-fV$^UHh4cQWDzgu;E|f?
z_s??3FxE`}bCyGaamsYra~x{2OCX&u_<2BV9~k0mKw?=e!Vov;m`i|aevq4xJ6~Ws
z%oVti6Nklw>GRKVC^Al%e()T4|LeVT9IC?RECO&v;E-}Hm@amnLzi!b1XP^u1B2^|
z>4E1tR2Va+m!0QuVq7wP=XnkpPVmhUSu8F&;Ly-=2aUsk4#P7+b_saY#9an7h6*i%
z+-0UqU*ND~JTX1$0*5K%iRlwAa2SZ50M)ZuEIB3ME;!gF9wO7PUf@t;@(`K+_X39s
zW5RT$iyStL3De^*a#%6eOrLd;Ls4jr1b7`iq`+YNz~FIX`q_&d`iwWG|AkPxmpHVT
zJY}XwUgD5ryfMAv5{EYE#CILW5EdO1=q4=Cv^IER$+KnpzDpc>j4jjOUgEH1JTqPW
zGDjrindyy}Iii`oM5f=n%wY(k1+Q=@ME9^Tm~a;}c*rq-VDc+an$Kcl!(CjD;Mz1W
zqDW6*T!1RDfbjz(vJS8(*gi0LEt%ePg+tD(hJ_&k#e{+lC<egPd#_<(P-jb?%#t#h
zg~cHS$^y%R1JXxl`j;yl8caSq)8(#mXfu{f_qxiVE>{8y@=O*N(1ajVF@$3Kz~Eal
zz5gnQBi{|sb|8=_NbJV+dsjJR7;jAfeU(Fn@yB$9YaA;X1E!z4#vyH402(l17Fq(@
zKF0BZ!EX)9iFe>BL%%f!Y|I~+g{DBd5MZbIXH1v7&Y{ehG2ID7wM<WgP+iwK<V9P+
zB`?T!2xj}h;J;`3zUv%TjC-d4yv||C`2aLGoyEe=15ScW{tu=H+~AO5beNudgTsW;
zVfvyQ97c>a)34s(&|$2Z&UBMQhjGGm{hJ(8;uApGCK$S5f(cq{22PlsaFfG?@xb({
zH#xK!4@^IJlf#Pf!1O;L!3Wa~Z*ho#tOQ-9#UcTo`)3M#Fg^7ahbrTP>D{+DTp3qP
zzjzCraJX-Cs57=qH@?lGZMJ{~yzK+*;jlNLS%G9w1(pLDXbgJ*Zj^w%h?oxucbGoq
zHiwPC6j1F3FHOVeOn-12ynyKcZ4Ozc2$tz`cQ_Q8B21<`-r<mAOqrf=hr`UY2IRLK
z@Ht&9po;?`_C%hLVCL)xtw7}Xzz}&t0$e|WZ3S&u`7!<U9S&8-lIb7saOg6YOqajQ
zq2;jyG_(LNOQKFddd6TsMDwsPw1BROXkmN+UXTM_>;oR>VTj&=*wzVF9vd)y;$036
z#(?R&?s7;e1b~i~%wUoC02LDwIx8GOhpfT(M8p<M{{m8cVY=)+4jIM^)2$#>_&pAJ
z#tYNS?{TOy227uOk3-Ha1L92%8PLk06wq)Fs7ISH!2~>H0=7C~0kk^`nzsgfBw-Iq
z1>1CFI^%r~Eyg3$b?$RGFy5G+d!Iwea0vqoR}HM|*7U^$6jY3$#!oYk49L~6RThkp
zioTg=`hoi#(q_#XEDSZE=H~>)IpEnqXtDx}gLlZWfMmcd*m8qrjp>39IE<K@EvCCZ
z;ILslGQH^mhd$$j>6;#a6YKp494f{WKyyr)Ecz3`p$%RB1dF=%HK68m77GvPkW!E!
z+XsgBHPg)=awsrHOb>s^p(M3K8nk8$Y$Zqm1hai$=;W9_`5}ipQzystI}bUuyt;Ly
zK}SSpOolGz?OY-O-G=l3_W@8M<oLjV5Cb3Z1P+$YB@&RKSWuUN?E^#Ck?8@CI3((~
zq<}X4eN_Nuc#aPY-CIDbD4?Cg?mdu(JAVvl<^$CB={^F!ya}WnH15LCeIx`rDgdhO
zyN`hKdJg1TH<%e`K$T$*i!iuN4KkyL2h;(Fcn~ys37V<uF`54U5r-91kI8iH#~fxL
zI{7h&5s04tn8TbgXZrca95(s|5p1Q9u_AD*u_uRtsTA7K>B(UMv7yF-%<R>fZuNvi
zlc`r{dg>DnZ4f=_35SZX3&tihm+2>;aL6&bOn>o&LtfSelASp|F!Y8%*0(?mW&6O;
zr!!sUDTgLgpU!muryOeXHc+F$VbNy;S|b68K~QM)*?^3dt?#n|O^#+kcMPDEx!~m9
z=L52Z3A`AG?E}LM(4qdI6sn-Z7|fz$!UkU84C(-Ywg?{3Vd3Hf-zNs<L6<*Us?2BL
z044qz2f*uj;ltjbQ+GjOu`6V{*)t9erkyU+6P|I1$>;ch@(cJ-%$-kkKx|Mx0r`{d
z1H-PI=~JI^s4`Ye-~Eh3fw5uwoo5`15;;8J@eD|B7o-xLd-tkL7k$p5%@{D<@i~Vg
z<C^Ko&%x_jdY*HrDdw;+{9s{BU^&8igN-qPrG@thFC*wGWRPyQ4-9)NreB6=`ud#1
zT41jO15*zu1w#z3nC|d`LsYwhg~5a|fn@^Y8b+{Qjt>m`L_muVz+tzy2QpR9@quA)
z&-8{D93s*^JOVx7F?|y?ThKl!6HRD&y0>Tg`WGA$jBBQ!c)=0Fv`=Na+DncK#xv9B
zzXY#zx%iU9-fxRKcn34b2ZsH3Ahv)T9ecNcGH@b`O$bvN=+Y>JASkA6LKs0;A%Yxn
z0JL=r>c4$8)8k%oh%<&vFMGwIRlnZ`bSQQr%LAqkW=7BgUyvm>@*o32fzS4V0iq%a
zq5@<hI3)JRfJ);W7I`1gs$NiM?7$Mxs$OtU`@kFxrZNrKkjsHRpwXiq1#qbgp6g-z
zz_2?8yyU(fbi@VIL=D*XE3h!g^`Mh4q9Of)-3|;)Wekw*m3tgw7-Jx(Ac2^%4B&pj
z9)}pV$jK~GpwnbQnR(9?P$+?Je*oE30Y2m>jAakg8fL~Y@cj;O;d;hsh<G%rIB3yy
zx+eoz4$8)&AQ?$PGH8n>IB0f*Ed=WdLs9@5S7e4L=wM;k0Xk&t2$KNlP-#%^gvm_T
zeZwKcIAgjOgi3$IVZu0L`kXf$#*7Q5UwFfzQomP%g)Me6OZ;ROaK9hw6#+(&2d{uu
zW<p0|LCyf(m9z)63OX9H4r|XA3D6h?IF;_%A^~3O#_@q+&lU-eGT1?qV9DJ-JV1LU
zK)H91ga&xp3+(hgE9yZ*F=gQKfif1*kOf$L*BtQBdML{Zo;m!W8Wp7T5C>@Vf*sUZ
z+cgKY^p6w4WPt4J+_i*-K?hWI<W6P*6)VAzbB4igIB;bR6YOM7XyQHahGqJvw;Zxe
z2U(^IzT=Ro-z~ud3g}`!kOFAoe#iyXLk?!iIRn~)cLn5q(6|)G2ZloyB8cJwlu!<B
zxWmX8%<+NY@C?v!Huxw`P$_w60}BH;Q!xVz_Z`sC*$YO{2pXi7atOSm8#GM8z{nQx
zf#DGBb~ceO^I2G`89^gqTR?MOp!pn-olihDJH!fTkp{N;Nez<4(E9#x&-6d<IOG^J
zrc1x)(2NOzxfXg(`QaI$CSWj&fd{yu0y1+0q;&;iUI3qs1KK_ZGi?tjst`jt&>&)9
z`@nGK$@B&9IkXs`Oh5ge!-p|py2J+#JH{u|!#{B7m<E7Kl^m89(4`{Kb92wGkzkC0
z`2Xw{NZSr(8aVndoS44j1BVmiiRr&TaOg6=nXdVfLy0kFyU#}sFD_L(29`HWSC~N&
zRcFV*@_@Mm9BCl-6rMd$_V(SsIs93f6g9W=FmldelDq*r(~O0Kf%OA}255T@3zS_m
z{U9^v9Y&Ao^H?|~#Ed0CH+Ha`V7kD>a)apw6G*wS!}K#OoRaldK<hDiWLRWWz*mTY
zq`;>~u*Bqm*yf-Th=qlNg-3uzL;@kg!NVc}(gYH*_=0c+h|L04tN@Y%tsY=t0V@V`
zLCbT%vJxyZU<LJ-Eg;Pt0w8HC0T3JF1rQs_AkYd529P@-j<CvssAS<00l7m#1*{z$
z8XP<bHq_l<o2(^3JLNn)K(f{rU|$Qch}6RzV!Z-nB1AKUjiMPeAP%w~**;s)b*n5a
z7Ay`fAVck9SQs2wTs&BOLRcaaz#=6GGwne4qk+8+c8%Q}kQ9$VJy;#6><61J1LE4h
z08RR`++dsmjwy#076u6xn;MXmqXyWH2$q->FxLiR3XILdA|S#d0S*ku3?!)@5SxXA
zMF4EK;{`C6hef1>!HD$(gHsG>Yb1vNi--Y>i3N*=1IRdM(1<e&57;c{4<HSY2y<C8
zU6`Fy5p=dM11QmG=zvtawSWRt!2rYtjZ`qOFo3-RVau3+#X~@*aAbhlDPVv2u!KZ_
zxhFtUpa2J(<{`quAOa0l&k~UD6+Bo10zfLgK*ItoE)DgJEE5<%FoJ}<LC4y&6kK3r
zdBC^;9AbVCK*n+Kun35N6a?0=FvzeN*nrufo+*or2AB=H><y*{G`0<j9szJ74@Bh#
zT>%-$!oeZ|j)mX=mU>VXjg%{bC$KOGuyio?FtHq9`oYA~z<hz3<p%Q%7LY~33s@K`
zSpG2n0lPQ!3@EH1_Jk{d4HjS#0S8z36p+VN3P747Kt(1f>j+4&=zyaHJUYrE0*=G_
z1Q}4IfpR5SXJP`_APyEDu$L1-om3V`u1b8t!r;LY69Y0dDS?H-g2lmyB?Qb(E?{BU
z!wPETv9mm2|G*AXl01in;Q$NE36=@0EHhZ=u))Maz>5|^yc8A|hI$qj83h&<4Hg}6
z+@^vC#93G*SQO@f{g?(ii2#%{A)%fI8jfWVkzmmQr;xNWAh&aX9iE;6Vw+fi49>^_
zu`O&^K!+)_EMVNi$g+o}gB2u|3A#p*g#+xl%sF8D1$Ka~0`XW_1i-PI4L;+MMF8YB
z4ILH(u&LPr;Glt}1_&1vaG<Quq5w_`xd9-XIYd|_!1*e73y2HKOW;J82bSdlM@t?!
z(XiCRqAY(3NU4MdOUWHZmKV?@S)c$C<WOKSuz=>&0?@q|EG%H}L)qX`yAagFVBvtU
zCxCT<%dbMPu^iwO21zPKkPrZQgGIu|7!)YQ6`+*FBLGd$B{DFNf|E$e8&H7<@&uS$
zDlq*47pF)%IE*3XTxkK=LL^H{!Nn4X1dEIYiw4-SWei|7U`Lg)fZ0guL0g(wSQNl%
zpaNV<Kw`M!%k*e&PPLdXAPoW{&@!d!4~WYH&SBM{MKvrr;QUm*0OW9y1>pFsfs{rm
zEDsppFtYq%+`<Gt=M3cETF~jv&=gm5VESEdPBqXW0zND;DJ(f9EHxdVLSYKnlv>cq
zC(vRTe98$l#n)v_H{s#*st0E-7I5xtn83o|!r}ssT@agv#RXiRH-K6OED~VXf(FSA
zSbV^VqZu^q56YO3Jd4f+jZ&~oV1ziM!-Iw405i)8<|QmFYgo>(uv}sJ!ou>0W%^$p
zPWDg_7KT5JEI*i#Re=2230l&?@_=y<6Uz~%C*UHjGXfNJa9#!rLj=nmrU%R*<=x<5
z6#!?a2^XeE@^Z@7gDVD5feOwslOXjSSOt^~7N2|u6!36mQ^0#Sa=tLJ{9*dT#L~jt
z0ycjN*!-9)Oe}Ah-Y~IzVfq4g(sUD$lQ_WPGXq>2f!U09H&_^^f92)W25p7nU@0kK
z>EM4M#K8K2(F2^8cmzNNgNp}CKnzRF3MQ5nOlv^qF?xdfJ}lsr$><2WlNwaHi$t(Q
zfQl+cC(!HwRMr`El0OT_4p3Qpf{En<(;ct@F5rR{TmUk<K44*}zrn=vfawib&J8pz
z&%&{ViDeJd35W=2;WN0zFJS$^=#FH(+Yyk*G(eHfXkP&;kwZdYjUz?}9u@{27Ly)O
zDr0nT0M#szYHudEf(KVRApfaouuPZZ=LF3;So3pALdq{tW|U!3P+>^`>t~qt17s6i
zkAeb=1-QV0i(7z8u(?NA7!+6_jhuxRP%SbFED1|Mu3%V_1C|CCWJ@kg-^<S_4sF({
zuxJ>tnAm_DCE$v7Iq0%O7KaW{2rz&+EGz+#T4@D1iAaEpiWQ*cDWDWCAOfo56H-_T
zN<aw>B+dY8VnCV#E5MOt<H6z+!7_nu0UOH-wk2FFYq&P>Fx0btU|6XGDStpZ*Ql^C
zd|+nz!TbkYny*;{^#r77TLZel7-XNt2C&1{f)<mo*c^ax{(y{8cmnq7x)4w`3uyzc
zi~zAOaNpr(dBWYp3$kWCxIp8PVDXaxH#4Ao5f%whWx(P94&0R)pcX|7?*v|!8N6%w
zK>9#Jpw=aby#bu8c_dgQ99UeyfwsY9x`H652<Y5J6_z=CSNK?-@Es9gxg+pEfaQ-s
zk08qw!6kw$M+7ejvfL2-A;{7oG)0JIj?e=kmJdQdKnb5=!;|R+f}Gl*H34%4In|gp
zT1-DG$f*lD?o)#0j?e;8ki{#PKmrBC-kbsQG^F_gnipqb;Q+UcHiK5<gYyNrfeGab
zu!v}|=ztq<HsJQ{Y8Qx6ECMntGN5$K02dLFVUd9Zh7Y*$x1|AGhk#S1h7OAfxTUcb
z9F8223LauENSx7g#q?Q1oU&%%tOIH=O0ZZ!u9gO6Z!d6@Q^5h!a%1!cXCqMJ1{D#E
z-Y2HN72*`HH(_De!^m=m@d2p1Yyd?uqd%k)1l2K&{^0fiT$ewzx?&M|!_3mbG6z&*
zGX{d|i#3ek1^}41hLL3l;}K92VGP;;D${ffSS)N<N-99^3T6T24;65TZR527NxS%f
zLV26Z^a;Y8q7I;IF0L@LJYie{DpA0N3FLYTmJo2Q0J?KR0LtD0shD{{tr>{yPL}CU
zg*lU4cCvulRwo#5fSkdw(*<-8BFh5CFQ7^c>`&}sPgod2SYp7A+m$oDTZGevv19rL
z5l#bX(D)h41V%_E-&+BSQXX)fym!rXX;DsP=Pe+waOkkufa|M$pgSp9JTh2XSYEKO
zeBu7X4e}#sV2Xo<r-J1HQv<j(Kd=B~kPNsk*sU_XQIu1fF=qN)QBG+M@Q@749;O~<
zmMP3Lm{}GuF9B--50bEehDbmr?wT|Gfheae{|god8<soVGr&3Mki~Q!F;2;P(1nvM
z7T~7P3vf7qdj1S7EHx}!7`H$KLO>oq0;x%+fXzP?0&)^4&cU_PA#h#C!NYQZ=?N3d
z2c`)SMF}89FPQ#-k_^KU1CZZAH5a(&c(enQUwBkNr5(tPN5LHm4sd9J=9NL28`?BJ
z2HLv8A_7hT$0tm`BE}iUIAOZBIA>_w2_BFY4ICFZL1w^s8^Db-2(N<!!aHjMss$=e
zfPHlC0;qu<5(3h6VFxHXK^oo{!QDTP9bo5QJTm>BIH#B_q!lN?BGLlZd+85IJrB6p
zy{t1`P=Zs~Him^^4;xF1zyz?@E?2NHEMQ}K!T*IHWWg0kC1=561Im#MS0Pm)4+{^N
zdu_(_L<vq|?-`(4>k4NJ7f8#s9iXssaAEQAVF?I<)Ta#Bj(`LqRo69eGk^hX9fS>1
z3{LvjE2i(4;1p9?0B)+ZaD3rl`NPoy4xj5+KtqNs7uXMg1L($_=|3enbwF9vWcptT
zP7TIA(}N^AwfVutz!k15V7J`yncgGG2|DX^izKJITL25g0!Ee#jF2e4I|H0i!4=uP
z2P_OPm{~qB_pq`|VV%IqGJ|st56c#wEud0@;l2pS^(+v!%XCF4PHD!R>9$gw67>^U
z7{CpKJIpLkm>;mSykLI=wi$GqkqZkX<KG7dA|#gXgAW>F0Ua|03akg<RtOK+Wbm0i
zEF~XUSbnhl0e6lbZU9A>063%`9Raa<z-`}0H^6Kj2G;ry43A%c90#e|o<NE=aN+%=
z22^25G=L-i3AhY{D0(UaN_Q+Rj4VBnGL7NJ15jCF0q)e?_`<@V!lD8Wm7Ac0w^&%f
znfE5>aAlSil7FN@?gkxq!otGAW5EKcHJ*XXQ4s}}8IW?3;n@ln1|Jq5aE<nC1ITzA
z7Zw*679Vh>c(Y}Cw=}1#NDB)?49gbj2huDrq>sph48Hkb`V(nRJKI~3#y_aw0}0;(
zyP1QBWsTYnHI_YUN7V3$Dol@;;Z!ia1@0EzkbeU<_!j6ubCxG^ALLlR$Tfh4UakRE
z%`yrs3L4O^;w_EoTVyy@nQm!Jzb(V5T7OFe6jVJ5PZU^s6!$2B?Su-g0cWDu1uP61
zEE^#0*A8Zu3Cs(aSvD|3GT|*9knT6~9T279BQRKwFr5JxDQ`+ZnFdlYz6E!udBE}f
zUIDbLm*oi43ubV;=6wn%AOpYw`5}dcK?79NI6zA24|6~kNPvgVzP@2$C}62r1CH)*
zpnI%YEM_pWEMR;976IK9J%^EH3F8gWz{LYlZ8!n!jvt`arYv(fmT<6q;oSo+U4JY9
zB>|lhmiiV(NV)M-1eBKU@OALBOyFO@&$5F53_r^i{u}%(5BOj3v#b%=0(Lw2o??~&
zaP9Il1r)ejIPP$;JmL7j!SaIxoU1l~Gc)K?-x!vZ5|)|+OyG-sK_LseHrIwF22_bM
z{JH>gLcIz&CI1!yb(ws?oj33WwJZSzEEOGKfBilIvL*nWm{%~eYykJ-p_L-|@>kH+
zuOQR^flgRwk!S&Vnvu~1lxM&LX^fyn03s|$K%RNR-yy)#B0NW!Wr^?#F_sPWVq3&O
zRXRk;6aEGiS+NaZNkMS)RX~L01f<7xgN5Y*%M%usH!M3?S@y6V05w4w1uuYNY76rp
zQ0dGl(gDi90y-=PCM@7w$0!2s{c)JESb!>5My>`HhCeJU^&i-_u(Rx8KL9EX7`bnN
z%n%R(wY@BCSb7*IFtQwAJi^Fw1r(_>n3gcH%wW00!t#XW1-RY9n*$1(DNHNCUgm9K
zVaQ>b!L){jWedv|kjox`UB<ryRJRz|usDEA3PynxP-m}!5j3(=|AA4^1nkrTmIKV-
zB5noPXo#o@s4!v_1`ozafC>pl!51LaTi7nJv)o``!NIZtQh_lFegKKD;Mf8xyBUQz
zKy~>XjyYhS*bh)4uz+z7Bg+v;#4&<|1XyHL^g)3y9s)`VEsQfjCHECZmOGFX%_t5!
z@tDOYhUEbB5pbwV9+_UMz^SGEf{o<^+X4=j6&wdRSWa-f;bi&2`G=FGg{y~)Wdhd(
zE|xQp+JRB>!t^x?oJzLfxY5vH0S^l?f(~r~6>TgcGAuFRel?>MWT*q|Tq$smXamz8
zaHvWhn9i-psiboN6g8j`Cr}THQKko!w^d9awI-MgGLeD(0|Ot!n(2{>oNiV*Cq&sl
zFnXGpfXEC75V>LpBl`zNuLKSdnK4C({R3lg4Tuxm!UAG<sDQ{d+ixmz9%9@+OPTW_
zi)sS{1A_=?-2VfEx&;FRgO7`Ffgn?LGe}4UM0{XSZ<)S8gHxT+VfqOT&fU5f7#J8L
zoWQC;@(iFmh#5XGXlj6TI|(vXGcYhHfMh-}XqHUhpvkEOI*;axCZ{^%l<9voIrSOO
zOxMxklrqybVPIg$a28GwWU6**76NI3yG3^n0|SGFGuRfeTVz1e9~gA6Os~=6lxJKr
zeU28Vv@Ga0)E`d50fJ1`&dtIgB@7HuR~zh@enpE@o$<r;KU$p9py?28PIJbN=>giD
z@`7g=7#Kh{KutBvnBJhxDHmi8T9pP04XB^YB^VeOBpe}r0*NzxU@!;G%IZKu32Y%u
zEod%91F9Bku6fJ!589k^Oco~71#~#YB_}X2Fla!64%t%{JElA6aLO~znVz7-Db9Fh
zdIgBLVEPOYRWN;r4yPPwi}4K|PG!bB)Biw3Wpp{E#Oy$hf>{c3EW-x|JDce~x|~v=
zi`X)BIkn^*K?kjzZ~_Ojb2G??AWwmu{(-^q!t@QgoYImYx4XC^LK_-?P79_#(dAUG
z?_pqINP)Q9u^BWI#lXM-^`i3!1_p*b5Yru-*<IRLT3K5_b8b-AxU6AdVAueO$QB02
zX3zvQEXlZntQCO<8Tb;*4-Bpa3=9mQwU$uxU5_v@)H5uBTF}bk)WYiA3^Jbqs=+M-
zssR)f44|Fe3=9l95DP(`gsXeOz`&4$NbT+*OG+S~0;_}ScL%Lzp8?SijwBuiaRvs4
z4-6il1qBtL7z8N?FD{hP=LDT=?4i$TB<7<73KXbkpyB7^F@1tQr?O`W0|Ubys25t;
zotrsY!9IXF%`bp~fdP~@pic060P+H+)BJfr$w<u4AM9nM=z{9=-^0MbPytDrV5dXl
zAOMunPC&$47@Q$-0M!%lXL^DGr?{yD0|P??#EDMLEG^(jhAIgJ<+2zg=Rl(-NM`yP
z15SCyE7Q+_s1?)S7;s9lg@JSxOjpq56tfCzVPIg0frbe*zQRDB1K9@6H{qbLQh=&~
znjG#hJ;snz4z#4L#*kCmG6fWM5XU(-gOW2M1xJ92BdFuxX%plG2Jpel7YsSYO+iV}
z2NI(#3{EKCkNm;Fz)%D68#u_IE{H0bE@Q+gXA})`^#d1h<^e@JtgMWF!@$5$00~lL
zeK9f9bBs9U%wj>lbAUJ*tPdI$v7o5-fQUQ7G9%Q^*csCg7;(xm#aT>$V8kh1zkq>(
z!2rn$s1b1>A43aZc#Z-&li>qHJg5)`VHh7|9VlUfoCA`t0fihiu%V$8KLstdfg*(A
z0|Qh1f$25IoXU&=(-#<X$}^sse!!ShOezuN3<o4<L5)d_nEt_-Q=D<ibPf}6qR=qm
zG-k}09%I6(CY1pylx-lv3=R%Zie&h}kdZKbjtQrkUN)#$f<_To9_rp~u=}Cz1)0I{
zfg!tQnklC`W5#q1Q%>!AP}+p09+1lzJ}~4xU|?We<0QPH4qUMu0v9<@xdKp8HU%2~
zEzB<9D1cg42=e#@XOz;ua03Gag9oN>3qk3o!bw;NR9S*u4ARW-fuX2i`V&)5Wm8Z=
zvBVXeZk$?}!PdaiP6;T!mmrx5bz8}S={9DZQeveb_ZUDu4GrB=2XN>+m4e*wf)tQ2
zc~GJVKoW;0fHIJ?K=nE_@X8{lA29>hif_y~)tIV8ri++!sxvN_Zez|V&lod3#+=hy
zvV(zv0Xedu?rS<SeS<ltG~<!!XUsXJO+l(!pdkq<k>Ry>D-Qz$QwydK+b2wyvEY<q
z>QI<&VZkW}T67m-!6_Hk3reCHPQnZ71(~WHo1MV{3JN8L4-CDa<T(Q-*W%;^m4=08
zA4qQuR34-e>e{}J>1RN8^-D~DVZmw47&2YPlGC2CVtR}vr#|DF={=U5(wZQ%bCBE#
z4Yipdb3h>ms_Pj*TeYWOu;et7n+Xzwh77zU0hMJ89~fpPOjoetbY}cAJ;jRCm~q1N
z8CIOij2+YWSaC{$&Um_E#i;~3<LVDccFuGIYffdwIiRIZ&>(DKb!}sAWdVmIG<Pgp
zGQGr_)137L0|R%<^bOXW#*9AGpICD$v$}vP-RV3wobrYswI+~86v)-kU}5wG)e#Oz
z2?FGFh7X`I(HI*}^-NG@1}aG*q0H!&!N9;N0&$8{GoMQvcPmc|=-6IJh%g3&3J#EZ
z7#~!!gEB2N{cQu;4Q;Q1m<*7RW7uXf{f!N$G2@i!3bvePUPnN}4v?Z4tPElt!x2!e
z50ZoNL1mu}0|TsvJaPwA7J@2RkS_40_X}(}<sCtFwFk7#33bUaaPEP499%Mk_zWKy
zj)CF{)|Lb13XoXDG&@cuspB9i<kANerVJk#j`vKrvEwvnd@{Ynj?-8Y<fbD?i3OU_
z&ZkU2V8<!#3Ca&DP`5zrWDEw?Jh0LU64DG8KyF?G32Dbx4yR@=rxx%PcTh_&mP}W%
z=QMW&MG$gGLE?|$?E(e{<_VA{uVXWxdnZQ+XFC@>y5Q}yj|S6c*mKHDg32KkqyUG8
z(x*AoFW7U6Gai`!!k$x3=`$$&T_ApgCv0dSecr;rz&mBSh6ATOqsMd)2TmhhRsjYE
zDH#`G2SKLlfIh`ur5@!D^>&R(vJ>Sd$oDIBt8}S$s<mmhYPD!L>r77M6P>=tfz!Bt
z2`KWIp*JsoU{VKF>!6EKK#SWLJ}{|+nn@r&xN-D>NdxQvW(LqUDh7rROd6mB0+I)%
zLl7SnZ6H24_&zXcfGP_RA9N!CNFEe~AU=2p*$1W|4UjKE0+3Y3qyg&ufcT(<&hUXL
z7}Puj@xd$4J}?Et9K;WD_y;C%CIHDpqL(SGVfz6`&fAQPv$oH1=457M?3lj5g;N`J
zYpDyTF=NLxS57%5L5}GPuAKIQprVF_k%2*wfq_Z-1Cw9M^a58-c|lOK4<_vRfypmn
z`T|!@c}Ab<2V6Pj4WEFP)Il}XeP9*>wP9hZ+dnW1f!b0q{-h6}TU`X)IQ12;AZfeu
zfm!GV694T7CNY8O32vP7f}l(V+GHTez`!j1fm!In^a*a9@{Av*Z*b$3WAZbYe!-2?
zUJ%qzg4)5n=mS&omgx%aoP9!mpjZGM&cw^Wz>@oc$xmSV0e4P+!5N?xdyEXAGrw6b
zd|>jOGhM-hGoEq7^ac-3c|}mE1T~B`^#hX*C^LZgybKJiB_Eg)Ev6sv;8d<}04=m*
zU|?Mj>y<+JTRt#F#emjfL&AjhFsOG5Dhr|Vmp?FQfKtT-DF5LH#zas}%>!EW%)r3<
z;R9px6$S=I1t|a52gW4On$-&sJ{#u;#)Jb54E2l_PyvY#j45A0<q(vw_JJ`K<nc97
zzVQdfR8ZpJfbyL_Fs5!{U|>*z@`FDxrh-BrCZF(u@eQaPVS&nLd|=Q3RoxK~2eTD`
zJJR(G3_ehS8c;8qfq~%wl;81zLCb`JfiVHf@BhG{J%xb*>|oFi#F?ODW<mXGsQiKt
z43K^{l)wA~1Eg;a<!=Y|sTmj;Kp_CqfAj-`-jaF-21XgEf=i%Vycif5en9zmKQI{V
zK(g@Z2L?k>AFu!_|LOySQ33-4lLnOk8*~jC0|TQAgwM|Xfx#5q{f6=-J}`-ZlDPmQ
zXmdLQyY2@jk$O;&@jwNfKQNeqlFb~bhR_cTkbXLppNPumnDl`G(r<^#=fe8zP=4(P
z26Iry6Y4<r-VY4spxSH$RDRY6=6WGeVGc@{f(#7oi$5?}fC}drhysqC9~dk^*%oHN
z_74meI~W)ko<QW;PkvzX1vwa`pO=Aw{q_eYUr<p8<G=gBU<t}ppftwFz`*|Z1A`?f
z$DV=c=ivWP&tL^gB+xkFQ24-L4Jx|!KouB%V6XwTdY~@maQ(nw1Io)&pz?kn7;Hi6
zmq7W&pab_n9akv7{R4v?sB*mm<<I!QU@ySHzzB_Ej&=2*Q;HZE7*0SH8~}|JFfcIm
zK>6oCF!_NBXV5-aUIqq^JD^p03=9m=IOcf!fx!vnfj1EKoE#sRaxOv31wjS|PRS2U
zITsOpj`yG&xItqKQ1$g19~dA53s3>a4-Alj1Smh?1A{9l4n?5+7}&r8l%M#40W@&H
z01W}o@()a6ph6!M1<VW#oDClsAmav5^)0Y*0|>vKv-bmo8>q0&fe3KU{=fhkFo5z`
zeqewM6hQeqKQJYON<NSUARiuwjTb=WZ-d4Q7#JA7K>1%jFnFF}U|@n~V=k5t43Gf?
zuzWoO7w-oK9}flwMjfyK1D6tL8y;vF0m?V{zyKLGfbwlWFbjd|S5U4IWMJU(1?{b4
zU|;}cD-b{C0|R7O0jfUr1A{*(M4*Y9EAIod5U6hf_CP%Y16SDxW+6~22MaJTa5aBm
zfQ&mp4VVDhe+L?Gfbyq;4%|hg8Lnj?7y>}IbVJhw*PagyfuN!pTC{VW`oJs%>RiFh
zzx9CuGSI*TDt{RmxZZtW2m-a4c0euo_kmdmRJ1}haC3cN2)e?+zywXjN)aEJg+RSQ
zn7sH0W+70v1l3W33=G_=9~eScfCdsE=5ZT;V1SHOK>2PT7{Wm1KnxQ@J!rQvx7P;-
z$Y2FjLBR)xa8RlTRUV8C4BSm07{Wn5Is%nn{(&I^)Fg(+DfhV#3=yDw4^2bduRkzA
zMk}D|e|%u_Ln<eDSU@8dpkWv$Q2EQiz$5a3ArjPrgw_Q-nje^jKus2?4|z;KFhIsH
zAO`XTd|-$IHCbjr`B@(rAmbNMe(whc$hZZRKlcMe3@8_Ef%12JV1SHU)I$Z1e_((N
zSU~wtJ}|_BQuzWX|Jw(KI8f&@1H$KJ|G*Fj%J&9PzRU-PIHcN**A_NH0hM?Azz`2=
zv_TU&Z^#E`Ay5?5Lw(2_3)<rh8nS?D$Ux(lqw!nO_!H6ib3ZUZhC86<t@ywY4@xu8
z_5$zD4-5$bpaI7ksDf)B7!p9W6*LNXKYU<-41hr7`ItU1B!bSowt@2bKQJVMs$&Nz
zU;YC_(iH{<7HHATX8<~D713bfvj-i~3hHh{)%$|RL>THBn4l#WU(5#v$lwT6K`Hp!
zV+ICjkny#F21FPb7@$Qh-?R@5IT;KLOwa}e-~10uVW7$d8lrrwKQMt)IgG#Q15+4M
zn&R8}fk}G;=nya)NE?pt*axOCP;DgwX>##h`@p0PYFKkX<)3|E3InxmL3}|52EOkf
zn6yEu8dUJ`GBEJ7eP9X$<#VV!zt{&RZBVBK#0SZ%eqhK0MFBKd@f&|&$g2mB;6QxL
zAM$|#GHL_m$9-UcjMPB+*&i4nqcl){%Lj%+P@As;%AW`tlmT_Lq5OFt7>Yp-fQB&t
ziVqBs5gDlbrVkADB_J0CKn3=EV1NwCK>6oBFqDGwJv2@5-}t})8J2;{zxu#X3QF}b
z{eM0%K!#x;@&e2s7|J3T7?_~hR6yVZL&XOM21Zbuk&%HxK<7g}LzM^v10%G$6>#{#
zP`!YG0W@U<DwqVkJ}~)#@+~M1c^Mc4B0n(sfkv}o{PYh@;A;qB{L&B1!tk=4fkB}8
z14CU50|N^*4GA3oz|aJ0@IVu>Ku`S#reIJU!VH-HfuZRLXu}-T2Ma$iG#_DLV1Sl<
z0!KlIQ!p?vv_R$0ePDnL0YUlKKQM)XEPz%{0?$7%X@f$L3zCKeK7C+l2h}yuY$#aI
z@PVO2fq{VqTE7eOePHMTHNl`Q6hX}o43IG+hy{YquyG<NKMu5m5;XP<<u`v|=mR+b
zW<k#fhJFbK23Dw#1?PNVm;ySa92y1ng6lpoOsimEU^IamaO?xabWl<J0?NPgfeBpw
zLPJRKE@(R?0|NuJtQY+Ffhif3D?svs3=E7Opi==6`CRZnXuybpfe~6R2=RVknDvE$
zff>@st!EID03EA{Xm$%}g07!L1hJ6m2ZjYa(4Gt<1A~yq2Zn_@3=GWBX1Gu!=&W}{
zlnG^l4z5S!0-@>;49k`<Ffc)VEYuIWw*Y2eJp+T#f)5N^!NW`t9}8{yz_0>55C!EQ
z_`sBWfPsMnlp+Ng7=%uJU<w3PJ`#{P6}t0*;bI8`gEX{Y5_<Z9$qzJQ0tyjc1_q(`
z9~ib-FfcGd8z91L9~gE_VPN0}g+M*1>3{13lP{<N0o5QZ@PWw>+|`0uAT0lZN#qLy
z10%>nW(Edfy$=kK;U$Ozg`GbzC4=G|q+gJMLD>HTbeIV$pZbB}2&l4xrUBuq4-AlD
zCTRUHJOMP$gea?p7kywj3hJ+VKn>XSfdMku1m&NE4KhLbS3fWu1Jw=CG$Z`%1CszK
z*9d}q$G{-`4K%{Uz`zPEszq2KBMeL@80#58Q)D8d&>;v=QOVE1AfgN%q5$#v7#Kth
zL7To97#N}b0uhf7O#GngnIB?-NW=$*b08l=v#ChZ2Zr-03=E7Z5C@86eSnTeLHV5@
zm~t+In&qJI7i3@%ne%~31k{9*g&Mfz1G5mw2hboDS^t4q7-S)gzyAZ1ASjAJd}am)
zkqaM~g+X-(Bc$#Sx$%K12UHos_)kADiGgwnsICC1|Mr0?2sE}*4-(*IU=U^ez$6Ch
z$tXb_Aj<uLNdVM06ovAoKQJXD)n1}%AD9F{*;E`VZ}x%77gW$FK+=q;{|6=kkcDDU
z`S=e^0-(A;63Wm2z$B0Ws{dgI)PG<S@L*tIfNALezyv;CeF{{=><>%=pn?e+r=qJr
zFo}Rd1Y{vI1B2+M4@@~%K|u-$0nq~=m~=qx2~Y@uJO~;g0oA53{+$m@0y+%!4B%t0
zK?c0}z?2Ls8bJyK85l%=eqc%lHIblvF~$!}5lAB<V!|Jo1VBTDpftkFz#yjlfyt(a
zfr0%1Bm~3^KQKjr5+zK(^9QD|8w?DL4G;&4`F>#X%>mW_AO*Y(3}T@lm;^wBhI|ko
zi=}>G5&(^WfXZ@^1*IRDCLtTx`hh7K6a^stf(#5|Q$8^1fI`Fo>VRb*m~=pO3yi=0
z1CtJ@4GH5P{lKJC53&FzaOne+HYm<v{0ASHbS@zI=*<TvUr-u>rWr9%2qD#W;;bK-
zl0g%rPzQ+%eqc%lC2AO7>I0K6C=EgNi>rTNs^<rdXh7p!-24N0KR5#@2$>id#9cms
zcWyI);uypa`M{(NYQ@3~i2cBr3L2P$$!C9HOj7_A#f+elD+ck>4@_a8Tm(`t$iN`p
z_JK(o<N#2V@iH)oPyJBOqzx*$U;-;XFol6!3<`3Ph8-W6v_XjoCV%_`lNQJTkOM&m
zT>1bW+63ME4H||Mzx#oS9~6Qx554`s6eq#JzzlLA$h_Ylm|_wb7#JNOX+VOv{sR*~
z$c3ObA2S1kgzN_<eo)s*29gFObU!e~f(n)js0RBFOv#`L0%(v*gnVF124yQ4KkWlk
zGDts+U;KgbP6Gpj04M~Q7#Jj4KQNw8U|`^d@$095U|jCNz@PyWSoMK1U4enY0mk3^
zfyo9`Py|2{mBft?Og5kp0EG}Q1B1k;4@@?oYz6WmF9U-l&j%)JP%eV1mjvYsP(cM%
zFKPLK$r=`AybKKWlKvl<tdT5`O#8rOjbwpj%?BoHWD6#JV6sBCVC4rUYh(-de_*mg
zvOx0c2PP|I^WS`6vO<_&&mhJ0fyoNV0x5|POqNI%Na=rI0w2Q+^?{V@2PR7-3#6hy
zFj*p5AXW5%$r51!gH*={CQD@V=Y3!T4{Cu!sGfmAYU>9kOC%pio&LaNfo#FU4@?%w
z7X0|YWPxOXG~Wj%3nUAqRX#A8BY8mD`U4Xv+cQ8tARYLD$sA^WJud@;bovJ-b0iC-
z>pn1<BU>=#1Cu$j1*<+VnIT(n@B@=Mk_V)(e_%3$SpYKs?FS|^B=cohJ}{X<&94V#
z8yTq&OlC+H$QXQJGDWgL#{C168IlDuu^*UBkt~oY{=j64Y(dutCR3;dVDlGzU@}EE
zf7=Hp6Nvfs;Nf$biyxRwku7-rfyo5P0$J7%Og`X_3M3cE%6wq*1<jE_gH+b&1CuYv
z0nl6^>+ylf2UHt^<CuX#HvR*X52$MfQ(yXl$p_>B1yKFZ%fKMp{ej6F*@8tMn0$~e
z*ztkM2ibyiADFz6EqMBY$s5^%-yfK~!4^OqEGPJZ$qUJRIgJlY-XQbqp)QiM`@rOl
zWPx1B2PQ8h3*@ptFnJ+aAlLYT$qU(n=^vOpku6yFfyoPG0nGd(ADFz5&A;`5$<qN;
z|3iaF?&Ak0Pb3TE**`FOB3U3W`+>;=$pU$k4@{m&7RY;jVDdz=KtACElLwLq<jX%W
zc_5qL`+>=00;v9n#+m%$4@~aJ7VP@K<biC#g%3;~$QC^Nz~qi>!QT%|?no9W2!CL5
zNAiGz<_9J>B=Z#<J}|i(fa-r}5GjOxU~)&YKq2P?lN*u+3e6vw+>kAp`GLs|*@E>S
zm|T%9IQD_b4aoxvcRnz=A)Ei{1CtAQRR=T*6gfXIxgu#$l>flwiljl&^aGO%sQQJe
z_xZq-44TLTc|eeXK{4qAlMAS_f`+JK#Rn!=Bo8R|e_(P&@_^#f4@~v0NIp>94a$Qc
z%);>hBLjot;s5{tgO>j=FhKZc{{R0EYA?X}SJC9}f%Jkf(faFAEqDgf48lYkfU5r;
zNG}KztG^!22fsm@L6}$rQ1vT;SCb+16Xe(PeqeyCC=dd*n;4V?KQJ(WN<L7xh>?Lo
zN%aGhAE?>Qs0c18m25sR1%c84jPLP*$qzI`!XgNf5Bk953u^bn_z52vBSC3^K^ELd
zQp)<k6a-3RQ2BbLk`GLNpnIZNpcXWKU<wKbwd0}ui60msbLLP7F8{z74eI^E4BYU6
zF#^;mh4FWOU<v{aw?i#ZI{ty-qXB4K0IL7q2c{s9hamFx3`!qAFmNFGSefkuWAFtA
z1||=Pi<S96t5O&kxK2O}P?q_?2$_|K@{K+)MuU6|b%3(X2gYbnDu;%kvhxSV2+$}Q
zOy1`M0|!W61~d^=&%mIZ{DD!SfPq0!18QN`2c|%fkDwvKXZe8vvTg!uAt=N^6}ku{
zgp}((FfcTLd<Zg-fkC<L0|R7P4OD$EXz?-w1A_^aKm7w!5V*~#$iM)q|CLvMV9Ev+
z9IS%iNps~r9~gK+J)Z!mfyX~E1tozFYlK>O8ML^Cfq`KM)WG{67$8d*p!^RXm;yoB
zmJgC9l-GV>%09}#z{mqJUj-Dxpw20SEE9PAUxgR6mKt<G3d8^vi4Tksp!ymbWGYG@
zn0!Iy1SHNFRJ1=ZupD4u;81`#P{sHIqlEzj1DlNyIFYH?eqf9O6-+Sw?jIP9L>L&@
zWT5haADDtbnS?_TQva*Od|(O!&FLI~xERzO=Xt`wz#uCKo+?#I`oI*V0Gir|$g326
zV2nUY)hg8=n1Vpfa$!gasWg6I7M=^T0qSGW3Ib3+0^|Wf1_qU>9~gr{A<R+__3?ra
zOo8C86x4uK9~dLRi4u|~R5pKLj0UYXg!yRC2c{s<#3D2ssvP;i2q_o^APzqBfiVh{
zMqui%eP9YoMC2-!#~+x2Kt**u$VI#i3@RT#Fa?1$KogxR6SOM^O2teJ461^l!!|)?
zLqb4R`U6uCs58m|<r{xsj7AC(Rhth?lNvzj5)uNco*x)^!Ep|WGSyhfXm~w1#R)Pn
zs3v`YE{%eOh-%dbrXbKzE7XUo-5(fuLFELfDa^>gpgQLRbkPq~{jv{?VG0ZkOe~NP
zQ(gOk$q&>$hk8(T_XnmRP#O||gs|%I51<u3^$g4tpa$Iez!U^ZbTA8FeP9X#r4ktb
z*9XQZP)P?3QZ*JxfP)8+7#SGUxIQrOfbw|=#D{9)kiH=UgAll6R8#oC!~=3b5F|~h
zX@S&(>VKF9s}D>;pdf_0P|fiJV-#pS0A`{02d2PD3=9lWkRVqJ`@p~m8YSa^TA2KS
zDaaNP$7(r9X@ZG?L9Oxw!za)fkqX4aYLh-N1=VYUG(Zhp_<=D3R5rsb-1dRV4>T_b
z4MMdO9~gr{y=9mImmunyD<DCxcKZWU&J6|z)donMtG)QZzyV72B2WkZ`M?+fasbqP
zb=D6|^+BMr9BP5O$Opy<(8ME5f$Rqc9#AfjfEw@!7Ni2;AXPW`z!Ve+@&F`G)ong7
zMuMj2Vfx)ZFh(Nf8g>5<OhH;8^$-uMCw!=93IZn*r~#QDnEXHm2h2ew9~eG?ib|-D
z)w@10Mu2KRm<5wRFh+qw1je89fhia?5y=R(V8sWfAP^rKrRrOt<BFhM#mm5;zPtVd
zbp0SCPSg*5U<v{yGMEF-ffiFCx%e(<qY0v<RDbh<fftlZKn5~0FlexUU}W@QU|@z;
zRvN+|7!5)ByaZD6X~=wF@&knk)O?M4l@CmQrXUL-A)sOKfhifJ0i-~XfkDIe17jqp
zq=NcT!~FyJWHSaBKkx$sBdE5#0*NAx_z#ToIt&bqE|4^#k@kTx8kFi`>I*(FyanYl
z2Z)EmG}=Efd;(QI8z2H2^FA;Ofl@Wh0c$=mC4-7)7#|cupg}7TpO=9_<Ln0}F_1hc
z1eh5ZG_HMM3Y@TgK`!TPMn?1LHu;?95@rm=8HuKbM)65G`N`QJPJDL0o`vc3?tIQR
zMuX`>1)TR7O}2k5;0$IGN-4@Oh%ZPi$}CQfPf0DyOitY%S<Gq9&11sg91t2G5)q<j
zY`T3;9Vat0qtWyQjhr_bO{Z5iaeB!ZGbH8bm&B(OWtOEf#K*gZ`Z<Sq`uoMl>lqtP
zf6&CKF<qmXQ%D{~#>fIyrIGn`%Vth#MziUm&75k|B{@m)sd*(unW@ES>P)9EY34NJ
zH(|(4OwP#6OO1CjG&As-e!H2|SkM?vt<iM(7S4+4%Ud|D`B7~*oc^$dbK>;Lt(=b2
zpS5zT3T6}(B*qscXU6B|r^ILGrR8tuYU4B&V%#v@VFsr^<C5tUW^l@LE@5C2S7Bff
zI56E{CZ{}W3Imh+lj(P6a4NHwFfgfqna(nkQ;AJOfq_Y5!StG$oXV^Q3``muAWR1a
zCXE9SW&i_|#svs7fq_Zm0fbq=z@+hE`WKM41_mZghUqf1IF(s*7?^_JOm_h>OBk4f
zzf8{oF>4r@g8xjPGK*80vw;CT*0)!7`hi)T%8W;*Kbgg;#ul!@z^HP1y1;BsWya6b
zO=fedvDKVpU~c|3Jz+MdB0D?7VFm`#iPJk~b1E^3MND4<QXmn)z;H!)`VElSo8;+#
zW^<}By_qpxWe%qr+uJh?jH0#E1Lkllu`zoxFets8UIAjOnJ_TOicDWHhf|5q*@J-r
vG;Ycu&%nUsF#W<DPARqm2?hp@2h%^y;Zzcv@q>YZ5man}8VDc^UN#Q^r2AdA

delta 291132
zcmeyePi@66wFyd0GZ-eSD6xh9VPF=Ho#+$BWN5i@NfM(KOM{6WLxXam9HV(PLxDn(
z9-~Pz4}-!CJw}rjwp|U)^S|dLFmNa+$T6BIG9F+&DB+-x!N+Kl%(-B)1Cy8>*92Y$
z(UYwT_HQ{Dm>d`$aICzjAyuPb3{uWnu(^b35|b1|f$|kSM)P|t4KLg!o|xZbXi#wD
zV>EH%eX&`A)tH4-17`c?7)~b^A%+44CjkZ%Cx#9Mbv;HCMYf8`8+eth7z-5CL8fx8
zfC#fNKxq#JRgg073@CpBgl7E!Q$Lx9Pl<`4V6p+<eMX7N0{q&H9h+_Vg_#*|O%4z;
zXS_AJ156$eN@C(@n5-h~BqsF&<Qrur1_lmUrYLhuKE>Cs*c2w$2y63ZfMh_TuU~P0
z*t|tpkCBP3Ve=CaBPJ%shRqV<r<oZoCO?rXXEc}`BOM*OApbB!L;qX_1rA0gXJvmq
z#uxE&U(KT!JThun7fha0z+fW7z~p_%KJtab0S5oW_Kp263IW>b0t_BDEH}(2GcaWs
zv)t%!P*4JinFuqedDyT#n9L(1EqQ@EhD-Q`y!_M*W0ngU#w-uODim2>Om>jz7TwX7
zpcuffAjAL?HLGFZ@GxOHF!_PZa>f&rJ7l#PH%#6lyPGj$bAjAtM$QiHL<0r~W40Ze
zeH6@D8Ba`ZQ9UlWqpL<i10<o8!oc8R!?s~^jG7l0n*vA(loTd!Q0vT2Q~-H^!9<bW
z<5~@e6JH|3lt~Q+3@;cMxVmQ9UpJq_z{Hiv#pq+hz%jW&0VK}!!r=fDkAlFQ7xMCF
zd2EDcY9}f%WFNA>X=26f0SYV=2^I!WV7-VJE;Ny3U@(!f|8J7W>@oR)x;x{B$r>8!
zj2k8gfXNCCZOxk|QVb$5<mFX)76{CF5ihzE$`1wcLFR(o3wHh)4J9s7N0Vd*0gpLs
z8z%qIaAs`WY@^x4$aVjJ_Hp|}6GaAv$tScX3tlw8Wh-bR!B7FR{zW{G<K!G|B__el
z$rH4_881%0qb<k8tvLCQ_HNaO=C`Z_O(Yl@ASyXKLHz9F){NOFtT{PYnId1r3(cH-
zN5_syNOH1_uC(e(jyYUXCNd278fxa<1uKx3`ww<y-TnXO_ZS&W6d4jG$LOXrKA0S%
zYqa^B?gvIDcG<}<^wSwnOb#%Z#l$K)`HjJC%S!WGHWT4)jFZm=@j2L;qF%&Fo&~uk
z`;NU}_Fa2PkR{o7Y#Fof+H$^#m*AXaWX(8nvW<}xlU(lP2qQHn#)QcYM%j!fCciOS
zFSw)SfW0XPBa;^>*?8En9GJYuSekLi<`c$7j7*ZMlmD1hF-ho7t}y+~XfZj*%$ZSP
z@&>agCV9ijJm&6<9-BkV`574%CZ||DX52B^!&07c@8k^2-<mtJkJ?LeNHDo(AF)^D
zkYsYnK5Vbq-k@;fva|Gu7jc5E9L!8n?ei5nCKp($P2OZx$+%;(j<q!7-^m`<n;CaZ
z{$nl0#233+!e%p*<c{pa_KMj@>?PY96b^v&XWz6Jd=bZSbn_ECm^4VZy+Pqb_6>W%
z?3?zIFXEVWH*auMXX5>$oy5SPtib=@#De3~<|od~Oo9i&IhujV0hCf4Y}j^8{^6R&
z#N9DD!L6Th$K(%g^^CVB7r2`%J^>|XaMpjpk^|DDtkA&3J(o+$+>$Zj^)msH$tT>E
z8E;K~<8H^q?=xA)!%I!p7UVN%($9JkC;b$}?{84Z09j^|49e$h4V&k9#4*CMmI~v6
z%`9H`n3%XbHb3#HViaSG1jVQMQF~CDRN!C*#W9=V<PyJTUInjfoC+CcED<IqED@7g
z{PkHa%!)ZJCR_ODD{8!m=f7xD#jpVsl^HfH1~20IH=0y2T!8WwCZF)vmoxxnx$c<@
z0!)}0m_RZdQcRH^RxBEm1p>@LaTxH7iPdqkL0~>($K(Zp_KXFS9|Wp1c1-37@@FiV
z91*0>_;PYXkg;J!_Azj@81^J6+~8njas_$xMVxe?Lcbm($g>>GOc5N6Ol~GEOdTG#
z*g7UZ2~t<>09k8(%U&>JF-ygZcsY=+NbfuLg2(S1-~c%%Lz$&uvO(~1#=Vn&1lKc8
zm|PJO%(!&&nGh)@aY^qZb`v>Rn4(N184O;(U|s-<lkB_pjv$RDDl83?IYLj1PUzl0
zFW)4Yfr;x1m&^-!dDo0REE6Wb2n}Z}nCuXy&Db$HC#;M~SaI@`Fm1*ilLf-}Gwzst
zA^f!H)9hPzJ59tHJj`#{3z|qW3A~6CUpaY0L^tEg$u^NnO#Hr+6C%x+_<1MKh+NDl
zFxe(bn^9o0gQm#jnkaw9Ta(X3&1SqcIV1WwW9MXp7<a}KlPhA38Bb1L6O+#Pb+Slo
zKjYEOOJdELBqhv>?f-Kda|v@Rut;(nGYNCmaLHuYut-e)65l4oqzVd2P$A=e)86t$
zER*Zzo&+@(CKjE^TT+Y}QzpMiv1dHFStB){iSgy+8R@f_#4RVAWGFF-J5G+sNaGVz
z%)VnkG5e1F%onj@k(1A4lrv78?2`FTPErFBUUnZjWI$oae&O{~ZV`~!i&$aC$pKkK
zOhTEPk7Q*rGVwc3Hpn^5XfgRqjujL4jL8PMW<uOE`Wxa~&F9$ve<3elnqk8|V{%2V
zvZIElG53UwH0~K@#SBcD#@rKl)(FI0o+JMOWC<^qfCz^OQ{?OCyagbOx@zmrdLOd8
zshudmz_UXj*hHE8#N<1<+Nvjb(u4xIj&O<b)Cfg**sz|s-p0Q_!-n+)NF@g&ledWl
z_m0UrdFu5iI9Qp&d1{0LJf<<sFs<O;0oGL_6v9(16yfoQ^~Cii`TZGxSWi4VpuoT(
z&*a3jMj(opOF;5+l>CR+&$%yv++n^K<O^BZOk3^=JSzmEcsbzm6Fh3TXMp6J_c%y+
zRC3RF5ies4s$)QG?F2ps26Gz*ri>cy879W8Hzq&G6Suta`YDTzX*in(U#(DprzQ6U
z{w@Kj*H2kQKu!aBz{G<417EFBh;{-417Et32Zu0Iq=^;lkI4r4&Wt-Im*gvhVlv;E
z@xbIe`Atkrk&_b&u8ST3m1ZbylIL7MHv1I5W)wZZA<X2AD#i9=vrlm{GcVYG;6m#;
zTg2o&W%rmQayQQ@7iMDIyLm&UF|(w`i+J{v=26TZCu$UCfOC!%15<_-o5AEiHR`ek
zFXCAjUXS8%(oSSx$gtr)(BGhF!6C!slCg))V6sE4G^54jm|As3i|bJwEid9(Zkn($
zI6&2&=x<QeFmGYt$k@YXF<C%bV)C9^W5&0WKh);S-sNCniZq$Y!0{qR;wUI-n9O7l
z0MRdEB$jTjsawp*ICHW>gAtRg;pC8pXu(QQxyQlI6wblH6!9WPX5r)m4cWXCv(MSj
zG?8Q|c@ZO>IoYC7&QI3T<QM~!i6leJix_D^kS3l6fe26|EBk=`L=$la22f78EFt~(
zMU2ctko*gI=~$B^U_A*hVx(4r#7ra^KD>yLnmBn$V;_@b;bfDhaK?j^dz$o^BoZg@
zX<Ef3<2gB_Igd#ya`KI4H6|&}NiETgHz&um6f-t%zR<$X$hcwhjn=Kqu?(7%C$z~4
zaW8lgFSFEKf<xd11A~W24fle{2ioKrJ0?G93$GVY?$=`k6-?%H*fgMQUGq6?4p6qJ
z`5d+g2wU#2`5d+iDEq1T9JU!y_F3~eY&)Rrt>$ysZa~>{&F8TFfU;Z7=depa*}3L(
z*exLJD7jGcIqU%tj-0Le9QF(-Th)9HdjpisYd(h^YMJa;^EvDrAmXxj&F8S6fU=L8
z&tZQ6Wv?}#!~SEkK!-P@!sM6^WyS@Q8#<yHe@wp9AuXuzB95<BAzzQtM4W-eq>9sH
zGDoMrsfURKgTR$qj${)_1}P3^rf_g;Iga<Pc@$@cNd<#|_jP+okleNJ9LXR#^C-><
zlXE)XGj5n1(-qEmVe*zPf5sn^S-NMlHe}eaG)!L7t<R`1`AWC7sz-l=B8T@O+nXSL
zFXE&k&7-(7PTX1W03-&goII4-8YY|cs0nc;!b)3{om?I-Vz?S7=k!Q3PMF-$6U}&I
z@{=AtC2oe61qv42&0NeJDJ+s8<)9)+nIF`)=U;0s!S!RZNw2c(j^-H(9ZK)@7(v+V
zJJ$@53KK~t26G9n50guJ)dhdNkeBNPne#$kzSitJ*N(|+dev10vJczO1my(p>-K^m
zJ?1y<1<fV6C0@ky>2l9xkpv~|$v=9NRRyw-z*O37L{-Tv3sEU4Ik}<FTU8+Y08Ax{
znHDeNd2FF76(@h_i)T!j9MFH5v2wD=gf1qw#K{XL#4#~SPMY|TIfj98@{@_)j2V*+
zCQWDToqS?aIpf^P4wJ(XhI6nng+rWSH_=>z+u}t$(^81xd<!S<nY^9x>Ex0r?u-W}
z@0pS>d6a{V$p@4lO(Yl?Ako5c(L9PrV6w~9bxh)>o4-trW@N10957v-k<nsu#f;^Q
z4U-jSii=jfh-1#=kYS1hwd6pdXQIe<YqHPGY{ngvcg$SQ_;hl@EIB4V*~tyFj2X91
z-ZE=5<JHL-v$L4EODA8MoyNvxYHrC>Fxg>Fzv_k;ag2ou>-894M013i?BaO=3VIV^
z0R|2krts{`_7hEZ@VwakWsWx^<E_aK^FA|fooq6{ijCP9Y{HiL_MD(v&G|(%^VP|J
z=7%$KYz|qln^E+q`7OJN*@x|Ba<DN)nMg1wyoi>&I9X+pw{4~Q3A=;lx9pigBIYOU
zRZS!ql+1718NP^?bL8M)ih2<(w-7{|NHB1j-?R&S5iKXk!3h>GoV;dHFr&nz#brz~
znv*LQ7cogCPJXjkib<MtGRKlGJxLx=O~xV06vZLS6v83P6#4qGSO`e0e}RI9vc4W8
zSPoSCK4lS^d|-((W5DDmORAV8A}1#-4QH&FykqG)CNa;+8O!t;XH1^4?4FQ_ruh+b
zP^+^5)B=4GEyB6EW4Syd<H^Y@R-}X4N-LciFH8<uS!^2hBAUh2ghPShMKp`52`7V!
z$7AjUj>TNeJ(b!;AhyCG1_qO4`=2Hp3N9wc7#w>lbxutFvr?Jy!DNM1;+hrEOt_&X
zLHPnGQz|<%FuaJBOyqXvl2S@wSYTGn$kIJodB)^~RdP&1ijx~wi8FrOJY$s@W4*!;
zkcNqK3_gI0`Su2dTP7_`j3(^%+#JnZ%!>Saj3z7$3>+*>t{f~(UZDPv`7Jxa7t!3F
zCK3z<o@{&q$;a&kvya+2a<DN)g5;8q*i|N<va5a(&+#|=uw7w$LxKQE?nNwHDoEa>
zg@LK3&psDqmiJ`SHF5Q+CQI#qI_zQ4>2I>X&$B|H^+hZvctoUqzWr7cNd}J>u}o({
zHOq+_`}q)gwo(%*28|PQ>`P4~87g=d2t@I;3N@IpF)+M{kyGSp7McK3&of7e<3%h>
zstFgv0-gy1v&^GFRi>yR2OE<Ih!4sL=23bK9M|pT|G$V4|7gO^!SEtR<ReIuXO7Se
z5N*QA#9$u9AYsD8An+naWanguwc3HP99&FMCu)=wIJlT1I5?OhUqo|gf=aWDG=>Ha
zZl*{RDGr7gu^dw~QWz34Y8Wy&WS9auIGG|}#B$`CNHH;F)G!oq$S?&##at)vS*zy7
zp2#7{6ve>_Gm_oWql%#biLdBU#Zci<&X57B$RU9$T?=Z&dz3R2aPTliK*d5Q>#UQm
zmj%gia4?0NNH9o1WTd`=#5}4P5?;hgn|f3-G`xssiUc`)a)bK+7YqzmV6j-KzaTZB
z)<DO3+uA9280=oiOTUGLJ=0N;=TF(#F9my^8Pri1T?lfymnB2Pi&&{vFDr%w4sJb=
zZ<$0vA(3UnkOA^3$mcI&8Q*5#v0IsC0}cUakob#O#-o$Jtkbtl1!?s%hj<2JoTM#C
z%tV600L+gOGz9TMY%UqF*9>07N_?FhvtC^?(nN}Z<%PWLUy#E&B$*;Wj(QQ#@O1K=
z_0pNKpe*E4!=TdLX@8$5L!jA2l0o4`tn5vY_fPDx-wqN3v0uc>HG)#T$xa3h6DfuU
z4i+Z=7cty_O}OnD6&n~hI9Qkh6xZu9a_~b^{EKL2MiU8!hUC+Bf}YEGe@s@`pe#5y
z`>0(dBJImDP7c|i<|NDtcSIYqBV+<W7Na^s<|ot<5+HAJurT?(h~X-oyk~=y5o0AN
zCncY?6XZz{h{--<=LzN?v1{~<<YNHku<Sc_j-cF^eA=%0MZCP=WR8vTsvCJ41VH^g
zg~<&Q*g*Zh7qL=}pagMZkKzgt{UTP{aB|N^WyXz@H*Ab%oH?0ilRD$d$tIih8EYq}
zY)WT*JNe8e>-y3w2W0G94k!pHWiT+jke9t`!p6X7mL_uWMJ)SCP{zAFNBVzzgZ)uZ
zCVdgdcGKjT{r{c=_Ip7E>I-?<QjmI+oeT~yVkGaHNHOrekeBrZiM^1Qo$7tdZs7}g
z*|i+ZOffIw*>l0}l9xTo(;?8}Qp2Fo-7&dsv!)}s?Qmj_5*H}oUc`!>G-+o@0JV!>
z#7MkVcHm$znaPmxB1Yn>i4=nn2Rl>bix`Q$CQ{(C48&eK`NL*;#?;9ITckyInk;2t
z=~!m}6l51vE$d{5Ez+uIP1x;0V^MyJ`Fe~TywLcLl5z#d_i;Nx&on-c$qifN1s`S~
zL5^=x&&eCMh%-K&d}50_qvGTbTjZD|c_#~OHD+8pdCpQPDL#o8al)aX=CnfvLlLM?
z;84j>@FGs2bn=CzQcMz-liw^gnS5fabiJjC6hpy@8bv0LWef?RLf2s_Lk74?i4xZZ
zc|Ie7!N5eup8LXd=^s2bLJS<NOc5qh3=0xc88Q-57_vaMm$@aM#fvz>y%}i?2@b^!
zSq|k48730;|3M{S_GSB-FXF{cg3Ovc2Q(&W{~y$^^ge3O>3w8!);3eYm*!D?Ga&5@
ziHqh@d?zMv*jCQyIay=-<a$p~goD~4CXx&ZFJhQJg7_CDq<)x4GFZKcVFd*rs3Hdq
z^QF9qVcH0i_q@Yk(ch$Cabbq!2NOw9LSSkHiC>fe^IcxVFeQTcV0A5u98h&0FJhPs
zLE=z#J}+W~n7|zs&;W^vBtyW97@>)ieRkMM2?_Et2t>6!P*4C%?PTBp@n6IUKAgN{
z$MM9ypz7yEjI=GtG^GRv#_q|whd@4rwW?mkG6aHJRLKYI1TQa@{$YO8PVhwx_eW3?
zYFVHlWx~q%&-s>}V7IHH0$46i%oUWpL3Oc%D%+09XLkDA#+q9)IGEgID0mUW<7y(s
z$Y64l;lPU+9^LEl5=x-PzEUd#gZCVMhZhVCE3&WHMVd!3FkOz4{_!G)t8;S1E_X(Y
z$qRPrGcKHbVV4*aZ|>w5yUdt)EGH}MwqoM7oE)=TN{mM{`>>s&$u0(m7tuU|V3$Pm
z+??FAyS+XW)EMf`QHlUnJ|+?djG&|q5_=KDb<#w@fYF49fysoIfdM2AjwueNC=Nj;
zka~ZJ7*{1oed_|H3=Uo<Pm`aZ`jcfRNDP{KydYv+nqV=AJXjA07a!Ols3y*rlNapC
zXM8(ZU~fL7=H!OG$-HYpBd#F)B8EY7@`t_RjJ}gO_PO(_X5X<Z^uB3V_##@`b#lx;
zW5&?Q6ZUC}$1q5ORGV5dNPs*9V!w!%|2p}?K6S>WlYi_}XZ$%?VLxa{&0~K*<I~AE
z_RA|;noHO}1UDg~WqWxO1fsxImJE|Gi2Wjl>E~pL1NMxulOqm9E9!zwG__<f0MRd^
zWq3ihWZ$t1G__=~co8lAcJh@2#hP!;Z`m1g$S^r`$TGRSh>|}GDtTW-$=5=~Jvn5V
zyk11f$4)LdD6JZ69>vcA%4DEHgcmU!Gr>tD9o$F`^)O~>@GxQN*u3GO6Qi4Cu89;I
z!-*QJtDqJcPl5m_)3CjW5nXB`$-u!=A<*2CU^Nxg&ohx^sCf}1S_)G0LSB9?h~`NU
zaCs3e*gM(cuo@E|>*R#P-HcBszd0<;xOOtf5hak2&Jj>~=X0c(F=6t7BjT*J=283}
zlkXh)#l$W-`NmOu#+{QTj;S-&PIfqE&G>P0&9QdJo!-qH4xqtsaH<B4?lyqtCm4-h
zM9G88p3`#{IGBiYR45DRF`7s+sF_PJLi!`I;%m*L_;*ZpIj$roFYA5FUJ_C#fU_g0
zrT%qt&G9%fJH{8WV!7r~pk54^9cmuMU@`f_@oLpu*+=Xxvk%z41lbLmgW$Dcm;*AT
zzd>OZsQY4~%yw(?gcII^8+h(8u$V|Ngg{C~!NkpPPD}=kA~c)=Wt|PD{xja3yy5gc
zCZ58{6VB){@d!>naOOSlSq^3<4^JKrhZj+Tb0_aPTf`^G%fZ7Gbvj1D!9<)>X|l~Z
zIVnyhWdS*;*Z2xR1;mS3PG7LsO3rQ9)c}nE_s1)8fF@m({Xt$}Uuz!4XyK8}rtu<L
zAQV)nf*lL$XT5Q^sDJ&4VGbw}wA3p!C^sBnFrUM)u6fV=uMo{_XU(G+PrQg1;038M
zkz~K{`U&R*5E~>9>X*ETWotE$V$66UFLxDeiM;%G&>RS8{sS}s1)Ac@K4PDleb~OR
zd6t8~^;sOrFXH8NL1t*D3$QYnfM&TwE@(6Eoa}JHJk!=Zitzzx%n4Mmd02AqcoECm
z3sMXkQ~?Dl$l@2VEN{)Dm;_8D8JJ$k%Wnl0W&9oj%}}|m=21)@FXBWiLB2gvqhJ6s
zkAs;h5-MM69>r8K`N0Kw#|<xHBn=h%?HFG~F$kK>VtN4SG_oK%jWd`YfW|3a#E4g#
zNHK7{ke6cxx#C4E^H%dHW`@ZQ7u6X9CudyrXS_Oj$3=P0TJtDogBP)!GbcZ|7|(kb
z<Z@7gF;Qf@FxltQb=g}cR&2M@64+;$NH9sfh?KbsN+ggN;rKS$;j$5vOz7m2%gXhw
zpvw3~te_;wh!>HvXF)XBDbXxbL4ji;$++c3G)pa%z2-$UOR9+!V}pq#<BAv2EWRM|
z7x7$)V142Y44^s@8~`!go#s)@2Ow;&o#s)@A3$sl879{kF<djvqgXUr7EBhqV#}C0
zIpm5y<Ic$~SBzEnnn$rDC<o{<f(n}#krH#wqc|Rb^ntqV=20vKFCryMC*Qf^&3JIK
z##L?31fCiprWcXorITZ>O4ld6h~rS?ILgHe>eg|{FuC#62yrL|=rO*C6lXP!;&@=*
z!NAnZ<X~YU!vJbAM1gt~rjZ;EUc|9)1T~*IS-Ds_*qCB?YJ|8<Wb7|0`r9$`)ClpI
zf^8P7<w+3Y!)^vk!HYO1cFoB@uF5fq^G=qy=FJ-js!hPn?HHlX$pzP>>jTYi*=}^c
zY`dF#GK+BXW!v4*v^%4}0XzfZtlV|_h4*FKiRN?E_I1@LY=Gz%d}w~lc4B{n!USb~
zJ5ZyW%iNNs<3*&%QjmH54GIY+JMAC7h!LC!;zOs7tX{+jfu{1JPSq$VINz|HZGO|v
zcH)aTmY*ELOi>v%EHhq2GsJ?1r7zEs|Iy!&*#wTtXa-aBleQB<jqexH46>l;0;kAm
z2G+?Q*Ta~E1tu@JE-u;tif_<l7O02^Pi8$5(3pJYI;au-;kuZXur6o}LfJr%5fpjm
zmK+aW#EO12k75Cj7lU$%hbqgA7g79)lMQazF$vaAF1WEg@~3$e%L!;(<OE3Lix@^p
z^C;E=P&jcgGWllMvVn(+Jv6uzOgZd-PGnI3`GSFM(~Bs%k02Mlh?9rVF-(pi?|@TL
z43p;Mf}6&cJD?%M^&(d8DM&S_V1wGm^degRt$7s34-Q$Q*cS{8Ns|{Su)JW9WO@<B
zesl7jo67Z?=25I*$2-`toS58T!1RJa+Nr(8dI302q!>8NE!if#h+%uFutAT}gqeZC
zgpGm2WGQ2Xi8uoXsEEiuW<N3esQpY(OO->MDe^@Ot0riYsi(kxKS&K|c=JURQ=mx|
zgGc*(1tpVm2G9T}sE~+!5z8c9I=SJNwdqR}De%BE!;2`Ui=bEn1&xCZo5y5uCB?Al
zMGS8z$a9k$%t2k-rWY|>hLb<sl49ajoy>Dv-&8<Z12kU1@lZM900XE<a4_ch0ZNYv
z#vDIDMVN;&w?R)rf)}V;aUogy1E`vxTyR^Q@#W->+g@5S2Ilu{8(+u^m71`E4e|up
z_Cj8${zWAJQxho$IdGsyi_M(;=k_8dw#LZ|?ikmDhp0~Mu{h7mA<*$6hRxGNioxJS
zjdFmA1cL#naC#BR=?e-ao(!Q0CNc~xpq5oa4THjq7#7QnR0a)?Dh3S`N&EjVqQw82
zN1^cVf(I%jnHXNgusU)`GDVq4f%LI9a>y`wwK^zuaL7y!x+@{XkqYX<!$;U6Ib0{#
z+?8hhI(f!j`}(=&Q4AR%OF$|9MU-$YXxPL=n1ul(##O__4&uLv60-$mYLM8AC}C5u
zSd5^li4;Q$69dN{(0q!=Ep`de@(=DPu36WkI22z$7W4sy5J(UATrO^KZ4xEA);x+q
z03`MzN@%HhR6T>hi8~4npz#WjL7X)#GW`wlN1+N*K^B47CXy_mVHu7WQKGusHcXNr
zu@_N7sv!9n@}j<=(1nPJyfu$vZ~&PH<)1Z=Vh8{Q0I1@>uuA$9NF3Bidl4lv)m%7=
z!N4@iE|xorD+=Oj$uE;%+>@`@Rh*#5$mzv(>-A&NGbVftTwraoOp!05gh8uP8bExo
z^-%&(O?!A|fcPeojCmk2ZgsG_r6vLlJRot9*o!EEsV0I9Oi=!W7f}MGCPD(>a0W#f
zIC(}1+nPr)EKs)4I{zP}@I{octa%i}jEhkcKVHP}se+tnBEjGR@*k+6c@fEcck+h&
z;+ziI2W=<5h~!Y6eBr*lsG*4zgT;wGN;6C(7%U*EjM;QD%L8x5y^{kTI5V0~p7KDQ
z(R1>i2VPR5g2@N$EKmGVsNz{6Ftc4jK>$>hy@+9HoUHKBSaB;TuQ}E*D1m156G8M1
zyU2t+3`QW;FJhQ)PA++<FMBinl3i+hgF=V%WjlS448j~{$H@mCb~9>D_IYH-B*Zzn
z=aIDR(aTZNA5Q+U{p)?jZescsyIKx@rU-LTCm=>}=Hw%f)-zgeE_rOt$arw_h9|~?
zk?9BQQb9_<UWt~uJNe6#V!=R==xLiBV9hV0rLRt|c&fz2B071_Q)S7$*A-;uy@+AG
z2nt1yYz7U}ECz=cQOu>2Z#?y{e`{LB-~o~W_Y0#~L1`oc%x42d94jc1a`Zef=;cWj
zYIq?ppbL@%5Bx|$+pf_fPtBuP7r;tUP}T>R+tF;f=25H{dJ+@_IAobz74q#EO_G^A
zKm|Xj)O`^n@zgx3p6dfdqi_dQ6RUX?>yH=FOpc&xrDwldEvR$@7343XnIsi1Kx&g0
zF%r4vQJ`f-3=9hI?HE0jxfg)SB9mnMn<iZLH%+)1TuhGf1eiQ$3*gAoXn4WEaO*`R
zZ!Rbowl^pUf$fSBe`?Mi#g_0QnqlH(o#)PsPbL>USJD#!jaNopl$8I$A;S~_?i0m`
z-8EUtz~qt4pz%UpZYjtXkgGgwST;;P@LY~bx^?n{=T1z#nUhss*fEK@PEL7I#v~d#
z`OXVt#=nyVUM9<$CLgsuX@1?VF#EV&q4^EF$m|pLGr=Q(k-~2$Pk5=#SUY*o%T-Lw
zQzvJ<YG>R!`NJz~#toBoUK=xhn4IuhobkZqir3+cTP9z4ZO=GivcMZVCQ*UO0dFQV
zE}i`3jW*+j$pUZ9n4~Qxd%Ufd^=O|r!<FL>*JPd*0#iVVm9GR8cM`G*pi1JwTkZM_
zpm~ZHF<h*mwjZY#lh+G*`S;M)bVK%GyO$hNOwQRS><(rhw>z1A%<f|LQM;SjN9-PY
zdoWnMh!nUADw|L20ri16qmcSQ8jzUf3<Y%*Uc?Cqf&$zlg~6bwO;LcSLZJOc9Iq}1
zYdupGv?7jr5h*AOG7QSM0<{-FmB5P_p}Xdmj2aUf3|L+;Fua=3puqNmfia6GL!gBx
zL7)vZeDNZVXDZJ#p@#MbWew#9ent)!CTET#Tx_6rwn+>7iiR|0Bc22SNe&jKsLPh}
zKVHOesDi577xnV;$0sy^YIlaF7jZniAj6;zka`ix{}<$-_6EDRAjg0#d=bev7b2$g
zh$lf{=8HH%@aXdk2Brd@KSB*X4R*aIGCU6a4FYqH?}@7g>3b2!^%rDrbBkRpln+|F
z6$PrK>t8T1uj*-P5HOKpP~eyYN}tSKJQ)IWvhUbU)J`-2EstaIP-6?2&|tu1BE!Iz
ze8+B~2WaT1L4iZLgMlIA4g;tGtI#n=iGwFWV6w{{1{V`4aPK<u^<&-#pgaXyA8>hx
z^al<Jrl{8snPR|Eaf`v?@>1z~&<qqvA-IPHYKd^{-O&Kbr7xUVGI$CEW`QT8?$~Y2
zzH7HL`<UI#7qLPw(~sIMb-!h|6qLig@7T@kX;A#(K7+x9LxL&t^+QH*?~doMP(w?C
zf`^HW{cq5$wf7;r$W9pr4dsS@cK!~5$;uOWcbLza-1R}Y{)F8@@8fnSy^q;l^ge2L
z(;Jk!4%@v1Eon5rXV(Z?oCONM_6Ga;ptd?B+<ACGk@-SiJ{J`3Z3zlVAg^~%Zs6jn
z5o+L&VG0HXQ}g5naQ>wl>93$L2dyrAAurErB4huSr$At8{iQw9U;7*EuY%gbE>{>_
zz)MUXa|eLJ2|Vc~%j60b1Fv~`AuqcZ6fB^yec{B!017tHnET~DTytAG>_S0~1VuC?
z_44|HQtu0SIaL!G`@f*91(GwjWVn!jjG=);ifQuUj}oDG`6C3HUqo{L1^J3Y#>nLb
z1LLa~acsUIKGfAlCY$a5wq-PAfDBUZw_^lNr1MW!nDe^f0Mm;&wos7T{s#N4AayU|
z*w#)q_@t!<5k9eJp#Z2s2X10na!z;=%h%~~i$MWgn8&eBo!szAON!N&CqbyeM3{jI
zWD+PJm<TiQy@+FNoqXhzGi$54CBuTr2A?Il?=dvIh~cs|w`9neZ15Shh{NZzyyRZ~
z2!Xa2k!;}9%^_pt`htPs6lm?-<d)A`Ow6W}H+=RM<j6n5(7+!d(2{-FzVk&4N9|;u
zFWHJOwCm6RH&Nuc!DFM)>XFW1;E}<g(KA8uf=3#t`NkAGdBzvzdWjb?vW(fs?Pu~N
z2+RSM+@M0sJc?rjPlmvBo&tdxFJfd4@>B@SG?8I2;g~a{;ROTZtd^!m&;kwvj|v70
z6JbUVa~b>p&68&)AlW$6qlQ5Nw9E-)rg;?S0goC64UpL{Vq_FO${7qG_SM@lf&|T@
zxC#&!N<V~H2+8y94T=)r;SzC?Q!f}e70f00A1JK1V|*bmCu*{k{RSx3UdYSon$KYe
zO*d*a%$au`<S+$LUrv$h0*{J9;|qlYOeQV%e;ek^n~#v=Zs3``_bZ<-$S?mI=FHDG
zX|ZQCX|Zo?nKIARM2637N(+M>V~T{s0hxR9AZ;%gm_P~TzljW^TgM#R?;tUc8U};@
z1|<V+=z`tJHs87}e}H@q^4N<QNlo)8P63_;LZEu`0Vo}JPqvE%wJ=O%7&v(L2zBu6
z5o+M65SZ~ILiFjR@A9S}K)nVNHiiZVb&g*k<1ajy|6#()l)&-KqQQifWkY+DLINl<
zCpQ>yykKC60;S!_f4-{lzmS*P%gZX%!0>=$*NaHG$?4w}bW?d{gc?95UMt~fF;U@U
z;F`=L-0@67gJUw+Wv^nE6@3W`N+vS)-(Sef@lM|I-Pmv=sApm#!_d(2M?nB&+zWZx
z+KdL46))svb2A#4BD5127(njwP~n)--ZxKovcwOwdfB5Ozj+ihD6}OhSb!{SOHqh0
z5n*WPOR()Vk+J{jF^8exg}h8F$iF5s3`!2h9KR+d7&Ms3FgU!Bmk9-lgTyWs%m3&q
zu?6MrpP<#$VEG6^Q&0v1sWG1c&P<UnB7|ajDg<V|ke4}YQZK{6;8DV$;4zsYqHD6v
zS`!)jn=j<0*JdOzXn-7JBFxa>V8ihX)EV!dtRUnuhoRzyymT(eK<xwth8Oa3M?Gvf
zCV-+5lv_P)*d|<_BYmH%hG`B&%)T|lhHZw&9EJw28YY<+@^Y!y=gZiG!lAuE!9fAk
ze(7(q-Vch57ZIGS;F3;8Ddq(O!>$+dQgbJJ{Pfk1W#9yfzmS)@3kt0l^75w24UB(4
zhV(aBZ3pRPc)+pbMWkfl<O4sY+~gQd#CaE)OYmO+je|n!f1ylp{U0j{9)0sDX3*eE
z0kuFRW%+7^Iy@>F4Ehx;--1>rf}Hdsf?syB!Y@50iQdTpzoZ#$C+GZ<Hg^CO=H_!4
z3c9D-p9Oml6nv(jHlG0lXeoL3)C4C`oV}2j*bADr>F=;uZXz>z-!ECq861pE!Jvi@
zXpM}CB11uYPx}kd5^<gxpn{J1A5VtBl&;A$L``JuziKeZF`8I%bG(R=6`d^dTb=g@
z$p4^9@I{Qw+Q}Zj^`yjgK|#UOAk^St!&bmEN2r5mj?jb`@?yM`C;XN&GCK|m6_6V}
zOxPm$8U&{BPZpZNKSij4e=<m!=v4m6Lg3}{9>#1DFXScnPQLS7zg`ri3KXvG9aEoz
z0!gXgj?ruiPY2%|g(<HZ4lsdooQVhv1Gg}jXw#OdOF>l^XyLnwC9?-tB^Rjcr|=?1
zYAVRRFXTl^K?w;>k1b4(M<s&-Xt6vfwQ^N)Nxg`y7n=yx$O_U3ambXbAcsK8C7umD
zHjr`&)zB$ZA%+ToQsi3`OMVYD`B0cV$kG?`@}eeI{2nGUEDSH?g?0IAgc`IH1sF`~
zC0H0h5-%b+O+jVN3wfchP={!M>0$<hz69f~;BYl&E9joQX{!b|AESvP14DyNgM<cX
zjRu&#xf~QdN(p?-;5D(6JLZ4}|6a%o`-0L1$YcFY#`>T*0+sOn4aVZ2?E!JH78_`6
z9ah&uiX}nt@Cm4Z1ow_(xE_L*lf8%*Vl|Ose(@rL{Us#igjzusqvze`$wuKOGLs+u
zHK-SS%OTGc16Clyzy!+N9;FNhlN$^gOhg#i+LlaQ4{}xC0tEq(%U;L}%mt;IzC{Y)
z4HF*5Y!kR9GYP+t7s%zGEY!d?he_u06zTtM4GIbwHf$3hRgOT)3wg1l<`Vn|816_o
zfC>dr;Rh-hJd#a0W@PPQ$ao>o|2Ct9K?5Y=VazcDRGOG5a!7O~8h}cnzn~U+OOwI}
zk2D62mKMbYCK3!xJq-r6px}EECFlw&!cOd2AOOm-FXRPWL1i(h1bz|0nmhT!Kc{-W
ztvq*x!2NiSDh7oUd-U5uN_Z*+CWB&xr&wr)#})>KrjqsGqyZU!VPtp_!2(*w!oX7@
zFo$Cg*BtLT3>rLlgc@E%@(1!P5SRsOiYPRKX4-kb@*ENB0Ig|z5hXkmWXI__dZ2Rb
zJO2cM$=;JU{+F%it>w8RGy|Gi650~<d_l1civ9KmoAaRX?Qhak2Zgss4TAz-g20sP
zb2#NMO_Bc3HHRtYMI5ImC~3Zs=XncGeH9D_{S3N$IV6}OJyIAnUPK91LhRL@5Aqv-
zgTQ3|2?BF?CJQz2cL>aRQ7_L^3o02v7G7_VweN4zcn_+4U&!-<GU0!acz;WeImqxA
z^1Ps;=kJR+zD7_=0?Re%JOw!(w4<gkLFXzY4;e5hH7hW97_)8gC}mLKn#?8AwMAzx
zxDZfe_W<pP>2FXF0;zR)A<t6^im<LZ_Ge8L88|>bR%&5j;F=8D@x$MnRihvYu}FPC
z#9=(V@DQ5Q{dVdPM)`X1GMN_)jG*2H3)nd}Y&+T;v}-|G_5}kYhldS6e9J?7gSIb7
z+{1$30aUVHm*8jt@j=Pug}i{Oi6swssP+W|!we4_&Kr>QDiriWUZB@pf*(9=`a+&<
zuDK=q4Nw~BZ(uUYpFV?;QJ!}ysQd->h+fEZ=1xDt$mk`+Q3>jcgYpvh9InYG%A5?-
z6_^;s8GlW;U}97^WCEKGo{Hn|fK)?_nviOU9lWUOg}nUS>?xpizzjc4XR*$hK7ol*
zT=1Y`z8z?O*vo{2fx%Rl<Ja^ZOpNY~g4388l||2j+DD!I_U60`1Y|&ZUPQ|;oo>O*
zn9O*0`W$9PdC9q872fvtAQdm7<!V8y9Bnv$O~1m-7|eMTBn{>ourNA%>VmkSV#Q-8
zgNAt&--8#?vfx@6+(s8>VB!%Fn3G}5rJxPk<6+Fg0LncX#w-kw;)yZK!<dDkFTwup
zWCvr1>3>)lqw7;WDi|k#jN~a0nE66p&eS}L-@?O&g`pkPRRm4U$;*F#5iKoh9>pK<
zB90{xl-@wtM1}`k$bh;g=J%Kyvd`Hq%sypzF#Dw4$?Ow$7qgGqJ<Psj*O-0Lt~2|B
z-Nfwkb~Cfj+O5n!W4AH;wB63^<90W*kJj70%syiGG5fIHPyPmhb`u#M2~a0^@*Hr#
zl_|r9Z3QS5aWFD@Bq*@$0N1rP+#H~S$i$e#07PfiFa(&Wv0nhOGwv`1nCP(=fY_NJ
zwkEp(m~F!lV4}sgAv1;{0F-7KYa|>P6Fe4jOb=vZ6chagvIA7+gPK1eHmG!*Uc<(y
zRL{bol)wkxN@60zBLH$6XvUIz@{R@$VWyZ28#dU)LJVj`$3&6ME4z_J0vsPQ3=G+G
z*c(6_2b3H7|7X~6-T;Z4Pi8ogVa$2Kd=A3}4n`&)kXVKd=Lrr*rXUj;9uJWHAbT=w
z*g80v8JS$CE3h-V*Q<5!Y|u~+;A7;FWr{G5VmR<3T3i$q5unx=Nc=^V5NLuk;l!K;
z9H0pWa~1vt=9c^mUPK5dg4&hs4GI;Yf?L^u4>Zyd^&&#p(A<)-<MbSz3Q!oCh)Xem
z@_@Mne*`G~gPLP6qQ!h6d4NflbNU^2M)P`Kkoz)ca)RBSVa~Pz#5XHuY{;->YXGr9
z1$%})8`#XuD+~@Cj7)wR#-L^=1A~bb=Yy;Ws9z-*6f#X195SvkIAn%0I3zN#?RXI(
z6q#AWc>~l(Hj!XrfcT3^*F1`G0yvy(>p2gABtaH|Buy;XGG0V6zBP|xJOC5Ruw_f&
zU}SQE43i6dHIHKaaeB@Iri?jk3Cb-B44yOCHh}bU&)||Uk7Ckz5yhB$SzJaQq#x9f
z$gpLL0Lj0I5~wwgVhR9@3-dUDig)FDPz*3Kd1ffEop=$&?`j^!RB+;sLKZkw*_fhU
zL<ne_TQYU@Hz;s`QdFi5+X;jm|3`C6CeTzJNR9<02eJ@i8UIrAC?;@dX4tSD@Z7@z
zYK6La&t!0b%BPw~F`Z!Y+&sOHlTlVw)jW#n!D$->NLsVvVt5h3zjOKlPDW94W9}8)
z#w`3VV&o-3L%rPnT*9EG-RurR4eSm~4dzh{3Qbk>!Bf6$2|^7F3@i*D#cT!BdAJx|
zINIuFoi!1cnl*h67o)8DX10#(ISdoBCo{|dbs4fJGc53!!<GQ5SwSrdQ1b<>^#K>7
zwDkn-%J=_Gl=&xsDoBu$7Yr<~UPMXmRCZu+05`o<7#P6KE>#8wj#d`d3wvbbFVB(w
z!m($%6*r?)y~iE41Ll+M|M#UefU_+q05d>hbL{_nn6j=g(Pv%3`$u6~h8gP$&Ocmp
zI2f4%_@@drm|wJ==%L2C!bFsTf%mJzG`@2Jk{s7|G;oM9x$zwlh~hgS5W_u-MGCY^
z==B3`o$RZ2mF7Db6tb_`WrBvcUPN&m&Awq*U+8@Uyn-h4MU3=HP>^|FwX5WiVT$K6
z<(gx*m4T^mg}p8Re4z%AMSP|TbNKrNB>7teqWBvG!nkh1Ea1ukTd<cw0n}2-zH65W
z%Cj$Gq(M{CksvcUzjDptZxd<&nQ3y2!Or`xT_*RkdM>uU752VY4#-G*$*`{An8PBH
zQNp0W`$AwU_f!@U{wYEecz*~?=KUZrg?kE%824lr8NO{o6O`_p|Ifk96v{V8XoATe
z`~M~)44`GQ2FerU7`^8(zTlX{B9l?W&;jLtfbus$`9Gli24!}z1}28-XLuMTrI*_O
zhNxiTfU1}P<qJ&XWt3!I%*8rghL=&Qo=E~KzXB?+0Ojw1@-?9R15myJl>fr)8ix>v
z2vbbM)`gpR_6RwFiy?D14UaMgNE=^~M<VMX1GqRhv1Ef3`-*H5{EDFNkN|^;1rLLE
zeF6gm*I_O(6Dzg_u<cf$gac|xWZ3Y4S|SYD%{&~AGHg4b^<dYF2+m4S+3C5NV+N=(
z1S-EkY1u@T-GgV3!qmP6_U}RcKfVNkmYxR1MJB=wdfk(o6hP&pi8$MY7xKbO%_aC1
zK+XH<6<myRY{FNS7V|MrFW_TzuU~66g@Nh%91ca$l8?)Cq(8if5CKmeypWg61zD-=
zz|Z(1LU64@3Il^@3)_Yl5rR`WQn;i{s+bsFL<rV$yKqT?#(qF*`7#8i@U;nuT$&>N
zyKUAyb+clI0;LObjAqxEEcmV{OnY_U08`cyc7+R5r2qFd*giKau4gFV*uw=GxNiY<
zn`QTcG=T!w!-f?!+Wo;qhR1@xL7+K9g|)$R4%>$Q289El9oH`+1X`7y6c}Da2$X^s
z!$%0DDm#Pup~{X7AaPe^CopZQ?83kR!Y?8OWX+?P7?fSX;;bC?3``E5XE-K+(jf;A
zQ!s}JQ|Jo@h6?2!{r|aYxP-k*6eN}Ej^8yaHmz-%Y`+$y7Ho;Ud@XkjmsHbz`x)kQ
z7&!PF1m^cYum_h@AP?{*2u$lcV1Jf_l_{oan<9gWINJ}t4FYqND*FF}3L{Vi_ctg=
z)GNK{|L<AOd4ubZMT63p{{MVC1SW%guRNpwKi3}?nagvea`<Y5_>^v}|9^c7N3w}A
z3j^0278#Hl&N*CnKs`jRZ!BUa@(fH3^$i{zGE7br5)>G=B(wiF;bm~(YUX0@$aRb`
z5ob35rHB{ue0R+y_&#umGP#<_G6W~^tPt4AvqE4OPo&U_^&8{w@<a)(;M*WDm+Ly0
z1pf@72L1&CGffm39QZ1YcJQwdn90G&<YfMzfr+nDsDpolz+BL<1z)Yu1il>tbNMQS
z8nP!(pCrJjRiE8xzY?^Pm7|J93RH1$&f>cDB7#v6G%3-MYk%~*Ge@%L9gYbm!VC=N
zQ+OxvHwa8^TcDuDKS5w>_GE?((C*0W28IB>4FXfMr!pvj?CF|gza69wT+4|tFnE}<
zDS&p&g84R#2S7~}(1bSE)Qo!2_@38`2%c6GW*&j-^CduY2Q!;(8o<@1i3EefWlPDD
z7xLUk&7+t>(KoH_fC3lHVo;`dAupc`vh+n1vmq$|fksF{?WPPHmI<CUoHro(lk?Gw
zSUzw=(~*O1hjt<Z!$l7HA0Eo}+zG7=3I{+d!NHkZfgjYk@CLC>B$z?__kB&QcpP4Y
z%Y6lf4k$w_9bio6U||9+Cky6~VG1!_$m3ul&tPPBjX};t*8acJ5Bb}Dl}al>1+m#y
z`~RR?E3=f}!9;>30c6IDaJg91S&RoV4zMY-)-!<XbkMAe2&mLB(dKT*zGIgNW*cx#
z0MmvX0uvHIOG=m?O=JKaKEM|AB8KNC$hR*dcvLSu1I;7xszUgZJ3%Y^Pt+&`n1I&Q
zM~Pnqjs7bo@ZSaP#`W0D5YbU=|K4ONLqWzKhJ<?1=>nNC3=W<)Y$w{A)K8(#iZJkW
z)u>MbC1TL(2XN!UlEc76g5ki6NcKh(DRu|2oCKqTi6#35(Ds5Ck?esA1$>O4kOK7q
zvga@;fYzwIh?Y-O)VE^<1wCk$v55s2s3}&@XdcD9;YGB(CTMUP+$xEd7c`Gz=>V}6
z`Ry3Zqu4TDM9aMdEqZ#vz%F5u%)WqYKWKi6!3fl$Fp*&}$gJUa0OcAJalv;l<T-TB
zCHPM8B?!dum<cspo+I6SeGZ3{Qw4*GxrF_HZW*Q+9$TRa*XM9caLuV_is8!;n9O4%
z)B#FNpraFb%!OuNnj-zztl0kN3wfDbP{IEqTrL;1w6lM{f`Z3cHU$%L)+HbdU&ynE
znoICa;9z0$G2vrS;NWA5d=V+~6RftW!GJ@C$^Y^k>Hm;K$Pm=qpuok!&*XEpK}O#6
z90QX{y)c7U=Vkk;AdN}~`0sL^;o@(7VDD-o&bo<nEmsVe4A-2iy&TD$Ygj}%wsKwN
z+aomLdN0RPE*mZxP*C#i5t_ldmTL;AFMDkYM+@J2p$5(pF21Y<3<@R^3=8<y33Y%H
z9S0v%RMujKh^##f0WZQOQ?u4GWbmF4m{WhfK}MDLj!=hE6ZnJ*W3wp+4!n1S1bD9q
zIe>g_BFn_Udq*h7rJO;d>#u@<i72B8?;Rl#6H!JE&NVC|oNKw}T%W_y!rjd!!#`Ds
zjbjVfInW*#-U|XfAd6pwOZ0+Pa`N^IHE{5Q8neu`ybVGfyf*~;uFv7DUuz=4;J^!N
zW=JwHya<;t1-aBjf`P|GlJVb*a0yY<TMSIR2ZXr1uh}K?UK8Rl-ORuQ+Gzob*Nn?-
z3cPoOc%b~heMJreymy57UdYQFH4$h1z>^`+{6b!`7nHqUL<mnbk>X=GQDZsRM1ldd
z=Yr!!6d(UZP+WntN~GY#=?6p^#p@G6LZE2tZ%~K;NtsA8XuOCNGz5wF&uaiJ4N?G$
zMe!d5<*w6n7Hr^PWeNtVeGw_}5Tp*Op93TYQ7f<#q!yGDLDP_+-1s6=pcACFf8Kmv
zkQ$KM7f}NI;0+b0=h!_3339MbPZMJ_s)y7?=4-*(Twc5%6g!|C3CV#B2TUy43tmLX
zzeUcKFXSasO)S|3CNxYCdcnZt)Y72jVJgYL!DKuC4h|Nk2#|wbM2jB;ZBv0(;Bz|W
z?4JwDd@rKKCz?lbfF~tPWEglG94t6~U6zpl(JiBRVY-4iqe#73B<BNIANKMb$&&0l
z_Kl#4CD5c&_8t39<q3R@=5shLKr>pP`3R7)pz($m(P9V9qd34LF&;MD3qZ##fGY<v
z2GGEg2L~gQr}-TFn;<a`VWv<I9X3$0?7_jq6v83K6mKGKf0KK<2DtLr1ga1+P1!s+
zM45uyA1H8Tim*9wh%ou^B?!ovh%j<APic5@d5ZjxzJ|mC^EvhhFVB(w(cjcq04k+k
zFfiOONoG(0O{AJyvVV9XFT2$=oc{!9)WYmL{|o*Gfw_|xfTsBwwE7wpxcEB+rhuw&
z(6HbO`RQg7jQrLM?5~5k{2c;QL5(vLF$N|R5k{`=DfYS`D?k`@R*O>>LxfW{LzIay
zBL{DTfK2n`hJxu05{$m}ybPfI7)&oB<tjaQu{U_`;s8xF_`Qgfiv(?R$v$V_n0?2-
z(s2$$6bCm`IB3~CC~zI;Fo5DO5*nxz&7(LyUPKEQf;Q87+OT<;h%g*$xT3%TnzZl~
z2CYyuV8}3L3utdpFaQlWI8SDX02LwAeIyy>6{ng=u`g(E0FCl0fC^^D7tum1&7-&+
zz%`H}v&ZxvNk%0mHizjOBpJmS1E!ylWYl95+-V-gbzu4*Nk(l>aP9g+UYdEjffS>7
zxFx6t@a|-1@L0vYz(j;Wf-ga6#kz^{Z$UH&E3z;!fM#`*FWWhCa&oaK7Vt4<AF(r3
zoWRFu>Sce^gxCJ2X*RckX%BZsr>{bh#~$tlCeNqOlVTKSeJ=gO<nHucQj99~{4Y7U
znWA_-1m<`~g3G*Fpk=8q!g+a}`xzoY`@%qLW?n?|&jb}io?Z+Zpp5fEUhXT%l8$SN
zQJ`_xzBa`yP_r16;xbCu0z7QkR<t*$fcwrM2Pu5uV^j>_V^p}n#|Uz$X%F`Vljr;r
zCiQ#_My6i;0Vc=zKbU6oF92EcBAV}@2`|GE(BR;UXug%n2W%&rNHXZXh-KCVJ1$nV
z5VXYA{IcytP%4F_PK8g-cWftuXWDudrJV2BPBsx{=mPP%CxfaxMy(gI;@}m{9rqQ4
zK#p!}v765Za&^m_>5rrty&3za>&Y-G)FX5@PqtHsxQOQ=c$J;JoGi#yCc+Fex+g2Z
zY+3d~UVbUaCXkKYlNGd}wr>E5bx*dhg_JpB!Y0BDE!~stW1;f%pz^lncWfu}HwXw{
zOOV-rY5G|iMkU68=^tbmWfeh@CSrdRl$*JyfV{yV^&*-(5!8!)AultRgMGT5ETe3F
zz>8>ZPEbTb!;0xetb8LRtOQSj!U_~NCc+GD*BfN^gKTY{Z2cYN6Z1Ltpc?i^dsBk|
zDDps&n_<JYz@vsOpua&uA^VP<rE-8A<BMo6Ptan@7xKcNoo6ycK*bb63;H~2q}T#L
zdq!SFi`#-U^fwr<1Q`HgPk$iGC|+;)B3kTe@*O)zkg$oA0E7EX1{YA97}O(q{g5XG
zq|}6qfd!O;lTX<>rr))5&Ax0G2-->XB3djLWc-Ogn{Fz%Ffj0PGDJ4pC|E$;!12>O
zis8Wvd7;HGqQ$0y)PW{ALH2lbFg^g$931sbQ6LLnKNQdbWf_lF#uuP$<I%?W0i*%6
z!YKQ$T_ng6>BsF{Uqp-cW*@f;1Z!qxiUNt7EM;JGpTpn+>R*B!`T8OMlq(Bl<UkGu
zEhGYozkbM{19Ch_FUUNQ*)O6+zH-#Ja<PI81C<#WpV>D!&tZtl_`|-#;}5$=dxJs(
zXgCUl%`F)WAiiP`G>>9T$UbI26E?QyVa2w9L!2q%g}mri4$zTO^72bTd$K^?CD4Kw
zP<IK`RRTH0M4lmm-$P(KzlXpMesiG}I_p2i-{rRuTG4b@L5VLzU>e^s0kKQhq<>EW
z9fl&x6a#9!y^xoG$RWcNx_ym2qYEPo0|NuY_74h-{z8l=r#l!k#xrtmUtr9b&B$mt
zoyU|hp0RLxjwxe5W8m~Zri|^3j?-Jr7-utbPFFBzoXq%e`xbM?)r^dt(-SNi(;0Ve
zKViw}&B&-YUBsF(oiT8FjWy$BM$PF0HjMp@oYNQBFdk>DoStFJ*v*)@{fjN*Z$?Ik
z=^yMF!x{HZ_i$jeV-nswy~BY~nbC0i8V5#sM&0RW92o5xZKv}%GHOeLtNZr(c5gXk
zm^?vMvd0pJj2B_dcc%w9GCt0A1x-AGX53AdGH`S(x4&vKlOf_o1l!9CRnk99W->&*
zh+w;Tp-KwGj(HKmw(~-jB#0e%p-SS1NjrnYiwL%fCLIhdCM^tYCY%f$FCsV+L3sxh
z?JpuYJVAXi&~WaH2oA&P3!E608C|Czabm1y<ecu{%qXYFa?qreK>{3S5iBdgOTD`o
zG+sooHG;|%kVz(O43LfG5iFV0dz=}SMHNloGcfi3u)ojynn4PpmHFrNBhHM<f(t=w
zV<$XNV0gj6*z_WTwQ>3nXGUX2&FMNWjMAAeIb@mKv+vj|Uic;b<3$A1MbO~yg<n!2
z_D;}2D;IuAg4hd9W-=6*%w(AGB0^jdw5bW?ju#Q)oF+3FI=t`LE1F0#uz~tsCQ^)S
zFCv&6O=dDQfE;2X#i;Nif=O}u1{X#-CdP-;FSsyD8_ookNFe+of*G_#+Zm*ELV^K<
z2|okFiwMR{6DbCj7xL0eIry1kUWCa^oG#<aD9<Q3-Nuzsj!A-ZdW<XMd&a`)K5mRk
zOnfV+7q~IXGipws;Kta`XgOWMol%}~=5z;lMkyt^k05I}Wte23y@EwABILk3K0#6c
zB0_HC^cr_YIVORJ)91J|s>_1545Yk}m;3Ipj3LAPxZOceuNbu6`$Yuz$>|T=8O0ep
zr~hzgTwd>*ea9}-WF|w*i*PAjXo84(5iTVPO%M^_1kueP^&(vIEqEgU4+Dz{FN2v0
zAH#ze;nG_{2?7*3FT$ngg1RoC=zS3`-3m@1+)Pm~!liRTOYJz0G6_#g0Bt{GSo9)X
z+SOzhLz>AfIfj%M;nKRG9WExb7?NIuON)XOo6KTJco8o3ce;%yV>)Bw^d+8*%7KQU
z(HYQYB5)rej9(CRb{1%=@P)$x2J?INjF34XhK3gr43H^_2qAC-1Jt$WU}Qp>8hH`J
zZ#iAUi_x8N?(_sNMsY^n=@nj#>YTNpfPN7nw{rRlFGejUmaWsTcro@fMr=><W=v;d
zl$?IXmob<zal3*aBReDGiRl{tjQWgEw@3IhS~D?rZl4m!=*Gw-cXs-nAjbC~)xnJ6
zir~31P<04$AgK8SS_kZX$o^)A0{4s;(qc!qyM!>>@Jue?6WHF6!1#XxW6Jb~kBn(d
zp*N<#_{bQoX!C)gJ_3Rp??C7V0SFBeZ)Dk?@`+J`QOuwsEiEm{z`($OfdR};OEWMq
z*xvV<(UOTVVfu-$jMqgcd|-5%@qy80&Id-j8y^^5FMMEhx0$}>8{=`_gbxf$6Fx9(
z;rPI?m0^0vcSdD}J0BRmmwaIKWBI`7uk(S?-{S*gV8aK-po|ZUK?^(_eWo}3U=*GH
z;5*}YN0tu^r+$23IOXwy;lzv&3@5KZXb_taK9%!<;Z)0ZiJy%7nRpdGFuYmuf#FTa
z2ZlFWra$@3SS*<Ef#Kti4-6mIK=F(18Gjf{80#JK9Y7^E!v}`{9v>LKFks^U4Idc(
z&-lRbe+@+L{}u?1q?VCE21SgK!2rtt@qyv1&j*HY3?CT2b9`X<;qrmu$Au3JKMg)G
z{H*xE@T-2u2ZrA!9~ge``M~hU1*!?;h#wyq{!ID6@C8JFfzTlKUxyD2e@}d1_zzOU
z@PXm$9*Ep`oevD(3_dV?5Bb3Gea#1k?-!u>#RrBTA|Duj2Yg`o-SUCqkIV;#?+-pO
z{9f~c;rERX3|_xM7C;66XnbH~0J+uxVi?FkESQmD#Ro=)EpRoA3@INN8EUp`{AW~P
z+FrrPWWmT}XgPfo6O%2Iq2>0EOicM~)6Z}+<yd@R<kR`U$fxmvk<SGS2Fbz1L2NkQ
zZo$QLgK0VsFH?1W$Ok6Qln+dt1s|9=D?TuBwtQgXobZ8(bH)cI&Ltn1I5&J?;@t6p
ziSx(@CeAA#7=OP3V<yfgADB2lK-qsjFmdsGVB!+_z{Dl<fr(4y0~41CM2^b^OvChH
z(DhIQF(l|9&cqe+p`M8=1?)m5u8I##TrFTWx?`BQreGCES4RfFo>m4EWiAs}{elln
zTx&isaqR$WVB$Iera?Yo;=1sGiR%WK&&2iS0~0p`gv~ATfr(q?0~5E&2PSTp4@}%X
zADFmfJ}_}ZLz24$tPW%bK`e$8&rIBq;Ai5VGF?J|DPnq`C%feKTmdF=#_b(~Op}=9
zxEFk2;$HHBiF?flChjdCn79voVB$XWfr<Od2PW<t6YnTaj}&Fn3+!NEXlP?#C=~er
z|NnnbarA+~6)L7Ffe`cIfv77GU|?Wm1c`rOuuOo66$&DYO}`<^q+Z{`z#t&PzyLCm
zg8`yEuLY`H7{rHI<v0Z*rfGl>b5dYn5Xfd=U=U|u_z%?^_5>=Xgeun12GPe1RhJk6
zGM9m2aylR1^d2!Lt}yNg9~ca`FmN*|d|={!@qt0}2Llg_!3QSp4<8tGCNS`FIDBB@
z{_%l9=Ldt3fWikR9*6<z3LrKIn4{rf@PUa(1kBcKaQMK)qp<yr7}GiCdbJ-A6(A|K
zKMV}&E*y*uAR!J026Ybx1`P%dHZWg+fkA_Xfk9&e2NRgj!N8y~g@Hli1qTD1|Av7<
z(*(+AU|`U+U|`Vv!odob7hnK6oIyJT$~RzO(2iiJXVB?^T9Cj1@(qK|7pMaS7(hN^
z(2YUxbrTpEbf-Z191IM)GZ+~3QaG4l7U*R#Fz7cx<sBFp^jkpHFqALBz+h0rz+kum
z>HrG{2E#4&3=BpJPz3@E3`Qyp3??2Nd@ut|d>9x^d!QCrFff=-U|=xQ00j>yycihF
zbQl=SjzHxF7#Pe>Fff?iK$5@1z+m<P5h7+^7#PfDpnMJn2J?Ca1_pB%r~m^4gSiI-
zgZUSzfglAx7#J)9pbq3<V6X^bV6dn_;@2=RSjIrr3ow8av?WpqS<YZ!uu4G4Tct2C
zSQ|k391INg)+P)L)^893)*l!cZ010NNPvOCW&s0(Es_RX69xv`D~L2;dxL?&_7B1X
zb_@&*b{C-X0t^gxR~Q%^PH=F*Le$|51B2rPs0RcX>KQ=!$4LgNfrEholy{sGpb9|z
z6b1%o9}X6n0nPyo49*)6^3Gcr7+i7?@-77o46aD#xhgO)xEdfF=xV~i;MxL<qIw2!
zS>dJu4FLfL1~(lB2DciR0tN=R1_lPV6;J~>7#Q5vFfh1_AmrU87#Q3;5c2Ll3=AHy
zG{wQd;Gx36;4uTC-eV2}gJ%ykMCt_?7(6F1FnGV=;DY(k`vU`m4+qph1_lOD!R2d$
zh!S551_nO?goFJ=7#RE(AT01(!oc8n2CAQffx+(r1B1T?BE<Z47#RF(ApClerTz^J
z4F0fe$HBnh|AT=cU=Jcn0uC@R1cDTT>=0mJ2xMVk2yB4LgZM2B41sqL76v|GU<jIm
zh?1Zg3=E+ePzOseFofnXFoa$KJD?t1c!b_yU<h-88py%G5az+a5C-xQ$U+7NhOi|J
z3}FwT91#Br14B5>K@1EG;VcXc;YSb_hM!<yh)@Arz`!8Dz!0Iqzz~5*bPN$w7#Jen
zfaL2Lzz&G`z`zih1NDIb14Cp114HBvgo7gYfc74MG(glxSuij}oq_s@gMlIH0s}+z
z8ifAn4Gau1G6?lC3JeS}uv}rmzz}nVfgx4^l>b1U5@2A66=7hAjeu$Z@naYmVt*hk
zi2cLB5SM^(P+STFLmbRU91IL`Qy3WHULeW8VPJ>{SpX@g7~(}37~*X}mO%vK9T*tm
zLpT_~@edM;k6>VkZ-DxMgMlHwg@GYK02-tm3=9b(3=9ddk`Tn7z`&3ID(OIGg7|kB
z7!oC*9^hbLNR(k<NDM)k2ddVRra(O;z`&3+gMlGkgQFf^)TZk&Fr+_0r1JC^3=A0x
z2m>-y7#OmSaBzd7oxy^EA?pMKLpI2VPzPj-Ffe3;d<fz*Ffe30Ffin3Ak53rVPME>
z;NS%77hqrj)#Z5$>Y)}eFfimTVPGimf%+hWfuSIPfuZ05G)M&)7z&;+FccOb)EAa8
zFcj{9s^?%}DBQ!qPy{PzI2ag;Oc)r7Ef5YUwqal>zJoBY_yGe$Nj<E#;$UDXX<=X}
zxqvXR<O%~rDag4{AC<B&FqHa09l*iBP#VC%P&xsLKZSvz6qHLq>Ot~P7#PYVKpap6
zGcc6NFfdeX;9v(C3Ca}}TNoJXE3ZJSUjYV&${P#})d|p&Nq~W&I)#CuP6m+%>J%6l
znviP8CLacdCQwldvV((xp{av`p}7U&!{!bKh87P5zr}}vq2&zJg8~c;Ef*N-8QPI*
zxAqVQhV};t1?^857`nee9iYI#(EWpfp$Ar32{179d|+Vc4S}jRU|{HtU|{Hd1GNyu
z|G>b|=K&2N0|tgZ9|nfL8&G)x28O;n^$ZMCM4&#dU|^Uc!N4%hf`bPfL=zYorr9ts
zOwWPJ3otNDFJNGp0kcqmfni1j1H+61PzP`@Fw8i@z%b(pC^#TNKH~)g!%PLJg&YhF
zGgTNEW^LgR0Glttz%Z+R2Lr>r0Eh*Q0t^iELKqn4dqA=Yh(F(lfnoj`r~v{D4D&BA
zFf4cj4G{qbh6NuO7?#99bA<u}!;%CBhNUrxM7K17fniw+LjAG~28I<K&|ENqfuVjy
z4+Fy%7O0C97#Oy2FfeTSgD_w#0|Ud>4G06aZed{9iqz)Y`i6mFhYK{s1Q-~0crY*=
zet<CV@Dm1xBS_i!hzbM4kpOrI)iWFkVPH7Y0~cU8GJ%2N$Q~sA0S1Pn6_5}CrP`x4
z3=BsPK;x8wf#K*828N>_5K(aS3j@P3q}uZs4+F!o4+sw&`@+C*99B+n)H5&~cVJ*R
zGX)xi5)2GyW-u_E3qVxI=Rz15&Wj){I4{A#aG?SbB^PQK7%r+H9C%TKf#IzHGz36w
z5eA00ARmML#KFMuHiUuU!xm_+tCwJ4_^^Y4;o~2u3pp4VJ~1#bd_oGcPbv%ypI~i7
zkh}*2!zWm-0P%k?FnqRvI*5aT;j;|`BO?pc0s#g_Mh*r>mNW21EhEbX21a=ihy&{x
zG#D7|Vi*`b6*zdosZxP~(Nl$i(Gym73otNxMldjXPJsqF2Lq$$3<gFoAA|*70St^@
zAoY+$&*&Awz!;nX^^gDqV{i@wV=$=Xgvtk(Ffay}fP#ZT8YILRT*1H?3~C~Q#TXca
z=P)n^@0f0*&a|5K00Uzf%k($uOzN5y3=B*jAPo%QTAe}X|9`zL3=B-*Sp%q;!~cKZ
zS4_9jU{bID!N9;!!r&*!R1MJs>i!t~|IZb|z`!QM;3QlCl>v!+{QoZy!N9;~0~cou
z6JTJB5P;doz$h=lz^D*`;72GhFh);7@C_$0FdBh^5b6neBNhfm3q)g|(L#ZN(JlfO
zjEvh04Vjpjrr*|O;+f8`&9o8Z3&!aOw3((%7o5ka50_AxzFmiD3M<P8CL5RO0lG{I
zlQa3ar&sGT&E~Q`@qx+4;scY7#Po&vj2Z$T1Q-}TFj;$iV6xuvfysIXSaf=W9upgv
z)rk*G))pU_tl>%v7(Osrd3<29+VO$O3aa!2NU7zC4@_1TADFD*N);GBFj;zhV6xot
zfyol8G(n$<jmzT12PR944@{PDr3)B8Fj;tfV6xcpfyn}@^a4n!`H2rq78W0vEZ|BT
z89p$XdwgIr-|>OT9IDj8fQgOE?8FBqbBhm5<}jrS42&O`%sf6YneF(%WCm5b0i@LQ
z#0Mrbiw{g@aHR^2ADB!%J}{Z?_`qZeRjOdf#KvWE;scYZ#Rn!+h|=jBT$xySJ}{Yh
zd|)!!@qx)?1}H-2Gfyty<J>M_%5<0mG(hI_;scY<2}n2^_<}Wf|M<Y<lktJc#{(j~
z!3QE-@qx+v#Rn#Dm}-cy*N+cO-Wea5ykV-n!K%F~J}`N`_`u|KV)`CCCOt0CA0L>!
zGCnYQL6iynzmUNAfyuMt1C!^A4@{mAGX?%%C}8}+<niMJlV`>UCQpdk=^H%3MtW3y
zVDfnJfyv{<^f~rSdR*>5J}`M?d|>i`Df0j;bFcWo<o@CVlRL!B=>`yCw;vyv+%rBf
zxkFS7{9*uwxm(2tCbt(KnA{+W1-^hqU4MLFa?AL@<OWeYeS;g=WY>xhOs+3JFu6h$
z!vff);scY*iw{gL5MhD;KLi*)Fu8DiU`qD+z~mAE2}N)ex%~LR<eKq;$<+fC7dFh>
zFSsy;bB0d%z))=Sfx-O82L`_-9~cUrd|)VL`M^+Q@`0gn&j*ImfDa6%Qy_Vqf#Cy#
zDM<Z;4-85j9~k^Dd|*(T@PVPE<pYDi&Ibl_j}Ht=TRt$9T-jdZ$0WwWXZGa-1E}c<
z(r9~Q`+^`QFGi-LU$(yqW?II|sJDG`BvYn5<J0MXE10Yp-%q!wWIF1wnz4kHRak^o
zl#P*<Q;t<siB*zK0nC$RU}9m^W94CsVr67=VC7_!X5|%Om11LL<z-W3m0}ZQWn^Q1
zF+H-1$)0if_L)^ok2slricPO=VG3n@x&3kr(`-RT_v!i5m^v6YZT~TiNtcoF=ytUk
zOi$P>bQoD#MOZ{wIoX&a7+EA(<(V}UKwRbs1r`Zb2^5|nvxWjll9i1)c)Qblrb$eU
zH>O`*$mGX(bi2wTCMkBt#nbIqGFdPl++MMg>4+ki3dmg*3aqRe+dWS+aWFE6FrS<r
za)wEp@#6M|GfW(EjBBQMzG5<ETr_?ED<)0$>x_)7jLdVUzkkKl7iOryT&BRv!z`h|
z%F67Zz{;<p0CJ@*BO{|QD<g9}$l;8P!XS1eh|Q+QrVmn}&d4gp9I3#{%BILF$;Jq#
zIoX(18CivxqxGggdd=j;cz3(*8>UknjPlced|}dX%VT7<VHQ#Vxi&|El~u%+Rgz7Z
zRZN~$h*?;HRg5_oY??5u5F4`~BXhnU*i3$?*+Oj0{2*KOrq_IBQe&)`ew~?FflHB<
zn~_D7m63V%_OoA^q`4WtPJPL2%RHIMW_mp%v*z?5M&@v)2`tlBGcqgjcUD3?z#;+i
zz_;ml7@4btpH?%9vg)!i&tPF>Wt3-CVt!dYJ(G!9j&bJn4kl(x#)s1nF)`~f-kAQL
ziFq>9oAT)fyP347uV-fFV4B1+eJ3-s4C96A*O-}&8Gmo*Vqq3wW!ySlnv>a=X?F4S
zEKX(%#+%a@b22Nk|1Pp&Wo2GC{WK@D0^^P8Z#bEinI7^?7vy3#;rv&m$11?a{F!IE
z9~ZMdQ&Z9QelF%0a*XoRD>RuMc^lakSXqTx8QBC`g(prwrpbJUTN;#94OqFE)AgoL
z(_&7q7hz*$6=ky(XANRwWK~vRm7Bz>EXOL!ro<`-kzv(j6Jb@CXBB1BXVqk5)MFKA
z7G-2rWX@L5V-;irvBlXKSq0f5SsmGgSw$cU_1PG0SOwWsSV6`!GV_3<g!xRBo+zsl
z8zU<Z8*_yoE2{{r5<@)`3p1Mp0}~5#1gi-1V^CN!pJPza1I6Wz`Vv+#kRw2D23e-h
zDhuMWF)K%~O0Y4q%0VO~+4P}~Rbn+@V`P<3U_}-J`9ng1RY9Lsl+6g7<m41UYDC!#
zSZ!6=7+JLyST$`~l|e371bLBF+ySf<WLA(3D=VAn_DCIONhZeA(~I?(mAKBAGqQ4u
zvZXPvn?7HUS;Br>nF5&4%F2A4laZ~Z1>`I?1qLP-CN>*Z4mRdTbvCS=Ag(Pdt5b<W
zTAB^31oPu+P`u7%(VPBTk2#$2`}AOa<|2_+Rz_A<=2umEth{W@B6_UKY>W!iZ|XBE
zv;StdVdY_-KAqWsSx*=ggo<9QjLc^^6hJDcmrs~(XTUs}{UEy@D-ZM0={F3RbNIYi
zL4K46mqW}t(*q5e6<I+gmfiF+LuM`ACRRpPO-5E;VNfiAEo`m^#UvxE061=K4Oq3<
z7+Ix3HW+O`Xvn;ek@4a524m&`9<UGfSQ(jr@i0!mZp^I0cy#(7V`eSMMQn_$0$>Xb
z!9^o4n<9v>pfKIegjt=jZ+e;uvxdNPZbndMo>jsKw)Xk<c_z%VjGT%fhp_Up8BafL
z%IwYLr8iyNj9HFN5bTKQ7G}(H{Id%gSy_eI^jIW7-hMVc)r`4b1Z>C)21bx}a7vq5
z&p7>s8S?`cR$eyS>1WNEn}j|TfbuXn*>Hed&)hdX(Sli)S)aLbdb0&{R6Q@7KPwOO
z#9ELt5m5Nvud)Hz(a)jB$S7>Y%ELSpD#vRF@)9dAn;kec3)rwKDX<DCfb?7|u>pIV
zM}d`*`5>PjsJu8(2&x)Dbpi7_Zar2jP}bmOW4_A-%DW)pSXLh9E89~nnTwbh4^F>s
z&Fo<zr_U-c4=%<)saIN&RSv?FW@BWPQe>5e@IW<;v?8k%geT3$s5jl-hPgy?S~|!R
zjEutI@|TYdRB^DfF@KPle#VBmfO8+C9-AR6EA!FmuC~lp^`OvT1QF0An+8g$Y<jGc
z%wh9bg&bIA<XDB2SjF{O#hBF;SjCy66ckxmVN6yLW>p1NY33LORuN_u1y)vlRvG4S
zJyup`O$Amd<`_LzIYm}!MNoED02M~Utio)}!Jss*tH5T!D$K^X{go{<8zbY}=^yQw
z)fqddOWHGgu&|o4=}m97XI2wh1@;S4yj_{T*PdBM?^h<skF20l9ul7|Vxambl0}M@
zjd?yJNK#l>SQH!^917Ff9heg$q}Zfb1(++qwFRp%$jhLzh>?|vO_7xwRI9TovWl{a
zu=2>Ua<UnKwF;-Pa)Lz}SvlFfS*6&#Svlpwl{zD<4mhBgD;1`1cVO1k6fOZNjT8p!
z<7BfH1}k7@W3FUm6;)S&^Yo_kJ2D$E^RO{auXSWr6=IcP6K3U+2fIQB6u)}YI~<v1
z?4{Y5m((+|@_-yH#r%XpfmIJ;VTA(B@vO|;jI1`G?7=*<UO|CXhWR-IsIF6Dm1mp&
z(2=>CU4d1e`6~nC^du){Q*~)JDOOJAQUz8ekl)#qSy`C{^uVcula2XB9V3edD;x8q
zwCOvYnDy%)N-}~AOHMX@RvvJUwq<2y<^mNjhq6Jz3(9S*q9Bu0SVd$&iB*)9lZ_uD
zq|6E_BNXhwQN#lZb7n!12N>BviH(U3#Aaf%VUYsmk%gl3SQSAfx&kXdC>j-6r}sNE
z=hT0$(_<B3V?L7&&Pm%u^lWWG{1e$WtWw~>Fk<Bt1-G;~L8VkHD<}Z@*fhYjpaPpd
zs{$J%tBeAxf&wcO8>sGKWn@)nGhhWdo{f2l2qP;m^Fy$Agh9zgn3a=_k(EOMR5VW&
zVXS9kew(cTN~Nr<Y|2nMR!%m32(V@4Wm92QG-4G90C}PmR1Pt+@_<|t$;!#Rx84R6
za%{Tb6v3ka_QNFxMpi9Q%L!DfX@P@<4-^!P;F?VjR9}Mvf|bpdm4l6yk(G<hZu)u`
zW;qrGR-TgS7hITEi?HcI;-8IKnUPhFO_7xolv!Mv!*#qsvB3t)eO!8MjBL!)g&CQ7
z84W~)85zY`IY22~ft3RkzWU53r!%`T>s#&@W)v3DXXOPqmh2&F*leK!%y-HZSb3S3
zaDtk6AT|$}&C90Gd~tfb8*`}Ya!ybHuE+wV2N54|ZOzK21TJ~NsZ!R)R$p)WZ#QO1
zl}n-^rMGK9N`-}mML>3eT)K!^&yY=9RFsvMxoNtEJF}x2C{Pp`89^R+!^8+u$I8TJ
z%gV#N8l30Beq_EpeZD)hCPx&=Q*6u|r$2RPZe+YUJ>7#jo6Uw*9#j_I^k7!3*RcZ?
zKT?LQlCrGQa;#FStkTk~lJcOe$_gq?B|*7heZ2y!B&gj15*8K~W@Tk#URTe^D$IO|
z0TgSXMm(qhP!wil6k%m!URKY@$||Za%qq?%Y{kl>!YVEUC0W^&K>9(&5~~s`znm8<
zE1ME4ryV#6aIz^1vnep2VPIqxWZqn_-~~!GXTdp^*-?R&li6N@m5q&gU%dh=tEeq2
zD20Gp$s%kZ2PsTH=gDj<$p$L7SU~RA7iN`YV}8QG$STe}r(R*Yq8GCl<M!z}Ud#{G
z|1&YNsIoFLccp@YTLk244mL(FNCUQ80+iTz*_c01FY#uMX1~V5&&tMpW%@O5W);&_
z;Ar}p2GYkW1WFbPtQyRmO^^l*^BW0JVg)5JQ1&xo;b&!HV}3l{z=zr2d|{0ZtA-0G
zPX9`P>NVz{Y2a3#5Ss!kE7+70P(mu#W7V)@Wwm0}a8Y2@VQ!wj!-x4y>Yg+k1y&6M
zP{{9+1Qjypt3Y8a%qqqv%&H~NYO27(&&tYtD<9PF5o2C1pulPx&MKzJYN`t=dL&u+
zSp}KT<b#|oD$EG7UX(?GRg8Iw07xUK^~K11fBFkw=2DJn0(va`Y|Iy?r}{C6F)o_E
z$B(&<aoTief97<?tJ7EeGf!i@Jl!dPS(SUW0HXnOl^zQ}^R4Mc0nFBnYo@OYV0L4-
z1%(Tn^7QWk%<d|J`mD+zH|Vg6LK?uJI0JPOL9{SfrQ-DHKxQ)oS!QlMRxxG)1y)&Q
z<~%P}Q81Ia5R~AV`4m{W*~D1+nFSSCWtsC7SjA+gUkqec6%k-#=4E6x1eM$J3alb>
zAn#5KVwR|vWfNrOR%B&ma~2i`*~7`ke36Bb)d-v=Y@xIPIJ?*|FtM=cu{nSujjaIG
zta+HF2TuR;3ZMp_JgDd@1vhIz?N)HJ%!ieajZuM#iGh)kMT(V?ftBe4W8x3ydy=3Q
zn6R+$_6tGG%Q+ZhwpT<mCvY&TOuw1TY{(cfojZj&opHwW;uPk`i~-ZbQ<;?*Beqwi
zGV8E1=1gCn#VpTQGW|G+s+j&fi`j~C&UB@0<}Aho(|fa-@30CmuVZ1HelVL^WO`E$
z^JY#7=C$mMii(Pg({h*<r(eisR-fLM%k0Uhu>C?Vvlb&`!uH>J%v%{5Crsa1z&xFi
zWxHn~^9)u-h3${Zn7!C!=d&=fF)*YBF)}bP*t0S)FvNfc+>BY7KQQsMO!us1R;f2&
zU|=o^XJ7>{Lr%WL$iQ%XmMk*^vzR*rLx4O31A`C)gMv3?pn)m9nuDEzVcpbf77#VR
znvsKnA<eUziJgHVCfJREVG*0HhBN~ML&#;2ajR-TLcF%=5)2Fs9$E|x85VZ7Vhjun
z#Ss0ov=|upW*)b*1B+=fFwDF<{Z}osE~EE!jXGvI#=7b5b<A3fQ>PczG3zoiOkYsP
ztjRWwk%1v-^7Qj{%yMG6_R``Y;}SUR6*(Cg7*{bdFqnx>XRc?~a8tHd<z--CxWORI
zz`z&FVK2|Yz`%Gj38adFL5qQ5;eMXSybKJCPpct8qz__iF)(bJ$@2u}o~+B$3+tH`
z?8D8ZK!LZDi6Man%w)=9VqjRA3T87*VgPZjLph903=GHmp&TYA28IIy(=XIBJ32Hx
zG?PY{0%9_~W@2Ed?1Kn{O{u&G<$z4-4uNt&rnJOQ4{Ts|vbQsnK^OvJGUqTcFz9kZ
zgu#aBra?I%LmVzbIUqx<?oPkd!0g1xFkQ5fS(ks=Uo%;dVUs{|^W&xmHZnUg?w&rS
zky(##x0xJVs+MQ^g+^varXwe(3pX+A@v)i7!{vJKPWNwOc4AbRKB<XWmw)G3GX=QZ
zrkv^LnwWJN_f7xP#OxPv+)PoFfr0U;0uuv6`8P8qP6h^sof@F{5t$+4Aj`qPz~;!r
zz|eZuK@KDZ_DgiEgFKi6@=IQ)g93=N6Xaf9h3T`JnWg;C3OJ~Nw1UFY_=$r$SOF+T
zjNdqDfH@%5IyDZOAkHKfCI*I11_v!LhgBrAsF1-y8_Z#2VqjodHl4YJSxrOAK_4Wx
zlZ%OgAv)H<0L<ZGVqjRR=wJxqOyXl=U{G8=J+OsY%%{)61GJQi17xdNrGuv+0|Ub(
z4zL0TFEEFbAzi}3hm(PU-Is}hp{CElR}jR8YVZTA5ddqLzPW{2wZ8d>gEuz=1KaE3
z5<_DKhX8H{26h=xNNGF>aWDgoriVd7${ggFogj0{*&Qsv9FTW;<~vw|I5$AvEnDqi
z1?F&w6c>~*I9P)@Am4CtIoN>m4F|~XgYFKtAeo&Kpt%KEhUw9*%#uzU92`J`lT<)i
zE7idf%uxk#@*SK&oSkY+3=Eo~4$hnm3>;w^ObiU{$__3dPMQuA0|ST2^lh!o#`T^8
z4xt<j44k0I=b7&i2G$C4ciC!(aM0udI1vU`IDqB~7$z};!kW_|5-bDq#KE-=QD8l+
zkSK`;%dj&sFl?xBhyimzA<i?)Ar`ERlZk<$Y?(tGScaRao`J!8w?jNw3gq*pd=3d<
zDM&mzB!W5opdj9Ij@uy><kY>O1Tohk4J-w6YPg?6I+z1WjLwb@8DI`5yo*g7GQk|M
zyZIclz#Ndfr}sEyb1*P?F-!tE{J6dYXu$=;Bv4{&(RauNs{{Fh^QuE0m;>^~W@d+c
zFbCud!QT$xX{1S9AlErOnr_(6ELpGNPzF}P&BVZPGR>hJ%mMj~N8h0W%;5zo&v?r0
z09xR{WdaJ1)eendDUfGaFFQ1WIUvtu)jBkTIZPl;NoNEc+Bg^(xF#?$FqpeJw1cHU
znxuIgIwTnwIR6WSbY1-A&<U0TdDQjD^gHd$l3JY(J)ls&!NZWlz`*>KiNT>CWYiNT
z1_q(y4xpKPt|tt>3=H*3)8#vurTOnVOp{<>;QGqA&zFHAclvbC4rcxO)xr*oI2ahX
zr$SQsVz4bB2TW9USOVsN>{l~(SPJHVqM+u2!!j@j6a|6D9F~J!0dm>K&kid<oSmSc
zohR(D63hW*ZGlFIRbUP%;JCOPR)aZwBGbQjFe}z)GV(ZzaWF9OePLo?;N0OT!3ko6
zTyZYgQIeB^fu99r;>K5wQV@Mi3=C<Bjxt~lC`ZM!If6<xhDkz93=I1f9KprfPGKen
zh7cA<P<_NONtB6!A+E_0H1WwWNsNhsVR4Wns48RFDelI^z`!r(s08+uBohO}qG^uG
zV6&x|7#M8W996&^872mXNk1GxWgx$Z91{bBlB1(KSdSejY3!JOx06|-e(5hqZLlDy
zgl%eb)Zt)Y;8$^CVqj3Va?}OOcrr0Ca78-mflc)S6-FwKkW$cxiGd+0#t~8q`Y|yu
zEVObo0{P!0fQf;D+tbkmtS5nqfuYCB(G+Z25)%VM&=W^9uuO72$Y&Cc=3uE*CI$x9
zbVmy?Cyj}LLB`L~5?nK+Gchpim2<QL%j7dLFl;h$gp^hVObiTxnU1z#nGz-jh8Zs$
z?ZBK;CI$v8QAc~QMP*D33`?>d9l$abObiURa~vH(D~=c@RWdO!NJTq3fu*XL7#PA#
z9i73PYLMBd9l?{$VKqz)3@HYVuHZ7Z0TfmFj_zQyTbLLaDo!|hfH`fT7@gzj2{xdE
ziGd-i&Cv@i)5*lZ;JC=q8!XceY8jkx^Z~87VVKmz#K2Ih<LC>P>SbbJSeN1G2j=vF
zqAJSKAI#}zVql0};|Q8PXP5-ag4;hh27+ZKf=b0y#~?6g5)%W1#2?3CFlRDIrr!}%
z#Bzj9VPas2QF06e#j(o_P|(-MI6?~9SxgKJJS!a`h3sr51_pb7$4GG4&jER2t|PdR
zy|ILefuT;_5mK(MU}9h}UFjGLGEQYB69Yr2l4BfL&jwKW!0Z?g4y+v@PK_g|B;^m;
z!vLz&c7pN<s4+FYpoclVK7moyu@7X*3vjk}1QiUB){|MPBdBEHe*wzYs)~*i!Nw~w
zF)*}rIZgumPz%JF<~SM5(Pm;`@Z@#`PtSv^nWg5A(?BNw0F`rgLXI<q85jgOK#6^+
zo#Px11_l9%#OYzZ%&sYF+6oe&l0}$-VPzJF7&k~RhKYf}C{m0^f`LIG5tP9z{ls`c
z%bC+y81xw!1Wfo~M4~VQ!-W|vV*DU&phO_eBPIaR23DCZ%)p=!H~oJvvt<2r8&0re
zL8a5m0vj%IkRhM~>HISrZV3hkK_^hLvoy|z51ep7C5F0!4Ien*KqW@x92<VHj0h70
z!|Cfbpmkr6LSm_+jQ~j5Bymu&u-HZrY>xyeU#Z#%fjN>Q)2H__3)D}v5d)d=RfYlN
zhi)wf28kIq5>lXL*;)(?Y2h}Kpq0~Kg&7!v>P2jnIT#oO*D*0L`0(3+i<cXq&{#ax
zMipcTxHS<u$3_jz0hN8#?`^;ht{Whq1m)Oh@Gvk49v1)wg<yO$BLl;9wSH#F`aMoc
z!VC<IRnr+67@A&bF)+yRsB_3OFbLkzVqj=uQ|Hixvdd%C1wih(0rnjOgAiXQBdD=n
zUg<2%&A=eUq{YB+q|RAbih)5$jStk!0vVb5Lzsa<!kWbyRB#A^N-GypXDd*;y8&+M
z*GGPFv6Nz9;ARzOV6e$C0I!S{21U!oU#^DW-~xFwA<ESV%mF3Bt~^&`AqEEJ*&t<0
z`CLIo93!}$q`At~6dVAc@MfuV1s8EQK*jL-8dpdO2WsS~PILu1hhdT;lN<xXL3dYh
zLADc=rV9dHZNO%O8dV2YPmi9!EMK4EVkN=AAS}$sz#tSM%)p?ul*7e~gMmTVfr){^
ztI5S1Y$t<AYF-M13#ci{aDxR@S?|1~;3f=Gcb5rNf4Yf4)G;wIoYiv^1#xzQ(p>9V
zH*iAO32J$8iMxq|eF}=h#<y+~pf!;UlR&Kv{$*~Us*M5M^j+NL2Cmw`(d+ThO&Vm}
z4NyXjj&%bq^5}~NrA@`vZjgFT9+a=k+~h<V82WM*KoK`v!X;dqfkF5sAIK-d3=D#5
z8tx$HiWGvK>ke`*BL@Shfu^|H9qe9k(|MY_JIK9S?I1@jRdg2zSv`p#RBrpYgKA<1
zuseFDxPzU01LThQG<T45896{P)7jw;cJ3rlWJJfhgQ{gYSw)bed{tc{6&M&qYC(>A
zr^Ucv6YWwT1x|Nb3=I1mU7|tkox%(ZJaO_Kpb|nf4(wVF9*`@*c|viu2QN4XL4n&d
z#e)yb0k!c0iabE21Eh_Y$K?UZwxBlNktZI4AOpY+ku8iKkemu?h(ztE_W*^8n>?sJ
zH^t3Ego}Y8=L9IETNpe<!DfS+3Vm-qK%v606Vy~-@AUwO$_<crS1WjcLuDr@Aubj3
zkOb?I19>-molBxJ1A}N59|MC3sL#DL#-&7rfkCvIkAZ>ljXsE_Wx~L4@Q+K0Jeb44
zU^U;RpND~gkwc4tA?uk-zZ8_czRzU>Onig)bj``k3f?X*69pL<L@#PFFl4v6ECq!f
zC|{@Ax@=HjVBp-V#lWC&-sL_>{OdJF1_r@}E)QiG7&sLewHO#qJGwmL24!R|1_rg4
z)2B>kwyziUlm>U*`4~JH7;3(I%7A%{d>#x8n?yZjAv}H$28OkKo^lW#Xvvc65l?vt
zPtb#bp=XMx0+`1q!~hyIFc4tzl;me%5W5q`z!0b8smRX2AQm3Rz+fQY32s*1U~pq#
znCk1PQqRo5AhuN>q*R!JLFB%GC#Z2H4r(9CeD{R3tw7~P_a0C1u82vX@*?PzC%A)o
z6jWYxiFkrLm@h$zV?wDXxPu8=g2`~q-%|&a1a9zv@^0}18&7=>1_tqGpgbP#32tG%
zoPKc%vs`T6XHR30%A=q>n)lxmQ~)s?1tk{EPoCfc=qRYr)%@iNE`W}LIx=S&JwY8p
z@n@if!(Q$Q?hw8-U}9jHwZs$BAq3Trx-X~uOl6j>pUvS3YAH!dc`z^}wR(d4b~hM7
zfgW7p3GUq8U}W@QV5nmB1oiG1ZZLvYqOF+b3F_W4++bw(U|`@?@^l3`^9Cb}2LppV
zo2MIu$Lhhr(Ch07ZaUpyWb<HPsPFUyx1DY<vU@NvoSWrY?+H=L;laSr&F%?qKHXsC
z^k85(o#Y8A?ijf|7#KWlJR#*BBR9yx`JTQIeLNlv4Ab>I{UAJE4+e&Ui=O@v9w@DJ
zT6hLPc%ZbBc-J!!!ULt1)dxL;z#)2rQLvS<ATfm@7&KVK2da0E`Fn<dRf5acB{dwL
zpth4FsF9G@KYjKzX32VWPjEX4JP>ir-!mGj99nBh=78!RV+K$Z_vUkWf;yp+phlTj
zxF@&^`Vy3UbYFTVK=lbTFdS~+@l4@hV30h?#J~_N?3oIZ0;}^1_e=wGK#A#?zh^op
zgE#}j4Gxg$6E1Rif;yCv|G`l>-D^6tl#IV;K1e;JdN|0(;#tJOz#s+cG#vAv-Y}h6
zmT#JiCupyS)I+dc(^pStR;|zb?AZX)21{>^U=B3BHGw(M^wtdKfYRIUP|p?+=Ork;
zDTjErf;pg~*ek}f4a@<RP1Bn_L0w3G5m4FGnBmz0lDT068n=4s*$L)2O!uF`tY07f
z!*c?d&nWM~z+n2xb0UPN;K9I<qUt#b!c+8MVBq-gIT^xJ@?c;P3Gkc(;VFACFz}an
zPKEGPK&DuEPJ{4NAu&B26w~}_9t;dYww^P<Qp~0v3=CR!^`0}qTn-CRSy21Ra~3lL
zgVaNP1_tRF!VC=3EC)P6ZAm#^CI*I!zdYxH+r6N;oT=<N4_x4a;%N0(&-q{us5UV6
z_XO?f;CBJnyS|<aIT;w_ctLrZwb64i*fvn$>C1R7;bf?1U;tNSN$Wh9f~7#A*TCwz
z49o$A-jYq8kiIOaR#Tqg3F*s%8Wp8iJ;8n18=yu7XQ3y!FM9(t9y7n)a}C%4(0I)5
z)1K?V98jqcbjou*h_e$^Dohdgtlt23w;2-y!xUl9jbM&Bs5PkJxe3g%0QFN=d2Z%l
zV33ow1oeUPJ-2{N0LSKqUe9e{4yefzdDwG1nBxNK;%@ca0p@rxF)-};?zt1p0kzcT
z>v--0b3k3mdamD|yTQB=CI*Iv8=iZ>oCqcc2E&P-d%+w~HWY96+y~}>x}41Vp8LU^
z6eb1+`Rkqsz?=+F?|G}|K`;k2M4G(B^AMO*0B%Bg9tLwjUC9NDJdc87r2^DVjsM|!
z94rOu{B5rBJOSo_I)9!kJx_u;p#I*J-JYkw98jlDF3R&Xm;>sq@oRdX0dqh({@72?
zvtSOW8&>Y+c@E40^|e-<@H`LZEMQ__II`RG0w)8*^orTc7WL)=o>xEtd=?Z9*`8NH
zs=z~hQEZ;qz#LE=(;)779ULd1Bsas`6SOS_GRSl=-SZ|`29)HE7<k?Sb3hFcc1h3M
zAOpZv(F{jV(Do&UNuX@qJKOUvSQ#&q5Cg-^Fwc9S-joX;sF2yNIo)v%vm~SD^yoRv
zvh{%io}i`h@_C^Cr?%%yuz{dVpk?Rz3dA`Ia?zFtp0B|Mf*djbt>+ss2jmEjLeIBg
zWuQ#JQQ`Rx%mEcN$NW9tgE)}N(PtBf=O+#Z2Ki0kvd!}|Sc;JiR6kkonErPTvsAsm
z=Qpq@xTJPH$>I4Eq~R90So8b^k^&c@$NW8igE%)>7>pPg<~VS8g137rI7WgiK1N2c
zBqKv41B0);CnFPt%NPl+-WZu7T&73{2J0Q3j4Ti?^K!<5`ot6lM$mBg4H*`G22kbB
z$Oe`L+jI7<h$kbc3#f38pMhb^15ZXSa3C=7Gce45>&XaeSTamv<Y!>ee&)#tZdx8?
z0`cB>GV+3qISMkAqtKHP+(A6b#?QdOQQ^r5?i3#7;Adc{ZxHun6aXvb;%8u(;qA!?
zZeSkefx1QrBzHpq<ZHhB9G;AzmZZW@esB%LC<baCy#%@Dn7=2ZIEV)cplSgQPev&Y
z1_s4IXaIp*(l@{X6xHa-2x?0+++bv^k7QtoS?kFt3$})lX*swiWt0OIu(HfhH^_5=
z3}ONGKN(&cF)*xJ$>GTe8r4#4<OerQ7?r^)U=C3M^S~i!!Or2y2x@RCu7SE4JfaVG
zbG;@)t;AvuPe#zNmf|z0qje#!Vt~3z59BI&P;i61tB=s>wx7q75!CZjlILe&(7NHt
z2yS?RZOIVwWQ4R6Kyd-mXbRTI0SeN&I@dWo87(*%7?ixA?gKZnz&b%{t-xwo7~&Zi
zPT!xtZ$7hxMyV&G6E6dUQg}QA!vtGTMrSZbn1P{Jl!Y18XjcN26hS%D|IKIC)h%Ln
zm0(~{s#RiONPfkf17?FJ?}8PK7#NHzc$gVM1E9+M{0t0PtENXRU^eGJd(>4F)D8ic
z7;>4@=Ph8?s5g{w1*JA+(1_3E3|Ag*1_r?+pghar=E^Gy>UM(itf#*#q#FaunR%VA
z;Dol5D~W+Y*+KwR5@fvLaMk2sU{D72H4Q(xf*ZMDi|o@~!HrySi^x5|72L?($sz)3
zS-I+lgJNPQ8>lmqIM=lR*51#rb1eW(4NlTxV3?ffTF3+H)eAE)tPhj$0&QkdDQ99}
zFn;323EI3~1#+(O8!s*}2jpCnUDM|*WR|So>IKd%lR&ldmg!#L%mSXD(HHRod*Lgn
zhE+210u9s%I*EXMVv}j%1?q6AtN{(zg?ovJfV$lvD^}-viApmtsH_21kmuCBKqJ5m
zlT1L#SA|iSfuTv&!JD0ffkAbSNKtA!gEt3cY!9S0YpORWyEA}01fKrhkn9dBtaoX6
zgTfy&uTjJ2jp#ZG&-I3cIjFIqGsPRxbyQdIMsyw1I=mshMNrfv<#>bK4(YJ(uHWSi
z-k3WHRD>?M?+wc143j|pNG>jKNH-r;!m~SjgSW+jgDH{88<f@<z`>;Y(;Jl88Nj{k
zL=JCI$6j@g0C)s%5(9(k8gOe?9~5j{4I<v4fos*@pn+y1Z_rTMbfd-0BGTKumB5J#
z<UY1%-jE&@$leI^>4}S(#mxA;b-*PID4;awdFz5XEFwjz#SGqhU=B!Y`8RKUFbCW}
zYU7%|b}_Sr%<PBWpk&7{;s8;v1*)7xK$ZV=p6L%4Gs~LlDtLqT;H!a({_=0$;QkS~
zpMJ8{8{9tvk6i`xd4u{#4B+}tbKZ30CCpm&qKpjQpsi8rpbE|Xqc>=bSv?Qr%tR({
z&=@mE7^vl?xy0KZbUZ*EsO6Q&;SK6JsrP{zPEC&9pfP6kI#9DGk<S}6#LN)}YQfCj
z><t=X=12pzU>3gg1`RQ*&jYzTQN$ZG#H_w<!Sp*zm_s$10=z+6_B22vmX6`xo)WO+
zDBkYvCCR{`;Rs5O#S5oLE@d_Xg@->V<J<tXtyaDB4v=JEQ051<t;Bh!FJH>6Sl_7N
z!vZ?2;1g(++1UqFD}hE?7#NPo`mlp?BRB|bgM2u^98g5@%=h60adv`oOWA54Na_W3
zh?esCKvFMg>SD`ZA8=I#Zm4d*>jO#3poZ$S+dhz_EXgF#z%bd*2b}qKf;t|H(|o|y
z)D7??rt8h=Y0H>Z`RaTji4bI=IPdhC%b3mmPvrQ5CPOrLf<`ujeZg}f;D`)M@&(Tr
zgClbGE?;m81COMbyZNesD^^ejaM$!z1#>_dV7bF|`Q^-F^)lfM49YKA6<JuBKQIf&
z2!aYc1_sU7;DpTtCixjG85r6wu__5NFlb(7W&Xev6a&)rl~tJ)%!?>tV3=aX%D9*x
zG*1l{@(^ZV;C?0G2MQdmcF>TtzaJ0Sa!~3i|K<k?8^-BdmNN@VC-@=qc3!6+I6QWO
z8bqco(;qBn)~dG>@B?L6t(y>&Ah{K45+tBN0}Y2l{6M*tBaI1MxcW(RFfeGfgXaeK
zb94B~aWF7wgVZhM^8?SEg9GoNyB~Pw9MUIDlNay<)vDUD5St*Q7`jlaKsgOkgqiC3
zK}vW~5!N%s4>E%UDtb-*r*B)qtmU5}<OkaPtNnqAfx*DQ4>6W1(B=oKQ6c7(fAcd2
z2MfrYtW|!H3KcX@H&NIRGF=1;hh09?^;a@W*6;KKRjCZ%g37Gd4_u|*0JlT~l2!ab
znNTN9q#&h)!4H%NArlDeYy3cY5MrOHo*yU=^1FcSn<(rD%7YBxnSWD%KTsZ&lLeKw
zOXK`pxfmF9(m(~znhHNR5T{IF`tg;_PX6WsexP|8o&S&^f=tsuLkKcW0}5o0seX`Y
z8jwvooPLlI29VG4I{kvcxe4Sm)0XKGtC-d6?fpO#FLJUVb8_?jAhX*b)e1-bzyk{4
z#LY3)4>G$Aa#zn3KgcW$r$};T4uc<P7Di4Ml+w#q`+)`)AmQZY;s=_Ak&^{=%PqJ0
zfhM=*WCfWR7>aKDC4wCy0?L&ULVii0zJ;uqNKrv9gI_XON)puFO?W?Db~UqZy@@3Q
z!-kCpQs7(yPUi;U3=G2T2GW9Ho(`yWF^Pdej|ZA@N*EZ@!~7YyvoJ8|{sAkIF=Aj?
z5yipAD8$depqIwaz#zYxjZqkE7pR#hx}S{^H1Nx?6V%>S{mI4%9{AnKVxO2Z{p4z9
znR<B!2IeL<Msa44evp~LCM66EOHZ*e77H>k=*feHbV?W)^o-dU%Md~;!VC;%COrY{
z91IM4AHmZ)0UY8C40_){VZLi$04Em%gWhjY8g4xszy)&A4N%{1<Fo*7ZUzQ@l@8F{
zh2Hd(HOv<EQGte_LCc*W%YvjV85l0=1{#4IFJKW#O9qAmw*!q4A`+Gi3>xx*pp)Vl
zkAl?*STZmuUJrCYsNu0>U~t_T=!g*Ewq#(~bvV!oA;M+Jz`#2>D9{-p#A(UE;5j$Y
z1tG%0#=x-bY@nMU0|Q4|2?K*gc_5P}H!KbUf0QsVaEAsmX~A^_eqAv=cP+CPBm49j
zYnkQh*#emim>C!hj4c@$1P?07ftH3%0=YWyO9=ymxQY^^Ex2z37W!bxz;IYPNDL(M
z6)f_`l7XT1M34qT<b@>zgPMAf2B>O+sCi<^z%WZWXfwj-N0tl>>9c}1%Yg<vAhta$
zVPH^n4Ps<NsCvN0z;LjgLktxBH!K+#gk~ywA?&#$%)qcgQ9%>b*fIo7`JUC&1lLyJ
zvaaKkCa6GW0OzHMPEAmW%*X-COAefxpb{A}jbkbutqHEKz{BTLoi+JEMbvUoRbT#X
z`uTOtQuW0Gnvwzx42G+j7#LK4YJ%n#7{FHaOwok&h(PJcl0_5LA7bR-0Og{tVog~t
z1_r}2Ee3}2Bu#m+540E<_Hb${zy{9w8#NU{;$O8G7<8{|8iDdraX15m;F;hI9&p&+
z$Y2TKtY>9lFcJ@AU~oPg0-8KDst99XX!Z=@mSSKqdJJlgE#Vaj0rjMeib0dSi$j#f
zz%rnT^H(7%peC&$i%3CoCPRoSc)k%72#(uB)W9t@P@RAAR|u#gV3-7|f+uo^KxzU(
zP#!Q6ujd2VFU-K;{gfvJ)E+mwm&Cwe_!X3sF8&Gu1tr5I7Ln8fh7fQ-f>*eN_=bQ3
z61>92wl@UPgyp^#0`8oG>+I(85J-EL3v5>{$f{al28IcXWI{kKZsRzSjOl3`nEC59
zLnOey0tL14tPsd-56C0OyF;Xu85m5WK_00n50O@5U@&<M^2lM%5KxRTd<Bg}+V+M(
zCZ|A6ln~z#PzA{_NfH!%zP2hMpdO>~1Cjg!h7esz1_o0tknf7-hUkGf`YfP%Dd)2x
z`oathMxgEQ3_L+02H=1N*}Bp`1iTsyJQZa;D+IJC0y2VE%@G3bM1m7n;=T|_l?O^(
z)#f3P)~N!hOJN)bnyBvM3|Yki@(O4zLqQ05=nlO6ZN|#_5b)R?xJwb?76Kl-19!5t
zRYSmIci?(0X-CKgP+10!g88#UHi9{zp%;hgA)CM)P(5T&7_u46;Q-tHRG5Kbc`;|m
zHjv$qA$D&E%Yy=8#>$W#;2}w{-COsEfXC^;%d{3$hJc6Zz{|Asy+XjlbYO?H>4boX
z>A((I*b@RCrUR!1w)_zAFx@1OLyoG2fQRWOfgNI!Ak4sEUnLM?3A#oOG|}&n8e+xG
zz+mdZ0Gd(^t_ZOP^FV1p>r99Zm;*`!TRu&nu!-5N-iITk7NmC*69Yp*Tu2=#D}w{j
z*ewLoKLgd)S;`^cA#QN^xlIiL4{?KMN0XgHz(d?S*+9wBG+CH|A+%N~1hiPe475DN
zsvx8vIbgtp)ZlQ@Zwr~k2|7>*Y^X<Z2zXQ)92Q2hA>cu2a9Cs<2$>2t0Te0j-$TGd
z(%`Ug`xG)ABm>SD(~pFJN2I~iub%lK;PL34ptKfh6fz5>4BTb&x*9SY%mGb^dP&uX
z%mMR2i9g9RWG<K^2uk8&#_S=7IT#qsu0x{t2v`aly`WJ~NQ=pjAp|_=365Qd=^@}j
zPjKwkF@}H#J;A|Lkr@IW^qj;7GJE=Lkx)=xH8%#0o1XRy1+`uw%`sD@Pzi7xfPy_I
zEfkz<!66hM6ACFuL2<d}Stz6&1;yn$&QMUUW#j;N{hI4sLP4t$%nvg$FsQJFB32{p
zJ`##pjZiNYs>aC>4w?^PVqj>y5sFxjAiXXWJX!?KoT_I-!P9f#UdxJkq2P8cICDnF
zhJr>e%nySyXWWEP@W{mtP*-lQ!*tE9%sMgNE}@|2lm%$rl2K$RxHSc?21*q|lR)7K
zu4ziuLcxtGaK}pcNN5UJ1{8Bfp`qXj9I!)j4u__LWk6+9i~aPCTbU&ptEZpd$}HzR
z!@(i68+6{;F;K%LG!(Ls4is5AheLb8x<H}UVjtQE=5UB4m8LO-f>NeMD#)hQ)zfvh
zG0W8($b^C7!ZHf9aKtYRJTVN;4yH<B;HUs6-JG;Aa8!WfW%YtENK}AqSiL$76cvzu
z^6G72knuf`4Qrl-fmgAC{i1O!4AR8_`Gw6R4ARArV5k>nU|8|UCJfX~xBL!{zc5f3
zLn_bRN5UXs46;d4D-1GB2TB2^N@1YYXL7tCo3y&az^l)|F{aEI2A&%Q$CzJM7^Kt%
z#h9sH7^u`$y9Mf&pVSWnmAdr|H$c7RRnB3MVi(j&Ki(Y%DRwPDNq5y}fiO^EV+ESS
znClP*Ssx1u=>^?k;Ds9CIGt1w23j8r2?tZ9F!1_V$msM`K9(?0kHabiv|!973^H8`
zp7NVpZ>$goTK{Eriiv^Y(8Dmu>?O!_uAVT+<R!@O89T!ubC*!RL#8f4eh=9g2AR18
zW$4vhVUTVGD3qskhJm{k;DAVx4hse+1aPm~%SRy$luoTBr@QT77L1b*gCtIn>9cdg
zAc+%Xde4+FNa6&UZmJXpnrf7i0uPHN7;%Jw7P4A{#vxMng=K+_2f18edssG@10HHm
zy)k|34rVn*rRjHeFw54j69@yXMzuZx3X6SV<zR(ST@_#s$iL=pVU=JG$VI9@!>Yg>
zaBlB17YG9t+BTq$P0GHodaxAK1aO%Rj*r%}Vc;?woX1R+!oX$r4W4>XlvWnAhl83F
zHlP)SmdC@vy$x`ppRqC=+}Qvp`h%L`;Jya9q}%Z-9I~7O)CXJJ7Y<%d0WPj1o`yqm
z4Y;IB`ymh^%E7>316m5VHYNhB30wr2N=1l+i+`~D)>=h?b%EViBo+bAYd3g6b&5@z
zFaty5B7q3d=!DICCI*JJF%gi3R3LA<=0-qDE>J-A6h=TwE>J*4zK?*ETs)u!wE?pj
z86rSkU|S<528Njq5e{4o3`({}ATt&iM>ukU2Dw2qSJOlzoWLAV?<P8S`ix!7y7lf8
zBHTC_80_jms|6J!+`$S!T2+5Wcz`(|>&vwwJi#20^+}H-yuch#$}zT%@CI{0DaYkm
zgb$blN|yoiBmBS|P%BG#cZ5Hf1InOV{UQRu90jI&1_n>9h(It8G)pPAHX;bj0nJkS
z1x5seIiOj}R;Gv$Fb9;6-6A8xz#LFMmg0>F2XjDEk<*<cBETHbT(b1Ph)6I8RCY7{
zkB9<uKqF*A?;~PBoah^%Au^$#5wRfN4bb$Xxm`pYm=gdha+@OJxj?}a0v`Lk!N6eG
z2Wp!e^MQh1<bwc1Bxu2>9cY_Lxl1Hy!GgsxaF!SIo-VhCSyIz2vH+ZNLBZH!A6W?I
zfP%4GHnIrP>IS7%!GP%rdzd8|w@$Cx!z>5t?1pYqV3ZbOV6ayKwg1I@<QW*!CMqyq
z19cN_fJd!BYr;C+6{0{juKh%j(&8kBC~+ZB3mp`Jo!g?oDQ_nzG8z^}Ns2Ns*iQsS
zhRD|_DH#R^`)S}6fOc>AK)w=YU^r7E69sA*+rOMHzL#0Ry*Nr9q~|5bwH*3U3Ze`Q
zMzx?w@7xvz9);TpGVP#o6sW_&Fi8s3g0x%3#=x*pE-FHrfx+a3FayKF-_!H<GE0VJ
z%1VhdFgPfQfK=HA2{SO{Zr70oS?ACslA6LGD<{IhV3P)NIfuS1$YP^fP?}npDXRe1
z2ueA+3bKmeFas6sd7aa5?`4)3Zjg-zTLucIz!Sm@3|-FCdG|3(YCMY;2kCqP3V?-~
z(GnoeTac3renx{r!{HOiOo!6xe*2hZ>P2FrL9TIh6)DVMhz7aF{1M1Cdy1pw#TXbI
zU0p;<Qi>U(<rP32P_ofgh*ki*29#_#^rJz0S&V7}KpwOxWn*A)<&RbY#nx9g1_s3~
z(Yat(S~4(9InB-wil)b47ay@?U~pN=9xQ+mIv~uzz#7NF4jKq^+|9(m5dNPXw8aC`
zl8TOHhpZ_CwWMO(*+D~Nps_|_28O^j%<P~7-|-C-1H+12({1)M8{0&(FXv%kaD2nY
zz;Nn1`wkuk27Z$S4)(8{3=B@L5W~L-fYw`qe9Ioi{vFJL7(RXVerD-t1@>Q{eNo``
zCEj@)?4LOp7@SIyK>8U#gQV5J*#8PMFgPWEJ+woZfnjgALkws_!U<IVJBG&~CR5G}
z#fXA?Z=ie}ux+~H0cNTC1o;?H8ge#dVql2e7y};21sA3(Hpf7kd7$j09u)&==7AEV
zX>JT?4HjgsI`vcxq|*wT@Yx<81L?Ga2EMY4V?d*qx_|gVxh!H0Z;T!X1A{ZDcigEJ
z18GixdlcaxV<7DbkWI_{Vj%4akWE_Krr$ikti%{Q{m%hrDO;0RU2c#G=`yh(?Jl6y
zrD7Os03K8U1>uD0v4&s{C<u?K#6rf0K*NEG#?yljGOICOn_hL0S=MWRtU1V}_33i4
zpb<?MP`6_Cu2@hvhXFi=X6_aX>g6ziYo_SfSWqvAUj<Y%O<omi3$g>;DJZp={_r5P
zY=T6rJvRe`i$OYbENJ1D3n=BRNs9%KB7w~l+7}BMKVkxnOSmh=g2s+qrl<47f|h8x
zf<{0ca$?;<27{}~=-5~fFbCw5#Ff+I4lzqvMaF{mA-NpSkc;(aWnggi4r5^O^p6dY
zVqkDl31eVb?hqRYVt0ozFa(Fk21zk6xUz;ZFt}?@-*kvsv%W1hlpCZ?n1R9Mqem=g
zA(bm=^3X9nHUiX*jsS&W(cIWbaCaM&N<95zqrgc9RN9-n#YQQB#xy{sy?kVBlqQG+
zD(x-z#YP!}I1VB?rFjgokR@0ypm^^#5#TxmI<r<DwDQ)|p9|Chg5)MsC9Wf28IT`)
zrcAFm%&g_?%fWRLB<KY;i3`-j;rjwE)+GfwxXyy4KpmW(DO`}%8z3h~$8tedZ-5d|
zxBc{|hndybmVkUIJ6-Syvm_snA?VOb$TqN(Y11u^Fw53&GmH>rU~szx&NyC{3=EBb
z3=bg&y*z{&7=rinXwBqcU~mU5t>2}gH4EH}0@=vLr8OJO0Xe;fPYbjV36fTX=W2mg
zA~AsbYdTZ35G#??6|@j5kvs$ZwLnXeAPZBM+}8r_uwejqLD`+PAX{ueIUub=3$n!q
zwDLA7M+-E=%mAKT+`UT+vc-m*frWvA#e2HSQD(*ZSz64Wl^Gb^&k8dzXkC$r1C6(N
zfbz-u>2aWmS;)Lo>)ANa#4KbW?&7aF@Z8W1@Fb)AebCv#kcHmGbK=A$85lf7v_OZI
z#z}xnRAB~&U4;(1pp}vyplKGza9!{iOay~SL9$FHgRUWXbPJSvI=AV9x&sV1K&j`z
z>gf-TGE14hbI=1d)jh6(=X&*=APEmVFsA2>q*V{Ht`VwL{}{7a{YuczSz~2gJ_ZI)
zDIEp|m8lFm3=C~Hj5-VqR`E<a3=C2$m_h8<EIJGf6)~(j3=Fg5*>o5f0>asK7#N~m
zI2h7pltDcJPf-8yq`Wd{>mRfy6rk)Uz`&s12TDZlFO>a3BkSOvmGUj+01#*Tkz>rV
zd?m^uAP%^UTwOZ-{V`?<e)kv3;b1{f6{mb_y4Z1MTi$BrAa0OD!x$KZG^ZyVXO_@t
zvrq<gbi59UB<H3uC_|Q{gVNKYU}bA~dMXW?zTh~sagLEPD4-xIgu7Z9G>ZaBA+ybt
zA%O!*A=)9zkTsv6=0W*4W$+?T@U&ryi86SN=T6YH;m!hO$O=!9BnAf0>k<s<0?Ns(
z3=H0&8Nmaqr`w-kR&!aQoGuEgjzB>$VY+gLC}?FFsBCIItDFhi1;W7rYJ5q%v2ZAZ
zDm!mbLoKgUIT1Wd4DyJg<n)y%n9b|Ml?xyd%f!H-H%Ylro`J!84<t<}7l9jMporbH
zTDcg+*$FC94y;xNpU61L3Y_(oOThtR4XV?<Kzju?Ja*6r)h<4uwuxi7z9z&1aLUow
zLP|OM+K^5F$c6)}^+AJ*43jLthU!ChS6MQwVq{>Lb5GxZ1+-5RG!w}b=mJ{jKUqTG
zl%IjY=Qa}qLwkU}IVj143uOHoeG4!Ll;bNW>sx|3psFR~g1!})1F9WNi}bB|7#Qjy
zGhF`f^=-gXpfGfB(6<G1K!Z-EC-m*W9MAw<%|U&85C_~-k+sox0CB+MOq0s>9l;z>
zg(~n>-wDJ4CrYOC`p#gE2!j#>gVJPu7iI<qA8>;;P)E3)fuSiwL?1L!<~tqY6@QRw
zm{$V89FSLf?ezn}9H>`<z#OPog25b6YVd!r9|Gn;eG&@hKz$Mh=0JTC4&u~<y)vm>
zKLW%9d!_u4ek7O!@=C@heaI4j@JbdgZ3F#S0R{%YXeI`RExYyOK<Xwjh&YuNGw8>I
zIUuK2PS#HVbD&O51am-6-RrEM1m=L8de%%oSryC!x%HH}ehQcab!#e^199v0hSSWF
z^)>n#Ah8=FBF-*O4EmWopjjJGMxJP{p9Piy^@uuz^s~Vn9Z&^+C`Ug>nt{Q0x-bL7
zlrj!|(2Wj$psiv%Q}iMI3{Ylh*{Tmo>ntEWYK;2D(hLlK>B0;Qg&Y<-p!rh2yG-s3
z436PCj*!I6#K6$GO$Rc30m>~0R_j3KOHIJZR|hm-$}q_kwBBikBu6}BG3cyxQGU=C
z?&<Mom`xp4GcqvbJW^n+Vqoz12hI0=if61AXJGKV3!3WdSBz(@;Ri`^fIC&j3=ID9
z;7%1Q14!r61JkdZVK!r&H=X+|vvmEdc*YJ;vF519FqILcR3Aj#U}Ru8oWQ}r5zh!3
z9}5J{!RHjlGxqW`FfbT{tg%dsXY2>_K<l);)#Di_f_b1-a%Uyu87F~xpk;9)_3?~T
zz&rtd28I~sc*d!03=9lkMfe#QI_lrWGfrb;U<h0+!Oy_3y)2$_I#{U+Nb-9;;|!48
zW(^SUQ#|8r5bv-<Fatw8TRh`D5brV*Xd$`C)p*8*U{jd`f*BZ=UyWy61mT7RGcaTd
z#WOC3a3g{l7=#wZGcEz!!W>f{%)rni63@7TpMfFpF>^vN14C?2JmX4;bVD!$gV@e^
z#?=sROE3dN;EQ<1wGeJcFatw=TRh`B2)8Ggf#FC@JmV$^cS0}&L)NZ%#?26mrvx)F
z_~ynlZh^?o2xeelei_ebz7@isvxbp@VcKNI9iY%>UI5~;Tw~k`=3M~sTGAPJfp{z+
z?;dfTe(M~wEaSxKKh81Ft9RCjXS~S4z!0>LpMjxJKc4XtsE<($il(yOc*e_M9w?d^
zzr-_M0rNo7RGt;jcoob8MN?m8JmWPm4-`!+J>wa#gL$B6vi=g!cmvD>#Zqm5JmXC;
zPllg?;pEr)c*a{`t^z*;LxXrc<84rKD^>xeV6|B+@r<CQt-&FY3=B$_;u#+^gAR~j
z0WJM(+#b*P1j1#BWMJSajAwib<}!0cGBAkliD!HU<}z_dGBBKpiD!Hc<}&g|GB6ym
zk7s-V<}#V^MKUn#l!<423Fb2kL^3eMGsiQ&0&}^9BN-Sr{*PyT4dyb-f}E9=JpIH4
zW|{iQ@r<9r!c06MO<Us`zks=nAR{>@#WQ||aQPz{7&PtU8NY$KU>jH_#xs5gb6G()
z6z+~^`~l{2NPuiu@vS1B@izwpLufre1B0bcJmX(*7=a?i^L9MrKQRV|py|mMnMLXs
z#4~}8oMtEnMZ-z8cqY)1+ziE_Xjpe7o{0&p4-^fe5%EkcU>+zMmUzT7v4Tw52a1NM
zSMf}2U^!4MOi7GqVh8g;8L7%Bo{0m@17##jmv|=70zZag9exIeGiU1KnYh7{2K)>R
zT`lq88(e}zK$qL8GsQFUg5@kg<;>D}CO$CF2Bh+0JQF{d=fKavFztLilK`0K!q32P
zeq}t9AeiUD&%mHq8P6mH=K1h5Fv!i1XA%bU0zgYRHR9`;M8Vt;eg+2NrSVK+A`A?{
zArYXZs@3sK;$XQL(253!cqR!jFM*$dL26Pw6KJlOp*V$~fkFLnJd+eyE`y(e!O<z6
zNgB+{;b&l2)fdks1LhU*Gcc4X#xu!+c_rZDa2B^z0FxpELs%F;14GZTcqSzw1_lNz
zP&5_lPv^VLETwnxS3Hv{sEo8?j$~l)bBSkC17}(mg-8a5b1v~r>R_(0N+bir>KD_)
zE;DQCOp0gH2H9c-S|%LN7SE&u=7AEj;_7%NU9b*;gh<e~sp)GjGwX&;<cVjB;$UD1
zn-5xBsuj-^4blP5#PS{SOfg^{C=;hljAsJXqzuL2HL(tc9Pvz`IwI_peMUhdLp)On
zSSiQ{XOgDtUtvBY?!pq!1lmFnJ~xShA?z0eLmwjp!@dL4g|0Fy*Uw-qE@FshItDHQ
z89~L%Oo4c&<6svuDuBw%Gx1C(AY7GT1_t3X@k}QnT#aA`hDFEYnNCSDFobt7>VVBX
zP{R}v&vcf7A)?bh9c1!3Q3i&vTMRQ8lR>=mU>+j_)Y=QtApR?GDGsvtBB*hy!vreh
zh0eq?U4n2up!Qw{+sgzh<3aXb0o%(I0vaU=GUf)ai~tSZF$HP}GccTHna+QWS%R09
zSCW~5A!0UY5yRW*CfAtNr8d0dlK_bw03C?KlfVfsu-q6Ja=%Y6y~eCruMy6`;GrWe
z3|@)mr=rBbAhBMCPYSfG1=N@HQvh{5A5M?~9Y_&b!NkCD;i^og7z2aedQh7{S3xEV
zJaW|o>K*63kVynh=0{!uZ)r?~toZ|}YdxC?UPS>OfN(TV1g)ar2xDeqkY$LDO$2r8
zBCmj2G1}dUpne?#ctEg4Y`WETX4(3DiA2y4P!wo|aqjd)@PIqG!?H9k5j@}yo<LMr
zNCc0a?*uiCrX5WL54eLTKG!5BLIyBFGXQ=GiI4?vpbkd(sYK9%H^@4tz{QE+X{w!|
zCSBOPMDR4#P65!+a_EXg@H`c`?{V>0B4nZ;)DfL7m<U?53OQ{dIyMnJPqkAF6dEhF
z6%s+yjM1%-(146TfkI=cVj^g$9<;(CCpC{D5i<S+YTxx=NCc17gFRtdkqGJ`gh6`x
zimMYr15l8axr?VJLZ%r(UXq`Xs15FSfE*q;Jy8eD0re|NL=qug1W=zT=V~Ho3XB1K
zN`(IE>8o!r8<|W=1kGwOfVXyb_$PuVwRXxeuz|WtmQtW5B52TY(H~1GSx`%cje%i)
z@N~hO%o_DRB1xdQjsa~D%AKABj%#qNoYhN$#5Jh-+A}2y6xWd5BZ{k&Kv50p18Ut!
z0xb_`JPL~U=-4FCIuAE_@aURqjR1eP00Tn|Xxq)Mef&Axpf#wVkjpmU&jtDJ21`8?
z14FSce;$|z>N%d1;D_u@;{i2KRcrVQm_bJsC^0b1cH%FRU|@)80w-u0K9Ipm3=C4c
z`HR6G1doA-C^0aIxbcHFFvP3|E0o{^*{a0AV3)}M3!xBnaMg@V{(8pK2r<x@y2=lJ
z#xpP>CO;7t28Na!{EQdCLh=j@7q;^=UIcT%rVGe3FqE+IGhRXn@vty3_<rPPybKoF
z#mK?W_?MM|AvSs~BLjo30^>h^(9(JkNBs+9{eMZ&fkz;oV>lCoBzWDa5d(ws3mJZJ
zZ5#_~=w1B9&-e!vL|++_7#LzTK&5KiNq#2qHk7ZRS~xGBpNSc?$F>?&3$HBTXJP>#
zCLqEf&%ofdhM$Q|ih)5O8|-Ed&{0Hh7#Lzti!s<SFc>R>W}jkr%QG-&N%J#p6b8wF
z6pCpWF)&y?<=|&d=3rom<KqWyY2#-G&kTMAmDcKCrWfC4)~R13&%n@E&(93*vVfL#
zF$=AbXJCk};AaMPTo@oiOXL|C*8byX&V()gVisCZ!oZ;MnxDlJzH-ZtC5M55X&0kN
zGHB^myfiq^B|}!>fl|&{y<~1sK!D2%pE=1qq6`elj7LF*MfAyJaG`Splz)`1lKDVm
z14ltw#!n|1JeUMtXk2$S8M3ezG}u3@Em;t(40J3?wsW!&m;*Ym==`~4VK7Gze45bo
z#yiY1^*MhTS&~8X=84Uqb3Ztf!P9r(vDC)oWJnnV>IWK%B!d>+LdM&UolAz4L7<E@
z+dmmn1c6-4H#r$RRSquR^u8y9r^>-YxZ)p^LDMUY;0?Te0m+c*m3mN7<@_TVJRT0-
z;H@Q=3@(qr1ugHEWJq}g8a+vrN`{n2pdj>$NrsGvgZ#WZG#OMLF-(#L9q#cv8B!d9
z0w6~%88ji!FbTAz#;770vYHn(x58AEti!=zzyLa{fPuj*IvG+PfeMXA!(`B~8^a`J
zCI*IcXOcmyeHp-qL3!y<KYf>3GBYR{vbI+pv;>$r8MF$YVG^kOy5?dsXi9@&k|q-a
z!#>qy$eadfb<c6BWXPNb=opW=KFOf*aE2S8c|Wt%WXM!Js3&TcpA4Rg2k%bo^PKK`
zk6BWqJsC9n$uJ2tao?zw4C>J`OtJzw?r1V(?8=&nfx$~-dfz=}Nhj}QNcR<V6psF%
zWYCg(hDr8J3=C^dC4*){876@y3-`$-yMsr5K(pSd2Fc(dtQ(-iaiU|Vzr4q+%X!Q?
z9-QB2PM5#WEM?l9Vh3uL8H3_{){GSJ*)v~3<y%T<3i!CJub_%6C?^Fp8lNNsD&=(*
zrsv&fR;mYWML)^PlH$eAz>wq-#=sDhmf|hRz>w4v#=x+wHN^+So(>xFS}!Enk^)-P
zn*`cosI(>pv|Bit36xKAyHY@_P?Ci}vzr^mQ<8)k7?PD*d>I(xR;45hF)$<>F}8q4
zv64JM=VMI&&BwryG*Os=L7nm5bb$xV64D1!f<zb?k`zHcsA*0K26I3@Fp8Y+{D8Tb
z(S7>%2h2u{SEj#u!0c5Y9IlZ9TA`K#T5ZX)J_WQwEv1YhB)_zTAqBKREv22!!Iy!7
z|6j^lP6mdQ89X2!YedR=kii`MAYRt0lno*b49R8uF1`#5x?55<3NkRHtmBXHWnc*U
zow5nU+sEGlGUb2DW?=?~lym$)e8B;vu|<M`A?1m{kC4nfh7?dAHF147hc9TyTMBr=
z+ShOeUr=Xn`t66za~K__S3F|Ys4xDX!mP~8z>q2@%)r2OSR@s+VllM~w0GAkl~00!
zA@vL>Fj*r~`N6IPg++sSD!BXr$L0+0RPc($uRJ121qBSL;N5gz!Q)3tTUb){1VBcB
zjum>A3dtlO<JbdJA(^BeG=Q{cV=81(JgDF}Ws(Y66weHbo7Ap;Mh1p1P?c?*#?HpT
zkor}Jf#I+RXn;A188pDWs1!VPbMQqPFDUg*0;!(`y12zSEgf{MqqYtML%tD6eZDJ5
zeSQRJKsrC08Pu||sQ<#_&dI^RkOn&J$ak?jxR?cx#vRFa2N$#81rg16+`;=fz^%UM
zSa)zK3!X}_WO0WK*@KsS^qnqo2Q6yJ_yI1p-F-o&I=C&-GX=^41>jOe2xk%psPb1_
z4dsF65~j(6Ia=+Y_RymBU=BwbD09?Z1#=j{t6Joxz#Pb~n|L!Yhv5dOoVsw!9kO5s
zw0NL{*B!E822|F#xVwWF%uIq5BJQ9CGxZFUbeR|!c6PXfSIq1L74`OZ?vNETpz`Iy
zQFrh@|4E=x+e2&ILqS!~Bva5rxe9mi0d<qizz5yAgZHmZ0_}tr<#&$&DZ2q0KF)A-
zj|6i-6H*H`-62c(K_!aXA@^v=8WvCvjr;B%16Bu`N3LGy4nCm{y!;^WzIz;41~jT&
zDCrJ99pDCNNzw9??x6h6FbTAEC~=cJD8DmIiUduWmbrr$_Dlk;?qb>E4qn(Z2{ev5
z;fOo9`kn;ZBP~|n=nh)h!!QZ7%OjZ69lQo@66hckvr2dH8nj9ApxUp(Jp<%~ouF+=
zJL}vt!5q->U6!le!Rvo^f?9YySKYzue|CbF*X&Al&jBf$1lnbtbi*Co+?$li#K2&8
z)E(T~o0J8bdy{c>2RHX7Wiv4_xHr3l7e`D2?Z!51o^Jk(S+&0Wn|le!q#FgGG%Ka8
z;to2=E)z64nmgUS5;=`QIM6f(=70~1QCtmC20p!Jnmm{TPhuct@FWJ}z>^q=!x2^w
zsxsrvz?v9tD1h7$d|$;KbYfl>XaiC1boVA?H$XU0H-I@XH$XVhWDerM-2mdi-2mdi
z-O$7;4w?&qx&a~uO6TjIPcMAVEK@J1;tm?_%mS@9$(`=ri|i5z2kH_q2j&t82kH_K
z2ksIO2ksIO2ksIO2cF?T98iX1VPIJIe7e93W|?|s2Y1l%TG^l`LGE;S@Df#6-UlyH
z1uuV^way*9L=`*|@3h^0HaKQMRpG&f?%)-w;CY1dZ|>j~s^FD<>+Rj=aWXI@P6iKC
zg-$kdX9TqxvTyQ(PBU_6GzWRQ{syQ)+A{^py#Z<=FI9x{CV>VI6<5P}oS@+!c?eId
z9W>stXg!3-kp^l#*IkA17;b<@t>mR3JdQBXs8zffgvW3LG-_2j-<{C{v^Z#IJ!sf!
z#t(N!OAz-4XuM^)n>!<DdoSpO93uvXsN+8FjG*bV9MI52?sRuX7m&l@?uPJS?gsPV
z?uPJS?gsG??gsHV(&}Lj2XPS&2k{UN2k{UN2kmTP*a>oXbgVlgXloP0PLR9JQ`{Lr
z>%JH{K!b1Lm)#j53%@|4ZF{%4GlEursrP|K+d%$>Ed6p|<!4}6?lxWb6|-D@JBtTs
z<xDPU@x{eo9*|x(sN(CH;sNPpgX%q&UmlQNHuylvT?P^!pe=g2+nE>`PBnX|sxUC*
zfYVR$UJpn^7L<|?zwm%GWI?^`n#CUAMR4F=_P$jfkcKR{Rxz;ifV5;miQI3a2dE{>
zkp`+&+T}bzb8q}EppL=B<sOiREU00<fx!c`76dW|ut>`TQelIRQOd0JfK=GxpzOcP
zPTB+1hRp-DDNi+fn8Kaf%i>`MIVTI`)?`@^NE;U9*28Z-K<jcKeP-5Q9-tXl$h>K6
zv4<7t&gMU$wv~g52V}|>G}W`U#sjqLlwlI+XvaCK9-wWfpk-B{O1|tnXkH`TiH(6F
zuSSP~VZsAYC4YW9qYgto1K&DOEzivcns!cS08KkD-~mlLSMY<Tony_}LEZ>=l1K+_
zQ_FkG#K17^O?n_`We2z`6CIllnj~fbulmj2mL4p~z>xO}<R$G(=^-Fx;OyJ9JRP)h
zg8_W>S8;247+4v2pv5RIJshk~1k|<6tKnl{$a{Yqv^QG(pG-Pv&@dl#kmIyB=`kQ>
zFk55698fzbds})OH>jHowKX0j1G6;&%mEb|X8GxfU=FB>P~4iH1kzJ~1QeS_ap}om
zDG88gos?wKL8r9lgAONDIgt+Tslu!U_ff%~wY;1TnOp-|E59!tG`Xf;2VUpYvw<TW
zbo^>QsBtsxO?m;Sy#+G?v@abJTq-BhC5ymPAS2B3)4^jC;1oK4^7Od3%rf-{Skgf?
zSOKU>pmHL;6091OJ)&dNtH2yk2$Y$nSMxA16xgtUC&eZ)Fcf&FfZ`nFor!ER>2(|o
z3<U=van}IW1~sD*%mJB^y)C^-2r2HGK{Ak8(5B_-Eg&8^@{BK~w}Ls)U~B_xf`(!{
zSVjUAkp<qu3=9+HIMTa7c7rx}tDH#h0m;Jxq8H2o*=>0_y${5>!NM?;F(WaPK_Go1
z14E$~XdG_ZoAk*bIhd{~U=B!E_O|q?V9P<Fr+q1X8b}5l?=ff6r-M1*wXy}jXEK&#
zGH|5NVqhqo3kifdAZeJ9bHN;tkt!$B=YcsOBhB*D>*s@cp#FDaNBRODkO7d1$4Lwf
zg=-*TJd?2`pMfQPF#|*41JLU96Y1bX%V4H20~-M{o%LusXf<8o19&tQzK0kg%)lU5
zppXvg6BU6vmrcvl*MPKngG)8ztLbY&JaDZjzb}0q4+DdG9jFLMPfA}8mH}1zYI5lt
zco-Op>=a<BpvV_){DPI!558xX49rNs0oDL=&+$p=H^Ch6s${Jiu5{1|E=Ai#N)po<
z((i(#z@9jkk$w-vxdGB-V2}<zd+i2T6DQ|%?GMb7GRxDSfK`A>P5FK4Pr)t(Z?a90
zo}Tc5S+ag#`YW&?cx!QilUVv&4hDweFp-RuB8K#L(hLkmzMwRD;amE9xJgr`(?5VY
zpivsuCFvi*93fDu*0B^z2VI$7TnBOOUyu~owdLQ^|AB2{Vz|S|z~KFk9keFO)i|9I
zbTWJKNgW0Tj+>wYu(1-<%h@dmD*rMaLFJ#D2B`c~FaVW*rJq6NUw;8;+09lq@MOef
zw&}JXnWZ9H&!#i-gY3HjY7a~nO=lEP0QrRvG&Q#KIe$7MsCFu`wg>x-Q5EF5CQy?D
zq)`p7(LO1iQ60pa1lHIUHhn$JbRCc|*mRyh>5RHO3=C?wz>3ZnN~JS`>X(wWP}2=j
zOgDmSJl~McXv_mTsSB*pymh+bCuS*mkQ3@a4XK?Vx3kPhX9RUDK)Ym&7#Q|cPmlV<
zEN!iu&Imq;YbO`TN6SjZ(iuS~Zk5{bGcbS*0H3(E6Xc_A*>pzGq0Q=bOdzGF^`>w5
z#H>|s&6&<P5p;brX!e-pS2`o)s4b9=+VAO%;7v_CLCqKWqI5>kv8xP|*!US3&K0IJ
zg10s8WCxkXG0QNW5p<<#88g(gGeMs91sTKgEu9h4It2OS?7?(KNb?Xh@K}}Nkj^+q
znt`D-T?jO_b~K%Ft|$XTsh~8-REKuybVkt1wXz7PsSDwzHZ4zQTm%XoaM*)PT@2=d
zO?60TT!Juk-}JqonPnLZrr-X|EM*OH4&=Nnm~%j58VomJ8rQ%z9@?1BxE4G-1a^%+
z!*qi$%u@9r1He1$;5LJ|*1-+f0x<yO0as~-bjIx*3=HLIP!H^YdjMn%<TNapJHXrQ
z;KuBR7z3IO{GQGT-e`A28Z^e7yCR)&FW6b~AUn3bpML8Lv$RfnIwRzmE0A$3W6~KR
z=Ujojwd6%Q;}LM^2!V8H-J7oXm04Q$a5^Js`6I(5kPhYabVkquNQN8S{Gjpd>5*TV
zW$R^>(;3fkFfdfW+<zX${TIN7g0zDo;3Aj@vare_o$(Uf{dt|~jF-W3Aon+&O=kq1
za>Wq_cD{BRb2=mFJgW-Oe50jJI^zwHQgD*B^PG~-2szOTv|U^!C7ls;q*cXyW>~RV
zu?|vf8Zj^wbF-u~f{wDP0QDe1cHRRS1a62oU7K$AjagQfjVYb+BL@RRr7&nN+$Npz
z6G#czu0`LcSA1iZO<lv1&iD<a#Fw9e0c6T|kP@&d^83;mf5<T~RQiHzg^Cvp43#l(
z`+fB|(wUe*I;Zk8Ff=VsXM!9b1<C@(SJRmwr$>Qv(!S}xzA?+zx3i=(fhK7x&+{`d
zq$i~_L1$_B85q>$(wRWhG?nMURxwOsV5qzYx5~eoC7nr>hk>CA)OWD0OJ@R~=mhph
z;D>Z3@QF@4!P$J<Qkirn(C}AP2e@CA&IFpt(fz}~&k)XVEGnG|Jc51$)XfkzOlN{@
z+6B$=bJ?UbK~5J2E%`~{NM{1=v0<1b#?QcD7oN@pn)73rB+k#ku%jWJ2{P*k>Q@y{
znEv)Vvs}ttnRF&a4hDv*i~I}>O1IOQz@yvXa0Gc3JiHC=&dKjfX9BJF1~tfx7#QlZ
z6w;YM1KHJ}P76pQWGW35j3ABRxiqlG=-BD`KbWQK_oXv|X3o^>co@<}1e6#V7^*=>
z%+B~B06G%@vfy&Ln}E77=#U{$YeA1qKuZ|3T?SMypREwk1<QaMo+^0)24Ic=XeL+V
znt&lQ14FeMXx7B{gAxP7SuKGn!l3aw(4>^m93=*Z8Rs<xrh-dyu+R)81_s670@IWk
z7^*?12QUjw;bUN^SeL`V(AzTI=qIzKQ$CNtQc(tm8h0iJhOW&5%RtEsTpO+l5da@u
z4<3)3!!7_m?hia3w`-rkO7J8Q$n`-P)7SoF_NmVoSk279P}2x<oahO81_mBR0p^1s
zr$FXqCX_HRFz*y#MyxaTeOto7a5z(dwGC9wg16xNzS+yjz~Hh$fb9fG=OobfS0)ib
z5dj8<njaz=41%B;T#Hl&(4<``v!EEr#`~ZR>+bbJ0>U7xeP4jM!9s%IDQe#*!VC;5
zcN8)}hm+TWj#Qs*mH}GK2U!a|@n8mMF&|_t@X-eu;Kh94p#i1i8Q{fy;B74ar!pXG
z`NTv($4F&>*7C{mf?NF72|XF0V=?O7LGiVzFC!M@ZgAVH<4i^zm;(wWAF&MZz&*H;
znROxqyngQnNRQLG4Dk9ru(j5;)9rpUOV;OQq=U7BHc-V~$N={vZh$sW<(<y}_akm}
zz>1tY8PFuXaXP4JQ~0_eBZq^5p$^oVoNbno3*P7tY8+{^XXJr7pfon|U`9Te18Rt`
zP0j#yG9YIaAAOJk>SS<$MqR)Q>+bz#mS9SJJ^jaTW@E<H({=tZOS&;+fcg)04_x6+
z_yBf-703zRF+3Td9nkflt2va^GwS3R80u9)POx2)0oq_xuLTMZCynXdf0$)7%p5X6
z_dV2uCb}HMGg^?A0%o*=x>-j+1EdF5Pe1>MS+ZU(qeGs7p}yGyG;Ce>0n|h7`U>i;
zm@nXCU}(tEVPLS+1vStD9YGB=!8@P^TI+XE18uu4sDak*3~Hdcmw*~*%X>f#H2>Kg
zIt&b_95{6t7*?rq=`b+Vm~-neFsQ5Z=rAzst>)EXV9@@-r^CPyuU5~m!@!W#C7{E=
zFfmq8hk?OAO-P4<!IW88hk;?{V-Xz&hNTZhbr={nn~Ui%FtGWH>o72w?UK-8U{HJ^
zsl&jaIv2Eb+vkF`4g-VVKUt8<Q}Q|t3_O(zIt&ae+!b{g7{pDLbQl<Pot1SM7-WJ~
zKoc+x&lwfW?{F}1Ff@RUVr+Ob{oP+?$@&?e&F@Qr$_+*VUj_!RWb+3Qo=8Y?F@yO-
z2uH$~fq^H;{1ND&azjQLP?TA>F)%dT1xFcp0)56#CiABp3=EB+5rp;A&7XlQb5NA!
zb(%j1a~MHUJJHF<{1r&u1MsG=X!F;g^B=@P3iWrHzXRI`>di%%o4*HhK%)z-W#%8i
z98f>QM%(-&hyy+fdwse2Cn=Ci6hX&JPBQ-t=76U6*q%*)_>b8}Bi;P3Gy_B9Pf!=u
zAlm#Ni1QCLsx8lG{vXT%EvoXHG~M+-vw759MjLZRW(J0)B7O!2+m+^wEFc4OKnr&`
z^vxMTGt)-3;DtLWv&|XVLGHN0s1wY<Ft6C0kpsdtn866z$!yNZDGeGHU^EG4V3@2h
z{n~$KdB)Szzx`)cV)U9S$>NiJj8PG^M-H^22(&PtiGhIuw8)Kxg@NJZ3v<Tl;7wPc
z4Olxfr-9jS3=B0!S(2bzqO9~87@F1H7#Mg(v!p<?)Q)Zp3<5=2(%>j@V_-=5lLcCs
z)eKsdoqlfW1r|f8^I4!-gXS2}K?&Ogvdjb+7@7|;F)*ZGnJ&%9B458f%Z8bOp?Q`t
z1H-8X2@}v9af?29e#Ar?RHB1Rq%F%$z*EHF-e8co33!SaTq2#UHvvx(gG;2<H%-7(
z#NZNX<rfq1_}LBcwp?dT2@}xdZwqK7e*JV4HSnc93{0RCSk9V&7NbDQ(u==Lz++}N
zz;jfcYdB0m17IyP!96Y$Q1u9@2V2ih|HR0m$#`tK3=@llX6soK$gC@<h&Z~|1U%~s
z9!`$>WCGp*4IW&N?wlUW#3Ez%O27m((%EVaF&1((G$=W?o;7g+`x<19z*`g0CIQf~
zD8dX3)_l{~GqFgxw4OBq?S+6G&cbon#24%n@E8pHRt^);%@(aoL8r){HGxdjfXv<9
zX#$?80S6$P#&m9G7Fl6KlSnxRhSo!%GO4wIje$Yx>~w2p7KKm-1rtWl3g)&*eg+1&
zohFPBH-TCXXZ1`NL5^Yow;Y!3F<}I4g<`k?8bMAMG+_j9WViuZaUm{e!sr3^3#d(G
zCOUlsGm8xWQ3(@9(5PD59<b5VZ!@z<>0JC}!U&#W0&7%UZNdm~IYgrgBgE;T#+1F>
zbVU{x*?RpsCXAqipxQyB%onbjFh)YwYVk8L@b;N7Mu{^pv@7(0+utUP(ct2E0;nUG
zWWorUM*^*1F8^l27z3JxzA*z71Z|N<3=9I5GA4|VIT#q)LCrjn!=8Zs0P_1ZH510C
zV4eu5^=T$*!uSl#1$ln)>**I+Sfu3=Oc-B+1;L~7&i*ncjG!Y}+n4e)Fx0S4=VE1%
ztGCXM1LYnoHwK2ZZQ1dX3=9mQoYaz^odC*a#%>G@yBM+)Wf&M3bU=HaFA8LXYNig*
z0)bNY?0PW<hW4|dXyrVc-2mo*k_%^bb|aVrswtymvzx#i@G_y9dD$&G3=Hj{<4VGQ
z*9&BWy0#sqB6+2`4B4Gvbs*zf&t`XlIZ)%e!5olr!ot}-U=G+gt%=!v#taM{#&;P7
zvKKQmFmx;lV_=x<n!Qw+fuTb^jDca@*6d|k3=AEm3<(_BXIU8-IzSs64JKrtmttVx
zfH;1^ujzVhEMiVmv#&@pFtl$4xuByr`zn|N8Ue4Hn0*b*0gb^3$7f#$b3j`MWIM8N
zfH@$C+UielV`EXMU;Dly8*~Lq7bx|Yf6JZ>b}-1)MHjQDfjJ=M+z+y+gE=676-H#w
z0&_qOn$ykMbHN-?>%ycWdjXgOsu*}4WiJGCBt%LXvX_JW(+H{-+!klA0*mV~G1N1x
zxs$yb%mdZ@%)!~~z#P!jXi;+ZdN2nx=c%?edlQ%gsvX*@vbTacpxPnjSoRJu2Q=lG
zEuXy`%mGb#=KRgx1LlCX&hmw1?*(xVf~GvZCuQ#gbLxYb7#P$#viE~|pb5|jsq6z_
z4(O&cwx;YuAkIzDY-s(f?86|=S<sB-y5{U7U=FBgEdP^z6wCq5OZu2)9}@*d4QReG
z>tpsQFef*OfuU0YJllAbQ6T#Z2LnUbbI=k;R^#mNV7;I)k6fAk1Iz)1`RV5A4je2}
z_1h=pfQ~lm2A#Qb;cAWmB-4UUF;~bD1n1HoP=7&fc@AjUg#onklUb+-bR<|}jt%%s
zTyW>0Lzsb~qe>tb)aUC4jacVS&xLmRKo{eQ<bo&a!DU^~lw8QdJWy=cFFTS8S(yi#
z_E21%3+m57Hs&q4mJ907K~DW#az7X3Ovql@=-6CPXHHHQd>dGNpH4359D^QE$mLGY
z1+T>f*HJxFav^ImK_1@tD;IKl3uqWsadj?aEoMDv4d5z;Tq)2odEhhiB&u_zxfmFF
z5<p2#dU-CSmIEcNz1F$lT5hKT=z6C&x!_t3eD{gr_gqLV2b#lYEzAYiayvnD_^Yqw
zf_jP!lR!&^qGNMGdxRM#X@i<hj87RDdg=?n6*V`gO*AP`Bo{R6(*rsy@#3#s(4-G!
zho|@7Tu_|{Io4*u?Oe#D4=4{#>&}Ht`hfCauUsx-1Mtc{xrX3U4;0MNvALifgmS##
zgDLu+a^!;MBYXKkL)#aB<(h#TW}q};P?rmt0RrWApUPa&RADb46U@E6a$x7Of}Fdf
zlp_~3^V6FPT72>=7c%h!GQ|6DE@a{dWXOWsxuEk#A-g)uzvV(!I)R+Kt}537H0;L!
zIlxhLBS$W%it7dKXuS9<7qZ9+WM1yUT*x9Pka_w^x#0Q@Jo}ORAs4d92^7ONwYi|<
zMj<Ocg|6j-jx}HaAJb%Qo(sBlhG7zT8flLzvl|-+14HjWCI&eMCObFKxq6U*KA`Ld
zK09<LxRKhTHob_OMNQhpjZch$q0bi-;Mrkrkc0>t433VSzL}fFrQY{J0Rw|bp>T#I
z8v}#NPT|Aq3=C=7Yzz!8=Y@}ergSESGcbrW2_J=YB=3NDeZt2eyc-7?85l(4gc(7b
z&X|Q-au^uqtYc)z1MM`J2wF4XwlfcMx+y3u&g$iXT?o!fLCtxfOjZv$%Oz||9we86
zO3q!1dEgZ=;D(n|Y#w+840v)n<7OUc1q@`GJWD1IGD-qU;BJL^;H5#}bty?QdEli%
z;G_4Ky5@n89swV{pM59~GA06Amm+gBPYe=?pdxni**tKL1MgHl$Cn3Q{S01Ka&}Q3
zc;zAZO#S{%d61SQsECcYnFq;ZpdvO;J`bG7z=vAo3+93I7<g5QP){B>TipN^vH3sp
z!0QXat4a#$#q*TFNgY&>77FD-hGRhMMQjxEK;thAH$Y{Bno}OAjmdBWRH`aj<$;=*
z3^zcfYSFYjND~uOs_qfbgAB`nu4gOu$%Bl_fX>t}j?V+HaJ~Urjb4(N2RY=Y29$}G
z#O8sv(lguu^|I$I$b;lVP%pcbKM#@*K?m%Y+2?`sA;S&O>bL5MJQJ|9K?m#~s?UQQ
z<pVlkU*}^U<a}SyvDp>+d64scK?m&Hoy&tPECd~}ue=}++{DcXUv0K!OCGq5dt(I?
z14Dv)9=MHr19TL0;O{&;utlK#*IpTU;H7;xwlFa;6sF{Xm-gKN-E)=|ng`l+&v0W8
z69Yr)yF6!328M~%2S6wJx934xm_L{p7@UfyKjdSPHCUJD&dk8jcQxH1A2gCO5!9Tx
za5Y~{h=F0^2~biMm&+FiZRr5VzxUzkdi*SE_3HVc%^wg27cS;2gH?m-U^CHt6|ibh
zu(zJgR|WNlCY3OxyX1pHb`q%iyl^$&0IUIIyqRdeAy@-Q_xkDiMqm!82Je}YZw%%*
zFr?SygS<XzJ`)3jfO@`tE?oPCi}?;<4oJJsxqL^k4v^($g85Eh4k*rB&*nRWT~fi2
zQIpTZ%D^z`X&3{;)QkC&+zbp8r-v~xh$rWR4j-I&BaDGTPCeg*n}K1HSQrDtDyHcU
z0xTN!GaB+i<DHX1^YWhl`QTM*H$bbRC(UPJfb7N2_hw^Ym}~>ug}o9q+Hk=YG}^$k
z5j5J+z6`D^2&5`Zhk+rG38X6YA`|G8FvIO4pgXufFbg$=GcXt)7EuBfEX+a`Al`YA
zdKD0t$@hvS14ECVh#F`K2V@wn#FByGT%rhgO9w=xppb!K$|jL;1qO!68~7L)3_)Y+
zszOslz&j)-zvE|MxNud3u>{ge;AdcP$`N5K1*NU8pr-w#JtB;yprHFY0i;oSkAw*0
zEznVQQ$X8yELlVtK{qupa)6rdJyS#&??5_A;8ofpjCVoiK+g4_c#=&7+~%K>2bv_9
zBEkr6^Mgl$RoO)tK|>4-lRyLKhFKzvkU<8}(fnJ2MHruhjM)i3YJbTQ2N9-v(3u5O
zwu1T^XGNHN!HZo$4sgm5VFDlT1D*nkjul}7pYO91GzGM4p9mA^fS-vcIKcNTnV;g2
zmtbdLm~tnKfk8%89@Kc?NCO=kaY`O^+?X6MX!mg1LV55+Iw&led@q28lvF|(>KPb}
zMOD}s7^Z>-Z=xrH#*~WWLGhRW9~8@lSHVO6qSXuxQ#HWVD-&oJ#D#yN+9DuL;S3C-
z6GaUnk$3{cn=5Jr;T<SoU=Up?YRn3vw~CsuS~4(X<%ycIf-bfKk6`W)W?*LUd_4V`
z5Q}Pk>se7yc>(EGi_3|EiVMiOp?f7o!NtW_&@juzU!t~B3=C7=f$D^n1)_G~W%=NB
zWClC}qM!xI(?IoiFrO%>h=2@#7B3Wa0jbLdcYD3gT8M%w=4qNDMGT@I;tUMaG#Nlc
zLe7@c`-NFl?L?21f_8N<FieX!0bLqs0_G_(Fc=>cE#zZhn3fB6{uU6^osEIPJ5Y2p
zXcY4+3j>3E#`I6ZELy7a3=B>;MHvH>85pLm04Wz)!@|J8c~F$G0;Y6Y)pSP@7GaHF
z7D@sP4AVD)%8mU@7RsPBdIMCLC9k!BlsbQWL2DDH*NCum^G~!;vjdNXeeq>rIIlik
zOq9jc{FjB600YBJP6j3hhUB#t+F&C<y7n_!fKLy;!3eqmw&1pfE=ZjuBa1HsgKFva
zCQ%kUMn>7`2gO)K!=xD)85k@;OL1miWny5+J7{4l#=tPs7o>B3zJ(c>!vx|@=&^v5
z`Ya$GyR8LiEzZoVEFe?op0xl~0*o9DAi3>f({;pI?CV2cf_;66k%6J|)Jr8$fEF?^
z%v(|*3d->}3K$q7z7~k_3o|er_^VI=Y75T-)k3+`3naN17-sc=Jk~R%05seKIYM7?
zbpd2c0H|-^8&&|RW5La0p#n%93+jovT`B<8q-u}`#UbVbNL30R9t5><XUzd8YH(Y<
zDrCBV1dAkN*>o)l7Fou==^hd+J<d}(ia<Sr*`44`UPV0cqm6YHig>|&5b$DMVN;eO
zP}^(vM$j?paz&6e%^+tByG$3CWRaCNmnZ`D1m=L;D4tvd>Ipznr<v$<e@PZe(+fqQ
zoD1>Z%7P-$c}@Z*0-)^HDp4c@-ftqzz#yJ2Pz*Y+eGX_{DQETcxsogrTIJu0LG$Sh
z;7#~Ok;R~)D~6rm#Rb;)Sc*Z@I&(l5mX?2;eqWMBf~n!n^q-O}GK{OIi%GGl)vsbH
z1~s|o`~!7|z7>NT**h6TGE*uTia}8eS&P%~rr1)Nfnm-+@YL9xMGOpc`Px8(g2td0
zx4>0_Vo)o4ZUA_gpx73a28}@hu<BhgD3{I+0JVdypA_3mFfhyw1-1N@{uDciGceT8
zjp6}~sLTOvLYfoD$G|Y>q#FZ6=Imln=A4@iGRca8VQx(_Xb4<`88lRE9-^gC3~D#e
z1)asT(y|z|mS%1|D9s66E%p%vIZgwV9;J<neL+2lof;y(3=F|_#h~*N7<Oui`7$u{
z{3`|xE{V^5qX8N|R^}=O-}?Gh3&acGIXzICMYcZY6Gw3<2Lr=AQ2&Xux)`)hS(zW?
zv7RZ#;h^f*7@Pw3Zxty4?T4MWoQZ)U&9DTV0>E9pV%ri((-jl|{X0t_O;=C=oZ~A2
zH(kN;R=uPI+;j!+v=izn0X1A0cGiQ^i@93~D7`RD5)#QQE@CJFw__)PE(cIoC;_!&
zT|`7cQ$_o?mVmZ8&I3)rO^OsK0WIO1584f4JGlh1fDh#E`DrDft{kMtX8EcF(w75u
zAf}%yf%N5=MUoPW7)taw7^dgQuyAN*mVkP4kW<{vL`xtoNRSVDrj$Thkl@bS+?eTe
zWmqKZSxX>IMDVES$*UqIp!Iq4D@BqM3m8hQq!}3IZ3a1{M5YAPN#h6ut4qFOQDP^+
zz_6eW)R2oUfi(U=>UJrXKpKCb08El8ft;NHvfiz*1XRpJ7R@!yE&-1`Lc+|>rv%(C
z1n*AVBVGd8eF7>JoQg|8<v(O)qRh<_(6Mq1;Qc>!ekI^*@WA_j+F44#Bd6ePPCXw>
zKqIG+ErH=XOTf$GcY=2LEQu|FEQ<&Ayyq+^3E*V#VqgIGO!%*rfY!w`fO{sK5+y;P
z+8?~_#%gy7WXuxOF){jC0vWP20mWhRm6A|q28Q{S!VC<uE2jUGWs$O8Q4-0_z_6ez
zgQX;im4RWw{V)cGNf{-{pk)b1!WbA5R+OZGk7o&EVAwIaBo)jC<;rfM>A`X=ZuQ9}
zpgYkSCUJrUQ+r)XKx^+7f|fZOy(q~S1{nzoXrW0Z`O+W`4<w!CD}y+odRJYcBwqu>
z0p)__uS)U_Kpc?kSF)CXSDAx5PqUm#3PHIIyvxUCehKIzJcdb*!XRt4R4a@?W%feI
zaa7Z_<yo{$10sw;Vv9gyPLAQmGLU&O@OdxBvhed>9Jd?Gfy-LZ=-94()4SwZR2WxJ
zUoX!hU%$;j98|6@2G!s^f5gSO7#J3_f;@A+L0lZn0i_znC~?ryMvJ9Esm5xnIH-ZV
zSPj$}-OVU2CB(q6*btP_^d5^#b2Bh3Rs*GzFdcCj5XTi10K2}6%Yry+poT~NHgS-9
z7RM=o7TxFU5|;-_m4m`&(mZj{sdbChKqD+tveUB_Se7u(nl7NoqQF-tt^=}Z2e>^j
zXS$sti)8&uanP-|i|>QQCV;LT$`=P6H6tYj9=l3WVqloMNE~$DjM^=*2xv>@CUtS}
zF*A@6uK*<m2DaDYc6^|z9IzT6HU@^>#o~|yXOtKi7S0!UK*)LsGB7NPW?)#7BgQcO
znj(w1WQaTigTrTWCdhGUAgA~S2s1D!U!2aS#G>k`Q3@`7z>_8hGNs_s=Z1htaxz0H
zsPKUtz|GEH3h6|HLW|G86x8%&0N>IZFlBm<5{p47=zNhSlM*yaLEYY^pqsikKPpuN
zmG0nTa{GZ&bub4MU+nCq8iJsfA}GFeXO(J#IiM)YZ72n`Zy@uyhj&l^sKg@17&e_l
znMILNeY%!1i?rtEN2O+9lR(LUoxRi?%mEp@L#)&S#Mucl*7wBpJY^P1Ew@r@uoxdh
zhCrz?D+9wa+b{-(xnZRyyr5NOiJ)r`Kna*jY5GQG7U5VEj#5xNb6KTGN>UC(Dd^Ns
zNQz6zC<T{BJHZu#t-3%dsL)vk>arTWD0LTSU|1H&Ad*~|%24Vd#=x*_56BgUpGqNR
z4vz-|Lu<@*MHLodK53Cs(9FzoQ0vC%#dIeX78P~FPo?1fF5q*YZ1_sSn_6}XfojgB
z+xQq5mVru)6^+w-Ran&Oy-UFxQ^1p6My#c2A`A@64uX=q*o@M25T_DUT%9~q3f_GJ
zKD}3up)?yLa}botj?FL40dXolz~<|M?#nuNp){X^fnf#c7(vJIQpDj;;_an{;vfl7
zdB7c4TFjXWYNCS7QT|g3>Vh$HfO@iWx}}hlYC%IQt7ex%PO1eBt(?j$g`89i8oln8
zEUf|WZ3c~AFSaa&4B>!=R&rZQ8^GlNsKdRMbNX~umQcom>2Fn8RJ`Y%Q(|CnxTz)t
zYS9&gvw;g}iNrTGUr2|<M~i{MPoo^X!U1$$ZuHS|&;kbrFndXP6sUy?Vjnv-Jw}a1
zy1t|ww3>Rw7cB;c<Z0!gRnp+wu(vgqgBD3c*xluzHPT@AjG%JR3TZIAS*|<<c6)a4
zjdJiB2hiOE&6CQ(OB_JAe{<CHRDd?ZuLMnX2cNG1H{ig##TvvbRKe%KgNG4kcvpZ&
zhQM2NH}h9O7VLutiYKk90JZEO>)ws{DnPY8WLJFfmkRJO(N6GT|0`3385meXSt~#r
z<5qzNmCL_XK=#FfG6-Kt1!T87Xav(iv;sWtvy&No#_tv}flAOGgH@nSd~VMwA){O%
zUCCQ3L4(I~vY>1wYg7ptJO&x=ZdnQP7sMs*MwJkcfrik_KURXWKIE$Flv|acjR^cM
zpj0{8suJQa(8y&fOQi+}XruKce$WMG8GkFn6d4#+v4gsoza+FlvB@mtFkM)K#ViDL
z#+UX{2|YdrhE*pWKqc2C2TKM9=UNE^&|S++U=a&T1_mBK2}97~5s?0`$0J6j2ni!b
z28PvUVGIm@t0jyj7#PCmhA}V%e40L2gGHhqWU{V=gefyf4F|}aoE?@73}G82tl1bC
z7@vYgwuUn>h>1vefln99*;2^B!093ZDt#HB7BVo%?UnEm1F0=!V9<Xr;S1JR$iPrq
zD&Z>v61QYv(0?i6s{mqy&D&haz+jv#;m5{M&%pT9l7YcZT*4o$4J^IMl7Yb@R04Dr
z71RM63mF)4lOzJbYAhKTV%a2ulo=Sfmx9!1F9nG(Nd(I<FsuY0f|$LafPq1bO(I0J
zkbz-grbH+o0|RSEAp=8VrbHMhc!~=d7#!C~g!6+=*auyaA)p}<0ltPNd4VMZ!=xt?
zZJ-_-I24oTSTZm$rAYK3L}pkrFs$Dr(Z|NXpi>5Nf-flS71$*D5h9?oH5hM7Oke}a
zCr`0tV5r+90X{AYlxvxMRl*q<7(doaOy&nE@KpeD|4K}O@IV(!F{DdO1M`w6fac>j
zNX!IXOm7TQoeY}&3A2}&g%IhmWMC+<mY4&YLWQVlv1DM7cqK6xAp#zox-BsuVrq>g
z1B0IJ0SVAr8wRizUx{!A28Jq$MGys`!7GL~iNz3Ji53Hc!Agl`yr5VFl`+#LmQR1D
z#Ufen`CnoMF9XBc7SP#>^CecoRP6MWSOsRUV`N~65tX<FF0w#fDJ2GmDQpsu^OL~-
z0nM{_u}eGx9fM+Q$-pqVQQ{>cxN|`1AzR`V8w0~S@I5BU86b~;Eo5NmNRg<22Ucmx
zz+fyT@dcqKMV^7dkW+%uT>^AG0@#`ac?O1pg%XS&2%#8x1_p&m5{#gm(S*TE&XOZQ
zqZ&pMjNbAL4F0MhjXpnCFj`13g0?-b7X}|cBf$tdcbfrpZcRPIEPe^bbTI~o^}?VT
z@Ez(Bj2Ws74C^I8GvIqHBp5Sg85q{ff~Nn4?ny9$_db3F&EhZDlVAjGeq65vn#Di=
zNP;m3v~aLk!ya_EiUeaWxMc`BzUW|_1Y;gp4z!<2%T9t3y#Mj52?HO)^cEc!)q2o@
z7wf7)2i~0ZU_T(iSkAz({s2D%!&EZ~#tH#YIt2~5xj0KOR!TE41Sx~;FAkPqtO8|+
zub^{}HeHrrtOoNy(~NA7B*5pZF?<D`dzAQ7g0U8qkcvS|bXI(mV62k>SpYisNVHFa
zv3|OSE{k^k(kel928OUSaG1SNVqh@3R3(N8#S=;l4CXvlphYsF^<Xs>N(>A$wW@Rx
zx-yg)7((_`86k9eC^0ZZ@>Q8hfDV}g>GJ-e#K2&2ugVjy%Nt}@$*uY-Ke#q;kYyEX
zs)7*OK$gw@Ta}8?2C|IzR8<y27sxWr!m2#DE-#Q}W=pCX;kvv)mK8cxwZV0Hf$S=~
zRaM`G&<3(><F2Z?2yGzCG&QRhA+&)kQ*NwU2G`{YvP||>)lRrBPmpDsw^Z$e>+%Fy
zwo|$45JDHoF57igSL+elK$h`(R^38q16fwBP<0Qk%>!iF1c|DTa9tiC%eq^uzQJ{Q
zfGlG^TJ;N|t3sZE!DLAlBQHW*hCBm9cy1MAy%0j9hdcvAOivY~7+k0O4|xU#-n=SC
zO}I|?7xD}Yc5kZ~_23%aL2FH&)2bMa5E?;N79Fi(bVX<cS-IhG6{8nIqlbJw1H;y<
zRg8Xcoo*m2W%8;R6X81DKvvH3tzt}r>vRKIId@_eV-`Xq$V$6{D#lubMv#?z=T$K_
zAvA(KS#Mdz*ap#9&-{VO6=dbH$5o6o;W}MGRvOQ*Vw?xp=?b#aa!M8BB8X0qMv#^4
z*Q*$}A~b@mbm^~R+=b8xveNxT72`g*Mi-Ec0sE>LFCyaK1!QH<)hfnoaGfq7D<@8<
zV!VaW39@qS+$zSma4VBRr`brot780w&<H9I<vOYuzacboC^0ZhYOH3IVPIGfZjRWv
zq%trtxz$hiHDr-syf{70kVS{_`t-?$EHR9+(?5U&g{N~GvFI>s*7!_UG+~L9_N%E$
z0Ncy+@3H~|0|ThJ#lVotz>s@u`WleRyqZji$|BzyNIdZTyWD`Ra>K;w{>Cgi%nNGT
zASyZU*UW;Mc>r1EthduY8MA0JEqFX#-h?HFF?@QB35x{d_UThiSacXCO+N$@?3*rc
z$|BC>@@cw-DT@wc{Pa{)mY8};s5g}u7+PFwO~A&3iXj^dB?g9bt7|RcA!Q?>#K7Rw
zSZf0hC~HvuIr_5JAFj)KhY|yWNm4DSFAAw#tU;@~7wo7FN9Y3O)tGIynIK*D;L_9@
zWEtbx+B~>r)*#EuTWSm8+N?m9o$aY@0civ4vI1FVZCBd~*JTB=%x+z64?-8nvV!c|
z`3PMgyVl>T1s%QPuL>@xtw5G-4yj!Z*JcT_tn+Z~F1R*JkY&ApYxlz~vjkaIBUXzj
zsw_d4tud&*iqHkJOzdSXqNK6}*(DoOdlzCCC{tO0EK?S%{Q%cy0kTZ9qxLJ@G7FGp
z$@R5AAljHeFj;`|%7hQKjNAxq7V-=XyOz{4f=*z91iyuZJOhI}cP*nZT%$QCtC+CY
zGODRFFw{e;GxHsww!`CEMs2u_<}*OYIAzo_>LGN3thAP{WpspFX%4bd_-`$v8$u(<
z%Icl9;6?|eCNu+CY5uX6F$S*D3}j<betj)tB3!2#$jS<{TE-N(m1ZC-#bj$4%Mdz2
zR$8gnGFBrrf~>SxuLalJ5GzeVRu;~zWt<4tXbQ6O{M%Z_X>g6E^&l%*?$<KTgj;C}
zva)M;E#n%5PLP$;Tx%IOB6NbRJf~aBxCO4!1Z1T~el6p1xJDC@mAUe@jA!5)O+YrL
z%hxiV2Wtc;Kod~HX+8|iilFSL(^0~}a5Pwgaf%oN!|v~3p%y++c_h!kFzv4d<1}#w
zhCSf6t4;$*9Mq&}oiD+(2h;<GwCq7cMC(D@-ONEvQ)5n0Z!Gtu1k+wk28KQAAR`kc
z>en+eFof1KFzks&C~A<EVA=;#<ONa``$G`a>S18mQ-@HpLr#KeKS)U)SV;rO7=Kj;
zhCPcAYWC<$FdYD?nFvx7;{Y0;DP~~U16pjxU@Q)D&ZK%B31$&728KObL29D!fYewq
zFzk5=o+e=Y4^kw%M}if!{&5dzq>L%@jywZH#cc^z&{{``P&i1NXafVoUeGNR494sX
z`V0(v`AZlWR;oy_P7(o0fQ%Ob9dNetg9OJ5cp%k>-vC*8gMndh6xikQAR9L<m*4<R
zcI^cRKp3csNPi>2eM}N`cq_;x9gs<rUrKPFMhGd$GcdHAlHk4o7t;P9&%j`FUV<C6
zzR^D(q*42TJOjgmDH7bbAgVz5UmG-HX!Be{2=1yd(D-27Yz+}P1_tqOV0|4*3=H;*
zG!zsV7{uO!M8aH@7#NBlXei4tFo=7CM6`XB7#Nn+Xs9bOFi3(%9+|X3YI^fEwB;BW
zBy+%OY?K%n4mW7%%QG-YPGM!P|G*RmDx-WhX&A{dFvx?WQ`<y|fuSZ)!we(>>Zvnn
zt0*xrxSrIomS<p)-vlx!%s`2OVUB}_9Y_Q;sL7-)1KQ;CR>KL@=Wqn80g3S4*Kk!}
zU{E**77+mr0lr~i*mn#Z+W+f8QMGT|21W*k)~V{UAPH9H4~%IFf(#5|FBlm1y#=cS
z$LPMhAY~1Vn&KdFurdaa$azNtIR*x~vmlW>4I3F57-G*b+QUT7CxArwY(V$8LewmG
z0Ex_1VA;sPP!ADG2idnjhJj&!4A?&KQA2WP<rx^Jtd!ybt*G4Z19HDMk01ks^b!V!
z{Vh;+`V0*FOXL|Cn)s!7j;n$sK+Z^g09tdU<R!%e@-|}vLm>l$P<EZ1AOl0>lR^fD
zjMa6apnl!X`a%YVwHkGx=`qHm1q=);ed=a`Cfip=)XfH+rGDb6LnUa*;{njoGOiqz
zpreT(E6KL!RDu?LKqi2U_$omYoRBqe_Gc@>E3<Zj=FoXtDnTnAIl@3g>-qC5AuAq1
z135<TEBQI<85j;Efp#;qNmPQCJgV1$_B1R^sRV6bJ5XfK0LmSc7#I!|f&D81=Yw(|
zgE4q6KEuzT5;S^$;2skL!@_HoVxpkq`#=qzsM1PtFb6b7y6APK1egOF0CwI`3A$c}
zvHmD%q}k_Sr4(2SG@cn9TM3#?;7HQ|jn__9bEyPPbR9g&#K4g8w^9eJ4rKTRzDm$M
z*TIt@!?!tCg4Qg`$%4+QTbEG@n(2a^p_YHH610&RvOuzGNhNruYbWRoHKw9Uqv<_%
zEL`>CmB!!+574%S9d|21)8`D6Ksyo&Oe#T>stl7rgQ9cYD<SI`L1U-WeJa6Itdl@D
zN-a2F37TT%cQIySU^uX;5;RlB06r6GvQ;JMBnt-cnMi__m7u9I2Jo3kRwpY#Q?2TK
z77RAfKt6aA9LTaDf3I1rP|wQ2z;Fn(mh5O}J)1a)4f6NG5A~4MdZ0l&z5MBc_AI*b
z+pg4uqd5(9gh#erJ$L~gc+$(|Ks{(zDP+=X>xFvoYP_9tpb=s4nBt-ymU__feTSBd
zR4~+oX6+d!F^E($)JuTZ6@tbSIi^m(YtJI3VZc%kikU+%MUoSX80tYc-b2!2<<WW>
z&~z2}XspVE)8!plq?{I-G+gFjU^omKG`_&s0NS<+xgdU<bHi2e_1mCX7`~8(YoHl5
z@G@7E84cIL@e7)SF_|~L+JQwnCKy~5u>WT`!pOj|QlJrJCV2VOBnF1V1z<_u{|vK0
zk}{0k3=D_kp}~2$7c9vSmDFJ3V_-O316F9lEWp4Z88d78CkGbu`cAiIM$nA%5zu~t
z%{tBC-3knoKtl>Di<%iBcU3d;GcaT*H8X-|m%%H8rsy{_f(G~*CV^H4?b2vw1Z~`7
zm;@Ro;caPV4B-HsQv^B%X41iCM$q&#!z9q2Q=|9IjA0z$j0d_EU82635p=_gdYv*q
z1H;0UX7DbD14ZVbgVujEGlCDx+6fw`SS#Gj2s$W)Bg}~bG!{}dmzkxRaXtgXk>{Wj
zn(dmw`@JC!U*FcuxDcGEK@LCC*USjHxP-|*B{7+ynGtkz$&u&G!3+%R>*qEzE&(fL
z1}_u>ZJ0gs0~~ft|6v*aC<i!g?guSp@VnI_#?8QR<OdrAgWuy8(Dlg>_L~;a^*a#u
z*A{<}n&)f`3`I{{rgDSAf{lS8Be`W7H^}d73=9dvEwi~980yvQ*ccclF|^DFNfd!J
zylq(s*O1+^2qc~a693w=94=nmvH~Wapw+UL8+2F%$Q+KAjUaK5ImOH^o8juaTDE}1
zLFOdbx9o(g7pQO93z7h7$e7f!AH)VJDmd8!T3QQnoJ7kBkT^(9Nnpz<n4y_>TTX+-
zLFyB&S}wp0oqww33P>ERKC<N+T>aCQ>mYHE`pma2cfjm=HU@@7r<R8>&1L^vp2FB!
zt}QRYia=^ATHe9LOXjzHf*G3S+wvK%rlI8rOby?MmOmhIkRyuITK<99Nk$9|Oqx0^
zjG*<&$K&}K7+jKNS{T6v3V88b)~XgpP*kr>0WE$z(l_1Sg+;pFzJ(D|rGSR=cw1T+
zL92a*)IfWd^XIoP@_|zi=qxCs_brT|5=KZ3v`dFgqJ<H(ghEISbfnV4lom$N8VVsb
z4N$5&c7%c9cs@8)@q=#0aeLIlC?d<ia6F!cfuXdag)vcuf#E=tAOpkx`uhwF$7h0-
z%7B!f+10|B3{u(&%IZ5A7>;iPOEQ8|=gEbwpjqPM%h(tgO6prBc^DY@Km(^+U0Ok>
z{_=f+>3Id#!voUe%hoE(!@zL-7F6y88(2;dBqyufTCWU}{05U$0!xa6B;yXWYVj~I
zoDgDTU@$n?3Ob46_%~28pVbPQ00xU2t!xF|00I`D_`cN(rammY6?AV0SbPUtD`@Tt
ztiIf&6|~6~EWUANYbFmvJ;Z`a)>hDlSFpt9>{iesG_Z!y#MTC|1KAiD9J5+Mr_+GN
zOCPoN!^9QaT0sZLfW^yaw}Os;0h^;5(h54p1uWjL*9tm-1uPz&*184eP>p)KR#3kJ
zEKw`cdKe~QzM>U$E-+Yp>d#it>Aoj~gc%sN_bRmB=3rnr30f8FlH3Yfh6%Z@EBSEi
z9ndH&cvdWHRV!#`=gJgNO=kP9^**>F5D+O&Eo5kYzy;C|n!>*@slN3gm<MVr2uHO(
z0&~DO^D*ocWMDXH#=vlL3pi5vL6K5l-uhIQf#Kv576yi@>#dBuAdZ<Z1H%pjzBU$+
zyS_4k5`G&i*g{aHnzgD86y+;Zz&jC6o@HP-#R$1u$?ahqXT2f=!%5KG-|ky&T;NfB
zHU<XQ)^-_iiygEKKd}SSdS_!`ux0EJmSkX9nZm}v(B{)20%I?H*8w_qfZ>KP14GVo
zjgI9U3=F5$z`FrEz}wZq6X>mHJ63{RbpsS8VSyc>^EDXj!56XjAMOAh8p;4(aqr;Y
z0Xj1jGHuTr-vPej8hjGu?$D0)ko*X`xamd51~3P7ux-c8j*VarXvvF?XvZcn2XwHl
zaCQgiXn6+kUe{#~9b3RMpuMiP)*V|xtwe@Npi}J1&va}9OMzO6<@Y*3$8#`DQel|Q
z$iT2Hu9fjWZy5ta@b9`kf{z&)7_#Fecq(}r7)~dER$mrlBfvV_PfM_`7JS0Uz|fX1
zu^ObIyqX2H#B}W(Mg|6*n|bx1)yt=+nJ_Rc3Ina?Ji<`Mz%a4Rq7!6Y`h6D;Hju*F
zI+sIi3=F6Dfh@XV!oVO}4N_<0?UDtSU)|*L0wjMEBtHox<)YT<z*fe<z}>3!oAoH@
zIQ@KQ(A>)n28J`7V2eOXZ<qvvX2Kaj3b+<`fu?wNGBBKx2gyxhc*@AYAP``0!E3<4
z&_1i<0Z95Q1H+jKJjqEJ3?0wKL2Nb#hUVUmH!=(iXF&I+a8^%W=*c2p-_*g#2#IV4
z1|yRWM)29yH&_@L7Jlepgr0!G$H35hnU8_tRH!ZkgU^?a-HZ$jXFzvSa8`Hh76+}a
z-~}DC+OZon$~cLGfg!r7W49*A!5m;icbh`l3qN%1b_B6`G8sC+*NxYI6<}jvIL6&^
zP8nn-1E@`S@~i;^16OXx0;oUEf{v{_+S#!{4cz`TU|{IJ)zJu(1T9E9+S$>l1d;?D
z)$*;QQ6IE0l#PKwU#A1KTb^MO8v_Hoc?alBMutfOJoyC-9h0RQ7!KZKs0W>%tRUP`
z2{Ud1FX+0hj!Mv6%vavx)O3c9N<{_+hMl0p;1oJ4bwG<_K$?VKb`--jo#bF(INI4!
ztPXMmZ&_jvLkBpieFZ5@INgy8QwUnceYCS97pxE@S#QbHkq(tT2U_@fw6h~!3t>#U
zImjy@m3pZii7<trm3BuvI}*VPL6R)-9nmmJP%H0fXGgRK!jx!G1b`jWHl-sJrVzBK
zO8aPMM<`e&$QXl!4u6;|sBAde+2OAOGKPbJVS(H9``#=PQ8pc(FeMit-u6T&>F_iJ
zyH}TiA#X#679#`0d1FW*YJti|P#~rr?a)#Hm8%>K46a8yw6sBNHU@^d*3$!hSj6kO
zJIvKVNdZ)(C3iqp*)TAGTqn%jAubGZ4Fkh@(1i&u$sOYAAnQP>3A~90mY5WviOGzC
zVb$+;MiZ!mFH~_ArIs+XGlEwYf|gka`m{s$4zn;YluU1D^nff%;z~+MV`yje1mz5n
zx=PpS|9n`)-JHL)GlCCL-O0kh;2zV?2tGh{Cs!^*J7c~)$k{9m47=~QGZuh0_!^5c
zFkDb&VPIGq*Usn->YaeJ^}L=Q?aLyi0BU12h_^Eq!6asQw=)*QIGg#WPxWO{3#w>m
zY~Tf*d;$&vjV<jzV4isg4*m8Ys-PeNC;avwMxfweVPFV8-_FPgE+tt&rz^KJg7;H_
zY@gvho!5^=TrK8DJ0o}j=}xXPhIU3!_lsc?D3m?6wS$U5hOZ0^7p<pz`LW1&Dzrb*
z2PJzRaOi<IAA{~K$XeC@iVGBb4Au+`u?p=Mpf0;u36Api3!t6EpeWB;)qX(@q;UFr
zKNcyKOYQq$Di1?c?gQ;bhN|4B3|9Hpk3~&_vmG?E4R*?Rh;P?{ll*jTe-;^uHSJ5G
z=3D};EjilRz7!%G@6RHgm;})<O&1hA;5^wr%?cDe0z9C?s(ltHq(R<T_@R9^m<<l$
zQ?J^=#p_oFhD)m<Ms$IVfan6>-wx3={kA`gLVav|J<Ji0Aj<2t5jNIafNf-BVAyu0
zy%}Lk=<oJ&n702AZRKEXpcoJ_YR`g7UIvW=9PMn+0v8zIT-crkD)hfXe3Ui4Du9K{
zH@!UprXdz$8ffC@Pzpo?xa#`~iX^`5c5v>W#K3U5k|#Bfp&in*V^C#as94bMC&IvR
zdEWGk0W7lhmhGOP>F}Kl43~HF7Nw>$w0nY<+wWx1Wnc)p&~D7gz;HzX5_`t5*h@Xy
zZVZk+aMo@&)&s>PPcB2dDL89@78BlYHv{JkP^s^d+-?PJ&l)f=M4oF`gXZol&Y<ev
zCAnQq3lw}H6Eu)a&;*+R@=x@Zb~$kShk@Y==p2`$o$Ye^pwNd{r2tWA#=y|Dqm?NL
z8bnt%flGl_Ch%feQ0@-&X=MT*rF;XN?^~HNIj6q~WZ{r@ZDj%<ioBB{mw`c+wUx;Y
zWX2>0hAX$G^9QlW)URu0vIhx$HD_Spy4uR5$;iNP6;x|3%xq=Slmc-;H5zM&Bm=|R
z##Sa}kUVJBGe{mZY<iVhhJj(}4F-m*4j>hvP6^{15D!#b8iNm2ylNoHz;O0KE0Zip
zGw5t-kY-sK28OHk%nXtY45tpXGKquasyRW6aax(gL2_WJGu^FBf*`4BP$@x#R9!0*
z2S{okREh&E#lpZK+1AR$1sUs+WMJq}ZDsrkQg;)gj`1g09mwL=djD3&&mg%kP`S?t
zIo(#qH;fDn*Fasdg_*64pq9r~u%ql2wlad6EZ0D5%Ro|35xTfr8LxtLfer-+NnHg?
zag{N&f)5#En8aYlz~FeUl@ZhiVW|Jgz;F$8rt#6vR>s}n762#c7@k(f-QXqw3)nM^
zhonKu1XvgtbZ4|O9#UmsxHcEk(lFy=U|4xpl7V6Us#Zo&S##|wCj&!IPAlU&(2)qB
z0yD3(m2o4u9^lGkXk`SS9QT!BE+YfO-cRAJj4K!=85mZuwKDcHGB8{Rt-=@I)5_SZ
z1+o!b5VtZy?s(<O&tqt1gk13o3OsfDRz^@G<~nHExUNDgV<V`AKcAC<!Fbm6x)2r_
zUb9xl5^&;TV7T5qeR&9rT$(~FV+o`MV#dHw)z-=gYdc&A9WVz91xVvT2-F5?WrVaI
zSQr>$ezY=zS7`18h2I{>R>ml($u~eN=|CEzz-1>`?R4!>7O(o9t&9OMMWD0JL5c#v
zO$Dgw0pL~zSVt@5APunTj!LbJ?l6r@I6*C=Rz`QQMyOhFwF(Z~ldX)P%@+)lSQr?x
z&$lvy&Z&pQu}r;5E2ACE7|^ykko|VxrUoadHPXsx2X1RX9b;z;Dk?y}E0Aktw18^7
z3EDag(rAIK(E_ZI!JL6Xr@56;m63trW`q!^sn^P=3d(n&WBpR=kG3+Zf*UHFpoU5-
zqbj(i0!{>=y+90KK?%wwxs_29RIcx20NJg*wUtqV5mW*(Fx&(k><E$v4LLJ_${ESF
zRz@jsS_G+$zShbJ%A26-?I!5(Ly$WK!HF1D$kt0_b%Rpm%?IF8wi|S;1Gp7Bqo#YE
zJg7y$!N9P7diOdV1_lODqdTv&dmW^;sLR066wy7Ok%8fsEJX8sP>&H*!Op1Zo-c>c
zJYO53dA=Dq1a%o0ra$SP&Zy78a0@inoFUW=I-LhJIL64pP<y3&0w`=J=`t|vx9DyK
z*#SD0Qp;}of^Zh4`jqYtaI=G_jG-HJ94*5nkY6lAx~oAdcY(%S?YgT$fednThER7k
zxX-}Gz`&i-4LUm)(g-Os?#>5W!@zJ0bb6_lU3Wgn3!sKPcS<*?<;pM#WC!FHSdblQ
zx4Y9AMHv`wgT~QgesrgSECG30%WisD1dDEZbvLMzybY=pV}5jlk34}$cPFSqLm@+`
zI{{R1fEz+GOS&VWZn)jc0m?(&pyOV^aiC?_9jOA+1hP3LrW=$|ZXXBxZu+YT7G3{2
z-Cm3g47cBag}S{!Zh?B(3+!P~Juj8p?F_Zx4ro$E%dXoQ>`9QJPOaTmj0_BSK&J(0
z*-cN2WYP6v?FO}E?||CAT6WzgNQRog4LxqrtqU`>6=J(C+)%ai-D)61S5Chh$s$w#
zpj!dN16{eDA=Iq^HjkkNw3s!fTMBFlsIs5iEeulif`fq}L#P`xt^iF7=i0h?!Ky$h
z!uMPYlQ5$h14F}+7RJLM;jat~ch7>ee+%PbWl){~m(4AVhYdgpO@^T!T=Ct#3(~{F
zz#uiRh4G{`1H;`%px$R@3*$phP(tO(WN2Z01TKJC7#Ki9eV}{o!6in_j}}Hy&BFjH
zOM=h0FhORcL>U<FP6HSAEsQ7C!G%32t8TDpVY~=#O0zI9#7=Etoc=wEMXMe({KH_(
z51ItLdzO!Z;n)#L1_mbo7RF7C3=H=`-QlC1EsUEKKpp@U8NyyIjLSh%pp7>!$t{e_
zK}TVI<z!$Gj%s0Ct^#s13#ia*VO$BWM4?^-olAQ65y&CBGg`nC`=Cn5yq<v}F202^
zjgf)jzBda4gVXF5#$0|72kde19Sfkc!|hoMBjoUXQ3i&4GgufH^!ZyDGeAQWM;Smu
ztD!<!aH0FwETAE#7REAA0R=K-k!TBJr91<}{b;BQtEB5e{sMOrS{Q3#>SlPiFxJ61
z!RK2T>p`t7P$6x^*8=X3fXg#bjCIR{Voa2Q;l4Ht1H+^>EsU+8Hr-bSm`}U4!7%{l
zgMw>5$lRR_pq373l)wHyWY!-%l(zrAIRnFq&n=9gw%YwY;4-;|F$i20b22cb9&KR^
zg4L3)M_L$zbU-aka6myCb0AAWt_lOY3hMoEsEuX}400ANjG#8$p%ey&`=B^;VN9Mb
z7t12yIj;r0)a~vg22fjXyIu<;q+!Rv@Bp-%4wMG$A!YM%Mh1oz$<2&+L8;iBfnoa6
zX2xrb3=9uIhfp2bIK4iWMWTLZGo*#`m4V?wuMlWRp_y?vsGa;3?5SpOYlQ(+(da5P
zGw#*}b+5Pz@{1Xo89_4vf=572gjLDSjGI9wZ-r{w3_6Skq$z7vGvj7U28IV)LCwn}
z6C@cJ^!%F{SAY~h5-LuuPiJUmTp<k_x8P)80I6PK239S}z|cLrnX#6Uf#IPN)YMv8
zBz3hmAQ`SqhGy__#o&03`O(bS3d(^yLAD*fDapWa<a{$@9LSJ#s3CEnTmW-g9G4}?
z6mWGveSRE^L_K3Oqbsyfc-RIm6q>=S4G*P&szSAdW_WNv1hue^b~ZEGgPRQC>b;rK
z9^BRdscp4tX0(JE1v;`8q}CFw79@SFyqQrSD*Xs_R0v2~AJQj-nxzl!lz|=B%m|r_
z1?ij`*31Yh9YOW+BhdaEkWMvluMDadyy+KI)^JugGirhY<SR(yY=ve<Ihd88Wy2ti
za+;uw1+`Hw6jHaEF)-9TY-R*C*1@)b4pIgw76&Wl0yWy286mrOK?Vn0X@<8D9$kTk
znjpBp4{icY=SpCavJ-D+<c8Y*m;tJY8=<I~ksCZJ05VV_u$hq&q;@9*!(&UZucjv@
zu&CGbH2-2`V0a9gO0<<}{soFlaK)W8qxmC9qMU<)!IGu<BPd0IdcQG0nm>d55AF_D
zh&R6kDVoE<z`*U<{1Tj;*gzF#^J|DA0|ti9S<SaVHh*Pccnqp`k9IcS0y`2^;nXwi
zi*LRNlHRGyz_4Am88krf#1`CkX$GA$1+H{;KQ`}E1Z5Ns(8<2d`}9D`7TgGG-VYkC
z0~u=}(YznjPX$%B%jKH)gQ^-(qoLtrGx&7noooyY(NCKXgLnV%WHK~^&sDD93F-l_
z>1YP6%6JmOQ^wG|9pdtK(B1C=%}W_|85p!&nkO?dFgz&(Rja|xlR=^M6;xO6y4>6Y
zlIZ7PVA%Mpxd+}d$iLPM8Y6si1L8{1_#oIPd7aJ0ph(#XazPm<!*sSJ7Lk<0%{9=H
zN|%9Qc1v?IBLl-z(5eR2wB}?*P`$#zz+iQ?Iavq9W@BJjDA}9}Zf&tKFjPNm2Hm6p
zX>VmuZVm=%25lR&PihVZjgo;vL|0*YT@s5#{nln*kTmFyGW(=vU(h%WIJ((%o1H)s
zeUOlM0<|hYp*o|c*+~;*DagIxy|G|_cmHfQ2PxkRQErZ;+#IePw2PkstbBb+Gbm?1
zeE^#1E@W!f2bJrSKt_Ty;a5;fVDOM^26dttKn=_VzRjQx^E1#yp|5<iGPs!r3h+%%
z&0>rU49`HLBfj#}lapB#>yI`u?f{8_HqkE3Y+?kR)D7uxX02~x1V!vK(55kv)JAZ}
z9NO`I*3Q6?wH{O*fjZvL+Ci-#WAJ{bXXUyK3}yjMe?i7x;{f%ooBo2eMl&!R32$N)
z1=pfYjI5x|=Z8|j!wOB{*+z!10#F_&C`!LFFwA3QVA$H-6Rpd@(5&49s)L?^hO`!D
z_PD8nhY3^}7?g5*)EOBVo`ZTpJ>PrOLBkiI+*bar2eK!N4b-ma(FHdvc#;bkdJM!E
z7!GBE(sbz49y@TNW@BKeJlX>}feMtWl`?zyL57|I4-ED2gF8YT3=BQrd-%cqAYPC`
z{9aIlxIKG76Qm5FjIw_E^y?`svTQfm7#NKBrvFM|QL5MLW$FNRaF#PLyx<o~E@0?o
z0<8->lnD-tUZyUv<5)nste0sbczBSjjG>nad@TJ=Py=dXMK4nkBLl;WIEeNlP}?w5
zC^?a#m#N5%f#J|{s8J=zM%98nCs5DAz|axb%Tx~v)}0I>^ZW#RnZiKk%@-=q%wy<f
z0#*KpK)u~g_FkqiQ;^3v85nG3dYQsOcd&hhSQQTH?=A;bv%RssOrT`{;uq8aCr}u{
z3~;gn8357atO9B-!QAHxbKj2jy-a?f@&eSxsyy1u1WJPpJ3(d}?&@U%CHj}i;Py)|
zlRntDoD2-CAA6bf!Dd4pr|$u3P(b}|h-^0KKof99+_SB|7rePv@CXY7L(QySCTsX;
z!2a-FCQ$Vyc!YuB<!ngMs>y@g&ceU|av`|(0=dxCrI!g@d))xl3G+7hGJz5Zs4@2P
zj!*?dFB3l~59}1G1Tn#dIn+^t;tWa*hf=umL9s3>44yzSXJDAQx|i`gBLl-LV@?JJ
zU-{`)=`2e1oxO}d!F~X%X8a3Q&BDMi`*bhlDD|(Pc9#FTUPjQI)}iGL46i_y#nH}Q
z#-obhsuPs97>`;*ePAoo%LwXV>Hc8>CB|OH6W{;`=fqydj}TkVf^FeSPArmU=w-YF
zR>8u+pk>_42wDdO?lc@dHvJpOfwx&07<fv086SX~w&3RJcFkVKH{gq389;HT?ApsX
zk&%JnHKcRi%Qz9-00aju<0Nnz0VfN_N#@X03o>9jc=Zs(Ju|@WfjSse*@I&d<ea&X
z0e4Wq9_wYC3#v*$&Fk5xr?1Okk*HVbW!waImnZ|n>nU7W484ropv`J9XBUJ69&->2
z?gbAdF&<@LczsJKnW2}l5ma)3%!_L4Wo(881ITqPVAp|s$12*(n8(P#@CLL`6BO)u
zpp=;c&I0wljCr=8fahdj=w$C@%t!KUz75E;5dRe-`wz4~m*FeO=py!B##oTi{ov+E
zFJmk?;2=4GF&1P1D0i`b>}8AtSqkES;x`Ul9&zOt)HC!lCLo&)-h})Wl-t+L=>?B2
zy;&&)N`{Q?atsV_R)X542XC4)Fi70%WwZrZeH9{YD+7{-I>Xiol(0Z9Z2H*C$iv9M
z@HPyhj7J)zj4LgPp_h@5o1vZooWVBp_kvf8fMZQYx)(BG0?I<sPkR}K!6g!?pQ+Hx
z2&$&l=W%5+^fH3?xPu3WeC2x?RX_z5Xg*c<V=to~_@D&_(9pH7crSP+XA%R$JJ9ai
z&HTMTKm+byIT#pxRpom@7Zotv09`Iw+WQL}gKP{8WgmNg34lroHU@_D4bz`zu|(Cs
zV`X7rC`<2UWC7Xq71S4eCjk{=g$RLqMIaSy5H8625XoN9^f<!}28MSZI2af<^Y=am
zEs6kHUwO3mF{rBoYB!~p_JYrz1yw_3AA6r7Z0~&vs=mKYKakDhYkeN%xb)r+pqXok
z6COfDK0-u5!~JFHy`LaFP_?u+w-?lDdT%-1BZo!CXm9T|(7+4G`W@?gui1b+$pJ33
zuYrq2P^~{jxpyBM1H=279H6e?^l3RPT5L1fK;ymBkL9qa*RKQ>TgI#))3>wrE@Wh2
zcz>H0lt@6gj=Wh3swJQHE(XUM$UV9rdpAPkLzRIc>~$}wz4c)xFGxqS1Sma#r+j)r
zn-Up7{*Qjzn}*P>&<nm|2^2`WAA6_sgA<J?1H%VLHqiYWy}6*E0?E$X*P92)t{~ZX
zh-?u^1XRb)+t*tHVuM5NLoGzM7D;a%L>BB~h2CZm52~*P#0DMbuFAk5c(J!0v<>;A
zBG~;#;Pedfu^HISYzz!q!M)()mcX;5x*vPP`9Y0okfT0BtOcE#0-h_Mx3AY8Vz?*+
z!$(1gtUHpUK<oM$zA``^6$q9AB_CA=h8@d#LDkU5vgwt1EE>A!deuNJU1-FD&zu6W
zZDo4Zyg-o*iY@)Qz4D9<3?ENVKL^nwkCYbVtwG8lX+ho{#0F_G%IpP=N_|q8uAI-J
zQNOoW*cc?m0j}zV9iVJmnO<QZ5F1o-cr-MyfClA0ff}$2GaFdEBtZ?YP{{ntrw~{Z
z@KXpl9dUw2gg&`QGBE7dX<z{j)O~6M&vG=dI7@>xLfem@CNeMt?$?3qo(R^>4c6T#
z$-q#P(ZFKB$iVOkl#4;u8h~|kfySE~SimPGg1VHt3JomA;Fw}zV30X9UAllpvOc_l
z#SYw#Y+$hfmjR%%YrR(k3#bSA8Fc6$$Ut#q1Hor!fDFu9)xZL}R{pacDEsU4H?YV;
zMutFT<$-&W3=D!U4J<5-3=E$^qx&F(SilB>?2z<tVE)Hg&%p2*)LCDc*}(iy7Rk?_
zr!g={`op~Zc^cTuydW=sZj)qSh<n+<{0(IAHb{Ume*<d<860=Jf%!d13e<B4nfo3t
zRh`kme4UYj;R~p_1CqL44|We%asfjFGiY5hxRIIH*}!}Y6c`{+`Ydl?1|7F2q{aej
z_BJrz0r!UlKurLK24?VGT9dev6B!zqpGtu0EpWxY=5GV@0gz3gi(^4H9ROPda$oq2
z2IgHLsaj43hI)|PF0cckkqz>A_zaN3^lc5yn?VYfLjAZIU0wP%kh+Au4a{pm>Oe!G
zAoJFst4r7mR=2)^88n^!<ptEdrLqii43G{?dQSs0Xm!z7&{-%TGv<KJnC@4^B2z!B
zff>{*{R%o+6C^hoEC)8Sr-2zXm;Dtqw+WI0U0HmUnX8PUfw>19PAm)z$@3eSL8IFY
zlfYW)8kln!85q8Th8jUya=@lR)#br7&FF1l1|8wSFo~gFl7S)SRRc3<ZOYf9P`4+-
zbjAE=U<S2(A&uc`p9W^oDA3mjP<5{GaM$18zziC2`vzL50J7K~Yy?uU>+c6SaR0{!
zW>Cfb4KzRlQdiFdRw&BA@Xds)IG>?`Spd?46M*o<AUu%XeF6>4Y>W&H-=OK8nGLKJ
zB(+Vcff;mc-8azbAs}NJ;8J^^G%$e%N4`ygIGX7fLh4!rlj0YUiR+<qUm$Yk3=9It
z8<=i0GBA9Xn9fncBFE@GUA=@wrG8NZ6X=d3hDp#&$#fr@DJ2;g_MT{90!@B?2c1i`
zFtdT_D%dob%IgS~)ea3zH6X)5XSaY<*1!WYM5}?R3?u~_umeezfenEMWIZSWhiHMk
zT=ltu36%T4FMzrok^8HjH!y;xe7}QkeOj2=!1xnvJUAaQ{uKe`BXFi<{0HuSf=pZe
zuYvIs$l7-h(-=R2wSc6mPB$>VW@KRa!3jEy1Z3Q6gxvlHM$px9KUARF?!cwI<~4wa
zReyjE&jRVXhU^iLKfLCFjo;kBxF2ME57dbLU?U)oJ&5F3&^hGwup$I<yB4^$y0Wx^
zaVyAxGf)GzA{nq9$pFwH>2Up^p-xC^x6-nKaV<zcXhaO;(6vbVLD#4s0{1d2bsHF$
zdoVIE`~+=`0I6FJRtNG!rD6jksJ-$N)GY%^fm$q(yx&yOzz7<I`uP^>x^{3dOz$sa
zajmy$VC;q!g>G{i7{RMkK;@!qY6Ig$kPN7?s=c-W+;ssrV{K&`7(pqS;VT!Yx7@%8
zI*1<Zt4{U?#@XNqg_Na?bHIKFxo>4a1GtOv3z|C_8^KPm2gy~6HZWE(GBEstENf_B
ztOCnH6C9{^tP};Qvsl}}SO8K7x|18^#{#fANJ1(G+Y3@w@w0(36Qm4ubsk7rCX%vj
zgtE5{jLD#tH@{{=!zCH44rBz!_6G3G^{;bKsQ|DPcs8H`GEof*mhx{6kP9EcgSg#y
z8W=%^187|KH)tiROL7Av8>k-znkE3LWdjY9fixcNY+&RB^=<1RLp}}QrRd<$Z4hrj
zbP{HGH!y-01b}6N&o?lNz{*b}z6M6{v3y^-G8q~e!Hs~gq6`ebQ^9j64UFoLmO4nN
z0z9wNz-S4{{ve@ls8GEv=xkZ=^v~~kP%+SHcZ^5D-C2G921ZaZ3F;VvX7w!2Hv9(-
z-J}>WFr59{0LphD-~JH;FL`XZ1FFR#OCB3Q8yvwSmAVQIceFswL^jYgLIdc=oIhfq
zW*=Wj!+Xde40uqg0W>rWnpNRrU^w(rm4ShETLUOl{3+xu0M*}Xl^7WQ6!L;<;<ey0
z9ySJsNSg-m9d|ngc)&^VxD=?%$p-3jHk^R5D~~pugx1_3qcc?*7&g{5fabRU%&Lc&
z4Vut~nmr%X!&?q&Aa0Fq0L>u(0gc;nOl`;qjr@RG<3~FiN<nd#0vbPSr~)S_HqhX9
z18DUO19*|-LbC?YeB7Z-28KWXKs#urHh>Q!nZ#33$<P2kUIaW~T%R<*0kod#uNY_y
ztsxXNZjlMHyh5%4G{E{7v;~aYv%wb>vO7UjzLBX7;JJ&P3=Ds3K$G5{4c4G+3Tn~s
zZfpSU#sW9M*H3SNjNtL4=A|$+IDiulcoePye1aj^upRa18nnTK<_rvfL942R&o^j;
z`jDWZ-UjgoZP>ci8Qu-rpj853U8~PE$bd9`WnlOVx{dE>XM>D11H&QETJg>N4Ukio
zK;135z&g;N<-ZW{$Y<R=2~Yzt6w+G$mjYS~SkF)g$|($AVJoh+7#Ma>s5=Jg2~5&r
zU<h)nI|g#YB%b2ZT!y+6U|)zbF#L1n0j;mBTLwzyJHfpOeg3+=kOU5ERsKr>g_<!3
zs8#td1XKhn7u9t!sxmMb*42U5#r!*7U&g@TaG<V2u#AC$?{HlusH3v;YF!n0jDwAV
zA?i+DHJA;ua|dWWFn?XO90LO=e?WM(LSP<vbT+lRE>D$#fnBdIf{}sY-#?zB)MAD@
z$h|FP3=F<o>JkM(DPNzz4s>`T<59@s;WEuS&;TE(C;cC^5~B5Noj$180FC*dO|8=h
zml_-l46dGa`k*z@pq}Kh{5tTE_YDD_g4|q&I%8=DhX0+QF4~Pc3vh#lje#LxYMl)@
zfY=xq<mcAefMOPuPRhU4*@DG+rk|)`5#wu-;{C_Qz{sG?!oa|PaQd4X7RmZeQhZE8
zpsl1V3=C8Ir1+R*p&ZsmDLy7m5Qi(1L5dHwRE+^t^8EkFRaC$r#U~&PG6`IK6ik-l
z1FfLj?*m$#QzONv2y#I&3j;%!t`wglXezQ8yoyTfjwu5J+dL`WN4$&-j0`h{ik$Lu
z8Kih0X@GcK$qZ7wpp&h^ZS-7jDc&crNqC{-QoP{N1yGeG|67U|bWsd=GJpMt>BnkW
zH0!5I@!k{v!1!hX0|NsK<D3(W3=HD+yf?wqP#+jmZ!j=0a4^n^VPG)qmEt`u59;cD
zU`*Y@z`&rwIER6e(KHJ*JRrq;+6Ba6%nHcNW02xK1L9dRW(MS!mM}>1o^@qlWVC0@
z2uMy#XOQAO2jaRgrb{s}FfF?>y`YXoQ-bR|?=jFw=+_U7pd;x(mO3ynG+dd!v5rO5
zYCF`Hb~gq_#_cd$IzYTVa9cXv85kK4!fojSxxr;xJ&Rbqh7@m=GQ{aAUl>3a0nTAy
zWRis%TIB)azznSh@s!|()_5{7GO5E2tp!=>!k7-~;)#Fb1MRp55mOu(7%p^5@w$K}
zroMh)OgO;6z-R#qAl5Tk4D}4<-=uh5ypXMNRbXIbLRjObh+>Vq90MaGB!re-k>Um2
zJii#Ul^Em+MJWb`{-aX7pjB<4JORqS47$<`i~@Zh7!wT`7{Me11BVoEA}0eQvm&!L
z1Eatk1_lPu;#>=621bFE3=9me3=9m;AkH=h2GEUU41vxJ%+|Wo?HgFc>Oms{2@DJj
zam)<N)}Y~`JO&1a90mq)s4W(t?KI4ZQoKnZ8~Q-TfGntHU|^^OaX=QdF)%Q+fH)uv
zrZF%uOz{I*@PRQAWFP}`t`yG=R*?B1%N8*(Ff0IZKyqvA85kH=BWw!++g2&Xn+&q;
zKgdjwZ95ql7`B5rAlr^GFfbefaX_|RVPIgm1oqAc#>5x~1_;T(f^6dh1_p+EFdJVp
zFfhDiV1NbU^x#Goq52Y#aUhF8SI&P0aaJ-gfVRpqGJrVS7#J7@7#JA&U>2o-Edt#^
zifj?+fEh+9s6~ug3=E7K2#adKT53R<Oo}&+lYx=tCCKPG3=E8B^$ZM*CLkWjR!0T~
zMtcwkWUD^|1EVj@)&{T<pfhDqY>i@IV2ps-n!&)pn1--*0yvFKU|?VnkmAkZWME{C
z0~rmnwU~i{u@J;r2|CxVj)8%(2E+r|+QY!W*afq72H4gaV22~3kr8CXESRm!85kIs
zGBEf-)64@<_m8<%ino*#WF$!Gb_NE<tsoA_i-#B(7!QCrAj>W>Fw`?%fZ6r}Y}*TT
z+a576Fg}3U_LhNx5fqIM3=DA_rFey*IWdWafr0S?C?|4(mg0djqOcbOBiDQe1}0_(
z2FBkO-~vkoB({Wsfys`6fyoS9Y^h1{ih46Ja;=1CelZVtuH3FE#VY|W|EIS%vnVo(
zPhZ*0;>T3~ZTin<78&V41<*<ZDPA*BHFAT2fw_T!fw{sN6cW=7T3Ez1<}ffY&t+g>
zo(=NwN(Khz6$}i_%RroM3=GU5yanv}>3J=X?8tnOfq{8H)U(Xz85o$)GJtak*SZgk
zNfMwPam*r8yo#I*jO@+K42)a{7#NuEFfcIR0CCPTFfe~&U|@a+OX5l32n3O!azc}p
zfsy?O$o4r53@joH3@kz*&PoOb7I_8+mU>wbZyN&xi!K8Li#FI{9~hJ7fMNwiqGT)<
z3kC)jGpIvZ+!z>GT)^%Gl}<?;KnEHzt4i_eure@mWP*$Z*%-*cz~T?$fNYFmU|@*?
zaX=R4Ffg!W)x&Ju0=5xU`5>otmU0FLmQt9FO$-by4e+#{v<IwZ4<xPYf^5A9G8<%T
zF9QQhH;4nWbp`_i%QO%NWa|nB29{+oOHVN9F??W5IsvL6kqQu&%?u1I8)3HYV_;y}
z1GRO!ejAIZZZOC&kToY67+8*jI3R1TFfg!O0&zgrJYis9c?7m*dSM$RnpwUuFtB`r
znfjlBf#okE^gvY?1GAwNuRbdSBj*v2F>@FgKzq+wc|n|&3=FJN3=FIiAkH=h238FQ
z239q&1s@obzA!L>Nd}bYVl`%9U^N6=SkJ(~>d3&rYLBq-2e{<5mEtvEWnkno1epu6
z(T9P7)eFP{*%;2iz#0nTfNV@>U|>y!mh;J=OLQ5SJ&^*9wVZ*06&6*jO$-dI4e$aY
zIa&a0Tc{MTAuGr{kWG^q7+5EOI3SzmGBB`$GYrV4wG0fbtD$}aO(uL`1d$9J$hPfd
zU|`)2_S^Ia?JQD4Dhv#JUP$q>fSOsL0-fvjbe;|txq9{AQasN=1;&jJjLBCR7#I~m
z1%`kmq=CTm+>L=zKoZ(O;CTV!$-x>3JTKiD7zLDJWdzSFXGj?VtxA%wfI=N)CWC|&
z&l^?-Ms9E}2l?#+0|V<hkl*S-p1aM!z<LwJ19|Q>0|V<znCG5=l5p}9w9=3D2Ll7^
zH?Zdz7}%H@7(jh%n5}QXw!UFt0NMJMm4T5*8f5ew1_sc5P;7i4&PoObHfaV1Hc94s
z21bEx3=C}A3=C|VFk63sZT$giEg=Odn>7Oin<dOvHwFeaMD9*u0mUEF0V$q$AR9YC
zmVj&wV_;wl0dYV!CNeOv#e+B?3kw+-*z)}t>Y1%|KQN|%<~SIb&LG>?$iTo>53{X@
zfq|_Ho;Fitz_#6x;&~6U?I*}gkZmA53&a80ww!^1Z7GNYvTZv91KU=p_fk|q-UE>g
zEK>D|8jS5Y0|VPpn2nbh7}zc#Yy_=pV_<qB#q)ucfsr>0WG=|IM+^*X4?rA{jc*wk
z*j|G;ARGTOFtGiG*=PZZlN68{$b}c^*06eZHmHs4!VC=Tf(RQyQ!5NiAEbCbf^57E
zGItIG1G^jp1G@}}vyy><U6X-<T^+>P#=yXC3EGAUv(X1^BghOC8(kO}*qvY&`ZF-F
zd-+03t`CeU1>kTgfE0FLI2joE0zhViY>i@IV2=QCK(?kbFt8_sI3Qb#85r0L!M0A%
z>t+#?wPs*ouVY|fuYuXp!@$7a1+`@Q!fqDP`lBGdAXBF^FtASraX_XnVqjoj0OEj5
z-N3-Wz7A~a2gZ~hu)BI7?t-@)*>^KAu<wM~a*~08{Wv1<z?BWtA1R)noD7WoMj&HB
z7G7asV82uk;(=_u&%nTb7sLVC_?Cfz{WY}oO4$HPU(Cqm3HuKQ26kAM<6vW8;9!CJ
z=>ucR39th}wFHM0&o7XT%R$D@VPN18WMJUn2XR(1Fo5;|aY(_k9ETPI1BV98k7vL}
zoI&#=hbaRChcVQT9L@|39F7bO;HJa}#*`;uEugYNK#J!NtYO9B$H2hh1G6!bfq^3&
z#M#Ecz>&_tz>(_Apbp7$;D%KSs9}YiLO6;T7&r>RHcpS~Ws$4jFU4~kR6KtDz?cXw
z5x~V`J+yed?aja_P!B5}?|^tM@Z#~V4+En>C%kyP2W>)u`cDc!`4|`!!$3r%DFcJZ
zK`EZA;*1Q80!M_v{Y0LtmY}j!sHi?Qok5D{ng*x`2VU<f#d8g`kl_YHHUoqAbx8-d
z4-6Wh%4Pz{U4jQ>8JKN!J}_v2G%zr&kaT5bU=-wLW?;6lVqoCtW?<mx1aaIM7&xXe
zFmOy^fN22DYBDfwk#q-XumPz7X;@Uxz`z0OoY;VLtYu)}Sk1utfkDHBfvJ2a1EXLd
zBV!gb7xN3SU<d=F-~k3k!8EWS<A1PV1XQq!kui&j<11J!0V>uHRw(cRESLcmT*Szj
z#b^i?Dqvu&2b;JJtoaK=(FX>N1_q|*=?wl144&?ipnIAazJ6d(2X&qHfI>j%p$2F@
zw4^C$jloU^29CW93>@2y8JMjZJ}{`aFhEHL7D;n%21X%eP)rLkFmOCzVBomJ&cJLf
z&j4EH%E0jt5;FB47}P=iAO@y6l9sFtj6xyMpyA|ZVBq8gaoiagIK>zkI7Jv>)~o?r
zvj&uyC9QcG7==J#ZY{*Xz^Tl@z$p*2#+iYE(-EY}>hcE$^#fo{pkpstByD*Z7=`vR
zGca4#KV@Lx3}9g3^kHXUw)(`tz*)e+z?laM9`zTHND#UR3Nb4N?hg#=KR`kdE`vJ*
z!|Dl=2B5z4R|ZC5(DnsSe@W1OKL*ewd0dgCff{JpB`7SNZ%PV*6@Fki?!dsn8UYGR
zaVw4F=|vM*H0m=YMT8g_SV3#?@;W6&LE~CXOcPCl7#PG#85l*rfaVW9)=0|AGcXD_
znt+D#7-Siko)~;!IDLSDm4QL5SrXJb7qMn$V0vQ9z`%Kufr0b5I0Mtuwhs)a!FSz>
zO=M$a7hqr%F=S?7dODebf%7H<1Lt)c2Bv3I>cNUw7#PGRvh8GLW?*`@kb!~oB?ANJ
za}Z}O0|Vzz1_sXWAkIz(1};_x1}<iH2Bv3685p<(85p?uL7a;W3|tBf3|w+@3{21N
zf{2$O;;S43({n}!1_`hwOi#QR^q@}vz`*u_;q(UvhI)n?Ni|NW+qn!G7`SvNGBPkd
zUGRb7G^k7{VPj+iIsK(41Jl#B&ly2(hD&W?^#nN>M63l7J3(#%IV_Zcfy)=f0XeLO
zfq|<6#JS7Bz%`qJfom#=^OAvqYZn7UJ=Z1>?<)fX*J}m_u9xf(7jyk$VBq=zarqAh
zkjp`#{>b$M!wC`41?Zy3B_%l-7{x9#GcY|0VqoAFWMJTC7iVC4l=p$*gbFB~i^;Ju
zg|RX)ip>Y9sbOH?&ShZWj$~(Gdeq6lz<rZ}fqO4ILp{@@X$%aYs~>orKvIht7<gJ4
z7<ei{oDB>NJZBgfc#eQLdl?vbg&7!ld0iQp9-aEYa00ZQSb~93bT&x#JOcx-J_7@<
zE`u}!({sKL3@1Si0}#o;kio{}1ad4WdY{WNFz{M2Fz{M{e5%Dz&%o=-z`*Ma;+Zip
z@P;rj@CJc6P7DmZ$qWp<i6D+20|Rdf0|Rdkh!e%Yz&nY7fp-GPs>i+`7*0)LU<8v4
z3^8m>jJyntVhPL)Opl`(7<lJ0Fz|vL_&9@sfp-G~1MfOz2BycQOcOb{KQNqn!cfnw
zA`2>kCUP(`W-?DSVPj;>U;@=&AYb17z;HT*fq@}_fl;gn<jZ>u47~dp7<fSu{pd9V
z1MeFK2Ht0&^mXzD1JmOsP(m|dV2mkc@Md6o6c3Iq1_l9T2Bt>|5Gzk8Fre62k7OmN
zya1JD$2Wk=3lPb`A}PVcz$nfEEz9`W7#R4NpoI*d8Uq8L3WFX4GpLX`App_@A{kgD
zB}G96%u@yiK0^iuK7DBU!sp1qz-P|@s$O!=Xf(5ZV93$oVqjnbmk5$mr_Y(fA}czR
zfq`!x0|Vb2bq0p*ni_3V42+Ufr=Od`B3aLnmz<x&pwSN676v}1GmJ%+fl>1D2ZmhG
zU^N5BCyhD042%+C%nXc@e;63}4lywBfyO?hL|`0G21dyb%nXcD91IM6=NK6H&VV=y
z3=DiX85sDkgE%@2416G$KL&9u7#R3|fet}pW?-zBa)GI1XJC{HU|`@^V_@J{s`<c>
zTfxYf1wQ0ZhLJIoshEM0F$2U66JcabX9C@(2XiQBc!+_MQDYIvq5q%`<+o*E;I{_Z
zC&Iu0;UGJd-;;rX-yPJrky2n_;16eD;0JYsrF0k=_{$j>_)9@LEf^U1I~W-F+dv!_
z1_u5a3=I6!U=Cfzz`(x<<j@mDI8>_P14ABYO*{jqfW}5v21dzNPX<P*`d*OHGZ`58
z_cAc>?*?&}GBEI;V_@Jv1>$UEVBmkjz`*|uWa(}O2L7)M4E!HKoZ}1(0z3>10$ep8
z81iahE-+za%mf9JwhAn?3>X>H!6H5kpeiR1l=Q5iRSq9RJ%gOB6$8TxGmRoPMg~U7
z1H47~xeOXb>Y&kjHU@_JXpItX21dzy44?r23Syan#)d(J5{OVYVPIr*Vc-MlHDqAe
z^I0PrH1IDK3o$5K2V@Wj1B3Q64amVGAod%LXi)p*D+fb814p4o3~YrLM}<ZVXowY5
z-!+J9#KOd9cx%LhMub7)yh<8zU~x9EZ3)~Aj8fGw*GW~Ifcn26LJmYI!(As8YskQG
z^uLA&*mYMRuJh2W2RV<oD8HOR!vnT7&Fqhc2iO(7$qX7EehdtZZ`c?ZHYI6zf$aLk
z2F^qN;5-Dk_mc@|pbkVV0TC+^_Fk!AU<mb=;Hee(z{qlefkDaxR9EYrQOIPF;Hj?%
z%?=qeFbL=~FbIfBF)*C(lHjQaWk!(TR0altiBb#<7x^W48bBif#S9DrTNxMxHcK%u
zC@hiSX#mYbfCLXQFbM3EVqoa2l;CLqZH)j4USVJmxTH{AQp6y^(+Ix&hJiugH3Ngd
zT`2~JW)TUVX0CeB{Spiepo;_qWiuHVj)yTY>fHgQ7ydP(42;s}xKdKf7$kU$B|yjf
za%B`GGDz@(*5Wf1Gq`+Ul*|C1#=<DWBE`V4>aqkMGiV)XF$05OAOnM-KlcYl$s7h|
z?I>vSWK95fLJXZgFtWOUMs`{2T^JY`TqJlpSQ!{)blDjg4Feb$1Y;N&1fxLXfAN1m
zFtV|LRI-5@%_0&!>p=?r=QA=eCUAjNMEiYU<g@^(-~{zoRU~+AK`JIOGcZO+GcX8d
zGB60Hf;brr41#qG41zW642;pG3=D#u3=D$p^$ht8j4`J_Fmm1jn{fx!2$bLr<IHDZ
zj4=Gb$oT^-3~Dv7NbtsiX8Qm4ePHAg0F4mK9+2RT=VV}%(_v>|_&=M0L2w=egWx0(
zXDb7PkR1bqkO7Euh=D<<gMmS)3dA|jz#s&|he4b>^$ZNcIt&cLVxURv|0`S>82&&1
zz{mxvpm-P<Wo<!<-Y_r-gVfc6CPM!I{J_Ws8qB`Hz$iOenStT|FQ$nc><o+y><kRT
z6B!tUdqEr#1_t5P3=F~xB|b26-C<xhcLp)uFfbS1;{L$M?Eqqcsz}hRDQK#MLE{4>
zPY2jjSETsjSQ!}Qgh7j-%orGiA22Wo-vJrw%)lVR#K0i@2gLDXU=UGaU=Wc5aiSR*
zL~IxsL`*=O3<d^~cm@WMXb`8AfkC93fkC7k#A#w+5P8MGAo2jj>1ALL1#O`am15xj
zz{sV-!0h7#>R>pysyHz)PM^tW08T8Dvpz8L%wS*!lMD<Y61)kZAnySc^UE0+MEw{T
zM19y97$r9|Fo-5FFo?#~d|>2x08Me)9k2q?238<iAQgz>^$d)mogWx^Ilx~3Bf*;s
z^7=k@2FB3Y-~+oDL`y-O6$}ib3m6zgr-1@1WbFq=J|ED*e{%d1ym_n)j0$SZ42&VW
z85l$_F))apU}s<qdB?y2+Lk2x6U6z=z#yi}z#yg!GK+(O0d!lkSP(k{V|}P71A|y0
z1A|z)90Oyh0!Ut)fkA8$1B2L%iHr=4p@%;(@_|NEMI@LDc^MexJv|v1L$87qKVq<D
zU<{35U;q_$@+ly#kqiuCXBim8PBO55VB{-dU<`f7z$jk{3RbQF2C!faRIm>$Sf2n9
zZGnm|28$Lz1bd)@JHUbp5Wy)>!LwjNQ0L<VBi|gT;3KeL14QKtsNi?7U?T&A#0N&c
z9UwvO4~zmH;5Jh|V-`<wy|GGhy^OI+4TBORV<w{kxVdJ*z_5vtfic8@fkDoNw*VB#
z@t~k|Vqg$^#=szU55)0jU=ZhJU=U{qaiSO)#Pt~%#8p9Y<na3gqo4&SR^@^ucxUl4
zFe(bMGcbY{Oo)RNf&$-BjG>-EypMrFya6Po$iN_eiGe}<42Yx0z##q)blNqDW6i)I
zp~%1>Aq(PoFfd32GB8N^+cGdZrZ6zbWiv1;+y}{IGB8NQGcZU*gCfSUoPj~Eih)t#
zlN<x1V+|;c3r2wb3~AMbMS%QT5ArNC7h?l>EGR7P1Eb&!&|r>Sn*{G1P6kG0D|QCP
zuo4CaiFyVGiAq}r#<0Z<407`r7?pm5WL7XRNGxDrkeCPJY-M1OSjWI1u?oaF#K0hN
zfPq0`A1D<?zW%@{3>qo(kzl&P&%mg7+LM7X@-I6>J!2FX1B1jJ1_p^6><o;cGsh*~
zF)&EH@n&F*QvARuT*1J=paYUoVqlQ?$-p4-o%;i$a03I=sqdgxSsiGWM4W*!-1-Bf
zhzzLjD7Q_5=`$w-qY`LnKiq?XL6VJuL6V7?fiXOkfk9G|fk9H7`vap0q|IE<n8j4b
z0163EKrnFxfWsl2;{&5e3&?1>6B10Ip*^KmkO86$43a7g43bJ94(L>IeFg?eT@Xi?
zfkD!WfkD!O^#h|w4=9)!7?nyuC0q^MbVeIcB#6vmU<}^^k^xQK)`Q%h_<>ObJcK59
zOM>Yu$n76NX67+4NV+mGNP?!G!>bt>Bm)>2B>g}Z?0{Nu6=V#u^A*50oB&CKr5HhB
z#POezF#~iOg2V?#;SdI<iw_xG85qMZd|(u10l9&Nfl*ls6lGT#7$jpE7$hS>rU)*9
zngXhf6D43l#LUHH01hLA{~s6y?|{?F8wuX|oD7UApaR#Bmw`dDgn>b_092VuF)&DW
zGB8NCf;j3743g^@7$iYy#n6O-LGmjDL%rmC)(?!LA`Fc8?lUkd&jM#vc5wa`)nH%_
z@Md6C-U+hX1mp)}CkCeDI*bOOf<)8=lm-|WmCt~r9l%09P@(%EAs4Vv3RLJ5La2g)
z@y<*JMip*G#;kg9yFQZ<qPPd5SVaz`7-HlS2FAN_42&v9pzth)IBW-0nJYvY_XkGN
zGaxe|N+5y^;tWg=?|xtu;{kQ8<yj<n7qK!hsx-<mFg<)F@qtnB4Fhw$JOe2H4NiVw
z6#N5LCM3bT5~S=EI|HM^bp{40F$M-H0TAa21A~+?1A`Q(jbiYTfk7&ifkDcj^#dbl
za0L{0Dp$Z^#|Ua=GYScSoQ>k1d`N>r$N|)#5CS!S86<eug3i%ql2iS_DE0<aR>><!
z@LpwQU{oz*W?+&tVqlOeWMGiW1##>d7^EgLFi7>XGcd{dFfd4MW?+z7Ys<hS7s<dN
zZ_L1`8U>PxV_=X1wKC6udaH6d9~i}#fSNQQDUea`7#O5pfzwYk+XqH*k9tr7lDC)O
zy$-S!G-DMl!N4HR&cGne2r5Rwsz8IT4D#VnMWD_fSdkF}gR~Avkzw2iM#&vu_h(4(
z@o_RRYCd9SU^FaXV33YxV2}n)xf#|nFi3;O)j{hl3_*<T3=Gnn>p=-~Is=3BMFs}x
zlOWC#1_tRb3=Gomlo=QeH!@GW!2lB7$G{*X#K0iK2jZM&V35&bV31J*ac(d$$T%@D
z$k>T9Fv;?LV3d3V_R@R_?o1&DM)huH1}0er1_qfZ1_qfhb_OO{T?Pi3Vg?48Y!Ij3
zih)695d(wF1X~6sS$75o`9lnhY70S9J`4;pj~Eza?lFL*q8J$DFETKy{Z?jRl8tAY
z$ie!7Q7Qz~wq;;cI|YjAYH;F|%3)wue8<43_5>sb8iB}Q;_wA!XsH^IYLF<nNMfpI
zU|_JVXJC?@%)lW3gn?0A3}ovJ1_qfw3=A^gz_u=9V37a7z^HBrl3LBcAgj#4AgjpW
z%D^O>`+-pkw3LE_fl)mGBwfV70GiE^H3duW{J<y;YMiq$FskQ+r1vo}$c8g8$OeNF
zhU}*gjMAVPih351+;;{B**pdY&?+NPooo1kfkFNscP=O*l|W(qkAXq9m4QLFQJI0!
zh#S)01l<@VyOe=Jb}BmqqY=nmPZ=0wA2%{GFd7+vNegiXMx$vT7^NOCurM$vC`xe4
zure^J|L6X|DD?sw7WGV^6(!;fOmb5`Fv>K5qE5j;g4>&mfl;Fbl<b!=FvxypV32(e
z;%sJMkP~EJkmCg<=K~B3a;gjra*CilaF&5V!JdIpBLXCIiGe}Rl7T_a6y#O82Ok(^
zK=benAgQMe4053i403^x$of(bat8yWMh7TfKr_A{7^N8)nDgxz7&R7x#6U5a$><I$
z%cMCN82$Sh7&Sn(2cs3JIV0@?8W>{zz$kqKY7l5}m#GSDy37oy*i(=}We~9=P_dsN
zv1*2TkijxnAU0|WfdnBo8iJCH%pH)8(9SyR2S!;Hh;B_wX!DlC1f*Zq0xBE;6Al0i
zdoVElSkAzxnF=bICf)!$K(+)b2pZsLo>&hR-2fE@5Anm4o`D*>3}$Qr*w`BkOtYmJ
z7&Uhz87rp%HQ)kFkoyCpTn<POCIAXAwj2h=75x$)7}-h~m{gvze&A+g>tJ9qy2!w&
zB|lwoIg1kK5-8Vcy3KMH$$B<$fU$mHWV^t?9B9M9sFewI4Z{W}1}5VzklKjt1p~9n
z4F*Q7Hc$|jfa-kEy%+y4fLzSZ0F?x_Zkb?`ObkcBlF%^K+7B_8@%tT64dM)PF1tZJ
z17plh)(?#AM<Cf+>lH*5ldlG-Y6qE>!3eIY*l$1_uFVfs!El0+EqyXe#$*;&E=GnG
zI$+CwKozOM6g>b5bBHi7>OEv&)OLai{{gwdkb$-S10#n8R8J&Sl2HV#CjhFa6ebLE
z5hOG?3Ls&nJsBovffQC8Es)^Q-T(@#GH6&aLF!<R1yD&)`<|(+9xm$xwsa5F(w8uU
z!L3+ugMi}>L{5hRCYJ)z!pQ(}i;f&jxB$s5oFb5L)d3Ajfm%Ag7NCX(I7B&37?|q|
zZ!s|Hgo4r#7ic~%15|8Ed;oRWn4YJD7#BdZaI7B~c^@!<dpkO{jEq?<4(=-QAlrH0
zKt-p3Y%gIbW>5kP|9}dwV`R+YC}t>OP*QGS0!6vN4hBXKPEZ4Zfq`-Tl6nwJfq}90
zEQs*|WEY6>hk==G9jNlpU|`hW!N92VAM8Tr1<>B6P5`(MlK`?yr~#rzR|Kqv1)L3q
zpk;%uHppGf9~gg~0ju2t$#S}&i8@el)HB`yr85o%Xz$h60<7!+R9OZ@Hxm=M{Ume+
zDqIg0W(F4zVkS@rfRaBm7u=EB9}tcd%YbU#3rZ8<u~w#%dT{y^Yk*3D8aN;~vB-ej
zAO<eN85s4%pq8;HKt1oP!N}C-!^EM$$kgWn)-Z>Wsm}$JAAkQ~WbWHj56LkSJ`9ZE
z?F@{1n$X1lfl(p`Dr5`tbu9yf80!Z{i3tz~=z-evVDpwt4_M72S6>GXN{I&$@9E6|
zhcEL5s57)DfV@`=QS$|A#CoV>SrtH$ExCY!;j{&)q*?%yhstqm03S%j_y#l-23~hA
z%An7{sCOoYfuXuYf~OF)q`mk9Lwy2h;MoT>oTm>u*lO2437$ez$f$u_4g-T+hBgDk
za&-xwLQe(;hGGT=xlRTKxmM_aTrqS&PHqVUgWMueCr!Wm149C6C4h_sPpJR{qkaxE
z1Ec<21_n7$y|<Q~fl+@I1B2WJ1_rrPprPFQggKzB#mJb&xtMvWl+Fs{6%4Sf#o)uh
zz``lPlLmGxBPfJ~AOnGEG7JpL{NUq-BzQ6)gNhCe3=zjAcw9lJ41E2-U<TSBFbCu>
zgH_s~?bQ-Iu9ggp1|Zu%GBC)!)MjAl2$!hm0WAeKSkJ&9ugJh4FR9JIurXSK#~mDG
z3=Hyq3=Hya3gGcW9#0X__#p#>d<6r8e3=4x9FfNhVmpI;GXsNsqZ9+f9t#N`Z}9c4
z3=H!93=HzUGLRujgCk%Ueqb;QU|<Z>VEw>g*1^Ee3@RK9+NT$;Wf2!x03FieC}Cj!
zz!Z6B`i!+KiuFgpju8aKpTQPW1_t9V5<J?xj0}th|GB`|zVhfwFfa%@u`n?3rAhGU
zft|_1z`*rMf=3^;8RG_nDFcI#n*{eSkS;?fh%W9wNV>Q|yWsZlLv(Tf1AB^vfnokP
z3GVv;T;Ks#Qw9dlFB04jz-Gj;Ffee~OK?8|t7K4NU|1(C!5s?@d`1RF!)Kh}5nt|D
z9Vka(i3E47E0ohLBEcO8x`z5Gcr&mBH|P*p@UEf*t0lM-g&7zPUxOC^=SXlTiPbYO
zC<n7JFszlA;GPa1YGz?z=$$0NJp;x$<R!s96U+gvb6_Y2ZOS(`Wnd8Nli(HwIoHS$
z<QFpuZgEg>fVMo<r%P~4a4|3%IdUa4NN`Jn6EX_}!x0||Zb`7qq8S*nPfBo0N7pkj
z6st*a%YpZCJY`@s3IxZ8ILOnU3=&-T`9O&g)MT6{R8mm_5|Iaqa569m$VqVB2Q7>E
z3bKU@bm0QyQ}C&15?qiI02xj)g0ceFsTc-^P2VNBazSedia&tQx@JBBO1`G`5*7uS
zxeO9qxi$=prV<Pc^79xN<Yz$AA6Gtfuv-2w1B3j2DF%j3UnIElLDOEv3=HzO7#QTQ
zDI^z^GDvV0fELGo1vkbS<liV%f`mYU_LYG_L7IU<fmxw|L4vDL0u)CK3<^~Y3<^b3
z3=Dqtt0lOK6d+bBEM;I&m@Ngm3|xY%7$hjmz@W&>z@W$}#lVoeLV~MAk%1w+gMmTO
zfq_BM0x}xU@Ckfd9siLa1_s$J42;I}6_Se>B)H1J8JmGYv6O*9u@F=sGX^j)#!53V
z8gB*_;gGg$JtMS2F}@Ee++eL6Xm!GWgpo0wnTx9tR2niKfHrm*p$$Ld|4>bk%83zL
z;+x1oh5xMpmC~i)5|+sURDv=vnn0VTjQ<`mGG^8@RaAi7#*_k;^#!>NQf@O<K*ds^
z#zAahx&sxi11W6)wLh4uAcp*b%1i>ufR=!MU}WZjimgO3gc(|$)telEivL#uxq}%R
z946Oc!ag9MGlM<M`hk%JS}mJ^#w<Y<*8c{OHWp}oYsv@HwgRM$<qW9x56U;;bNLt;
zB7|ZX7!p58a2^81&DReMpKa<H7<kWsQldk$MPgApg9PUxeMlNnoWsDN*rCn9;BP9y
zdB_P;K`03_FergiL#B-c=MhNpz@U`Hz@X$L#lUcAsRZXysGzbk1A{Vb!p5N(R4ej-
zkY-?XfBAvoa|vkb{BsEd14F%p1m_7(21e79%nXd~zZn>m9T^yuZ9x+!AeCQO7#Kb<
zfJg=j39dv|21e6QFoofuq64JRq2dF>S00d&UqMBbg9MkI2m_;;DKi73Ll*;sayA2l
zawa<iqr-Ft2IVpa2IUeEX9)v?atlK}gK`6Cgus372Zpacpx&KKi3I0mkp4{|i`FwR
zD9>bIPzLoO-S;psC~sk4PzDWOx}RiVP`=N=pnRL1fzkaM1B3Dx1_tF1tREP@LZi?O
zwD1TNMSnU#%?-8^2Co1AK~o6~Umrk5&N3Md>cK-D?#dq+zA=EtCuABWIIoE?Fq(tb
z1G<|sFo3oitFVIXaAIIkkz-&`0gc4D`!g`87%?!Y=z(Nn7#LJs85mTYL7Yqm29*#7
z1{FULr-Xq)C7Xdk1>}AAMg|6zDh39X5?2OB_r4Dd-x5G8QCJul&A}S`85mTSFfgbr
z0<A3gmIKPG+#eXey?|6(nc!|o26$RqoPp78)dz;};5iAI$r7A5MHm<@*qIp^-S#jr
zsBC0lP+1G&oMd27Il;i7a)h0M(d`-ogUVM129>uU&SM4!RU-xlRWZ=;irWVU2Gyku
z464&XQhym3RG%?0s6GO@pNoM(jhTT#6*NcTF3!N9=Fh;O=F9ql;rj*#X4QiXjOO1!
zS*-*#rp53b+yw&Vcu>j`XJB;P@`2(17I3hxk>Jt?IWmZufzk081A|&L1A|&5Xn5K2
zG6REJ8Uuq`$_wyp1_Oi4ehH3CLP)b1pakL;_krPu3)rmF5}bEHW`Wiux)m@msFg7=
zsDVZ^-D(*a)Rr<ZsLcm?q>F(;?F0jZ8rb*K85q>=F)*mzlK8;zBY}b8bQZ`^hfVb#
z7#R$}rrwd@G8bWBwB!OM+anANpi}VF{((~JMFs|SDFz00E)eG)1A}@X1B1Fh$e;tD
zxZ(c5$N(F+2S*ZYf&wyR@B01&!;cFfD`c4^IPZh30L?vu&U90cXQ*dT2Mx-)@i8!{
z7cwxY=Yw1>&A^~u%fO&s4dQ4pFsOGkFsQeKIHn8?>hl>G)MvXgFuM7FVE6%^j$~l8
zYy`;$FfgcZW?)cX4{H4Vcmhg6(AWWa)>+^K!(Rtb7L(<d;9?VDV6<WeEpKpEVqj1|
z&cL94n4N*qS)YMH9pp#QV862s1B3b>1_t#nAQ?{v1`Rm|1`P?;4-7v=Af>7$Xp{n!
z#}IvDhMx+cS^`usxUTrX@Y8^S2~09Dct~(Q0@<3$%)scni-AGIn}MNT!=0Uh(e*e3
zgGL4eg9d1h%Jm8ZgGMa_gGMDt<{<-v#smfijXv%V3_o2U`8EqYCY-^<0S#gO4-7vm
zz#h|);Cw2=z-SE`r*w5>V9=P)z@RZ3WR4#LgT_7v28~T1PBa69#ybWEjaTgT42-TB
z3=Ep=3=Eo#AgNLY22Di<22FVor-^|<Q;&f`QwzlDXJF8DVPMd70CDCpFla_GFla`I
zGcX3f`M~gV1~`TtCD{H7Gca0%_BsXsV_?wCVqnk&c`AgPfkCsAfk6`#Q6Ulx44P{h
z7&MoI><>|9V9-3uz@T{;6id;59~gdt@(+WouLQdcF9V}>F=%!=nt?&{A_Ifwc@PKW
z;yVlsnzx`+)tWCD7&M=O))4-(03}HVM(Ykn#tdfAJ(&_87=Gn|1SLK&GW-BBK-Rc?
z{lM^R2Lq_HEE_4o`2rMZw?Od%3W(1P44R-NB(5S13|cG<44R<%TvtT~1}!B91}z1!
z{@ouKew%>9JXM18wFm>F4QS5A<tzh(mLUU!mNq*BqsuJ@1}%RE1}#t&yF6!L&?;nL
z(8`wh!0>wus1FS?r{1OU1H<n<V1r5}INyN`>SShMbeYV+pw-2|pw$L4XaNI*)?x+*
zEl^CltYu)(I?TYJwI5_q4ah^>9~k~vK$8Zjq6-HP(17NPz##xiiZ1RS82-3`lHwoG
zf`R}E&W|9g&VbfVyF@ZDXkBGs(7Ft=D~*9c>k$Kk7HIm=rI>+1>nj6;)@QI8OdlBj
zOaYrQg@J(~L4xzU2m_-nXuR4*gn<EcIJy?7z;MxKV9@4fV9@4tWngr%_`vW7ya<$m
z(H1m&>te~kpe@e8pe+ho$yQ$$`+?yPXlVh6WMJTsVBf~ez-SxA%)nHZ#lWDg#K54f
z0P^4i2BxxA;0`R~7tl;8!=E#t49@z2;SY3Z(H1mf2g;0pwt%XTKW{)6S%DnxeDwpv
zAJCQ=5Xr#cBf<F><nUdf<yFql85pz;7#OrcHJS4l1_o_w1_o_QP~14BePH;{0FIg-
z2`(NH21YwcW(G#53I+ykHwFf67j_0lr&b0A?O+B5ZGRAF5(9&FCIf?ZDrC(BNH-hU
z43Nh-CU8l7VEAvtz!(Eg=}rqiF#N4Q0nRtGB)B+57#QtAv*b>j7#Or07#Orc3o)Gb
zGcah+WMI&q2r~Z+1B3Qn1_tfzAkIw&2JKr64BA&foM#LS+P@hXv_C5|Fgkr^n#fVf
z!061tz#zLERCIwZ<&t1v&=F((!0?ZOf!T+ffzfWY69Z$ggdd{;h|U0yi!uC@0VN{_
zM!VC~`*yR4*JnW0J_o5mQ#u2p)SeAg#)1dQpcB&#pwR!f0W^!q{ej`%83xASK2WU)
z8n?}01TFTKW?*#U`@rzugMk@LGB8+3aLI!L0JLhsNr8buN11^^M-fyzJLxho=;$#p
z=;(m_X~n>xW5d9pV*%p0Gcf4*Gcf4*f;hnp3_8&a3_6jZK#l>~35t5hhaVXJ&j7W}
z{)5(p@JMi}gRBAVE_M9Oz@U@Hz@P&vpFr(Pok9i%oqSL!@_7LRW0WBSqrCk!i08n9
zCm?0M18A5EoXmKpGwx;4uKx^e_B&`p8^3=dK<d9h2b~?DW0s76Ktq`fUm~E!Ku0SX
z|5|{;>;D#TQyFsGGNS|Nhz|y10Z_NxAz6iiVM)IPr#`54`IV7@(P5Jiq^+#4$-rn>
z|BMCF^fd%GeL)8`hD&f7iGZ8YDhv$9p%R?jaIL?gTDd`5VLCxeTp2)n)p^1tIQhUj
zp`EMG(?A6Z{{>Jd-@8tN<29(q>o^P2$>(?r>g3luaTPE~aJ=JUU|0+~U9Uw;g5y2-
z@B$VFhK;i&INpOgf}ryiQ!Yqwya%nl0&(UkNpQReA2<xLiqUZu*s2s!21dtn&_RJS
zBsjjZGB7%>X8;Lxp$dV{`OyWds0S+ncc9-eFgmURcc6tqA?G-YkAXoTMg_D>PJ-hE
zEDRhULc)OKgdQl2Afd-`3LJW%ez!%61ji1TVkbVR;vGszig&>kAH7m9!Lb;wIuWXR
zu{x6KrC`-83=ET_BsiAIFfckLa;1R6Y&m!+2eN{UV+D9<1=Lvzo3Fya5Ia|bqZ@AS
z0;sv&T1e*hg3SdT^2!q~!O;hfH;@NX6(u-qU|O98pjvH^wc3HTLedI{Jy<6TczB7!
z0ohHCU^jsd1+|jka02TQfI7Ea1~Om;TA>v3NrD4%wGbl%qjMV6LOIX`B{Yd~D1bFX
zEmVYAn35sEp#+wJCIaU&a3XjBi%#b<aCCyM6K8Zz1C0b3Nw7bK`)#XGVo`lMg9Q6i
zB)iz3gH43k#SW_44WEI6r65d#9dzR*11JwUUxm1m{W4f5NIs@cf_)#%Xcs1^{626-
zfea<F9{>;WfD~t1NU*O2E3Ri`V03YZs$QuAiXYJJitXS#5+R9;eGS+}0$iYx3HB|Z
zdzy+FK&G6Rlwb!Rj0kd)OC!{f9<Y^At$kpvEDQ{rSS8r|!5omzur>+y9EAP5p;~j0
zwdR3UL&G5-9OfXcQIjOty}?>RF8>PE>8%EGIn+{LWSxF+on3ws?1nI%uKEz2_3Vb=
zAcSf)M%HQq*E)+^g6$n#>k5cgws+v*g6L%XfTWWR)I2eK#swY+W%~q^sn3;Q`vf|@
zycm)S**=Rf)H8sG7CG!C*uID{Fsv5_4TrIP6=7gV;sANqq*sFNHr(d-P@8Wfd6(@j
z%zU133ATG+H?uG>q-032-3QBnjJc>P!FCL0j9VPkm}ANe^^AtlM9y{stQr#FY$w6y
zKz#ryUAQtCB-l=a(-3NUe*sAvZ0ErSfRl!{fCO77+`gqy`#Mz-vBcI5Rt?SnY&~H6
zSQr?#8A!18$}ljxEd>=O!Dmz$7+jns*x(t|T^VYa9M~{U@DK}|9B6eYs1B$tkzi90
z1dY-|;{|?_2`F@wV73GmO0X$|22<-nqp2O?5^O49DX<?w*Ca7~1qGXnoCNDzm^a+#
zLTqMzi<Dwm--EpY2{qOa5JSN6&iWB712U2I6FAgZKxf%Yuzm*BD8?)d497hsSnEH7
zhBb|$A;=2W0uI3m>m*oD!L5D*wfYoN$;^5NtQu<dS+LbC3=Az_Bv{Y!Ffh750R<q#
zMHL2ynNkw0(?vjm!U$@*3+0vOGDxsa2eo<Yiy2}W7-Y9gu(t4iU{L$Rz`)=G8qxA_
z;Qqj%E&*yKLD~gOk!bDm7zPHNxe~0|(9y6@phdJUV6CShgJG=M#-Pz^1_qsa1_qsK
z$PgE6F4)lw3_7zI7<6Vx)iW^ggiEmIf#Tvd1B1>|1_qtQ(BuVKsVu<4{ej`L2m_<P
z1j<|pbRGy)mBuhI@P3tG^@TYFwEt`a$SI!Jpic2MfjVUy1B1>w$N({`zc6SBr<j33
z=K%wQ&ON9D17Hq(%fO)XQVQa}K&bn4nHU&!{y}CvScAaz3j>3$Bm;x4Fx1hW&p>s6
zfQ-urhEJfQY<L(LJsYGL80-rqSYx0g$ht-h47z%tX4a?r5|GCj7(M5L+G?PgIq(91
z0nj8I!>1b1bO-~Z=SGkucqEqLQx5}U#7hQ7&!bQ=?hg!~b}%qTfQCZB15D6XnCCNa
z<s$}aOL$(3VPMEyCBf<j3nI`aN)^UA4E2m&-q0{|GlPVYt~&#Rt~1m-UeRFhn1F0C
z0XY?G9Dpvb1udj!VDy4q@gf1T)yq4EfuaAl1S{w^dC<ndPoOn_AX^!|4nQrfcYr1m
z-4q4}-2|wu(3lSZ*(!k3)&K^E7zPGr0SQ*nJ>eh=KI~v%U<9wg_tAt}AOekf-Btz$
z-CAhOi$UX9cYQqrgYH^r%!|WB_c1W&?tsR;1UO$YFzDW9V9>n|jd@8}%ztKJ(0vPa
zG&JTjSU)g)cmi@X1EY5VD3ZY43ve)Ifa3ha8%V5rw}4m3m4F7=89w}hM5{Mwnv)44
z_ECd@G2#FNqxTw+DNr#B2F8di21ajibVJ2bpkkmYT$o;P-<pBZ`vWwe_<}arFnWL-
z@Ua78t`7?%V|^A(!xpF@D3^i6xIZv_JOeTqYB?yZgJUFE7C@8G+Ykl@<`hsa^Jj*H
zHOm4cND9)EWnj?bgoHKAB50`U^)WE$bwPrfWid>!eklWk-a<%Nvn+w;GQHgl40_uk
zVa>7>8rFK(85s1=DuC`Km0(#0E>Ia5K*w?E{Z+_G&0~;YSq7Tj`pUonx@<yUSRt7~
zf@L{)_KJZ)-<*L#A9P70e~tvp3Ni5DH-mmP14F%jIyCzHg~3rYC5VARCWC>|*G!6m
zfrCMU<pJoZqhbaI14RY~19^!L4DTZtm<ykP`ezY>9~j=R01dK(NCp`Rmi>ARjJ{>e
z42%)V3=9T33=9TZkd=W9@4-97KqLc$1XF@4C?eiAFw`@KX)rMQc7X!90-O@wf+wpP
z7=5=v3SP819f2v}IUSa@pnlieHK5Tt)(;GC_dsIL_cF*JNJ;Vb45$;!!07uNBnCAc
znlSxXKw`xVjP;NWMFLYm?s>-nF~tv@1|X)qgLVY{bU->F3GST_RGkAz45|(^x4(sf
z(Jurf2C?m30Rv-%Jp-d3Xdwd=RICBC`;~#w545QXv<Lxg@e)Yt_nQFH3^fpxAYU>t
z`Yl0-y)OVQIbvY+1FczSn#cjt`~CyeF=r6!KCmz_1~xJ<`hhkIfD*IB2Zj$lplIX%
z!0=%WD06}oqxc`zX!jQemzyG>63n03j)B3mUxH;i8v~=i1EdmWnGWhqfo?De%8_81
zZVakdL5&4{YYCQiUeJUvBLky<6{NOj=>(@#P^*rm3p`s4OKx4D<i=lb0k^jcY%d?!
z-l_@)hJ-W;mU^}i3`apHN*RDN+6xO%qOO+$S;D|zV9UT@V9NS|;V5V!*$W0ne^3xG
z+A?^3U^x1Qfzkg3BV!gXWbuI23I-1q4>bl*Z7;G|f~Ac21H;i828L7yaB&$>0XDe|
zbSl(S1_px^1_px!aRx?E3O`x{8buOaAi+|>$-o%k2TR@c3=9Uf(A0f&3MdzVNCp;g
z>VC=if#K*D21ao!2F8HA>H6nDCoLRcU<{}Lx!`Dq1dA{42Zke{v9&!QuLU-O9pI}1
z_1ZKB1_MxG!C5WA;tx99s)~WZ;5Gw;!Fg!05DhIB3`H0i3<Z!D5**D4Vqg%R$iNt=
zppa8s#2~?v3u;D9VyI^@RAXQ;Q~?E;4+FF9GzP{%9?+QFL=HA^kd-hn+inFFmwg;;
zrZS-IDa>|S9~h220gb>M0Ud3?A;A*D$-o%s$;`lPXU@Q2Xvn}|s1HhoM|r@5HjIIw
zqz+w$10GRgGyrAPqY4a+^)WZOKQJ7%00jbQ(Vr~?g98IYPn86V2`J`^KQMq>=r2IQ
z5o`kv4ijAl24#K*216GH216@t@U%ILi5+A*(XfPp!7xXPfdLdoX3#J)T*AO$I7b0=
zl%xcUIkc2Dyw1R2cpj8&@;W70ETE!BtPBi>KcUGHGRY{=;PQdtSO5b9g9!s;P#rX=
zt--s)7#NJq7#NI<SU)fv3xU*NK^~A?1PXv-C6JM!Am}n4^kS=lu^u!R&0+%zj$;j=
za*F{JQM(x!gLR-0<p_x=1|ts!1|v6V2Bu2k4-CilfP()R=-?zC2^M!=2F74EW(KB8
zWd;VLU<L-GKs^SgN&~PuW-!UXz`|`Rq{qN)cLmG`IT)n7o`qYF$D4uK?kQN9fq_Mi
zf!XdEs7(S=G6#|*f~CPpf`<(>4RdS*ND%5tuz&>vQ|Vh!?74tj>6@QRut<o5#u6Ao
z@z2S?aQ=}5i-bKWhBz4*wCp5UBqA6X7(myh)JGdiut+3>&W?ce|5!kqZ1?bkdI&7i
z;9>$)j4b1oU<O^MvWFjJ<Qq-~hRL@jn16aOFszq_7|Hw#wsfRlT7vl(_##k<iOhe%
zxdLP&^Ix!uTzN$d63l-=0b395(llC0FyDi@IK)5*+*e_~2f9)f+AU>%fG`AfFC)WO
zh#?O_hJejDJVAna2i%MdsNK5|+IEBO293PfNigq*>Z@m9&|;EcUI6BT_WrEpWMI(y
zB*DDE0_r!AM;F34AipgFHB&(c=SnbxZkJ{F3L43q_DzD>A2gB|3OelE=#T`nKWHS*
zSe}8wV5bCgpf&?zD0nNemW4b6gXshb<{)JT#?Xp-P=Tvq0lLlIQGz)b;#!FJL%>;r
zg@NJBdI@IG1P?<oI1E9D#xr~cjSw=2f}PD(!XUvM3T^?(GcX+8A;BC0IxGmhwOZ>3
zG%rC~ulyAPknS^c2V@~iJ*cD)O9MFtl;4f{8P+p0F!-y2_NYMxR2Ucx^(2_#W2K>o
zp<xRu<sd1A8FGR!)GA2xoPPo+;dsoGU{(UV5;PV24jQvcphY%d-_$dMro$P&f(qbC
z3KGm>pbp;-&<0IVi4&#~00|2*&=_|yV-{!!E3*VRA{iKrk{K9`VnOAVy0`?>A8_1%
zU{D2}>r?>Nod(g(^apf#A5=HfKbY=n1_q<bdQjw*6-qE20YzTeXUH%t(=pI6tP|8f
z;mn{&;`a~*?Sz7inKGS)52J=%;3`N<WRPGw2M$rtjXKE^Oy|H$dLT=@n9f7WDv<ui
zsQLv!Lk+q!Bw*%&Vgs}YFq|12_|l+yH|#U$)V-M!Oq<w1o1TQgYsi>388I*jItdjp
zNHA^IWnfq@Ap~*7W=KJ7$G~vZR)T3JNJ}DA%S?T^mRWM3VI2lLhI$5P9toxfkg|5D
zvIaA_vPM-<CIH3bVkZeE&>6;})r_D993&o@@<IETi#Zt>j-*I1<%2gcgIeTruOyg~
zp=X7t#V{~1#DJnBLeK&nnM}#h(K@3J28Md07D$24lnPG!3=Bp~85oQfa(`e@%K;VW
zC|x@S&>BPC`4UXAVAB~v`&*z+i3KMq2GD&22X9I+MS#<s0|P^Uv;-5l2><$lK^0W9
z>ww*o1x*_Dj-ZX*#f(`XlS6qVm_Wx|gNHLCCJTYr5i(h7fr`>l$f`iSJ0OJ}+a;Lv
z;Z8UJb%H+F36RXe1j!sA#UU0FOlok&FQKNYX@X6yhZyTG3{ttPT7pRqrZQ3ps!|Tk
zelrFJ?o0{BA0nV=VqlD13$dQ@2k0P;Vn_mJ`~^<HEDQ{54ofip1}Aw@2FA!(X!2u)
zCEt3+$S$tj)LaG$CN^;T1r;$&?BKO$pivCYY6&Jz&~dlL44^rK$hoKnfRuoeFVsBH
zeO}UMB^W<|J;A^jc?RmX51=`UVvzKjZ4!(xVA8LJ>cL5Z@dapYL@_7~D%vF&FN4am
zVn)!65hP7AUbY5#mMb%#L4xrrxLgFelkpnZV*(HlFx~)r0NjAtwM&9=Hh6I914GLN
z1_q`UP^?FNgQP&l*`QITVg?4I!}SadMq5Fp3gmLzuM7;viVO_K(vU>ScmkRzjjb3M
zjLlp=Ftma8gsU(xMy--(V6gR)U_2noz!>!nR6uC`VQ~4t&<Z*^6{O&eJOjh@dI`o;
zq6`c@2_OYwptC|+e=sm>IYW9;Oko`LpmoU5eZq`iI2b?;k=7fagbywXo-!~-vw@2O
zPEg>KESF#m;03kq85tO()i@a#9K$6TL6@Qn3xlqhS@u<e(UOgUG1^ZE9H)$yphR*+
z2;3EAw1fn*9RtHAE(u00kh<o2PS7RZ5{z213=GQrpu6X%NHA(?GcYjfaDm%vj5?6s
z>M2GBhJF@C=?@HVK}VT8fWkATRGWd}RE7kjG-z*GF$05f5Cem;52&*m!@wAQ2E1&L
zQ63aYAju*I2IB%y7`+A6peziG(eD)MLF4y~@*pEYN@^JxjH|&)KzWIUfiXq^Y6$3T
zWsr&v1_t9cunN$MVUP+Vs0wJQVmz6F!FVEA1*irFsR)6p09OMH494>q7>wtDT2600
zz?*R(vBCH|gOM>4v96hc0p#c43P!#U497s*p}}L2F^5?{FdT<2R*8Wv2m_rq_<`ZL
z0;IVavlD9K4;fH=9@ha+P=l6^HncLbf{LgeP7;g^pdzaN>np~LoDv3!Z_*zawu1Hy
zfzL&bm1h0Guob$tK9(J7+;<<4qqjZ)*#Z+vVPJ@0U@)B_aS>!3sE`A#5C`|nV#CtF
zx$7c0wKHZZW->@X?xbU2Fka8VV7#2cs-A)2w17lD=pc^R8V+#d5LC=F+~5Tr(JGNI
z&%nUQ0XiCa({+g~u&QGaRau}W#tq)o#0mz9EE&*5C2wjHh^+=;Cxh4q5OxZPZ3SX8
zEMR0{h(9O+x;L8PD`Ol(J%hk)iFCF&28LvBi8MAV1_rHsiBzyfpp)-cHcF%_Gcd;f
z0}UGs8Co$g9JZB60ZGTnaxgHgY?Me*1WQ{nFswI{NCwN8b1*QNsY!sYEWOGMa{B=n
zi6pR0AVelf4t)Mp90LPKeY8X($acLu5(yx>&_W^}L@(=>h+_jeme)!mmW_ddVJBl8
z14FciL<~swfP_Reh-T`Oh+^wzWMHWLTHy>TmcCjuFr1#&Hv!CMV2r!T3p#47ZvrT7
zLasLGn*h2f3UsNdu0r1gyL!;w2A~VkBxC!^pt|Cjz*lAVmDzxf#Ro@3Um0jU|5uPg
ze&@a%m_m7o!W^(dkfh0(z6h8k=rI4IoqZ9YJ04R&lHRNOz_U<a85rXWAv%4zK$jta
zuB2b!HtjBpM15Qz#2*Zd@v|UGoDnMeoIwj9zA}J(yj!~uJUb5Zaqs><37D-HAi5+>
zKyK#%oqpaY;RxzpfLyRbt&azENkIw&WBgkV(B<HLJfKYZl_8FSp?RKKcs(eTo&Tx@
zFj_G%G-s%}GBPqSCWvb>FoYzld4j5iNuUUgouFm~mNDc2-F2pB#RCpTcLs)%E;Y~{
z^$cGb7!yF(yy_~bnSiD?ZZP;WFswFJ(`5vy{J;<oDsjL~frRUm7#SE^&#LKyN8WER
zW~nhSh|8(zLP|>p<4X(-#%J^x7!$68wK0K71_li^eGz5`#)Rh#491{p<1>i!nSlXh
zy)oz%?u7pg3?_UG3?`seeu>-+3?|A93?_;Upi|dELe;<*+!r%2CQ5KHFnAwUlaga#
zOw0jsTF<IUfr`Hy9AJk?fi9yfW&?Xv1{BQ2pv)k6qn3eTL0&&I2cr)I1N+i`CeV#n
z;Fe2b0_ak~ex`5A42+2hTzSO|{Y<}Q7#I^%A=Pz1({Duv#>A}YjQ3eYrQ5`rDj69V
z6BlzbF!1~lXR4F{WmHh7v0=L5eHLNf#USezMT4%;*_b&!@IH%ZeX}+Lg93v%Q!vOm
zlNcCG3>X+pbS#Qe3qgX042((53=E*N-%Px;85s5&h%<riGy~lXYSPWXVA2RWZh}#q
zDMTG)6$69GHU<Whb({<g`~1Y2LRA?UQZFi$q%epxMM;1h#=u~5kAcDDmO^GxGJ`l%
z3@4~Daf5*Yw7A}sr|tuTasmTmQXHs9T*ANr;`cBxCgo4(dcdMqUnkDw%fP_!6%<NB
zvf@m3j0_B^pt<3sLtL2*;!F;p)L|^Z1-8!#6iSQ1EeI(|aVGE@j~gEtN<b&3gNxK;
zP>lz2CATril?)7~t_%#Ojy;S;$qY>35^*ylC}@}j85kHQNii_gr<jN{34v-rkb@H#
z7);~*7#IuBf(>P3VBowg&LqMW$iP^5k0FqOv51KgMDl^yg|9$oR2F_?U@$FZU@$HA
z`T#omhp}irsOT3w({P~-v~A6hkue=~Yze~|Mh1pSvzXXG)xeDp3`(H7goCkujspWj
z&NgvI@QmS&4-Dq;d8iaAZ3c#JS#id<vfwlR7)&QHFqn2&fEo+pjBm9dabvoNfx&bO
z#8-@<xe}1CY>$XDg07PT9k6fugn_~I0qX|_^9%-N>kSNyDV$&j9%;Bx#=u?wfx#Sn
z1PnNK*udix^_#>Q!8fDbU}RuS3E>2#Y;neWnhXpz>ENb{IO9D~Aql#*Qh`C7@fmpO
z3#gyB>$5oHIj9FqK!-I1fSMtx!r<^{yv)GBa0BX6P>g|GTHk9b&Uh6T{=XR*Ouvdl
z!+!&4ofzj4amE{542&s%aKwQFGXo<i4$LGN7|evcJ}{J=VSvTK0dO2-GWT(Sj(cN-
zMFsZ<hLSZ5%r>Ci1oh0t2SED?K#R0M6~E|FamGVnA2={DglUK~f|tdB;tN!5gQuZV
zTOhfMaR;amIf;S6%$R|}Oy3!DY^Tx^(4Z!WWZ)2I+zYxQ0CaArnI8j#nGf`=NwY`>
z2D5N*GOjOj5oZLis<`oi!S4dBFP6s4`hmgk0VKjwL7R)2i|>F(`u#pY1y6#8oQlDF
zbwOn(IBHYxfdyZHRr(7+RelBwK4AbgPW&Yp7z>m^V^M|-pd?w(u<I`)XksPx>jws<
z4$vvhjG!bL@I#!j4jc|27>Yqn<|Uw*OrM|t%HoVI&<Hb2XJ9Z(mSSKyd{mqfJZOD`
zfx)bjfx)aCJj5u@I0tkC5vW#gVPG(8f<|re1JKC|oLj{iTm1PL7}G!-3<~ctFqlnY
zU@!wMl`edR%=yN^V77pP!E7EgC<8Jun5|=AFk1uS@G&r$?Pg#w+sXZbq4*Cd-lvy8
zVNtBN{{MlYBn31CSOU7xKtP;vjsOE=I_RKq8$kvJvl9#qX2;kWm~G@37|cLUz9#X3
zp`?U?+5SFgSh7S05_0LFp-NW44WOLD`hlUu0hDMM7}JwMnWfkObdsQhEoc)7Lx~Sm
z3Y4ap>Y;M>Dxe@Qi2#`fjss9YIxsNkW{WeXLj$)Iw6GMMO){#r!6htXI<)LE1BJpf
zNZ!c-<sHxoUku`mxsd$EV9v_GV9qSXz>s1h&X@;{5_16thI(^8aY$+`1x*7ma7l<W
zf=<iHPzNPID+UI0X$A&!Nf5`Kfx%pjfx%n_wEVM3`U6Ah1<=4fmx?%J5hnv<MxiGI
zW04LhtSuNA%#9fs%nd;Wpo;*A3=ja7d3QkJ4l3##Kt-Jc=v<l)45bSg7;~9HWkSpi
zaYk@&|HcP~QqU+dc)mYV6XLH}B!9)h{AI_$U~VJDzyK;6;$i;sWMD9N7iVAuJ2C<6
zNH%ds&>bO}@*wx=Fff=$GccG(GBeaO7J*!w#=u~na+Z;SvB(8X27p}K19dGEM+4~0
zK+uA6i4P2=2{7lD?i6RVhsI4IXau+dl<>3kpk*=W+Cd>ufK@Rtn3qAzVtZ&=Y(AZV
z!F+NLV|`IF10!hB@eL^k1~XA{Mpu|8b}%rQZ%`;MDP|C7bb|?AXJ9bD3XNNLSQtEK
zU@(6w&A@CO_JN^@0hE-BK!eUK;*4HW42+rYKqp0JFff>ZVqh@;06HnMl!3wgF9U=5
zZwBdls5Sx6%H<+ZwZ|gP=)=#zn56>MX2HS0V8I5}W+B1AU?B$T2^F4!1%s-)IHM3W
z7>Z0loeWSg<Y;R{Dgz;KWx&8-q0Ycyp$H8IA#kO@z+h1y#K2(T1t}`PTLf<~FjzD(
zFj!PU!vj1*2ohY&z+kalih<$iOmRl=&7>f~a|{d?p!>Zz6vP=pH(E06WMHuP&cI;t
z8X8E_&_Du>{8(y8F)+xni!;hVgVWNKp`O9g7(AOH&IlU)2GxR=o(v3@t}>9@sjfOO
zFsQnVGcc82_`pyU14>JrQ^Xl%`573qE0`IWN*^#VSjI3gSVlpo35sGESimYl(*$uA
z&}o9A7|`jmMW6vRq*;QZ7>0V}X##0TPAmc+4h$k0Si~6(c^Me9mwAHDbcW_a%RB}K
z%N)=GanSrlu?Q%}i$RTG4sk|hQ3l2w0qFdNWi11PWi`}c#Uh~f#9(zu^B48SpyL1-
zpu+I^3kV-Re<AUKp(p|r-=M;i1y)9Z=CwfCmRnhzkqMdrN<o7v;NEpEGbG!xBV}6-
zSZs7KFj%&MvTeP#I3p)4IwmtPSWbi$N1z@*1Lq5IMs8LH#+<bvzgsadSk7Z$u$%+p
zxHB+Vu4G`aTn;aeY{0SeMVyg`i-9rcCvtIQxs8Frato*+a&Z8W0S=%H?!mxV4{C#D
zFmZqiBqk0}iS&V?R0QNzP+xrUVet=8j}?NpU4Z8@bIa91?Lu+Tagv~$?k$fqFj(#f
zodzBDfuRs|d^?zAU=jbp$H17I2F*v7uNW9CpF#7H6(a+K<$nh55A_U%D;OAa%fZzI
z19$*n$3b!M0Kkn83<aP`LGW4M`H5;^OD{qj5>|W+3|3r<pehzTa(07(!AggL!Ae6h
zF*%t*{5mwCtvneRtXz3=7{qUY0{N>t1B2{o@tYtvNJlI~J%d%GETjwo^&=S=IJ3lW
zb2BjJNkg4&mCwLnl?!ur6$67+1?W&((6Qr%GN6=K2yzjN_<ddm#=HPf#8@#fShX@R
zST%z<?hFi86Brn*`rw*$z?wiKJ{;mtSnC-W^IAa)LAvHLFj&n7aX`9OFfdpx1L*=4
zYlSAD@~IFsEXpGO4CKCDF!ya?V6fT*bKiaj2CKc0v%Ehr6oSq{WZ*0lf5FMXnD-iF
zFvylu3=CE$Kpc=Qp;s9gtS&RyKq`wuaAm>SB>oa~aYPX)Kp!zMSb^?5096xK-xwII
zzJO{F7X}7vMg|5eQ0K5H0LJn9z))BKsx+qGeZ!(%A0>X6_XD^o&H&yHpMOFP+%G#U
z2WgL6^D!`3^QbW}oNo|6tPd5FWMHrsS1iddW)MFCUNp|YV6Do)V6Ci}Qd-O)ei9~T
zz`$Uw2TG%RPKa-Vrcpo8VNKwkaDlQcLp}Ixc)ul}1{B*7@!hNpj0M6Ve_JsySlci#
zSX+TO?hFjpJ`4=jUJTqH82k>vntTQf42BF0Li*xML6a#3u^bExyQYaR1>My4Rg{6T
zz>f{=>=k@qXA7`_J+>ag1G%chTD%^#9v9SBGzTr+1J4^2Y)~vpO=l3F2u*<2Q49>$
zVXPk*EI2@g3Ik&Ss7J(9YyfhM1-NMi&KM%#j8Rc5o(c77F{mRAZf6#r1!sbMn27}p
z4Axod3=Hy#_2Q*4!A=GS>sEDe+Y@{>;|&G|>$waJ*0W_97>i;*FcjN>0*P~(cs?Hk
zV_^j-hVvL0tXD8FSc5JxDXL;%u-?MJU=7-JTGYnCV10yv!5XwpqG%F~11cF4KyeT5
zF*P(?D4Wjmo<-Ve0>op5y`WZINrN1y(O5hOD!35jyAsg(Ck(|WAkD(Utxz$Lfmc9c
z(-Ysb2-nAoCxiVCYNLQEH3bIoWKhnV#0w75WY7=?Xei45gm^Nj=md>8q-2OETY`G8
z91IKxPKYOi_Hj&N&}3j(x=1_@ZW<_V6&S?hz@~99Fxa0Ej{}(oH6adU+N64j5piJS
zKt{yg6OV)&F`olmI7Na+b|*oMhy;z3L5+w6)%GCq11H2IK`}Q8lthj#6?X!g@PVNK
z)YzK>YBrSUYk>U&+OZ63JXv37V6Z-~#!wG(mJ?{H6e#ZgGcZ{HR0AzS7Iy-bB$F5z
zY?K%nY~<9y9(4i@M1jPd7#M79!0E#sniOo(85nGm6+z?S;vO)udIkoYYG{T3DTIOH
z*ix4d3<aPqF**#4#W&R%7&7XG#KEh=L8eY*V6f>ohO8ba*a9lf3cx*d@c>>1#^U49
z%GYKN1B1;hXyse51yuQhl_6EW1zSL=0V)cwdm(&y-OK%fp<oW^<`~d<JIoVf*ccdW
zAkC2i&<R}(oI&Cq{Lq$&&1wb)o25381q%fk;QBC*JI=xevRI)Y19X%YXB@X4PbFxb
z0s{kQ9NZoTI|c@>iN=gvj0}t=JuD0iC;5ySdBF7uS3z=MCWA4f2zVw+l!37%6Fhfh
z%qR+*d}1uAK^20GPr+4yZUHS{WBd$c_$Lkq2FLBw9X_!rNH4tsIwpmIp?nP+1B1Dn
z@dvPl(F_bn!lze%Vv&=bX}kz>#VBKGC@*Nf)Oe8&XaWgh#<ou^iuJ3F7lV=|=t4`^
zc;jV~3=9h&f$kJ#FkS_UVenAv$`!_yFmvwk=9K0!7*~Q;MuSo)N2hV69s`50FdNv@
z)nF&EF)++KVq7D|z*u^R4RlVZG3XXy2GEt8^G+J~fW;w6CY;f66$8V{6%Z?@gRQIw
zdBAuMs9e;YVO+}z8lwYWaJlf2Dg(o`4aO;q42)%<yIAL)G)~b5SpxA~swTp7Yd^Cn
zGOnI}{xge&@-ky}sPoJI^5z#X7^`c6Mg&2wJZY>AcFlCIFDz;ji;Y1G2{mJRiqjd4
z4aFH4%l@)4Fq}O)-Qx?3a(%3^9oT(r3=A&!jP1c}Q3l4ccc3xJ8OAyghk~4)7-;MP
zo;n1dW;6E>17kU_7-*#l6DXl9F*jo5VPs$|&jKeDBSt=Opn+#BjTpsX>7?8poG6SK
z#UbgWUX+2cJPK6|l2G7EKnW!>z~~sr@Ymo-HaaE)8t4V54<pFMuWSqqc4|haq!}2?
zUqd2+5wzGkG60-#j2KyY$_f~aZi+K7EDB>|VAwaw=oWZzA()MUp_$w0HkiZ4z_8`7
z(H$6j)jOkqkohq_28M;J+!+|8T#bUEfnLD_3Us4jO;DhNrsqUDCoryIV_>Y<JAKbr
z7A*~-35@GSKwK8kQ1}GK4X`}|W}*`qH-f?$Gz1pRH=XYri)4NE1jbEZds!G5F8-Rp
zxEUOJq6~}`Ygs_+ttK#j6a_V#89;%<Sv`UAmpCX0z$s|KeKQ7zJqso<T0o~>D@}yT
z3K%9ZS}1|M%gMl?%r$}00#y8huA7ekJb}?tlYz0)gbTDRe*&X52gCGb-&lmqmfm1s
zc-9Uw3mj?_7?*LC6){X;tQ2Noth5A;6feBX$G|X`&zyl_=H3a6Vr&eImBrKFePfZW
z7oET;4N4t17(jvH8#{rK10>rEaS4Ya$R!L03=AIECj4aq)j$l4l`DBc&io6J(`8`T
z5HaBcNYh!c_y;wR9u80;FyVtPSc?GzLxAUmr!f65!Rnr>Ffc5V3j-w+v9l8{vN14L
zDT5_0YCsLxH);Bc?<`6@XC{EJ0p?&}tO}ie?K_K_YQ=<7koqIM$%zFF6H4Vl@dX-i
z5}i;A8>DYNJ6-Vyi+KHF(133Bgc^t^MHv{Ywn9XD`N1&($|9WA6XrqWL0&DsK0%fh
z)ca*%tTu<(AS;WoK~@bEp&X#;i3zfxB`}kC$`XqhCV-|?897857^}q~7N~%XtiJ)8
zqOaC~2w9@o=?7A9g8>u*+ENoc*%%nBYe69}u~Qio0=#8~3==!;85kDc<zQea+c>e)
z9W-dpQ&z+<u^Sw<Yzz$6PbT(AGBC^y1(~va_QYg12F4m)u-0T928M<1Aic#4C#I-@
z#X*<bPE1t<Wq;nxJcfy>pbFg>JbO4X4YcD3)E6q-I57=WL4O5Xl>xSDdhJgZiF(6N
z6Ei_W3!uWY(tlzms2l;YSG}8<CBeWjHvr<IY_N+U`I+JKGzNz4vq7nF?jHjNhW7sx
zy`ky7W(wGy-r689@`8rACwkk07KVfE^#$9@#=xMkZK9tn17pn;HWmg3r9aapezE9j
z*4zW@H3IA9U|=x(G|>puATb8(HG%0}^=^9pFBZ{yrH>Ppp|;ivfpseDf^202nK)4u
z<n|~~6m?GoP2e+pWl&{c$j~j0W@KQj_2DfmVknN50%ay%P}VDs22I|ALT#mGakM>X
z2Nq8zLva=;?|%iQpmTSMF2HO%4r*}6?JK&V0a_x!#=xL;qv(<f17q!RHc%2Ox(q5(
zKw)SmS_EEW0b(zbE4mC?-~nO_yA)kfVqmO211i}Simq~lk}V``89kpdFr2%yaC+iz
z7U6nT28Ppri)QmOFxCZwV)RDQY)_Cq91IM?E=6<Pp=JoE7tIrAV9@)<#=vmlV$pm>
zka{)-2Ay+73qb4QjoBC&%mj-T!r0=;MT@{i+#<%*q9TSfOl%Ac%O#2qs4+0sML^ua
zup*6t!SD26P$bVz<YQo%eNdHwL2*V=3&=5-A&zPBKsct=4eFQ+SBu(V4lolf>VR3g
ze)@FBKP=+)3Ps(VpotKO-P1ug(}Efr;mjc8L6IaLP?XNgz*uh!u_PVjOHhytyA)-(
zLM;(cFUo>ha^Yf8HjHg1T9gB`P&~OP7s;0m5S!{580&o*7{mj>3qRg~c%US2ECpHv
zR&T4yz~F6JWC61OJj8wr7lbD*ouKx6A1<;M0Zl4`Li}ox4a|OBg(6#UY=RpcMeqt;
zT%yPx?5;)i;2=+iIEI0-{yxaUdIpBstBMlgPPz|vk~r8&=XDtvVnd5`*ccca^dX7O
z5FAmW42%t+8)kH86d6IPaFB=sC{4jdKt&-!9yB+cy04;0o)MHl7#JIpKq+}&k-Q=(
zAwv?Cf)U7zJedqdO5kJ+YEjHzHHq;*BLicjAq!|3%OoZ?aAgd+B%aZ66$=By=`)j<
zctILKRq3wK=~n+(^rcr#Vp0H!fsPi7dOV2<vIdcbfk7l;ddoi+rC1>r28Lj!NlaRh
zViQ!OPOg~51i7#l!~;oMfF}7sSAfScFwFBVj0MeEM+r<81I<h~onm8PINm*3PL6@G
z=@i6444<d5F)-v#oX-58MY+CbvNmWL%nddM28nBvAqyzk7#I%qPqqYQ?n!J649*>s
zZA2Luo6hrqjs%-*V*qAnGEBAwJD!b!LFUb5PZ-<h-DDq->MJ}+rNs=BeY6-Do35}i
zFc?%%4u`3k7CkuuVtPFT!;Z?yi4qKqO*h#X7z9sF&IYmXu`w`+Zk?QM#=zKgj|a2>
zZgLJxbNI5!xu6k4M;=g<dU8Iv!N$hGkY_Tv3#O)L%H(Y@HoxfPJ@O0;-NqnS)q|sd
zGH99ry#1V+v1#R0byiL3-6#@}bOBX1HJeqwUap{nje)UQjwh3$0B%jzs)BAgkSH4i
zgWIKo9&rZ7W@Q1MREB~{(jX?d(KAb#kAcDczAgiU{k?)}kRjo03=CPT3Tk0meZvas
zco-O)!$F3FmO?Rn1(hp;N30ka8ng>Qi$<6kn>S47VPrL7JUZQxkyR`!w;%@80R>GV
zxA1_McND~cdcI$I6N}Or3SvO(GLL|~5w*Sm++PMw-OsuYW}hx+V_+yfhF~vYgR;Tb
zk2^CIn1j}-v?Q@HFa+~WKgh^xT|d3Rii?4<B?+7dpE5AE6oK;~52!@yOD@pnWngUS
z<Sk(+&^7@D2q;@{owi_PVq{=!S;E4=psrxS$N`FyouHKy3jZwLfYN6RD1Ej^SbT&<
zqT^SKkBXpf1gLW7+G}x+je)V{H|VyUb4x7FDS=u8pg#I$i*tG)HX8#&hLFWYkhwQN
zE?LfMF^7?Xu@#idXS7<ZlmM}LigR-rELMTppm3d;q{_gsvD2a-q|%Fxfni3g#U!vS
zMCD{K8+5N!Wr&46;|Ipz5(Z8N1{P2szxC{NW@c8EdIg@M)G`JO$czUxUp;FVWngRt
zbp{QSEy6)Zrz(J2LaqDQ7#J32S|ow441LA`ij#$z7Nvp=3=uaOK;fj)B+Bv)<Q7ml
z;FB)O$^|m#E3~2kb?Q}`K<=K#Y|6lpYbnaImlw1(y{(Otfx#zTlx43G17qt~E>Lz8
zWqAP#3(zoETNw)j!`AJhEJvgn7^dE4VPG(vC(3d}1<Gku5@k6L+L6P-!oaZqwkXR5
z80WmcD9c3{XVMu_mP=p`xIKUImnh3CUeMOiui))6GQFZK%XvRAY<<JPzyuy9>r&T-
zxN5lx$W;ssHs=`_Y))DfF^IA(_h(@2QfFYW`NqIt^FbkxL6l{s1OtOWA_If1Bm;x3
zxD=?ZAj+~zj)AdDhk?OXoq@qtIf#KlsGNbZokxm+L3f5I%W75z#(Kx~3=Fn53=Fnb
zpq&yz%?ym4U%+#*qAY75&SkI-Vqma!6K7!TGW@`>4SYzu&@54w?VJpZouJv*E_((B
z+nEduwv(9|7`uEJ7;JYkFxYNpXJG7#WMHs;#=u|;Ix4Iyje)`T9|ME!4{-*@#i<_{
zwl84-U0xuxPL!pWlYy}Vbld9UA_fLKHwFefCuRo5#dQn}c5w_0c3_z<1_rwd1_rwl
zkjyj&20IX*#LmFDco74G-3kT<yJfNrjEmQU4Q69t5ZWag#m~Ul;RsTHfPukoD+7bw
zMiA!=1B2aJ1_rz1atvvVi*M*bb%E{xX4noIr<4)(;ejc9%D`X;x^rwX$cT>&40i89
zR^DJ>u=~rvVD}q5OTPU81Jea{&<QT3pdFB)&0wHGooyc&n9gJ{Fm}{V=U`)%(O_U;
zI>*Ss*f9q*x(8C3$;1IVg9vi6%yt2&>VwmL*jQya6`-mgOfO_(72~vka66f%Phew}
ztoML&Rglb5Vr0x<sbFvb@B7=H09E0JqyluM7fT6DMFCU=Xgd)T)IDk_W;B5O#lYCv
zfn<gT=uF)DV(`+|?RUTmq#2kkqCPNycwmx&K}3{g2Pl19WoBTuNM~TM=VxHB=VfPL
zwkTv^u$N(Au$KaHY8e>p)fpJ<!7knw1G>M5fwA)y?D8Io4-DH1z`J-{J}_+mzyJb_
zU7*xm4@<zH^lNX#z+i6x&R597e4rc(B8p5I7?i3+Sz16PWmgGkgUbz3mKI}B=HLW%
zwMAK4>_ELXuB4PS22mF9$n;JY1_lEkQI<*IrX6UCOUOr*1w0M^^#en_q5%T~Blw2A
z?pzB<iIHv%$*A_u3=H<xpiQXzL|HN=AX(KupMk+XTZ(}pY=tOG7EG{>fx*5(p|~`c
zL6oHsViAM=5(WnQIZ~jtVxlZXFu|(~4EASPKQJi9FfdNEW2k5B<^jbC_&N&)#T>98
zW48iG46=VxaRvk9gjo!X-6kM0sJazUb)ba`Oi-~qP<1gNb&zxV6yJc<LHVHV0&Dk(
zvUtI&$?oMsN%f`045BPvRv;g<Ffdfi7G((sdx{I<nFxrxRTvmjaz&Ysz_j+7LW)}E
zBgP<|;GrT>=9Az`3v{ZrswgvPGZF)+-0l7h9wQQEJ_T=d_P9d|XXbPDl3@Lr45G|e
zKyA9Ophn!qU!u%6L5(<2`M+0Elo>Sm13uTb^{goKEzq8IP$8{#LzMZU8YuF?Yv6kz
zV^Jvf<f2+Fz*Wp3%KQ#&Ckq3^`Dda$%pYOAi@&Dpaj{C8$%!)m1o;zmbWeM}DDy8E
zr|YRG^B=e)#pOhq|G}KndUkp(7pr8wz9@?ZlEYa{VH~X+qAV6*w}L#V+bYV!0v;3s
zwP(FWSy)9u$rh9?R2UdGUJzwo2eK5@mg&t0FSQqCUS|qw1#mJjs6>b|uQz94nDP#!
znNO5?Be>-Vir)IJyQ0j!aIN=+zzLeU7hLmjGBBKz6J_oNb&)}S6F(%%+z-|Ya*|Mm
zDDxzc=Ro=86u&6*6p%3>b;kXo%+p|;Y(7!ug<xgiWlZaSi86yW1a#?qV3=mZP|v_<
z0%{cWdqc7kbFn5UdKnlT*clic7%f2UR#E0+N03h#7#s{37#uV#k`jv;M43xK*Vlbz
zU~ouaU~mAXI#5)XsDXlo6P$&ZOF%gl)M5f9j}q{v7ET5RQ1U2o1vPy@tNK7mq6}JD
zI!s_-aOi+E8o=GAb-$z-7%KflnVTgU7zEN77#y}TFgUDND98t;iWZo*iwq17XI(xp
zOaq;`$iTqZcL!3>GPgp~FN4D?1_p;`4B`yT7Fr(|rh{UQf#;kkb0=s5v>!CrYGKa6
z;P97$!QnTk*mPuIaO7fOa0IQpu<&JIaFk_WaFhmBEYlhon9cSwF!t+%@+gM}Xr^r1
z6zDk`;G+*=CroO9TNlZ{M41zLKQJhOmiOd<LVCiiECz<=4pHVrM+U~OdUeJui;{c>
zQRXBNSDk^uQI~<iQ61E>U`~OyEFAqA7#w}27#LiSh%%?hLW06Ej)B230@B=IPK5@A
zV+8|)V@VJL1JeWs#{P%UU`T@ogJTZ^gJTD1LBArX!^FVAI6)tD_n+<zQD(TB`3ww>
zb3u*13F6SK2$cd?HPiR=vWnJ6fdVO=fdMq~?zjR}ofI-KIBsQNaNG>y)G{zQ9$;W_
z+{fSy32{XZ(EPC?DCtUwGUtMBas~ys<7oy4$CDtlKmmS@fx+<#NINLNA2KjF-Ulbx
zIY&g9!+1cc>H~uUXca&JWBnXZAsGNlgkgH1LY^@TQj#-+k|85#*!mp<gX1e`;6y?L
z$BB=D!HEYHI4ul}6S<**69o+%CrJhdCvi~VD1dg&u`n=B)I(RI&cNWL%mCeLCdv%c
z>Hs<*RFv5V=1S1Sw*n}xCmsYl(#HVeNT_@KVD7PDU~sZ>`M{t6(g3n>9@IjAn43Hq
z7@XWekuh;2G%`R^pr#|J1OUYwh!3iXRTvodGKn&qgR(uS6q@8A1PUK>Ymn8@0?7ha
zAc69u1!#L4sJQ0(B+6_9YI1}6^`PwN0(PG$1LGuBsHLEb&B1+5#z~+JmYN`op<*z1
zK)IkzfDKWi%)Foqe=`5{pZu(H(iNi2eBulY>v%XB7|yDQGV>`jFir+-k(tae-AI7d
zSXxq)Ss3I3kaIw869%n@260j{rZ)(%O4V-?W!40hVIU{!%n)VP26MoDQ%2Ce^#SIh
zOh3R@+OjY(EP5cy^b3^OK!u^#Sy86nU=C<!q>ZU4(^AF{40cx-7#M$m;%J&4q~v2-
z3Ld*-U~r0JU~mf3W?%s6T&e;Z$f{>xaOz@UaB5NjH&d9FgB{Dj;IxZ@!D)jO14HB-
zQKl6j!JP~YPLCKEobEw7RE&Cef*2TBvltksrb{s}><t%X+5?KANem25Ul<siK1ne!
z80m^Kfvf3B3=Gc93=B?xr5G5}SBf%$m!W_J73&!ooTWhqRWdM6DUf1dSimC6bR9IN
z3zBwXU~o2501c{(GTnd)W-~B2r@MS$Z~!gtbzoqe5)abGAj)(bT#GR<IM*^TI9GFj
zU~uRF-N*$h&Oo=sf&_dR7^msM1Xw>X*w=4iU^;P^fpJPFL=?2u$_i8*+8<$HIv&8l
zIAsw+0(=OG{T)b?ddfj02~hJDe3K4?{R^nRTL@`Skbw?7P<^1oYauOTMo-3i#tcx)
zp7jHRg9Jq5RPb#(;FdF^7g(bXMB`LLgo$1t3pxISr7aj3C)+YGPW1*!gKmDw1f5s`
z@@)=CBS;i#8c0(y19)Msy#xc(k^c;g^-~)`3Lx5`J}`kuO`VM)QveC9si0FV*owg?
zTO$Ij1!Nlo<J8-Xj9EyMo*-KxPPLx`Rq_|EWcn0gR)P8j5F4k7gKPw!CB#$)?gTkh
zfMh_T<)9VPAW=}OdF~2PrW$V0T+RmuThQ7a@QRJ;nih~mTmur?$-v;;!@%GSS`8M|
zEXo9)Wd#YYWnge#4NX)%;OqlRgnJkmoVU4rV6X)hkqQiq(+)~8Fj&44WrDOl7#N%{
zGcY(`<o>{5djJ$sAU8omt(XZMqP9Mez?lY)c(4?t4`y2dl>n`Qh91>y1d2J^ISfq4
zI2ahG*Mp-RqQw#vT*Y9|+pa;gh?xOY2uZ#WWy%FDo|#?+Y3njUM%hFe7^jCriZv$C
zx>-oEHXSsPsyjmzCIl_jU|i6S!FGiTQ6@*w#u-raY5F-%&_sYJlcO2*Fo61&>5ihT
z5{%W;qeNMyxhzDPEWp-(pI$G@D#yM2qbQRONMMG-^cAA4avCKcM441UWx>}E3<{tY
zo&=~gnsF`wG$bg>qzc|U%$OB0{hcVQtgG__1_ozPv!+E$lt}|r(tKrLZ~@IDGl?@W
zTe^K<Pyp>5WMHZgWm4y7V4SgnnSt3doPohbhk?OG3sezXYD^ChV-=IMWMFWyU|?`D
z1BcUv#iC5SV0V3=UN6Qf&$ws$d@)wh`gEu}*uixMV^%;xW*&nm6Fa!pV9b<aU;w!U
zymk=e5*G#r7biakW=o9^3<?IIl@ClgqD-6uAXk7ajACGLiC|!mWMD967i9#kR-3s}
z2%HWX?}OSRJHZpLqKu#u2^cw880s0gpNKMouZjSb`HQZKGCl_R8hoP%>n%~n4Inqq
z`~`_y#!cXUj3@)+%<GW2W!wU(LP0{WP=%mz3sV6~EYl-J8CQS|oaGHQ&}$XU#910p
z?Vv#$NNSm7jVc5)5vl@YqKdsJ<0P<&jnn^#v+CA6h%#2Q#WFC&-x6h1=l#Ht7{S26
z2;TcSXA-29&8ThwX=S_QF)+BKfDc^~WmE_4*FD0(;IfK=!DSh!7rRfCQ4>5B#K7Qk
zjDf-B2nz#)nT#l-7P#XFX+1OCy$iA`h=GCq0t4gh*`R~iIIBe&^&nH33@%p~7+fw$
zGccQFeqcyk16o9rxQ2m&fk%{4PmF<ab^<d4vso1bgUd4p2A3xwP8$P*%NGU)mrvXu
z7!tQIFednc7S(fss++nG42f457-yFu<#uppPkg|@>`=zQIJ=7xbX6!Mzb1YF4P1am
zY&iZffJVO9?=UdVv4@O&F@iD}Xm^t<BLjoWUyuVuKQJVzfE<_vN+$xMjE-UqjC0sP
zZc<}la1~}?a1{h`j2IX|$6&k4bAMn+GJrS`bov#@nGO#1Dqt5S1u!s~1~D+skpf*i
zzz8m2k|H3koCB`%iWxwM#U$0h9T@}Gm{`HUWc-hTaZVU$ff@4$#*g5`z7i)uuJ@V)
zx}_I%?(WALM(Dj^%myoTK)r(`7SLvedPcU)$t+ouSy(4>EaT8&0JTLfh>J2R@P1$b
zohi%!UTZ&B1)3BT3?WIuRgZzeRSTLFK&1pYY`hs5T;2T`80V^hH8V3Xu-+79RAFUi
zV4MpIhBO8S*A&(d3{EZ}UobGv<%NbnIMfwD9(0NURWe|{187G8XiD6afgz$?lu-zj
zZ09;abEgn!PI)KDxkva!898}BFgSwtLG*wMt9gzV;KGWL6MP;51A}V`1A}V;)VZ8i
zpgB(l2G>ap46b^8ehiHB9KpIl?mZ>S$OCfkJU<2o*L4gGu4`C7FgR`iIf{XC?t$rn
z(yXFfj%T3me>A;7npHy65!$Gj$B0O2pv?iGgPTFx!6}P@ah}Tbjnb@AtSlhYreBa|
zm8jPe{SETfyl7r<ne!Vo&9IXpih&`mO!O=72Zk`vN?&l3ecpQwu%EtyW*?jw7+m)-
zFu3l}0L@5<ezk@A=q3Y$>s1@bSZdf4P-(}WEBXWEAJ8bO>o*1l*H3}qQB=^V<Kix<
zh6V=EMzqD#7#1^vhD|}+F~S)@zMI}C!zx;@Bl@2A14ACDtp;|*{1%8S-s?fqftxS`
zgBw4@74Iz}u5dG8U~tocx+1Ry<O)t1(N8c}xcM?LxOpPGqM-%T5qS$hjsWkS2c-ix
z!G?wjEud?IqZk-Uokd^peqgXnU|?Xd0LAwLeu%4HK%?6&i-Ex{4dSX7(AaisXJBw^
zRs;w0D^Q8OlYzl)5d(wU0@e=<mKBh3&-tJmS|Gh;@Y-*a3}&tdaK^Ko08#-?mrmeQ
z@<F#`MlmqVU>Cgw>PCZ>8-iys7C22mA<L>*?<KmO_X7jC>!ky7<05+v@R-GRaJ|LA
z;I@H*!EFu1joTfdA$N{}!R-_e*o`~EZdA-<5Zwi0ePv((UAf`*LNT+bkU?}8xPoS2
zaOY=WaOYKGV92>Ex|@T6f!~E`B8M>p<01|F4-7sVK<yMC(B)q)qL)}17#BKuGB7Uk
zVg11115LpTnWj&WW0g?zfu`VvN=PZ#1=N_~XaE%!KHwxg{hS=DbU@Gt1|RUj@IIg|
z^D?4WKqenxW?(XnXJBxbW?*oa1aYz%7~J(47~FM1oN@*RcV`9$cSkt}CevmR(a-&X
z!Iy`D+0|pZr97)1X9XxzFfcBBIK4ogRf4kz!d=8PeWE<8gz5s&8CeXBi$Km}FK3v-
z$njqaRDg1^TmU<74M=|aIeAuzdM;7$+T=x%kSw(nQcgrMFql0Poy7Zr!4<Sc4cy{f
ztOrRplfX?H1_t+F1_pOuNR&(hjVv8uU~n&FU~ta`MZ*+mG`LS@U~un-L<6{W`IUje
zeH#OV`v!0{h>K2z#RKaH23P2K|Duo6YZO>zI9WjMWMEt@IDMf4t1ze62L?A4kkItK
z3ak=hi$t@)@%n*50aT}OfYQz4)akDkSQU*#MI%7{$i?fy3j#$Wv_Tn=7d+w>0ctRV
zmfCPui$>ToFffAlQ|y(TZl}m9QNKhKlm;0<8!;C@h3NHB2kGTtV3^b|>H}KF3tAX*
z@s}uQod?4t(Cpw$FZorB42(-a4Y^ZY@*5!Q3Nnfc7~~;~)<83DGOY6Zz};QY3~h@1
zK9ET_L>U;Dm}oIDxQWZ}6JuattbfWNpvAyo5h}mW9CF4QXpVCJCHd(f-z<q^15IDb
zgO-FafM+kG<mAi1GV{RMKprw>3$m_LM!ped-O@PuCJ-C6wo_d}z6nxng33)xWqCiw
z4-C$rmA9Z1-s%~bKG6VWD0x57BK4gN4DN3j7~G$zF)%RK%KL#d-T>V)!oc7mqQt-u
zxKBPrl!0N&R;Gy@iUo<e4Dz6fb<m1q4=V-+52JOA3=A#i@=>6)aD#!LfdM42VvT$h
zD89e~ikS@Z;2mdQ85lg88R{84s$D)XxPaOt91M(0Llr^CcE~4!To1B%83TjIB8Kyf
z49s?)!OjMCM}El%va)_)aDD^o05dQyZ31OVNXH6tNTKr|s0?`C2qFXN{<%1S%1s8w
zrJ!RRnTi<%Kt)z5xCnE}07*?xQfAexzbS763MJ6`>J(5aTech$NTBVEpv_VqM;I79
z_CW&41{O$f7#KVrfmiCwLspkCFn9_xFnIEVMgZP1FfMCS1Py@7yFfkXsn5XR3EE^I
zlq2sdz`(d{2LpqrJp+TMZT%LI?Gsp;-+yodUDO3Ba+xP`uz?#j&KaPt69eNi#ObtP
zxuOpY&TAMLm+fU}W&{}rO7}ZK#0>^M2F7K}L6@ssmzQV!z~BVhwD|_)vlRvqpUEqL
zj(A{T@C;^P@T~WRcuigtwEB*L!Ly2i!LtMs|4OLw4?2|@6#t&{85lfgf?^le%kjL=
zz~FgZoq-|CQeGF7Aigp%crh?Ac>WV*U|b#s$pqj7@}7c5@0>vkD>xV!mltR;)PwSe
zIp~sah!kjzJp%*d@-9eLv4F^cjF|&5#sYL+%TrKs?lc7w^~=E#4DNL@K@x@23aAX|
zwp>V071ZMfwYPqNVxEC<Iq05QkW4*eCRCF%2SjQG_+(CqagfftvjOOu6iBO*DQ6St
zfI{Z?pFoTZZsre6IU7O5CK>R4Zvh7prWxR(ixG4cFAD>M_#P3aS+WcalR;Ap$K*tq
zW=k+IOvz(mU~tM2VUhrC>SX|Rpjyw0FwFsv{D2RxoGz!vDp6k`!j#9xz_{WfSWJYe
z3KY6GxKbHJm}<dH76yiVZV{$l5N9W-mjkk)UIt_Xcx+a`SA;1T?4Az{fe#oM7<Pb?
z!pd-k;>>gg5vC~c8X^V;F98MyFFu7#1`(!ckWrurRAFGK_mV5mOkogVN&yMpU;<ss
z%@8EOz__lKfpMidBr}3GI|dnm&gtX+zz~$cz_`{EBmugwBNH@_2I_1re<;Ev1S-u|
zUSVNiSe7lq1lmjp>P9k5`XIstTH^_xi`unMgh`!?fkE##S8`qn!*mmMR`GgK5hg9L
z7epBtS03R4Eoc;B(g9_yo#1)RQ_UhwmdXqaQ`EuzWdkJ<#@8UbR)L1cmG+A;egnIn
z1$5rE2opQF69x(@ts5eYKNUeS!<ES(!uShh;#UR+GX@3=OA*G?pq0%#85md9yRtAa
zl<X5>JPR@g9LN*&L>NH}7C;5WF-8W4eZeA(N5M`sV_-P^Q-pCBO!I6`28Ih)MHqK!
zfR+ZbFfbgG6JgvV!@#&|Hl!a2UYC9NC&)dzGej5<@-i^4S^yq4oxGKgfkE$MY&`>m
zMt}(8O2!Wi@u21>c)Q!`71|68yY`7Ng4Q;GPN?*9U|{gF(gvq0#+BeTEDQ`@2@DKg
zQQ8a)llF)(t^_Y;VPNoTXJGIG9ZS)AR)le-1!$Uwfx&AX1B2HJDF(3nR)gKgz~FV6
zfx+uMC^dl=2Ramk93sxZWXk=4A^r=fHOszCgmD`y1LNv&P}4?&fx+u31B2INQ0|Oh
z1DS?doefG19N^<^;}3wQVHg-!gHPK97uMh-I+-}8fZ8tc7eJR4gOnGufSNQDV?aj@
zFlB)D6`L_IoR$({1YL~)I`3rlZ=vF%WCjt&+0vi}BQ%g_8-W6u6SPlQgmE@##O4P0
zj0F+K*`SjkZa_mEG$(Re3KY+KB19N_K~eRUfpLxF^!1voa*U$W&uOws)o&GHgzSg-
zzz}+afq?;h%HEn^+6>_6tW*Qp#K7S7je)`IokdD<34;h@C8$Gkgn_|Zk%7S*bX{w<
zjR<2UXj1J41B15@1B15<G=OWN0qkAJz~EgW%D}khFnGK|gs~11|E$g*7{Yi!S&4yh
z4d^mO(BP`X2Zk^WP~HPE3>X;K_Hch-2(w{eTzeN3XrP%FNd^XwI1$DSMv&I&tF%}(
zG(b@YTKn%22TEhAKSda`K?xmnL<a+dXq5<KG$^mE?V0{di&fJUBp-*6pR`$o(FZKQ
z0veJ&;DLY8Fi}Re2%{ayqPx>0v{_{(!4`EfFl1DNa(v`N5m4MRFs@^p-lxqfU+*r$
zD98ALApmqP9k?sKu2!3Y!IDLUQBD>VhYSqfGZ`4XCu=h>^h^<91f2v2+HCB-kAcB^
zhc*KP$YpY%p*&DvK4f6<zAMkb5RoFns369`V7QuTA_w;ehJY6g%y!@cd?E+92S2}D
zgi(U=1A}}$X#aTzsPJ2#8j!{y!YBbMYj-kc`7tot-uu8H51RgCU`h~SlmeYIVf&ha
z!TTQrgZD3H24>su3=BSE3=BSe#th63lRhxWKL8y}0U{YVc>bF)Fs_$kW?*($%)sDd
z$-v-auE)UaI0vkZ2~09DaMUxI^Dr|oJFaD5@Nr>a@BvK;Knzm=?@v|$SBgB0>>4nW
z{23U0e4!>OfcGXt)F2rY#lYYb0h%kdVqmC@7dZ)vsr6mZi4Dh9pvIyPi^xk*eAa&j
zZ&=h|6*&m%XRlwv#=sz3EOHoJ8iJOg9p)36$M}IEXa)lV(-lxSZ3a!mu?I6SZg5sC
zDrOK_2Quac1A|XG1A|X8>j#G53<jnnB@B$~!Idco=rU}E;1a0VKTwk7Fa;F_!4nvm
zj)2bD-vAyT<^XT!3!Vc}xIqo9&=6Dr1YZD+{lLayK*KZOF(5+*23ZEi%{*YoF)=W(
zi;65@WnkR!gq?wLvm^t9PbC9`Pq`ce<7Q=$h%N(zPYVNsPZNk^!NB0t&%of*ThID|
zAqYB2vH{eZ0;SGO$jElk70Af;2GG_*h&XuMDd+)I{2b_z56~GEOdQ}5qo5BU351{?
z1A{RG<K|@_7=lF@*uf+NgM-LIRtCn63qa1;%uvtZGmC-2XNEEZ<L3R$6Q3}E7^j&h
zJ^(YWGfzALW;|w^$RW$X7+V82gqwkZT}8wWWK0_~17mC_1B1^p1_qxcAkI_<2A?eq
z3_hSem$3^O7<`T}F!+G>T*iXZ*d+!Ap9>&mI~f>!9xyP}``iNuu?^_{c~Fpp>u2zQ
zm=8F7R~UR?2o7OjWnf@86IsK>z_@9mG6UlZC#cI-_%lu9U}s=l5yQaX^NoSQ=M9LH
z$-v;N&%ofT4pLeM@(oC|nSsGKj)B29Na6!Sa15yV!uo-mA@~KTP-0-*BtLzFKC5Vb
z@E=gg#lX1967C!(4$#f?3?Tvx%&L+MjGLmtGN6__*r5@iaWG3zdm}^#R1UI!U<jE3
zH3W262*|0Rc^nV0k~5&hB=LbE<O7Jopa&v9FoYz4HX4Q`fTmw$ME0<PDz1122H#!=
z2H$QFC!2x6cOe6V?|cxaoPoi2D+7b?W>7~R-dhi;0Qc5g3|RF!=ZaK<^3!IQ>3cxj
z0+C2CciHqW2CNQBLLyn9M#BvrUymvVkpeIqv~QT>oQNe@-G}L6hO8#_(?x6`3tvIU
zu$_w$fgC`~+``Df(4#2=Y5kZpFj)5sGchnSFm6#30`)J1nHYq?MQ1GoLv(;J;}1p^
z28Oox!i;Ocbs9(^Xz1DYtT5v`@OU%}1A}jfFyneKhby&!L6~uaJOhKsbWS5yo_dhl
z(pX{e&MOAcaKEvVFykiB3S1DUX@fB1X7Hu~kSSrpjGKi)6R$GhV<5n-n6~$z8fM#V
zVaD^IqGBhw6_d-W0=flIn6Vyw8W|%4<5p0Rte-B-ST6~3JSPLg(l}wp2Kjo>`ghR$
zvz{<x1NcyPP6mekZ-f~eJU}vBAlEiYGcayB0zR!#n6Vk$cm?ez%MgYfqXSwRwH36b
zuJx=iV;5wrh$sW&R?sRYkWe>72;@u<w->?%Esu@O7OrQs2f1z?S4mP1gD|6`Gy~(-
zbu0`F&X<H4oj@@MUPl#MEX?RC2=Y0oZNE~O(M^DXLH7^DuiNby80PO2W>g0m^cfOI
zjOxN5Z-Sk#t-!z_3Yy3|6(r1P0_H%%kKxlqhI)qi`#>kk@;(q|<OK)T2L^f2-XZW1
z&9=TQ28Q{Eg&BE48(y*)v$Po)D*c5Sc|k)qM;I7<k1{a$f-czxg{&ZWn1X@9_bCH|
z?_CAZW?o@NA*i6AF9U<0r$R<b5rZ(JoGJt3wmt?1zeEN<2EW*?j0_A+Ay7GSO{iQc
z1A|{7*oQecbQu`t774#+WMJHOk&S^tf2;6EB`AA#gzy(oIDwY=+ayenH(`~MP-S2c
zSR(ucr2IE{Bew7p69&d@zo$<$VHK-iFMOJjfpNPeXp2y_FldD}BL`@skNOK?kV_bD
zFfeX+g4nVhW{ci#;ay4~anNezteyT03~ZN#LB~xA9{Io^4<20r)n40gf{wb&oi5x3
zs^@PoX0b6aOgb*y57G+S1i;!OJb??uxhKlNxP8-f15;K-rtOcX2b;30Xl{SZ0QPQX
zH6H^*mJ}ZYL&gu#`HpvlYuG`N$-ub7mJPHEWBLM9R^@s<Ed~Zo7vVZ-@VE|Wlt*r_
zFer61J_YYWlXMWyW@KR8QOyg^wb^1IGuS}w9AWUbe9)-VsUYDZa0EdT1fzc!1B0Xk
zXtT)93Bn=Z{LH|(V;97P5b%ai@LoCL5UuG>W~@T>Q-mYIfe#wB;*S#6XJla9$p=xc
zF9NcVr+`7&Pyr+gvDyNx95iILUf2@E28|(|3KDh#tARL!0d%|ze-tRFyNz`j7&?rE
zB|!%JLkyM_fEg^EDZ#)X{F04<;Z%^Y3X(?{{-uDlfyTNvZOX9+wNQ4h<H=3RWXN%p
zVPM?3jwh2L#}{P%SDxJb6owo>koB9PZ5aP9P#Y%OEGGaYx`T~@VdJ#vHs-7v_0OiX
zLvk<U9vj}WVumU0$_$KqK<7Z}{Fu@q#lX17k%NIjMQ%!m76U_b00#rZ&Mi|qEEyR0
zxN$HraG#vg3BKZsgMq<%!<0@{sG7X&DV?SuH9Q3jQ@Xhr7@7~Ufv#Gf(!&W-!N$Na
z<<*p44hDv(W_30OhQ&ow`ap_6ql5D*ru2i^JUPh>Qzn2;bpgd|?usdsVQi_oDO12o
z*cce3nx{+=VPI$mvpc3tk%O^&r`uYv%GG<bF);WCOqtHlz_<s*cGxgw225|)&nYv(
zY*7ZrT|ap;8K%tVfof;AoB}%Ez1an{BxyG%NNy=JxQho0$W;%ftOBV7c`E$pl+_?M
z$N`SOr>p@-fhYsx?kYA0hFL;$r)&W&OaPUryR+FC7;1E<zp-GI2(X-TSO^p>4B$Nm
z=Pjq46@YL-T6<X-7!IGE!U(FCpia2T!oa|?e+r`ls7e4W7%~%`0&cQ{`}=#RO%JhT
z)#PiM!srB6Aj-hFhiQ7ZC96E6#q`ydtSU@yZ>C?gWL2wQFeMKb;h?ttnd~Wf+6;_)
zK<r~8Q}Vo^G2VK1N?s($!)y!;@nKU6K#N7KK<T%+&yIoNIJ*gx79#`Wo|i13j+_aT
z9=Iw5RS4N;CQQZ(P$_#k6DCtpP_@Itz_99_36ohpKj_e4kV4%VCQK%RkZwB2;I`AC
z{lBp$jNcg<825sX&*1GdVf?Pbz|gM1RghT8V8ZxE3M9i-oSM#H!uVH-fpKqx02inO
zYr^;+Jm1U0z>s>>gb6f`DhR5Eb!$zS7(oF78X21BWWvNG4(5q6FzyA_A3-@LOk5%i
zjC<Rs^H{UW)W2cmV_@9dYRAA(6=%Y@nvsEV9|IStgg0T_APM4tMqT!pFzyG%GRVw5
z7fl$!*Aap^Aom^=2e}uT?e>X+JnFX7gz+eNp92d6L$;X-;|Xx^fCpeq7%zhy^c7r8
zwkp2>E!us<z_?Eo)LbwY0&SYx$7;pEkYs4`7nJAsMNL0t%_@`GX~M__9w-su%4INN
z<WXc`+!qBlq(xtsfr0(7$!#_U#(jOf$qXj9K?m|aWn*C2-Dv_^b-)0sSjxYdK-L_9
zN|YtSCd)yl?`PymPRd{~0X1ySOaPxPFx}sVRi?hvWINb4HU@^Gza~ed7#R06vN169
zJuo>9VzUYG<T9A-1UrHawA0*V7syvPzz%8!9Y52u!hnH6e2d9sMh1p66Broxn?P)u
zDh}fFBqyaYn9Ps>iGz|tE1LlWgRzzgsNE)bgn^N7|0G_p!&+28%BTOZVU=O*oGxn1
zsv=lzk_R*MAqQxo{d6x|R_*!;Yzz$YOHE3l?yzQHIOb*&11kS_GB6%c;7uw`V=##k
z03}8a&~<huF`!c#zVZ|>n8a~0Fr1vv16pKm0v>q30czQ-kete-%*eoa0CWZFg{xDU
zG{8w7bX@v}sZ5%n1o0KTq+%+QsRTnkgP@Zr1LJ{o@OZ>jCNuaVjRT+yb#!OIg+M6;
zi3?hQ<H0_aQ3B*t(DKFuD?ul-PGyu(1s@6E&cG1yEpr}NmVxo000#p@(cH{=$_xyq
z`fQ*)mbpZpfx%{au^p>y{jAJ=V0VGatj+wH8$p2qDooEm%iJUj(gD7BjN8hbWhU6b
z4~)T}L;b+hL<hG76fl^x%v5AxFnY|Gl?6Iv&75VX7O19T1Rcx4p>NJIPn?1A;1<x)
z458*M^CcJ<5AFmfYjc)`oS=<IH@HCIY|gR>T$6$BUR5w>0i7Dl@D-Xx{JTUM7!QIr
zo$1anXPGC*z<6*Ucr+5koiES8c<?Yd6*Y12F)%c;@-Z+N-2)NDJ`4;SHO*OSzz%0*
zU_4YO1afZ;*u6q2nMDld)BEgMCF&K-S!zK`T#j%uFc>A8v($nI^;j4fKptpB_COQF
z1Ift@<}Cf-fJ1iVp=fYinzJ-Q94X4ccnCE74031_#GwLQpyO=KS=!V=?g6{ow0@Hh
z1H+W*<}Bun;E-fsJnX;;iZpW;bI?GmJ|_c1P_H?QxdTX=6Led<Ig5oUNEr(QLvy(~
zixYTJ8Vdsh_hoYyXRy1Vu6IRty&Kr|P!}5<;mXWoFlPynuw`I8><a3mn6rdPFfbnW
z;sX0G3~Y`l1LI)>sJC1p-h!k@a~3zSm!>~-U=@{qY|b=;k%95>PH+M@XPOHNPbW~)
zUo~COkyWIAKgghI5QCWJ!PENTm8e2cvtcS2rZX}ytc&3TnQX_vuw-rqxa)941Z+(P
zqdV9dkkKE(=43E>z>Pk_f+UpaxE`8j;7ULzCO5fdTm~l(2F4>RK<8>?Tn1+%HU<XW
zOBvUtK*DSc4Bm1XH{}@^>YI6r88U9kF)-AtvN14B;K=|T-vKTx&u*R0>cpyC@0M{N
z6l|dK^X$<K$nHH*-qM|saRYLq38?g{H>qV{sCy*Gw3*SAfkFMI9Me)z;d+!E>@7K_
z6)<ldc>?x>9MejKx4xqaK|&0wLVG=UV7}~#920m-^JpD-xw9M-=(;OGP<$BAl4Gin
zWMDj6H~o?mt9Jc1Ii@;T))Q}+V``FQV9;=cv`HED?l3Tv9RaymeV-`<LsyR+6L<{s
z=nnAlx^hg>AcumgQIN5*U}L$8k{RTf;y|JB71Z@_3zuUAHH8?yeqiVWod#<I>NK3^
z*JfZao+ancxXJ+J7zPGEP~Ql&^isTCj&Tjx6$}i1yBHY!wkZ_k6*0&$f-cbk4OIGF
zWMJ?+E6>2-;x5Oyj*EfuJU{cq4mNqvxx>>>JF`mF`~6~I@OvV~z;L`wj&TEMC;ANr
z2LE^l2LEUU&=CM~j2l3MfFQv_1_u9pg_1M|IZ*x005addj)B3yN&(~#$ayJW85sPh
zFfjP{f%|uIjNm(eK$^EQF!-;9gcW#|SzCAz0|SpwJp<!OSr!I{rF?RXKVa3m*FQPN
ze_)Oj14G0nImZ8d;7$yK{~ZPf|0_}q3>gw~Ogx}UbU6b<05=1JKWOo@*F8BVUYKAI
z14Dp^6a&MAU2;r(Fu{oo3;~VO3``S5KQK%H?;flNQ4A(>Oe|syjK^;>GcZjsVPFWj
z$iNVA9>h^+U<i1|zz}c;#BpR`2ozvo2;^gDV4C2^zz`_Qzz`@c4jD0>$N)Odm?uk%
z>3|#q<MHFr5z|0T28KX&8_3w}L<Z1_WjtAk(bD=rD+Y!@3-FTEi5d*dicz2w$0l~L
zF@R2roDlVaVWJLb6U0Q&3Kk8BGf&8X9FxPq5a`Xo5a<bVOeF(DU<3n0U>Jzg#=sDm
z&A<?t47!c*PVonZNfn@xVGzk6AqQFp%6MWmGXvwD1_p-uz#ayMz%CFE#F);&5I9wj
zfm!)ASQitR1YIyD2O57?{=vWyxP*Zra1k>DvkD6XL*RM_hCt9Ek1C*G+0DQZ2s)^D
zQVVEC1vE-l$p9Mp0_~Ut4WfZ3k0(|zFl#n2FrK&rQo!LH0G_%0!1#3wXgLc=Lpmsh
zGBWkKfL2<weqfl`!N44+%D{NyJ7}`JjKPV4NmGRpeAwKi0}PB;O{Xt*V^ypNZHCyx
zz<4SP6zM*4OrD@fpTxirc#44`@EA1GCxZ`q1d$8|a!h_=42&nAf&$Zofg$i414G~!
z5J#PXA&8rSA&3#gab#c!GG$;0G6sdL9|J>>69Yq#12oPjPXNdHL@lNR^>Pf1Coe-I
zJqV=G2O8;<Cx9b;A|ld*;u#o%V!?4fc?Y&QpS%YY=aWIR0~!!#p3(q0CWnC`sDObX
zC=cYAN(P3YS_X!oY7nQbo`E4~0s})(2WW76@*hYbp9%s8GCYhQfWjCwiwq89(9r7?
z9#G(-1}rG$fzBxHuK}%}?5_cx87;?nh?jx!)D`G4X+awq7=qSAk4fvVVPO7H&j414
zbWU1-4ag}_QTRD&5WXDjjy33YZWA~_R!soa%^Y%!S9uv2Pusz)+QYyQv<qt01P;(Z
zDOeqnO%pg6SnEG9K!xE}LHI~kF@iF~1Pf4R0Few5a*PjI85mEW110|k28N*H3=Ba>
zL7W~2hM-Ff3_%y5d0~PDC_=!R1mxg(A?Q8>L(pAFUXW!7dd0vH^a8{aU|<OP#=sEt
zh5G};1Q$?dm>%QFDp?Q8iX7k+Qz^&zoRfj^Oc=<r1_p*;W(I~}Mi8fmfgzZWfgza3
z2AT^wz^SJdVQa8714A(AY-dmo3|3=c2nHSc3(A4PMhpzW2HYPQCh>qQ1;srmLxC0(
zfFiygbW$oPa<$%kV3>3Q6bvAeAwrHRl$C+;Yz;F5leP#0L$EyqL$EC~1C!Pt28Lj7
z28LiykPHU{LvR=aLvRR)qrkuroXEfs9Iwp4q^-j|v4e%3fl1qffgw1Lfgw1@n1M<6
z*awD57eK)_33TeY4*#oqkR@5n3{1L@85n{q85n}gnHiY$*cljt+Zh;wTR}3{85n}6
zGcW{C1aaOoFa&R5U<lp>;{0Y{2;R@Y5WJV2fk{u8fg$)514Hl$)(;GmZZI%MuVr97
z>jfz~LDRILk@>G3P7F+XlbN{~!8vWxk4Oe)(8WI)V97b4!=cL<z;ihUU<H#I7?^ZG
zSA&9l11_ujWf&N5^)WD>1#i}XZIS?u_k%a9^jk16-fUrDJbP%mqYtaNfP*49!3RJ^
zUxG#JogktSpeq6y7|;FzP0(0@73M%pKPLl<C?wOFI5fcWN1*aH81mrBs{R`gi_U@f
z0i)=L$UgyDDapWit`HP3T(uBC{eYS}ak`=pt2n0t)Q}w@*UE8bfC^Lw#&b`nPxN6`
z-~^>59gq-+t647(?nrBZcA(ZymtzFY7$2=;WMDj>#tCksFxEPOS}0s4xdjYzprLfe
zqjg-M3s~eB8$hib*krfC5eA0Z>7W_e%ExkyC7?-%^G#4AN{m59fUHO=m17KH1o1#t
zoaAI+W)N?mZsW@;SwBmTF$~;<LTXVYm4cQVcb}4Dv|#+eknO<0zyMxibTM0-fdSM~
zvQP!J*BBUr?=vt2U$%g>lq~ciYm7obSDeTxfG*vUW3&Q0mVqIpkbxm26WWvkpZRiw
zfgxlzLp?*tWF(urPeF^Z>=mG5EPDlLNxU4RD=!1%h1JkvEaVUaL&yPWF_ygoRE&Yu
zAr)iUD?rf>6@`~#5I(#VWBtI8T_OvLSq8=npzEHQxfs8I^>siZ_QL(?1%9kzoJ$}P
zd*L61dj`V2s5E_@AFGsV_8o}oi;keg1zz<4T6x5n!RP>5=bgg?Qa(Lk0h??+qXYQX
zw=?(T7&XBi07eGJi(R08v>c-*_=Xcu+jW({93!Y`1GQZ%Z!j=0f|q(<uC&MpB?Sg`
zaDSU2<QfA*$Qf-0hN{(aj0~Wl|H{A+D#pMN$^&Ucf)>IsfW!hA7(#ud7#L>NACzO{
zfZoj<TEM^%njpo%AZR8BK7d+Cje#MIpMfC^v@KI(wHzZCcru8AAxwvXAxtTVfq`oR
z1LLJ#QVa}ptmGI4Kz;U|3=CoA3=Cm~(hSVX1s@oy9)KdP3bYPMK#oy}mx1xp5@rTw
z<yr=Yu!Rf^s$ug%yiNv&ur&+}VXHu#sSFHZ`xqF)_Hch-r~==vF<m!+Rjyuuf$=hE
zNk0>K9ususgv$qpstF7X3?2-OmqVbgkb=4590NnxDRHPP&VWLXt3{4co|l2~vMtCO
zkPALDFob;saXJ|o!dV#@!kIywsSFI^0t^h{d>{v0fvyB&pMENURZ3<HiX%XcC{T=6
z*?@$n1+psCo65Zf$KwZviY*Kbj4Gf`#+5r7pon^_4~eI66$XZI88vV`y#-$-%D@mF
z!oU#j16rKQD)%0o`4||&8yFbEYZSp*9CVV6MgRjt_;dz_@X4U_Tjf51^3hiYhVV5E
z4B@LlvEjtPSbs%Woq<7jhTMBl;>luQ2;a%T5WW>Ooqk8_14G3J&>|i#Ke;cg42)L}
zfa*kZ28Qqp3=H9CKpbZVhVYjR4B?<7KJNH2FhsC2Fhnr2GcewXVql1nV_=Ao0CCb7
z7$QK!JFd`rwBiE;8v_GZshox(tSK82#J~^{0IINA7#JdA85km>K^y@FhKNiChKO|T
z4-6GwKo#k9{~%Tg(C*=@rl8zX0czDUfePFV(8VwA3=AQ6<gP)-fv=i^`o?nCbU^{h
z#=s!RDt8+kSUliBx+?)%uLM5ZQw}_Q_>~9Ld3p*CC`j*D?lv@BA{ZEE_Q+*`+OePm
zEXrgU7?@^&BI{<08ra|rT~Oi3zz|Wvzz_l2LSMC7F2f2m&dk6NF@u32Vu~6AgMOA=
z2KX#N28M_o3=9!l)Igm-xlDP`*b@Uo#5D$nh)Wy{45gfMnV_TYZYYAwz-*9<ZZI%_
zhOHw$se|sEaFff1_76cv14rtE&ZxOB2bwqnbp<2c85km6)j=0d$z{t!3f0Ic28PHW
zbp{62-E!IBqZAn!BBwDhMD~G_QMz0<s0096vW<Zua+5l^n9hOrXCrSiFhpL5B&}RY
z28Mc2+KPP2z!3RZF)g#0K`sxZ(3^oF@&f}y<U4f+hT?^C`5-Yj28PH#3=EOK6v0J2
zbb^~9ik*QWiWPi_uv|OTcTwUD3{is6q8v1>G_wbKL~un3s8px`tzY7in<2=+7<XL|
zT9ii_GcZIMLW}Z>5>QbNR)<uSSCoK?WT+^-D2MQoi}JEHkYf0{!SsV6tYVx8K*cTt
z<8^-s_X?C-GW~xDtF(OC14y}l9kid88Cs#2K`Zp@D?oZgxyl8gn$Av-2xXPw^nu#&
z22>A-a+Rk*q;GIT`6Uqf8(Lt#SNQ}eAJm$HEc}I33`~$EGUd>E<wh1LD<D-IF!?P|
z{hd(foPgQ~ah_NC4XFGH4E+kAFf0E8l?Po@j%vRSNWKE<y_*8lXN0lJ*Gn)km91i6
zya~PXhV=tOg$~5Vo1Pdp=zto1kma})HV}Jmg3r=H@&}^_s9#hO0x|^607ef6&?5Fj
z0&<|U8L~m+BK6?iBe(iMSC+NQB^p6m7*UQ43{kck;N+JGUh>Dl5EaM35ETVJCtEJj
z6_P)qY8e=!$~C|lF3}GvwupftYMwd+!{mIqWLPpi%)k(}Tb6<GcJ2p;Y!Ofa$#G6D
zS%iTx=avmK1LN&F28L)c28L+Rg=n|C7#N}z85pAF*%=sbPh((+)?;9Z)&iZDe|s@l
zJ0}AJ$6dJ;(3YRu8yFa(eHj>{Jwe9oVPJ^PV_=9*1946;Fhn0_V2IxD^?@PV27IQu
zVg##5{dBo#P>}?>$_lh-TLV-g-OhysK(qlQ0HPl-Fht*h1VA*XM7qJi5dD{dA^ImI
z0HU2Co{f=VV2BZecs3U5*%(&_h8SC@XU!Ero@M?i7c0WRc-xGbfw3Os*_as&3^CI{
zuIyr9h*`|Q5VH{K*_aIs3^8lKp1t~k!CV1+ei^r191lqGGX{p3^9&3zr$L-g3=A<J
z7#Lz+6n$VYcLAU64mu)z(?L1#+GNm{jN6NO!EqQ28s!EZI;~bJry2|{CE36c1ilLT
z259k&3a^|Ws2zLzD(KR<_URFktSUlHa^O)2uu=aZ;(d{<67|>R>_KYpsPckKGJ7Ki
z#yhGUpaY-f>_JO2cY?+dRW=$jFvuv#DS?$1LzF6+fs}%)7-eHn6~h6pqm@CrzVhTG
zB{Il?mc)Y&_GR$&ms11vs3(EkXR|_125itw-n4p9@hM{rGKqr$q)Y~+eG=%FsiPu7
zD;YsG!v}^~(7h)MK(Tu_4!jdbXeFrHabjSI^<-d(byNe*4+*V=7U8j_3=FZkil7}Y
zLf~oJ8w?Dwa~T+7XF^I>Mo^posEEr4hS(?d3=9kc42*a6)IqDCg*JiOLm=hr85m;M
za(`fmeF0i34;qvJT};CIfg!d6B*4IU*9j~L?ykjNU|<gL28}P7fO=#`P7F-PbwKs8
zKLf-1lR{G&85kI=J}|`oVPIeYFR{G)1LBLRs-Qa`LEbpPz!19w;*F`Gb;uw$JZE5t
zeGKu&3;~c43=E)MFmVh}Z-5pYuRqE9fgw%+>ZUu;OG_nnRv51UJ1x!z#c76cr)4uR
zNbm{uL^FP1hy!hbFaU+_Jv)fIdccQ>Gcd#{Gcd%-a(`fmt3ffw1a6E01H<8ELJgpJ
za$;b-x0E+CrI<me!3e~j{x_OcCZGj0DnCQ089o$#4|MXSE?flC(tyc>Qk&p9cLs(&
zVWE6zJLcYfh^hI8U{f<=SY_)c3#EeX{J<awYAu6Ze?J|xq@}f22y}fk!%oI5MbJJ-
zp>)t_w-W<HoGSxEoFnM)6dMM{`&QtFpHK$GSqyRE3=DChpv}BY9t@24BhX|s7(k%}
zb!rAHLp>wt#1aDr2I+30NU%c~81J9sU|{g!7m5Ter~%!iuz0Faq#|f93HXdmA@Ha>
zX!7v>T1b$@K<pM}V7$K{MFeUOR35bWG$uz#l<@<@6bS|fCQu`}p7GH%B?g9rdxaz<
z7#JT-W17gJ4mxK@ND6w)P+T(uLtLdg=p+##X;5kQm4P8{I|D=9dPUIrOhPg+u}2IH
zad$v17C9mCg_2(x7(jEQai9&RKCgsiK;<e(%$b299<-(>uTw}yA9U*w^k_tIW{SxH
zji4`JV0;t`-Zv>E56VX%ZSf2Y@zEg3?F@{MWE4Rg8-<h<K)cEq7~)G97~%`m85oXD
z7t$4kv=!sK85rVQ)j{WE3F*PqEn{GaU!=~!&?zHi2U2%~p`Iar7Xw554s`|w^PNJD
z5J86cqYMo3hZV~hgxo>voF*|a#9v@wh(G7@fnn+k1_lNl2F8cZ>Y(#VggiktCP={p
z28Q^1+#eXGz5(qd0@bph)^sMLCuqqk_^_p^HlXI$R8ZY1A*8{}!1%D0xt@U;bo@{J
zYX*k+m(b&X;=eI4#D9Sv|C0c^+x9=Gl`vHSve5tGOpxIm;FiTy3s760f$<^ea$so7
zq6U2WA5<Q?b?4z_kRGsum}<adCR5jdv$_xC!#8j#Mhmb#dq5swV0^>|mtf+s1vMb1
zo&m|gMH%hDCQUg3I&y=7@sZv1Gx4mF^$H*^ND*jIHj}9ia(>8^0*Ff=fw#s(x*KI6
zmojsKCN4iPOle_YGP=mfm<1Zj`o@8>cN}y~sh|@B<D+HZ!J7Y|l<Zw8*u?mO!4S0V
z4!mdJagZ8l3OZP@Nq~W&CW(O|L4biFflCdv{7bM&3Q{>Im@qIT=z&gn|1Q|123lRn
zz>pBZz>pA>mt0c8AlS~wz)<r8vj4`2fr0UH5Ch|5)9Kq2SXEgCKz-8b4-;4=>gxo<
z89y)>)G#nGg0}-dd8`4}9xlwl_~bDILqa(NLqfh91B2%&!Ehz0bCxqOB+Q36CmdQd
zC){LUNI0(!+DIV?T~)@AD9*r;$gc=Gs9O-c>u)Cm1E|532)egSwplQm6Ew(lgMlG2
zjDaE1FRz?IFou(X@yQFOi5z*LQ7S=DtAmk)dEyBs)(;E@4?xalV0@xHeQhGEY$^`}
z<C7l@j8AMqQ3USOL-%DF%0Oc133%)cECX7iox#Lm16t;5sKLPOu#WWugP{x5gnA4U
zN}yIPovxq6Dl6XrRk$BTA@>Ic!#N<Ure`Oys>?t50gh9DP%Ctfsh||&2L@Rm1_nm(
zB`nYOP2ZTrDpvpGF=M7;CW9cjv;ld2IRiuDT*X8NLD2RlP**MS76U`#CB-BLL0Qmp
zsv8UpNz4okiQg5I83biPg$PK*f`K7PPcel-P!@D}2}mS`fgveIF_l437Mk^wdKnm!
z8WqzR1Z6=RFhFYdG1N08ZBqmXtsJPh0|`E1U`V>Bn3+<+APC-6b%TK+S($+$SyG9C
zp;1~;QH+6M@eWqz4@?4UWEq(4vOh4$Hh`LaOcH`x0t}4Lw3!*0?W!3VlKmMNl6^s(
zb_RyzOa_MJban=2yU7d;$)yYo$;BYf{CWn4<f#k{$^D=Ur9fuMae&QI5p?2bV0=~v
z(hf4~9s@)29S{d()=LJ4<mVvmAhW(QFeHBlapp5Hr0_5>q%bjnu42jlz#yjs8jNQ$
z5cK2)>8xg8NO5CeNO1vi+8G#90vQ-m>it1lCo?dl#4<3XM1wdWb8;9MQnJ7+M4WpC
zI60sLFrc&W7{C{=J!j2lVEmQ%fk760KbNcwXa|J=Cy&4qMyR+0Xn=@`M}U)0fT5Ow
zf$g6F#~09?xUQ-I$2riP_;Yg>1_tkXeF2UOppXZxYwIf%;J7Hnz)*7$G@zOqEWj}V
zY%?PR<8#oaw>iHAI6znYFo2G{%3%=Tm;_2-AddYf0gh?l)+1=vd`*Y|$4pSGe-c+F
zg8;`YFq4IWL2{V@$3_?@{iFcLCf<Bdog&J>_#Cu*$UaGcV?MZAU}0cTT_M1+KoYcm
z4ZOZ!#xVhoEufV2l>s~xznE8m!vW-v7y2v=3?Ny^0%sNmhPDR+98SUvj9?j%pPa#d
zVqsv&T`_%QDyw*^jQ|JuMB=ZY;t#YL>xDhYC&p}`{Ll7TfE~Qx>qRjqNQ(gbU-0@Q
zPO!=Be^o$-jDbAH{vRB0ps><7Bf$O$7FI9TK&;YDW0eRyBf$O)uB?8)0Q(uZGLU#*
zp#b|C1yGQ4GB8N46JS513knggqSO)w0d~;&KMY?%7Vydlu&;;de5pHqb{eakb-n;Q
zWHlUAIe0Z3SoxWE0_+pv%KJDO7!GX|V4o-sI;RP2(ey8AtZMc70_@=3+BcvEEQY&u
z*$e^pB)9=5I2jl~E=@vqX%eza!MiKLR`<^mV7G_qd<AOQXtE2igD%Qs0Nqsr@}oWI
zCXTNx49pDHXQt0dXH^0noHBE!0J|hyA81kWVkH4~NsyC4`evOJV3!14Nde-343PrM
zurM%KpAldOmtJ3?z5o|oV7GX62(a_R&0NXJz~I6uz|IdogAE)E0_^;tsd5LHRzY|G
zRIU?X`vBMahZ8hNEWq{ww3r>_0vApJHqdn@P(Mwt&0tkhQDI<MQ6Ru}6Q=DoC`tBw
z7ht;yN?jmrlIx})&R|tDJSe~h-kkaM1A_{9z!%iCf4x&1>>IYz(x4>9z>w0&z>rcY
z&%h8SJY6c2RjNK^83RMg67CNSDjOIW|9u5b4w-_s8FDcSf~M?1HA_09Jp)4p0|WOY
z0k$&64~$+B3=EtiAmcy00Nsd@DZo~y&cJY$nSmi?I|D<?dT|D3s|>I@W(EeqLjr8o
ztPG5A#F-hGtx6dfQXVoeq}&H_8bP;XzhPiVdBu>=z?jtWfzj&@1IU6q;IfCUg-@D+
z@oVe{M(-scVQ<hqbpirxQ#BbF--I(WFn-NvU`YAFz>x9{beZE<+YgN1TR>%$;6(wp
zY03<YZ)!k_{23ThnHd;T89|CZZT`UM4Ib$hd?3I!g}0u8@vS2>1LLQo3=E(SL@KD8
z{^=3}L#hV@L#hiq1LLRr3=FC13=FB!AkJ$BhSUWN45>3foF5DfsaF^nQZKMGFn(rb
zU`Tz*z>xYJ#1R5rG0wn{`WeKLXJAMJ$^P$PWMKTP^MTQK3hM_(UmFI-&n^lKjBiyz
zH7=<AmCjV60G<y7?fYW%odBw!r(eus6|ax|!05*U3IjjTwKf6*Y_m-n7~f`ryqC|w
zkhYeAA#F8iu>~j${6IVB82vy^T>$~MIUt3TK??mD7}9nyFr;k*hl9xnMn4sBVEqta
z16||sP5~4QZVU`*Cm9&h4uUwr3=C->7#Pyt)PsDRz`&5s$-t1#EXTn3DW{Q<f$>u%
zNW77OA>D|9Aze+Gf$>uxWIxoW*$fQnJq!%#UECiS{Z242CawUbEbu~%5*E-P*hCJn
zPmLHDK=sQfwGWK`Iw0o=@d&Uj5QWCOzX!<A{vP1|x&Ye}GX}<Yu^_+XGccr2XJAO5
z3i1oc)BX`)%@P7^OF@d7K#Kes7}6IpFr+U4Df+nQ1EYTdSdqE_+Y(U*#&=(t85lpF
zV_-;M&%lrlT95MaHUmTYF$RY8L+lKUA73yqq(5X}NWaO>P|x`B3j;$2Cj&zUE6B@?
z3=A0x3=A1^pcwtc_kl6cgZl$xAPXo)!QKM(5g|!8umR+SK+th80s?HS)EOAx%Yhu1
z&%ltO!@!WC1#%q72Z7+F96~k%Y^xO+7~eaC6!|kSWSE1lkuwFU`q=e>F>nF{3j>3Y
zmjK%;UIxbZbs#UyVPME`VPMDrT~z*YB?Ci776U^@hQtTPARkaG9F{JEGC(c~0^R;5
zAi%aklY#O5a+oD`3=A1HAcY@8KQIPWfE9vH(-9G1TQADMSpWVm$f9%xhKx=IhKzO)
zr<j2u17!0okkde!G-v@hbRz}Wwi+`qeqaKb4f5r328N8KAVnWud|(Wg04vHCVB5;g
z!1$qsnSt@cF9wE;Ees498$iagGcaVFWnjoS3F3$_Fl0Oi`TxEr1LH?UkdPh&Lk390
z4`l|%kJgaX_R)iZA(NefA(NH+17k2aUxBg|xa?w@r~!@<Lk7@Ua#k517=uF?n7||h
zgM<LvUeKYgpkgUgh=Cy!bncr~BLhRGECWNPv>v1!3l6DgV1el{(`JMgU74B;44I(&
zuEDxZ85lA_b%_cCgNc>^8@Qqa4ZD2=jnH+=3a}-qgE}yr3=CPT1lYj$E`sh>?U^FL
zmI6LNgOh=wX}JJfDvVRvCcu`a0lFs>bgG<OfdE^E5CcQud#<8n1_3tE^)U=LK-IWw
ztpFQnFamsp%f|+xl1v5xwnz~MMi4t6#0G^_D`<$N(4UWip>PeTPT4KM<^!rzz)svQ
zl#vM1<)gsB_;EWY1H+>40&G5-Aoqf`d4VcZT>}9&6_}P!pi7r0vI(%Ms53A^IC27P
zDpm}PpJX5o1mA1~T1MY`R)9?%R0o2#%YnS1A<V$|Nimv%A&o_V%?V^d!9hL-hJs@t
z$Gr#bS+ZvqV3P$~rNY24D_MZm`8AjaDsn(IZqEh**4H45!JGpEtgmet7(cB8Tg>{F
z6V!R+Dk;if5MX^L!@!u-47O{!VgaiNW65;00#*f(e@u)7SU13o{R}!~T$fRRb%QAb
zBbei)B*3~+lY#NG6~tK3CO`0r6mp&dtXm`)7(d&yFfbIi3b1Y!WMIexoz-U)C&0Q5
zY&#1BgIs|C>vphDS-=s?3R;HAa0BcVfqK@5Ab;mQ<zryTPv>J`$ouHPz+lxczzSMX
z&v4@dg9)ft1>O+;)m9r~+GKf9xG^wfx-l?h+G#T|aBUG_ooocMoPi;;gn=P55420X
zTYz;kXz9TX28PU;3=El|t>bEP0<2TO`wAHtGWReruxEl?Q?5Kcx{y`6ezE}Te2}xh
zGB9M`VqnO;rT}g#vVsqW1qr@qV90#y@`1q=R3u0+Fn%$Fs#px_tASMfVqnPp!To{3
zw1$E4_Ze8`%LH9fF3rHi*7SkF<O66t#RPOBzkmSid@%;bFHOu0Ol(sa>KU?F85pvd
zLA(VF3|V3f3|Ru)9~eyjfa*W6S)jeHOvN0Gj2TEKn(}~5GzB&O1q4`^vobJ#xePL6
z3IjuyAp=8}K8OP{(20Q|%Le2)39JV4g9k=T)_}`O#;=Uin~PXgIrlIy7rtX){Hi#8
zV-c%(eE<U!S2x%#9H0?j@X=Sr3gE*{CS4a`?G*(LS%XSEP<MV|rT}ZN0k}n^!oZNt
zB*5AMmj@kC0+R302g{o?FwAKaU<Iu*`MLno*kpyAH3CT~tkt013d!}60<5l#42)l|
za)JiE1z15x2G%5Tf`&^3SY5#r0xS#+J_`g`eZf}<f^<#P6ks)DWMKRT%B&K~0<31>
zPBPR4Gd0ji2h;>J@Zn5Q6F{SFqF{UHwhFLHflTlKjdy^IkOK9WKm`|PwE(M>3X&00
z;87B&5lRq8m@_aq2@9}tf{Xz57&xn^^Odkl*3T7S<&$J!sJaO1M^3*k!158)kJR`f
zz;YAR|N3?U5)v%nCEH&iA;AL5ViO7kSnhK$FsRpoJQ(y*fMq+#?8i{`dmzaeREErb
zBEYg5l)b;IFfjD(6=10aa~K&Ize@%{l{bQwLycbyDophp1y~@LH-Z#8Le)W5*F)8n
zg4FGMEWlz4H!yelw-Q#ldP4ygd64tJgO<*-&J|!$6lP$kn!#0^TEHN{q6*&F3hE8U
zF$%DNkA3-mRGxu>pIv}OM3jL+^dfiwVh;-ggG`G6izvu#H$V%Dc3KIrurq#Oh`GW5
zI@*2?1LF^0ZHOXvP$TaK14C9K14C9l=%P5E1p+MWTHr1&Lsks~Lso?X=wuiH7VwFu
zAf?k87_z3aeqe}s!N9C~kb&`s86#sB=VIoii0Ok^7LXmFHCy1rMlwN>6U)FLv0H%o
z9mpY|(cvwi_W#ez+Tg;C`JDm-Lo{e)Cu;=*L)HRq1_r~^0?hBgNrHhP>ly<?)&*?_
z1~oYW=J%kTy44H}S$`QAvc76FFswTx!2BLmb>3iL$W~`y$OaA3aBUG_26cuYX}o)S
zZW*hz*JJ_apP*p*%D|BA&%luF2`Pq{L0u`(nw{(n28Qeu=rBf%0%+-949Kkv0?ePd
zKwgf3Wa^(zpiC_s4iYM1U}Di{VEma0&)m!teb_)p_)YX+V`NNcGz1N^#<YOSH3r6?
z&2VL)LwqDYFvQGYVElO*WYQL>N$aNDl(R~(#hd^Y8PlW6SrruC3oxH%{J;<mI%*F*
z{P`=9^#eon2L>jl#|(_Wgs0CcXH}?YVPN*Z!NB+na-Ju*69eO~N06f!VtAlZkQrr0
zm=yO1h8Pi$6v$P@JTPGfPzDe%6kt9IPNFId3=^USm?5XcfCh6w$6HJ&5MZ7y2dd&(
z7#O5e1(@fGYcepDuHz~yE?^K~UN6nSP}Ic2z_2%edO!uM7^oxa^<03t8f+pX1LJSd
zjcMo81(-oMATxkUgxnR=yDC`K81tuZglY)l5MYjjYiJb$?H&?fjuQph%E`dMyJq_9
z3RX#LBLU`Ac?O1(XJG3Dm?0}aAbF1&+|U8{yrabhm|fteodNBjoH5<Ll2x)kUw}Cf
zlrErS4$MIy4tPVuqCEo47GOOe81zBM1c8rE|Fh2`CzU~f*+Pkd@y|X6hU_*5hU^M$
z1_rjt0?ZcRD^M92vL7-qWM7qLVEp^=1B3n!P+g-BIz4)W0JDt%1LL19o(znCKQl8h
z{!RGLz>uTKz>uS=%)t1MhiM`Qh?ZoUs0E_cm?xfKU}s?bXUxEm<I2F0;|v<-6#-R6
z42*vub&41xV<z`v=A}~L89ZfZMaTVt!N362b((Ho#i{~2D&)^$P_v<Wp92F!xvT)Q
z7^v?1`hh_&gMooj29zQHo`(2LOdsO2oDc?v96zYf#Gvb_avB*Ja>_xA*m?z+C1e;F
z%9t4#a`rGV<ZJ@(%Mf5z<zQg^dzxt?heAmaD4^7285kA*-eF+KeZjzx`=A_>Ms&ex
zgn42&vphJR{HkJ=7S7{mV94WT{Qz29$6R=ef${Ic=^E9n3amO{pZHd@Y8d^!lgz-t
zV9W@<TC0p%g@Iw^9RX%0a6B<GF#dBC0!I&%3dj?jplF%Cyc(Rc&Q-HY)rSZ$eE^lS
z|3G^_&o>A#fmV4*NwI(~lNVt6&dI=_b_-NU^SlvYIt4d$JyiaT3IjulH6(R0fe)_&
zjZ=b*xunX#P*MUKhGPPyXUHfStE~VN_}nVc?!A9sg_277(-;Jpb}51O8bT6rSq-aN
z{T%_OWnjBLFesm4U|=``ijMyWEkMWH3owBWKn4|$c`^(Pc@o+T44ujXOv^w=Pu^f)
z$g^T#$TPD52P)GtCkDp<2N@Xhq8J$RLbMqecy|aeE%OGoX&D&u8W|Y!s^u9N8sh|*
zR!B226pJuT<dA1z*v(izU8a^*ia&1&14G^-&~T0oIJ{kJSyjYU7#I{X1(?8trXX+p
z|IEq2Fz46whFVs!XcYzqoiG6=@Mg-dj0{W+cfpbZOfjH=DNqZ3(_I0kI3)&#3T7h)
zhDLTa0j4Y-1}26Geg+0h8v&+lP$O_BXp^qp6al6jP@0^?#LvK>k}~~cEvu*-!(DKY
zf`;F~yPMa92rw0Z2X<K)80@bKFcrc$ISc|!g+ibKMMx>cGy$B#z{SFJpE_2l$jt&w
z<)9V__`I={3<0JpPz^YV0d(6m6N5Yh6T@53xR^0BXhkUhQvoJRXq?D^Ch|aW!o>JC
zi-Cdvy#SLXxby?>g-lJIzQ2xDw4U)T14G_+28O(~3ZT;=1elz_+pQQF@*XiT<UIhL
zzQFiaih%*-QCF}>85r_@Ffio30UalQUx3MtAJh(HV93{GV8~aOVqoanEWqRi2_S}i
za|VWdV<`p(Pzb=Th0ph9V90k@$Yc;;@~;Q^-I#$PKZ$`MKgN%NiOc!}gG>*o$IQea
zz~n8>%)rFu!@!VV!@!VV!Op<M6~VxeKZ$`MzXx(MLq(bj14Bc$0FxNl+l&lMOu;Om
z)pi0*5*#27S4mMig8-AH3Ih{UGBgiB20B?77!K5H2{3`L)&#|R>sbLNNGA@u@L-=P
z$ZYWN_9T#Ya6s3C3Z(M2Dhv$k<pdc2!mR}zdaj%<zz81a2IZ!eF#?Q#!N)0bf;Q+1
zF#ZLVMmL1Osh;tl4k*=wDt_J_0*wDmLCGEJRt9AThVnEP28P|`(+e6{rRt*u81I1X
z`M{t8I)e;!b{`XqzBU7c0)qhK9Z(w=6eJrM81g~K!5yC@z<39Aw&x87hWvXB4EZ;-
z85m?G1Q_pvJn)r)p@5ZvA^*QN14CSq0OMUX(9}HxLxBzhLjlP9`}_nL?>aFsq+VRX
z$RogbpH-ZJiMgGhfk7!nfboGm14EH7DCx%)O;>1S6|0X2mG+=k-8lh9(53Y1^Oz=b
zNHH)>6%%0mC<F2&14BV114DtYJOhJCm;fWF>|(gVJn;$xq%p$?8q)<eW(qnP7z$ch
zKQO2ofac#Am{^!VwLEB019nx918AOC)d!T(K~lvGjMKL^vMScM3NW64hLDj80|S!=
z;~Y>Y3|uuZp3nf5stgPTOBomnW<t7=j3>+(z_YLgPZ$^q?r1YG9M=|LJmCV01_p*g
z5e9}r9&H8&m3IP+pqsZq&MWj_U?{W!b?(-EU@$rYsveC%hlL3UFxH<HU|?eT1L}Sq
zU|=Ym#K2HE0mM1Oz)(1sfuV3Vh;x&Hp>PEQL*X*+4-7^ZKz%Qe7a)_~pb6&;reY2T
z20sQSw&x!hjP8K)0P|`A#`6Lo%|96!3b!*b6mDc@U}9%wU?{x7z)%R<8pIA7BB_7R
zz)<)aBn65d(3WZ@b_OPP9R`LX3kHTFBM`@ufuSgrfuSf6#BpO_D9U1BC`toyf*BZ!
z+8G#%K)agQ6BrnZ_AxLN?EuN-GB6a~W?(3~D#yUYURBA!#NNulz`P$M)yBY3^o@a`
z=o5%jKbe7{n2Uj-m;=OHz`#(f!N5?gB+kIZmHdIhcm`;2oB5^yW3MO!6YCF9o-Scv
zD0XLHD0T+r=>`Ud;&=vz;z*G1IcI%fFb1V^2IjW{j0-rK8JIX%FfbHXGcXi`Hm`7Q
zWnd`oXJ9A>ozld4h=HMaF+)8=G3b~k&hrcm#oHMeiZ`<}Fmc{tU?@Jxz)*a=?gN7f
z3j-4yc-bLxc-MoM4w*QBQX42P>cOjwIsSv33#v{z=Ls+#04FO(1}3(3;5wS|fFUR~
zaWXJ?R|+s5um`6i(CCWcaskF2aK+Cdig##16?1J7VB9GOQp^cSYCAzwCg9;L`Aq_h
zr7(@`Yatp-ku{bfYb*n61l?8kPJpote8~fsU~y^=g8*Z-0s|A{TNVZe%lp$Gwy;Xp
z9~EG%1()aGV?zZP!Dk19in`K`0*v*bNx~akWeft0>l7H6*w=z)9qpzFFgAkAc@_qS
z<+lYGdqG9{SFoz7$_z~Go4~umE0y>d7%E;kFfgoa7hseDyZ!?Ms48Y$1Il`woo^W#
zdpQIc6<HaW*ndxNY-N?I@04MX2lt2=RY1w)5~#HWakwtn;S3DLHyId;FGFe;Mm@00
z85oMcF)$Q=QUF&^jCzoRt{6(V85l~~r62{X0jTwRgMpz$nSr51R*HcE<UIqh_ZS#T
z+(E4$&;@2|ZwW9)fRuh^U?{0%U??e-VqmE76<`D{V*qVyD4D{*P%^0;)D&ZklVV_~
z-p4#~DsvD61E)3v6Q?Sq8e}vA2M+^7$qELBk|k1*V6p`V69YrZ9tMUI(B21-WiBwm
zTMP^(SL#94Tk;2n{5PQV#pxixXe$cM3MIc87)riFvjXU{)>3Zp5KZ14aQBUg(-o9F
z5d|SL7h^A|la{{(Dxb#4m<4hxXru--<-p9vSO6+2^ACW!WDv>e678%q^|K%i(E?Dn
z+<c}0BR4N20~04`E4ZbN03$c3^9VX<T~|SXk=q!SUiAeSxots3BV?qMk=q;8p#e2=
z7<obK(~Uv7rGB~qcsq({H6sHP7wDF#H6a3wpeSbmPhm4M@qvz1Fb1vo?3yd^1(axZ
zf|OcwfEx&3Kr22c@nkXxe1n*&$-rQ`N#F%Y-6W8@WDaoi>xDF^!UCy#1y?uwuK=Wm
z1gYzWsJkN%QwKV5fx(y|f`LJ;UQD0>WZ>5i47#9V=>jOVa+j%r?t&F4P-9@?E@NOQ
z)n#BPRaXNw!vzXJ_bq&7U?>e@U?}xb1E=3YS;!D%X*B~wX{j0mLsYgvA$U5LfuVFJ
z14HRlbq0pkvjUZ%#CC&$p>!()L+NI928KYzcmdGCFrbEU=^+M&(tYX-45>#2nxIL&
z^bP|<=`F<)27wk?1}1Kh@h=$|N}sZRV9@;m?msbcr$E;}LV8Z18B550lzKWK1=9sO
zS;gzu2n2yW$;iOOJ&%onVUB@7h!ThmYP)3L)MQ}LbQ5rfD>=x<z;Jq{fGbGJL9h~~
z2nL2NWdg>ar2h2-gEVM6A?Qv#CLUEa28QKs0>+A<6aeW+mHt*^V3_ekzy!1i@CE}z
zS-l<uLzx=)2L|asu%Z=wV-t7<82ElD(BWRqL8+Onpm}-*CZ0Opq}&3A)J!EXyC5@}
zAvM#CfguTWZhM1xYNkC%9R~x$4DZw|P?Pa12Lr=q{?sf`D+k0*-IkgKYHES6vQE{q
z)@5LD2}w<4V_@Pr05LjI9b_~I14Dy&YN8=%Y8Y(XbpI|^iTbOlzEGF&N<x(Tsz8<N
zDx~^aKwYx?LaMJ5$R%tH44px#;7&K_u&mkdQbWN}&BnlBC!Pu}V{U-F7_&IlO%!Ah
z0~4<q57>(yl3>0n14He~RBK)aCf=#M^`IkwQmr*WLCOJ25UJLNP<DfOsx@e(FvycL
zyi;w!M@VrnFih@EwE?yJK;o&}Qf)xvp<j728B(F=kV`T!Y-&tl;oxOp;`0;AFD+q6
zVF7iU*6|2|LN|ql!x-c#PEdHHOi%4*)zMH&Vc`}539>LS2yaVa;g*JSB)+Gx@Nj{G
z40L1L?ddzaS*^L6&!;fI=Vf5xXP^GBn^lfce7bB8tFDGp3iBr<Lzq7y8N&P-$&jKR
zRvS+46y|FnGY(AO-UBw{8q|!N$Y$I`HscnO8QQ(9Hs&`{m?J=D+!QKgNMVkUVqoHb
z32w4~1+hRaUSoR(J_aWKo01F+4L&K%ro0SH0&>&m^|Go<2d027sACd{5h~2gV@P4v
zRt5Q)lY!xk)bt0vtje5>DNG<23I<K*>0^~);{QKgtB-XCJO5445zhCfpX_5*bgsXc
z!gL$#V9;^6%j!~?a(Nk;1Rn@xlrp3+<?1moB!P|%Ym!Z2$~6ZCBPRpHM&T5uJWY^g
zpvleS({=k<qeKl-n0$E|n1l+1K#pMor9q*B>2vy7mDx%;85p+Qo_@5SHAd@j3X>E#
zV=^!a-G?ZZQUGfMTPOuet{@9{@=W)hz-sN}o5J`Xs$Q4_te)||8c01?E<*|vBPiv5
zWyob<;Qo=q_!y=z1fuXU*x>0WCa@aUr=&36=4D_Ku7pV4Rs@+LRKSqJc-sWz6VOS@
z=|@r+`=EJA1hjp#V|fZ=p9%w$h%F@HG4@%4)It&-V;?v>ae^{-3S&QLK{2Q^u$e!F
zu^&{JfH<k!QW*O|Z63L=AontYFCGRBVDu@cFir$J7j*c!#Pk^xSylLUr!Y<g)gvGU
zCV!@%n#d~e&!58B!N$NOQqIZ10CG-;CdfHZ7j&3FV`PSR3S)-@hy(J6okI$vHq0NO
zbHhOzwbeixr&~;7O|3tZ!l)_+;xaIain2fqR+j<`<T5aLaiuUyfZfKxBx(<}SHch^
z&6UZJ!YBm^bV&vV{o5&we7p=yqNz|-d<Jk;0uWW!3=F5cQ;tK86O-X!VCdjoo^o6V
zq>zJwA^Gcc&B?4~jIz@gOlB2T6Ha+0&%ltZ!~i-paOsYe{V<LGAdSmY_Jh4Y{q|&5
z>H4!N(0fyu#Bw0AyTGyxaSRNao2-8_S}`z`oUl$}WMp6xF9jcsWt{;YykKKs@O@#O
z33eeH1H(#bYtV6?LTaGn*5s@~i@w0@j^)-R;7|dVe%7Vn(vOXS!8yjdOpL)AVrVX-
zb-6SHlXw;U@Sl1Hh5~)-cRWc&4Au=o3=FKG(>a#LS@(dC`eb8ZSW_{5!xUC=PjTx>
zphf`bP^cN+)|0>~h>d|EQN?;P%xSB|thd70(JQR?fa_W|Q2k-O7bdQ}d%D0>R<U{|
zYYnhhXMk<i2HOnU%2DQKEd`d?$P03klni((tAc^S;|xDbIO7M#;5iHo3<{veg!n^<
zFBm?Bczs|D-od~m0lIM-v`wOdfnon7eimPldeFooXoWkIgaTZ>LVa;+Ap<{40N7a!
z3}wL#3}t~u9~gsYfJ^~RjR-yGXHjJQz;IrIfq^jvWS>;JHUmSV7e9+4w6$55!oW}#
zqmY@(z|W#3%)lg-&cIMMm4TsbVtG;#13wFBAs=f8(?kww1}5o<4-DsDfQ}^qkqq@U
z{4A!N3`~;em>HO)(-;`a4l^*69b{)<k}hUoD7(PGP<95yX<%R|d&Iy{_5j4`Wnd`#
z$iPtcUXFoDdKPFM%heAI7i2(t^e%vwRC@3;zhh-!lI#Rc7QSa-C}&_`DEkNE{9#}y
z=V4$d=K^saF))<ZOEEB%gZ7ewa$LDS14FqkbZ+B<45+;eHjhDo)dDoPalwLt@%vE*
zCP`4^n9&4!sL8houtEp$R1cFRXt6M8#r98dbNE66beadOoY9t%5qvVi&jQeb38rF(
zdPb%`4`wbV$eQr;9~hXmqZpVZ7eJSN|5O2)ef|dn)0cA$Op;qbjdI9UX%_@QN@2=u
zKwD;t85kJE8JMI+J}_L!0d?lZcJQ-Ub22bVaf1R^iGiWqo`Ip<78Gjw+#eV&6fiK?
zYlF_B0lT*We0ThL2L>jo9M%sE=Sx5>DF!AfW00kYo&Xbv7T8T|K=v~*NrAQyg7p9R
z09q7%{s;q;^mgtK4Ck+a<YDgP0QccyAICB<90}rQ;br{5a1L~q%aM9ef|3>i_qF(8
z6LJjYF$@gl5#kI?*V#TWoC9~w#n$k%h-)%1Np1CHV7e{=a>BV1kQEF}QlQCjuoLEh
zg&P={uB$OHNr8@e0L>t=eqcEF1gi8q)I~p@fLwd-Lp=jyOex5@93TZS$t~cusye>>
zEX<%hC=I#-SN#h=3o|I^-{30FXW(aH16}fc6x6A4*v8NN6RZx@4!dxbpZTXO=tx75
zoWe|g=KEkd(3%g&aDL|dG7JpD!Ym97=5GAVPwT-MkA;CjLYbfWHMpE(VPHuA#}B!2
z9kiaK@E||)N02h`fUG`0Kl2xe)gbdvNANT60GTfXx)KFs$PSPjCvh?`MA-5(?*R2&
zKs6J{MDQh6JGnqvl6fz<pkZN9VE`F_9c;WP1CxvdS1wrotT+Rcj0SiKuRj0ugELu$
zrM>u>S28j%$s}?zFs%Q^&%9ERfr0TTC&=m3-_K-~tl!EHnz~|=*$0{hP~&F?p9b-j
z3v}`<KXa=j1Cz`?kQKAR=XLQjx4|~)Fv)-pJJy{67Xl3nAaOzcgV^X;28Kgw{LDFw
z9~h)T>#IQ9y_jVAvOtF?@-ye~GH@|4d<Bm*tACk3aTcpseL4d}c>x1Mc^>G5K!e}>
z%%J<*g@qXznB+h+zs(~2%%=LFGpAS>7+kygnax3=0CTSu%)PRpBb-65v4*=>7IYE)
zs(1X%Hhdtn7(^MEWE-HqLa3^jos1zSy9_GihA<2i$2$f2nf*Y6?q9)%fhOKSRwAjo
zkE!t!R45E?mK-aR5aK3ierBi=P%D-3DFc(7D!7&E1DfD(zt7LC$;QAW2Rgs6U@bqh
zra6=|(U6~6OAf?=#-R=@OyqK)_UIz4u16ITV5tY~|L13hDgi~Ju&@sU!-3iS%yQs%
z4kH7TJToT)gCQqBvz#u-9!>^^1FQL&<v=}uSVSnmEqwsBK@nl;XH+3r!U3zOU(W#Y
zpQsE!({4rvCIw{{28PxR{7m4r*PuM%($3Fx4qUy1jtz9=XF3l~04xj)?)UkbE`vCr
zkt=U~ekRb85b(sxu|xb!kS+a?FkyNGb{-1@gUxk*rbqIiM9#v%V85H6sUCbJ^;b~_
zCixi<XEHs8yIg)X_;^=-rYG<uBoE3rx-<BZRe^5bK@tM_&+h_1(>HL%%fi5*$;;35
z7t8@!^B-ajGbbklqvQH|P*PG5LJ<RJXi&<6C}9BaRqzbwXIcdAntxyb9U#b10xFah
z&T2C-<oED1EduxY7#Pai85qi&-!U>UfSj-d6g*!+BTNcs!P=M@7}%ounU;V?m=x|a
zFqAtiVPGg<z|O#=@P>h*d_Mz2`Ce#=?ydpaVZoNp&oq;lfk|NtGq^-&C_lx(P<{e5
zh~%yTD#E8H%wrX)=jCStFW3Ujn<@O_gt%!kXx{8A7iffzpJ^({DK|j<iTE0RrgpGT
z7?>0#z$G11C%B{o$@(4RXM)VFGcYNdL1b$ovgQm7N{{)O@);SJ6hTwtx(fVE`QY_L
zpaOc;JAS5ob<lzjP6h^XUVf&0$Pi5h0|RFQKT|B@2Zs4R3=9k{pm0-a(`I0B4CiNx
zl?4^_3=HKr85qhzi#R~W#2SE%VPGi#&cIOq5p-q^FF#W(X!G<}28IeD28IeAmk$i{
z!EH4LCM8R$dIpA?4t}O&@FBnq3>C%<3>Ajb42%il9~kD(0Zj?a2Q>s4_?gmp8JLt<
zJQ)}hz>S9a4Gc`5mohLZNrDICIM_e|JAVr3%rH=e&H+0w>{|<HL<iJ%kY->~o(MLT
z6-+WPaPTwLXR<OdDdjUWFexu)V5qQTV5qPGaW*h8RCqElRJeoA9hrZEfk}BEX!Wr%
zXjMla=ngSE1_r^Y{7hkt3`|O(0|G%o5(W+uPSByN{7hlspn!&G7$gYH85p`<_?i4c
znm%xX!qI@A$zKr^kWgLzCZGU>>hcE<Ml+Z*Fzma=&*aX?z@+RjeZc}&852-gyMyL_
zK|_n6D02sIdjMr1eSUr>FIiCC#Q@TINRgk(7Nm3H^bZSIW$QsYZ9!Mb!F1Y!R@i_~
z;0Nh+fa+9XVCatFXEFz84p4yX18p=p$<JgC8UzG&BQMnQGns>J1vR5*{^e&9Wc<J|
zy?}v%;RPt6s65jK*Ii74U^5sPD&iOzD(b_ai9!&xZ3vVox)>NLKxqn;CIvy;hmSBY
zRIFfNs92&62}nU}P>?V%R2*Yqs5qpMl*+)*BnmE;7#J!ZF)&m-fXps3e4fU@FcWl$
zVx=EHlM-}4YsD7^hKe@|;98nVS+X8ff-x{uN-;20in)AXm=0PI1=<@sT?$;DGpRtz
zFosHF28K#~25|=PR?g|5U7!p+xA>WiSs9pAu7P%Lnlms|x-l?Rf_6?>I5IF)27@jR
zfNtZgOk-fEOaZ0I=@UTPI6;ZW2jqVShE3b~8Lu&ZV5m-EU|<4WAjqT++UUwPhk;48
zONxQv)LDMU`=CPa1_MK75d%YIfkGw&KjUMN&{qbA%6bNdO3;OW)u4u>0t1t3Ao#>5
ze#WPu8WyB!G6O^9L{M9?x(0j~43laqI8RuBkC>~T0u`(T3xaogR)a2BF9Gu{z^!bp
z-5(fgG(fFvu9f_ZpI8}~)a2M1n6yqXFjTH#V5pn};#_86sC>`BQ2A1vfm!kB2ZmY&
zu!bZ2jFP+zOsa308JHEXGcZ(v*6D#RDpq{NP|r|h%fL`&4su<M4g+(b4Fi)JH?(2;
zafuTHlkpZt15o3&CWnF9TutHwL#+wuctKFpU)SgZLrn{)aOJwd585ulq;AR1z@%%>
zz)+RRz)%$q;&?JJRBdKps9I~wz@(eNz`*sLfk|BuB$LR%P*s1MfuZUuh?mX4P|eK1
zQ1x9F>i8Ov<GK0y7x6MMsV#@Pz1on0p;{BfdBng_9m>E^?GM_M2lg#!iwpy|H2+c=
z1}3!|AT`$+7^+Jd7^?F@9FT?y3=GvhAivfwVPMj&WMHaSdjsmrlz?X=YBxXx)fvEI
zETH64djKQ`=2w6f)$~9@NnIZnN*j<v=>jN}KpJZ#koMDloB-QT%gXgCVTBF@Xb8s4
zj-SzR6}WA}z@!d3;Gk$OKjSKG(7De-Ii-0F{EVwWGwPtm!>V`uj2pQ?%BGtwWmS~i
z18!0M2h}r9Ec}e1+f<bK8JIK}rWY(_HLpLx&j`7kkAX=8GzAYbc!mzhV35VVPx%>p
zp!RBj&I8%CkDn2ARDdXG?0)AFe#Rcq;yswX6T$X!6)^BKP6QpA#Sbz=`UO8@1I&!&
z;A3w285_WN1amUfGk^?fKz4j9!jM+DA@el(89{UP3||?TG=4x00Zm8<g7!oi&*En+
z02kDtSs7J+#sbjnHOy622m`Ai2Kq2C2(a=qCb5EdwKFm>Y1%`LOak9w4LS^ND?eir
z%*b=<{ESI%py6&v<A^aEY$V8coiF$qL5Dzr9H!X{su{NPGe&5ER)Rnpjf@eXODMlW
zqbUNkIveJ&7%m14CiOL-UO?+5enuZ~Ac0(S2I?9g(Di8`4<1-O-Df$g1gH*R42Iin
z8^zD)4A#WJr1=ACx3en9Zm2um;c68E_!-TiYPD3L=9`0k3sq|eQ5(a+P$kOGs0Z3>
zH0c9_G-$jLbP_O=RvPF&8os~$jNtjiub>sH+8m&%4Ic(3Ezq<ZsH^)y1$@b(I0ru?
zc*DTg4-8T#7#JA912kH@wHX*hqWKwB#3409^(qF2>LuV(61+{|D+5FINd|`MgCJu$
z7?|{Kg4+l&Y~Y)^L^<#A{{{6awcbq6Uco9^zw`zJ1E}s0y~p6rz>q1&{{ZSkZD;Up
zw)_vk0m#9?V7!(80c`T%oI3vl@R?M+$r;5A{10^*n6#bQz*W{ua2W6;G4Q_@WnhQ_
zuTfK;?a#mv(!zfRZ1x9+-UtQ;h8c`=7?|pH7J?7Y;6G!`z#!<vz)<~;fuZ`D8o0A?
z2DIqtD+5D~Dg#4}v<5hro&nvt2NDZlV5srX09$`n4`e+9Lro0>Lk;Mf(N*vGuY#Qc
zx@I<sf&V(hB@8u-7#M067&9>G$$enxoxs5Kp&mprFc|P(V`X5{0WGu8vu0qZS<Aps
z13LImPoIIIW<LW%%}&rkm+lM<HFp>oYHoly!3+#F-x(NczJfUM3=Fl*3=Fl5ptCKr
z85nB$7#M1KSU)iI&H<lo$)uA9s$ak(Eubj=+QG<}0a`R%51Dv#LO$rScMtM8mpzP(
z>C6)&*uaBIB@Ez22E9k1CtWguE~+qKVA$}Je=j&}LE?~j+Y632Nc`+|1qBc!ehz{I
z1{6PsMHv|CW12uSnMbSmH#34_>jQ%nXzT{uOVBk^11Gi3GLV#3E6>1CE3TNyz`qUD
zD*wvBQ0v0LPz%}`AhiKKq0P4AZv&+>-AbM`2L3K^SBxi<fgiMtodI?VhC{Iu1H)`P
z0iF~Fe$d9^m?ky`h6~L6OQ9{|2nL2@JEkkHW)*QgrjcA)#K2!B2wFGDz)%Yc<ixZ*
z2L3W>&>kPgOvPLV{tA%0ZZI&^PGMlE?E_5>>%HKQW&~+r1V#Gvs@1F-yj%HWKsgdL
z*>z5R`uf$ZV!SE*{%}=g(=V-N)nHsb{r75CC0-$ZYq-qK=~`=8Wf*;@yRTujWGtWF
zxQ11v9(2f_NHo79WM4Ex?K%dA+Ep6GB}EMUirUbCJHo(FyAL!9-W+YZ95f1E_1|<h
zD0K84K&O`I^P4UbhcsIK85qoFnzn)ZIX6BqdIf-v?gix&{U*>UEoYof+XO+^F@P@~
zno(}r!#Q1KEvu-+o?DiTZ$L*>u;^Mc9%f`<(g$5d;!-!=aV@K4;4yGN(US2xq<JUG
zz@&c@RS48})|~-Y0qR??^RZ;iVPs%30A0T_|EVQo5hs-65juVKT2{4sTc{ZoaAOSu
zFolv)g#@^Y@^cw189QVc7@`ky7338#STgoWF)$g-Wnp00dBl=&8nmqky8MF!Bo3~9
z;~DrE7@}soGce4Hvb+KcADgcXOa?c>iQV#wJgD>lpU`IsS}n)06BMrE?Ur{zhTQ;9
zUbz0SbOY)8%D`mEH@#;as|M$RFP8R<3`~Yb)Az1pmEj1mv;gtKr$1cBDl6q@sSJuD
z!*#r17c0ww9Lxbay<)n=dRF~<eoF&>NTgXYFx0)3=?1HQ%fY~~YoAQFEGW@&Ffe2Y
z$#jFaq=C+=QIP570;N_N$n|ERBj@Yhf@TD?D`l!d+KntA+N&j@+I1CVs=>7p_*y2J
zYS3X#py`QhvwE3YSq3H}3#eJ3)0wm@L4gz*5W&E(XNL^vA`sAFp1KJP3=E)yJD7|v
zs)6pOk;zkr+%sBxpMjzFrbbF}34=_YKB&%PV5kEXV}I2c7_x0-@<7+P-e6#;Q)OVN
zQ&b0C*CJB{wv>UPuHKx1q0Us4fyoFoX{|d$rWkU`DE9{j-4@W|0n}{~ptGr@t7Sq#
zr#f+bV2A*1WNHAVY~vYf;1COyg=CgG7Y2qp2hh3zb(v6g&~57s40Ra{40UnpV8@4p
zFB)NBkgA)?z)&|)9W-+!1KIM!z)-iGfuU~c^m`jvW$WuUF)-9^VEw=l$-%&6{Evaj
z7}Vwm6}pfzm!a+hL!=7>lW`xY!3ipwGZ-xxiaszzMldkj-v?EPQ*O$bfzBy90x|#+
zGiGuiXM&FUQjsy!1WoXPima<L7GP(wfn5U{Qf8<JMU$?Aj03pngT@l*@Tn;`c|iNa
zWZXf8)mKos%>5vv#|Vm&4-64gK;t%`a4}f`2^T#nkcA8kb%z-k>UPUAFqxeE06qwk
zfq}h4#(;-`$)qokfyv|(12Y4Y$t?zkx@Qawbq|=87?@0+F)-A#F)-BqV`pG8`NzOe
zugSnrugv{{A>t0`F2w25n^>jlmw+ZW;B5p01_s&dG8$m#fb8O6V9=?N(Ex3}spbIn
z@nkftKu!e}uCiBUq`(RpLD%;}R7xp<oC`XRQcMQCr3qBbR{G0Gd4qKEfC_OL8E{yE
zuG-PAm&q0cC45s=4sh%W%7c`Fib~f&>8Xsm3=C1frTakU2XQbkte-C32QC)Cxk0*5
z2An*s7#LJ@qyxaloP($e0Npph0Z|no2~x!Y>W@#C-^{95zm+GIK{`g7fw5Vcje)^$
zsdOy(ssaW9ka!W2co{?-ltCjnr9rohF`543$z+fQwI><Ag4Meqsdt5{k78hu6O>k9
z{J@|I%0UM}(P_3>Ba=Z|L6CtV4z&EU-i3jo-cAkdB?Zvz8wUeJeI^4#eJaG!3d(Rt
zODli|8lWdHgRb;rkP}o)Wsueq2l;@3p}vEGp}vLt1B2!g24<z8>9Si`Z4FLKi!**;
z&;TtC1D#I7WUc|SUL4d({>s2me};jf{)E>D22B%?7DmRb>8rP}$}nn7U%rJ^q22+s
zSe=1E?5+x<BjX1~PtejP@G4;oc5w#AC2?RO(9x*9DvZ9Y3{2*K*%=s@WHT_-zhq#j
ze`?FXxTKtcL2xw#lleK2Oa%i&{ci?_`kx?93j;#~8v{cF3y3p;fuTW|fuVt)^#h~l
z3-BRLOy>0)Ky4+^c}b9)R2jVl7#Np6VPG;p0+C>l_`v8T!@y+ml>wyh0_Y4T1}5|8
zAX(1;;8kl3+#eXdTtE^aLGbC2pgB{JMjZww3wF?X3>&0W7!5%Fi(r6k3}dqRD$T&S
zufFdCqh|qV54R_1K!-tv(TtUW$s$gUfpOn#(7yeB%R$U_AYvDYI07OrfQUPwJ>c<w
z!TLc?1L+r00reV~EE?uBGB74^fzEHY`1gU)vjuDeXj2V`3ZoUshDTKlOqM)s*~}jp
zE^5pVWMHxsV^C&bvQ%P&h{!Q8S?Yrb8xY|MBEmpKGWQ2Y&khDAE6|!$s5d<`K;a_+
zb_wJ9C7_Lh+V(1pN{sIr85sK3tNaIL7puVO>$kB=)#s=%GV(AmS%K<m`9&&>Y@nhE
zG(KMEqQVG1(HX?a>QQ0j0MB=W4zb#*!pI5ZbnaDQ1TQamDaycP*&NTn5GJX@$R+}s
zfB}tETTY8-U{GjOVPw;V3$2W2V2JWmVPqF&sAph&3RboUs*Dpf2?h~5AJ4!bv{r>t
z2$a_$LXYA>=jW?13Yo(V`x?){VEIFZQ3S5aiX)zZf$^6LqX=A;m2^A<gPXVtqnHp(
zqm^Df14CLpuL`3W++|jd@eB+ntyCDrA?_D|dPf2@I{1`<p_!3^$tu<aTwP8Du><))
z0#OVM2S2MEWdy|?1A{c^<Z`Cud9n;lDN<k|CI$wvBPu6Y8JMi!fkeALFkGwv4d;km
ztXC;yWni)bEs{=|&cM*1&cM*1%m7lP^nu}00%&MP?1f4ZNb4nK2Bs8!Hs%jZ*-Pgy
zW@KPWu?F=yQrsCB8XOrI8mz%$!3^6N8JI2igLSikNd^W66+abM2Bwtw4-A)bK#N8h
zn5<RigNz7D0a<1m^nu~h9<XIURN_IFO#@w48_&Sdkio#vkOtypGcYvNFfcS!fjH$1
z3=N<R+=p_F?WHr|Yiz}LvZ~c*K&F|kw}CPt=!6c)%6n!mMjp_p&7~C}dC=&f0XWlw
z#+SJmRl#%B7b_STSM*DKV7PRHfl1{Vi1C1d>3KTHr70XA7%n{k9SSARqH>y*fyvp*
zn1ShV6j+o6OfoPSsPxveGBDYIu4umWf`Qp~D+7}aXs;&doUcqqThPGNr7uu%f0!ef
zIBtO?E;B$Sz}p%*4uDz+9M?c@zRUxXK`6fhzUFv+>Ia6)0-$S-#U)gxvNA9^nj14P
z*01mSz;IcDfdx!5Fo=lU1G(sm90TL}>D(U}E^8o-TK#+g8?|CK0F7D6GB9pY`@nEn
zhk>1eL0nzr8OT&!KL*Av`e0GeFuA%g<1bEj2F5L*sGq~Y&@c<c@nc|USkA!Eu(V#8
zfpJST<cx<c=?n}Fn;94yHiDECGcYt9V_<051L8C=Ff@E;U}$&^;`A~wH0m=jG-`r4
zvlti}y%`u9-CY?Nw`}>qaQO-7EKUX{+XEoktqcr}DWJVntREOIzX7!(7?^CQLI>)8
z8Gy%IFaLpxuYrg&iGY_*Tmjw1d=MhU_{#!xR}SNrlOGtafQnrZ$-pQh%=lV}fyv&3
znSpW33kHV9S_X#3Y7plu14CmU14CmEGXvvRCI*Ja`3ww=b3rn<85kNjFfcT(V`pI8
z%Fj^G(71<zp>Y?8C&j?fc!7bT@fe7s&cM+4i-Do>i!B4=RucvWaWe)cyLOO_B?Ci~
z2m?ct5bFnqD-$4Yw@ZgP)BuzMu55s|ZkdWDpvy#lfmTT~l`$|dxH2$qb^pL{1#}<1
zMLh$P-5rprJ`4;^@(c`3vLI7WKuz5PF%=dfFJPvE7q@~&hC~V&88g7gzk{3^#lRr$
z%D`l=3o<a8fuTu@fuTu*^#j9I9*BYVybuFH;mQ4h;i?WpJ#*nLP|kyy$oR_wW+F&|
z4>b2N6?4I|A0s3xwr>8waP<Oc0_rMgt!|Alc)Z!c7!=?K7#Nyt85o+3LGC!qz|fS#
zz|fQ=$H2JthBN~sNar;f&=R0)GN6$`1Ms!QO!mKFTBkEGG))AlJ`2)+gMp!G69YpN
zsF{9Efq_}|7Xy?1HISPpg2I-mv;dSFuNg2fn<p?Z*@LfyF9i>QTyuehS0;D}1QZNE
zAle;7z}i8_41jJv;QqjH4V2hGGi6L*LqX#&zd#2NfVO3WlCB8@xO?CLTkZ1m2guUP
zpsv9`1}29@Sg?wKdJLCK7?>Q&K~{i66=XZej1C57b2SDg2k?H>QU<Wf6+R414$DDG
z!R-&of%DMw2QTknVBGqdfyrSvNPZ#*$i^!P49w=W3``E^L1Ja#0r0CcK;C3va(F+z
zejlqixUv3=fyt2rqy*Gw$z*f@>AiXY;(JFWummjdBt9_QmH`JIXjb8}1OsF1Sx^aj
zGw}n%H6L(!6{0c=RD#N~GceuEV_<07%fQgI8^oz%U}(C@z|eFZ#A#z-XaY4Hn?8eh
zlNcD91sNEc`DGcH4u1t3#lyfLo}r}9%E06V+J$q3m4Tr-gMpzr4SF2=Z3j?tx(yn;
z<xsTXWngmRg`URVT+G1GTnIgl{k8*Wr59Kk(rN6s!G65$07_9T-0<VrA<B@CW4{&v
znci^%FOmb_(sEk`eC9fn6KJgyqdh1G-!=fL0+r!bpwgS^=EV;T*T7Yxc$t!hFawiQ
zIx_>)%|{Fj&2<b6%{AZ<1F5N~2i2S6-AbAuMW8K1U`3q_49)FuMWCaK7{sS5X$dkg
zIjx5oG=+hoc@juXrQHXHYYm`Nh{P8wX@k^U1_gv414HwC28QOjpxC^Y0&*Y&lhZSh
zBf*!!Tq^(x)iW?T{RD{_ft5jLxSV-FLM9-uT~`4q1Em2DBL)UN2F7nEJ}_K20aZcQ
zL4)WFDsx%o7#P1@1$$h)9xTbnz#zU!<q9hUlZ&r11Cw|U(?kwg(3R>R7_Nta8U*4e
ztxZ6(0`;IwTh74H{F;HG8FW(D))oea7A6LU=6|3vY9a%J_+17j=ldXKlNcCU<QW)R
z#FZHsx6WstcopR2>!9AIBm<N4X^<O>LAewp13H-myc_R^57Jt#Un$@`a6JW*SDb$`
z8Zc%tLGm4BrQGc+ASsYha8a-=HlU)7fyu>S`hkPs(?^)$YvF$RKniV8xeJPq6rm3c
zHv&KnG4VGlH#ixX!q><$Fl{RWi?T8>NJy$QvNAA*T^46xTBr7b;YI-{?j&3l82^HV
zH?cD?tutm|Xz^fRXmN67U|Qz@R>Q!+!NBCQ2PErS&%n@<%)ro+$Y9IBv@V!|L86d>
z$pw_J)<rNdw3IL~v=lH%GccP!{lIV=e3{8@(DBRyvW#ZD3{0*J%nZ!t-xwHL+8G#H
zT0y(o)|Gu=xC6efPNH6x(HxYM)`22o3IjvS1dx>z85mktGcdF)2XW?s>_5c7(6R^Q
zg`FQ5?qq->Rbsg;qYlUmddv(=>y9xnwA^E0Xt@Q_afyMU<tqb2%SRCB9s@%w9|J=x
zXgA)vR}2iTS_}-W8jXw$OzWB18JN~{GcdGTGcdG*E?8SH%D~VX#lX-S(E*ZI{J?N`
z2|GhQ(|VAebOwgjRAUBavrMoPSimF$1CQ({IR+*-&^c0ORSXQR#S9Fsh0F}hW^FJI
z_XmbM1q_S{exOkbE=JIVA^1`#Q1q>j`@nFQ1?->mvj6!Rm^^xz8JO1RGcdF^GcdH)
zgE;lo3=FMv7#Lcof!y29z|gvffuVI9h%=diq4h2UL+ectXFdZ%>t_ar*7qRJ4hDuc
zHU@?^7Gnmcve*v{cU?dQ*j>=97>Dd$Rt6@wrOXUWWmyaiZ9)tTZJ-l(?s|akG61DU
zQ04>O@pIt=!(AVSdL{-2iF>jK_!*eoxtJN4N*^#Vw8=9tw8=tCy}Lf340;!|&V+?K
z&O(oY+3pHhCmWb#U_dJLAgbVno+|^>`okX>?t)4k6$U2v*&w$cVPI&}XJBa4gcQE@
z40or19S<5@;*dSY%fRFgx}U33nSr6roq?gv73Pj9pwjm)NEuS;dv^*bPeDcDg)f8;
zcZb9WhPxf$Gx$L)9uNz}kO473P4K%WpbH2XnA{J7+S29VHvU})kSyy5hPyRT$-AJ2
z2>8U1yLX^MA3^FNmEqkt5HSx{s2IqG9}LV6WfC74?s0%5SwAq`vjH&}m^>UA88aoS
z*40%_KYx@}k~0D-oHYI8QC101-^3c!?6}te6>kES3*`(P+Z91|<-G|Yw}CqA>n%X3
z7<3rQUC;rF8nTRBtPD&ZcR?x3m4Trxh=HLk02Jzh3=D1Y3=D12AZM)rX$LX(fQ$z*
zPJl!}Gx-~tKQP>@p8_sMUdb{t3o<Z;Ok!qW+9<-n&{odC&{oRMz_d|;fuXILfuXHY
znSp7e4!A@Hr^9<EK#5(FLpGO{fyvVkmIh}qFtknL{=jhW0yGV>RWW#|8mcgWGRd~;
z4-EIg<%Oh(Y$+=PQ-~udV{GeSU})RTz|gjnoq=iFR0f8&;|vUKM?suL3=D1885r6w
z+A=V0+r_{jX~4h~Vh)l4ssGNv(DqrJfoa>R4-EHR!0z!>V0^{Nz!U=7VY}@H14BCx
z14BEg$k_IjfuUWQfuUU<r27*CL%S6NL%Uf$i1(j?p*@g+q1_i$T5RX}!0@1eoq=h)
z2m?cV4g*7b3aF6Tt_Tv+WMF9TXJBaWwPj%1ZpOeMnZ&^4^$a9q&cM(<hk>De2J{NA
z`#GT2Cx~R=QD9sr!NBA-4^+W|oUo38p?wV`t=BW$&jH0LSRqnkzn=rjicnE_Vu$eI
ziCr90B;0QRdp%D9bag6|7pNWwl?Uy+7#P}jaDQO9-vW&bCeXRyH6Ix6gBFl8fv@zd
z2X`058JM<T`@nF24X86KS*5_ZpPPZn7j#wR_7@Bc?I#!*+K+%d`IUj8{XPRj`)y?g
zrX5Vo6W@Twg?8|Rs!nzWrX4a24DCM{7}`HcLmdX*PktY?pPWO1QJ0m0$vY34P&)WQ
z`#rcn)HB>a0d*Z{LJE2x=6z7T!ywtIz-TDVz~sHylY!Y`G4vYD``{k8WG9n3k0%4O
z<62OsjcNDX4-EI8fC`uUpuVAi0;7pI1CuvsQgruP28Ir428IqvW(KC+I~f={v=|sV
zR6ybKfq|)hPYS4@1XtUj9(e}HQy?Rm9VUHXcmO_|>;Y)634;QojSvHqj}!E2&JK45
zh7MOf$bGC2ct8afL>=OK&W>mXhK@*(VNAQrKQKJ-0J-l0XyRBvfzgqZfyrkdb3Fso
z?iL1yj(i4&j$DufConK{R537gROm54bOnIY(F5=doI)<>Dp9cdRtAQSW|(@Ao<8mm
z3=cvWm=OK}Un&JEIY8CM1JE!Z!vpXzp8}&RD+80yH&9g6XE88z%w}Ndm<iI~0gDPF
zaEs@G4Fl7z#SBco0*s8AphyO_kHDSJ2P;r)f&>~U6}f$2c(4Ujq)1LxU_36!z!VHB
z8n#C;Fm$YBVCYz?%)qog6=W1BITe9MjgK)fbnF80>KPb1eljq0d<LoMVV>9k8d2Il
z6LiQ514E}YNXaq=hRy&6hE6vSXEOssXDb6kCnyVVKfu7yxs`#Tb0s*ho|R@`+OZ$(
z6kagNz@VYP7|GAT<OeDkc3fa!=zPJz(D@7${yXk4Fm!%rVCeh^O4TnwegTEW4Upf#
z{(b{KGJoP#22fNoJJ^3<cxVEO%7>tqEQbPPEGGk#Ul=n3vqJy_Lzf5xLzfUVT|6`a
zr3;8UCI=p7NP6v3WMJr$2QBepcBr59f#D%&I-NmsxdLOVGy{|0Y>-Kd85p|s7#O;A
zpsD_02{>ymN2IPUO9qB6bC8pmcBFh@csK#<B+z=O2?~t4It)zyEzAr|J4zWCx?C6-
zx|~3sYXo@?#OP(7_=5qIW$R}$FmwemFm(BWcuN@=y3!aJx{{0;ApSf9HWYLa4u`^T
zYX&BNYmnnW-mG9?=qiJG^9<OVU}Z?&Y-M2RY6d5yhX+7`$-v|v3(9QO;Fi<GAE02Z
z2e}AT(LKBa>bi1&V0icgq!wKr6R680&cL)o>jT3hP%37S+^oRZ#?8PKAO-TK4Ff~h
zBnE~q(9($=o(v3Ka~T-AW`n#M2C@NKt~{Cn4#oWni~>RoOaaWy4E4+oprBsCz|ge}
z8q|+wfYa}Oq@do+z|gf3+~0q+0^+(%kg1UD0Lo&Eu6<y5tOE+H$2trQj4cX`)A$*f
zg3Xv2m=--_VCdS%z|aM1gfIHUz|eJpfuZXJI|I`q&{SC0X9k9@kH!p4JAQp&cx(YS
z0yJCWz&=@zfhhpA`eUaU14Gw;28OP`%nVFBl^7VhxfvL`K?!*$7Xw4L1Or327&`;g
zPCW*OZe<3BZbb%T2ByW19~d6@fQ<v4Dzk)rwg3ZD5a`C|#X$@V-5|9(%nVHRi{ls=
zx~&)(x-Hllm=<R-Fm$_t7Rbs%62Rj*;Hu>`yE`WXQ=kDf^1A~W7`pwT!S#3!sM8{O
z8WHi`u?!5|(V#0hm=>@3!0;Gc3p@tZ0xInO{0vNiph|!7Nd|`QOon=f?sR4brp0?1
z7`jUt7`ls<8JHGd1qCkm2ZqN_kOCXrf>>Psf#LBFu$!*42Xiwp1%htZUOa_?p}T>B
zp}P)bR0jh?cP|4&cQ?qW`B0;tNFW&njW<vUTR-;$!xI?>HZaM+Aiy3DT3imQGrDIm
zFm!{4o<Vg+_hJTy?uFbR7@lY#7krR$WN_MKuwh_Y3{v0$cHLw4xdI@^$S^Q;uVY~7
zUIXH2FferQWMJst4hm`$28Qk<ApakNhV>J0A6N1Ndm$$SQ_xIUSf6KL=spV#>n9=L
zu>OD)*0&iLx^Ke6`biBa#-D($T2^7N<Y!<CdJD1`6xPof7`j1sRD*;1GXq06sJL5P
z4-4xjbFc>xD126c4F%ms%E4YM1gdq`GB9-iXJF_CrASct^l&jS^ng~7Jz0YsJ{gdp
z0gVVeY(S9!74M+3s~%Fxfp_aYc)`HHAfUhqnw$te1+u1vfuTo~fuTnj#F@ar(4)Y>
z&?5(mH&A{00bDbJX7D)>HDeFx@KjBhdNT%w9urV${sqN$(Bu?oZ0!D$dIqLo@Fp&B
zYY5aBsslCu7?^^;fr=owXw3(PhY~0vpw7sB6;PqYz!U<ydY91$<j?!y+hIT|5p4=a
zA8<e8J_~pV2-Hbf0BVGTItd0_K<#n{rjU40RpVd-URQtb2vo3?kuj4+u%V#_Wb(Zy
zpwWcsikDc$>(^iU!0_Y@xG?)8%gDmYz!VA!u=V#D7<wET7<%kM9f8*j3_ZRK3_ac;
z&UXfeo=66Uo^V$NrVY#=7@mSQg1Im-g(k5xFl}IAVCYF>VCVsJ1Q-~4su&o0%8VJ9
zc3FO4cq##Ep*{uehhUIh!pp!ET5rJ2z_iPgfuW~|fuW}h#0h0!=$X#I&@+|67_xKV
zsS8*aq@%hFq$`3Mym5e`X9)vC&mvHv|CEP;*+B)wdU638B2T_R{2mJK2bD2!o|gj4
z|6yR-V95G`;b{y5vrTv%15@ZyP#{;UfcjvNtN5PgK(+3KigABncna>)f%u?dan=tE
zcWNM`o1u3>gH_-Gy*mp)0n5M?`fqygWmbv$4G?aaEXV@z{4aR02Xv(^Xb9j8sHX>!
z0#|N#I2ai3%w%8+a|a264n2YnhTf5Yq>eDq{zpa+P=dLm12ww>q!v6L3vP8nWnCB;
z@BXM~U<&I2Nki5i-wA>EDr^DB7o7h=N#RZkNDRsc*Go4NkmhiH?SReUuyCY6CUKY^
zSbku*F$GjMN%5()ure@(m#{N1J#b@S=-JG`(6d&Sf!VV61H+9K44_?BQc|j*IiheA
zW(H=<Squz47Z@0N&Ve|~7#Mo)F);MpVP{~r+{D1p^MQe(=N-szH)b#}`yF9m3J(Q^
ztbr2)(}NU7Fjc_l0&?|@B_IVLpA|Ep$%1-^5AS|pxN(L7RAfl0skDNeI8%;+>ESDh
z4-7Y6Ffhl<gA&4x9tK8%BOswE49slnKpN$l!3tOz7^I9;9<VYnMS;$5k_RQ@{|pR0
zf7uzB<YgHcKx>|QL0v(4Ed~bANx!|qAQ^K8hF%2*hF;LpdU+QHhTeK@28LcukW?T8
zL$5spLocYqDIdqc(3{M_(3=R7$!1{a&1Ycf&6Q(dlCO|vV7BP`z;F{h;Q%5TSooQa
z@-i?*L@+ZjTg+x)=&fO3=&fRqW?&L4`M~h>1E@fK3M#o6_?bWho)I_Y7?{KwK}2so
zhy?juY$=Gf5k%|-5hp>!RZs(0>=lUl5k&lvV_*{J01+Y}LIFhRfCvi^;Q}H8Ktv3P
z$N-J}$+t2vNI5VtMSKDIq>F)}w}*kDw+k#agMmTHz@LFB(oUIyNq#QmPNruk7?>5`
zF)&4f?#2Xn8#9<Vd_gh#><(y{bo%*gtfKYu7a16&5*U~wSAoLh5{S6($G`;Iy7g=Y
zsM?ZB;Ai><>VzrWXJF_B1q#TM3U8o0ww|qE;9y{o%7N_IikuGFgUkJa;aLJ`rxtk3
zjTux!xH2%wul~UB4Ae(tVPJ|p3G&8<dIpBx)eH>1%fU(U2Pii%Fhzpy*#b?pe5rxu
z2xh|-I-qoPQ-p!>**?|}3^z?ceqdmV0*zjS)c!gHGUDkJ(0)D!rYL!EY6c4}fb0T@
z0$t+-R(S!o3xM@QJ;T!-5KE&HU^6u@P%H%%UN@k2)k2kgtpH`>VsJU~^bJ)1BB<oA
zKQR5QT%1QB&VKp@<Sf<?49_?~3<jns@SZ3G2GHQvGZCoqSD_~S765tmnGeXTppc9J
z$;0G8ORN}}QW!ok+_V5q!ARAqJYi*EN_LWEVEonx7G-B(kUFBWgq49QPFR|O@%yw7
z3^x-%Y4;{*F`tP5D-$aNQ*=2y1LJq0?F<aPCm0xd_i=w<xY+^Pl0N;@4OX4{=^q%L
zD}eMoS72aZyd%K!my>}h_8dC{<F};@483m{7<ylU?qB$}=>x-yH_8l*-*$oehtdp;
zzgxjtnZYCj!wvzK+x!enF|EoBjK8Ntj%WS71f&)uuo2YIV`pIey^n#R_csGW?{{hN
z@MS&2b01JU0Yoye2rzpKGBCv`dowWGJ^cWdVqk%er$E#*JP!cXThBoqZWaM%KOqLD
zm>`&Pupm^q#0Q4w5uoe2xIZvFp8-9*4^)_ELb3?RVT_FF(`9b43Z$xhV0eCmfdfo3
zFcb)|Jm6+viq&9dVEpaOz|hCfz|hAF;+Qco^vN?Y^htue6ae*OEXZphfh<U`jq!Im
z14Ew;14Ew`>j#Dx0wB8?m}0r6PrSvdP!FAu%!1gT$uv;}G}&4T?z}So%KyOd!UNP>
zdjT4USR%mk1mut-%nXdb8W|Y+ycrn!T$LFZe}OIl0nxLecK=!dwfomr28O;&28O<L
zkliaF(}J-xK&ARbRYt~45s1ARpb19q4-7AkfLu4-<u<FD&WkS$j6W}fa?;Hh$SDW0
zpqW(gu?3*)^c#F*?sE|aCZ@;Jr`={%sZadCaB~W%l_PasWjQMYQxYhz%j7XI^p!9$
z^cAr)Fv(OiF!VJuF!a^hGBC+>Ffd4qGcd))fn<6a82aWhF!ap<Z6K3t{J`+$3#j^&
zR^w-$%FDnMw}+X5S*{PX3W<TCZ?zu-v)o0n8cqfVX&Y8Xan`DO24=Z?phYf0cji|y
zFw4DSWB$M_90R(?UG5tLL*EewhQ0&fe!N`T2Zon6VB>@MnR|H|nBr%Fj4x(j=)1|l
z(05fFQoX(ekFZIXurg|LGBCx<gKE@S3=Dm57#R9qfjG-x98mRIzlnjN?<WI8-*>PV
zE`sd<Ij@P8QGu0#DLxKl$2|syehvnPel`&26$3-R1Or3A7>M(YfuUcEfuUcG!4GOZ
zcoC2ER8~e+&^!mIX79IUVCV<+>MfTsF!XydF!XzXtlq@H&>vRMz|bE8@!y;e3@^bW
zzS7J2nJ4lxFeRCTY*@*_(4We{(4WlCz$~|ofuX;UfuTPi#5v5s(BH(s(BB}=z%0N1
z1H;P~pm>x%$I8gf%D|Lp#LU1fzlVXLe*yzTe-AqYv-}ALhW?EV4E>8ioGT0r6WAH*
z8T#LXcn=sDCNwcHOvnLo-Y_ssWME*J@D9ZJ!N4#vkbz;MH#-Bf0t*Af#CisXiMg^2
z%nI^gD?x{1e`PHaV_-^@VrF1gFkoPqc%Ok`;%$(68wQ4nUl|xCegttm7#Jq;FfdHw
z0C7SX7$zw(Fw{?y1Mw0V7$%u9FibK5adH?KCOI)MOmYBmDi|0h`7tm|@&Va68EhjP
z1A`0)YcMARQv&F6B!wjm43qL17$)U1xH2#+w0vNA1!_lYFfb*ugG^{;V3<_Jz%Z#o
z;se7g@T4iI#C|n}fw}OBMEwVbS8G5lhDruz1px*I88MI^K?a6N?F<Z)njujGN)~58
zLl!c|tc)C>z%2wt%{>N&NlO_RCM^bWUNJCC+RDH%X)}oPje%j(Q3i%dhe63gUf=`6
z>jj|tS;mo-kq>mIJ*crX=@J9Oq<T<`PhOLOVbV(mhDlFB0dC5`FzFuy!=yhTjw1sD
z=s=puAfL$lGB8XQVPKdn1d@qlV3;h=z%W@B#7Sjfn5@OXFj)h{DP&-nY|6ke*%-vB
zWnh@>#K17w&X$2$zLSALCV+t{NnVbDS-$T)BLj1`W&H<+H!fhm1%Pe@;r_tzMgp|L
z0Mr^NJ_s5|Vgya)yD~7z%>KaeasdMa0}BIFQWz-zFJNGp46-^AT;j|D?QCLTO3H;+
ze;>d-t(#jIn3VT1FeUX*mwmu0QGfFT1Cz{Q2Bsv?dI?5D&@>Qu+WY1os5t0aMMfit
zxCGcnka}YVrtgP7Fx+AQRUNlLlk+Jmt3Y)rs2TbFJOjhz8U}{Rpg6uI!N9Drk@W+^
zEl}4nfq^L*v|I*s=Q;NWhFkUUQ#%n|1CSi3t#zvc=5arJP^X6()L8^|wwAbjV7LVy
z>A3|O=`m4x4zhU)I|JjAKn8}%eGCkfdq5U0VPHCOmw_o6eD*!qd?v^td$;y5FfN$~
zD#2qxd$fx_Fx=)~U`n0`y780ify#E!+EmbPWfRZ>;uMCwq#_0t$l)H~_93GuxXa7H
zl>7t~EnEfQXaOxnV&UktQ2{N1_4ELBd!|o#$SPLf@LOdeBWSyQ_EnWGM#eY>hWPm^
z^&onUs7e~6Ap?VFrHU75S!hZFPf|)EgNmOV15*lUv2N{e74QM^pe5}aU#Y;4s^j~i
z60Od_l+r57z?4#`#lWEdQY8esYEp}VAvZ}S$qc;Il7Ww*o`HKQ9|Hq_iXj7o*nbs8
zkVUCqcrqDOK*t0#fX-4#+04ekpwF)YI_`w=C}>4!%29}j4kvi01<0D~5D`6u$V-Tb
zAuC+XZ-|HyTqKp3tsZQ&F+xZlqR0dxVh9m2MTmg*wCVG!m?1<$A!<PT03l9HO^1kB
zAk<VsL@W^^-E0i?AfH(wgyupNStCT&Lqu#4BA}xb_4!q75h9l%YU~gqPaz_pCFzVu
z89>`!^!ZiXAo8GuRR5UoKHCQdo#Y>&wR@nHl(rCjcP!t1aR%_A#gpeUFif5fzN?k*
zKIovd8w?DS4>B-J-VMGwmhZkU==eYehRIJE7$)BbUmeT$P=J9U;w3m4GU(bcFs1u3
zFr_tvu8vh<)Aa#0PNwTWVHK^<W?;yB$aezd0MH0I_+XcGKZyM&p!QE;Vqlp32V(yT
zsQpva7#OA~K<qyOwSS5i1H%*-i2bLK?AN&hu|M4al$F3447ST-`iTTqVK$v7U<ciK
z!YWa}_9@>i-VY4g5zyOgnKB-NZ?ol_rOd#T@sNRGN+tutlteYqZMJ-~j36O2WhMi|
zl!*`*&H|lFaD#zi%4r6MDF?x~+49W+ua{<E0G(Dbl@WZKE#F*_*iHt9srn2IQ?=C@
z7-XCI=5bnqmi03*Om$~qnCh5U&cHXHlYuGY8EBs(=*m^T1)yZj!N4%Jgn?md5$gvA
z?JFR+GcaXnO<((zRXJAs4+B%iHwLB*7m#PcE5JZ4KGqKmIy|7f&cKwB43`15iZhrv
z8bAfHjsjF8s0+k|qA>(&#p3C@&sb&U6QBzB!p#BM!2N+irv_xh^vq|h>h&4lz}vFG
zH`#8{;IrlZz#v+{z`&vdN?|#V)5;n6Y~>jkC-XCAr6reCF!0&xfx?$DQ?Z1B4|Ikd
z=+x4wZ43-kn-min_#9yVUc|sKb(Ufh1D^vAG^p+~FigFwn9RWE0NQTF!N4$0g@K`d
znv`M+1D^wEB{xVYoq=ImykaT?p95&=I7nm>1H-gAifIgd4$$ot)2=cwOgpWZ&cNp&
z4KaGU3<JY-5ycD!J_k9dNF)Qp^gzWBLk2!asEejgU|^Wurx;?yz~>0v-!Xj&Lp{Uv
zdEm=$`P{@9m~uXY)@uqJkY!-X`SF24^aQ9TV&vw_7GPk?0$tOT3p$iAg@Iv4k}LyL
z?g_9GCI$vZaXu>^2BxeKW(KC*n+yyyN*EYs6oEL885m}?Ffhz$0u66NHGuN8GM^Rb
z6#LwIkm?Bx3^V#*suwUY%$NrrtIrkrz#t0hq%$xY@n!2WFlDoV6sa;W%vj67Fk>~$
z3E=r$Mi)L)kQ1(flz<G~%fK*WH;4mr!dV7}8K>b+cmV3HG6wLON`a>DzzzoKxDHeO
zl7V5ybBGfRJ}`)buSaBz=W7sRV9MSOQsl_MFyku&!;H^RCy1+n+CPkWe4uSi*%2Tm
zHyIdavNABt1YKv9`<Q`YrYHl$OkvPy6DSnKRT$V97#OSg>J6kBn6f)zIuscgX3B#&
zARUGb3^Vm%juuy807YaQpMe%g9%Q^N1H(*f5C^2#mw{oXH^j{|z-|U5yGeWv@(fJb
zpjqtPl?)6sqZk-wf?c<nfnjDA1H;S=&`e71UIvDlRSXO>E5Oe4`M@9!ZmBcQ=WFC+
zV9HqmvLlv(VP+Qt!^{qtmrsDbyoFDjhk+@_6Ql&>rdbROGiQJ}AUCaIV3@fAY~~5D
znIJD8=F^sDV9Eh4yaxq*{mg9)3^PHe>wp947z4x1BXBRD0DJiopElgfml+slUW6GB
zvf?2FSak;2e2|y#@il@IRwV<&%nu9<Gv9$!H#0EIVqjpH`47bDWnh>kz`!tz4|G{X
zJp-c%DBVK~0euFhoX46B43SNI7Q&#c1kxbFTfx9*0Xj*H1GHPLZ!(`TT+RR_2Rinb
z5iI9o#-|6D^8v}}$%Bjm=?lEhrwNzK0Lf{}Gl()kG^SqSQ-Mp)m@f00Rf#YAH=jIQ
z?8J1R*R0C*rF>Fwp?4rNq(HklIC%3I_@qEb$xH%Om4VxN_pyCo(EP!`z?c9k$MO$=
zYbxG-(3)zN8Uw>DIdDC|yAN7Z&5B@Pm<6iQ7JcX42d$}Q&0t`dH33{x@g4xxRP|e!
zCw4H&GBD*I_`skQ0P3$YPvpJG%D|Mrh?#*Y|11N;tbGg&vvz?vHyIdaU1wmJ1&Xlz
zrwk0Ueljr3de6?ll>d=|VYVp)!)$#J=Pv`p><9*i*`T#Y1)K~FvuhX_W|t{5FcpY`
z$1j))<e4X~0NskNRZ<Tr;qzX@i*$}+2F?RgWeiHtK?>Fn3|b2qm<k*jnDSZSsz41@
zkPLKWK3@ec1Fc$YKvj#@6{to#xHMFwHsqcjCZ_z9>F?gK%E~K1Ro0=X<o>{*4Q_!?
z*Luq;$EF3Tul?S#O4e8NP6C}NUZBGZszrDwf&8b#0jiyOCxL5c4$vKLypzDSG8+Sf
znJDiRP|bUTC$BV@ffrOGGk`Xz$~N;(gNT<i@J{DsU@9==DakEh;GF>~9ymZ7XCuIu
zS>FJ;5S*;-8KM~K8O~MmTJnBi5bj}MV0;2f6eUJ!<qW)*@}P~p(8`V1QjdYDKnGm8
z@mhneVPKd&pMhcaRK-LFUhsa<8w?DyFEB97KBbt%z-t3q*#Z*zz`!v3g<>)TuMPB)
z_BrAV40HGuQy6${Ku1&8-(X;v<HW!)$4oJmf!79fA}L6uoPl9ZzG4~!uMMbE3lf>f
zz%XZ;Vmbq_4d_@vkjPO6hB<o`GZ=VnK<8S6L_RPu%y|N;+;~A}>4GZYxv~rlbEQF*
z8?P-d=ty=3hPfIH40F}MbsMjfSUm$%i4&-D6LyegU@CF{z#t5++!#D~lLZ)<3PEYK
zB!Yoqt_cIfTq9WqW;-Xa640TS;k;%%3`~WfQ5(A;28Oxz3=DH^nHiYv;usj_dNDA}
z^<V(4bcASN1#4qqVBs~B1gQaO2xDNVpBn<=fpjD?FwBhym((T69~guoXBQ>&CTlS;
z6$LXhFqM=rFwD(mV3?Z?bH)|W$Ol6auOSZuQ;{mj9FVCM3=DI@m&k(*ZDwGY+X%iL
z9^{NGpbCzmj@M8ErntVJfnjbhhzC+Vi-BS842TozKQM@Zm(enG@m2^iFcq_boG^ib
zVeT>phPg|iP7uiemG%rXd38We0G+D?4vCEn40G4R4Bf-PFn1T|Tpdu*iDZB(IEJOX
zIuZ;_MK_r18JNL3PB1XcJqFWpnSo*MMVO;SGC-w0!$w{mxDW3$FwDIRQ~Zj7VeSiv
zo1cN*3`%-?c`IZXn2KFMZvM)^F!vh+!`v?*&VL4md5jDUbN_>usd6$f)X(E#V3^0n
z0E+zC9~eZychoYR<gMgmU@HC&(y@ktVV*bx!#q)#m%(Ei3^#byc^H_AXMmg$#J~V*
zEX`8@apD*l=IJsp%+rQ@c>&nVPk7ZO7?_Grg4BRCSTZooGY9)0q{D@QVV)D*%L~9>
z{=lma^YXj^28MZlAgv(9(F_dpBEc10$#$@tL0<mDTPXo@?{Nl(dFc!c^HM>aiwq3&
ziWnH?6@WOm85ri(GBC`m232qj3{OBwzaCl==rb^t7-=#vY~RUi0y@$QbOcCAGH(R~
zuL&e~f#f#v>ci#gL2~+Vxhj8NEx6olken9iG}{}X3a-kFR~0U|9VDj;kz2~>%bS?R
zzze!Y;RXX!$+PKMpIGJjmohqMFz`aMIa8^~^ckO6mFu5!*D?AtFl>9o4cqrG3>u&T
zZ~iS^u2Igwod;TwyqtkyUJnDqyf$?PhB*n`pn8MhB?H5}bqoyiR>?9jRT_L?5Ox43
zS{v?S5eBBxsW#x@e2^$B0|SE%w;oR=Xb>O7hK|THfR+;qmw+bO!2=PX*&;p$24M*+
z28RBR+~D(`OE2)2GjJ!#Gcc7d=U`xvdB&Xtx+>@fXq&y;Z|)e-$qY9@CU7t?cr|gy
zKuS7)1_mV|?r^Z=2L@qKVW+`32eimh4Qxg@^jeO2^(Pn@<{g17?F6Y~f~scWj?@Pg
zGFQNS7BGpjoEmH<Y$k#Mv?u-OS?)kKMh2#`at_diAl!kVP183(GPcjT{lGGyQ&;jj
zx&0tAx(p1W^>4Vn*+7f<AbPwZGT96a=DytSY#$g(L8~LdhcJ}yR0A994pG7|?<oVr
zyoWXnOcf8o%9t1!xXidcSeY4^D&8?L%x7X?m<QUwU-659VZJ2;!+djg1}4x5!+aM8
zhWSpQ72XCP80t%(fYz;otzqG|7Gz*54}$u;^a*H{4O9lcq7}l2MIb2Pgg-EpaWF7}
zNd^WEZd=f{0?-oi`Th(H^L;@|48W2sU=kFHrl9q9prz_%^&B8e%0O!ykk+b0_%KTt
z7(k7z+0VIM*gh}_fevtU0L5j+2}pprKm%lc3<Jab2xx!^-2j*22HdXj0I6hPm=9VZ
z4Gxek3=H!@TQKUuA+n!=Vg6odhzQ*P1qj$0NPtu%LIXtT2FR^Y8F+v|_%OGEd@KBc
zL6`*;AfOX{Q3B)?1H=3iASIyO!UD3V9;^mw9kDPA$P%b1+!6>MW(flWgDwL@IWM;(
z8z}lANyiZq42BF0?2X)(pi#0)VbG1OkGU<uGHjqT1GpiL3?9%SncSe}MLh#JCy8rv
z8-p^-S5Qvo1<M+PbusiZGB7Nz=hgwq-e7cRV7Tyt8+=sj4F;ylDBj#+25vcVa0|el
zfuXLPTLP5XL2{s6FtvtT0+J!E7#QY=a|?r=1<D0$4s#2G%C7pIpfelhNOJQr)-o{o
z|I%SJ2W_vDyspEj09JgBlYv1{Mu$-WRG@-(lXq^@VT4?k#+AvS!>A8xHGO3;Wnhqh
ztiuRC6QYWTlYs%G418Q7=vbEnt92L!L06+pVqstq@6llt5o2KRo6QixP|uL?Lgy#Q
zb6-C&Yz1|{K^LqtRZjw+8m04766`gG`L`Ju=3iE0VBqM~`KbpwdXj-*0XGA~0%mmv
z2Klo(zr`7tswXipEU;u?SYQYeyQK36CYH*;upnLra&(L1Dh7sx7gC^;OLQ1nxEbmh
zl=&GL7SuB^EU1+N9VDv5$O`ch!-6gbh6Nqq+sSkwJL|tPFf5qPz_4JdC<9Z~70|&j
zGjx6{GcYD*fwl)!PyfIG+LX$`AXu%#2%6}v2K82}moP9a0O1A93{2G<7#J38V_;YS
z>H${oVPL3VaFBsv!G4g`2?mA*XBZe3oZ|k#uob)!3e?sH4~sz??H1r^@2v{pje$(n
zpv})r92TIK{MH=M8KMkK)zu(9@N-1J%RqVwjEw25B@7(@r9k82TRRw-rhv}n16{;Y
z&zQl)`5$}|xZi9;1_o6lop+#kufEE`z#xA~=bZ*9U^&3?`OXLw862P^zI5J!jsu>=
z3p(0M=N)KfbP}jWtaa2m0**^Y2BsQuh^`~xx|9u6bL*S{1?>$s28Q%Hol_hP3>;yg
zV@}R}*0~Pmfa;W_zdE3^W<Y1k)ynYZ7cl6AYB4Y-Ca^Iu_?75Hg5#78>;&-HF`zDj
zT&7Mu2LprdA2tStvqyCjK$d_;ygRq)fX?k>xWSW>o5-M(0ul#VZtkX&1}g9-u`w{z
zYh~)B!#I;4>11*;FxATNq!br0=zwmDU;t^T&D4RMn_bVqa3ox3zbFG!&3Q=lM{$Cq
zA2fVBEmfx()L;P_d%RSq1;%#s&}oIU{dL;FY><WvraB$<0-#V}V_?|mrUN=61=P3)
zoe0fvgMq152bAZGxk2Zc1Q+Uffa0ar4HBvzpiagO(0NbAC-fN&7#Wyqr*Rb|XENwB
zT1tS<R1#%isx1Z|;iL~bq=M0LJ!o9MwhdKCKnax(%Ez1&^clfNtk;50IM-E}?(>^f
zQrb<Qk&O#<gcS=YE$AaomuSkE-te1MqTWXTFKDrSoiYalLr{+XUr@O-i8rw*ok9OE
zC<#mgJ6!)S=uoAdATJ#<)&B(YQe7hWEGYd?pmS86AgVqglA8V}a8hGqU}!AX|02e~
z;C&Eu@>%r-eeh{gUq3Kx0mWZE=!RRS26=F~p??JwayJ+l7TjfESa20wZs=dphLjr%
zc^McMvZ^yM^t<a{6K7y*kY`|6XwAT|&=@4<qkjV?md?PiFcDgAfDQnvzMu{&H}oHI
zgARFOU|875z_74h9aL)QKLMRd3_2iYVGjet!Y)P7NkRHgK`HJl1H;1U3=9jWZf69g
z9{o2T7`FTnWnii|0;eGT>yQ*A%fQs2@_}IsC@(Pxrs>~hWniiY?Nn<pWMEjhgn?lp
zsQhTKWnfsije%hysQhT~WMEi$kbz+#sQ3tJ2xVYcc!q&tA!uD=Lm~si!s`qS3$Jp2
zVAz7#Fb<z-V&ZTB7baVDAcaZ&PH@2iUf#E*fq_ZegMq33(e%u}tP1rDAZ1Jaf3OnR
z8O7guKohT9wlFYhwt_6VfK;k5W`f2MKz(!XgN6(YA@lW*gJQZN4>axWqkmi#6zY&z
zKW+y~t&ms;O)N0n02eU&CqVbNfD4%E9RFB(>x1>TfJ+tzriKTgVnKh4I<#1j%hcbA
z$o~4^6ZJva->*b}A2=$(#fAO>P-N`n0hL(#2f=JMa7sP|V&4GeN8K6v`yr75D$6YT
z^~=CEGBPkVF0O~Tune5-!1kAcF7{2}O-@N-&@UGP&9p!qUJh#D?*x~O`sLun4mxz|
zsD3%<s`;JZnqMDsB^Vn6LnMnn=yWER>Ya=X43;$(Ec!J(3`~txObiSQAL`dCGBEf>
zGl&$Yr%o6C&nj9U0CMKhiTaDdeSQ#U;bQ%zkcI;IVD%tXWyTtigFk}{17*e*SYgn3
z0i4s78C&6}zBN8Z6@nZl2Uh_q3p)9g88bmq*JQ@Yz`&%dFn#5JR<+P=%8cM^ZNWDe
z#^@_UZ@FP)U~1Yd1S*A;86~Vi@yf}-kg!6TQ3AB671VezIjju1^#;V@w^U}70=HdQ
z7#OUVO;ur2t9Mambb!|R3{eaW!9B{Kc|R~L%K)8r3~F??)`O3oRQ?P)$Hj?(Vc`n~
zhJ_E*KryNO8B|c*U|?7z!N9OcK#74N?6dM$DFy~_DW-`W>I@8ela#;7Gcb7XVPII~
z!oaY|0h+f#ZGzyQAO;4$2lWh0Ef*9r8I&2hK|%bLfniZ31H+<FKL)1O`VS1t!Gjlk
zZ<QGZ1(_L`S|>0tEXrYESd<0g%wb?yRKdWos0_qe!N9Pnje%hiXcD1y3j@O<kn9Y0
z2By{n3=E4lF)%Dz2jZMzU|4jVfnm{M5a$L1L;a%L3=E4vn_63+Fff32LM(bB%fM_l
z`2)iW5m1Yo@0apDVFo79dBV(QOBfgyeP&=-^bxe{b^`;$VnzmrMgO@!FszV(?z&~-
zumCNS<^m;T)(;HJZ$NT;iwHO?gLC`xH=xNO2BsF!KKpu5n}89zN}mHPzrqAk8ni@$
z^nllBLr+8it=vs#DrN#TKvo1m3W=6ZkScfs<l7y10|carsm}*=E(Yrdh7~EGa)W`X
zWhF>G+*E$Z!5JVg)PTy9>7h()itfs<KQJsi09q2a40Jw+fbw5f2BubBW(H>E9}EnO
z`4|`$gSHB(urM$zmSkX9EY8fptRld`uvnFWVKL~~v}I>New@CSi4A-bgQ)=nQ>zEK
z%M0F=3~fX$+XGU?z|;ylj)@8R*c%oOP{V0?1p`xCF=+i^C1@uO=o%AHLE*et`79`W
zL5JbD{sWh4%4bzTsUKWsD4zu%0|qV}l+RjB4`yZ)krY=xFU`Qz`i~7%p(tMfS14?t
zie!2NGn-gF=y2D&cNrL*_kzpN1a}4oksRfPU|T?L02M&W3)MgcAP=YjQeKKE0F{@4
z3N%mwXlJ3k5@w6uB<0oMw9m%CuxYh2=p1E+ojjQg%4@-@K}Ct~4CPgj;;$Z5!A3<X
zSAd!-Uq3MTgQlQQfU;lvJ~goZ3eX_>P6md>CJYRV4b;H7yaMb`28P8U3=E4w1M7N|
zlq=04`E7AE1H<A{bp{4)6J^lx$)IM=;zbM$i|6cTWMHsrR;~d%gHfG<A>@*BeJ!X)
zpTxkh_&5W@;=_umc_|Fapu5b#+U_ziEC#I^UV4Lp5mYTlMS*&b!XFp{IzUMzpaXRF
zrt%~~2Bvn<JQJuVy!br>!{WElj$c3r12b4LN>4bT1C)%xnpx@*M^!)s;2l5K4-5f1
z49s>c3{35d!RuT>*{k>nBd9J6$N|Z4e_#ke45_?I0FO=7M(O<n6{8(|;Br}ykquTZ
zx4#A#!g`GC@N&7m{vWCsq+o_C0X3d{-Sl3A4fF!Vyn-I+%wEAGJfN~y?=9GDaP6k|
z4iv68crqFEK!+qVd<E$ZZ`OMV*4qJ2ta=X-4KKZipoUjHqz=}52r5uP&Dq9cy~kn<
z3?A*Egwa}~2WjMgU|5;}n(P53j4nHH!%Oc7wBZHXalQBlxZ$OD1lsUgqQk(jL<7{w
za@RX1&cM`V$H1_}i-BQ@8%WGY?*vQ?w8wHu3bb?vMR98lxaFk>$tVmAOIjEhmNbD|
zUV2wRKK#nSu%w@XVM#Bz;iU(;8iavi$t(tjB{LumFTL9z7?vf7GB9;Uf*W3X$03Pb
zmVv3u`2)jJkc%1kPUxLwWvFNBJj2Yu)D^(Muw*#{!;-}yP7DLXlAR0;OF$E%T^S4v
zOO7xwEI9;{DPdq(a*=^y$ypGmfq`MkGX{nwkGMZDEL{UCP(TG7axV_j@LJjeDT+J6
zn`t0L?b0uhLbSe%3#18Aik^X%qM-5<atix09!RO&CCA7JE`udLFf5Y+m8skx7?xRp
z%1)3GV0&S0F^_gb1_s4+y=|b#@9G7&#q_qRf+7Nv5Vk?vV*Cu9+w``9&WVO3gy}LI
zY!da)^<W*dZeLIVq!$Wnf%%o_fjVYgcHowl9;9OiZfWVofMN&INz;o3B~?f#O)m~4
z4l1NNx9KH<*x)pp1Y&_ib64mkfeRlt(49<rpgUjv877G`Fm<ayA`hwGb-YZk5~LQC
zP_w`3Re{-{0xhpouM^gmFl1op&eH?0lIjNC4BNSFIuj?Ga(%L%7pPtK6*Np(ucdnx
z6g1t}!TCt{E;t{7EZqjSRQDb{i*}zt5dqnzI|C*U%3~7Fx`#k!^?=5JbQN?DiGt3Z
zgP3~+Y%Vx|*6SVxc^Tw+UC2#0Ak8`|y4%5;1Htj4yB(21b+>~uC?r~Rw<GeWE@;oA
zhXp8qHcr%?1+FPRFf0M(PX<u_?BfULPu*G2{JE5!fnmviwR+Hqita3E23=~-z_3&w
zlo{Q1=ZG^f_3<+>EKOx#SQ-lw^U<9L6Pw7uu(TT~e>P48=TF@g;EIfaVd-iHhNUaP
z`BQfl$b(-Q7?y5hU|6~ZoIiC}!^G+jGB7ON56Pgq8$U2CjSyvE>Q#aS?p$~V?GyRH
zumrSLk%4c6?qXI3rrxQ{3`~8B3=B)pF)%Cz^?3Sp85ov6U|?8!4<uvBz_9c+1H;mn
zAdV{o!_sdI3`;>1C4GSm49gf97?y&XNlTW17vjM)3UrtSl0lb1GiWckg#yW-OCCUS
zUGJsok=$$w^$d{w+WQ`41R}fc0o4XeMWDHHsR8!fXko~}u%}PA2NctNap2sj+oK8!
zbx5rDKyxEQ=QiCQL}t|O1w|pGXY_-cjaS1%*8&{f3{3r@pnR!ofykG-HsB}&=gaB3
zJZ$3inYs>$Y^V!bEW-fGaGl$9T|kin87t9s1+zgnI=<9(=U`yqcL8TaU2ky3%*Mcw
z@<P`KCa#sK>kAW~{7BcI6XX)`5Q=UN*c|Y%iEg_n15<y!9wcsUA#n@JILAwMLHGYL
zfby^96J2nl1I+%U3(41zX`LGkO#P`KuN#YkF4bM4GA$nF?M9Hdr^SQYL!gYj<KHw<
zP^k9*0H5(YO&WY|EgJ)ay<Gh?IYH1tw``!RnWuqneE^T}Z0Me*2y*II9?+dD(=@;b
zWQKx=3>iL81E2dl4Sc^iD6AaAr<sa^#uC5>vrn^vBzijrhHyD876C>ErU{~;8e5-V
zi$zupytWZ^%|YK>EvDU!^`M~xkdi1)1_l>*EvDVz6Qemn&e3Ap4O%q{8Zhma)neMM
z4;pUa%4E=D0^MW7@D*grGBquxHDG^(44J~ozyMOZMhc`9bQ!I+7Sno=M?e>toz>G~
z+5nCikj_)9wV1paqd_-0FfuSr3=+yOV9;Xn)&MmkSr{1PGPRgMNA;@rv4BR=w3vcH
z#(=JC*y5?h6fObM!ot9?I#-J+QksE5Wep1hgYgqBrYHf>x*ibc&GgxPY-;u4T1=hb
zoAk7pz_V1K1)>w3zzrHLrf?O=a2Z!>Q4xa{6C~alK#g3Lavuf;yL(zp;E`@nTYBOo
zh!b^`piTri#1QNdQ1I%`&|)%#7zauZ+oo#01cgieR|ckupE(#9ws>m2Q~|k~H#s+j
zLF=VENSqDqgV$gWuz@}B2JC(i`;FFHFdH1(TA#q)k7i&v60XI_3UZ-4n>7PN!hNmP
zAZxxdFipyY*aBLYH8BWc%W8*ugf(kn)|^w<S_h5?kTp-V)`P79XDF>rU~AYI7({1j
zZH1}XR;{%i%m&@v+A~|r2WDd%=sJfdT0Wq)IaOfEMOr2>$;BKD48eSkS|(DU7y-$0
zq-!ZdWhZlUFfgQKXeonlBIICTDF3FV4C;GN0_)OJ)&yw+sWF*eF97X=d<tP;;7AAM
zQFAvfb#T23zMg6KJ42@Hj0{YZ)mRu9A{QAl-G#W;oPoi^%8=;<NXiSEdp?D5r4<!3
z7&4uQs4-(;ShmU#nuZyeCTD;m*^p_CDkzdc5t$HbxQUU0hXFJKJb5<wRORUkf^5?D
z&fu2x>2-#aL3w-fTTuq4$-BUdXbq=>me_$89#1|4zMj@_KE$;kHTNJQOCcg4-{|uj
zt_3YOJjwvFaK$S_(A2B2FsPX3U|=u^GRy-FseI*NVA#-Ym<PT)3bYQ`G2E~eobMqu
zANWY;6|Wd#7#L2!;bK$-hx7-A1s@m~m<vF4?o3|rtz%q_ib|l;f`MU~5Cg+9E{kFY
zE=EODP$|T~u*`{pVVM>9dMPeOMd-a5%gPuSmSt&!M!C5d6<rw^7$z|=ur1rkz_4uV
zbbBE-IcIqW23-X%Mono32JH__6FI=M6kLp2;MByxu<S7d!?Mfr3=B)-xEOW07?@`A
zGEZz|lxJXAQ^CcktI5DLQ+E0SAvTrz<)8!G<)j!G*4J<`g2s42W0=d67#Nnv$TKix
zwQw=|DKao<-DIBF#V7^3CxnZ!5>nnVET6}~uzZfo2ZlwU$y^r(rm2^qD(s=xKrCO$
zz_5Hd>j#EK4v>m+D(LJ?CPYQqQx9s`mNPJduF7a+1Yea=!2r5`m8lZEOLtKK=<+vE
z?Fwqig7-)<xO`w(3<{_#3{2DN<rx@+nz<M=)EO9b{xeO~0ZD?6!Kz_knkFp8z`!$~
zi!mD%n>QF3mhWI-SiXtDnSp6;CD;tmH6mc60=O76`I#A*=5{eKEWgaaupHEspF5R-
zVfhCJhUM>+8JOlSWS;nuf%OB!V(?%p1Jkq|kgIAz1FGPm0_bMv#T^VxKR|mSm?whQ
z+lVtT%?tRzurLNZcr%fUQH!5}Y1#{B2Bvw53=GTb|1&Tw{|VydFfgo8VqjPyrOd!I
zuYzf!4(kVoh0t?&r-4t_1aGVcH&GbDNA4}0gJP951Jm5i9~c&G0L^?Z+5oycfQ!+e
zn}KP17|3Tw7#LQ#Gcc@h1aZzYFsw*pU|5k<5Axb=h;56Y!ynVZE0n>uA^U966BO&j
z8JLvXJ}@jX0IiARTf)Uy&C0+u{TVX@lhR}ch85Ke3@a)@oCORFE7}+sR)Ee{QCiEu
zumU98FU<hH)^16?0jMv&1k?oQ;Ae^e83Ag{fv&Y%v5tXZ1?UtA<qZrBD|Rw4tk@13
zgjwPP+JFM;dV@BVK=zq~M`A$X6$0vSF)+;lErbI_0C?L8=<o{gUh;)o7{J?dXQ(nV
zW`XhpBV&Cg(?kJ~0!vWbE<C`%tQf_>G{Xw204#U`stY{+1se0p1fNHm!RQE<z5&&f
z3rY`=9q0>RK(&B(rGo~GGMOf7fUGeEYxw}xvVbv+F$<K^L0M!81Ji6N2BsNX!FHbj
zkIpYP03G+wz%=6qSg?^1bkrI12gZ-kV^Fz2Ff7plWi621h-|fD`eZRSRZmdkgTa^s
zG@S&xV05M~xb-9eY798`axsd4W{N=-?aW3_28O-9T#O=GpmGW{&>O?WC}Ihk?E?+q
zewofF&Zb^Jf$JVv#|MV_7Z?~A!Pi{Rx}yfxdQStSlYwEyIR=Im$3WvjU%2i$Ffiz@
zWMEkFkAY#uH*mwB>jAWYTB*jsuu?&tfq^N8>oG{|1_Q%NF9wE{F6s;nQV+PEz{FA+
z7*;0pWHN9)nZ8_{O|gDu2?N8*Jaq<!g^Rh~DKIe2y2HS*as~s#%4v{7nQ@;e1B35`
zg^c;7B@A4Qd@dgt7VKeQV9;S;nzfw^H2BZO$O&E!K9P}uY1TuiG!GXer!WK4tfig|
zOtV0n;b;A0U|6|~fnnt$b_OO;EwpkE1H;N4Q4CucKQJtK0KV9VF%xwB1t>-rgn+Kg
zV_=#EIUN&RbS;<w%`c#%W<l)-H!n>F2A$1ZmwCX0CJaooML8H4(tWuuYl7I*7fP@x
z)HicYfYu{3RTvl;r-15_IsY~C3mCX2D1xg<hLukl7*^f|jb|U@0xg0BmDsC<85maa
zsxvU0<>i_Q3cIfi46Do-7*^?l2hX@>fy8bwFszDUU|1Ca8tP_bV4Cw55-FewF|Z-U
z4D}4F@|74EmOF4QQ)OV#&V?LbH&5&XXmK$U0|TEP*K&Rara9uEB1@ftVO1*w!z$3R
zTJww;7*<VSU|7`$D!=TQCQ7k>V3_#>k{{==fzoFcxU2+aAZS@RO9mD~#SGwuZgbz(
ze_)siKFXZWgKMEM1JfMPqWZc27#LQ~W?)z~6J$0gWb?|*BT%zJ$NVxuN-HF@XTnM=
zaM=JIAe^}dR5s3B0~#RYn#0S$H0L(-gt=AA7#LP9(PO9wFQl5e2DCH;tPW{q$jmjM
zl_5}3_{tCnA3i|H{efZD8qjhmM#d~=u2KVVQkb~}E+X8)z~Ilouu+Dq0~*glprRVQ
zIBKqXT0JPDI}|_>&6ow64$o8L$^|O~Ra&5K4p%NX8E}AF>|D9ppiu?Tt_dTqT<}G5
z0^qxJxQgW%7_{WLKQQ=C0IeVf1wZ)AEKLT6Ev8&yU=tY`nC7kn8yN=fFoL>;^$J{J
zULbLZF%i-X3_8<5iC5=8=*|=?E_b-r7htXK;C35Gs{)t18w1na7Z9DEAO}nb>D0QZ
z$-r>%C>NxY%E-VpPYkRR(o2P?wvuCD&}L-NWKd%`W6A}(#DoD<FwOG@tJHw`SXY5d
z!-;`up7->J(rjY&*SI8Lu9?>gRw)5mjFA9wjf5Qo)4W!Q`BD(``9Q5DcLs)qfw4Eh
zIvJSe%WyC-6wQsjp$xkBkBxz$qCEDV8UusLW1iFkhS=w-42*{z*ccc*{bOH<F)$cC
z1~=PdUy3m>)Pp(lk+H8}5|;a7U&Gj|-o?J*1kDP9yAZLA(ku)NjU};+g5nGet|eTc
z`QcbbVNkaG3X12=J+ZLv?EGesUt;6I-5xduh7G%7QzRIe<~Q?{W-`R4^Dr>DW`I^Y
z)E|uncdx&KJ1nu_3AwM}u6FE-dIpB+%CU<<ja}Utu_>Tn$pUw?Tua;;7}lx8Y=HWI
zffU&PF&hy6kJ$$HKN|zXA-$M`F#pU~h&iYR4FIi!F^5zcq#+@*DJtd&IF!Iv$J_+n
z5mGn3UzSZg`c=$1P<P|20N8~w7obyW?hFiDb7P!fE|?7RZj2MmyWJ@<o)Qd93nud<
zCzUhA_zE#FIDtmn&K`~N2L~4$1H;MI>5Ou0;`QM%<vhv7<qR<yLJSPfh7j+@ctU%H
zd<+auZJ^>*E0Ue@Afp)rgIpOqBWRf{sBf|0949DR*%?8rU>QJ{!^Rb{GtN^1#TmnK
zMh1qn=h+#jg1XC+3=EF!?2Ju}3``3_S2uI$vop4V!iD`YxFf1CeV!bfw3skEV+lw}
z04Jz%&dyk($iTEPVETDEHmUj~cE(Cb|A&u(!Ev__14H*qcE(t65HK?^Eo_3iB^I=5
z0_K)jC9qpgGcquA-ehM4-S765S(1T4CzGAg5oFVG76t~8V_ZRwfx3mA(TfMP76zQc
z*crXSVeZDjAj!bc*TK#R>N+hlfx3`UmVs%J30Hnj3IjVMn>Yi5QvwSE!>+mPj9lQ5
z=E`JXXXFMmMH!eDsZ3ud&!$(e%D@o%f&B#|1Jj}m4hDup-0UwvYv4g0N%tx2FF<QO
zC-G!5u)hLpWKd;bP(I3j7o>bCZ+2=W1N&W2e*vl-G{(vRVjtpWzYAU=#>T)f;}|>m
zKJT3%&9Tkw2SJ*zaeyTb)`OB1Xu{up3j0COTsu_vL2Yn9$(?~A&xsv&;q+o|aPnpc
z9b{^%56<4~y|Co1nZ-UCoN__4c!w^sXMm%F5p)zBL|29?s8HZwV9?BB&ol;=1UyBl
zVI>Ug;Q9NnAZ_Lb>~?T%pe1)jbJ^{{c?qJ;-Vmy-gn=EBd_lUJ9<r;!b*%xdebS$9
zpva~y#LO-U7k>m1PgP`7sn?5U0`*Zr>2^tnPys_UQ=TFyGlC;Bnkf%_=_WWeL^BnO
zGcYab;3`RBh-NAgV_<M}Wno}wv5#gd1w{yG;+^|iG!taP4SZpGG*c}|1~k@VBo@t7
z2Oj)lVPG(djAm*A8z3plz_g?SJcbj^R4m89cyJ#B=z5i<TGJJk*o66JM>9bN8W<Uv
zmad%cq{OCapb*WZ0vhN(!pXppo*vDl0$R`kvV%iEnn?rfMivGJ4fALwT@J9W*-C7(
zme-=0j6jY7jb9x!j%G3jaX@ZPJsQnq2jk@ML^Iie;{FC?l!4K|Yx+keHW{@_s2epP
zZWLu;S~`=3fni%lG!y8OC-8Ogh9T39mDv>QcO^40Fc>rL1GR^@zKLc$#0UyeMh2#3
zprW*BZZzW|bx{0sGB5=7Ml&9A07-L#5<@iOVN+1Fg0849k7fj|WMcrWY;-;w&3IM<
zWB>~TgVn!i#*5&L35gfR+h9LK9c*x<o`r#-;Ab@BOHl>}hfksmOv@mb@I^D8m1kf)
zc$fiHws7c2GhUGf#V3fTJ0qI$iV`^V!G*cQ%vuHpo1M{&VW2An=Tt{CdVrjN7Cgro
z&FBLPekYL0t02Jwy7URU5Nz3Ako_P7eIb(?F!P~Y(EYB0ys}K{;N-}_w0yQu0fQ`)
zIwIA{GN~g{oh*~CI7ks!NlGz;ER!C{PfaWg42GX%ne<^C8$MYk0~jZ-zEhUT5EP+b
z!HG~767Qe{ViYOMWDHZseNC3h3apHUfnobfSte^(^5j#OWwHTtL>ZWtcZ0ns%cKj5
zc}VJ%WwKR<?PF(fP>%uKd?(9z7wo6{4-6S93=B+5Kuzq`TowfkvW$1Z-eX``wVi=s
z)q0DR%p#B=s8|BEr=K%0th#Rj8cmdCylct8koSs#VYMg&!)ktQP>C<gcuxY<9AjWu
zZNtE@8Z?-ao-WIH51j6$Kqa*-;}dWwF)*x7WvFLZ9V-vY0J4nFIT)B$bAg6&z`@7(
z0_=GPhShT!7*<bJC`n<EWqjerz~Iotz_9uf1H<YQQVa~-*JK$%EewX83=E*b*wufe
z7#I#3%QC(Nh1LxQhBZ123~Mx`7#QrBWf|XsDi)BSD+9wCM=1t|)cT{cjNmz8kZ1w}
z!<q;w28J9SS;imWjK#pPrh|cDO#`%B<=+JgJ8-2U%OnS~0W_|=0y0r8%lHHm>Ol+)
z9F+`AD@&z7c}|w`Ke+Z`U|4gKfnm*IDFz0^5LqS$h+sX#nokT2Yd)}kV94qKoe;;s
zw9=iCF^gs50VX!k1WMKnkSIuc1&G1Gv=V&sFysh^tSulhP`kFY9(1Y)(@yIT44E;Y
z!3d5ivP^RP3`{GRGcz#l^k!gK^Ou2P&2JDVoPl922Lr=eHU@EqdZyLV9~d$Vz*-hS
zw5$SctXZwgz_3<~fnhD^;KtRK3=C`a85q{;vNJHPc4J^z>%_pY)<T?tsdNokHz;$j
zm1R84%D}Wr0krvMCj-OUCI*JJ4Is{828Oj07#P;}Nqk_)oC4|vfP9vDgn`+iUIiou
zIt3kcv~m^)15+vJP(<d5JD9+I|BMbu2WJ)7*WeBgc<_gri%|j8=ggP`3IPVDRp68H
zAOjB>YoKD_fd|M;amEg)*aA>!Rj`BfX0k9avpJM8Fs(W^JwSs^wq5|L27K*I3HT7K
zObyUcgCIAWfFxNzFl0u64$)&^S`F^Vl`w$3lBEMWW)L*Qz%Yq{X|*(@Ox0shVPJ^U
zlVt?0?f^ICS0@Ukf|BumNd~6Xpb6g;6IsUnpj9Maxl;3{ztLdh1+98vbS?vF1oazi
z(tH>ggs;mof?9A!j~N-5)_|sKiss5PPC%5)vWycD<+3c}L`1nP%Qyqv;$mT7a6T)`
zI9mc_0JvP1Wt@*Fmt`4Ofb*mbLp=j%MG5FWPT}j2qKk1W_|{KR2BtNjBUN-~$TH4G
zE}LZ;7fFLkJxJLp%eV-sY_|WU!oYCoi!5URtXf$s#R=+a$T9|KL8}$bELp}t3usN^
zTz^)UF&O4b>HD&bq2O!=y0h(?EF);Xh~X<&ZZU%_V+>3puTvIum@)&nUgOZ0WsC#+
z1yTw##)FFyP`Rie%a{NzDHk$=CSGJ2JGj8HktGU>4X#WES;jn0(1F3A;x}NvEMvJi
z1Jhb5kjKA+^v{rG42F1Il!0k27YhT!sTs12Rp7V;*Hc_6vW)eRd<~Af_puBNrzB+=
zoftnbxPUIx+W;zM*Qsekia{qOP_QvDtewxmuy&?4Bv|U5Y(U|{z_9ih1H;-w+Mt?N
zmeJV=6g~_LYo9SNtbHT}iA*nWFflN!V_{%e#{_Z{=n`5`{CGi}DbB#Ob0*koCI$vJ
zHd*ii-s?bz`R-iCz_5;=fngnJm(0#h3=HdJ85q`qwoupa+{eJM4%E$6w}Bky>#_w@
zIIw9bYy_<+107bq&Xj>+oiX%qS(h!K{Z?!mh{I*qIWjP;vu6P33|9tFwgIisc6}=g
zUZK6N3|ukGGMa$u2~fqnE*KiRrmPH%^^hgn>(Y?K9M^+`7vwXL636unpjDZ!i)A4@
zE!OP>ueOwB6a-bpph>ocnX-(+;tUK9poQI_bT0u8DrhMVy13SLF=&Z_`WD%@puWI*
z(8aa73bJp-7%UkCkFbHm_dQq-8v{eYeA!Rnl)wg#@z3Do0yPU%BdBkQW?+b&FnzTS
zn`AvKZE>=I_DRVyGJ{ho$TAZj*{5L3K(pM=XJwztf$}071H<Oovd=-Pz}x9eugZe%
zvIZ9y>o0MDU9wpoq>=;dlFjCzG|9%m;1(vk6|4(l0{Bwv8$9)(RbsN>Rlcx0H=ngL
zFqmHDNy}uAy#&?(>L8lC$sPu!)Ef*SrwQ4}P60V>188ru^I6#`Dj*Bl7#Q*w$$|&h
zZh&WmW#@rQ0+4>ANZAG8gwF;}%Zni;02_lZgYFF3#YzlJ8$g#-^D!{ktcYS@*pV*V
z!1#e7{RL>-9VicMWL9HfSePl>pa_a228MNk3=HeMAz|GN3+s+G)A{w-5SP5~NH>O5
zIO#t?<K^j~^>`w(?W_z;8?J(?nVk#_>xvl|))j&{hZz{wH83!&tK<H_kO4kH7d#dP
z+T6$bfg$}1=-gNarVXDM8MC+-GcSc)s;evk8eGp1fYw6bF-y&Q28IY7*<^5YiIIV6
zqa`F#l2t)r#8Z@!$RL{u4p*Lx(j*4i0#ODA<2cX~l!N}VkY3RThICM9>;d_FQ<er;
znVlj7gYg3fhINw|7}oWuF)$d<lC{$U4K_0{tONOEvpP8L9VF^O_AoH4yTib+?v`S4
zNil;g=(rrvD!_Fw85q_*%>&1|voL7SBGW_;q?CEkKZt>WBbR|`BWR>lcZRG3q+noJ
z_nU!X-A~Yg-=GRSy#O4Zpb|<z7Iet}CM8f1?qpy99qLoR9&`Xl>0t(j^}-Ac>jk+#
zFr-(2DsfOv$^p6LC>?r+?j|$P!cfTlDCyt}RX~9~2Na$ROq+s1Iwpcwk*058VA_-g
z;)ABNAPeQA7#Oy^lr>}gz+em7UI!ix-1I@C9vog~pdfm{z_4D4fnmKIh%-yp40NCL
z4F-nwjtmUzts&uM0nW7y4C|8_7}h7cK+R%cVA^y~odJ|MEucXFx@2d4E`!$x2HQWN
z8XdHRk&B6u0Tgo%F|xYg`2N6P_61ZUfX{{5+y;p{T_s4=t*>QZSYHWoiY}<%4RXpH
z28Q+1AWqSTIb|OM!}>jtm;*1L0I560z_9*=3&?!Xb}t5|&7j47x-(?;Va~hCz_9)@
zsBuwm&I3-YW(*9e%cGd&!46|!+9EGhz!1eG4{of3d%#gl@}L6n2&gfpAH}394pIc_
z0Y@>Zi83(QzXUHxh+<L)r&e%xIEo2$S``DRYiT4F#iS3e9>Ja7C?*rI9#IAhrY-#7
z!Z?aa71F?kbSt8m3=rK4``JDW3~F9cjK{#vV`O03S~>luA)98sLKNe1P)QHz0Y@<&
z2loUZZe%<Sb|biQk75K3MS<(^w(clK$T~0<28IydD8>sQ7lUf$gT_&e;6e<<(J+r<
zyvhNx30&1jF<t|^n1z91$%QCJ&;k;MuUy`s%n`+S8)U)_@F-*ylej1Y(^gi9pBPU=
z`~(tG0S6Z2BS~mr?K>aE_!v@3f}~@opD|*S<qL^o`~ngLIbq-V>EDgmbnCkyEj~U_
zFS;ixiZLD5+}S1zZtg@erXyNwQH<$`)>;%}2BNhV#h8z1twk{wNiZ;NlLfcdq8Q5%
zt+gn|I&iq5^r9OUMltq+0$?JfAr{401WihO3=H=Eb_@*slcN|x3v;#=ae-FIMlp(j
z;ssO#Z}W!+hA5;PEXu&NEeTZ!W++qz=tf@oIt9khpg#Ay?3)UVHyIh2ww)3JWmW~o
zn+l*T!ot9ixK9BZ_FS0^3XG7MFGvZ+@Oc^o!@8RwgNx=WFg}unw0le$7+Mx7FfIbs
zN88=N30r}2krb#;$pUI3P46{flhmH2zzAO94T{nNeFerd;7*wW;|@?fe~o5fI1r=2
zcoAF&PrqowCZVFjz>xV>fiVb{Jhy|kbb{;+0=Gk17#Iw8Pv<pdldQj{0BKr+246I@
z6c|%f7#Pf|Sr{0OcPlXFDl;&cM6)n3R1_;P7K1GVwF4I@FqXjbPDQx_V<~ua4V>IS
zGlVJ(3=@477*%1G?*J`P09mdI9$N!9&J`Fngc%r&DnRK{Gi&-PQ#NIBQ2)VKfsq@o
z543xaLx1`cQ#N&>28FkbAjdE=Fzwh686}f7W7DtiR`?BeBqWp>K~4GN4WRM1>}-XH
zaFammIym$d9x8*zb2vc0S9s{oz_bH2j$X*1@K}a{!894viZ$Kt&cLwhsls_ia1)ei
zr!{z3P~kjmeDC5fh4Y|-_$x1Hq(EW%X)`vi`YeTukU>Rv1_sg33ZPLX(6HUk6tF`T
z4k<vbHA+-C1giDG!~Z*%Du5P2f)&n$*s@&(lq$fZhzdKvjbJtghMj8_Ap4s@%iK8B
z6jp-L%FfdeqgR5Au73>CzS0VzeHC~R5<JZytuO<eK^d5K@que|g&81S6&wr<&E*O+
zG(lsiYzzz~6BTBOgVcapJRJH8bEH77W&nkX(PJwHhQ+fLdO=q20yPOZ^c8x+feC6o
z)}K|F2#!sVbqBf?+Q8w?z_cp~VjbxIG$W989Qq1vW?)kd7#M6mE7Zdjg4Qu@dZbVf
za@S)>$kv0l7J%YSS3#lP0+b;@GpFea^-iGidC-KK>I;Q3umSZS7_vYsFTe*V>@Ekb
zK-X6&(*|3_u>LUv!}|LgMX7}h3T6HbjECwN7&b65Fs%OrJ}*e2TnS`01H%S228Im^
zHVjOA#6B=&fv!?z;Ml29$-~URv`3wRVS@()!v@e$!5(7<h7HLK3>y+bGWHA%8*1bk
z7&d@*0PXQ+VA!yLfnmcePX?wv;oKh>vRN3ImM@t8!GcY%-dG_Q6nwkqLLv*4w@mdR
zv6yQEcB?xB!;T1rRA^-FJ_b>kij*kQz=;C1g6UMGLIikfo`GpMDEc=&QixCmn_|Gg
zko{HxGHD0$4F?0mrbi0yM&Pgo&yy**>x29(P{zQ(t*a0$zyQiG%Wf(dfkTrKbPEJn
z)AaL}Y|8Zt3dZ6f<&fY9odd=271V6#j8{+qJM{xY(hLR$7Vy0F!A><$v84by4$xGe
zfnmcr28Iow4I~`;3JUgM_c3g=Vqn;)qz3BiDJYtN^BKd&n+yyakJ~UXtxo&EkZc0#
zgR#F>&=6n-joDN%Fl@48VAy2B%)qp|m4RVX4+F!d3J_-!1H)zk28PWnpplyS3=Es2
z85lMPf;ej!7&iAaFl_Dxadt8=Y@W-&uz4nkbBuvu^JWHy&Fev&2Mi3GPctxVJ}k|^
zv`ZLlH4B(zU=WdIoXX0;RKFLr(`%Ok1H<Om3=ErJvNJI4(qUlO{EdNO^A`qj2BtMC
z9~hFsX9lzXmt~wKz`%4Mo0)-WjTr;O7Ip@P&7k91);KdTY;j>=*kZ-bz_ccSfniG%
z1H+a&5GR&_Var?whAmS;oGb>0EoT@Qwt#NFSyRryu;o2NJ;RpQAgN{s2GG#NRwfW<
z0t0y4`BnoEXD$Q7R!;_ot?nSsDh7tFp$rULgF8T@C)+<Tq%HsnA7EhEn#{nkH6Fw{
z!@vN#3v_E4h;yBRVe38yhON8A8JKpafV~3h<p|3%hKevS?VATWJ#A+R1H;y<3=CUA
zM+og~U|`t#nt@^KbI^S{Jq!%nSQ!|${skS_u;v3patQ+igk*3~*rNhE=4CGf!!}a}
zhHZw*49s@NL33K-pmPj9FeHBgt&rkSlx2(+WMJBN7&I}T#lWyFn1NwiAn1}!&^1!^
z$yY#Ie3C)i@Hk`{qeK~)_6smGfbWso7SF)2Ef#vgQt}m0yB?wr(LLXm&A_lNlL2&a
z|C;X%3>?M`O#3}R{{F+ju&tbdVOuHd2ZmH0aKD{tKlo6rVsKwR)dw^d#^72H8vXdd
zkP7O5wJ<R4PiJRfTFcGAu&srGVH^0g#uOd~X7gDLO#2}l@pV9>Z7HCed_iIpLBpH%
z3?|@{bW=>ADp!CG*sW!#XOIIc&Vda3?LUF&B7p9H%3$KqVc=!`z>w0wz_eDLfocEy
z=@qtYa`n)`(F4pN^>yH(!;}jUFB||3D6*F^n5fh-D1jQ(sSKd@G{}<&peiguy2`=2
zQenD$L1Lu>AlIZm0DGM20C<%}9V9T`fc1is$mtIZ^=UPrYX~@;Wf|uyFfbiB$jrdB
z^ELy+ws{N;+h&0{&lwoDZDL^9whoj;J~J?EJHf!P?NB8H)6V}43>-nAJjB4ju<aoO
z!?wGSxB;!tNMv9-C=QAnMh1p$KN%RdeRgGFTEq8&A#Dbv+i>6)NS42zfdO>y;C3NU
z|21s^C~QE^FD?Le$G{6hK!;$0{E~J8a=XYuZIA*EaMYyTfrR!!FOV3xLk1pX1qC+i
z2ZppaAoCcQ4kGo};AVpQcO0Pmu*w*i4ua1`gCv%8NOXga2od=oT*b)1bZ`xCGDC2c
z7-%X2v;=roaGd~Xxh?4EjR2nDY(^^vhIFgo2vC)9@EmA$y-6@+j1OeUYUf~okReY&
zhWLXH#eB*DnpAxs?8L~xRDXyAB<=({B@c9@Y>G)RsOiW6-qFJOHCPX1=pi>Y28MX<
zU}JC_8?>gtDcBgal^L|oevwbGIZRytO0YS2b{2f@NTjnS`0%5z%%D?9GIKQ5K}Uu_
zc%g?il|j7vugstsb^oi=^Fg%m+UXfq3=C7RPj>}dya{wB>b>c%Aj?1%cu>xCSI|=9
zqihTe>R+aNf!mP`aSRNu#nbIT;lLs=T@$SH0S5y^<<04ue4r)?2LpqP-E>Xxf@M&c
z@HI`BXJlYHY{ENzf&-gWeZ_Rpu>;^O1P%?;Aq$(?7#Pl7nXU|4QV;TGdC_!bGmu#z
z{W&7j#X$N&`xa6%ri+0L-pSCy2s*fYIv=R&+Zo5eFm;BN73k(8d44O%N)raA!@D^c
z7&xn~BtW4A+J=+YX(b^A>L`PJXL!v@LKV~`0dMoRk_Pz>wD~D%os|rT4LVF>*>fue
zaBzd%aY{om3giyZVIp~*ijZAVAc-^bioPI;w``!nG)2fM&Y*Cb5wGaL=+3|pB%ugd
zC&R#WL`V*7pCV{ppWy~bd)i|~Q1~42<6vOWvYUR)kxjq8Sy3Dmut!S3Vv6G6faNVq
z%wbRz2T$6A+EFrV6!}5kpY(yj4RkfF4rt`&$SpOHF^c@4&fg>khV6<B4BKT{KQOpW
zVPLl1%D{BwBqL)MKYTEWvq6#LzZ56~auk4u8QhjIFx%Eo17$IeLh#u+2VQb~W@KPG
z@{y;EfddqB43iiZFfuSCz2kTRvi>XROsu8rInIDN9~f*vn}5KKienraNhxUz9A`kz
z|H{AsYNKzr)krEWX5csjibjxF9s|Snj35RER$&IFqsJ7>7&vb6g5qc=1H<--3=G@*
zjTx9N-99kb+yPY+Hg`ZJ3deO`2BxDe%nZzy;S3Dh=P)pApTz)D$Mu21mH|}l*n*TX
zaNGx}TLV%j&A_mIIRnG?rJ%CM<_!bW3D6x$Y{d**|H0k|r5&gVHVf)OYtO*`VBk2%
z$-s2<9n6SL3=G>hfQ>l8z;rx-kueL&2s`k4G37XpO)Q|q`+>n4bPEo6IQ`foNKkA7
zojL~c+Cc_}?Ylt-Y@OuT1Wxu04BMYEFl>LIk(^ji&%m(>)LEItz_5dxfnf)$VkQH}
z7Er4E%D}Kgm4RW0qB>}^9S3-9btePE4r>O69p<bb7;I!fK4V}yHWw6wkbTi+pc2(4
z0pwl=rehl+5@4|gs2F%DBv>(M2_E-{2nL%eASsAaP~s?N1gC|AH5{uL8JLc<gL4+g
zDoN1tNDk1(XpU9d;8pTg3=HgP9N>QO@c>?M^e+OfWd*GQ;jEs1!i7!0eh$Y3SO9@;
znFNnGp12DMpb4N|fFK_QGcfG%Rs&^VjtQW_m>UcXJDM37c2v52V6cv0U|<MfU^=m0
zoq^$KGRI_4Vk%}}*s+O$VaEnp2BwQUJ}_A4fLfz04>+cAGB6!~!py*Q@dN|Ij=c=^
z3_C!F?_RvZz_8;C1H+C}pp*A5MS*p&Ffg#Z0qZycx-0KeHUq<s>kJG#t}-()T`Ff_
z*zuf!VaHR@kR;d&@RiTjphfHq9Mi=Zm`-@Xtog#gu;T-WbA^Fnr!oV>PDM}xwGR8h
zVC}U8)YP&DZDM8Nm@dG;bfTV_f!R8PfdO>O;Z7ZP24?G028Nw>3=BKLXMbA9Ffd(w
z$iQ@BGAKeIx3XJL01XFDw|8R`uLn7O52#7T@{eN<=!jmBvv+zjFzj@PI(ugb1H;ZB
zaPmC8o1-4o0onP1!77D;f#CwE)HwAW68iO03=E)2>Yb?!3_D{Xp<fR=yY&VG!_KJ;
z3_H7BJ}_8;c5R0+Fr8|JgnoS!H28NOVPM#K2parW;M)~hmT<IkGBBM4jdp{Af9H7y
zhMk}l`=HR@d5?i%=N(w+Tg?GY+_7wcXaF7A3iifJ28Nx_Vcz)3z_9Z>EcC68fO5Lk
z5m0Htz|khgz;qIHOftwC&|Z^WOwi!pWy-*?%NQK|%^w)7Zh%4`L^7~&v<WaUoeBko
z{!|8rT@DNkyX-)rzlechR{#UUE<b0;<dW4LP=R0tE_-+wn?VN{fM%F>MKdt$iqxxz
z+>>i{2ec9uq6pEB-Id0`unQE<tREPxdLZ$5DiaZpRtG@w$jF$<Tf)HcN2-`X(ZO2<
zG+YY3IMEt>!ZXVujvhe<rc<Dk8^JagGBE7Qht6%)TdRO3w^$A#+1kdyu&adubp9|X
zVO#wHr;c+R-LTZLYc>PJu9?ta-L;H?Vb>CH>e&CEBM+21ZhQdEhA}W)0i}*J8IaVG
z2TdKjb}}&RS`SGbdCCm+44_f|U4I!EcD)A`<Vp-oXLKP+qY#=hcKb0f?Dl}B3_A-@
z#$+|&DB)yaI^7P6r4tMcyE7RWc7v|V1f`7K6$}i!%U~(P&H|J&SREi5c7R-+&A_m`
znSo(<BQpb2EGT2{p3K0odm=~&C}Y}z`*p1T9Hn9mOs7FROF^k(_dEuM-E%<pU14C@
zy_SJt_i9ivXr}>*meYTs(Zc$H!47m2UmXL}8Rh9~J=tXIYe0>0km;b{v}*u`H)}LU
zl{^E}nK+nxb}%sP-Ui~7GcfEv%)qewAVbjy2D?4rW_dOP!{KWjv1}h0EJ2OpGoWxi
z#|R16SZJlN8|17rkZ_F!wM}j?FzjJrVA%buUISG3bHwU_>J<itJ(dg%dkkGZFj#^v
z9t~h%I(r!s-U-m~-jmG0uqP23-j-KD;mwlDk<7`!bQUx)0t$>hc?=ADa-e~+r<Q?X
zPc_VcmRCUG%~A-_U<<lQ6_geCbTBaNX@h!j&kP2JJ<~usK;doq2W&+HM+(Ra&^_2-
zE0!}b>{$r2;x+@ro|~XtXruFi!Ab<2cSS(eG(;2VDi<3o28KP)85s6FWoBTuac5xI
z^NE3B&j$upnGXz>Cm^wOb~`kdxIZvh{s3hjcp+$I08Zxp9GS3WzUMCk!yeFb5>OJ^
z%fY~~mkoSCV#+5DAGQw+7NEOC!3PdsP=`c?4>T(FN-{9)6@)~E4>T(FdNMHVwTHxn
z52$+H$-uC;j)7rsnac-;dW#hd3=A<0Oy{>kqQV~<6?<1OFzj6hjS7n$;Bb=V2;yX5
zItMy33KULzH#0Eo-3Se*y@wbW_8tHQEGVg2>;OlFCPV}10C`YM>^;lCu=g}HCidQC
zVAy-R9;5>l6&4S`R#<R=uIV|?4l?xw1H;}o3=DgpfjCzf81^YJFzk~9M@8rd28%zS
zsId40>d8SgwSq!FnSo)S4g<qJEfA-GfnlFH1H(R3P=PoJtcL|mGB9xPFc!$d?i$|b
z#K5r60ot**_ybym4>1^V-|#+P28Mm!4B&38#TrPQo}Y<`Q;R#GIK^5ZGJ!(GQUM&v
z?i>;F3{2-iUIK;4zWN9ThJB#jQ=pjM2XcHO=qOvzMdy~_TWeV&IU@Bz;}44&8205c
zFzm~L7N3?Lpxn$7iR8pe28Mm*kfSsuOE|3AJ}@|d?teZ3%Cr}EKvIe|G^On8V_?|V
z1lpa?S<PV$O)C4YGcfEs4M{52prmqxfnmQo1H*o4PyyM>z;v+`l1l8Lsbqfy1H=9>
zXex1J07W6|6b{fm>KBfKV(kP2!~SFjhW((yOHcv1zleche*q}YL1E&^0KV9gbpb@j
z4^Ya;W?<M~%fPU|8pJ7QVA$Wwz_7m?qyv;n9Cg4}tmkmzWMH}ox>6RD5ckhuVAwwm
zWZxAAhW*PK81^p(6_5^JAklOYbT=Rq<U&734Nx>OFkMUr-HW!EdHQBgHsN}&4-Aez
zAPLYsWgiC{c&iB5g#n;IX5G!<F3-SpaT&->AO~({VAu~z_@GGJzmI`o{~l1=+OY&Q
zY5|%Fp9nI-oq=K7J`OW>&|oIWA)t-5vpCE^C-xR|fZKm&pk`z-gMU2(LxVksE@+8!
z@dpMW(2YSVpg6k}1&K3Vke;0k4Es+rFzi3B#K53=ltW*Pfx%t{bo{o6gCe+V0-pW+
z%D}My83V)qCwh?Xhfoiw`vEqRg~Na!)E@|EVA%hifnonw@HlLrCWmZ2Xy57$Mh2!!
zEs&<KtSqQK1!*kHLeApVWMDY-j6(u+!v7JF%5@Nx5@4r6R7!w`_HQtlGcfG;3<6CC
zF<m+dUOW=S7z7&ib^=KSJPTq34Jup$o&2{jGl<binxUTIDl-cM!};JKMo&m@!JL61
ztSX4nkdcAuvLq*HHA4`ip)><RodralBq%_FKyyD#mrbB{scL`@Mgpxyw=51~lm;0A
zS{4nmOIiYC1W2lANf4tDNGc0-k~K(9ND3ymhAW7X6C~FPwV4wlrOLoy&=T|yBr^|u
zenQYc1+Z1Bpwsn(zJVmRLnOXI{0ll9>TA#&ki-Ru#2a~-4(ZuJpcQAAU-A~zCucGQ
zJ%*cA{3YldBLmYFCJwO2&%te1eiU>JBq0rvI3@#ju_^;Y+R31OAPEzQ#6Gx0#PpzT
zAPLYQ#KO#=ZE%T&c|p@b5(OY<O$%ZZcWVj)b(TQWLsxpihlm7~f@d&6yS&v@f?!*O
zuB-y-U<d-uCkQ%$B)1$1iU;?h8JMozpB@{;CR2YbD1)DYfg=qxh;(p9P%y}*9}u?%
zL!v;Hf#K+)Akg^3RY8b^FWj3EdxGp48JMp6LnQ3M5^M|%+VMf~!z66Gf*e7~?W+s}
zXiXghXdO<(9*}+eQ-bPEK-xh&2Nq@qf%d9jWd_NFn+IuwBpM;+YJ<%MNvv@T0u5zc
z1)V;<Ff#~r*V<KPsKKCl)HQA(Rr{9*NrJSWg=m+Q1%*D6s{PAB>6^t-iLw3^BLma5
z637fP!>14y1_m!HCB}>3F&P#Hh7C8B7(uI#7$!wCFcj!3G5%s<V6Z=-#P|Y~s&9xg
zFkMsON-APdV!R>7z`)u8I#%<VIST_rS-KMAOVF^;SFlhDXa-+diSae4KYNsgf#Ki;
zCC2x>4D}2`pl$QpN|YEsfU@=^@Cq-G=5L^V%3r}d>;p}e7<Yo)*$+<TN{l<f`3sae
zB>yWhZURYdhe~Zi_p9W8kY58sl^DAi8JMoKLDhAEjgYB_#L1_L3=DyxAZHaSF@jD6
z2Crbx>r`T#1okI*R#}M=bX^?-_~ePa03}BFQlRT<LZH<JN{q>%*47Qs<i8TX5@Qr7
zse#I>>!2}6nP*CjQJ^tGu>90KCB|Sz28MbDu!1yB(7=`wV=$<1euDwD$kX3ZiP4eK
zoPojZx)P&4$mx^eu>=WmQz3AOg9?@>N{mt<C7>mMo2--=A>(Txk9%HJVq^zNftE`w
z%v54zmjopSm{Ij1pirFeuEfXyQuGTNIt-A|VE`vsP~gmW2c@e`(n_G6Xg6fR=}PG<
zSQU7(tX1hZD+5SLl&#VOMh2!EprcC{W-2`ZD`8_`SQxML2ArtCiVT(ZgA|o;)Pu?m
zrTs{%K-0Gjlc0$eWObAwNK4Lar3D}@%OF-S0P8?fl`|V+$u_tpIkigtART8QI{Gnm
z)H0|t)HBpyS1JT4`v_512v!C$s}*5Zlu|q+1Jg~=DZUFcmEysQkZq3wyU|YxRDRsF
zffyAGR>j7^FttVryn6KpNKxc3B{z^!iC{(bN^VH1z*P$PkoL7sO5nTYZe9eHCij#e
z%X8Qm7?RH@X@Zj^8v{c~rV?lY0r<?8sWnR4U~y3frkfks7#KKnl#C%c3M6s}d^CiT
z7381?&^)$2zmkn4Lkt7sQE=tjE~W(DYy(P;H{XK?LX{*T`pp>_#1aFU@);SJZh5nS
z#)|@(N<emjRz{p+4}@%`0dY8Q1u}t8O9$=$$m^VbI-E^i$2gEF1!T}y2BuqCT*aw{
z41r9b^v>{=A(w%nVOAhhI81u+bh!vNoqEkcCSP6#rdyz;8PN=ZOrY|X;VV}rLm(5V
zdIYZxlHw0!@`vcFWnl1Z3S|7xX3oH1*A~cl59CltN)BYa2QCjli9G&XAma^Q2BzDf
z^ST#i1~T4I2jv8$Sd2dhQm0oh6v%iMq!4t!2uR^sutJcW;^{!fV<4#ra7GDaJO-DN
zXboiC0FnZ&1_9~X0GHx32xOcLl9~<GH5n`gUX>Ea2)Wz^WI8)<AY%_NLp{@N&?-)l
z89iWyAUTz_fsB<PGcH2Ss6<Gq1~L|cq(B=WK)MRyQoQ>D8MApAnC`Gcb!Ee)*p3A<
zrhuei!I1)!s%K!^7074`k}HI2GX=}BFfjN;2QotDM_3pbT#^GBK`Um#h2{Q5fsCN_
z4`2>gd?2GGXiRz%$nCj)fsAS(<CX~}XB066GOB^cV>uZZDvt&-s)5!-f{IzzJ%NmB
zrVI=j3}9VOF9I1QLAnldCFkcb1Tuo!5)i3in?Ob`kklQnqWp4(Kt>)&PMyohz+l-L
z$jHj8%D}L+GVmuz&3_)S_TLaCstgRZ>Vcnl8JO;>OkWqpCK;v*x?42x0Z7D?2kbu3
zUNi9QN#)VNN03o|RR#vhzQ7|OMR`16J3(s@7$!l?J`Oj#Xno*rkfO=cWuw_7y;K<(
zHZKZX4HDVG3pRT-XrvW11H-i@5PaGscv~MYYv2NqB2c|sc{FeVsHr*$R9g5}1$OZ=
zFx_LA-Vn_uC8`qG1!{<crL?C8)`Fx|r>~D@lQW(dSi%e1=*Q$7m;+|yFAq!ug+onA
zASgH8tA{wiR~|IN0V*J>r^T?Ti?j!NfU}V*14GfaKy{Fbd#78+uxZw71S)ca)G{#L
zy9HkN8>kG<^`Ms2!VQ7aFv;%_Nze*6hMf%Ej0_B1k%3}hSrBLcoIpV^2h`fGP-O(Q
zc<!5m6P7BY2}*4Qu8ib;RT*_bb9wh;p^9|DMI=&2mG=cDtFZg3jLM7*O!py;UsXnB
zusU!FrOK!ZajPT)L)c|ia0B{2XtB`3OjSl9WOX87bu6G7N|jLp9+6?k>s3E6GB7=0
z2A9*SAHaIR!KV5NtOY#Fr1}lS2F+wGj92{$)-AwO#-REi6sD6HKtVO<vg#vHOJFAh
z(*sZjS(vE`TDcEzwt?D%b3iv@a#pK?TU9$j%b6xL)vI1&1UVoWJn5whUdOl-v>s*3
zch$pS13|K#;J%vbVNlBhGy{-gqIwwAC7J}jhe7o)sO32cGzsQ0MRg5G!)l0s)}RHv
zDg%SqLDi)o6`(}8FjF;bDcH+M!7g?Xlq46rs?Gu_`vx&+7FZP|V8Ay>f)li6oN5Cj
z1JgrOh@u9BqUqb>*py^JneLZrDo6=v25w=dYATYFuW@Wjpq;fG{;HtK-iMIZuBtym
zi7I#wa3`oD+bpUY3Cg59!J*B%TGbI8I1Ee=K?gA{%v1$!@Inb~*3}T_x`W~l9NOl}
zsyd*+e)t^{*ruEeMxbGOO$LTD>Z)R30~r~Z9=Sq7TMT@t6!?57RWZ=uJtVZJpNMBu
z;k0050#)#j@}_@{XH%#*V`Dr4GWrpyMw)Sqjq!vKC{wX8Fsuz_V}!JJSQr@Gr?4Sb
zv}UbhV^S4kV0r{<ZLjrXgRIU4)v%}7*_gof|4vZ`rbl;K7#LO_Vq-i9No}Adl=d^(
znDoJ176t}QK{j_L127M~T1`)0l7T^d5*y=gMh2$Gpc`vJ*6s#3(?M-YHpT<+Hs!XH
zY>ewc%6vINuA6>4flX2-n~iY}$TN>YTeLxX=YY~3Xa#K8;^_j3Y!dYgPqHy~Gk#zY
zvS46f2muWZJYmZM8NkNa4f6O`M$l1Cb-UOYyFmfBlY!v?3j@OehAak#>St_>-Jrv7
zCNXAYf$qIzW9$Z9h_;h4U5bHWtsfg>FC@Yk4yZCP9FPSGhO#mCfpZ-L!vR+Yh657z
zpuL(W|FJPvfd<)kGB7;>4K`>BPTvo5-5R!UAm={;ofEq-lkFQg6M&A^PAFx20&+EI
zv=n^7&6A(%3=FMVY|mh(r!g=bNK$8D;91G`946Mqz;FO`@amZ>Y%gG9Hy9WWTmc^?
z!Un33K}U%k_|Cv^;Hw@3Q~k574-7&IpwU1fP!Z3=_6Bs&(z9v?hJ(xu3<p7127ro#
zgMthU2l+wW;e}0L4a{JYfq{W7j}yF8gL^OAJ&;eHf@aSbX0qJ_XAPvh%Doq~p~H%k
z?FLwx6*wQ(v)urz14$h<WV-;C3IR*8U4Y1dy6A7%jx#baJ<Wwk9EVG6zsLsayFUdT
zytXitZ68F!kbz<QQMT=1vlc+KY=_GPFJRjMme~c8sn2BF0FhE<VA$Tswism1YmiJP
z+hVW;8v{dJ5gX_LXMPv(ISFjw<-OpOdbh=}O#+$qj1{6|5?BYQND9<s>t<wNdL{>v
z=!QrbGB9itV`~O$0X0(=X4bPcL!?w07`Ab-fzF1176{Q(1DDwPkF6ABSQbR06e6L?
zz_5A>TMnos0Cj<$O#$8B=g*b{?xk{oU7aHbKB2&nfnkjbn>onZ=b%-k3p3fw!DetU
z)H9@AV>1VhV1j1(kF94j2aQ~UPEibhzy{ve3tAs>P?pUaoX|o0jM&-0odS@!rXU+A
z-GW;tVT;+o$HRie5A9?F-|Vpyw8)foA{+SZwMh(2&p}stoMLBF1i2BUFsyzt8>9*c
z9cQtVO$BC4_yaajVF12j@SrRkcw+!aLuL{iq_6>9dDOj`O_=cmgCJ-^#0HeHpLcy=
ztYBah1DhfT>TI%<_%nm9mU_Mr*1rq^343(;Gd*QwV0vEv0bHZ|Gd%@oJh&nj28O01
z{!EZO1S-Y4{`oU~02ND<K)iKp{Fy#0Le5kIndc|x&jdO`;RUGfUYP06bQje)P~%|9
zH-DzRj0{XKK$q5n)a+GaV5q+e+J*(PYOgk^5QgLz@F_`4zJXV1`!j)dJ94=BGo1w=
zZU?d+#5*Plv0jpaVd_SIrWGKQmq0zU0z5hcF$+ApGj$_mXM{h~Dt*u@C-8X_o~iy!
z^^-yR&Or4|2D_S*fdOQ}WPPv&k_-%nfBl(qLF&Fh)#ZwV`YBL#xw<fQ(%Jq@>5L3a
zFF{cR@?ko%dFf#DppN<!!oVP%%^+FNz@S&-&lC;P1*$+nx}uSFMT2#L!q1G=pD6^S
zt_|vn5O5lXx+267<O-PS6B!uHSV5Xxiu{@UK$><#HTfZH@-wVQ)8$eG(lyP}p9!>8
z|0OJScp&TYK(}g|B}mhO^Zrbr!P!@!b{@zdPRN>^&@~-657JbBV2?kO4I=~7E6@f~
zkS-f!T{alH_JDL5-t%Vy4ZysD3_tlZ=_3c3J~+r=K@q~hV0aIt$)wpIbX)+_E6`R4
zkWK263=Hhx^vB^gJurh!0<^=I0TeSP&7f4K&+pHq30lu~6r5c2i~N}s7#Wyeb3lVq
z0ohUou%#e-bou-lLF2ryK}EpAOn=6INa`5>fz=^7PM42`fnoL~e<n6gP__lt-03mX
zKW4B=)<^g=f`)%zgEsns40?lX&>M7v^dmsFhZg!Xf^zojvk+G@K1B*o#;54v8CnR^
zB(~6>@eU&c(;Ltz709MLAWik4tjXc#&v*x{3*t=1dk9zhGu{W+u`u6EWMB|m2r{o>
zhd<+Kka^iqN1O(k2Q%(8vT-11f`<>%WBeJ<p%_;`k%6IM2iUwd{@@1E8%Te_pK&*`
zdApI#+l%bHeJJLEj9UXT&alLvaU;likD$)mh#asR!2!!4$xzRrZ|KhmTKn@Bblwao
zTtJI|pee?m5mb~23xf<aZuMsb)tqlZXM=#$fv$Ogt6K~+kik&JpK&H51Jm1dsKqmp
zEuINh2Mf#)hI$4=6_Dxb=lvObLApSVd64P7$hvybbTO!dGnUFFf5vh~2BvpHP^-$3
zHI<`lQn|#HoKei+&)6iyz@R*vD=#ORVR~yen@Rlxf5rlkIiRLF$npYYa|+PSk$V7k
z@oay_OpqqfDJ~#QnaG+l(KV^h25Xw=&j>09-<^iK7+emrK~l|hyBs#jdN+SYP^Myl
z4cvqBs`^BbW(75WMo{7S9(02z$i@(48$-}-R8RwHQv2c02%1HB59#~*Gx{QH@<rFA
z7WM<AOCrIa5!9V{51Rb}S>=YT%MD$ZL;^^YBELVQFe3xg`}a`K2_rO3*U4pb2=DY~
z1f6w-7-$V)U{K@-l|x<s{27g)T?SPK2Gx81-x(R0K1=|&hWx*S4Fc`WaP$9;Zn^5c
z>4$UKOe8z~|ADgt=#1%f|Nme%_zZ#R0(p>d<pt*(P}5D}y+5d%{Q-2`@4`&~4@l;J
z0Gkg|q<Yx@CCCxCAdYy6r06AFk-}~NM<7KY`xa*UgLdy-Wrn!)5nPe#Mt`@<j0{X4
z^&m!FMl$L$SQSqhgFooHHwN$^i^6VyP+RyTXphdqO#kBu<<sBgv5D8a`9q2nL_T6r
z*bQ=W=2?GG9{mV)@?v>V9S(8LVpC8x2yQ?6FLnk^U-G2n7clrQ6=Psf2KDx<H2jxI
zFfe_*1vM3P`AOzk@L6mAJ0T&*$H2h)2{e2i5$9jQ$iVbzD#Sk(;Au06Jrza>dn!QJ
zsP2T=16q0wwkNOCzYZKZkca|b+68L%xd-@zZ+HW-4L|vV4#Z^G33ba=2L^_SI395J
z?Gl>KT)?JN@8&-X;wozf2L5#aY;Yr)f$7sm&{<~w+28~GKqDcMs{U?_pbXEz^a<3~
z<8bo_rDkDao}$!Z27k~kZpyPkU3%8b{(gugD46SS#K^$(SrXz!BXDWV!NA~~=5GXQ
zOV@)M(;mP4jV!_IBUKp~=Cb>%gLH&Jbf{}U17GcdzdG#30FPh(>K-5sYzz!S$Ne?I
z0Rf7+72W=z$+ORsA(|z@tve0|2DJzNlAv)*&^l+2U;dI-FwNe_{h>pXpz*h4kr_IS
zAV%Gp8On??3=CQG3>ZN}>&pBe80LYFE&Bm#JbyU{J`UM{QBnyMOAHJLH5nKV%1^H-
zWK*y>n9RU%Fj^jToVfv`8V3WzVJD`E98wGnt3wSK?V%?QA8ce`I9Sj6fni<+WZC`~
z`{@@7*~IEwAZMq32?5XVcYwDp%)0?PU6O(6OD3}57Y1gP8w^Ze+87zLm?m;U&r|&d
zzC>}p3{=N#BpvfjK<BG6Fn!qzI&;<!s^Mz|BVz{BL<7*ug82^hpz~Zo27=D9^k-nu
zd1lZGP7xm%X6;~LV4ef={`W&_3=EFp2CXts-%nv+IM|g3$_EA=;C#S5u|q%|)K)R*
zgd{G8gBKVW4xRybtqnj;F;Lg~;710AgO8QKAqDD^9d=@>pU9z@la$C{0BWBz++bih
zq{_f>NLihMVWP6Z0Z2469I{|wIAoyCz)+}U0KW5VCj-NwI0lA8QR)l~9R&v9yBR@Z
z<qQmm@?AbK%mpn*@nK;43L5dx>om9q8glx|z;I|D1H++d+#eX`8i2x!kuj?t<Z=ek
z!OU|(%NaEon7+PL$W1C@Fks{sXJC@iU|=|Oh=Jh{Xay3p!oLp;pi^5J82I80It3V*
zzJYEESL9=0ICPGI;m{do24+Pm28Kho7#I%SU}s=fRAXQ`^qhg=&|@10W<|pf470v~
zmYMLCu^RD$)PmNj9Qwt;aOek!=gYuwn2mwqFz7&f2F9-oJ}}H-01ZCO0S$Aw80=wX
zVEWF(%)t0{7X!m#K?a7y{2<O+28P4(3=D^5*%=tW9%o=Uti`}^SR<c-@mC_)0A?`B
zz`!8D>dwXbfnkmW1LOCj3{2lZn{*gW>Y=IPTLfrj%Nzv;X4QiXOyBN<Huf-oVEk4B
zN+xq07#M$mw$?D3f{rD&V`R)=1xtcYy)I^8Wa{%^<^n~QECaJ;?+1pt9bkX98hqkp
zVEXO_S{*Wrf#I+f1H)kp5N8>T!!E_ZY`KYn;jlXc!(msD6J|?5^2hf~Q2r3DpKSoi
zAm2gTRKStN`hj6~0x0?zn7)Hn0K)|vAQ|NQ22grN&LG?$7-k;;>40Sp(3maDaf2*S
zxBvS~HgMuD26rJL1t%lugb<eF3<eDK45AARBEdO=f$0Y;sEjm-Q~@1w3MwN#-W$ll
z<d%cw<m5ndplvF<3>3g7f{SqjMQ}C&k5?Lid+(re1f!h>ps7M3HBknpA9>&r6azhQ
zQe|UcXnAE|$OBqTIter<|Dy*YZI2}F3@LRXM^qa4BFO|mWEf%?80;RgGL?Yc_<>;t
z{3wr~f)@D&46IBgVCOP09FAgOI2-~#ik+3I3YvuvS1~ZuAFcrH;%;VTssharePv)c
z+{(akxS9I{!;C)+Og{xdVGSxfVi*_}sIoG-K&)c4i(z2k0xb|@W{ZSa<pMqmm4V^#
zJ_d%vQ^XmV*&;tM+OvQX3ePiErf2~MW>!IF24=Qw28JUC85oW%7iVCqsTcpi=xzgA
z;>Ih&%48wH!1Nom`WbZY!cjj4hNE8W3`{jf3=Bte7#NObfjD*y3`Z*%7><@HGceV7
zF;9HJ01^#jU^v>rz;Lt;#7SacI68%a;pij~Cy#;Q=mG|Yqw_%OtC%M?F@hLv%o9H`
zC^InC*GyuX$N^F}kAdOnItGTLt3aGp3=BsPGcX)I*a*5VcAG8eR#gTDUR4IB-=-k>
z3k(cL&oeL_JqzO8VPH6Vmx19Z=x)547YqzXKQS;IeFu{H!oYBhoq^#PvnvBrEyD*!
zj~384ECbW8t#S-ZwTyBMO!c+AtREOXIvAL3r!g@7ssROei7^96477m-BsKvoW&{>n
z09CgHEM~~S{ejVA4M+^kHvq3cD=YuN=qUgScV1_mJ)8_ozd&cYm$fi39Ft;TI3~gU
zfzeZhfvFsHttMldDQIOPqelS95C*1Se?SI-PwZm!h=GXx766G=LeynI#Z*9IRSaMU
zlz_xQ{AvaUhN2IQ_B$Au*;-gXFuDgYFwIqGVEP?9{apo{m}~|E)13bdOuq|3ioxsZ
z7(E0a+jM^SO;@aB6XBGBa@S3_t7H@B)PQo&O^>T&6R)=caX~v3iy1srLHjgHbQl<<
z8JPOwJ}^2=U|<B342(xunG6INnEn}nuGq<AU^u41z;H~3oq?&Zl7Zov8w0~J7Z9hF
zf#FyX1H-WZ5N9F-!?7d=hGPlJ3`~7<p~<RmB?H5;A_j(I1t29`>lql1H83z7s{!#2
zGB6yQ!N72A8c4%gXu9gV$vm+Yl)(C)LK9fuN9KtwV3EI&ga)cCk1b<hIJOA1^|fF0
z1EbRnV+Lk>!4Hg%3mBNdBm;wlZaymm)1T+e49xag3=GFWw(SJ%o3NK-U^w=Rf#KLE
zi4Tm9OF%0JL7PVV^%xj<{TZ14wzD%Z_3JY*9G75VI4%a_STisjS7u;1t_b3|GcX)C
zU|=||BMZ8X{sW^E_>g?wMBN5X2ByD$%nVGRgmT=8f#J9V_XkEN6Ien4rIY#(jE+A*
zk<GyLHwhGn;N6*wPApKdGLTpWI8iu(;uXBD3Us(L>jy@M6_B*>cNs_#csnEL+C@gt
zf!iSI1CX@wcNat&l-eElfTEj$>F;$=ZB@*`QU4#jbE^cjKa$b$1XT7rBV!gvF$3op
z70y49M4=1TeFY-_PaG=$1}?7$O16$KK=LSwNgte;x_UuT0!mCyGZ+{c|FAL{2{14-
zE(Y!K?wZTMa6E{C;kXYw15?)u28QG13=GFXSI2j4VPH7k#K3U80VH#Pf#LWR28QDk
zlo^=1&Ojo*>jneE@eK?N$3eSIyPhyG9N)vhaC{d?`3DAu;};khjvoVYelakB8a&6p
zvNJGsvoSE72w`A25oF82)LpN_z`&c!z|8OuB&Ev0a3Yz3;Y2KmW5~d8qJe?oM2#y0
zQ@8C0MrY7=8_-pppu+*X?HCwNOkrR+G0B*LsoVDhqw^jH1_;Rzq1PqKz{~*JJklM-
zz;I$d1H*~A%nVH3X$%Y}RxvP~SOMY`F)*Ci&QQ;AVk?MO$G~vn5Cg-B1FRnyouSe2
zA9U6qYdPp9Z*ay07Z=XZIQTyU6bI$Val`_OBj*R8IACD<zXK|dh$9QI{2S1<g$zvp
zuY%%fVto%I8)&6%3HS;EM&}<;*$<#J1G=gsley#wIQhANlHXRaTF|weAb0KnCopCP
zF_2>LrXofc1(5Y1KF0)*qf0@ju0ryKO9v<cxPZ3)@aV1PWMF1U0mVNkbDTKKz;NO;
z_XkFo9^}mNfzdevoDY~8KtTbyJAu&|QeZMO^nk3Xf`rN(khKiV3`;@nc1NhqtREO%
z9H0^hKoSOwjF~JGI~dtOA>jfljGd=3Ff&{M8B_)~$OUHj3#b^#Q8gelK>D4a27|Oa
zZ2;#!W=7fR>+0CV>Mwv4F)%ZlLo|X^LJD}NJ5ZSbkP(I;iBhm#PN3{Eje(gFeC8v>
zBTj#yiYq|sAZ~I7hbaRyV-Hk}`var12}m8tDh`OFKwFrk8JOCbKQOw?0S7dwDQv>Z
zWFo-8%(R%9fvHWHf#JkW28I*Yl^K}Y<RCeyO^boy#8U=_6OY*$m_R3VocPGVaN<3P
z<HW#l;x7ZkiQgcO9|OZlZU%;v>>y4Q1H(y028NTevJA}1uRk!loM2$GW?<lLQC`o=
zz|54(47sZHqzMDVNh8qhtSk%+C+!&+PTGPv0t^f%y%`uzdV+!$a#ic!dN%R;HIVRR
z0!J&PGy|Q32`bIFKQOxP0bPX(@-SpeHmD5rV_<5?`@raW0o>S`z{+GMz|6qZP{+V<
zGLC`aWSBAoQ$r`H(qLy`YM9Eva1w+kf;bBq7)~x{U^uxH#97P0aB>qvJ;TWjAl^;}
zhLeXG7)~ApagH)DoV>-raPku9!tMtj7+t~Jpm^u&ALe0TW&vF>*YJ^n;S?tW!zs|*
zX2V|whEo;{45vWVBxr5xseA^8Q=l^;8bufwPPH>IoN8reU}{tV9k9p1a0;|gzEOvP
z;nZpdhWb;>*%_D`LAv)cFr3=0%)r#>0;)7Yj4Gyy9JUNhjcp7Jyc-#qSvG@|f{Z)K
zz;Nm~NM<qv1Mg`DW)@bE%oGNOQ&$)mPF-UCz~}}l5W*RlnL$N9Wa&Ml+ZzUETaegm
zP=G>mZoNAXDDQ*n1?CS-fi9r525O~3Zc|`%+rhy60Yrk%!JE&^z{~>LqXW8b_0)X^
zhEsPT*R6sSfb87CfPCF5NR%C_nFW5^DoB)pfdzJ%0(kogsG;Q!sXzDYujgc7W&!Qu
z0~HacUNJD7dcpmH(H&NQGI1Dz3nsTSAkTn2QU=}=!sx~TI<<{~nFZ8eW9E950Lrdz
z6Ci~Z%N>wPh?m_qKz+<Kk%Li?F_XCjRI-5*+XGNqoW7umO`<;g1EYNgIDuVfW%33!
zx$T)57%$c`Fr50&z;Nm-sCD*(f$?G&gC7Iql{+68?f-x_D)7EwW%3nZW?;PXhJoR<
z2?N7vJ$44hE8iIyP6shCoc3X7V7$uAz;L>Vf#Gx(h{MmoaC#~O!|912jx+<q>E#Rz
zr<cmsGcex%|AEl~5-4Bgp0F}7v&k|uFy7%|U^u;rf#LK95J!T6;q+bxhSR(CAX(A@
zbkz<>7XyQUoFgkVN1i^xz;OB)C=;?UFr2>3z;OB^h$FzjaQZ$2!|A)+9~d2MK%GfY
z7=d^5GEU#t%*Mwl0}2lYW;WaDXPeo?>uVSoubP6?fUj}}pP|5L$iM(P2R53Wl}QQQ
zqhSO!SwZ)Gu`(%vt|Ukhn9az*ut0*9$yNZg&xyfvJ1dhQSm_4_LC}^q(Drj?wsisE
zewHBkf<MMAh6)A->kwAPzl<LkR`f71aMv)_&tYJeekabrG<h~yjERAPpN*CAKPYJ4
zR5CD4Uctb?FDJ*qG<hxPv|z>~Yd<ioWB_f0;@4$mVq|4t=AGroz<6XESeTcAfnQgS
zX%{Oy1LKh+3=F5=F)*BdWy`>L<RSwDzc&LjyB$d88Uw=_CI*Hx44{KS7>_*pz_1#0
z@(>FHGkYvZ{v`v$8GZ(aGu)tbaFqQ6!)ow0D*kXergfam42(xb85qu}Ffg1^VrO7H
zs>Hx>#(;t03@A|?)n{NhW6i*D#u6lB!@zLHgMs0U3y9;%z;Gspf#FOPh!e)Za3-69
z;Y@lxh?mU3aHfHQ;Y^J*1LN(h9~jn{fJQ#nfR@h*$T3aeW?<&vVrF2x{fvR(%wz_J
zGZR6aPYeua<}omwnIrLmVT}WLM<Pi3;tvdKTtFLC*MP2Wmylzc$jZRX5eCw+fq~)7
zDh7r#D?pq*3=C(sGBDJi*$m>HU|=|Nn1SKUevo01(}F>Uf!q=UHY^6TAxw^GvJe9^
z$5fCGkX!CBFr2vs;(*-poPpuYQ;_xquv^5TUdaG;wfNKIn5GCbFmqf0sRn8N%)oHw
zBQpbI{cVume+&#~{($sCc2<frFrIJvz_4ZsSZ}Eu(;NW?X0B{z2FCMK7#PlSF)*Cv
z0C5&FFq{=*U^pwn&cJwn9RmaC^6s+=tREQGtN>r@!_27!O4;D*m|+d%mMmsYCy*GV
zQmSA`0u2X36<lCoHZ@>i=8OR;03F?u$y5!h-5J(Afy#iJ@Q`bvzzqV1H9w#-;BF|g
z%vuFd=3`*y+%VmtolP8cUzUn212g9-P+<(I_aH{Bb$}{-f*}*az<9HTftia1<REY!
z2H%&H!36GtGOW#j%B!Hu*MOb9wgoEh$;eor1-=ptbny}BIx7><<-_2<2*cVLAXR84
zFxo&BFo-iS9&P@>uyzipB;;?EW17#&z|3n4$^{b{7|vQUFq}07rQvxD3}=HF7|wcu
zII9^L&XzDRoGk#wr2GelwKwX)Q8`JDDNTTZnWqsHdxi`QXFC`e&bEMJ&yIoN>|6$h
zvok>)Zw7|5n;00*u9Ie9JfHS~VeJl38e9viiFo7~TR9n+xg|j+fUG#dz;O1M#0Q48
z2N)R7p9GyZWS04XVI2bl3z%eJ;E`jTD8x|D%$>^2z-(5<z;O051H)NRVQJO|<8Xgq
zSjWM@nBWHr26)Ufh%+#Q4FeAs@XwcHoFvG=%)J(7&O-)<v-d$9kU3xu$Q&7%Iq=i~
za#TIoAPtZ|)`5<t=aFNa3^ME|NI%F??->}*z6EhWhJiUC!wfJDWBtIe_6`HHc>)77
z4=>2Qkkq^O1L(dW24)^zkXR%5q;F6n&tR$o9sX0#u=WoqfLK2;tV;kzI0G|}7bxvR
zlG3^os8}3G43d1-wJ<Q=>SJK$DFme$571EPI%rzSVDtcY20<6ety=>stk!|<W>S!2
z%Hd^T<^?Sj16?L}_Adj&S<r@Cr3Lj244^seb8Mii<<>GVoD*eWI43L(xlL}}8qjt+
zun~~U<d}JWGBYrNE|WW_#K3S4bUZugGP!g53=HRV!45fqbeUWRQzPW$=Cw<pUR=9|
zf$``L24-FzP+)*s2=yNr*4=<zNeETG`UL~C!ba8)46DB|Fy5KTz|5NfQVy;NnK-~_
zJ*{DZgfwq4sKM_78lqjJ06GkVftj}*lwUb)K+aiXz`%I-2ShVyyjq%pv7Gk<!%7}d
zDqIN~j;!ZkWnux<Rwv~c7|W$Vgu28BhLr*gOj;@o(hQ6x`X3lpih%aWt^}=9<X~lD
z1u6d_$G})(10p;@$|b<c#Tl5oyFW0jlwn|FVBlZP%EZRXz|4OO)YF~8z;Moif#IAD
zsHeLGtcHPsgMqo8&l)7Xl7Zn|2m`~pAO?{9whs*JK!=hrFfj8)fuwgcFq}(eU^th^
zpvS<}ef<N&dKOURt_K~^F-P|iC#ZY-gn{8)6$8V$3Xp~m3=HSm7#PmAfH;2`7|u;$
zU^q8{oq?%`gMr~3$hM`j3`{-3AL<#_yMS6={QGn-axyUUgRX(@QD9&=w}*k@+%9GY
zrXC#zhI7Xm7|tC9aV!`Z&Rt?)ICnvrfvLxZX(ER#0~6>j>GduQtPBkNXLWajd>jiJ
z!BS*kIQN)=;T-5jFwkAn=b0H8&VyR;eU=Oi=lK{I&Vx3&EA+WCFr1fUU^oxD0S$DS
z^m!EqhVx3?9~jmLfC}L0Z+h4y>KhoCW;QY~^Ou9-av}#PhC%1+ePCEWfq^*ye48Uo
z)QN#<rVpb9xTIar!@zhqj)9qf9Y`N2+hsC3fD+4k1yI6ZVCFvrkpLx@^@#qS1IU6>
zP<)FsFtzXdP|vVZ2OLU|See*a8JGoUu`@8WpJre<Z^XcGUeA_+sr?261OHbBW&uf%
z%v}bC^KJ|b=UqV2+5Y+i!}=|t<j24)U;&c;z`$@m9JB)zbaiG2-v@^EC&1AOYV36A
zF>-_AvqPGJ;d~AQ!+Fr~aeaq61H<_W28Q#XQ{_6085qvDF)*BOVrO9LuxDU6Kc9i&
z{B&6crVg(U3>!E=E)`(Z`^Cw?EC||c-2t*|9|ObrJ<JSD9mxy~=T9;)oCob#?#O3g
zIDd_S;ru0K2BwZ`NPKoVgAHM2U=R@2dkXTc4d|G<t^fvx^B|Xl#$~%=7#J=HFfd%;
zV`gCL%3xpsE&aS83F4G6FkH}JV7Q<H;xsTYT(DtaxM0QofnkFPC_X{q4T-8c22h#C
z;Q;DkFl=xE#V}lwmH7k1(ga8xUSMFX2SuV_K1dol5}!aKQLq^z0ggn_NFV6NM@GnP
zmY_T?&cM{T_yfaAa6%W*U}fT9WndNw1oh%JFfd&3VPLr6=E}g-xEHL3fkA?SS@14M
z_7DTZg>(jn3#s*>qX-*6e*hgo$;iMUkgUu&g_nU@#FUwVsfm$+;X(xi!-W!d2Bs!H
z28Ij$3=9{#K^$oYh6^hg7%qUWJZu7m$#n*X3m3&1n3~K!Fl;yjYAp*)P-ZOWWMCG4
z3^K}tf#Jeu28IjoL7Y$qhKpPb3>Vqh8S0suk{B2+YBMlglm!`_&%kgoje+4}0*F(?
zz;LmHf#G7EEdx_iCj*1P4hCjn(5QY>7X!n^Ees47H%K!uRSJJ#*cbq+=Qai~Ffi~a
zGlmK>Fbjju;|BFGFP>pwxOfWE!vv{g0jq}fFzcD^u7CyDz$8dmkH?#V+3qQf59?xr
z5`5G24-A_?4O1NkW?@iq)HH*E;o@xuhKtuh?p@5laPc<-!^Q8?3`}LQ9~d?jfD->E
z(2?OB%8YK349voy6GqCi7#J=IGB8}?=l)R7u&IQBscaRbum{ESrUY1z6g2$B`hj7i
z2c$<T+zXmc1NBHHJ}_)70I6dAz_5t})D2}|76ussx?~b0<^mNv3^LXnoaMo3anl5l
z1VT`Op`JnF1H%SLkDm1d!-gdcOsBpxFbjVJO+13HLfx<fQqqWUfzl%6qL2+IAn8*?
z4l2g|fnn1I2BxOX5I)pK25$zY#tR=9HiG(RptCj`uQD)Pl4oGJBn|3XG1a<(%AX8S
zJ5S&lD-#zh1GD&ib_S-}U<QUuW(*9MjBFX0Y7-b31immZi+~FG+EfOHOI{2Nmpnkz
z47JlfFl>4O4&xUL42&ZBjP|??%;KO+CTo{4FkFgcV7L?xGH)XT!zGZ;WY9FvK9I<1
z28K(;3=Eg*^Fcy4KtfL$7%p`%FkEVpW?-uQ_<><FxJ9=aRJ`%%GYYaYFpD}fGceWu
zV_>*6n}OjH==hpCE(V56D;O9qfsPcY6Jubww1t7;(kAW?44c960*WyQFBMRDfX1A}
zp(d+<+NOdG`ix@rAY*64jNQ+`aA_|y0~6TTGYkxuPJuWeV{b4pT)GA_RtFk`tUOL^
z4B$2w#9(Hd*B=-*gHIq4<k4r80-5`YnSt4sje+6Pa|VV>4?!GZ28PQZ44U|}`N_a=
z8FVZ1Wm%BHJ`jT;r_75pFx4r4VA#9_RN@Ls=rihYGBAtX0lCJ2f#I?i1H)wv5XXjr
z;j$?M!)0R-$Af|4vI7IdWjkdCrn(SFk=vjGHieaeK~P=)8!H2|*b>kvn;`?k<v<38
z%buX}x51Wy;c_7Z!{vOClqUnj<r)Tt%T*vwC<DXgb_Ryapn<Q3L<WY-lNcB-PXIZ0
z18R{Ax?MSg2~^~=eqh*q2UO%TFpKR2B}Yh^45?H%zd@^1>lu)1)lF|8X<h6qNF!2#
zyy*`l!HaW3BtSLoW)V<`F))jRx_pe5;5aq`ODI4ktU);qG;GWSo|s|S3>qH}XJ8ih
z2bluSO7#qzYoMw#kX3`cI0GbsJfsF5O$TMF+Tsrkn?Wb0fHGBW1p~w71q=+A=P-b3
z-O8CC7*;lbio=x+p!E!_Ox&!XQgYD;hLtP8t-}=z42&mq7@b%dn5FA)F*7h#ZeU=z
zyq$sJGH7J5axVkJ<*N(~moKt2FjbynV7UB_f#LESP^QoU8^Hx885jz57}Z!Am?c4{
zchp)kFkA+ur|-t#@p^`pdqCN8CFnj~9vyF124;y!=v>wn4hDuRY}_9hRvuwsDz694
zdNP-+aAp7<t5sJ1fng>1+}4$#b6a_Id_g)V!E}l-FkBG<>AV9S=x62vU6RWBfnnti
z(1<nzv&4E($Z~*MIjqGDr3^}-_*e-YU6%lzGY1-P%0$T3ulxYj2^!4=jlXAd7BiGE
zC~?XClmTg81)5CT%D^ni4T~O_{4W_$alJ|eq#tf8O!9;bxVut)^#j8y2~cFL0-c-q
zL5ER;lYv<pR5w*WV_>)fI=AJD5<3G^^(O{~EA|WwS8U}Nn5zHDF)-DDR*$R#&A(1#
zV3w>0rGsLIDu|C(f#zXB!k`&F)?$Wos4%FV2NGTjQC$WV22EptgpWXkp~12WG{>w6
z^4bHC*FZA?tOy%G^BW+!ztbm7XA`LhrQEFy%u-TdpN4@}u@p1F%m+<4gCxPT7aX9;
z2Sfm`0?mI+V_=p7^>mTU?}5zCNTovD1oHuCDh8w)H1W=gu%UhhR5@q?3X<WF8A)a-
z@Dh}IP;rQ41!N|SS?Vmv%?(gVm_?A8FlMP&AW2Yz4U{NA9^(GMunIKl4QgsJfr=H7
zL_H|X82lKRDzANDSgio+5(wJsFdBi{vz1R67_Rs*FkJBhWu=b{3|GP#7_NjWGcZ;D
zW17ez&cIYX9jpm-_I;oZqbMlffsUoBUc$g|C4+(CN&+(jQ}qT0hASNm3|BxWTvhL3
zV7M}wf#J$Tkjx1N2L3Da7#Ob1;r_s|S_f3{O*fdyCQ%;%DdwbigZzM8%&ks9E9MZT
z94O7M1TAF<2TkD>Hyi+sp_(x;@V;SXd=6rNWnh+(5=u=;VPIu^F2%sWcoe*?ftB$&
zcm*hETY6O?E8}uThI9souMEtxmQcmZ<)Df;>|$kHZVXzw#=^j`#gmnBtpo$p#2^+1
zhSj;OjO(Qt7*s&F(4A9fW!wN-#01(8Z~TUpaU*CQ%ucS%qCy5%M$l=n;N8;3Pp0e5
zVw0>-XJrH}g9VGlNwG45&a`0I$yHpM%fQMAT6PGQ@u_5mUZudoz#wpdmGL%cY1$1@
z24<Nr;JX@F8P}>XFeYX(h%zwCva>KSs7_>M+zDz-gVy~p%Sy#FFf7$#Wd!X7V|)re
za6_M;mGNOcc=rKh>k2F5LlEyN0|O{D4jo}-1nsS6xWT|In<@l4bCQ*DE@(R+XgMld
zIxFK`(7|<+Kx&=mvohL3Ls<@V&lxC`ZIz$_$Kl4xXlo7%I8FwJC3{#I?LdVFXm6`J
zuM{hz9cY0iXfHU22`i(WF#`hwNUEl9di-oQNevBFMn?$-X1PQb28PzNtc>96Z+3E(
z7#cIMGCG5UmW6@g;;-ooX0tieyR$NaE}vxpZJX2#Wo4`u1TENPVPIfaW@T&xb3iBf
zv)9`(FgPt^Wt3rLV3q@|b#)A9Wt4%e%Cuu(a13Att)*s`1FeS#NeRn=oDVv@FDROo
zkqM*=v?m`V#RQh(N=iv&V4WU6hm9?#0kpL<oRtxD><9yR7hAmmD`*cQv%CNY1B18_
z>o*w&Cb@p_Ze7-I>YyED9H7Nxtl#WF)<71Ifwzg&3osZmFxc_3o@8WXV3uD6QFc-q
zq>O`s!99HX#W`%j^+K%IL_pG_49xPNGcok}SwVLoG9G0Bt*q7OX9exD0Ui3l$H2f*
zX2`&x+Ra)3GEqSuVq$?Z$V4`9vMB;5UN#1Xvem5M3sXT$f_dh%mVpDCr?{YmfwdgW
zW@BJj%Ewv(x;Kpxbfna(cdV7*Fb3J0@qo317ZjP0qbA~613?L75+eh%0%(=3V>oLd
zczYKcDE3%Gkt~ge8O}4GH37_qSPHr{54>G%DIY6nBOKVysZUswL5r9fIY5@GPGpUM
zBzn-M>4|q(y+D?J1zEZg;!`gbkWWDe{RS*yH3#h%{rZ6+0kmk-fpHE4v%){cq|!77
zRvYlm)eH<*RxvPKSpkU=@O2siOSnHUB>VuKTn=glgO@ATyE8E8?qbyin+95<30g(G
zf>jrE@(XB}uwyu@t`5jro=gT-1CWovS6-~$%nG^#S6CRdcow2X4HRM^Elqz|)j;RM
zOad*wJD$t}z6S)fnphBYazYNssftG}Ku%?0<c^YLU{K~~V7RiAf#J$#g`Ctp1{Ox>
za(jj=mlznXoKpZDR>Q)`2VF;e<pl%7l_%UE7z8aqOEp0SEoffThk;?;UKY?5$qdT;
zj10_*@1|GHXOos`VEG1G!_EHz)Ma5{0Bx3KRtlQL$iR?#bo$2mY~uA-85kI@{Llbf
z{Y{sFfl-Hn;i@qM!&Pm?6b6<bP;0LyGca6@1_i#9Ez1)|(9vTb7&Jf!y+(k1q;yRq
zg@NS>KS-Q`;p#jFhO2!V#SAP@<RDj#Uj4(saP<Skk|!DvORm{7FkCa`<o>{*u?947
zJ3U|ln=VHr%PB?%W@YB-tqa&x#Wu4nhuSp*w2={Xcp0;D!Sn+Q*fcz^RWdMKD+W1o
zKh%-e7BVngo2gjLz;Xa4a)p86+8NMl&;CG`*^Hox!$lkn3{KNnW($Jc%E7>pY&YF-
zA)7>y5=#fjV$l9peKnR2&~`@94*fl=Svq8)O1+n`bbv;#LE`bdSvssip5q0FT!$yv
zQ&tQNN4~Svu`z<{#Mukkq*YqaveapTCH)x~q~lo1p&k+dH7G&X%rL7YO~18}O-1E8
zGXul5|DfIft9G)afs6oMv7xWVk_IljIT#rBte&p4h)qdSoFyD24XR}H)mXw2Zk-;x
zh)s#Ha(creHW6J(jbcLv7B3M{LCU~zU7CU6y0AvE5d#Y-Cy7=wFkJUzV7TrEic}Zh
z=?53FiKOL#wb+P&JjTFqy^(?8dL>wkjS5s~3j@RTH5z#gEH<Fck~$0w*IzO)Tz?3<
z%A-DjMGu^5K?#$Cfx*F(MGx#WUXVNVltCtNFfgzwO}AdmrXybbmPMHn6fhqc1bjfF
z*Pw)?`fGaKVm1lI8xjl*H$*^AQ(Vm=3o>=m2Zp#e3=9k!AZ2Q;)3+~XQ>bqR3o<b<
zu+L(V2OUGJHkE<lh7JS64Gm@nX0?S33^$w@7;e~sIBOXgZiF!~+z4W4U{>47z;Gjv
zf#F6Ph;x{M;l@M;h8x`s4DJjJC%ajMz!owvt6kt=VA%bPMF<uF%^z5V6hWy066@2$
zmar+-FJuOtw!^Fry5e(TCNon$cmo3`Xb%E2Q$BbH11AH6$1i54eDD?q7SI+3W~M@L
z!N~&J8Ntj{1S(s=N8H7}V`fTaWMEbY?Hvahm#PHX4*@kU6;z0TYFUtRsZOA%1zm<L
zbex$9w0{`f<nT>nX3Bt@=PAa_6a_MGF?e?oGgFi@)I5;7DDdqxQ0GNCg3JT$*_B()
z%oGID1hNX`h#*-cO+o6QbK;?zg6gfoy6hMjyiYJQc{4IFYk)RdflT)Xjq8H0ga^6S
zTLY#}eJL}OGe{k1@iR!BGqO5oxH`cIW+rQpI#A01q|O@DZh@I+tp_o$o`FG#gPF+?
zq!4np2s4wR3X*dTL8rvRbQyxf4CKcuHfGSCPi76s#zAH#bvYzWpj{{oFiq+<V5`g-
z7;=S}L3g<^Ye4pDF*C`74kZI`=L0!V9(1N5OqV=(&k4w?UBb*v;*1Q;n&Qwn5QhaP
zC}70(VWux^U}oY2sRQj51WEBpf~6!G7^H2O8UKK!d?7|K{sC`pVlZdmW^iC+1~rwL
zH5;b?UB)I;-^tAQ5)}VmK~<1=88c|VB?G7m>I3Do37`z5<*W^Al`%7(76fHM28J7;
z?6KS;Ew_Y$nentT*jk1g7Z@0BoSDL?P+U^Pz|437TB_doz`$_h6{Koq_?N=KAYLZV
zz|dRA%y?CjfkBD$8q-7$c?O0v&eInzXOpVG$<DxVla=)YLthPKPFl+dRBb^nL+)F{
zz^ntl)dF;oTMPq(^<QSj9iaU8^#el-$h|FK_x`YexM7C?q{h4{#=vk>0P2YyG7wMP
zv}ItpX$tkk4oLc7aJ!koz;H8Z3M15wprdS+;7(*_+y|<;qnRd(D1d5OX2wHMU*7Cw
zV7S@N{ehun3CM}l8&<H%*LO2Bu4eqeAOOmS;KExwAd7(^YZWu&YH0=rrFD#10m%%^
zjH}f^JINU{r69qwR*HdHJAi@V<`f2oo8V3Ix-*y=*D5hEYlni5`cS&Y$H1U8qk@4U
z^B6PZRK^bsO(3s>HtsWP?}vJ5stAKV1E}1-xtM|B=3KCc&NwqO&VYJ=gZl$RQw7Ma
zpe`))2c}?!>Aox3B<l||GuAUQFl+x1f<$k<I4F9jFtUK+h?%h$tY3gDxfB%1&9Wes
zU{?uge`I7}s6D{Um<MWd>S#mt=LtjfgEk<798f68z`zjA06Ljt+H&U4j2{^46c`v-
zzzbjuY(PT_JDr$6gTse`;pTA$hMNa9z%Ka=N%;&n-!L%Te4z$*&Sx8lVYiGJ7;dpC
z7Bet^1-DEY7;b%JV7T>Iu{4>18GMe<R|baLnhXrL)weP-FmS6YCNnVq-~)v_1H)}!
z28P?lig^so|3yJtII0;KZtrGbxV=z{fuTW=nGt%AHv?$*@*U98B<qTp85yCP?=&zl
z+yU)+*el7*$O>(g-dW1PaA&>(=-6pyMrlxpy<}jxbDDwS&VDHd22OQmMj2iP21ZE+
z2GBV+cmA+2F!Z=GGs=oGFw~1yi!(4A*nD89TLT)t<St@n<P>6H)=g(-U^eh&V7Tkg
zz;M?WG}mqr@qwXX23S!YGo!sA1G8Q>NKq;S!`)~GhP#m<P9X!s-82S<yD6Z}Hf~@I
zpt~5mn4gL;Fzasd1m6MylG6aofllq?p2qwfBzXZOX~_V+*r5SDZ`}Zzw`O5}36clx
zL$Z`+V7LpiBOf%})KI{{Y;d1}Sx*v_XG=j_eSDbeK$Hig0a!r|1G6zmfiYA8V<r=a
z6<B5tL~FesXm1-6x?b)N3=JzldJ+0+7(m1D%m#HI7#bBoL(<%fm>Gk48JP9HfIQyK
zz;L&of#Gg7h%=pm;qGJxhP(YB&SD0JySo?|?yduI)-y2Nea66W_YsJ*n}MPJ?k@(0
zyWiLum<^6GFx(SjV7SKx;#^{2xaY>eaL<AJ14Cm4s!JdXP??Q)e_&`_0U9}M1RZCs
z!^{}Z%fPH}#mvBLe1d`DUK|6%y%-SZ3IoHvYzBsV=^(Q%Aj|>{y45oqH+*1d1kVdJ
zf_C7jFf%5Dj9CEE*~`FiubzS7Uacnsv++!J24>^M3=H@B7#Qw#cr!2?uLJ93V2}aH
ztY=`jx153D-cnFbXF#?E6yEhIAQ1*;{Vk9X1&hsKV6F#6k3MMmAm}<F)(;HzU!V#f
zK@@^Uia9`Q;u#uP7?_RDFfi+XgUEo4XgC3hMg#DC3wW_FL&F`22?pSGH<0B5mEakj
zh8G|ih;FdC6$}R8e&neM%%GbO8NPyIC4x7Zf%z>YYZ)>ySXnba29+=dpbf4&ou>1y
zW0Nq_V7>|#1DzwV(~0@2Jg9u-1!usk+R%G88pN5eg4T$A<zQe~S2R6*9h*{pCo`zg
z!tfPT97XmpA7uQ%zz-@@K7i^Gqe3+XhMi8#2SF9pItGS&I~W-5Z2%uk&3sT5WGVy0
zy(bI|_a3M*Ff@oW9|X4@7#Qv|Gcery&kHJh4qAd*Kdc`Z_$wd*V;BeWZV4z)_%M}C
z|FMoukhPG3*|1?c-+DG#Fmv&AgY|538X(bQP{oXytfdT`Z&W}tv*4{R4Ez@un2kV6
zUQRDt&n5@bXv8ypCXA^+eGiNoH2wa1HZe}G4-5h-AU)Int!I;}w_@G`@++vx4K8|(
zKu72AbYk8D4mk#f`%(-H_r)N7-2ysM<pu-8eM<(0`^Fj|e{BH=Bm=|!AO?o}enlS`
z_$@$D2?|E@L(Gd9KQQn`FfcIe00pCQ10)zhH+(9sV_>*n%)lUaKO189B2eYW!N72T
zCIiF$sngePV3V%Dzng*K{$^PQaE{_T1IpVBD$Jk-*2bU()}YLE|2_l5{hOdHafN~5
z{(lCB``@`gFz~a090BUEPmEz>08I|^O<-UyQjqw-z_*8ixkw8%%wqbN8FbbVvoYv~
zqn%F7lcd0DrI>+v61Wk-Gu?e7n>61W<_=JbGKQq6=>;3v#C!snOF=#Z`5oN5Gzo$D
ztW+Fi1OvkZc?O0D(i+JO%%v)jy5)fl1H%Igbq0o@9OgP624<5~28IXW3=9uKr(fF0
zrd6M60@7&$R?Nr1Y!VX1z@X8|oXq%v;pi7wKgZ+|#F}I|kYWag2OvWdLDnRL()LpZ
zh6hay3=isT7?@2Sfi<!)Fo>>U&IB!fHF?j#@L(<j!-Lsg9~h2tFfjV}GcsoJE@oaT
zsk35w^(HpH`b1`bkXKE9fijvuq+*-Q$iR^9$ZWv~THU(Zi&-0_!c>C;oFTMjK@I__
z)&})fpEATTFf^`WR%VP~U?@DH?ko!G^?YDR1dU#Tn<ZwVY77kGa_Y{YChrXfh6lSD
z7#@Hw!Dv0J?pzOAKMN9k%fRs9F?bWOx(jHy`3M8ULlFjshXS$;%x0n=7!pB4hz#so
z)m;P`m`%@vR)486Fgyfd6%faWf#D$t8*qPMNHl>i1!JDb0p8{@k%tX*r3bT_{Rf6b
z2T+<~Kcemq>IT-E1u!r?bYft5Xah1OhJoQ>JOjhSNUskJi9Rq>`XHwCflL7nI&tc%
zJAl0j(qa!9?~_w^09|tm>Swo}Rd+B24~l6rFi37ww}q?Bgs8Lyo!tjjX<H9UPd7k@
z3iqpnj&T({0x}ddd?qfZZUyQ;L6us8`-dQvdNb6`;f8|lW)PQCHwOnU2dJs8ZVn04
z2nGh5JL-mDl^+=5L0J-<+s)O~z{)^fABOrH3=9t&7#JRwLBie$7WT^-7#=QW{lE~P
z0=`g=*<1viwK&*7cU{F-Fff}tg9N}w)mt+#9GRxB2et_$0da;NXawX2gEa$#{~mR1
zm}CM(QXA|u2J3nThV6pt8Zg;fh^z)^|36r3X{Nd=OmY@P5_G99!wt}doUL!vmB5l8
z7~(+(AxMBq9P_6T?<s*249Iu885kaJ_xivP9|Da}PWT;OjEwc5#Ydn(J>X{}4I0e5
z!OXyH!3;iO+(z02d{nw21B2lUF@4aWkcBF59)p;^G6RD^B5wwRn7$<gvxO>XyjdXI
zkbyz)qnHX<SrkZ_iX2E8=!Q2xF%?q=27xp-1_q-@F*OO0IH))Z?5!7*0&D03X^;YI
zfGCmyD`I0{sPq$)l>})9xzfp7Oa$EJ0l9J+$OR&549phGz%FRhWMDY=ms1Mljh!F`
zS9w9l@^eao`XHc+Px}+66ewwekDC<S#wjigy44V*)RJp@=QcKt`iYz(pb?Bo%nZzy
z8sPKwIYmI>2-dOt7pEXx)(s*n2#P7NY?Bcu2V6D<BFh1h1sxZ9vOv2U>@d(RdtxQp
zk&FyXDXri;_clJ$4h2gw3mGyn@K|ZPh=A+|U3$!`G~H=Cn@atDZ9S0s29Wq&Ee3{I
zHf>`S1_th>pyb8VJCh4^HfAvcv*i!oGKQI42B0zsbm)UOo0%6Q1G5$6WNR}o@Oif!
zpkWm=FYu9sAVutN&0Ii=%s>OQnPx8FVHA*r?KLx7kc59dM8;MD)b9t$GzOWOgJd!w
z5|D%7Krw1`+Dsc1p;n;d3m0aZX^Vlha4;}b95&MioelUE<l;FmX59oQTn1*VRlLRd
z46|;UgJx0~Oc@vw{COBRf&#$mGAHOlIv&Q2a??|GunD=SFfdFA<YAlz3uSB2=m}>v
z592Hi(1;lqsKvv>I2$}#1lp4@c>xdOR8YWz(zLZMC+LXh>AQBYN!bMRF!qA1unq$Y
z@-X(Qf<jCPVgl$eAch+t6DEZ6Ft)<2YX&QxF0hkLOk4%Dqk@OA0c1QV0a<T=NZRgX
zld50B!w8P+8y^_VK*R3fd};k(8{_~U#%fiNYZ(|Gf->h7a7T%U5p>26=un4;pBWe)
zek}UHVD<rg`;Q6(!!j!##xl^&j~vVl%r-h;dw3Yjz@|X`44SK8<N$@<;fFkorbQsX
z*?`XG28B)$cpMJuw<1t6Jqe^T<u4Co9#~-=*vRSJyV#`a!+999L_RQBfDZJ~02L=T
z*P+hN0vp4?@Q8_l;o%<(NKk<ey#zV?kqQIDBL(gc3>G<{eYA{>S)f8jQfGxRs5bzb
zW1IDqhcQJ2#9~(GVN4V;WneIj<zb8jxxiMDlYzl_77t^jFQ{b++EuTsz{416z`(GW
z6?}v|4`ZYixK1%;U@*SV!{`Lo77o?s1Zr@=bUEpPCY!*zrhnYUCaDIR)Bzc80-CI=
zV)(?EnODxh!wA0SawlkV8f?mRgWYVB^`L9<Kx!ow!B=;hGBDKt;bG(k+XgzbD?^Bf
zksDOAgC_Gp3c2;b3Jn<;Bsh8gg4Efua4;}r2=V*{Wl7KgxbZBWzn~%DDp3Ad%)#>>
ztV#=_>ODvmsD?A1#q(Z23}%>cHP2nJGAG_-2A;d1*@mYKOBsvuix_y$fdhisE}Mga
zVQx6jIcX4|gMmSGKhHT(BitCQFo%KX7)XMF*>25rxjk&^(h5I$j)P7nxB)6i4J>$8
zgVHW2YuH_xp0I~ay8abU3&=Ia%nZzSp9Of5ix_y?Ks}FQ1_n@zNcSgCga|W;RVU43
z24xBGD2Ol{GB9+jFvWlzY!5m`d-5Zu7)?;zaWF8PY-NhEXJB9`2H84+fhhu(lI??e
zD;Ss}l)+sIO$LSo^=VAtVi4pc`+SgODCj6vuyg$%GX;U13(9Kt-5|LjkQ}(+by&jW
z4>xo<NX{Q_XvrofACNw<nTJ7gJ|KNyGYgBDJVA0`Gw<_O)H5)7f+Tl>s@8~XCRebb
z9~fLg#g+&tFF2@ZR4_2PLQH3P<jBDA$kyuvgR21pv%@+@w#>;aS(8~<!L3UMP%$U!
z#N-6B;Rfh3IFRK|AoIbNTNg6fgQP%~J4A!z?7`RN?F8wYH-pIrY&j?|f#hr;R%$XZ
zOnu8_3DO7hki#U9oF&}M8R|@CAUUv^>p*g5AUUvq4$WZ#C3r@T4-9;ueh;__?`W0=
z%EnCU3ZO`sUcQe_zTOP10JMmkhe?Zvf!R@lnSt5Soq^#|ECa)%XgLOE$6(O?NRA+d
z;OpZUB$%{$JVA;elAwrg-OnTeatg?qjtSttC=>Xi8qkr_>FrE1phDFcq|$XFlPK7)
zAZzM)>%k5Z1>GLY0g`sy!z2VZXb!|6A#ei{B)cJvi60~j^0DJCh%7%yb|-@)1G8h@
z2T;3!fk6Nid5%}B7?>UV8M8oA4rL!0%s@+<!SU)OS;fHY(9W2p$577<@|f8P(83?E
z0s$r~P&*kM0vQYpkJ6x?bObFP`oQ1{YQKWc17>zAu3})eJ<ON|TCI11f#Fdl1H+?2
zXQ;9q(A|NqIiOw*tUNi)!0>1}1H+@GFb!K67#`JcU;w$#cG?F9H&C+$V)Ry!5|G-P
z3=EIX`hg0q4-9S@paqU><~)p&LQwg~G7JolB|s)HU03_S;07A70#BqmJ2EpcUAJIh
zcx=hQ@YvLu0V4kZ<SMrZ3=9k=pnE+)_qBl)g)uNZ4g%fTZTEq}?Ez?%jm=q!F^-3U
z*;x*>RK|~i;c+1Y!{dC=!kX)DU`4D93~c@&MIf6Z7#JScF)%!?VgNaYF}(c)gFEO_
zr5T`@aA9O-U<{wh!0>o41H)s`p0e;|3=EGyGcY`UT`$hS7$FE&&BVaKRwltz2(on*
zGXo>2sCc5n!0<#NpMf#L@B@SU0+91TBm;{CQ-UgJ{}I@x8{mLxm0-#jVPJN?1F~%y
z1H%&w28JglAkIt%h9?OO3{Rp!qc-k)7#PF1FfcoR0F5`)gEoMCU~oUfz!+f<5&+E^
zJ2EhaWPD)o0JQ`wz&<EqW?&4dVqkdE%E0iX8pLU5V0dzff#J!HDh9@oDU2EH42&TQ
z85o}YWng&n^)n;X1W=SINH8zp@dT*?5mg|f9jf}Nd_4ohQ(17B1^0bm@Bp1?^aW(2
zs|Pa!WAFk7hNlJ$3{N#coV5%LPZJmzo<@K;yBHXrPGDeo+QH7i7<`<8;prX*hNs&=
zoGT0rPj53YJiQ3w+=p>CF)}a)_c1WAO=SKl&cN(y=m|33lcAn5crA#z3#9ru1H&_R
z28L(MAkGyAhG&Wl49~<tocjz6&jJ`2p1E*;VDL-<c@8v$1>Uy}S}_S)s^swoQ`nJ#
z$u#H#gXaVW2Brj%x7<RQ8JJAt85o{*F)%!<104)tn$5uQ><I(IvumCVOs3`R3{0lY
z3=Gd585o{}wxyW%GcY_aVPJTkXUo83I+KBcZ2<$b>m87?c?=BCr!p`+?*?&JFfcrS
z&%p5fHTMSwZvzG<(|?fIWMoU9%#tygg?%Zz&Qew#CGchBrdt^p*fudRyJ>iU^loEd
zc)`cO@PZ4(Il#d1!kmHOg)!>~2Ja~hOlF%InB71pVSqMOgA9KG5`!2H9@z7e0NFPE
z%3(Hj$Dj`k-k@DGGGNbchkEu!I0M6rKoBRJf#F3X1H+4IuwUgsegzTzULP2II2f2+
zJ*L|nVN<GC|G?l2I(YmJ$QXCfeweu+C#_{*cmcW!aIO;r!;7m73@<J+Gce8dV_<mk
ziGkt8Ggk(txltb&d_hMqh%hj_bI36;&5Z_a*O?145OiDsgD)tB6>#N(Ho<_*d}+eK
z@X`omj1vRHOGgHVm$sltnd`^E@G_2p;boLJ)KIWKcCdjAFPj+{UY4_dVDMc6n$Bln
zb_bu^0N#bj2tGc|cLzuU6iDD9P|#9N&<1}<=}@5jfx%CNfq?-$;pQR2%)nS+z`*cI
zmx1AxrYi$uLA}if20u_itHHqReubTZvA~gm;gu%?!z*_NJqAXw{sK^0;0Ic;Zy>&u
z7iL5x1H-FuZwAH!zYh!$Nsw-T28LI;3=FTbA@-+8ePHm17q%Y9m>C#TbQl<3H8L=~
z0_E+LNJ|EWS4$ZfUd@+dU`%myW?%$s@c>!r?*W=>7iYW&I&ciE?IZ)ktHU5OK)T*C
zFuZ!s4${TI@S2x_;Wanw2L}Hb&@v7NW{)+~_a?B))%)i_ZobQ66+F{$p$xQuA2fvF
z2wFw_fx#biMK`$E@eBtw%>)@3UMn&%ycP#>WEmJ<$1pIw4l;%+244~E4?44ihv&Tr
z1GA?+NEt}aGzNy(ppLB_NY7>lhS%%4KQQ>OU|_Cy0PR%;HQ1$eAPshq#2ZlK1KN;>
zi90eduD$z#ArRC&XaJ=}FK1>3#<i~*7+zmsV0e83#QDL%@P?Iv;q~8q2FA@FJ}?Bz
zfMx{(L5*e>5k@mkai|%f0SgAU%OZ>hpeZ*m&?ZfgL2oP=7~UAc3`%8ScoPq*?-V~U
z1cLe`3~cvB7%e$L^_@Ng!<$JA3~zcs92*9PH)|Of-mC<1JQ*0?9A;p6vzPk=Ltq7{
zwge5;fUg7ujot*>FfguTLwId^)B-l)dPXB~vAfpu14AI_aH$xO|GW)BE(vE~cmwj*
zI}j&@f#IzR1H)S>5GS93;cYwv!`sj$j8NaUfNRUwB8;(MpMp#SMFs=gcM;IRtjykG
zAbsHs3~#3}Fua`r;($zCX~4knb}5JlGV%li!`nlZ42)}Q7#P^u*clkt)-o`>eaFD?
z_L<iQhQJ*l_fMaAf=#<V@CXCrx>}In4N$m({0SbC0>xC%2Zm5kiv!#O@ZJG3d=>-4
zI}-+mcc5eMK#>#L0E(PYPzqxZVGII08Ki9js0L+E6k+sXWMKAQ2h*Cz!0;}^>jOjR
z5|9fR8MCHapJbD&2QA^A25z>5e_#j$We9NK`EY|GBZGnA-82S<cRkXeeJ>vv!csul
z21GKj@GzPPGcfxw!qgpNV0d=`boXr-=psiI21f?QV4DvNVW1EMuU+%;sbXLZj%LgP
zRYIi<4DZe}Fubcj4dOL1FuZ%n!0_&VAOmA?1_Oxn1IOs}st*j|pcH!q6r;Y%%nXdv
zdl(qreP>{J_nMu7ar!a_hW9264DXEs85pO}WT<3doW7BPfxQMKw~2w_y)y&Dds`4^
zKLf-2BnF1}F{~dL!ehW&*O`5`GuAU^F_$!e4wqpF2Vbtu!0dAg6cZ&4pwU-QJps}%
z2b9Sfn0=mur6xesuYm~qa)1RpK<YV48RQ+@L036*e_#mT15yB%1RKUu%wVVpDYpKt
z|G*FqYQsi@t5V+s%nXeG4l*#jZ)9M2U#ZN%`0qCOuouRE&lworFJWMKKQEAh@!vTy
zkYgTz%3}s*-&&B-6JtR3LJDO!P@5?H3j^c7uMEt-i>K?JW|L**0F_tM{ZF%r*T4Gn
zfgu7kvI$OAerC)JjIa3^7~UUdV0gb%nSt@O2E@|Wpb-7V!0`S{AOquTX-3u$3=uXA
z%)ZJD%zog5gC=q~fn3Ar25KxsG%zqRJq9giHvnxQHeh5-XEb1B>hobV0L3Ab#n%rE
zk)Xo8-Uk$ken*@cAYwhB#1si?S}Le8Dls}UFdgyxz!2F3YQKYpB~%zSSeY4^jzlvs
zd=O+{_yF2)d?cNL;e#9l!v`7G4-Ao@HPu@gnEh6R>L-qVP)mlR0OYDj&>?Z))#Tu+
zjESR=0W{s|$iVa<_ya>EXp2M*$T|M@%nVEqY8V(k=rJ&S&<JE;dQcz&B2z$t83{V5
zWEumrKQqXGpws6VBB5sk`HO+ddWaC{RG_U4%>MddSF8d_fUC|(&^8CqZUJym)H5(W
z{QiL<3e*|^H>Uk>Ff%ZLZg%<*!ocvs2gFfeVEE9)!0-XI&Fzs61H*^43=AJuvokO~
zvS48Nu!Di&!?r*Mrbi;6Z3<DK-Dn_dmx3J!@_R8O$kkC5pmLLe*&npcgQ=JiG@%sL
z!H~;r3py1v3KlY;M3V`U2IbXXhd(exU0`5fcmN8O0B>dn#$Q(%7(N_jVEAxQnSt@w
zd!~sTAo>r}L=9yI#^0Pw6HV9|7=Mc~FnoB-!0_Q=AOqvCN1&jOE@5CyTrvIpSvKWd
z_74oPA`A=+9$-^JR~a7{VPN?1g@NJ28)gQk;|dH6A7vRBK7w}Z9=Bj%_z1!#><moD
zof#NDhBGjH3=CvoIu1JPj3L&5f$79u2Ic_pemC$wA<!fVs9J~(VPHDPI6eLxn_Ru_
z2ZlKKn$18PW(KC2_6!Uk8yFZqf_68}jAUT=IG2Ip<8*cgrkQCB3?FwfFnrts;uJG5
ze7wcL@bN+*XwNSPXreLh1oOlQP<_Kx0y;#L89YDd$iQSg;{!ti$YbC{6nKxBfeAER
z_6c--;>SPi3{1uc7#KduGcbGtZQwON!@%&#jDg`3$Y;hk7#Kb|GcbIz2Pyl=!0;)Q
zf#FkdAOn-}7EtUZ=rAxD|6^bd+=!^=KxVUkU`R-SOlSli1tqi+MuwUX3<(V&Hn?fV
z1PYVs)#ur`>bHMjXzBpnC=3es;1kRYOwvag7(S&iFnj`CT`qlzf#Fj>1H-3gb_OQt
z`wR@9E-)~BI;G6OB>e_l1~5tgU|{(4nStTcM^^?WP*!UK9m^oWz#IfR^i76~f#EYF
z1H-5Ppq;GJAlpD`hk<(?Kl2Vo2Il&p^-wE6^D;1e<_2*tF)(~qW?=X%F9)&`M7#kJ
zKPo}yGca)Pm1AI%;qv;x(DZ_VSv!i6F$;A3>L*agO`L)8oA?KYrZ=Dpn)?ht^A%PG
z=HNBV42<6l85ll0Ffe?!0dedY7(PcZFnkWl0P$297(SOUFnlgxXJGv1&A{+^1p~w9
zdC)^+o8EwSWi^2oTQUf+%7F4yvj79=&{*bR(0o55cvD%k3}~4r19LEFQyJJf;N6+c
z7NDbI8JL4Jr@y|yrYhqCRRxL)uqq!=K4?w>shX~HkxjjR4XDfpMHG0$2q@=eFmY&s
z%16eRCq6JVgWCDvIxeJ{nSt@;Ee3|qPZ=0K-&JN{eEEfGq5?Yu<10o6hA*NF3|}~v
z85m#jF-_zMWMF*x98@|tFJNGN?Zm(wA`iAg0hHmJZ-7FP^#eom69#5QP}v;<n)PBr
zl-;Z!7+OR?Wj6zJNdENC7ul5SEkJr;A-@LfJb#G~4DF!i8@PoZ3TguRt1>WrabjTj
z0t$40BL;>q=?n~ClAReC!HU7n`F2o=pCZ9BosF4+5v-w=f#FLdhy&6vlY!yORFKIH
z42)5RtREQKH!v`3*GDlhhcZI#{~`bi#P$nFPWl4cYV63sxT609L;Dj31{UxTQ1n_k
z2F4Y0K*UNAu|*uBq60Jl%D{a~gei}WfjN4yGDsEk#0iY-42&yQGBAAE#lY}o6G(Im
zc*hXq%KGpR3>`e+MD|03shpL8IYLpHfpKLj^TZC2u9Za$3}5atFnqZU60L`nh%0-T
zCr$&)f;{z&f#J(Db_T|kOBfiw+A}bGHMV77TzQ0nfk%*mIV=gJ?<mL(tREOU!OcDf
z=1|bSN01m}J!2-L8K?~CVqjp_a%Nx-lK@93^ne2BiNs%CfR#uvFs@q4z#Il%X9!MK
zpw^1S2Zk;U2FA5L+#eXad_bmPGvN=Yer5vgVRdC-T)FWBLno-&>=DPn9QF$2#BCtw
zfSlL?YMC-HhfN2!H6}2EDjDz*cMP3NK!!6ghk=giV}jVv(ExMe4bZtV;Jua%oqM1T
zeK5V?3Y%C~=Mj+eKwjujfyjh|&Q=BGn=dt>suOhbGAM_nGlFZ^4hN_z&_*|~D#$T~
zOz_r*A=t1GsIpjC`dKpl!xiu*I>xo049wx6&26A~1X*DV(hE9Vk)fl4fywA119SL%
zxHi}@1GB*jaJ|zp1!^*ARSVbwTM%Y|{0Ujv(y;}q47A_~tn36xnT{>kbtf3Wu806N
zBtYo}6p)}oI|CGH+#eV^K7bTVUw@TNvi=|g1CI&=b3{5QZ60Ep$ie!7p(_Ov6A=N3
z_~dW^<&dr#kiB400Y=6Q(DEnHXxhpv9~e5p7ryfti7>UYGB8K+fTH#hC=5Ue^gRQ^
z*K7ucubKG_Oo!Y)Fm%R%`V*Zop!KvYB8>k9q#+|dof%+p(D0Xx2op0W19PMnX#69d
zf#GX41H;!!5C>#XKLf+pUJ$38f#K_728OQ-LE|CKAfli914CyG187iW@ijKx`jvk^
zFm!>+JQD`y$YPMQAm_p|uHs@~__~>a;p<wEpL-yFjs%?$4@qK-9-y+VYYoV0pm6Op
zfmD`}UC`+J2tMMw(+3oq49t<Bb|J{aphGaZ8kj-RZo<G?|AC?F00YyJ5(ehT{h*NJ
zhz1$fbp|SS87vk97P|oz12z4bIATE|-pv8B9yV#fy+j8zZ3&v%2Ct3+Ej*ECU@~0y
zfuXws)Wijm3@IW^6FC`}qd~`57}oD*VEB55f#EA?r@7&A28OS97#O~S4t6oT%)s#V
zB?H6Pr^XCShHpPGba#N7!`+~;3Xz%2%D@~g!py*A_=|zz>u&~zub}gDjD#2%zHu`!
zd;{%^G-6|50No+?O_ZI1$w-cY0kqxao2D!SlPUKHhHmh=i#+uXGVP!QaR3xs5)2IA
z>=_uofzxSs4`lUn6!?HmjtQV3=w1M-ycn3HzJP)S)W(1wFU7<$0UR6~KwELZax9=N
zs>~l4zk*kMaWsGj)w;neqCss`6YvQfof7qs*og*JNT8AilutaNar1$pTLcoP(Xcka
zSMYrS-4;+?-~lRdfx~D5(gZFgx&xq^K&ym6x$mnA*lj5wVQAX;YQg|YJsm9d42&x-
zGB`3Y>6Lw8=>EaLzyP`cfjL&0nSn{Koq^$75Cg+E4-jWQ1H-pI28M4<AkJzAhHu9h
z7`}ndGSJ)3!0_!C1H-pB><mnL2N@W?8!<3^*8y?PGBAA4XJGiA`-PE#NpCVEcqOXF
z2ZkO4P-*~?^$ZOB?)(hQF`zvgmX-_*-|HC|zSn{ka)A{xgGmMk7Jhd<2IiPF(Bc7U
z28Qq53=H2pL6Op<!oVE8mVr42eD)@|j|28~juXgEW-dl>Q1^sD3h5X~PXN3dw}hcs
zfk6gZP=9S;WK0J&alvMmKvh4TZgY!Gx*k-Nuzq0Z*#i-d1#iO#TLm&7W<muhoO|wo
z)PU0f=ol8TQ))o%2PVzd4-7q^anuY@Q#4MMnSn`jIs?P^xeN^7L8GCXOBfiwpI~74
z4oZxg8yOhBe`R3!{#KcRsa|s*(?kww1|~hZ4-CB=pnT8^%4r7tj3KNH%yFQMpl8j%
z@I#7$;fDk$g7g^}e&{eT{7?gN+!+{tcr!5kaP?$h(hCNO#4|Ab$Yx;pkqL?=5TlHN
z;YSJU2Zmk|NMOeP1o;4*v{;!x)H8nVU}Vfd46Y%9miq%kuL;D*;7bC&_JAu?(1Zg>
z%7%eSD-B{4I1Ds?d|>DWg#mbMC0-sB23!mbKiU}>et^zm&=hB2__2wB;m0av1}05I
zaMO-SvmSI{6qD|;4-9<_AkX)K26hbi8FN?}nBzeQ<>)?UVEA#9f#Jt>knh+T7=Aow
zVEFNrnSn|7Is?Ox?+gq-K7u&!85n+wF);iT@MK`p1)UA6C(OX`(~N=PrwM4o0uRLV
zap3F?^E~6%j(Xgl@6$o{{2Y+yL0w$#4-9=KXnucq_XEQW&;l;-phG<9u!D!M7#M!K
zGBEtK2d&ZW{lGAzg@FxBGBB8^+Jd~-$jrc8Z#j#B;b#&9!_Ndz@?XZl@Uwt{;b$H@
z<Tiz$O$-b_8$juHMh*kBzdZwU{A^G`V&DYoATwHllI4sBkPN7<Ee37Iek8(Z1&R>H
z*0UcNc6cx_aD#6CV9x86V_<B(CC<Qf<Re%dw7c?{Xg$k6P6p-#e%22RI~IV3Xc?H}
zK{F974&EyAATvwB#oG?hE_u+tZcugsog@i19MoH45V|4C@(t89Y`w+6@N*^u!_R(k
z2FA%E9~gG*0JSoOZA4i?XImyLkYiw+3_5aivOc7`-*JS2sUFlWNdS%Sg0j;$4)k`(
zjvEY&lWiH86F@~CsKJ!UG?4@3>zzFy36Kjx+fBq77^iD~VA$~kY@?SbD?2L#b0TOs
ze7d<G1LO2_U^zAh2H`kSrV3Wj5ZfIFhM$KS>KT6S2k~Blc?>`IOEWOeIQM~JC-}C|
zouH}p2vN|<pv;N+%nXb(K)OKwyaD2XG=Vv+9~gE9KteCk3X~_xK#fQi!37Nkpt#!^
z1C;|Wp9eJ{GnvXPz`kJ307*@|&n8+w{rd-ooijj-ABBrVnXEyFw9a5<VEFlrf#K&9
zkaa>Z4tQ}rWB2k847<RK>xJt?Sp_&5m@|W!85p~FGBEu7!NBnI13Lp__b~>BUvdl#
zza&7M%M1*^>=_t-nY%JDc0T~?W?<l9U{3tQ&cImT{gi>>S0V$$uXqMq2F9LT1_t57
z49sa_><o-Oc?=A{Di|1k<$*Yr3=F@PFfja@2ja9bF#G~pvJb?W%)s#LJp;op(2PRQ
z0tN=qz{zg`kjz>JhTmok48ILPoLvkIzatnJeg{Z1Fk8BPVAum1Dyauk3=E>oAGH{m
zlX^kfA)JBX_f!Uk-;+U&z25u}412+iJ>f5+%zxw=n3Ii}85nyT85n*qW?=X|AH?Zn
zVEDb0f#LU7b_T}Y*$fQ7&oVIlK5fgu*t>#(L4=8cIT>`lO7BVrhTk_B7=B*^Dci=t
z@cS`CJ;U#ZAl_jHhTlIJ7=C{PaV{`0{1IYc_#?pmfnl!=XlMqM;u@I1nPTq|2Bu@6
zZVTvyN$}Z(;D9^Mz#ziMz?=%|A@!VKVECiW!0<;A<nOBt41YQq82(g(IFA?@{xUHz
z`~ii1&wB=j`oAU&41YlfulD?5VE9|Y!0@*S<OEIzhQIX;41a6I85ny_KQQbCHBuQw
zj6_)&gcz8UUx9q>&cN`uhk@a52Z$5G!0>k=1H<3BAl-=!41c#UF#O%b`hj6@3j@=c
z3<l=p2cRZ2$A3^eVebU+34pc?jP<=@3=ATU49qF3KpMpv82%n)VEDTi#8F{j_<NIq
z;qPUTDIXvQIi-O2dV$YkXR71?CG&kOP#ITH7J$m|fMs-`GVw?<;0DkB7f_i>&^aXF
zdjc|<Dn&q=_WyuNfllUt$w+{5%>fRO43beYpxq{n6Ayl1*!KaHfkeVZSxhAum{X@S
zGcZoP%)s!Em4V?OXj*^bJq8BQRgM3|K{Bry82+g<F#J;nrT>XP7#RN9GBErDop(D4
zq`{wo;h(Q71LGv24-5xD-EtNN=2TEjP7-He_!q^%@Gk-s<C9bw7(_A{m{V=o85k#N
zF);kgU;yo=WBtIep9kbp2IkZNP`ZJf!?<6Ef$4%e19NH)M2wL!gGKPe|2Su`r!Alw
z8X%G&@9y^jX@KxSF$Y?-!1{q<UkC%^L^}rNR8adLbZjI@tcHPc!Yl^nRB(&G5u8l-
z_b@Q_-k+ZRm`$l(0+eDInA2F{fyd|oH4>D<RTvnj=|QAG^UjRjpBWfLN*I_k%|XQn
zD12%e82*8iFDQH_Gcf$?hvwm3UqC&mU7&UGETYWk)ESu5zzw=^28Msj85sU81<hO3
z_XsdBfR5W@>=9&O__vvX;onA3UXWv8__vRN;olw*N1K7+-$@3Bf5$-_3kHUNHyIfI
zT^DCyoaFI=VYd$GOfQi&qRh8>8JIJEFf%Yt3S(gS_l$wz-y;wwnStToUj~MMKS7)V
z28RD43=IE4W$C0^28R0orVI@KL33u4x)>P#hcPhx4+6#6bOwh1<qQn}i$R<v3=ID#
zFfjb@0&zAnF#KQ3!0>-1h_jD@;r}THhW`gZoYM>p|Nk>E{QnH%++bj2FlJz6&<Amz
zGB7ekGB7fPi!(4TUJrIND+7bbQBmf40e%MN^wZ1?jEfI2FfwE_FfycrIG}A5jSP$o
zwQ>xMi*M*bwC%|NHKjo$gM_FLX!>?BNZnKhMuy2CO&}8%GB7gCX9sCwU}RXsz{s$Q
zfdQ0YKYd`>4LTYvhJiUF9pt9Z42%r>7|a<NKtVhiG-!H~fsx@j>j#G23m_>j12jOv
z1Uk((lc^kZX9L6TEueJAz?@+){lHT;vFP0gpensUNd&Hv`vb%7D<GA~qR>PIO47SM
zpxPRd6o6aqyHh~g7??8_PB(nUCLU7(RR}(H25LS;VGmT{ZDb=rc0iK&9<WQ%<v9O?
z)Bhe9aQa{JjLoXv{R6`u&?$Q?ptR+~z{qfofsx@7xb$fK^?_km0O<T3k;|g2BCHI|
z*`O)OHVy_xhPMoi3@_Ok7~4b{7#W!u7#TsQoOb7eHL!z81_m2Zmi?eQ_&TT#1|1m0
z%fQIU4azq?42+Bt42+Co?DY(c-7^^&8C4k=85OxdFzgBeWmk~9K_~LrGBCC&F))aH
zWMIy&Qf6RmQ)ike0isR7!_|y!jtq>9AZ#zkz}V&oa!)h^BVz~yBVz!Flfl5q2<o{M
zNHZ{N|NX$Q>kK$co&g<QD9Un{mw~xHtCg97S%-&#k#Q0OBjW^V24*{mLKd)c1_l;p
z#!6NO=B(;%j10{7AitdfHCuOq3}NB1U;)(`yKXQr#@qx&?XEQpjQ!pW%vqp;C8kmV
zP#HB*0xYuwDg*A6l`4Q`IO@St2N)Q;N*I{4z^5lcwxJz>mRng5L4g4=;y@25a2S}g
zKtqS1Rv+sJh67U|WnMP8n+8?41S%#A)(ftR4jh1tcx5|4yT#vIKrPF9mW;_P;2|%G
z4-5ycFfiNSXZ^r%a0vrrTN?v&b~4BS(12AY(?oDZb8rJl21%3yoW0u0J}?{v&92EX
zFlR3ZMMgRI2Zn=ZP!$&!fRo>@2_Wx6%%}&aw3)v?FdPIA^Nai!Wffy(V9qsRXJDMg
z!NAD4jDeAHfhz;!EK#r;aPuttH%L~Bfsye510&-;P+Mr0_XmbUDWIxOR8o|24JQM0
zt^_j!<E%&qM#hT_jErYNI?@;z8DBCmGCl@ziWwN0Kw|<-OyUfT_f~yiI0SBLifW58
z&Shm_&go)iV7#}Bfssj=fsqNcKIPse21X`h21X`*kjya#MkX%?MkcqK4-AJvTTQ_8
zFqxnOnL%-SC<ok(V9r?r@+c?~W-@WuGSq!wIMl(woCDs+Sj@nn&iaAj&=g23B<CEG
zQX7yVhZPu@1H2iSbG}Zmd&MTks{>h^bJzwXJbmFSHqm;J5Q8@Z<1CF242MB0G(Z`7
zmM#M$Q#=DBQ#2%aSAJkP!~v=%L~TS_LB|#5`Li=H&fLzx2;T2nWXr%f^9Tcjs6PX9
zE~vzxd6I#VX$1o#(=yORkHMl342ONd+T%nSxAHPD=iX;#U^3Xmz{pg;lYx<GD?0;|
z!9E5?rqc|JOebv_m<&!aFo>2gFz22J$$&(!F)%V+;r_sIxB(O_ptR3n2Tlx!6QFHK
zMiX#KntA;L!(q@Y0t*9k?mv(#?=Ubjy<lKudIAcOLmCW>_wF+==Lvzrs+1uOEa(6V
z4+iEuLr_l;JUV3T1e!mD1lOSmkTk?jPzhN9>J%Oa2b=`B7sPn~9P0;$T`Z76u)I9b
zX<cOu#^9l(T{56yu<257*re(Ye_%NLgn@wpys#nfEocQv%xSO~69a>2lLR9Nr!xa%
z%;66VM>s$=6^LXIkYHrxW&OZ#ga<UG!N8mc8z}z11XOe!kpLGRpvl;Xmme68fF`~S
zKw~EP990aA5x>E!Ul}6~d|)_I51NkwZ&1ru2FYE5%4L0EI09P!0nug$lB$7783le|
zI5UHRfpHJW#Dd?<42(v}42;ao42(=*P5}cWvmOH@Gw7-Vqgn<==4u8;=3I6LMxzb}
zM&?}%jLaLv85sQ?J}{hl!BEe{z#ukXg6j=019L$GI|HMC5CbFga|TA{$I1+h{_)^p
z8^(yq9~jOifXdmk382NZ5-fdu49o>Ap!J|j85o&=GcYp$WM^QE*u=od!p6YJ!ovE2
z;cN;6W0(d5bN(+-wAL_yLgs7*17pMiQ2d_x09xD0P|sWdo*01~V1AZ?fl-)?fw{mC
zqy;>H!3drbINQR&7}&_bTmY_=ktLQuVxR!lx&D3!lwO=6Lt0Gy7N9{fE|!U4%Qt|d
zh4ll&nI}+PQ^4(U$n3`1JD{D349o?~K?9uNDTT97phDofngcu=clHZNjP(P<IT;Xx
zfw=&5w+ka!{W%q=5a=*OCJqHqyY`$8NDN{mC`G(l`GMgAXy^DEQ2f;wg05qDwVQ#F
zMVf(;1$0H`s}l^2EO88sEMcJ8!AFo<@zpy9MwT81MwX^P2F6!c8KEcSUK9XD%0<vx
zat;A@HeLqi!dlR2k68?iEbAE<S=MrYV7Mp(Js_8vi~Rz)p>bgjWC=*&4A80>)Oo}U
zZy@uCg*(BSs|YkKYsko$4qEb}4vM&o&@^9o0b1$&oB;~liwX>kF{KO_85tPZHZw4=
ztppv4q0+;^pwa^pla6CxkPcbK$Tp7!bbabFM$UQcMY^fUEE&ZN%cgI9&n6~l`;&pe
z_9sYN;a>)Z!oSO=-+0evSihT*fl+wo2gcw7CqU<~IWRC>tYBbZuxJ1c(<?Htf{uj{
zIM2wyC{p%;F-)KZx1z_442+^q9~k8&jxaGWT*PkDcaWkx9~dJPet-@PbEwB=pCC6Q
z1EV<m2S$a26-wwvF+PVlN)UA9*(D!YW(H<4cLs(_ydaZ4FdBlgbqNEb#4Ju0*37&T
z21XWk28MO>8Ch5v7#P<wa)786j2tWs442+BGJ-aJrFk+kvN15E1woX~g7CZ<nOGSZ
zI_nsj*cljNf|(f@F1~2yXJBB^1~H$vh%qoQ7=f5S+CicYAm(?_^|uU57&$;zPGw{P
zS;Ef90h0O;vGNO}05b!_r3aw%rSEYtF>y0<F)%QEVqsv=nK6ChM>ZRUi|?73Kx!C1
zfliPR<^x4BBa;9qI{HA~oBsAAo4dHeeFg@`MNIMW<qS+BVxW92z`&qzf4cW4HjR2$
zMu^xk1|bd*6XXmB5QBk%p_u{1vxf0NOU4)&*cl;VDr6+Uz;IazJxq;Q7#P@O7#Jmu
zSRg(Vgaj=MBxqS6LCXROS{4q_5k!~XvoLZnFr<01K!O&cbQXl?%>oHp7D&*t!-Lic
z#DoN`C5Q<LT6YlhJ2+^ySs-D`0tr(Va5R2l0fpD42SN-C7m>o06C9>BpV@5c5n(C{
z3Mw&B`e$SXpX;>X10%$HjB^+mSWNlz7(k0v7BDcfTxMWoInJNLAkV<Suz-P)Ri1&7
zRazXR=mVn>=;T8Ng-?vEB3#@I3@q*pjI5pvjI5?0jz0q<>q!Pi)`K8UI0GYFJu?F%
z>rYk&29^X6kqsis7#SE?8W|YbEEyQtv_YI621d3j21d3l5NA3ABiktkMz&2L&LRdz
zb|(f#cF^UrENdAU*-tSrvV%^>WZA*M$idCP$o?Os>@Wi(hc5#ohdYRKj)4(W8*=0@
zGB8N6++bkj*vi1ju^wdgV;%+umUkZ*jdZ4;`@$xcWz4|9v=}rE!pgwNah8FR<0Ob9
z$iT?)h=Gyg4u~Vmz{ttMz{v3n#L;A6<TPVo<kSIiOc@wCGZ`2;6G0qD21d><21d>{
z5XYB+k#ivfBj-#89tH+Bg%6Cz6Q=upWfQ9h6{iji3``eU85mgOLAz5~k1;SP`huqN
zK|-fN#C4Dnj~N&_&oeM`9tCmUGca;7GB9#}2XTHgFmjnOFmi$109rfBmCC@#6%Q&M
zg&7#Rni&|ms=)^5Ffb@4F))C4bg>pPFmkPCsAuE?9V5qD%fQIBkAabE7s$L$21c&i
z42)doL7b@!jNBp&jNIV4p@j^L+#U>!+%_PYwG52htqhFZ^&rkp21f3s42;~f86+4O
z*o+t$6sLk5V9vnEeTIRN`xJ=d#K6dXje(IHbgVF&F9U<(Qigg47I~0V5CbFkGX_TP
zdmv6610#<h10xSNh?B*@$YagG$fFP9lrb>!lrS*zfRY7U69Xg93I;}=IUt!n21cHz
z42(SYL7Z6(jJ&K2j6A;?BpDdkmVaP02UUU+pbaaa-H8lR3=Ef98JQn5GE9H?jct3t
z<qIrQpv>O|x-x?`iiv^Y@@W<|un35K42gXZiM<Dj&46HE`aS){cQzT2si54%05SC#
z$fVOO-k`atE)e?|68j($dk+$u0l~iXdwRitHVG#MklxcQ0Z6Vxun!`M??GZSAlR3F
zPha<gO@`_6h3RL0uxZ;}KFu-*$xR6MK_u}#NNffK`_k{Jf$R#?Lw~Z#*1IyYfX?J&
zyTu^O0b+78FkEr~F&G#ax<LDOFImHQEDQ{CAm=Y&U|?XEfRwhvPX)1+wiXHu3~V+G
zjB=-;rL7Q-(zc#~fpG<-2z*cf(pH#35K`PiYA{G?+xQEmv;|j8;-Gd1BP$!I23zof
z5#l{?Y3svZ3M*}SeHa*dZTQPzr7iCU21edB66FkxtQ_2s0+{y<10(M-Nd^WMpAU={
zpq&y7iuV~=xxfW*90TY~Oh(?1+@SoG#=yw8k%5tKIj98AV_@X_%D~9?7F70?gNP;&
z0otO@GJ}DUUzdTAUlmkjE@oil4`*QH_XKg)F);EkVqoO&0C9FQFbYUBF!KKeagH!B
z3iL5B3bcSY=NT9UjxsO`90qZ2F)#{TVNhliI0v%eDM;u&1Eauq21Ws}<-d3s7+6_9
zFk1LbzxSI>EQ^VOfoUD6B#~iY6qI9N6qEvSG#D5KjTsmPbwL~x21Y@D21Y?|5XXUm
zQ80~xQ7{3-@nK*TY-3;)tOIc(7#IaNFfa<P0C7?n7zHmfFbbXp7rf>l7%gW^kNd+W
zRu9^q04jLzfC|_$aQS$bfkBCvfq~f-r1230qaX-B0CC<iFbaNPU=(}@;{0M@6k=jv
z6#NG&YS<VUg~S;cg@i#IAqGYvJqAW04G>3;fl<hdfl&x_?Khhi1EWwH1EWv^*rH|z
zhI%Dg1_oxZhdUS;g<2UHg_=QzPhnsb>StgS0>udH0tQB*ISh<KGe9zH7#M{%GB66Q
z1#xyTFbbVuU=%t8;v8XM6netIC<H1zSuZd!3bQgW3jJpgU|?YLWMEKo1i8kKfl*kE
zfl(NAWglB417p3gB?F_dDd^D26b1&RKn4aDE0DTO21a2Y21a2I5T}%ZQ8<}_Q8*UF
zX=Gp&?q*;VZUk|985o84GB65n261LGFbaQUU=#*LGTTxHMiD&*MiForY-C^*@nK*T
zaREDK9|MC@3#bs@&%nUW04as1|M<(cryjKcE`$_u6coVF!k9TeJ{MLngNycNkjWQV
zj6kIiq*%TS60xPYT$TZqqlj|&7^1wrOmvwn!R85a%!TPM{!^n|wpE4|$schS$y+zF
z3or>A3NtXsn=ml*S#evlT5@{|Gf7Op!o=<)#cIi|F6k+(z|APkz@Vzf2v)%j65MXZ
z%wEI9&&mMO>*c{%%h<#ySwH<KD|?0lD+4nJ!XyTUK#(dKZU%-RZpKh?M&a$gZ0r?`
zW*`eag-s-xBp4X7SW#?eV93^Ew3kF!C&(zo<{(ie$tb-2H#>U}Q@t#sp)g1=f;*Bm
z9PGSFpgD1n54a&dU|^Wcs0T3>>|zCO28Jn&ptkB%MpFjRM(}Bj;*89E+}u{&*4&n0
zGo~{NGcfbnNHQ?YVB|&eg#{}E!%RkDMrIDE>Uu>EP>{@GG+}TTwo+_lv}UzbWC0mE
zn^BJe>T+=Cfef3&i0T^~Ns#8bFz12QF)++S=;XFkWK@@AV3^Nn!eA&2GGYO;B)57!
zI93=K7BX_doT<pjz_19yRs6&N@(}~WVz7Qt&@W+>WiS*DV%*`x8Y&J6GzNyHjCzdV
zsN%L%6b47MA~VQk%NWfVK(VqM5(tVX89?6S^c3dh&gN!dSivaF#|RDxR!Fd|oPM91
zT~uNfBPdECq3J1XFWJG!4Kii*bRHgd3GX!^!}zQe?}H5!_7v`5ROA2!>{_S<KP2rj
zFswr{M~01oVLc-wBSZtpc^jtZ^RSBrZiFaPlma<U4lJzzvTqZkETf@tsCa~;1T1ZA
zhAI^YDdq4KmI3Xk*}@1)w#}d<v6T^&GPj@SVc*7V2h|NuSPTp=!Ky%sTNq^bD@as=
z(l<C&wKGbBk|88*GBCVmoc@80U97$a9K&xIMHxWR_?A(ak((8gB|wI}gE$A8*+8cw
zzK0kKO}^@q?TnI;O!on#6l$BNFeoNJB9wv?4qWLcSZuOdDuJ^t$g0oazyLWB7U^FY
z!P#+oogjPY_WgqFvstD`i?RDKN=#oN#vWWB!@$6G;sc{6Xduz#1EVKs5st$LMo-Y>
z*NzX2UZ7c9jt`7p5ey8RA|DuoLHo@(J}?G@mIbqXU<|GRT@U+#F&MO66tvg_wEPH!
zWf+(kn2SLpC=8$r)PoN&Fff5Oj)CMr7$UC*>Mw&8gb6S(FoDWxkR%906nH~~KqD&*
z42+;#OhIxW43RH@$ww$KFffB01Cj$_i2PKTyg~v4gCJ;I6G#q(A@bh4U<#mvCm<;Z
z1}i9C3X=y_B5a^m1VomB0W4p$3MOx%u-!$1-IrziTp4y9Uheq#l+5Dn_~Me%r0q8}
z*=w}6Cxo!O@mORe=B4DM#v7zE6lCVcCl{2)7ndZKq{b(wF%;w%m&BK)Co&YK=9b1M
zr=`c27iE^D#;4|$6je^&pTMreo1L0k5MPp!Ssb5HkhuMS0(%$l_DOl{-rU=tSF+D%
z**>$5okw{4#)<5{eADx{uuE>|T)@7Zar@4N>@PS(i&As*%TnXhit=;g!3O1I7ME;a
zu!?;>Ge<#jYH~?_QStV;b?ky{+dH<f2lH}6-D+rHV7mR*LH5<$+b5o7KghK`=?42p
zR^HOQ%)HE!%*33`s??P2LHF1_`KDib!=5?)^c!}I>DF)ACo{2Z-+tjOdpC!%1_vV~
z;V@`ua4;Fn2VEfhfkDH82QKWu!(<2&28Ax$2L^SI>3!eWmFinq7+BbP7%CW)=CiP{
za4~;iN}j+5;xRBVaeQD<?_hwLpgsp~2Z$L4GKdLe(i#FrY=9WS09JeeqPQ4ppCZIU
z5Ep9U5wL1TP=lWB1H*BL=>gx_<ry8O7kp>es6TzcfNcQ-qwog?1||lM4-BVIXu$X^
zIQXEzfXRVEfE%igmH7ix_I?H)WbQ!*Hqe;~9~e%5U}30%n#{6*aRnoU9m)WjeFb?O
zH05|kf`!2ZVhoFk3u6w8PY7cUOGN`CL=4nGf+-6D3mt?@9%KMb(K3LgRi@|sV3%W5
zncn?_-9X&}Y+{Zk11rd3XP{hd1}1iPu)SbCCq$+{`oSK}s50H|CwsPp1`C4>$buYu
z78w=B3>Fn12ygnqpX}j`KGP+Cv0ICrIKaYS!WhV6V!_?RV64LYfhpKzdd4qySqT%R
z`7AB04Qz~oP*;KNILR}8?k{$?dI=T=1;$jCEi8Ljm<m}~dRSMmGNwY3*9iv}#t=wE
zoV3VbOl1Iv^GS;cu=P+cz__4OAUQrTob-rbOo93YVowAMg9u|Xi--zi4vUHob2HO?
z799`990o>E0G!l|uwhJwuun~4;Vfa`Y>?vkF9k};93L1?Z7^p{hPs;V1H<Wv=@Wjl
z>o7)4-}{?gGI#?dtyMzP8YHQKc#x!ad<!_Kfs*+N0Z=9=V^Eq8kvbv5z!(BG7v@;D
z4-7dv(>4FFyVmQlFmti7FffB$n4`nO%f-gR2Exh$Y)bPXj?I;c0i`?!kdj=PXt19-
zJ}{sOvo|w1s5q#Bd;_wE4WxjDL4d7?p@l(aK8t_@V-AZ$G(YnPChedpOdzEoanKe@
zaM<OVurMgFl`yn{e5l~em<F|bf(62E7#pHt0t<r%V-AakIm}G1|No_$8Du~%06A}h
zIeQD-Ne}_HW(Gun=T5L-GOP!whM2d6g@FU+01jowG)Th8Q-}s70dNrkR+p#1!l1&K
z$)Xa?$^3ySjD^h*W@Da03}ZNGni!N9@=RD59AL&dxWkPzaR(PdpdbR_=`a7X3$U_%
zU}T*!?H{{HeFJL`D`O7J4E8sijPWc71l|aMD5(=tOa}8=HYlD^WDH?Bqj*`7F@xo@
z;uS^alKS~9R}_D!Fov)+s4h`u3}NZfn4kep${^P=3hZHFP~hNV?qTCdk(<wA;|ynm
z6FZ|^K?GwMXr_#T?E|A+0jP>)3}Io2U<?I&pONE%GKzaaZf5(y$aaN=frl}Ng~x_5
zge7JN6JrR=0_M%kj5#cung1{|hOum5In2VC!}5h^4lgM6fwX}!$fqhS3@t2-;VeBY
zUo;rQSsFAyXflSgEYW(S#aJKCvc&j{F*q1GJ}^pV7=U$id|+htu>of!u&+2RSQt21
zxI7r<vv8;|W`UCmBd3K5V?4ywoHh!eyacw90kr-G<U1}O76u8%92SW!%zUK`{%TzO
z|D{S9lx)=Ivut60!OU06?61ZL7GwqszF<BwbvK7B^AVOaAev<f+aI>6e>imOxmK_+
zm@}raWXxt{%wajhcmqV;V0^>Kn9A~ov4M#(g{6V%12ZVuXp69%U|qllVM3h4!~h!9
z2lb6VFmg43(o!l*LOx>-%MXy&RF)2=DIgQ3Fr8p#OlCR3Jc9+STY}{S>j|(y_1d8I
zEucyT;k5-U3>=JMEF2<YWeh?N-YQCM3}PZ6T33UCQA~I~i%1S*7|R*P4<M(0VEh4b
z91qI{))ingwRynlmVt>0WF`|BfUiYi`@qPxfQ5ktl>Aui8B<vjGU^#qSu%1!0y&F8
zUOvEh1w>t8e8312e8BjHk;!mA%NNE5CMKi#EDcOQn3;^{gRNpRh7>7`Tp>Jc%pVxj
z7+~3tk?R5r13zO1OF}VYE&~&|&ICD$?E@n>2MdD-V;GA^07n_a#4il>Y)bQ40wOqj
z7}zF$VE}O=CV-OM3zh?{jA0B+kf7!102MyW9~cuD=CizDJir99FM(k`s47FK;DCy<
za0oD_f|W6*GB6|L1sFpiqM@MaAV#o@j6X1f3<ot$K-zLxUVtJlhh+uR7AD3V1{NgU
zEZi*|VB4oRGIPi$bg(eMbS1OA07XVJIG7ldSsIuoFfrz^OkkS8#NNzcsA8x%pJf8m
z3?}v-C}#%K3XlS@CCMyXm=1vKVuF|JY#$hTJEpO4Sk@z1lEU(WaSbRjtzp{2#N1Lp
zAEGY>T)8pw%m{({9-J`QJ}~kuVPP;}D~6Q82G)#epsd5l2+BOXBA~i6ndJlH1}4U2
zmJLihn3$VAK(Pr*FpLbK77-&zQ9Z<mCX6{O9~hT_oV<i-4HI(@<9wDiOgli1hBSgf
zcCvk7<nv)+5MbtFlVK5%VCrFDkvPJ{7|im3=>;=mFv}l>Gm4DCpkXnPYLGKP%2$As
z*$T!N%#5ile-sWVGN!T|0F{iORwH;%K1eml>@T3|IE_U_f~lE-MJ9(ajpd4bhXP|7
zONYV|1*T?@%fZD7zY7aP3}ZS=#s@~mbWj|FG8Z#5$U^=Y76uhia#nF+%x4Lhz{r@-
zGJ){|BXfWKe3lEKte+3EjS-wQKpN@=OjsBM7=u{^B$$iq=d(yCFb1>Ski8?z+`>4Y
z<&NwVSw`?uB9L1CJ1h(?j2SF05g^BaECpe<4~zl{pmHIHMa6}=$74QA%>+=koxnJQ
z5yS=C2X?nW2nz!bD9=SCFs86{FfL(aOo3FW46w`#SHh#fn9QP}!_;HKqLaXw3{jm7
zO4T6qK&}ytVPVh!)oH#j*i2;RvuM~bCbP6KUjY?EZ<xO@gWE0)3=AwR?CjwD$@YN}
ztcML$4@Q7B1hUk(FmGXI3}o5DyoH&$kOfq>-e6`f<e1NLgZTk7b0N=smIoli0-?=M
zkRcW<3_c)l++e-~szUBC|6t~BW|+bRs?d#9=R;M3)1e?ttq;h{E0`NtKt5-g!NQmV
zR>sEifl*js`c*a#{dxfhP}6~#0UTB!m)d|zQr{OWEzDoQ1)%Q>P-y^_UxVg*1IA#M
zCCqo&7=s~oitwH*OyK$jY@Bceqym&sV9bHkq{0F00-$D@2OEcl9P<aJ#Ci!(6AV%s
z2v>j_D={oOE{vcRksKcwg)3Yb<De$DSTM#zT>pVlM23ZdovBrag*}Eb7~FDZ6p@L6
zDHUnafw>37gqj6n#xpQ6a(rME+2Fz$3}LE)*l`R{|BJGKO7UVA78V}nVis_*%gFYD
zQB-2OAv=c%*9}nn669)$>Hh2-(u_LOv)MV^>UCHcB0#A>q63`iIvCf0%63qSVFu@T
zAr?@nox{Qp3auF&GdLK785o(Em>`lep!smHq4PmiZzxLxM*|1AWx)VdA;Q8S!<fS&
zqrg;Zz|z6d0qT~4svx!xjACzC7#w0iX)8HqKFb2e2aHfQ1Cj!Wd<2qw1lVhkI2Gra
zUckX2Q~!pAAqEunejH$PAWWDs;!8jQ(<1^3m>!Y&U}10+i+ivz=z!EF$FQ_8&H#6X
zl4DpdFus5?LBRmE=miUd0a$4SiwC&NkQ~9Xhxr0Hl_l3lfO<%b3@mIP7$tYGFnnMG
zb-|?XFtB`Ko52BN&*9j?31wqd{t-#}M+O$S@{gcG8th<@*)fdaEE7P*QaD5yl>F*H
zFv|LX8VETo86}K4EF~?BjNvRZ;Hsc5d&9!8hmA3W<pA3gcE%8v7wj#ZpyjR*AIk1w
zVGw36`M}7ckq)B3!Nm4~5i0%#BL0ODmfWD?KS1K@%q2e<VHzagfO0}OOUx2R#&A&a
z!whmLC}iGDZ{p(6t(W`*N)u5mGN3BN1XKpu_<%a39gK`oEIo`<K-3gaQJ2heg6RXO
zGWx+Zg_$u2G;IJX#y}PbFh;Qmfcuet;LGMgq40rGN`QsI0u)Pr94rlt6Tq?P$HB6N
zsRJBOexSw29Q7X<rDJ%w${0LUJk&VSWsnktR0AlbREe;#a4<%(a0oD0iOh%jS2_bE
z*9=ZY&CpcD_JL8l2PBM0Tu{HtG_Wv8gZdEejG3VN240ObfcAEQ^zlsJ!p&h{|3HUn
zB4~9bBPg$ebcuj7LBf0%6$dDb0klM#?E@oN7G$OaV<xC(1MBF4M7x9uV-5ow1Hu$&
zD5y9<7!1rTETFKH*}}rWz|<qc!oa}{$_t#JB+mAMAz{MwY90<5j|rgMp2@=R!v#Lq
z6m&iqD7$fdU`SXX0O==yn+psHp#Caj4meNM&u8J00ZD>ZbA!4@2^*&0=iyLb)S1T1
zq0gu@-GG-vhf!yGEH8(qdWa5V4!G1~Fw<dS>I97va(rMgOYi^{8_dwMjFDsdT3!wn
zJs%c^DWIf0g>gP3V+JgRG2dWeNMX!jxdKYy;5GrsYm6z=|MPNaGBLiHuEoa@$0#wq
zlaE7-vxSAhm@$XN*k<}&J`Tz0SNS;HOj<zw6W&q=E~W@jL7uZiX+Fyi))%a(LJaJn
zm;-y4k&$D%KR<^_J(`2S(EtiUMErvM|JjCxA%QWAC82?pF_@)+wSyHDoRDMH=CgFL
zegO%8VV%Q<EIfy;hl??orH5+@H?r^)?iL=#V3ro1Jv>~C?U<LsOxeS8MjBjGK&)r`
zzyPu}oiURoeGe1J0LXF7^I7&VU14I(WVyn0MtZt{Fo($Wd;t#mdKQp|9B}Z4u=Fr3
z0d??}FdblGDQRGw&vJn22uR=v(;X(}5~leqcbL9__+OYBm|02=FwAF}!u)`lF@)s-
z^9yFMf+?&=Siy`ptTWiaj0J3KAdETeE7-vzH#pC5ff;wWzSKilN4O{OfQ8QR{SW~&
zrikAW2Q%)7zY&KxW{SiSNiYi(9pJ)>;d2fPg8@^Q1dD+=Q?Uft{Y=FYV0n<gN<fuS
z2ulm7$qicf3MxDqzOaBqGguBto{?m%&j5ER8NTv3Fa|@$M!xcBfXo0jUfDh{eC1(b
z&|oSSVbO2^)&Jn~h2g6Y3qt{8FiXW2Mx>wzoBlNbG-8#*Vv+!IP)P%*J=eh4!U*Cm
zVcY<sK}7>7b$ktBVW`hw3}q=;!^jv4b2La)hB1VtU;!h%P-ghXz`_8kcq2NPpcb-y
zVE85gYN_Y2ctnHp93()#Nq{^T!Q$|Nkud_|wQnixj9H+>0df1c9FU3}76tI&pJohL
zFUJRlZ&yq}IS-@|<hXANpvG+|i^Ud3#!!|mj4!6|72=Sx0GkDAyE1&|U}3ny2x`PL
z?g2RqMHo5dJz(53onM$kQWD&?2w_nG7e+cQEDmQF8ADjEFm9OcD9j-|IiHWWp6vs}
zcM(XN*a0*$83GQ+j2y-smYfDq=&^u8lQ9QeQG)_?2B=8LVcElY1QgUq7|(zef%>S7
zIV=xAUDIL-mIkICPzR-lX#*1|Zb9t|25=bz@-E!UP!^Tx$Amd_>NhYkhC<7GuxrkM
z!r%(1Lj;K?h+dFB9Z&&UA~2tYg9p^0)@fl=7MRb%Bf`V{fk~%@t%pGg#21l3;)~2@
zk<dWm3xFyfjt>mq4L}_#P@KtsVEDf!1C}2DZvh1XsGSdqz#lHtH;QoRF?vjYAi|+!
z=>bWK4U8S2v<T`avVCCq;laWn4s(#ld=`xY1P5fp2Sx^i>DHngl8gq^Lq$2v>J6qK
zrM4dzSQsoAgINL+U~c$vK^zorETDlwFk1wcTz@<O)$$=M4guit8*m=@@dA=CEkGlp
z&=5vZ2MT|-4-9`DSQs1_gIPQ}Qb2A8sRZl)8vsh}sVo*bjHxU+1t6Qjy&Omq2gyo+
za-@U-V-Aaj4Py?AO#xFeXpthw1dzEAAUCD37+5f-uvip`8X7ZyV9MD#JwS{@oY7!<
zh8TxTxB&};04Vtgh%;tFTjUHsA%Y?-0v@2&Ey%M!Jq(yR4uE0^?6RK~EDQ%g{ni_N
z9sJOo2(lD}**-A*teJjWj6=Tu3g3S|u&W_1{#nDqum@CbUg2xuhXxbGxEY{sVG0ZA
zB!(209ej`ZU_-9IBE%U%J5oViA%<T9puCvOa)9?WFL<<z36w*@qD;*!U}2_a7HGWw
zVPVoO1~qU%brQ%;Fgq$3L00SlSpmwaAPkaTFnyUghjPRW=!k_0C_G~-V0H7)8Q??-
z9ufXkq5>-{ewC<zj{pJ%(XSdA#$<5Mh~d|c8l*sB`@ryP&vZoz4jI8;dq5_Fq8;q-
z-zL-jBsj$Dp&S+l3s6)9#4zTt#DJokrJ^3}0BErOHUXu_WR`#e#$=Eb$To=9JuD0f
zjKM59;It1av0*y)urSzw%(U@f%wh2WWgwOun3-%J7=D8_)+d7mL8fthVEE$_0ChXt
z2ZlcZpiW;h3y%vV8bR^_pkYby1kRr+po{^Y>-aMTRPlg&cMN}yfC^gh48Wf|94uUn
zUqI;wr1gsr*l3Oq41X=a9Ustv?Ee{pLCK5-bO`$ghW`xqOvMr$9~l07fCl(MYqCKc
zkf;cV;lTh(;?PL@djgbhf?0fafXZD^TM6p#zbB^WNpdL3gA`bU@`$wyV;EQ&WLO)V
zoc^gyUoXiaSr2Z}F#KbIv>XKz7(-byY8Z1^Y7T&^BXE@ey8vqJfu{`qdsslbsSN);
zz@-5jBz6A>l{Fx{#4Q*@7}!Bc0;~YEs1@Y$1dtKnQ29SY1XiH@pCJMcTBy4}{a|5`
zXUt-ecLCKK(54L}R6h%-fHET}#6V0)H4f9}F@3cZho)7I47BQE`@rz20MsZ9VJYYU
zmuQeO6C{|y7zP%EgakPKd}^4^C(R)){s}ay%2dq3!U36jgh;APw~^+MVPu#dDa|3z
z^kK*JDrpW4y$^R}khAcI2P_PrIvmu^U<_qB!#D#}cR=Im!-MG;q&dWxK75$|LYhOf
zJ_J-QWwB@+0o9sE7~e1=`IhAk;|dnWV3rjuS6GmRudsXo34dUjfzo)K!McHsF_>io
z+Yyw;;}NzekZ}yK7v9#eFkE3_j9~e|vWJZ^qMm_~ogGwkfW#R<%_atRQ2GW<)3JSE
zfQs^fh9!!@2cUt184}5FTR;(%!y><fnK6`Q3CjT%(0D1!8&<|pmMLso*bw3WzJ`TC
zhcTF?gJ}*Zae|Cs`@ryyfrUXvmNATF1@jSRMsO5>N0va+5U2i`ZYRs3!uElA3JYV%
z<U~GEP*dRD6BdRD_Q@<^lUXJUutcQrK$uLqlbI&-u%r~g_@Q8aK?N$mqJ<Hz7u2su
zm7T%3fst=A%S4{ZER&fg3V}^n!_>nJ)8fI>!@PhQRnG$E)gX}^kd`cv4oDh(?;*^X
z3uUg50bL0O^&Hy=hNDNOzm(%pW2~7jAkQHsQNzK^#e4wbZ79k1f#Jx3=}z(-&P+${
zOmCOxurL$=b-!|01hioV?$H1i@T3UG2Zke0I3Vpgg!W@R(?7^_=ri(6S5V;4XEd1}
zpul0o=rFxmfkT(kVfsb|4g<RgNCawtx?SMBeQW{PNKnQ)wuc4O`vjNIjBFnm)OJ9J
z8+kzUZWb1dInx~#IUGbmHX?l1asgCwWKCbD$Pv!edSd#2MGkSP)*CDg%Ag@(P)`BU
zCxgVV$aDiG4tZS_b#T4L@qyv3hB9M1B+%aK$iqDP)<7Cu#eo!<Os`SmFlH2)zCnpY
zNnb<*G{^@ofa66p7_*?gK!$h`P=hv;MM8t6lR+LdP|fjyA>Lp*qcX<{$q>*A0eKPT
z4@|xRQy4k^OK}*0dV0Pg(;q2w*!z}T0ku@JSQHG9vK*vWT5^SjyNkgHH0SKw!KTE(
z1}fOl1wjD<!fYQH%sr;(sc>jBdQ6|C!l5Q<egZVOkpUX;DglQpBp;Qmn0`}*Lxyp~
z^lvI0e)SBX5X@l_fqTD10Wu56@qwYFgo7<-GE44c=$viw0|ih3fD7Z|2MR1)r3Rou
z362j8#SaviIVT`<8lW{#Ns0iQ;ERR}Wzf!hNe(+3<h~M+s~JF9taJ(}t!1(B2OtLl
zIE9ohk$^=@=@xD9U<1bohSDQE;PeM!GIJ<E?JB*%4_A_)4@<433HltM&<|l#1`W`F
zG=U|-@hFEP3vv?M2Zln>02E^ui*UvCM0XBhrouhbOVv0O823z{rp6%`D8j<lhBUWZ
zcmY(QGJ@vAix^lyll)*N3j=6!3Csk~lDEKT$%{l7K+_!{%Roh8k;!ycbq*~?lj#QP
z;H;AX;dQHXC@`8#U!%^U!Dur5syc^JeGDixz!h0hOa#nRkaCjk14Gda7KQ-EaFz`4
za2MEnMKLzW$~ZnS6dhn;Enz5TP-0*N<-1}L7RGQ$7AO@Ffrqt<Iy@i^5MeEEz{AYp
z01IpzP+)`F4vb9T)?i`D^radcN~)k?D8^(K78bUi15q|A(4_%|6Bxj`3Y--So=ktE
z!6Cy`@MJodCWlPD1q*{YV=|~EoeT?=f*&jl<&2pu6*VB2uyA}}DCA&ZOl4q#F`+9R
z3T41$2q<e5%CLab0yuyQbvPJP!3|P|LLCk!qxlR>ptvYBfyYpx1;j-hAL<zjL*TwF
z3_<c_VS)fOO<JvBfO@<z0pxLT@D?TrfCB`aR!t{_z*42@gc*z=XM<d2I>!Unq&8j9
z!N`~l>Ert?5n&VT0Ot#4Es#3DB_g2A1@b@J2L=ls76#Cywg`AM3nU0iD#a<&{j@kF
z{HL%ma5LtxaEmY(GeV1-;uWB53(1-`;BpGaX5(StF5Cdin>HHEoDHD72paf>L`J~$
zty&!Fi~-Z{YH=tr229iDkY@~-uAt4K;u^rhPyrf~2aSayxvpRa3xf?~FpCSkRavkA
zoC!cls$dHXxUC6tG}{M;f{f{%+8jzuTi;AytIeSbqOWLkC|NmNVP=d5FAQS)z_87N
zg<%IXV;su?<_;FdI7s=o^$iPCCul?xWD*2}lsZf|(BW`p+O}hQxekXMh@P&)p)Iv-
z2MdEWQw0Ny^&Lp#5u^j8{=oD*IvnnjOIR4>nd%r=LJFAb7(j!;km7LrlIb?O9Fq0m
z>B!*8EFqIwSV9WeAS|#lwhs*3L9&eDEFlH3%(8up0%It6Mh7Y_fG``>Dg}ouNE;7h
zCJT=MQys`u@Bl2w2ZrrGWSGoAaR6o4F)-MG)6@1JG8`2WQy4kwrJ#vz`yCPHIt7^8
z2cU*5II(Si!ovufQ3ILqVY+}G#}!7K=}+}IG#G8B^XYTwGulkI15qv0^Yl5C<)&Q$
zMOY3?#uU&H#T3RljEpI;;e}~;rmxrM5I3E62UK6Aup~?YNrG*e&L99zyI|i;2UQhJ
z#VX*5Xh@MUon!lNeGY3zCc7)sEetvIKy-#7hd!gi^cjX6>PjUn48n{#EH1&Yg2n!X
zIEV?_FbGP|_HU*?G~|$FRGI$YkVApdW4eM7hlWxBq)IZe1}Oz)4Tm0xzo9W|Ycf5{
zh(kfW22x(ZL??i{sKG1(@{Bnw@}PbV*bBBtrf)Rjn8g?|-N%^2x;_HbHppaAK7c$h
z3Gqx~M+2z6&H$cYW=Pxt8aB^ik+uP~{XwosT*Je{CBOj9Z;5NT!OaM8&?K3FI%_#B
zJO(huNh$&?4h||%#YrjxkQO@|$k$E^(|JrdWQ@S$TbV2Z;2sBbj1*EhI4N*2b%Fc^
zHr;UwsCkjaBGEJ5Fpooo$#Kf`0uv5t{wXX-io%{u|7gM?%@p=zI-e<o{%FD>!`K26
z22p&bFrGA*WddlnI*Ucb0$jmqgZSWtY5^+kU`_!iNy`L?Es!$ahi7`9DTgd0&-68>
z9EyxC)6bc5$hmqv0OdHaa-T0UT=PKtxETIj1TC!v1sp<*fdRDD1u6zAlNp#m%P-hI
zFt~P1H#FmrW$c*lZ^og>xMO;u8HbYj9#FlI!D1f53$C&ZWxx%n`79wRe8mjRADBcB
zD?vmcVFk(2&ReFRGUL!@+%o+e$S8s766PEpi~`dW%{i3hLDLPaJ>vE%^I13~SbN0m
zLG=?@H`@mW=YZ*p%)uq$DRT}r#+>ON%{io1D>T@c-+ypQf#yhO1Rtyq9HS}I4J|m-
z7*nQ4Sa7H?9++Nh!C}vM0A!_zuLN@sc;y$z2L`7nDQv}%rUST=3KB^GEsOZ*0xF$B
zgR*QN7=lDV<3a}WK?ym7#l#<y${;=E_?GE%mK^eoEz|8RIn)?irl&%v9!m}tl?{;0
zCJdU(1;<7F7tj<b#F5~H6nbO&6-y3HrqCPH|3hglD-Hvu&>z!dtT?0?4@@t&0y}?>
z6^9bzf$96LIGh-3rZZV{IDr<tf|kq}K-|OefgxxIsKjSr1u@@ffJ=N3^9!hn!T_oV
zf_1>v5H~2ggGD4*9K2NKGr)MD*~g7b7~p)CiBA|1vMduHpzuyG2+jxX-D6^c4f+L#
zOuu5yVZj(Oo!5p#mnrzobQ>EEJ<SAI>ihqPfdP`2Lf~TH(i~hXh9pd%Y{PM#sqfD8
z99s@;2?-X49?;~@62=BD@Om(CaP><}UvJBy!Kg9)hAl@*cmb$<$zkychZRfxCxpRF
zh~hsGX%%yj7^wFRN*EJzAZ1w(^J36ygCn374zMl>L|el2$#xv7OcQQQ-(|<4$2ej7
zOFIrX#tG96>^bZhCrr<`=dcr>@WX_eLjzO^fJW3985lr4qzON!AF=1qhy_Vb<Nzfg
zjt>kIet-wd7(uZzk%57IA_Hjr*N%Z1T>#wpo2a9~4AKgYu89UJ%oA6D=S~@+ExL&Y
z)AJlTq+G!T>7)t?#z;s>IjKT|ne#m~KTN6+V2p$ezD=qS05uZ8iEmN`q-g{S3APUm
zlS`(raNy7u>oLIe$>g5tFC92EV|on0t^vo;<Q~v6FwjoJ4-AthfIL#lprj1-2(kd!
zBa`<ad1Ued43A7c0P=`JeGLm}mIIVHCvdR9d^5p90@PmyCDREO63m<np&pxHA;1^`
z@z?|lgvTaWz&ytBfngE{$n)U5Jc&bqnez=a9wu>cFh)Ys-y{xjlz@Cy&oGID1KeN)
zyL!@z2vBfALidC)D5Ha%Ht7UtnIt$)CY^|2E@lEnJjVxy$t<Ayjv1`vf({E8Bg1?K
z7!PC)6Dw%Qj_m`(qzfzz3@j5nSmuM8iCHY%I$#b1lOf2DlP-WNF3<uFhDjH6zyl#5
zkKBQD0AZyCIB{k>OyBFo;l=1Mox_>Kjj?CCzcYs>W6ktRXAU*d72pm#iu%eM)3-Qt
z*fCY!nEu6?!;*2wbUhbvY31j_F^{oj`db$c8O90Ixm-CsnW`R44|V0x(64$R0M2n7
z9~i102ym1!SgMqOdP?9ht$HB9!o>t%xW`a6Vfq?Z4rSx2Gdvt+^(ZRO@W72Z!vodC
z37%61<->|C)0x~j^clBIH*(|93aWU*!f=O?F@og@;}_5@704HC9~de=urQneO|;x#
zd;zM_z%f&~0BJ-HT_dPp4c0h)og0U^ImiG8#w-?wC5((=EMQZ@V1oo8IZ($8A`DuN
z0L>Z|AEy6t<Ipe)0k!DBef)|Kpp`2yCMa%UY;fXX08gMZl*vpFbLWs}l$l=U&LJ-^
z0~!U)V99_C(n;vRCd|PxStc`mi#vxVW5D!#?i@yp3eyEWID|zUW-x&a2l*a^**-9o
zHB7hg;ILMN)+Ij4j5#dH1&pCA8$c_qLK&Et!Ck#_h3Qi~IFvGd9zdG<93L3U0^&gh
zA1H;Dg`8o5rK_@taB#N|q$1`FXx%%c2m{&m0@B4{Il{~|k%Q$3^BHEQKG0EF93L1e
zO5mxB?E^!$$aHy64jD#~={BAma*QI=qdhrP7)7Qp^x_cVMOxpVEi!$fCr6Nl2m@m#
z0~0$3NGAhh1_KK#E0hDyH4t%*P6l%o<pw5j#R5tr*&@@my*Ly==6Z7YfYT1d?uA|)
zGK>n-_d%%JUL10a3e$giacD3qOh4z%;WIton}f|l0dA?e0+OZX3Jfqy%@r6hEHzh{
zzSf&V0b)`FV+?2nM@kYr@d^njaP-B-fQHU8S>&fLRN)Ywp6kQGtI_~!tp~HHK;}C*
zJ}|_-L9~(~y8cX`=fk0D7yE~WL7Xv@MLYw!bq6vYtSk=H;9$&Q5ikKwgat4+GlB{n
zXo84Kna=3TVaeqCV!DklhYD8-3xft|F^KPr=~=!UT8ur@r$VR$z8q?dJ=352a#%9<
zOjq>dkgA_@0aPW1u=u=Tg0y}?p*&Ru<d_^5@fo18S;)iz+XsfJ8K4$v7>kHLV=@b9
z3Kg7y!0wwG!NOn<USsiu5thWJ&Hy()K&fr&27cH`&(tfR?Fit`69XfM$p?n1A3*a(
z;G$%z4XFBpGofQ1QyoBMD#)*3s|>eHf9J=c%(n%!3OJL+!=EvO#lK*>Vl0O!li`->
zX8s&<j5X6k{W<g*Yo@pQa~Lw#OyBO$Var%E{i{ERvW&qG&<IR0%M`{vpy@==gc!(d
zwhs&jHQP-BI1-o{Bc@Lc=Fl{WaA3>=*AI+d5#XhRAeS+EFA;z?q!_)oNPw9j{UEn7
zdY_qI7s8=4T`q)!o$<_cwGa+D#xv7hLpUrL!7|21IxGw?Ky!Rsm~SwH1DxXnqfbN+
zD9}K~J)=*<6j(%nP4sD){y2nVxhxCZQa=$06K<)W%Jk)-9BPaz)6a!+NHD5Qe;&%A
z!8m2QKp014*cnj42zIx>2Sgvo2S)!0n7i3NF!~p;FiZ!n>HNa{gBer~FoK#cU}2CG
zS-yaJ`yt?tD5zlv)-ip57>Bw|0SiM1GiWI-NGE8;DyS@G^j~qG3AO}3umNl*Gsg$U
zzzGcCSsk#i0w+vY3g=L*pRk{ivzP<2uoKb^V+_gwYXPlY45|>}EM|epGC+l(35hXi
zK?OAM**-7^gSPUpbuzRvD9&e5fDDX*Z30Q~Fiq58;ZbL5hX)x*RD!Kz`mt~hL0<_Q
z=3)_0b^>ip1gAAn<A^ah1mqAH6STbwG?fPu2C+eN+#oj82_Tc%J}{X0Ojn8E&}H<Q
z9u&c$!ss)-Jc2`s(P#Rs2o70W1{Q_{CYSjv6%!blTp;!_n1;afh-m|e32t<ld=LP)
zvOtv&C^8sKK1^4L<Pebn%bN0_$(r(jWM!FRu1vR&<dD>hxdO_*nJnTCsAUPq2Zoq8
z(%|d~axW-+7-AHrw?%U3GAc~p63L;)s4)F@B!?!W!gSUs4t2(g>AF!I67n6Oq2C-9
z6@BnPJVYymWc$FN-!eTViX)1#W%~Xo4tJd$&|J9zJZS~%rGgR$gMkI8@`P*D%b0Ey
z&7s4XF+Dz-!-_Fu`>bdVZAQiw(~re)s4<#se;dOwm5EVhdUHI79iz(hL-8E?j4IPV
z#d8=ls!Uf);P6m4Is%FzaF~FY;gHc%5EHbf1!NK12L_`%)2AkI$V(dC0k2*PXPLwJ
zfeG9U0sG(R&h)bh9O6tyccwo};LtNM`U09OPG)IgT*Jti%rb{*0~5Fn3RZ0F0_rJ5
zvY2!r2^#&G?vcnL!^ko{HIc)Nk!AXvL=G80@akHF`7A6sjG-(gCy-|QjBP-D$7UuL
zn-r#IP+y7T1B3Av7J+648_=AC=xJDY88T7L29ll5mc$_^IRjLi#Ip2&MuuWR84@yU
zX*^@PZ4!r6z3~mu{C6x%ObKHw$n&6*93mDD5(AZ{5MO}RMS#RW8+MVz;z45Z;3AK~
z_y)L144TIQHz)E9AOSOnaR(@1z>B5QVAkYUurO$IFs8AD++bu(gSDnWTFMzyS>`Y<
zU;^);11V?wz>se+oiUk1nbBanYBGmmQV$D*0LMfHHX{{f@V+qSVp(YJ$e&=tF%dKl
zt_&We0lPFG)Wu_JW@3q{fCpazivW(`1MSN!V41!nnL}P8{|#t}CZ8oFg)tuydiigr
zzfb0nW}GpdJB34qamI9m6b=o>8Pg+EIApbEurMSurn4kp0H<bgczccG1B33B8c;t4
zGMu4%W%_~?4heqUC*q(I6e6g{GW~c8N2X8*KX}L)<aw|U&Pz;pO64%%b6{cM;O+wN
zS7a7iGrb{|L#%!cXo)ze#ytN*23oYRePB2bZXD#Wh!?<yt}e*PgH~z=nL+wKFs=h=
z`0oS51(^U)n-Nq-f!L6iHk2pN&HRBW$P79p1F9JqF4!1=MmT;J%vXgB#$U)`7hDWm
zI|$lO$t<)%3G9Bh4-Ds8rdy?P$i+jP3igq^1gM0_V&N|V6*#bYdFUb|xFon`1Cs=o
z2<{p#j5&~gue%0lJp-t{173VE-)H*vG!9uAAJB5lOcvt`&@#Guc=^NjfnmPS^bctq
z3OWs-!Aelc%rJirXaEn!1O<;DXmJ79-JrZMy<oacI)^r6!SsxD4%x5*&?sXDi}DL_
z+@iI`r-NnFVX`POKYa>l4H<Y`8Duuw2ZrfKSQtP%hnW00rr%EIkglH&+78Fuk~5#h
zq=gYg!?FZef-wao3?8)Q_`opz1@idq3(x|a9tqI+Z6Ks0Km7v>Qz6JAjt>mgCqSdL
z&<;)Y6&3~-W{%YPEG+KeR0mRU$DT2jVR~r>hX|v=^sWpJCq|3uXEVS>`u7YDWk!YR
z(wQ9Ej1#82XL5Kl&X_(i6I{;k1W^m7Kg{INWvrRbpT(hUQv)idtmd;sWH4FHXX#<=
zVPvub<x9|<1ltFOTJTVA7E4GBV-`zH3Ue2D{0y8NY9~z3%i@S-jF^5Vi^GgDVmfm+
zhZbYRbiHg2ZN`Y{QP~_S^1UZOV^H9(aqk2JaO)c!M&RnMcf$0!*&H&=6Id9g8$9Qb
zkeFb=G%*6ai-Dnc0&EK)L+^s=Z?ZWqFeXgjo5P{Zm@xfe4u_&<0;rVCV3ARWjlJvE
zfT{^l2(o=(i1+}i8?#u%8yKf2N^^)zx6kEZWs3MP-7S|xN1p>aL~IRhz%WD#7{h`#
z(gl>#ASo2=&4?+}7v^#(Dehol5Mi1a!y+QX)EC1dW5F~rhJk^Z8B}tDl3m1(=}&Sw
zlw?547=u|rlSM2t2GGn6Hb~QAx>6p83Zunz_dE_c;WaD_0s<wBC5(nDN}$Zg<R>t_
zB9B9rR{&f%fVF76nZ7EILq_`s3xf}1Flf#Lx+}%=4Y(D-!0~|*!i4yn(euOfk9i!z
z^%bBAERGKhmuwiAITAplD4-oYY#$gd<$%0lIUl-NIR&(LC1*4D9|kEd76usyRY>!U
z;nE%v=-4sHU`TO+BnCQ^5nQHR+9LuUI|h|ymmMs?3qLqMFeqO3*Z^vEgR}qTJ;vY(
zIIu~OGV}7C=}YoC3>ZD8U(M$*XY85ITfiY*pTNQZS|!4=2DDlL<WZ0gwhs(fR6z6c
zIV=hqj43QHct7xh*4~0_yiza+yua_40mz3O9~htlOd<uS0*t>bpdPzY&;#l0fK`Lp
zAX`8SD%rtB(v^zo>k2qDT`E9p#ti1O*f=m5&S&wc0F|_0?_8Oo0`3rj47i{I8?L%4
z0%9_PQv=9Awhs(fFHDy%<j`fh`e3?OA&1s<sX`7O=}Z=F$j}<ttZOEqVM|csli^y<
z^x1_R(v}q(Ld6UwsvQ5NtmKLr>_I!lm7t!v*1#du1C#54%Yg?Zt~E@5U&s+=r32b1
z1a2$cb^s3ufM!~+<uHI^2F$Dgwa>u^BV20$mBlP<93L32H840#|5(UjJAF?P2aiM!
z3&Ru8qNF$MZ$QJ=p!O--2Zrl8(;pOZ$S`(H|69bNQC|aUBt@`1VY|S^7{PLbYl;+O
z1Oq21T5c3@fQn_`7ts9$40q3f_7_xu*Oo;vFfwy|V7UE&0lXv`oXqbqurQoqW{hCD
z!aPA39HJ0m9#DOg!@}PJ83BTZ>m3=;==$^}#T?>>87vG>Kr1lcFs%@R_d6Kwpb3LC
zLQJff{-&5iTBsoev||(`3>nP7b7Hz=35T54ls~-icz$x`2xO}Y#|MTx83K^93p(I?
zmt}fl35NtD%k-)e4tYk2>9a~W6oPeF7%CXUSynK<0JS_pMF`smhPx%8<*U&w2@9AQ
zK_|&`d|<f81KQLA$y9e;IG8y=Gvc6tyX&I?Eqo#4%6EIF^OkamOHN^7jE1xT?k>@Q
z7AYX3*G#u9<q+qcvV#ZKV7RwtdSWSuFw?yg)5}UZlw=uBaKi>a?}OM;3`{Jb1}EDG
zhWk9zx0Z6q>uP{PGlxZZ0XL|j135h6z6%S(4kpG>mIF*JAYo>h@N~v94lxOcY$QZB
zl7SU2t6#<;#kgd;R~d(5(1Rx~;2BzQz~7GnjVa`?m{@@NC7^NB`#CJ21K`1>$o&Qm
zCR0!%hp1h{!mtK1^w$AuP=lfg<lY_A_m*);7(0MU_8b;*3C3_1mlALjpW_3={UaQp
zpo19qL;&O!kUmh!eE-RGj&cr}dL9O@YC&*=NSSdyq&e~cRSc~Afd@o4#|MT79-!p~
z;GFs(05lE=WwOI&j~}#vmoq>^^uZQTREM&ZOo6BcI{-|uePDRNcxU>Oat<R#lj+yX
z!4)-Q1&0o!!gRd~4iiR&>B$w~j?d%@4#WBfThtkI7<l1Yx3DnquuQzlFrS4-oiT$&
zT?5R4jL1JUVPKwkodMz>7>5D0GUH(hD1U<&X+W4@?>(F_fe|#>4=IQr9)V1)T7X(;
zAp6)pFg(nD01=dSV2p=aa)yC<;yainP!2dS9<`{0o4p(#7(mPv1}0E>@@NJFV+sSf
zXn`=nRzKG1VP*^kZ`gv4n?BZ=zOIr(slMU>Xpbeh9DHoy0NO4NV>5F!Kuhk&77pNb
z_#7V?K+JeZH}G-K5>Vj)F7d!@$WZ_ck6(aCL_l*bkLNHj)w4hX2+D?-enbV7*%=u)
z>OU|%KB5d>L<TbbhYB-?BFxqwAaQUJ`$PtmFyPF1NCtl5Q2<VC93L1!OsMrw7Jx^>
zK-NDAL0AuEgROs31GD}^J;Re44yIDj7!}Bv6`<q;4zVXIIKX>PL22;?$aZj;KX`#i
zmf+!Oi0B7UvILDTF+4c~*@^<nXHRadU<B1yAof#^3dShVPF~QY)l&gb0iMIcQNZXD
z3Ox#f;i&{@6;Tdog+eG~ea}+~P=x_bMNcIdn0r7Q6hNu#sSBu1fsFXFePFmTW%|Tw
z4w?EDDlFUw80JGdC^uGcaP)vWc6KVD4fq@%7;dak0aXpzTOp0!8-K)MOC_IffDBe~
zd|-IGCkIqrfl9=uAK2jvetcnM=KK$u)d3Z);L7@$1ZbPK!F(1K&?;q?1B}ykYB)qZ
zb#{OnAK;$QGl?spEvyjhZpyHL22A}ppssl)0d|caXkiP-2Zm=Wcv!fYUw|ABE{L8z
znBG~#A;Xw3eOV2MlIimsQ($BCpa6J2$A&S7;{(I<8w{Xi1g`m>-zWf$`G6<gK}FB=
z8`J;RaL5RV7=t=Mp!@|Aec>@(vz9|f=EVunkSI9vZZ3efIw9He=7s5rwH%W5H+O({
zqJp<5f}Ql{3k!n;Qz;8*e|ZXM8Wv<8svu-jKEq2Jm`WGM6iDUqa*YTxha<>)93L27
zt`UL81lZ*-ZDc?}6BGj)g9k~2`1K!{f@MGgV7n0}%7FK>gH$CbfK3D^)|UwipdmBR
z>>9(%1O=$+5UCSu*cf9Wt0rHbSi=UgDtjrYn*lQ9%nCNfIOqWm3@=}RmmkHlykYq>
zy`qjojL~6we;r3CqsR28bsSZU0n-!eIch<(C-ocwi~-a28#r_s1E$9|a7fh8V_<1v
zX#vevvb3;lVPRXqz+AMPf#nIy6R_A5mM;*o%?vDGSXx*?d(T@~r?7(6&0~Nb;Q)3)
z1Y;~q1LF=R##nH7h3x~wD-O`2rCJ7-gnmY*T5wc?!v0kb3xhUOtqP0w7DfxkM9|PF
zlCT;`m@xqo{I7DfnQAp4!!BU903?^Z%9*ay$RVHl@`VCuL<f{nUul54O`v4X_JQHG
z2WVqVE{lT;Z><R13gZ@r6~@w_C2-&b{_+eY;^x5O6~fPvL+}~FqeviUy<RYVLnDV+
z)B+ZUEsTtDEJv8GFfqnK3bNNLz(;U^a^33{pzZD8hy;nIK->vpCPS8kftaa~=mas-
zz-2nfsVk-{G;t_df{zX<6#?x7Ed`Icf)mg!4QRarTE_!U_P17`Bzv77(;qZ(C^P<;
zKEH`WNnYm%XzN!7i%J61#1NK*45mKVdVjVL3_24aYA1lzGU-g1uF=dP#~3l)y_rLw
zF=BdoGlwB##PpTT9JY)R)1NnUs50)E&fCHv&KNOWwS_~6QDA#e3&#c)Ce0tySvolk
zK(tvWhaHG6>*P>n446KrlS6_rVEWch4n@X*>DN0stQiBQ3wLoSG4@P1>*7#m4A>sk
z#gWb|U-|^px&f`>;ewB+z?(CrPo_WU<uH{feE|wou(!)NL_iBtK`~v%F<rNhqZ_pL
zSAsE%MFKS4#Ik^K4S2KyI*P)whH(pYITSeEv3+3J$^aVH$YfDAVGLz4fvAR#!a`I-
zx28dgldS@vHeM!+unJ=+i^?3Z*)Y{}Kzph~p~pvn(#Td7Xe>2=x&R%F6F_At*x6eP
zK%>gw4865L1zZ+G#Ct%UQIOL>E;9kmbmy>en}8dt93L3AnwWqpAW*^rF(D@mfkk1_
z$-uzM_JLsw$MoI(9QuqL(_i;<=rT%7mz=<%U2g!IZp&ejKLB#g3C0U>*KAn>A0gPX
z1LQEUTee(*x&<^OxW$8oft@jjg&ph`Q1@qx2Y6p2j2R9&D+?qVhF~I`#rA=jVOhrX
zV-q;^88fDT1G#4fwE6h};t+7cUfuy3PzYnOX<-8S6lD7HE1)JU#7r<7v|a;rJOab=
zE1)eEB^)g5Ye4-A=o&YuC?{AHJYEa(!16nwh|6ISUIMj^Y5IbR94w%vbNq}sEc_bG
z6DNQw8;%bQD>6V?3EZ++erE}|&I5B+h=4X9!4}M}5aD3vfc1r!9RQ7(fa7!70r08{
z7#pkx8lnC_K&{#=7K0PubR(s+!g0E%1qUya|BvZLlQ>jCbmSxsHAb1~4U;%jtZG2J
z1xlD$R7{wlYu(vCFa%UUy6_sH_CL6>7SI7&EDW*(gxNkYEKQhxZxV+#W5RT<$sDqb
z3DY$ubI5~^wNYoxVNnOgJIf75XsC01U|7cB0-ac6Sf&7v{$)1M=m(|brBk3O8MF)w
zoH~}yfSqu~uylzJD6SwGWGVPCh)xR@7H;U^BgjEZSQywG7(-Ybe5MCH<Pe$uU@`{_
zW5V>OlR5Mm6Q+w!;m~C)nC?7<Lz}T<dj1p+$qXKNid-rIchXW5sFOeux?}+~MS_b!
zP(oR<zy{RVfia;e5+n*uksxLW1LTM%aB5rdVfu$D9C}O(K1^4b%3%beL#A>#g6Qc}
zIW!p;Og}i4!-<h&I?FT;YetUg4%0ZS%?u!GN;p0+EOG%gO+kSUHf`}7P}<F5;Q^mu
zR{|bd0ZFobU|4K3ed9C^83CIBSZ^5=staSL-<`&x#27PeI){qy1{MYlmWd}A=Cf#+
zGiI@vTYx#RN^{W$(1BeOyBO!Qa9A+LLMoai1`4q5>JqTCpyLZm45k-O=a5n~05x>M
zmCq6b0Z=Q#53;Nt>Z<t{rmvaKp~p1;!t^`SIn+Qj%M1=Bo%t777z#jRH3btuoyQG~
zPe2_5aI`O20qP8Z^n<;;AYyvZ3=U=01tOq*E)2}fpl$C9_OLL38gii23p!;ICOUoA
z3=R!OmFb6PaOg6sO#e88Ly1vky2wlp)tEIb3>QFKmhUk3KqqrS?dq8?AbHjTyhR*T
z>dpKB8V3aDMi4U$5)3o<fQD+o?e&>!z^gI9J#(-NGgPKeoeAy_9-Rrc_VY~e%&*ie
z4h_bd>CUq_%o%H@SI^=wVXT?HVHSrW<AmvtW^t&SP5|wIH<-_2u!Dug!xc200zS`(
zAp<O70+s*`*nxVi3=B-5_{=yk-EKCA8dJuF>1ne$92je+FQ3h!5m@8G7zJ@?W(;Vf
z9=K@8j1gg)=mQQ&whs)M1uP6J7@3O;=CfR2y1@iuK-$@v1)%;bC|bcvLAGQzOjnr0
zVJ}yp!!mIP6SQptQ3qG!QZT)C4u={~0Sm)qM#fB*$&4Eqr#HHD2<N&$gfhTFpgI;d
zjt?GLcI5!g2!O-arJ#k8xeL@s0R=pW2U>mtXG8b*yKK>6>VR&ffwCd_i|qqL`itrM
zb2$_g(|?G7CuhM4G5v=K3zu*QsKE+yEl8Qp^n$q@YK%J5r_be3a!)A%WnxHSlHLPJ
z00yAbH^AvH9V`tosQ@yo3+Hg8Kul%(z+ii0+B^<fCfgg+<>zrI$k^UsVd{c*O`vS3
z<z`=|M}t(FeVJZ0k3&J-><d^W*e-JcP;mn`9xe<{Q&}gb9|UR2Ix+phJPswMtP|5&
z=5r{3=!5e(MA*UMmvv&g<9rTrkRU|Sh3R$kIdmCkOkXpfBb#x?bcqEV^B8AL-@bq&
zh0$cX%t8)dMw97T3ptt@O{TwF$l=8pG2L<zhp}qS21Z8E{hVN{(`JC$N5L!#Q^55S
z)E8+drcYeNA;y&UVfxBN9P+XzBCuhVWE)U^g{2?14-Cl()1NNluwhJ?uC$oLmN8*^
z!eS07#x2vU7jx(`C4ZT|YB7f*h&~Gv7McEHF^8ss1Zdd;V=&7C<|p8RP*5UBF*v{o
zJyVGx#byhr{sq~>_JJW~$#lmh9P&&lPo^g=;jr}JU}2cS$Qa4;f$<Ay5*Tzl1K1rb
z3?YmWEGJlQurNk2pooS-L_<O6mVpcfrTXNA>5rFi=+~F9Fxaq_fL9x{*f?;MvVn)8
z=0kee$zK>iSrVMVlCLO$#sR?52W5j}H8mgrG;jt<U}-EMSLCpSRInTR*D%Pa%xB<$
z%n_&6fM!J^Sqy9#Bay_WPh83&B2@!g;}yxm0y=rg0J41<5<3mk_b=rT*PH>GX98tr
z7H-BY7SM*40?-*;93L3cz*}`eS%mEagImM&|4TVk85c}fUB;otxL~@^G7d!}n-8Gs
z9K5#G<_>7Y06fZT%K&162M=r(Fn|Y&ppkF=Vfy@K9Lh}AAEqB!#-Z$G{egu+pD}|)
z--0oiB?dZq0Ct{D4yYFp%A#VzT#A@{vQdDHUg$W3!Ua0)&h~-9+GM)na`4uz#N`}%
z0Vyt^!5Pqivvm#ws4nqUfQ&y|gNMYKL4#G+ISjCs;4nVotPSfaEDSt6B@D(=pnYpH
z)9)|m5c88^gPoCTJq1)*frrzrm$0yvFqDE8OhWi8;KOg$d*HzUVj_-ZW&6Njl``FV
z1&2Ok%JkwD9C`s$KquaS!_I0Bii54@fW}+E4z!ws>R^ym2(0I6bp+yIBdCKvuHX=>
zM>yE(hzO{p0{PqO2ExH${vFUJEb#c96_^Pgzk@KriPKs|fV-0cYA~A;q$i6m2###4
zKX4C&n1YBFH8@J`7^Y8O$>Ge%F#YyQjsQl3={l=8r0OkD{A*_cI=>d|Upos_|AM44
zA<<};0MR4^=Q4&sM*8d;Ku!QBNDwm<eijeg2L{U-pk2vXEIJ{eNwpb}cJ1_|t2ksB
zXH0*zio=9)#&q%392)hOXTVz*LFvcx3dAO8`mwwMie0etEU%zC4<rSN4zOn}|FAF!
zAW{&U(tH*H5n=d2O3;J_5*CpFr#p@h43>W+Kur@%@Hnm&<Ro9vm=lNz9hb8*0QnCR
z+6JJY0!`RLGnYlp^zW-VKnvs4*MOS{F>5$9>o>stVzC3oFBUuCezDkr>KBj{l3y$y
zK>Pwv1M^t~BoKZ<5|#k%iwCC~iw80wzc6Hg3Sf&r9I#e9hzUAglj8#egb5y5g)qV1
zvQ&Wk5X20D3`JXdfL3&Z;}yaL`5A`UJ}@|(nVz$j!=1_D%=E2mIs8C0>pBko42K_}
zF*tC}a%4d9z9R$N`;H8#-UmrRQ<|d=L=!ZnIqEPlP2_<jHOByuL%~jR446J=9Y;UE
zJ&S+}V={{h<S1<W=~nAG%orV}7p~_J6?T}y$oWI62egDuMnM8}7>UF5nd>?97#*gc
zSkIv=1lh9&^%C0$hIt{=**9=lGImUN+`u6#Vgu^5fo5|dZ8)|M46}AjFWSIi&B!x-
z-3AT?#+2#jH*gq>^q4bGJkJ0c*oD<bb9|<YZRAju0v%_;G*OEMw4WQ6YCyHsoGa5q
zH-bBIH5)mU>gRrt0S#<|BXQOp15h0Wu8U^fF<{IBuZsZLeFrqmXfU5e!T_}O0F+2)
zLF+Rp8zc;h`Z)|PEL<G0JzH}aKnE6r&7LCzTE@!wtpqycKDPrrs3;97U*>keMiL<*
z!uEk-#*66|n>ge}8NkD*piz_=Uo_ZD7(nMn&Y!+8pHUlhva(&w_Boq4m>3yPOrO7*
zqleLEy3Q63*?OA^;5jAGDnoY%6}B>Pr3`MiGP;K>fUH30_`v9%vID+w)4ijckueuq
zz%qL9urPqmsd1RV1a2ULM&TGe96$$hLX7c<Xki48+Jmw`qelwpbdFG#k~!e+2&lKt
z_JPr(VETnE93u4<kfvfn3ut91C^Q&71;BG*pg3du!00f6g#mg##1Upt!xuUv1Ri^1
zbeI5IA`h|EVM-0$Ga%17%ur#gK=Pc!niHUg3@8vm=I&u(*uum(J$WmKkk*quNZxZ?
z0BT$WvxID6gm@3Ul>s!`&gi&c`uwdN7K{s~-`L6_Yt5hms!2dg5S(~G6Od4&okT!G
zQ#mZ)vjxCjax#E>2^=I&Go~AC<4}p30UnD18!#sV?s#w;htX*P3qu53IoJa%5%FwY
zU>3xyPFr3ugJ+33J}^2RxC4qO&@LHBQfB+W=qxgQ-8K#jMvLjsw{dt0q=1eL0XYt|
z=!DTZX1e2c4w?EKNVj(dXyqSh8xY3_M&~UVjG*OnAm*M3XgS5`yeEQrVh<=jpyF^P
zpnf#igDxFV4|059beXdSw7>wAQy5(~EC9^}gIaTpE<3<yfk4FfOi6(D7(r*$xtsuv
z2$fo}uy-&qMu5&AVq*Ki=xPHxLlCsK5HxNGYMnE>oB)-cFeWH-!r0&e8_<FwkUv41
zFHE=D!C|KV1hfb`j3pq2F%z7f7+v3#z+%ny!x<*FYNT*={W5*w4h~T!*FV#D?BLKv
zrp0!0nAW@gVPWV1HHteJ4=}Mz`~)3TVs!m;0B#W2L12L@h{+&FfgJP)v}!So#li=?
z7KGyiqZ`i#P~d<A#O(s8^$20U01cvm`gM$MJ3t%a!6EE!z`-mGnI{MN5Hd2(XrD3t
z?oJM41^Yjs`aGD$qz5!exIhTJ766pfz{$=2&vb)b9CA$df2IfQ;!vsww;aP*1Tw(m
zKO7$z9Ux0`K?%{p0AxGZN)R&)5@-$vpbjQD8XXM417$EaWD^KD$ug`2uWtxt*}?h%
zG-oadD)d$|fVMe7!hm7*2~dpImx2#tEoFfgcdH+?fDcRojR38k1FA_t;lQv4ybg&K
zV)U98kWNrqcmUeY0V;AB*0eleVe*G}9#{W>E|!3f*Mhvxu!aLV0(OTL*0fk-Xae#K
z$cqeXOaz!rKm*kr9~joSfLb4*=mRk!!VoiDrZ3#hAyFR#OM47!VjycqK^|O_0n!FB
zEklCI2I{FbOMZYxtRdncHu#ViP$jcw4W!5u{s0=%Waa?dv33sVESz8#8&Cu?u(Gjn
zKzCrmBs4UpTkPSGv<HnRfe!x%H)WWZK;tcIZ-Dwd!7MUI7#R~mi32S70BXw~upnfW
z$GVQ`6ZUY3)`OQzfWvSd0}l%q3#?9BCm;b?<pB<bbs9Vn9@rD>)<}S7cQ`&UtXm__
z+;{@yKp5u?bbsTzH3H0yNE}dy13Gxc_JLug3aHBx%u;`VyM>oAm;sVNWMFG$m>?rH
z>pp<Sp^8Ci34CBL*!J}--~nJzs$+n%K|W>sz_1=Xw4cKwJOfm{Koi<}3(zQ*!F(2;
z0`Qdp93L3ggAcR<drS_*4u#A~ftVqn5(i`)DB#w+Oh34nL%!Yxe7+N?Ze8yJTGqu1
zV}>xmn4t0pqz&XX=;7C2c$V-n1~c%2QpQRh@Zg>A3kImq)`L$OMfceWaC(LK48jJP
zDF^b}6=)oSm;Zpg2JL~a|1-UIABUVV2k4YWu$MM)fYt_pl(2nZ*uViQ4MJFS96;A3
zAbV~D$MkdiIOOX&;GWyS0rnhZxeZ*S1w<pr%NsbL7g2y*1@fs6D7A&K^zdB}U<_fo
zA@D(nF$C&i7x2-uzAvCH1%?d^SQuU~GKR3sV44FO-~;Wj0lANH!Svky91@HRrnl|q
z(3RV;2by!i2MhjTYycG*pvE0Y?V0Hp_j8CcZ8$Ui#eNQX5Y2gj!-|n*y2}9$1rRsw
z0Ef0l01JZ!^TZPjEN4Jxb51<L09i!2F@Oam3R<QJ8hqXqGkxa)4*B{N76um99tK0H
z`7A7;^=IHDwyA&vG<6LP!;PT90HzXfNmT+lHX4+9SC)Wk&0v-jLOr64!3=!hc+P;u
zGsK)1Q$Y0}I6^l;*wCQc^a0|}>EQ=C`0D4dKo7-FV1)JpHZwp@`vB+6&EONxArp_A
z8F*l&*Jc$SW)3H4A+uS92XuA=*xJo1AT^*+1J&{jn?Z;7fo7QlbwFJd&Qj18^*|jZ
z(826rjyF@Fh7xpmW3zz(Wcd-t2Zqhy3ILp_HZK7ksR3s~uZaPPh9W1b%}YQzM%2oL
zF$<D4HZK89H-U2rhzZRwAZ93B0VwZ4lf&je)9Vg#h}EwEZ5d)MZaBa=pXCM931*h!
zhC0wX1#khm5+-{HDhr!jTde>(YLN>Z5i1H<iyICxLPKZe9v&91#1$~!6&}b4CNzRq
zNw6^dV1%e=`N7!1RL>a906wm5mBbAuCZG8Xte{@+Y6Va;9nK74;08q|B)hBzRivOc
zA`1sUV-^d)3Ye{;!<fau4az#J6+i>raApWx6y$mE5J|!x&{!qJ#Oad`bG&4nGQH*q
zM=ax%>9>w>I5AF{E_;;2f@#K)>ETB?)R<<Rm|lOB!;opliS3(?a)dFu#JvG6UN)G|
z0zC~1G6)71Wz1rM91DdkmI)HeWMBuC-H?hk?#*<c;~a`iac`#QALo!}^qJm$9K4lh
z-Ej_i#)j$Vj&q0!Y(Z@1WBb6+;xqlraSk;`pXt&kIJ6jjrn{ZsP>@~&+Pnr%xdJ*0
z$OBzXKGPddfLCNMJ;9;Es4)H12@Y3Ah3Nt(IrcF&Oh12;!<>}|blSz_L_TR&whs(-
z9n-Z>apW>CnLhIrM=9fy>HMcT{1}%^k2}qw!pJba`80<rBg6ESr#Y;d>K{yhcACR2
zXbl5X3urW-;{!v(3>`*j*$!fcK*mKH)-W)YKzz;ifuT_W)D{b6@c}Kf0bOCh0TNST
zOP|b=F&WfrYs{HmcZNd}bacoW4sBhq@_3MP(3&T3dW0Ae0uqDo83R=xjSAC0oZ&D|
zQUFyzhVxl?EEwZJilA!@8dpG?{17w1OQl0tL{z}VEjSxDzEA-#@`9H1jW0k0#~~~t
zG9V=^GAhtUIYZ-z?X71y_AqiD{Q{~~vsgH$GhX5lVLJL{dct`QNf2Fqo<o*VX8O$Y
z9EOZC(@&r0P}8@7%-u?W8r0xMR-y_Is22}qgZH^YmhiHDU`TYBu5f`vhS6cV?F9}6
z#)#>07dX^pG9YylXn8jS2(W!%h<5;qWw8i@ouFfO2kIgT<o+7i3bQBN$VtN@Wcq^(
z9EzMFAZKN=h--i+JD6M*rpsUCP!%>iAplnm4lq}f>ERbSbop{5pyHszI&!8@y2zoz
zs55>0MGhy%jOo8Fa>#J50rfevSX^?ZgAUEoasv(9FlMm`m>@d|Jjmkq05mKMDmOtx
zyAP(vT;i}}?3q6M5{D^c&-9CzI1EI4K-Fm$OHK)R)(-3v_Z!p2E_0|cx!;&>cbP+l
zQDu7aWeyugmFWvEb67DtOuv1ZLs6(e0=%Xk6iQ%C9&@JiUE$DYoHN}HLgiiI&|>m<
zFn!h)4mrj-(|2Cs(3Xw?Sr)>gV*=fd1)3fQPg8k%O#goce9*1lRSrwW3DYyKazrvt
zn11LgM>Lb?jp_2&I1KAOZ@@+)zy~tV01f<uyN2M=Kei7HUZ4Y+xr-S*Kzp$KG?eDE
znAmU^*CV(#4U8z#6Brku3M^p!z=*5^>^+dl87vIb&tKz^@p52cNI)^8U;~N~Fdg0n
zEDY*w$&*=9CbO_Oq(E6<S#WrHf0%B1okN4k`@{73>m1sQ7Sp@0bEwN%fI=vf#RW9=
z2vrQB*gi1$T1>xiox_oD4rm7vNE9SCXS)0i4jINd(`{~Ws4(uCo_K>}C8Nl6?wcIa
zmL{N~7iJ;Q92BU?_A5X+`VKrf=~rOD#{7X<C<M~g06WcJXL|fi4rNB2>CGU@WBPIk
zb^0cUyr>8GtPzmy5X|<0!M|bp|C=0Ej1AMRZgE(0E&)w~XR)yJfRiVa|B~qwZ-KYg
zt-Hlx!pJiH@h$Lyg<`ikbQm3`JA<f@=>@krq{Kr&c`F#Yv4RO&g9e67UwE6tgt2A%
zwc8xpj4jid?r>N!woJFZ!(k$~1eCe5Si~hj8`?n*V*9`l2%7E(9aAp>*-sp}Wcso@
z9IA{<rk}aP;mVjZUFa@2iTT{+P-pa*UUHX1TOox7yjcY7{jd$7DT!nj6$8c`NE0P&
z$@KkqIYb#*reD3wVIvR$n(&2}x8VuX74L!9COO>WkYx%#F+KhshoWNm4^X+0!y+ug
z7|fypG79882nKCo(U`vQ9*3E!1IWuc;Pbs$K-cp@ER5`tVCL)xEr#Uyz!2FZ0j^WQ
zdf7fOMDCf+bDu+%(PFyMeGXkli|GmXIkY@#K;sqQaww_?(%lAoCh7tULklBg7E24`
z1IS1?^8UBz8pLi+u<}@u>6h+vXfTRQ|9ziBicw^`*aHqZMw98L55T*T;~sFxFix3X
z4WVW{;E-pWGJVGb4pl~x>GvLR$hm>e$Y#u8;gA6>MM?pUMSwcK2_Yunq8)5SLJG9k
z3Ti)q9h}gBQUy14Om}+7p~cuSJ@+Ap1LK_O>mG6_8D=oBaMi&2a!or-KtTeoRGKcx
zK+8Sw$#I~e9JUV(O&6v!KH`vOYI-wW?h%KWT+<sCh8pl5I+h8Ha~Q!a*gA%$H`9Y2
zaTqZ*{h8kOh{J}lWBTDo9Quq)rhk6Kp~Dz5UEwi@3Rehd1}l?Ae*$FETCBYQ)L719
z;Yk5E*1%qCFPL8bm_vb4X8MfB97<9((x7!<U|Ya(2PW7)Fm#-me&sQTJ5$G*>9S8a
zw7j}LNP|v)%$N*aBHWoF0o|VS|Mvk<I^+1jfDi*8?F9CDXNCl1*cLQ4#`b}st7H1a
zCma&>6)B*dfM3A}E^&Nd=&k^*$bby0FmyLSn(6#8ps5s4snFd4zA*}<95gP&(A^ON
z9UlNy`Q06$+?>P09s-F$u-F7>(gwGn!Dd{54H1II@F0z^?jO?)o^n_*b^n;2^OVC3
zL@#;DVFaRYJmoNFG?*^%jKfCXB!aCJGL{5xH1-%UFqJ}EJ3R(0AT~JIAZGS_m|p#i
zLzAiJ!}Mj(IJ80Z<!2l!!W<Zz&p1Gv&%{9k4QwA6dO4<RKIf2^<$z>djt>mI5|9-$
z5VJu_K1@%2&Y{WF`(gTo=NxMC3{VrnLDI)y07`D4#x=PA(Z>Kby`BNe15LeVv9Rzn
zX0Y(16tUps-3K}-4U`I)z*XIh2o?s=>7Fd01~iL~2^)9~HK;GZ@quARiw+AHANWEu
zFb}%I+7dJg4C)2UXaO%72CuLNU2qRd9iXn;E{^HtFE})qcKn#W@CApMyaMRzCCEXH
zJ7?&C91qGDAm6fmVA!QF{n`r-RYslZe_n8aPQH|V$)PBrzyli4fc9@eD#1y5&yDF}
zFFCZ8Sy&jRurfxlJYfC8#u&k}fcF6}_{<(~n1EccH(~mcm*A4)>`M+cMFkdyA1sUs
zEJs*xurVgEwD2C`WlVsW3RbN%UE~#qB4fgIvsWC}0(-tNF!g}_0+noh#UZM#1G-)z
zfn@^Y8b+{Qjt>lbPeA$<ASU?kSa3$z>oEP`D-IE92OfbQ@H~Nunk{H+m5C;_2;J*2
z{lhB`3C4u!oUb`znD*Y7p8lGng0W%xgV!8}j1AL;-f-CaWvGJ>3+4F0uzv!?7I1v+
z%>ZTeL>8M6rZNLig9YqFkRWJ<u}uhL5-81oVAxv%>TQF($o7F@pTYF`Z#cvmIi_!a
z!=Y8b?*nM_P$J6%rVeIC&@y6<4-ET0$b$?7#S2ISSVa;<1;|8j=<gSRu8;HqtsMq+
z*$za2)((UF-v<ITn94L@<1Yt57a=qCfO>79IdjO#HM<4C3;yd_7)~%VP1Jzx*a8cK
zT+eU<bTlM*+HBVs2BtFT$inU~F^n;gBacALSje&EyT8P+MNVdknhY|N;{(GU4^SvE
zGlN~aTL*liPZ-M{rZvorVc=U6*gh~ogzFijA>z@f;-ID3>7oo^IVc;80(~R}`k>Jc
zBn!d1l#mpFb~r;_WW&O+19aBd5hj5-%#7in90-${p7)MJ2GkvdP%GYXm@xWGzx$5E
zm@#C!;Cl|0`aNe@*kUKM#7|}cj|M=!BESgp;1$q1Q0Uk#$b$l4?_B}!00U*xJsA?9
zkqdC<-;*H$US0<ZuM7!}GKndSkYiIo3U{yZ0PWZSGtX#%r_#WF+Y?g{8WAo7573mc
zfCe(a;=2OCL-e66D|qJcgDO{$&VzeEgWBw%p53kh&}u_Y1QRro2+HsgEDSoJDkgU_
z3#h~ih8#5vcHn`IHB7KWIH8I6zyg+fh6#+&$Yz<qIE9IIDW{G+q>0G(f#JXoP-L@(
zPiBdj%))Yl@ed>GQg)C$I5+M(!vl(zqFW&2pw-U7AD|Ozf?0CTfcEoU0WC}q2G4Ra
z9DD=bsQ@W=Ky}HXlsk-!^}!q;7!Lb@#>>GIrl4x)PznnJH&ZbK3-=vH&{bB9pwTx-
z-aAwPSsn|u?GR{u3p73?vSvODOEqH-%NEcYYtWr;paV!44$Y`xGMEps0a`YKZJtrX
z2(=efok825haINde&mp2l$jp$kwY_v1Lj<22GFz_!(ks#YcZI`zyn-Cf(%W8w7)>i
z7VtSa|D{0X5I71C7l2|G<;FH}FtL4LI5T7V!;c(Vj5DV5eB$t76qz3RiNlU@#`GDV
zICM-|K!p(KCX^1?Tq48S1PSQ9a|~xQAgw>JQDB1Y1H*-y=|4Y#&lR-!%%RJ;V0zYP
z4kbo`?Y*Blytq`k7+BsgU10{rR2>%s%LC>PaIAsYQ+W13+1vm8<?v@^QaHcemzi@8
zljI!Gd1ovf46Gj*G&GRd4%3;~IPWm>Oux^@DIo?rrQ-k-%L%3nOe{B;UNC`_8?#L3
zW#^Qv2i-lv!Xv{XqXNG63oHdX%7P^(2gEj4fSAg{Bfugefe_)~VUYl70*P4cfT)47
zS-^@Fz}yEQDX?M?*Ai43f@LLGWWWmQEj_?01i;c)Kx~M2EJ6G5!AimEK+8H9SXelq
zj<7O-sAS<00l7m#1*F{y92y)v2sR4`!UU^3ply8~9$?u&poOv^FV({wVx0pr5uzEw
zM%HW%TCNJR9@#z{&~<(+EEX&dE+9kg6j&G>SX?|<d_q_v62KxB2s7<0SQwB3#x4OQ
z#UoG;R@VUHfb5e2aqZWDW}#VbFwOwSl!FHgg9M9B4M@rXbX^~dO9V?y3W)0nI@png
z2OM}HHVcb@2#W+bFdTJ2W<sR`Kx`Hc76EWrf=*QhxrIffgu#gQ1A~(S$Y~q`EFuOh
zCKfCf4j`kQb3lSTV6&V-Qwh)rb19e}!pW&v4-ryf(a-^@cJlxQsDc5Q4UTgLuvb7s
zAq*@sCLnQl&}KIljtnqc0~}U9EFlqKZV%LfJYdt@Z?G_kKtt8j0_1xI50-!ckV^1~
z0*gySJtNBm#t)2OA<$9yECm-BSspMh0Ed|05|D8mJS+ktAO(RAEDSO%1~y<es7uQt
zqXA~OfRsVifbOLRB^Cj2A_sL@!D$D=4VnQ`$-==R0gi=W5te!eaB2i4A+Uzv5Ecdj
zmJY@qCYA$CKbTk=m@hE1++d!;0<tJLg@vJl<qzW@uzN!%fWiu5aM%;D!2&EI;NS`e
zU2V>yQUKBvu>uqUAWulJ=zyaHJkrV{0*=G__y-_qko{nti7H@&I9PbVUQPscV_7)B
z2_tb03xfwsObp1-Bo!703l;|-mJl#E*@T5*4=bom$j<VB{R2BlNpb=U!vPkS6D$*0
zS!S@#VS|Z<fEQeXc_&yH>RDK16j)R=SaiT~n+iIahlNFgMPUxukD!&2;G78w^|S_1
z=!i(L=zvp5+60i>IlvB2*8#CjEI<Zl7=YLoHY}iHnpqYwZee8E!_vVDlFEz$NpXNZ
zmze;zUtkB=DiDu_MF1STS>W>@Sp-0C)6iit0GpaE0uCBjYJhM-0SC(ZEDGSHkShW)
zo<#zjuW~CuTu@#DC%QbaEDtzZ^1z9Pr5+Y#`4J$c5*jQecNoF94TD^p{{$q+p}=Bb
z0nMoe8DK|%y$@xBOYK4iuu2F!1k47PUxi>}Igrv|5hMga-e8fiF$P&vYy(P3JOa@4
zTnx^5EIiO`Ua|pH;DI~=PBA4{rYrJtill?X7*fuant&}tvZNGTEOAJ%$Y`)=fE`<U
z1gr+^s8Z03It#L+KwGg`SQNl%paNVZKw`LJ$MiY8oN6&UK$-<apk+$c0T7o5oMEaS
zfJ%TIaDJ*z0R@i80&slRKuV(&mIsV)7+L->Zed~porDJRZ!PHDXlRP7X_+p^$Ejvm
z!NTCf5|hG`Q^Hcy0V))xfK90d9kc>1hQWubKvR63&h%0~PA|~(4+{$mICnOLurRo=
zxPW69#Aab}0hi|upo=J3B*3l(4Zs_)_<$2f(*=+(IC!9W7M%+o*O<TvaYhFZ3&R0s
zmJ`fNSXkDuoMB<P!t#ZM<qykrJAO{~P#zYBKa4Ctn2=R~{Mi8-WoLQ7xQB`52-6dA
zk=7{#vJ}qKVPS}1xx@5;8Kk@$9IOK1>@;D@^jZ9zvgY850aT-abIe3YeFs(nWrM{h
zPXGlxT-lTj)8FxPiWz{-i@CzY@`mXR6U!H-FJLE3`vGzS2RJ;YgG(PUo6+vXbQ1wi
zT~Lj{!BSGf(!u{ih=KJ3qx%PtdL98#1?}R&5)i`@vx13b1=AXkX^ftr{m?Anbjauk
zHjPJwMI?eH0#q<DIvIdcHbmALTyt{l0F|sKm{=|_-2ofmvInFDT--6bUSMIUzrn=v
zfawib&J`Sh99x)J_As3Qi@1SHQyu{pfdY`zkc@ZR0&=DXC~6t)L1!_tgoMDFLX6<0
zE}(@jAP+ehfa(!QB{vh|C`fLU0TqPP;{`cE(-$>@oRW~z3Y7I^SQJ!P5_-UCa@HP@
zO`sATTr?^uuvmbL7r3|uxV)O%!NQ=x0%_7L_yg4<qrj4|1Z>I@1F$r>*jh4W`aeNV
zacCn>g+;@F#l!~O1OZp8%UeLju0sbX1Q<XZ7M1`=9kd*rASA#A!wS%~6)X^E$*8a-
zq_7l}fRYtRoB`CJfV9+BfWyhggT*I;rGsq-8_NQ=Ib1ADxK{8m)U$qISn&Z;+JJPf
ze!#-;ftlq8^B-{8y#{n^E7$^X+F1i`S#a>MSZn}047})s#pVEn1G@c&Md1n9tLp?n
z?uRrxSIU6cC%CV0v)tis;RRW<9$a<sNU-=xfEyK1z6gs1sOV>L00-_$9Z>t>4^Ia#
z%LLvfd?0-wAyDlNVy}lJQVA9b2NoA_psoKfJyDob#Kwh%L4{=s-x)rZJA8WtSgr`%
z5McQt&?3mvBREHpWsl$qL6!@G9|T!`2=)lEOcA;v#PUMu11RA$Y*;XTqcEp7Xt}^W
zVNNxs4PU0SiE!%HXMkLCMQDa7$l{gIKmoBgt02M-G?mW6!U1jvZ3fqqpnL&tPC~f?
zEFu~#I^d?74Y)PCngg0h1SD7_K-q@@A_C%qDrgoPaCuh01yWsrlca_YiwU?<u@xMM
z9AH6kUC!tUY3x9fHn@&A>0xA<!ngqxCybupj09>dO0ZbefNz2X<qfY0P)VZT0BN-`
zdV>=SC{2N)oY5Op57dK_fQSQ&#~o&tKg>r!WiO+j3Jb#?MwT;-4?vY?11JeF`a@g<
zs&N?oA=Mxc3%I$&=nty{Mcy#8bg;|;n-K^u#MUr^n*)p>-Wo=h9gIi7&J9`sa+i()
zi-nB^OGyRDsX<>r8At^jq+8#Bq+NVKv9J|fzIjYxW?91ggPElPVm!mP9n(LGatdpM
zF2Z050oM|s+bsm3>>VD^z!#B#iR_rJFUFaqvSSCRt#yL&2FM`{JASY*G%&I(VEh8A
z)WAMv01Xa`aSHR!U||Shi2*xkm%{X`Vw^6FHq)iVISr&iBW^4c7$G@-FF0U$z}52J
zgz2f`oXXDNW(9{1G>Z2=09omg!P3I=f`#P^_aAPM$M$^ymy{JO511Oj6~+N@Lqi5!
z9qhU>{j@lzw2J_!$t`mL)InUq3_kRjWe@WKuyW9l$_Yl6Jxo2!EK`_gFtaRRUILd8
z0N-s3vSwGnbS()^S<q4w8<soVGr)Q6;2TiV7Lj48Si{J&fe~CrKLABD18DTXgvA2f
zYI*?<BG4!S0}D$HcyIt@;vo)Dz#M^8LQ}w2f`nLDKnV+6fgR$3hW-JjCrm6Km?khY
zM6iBfI0SC6y<qwSw&^gWkqv6*fJ{AV19B3N3X2K2&3Lp1lms}yp$eMb29*rZR`jtJ
zkV+A7>NxH)T~3lSj1f$UP4AZEw68x7t|%KgE^va(h4D6k8*>m|2M2_A<^>Cb4ok%e
zus_eWfEwf>As|f`K*!`m8|oLqJ$R2DV2@s`0NZ_qk>v*C9Y&TXjF2$8<OBAw0E<Wq
zBe?H)3A9F!g$G=cUwXj8aE62B0>>2&mMsDwz^(tw0-y`WSy}`pK)5<A3=7y;Uhse6
z2U&lm0h}}}SZu(B!4+6_!vp4C^I>6l0I{3p3TF!!NC!wv1i}Lq``5tTW(OA*4<D9*
z5J>IKaIFFqq>zg88n|!E0Ja>$1}O$-qwC=G%&~-tWevw1PL?H{Yrx@nJp|k=YT@|8
z!SaWr1tQh~8sK8Nz<vN6xHkeo`^BcaOLJ;4223xI=G0~^m_A3EQ=1>$aKFNJ1?<*4
z4AZYkbE-3DO#dg%sV>99!mxmm<pSdbZ~))+0T%<{di36u>5ej-GJN+=fE>;ODtZ|1
z{g|FD!znGLz`}5ciRB4X0}D$BOA7}}561*>uDb6seSr+8M7;~R^$1QQ_rakF>2=*-
z13FfT<pv|9_Pu`v9ME8s!3P(ylzd=e`N8rB+~<0j0+JN~2hyVo5Ss_wq<#dtS)7Fj
ztm`p&bOT%tGCT&?THs2ep5X~-@fC|i12}Cx2?6;4qUs5_xz5tU$kGET92ss*0hJFH
z;B<du1*n2k0sH?3=)^D<7I1-Z;{^*t0Lu!=KhmJ+1|9i=l;56#o1r2KEHfbGE5kGS
z7*GS;2V8YNO92^g<HF+N!r}w2eQ#P!zbeb=Dq_LH5W})X`hhgd3+W^BAcJpCnXV_t
zX=i&AR5gGyG^Cop33f9F56c?09cnCl)Q+fu6=N5@GJT~Sr-JEC@KDhW`8N=Q!J{%y
z<UYu;e35Ga3%yJL)x0taEDE5C6Kvp}>Hp+7Rhe$ynXW3&sj7VQ4k%moC_GVM=~3LH
z1W^JJS_95nuT`e!%5zHB-vl>R-^h1BM8PL}upD7J11@OZXn+e*a4^0F_c|ftFYkFk
zK?><|gRid!m4+ZYKvzqfute-&WI4bHsS-f<I?rKbS;BY&G@Q}G#L~mG1#I^B2cTq8
ze}#XB0Lub_E#Rc`A6mGAjQRm?ujrJpv@o`SQ^JoOpa#<qz9sxDYxwu@vmD`n!O!x6
z{|i6MAO02rmJ<ROz-EB&8)gXrS3W;EK;g85;{gZD3yvQgEDfA9I9V2O?f_@OpA{?&
zG4(7dB`h_dT7s_wT!8!p-G{{z1FBdVewBbz6u9Z~YX>M>_<*~2;45TV0t#3vI>0Xb
z4Y~!JB><c*SAc5;u<&1S?rC5?0nVPFTU1>@x2J+U_ZPIOi$$V^2~^}UGID^@IC#*F
zkxPJup@Ws>0oxLGmNo1fK)H#LdkQG11VmUeazLl#f^68r$nu4;g^A@3^8yx@6)bDO
z4F_HhP;&hP>1G`Pg)$?b4=B(?K<%0Zj4Ugl^%XPA3+4_MmOlzd>J>pP2>vyo(%is?
z#Q~h@7zILD7!p`IAk{RZpb9AAfcl3eEPI%5Fta>hUIMlcE&*=mGYW%?KM7E3VH5;i
z6wI;%GHCRKjpYs72hhL^qu>rumtzL=24<EW%tzQ*>d&y90ZWL02V6J=SR@iyQb5gh
zMiJ14Qx*=;h#ZRnsPteIfi%^?eF6ti0mUc?S}et~h3x`6%MJDw94s3k)f1!O6Hth)
z;Mf5wT^R*In+I4Ha4Z1x#NL4N?gGX=j4VeOZNZHhMv#~QiwtORkWt(N6ziZXK3Og>
zUSVXp!}tIcos8lyKxY+rM8KL6jFLO1e^TPq;$6bQvW5ekrWhrUOm|o2RI&w+F=%M8
zfQNw?CEvgTP=+N2+>d6I0?nJTfJcTIrNH5~foTso#-z4PU#85dqyuhnf<~A?eJDnm
z22f5^F@e-;U@oW>V_^Tlz{fCS`WIzRH>;QvqU;|SJylFVWP}5VoUwzE{R5*{00)SS
zm?FgffiXA-#0f580kJDoK;)e5B`TbU7`L0NaXw&Cbzxv&0N;Q8fk6#)^^T8=aDgCG
zbu(zxUj;;bU{Lp%Zlleq&d4%7MVoUs<CN(NI-Fu+8gCdF7<`-rnW`BW7!)8XH7%z5
z=x{25PQ@wE;Z$dgm_9>?Q{Qp|0|P^bvv7hSQ?*mG5J)Klg9M2Bz@YO3iyYKFx(U;C
zImJQS$aOj8Ei)Jx7-gJ<8|uNPq=U4>4AF04U|{&+Bpe{fRPEd>43=VmI^LjWdVwyd
zy6hGP28IHd8z2XfF_?f<eqb<CnZ8Ar)11*~`WszNc|nkC=P)oZ$UtPxbf(MbamuNg
zoq&cE`264x3}$y27#JiRA^wND*zC*n1U*i1QBZJbK&7C@n0rj`(c_deG6#7$#t9L~
zP^}iAU9TEQ;!u4SHPi3tamv?&Cc7<=;sz>hIfH?L;fxbFY@J(~omyC&nn6>EFxOk9
zFfcG&faq&waBN|8YKBa)L-kvO!e9>;d5{+vJ}_8+U|?X_;3Pb~N}p4fal!N%`keB<
zAU#W*!Cq)#aB2okIWs^*#r6gR0|U(K&^WdO1>_Zo8(o@NT0j$F3>qN84-9r!rn4Au
zYB4#SnQmafDa|-#x{m>;v?R!O7gw+i;FJjBGkjohN}1kZz^N=7z`($e0tqX}X0UPa
z=yKjN{eS_dJY&K12L_zdsvwOb(3k)p4Dx}&736$SXhVa*wPU)1A*Z~c4g&)NNEjL+
zZVl4|3^~O$*Dx?JfVO-=h224(DuLJy@&YXLxc5w-V8|&h2ugMppfCVQeqivJGku34
zC+KYDCx)CxV&0(Ol!3Yj<Ti#63_d*5b&NQb87-y<7;(xAg6sh$K@iRGfx&Od^adkN
zF)6<b3=9ld(v82)^bJOw;*t#v3=9>Jcm#(S$e9cu82o=se_+HZZ3?<J*aZ>=Acw(n
zP9O^d149Eu+zA#nP@4l=rW+V@iZKN~nC@ZBDbF}#dWJEld_5>Eav=VPhdtD?P*CI-
zU{4rf9w7HaeGZL@uq6x(po`^Ti6`s{s3?J|fyPca$c0BBE_7>UX`9Yw!YN=C4$6!P
zu<Q(7W)5{l1So0cKy)}ZLpFB7{2MW4dVmS1lzapz9-#h44v)wJP@(2Lz0s6Ylqqu0
z^aUoI;;a@73=A`-JD71wNkxHT;eiV{yMgsV!zy~i^baPS;*1K@IZQd_q++gsJO*(B
zSQ*r5u_DtQOgW_)W2VQLa>_Bq{+V85$|)@g%A*FDaThmb`UX=@DYH0GNel86G}z)n
zmV#0%G|$C5V3tJj5!1{##Ti?sOPFyggYMrk<CL!lB`Y6D)PY?EGKb*<LjtHIb3n2m
zDxL_60vjatAU?wfhQtU421W;n?;KlMU0T?hAq6UEISa!FhNKw`3@lS1@)H;wJ2-q>
zx%(OWn5N${<CJC8nf}9!Q;jM8#dHO8PH{$+=@#akW}qWP3d}jhML|~UKvMuHD=~av
z$aa`M$DC80QD^!Qb53nTP+6}4RRImwyd?|_jBA{PH`IaahC|>22`X0*FkQidQ%bA=
zl(r@~qZHSLCDQ{eIK?IRfbtHKKcN}3$Ygqh1*fvC4Fdzi5?64XJGC%3gAybx*B3vS
ze!zlL+!N%e07$}jf)z;6*eL;}1p}yqLEdBdz)%V@14~Sl225A5<P_JO!oa`~faD-(
z#Fv8n07{L}kSUXyo?ywT&bVcIhb5;PQ{|268$jHY={GDn<rx*G|FGn=mINKZgB*#_
zaB1q8?qkI%ZP~%VzyQr&jxC%{&7i}&p-NgnT3aCT=-3QiHvw-ev|O0Jz=~7c1yo>8
zfGBZ-gbchSZhykSz#`%#>>$Wg?b4>!s@|f}tO-hY&}7sNstJEM2`5aC*WwhH>j7oS
z3@70QpbFlx*%_n~R*UsUOgFIRlmo4%3$W%CmjyWtW@`&aGx)YJXyWU;Grh%{)0k0W
z`VMPOdq$h-Kdd?RT|wFU1;m+-kopnslNq4%({hkfKQyps9ARJpHzFVgGup*W&#~b&
zVw&+{`T`qHX-1Xldu%wJ8Fx&x<pizrF|p-T2D=LyU@k4pkN|-urui49m)LSDfzI8U
z0n(8${fsRq=zRJQww&^e8Pf&qIL%pm7#O%~ru*1&8Z&ZCZ?NN323O@<rmwK$l$QiW
zx(TGn1BVSHEirmVOn+bpZYKS(<5U*}RgIuB4-&|XUJ=s`>^bEXL8UfG7~(m`;1bYM
z9%zGx;RD0gEz=9^ImJMC{C3!L8Z&xK-($~d=5-j9;2a?78f+&-JHru>TR`Cg<Aag`
zD4W3eppph84{-(Pj(QshPI=K91_lNXXp<4*e9#^D1rD5IVn@Fq6=KjZJH|78jsvF>
z)3Gnp4>)j&GdfJa;lOFmIAgkiBd4(>$j&23@diz`=Ow1cIC4sBf+}GZs9lh($QTT2
z*1^gSsM9XgOkd#0DbJ`e{eUB<xh=?5$R38e<ZTE819J+bh3VML>(;^1&e_J*%H0C;
zFw~?EJEmJWamq`A0!jrb%s@smd|>#bGQGfwQ=HLbdWRFIoYE&y>UV)SAKr+9+V<Io
zfr0nT^b<~;@{AnQUpR3Z>9Jg3V36`~5#9jG9RYnRT^gO59a?QVlN2T@PEhJs?p5tk
z>sD{qZq;qkYu2Bf$R{#A#+lQ&J_h6(X6UuaADGm^Ze<4F-ps)8fk_=yjezbw0q5=y
zOzNN-9K;6~=pUHWUqJPP(hf*H$kiZuaF+YPqyZLZW?%pn8w?+qG{BL-%mCT>^?@l!
z15|H;G=KsMqySWWf%v>2gFi3@gHjTR&j;nh9K;XhgBoifc}Ns8g)wYTaN)eo$T)Yq
zjT<L3BcsD~2X{_w#>vxj+&PUI9i}gE=agd-I57QyJEuMPBpDV)1_nU}1}5nbOnx%c
z1w1(A!FdEG?D&DnPhz@*2RNt`JUHbIL5&iaY~2TDp%tL40yU)l1GCTqB>toipj%ot
zcyQ_~g34@|wksc)g+L8+82{}DCeahqJUQhBK`D?CVi>dZ2WFuO(+xa1<r&vZ5Afua
z16|fu;K^w(2+Ai=z08X~FeOi!e!!EnPskV4iUS?q#LK|IlKX+l_r&xBFHV23e?W$U
zgfDzx@(r1Oz>71Ual&*3Z%%ndP{Rvq7;EYWCLK^q5ya<ZU|=ozz?3L4J;9q(x!whI
zH46g+>xvId(VzxF0>qW9n_wM7sQmU1Op$j$E2^RL$3PuK1_p*bQ2A>g7(fHT3=^RI
zCm$FSL8*p^38aaE_45bD<SPsej0#Zx-w%vQEDQ|wj29pRY&;(r6F|$<Euehq4~!|G
z!U1Xko8||`R8X>81C=-Xz?ce3EF4h2>j%bEP;XBK$`AX%m<mePF!|&UjBmhk2$j$N
zz@RaOp`L*u0^(w};tvdv&MlN*|A9dhlxz<``Q0BFG=DHKFeX6xlRhwLgPKGj2ZJ^c
z&H<e_3+mQF<rjZ|c5|WpRUa61!QDA1f7b^F-5H=WRY4&DGT_7q20d_h7pmYY=teD2
z7Z=KZ0J@frfq@Zb;foIph9DmoK;_?p`m_uTOd3%BKhPy)3=E9WC}!vTz+gIofq`KT
zM4nyx1CvNSC}j#Tg7&5}up4|}5&<dTf%4rxFqnZdCQL)b2L?!Y7-~QYDxYKO2Wa;g
zDqrw{!3-3II#7PY2L^LcSqF6>`-Be+_2!^-x&f+S?gwTe5FeCI1sNFFmwjM>betjb
z9D6=6KswA2KKrf@3>KhF^90I2^MT11WC2J&F9QSny$?*jprQ}P|M-Ey5-AEe7(Uc9
zK)TWp12}|0XKjJH&QQKG=&&$ED(5hPb&a9&9v>KNK#6J!lppwk!4_0>ErIgOKnM1L
zx`j}F*9Qhjw;0NwT@UIDGcYjzfC_8`9Ztl+z;FV}Km38g5mdzVK>3$GF!_Q~H4`HP
z=<I)v`=Etz3=9m=IOg~O>Mb)cFuZ}N=j8stl(Px6o)wa9Ib}XD<!nUoIqE-wuF(ed
ztDzdSKQK6h5*0LGbGm$BZ~--=pi#sb{DHw06vQG>_3^NtHI$zMx*ME<fdLu<oK+u~
zL_tj|P!upTFmN`1U~mJasSt?zdd_yxX>kk;4A4ZvIpG6?8@TfgQNTIx0|TV<4dt)-
zz~J5k>Y73Mdp<BFgDQQH1%eC=oTol8cz|k`3aI=&P;Z=pf#D03|NR4l=L7}@CP+4}
zXW(N0zyRr=LlkfcfcoYP42)0*ajAl~%rP)9+=0p)e_-$fRqoJ|j?3W#vk<5&2g)^q
z3=CWWpnY%*3=E)L1>(npdh-Yma%FsAfb{A?=G8MWa20-F76LVGp+4ZM{J<;(YR|#=
zZ66r?k%EkCGH9<HsP6(YfPsN)2B^P}NHbh3KQIJ<stjnF;M)Iz0n*`zsz3XISqK!R
zAoJ@%F1-7JArRD+iGeEk_<<qt0RscW4hWx{@dL9Exa9~*MBKa|7=mUnFfd(#$Sc)+
zU>1T^FM<pV+)^Kyg+NgPs<S|RjSmc=pq6M3L_N3J2L{NP0TV+#10w?ix90~2$Up&9
zf$s+f$RGifU;KdqGDraBw|-!N3=ly1t3EJ5h6bSgiys&u!vRqKyAKQzpj-s?AouSN
zOn#t5%)(d?&PF`!pxdB8V<Hd@JmMc1AY%ehzRm|`Ay9W46l8)73_KQ~{c{Wq3^h>s
z;13K@pt@oPl%M;70WxL)<xlv)5WN936ba=o_`nbYa=?~)sKD+I43N<SDF4(4hFDM{
z^MLZ7e_)6OHR={X`9D7}#Dd0cGa!6kt`7`xphRc@<;#Cyhy(c;TDkE$d|-f#CqU&r
zKQMsD6Y8O<oHzUfvk+)d80tgb1kj#k1_lNRsD^Abeia(O1C2igjlbXnLp-R<1+#DU
z2Zs0-28McAgMoL?2ZjWYkD)=zd-DTB0;n?bfjZzbY{UY>=VSfA02!%(@`Yd{6i~hr
zY(xUeH~zqo4$4K)f{o7!bc`#g{<ncD2>8H|p~Aqx1TDGv;y*BCfySGl4&bW*Ur!7#
zsQ5ZTV-$#@mT%?<h8!IR1}12b^DX+o6b9<7Ktq&o-3O*H&;S68zx4xC7|4F`l>&kc
z419Y&FlmFz0UJo!&Uf+yQy8fB5`knpzMCJIv_X7Ow&G=A;CuOjDGU^1AU;U{uMbSx
zppp+%@bEG)@N<4(3Ip}Vpz{2ZADFa3l@o{$lGpgakXH}N_n<ZzBLf4!*#`#5m<l9B
z_`^Ri6o3jMXzj+I_<;d3o&uH6`@m2LDi@%Ml)wE0Lm_xj1u8$~14EGsXx9&vzwiS?
zF{rx;4PpM(9~kP3K?My=VCx5l5|D!epc?jnV1SIHK=~J8V<=Gm?GFs4AO}KAI{vpG
z7)n8@9;W~Q2L{OC2}HdB=oV`k1_mZ*HWd*5P|r}Yg@J())M#X6U=Yy%z)*REfq@ZP
z-3mB=V5m-EU;xe9fC?%B-w#aSvL6(OybKHiF&~(~XZOJPSs$4EKwTCXzv2V4Fepkv
zd_e{Vfwm6}bqWj&EYMsaaH{?TLlZ~=G!Y8)e_#p*6$~H^APZ)FU})+9ZE1u0V95uD
zX7Jbzlz#$r)&v6sLkpCD@dHE41qKEt82{D>rZ7;e8Cp3By!ybT1u8eVAZbjX{_6*Z
zc2FvX)@Fjt9~dAbI1mE`1wSx!gWB=X28y802L{NH4OHIk14Az;UqgdbF!2LJFK9>y
zTGR@*ePHMVc@SoP{|AP?I}8l0P!HD&&i}wLMS_8W2^s~08$U2ivteLhG=W-h@&m(k
zP;K=B%D?`B$q(csXb1^D_`m=e%Yn*&`M{J6N|YdZK?Vj!j}HtpK;2oWg+fdp7-p(4
zFfc+Abv=WS0O)W;1_owmD_2MwbebZf*)604x?mC!#6lJy80KGq_GB0t7=*k(Ff91M
zz`zV`h6}}fU|5oXh%%vE(6RN1Tp(2Ufniw&%)|8z3__DY*BT&MxEOSG0|NuY7Ko38
zwtrw)0UjcP@(+JtN?yRgzyV5;f(#5oXFo6nf=V_CNSq4Y|G;ojgMmRB+6EMQ@qx(~
zG=L2X5ncucp-&$ew!UFtU;;%^JtG5yFy{w`9Ucq}+|UqUzV(607t{uXY7iFwz~s9F
zv_%SHfw0mCCXqD^42&QPnHd;_4L>j(1`ioQ94PGefhjoy(Onh}`T!j|g34!nU^oIw
zb2iZWU%2)I!x2zf53Rj~Cx2i#0&2lP%WC1J9~h2;+WF9eMtJWBhNGZHB~1O94-Alj
zB&Y>9J}?{ujXXfpjPT13Oah<=iXfz8BmDCN!*K@&2G$5B(B@kP1`&=AOu;4$3`{3L
zg#ZJCh{Ok`U{H{Pib{S41`)LnOyD645TB2MLBs^K&x(P85$Zq@?+;A;p!%O5Vu48X
z2ZnPXA0B}?NF?<G!+8k?2F4U9KNqyGih+S)4Yd9j>G{Bvvl-DY7n%QoNd%PYWuXQx
z|G+E+Dj7jhBFMlXvgre}Feux>_=i3)34n@T5TBWWLFDoWW?@i!0W>}UQh)mcQw}If
zVf+^#n8ZNYvK~}ffHeI4z!V6o?Ld591_n`<4@_d9K^!HB14Q{gFbRN)R#7Nl?gLXY
zs4E4sP>_K^RPzIq04UDIq4Jg=n0!Fxh5{tbhz5ON5&#v|Vo>>{4@?3kp!#1DDp2%+
zNdQ#4!3=2nzyz8;XMky#^nr<I2?GPu6sY=nADH+-1r0P#Mb~{`5&>BNvXGg9L3HZ}
zrX0`>Qcxd@9{#|j0}DZr2QPnMvT<RkXJ9`7b>YJgOunFTERc^t3f_KT;s+HRpg0E^
z`1b=-GAK$w@`4NuVq71Xl0i)_7+>fEQ#jHHiI~a<CVo)m2GuWS@_{KF)OCZYcl*E;
z76D3s4Uqa>EZ_r^FR1<oDd1&b5R3T0#1G21d=MXtWqe@b2c>#YS<cMBAXf2#X%Z;W
zfz*Q>)bW8S8Pqd^@uz=a(gB5t0mOr1D?c#lfa(?)f7b^l?RroU!URryVA2L<I~f1!
z2PSQBwuBn+_ydzp2Ln9B#NK~k;s<rrpiw0D{{xdRD9u3AkT}l=rsNz%IUp|afhid@
z-T-x=xXK5n`edX5GjZJyOuir=!3?na0N%090E!|e1_p8W58%Dk44^m$@xwnbX@l}P
zOnt%!##B&{!{qZmFs3Phiek`xR}2i|6(5+wK#g3GdO-#T@y-wROxmCp2`G+u85qQ8
zd|=WBDS+`;e_#p&IS3TwAPu`eFlmFTUzq%<4@~@^5P~LR@mn95v_PpI<U^2ouRkzp
zf%Jns0OEi9z@%XT8W4kos03sE2PS?{R|y(~5`rI?Vt+6&FoS#`$iN^W|A8qMRB}~7
z(ujoN2c{SY&^#QJ@BD#@ACw3|ZA4}U28rMgO#Gk`6d6dGkx2f)lng2dKn?<#SMh-<
z8L8ZmsPFo~lnn9_Ou_UIjCUFs7z98;#KgcLvGN1s`2+?AUKoG(2gc<N3=A4D{<#l~
z=?V-C4lw@14@}meawGui!#^LGY(OCZ3PD~521&6GOg5lg2J#>;14F%}!3QR5kc*)j
zB;7wSS%WGYn1<L7OxB<@0@WZ{{DH{|$pXo)4@}m`7A*L{WQ}Bj<hBn?R><a`{lH{}
zFu$Hb^6>{ID`X3PeqgdhvOr4U1Cte!1yX7sn5>X2kh1x}WQk;fRPYBTON0dsQkfr^
zz++5M4@lL2V6uRlU(diGHSGhFC9(x;J}_A#TX5(DlLfK`H$O00AY1VM1Cs@k2c%g)
zFqy+GU|^7z`M_j>WWKb~2PO-c`SrXE4ALGSn83qu0gyP8j{m@9j%0y!=?5lrWDB}K
zFoDMbVd@usU@}LxV8;h0bC?An^Ur-?GDGr!^wSSaW>E9%L8DmGzdtaUAz2_J_<_k3
z$p<nTADGOLEReDLz+{GGflSB;CQ~E}WU@annL;f9nJ?4$fyorv{OKQ<Od#ghgZuw7
z>pn1<B3p3e1CuGT1-CvhnIK#6^#hX$k_EE-ADB##ERfawz~lqU*3b}=b@;&K1FB1)
ziCQ-71CtNP0Sch@7cT>YY|aNJZ&1Mj)6o2Z$p=)O!ZghMz~lpR05lQFuK&Q~jcmcO
z4@}<37To#3<PEj}5~Z@AJ}`M9nJ>rrfyo<Wem&FzIr$Gv-bfb6nSNmMLb5>4=L3@$
zk_B=}ADFz5ERd`Cz~qT+LH`FPFOUT=^Ot^L@<KL$_Xj4=3Q+wI^|9Qg4@{oO7QFbt
z<cVy-zYk0vNEXP8eqi!MvOr$@1Cu9`1@ev`m^_d?ARqC8$pguJ`MeKI9w$KkZ)lLp
zw|ro7N48-02PO|>3pRdW@<6uW_y;C;WDD+nU~)&c;L8UlcO(xeaD8BMLo#1M@dJ~4
z259^r8bk`_ADG;cEKu<Mz~qKxfkMg$CO0Gt6skTjxglFH;RBN^vIWaOFu5UlKw<9(
zCO2gBFMnWitw*-t)dwb5BnuQ7J}|i=S)eHPfyo6)y`t_1CKqJ&&L5aukkv<iU~&O<
z)u2(VSnz=<8Pw<md03EvL9y)vQ@snQHiAZh;+zjmE=WF5-28#b70CyRCqFQ`BKbh^
zK4=06gjpE=e`H`#eE$Fcf6%HK1_lWK!~g&PK@A)j|0k-v5~%+H(hiy^CCdQt{3pl+
zG94fUihq!P1~Lth2Wtkku^>JsH3aI_Q4LTc#5V-38em{xun+>Zs~D6_KQJ(Wnp~j8
zT#O71N}eB>d_hsbs0c1ul@dNM1%c84jGyy?$rsdDWDx|**DIBMVDbee3aEfm%Lm3t
z(5MxIEEA}MtJL>_DG-#%VDd9QF!_Op(V!MA{lF9iS_uZTVCx44$Rs<|fu}z(MuS>N
zF!Qc_V2l8DTp;{<2Bo_nm;yn~YM2GDKQMgQ0U9`f7@*AbfhiE=BdENx=m!Q4Bp)kl
zeP9eez`(%d0dcUh(FaDm7zPHe6HxsQ9~dFi_)vb>2gYbnM+EGEdIkpNgb$3-ph+ZX
z5GtpCV2l9y7_5MSLAl@q0|#jESVjOG<jU<I7!?v27z8z-7J@<u)a+(~gb1I_2Zm#y
zX*VCJg)=@d`GRtR2t;0a(FX>G29O5@K=ZE*49crMFhG{QKs9UxEih(aU@(F5cYk0C
z0!0bb0_C$Gn6g0*W)%d_u`56Lz`zUgQ2^9|uRkyaNrBEdf?D|f1EVLXcH99mPlfpd
z17xj(5M=ycMdSlhAZY%b50WU9FMeRkUdq70$OExJ1r)@fD1wHFiXmvZGiX2pYM{*r
z#t2YP2PW_KfyozCPC%nf#s32X%K-)k4h4t<Rl+|oS|~6uu-ORJgA<ub;s?ekP%{~3
zK=ublBNhe*HW?v^eCY?KKu~?p0r8Pa!w04ykop4<2ZOrnJfIMe6$H<us<eGz3IzA{
zAo42HJ}^drLJ(&D{0~e)prKgddZ>X*KQIf&g0dpi$E!au3xWG`Q2x#j(8W7YA0PR^
z6bS05K%+$E+y}-8P+t*d!SxS}(VzwljQ`*RQy?f!Ky!)8iw}&TB*9P*N_5N&3@RT!
zFh+qA5lq9c4@^OzH7!sLs_Y+_f<Q$zG)PrNKQIM?On^E-RSnuz1DVIfz@TdSfyqw;
z6c~^YP__TS6a*R><$&_TKQKlcfa-s!g{lc3m?k-Z5+=mQs<|H+ctLCEKn5~0FsL?y
zhRYElq}uj@(JO+1fl~w$BC7K~Fa?47f-ncK|G>ZtDpxEZajtsc19Tw}RQ;(Bj9~%{
z^$bibkZh!S@dJ}DXaxk!hxb1)1%VQg03?c3Uw>eLtOtS^pvLflDF_tAPz%-gJ}?D=
z>H`>G?gL{KXg~w%K{X9faDhAkagdtc2L_%Wpz=QiDqs!i95OHnfr~~pmk&%lphOb{
zNmOcnAPu0^%24%jAD99`wI$SnYN;O>qd+Ai%)<N+Oo3hu3=C0_AXlsUz`zKqo;jfU
z+dnV`)_(;JIzfD>HUXL_KtayLz@Ro4w0sG)91iN^Z6BBdAA;0F4LtgRF#<H80J9J@
zZU~ApXb7sk`M?+qYA>ij^?!q?XRd&RxZ3{@O!YZC7#LI=AaSnF^MQfm3}|^8#D(e#
z9~dJ*xd3W`y5<L_AkeTJ)B<&j4~!9@aswvs_<?~3R5VLK^|Qf3Q~(^J>LDMPf<Q}{
zpi!ir@S&bD5@aFFfUFOUk)Sw*@ryq&1wKOfSiR)~Qy@5vKtfEt_XCq3c*q74BI+|f
zFnj_<G1SNE>pn0>faVQh=57DL7zGLu82<qH_G}~z&U|1B0wo$~oT}e|4m^UQgqMLq
z{r(3=Pf#{=fCQ=fvky#xNY$zOrw>fvsar;fgESaHdqEH-rG~%<242v>B*;8Q1_q6K
z?GKEM91IN1(ArAF`~#yQXhfp~Qu1jyd|>hg1t~PhH9S5r`Mw1?7!m>+As?8MK?4*Z
zc|isSjl>U(k)Yvss1G%=KQKmu6Fwx)HA+7)FoGs1u0W!wUZeQ~qdaJ6)CH=b>jPsn
z$Uv9@Q$8@f1<i6neXOzi1H&g!w%h;-0gXc+n1#Rt7?3oiap40~GN>qqIS3R&pg}DV
zpO=9_<KqV=F;LMB3IS#Yb_R`KAD99?whI(+&Sqq^oW7=z(_F%Wp*SPa)X*qCDJMTU
z8^npv&eyXrpZ>d$vyIVcdQ%bSJw~(biN&13Ork}px%p+O@o7c*x$)VlsRi*lnZ+gB
zkCk$obMu%nI0uBrheU+v8JlnCY~*BSW;B`3+roL1(R}*z7EUi2Q--Ac{F3;TqRg^X
zhWL25P(SAoPk+Docs*m|>AtO;8iGb>!iLk+S~(S^orA+eoIUi642>;N6&P7eKh(;p
zrkR_VoROKA8t-IiX5hn6l9LplnpaYknOcmd+<ZE78>bng*>sOKPGdn+G+C4BJ#Cy7
z{3tFnGM>)d&S^8<znyb}0;-G=Lup=SUS>&VVoqjNYKoqb;q-g$oK7s6d1?96g*rHm
zw}*Fdng}s2nBFss)1NVB`kh&v@~kloOk#JY&E`~Qm0@5~pEG^IY)<j%_Om&8Salef
z)YnW8n9ZrgrhbEgNh1Ozr^KfIf`LgR1Iqrvz@$+DVk@(9FfeI!K$sE?Od2yFObrGm
zjTO@!=5Q*rS}-ta?3kVbVyZAO1uvOC0mRf{U<zIXVv0{cKZlct)r5g5c+2z$b2ybb
z85o$tY8V*y#!ly%%c;y*Gu>b=ry5(>0|rJFhv_jOA%*D;Aff7S49v~PrmvaHsmRXu
ze-8tL=)&n&=5i`Ai6%_{0a73y!N73&+H{q9oJvfu^`?8w<5XjMoie>(9;X`Hn;8s@
zA_ddu%;QvI1La1g{^>_RY~>jY46*{#-^}Aw;&WKRz@Q5%TjUuSn4G7}%;%J1%U!|1
Vpvf}bW<IA9)3i0y6XtV@007XtMdAPe

diff --git a/pc-bios/hppa-firmware64.img b/pc-bios/hppa-firmware64.img
index 630edc35796c5aa6e36f4f5ad8e7ab3795d59cd4..7d538e4ea333d14662fe1e5863608685c32e56b3 100644
GIT binary patch
delta 311526
zcmaEGTWi97tqFQeO9dtxgb6ix*#H0k;R93M2^c+bh8@>w0R|9Yo>V*Wfw<rbh}3Zn
z7(JPTaTb%2!R955_ZYR98ons<FqqgeGAI|xF`8GiIDAj!VNfWOV>C%-Yxn|U&(UKv
zX<_*_c@48N<Acc;n5CGw6(+x7mS;@Z%)_#ZNsOuC`#~Ot7hFqUnBQY$P;j?nG;v~j
zu=xy|77G(s!sZ`b?^u|)945cuU&gdXV)6t5xq9Y=FA6*i3Yv0^CW>4SAZ$HG6Ge6f
zBz6Ost<DEh698swg4H0Y=bQi$N0_sM;ei$h1CxUSOrIhT!wZE2OfMK1m6RU|Fqr>m
zVfemTSCE&9X^FvP8(}4;Z9bC|gyk6vHa7^Hu`;djnCvsbe)4w-bEf4Hn++r{voSVo
zW>L7oQy*Z%(O@Faz`)-iaG67%DTYIsDU^E-*A(t4Tp@fV3Rm_uC@69N=bFR)hbx||
zp6l`phYJjRB|-=G%~IeppTod(dk+7D=J^T{AUzzSOpzdcTqRsrOvD%_@J$f-&No5e
z2fw+{hjj<z@A6v+eE^Ap_~!o^n9S!eh%(*&&;I~q$P0OSUbC$X8$eM!*+N&Ib;Ilb
z8xtqT=mslJ&`uCw2(V#T@WSB&lX;Z=|M@ZVkAlRyXYIcpV8bwB^95ahM#c@374*d!
zCrrMeD>peze_{Orkdhbj(zyXP3>Tp6&;T2T2T-<cfDOY3C|fnahLHiv<_)l66o9a$
zz6RJZDnQwH18f)#pzNaoHjEBX_Syg&#sDaLYJd%60)$;JRU2T#SODQjr3TnAHbB|F
z0XB?aKfREbG7Yd{TmTi94X|O{0A;fV*f2spAo(`Hh7sxk$*Tc2j8G3q?hUYEgnB@7
zX@CtA)B}>e0X9qm+Vu$n3@_v*O9O0}pgxd{4X|N?`ase(z=jFx14-Qg8z!g^Bt-*k
zn4mt8_#0ru1oeQ#(*PSLs0Sp@2G}q`Js`0)z=jFx0g1T*HcU_tNVL`m*f2qTAdwqj
z!vyt#L}-8w6VwM1wgEOwP#;LB2G}q|eIUUbV8aZJ0`ac_Hq1~Dh~EvcVTO7@{Ahp;
zGt>j(YXfYU13)Q<|B%o@?F0q}^LvbwKO1fltu&Eh5P2al_m+c&Dcbz5{leG(R|ihs
zW8}oN>f|KjZbrw=J;vLZn3heP>{BSo{BM8k<ODN$M#;$yX2pz#lfRg$G3|XiS;l-b
zW8~xu=F*a`9IQ-HAft+pSv7L7Gets-T=sD?i$yS_=i~?rbw=6A4Hoi@36mFCh^K-B
z52S{_LEujD9lOQ=8|DTO8x+gMckCtx*f4_w5+qi9$8KSO4f6sJ8!Epsz=jzdpdhj0
zJ9Y;HY?u##*iiY40XEDRCd*hRF)=>?TL=zJR0~-^dHW7j!^8j^7I46V41rk4q5xt;
z<u?Y{uz&*?BnGjN#R0^I%3lnyVF}p$$FiJ>v2b&VjT<A==7*E_*k&^xn5<zJ&Uj&R
zgIznL=41~0e8vr%E9~PL86RxE;Sk5jw0iDj3nw)ujt`R)oU|DkCighGfjACc(u@p~
zKRB&pT5)#r0%xcKvB~$GMHv|;e{nVgDbjIKW@MNg;Nr%#?C#_lE_xub6D}ZAzPQ+d
zI1p0;T;rIQtew2U6|CTaD@YTIn-N^W<`B0eW~MzeC-3kC3%>CLsSxl2D+e2~ImXM5
znQ6<#$#Z<QK-y0Df-Ug{E7$NdXJnY1;OEXLFnNXFaz=s80shvEf(qa5nWlh}9Jdvh
zWPk;y!Q?ps$&3k`0{NJj_RXCv5WJnyVe^ULb&O2wA~siqE@rG(<zQxt+TWls1C)?B
zq?uem@%8%OicqL{14tZXqDeBS*y9WUh5w!!g$z&}1lX`N1Rt_{7<|}X5L6ZiAF=0s
zAuoS5z=j2!*j~uX?+vhF0Vk>#^72aqY*?VVQ@%IAhGhf4-{x82h0Kf&lX;?#GYV|J
z5^crEwDIp`fmkV~jYlWz#5VIL@J|-H0J1;8gyX{GJ+a2T1^j=64uD0BISx$z6Wh+%
zFu5g8opHkCHF4^U4<=uU^JbhdSs`AUv0<}K{4PeO^=BvlNO;Y-VDgj1X2u1RGm`un
zB`5DlGG^Q``Aw2CW9DRmWP8Q~lLL~2IT!FZ3pJQ9GcZlcQkZ-u`5hC>g~@wT<d_yd
z-Fzp7jggP#0X&HQ?zf!$AyuEzce6qoKO^IX$p-1tj0YzBq^mPtm|T)>&$wXnmh{Vv
zwVOLK<}os{e3-0}^-5{$$KqRd4?#g{BF^9eHtUAnL=#CS0dTPY-F<bkN%khDJ!dDs
z$Tkz(G_&}Y-9?aU^Hv5Xu$OH(A51pMv1c@#T#~bniSxr`m0T|-&JUXla-Eo%)_<M6
zC4U*y=BJZm3f?g-{5sjEP+HUz6p<h^IM|q?Ahs+#IJu@!nlX0rjKUzM1zRV-DO6)x
z{&BNNksLGA!i|$nO4FDYJe)kI^bynEyOSHrjx+Xd_9(YzW@MP$Qgz=kltTtm?3hR}
zG6dhW+X(gss5JYtHP@tyK_DZYQ2=BiB!#d-b36k>K@FoqfDPw^%}c7;nHU8ouc?)1
zRM>o`b{iAZmIISp8iJU%&zXFqA&F__(#<xF-<X&dZ=Gz?a*1jA+Q}TPc1+9fPWEW+
zW)z)#rB$7=bn>6pX-xY*Zl2OMn~^bgvO&i*rUiF5pXhkZ$e1{JP1k!yfyr~a%{di#
z76^foXyarBZ^g-fyVV2@JRb9KfWq=dGWUZ3H7<wACOu|uJ7PdBn&$m+XM+#fHG-tM
zYFK0fRJj6pZU}^c_&l41JOVVh5;)kH!g;m`fyF%P8D?;>GDY$%7jg-(;3}BBp(mTM
zV6sfFnbNi%kb&lV?f<`!mwC$@E7ZVqLLiD)LqPI!l>CPm9NT;*m-M<@HoRcpdje!6
zuY<r${<%T{{I3M0Ua;?7z~3R{0kSs0f@=c*T%iyS8Ky`OpMSnkLx2_6g2`WcX9=zQ
z39AC2VQnyZLEm=9%*he`pO|)R*z7Z59uw2%g3WIxX|Xb`l-MjW!<>;(c5}eYM@&qc
zw{A9>Go6WX!{jsb>?IFy|6!6*e#F3F{+~}CWDg(69#gIhlU3%sGdfJpnJ>-zfd7vW
zxY7-<Vhxx)Wqvbb!eogBkC;|{o&0A(y{RcE9f0E9WG4d$hz(9`zjw02)5}f<0gyO|
z50Tq(cJqdXZH!F&c22ffY|ZF6xnyxVW8vgGi?wYfVLszXU||O9Vun_5zxO)A<X*_j
zr*iNxIrAh4+yse1Ox?>k*=30p)4rLL8<t2h?fy7<&JuM=!P}PHzrn7PWQYNo2T{Ab
zaPplcN=$oaPFgA@wd*6u5U8RL2t~UNPBvMZ&los)$x=0@of9XYS!yj?z>^>#dE1iz
z$9x4FU64|cR*0E99!^$Srq9?oIb>N96W52yJC>y}?Y%i!VYxA5!Q_zT_L>bK^<cIC
z_JZ0393U&fF{sQs0WSA@cjDwd%guQgAVhZEoV3D@Y4^;@4lBeNH%yLLq0GoQxn_km
z<AKRLR@lX{UH~cOU}g&AU}Xw7kzimlkz{xTw&>5ILQpxdzrpS)$g(+m6g)r{f^dK(
zE4-o(uwr9){eRb5P}+SVFW1Y#%oGDI#4TALOb%HY461EbX0UvZ=V90^uu6%se!)qQ
zmGc{vK7fn`8)w0$01^wH&d>l#NC8&d3}7ex-~H4?l0gEZj)CC?1A|9^4L8H*|AIaH
z<L&)H?f3Rc4jkt58S>2MGbDiZ+Hec-&leH^)iJR81!M=Lj$t!^HY-7u3>&od1*&A&
zpv^~6CBp`7KFXH{*s#GWrPu%)HgHOQAusP5V8aHhpmYOl*kBcuXn+kHxV7^_UhZ#z
z4I8xeDEBnLh7H<!lsj7=V8aG&KFVzkuwerS<O_MZxdArp(B`9DYk&<qxRvulUM@Gl
zh8@~`lnV{8VF$NvUdYSY2H3DeJs_tVV8agefE;gt4Lj5WvR?yi*r6Vfy&GV|4)TB~
z!wY%YqX9PTP#?&y4X|NfF!{t9Z^jLiMb?56M!?!UCiV-H53H4AVt+9C!CEyY_79Ue
z*2Ob2OwL%R%_uN=%DQ_@EDt7^tnX)3n9Q=Fo6%wNgbn442AerHax*d>m@KkMnK59p
z#U^=1fyoh@%o!6VPuL{QSTK3bCV9qy$!9hNF)h70Sz)sj)6$QVZ8l2_LYtI`@_us0
z=4!?Xlb>wXXIwB@WQ#WAhRF_Fym`R^3Q8#f791BQ&j5=b*`mh8@nG_sE#MZ9#8yxv
zCt#~Iqv7P7tx2Fp(1oq~j0}^uNil7hI9X;}m=eba^TReDA?a&ZEGUUX(w6{3@O8V7
z0T!GBlc#J`1F7D#t)5X~vd#AYjE<9Sb{u8?wSVhmmYrQpJN{0du=5?$_P3K8b~!T|
zOg^$}JEQ94n%!XQ9_$up6qx*Dw>D$rWR*S6jJ}&Q_AoOticZeiYtQH~dClI{g1IKl
z_Wxm)23T<hOwQQ%oiTQE!v157Oe@cB);P$`D40+@oxuT=qD@2?m;&s%6(+kJTFn?R
z`NJW7MuW);hgUIe5tw}D@H(ayM<>@D(PCP3cJhiN-i)S`zZ^Nt=sS7G(Ke?2GbcM7
ztL7{K`}Nm8!O2ICt!8YPTyR{R7g1*X+P!h}l;cfIOxs^hmN+#Xrh1#^<Q=D+m^dy>
z{&Px>Y1_uhGN<Di7fh}>t<890@`}^#j2ku^oatj^+AwqSfwS_Ak&_>sO{!o2(EOGi
zBgkhU8e;7ROHhP?#7ra@l+171CW817x%G|aw`})=<Ull3>?TMaBxWMPzy)HP-?VLn
z$|;)PvQq}hfoP~$B}k3)eOu?tlMkNLV>~eV!?|rtYfesHalV@Iz+{yR>Wqz(eJ&_7
zT23ywFwJYb1*o9nkY|eGkYx(tkY$Q|!MddZB-Xz`!2(oLfaOG(B44m=PD!a@@JT6V
z@JOj;0Ov1|Rlzsx3<E4VFH8=&sLps`a>d2TjEs|cE=4hMKA4<w={IBG<dn-wpaxdQ
zWh+LxMH4}#Jjlr=5)1_({U(wOkkakfqR7n;u7ol&|J=WJvc<K0Muy2NuH9x7o!oLg
zcyjtBp~)|=cQHClF1gVy3J*h&pFxJa{<T(cv&c<rCdS&y0k_vP%1*i?1!~2~fT*>b
zE$-wqF&>z_;@&f+HGd~hxG&9UuzAgWK1QZhODFGnAkFBo`No5Jj7)3JZmxLrnUPUp
za?X>@i~*Asp6+Lio&4abG-JTzKTjuv^6fKe#)8djp50;sWu=an-HZW~MP4nJ1eYoS
z_FN784+QRmQYrs@p#uRn+zpejyz*k&dULYEYj?p~MCM{(2(agFm|XE%o-udwjMvJ#
zuEhsz7lML?gNrE=<Rg&JUjN)8YEs4E02XIvg0ww<ZaKU8#p`t}QY+sU--o0w4jCr5
zU{FfqXNrCObLHF38$NI`g)O~me#>?vSg#C|E5gjBOF6h8%}<a##Ga+TAbF@-NUIvu
z9R0ae7N!=I6auWcCQKIiY|MCIv&(0GMn=KOAz!K)3npLqV$C>VGtbw2Mo^acrp&lt
z^MY^O%#5j%*Zfp7T09lx@BIx586fjPffHcCy#Zt|$V`yE0ajcaOvE|7UjN;xX(Gv>
zF`4DpW!VED6|etp&jhJ}=oA1almIKP3!A_EvSVc0ymhk4pY@CfCO`S(%=lol#$S6z
z#@@{t|JWHBZ6_D}k7v9v`NIEtM%$?YjAl%0&u;Bt)MsS$oW6sRaTe32iPJ-v7`^1U
zKY;8(bIF(2f0yqBxn%nuCPsZm$p<_M0#o|tEB?4OnIBwPf%F7eaXpyM!oqlsiR;7k
zJ1mUyj11HNurQux?FA+2$qAMs(;u)hs!JNY{<}~R<_Qxi1_p2t*l=x_uE549%_uP4
zhK*63(P4TD8>2O2!1M)djK-FT_Ra5oKTV_<5bYZ)?gWtKuYc@$2{RMq_~2`xvYI<#
zIuARek=WjuAh{RvGIv1%2T~tk#jP+sgq?8_(~_0bf3PzuGZsvj;b5H2=rDZ;2je@T
z9VcP=65=`@hUq&v8Lb%&r+?vObYj~1a=HZ<W4&nu$ZO_z?HOPHUfc+>17tqP{s1fP
z2@vr`j%eZwroZ80+{Luv?erDgjOwl%z{-AX)<h^{U<k0{0XJ+Ra+^MK$S^r08GV4e
znG4*6h01T7F2ciDFT24+hQR=23{Q;^6HkH=3kNqilQ6#iv9WUc1|CLdQ30MBAr1~1
zCU=O=4Hr3hn4+c^@G@#mH{xYf6+Hme&I1yMs$ra-!^;@Y*f{+RFXMJbh3PGPjCOq7
z7eM7NM8(?5?HBkM#Tc1(R!o1v&v;+56Ol_87y>MLz>SpvEA9u=9|$mti-JaEj&U%<
zGdAPvAInsy^9VA!GZsz{5o9!D;{GtbN06~!5|qFhU;o;2)I^fu1S9|$7y`_A45ph1
zG4AtYzW{c?ug#(+k_=4k4GI%LYWiE0uYkpW>@5U&XMcn87LYh3Cb>bj-<jW_+y@$W
z*x#UB1Bovlf$0vyjOMZmV6DHG?t~>X6J}@<RpW7(K1G<(p0fe0<j1za>34(~jTsfD
z3y3iKGipvx5MdM(+6GFWEC~B}0;YF}ForWmPJbZ6sK&(kVLFE>qq=AUUxI)<_k0$4
zzIq{O4&Y9h?jp+Q$F!zk`V>*dWJb^FKSUXw86BtFh%s(w44nQ&jIo;0c6xz0<1xA2
zYdLr!g_el~1Gsez9j;@1{e5@o_7Dlid(38=w}RrK_^?eNl5+~O&)R^yqXCLMki?=O
zFst~EjUm`m-*>#7o*~1S%-A~pj11#>#)j>4WEsoZB@Mu`zt)z50u*AJ04S9@OxICm
zROf})egRe-7p5nuGKw=MOs`O7^p*s*E*M|`SvV1)k%1w=hFf9!9aTns(N>V~{00RB
zBr_*WS5RX-%{XED8#P90!AO&13``(d4jHD1z*{^G(<RgygP4{coSvi3=*}28eTzDy
zHDm4c59*BdjJ4AXG#GC&?KwK#N0ae2W9@beEk-*=sl_Ki)_@HWLZrGEOp9kspP<c{
z#<VbI`VVc!SxkGDOrN5|_@2>WdW$aOX~ux*0eXzVp$lIBUVj(V1mN^y@_HdJ{~k6H
zYkrUM0jMx3K4y2Z_=w#{kR`>3?HM_wn4F7G*-b1yX}7TWgx$vC<8}v&kJ>%-c4x4-
z@tps`>+d^#r+?666t7<Z(hf?0Agz#MpHt`c?{#-Ug)PXvAo<sS*X4q&_ef<hc(ZI_
z15brO2S`0w?%(=GQ15qtg93P54KDtDXDbIgcpNSOWDY3pgX97%dBAqQ{=KV|gIS9y
zs%43y2S~w$1qy607#KhCWC(!cgeO6u89u)AZ{5!68}u2ac|nEMLK7JVhTubXjFT5c
zsMjmLS+W3JXh2-E_9xUe;0OiT2p0do{V&Kh^Be4HL6(8UK^8&ewy8qolo>#BJP86b
z!Q%h67J|y)7xHpfd1Zte_AIbtHId;d0Oi`_dt$#re53^%UR;w2a_#(9+r1z|Ko&p@
zSz`$nZ&0zAzQBM{te%A{z=mf7e}lj=o(zFG#dqusO=K8YCM>XEGLd0mOTJ?l=y8X^
zqQ60bL%D;2A>$5%1y6#&9G(J!DJH@U3VSvy{&2a^;KCu#6lo$Q!0>{3^Bj;}AWz@k
z%>98wm?`oF)3y(w=mM$nxW!;`dolNi7tEV|Kw`J+_i{e~DdMQzv4BIC$r<Fx7mPbt
zI7FDD(hu8(f*fyt%g(U)j$I;14rKW2KTA@JkJ&kbDuLiTc8(x5?l<j1LGmvcxA(Zu
zVsN=VN2+^Hf=wzYq+ZC&#G1(1|K?dBAPLfc*;4*Tz%8B)uYa#xT5pnU|NllZ{{xUA
zFXW}ank;2t0x1F+_WIwdL`Y~^Uj@k{qGH`cNK{BK1z9k^K|uplhj9GwSim9A<bLBb
z_t$+1)}<yg_HQpumj2q8U=4D>Tac$fq40uvV+c=%K&SZ~yL!XhOSvC_rV2pC>YT?7
z;A-xLywq1-W}ya9(7W7Z0FM}Rq_aqI$Lv@D3fdQp+m{rdv@<L|YL^Id7&tVfnOxHE
zKtkd5pGB&mP}|>N#|n~nzhf5~3<<GFms<=jFPJu8;BMt&y}j3o{{i=6F6I~V@~qq|
zxj5gfu;K+JXHa57WR1;xK`pcw@{(6gWbFTfayv*KH1`r<$#Y=(79&P&Q(gWDfo70h
zH+J!Z3xU_)H*5t3BuI=yhRJo#0)-8r00D_X0(aTL=_1CAMN-QuL4moy!Cn@u7Cu70
z?B(<Y#*AuA%VthLVazD6dcortgMzsw17sxk&pvR=k0(v&07x6e$fbqTc}y6M89Apr
zm@vvQEzO*sV8Uq3`=Iy;BL`T;@AYe^FEC+L;^p~(BsP7%38NbGaYm2H2P#CT^O`aW
znyp*QA0f~NGWo_Yn1|ND2jD=lJ?DYK3{(#-a-1Gw%BaV*sBwCWDWf~1!1ObwjM9v<
z(_fe}&SP4eJH5k<QH^Qo-{~977{z4|aBwh%aBwq)a&SS0lQ=k;A|Q_3cX0X>Ge#vg
zo(r#k?<<_nW6r2;$O{T2kb6MIV?Zf`Lx2^}1JIZyC_n?s7y<&y86Zu+-+K>ourftV
ze__TbXU6m4_3yof0hJ5}u)<<~gQ^C^90mpxaghfv7<g6$Sn$FIO;`hrc^RhfF=xz^
z;(zh~|9=}8W?<m|17b5UFnLUOv0yZgv|(UiVqjoky1~G}vVnnt)rWzB^#lV0n+gL1
z`ve9C4gm%RjuQ+FoE887|Jwq>3=E717#O%MAT)>#!rVI;7<d*iF!0Kl$S`Wn+0&>n
z{elIfa=iekv&5Jxao~EBFa!4=Ci(pjlo?Ef?f<tdQBt@(NBVzzgN-aGB?j1VgJ#k0
z&wrpK6i~yEz};Z6;01$p*ZZbL3rvLV|9aFgc<?_En0$Q>r~IX2>Hl0cOfleq{=2gm
zG~)V#fw7?=fg!*|hS6=$9_#vmREC0p`ssO=jGd_lN1q-j;Gdyz6CCX3kYEC74zS`i
zc>Q}vAgCDQIUsc41p~tY6JZ91`STStOk@~1UNA6#EdLME_d;I2H^7{i0n|F?xg&Ie
z=Z+A#`{Gf-VDb9fw!PD1tQe&wI|9-e0wy<DfV6gj+|41(6cc>N&T+Cpr=FBuqKOR4
zh8Oa3YeBjh9&qdex#IQr1+3GrSTV*KtbfSC&J@9OT<E|HdD*QQ3s_b_f`%6~pLY}#
zEbphu`GTxypEl3cM0k3i1EZp*!T<mNK^eM$fq`KL0|UbuD1O4g!0-kn2gB3XSTh>e
zyMlbk{~2V5{897&3<3c)3=Z#`Z2L`Q7#!ZW*w%yS{S7u>O@!@#dhB5Uxg``d-49B<
zVE2C8_!N|2L4E)wLh~66OaWC4pyt%V*WWhVg2wt^$jg+1><Or6a0uALFk$~6n@|&B
z`<pN1nWRgnC)hCBgStUBjK-3^Jolj!RW`h!X|p+yRAH?;{f!NyG^Yd9#<|l4Y#F63
z*Mh<nBD4rR{>t5;vET&*!=)GUl1q7N;3k0r?52qXXx<&vG~-Q}o?^>rZ^#IW=@;^n
zYe8;%Aulhh+`#w;6t4RlEL%ZFGd$o}3i2D+itoD^r(dyURF2#cV8ILS{)2=;O&XAr
z*S|MJqBd#PzXTZ{P|py+{}dFw;#c|q2we!MWJuVrU;%D{1SB&Am`E^zx&RAbe_MBU
zdVn3Hx+uu8cf98?oVYwk-W3$mFXY8#r}x+~N;9sVzQT@CnbBbS89PSJY+?JKFXY8V
zL22rJ$F{#92lFftI>56)=)wyI#vKI<7(g9?tMf{YJD`g-HoTCRZw0N_c>ji1z(j(D
zfoF%%0TUVKe>?>O_xJyqR%#+_|5ZCdfdS;B081utW9apt<(<<L>>2eKcTMlNXB1~z
z_H+6Qdq!hdUr?}tYz(mB1rK2I>=C+9u!lk6g}jJs!2$+@fO>|6_m30`0%{ln-ak?3
z0A-y04@~ZYTnbLg#=H}zD>yJp%kJf$51p~J=bZp5Bwol%h=MY5fIV-(^auw=d2!d`
z`3wf2$a&u({1p_c?H!ZfLK3}dy$u5cBhUZ;zc(;2Fq8yTfQm*I25xySk$H0_r<w@c
zzXe-o$+3a^Czm966upYU0ZpAKT%8rihJZ>22ku{7QlKb){bz|HC@Npb3;qQaDqyki
z+cTkJR|^tE7y=+J6KaLHY*H=MWz(}A8HJK%V2+sx%0^(vfMyB;EO{58I%48hm?OXg
z;#Ry1Ok`LXUdRh<g-zgsVlBXm7t+N2wtO$B0D2)WP&)mABcpQUSCIR_euYNK{H_VC
zpa>1HVNTc^vp@pMKCm}t!ctK5DbN4MXg-Jk-}eR{hP^QpYE6V0n7-6AFzj{ip9)F@
z5WjA`I6c9MQJP(*y}^LjM0k3W6JrX~n#SoboER--Co{+^KVWR&{=+4&JpX?*$h6Ph
zJPh;y^i4Gpo^I#NXu-5Pae9R_qd6})zk*W3{sx_=(+@Z^%K5DQ39<%MaDY-rfE8~7
zh!3{*_mYX=+7P<%10??X*K%7EDdra-^<Xt$_lQEGf#;}+@N_K~M#cJCP=)eBo_j9;
z1EB*Z!i)_2C+mcR!~)6~4CWosu>}P&sFX7ig-j6he-%0qV9a}fFG1k)qy!CyZCeDG
zI7FGivz7c`gf0Y_fReY+0lo%-E4QXd<?uHM&6t;<b(epN(1dwcwdaGv(L{uSh5w7t
zfm_AXPq{D(GWJft<H9Jd4r+$qc_Gi`TKtE>!J{5Dd&9fog*@L<@MvK%L&CchuKOm!
z)8$+lRXstO;K1d{(*O8B3pGH>Jq3kZCEO1{5o#hXQ1wDy&@{k;_X5Ke3Gl#pfDO1R
zxXk}R08~!izdeWh!3%lbwbOfC8Ko_cg0dMX(7*xpbJ<FdDh3Ns!0m5U5CAoIUdVHT
z!s<Jy2m+PTV0GX2@0|X?mC--&X~7*xw;L?{bLmWvDh6;rYJP*=SCICA8U_RNIrjex
zY8VVW{xdj$%9Z)^SGa<L7u3cE=>u60GXC|qeU;N2+!&Q~Ru%F*5V!>@rxg}5Fuagw
zyUTM_=z{r8yF!rq*FP4q22?RP%x_Q!<)CwJjGFbK1$P(>UdYSTf)Wm-_*DDKA;}aG
zkjfAM(X=oWqDk$niLm{5{sw{j!E+cCc=ih&;GZCH=Y>4$Sy0gg%A(&JSnc08?cWV*
z5WJ9Q%LS*48is`TEv@aKyz@ey4dj8pU~~U2eagX5&*Tu0#*nb*fEq6-9s+DQKpnKB
zbC#)s^RjZY0t3i$?p7|D{V}R%!5Y6WcLb%%`E9D86#o`fCMdTsFqqF#kOVc-K@NK%
z&$6^24N`9GZ?KyUaS*F7+(C0#bwM6%XPwikY9c&c%!5(Ywc!8%PdG6H1H%pm28I(b
zH4F?45ey6rHK6bZl@ef=ecQEhdV>d}RJ{t+H@pw{8wBROU|>`LRW(o_g6a*K_6Fsn
z5I$JV3=sRa4F7`wOWqGWdxQ>Lm*8jtRrD|9IoIBn0F9D@>Q+9`BxMJGgTNh-dJ}P>
zj2H4;x&an^0s-|52KyiA)SLge|II&L(vwk6R5hTAL4l_L6h(|*L1uy)F4H|c8SR)B
z-JIUx$!MJj8mwvr6%C-I1gdOJ#6=}u|JuolRM|GZ{<C8$D8LcwctBl>#@D}gY&GFz
z0Qb5<asgJn1)w$+$Sm`__8|Gv=_+1~`m7DFf9>F%9^u8P%sS!qukCxMH+V5Bb3zT-
zo;rPv7o#@og4e&cvrfMQRkUsEbQW)fqHVF$4ZIoU88=K1@MhHW+PXJjCkw*jt;`7l
zR=nV0gn(@<69TrgfQHx_19mVgy#BQ{HDD(*V)@5T2894CUeLf_<Lh5rb*G>3W;ACs
znC8QnRL}e1^{>ruLCyzdWUv?h?%@P^9fZLlF2iFGV9e(L>dS%n=J%KriqF_32Iz1o
z6rZwdG?51tdI}81$L%&2AGNz!e94Zn_@bR)@dZ1@;`4Tf#pmoCi_h8x7N52&EIw&B
zvG|1D!s26g2aAu`JuII7(1%fkasKpgK8%Wn0U+Z8RQVFJYCv;C3=9EUd<7YMAneQ-
zhJXNdKJaXI#vg`&0As!h(>;6{?HLWGcla{O3n~Pt@irhDdt40Dcla{OT59uw+a4gJ
zd256YC^z)~576NFU_OW8#OG!n23{FRn+`0l$H`zmhv5QP{LXYfKStSlQ9c=X=dtni
zuLbb#9W?e~3ltiaE&BhPTQV5D{;~V+XJsB}L@6)?*fTSHpU=YpQV*(f1FZNMK;yXJ
zp#HHN+-w5{Jt*}x+bpQKJp)ucg9Zxu1kCT&gOb$xSWx`DVBi4H;(Y(dJO|_(kXHjt
zz?IA$?msLtFXUy{^34JH2CNyJ%wPZ937#7SSpafCfF&Pz{E|b4$sg>1Z)*iXg9RY@
z{SE2?py3jb*(Nd!OaZ#Q4!reqU?Z)33wZYk9Wb8*S+p5o&*uPYRe?rQK?d{I3mpis
z=L_KA2Q82hU;xSS$_qh~r#&Bd9RWxTWNCl~M*+wZ-uoauoZwjJe+*)C8-T<iYz}Zt
z*F%GB1241CflOxxhm6Mz4zIthsmxdmnbQJU9$>`>o(2RN{`$v`rzVn2(BKEnk?|&g
zntdRH11$LtfYgK31z7Ply#BGH7ZkD}--G4#xfk$)m$eCi(@cOBpDAcYqVe_59hQ*M
za@7d9VpZM%kY=6*0y9B|23YZdnoy0ee{O#`y&-^6p`K?yXps=#29PRV27#L(Yq@7~
zNxuHEJ@>XHWH<?Itv&Aqv=jmkH<0?*Ker2lidwj>T6`Bw<axlI1!&NKmzzM;ZjI!1
z5NZIao!_7!2^t1+1vw4mfB;KA(2z^x>u)O=r&|Ov%GL9MW~~}ue_OE;)bZNipa3o}
zKqGs+F_0BTV0~8npx#8|>z`XMqBumI?*R{VB@*uffjdyOkn-*4*2>_S3<<mo1nvia
zW=NP<qo4qCRPi6^f)aba55@Ih4k)SeLzC)e@EW%H4GQ374hk8lp$wo@2KM2%6`HUH
z9Jt-7%G{vrB)|Y-gVkCxgE|<E+^Q_BH<ofgc>Q}(ENGYmWI3ps1SNHL2crgd2c`xo
z^C$*|IlJbAN2ysB7&S03urQd&uvPFJn4TBJs8|nP6#`1L*>l)-6wha82(ae|r}^Uf
z>;fk8JP9B<^Z)k$-~Vd>_oGe3r7i?m@Pj9AK)D%Iw}4&!YdLso^aTS0c!U=eB>`6a
zpq57C>tD-7K`sZm5UlpkvZbJc_k}#4)Lh=j(A;d#y<s{}Fr$nR?*oB5pq373{TXNs
zj_1I1t6)Z%dQA_IW>Am?sPZd#>|s#oZ%};!G8iQO`p247Wd~S(QD6wrXFdQ5vH&&a
z1dj78{HA~8|4n>Q!N9@K6mxryTuyt7f&$nqdwv7Zn8>vn9wAT*lIMZId=7c07?7v?
zpEXE;)PPC~p87vR4Il=n@fM)Y@4)jw;6AAG=lP>>ndh_60ggXhcT9vB7(i`Q^9wc`
zc^(LyGZAHQ;Bx1Z0qrv2%M*~~OA(0TOAv_Rp2Y%+8m1SF8&-fkP<++)<Lw>X56pKl
zC=_3|eaLxv#{v#vCO@#pey&L@zF~W@9u$1RH*7D0Gz8zYeP}Mh07+E8_g(}=I)@BX
z2v-1?4F43N1Ho5qKbi$G2<!{B`wP;?!N(MDe$c+L_@M1U6F~+B6Fvq9E(5T`?(p{s
zNb<J`MDaHWgmUeIIc$9e$R5z5hTEIC9|YgEtv_fM#Gn95nXiBE`N$!}6u}|G6wjs3
zB?Iy?$P)Aa40dLQ3<6y7T=M($>}|h4V3Fo|AaIA{4vT!oeg^Qs8qWuT``q(cg!v~6
zO)!0L|3Ba}g97(t77_k0LKBqkoc|y2pTU58K8p-rjnD)RW~R^p8~y}PvxwtPJ&Oz|
zQDy95=m@ak2Nw=EKXZfHVIT`+GWIZRFe|qI8(_l^?p1T#fvax_u;HHojz`Fb519HH
zT&Y~b0XF;wNNOztZ1_QAXkax^`z8d~@NdwrPheo+U}Xw{xP}E};R3U396|v$`~eUH
z7#K44FnDCFXD|S{8X_hD5(@~h;RhGWNP1TU*zjL~@u3#&2(SS)2nE3FSV8(T_And>
zu;KpzQdbWZcmYbC^GX(F@zn@9fqWHU&gB4#D~~<UWpMWV1zG<YKoe|``8-Sh22eX2
ztk#}?0>8ab2bgWazW_{I@oxxjVo-SD@PQ$CHZ1#sTBTe9Ch`nS(0o|Wklo4y8a!^~
zZ4i)YZ%~o|S^E0h0&t@pTs(rhoO75in23P))!g6zK&i<@h9`lSLEz||{R$`e8wAcG
zHR!>)LV51@yXJFPYd+8CVVGB=paC*d*;xTn9DiGt%k9b~1xj1W%@GU?+^t+v{0;*5
zl^Ylqn9pHkng2&Y1LOm6Hu<&+UdVvNK<fzu6ge7r6a<cPFf#>%Hv7C_V4CsmJCguk
zgMj$;|C}6L|C!=1ZJ!<$&L~}fpK1Q>KinV8{@efWe_(&~_IGa3pmMy~6b7aj@-kn|
zwlXkr&*74JAuqr6_8jgHufJ`Lg_L2kPr-hdW^(x+&s_cb+lspiOBfh<83c}j+|98J
zJQ@P3g4Tlk1`;#b1s=R=<aXnddi`xhEl9lng}iJi$RPd+0+;#H1cWaYOaGpfV8E0$
zpIzaFysWAD9EJ^Z#TAtJCJ0>NYZDN;G)4ONqy`00zd?w54%d9{`CRcF`?>Dl<lz3#
zmBA&_JVl}4)@1$%+;h05aust;<DSYD%2mb{#<7*_D#tdiYbFv56ZkF&{N%eJ@QZJ!
zQ2mGXjPZB*b_sm|3+@#9u$MtW0_1zpYDthmpt6pum}?4G30DZm7OpFN4FV_jGT2=O
zg~I$7%0EoR*-iz2W>8R?(f=Q`Q;N4ifc?gE{vUfDC`f!aW)k2{5V*;$Zn5CIHskx?
zFAU&T(6@3XfdEtf1Kh^-EW)>nrE>Tt3-N(sk9!W+<Ny=?3*3{rf|YKp|Ifk7<i@d?
z>oT_)i<pTx15@Mn#v2^MOfH-Yg5szDXJ9blXK>(tz#@P7zl1#ZTNYmKUM}97Yq%dY
zu6H_ca~=N!&K|BgoO8H*IM#5T={&Er1GI|4WT|KXD3$OW5V$|z{((Zo_y0T$;0EV?
z1_k~H0++wl^DuzMcr)&Rk{e{tSHS^>g5duQ3K{nq988WeY}j+uz8z%1bc1Nnl*ZlZ
z5z&mw^$fQyB}>4m^4AXV8mt%cf~ugX=a6Ue0fjv81cAT269gXd%oPF$JWrF*2ap(u
zAN+$sf$Juh6knCl0kf?P2K)>Hclq`T9pD!bxNA0r!NKf10~6m~p$owh3<|ft^FJ^v
zX4p`)gFzwq2ZI6ME};WOrS<lO{0suO_-27Mf#?gtQVa@3vltYDB^V5fW-u7sx*?Tg
zc1?kSZ-x-x3wfERMJ4u)CgSYirT;JF`C|ht_`w?xOe7dKfSN>L&wSlF)$|->(*5Q+
z{s*At=B7Oi8~73guFhMaAe2=D4X5dqF^rP+8{kv>JPRO;y#j1FFMvuD-UNX=^BZ&<
zz=r<Wy%3ZEK%oPQ`2ZUZP(PX-#J=&C|3`og2dFqaI(LD>1(T)rA3@>)+Pn`;B$yd^
z6F_Y^2Jm!3fF3WroAUbW7FmvZKBg!WQ3eL31jb~L;h?gcLzF3oLzF3u10*NTU}RRz
zAZH?B|6kcc{`R|xOBBrZGcbXg9=xSO;FU!t5^N6;zTaF58ld5A5Nf#a{Qi$A&mlcz
zjt4C4$Jq~Xn8+{)n8+}QfE-wS&~{;t2_LA>D8RtM$P`d~$Mztokmq1z3Ir+OU}Oq<
zvvCP{fyUki8jwcy?=|p#3^-)Itzm_Q42Tb6zy7^l_NF@j50HmUq#(t}>u+lxPX7?g
zD95zp>U4oPMuqx<`wZav4wNthZ1^T*&u4Jpbr6`--lUbJ+|bX?-ytwxc>?ba^EnJW
z-G8*SKrRBci32S80zmCz6A1=H<NW)gjV4m;;O44{1ZeXgXypzcc)Za>iUU$me_xbo
z!pgvqv6KPS2Ck0=c@?x&3FPe8zczx~ydWooEDEsT2e)NSBpDh4tiY3)jjw-g1W#f@
z)F?0nSV5aMzczxi50W@&h6JRZ6BHZ}ac~fOff{=pj7)CY3H1t~F!uuqm~ikUa4<4?
zgV-+^I1M-$nS8pxD_GqA%Kcz|g90eh40vlmsYrmqL|lmFg*?a801E~Mz6OC9{$TKU
zV)OMm98OO28A3oULhe6IG5iri6RywUmf*U>6ay-a`D27S%&svof!f;qkwP<X)nDWO
zYc|FHBWU&-++qZcnS9;U%d<cr>izr$pdgAi5ocWn3Z)nF9IOEr3<kUn0^R2K?Hh0A
z^FJuQZ@ZC$gDKR6ok0Pl2jo*w3o-bv?Z(&Nx4Z<c=mGhhLxw5%eN%%0sIhl>n)Lrk
z2Mj>ffm8jy1qxgoGEAZ07O=>h{9#}+VPx>?ZnRGYjX!>Q&$N}}E0-|md#=zR5e5dX
zsa#h$gqhrfOc?|?-*Zjo{LB@@afj<p@e~GyPyGT*xwdeLWH&&T6c<lnFbGiO|M2BM
z4?}S)LqkvqAH%0&fff#9E@99xFK7eRxA{Ev3>?BtQN>djz#Uc-35Esy?Lr4&`6#=a
zVZrOKYg$3=T;(Rv@ScG~@MYVFd^JK2Ci3>id>I0B`09lOt~bc2^5qG|fPBhVBh+ES
z$i(2Xhry$}Q9-~&gi(YqPe{Z>gpmW}XmGkx<p03=nJfPD<RF0-j{98qxf{W4VYcA+
z3<@R^3<e+v6yJxmpE>x!3*Z`Ge_dT_n$5t(`y4U=0$Omw`#=aXiu7$ec#UxIecOxE
z8xk2stP1}yD1b}>C+n}Po`O_^oM$4zzypdT6G_H@P`R}xzZjT!9td#--?u%;^MCre
zL`F@^y(Z$UpLjM19DN}#?g}c*UVmG<(L{<5+>xK(U=G^v<jUV55Ct|&f`JWe*pGFw
z(+!ds#h5l!PWMP+lw;apIXxqZQO;`pPf+UUpVt5$p9brZWYB=>F@<z^6~ShkNWurD
z8()84-#Pt25~C8+deiAok{Ffb)<Mmg*9-Ct)Er3H;>TLk=_<*L+Vut5e;{cfz@D!G
ziJkC5USutZzvqt$v{NTi4odW(as(7Dpt2;uk`J5|z)t(NqZPe8c_A-)Ho%gvVZwq5
zLN6GYy5=lUnh<!CAt2y7g9Es0D_zgz5;zOeq<#Hsc_Vmn3JX*8jiuZVco_ul?Af!w
z6_mvTtQa7b%CF@}<p!uJ3z-%@e&^r^usTzQ36QA*#TTGl2o^J8SOB6;WOxJu%o#v)
z5SPIokYP{=sJG<XkbTF#6Qtl)v1Cbr6~h4&F$QoY0ru6eWsw|WOo)LKEp7!~2heD)
z00XEw9H7DAz{?<T9b}pL9Q%y{stf@<3k1$^h%*Iq@G!-5h%kkkNZ4=Wo&lMOo!6ki
z#VagyfJ2xmeBJ^DE-ujEH>mNz_h9;^6h>`dU4{oQ<Yh|(BY8plGI9gUL8A@=3@_y6
zSOZK!Vsf$pCcL1UbK0Z>pcPyUTKgX;aPdzNxDT4Z37*3c09rr=a!cQl>0YUf>Y};~
zADrGXM3~4ka)4U+&GQ=yoZe4wOJ!711MMAGV0a-fUmKvy2%>WXbQvy~$TM<v&$nL-
z3X}jfh7Z#(q%w*zE&e+FMJl6Q{o<{+qqxD#i9qs>Qy8Kgr!quv2rvZ~-?0a;i4Cw~
z6yRWE3gh5s3g_ShulZ<v{cF)i4qm26P^^MdqlqxXv4+nI9H71?ycwa!vjMa;5Y$$4
zp3D#diY4bc3{e60JQw&s3r*nvBQ!(X8Pr{qW^xIz<eOk3!2qeJzHO>Ckz!u}(hM>j
z<gfrMMo3csweTP)=|jXpNrq#?^b=`}*__ZCXTi?tHtCF3S-T(umGY9B5T&4Sk!cN3
z1BHuBX@DBT1<;@c$Y}3Yc820RwuQ=17(jF)_fsxbUI&2_pj2CY$F`A!k;%9Cj_pK{
zS`!%tzT%^{fu<bx8%=oZHzwb)Eu8)!oiU7U-_gKbj1JRnG8pBQ_U<&lWdm8N&dd}U
zB*hp2cCrjp1P3>0N&7zA=`|UQ`kbK2@Hy=bY7x`7fVj}{y}hy1-()bVGj5zNlF6v%
zwr6i(6=MR(6JSG_K?dxZ8fe8>01`8iWY7bNo1eGY$N`f3v#}RcYJ%mY7(^gq3q_|l
zWHL&tZZwf+SaN#~|BvqZic-#ZY&M(7Gjv^^BM;(3!tc-GuhS1?GB(S?rJCp4ih{fz
zIE%3XY}(IVrPC9#7{z@-N|wElm!AqU0c2A5d<7$@sT)9I-Sh3sLE2u(3%vwoKNER|
zmhSoXu241eplb9%YNj8_V)U0)FcG%j2<k?IQvCkO3R;0uj0+&P?zlSLAe+(1YDaG1
zEyfMW2Ot3q8VUvZAFSrj+Eh%xLl%}h-?7;^eNHx`c6|b<Y0Gm!;LiRA1&iW4wuvCm
zy^t6146uS6X%Jw~kO1mGLWXJ;7@TJ^L<CqdB8_csmo-0W8wfH36wDwqKu!Sp@b#~a
zq8yx{b({JpL2@89AbI`<0U7f-_6IM|nI4wI$Y0ON6a`8;uYYX-FTnsQGm#QtaG%NG
z@`7<!2uLePTl!twQjpOmJPa(LWCt=DWKHrJ+rrnsHs}@~ux$jX-QS>h6Vz(pSs)Mz
z>bf`EC`5p~1yUPe#rWX$&#hp4UdZ!xg4EZ840`=*gDuE#&|*4}1A_0^CVDJpeBnKV
z!J?xAG^C~go*j50&$=_fit&TT3dRQ@bsQW_Q4ojjons=;z?XdAw(vG+U8FRVOYvRX
zMvqmDA3)}VEC+ew^{;hz(~sMhg7q>pMHSz%tp_gybf3fE0vf0SJA!d9*oR;rb1+4L
z#9uJ(xdZYk$Z(LsAOm0jTIUKf9OR1&_0o$t*qLHD{%bV6U|^I2t!o7NI=~9r;{LgL
zFUV|=T2LDsl;NE}Genpq*E8^CPiEiX{GTD}N`j0m$0{za?D_0FKpTL)=df$EHz@4j
zSj@!?Hq4Sq08CpkK?<Oso8bc(CgPx_<pK<#6>$MJ44@IPSsda_5ijJ0N<s4~ybJ=9
zO`bC_aZl!w0WBPcOkvB-H5KMy-~bs4-fd{fWB{5O+|H55n5HPU0kZOffk7eokj+8!
zyY>rT|JYMFy``VAifLEov<Zw_Olt+F>r7yDW7?=Vy<`I8GNv7d(`6=t8VZ)v9VRlq
zW7^|6-Cz=<7Sp1O(_<zvN?9$Md7(-Q(ihnY+3I@Rk{dJvzwq_9MTr-xBw=!KpwL2+
z)11Cx5~G&Ul8LYu6e#LJYQWC=wj_~5hRG8Yx}dolByq#(Jd+vKm{xC`ZZetCjcIe?
z^qR?xn#|u8SWaItnNf*p|JUhfCNoMgEvlUU0?aR+&NGEki)p{?bc-pBa!mW~PLG(v
z=qdeeAtPu7{N4to4PaZOnOrzHnPOjmTX1puo+*rOOnY0WvrJ`FV_Kd#U1utzl+~WU
z9BfRHAhj1~N&SGi$mAvi$Lp_qj)Hs!k&{H0D|r2NPw(`Gsf<!gTNS6z0nuAtPTv7C
zclX)p4?z6gQ>Xu#%BaP(+jhFfG)5)8y<0)eHjr6hpR<BnsS96!-3y;W12z7^q4agv
z-02n57?l|xPM<T4QHg2I%jpNEf&4mk`kQHt@0d0*PQNpqQH^O;;&hf7ph#Oe-Czde
zMCLCG45uFf39PG}{$U2Ak=z3Cf^hCGCYkmIg&SbILE*s$4iDey4l^0Wm=?%RkC@4*
z#I!bXdd*BmJ*Is}r>~jGsKvBw=kyyO@x4c<|C!0Sj%kzW^fj{>rK~pog@p+?6+oA=
zn(SnVdi`}HJiJVHGDLvF5~LR5r;WYSW;5C`Z9Y5QVK$?f)aJPyGE9MBC&@5D>N=3K
zzHZK)UND<cjA^s&^p4q#a#oxE!rB_3!U|+0$T*W-3@NX_ZaRu22VPeVk~i7Kko5ZN
zrrzlfW;04LZ3><KXEtLN(@x*%8FLu*q_)_C#vnoVnn*CDK%4vvUw_`hJAK0(Mm4jA
zXF+Cw<U#hl{<a>xo*KjlwM7DKxWGN!0DEQy&^{)xn%~<WPUo4+7{#>Jb9%;HMkS`5
zhSPiIGCC<Ow}oW_u)1&icf!nun8lqi{li>FBc{z4x2w!!oW;zv+IISZg^W>5O9Z#e
zEMm-JWLi0Md&gqNMNCYKQn%|YW2|Fj+7>u{&2q+POnWCzpR$56iD?(_^dBo2wU~Bp
z-LA5dF@|Hh!A8aa5TUTWVI!mYB*q`pH<)vYOh4ny#LXB0Ve_~!aWfh~*lQe_xR@*j
zkT^CcARHf%sud7+4~Q)RVS{xzFd%Upp*p}a9#9z`S0-*o4J1{5PzkUqzXXVk4@gx6
zgq;IoFMzOnT$#A1Z+B%<V1zpD3`i1c&l?c?21Fr`8xuDp)G)Bg1uq~HJ|GDX2s;PF
zhT75tVnYpD17dH0r~zx9umi$*1CoG+mOB$SBUFP95*w^x3e*`nAPJalAoc`^L16I@
z5H?uDG^nCCAVpAj^LQ|EGeVuA17brB1#9@hfu#E>G(dYms-SLK17bsU=QuHOG4(+0
zegl#yfavD&Wa4IovUNag3y8Q6h}{8UgEh~FrVB8~Q~@Hh2BZq=aIi!%)P-P9F4To!
z&awwcT3{jQ#l+1BO+8>mx=@$&fFuq;G=L?RK_d?=0rdvhiOBXXL*{tEJmQUR2h<~A
zqo6UMyOA*%lsCW`gjm9Hx`00un^m0!<XE;^C|$J!%x9id0;ZV`3V><mNd;h<=^zJ$
zp6W2YA%ID|{s5TEJn;;a-T<W`#xNaVfb#c1Y3ONiRSUp;ru`ov^sN9W4Yg)J#9XHR
z(1Ydn&Vb18h3dPN0pZtAhq#aF<^zbpHK+mS6(IaNs6Xl;8ki?SE!vv^k>48uq4(c_
z(63iP>6H+=t^-2ff}C{6JP~3Z^TZUecs=t(hylzKAqFx}Yye9zPi%qG5CfPeP5|?n
z4oZM&=7|na8e%ZhX{ZlRyMV=+PDA9GrozM_<}*!&c!cRR*xvdNOjDsgJ`Hgh(^QB9
zm<~dMp6S33h=B+GfNADQIbfRUI5dP#Lme>H03v<>79~&z+=7~SL<b_j{{oZ-MRom$
z4@~=^alH@f!dp;-tDp`$0kz-+G>M&n8e9pr@bzklfprjd%o8C#W}Z|55w8MS^x*^Z
zq#6kS^%@9$<bwVGdhqFkPzTgOgSZM3<V?4qX`>1pR3Di3!W;&5KoyJ+P1BW7pI1WD
z!ZfH)r$eHQX)jdYUT7MsykK7sKK}3))MvM#3eQ3f-V5;&(=Dh^E1{|RtPI2lr{_TE
zz0f$VgnFbBl1rEcq55t?5*yPrXzHH^4cTc9P>s`|KAj591=C>;fGWHNJ$&&NG)Qkj
z)5>y~kDzf}2?;^Q4Un|MxE*TFRFCNa!A#=y(14u^qan(fPD5j6>J^B8CPQM3X(E)a
zgj#zU8gQ4ODdi&6_(~|h66%~=&<ME&aR$>ZsQmVC!Aw6GnI=k1{}9UL$23u4x<eRK
z8`ngr?~;B@zYxZxUk?rCL})Z7zJRzY5t<Q_pr$85V=D=!9U6;C&{#`?CYvN^ASXe6
zkp%U95+t26B|&0~DG3^T^+`|%BtadJ1a&|%)H}&gZze-yCmCvBGBkRVp~036H76Nr
zP6|vv)Vvg^2U4KPBn4t_J<~*(0Mx}PP?x4a<0}Q~vlOVsDNrA#Kpl_*^-&7cM-!nT
zlLE~UsZfWcLPIVUVlh)HIDYFtFr`9$mI}2n6>4xQ)ZkR84^v?VLVc79jiNMY6s18e
zNP{{6T4*v&ghmmpG*5#%APwX(P?-cRm6_6@A&>@jNE$Rq)1X;B9hz~{!7l&6lnxE4
zbZCgAL+haos0Haz52QmgS~}Fh8PE{Vh=7(!8Bm28Faw|(GND123H4znG!8SNSs@eZ
z(@dy?Goj{WK`qFHhFm7pBN@;r%!HZ$16n3!L4B45wIB=XgDj{4S<s-*hFY8rb!ZMu
zJv8ofVEUl)+0c;6h87t)(5T3UIyfhw9+KU1pf1aS#(fUVK&Ztz(4fnOIv^M7!(6BX
zbD`>Tp;46wbx0m4jz4^0Du?>G9GZ5@Vd@m2r9~bz?(?8=ng`X8_hGt0G?RQi)V_SE
zx%p6!<wLcXL)}*ajj=qayPy?4(?n<znFvkm6QR~Y8vslbq5g+e{LpHRX(BW{>L)^@
zHXo`nAL`)(sDlcj4$Or*C>QGST&Tr`Q1wNy0E9Xu7iwM+H1ia}%z?&OE+jnanR1~~
zmJ4-h5!8ppPz}XU1B;;!ErzDKQYgO^8bW2zBvT9x;4-KK%b*@9gQ_os>MsMwSp5g4
za;OW-p&D|bK~oNKAyY0?V=6R_?T1>pA8fz}rUOv=2-M&M&@_4!5@HPe(0b{}5=fGK
z)e52af;{f};RDlAs6|JhY3C@!A<UC%AqtN`8)HYIndvA<<A)Eh`jP3N#`J_(Ch^2O
zVC4+F&?N2vO)~qT_2Fx1z#fIh;6Z4N9ft%Q1HTDaKhyr75c(EW-K`i1|Hy&uH)5GG
zScRMeLgPIG92tCFef@(XLCoz@$xQcn^n+6qojm=6trT2~it>xB6x=e4a?2BoQWX;O
zQWTs6LKRZ-74q^+6mk<wk~0*!wwo6)Nis4S8B7l<WU^&4GT1(`km)^Jy=zdAe~^`e
zb7CGyaZY|>ih^f=kB)+Bib6?#zCu!Fx<XohkwR`_g+g&=RjNXM8b~UsvLv-w4>WQI
zcSg8lke{cYyA?>gLUKlGa&~cPu0m!p*bxSLTp+~^3=CXO`S~T8dFgt3dLZWZ{t6~{
zMtKc)zfc9I%)HW)%$#CP1tUEZQ$14yJtG4nQ$qt|!|87;nVPpxsA5v)tbf4)HHm>i
z`vU`mjspi114u}KfkDTEfx%z~hyzh#uz-QVu!e&TEHB2uVA#OGU=)H-Zxq46V03_k
z5iBpjz+iNOfx%b-!8g`mU@-o`!3vfaV_-1;!N5>&`htT4EMUjLVETc9!Q6*~9n8;Q
zU@#A0V6f1DS|G*1U}3<(V99~tTM95RSRy&VGJ=7@$^&76RR9Bn^#rJT7X}9F84L_I
z2RN9)=F2cJ*qmU{XRz%+_|SF&1A|=x2Mbt%2m^y%1_Og#1w!7gVfu#_Cgpkogs1E!
z7#QsTK+P0kU~phyU~niw$U9UpFgUD$@`V@}95yg8I37V*;dp|9!AS(_Mgax}CkX}y
zXAy+FvjhW!iw2Z0#K7QUz`#)Ns)7)3)nH(7lYs`B7z2Zw0t18F8>qYp1B2TK1_t*Z
zP`(fYg9ifxgNFgsK>`d69u^D?o(2dHcv>(p_y}-tfx|$8fx$<Dfx%Y+A@8ffP|x5C
z^RW;EgC7F}gI^572Yv|*4E{BUSnzLPU<lxV8X&~L5Fo(75by;dAMk^LA#e*qK5z#E
zL*NyJ0|Rd`Fa!l4A|WWEo`E6Q0BV2)14FO{14Hl<go5A|3=F{!5C#OlU|<M2z`+3a
z5d#B5$O#69&?yM{&>0L2VLk{Cgat4#gq=Z{7j}VxA^Zz8nMyG*gxCLIV2CV%3WzZ<
zL{=~`M9x4M7`cFfA=(8hFTubN?ZLnhV*`x>F$RVh2L^_iD+mi>ZZI&!@*wob3NSFl
z9zo)tU|@)|Ksc~I&Vhj;?hQg9?gIluf&`Q=#K4fCz`&4D05t%_uV7$E<bejU2m?c+
z00To}4?=z71O|qr2808XIv5zzU>Q+`fgvq`fgueRB|;4K3~4tQ7}5(62BcRoFl2~8
zEfip2$dF)Q$cRDsFe8D1A)^IJzJq}wa{<D_%oPj_SvpYjBp4X73>X-)HbD6z3=CO2
z7#Ol`U>>MvV90i0V8}iLHBg9wA^QRYLk?09<v1`f<RFDm&IbmD+#OI0g%}ue4=^y~
zZGq|+V_?YJ!N8D@l!)^a7#Ip3Ky#G?14F?J28O~KsDtXo7#Ip07#NDba0q}Cl@bF(
z@ec-uQUPe9bYoyBm0(~f&4F4V#K2Hmz`#(>11&sV7#PY07#PZPpazOCFq9WCFjVNk
ze8|91VZgvpu>r~#VqmD)!N5@Q0iwR1L4bjw;s*mmr2-;|D>WDxDkG5i2@DLCHBbi#
zFfdd$Ffdf^f%1hI7%C4iFjVzG9W2JcP&I*pp&FJ*MHm>W9T*s@=OENqFJNG(egSqs
zJp;%A)gKrbYFrR5tnpxAsJ#LWVlf7W+8YcE%>mF5l4D>1E$3|sfd;7r14By$149ce
z3Pl(gS}rg!bWGvk1Ba*!14G9Q28Ir#Y~1mJfuU0d<e+*6umd_37#O--5C(R6FfjBS
zfMz=}28Ny!3=BPQKpG(Gdp<BQ^j&~DxQKzF?*;=y{~9P?jDewl0|Uc^0EGGp5ey6y
zU};2vfnmZ928M|~9E=S0pimZKV3-)dz%c0uGzcXa7$%)yV3>RW8UjKL43keVFig1u
z4l=NVr`%v*n2Ho)Q#}|Mrgk7KoH~JlVJeb?r+#2ynC60zpXR~9Fl_?|Q$09{1Q-~m
z?O<S-E`TW6rb{p|%vu5s0VxKCSt}SAW}kp2IuQnj*%ufX=E6cuhJj(O2Lr<bm<L1{
z7#5shU|8zI!2>p5j)7rm00YC)B~S+lF)%D$!N9Pbhoc@+gDNmEEEiy4SOF{B#TXb?
zfcRUWJ_hl3Ffgn}N`$K$7#P+lK;=ak7}jVoFl<VJRyH~e44X0-7&gPo1rY{@%_|rf
zw!pHr2?N6x2L^^Mf9j!eX2QU*m4Sg_YX{UoBL;@86Brn_xj^|63=G>m7#Q}<;ot=O
zsDXiD&jJR9{W%=`AU>l41H=9T28IJ2&=8YgU^p;=f#KjBsQDrc3<no5FdQ;~nkT@(
zaL9sz;ZS`7C;>nkMTasN7!JV_kq`sJp$!ZSM;f51UWI|-NCyMMi75~VFv>A7oS4DD
zaPkf$%`i$aFr0kAz;FuY0TBj<QxiZZQ9z?ij)4JG4_%1h-~~CD!H9w3LIMLr{lyhf
z1tJU#7dJ34TxNh6$RNhRaG8UF;pznrZm@=V3=CIqFfd$~K&Zd2z`*cS0qQ_K28O2^
z3=B_Ub%g)}!_x`|h8G4<{W1&;FDw`szN$dgYcMc;1=aswE1-!&fPvv_0|Ud?6NnJ`
zdVzuAn+$^gO@V>oTLu!pfPvwA3^bRBF)(~jU|{&Z17Y6x0}Kp57!X1JgM)$LhYCXe
zhekaE!_N$;k0lrweikq={Djp`0t^g4Z!j?Ye*!H?R2UfkzhGcw>Vfj*7#Nu*Ffg*f
znvntwj4T2SjBK#lQ;LC+O@V=t9g(OR*##IFb#<U2V8_6yTW`R?sG9+I5u<Ja1Eb*z
zXd;qhU^Lvoz-Zh7b)X0Xqwxd=Mq`8z8I2DxFdDx==r{hrz-WTVhKwdB7#K|@povh3
zfzecffziVNnoFb@80$SO7#O{C5CYx>42(GfP#2mpF!oGfV4MX@ghmXEvpN_UXI+3=
zD8axu>jnekYz-)1fPrzg0R!V42dD?c7#QbxFfh*XfkzqRoB#&KWmljcl43AtTy}$j
zaoHV&f@KdF7?(Xj;=f>ET#jfDFfNy1U|jAnU1b8(YE}sb#$1N!S0*qSG2M}v&M}cm
zj_J;e=^7yV@r>ynAX@Ch^b8O!sW81`B9mO&%L+(lV{`%2jJX^PjK!b^6v##p`vwDJ
zl?b#P<YHi49>Bo3at5fS3sJvv0R!XeB?x|%1OsDr1cJYM0|VoFmF+x}m{eG{TTEkG
z#^_Z69bT${c3dkUJx!(xXwS0(+QqMccF`-KJ?skTAjk@6&wIJUc8wWK<&1*Rp6zmI
zk9|4Ebj6K~Hq+nCWa1KB1~qIMwEMnny5R>#Ygq<{f0q@YJ>jKL^Oix~v2^;z$Bf#b
zNh_i0b7nDd2`z;>Y$>FN&9t-tY=O+b%g`w#rX|q6`ckOZmb?I~nC>&1iCYjlg0UDn
zK(P1*SWe~#0|V3nTcHl$3N>YG1z5%OKeL&*gqA=<X$f?MWJv-@G9KhSVyDw+qRw;s
zge6S+tb$NC?}hq&57g&8tC+Zi_CVdf2kQ1cV7J@I{QqG9_4;mT;OvG5&TeSn{Qq%)
z5i-888>SLE;Ilgb<bNBP{}*7vw+lL^v<o`ovg^cjgVjv#g3xi3U6276rd<v&jR{aA
zcS1%~n07+Puy^i&sVIP|*a00i+6hg1I}KneV2Ni3bU0)ObeLzyis=*9Fu4mt$G>(!
z)9?-jn8pUE(c7V^dOI}rZl3{GF}-Fj6Sp9AtY|wl@opCY%gOv=V1S0oHt107HfY-2
z)&W*AU1uE=w*YiRXB#xxZUaf#5|Q5StYhL5+5*i5Tc9zsB?F}0M*9B`0jSG2L+!i?
z4e!lJ`K4z)6Sn{~t8InG{+8*6FB#>joM5fCZ`i_=#v@e$4S$yf4BSi#pfU-PY$_6_
z8ysX3ld6Emv6BM>F9&D@0qTj0g6Rohd1(2^z`&rcfULh^`UJ521dy3vtl5C9e*q|1
z47Ptb$mGXn1Zp-jFy#OL_Z4D$J>-@#1_o9LzYdhyL58qF`46TSoB+)dNo+rGf@v8W
zW8U`k^GwRpj4!5lzhW|Dd@=pdE2dK^s~AgIS%rl~gjp5Y7+JY>Srrvo+2vWa*z{Qi
z*%(>1Y*<;@%vhz_7!_C<6<Imim@D*HdDs|P`Se*i*%ZM{UN(JJc{WB?PPVnITx^Vr
z@?aS*uogDvw=6c>FTQ3v!^rr2`@FYIOzcdP#HTO%!c@w*XS>8#CVl}%i|rb$%-M{L
z9@D3=G50gh+OERR?83-+XL}|Gvm3jGJ|iou2#YYt?odV+aaMU|Z9Nc|IaGl~oK=EZ
zTLHlnWY*RLaaq}z1GYcsXBJ>)JUsn}5OWygo$da@%>3Mpd#1<BF*`G^*uGef`J6Jp
zBAXa1BXhX|E2k<eE1Syn8YkxO%o|ztrk6Q0YcjsrzQCE;Q=8F$`h;3$dG07hR&GWX
z5mrX#728GfnH#tne@vfR#cazwk;!ZN|0-tD=?>M*BGdm>F^4n#V4fac&8)<~pc3SK
zHa!+`kO%Hh@2F-j6#rYzD9Xyn#{8d|kyTfbl~G=SRf)N=X1YKPvm9gNbp0A;J;v|T
z<7${y8MjPtsbSv9)Lbz=(U4hNRh*TFfr*8Y`8T^Bh}L6e6!TKh0~uYS$I8dX2r~86
z^!{3AW5yrb57#n>voao-F5S%R%idkAz{<z`b$Wg?vkKGCqUlqcnN1jfPe0YntiXP=
z$cvSgdFS+x&CCjn2c`?PFe@`P^G-K!VV=tLt#JFf7Um8`My2WD%a|RRp0iD#wTxMg
zv2^;*Wz4<2?->+WGZ~mzSeP5?*Gvyy&TPxV&77GwefDzZctvGaLpDZMK{iEJT{cEm
z5hYeZHU(A@Hbz!aHhpncWj4m?+$)$>99YGfjTu=rnSB*NECp6Y5KEAa*;s*99IQW*
zRaBJKfQ^w=T!z&^g*C{FRgg^yWRM=K3UfB&^z;?Xdi82)tP*UDteTK;5oI%E)nsF2
zl~7<6WitlL7%^wqu*x&*doc%s1ep~Tghg28*_gQ*S(TZK6j;^SlvzcY#q@+(W!M;5
zCE1v>^n^u3S?$^QSuIsq)tM{xSS8uiSuNQZK@5FXRj?{0R!cU1R(WM-R!O#Wuugeh
zR!KHhR(UpFR$EmCR&^UzNj61R6|ibWVKzoqRYq1;Hf9k$Rt`20%P0z*jTqS+w+pRg
z_F!T>Gd+4WbC<=70!CI=5wO!aK%Qcr#;?c9%4W#Q8_258#>lFpz^bkQB6;=M6xj5b
z57siWvNC^SnJ&48Ihyg?^wKrVx$bSOAi<YadU~u9%#WBESp^xGSeTes*66YFvN3bo
zunDs&%d?6ru=27gdb7&03Cn|6!jQn_Wn+HN&dAEcJZ-w>T4qIsvmA^dUDL|1v5JDS
zH!mCWLk32;+GW$T)-q?Z9|UVTGX2(C=1GiF({tA`Yl(C)F|ukhvhpGf{#(0!^*Ux<
zCdU2KZ*E`?0ViuVJyu5MIlPS1O*S&CFfN`Rxsh3&@yPVXjm%<93JTL_Y-HAEY@2>$
zBeRCUdv0)ApH#vK_Q?C`e>O7jP-J6H0fjartAGN?PXZus8Gzi!%B!cx#>^El{mv%l
z^^Eq@dp0wxFrJ>iaWnH~j``e-tUPSYm#61!VeXdw!>`B6!@Q{)6!yX*th{!t0&E~(
z+kpzf>Ec_N<@qNRGP1G?vqi9ogF@rucGs=U?92)Gs%${q2^@NijKU7AJj^pe@gV{>
z0#uX=fE;STs>B9%ost5`jl66ItU@3GQ2c`A4Oy+gwnd_a)@>%n>6>>juVA#<9<!4<
zfsyh2^u4>7Q$=)HS=kg>rP+j8<seKcHsR?uyP0b=|E7U_z{n`f$S5ofDjHbCStXe}
zCG}WTS^1d1r-2GjRyO8N$>|SwGdnQ)Ojp{&tj%xB#(ch3kNFvs4IA@{dcElhdzcgJ
z<rrB7nUfS)S()W+SY<#gK}Z=7$|tPMatf?6%*hHMA$?H7mSqI<S%s8YWn@`dnPnAN
zg_zS6SjClCWu#d-*_2tu*+dlO6<I}?#XvbeO98@SRb&;BXJu7{sODr-5*7x9IjaDu
zqLBhuFp8|K%)*S*qxLfU323phvZ;Uz2wqU=HBH~Km$`w3m6gqIy5m0PXvVA4=k8-x
zXIwb_=sxBg$%)x|%nL-)K<+EjW94M#V`S4~^JeC=neM-zSyO0IIw-V|^4go}UHh43
z<Q`;##rfG7Ss{6Fo|pnFCtD<oBr6+p%k(4rnNvIknE5~<P^7@h%BCtT#VW-n#VWvD
z0pcpM3WMCn$jYS1$_@5`KC393NU6LcD~~oSC!2vVI3s}ya7DI~>9q%#Wx_#uoS93H
z6=WwUa-k-0vWc?tYeCFYWMyJQHjt5(vy@d-o|RLPRTvZviflG)ieRHzIob4u+4xvR
zRi-~bz`R6dNj)fX?l35@O6jqJst_hNkV~O<u!71$>FMhaGMjQLF;A#hV3lWnKmF}N
zW_3dzFjtNlRNl+zu}U+~tOpg;FBlY9mGxQW<ymDwwJ0kn(uBcay2Bx6F(!HW>4}G!
z!?>F38Cld>*_gklPCs~v*_QFo^#6yL#p*@anAc{5qT{9rD7aKud6*YwgF_rtOR%yj
zfl5X;1#npKfK)IG>#;GiF`pCxH8+@#W;23vICD8j3&>VcaFHqs3UfVHArNK5%E^|_
z${NjT2;#9ZLPS9U9?7c6$L7b%lg=Uusy`=+>P?S7%v@dHSFgt^!p6KB<SsVm>mqt=
z-tugUksz_<*%7RqY=$DN;M54R+Lx7ynTwH)k(CwfAZbYBNCspVC_8(zs)5Q$QBayu
z1UIO7KuoZ=SP|`}>mYA}k^?Ijn<FF!S-C*1FE-{f1#rVm(1ukD?0-H`q=76HWz%D2
z1-IHj;-J<TBP)j<D;Jx=beW^f3dT*4q{61a$_jD~8?&Gni1uQG8UW(hu=24PfXY5a
zP%tS^&p*ms&UkYA^P|j)Tx`r=>q=OqnQ!Gx7dys$!RDi|p0EfgU9s|lyvybb4r)#|
zTU&?#^O-UmR$k^UoS<^zOql{J5AzmIP#EYlADk|CoLOIwU4@ksWUC4*pSqeN%vl8r
zATc&Z5a|Vqi0zz=th~&9(<_cMYdG1m${6awl*WM-L6m}Gkok=$Na@WQX!MJKoTSIf
z%DjZx#+OZ7)Si`>xncUF<IFaOkmRHYDlS0zOP`Sul#JdnF@m(PGO^jR@-R;X=XH=f
z*qGl=4?Mvf%D8a)@)OMMjOVB8pJbj=-^Rqq3NCAyb8T3qnMD*>C1vecr4?Bv^;xB5
zStXTNrRAUs@<7q7$STUn%E>Ii$STYx&MKqGDlN?_W6UZk%_^hH%F4X9UV&AL`7#42
zz(8zC=CceSZz+OOvam3ys9ICc$STQv1tM(D$SA_f#=NYak(E`HRh&(qmB)`&T#l7T
z2}JTMv$8T*DX>9wi?E8b@v^e2vU0NdOm92I{E6}W^vcuBkJTHQ8Cg_V8JXXwfC5bf
zWF!Y0qYb2ax<mq$vUu5;zfNyH!)zfC$tuYv&dO>I3KKn6Nww*x&oC=6?wtPS46~Zm
zQE=ct1XnZQN{m&3RfCzc2^`5x%q@~O3`{JbL<(wf7=hR}EPSj?Y|JO7`<!L=7g|zd
z!>Zu|^88duPzB5UaQfP_%*u?jr(ZnFe59WFMXe1hEAyTVJys1nP*_}&1XaxYt3bXN
zX4PV2WZ`4wWxkXTs>n>4*9j=FiYc<1%0oyNK2}!d^H8~s0-!9S$SMZaa}g{q#=KrY
zfrSt3Tt?<AP_Z>&F;-@&bNS$m0y15Uc@x+KbrwEWLFR+gjm|Tdam^FZ18D|%XVZD+
zEXGySWiK$xif_&X`RJ^m0;>`O6ALplh|kIVczWOkW+k;#1tp+>X5J>C$I5EV#_XrZ
zYR@Lj$|n!1#hEwfF^Ynk2h#;>m?hXiIg<JG^z9dzO&GhUzq!Di&iG(@$VKMqj3=hQ
zxyY=}y-k3T&4x{jg^&6Cbh%5+){NVyM_pp}Wwe;S^%C=<Xy%VhjBLz5YakVgm?NtS
zv$P(oEOQ|!ESUKfzztFkP%_nLm1Sejw_z1y7FS@ERc00SV3k#3<yK^sm1oWXs}@yY
z<z^FO6$4edio(LvS6ybdsApyK2G?n<Z2rQma-bvvDqZEF#f~B?s{uG~akA;Nd4X$2
zRwFj%t1OJHY6`4I3akRmYpNAkjhL^nC@8WDFt4swVC4sg156o2jFb5~3)l^-sujQ$
zDD!0&Mqv>KCN~yFa8bsh$CkxBr@9GT3W1`GS)P?w5nQ)HSO%bYV3P-vjI5x9$jk_i
zbSCD9EPC5*uQ2O#GWAT@o_Ckogp;vj`r>EIR!p;QOuzq(xq#7Ndcbq$|BN2f170wz
zF$Qcef59BY%Czjp^wV#dm6(=2nEoD2znCukj@gn?V!H1;<^o2E>HFR>e`Vy@zU4i0
z92-;djqM`en5|hs*HHXszQ?q3!E}Q^%oi9XrZfI!p2M_y!}j@qne`YM6SklG$IQ!V
zu%3mHje#M>gAp`(#|oOCXJKGqFy>^2bnGhyKxdb`F)%RXGczzSSj0}}=3tSm-@w4Y
zypWfHl@T<mntYCtfuU}OEHeYMm^%XlgEa#f===v$V1ns+IR`rf!|L^}3=H#qZ8W4A
z7#N(-gLE%n2@(piNta+?U@+HaU`YLJYb(aUz+j-wz%aed)(*~|Vrvg(*OyvMU(CTG
zWNoj{z`)R1Uu?m^CCb3SFuxq^6UX{eLo)_$kZ~K!nb;W^q6+GZ4b2#MK$;JiGqEx-
zv~QXIfrCYiam#deP8Ji1RrSSYCJX{n3=E8l<s7UG42&(V3=Fb%(}Ou#^b|I6*a@>U
zFff+IGcYik<dr4nFxZK5GB7awXK-a;IPqZmLQWPD##Pg|ak6N*x!S4nGB7ZlVi0Cv
z;8PH=ljmSyV7!{Zz`(eSfkB&rVLlu8V_pUZ#)lBMdgz1L+6)ZqXK+6Oxew&&jK1kA
zTr3LqTTG=u@v)4FA&v#iWJ+UVU|2Q@%x0(p9V)*ZBEe9_$i%>K*bOSf#Kgd`S7>@O
z7mK4qov^7i!W0mb={XYvL)m|bFxZrGe<%lJN@q5d12Uy)@pKk$7Doq8MpGGtDIg|u
z1``8=_EU&3*c2TnC<kPUy&jYUGR4wwdMh`J6Qld|6WlDi{7cMCWkH5jf#l}wna;w)
z;=~v~-JOR;m%mBXR1Pjz6+68dB)5I~F&-8@zAL8kaH;Mu)0uc#9GRNxrn~a8=<yvf
zRe;N_&z|1M%c8?Ht7iIoUKYQAa#KZ71_s813QP<Pr3t1=ptxIR0E!_I8yS094h9A`
zTP6mE7D0PCkQCT6kyZBcU=GMLIW6`IAkH$7gSG!m_vK@eGF>TPuLjZz3QeOq_Ud2-
zpg1vFVy^+_fK^A>Yl1jcEKCdx?Yh(F@UciTHca2f$D&rRX0H#DTE@l1zz|twZvf`-
zFflMJin2EZajN*37#I|8+8cp6{0zwg_U@bv4D1q23=Ea`?L7p+iI9nb!IaP56U3?F
zfN1anb2u52CG34b8ayEyd<7X8*gZjRH087R;|41NWp9O>)6@7_RGFH>ruXu*NMv4$
zu{Q%vkOV<O#T;b)GLW{C4tonQ2jn%LBzsE`=M>0mB|7$2U=D{!aX|@#y)~Ev@(kx$
zdm9kvKggzi_V%_Q&N7e}WJ0I&39v{yU9@)qiB;(^F)*0?vUdb?bV1%?v3CM-mgzAu
zFle~jJA+Q04KiS2U|@S@?*if^nJ_Uhuz#PPDZpY3+MN>0!N9;N!^FVAlVl$T)(UpE
zj(s?&oB}5}|LOJ-U=A}Vq@C;|!5oku_ARxK0_$OgL`XDPhMkFlVQslRc!3Hye0gH+
zW5LQenHU&K)a~QI%D9>885lf&+sA{YKptP@ZV#UOg~ehbSRFqo-EBO~ZJ!Eq>P{vG
z29|RBG_VxNsiE2S>0k~h-8s&)2hW9q-Cc0TJ`*ehcDK8I7MKHa_f&8DYz_v7dWI^H
z!w)~R&jCxZF)=VS_1foxIUrwf&alq|b3mzN1CxC|m;>^K;1>G=Foz4|I(vIQ`(lvm
zev70el`z<sNP+?t<T{?$_GMso+)NA%N1oZ2gE=72a(}X~uK@FSK}Mu4V771IU|`?^
zMOKN9eIr;3WCZIp`zA04<iQLJ`(`kQ38X3En1Fp7NK+3e?r+<-gQY;4q_XTgK#uqg
z(sXv2eJ5B3<aZZ&`!28ytH|^jLM;4DIW5yy3b9CAl-o}L8TEj{n}MMw&3+OnT23+U
z@Md6OTxmZA#9PL=$D4t{!ODJ`1Oo%tN5*~L3=G+mrvDLQ(Xa0pwqL}-z`#8bk^>fl
z?E|@_pU-{?m;-W&s=fVEFb9+!sub;)fjOY~@qcQ+9ApPLZ>;-dzXHTr1`7At7wuPq
zIiOrG;9|cD%mD=<=UMyJU=E+i^i{$v3iYDAj4BRd91IM6AD9>zIIA5bI6-WXGfvKQ
zkmO`w;0H~8Gpu{*AO+FL#K4de?jQr^fU;YxkOQcAW2h2hVqn-K<Nz+;mI*U4Fa)VN
zfT|{jDp4i|hL}DF@Zz8<F(w9v1v4EK!3MaCGchpmJ#<h4`%03Dfnok#2W7C76cYo3
zRjz{ym;=gg6V5t-3PXMYIVJ`M#e4^KupT=m28N>+(<g|qNYpPjcF+b3Ix;aZG<<N-
z;b36kS8!rtU{H#7&;`qYN+~WG2R*Q<UZ9dJ$N^G9`Y<stB!oFYN=QE@28MZ!4xmDj
z-yndAfq|RH0dyWU!?FY>28OOc2UD<VNlXk3fx-@EVAGQ8K|YIjFb7MeGBGf)YB^Yd
zIiNaKda;8gxQa+;Vqn<$-@ytjQ_jS|u-@1KQj}FNF);XdIM{+^YM2-prY(1{19NJb
z7#J+(IM{<Ns$*hcSh&f-0W8zN#K2&~?BEE=oQ+Hj43aw?oWN2|ObiSm2@cL+PBX~t
zR}L=VGPi|^fgwrQ!4=Hu07cbA2T-Zcund$f%5)t(z!vp^Vzke}6Kuc)CI*Ix#SUIz
z8Bm(F|L@=pmYED{F?@CK0WU+Un!?1uP_)*;7c4cEiGg8tt%Dz!GYyoXZ#npbIn$XK
z7@~JLfY(u0&0u0+*z(*V5G*qjRA$a|2m*6vF)=VmWI6<cIkQ1BCmcWpFh|fFCI*Hm
zdxtPk96Kxk1%2jX2S^dT2vj)dI6#Wv#Y_wgwrd<B!C}7y<cVDl;3D|c7A6LU>P!bn
zsk;MIG1xi8f{arD6`8><4sl>T2S6po42O7dU|nEhU@#M$&MVGRQ!mQGsO!)N((nYF
zg&q3At_0;BlV1*?qJjSjC=07NIZOnbqy#E0&pAv2D>DLdZaGW_bBvi77~CBkrhx1K
z*Efp_9HxOx{$c})-%5v>!VC-oETGi8sN7)=2LpqE$aD?~7T5ZN(pm}<pi)GbfnnKn
z0a0#{Tm%yXgQ2M?j|2mQKrF~TW&1^W6c`u;k~kRj85jf%_+Uh=FayKsQyilFAZ?%o
zBb6m80MQ0knJ&!0Am3wP&CbEVAZRC&l#<3^%>hmVAY%{v)mw9dJpd}5md&;15(gO!
zDuYgoSc96!f_9)<c+qrgKCmWG^GHp{nh(@0SOyA?@SWEDU>OxA28QEa)}X~>3{`5N
zh>o%r04b|d2bBu1tOddLXn-oS7uG^xj;2WFbZ<!({`wAUF_0l|bQnM$Yu9FAkYKfz
zkYZpENY`dyNb$9n<N;lxBh0`MFi*l-8RVB$ObiTO{?_2)<rK&-3+`B}f(!u{r{O!T
z)xaE(S1QA;!7Z;-pb|8o+ggK%fkE)F04RI}qZ=3*7^dHpWRcYFa#RuqHQ}c)GB7lT
zXfrTKC#rGCGcX8V(Pm(1C{W|jgtANSPM4Kp5wHK{B+SjgAox$4f#G0|ldu#6gOCy*
z0|P@9$b{tE!VC=JD_ERB<%Ez269a=&fs+-e`F;xA$d3?owv=LE;ARwNV6eJu;9|hR
zz##OGiGktlG8aQ|=zu&G7w2LG=77>+$7~m4AqEEJ*`UZ;<R0w;F44ekCXF^1Q?P$Q
zvBeVM0xr=`flA#q6I~z$8Yt>i=DL8K!%(Hj#K5r6-UVE2f#WgH$HfM0HYgtVE}qUO
z%_66;!`0bJf`LJppO1k-C`6cnLGdz&vlj;ggD@yndu*TXBh4aJe_6p*7$kO+2~;<_
zih$h#a{P&fuHZh<GEgPlBIpW^<7J>G2j?wUaj>^Q(bEv_DgowzS{eMAuAoYb0o>qS
zaM2Z9X@MioUCdP)Y&59SimY-4tq7aIBm!zuDcp30RAKT=3=GY?T;)U=7$yiQfcjE1
zt~-ZIGcX80<pa4IlnL)^xPhE2k_&dO8`!!3LC#gU=>~Q#xB)l$iyO$fTC+ipS`_6b
z4zjw6A5<cjyMgLhhEpJSbgg!)2fO!_2onQCY>^w-z5hY6(7w+N?A|I+z(-cOfofbi
zNkx#OyuF+w6&M&qDnX8VrOm)#b;vmil)_JGGcfEnc8&(ImkBd4@F>c=g9-%ED6nJQ
zc|fiJr*?&#?!4eYV*%A#U8~*sz&udn&TpbSs5D@x0)=!At2-o1f*N-RFS!eXOaM1B
zHhgo3<U&v*BjTz%C{WyXgBop<MBGKV7#Q+wK|XAXa~B004Qd4RymJSI3d1r`BY-`?
z9TY0{45vWeUE$yk4whx0M7PM_T@tKG4&>d?)6R*?3=E=ad<+aC)3g~F7EN_75n*5u
zE$3rkV0@tuVrerl?EB(eA`fL-3OM(J0^z?l14G6_=YA<rFGibzVa;Oa2{7@sUd|I_
z7#OBMlx30j4sf0*$iN_aR-1t#)6sb;NDU}3lNFpdC@?T^?$l;rkpJs^A0+<f5+ehH
zV2JZW8BmjzQJaC`*g@w<+@OrB&A_1gb-KG8i+%kn4{2~GosYqjfuYL7Lk7%a<nv@;
zSTEus3*qs5GBB(X@{oh@1UwlST;x6EAv{4(28OQH9tvO{pAf@jMg|7GH!L2K{0t0Y
zH-Z@$V)Q%|*%=tbf`dU49^h8fDbR4iWN8nTdS(U&v5op5rNRshBFzFGpth5^D-#2Q
zjE@JT=>$r&otHf{z#$DPAOc=`fIE^qKm|mHqlXqKvLAwSUtgJrHi&Zyl;IAudFX&S
zJfIeJVTFx{J_iGX_#-9;29F*Oa0BY$^cHy*`IvVe#vp||K)P~%d4S8C9ia50an1u=
z-s}JssT$Wjz~#*jP*?Osi3g}JDE<hPc-XBxz<t4opeFu|WDiJR5Y!*jIXeBnJd14o
zat;qrJ4jN@lYt?j-UHmPJH-eJ^L+sx;EvrXMn+EthVmj0P|uFx6eE)-1H;nu9-yur
z!zo5)PX-2_ryi~#XP#nY@nm3-^Yw6p@K`+=7`jtDzzw5QjBK6^3^ivxz%8RwjO?DE
zrLrFNo)D!Ro(v3~avtEu(J4kwPX>l#k375~a$KGa4DN*<piVNwDMoHj1_s_F4_}BJ
zk0%4el(!y!5FW2514G_64}S;`lvLXDJOUs*P*RD%?hy##fs)FKhaN%T5Iw~x*u+?n
zn8FYY8WrLLwZjjyd4zyfvVfv!;b9IBP|HXX)Go;Bn(n8_B3Xak1KbJ%k2f4<^N5Bj
z2Uoca43Zh3s>Xl;q`kY1!voX-l>{{bJ$gLA-Oq=h)T49MBLS*Un1SIyDUU}A2LprT
zQBbqk$s-jc1y<+L<B<mDfYQ=oHji{p25|<4Qyd`E`z~>KfI5?szrj&B{jVa6q{m@4
zk9?4ZQ(*V+V`K3s;$UEq0u>vF**uEDQVa|rx1M5PkWvG?72Llo5qI&Z0V%x;cEj{I
zB^I^%cODHO9k68B2<AYOVH21GO@_^24k#J!F!N{uaUOz_p;D<wE0_Z+q&+5jw1GLG
zQfsP{2dD?hF90gF>Mwb8fMiaAYB!yu9-Uy01H*J?WfuK<QI82=KBK%R1A|Gs$3zHE
z!IOa@iNgchcU1IbVBk39F&QGK<jKGw{KW&@lRU+!?8(5uZ|*S_BB$cXz+imdV;Y2~
z3P}LdK?#6g&69y4AjV?`Sc=)ylYv1~%A<ZJn9E@SDj}+MJZ3R7Fi73iXJC+?BFw-b
zm2|)Z)T)#NRaa-1dCUbhM1w$4JnfOkJa7R4in^7e9`nH*P(5L!?XdvVM0Ehw6I=ow
z3pp7W<TycDoz=x-G1xXx;OYMGSi%V!IRIC22`fC7f~7#AS8MLE49o$A-on=&kRB|k
zzEj%i0qMbl+K9zr9^fAADNx&j)5HVZgFOXm3C?-yu?B1aXjo^*8jp2g4ydpQc<Heo
z#90O^EG9nn*Z}FAm@zRhOnm6E5$p+bP!ll2V-uKT0qRF;d2HrjV33ov1a*88J+^>M
z0LSL({T|!E90w)_hVTa-+rb<cP`~z|#||(D)I{5P!(%6y1L{o9>GIeG=79Q-T=n}r
zc7u5#ObiTlTpoMC98iWd$o1F@=EN{DFo^y3*azl-`k72$J@$h+DNGCu@**Awz#Pz^
zD1U{=K`<wWiGd-p-Qy6LQy`L>m%`w27|baFbzvDij)G&Q0@Tcj{o`>QECuQ_ZYcCP
z0p@`Eg6{V`PJ%h0zTl)zk5ga{s4pnH(Bm|i1Iqh+Z#>R`IiNn?;SC;V!5mQMt>m=F
zIWPy*D_h3saURS8^~w&e^tb?W!gL)q7PI=jmI5B2b<%PtnHU%*S$bRrsapn0XA#OC
z*T5W5-Bau7aUC2hphP!~%i{)^14?xJ;yrGHIiN&$P}SoWm;-8@u-);v4Ke^+MNMPy
z0IvqG0%h#(O&)i_%6LHoe$z!g?tzmnAE@-%q9EY$5ESPhMKV%~7(5<HGBC(lf*iC(
zVLG2Wi){TO0T0lgRQW6>1_tpN9xuUmfD~v-dAtH~c7PnY@v6sbupJ<G&Gq(p1LlC-
z#bM&{7OV`EGdQe0-hnxw(&sRn$9oXx6u2Jsy3XP8iGzVbejT_R^!N;xVq^o=Wmdw|
zH>k5n)*oi`_y!gR7mF?`93DSGI<A4sI*(r<DR6mvn9buih;xdC!H|Jr=06S(@FrLV
zTYqpZ$;b$nWMuGXVDNVFU}S=D8U4X^AtN({%jD0%U?uFq$O7RqFJ`O<RWgjAG4N9|
zEc^@%huJ(B*}$@3dro?Zcrb#xg9@kk85lNR^<d-zhXMmX1H)Wz4@OW+l%a}|pMgQ^
zkOw2UExLmV#5>`^$O|%N2gpzk6AwmkXK@D`KLZ1YwFe`(gSdl(pP`<i*3*Mg0IZaY
zpMhZ-mj@%bLArwn>KY-C+$jN&ulW{ncrb#Ro(f<285jbcJQ&45O{s?<*MJ-@4&p%q
zsG?E8gHeiufkDw18bIKd_bG4yMa=VH1hu^xPBGSlLMZB#2cs<58b+qY;A$7NjfUZr
zEHl&%@?0Q;I6z%dhKGg>49l+xcrbznxD;#o85m|HdoU`4Rlppg0_Jgm+-%k-;K2xL
zoGGq=x*0sm4|8)pqb5SFgn)ntqYlW?kD!j$g}90V>MGFw?Njog;0AeDAEDD#O2C5=
z)Gbt!=4W8g+~UCqZl!^3Nj>Yq2x(M+;sT`66roXf_EZ56M$nL!k{i^0;1(HJCrGUo
zRBbE+!||Z$g<32U8ml}Qop>1-l!9X!82aoy7@ff!VFre79S$Z?BVP$rm;`iB->Ai+
zYna94D#5^@RH?+kka(6U2h4`e5*}ADWMD9IlVD;54Tvi9^D{7Hq)zA8W-;eKspKLG
zY7Br&64?#YL$z5n>Q8F8fKr??Xw+z;tqTvRuYCZNaXC0$ctt_oQc#X`Z*hTieL!_p
zPKygTu`LryU|>+TkN}ksY0EiWG&vX;ltC>DgL5w6MlskT+aoUEMlrYv<vPy=+$dhg
zA_B@KF1pkIXtQwFPj@MR^$c<=T?#-GhE>`O3=_><3V9e9gg_$(YqB*wIXD;?R6t{a
zMsqwl1wf++Acq<)@#F$?Kn^wb_v8k11Vl263K=}X`KJn0jT$w3g0oK*X#8|zk0&_y
zRDs4%b;CY*f<5#GRKqGJc!Gv@1nm?+{<6B@;0fxpsjOjQV6flfDIx;uq=T$o(d#KH
z&A_0t22_!rZ1EHW=VA*`f>r?yH#GE5zoWw<Ss&m9%IuJNLH8CfNM;8W-`nNAKq1di
z1sbNVEc1f)G?^F}gnhjrp$#g_wF|ru9ZfYIFGNQ(CC3ZWw*+}SA<YZqPKGK_+hoUV
zFVMakhAJ*5R|bYf5?-Jj&QJyFc5<Hef(#0P%6xV<FUX((FB1bp+$S$kN@D=elBlwJ
zfwDRSxHBI2WBN{A7TGjs1uxK0wd!xs&~kzoXhcoWjsYCdUf_{xaHqcgjh7NQ6@k(U
z+e$A;mkSgHVIf|Skt7+0WC1U2Rt5$&P#Yr9)=LLm%z%PbqiVX19*cxlX@ZwNSP)$7
zxA--9fpWZBwMbfKF@u+eBm;xWMv(fM3#QlUu}CtWo<2j5Mb>nSf|m&g1B2Qv@C>6D
zxcda|${%I*0(YOl16P5zUZCz11GpB{sG9ytk439qk&(g6hJ%4YJ&%cj!OhMKG{CH$
z2eKpXlNV@!nIj04J~SG<>_MvPKrOJiA6}r2m3p5EXe@oT7ifT4y$;m;iTmdT8eirJ
z3SnYkm|5fn8eir}0<~o38+d`nm(}Ni8ZYrIUZC-1^>quTPu6D%(VQHR;pM@>z@Pyd
zoVVZN<tYJ6Z({$wyd*&qp!8N~IbFbj#aMcQmp>@8oB~<0g3l{Jl7T^)A7qJG>-0DS
z7KQq}GzD)Kka?d#W6TlW;ED)55OYw-n;l#ff>Mw5PH*sdC3p;oC&`-=B(n?@fh9WL
zkR%K0FfDTTh9p_g#Kp!>-r(E?Zn18;;tff^pm?4#%Nvq@B|%{{QP~@uyOx3S+Jd#-
z;F{@_3@CTGm`s;7WKreo@`0p0kcDEc(*q1y%<B*3_<*KDG(n@x^Jn>h(-$}<LwbF{
z6UX3~oLT7uPG8``7Sr24D&SlQYB#u+`>29Bpj5x4(g)PDS6|1&5CSTsSQJ>`1*QZ@
z<RyzDOoVw-jUWR<y)dZM{|xCffk}P_O9qBkF%~631_sT$FzrWYfV6*QQD%jUOekbv
zn8d-txR@U_pA8qT5oTcEUMt`W3PCMUaqHgV%L8^HD2<gS_(B4ZQ6wiRk-=9DTt1xw
z6%_kJeGw%<PKz%%0GEMUO(v4lR~xZtY4{8Hf-<$%ThIV`i!UTkLrsN*ENI|jzvuM7
zMl4cUe>r^RI2ahTL1Rse+<n2b>)?>xXYUK1U5E51Q$z)PL3vKQ5MnB11O#d-sH}&S
zX~u_rA%#82sa>mmA#+Qh)}HZ`>5axLTJ^Jpd_m)`Iv_E99$&<`tAM93sDg!<Q<~sw
z3=R#DIT@+Gkopx=HunAVg-j%Yyu97n7m|-TL=uaW8GIqbuAss!X^t<b(q*Uu6=tSN
zzTist6dwbtFav{M({z0k7D=axzMvcmvC#OiFDQrdJAf?g`{xVFp$y>F0me^!K{-@T
z5>);!n(ph$#lWBgF56Z%P46;c@$xSa@C8lX=z{Wrdy6k*<^~!xkeM4$fOACnLS}A2
zHfTNdg$zr8yp+@88wAc`ATOCnPFFT%Q8zX91<l3CNrKGD&hmv!hl5nhfA$5BLV!~|
zM}#kAIvkX5yH-!HH)WA9E79?d0|y?+?;e%DplKL6Nl+Kv!qyiw_bn$W$i%=<Q0$us
zwieVy57VE1)|5qx@&EJ}rYr{aM>8xL7}jpkml6b3`tVen5W>J9%&adh2p5R}wIQk)
z81!_Y*`knvAywXwaXSkGgPsgrnTH_*!_vtdtc*hZ3=Dc*{0t0opI8}%!PbKsb)w0v
zjNoD6WuVrrDkJOk8D=cDnI}9785kBbvoaP7GBD^l!;CxOP{_cb%g@SKhAM0!%)nrB
za)v)>=0zVg-fn2>&mqphpsxlB#qIO`Ik^}Z^tC}@)gtK61+x7VsQb2V>U2AE7T5av
z07KAd<uaH(N1ZGg7|z587=ha(a8XA~28O+t1B_8c9V{6b)U^XZ#||?dgsU~MWMEKa
z4RAnJt7FN);35*>h$>pIZOOo}eMx{5s<4(N0|ReZfHSJ7rX>S|`=tOER8b8!28JbU
z0d9f}3>-;?3=C%f0+=+pQKCYkkb!|)B7jK?Rj1$*#_5d~ESik%(^p%t$kmqzFc~m2
zFc|b(GB5~MDawIXpH;!VB~Zw~AT~#l(H7jZfeZ6kGB6wv2owW}zJZH!STZoQ@C0h0
zin3TTFsK>_YJjRNgj!IsI{i`L=6V$Sj{LJ^U`P!O+$;wgGKLv^<ZmGZgF<m2BO9vX
zKWq#P`|8=nKyi7>l7T_UQ^5<x?jt{h85q_oC}@BhV}{?D7#L10)Bsm(;F7OhUV|Gv
z_5sdfVaqhY1@nJUvaw6k02j>Q86e{i8sM4@JQzP&Py<{pPX#p#N)t37Ei+kg%T@z4
z5y$T!2dd>d76@oaf=*V_W@2DaWz_)BUVyFbTCD-;LxGCMdh>1#a2M)72Wa%EV}XV&
z7XyRgH*E%nlE)hIV6SO2Fzk4xp#Wlo2JQJ>G!#MXH`)vgI-50&z!@@xfkE&@PzDb?
z%s!-W1aq=7Fc{4aW?*pA3g!}LU@-a<%)rpNIhb3Dfx$Q(<jRH8AsWG;4w%t*&@}O@
zU}ex@PwAj+wEpGv2UaW+?hYcsYT%X~sFFXsEErTfFo0)X`o0B2ss}~Te4o*5K9Fs~
z3=CeX0>PkGyKzzi1A|c|$gs1^rrTSyNND5-g9EP$R99Pn35En7sIKOo84T{OE&~<n
zjSr{STeFDQFE$7UHL#5ziDZ-}F$9Z?F))~<fQ&0V7%TyHC@8LsGJ+xVM4*Pm5vO1&
zWd;V5`ykhr-U*ggV_+~%2enA{{|g2O^c&FVnDv)n$g~z{bSx-87*sVfROy0(#5>6#
z7}R$(NtrHc!@^%*;1H}Q$-rQ`8Dy7}R<OP>C?G+0@rVW+fO-bHAiI`T1cMiifoBGd
zGJ-+tBN$GBEUu^w26rOCV|4L5f+2Mr$Q2bUf+1~H@Z_xVBhVaLAZPF@4v+^x%NiaA
zudWA`Uf?xx(=vj=BYNP)hGEIU;1NA=2TO}F7(Ai}uE!EK1#bZB0o7x3eg<y@b3kJ+
zc3*-wfjOZ1N8dMiGnfPJjhkc&GcYV!!x_Ad0~B5myTK!Q^)S1^LwR7kHysEDkKTdT
zMa{h)3?94#cWCs~g297#V28961cL|fz{{fMT@D5h-hpS%*o=a~gLhRRha3_K1`pm<
zK^*c#n1R9ex<are$RX>P7_=Dd4h36rGccH*0mb~jfM9Dd2NWBcD}rsn98hd*d_MiO
zEsI;dKSyva2Lpo{Xgo77GPn+0LxQv#DFuUbJJ=8D_kzI#-{A0b`49{q_y*6WCfWvr
z2fmlFfl{^Ub72OC;Q2zqpv4Sk{~-a>4-PnxnbR_Y!9&+zGxd^!Cvk#y?t%?<TNn%;
zs|JUK!OvjuP&GI#(yD{OBh}!raB~R;4^)H0!qqo;I>>Br!**(OFnF9AJYVa+Bp5tO
z4bC6IA;Ggi%D|mAPp;tEU=C;o)x*C&cn+8c3X%lp;JILqAShvr9%K(b%)!859u4uu
z5wH~07of3FNDIkFH5fb;3XWa7FTvoUP;l&4I|qY@LczgQdM+3|6k5dwGJ9&2NC+sa
znr{cqnI1bA0&1B;*2o%f50L=J0jP15RUHD(tKbld%?N>%ilBmU<*N`#sR)YL)p8-=
zy!s#94{Utl5&~M7VByZhz@V%i0_jeI9KK^|2x4JEO<af?Cqp=B@`Q<jp;aaXu`)rL
zCj>lNbP5zIDmO#GQ+ePn%+l*2;D#)?Y>%u80gYN%xP!{}m^mTfQHxWcj@_(((^DK+
zbYe1GLO=~Gi<jV4Bq88-6}V6@S{RZ93QurVQnWlI8O#CsMYtp+1<V1JY=(v*;MpFq
zL$Yp!q=RKZ4YQ`X)89C-NP5f;$>L;Suy|<zo5Hd92`=DS7&b97FdUU|a0uz<U|_HW
zEzmMF4Cw(I01At&8zH@54k$F6=1%u@WRYZ?Jw4r#MXp{!CKMDQmiL$#7>=C_1<xjf
z^R@BzP;h*J({EOFC^$aAk+b4JC?q~W#;rIV3XTtO*LlUYP{<%3$U`e%g@RYLfjy+Y
zBNWoF0C|XwI~3BdkYK0>Ex?hs3Dx3YV6dtNM`9=_pc%kHw_|B2B%nbyDMW-q#_B*p
zXS_WWv>Hv06J(QSdMJ1`8aUdN^h3duso-ey=?_H|y~c+_K}E0HEl|;WWPK>8=&ffs
z1?oR9F9?N{y`X;k5vNc{*=qqxzbk|VLO~^t)m|nBhFSkYt-v7(3f8$VL%~Zqz!5va
zH59y<790-7+e5*NX(40OlkTvDg1Q-2H$V%>)I%W?tl&w)S@j<kLcKW{7_32S=k{L<
zh0J$?Oy}|sg-myX{GL`43YqPM`W-Ua3G#c;<xt36Cn)`{&<ch0DL|n-DLfS1rvL{;
z;=j;fu*1RqY>!5TP*7sEo?9=HTvEXh3QDbVoFHp?AB93vE6ApqI-!u%3bLtdbtojY
zf^0J09txVMloAsGg;AUtM<{3stTkv3GihNcD4jxLP@pO_8*DFl>^*t6LMUi$tMxCD
zl++xC&;rhBE-Ye<+oy}Wu*lZ06bJ>aVYTrA1=GUNa<D#-n*^#tE5IC3P?+8htpsyG
z4pe0gtpanvr9nrEKq#nCw*f7|OIjETt{}k)NuVkeT&9DgszopqT&BaK3S6e2;;9Gu
zr0fZM7-$g9<`t+U^a}&`Pr&(MT1FVSdjif6`xL_<t5!fgxvdYwAnP+geX~`Q!a(aY
zAS-^unZh6$3S1JV+z|)|4ZPWcS{ADk!oixr&NE&gE)K39!0uaR7Y^11c3=MaaBwy}
z#RIByY+ea7Ff{N8goB1MY>Sx~7*-{OL)Kh@0?PSBIHY6)1yol@IHY6)1ylr2IHY9b
zVaQ})@Y~7A5Dpr(vfTz+FZn;*fs27b$#xsajJXrT9YN=ko&wExO@0;b1m=L|yCSQm
zUv_2Dsh=P-A>56Ffx#Z+`9)FT?qC%ly{fF?9$*g0{*u+<o?s5h{)D^XUSJL=B^il_
zdxJTkl;rFf?gQq4(yZUUa6d2y)NT^a4)+IhKxOVG|L_1XM*%cU<{lp&2<Cw%H^r>O
zgTNe6!^x*CJQ&OY1#+`ncnFvS%Hu9u!o$EEP#%}e4i5)&Kr@(AnZhH$9MBZBbnx_h
zZY+`-^TT7nVxSpHp_SpWU=Ap0nqCf%19Lz#l!kHB<=t6i<EIEPM1WR&+JhFvmmG}%
zt!c3I0_Snjn<5dQ)!p_5ObiT6ED?|?dQfng-i{~$r(RHSHO-AE1am;a)oBt@1a4V_
z)3qSy^x5t#l8k?*Z*^x;s=p%7C@sXmV84Qs8L|_oZigxZLrSSU<26v@{}fc1c~XTi
z14DbQLnNsBb&wS)Ely&H6c++D#X+{Wzlj7Vvt^)QtGyg4Dayd$APWj9k(rTFG7Jn3
zO5o9J`vN`&274i428QF$H6mp>q8S(*N<|7Y7$W6F7#QpeKxXX>iIfLvF9kWC{ZpiZ
zC<B8rBPe>?-$a6k>Xv~D-F@1TpdJN7l@e%J++L53fni>1WP~&WgK3U11H*i$=^H&*
zBt<sJNQpBrIIPnEsj|H$%)pSnY5F}6772|{G9YUpCePa-qX1S0GFkhNj3PL|K%U8I
znJ(waB46(;6Ad;R8X!zZE(kL)bQE|*fpVc^1vo&W#NYwKwlYdwoPoiy0%XR#4N(#x
zPAw=v@=ip7LdUTQlv?aAMS<(WHx3}@nMd<6Fqm)WV_>jI6J}tDRVau8bsrqBiWKr^
zFhqfZ$RZ6AMAJ`uvPjndiBbSN6f`Q!{wWHy0mhgy0c4cLPc{Yy=d36dP%OS-V_;Bt
z6qO71fF%RNq?v5|LZH4G+%qRE85o=y*aT2T4+t|buqtw}fkw!jf|(c?!erP$TSg!)
zuE;74HpmDWsL2&QnGG~T1{!=6W?=9?&CCX>6r4bLeVOp|ZZ8&Nn|8M4JPZs@Eo=-7
z$HLim@Gvm&8^m$2edT0eZ~{&3gvqdd106sEE+W}w*}j805W}bc@?w#$|HJkRG;aSN
zRJwXD=3x8G!NB0mlK|4s0P5;jCb9h$W?*po0r%JrVFrd>wI0!+`3q;zB)<KYXv93r
zDTioLa0d?*F@9I0Mdd-EVj+@Kn#T|gE>hn(fb7z-k&jm5V5nzsJ_}lXa4s4=E(|Vi
zm%fRHG!#MkPAx4O(oh5?T@$8g(6}%Icm_OqZ8W4u3mQb*5*7{V(Sioi(%(gc20Zm-
zz<Wl*PVz?UaWF8rfSTFu;n9$`2q@0O_@X5tjS-Mdi`%0ijS-Mdnv<sM_^>E3R!#T!
zVUe=^9HYw(G9g(e2Bh6(1E?t!6k`A$p#d4yHzURn%mIb%q1!P=U=FARR!E$_%!fsd
z(Qx`%9~RmA*)irIlf0AVVn8FFuAsdFGb>|2{UiqP1f1#Z7*Icn0o;m@tcn5kllT=t
zb=SoD7+a9B;BH0H&KNsx1_oDg9&mHBih;pZ9o*a$1dT?V@rtnrS#u_tImVHbfx$JL
ziGg8dL5!0J*Z`1=h4Nw`16E8R4Xy<-pn)n^<7A!~&`L4ag-i?#b|+)pLF&P&C$cIA
ztQlOv#xI_}(U(QaYHo}-$PvjYaxwm_3=FQ%gBcjyTVevF7#Lg*1T!!!sf-Df0y!<1
zfg!LhCJ4k{7|g)nT0WiCk43Y7X-p_cKd7r_+?EgnTF>QH37)!(i2!xbLqIMqaEOTn
z_v1lH%Dp8f3Y@+`dENAOOq2pBeSuo~atmUjG(j9tm0;l-6J-qI1b|as3}hu(1SsWo
zdJAwK;$UEK+sz~gaxEvQYX!-F#@jiMfMr0j*tL54X+IWCmsBwh&XXX~XJDf^L7gYQ
z58%2(qK<>}EC&OFyEJG6#cEE-auJZ5Bda(e%SAvbt21o6g+Ggy?h?=d#0f3~&}w1#
zB9Y{bVg>_m@B(9y7S{6y;L`xXBiBcsP4D*yB^QGTQ3eM0B6#levSeUrNHaKuI-uqu
z%)k)%kVkVS2Lpo#sOZ`*uQ?0ccLSNsc~)~am;>@wWtk>uQ4}P73Hxe-Rz*Q3HMI*g
z5v!uqbTsF4FhnpwT1xIMnxJJ-kma+BBs4*Ld>FtTUv@T4$R;09u1U$!glzHw&1xp3
zX@cgoL9?0+3_E6PLN@tuGq5l)u&7RN4q#ENpQy?FS($;sqg0rIL34vdENB?dV-FJp
z!<sd*;MrgB)K`mOEO>SWJid2!SuA*Z>XZN|-Fvh%FnFA3V+5_JEi{Q0mt<h@*rUzB
zkW(Kk0WPM685p)_IOu@Za(e266P6Bm<R^qdq##))lR?K&0<;GJl(O32=z#hk45vUT
zYwzOe_JJ&tW>MS@x}eU1Cuo0){T5v(NU9VmNX}%?1sxkMXa~`&>jG{aK=t+ovWV3$
z1?>#JrKHQpz~FgEhk-$P8-or5LrVjr4g-V51tuK^1}QdX9R>!=7#1A{hSGzqIt&am
z<=Au>82rlEbr={T6FC@?Wt2dD4lhs{cVxa2Xd@z|<-WsE$xncRLA?)@z}!rg{6WL~
z;J%#FZ>0bbXS#9_i!5KUQV56xE?8Ggo$eRJBFSf}6b=>xwc?b1PcIE(vEe&nq!h#r
za%eCEgW#j-`-4~{G?FZoKwT^EERp2g6b2>8DtS<Xnm<d)8lIqvE>Hg-#A59KRS6VO
zkR-xwrv#d;fh3U`UzH$%14<%V21<~1si2l-X@U}XAu4$4GD%zsybg64XzFrX`t-(N
z78%CH)8_@VsJSdwN(XIJ29L<}%}~k^1ubX;4U@G9DrJIX{&O&7GB8LjVc}2$Rg&I6
zm>3vxT9gt&bsO043hvW6LRid`wkQ=qqL7J!K{rpSP@aLoCj}CPN=5J}T)#>QydHBI
zsL8o^u~G@xw|3wHK&ceWu?MvYyw(acFsyy#pa-gad_dc6?6*u`7{Vf1|3(kePlhB2
zJ<zx$LzNBK06oaAEn9|Vj0_C3=I9x)Ffecg!R9lWj<|p}6&#e%Gv#Ms@NEZ;h)mHl
z2c>3kIjk3<X94DbGIKeLo+X$As%g@?^{l`gW+sMu1`~EYYcLO#K>S4XY``2)nAy$M
zvjuZNLyIP{dUjwAXhg3{NY5U`0e5X=Ch9qWIN*V+2|jv`U=FB$71*KY1mb{`8`D%h
zXD~;EL5YDu@t~dyGXsN9{RMc5r32~{T@uj)&AR!427+3r==p<mz`PRx=77A@9i|ru
z=0Lp@1m=M1J`;AmU@!;jn-DMu>YGq72kM(JFvkPxop2Bj?41cddJ!NF*gK^<dXZob
z$UA9k^&lG!1VGgT=Q{&E(An_*puz2p8>ZKXu}EZ<v*;y&)PpPKv~ImbFbCwYU8Z_T
zU=GM(CsyhugE=6F9o?>%0_H#+mI~%T-IWI7oZ=Ai3H4*pOXmSi27xj}PWg1ka2ARB
zekHvuunJIHx6MN@8_dxG)zteF^>U;c82sFY85kzHaOf2XFfjPrGcho1i`IkmP(V4f
z>8BnfHM4;9sPgI+OEWO|iwiR_<XyMW1}%c{?*$i!+K%w-(EdgnGWKBra{k`M)8~e>
zNb%p`h+_n8YV|+L584Gj{a84Qslswb28OKf3XD|@4F3Q585nfW#W7ZkGcfq~g60Z)
zm8MHaut>3iR4w{B-8zEBOg1r&v5lXBf#H^h186Bx93yCnF~eaUeg=lvchmbKSS0HY
zgmN%&#4&;f$%2CU85pwK;uw3udO(Jnzl~$;2lGISxIAOx7$<^x9Q+InCwk%-CxLmO
zHFF}$ag0;IJOO?NhA4$N#;I(eol+wF3=Hkkag5X07#M<rCHNT_w&cb!P6w-00WHL9
zSBYbs0g_DC04bG^W1J1*6+8GbFvJSQG0p?=nwdbCF^E*gF)jp~${gUwz_64rj&Tu$
z8{)^nkajkXaWRA&;m5!r6cop}1Z)j+j2{C-mv$T@XenIKWab1v28QSvaf~bZL5qoR
zF*o=zFo?OwF|LNFZt-Ja2w;z6TnpiL_%Sf#HpVfogK&HN7#I!)#xZV!a3}aNFl3a*
zF>Z!fJjIWJ!Fy61;}(eQ3_k`2=IwEeTOr&zD;OCVrUWtWU|<N~XI=o}xv^|u+zIAh
z0CAgEGwuTMSU}!AXcfn}7v%fJECwKhF2pe&;Adb6+RO%$Z9N{xco1wZ8;jrctSFYr
zvhxDs7%y@#Fa+oEGce@+i(|Y5>UkJ|BC>>Ux>Piabp7i%#;agKP)zhx#W7w3^Az|Q
z7?w4~F<uArKoMaT9mjYB%roF;V5qtn$9NOWv*2f7I9eLVcni#P;Adc{^^9Y@4Q>T{
zfL0!=F5`$}1g(n=5%y<bh<z5v_z-jyhk*iUjcC0RLmcB{FrP)ipMjx4F^=&GgsTEt
zGinmY_!P`#*6?Rw5KV|<d<Nz+Y5OxU96uk&_#Dh-)b(dzIA{{b_yWvj((`9v*d`pu
z_!7)zHUL@7AIJC#%;hrnXJA<OFOKmwGebQCg8{QG$e9^(9C3{AI2ag0X8AKPFjd4c
zz83}^<G}-RCUa^W<43S&1s;C}hWw;B#?N3blMcw}gK>;sz+6U<#T=n=j9(#KeSZc9
z4Z}FbZ(uIi9W2>#jNidrR%3q#eTMv!IL04fK8FR!9n17T#4-NnU|<OI<!4|pzZ}Q-
z7aX#nNb?Yw{xF6`s(xmC924kX0tN$6tQ}bv$HWL$1B$iPH{+O?z&uc_iTsIUVgd6&
zv9_>3j)_$alpa8_7ResR#0HiF#o8qOI3{*5&x4<Vp?q;169<?V0CL6YI402AK?Z{e
zP(H7>k7MEnOD6C$Fm!B;W8x8EU<eV;;Adb^<BMbB1<MtHN~Fd(CO$B)0;KXq91}m7
z*TB!fFr_b!NdV02;Adbsbv=$r5X_sv&%mItJdQ~S%$vc_z##i9j!78ITL4-c8eSjA
zBnsw&@~?1c9FrK>`VF8puvT$Q;$XQQpv4pIaZD0m9w?tkeu!fNO(`=NoB%oWd>oS$
zSndKp1B3niI3{T@?*=~u!}8s6Ofq2J1AYdE;ze;xvS8i|22f!-J^54slOh8{xC%c5
zL)YCnCM6-zK`x*O%KI0`qzr1+buu~>7bG&oF{yxgpw${@m&Gxuf_cpT3=BS*aZGC9
z+zL+jC%fX9)WKX~P`Y2qG5vNNi<VAH9FsQ4=1$O><XE9NCLJ)3+aGkWMjVqaScgD@
zKWIPKbi;TSo%%XUfjA~mB_AHo&%m%tC637-qy?Pk_jANCfv%)sFaR$J_Pi+&#{}B`
z91aR(NryP55V%q%i#VoG5bqYKWRI+hV+sTFctA<?)P9LLrYH^uhVYC03=HW{<CvmB
zk{~-2805~!F~xwnAe~7iaZI3koWVc<q|>f%`k#0fX~wJ5B@$Q;i?_4HF@d&4L>x<C
zV2IFRVCZ6GVA#EB`lkdIBWFJbhH2;Hn2v+}$fy7+!E54}KvBnVi&4dofkC(?j_D*s
zR>O~hVF6zp(<vzihKP-fI$(qLmP}7iWHG6S8gvn~QJS9#RE-GL#4%lha6O;~T?QM(
z1gb_r23-Lg#1sM=d<h8R0<Xz{jTtf>(GX@}IM$-T14?O;4@EK<ctC@M;*S_W)%>wm
z9!X{fhR743M(G;|-sw_FENYT(c_l!CZ?zd1c+bakf{RC228QfU(<75ubm|XkgfK98
zT#*unuZTOSpv1r+AtTKv1zMN`YsVdw5N2R7E?XcCI$0xXBNGF|8FuMRF$M;``=ADg
z_8;ji@W9y&P$Memu}lJJAwe{#-;zBk0kS|5q^?CU0lba_+>)}NlAs1!U&j#yYDz^`
zC4f4B(Y&BGl2&>GxCaP6@T93^x>hoaY`um=0%+7J`U-gGXMza0y$&*U(ewoHfIoPG
zQ%xrUJkSK*RXe360X*Ojo|s*kod60h$VOV9)&$66J5a+b^mzhg0WHYE{)ZC4Gib{|
zt;3L$3E&yDWdfk>Cc&o?z*A`8PRiM336SLnpt12O7ZO0LZ6OCkL{=q$r_h#(fkI<h
zib4Wt8Z>4f#NCk5EwH<z5<pW03{@;5IjMOJ36Rk(Q1h$zVgh)s0PG19-ULtwBa8t&
zHlT1b0W`b?Sv$PoP6A{a6tply?s@{a*8z68|F#71>>RjrRk$Vr((3?quCiVwfM(|y
zmI*U4FzB^UpPj;DXgVt>0W{;r0N$(GR+9jpa9bwFz{bEJn_?jaYJh?UJr_7zNXdd)
zQ)~<jb2d(AOl8rikB~_OMRqJ`dOCYjA~>?aovsrL6CsfeY8-d1P6Wj@WI#dTW+EuA
zA-zS-Es3DD>x>6M5g%EV2wJn_wp$z&bSfPZeA%Fzn&vVwFl?XCm%|NOG7Ad2jMsd*
z;P~gL2Q8I5%9jV`fg<x{DIa7MUjURVR66(ym>C#iqm>vKW-{^>NiZ<P?uVyp0X_zX
z*ttp!3{sMO#b8fDrI;s`C^0YyzvBA|YNCFCiZUJK-~+ip33Ra;-!HI+dZ--pqykk2
zhG`mnjHkikaN!(P1_l*LKE^Z1!b}H2BO%Q)e2f>s!m11mr(g0hUIcTXTA2>~QDtB#
zoX5v_303$93j>3X7$4(hkZ}E*&5QzkjDJ}f7~;09WMp8_{=@i>pMgQ}0EnZ`!1!Mh
zbcz#*W50!oK@zlJ5L6^Oxmxgn>-%^{e$W<sKE^+wAbi7+z`zjK2r5HcdHI;Y`)J;P
zYWtihJ|<?+hT?KiZNF?T9}^4sWCTeK22}<IkB59rY~a%g;Ew+=-7cL)(&RfI(?($i
zhIkE_MBM~K1_sM84nF2&4hDw!e2DGL;OWaZpvp|0VS0Bui+=sYGpY;>Jq>)!86bbc
z)}S#@JfX_K5Z%JZoQW!YM3sSIwJ;xZCi03k=7|Ri85q>>^09cLEHOLqB9noEse#cZ
z3ADy60kjn?dr}f)$ss6xomiMu&kYI>aGBzDFo_3LY##)5<|3aZfy<^-pskxq(Mfz@
z8PIxZpTH#W=+rVTCI*HY$t1|yU(j6F4A&$<urkmLRK~v~AutDY(95YmNy1<bXpT9u
zDhad|AYnorgCN879T_Zw_1Qv<JV~HM07;-hjUeqL@Ps3HthoMck`#C_0@PpD|BxgN
z=77r5!>vh>QVW#xX7VLL3N4W1`NERG^ZwuhQTK8Zc-|j8q%5AC1ezFPJP67|J%LG(
ziJ^MX^q$e-B=GqBGC9zJQlFB*B^Y?lh_^fmQi6dtHO6x#K}s-X(6;G`Ns#e*&?Mjv
zvm{Un#!#gS8dr`;f)rq&BQdh<lR&Er7{Etj7=|Q479@lEy-XHKI-nT>hAK@a1_qN4
zNstl@6ts0|NuVJ;hAPk+y;CenpasheRiJS8NJ)aMSO#s2W9CnStXKvGy3Fz<$ckmq
zIH2DBB+$kKhAPm|&&sPwp!pbvDnlj)hTY;xkO>*kStf@sCe=eGWI%_R%;ri0joCAt
z0!>kx{7QnXH2{t9n6e~+*BXGwi+a40z{?Akfnt}*I0>{FfuRaCMD4dM$sQa<j-dUL
z@kyY5I71caET5BqlOUsK&Y+NsO@fS`f%aksFmoh9);fdtxi3fpt#xLoasw6JH<CcR
z5g4jKqbe)UC4pvr8LB|T-@65p+`$%s4p&JQP67|CodT^qiL9C~n$4ois6X8~n?=d=
zV6q*k33&@NG&dtW8GIJc8&LcwStNrG7kdMmB@F0J1}%9_o(LK-)c!MlRyK=zeJe+@
z7drz(^4?$uhN$LbZ%GD*6vki%hQ<4meL!p;(1_d`b-|Wo(DLRK(D;txtz^*F>XdR&
z2Fq?uPUK`@NNET8a-CRmk}v~9%Jdd*28Nhz$;m<t3@OVQTNwC2Hh|6!nYxRQfgy!W
zn1Mm<l}55Zhdu*CO1Vf%GD9+WfyEn;kquhOK_Uzc$<sjIsl1XL4Ca7*U}!o$KZm85
zv1a<?92O(S%;{peEME0u;RVT{HG8SAK_{?uCWAKNroLtf$S*BnNCqw0OZ~&<;LX6m
ze=vD1Cj&zoFAs>vDxJI@WN<A%h?kL?yg`J4A>}o{hc^R*&V=NRf(#64%KS0j3=Dx<
z$(uktWBv&sQw}9>7G_{ba~3f01_znO76}H1v`9gNfXqCGWKhpMStT4~<}|Kk@Djc^
z;ThhbUhQ=DJeE0(Mbnq$v1l?*pMEZnMN%Utg-?QkA>9$=Z&v9Pez1!`{;u^*0T(;q
zn488moj;#Ns{Rp6ik<*SITHheluHUE^MJIni=;p@4=8?iPD+7f9#DC5bV~{(^Du)V
zA?<%RBLhQ+7ib74m7R@&Aw5fnf#HBHXh=K$FK9@6{vPm5(!K|&yr5#a3Z#DeWw846
zdXR<%It&cCx*!d?4j>J=!Jskl+%#rTMQ>is;|3~-)88{OFnFJE0~f^L5yFF!Zs2kl
zJn__I<p$ox0&YG=R=I)8VelF^^KLiDECF~aOV61SH_*bJtXy!DtKQ8QRQQ7%C0(nb
z98l4?C<?-XHmsl=(DcRRFJO+=Y%b7IJ>S3_jwDc8s*wb9AV+-2C4xDS%|@|KU=9O#
z_2?NMH^`zO70_^Oo3k5aRS>9Tb6VsEPPE_>%jB0EcvVmpsKnY<?*?8K1U|XXcD5U2
zRS>9<I{n=ZeELBZsPNgp&@B{HH&vN}*1^1V10UH}1zI?1%HkFdmH}-97uoC<0pgsh
z2NhDOf7~L$JkX%_yaKl<Fb7mFsh)F#Opt-HVl1;;3|IzKkW|XMfzRwa1zK9+|IaNB
zEEB-Qz>xRCEgsAPZDv}^<Oa&v3{{}Hr}#B)pp4B>6$zTzo$Qvx2^#FEiUQ@aJ~!}+
zr7BQUvG1rGxXP~r?-A#B1FcwMsEP&c`?YWbFSe_S107Sv=LTMER}~LBU2v*f2FO<M
zk!9OT-7>)((2->pMs8VP4rof6XNDViUDGnqA!XZR+#GU1QdOW`<_VYF!0pDWOwbux
z%5LChV-;v4wDc@DaI>*0n~8zJ^@1CC@kbSCGrFn7^yDHI)%wx|w-S&+rwTwxR<cvY
z4RnxS7U-0@>`88w$Vm*sfhI992bRPj9B2{)ao|Y|#DOO<5C@*bKpc)Ba8(@Z1hojf
z;W3C&#SL^`U^ZwuQ1&FZCS*52I8Zl$IWRXsI8Zl$IB++BIB++BIB+*Kv5JG{DL~DE
zSSP4OptT*V|4g4-%pz0&OT`T|bejV@Zzy|`TQ9OpARMSmz#N!MARMSmKpePBKpePB
zKpePBKpc36193nZj)j3?^`GfBB`h-ahaB8M=Zximj$_N7<OW`g3(NZ8wYcDQTr+ar
zz-w{AvjdJIZs4`J;2m}QX1alw;)3TlN)z0`OL4)g7uSTi&EsTXNam0LHK2pH8o4oo
zS`N8>{Gel=+!)P4o~}OyYQuJ|hH_7V#;X@aL3vf6cD2Gy7>|>mfno9&2v2J^Xsl)a
zHwcd-2{d|LBMIR#oC3AL<q{!0jvyIOr^E@uV>ktBkCzL$F<O8YJ}s*UjSfxQ?#5^d
z;+_JH^(?7(V+8GEX85lKa(KiOA2&u&6C=+S>Tnm3!{P3R@L=u+^Wg4=@L=u+@eu9?
z@i>y|VGajz5e^6O5Do|N5Do`z*<x4*a(85v8>1V@-OE7kHvQ?w2wuPTA2g&G`oWD6
zvVaXVq_}ID8zX21n|hxKXxsdDH%7=3HV0OI28Jc|(<94R<m%tCxP#XF<bh6sJG;ys
z(p?ADdtIyDA>DOQy~ncG9nxI~AGfkyUBVr-F)<(1o;=3vuByVokmn21R2b?GY2SiU
z@`1bVkoGO8yI%Rl9lV+k++E*2#~sqX1$RyLrQ9J6Tu>tSx#kXP;Bq8^YL(U`chI~b
zzXPaK-apA5(!K=^Can4I4qCDT8BCa8=nko`LEVjX6L&~`4elOqH<fk=wPW+wgVqN#
zyPLwD+AZyF25CHl+?puv4r#`M+<M@VJ7`@I19%lX>t1)z94}<1HoD#&G|8(c18PUu
zHM&D4c|nc7O||Zz&9)5S?btIPyMuPyGE_-1fGYVC(8XD|(wx{B81g^rFfjBz1l94U
zo-*n%)HCoEf+~5glc0(2lqaBx?zvf@iSE)$&_s8%Gdrjx4UJbw1MR~r0M!vwR;LAm
zR-J%*IFVIpplN9a@XF@Q!n9yP28M!oke9U9rG<c$fpcu5U>ay43FQ2-LfN!1urlyD
zXogm4;b3(#pcR_=ANd#<3R13vwtR~hsHB0$5)1AyF)&P7ofZR92D3F5%mKB7G7Hn<
zz$05wTjN18Fk2JA98jyklqD?@%mKw;p=??bNKgF%P~aI_r6q%<z(ux0y-XVD+}c7=
zUrPC98n|x@vliT=1$)*aDh)CP2(nh5H4QWcs9py?U8w6gM;d6!Vj-w;Gi7yJ0jRwN
zGXb;(9}-;3FViH8z)~P1Oj**v;~U@<I_Kl`u1Xdejq5CFpc<?YG@PgWGOZG<8kEu_
ztJ12#98d@pZ=Zgyl0~Neqe@yG2LnS9sGTuoby@>h0aSG(m;+LsS(w%&gcM87AQ@PA
zwSYOG@G|O3YXx(l;nfD#0}ZZru#5sI#tK18=K47~(z-x-vIw+FQ~70D4@d#b%e`O@
z$Zm_M>Ah7fQl_iZCWFPGj++AJfD~jFrcDJ~1PT(Zb!pQ;GGNC=-I#u-ibc+Jb=n+|
z7|iUsU=B#D^2@Y&U=B#DDNEXXFbCA7j&GW-U(KRX|1u4H#u`lPGOz-WR@RO*&^o>1
zP!`al6^1GXhT@bY&=e0S@yl*kNCS03iZ?ScFf<CLtpRBRS64>8X=}k8kd5-JY3q0x
z7}V=Pc{5czZ9P~9R2!>mrETD0U?`q`t(rxYX&(FZx792X^@rutZh)159B{-l?IxJR
z2C`8zf-4Pll1zz?NJ(NkL)u-C6xh{=<<stgIN*)U`aEgiv*AvGHF2C#N_)h?z)+G1
zK2#>{u`~li@gYzEHwvab0c!%4Y4WUTPeIP)r~@BG6DL2tr-ntMUY<4W6-c-ad{A<p
ztytPykXff8X1#-(bw(rYJ>0BGFVjANIiPV^*7UTGV2%*T3)-S$X@5W_e1>@8FGvdP
zh0=tye_)%K7;Z2!FnH;)vw-JT(-=XA+?U$vFfee;0Tod7k3pS~?Vmv9Q`#R;`Q*|J
zDxc)zK;=_$38;MPEo28>n9L5IwU}^QC5;iZxv;d{0d%fT8Y3Ub-QPjAeT!fkBR|Lu
zr$BZ1gjZ>d0tyTaC8zm7)$O)>mi%dqpyXS+0jg6KMW-5Er|teUMs*Oc3aqoEdHU^I
z7O4o3@j4)3u<<<m(-?JmK*uJ46`h(dmBt9F6v~vKrW>M|ZUonOYF!$mF%Rg>F|bB6
zsp-CTEK>C#)9XO(+GQZevlOK<f|ut12T!@|jNwUR1f4ux)&@1b8D#n)kgvnN(ip)f
ziY?;;`E&6)u{7|!e%VHT(6R7ojNqfgmVuOZnxrv;PM=n<V*)8XwoW09v4?|!q3n*s
z^k;P}3La}X(-<dmFff!W^D{88>`h~YoE`?!TWy)f2;Pyk4Adl%+nL5V1w6O`I!ou|
z_B2NDo~&i;Aagllr~B2jNZ0R7V}vyBKt4Jtm&OQb-SL4Y7&oRd&XES$4BF}}&y&VD
zSCoOFtW6rE-|mTY8Y5__Tlrb2Zx_OS+bEdExCj(X;79-&x){uZ8M*{vC?o6im-Q?%
z;r-DvX^bm47#J!Hp~kI*8^^LUjd2y&0GJy=!w(FnV8*S18@GR18sl29kHK!#y)!+g
z0pdsSu0XhRz}o`h`nN#zgM8&&rjW+C9psGLP-pBwaR%gkFPJmHTLj_8?1mV_&%n^l
zm&OR*BzQ_1)M^Z0oW{5p>?(PX9h;wtr7<4hU|^_(rNV=7JCr)o7$K*5f$Uh;nZ|e+
z>~WA+7b&JOf;Y6C5&{{cxof&_Ba3wX`7}n*qDzJ<kPeW3(6UR0Q{4QZ;q5fW(;$m7
z`C-LrWd)=-HDq9rs!~p4JO`47`Sm>99iSiw9o)qL53-AJca(2TW4r|St7lG28slZK
zB*?Rk=4p(eBfdC-z<$+oVoqZO9p+U9T2o?vIF0cJNGUj>+j6EcLQeAnO}#3&PB&;`
zk(FJ{lEw%+ud52wQvjKL52OLy;BIu7p4G%68-9=}jqxJ~14C5@Xx{s98sjIB60n&I
z?9v!P3$v>_m|#Axnhy7I;5n8w#%~~<hxkFO-qIMqgLHxomuH=RuZcxAHJBrfiHU=O
zp&AsNje==Rkn^xWxyz_GjR|rb7ASYgv!*ezf)#SWtg4oTTeY!<C5;I**Hi7n&%ltX
zoyNoow@OuOdO|acZ2bb3G$v6V28QZ7eg+2Xr)f;!BdWmu2;fg+5(h2GTLvx!HqVhs
zV*(YZ)qg<=YEl{#Xy!*x2IQ*4f@w_Pq4ZOr-h{~2G$zQFV^Dx|{!e29ZP;e066I%L
zh~r6P0__Q6s1oC6V6c(hm&OE|BxI-(=VxHpTAs!PnI;7Fp9(dmOSZ7cr6kCtF)4B|
zFw}rfd{W{}V*(Fug98lYC-CStxZ4H_4bbv)P{YfRfuVYxLK+ij9J^*VKLZ0uBV_Ik
z<Y16S@Z=j<V`SCz*)1$mpn8u9G}oqH$HS1U!LP)~z)<rHw5ex1zY1uP2e_VJQqQk0
z3_3UoRJH3o;@1MpfEr0BUi0gMWkBsB<$itxFh>D2H>`ew-;kMsp=LI0R^`9}B?g8Q
zbNN9>AEswPM6EtBPu!!#z%Z?ke=4{ZfCztJp11?FSWlCGnlb}JtsPu+10MrJm2xHn
zL-*|Id95rK&QtXy_?L<@Fw~x5VqoZaz`qO>-Qaq5WgI{Fq<-*7+-X(*6(AY#NZj`M
z{42rJL?G`3v`>H8%HpjxRgZr)GXp~%8`LhQ1E5JG?j!un2SE-)%<Zh09@oYqrv0;!
zf#E<LKWiJxLg)QIwlOj=ICJx}odD^o5@uisR+&D(jYXnfRX_}6ehFwly|bWzFwCC)
zA3!4hf`ah*?fox=85orRDx`x}Ak<4TF)+;dnhsu22wra7za|~Lpb)&=_|Uv`@Pb0{
zP=Mmsbntq@WuPXj@B4JfdO|Vq2?F)$paq3;oD!hciRJE|bkGUx^(#Rq;rFJ;f*cEu
z>b9ThabOOpN#_-o9uMY#0xF|99lWX#+!%G#P6w|l1Y2u)BOSb|@RSJHrgYFk!upk<
z6ydcl9kh0k;Zy@?ZaU^pI=C-!3baEc=TthlFL9~^mW}Ioih-J(;L`*0mo%h<&L?dE
zoxwljYkDro8DQUQK2FaAb3ktDUz45>=77@Ts`PYlM+1D2^Pzd^;Eo1(q_Z?3y$HPA
z`jm=Da!L|II;f+eCj%PkjDI@ar-Q|qaq;wq4i*WfcHQZ-I#^^iCQ77(wt6=l0v$~i
znqDWzz|a70OWJU!*UK|7G#m$6@6bB^eg}(8{a254&}|oupwTA#E$J;tD;CpRLEWqa
zpaIgoi_<}uU@%lcHk+h_7Z_H7POS0_PVbOsU}#iu0F7if^nyCAogjbRGF!mMz|h30
z!@yuO1=J?=PXM(E1*d}Age}&fHsKZ%mU<lqhSqjaqtNvrs8P7&D5z2Bdw@fSf#K)@
zkmlvVTsjO4l^xtV3=C?<JUR>vyK;GT7#Os!@aZrx#2WGIFfb&v2<R{{^m_>EFfjOb
z3+XU07|#&aVPKfPNJNK$VX>5`4g<pmGcg?o1~wsa9R>zde+eB121PMRoq7fam6cLD
z3=Cdhr9qmNWkE{!%j+;O@YpEmFfc4_P}E^y5L>IH!@!^;udKtsAiY8bH2YE~$*5ok
zYUwwD#y9Ka%<f7tFf?T`1f-UgFqqwwVqmc0Vgz0EF>RCCeJRj6tBeBP3=AGK%pO2^
zA_2+8454NZAv_6h1_mBcvqzvq-E|pdKncr+i-Do33Y@UOn{B35Fqu8&U|?uk1YX5&
z_6*!W0QC}bTFjn<IgFqj(yu%HY!{29|1`6AV6#DKB`n13J(vR;cWK^b_5sWRMXl8&
zvyUJSc<g&kkJ%@XH^5`xlM>86gE^q#Znl-vO}kmFHAT41{z@}2G*1JK_v)LQ{R44k
zgL;l~9%lc+9MGaLpY79UcC#2cfR_GjoW$s1#>mXT(83R@L<GzjSwO~ef|fV3e==hP
z&1@Spg4Y5i)tND}gIsfp5wsR^j`DQw9u_H9KL&;gU#DyJu*fsoPWS3zQDQtbJ-3I&
zo2i;(`mP=pY5xo}#_8bgVxX;K&oich*{%!>mCc!w;-F<*`V0&$M_d^gcy44$fo8Bb
zx-u{bm}W|YLid&{14G=KOwiJ>mWRR&45^*dReD(rrMfafQ=2V6L5D!Rm&h~|U|?tk
zjgzPLPtWgVk+1)dX~WFG&}t4^HpC!dEXBdV&<ZNbvnLr#g9>bLp|o+1F?g~VJS-ZJ
zWelDy1`mrK`ELxKECv@!D}EY-CyT*_(sD&(@Q~Rl5m0nGwn-R+rh(f)qiJi_7=!n`
z{%2s42XzCC!3$Zy#p&5)#^7PHQ{bi6?T@DG^sz`VwFpjk>toSm{5-v&k3~YWMbH>B
zvkEFB549SDXI8=E#gY8RHXv75frio|mrdW;$0EbHcKW$K7K!>6L1V}+1CTC(4aTk@
zh5y0hC6@I9#-Ken?Y!X5qA}zQYfz$W5i|yEuV4WCoTJUy7omy0g2NbeT}L};dbUN-
z7%~$B(zGMX7(5dL*2MbS7&H^pK0URcMO=81aikmrLwh`^oN4D}V_=Zdp5EWjB41w>
zs9?+pn#OJa#?QduDq_qCaV)6iaAKh`BiOazmc!z&#*CmHSPZ8?BgH9SjTymPBu;@=
zHj7O&X7m6#5!@&;S!K)!IjUO(yr$Zi5wxupR0SC_FgPnn7&C&#)H)*h85o#cMW*Xd
zV3Dq0X3PklUjiGaaMPF(;w?}c3uGL`U!XRYZH+NwC>H}mN2CNOpEEvWVCcwzw*yU%
zY%pd79e>rammjnc%$P9}vJ#A+fq^&Bm@!J6fuUnBXmOwRA7jR7a2X9+L0R9t%$N}}
zy98Q6S(;$X7z3JrKD7oMV&4oI7zAu&j2RzuFfeqgg4cx@Gd=<P7!*>Ie;YGC1@k~n
zRgi<9fq9^iT4-d<_#DLh&*PAjn#W+w_yWW`1@cVgMq@_s8Mk7mzytS=Yh;WWLFdwT
zI`K0wROU{Po5&(pFP;?#%66Tu3=Ao=vf?Ef7#KiVuxWEv0w{livf#GwS&1?X42=As
zJq^|ZS)fX+^9bm2n2xM^F$RXtEKmaBoRHN3=75qSr(ISfm;<WOBCE2Rz#JaX%B1PK
zSuHvY44qBF3=E+XDFRubDyvIKB(F4=A*&Ot4rE-5U{)8H12wK2%mEoEbU3RA%mEvx
znVZ#T%)roj;U=R%)?#J`hAzio28M}JSxc1}7&?yxGcc?^H9dY3i)dO-)_EzIW9K<$
zT>x?7SQz5ivM#YQFm!>AQc!Qtx+2NI&<Q>-yKPt2RWJvXy{oTgT?2DK153jES=YfF
z(4rHWV_7%A9FRk;r%k^#iAAygb43>D)|ehpHY!cXnhbU?$Xg2}vZjGKAl2N9v!;VN
zAaCWXXUzh0KnoF$GiS{Ob3knnW8SO<U=FAS#<MhQA($f}Qp%9E9OQC2(0G{3zpPbY
zaZo+NwDQ69n#n8@^#w9n>%pR+sZiB}S)0Hd&{Sy4zO1ca4rnSgX=T<9Fb6ahnsF;@
zH<;rAnnf1M+5_f*rb79|v-W~GaiFPC&*NG9z#P!MZ>m$W_JcW~dC@TQtOH<9SUu?S
zHP@^|AYK`0mekKB>oACu1==vbdPdd}Fb6bwS(=u06wCotUtVQd$3#K#0Gfx)Sd(=M
z%*jmvMH6@y^5A=ctS=l43_YM$AIrC_?_jN<01iKv^#jZS1#taw=B(df9tXG;ne`9M
z0dHUrxV9i0bh=Xy=+x9R?AZd4ybQXh@K3fNIP=Z`bvaZwXWM`ltHPF}GEZD$$-tnV
zn{6WpYCAw%+{_af2s1FWEf>fEbrgF+tD3SW<<vtvilD3CrsjZW_rc|7*XkU|sz6Z0
zFaDbYSrrH>-xY4=fcl1z{ez46b3lDV2JoS%izISD&V_6Pj;zW7^$g`C!S|=d&eF*N
zZ6EJr1;yB;9PmO=P$gH-(6u@TvJw;&9P57OK+d)Sjo&KV%z>-~1+70^?wcb8KR{6Y
zMUFHV14ADxDDg?N=0K`RP$JtUlOqc%U%-o?WE^wA)g<`V7=z0>kZKaN?upeT2V6}q
zs|U4kR(#6=bvqfVKx>#Ht8yT_?X_VAY#(UnG=l**s79TjCXxf1De41lJUqKB2Q*Ox
z*`(@an**6B0%gW|N;!~;B2Z?W;*|rLC<0~1ZqppZ-sWX5opKPHn<J}oKsz1fIKi>s
z^Nb@0G>O><8h<{!EC;gs36y~JqjDg#Mj)HKc22)AjYYOTha(3xEz}R1vpTyh2Qn)J
zQtf4%1DO>9sh+2l16lS2a#v|W4rJLA$X%=ZbHEFWAg5M}hH~V9s>OcL;WB5J<v<oU
zfsD)ElLJ}Y1Ts#~E(csEE@J{s^=H4%fvj!<#iZ4f9MB1@kY%MpZ8@N09w1X&mMd~V
zwLU`?c#df&8?!4L2LnSt=<X~g7FTv~V-#f5UR77{X{yV>Ez_o!>F1`is7W7n<r8CI
z=>G)rK&GH8B*B3Oq9d!O^Uq-MtbdThz#x(<lp)E+z@U6f=&(8iL;3>H5dm64M?kYZ
zRUr%vB6UJXS)uuYY5yINNSDwtgvgDZj0_B-Q9_I=P({oWXJj%k%*tV8$OUbXm<($D
zx{BmNj(!C>_Qb+muwzfvgFGLwC>N5iK)EMme=a0nfr`!T61m`oGT_FV!>(NLLK*NJ
zcG{F&@Io2z!87UCb0MQFpfv4rCKr5^8@N-KAeIX`cpQ|B7uDs0k6Hm=P>@-hD*|59
zaSBwx%IM`nG8xFJ6Bp%z^B8!A+{x@*@M>%DhT0SVbHVEt!8Z@|Zq9|YK0zgJ*tc9r
zwgQ#7Ia0acY;_7$;^y+?g0mHP@rjU4E;uKh0+qPApL6TM%M-yz>E;RLLXMaPm8*FV
zb0MQSpj9PS?YW@g8-`P$LRQr;7u+sA1uA3}GjhSr(o>*9w!ktM(kulPvO9j{LPm8!
z9fpD@xsX8}(9Ht{-*dq$s!xILw5u=tnF~4a2z064!X>$&g8@K2aR!E2ak-GJ2P%?_
zCgehL9_Sp);sd#$oX2nqbPYkp$z1Rv>r<e$r~6BCA*ULFP7c>Tn`;ItTuy<mAt;@h
z3pxFG4rsxOPA+5#;sQ{GqI579(ozOp0k?5wF1V$9Y6a+YXzyHbOZgP2NDq+8wF4Um
zI<~-LZZ3G0ANZ!YeB)e5W&~|r%@D{1ofW`v3bX?|`C=~UZkfpjpqt_jmgYhlsGt?7
z4i|Dkd2xEsY!-3DSvk4x%nS?@x{@98Kr8Skg9a4Nu;+;hF)&Q71tnOqX?fzHy(i#Q
z;Ke+B)@&BF`d4|NohuLpXPEPp!Ky(Ov&pJF@V=E(pulet%u@yJ=cp=SNOs8sh3^zl
z#c+l_&j73eWW33$JVUtgYu4l$fjOXRy=!%zF_`1PkX(}o3V<n~Dw+RPp1l!V`x)ju
z2QUX@x%R3&N3af%<tEGWoWLAV%(n<mFPy_7raC`QlAD2HvQIDrgV^mn(CLbkdxIGm
zWb^V&K;ox^85ox9PhT^KMZNw6cS9a%@%xn1;PZI%z-!n}f!0<}31MM?><!QJW@BKO
z0-7^#c?%kNI9(1Jc;G1k4Lr2ofvXB)V_=vH8e8yJ1gQ%C%)}7Fz+hx9tN<%Xm?usE
zi8u=@!9?nrCw72@{DoCuLQMOwSTZnlxeBX+7JDE@+*&Ld7)~x12JbXMh&JRiFidI?
z4p(4cm<qa+%do+afkDN1fiNRzH|W&u;C8<-V+o|Kz|X+oa8j7D6qL-~fZF}_6DA5X
zmVyHC%^c9UzO<BtFeB(<i>V(#!`t1$jNpqc{)3wJU8{u|?|^jv2Q}o+E)!<F3*tep
zJm}xTCJgQmOfv^<dRi?E=?{R%lT|c?89}2B3{{}9b^|wIM#y*rGiW#GMh{^~hhQ1_
zB8P>49fX-c2P{kjjZ3!(3N!hFmYIMDeH~5;Gx>pd;0dP4Dq$w@$wtdS6HMFZ3o`|9
zfl@OE1L(Rcvv>|U33djCX-k6{7^Ji0KrIK3B+$7R|K&gj&&Y9t_Ccovw#tF$-eCdC
zwEqHV*h#q*v>;MMg^ht>+EdUT|8<~Yr~DhBc+LF<iv9dPW>9-Tw48xq+E-B5-+&3U
z2jh&vbcOjW5_Ts-7#KuniWngx^*{~-gXmHbV^$EoQN)DRl7S&ZQ^XV$$^W6%3e$ej
zsVyE7)63?wsMfa#ihzp^@ENIM(?r0<26$L+=Pwa(vGE2p)OL26h^-U@!?fL?8erL6
z5j*f|e+^LUMDK-w2xz_XbkNd?KwA+|QNaKnKP<EqaRI4I2lu=^nJh#=RrL%eks<~W
z4{-*D8B7eIrkUfk>GBI$v>ZE1Kzm6T7-m=)gU(?v2J@5{7>de83i%iqX86H902-Q}
z0SY(IHj&Ms!Miss3=DGXr*|!2(W^HTVGK}aV3^SfQ@$^Og@J*yMTD^ergVy>2vaKf
zu!&uaiVO@hK^J!h%a|((fY_jtWcL?y@CLe5ph7Njg1HJP@t*qQ&A^bi%p6n>&0NOF
z5RjT!!C<ZimSVgRkeUqQiGhxeJjHk=AT<TVl?FA28E*unCV_YgVBVd8)ZzjLb2U{k
z??FIn5{Rb-<~<2WEzV>xR|8$jev0u$KxztzX9AXc6Oft-QfUe1eeh;r5dUYcW(Ved
z@n&E+6>6?7z%YH=LKee%8FMWG28LPhK%PmQV6F{zB*^`{znJTQIpDFryaVRCAa(y3
zS-cq-R2t3oKyv>X3j&HjR)LO8W%$on5m01k%3!VsYT5s1YzQbaG+{8;QwCi*$Jh~2
zWN6G_uBQR!O$aD5G-5E<tJei{X9N@(8Zwyc8G(5V0*VX`7|iv|!Mqg#MV1WadNyFr
zhJYdq26H_JFlR?V5y;p25T_gnC<29uJ}CMBXFL&51PU#EP`LhQybw?X3Q2uXxc+Cn
z5l{pQWqnl!21SPdj1K~eKvAF%3fTXQF9M1{@uLq4*#C?l0;aPqW(lkJW@0c0E&ZD9
zp1{BWI{NlDBLf5XJqAVw26NC_s@c0hXGiQYHx*-Gm~8|a9i4O5+ziZN0`dBK%^~$M
z3y8<gU=CVLHG3BeC^Tnxn}e(8{|z9yExzWU<y5mzH*f?b7nCxXTZ=I;OuxODMW_D6
zOK`f}&B(w|Zv9dTl<e~v80LiJi-NN4sT>A|D5ZQc&@jW^uL}8~uF4$Hx$fDM@+G+#
z80Hj$;<#&dK4?6T0eqOK!p(fh?hnu@N8Z)>kOmQ`+agtv4`~pA`pmAn`JiSG2V^bf
zzTeaPmaxb&9-Y2s35z7-uIa~?u*flHO@F$CrKi47pb*qEo0|{b>Q~4EKc-vzPa!Y3
zQwYxDLQgpgL5<_Npw*W1Qwt$$&q3}J`cf#Uz`!tfI(Q~=t~&$6+~v)nGf}`-$nTI)
zC<OJ?=7LUl7Q0;tZbX8M5R+Af;+zcAKP+Vttye7sm9G#lE}L5@1u9w$1V9C1b4;NO
zc)O7>1B2LOfg;fD1M^%!_dVMcf%{ee8Nhq$ij+YOeeh^zX+jZb5e5VJ2na*dBG8B>
z!!qzX6)Q`YBGAO%JkaSwr3ppg6?@AVrnf9(5s<HwD*|=D=2b$L?<`|rnAZUr3Ikmv
zdvp5cWh`nMxhzGXUer9$wYjAUMc|IpG6s>%lnRC-Pzr&p$*Pl^&bXXKmT|^(`Q<DU
zmMi#*K&9$@Gf?~8%D%{6f`MVaH7M4Uw2B<W85rg}NPtGh<}vXxFwAoS5$jzU7}CS0
z7c6IyNqVVeQ3UGZ%)bP>t+=Sj8+1yWD=6s+%qa2^WMG*0MT5hefkA3Q5$ODThGiNW
z-V6+Z3yMJ7bQzXuXn8X*bc+^&h6(3i($Mi{U{JCs0$*7CMhnCXy*B;bau(V8Y<7Vn
z&;`W{Kr4JW?TW%UL3`jpaon}KC>+#8y9G`QdzOn7^9wLAEC8J?k)mD<P79#kH$%bI
zVo28l)NAS8RSfA`fP8&2yBOTH07putXfb%U7QBH`$fg+7q-0pe1_}_<+tVkkV3DlX
zDF$^aTsDY+M$q;wF9z*+UBD&Gz%W5ipcu65av>-OSpO;pM<I9z!JH$-psq9ncn5(+
zVKFE&A?F`W?Jb7%rI|&N5{np$A$@6(8(oeRgZk2tO9f0;6+;^I9H4o&uGPhm7CpH8
zJX=bn7*uR5G#5!uEMO=$l?Gh}4hoxPcEylZJb1ACXsAdrXr<-Cc!)YHxVpkE#h@NF
zM-W(D;&zK-I{^lUMW9}a!>(dT`y6E6c8Ov~#4(f!V#SctIzWNwa;6wu1%t=w8(E9N
zgUjHJpEjF|!A*DYhSeQEiXnT1Kt+MWg<??E3|V6;qgM<XJZ1o2Vp=_^7(7G{-h12X
zQ4Ag;2j2(M%~4+r9wP_u5)Hjp4Bp`Y-W9fRNik%D1E}dRE3O#4!Qm9B>A*j;7`(v&
z+<D}<T?`q32K5~+b&4V5&!E1e;niZu@UsahW)rs;hcYuTEQ}XsV32vnSPV*Ki@HTJ
zr!QT_B4GWjIFgxxVNpQ}M{yD>1H+=D!3+!&Y>Sh@yB>oX7~<9xr-0TOoC;=O*xFT`
z3TA^EE}fdwKdfSL)7)2_4JsC@z=KA~1rf!d^^}W29Wlcr#reV@BSAqf<TO2gHH&0`
zPI0~lNDSo8rOL(m1|SZo^SaEg7`#mY+$){ISX>A;71YnLW-A6=@5oRU3bI#|ae^VJ
zd|rGQeCo>d6RTOY_@-wVfy9=8dMox@rmbO-;CB!)k^`5mp#I4A`P0?cu&6LDp6;`T
zMZSJ*f*7d4Tmssx#Is*ajEjL`$!m}+PpuOZ2XjD4L7_toG#9%Re7vKjni#0VvXloj
zTfF^|n3NC$!%}fj4C(F{ljde%SjwXTy1v&>Oa{c!2KjIM4KY~|hX>?@nqOid_bhdB
z03DW=bzV#!Bozzlolhth109vPln2xym#m)7v6f{C<JakH*Rse9=lhE3fUKGaYme2H
zOuxUDMY8^Y80fa<r6=Ly8K7ISGQ~g#7fFdhMVTjpw%$%I5Ca`xq;?A~nxe$OuwG3J
ze0ULJ3^GB9fq`wEm>nNz$17ZI1RDdxju0`(aYjlE4D+6eIq)&?G6)`kD+!q1vW`Vf
zc7ZAbgMEM)6XeuAs4Uao8Nv(<N}r}5U&o^2)T>znuAaczOYcVsWQ;>VBsrO(1XLO^
zfCpCCPL)80I6#5TCsYFJ4KRRDmG|2`U3Wc;bL90BNXrovX<N3JsDoNN;89SvQzaT8
z4tSDGr>sO1%mEd9+0`ZBh8(zgeqcihxFPpnfg#1AM46R=Vflt&28P)p(@(BvQDEA|
zG5z&=(5l`NGmw68!OM24#2m~46>3{~ODsSf@ZL}Fx6}1Eut?V5F0lrS@iC+blo+!z
zFsyI~n^|JQ3tD0r&%m(!3MdJ4J{2edZ3tTtoxs4bLWcn)wk%hm1k?{$(JYdZl*3R0
zI*k^RCX>8Nz$MZ$aK&KVr%(bac~%?)9lw2~#9f?$VMR29NOEE7^y3>?c=gYfKua7?
z28QMZCH|l*!*4NO0M&gfKqnndxusD8nvGj22{vFl^F|g`wR0ulEll7cSgX>KSWu^N
z8Tjnd<p=l}7*;e3GcYXOHQjF`i(0)`33#s&csR`9VM&?@1H+2bpokJvD@g}&nnBt5
zs80!aM-h0uNas#THb~|)Xo%==SV<0u(>wv>rsbds)$XS+N<haYud)W`=@P`jVq*VG
z3dI>1R#}7c6SrbXF=r~M#SY3)%CaTkPV#?{b+RQTkYkiV`Dyuy638*ip!tQP?@A!Y
zD1$Orr$I>#Hv{yls09rr;MJL6CuTR4G=Pf>kP}z&PLJ5c5+PXUAqcucnt@@}98d$=
zAa?q}O)R3pnG=*480^hdg}{Q)bk01{1GGHmld3PgL%DZ~HUoo?Zy9)X3+TS+$VX+M
zwJi)__Q5j9Sy|c)42K)1Yi?$duD@LdS~<U(OPhfqv9b)bA|8DG`{s%=(1LgfyQvJk
z9v*Zp{4~Kb&}w+Fcw<Ld3dsE+@xWhY;KeMU+c6sdl!2GByb)$#;Bew82esi=KL+g#
z`&bTc!h!4cTF-J-@IWMZ!TdC?a`5mTc)#`rzH-Rs4AA)ggvN4E+YYkF!QfRnsFeUY
zN+C$B96Z*yj0?2Xd^Ko25sN-+IcO8)8d>n2WaXeF4;gsp6EBCHkN_Hywks+J58f?f
z1|Lklkz1ew)Tvklx*pWku>vww3Cib*Gb%u1{&JF_3@FoH0dAXuk4|)LuK@WA;u6<}
z3W&!*BV47?72sh@@V4xvy%nHMC;SeeVcm)R6%c=cMxv9RS7>lBC^Ilr@q-RPOxsZ&
zrpUmsMiw+g@J(DB7Ng7)9i~6o!eUkrI&V&Ep|~C&1H+of4zLs;2)Y-?@s_v&D9`<b
zi-PXO;Sm%!1WowB2Ql_exX;KGA#TLTz_2zZn1R9Pg1E5+14G2IU<L+%L2(la28Kv$
z(D21t3kHU@IpCDW4?gEk`-^zJDKkhL2h<9t*Be3@7{mm`ec?yny<U^gz`)5a?$5@+
z!1yqqfkBQ%++PgJ);ld80243zCLSOH61QYv&^sy~pa5cXLeE=%y*i(P!N^cN5Ud(>
zkx!90Xb7#I@gZEvDoX|ivpeEJ5-1v1<})y4$BGBTG)4=Fhbl8La4&@Ed(~>mz!1$R
z9wx)Uu=)jDv>}IqL5xW}Tr{77VcrJu2tEb|)|Pw*hWJQv(Cj;dK|TY6182Q>6euta
zLKqkXRK%m<S2W#fuw-DEuv5Gf)b)c0^{om^1_mZA@qSd%5=#b#H5bJvvN15|bio|3
z7i5CGiTET`(Si^L2F9!6lc8(w>OU~uDzIc=sQxBC73>hW_6(51x8l?I;Ub`Wq!@pS
zPe+JEgfK8Lgo)3Di`)X;K-K(3d=4nxz$$5`TPc<d3?W(Kb5TVTEEyQ;3onb$2hFe}
z6vtRHFi3=pFF+LqS!EP0z6fDefF%Qi?i}&OD2DD0068g1d?`X5s4!#56JLf9anNR9
z&~FuA$;-gN$@madvh5LHHC=WGi&VXd_-bAThV_3y=Y`G^U&9MZ3fc?|+Z@E#g4s$8
z3{ghncfpAm9xxtC3=9*mh~GmIy=4J959GS|15{B1HU@?c6Y-~@11fJ>GB8XG6Mut<
z&H4`?m~Lr+(%~oZw`>dy8&<<CxupQ|=Nn4~hPH{~9}zk}d|=uO%B+Up#J{6zkWgh{
z(0?k<=p_L<+yicofGPt+UYj_hH>xm)Dg%T3fqHR9A5?MBicE)oaYjFR1_uADFjMv_
zEMbfgX9R7#-FU$vqacw%oDp>C3<K!YC5Gwe#2K^17#KEQ0FB*ll@n*oRt4RY3tCaK
zQ&OBUN0xzM<1NtQTcJL2M)1ztH=yl`OVX{y89{q*H{J(r`#UWl&IoFDGZ<JnfX-GG
zX9Qg<Drg5fA8cQkIAbAbNvr|rd@xNZamJ$Q?{~83)fY1}Fl@8{E#Eq^n<qmYbQ<9%
z(BST57IDUE0Z;}3jV?RQ6KAZEW?%@q402P!YjH-<m9-3SKqrW;za-8G(!ua11$6u0
zQgOz5P|kP*I!`SAvp8b|C}A3a&J$avFV5H~!N9PouELLjLDWc`v1$68T`W5FlPd+)
z85qK6z=MlJiGjgzU8NXGAntjg#K2&>uoASeE6f+BcFzpZ+T53wx+o^>X;5Nd2)b8k
zglYn)og1!QX(j<Wpbc(9y?_z}gL!JDCyEife}KkNqbpHka`z1-28J@hN>HhXaK!Eo
zB?gAsyDL*sO(;-eVBqbo%tCR*?f@kQ294y(Jh&t3|9|+vv>P<!ZE9KBh+@Ppke~Af
zE89?v*mXjQfuSV2vI}km$b?-LN(>C^c2>?sH38&j4e827s3tflF)%1Cs$2##p&lNX
zJ3lBfFvx0D?nE(SC&<qmR#xsqF=8iZ`SUiZ%0nO{5GH^+BQ~OyS5Zv>`I(oe@)oKI
z21*PJ6%#9M?x7g5<AD+bL!V^jM-(G=fc)G!r}7($5j$2)+sh(Szav7Gfx+0al93lx
zkAo@$LugkeqY$bl1yu%ysFjtBVkq`*zo5#%z-w5^sEK08cF@%Ww%(PDdMJi$pP|aY
z;CQ%_(MW=!o&k{*wtJ{DFcidAGP<IgVxY>vu=Y?TqZg_vpyFlIwMs@m6sK%Epvu4?
zeYlb_5yg;gD^wX6X7E%prlA<Jt-eE*fnm0PC1Vz<DHf^>3^q?I8Ea8Z0eOGdgi6LH
zR8v4jS50jtV;hPgTQ{gOFdUv$$v6|mkgXu^8|79q&XZ?gs7I7^TPsu<7%ZeK85g0N
zqM^#bz&@*zaVx4RAn!Z9s$|@S;*>2PR2dlDL@OEhp%}6S)Xns}TgiA4#gHu>^{NaE
zU2iHGuc4Zfp~}F}UtP&~3)K`*LBDEYCF5HZQ*ORcWnhr<sbu_wV#wwnstgRW=PMb%
zp%}7xg%Sh9gs>_`83u-pe_^LrF)asWE0<f<YA8l8*HB_$&|h1vjbie0P$AdOQmv0-
z@G?-YS~9KL8O4NU3qa>+ZLjt~F<}{~kdv5J?Ng6x1SnhiEUZpIH9|s(fg$^9bt;Mx
zOF@NPAzL-*xF<v!UJCME0b4a{x>*Y9{H&c&jhbwh7AP^)Gi+K|jhbwhf)2prTvR;^
z#Su$Eex9+WdOnIHmVgSmd0N$rQM|DPRIrDZRBuNyVF}336ML%nAe&Inv;<VjO$)3(
zfNBJ&V6XUJeGA2i#UMXB`&QpaHiBs}sF2$jQvDdkgvFqOUFak<o?$h{bcI3&hC|xo
zjG*;)JM%c}p{?fW5`3WKpvu57Wsf-HOmPN=o$&VMbkHej8{exkFf>0FXW9#%x`3H?
z^MN1(!^Zav3_G_$T0fwyn0-W?X`dzo!%p~3o!1IhF@h>C28Nx`wi8HQt-p9Z(|(Y`
zvoP~6gAOkbpTWSe3v^y6g8?T<-BwX?rUM{lUt!8FC4kKHzskU{OBZ49P62VIgPIHs
zyWkg_UQ_@LZges*><Uc;ZGT|=4>C{YmpChEf#oh2xc|?CN|rJQaaPcZ%3Urnd(MLN
zi`FnO>;kP^WH4X{brg3s7cwv`ixp>`BLb3ushtKYgqO>Tb9_b#p|dg|C!Atn*mVu;
z(s+;y)-Dt0_`<`$u&e$UO#A6MstgRN%f-3xOENG7z?-nsKqbe-?c&@|P=!H<%{B9h
zbH79t22~r@X5!rMP=!H-)!a|w+@Dc|r#?`s2i<O^E`;LZ)1c%Vvs_(7j)6h^6U=>6
zuP8Av*#1{nP+(vXdkGUg4N7H&73#_|3=HC~Fwv<X6BZs;S65<Skc5rvF--;K!tOS8
zZ8-)8$qb0v`VUM~K}H-XRo9niV33>u5&pn*x<-kC!RxxZksJeqJaj+P2d1f@JXE<z
z-3%nk2va*1)LL;-QMZ<7V31!26Fm(YMx6Oi-3}yr4JJAjRLh_AQg@PPU{J7y$Ny<i
zF63LJ?yA7Rpa2_PWI7GHK9}(Y1H+y^aNPX|MgN|<)r<@b%{SF$LE=zz8MiwKGBAie
zVPMz;*=Pe!DSK9el-3$+ii5=AN)<q&r}7Qt7#Qm1;De#M3)V0)Fht*Av}a&Ih$=LI
zM0x*%7SqE;8Gj^zL}%S&*@&c;aR<l^du<pP_S%4*3qHC@?xZRM!=!Rao&#bG410B;
zj$oP!8YYrnAj`n8Hv_6zpMha7s5R11DamtO6(lkJ_)!)`NtGHoK?a6s*?b0uw6vN~
zP>*C;J_Exlo#~9nSfuMy9V$ReJ@<i@dO9apfR1s3jF@amt^h58flRy@ys7}rCqgD(
z?6fL)z{7Q*C4s!|6`+-#96_L!0lBj(AS*pV10jZ|D?oFL`}{x?Ppr2qKr21f>p-W=
z&0Ado+5)&Q&YYnhl)b7L81}`1y#ZdY4%%bCFAvNI4?w1IMpS?X&-a~TVqlmrTOkHM
zaSt>;6EUem9LxcYwk|NLkN|T)L*!1p6`*T{7!QI*@w}c@NP%TQ<93l%6`+B8j-&w4
zAZY!hFFqBZ38wv9nHU(-c2wwq6@m;u?N9-lU)sMFWcX&c3efzLoFr(=#_HM%(EJkQ
z%(>i?6`=jw3{{{r=PE=iz|%|1Ku69oSyVs<pg;#bS=UuSPOvj$Vqn;Mr2;hV#871p
zS_zh?UjdqZWT*m-G0tYKfGpw!ZGM`{T>+kptg>QaV3;RX0h){CcK{7p?p;*@nvi0s
zvSngmn8;rNnyY500v%c>XjTE5kz%L<ohxr?RRLP$sov)R8rT5^?0(SlWCjCSkmpw}
z*HEhkZ5TZO8mT;#Sj#5Pz;GY{<oWsLwUBj-plJzR@9B0YSoEAv*Mg%u33Qf8#?M;t
zN<{Gdk+XCyXge?icr<s@#ai&PM963^cwBD&WtLjdDToIqPhWq6Mans%7F1y|R55{<
zGuKLpfG!>eA0?LM$x;i7o&#4!k`s#<YGuH4G9VX~o7KvIrh>o|f#pWic}}uO)z9&$
zyUfABa1b<Ab=sj0w9QvN52SjtTisO-1_rI!GE58%eByQ2zzG&~&Y`hx-F0vrgC<Xm
zjq7fJITj3C85tPXEU07Q1Kr9E3aNwk;7W)6Kf_)|28PvYpleJIg4bJAF)$pA0ZC3@
zdXj}-&KsJB4_1Q24EX;uOb2PO1I_y$%$R=ZB#TS^Jhw(h(8TSb8h!?b4cd+1?HvqN
zpgykh;YLQt-Q}R8JX7yBGJ<Du!ONm1{%vFg4V^PoG4nGpY?p6j1nqldr~+-F;B{|g
z4B=p4;0OX8nloWqBO_><m!S%DypQ4OM#eA>28MlppgqH^x9b}jLHF~h*MT<Z&s*IH
z-v6;L4zwyOnx&Bue6-jyP=9@ucq1d|TosNWC-7;=6@1Jrjg0dd7!HAsI#$SO1aGj1
zIDF0QM#hEU_yIZmU`-?AA~281Atf=Hp^*`Ex6Gl-%zg|EYw9;OGD2>bVFs^|0)_9P
zC*a^>`VUK*hrWRG{C);D1_q!1O=8>(42PbuF);XYG=Xl}hOh;jK$j{(*iudYAT^iS
z7#Ip_o2GJu!h(%~Ax*An8aK%AYzz!>;!U%;85ru->)03=`d>HA2T8<%G_*D?glkZ1
zS_BgJ1Bv%GEr*NiHLZY&$LTe#<pv$$0W#-v(?*au*qqr-o8jtRo3?<&LFU9cH|>P0
z|6Sj-7bF4FkmlR8AH)VJ%3Ie2T5b$>+yv&P6CiPrn!=Y&r(lMr&uBUg5(lY|*J`=|
zGjy&-(-n|7SpCPQYjE`ony!PyLF&_2G~EHSL1*~I8#O(IX)bAKdJ1D_Ff_dcD`I0{
zh|g$x2NN$+X!-;*G=rn*Gh9to(+`*$zRgX4K;j@r6#Q%Y2V(mfGB7Z{_h@1St=K;5
z&CkH#v`?mq5nP;rSN>(BHZgLDF)*wKC-H+d({;|WNY(c`G%-S|70`eauX__CXxX!n
z5@^6FcUBW4q+$UbC1rTJi4j!72q_uxGcd5;Zej$jRS;4FolZY*brU0Kv4W5ixWqfM
zfq~&@G&ouDgO2QVwQXV)k!4^w>dnHyP|VoGn5e?QurE)LfuVlyX$FR)tze}xAf+dC
zn;4TpO2G>umoYFLT?Ce71SQX-ip`*j+M}RB+aiW$Ngf6Uz7K2+44Yh=L8mSAeE<~+
zAU%*)BM(TAw|28E4+F!|V=%c-VDkh)axxY5&B`FjM^MRQpatv<2I3&em@~~<Ah~~R
z3=H~nn?Z+w9DM{z=b_D@sn??*al_VT&`mC2@%~%QUNH3`)0#nduYkq3{A~u!|A5t(
zY;6W@QU;5!ThW}!Q_sKvmMF_=25k-oOKeDJ1}(t@iw8G1gU$>Bi`yS>1|9MP7B5b2
z?gv>0a*)E7X3&{DVDVDcX3&W{VD%~q&7i||z~a67&7gB}z~Yh3&09cvK^~}A_iEk)
z;(!dQN^L$2VuK{iY@0!6FM~BqKGzI7HTmd2VFrdREe6fEIT#p@cQb)fSTlGL>M~H-
zpSY~~4rnA0JhPOM+6)>6UJbr}$R@P;KDZ(f5GhVAWN3cC1=0_iNjzPDr1>G32WmYC
zb2UE#bHLXmGAt8hU^uSCz;GP2e~H0>9~3DyyPKcNGB6yUz{0>#;nB><3*smVGcasb
z=WAgBx$7a=T`jC&3qkJ6NNr(*BzsVacYG%U!|}I}>#tmGTIx9!85oX(2Dx|aZs7ut
zI)nBjJZO~xx9-^(7@YRBL0bB33=Gy8ZNieE9K^=J&@!P-1je3k+6Fqlf#H-e14Gsx
zjke_+3=AiQz&j_~z?=NR^U5uPZ7V^p0#9Fu)U<)lE~#e#&tLZ*X#<^|3OS6+ZcQ8L
z=v2rIIj>S1`0jJ?)`J~pZR^2hJ*awhaBbTF=EyQJFti<O+X&`>PRP>w*tQAG0i7!-
zEZqh=wVwfei~Zutwk=>8MJ5IY>qTu_K{L?|RiFyG)T|A3A38%7sHs@$(FQvEgrQ1>
zVFn`u!{X`9jQ@E{85n|OYxW2}U}Rv(loaQg#LK{N(r0@8MHadGHb!ywZGsOO85mkt
zi?0JoB$sorGB7Z9&IFyVy)_rKZ2M%BF$2RA8_=@V0}Q1M4E=@Xogh<FXE}4Qfz(wU
za6ZJwz;JREXi@7aV+ID%a*#T!P0m?h`4x+tUx4I~g5;|}QcjKS4s4|i^$gq|ioaR+
zfo>#7bOKEUoMK=&`4wyvNG-@LhEoh6d9Jh$(1N;U3=F5ZK~hx=j~E#k1cdD@cnugB
zS}(MLyvOi{f#FmQPjXTQL)&w45SxvGq49g$8yN<MQ;lp444igt;FG`q^CT4%Ftkmd
zeTjvuetsJxBP4<u7z_p47{TX&pJHKPm~Y<32t7T7kAa~Tbp7ZFM_mR6Z^<^$a>i57
zIlw0F2JM;r&kHtjH)yeD6$b-D<oveXnxLt04zQuSO`+`h=54zjL2RB(hBols^Yw28
z*cccN9cnwL%)oH!IRj|c{rFA;1_myJwgn(RzhPiF4eDteN^D!825xd1Ffep}Y-@x`
zf*LD_65AS;K$0AwyNlWyK`TK)r`YRpw1G|(V5nkaU|{>z20FKrp-O-!zks1_vNQw3
z{-X@_3<eAg@{VnlFynf7L6@MlRf1*&-tZQurZcovDl#xIfUdRE{?k^e16qCp(j+{y
ztr(_hD+dF^p~SXgb&wl)%Mx=K+KNF7d*6T*#+`4=g(<uQQJ4!>2$HNfpWK!XlLcMM
zawxGaT?=7MI%q{L*ce^MwnV7HGoXc{hZ5To!3sgfuvoT5!z4l3<4|H-v<AYIXix-z
zO=-E&779}s$HBm$eJHUl6s!_tjJ{2qKTLKq#Hs!&AY(Wf80IdSe&z~`MAWP{PneQD
z5G9@nC2gLDpf#=xx(p0CtJ|~~85qvWLjq9?RD*#6F?mIsmIA0O1>Myt-=?JvVzV(Y
z%=$Uq?kbD8&Y?DQbx=|O6=VC_AnRB_BRUKWLYvz_H(MPDU|={4YRx+Bo8EYpMa=3@
zn*ucPSTHcGkZxr(fjaP98dp(j2}3KR87PH=7LxmCw?g+>voJ6eNld?Zl|{0CTPtHC
zNWm$t)I5e(M#%B9EDQ`r`&${o2g)vEVPG(8YlTc}E#t~%Xl2Zo2f2}jfnmpiR>lI*
z-sW4P3=HQ4Sr`}=O>brN26aC`+Paxq8GS&UH(a2Vhpmi0pbpF%29RP<!=l!+Rg$p?
zqyVIP8doc0F^sc;Z+g=;7Pb2Ot&9!4pkregKvAT=tn~-Xd!T(5hZ0*s!@mbW-Gb7D
z)*qnt*dU(<er#oA1Q(kuprfT*8Nu7hV3vS)lP%*)N@HjRx1AV3645NJjNk>E%ecxI
zS{XsTFor6IdIJUqx7V#tpq8Fj2WODhC!l58kPOoLL<OEfTA%2HG6)Yi+`+rHLHRHv
zwe=Oal4P)9V2IXfy#O;T6`VL)FUUX*$VhFypax11JfNt!1d0`tWjvV-t>A-~-hi~5
zrniEML{MpWemz9{KF}U+P}<5!ZQZ8~(mwsxbrv;=Gp*}j7J+t}A4+Up2hK6mC2p|D
zNPKPu@6LI{z;FRHU~wq1bty#F=LU;(BDe>Z*g8!Yl>EV2x^<crC~XUXOV8F>plAa5
zZN7QyY%m)fJ;$<IK@*iA*Ik$n&K|8@U?U*9`anK{=$d}w28%-dlGb{t6EA=cvpSU6
zTCa_;vEBk~BO3$5=F_ds2wOsATgzeEUPEjt2WtbR5aDaBSy0J~pw-fc5?iyt<qbF!
zw`PG0CWw!+!a>XO!3D!C)z$=<F3{e}Ly4`R!Fh1Hn!BVm0jvuY{(O3^;1Z;Yf#G5*
zIGP|`LeK)0GS*f<5e9~fUDNm7WRa}5VPNoyYxM-p=`LenxVW6RC^em-)f2P~ei^8U
z2zcLW%*eoS@ed>#jbYK4yrR_@9F5>2qSaUr6s0`546UZ%TnAe6cc9e_oasQdhts}R
zD`;ETfPo?Wb*q{%C<qzq87_gwUYz!|s)05NyaAb@fn<Uv*aVQDA}_Yef!j_D43|L1
z9UMw*mD2~A0kKK}qR@hYp;4)sDF_-&m*#;>mu4pLa#m2D^UrQ(0?nT@oZ?DKNn=oN
zW&*D=14)%_Yi0sXgEK5+$YNlSiE3tY0~u4rz;Nl<^gp*)r0bg`nwjiDVsFeD7`SFM
zGifq1FkE`i30i8>%%mv=;(%&L))q+yhE=W2Ov;Q543|M$D(7uzW&#b%UV1OXz_3`5
zf#I?aNCl|n$oK-p0~Ngn;G63&%SbXXoV0Cbk_Bl7E%*g#mX%>(sK4|cbY;jfhh`>m
zkR0eNZjhX~4A^2x28QGRnwbPaQcX}d2_mFEHZyU6q(BGVfpl?zrC1mkB;GeOaY2TP
zBpDdmqMI3ig47*_7{T}xtPW&xee>jI#?K(R2T-}saJlBfX2v%lsozj3P?HAYUR$wd
z#;1%73|Bx4H|K3=W_*g!<=@PB6(j}P>I9Oy3YOw3V`v5+>c&vTV8OuPpxw*}YR}Yz
zvg{SmDTjv=n;Cb5TN9k1)<iSoZg6t~;u*$6(hLk&S_D`a7<5XS84sy4FkI<`v|5z-
z7#LPRmSkX9v%i@URPbCm$jQLa)!fXu4%9{hm9RN2&5RqtMF3YOLo*}zSid(6vltl|
zc11jCW?aE2$-uDGzL~KX<m~^P3=HCW&5XTTARAd27y>^wGeWNM<;u@vXl8`m;tL8q
zHScCdP=n|ysG`&U)6Cci>LGM<GB6lrOwYc{B3<8O-pp76PF)NPSM!BHZJcJt5^y6&
z2-L`FW-I}>ayS_nK>AA{%^V8`hVt*tjIajERZzbG6g-d?iV&!w)658IqOdS9M6)zA
zf)o5QP{8g~YG#ar+IUSE)X@g%i~<+2V8zoV?y-2)Z)s)>fT;p4O$R9o05?dW#s`4g
zE?^zakV8$t#@p97GrGexPT&N!znU4{!5X1z!Dps`L;XlIBWU{sLlp}HLuOYqBk0Be
zNbF0?cQ!NH!HhWxHO3Cypy33yd8XZGk*v>?Y-Y58Df$XkWPwoB%xD2=_Lws;Xva4*
zsxmS#Tz7$nt12k>fzDG)UeU~`3U2vuGBCKvH#4e&n?B%_0NSj>@CKBsoc1*{YJy7o
zWelKD)SB4LSTDf{DvKBxu7lQ~gA{-UuNgqaip2Y7Mk#QL1SyXE+{_5dp`fIEy&vjM
zL2yzA6}RHoJ3-0v`WbL>+qn+xFb)QWY1W<V<UtJ#4$zIvo$GWM7#KjU_?(u`b)e>F
z{Tq<(hC`k685tOEa6)v?2lYEab?!9l&iQf(-Sf2(y62mLsxOe{sf#<OgEWIyMW&wZ
z1RapXP{jaBvejap6F@;*rOUvuN2{|HqzZKNuBKFHE69o}-u&s)9<WF<s!!kWfJLnS
zc4sw63CLzmsm^MUA3$zRJ=<9g?tQQ^FmS7Pg3d2yr~=i7`ENS&!R9kC+yI@|s43N%
z4>lK~5VCfkr;MQ!a`!LDu_^mI(-;{TZh{tiMzeILf$V_Vmp0w?A&YkXjZRQqc@xy;
zie~8q9~%QzkO12G2X#;asN4WMLi%TCB-9Z%D>*<pr4w|J4!BdHDb*PXYClzhtWL7;
z1m%XCpx&>hRA&I#rM&rRX$+kK@}Pj_&Cg@#oc{hHi>QBmrx(bTH#is=G^IMdK(2&Z
z>;(=9knbf=cRIr?{t8j(3^o&FnZu(_D@F!}TcAo(Q)+tfBNkn+gicW7`4*^ottr)M
zf@G)(+|a}CJ9VLk-U4le(3I-bg&V4RyHgEh=+x<_9<j*Omv$<Ec<VSA7*fx6DuB%c
z$NP$!PARY<x(o~fdpd<dsz77%sb@Pu!xhlfaq>(jFIZI%BLjo?=O!j$Mhgap+HXya
zhe5(`7#MDY4mCZL*u;2P8I(!DMRpV8VFOUglVPX_*N3-Hg7mO3Fi8GsVmv9$z;OE<
z3#eLcVtmL6O1WH_3{8xWz~wRv0|RIT5p)VCxVVUBX=3~Wk^vPYfghWgAQN4p3=FrM
zz;!?q<4JXJ9RSL_Yt5S&FM`|ZpfYG-6XWzJk6E<pPlCK{zz>>JyuFi;f#JvoNd^Wc
z(I&=Cj0_C7-+?n~6XPZYkOvsd85o3qH8FzjfxH9S!SA%MiE%mT9I`i@3=G0tO^nM`
zKyGFMm3U2zE5UUu)N7!lWN)7XIYg(ViE$0YT@2>+3=A>ZO^l#4eb=0Yfx+QN6Jstv
z1H)Z&u*bnyU4RM`SH~ts$Q=lx3=DT#SQr>|UpFykfJQ_Pf;udBrbC6Y;6iuRSwJId
zO^jurA`4{5{Fo-jN_hr`yY5gIR!P@``~~iXG%?n~)J@}RVyuI40zWn})`J>gpc2~P
zRTH?w11{h|G1e^)iZM|JhP&b{3=9(*n;2U`&Am4aFrRj7gJS^92L;!Bkh#kkKn)<!
z>_PoqcW?yAfSONxPn$C^94T&M1U2LCt^gO(O^iX{8k&=VA$dg;V-T$Jbdhgj4AKEL
zKEVM6Y3G3~1-U8=>?)}D!=W}>Ffhp0H!*_RcA#$RT~PXRO4`@N=mv7Z8?Z6plfA%Y
zJ;)f)TC3aV7(lJUEvik7kQN{V!#xIQs<4L?-v<~O7?#dyWV{PX*X9fiQ&SoluQ4((
z+ygCD-@j~n&NCJXUWZ0-QwCK0->aNH@fnL8<Dcmpp0P;PPiSP^3{t%i?B7Pl&7l3h
z%QzVrGEy5EH(N3=+*=3=oI^E|3=F#3jf|k1f$yDzDqaEV>cJGRFas-=WMJsr)W}%N
z$iQ%)52~&fbYUP&U9AmBhAWeyk+GiB8RTkEmSAaQYz5~gkZlK#N-{7U+}p?)2QnoX
zYDyd^t;0--vjmv});YcBIg3R7kw!*WXwJV6y7~H0Vk3AJ+kpU31*n?S2oJ&gpc_0u
z()Qp+0k}2M$Y>94O@P!k*EKR)!i)lqMS;{>g4Keg59>8D>cgbJfg_`lQ6JJdgPNre
z?wx@h*T@K&%LVD2tkTE`Dgr^#@Bnn01;}7EaQ6(VRs$Rapq=Y>jf|Qg&Kr=%8TT6*
z<)BtR0A17r(kQ11$~{mU<?10dss#f>l~E%jsG$zFr5)-%aj;@8P`j*=5wfEeWU$}o
zMtHm6!2zgRK~<2!;6_d(qab+L0BVb%9Vog$8Z|f@8M$FD0+l~{ASZDn>*NOO1SuBZ
z*T~2SQoM|T;h`$ntJD2ovZ&V=H~wN|V0Z{RD9F0G@fRq5!IfRYq{fdR3DE6;=G~1S
zLCNe58>n_{{0s^da38U>vGFBHQ3nSD12<3OOK=*4D0&T1WWd1CexdOe$mTZ;3=fxr
z`@@a5z>Wk}HT4X;0~;@bq?hS3Fl-TN1PvcN(gZhS8bJqofvaJivyJ-{K|>cDptF@5
z_vt}LB-X5H+z)CdgX(v)`HlNQomWsbyCl4EKd6!c4K3CwH-eA7UdG125XIDZ7_`;p
z08b`EBly7U`emT5@sYsBjf@Noj~sZ)7#hL1el25YVPs&K#n-r$QI~;1Q=t)b?8Kua
zP%W+BI2ja5;C9#cEsdbc?@=`e1H-zXjXm(TLhi*z&;aD4Bj9FRBWUmu?30|9#$r&U
zfW}Q4%QzXPe}2UxQvai|23khxGBC_^ZcJumV0a7~AW|u6OjZQdC>#t7mTry7Iv_S1
z1H-(8##He55gP+TrDr4PDhmd1v}O7=27@$%7A)BAZwyukwM#e{7_|R127^O{2b}(*
z!J0ws43AfhzMxT#$Dnq%?fynz&}a|XDAo^+P9USIAd%q&YGQx_dYW~klP1U=pg;s~
zas>xPmq4RANcl>La&si*=5XcUjrm~ZYbqN-Ir#Az4h9DAyo-(cphCV1WF$DVz5yi;
z2Dh|EP)C~q)c%~ix)Ic=ehfM?(A%X^8Qhiw`Cz?cqZlIt!xPYOinq)3fHy1(^$q$B
zj5|Prpkp=WZD?QwowW|>lxAc#FoGic3Fs0mkkm$S?;YAZe^SiAkdXzdoIt(vC&i$e
z!2rB5=}EFK1B1!ahQA<V4{?B+C=GwXTB8^k4*E1Oih}FZ21ZtK24;o>0n<OdVNt5@
z>5A56U}&7$1*&zPfCjqeZRm1SWnj4U9+dDDXLqSHGB7*^tq$qt>rw}eWq@*7X+jrd
zgA{1|J+Vs{+>qc&E@0>~5My9C5DHGqU3TEK%*Mb_Zq@}k+zV{x^e%ponL9wYnIB5*
z;s^JII6!B|ckzR}LcAb@_`RS8ar1P6I)DtI46<fT7vvakp47Y)hAts+h5`-AcL@uF
zhUD287z|!bfBu$5sa~U-2{i9<U@`;4)89hL1q|Ix;3Z_C;9%%x>H@o&1(fN!nI?h<
z7`e(Ax|zUN3M>P)q}G*pGZis1Fg){uXfFaa5<`WO6B)Xhip&@o4orp`Rf23(E!fin
z^(+hwZQb2W_0WuC&cNVf*3A?KGOt^xJTs4>n+enkH~>Bw)TEm!%oOBbP6h_+=5D5N
z@IWubs&G)RcQUA_-d)no1WNMHo<R+80tFq+04FPu0T4aTDxh`~%zdsf_ibI)%>>?!
z4Qgzan{_jRcVjODnQbtwn+cTQpM!*wS9CM!gMG`%z`(ktn@JyRHq>$Y9-tx~>UTqA
zv%x3EfXwbXTi*@dEGu|`g@K{+bvKhWd{AJIXEzh5iW5A*!0@~s60~aaAh)wHFo0YL
zuHitY7~kw>0@rY-Kvl$?<ZdQV!U46)o}Un^VCZJz2POYyLX{vUxNL_yN>H3ZiQzy1
zS3W4#MZqZp6rt0zx*5MSGBCW5=VV~;cA2jJfkml4v77NH*biXUjDNwZSr`~*c6Bp>
zkGy{aYF_zX?q)m+>Pb&#V0dvITnlzH9#sU@f?yvo9<_%0z`D7c@i+$qgPsfvC^2?3
zo&eP}Z@`(boAD#Wma|}6xRMi#q#3#y!9&#`4{P#wGlJF`fqM^!CQN?}a^P_m1_mDU
zZpH`THZHiGx<#Rz@eTOGUItLyDW!EYPGn?YcnRsYcQZ}|xBDOtn*>fH;AFu#$sC$$
zK?Y0*FGzy82egrS|52!e!Pj8GoHN%JToi)>c0xDfTu{vdYG=>v>ShGBkr+VD(r(5L
zU_XLdw_WDljGMqN6=h&}*)aX!M;7_|huz>2CdPvd3@?ufB{Ot0HiAkLkU<fPyBV9o
zx>*<)K+b9bI}7A3mK)uSd5jDUuRt3m4<&Xp=7ExA03_`*=GlS*oRfi}-K3i_AIX#X
zHXu(z`~}()wErk5FB-h+hMqhHGCKc2H)AZw=xS(G#)3l(+=lOFj0Kqh%2upfx*6j@
zmV!8-h>Zi6PY|;cz;Or-vlOrwK#6SSf^P8G(yOULpybEsF2_*M@M<ck&AR`nIRk@)
zcQ>Og$m)X-d0QC<hF4Re&agECr6`aK8>71!c^DZOUOPdQ@koP|ait|ObTjgSix?IL
zh7Ek(;8iH#-i~xZH)I9|6m?Nd-HgI8WlY+CrpJF~k%)EaW>f){N1!QMowMDHdf>AV
z7(k=g-ZtIfsi7(chBu(wg*WhZ{{W4>zX8>MF5N#sZT?ei3=GK;-M_$oWn*9{DeC?O
zI@kkLBcx_ezw((Ss{Zvy(2AEA-Ha?Ci@<YLZ&;v0tPmkkGAVx1&BzAff@}}6?tTnv
zWSwGQcmq0%d;?$iW6;tHknQDW-JpR{@H}jCL^t?sUyzL@Mcq#kws$`TRnTvyul>T}
zTfdu)fuZ<C_Xp6tIK&BOAtIogy%^pwfCm1HUvz(h$b%}SRfXNx7#SGes`923moRi+
zlLocsc#DgY8M?2jf!G`j49*hW*Fd8(AV+Oo)_o0hL=lK>-Q0Z*TqJ^O`-vaB_i?c?
zFuZN$0CfnbH-BZ(Vryjs4F*r&{FOz$ek!QUGGGN+y7_PSLXf4$c|j=!bcxKXso<Kk
zdoeibK+e=T+YP!X2UJ)pGcbg5bc5Pn?^?k+k|jWC0z5g?4Zau?6f99p-Dz;$+JCyi
zw_t%9nmT8@r-RNs6FeZw!0=9&4b<rB&IN@aNOn$MH)weh130+effg@l|LHCQb(KN&
z?wq{t5)d0An+efdi=?*>A`5b{_Mh%%5D%)a1;l>CzyR{FU{`lNXkYMqUa<R(q(Sb7
z_}C2WW;O-}P5o~0(MjOBeVw!2;ovk1a`JtMwV;Dfz=>f_Ubj8OaFFa@h^#x3qd<$7
zp|P#~r#lcV14>oO3=CW6c7y7m_es;!zO!iP7ImwETD_py+`6nAe0COyZQb0h2D;7m
z4ao6&mEH1;3=HqLPu~sEB9D|9<gGz<A_utkmUjoSL0Sx5yM-AU7(Vb!7x=-VUhgc?
zEeu+L0Wx~)vTkAU{24@#un$;|IRk^+x;hrn*xU!uX)^OR)UkL;f?8vNklC3J;N@nZ
zw%-Q_a6;l_&}U%yU?9oBut%<r1vFmw0knY<q|sR#q!HS1{7}nK&#*@h)^hw%3)amI
z)}1TKz)-ofj>Q1vR?xgFNVfr4Hy3Dpzm5fbASGxNOZ!h9i!nH=SQr>&#Oqif8{D}-
za{_fNkmbeTs;-X3jtex8TgPGnE-n}(8R{9<#MiNa`kf!Oz;iKmEaJ$PfDgt1S(1@j
z$08-m!0=HER8;7`u49pf3>tw7(S4^R85jiq*0HcKGBA7ujrxOJ%K|nCRB%e{sAK*I
zk^=Sc=WVEC{wE6!hI-KS*2g9W28kW8VE70+X`8`-7ZeO1izFEsV!qZfe*@_TUE&1N
z{SB-eWN^&$I_CEvDNuhOB=sIHRdKV9`8p#5!za+;0wAgDVCQfp7ckT@-vqaaLBW;N
zQpbD?6dE8;dY!3b1|4rGq{PC&P;NHe{}+p5{bX=`zKXGq88l||33SvZ$hZSw<3NrG
z-CD=I3uF^$t^_2t3+xDJB!fH`x)r1@wXlvEG-&f_A|#}lH>0adEd;5HJ6OjI+9dD^
zG!i<`XG0zH8gzwm2f+$A*D-^pygyxm8n_g!4kVT8UdKF#k%8ee8&qlzSZccUZx)&Q
zd3DU7uIXpcNvt6EP6o??w8c%RV+Kuke+CVWfuy>?Qe0&Wb<Ch!zrc;4#HKptUT_Np
ztfi@rIR|7@C)6g;&f!b%Sr`~V>OjZyfHh6?sbdBmx&c~%Aj!ZG^{tK>wEE>UX!Z<b
zQ6ktP@E}7SGpL)z0B!<T?5$%4jSqc312x?h9_)Iv>zF~KYo9^GxgaC#!A2kjyWVV&
z1NVHcV+PgQUqC}QAa&e4V1=R#3||zcC;VZNuiwp7$IQma!0-i{beY+}DnPn7tJX1t
zj+pxbD$GH;8Q@a8uGKMt2133xK-|Xk3n6u)j_C`?Kv27F-iA7+FAynn1_ptyIwsJ`
zbzfP)<70J9w}nC3ewh$xQlO6MHmENR8ZDc~HC^N{i%R{JIwsHsR18(ne8+Sjn(rhT
z7<TQdV*<^He$|7z;40V}n9A!2l@%N7m}(dq7`}og(LfFY?W~4$Zi9U4n94v>g-}Dv
zz=lA>u^yCugM2_iQIS%|1j^uFd!Pyt8N4E*4m=P1bw5Ok@h3Q%xRMhY>KOlufE$0H
zjK>H%z5GBZ$h4Jmb&Q`t)`D{1ybX1XpTJr`QWZ9JjITjbUqPpYfaG2y<P7Q<?=Uhj
zd;_if1xek3OL<(b0}r8o1C?$dscXm{0r|t@GT3;PI>!AVBS6QtfYj{=8v$|bK_th5
z4t=jb0P39PwA3*k29*+TKn5&ZRL2O~GVpB&)VEua4A_oj0O&+|xPDM>W&rCiTUE!n
z7UTfXf>e+L)*|U&57rN|rfgmv<8lv>I#BBlq;5G_9awHs9V4in@*Q;28b}J%Qh~&0
z!=pOJc18w<?>C{YYX=9z^qT)HuJw_1jG$R$@bVy+?{$pe^(&yF&-p+dBdA;gH(Rwj
z>%jdLFvq&Nj&Tau?_8iRavdY+jDN7N+D+;hXTwU;a<e){(6+h*;BIkQTOGK2@g15u
z85_Y)uLrxms*bUWk%8d{WUWITV-;8qn&3XvGBA`?fz+9s)G-!-)PW8p0{O83tPWg)
zGlE80APK1~u8uJiqztsq3#2R)Nm(}7c_7oug6bHPL8DebKm*nwb;)3LAUTezI`E|R
z56~5QAgKVb6nHM64l+j#YQUE!)Isju0FUl=ey(E#6&j!c+n=CI3!V1WF|vXBP@sWT
zkXklSUIuAAlvu~e3F^?+2S6%d$Qmt>RIO(nqK7bztBw(Ts2)fr@M9e#sMQZHJ`G;g
zF@mBR+_$S^1lRp<L>U-<2C{%=Q0f@fAq{tsPzrcfr;gDQlKnwK<xrt|TTTWBM)2g%
z&n~DK=%6~rgWx`_?&~^6P+)^Pg`l}y^N_m#pbmC`0RzLys5(%-1NrtB6L`s3-5pTD
z1z9pycLy|^2^#9t{!@2H3)DJi15HNMJ&<Bx_{9WjgYt>jy@!mvfCs4RK*PhJITbzz
zh67iX85meA>p+>}S1fM<sHj-0#K7<?mKRiltTh7_AZ!c_;gNOVT)0et2b>g-OM&{E
zY@q&T-3b`G+^p`T1V{sT6~_V4K``rT>p)Z8zuM{{W`pLpp=Qqq_3kEv8it$V>Od3A
zzd+-391(T-py3`+EBsJmT`4H;0zhMFb)Y+wz+-9V-F2XjDg$`2)x6p|&}`g+PzHuy
zuR!~9BI?pWJ+&&Hib{q$P{L#Y4;t4e%&Y?~w))Kk8c(YW1r1h&f-EoXsPkoHVE7H%
z|HREx=L-tiWuOV)@TNNOq{cD^hTj>WDQ=!R(D)>H<ZVY%9cYIaxZ%BKO&w%74?GH2
z=K!vs!9#C#pcV@Q*s!hjN9(jfeL9e7pp_?qAM3Qi?&JWiDXh~5FBt)?AmFOg2CW(Z
z>ss-yP6nju4FkjPW8lH~IvHtDpBQwO311!L_#;q1OLj)hJVpkFKOoEJZK#<i0czwy
z8_9nHKuZYg8EU`_$=|@1aceU$>?o``2I>J+X)`bcq}Ch*xuJ@uxHOlc<^<Rmq6`dw
z40%8cuxgfpQu#7)Us3mU&0a_Xhcz7k1b{-#fCJQU{Nn%`i&vUl)5WOFz+ezn16nKd
zXLEfi1B1P6O@&}70|Q@MO{E|k1H-m6HC5p84K@abh@UmpU^d9kC2XJx)0%2IaFzij
zVcpj?wL)MX!)!(dhUB;!(C`P_$C?O`w_ouTr4}>PK(5ItWnl2WS(7LT)s_TtDtL8r
z@v0ios2;;928O?&l@Tq1HTs}p;}i!2!-*R;`ruLn)VEzyqYqki4eCK2R;vMzai0?4
zDag%bs4<oXX$E!8w$xaFN1fOh82q->*nk6wje$Y#NsSFCW|x7xxiz+6ah~a0Sy{#E
z(<OO9yDR?jvoJ95w@C6afNZ}N%fP^-CCSGK>XL!VAKgAlJ|-d1mQ)r7hRHFKd`zG%
zr#37M46H7ad`y}k8LmtQNj~tRa!_IP_bFFV0fQu;fG`8YKYnnDl2;+g2U=~nR|m9I
z$6S(6QJA5gfx&=<fuSQxl1~vdgkit{>O+X#Fk@g~OO)h&1X>{QuT`ihKbJw0_mKtz
z!@pLpWClszC*Zk#76yiF1xel~uvvMba!FqB_yedGlh>5weG2wA3j@QN_maF%L8H;j
zK+fa^b)p#FaAh$}Kgq@_%-BEuE*q;f<M-)5*;r*6GpCEQv&uSJrh*0qBzaG}FfjbL
zWXuZ9%wv$`Jp<y|F=mG5mzFR{@}6~NVEFIMm=T(smd+r_dk)0)U`&@{U|7OCy_B6*
zi*eWV1?;RcOm%G2_p!6e2A+nR+U~}{@c%T-)D95u0^HP2cLs+4SK+31f$a2POa}#x
z<WW8b2Fc%i3=C3gjtmTQ+NSGpu*wF)99!kVz{mi1Y&D37aBPhy10w^%v9%yep~i}X
z##$sZKxR*HWMDYGd-^O6R@wR-sB2xkkd1X!U|?iG80)5pVywFy1H*q<7)bJZf={(%
zU|;|xUsWjvhTdb6yr8x<D9wY;z-I`OXJ8bFxBvhD!w1HV4h)QN76WKaE&~IPByS=o
z10!QBGXtYQE&~HYG6MrcB8XGPz`#(%z`#%d;<Pg`Ftji*Ff_R_Fekm6Uckw!D3|ny
zfq`Kv0|UckW(G)4VhIBS!y*O-36Pc3*K@Lp>RtkA1{u4Rfq`K&hyybA2m=GdArJ>-
z><tD6hHF7!V?T1TiY9=KeZj!M@C;_`cLoNAuTW#5?#}`3^<nuS$(zi{z{nH~GAoyX
zfsvhofsqx&sbXMY1f7c}0^+nYFfeK{FfeLB9G}Jobv&aL0|TQ4)D}ih1_nlV1_p3=
zO<&5zs-Va80HhmaZX^Q(V>pNdGB<;PfiVrl0htRDsDPOJnTu612jqIjE(Qk14w$(!
z85kI+L(PS{egOjmg2ey=0+PIGoD7W2xgc{vHm+n~U|bI3fGpU-z`(c-!~xlOih+Ug
z1jNP$ZdOHbcro5&U|_rsv+)H31LHH)@HztOTCp-n^5%eSc?U8JWXpF32F9--P89<K
z6B`2q6AOsb&cMJV!N9;I2C;>a2O3^XI-rsZY73J!0|S#K149rvvK@F>#WZpm7?}JS
z7?^xPhJZ|rV_;y40dYVk7BMg|6+ld^<6%{l2Za<<8v_GV3(Ul+3=B+@85kHG85m;r
zPT$AFDig+eUma3V2zxOwa^7cPU|P+<z_i>1TwI8N#GWuPFr8*#U^)yfG(^1_7&%|U
zv$vQBJi}~JkmQvBm$TCicv%&gYCWe1@v{0$1xWJBfa=9J3=Ax+3=Axcz6=a3dl(qm
zc&G2?WtC)%pMI5>RSD!fmQV%;7I0##VqjoNVPIfMg8Gi7jDdlr1mZh+KB(_lS{WEv
znxVd9nZm%pGKm2kEu8PB$Mdm@DmpVWFoJGXU|Gt*z_Jj;;bmZ8+0VehvKyKXr}D8X
z>Rtd@lFPur@|1yr<uQl@vi=JL1Is56r=5X;m5qUcl?7t`V?Jo2U=?LxU=@a1&#J<}
zz^Vkc9abD{2F*D$u;fVc>aa2}vIm09%4J|+HD+L7H3V_07#LWc7#LU`Kpc=QVGInc
zArM<q_@RlNHI;#ZH5q102?GOb5lUj;>;OybAQmXCGl)p?>Vj;%2Qn9AV>1H-Ya@sQ
zvT+gv1M3732V~<i1_st85F0=8Lz5xvRt5&v%`h8}Ffgzlg4#IUK!8<IHyflGWb9=I
z2G)xp4#?O?3=FK`{0uVo8v_ID7l^TS0?^=M<6>Z7<A55=Cdt46+NcjM${=}la|6in
zEH#q6`m79$9B)7d=Q1#`=`t{|X@fXb3=C{G3=C{mAWl021DhWM1Dg-Tmj7^DVi_3N
zqG7h=Ffg!Xp+-s%xMb^*<TYSrVB`ds#2{O$85r0qK?Z|t>0)4D>i}^;w#;K-V4DLe
zKN|#DMPoquift1E1KS3eEe9DG*!DwnD%3A4z_zTB<TV5rmmnLiGBB`R1{n&n;Ryo+
z+anMMWWx^z2DWbye|!{VRpbZR0J<HDoegZmbVVUnIlhyUyeyyw0VrI!q^J7|vC1*2
zvro?zVwG{?e*~%Oc%Hj4F!DcwR?IvvK)mO$ikau7I|C#C8(7ZedF2erxsU?+v=FPJ
zE*r>2xeN^K>I@9*svu4k0|UDm0|UDWh||u%!0yGs!0rKYtE4bA!LUa&FtA60-O9kg
zp2fhxo&ifR5yGsBx|2bgLB>`yFtEb{nZ1jFfgKje?DH5H*yliuT_((`SPu?@O$-d|
zus~)%$iTq9A0;ZcJOBkU^L0s{cdQJIJRC4vt}-yN!vdQ92?GN=ETGwcFfg!x3j$Sz
zkZ9WS0hHvJpG)%GU}a`t23g9%!@$776$bSThcp8Nha{@4f55hWm*ja5vb7UxD~CP<
z1BWh%Q^ml*VaLG0VFTi{Gca%jF)(lhK>RjG1ezH*(ij*xQed`}GB9uyqu8<))OKcI
zVVC6jz{<eL%LOtkmw|z!lYxPw9mE0IGJ}DEV;YD9vSkee1IH?eEwZ98TXr)raO{NH
za*Bb0;{>WLCLsT_h)eQ(1liIJG7DtOO$G*z>mUxumKO{R9M3=;kS%{07&v}GY?%kM
zg_E0sfs+$z3#SwV1E&P4EeT*-)FpYoa56CR@qo<AWnkdcWMJS_2XU$x7&t8$7&y&9
zoOT8VPA>)qPG};N7lS4;&PWCZ&TyD584L`ZX|O~VC&sE+9}UtBGPaz7fwL6E0U6r{
zx`YM90U0}kfq`=xr1b=e|E=KoXEB%L`2%tp*vlXzmNPJLE<MD^z$j3~%>dKAje&u4
z3)t&W%^k3UcWVa&!}Nb*ti0g10_RZ%2F}AUhhAY|;Jkzy92>yF;V#MZlaqmwKLTVv
z$kN9Q44e-^9FV&|F)(m`0CCzG7`Rv%7`T|gHc!tMhXx1e!T~Nps4ZMd3=CWf3=D4I
zw!$iLNNvhx$iTp*4>F{Rfq~0`fq}~o!~vNY#K6D>O_E>4q1lZqk%56L9%f<z0|Qqc
z1GqyYe~k}xP!WhY<;cJgen*n$HfXKa8%Q{80#|bk3=BMsa~K!}0-#0FZEp|<RutU<
z@j~H6(On+~Mu8}JQB;2q+KK>m5){7jF)%0wfrwf&1_qH-NuI0XptzVSlnm;p@LaV7
z6<k7~EnAX2*Fbl`yb%H|?2_cU2AV-X#gNXx;3Y2Mzy@|7gCV$HVPIgm0dk+<UTFsA
z<eyL}P=lI*d3(KtD=Pz|zzb#u<`i}Y2CjMr2CiBVM}&catB-+!tA_zu*9A}nG9Q<4
zXJud%lm)2+X`08tz%>WN0cl#xz`(VdffZ`a4hE)~z6^|lW{iwk%v{Vb;1W+57zOt-
zFxCtDgJl^1!)1OzWCYV08MBx;zQV+fc%b49U=0Ev;1UW@iRp}tS&W8oVH2qEdayZP
z7{nn?GV)+x=CNV$VPJ5tkua?X9jF9}P6mSoAm1@CFgySSm#~-yX!cFQ6ubkDfr0BF
z0|VD?TL$K&gAjuZUO;mJ1BeCI$|7OT&A=#R0xD52Gca&HVqoC9$Iif<^nihZo0Wlq
zn;9iESr|YaY3Ah;maGhnLYbftWM^RD7GYrE76NfV4A2?KiVR5B8cM*d1+k#kTJth6
z3ax@#%WcBIz-<7tHk^ThI}~id6o|VG4d4bCfb0hu!6ISH!@wx?8f3yU1_tg71_tgF
zkO`X^7`P`eFmU(5g4Hkq5~IRQpwPBr;D#Dn0uqJ@F}O1@tk@u701jFPMq$vPmV1i?
zXfl-nG)Eg#Ct;ulT1m*@!=S+6WF{d5RtYiaC#ciLz`(#J0Ez_hr_<L-vuf3EkPs09
z9qg<GS_mp33L5PA$u!Z%mw`d9nt@T&6SV2y?V*IMJOiWfK4Z|B6)2!No<hw0&%(gU
zz#!Kvp~%U=C<5v}aeQK6;C{ux!2Lpkftf2Bs!RY>zsb#KWn>p%U=*ohW?<$51;jtl
zu>gOp7?`;;;R-<)V9jUU3937}%NQ7Vgculj1eh6^xtkamc+?mecvL`~J_ZIJGX@48
z6Ltn>?pX{BJZ=mOJT4&4G6n{oSOx~3Xjukk?oA+KABZ>wBCavO(&~Q>24;@`40`np
z%y7S0FhFznf6!8AP~^2psDbJrke_%!ZYk<zWMJkhWnhro#>&Vhz`!VKWyiqG)%1iB
z<OQ(sCRRHJX6`Z&(F7v;KyCs#a6SVA&vXz6<iJY|3_RyRocc`+3_O1s7<j&ec>5R_
zcoi5JcqKrbQw$8ep$rVX!642x1_s_71_s_Ngby6RJ^;lA+b2lq{kp-x%)lVKMnaO4
zfl)k-nSq(@KLZ1AHv<E2qXYvpyEIhUAJB4pId)d2FxGkoMsY)C24;3m1_s{O3=F(C
z*%_EYtuwwD1_nL{5XYH;f$t^*1K&juCxC&0Uzve{UlzoPWnkbBV_@L-197q#82A@5
zF!0X~V_;@4hu8$#;tvW(1{qM#9;B*<fr0-Z0|Wnl26+Z%?#K4^pg|6XKMD*?5FLL&
zt6V`^GFX|MI2jnl%0RLGnSp`-0s{j-ILQ7pF!0}JVBo*Y&cMvW&A`C_je&vx3y1@{
zM~Rn#L4X^?QD$HO9X2T-1>)#4FbKFXFbFt-tY!ZNvFq;z2F7|g6J#j^LkcSsBQFD^
z*dt~JX3+6(0>KOn0)gxd%p9T&3<6mU3<4R749px#OcObv`SYI!1GASjs3a_BU}Vf>
znP@YGg^@9XiNlD20TdKn5F7r@fLOo~z`!Uj1`3L91_puJdIko8au9C@1B1Xu1_puE
zuoU`Nfq|JrA6m5jt6^YFuVE-=U}ooGV312uWMF3JMY!SD8{BRH7f{fG^;ZI{fC8~V
z4ytEhk&xhFU=&{tDxfYiFbJGyU=TPBDxe-PFbI5NU=aAgpvS<R1TErzU4ff$1*D&W
zfq_LrQWT^av;_rpPRD<c=FJQYf&vT-f_x01nltO6dNVX{b%7QhF)%PN)qqMNDaP{Y
z0Sc_L#;pttf|(2qg6W!|MRn?JQVfhz<qQmhoeT_u?FB{o<qYcW;IUWOL4T(mrY}%n
z6{$b%BF(@kbrcfF-Jk_34BWlyb9fmTC54z77^UtpFbE!HU=TbE;(UW~>=+oOK*L;8
zuNW8vuQD(Qg4*`dObiTyPZ$^kL2Y|!J_ZKCFANNVpX?YIrKOk|7^OkWs=(6h42;r7
z3=Bftpz4IP7HapL>2`{&;`OH^7#Y)<$`}|JY>^zc0TyiC;FcN#1A~wHB9J4GgWPqG
zfk8-$fk8+D#Q6r}AUje>i-AE%1LPDYkW=^=7=)}C7=$c99FWdH1_mL25Jw(V{--i9
z2qnW@S<1j5R19<EA9P1bGcZagL442?1By}Z#p)Yb85pIKL6+r%jI3s05Ncsy5NZN(
z+8G#x<}xq{%>;2KGcX7pU|<m12eJz!dY*wn=q!k{l7T@8<f}VtA)}WJJ$smn85kKM
zM_z(XiJ#iQ$e0O>&8Y>9jL@SqKQNsxfrTJ6i}koLFp58gR)KsB404v%3=B*2)r;5|
z85pG&@qz}!)r-_YW8rKJ3^nuBOSl;rr4BGau3==9I$#VMtOXHvAi~+W9@N-l-~(wk
zVqn;LMLn9Ak%3X#9%53o4#*_XA$f<?A!mtz*eBGZL8%K=&2pHi$H10SaagOzz?M?g
zdaB35#HVqo$AU&{LF##)s>gxF*}#@1aMv?1O2@*SCmm}H>R^M2=OE&ZG0b(+_C^d0
zhqkGEfL*r@;yMpakn4ECS;7Oh2F!G#x(C=5yvYpe9)6&kQrH+6)+efaaWgPVUtt4h
zDt{?(rYd1z0B!$fl)hpN8lD3YPe8;=guUC!7#M<c#d)R)fKvvecL6A6Ffb@A0cBdF
z+j5x<;yg1zZG~G53_`yd7=&I+F)*CkA<i=cv^DY;1B0*~1B0-Y6a&K<M{%B+pfLsm
z1_t2_1_t32DF%jm`AgzFGeHZWL846z48k>13=BP0;yg1!yAVKv^BEX~=gJkA6fubN
z%mUvN!@wZCg@HkMjT8ezW1Tq994^q+1`G_sj~N(*Z)Pws9N}ePG<pq7QI!)!85m{u
zaHXV{F^Kc_Nq|oN<pQ7c&)Y8!y4uo!!5QMYlqV3+F*q<V$}&kYFl-1G=aU01&NN_P
z5D{cx5aEZUL&lU349tOZV2Sv{2d3fza4*ahQr$6ngS+vX^5Q%TSs55*m1P+iO<O^I
z!)ynLRXz(qL%N!#_2N7yKq_44FfuS^`+}61PKGE+^#Ln!73b6BWMEVRjUbyYWnd6d
zVqg%FV`gA9-Ne8k;?BSz0vd-j-Os=v0=ls~gPnoV^b7-oNCyLhNE3*2lYv2G6$69F
z5)kJJ1B1vZ1_qI1iVTdVADJiC-(Ua<|6^bfdCI^b@{pZ@5wx69l!<{s<R6G5!N4FY
z&%hum4dSRWFo-%ZFo;@!I7SQ%qL~Z~qRA2rOvaG9jWKl!*v%Woxl4o?80Ev68JLXc
zFffSrFffRAurn|juVi2lUCqECx)8+K#=zh$`kaA5^r|TXlkqhM2F*tdjB+a!8JLW3
zGfm`x^lunb-+;oJfl)3GIlNau8_SGo0u0RVcNiGudZs%VvWnIlfK(%^Ji)*KGX5|F
zgBBA5qugPT%_kTb#55Tg#MD7jCj1NxTA~b$a`)I7m`p?%7{pu{7{u(rQc4UATB;0;
zaz8;*>I@8G)eH<`l^`kOmkbPA<_wJTJhBW-#_t%y7??~<?f-)=3}8&315HRQ42<%|
zAgxvm3}Vw67{n$scrY-T<UwLM{QyiENJ%jRgV-hp2C;Pv484pDjAot;3|j8u+!dS*
zjEeg~0Upl4Aa<64LF}X=1EX0A(?kxCU?Bs8*n0*BF>uV)Ffi1MYcVj0Yt%6?nstJR
zi4qKqNt+?|rJVr9j#i#Hx3)9`qdaIHA?YXsgSZs~gSbU517p%<sJa`_I*Kt3+EZX)
z5obzN1&wN(y@#slVPJu?Al{G>=T-+bBNYsxxg>1?dR#mJ<q{@SXkn6Z1k@SOY82-V
z<6>Y`*u>1hWU9o#ARflRARYwb=rb^gH!v`W*RV4%nc6Tgh|geP5T9boz+?&voVg5)
z3Vk3MKL!TzEes6eYZyEj>X}SqAnwY9xQc;+0i-68fkFHo1B3W026(~&=V1m$g^Nh3
zr4*j7(pf-`XJAzLfGqt3raN7Mfq8B&1EV4@sKHkcYVa|-GqBnlgPO67=_U+}kv$BI
ziYk!03etFEOs@bn-k|9^Lj+=hV!(7q6IRjsj3-cjK9YrH888boC7{xM$kGmQX%nb>
zRwLYF2<<sCW_o~}191wpRmtcJjvT04G7m7+GY8ILU{rjKZ2Aef>30~I<@gvFm6$=M
zSHi<EO9UzoZuTOH2SCM*(bU&KJfReXYz=tC0-SNOCNMDVab#dr%0kok18QCqs(7{w
zRD2dx9Gdd73qbZD*-;J|GfvZnq>VrU21sj!5xle-lv3(d#CaoF85ouRGBYrySuikw
zZoZRXwPRpRb7f~>ObcRQkWgY^kWc`X(Fy+`=0yDfr{FE(yxTb$7**TZ85k3J7#Ji>
z85kt=O&J&y?HL%ft}-yH+Jj_V7#Jkt7#JjCK%77Z1_@B5kptqyF)-9iv@tM9v`8>8
zCSHda9@hXmWK-*#I1^}OQ+Yo#17qS71_p_(3=9$*L7a~a3=$U^7$i<ZeI3^VZTt(@
zGZ?AVGbov;Ku^EF9H7L=n8|1W?v4aN3Ye4`3=G<e;!HRB85mV$?CKd9Q&zDvFs5v0
zV36cxV36blaSk&uNUAb0NGcXHFs7ViV9+)MiJoU*khErCkhFwa9D9I)>D@U-#!RMi
zP*8&WumtJ{@EEAJi#XF)P6kGmsUT->WMGi=VqlQ;0CDy)Fi1u+Fi3{igLo$y7$h?o
z7$no6=`x-N<Rb<~70`eb6C{^`Ji+JzOWN@o42($upx6gl4YK(!#O8PpP}FEgi8Flz
zMGY@A17i{w1A}Ba1A`=J05?gTfkCp3fkCnbViz}Kd<fLCx6}9Quu9g)7l8O+qZvVd
z<M_|Wn89cUPyB%^K#7cjQPmJBp{1Pw1+)t+m&H~vFnudy2xDMO%z?UV4Je2}y(I=l
z)ihA#7cwwNPG?|{oDB0*G}zbmAe+m;1q;Z_%v{U`3=FvpjOp(n1_iOe(r^$9%t&$G
zLQbTDJV*hq1lF5o5$CN0jiCRnf|_ChsuQ$x#d)hZ85q?=*%=uAwlgqDZeplskX#4i
zEo5Mje9XWgc^$-A$G{+E$-p3`3*zi%V32BKV34W;aZWHWfHpEqy#TGJ{yQa%f#EN-
zItl84I!}OsQ7sIl_67rkbQJ@GbOnPc1H<2^3=G<>42)`96d4%)J_FZl41Yf})H6uW
zU|^7*z|O$%kAZ<f`VIqw^f_oj8mz;>9QO~#@nK+IFaeqrgZF?qpmg2@o~>p0Cj#+k
zs0rAk(<J%gSQ!}AEtnY?{wXmq$XGKl$e4rd&}U$f$z))VNd|GO7#QkhCNeO{^n!Tq
z3=A^s85m@igE%1!3^Lak7-TMiIEf4lvTO_tGM_-4JO&2YbOr|5co3(OfkAc_1B2`&
zSgZzxFffCnGmF{5RmFvYaoKN1&>4&jj8ZjF7dkLNvMXaKsDA-!nlfaF^Hzi6<tnH@
z*vY^kyPttUb}u^vqtsLe2HEQj46;`t9XiI)DM+bs>J>($E>#C|m#T)5F&)-4o;m|m
zA2TLsKpk)a97HF?c{^Ac80*#lu`@6xSTQijzG7gIeF7@?;)9_oUw~EK73b|_Wnk0*
z&1%OdGBC&qFfhn*u`@8n&tYJYGh<+o(*to<f(9xW800|ZUi>x&2Dw=b406*zGKU!$
z<aRJH$ZY^|&M`2^J!N2!yA9&pWT<D5mt|m(=QU+ujQ`HSp#7hLQKKIu^@D*yzKnrE
zz6e%3g()yFCU`I~YOG{r%wj2Rc)$pk@qx-5hR7UXgvCbWA6VwDfoCx$jtEH67<Y|<
zL8o3)oVS~mfl*VIoq;j#1p|ZpWCjNLZV=}y1B3i=1_t@vAm=bJFen%?Feqq&0>~3G
zdc_zu0Te(w+Ty%hc^Mcrud*{RdI~TwD8w)@D1?AGvJ4CgGZ+{Yx<DKa1_p&E3=9hQ
zKpayB21N-52E}>-5YLH$LD8OpLD3q-@n>LAEM;I&EH-6e^vq{q(D7to)LaOXDPdqx
zY-eClY-RvSH8C*g#4s>wZjohR^lXQDIcf*Y%XM%sGjlOEfYX4f2_$Bt6F|kLPL4Ql
z{Vq-hMr|cf_W<OG^$ZM(Ye5{4BMvh#D1uU<X$%8{;#UR+#it;dOa=xeX9fl(TS$q@
z7{7;s@zXyBMlD<LbOJlP<cxp7z+5BBz^Ih~DlAPv#j3Fj1JkQYMgv&P#s8=W)hP^&
zTIC=$@ODmu1XQ>WB<uoHo?rnLUWzIl!oc{Ufq_x$5U4OM1$!HzrvR$wCP)v$hA9k;
zAJZ8a>$N^YG{NoI0a35b0Z|VvaT2b8?0_hRNH9n+Ftb5>M2QNZkyxD$ao)YG42;?V
zvJA{@)1d`dbPfY^_aacTF@d%xqGy1U%`9==BcPVF_EAu<@-Q$cr7<ulC4o4S3=B%G
z3=B&3AdVUXgVII@2BnqI0FPb*32<#tBaoSkkpUL<(MLdjLUAKfH4y`^Nn&6%34=Iq
z{RuV+1}2k*kaUrx0e0CMabD1ru}&s41Cz-*1_q_;3=B$_L7d$T49d(53`+k&eVG#s
z49bQK49eQ33`{0h85nd9GcfA7f@E$nFenExFev+hJ3=p@hJ#xPpgIwx<She(GN>n`
zTmep*sgI$GTEHpuvN-Q2Rt83$Nz4q4sb3iwlxH$9C{G3jB1|FZC<g`xomWtWyI~5i
zFfb^egH_DFG7OA6jiC|YtHZ!#eGnRmz5xtO-d+rh^*UdWO4Qs9uw>v{1CiI2M3%k)
zY9SQEQ@HOP2IiXO42-(=NQ&|tTo{;qtPzRa7gPw{V_?)x0YweCc>^n&^CIeD7W!>~
z^l){NTmE|sKo)|uWH7>$uHPA`)3zYn3d&^Q!~pf6-w&v&2gs@_kZO!u8VszE0eMD$
z1qMc=4-AZYEXayyfD*bP%z^$sP&LZPY97F)J0SMyIU!5K<`x<Kw?K8LAxY<RFxG<_
ztZ*|xCB||FM!g<nMG|P?8NkB8>~)WUQEwwCJi*x=7M}SaFM<1J0Xk4c*Dw{qi=TiH
zhI)v<e<54w0P;6NQ3J%~`p79EKLF<DfGv<TppTpe@)OYAd;=1@`pHNZ?QLLWtVfF2
zKn_r=hJjHZ)c;}T@?Zcpa7tk_K#YM$KrK;dVh+5)z?l9A$_YIInu&#S!mcnd3QUEj
zg0L5ms!{(usBrf8R)IM?oB<+Hum6gXF^jc~p_D-hE++wzGvHuk%;G3zC}U7kZeW7t
zsYnI}#()f{`H|p(7zRcIOC*2gSAfcT2bhK^8wSP$%b~7|N?~A}JR8c1u3@NW6qpL*
zO<-Ww6N4HYW5U2_e3gOGU?#}nT+9oQ67IAGpn%~>fVnp&0;+ZsSS@H#Hl#3#DFKBT
z1ET?Q=RXtP`Hz{wz+4aN4;z9yyzn#x&g2{pNX@Ce4REVAKuk1LLh^3`JZr|BfJ!?e
zNf*MCQlbyUp@z9&hk`s+4<8es2C|U};j6?Rs9BSc&AI^cdMUirNQAiulowz=C{lnq
zH%S3%#vddziVTp#vK~~#WH5oe3vVzMX)rRTfrOa)ToA=h@*D=nBxMFhBVkbXfENqN
zd!WMFprWc8UN$Cwfmm&nfo$~#kfK^}!Ui=@(wU~)TeFJQrvyL(#%MAmU_em-^Uc%;
zpwt8p!;~DTxuD2~sVO#qCAL%@28NR=&`LWSoMVveFP{NEH;wTHXy_QcK|+*4pMkO7
z=yoInL&Z~Zo-WWLQv-17VW<YR&q1A<1kfnB@d|YYhVApkdAdx&r{FWFa5FHdfL6IJ
zNf77h@`Rk?t)j-jprQmF$L@iSW2@LRFsRrbW@KPAUI8^a2V^d&O)1XPC%{n8Xbf66
zWxR`lK_!TRLB)rifzkLl1A|I21A|H~w0dW#jscZ4pa5FTm<20e7`zx5n6HcTfUkTt
z09kQW2r`OZF9W)5oeQ+8MVzM*G9>TFz!3ICoF@)+{snZchV2B<`~b)~S3ur00WIcD
zULnpCXUV{5a-V@gWf}v6$^>-=hPD=Qo_IwDMw2HD3@SSr7*s$vNv?|$=Scts<ShmU
zmFo-)Di`IzBk(*)BA^j?1_qU13=AsY<iI2GJjoDOFsKSJFsSlLF)-|u6z55iWvFM^
zc#DBSRg-~1Rb2)$vTyPe>{Li_*&bkEOxOe|85ryoAf==UsQLp>GG#J>DuE0p4h2|H
z**SpJFfwNGltFu2Oy?CqgChu)pk+b<MSKhl0TqJNFW9oO)tmeTdBi{vlp;)CnlUgK
ztr6#O0nNpjns9;d^W|}qU|<lmV_{(6(-h}%2YV5;uxhI~5BS`>Qw(Md3|?*GJi=gI
z<xpLs$hyRkb%9QN2k-xw8zNrMBLSJ>Fk@iw&=lwX2{r?CL=Fd&IQMTz(5Wymtkw|c
zhTJO;8b1adqIkwpoI68@fzb@ak-sF)o#6`QG}ei8XYzq2PQY93#JRH}dlxeq#JRJ<
zhfA<9Fzj6{&YdI7P|s-Q0@?$kFV3AS#=xK)%)-F1N?DwH5qRE*g@K`ar8xIu7-zq|
zIQJ4ThYPejNu2vMgi}z=AkKYShJn${1r)*z;0xJrnK3Yk$%u0+fV^Zji-mz<&J=NO
zC9qpq7#M0+i*qY;)iW@f&EiUC5a$NvEM?GsoP&<y+$vz_M=>yDwup19MKLfG>=WnK
z1aEVC$iQf}3LIzR3@Qu^?xx~gulPWT9uzR|g-R+)7{s|=$%8~V85sB<igUdJuk-?0
z!u19m*jxqq#SG$HZ#hAk;0?nOMg|5sL9VNj3=HePiE~weRxCkE14a+%A`xZ_P&Tpr
zZBme#%OK8GVZ*>^`I~`3)rNsV)eMr(xvIn=rGaWJ1A}U`6a&Nh&*EHFpyikb3=FFI
z3=FE-a>)gy4B}kXpsh%67#LJr8R{8So8>A&VxW)&i7jPdP@ODSz#z_5BLRv~1_sri
z3=FEExi_B+;#{=~5UbT<7#P$7q!>V#*K^e=Fo3p9FsSWhU{KpG#lVogSe&a~k%1v%
zBLjolQw9dLyO6mvh7Yx{(z9}fF9U;SJwF4Z1&dsA5ra5aBe)o3U{IG}U{Du>)g~Sl
z42&6J42%{spf*)Gyr}m$11XX%LXe7D=nxrFEn2yPkujZ_i>n7#R(m`EwP7IHn$g1)
zT47j#Mgd_?LsZtD(1COdP_G9jof9xU!I4#@-qQo>f(uA4$msx8Hi+SBPw;Rt1Ea-z
zWJL>LzVn;|F~gD%NgBz1s3$E!gWYiZcYv%YuZIVPC)5*`$V1;ba67!9^|56kRy(|)
zF0`D0B%N~s=0Y!+3qcF<;7<6#zzSK_!sxXF>VtDg+H>KJ0q+Q?^jl<Uc+KgZ1Ddt~
zW!i{id<+bc){zVh@o&UA&w|ndq_SW%g$^(Zi-0nLN191uQ96S-XZ=}yNcvQ_V_;AR
z-M#A@CC+))36cxc&oD5kuaIJ3Nc%3%d0rSIs8PwlpphxXz_5RoIOheJ;86w!jf0T%
z$>>oA^J3)<2?j>5LU3KcXrTh?qN;rr=MooTV6+A;kMOE*W?;~`&%mGo8dUO{z`&sK
zn}I>&D?0<D*IWh$O*zmR!boGP7VuWE1!xT_sP5ws=a|g}ZHHPUFfgV+15JZ@R735o
zV1P~}SX6*iGcYhXh;w;@><?sSVDzZ(Wnj>>U|`TRV`pIWn8m=L>B+#L37SywSkAzp
znZ&@L83*dS`a?Up7CS(lTy-9C&U+v;K#NiQzcMgr)-o_?ma{W3f^H$yT*|<pITOU;
zXJF90%fO&{9mJ7gV9@->z@Yg9nr$pK7?=a==P)o@??;N&>;Py@$Y_}X84k(>4MR#W
zF#1DQ-Z5I%fSsT&&iPP;fzf6LGXtZ4H3Nf|JOhK4Bs&A6e+L7D7HD3>62zIxz@Qb!
zz@QZY;w)ld(5hl!(5e7&)-y0@b=Na6Xn|%${C6=hXf0%5(3%gDI?lkLwS|E}Yh4%v
zqyH61NLs?D8W|XE3P7r^GB9Y}WMI&`&HxR5%O{{x2HJwNa)DIjuqqxp{O|VxVw_b7
z*cbH<;+#)J7#MBSLEd0uV9<KSz@P<MaPH5~z@W{_z@W_tvP*`6L0g4^L0bmI(PUuI
zj$~la_6Kpy7#OrCGcag(f;i3$4BCeo7_>q2vHk%J4B8JE7_@JJWMUZ@bU>#4hK9bi
z2?MkDb%uIITTrRMR0=N#tOFqZJzH;30Z|GcqOnl`i6gbYvmpa>KG69Ld+^p0^)zwL
zZy^61VP;_T<!4~fDP>^L$!BL^1f4FaGo67!XCjEB$-tnq2Q-Me4H|Y18ld2Uacn>x
zHBh?qgU-{~=z#K$daXF;a}fqcJ4I#&M!#(g3_AB17<6v1GcfucW?%rFyQB+RF5q{8
zfk9WDfk9UpBy*R6LD!XmLDv>)xQ!13!^tp^;T~I|g9vUPz@|?Y=W+s>J`t2Njx#Xm
zPGw-woeattR~Q&{S28f@E(UQPGBD_#W?;}g2{Uj9$m!5%ch7;O+AMH;4Kk$#9^3#~
z=w}Ftd>imYxB5PD&iYp(42<@gAn!OcFzABZdK2X600su#&kPK@A3>a01_nK51_nJ)
zO7P2KV9*m~V9*l;$&@oN=;<;r=xK&AF#1h}8V+CX#=vMV0#Y@NfkDrefkDp^mbGla
z2^CZof_74aT;>f~amnZ+0}hFE;#`6thpl2}VDtuA0CGYkI|HM)6$67F$ksv-$DM&e
zZ#n~m9w<t^Ll_wJwlOg1L0h|ww$K{G9(f%Kv~Gpv7~6UiP(=zVv3y@aoNwy_U17;+
z>jEvYV#GP$iZC!bfMVVE4+DeV1qKGaGa#RFGBD`9W?;~J4&sP0FzB-|FzADmfHDJv
zzBB`az9ckWY!hJd0$SXa0gIA)Mqg;@Y`XxQAzz7eeh^_`bZi5q-)05|eLV&SeJxOu
zoxs4LAIQL<4=Nme=Q1$pw=*#4H-ltWF)-*aV_?vqr^vwQyPYu%BzA;>LH{ZPgZ@Pj
z=OP1x{znD|{nsGQJq88?AqEBm0SN}ixcW&@UxT+$YH*3Oa|kmqI)Iiw#4TZ9FwkIN
zFi-#u>2G9UFo<DbFbD#1_AxLROl4p&0F_*ECm9$FMHm<ic|h?9n?SY$FWu0P5@%QE
zWngp!ZMXx?85`CyFc{W=CXihj7z}$E80rl{69%BkW5c-&42H8|6}DXgC`~gkI(jiO
zW-x=U|Ai)Yy9Er)3uZwJ5j$|oXJB-!0Hvi0Q0JJnjG>%C1{S{_Dqv$I7#MxcAs)5o
z0R^*$mN@5UP%zh@1ckFF1B2lj1_ndW{H|{p1B2lq1_r}jpukFIU@&~bz+m_Y<T;<i
z5Hmo-lne|S*5aH$MHm>JjF}l2eXcSv7=C47Fa%{7pGOP~Mgj~BMm+2cj6Uxf7>slo
z7>qQbDZ$|dG$nv4Y0#`b(^&=3xBz4llL<U4$LP}uwdxDlxnbg*e?%A<ozH-*n$5sq
z<iWsT<N`8%1p|Xo8Uuq-0*JGffx)PQfx!qgOP;(3VuE80C`V~zinFidWMFjO&dk7=
ze2#&^XfXqW(R}uL2FB#u3=Bqx7#NH|9!`G2z+m*2fx+mx1OsDA1>6W$1_q5ramIg~
z42({oeTFGr3=GEH3=GDcpb3@auM7+t6B!ttezP+$CjVk!FqUFqFqQyGrEoAXXe?o1
zbdCc}jPo)u7@IRN80*V2Fs4YEGBDPss4_5U>}Ozf_5{hRF)$csFfbUWK*P%M3usCK
zR1wrLz-t1h7MLIhWP&gy0^&|516X6j3AQVSL!60GfPv8&v<WUHi-EzopMk-+m%)R9
zF~t<5ss00_(+X%dX92muih;p+0Rw~a9JqCkIiM~yD1lWmFn~%59~Y3$4~$M*;MQ${
z8qpxm#U#SO=&}P8PhkuU#yc4pjJJcLCYOQ1_#^{^@$oPQMjz<hveO;--UkLo7ZZ@O
zY6b@5n+y!b*BRs)n5NH!SmewDvj}uSC)g?xarT3}42&*y%nVG^moYFHzhGc6eg+LS
zX9)(T>CZsJ9bAlG;Dew}FF>sWXwGqluHLD4S%uvAnE=Z;&Y-~{A5fzAhECKtn}Ac|
zEpaYB5e7zA(0W?$ISdTOpxFKaDvVb$Fn|_^nShpEd2eH2F!5(#Fmd-_VDyG&8)w+i
zO$kW(5e5d6GKP8v6EN>01A|E?1A_^uJoCQCz+keRfx%=ccz(lcH6#>Vz;izuZ^gMp
zL>L&|l9?G8z4kINnCxI+FxdiXu%2RIFuBaYU;<iJ>vf%h!Q?XogUNf4%o7F%QyvBe
zQ;^fVJ~A+vYBDgGDl0NDdU^k2n#fVi!064*z@YID<SvjpHwFe%7idVi9AIEB-Oj-1
zddY=>G4>0ifeQm;93Nti!Ude285mu^Pyge`Dy`+}0a5QJj$OTL2Ppe9FuGY!cl2i!
zu7{Ruu4_Q+G@udadWL~9&IFX~Cvt#>@IV`@<QW*fBq1T;22T%epy4P`g0K<i(gKCb
zO;D(4GccHjGBB71gZys6z+jrfz+eiR9rJQ!U@$FXU@$EL$pkSlnD*8)FqndhV6Qj^
z2Gh9=45qLVW;Yd(8$jvZ6WWDwOMoRqH}IZ9(55qSE+Y{JMt5mu21d_+3=F1g7#K`J
zrKlG-1B2;q1_sleU=#L39o_&p0k$oyK1Q6&3S>kU$cT#!45p_U7)(!s=4|gVFqqz9
zU@*M_4I;N4po|EsAxtMQFb3!|FuH?={E^y^raKrIQ|>V^x`UTIRlwVorqE@Q?st(A
zeAb2OO#!Sr^=2ZF4xT&mXm2*W|7Yd^vCBgQR16^6s%Fp;RS)Db{OkkZfo8bHW>X+$
zdqf~voFf6tX>JV+jP>a?;9;2;42&LS;9(g727Lxbk2DnqhLw}VIYD>yGQ44AVD#83
z1nD<gX@a_qERaqh_=FbFStvYG;+(c3AQ{l8PNkMOrx+-KfOL8?L3N5D>y!X@A6e=d
z7(iMj!CE1mNQRG1p!(_mhYw7ZJ3xbTo}0xvzJW%eJeNWS=Qw_V2j{p77{ob#f=}vT
zVPI(L5a;*>K5mDFfnnV&agJZ0A(<)`28N`~;vBy~YnDNr*$>1yeu2v9DzI(!42+&z
z;npRHGBA2VZc!2EWME}r^xVY&5}FFWSOqQwI-X9a1kQy8pyyU_01ATw&~qst1A{<>
z3IhZ43vmw6y}#g4^n3#e3y#Zrps-?Ls0a0>Ij({O0~B&*uf;h)w+Dk&dr3l7A69~>
z1}i=aSA6oLILA6zFni@d6|YlAQoI4In1z91qP{rCMi~Z1uN<xvP`GW9WnkENi>n?y
z^2@OqJirMWM+m>D!oU!{Qk(;H88XBbtDy!@(?T+M2Fzd{DRGXO;OGOnKbb|G!yV=%
zZ)vDbcVwO5+xMVphNIpKtd#{ktjysJaTLT&pnEBIcCj!pXo`t*_=2qyfGic~Xp(^r
zR5LIHi->b*!YwR?TBxav<W%qhQ7{X2VD=?>i*x7-gO>6bfKvhkqjxJjA)J84sdp<l
zPT4_m>Rk#N$#oZJ{{Xk|EyO<d4@ma0e*(J|bilThI6J7VXJ!vdF?C+z9Q-;AjNWfq
zK-Z{=a|oz0Fmic+0-a*EK%7Hx`i2lzk@~zqarS#K^L@mj=HCOG4+`L@+2ZUc;qop}
z`IF$R1sN}9KMfwE1u0JZEY1$Pq#7KLKAlj-TU0=S1G<qIa^El{FSBn4IlJCKfD1I5
z$i5$RL7@Qy$dps=;_TDmRvw0$G97FsR4-)r01E@ddKPi^Ss;T9KsrM<inEu)b^e9w
zEJxN^304dZtSS-EfU-SEYs7kS_Ar=MUvsF|Fg1|Vp_WD<YmEfQD@bQYwK%&CTxTIv
zrwup+p*ro5b=t#qPCq4H&-N3p^%X=b+fQ(KLA0_##`GcXWdpU0&Fmpt7T7?Cyo2Wj
zYBq|q{RQ37VE{?4Z2!Qyi-m!KgGrq2zZe6<#tWd~Y<30_28QHXkeiK_#Mz#KEUpKY
zn0|&(o1Y<hm+b|TquE}99Sthnyv5mGfn`AEoCz0ay9hD|Y|Ij<F&B~i&UP8B80vv5
zU}K;j0F^@Z3<g}84B~9pz-b6GV_bkF54KxiQ^3hX^Nl#$6u6zQp>|GDMZ^@_G_Y!@
zozuZ~vM?}gHWp`_A;ZAv_Zn32gv?T5U~sCRC(fn;Gt55|YM2JtFir*r-zaf54bY%I
zC_7he6KB&B1WoKg;|4jSv%xcZzyxtNU18AV1`BvXj7<;h0I)YfC#o{M0fn4Xr8w(%
z9#E?o6m<TNAvUvqM+!RDpGe+d{RJ@vJW0k1NfjU?S-}@tgN`4|X%T1r3#x-|u`n<k
zVGw8i3!0g@1r0!cuvy>$>{~C+dIjp|dd2`PsMS}H%5m0fVC9eyWW5fynuUR(*+QK4
z1`h*cfEFkO84f!#Fig8C&bm+p6e!?^4}%VLFCR+?X!JKA!z8aXmqDC$A?Q*(0|o{&
zMg|7cj||Za3^HHES^IdEA-c3-%YGobR&Yavbwofd$mwyBtP=H=;;f}eqs%5JK#f5L
z1_rQ>KnKVuGi#|aDBu|w%zPLa%se1N$E@XG&oD5Ur7|#>B};*u0IU_@C}LnRD`8+T
zD}tsxq`g8PAZ}nZ`NF^$DacsQn8m!9F$-x_uJQu|LnH$O?+$TR(DB|3(6*y7%q!qy
z0D?-O4huJdI&2~XgIQ-0BpM^Z4r2_5x-$yQWneJd&A?y=nwQ~`5@(HuxU-(Y>=^@t
z*(1o*DQgTki!(5o3o<a6^Fm!8)B>wesyLt<nM|O&v>1387=u`(7#M8NinFFcXNt_V
z7#PgeV9iVu4Uk6}7=tt+O+O^BR&g-Yvx1|9(ZmMaG-V8O2d(=kXW&p!;ZQ)B5yQZk
zJeh$pC>~@+IlO0S(!;=*oCOtw)pbEF;JQu>RM!QSL^3d>r;4)%AjPpUcxZ)zfkB6H
zPCWx-(06E92ADy@(%grE!Q2Dt`CxXq=M|t)XM6|bBT(-UHRh@m;4}Qe>|i%YfZgyt
zl7XT3jyS6qvKuBq(pf#o5e$sMRZus0K@*yJIs=1wGSm%-<WuDUbHf@OZg2pn9;R#J
zta3=!8A7*$GTs4YpHO+IZE_}{ipqt7!Mu%u!MqNdd=$Xxg)tPGd=$Z41_tv@3=HO=
zEpedaqXf>o3=HOP7#Pf7KvR!0H1$}BGcZ_ycHn{b$swhl2xw#*z5qF%fic7al>V8(
zo0;LE905x>hJPSQA|woyBudeegpmv+NrZqlZ6Wnuj3$7R1OsD88z@;IdKyM67#Nd9
z7#Kt5p@`Qr8eM=&Y(tS?G-d#gd@+XHLQ1iFH9);d5112;MWB{_LeuL35f9~pio;?p
z17sIe43x_Q>$}BSI*}qu7n-qHY(Nne@dpx7ES*M>q-kNpz+j;Rnd)WfhDMA<4+Dcm
z3naE!dSHTE85k@;*CX*riL>-VGCPCCLk0$myO7vo=>x@9eHR0Rr62=?C8r$dM0#-+
z&^0Nbvt=!<7#J+g<Z@E;7{pon!SnSD43=RG43+_M$qeEw6QB!BEbAE<EK8*r82I(Y
zStf!f?->{@_c1V7u7RfBNFI3HcK9+ds4Zt;3^$ZwVA!)$oaID4=(t(~1_rAn1_rAr
zDFy~Be{q(RFu{2Y3|7-XdUi1|hUH5!Ft8sMXE~z`nZ~oa!@yt#>)INKfJQYLKx)r2
zFottWF)+055odV?RSP<*)tXg`fnnosahBIA;PwiGwITyUy|w&YMg|78hf)j-f@<O{
z@6;iNTbnX4SnEqMFihSg&hj267{$O~9U%oezCxVkFHA6xfx$Wl+QT+9VPIac1RC3h
zA)viOpmJiO0UHCnJ8NJ95@uiw2Q6l-XPU?X>&O}efc*f?B)S_Q$v@l^lwJ@s-ntJU
zz2Wdiq~0)eR32%@yQ%{`<IOS+X1eYd&_F%Za6KMK0u8TU1~R=2?l?Ua&?pK6WB5Lh
zIKoyv7f6;3e+&`_jljbfk5zTRvV&d$)YRV~MM#E%vRD=aV}vl8_zQ-5#-soS#t3bY
z1j06b76!(ohYXAn&S>H?pp!@#7$c%V;)u+x56W+o85kpqLE;FD^%Ee4L_{~LxB+yR
zSi~yO9vE2i%!04LHJAhONCbFQH^MxFEewp&#~BzSZh_20OsyF%0EG@n3_WCEl~N=R
zxIz#CRR|G(>=_u`kBGB0urbs#Mp{A|N-Pba-ZAJ-wt#MNmIh-`+XvL5(-RkGDc}XI
zqhVxVj4Wq?q(0CE4h(NV&2N@sE|4TFv$ex~Q)vLVyB%ydAIR>=@-ha7xGZs&49Fn~
z^$g!(wV?~B#EE=m0?OSPQXn%K7_1u^7_6%yiH70(0|v&(R}74iS3w*7Y@u^e4BtP1
zgdv`105!ox+{IbqdBOEM!*|#~R}9GXsHtGn<3XowK4f69UdT|-U_BSHffS^iiGe}3
zMw|t7>S$C3XiwEq1_tY03=Gyg5DUr~zBfQOkb+s@suZ$;6z0?gpl$pNj8W~NOtP3U
zi^D>N!$J+37Z|>8VPK4!3UX`xAqR05GpJ*~K?`4o4<N@z9|t?uOa&SgcNiF~FM*B+
zvlC~r5MW?nEMs5*-GFYx3@uPyKm}?S1A~n^1A~n+(qghh4!#TwvN;Tl(GhYv#YGI_
zEZ{C-6$68fwk-pLjWx{GCJfA}nGB54rr<(DfDInRAq>o^9n)=+StaXJA=9-C-{wGv
z0zoWr2rzJnv)FPnFh=(>Gcc!dF))B8N^QKLxs&1B1@L$zV>BqsGjlO7fQ81l7YvN)
ze;|bx!*>o)&_E&>bkb(mL~#~baQcBnX#Ee+Iwl4N21amtiG2hPBw1b1N+$*en`8zC
zn@Dx=iYFFX&~=vv3=B5Y85nH(p&=&^3%R2V3^se^Qu9(6#91IM4h9CBcMJ?RFQ5f1
ztleR2#=u~!1x?=`_3)(`RRxg7D8moX$+Msk@L^z#c>|3M74SBE1_s-F1_s+~XaN7{
zft0B+pdes^FQ#Ys0bRWka}ShUAbX^ku#~9<jEwc^%v>z0u%P>K1{8FlYDabs17qwt
zX!L4<x<OS847RNd47Sbk3{0~iJJlF|>cArHC+JvjkfV9TSqyj?7-JVOGce71%)nqf
zg@M6#k{$!oEXYCwkRFJOKrB$t4z!Jd%T!2@fjMnCBvO9rz#<uLEDM(&j|T&D+77r1
zkYx-EEV2yDX*)q|SeX2QB)Zt0;6x_@Pjo+JKoYQg4NV?D>Qfk)rmKR|hYPsZx8aUB
z3!^w_9E%Z@yf_&cP78>$FxrEvQBKg}7jYKG2nGfQ(CreDe&Q^QpaX>8Kt>c;n87&)
z)Zb)*UMHu*z_8d&ocR&lM9`Ik6E}!6Kk@(#^nvc7(3BEqehgc3*efH>{1|kXI@Cz!
zr*I>gp$ARp6)}i2gGVL6J><H4apvQ2<F5&UyG+c-Z9xu(IE(ot!i-bk0R%3v8K*$8
zS`RklK&v?OLYN`(d{BLh5&D*Z^?^qHq{Nw*fHZ>jY1|WM?gaA~85rY(IT;vq&xtd4
zT0s290P<)Tj05soH)xR%=o&e3=3cOg44{i@r)(8xcI9PcU`$}=WMD9yC(i5&8VUy8
z%&I?CoY`F)ECWe2Op`aLGBB8^iZgpCGcYEI!>Wgg8(0_^T>HhDJt2;U1cMj2^~l1&
za6(C(*$XoGlgS{?><zXYG*Vs9><xB5R|!ZM+;W9xO++uHvO)kd7Q<W!U5zNnzz{wI
zWIebf;b&OI$iU!#m4Puq11g}xz+k{7&I}&{P4Iw*sW#YoprSg3Nt{`X7qW(kK^v5&
zK&f~NsHjfZl*+&m5-!dxrU!~f#w<t+nHe%V&%j{2gn_|!5okFhGx#E<Hw+B6yBQd4
zH_Cy0Aqn;n1B2}=1_s+lph8bgS)A$b^fwu-lJyDyOu#|I^cQr&u>k`E=!z{n9?-EQ
zO#i{5!oXms&%j`(3L4`t{v^(H6cjUw{g5$!rsLo-erOOS&W8nmrGqGF^EPBap6MKX
zj6N}ks~|0rL7eG4IOISR3x}-5na+b3a6%UUGF^ZaZ6E{cQ4Ii%&+3$j!_0#<021ee
zLs=Ts07&e&XJBB87iZec2HFTN1YTUswAl!>xLBxwL7ZueE(62Ht3nW0Y^jHo;r5`i
zOq^*JNY7uWo>}^EJ+tLNgMke83=EE$;!KTfpk?_`RgGqFRZXg(WDaW6Ea((xDgck}
zFoK$!kUYp#06Jm@bhDRJpg2<j_>36_jz|UuIYV)#l<8ertWx!xp^=dS9oDs*!@yuS
z15)HOr9qMkgWXOB2D{DB0!s_riv$&Iiy5;R7`zx5bgIRf;=qU1fh@lawLA_~tr;+Y
zE^OI%QJg6foF*I@7<yyGnVi5J`~Ux^D`&F`)r*8eQiK!epdACoERdnWdg4r0Fhi4V
zg}`I~OjcT;f-w-Xtla1|NMYL(aVE&2dW@hpCe(J&G7$#oI4hG8#2;P^3_(%iOzLn`
zCqqoFXHwThGB%P2WbF1LaVB}V$~_R3O!AoabL)sR{uBYl2_pkzN(97y#-E^*R1F|W
zmhm?@$+9potUNBx2pI<yWnfI<fTp#2Hh5}HG3Cll&1Dd0Vh5*IP(jYb!3(;r4U`f&
z?Zlb5KwGvA7(mlcDIQP*p!z{dK#3K~1^Gf+Tb%JD%oiyYP{(})O?nxC<X7$zXM71c
z?Gfbq8Bhf;Azd*q28Pl%;*3{7g%W5xLdrcz8f3g;4e~EnW<G;BBV+^;<Wfe^RizAX
z1R!2uyb1OK_;m5@v&9)_gOewu@?5b4RMIdoFr5GuHub5OA*qmYHgxpS?g0aX-6c?w
zz&ICLB-q<BFxXo{5+)<0K4D<64`pDm4}`W_R)LCakhv-hjH%hG3=GyA#TgHZGBBoI
zh7}T1VFw2>tOT8<4^nKxz*wJpRF#2Ys+~CFX;B7-K316O(;m<yze<LIIiMD)C3D&X
zv^>TJsdt$41GcJxVdV#Kn@AAc%4JM_3@$1-L7`owA<h`g3+jh3f=;yOWMHu0BF-3G
zuff0|%n!QGbBUffqYWDaW16-QI2kb7fD+aLA@HC9Bd8h7U;ru<)^mz8>VniIa56Bg
zStHJ<D+_8aaxyS<trln0)drot&joG?GU`Ky6+qX?_Odd{fy19s7Zz0DL6Q3O8g&MS
zqc6l6<v_b+3>X;f3mF*fvq63T=?si%8^P<y8I?dW0g~)zV6g9noxr3E(gF%d76!(&
z+fbFD8)iT%=P@wY&w;CS0VxBuwHO%FS)nRH0~7TirE3`&>{r8;LI<ZASQr@7^`T0k
zC6xUh1_t|GaFw8|3_<3CR7OHoLMs;g(+mvuC!tM#M%@%pHy<eyvm6*1GeKj;^$ZN4
z;Mo_zC<qQ7hM%x*O9m);rayx=?0(JwnZUr94r<uJ5=k0tS0uwv==QDj8%UO<3&2{o
zKaYS{B7=4%)NW_w0F{edEyWp`c^Fa{7~VW(%*ZKW5dR5Tbja`&RCt2C<pXj-Mi|ru
zPXiz>$go1PBFzEnMTV!~$$w<22nL351_l#d@hj8&3s|M<XQqKm+AH9E#+ap$$sm3e
z6s>O<80_ycFxcN<ux4O5HbESGI$Oqm&<*cW;zgk7JjDy%d{hLAu>T-c>#vFDvN19+
zW^zJQfiL$w#haQ~!62S1!@#iQHE(JXh^+=;Cs#0t*XJ5QI4K|rD-fFjbg@qCS@CR0
zDHX%OATUoni!FwMA<<Pllg*leLDO4218k8a2Lr>hb>bPy42+qMpotA3UC=$qM&jvU
z=>&*$x*}NGnt@@ByLcK{riz1s!DP31nqocp3{-0d2G=z4RIt<(h*YW^SSE&nfkRF_
z1!TMK4)J6VozE_w1fmxo5l>_Txs~UycminfX&GY-14E>%csxjUuatNkh-L~Ak7Wbh
z1YVw2?hI=By|H0nI4;&R0nBD#X3UbAu35w?Q~#%Df*t5CDbRhi632SVAo7e^t{e;u
zhZ1|rK$ijsfP=iJ4745X4M-tBTTc#5VG=}P4p<>b(m1gPJn{L4fibHdA{ha?NIL)|
z>G`S$JW~#m+`_@YP=6?~#}{<@Q~(D9!`vl3zRsXJ24bHdD5HVx+ZE6Q@dN{77U-(J
zLy0}kNSd6%nixRd-NDmi2zHqb14H+<9&j`94FhAgFvKAeCZJoDI6yZ`^hh`|Ffi1E
z&0iYd!vne~Du978+kk_C!D(L)4=C@xVTfU1XyQ-}2L-WHglYhzH3LKAB~@2OMh3?0
zC~XFYpjK5+P_0x2N{P{PRIR`=B^(S4+J96*Yf}UdfX>@3;#M_*T=2x0J&}U}BxwSg
zc{^1PI_Y>tsH!d_C=wvKz7m$_Oh9=qN3V~OfuTiERTt#1Q;b<^3=Cq^RCOUWBZK`v
z1_t{ddJK#?dQjauumO}xSVvSxRUdR6N{$@^gM&N+gM%zH17nUC1A~J;Lp_57=xq3$
zFa`z(2L=WQ8+Hc9oFoPYhe!qnhj0dv+k?tgr9f^sU|`Gv-7o3ItSTi3Ww!{bN`YK^
ziUaH@DbVG>pb=5+KdLey=Nf==hv1b828Ow3dYL&GL5K8b^fH0&8U;`J=hSZ($}eE(
zW%{Pfz?ie0E3cTLm+7|*17pq}NF$<`>9-;SW6nYFdEd&xd<+aL=Yh_x{0C~cJ{DuD
zWMp8>0bSn5vtNv<QUa8bIT;vEtrKIa)C6(3N>Uian5rc}sz7d8;`oe_fni;S7*jCF
zPj4WbTo}|cKxG^Q17iUw$aBA|Gcd^Oi7^F({7}Wf;E=_@;E-lglv>Cj#uRMGz?l1;
zfx)4Rfx)3koq=JOpcqq#7%2W27#wypFgR>fXJ8OrD#jF|4srqmgTosJ28So=3=F#+
z#F#==85q*t7#JKS7#JM+yyU<RjDk3j!O@k0!O>AJvnZKCj41|GAf94iaO`DZaBQxG
zM6bFH17q$<P~W|jfdMAgz`&S$e>z7QtCoy8s~D3nC=Y?cTJV|}lN}=iLwXh?17n`q
zbiXoIvHF}};HHpdxfl~SsQG&eV(?U0RR<pZ$rpt>m)jWX+#L)Ij$7ow4g*~b3A$&<
z@iGI0<N0-rpul1R-AP;}#lVmxF2*DTbNMR<2FDjc42<=VCB_U>Lm09c85nrl#h666
zm>C%BJs23Aco`U+xIvs81_mct1_me4lDYZ{WSI~K1}9wx1}D&U8}$hc3{G|o3{E!C
zR?*ZN2F3<X(DaQVBV#&fOA5nrMh1on`O|&NS!L@_i!r`M@~1th?+c3U7oe!lKcddS
z&}kyZ_*NEt<TZm+Is=1Kya}kGBgXhv3lf1&y$lRaoe+;Qeqvx?0D06#TZ|Eu@<1Ws
zw330rX(?o?fWh8_fjPMl>NtCqFQC~bP=pn;fyY&9zKJn{7towyWMIty#|bJ8rt?;?
zO4jR%F+Kw?5Cip8w_g!sJcs1&DX>j0;3Qh`5gZkam!To;bO=;xL0xzS>cVaxF-CB$
zdWwO;={5s{({*{IsE~jSSWSh7NCbn77~>5t2F8NBpx6LK%_jy1C(vpC^*Ia-&P)sp
z&Y(*Nz)=I231MJx7Ghv<769o<U|?`oW?*nug!+D}0Vryw|E*w^44Nvyz?=fwxx#43
z0Pc;6W{NQ$0{hUBfg!|8jBy8;14)i*phXm*Xwm>hQ(-|WD3OUV?f`X{s~EG~KxgGo
z&!}Vtoo2$|Y{bCeYydrz-Pw_W!5P$HWnjqvE5^7I$<SEP>AxUDcYqDO4UMo^9Z-b9
zI3dWK8f4BA5C`hB*ewi<wNn`xv+6<K0j0O?_ZSxogYp{G1F)to2jd(^1_pm|F~&M1
zr%Z+}M_>dWq+VPKiOv>ibUFt!FgW{z?pxd?#t6Fh7nI1HGZ`41L6@L$+KDmF0jd1Y
zz~Bsu4d*fmM8r-$0XjB@r%;Tsg^z);2(;`Kl+B#m85o>fL6HQCF*pYlW78QJoI%H{
zfn#|k1A{Z@{wc7zyBHXpcR+nS`3op6K}}VzQqY2YCXNZ9BX;XK8bC|GnUl{z{5@p}
zEL}|jUt++(07_PK1Q-~LH9&Vb++$#HKFz@3e3G4kIr%jMgY$g`2Isrbz@Kt}fjNB>
ztfe|d0~FxUCg+qGQ1W45EcOFA!NC@`-L9TtN(EFV9V}z70@ptUq#u--blk-l(~&}d
z8mzF(0VRZzen?@*m<}!MoIf!zIKP2JNe(EWPcbmK2r)3YfVP**>xnVuLb54?izY)o
zgNr((*kjCtDYar?a50krB~eJ2OzQz9I-av)j0LO=j3tVol*-P);1b5b;1UAjh%hj?
zq%ttLB!iZf*SA7-%>XSc=eaA!Sj5S|Skh?6z*rBuRi%Cr1A|K$1A|KmC^qZYF)+Ba
zGBCI_gLu1O9B8CXTL6i)3`Pe~+2{c898ODMV66ND3Y(}WVvG?;VKWuB9wh=4Hl-Pm
zV2FkJZ8`&k%Va4?Zj1x9;25eH7+gS(0IeVZ6*=)Rr3V=pTy}#}Cd@-DU=M8<V+73s
zl}3RaJdJ_D<ue0=%SRAr5d(uO8v}zYxRhDPz~E}Zz~BnHe5HODj05wR1=L?m^&AbL
zWC%)y&_pzi0p_)0D=|iUB(F_?cJ~=(fV@^V1zPrluC*3YVqkFfW?*o2hnD^J(6Zk(
zoq@qM`8gw~=3@j+;xU|JkYZpkStZ8k3i4?EDFz1DRt5&wdb#3~Vg@lrH;^bu5agQ$
z(2#P6CK%Uk3=FPY<QbTgp^lvh+RFtxT!vvHsCNTOCoE!&UQ!H<WiFuXqRGJEdX#~|
z^)M*Am@zQ8USVKxy#zXe9%@28!$b{Oj++Q-i$RU>;b&khYl9i_n1R9dA<T$R3=FOx
zV3}mX4OnQY1dA~WA%)h&0FY4(42%_^(5m>V4yvid7=<($7;4`zFu1WZFu49VsfSdR
zLdFaXphC*cn1R7f7m{Ygp&{WG!NA}a1PwIM*_dF3O$-cf6;ccghYH0Q!DF|l7#Q3(
zGcdTV2Q3G9EXF7W(!Pv=!R;0UgWDNsKuSXc(p`dq!Cee=479AP7$fMOW00Zlx(p2N
zs^Ad^F-BRC{!`FPk1y*mFsKBBc7Jd{a@R!gnNU17VvMr<42%^_pxq)MGs_ql-1Cqo
zX(qNnPpf5^2%C*!;fk|>&(YL>07*dRTtO^In4wM5Ahg0KX+UY<C&Vd}Y+y}x5DRPo
zix{IJF9TzRjUDLb7ibaTzLSB$eLHCT3vAYD(gKEh$R=WjNwDitIK&v0MHv_?E<vZA
z+)pqtxF19E(WC{?<0}w)SWsu3CM|%?I>Ajv^AJM39_}Mpimm}AC}=*NGyzlug9d3Q
zO0a?3om|hv7@3e#*;MFyDF*O?D3yO8NrxRAcMJ^fHyIe*uR`OV0~Yrm7#Q5&Nii^V
zJBcyYb3&DZ?(ug2i&W}PJp&3#p6OzY+^h_Yl|7(PWM^RTkYHf&5Cd^U7#KX%85lfN
zkxSjFH^7C|axq38E(XTRcgUqK=(q+CaCx+jfx*L_fx*L-xt@U$R60R;P+w1d04trq
zN8m7VAj;jT3qYX*8Vp&;B?exn4Q+o<fX#b=!=b8C6I{f8g?iZ|fq}sz%ob5@OsIgS
znR*5g6Xa6{7O@|E42)I9&`j^q#lYav0nPLtGZ`2>ro%J+1_s8eMvyDE?hpg7$A!A0
zAG(~30enb%&2BZYD=vatT?`B!s~8wOmMMUWLh$<AQw$6q^~V?(JPs)&CMPq9U5B~$
z0Rw}_J%t<wu^XVsdBecq@tJ|a<E<tGgDj`mO_10r1_n<91_n<pBtP}vf%=I7#DaS1
zHa7!fwJX$1o}mm3o}jx-lFb+xJX07LJd^4{cT>RbP3r#wD+>F+fb}ylu!!B~WnioZ
zm4u)xlst<W7(5H1vG3W$z~I?{Y`_HA{vn15pfn0HgG1~ID+6QoagZK%1_sZ`3=EzV
zK^zeV2G2zd^$ea1z$QSG{{#`}CRv6Fhywi?Hv?l0_=-VI1_sYf3=Ezdpz-2)kb%K-
zKj;D$m>(v98;(3OVlOxu7;9`nHi4|Yz`)>n4#WXjd!K>9^DcuG17m$_5Tp#5U;|FJ
zI$|&RKsD(!1_sX$3=E#{K%7Mk3|>s284?g@9Rq`xAOnLJKZvsn#(^f>2`-?7JN;M-
zt9E^d*kS1E2^(lzmEj1eBB<2@U7)jH?64f9bL6GOz~H5z2JUqq)`yB2GB9}QE0p9H
zGl-o4Z-8N7@N#5e@UmA(DJ^CYI|&mDU|{g_1Es^AE5){fLL8b7V{U*pK7fKBd@@Sy
zRB1$OD&_{Lfy*&lY&R<dV{IcSOxPJ1yb>4~yy8F{5e5dY5(WmZBG_<bECaNy4(c0%
z=EGiyEd@>G)t={IVA$R(wiI+n@*7bG#@YjHU~jD8V_>LX@)~>#HqU;s^?VRtg)=a;
zWr+17HS%F&&J5rxvQ9w(boZCoL}&u{YGYvVYJ#Q<2N_UF2;(?_I3RzQJ`&4B^7kZI
zQ2(h1g>}6-IJ4!$3|zp#;5AE=fkAGCSSd_wF9U<uZcPS;1G~h)*QK9gVDLJ_z~FUC
znt`$YI3#sUg7gVO#q#+W80+4HqW%U0gV${a1}|{`;0XhR*J}m_ua_X14-5=m{~78T
zyg<iU*Z%?Y7`*;MlgOk$pd`Y`n90h+z+Jcjw4n>51vc3Q<UOcgCntb7&{q891(3FS
zy&`A}Uny+8FT>;=AaPjxok5F%LD+tmSTZ<d7(vOL15^-AuWx4+uU8dI24xY@m{XFs
zSh6Lkx68r6u=jviGU#xSDv<6)x5dEcQGxo{^~b@Q#p1xF7zb!ZS1b-Rd<Hck4rCf=
zXm;-bu{f}4AQPfriGimIK_)bShL+{^#3Dh1&h;RrcB*2Lpy5fV5s{$Q4@i9P0kKHX
zAXpVBZV$(ZfhQQDX}S;Ag9k74Zv3hNPApEKn^%+=7`(+87`*w^z^-!wEp9x;z~Jq`
zz~F78#=wx|E#?Fo&8uQy@UD+xVDOGm1AEvBG)f5)1mO~JT5*S_3-9?14Bj)rch!qQ
z&XIz)gg!VhFdUBYWnkdpVPI^`*JNNwJu3#D`Ue?ukb%K_zb#^2OMeZ#L<Q|L1`U}q
zaEJx)GB7qqLK_&~7Z@14&mlE1`fFefjDDyd2DAo7e+{gGfusUuSqnlO-oAh)!213a
zP=W%tDLB{|7_1nWrbF9weP2K&1NR>>4}NHK&if$)gZEt|xAlF2+1v-OA&{GM9~k<+
zFt9^%4U!5Zx7CA{fQlyMH8-HyFs=|IMlMDM#wO6I+DH0~7<s_;A$aoDh*1PQ`6|l5
z*aSKXL8rusQIr+7fv?F4Jc9}sf((AbxeU4t45ea5&p>AHVC7(7a1fb3wTo3jda)qr
z%sG%G8v}#sZKDrh3!@kq4*E>L(8VgHXv4rzEM>F^Jl4s;*euNpS`}clNCz}+3NeSf
zn^m!XvC(2s!UtVt@4U-snIr?l;uAceWy40RK*<R_NWSc<Q6<crMZ7tsc??FCpbaCS
zEWqJoRH+A=JY-{FIMQcS4R!__1H+sWqZ%m&#^yzA3=CqeMs;ArK;o4~Jz#N2nyhE^
z+{(bP>?*{{>0nh=AWs<05ny9r&?zyh<%Ev{FFv8nz%V7>D20)Mv4xF;fniRiQHnOm
z5{TzgHQ}B!N;Lru%kq{LFc_t2Ffc5!;Vmm<FiLY_U|4(@RAekR0*$9Im@b3(CtZz!
zfngbF(7VviNFD0gmczXH1q?>&TA&eXh}*TnZl50C!>T6n%E&;Gfk88tr#PL#$WWYt
zvE?uu1H(zB>2rHnmFv5W?7+TZV_<N$Gy)x^#sI2lTDCyEr33L6$dmDoMjqe^cJNk%
z`HvVFTP}lVY?(kwYhj%sBM&13V=HK1(UCqwMm}&5gOipaqZlk{weo_~ks+fvBx%))
zGBCC(po&4#7F-D^ZH4C=9s?P^5u79pkI8^S4V<D3Pk`-VV_>l9H3Zctts5ax#t14L
z!*jt&&5)6mr>ua%5H!)g#D<N5VRwrmXjK@)|6n!-hQ?CE+n_M`&&I&8@sr^l7<&bu
z;XlZnFdqZM;tB2y43ditA*1pPjIEbIfo>SA2?})3jI@YuALAM}2FAAL>4JT%n)RKU
zeT?fxKztU^$Y&qp2G~X`lU03;8$p(wVqstiwC!Wu2pXC`#g$u{!_ddL5wsWpB*SUf
z$G8ck>^}<w!`WqhjGMte6=h&-D`sI}07-uY-9vPW0Tf^$?k{mruz+VG7Fis%U|`tU
z*vDuAo-SlyZ2KitR>085XrTm3W}FNRN)~;L7N9EP4JQLb?DsxKOHGif=^y)8W$G6T
zGB7+T2AKd3z&^%hTxCTJeT<dD42*66K@$~=5A!iF%===_z%ae0k5P<`fwA2ZVuKji
z2BES-hCW6yJ5WjnIS}M)X;At(#Q+K}@1{OR4v?l`h$aq2kh2&J7#Q5S`~HF!7co>Z
zFt+D|vPR!uh@>t9!`kq^4<KEW!Qvl4Gp05ippvEUgD$9=1sUL%(f1T|)-y=|da$~u
zDqzEP85qQ(`!0g?zXXe41ZO!8P<rUQ2&!cN^Q0Lt^j+qh&OL!ugl9$HUQpouXJG7*
zo~}KCRjt0Iuau2}v7?JOIkAADuT&lsy`Xu~RehzPkquBu(<0bc3a)H<%Myzi`bt5o
z`~HhEFm`0Jfg`O35(XfVYKTZLKRDVzd5qJpZyrP*<dMSsK3SLp{(`KmXXulaMc63|
zDh;4^%7V@rsNw<JDGyFHARF#LY*2xi2@-h+5wS$E(+?sK%4wS4`a9Ve7(1Oo0o32A
z3<@|<nbhBD&%iL<e<CYueTh+jr#ol{ho`KFp}!lPB0$xgeSeQ61H*i4kTF{(^(TXj
z`3%;ZtOH5~91IMFmi;Me42+$hdGkw482VEcLCZ6FGxHewQ$b;N3p_#Ip9UK52VE&v
zV$`1oYH7Ry+mr#eiKjl3p+6Jk!#6yMWeok`#_1b21_pz3{h6TQa}c}iKz}BvYyz=Y
z@bza&FfhzFgSasp>_$i#!SJz(fnm!eP;#FC$bf;N&9vVe6yR?d7`vjtF89_3xttd?
zgw*eC%fM*n!XpjxwJ+E$Yzz$YPx}32LCV<}7?iZ8=T2hPuU`VzY6RBG0d|-XsL6E;
z><bf^&J}$9reJsRWHR)dfhJpTfg)W=zF!&Uh8tjmlyyOF0Gr>h3ew>KibKDCHE<v>
zC^Immz9@=jWMJ$T;w>v;D5{T^0%cNO&_2bYXwU)%P`EBDDvGuT?LOhjWGKo46(w&#
z)}0b5ya2VXyBE~km|u871GMmlje$XPOW`FI2FC7QHqiWTA$TeW6rv`p3NM4^ltJwI
zsfCw83#~wGp)ZA3lo%N6yC<=MM&b&ua)S~!B&ZpKS{N8kiOgqAEh=ItWCRydQ&#aY
zFwD(YW?(p8P&k{Hfw4ytlmNCA&h`Y^%E7=O^rdi)I|C!wK>k;S^TZh#^wroH7|t*k
z&Q}Df2U)bLZ~<tO&@DCw29srl3;94DGZ07YcHtsW5dB{Ow)6}W8w10Vz`_G+42(T;
z5LYp*DgapyN&s`+L5^9j%)p><tgr>-n3)jAw0IyK)9MCw%o+B=c9;W9Ruy)@9I$3h
zVP`#<!vjh)g<W7a$d!KzyE#EKco4@-XM{L_F>yY~LQo`%ohVG_Wnk=OhFF^p@;4|(
zguWDlPBw*wK^Dx~Gt7nAFt*96!W@`QV)eHRbCLYr0JExBn1MkIzAwL57?eQ_q(Cb(
zdzqCP7(DX|EkO29h1hT5g7CJb6V%&Y%!Sq>ps96G9IzMK!0gxlQ)mm0Y)}KKo}m!l
zrVyJ@Xb*N6#M{Ymw=4x&SjE6FGqW%ewpg@xDcDKkU?)x0WnhR-EYx9RVC?-0NsNZz
zm=k4S>;>KRr&CgB1ZhNoM4o}$D`1g&&t2e-F+u@oVaM*QLU~3|l3`%%(|{y&c|}k{
zha@uvBajz)G8qcNtGC{O+B9=HCNTbIWMJ(3&H`FIHi3x^+#CpGU;s61J-4zjFdVm^
zz{Cp*Y*3B8-Dd(5uO!3tDbrZBq#sXUQUFPSHZn&tOkh%haYR_A-<-y(6ng_y`x{PR
z(t;GepgMA*?*t|@Fc-uNG@QU>0d5*FFo4#1%;7AE1+DLh(48m-TE#J80;n<TG*M2D
zfpNkFh^rVrHnA}<WcN&un9izPUpEnS@E^k|HU<U>=ZQvO7qBrf>~EQ92`T`pKm(pn
zC)$WIFix1t13H>@qKyHVoyjoK7N%OpaiS-T?JYdf2c&uyPf}?y!$cn~2F3}q*cce}
z!zYHr)J&0@m;f=|gn?me!Nf!f2F3~V*%%lEn<i$1*h|<L7(^o{W}7iEPFTVNTCO?~
zJck7;LP8Hu*PFpAW|5;mu?uEk*XoJeU~Ik{6Zgn7F!bC2xdJp5qf;^wG-U-jW@JMC
z^qLv0n$nHn!~l~3RjhDj(+|vGm8;K{%<o`hV4U!TCzBx`Zc#>Rem5vApMa)#bn|<}
z85k$L6yQl^$e$z)VuA~;IUIZp3?A*e3=DSG`PFO;j1xhZ<Yc7g*TS@VSLfI9fW$$D
z*MnUSDqsW;STiux#^xunF|sf)PAr?AIFr>xWnq4*1Or2q9!PB(Xf=lcsBeGlZGH@B
zXaTg7e&VI+J7==WI-JP|4;X+}ugsVSW}i%EV_+zDN3a+ALfH(U)jp1~`R1UdTaz@{
zK<&)wVzXGS>nG(~aWODX(g5eVhYXC9EWmk=2UG&}q~vS!GB8f^=PhB#*ERu#4=5XO
z^_ep=F)}bt%3@()P}4DI<N*0;8ORC+9rHJ!q&Nwb6kF$*e+0Ml*%%lcg3LcEg1R}N
z#sF7?`8hTQ#z_Y`80r~LzA`_j1Zq8i#yJGc&w-ZBgJM4QtocQdxu-xbSz>1nx-@bU
zC|6H&F<&Xcz&Pm{PjPN8gZU~j8x)|k-IW;_)^(WoGcqtv21W8T7xPJAS%}KXU^eJx
z-m;_S_K;Z!A;x77AU$IS7SQ<B<k@M{6KAt3*FWPaN-bkB2hW(Dg65?s#i9(1lR>$}
zz}`Gu0pteIYU0T~Yzz$ZHkc;~GBAig0v9#&Hkg+RGB8B3F@OS0d9et~H;|(avoJ7t
zEf-<s0-19dQsOg!hBuTKgFG<(ju`_(wuuPKUfy~}2F58NoM7cFdyN<vCm-elWib(!
z7ob1^b;+iH&Z*wCLxkmsGy}u*Ei4QS22~;~M^vDkx^NMe^PsW=)LqzfSA^vPjB_eh
zgykZPGhv|!%Ox-e+-*3!OoZhXF9Z0lRM1Wb=|>_g%b}yHPoby2GVK9{)Qo&}i0hV{
zfLzDG;Qfz*!TX0v5rYWJa(@QK8TkwhK1vJ>J~DE73?eKmB^Ve4Vi_2GoEaE=9Hl^w
z2@#f6atw?!N*EY?LKzr*0(}`6Bz+hdr#u2plIfI)u&jm@=L|l13=BRw3?TU!2F4jC
z;Qd=7ENdXnX7FiYVDJH*4Lt+8yyzMDo-fHN5ti+o42;wFF*7jEXlG#XS<S%UvlPUc
z!oc8jo`Jy!bTrkBg$xWnpBWf@-m)_=&REC5;48+!;9CzmQE@ZmJ{X4Q;6WkDNg^!0
zoD7W9yqFmnH-i+qGcfo%gE+ew7<^M07<}VEoMQ|OzRe&bK%7eq48C(17<^~2Gcazx
z$H3sbnSsG~qcj8K=GTxRo9EyYXeAekMDa5)PSXeJ`2*5?gn_~L05bz4Xw9MTLk0%l
z+p-LdTSWAbbUuMiK0Jrr<tiZJ!voXvkAcDW57an6J_ZIq&;f>9L>L(S<QN$IWZ(mt
z&lfN-eOV3}+ysq{)`GVOPp_ND%Ep<&!1N)EfpJ>F^xk=_vbrq{OrJCu7^h7EEe--5
zHlNAF0bW>90o%08@N5B8%dY9y=dsFi?tyB#H~sHCR%y-$5bku2>5B7N6*>Pvxkl5y
z=d&tsJy(G8W2Tpaq-~(ww(0Zdvntj{fE>!eIDG?>^`K4g9JLIbCsa6Jz_-FZKLA!K
z&%m4jT^0QN1Z<AuIc&UIM1*ArCj;XQUS<a71PulTKNAK9KO=Sq<^&@K20vE@20v#I
z$Bu!)FNA@?FNgtpJ_N(l2cWyn7#L@$!7es~jvGJy1Kxq>42{@3&~k-=fpJE>6lhQg
zk)r*Q85sN$!8r~&q4R<AE{O0pV_;BRA;QuEDokhW0qtJf!YjhkVhqYJoS=T=^wSGi
zCF?arSU|hd82*FSMF_Equz=T$K+fr4PzBYx44@V5p!_=XstKe3Nw<dNSHB7d2EPK(
zUj5A?ESVCJ9P77;fx&N{6az!ZWf7JvnBZOp2EXlc#ih9nA}ocV^5;JTgWqiihI+s2
zQlNE|A}mEP(H{&9ejlJ?=c*<Qj0>a~7-uFxVhlErsp<n22Osqb-_y*XTEM_KKaGKL
zCg|XA#6b!SsvS`EE6~iT-vQNd03=ZcPt&RwKpLQ8pj|$z4v4UL!79*M{6dhB@UjAh
z1PcR08G{H*IM}n`WBf%}A|T#TVPHrK5Me$7(>WWor^0Kw2=ftRkWQ|8(BPy9^GR?m
z$HKtC@<N0eG<pIaGMg0*9>x-3J_RYpL>U-ot%nri%;zM*`ZF0sn6H3Ju{WUh-PvU#
z%r`;pJ5UpG=Pwav(C`!kh|?k{!h8!P11ifkw}>!5R0AahhI&x-GwTqhJy%hM1h|SB
zM3~=!EoEU~I4vT={1L_h+4>#q2Ck%(GzJmoA0W;$76yis)gsK`vzw||7#LbNi!lEJ
zg#(Dw@kfOD4==cu06AQ2nh5hhnDbf$MOeUVEB`~oQXM9<TTz5X1H=J&Y3DBy7E>5U
zbBhRz1=vd<<8%^5SXjU#S)dkil?V$fi1Qzmom3bY)}0q&h8@vX&p7)!cw>zS^Ey*d
z>w=SkLAg?ddA&IU!?fKX-L@jkpfN&*Do`ru_#(pG3-SY~88ycpk_wo6!Sxp>#J|0u
zjycGS;wB=@{h$m~1#*&*p$PLNShyVR7hwh;&r}5(mNJSJVFsV<2GW&rQiORSSRHuj
zz#4uL=3+)rR6)vw{m|_Zj544cIrlvzM=}>{f>HwmgTE33gTIUks0A#-T<i$)5Cen1
zCj*1Oqe)U?5rYVG3F!9lHw+B^r3?)I`Retcez*v8i5dd~!+!<_|2Yf{{-8BNpa>}e
zk6$q`_@826@IRyu8Zs1NE`e-iWAOjRz~KKuoq++A%t~BA%`XOq0BHt>08vQQ%v=Vo
zngbjd7y_&yO%=x8r3?&f_@x*a%Jz#eH%l_qGYBLxFa)G9Fa*TOf$oqHVQzuxYh+*u
zsD+k=2S5{9p!j28V4Pb5DGQlfA=!c<U@ikgz)a9Ra`DhQ@c_u_3<3{Dm_au#&fU(;
zz#RXBfgxZs14F<@P;t$~zz}eRfg!-;0H}xt-ClB=fg#`~tbEyjfPpzKje&9Qc~B9+
zVZi{Mh}r)DeAp7-GFI{WyCTeq&~}Z=42aVhz-#N~r=>D5G=36cPILqniHun$CHV{@
z%t>G#14F=j28Mu_pe7A-3baWR$j`tK$ScLb;36-=oFdBr4wOJ828KWxXkey710~Rb
zfg#Ywmw|z~emVo=yk2NXq(MU>FoJ<0Fa)|mhe72B)L9G+jPrJ&E6rzM2+Rd#|9PjO
zc^zsBQmv<Q0X7w;0$y3dz`!6N!koj&z&Kw|3KWhS3=DyF3=DxapkOp&U<mAGU<m96
zaqJiv0_QL=1kPe`V_=SdJw0$atD-h25&~B<Fa)jyX=Y+z2;9ZM5V!-Ro{xbc@FW96
z;Bj!epVc&d?s8VyFsV>bq7Bo71SF&aVTP8i41u>87y_?BLnsm!LLV6z0^fr|sGWgv
z{(Y#gqo4s4#K6E1_;0$v3RY1aE_68|28JL$Se42Q)8fd$pjJCQa0RQZ@>;NKd<-D2
zfm-YbwKxd0H$rpz#1*U}^<7Y-{bAPHFfasJfdYHMTxeiJr9fqaPKgLJlnW|kc0Lwi
zHis253r&PTAz*F|vJ+ZTS-?svP|0fn+SCdv54pCAFoTY8U^oTZXbURiUBE6AWnf$=
z2({D|;vSHY3aSvy9Z(gZ{lB$6BFwy?=EK6@P>Xq0K_!Y1q$J@5_p>+|7#bgmF!PBs
zFl<=O$-r=8x(G8Lmofw6!rz<>3=^(SU%QgkSo)U;voNSa1i2IBXkk#l6vRpLp8k6!
zt5p3(5oS$LsRtVL&@K^S)&_IH-D8ITW(*8|VIoXFKyF#2$-=;}KwX3hey*q|lL*sq
za5)R=ZdlC`VOk35nK5`m7gRHW4~kk^1Su?;mV!qY85n~685n{*)fpH(nd(KDma2fp
z(ij+m$`}}e^5noZ8PjsGqZt^2mN75{&5>eY2;V8fv;rgu61c>`5OfaGvtu-R?aRQx
z_M3rm3FvT$U7jLLdq7cG#lR5sl7S)UxfBC~A*TovxFG-%{KLQy^i7I^AvHyW=^_tk
zfU$~!Ay|%qAy~qffq`9!fpIaYn46m<!gO5#JP*MT?8?9pY$*qtC=g+~0TV1`U<fXR
zmXh9kpcy`ZfpIaY#W*)kgy}Y@?mNZ65Zukc5ZnnZ$h^-$PR-6@Dgzy*9S^BpKv$P6
zEdmvJAW>F`pjQn8)0=n(#>EpM5}@suR<MH7YX$?;tGNt}i`O9}VJAv4c<q2R<riO^
z{&6*{l-dQT+II-Go-l*F86awx2u?R#!z!unEdf!yL=T}De)@;E1yph1^ujf)Qpy1g
zjEgiG7?*(Vf`{C6z*Gru%6U%#DW1M=4XZTg1O}!T3=E7*)=vMhhE<ev1C)Cj#1-N4
z;(+*c$(!kXYgxs)yfi>M85oxePuE||Dp&6U<$})lWh-Xj`u|@F6d0gG>ES0pGkC>7
z3|$%yaya-19i|F|W7dFVK{DWj!ay>hhWG3=5vCe$P&7lr+zq-QnUM!n%`fXV0VT(J
z5vCf@*5+jl48ijl7=mX=F)#!y5@7;QF@ps6GB5=1hNh1mNRD6#KEuEed<vRA++oWx
zR2UeSNlGy=SQLsdK^h_q48gY<7=mv?(}(*LQ1FA?3F)O3GcmxsFYXeMU|MDdmq&Qt
zJpw8jjF2>fMY8)E2Bw#`42;Xl5R#UlE@Lq~fZWd@EM@?eLXvJGOu3+?OUvr-faiWi
znDW7`Wl;vkWji5-7!zo<IAp+X*%?$JXt@Sc0on>YbB_p<BWSh(w6A(OXper2pa_$r
z83O|Yh*NVygvk-K$_aE-g$NUP{WG|A&BSRp-FrQ&G*^!ZlLg2{%Oj^3tY?+uUaBR+
zqyrXcnm%(qs~l5N;q;yBS!EeLre9yrs_Pm2hJhg%bP`NchX|7fsPuTlzyR7l6(S_T
zz?=wOdZ7YZ?ZUuZF2bbF&%n3>v|KY$f`K8#fq@~!4pfOIyqxa4fmKl|;THo#NB{#v
zh#xqBPG1#a;sx2hqHuc023Gm{$0CfN^?xfi3xQIN2;+Uwxf`J7IH#Qm<3o`3piThy
zauLQyAP%U=T_7XE_!!Iq1v%?n5ylN56IZf8LY#3EEW}qlgaj|+7I;mv;tQ%!Jv7K+
zN<bz~l@MWE0X8udYT_!Gi7Snu+M#1Lq6~~HT~UQ#20~SU3{*}KVVnduup3f0F-`(k
zid;!4)0b{!m8kDwWMBwR5@D=ni)LU5WENpmhql#fp!*;gCxEin>d%nIGNZZysA^+i
z2uWdJ2#EuqR42ly4%%yffPo>Toq-{w8Pun}EyAb?o-$%!2wBL$5Hg>Ifx%>>2%{D#
z@cu&@xeT{YGSo8!GW#+xaG5eNt~v=BZDQ1e%#bpKY-C^vSufAP947?H?KK-<t*jc@
zT2vVkMm;eG##K$s49s!L3=AP4SL_3E^cfgJE-^5KT!7}(nga}s*%Lv_$hbgN0(1b2
zt>y~@<ElB+4{l-=sjuZ=V9xMkU|a>h=?~G#tyKYya)1VIIR1b(5P{d^*TNR%rZ6zB
zo&|L}D7y%PobZ@|A>^Sv19R*?h|_B$U`~hYlMrEa6k}jq9l*@M9DAODA*B8j14GCM
z5brhvLnsRaLnsr}?X?*Yw}WaSkPjRjRN&)4wLJ_>zHb;9SLcEpSO&VygArbk)GmPd
zXmu;7AVHKKwL9QGih-M?SyRHm<kQN)xEgu$cmfBkRH~T*xp8;(-RXZevr5-nfHveX
zGG;MP1g*7-W?(q&DZ;1#O+J3m8Wys4d(C`k@=-8^B%e@G28K{UX!238VPF7-TBrd7
zL#R#=1LK<ckWlku04>^LZx&%xVP$4uT(g#eA=HzBA=DjI<*I-902)eS`m&sXaZMe>
zf1n^h+{)<Z1FDFo@7=;GQ9nh5Q3#X|*6fDnb|KL8_A*dY=peHQBPZ0^zM#bfAgA8|
zrTVpZOu*v~jGW+OPZ$_NqZt@N!=cXRw1PUjoPi;<IEaC9?H!1-eKo+&&J<zf0Xci^
zO9lq<(1{ETq5U9tfB3)vx(pgL+_%<ydiGXUDb5;DY%nmcEu7xBl~q<}2FTeAjBAlc
z{~ExX7-3Q2y9cUc_w?&qS>@_)fOLR@08$HaTmq>EE!#3;V2~>m`3>^<+Hbtza_%>1
zed98Q2nL3%K#{Lde`mmsYy<D9TendI?C-Cj6|r^<455n|7((Z3fDX|Y`DzRG^*#oM
z&|OvxjGGtQ*MoCJ2KbV9PHmANAYX&VZ9{J|Foa$O4UO(%U<m!hzz_=BF}V2{149@S
z149^SFVE&nFd68$ZI~DXLzoCRBqTE`K>h?Z9zd7XvU2=)R{^cFj9_3;@)daxb$ibV
zP_qyeX<)~%&xJVty&fc~g=sJ_gsDIr|K1Yf_%LS%hA?}G<H2t4IRRQD&AnOV6U^;l
zaSRM$QBb#sl`}Aem4Y}Rx3@Degn_opf!q$3sV{{&el`O`*i5M7dmbP=o=vc!VL}UN
zU_XL^q3DRn3#jWIVZ)>WpcJ=(590V2&;%E@mVqH`CB*SBpy@5_1Or3Z5e0B$z5<n}
z%On{X!X7d(gx!axFUL2K@!a)qrgQCJm1c8d0r976?_iazKPGYuYO{(0D9k{IU4U)&
zOasUHEpVJOW~G5+`xZF188bo2#bUR}cBs}!=#CP`6(Fsf3N*kYDciwS3j;&gX9k9_
z_Yg;KcYuUA=vd=$ZiS?J(8$+Lu&Wsu!ZjHf!qpWr8ANu0MBXqkgxfMOgqtg578Npx
z>;iQRKw|L>4B@d#3=CPHM0Rs9Fz`DtP2{j;VBAyyNhDD%uxt?p+lG@Pa*36Jabuw!
z1LLMzXrM%`07Zuu1LH>Up~R3DCukE!21_Y}p(5OjBcQy*z_`(Odd^N(>G~HSU7)N5
z)$oClF@sgGvEg_b1A{H7=!H7s18m$o3fd-RP!PESa>Qe11}5L13=HA<3=HA9%nVF^
ztPBj{%?u3TjUbL714H;!28Qs-vJ6aqvLHeentq}=7?^Wiu7C=BE(d724tJ#r#Fd-a
z5l#c;{R~h)1?FJ~s2c6*Ub|SOIa5IA2{JHl@}Hi!i&dJn2E?7-u$xt+-iU!A{iq0d
z;rpg8NGY)tQana5Fql@0OoB#x5UkDvcN8}#LDK3Z@M%vB4B;yo7{V7rqJ0u*Ozi*z
zL-=V1hVbK{7@h));g<{y;g2CP3~o|`Cj29~85klsAyEuk1p$s?s5gSHK)kV87F4<;
z&hHEQ1M&a^<7UU{3A<UP*n$N>e2|AE7+a^$+|4SZy%3V5v%n5y%t|ZB%wrJA0v%KL
zhB1@Dh=HLcQX~S@Ti*P7`h(r9GWB*M5#Uv09N_V~2*_Hi{Ip^QktmS!Pl0BL!w!o0
zfKn!C_4gJ<UT~)IQ3sVZ91IK-Qbc?}V``vz)w9b)f+4*NT?U5foN}ue85p-TurV+k
z<C5C|S+kK*RKOqyS&;~uMy;2QlG_LF(X%lyxa^nP2QuoEC<Eh`0&NBcmm;}+V&D^d
z1hg3#%<jnTGY9j)Q_gb@<femsvIVp#Kut#uy#59}QygI}R|b~3#RDob<RJ6nAnV#a
z<r-nOEt)RZ#0x4%K?{A=bmTy%7ceYi0Ofo0RdRmNk%9nF(+N~+fOp7mQ`P{R2%6^t
ztCeG5h>%cYU|@EZ^8?i~rx+L_92poQY(c}VcjZDv85pM3F-_!9C`im@kOQq-0PU@e
zh-YAkh&;i_z);^b6%x)M&eEq*pa%IVg-ixH@V?PE3=9!-7#Jd^KznHc4Ir0*hT0ey
zw@z08okk>=2=)&HL&RYQhKT(PCm9)-(~d!MXn+8yh-aTE7sv`tSpfl{&OHO;)-%vd
zH2ue3RzA)GsOYQd{QFo%>!DTcHqhnt(CeQOO~ZgIsKo>5zQ_m$292$9HqapRhq<x`
zR8(%~hXk389C$e~L&Q@ChKT!+AOoMBbc%r?l8b>Mk_o(DM9z*Ad}0FwL!<!%L!=JW
z=l-zfuK@$&wrf0~@nAU@u+P~T7y`QGTm={yw=1lLx!{2?<XAukzl7-@_OU9|FJS-=
zMr`{6^*1Bvx=YyDZ2$uU<91aP8HNT%kb$6ug3Ca}DF!|U#_jwdk8YNehg#zYZ9*_A
zfIPb63dE!Gph{*L14Cp814E=A#H01{nvfl#k>v~wk;Rb2p@f<^RKZKO7#Jd_GB8B;
zgVF%3Ll}95fg$pYCIdtI7dc%}u6)D55c!jVA@aK@1LO8%kc?smI&t(NY=GAvG}i!1
zEF27s+h1r0g7cEO5IFb1f)sZ069WU|4lYRkvVf=%WnkPP12NVDbZpf_SRw4U0FqL6
zSb_Tw8h(4Ae9)am(4+!C-<ZK)1e8=57<ZI`RoD9)K>6Ti9;9}GpK{OO9|Jub0(OYg
z>s7EL$v?jT1ma{sW0mRkN=WoFy<Q~)K1M=-S(s@CsE7j1zU(vxU)dteG)tC&Vd{1k
z28Kgdg_&kcC^IljGiPC7a5yQ<1U@kU)W2;J6lR(O9tQ&-IXpe^Age_EGGV4XHU`F>
zrC>2(rYcaNpW;eo5N4_cGg%lIa@mBLz=u^X19d_{Hq^_2EC3Hu>tzZv1%urK$%%=u
zeVt!GDP<SGTybVPgD_JRc#RhWLliFqLln1MCWA0jH1wWqhA15dhA5Sy%oGM;rWCNH
zOcObv**Nh81LOV@2F9JwA&C~YlQD?_be1W!GEH(}VBBX6QUJOfEE9ANEU16HR7#jh
z2vj=m>S1AESiD4-3A{BJ)bXEiRG100o|hdwF}QvH^t?l?Dp9M1nZO6Vg4TuXs^J1H
zH56vj0p-1A;1Tg-%)(5T$_xykt@36J40`{B8DE3VKhMIzp!imp@f+CnEDQ|VCBjVL
zy{!L1L8iH7`kO<nlJy6K8Bc?D7c667-1V1*fuYD=nDHz~3pil=^o1G0Ye<$cFzjb!
zVA$;{%y<+WvK9;s2i^%Y?t<#w4LWA@47)JnE)CGaO-QUW?vY_&+#L+*eS=r&A9x3{
zTc<>r@gOe)<L(HCdeG{asdan|4El=E3=HZq!i+1S`MVN!X7mM6tnH~#XJFVqUzicJ
z+(en5fgviAfgvhb9h{&TSAy3WF)&2cGB8Ayt1~c6m?+G+5<C#jz!0^Ffgx&+I%q~s
zm~ka&?D-7?L)38whNy#5_2A^mxEkzG28O5?3=C1vpbqvZ135^7fys9%Bpp>{fJ$^O
z9%069tPG5Mq(Kd>O$-cCKNuLIzQHnS<qyad)gEx<bHKMRSIK~;s2CXcfNmOqWL8E4
z#(KsKCXNNLqOi&Wa(iwTQ!xjq88(rF4KxY|I#9rZf#KLJVaC~@@P5O<xaYJ`aZxgZ
zFym}#P<xk?fdLfwvyDK3&j~sbK$vkhs1P~@J||C@aW-gl<rLIopdBv9W-)-a4e(kD
zGxkEw+$%Vp?<lJr<ErVpM_DE7-I#<KA-ilKzE6V<QqBRz$6nAOLLfUU)j)PKFhuh*
zFhsMOq!gDh2s2iK8ubSl7^2M?7^3yn85lCY3o}-NrYKJ_FhnOZFhoa!w%cD7W~_yV
zd~^>3Lv))c1LNM=;6WzgIL10i5`pHrbP-U7Vqn}08Y}@10f<A~mF@t_jxbIL1LM9j
zXdX<@U|`&L96n+o3EI0a%$UIlGHAN;F;)!?(CSXm?h&^$pmeFqD$JM-%37zu19+lx
z!i>?NytJ=udhsz<O;eD39729VhcKfLSbh>TlzqU{Ck&Dd3~6S<jCLT4j!(aMj8#?=
zY*9N%98?N~{}X030PFlPo&7kge7&+TqZ~BZCx9w2P~8E(9A<xsIs=1ww=koeEGV8q
z*NrhSL@!lmVCY&c%qR!i)By_7V+;(@2h<rDKrWO64VZ!ipEEE-KUQU62x}B(R1jle
zFw$n4$N>$S1khpM*Fizk_oI%14Kyq<=j!y;$5|z_GeXlCgc&73rSdYytRM#F)QymU
zR_*{fi`iM2QHqtBfjM;_149f814Hyb5a$#FLyQIkLyVj>19L_eRKpRlhH&oxW(<r6
zWSJS5GpZRFV&WJWVq&Zqm^1sQ>z`m1tzW>v5L3Xw5R=Ei5QL=p59mfz=5%gGcF<uh
zV4Y123^5I0olpz@fCfI8(;3Zqm>HNeK?Y4^V2J4lS!>O}P<BE1Bq)>*^g<_tJhy_H
zp<XV+FF~>Rh5^(hSFaZoJ_s7GIIx_Jfk9@Y@L^Et_aC&F@Bp*$JZP*Wf&I?Fz<dIf
z_>YwOGB9w8FfbmBQYb2B5MBo|4io}Q7#L#aK@)896$Yl~*$j*aeu8QN4ii`bk^BZC
zeozoBZdwnMND+ZbfcuLa25@m5sJJ6ogCVT6NOJ*o2SKM~gO+N6&i;{RU_4R^37Vu1
zP+7&XPj~?<1LGlnb_T{HpwK(azz}m#mVxm|4@hJh14GQEdIpA=3n1P?28Ni23=A=_
zUVYLY$dtjsJy1J9cdSD_m-GZG2Rhi1(Ev1J0v`lS`U92w3e(5Lp#yVtGI){#A)&_r
z+BMI3lpo^k<P_MB$K(`HEHW@K1PCt#dEqfT1LIK{28Ngq3=A>v6d4$gYA{cH!T@5J
zFi(5{W;ifUJOO6-Fiqr;W?;;K+-S*=oWj7(z`$`s*bZdUL1qTVj57=jv7p7)|Ck*a
z7&C4#FvJQmFvNmRj>>q#z!0m(z!0kfQul#@A=ZL{Ar^GhLdG8khFC8KhFA}{Z>BIX
zd)=FMnpLtMasfO;@)ibG1_q9I!fUt~7!UtdWMJI!4C<;KpP43t?luJ-j2@f9zz`e7
z&cL{nmw_R6Ap=9~OhpF9ol+p5fJD_97-Fw5FvOmKmTSp-Kn)^j;HM;jN-ze-!=P(v
zKsp#1GpElu%__jz0V?nq7!UVM-*}o;lye0Gv$r|}<Kb=7&x4!@H7n%?sKA7pmD&Q;
z@`#Z!i)G>q1~yP!dcfK=sVhKf45~5p42Z*^2O=TSm1+aqUYiQ4Z9p+5BD{wcR5AW!
zU;v%T6UPP`bYNv*h?CJ^V2G0f@dOzd;`A68;&ecx4=6(rsXh$MxmTw5pJA2e66Y7L
z1m(*kYo~8H!>Z3|DI5vn9_63@<_xO?<JsxDXIUjUCkk7FMI)#Con<x2nIvq(1zz+F
zI+pU}B4K@SV}-eqk%6JhK^W4KGG}10d?m!hz{tROv|k9+nGs@Q5CRvk6$}iKxk8LT
z7*!Y;T8)Jm*MO@=Mh3=Xx-1L~HYP%h>%g-NEDQ|ZmDAsyWtFc7Nfg}^f^6Ue&E^>X
z6Jp#1T51jAG)f6EZU%QPKw7GW7&i-prn8|HF{tWkH3n5Zn=c75g4gse1JAAJHK{N#
zXkHXztOp;)2yy^uPtKY(LX7p2AeVA7Ff5ub#MmHT58BuOn%`e2#0a_1gOh<_&pRQ;
z1`m)7R{?_%W0N$<1K^`*gczH_tzOVh#lu33;6uJZP0M4TliFJZg&4aaTZBXz7>|M0
zG=qe?AwnQ$g1Eg9E@=64bh%Ifqdg-7<8g7WlB664Ax1}O5C>$sz7V4ms3ZkX(M8t_
zF}ezZd=BayNDDE#2{16|$$<TuuVc@^Fjq#1Q5|GZ%=GB<tTOeNgcwZ}7#Kv;AR)!@
zp%$bDbej?HVj)IeaHv3%pc1TE0v;MX{y&w0VXmSOBQI!cQyOEIIs-%50U<_SGf=28
zFvK}AFvQtNfi`&vF$#hQMHm?3G8h=*;=tEL2r&wQ1TzmXFvR_1V2JxAmyuG$AjBxA
z%D{O1KLbO&7z0DR5a>1^W@D(7xF%FekAVSn=?EVKL!PfL1H)_sq4$goj3=Df7#Q>>
z3Vl?9vS*45eE|gwXs?FV@#*mwSmi|0g`R+v=J0~{;R`)6VPHIwGkxL(R#DIV458B?
zsV+9q+E5|z!ukK8?ObYKgtmfG=P3rp6PqDcY=>E)J6&iOh`kxqy3Wz_VPIgJI{p0x
zRvFzO&<UQ|lZ3iJ)%z*NEH(y)33G({l^7UL2C*?Pu=)#40I|bG85mD$Pq(<ps>B#G
zJ^CW6Dr3y_#*3_?LJO6JYS_VH$#`-b8z>y7ueivnT)$kKfq|1<s7{)Jf$<>&XuwF0
zMF^Bu86Pr$b_N_;E|ks4z<BZtFF3<xgAb`>12toWz(-1e2C$A^5-I|PK4?)Htig0>
zIcQ7IwsxTqkZ0d8FrG4om=FTq8O#A{)eD7afkuCB@f0u!g~>87h*UxhjsyoY$aa2N
zA$>*$##8On3oo&Xy0k;&Ex__@3=FPZLY5#lXe{dJB_SsTkWy&M1D)2yFAECDo*TLh
z3`#CSk|2{#Oh0vrRVv|<kP4EE8U6%-RDkwNtlyYz4{CdyR_Do0%4EoPlwn{zt<ICl
zknIby=?zbAehNdjp8^BpX&q?mB(fdUI?4E$9RLzFWMg1hH+8zpWmb*)h)L~`OviY3
zD{omb!=!d)2F9~nIT#qUuT1KYVqiSGi-Und*?v-o76U`eTMh<>ZL24BSTZo41szw+
z-7~3Egn=QsmV<%8ihEM0DpXBQ+N4fXkQ$x>hDqIA3=FODYzz#lsgrs*K`Pi77$)tQ
z1lpG-+;W7CfnmYUNqt-l3@s1Y7#QYgO#gS8RjhvTq{-}{C5CJa43c*yO@T>EKAbc~
z1gcc>*`z6QF!t+7Q#3$q@RqqrQ(=0UPfnV~&%k&VWQ}j>r0FoWJ@2F$Ff%&^Cd~x1
zMHv{+6!By-Oq$O#eexAn(fTG3XDKtt9pEh*D;OrN;(_`mOl;C>9*~WoohlKN)_}tv
zWWr}Q28J0ileT~scYq4OGoY<Nm35QA!=Y~kc#<+p7$zO!2N?=Fh$Vf}VIh!_3}72h
zrB6C50O5)<m@=MaV_{%8aA*=Es1|8?2wF~d)(^C3c;+NV1yIuvw4%yn)g*8$9NfF#
z)iFKhDyyd6u}O?hU<INKjAyI4G8rZ@f)CAjBfynh0OhpCGk|;g>&&NbzRIe~=sx}C
zRaUk7x0CXqY2q9g2Lr?Ldz13C85qIrL#HR@c|j9Ji{PZZNT@GjlO`2_7Up(>Qgf@e
zJp;qxea1{$j0}wDl2|}JNMj~FaP<Z%>N7qXGZ`yDrEF`AnM_4N6$%Rj!wNoQCbN2e
z(CO+Rg*qk1OeTWh-aNQG@5lh{6qhk({0=f0RMhbX8Z&-ZVPNRk%T<tA$zaU*M~Z>*
z+!wCm)N}@8#=lAojOTs|aDn=>#*F{@L4^wo14Hr(V<rX|M<>#li4hb~ph2TK48}}M
z^<bVT1LL{JETAz+V<s*U2FCLY3<BVreT|vKK_%Q92C$PlRrwegIu5;H<YQnw2Rg5}
z{Jb&aYDNae^Oann^4*wmgCvLp8j|^H%(x$vN<cR4++@sn0LB6N;-EOl7ohyAAjrUY
zz7OPoR}o{zqafFS25~Yz8Z({%huZWx*I8xi`#=o=10m2p$Mbd83=9d{#(zP@!uiWw
z$w|2k#*ED33=HiBT$v2Uj9eg_KuIO1#h8%`+;9=#0;%CqWMDjh8SInRGr9~6>}|%k
z*%%lvu=6G}7~hr$mAGsS3_G%n!HY;h^-5`iF?bD0{V4`(28M-E#>+vLUZ~<pPRd{~
zUN6qTaH<A;s)g|t9<Vz$gPp;X$zZ%4><Tu}4PeIG!H!^KU?`Ysd_;<Y@j?|F14GY4
z<I^B^y#P-xgYizV+t@&hkd1eNLg5tHoozSx7#P}Iy$l!_#MO)^GlDE+V7#yv;()1O
z2k;~(r7;-KkN}B;Qe@j=0|o{oHscm>?ash>k((Fn+!hs(?rAq!rI~VCrpw-BRS>md
zU^x2QI1g&<#V8I?<v2a)CaZRR4I2Z4+#BOks9S6p7!Lh4jsaC3%NQ6h&g4xhO=B>Q
z5dfuL4zMR<KqrU1;VED+j^korINr?z+6`e0o&h)oYUC^pn#`ok$iR4s8JtHZGiiYH
z2<YmHFO!)x!NCPyJTsZeRDz+NLC{W=f$`!4@F>P)CNubYoQt1Pg+OUXrv$D7v;xX4
zWHO@!$f=-#)JsaB^Qb2?N~nSlo^WSi2p7%(HES8(Ffd-~<X~VZaLAaa%)np@s{U8-
zWh{{gU4vD9i&eHhBV!-fU7!kO17F5QP+)*+*wZ2zpv%lnH-j(m<oavIG81eaxGBZB
z4Azw50CjRNn}!xJn6b=MWMD8(XUs}vV9@?!#xhe2ls_3WSr{1DKbf)26K7z&Yzn%x
z_o^Aod<h1|%T`=Dsr7jbW-JRqE;z*n3U4!(Mc`VJg@IwhS2LEyAelFyTqMZA7}+k$
zz<5~|95!Yw^W+#9FWZC5JDn0Umih7wjF(-&DXJNCOMKHJJ_ZKkBt8ZPqwih}4C^$^
zSZcr?U}Rvt{9g#<-Wo*)hUwF8vntg8F=MF(t!4t{U_)ComRj&2A=KfG$PRCUI6OI-
z!3=sgC5q$jKpoczaU96K@1a6X5C?(^ok9jPmNs>eJHYNWt2gsvV3?F@#$wJ04nYRS
zD+f72k!HqXt`3SdP6md6HD)a44j^ex1_q57GZqU|kTMnqhQ^0xEKcCrJQfB9?rCN$
z&fq|Uy51Gp^=@F-LtSk0lPePx`T-KQ42)NfaixO7Bt(LN@ycl~u>Zoq=7=&dUfBrs
zgDb>ako0KA;s*B8^pAH~MWv6KG0k9PV7zJtPT*!tb3x&02TJ<urYqiM6{!c^FmzQM
zVi40jcv`=zg(?I!8>WI`3L^u<>Oww{$@UBk3$LYvdl6Tsf~`qs1f8e}&PG>@z~-bg
zdLWE$MG{K%+yzZ5a3!E4a~d|JUj`=&2F7cey!izT>6gKo2((#vUHWw?kT4tQ_`dX;
z@(c`(3OvOO>9^z<7#a?-F);M;rh^ZO0hOaCg{F(%V^yxdoqit_Y+xa!^cNuZ8&KZT
zDM`NpIX4GXfHhpKU|^_GlV#e>XvV;x_EeT>DX7@J)&cgGEYk{b=!r5gUP}f0L6&JH
z+*{WwP=z2N234WG3p^lM;wsAoo?5;3AH29umZ=Ps8$t15lp)JhA<4ja?f>*g_gJ;-
z-^eo6!Lpp#e_5s`Nd^WDM@W;F(dab;Ly0TM#p?Ua7#KQs$})k+Ij@5n!P<XhnW8}s
zJ;1`i05UcfY%Et%GJ`Br9N6cem9Z_eWf?)OEC%S7v~8dPW(EcZHt<os^$%~VgLN~m
zG5|S>fg#?Xfg#=<w5RO9EaMumYZw^fD;XH#OXUjkiWp=W*MiJG#lR3hg@GY{f+_=p
z(;`{MbzBUL4{tJ0>|j#`9gZ%`xSo@NVg4nii5zmtxhV{?j2mFOwlXlpua;t9IHD`d
zxB+}H1IVoR3=Hva<v=G<$TDsK9fAlF{Kvo$|3|JQ4WwNXGBcRK&%ltt4La~s7II?G
z8wQ31O$LSpWpKApmT@=Ko&-Mzh6FcAK!O$&GPKP01vNSt7;n9jVqjS0F3b3X7j%K%
ze+GtxQU->ELMa9YPh(lef1olLB-q2ikO10;5O!Xc@joA^@@8O2SjfPTFcY-w{IV<)
z52)6i%D|9tiGd;E7)ZOYEE6wOFj0hoArZ7gqHnh>6CX^_mw_SCS%QISLnOE)XQ<x+
z-eMx4Bg@1h#=v;9mYIQRLj?mvVl4whVl{}9&A<Sf7E9~_aatJ|5?3=YBra!XVA?Q=
zfg$lY14H6L3B+LRP8QH$tbmOs(*ZdK#+w<;kfGef*9;7aFOddhcd~#6WCd*M5hJpR
zzZn=3f5O)h?*vV8*nkEyK}(b58JITAgE)Do0|OJB1sX_VU@(BX{tU>C8yFapxEUCd
zI6-dQ%fOH%!@!Uv1>&4yU`R4%U`WztkY`~05Ct-%{sY4<1=uE95DRReiY$``Cj;ZH
zY-R?=59tgHNf8VTNns#PF#|&qNFddUf!XsV$ONzfObiSH{<3nQ(QeOg3=ByX3=BzS
z%nZz+BP^5J85ojUK^#5?hNS5X3`tX=W9z$27?_#8q^Ea2VwI7Z!ocjmih=RgB9NCk
z0vH)HVH2z=7p5P4#44?_fq}WJoq_SzLC|uOQU(_WCWi<{1K0@Tt{Mi$7d6u!v#Qj?
zHWA!mV7!wn#lX<#E6d~wN&!_23`uJk7?PHOf)knoc7v|30WUQJvB2JUkY(}{V_>{}
z5fq#tue@hqNO}w6WHT@%GchnE{R44Y85ojf85oi!L18<IfdO=?VY0CVLp^+4fA<$~
zYG{I_hTD6fsUbO*fgw2>DK+c{pMfXPgh&j@xeN@++3>`$M}>je9h?|I`x-#5hbD$S
zI<UmB2fX?kbdP#H#QAp=K#tr1>d!JTBv*qRxtD<<xsQP%xd+5K#lVoflz}06E^PRG
zPYEOn?gU~)K`H}idaZ&1bZR$Zjm4e`pcp}o4F-9JdiVvK+u^5NZ-*`4<d9`N#LK{V
zml=8xVKT@WCy);N+pYl{DTV7{;X=7zbGru2#Yiep5Boz%z)vDXy7zNC{KVPqu=4~t
zWEro5oHY~XteXrB$=8vc^#$%Mm>zUz!A>cxXMh{af_m>KLLA9i(46>zVTTE9De?}`
zE(uUlRFP$T$jZQY&k~gP(is?%UobEvKLc@!85okkGcY87MaqafOhAPSfBi2+PE6ro
zU`SyDWj-bbh7@rIh7?f{hmV0FMV)~mMHQM8cX)v2TtU$e+tmSzZ_p9Qpp&beji4F5
z171=<XL%S(WSK%)85r+(F*7hZM=>y@STHcur<j3wP7Dkw9t;dAZXk{y14BwU14BwE
zh?B;^kOIOfiVRH7Ma&aBSlAhuoa-1EQpy<^Qc7(ZnA|j>Hco&g?_IE^2`+rEKo*uT
zGcdWiF)*aGF)*aGfH+wU3@I}h7*eLWf_PR83@K|E7*dvjI6({yDQ6iNQci<7aSRM8
zcNiE_Zm}~kxs@?6q`YQeNO=hz<=?e{fw|)<1LJ+)>50!-h3gl%Ffh4&W9DLnXT@D-
zAosatz>B9Hpj-i3<Cg|Hs}>rfyY4VBx$1-F4JUT6Fn|uLh7`CT7<P+*3x#-D#^;<2
zj1S~Mv6;@mkn)RxA>{{%Q_R4S%E`cx%5KHr0WV~Ci-6)*ARiI6si0a=0u-A}3=FBD
zBSF<c96knyR7(biRCB09b}N9QcDnToR$0y|42<s*85kcpPEUNnD#f{nf$^;;1LK1f
z2=@V$+dqBz3sxnCFQBVs85kdcZs%o$@0Z#x0yX2*^p`JKr8yg*+;`IrU$RPbE`gZw
zPzcOb+5<7;A?QYNX0BTJiuUbKAle@KPtSYFD#f)!1FElT`lOevN}Ls-vYdhO;p*vo
zU$Sbj`hd6~rb0dJkd}up!2<>wp#6qbH)X-o<JbN(GB7>@ZGkb$kY%iO0yU_(N^%Pr
zWI>YwjMx5iL7GAh;3f*BX~JmolYyb?CTOy`JVchU1T;tT$cGcsCMz)p83D2)Azzj;
z1azn^#E!|F3=CrbWf?<ML9In0NV_ZqbOR-5Gz4UO7`QPAu>;)vNyrDy9d|yIWwd}!
zm3AtCvN-H;f+xl55Hl^nW->6O`Y|x1dYC}Wwg8*Wz)+tGN*%d!p!?Kh8Lhw`VPHs|
z!N8C@3EBVypHg&+fgyD_14HU|Bo}l(L@EP2x4;UU&MgpUF!0DSy7DqGK3)ke15>Xt
zFr;2VDg!&WFw`?cGA3LTS|QlE1y(jAsX!{5KQJJ~;bkB+?{$JNGiG3X47%r?nTrut
zo-%Z{KvK)&r;O9zd}fv4>Rba!E>Ae7zy8cB$<+x>x=#$Id%t0oum1y4{{*~+3$lO<
zls_{V;kVs&$$(4%6?mx9puvR`fwGL6;9e0U1LKoPpuq)MMosW#SD*&{@)}u2P!5JQ
z=x1MmgdgO}g=Z^F^6Nn<jzJwf8o`kIhJhjVi8=#Ag^VmC11K8bFff2-Yts1SKwSk!
z@KPg?SS$lW8fdl0j0Rao4lxD><zNPev}Oi|G*HV};Jqv(=+u1By3BNG28MLd?l<+h
zvf#lmu%I;qL%OCf0|Re(1_R^M%Tf#sGk?f33V>SE%NQ8a*D)}puaID1_RNFC;G7#E
zPw-~RG79lBFh1SE%)snf&A^a;nt>txB#6__z>t26fg$|{h%=diA^igbL;5>tsWRsc
zXcgS_3vXE!>*w+?Fg{xWF6s=xlcI+3y*P6~ZC6n6L@+Qu1MT$&IY|oYqzo1Yh71OI
z285H~+lc1C)=?_RGRpHZFg_~+Iii|@Awz+IAp^8=+q0d4A;XV>A;SmEo6NwF5zD}k
z5e;+S39$RR-mxmNE&(}j`o?#xqV;n`Kx|O7gVF<Ju~|3+gYyL0x8Mke1kJ1!ASW|0
zFsgutcU~xK<QFi=zSW1sXGSRlLq@I|I6mKk@49AS$XLk0kTF}6fkEJe?0ay=XJE)U
z!oZMmKmlChe3W2d&<J2)sL#01z>slU0Tl0_Kza8K14G6y28N7pprf7tGB7^((gdB7
zBKsbc+72=>WC}4bWb!dcGcbODUN1T81p^ZU123=a7gh$w7tEmgLXLqUQ<s4uQxn9|
zVqnPhVqnO00dY(j7&5aM7&6n?85ln}GBCtub}=wywt#rP3=Eko7#K2_A+;Z7y<lKt
zVBocr)qpkRGq*D^WNrmjD@+Uwna3CyGLL{bd<+bk*BBTwuRue4)*EmgqxgYUCZGdU
zR)azq)LP7B0<|YHK=q<K14Gb1*=x|D_!l*x(FWOTx}ZR10|(q~aKQ0^1MDt1z#wPx
z_I_X$uP>3k4GofT28QY0vKgS}JhVqW9dtG(0|NsycthM<Pc^V{8M@%In<4Wh14HIh
zNPJ~jfd=>)7_!(I7_ykv7#Q^2WHZ2P$r%{3R2dku6xG0;=S+Ff*c}5ymLmg0maQ5C
zLw!+~Y$oW~$WsgqS&0k`S<wpM5;z+ai6F5F3=COKnxIoxWwSwt`+>yHFfe2t(_~<<
zagznj;(_iu$@;{=ko7?mbeExQHfY1lDF%jYW(J0AMok6=mE*G6YLH%bwk!ifwj}6K
zWChu5eb6Z*Acf`(4B5t-;94RFIxvtO$H0&s14(7MAh7@jhU`2BhU^@Lw9H}#**uV#
zHv>a<Jp)5_wI=AeQQ3Tum>UB__6!Dw>}d+%3Z?++k?fTW4B1N+K-a&@w!_4ZFw`?-
zL+2V9K+}BFy^&5EpOpfuNoK)TqVUMh5M*F{H3eFcWZ!3C$VNWUdsYgpF%8#(R*%d|
zfz=~m6`*{^fYz7>OMo&e3wlK|eFLQYf3<yjJg9n@eg#z6Gcdlo1?7K%@Lw}em;KBt
zuRMbT(oA_R11iLjnkh33AO^j*2WgbzjDYG(f^b(rWm`eDkQC<`sO$;|_XSk;G>9w7
zHIoO*e?Oh?3#$~@OdW{wH^NZ92Somj8OU%+u9+E7`A8@qS_!_Xoj&Iat2E~tsPcu=
z4}iE(FTObn<|@2kV4D7nf$_~9&;lYucvx~k%zVo>UH&VpLj5cih#_ym3#pK6Lioa+
zSuP+gp!|#~4cdROnn@ORfJny+P)sl|Fo3Uqc$Wye@bbTGq7kTh#K4gKk%1xmtp+%y
zC4$z!oMK?e;bEv}$l(AVs4trcI)4QusL8;PqpShWTZw*<ypZF=z>wpi$-pqtMK&3l
zBy%zu7;=)O85rM(K#J@RaIwgpE}IN$pYk#@FuqS^V8~g_z>u>L#3^K8$l1!kkh7Vc
zf$@DU14GU+28NvaL!j$8-gm)`;ACLnu98gw?KFEooq-|e9RowoE0FfZ3=Fy43=Fwo
zne_||xvmThxz5niuTuba55i)`bO!LHxye<s(V!9vdW(P^?0`M+?V#^NAfXcty1Q7z
zk%1vMl7S&N6cRkqpd#uN14C{J14C{BBy^%dccp^FCNePOc0)n}cDGmVHU@^=4M-tj
z_W)Euu-eJSiZC#~7X`UKm4PAm0|P_uI}oRkfgz8Hfgz89ouM8a6nVl740-(Ekk|tW
z3A+ajoD2-CfwFO+qtxD?Wnjp&W?;xO2Wh{_z>pWgz>pUNUFu}d0y@~A0kr>S{Q+6<
zVsg;_oA+J3;MfiZO(lTNV^(dH4F(sWY~Y9t1x2LDDbTt?Wj$FxUPcDS_j^DWlK!85
z?mMeWeTgi1zy@p-=zc}9|FWQ~XEYpni&E1WWIZ9FWW>NQbDFF@NcRUGUT}eDZ^Xd(
z0d$7{NhMi(&^p>>py6AUjYbR%(xtLWV5LzIrAlTXrQmu<*%(w0aeymzWouA*`-Uec
zDUm@IwA+CJbPBqAi>w-WmI35sYkpZ7ut^ONlVprRCUGz@xVOm4fGn*7T@ibTNpK~2
zh7J;{<<OIl7!H716(7^Vd$a^ss)05rF)-xKU|`6bpaz<r6I`he+V69Ufg$e@14G^}
z1<-LNg5Vi>kk|_bhP)?`W<9v`a)=4KQ=$Tt;y~F@hJo>;t|n+9yWl2JTMMM?KLbM^
z>^hJN83v|z=NK6?*(UN#VNqs*cgxCWfFu|gKi0c5GG?-XWMRW=<v$phYeYdy-b_GS
zSdCm5m|j(a>UAFmhBfyDr!q1yFqT0)S^?S|1#(9V$fKXQAs(FyK6-_LAzy@nA)g20
z(W#(?=cgDL@~s#c^35RroB`S(QeVcvkRQdskRJr~C}@fKntRZWLIret(8t%Hwcm>w
zGhvRb=s<C#A>5Ja3=HDcf<4fVR|V`!Iq(hUpJE{n>;YA`b_@*p6Brom^1Gm!yW$3l
zktT2>4Hy^>%oc0_MX((M<EJCMnJL8#f(=F>_Vm@iSY-khgJw}m1e@Vg7oWDGh(P8=
zVDg}3D!9s>fuTo4Fdy1V`t%QCYQ7=ZRPo=evh^DTQ^9sZ!deM-a1*#>`P>IuwbXo3
zFcma{zl<?U0kjEDFdZ~Y0rJ@f28R4Kpp%7!85ln&f}5Ix84%|&<R4>T$Ug!)VUk&y
zf$?)an(TcBhWy(M0&IGq_9<MG0Rw~7OTkF6gBTb;gKoa^@)wK*tteQ=!N9QK&h&@B
zS;gxiXA=v?K&%pFVEha^#Z;#RCISr!s61#zaa5<EC^WYAK)19qfwwn&d#A*}uy3oN
zgaiZQw|7hvIW$2>aS2LELe8AZ|Hr_P|3wpY!j7OcsEm2Tz)(<c!oW~qqyRecP7r+S
z97xccfuX=zlYyaNn;`hwV~|)i14BWsCIf>vzn~1La}E;Q&A?Cqnm5jA5tIS<-k>QG
zG;R>p37XQF%E0(-1$fu5pgbtMfpk4$U?{i;lHAI`_^m!&0kjQQP)Pxj*9(3!Fcf^(
zWMDY#C#VZrXYz)Dp^%q>p^#mZf#I}>pdM6Rp$-E>A?T#qc27Y&kh)Wv3=C#|f{tJ|
z14E$;14E&cLK%agJ81h~6$3+IFatwjAhbN#_Xm^-LASp+Ffe{C(*zyhBj^cA86cJE
z3=D;-&_uqU2ej`DRLNH|fU>wJ1L$%q*jZ%zG(bH?fs29~ybO$AK^;ZVDOiPN3=D-O
z%nZy4ObiT#?F<Zs&Fl=!349C;h4UB~3g^Ju9D6@7)Ps*A`+5On0b;fGJ_%5#fr0TW
zc(Yq0$YQ1j@HjJ)nifcb^i2q)7wkBu26%C`Zv|9VA1=#i0ke1C5s;r47{B>4nlolG
zLG*Ii!itK04?xlgeRgnD_cnk|xM5)Y);oRGKUP^49}pL$5OjnCq{|2`hxQ6UeDLke
z^w<AbrRw+UfX-oHWXysM4W?><2FF2L4+X(7&-m>hc+?8KXx?+3Koc~H7r<Ii;5#nA
zuTujpArNR1U|^_y&cIN(k%6IbwHjy%pg@xpq)}9Og@K{)oEihe0y}{wHPCud1_rgl
z?+gru9}AL8Di{RX`4|}LdJ%iE3IiCJs}?aZe(#-L*Uu)yR+s_qAfNfqDiQr&ARILP
z`a_BrtTkMif$@hFs5bjA5UvDr0|(gdaByi2I#Pa>0A$4=59mC70r1XH(278rg94y^
zVGO5u${7S=I2jm!$WOIrld9JTd)gn=WSsd~Knm(<MQG||1bh0Iutqt9fRrHQ)~+I1
z28JThG_Z3(7nlE#V$4*?WDo%7-ct+=MS%<qMa~L|3<BU?VIYxZ3=Bo{6p|POWI-#{
zKq6Nd7>Z6PBs0_t$bz!vDF%jOJ_d$j7KIcB0a?(3HIRrs14FU7LMnrREHqOU=Q1!9
zCn}^d2*`pqsesfhWnd_ttpFNG6p#azDIl@;3=G9D6*5yQ7z99j(LkNM5-SFV5(6a$
zhPnU&MKK13rSl-^fb#=W)dFb-<}|zM35;wa^%cwv%xQiM3?*3%3?-l$!n7y`hLRoz
zhLSFJ2IjOh28NP33=Ac+K%625hLS@J3?=(O88XcdQs^u005$QLJ_|VUGcf)HU2+F9
zu9S&^p_Bn+b`%2x=;-BAevk=i3=E};3=F06AWjhjLut4T14F41gB8d@Q1hOE#+I3x
z1w26~!Gg`IVqho*yAxzqCj&!iJ4idoteFf9rPDzikXdUO7)n=xm&iE2n(oEKCd*cv
z%fQ61I6aq%O^H!)`UEC6<=lh(9A7~5{5p*M9Opm@?bmu1&`p5+92Y>L30lb2Q^e14
zQHX(|E)6u;nrz0;F#$Xt!^pt++lPgLVb%_Qj!EF=7YhSJmLxyNBv6v7Vqsvg^XKQ7
z29^OW1Xvk2U4fZRtX`6zpJOAaIRsLY+QQEPZU=#uFaEY>VPLS`&(AR*Tx7B^FsN+d
z=U5=gz#v)<ULi59m7ik^C@p}N#F;TLEC}J}Z~(db_i`2n29PXdwKnKLP!)a-Ct(Ig
zunfox&R{RFfV#_z`8gm5FL7lu@N>9;N?njgBP01azz1r-0S#n>7AXDR4)Tft8)yWY
zZ5uy3c-7nQ*PILt*^Bwv|AMC7LFcKqs_?V_RRNt*2QrZTKRDz-fu+8WpZyUmu>OD!
z#mipo#?Sr)tbnT^je(#2sR9E-3FwSOD|LSMXJ84C&RS-E_A_vupcM-}Mf~h%6hP6y
z$-p2fKD~;CO-lDZKl^&Ps-;{dMTHFf>>H&S7%B|8ii!&u_}TYKGcXi`E(F+>IQ<|C
zo0LK#Kl?<OmcMMA3=I31@v~0^-QrUPG59wNo0@eZKRb9c{3-B4M1FS2YA2A(7GLCN
zPl6lZz{$V>a#<3R%VJpBq;zNVv)jW}frjMOfAX_~E(T@*g_xu`Kf66>+7T4)R_fCi
zv$CnyPmkbdmxSwi&dI>AAd{b6667?Ho*5nd?2@33)F2MX04cBx3j+fv=)k4V8>nl+
z1<xChYd!Yzv-88u{HMstz~Gd^&(1Fm8fyZ3m!F*<G&%c*t7y7A8ymk~xjaAH2e^h3
zPS8nM{A?dU!&o4Dol^MOK7a;-KpaW&=`Cz*Y6>g)*>1wMfDYy8=Hq9(2}(LpRj1h4
z)EH%^e`I5mt+!PNJDBaXG$_F^Fq9r;U?|<I%D@m}%FlLIm4TtO9JDY5bXgcb+c`*r
zU?_dTz)<=O+9J@n!@wkb7c_Wa3Tk6>F$#hv1VKA=(;4kSrv)=`hw`(PL5gz5IRTKe
zoU4Oz4g(Wwy@5LDG<bftGIa)qOYa#NO8+u2lzx?9U`~R}>wz>dGcZU*^Rrd6GBEyM
z&dk7^WX8ZyrpmxjrVQdZF));wFff!EF@TP;&;0`~s2JyhS64{n@w2t?$ulr<o`ect
zfsQ~i&b<P12&nfYz|S^SlY#O77iI<~&f5$OWiAX1Wljtd3{0FWp}L-cnl%!2{A|;d
z8JHMkK?-*>Fq8!|Fq8#?6tew>Dg<w^lbFcQHieggiQywN0~0$h14CIF14CH?hyywe
zwvB<Itcjh0iCvw6A+2mV14G$d5YL!_p$ugERS?I4fuZa-14G$&5XYB+p<IN4p<D>W
ziDF<VS7Bf%R|0X;85qjV7#PZpS{WIb*h?UeSYW^kVa&h4z{K9ez{GHI`bQ2nDOMeD
zJubk>CSDH>js>tYPZ<|LrzRK#_}ONgGB7c!fjoJefuX#JfuXzrG`9;2jRg;2VYmP`
zSRugAHV33B8l-7A14DTu14DT|IAm%dZdvdF9E5B6*=F-HFeNd*V`gAt>tkRjpT@vY
z-Us5$W?(2k$iPs(mz{x$Z3P2E`8@`P@*A=YOl(`~7?{`&f`m^pFjR0eFqHpSWME>u
z2HyI`#P*nhp(2}sp&}EKAQ>0VU|`JoKb?b%O|~8~gTc5E5-&&j*%pW*rG`ZkFrO>}
z<tR{s5a4H9V#dJ4WDWAkZ3c#lDh7s%3Xo4=-d_Z6<4RoRXIlzVm;zF`n}MOClYyb4
z9i)(r1>)sJ4h*2JMiMXh*_MbhFfly>`BIF5p<)&TL&Y=@N11`4Vk-kf#YT|d3>X+H
zt}rlEoB?rc7#J!U7#J%4fH<BE43*Lh43(0gSY``@n7*V1>fI$apjc*P1Wzd=d2Y!b
z2F7}*TG%od0e-es>I_WG;vh%gW?-n)W?-n)1UVY!yCr8p@g&K}&$e2Tfr;4xq;NL_
zL!}i1L!|{sA?qcmnP(VS7#Jjl`Po+SGB7bWGcz!;K4D;}^k!hFbO&)hGB8xumohL^
z7DL8=7?<v0VEpzEIVCN<0So`7uw}9W{A?RE8JL)Nz%1@%V5sZ{X=0rVv3ThVxF%Rz
zScIQ#y(j|{^DmIS>lqj-=P)o-&SGX@s%HhceKP|?<wlU(VWq$_0k9|4_}R7^Gcd6z
zgX{u@#vulV$^#&UtOgLfmgRsI+VHb&<z`@F*#a`(iGiW=G6O^9c@W2+fuZsP14HE-
z5GRI#p^Afnp$fD;k2RBlp-QHnfuRbtJ&(1FfuTy9fuTxMk%5V|8Io{WConKn*)T9v
zSwUlR*%C-hW-)<FPo{|)pjb6z03C>!1T7Ai9f2-$U|e<tlwKJa7)1El_Hu$sLNf-2
zDsKjcDo+r{iGiUi3S@tT9-=T^c7y?%I1#!{wHaaRvltkvK&?zr0b5nYz)%I6lT%?}
zFuKam2CigJF)}c*f{u0XG~s7UQU`S=I2jl+Qu*1E)j_=tPEhNgpAEENgy9tE+=oU%
zezsJYRM~faHt;=-uUQxvWViFPWe71a6sLfeLGrVKFI_qXswACn@Uwx&2^he(oe(O?
zWZ-9u6k%XuJt0(*4`M4bFtMHmje-;%0X5SVRTvnSe&J{H0o8h7P5*^55<$A^eH0j&
zSV1kI1$O*wKAIp0gZ1rKVPMeV;b&8UX<>`!WMJs~$j_#t&cFob^mFpFsaP>Eu|XXO
zzAy|lXWt^o&!!Hl2|=3?LEg|1W?*8=jACF&e$LP41UBD{kAb1c8g!XfaY{QQ1A}cM
zKbtJrE)@ob8A|-DufZHf1}3(Tpg=p$&-xl<F_?3mpY^p30~6afaLBN}1=)3qtE4D{
zfuHrA3<G2Ccc@*$TqTL=4E(I$K`KD5vA)gE2EJbg+EAJ<&Ce!Qf0v(i1I#*h&~YEy
zAQ4jrCNRgLo}YE2CIb_D6T~{u)=CDDKV>KIvu=@KU}A4)VPGhf<!9Y0$iPq#&%(f9
zXvNP8zElXTY&$>ec5n!=FfcR<^0V#$x#kqaiL4J9K!H#Y#mB%<a0f)BIWjO<GVrs4
z_Af9%2fa(7<DHBPK#c;<mFnQ+!8%zU6s`;mRs9SMRqg5w3|!^>tdosEj$mM@+ReaF
zwH35!e-S_HWY8I=rx+Nj?lCY_-B4#>P}SmRodVv~$-q!w^`C*E>bE)rL&*|;)+wL^
ziQX_URLe3jRErnoq%!cc&X!_esC8zV$RWkRz!t{OIv?Z%kQxUDhH4u*aN~z{1xzrC
zfuTAAI&e}3YWjonp$Y>N$5g1w#h^YUNP8v&Lv=cLJ-94kDEq^}B+vsI9RTI-Ohy;b
zQXeL1=yvKd6HrORd552Mz8C`&$17$ACh3a|4Am734Ao^I&RqtE>Rtwh>UKzB!BFM{
zs?EX134n$Uia9`ot!RcufDAR{e8bPWoRxuz(;j3H$ka6q4ArYZ9FVC885pW}!%WQq
znL0gAkWIS&3Angs;!I^^%wk^5m<ej#EoRIBweE`H2TGPPFfcDz$H2td33dwThz&;2
z)_G<w#sb&?O4%9)Ci$BPc^9w|3gB~YCamFS?G**hp@ItGlbqnzAZxDy14I3#_n^`s
zV=q5z2VB8RsDciCaC6a|fnk;lKWhjh0}~eyq_xco9#?n+O@7s&-6n~_{H(4ZC63_B
zK=@f*6+uH4pnSKQpVbvS*8sX}=qNv{FZh~Kkf#265q?%PkgjG<1_tp7{H$i+PCnEK
zGc_b5%s|7~puFI9l%Ewe{3cosGGewfKdThTgriUsKw}o*a*@-HpH)f)$pk6zfC<zQ
zN?=FSgD(1XDBx%11R3!QYA>e@DEWiW#^7h=1U3CZ_Od4Mv+_wYFx0p)R4_11oyO1d
zk<pBSLH!j!%S}c`1}1J3NZ_!5SK&hghvgLu14CaSKg)d%1_t#ykc$Hq_*u4t)cbQ4
z)u)y)@Uwt!Q(<_+04l>~FXCre4Jt?8s4y_}?Bi#t1#>{kTcO4`g7XL@>{%9rqEA<r
zp9OO3D@fg1sJbv@b)_J6yRY)In8MAw$yJm({fjW0l)xq<einI<7kHRJlMe~g<wV$|
z>UsHDKqvk%@tCSIFz}t?XAuEyq&o{4MESr}1=@KneUqO>6lBjShG+(cZHD|T?2tYP
zLn*AW2U=Ip#B)NOfdQnL9n|wa#lTSggn^;@9_YTNqx>xFTHx+JLk%+nL-l_-&{;wJ
zEcKw}HK1{v8W{$L8YxI~o1xT#f!X^y0~600Xoi8M|I!!+CY}@EvjBLeuz*HQO&LIL
zlF;C1eg}0^F?ew~0|WT73nsoAb#PhA{0=m>e2RggMxTM9MpK=E!C*N*^SgR*YGGig
z31MKU0iDvOs>RRz9<)2VoPnXHnt`DPv_fq4Lw@G>pdKnn{~88{nkA4Tlo`}x1dSHf
z++|>>xe6&lnLmIQlAdB<sO4i|sAU6}i_Bk9%SGm&px}JNz~EAA!N5>!0x9m8|3F1+
z0~r`<eft?fqdJfxulNUO^ojEfKl3LpXdsn@Fo4So-doduin2+Aj!l)cV_@QAoh~cJ
zrldCqR7Nr|@yUWpi(&@YkqISR7?}8KU`D)QU;^t2n4T-fCc{?B0V-am_lvP9>ulm@
zJ`D}gJlNC?XcIdVzamt3z6b-8_#*};zT?yHiLoiw=j$*qSE(>C@jU}u$?d|x#J>n}
z#&^C0M4F!!EX@d$hL)H4As}h66c0=aoLTt4@G~C;r)L!ghQ1hnX2>Z+puho@Cw+zd
z%(LYf7=#p*SQr?j4)Zh5)ns5OSB4CeFt0}%CYdkJCZ!<5&s+^Q4P*dlz~<Cce&%Y>
zMIoSOR`%lQH^tf17!#*Sut~YA^E1c6)C#x?fi{crGslU7+CH2N47~aL%yHn8>!5Ze
z$TKjMf%Yx!HQ{GY1#v)E@$5>Ro+!a4C2Yda>;gBe2ebjVXnLOnn`C_=KXV``;-M`K
z<{%K~4QSQd0%m?@3$PwYDzJu5JTdBkYIniuCZIZ(*+PkdNpLy?Lv1kwLoKL@$QH)W
zYymoa=M4ix?Ewac+AZ=7OhS;3DueYC257WeL$2=%VPLqx&uk;Wz$Dmd$G{|Xo0)-0
z=s5#J?Jov~+HZ;sOhR9nCUPh;FbOj<P1FL>e4ryk*cq6Fr5PCN#26UrgrF(H23(Ue
zFbT#^uaabwWi0`BALmH2$=8cRd|<POfk|)<s9{&@?8v}SGLN5G3^Zg2T~%ZS9n)ZR
z0eMhpGsJ^p`VbG+889%^fi}~FJSYZQp7Mr)p)Q(%p)Od8fkDuLpIJhNfuX#DfuXLO
zfuXJuyeWsDS(Sr<$v|i`Xz-<^D3yVqSxuIKN$3azL;YR`hWf2V;PEtOU2sBSp4iQ-
z%D}KIae9^%o3wcS8wQ5@7f|0>eF4?z3`|1p)8|OBsjyk=fW3E2icQ_{NFwMQc*Z7>
z&&n%Q7#Nmw@-s7mqmGe*Nmx?|98*jxAdhf@nnu&*q}kNM6Zx5WL9q>sdOi^64QNzS
zp^2aA1E{nX4q{<oIJJ(S3AA=iN{oepfoDHI6R4f4b_-P8^Q`A*It90AI#_=CY-u)0
z%XR!rmq5c#FF}KsOgA7#gO18(;AaA#jP?fPw7ZaG&9qAiwCNO_tf#+~W>c##<Y!t2
zHWw0e>acz#=(JNNku4^m8zuOemO<x6Kqq-NFsL&yv<L7rEdw2wdWwOeL6d=@LD>Wx
zz)Z`W7??!1FfcUuF)%cEs53C|R`WA0^9FTx7#JE#85kP!RT&uSCi63`kY->g;p}9Z
z$f3%>up?snY#BBw;f7fZ3=LDDg@r~0IOtEvu&LKi=VzJ)PC|?fOd_Cx)>%9FnP!2;
zAfcfOInWP0YN&0*&lCgp6e9zZC}<=cq&Nmti-9Wt^>_H0;*=N|Dk}^b7&g6S<7dj^
zVPF#V=4W6qKg`brK7DH$Xxq0fCqGjT$kHk%(B3TNR(_^j9tH+ENoEGFl7eCeex^Kj
zkOkn7hnye*+Ljo{&r|>&HV2KN8}Tz0!Z=xy{7i+QtCy=FMG4acaB5@$r^IuzY*P9U
z_?gN<1LWX??~=UvnW{i_Y!w3ogCGNws1O5_=mXHWqyaOi+~8j^U0jY$w*E~j0|Wmi
zekMy$`KScmC7bNQ&tz!?D!~{t<%&~t82FhS6&RSr-Y_sUY-eC-*bH9K%+KTm-k-<7
z&~ToCq2Vm(ND-#JQVa|rkGq0B&cM*{n1P|;F6cgpG=3&G@Md@h2GChH4gaMW7&;#C
z+c0^7+V9I47#f8c7#jJd7#LQ@@iTct^*3rVFf^*mWis$H`Gfp^i-DohhJm5cEQo<g
zzH|C}IX1ESSquz~F$@fi5$p_1@*smM7#JEseH=aphRWNZcHdlnCNWryii7e>rwKok
z1P23?co0`fQ91)ZlcWj*lXw!Oy~G3=PG(_X*sH_Oqy)+nponh~<Y$8PN@XCI>Yndo
zV5ptTP!9_7Dv)+?;DXNstW;8AU|3_!&-fQ^Eoe8pQU^aHc;Wz5jV$ZrXZ#C3){_&o
zi<_VEFQ~LSB?Qh1jQ?~%IRTW_s`(lJnSycv)Ts=haje@cpj6M##L3ApomqiRl+kOt
zqyn34y`4G(gS;L;;~h}zxr%|IaXte><8*Zfh9jQ*jCVj4(J2Oo#?uT8jYriP7-Vw!
z8SjEz{f2>|@f`z0;|p~LhL}2j#=D@V?lK03CSeAKCSG+0hTRVQjCY+F7}DJs7@8~?
z7@CZhF!Jy--e+ZCl9<NNz@RvZpYee_11CfAAyC?nshhq}flaJF4^#`NGBEH@<Y)W<
zYWL2Abo(Yf;b;6P1M(pQLsK#XLsPga1A{RmKO?9BV>rb;@d^W^xx@Gs6#Q=(7@DRt
zFf>huma>{P;Q3u9Nl{Q+0Mfw&b%U5V;OodW=P)ql)c*&`gV)D_90KYHffT2M%m<&d
zS)jqs2s$|zwq(2zdh{$)1*mS3-Vd%@7*A+`iev_crtJ(2O{*czI>r-bpbiBCL(?w?
zhNd^_3=D@K@iU$Por!vifuY%jfuY$<J)eO=g`c1CB&h6o!@$to&A`xHFVDav4ZTdP
z$Ocx=7J(MufqJ$g{ETM>7?`9~m>HO)|1vN%A7@}_KFZ7hPL$2p7#NzbfH-0d49(9N
z7@D6z3%ep8Q1@}VqY|5FeGmhaj0&VcE&_K+Ipg^m&kKOGnK3Xl|72ij{tV(cF)*~q
zFfg=$hRkIA85ml085ml$K{7E63@!Ey3@z5|3`{ba3=A!?3=A#dAWj(rLrWb4LrWEi
z)6BroGL?a$Wip5}fq|iAEdxW#;(8EoE(1f$V+MwnyCBXg28LEP28LD!Sq3JV?ZpgC
zGKUx#ILkp&hZz`J)fpICl|h^f3=FOI3=FNdAkJL|hSqEbhSpRG1}1sv`F+Kp5}Sc@
zDnDbdC<BwU1~UVb{2>O0);<P?)-F))KL^sZhJm4V2}2MAliUkPC=@4vLY8wkKjQ*U
zW(Fp?Zww5rml+sZ&x7<cGcdHiVPI%|0pbWSFto8VFtmX-!O6=qFtjN!Fto{lOx9vx
zXtQTvXfv&ZnmL1kNqXV*{mN`ItdK?450u$N>l67I55Tg#^lNa9&UnBOlzccD7(CbU
zGaj%9CmR(827_jP#vL%VGAa<YJG7u`xytz&cglg(azc{UP90Dg0IJR9e)2Px!Zp5v
zXe<S51Z{r?=`2ImSq9e02}z4(;7h%@z@<84HMmq~VPLRGo4!_sO|pIkKVvPpPzN7e
z%g+ct`5ILC6&vw0)`KQyPjQto@H4JcU|^DY1)A8k<>Y5<1Q*sU3=B&}_!)aa#rYes
zs;SBhOfv7mX9-kI=VM@~igjdQShj_qQ3mXKNI>>L4}WKT!Z@d%fl2QAOGd_Cenv%B
z1}0et2hiCj{ESMP3=GwE3=Rc}DGdCK$~+)tG7PHVfhR^4b_OO{aZt+*;wfFQrx+O8
z_AxNDf$pZWNaJVJ1N(}Bq3u2cL)&dg{l%yUIWmo*?FR!x+ZQPYhWeZqen!wXB~Wj(
zU4((5ollB^0pxcBu-_RN+N~HE+6|-_7*^fmX9V9C_lAL?J&S>%Jxz*%p>z{JBWTeD
zXxm4769Yqg1Gs0$7zggzF;AQdy19k>7z2}B9;BXRGy(@514H`)28Q-IAW={l+JeK7
zfuVgT14H|EsBPfmszJ6rWMF8&532v5xuOr8ytyCnGun!R67eAhhW3994DG)_>Gm80
zLkFm)6=Hy`zv=aW^a<rAP2Z@-CRN`j0OfB7b)+XwWd?PbL8U43pi-X&sMiOQ0S_mE
zHff|Y6@!+Sfv%PUWwk_b<F)|QE;ZBRXXNH(WMGmv;{>;g7`Z_m>t&pv)ieBz+{UnE
z{fwWH+Z1$sJg7cgV8_qM?G0*mfLcV1yr9+k;MQx+ZGP~+9?^1;k%^q37Q*y;bv6mB
zQ~X~*DQOu<9CVz>$~gWnpmnWPJedsq-yjBPF)*08^S=P8s{*M5UAbv~c=|<kHqrXi
z()@Qo5}-z|{7nw9Tkn8Y|1Sd>a1UZYI0J*K5`O_$9VE$G!VdKZoyN?ha77JtV>Ew(
z8UvHU6$XY5dj^IMOEpjfp1;5lG}p|)(2>Nz&=I2sPOyctpfM!|hK|m928NDiH3o)=
z4*o(=$@YeUp<^urL&tJW28I?v{z_2QcZz|b;{pRi2k7{2e+T|*nAmp)hK|pgphJfE
zo1keMbSze<vO)<1e~T;wlfq2~hE6jEhE5}BrD=Hq(lt@o0U27%Viab~U_zXqZN&kS
zpZ;BgP1aqOKM3q!Mg}H@KWq#PGvD!tD1q3ZzDus376XHZ1-~;)iK09k1H*Amepe+1
zCPjIWlAP(`3=A8yr$=kD$(Z%4F)%Et=Qmaa#VrFvX9xpBr;i!~!?f-ECZM%Orx+MI
z8yFZmE1-3md=98~pT1U;O`?8JN+x8<C6nR{-lW_DhLlW@B`<gjGLsonGR;7ns5uxI
zYCTgj!Iu<pFfdHxO34B>72j|$Fl^vU$pSTcK<wn1DOsTA)*Fxm(>CZbFgUGGNn~SS
zQqqE$oT$#gr1%12TB0Fnf}W!uY+Rx(h{KyyP{5Fq=mlbfj<1uGN%4icO{p1Tg0BkH
z1noa5z7|lo?bw*&>jX*$Yzz$T9Vy_RJ7`hX%(W@t#nzxBIc(}uz=g>vkik(0QrtvA
z1~D+jC@tUt``SYiETGK5Q1v>+nwNn|=|3;%xTzFt4N$0ZfD%HAwIP&U>zQH=TI~$-
z_B5^(8}KP*91IK-lTvIz4MUK4^33V-+H7K+4aqDVybMgrJEq%dv&k~mdQOkkX4BQ^
zOlIK*AGyZDz#yEK%)%`V@(yUjY)Uc<4;Ls9K-VQIP2Z%=X3f>4o6P*4mw`#8aQb(s
zDPlTcQ<y&?nZo=D$rR?#NTy`#u-R}vNM^pq%fO_nHGP8)#3|>YhTKFp<R-Eqw~!1`
z(PgtSH%n%Y02$&eRLGFb93jQPq#DcsYNEdZu|SPo1A7KO1}0T!Nd|`6x@2Zkkm`=<
z({<U@WNMp}K^H_asU8z5%*<m*X4X~(d7G1g;dt-#o4Rbu>NAs>KyFmqBLtFXx(2?T
zQYgQ)gdv&fngS?TI2joD4^3CrW1Cs;%)-EMcxo~e$oU&qb7e9lGu;AZ;5S@ZASS5n
z2d#mr6-{Qk4fY}E;N`{JlbLdP8JN_)gfdDQl9_V#7#LC*IT;ul+LM`b&7oGT6G~>v
z1Lgl(76t~P@?<9PMxi%c*$l}{1)w!_Z@4n2TkEsAipD21`GSnQ1#vMbjjG?8K2@Jh
znGJL#%*G4T_vy1mYuB(RGf9D6#K5HC2~jJhz`&$_3*rnZ3#c=;F;90fV6%2INM`&G
zQ(pvD&-h;rq@F96A(;u}V1_pgSqu!^yOS9o!xZj=D0~byc=|yDHsksg$&9yo8JIL4
zL!@pig3J&qU`S@XZ2}5>1`7s;)cRz`K4@msT+YeB&~_!6u}_78Nprans3b^c?6U-^
z<pdQ4$&7vA{Kg5&yvdCHpheH1wKyC2k{SC!1rCUlJTsZGAJj0CdjoPW<3w=0urM(6
zs3bE^1UnaWNWbv(iH2;-^(8jRj1xgM3n;pbCnhsa1ZjQ4m77?>kjx0W<~%4FRIH?$
znKLkmZcb+GU}Ip?1RZ7ua%hJp$e~cTb(lb7a2i)KV}}EX1M;EG@?=JBs1LOgpgz=A
z18EdWnr>{wmRvt8nNd{?B*4I=1-jiCWVE^zSRjjm!NWe8Q3C941}3eQPy-|kLDHav
z$0!B%ASi+9ZBJ(8<7HsdIuBLFX8>0v08wSbz;K*9`8d=#?KTbuhBn?S$;Wj-3ON`U
z5^qdbGG;5SZ)i_`Dayc*($163ko*!HK%he(g_2*%Gccq~X8@gix#(l^ewaZ!K?Yq(
z-VY8Co@7IYWYB?93~zXnjTn*-LRvjG3=GA7$<V8en6$4!wCn<FVTfU1(CD-J$!N{M
zP~>S<p9C8H(zy>lyv-^DJW|5Oz~IAcl?nC-8w10#5UVUsP_f9yz!0ltRSaXdU9l<w
zhaI?lwJHUduWSqqjytW&#2A>sW@d|7l}j@)={$j-OjX6ekf&w!jwh*z!Ky)sp`L-Y
zg^ht>(R8aG@R_u13=Auqta`z09?(3d6)0&ifX*$e^|YD<YEOXJ)3~fAffFSg14F!s
z6=;DRSj`GEtF171M;^7>1FqNEK((0FUYNMj9jhZ?HYmB($A98uU`SYC&A{O6ZlwVV
z3|%I$<FrBTy%x}xnBwDBQeX*bUXZJ$WWZB-Weg1NjC?HNkYQfN<)9uasFMU9G}aA=
zc$ndX1Efl3TyDa^qzgI#2DGuHjDcZK3m=OwBjgq{#$~XDAqJpMv+g3eX1U_jLIysT
z0El}TI+rmpbS{Am@-i;x0GSAyml2xI$D#;z2Mef~&A`CG1iGD+$zYp014FzOAB!R+
zWiWJ}W?<;tESH(ez{jE`%)nG{u#JJC%Zq`b%cLl&h=Gp<w9b>Yg=r#(1Ot=dWpHba
zkyQaSEi3n)kHwUefl2=*GXs<1Lk5QKdIpB>YIX)D!*>h}-Ln`Nx~G9SzZn?1H!v`C
zuVZImGU8xh=swQC(0x>vfyoH8l!?m`YGw|2pJc*^4~(oipl}1N9^zwu$I8H@4_eE_
z70tlVeUE{m`wlY$6ITWULpR70(6SXSKL&;#1_p-if9woQT%`;QJ+cf8J<{OCxp1=~
zEjC8hoarCU*hK1QFfj3$GBD}A2QB+EVPwqYWCkl`N-cmk>KR!#KxV`A`4|za+%sTj
z@G!F8fzF9Bg0wT*GBUzX$;dEZWK3n|Vq#zbE&DNA0XCVD^$FO6Apbo9t=a?mQGt*7
z3&?|0>=>Agwt<MliVRFf7vN{|GqV0*VD^%RkGX)SrkOa5U|kPJRt*N`z&Q*|`kRql
znf?Io2^$7x$tw&@`e(tjcLx~Qz;k-_AXg-SbRz5e0d}upKg7LkEU<+-pp#5Nu4NG5
zW3lFBU^1`+Mfh9>h8}YUh8|;C1}4K*&{WMPfM#fh18feAk;Q?5$zV4)B6vP9vNV7^
z#=vBdH@(k-O{)F~NFxK2K`*k4RzT;^7+Ib$Fc}#^En)csQj4ta0JujS?-I?xaL}EP
zg%_IknV<)$FxG&wkzqf$lgbC1RAuNX0WG$bU|{;a8Jh2y!FRXG-Qi;q*JNNa6tH7p
z`h64@mP`jg)-o^|g0^75(o1>(T>1tB)9=d+Oor}|*n){O&wy%6Lw4~Dn9rEkFfgXq
zK-X9>GGllxg8|h4)7Io;VFr~shTAzA7}Oc~SeQXY-zl!*d<H%iHc<u!#)BYr_QHJ3
zKf&riM}wbX=VSgU3p$+?Bqx8IkNG}G&d7+9fx&(YAM<?~1_oh%7SLAi96si!;6jCk
zfkAu%AM<N)$<M;Tkh+tP8C1J7fR^XvSMf1}R`@W0$HR4B^D%#cSPe4&*bP4B9bof8
ztD8ZF>;SnDv<x~dijR2*c#$yJ#OV{Q*u?8WhFu5QxlELS$!IcHE~va=J}b_^WVDz8
zG!OzZ{}$AIJ_ZJ^9y11pu0%fOm0(NmaxyTi`O3$<QW4~N@B#%s=9QprOI2K8lh!~A
zY<mU<87@B1>?4!073kc=mwe2iQ&Fa?TeI=iTZu9-8AHx0<YR7wZQ5cohMZLh7Xmp)
zrv%Og)f91Cq8S+WOY<@3KvEln9PA*65>RS0?n(unf6B+411@R7vjFN0e9WNT?1Bdv
zGr5vd%NY1{m`j8im<+ao&f?I&&c|#j2#OI#1|}0w>#4DhkJ(fobQ&BB1B3Ik=?|>g
zL?AA{20j>&kJ%dG;+No4c=?!Z_&~ZDK>qrJp~?gl+aQl1G@5`Wa6v+DaI;K6hj(t{
z;A8fKwDLt6m`psNX4NAp1I@Fd>CA&F3qu&zh$;jNN~j7@M}qMo1Cz-@a7V%iw2Grm
zl#f}Hje*IOo0EYdZxSD~ra6?;FH_IQtR)BHae>YZ=VR89WMDD|#iGdzs6Dy}tAC>k
z!K{X=0L7v(zZV0;-pPE-a^RLCBLkCZJtqT${!>0?IbD!7oD2+m7xOX8fyPwca24d&
z7c=lNE5Ix@1zmOm3IavArKb5%OQAwAOQBql|3nV(G3{n#U@`;UNZkB|j|qIZFsLEy
z^oWn?9JsLqT8p-tj|tSE1fLG=ro+bs%G34WrEQ)md`wqCc?YEFa3voTsA0?ia$hk6
zAJZeS^H>-dtnK)i9?63O2sHI2!N&wTd70sjC<Bw32*j04kKqnCQ-`D=rYG<eWCqGG
zIwgEas_M;rQFVg+=kt}1=^HqmvoJ8I|L0@+3+90AsfMU#=Hz5x1mF72WY&i&1Tp{=
zgisaWEjI2wd`yeLgCXF`h#>@aLFt8hQ06iZS7%_zZRcZJ1nzq?F!Z!CF!VIOVq{<d
zIb{hrWI&_#=HYPtObiSh;(Sa?Km&T_nG6g)3mF)CKnvH+%NQ7Xb~7;a?1WSW-~;kP
z?tu0QacJ-{&E#cZGIwAG*8~hbr;HgGdQN~V(GMROLcnD{XpnC)V-^DgC>Jlc;$s3Y
z4FrvVnS<_9$Zem#0JJr%gO3Tc3W?zj1C#k8a1q7S2`Qqo7#MtB^D#jdNH8#&AArc#
zLS)Su7?cG0nDQAJn9M<QH`;&rnDW63$~ZyiZu2qatAm#Ka56B6wem6LL&nF-7#KK}
z`Ius%Wz)$ApyMY&mG~M^_*sG`g6+5PF~!P)${PlTp1TYTJ=fJC=EWL-%wu5aWoBUL
z0WCWOnHvk*hW>_up;woIp;sNcdhise7XmWXg@MW9sT2c4<xM`OWbi5A3=F+~3=F+K
z@(hgGQJ_eu|G;o6fC1{BQ_vL$3=DisX}k<f7OU(S7_-x%btc0p2?l0~CI%*p!=SL8
z$iW5+@KY|JbNfIQEXuKosSChO7pq{9MPPft%?vOL<U9rj4!(M(OjZUaOLb-jCaY8i
zhTd2PhF;Kef2$$}hTa?ohTbf=B_#|@Rt=z*p)q)2B50!~_;M*w-WBxVV+vzrV6p_Q
zLj?sP=yCyJerQyLfrAbj6=9GdGiPAvjOJsq_6O<O1gUzN{1rg~57p&w0t#@bE`RWJ
z0%+~r?h|}W?u-mfR!q}BI<m=_tl;BgatF=vgNA)UapJBE8UzF7AKlk{OkT2}ijV=M
zbH5lLlPySR@N`EfHraZRPFv8rQJ79!&;l&*EgT@74p5yc3=Eycd`#xxOa%%jP(9ho
z%g1C68o>p%0#2{zV=@QZ3hHM}-^0fw2#wJLu(p-}D1liYR0r37OoAY@K<hbr+Zh;o
z8$suOwem3u%7Pruz|gyffuVPqIs*eJO$&lHr5|8m=snNC(0dx176q+ALBqh%`<j8F
z_qkkBDgz&rD7biIU;qtY^f5!Gju}2SF)&Qu1KOUlpN~lix<$HAnt`EDSgsyiRWK>T
z^m#Hc^tnQl@IlaoJ|vAWS!YUtwtVw3sXz)vhQ2fghQ1^Q2?l1^2H}ICQDp{!k9<tV
ztPD)nYnU0BK|6%|Y8e>%s+l1>g!}p!82Ui_8$mmS`<5~=)b}lhrL6-8KsUjG6R-t%
zZ_)Z~e2mwiVK^6hUM_P3C=BiTK_^^QF)-OQN-;1T^W|f_4=PnpF);LPWnk#rESJf^
z$M_f|^oD_<?*s!w-yx`<=E4^BDljnF*vOUDC+0BlF+K%V<{;fq85sH=!?N1k9PmX_
zOg14<M?rJW+$m7;9I&`8%mZ`RfW*OK7T^WI&QQnCa{+Y<c_;EQeqv={vegBhbI8ZQ
z0J?XpzV8!=C&|Fj@5aE;ZzI9L?7kV2Rp-wD>srUhD9OvfWb=lZf!X~i14Dlw14Dls
zh;xB~p?@0#L;nVtgXe`XFxM<+V6p}6lZG|J6B1k)n0%}m4WP|xhIuO(nByKodd3X(
z^S6M`6a{UJaP5WIJMRPoGXn$fK0e0JtPD(cIqVEfuCo{z`kyc`^j`sSmM}0(Fk)bs
zpkd0u<hq-If%g>ylbr=fW)B0ygbD_R2}K~zF$RVSAf+>;5q??#-nzxd#kYu;fys6s
zGebStPZMr3Fif}z_0vSqvFHClJ6&NRu>d?^z$eYOREB}c_A^M`Q3i&Ipd(N~+r->2
zFfdH?WMG)+3JZt@CJaojR~VS=xIv{<DXdG#u)qf@t_&7uVc-sh_<2DFNCGTa09QQ^
zbm+r!1}3{Wr0z*V0a|d*w*UnvEDg*v0B!!BzS@mV%H%R1<0^2|iGj)P0r)6$KE_qr
zprg!%a!T_U_!w7#)?k2|DJ%H+7&mf(luiHX#-=Fw0o>sG4;s*PNaSN&zzA9i#lU25
zGTqpn&AfgIA0y=cPzEM@&_$934t$I=bU+4!2KT!E@G<s4?X{oI3AzT7j}dgNg=je^
z1H-o6e2hJym7_3wCxY$eDq!GaoCrE@jvr)(v@IWF1I&!u;M24D7#qMhwsSJngAHjw
zc6=+skXE=Mv!C-Z7C;Sg(198Pnxqo61D~wO$5;Ta20%wt=kPHWfR;1BTvdfIunJ<J
z7Xt(T2|mUoR#0^fYC$*@Lyb%_1Z}Ga8QILom;^KOWD6f-k{hTng|yumv%yA!eAgk$
z#~1-~80fNd2N6ET2rbY`bx50*F#@z=_6;<eB0xJ3U=EAnVyI`bdjPsxsYQ&B(Fbe{
zBoS?f9vH_k1yn{kelh_ayTQlk1G?PNj)7rf253%19o%SU^a0P9FfdH)W?-1uY63|Q
zKF~wRCaz;(n7Bd}+~i;k20I%v%H-AvvZ?+9!{#fX)wle&_!vW28JHaJf=)D@$G|Z0
zJOjhTvmnkS28M}`85kzs2XR(0FiiZ<z%cPAh_j7>VUj!p!z5`t1}3*dpwmy!F)&QB
zU|^VJ1})z<zW|?p%H((uRF;7kw7?3Jlm(288THJI8M81>MBO67z#LGEG}e={0)ATR
z78M32rv(tx7(g*#eUOjQ860#BOirNP^q?4U2AvH9Iz}Co9o)g*2C0>=<6|_3sr3>n
zNR|ba?&jb~heoX(L~$eoLwVcuMlUv5%LSmt;|KT{!BgpPV9uWk9b#mV>w!85CKHnY
zUZNw`F#Wn0o2(C`Is=37e?CSPaY!9I$(w;;k}J4c0dEg_!@w{ppMhZ#bYCKaoB{)r
zJLqI)NMp!|fkCv1544Ay$=PVSgEyOG_+mi@a78TI1Uhj)?Izy?sF$2O!FQDNJpd;Y
z4h9CJX1)jD)WN~PaI%H(0XR|cCTA2g@IBOJU~=wc11F4^U_Vda;LRpdzl`q;*fdb;
z_`t9QlwLvgHt2{UCYKN3gKhZE7=v;N1H+`r3=ESx)xgQ{3}_(`$S=nk7$)u20H?w;
zpqdsW_LG5O(nk%jy=V16_A)R`R%2k8ET;sv|0>vi&~4#K^$dL1MHv`k_cJg|_F`a|
z>><s-1WBqN7`A{msWR}t;=9Jmz~piplmh25FiehQV3-^Z;!I*-n4HhRFgX*%S;fFG
z86*HYW!-HX1H<GE3=EUkAt%(y2N@V9?}sMTEi)hqwcceLC~bjOTfs*w!6_AcLOp_!
zP#GE1Sts@|O#zL8K*R6~^x$5mi5v`|dD68%`1XRs7$gpfvAy6J<4w*0b$s`_f`SMV
zH3z{#!;{3ocNh{Z;S3Cig7`Kwg2D)5zAR{s0w|6afXWKjUNvxf+bjb~Zj-MuFibwD
zkjcOY-iq~xfnoAL28PK$AftQ?vP)1?n>Pc)jK6$sps^p<D?Diod|lvvGEXK0Umv)?
z2Wbd0f{ss`@mGK+g@JE@B*-mn3=F4D`IbU^CE*MVhx4a%`?1N0X=)^w7BTRZ34$vg
zhAGMn3{xc2rrY|liAzigVqlo!1v=_W_XuA!xN2eq#rO0aKQ;~CX1*BkY!x{1PG9K9
zCdRvw&mXSp=JX?eY#NM<r@!@MQ{w%~XAP5ax0x>E&nCmDIo;Bq&9Xk2PZ2Bw2`$iF
zh@ik?0I&CVZ-<1IBILLRhAE{C3{wg<ic5+Z_!PAvAvk3c1H+Ua&<sxFQIqAM8Jvm&
zli8pUa$gNPXGr(8$s%z`r@)7S!Bo$r4b-KE>{(-+;{h9m2Hot!<o*?Op3?DcCT)VC
z3va-;z)dqV=>Y}pGVsicNk52vilK**fnn!v3&uB~-SN!7Ef^0oGBA07211-}S}=mP
z3V{Y9k~0}B7_Wg(V-jUx@~{N=`7Ic)Lt54#As<^*F;G87rv$D9)Y)2{Xu+7n$iU<Y
z+NwL(*@Cf%6UuR$F@0?Sn_4|+qYOw>1;Sj=6@_R*kl`{5MyM(QuA=;01`Eax(AA;8
zxC-(L7%Uk3q!^eyL2lT#+k$Z#v{?;mGXDpOgWD?cpb?|!EA9*ob0jRTfWngX4Fi*>
z&-Cy>Hd(3v7I#6qPJyTBT!Jm!Kng(ejnn%A*)%!cSlENSvUK|XKsFisFBTRc-YH(N
zQ!KzP;Y~_OW3T`nip;PKG|?pT$wC<vn_h|#RmyS<3^Bhr7#K`eO_vH{)31MRVZaZG
zUuy=28bj%Bu<8U3P;*GSTNaeAIT#pH&q{ZLx3IE-I$F}bT%dzzpt;59HAo}KGObYQ
zYOwaz5bf2HQ0>}(q^rS|7WiI0>1xmrD`?Iw<72&att<nR*J`L)pkt!6LP22^)fvvf
zuydv~=rShQLQqTSL==Mus4(#MQe$8^!!Dht47n+K$|eSeDQh%9H$_Y5>4O?63=C7Q
zFfdFxr^djL@m)I40=!m_VagW<hAE&^MKeB17uADpXJDAh!@w|=OO%1h+XQ^-m~=7Z
zmS|{6Vrc_fh65T&0G*!(I<8LYrgSJMcK$<hUN)>QnE-N{kGvW<{6b|Rxoj%v&U#7E
zikk%KP*6DjXJD9W%fK+zR6`T&hj4L-AEqWVFieft1kIL8LpJd-FifpvV3=Ay{arAd
zZ2i;@28O9^&|*D1f`Q4Wm4V6o2gG4n4A5ne*;^Qxd;~$QbWl;B!Ds>N(qtcDU{2oz
zs#qs2mo@_}6gvPi0uozhav;ZYFfg2$E^Vd>ngVA7yUhaZHt-B?y|fJ|1B0SY`;W8(
zxb%d^9H`8kv>cqvr6G6CfkJ8aI%z#dkk=rglm*+51U~t~*9sC!dQu>Z85pL{Wnh>(
zRhogxHyNrNyw8QxU)q3&fyq}To56y~w}%0A3v3Ak!_=b;3{&@mI1LO8Qy()hOnu1C
zz~noFfnn+o28OAhpfQ)N1G=nsx??DtZ2b)eW^eH2)S%%YP-P`6Dy;!_9>`7(1_td2
zX${czpyeE(>pi74tUyi&mEf|%(o$fBjG$}VAu6SmK+fi1U?`d{4c@y5TEJ6wKw8Qh
zq>BesF-XgR!wz&=npU)Qy&x!a_=4_EJi{(6C=XHwDtVpPNKIwbWnhSukm>`O4>D)X
z8mT^T$pOwWQhlIpPX9sXs8mP=fQ<12O{}k3BNYIeAo&kb6#zQ^2E;zQOez30%5#b*
zH7|uhDiRcF|9Pgzgt76~`}3qSNX1AqFiv<0iqlh4v7jR7KZ5{Bya-9W3?dH7*kNi?
zpj#)I{ATcEGDtyA^Z~1PK~nDuRUg5?AnPxs0PWKogGW0U7#PlgGKPO+y+$U3lmf_W
zZx|S+Nir}@6I26T_bH_S>b(AEV3_90z%b2T4Yb%!N&(~vkXR-I!?a{I(0GuP0%+{$
z6a&MwUIvC~?U2+5zQ<M8Um=x2N=qE%GX{of8yFa-t$`*2<0TBt9v+O0SrVnw)5F;U
zEY+mMq3$z+4GYJB+!w$Fa-KNUdDD3q7^cInHa8XlnKAuCIGYmFL5=Am5p2r!2OX5a
zBQRpw%8ZT>0~u$7Ho`J6FffXM3=HIzU|`%b3!I)oQfv$i5)#UczN`#P0sq+<7`H5E
zU;ym|n67Nfz_?{I1A~M;15>~WkjxeahUpFr4AbpEoC6FD)BPD3ru%|8XBZf!ConKf
zuaAM01dOxifRA=#3IMGJU;-T?jkr^rarOfS#%;<BOaZ$X8M8o33n4=qjI%#5Fa=3K
zhXNR9SAY&~V_*t+3R1=SAGE3zK2tr%1SAQP0QYi0>kUALfaZYb2rw`O@-mb$FszkS
zW;B2X!YtUHBhYR0OhFRz42&1pp@F~v9l>Rs4Q{G{2xUeyRtBcPa#;q(3nFz4j29F@
zEOiiJ3?ghngeQmy1zpCI?Eo>Vel~0j0%4YbGN=>86u5K_BLic$FKECfND-oZwg_mT
zNP<I|(F$bSUpoe-ApL9xrXWku8u%brSq7${AP^A`B62`PC5UK)q$0-IG7L<?-Jn5T
z(Dj4%|NrZK_`nD{VLV6z6dEAT4+h2q%R&2(wWO69l^8)M9Q15Z{twEq!6nlZqu8YC
zyOkLkc^H_2+gKPF<X$Q>f)0EFPsj+bRfe2ye+qQcySp+Y2Y9IosI6V0%*YAjw0~A+
z1TP4BD9XSTv@Di^A;emlkxc|N#|N6S3)&gWz#zX~nUPHwE_5cAfgvJInUP(Tp&oRP
zE=cEns4`B_^eE_ZQKq0zu?!4CvC51>GBBONtg#FXfgZ|?LgsKGiC6{(i+W{75riu3
zSOx~h1Immd2vv5m3=A$s%8X({aE*bWi+t)oC^L$|T^5`Y%fN7CmolR`#Qg$L??`}#
zlOHlLG%zwS1%vLN7CgW(3B)ep0|`VhFzkD+d=#44*rCk=H3d+PYu+Wzz|`UfiE?%U
zQ2$?^S@{Gj15>D%Gy_w8%QmP~259(BUR=45m4PYvH9G@S%V7qF>75J=(@PmZM)*P0
zaRh);jl7X^5y%K7MFyspXfEhdk5{epL1%5Wq%(rF7c(%-2w-5C;RP0}XIRh3z?|3s
zH-!z%s%PYYPh2Sbse~~wwRD3e7&$UPSpkfhLW<`wGBCAF06D}Lvc-~-;{@0*Zp!hj
z3``;SKsDb_28J2U3=A_GLD!$NGBC`T%)l^XB8Vf%z%XMe1H+8P=y##BGjd!2UxxlS
zhE19?fq@wmD4|T#6=T_?S=WHL(;Z{kgrVC$8QBvU7<U>&lQ+i$1}5u+FwO@CW*!@m
z16xd>9sqB3mXB0E&C0+OyUUh==~*CL272ZS2Xv1&LxOTIC_H~dOE69j2IkZb2BuK(
z{V4{F^^BQ}wy?5^QvoUon#%#LU&&<RxCNKAfJ#0Dl}{W8K+PVGYtV5<M$Q0`EI7}C
zC9W`lt_L`f0dW^+1OqDrgM69tR8|J2=xkdC#siSSUB-IO4A?O-oEhLaVPKFEzQ@YI
z6qYE<z<6L5v`heP-uCuF8u!dt0Vz2_)*OYdgW+spU}s>E?-PCovL-f&f$``Jr~_I+
zXGhET2{HcSWM^PJx{85e##RP~8Jp`tyzLAOGmbGZ%s8aTz<Bfs_{1E>qZb$$W;|wK
zm~j`R;tm7DOfCk7nG7J#O9qCS_6!U&jX|7m3=A_X85m}kvNJFqV`gBOIfH>==7cZ?
z#$&P&tGS@Nsu+40n8LxT<QN!c9%f*extG=cfBpXt9~ikNfEr8;OyO2Y9?XQ7xm;_Y
z(ve8gb+EJ08M)4Yq>-dDIY3ivjK_>14&a9Evtr~14X=Qz%pM`e*Fp?Tk^Ic{42;JD
z85m|hVqlngkC}n-SR4bxEPe)tS==B_HUq;f8wQ4179frb1H-IL28LOwAfHw+FwAOU
zV3^ea;xscb%v#RCFl#o5Gl79&);$J>S=US%7>~_mV31$Nz!c#Hl3B#SFq@NsVKy@~
zEplftFxP`lF^B*k^j-}co@3;m0__Db6-$6pQ#EK>4^*QvfXv*$z#xB!fhl4x$jq$_
z46`*D7-p-$%-jPC3<jo%8c-^&K^O_X83ZH-IWM&aY-BZPFDS^&!wd}aR~eWhK7h<T
z!oV=wfq`MR4b)5?6{wl#LHZG9@_^14m@u6$kxiz)1(c&f(#2fhbO|~j1w84(cw7b&
z4ZH^6^6j+{cp4)LbivYbO$LV9VGInjL)aM@kDD<t%uZuqn4Kcaz<AtIo&lkA3iN_2
zM&2pVED|EbsLsg16nTr8fe~a%{p>OZhS?<`on|1j92pp9w=yuyZiae+cL@Wtj|2l#
z<XW&B89<?04qrdVyN7`}UYda^@+e3azA1u{_YNc;GMPY!Gr^2Xfg1H4q!@gi2BSkg
ztQ_F&0CfXEGQ}WEV8fZ25}*Jvg(qpwDWLuk15=bOQo7AJ055AcK&4}lr5`~1U5uPx
z7?`5UK$buvvjVgh6%xu^0^r#Xrl>xMG)xPZ2Ln?SsK@{xxtqaM26qZq0t4gm7zU;&
zu;(HEF@QOQTZ4f)-hzQC>MqE*a=0d*2cVE)V2b(;3du@_>1xSr{PjN|ArmbDQVcQ4
z0cH}f0#worBnb{2CPWN~Y=Af-+7BdK!2s<@GK$;)#|(_inZUp}c{Zpn_{RtFFE99V
z6!|~OvsfAGnPMlhGcf&=W?+~-g@IxABoIfPfnoL*28P+2WEq(LfffM%vzKOIdIqiQ
zcwaE^GB7CcE2^_HFvWoGk9_urfnoL)28P*}5SM8%ips#+lA@pv5-1UJC|K|^FvX-Y
zGce71%)l`FF#|*W?1zYJnLv6VwKs?b(!s!hdYcAF9Ga%!rm~>iOb1c{)roeQ1|#nm
z(A*{iQw%7dGeYhG12vOHAoqhY#Y_g(MfR{{Dar#<4id5gRZL9(>L9_#rvNfvK~Ygd
zn1Lw<v?cOiKLf+;PYevRKY)W7rVd<kDwr#3g4BIyW?%xTo5RS!F#A7T9msyZIbZ|5
z6tx5ym}154zzU@qm}dQhS~v$ZKBf?*s11@gw_{+M%?C>&d?Fx6GBCx05&`^J5Ju1f
z_2=0POtGNDkr<8Osy(2p!69J6zztm($sYj{2PGrW+EYEyfjkha`Ey`3EkA74E`#!1
zR#^rnZbxvS=s<4HWaQ5Q4Gbw1D_>z{V2XRK$iSrYjcFo>Gy~%?=&EA=6`-<Aq1(y?
zq+%YZ(0staP(MeAfng3Gi1(I(VU8{X!yHXe;rfe#L18fiQyjSB_|3pD$B%(wj+-I_
z<8cn=iC1C%5#Rxp91Kix;UKqzj+n{>$%4ua2Uz+SfUN6;rW*bukW3TT4AN1?09^tC
zkMlJkX^0dkmliX?voAk%MQhxl=?~M`r0W-e)_o!sHJJ)X>x}C>z@gIuIp&yA06ZP7
zuub^}Cj(Pigfs)wja!fa7B~TF<tRK-Ze(R(Dg|xby<i2E`2dP_MP7NvzaS}Rb_S*k
zprOfX28KDMrVRB=7eW{q6fGE-;*&s9kqiuTW-&0#nE~omU4UE!!YFzN6y}N^GK}WD
z3``}UQ@bwAU|^WDnSo)>dXTQA3=DJ5FfhzH1>$UCV3>1{fnm-q2?nMMXCbZ->j9fk
zEW@b7%D`0O%gn%Z;T8kKoS*d!40FDMbUkBWm@C4-FjoM?`NY65SD%4lt~QACkAVTS
z<YBH`9Rt%vadrl#i}DN%b7L47=7xbdnhXqcD;OB&mVu6qyl4usPhtj0%8r3yZZ`wN
z+;&?A<~SjUj93pWDT;xXgM&x6Wn@0dF)$@`F*7j7DKjw4UCh8RcOi%aas!wHZ3>Fb
zVPMRj2pWpxVg%JO;A;>;nebu}#B}ijus>(X{O4z2N?F0oz;v;hfnn};28OwtL7aXD
zhPjs*80MY>Id3)t!`%9}3=DH$f_Tdr80K*>Fw6s8{djRR1H(K;28Ma^Ael1^4D*5+
z80H1qGB8b_3AG4*I;lA9bW#zSy{rsOiB`-EOw*S!Fw9G0V3?Nxb-4H&(DgT<1PRKS
z(hN+~IUwfLi+=%iITY8*9N=eQN<0kGEWyAqub6>hULjJED*go)Y~o))#S8<eNR6}5
zV_;5O4lzmm3j?J4!-%8;`Jy`{ad?p$R?on6@jAo+30NcCfPpCqbRp}-8w?EdS{WGT
zH6qmq5*@JmKmvB<CWp*1&|#}}(E4EB90rDYvyj{_(E(di57z>(4j`x2F-mm6$^s-M
zD2_*n!yOOpB}r6(FMNUW#9Kf-7-s>911&Se4}fmPVPHzy2PzV(Ar&pC;1<7uq)H+I
zs_GG_F=q%Xek3_S!cdbWH9#B&ret=INtN)jMbd_WIm3^EDOnyA)3p#AK73%5i~*^K
zX+8qtFfgTrFfwLN++Li`CdF7U#RC;AVr0zZC}ZF}p~CrE6=u1V3X%h*T%by4F*0Vd
zRx@yHSA?sJ0jUFRXSnDCjnf&h?Ew<d<B=EwWEi<v8JJQ9LHQw)fnnZi28Q~1D?tf8
zm4RX2E(V5qJD|ZQu>xcsjB^5HFO2g5Bm*j=E~`Ool1c%WbBARZnFSe`iqe@Gm@b<$
zFw8s8z%cJDI|I{YX9k9O_Zb-G-Bn~@y6g|GRN%R(UTP0G-@cN`1vw3L$}2bvePLjj
z_X%pH)CEu$0%i6ak0Dk{OMo@~k|||nU@8I~hkD}!0|V$(#rf>)3`{rvGBC`SWMG&N
zDzk2KF)+;6Wnh@EZpy%PQ;C5=Ns57~@CQ2s(@kXthWhzF3=H$VBp8@(LVHfqQ$S`b
z*~&A%;$&bdJiyGrbkl)>VSXF~!~7_aE?)+Q`IQU|^GiXTC<cc4Qy3WLPXKY!85riT
zXJDAW8dM<OEP=RH)&L|`!@w~A3<JabV|5HnH#<Qh6B!uhzhkIpnEytCf$0{so{>=j
zTb>}#xSyMWDdRdb1JkVl28Q|n85rjOW@li!70bY|K#GB3ftVr#)2%G#iEkJ{jB@6Q
zR~bOkEes3`Oc@v!7)l@tEEyZHnN{+Px~vRLX`ng;6vPXB7#J3K)kBLZ84pkxL)%J-
zOT-yvVnBtIQkOiVp)><iy1E_c5^=<J(I9yi1_q@rMsprJ2IkBK;3a4Gplv`IaG9($
zOP<k0oPjC5hM9rso-hN$f*1yd1yLZ5JVQOhf^5*i=P+k9FfiRa1<FI<Mm}gbB7>=#
z0c0xdCTm8S1z`WIl4rCLVqgMa5SdZUz_6f-fnh-fveOoT#-Nl|A#So>Fo}U-!30o0
znd$CbNbJ<hyn*$zKrC<pD<jY7$jQKzk;u%zboUhl!-7=|3=2Rt%H3}a3=4KLFf7=v
z#{f4$<_p{aSotg>pUVi-dxC*s!7&gAr1v@l!-A_&ugWrjyc!MjEBInUP_~*5t!HFC
zz~0;?&*;j^z?3l;R6i_ZU|8^sfnfpk3=~G$5Lm1sb{xsvU|_lnN<4d}KPX@mt49e@
zNMM38!aN2BrBe({nYTe{aXtgXf*%YF3%($3Wo48;0rMA#1r8V<dB$}T3{08r(DHsE
z9|OZe9;EVK`UI@df$OP<7x<6>mp%cj&frSW+W!b~czKVMnx(-lBBfjMj2k%_m_T<x
zg6rIcatsU$WuQST{RA2;Obrb63=FkUn|FZ1x(d{KV5$QrDW;q2AX2guKt-6+D|yD_
zf(%Rrpp{HF4=^w+G+<y@sH4chbn`4UgWbHvz_2igfnlK=DA=AeFf8n3U|84;Qu2j)
zVgqQT@)jcl!@}(h3=2W+vs<9UX%{|WU|4t$ls%;x7#8s}Ff8H*aWohh78x)wEK;ju
zV7g^0&%ktB9qt-lIEw)cY~&du`5Bn9K%JG_77PrF;u#ng#WFK6-F9JMSd_=Wuqa27
zf$4Sts6c=Qg6s)UI$)gssR%LPDCYvJ!sS5g+(1Ti$TP-rGB9PEFf%Y`fSgp%z_6%R
zkAXQ8I=&|70;|IjdKevem?61+(F6vDMSUpwQw}^{q0A`Hm@3V{l-<b8z+4Z?po<nV
zFf5vnltJaDfXWtSMnnc(w1I(P(K>Jjy>$i>1afQOPF@3YF9QR^9(l%G9R{WxP-SuJ
zE(61&{R|9?_JYd6mmvRx7+;wu{s0w-w;3527F}e>Wmp8NiEi^UFf4k`z_944Gy`)6
zw04mLUrnSeDF54<fhk8977X7Q7#4j&cI+RpV+9djU(C+Hu$UFz1dw|J3U3CcoZ#sN
zC2XQnP~+uAKw}foIFWY%shK{%giWkof`RGQB#0m7!P`ld73CS*xEYvoL5KX@TEf7v
zSb~9Ju^6Zd*vP=JSe=1ku`0-K`#_#VDx&2fE;E#86cA!y%H;$3pqhbUu^9uyViP1E
z$o~N)a%DqEaMy#%>cy@M42zxN<7EmWAm@QvHsHZG&`gv(1JjXMh$|IVz+yrHy2g<4
ziag^qeg>w3gUk#}M{*e$7Kbn}EDmC4U^-ICz_2)jfnhPIYjdQPfnjkc1H<BWTLz}v
zNf6WO6=1hMGb+GteRg4+tjEBVdl8hb>lhdo&tza&JRQX8VqjRjl7V6IauBD8fno73
z28P8u*cq5^Ph((Me3F4-@o@%Q2Bsq?AZ9D_z+9>b+W>KfZMFadQ$DB)I&zbNVeyT6
z28PAgK+b;3z_9oQ1H<BHAZLGMU|9Tvfno7Cqy(Y}-c76Q$mY(;z?7E-3SJEch9&F_
z3`<y%f>%)iRNW{$A`-|FaR!DZq6{FH9W{o!%me1KdPUF@H&BY!VDsl^V9Gne%)oRs
zfPn#Yi0Tqm5XXgqVTm~d!xB?P2BxDipjd|{BgGs<Jb}BZN1y`@iVdJTLphKwn45tq
zUmj$LGy}sDHwK0!E+7s+1H+PV28Jb}iVXEkN7ayxT!AnW)cZDIV9;Y=f>q>-8(=*Q
z#SI`QGcYj7u!Vzm>VWF=C20%{OF-8Y+>>WuSW?Qsu%sB~&?BHaj*&5o38^}71est}
z&%ks9n*0^NfL)!)Hdg=?A&VIpmb5T1ENKF9)-y0HnZm%Z1T?I5WH$rDk|hibOBNx;
zjuLn=w{j6%AtwV<0qC+|P${-#GXuktjYzSh!~%|;B6#f7Gb}mGz_8>XO7tk{z@kS9
zw0;caP#v~PPzuig1s^DOE;BGJ0VU9*pxAlLz_8>Ydh95L;0sEn1c(*&9~hOurx<~1
zBDPu~P;*F_fnmvK28Jb|Ydt_=xs-{4VJU26L#YHgEHjwE!3dL-n}H$;s*1p+D6E+y
zdjnRPgIFMc)icP*GlC}W3QIw)lUEE3O9dGimhyu*-xwH{DljlCl|yRg$UcCZ0Ppr9
znmJ4L85ox8!t~lPFf6r!CIQ(uC@uq)Dd6E*Q1?qlgn_BBACx@cwK8Op4Wq0M15@Ej
z6d7nOE~kJZ3hO*d$AF4i2ByLrAZZTx<hnF`j2<Zka)3_%hL+FL3g8QOp**P)Q11rX
zUz3^w>h~}(73qME4|1?kfmtTC1uEeNx|&k3p`ivA4^rTR(Lhds_^1**;{dWxf`RGc
zGe{wzG>3tSp`JmxNrsVym4T`FCa6F5nSo)cF9X9;Z%}vaKLf+kSO$ir(d-ONm$(@i
zmgX`rEX@vMV7df#rxL8G8N$F+91l_@!N9PzmVsd@Xn+4D6$XZ-QyCbRPPS!Wy0Z{s
ztFi#BZKe#G(ghE{Fvu+7Wnd}>-8XY*BLl<IH4F?(S1~g%-Py~)uyi*A!_u7$wy^zS
z9~hM#;3mKpWO2wW0~rv=4Bj2au=EN8!_rHzPN^~j19SQx7*7egN3L|C9ukDb?V!GF
zIRoc;DY(KX3{00?p>d!L?UWaT&b(%-gGYgK4OIUTP<2%XufmjPfW$#!psVhnhKOx}
z4Cohs0CjL2z|jawe_|g%6F3Y^CE!C9Yr!o;(E5%H@aPg$vp5e_kp(DP!Knzm2qc3M
zcJd;lxCyBD50Qqq2Si^mFn(xYU@FN1NuW&(h_Tc|(rZZ*NEUv}AfuQD)V8G{aqx@*
zBj{u@CL|?342+++8JJ4;f|OLiEfmWDd7Xi&<SNMfod02IQmh3e4iy94aUZ|T{{MfF
z|3&ve%Aya9qVNk`WEjnO8JJ4tK^v#GGcYWD&A_nqC4&b8(}i?MI+6f4RzRarpdrE>
z28N}77#NoRfX9Hq9nj_z<Z;yrAiFtIKs6OJ3p5W1)`M@kQJ$gP!pgu@Ccw_X%<`Fm
zVVNWY!!luM2IfTQ0s+AQaHC~~3TSq?^c*t-b7C|D!!j!dhGiBYPC5g_G9LzpWnSzI
z%!$Pe49k)j7?ve~WB9`dMnMw>=86XlOr@Ve5pUqaz|1Ph2&QD~8C_rjB<KTDg)9lW
zJ3*R(nGHG$D_8<<`|VI}1-aE$mVudVIy55+&R}5fUIa_Jf&vVT0#jj93JlD8VxVCQ
z(|SnI2`&JQ6)T@megK-csp4d3U^4AtU|3ekz_6?w#F@#!u&jfDVObl9vy6dZ*>nbm
zWm7?%%?u37KmtoZoC6FD%eFEwEZYp?oMm8GcA9}<*-;SZ76ZewcMJ^6UV%8z85owc
zGcYU%jrN;<k!N5|@P@kM1_MJ7f(fb)7<l-Yj`A`vm5YEj$;B`*fX+u*E(RJ=(!K{#
zs^S1kEh@0=&%nn7nl30`Aj`m{{d#(CJ)1Ir9Rrh2h%5t>PBe%}n?ApuO}C!Glz|Df
zBvSbn15^2Kb_OOhHU@^}1`G_#^}tdh3=GPz7?>(R!y0Ci@T(#jRSz&QyWe48Dt`w`
z>!30<gNefz7ICU~(1!4{KsQxzlrwNxsBl=QF@TNsWnfSN9ne|PC(FQO<_998gBX~g
zJC7Mvdq52X6?Q(RZ<5RmOrV{|%iS3mmV*{7nU^7U9D@{cFfgb{L3SKhlta#*fYx#<
zA3%pofQP4<LHPsZU3CTq6(a_wiiNTa^-N|u@HDvvls_1lDnL_@u&L7I0+caF!7~hu
zzl5O$kPrjNmkdl5ACWWF3YdAydq5l28JH?Lz-b&Ve1!qL4X;v<kuj?tW>4k@*v2ua
z;mThiuBi+{Hv9y{HBdDw3J?cWmLsW2=>X;GVtDDJVgog3E|Q|m2cVjhi?jX+EQhEB
zfLseRI0wXGV5$V|@j=XeskA`tdw^`z54aIWK!F1b_y-`hNb0gAK;;Zmiw-2w3UPq4
zT#Aa5@)K4Dre-&31}3gwa4B{M29<W@C9DigwNvF8n0T0=GVqix1WV}-{H#o@3`|uE
z*%_F4)EO9-$1*T14~IHJC<k=b%=8USY|5Z+9XE9NOAS2vuQHRL<u4}#Q>`mI0~5C(
z1H<x428QM3pdmtTIf#8428s+!+-jgP26+Z10au8qngOiitp;87$gqc><u*S9Q}sJV
z1}1@U$ocaEDIk3yfkNhqZ|Xt4UV%CWhUGmB49h#@5wiqpF|Y<4hy~8`Ed0#gf(%U6
zg&qvdX*-~{#(<?57+9dAFUUqDz#0H*2{2Xs%zi=)Ox0VUM(Bf<wjgAoW<X0swHyZK
z4A_D{wG|AEIsd1%uqlATjQ<JL`Zo-qT(*jz<pDPXQw``AGXZ7>hUF_57?v+%W?<s~
z#=x+AF9XB!?I0fuK!ZRQ)RO@TXhHk^0_F@1%kMKVEWZm)YU&yw+ZdQ?N<k@d;u~<g
z3{;+^Gf$j8zlBYp9()NcC<jlx3T_BY6an>vAotzy>qA_p-T^Kw_VTkl;bvf}H3vD!
zk%3|PCkBS)Zxk7r`28Rb;*W+ph(81BApTMYh7}?V3@f0Q0x+tBmsv0{)pCMLwu!1z
zV0VG6&Op>m8Z01JPxokLQ?!SMp@s$MrV3at7qWmHlvJAu%KV^{j$k=G3*H1)10D4J
zX!?p)HsyNgsHac^s6taYrwqEar)eYT;HOs%3@elw7*;5PINuo<R+up`tS~TTU@~T5
zU{DoiV5)t>&cI|0+7Tbhz_211wCUOfa(V-!F1Qb-s>a7Wm6w63E{K_d*(HU6VMQJT
z!-}jR24)xNM3rtm3ur}_ssjt7IBPWnv&$CPTEAm6=7abLpnT>@HS<A+oMB*C(aylI
zq8U8E<YEJf1&tO^e^E7xkGYqZfvMgBq|%dtVZ{Olh81%p5Y}mc*MF&2voI>KGBDNc
z1#R?o*}}lEVmkxFimf1B2N)PuoM&KIaTde@S@x2FVZ~FB*I?}rO%_l{sZL;F)Z}Df
zst4U^3u=I@WME)e@ekSnfpDM=kd=ZA3@iB=f)Gs@jSXPuE@EL+tp{DB2G*~^z_3yc
zrr(l*VWl}tzb6C3N_U8Vp;Mch;8otLJNTF<@-i?r$$}hP&%m%U33MzhI|H*z4+F!>
zY6gatl_1Vc28NYW7#LPgl3-wVZH0uGrU%#;FX~wsxmg*Q8vZadFuP7-U|6|~fnnt$
zb_QnGc?=9Ik1{Z<+zaBYVqjPWI@s+Eh_j7>VO1*w!>W7`=MV$KYIX*ORbN4za|{ft
zV;C4#hk-b^7#LRfF)*yIk!E0a{R+31g@Hj$n59UJfvMpMDE!^n7#LQ6VqjSPj-7$o
zO^AVE4G#mu8V(Rgj)7qfXtlZuh@-{8u*QsmVT}oh17f%_FsyL_ahw<!)`T%ItO)^e
z{1_P4q%kn8Ns(q?cFTm@%ErK;rppq{$-vYwm6?Irt%`wRO*aF>n)*(LFa~Bf@Oc*>
z7&S|vg_sEgQ^QG+anTG6Yi2PpteFALY?>XQWficBN6UbLdBH5Gloser;aLpD49u?2
z7#P&-L1FNmfnm*R28K1uL49v{s@K$D;DWlW9vqVl3=9e^j2x^COpV^4xZJ|Pu-1}+
zVXZlcbAW+iZ6E`~T7MAd3<Ja3Oa_Lv>7exF0&O~Lr+^9}wG<XcKG1N7%V!3LwG|8u
zYs)}7{xdMF?POqB+X`|IHv_}kMGOpU7l1h83=C`QH!?7+T@T_ZGcc?LS+x(u(Pv;-
zd!B(|?O71Vnt@^MeFlcLcR?I?28Olo85q{S1#yBI7}hZ|Fs%J+%E0Uz&%mHo&cM{f
zD9ga?nsO4f8W*~7T*n5~WLGO^dCLiFsOj*4)<H2cdS)><o&=SyjG%fIRJe#UFsQXN
zFf|#-GB6p-z>Bphpq;S{OiiF|1x$!WhR_bs$sY_%P1)1CyVxY_g(Vo6jO`hin%Y6d
zpCPE#0$;@?Yyg#843aZ~$U!4d;{#aEmVsFodhMaG1*~cl2JK`5C5#5;RiGw=COZSO
ztQiBtIwJ;#bp}uagaa6u-P-G+m5Xo&c)=D^Gq@~A3_b|Y0Cna-<vVIe4i+rJHz2{1
z#q4LV0xJI<Y*awwQH)!l3!8<%z?$5`unvEK@^g@@)_}Gu)b}zltaD^wSZ5D)h=>FO
z)0=n(rsnBzOPNaHJu?v-2F5M7ATsb7YLNg2rsiD?=?n~9i<P%S7k$ryP4N4G7Jawq
z6eJZfDDMRycY|n~&sxC&@*V?I3(s`T9yXc!SqDITkolmUQJK(ws}Tce8%~|B@<K+?
zMcSF~l)D%iV;C4>S1Z?p=#{3*X^ch;4DRccy+BL(Th{O-r6e*a`^hmdwX9)dV5qiL
z244gO+8DL&rE(BxzYXX#VZPnU(drCLEgMA{m|Es)Gt@Ka9aRp2E_K&tV91VD2Hi8s
z_z-;f95-mPia)`KfkCWXSrKGWn*vWJgEIJji#H%6Kxb;|zE;-Y1n<}biF{;ZV9<T7
ztOFNmWrm38Aw)zWB8IG>#s3FEdjwk5Awov1FoRkxAtJ^I5pRfy2|^?mB4UaV$%lxT
zAw(J>BIXE@$q*3>RtAQ8Mu_!GAwrf2McW}FRtS-k5D{yH$Zd#-4MOBCM8p;$@*g5%
z2N!7*gouDPEiu*~WPogHRd$0Y041tgb>91s#VHIHuvY9HP@-zPq{hIY{fGCyIOu3}
z28MMZ3=Hf1)EF4LR`cEm9a(#dfni-W1H-yfH3o(ScD(m>85lr^%&%L-z_4ykL2^k2
z1Mfot28JjxSc>HNz+iEQfvLTPfvIi%^tygF88!>>-9*#h^|6UXr86+(+~GX|b&NS|
zp8(h~?JW?;oPaq7Wcd+@V@|*v^O1pJ-D`+rPCy;AUV?#Pz0mZyel~H=KM<?i6QNd%
zfEJ5RU(nAcRsWKA7Gy$?!4!7%e*!2BI%PD#{+OlAz|<+jz_8wlfnhyp-=6z_-dRSF
za9Ll#z_308;*?pSqlZp0Fsxt9z_5O%CTO22?;KEe0Et~^U|4@qA+I!-fp;!QY#9T?
z`tJ-3>pyGOGcd>;<edi+{LjF!0d#&dZ$UW&?|e=MrcOoB=J}G`0tVg%Fa<db3>(rQ
zB?^OC2*?`@OdX(Q=uDtP@G}tQF@sqL15>9V15*d6X9$+f1g+SH>0JUU4;Yx3I%ZAZ
zHGxekeh*YNcp?^L7K&<cTrn_pTmzLLAlVEijs|Frz+f%_)%yh|3)TzifH9a`fNYv>
zJdsVK-VnSM*q<SSfnlR8uPrp-L1#IG3U$U0pn&h~&?sl%wUuXJT=<)TVZ%lSh7Bvz
zz)@kV2Z{>DOob8#UVBi0oMK?u@RWgJ!*zv3242wh?+pJL7&iJaFl=;DNMhi108KD~
zM9LW$Hs&iNGt~1sfX<=@2`yq^*f>ieg@M-rbT~Um<RSyZ#-j?U47?7Y!*KsIFl^#r
zVA#Z@kjB940NtUtNr!=9lZrw*1Fr+<Kt_<7a0Z4={t6ikybf{<3?S<_H8C)3s!|9s
zWZ(teI0+V7#=x*?i9(1`Jp->Jbg$s1gA5FtHY+hO)CKUmi7_zs&VY3es&+^-F!e(2
zJ7$mqt@CDJJk6Uez`)e?oSA{CcO3)6mN*86EiuvzOntfF#tTRp69WU|Jzgsw2Bxl+
z%nVF@bqow!av2!5WP>;z3=CUp7#KLVRDouW`f{f~n8c=74^q;@z_6tYrern)!<L!g
zE_&}ysKMYvJsIEeX6rIAb%SOjdQUMhY+1v=uw@mp{Vkw2EE6NIDGvivw=>8*km0)-
z7`E&LaX|Ki^qpX^LO8l!ss+^lXA<N!1>N}qcJVC+hAlT>I$km`Y<UiG&Q*wWq``ML
zGb!>m2r)4ASb&1#83V(Xp9~CJz9TtDS^(4vV>0IjZJ+H1%?N=E-^#(juobi(sjq{9
zVXHVpJ;PQ}&<G$b5Tyke*ccd?+<6V88JK#&3hNjcK)1|p1x@*Zb(t|RY&AjlgtP#t
z*TfXgYoG;kHb{dT1H)Dq5C>#UC<DXRV6Y$hY~g<3VPIfN=QVDSXJG270;%+4VAz_*
zz_1lGQP&s2z_7KHfnjSgNG6GaVQUKm!`3E{OM5>~-#CR$q}~=J!^FU_but6P)``d-
zj{$q3mscC)1<({K*yD>B7`83|=>fTDBLl<M^&r#W{*D2M)?8j~9tNgfZjd^VHx4l{
zYy~Z_0{i<S1H;zyFn=5T|L}o9ItJ|VwY=JJk3VE!*a|vM2CU-)1H;yL;EBpU-svS%
z*%a&L7#OxOGB9lY53)gnfnl2f1H(2x5XXptVVgVy!!}va)nE*aT%ha#Eh+RFn0h<3
z7#PCm^ICw8Lj!5<-N{?Qz-s|2`~QRXDECa^HHOPw1<8RfcVGa^IZfo%gUH!1F!g=}
zN$P<PWCKh3f8*7JNHQ?>@q*+u;d04ac~#(Yw$lTqu_^IoiSWw9#d4=NOk-2#z04~G
z7n(eM!!$P0`g8^c|7$$^ptYGXbmJEz_<D{Bb>P~JXCJgS+h)eVuuVq|RJHQ#1NrC_
z1H-l=28L~*YGr{P&pv2vwrvdq!?q>hs+H$}00TqhL*|JcOwtTY6CexX8BD;3fw3y^
zT&!nhV4470!Zo3rfnnQo28L~*rD_wVGcatoWnkED%*?<vVKD>4_F@Kx?b+-MOcT~K
zFl=AIz_5J|h_jo4Vf!uyhV9!xoZ}1(+pjY)Y`>_;z%=19Wc*~pUFL}^n4r~&$r(r$
z)ISAO^n+T`8BE6TtsD#{e;Al1{AXb52c59Y1d`4KIU81Sm`Z@E1_q}7Ytv^pvr8tK
zT0oV5g_(w`d;-L>3BoYx4A2!@P^Xx#foPs!1e1kmhE_wSS3q`6FPy=q%o+ePXZp+;
zY|_z_cqW0ahMDk+7gWXYOj2fGn(&H)fx-Ph&m?dy&jF5_N#NR@4OFZ1OaWItJfPZ~
zXDWydYVgV&<e3IypW-QJ;F-?Jz%=3gbpDxalJyh*gHy6SsLngNpT`nf=Se_U7(nX0
zsbL!B3_O;gDf-t84BP)OFl_$<uJd>-^*{~+*LghFU<()+b{H@)>`+ojWZ(fGN^pvS
zVaId^h8_J1NenzTpgIpEa+rZ($8Lq>dIlaFP@M-7de6YH<GDf#1CI@;&O61xuv40W
zVW+S{Dg%!VsLlh4xH2&8v{y)D;IRSKc_5K228NwU3h4|yHlR8WBr=VGVP~I01_O@`
zsLlh49AaSDxeHY1@z_G$xbry!!_KD)A@xQKJmC9-K+1kFFzf`~h*KB9<0QtwG&K!Y
z=ha$BGcZlfh7^#{HO2RNk_8x;CT(SAV47OPz_9Be1H-QU(hSULqHtxPQ^G&-nDH<$
zO)6(*U`|tIVAyqmfngVDDk{y8fnnEu22O@ucNswIu|=n^o5iMB4^r};fnnEMkb01k
ze+&$}{(uYUsqIjM!E2-#nRt@57?>u5Dzm9G7#Mc*F)-}rLAD>fLW)t8$B>7CX|f>5
zJXHpU-Leb}yQM)KLk5Q3It&cEwHT}rjt-WX0;=;ERe200K#D**Y#11JTY)$r9o`HK
zyFDS!SqyQGBzTDnqbW~?5ChW`P_;C53j@RMXa<JekznUcUpSjhq#iUT2MU1QSqu!j
zGhoJ5GBE5e2c47$3pGgvPz}Kt!J{L=z%=;^NFB%xoeT`S+d&+V8$iCDhU{ud1yEVf
zn8Bl?3Q_~ou!4bM_c9O%q+vS)L;dcpU{_Cr45u(iDlqUcFfdl|RLC$eP4Qr6U;-U^
zu=_Xz!*0;^anqC;7<OM{VAu`1K5m*W1H<m83=F#;gQ}&e`=S2M0S(PDcJNg4F)&R9
zRZCMZFfi=?!oaZm6WHHyWo!%#jIpzM)Fl|0rYr%uNtJ<N4>JS99!3zykbz;35Cg*=
z0hD0K0o8eot9jIU7?`Hq1gQgQQet4(qX6Q7G=Z=_Bp9X(%w-b=rJX&F3=DhhVJZR`
z820#q>$s`6;jZC<vp{WH1_lA1N(oRJe$BwJCxL-sPaKHzm4RVTJ_Ey^ToC6!1H+y=
z28KN~;OdXzDkx__3k`h+rm10C3=CT~@R-zt>X}m@4eh)Y3_K=~%m<QO$)gXKTMUxZ
zhs%{8;L(E1?FY$efi{et0@a)4yLnXMa<@Tpst~z_jJ}Ck3_PH%Sf?16rg4F!6r`ss
z&tsG1U&!d3!N3D43Yex@O!uD0rd%(~RmbSVz_9ry7xJk!;?NEi1Nf@#Y4<hC8MyLf
z8JMQsXJFVfk%3`Pw<ZI_EIBUlT`><C81}4ZVA!)3v^VPmBn-trfMSVZJy)>^1JksV
zpnL=wt!5Da0Ln%T`?>UZiW!*e(?G|ooQF<mKu2&GBy>QlM?kX%T%dVBJ_ZJ15o-p9
z-cMZMdpf3b@Rl=hCCP)_!@<BHW6hNWx@Phe=#UuKFfQ<&tEWIFa4;}<Z0CxBl#o6Q
z42lk1;h+O>AZI}_h|ge{o-?0~r+%gy*pzV43XW3@40}#8Fzh*O#lSQR=9?LyMlwS^
zSEN3&PiBBd<QV!PJ^_1VKFlKw)(i}XrgH_dF)}bs-^{_lkki5yC<s2x$C`n`#*fPn
zEOQntQ_lrHar_j6E(3$;1TJqj2BzuHz%pFk5IyM(45p8`+@bA~X`nCzB~kGCA2WT`
zz{a~nlrroACD*4Q*F%=5FiblDQp@v}%YzlP!gw76!(MI%hP|LA{j+v4Fzhv}XJFWC
z!p^`n>lg#WURMT&z0S4>zfU^=9m0c}16rcMWi80SG-DU2aE8X}v;)xf$H=OX_nRPz
z!@>x(!Wp~?uKokVbOx9$(?N~}VGb@^UXXhqGcfFpXJFVH3sMh_km(FC>)^^!7es>$
zgoYN93KRz+#Oq-$VqgFbuFPD<<pR|!4$4R%$AAyFpVa{gX%}cn?=50r*qehC(&7r>
zbYjEh%4)~JGz)a~2RMW$Ffi=xg9Y$>28O+Jk+X_|B{&`VgF|)ZSL751F7g@Tky2Pb
z%&nl%xIA5F5t||(D1>%0Fzf}bpP%(%dh{YTMaJdRYZtL821BMF8N^{5=V8;2AV29c
zFqHIhIkGV@%~}XaZH^F+88I-hyKq^8M)PJ}=3rn@d(UMFmSJOHShHsO$3<)s^$WR-
zK{@FSD53CzPVC__1}kCcWCShE=h6Ymo?>)oU^pYi1wLi|6a&+2Dc;;-1}-^qa7J)v
zV5r{BB>_5l4<u*K!N4%ti%SBMTdf%wW?tnI2DxE&AO{1(%Hv$Zpb~ExXxMY+^?EKo
z#tH@oKY49N3y>uV-?hO<TfJdmnv>3(U%;Rps>Q&V0~(_9nW-Hq4iaVqor|a)4Ql3q
z+I_McwBtD#81!V=7#L0}X@jmx0$-lf{zf|)q~;V)N^T;9b_$ry2D&XmI}Ln21RDc`
zX1%L+I*jAGN;{L2foV<-PfBqCgEr_SR)$k-3=CDPwLvFIGrXx{U^wWby<e1pX^s^5
zq%Q3!P6oyt$iUtd742qF%dd)!f#Habb_<N{vRJzn&R(V624;gs0#B!FcYqF4;RpiV
zkmNeOe+ip-b`7}J;byRBU?@z`V>Do7V48D=s~|a(L66ZAb{yTDmEfc2^gw6HKu@Kg
zvj<fObP}9S30wu}f(y=IJx1^)9COvd_byHsT*@X{zgUlvjSF;S9t#6Q`x`yPDKHI}
z^ccBh7#Mu#a)B(@0tMe2(1A=z@_K(k`#0uBaxgFibnE>EMRXN!Vo^GS-d|9ySH%G~
z>M!W9G4Mff`?d5wffB&n>EJ^d^*(`)%C-Zms@MBu1WH64pg7h01iGdG6oB=2^}dKP
zF!*FLgflQyTIhjKtAp&%X1EGH-v@Ht`}{@?(2<yWS3m)Gih*J883u;E$J7`YIDGW3
zXoF5EXJFX-k%3|FYfT1*UJt!%;tWjl8yOh(i7+ti;{y%;_4?}FfC(BiFzhpwf!yZo
zQ3kSF6LgrG-Xm_%X>tq<`<xjV_Bm>T&Z^gY0tpd@eL)Ni`vMd|w>#-UE+JuH*q6w_
zurGcCBPhY>LEU}rk0=Avyb^H2(Yp>wIMV41O!M0yRqZwK0I={Gy}PUoO!M9|Gce7c
z%)qd(fPrCO9*8rafni@g1H-;r5N9<5!@fQShJBz@IOlI?VAwa8fnnclkj!BQhJ9-o
z81_N$v|+er1MYP_*vclQbd3Wt6EmM3)IsBbEcN^Ff#F&W1Cw(f1Jity=`!2cl<Ti8
z0i9FNz%(B`tjQ68wDUJj13KTwaP0^KlfzDE-|pHI2Bs~=AXC9zOwhCnXv4HmrV#@}
z&_TW9py;1}frEje*H`bjDkusdN#VF1=)_ZSQqThpFEgCtU|?X{yLkG$<!lo5SM;`k
zik~+OObeVqg@N7{b!cHAyFm|hbr>|$>+J%^1?Wt%nR@%ckqIs&^bUZ;m+^p82>4<#
zP=V3@M(+?v{1hk`>Xhj1hr|V_J!USZR|d9`k%4I;YdyqWW#GOV*#0sdko~;LDM<`^
z<wBq#cSyo52ernQ@q+Cs2d8_`*_ujv<)AoS20jT*4|01a8v{eQqFyxz1B0vhCPoGZ
z3uX%zy&4_{rUiGH7#QYj=+!DRF!*ybh!m%%PG?!kCR)D<<jg~vdW(5M83n|d_eu}6
z8X0saEvTRfa8Y8c0XaAnTu>-6w!jLCg+|~~L5Z;ye!k>FS5zSZR4%BXXtz;f%mhW)
z!Wo<l3{2X8rq5c*rWX1}i7_7>Y@jQLqkNPYA(zWBGB7O?6#|t|N{kZLpxESOV2E3z
z#3%vULjyWb$~Zy^a@ib+!}mvtQ3_mdurM%KF-{j<#imxTuEgj7IzR3d0|Tg&9=J~F
zGqjTqs<uFN9258mx25vnb8?kFn}F<LVAyw%fnncHHBfP*^chrkoMK?u_m+WS-*Y7f
zhEM^euTl&Q-iMeba%eIz=;kSXlV@P?Nnv2v&&R;9p9h-FJ-0H{GX$>lWnd7V$iTED
zK`xU)iIE!=)^8XX_A4<k?3W2*U|K2<$)s0~fLtTINQqGpv`=)Y0RzK+2L^`ypgX0O
z+AuKe4`5)}@5ju*wA6!vVSf?>!+ua_V`&Hj!~PluhW!=n3`|QC7#Q|XVPMz~TC~43
zhk;>#{W1oI{fj_S6$}jf_c1W+-vi>bFfi;t%fPVzv@`>A9At3^!&Mbf%S3py(mi1Y
zrp2H+?KocshW+;#81~-*Z48fOVA%hGfnonUXuiCv0o@qR#9_h6m<e9F3mf~nat2Zw
zES3Zx41y>Qu0R+5F5Wo(;%YW2&Hza1u=w`$FRR%UWhx+r!xAA-c1JB7IHnt}VUyOJ
z0V)|7n3kA<RDhNYgHB5UUAA5cn{8#dx(8HXOfOx-rsxGZV}ao^c;Sk0qtahi2Bswk
znHiWpzcDa?ZqMHTpP7N#i-~~&H12i)w1vlukAdNU0t3SVIjBc3gC~=xKUl*iT_3{0
z9J7;wX$fe79LUF@rFa|`FmGRm-W9);1>`!=ObTQ!mYIu%1J-f562QQ;Oc<mOv<M13
zrvoY;oTQY_!itBb^S~vT(peQyS_GFAN@v061G0k4gz5Eb*~BG3E1j2SU|Kql4OERN
zT>w`jY@q66`ueqOV)dXCr*EHRU~rNGmzEsv3=ARyN(;eufLs77bd(mVfeIZSP@$u=
z6w%UAS_aCEplM&5`AREcw&><5tp+D^HU@_EtCZG&)POE8R$2>Uy#W;;IweZ0AVpq1
zsCtbkSE>LtN}$zL9JI^GsKYpifob^)HLy7qpn=h43=9X%85j=etATTP1=zO?3<t6p
z7!H8$GS<ygsx*gWu>-3Z7!EAaWMI$|P^t#me2RhLz<CCS11CW@oLhWRssRbszhTs5
zU<mr6R10o{F)$qX#K3UiodT#Gssui}_Y?!eK^_K%gB;M@3aXSN%0b;4aF62yL;Mlw
z8UPRrls6d|IFu#{GB7O%?f(NE!*WoGf#IM6sF@Azbi^Nlt{h~Diw9?Ca97Aw2&o$s
ze*~6VkW`@bIuPQphCEz{0RwaDbq1#8t<x8*XA_5>X2uXd2P6zlt??T`-CA(R_*DV}
zsFPVWNB1A7%w7HiT!`y3vcU@R<yXN)v@Rn%ybxawxhx7U1S!PfTu>{`J6rcP$h;Nx
zCL9b5+JAIkgYVqo0TtA`Z^34Rt{;A*`wkQlr+6|Mbbo+Y;3i(^0^NsT%|+leuKN(t
zVAFkwXs_u$1eLjv_L}ZvF$M-teNcjGKA?L9oPxncW<A42=%y$}@PUl0!oUqS-6PNj
z+d)$XhJ&CK#o?oS1lnLb7{S1BFa+FS(>*56z_coif#F~Y1H-`rkeILT37A+P1H-`{
zq@>Y&0Nh^Fg=91ahJ*7M>KP8s(FEl<-766PF&tdWz;JLixWT3ixrK^>;ou$yhJ(8x
z4K`iqNYbSzq6|zc{lN`3-Q$oPBhA3HDjMuBhD)GK!yufbdzO`fX(eb>XjKLS!@<)G
z3<pm#Gcc_Jx%U<WgV{mQY}%>@28M&L85j<NCJ<NkFfbfqVPH4}I!|`h3<icn(hLlT
zB%x{Jk_^1TR)6sUq=;Vm2vk-fO6W^DkTQ6c7+4&+ftLCMRM3KowKUc;29EzyuylE8
z0;CvUrN_va&Q#0<YsXz$11haymY)F?%OFER?YR0(SVPWJ--v-hVXE#nP_kGBDusG|
zb+@U4q6U&gwjmmFy4&1AEfsJnsJk5$%~jx*k?wX-AyNez-O)d+3+v{sP6ZWmx}mU^
zozF~NP&aQ?7#jma{ocj8kbWMx38xzaia}5lPIiNCETSaTjRT2;O2YOxx}fXe8Nlf|
z2_~AoST_k2Ss)drw{?@jg^ef!(`p+?+#>bjj_B%Ef|P<1br!#-ZWWjVDm8OjbUR^f
z6e9+P&Q@LUdYsjZ!A1Y{m7Cd=>(A<Xff{^oKpDCwPv<HquvWhZ=Q*9b;5-Mi^&Hq%
zoqO=?y!ru(2*@^_5|}(FGmCG~IRr9mjW!1ZgZ3YtLx{Yra|CQII4{@hfR8T+d0q!{
z^BPFAHiOP~u;xr~OzCV#WM-Z1h|H`5nwnw&`MdtE&Q37~29F1z%v}FlXBHweGhBeK
zY-R*6eOea`&dWNpK#_ckp`PK89s|Q64RG&EXBIRw9|~q*IOGe;xE?xl#2J{@f%s(%
z42K|@S!W(hY$^l8p~*;@x&AjeGwZAX*P09rhn6xh99j&{%Q~yTam&DPXbS_wp-tet
ztg{+)^&P_-28Kh285j;7gk)x&jgZ`Wu}74FX{{S1py$Ff^STI#^ab!xoUohDVpayG
zwV(~V>rxpQ4qakkICO!TfoWYK1H++*3=D@rldJ1$85j<IU|=}(4kXjbz;Nh41H+-e
z%nTAt>!va=9Oh$SILrghPZy5BGPAVe1V~<9dlQts5PA6`4<ui%V}o?QE}B5{_Bw5_
zI+VQq0+wknh9G6yizUdJ7M^E4K-X35%-87w#s0cQ;Lev$k18kzASs~-k!N*!V0jkQ
z`8u$TO+sV0js-a48JO131Z7bj3q%&xu>nUKxRW()JDa%V1|0`Pe$)Xky8z|3_BYcF
zwzG-VFBj8s=U`yqcL0yS=y-#3AR7Zi(rFzZn7F2^jxS8yb(M}kC&*&(P>fCvD7H_5
zhhKEsMH!gZ7eV6D77~x340A+BryQJD*%%lsvUR{M8c<@ksMM+C0qy3if(-4SVqjXo
z5|msGL_w!;FU+125A)?wkT0jigIimm9K7}G6j4ynZ2%P$XV|AmgAdeZV_>kYnIb0$
zI)IxEbW-#bd9dr)7#P-eO;H4~-|&EL?3$thJ~kJ0`Efn?ViE8G<x>p6D%cnp?6*uY
z6$K4YfG?z&Vg*U%_6!W6)|xB=j0{X0B0=@K?rTjJSuyZhInV`tJ@Yg{moG9X^Mh1?
zRxLR#(q!5VKJA_p<Qz?=-Jq+|PH{3Ybed=~?bc^tI9}h)mC2yVv=3}G$dtwLnoMiJ
z{sx(H1FCk76m%fy&?il%^&rK|SQr>iEYxJ$0FD@t&STn|Ox`e^8>b277cgitd4skO
zY-eF$klmok6vV;6px(y<8jRCq0$qK?@J5G)fnlSaCR4Zs1JlN7pbKGoHJKu%85mU7
zurM$f&Cz6v5@29pECX?tOwZfNrdof{N0X@&e7CD6^d@^z2BwXmgNt=aG?~IxAmeUa
zsYOK$noN+G2QOq)DfePvu(i=-0uNk*?jYKD4dO^0B~UXO>JrciFdL_V!WU$mA;dUP
zg4o=n`I3==p&oS4;U>^f=0-csmntA<^Cst}FlfGXXJFc74vMl~&DUTbuz`K>2J8V4
zdx_>-FdH1*nx8<y_$CT85Twb-3ToxMud`ubh<mKL8XSrYOq<qnfJ0}sEW(!6^$rMY
z*21hg*`m1)91$RE=4h@5TLaEfnxKpMz@wg`cAB77HsFGMbCKqDuzJv~>s^~PePA|%
z23d^eX!<CE0v#;5Q_}<{`J97+A+X+7(?kj;%b}&I43*vN&%wZu<gKX;I{F<n&{vwE
zsSN7QgV=$#n#!6WO&~Smn#!OntRRCQnyR2+I0Y%(89q2LFmPyra;@oYO?7atWdPm#
zx8uA4({)A$rp;L_^$ZN*`wf`xLY!~Tzz|<xz;ps6*9Xc_f(#5F9JtboiWv-;&O_8#
zFfc5BYyeHw3{0EXfMVT%X^ko<)<H2F7ij<*Z~;Z^=KJ77>kT%63Ib4dX|M(4zBd9q
z$qWYD#2J{J>pQ`%^7fwwlR-tm7DG`6rp^Dr%Q+3EL)LGKGB9lc`Qhv`gZU6YfJBtQ
zSI-+Pg@}OUbzd8-6@}zq0|tg=$_AhbI$?fLk<G!tps#0;2O4k(9lXD`%ODT5`sEE9
zLp_827K2i7@c;|7T99VYomR)=IT=AWufVRRI0Fg*P#*@|zTU;E4k}wX85Na4g$o12
zVPyt}!_p?j44jOLrl3-bf#Gl<1H)lY@NI^ijEbOh9N#c79ByD>I9vt3`-+pXUeT3-
zfuV|l;qYPxhQss0mtS!*DuR}Uf&}+7FdW`pl#*Y-z{#ivy8A1bX(ERzsBOZ@s430B
zpu@s6(LfF~B+AJM9XVz={FH&=@O4!NhDFmk8FjfBn0B!;Pn^K0%D}L)iIY)RlYwcM
zDD%Yk3`Iq$Wen51_p(XXA5mvuI3h2_z_4Z_C!-lSiWnG<q%$xaNmONE$gt;R^iyPD
z(0a=}aVDb_=*A;X#!5&r%5Y>A1H+LO&>IEMLT`6u2w-5^W&>4e54}?7$W8`^Bio@%
zSk4}SRKD9385y$#m{3MHQa4POIK(E$3$5DE-eF)e|2jQkADd|Xc>ze*li>ve({>(J
z1_pTrPR0y%1_oVW=80Drpw2j7165VSz_hJbih+SAiIXuK6#J(b7>=A_U^sG&!Ht1w
zKLeyqavruNodIrq3MXSG=nR7Wf(#5tUNbNpdCJVdv|py4f#E0@1H(}cMFyt*8ldA1
zpx!wT-7mfE8>lS-*_~Yq+S~=-oy~B*fPq;KbV)oD=oTf=5lj0a=iV`#X#vgs3d?gc
zYVk8LZ3i9nz5fLR!%<lVhNI#jdp|QU9Ccz~IBF#YviCp8r%-#(fJb8(n6~Fk@7>QP
znQ;Tz4tWNq{g6W-8P0jYrVGzOSK}}Qa5DOHGcfI72HD`vz;HC1f#E3VNY(ve3=Btm
z7#NOrfNV=bvh5u7DDmy@rt=+Old7MBY?}lFlcfhFKrevTaR{4nGFG!PFzr~*%)n$B
z%D`}RDFegN#UM@+1H;iR3=Bs%fjIdL3`dVLFdRK7&%gw`n)QMLZ0O(uY(|lTk0}CV
z8tBv~(9Ntz?>RFt9K8d&f3%2!;pkfihNG`x!%7!CKpQk*8!ng-V@t4Ls{pkY8JKpQ
zn*Qnln-u3C$oAeH@22w}WRp@pD*(O+l4&Ps_#TvZU|qYjIuM0Bb*6hAWRp>HfU0u^
zjWA4n58H*xa5e_2E^B(nK{gqy0;sxXu)2keF!RpYFfi?LWMJAk8<cD&a=^sTvp~)x
z-Fa;Ky@PCuk{4t^xdo&KHKSYrWfXONQBd(}zyZ4>dzUJhF92#r*uUar6amc`f@<hp
zprP?y_S5qYu}LsBuuShb#HL=qmGd509ujq@pgEYa1T-qOhgpq*VV6DUJq<_^cZ`dH
z;TV$|149D~=RF4o2Hm|3496@O7>*f$dj_1Kn;k(NgJYQt495~R85o$9I3I(GlT!=~
z$7V1v9Gj%cz#wJE37*mciS1-yW;nKWy5V6qwfbXM85oY8)ns6p_lonK0s|9hUCVJU
z28QEokdm44d>;dY_tyE0`K2WcoQ!<X%zk<WG_!{=Fzvn~2bvn-WaI>mEB|L;IIhgV
za9j~|^VA;5d6x`u<szJnoWcxDyZ72LFzu0KXQ*e|qsqW=+=PMQIOwRnJ)rhn5Cg+;
zFNU>{?I;YVAFxb3z`zC?tt^9|=gM$e0d!R>1Jmv|p!g|<54@hPfaVUCi6=k{k@y%G
z+@5JMFlhI4UItZK{}~yW_SkSRFr<ocUe;t_V%lRfJ^TopLj7@0&;}J)rE>^2sB;Ar
zA^WN{Ky|?cMQ~-yaJ-X&;dmox(0vgnXbu4s_Q$s~FdSd6$-r=;fpaD(?B6gj9DmBd
zaQrTKxQ}xdNbD2?!wCTfh7&x#3=Bf83{3k{AQ8Bb7c`;&hJoRPHUq;6btMLdC6%1Z
zKow3S<iN!J(AC<9!7Dt3HghiLXJFbJ1S&(;F)*BPWMDX958~`(U^o%Lz;MD3RE8X7
znkWU$d56K*4=^z8wVfV&lufGs4m6NJtNB4oqV_|MD`YqfzL7!bBIiP32By8BmDT%O
z85mB)GccTp1sOR3w%y_b!(nKtw08+80>CF+Kyo~y>^<CrYz@+=X8mE<VImBN9iZum
zgL4iq1Jgdx<N|0|^F$s4!-*WEVa>x1u(cF$Eof^g4m&{4DMA>Edbk{1+y=hC8J=#A
z6u^fpOAX+nhfUz3!W|5tYnRqZPv3ZqO~!gv8Yo3{D1cG~V-{%8Cr6Pp7ut;6&j9Lc
zapr>43kRs*z?rKJx;Bf0fnf^!bdKX}GW8okOGH6IR|*OMEe3{-TAX2E{frDu`%S?H
zgn_%H91INFe>lUuK*BtrRyt<{s133T)Y{e+)?#2-?a%2B*O?F2=?-oeaxj2&x`Qg+
ze27j@IR*x;)eL+L^$c2XwHO%o?d61YgF%+g1#5-$gCWYT<QN#VML}}|$5(KI?sH-Q
z6=?e}ffZ`Nyr=z#Q^SdYY5ygNCM}32J_ZKuMlA*gaSu)jnClMkfOSeJGw?I!fEw@G
ze>f%V7?=+5OgB8iCRRTq<_1_P1JeP}z*B)k%nfDGrLt@c45fEs?tu<<Nasl{V2F9H
z%D{N#AR7aNdrQm<F$M<XbZ|!@<|T|Rw;<*fjBVi>^BTrp!50I%DqBbi+-HellxAUI
zsJ|D(C@9Xr;5Pl(2{z&S#u!+i`5+g_xiRtJt`(>UyfY?6f`REE7f)#>Lrgjk1A`k2
zcv(gaxC{RV+$V|wPa{HBQ^c&OVqlo^C}uIJrL0pDlcEgn*nwisO~9RjVYOv6XdDOB
zXg|1+gMp#IA$mh9!pG6uz&>VUVA!u5eGuk_Id#zo)u3M1oEv=z78L6vqmO{u;E{yr
zn`{gWwHu<(f(o8D-~q<yb6_?b1A~?8^t~t9r0VmcouJ`;NDAcDXeXFgJFBBTB^a0v
zN%15nl`};93NbJ^r-1z$?GH2MC~Gu$Ki(;@zoWrJnGk<Rm-8eSmor3XfV7>3cs|+_
z+70DnU~pCf-BYMpZ_37akkNvHL3S@2<2;y4LODUv%EmYk)bRpER!kim<2)76bToLn
z?4%AG<5bYCx{?eG_9<+PO^ggohi0-cFtC4OV{8M55~$~^{fCXQn}>mcBZ&*tQfFiA
z0o6`#7#JiO7_6$;7)ux#>X{B*2QL<3V=Pf*U^;Z2tAc@zu>#cLn95ZNVuBWbOl4tU
zu-(tbSP2rZ0>zzEuonYE7Xuq(EZEJ=3`~bPp^lCP>3}&pRtfCrV~h+89c*ljAs|OH
zOENHMyRtDlGBPmLANGSf+ZDyxUOb=$KTv0TBb?pS$;JrkuN~eEbv2_b1JmK%T=_XE
z3~Y>S;tUK<KUf$TwohSW<N`+$S0)1+BR7~S%D{AZHCJ{j$XmRiny`v1Yx?EWY|4^C
zY%drYm=3?^U|`tK%=QAbm>bmHb$vLU{|uX0{WG?^j0{Xiba=sf?}EAl5NS5hm@fl}
zy`P!wE@*QzXhdpSE89bmh07R}85pAb*$#p<gGRHbwXz)qb*q<w76&|JI|y1+0M&d@
z8{8XnXJE*&WorkADd>PWaE7R7Ye!@VHqb4lrl7p85yLhaoY+By)Ba;@8DL!?yH0?$
zv1O=&3Jwki28|fDOk+@K0ZyfCpvD-(8;~y3qil9?UH>4u?7((GblDq%bSXo$K@vSk
zTcbCd8cf?!V-8TVo9=d&O-Z=MolO!h0lJZe{nPa7vuw(N2b80jK)qs6Hb2HMRKO6$
zl&1*Fz~ESnV#?D3)eYd35XDq1&cJkxpQ|K=A&RL)jDf)sG(XlfH;Sng6sn*#2HZ2J
zzdy?+8Sp8Jsg4_})6g`EsR^uFl!58!fAExA6jQMr1LI|T27y=xhDFIyO!dm(3!^|O
z*s<M<fnj%V6cc3RgOP#hxWV*@b8MOhf1;RFKx6KpwI!(rQA{dIpi~QWoCer&EDQ|l
z&QVOd9AI4=&#}qY&x~R+0=W+~qP9;v3Vc)q`0B0X6;Vu}ySBlcEY&C`J5aozf{b!7
zMz(W-CPSl`z>^uLxH1`{n82&rKznkJgVr1BlteLUK)fN!z;s-Jg@K{EEsDt%oGDls
z7z_-enA~`$`<`c$t#?dhU|=v{+y`obmoA86Jj4hJWRTy!f$u(#Vmzb{N)((73;}DR
z7!Nssq&Yz;B#QB{DJZg87#JEKMlpg0kQl017#N(iq8QIgFfbke#=^j0nIFY?5u8sU
zp}}|?92!usnEb3~VPMER5ykjYl!3vq3FO-Aka%D`E6>1q*@XdADzSfxV!R>^ieeB?
zrzDE;iV`@Iz{7ivniUKT)(TOKVW8_<XIVxudN49Dod^L>nnp4DfFj0Dl!57lA=G4F
z_$<o_7m)oR1EFFt^PybOJ=OvjWSG>!NtA)<q>@kpgA9{8A|c8!sUs4i43n-nND)^_
zN-={BlOD)Ve4y|?C&Q!<<5-o-Fd4u&IrS|vOopID@P?}(AEXJKB0#s68=A^68N<|Z
z&y-=Z0xM%-VA!%ihRGV1h<RVhFxh}Pq6|zYg}`2vVbX=fJ|q##Fxes!vBTy_28QZ#
z8OFO{KS9pfVraPlYEUsSFrNT5-OsX_6fnpz-UWM;f#F0m1H*}Gla$ONkRYhc0=2r=
zGccT3X##3m$uQovWMC)&HF&QuFq}B24r)QkFx~?N`~e1r6F(UkPJC8pU`REPVY~;<
z84L_3Wf&MvN=Px(Gq8V>VSEA(HU@^1HVh0WO;kZyMTYS?2LsbtHl~Rja^T=(d;ty&
z28NSW3=Ai;<VsQ)WEfw#F)%ptF)*Bb$G~v%o)iNE_e>c^P))+HjDg{l5d*_1Jt+o;
zecCdNZ$Y7Vih<#jHv_{dcPR!2n=Bc|x1ykF0FY<~1H-8lDF%k*6*7$ANpFx~I|IY1
zdMO5mEL9oCAK)y=z;J2<1H-9R&~9F2J18u{b&d=Z=st7?P#!!5s{C|HWEh`7V!@Yz
zf!maU>9nd8C?Co&{s-qn28L5N85rtMU6lf5NEs&34Ktul(Wzey45z-aLi)HJDxh=n
z7?@6h)~ztXPtRxQfS#Uz3Ut>h(gxy=5QzHI0-#nh{0=6DjuMbKNUXdbbkqjZZRkFh
z`nCqxVu?1`LSg|KCOLivrqiHv>2GglU^p$vz;GHg#B_T<1E>$la9R#@%Gp`S$qo!{
z6W}JmdgLq+6V8}0GcbX=$)`;i7)~32IHn8?rvn)nPW!VnFr9T`V5mQx#=vko4z%7M
za-I>$ILPH}AQmK5rpPcJW@TVH!vfl{@{xhz^kN2v(+feI-wX_=w=yuC-VAfg3sBz!
zHY3)q0y<6+D%G9<;y?%L+8Y>{ra6Gl`C^{9g9$zu((1#&>?O^>bOyA@k-6+aE%*!!
zMn=%_h6=C|kJbWESTZo3DFlZnLURXHyb~l|iV$A_6<-JvFK36juJr>0b4I-%G^X2l
zpsJ36RFw+ARJG}VoDKCun+He{Oh*OiltKokGe1Dx{8HHY6b$WaK&L^1MpziC7?{qA
zLkf63&=S2ED;dW9;C#=>z;rfNC^dzTL56X^B#6Vwz>p+9J?AQ$1ZW8oqjxI<LyQ%u
z+Ov7(#lRrkF2e}w>l>#tGBBN!23HL-j1v%5gAC&YMAaa}I1y1b$S}?THv+*`gAC(r
z36KHcszHWvKB8)nVO#+&1!NfN85RpNFoN!07H)@>o{U?;H$00nFrEDaDd8ArBUcYH
zjEkf}1uvxdmSJ3kR6RJfsW33?e<{Nl0IS)~i$R?qparejG-6~J11+GHnUl1Z3}Z0N
zm9o(?jG)Ff1E@^qo;iK)H8%13oE90-8Q=_HK~Mn}2X;E7+-Hmj7gQ{eQZNBrHqU1S
z%}U8Ic5tPFimfb=Phz<;8DtpqK;;t1Y`=XnjOF4COy|W!8JNy}hI%s?;!RNort@qp
z3=GF4WEiU?>p}4at{J)1Wf<$B#R(q+gKcp%1H;joGK@~pai9R`HdlrNpmP0!l{%>9
zCBx{X1PUz%hSMh)7*2!g_W}nQMkgCkXfQCGe#^jc`lULkikD$@HUfnT1H&0^(B;cg
zpxRxAu^x2$!#QaNhBN963};k9j#~(IuNTC<5)4dt5KdrXU|?S<13s1if)41gR6YiV
zGiD47;PT;)6a&K<4+e%aZXg-Z9oi8L3}?cu;OC7q1iFCsoUtF1-zd%uK61UD;Y<bt
z!<jV1X~iHl%nS_d$Ka<GGn}blU^oLB{DS74z$u`-16myG;voZGMSr0S+(eLJGy&CA
zpeDkFbf`B>;Z1}KRj5LsBvub9+@VT9t7D!2$uNR1Q@(H(yy{hkQ4rK9uw!9hn72WO
zQCOUT!C@UV`AdKk7PS5V-Bs@V540jf?SRZ%P%q^oXzpA4kIY*!P$QKM9NzE2TG$vE
z{PxLw0;LdnF*a~g_zX@)P_saFk=lVM28QT4)BSF;N!G*C9489{11P~VgHsyFGNbP@
zPr;TIaeys&DhJAvYzzz=CdfPosRD0AGs%+K3@a-xg7z#qX~}Gs2dU%$J7u#uD6z6J
zFt}`#*$UPLF<~2+%`^SkO*TGIQNr+~n1R70izh9ULFN)z4%D|by)APXlyFZmfLtW_
zRb~pvMVCNJ2As5Hrl^4IVPjy(oht(#Ej$IDKbM&YE(bvR4NYYhfXgj5aFSjO$^YOr
z05Xe}7?>`B#>n{U85nGJKwJ0YWE!C9u_XdhsW4Q4vczRIHE<*~D1zdMf#FOK1H+j%
zNLV+6!WtCRZ8v3Fzz#0}HN0h7g+ZIvm?lCOAToSxVqn-BC(Xb#4O)e@)PQD5xRqqu
zLA$;$eFfE29~l_VtYKg{13D~t+HVGiGkX~r&g_O(M=d>|Y6~>t4&D^U3aR{C3P49I
zGca8SRpzXV8MBlnV6z4-TcGt9^F#?Y22c+x%u^;A7F(BNAn}^4S`P|Fo}!FI2ANE-
z4|p<4lNe+QL>U;2AA#2L>~oia^yeT}HbVo4kpUDqS5|3&mD?#YFqot;Fr2x}z;NcQ
z8Uuq-hK!vSXh9bP!<iop3}-;QH=ML&9KZ>cf#Iwq1H)Nyh2oOpdIlNLNjIQn>1VYW
z7|yCgLeLpC1Q|hTcb_|`oy5ezbOp3DTc<?E0aBDOoONViIBO3YafO9%^A>RU3dw-(
z`M44Y4c@bX3=C)eL7d+V3}=%V7|teeLz}nF2cY501Ugg~8obRbAob^!Oi=w<39mn!
zpMZiLs;Gql6wnMzS3rkuGfxy?gU5gb1JjjNpt>5gDh{&126TYRJsC4-LIcfSftr^L
z3?`t!yy^l8Ofxk|V4f{yU^rU{2~0D6NMN3w#K3U2M-!YWEntDUiGktl2Ivd|$V_PR
zWxA@T$-tmfB4Ysyr$Y=3XAi*K=b-}fT|Ib#HxnZRD6Z{x%IJcV2qdoUV6zbr=e>hC
zPge=*yekY0XD>jUrwbZtIK{wl_9FwsS<t2#CoLI$sPoPVGBBLu2gNmm40s*ODF%jf
ziVO_r<UvlZ|L}nUZVv+k)71wMH|s;)e9nM@;hY|<tz&lr6!M@>S8`V*lRVh13{2PB
zg$fuVndHH}5peH6l1Uy^z8(N~DI=Lw#X*Wdz5hriHBklzhf?q&kw_+W&QwsivM?|-
z&5dLN9a9DFQ5$@UWYPy$%Pb5GhNh8BCSXmX3{2O`!G(P!lPaX;4(UHdG8rKCpVYk=
z7*xX|89@V7;E~<y52s(a$EI2TCzA0vs3L(30z@(%2X}QKZe%<Sb|VX@gA&OI8B%0n
zU}!lX$p~4M$HKr6lpo1>0hCEWt$}^ok&NKN62wt=j%2*b!N7F=A-IJR$#@OyU={|3
zMVyh0prtwtZ@8vc+-KuYKj;(5BreLpbUhd16UNgJpMZpVz(K_LND>-EyAMV(K8BRR
zAnBtJ>Gxo1aGxfU@dHR2<OBnQNX9QP&hCTL-`!`^t^WjRTKX}7M)nFL8Pj1ctQ)Q1
z7FHx<I--FX$(W94AVxA~AR35~jQNNLVkBdc1OwBJR&WC`lCccYK#XLp0|z3?*g@^(
zNXA}JXvl&pW}T8q#v*9a;$vX2zirRJz#kUL2wFOI;}#cap>rgo2q=<3wfzmy@+6QJ
zQFv{C12k5IBm^@QssePCy4+ED#?OrQ3=FI5-^nxHWCY!VB?Kxa<r!}(fbtFt14H}{
zdB)qIs05A9$TLFb8X@&GxVBjR4rFkFgFNFSSxBSHjDex)nLOhnP$hVC9XOTCGcJ+>
zH3C>bL)`L=OC&)mxga(z6=Ps9F-QR|j>?c{1h4u(6~(}irzOvL1{`(rj5|Q~gH{>s
z4UuQO2yO#RKk*PWi6YM!1kPHFpj))S5hc$U1a1nmFfiy(muHMnVqh?{hME%zHV2$?
z<ryKXZCOBVLwUv&6$S<~(6HGNCwazPWd;V5`z#C$r8ndmi(z_>DabRHz_MED9eKu5
zH9H0d({%7ef;{6KP^YBdLY`3-?x0Cf2dRRGBEgL&c}5Lk1_mQg%U>gA`oc$S>cWxo
zjNEW7XE;Gkfa$j%v8f3kF_(YK2yzJ{=yo8;K%>ZGHof{IPV&FOPJ~1QxO;KL98_~=
zs>wfunROd9=*s>{{-H8xm<zNPXS)1DcLt{0u{=eog$(kKWf&MtpM!cuX4dWu3@cdW
z&ohD>$V|5(b1(AeVS}M(m&u<873*(!K?5iC^5-o<V}fkppt}eeg>`3O5S=a$8gT=S
za^40l+F}1Be@Fppx1p{4Ay6&*1~gN)ZI1kQuqzpu?l6MKUFEl{fKmi_+*N)DxSh@h
zI*vvjvhxkJT#@~y{7O)Yx?>F5x5oZSekIK80tfk(RtW8@z{9p6dp1bP&j4p*2Bte@
z;AVvU3<Xf=bAX2V<Y#DtMxEIh7>b1CXNiN<fEr`$pXBFAfm{t9kTXuVW?)$GNWK?r
zHE4>4{Zo*9FE~iqKy{n^L~wk9tlQfx-v;v*XavzoOTJAWY90G0`8G4KsRj%T)=~2H
zP=$B7IT#q$Kb$W3luf+;k9@raD3^d{rw!!moj`#MnsZe7A`jWN2dV5jU|0Hq7b)Mp
zs|HFk@@3j!;~CC5F)*C7(*Q?tnLh*L<^K!}=i(U{&P9UH1(GjU0$IVpaITSo;as&9
z1Jk`4sIm16K-DpKpnN3{=suEO28MGB85qvZ1#xCFFr3@Pz;JE{h_jS|;oNlwhI62E
zukLMRU^w@af#KX|I|inEd!dcMjw=jIC)GiXz{QMNpfQKVpe=Xl%!?U8mrYtTFiia<
zp9>1od(4pd2W7c>Q_u+n?4RUwZNOe}XJFXsFP{pH!FxIom8nQ6B@LWXK&#)5-jt63
zucu&Oy5|WFQuzo~uqg%%3|VaQkoi%NXCadAu*9SNN8Vi@6e0qp@(c`IALN4tz-`ba
zLh?r7IAR3dU;@@O{m3&m<@!JJ#^NCLkVpcb1N8>fB59v0uK;!`Bs6QG+jv=PKn<oR
z4Qk+$PXRQax0!+Ayeb33c~MBjDcFPE$#A}zf#H0%8aPuant*d6186Ao{0A!rrn8WX
zlNjpi!Mn(~+~qX{Kx0rP3=9_n7#J>qI-F-485k~1V_>)dx;y7=9|OaMe+&#4zJNxj
zW-~Bcv|?bm2wGxsb_D~&#UciViv=K=tqcqoTNoHFHh?&X7#J?jV_>*A3&gp@z;JOl
z1H(m7Kj}_2#8-7K^{`p^I`F}53=9k+GK^DM8JO<B0QGr07#J?zXJEK^mz{y>&J+fQ
zi|-g1F1`URyE>-;H3EDfGFPSy<17INrpKV2h3AYI7%nk0FkJl2%)oTco`K<#83V&5
zJ$44Bb3P0Vmr@xRE+v9Ekqiu%>RT8XF4cf|X$%aP_A)SB+6m$mGca6w!oYCp0f<x2
zz;Kz7f#DM9&ct&)3=Egm85k}rgJfnhFkE(EV7P1t;w)oexE#R1aM`aFG!C>G;=INb
zkklRqhRaC|4430ToD&QTms=SaE?0s$^_LkKF7IMsxV%k*f$8=ch^D#?prs~UZ8D6Z
zA`DCqK|_VN?=Uc2zRJLG8I(zGzhGdv{GNf~@@sYmrrTc_7_M+LFkE2;?Z|?*>g!<l
z?J<B@pnS++Bfm!lbPmh}28Jv83=CIv6&aY*X4Nx>GJuY#hF)OCP!C@8#Wh2QF-nwy
z=^^O8wG0gghAYkt3|AbH1{LbT7gTZ0KnyBe31(op5(qMkX|@!^ANAl9&be00Fvbcp
zFg*nI?`CT;FkDGyV7QV9x=-QU=XwSPuH6hw4?%ZKocqDRaHW`m;YuO2htY5XJTAfX
z@D8Li0c#953V;Uw7{Wj!KM<Q5VJF%)Ffct5WM^PH&(6SbrG<gv3jEN=`UD2%_)rF>
zN17nRU>gb?KQPqSKqZ_R8M9bw7))UI!Z6e?fy%@&GG?*XGt@B1!A3gkzd(jVA2m&1
z_=-)czCnP23AA_d(K3+fkbV#74wwwk#rH7pI6%DfXdg%o;?S{%3aI#PM#e1mntBtJ
zG6p4>UmG@n8vald8haorA2WbVXn>ESHrB6!N`NnpuR%y00f!XRV*`)|_*JqDjW@vR
zB^a3QKrRzwXet4nmCtoXhH<_E1JmOfpxg(F^hFE|SLT5@{tOIPb}=wq0iCmUCz^rb
z$`uBNE9Z(CnC_%AFvN4+2j$QV28Jsi85pj-WdOzQ**^>nT%Q=29{&R6|Gx|jS9uv2
zuCj+QFrDLqL|YSdRGfi<f$8y0P=4TMV7RKoz;IOy)>&(s0}9yb5^vaK6wg4exp@NF
zN(<kQ-}D9&7f(z<8*nA-n>j#Q7?_@bhN>ZlxG|x}MY9e#0GOVDN2-evJzNKHl!MNs
z5m_8m#mK<)WHE0tLr@iHPr*abO7e`LI`B$z(1{#=hC$hk)(i}(%s~;L>gUN(&^D|j
z@gQ(x@D0e670E&VAXDyuO!1ch&zLGRFenQIIe~=#gM^)gLBedHQRW~waQhI{LgCyI
zqz5wesVy4=L#%iZXl@w1P<^dqkTGbJJ!pD-{^TIgvU{+&-i9D^0nlRnD)4b6;Rzbx
zla$^tgAON2SJzMnog@O`1wYkLhVW)HGBEi5nwk%yg=42?STit8UOLqkZ1GAC28PLN
zrn-VG1Fg6Y=$`5dTComVD5K6W)eGX(7zPICb5rd=;lO-vswQJSBLmaZ>l_RW<z7=Y
zK{NEAS$U_KQ#C>BFRDOc!sj|wo{@p+nKo~JS{lPtdC)?~WxV-$3{&Mn3%ZxFF)+;A
zKUEpr^I>CPu)8}|8LXF$f#DR-RAtbH4UpeUK2KFP1GTw8W@hP56$6>+!ch-eaz9lJ
zq+=OFBO?RD1n#MPpt^Ti3<JaDG)pVcwPA8$mXK9M3{1~J=caPnSxN|idc+){5kX4{
zDNtjHgMq<dlcj_zhz&lKz!EgN&j4~?!U{_nkoQ3+o-9$YQ~<jb<c^~&k`<yr4mr&R
zGD#s0qzar8j!#nX1xY-CNI;IE2Bo5DataQh(_8|~6(DP(7?_@Og6&f<0qF*xkd$&<
z0TgD>T{##SG^M8dyl2y{w`O3lf1n@^imT_@U~vU;aDelcCFU?Fh=WeVs{*z7WEd6r
zK_O5D$#%i8;SC#5W8(R3HIR`C{GdK;6$8UnTLy-!me3L>_y_}YD(K*P(A*2>V#X}a
z21Snlp!+45IO+>vnKbwc19K|q)(9q!LIzMM?0v}onUR6%`6r$-2KKLzzyU4DNqE8j
z0_2c4pwqV&y<k5B=0IHK23sS10pzNewi-z(X$<UVKpuL-z;HE{f#GVnMp9`p1N#|J
z+`eI`XSlkQf#K?WUj_!YISfoMUMrL_u-^jtVi^O&)ng0{SC7~-FekD@jjw?%Ms|ZO
zEN5W9&db2`VkYS71PKO)t5+Equ3l!aWnfM?4b`&(Hh<>^3o-`w`yf4_OCIVI?l3T1
zeZs(S^${!}+@>%vy@_XJ%wj8M;Q9{^Cs1lbHc|n$h8yl*2KIBD3`{TOL6;?gO#IBi
zaP=eH#0UnaSD<TfkW91#FCA2>uV>%H0!sf7$GU>1pFvgq4^a5M(uaiKCeR6K%NQ80
zaWXJm11$uWkz?Nk&Or<e*K`;duBmAxCl)ZUZvu75su&oq`7<zF^Hj)WV25n-U|_hG
z&A@OiQ<H(g^fo(qFdJlA4Fkiq`U+?waZLgFnt|!%Jy0zJS}~u=Xa=h(U3Y*yz`*np
zyr>>A_viWnBK}GQt_ie!6x!l<;{nMc$uNS`)xHw;Rg4TwuR=H&7&wjX*jIt}nEvMg
z9T&j9N*lag!<vDCU6UO=TJUNvFE|Y?0v9kKEq2qFd}7nDS7x7p6mTw}U8wMYdlL@{
zxCtPmL0+A~z;JDX8Uq8T9s2~(xYa2JhHJ+d7_RLDjpBXyz~BPA<fepy>5Z-?1H&O}
z_Q{|WYQVs7?HvQdwKviXOy7JVk>patz{pU~z!t_njgx`twJS3N)3;a#hHHNr7_Nbu
ztKTvi7_N&jFkBY`jp}}frd^jB(ApKYG>9h93B2DW7#OZAGca6NWM*LcuEM}@-JF5p
zx+zE#+^Q|0xgoYP_UU2_Ot05NZMyEmz)*i3blfl4s*MZ`*VluRd@^({$mI+y$-A5Z
zg$Zb<4EuBe2By~^m>HOpH5nMLA7Eg(4!Y_g*^GhV`gsP1>t|tc?UKR3^sS76=?&=m
zD5ThQSpynzWn|10DrMmKBQ;&}7n^WB%x^D1XLPW&vCjcrF$(tAJqCvBpe+Glf4ya3
zxc(ZP;E(IE*MmA`%OFAN3@Y9j7#J8uK<WM6IY_jD7A1gIINV@jV7UGZ5^bP`N}zG}
z8%7KaH#DHpR__ctaRubX8V06!0g!lWg2vm8L<WW%@ksIJoB|F^2KH7?2Bx>{(7?P=
zz`$?=bleaqEN`?kFx+Sb#Q-eYoKwKjCIHc71BxjL28J8c7#MC$VXlY7+l^HW3^!JQ
zbiv}yc@Eer1@<;E2Bx=#Fst@5Fx=P<;$$)~+~j9qxXBBSHWz4Mz;54TaE9H!$HLww
zz`*oQ7!++`3=B8r7#MEKurn|xCo?eI)Mcn=xT)=im`QYoA9&{sJ~$5)Fx-sIpsSfd
z9e|rQ3=B7|5H~q9IKz*=L#Rh|25x#YFx>P+EU$MCfFz7}+Mp~AUS7}rA9O0S^Au3Z
zm@e>(O`={J;TjhSa2Ob{_XsjDy_*A>+hn*I#lUbg0;w0`A_1E1U^76nxRin6W-$Zk
z<Y#y+JOL*#2lj4Q0=qeZf#GH!C^}Ra7;esIV7NJ#fx!oK9v~xo9w>!DPfGNF-QMvB
zl)^rQK~h*AsBN%}f#K#h28Nq!ASo<Q8Ps-QV7U2)f#K#8XbSU400klg149J^(+6Ql
z0xN_juv_8`47Ws)5|~FvJ=n`z*-JPXnBJFxVmg+A;g%W$!z~pMCzFBUmMsIrEo)F(
zf%(m&1DwK+LNu)gc}aqS;g$~r!!0imM}>jmRssXVtvHY-SOW7n0JiBWd#M-$)B6V?
z!$CIH=QA+e0-f&(O3b&~7#MD~!1A?60VMj~gV)p`TFV|gK(PlcIXtd_dMY4`;I8`s
z4*93-Rq_l>A3Q(~0=aG~1H-M!AP&fNOBfh#EdqCTKocUK8sPp)Is?Oj)9kU(;|QH#
z867<H_DKU04YAOQ?bc2PhFcpU(GUx2s-0qBxb>WY;nsZ(P%DT%Ru5D~GBDg0Wnj3?
z3ym5lA86DRFfe`m28o*b1Zdpcwq;<rZH*K+PT<VXx{E!TlY!|Y=mc<3nSI-bf#EhN
zltJNjJDGvub|SLpoxqu&^%O)C=u}=%*><~#f#G%m)bqF77#ME1fHZ-krXG|ZoECuM
zhV>SE3dpJoXx!YM&A@OQ6l5T)?r<_N++hc2{-2P{?*z~MPO!|+05M=EGXrx9I|IWV
zNd|^Hpd|t+A`A?7G#D7}sKMgaDFPC=A4M<1^CmcJI)QIL1!YYcSXu3K2Na>Kuh=tT
zS?P{B1H&CtsDJLbF)-Y50iPzBbd}u)8hsA1y)P1=T=Zo*B>H@y(Ff{E-U)_8pAR(p
z?sPLS+-ZbFpAV>A0y^^P&H)C7J3FB9=kNp?e-#W&Uo;`{=MRm(J1-a*?mR<^K8HWx
zFil|(;$&d@1WWICzB4e~0nI;y!t^d51H)Y&P)xwmt^@djbJh~DruxsI>#0HUcUP8y
z;jT2)zjqB881CwWbb;az6n%~sV5?f#LDxln1}BbK28O#X3=DTcBU50jrZF(wodSx!
z6eURXImW=MTt`?_f&pT{8&LFt?iaqhjDg`U=&0ZnTLy-^TNxPcZU&XzS#Seb;4Ems
za5ENw?)J*4W?;B`gn{AiA*8a~F$T7?1z{oNBKOP%3=DTKGceq}h$y=qJ}@YNYxOTI
zs0qZ;0F?VdwR+j~{BLaH^)Tn`00+Vp_DFpOrZ1(S!W-m@M+^*iA0QRpjyphwH|rE6
zn?Euz+<lKycsqhGYG7T$9sx^n_ZS!$?*4<uz&(BjhI_o=6en@Fp4}Rn<Uk8sLE*s2
z14?q=d?88B8k*!l`#$c;K$4s_G|AnIVPLoy0!eb#pd@#Sf#F_11H-*mXo~YeYAt+Y
zhNL(<Xo|bHkAdOd9_e~SGtUQHVz4W-J908GeT|1^<9lZr819`0aWWYg?mb~(xc3N@
zcwkA+2V7#X8$&cr0eMk^f#Kd~28Mf}OT0m?q5JF%4EI?<nqVo;2V7vVJF`1+)-y1D
z1)Ze>DxB_%F)-X0fm#K+?&iKWEW`VRKr;N-htTMRmft?${0?n@`|N?nE%-<qX$B^^
zBX59;0QO*ZcX<Y;Z=f43K-uEHEd#^-AZw75RTvoV`!F!v_k#6cd^tcvEg-u<Ta(-w
z7&dQZH)98ld4t@+0a`M_ZU*Z68E}Bx&SoZ{W!Io?Yi;55wg1>;T-YJ;rwdZFjDg{P
zECa*+NF@dajfL#`VhjxSD>xySWHQxRD1bYN;Mw*!3=H=x7#QxC=z%(c(|P~1Db`Cc
zFx;QRz;J&Ccu>Aai(MA9b>S2v1JidyNMAu#mVto*w5Nd6j$IaVzOohr!~Was5_}*h
zgH%RCR7!xI1MXF@OMvEnPJwpi@39U9%^@;<F9WZ43S<mY0-bmUlJaM*4`c+5`g{i+
zL@{qeAfuBs1H+~FEDQ{%8Uq<UL4Ex<AcY}I0~rlLHXY*xt-uLnG(=Ws0Z}IjI<Ywr
zG(E`l{UOvYRSmFRk_-&yzXBPhK}P(68X+wK8tr}$+N~n7Hjq(>k%8%lI8;tZ3girs
z)Jm;DMoy5F5mbs3BBjj0pq~)<4<zFaJ`E-Cp90t_Wd??srh(r;5-AXgZxH_~GcYW)
z2?TBL`cVs!cq7kH&md?A+Q%XFGw?A;%QT40W4Kv`J%Q&y66-m@9zO@SU70!X7)S!N
z8)M#vz+*CC7b`O`q^u3x2a<RQ(XkIM5w<088%W|8L}D9AqW(R|_IX<ar!z7z{gj2+
zK3xvv6P^@?z}evGZ_o)3YJGvl;Gqcyrk_^e6Nv&#;gYHbfv}x<Kf@trfaaS7?Lay=
z?hJ%&_xjlbk&K5}P?VZJeI+A1PyN%t41Ul)B9L45O$ZDIxdn7a)VvLW!Jt?IJMvIf
zAZWDc=RSz@ec>Syb~Df(q~i}n!X7LETIggQ2tP>1`ePvI*j0u%kQrU@GPAIoAp7=&
z1=gD|GBEuTg=hyITX6|&VQ5I8Hb_DbBB2d77o=rnKp<%3=@+QaJ#Ryxyeuf_p$3E2
zcdZNnsoFC$P!gmaG}t$9L!czOsy#D7DVs%Fk+B|>-F_=V)+#W3aA09z@W@wWya*m8
zVqsuddqa`&5|{&?wpV2Q#lpZ~r>e;K0+jGii83(#y2zDO#GuG{LyUoewFPud+OH=p
z3=G9D6d7NF2Jzm2gnkQx7LK?oGQO4s9VfxUz_71Fk?}n*Lp_6#5(@*v=4?gA51`y%
z1zs)+()<l{xWF6m;TrxSii|rM8JK>9ZmgKML6LDMI17UEh-9oH<0g<4=!|5L)FyPl
zO2&fx>R+PB*acFz8Jw3C8N0wn$jC8(7V$ECsAXXAF9A6#Q;`vTm_QX|CBk`TcFFo2
zZ$(D<qP5?bg;MiU7!(<kMZnz*F9rrhTSdkwPznVH=4VdON$!e_QJ^v1Q=l~`lWi0k
zgJJT2ggHTDk&2ALpfQb844}<&zG;e#j*R9E46a6sjQWfWOn)5UF~XHp4+>sW@Ev_1
zFYkG#$S4I;6V1ZFu-;OU5i<4(@}&oxA|pFU3Ur(lC^Xn5LFof-7D)S?rHYIUAT`UO
zA;AC%2}D55Sqe%+>!lRGf|Q*Cjp5GQp!gN6OaOH0poijbRtAuoh$zJeAT^-vW%D*D
zJ^(8L4Hz#|1PxI$RDl)wDeh-vVEU^FPRok>krbT<rz~jl1;s&xA4o^m2E_#+9l;PC
z^$WmSkd$R@fLO8(tRJjpl43td3uqtTybX%|7&<0_RMko=7J^jGgBV;0Rs}Jt6=77q
zVmwIE5s0FA>3UEYBHNx1GAk=t5mZ?GeF;$(3^Qx8mm+u__9>8}2ysO>Mh2#Td=N!$
zNQ%HU%qh^^!YVgK@U?~i>OdvOE=9-!Fg6B;#Py1roS-=b(7<+3w<7pB5)gZ`m!dW-
z|NR49FUYB{Xbj0dq6|#`AlC~jT0xF(0WEyceXVE%&UxUfwlzvo5|$kQ%>j>3D@sDN
zn=>$oz7Jr^2RRzF-H_8RfJwCkWEW`n*U|O>$W}EFhjVTK6KLfHcr#T_%XD^jc6FUs
z0Zb_%lin~e{TJsdPAy~zU`hjNf5VW)z)*W8fGHd%9WXtLon5E?YygulF9Xy6W=;l%
zNZ9};P~pn(hAWdHfC;iMkA;CjP$z)NAEK{<fx&%y0ONl)a|Q;R-vNyG7#W!ULy~d;
z<2`WZ2c`1ZTLFwWK*oZWt<BpIz<5I)Ef!;Mfz;{LzYAbI3sU$BoE-uf&w>?#<P?4e
zFdpM&U}j*2N*#ksiGK=U+yIhNfJ$wEOYwdVV4Mt+@_<TB21|j9lK{r4ps-j5GM(*0
z0BF~0Ju^cxRACQTAxKX7TmWMw$c#FuR3$>nEr78QBn3K%0OYYkxD;<=0An^t3N%;@
zlFEilv2_M8rhuei!I1)!s%K!U4PZ3oWng9mZ43fwGX=}BFfe${4q${#Xo1!@?F(SE
z0A~^w28KOT0vIh}94@5*MoZAlKo!XC*`5K6Y9Ql+g_1Lh7y=m8zysWz3=HLF0gP%o
zpaB3*1_svp07f-a28Ij<ur5c}07glWt~{>f{2Yb=Mrp9=AOi!l0~onLQk`5y`Q;1&
zj64u2(Aj<#JOPZXyvhs=i#7%P1gTlW1J?c<qC}a2p{gR_6G-CX^jDnhvO#|X9)Nh?
zc))IZ1XjidcG@G*Tm`tmlK38QgqMMtNty?2-!ZTvh`GnXY*5ZFa1YoGQsgi_l8ar|
zZF<0J5HFP%Z0>5%&@^aPj4M9?e0VK*!z|B<fCV5$b)e}uvw#JlCM(!N@A&~;Ac?ip
z_i(XGiB1gY0=2rqQd)%pwIHcW(_eG3%Nbt}DB*2kWME+849Ed9au)@pf&5>2G{Bda
zftgtc;s9THP%yKB#>uDKaI-5(b}%w9%rOt}0B0g)28IH^0CkZ1tm)<4?5g!P3=E;J
z0gBupT@1|3?ci1H0m_iXYQw-V?|XnWOmYcCQWhc!GMGyyKnyGk;_T@Q5Cn6~85s6t
zsW6%_GB7hg0;gjYMib2XNN$P>W4$gT12YR~Tl2gPDvY||QWB}am74-e2O)n{7?nZl
zAkASFMrE)%7LX@Z7{RA>fiqUf2Nh6@nwcdXYN-&iIuWq5K|3CnsW3`FqqClYA>@h5
z2aw^Q<KpIRQ27AX0}enH@HuFZ!@yKPn@t%&Mew|3DnG%x1$fFBRQ`j)wTc1M=A1QA
z<q@cGUB<x70@{r*Z-dGsaPtl7A<!;^SrZ{9gBwxH7_93V82Xx3E-^APFtdVIo8+{p
zfLF^d1Fid;bX4Uq*g%l18Muq4av0S10CkL##8nQ1I!U0GUQUb3VNllxJgw_?NM#L3
zLj<_yQCWi)@X8DfV*V;iK`QDv7@`>FZBSVX_A=C!pvqXxAC%DN^{C7ODFdw=oVP(`
z7FZR;`QRH$!AV;qK&1hs2$Z4bZBS`ID4PC>mt9Trgi0zS12Y?>380dSByGsYu2wIk
z;t!IBG-_4+5z;E)iP>eKDr|#@N+c+YE(3=$Yo3ZDI8Ydv*}5QJbVLtj);x$a-N8}L
zV9mf_x<f?=6v%8#z|+1erVtrDEe3|;vsA>u27(;&2@=X;;A7;#C&H<Sfd-W!p*)?1
zpIwF1g_X&Tk%5_Adb%M$yF$GaE8_`}(d?kQXj&^P;|b72J*XAADw35E($HaHU~qlN
z$_QUCosr7Qq$<Y1%)Xq3fnik;D`e?6sBS&l&dLO;`WcpqGBC4uu`n<!d(X;v4wA}1
zYjSPBu`=m{xu8X^%&ZDb24Eg|VWXb2Bm;vu3oGMpkOMDsf~=kXfuCK{`2Z{9dXU&J
zuox>N=o~(VH=qVQE8`|e3)75&VTu+j;~bD@IP{_F=77@M8x{tJkaN?01lT3&=L@hh
zb~8f8xx_L+!#fNN44^~Ym^pT*g6v~u>;?tE8^$bk28QZ?tc=~D00a#fY-eD&zd4nG
zq0*0)u^TkoSH+l-%D^xsnw7B|bWz?i#&juga4_~lqKD!BH3o+JpzbFqDEmOUuD*(a
z;r=fMhWlSYtMHH3u`*VHrV5rZFmr(JvCv><Wvl`<udBE+8CV&?2X=!`wsm{R`VH(c
z&@|<|4Xoe5*#dNMe_SQ&6PSNsbGM)wd1lUYnhXrh>sUc~nW2h-;ejdx!viPKVSzk3
zte^u2!GabH3=fPzCj_~(z5qE8q_B*E;Xx7j5Fl3YR^K-a3=ifqFg%#8$H2^OKYfWH
zyP`}01H*&03=9ueGcz!A$1pHF*w4W5VDEa+nGKxN9}2Q7*Eg`<1G$*<D>#+2-UDY2
zq+H6~0NR*jF@g04NEsJDMA;3nGLXz6dDaVH8BK`H1&9o&w|;^3I3oiymlH(dI9y`O
z3D$ieiD(W6hUj@4Soc9>j2IZU>|xywHmnq)XFFUb@DS?;uuMNhW&=b<nSo(T1?ysv
zX$K$@i@_3X3=A=K)9(qfOVr1+P6BJZ1(BZwmIswQ{vNE|AdR0P65S99BL;@elB~@j
zE!?~inP!NLG6TbAUe+2$24-$Gh(rxSf|0cpBw-JcD1}I9F)*yC-@=*$%J^?U(wU&k
z8(Ua&z<o~+kQ-TZ<QPELQyVcbtaM>D2V46XVu(4|5Do^0lwGXmprK1ppXYEIt2t=M
z5_E)Y=wDXwW_ZvVm3^YD;2Ri0?4#|h;MPBgtx?a+>IF_QY@po53O+0WB(Z-TE2v?}
zu#CZ-fq^xI6?|-B6$3L5=zy!E?W~F*H-Z#~oMVMl)S#ne*0HL9GYuO9L+D>t@D=DF
zHTy(aK{w}sSIeZ!vO<a$(79Bdr|MaSq3K@q1vDRn(>+i68^#I-R?r?)hGlY~-X)8l
zA2S;x12az@qC;uUz~HvSkLf8$7<3xVybXR#Pr;cAt_F1Of}S4}BwK*Wu1--urVpT@
zfhrKMe)T~=rq7Cy)6hWH_&ED9-36KV5nO-!G2KNq57ZV|r0>VHmyv;)7qsjNWanNb
zQ1hOXfuT{)k7+MxA5aw}kAROjTci(O$nVDlI<$d<(~s#a_;^Z?^&It_eoV(CA=XPW
zFifuZV_E?+xe;pn3iN7aay?|bjUUr0eb7=d@S!vAv;3GQgS4%LYMTspG$#WC$hyh;
zVDlvz7z}RuG3A2PU4*L3trv&79HcN;7p73^q#si{BLg!Z8&qLBvVrMf10g;HpGhip
z5)>@D5q?b3AWfia>_Nd2jjSmetO=yfWR@RO2uNKrCqq30NMQ&#Ekm6fVhC~t%=B6Y
z29sGJT~25HnEXJxKsy~ln*5M8`JroaIt$V?h0l-41EdL-Iy{gyc^ER(GYIn|Sv7?Z
zq-*bSKPD$e24;RHsP7?zvrzXrp<A{0I9SsbKPDTHCUdAJ8)U0&Ff?reX)*}d<;SEC
z(gix^3FIq%<S^3*hZ)R$4h#$iyFj{(CHz2#Z7}oig<7SK&@_FoI6HW6IyhpCB|xc6
z_q89BCTP9kL2zo(^Ydd;0NDwutUz`uAhi22DS+(+S)={RkMSQP1G50=dh&T2{22cs
zsbl;HR)^#^?N=-e3^OPCF|mP8EMfrF*Qu)0V<p%n>rMO^K?R%u=%5*pL2r-^dV_9|
zo(ahI;K_cBpo}d5I<Xw2=_yipGCoBQ&)~@*O=9|fjCVjz{s{>g#ycQQ_3t53$9M;<
z3*t=1d!V8U;z~b8(7Cn@&`b*+j}y}enOFPDkMT4k1G6BcJMG7K8e|^KxYNkSfl?UM
z(|(NSI6!?FSm4yxGBDJ>0-JZw58NygoDOy0Ze;UzBbx_`Tex|kp<fi|)!qXcXAt1W
zxDn*M{ZQjJA_we7aKJK1GSoBZ@%k~Y0x1M-Tm}UuXtmTOm_I-zi7-FNK%-zkMo@Jr
z#1A!aF|vV+VFof7F!(XfWMp6#a)GLwiL7oWSRKsw4h*@VeH4-m3~IOi7<)mwKqn=E
zT+xfHs~1fdgW7G7laxREF_wcgfm{pHRF15v99@(0=jr#Q*xl;Y{TK@v8JLAZ6%t5S
z0kW<FbX{`lAgk1t`!QyMG=X+=fiz_zYsy5|q_!NaX|5k5sMHf)0SyXpsRvJTkYbN3
zCBJ~dk1-y6;xBmLr5_`>euWLoe{f)6P@4-fPd>zt5mY(~--VhNg6xP8bVtaCfHbMG
z_%Zr2GBAq>K{eI;BJ1)+*QLe+(j|V@j}g?15CQd3K>l?@*5rn+NgQ0HD%kol3WKZy
zZ72h25=Pb}4A#VzJbjT2yJ<vDiyxyDN>*@SU{J6Hl}VkVevC%YPJ=Q7gUTzv?~Dx0
zqPgJ4jo){$nH=Ey>pR#;L~3GCc{N>Mmfct?r^OF+wibB7v+WT-P@@_=8fb8CdW|f*
zWc_VFMqY3p2Q}vuWc@%rY|%*&3qBxO@BwTANRi5Uzn36afX)w`x54ivlA@PzMGBmL
zk3fp<KuiK{6ukr*g681#djwacve&QvG9v@C7-$#PybXSrk&L<wR>f1s;CB@qHXxhj
zU;2Ss!(yQjLysdVKMqk2PC+NZ2?%^3p&z8cK?)c7mmrhUJN!U7SZup2#Hhvcpc)<$
zl#5M4RV%oaIemj1yLkOfzhx2(%wpT2rhsl#O7DOezY`L4d<+b%@01xB!m9l$7#Wzw
zL5CsC+u&CLnnQ#7y21!<s$YczXwH-e?AR)pV{=;kK%-8uhyqOyfZKwuiu3%y7es;@
zi3aEVK#d-TWl*<V)&W^MJzbvNr2e)a_>j{#pb-v!Ex&AVi<yC0ybpA;pkFrls7#Pt
zxRak7BLjo-YzAiWqYy8HlC&^CPf=<ygP(^GNDkDUXPxHfhe&)Z{C-9tzkP#*m=U;4
z=3rp(?)EbRwXEwwO>1|3KO;-<vQlLRhFM4b)EOC=B|r=D=WXy)*MNqx>Ki|G*v%mB
z`hMyjAPsB`3_|68pbijZN@D2|KS_}00*G~z;3ggi1B2=tKS|JN<tb1E>HA4q!88Y#
z`#}dJL8EVpeA9FoL5v!KY08X|3=A2O`i!6vb!C1?kN5<17ayYs;~WNN$t&Pv&Gi{2
zp~sp(xXr-u;NtW*3hWB?4+R+*9&)OJZamOu1a(^u>M>2^0G;z)s?TT-JrVq&F$2Rx
zLsqEa7r;9#m?bqp)A-=sEsO@Bi*q<MV5<sFyZ|49%q$5yItaA%6RP#32k6jN24=|!
zh*kzx=oY1u1q{qy_ZXNZYe5ndIT;x<Vbl1j0Wecf&VlNl3Q|-I-`8^T0O%-X24>0q
zpyQ$ako2Z>fZR3F0Ji$z<Q34V%~0K-MFraRhxA*)X$j)DBOQ<~2#WwH;AAz`K<B~h
zx5|K$Hv_{%F9wE(4h5j3t=|Do+RPI>1T;Zy9{o;8W?^_($H4Hg3f$|~?}v%aXJB|Z
zRS6u%Q#cqHz(K5#la$DyU%v#T<`e_N!_y254^L_`F!b~3gL<l<Uj4&I3=9u%X)-Y6
zebfhEySR*j;Smo5!z0ki4{dYxPk{7-#55Tg9w~y({r%0rEOkW_G{2{R4K!HwhJoQx
z2m`|-ALvSs<1L^d1nr%i*df5c;A~$HUfp#9HsYYcz%2D&E;p%&L7$OZoPo(`F$2S+
z8U}_(RiOLF-5x+gX$>fpgkI=(3NSEB*D*6NyM16_c+|td@Td#K`NP2QXbuCzqgm_>
z%%HnV9<66!c(hWFf!SRcYQPEDBB%NzCqQO_FpCi{GXt}`G6Tb-(+mucPJ%f43=EHM
zGcY{5$-rRCz{CZ;o&1;pO#3lVHx8sZM}H411G7vRGXoQs8Uw?lR}2h~K$`}+BpDbU
zf!qVycEn}O!0?!xf#ES{E&~(4BFHVt9~h1a!1e;bO=IC_b?1Vn*<%I_OgyFx%rZit
z)MbK{x>5^ZDf5^Q1GD#a24)#8P}(YkAMtyvgn^0Y#Pm!Rc4dD*kaZszj$Z+-hZ5%3
z|HR3_EHeYN+aQ{O;juCU!(&AdCmqINXJAe&W?*=1!ocv@2xifdACSB!vuFBk6?Uom
zqcV_;CUX@Qr%+cP4FE+n1GCIKbP3QEe)kxdWraabMbBx_WODQbNH<I;XylS*p?(%<
z>_IjFeEo`kF}MTk1u3Z+LFbaNECjXjL|ybF!TE`SSvCh$HtR=%PG;Q>Dx2L^^yQ#(
za(rMpIXTb~$Kb<nr|(l`7xT<%(FczifJQG2r|N@dB88Mh8JK0Sf=|lS*8?YNHU@@f
zJ$*w+@ePvw43V`*$WE74W0$CJ*3%Dwr~+O7VC%rbR04JYBq|QU#tp%xq+E+hegOju
zQwi8j3=EI`85kaW%7Kn|WnroU<+L{p43Bde7#?R!F)&n3VqvNR%{hStYZw?FS3!gB
z5GaSWfWo$zp`HO`?c8P-CKrUYj6KkOZoFSWWsL4lh_x=@1CJRP9<OI$c-$|+z^uCy
z>`KNy@Uh&2f-FqY0u0PL9?T5Px~CZ!o<uM(JOLdfGaIsdmvQ<9P{I;)WMQ%pU|?1}
z!py)_Kf8#5;mL6Zh9`&F8JK3*GB7-O%)s#EA&Aq-!0_ZV1H+S#iVRG%r!r4`zyK0m
z$iVQFgMr~G8;G-(f#InH1H)4>5N9U?!&5B=hNo&E^+%Z}HZg)27nvu1VgNDjGEL-=
zWnh~95~TJk1H)4n28O5gPIU}Sa~Mq-m_WPU1%nxw6~41GFwK!>V0aqB!0<E(#8GEp
zc$&h%@H7d;F=k+RTE@Wev<SqpXJB|bfq~&^PZ$H!9B)Wy%!F;d>0w}2h?iwxn&Sf^
zA|T10apn%t-XjKP1<;-Yj`~t#p8x;<!|!opoOuN*t;Wch#ZhX6Ci?*@>jIWFgvvr9
zmT?vjNER$(0F?nPy_*i%+sins037@|+Iu(|m=$I*GcZj*P|v{dbOi&$(`7ItDj1k%
z`htoPQ&{E2I5PlbECaK`CQzCwM~G)Y#ZQ66D-hxhP;v0JcJNC<8E4J_iG$QuF~Af%
zFiwBLz_f1_1GAzCBO~-8QAXHSNyZsG3{3l~7?>4xK-%E-DdUVi;B8*aiow(KHQ8ki
zXWW4Dt3W$niy1h7s4y~Sa+K;pg8>@$GrmBTEu6krlU<Hg0K}dCK$Bgnei0<{`eEfZ
zV?VUqW=ddTG7w;3Rsr2ov2GIs!_!?13{OG3O4sdWV0e0sf#K;Db_S+(Cm9%?K4V~b
z`UJ$e%E0jSHv_}dpNb4j>mEXr?z*=O4A1x(7@qNhl>B61c&5m}@JyDSfoVN!Jp;ot
zTLy+_)`|>F>jj}{cfBn0#8yxuUatvF#OqC&C$@k^9GNC^fOPsYFg){TV0h*Y+Qq#-
z65@-A0k#axX^<nV7$=xOcW{ANpo)lrK|v><m4R95321-yUj~L}1q}5J&oV%~j|>dY
z)-o_WTMAiZ2|5XoIl~XMJ9d2$1A|}<1GDlBkhR4O4A0IpFg!a8;(#1~kAdOY9T2CR
zf#KPE28L&^r5TuDDQ}_;IOR>%Y2ajFRt^TIJO+m6tPBj#nIQ?Uo^hfJX3CrJ29#nL
zn3c0Z(T_-Z6Ir0*%^>j#SY^gIQ3fOq5(6#WghqP54kUpoZ^e?p`U4;dOiKAINE;%B
zO~?VI4F+cAFVh8d*yT7oAY2vc>E=4@vRo6EK>1G7<8;_%*(MwS@uxTHuuIi1g+@XF
zEZip+K!TmwgN4aRfPq;f1$2YtRtARWk_-&bh1nUHRvlnqcy7bM@Z1W-Im5v4+=qeT
zxfh6YgMs0B0t3VII7J4gRZk$XzUl)5!}C%GhUdi~6@M5Qp0_hFJa1-aU|P+=P|xsu
z83V)fc_5w;1H<#X3=Gdtf;e&v3@`K;7+&a@GBB;SVPFtk%D}9?5+q~G!0^J6f#HQU
zh~vq?@FIbM;YC~+1JmkIh+igyn*1P7d|_Z#TLV%R#=!6*pMl{;t~3MF>QtyI@R?Ti
zg8Ov4L>ZXXDw!FWRu?fayr^ejcmcZCe03cI!;5|fh8MjcnJxx~7xNhyUd#n?rZF(Q
zSkJ)lVl6b%CP#q6lYv?FC@4eMfNr`3#U6YUI^*OLr~=Rh7_2q09AC!5GhITDotJC!
z1c<zv@N|7Wc3J(&Yd{yYGBB%Ifa1A{0n|t;JHdcjK1@CVRTMkDT8~}2eln=I?Eou1
z08<KW=P*vTfutO@i68^PTZBLjRmLfxLbwAY#xVip<Z=dZ!w{AgrYwLq3>l|@&l_Q2
zV35#V&B?&5_8FQjUhHFFc(DhRE$TmfV4SiBGh0mB0!ro#%<9}AYpP&nDdVIwP;q6D
zcr{#nvIrzB)Ioh6Mn|ZtpdmfQ0xAjG1`6sWWwK1{U}OV%6STvFaY_u-&~lKW@codC
zQ$P`r$-t}*I!+C=>Kf!?kb}WF1yqALK`jCq_5Z^M#)&<UjHrGLBvHe_$e4jB=_i7!
z#SR8$^(P=}Ah$|`rZAzdoOlP~N)1Mk$%Y^UkcxvJ5GQI#g7hN%Jqc7CbTBY$fYl?M
zKFI@Wm?y{_&~iOU`kj;k5(k;V0d{*mDDLDLn3h6L*kzn@03LVHJ!gy#EKDW>49uFK
zJ&sE^Gcde3$H4I7j3NWm(tS+e0($8w28I{+7#LoF3dg0_7#Lo>V_<mk26O}XBL;>S
z{}>ov`~h*^F))DEg1+Pdaegr{ywqc02zaR`&A{vlxj>t73V3&t;CZF>tPISWPS6Xq
zUnVgyyi9;zp#8Ftf#GF7h{MOg@UoGC;blE6R{nrm<<k=l*`?~IT!6%bW<1FI6FDI9
z0982k4d`ZSP#9E#A_x?*3_%P`^DjVxXc_}(IlbT`7A7;$0W9+$FfhEF!NBlxf+7Rc
z{MVpbik*RJ{&xn3mq!^GUV_?m3z!)gUS45fczKDPfoTCh14I4G#|#WFK`lJcqQ#d#
z7#LoD14*efFuW3GV0gtX&A_z432Gg9e~RE&y~8{V%sRTv3``4x85mx<F)+LW?N3<{
z&%p4il7ZnBXxHI_ECz;GD;OAFEdePjV_<l7gn{AJArPmDf#KCn28LJHL7e(N28LJf
z7#LoGB4NQS28LIE85myuR%BpWunbgFgBW+1CUTfEFfDk&z#zoUz^r`><iM8<46k_^
z7+!-;fL`#GfdO=-wAL4p%r^#x*D?$Yuc7zNFir=xn6wy}wRV955>cs42PLq2ki;dZ
z1T@sA_kao>M#e1IkirocP}~$l%8pr(+prm@%Rsw<AQq@JW?<mZo6pO@tli1Xzy!KB
z=Cw8h!)r~%wJ{)ttdO9b4%$ru(o~OnZwyEYWNRyk1yaDkfO>BXk~sV}Y^2J4`UX(t
zE+nV7o|A!D`zW*&du_$Q@Y(|Ay*<!EjETdDAp|<q!8qN7fjJf29R=kxs57TIfX;Vh
zVAlQ&>f3R>N`RFf)2=|uTODwrhbV8SGk}6_x|a#NY`q95VS@q=eD@Y3XqZoef$>Q(
zBm{cFn_PsPSeU#)-IQ)-2F53?3=FUR85mxBLfbpNEey=MPhgxG42(}EF$6I%zEFl5
z@dUI7NGODb$yb1xf$@bg1H<b)28P#J><o-A?CKd9Ubizaylw{Zycif>FJfSLJqN@I
zV_<lFh=JktJ`g8~f#LNH28P$yq!}3BKZ6+DrvVPcRM{u249vQv%nXe0KQl1Ae$K$~
z`YDL>pMl{uD3yJ&LKFyn8eqqi$~v+_3IjccH>?Z{Z<s*^022el8xaPEH$or|9|OZ1
z6$XYkO3?V|vjLX|iXT`->Y?G@CjbgN24>xvkdz5JZL;(Ls0d)Rfkjwf3j^be8jw8r
zt~pR;k-=!lzyLb>EmDPrNeSGAWCVpE=z2yLCMD2)FWUt`r;yDpV_~ut0QWZC->@(V
zf|c6;|36*Lj9sW+EEL?a6$IbT%9zDa#=u~?o`vx*BRF&zu7lPAGB7akv4Hxcjz=UI
zm^R;sOEEDp2tQ?E{Ljk3td~&Cz_j@d1A_>=ECbW#j|>bF42;+Gph{POHlK<purM*Q
zGBBHd4q{-uW)7CBXSlusbZEPXf-KW6R(1x)Ypx6oZ_F7O-WZ!QFkTB{U=Z<VVAk6O
zk_l&Ec;nB&@WvNxbO%^J!;Lkd=o3kmWm?C{z-)SsnSt@zGzNw@X$%Z+Qb4*EGcdd<
zV_<kw0^)37V0hEY!0-l?POj}`V0cqMi-F<IB#_i828K5W7#QAw63Vsf3=D5BGBCV3
z50ZJp!0_fF1H+s95)6#*_du+@2`(N*I%SzAa5FIL7lTsDSq6qT9~l_lya#b^GBCUa
zod)s`lA;-IdVu%5f{f^b8sWph#8A&5GE<gmA}a&4{$Y@|=?n~@TTb8dfjEm97~aY=
zFuauoan>_1ywzu5c&iIDFaxyj3KSG@Hx+<t2$7YtOp}Eem<`xKy3R5%yme(@c<T(}
zfZP<q!0<K*W<&!+J#%s)iWwc?;M^(8G)0(!*}xN|4P-_N1H;=S5C>#NF$2TfLYNtI
zVE%gK1NGM(un}iundS&EFdHc{GcZ1iV_<mO%)s!r5yZ)6V0b&3f#K~$b_T}!M->bV
zZ$Tbi2+0l%H=ls-S7SC<3`*{Z1Bz~OfN~B4v%ztYIQZxYCP+nzq(*~*Ic6sVv%zz4
z5yk>)Ycg}Oz?x$Ww>%*7hTx0-xEL82Ef_PIxfl@&GN207!3How3_z0K0da((&-5%y
zb{WnqP;U10eoJ;S&JR#-7l<p$bz6Xe@vSEVv*EhwXD!*KxNaLj`In}Dv}Bj&jDT`~
zPZzafSE#Q5aY3E~=W!;`&1M;lHlR!8D?x2l2FB~qy_>fiK*f*916ii|pfn%H%)oeE
zh=JklRtAQ*8`&8cuY(fJ1qOz<r$8JX28OpE7#QBZLAtT=ZUiWfL|J5+a(Ee-jTu4r
zGS-JOFuY@9V0Z_*A;2<;f#IDf0|V$#04B?P28MTP3=Hp7<Pldk-i?4(i41omAaxf5
z<jO{7qvxPY8dDh<-kCEnyaR3dwJKs@c;~^u@XifdpfTJnLAtRqgQ=E*fuUZ4f$<@v
z#l>(NoQ6atWtq|h7?@2!IqKnW28MTu3=HpL*%=rgaWF8vt6*SwR|evM+}Xvz@UBgQ
zf$@<6Bo*HN0m=-bR<ew(oD9sym7s)Y$H4Gz2?N8sMbNZ+`v3#uqsa^s49syt_Wwa`
zZqTM=76t}UFImQkLJZ8tr<oa;<CGZ~-fd=Jc()P6(T8y$1v<l>5C+EViQv?NNNzAA
zK^uMVB!C?fCCfNTkb&6*wAB`D;!y^McZXpnf;b6>VMdm~jYK3s6eAnJMrO$}P6inX
zYIcH+yw1Sz?kdbkFb8Jh9FU3AC)%(})V~1Vmd<R_4oYb?@Z+rR*nq+Ung{PZ03}5R
zW|K9bDH6nu8Fv|=;zvN@b?|I+SB8P{T_OXs$!$=J)&m~NHX!8?AqII!+<-&*_6BHk
zp5Zoh%Qpj$EK>?7F{{8L>LmliyXWBT{vSRt+@65sy4y<_7_VD0Fq?XUya4Y+Fx;I0
zx;Pdj21-uQIKHukf!VDc>aQCY80r~6G%zrmg0Gi=^mRDkr?}mC0|^^b@Ff!*@XIQ0
zN`Q`-VPH1h32NbRz-ncNn+6PwpTLbGP&3Mdf$<uoJI-)p3N%Nsfa;Gd28MUP7#QAt
zV_;yAuV-Lvfix-^u5W-HX?PtL3IZ%lEUXO7W=66Mj4cm9#9OF8uJ2%Aa`Ix3U|?+g
z3Q6JD4}ex<i&n8Pv4XUu$}%uEF@Xqvn3gk8EljH+-6)3ZcNpr~7#KvmSeV#Y8JH~=
zgT@m!FfhCqWng$O2pXK&!@wZAl7ZQ51xV%~1H*fL28Q?Aps~!=?;+OS1)m8ax<}^`
zCj+xZJ!lBw4+Fz{Uj~Nv-s}uaYd9Df-p4X9ypINPL>L&}=Q1$7&jxW67#Q9+*E2A@
zua;(DTB8jy?w$!aEnm~Q2r^ESnSp7I1p~wT)eH>pLHEe6abaM1e}sYI{Q;0n00YDO
zy9^BPZz?h{t%-r$P`NGwZV)R2gXn9W-K-4E=DV30nAW8-Fuec5!0`SPh*QYG@PV0u
zq5cD?uv=Hl!0<tcf#CzFE48kZf#HK91H%W<#_@Gi85lkoFfe@3gXW!k9t_N0(x6lY
zsdK=^G82ab1H)-X2BuxA3=CrII{O%yE!gcCn0C2<2y+k-D9gaK3v`U*u51Q|4^9jW
zAM8LTg3hkEw}XLc4fqf&&|!0sW6wcyA3iYLYhhs8RSCBZ+9_eUkbuZ*7Z?~nrZX^G
zxPeqbW>{gPwhVVafKns_vjylJLeShQ%vku)$n=E{>>~B&AYpbFHek*Iitft{3?HHx
z7(Rr7+HOqCS3uNU2X}tOBv_c(Ss9qE7P2!iE#Jz(@S&7};X|P*1Jm+D3=CrW49phK
zKr+V}7(VneFns6+ow>ODD#VC;4`A7Wf!Pu?1Y5uS76ZeFWef}-7J)8iUj75B?gy+`
zxc399<BTpNHzzX#(+XAwh7bE07(VP}XJA?($iVR7JOjfA&=}|nSq6p=_Zb*IfKL8g
zp~=AT;WGonhquxUOe;(v#@+{)z+(2gzc?9~t-L{VA1fRg7(NOxFo2KfSmDdS@KK(D
z;iD|bqDTgYk9rIYA9WNNm{z1h(%7nKxJj%G3}QjLPeDNeO026g7#Kb}GcbGv?Py<B
z!oct`oq^#aXux_^0|UdyG6sf^C7>b49tMVwtqcqwn?alz^$ZLjr!X*loCJ-Y`z5e6
z1{xE{WU2<W{=sPsreFgsS%4M5lEuXh@MLkH1ClJPGO#3z`x=mBVbuVUtcR7*_g$dl
zE{sN?QTuWp=%^ex1;AQlH#k69R4k8$iG!7a+4eX)1Jgnw28NF-7#Kb-GG$;|D9^wk
zwuyn+3N!$}P=$fv<8cOtk4HgguP%g)Vlq4c9~LThNQrR@F9Wk}{bFVYriIB23?Cmb
zFnk1!&nzrpVEFi(f#D-)4rpO51H&gV28K^UAgj6<7(VGUFnrRMU|?D}0}>GrT0k8N
zu|G<T<(v%6wvHg<RxvPq@?v241Uiv+;dTawPpJ$HpFqdAE<D1(@Tr4=;S=ce)`b@t
z7(Ue>V_^8S3uO2`28Pe93=E&XgZ%NDfkE7Wf!Wp=B=d%W;j=RX!)JSW1}5k*0K-EY
z=)f|F1xcYCN{pd`49qs5TW~?+0H3277(PcL#sNSoq0P33pbOzax>)MDOhH2!Y0DwL
zd1wPWWdosvOOMBcfjMmlTm?uY0|N_u93YH=X(9Afmq#TKNd^}NW*gAR&%$2}44-ot
z7(QpPGcYY;WnlO`nStT+L<t6_=`%qF)_-7lGy&8C6i-)TbdzLYwpj-nJXprS@EL@c
zKvUhLISfqGpMi$`TwnwJ439ulOlU&~3=a(;LkBjX<5!tMLkG|*=pkqbQwz#@Bmo*P
z09D1HLhw-th{wQe3z}<YGzZnJ<p^6q<Ehs{HiINM$`xSg5^B@~(4fB-bbx~4fer)H
zyK@Z8wh^GKraa)nK9DS7TL4P+@Igq12RZeS>|hHXEJidS9{pipS|kcl40R8K2LsbW
zBT$%qV0Z{!IKu!cEf<<IFnr#@!0>qs189_P4)iSR8{pG!#miZkxL85cl${I=pRY17
zd_E7Frkn;b=Y|60MhgZ89tLJRP#T{zn}Ol;7Y2sUpFo*r4)k!}$0pz?nyklY&&$B<
zIG>q;Y0fPM2G9)xUpPUAKWAY0qQSuMMFqt9!ocvwm4V@lJv#%_Tt)_lFXapjUy2nO
znC9{^Pdovdz@012!0=@n1H+fTdU*z>x#|$tJkEf%LLS4Wyk+zl1z8!G?H)2SFwHe#
zVED3&f#D120PeXC3=CgRGcbGs9Ud~*hk@bCZ3c!fH=)VpaSbR&K}}%?FVG|)cmz`d
z$tLh=FXGGe80*DY8JO)sxfX2vD+Y!yp!FDF<9{<SeEA8o*oT4PD>nnfS5BDm;3)#o
zqy&!>8w03k2DN}WWgpZl7eED-_%=O8DUkV~^%E&K85q7QFfe?T03DF?jDg{+Hv_}h
zdQTAV3<Ja0Xa<I_kuVEDa}L)*5f7Tf0y!KqsmJgHe6)=CF+D~dP6lR&Ga%QcF))11
zVPN>00pb)fFnn!gVEEby;?yxPe4WR@@O2g_?7JWp$ow{l3!k(wure@+huzlu#>&9#
z5Xa2GG=DM!!`H103|}{cIP)18z8+y<_zD_4oxhra;p=4vhOeNLoab+6VEFoof#ECY
zRHFHZ85q8PWMKIE9_sWbGe8x{^coL#NlR4*2J!EDKN*-ER)N|fI9ep%m>C$p{)cLR
z%E7=iclz{m9_(WE7hp9FxOEJxX|CRY*EEkEAlb^{B`Bw$H9#IGK(dx2Xtn^<00Cw9
z4<8sFgJz(wGcY@<fHJiusIn<Ffo5u$k`18bQ_sNc=m=6{0E!6sOasFc&`gRJ1G6Le
zs9r>7eqsaC#lY-XhO7zduP3152ULtey}<+?+~q7i0-sXyU|^cF5*jz)9VVcx3CiDd
z)-f=AlV)J}20FRNf`Nf|JqzP=@X#3pv*QP$)RYtk7RKkGJ$MJftH)UwpMw`-f_9RZ
zKVo5A4pr;S4^_Kdj)8#@q;~C27RKeqphaUW3=A9XSQytzFfeVL#=^j`qL+oSe!VmU
zgUT8f28NR@ER3KHpWsESMoU;2H-grgEaS>7Dr8_`1RX^Sk(tB72s$@{VHp?b2ul`5
z&<1Pp%5XL<7RIgMC8R723^8gfjN2gw6qn{QurS_$$$0H#f!?#h!oVO<-^{{z8#G{j
zN|b@w=@j?^6c)y{pmjP289+jJSr`~p=CUyEgshzb34H)x^UA^q+SkSS5PV36?rRpt
zhu}R0ko_o7-a`fkPyp@U$-)RKqZm#xFgsfdLEJqTv?XsDX!R$^;d4P}=T(6eJN{u|
zw1tMIi#aqjZIu`xp~=C?!f0y_3QbN1hJ{~Q80|o3z@6e`U{I4}VYCCyo`TlruzzP^
zv@-^siNVRhP<fw)(assf;VMo|XJBCj?O<R4ZEY-{$;-m%D8az&Vh*}lMsWITZ+1z>
zWz$)G*zN20*|RVPfP)aUt<jx@v04zc1e1k<f$bR!V;h(Qy48Zc+Ma>Ik(q^2hLM5U
zC7ctqOpt|92C}}=o`J!BEem*wv`Z0GN>~o$eg=C6hJY#-MkbIh&_+%BEi8;oU@5Mo
zlthMl7DiS%2BsEJ+HhUU!U)=X!|(>Qi>@Yw1-x<41+)!Ntc&HF3<HxXXk~Fu3(Gfk
z1_mJ|4zL@(*@5hVEXxA#|ELK8X}2k1ImyV#!0g%pQFc-qqzrUf@=}(Qpo5Lx@Z{wr
zGfa2#Wp_`hWVt2+QYy;8>{`giz@Yn@1#~MY<3R?{!dczdEFU;QF$3P}$x&p)z@Rdn
zr2uR?Xpf-%7M22Kkm+pTL<Cwb%mCVoUZTSS+WY}t_REtr{jD#%c&s~11t_rpvoSEN
z;A5!-2QSEuwAm~jyr9T~92c>eB@mQ2su&rV-9S6!?6<H4f;VijF)*B6#sXR~4YML1
zWFBZSF;CL;L_c=%dUqD^jy8}L?Wru_75D!^R;bKniGU<;&>rXh<1AhvD?ocx+}a^w
z<fQ`g1!$G1-(ePW(Du$ZkW!=?Hn;2p8ZdWzppaCW#=v6335o><hHqvJ4Bw0(F~De2
z|C52i4>sykeFSu#IH>mI0_9A11_qsJEV^KmL2DyHi-F&>=z@-I0d4fP-@>A+19AdS
zCIbuf5G!{EhE>~HKvzTy^MjVMLbRxX!V09NF^xqHyzP`Bl7Zof6f+|?=q?c0s$fyj
zW>-)%vIFF9_su3CcQZ3`OENGh^D{7f3t(XQ<|UVtn#aHlTQ<+|Er)^OTb3N?#2IEr
zKIn4bZ`BM8-zuR6u&4`Y?IWa~U;v#qv-%P<=pu0jWqw8m=6d%#Ld6WsjEo|nd?b_%
zVoHMs%|YS1vWxi}Xt6eQ)w0M3kmDE_7{L4gJUsds85ojRFn{9*xsNeRqqr!Uf%%&v
z$RGxWZ#@hQ-#RqFuKlLVz`&@%!0>Ga1H-ok3MmZCKVUA+J;%WC?HI^1$=S?L7(u6Y
zK_bxzHlmpW3Ji}k8Yv9SPxwLd3=H4?F))04r%}wn{6r3NVej_{28QoG5Zj(;Ky3TI
zf`Q@tENCbgl`t?bm@xfe0J{Qbx(M?rMh0e&pVPSl*;RGQm_ZeV-~ouehhWEu>VWL^
z%u7o#WMEznIZiAqZF+PdyOihmcMJ^QUx56vAL@@E(hLkggcXVzm=C~2f*2Tnc!8E?
z_69M}W(3VqE#P2aaQMtTTM*<64hDuqi|P9U*(K^%GIub7Cbl>j81$H!J3vdXKwI~B
z_AqzILX`?;GIxO10E5J1k27~zgS^cP4%`k;uy?H)7!E#Vt^@7A^pfT+C@ErKt`h_4
z1|Q$TTqg(G?!>{s&?3lOrv=vG!@wZ5hq;_F38V_*c@fxRUk#Awy)x2@8JNpqeotm#
zE(c$5&zPx^$G}`J4>pD2M>_+<k4Dfr;>({gr!g`xdx1^@&|_jw16L*-3=BJarf&~o
zSE?^z4hKo!gZMKX$)Dk1fAS_XFo&yy+zIhnxFOgE9|nf(5@tyDhdQ$Znh+g8&h%E-
zC^lqZ_5!D128JIi7#Mym&?q)yU<Q>CqU8(>Kdvw^{5Zn~N@Y$frpE=d%cM1d_1K7j
z!jXaDCj$e+j~`$?HY!jda|VW=`XG<mfOc_eFfjbgV_^8123ka0Glf|XTpEFL76$`^
z-7;o9uy1%l4$%W0pApZ&z`*)+`h#G09j3z8>3kvVGW8Om;8X@XlQB!7fPq;ZT%a;A
z{G89g@N+iEc?vg~WkDuaK|ERk8-oESMxXU*;1WSr02E`4S!v+-mjx9lrx-J>7?^$5
zL$rbBDi|0z|1isgP6YPZ&%p3=I|D=H&&|vX%s!_X7=B)4VE73-6y4`K1H;dk3=BV?
zvNJIIJZ50{#md0&^Dl_=mVx1y4g&+|P-b@qhNIlfLST0>F#CYcXxnj|SqK)rO@7mv
zLfQ4|o0vey0x|o7wl2@xz{Hdf-g3bS+BLz%ln>r>!O6hjuFu4j58iaa0@`%J#8e0>
zYO7d4dpVexK-Dn=_-MZ9UrbD(Ga-B-n@O3NQeiuIRo^f%rGk!$0ktqd#-%!eiky0=
zdFjaJWq_(1uzBv@OiWRX49vcuO*tUvMJa=Jgm6OajnV~`c~Iv?IfBdsZ8esC$HWxG
z$iVCe*=EYb6a+p%2&yRvlvY7I_d$*b0v+%#S`KPKcyTZ>d4qI;&SUcKW@7RNpN;@E
z-CF}}x;+Df+D0ZOXOOxesDaMN>YU-~1O=IxtU>BPttgOr)}V$N%wlUjh<Wu441x!l
zm<&M**Ms+%F)<mcAo<Y{bha)`mmxUJKz=MQX990k^?L%<q%Mb~3AAs90j5da25gl%
z14Fht6X;$;W`9YjCV3g~DOgaC$b*|KP!G$4cgcXP+RnwqB+kgd><>Eo4ipFCu;2uR
zptwHF^m)gbnD{{IKsR%Mr1&JkQj!b|QnQ#C|A3^*Ar>?K0q?_NFlVS|u!~~?^$(c+
zR|%ysFfl$C1?6NRP$pqwd=6?)gSL|9v@kKg1f_~MpgLIW9TRBxC<Ckt-U?m&&9DPh
zvINwsg9=P0M$paSpbG4l4+Fz5H<Ps75(Xy5)5>5+G5pG9VEC0ev7S+`xTJ`IiSYuo
z2Kd#^!0-#SHD$3N1H+#H1_rTrstgR>Q<)gAN-{7gU1OTap~}E;d>a!Zcq@n((?kVu
zJ<h~<3ueMJ28Lf#SRt8u>kY`HYyfn05jK9fO@e_rsF0DdK8p!-FkK`AgH;L>;|@@6
zg|>%QfXXINiMaygsX!wWh&y)(fa+}qhF>cg7=A5=`gDg3xXfkvb%ufA*9oXkcR-RD
z!>?Bi48NXCWQ2NSFN!znnHcwh+Br!6I0W^_Z%zh=-|Wzucts1uy&&g;)>$kDT?-b?
zz~Fj=iE%X}#IGWtJPdNN0@%fqQW+RBQkfW6OEWMitzygyO=e(XT&)J$T+f&(1qsu&
z^->JXfs+^*eoHVg{1yXkVALsLVqB}lz#KRo+!R*2#>c>*G^LDzA-$1_aVpfRr2!y&
z7#J8LKvo5@LcKf{Tud`C{MKe*_^k@|GAO2IKz+yo^~};KP|t8OLv~6r9an&ODhqrv
zVR{`C=!zBQAUh#Qq5<vZ7cHO2$O4J^Ua)xrT*;-Nl+!HBz#L=;cC3&(==#5ECML!_
zP|H225UM{<7?kKHGJ^aEa!{cl1GrHa!BEdIC5`Db)K?3j6*&vIDH-mg#=x-6lIb%z
z{1_O1`!X>6cGm#A=rbhOG5juIVECP*26onG&?u=F1H<nX3=F?J6p9&`zCvrNKe`MI
ze^eDplNp%4K{64;pD+f7KS6UD>lqmMv=x#Wn11kqB8GwC&twLMKluuI3{3w;L5^l%
z_-n?%@E3GjORX~#BWTG9!y5*MzsDFD{%(+BU|8MG#K;KM`%jC3;h&Tg1H;Z=OpMIX
ze!#zc28Mr`a-f64nHZ%(A@`7h;ol4fhJSrh3=H)gub3ERco`TN#TXd=onT=2cZ`LB
zp(}=oQ5I~y1Osz8ba})=(6SE(zA7e0P9X;7V9>eS;js)1|E@DI{JRR8<qgk(q{GDl
zpwTS8E+$4>K?dfK+sq8i;iU`=|DH22{Cf)GG%_&!`^LcV?~61;J^b>L#Q~s^alYA1
zPemA*L-_0%m=h&H+p`j&GwX|EK!b{WtC^mI<jp`giTq+<_|M9~@Shp14tk-<V(@9f
zeEXPQg4D%<)ZJlV00riMVb}ocVhaZ5@b?VNAq~?P#;{AOhcGZlM=>ym%mX#}A+u#1
zR&d2NP{jwPKa63Qte*l>j8F(_Hh@B@590YHI-n&EeCL=LgLxU4LqR*o!e=uu{8wjS
z_^%A|{Bj0{|Mm<F|E)os%?u3xV;LC!2ZK2K85sU|FfjaY0dY<<F#KP@!0>+#I|Fn0
zH3o+NAlaSl49xZ6j~E#K-(z6-e*;>^Es23RFf<?Gsyg_H^pX}-_kwPQk!N6zHiNns
zKBK*412j(?Ffqo1-2Q->fjQclf#E+WoPU5g{-B#ZxEUB3V8zmsI|#!W7~~n4qkcn;
z{Q#R0TLSC<XfQD*^D;1pfubaugMpDjnSqf((T;&RT7;c}Ia-c^k-?0Ck-@-&fjL?e
zZVJRr3Lq6)42%rH4E2l*fv|Ff2ibO5d@cL{5@lcx0}ZT!Mp~i4v`7ak-UkULnEFNF
z2xVXn1K(?g7@%8p0IL27L_KI&k3*LMy84Y_(H#cnD18RzFz}WYNTPu++hkbu2P*pu
zq8Vn{;vJB<3J2}GLvq~WD-g@V!MB(}Osj^+;o>(SS%^uXc?Bkp3I^~X!Z86RP>II?
zIz>G^gEyIh=`AGN8!<3gtYLZ#Dh0zqXFF}PoW3TWUBW1e=_*+4JqNgKyDAT=8^E0%
zrmLXyT|k@7Ydx8+f{w}q?G9euKK)xfyJCG#3lsS4v^Strox)c#9fTH{LeNeHBk0mb
z=ExI}BJ&`qj$6gR$dJas$dI4`E_)7wb{zj_U}WfKU}R`jV_>NDWI70LTrn^*Y+_(!
zSfv3fAP<5sN@ZYVxWT~4a0wc9LYyZc!4}aueSQMF2I~n1=7>$x&m^#`fSI?ae}yt5
zS*FV+LPR5Vr@O<LVbcp>%=+mw6WLXqPB1V>E`@|BBV#5@F@uRJXlV#ym!t3#2Ij~U
z$SUlmpejINu+M1v|3r3)dVPqGw}1nZfsx@a10%zCh>y2`0`wFEBcmb%BcmkPcU!>W
z%D~9z%)rQK51kVd$^peL$WXIzrbW<z6>NZ{e1;RC8aC=T#2V0@z)Gta7#Wio7#X89
z$`b2y7?>8RF)%RvXJBNU#K6edQ2^@gFfHX`U|1EvG?7Cgg@I`qq(#BVc#DCN@tQOu
z^9z0fm8lFmOrZ7QQPBL($oP$ckr8wiPP9J*Ba;LJBa;v`!wFe{TnZZMnP|WUUV)<p
zS}7#Bhk<#)1E_BVA22X4SOOZJGnvE$K7%S6biCd+%jx#X>^f>;oJ<{{6c`-^Nr4^W
z;1pQQz|;Y`+$e&9VMW38iOK8|))yh3E(I%LU}Q39U}Q4ZNM>LvRRLF)j7&icj7)x-
z3=9F?Om(2b;1L5OQ#J!5Q|9z1$?PiikBmWv8-o?|F)&A8j9_3;uVzYyhVc)S22%{^
zCedw{Ov!Q}O$>~n3-y>PLDnT}gH2#$n!&)xG{uU6IVKxYKK<YT)mgGVOqrnNv@sP7
zj7%FD7@5{XgUjoO1OsDa4`_|{V#Z7k3l$CvP*fQ)F!(nx`GZ0srWurH{UP=D1V#pi
zR4yh9Mn)qBh80;%+F%tM!QnLhVhX!xeS-*-GGjOcLw=*0vnZ%L3vos@tcV4-#$xxW
zF))ZtQ*#E{b&7$J={N%;(?K;*n_SHqwDcAv_L6~-=`naex0(z1hGqsvW_AWfW>#qi
z=2+;gR1LTV%%!B}BFMlTo5svg&m4Q6fst8)fst8+nSnX>HUlHG9s?t@4%ELj5}?&u
zpezHPTmcnt40;UAu`eLbtWkm02{oY6ZBY6aP;&=$wqt)XFf!XRFfxNG#W+?5MrI!d
zMrJRVu?A3Mr$0$$7pVWB<^c9P$OWL|uf(RQIe;!o1|2WZBB<tI3LawBVqlPzSF?qw
zj1%Gj2Z}A|C`YJDTTo^^1sW(7wpRlk>nnHwv<3}y5}4RDH7ig*6{^w-+z$t-)Geu3
zGlv_R1~Jqe9Ma%nA~kbJ2!}H;SUam3f>lC%UkS_5;Nh3JhmZ&X^)(qzF)%X6GcYno
zLL$Tn79lkZjLcQgBCv7>19RL%2Ijc>Q=mIMC-O{Tf%Ro7*Dx^0{ez2wHYFcyQPTt4
z4U&O4Ob;{?b_yiv`%q0ADj6>gk<<oz79_caLrnuF2|AdzMNmxxRC0rL7QIqat%u2i
z2B=#E)j(HuGn@k5=i6eSrUaIRdKh*$5V$)MzYOAGB~a9ZJlxB`$lM8y;mQIA=vqYZ
z<;R(zW%ybQ413+Ir9tDyr<fU-<Bxz(nzxp&Hvyex4=P^_j)>}mh6v-I@#Zmz>MJua
z2*mPcFo^0~GBC$K15IcMq#H3X2(A)U0Vzw61}RgK11aNRU?|%!s$$B(Adtkyz+h-9
zswM#v2N~<XMpO!{-W#M|3alQYMh2v&9&|Ev*?v*b2$Db&C`~x55ETJ;96@c(bdU=~
z)EJl((!nlh(qdpZrOhD)^2aief@!><`x`i<Kw~kW8dmEZhZHEuf=?wC%;yk?t2_-+
zDGoaJ_6=`JY8eBExHiM|cNy%$^*tOSppm31kcltBmo;#RfI=2*%8uI{f-u=cc8IJX
zC=$W44Rbg+;IgU^Sx}#vVHraQBLl;c4_eh=Cv-A0Fo-c}MKUrlwQK}mu(|H3Rw!7C
zS;&Zif%~tP3#b@K1kJwiJe@u%lU=3$t(G20{Tk4w|9RRB4ADYb#wrX9+zUZzizi?@
z7wA}30|w^AoxEiX)42>lg&62`7f)+bFGdFDM9?tjybY#a;KPzRKx18|UZ4Sf@Ugw@
z8%$k5ioSy;2sW6yfXB8#x@~MtZ5bJulLSB)ozL4~YO4Smi~-5iwVRrQWI(5s%-diJ
zIb0AF%ZAHMwL!6*<PR}STMVQHlrA((wLyCaz=yKTS~lY*I7u@wCuQ>%=QGT>X%3zx
zGGkzf3+86r2nv9tDVz)pno``18|9{N$zm53=?mg!oCOQwB+%3;r``0sS?rP`6HB=n
zr-FhIl%$j1ae_|Soz9ibE@e}|&DaYvEE#lT1*aW1W3MVGY=l5<CvHa28Bz?VK$|A|
z!nhe*VP+?Tj;Z3bo1T!(E-7-{lAEysWHu<7B^N@>?#*VGs;}f`1V<_K&M!MyNu&a5
zS|p!Q2f2cqv04>0^25N$yn=y|c?r0~$PGE<6O>&KGB7glhgR`+Gr(6^sW31sF6L$|
z1KIf>bOjsea59k7%fKdaL7ZOB37XgZ&tS&DaNrs@V-d)cDM}F6+2ycH)j!~7%mWL0
zg9W)6^AwSMo(F0~En|pgU<fPWX3P?Slr0XR_AjUcF#&lYWfjy5Szw(EjLcUU7@5zR
zKpc<-G6Cd;&kT&ruyqFx6Bw8?{6H<4`o)Zy3=E)SuV*abW=s(Qv6$X+GbW0dF)$cd
zax+GP9ruM3bc+i&W27nr17jH{1B3P-ZpKIh28JcC!8Z?ZGe%m0D;_fj2BYcRj7}h3
zsi3h;qYQ3FCs2b0rprkWG^YmD<x~%vIyuE~hA}fQhk?-q6qu(Nm{URH!62O`p!wo5
zhIfpadF2e;jNl7ymx1;!LfxYdkq2o{Vqla6rwq{2IH<IwBFMR*z^~QgX5<Dt3N#&`
zdX}4!8#KCC1)8@8S;VaeR%yh*5OtaRFIeGq(2eb9x&MOlENBkJD1-YiXjs1tlz|rb
zbH4|x`U_F@9;6CXUm9g_gBIU1f>jA?bKeE2N)zQxX5hXHn$mj6u#mARzleeR95}pm
znA7Yy7#L=Ya-RcDp@B>gP3Ara>KWVutIT2GJ_c6FoK`=*A&*_7UY+|m=#UC<)vYhW
zy&4>5psnc3c`F#WSA!h_K0AYZEgNWr8dOMgt>tb3Nf?0C9TVV5E@I$r1ND^*7#Khe
zFP*F05hBbWR&^}58I%>otsuf|#K6#L%@_mnMLKAP)3tsTV~i#!;yD-?j<Pbw*n=<g
z(PCieV`Pi~xdoIN($#n?7#Jf!$MgON*}pfA5nOhHGJd)fNG=p42lj&>2V)ROA1LFd
z$ARR6Kyu*H+MbcoA0!7hvkD~VUk{Q58(L({=mU}j8#)an=>w7j8=CLP=n0Yo8@dT3
z=LwQq2CAvUIv8C+a{nQ@DR2iUD={!IfNSdXKN=MbjIJQX{}~ur_!t;jxS;iP;28$y
zjJA4Ewpq-W1wJxb<QbzA$f#4Gn+-v>IDs^RU0`{J(H<lPazTbMNX{N4w+vJj%<*8f
z0m=ObWkZmZ4M+;?smX^JEkRNsPi16*<SapQU?ZnKV>APu%f<jUvkfF^29gB(YX8LP
zdkffQL^Z+PFGh7xDGu_1CIcgj>hyO7>|*sSP7I7J4$=(Fna~jiK?zU`o`Hu^i-&<3
z+=|b%VqjzmW?*FTmt|nibYlQr=LJ&?-aEx0!>G+u&A^;##h3+A0*c=jW=08^t22Ya
zJ!(b?kPA++F)-vcGRlB*X8kRYQs*~}q9CQ9D9tQ{C=~^@OTpfEkYp4B$%4F}*$<Hw
z0?C2{U~MWRKS&nj|ID=zS$>f0G6p9G=FCD!go1`Q!BHv#DjqX0fLz<en8i@<1PX45
z8avpcIk1{6J!S^xjCck{mOKVVmMlF)2-#)8mX5-8@Gx3|TJ7MFYG+_%X@v%Z6R6;U
zm>zfoY(E17cw8WBLNx<(>NLjsEM^Ag)Wr;pEb|x`S*8Rb)CYlDrwr`ZU}e-a21b_i
z42&$G`8KeI2MmlXcNjpPOwEK?5ezCgLADftJehS5WONk+BP$~VBg=P?(J*zO5ibVz
zXWWdE^`NbdsUSrr42-M>Amf;RLpL=9gI7^8FfiN!8JFG0%)s>fDFY*GAOj<-w;Kao
zU5E+;1H=I!7RY{v8H$WipvC!M^(739ta%a)Otb#MRWUIzuzyozjN_?iV9o~Jls21>
zfsu7G10(B1&=SnwpW!N585lU&Kq{FTnEtRbFtRRTU}Oa?%y430OoD7EWeA0><^<2S
z<YX~3FeaHYFtXlYU}OdDB202(U}WQCU}R&HU|>vw9OMGh#Kgc*&tWIdRK&x;oWl;%
zb(DdT&6<Ic%{-TZF$o$Bp&MY{1F^u~V-aUcR0VC|fV%)Z!O9UR&Qu`6z?@?XG7DsB
zC<7x~Ac$kiz{pn0z{r*l8}<sl!oZjmz);Ve6AI}b!ul?uZx|SpV7Ig}I59BB^Fab5
z3^v2i0E&*B*USuz@d^x#Z1Wfx*`|Ovx(tkLR~Q)CPE|87##=FFurn~myE8Ddb1*Qn
zGrVU+GHD6e7Yqy%;`Pj(Ja!=EAVL8|=)$xaF)*_0fD!~_9CY=4*ae6_M)0(L?iFSR
z#yB?yM)o2GMs`r3#|1MmvM*p@WS;?&Nnl`PKgYnxevF-gF)o*Zk^L6~Bl{N+r;34*
zLzaP&LztbRo-wW!#_MHdV2m?iVBkm;XMQBkz?{3o4rBp{2nG=eAicQ^j2r<Bj2u27
z4#=P^21X9h?ohBfoeYc|&CsGb{0PX$pjniO0&JjhD$uwzOwI%<SI>+j>BPX~3!Uo<
z2S+Fa10y)F^WHKuF!}yuVC2}uz{s(JnSsfVm4T7t5d$L!=*nV0K?X)n76wL+f9woQ
zezFXVocaumoQfchCIchq90o?tK2ruJKVt?4juHmuydsc{1p_1Jb%uII&Wj+P69Xfc
z0Rtl!Y~Uc0g@MU$1|(&GhFQxP7(nO8`1vz1aI`Zp=N$uS3SeO5@?c=(ashFo7#O*_
z7#O))pxxt00|qAlMh51*jSy2{=_@h^Bn}m0sD}nfL<XvTpz+oW@V>=#CQ!H`1x+NZ
zr3r2<=f^^WhHEVYBiBl3&~Tk#VB`WFO$7=XuEz|FT=!)`K?5Q*p;kstU|`OzzXGi~
zLGiShF_V!ogBd)N=LFhG4N3UX;1f|mODjMLzaWp9fob0^21afs21c%5AkI++Ms5uT
zMsCoRx%)0MFmgLGFml_5F);1B3pD|@IYxwmIe(ul1Jk~H40>P-Am`#m!|zg!hTWxF
z!<h>zz`zzoGca;T!Ys;RVB`j^6b4(=&cMjs?15wvTsu415=QP-42<0KpivTif`Qpf
znt{0hbT$+dD2OwsmsYR~u|5HbPw%N<m#Ci#ad8Z2+dU|^%>eniP>`8{v33yyBaa>f
zBac=X17qzvsJax8A_fKq4F=|dz3dE(wVN3jc{~^xdE6NE7#M3|#w~%BVKK10Zy>gm
z7iMY#10zqI2Log60m$ql140$Z$b$@wJVgwQJfIVJoERAMk3j5>g-#AKlz`oMfti6Z
z{~7}$Pagv#PX~zen1PXJ0|O(^Dp>}`{10wOI^V#Y6Z;10ej72ydpyhxW)LGTF);F+
zff@0IfsyAOJIDwIMqVKXMqUAEc*e1S7Gp6m7w(>Zqmo^wK28O+kD8G&6TF`uRQFzo
zxHJwHnj1haEy@H{j87OCc~uw~c@;pM4-AaFE)0ykHnyN8$WTocFh|D0QoIQFdl3fa
zqG*s7kp6rIM&4`?2c*BNo`I3K4Vt*)T0rdzXxavk3xkG*<8FXNL52Fh;}A;{U`B)E
zxwwUyfpOne21ef142--BL7YbnjJ!7)7<sSeGB6&6E@DrZ0vk3=fbCA?5N0&1=agq)
zgd2PY=K2KKmF_mej0TJh%*Dwdb3vATWnkp}2;w|qVC3UtVC3U*V_;7C0(IFFxB;+x
zcU6QLEjdBnWny6DQ(|D`lLK-185sF285sG@>p?sj21Y(F21Y(NXh0-_PL=>|kOLL8
z4Dk7zgbfUg`#wNQAw<>(4f8rNFzz#kI3W={+{(bf04{_}=7XH-$iT=~z`)3t2IBZJ
zF!If3VC0();zZUnF!G&aVB|Z}&xi=CL;=v$E5|xv##nIhz>Kzl`7ROGXp#^HpYB{z
z1~Lp}%})kKzONvT9|I%500SdGXea-^NCrlJB?d-*1rG+seQ8jKg3SOejgw$!VBD9^
zz{qdNz{sx;3j-gJXQ%hpuuIoN2MiJm7#R1Lz~oy%@dipP6FJyGr9J4#5>PmlL5xp>
z)%@UD_);H`n_3tc`TZFf`CXCHMOq3hU8KQ^1rA}xAh5roM%Ab7fO#Cm0%tw}VMZTD
z2If*bn7P#qjQr(Lx1}8cxgEA3pBX$FnZalRPts`%KwWQeD^v^O+H_cwUI5B$rQ1QN
z!kU4Re*ps{|D<|(&~YVDg)3lANr#osJlvrEK6B|xn5L%;jQsauTZhvRfJa%J7#L$8
zL5#=%jii7)0Y2KXjG>x=5wu+r)HaZ2U=-kHU=&~naWohh1=JZB1?20q85raE7_u1{
zW50mgHp}inO@d9^$$(s4_Jx^&aoIZtMuAxji~>FE42;V;7#IaUGB66f&Sqd-_M4%Y
zfpNJoXqX5jC&IueD8Rrd$OYmkGB64nGcXG3LQAQPKMbIg8JNpJXFt_5mo|Wpg#r}^
znI53>ih;Ro8Yu2d8(?t{)tH$8m0k~)o`BHT0F?lr23pzy(#JWGgH7JST}56IR?%mI
zul5CN1)I!L%wVV(&H(Z?lkjwiuQOo*4^CO-OPLv%gjX^!3WhT<3i>NDFbN-q9Ka-e
zo`F%Yo`F%YI-7w>c$*l^g=at&7Xx#7)by%)b}7y`3{1jz8JNpkrq8WsSE$e80hP}n
z7fdt&xshq27-$E%8^{Ta|4JZE$N~*!f}*em6z~;V%nXeG+87uGXEHDfPF7@K{I>w?
z1jc`B7#IcjFfa;k%VuEwH<=OYgscDt=CUsg%oU(>Aebg{xPaWp2tJ$uygxl_0Rxjb
zXhND1bapX_NCy#VjF7%gkOagP+0dpf19+Km#RE46Cb-lGSTfCq%_`X_Gb%B<F)%%M
zh3ftQ>k-10=qNMRYp^miFg*`qU=+O0z$kbX#ED~I6nw$JDEJKO{OmuV9v=g9#bHoc
z$k7kV{Tv0bD9i!vlmYK-gG?WB6oLZE33PiG#Nr&3imkGknSq&AlYvq24+Ep%xB6@b
zW>#4d5Ge@jcI1Gz(PT0(S89W@v=Lmm0^*EHCs6H)5S{=P1|4h0#IXt_2|r{x2XuNL
zsAPu(B{SO+sGDG+RDT8(qg5)*49sj>85o6>85o76L7cM;j6(hlj6$yL49sjd85o5s
z7#M}hK%A!xj6&@Uj6$v149si?VMp`k+CZK06zphF7!@<ZoSq9hCJN-Ezn~B-W`q?M
zxf%7Kk_lRj<-!kC18+tG-Sg|jz{KASadIy7Br=8{U>7f9W?<r<%D^Zzi-A#SiXsCO
z|9Ym093XlR(?ksreUfRS2|EK5|1}0iq5TYuLOZh=nD`gLq75``ne(4<`t~Mv#d>H%
zEgw4f!w631HKNQ6jNf-NFbX|jU=+Fm;v8pS6y{@K6b7C3^8GRcqp%|bqp&$U1LODm
z42;6142;70AkJ$BM&YRpjKZK3SH6E|U=-fMz$m;%k%93CGuVxcKX{oZo?wC|uly@6
zpe)G1Tx|so9q?vk#Db0j76!&2`V7p~&~v&$AzKdL9af+K$=%h}(`PrcOV$^dfX2EQ
zn5!p)%z~dH$WRafH3iz!Kr^KS>VoqiU7&QF0oo1?bzs2~sNT0Q*-R$H-q8YZ`NGJU
z#a_%%I^DR1T_Pz25@Y4Cra=NI#%e(43%p8XU=;qsz$pBVnStq5E(4>87z3k-0EpAd
zz$jwMz$jwK&cO6)0t2H+00X0lPc{S7t4dfhDz{)@dK1sUT+=muZ40}2eFOv3C&a<$
zEE7SqiwsT-Og{1u2UNjUc!HahwSmkGOg{Pyj3W6Aj3S^T5`5el7)81n7)9FI8JK*6
z85l*DFffWN0CD0O7)5q5FpBH|aVi)XMNTp>iX6{oVDhnsxu&Xq0|S#!D+6<_5~%nD
z4J|?gteOEb>sbqq&{9T*T8Mk9!OLVI$IU>R4@^cz5UHimLY^@L6jt@mm>HOi92giy
z?l3TlTmx}@85l+WGcbz$WM^P9ieg|CRbi-S6qQkAU@}T)ng}{g)2Nt%Q8bu=Q8X}&
zfyt-=YA&o@D8s;9dmf~>m4Q(-m4Q(-nL(ZbZv8R_SosNJfeJ7N5kBS}j10_mpkus2
zP7y6-U=%HeIz_adfl;)+RTktH5RncdiaikaB8&mav_f<EG7$#mz&W6m1<-rp6F`|-
zf`Q2hdiue#7YrN>417=dm~XK%FxP?hXc}!}U=*Fkz$iKeWcOhPM$runjH2rl8JOyg
zE-+1mt<GEqK8+icK*3w~LG?!l=nyv04qq;45wc7Nv~Yy)J0J5ERtDz!W1s`d=Q1#g
z9${b<1s!<7wTgjJ^dSSI=v|P^1O`SiCI&`P(0~Egb_PZ<eFjD`)m+$V<sTR#mg&IG
z<XNTz4l@P@4t`b{Sdq9a0&-e;y$z^HG=Zg?WhJ1k1PsjeAt2Wx7GEu!13I9bfw{hE
z`t){oRoNX-WwW5lU}5+Gq-^@lc6Rmp8=%Y&lAdS<F7`nqC>%!Ms{5}4BmpdkWx_w8
zgw=3>nSt?d5CfxFJp-dyr6L34-yEii3hWGwe=8Xn#a1vdip>EDwlPiQ$Yx;t8xO0(
zmzyv!{@caC+yFiVW}*VP1h@R~fnj+KC`zFTfB6JRMc+^gb`-p#he@9S)$<I@4NIo)
z=wMf?{{zyBlo}Efz)p`8ggAXQY{qX1$mxyM%nXc?atw@Ow-^}3K;v4G+6;_he;F9X
ze!4L*!Zj^`rR3G15lB$96o|7lfJ$tTW^qXdMsZNV9;wYx&nRxlz$gwo;cN8{2F8?o
zP^Yeb0dgAyb0es!3fs<_4DTAP;Q>h_IXxLv$vZJH?u7PT)__Nb85r2W>n1v`$}%wS
zbN~^)AR<Bnq!QYXUy}oJBtMrhQyv=wbH{N-kW%J}6ByYU7<c+IFpB#zFp7JCL?f6c
za!4>R?t<>oT9X6nHt`z@GnKP4Ft<EYWMJGS%RI3Iq;Z!P1EY8j1EY8rNYors?d)=4
zo;VFG8_2*Y-X6xlC|=3Vz_=@hfl>Sv1EcsJQwGLenG6j4ehkb_7eN~HK<<DB$+|V5
z9uNa_QywUCK?e_JGS$E<qIDM-m;-7Vn49KL-`K@2QGWw;kQSmATla&3ad#{Oa}&4?
z1*&17M_@CR!MiEz1sE9jl`()EQNzH%pTNM}+yQb#Es`VF8$cY<%mQ}=qZuq`t&f4Y
zp;@1?o-vCFVhi~ARd@`(fU9kQIH(ys&I3`3<dhj8r$BSuda&0(_Cb`Pn3%%A$e0FR
zGXxE$H60*>6B(GBw;`vG0#F9E12wG;7#Y(U;mx--8$ik#n43ZECb%;}NAWUMFu|1@
z!koS421I!a&vcC*b~(;342=7X8JJu2r~CJ?OV+OyU|{n0Vqk9ZfjgJc0H$}X1ynC6
zcfzgO0CJcu$R-Q8!W5`N(7{Y_g(qMNS&A8rRp4qHpe_KNUtAALU!bN1_|zUoBUoc=
z?E#P?P%Sxe8Y5Vq5oDne11Pe0rZO<_H!(1`nt;-H8q-7$Xh^OHdG0s^b1V3?TS(Y*
zIKa%@AOUhD$eR-dK;<6jsCCepX1jVIrN=rIP+`wMMVP6Tm4UhKHz*~|g5{3o42%+t
z42<Ica~YVP+Cnwtz<TEEz&VnEfq_Su@xOpPV#Ik}16&ELY?2UWV&-IEZv71!Vy*wl
zz$hWWz$n279b=VHVPKR{0&xTx7$wXY7$r<V!>h6&0yf6FZVCf)?iJ7g3zq|^?FSlQ
z31eW~wFTm=4bYMVblON;2*?*(A)T#VhZq<o+!z=oT%h5#!K5CNIogoUD)IoA)E_=D
zYzP4P0~T%TOdxHSwqm428vg+<9RrFm2Ie-<@HQyWz|L!62E`h@BHK{G!1O$ufw^r1
zC>A)P8DKZaY?uI*053%4h=G~9VFgtD0a!yUJSrc6oCZoB4n8U%D-6L0;&>@SLSSPL
zxPV+H%rudcfw{wgnSsemkAYDllz~wq7{sw+V3f#XV3f$IXJ=sY0tHDc1EWN<Ed!HR
z0@R2Vu!!3TZD=vHNKa;EVD69s8Ia4sC^40RQDQQP1Jb*Wfl*=&h*QbHD6yY`Q37-h
zlGj8AMv3zbj1p(18JK(_ho3WSk^vXOyQJG$8JI2G_k)tbCI&`{dkl;ccVHghxCOGG
zryX=S0u#pqxHz~1XJBssJzZ)7yEN+;24?p=)2$}3%YfGF$E88q4KUT~cp#C|5d;c8
zZ~@Hd2?{PmjQoJaYDXbbtfol74A`gxH2~Z>0B0yh6OaM$(r9A<)PVZcAUhE2iZ|wf
zB#=#YfS22A5*QeFmVz4IZZ{#py$L!?%Lv{*+||y^z~uIdfl=Zs1Ea)iW(FpACI&`H
zeFjEJWe|stfl)G>fl)G<oq@?+ih)sbE(2q|WIu?f!oVnblYvq4GKgcqz$hicz$hhj
zh>?NG?HeP5Edw)bpT#ElkQs;tN-qoyeD3@V%$?xHX1^F1r8F2ArPLUt8JH8GdoDKZ
z0Bw5UKgH*+$H3gV2(&2e4g;f<1p}j$8T^Q^O-mS<JFYS?cU}Mm2zWjKRwAZUxPaV&
ze4yo~JCGWvi*>rkBzAc(=7}8e5uwd2P&rGGN#M|DEoCTXkYQxZfEzghRBa-<ZJVJr
zT371ynn~=E^&PM*v$+Fg7|b9f{h$^UlY<T<9=1XPf`Oq2)Pm|>#LU3tV8_5H<-@=z
z<p$z-GcZc!GcZbJDl#xRfKK1aW?*uN0QC&qpsNSA%D{$Aw#tAmQ3074z{i-w%D~*+
z3yN1a21cm~42)8JAWjwoqtqe>MyUlLjuiu=)D{LtsSO}b5Cfys1qMc`Q+5nYZlH78
z+{zdjrQR_xO1*&=Ut298A>Ew=^HwH2SQbF$oa(a>Ar7sax28Y>0ucl|7#YDMM=%8?
z3`|Z7AVz`$hnWp}AnZX{`)~><aC+Q8V;j>M7^N8*7^QwoGcYImK?3pM8_>ajf{ZG*
zto01cJ)kuNiO~#<(n<`B(x8cn#B>HmX%hxUX(PxrL5$K~42;t7W04LXVPLK-W?=5o
z0@a@eE}%gZMk`o69()0k1yzZ~paP!lAfpw?k&KgPLo9y*9<^p*;Q0V@Wc{25Sq8?*
zD<l}0o_~TX;ACKs+$6&CkCTD9XB#vyU(5kbk}xp$fU0m72X7U5h#fF{Uw}@30iP=c
z>WBt0AS?v+$QUF~im-eGwG=0>U|^I6c`#mrfpJkHbPd6a1E4}r%0Yw`bii;gXwr8P
z9|NQG1O`Uw9z_PmMbd~`{KXYWlcZM<sq{$I00#!FV0!U~fpL*019PwU^unp^BK225
zT#$o7mAV82<FamuXJ2Z7?F|xP1s#spr!LFDxNK$+1LJb&DWoqoKv5-?BEnR`%FMvH
z+>U`!8svc`AdWYTBhSFN96C$$G5}UDyo8P4JBTpVTMIBS_kIRx0(t!q1EVyk-?Y4h
zfl(UF0iBe+!UN)_R}Vn#45=~^CR+h!2F4X(42;s37#O85fH=u84g;u0W1IzTxxa+y
z=@4NR;ACK)*2&DkI7^X%QThb~qx1vNg!?Q#2GH6YMj0M<2F6*|42&|C42&}RVGNA3
zpw_;G9rDM+z}z<hq{^3pQ6`OnQ6>e{sG7B&fkEm419RVMkkl3iMwxmBMwx1`R5SyF
z)F%e!Nt__51O`T#84QdvQ$U<t21c1(42<<M>*N{WTijmrz{2P?XyqBG0ALYeKBvyW
z+|LeLFe|~pDD#SeQRW3`ynR*$1B0|U$gD~RMwwp>j50q!oHhnVSxyE<S<pcLtjP?F
zvJwo8vSJ{a1q_U`>I{sssuB#03r!$FTK_r#R5D9Di7?;hWni9oi<yCOp%Vk6tOWz3
ztO<zY&%h`f%)lt?58}iyFv{jJFv^0KH!RF#V3Y+}&<~O+V_=ls!N4fHg`I(MVKW1x
z>|F*%*_$BF1O`UgpA3w$pFy0t42*J842*Ih2Q6I1z*sM5#lR?M0Fv6yz$jPDz$ljv
z;v8XMl-tO_D7PHMxyZmM_l$v2?tugY<L1{8hrbSBU}a#CP8VSo;Adc-(7?>VxcLtQ
zqr4;oqdch7xrKv)QQnw=QC?q`fpLq79zy4vBd~7kn<KDdRzSpuhnay9tjU{!Q66+U
zG}yRk21fZvc901SjPh9wjPe-_3}Fn63-3W)0UPsaVPFOgfif<<&%h|(z`!V92Xgou
z21faQ21fZ_Xi@R{3j_E#w+R<Pg(T>V=lV>hG8S0gd?UiZ^kq2%^MtQ3X^<?a#m)I2
zt_FG{+(gjfa^Pd4L26)S%^M$(3Fx|;;8!Ctye@#aU?R9-Q^`;d%KC^(@bwIkeg@`=
zpvf7S>7bS}Gxra8|MT?@s2Si32|>Qd1a&Q8e!KxSVkeR_Kt?b%!Ta=YbwFxB^3(s!
zWS3xFz`!`ieY)f<cD4Ge3=Gnsp7N|~42<&27#QV2XWh?w$iOHM61V_L$L|;z6<8P;
z<w1*QX8mShRPbV8RB&QvV4Tgtz^G8nz^DKk8lEl6z^KsAz^Kp(l2Kw{RM^VEsIV3(
zx4kWaB?J%)l-U><>P478YB4ZR0yR+*B^VeLzB4c?d<Cs-ntdG-<!`~K#7eIfVg4h}
zz&tsGnSpWkO9n<oP6kFrP)RuZ8v~=FG6SQcJUav99A*YaMQa8|MN3l##yJ8E4AO@f
zm?v9-WCR%)6}=c36+J*4IR-|>NCrm5@OltWn}JcWh=EbD0K~CiU{svIz^K><tz_Tc
z0FBIoqOF_>9-!}f7?@t#GBRd@PSwr;4H<)qpV|5h4APevn5PATg1~@*QE?*!qvB!^
z$CiOniGzVr@f(Qa#lWZ(&cLV?2r3U}gILuJj7p^-sT2lArE?67N@qZvLIy^qy9|s<
zw<Q=DXU~NM$2;&P12POEEDS;n%u_&z9M4|Qz^L?&fl=udC~WpHFe-C0Fe<ZxOgPEF
zsI0`msH^}@Ebm+xm_CFtFi+tJd8mwmv7Rx5iQ_*kIlqem9Zw9A0(W3%*D)~2h%zuw
z`2#Yoo`F%>n1NAQAH?ZlU{v;JU{v;m8GQqiN~eJ4WS~j8jsupB-a&KX6!2lukThJ!
z1MgP7SAc2;?*N2K3&1pgxB`_0kFY>xMc}d@pt9gqYfxDUn3q2CfMh{QA1WgQuC5lW
zg#>5)d+<?$GFl=mrV<RyQ@`6WFfQ27%)q$d6a%Aj9s{Ft4v2G|fl;}Efl;}Joq=(|
z69z`*xeScT(?Oh%42;S<7#Nkeg)uNLfUYq72pTa1rEeAn=BeeNf{B@dQTaFnqw-Nu
zGFd3dz#!wmz&v#lDE=3UF)%9MWMEXj3iHr=sCTD=CcKyshf2Ty1Ion=%u`Q+Vu%CO
zon#UG@ZTAx?}G@)s|?IjA3@|{LGZx@qz@_vQ~W-FfpLKpgBJ5N&@q)96Ajo*R7x3?
zU|s6>84Qf`)1X=4LjkzFNSw#6RX+!m@EMq=fjZZaSY~tp^|Rpfa&NaVFfJ{E1URH=
zF!=-|tY1lhst}m~5mpga2IiR&%nXc^uQ4zxe_~)%1}(6e{Fs4Jg_nU*g;RooaVGS{
z-&Yb0><kPt<svNmIT@Iz*MsVsna>#*Rg@VRRTSA77-xQAU{o<;U{nEBYO@#_7*!k@
z7**_{PJg8U@(0K@pvIsn1LNcm3=A^u49qjR6d4#Ne`T5|p~%2Eg$Xk5FomCiQ6+$Z
zQ3bS$Zi);$1LG7;21b=621b=Q5XX$6o>8Tafl;MOo`E^Y8R{+ghV56d4ch`DEN6Kc
zn5VyHW?&8qVqjF6!N908O`d@{4RQq!!z=iK-EciDOpKMR49wH-u4iOmPP+v+n+?ta
zrKoxa1{Q7$7FaaBI>5k~{s$JPuSysg=e}oPp1}$BumC8^C&IhPuX>=epc@I8ia`fF
zFv0JgVtBQH0emCh412I%c;)l41QdV_%rnA4;uGuP#(nI8N`N=HBMkbu0GzOxXMl4$
z!upRppyKmE1|g}x0ck|f0PX6A^@`FeKyI&u_rpKFVPH<*#0ouH|5E}3<CG8v<{9rn
zMuEGVOcUWb{!;}=79j&_XooQ{PH}+*B<TEJP)IVUFfh+_mStd^;tEYGpXQ)y1TA`m
zO1%mIg$^TQRz2t>N>KH*5_%Nxrz4<tyUa`xR?tbLvwpKPFs>A0U{u+_z^Jmyl!0-j
zJOhKwZU*L=vq3T{42&x085mX0f{h4;xae~NsF^KuPK0p{Cj;}W>&y&{E0Y-*RbDVK
zsyqSdDqvt#<zQe`WdfBKD{C1TRW%tHRYA?lPbZ;9fGbIv4<d|nSs9pTnKCmle!9uP
zsOrqXs0vyQ{OKbDqiQw-qiQ-x<|zZCYBvL;YCClD?u!RJv_O;T&;tE)0jM%yV4f8W
zl7&p|apc%CR6?y>z`#5!9VCUA=lQ$?QoYP-1&Kqo*uawKmjnjp8c_!3S>Qo6uq=3t
zhM9|z*#$Hi$_Ot+zI1?;PJh3MU9`Ru<R%XW#+A_d#4oU^PtcM0E6o`gRaY`FsxAc=
z>notEt3SN}wX$W|L|8%Rx6T1I09G7iU{pQ9z^Hn_l!0-@IR*w<SqA3WcI*s{D=srI
zs=i@hRDA`SQS%gq`0vXcuo1fTB8*#k8JK5pV`gCTRApdPV`X4eV`OJw@-$>%RFh_4
zRFgDiVDhwOV32iZV4l4QBxA?GsHVlhsHOo;K3^Vyf)bRZIqcwVh%Y;!4GYk6rZ5J^
z6%U~n!`3yjFfh-)%U;jGxZ)WDqnZN)qZ&LYKl3m!e)`A2JR96{Ma-FhHUNbi1M?gS
zP}>AN0A`F9w4XyjN+50lHFc{PU<zP`%1Z?X#?N1&so<q7bbxOTco7ETh~t;w0lw+;
zmat3ILoPsK_zD}(4FUD&=dyqn!ll21`06XTe=8d)&dAN_#=w{k(-Ht{6MlvDQWeA*
zIe4MAe~kf6MlmqY0r?YNI81=K^lJgQ_^SskX-u9BwWtA{yBQe3$0p8IuV!FOUdosS
zR+0r(0$Xhp0CuMrNJ$M;33NZ(H_%QIkU<brazRSeAWF<uK}`7%-Jig;q8?<-{8nZL
zMzcK(jB4==jB4Q^&PfJFwGIYGwI+53Mzd=SjB1-17}Y>MEVG9UjA~yQ7}cJG_M=;Z
z&0}PU0hJ_j$Hck5^D;2cd(F<k80pQxsBXl-sII5Tz!(|9G?7D|fiW2}sL#mA0PVbj
zj^+V56|@XjoTZ$Pfq7mqGXrC?KLew>7Xza@sKuKc!@#H>$-t-{4hdOCMji&ngiQ?0
z^ISn$wE|YsGBT<#FeYa~vn(S+0cbY>1M@ua<(-J@VHtWD7=`T_nCF342h~I7rC~EU
zjEoKpjM2v#nCF38bLf%<kSLvZ7irKW4Lk$mf;3!MX~4*s&dkM91&wP)#uji~L!HkM
z0x@MiGq_NO&&Dw_UIFd!XJDQWzGwlSGZ-0PK*fzg{^fwo@_zWh$ix5=hnmV{0^%?*
z&j&9^L1<?3fQp09|K?DDwyYSLVnE{H89C6s9Zn34{~!bVjBK#<^9GbQ7EAywD>G(b
zR4-y+R0pjc{pY~IsJ@ngQGF?Bjad|=`SCA}fl>WB1EczR&>AyeMtRsN>mL}|p1>lT
z4b}w~;b&*#Wnf+)&m6?SG<_KZqxw$<M)mKIB8QRf1N6joW-j&%u-crF%>y!vy}%9>
z3KP+0u^HJmFffTfVqjj7JiT!RyG;EZNFXn0LW-)42w04;voJ8G*D#!AWME(`V_;y*
z*$6sib1egd@>&ope;Wfs{x*=T)E))~sZEO*+2*l;Zlhns$T^R_NH;Y(qnKe4qrg1A
zjQrvf-Qv=Mf}G6M6b6u9n*;_1n*_#1(`8q(8`jsdGccTaA<N9bEauL@z;=Lvfh`P@
zXL4W*FyAmRDn&AKure?(b~19XGcc@P&&UFzwm<}17(qu(ojJn6!kU>^!obML!N8DW
z&&bHez>wkrp&S{RSQ!}Fw=goXGcZIIFf%Zmt!?IKU|@(21F>sb#27$_@iH)+UD6H`
zHf9uHWneh7no$7cylO@k76yhhcNsaD85qu7W#j<yPBIFBw6-uRfCTq&GBBJe;$UK8
z=3-!A_{+t>pj|RuV->rN@)jm0kV1yPpmQf=K?jkpWn>ZnZDEHT^v;+gF}-~iy9%3z
zBm<*{==6=N*p=%wbQl;lv_J>vK4*!KFK1v95o2Irlm!bgF)*B&&cFaV+C{^Pfl<Q*
zBrpdm(80i{(F77$2ocb<V_?)Y0||hZwsbQvYIZR&YIcAGCP7t9XJFKv2oiV<71+v9
z&#1W`B+?5Nxx>Jyc?~20DqKN^{9<6#`~oSL*t-~5K_M;(I>YVkR%|hu3qAUS?E(X%
zvOfzXCRrdc$pVQ<h+qo~Bqr+xAyLT!GC0Ma1rn7I%8>;Ul`N2`WQRv(7>EgtNe~kn
zlOX2e4p97Bu|Oh~1rn(&kVs{LL@Em;QdvN8bym8C1rn=5NU_SuAq<YyoHgt=_0U*l
z<PZlPMkfKv4UDYd^CuTVQZK^KjB^+mShn)!F@TOvT*$zvWyZj$rNo=UAkV<S0OI#E
zFlu#6f)v5EGBGgdi88W^aB(s)upDP#)Y`<rs5KA7InThTEyz&MsLc-IU1wm_c4J`F
zwqs>rV0i!{UV{kGk+`6(dD=A$jM{0Si^+Hx7`5LqFlt``al{!Ib!Ia#>ePZbN(_v;
zS`3W3EFg|91EcN(21ea`AdUqCqwY5bM%@=6jxz(Jo-G5To+XImr_R8r7skM-=Lh0N
zFfi&>Gcf9vvNABRCUY?`u;xKMVlw^gT6U>=I|c@(Ga!|%42*iy85s5YL7a&UjCzL{
z81?pmICB{o^`0;=>fHiyRx&W^i!d<i^ME*885s5L85s3VL7amOjQT|kjQSZM&RGUV
z{VfcP`YRYfc0zhpjCruVkPZwCOrXGEz0U<&oW<tGz@X<hy<i=?sE7Vr21fmdprS3G
zfzd#Pfzdz)#HnUrH1K6$G;jrR+8G!PiWnFTvOt{442%W~85j+wgKT130P$Uc$n>-8
z*rn<-7#NtrzWd0)XmE~!(cl=!aeo;Y4L&n48oUPS=VV|slwn{r1SJqQQ3ggsKL$oa
z7m$o11EXOZ1EXODh@;EEXn2f)(Qp@tW68j11k(4PfscWKZ4(27-b9e_W(GzhCk93%
zI}m3d1EW!WC<CKWAO`~j+eronJy2SU07;!=U^L2NU^Gerac(g%8nrVp8a0DB&lnhu
z7BMgyfo^?d`^3O#bcun{=oCoi9|NP&Zw5xA&x{NV>|6|t#%c_V#u6Zo7z3kmIs>C|
zJjgNZ$_xy82SCCq42;Hs?F@{@tstHO1EcXo21a90?6TW1FdENgU^JcylJQ_*G~U3#
zXuO7%fq^{)L?nQOa~K$n4>K?t?+1y1m-b6BFr15@ZnlAaZ~bHzDHd??!^XhCdW(sH
z;p{vXHLwVXJrjw&0g1gD!9G`r#Lj`Tnd9Sg8K7*?qzmgCkZF@yjKC&?MA+OwBJ*rm
zyg{W_H;6M6iM;`dy&AzjSBS*UnI6BBUBYPrNbfwB0I<;@_Dm%91|;@s1p8be5<6!)
z$0l}JuE{LLU?Uj#r$5-qF6E>QGHV{o93=N4*c*_<S0mWx3X#}3)4MmZONLHonF}-G
z%p4^4LL~MwB=#gE_G2V=FB1F0^q-s9W$I1%85pqF1;x<($>zYosJR|e?02%@sS5<i
zs0z}kSQo&m0zs6jKnPqF{Mw9M6@aQ}4RLVehLsIe!9%M8gqOip!42M0SXE&BhJn%e
z0dE<sDgZ4dGLe-iXJBOI;D*!=CPoa5CI+C|;RdAGDZT;fyXrk;WaR?a4)w1X7){(5
z7)`7|6~ZS5Mw4m=MibE4vn;<D7)^Q@7)`oB1v4{<-~$nopz=wDfzf0Q1EUG36kye7
zU^Hc8U^D^O8&(XArWFi~rl2g!>dL@q`jLUr6x7sX4Pan2Tgbp@HXCF>Gy|jAGX_R8
zE6|bXtZ594W?vZ?&EA8g3K<y9#TXdP`9Pd%21fHR21avG6~)>HI&*p=#3Lmv)AP2n
z%hkiSV5%@MFr5bJSi!((zKVg-d<BTJg@Mt0GXtafMv%)7fCz9|dxL?|d@lo|`EHQN
z6A<wMTsCJiFzB-~Fff~d%CkHMM)TtgjOIr{oGJ!J^Q#Pu=9fX7HU>uXrwokdj~N*p
z7}zE;Fq*$-U^EAv?g!fQY{AIDX#O3fZWRNgg)Rf5g(`@%je*f3h=I|<3tXQZhWMh?
zWxDq^c3Gy<3)8c<u}jsfFfcIR2B{WdV6-S<V6-RzaTFLBEqWOkEkNZYn+^k`#U=(u
zi!~q_3kF7u>kNz*=Rq7721ZL(21bkDAWi@SqooN0qoo#z6T`r0nZUqk8NndMz`zC>
zKV>Yx18IUWfyS8Ft}!rLE~#f=w44Xh@Q{JgavuYu<t{D;2DUd04EoLt3@o6%32Yx3
z7%eX|Fj|75l<hAAqva<CM$0##@|cr>(MpPe(F)W$Wfx^&wDMwLv~mK;C^9fwl`=3|
zWrH}n42)LW85phBf;g58j8<<L7_A;LNHZ|7yQMNP=$C=S-5D6I%^4W2LDe>UFax8t
zBLkzgJxC^=fzjHRfzjF%#K~r0v<3;pf~tUWkVrEFqje?&qjfrn)6c+YUCF>`T@I3-
z4f3rFxQ2MX9leJ53n>(-Uqi6*gG@%LAu>TCl-Cflwv<&4J9o0nGESa;eJ8tyEoIe#
z%`Tc%2dj3m%hcazWMI^Tto&eH9&m<*f#F;k1H-v>3=9kw4WN=z71D<g`OL_`sDBBP
zvsNzXz^PD_osogjU@=5tmBbMyTqcTw*2Op*Izm*g-tdDBr%HWB21cU-h{EcG6-uZI
zr_aB@F1mg0ZuSgDX%B{4#(H4}1_@b4L*XFC9ZsyF;t|}Dtl`{@+ZFb*hcP+pG1^Nq
z^I36Qb6aw&ODb?P3NtX+=rJOMJcU6*wr~Rk8HLy*xFfm4!Ak8|84S1Y+|SO#=*i6(
zDh^WW$IAfL&1%W*DQv;Yz~GN8z{{P@&A<@A%fQS5u@s^v(1d}R&r{e$l7S&;y5R+O
z;q8hC*_|29Sdr8*NiZ;^qq-O57zc?eNszr6Fe8{Gw$D1mzMoM|5AG0kNl#$~MMegO
z4o0XT*t?*Ua5|??Ji;#Q+r=o%$jryhYQ=5MYN^NpGO(MGg^`)hPLZ8kk;PLO;#!b+
z52GFfG|*T<fyThl%Lob{c+d(@zkh`NTRkX17#QXuR734l;AUW$&&UPw8LK78SqmUs
z#g7c2cwk^y$f(B%4Io8fh~t?-Rxe^SV*mxiVn%QPDxP2fxt7yY7!s^Y7=;<RxxrrG
zW@Hg&U|2dm;2688#4<)u*g$;XDQqv<!N?6VW%=~lW9$-^D?o<vSt;HF8z$^2+`*{G
z0gAYlPzgS3a9lDltYTzjgh+!NvwHfuW9(vPYaoUzN`jms2bNX<nZB0MgRz#enNfm)
zVI5S77)S|+r?8A7!*-?P?2IgO;OK;=1a--FMoHuteKtMtG`np5bC7P38n7#5xEUB;
zFp4s$OENIL1o;;dW#H8K3ZxR0m?0{885mwOf^7hafkVHY5t_!|fRus^<pw2FkfCo8
zO2N?zQ!2*r4i+0=aY%-Ezn%FE`vaEgk1nw1GKx$OxX8Y&z6Uxdzzf+u&NvIYot6P|
zR5s%*Xp52|1d?}WLw9{LLWX-8=fD~m91!_A(7|Xf$ldUa%V7GU^2=aLlpwP}(u~WX
zgTV}t<ywr(VFOb-69a{1br_f!m=_)fwWOiL-HeEltBEiLi~k@iKnxDR6|C+;R)A<S
z!WC?`Mpm#K>Io(vgn|@g1uLP;1erJx3VM+hR6%{g=z>tN4Oziz=!_?G#l%2iQLr~R
z-$zzZov@wb3cETBcYJ(GW^s0WaY<>?cD)<yJiPo#l_jag@kOb*iJ5tsdFk6-pR!A7
zawnG-6{Y5t#OEX>Zja;R(B+XV$jpsTE+~yJE=ep&jZaQvD9A4^i7!h}oPJn}LudMW
zDGt%?f2BCecsWvv@(bcK3KF*$X>bT~b7mywrR1c>8>DV;GUn)H5dupWBo<{BC&#Cx
zmSrZVZs)S#s9~Kxqms!^Uc=olRKY1Tue2mHr&v?LNYBJn&(uKA$iT?d(7@Pmd#f$S
zVjf1*?Xq4R+WcHF$0w$2Pl)80&&W|woSIycUsSyPUlhkYj_sS0IhHd+y;zcw3G!!R
z%J#%`j^C`)>)N;^wnyi3tYX?8UckZ4wLPzjqlg>s^Q6+W>5PdSird;aCUHTHC`v6X
zO)V}-P1!zi0>=r~?dj7v_VY}iyqH6rD+jWLm@$`Q`h>+CQe3&vBwBm}!Y_vQ392MO
zd}&UoatK$7Yk2@9#jjj|ReB|KAY=6g6zS?15Lb$;ItHQ}#$UYw!e4IymglR6EK+Ce
znZUrP!Mc6R5{_mr=OsLhpj`+McQP0*;bAhE&%nR{<6l6PzQDs|2$BXh?4Wbu1`DQF
zt>;jvf5F1Q!kELt!ommLb9XC)t%5;mJ_7?2)G&iL3@CQ7aG-O;K;|+*4K|b@Xd-Bg
z2IP7MCN`)Yh6d9WH*komWw0r?G%z7qZfF9w95hh_yOs6ljp;EPIFuQ0OmEo0p;-T)
z#e{7E1EYu~0|OJx|NjLvU}7u;#6aPOtOgWN+(>$06K1dGGw@&&u3yN&#>4<~+kXod
zh89Ms-7G5@H^A7SRU4pCf-B5mVK70M&0^xhn8V@|!kEKS(ZGlh2Mv@UYYBl%Erco*
z|NsBP2c}mGL051xAly+hecMJ3CB~BJH#c&an0LUfdM(Jn3ik$*urLD?J3H8ca5H}0
znC`NPBcAck^d*}(3KagZFet!mf341<puw2Iq7i`*nQpR~BZld>%JfN_IXq1kurOpW
zrm#F<eZk7#&tR+qO<X5Dl;*R%U_HUcm;!Y$+`8Xirt@#%@MQYKFg<Duhg|Y+2^PkD
zM3nwfh+#}-fXCDy1%%Z|UP2ZIohS!QUVjWC7*nCXgIoB=VfyVY9Ew&B9*ijrjIcoY
zdx3?sfq}C@isQc&D9b=i`1{75F&XM)XhQ!tXS&%|4r9hS)3dg6$i^mMN%mDJ8R=IF
zI4#5S)vqfopo|3P-e6!%fZ70aD%7SfkLgdga@Z<*un2Lnu}oos+|=p7p`aqKIG=$T
z=JYO)=}y}?tm_?eK#3Y&7<4;CgPaai)r~35*}}kKpu%CGhUDSy9DT-oM6h&k@If^c
zgYOM9r5?qY4c=_c45(oVG7DTBLBqEDhB7E1U=HkwiHD`C(~w1A&|v6^VPQ~U%w$oB
zhm}>QU8b-Y${@MACnkZh9&}wC)aag^0LEZMx!98t%$N@gTu^5o%!U}x=-a}=Ai|i#
z;t|c5!?J++G&5rk%N3409E>?EXXO6KF&WHfd7$2+!5GRiMdOSnV<^i8tt(oLp`Zz8
zXclFR<X~aYp8jh)hZN}IQkZD=3>JnE#weD88pbFFMx>&QF}s3=L5DGvMW=)@m}LUv
z97ZI^G6r<$gM$U^MwnT?UsxEXFfqond|^Jq${5OWg!MTqV-Cv!_7m)k@eq|@vL5Ow
z?;9)(2bdWnS*|cY;bx3vY2Z0y#2Cr)!03W8V<bz9$r}^KNO&wWraW<A3}pbh5UM@Z
zhlSw=52!qoxx~P-fOiisl#N5tbC{xf21c3Z4B#L}GAf2Kl4Szp4@SmFup?nvkumcD
z3j+_R>|4Re7|ybXaSan=I4E2h;VQCySQt1!QNR(w7|ybQ5u^}oJk0b07KSZ6jG-)l
zcxLc2hJr5Cfa}dlU}2DFF8#pBVl$f&M1zcm1t?VV3smw8BWTnQP4Wj+@&_Z>Lm;<9
ztwlIX9h7Jo*Dx~Xuxw%6!x+Mt0}3KWMwn3`l@W{)EDIR7FfvAf)i77o%m*6?H7s=s
zC;>*Ycx(U#5HqAKKm<YRl<B3%IINgbr%c~?jKiTmbqWV8pB(rA@)DBLB`gdU2uYR&
zj2qyU%7G6oSD06@AY>8IpFV+yr<?(Dq(4Wx45(;<2V(jh76ulkehn5D9_D_H`3y|c
z3yyPeF{K}vUUQs7k}2cJ^y$Yr6qwR&rtdt?VOgIUV8B!liXccvWK27uz{ACS09JN^
zjAmqn`a9zY3xfm~w1&7PFrP)o1Bu7L#DJ=jF_T5d19ZGGlK2%C22ehgv0%&rSD8tm
zz(X>g2jN{79s$N276Az)5giW%hk==e1r}$Spkq{-dNf!VIGB4hP~s|3VETa_9OCtX
zA_|P5pw*S|x|cCpfrY_>7wVn;AJ{Bp=CfEhFov>RV41+l7z!_q7~@>NFoG^VKxmDv
zf#d@T14hv1ZD`oV7I4c$jl20^3JZsV3WtIkM}!=+{eLk~<$tX}X+FrMFlWa#Ot(J7
zAypsOz{0@Jn9RZ+AyUs^q*BkIWCE*)F9#^iXNkz+g^L%0Ybqp{tYKjgXG~>rfK{B(
zz>HnP!r;Le&f*aPE}LL3JY#`W#W2QwhyZ0lSPcZ`g9<08>bMUcpzO^E<;Hu2fJ#wh
zZa8u#j9&vvd8Hhnlvm0DD(vBjGN=JmBjm6sv@i?S|Cg_4sAn+H)nH&06Sh&CKV5Do
zhiLr=76yC9WR@9>=RsMsfoTF0V-Cv%rUgu}D4!a@vViFVJU>j0U}<5$!w#1PRVECe
zrX>?AB7X%PVPQ~V%x5X+1{u1AX%7=)KFblNGfa%hEN7VhAPh_3XW78s0nevX6Q&>B
z$ssEF1QgA2EIbY>bqqqv4KTpiJpKJn4)OXqjEr$CElfK=PTj$D2VtBC%LMip2)B8F
zN)J$J4Z;izj7%T^u3(_C74!rYbO!TTSSnbX7>rftgBp$OAeJ)Ye3k~r9!B=23S(6e
zr-yM4BdC0x!}z71k+l)5_zU9?M%Km(kiH(KIZR+_rZr4VhVxn0FzsPtGMdk_hv^Or
zlkt48yO@kYSp*uZK^+3nOw71l0VK`<Dh*&sG+2d&frYyldhxfiz<d@KZtkuENW-Qc
z#Gk-8hlMeT<pSFZcF?^r5ZxeuB4Q!9fQ3PTF^)yRpD~{$CWWn^p@~6hK1)gtdk+H}
zn3+?<n9ovkfmyJep^-t!LIxzNEYJBsYCcN~+Z{GcVFo5f1_oH&8EV49zytHd28Q`8
z2bg9sBk@5c4Z<}b)htM|EG#^XDPS#(DGbc0>UbEFAu^yAEd#h#fyNlf6eAW;NV9+{
z!~;w>K#8D%xrdoChXJ&707)GW3wH|##8uP3@8(cU25E-r&1X5lbOMwt&wz}`XSu=j
z0%Xz)rWZ`?{S1aGhKlo9UNC)NV()=+J}@<aT0CH@@>zPAXMk)3t?UAg8$)dk>zQ7?
zhr_TQ*`idI157Q<jHwVUsqiK`W2i$0Qg9%Oz0e$WP}#xAz{CVg4xv{-F`2`1f$0gz
zkx!W3FtPNksE6crcy14U!NSnP$Qa8~e}k!kl`)p(3fl*E##pqj6(d9$C<t#beF25Q
zAEpm1jQJ4Nh}Iv}OW_VI3>u6PEE+n3%?w5=%?wJ0Ai@~5ke_7&;}s^x2$nz07g!k~
z1p!!B?gz#Q4i<(Q#!QwiOjnp0GeP+f)GC1aCqjjVK?RgeR1z4|S!OUjU}8*X*}}Yo
znK2!t43vx!MJ>n$I*iGnMqmm{Ney#L{d|_121dpdmIlTpjEu?C>-TX;)Pq!2Fy^o{
zFm`}~sDo(_6GuBk4}+4S%zTz3Ojno~<5>PMA7McV&S0Ixir}qa-NDKj$8v)80xM%2
z*u7w{d|-@h00lr6i$(-fD>#dSni6o2OkrWLVGLujVNPHvo1VCzL#&>O3G4+B0W~3F
z3JZgUP#HrhgN*VD(G><95i1O&S1`<Hv9J-r5CxSrHVIJi3nFmUAn}9@#(b7POjDQ{
z^I2vvFJK0@)j>HDo&+MM)Pr1`!(x%an8Wgi36w2ZCV-UYfNMY`S4Ev*VNgJ;h7}AL
zQ&@Jebg(j}uq<F*!3ys9F)%Q&urM=&BL(UsuwH25WjZ})K8u0@V;0K}mIo}1^;s+r
zSe~#jcd^W8dBW1e%G|{<pQVR&3M+FL&wQ3CAVagDDH3Mb1Qvz}P;#8Xx`36n2VAl)
zU_HRf-NG=1iR=G=DPz_7P#y5rViZhIL<VCT%LkSdtc+<a7g!&#GS-7`AA^TStPTqU
z3tx-Y6h=cCkjX|Wit|}mBt#%02n#^s@V+!-td0w)GslcbgCGwZ!0NpHA6Ry<tYAfO
z85rP|^AW{6OrS0TD4=2Ow}b~Q46u@q=~}_`@WUL+Oz|(K*Bs{X0nw)pb12qFukm3F
zh1Ly;It(B)n3$Ltprb~N(KlEa7+@iOtzbT=UJqlr!gYm<5j?sCu7RNe8hrv%S_o(`
z=Cf!RFqfTSV0pszgbO@e01uiZ4HkwNn2ERiIOel#VEn)c7vPwWoX$}dGoYzuKr4un
ze5S8I!l9rIvH=!K2R?w!M{rS$|1ka65f174q!tzicrf4MV41?W1l}&c#ldoi@dFYU
z6vT)aO4dOdFuKLS;sGE3xW&NI!?FP0NVo;j2MH^NY6lhuX~rxT=>(R=i~?B@kHF=o
zzdOMpArd11Dvv=eW@xr&sLq)#b&^AYF=x8<Ne(5(3De^sRO3kwS;h&|=bz+Isy_oA
z?+9niXMhhW*-l{L?o>du@?lLt2HOW2;HEFgaS-bnJuFxlEEuy`EIu$X2D5x%+QG)M
zm@x~~RDdQEkDM)__AyfZ<8_3EL54A(MW%+47c_tfQ`j-x_Y{X5lc&t|+*2GuOr9#!
z51!&M7u}#VpJfKi85Z6$=s{deZ#O7SFI40dNnrF?z`}qe@fxI-MV~Q;Mc)CT94zV(
z&X~gz-oc6{JcsoHnh>HR<*{IT<7p0YkOLUl!EIT1vh=W+zV<YSA(KbW^arOoR5DBz
zKqF;YEEzo<jKM5D98);Jp};bQ;{!<G1IHRph`<`o34EYY0=^ae5P=o^TLc(`S+)o?
z2touJ1oucV2D9vum?8}km?Awz4LqX2z{ogVaU-Mr^a=Yo*z-VE7K5$_?BQSxhgq39
zpJfWi7m&agh?SZ1S=Mm&aDh~CZQ){B%$PZ!Wee9AA;xf)FG3fDAp#eKw@5OEvuu%^
zAO#VaAhksbBp?NL1IW;6XE~Hvrl>K7gX=LS)0F9sXE`iHI@qqTfeHac3O7xe-g}lq
zLeWA6)Wry9c_95lnlTs@dWePsNX~xxv9la<x?m<#u?AQjQ!!{uCp0-&R5(ENL6bA1
zMa6W%a~$GK78TP$7gK5OU||3axYV>Tf`Xj!2xQm=lr%xjOn4z|v1fYjISv`NDWFFF
zl<EEFI7Ar_OkaAALxJ(Y^ke5Z<m)YKKt1+gmVgk(V3wF02y>uG+_C{uQuzch=CDMh
zgT@5FwxCFdvG@cqhOtCkVPp(LBq7T?+>BY^`WUA81q*`&V-Aag3OKid{F?dU1EZCL
z2xB+{=tdZL5(C@H!o?IZpT#EtLPuO-1Tzq=Fo^k}x*Tf0RR{~i3{Xy7z;uI|F&Me{
zvI?1g_B@BIs8s?BLk?poOU?p#F*RLc`v3DB3QSfB(-kjpSb*s03mkeNy88l$4C9gM
zD=u)TIGuov-pB~`!1CgB2{suA8Bpg!22IohBB~>Tq;@*rMGmogxE`?c;6AqRVPQyM
z3}(sc0LADM#vP!T0IlUiRl!tj08#>?mN2eoWGXg**1OOkfEbexQp1?f0#X7R0!8Xj
zF*DleOkaADLygJCVEWmM9P%Lg-9-+WG#djJ25DGpW4Z*Ja>aZW9TPMG6BjfAml{+7
zMD)9T=wN~-Vz?jNK1?sT#GzOZk_ts`!r7c)VQ>L?zXq%Ylr%nkV6-_Q5Aq>w$Q;54
zWfQo8HaA!pOc+C1VsfBmGc+7*UVyr{IV?Ug;G~A8UJt4Psa$rE0gYn@vzUM!08Zhs
ztmmRI-R?4n9FvQ}^tj6$vLL$lGKWN#tqUk;1hWXlfQu?{;|*#%SPB$J0`iQR;0QvM
z&|ndWVGKqDm2HLvGsgjx>fCk#3&R^wTD~FDGyVT%4hhC3(<QEODAr#QX%+<q3X<Dx
zm#{FrU}6kqxgydb3JnL47hski0flWci;E9;u?lSPWj;&F1V+YWmMtQWMZg0e@G`^B
z0pzb7mL0+ugu#J_l*8;CvRN1en0h$CvLO0`@N;2s?*STR9vUo6#RA}{1(ieuoKORH
z!4{AUK>h(?23VWS_QG_=s~pnID@0aIm%qv(C3b{`0W?R*!XqQz56^)D)BUe<NHR?q
zn4Wc&LmEW4U*#|)My>C30X7+q2pQz|JECy0JD>q>yF<NYcR+)w6qFrd{4+Ah<6HJT
z(*v(@h%ng;Oi#bYp`d3kPy?2Rr#lB1(5xD$@?+cp%h}Mdad4R~cb!9;$-!m1^>q%Z
zm@lB(G?*ph05c?AfnpM2&L2p+R!IOQuY_XO#f(|XkW~y&;~WK87?v<HMzJhlI>H1R
ztw&T(jy2OaUgwZya;%wt;W~#F<C^KeuXD)gIo2pJMj@Kkj$1TfO~C!ILzLn6JN}sN
zdV|A&@yYbE8yu>_P6iBMt#Em#71P(<;E-_H(g5)#G`O6$n1j+RtS!ap^Z-;fz-Fu%
zoq0r9xEQ~HG5}PAv&jp_X;(PJIGrs(i8qJEWxD1~4kIRKi|Mg9IaK4Fb8;YUWyJ8b
za}EoG3{$ZJi%be*4ogZ6bB_S1tq3!)pn?&l-{CR?)OHJIaRB8qNEpL&{G90zZ*s^p
z&Y8}5i$j9(!*r=z95VHw3V<=3MWBQ+oTURa0{}Y39BR7j1yBPN?jJWE8{}fljYk^f
zdr<O$Mv@y33xhPM=9ji%428En8NmucTgITqx@jPcb^7pu(Jes)#oPoDkhutJ8$hKB
zQlH4JfrSAS@GRyrpgzd-!Z1!TCLNFI&u?*fX`WzV&}PhH(GGznGpMB|FLXd<6Rf{v
z@?v__Z4Md657WzUb7(M`s7zmYn?n;spSjJUDQ)5bO0MB71r6YaE)x?h`<fI?7r4Wr
zD02YXde?zj15Yc)6Q=v#;gDn8Fg@oEhc@Gr=`-$dSTa7De(4T}CX*4z^uKpFRO$;r
zz4t5@n=hbh@eAVxCa^Iq7noXD8G~6`SQkK=+$;;&X0S5`v&>+h0d0NG;Ml_fX*n{0
z05srr*RU`=0nN}%VcNn9ny6u&!p0cRa)-TvgE5?ek)0iu20#iKxVxq=xXYo&xMuqC
zyBzxUJ6ISlFfxX*bTD0DW(;Gw!P>#b7{+pe{R=xNbP@T?zy_2_gIVS<tzZI|prCRM
z>HxhIP`@ykMMa0XxPCrM3(FK15Ch~yaQ6isI(jjXnr#8&8AirXmL8TB!YquTEGt;n
zurQZ0&SzP}@`QykbYh?|xJ6vA-@(F=!#<fKY%<4W36`7^9te{ucQVst5tfn`Mwmb_
zSfGV*3!2Cl#?y>^lQ|{|Oy-!(G*JqyY6sH>X1JLfn9noA49NjYpJ%=RldhLwxxn1O
zf@T23SBQYo-@?L>%$UQ{!!(77vj;kKI-g|<(;OzwayS<pY@o~q(hjed^!KnZMDw&T
z^fO39##raGv@o4vf{N7t|NsBL)O?mROdFU%bBfGon4uLRG~5jsSQrF2VZ*iaSp>xS
z%4DXnAWQ>SSy07>pdmoecn1flHO9aMo#19PWM}}*Yk{H@9#5dfA_8n4<)Cx!=CcS$
zFlMnxWUxWF3{1?>Ol2s+026~3f`&CbjJY5`!UKrm`+?~z?{mnjCxC|hvsmn*O$+#{
zknagB$a7HB16OehGkq(V&hmgmhjGeu!v`F)j8~@nKj07*v;a-b!-@umZ*w@N2dv-}
zVfvvlz54-&5s2RZfJ2utVfxz#92$%{)5RWgxHINVk9){rQ9l7xG~}?@IDk_x#0v~R
zL91*S7@_3?!%rO+rinc8aTNyb8Xd+IP$LKuI?#N?pdG=&AOQ+W2_42978}qS5swy7
zZ={D2)F}aJ00#ji<RQvM!Ried^I2>f7#Z_fIzUSEr{8?YVI>QywBa@Od=?QAN#wSG
z!6Qf;!1obHCMdgdFlMoE>}F!jV%g2~gNbJ`V;1K>DF+|Wq63y6OmmnSvsmUZuV6-%
zSi!u9l`)HD59<k56bWQ^u6)44Ak3J<5>NmRB3No*SosAKbPdcc)72hx2r}s!Ot*Z@
zA#3ZP%m_L%5)zh-x-RnIaa0)BLz*!S(e}{w5eKjJfXN0-pZu7^kf~B*`mx6x@-~$^
zI-s#H*oYQGrH&4$pTz)cIWbh~fXbLm76l!aP6qk;h&ZbZn6CJQ<FC>JrTHuz+A`1?
zxxF){Fmn8t;z$5Z$AM<!_AXEYr>yD0PdRiLJ*GE2<&diPU}3NT#fyat*vAmJF-#5N
z5bc8ITqD@j+&&IAC3t&+VQL82x$ra$;u|8yNI>$;96l%lSj-dy8w!pBM0T;4n6Cef
zLq*PBf`!4DF_Xpk1tYi*4^{?EQT8XM7e3>VNV>to5Cd|53|fp$<zZo92eo9`O+a&a
zuq7N*C1gN>jBvGt3}{^yJVQ;DkYVO<Kz6mn^w-Zg^y_~>=W&gZgK3HmD)#`WUWc!G
znS8<kWEV1@g{#y6G{X!H=E)}vm^mk)3p5}aObk<&$guJJyTYKDfoSwFOxXfzW`RQk
zmLI2iOyBjKLmm{Jkl@HccIUJdki$S4prJRdg@r+cy_msBrJq5GMFiBHft6nj(|UNo
z=??0~X+1p5912KInl^)*F%yvvrp@4CasYXOfq~7Q9kk|)Vd{tJ@h><;>!-1Rtc4UD
zFpF7O7({qrDRcpwG6#!@1S(&`oT;A!$$YROpw0@&0<ihhh%>|n#S{x>&IV8z!cCd5
zgM~q!F^ffh1}Jr*4nR)WF<t*9hb-fc>Ao*Hq|+zru&}kDtrePZ1GL(Z5n6{ZOcY@O
z^|#<$2?kKR6wcKE72EKIixYJiK+DWP5rRnd69cB7f61ZE7%=_!OAZyrfawaaI5Zgp
zrhC2OFklRrUj2$gjWJ;QqE{TYj4jh2yy6h4Z((8JK@K|}79IgqzJLx>KM#w}3`P`T
z=nw@wBqkDVP!F;}ddfWT!i`~)4QNpuyc(IbfCb#7h1)T8!t{l&Im9BCfRY5r<In^#
z^#}`t2va``S|Xf!1|<<rJ;MXemWX_N10@koy)m8t4Tl6{#B_}}9GbQjAh*CndqNEZ
zI6=eR(!T*TSewNnvjiIRh_*FD|Ay&(Z#X1GCrE%+nSo{k5!${?-~EQeM&<%&>bi%4
zg+&E6X1{j<8;eRgXywQBg0~#9_3+}P{|m?^$Xsw<f(uOG0Vg6@=`?|dgUM(<ykWvH
zK?Eh)Opste>bx>cFhB{T2?nq*s)uIX2{t_7W;G%+O|U@;wh1;6E%3Z=b0PyAR8RwK
zP8?ta`3mMfn=3KkbPJQdv4N2>8L`YS<_4s&Qs4lU2T(;ZH^3z>Qj|L=O!s@oA;C16
zWqQUt4w)zqY4GqPRQ==vP?-uZG$);~K`BHhov>l!Vc;&@fMms_6E^V7jbu;Xjp_H^
zacElKU|}#|%w#dR0gCNRlro_21`9(CV+KnNSPopqq8i}zo<oK4%k=d39Eyq=;JAV{
zl=^GXQh48&=_}uJ$S_t+KlYwOnXzK}tM?oV!WY)CfYy|;!c)=HBhzI+a7c((urPIU
zfX0wP7Q%}0rx&LCeBe-Hw3uG}fkT<mV)}Flwfh5y5~I!ZdmlIq7;C2Uf8>y1teLL!
zkwea@2Go&?Wyxq@WQ;{N={Z;;3@ibfr-Fv=^Bx^=bqIIP^P1^B5aU*U<d8{wBEe(^
z3L%*CCla8m65!eH`4b6_3XLg@9Q9I2HNx`~BFr@!$lA_8ayiVD3p|YZptd)7`8dP#
zJJYp4aqMF(nEvV$hZ<wSbivOY+KdI$Z9ju~DW5rX84IRQf(Y*W%%Q?qF#R!zIx(H&
z3x^WZ0g>rCUpS;=4#==D@Gv(=%x4KH08!v#4O*;#<rtG$LJB~oGA#WbFc1K9;l4j$
z02=-+HelgEaqt0)?Tf!~6f-hfOc(zKjt;wT9QurNrssX*(9-eZ0aYA1EG7Mn$d#<u
z9C;8IbfyF>I=!w;Kk|)3fyrBC`ZJI@3DbGMbLeXoK-v;M@gVguw|QR>0dql-2=#>9
zhv{kGIppLM6u>gj&~%@X0`36AxG$zJ{?5_C=rLXA2Zs`)$8`T69Fp}tPe21T@FKA0
zOajsnK10n085S-92Bc<A%?4rS;toaz258TQp|-#WG+Y34U2TK}i-Us-l8)L436$<J
zgC7HE0z8XFBY|b{^yfb~_&q@)0*sj~0tt}j8$46{G4L>TfjkP22wx3Q-#Uv$1)LF4
zD`Q`c>GnT4Bt(2QSkQE3BuxMC6ST%JVLJCO2)*zphlF_oxX59GWz~!X88)7V1_p-t
z3@k`upk@om5zx@?IRP?Eitz-<ED*KuCx>`&&k0nsdQO1MYC$mzq{ac1{Ndhl1WoZX
zX0a#)Knh?aYaCBZpYV%ALihy4Gw>NChR6lecmLv$mR<mwWXfdmSOFR+%tXp&kqf4O
z{KX;6_+mQiZw^K8Hz$}F!w^M#)CUDNo_`k)Fd*rO`k=tV<$xvvs$oFxfjc%RVtV0k
z4n@ug(2!gvi_4wqf`2$fn1W_Z-}swDQDlKRxQheQ0u8AEf$7hFb0{(e2u$bv!y(I9
zF<t!+hYe%J^prmwYK$GzyZ>+~GB!+K`-ek?v0?h9KOCxzE2jVW!=cQWFkR*^hZ1AL
zbo;*?vW!Qj$NuH8V>~i_&R-4{#vjuU{^bx>xY7fk3Xi`5D&!fEy6_B%SEhgY%b~+~
zV7lTz4rRsz(_Q~@s4yOwo&}-$|8d9*RWU%i_pr2El`;LmKMoPb8`H1;<IrThG5tS;
z()`b%CHDt3DxSq6pu!l;Vo?FkSnz;JP?%o$pF^4{L1B8|e-3#Nz5YK(kYoUhO9E&t
z613{2q6a?XbSq%06lVZa3d7VKPPzI6;HsMynoE;8Kx26DdNx@BoTXujF}VfYQ-JU8
zNKR2;aqv=^&wwlfTHk!=IRlCq%fu%PsH#{dJ^+g-!z@lwV3~M=VLk&V1E?_rYK%i;
zF?q{$9Y#(Y#x2t`899v@Gp5gB<TO^d5n<!`{|A)3;kh-{Muf$|P6ZSfP(xE~wtr*f
zRA6NEm@dxDsmVBDx+62E6yt>HG0dC_j0>jMGILtkY?lDlmvAp{Z-K0(hllR=7oece
zVNr1gmu^VuYe&uWkIbCPOxqczi?ML3>D~a94LK|-$)G6+xPdz!L^GyBSFOVh-SJ?0
zCJUzl<BsXGSU4RScTB&-!fC;{W4b6Sr@r?O4`vQ<HN^lO&1BdC>ejJL>|mSE!r=i~
zNQErL!x+xO<H0-;+@3+qdob+yF}<IaQ^{*53j<TR83QvcmZ5xjD|n}a0a!D<PruVe
zhk4=(Mo>+Kw5o?;r_1!;tenbWyA)IyqY(R>b}6VZbG}E)&k%WdZM;iC1=Kb|=7U?w
zph$*?$nGoCOV~J_MBX@{dw%zu>8IE@rDWfLs-tig4hOJXL2Y4p`0Rc&ospeW+4Bpk
zKX*g;aDVR6(E;m)`*V+h1~z~0F_@mq&Z%6#U4w-&0x^EE{R<0Y6nxr@VTXwdXwa4c
zn%H)js4#ObL`r=-OcWSF>u}-n3ZPJcC)XV&3Xo8M<*r>FB_IXxgtM!@LmE`1A<2UV
z6_L2i#h{&DFbC{<0IHdp;qnt)ShyG&<})CRfGhy_QDMnv*8~;@4wi`>Ec017gc-9~
zgk8WKaCtqwkAssfcY-iu1_Qi~+BLxi<OsN(D?m#T;r)c&A~MJ!v|B`mnez=&kn9$b
zV2naE#CMB;#^#Xu(-}EAg_$}Pri*cMDuZZiPEHlZj_C=UoJvLopaF2Ei99S97;i8#
z_3<ELrgIBqG!T?I5k1w}7p8CF<kV-pF#QQ9rvu}P>8f0us*DNKy}3B2E2e<P;lV{V
zSQBJX9zyS&l<CaeoJF8KZNnJMV&eiDCTEGrKyGZzxdDn`xaa5Gn8w2?DtbeKg^LNg
z;0aoU&1sl^hMQBGal`Z%+?=`^8&I`vfN9|51Um()Y1WGAwmh8Lj4P&R@^C6KKA7Ia
z!zpF*f`#D-Xh8l7;}b?uM8MbDGt8dA!oa|o1DZ#MtkHy-^I-Zd9!@FHKE*jmI+?(>
z!PL9}>CIwcm;;(%0Gkb}vf-I?)(fyyI15M$(nw+fhaHlB55`~?p9!FO5|AQr4Fyg4
zvmH1XbL<${V2Nhd3l7Fm6fP)PB1?la1}HF~=1-THzLA$xhH1LQ^z%^qEib1Oh|kH#
zDF>o8`8f3$*G!M#<FsZhm_CJ%Q&nif4rY+S@C-G*X8LJ9PD$x4EDXxvg`mqp4P!<`
z(`H7&^#6REYCZuM*pS^nJp|GMh6l&=2o{DjOpIYHKUf#Afm@eQpH7bfE#^XYc*68T
zeojfI83NOL_&KG_QsC(n>a&g)&_2EeMhgri1>UV?F@58E4q>K_7t=rTb1KQb0FCjc
zvuJ~Kq|Zm$I>FHKV!ELKr={@=21qP1u|r+f@q&RdgMo#W6-fYGJiz6r&lTX502waB
zn8hLkoi9U4kr2b>r+*UQloEXbQjtC%<X2cX!tTLzML|v}#s|}F1UY3GA54!F<WymN
zFkL~2Q-1nfK~5>-2k6eSdw}LFy9W%&&a!&|a+bKf-2-SaX+VMr#a(t_E9@ByrY8t-
zYBCl~?-JrvWn3_QgAk{vc!dI_%LH~P%%v3u)9(mzswh<$fRaKci*gH6pBt30p|MjD
zF<nWR)0A<?^ax>22gVQ6X9{y_^Y4{lVKCr=4i4`BF#WPHr@G``0~Y3qJp!OA6KoaK
zguMpSg+(~^nD!b>cNXEa1JTVQoN5w1pmk4SEHO`*k<-uKAJY$ta0=H4fMmm2M9dlU
zStc;e0Bz<1845LXpA8FxH)9UV5~eMX2|j2X?puR0Lb2}!3tJBZxC;!=0{bOE`<mfJ
z);<jZ##oSlVF9xbv{i>`dax*`peRT(2W3`}q2R^zN>NTF#uwA)fT`{KMLAhn7z3ss
zmE=@+3UFb}f*0nDa{|C?WMOtO&b=all&Ki!K9K-(5&mMF`)9hI6sH{1+&|O(q&Ve4
zbiNd)QS975pvcc>F}V&}*L;QL3M*)M39%tyUJnby641Qc0+u5zph6K^&@j&1(F4li
zu*!>Z-h&IEwYNxC&U-NZpA@H++JXxxj$7~m!Ud^><$A^iAEw7ib80dz_%OXwno}A?
zFO%lfVN95QS(-D>XW<;=pk-Vn0Wks+H;jukVBUp9BI6<l7KZ;I|9}=lL;M4+lNlE|
zOs|#Ulw)+5K1YUA+Xt+Wsh<J7Y?`Sb<R+M*E2c9uX2Dw|j7#=_?S%G?8JC=4KpEU*
zTykc*uq>xW!jdze899qNAd9CFePza_H^BO#EeOV?FGM(tSzxMQjV6#V(m)vFGVo#|
zkgK3RTb46@wk)SieGUtQ0@Fkd76ogjc91mG(aUmF*g6<`7!*Ne2V4v^{s>E@jLUK&
zn2SY_<yWArcUg9X2fV%xruztZcRp+lE#opUUlBf%0}_CzHCS{qlom`6m*WHt=rqf5
zDlryJUna+?z*sQ-xE!Y}W5M*Na-2$_d|1KcGM{A*;{iq{7leZt$~K^M8p=VN=Mc@2
zG7}kaI}_Z%g~lpFnF$Mn0CO?Nd=>#|#!MDz84w#uPXwf0i>!y4p)6v0r#z=3Q>n!C
zHS(OYdZiN30xJSizQclyq0|99ssjpVSY9svG5xzdC#b_Jqrj=g_+z@W0;d7vkLe{4
zYAJ-erogGm*fLF#Q-X29bV)@{MaCJ^tra<a7-vlHP~^0feFDmRnJh9F7@;=8m%K38
z)J(sp$SKJfF#U%jrxs(tbY&$@ea3+8!AhKljEr-pw<>e$GFh8|6iIA9qs+O9iLqgN
zy&9(zW5e`AYMh>o4byqlIo%i=rU$EYS{vJlfR?jD6CXp7jR@030Yvx|*@!U4fQu@4
z3>HO9Kd8>Bq!O`!8LX56k{%d}A{H=1)k2aaLs7(Zb`4I@2!N^vr-H-<P){O~#bN~$
zXv`C?tz~+w2B$b<$MjMSPE*E?>8mw3l^8pwpVQz}U_3GXy#}Yat^<Qq4|KlK12$iI
zfLRGVg9+I}2zOnv!*pX!PDO=c4bZaFM3xz#rB{idkyLOLLtR#^F}*~SQ_VC1G@6pg
zQZa*(F%cyaK@v<81wb+&PlDuNS`((9*W{F7Oql*clT*$s0W?HtFrS6PMijnU`v8N?
z3Ih-5W)d3*acmNxeIpJYNKz8h1GG4$m<}*Z&(Y$PWLz=5O^Z`O>INvxGFfu|fJWLu
zK7hKScg6GrTAb31E2iJk;sgz#Fllq@OMU_E&kJVZ31BW}L=-R#y<et#X>-a-T>vlR
zV`3?p!pPJEIus5XbA1)l8?`xwMUjFOHZ|2(F@2>rr;Ka@C^VB<VoJax`j7+xbxL2t
zbO%*Vk?G&GIRzLarnBpCDltY(*V5rsV~m&{sKcqu7%{yRBsgXI43OZ8>HBp!<rGh_
z$sjq=a)&f%%_^cNVEJMCKON3|78Z8KEYKQoN$`pnCKiF|lXW@kyg|zqMSB<^drD!)
zG%!y*qcopIz(BMMtAs&>*kZ;k3@y`R^f)C{z*-v^H!xyVqXgPnv1NLq9;YzV#52>^
z>TybOfOTA8yaN`6@a`}knXahMDZ(`I%rt#YNsv-$eNL%*kWx?*f|e1CtO_g)+>H4w
z+y@w$CxUOLgQZ_aRu|ClaT<$8IB13tnn@U0bM#@$^NwbLdx@Z_P88u1M8V6N1Mbqo
zSI~O1=9EBsM{pt59DROhQ|f3IG#|m+46F+rVC}371JD2i+;wa$)Bo#pids&*pv1z#
zFN!5NFDSuh{TP|<K$Z=_v@?X9nC@%9DQ$ZKw2mT+MfeD)bOR6PLQ`T0SO<K>B;*eG
z<O!spV>tO>`ceZ<RmKO?PaAM*GCr98)qqpp`ji5wLkz2m7)}L%mdqh@VWD^657;oc
ziw;bf?r+Gc!Z=}ii6N&FX#0{eV+M=y1kj2z=!6e6nID({T5gaIl>;}yp^iRq;s&U_
z16j+CF!=)ugA6Pf4}6&Z!H`p)>7dATK_gD-l!GFmoSMR7)5FM^0uL~TgBk*0F5HlV
z;D%ujcm@L0y@c9$(0~QpB7v3KbKii56Tu@4&?Lq%_sR4LMx3A(d~1z3r5IzTpD^Nd
zWlWjQXUyr&IAeO4F{e7?jOlg8oVtt;rmr#P^ksZ8{g*MP3)2FI=?*5GT1*QxrstS&
z8Z#|mnZD2j)c#_be#V4TnQ4K<^p7T-av)mJlv9pz#dHHxP9?q-pyB;Y77b^{bQb3+
z(;2HcMVL0Pm|kYesUUjA1Kha)HPT_#^5!ekSDSK5GhUf~+>}#Z>I!Jrb~=l=2eh_>
zrhA6XAEudcMlm`}k2d2pW^|a|Z^miJ=rH}D8K(}T!}ND%oXP?>Bp7oLgDqQnrYo9r
ziZb?0H#g^0V(gh7WzH!p)Z@TBu?G}9(D2)`V0x!H=X)kgf$3EioC+X%js>Tjv84cL
z4NV4%f<Ab<1D0DDEDcbbkqp_e?MV}+?_0?!#+2<aoz;?4RV@ZoT<5UJgo6hyp|)k$
zn1kn)VB9U!11vd37<Wuhwd7Q1d@{Y)l2caf2?uizBdDo^G?19}Vfq0}PI)F{jp+|9
zIkiAEuN9{fh&F`Mp;nwqj60@RSaB*a9Tb>8%ZgJ&_n-ji7$ihdYIFj$=rxPQ0=lpa
zR2f1NHRJ4->F=#L#g%4*&t-xa01z%Hr@+*$nXX~Yslk{rJ<ys{#HK;UM0Gxkj0`_~
z8P=@{U?Ck7L4*)Ul`_YC787K_3DXx^bBc(8<qGDrcz7Ubm@xgcHK)8AST12c%NfQq
zjDqm36kr>a6ClMA0}Iq)92uYm0+#bxM8KQs3M8O~+UwQR4Qx22Tuump#v)*2po|<R
z1Xx_`RX~P7Vgn=sneu@0IadULyN0kV$jG^4dY=ua3}epp)i#`Jj1|)_*>IXL?wHPQ
z%W1*HB{AL6mQ$9ATW5NLEvFXao$1}SoO01NEDSxc9oI~m4D(r*2(J-_l?9pL85g+u
z+$f6cJWv(ad4SxCq<H!&TTTUDL`#5?+h)3<9j6qd&2%3-P9;W<>G^h?W{e)wm)UV@
zF_uifXvZnXcxL(sJ5I4M9urVAHit#ogfSZ4#AD<&*ujW2-pa`9u>iz}cRYBfgn-As
zp#j8u0Mz7#hbW)I^cZ_ic}AP*HTIlx4x$Vups_k=!Ne#k1DXbhO*As{DKLNn7uvXB
z<g)?wl#r4c|Apzd>^Y?vFHHYx&#A!pV!D_Er*^#{3n*7bu<YP`!Os}M@_~PiDq{o#
zC$x-U6!;(lE8X{h0Jlt_X+!i53qubZV+6|#wky)eUJ(6o2DE1h$zm}c7KS^ZwZ$)3
zmw+~JA%(9PW6$)14xCbqJ=5<va7xv$U}5;c%oxjZhUErm6F00Yz$muo2xP_$$yjk6
z(0*!z`7A0njL9rE(cmTyG#sT;&Ip0hCX#ZcIiOW(6HQpyr+}Ksu;PbNtVae?fHE>L
za6wB@M)88_^^TlUj0MwYIdV$L%wb{p!^jxUa)W6PGvsg%xWYBlFF107R=>P-<TR{b
zqkuHm%P9UpgqZ`hs00?8;$Kpjtia_EOus|}sO=ZYQu2fubmk5$Y9%^YkR})zC1xO>
zSi~r?MxMQgfs2Vj3e-M_dwGXIJt%p=ER$;RVXtN2{sua-3SRg~?Ga$FW$;inM4C@#
zl$Q9zhct!_;m3k%6nHtuC~W}SD>8wFF_L8l%M(7Njs~N2$_75hFii%~wJ*>VB0YtL
zVFhSa_ZH>`KE^NxX84I{jM7u4J34bpF;1Bt<IE`~2T>Tw0#*n<1qh*3Mq>IDXHLcX
zD+%C<33z6eQ2{SI4`W%v^ahkP7!XdCF<@c1!N?d7*<&9Ml7Uv-j4}^EHEB3Y#s=`(
zdRS1&*eHPF1s+N=1)vFbWNtkuQ$y#P7-bePaMde<8+OW!^Wk$)=;H9yEAvJMlr!PB
zy%9%R*~2LFMFd6m3qSJiA6X9tP!Y-t@&znlcT7Lv!YQhJf`w_K3Sy*0`VJ41DJVg}
z!$@|*^dByqii~HbOSy8IF}h3-bmi1#%$Q#9%BjPcF@23Irxs(z^y{vipiR9$TsigX
zCs;G)Fz~`0Dm%f3d1416=s<LPaFbZhg@JkEbq0iwVFC;+&{QZl1=OfyLgm5(Qf|#2
zM(BxDP`}81U||5Ak`$5ws?_UYHp?q`fclJZWBxEOPkhI~fG`&-01smM7y3x6rx-!p
zWcW#fjPidN7?T-Tpa%;=xo}r0thfUjv1Dgp;6WrJg%#5c+&LBMfAlajCL%fo3R_%2
zCz`-ZXoW2<%p47fz80gx78m5$RM_Fbn24wj6nVgfBW(7L5zGg5j-kP)SO6YygC#UY
zg?a|2MixYPD=L8baO)L4G(g21+$)M6>WoNT7{vwyW)4Lp*C{q=GiJf3DHs(ufD$Hb
zmIBO8L?kH1FB2H+k;^lX04Q2uv7{6Ms;wAdu2o_II}X;tV1)AFj#YxJvW7cWNr#20
zj00hxQUb^|2<ZeF#zfGOY0$8dy#bPj$GGeblw2hH03{d6J^<w+_$aB;oEFf|NqDuZ
zwBiS-06_4+tN}0Lf|b9@95Wa>%NTh6gLXkkAqAkafCE?@yf*@o9+d?^l`TAZDhn`h
zgLH#bDGSU;Qs=;cq@58qswujMfiVKqa)gyr5}*?}nJPF~#8`NkD>zVRL>L7%ra$!L
zRHzS7Vc`ZXI)T?^f&m;H#h~*)KuZST(JC0A0;|JcO@;S|7zKBTgYq0KGL_#bfCm(z
zp{@KU2RR+9I6!tTLS<D#<}fo0bN&a-gCg40j4D0TCwp-!MJ-@qI0D*fd4lNzDA?id
zQ|WmEIxq;y4L4wC=`bDmFdvaHReIn%<_>&7jK8b)Oy~FJ6a@_*L-s9NfR>Jc_Ef;F
zP<wL(Y6ZMZQrlp|m;-gV+8YK?hJm+l)ZR=l@a7a@d^5e(n^QqlUB@2O;Q<x4u&7Y)
zn7+%KQ$a-ow5J2%a-kWpH5KsUR_MX>f8LyO#s?f=!F>Rw$)w8yYOoY@u&99cb#Nle
z8eNv@{yv-%UM--}<zfyN1s}!~L=#M-1-{tz=nT+e5~x>@#E(mW#NiInXqmpzhf}m(
zlSPD?!x2;^K(%PHz*}>#rXn()#s&qjI(XL8*q{Jfnh%@TXVlmLKjjmgg5Wl3YOpYz
zVPQ;US;BUPoiULCHY&iVsd0y06V@ny)ru6gAQ{F;@R>@`IzZE7dY&)1v)k*->A<*Q
z`Z-_DI?(!WKh8$R9n;VIafUGNn6Bc_X$abYVglN7(8DwZ6w9D}PRwiz7?>AkF|bTw
zox%!|o5K2l6)aZFz%qet0vkwd0^0&Muvk3<%L29yV6hEsdmv(249JHlX?lRRjVH1!
zVf@1cF8L9j&4^-QP-bdmU}<68!^qSKN+qy>{ou^hh*TGAg7|8PY6HyIKqO=^UjQ+v
zr1@dGUI3?xqK5*ge1(-lno~flACU5ww!rk_0M4EuO$`ND*dCLZ&%g!C!${(<*-*t9
zLBq6A*J`H-fVps=X{SsN4CItZ$T48dML1eJ$Ad8q;b!fe490YXleKdegH|BJV;sy+
zL1bYtKNUQc3yo*(oarY6ISrHxJdg_-5gBksLSB<&VK7}Lh*Oox!eIJNDE%OaQ;H8+
zjd=h_jT&PBNC}8~5X7m;_+dI%FsCl#hv^o<oJNcvre_Cp8Z&;FK0laKo-t$keh~Fx
z`u$+e5XLpzO+q+NvNHad{x6c#n(@bUt0+!O&`d%UrxoLj>Fc97Lm6jGXN~4G1x+4A
zbLv>k08L<qvb<oN0G@Dz&($%QYylrZ1=_{91Jo2{1#NzS79R{IGq%r<<`iaC+yT;_
z#UdiZn8_jo8!UjA0Swa)OuwAKsU>j420U>Fi7AHZ4AXfNIVG5;GfY=c<ji5bF?~uR
zrwZeZ={plSl^B0azmv!*TYpWY0aVJuYDR`@8+?#v3>mJS0M*h6*%#nx9%ve4xMl#3
z4P<U8Vhb8bHUgC!hRO|R5Cr7|5QaoE!)1=?ok^TpOqV&PZ%yJ<5RI7taUGJ9D>>6&
zC2`88A87zj14Fy43|Bz>D3Chn2|x^2j<7IrGnI0%a5pf4JDISvfnYM6V3|n7!mTS;
zK7g0sGQd?{ZJ3^y%qd<!2b9iWjS&WrI#5jj7r3gz1L+4Mi!gIoAS!=`%PpWYL|~;P
zhzl|SnGaSE@&E`!!z1nkc!X#=OA0t;8l`aBGk%y}l)|aZ6fZJ;dJ3nK%MMWAs+fsI
zC4i|IG?E6(m<;h-Kx1Y(EE=G*A7QOVhWI0(5lN60aD^8)O#hq0sl>Qpx<V>=RgO(6
zr)2#bXwXAb)1{6W<b-i)14_cUbO9w{T>O&*%BHY{aftzXRu8o2%5aGXG&$30!NL&(
z=@P?IJXFGlg+oagv?UL20uOl0G}zhDpt+DR{aY%h3S+`_=`>Cy#)j#3X`FKPbHJxu
zz!U662bAP|5!~oR$X1}Z`oa!yPZ?$>h>Mh*L0qKd4B{dsXAn1>fk6Q5LU_oY;h6q9
zjZ=r|499fIbWU9m?UBx@2%@voIi)~!dpdZ`d~G_XBV)((_vxJWj2+YUGdLaVFDPgu
zwXqn^o`5vDKsG>w;5=vp5MvGtj|gKvi%1Fdj03ps=LJ|8TtE}AEH256SuDvZAU3>+
zW;id9!Wao|IKp+DX<=aiPrI@>gin8;!70VqGMy`vQzO~~F7D5m#o`|TH3_cqoCgbo
z2+PEojPqGUK*MzKbbUbqynP*7$uL0tgc!tOxS%k-H<MFb?}CB|(kKGM1qFCx<G>G)
zkHHw~?Nbw`U&`dvWt=cAi_?H{!gRwdPCdp6(-X2d6&NF?H)e54F`ZVKJ~xZg1hn0i
zgE5rF!~?XLmJMD3F`V9`4C?YRGed_f8BVX5{wIr5mT|>&sccR&#tqX0vpIDcH%zaG
zP;0X}wdx(fBRQcgJ)ol;K*z4ay?=NDXl^KnB>;533A_wAJOflbqHrVN4JU@f0iXf_
z*2`cx>;PG+0rn^?JG5M2VJKkCVkua_#uz+3EQeEp@xt`-98ML+3)AO7sDnA2N{Sa)
z80s0*Sn5x(vn*yz1C=@`#<bc@XUXNXWwe>@l*?JnXfu6VE~m433=4xeQ!x*Vcn)I(
z0~0ed%+l5v76#DS+$=tO*jPMVL1VJWlG6?HI6<cb_~&tIFm9M$k;kdd)WI=*VIHTv
zO$P^P_9UN$rvWrj2~PxV4WM-t$XtjsL5_sRY1@S9fATnG#3lrQ7jS@N;Gx@gX1ZQJ
zr;XZ#6qboQm=H};hBmNj6tw|ArccP{Q~~Y#oX^OZ$ughu0B9-;b^B1j4;F^`jEosD
z*$kvbp@DNi)9&y{3;5B%$lL|$hQX3BNCbH!C77Q9ALn2QbYWoX$UyYFAp)S&CO{5_
zdbcG4w1_&3ML?RlD`P&3bOmG?7p&3D&{87-&SJ;{EL_4J;PF31#ort;eRct-3S-3d
z0|lH4u?rS}JElnTFF?mVpl=;-hNy#^-MmEv)iRI(M+(F)sDnKirrQ>BN;7#dOphw$
zlvD9wU}5SKfH&|MpnN1R+O3#Ar;t;IamDnVg`Dz6E5PdEMX%i%P|*u_f*nj69_bx3
zrgIf>$}rBDu3iLQgyC7lDQ`Xlx)a|45?=6V>X^a8-N`V85q8WzN=4W)WBPoM84IQ#
zEaKE=yfOW45oavpjp^RSoHdL$rk^P0^k;0DE>Xhi%GfeJu7oq4v1R(P5>9Kz71NnY
zIn9Mj9x#Ge@xtBKG-0|=DW{~|1<+v|!7LS^W52-T+eqGT7MR{#%Bif{B7!s`$57V;
z9-{%NL&Q?uhUuqEIgJ=MO#fHPsmHisx^5Y#EK@zlbe}R#3&xJ=t!12`?HOyzIAs_+
zrk^b1R0Y)(Wt<YqGg?4xMtGpsZ+XGUm;iPOG};<$rfZdhYe(O5P7|3uEDWG?&RKRa
z?EsBMgC<6y3hOpZpIgo;DZ7D%0d%PN9@aCk14`k(uG=yFayh4R*a;iZGCJguVTO7I
zXQm1kL~4NXp`$wt^&JeLfk?PR8$|-ZRU6#wCYI?w6`ZohC7{(cQ7k47j8P06h*okF
zSUeOY9tyfG5LssWoC;3R?!BEAoYIC9SQuECiwownu<$cxvG7ZP*zk@eL(>HCY$0NS
zYw(Kctd*Q<Ol}I(bt^gTKy+>;r-I82P#Xz07RBIJ0~(-#4Y)A4tpIUh<24L!3ZO-t
z;JI>8v_iwvRb%?aN=`*4SB>dkDmfLsT{S={H-p6<v@E#f2e_FDYiPKh09BdDnlnK2
zDmg4B!H`e_FUE!%>|!uIp^8(7$;DuLUlpf%eF>;x1b3TD4FhcaU~d8gvM^{69Xf`|
z;8MfDRt(t}&5R@lT5be#1tMj-Y++&G5G!RcmVzAe0iDC!8^H!TvVcddltB<fYPxGR
zr*Y60&>%Q$dWpg147hTGwbflNAP@91xV%6KP!Km0<PJ8Z^yw@y{Zuul9+R`g^k3DS
zdi60Wput7x7#M?d3RZ7Br+{X);9hi2!SpsrNhmnSz|*4h92N!vu~G&jY@QYn0n1EZ
zUc<@Dv^Qe<wi-@_^f{oJ8wOZNI`3ft4bj872SB@j;TO|5gSoKbWCjQqUNyQ%i0~q8
z?qN_u<S7@4>9)0;QtD4o0?YXc1IRK^aDkVmLQ{!{#q_#bPE$sU>04?!wd!j?ZFhKT
z@aVuAS{@ysLsa3R<<Wr|S|BBvh-Bq)0AWxBiZE!iDs%vz!Q+DpijzG)K%I=d<<d!F
zdSe}@4wI9_^z~5sZXKt3eGF(!4eoL$?D6abz6S;FawjbD3{nD%XLw9IEnr~)C1Q*;
z3`*WSpfsR^RZ2iad@*AthSc=+^_+^q3uKrkaxlOK5E-2IfI=088wMZKWpKKK5;Pz#
zIO%hMuIqxvrNf5l$_<?Qj2os0H*lITZkXQDz^PvU1tnk{{vcukDc?K%0cA9Jz&QND
zj8c#i&?%9i6a=-<(E=1KW!N(SkBAsZh99j!m~Pw1sZejB0`@xxw9n`m1CD8AZYTo_
zDwhqF3!4yNaNGe3H+UHg;lc}D#}<@u193AM7=%Ec0Ar|6d?cp7YveRx@{yRX(!^;9
zqQjd&r3Xsj`Cv~~KB%e62TQ5~DM88)J_``BfRrD67BGN<1@3qsfg32U_qj1$q?vP<
zusUcvV={{h;%+7N=?|MZwHY<0^R{qGGHOg$Z{gHo)R-R9!f7dX9_&#l0rl^R8PgZH
zaGEl{nSQec)Xfx`&bW<Jgy~4fbfH#GW5y@b-C8*n7(=F~w{mJr^w={`JP+Qb3F?o*
zTK~s7rmt${)RgN14J%C4V&MUu4hlIk8=h~D3rzpm%BjVeGF_&PQ@!2>yww(7h8<aB
zfl}EYSz`g7Hv%~o>dqr;K!?K_%x96&VT@qWu>c(&2P-a)oB+2K7?Jp({s{v#O&t@+
zVd3IH-UA(aOaL_60Jr~`g$rzeGj#%}F9g+j{E7m2q#EAnJbndzWE$?nLmAV>+c{+=
zJ2XHwFs!0JRARzj$^bfHd;WCBgN#bk1Nb;unHhT~OfPTeT*1gQU7>?BmudQi>HQs?
zQuWg>+(2%fF;2hnfRU{nQtiT8LX6WttO2bkK=A)`u!6@~U`}D2p#vTv%w_3eoXp5H
zQ3BqHWt^!1-bV=6J2T}9WVI~V!(ty8XO_GHwFeOa&p5MZx?LxyME%S;kPhn%#si=g
za<H&toK*mx2L>ewNK`TQ3xFrYgIR7cK45{gy5W;U{Q`F&%Qe6jeqijE=)m-0zl;G}
zC7Q2A`c3wL_6{Pstlwq&%T7*d;gSQ4jJe<n8R~!uCey{cI29O8rdxDz+Ax|-FYV$~
z^ky(YUO_NX0JN+S$+U?Ikf~t<(ETlN-%Ydu`wqEtz&NpB`ok_xC7*&86t7II@WF_y
zi8XT=F}yNy${IG5BODkfewpsy%_+xdGCi-G(~Pla`qFOB0Fev}(1;kwiO@kX#z{M-
zbM|n`)=vVTRtS&9$tG7A8DkKWMUz3d_aKgfU<C7%(Bx6ngJ#>{ex9;G05r3Y;2$^u
z8B&GD*%ad&D?r1euw217<-r1!WIN@_9PpSmyj93J<-_zFJ>X3N-+DNWET(+W09E(U
z49Ym=19(~))-?n1!6TcHP=_b$X$;d7dO3AWWI!W;aLcEulpxO>PSaSy%vOVzc&6!0
zKhVo5#b_~|uaDCRK{@tu>M>eOFX-cx7PFWE*9Z6cG>hpA`#43CEF8dNj!^$k3us^l
zj}Alm)4?aT!DC~34CqKm*p^Yo=`!FQurR+)-yi^9qyx$?u+6uOy(!bh`#EK$d!K;L
z_y}fkSp#bABPw*p-Y3)j`#B|<dY??s>gSZNmjJc)!&w9>kloeS0qP*b9p9$`at8_*
zv6q&yPXlyX7CaRDG(Zzw@TMb38oYxLR6jy;6~pxv5KA90ewofOfs@Z?1-$A4uhoKt
z2E&atA2>m-g0<XlH-KtoSm-d^^Z|_mvw~7JJb5tOTrxdr0;g*Ik{|3${-8kwm{~Wj
zfC2)p`No$OoS;TLG%y)%T7YKZVO|7rnM^=y?4a6j`lui+Yht+Rqk<+a&(Xu+;0-!V
z4m`$L|NsAo4-7X8K!(B+BZ!MK?0&NY)K5X!*&)GXgH&bQyt4$fx&t8(;)Cw(fVt_-
z6wtwjpuN}7aJ}6CI*lQeC1%6))`^@#j1ALgOyraYtxW^n1ZM);GY>cIZiEJSw;9y1
zyAkrtwKqT&GP1w}26#L&+>PL2u0<1ob@vYZU|?i`9rwv_`wr-axKNgmH%y?ysUB8?
z-TrU`EP&Xwa#sPg)isBOL7ugT!BG(@z;FK$U<`%VHVk)MWLUUZz)K{d?z@wqfHv!K
zr$GlI0{7$X4LppY3>u)!4-KIkQ$Xi1m4k0zDo43}iQ)Q_>31h_N`~G6rOjX#4)`To
z$Vu|<fhnK@43^j#pnQ0;x_bk(+zz?`4OZMR+!LAZJ(*Lj{+<a7LkwduOThwAT10Xd
zL?Rq40lq2@)*ymN#DFDYK)0QPmoqWkGXc#ku)+cs#0^H34M*jI_4>j!gOVZWLN{or
z+*<(}`G^HIh(H&0!QFj#1t_$N!J$=*7Fs{1+fLyWm--+8O9T7Cx3<9@{$P6E6ix}#
zAK+{U53hR=K0Lhc3+w@n8Zv>;nSi?HzR&dCQ#fTz5<sV4z%$SN1W;Lx!Udg{3(oz}
zN{!)u!gTJboXSoKpkrv@p>sdMhY=|_K-^G7=-f{L4L5_0f&2T0!1RKtoU(y8IFNk@
zDrccie4xO>0J=GZWe)QTP>TsE528zf#$MsNrr(>&DPbPM!mxsgF`VTE_}p3Wv6nCv
zEi4Q_7#TxZb}+pG4O$>;Zket-jZ=xSWqQCgPFuz^)BC1z+A+3FKRb=nw%&$?!GSS}
zWe)QeX2vAM`2Y`XSQwK)K?@tIcvND-&h;vxl0jxZG#foy!NAV-DiI_CuhkhIwXm@E
zFc=~&A7XekK?1br4k^t(oB>K4;ET+rcTVRNV!EL-eeQHlS+g4o5=dzRDbyaDurO?4
zW(;OI!2E$3WiuqhW0UD0rgKU&J>i(nJA>1Z(PO&(3{E-5jOlSRIF;)&Am=N>mdY?Z
z&Hy+1k@?`^BdDJq?~q{Ta6&3cAMXI4Pz5g+9`BF<7cQU$3a~?E86ICi+>ga{L}xw=
zj|^iNi;N0$nQzT}78L`=FvM8i;|tKX9L&ZG7T{J0JOw>z0S#qh$>~p8ru)w1lmH#W
z7r__?&evgx#Q3BIbe9}F<$}0K`5MGUO1U5|s$R5g{p1HITgO1MHBu6N@`6Q*frSYv
zUo*n)BxI;QGyUI8&f|;`(~r&KjAV?Mt}vU^pD|*3!E8=fMvLj&W^?K=+Dv~uo70TZ
zX1mlJ&SXZWN`~q6b2%j?e?Zm=NPtfuMGTTwGECn%ms1L)?Ce}lRi#P>P`Ux#;s&}B
zOaRowgXBJF9@sizy2w0E1=|Urebt#P-aFt^DA2&(`T(@n6Se}5VVi;oXyF0a45$$+
z1g00x<5c8YApk0GGg)F*fOnoKg7_(n87wK~jF~LuD?kQ=ck@6EUePoC;yg}8#(?Rc
zLDY%qqVqYG7*9;Mn9pg>cw&0Ne9mU3g$mQZ&gWDYT%sexm=4vqB!_`99kd%wX1eDB
zP64Kc8q=c}a4uqWnf`A9XFsFM^uC3h$&4=3KP}{RVcam?d=Yr=Dq#_)e!>~hm@vF=
zzR-t(sSI>C5Y*ts0idBXc$o*{#vn$z7RNAv&RK(xPc2>m<|9S)5}oPq7jcRyEYSf?
z<j1i%6fnkt=3GH*oe`Dr5}oO)i#au!mgr0mSj;J=h~YH`R?ub2utIi;&h+-hoU&0M
zLm5D~f-%T2X0SLoFlHd87nf`R<p)rdKx1Ud0nlpkU=|4t(9s=83c<~HW>6Ugt2vf@
znEr1urwq#vamLK)6P9p_Y&TlMDaa)Ig9CI$PZkS{0;D5|Wcm+|=?Tj?#U*}lh`@FV
zA=PfxAEx&&<5Xn)Fn!}PP8s1E8PHTVQbAVzVfuq*oFer#0-%k|@Is<S1=IpT;ezho
zMY6WC0W`st#UgD1ItRtV0dxuq1FS(=IS14eLROss-QI@je!B)12A=7~%Q;0wdcdc&
zB9FN{R7{_<oKudmV*2jooKlQCre9mm884Lqn(NGB;Q@I#Yd(CzFoRvjbpI8cVvIMY
zr>)@B7Y@<@=SD>PI7nmqiWQs+j26>RuHZCcteO621*Z(-i|LXpITe{gRHoak<dhW-
zQ2`x(iB$Q7s7%jU$!W|uWBP)XoC;#a4F#a4HOO=D5-)Vd^lK|Qb);v24o=Ks0UzlM
zy4C`r;Ky{?Rh;sSKc?HR;?!Uan4Y$Z)08n_`kYmq#*8`BFRbF!WLz@+*D6kX#tYM}
zR&(kyUYMQ%p{A|o)Mm7qerPqP661yGPgipqSsegb6Ut&>0q#D5TmnsL;R_(`Hv!N|
zF&?0X07w$<itq)~1J`hBF#eccwT4rl@yGO4Yd94de@s8KhEtO%!eILMHJsTXI%O@V
z72}lY^Vf2UN*~lvn$M!(B3caHKMLP$d{ATh`L&$lS|9~rTcB=;SOCgz87wX_piF@%
z3L^!k3#{W5)di_%vB<z?Aasuw+`W+s(}UJ=D#=uUw!&qxh^t^E{>X~y6V`D`F;+}p
zy^d3k(PR3lb)2e<9@9Up<CJg*oz%>j!D8_Py{wDg1H0S=>gMP@EDRNlp)3_O@GJz&
zk<ojm`>zKdG*PskvpLa$g&}}3izNVd1TK7aPfUsi7i5x#d1A?Y#A>UUB?b^z!`B<c
zEP)-_!8{Q<)eHA=?1|}N8#omiPfV`>QE#Ttf>3)laLNk5v0*ZRBt59J;~b{H*}y5!
z=rEmUBd3;11q%as?hTqPK#>Ad2$srZ;TM^{VFjl+Q$oe`;*FfTj1|)tZse3^JTrao
zMotOaGcFjuPXOII%9z8#q669T4K14!o`BYtfI3W23lg487uv+B!jvd5-C`4`E{INt
z($h9^YB5?&Ke&lgOvyq5W&_lqL<?{o04p~VEvEn6#3{=dFkO5zr#9aXkcTo^_yxcr
z2)VT(y<&RCW=<Ez71P&l=2Y>^0Bt8?%m+15z}E&MFE-4OU||pets@mN5r=QVLpwL!
z!~*5qboniu(xAIjY_@=>dXu(rhB1DazH<wwEK?@K^c!0^l^8!v|GkA%nQ_H*`K_Gl
z(qBNWj9?ZM8_;MaD8ymuCd*)Y;#N*2#}H6imBSJc!5GXEkpQ~+6Xx0M4?4`8{h+nj
z(7?$406ribYzoYn9Ea&gwsNX5ewhAxE2lQ&hw0+mI5m_*K&3dmw9U-{O`4);%RMkX
zX&a{sW6AXPZJY{>3DZ|>;{=^?e{CD55o5x1&h4DWj0w|iw{yxf9+)1xol}l6VS3GW
zPCKS@f$4j;b1H!7d)ql>LG<74;H`8LJ2>S)2jVL;X0a%50A(rY%quhrRP6xOa$zhw
z9gyKX_)5Mi@KT5j7U=-+@G8`^)jXhGad1CW8z2tHff~4U1?U8+EEb&{(0xcRm{=Aw
zPT#tNQ;>1R^y51?L1!4g*}<vj@<N7%s|I;gdg&AJ*?{oMYZ(JHLm-PVhB9!#B4XK#
z>2W(bB}HGzfYTYc0}FM-GM(u?J2|D9mg!7ixsy{KM4#FT-e~)MC#N6Na)IgYyEru%
zZKfCO;xuGzn7(Kir;=;~3xhRdCW|%ruw>NrFRK?!f4GZNoN>YQpSw7vt=EabnuDOb
z=&vw0fcib~Fj=btI$jadJ%q$Ayqs9uG2MSRrxRnx^hvup&FW7`BQJGW*C4^h^Zz$!
zj{)4v>l!3jzz16*i=a#vY|wCF42SP|Vc6KSfDu}tF{OZu9caXD?BRy>aBlfP%DDv4
zc+bW;6F}#H!Hc<#D_T$tK#>3qAi;}HkV;U}fc5A%?kNBrssiI~k`b5=o=n-4F@5hI
zPD{p&>EHKoS~F%$H{Q!>$e1xbbuXti<BsVI_i|cUo(NzogN|ClM$R_vKy6rV+93dH
zXhK318qZr9ri<+3RAk!9Fx`9~r@Y!$nE=Re3T*t5VXI64sPqNhq6^a_GreXXrxepx
zndvk3amtD~s6&<kA{IFuTrmCQK28O<HwG+Rd<=-y^b7~zKzDpts?0~E!-H?&7fM3c
z>x0|~we97e>H7OQH9+@Gi!cVWh=2}QVux?IV|b}Cy<k75q<Vk@$d&L&e)Ryn*%#Cg
zMK<ff^bPyL>#lF@=Tv2S#WJ1o0H==e1LRR3q-AMu_OLK8fR^(zfKE$eKpgb;+F*LZ
z0Zs*`*9Oy@4shxPyyjtGDn)9-zsc}mj7JQjfw-XSOrQzrO@=jN8lvC*2E5;znHiqO
zUk6M($SK7bFkSi}rxfS_oEc1@%>ey}7+AhAwXi_h3@AE4_uhde?jR|;!+=B4c_c;9
zNj+$2zXq+uV+><yV15A_hGb&k1$7<ZlG6_!<Wx|s05!vsSe`JQ0S!FB!WiNHis?*;
zI4u|}rduE4v}J6VUU`Vqgz?Dqb%!{O7z3t1Jj5vp@)Zwb9LpEb?YE$-d|^Rz1l(tb
zmjrK)fcot4zR;T^5*($lL!}Xl7&1Tu9<WmFjRmNZz;M;u5KvDwltn~_xzu8M<zY@0
z#+K>x4s+@-y%U&z<}jx#<BaJ-M>sVY*G#uQ!YR#oV0!owP8E=3?Ga8#;SvU>9#Fjx
z_vPCI(=Q(3lr%rU!r%kCM~LwSXiN+4sCN@U%dX(ux8P;$@Z|aS#dO7^oDz&Lrdu85
zl;wKC0oowT$RITzQrExJm|l65GmLT1^b1Eh{TNH8%OB%ZW-OWRe2g>5CP0}H>6nNQ
zC6GaT_=v_k&@mB=Nh}SFQy7^_4Zt^ZL*wtA#`KHFIK_qE8Gyz$kn+WQmFd5aaY`}0
zXPGX3oKsGChde|l+_Ud@O!qj>DPwyBGRNf-&zQrK0lqi_HpukR19bKRd~oKYg9cNn
z2J#xuj|tNk9_JKidL=P^*Ktm%uny4H)=(A$&?EypZ07ZqgaKnP11BmM-syj(0y={V
z9;P1~8c?T+7(T9<u62S_+V~7;m0UPW#ui4Fa`62pu(a`Ng8(R(ESv-KJZK;Y8Zw`*
zOs_b>DQ9&=23Ev_$A95Ae@@uI#25@sq+jNM=F&kcg<umf44)IGUpT?3z*sT;;|Wg5
z$OA~13GYjo&%y$_>G=-h9ni!ls33(J^!Y#!=)QU=@5>zUUN1&S)dH$nK=P=zPXBe1
zQ;r{e**dJD^y$m=2`4#~Ltns`FYgC!L4&7<FLOYxiC`9s2vAi63y3d!AWbKj-A}*=
z)qz&nA&n$_IWe8%6sH{Hi|Oj8I5ikwOb<B4sl~Wtdi5zzN5&V^_nzXk(U<~SRhq-H
zg>etabFc)?$OyWS9A3sTG73yrJk2T2#HKLa>NKY%h%P<NsmT~Heg0`qMaC!F51!_n
z%)`jOJ@f|Wdp5@F+g<N-u3}a)1g+O$Vc}q4g$!aFE@1&JbK!yWFKicl%o)MR7%@HT
z38!rO1CTTW2Mdn?Oa<uFLIxHA5f%vzn2^ICkSZAkWIhKAj|7bGXu-n3!lIx8=YtON
zV2O!=^IN80c*-ea=ahnK4v3Fz4rr+l3yXvdOrO&oka`{o78wN=6^-c$PdOzGQ$R<*
zBCH0j17l!8IL-M03j+^JL<GzT=O<vRja+I#Mj_OJ_{dhfYyruOz`f-10;EsWD+lB=
z4gnSc50;1smV^|TxgH%L^$7Dod}Q-H4uIr2;NkA^0c4&?z2_c~`!_H?U}kAxxxfN5
z&O3pHL4hS^4I@mz2Q8>Td}Q-|7J$qb5P_=)-K5PTAj6`d!lI!A69t|8&cMRL1CCA^
z7KI)4a0@`^$AhAsMMQ>0ApoW!KmcSc!dsw4*bFQz94s<6EDkX&DJ3iw4R9j@T|kN@
z;K?EgH1fov-~ux&H~|!RG7d0)hzd(R0|N_#1(E;*1B=BBxQQVrKqhh=K?s0T0LvUk
zmNkqU;G&^3K+0G+SOg4UMumdLa9Mod9trPZVUS@_31NwWM;YkCdO-;m1s9fp5}3A#
z8`Cd7=M)YBhaQIrQrb%dhXe;aTO@%aoCOkO5-bLH;I2sqM->M+kP#u5yk)w@3r<zW
z6Vu~faEkdRfL+YPA^=a^8828ER9I~Gz|F}5om$6Y5dw2tQ3MOa116RiOh1@d8klD=
z!^L~1AAG?n%h)sh{tHgkdeB*GEEN;r#uWbmS%q*o=m<Xs78ba@Wf3e45-c|GSOJYQ
zBfG0A02FHw?;zr~`VUl81RmWr8(0`>SokI|BJ8efnLhC)r(*pE7KSaXEPGgwu(F(C
z-NVLmgzX4B%=vYo)yrTxm`FWnc9TWJfF&gZE~Eq6s)8s%8uozlhsFxHFF}iqLD9ux
z0{2K$1q*`!i--h^fu9M?oTd)2v*B)TjsOLYiw8`;c@3(3O9_O}q5?1cS{_WVf5j<X
z54t&=g+l;b7Qs_6=(t<Z>?>0F2@wL7pYUwhZ2&fvheaTVrJ@FAcTWgdv;fWrCw@?7
zg~wGd_@HZt0G2I`(<NVX3NTKXuJxKzI_e7xLjX%e0!(MW3#d>Lfct6!)ION}1QW1L
z@WKLgClL$i=7^dGMwSl79(bruIx&6zYffo*xJx8hWZ+qBY6vLoc;LR83c3rP1yRIJ
z1>N1l!U4Bs8q0LXH=Lr5Jz&e>CE+yC@^55ipsJt62A*?gtpHhL0uSO@Yo>?4;WP+=
z#1s!Gf>ktFY~ZELoEt0*E}$!~L*S_gBm}B7VE&)$0WuPjcNH$ceLK%(`t3KIGJ-Qe
z>Ba({j^>@1&heI0%Xt9<3quY|O$#G<kd|c*;|fNW4UAjh+83~Z^dXgp3nV}SCGZGd
zaA$hyTTVaFy<sdYEby{^u?!1?35y9L*DO{6g^&(BU>C<gor|am7lS4dSvcU;`VtY4
z79If>i2#-WM2Wmi1f=r{;|sVWm+7zwG3;Svxxt7iu-4>E4|&I_#+Wm``W>f?Fz8fY
zmMKgV;04Uu6Vq3{<5Z{z4>_=0VeWxDeVqymLkUX@%Mn&s&~9u2IfO%jMFo*JH-R0;
z0k2Cp?Etw7(Zbk#1QbpJ@H%=+4VVv40Xs}UC6o*|JlF16F+Joxr(zbkWMhFR^PSMP
z4hs)F&FxYEX+^X|c5{Go1`j+lL;0X;66S;5UqG${B@VbLd)`dH|DIEx@y+!A?>VKM
z_Q`+^f#=Et8el)e{dZ6SjsFI0A}j?n_VP@R{=lg(3@+w22tR>oWSl87eeMTN39AB7
zn+5I(#tBEj=E<<gv@o)?AhIXpL>p9vlX9lN|G+6>;Q&^@0~YCwQ=UK^%whm52pOj_
zfX?b+*}!}P7R`*)bf(*X<P@!E0qd4vk(j~=X*4oU-vEvfxI3qVm54~NI81@t(VGHF
z#SM(`#K#C;N(EX-1r1roKG3~0EE+b*d<le`7!I8P**yL7M@~(~3)BC8<dm)d0uq7L
zJu!1&b}<~81M-i60E-Sh?vI0JM?qyl3ZhwX{0gX&Kt%o-38-l@3M@G%;HF(rU}4Z<
z(SZdG!-X{<(|HV7Of06){KP59bctd5nopc^#x0<<gs3R5fKKsb33$T<^$!C`fQKdJ
z30&YR%k;mWIK`!}senz?VKK2_ad2Vrfmi9*6{hQd=2T$1t}s3DGp7V&!1S!ooO<H0
z8rK2T$b^}GJ!Ja&&z#B;7ND9C(J;N~15RA<w)V{ekUXNKxCv>eAQyi(LCaG>RhP*P
zSmZO@Tr*wk3#W2DxKtGoVOhg|23|wo+yM%=7M30smL)7FSXeHwbg;AZuup(1xD9T^
zB8uQUE~sv}0}d%fTj)*$$Uq)=e!hMHl)gZ2u7~teu7eJ@W#Lg^Im3O2o8<}j8D5qv
zynlG%K>@B=ct9;IxX=}lksLfMZ@5qJvRvT(0atua1e^+LSSB#Sa|8oOkcEXqf<?iD
zB_x6+CV?d-2V_(rsMB~4TwRtR(%bb9pqPKc`-PX~5APLzkV23;kT9q*4CCMT0eM>_
zgCz%Ehu`;^KIbc^6w?ik={vr1Itkt20LK=*^1Hz?o#z{;C1b&Kw{M)rjAy1-ed9C}
zoB#?AL=@jpn11jZr<5sV9SF+-<`?j2dkh*mXF)W}K#MULSUBKy^plL~0^d1B>@vWi
zBf=u%!V(a|5)p&cb9n-e41{kPXA6K7v%p%qjI#}<Cw=EsV|1C``JGeRJOJba6&DtG
zqls}Yq}+vhig7Mz=7$B8YvCov+!xbtf9I5{U+{s2;Q%Ac1;!_gEN>WFU^#_xA+$LO
z4NAsEkRp|bMF4KZA{~&kICxk@Zm_U?Vd;QXIgCrrfLwG3QOSWt?l7{vVEh5g<c!O}
z&G+dgKR5;JQ@{qnTT4$XK>A&LpmsAn1y^AbGAuq%m|5O1-(X>R!14iJ<vp`tVc5XL
zvV&;?Gs_z0J@A+S-vP&xQ2{dr#1}x~zpwz80Rk)%{0b~F9WaM6yf`pj_$OzX=K&Um
z2$lwx8E}hUYJi#>JD3l^t-vAzZaZCIx&aGFhL;bfU;4=zF8l`M#|x|%V4=kD>ce!K
zU!2NJuO+4@{^HbRdaW?M=NG4nZ~&+Z`NGr!x8-ff^uxb6jnxi7n^AihAHW^^7Th-D
zfw#5Zu}qiw&8ZUv8Zl#FVX<IoU_|)r-4PZB50-!emKK&ja9_RO0S<;4j4U0@E8up1
zbOAY62417Sl9)d0H>aw~D+v|`4Hg}Ea()%V!jQt!!?y&MI2k@2nf~}Ur=rLaP#l6P
zZDbjVKb(r<;Ep#-4<id`^avI^pI%H4_`@j%x=(}!smb~Y9Bdo{EE|~bFtfa1o&b0E
zryn2}-eLX$ck@>bu$9P#(02h)IUxaWxO@lq@&sTNKLcnf1_M%4_lMvGkOmcaaq;uT
z^lyJSqZnUI5B$p+&GbuQ`ntcIVm<{RyQgq|;DR~-7gXc~C#uLC&IOz-3pf$N|6M@Q
zD*#KCj0_Uf1^#i0+B{%kn8L`igmDQhY8hExfFedihs9tHEHN>%gEI{W4~q}H#9?I5
zn4b8LQ_9r_<R%UQ77=(c$;hz<CI+jG7&(5hFnr-*St5QwoaKi2196rQ;#=T3nlobh
zfq$Ihk}WI@PdHd+h;0#LIU{yO4C*CDZind~{y{ogJS-v!EE(Vu`u~Ryj6C4Vo(J6D
zlYxu!8h|4NUdS`@zF=W!VP<LIJHiJu6C@;qBEko5g@weh<P@-!z{82p24t3k4vT?_
zF-$L?52#oUfW<B&Uk%v1JfI$+f&z;IY<P>2KWF;h|D57FD_9s7FtPM-zu{*2!rcQe
z9{FFeFg##nIm5Mv8)me?i78y#j3=h*aA`4qm>SNdCHMhsHmn88DDY+KBrYw+o~e7e
z)Ie7nu3%zmVg3Tk+>GL1Ku!}0fYfC$Q>9X-^D=U&S%T(Z5FLI-X>dP9WDg6=5tbEf
zEF0KnaI-Ao{s9joX-L^C!lE<1pOH(FNm^riJ0q83JzV?`XtZhpD8WG6hcY%G>*4h~
zqYSvi0v~b!^I2F#V6ARO8Sr2gqJb;xfvO*LkYor;2s}Wg@31iN)FYbpjIt9zh0_wo
z9yXR4Y;RzhfKd)~*&~YzJoSMtoMS-JCJ$Pp%)$e2fXaUWrFkBB%qW7>0;0+RP1CTj
za6s~J{f7^XiZ?(tybL1OD1oa!gbpRpI%yV;EsQLC7<=IPNKk`?!H2~M*1=&E3;+%F
zsOZ2VO0Wc!+TcBDM!^Lv3>hpFR8GJ{Or?h<odKz+VN`*106_yaEDcO2m{`s*U4YxC
z@`8n72`GER+ro@0UsxC>FtW^GoWaPl04dw6J^&{)SVxjkh+}#WGnccc5C;oG1<MQd
zJ#a^=fo4TmIOf2LL`JnYEDQ}GBM~KldJd>OlYx)dF$y(Imtf&?5jg-3XwYB@%+Ep>
zrWdeqNissI7t@!pa4Fb<PQe4U9Oh^r(1xo77s@kq*1(;ju>ow20*eAt<-jQPWjYfp
zmp<c{=|-$vT8v+&$Fg!s3WIwPS9HF>HESK2-pR_P0%`@kU}Twq7)WE(Q2@s-tQKO_
z0PBT!vKe*31q{63%BbG}&d3Lt8sK4~e}shrwSC2CZ~#<?S=g{R9Do<L20vKhKrKfe
z76o{H$!MX%!r;KNL}HBu%LC~L(lGB^>;Uz#A;S*f7(|4wWeq4C0zz0~z=IMu;O1Li
znC`>IrBZL50}A&A91WZ-J)Ae-`NT#C<RpUzMwTgzh#s8H8j$yoh#V1RIV1W)l;wly
z5;2xFpi+5{*by<72JsGYn44@)fbw4sY-EGcmIq|u1in3dEJyer@Ugt$YXP;A!Miya
zZNaIz06eq=PJM5fSZ;{)h{6oBJpwW;1vUoDXa^234OpemXwL&4-9mIM?ZF8m0-VXN
zfa>)Qc*=M9!oqNaiRA&)4p2P}z9F5_v1a-_b}q4c#~M&a06vh%=m@W_;5CvXxTnJ-
zz#^i;qLachhw%eEND)#p5Gh37ayDUMSi{J&1<_DqbeX}zV8P-5?;A3@Y^etiKqE4#
zhXp9pBYNcC;2fQ@0F-Z6z^w(1>m!ZxGy2W|Rp?vv_ZYAoF<4^Avc|B(gk^%s8WWZ+
zCTC1ou9(a)Wm#Z4!Hi{w*$Xq44`x5iSsE-lELbL3n7puL`C$3SlBLCJjup!is|VIB
zZ>&F9v;44buwiMj>9AqxvFWj4xnlDIUOuJ<OxNM&(q~Eym>$c`CFh<B?nWr6u)xQr
z7*oOXN$~k4##C?%@dEQ5Q274`Rn}>c!A5uqla@365I2{qXc}Z_m4_t+9`k7{rvKsQ
zlB!Pw?Q>$8!?FO>;amgHT!B+S$^D7Y8DW+?;y=V$8YCvju*{H|1JAG!1#^UtpemRF
zR}c-Jm|DTM22}0sU}M?Cc7%=P1lt03mL=>f*jd)FZvpjbA;~rt93LF;<^`0`!y*Ff
zzB7Uj`mzD_=skQ`Lg1x)ybUPR@dU7hz`7WWK^80w9c(OnKpC-vvj?6LgCM=u3GnnA
z0_uCEfu?61Tv!rPSPDwOr8Rh*k!1<f1}2s#EGt-9Hn47i*Zra3Q4<asmOD%z;O2xr
zVPWWCWVyq%hLz<8+Z%S4FYJHVSz0*Oz@s73X1W0<mqdNU1W-4lfq4!*!lEj`Re}JE
z1Sre0E@5R^!}<Yk9b6XC5Q_ByX#jQK!M%6JXwWS#EH^j~aIu`=+QH3ofcpTvr4tQW
zfXlLj`v_Dd`vYV23>Jn2mMPp*ph6!QlQdWuVpujXo?&D`8oLAw3$Q4_OY)=^P^mM8
zaS5mlfOk?DlXXDjIUW%#JuDMg7}&vXVi07QvTeE{4_85a&x9}15JARS9X>GDjSwhn
zw!su8D07Yn2aFZaAqr(Ky8#ni_J9Q@_QC+lS}w7Tmum;(_T7A3PuK*fFfcHvfab{|
zZqWWPeS;{Mx}*n4h=GA6gn@xU2gHU*8!VXqL6l3Mv0=M{7?(I`M%F@{OP=clNCg7}
zLyYTmL4Gb#&~*hB;#{C5xGTiD%o#sSe*mHaraMS*sWTdYC^gUx3>hG9#PkUgT>6Xw
z(+_}nGp4@)Q75JgNOFlYPMEGC$)zuu0X1HPfq_8=#D+M=u3>tCB$xd3^^#ni(`SIx
zKbXEjl1q-sUSj$MNiH=e2ZrfCB)Q}nE2c|Gaj7$InC>9Or4L%|FU6$>IuK%p6qg?8
z;Exj^zKg;14<OoAW4eSimmcWI77uAIb;b|V3#7T!K<5+9kmizSw3xmFBx*7Jfi#yL
zXy3nr43`>{uf}u_5beh>y+DRboiSnh3>i=`O+Nt=4G@_A0mS_=T|t&hopHx>4_PjG
z$r~V_FfcIGpayYJ#PkMPE`3Ie=^JFZ#2HsiKOxH{&-h~c3lMc;I)@yWJmZY%8gg9f
zi~-XF<haB^YpLb9%o%@7UjU*irr!W5Sup(vi03igK%PsT(*bJNjOh*XT;kKq<+;R}
zVg;s8kmr(TJTZNPJeNA7!}J><>ccbzE;Z22#u^G->WmfB13=tFf$0?>?u6+JKvc){
z6AIuc`vKzJn69A6rOs6WwPJzG^hQxGQK<|Gr~oJ_A;nro!t@43E_ud|=?fIO)It7J
z<WghGGMN4W#N9DnLJ8~`2M~2(dIpGcm_7kSeVD!jL>-v^07UJW&Y=trX#-_0bH*3b
zGeEqC=@XQ>+!=pNzoE>f2fECQLxoG7v0%D^3YQ*ev1bB=+o8gx##CW2eFKQQWBLsc
z^<#R10GF6lr3Td5Ca8(6GGV%bDwjNC!}I`EE_KEO(<@ZD^cg2iUjgDdOuqo47EJ#E
zqCQMlP~%c(^qB4eqHattP~);^jF`Sbjmw-dV)_e^;DzY|>Rg~(St8WA<hfozt+a5P
z{!orf6m%Wy40SGZMvv(i)IkY$ng*9V<A>=A8eHm(H>P`ls14H#K!Op|CxECO(>H(w
z1E$~50I8qOp~<Drcw)K%h`KR70z`RCZ_wnDXPhv70f_oA{Q!vanEn7Hw_`eo7MC38
za!(B{E`7!o(<4CCh3Oq2%47Nt5Oreu3oR~t#(?P>+Td6V(B@JDEfB2$(JKU|FVN;v
z=iCAD2-At_7qq#=85^d*0LiY=m@c5hWzLu}-9ra#e1#4;iWlf`sezUxo&a$tO#c9)
zJf=(Na+xzOm>!_Z70y^NeFca&Vfq7IE_KEQ(>e6G)EO<N8|ZO~G4)KC?xDwJ&zLd2
z10=d(`UX8Nf5wh!`ds#mGp0M}bD1+fm|mgJr4I75K9?ToOvDQy$%N?w23-1}(!hXA
z4|E`CfdQ90<BjP%K-}vJ(_a{HfsRVlFyvBWnssA(fFYMWqrvn7LvVx?h;WHAGtLQ^
ze!!4Rk7?PB=^qTa#F&;nn64nsCC2nrW4eM7xWI8R;<9J7nBHK-WykbYWBLJ*Xv6de
zMqJ{O7a)Pe5Wv8|04mWKAf?$ih3NvuT;hxc(>092={mre3$%Q>z?e&o`v+*3H%Om?
z6QqRwp)q}jF_%7L!Soj(WjCgCm~gp+*6x6)3DakoaH)ZA&N=|1m%W(&!h}nnQDQoW
zDVH2*RgQ)!ml_kh!1Mr9E<0{r1CYTC3=B5TpyVf_!l+vS5n-`$5>66is&j7RZsB!m
z=5y;}@8sy<Z0Bm_nSM~2ON5!xaKrQmrr>-aU<P)r0f_oAJ-`f{4jat4)VNF)Af^e6
zOy6L}rN`u9G5vuVm$@O-5``sh!d`+*b&fqUL0xj~iml3%#3qVQkm#4}lj@c3mhF`9
zP-s(XQE66%Y{N=1=bFuUVwwe)xa0$f!4Q&}fq@eol1z0!rW;sriAjNuX@|&xNM;5G
zZisxn!1M&LJh);5$$>C40|PHazW>bh3D}J1he%J@GW`HZ`UprD3^Ow@2tuW=O#c9q
zegcyM(aa1C!cgfi(-kba#H1#Iw%~xIz?hkVK@=iCQDS-kNd7pi9D>P<L*!3bOm6_m
zpMVwVFnLL+yvOtnmRw>?ryaJRu;glHX8g0=$Cj&$k*UsN`VBiSYsQ<?MeMnPm})Ji
zXV`P;Gwzr^!=5W%vIJ}lXr&7S(|ks_YYqxb7jOV4GY1DQF{XnY(<2<X^q8hPOz&{u
z(vzA93j-Dg24>J%E>d7eFi$)&{elC?lhB*aK>J{s#TXeFVDe|CIdZv6Zh%_K!N9;A
zfh4<QdV(XD7}EiU=@pJ#`jUH~$`~0Km_crX8M0#f0Y@%<#s$+qfT$1C6`Z)@83U#_
zIDvD~3@5Jrk}&&0=O*1ocx(TO=>^VQ<&rZHCbQZhr1vhE=EBv_m@$2V3zr^fzr+C-
zE-|T_u;j+Vz`*(l?p&s81=BycaGBRnVPIgB1+Du7hXI532dLp83=C{a2<7LY*#W#u
z%@Cnp2UJfoK$=`^RtRx}1yFMyFfg!rA;b+EpyD?e7}z4180s0Az!o!Zg5_r(1_rit
z(E56a_?8tA4U8ZM6(YnpK~oY_3IhXM144WQH1HS;7#P_45#rk*#(*!TV4DjUuV>r_
ztMS(`FtDwHOE7MO9bU`9z`(W>NgUQ})L>v>JB1_;3ptSb>u_-<Td0FTsfq1AA|#AJ
z2PZIqa(fN~1KV>X377>j3=C|a5#q+Mymf|wf$cw%IP^qV#xD#E>}&{eQ>cR&6BroS
z1rXxqpduU;8h02N*z3g+5*Dy107=Lp#4TYV;laSbu7@NJ_5lL}1IS_<gt!&d0!9}G
z26j(`xHUB4GU_leu!lgz>p|0fHZUI_VPIfSgzrvcs)OZk0R{&4G9+<W)0&5YfgN;T
z8Y4KZFxXB2d5eL8;R*u-`#gvRAoJ~D>O~kB*g;VYRd1I84u43E#&H`-11y!QFfg!h
zLlR#BwZMddf&CbgI4qNa#IGU5?O|!_1p@>7V|Z?2o(K&g29A0L2KF}y4bVi*z)-=!
zzzN!O33aIhtetAYzyLlH9VQMfj2I;t7&wHG%7O%_Lpc~2I8>0tVNnJWH)mpCsD~Ql
z2#bOM1_ll{goB)*J^(FQ=ZHXvJHy097#KJ*5#lbeH1vakfujl`?g~r1An`tgc)c66
zU}3nxz`!vbA>jr~y*vyI9D5Mr(DH_X0TdD!ki;#ZKK{eN!0`|v?g<rVy2HT0@f{)V
z1MxsT10xRu11Bd!!WZV!8w?Db5{RJN59|3bF)(ndBGmgq?PW+{VBj=E5{E_sqXGj1
zXCOT8nO?7gYG7nw;7qDVl30l(VSzBnAC?$<7#KJ~B_K4)0$|zl1p@<T7eajiv^-!q
zz`(#c6CoZ5ZRaw89JCZFUjN|(Lm<p&H4F@#NZBI@mRRmEFmN6~%6=VChq5p*aGr!3
z^x*?TFf^zc3K$qT&mxJ#a*YiG11D1M2!6o;&3_;Zo**=Yz!KvH1_sVg2=P#80m86@
zfq@HAaWmb5B?=A(1}>zME)15<8W<S3R1oHbK^wD-8VvOeT($^_aA?pmf;9Ld#3NzZ
zPlbVjD-1~-TFWu6U|`_NMu<nl9Q1>MfvXZB9s|qYGZ+}S+CWhcS(d>(5mwUiFfedU
z14)2OH0FsZ(4ZDzVBmtq*@q7dF|a7JU|`@{hp-?PmL@<Uv>nMDSX6>SXg`v8Jv5bq
zYA3EUNCv^8poD>e>n1`x4(5Xm3=CZNki=oxRfmCr>pem|0hYZ(7#O%&k;I`PTF)?p
zfq`2X$wjc#&ceXJt&Gr+2=iG30|Pgx<bvjcL|B>sg@J+F9m$*)Xvl%g2}YQc1Wmlm
zCm0yG6Bz3etvjd$0|x_xLI{#UFbhBi<sl48gC(vG1_tgLBym{O%wb^Q1~ovS4o!#p
zm|+0}1NUT@`uYzH$U_d?poRuiLk28rG#D7TPs22PV90<vlu?F(f%^kOJQJ49Iv5yu
zkgD}8SdrYqz`$dIP@e@V4?yh?29O3vL`ioLQZ#~U8U`MuT#yZm`w0vTJh2FavZ2|D
zA%}s1rwA$JVCq>I7<lRs>T_V?8yFbsd5}t|9B3k9IK#levl*cw7uJOO!N9<SRDk4x
zd;p5(6$}hK&k*YKp&`cz^6@W(cmZt4Vg>^P52OVJ9+74!geE$s3I+yVqynTERvySO
zFz{+43@U|%Py_=5FH)<w6xusvT)@D<i`42Zhb7(w1_oYG;}#ml<ptpIXJ7!8)x1ar
zMFmov@gkM&6)+#$Ffj1WM>wbg>QK<AC+`Y`IP$m<?>3~UffZ2o91IM+`;jz2gAP<l
z@Pb;mP?uIBizAf>DB?(sSQK%jMl6c>e^C1$W&tz`7#tWF__&Z91dIC%3=DkI2=OXd
zw%owLz=u>@R>Klk0s{kI5JG)5w5VqAVPN1(fs5BORKpTo1Oo#fQuSH`4I;(~3=DjY
za19KgGs!?{j<tq?fo~E*yct@=f?7&^3lZWiP;pR`j&D7ZI5^kTGcbTkBEEeHi4IsT
z2XZN>BLNMe4p{27U|`^Tfl%KGEn*op7#R3|AjG?%9snK5!VlVl59xt2oramu!oa{^
z54xfiCgB3|7pODGz`!p8Pb^HQVL=MgAdM&|ros%eVPN3bKvEA&D<TXG{1!;+Va;$3
z1_pi)h<Z@_pXoF#h(HpNNE)Eo33QJLe+ERu{|_ISPQz+TkopQF^{_Mq5^qO@L=UVo
z(_moWpNb^@0owjxe8RxMkJQfZgO%Yo7#R2uAT;zto7)Ua7#R4GS~wG69!Owd;72Nm
zCcv`m3<d^%q+9@N|1(z9gDy!ySTG6Z(mxCg0!X=FGE|&VfPq0k1fhNk%%KGg3<5}9
zwyDs#XK-O)5HLWfp9;%02@DJZpn?n5{-27J3j}-+8m7Sv%3)v-h(i*G`7DNkK_C?&
zJ{?*zGEZP&5GX>3&w^G?j4BKa0(}Va`q|)Yz`(#*!N4G}2q7^SYB6&I1B1XCL>wQ4
zrcqFXMPN5V9DXkf3j>3|NhERDMd~2&>+m$hJShik5O|vugTPaS#S5T8&C<cZAgGBD
zUka=5BN!M2-XSbF4$Xd`c7woAB=s;KXD~1bf-Y=@X5;0sy5J83gP?jnLc<D}#0mxm
zL8Lfa0S#)V6ATQ3mT(_1orZ=G=&DUYPlSV}!s-q#1_nWBHyhLoUJc6~OBfgglc4s3
z+W%{yJsvg(1_r?bsKkd444a_&mC=TQL9iPkz8UH>hA9jTf=G?hEwFOp00V;{Qm)ww
z4rvAkh8_k6L8Or0Isw-H-@(8j_zq#gHmJ|oA{ZD1{~^TpK+ABZ3k(cGNY(UyXgL9D
z5eb0~SA+)j0cdIm<r*O~L<k*#C3X%5bp|1Ogarqo7Jz&v6pRS!TMpA5BDlosp#j3+
z!N4Gth|qQjS}ZVLVPFu-M~EMRw$xYz7#M_*I>RTR1t%lO9Hf9f2^&UO!@wYf)E7Pl
z^+!Ep2?K)=QV;D6bbuW+;VHBmVetiM3C!rjz#xRws=o+xXb1y?&|QT3%TRNe&M+_t
zeME>~g%&TMksM(rrg{bjXvkiNCVD;=1_oh1q=15^F;G$#M(R8tfel(qFfa&f!7X59
z2PtG=U{F(FU=TJ&#L#|dsQ}95!tf57%m;?2&{j0l9tH+sq{RKgV)}<jF7bM(2SJ%p
zI1b4?XdVKK=OV=S!2&9Pfk7Cl5&spMB^W{&7=$Mx`48%EusNVnL}++?h5EZ5)VvTz
zYPx=fc?4v^3Ao1@zQGLgVPFtO>PLNpCS`^X3=G0Zjr;FVhcd)4Fo<v<%=vx*nz>vU
z7(~R8VhAz!!oVPc)Q|cB^%*EiMNAN#`YM>kf(#5IE(i;LLX!ZS00V;vC`-Uc>>(C|
zN+pqGMg|7(NPqnYrW3GH01gHQkwQiW1_^LimI*%e4-!Wz_WnbgHB2iQ7(_r_U&yw1
zrb<{b#?QbYvJCDZMkZ)xV60(a5ZQnb2W2vFb<V`Yz#y^%A;AU<>NgAwB8VD*>Gf)e
z4?w4Di@ZXFL>;vBVUT5D5cvd;d*+GITnmbOk-rG>Nzfz-N~`svp!O8h2UW1d$il!N
zDu<*2G<OcN8<Y;!;NncL*MI~;JO3FNM3FMX5m*{hU|<jh4fsRNuY)CO0R{$9f3OF@
z-5I7jXb>?dF))aN+EY*sRnYQ?L6m_(G!tR*Eod$T`AoC~Y!GOH5mObcStHKCAld?Q
zEhH-U!a@|}pt(ru9bnxVF$M<FwMY^$4U!BDqI;3Vq2&$($bz#7@k&?$4Kn90k~lOm
zf-XuFeT#6=G*}4LJ1{VaenCjUnj;{eiLoHW_rj_w76t|}0VHu)B@YspL9!TT0S5zv
zm=03NAtiP(OGbuz=v)!gEoeIkY%!>B4Q*qeg@y!Z9z_h4ouCtFdtr$VWI+Ow1+ZKI
z63;_&5VVy7Hop$8zMknUc+mo+5id3YF2QsfdaML!XiIDsl8<3^8pwi0NEW~n7as$I
z*d`=#Smn>dz#w)AZa%Xh*rA~K2L;_FxCGNJ*bo*-{2{{PX|TH1fPq2mGm<#0ATnTJ
z5J!r#X|N~*i6aelPlF|1ka)d3!l0?J+7u+Aix8g<jRKww1_p6!g!o>V#R3cr;?V91
zsJC$oT4I9ow>V;8i0Kwmz88l^8Mr%h3)VehVPFskWix0TFNgX7Y;ie~#n8$F)XfnG
zWix1Yt%PM`F$M<lDU1xTsWMox0va?BUx*Ojt^h9o7#KjEckzt~3*fy01qKH3T}T?B
z<qcT<2_$i-LqT0xaipj`4J$uDAq1MvfO>2yOdK?wAr2}sVG=MOa4;}Pup-jLX;=x!
z!@wXRisaBMP#1yJBTZXOhI$#4cqQ}^>L)_QLAgo7ijje#9u{=4xDjJuknloSd>NX*
znH3lqBoLFgOqXEQ>jwq~i7bTri_o;f=)k}rQG=8VVCqE}7$kZS;`No#paZS=l9+=q
z=oYM`1NjUTHPG_l7SzL_d@OMoNj=O076t~13-G96(uL+40RaXE3D9&dWcrjz0g{I5
z8F)bwpb`)w!T1AekcI#QgCslLAjTa~hdO}7r4T{743_T$7#JiC5#q~Xxj=$}K@v31
z3XS6BFpnuPFi6INrZb=t%fJN!0|RKqh$N^|fr&$XzyLC+3t_=Bh!4PtS8@SDd?~EJ
z0XYaXqzy9%R>FeJ0o5HK@%j%Rn3lrE!ay!UN~KGoaS3+NFC+_KiBy7tK?<oZSPCl-
z6c`w!K-DzJf)5{<mcZHp0SpXMwn*l1z`8RagOJMhCD0ZQD4R(kl?RJq*#=}#1Hz!i
zFb{yt0kw#r7B7a?ejo=Sb&0paq9y=T|9}z^RKr%7OF;(RL|CvDmODTOy+?>Iffc0z
z3=Gn2NaC=lkzinu2GxpC^Or!=7RY1LMj-W&=?tblFpEJ3A$3jn!V(L}pm>l5NP}Vz
zQV2<xB8ekA2$apB7VklJ5UA3EiNmKe6c`w!cOVSfjTF?<=aIybf?E11k~mUOOaDd^
zhh^6Q1_l|VN@zDUt<-~3wG3!14C<oY&;kb(L^7bZ8&rH3EDAsdg(5821q%rY1_qgI
zBym`MufV_{(})n?32P~V%$Wh2&VX3}iyM$Z>kt}tLGwM>K}QhcJ7MhrkU>a`PIkgV
z0%XodB=xXzLV<xn7F4c)?XCa7v;$V{1~4$lf?B;`i4ROWVId*Gz#t3ic)-MA<pjte
zP*DvP-vMiUg3JLe3V?~jLIPwCQZ2dzR8D}}A0VH}_99%m9oBXO8MFi;4l4mcQ6>wj
z6=4>@$_bEzKt(T9d^@a(1~TV4!kq1}kdR<tsFwwG3}6~yxj=z|K@K#<1r^^0>$3$g
zFvw{k83YRn2?ho^2PAP=E&!Pmh7jKdYkY#tfplsi?f-3{pa7**kU`Bz8eq8qWYA26
z_*Q5&3Mv`pHXy{e!9oIL&M_o$kl7#%GUpCLe2WA){2^t&98#NZ3(R5(1_pUfBn_}c
zr@+7<kJNO7k1z!=Fvx=jZlJa0O{Cl*?}IRBGb|g|gA7VSNNj;sHXws45#n26K?-tE
zKSF#9EIWbBS<1rj|0Bqos8}A4cs*7P>v0&godIgW|NsBrAS{tTfFurc5Ca2){7D?*
zm*C>{|Np~+0;J(K-7JRM3ypvI$Mm)s5_<CWuLsED9}s(^Anrhr@>GlC>2Gql^y@)`
z6=IM|6M3zr0;dpsZ0;$nIpD*<pa5zPLdU2WL2JXIE>locgs+y|4@)tO3=9eu2=SvZ
zb3o!Qf?)OF{>^?^E@WX~Q1F9DfI3QhLAx?Q7J$TKWSO9Yg^X)p<sGPJl7>)!6t<WY
zq`m-Q@d0G>YZ2l{wPF1mkc)cZK4vt5RS6*s3<`@87O(pPat#D4tU-vcM#@wQTM-UA
z0y77+1mG~jd_!pY$atrofkELGLc>v5dj{l#w*v4e;Di-B3=9m4ObCmYL+d~$9|i_R
zE`$X=&?YGF7X}7J352*ev{|9Bgn>a(PnHR`T#Io%cnLPdXNneZiy7C$st}OH_6UpD
zz?vH%aSyn922RjU8IUnD3=E3#2=&#_)`Or11A}53A`0q{z!C)u0|Vb|xJwy+LS4#`
z!N8!19G9@T2N_g_u$Tebf@8eHz@XTKFy|1gPSasvQ0#<@GtPq4AoUEO0anGy2p1iN
zx)jubQd}wsTh77s3TgoZD+7b#4ur-0(5@$Fu0ZiHk~vPGU|;|pl*^!a9%1opXoxb3
zFfb_Iu18297Kk%2D850Yi6cv(2Jta4D6T|uP%A_nGy|rDoF-sVz`($ugviE>b70L4
z4h9A#5dj7UX8ZsDLH!#qSgj1wAcu&v)v$&aNL&NqpuNz<1scClGDL&~D>URd92gjs
zEQR3NwHVss15F1hIU~$p`v%s(0a@US(2xtw1#A}>7?i>hL3#w%Far4?3E`ll&~_21
zH!t!^5O$C&QzfiYmStd2%0Q?;0?V!(4D}336$lrth9xeLgBlSQAB8n5gc%r=+Tl^a
zJgF8E1t3zX7a=|o7G*393`&SZ&A1E}q9E~QAoHR9n<Gdw<w_e64q69mc!3<W6Cu6^
z8q{Em4}lDV6yZl<K4xTKP&y?54~ZC9+ZSZcC4@O^>tR6(lDLCpkR!-w$k4IUOGMBe
zg~dH63ce$$=YgtcVPH_^K%@y?sE<K2Q_2zo7(-6r`dwKaVZlLYc>p?@RT-4HK&kY@
z2PRlA17wY|EkgZKXm$dPbt#7;e6|iLDwX39Q6mU72$Y+Zvjq?{Py*0I1h$|at^u)F
zfq{WRxdoA3=Rk{It_}tU<vB<p0h^g(WMEKUiwFsRsK-DvK+5}I=G1>+Tn-y|&|zRu
zK7sJTN@$tS#KFLzd>)!#KYU<9&aTQ=5FxSu4#??{fm-E9NDhJ)P~Z@H2ebGCWP1xJ
z{8?-m7*v>%G(dw0)HF~LL=xA6TENJ_prVLy=vvq`185JWHp0hH)nG~m6qV3+1K%02
z5SXY}aYW?T3TU;+5XZov;*Btf7nVph7#LKdksJgIIROR+l_Vqw!P*TV2jw6_=!h5C
zP6mc31_l+-5-LV}aQ}vZ33R_FNRESnL8S%B0zr@<Bp0ak!c#9wVpN%h2vTEMqSIku
zP}z)R@n0l!4j~-6dIKo@p>itM5gPWx#w}SG7*t*&ELa9>$rvy&sC-5?2x16x1p|Z1
zA4KAP4GmG%1_lOIPDF@u!fMxg83qPbS%g7rV59vE3=FDj2nQX76(Af8463F`>XF)j
zs&)tqc%g|G)E8D|2F)iy3aE*&C<B=vsK`(c+wgN#6XF9<qEn4USg;lrH6RV?2=O&Y
zC8KHq!l6h0A(?|zgdc%5N?8~fRJ-8n>zNM1YCn*~R76l4!%8|G1_ssD2#Z(4djB8?
zZ9#~ygH~D~>s9x{Enqqh^D!d>gX&47v<0q?LGdrZz@T~+5k$z%aMe2q2hD<3qo4vr
z^)bSNqaYhW803NX2=ODZg(@J6{~^p-1~Z3)fkCYvsXfn+6qjlm2n`<4CKR&;1B03g
zqMFWu`Rok?gBntiydPTTgIZ8(t_UCR{|Ry>BsZxALJ}#s{eKIVxL6n%)Z!39x)#=+
z2TkZ_Ac=ztZ>U*nMTkTP+PVW0X8ORupw@s;Uj=n2Xo^~`9U;D60M`BoSuhddW5ixS
z1_rei2ytUr!{G)4gW7(G5B`7nz&sI_+Cd&T3m0d)1xvgjail0a0xKstG#D7v-XZGg
zI#`DR<RGN#^@zvz6;)jFOpIpJPt<UkGn!4S<q~5woi1L>)y8NreO@isJw}u5wRK#!
zOhPF|`33O>iA9;k$?++vWtqvT+s`*}X>;?KFgOQ<#)m|N=oy=CXY1j5&%|gn{aYW`
zO-9q{7y7xp7>%b(PvDYbG@NcWflFh0-2^Tr`S^IZP(SAoPk+Docs(O?22{S;^!XFG
z>=;d_-<!Y{$Y?U1v6@48y7NRX1wmspl}6J`CURY5G@R}>iEHBaACtIN3rtL4nZ9^2
zmkJxC2A_U!8k5-e$BVg?8JUy{rgJRi(&vPP22+E_bcdx}=A4jp#ng~6y#d69<Y=ab
zis=WIa+z^~vJ$Ad-Ow;?8HfvM3NbZInC<}PL+WLwhBeb0mT{SLLMkDqi9XX0fVfbz
zCnii=&SlQI1(b{!m?oJ_cK~rA`}>$Cxj?v(!kKAO2!spS;>a{91;T~&5t$~HfVgH{
z&>fCUlUk-Xtl%;ef|h_xlc4PlGlA(RR&eQYL9;#6i51gUa+z^KS3NMD+%eq&%!gFU
zOeYUaZvgYb#Rmh^$rIBLtmHBig087#Is+}Xj@wS>SjA<|IAOZODlU6Yh@%)y*ryjR
z<P@Ghdli=o<L~JQR&m*JarlEh%e;jHA}76?OPOmA=n4-81_n`Qh+y<;E@h^R3#K=$
z=CX&z1H*X<h}{289PHB{t>%(pTKr?$8ZJA~HG2+gxa_!=Lh5Zs>n4c8*=x9zxgJ`9
ztz*#dh6vsU2?{`Bnn7d6bdI%LW<r+G_N_ChaMoa8V6vGWu$D`Ys|K3$)fpk0XRqZ_
NW?I}h{lHo-1pv=*hWh{j

delta 311407
zcmbPmU+ckbtqFQeixVaqgbCH3u>b%6!w0514;Vdhh8@?b84Mu6JZbO52jYST5UFDu
zVDw}T##u~;mYbI_-ec5aX85AW!(d{^$e>&#$7o*7;_y9@he4rCj?pBUwc!hhJx7nx
zq=mI=@)~AkMuy23n5CGw3?{!}mS=phnTKT+lNd9@_k%nPFSwR+nBQY$P;j?nG;v}o
z*nEafi-n2v!{#4c?^u{P4JN<fU&geWWAX$6xq7C6FA6*i3Yv0^CW>4I5Vjtpi6WZ-
z5*s3}&c|q?$oT+C`~rf_(Ewp1%vr(kK#PNc$w2|8Pmzb=g~9=*7YvL_%8vvX%>T16
zeBZ1q$jijERA91=uoBaDoyiHp@{9{MHwc@tGOg5@yhEalX@$jR1If#5j2kwyDBR$Q
zF_B?l2(ahaz#-2R!q*^hb>0F63G>MeO#5~zIG9ag5HOo!|B?F-*PUC%+z+@vbKU1}
z5V*{hpt0Zu1B1{DhYL(E<mG#B)$l*ye;{z#d=7&E|74+yFXZLdn*V1Im|UPM&wAkX
z|BV+XPtgtLJfNK*zz|@=aAEQXU2(<(lMD3aHmm6wGD<!$kFsYpkzw$fA2a7GNKyB!
zz3c%t3?L=@>py@*UdT)52G}q%K-r-IHjDyLwrzk7qXLwz8eqd{0A=$A*f2Uk*iv5u
zY#0Ne?7IOrj0sTo(EuC90w{ZJfDK~<lsz@ThH(OfT`yG|V8gfo!jVc1uwmQ)W%~x$
zFoON`LSD)=z=rVxR9rT|hVcQE%^G0C2=##E+W;FTs0Spk2G}q`Js`O^z=jFx0m-ES
zHcU_tNcINUFga+~CkQaSke4hCuwjDwKr%MKh6(BeN!I`yCa4c2bpvdepgxck4X|N?
z`at4ufDIGW0}@XIY?z=PkT@G)!vyt!#MS^CCa4D_<_6d>K|LVRS|4D;1oeSLZh#Fl
z)CUrw0XED~A4u2+*f2wVAfXyy!wmI-1aE*1Gc*dszXsSaLp>mVH^7D&>H+bi0XED~
z4~VY~uwiZh<!}B&LI<@I7#Pg&F;3Pt+9LYWM2bP=g}mHb4i=_p^Sky7U;kfyaPk);
zC#KbwlP!$9SvP`m#^i)Nk<E9E=P@xYXPjJPCe3(u@(eS1#?Hw*%!(NoPS!D3W7-!w
zImCRk=}8V&rYMkECK8Mc9MViKCXx&cU~~WN*$R^@K4#U(!Oj#37XQCIak7m?Fyqe2
z6D-sjdnfO(kguP>-ym=Y;#2{UQx_E9u`3L)VFrgaNEb-H_>Ns;fDQ8o5F3;zitpG>
z46tDahdW5D_>SGe02}5DAU0HfV}K1aIQ&6k#dquu2G}rv0I{L+7Xxfq82B3|hgl}n
zvj~7BFde}Hjt^8vuo!^ULJgT1V8a5A8;}^p5i9{9HdKCNfDH>cjzD4%N3axt*id<p
zBO3TOn_87IF+SY9#>S12X-nYbFSgl?7bYjzg)=^wyu+@Yapq(P`+UX&n>X0UGctbI
zEZ`W&$h3xca)FZ?6DPwY7qQ9foJ1J~CLeKfW8!3(T;L|nC@@*Wc^%VA+sQYaA!@W4
z1t#mbn1SR|T$C9FCU>~FF)jC<e8EKzWQHqP-qj8y57FP@8ppI$cJd2Xko;r`H;^71
zHzT-$%{^{O%uIVZCx7q+3#xd5RCsuSm4l7gJjKh7nQ5!z<SV{fAUpiPcKCr+C-|8&
z3QV5i=gz1w`GMbZMup8C{??3w2H)+Orht+xw-uLUfCZ<+<SPNmj1x9n1oAO4?dP5B
z5xku-U{lCCMyB;EHg5=B%ve8_gPAF6e}lpdP&x#qK~QA9{<q>NRJ;Ks4l>as8B}a?
zCV&EePmMwbC;|d(ST+P7vU?bO*k163!v%)mBlf&6<mImh*sy?8-wS#9y#Y2X;8gZP
zUVdqS4GT1P%l8J@usq=R+k7d!keM-HvP<-FMup8hF;<Lnn{q+U09k7y!Jq)n636T|
zf}Qnulj-D?*k;}W{>efYK#mG9;dn6lORO<(1OFeP17Hzjjti4b;@TM}Ox_cx&bVOm
zlQ?z850iP~y=4~^A7SJuK5Q?@-ykrj*`}ewgqeW}tjC6P!se3rU5rc{Y$qEezGmDo
zSthBOal_;VN&bwTlRqRGGai_%lB~>lbFxRWJ>!ST9m&Cr8#dob7GqRmWyn5Y*Jysr
z_9DoI*$3=8vk%x_%syayGy8z;!`FWog>Du}Wn<)H6#)4Pq~`VC{VOMHr0Fy6-5im|
z&nWwVFF|1HygmEdO_CXyxaM=ozmS(t<*OHJ2$bi%Fu5gNo$<lsHR<+@8z#R=zs&e{
z^MQ<cj7+QwlM}LDF>Onn?2|3Ww8wRFPWC3Iy|$ATa?Hdwa~9vSy9f$E^H#VAKTOWa
zv1eR3c}>nbCN74_F}Yq$Tnw96<T^1iZAhK`CVv^zme9#l3f?g-N}XI|CTaY4<xWrv
z0GYzU#uNo{_##7)CqQKfSe%_HviOcoBSdcD*~u3QgP0boPF5*WV_K28*{4X3nQ4*Y
z<ebtpriFo%uarJw+UGlYN7-@4zndG%t(h4GChw`b&v<n5oN8&+yCzi(0vYLy0w9AS
zNsAR)PB1VO)G#Up*l>Q>e5ab7NztMBh~3BH!}g5D$Lub?{=cUY<R-W_E7pL`EOpzM
zn6?Q_-qR4owByZWfyN}JRic|q8ox0yEm57E({hPvh3sU9Ry(E@zLOhTyBS+2^R%fm
zKAmjRHjQb2;^s4Lvl$uBPR{6<#<b9PQ|Dtw#*34mbiHR(n0%$%oY7!1PmjN#gU4eY
z4p7>;k<9%dK#eP4a!!w#*3LDc3ZQv^+}Yqmc8wrut{N7Z09CF8o*M!oAU@A#A&&qJ
zu7b&DdZZZ}Cco&(W^9-o(rd=F{m$f`UOA@ib0)9pb+?@Gf_=XP2OCp3uY<r${<%T{
z{I3M0Ua;@`z~3R{0Wv4Rf@=Z)T%iyS8Ky`OpMSnkLx2_6hRHg8vxL@X!YU7FNG43a
z(YKxP=Hv<epO|(rOx_`3zxnWlcqXPT2R5rr)?#H^m9aTshB+f+@8*t~kC>RYsBX@g
zGo6X?z+{&B_L3L4|1ilYKVo1o|Ia56vWpL7mnqkS$uaZYH48woudKnq@cQ2_Npnk)
zgOHd2HRrfK@c$74w*&&LSQ{pvncvJfVRFENM@*|zCz~v+ms|>qIFp?W93VExsMo)D
zmQFsiP>N}%?dBH?+ZdVlYfdg$Y|XfF@|wlzj1MP^EYW7{ob0efnsMXgm?iRzg_CQR
zSjp|@g!$M+lA#1-7KjfqZ%^XnD@)WR8*f{3{{}hEM3Nx}qyi$l`{87frAlV|I6*=$
z<mFmHN<eHANrnWdl0=YUAaN5(h7TY)sJP+eoTd4U2PfZIs>Za7aWcy?YsLkW9hONk
z?F^h8vrM1y<K&)YNle@flRqp=W7_9AIbyjn<ATXO%Rzbh%yMbo14w3Focv|EIqwA|
z5zomME9|89aGKw;6MP{rryG38_8}-fU&zbV23WE_m^@*HGGpQ7Ei0@UKTQ6x!j6fJ
zVY0zWX~u_>eO5}TvB7KJ04p|w*Z+5|1trZF@^ZZ#%uF%hg4vQyU~<pOU`B_@4_0Pu
z_F1LG=(Nxg<be4NN*_Sp1=$v0!4?1#3!cu<0E+woD{cX>_y6yHYa+=Y0a3@m@PdKC
zBfy4RVDg65@{9_TFRYfX2iMzRn{3#iZ7Wa}zy?kdpcZ?84I8v^C|??2!v?D|Vgqd0
zpp8R$*8m$fSoNVBV8aHhK12g-*uagG7xHp{18mr!Z9}=I0XFQ=wqd>8*#H}MXyZ_B
zYk&<qI7nW|%gqh2VTU#j<yr%5*uf2u7xHqs0XFQ=#-UtjfDJp;19G+jHtbLj$f*X{
zutPl{#~Wb74)uWS*8m%Ks0U>42H3D~(3S=_nPra#*sw!=AiFlehW!GlWjSfBH{*lJ
zK5Icy*ReK_iGyMCkF|1490HRi)~PXZC`@)(7td%gdBHkuMu*8~*4<-b6_~tceLrKs
zWSb4$j0KZVY$#_;*zB;8o00LtWS>pSj17|uHi5!@!X|Uu3E=qoyXh>b;NIV$xBwDI
z0t^9G91EawQ$cYG65rpTn7|>!<PMHo8_tBuESrP8mU(i>ptejo*q|-Y-^&s~MRh?c
zqk)MG0|&^6j2cKUD8PmT+P*{-*^?J+u4X(iS!Rnq$e~-b86Qlp*y7C#jxLZB0xUQg
zCSL%H|JkC(#3?XYWvdnwr^4ibt>&@@AQk2}L8biiuiP_PBtf=;J@9+;!pTdvCV>=k
zY|}?pxNIt_!i|iRL$-y16t3AO4+_j}YD^m$Cx6*i&loVdWcz={jgw1u9A*B!Kyk9o
z&Mu~%xsy-qe8;pScJhv0&Ws6@|Loe%ICb)t-APiM3SgW6ukSU#Wg`f32_$=PI!rd$
zqs{nna?BoQ#=V;t>|thPY@NJhuRUYI<R^Pq3*I$hw*L=TZpGO!dBMK#jAu8`*nf<X
zX_f8fgoE6Sf)k3TGdO^vz(j<BDZrlFU~<i&)r<*~H4f`DI!ul@yozaS!eo{s>zG!W
zPTq1vi)pd#<OfH*8JAAhIeM6J@8l0h+n5&cPOdms%?XL%U;7#-|2ei=bpzPVfA^j=
zk%Gh(*v)F3h?3{m9>vXPjyEwe?TDNlaB4bC|F)TvKb&$>;skd~%x~x&eEom>OcN;v
z8<0;pWSE@62LIZwI635WJmZDQTTX+b_QC0P#s`}-&h#-dZRDK%<E%X6$;lGulEgLy
zn%}Zx1Zf4)5Um?lPM&a1TJ)p&E!+JN8Qc9(8PCZF&Pj_-G{0r143V)@hRCdcIr+mm
zbH)#oHO_BiT5CD^!TD;&50hgqs55??+;TygapmL{7pCd$=l~UU9P&(29I{Ly9I{N2
zFIcx;0EzW4P_O`n09a0hDe?u|mMxQWE=qw~L>(8^881xUaB(tY;bfOfQIq*@2v6R4
z=@sL_$#X6%F>xtuK5*HJk!dmG<Ud!W8BcDOxEjjH{A+>a<brGYj0Te*T)WNKI(g4^
zP-!Y~V>V;J<TW?CMOT6nFxU%s?H7XBuYav=-0XAHnu+o4<c{0xEqgh5Vfl=SAz&9n
z14t1EGgIvApIbsXIGG|rnoT6Yaubl`WH%Sw$!B7`F!{l~XL4(ELG@GeIa@=X1c8|B
zJGO}+T_CX_8LouQPww+E%B>bPzh!Hfd=XU*NG$LVSHWh1hw~Vj*4l2~@aQumW5DDk
zPc}0qOpbWEU-m2qJ5v;f(d<l7fq%FfCYwB)EDJ4d_WuPtkA*236u_Y93b5i@u=&Ze
zTTGxX&w-cSj17~0UM-gd7oGw3TpRcw2;2uHdH(rA2Lf!kCrsvf?Zvdsb8^IMcfq%?
zwkJqIfIatw$s1nFGv1wi;kB~v*5U)U3&B3*Vu}P=3bO3=&n>McRSXVbab{?H_2*XG
z%?fYUu`sQQoqXYg7}KiQ%`ZN1G3hOHHNR!M5v){($rWM5GEojLNOXYYA;vD<J6Ykg
zxL_|#2IRW{E3N~RJw6*VUf5jonV*rdadOX>YQ~1i9AB*&7i@O<n$O6%Ve*!5%8VB_
z-}uJO%y@P3lb>ovOISgk+TWm%0kRqFF$?YkAX`9Yf?N?`#r42MoTK9P-<_H!k_>8-
zZGK&5{4iPIw-ggM!)Be|c8pA0R43>BS<iT3vdmv+#t)kl{@OD#{@uLbA3G!C+Q}>a
z$1^^d%E4IAxOQp>qZ!jW+pPx}^%)s=PXEBjIE!gB<MbXTMlU%Y@E8NCrJPEy|1RGN
zvUK|wCPsZm$qzgU0#o|tEB?4OnIBxyf*cB}{HNQnFkVyQR(Sn)aVE&oAkTp0UjJX+
z3(8|4a|5in4W^s0GM;AqJB^Leo-tv%0~@2b>;e7;ftg^ne;0yV?JwlzSwZ>(thgPf
zm#{IaGZsvr!^UXM*f9MD8>2DfhUq-)jMC5~_G2$Nwn6Gab_8Fu`xs!sJz=^FJEM^p
zto<f)7bFj|BfyF~V0sTb<07V|lG6=17?l|pOb_8;oXr?8{R0Q%JE5JHpd12H4UP&M
z9)al}I2o-O7f#pVVsv8K6*;|ti?N<@!}JeajM9>zcw&70dl9&O1knVlPq{BlSK(&d
z#k4VY`U7r8b=L>xckLNp|JXbe7BXP7t#}kbe5hO^sQ5%O;sbXx7c-K);&dM##(KsF
z)6eiQN;AHk{(^_mSx|weMu-DcPeTmZ=s4YmmoZop+#2Pn5#r(C0jGJ!*FQEC@+1iH
zO?TjB)S7;Ym(h^%<8&52#_fy-)A#T(+VSx)m`E^iK}=cuayth<qZlL8t`pN01Q_qT
z{zRm528IAj9&m#xz={Xd;$wXMXLT&dnGmNlFa+4}fO=@hIGEwtkn#18WmBiS2r{}e
zKAheo$Y{pIqcHu5AY;Fz0ocZ0TaKDYGMs>$V8-JxJx7Rf9}@?|bRA(vdC`X;3-&iC
zZ-FbZ;Wn6_Aj~Mv=rFxPn9-auVEP7OMrp=?>1Tu)?KwAqjs3Ch;B*lYMq@^U=^i4C
z{+ghQiV0)_Xz&1JB1F~pOcN;v7LYhNR&00@rXLVt3}-w!T|$&mjfsn4x`QaAx@ZAk
zf`B~td=`1WdLaggO74Q`HKL4uOluEJKO@SR%(!#9ff%DR<HqSFVvO4v4^Gz+XRKyi
zJAH*X<1wZ^veOGB7^NAXZtsy`yvJ;|MHLjN#fNPIk!)_rK5GN+9|kD$IDlNpqaZM=
z_>PSs*rnfh#!g=#!<fwYbvlbI<9Wsj+pownma|KO`Xh|5f2}PA>42C9N`yQG(^FI#
z)m6bID@ZE9iW8K@8DIZd6bX(UXsH}v#WP|0231CHNl+_+@%5jD6G6%$CV?W9+hDqg
z8l%4GSCH`h1_c9%6xfmj(<9UvPwOt=ZsU>(sAK@Un!iDS9ppQRtM{EWImQ4EcMch*
zh`?Js8>R=SGX^m&Gn~Feozb1~;Pf}@jMj{Ar)y|1)-%4HzCwfX7SmqS=`EU!uNmKN
zFVJGNV`N$?F@1wJqZreY7t>E@Go~>uS~J~1hjA9u-Y?V7=rF!#44A%0m+>@X!t@S3
z#$d(^)9>gpN*jW_v#|J>-NWJ|_KYC6gGPBcq?nwGPuLwSK5loh_^91SZ+8ZZ8_)S4
zy#BuP>~sTtM)7)3>RAXXOF&v6g)e8+>)-1@9UC=}*FojT>%Z%2LFJl9DucnBWeW><
zDg-(}>cMjV)=vbrl=n9%fXB(;;@@|%f-27a4GIAub3myGBo|=G1Ge+^?_I4N%vwxQ
zElU(FKnf--P+)t(!1#zKL!cF;kS9T)8Ps}*ShDWq^bh)s(!47`T+mcW@F6?L$s3l*
z3nso<vH;PR`?pSVdVm3=SpAM(knQsu?0P|lgAL3OXa(th{e9b3h@3LG?aq?`Es_6i
zod_xqU&zZn<&_a?*t5V+)I^2{Jk)x8PaG@E2VgV)t?2|gZhounS(y1y@kp?EeS`7=
zkVMa-1__Wx6Bz~tjy)O;FBq671=#R_s)6G?83J=a1Jx!n3@j5CSTLE$Ft8=xv76}e
zhry!1K|#Poo<TvmgMlIA4}-;?{YnBn2?BFmJ~OzONC_}-2s1^#VBRVM@)#)iZ|~>+
zz#-2R`GRRj1}LiPJ$^A*fE3+c#{J<1^OhqZ!P|SeAAl5b+}*K&Lzc-6<l+~MJ8O6f
z1ZII8YkteF5M&@|5W4udT_Z^T^`9lZ>BsD*g5*J^w)-u+slj*b8uu(vyx~5R!Q}<h
zc5qws_8#sBpirBWV3TViV_*OKg}h8ID3W*<2uOkqy=*D}Bj6U#gV(=T?lnoa|9>Ny
z{{hI*7xL17O_nk+fz*I4{I{wS9E1(l;ED_pJ?nl#qDOiy$fEfT3P~>i8C<&mG;s0M
z3pL#S!~MYHKZ8Z{p9Nez_4Psx9P&&tm*-1=o&3N6)HUaNAusJ}B4huSr$AuxrF!YF
z{SWM~f`SfY2q;uuFmI{>g%XD_xYg_i6$=50y^xnZ3i2VyfiD=h%Rt2BWN**mYIw84
zYAPs2f}$Cox}|?_2?e!vUdT(un#kDy1xbSD1_CU3E=;#EX4Dov%O4@o3<`i7yZAwM
z=EB$CHy)i{W6UVWv^;V89Am~Jrsa~;1xy&ln3i`=*DzsJV_I%GJ-~!fUiE>;F9rp3
zO9oJ#wD9$x{osKco-`qFiUT?E^}l6;)2Em)8Z)k(e!_%Nj%gX^^cN<K#?!q`8MzrZ
zOb<6@RO3Fv$N^USd;Qz#5vGjFi~`eZOc}Mr*8B2D2(*D+_6z2+wXW0mm@>*UKAe8X
zlu?gqvEp<dGe&n=h2o=(8vGHEd<7bh^mb-20F6z){=IhZ^a3-+c}(kgrwf=fs!1)I
z%fSI@SaQfP1tUrvo)6Ol%o(Ma_9sryF=td_<7IgLd%xiHDdvpYhHF9b4RQ!bc|a+H
zLx2^p0BE=mlvV=D7y<&yVFOhAKm$|}(+kWQ<;-{$UjN=F7*NSz0L#Af8&nk_<}fgr
zh>M(h!N4;kz=9Vx0Kytz%xf^+#ey+UN`U46|Nk~H%)lTZ0b(;SFu6=WW5H+~X~Dq2
z_=kak=>h`-%L)btRu={a)&mR-Y%&ZC>>UgY92^V`90wQ}I1B#&|F;E%85kJ%FfeeN
zKxhyfgt>PxFz_s3VBnQ8kzv%Dv!_vFdW0pTa=innN5GgWao~EBFa!4=CVB1$pc!5!
zr<Ns3QkUmQ|8H-wkp-ot02^-5K*Rm{50tn9Y8Vo@8!Q&QV36*5-?V6wM-77q{{w-^
z*XMA`Un-XV&sD<|1CHsxyG%jDkuMk+8wwH_0!(BW-S+IUZVyOhC<v%$NZ9{i`aes?
z)_RAdPY)FE&rrAt4t8^1@OTi&fB-Argx9}!`~;<bo&!P$UNA5m0Hyr-^A$8e?Ti-;
z3=2$T?Ei!Gfd{wDdBGzjJa>dH@Z1psH6RyyR4`b){<i&UKox@n&jKMA6B!23)O9M)
z9w7&iN8UGyDKrG6F$7F*u;6&Xz|aKBJ)m-A@`7dhl8GiVEE`_P%WVZ2$MAq-7sy$!
zzb{mso?^`yXRu)+2Rl;)&vBsxFXUzSW-MS?0SPN!(0tlau<_I6LP4gtPn+j&A~Rji
zkx^08;Q#;sEDQ_`1q=)fpj8cL7#J8p_z438!yAws3{SVQVKlDy1$mkOGsq74qoCRK
zfO-ap_m6CQO=K7x-aoOi2f1zk1Dn4lGWI_`_Ar3l5_)?M{{v8J2D|s$W>!!N2B`z3
zO7j^EOaWC4p!VUy*Wb3pa<DQ*zL1xx1=$l&%-|5PpJBqjdK*wVa`S~elXUI$4>sT)
zg@G-jvE)>q`_O408{P!|27x({WMZv5y~dVNniD)Y{rcOcz0()iGD=%+2L&g@5sS})
z;*q-nl)xA+y^xn&%Toh42^3&AO(Yl}XeWSLMZ5*mzt}R`8*T(?c_A;k738)T^769E
z4UB(4;kv)UvL9qL!vhZRm^Rpo@4FSJr`RznM=lDm-~~6$K*FF_2FUxbe{bXj^|ru4
z0GdhuyJ05C_<(wb0RE?-;1$2i|3~OTKqW)Meg%tOke+~Kh5*o50LYxz-`2mK{=kk=
zT@>WlJKl2`PF$WN?+Oa(7xLn&(`D=#r5U$Qx3FhaW~`VVW6!9WEo1-lg}k^dC^^0F
z*v<}eFwX*^13U|aF1%o1+)=QAL4hB%^rF=Gg86?2Ci6KA8(zrEx8DBG|KR-_UIh~g
z76zUjLI+Ibng8(=2wdJ*Kdsh8#{R2zf&zGuD8P~l(zf}t!gBftdqzFRJ=5hK7{!^E
zubgh-z-a6m3JNxmjR7{i;5loaJwg`>_An^CkQebSSioQa%7*VBDHH_MFa*4RqR;`#
zN&6p|JO{ZH923U83#M;yV3d|U%0C}E|7Xv;090zcke3hz<?aA`-iGNf92n)reT(Na
z7=R+@eTVR0P^h+dO#Ti@^s4nf3=E7s|NsBqz`(#z5>UZlU?R-Iz%9=uGH>!^PzC-L
zY@H>?0q&n%lAz2A4)Q-s6+uz-LS85oRDz)Dn*>Vn5Peo02S5#EP$9tmi%SZu_xlb>
zh+e_F1qmVy0T7o7^+H@WsU7OF>AxKrg_7ZpnFu!&G;kka$-4p7(usRPbvnqgFXZL+
z23YZKFp*(lcp)#a7d9OViZzfp*b(1W+y$3Z@&dKf3!E60WB-Eu0n!eOlKEW|ctH^g
zS{bo7W`TzC|9^~7{(-$Q6PAOb5F}>)pa0+Y2RsaW<0pV}D$|#G28O-P{oqk$uvOnT
zy`28WiBXzezWsp#uZhfbK4-=hrnQ>WOPm=kW#=%+D?eat;QqrUto;9fG|05iuXz~e
z)%Q&`k(qwVnbCr24d-+g7e;fz^`O`XrHK6vy3;}B>vRtnM!EX+;A$U~dqAlqz={_<
zItI4-_fkV}H3?m#0m?bAe=WajBE|dyq#ms1>t0nzbnxs2c?ldFU5Yb6LGiu|oDu^d
zl?tQQ`?fXZAbVfPb5G@eAauY)n2}+>`eYq{kYGR=gTcH5I;Nm#2&iFjFcF1JxblA$
zIuKyYdto|{E2A`Mg@(`pz6OCSx28zt@HYs}n3te+m4AxRgn3uBr-SS_5n*8A{~~nY
zR<Tsh_eUHu*^?OzisyrJ23Ko#1A_%9HbJF9@gD{SkhR5s7z_ezctH*6J1^w9Y>WRe
zIC#{9CSZ6EypZRc3La7`W=MFK!gbX|X8JN$MpeeG)6cjv%Gam7kQY=9u;6{ba76+<
z;v8TDt{^V+KLD4W_ixYPe(*w`cWzM)!-jxVhJ-hZ6b(R?#+xNd8YU79OnVk+f>IrL
zxDOnbKbL!YR55_NG5cE;Kur|)7xJ8?CNlQlL8TR_KnJV)w%{xW+w?3qM&H1@1$P)=
zLm~@b|6FG2QN`c^ik$fkc3(lG90BzV2Il|m{}<FV7<f-+aJW^>|6u;-6}F&o2DOht
z27)3MWWnoi`#Yy|xHBs0tZw9aAaDy*s4FaFV0a<Vc9rL-&;|3Gc7-7IuYW9B3d+m#
z8`R59WTuC?GiuiR7TjSl097}j6b314)!uSQGDQTWG6X<0E&K}6q;?$SBmM?~`@wS<
z6nORv9pIlJaOZ_Q>rqfS21-HS8(8h%H|^gIYErzAXG;ae6iEDiOKUwSqrH%419{*t
z*xbL%S~(c%nZVWl{suL02P?pa15^ad_dig53-T!_IR@Bp6euMtFn}x$C}D8ms^=2k
zH(7Npl02v_bY)+If)GgTg*<C5sEFTJVt*F25-y;aAwao>fx&!^f+Y8R(BcA)yP*0T
z<gopU4R*;8*Rt}$T|0;6Ey(xnb6TF8$V_kYU{rMt`2YVCPRzi-u!Dht;RH+#0|P?@
z0|P@1C~iQ-4cNQic6UyH<H0D!rF<6RE8Y*&1w0w0Lt9~7{ssYX{<|&1{~*AUkAY{8
z(1Gg`94(;6!3%lL)Y}rEaY#^o%qQ@IfuRGm4h5vwL|iE7g*@le01G|^P_o(oK*xM~
zgD0c1U~fPbg91+hD3Tbrf{dHK!;{gDY4OhKKRg+&6G2UmMo{SiN=Tr3*+g8F>GiLj
zrAYO1<Lf^=SwSTQLLHBT`Ca?Q*S~hEns72OfD$c8F2IU+0jT)}G7BQV<LUG%UX1#z
z8(#m~Q9J#F7o#%kf!Duw=uZFO#i+~)HDvqM=`!Ao+N>8||Jq(U-NzfEXuIn45^sc}
zZD*%1@Me@}d@%ihH=~}{Hr;@oEC`FYGA9IB@qz~e1GceD2-wcj0CGUU4rYbdzqVct
z*vX7oQ?ZjlA;5|cG&a=u`q$RE(=B`$%^4l07x*wHCGiQo{<Q@@zy~to_1`^}Aisk!
zIHYBG3<8Y#0zh3k5a0YBb3^fIyTSl%4u#@Nc8n(Spu$gqq4=VmVDSYz#p3gJhQ;UX
z9E;D|1s0#NOPqejlTl`RfG?vcWBv3rUq(g41duUVH4Fg(#(V`xZ17AoRD1%G_=4#>
zd>QQ-9j5>AWt11R2vFsn0Lq9U6#+I}0@F487-cQ>_`pkTK!Ut?gbpY-^#2dg;$$$N
z!*JqrGY<oA45Xb07FXvKFrUM40VK}zXL=n-dn=y|ye|nJq<;Nt!CVs#2JnCoB&zvf
zWmluJMgM<uO9q42KlZpzzu?CxUk{nH1f`H4yFs%U;2E4onFSMW&)^1+qjPXDMFv>$
zK@-6Gqo5Q6N=4uh|Fb?66x!eaG0y?HALO|J6W$Aa2?BSx|FFoske8jxHwWZ?(2yJ-
zsDx^K{d4C|m>Jp$Vgd{SmV60d0U7WhN8{^nYi~}k@n@8**WeA{t$~ec@@?Ri5jtQ#
z2eRHWz@D!F)Q|!#xdM5T_rB190DHa$(7Z2*50c}J7Xptp1=#a}BLyS|a&>?X2RQP0
z{)6;zf+LmxF^J6#sbP%yz!6%XmCWD}U<}a=WrH<B*c@O*d^JJ`0<8EBfDCy3ZLJ`0
zGbA=ZjtH>gTLAJI$kNw8cJi7?GC}hJXt@b*0jLEC3bp`CKJYpLkh%aXz74N`?AXd7
z%@pVY3TLnaHSP_d4hYClkbxizL5g4h+>vM^$-va!pbD<fz-o1Q!NJM9Kwu_FeSj6;
z1*lri>1P5M73u@5_#W`?7Xr`S@iqwD1j%yG<dS^-WBb(GmXLuSuu1m33%<|i0WVJg
z)#w3MeBf*gQvdqrc1uuU33s6u-vbkQ9`LFIh+2MdD;uJAYa_3N5O~CKeuIMZ0#J<!
zavInxmi(ZRk;d2GR?Y+s@a%6;0Ox;DSCcnJ2;32Yssl}EgVcF)uuoqX$S7M6E)ie<
z-1-y6CF*=1c>X{%@-hhA0c*D6hos-1TNeh;WJus;5V#-wnIU0bjRJV6q4*C2I28og
z^D{u$p!CWQO|P48g3OrTpa7n&1BDETA7E9_F91q@U@v}KaS+ys1Ghg7nH!Xy1Q<YU
zuwqMQP-ml&+mJ=@mLd0p*S{CFatJa-fP#;EB9|b@=j;wf4eSm~4dzh{3iGVy-vwnX
zHU*;w1_l-e6B)J&o&})!M*)W0pQUp6Ckr*0Og|aKC?pDA^Z`oR*>l)-6wha82(afb
znEoM%Q9Q5%<W>`LsaXLQ{0c7^z>5>rpkfRlF;LzHMFhwTpc>`%ujRfV=f02^2d^u7
zAuqL;=P)$?+H*gco)OF_lf`pD;0~zK0$RfbY7K%MmOY={AbUQ$g>pkbJAa43eB}we
zJIv=W@O1yt0DBx{Yk(@hfyW*Oh5iOL*z&2y*FV;*Rd#^PgMtDpz#g>5SAiiwjX8ni
z{`7ajjMDYS{0@8x0#mNd;Su615o+LhATXIjm?_4r*#3WC8hpf-2^8s|RAWBJ{(pcG
ze*m9@z-3VXk}pQ#3SWrO0j?OXJLVT`Ch|`fI$$Ek;K1h~aNI<gfq|=tONPHe;0j-#
zfFxgwKonntKn(XR7Af;62BsH`n;hyvAyRzV_T%jx+z-rmF(?#Yvwg_%Wyb;z5hnNI
zE8vBcjjw;MSy+6-7QC7)7(`1mxdh*|y=X4M07<sL_kklh__FOs4jHCUt^zI@{;5I-
z%!(NVg0I;=+*f7?S*3m1zR^U4fuZ=a?M4$p1_!PQT=gK=-QjN#2<Gn-kmPR>h~lb(
zxo#skAVH3}y_x%gSuuk`@Lk)DAjfhDGev*~&R_rDs|ZS&!B=cAa!ulr;cthOPbSY9
z>_CnI?N;DQ=VISC(O&h-0~TpM2Z1{rcUXioHZy={)A$0s1uk<>W)T6k|4skf{|^db
zP~e`zBFa}PG=YPeDJ&?M!GL=*iwxf!p$QzUOrZfb{0*SC4#yo98Bp5F*u&5fV8ahy
zcXWID!B9rA`UPn64FNX%8$c;UY0mloFu9C93^TY=xr763_#KeUvIwx@2lpe8#3lsT
z@Pn7vnoZ#lLejq=z=l5oq%LDWg8|6=j6I+}M?HT5ND%6{fB+j%Lrs9eM4kcEY6baT
zCSwo7iU1pa@bYnpS_OuTJq$YnY#6|K8p)Ca0X7Wa)#M;`8G9IBfQGW?l`h=GS0m&E
zvNXV)3%nxDV-IvinzucFL)L!=&|nW_PR){k0(UEy3|O%}{{nt{A#lzOuz-Y0fEE9N
z;3fuz7Y-j7f@d>8C%Hf^OD=`!3gL{R^$7wp?Vxp0(o8O|zb&{4Dmg$U3#ga_8>-5&
z!Tdkd1rAoGV9;thP@>~26u80#9!_Fh#Q#9x#9ju)RVMNbdfoGzc7XJNu!%U^gctH+
ze*-M|AMh;@5WoJPlY{F&Q~agt(*N5YC<JlOXPRRo&Y-||dp`e%_6G?b-2b`cx#mxo
zi(nM@-U=EjlwE6fje&`K4wuXedHJok=Wu^`{cW2q$bFz?Z6G&-GS~Nb=IYnqR_Q7%
zVPN2G5I6=FUj`nD0G0QDr#D0}iq)??3sU<+UXB+eZ$1ZPzMLv3hx30BxXhO(AbhD<
z`gdE^JbCl~3>!c_Fa`#Zt!7&p4EQ!HOuKcB{{h!kF0oe!4lpq=FxW6KFjzoa{-D-B
zG6u=P_#id}*E2BKWOcAB+!W^izc0Zy9ApV-%MZsMt~>l4LI*(Gd0xoNs)EEp>5;!d
zV1D}pl_V2+o&^2}0>}6}gc^7o1n%#Dpa`ycL1pgiZ!1)lofN>00%d0gNJIDAa&TW2
z<Vj^`1(?`Xa4`fHbc8Eh3kngim=jzKJRb)ZbAgM&o5{*942Wv^+j3p=C`gM$*%hu9
zJlYA;4@v<X%uFExiX06*3Ig?)O+*<$Q(0jz7#Kaii!%uzb<;pa)Me$l-|w2wVXgVx
z!NV}G#va^L0{P&Dyu2%SJeSn|?+TzgL4a!t*BlNpCMT{rTrpfVTz5ERm|{)D87A-q
z2>j#;5ctKvQ|QCGhw*p$cL{v}iGld@f7B}|@m&zO&;Lw7{_=n6-;*CGFmQ-6#h6WD
zU;-7WFBljkZcX8Tz~3NnecuCn@NkLQHHHm*2S7n?f1ZPtDQ4b&6$TS=wjV)z7!;I$
z^#2D9JMbn5$n-ZTNPHJ&65u@`aD$t{V!?NA#`i(cBIEmXCV>ER{tw*sGAuH;=Sb!7
z{}JK?6&)a71lTh$fPA5BvHm~EC)|=Ok|t6NObxdhKX8aLxpN!{ikUu#fdN#Kb2qTa
zT%IE#&)vo%!!?IX=5`PFgXW1&H*Qbhf56$pHHUK!mk(DC*O@LsCGe_RXz<5Cga5vV
z`B%{Z(0;Lb2?`P4>UkJIz2e}{3<`V+0$0Ax=V9P05jv3lhhYIIXMl1=@dJi}pkfAv
z?9U7iphUTEzkNGM|MZ9`Mm46zd#5)<F)G(9+_sb~0jI@Z+rU$QFXY)mLDA14!{llr
z#xQ~BgTN!64+2kk772Y=cQF1g&k~^zV6jC)AA+_qC~#YF$@0$?I$-vl!GQ08z#+az
zLI?OR2pls1&)@*6LirvET?o3ypl~~i{{d)>w&)v!LeMq_1HQjP2a2a>*%$I15V*_#
z7pw_HUkJL(piummK_TcGgF*2(27}vXQaR?93Jm<;g!o>_%bYEqZ{KJl4qFh*D;i+I
zAOKoUVj{t?0n`u#d*<urr)C0>$^Bab{10Bp%Uqq_6V0eszYaWU3i2SR*#ZjW02|H+
zpr#D(0f9U78+5_N^6Ni4!F?&-1OaZ4+M9X&KOky3Ky}2?xd#+Zm@Kvb2o}@l{a_-&
z%)t8q)aZoduK;yE283HS)q-kbP+LQ(egR`L$UqKOrg%^zhC`Ss#6*n2$ZRWvoQb&o
ze`N{z+wVUvQ824yU;?$Vct1nh=_V3v4-f`!ybBss;%yLWxR`za$JA^{zn(LJh5I=7
z0S*%x1_2Wp1`$vyEk0;F(S#q=&lO-OK4{xm4;H**yOD#DDG=m(4o0S+Hyf9Ldx(1v
zXn>~d8(;rk6$vX@z@hnVCA>%i@j-I0e{U7Nsm}ic<QWqwCTKCW#uFq55}V(k&;d$9
zAijwtv=Q`U8{^sOF0qUX^`JH+$ohi&3=;y3`4(i=FgWl!2+V13(kjAiLuy%p)Pkno
zL7hcVx4=Y#0o=C(Ip_8F1uIRY*ukxH6A94nMbKg(z5=k-QXCMceP57h!pgvqv6KPS
z;;#p<`U|jv4UVjbuY3eq6kx$G0BVeyNHR18Sb^ty8ejifp9nG#<TsF9fE5FzOYv(x
zc#{c|IHcR~Ydv^n2Si+efrF9B1Ei0Gk;zRvp<V$b;13co;p0i*U}W+Fv0pH7I&d&D
zd3T#BSll+|elWj50Ti1CywLuPiMZgq7xHXd11uOoML`VDSD}W>bEKQE&*5-#{>czx
zZfXCY+lDEI=ey8^>vOmzxaKg$@P81v&+|v915{9&JZDhg`5`p(R{a$2zvln#KfaKc
z`U-9{g9ZS;ZurWxKp^V<`~{#OiZ&5vT>?riFXUOT23Rm8@HPl^n_sqXyjj5ip!l-w
zLJkh5P!o0r1&|(4$P{0-Js5n~cH!&qn;wET0D^oDnm&Ht)L;;N)%M`!Y104O4k&;p
zDC_qvP~ZX;+us(j$ea9OU@{S7@ampsp9<<4etFNdmE$XyFv#)%MFs^9VJ3Gj0j^Lk
z0j|kh!dx+*iUnFYjJbq^585^cm@pV{P35}6afj<pkST*h@e~GyPZI=|a&6%f0d2ba
z@}GyHcnX6-Pzav@2WYK;G?NQogFyWiP&*h@YMMweEGVABPyowZ*$oU1#jOkt+1(5a
zUVmNn6x5amwUd<=F);9D2+T3tYT$6aK}MCYRLH?Z%-)!<MyLbiQ@%1G0TX#92EKfu
z7?(W^9^La51WZI2MfmcCL`*~&IY5qwd5B9mj4S^0WPuir`&{?A8@XiorwFkHe_&8B
zkzg<YIi&c$?LknGatMG|$u++Iy7H=NHUkqMJEZXrDo*$qgdqL;Z(G6r)8PBI2d8gH
zU=*<`k^%ShAnE?=N>`9-kP}TL7<fRYnn*JK1LvEsD|t<RF);Bw5aJ5HY`c-?^YniS
zjGC5PO~hG0@N5t``a)jZ7F5c;{<cKWM2ZjGOqt(c?hDG-{0#z8V8bLB*uaMUSmQfA
zA(2sxX<g>@ibO^^rgfUrXCyMpS*?8uN+JF88o)yoU_Fuy8c;o|pn2B)4T@m1LFEKU
z9xV5LZRPY2iHu52YgMO<Brz(<t$~^|uNUMQkUEfhu-YH1Ri}p}F>2R0WdC7+jN#bx
zO+aE7ypR`J3gSbmdy}b<Ca6d{DDi{J6HvAXl_>$1d`PXcZMo>>$_shXy#bbd6DBN}
zAoPNPscOywrG~(t3<Uw#84@^H>zN`z?h3480If1^eEn-_CU~_B3sdxsrQ8odHO!tp
z`&&U-J-~_qv<eKQMiHckcY(m1<97~%%TuttDZ>WH<gnrkP`Uw&nJ^px(IzrH0s-a>
zpv|wB!48*UPzbQ(JCGfJ$G#J+Knz@PJ>U>yinvt_tKXLdf-C|B9!OJw7PkSfgTNh-
z;h-L8fCfVWFN45U5Z`=`{l)-Qh6bJm0%tiynSwcZnc_J_n8Kz%NM;o051n^FfeSR$
z$05(;%eP=UTMDDLuMQ)_3whbrKuKPM7xJ>Tf#IOejsU|8c{$bqQ;?XPY=8+bXaVN*
zNe@7a#~8HsKTzP}pCEAGM2vwccn(9r3wgP#Ae;N1Os`8}R2S7@6mVL{5Md(E$icfn
zK&E+qLxI!!>AO-GRqQ}p+7%dH$jjFT=rAh0keAO5&|&ysBG1UxJ>PyUC<p@77zIqY
zA+@n*6?+3{m<*g&zAt<`T_%-L&Sv4-+fm%$RZSrEj$0U_9Jew=a0oC37vHf5*Zu)k
zj0PNROko`SOyL}SOc7xHzZR_I;F(^Q%BYxn0JP+g=f2PZ=gABapfGiw!w?l<&+~x)
zv(N<oKSJR70Z^C+Sn@3}k$^R^H<X%4u`dAWg~WvdLx2?{q%!%re=kTqL>$z^<2W$=
zPby<JC!|jKxo_+Af;2{}`W@h5*cbAAg%G8nu#jmDPy>a9Olg1`!w1m749H*Jt?UfN
zcWeWdpD=)ENA9Owth^2aCqU`37_{`Bk;%9Cj%^`Gt%(c+U-3~}LsJg>jV3(y8<X$Y
z2AZF?Z{%QP3fRk|Py|XYrkeJ~=F>IP86Da7><!$-m@vH{ol#C{kD~c4n~5ODfEI8D
zNil+JU(mWr4sOuyfIX(uH>5M_bAo37=d?GdRZM>Y;%)#3>CfGv(-krp)fp#F_sC#W
ztKYRXu!<2pTnG*f@b-dTy@6JY6F?T2NHXYw#Lds!OayN|__My1gCDY73AEuIA_iG!
z1yaw!&lJ!9KtSg9Wd0xf5)^(p-?5o!BG0ho_8k5n-SZWtobT97Hj!uOx;#f7#5XW!
z2UUiD7QUVSC4;fK9xm5B-&Pb9N`bQ&7l7^fxdXiO_l3NyE65%bd4?I?^A%v`Eqfs^
zKNVyq$n5U<3Pw<SHh{#s=i8Tq%y}Wt0a`-aXd=(h(mmha6{=<)RE>V%EGEVU(|=?#
z`pX)a2-|PuZxFZx$|CzGD`*8uF&==pW82y3DOrq0R@+hoZ!um-J^+abP>KhI6Icys
zEi^_L?E)`f28GA;3t5cX^%FqNU{K3!e}h6q@f}-7kas~b6kx^p;Pua~;BMp#c~)>d
zgUX2jdxi-hZ$bvL6&RdnGDHMeF(Qo;Z~1C|+}03eCMbwNW`djqGV}GXb#Fm6)BXmP
zk03do18f3!KnkW8WHU;JgSK(pu?>9vYh5i!2gn4_QcCbDM#h~rARQpZ>33~ILGmVC
z3@o6e3o;R8dh#i-Ue@9RkliKw8&nuMWSBgrKgebjt7l?({c|(e+!yl9kc}1WOi{0Y
ztrG>A1zP0~vd?2B;{y=Q!O0W_v3D<vi97?J$7048pw*el_ie!?s>f=^55;$F6Jd6P
z+{Lk)i~IGjHBZw|*oK15U}lN}i?c9AyVuWQZ~=|Ufh}X)69aNM*dv@wQ6TXbjC)K#
z9spSaG8AMu$WyO>t#LI;X5a%E=scex;!1*yEGQr{<=HoYik=(E+z&Ek*mro!uxqq8
zC^T>^=3)j#VSpv*)C^ED!vr3Tw0Qk<BYc>^L>x4vCBVSJ%@h`3!vI?8GK)i;DdL5^
z5O_WaWB|CJwPZ5bJ|mYgO;K)rC%F1#U{DA?WOL9Qv>fQiZtz+Y5P$N4n{LyS`WbbY
zc1lj4(9fvFw8n7yo_<C*ru7%6vrJ%I#<cC>^feP0m6+B=PQNgL@g38ypVJRaWYl6>
z*f{;oL`EsAg`O9xq`)<y$xg`L*V~rdkY$(O77AXdl7z{{fkF@=x8UY<he?cDMvEOm
zp#};W@G?eeCKs?9zbyt0!FqzlWtf~ndLiPA9!{S#iBXMd)y3&YCNa7(ZBm@hGnrA7
z`Rl&7(=8@5DlzR_Iz47GqZHFZ&FK|jzUuTjlNq&`_MV-7Vltx~)85|cFD5g3N`KwI
z6|}s3Z-deXur1O|E*zXpv9G`GZ=LQlh0%>^kLmO&QyA5lmNib_GlfygYWG^ugcV5b
z#aU86U@kJb$-wdY>+VvJ&meM=$Z`d*zwWl3E-;l*ifQx3={jI~=5&v#jA~4~YNr=~
z_`6)E_e^EfV%qt3`i`lLN_u-zLG3J%S)gUXAU4?NU-y`T>;#LmLpMx*-RV1>V;Z9}
zBja?PX^cutt7lFRn8v8Zv~TP5nrV#hm^N&jo->_MjcKLe^eNLpk#=(Wf$5ABnLqCj
zogOlSQ46$areOx7k=%YmP%LnFG0C(yDBJ+s0SXT`rr6it_WhiGVFsfZ)4r3_U(8@s
zVp=0Ooo6Pa9@E~Z(`{xlYB4R%oSre0QHg2K)9F1k8P_pwcsku?7NeBahPALT0jC0J
z%$n?Eh<g2X13bJ;b~1q5VIZ{-e{QgyK4BK49n+@T=@(`(ib-t(wP6FnZjxaN0EYp{
zU0*lJPMggr#<cP6bcxxFa#kDRO$1QC1f&dPoXIYRl-FN3mcp73pdbZ_gXB$iF(keI
zy3uxe!E8n;rj4xAduB6cG405m{$n<yp48@8(0CZgS`!I|6i`bar0@0T&AQVa<}j+6
zEdZBEAbGI(x3wohW`g*j)<u8~7r0v*V9%^zA_Z<uEPVZY+r;T}<}gMvZT>m^#~el_
zrtJ@>%gkkTQd$ZwT|s&wX6=LTeu9|AT`;|2E~63CrpE1C<}%J=W?K1ndcZ=)D5gaR
zx35{qn8nDnV&`^=#f*!Xm==m|-?Nmlj*)3A<8+(ljL(?%I8Ikt!I;FfWAF5i6^vR;
zJ5slAS-}{?vAtm<qxmGp1JeUeGD%Fo;LOC%D1pTO0bzdtiQj;*H#jn}G1*LjZ~|PI
z*cl6u*bgA=0+9F#2zvvF4OI`;><*IvndI{UqUr-k6;#5&m5H5E10o&(Vk<z{1t4|?
zgbg++W&wgTeVQwiA|tXrX;4`KH-vEpAod1`t^g2Q0Kx_v*9^610!RX85{O-aq-a6|
zg!2I;0SzkwcP4h2)domxu&Gm^&L{v$K&=C_BOnHW**hTY3rK1{fY{Jb5b$7PXGC_z
zRj8q08@^wF=mvA1Km&Aw6B8Sgi33yyq#tS)SfZB!BJlwv0cC@=|FnQe7<e+VGeRW-
zKx}AIC;+jcmV-?)nE}zT0VDzS23VrR10n(D<U$=E;Kjtw7yyv~>wu;_uy_YVyuh1@
zoe}Dc2_W@QHdqZb(7@sxQ1u|2p_YNwK-pl6VTldQ$${Dc=IB6u1U3qssxr1On8PH%
zJbi*Q6I*@l4#;6^HBh?B0?cQgv;|Bv9hd>8nI~-k(@X~@K<Fuu^W2yxv4Hu^lQ^I>
z1C-{0&=WsE=^tR4X@3WpW}f&5OxH6{d;w-KRVhH|{S^@U7Sy6!P>c6N502X(0FmDd
zRlipQ!oRfwLQjJ@nCTW&{u)&Og#{4#b5OeW3y7cdfvFba0OpBM3->_yOnV-H6ntRX
zp8%m>zk<>)A#@$Y$4s|iK7xc8^TZ`!dFF`_hcHisSjar_!1MrrCh__UU}>fUFyRI;
zpLrt07^c$_U_R5SBT)JPgq{lZ&nc+0ra%Ig>C_E~{1j*ap91^q1JhKf^A14GJpi$X
zss2C<SOfE<HDH?Q7&PEcL1L6?3N$4gfJFpU<1MH|4nzFOv_Ar(e?KI}Fzt7M@b^N)
z?-n%NDxnTN4)J(B({ZRl$DtNhKm-2uYls205OL;-5T7wmf;y-Qay}sQq&*OIuirrE
zBT$FbK^;;j01>Z(hQKXoim3#fSO0-&57ft%P={1PqJpUs8dQ}95CbZq22X?0P<4AC
z4rJN`Ht+*eCDejjun>c)KLb+_@j25ikh%3AJ}^~6)AE@)5Q|RBK<GWtpsIxWq!N<0
znFT=_KYU=i1xZ>=(;(tZQ=xG_73!d=kR-=6H3MSaG^j`SK-JyKu>Y?HI)(8TG)Qkj
z<8m3)fW6Qls}z`S5X>Z2KLz4)#_f<?&A1&J$ETs{rb2^yDlE}Lay8S`7>EO=Kr>$j
z)MJw&QOGnAN>@Nb@G>+BT!Mz!MM&CFW~zWjQ3X`u7Bu8;K^<~y!S)-$O#c{}Cd`<A
zBb3RHX~Kf(8evRrToa&PPiC0DBaBHOmg^FsxhE0opd^ULn3A9#NrL9GB&Y+Ep!Os|
zqc{oTFs3AEj3hxbM-tQnNl<qtK|P)Xb$@*lBqW)VpbkiaIv^PulF3kyB}3CtGSt9i
zm_MK~mJBr~8EQ@nOh44T6sQMMph+kNVs1Ut1gMKrpe{~<x-<ovW>TO&OMzOP0`*}E
z)B!0l{ZJoGfI27z8ilD)honM7E)`-iQz|$!)PG<~h59TNYGEqW;8du=sZaw`VFp5d
zlm?BWG-wp1K`lswM$H76gP>`60yKoupbkg_c?^{6CO{2NgN8sF)FEjw4bWVY4o%GI
zV3&VjN{5D2Iy6Mmp%!I8El7uYARSupWk4OA0gZx;1pEK>pj?*$RhR)Y0IDGq8g!XZ
zA7(=1FcX^1Goe1sggQ7AYEBl^f=p=0WkNlY0gb{;sQFn8_VwVySF@l#%Ys^v1@%D|
z)PO8#2xUVp&W1WP2c{kx)HyJHQ2A_VNM%C{&>U!P$%Z;OC!!uw9^^n>mIICZ9GHPn
zi*untmkV`3F4Tv)PzUD1)Ip;v59*LSP#k~wz*G+9mqQ&;4s}?bBD6%zgT{RxG*0uN
z2Irla{vnD<oRMK#G?RQi)YfvCsZh-mpm}ZrG+ZY@Q|JV!YbHWnKM@+A6QS`r5gP0h
zp}{y2>brcXEAyeDQ2<pJRR}d87iw`X)FHXh6j%t=Pzbd+7n-$lp}s4EI;03@4m4hJ
z7fct3VG^q^g7S-@^2N|#D~9SXhK5cllwS%>Sfx-87ehm>44N>@pbjsCsxO1;FM~#J
zF4Vo{5O>ux<w8?%Dl`Q4LpAP)dhh_0J_40L0CnIINXRqr*Fe(K5giEq>L`TX3w6j*
zXh<J{2FwwN!<i@T1*uc{z;yTwi1C5x2sDKrg=l2l0C6GHfeq6WVwuDfQ^3j?c%dG4
zfJ*O&)^D#N<}w|Dri=qnj~;^r00X}XSU=PLMhJZiYTYep#ec+O`;Azp3|1+FinO$}
zBm)Bj1JJ2f3=Cj?TAG1@!S<kJrh7cw6AG9l7?}($r&kp+*>W0Ma&dtbPCr=4<hz}>
zh-o(4c8N-+Fh=pR)S}|d{5%CCJrfgML%p<Q6C;qy>Ah7<&9d34sRi+gDJk*ksd=eI
znaS}fsb!hTsl^}_4BL6DnbbJzw{U=YAVPZw1A`6+2NMHGNPvMsM}UFBAOXYy$uck)
zWH2xox^S?8<;55n3_TbajARh%jT9Idj5;_N!SVtO3`P?e7>r&Z@joyy81LX<1<Q*u
zFc=?TV5m3Uz`+3)uw!5_-NC?MF2cbM=4UW4n1kjjK0qx1jWqmVV6eD=;9J~aV6a4T
zfTaQhgOvcn0xJmy2I~l@dKU%;>jVY{n+^_Uu=z3!3^o%O>=|qW5I(exU|_J*;9vnO
z5Mf}jGhkq_b3n-3c`z{8WgvWHS1>)Hl}Wk&2-Hjw1_t{R3=9r72qg{<3=9qhP`(fY
zgF^)agJTcE3dacy432l8ZWLf(aD2eP;B*He@AQCy!TAG}FT}v${DXnP<qd-G@_~V&
z-t`GI(8L%RTwgFSxNU(d5Mf|&+rhx#egMiBVqkDT!NB1D1L`0F1_loX1_qBG2oHEN
zFfe%E;NSv>fdm7C_X7q7pBD&upAQTSzAz69F);X^V5n#CQ$hH^PlJKM-vtp1{vHer
z{uiJI2r)4D-(X+}*n^M{IKaRVSc8xcY+zsroP%&+-~tAQAPGby1Sv2u1pR>OmtbHB
zW~gUi2+lz$2rgh?2ws6OAb0}<Lr4c`mo+3EhfH8#2#rC=hbAyEgoz+L5GKLE5H<y2
zUf2u<hVVVmWGcnL5PpDxA<_oQ7h_<Etao5wh)h5j7@5Jq5X}QsAi=;8Ex^DK!vc*0
zF$RVh4hDvpIS3147BDcxTtVoMxxv5?+k@c8PGDe&V?a1Cj)Q?AZVQ56AGd>nA^rhW
zK!|}M{sjX=f(6t7AqIv72L^_OE6^YoVPHtO!N8Chf>56r!N8E@fpB0_00ToBEF-Eg
zFr-N^Fr>kvM2LYQZ2<#Ax&>T+Jwv(!14H^9sD%Oy4CxOT7&254KFrWyV94-6$Y%sF
zFl1&REX*umV95LeHBf?qA@c_VLskWpFT%i()xf}z&4TbiHU|Sk_7tdjLiG#`*)tdz
za*%=ulpJ!9f+%MP14C{D)IuQ!hTIMYhP)c60b&dcc?}E<`ACU4UxR_6U<EW+IWRC3
zY+zt0bb&fZjDexhgMp!V4~GCam((jUFccqPU?{l(O_gp83?&a37)ni`76>sglv*$_
zlwE-qo-PawWj7cY%1xjKiZC#gTQD$`e?j=L{09R=MFo^E#K2I|z`#(k1FBwtfuZ66
z14G3NNC?-1(sjiL28K!nhyaLRslmWd=>m0t00Tp%2LnT83zRR!z);!2z)%$eb+8x%
zLsbL=Lp3asiZC!#b1*Pery$f<XD~2SZ$LPpdItkT4G-9X^$ZL`3=A~_3=Fk%pg}Cg
zz)-t@fuUIf8bopo49yA*3@tLyAeCTXXaVtIaVWyT&@zL8p(BQa4;-W}3=AC!3=ADe
z*|=i^14G9XsDlI;7&=}sFm&;N%mevff`Oq+fPtZ>1Dfr`7#MmcFfjCNL1^gN!NAZr
z1MFf3h9U-rz6A^n{UuPo7z0Cp1p~tb355Cy3JeSrU};2vfnh=e1H(iSsJsvZ!$b)N
zhDkjftPJ&_PzP})FfdH+fQEn&1H<GA3=C7|AcAbl0tSYukRStx*i-=qhN%Hi13~Nv
z28O9f4xYM$fngdCLVlV61H&{}t^lzc7#ODA;9#f+2N?qc!?Xts46|~eAt1%TFsp!p
zVfF-Qq7z|Ym_37mVJ<kx7#J927#QXXFfc3t`2ger5e9|@6Brnlig56N&68tbSSrE5
zurvqi03im3r3DNO%V6b*0t3Uc8w?D~FL2aDYE&@>hUGUH7*^CkeJsYnu%dy1VYLI)
z009Pu)gBBCt6xCnMHm=Xe_&wPqyw#NbQl;m889$xhLsB<3=EqK7#Oy|vb6~V1E{sK
z1y=ch_$L?`wg%Kg4K!k4*c!pWu#E@GmtbJnCcwb3CxwF(?4t$-hCLY!4Es$u_(6O|
z1qO!w77Ppr0-zx#!N71Jf`Q>+3N%fKFfbg<U|=}-18SZC1H&N(28Kf#px^@KF$RW1
z1`G^`>S2jUh=Jiy1p~to4``}aVPH5Cz`$@K2I2rlIR=Ik2@DJ;mq4-|qZ9+f$rTI?
zrvjiBh%hjmieO+keF7R~atsWoFEB7%P~hMNIhetSf#HG%1H;7vsJsXR!^H{)hWbk<
zAO<psF)&=Zz`$^I1_w7-!#oCts|y$yu023#xb}j9;mHfA1N9gfo_t_ncnYg41Q-~e
zIxsLi{{hu613saa;maGSdJP7KFCQ2fz9L2GR}Y4IhOZM4LGpD51H;!RNc<NJ4Bre8
z{BITv4Bu6txkQYC;kyO{!}kV68u{MA!0`P9G(-d#7`|U%VEFz9N&W)^!%qXKhb0&o
zep=KsF#LqoP67-JKNm1C{9gktNK_aY{%>GlWD0@u<ro;5A{ZE%Va-SZ21e!^42-O>
z+Ea>wk@W=wBO9#2BF4bTc7uUY=L<9h>=+nzelRfV8o(XIs9SHrz-Xuf4Pq$<Mneq-
zMq>u33q=?hjX4+?jgd4MTQD#hBiaj$#u*HZCN>E5CJqdYCKI5EP>6xiWCjDH`w?g^
zkz!zUKf%E0^#{SP_hw*V%xQtT(1L-nmw|zC)(0rxh=Fm|4+h5BusD-oV4Us2z&Lvb
z!UwY#Ffh)6HN?dj80YL@V4SlD9%YPk4lpn-cY!)kih*&t2Lt1BAGo|a<MIFo#^s2H
zG~@CJ2FB&E%0_^Jad`&=<MIvDmrP(<&Dz1hm|HMCWFnIh(_N0~9TS=4nC{+~z5+x)
z>6m^3M2kO|{sKfx2~6jh#3YyYDg%<+7+t_LV{QclV~Gp2MaRLwSmMFJSk(gMb1^V3
zKfu7aiUZWLg{WU8z`(dh1i`QBU|_61f#9!EU|?K7WqZ#gCKZ<HJ=2*uwr`lmw2aZK
z9NIB0hjuK>p&i$9Xpg!a+QBP_b_C0z9o=$h2XX~;@M_tK?F(iwl`{%Ld(g|E>XuEI
zzHtMijm*Ex4A8FTQmD>l&_RP`9AFjG_snAA7J!<z6w=*fS~}hE1EaMp1H-?|4N&b%
zpbl9I>EJRgnZEHcqxSRz8yJPA=gel}7KHYcmq15mmK1=Em-%;*32MS(=qScws8<&!
zfK^O)n8Cy{U11Iro8T6x<F`W1+6q!&EA#(1%nys9p|S)z-mv(^_K9<t$~m^PFJ&@d
zg*jml)Cqf_PWb-=rhhk7{~oCR-7i2k*i65(iiukg>b%`h=k10#Pv-xR15gj_g2v4*
z=xE8V8xY++tC_eZU}~W8x+{Qzfr07&g#*(IMVU0GC+uP3lL~;U*$IvFosdBYrky9i
z=E(fNkiZD(-tT}82keB7*X(qFsVIP{fR5<wfDUBs*a22C{mmLCE}`wvQG^}PQI8!4
z(>c~MxeG!Ev9?1;+qSQO=$W&YiA!i3bZ7=PGQV8`EGhH<LL=1K+n{47+n@<)+YGRZ
z=|1b2xP-PsM`*S|Q_?m8u%yfv1_r2$w?YTQwn7uq)()@=g3&Mi|NjT53pPWO=N4#G
zZJuuUl2IO%2IZ!&S&vA@x1dRUGdLN`F)$!f&=#oF7HCS?QUOXq9IV?lwlbyhFqI#e
zKH(sfm{d75h@2D{cv!$gDUgUMzcBp(SRNYeP6-S`0t%p_04o1r`UkN53y>HXYd9e5
z|1n+R5R*6~IPV!uzp$H;WqZycCNDOlI`9QI`TzfYg_u+~0j!&WffdTHfb!X({DkQ*
zPJreqW^A`O$+V1(k$e07^GwRpj8CUCzh*LHd^O$bHPb2A)r=*qtimF!oNRKe+y<<Y
zYznNRY>cdu3`{JH3amVAEv$@e4y>GP(yUx;jI6wD2CS-VjI2_6th{WBY>cdoY|PJD
z^tNZbVLHRe_;I`GJ0>P}rk`TdEx$6AGG5)j{wou|03*Zp{jAK{jEwHnwb_~b88>a;
z&Ccw?$ar)cC$k&7g$^Sts|brQD<>Os1S5+$t30!Y9*D~vp}-=}D#5IwfZz!-Yv_Tv
ztZdA|+v^0F1(+FcP45?G4r4sJ{h2T`KR4sz>EGm-of!{qw~}W*r_8Maa$$u6E2{?E
zba7|q@60DzZKeylFl#bi+-~i{?5WM@GhMrmS)Myek(HZ~MTC`+dG+@7`OFR6j9;f4
zR5RN$PM)4u&D_K^fo1xqYGx(=&PtGT+4NY%K@R>lUAcz2P~vGdqbSIt=`4(_x{9of
z@(Qd<%rC1Irt@E9mSBqjshm0eR1LEp<AdoxYnW9TPfwSxW!}mBrkruQ;WTC~E^$^K
zP=GT};+W1~$1KHoVY*fwvoYiE?QwO?;jD~Xr*CU!_GMpNtia00e0e%o3$qH-?BeML
zEzBm2H>anzFe|YCF7je!WnMVFr-fO8@y7JEEzHVH4|%3vYGIzr)L67Vvz56+kx_p7
zr)A8JT#f8{tgOPUjBJ9_CwelAG6_dc4_VIK%X^MNfi;tXiG_uEVf}>Z@0K&$a!Z4p
z<-^L&oUS)re+6^ApdqUW8zZYIo4z<}5E~<_vcmNBE0|R*6j;TXMHyKYnX~m2SOwWY
zY;iWmG*&@2MOH^PVO9}&kRDcjHbxs(K{gezA&ksCdeenhGV9eVr?E<~F|x{mEYo9^
zWYcGr16!iRYQV<GDxrWP1d@_aU{%m(6=gGGl?3Ti0I3mWGhnr4V`SA<VAZr`)dpFp
z$f^l8Cjo4ZybUWWn<*;?8zU<#n^6=i4><iAv$AeyUB&Fi#CUqT&l=_~lMe-;7zR6t
z1LPp)K7Kt`RyIRc-au9zHbz!;1y&seR$hHJ1vWiqYerU9<{ymH`PMQ=Gk%|*wU#+o
zwUrel_^L`zk5z*CAu}VZAOjN%6Z5JXP^Mw#v|&|dV^o;_XDzcd`#W|<RvzZ*)8*DN
zD=M7f0A(=d>E$OtSx|wMmyP)W10yJ?z#5lNk6*`}$$kK=<>>VD>zF4oN={E&&#WcV
z#LCF3$;iqp3|HJ-y?w!YW?d%6httn(WDa2mrOsbGdeikbF{>~hogTc2SzTfgn;xqG
zI8z&fECl6f5MOWl<W0=ljD6GhZ(`OEc+L&Z<g-c`!H#%7{re{79h@d?wrqNA%(0Bq
zwlIrw>9O)MD=@M#XW2}@u$g&1qwn;FEzBy6SEn!C!n~PdDmNo54;%B{=?PnzyBR-C
zf3uZYl1-3}kyTn@I>$C<dH&gjjI6A}Y!NKtATK}LZnlk?ojLt}l?{m7&!NZ2DD1$>
z!#uMV6fYvIymqW0-2$KhvSU?ZV`LTZVpURL6#x}i%-2f1z@Fhz&|_s}KFG%i%6tb3
z^+2%=_Q5)CMpi2}MlX=zcbW92&)vzqf>Cd~+b-q=M#h8Fm+xjym6B&=Wm5#FL1{%+
zIS5Z0RO~5ESJ=Z`qd6@d<P=6mVMaz_VOBmiP_ZS+{6RvGMU|D0c|tm<;9_NC{va{^
z=pJSV#;ECRdzrO`^+BnLjoCB}lpNR;m{-)>On2DJoLDcz$STO3qQJ_^ENjCm17Zov
zvvRU2vdVyxDzl6Ns|<6h0!T=om6eTIni0%r6;fuEk!59NmR4XDV$M)t6<1=Fk!Iy&
zQ)U%s6H$~`WR+HAmC|RGmS>exWR+87m68XMBFuscta8lx3anrjt0JqEh&(H+BC9xa
zwgM|Bo4l~FurR9-vj8YkrW@>I_7kvRWo1)g6$d31kQYj(_w8eD-~=&28AEBh(0=A<
z#<$b+_A{$9c21wRpE*Zvbv8(f`IoRBD<?A_BS<ZnVDn;Q<}H~neSlfhXB9XUkuus9
z36KNySy@HF*_xHj7A(oirp(I2{3{a_=B)f|jI5As*&+r~9myie%Eml@`h)|_DY{b3
zVxX|fQeb6eQx%qC6$aVMCd?`Ti9#@!kyU_Akd=u|X}Z)wW@%nMJ#a`%v6ZrN%1^gF
z$Sk7((#_0eBMi|FN<gBl{4%VZDi8tL>9q%$#l?j|wkxuVvSqMxTCpjD0!<W@uQwcI
zUcx@79u!AUrbi!QmSN<XUU7)olvA2{cD(|tJoA(3+YT|S>qs-ts0T&Fa|Q)g89i1-
zMOGQ+a!{Ztfg%88oHCm*t324{)A<fFi*YM4cYzJ~%Ahb^?J#o~*NZwv7IjuO=1FPO
z+YU3^CO(v81P2@^n?5Tqn=mVnJS#7oEh{IR2{;0Im=9%x!w^)0v$A=MvU0OAvU18o
z>K-;_A8_FEfW0rM2M#(=oH4QKu}HFVGA|VMnx1}yxw`&y9VpC<*mT&u<=GS?S*1Yf
znfXk12`i|!U}6Jn0)>tts}#rrP)6lw1t(@cHVrT>sKBNVW+;F?&%_4G#;lC2>TCwA
zpfZe&d5H)kD=+gyu!BJXA_{6CFtTze*wnL1Gfx!(mEp{9vlUo{L3xBtnUxciFhI8I
zdq;vmIx8=m3ag?Yt3VE@2q*<*enwUvP@$5}%E`R9-UePIoMB*O1!Zq}1y*SVR(X)h
ziJ+2@RRI(TAg&K6lPiD=m<{#ydhim4la2Wj10x$Fs}>t`8K~l8WYq$PA0IUQSVh^u
zb*&;BBPeba!L<(;n;pnJR$h=&Baky#b@W)RY*-aR0?KTRtUM)<w8o~u$_jD=8?&Gn
z8>rl1WMh<I<ztIt(}OBtR%T?CV^d`1Wb>N-^(b>W<Mipd$CwrQAiBQSm9R=PcjZo>
zag6zb#eQKuVG%YPHbqumaG?2uUBk&{%gW29&&nwelVHA6rohU>yo3`JSo+Ktr!P6q
ztj`9{@EX(a9A}neU(N}NofXp=PcUn+=(Eb$PuD%cETwWu6eN7R29(N#g@r{x=IgPt
zGB0Ab@nzE%wP)pJZknEbg4xDc9MmSz1sAiRa)p&mpOKM`k&XEc6C+3yD-)Y7D-ZK(
zaGr;F<?{3!CzwMSH%`|($=uF(bNaTE%v01`nHX7lLGsLbdaTmS!V0XCa;(z&`mB;x
ztkTM?lJcN3P*P`l-YI6WdPz1>RvBehR_3+!pi<&8gC46Sa}_AbfOD@5n+Q}+iup1F
zs5AztlVrZg07~wP;DpA>rYH=}Vv3B6BCKr8%jy|H<&`*_zJZ*Q94n6stGFC1t1P%c
z5C%srE1M#l2rIuFJ1Z-j5-X?OwA0L=7`IRVe46>O`hO-y78O=T=B`vwkcohd<X~g;
zf;29>B|s^QmyP-J^uK4AEd;z-CE3JT!I_Lvk5$rSy6ahH1;#7W)6O!hDXszs{m(Rz
zIjlmU=v83VVCHOM1w|VZ^BaljYtJ%EFg~7s>@2gt(83xURt*=BAOA{#8y!EVtDj?5
zW^A7BeUAA^Jvc;P)!MMKGGEHjW7V(&RXe*R^;mhB&sTx`E6l3J#>m3Q%FBE=A5__y
zGA|ZTU=>qjHI;{uEPSl2%(tL&%LG8_T9H)@s^<<^T#R{%fC392*ny19_n~471r%81
zK$>sngR>CGbTQ`TU=!3?_*ey*&rDx&p1F)`vVa~)GaK{e=^7W9vrOlMDlAwz0IGGi
z*4wbMDzPdtFtIQ*@67{w_OPG=5}%X#=Jewin3d$O7L<TOoO!i?9xJOc8?&Dtt38`A
zD<8P*W!^iT<07*P<H6~=7nw~Mr%g|~$ehl2b^57`%+nb!PfxnUtj@h!fRW9HO^bz(
z`PTF)mzb>?*G#`~iP;yL3456%*qGnf=uMZq%)BTV9JY^{7}=QHYxTe-u9zdMEHk$r
zs~EF@0;{YtbDkHokOHfy94ognt1L6f;cU!&3aqkhqO9DCtYTWATqDfN&&DhaE(G%w
zrb}O8wut7oWt9cH7+kCyG2dpfVHIFrSFOj&&0G$O0CizuRwFj%ODv3vtOCqyt3hI*
zJ{%_-^F<a$kQ}J41BDkOn+>QNpvRU4D%#oVrcb=iEWBO&DzgkHQ!m4I&wI=!oQyxF
z*F9&pVw&wSeb;m50>%Z?wO=s*XWTJe`z5m)<ALo#FPVc_nU;G@U-ph!iD`Mj^iyCu
zV*0yx%$AHD(>2~R7ch2ApZT8oD`Um>{twJ?Y)mB{+uwg<wq|8KFkSl(^F6jz0?g}J
z7^f%xVHTOL{FiwLW5@J6f0^entx?!s^^aMPk@3RzmH(M}IXOyL7}*#YQsk!Z<6sf5
zuP6W=aN@?mz>v=jI^`sgfsuiMA)b|ifx!ht<a07Z`p6X$3=GT*B^g*5K?91(=NK6n
z>R4o%8JNY~85kI>AsuR+rw|%MGCeQnU}s=hUE<2XFrUpvLz;ns!TCH$_wqcD5U)+T
z1cNODgSj>XL+VLeTQLR(1_NydhUsj!c5t?ctv#4sUuwa?DbB#a(5cVBz))2VGA2cI
z`b16^Q5*64QbRKaZV3hkhK=P+><kQ1$@RsCW(+(aorlYrSQ!}FRqIQQjTm@ABDX*$
zoGNDlxvg^gBTg0*iTwIvGZO{@DFy~c#c~c-1_s6!R|W=Iz3F;fEP9OVrpI!z$cat2
zlLk4!AWpzek&}UeaTyZ>gUPJv6S-J4+#Kyxc^McOPB92GFz|^8*vWG+Ffd+C0I6bN
z&}Lwmx1aklF9QSP!*WR2>x0<Z3=HdIxu1aC1oC%A%JlzSEDDS>rYmr>h-rkIN`b<^
zih+rNVcAJ2hmnba;m}_whlz=SVbAXAaojA9OttmX7lL$Un@YoVmF<RdK)O2aKsg{?
zP5jgEbF(-)aC|kD0V!X`#1O{<W-@0mF)(Of1+y8zcIy~HIUrN)g`gaeDVBEA6L?sh
z7#XH7=3&w0U;N%w7GzizNN!H)^!p$=|LID+EV}%S6HVpda+N2i$MLc_F(yo3$jhR~
z7i}sJm+DTPewUZUk*V?3bOk;ZJ-%8~1-RULgXuAREILdxA5ZV%WAUp`H&qm6U|>9`
zzyzAoHC5tdU|?8g0Ez(-9T|IB4h9A`TP6mE=309>kQCT6k-7HrU=GML*?;U6K%8YD
z2W!8vhZx5ql9QCkU=KF#zX-@Uy_o{`Y9QmDGchn2_1LR}HCcfo#%PMY2ABsn!oyw@
z#HnIoVqj=nZm$LAu!>|B6*AasgE?$W3=AwK(<kz?sA)*r>x0CWaWOG4MCRHXfH^!&
z3=E5e?F~VkDn2F#28EN;@AI>WNqgIS2r@7*{0G@;^3UEA#Hr$dC=d_;EASO$U|{!z
zD)0j<5P&Ff6kt)UZ#-o0&CS5T_B^k|(3rtKfSZAVT>|7k^+PfCW}s2|AV_eTgDhVL
zGN**W-U7@4d5<T|-V($)1@d0;5_>B!heM>epoGER8q5K?p7Wr+4T$p}WcS_|_O>9-
zG6|-51_l{ddpmHHNr_~qRx;SzgQc{X7#Nfe+B<+aRXU(d^~&B6%+UpLzSui~ILq{y
z7#K9n?VUl#k_H(tF)*;*vUdS-l1!Kw7}#G=cM)VUuCErb59MHB;FMuvVBiU}4+Coj
zd8K%XeK@G#0;f*@$@URo4l@%2!@}S8kzfwUU;F&*qriGtA+Zt-mSJaNU|4Ho4_Xky
z01kAXK>Jv*GEOE2hT{45prsxRRoqPV3=E#%?c>2xpukwfU=LoI1&vDkM6hxEpitk~
z!EK)ka_UY{n#i_K151IN8X9Mx4(5OosbiCU2ABhif&v%&OfU!J?nMmtSzr#x-BV86
zgBDwOF;syZet51uXk`UM6)3$m{<O~ps{{Fhv&TLU%mF2x^~de=!5ok;1ee$sfH_<s
z*V!vi-!H@>S%2TY3@pga#K3T5u6;R}1M(U7Gy4iKhZm$gt&G{efrEj83luTMOY9rL
zQXtQ;cG)+9IUvtu@Yy$mIZPl;3F`&y+d!Inm>3vLPusVHr9hgbqU<{)85lT!hk<mR
zjkWItOMyJ<!ff9KmSTnE({4~$p91+N`;UDOn8U-6$-uyTn2Eu@A7uIiCI$wfbbHX$
zC)Wc8Zw7|yOVig1vq<yH*-w*TVBq@5xX+t`A)9OZbzv6$`cz^2MH~za+!G;rVKLZZ
zkemAI?U#T#ASbEn+b;!kK(SKUYrhQ40mX{{L;K}mSAZP5ZoB;o5N8?4eX}j>SAsd9
z3@>0|zY5F&g(c@f`_*6$pUCu95f+7dk-v;84q_Y(416D$7#KM79V9qGY>+cf1~^D^
zGBEIiX4@Iot#goqXk=nwNYQnW0dqhZFP7B-R01+o2{AD+>^|)PE&`VcGchm(DLH^@
zCx$9fCI*I>MhEa(lqxYM28IPe4xoySVOhO669WU^RR<-ouOyim80JrNPzIYV#l*m1
z73iP>=72KUgb)W%*~l*-$Hc&(81JAC)?)`sF7F+{Gw@aRObiUndJbA(83#}S_r^gR
z%yDF5U}%VO(BWWU;8$=0l>^=mx}b#;3{{>?3=CWX4tijVyg<d6lLMr@^kHIPNU(Q+
zl$U-?3=H$E9E?CgVi3T@z`)Jm06MvtVOatb14HK_2UD;`NlXk3f&30;VAGO8ewA=A
z2g{@~F)*;oIaq)>X-o_Z(vuzPEy1N!IuirK&K(X`V5xE@28MM%93bUf1rq~<e~W`H
zSf+-Ffnl1ugB_St%f!H7(c=Iq+3G;0OSS`eWnxtW69a?wa|cJTvPLEb2FaBUPGC+G
z69Yp?u!A$0)6B%cQ1AcD0X%IQ)WXETkod>J6<j)ZfMT!L!5!=gP@XAW>fiz9^nqFe
z?hc+{6DBY*Fhopq@B+(#lCk|`2XC;<WKdILmjif4xM~U$14EIjgD+TSDiZ_4Y9|Lj
zFlSmlDE1~g_=9=VnHU(NS37`bjjLubF)(ad;1CFwnF)%@aEBl;XBHC!gG8i5FqktN
zB-7{sDv3FQ<}fiZL>W1Rfg;&q0VwQa93VyUB2Xcn-~cI#7c((1*iLYW6lGxWWIVV8
z<cYNo;IjDC7A6LUs;dr=;&%tAQqXgV1sSIRDm#N69OA(71v;wFw8J4D99S2a7#PeL
zr@s(qsi_zF!l>)e2h#8aoU0xB!L9^lCzDqWpn`$_2`E>q7&%M?o210Vz|dsnFbS;8
z2*h!7m<;9^Gcho@+c<!h9ddvxo<*7t(?BMFv0-9hu!(h;Da^nizyeCWiwqn<iw6Zn
zrazWoan(3*L`y*eRIms$Ff5A^5as4zU=WC4Vqh>-73Gm&U=WA}xu;BfdVnO0jAA2)
zC_hL6C~ZhZi3&gzFz7Qd2&4-$Fv!<T@0DbctY@|61Um~<3@uBt<`QRM5HJ80Hm6Qo
zgBrwwb`qed2(ab@rv^|{NlnI@57ahT2J&S18f$*Aj0zJ2!*NDy0kCOmAU(p?0w85o
z>Y(hu*jf-QqXDX`?pO<fIhrEVRi#)2>K(1cKxVwrVc=t65NOwCU=aUmEg=PRsx|{d
zin6sN59qoTVFrePSrXRD91IMCtC$!Vyu7W!#mFg;zZXokRs|UXZd`<~u~q|fKt8EB
zYz=O3odT7V0qxcrJPZtihXp`EAsF4j$iOgtixi7wy`ZC#FarZ)*%U?whK2*$3=GnN
zY8>(m41!m*85rvCsBvgQ*(ITB0wDLC0{f1EL5Qo35!6I4DRL6#W?&Hfr_I1{P}E6S
zih)5$i4WA-02!HlM3{j=d<KgXs5B7rU}9i!3URUmHQi5v8~F7REY6lv3=G_i!VC;n
z+YMYmD`|xOF)=Wljdd{u2N%ejae*#IU=Ap`b?~?t3o$S#&j!WbA_f<5xdm=EX_UE`
zf&%~)dn`UK;BxB}sJLAd<^n0VKvAjE>jH8PLzN<v90SAN7cSt^2^_JxM_g>cW`iPj
zug~<C(kycI+y6O()>;em^D!_8g$Oe+C?4i;_Tpe*5C$b)kIl~BU`rW9Qu9(6oPEF?
z7En#Stw+IC7^Lnd6R4(i6#+|uJai($RTRWo2CD9wYhA%9VHv2|!FkSA9PCw4B-S5x
zmEfoc1tzGe!5`}is>2w-P2UAwuHZTh9KY^DuF@dmPJ!yM$Xr($4hDt^Od_D-|D-FV
zLX!t&VKrAdQ3i$yLJFXmn-T6DF3rFo{FD#m6HxxUtl<W7u1GG}xo%+R{$~IcYYHdb
z!0rXN;wG24f!wP#8|0`(!fxUqtE>1y#c`G!sLEvkyQ53S4eZ=gAa}&3x`Cbh9~3q1
z`fgz7R)Jz8GS>}M|H?@!f*j@T<{YWOz#viya?~qr1_rBT_0Cb?gs08Gu<MO;G>E-S
zn1O*uRNfs_7>GuJUF*&Ras@b3D4cZX1qUH0aJyvO`M?}d1JAG59aKC(8hF{Y?vQ*7
zYTzBLb{7O00B&+@*zFF<s-PxEMBWK^P^h@=1~uj;&UP2!VqnO#1%-6uDR)t@*`PK-
zPrN%QR2Y_l+63$_?%+^41@i6+R(EiyECZ#)MI7#uU_Ejm?}qMkPE=-K5KZG_U=W$6
z&A_n8Z+f8|i>TpT=Ms4a2GMeD1_nz8=YEi<|7$ZaWRyGiOM&_`+6)Y9GMp#C#Mkmq
z-!8|Z;O*=@QILT_^sF`mL#DX%Qjqj1Z3c#9PUj5@3=Et*wHX-X-#Xt1iNCqT$iN`z
z;`~qs)b3~0W?(p0;rxgjl-RTx7*wB5SCVJ3ub<^14ep`yF?cdCRBrK*0rMF7JQ*0)
z-Sm)!@c2C$7*<~Qkc039JQ)~Vm_6hnJV8$ehAtTo1u&0Kh+#4#1B2cj77s~&1_rSk
z!3+#BiXMvW3=Cqy!5|3_aC_+#gDV5Wq(vSo^~?+mVjJ~AN`)C1M2ZDGK&>WmS0)Aq
z85<8sqY0FsI$b;<jV4e55%AOl+@ah7Dj?c7d4M~V4?&5c_qhkSLkVv99@^`n1B&uf
zJfOT<@WIAIpM!xx{1FoagGYx4xSjNHdb|RQd`y~$F-Re3eKJE%kq5ZI*#Sx$8v8uJ
z1<npoA**rB16<(j0QEmlXnTPAgW``s>4aU+1Kb~c2x{g}f9wJ24}$t%I$NjTQecs-
zpT*$;YVJsic``60WO#u4ai<tTVZQgL2e>15ijmQifuZc42dF2<aEg)1lYwDrhX<%D
z$8d^~*^_~R=cb1%$eE`YSv(mS<ZM0MAUsx33|#d9w|`DCvUxHv)L43e8$hQR**zH;
zPEPlz_k<|r@MK`<==T7(fle`UdNME^o9O{5-59w%85rDiJs`y!Bey3518<mzFGL@Y
zCj-NjTn|48kJpodAy3c4AHoAAmA3mH0T3Q2sl*@f2!!xJNoB<{kDzD>SFnk(ATfm@
z7&Iir2Wo*I+UpSlmI4>23u`z$KrJ9iQ1zd~<Piaqs$viU>G6o<WMGht07bvhaSw3&
z2RuG;Xz%m@B^H_buJ0Tkpx&k=sF~-{;Q{VzJ_IElovj`TAcIbU?KmLE<B`I_z#w@P
z)bzFUNCioO)p>Myq=7l0gmh@HM>>deiUX8(`kXmDKpjWP-;n6b1xqn9K)jR3z`&q<
zN*?62Lwh~)!E#``_O55~DB@sXkOGw$hxShAQ)ZFjFYb5or~wJy1v_B6r80|JeVRuD
zNE<8xHi9|O1lR=TKoejym;*|H+uwV%fH)692~a83qZP~n6~!LC9&KO_sBD^Y$OF`W
z<QD*yP4#vj9Uz%gpn6Sbt4Al8<G?Weo-&JmJ%`5xFrQK0lYzmc++!kyr{KxJkoeJK
z5`?Gd$-uy|&0{izr{u}NApFE*3WTTZ$-uy`?J*U?Q}JYAFy8Mm4Z>4}gw=FV)bp!(
zGB5;0c+3DxF`IfaFlcgl)XxNSIV?bBL)8qAS<DO!Qg`(k7^J5NGcZU69q<4(8|6TC
z(%D##x!~3;D1N6UdCUVBxS)7jam!;qm;<T}jHEplfZCuApn8{!#bY5S1A`nVsNQ9@
z@K_AC4HS5~FFclTGBDILfGe_ui5^SAQlQYQS?sY4%mIbo!X+M%UMr|pQ(EZ(>9vBI
zi$&)=z`fQ}pjHK^h6lLUdJ5DioHNg34cGwC0M3q7k9A-UsF(<N>aiZgSq3U5Cgyl-
z058L@GGk(3n3&<Q5$p+bP;)TFV-uKT0qT7`^w`Y7z#u1S3F_HMd29ih0FKSmWggqW
z98gCx{IbV(FvkVdm)+vA1Iz)n&UQ}p*a_x<dW&<MJ$8XPpbjFJ#wL&5U|t9l14C_@
z#~v^TlobtPJ@$e*F-!~$Vy~wgs<BAcvv?c;i)An|F!1Mi90YT6K>e};k3(Qi0l2;7
zaTv@gVPasIyVK(+I0``h#Mt*9$H6k74&Vkej}u@HsAK1T%i|=N1M1jK67V<$=72hO
zvJ*W{gE<qJEEpL09(bGq^FUp;!|5Jp!5mOmti;*l9GC;@V=dj~aURS8^|1~HO=nbR
zv8mtlNWkL?C?rpU!ux>7Rgens*j|K~$2BkqRJqh_^|%fWd{Ek&+U0Qr%mJmXeH<P)
z!5mQ9I&jY87MKHSX|P@JxD7G@Tn9~U@VEn(0p;IrWskdH4liiHVcJxWd*IZ`2P$GV
z-<*D4okfCa^Udim)mdcg`2;*b+hgRjm>3wuJ3L;3O#~%(O)igDAkGeulQz!scnvlY
z<chg09&f-LkSjPeJl=wpfs#9izQ;Q-2UMgS+UxNi#DP?cUY9vMK5;NG$ghJGZJ)tX
zjBKE)$%=V;w+4%3{h_@c-@wA)Qq6^f!{aAN$2D*P=J5+81uj7k?e+K#;+$e(Fl1nu
znabe--b|@r>j$p%7#YEmj0}DZ4BieNj7$(NqaV0xV`PSKnfw?Ste8C*Ss+~IMU3^J
z@}Chj-hE1jg`a`p&|VKlHn1$%o|B9s9*m&wp28`928NBZJQ%sap}@e;z%ZA^gAvq*
zWT;}~XJF9U<iQATMebk%@pgDH@`8-n0Wy?B!-Emr8Qj6f&%nT;@4*P}0Pf)6XQ*eW
z+3LY409MMy&%iLX%YzZzmfXPub&U{6?vwz?*L>4BJQzWZMuo5Z3=DyG9*kn3meE6y
zYd{Vc2k{^QRQ^`LgHeiufkDw18bIJi^C@ruMNITy1T~u(PBGSlLMUpl2cs<58b+o?
z;93;49fRSNEHl&%@?0Q;I6!?(hKGg>49jN=crb!SsuXMa85pKN_Fz;7tAIH~1<d0B
zx!J5vz=ILg)>2#nbu)PI9_HqHMoolT2?hZVM$o{N;v=Y|bs?@|fVxT#RKm-Hf*a&r
zeS}Vze*zwipkAJmG(Q7_<`NG^aH9)sOX^||MsTa^6euo08ch)zb!Yt%@L&XuL@BvJ
z-3M-9fpvn^T0zyuGB6zHobIE|BB8O&gVBkXfk7!amVu#ny$7Q+m?O-<&^4EX3DiDU
z0u>qo?bCa-S#%ABnOr3p7?diN7#I?_G39{Su=%}XD-0PJjLamM7(pYO%KZEc3>ntb
zUum<L^PjlsA`0p)gUb!s1=9_5STyP#HC#X`P8l@TGvSB}52){a0F-gr|GMysGB619
zgL0&MgA1hB0;+(r|G0n?+cKd91_osd@Z>{UEr*LH2LppLsF`4}&jsAZ1zTjh!Uf#M
z1vh_On_R$c++{4_R+5WuI4Cxjv4Q#?@eM8ou;zZwN0$Q7L|~OR1H**9E`>axUc4{^
z!x{q(PtXm%Dxh&ZqaIIA0nlIp$hk&SJh{LekaLagr|apmNY)p7f^$q2XzX)ipeH!P
zRDs4mbsu<wz3>K9Q7Q&_f(B*;?G!*Io7ENvPf-6#WepPpgZ&Io5fM-?8)U_bAWu<g
z1_qTip!)EnwWk<3-&%l@unK6rp#Ham7dr<7gX$cSqSSN-FAhi*3DTOO<^{^~3{{|3
zmwSU3B+G+}>}@x^K;h3&1sZj(c;toXDGJ+qLBbqVerqRqA$p2xGG2(DVv3U&q;m-J
zc!Iwd$n6YOpk~L8`VcP>up2?;=)#L$pnMLR-e6$hJm>}K)q~1;wqIW04Zl^qObiTh
zPrX3tjR8E>q4L!Wl;Ih`o$0vOUZ8%w>Kp+EP%5foU{GBH8aXl02L&6Kxq=sHKw9-T
zXaG6D3p7YJ{fHimNP4W75;#$Tk`CKkFGz<9)LIF1_kxTZ$uJ}fcxkgTFsOmr34xYg
zI^a?V6mS|@Ub<ioi%3ywF@u*Lm;>@^$qg@kFbCXSYTh;7UY|v>Ucn2L3i$;bAj(05
z)%*gWG2|)UUIy$83~JR4AlIw@W?)e3Ze|3{RfAk_wnV|pgoA-W?G|_z(hJ;+0(ahz
z?C}EkqQE0sftFsNUK9hkuGGl#0{5a$@j&bXW%B9Q^;sn9MHm^pY&aMg)bp4a7~GV+
zKm*L`c_8n^J@o<&FmnWf(w#<umpw>T9jJj8_u328<5KT40S%^$dw~X+)$2g5qqvV=
zpaEu%AW%bR#wRb(05eAtsG&3Or59*?S$!VJgK^)zK;z5m>lRGUGhhkPoOC_I%Y%b~
zK?5{8Z$HD!Qv#Nb#ol{)NrEIm>9}Cy^w$O~#?lI2{-6wZ3S`Oh%U%JJ3=GQrAWOtb
zr&}7bDAecPQ}AX1nfD1a$Sms(uF}Bsm<M)yvxBlRI8?0XdUJp|pp?ZE=FJJ>ECa=T
z@e*%HvIq5~7BP53l0B$tv2nXMxSj(yXt(rwL-GJ9iA<65hU5WBP#8^E<qgiY%RpIp
zL7F$Xjyoj-ia-~M=|2ovRQalWAgLE*p;+m3Z6g+Q|J6A@pxF^k&?xi#U?1@02smy-
z8hpU>!{E4`@zV#KG{GY-rl);W;5o-N+D8@40S&k;F`B;7h(%K5*n$uS2IZG5iY(BQ
zmwD2j>GzCSB<ow6Sd;`A7&PxfC76yXfRuh^QD%jUNE9+KOzdZ2T+9!e-i8aa2s1En
zFBI?v1&tP{M0RiR<pEm_N<1Yud?6vj2%a<Z1s7+hK!wP@f4=b2L4YCqk1sf6mVp{p
zCY;mTj9IkmMFf07IbQ26Xym)W7n0$jrb2=YR5b1T<O|C197#;z^4V9KgMmS7Hh3y=
z_cjh+ISvK}ZP4J-A_iaZ1Uxtx_rCB2PryTZtjVthd_k47b|J(j$T)~D)GAQ!gp`8D
zn|&db1jqwjGQN<hBv32S_{#Jc6Be!dKp|hy@T(3;Oz)2`V)#|S))!PUL(D0;;cE;I
zB9J*5*1nK>8C06~<@-XWjX>eB?T;@cA9IK#7AG_KLWW;Ki8QIz7gSj@fQvs<Azx5F
zW;n&ikRZ&!;8&;O3(BK9RU!o`B@DixEDBjqu_nwHltm$KFy8D7%A))ZAUE{o`+~A4
z19<&_@fBZC7L}6(72=Bmd|kO17<9m+mMh(-r<$^O`D+UJf+lZtK^eil!51=j0}U<6
z)D0+NIDC8|Q#T+Rw66L>1}s3n%>LsW1kPh1Uz%`E|7XggUeE0dnvIc@1eufd$QLp(
z4pJ@u*cUt)0Z#H9KE9BNaZq{MCF2X3nc);kuFPTZ1<lOJNrGyQ;w8SIp$bR<d6fEs
zW@h9hL7jRFU0=|=xSXUQ69Ys3Yu`k$LqwS585qKpe3L*O7D+LYqJmro-(;|qB&f4o
zpFRDs8H+*vkq?#(3~NjEr369E3|J;O@*;$RL6})zS`aSs09xPZ>457SeuhE@hLo><
zjN4fl81!V|$}Si(Ff8@qU}Y5IXJF9l;%8uxd&J5p47M25j1&!KWdx5QF9WrwRT#fc
zFE(eftv`ODkbz;*9#+O;K?VjrXP9xvPZTmR==^78EJGDOAk4sEvU7$%sHWFf1W)|<
zbBHrA=&OMOdwYaGCl>>QzBVXGn``~KK(?O(^$gcV`EzqKFzAO&0L^*m-REOq(7P|l
zz%X6kf<?c+I=~P#2)Ybr`;k+Y3=C()0*t^dBDm;DO9qC$H37z`q9-gF7}TW$Ku60m
z9)zpiVadRt@HM~zRqYl_(5WT?j;Nybn=Kg_w#NoIp$c!ZWMJU+3UEdh-Dt_c;C?Q^
z1yytd8w11Q{Q+)*3=AAeg$xX4?*f=Kxltl$K_LSJH%|bQ7OKvfiy5cKSh8p`+D&h>
zWRa^+4`4E2W?(Srw`5=t%u<wN0gVB}y)~ndfkCWCk<k|1!-5M>v1DM_zcWw_B>Dy}
zI>C~Gp}8VZ168!gl7T^0IZy*s;UUy^STZn7PYT>zk7{3=B?CjMcHm|?6j!tsGB7A4
z2QspuDsEw8VA!X@E(VHAPz(xLDtMvV-2iIEK2^{FH3tp9F)=Wlh|mC6i{PTPZKeh{
zsJvkS=g+X28sO6ZKPWNTd1-)4fAGwb@dFKTy$Bx9pEN^*A5;QP1vM&4ZcKk@#Uhm^
zD4-z;Iu%HpiGe}os|I+o18hZ?j0U9N1}av~t2MyAw*MTUjM*WmA<M<UVE9d&fuST?
zLmuo4Z3c!Ni!~HLY|w~5zlDY(i2X*Jfk9{S^h9eGiTa8Zj$lq!1_q<q!3+#ee8Hgk
zOQS!*3=EC(!Q4^|494l8DtaNWMlh&@XY?I3dAvASSqv=0#K5qAU9bwMm95JmQjna<
z5UeV}z#wP`s>1Dm1gn7?kD$iD+1OxE#lirdrs+!$hSV&I4AXyDv+&g`3Iv0C2F6JV
z3=Bq<puBiCHW(aYRU9Iz1q{L900TFSgR+Cc0agVn-K=i}LmJbd+MT;M7~EA}2C5hu
zeS;w_Yd%npHD=^vU@!)?^ZP^$f<bM6<3}PHrAZ9I;$jR8CiN*GD+?`yCBWVS#h6h<
zFl53B<defcgQb)i7)<Vid{P<`EUm`CV44nU)$Cs$432|0paD4R8^MtIG0*^9P<Ak=
z#$~9|1%;n?oI$V-2Lppiib#F|L$IzS1B2;0kfr%Mg7qZp85m4AgKTx;3)UBAU@-av
zvXzH3*Z>@|AX}Fi27?!*foC9%B7#AyEf`LLoKXHW7~Hu94+zFD42IO9Aoo;=1Vh@w
z;8|hgN1$mrSI*#7Aa~pcEt0qx3?4nKst37b>Wg6T@FBRH6BZT>9zFzj{4_rXgNF~n
zm14r|;0>U15xmH0&ZgjvU=C<Z$nHk)CNKw7nd#dGZw7O~qXZ_I!VC;cQaOXSaezV&
zVmEl$5WFO?e(H;0@VFt^?oE}!;GshBGO@W6g25w&;4YS)STJ~`5bTiVJHg<QLa;;T
z^#tz&TL*Fon_BRGFbCw2gL{L)gNIcRhddExV6fe-5Nru@$T}tl2D@d!R;t_#45nv5
zfw1>yur-(iiVe*f!8TwHC^j~(nZC@9#jT!$Be<4>fx!$kc$#}LxDJ$g!JaS@3WoF<
zK~;YGmSFHGJ2?DYt^|We*})UEiE6>%QTAnQpoD4qT$q6&c(zb5XlaDme@MXegB=fY
z&eRvd;Bj(rxab81PvQhk;DQZxTM`T&7zc-i!OLLqxHvd0(gK6Q!{Sw-uyE4|29JtY
zfx^PoFnBu1Y;ZGqDswP+P#io1?7kovJR}azJHY|Lvp~wg-AGTi;MrgfXinC{yFPdh
zm<I}y1fAfyV2&UtiHmMz4?fJnz+fH?@x>9a6x0`>u~<lR%SSO7JQfR%UAr5>;IUY6
z>{hK029L#pgQ?Ul7(5nR#Rf8a$}N!)P_8xK4w^td)*1q84nx{<#>+z_z;OTy_RP;A
z;9Lt1q1fmUNXZE*ELW}%fs~w}h+XwK1e|OCgS(%NAub`H6%iKhObiUl;vtZJEy&?J
z;zAHBBC1b?sBtocGeA0!Egd0<B@t48LcpU~;HherlOf<4LvV*^>4Xq)Lm6DwN9Klr
zMpG=@L1leRe+YOq<rJu!I4gC!y(5cGeY8sms7+?^65KQi0XNCO1%HubND?SK!BtC<
zd<eKj2JW*7r-Y<{Wk98#p<)PlUJ2}wtbh>6yb@@lrin8o1FTF!B&jrwAtaNNfx+S>
z$RR5dLbAXd1BU6Z99cx_kDPaK2<hfvV6X(O`7%@t=>cm51xQvvNH3TJ3eqOdkUlVn
z17aj7*;>2=Ib%ga2q@WFyi@@7*BMSRFjz(>g1YO>|3R@CFDw%Zia^VIObiUiT0_AT
z+Tc87ygXF09%Lps!DoIB1xFw_HdnNULLv}k^@<6h;0OeVz>3+SkkLwz)hpMBg4fxB
zLqL5+D5R$Y3IW#tp^%;qc+6|*6`N4d0E1OEIMPEw5yJou>iQjVp^%sX*`(kR3K?_+
zr5oerp`gWZa-1NWG{Zx|i{ZfWtRx=_p5z6`vrl&@qO3OF911F{)oy{x>LY2Pkg^)o
zdtYuE3Ms2WqXvh6hC<3}i+WHHEx#cU3M!(k_A)Ur%t{S~Ec69M!Q4fm;3X#Dl+b@B
z6ui(E91h0ILv2A}2N`Uil*|(9$icv1b%Tk4AxR(<GV#j*GJIBqLMUi8nzbJj1H=CM
zP{=ea$Z#&_P+xHPgH2EK3WdzVLj4Yzga!FM=zJ(-4i;1lEPo#g>Cu2fdE&iLaE}HY
z5Q)!2gTXEWck?}J6+%I&+j_1@a!Cb4C@6Kyae}Pny%q{d-5`sCW~>Q?ByW&ST{5AN
z<PEaPczGyj4pmAFye2$OlOq(g6xSLwy_(b&3QEP0C=|#G%?8`c0`hM1lIf>iSk&s5
zhZb=%Fj)WMfF(*BE^wEG6{ILzQ6Lnw%+>}pS(VfkS`O9^a-2Y3Xa$%9N)D!{Lo2}?
zkV{p*hE{<&;9{ixsz4~HHn0J$1Wf7*g@hy2ga%HAdIm_tu(>uATpPgR3|t#P;;bxy
zJq*-pv3Uh5LhZu9-5+qqnEE0N-1`CNi@m49APZ<f{mHGf!XQgUKt04&;bGvVBH(%;
z>}wb#XMu~*l=@8q;h;f8TTts{m1;Ox7dXWm&kqOd0!R8P=5Vksu=DcW!@=e0DIQQ|
zW%EjyfuX)aARIKJVq46_z_3a+9I{Fb<W1)_;gBK`6i}T%!y!c?D4@dshih^=fClTq
z>w^8ZGBSjNTFSQDK<hT^!yUL77;LwJ%$VyH?g%=-^Au>NZgN(*6PN><sf)~=zRrzB
zr@nvjgm5<w1_pbO=NAcwyMtAL^s0Of_W*N1_LnG!dxAM2`xB0Zdx1Hi6lKI7?hWRE
zQk1i5xDS{EO1pl$!u`M;P=iZ2I@}-30hN)PIKl(K90gGQ;~pIz2<CyNV8yh<gTNe6
zi_51dJQ&OYg>loS@DMNul-XTogolASpv*2A9UczmfaY1JG=)ciIiQJhY3J}rFb7mC
zFdYq#0&_r9t3v(ZF<cA`N(`qwK#QqohR1@XK*`ngaCjV;1Dabk^qc<6okh03MSvj!
zv>4T14>T%j8v$B}Vd(|V|Dq>FB0ww9?LqsFm{=kp%LqV0XnH!L0Gy&hLD<9@Q3&RM
zg0N$0L=m_#4^Ha>e>oybL6HEO0cB!|C<ChlnIQWn0-SZGPxD}r(Z3+iC@sXmV7~&^
zsjIV4Wnf70mS?;M>W7?y3NugIA<V$g_HOz^4;D$|*hp{!Tm}lzTKh;zQ3eJFSx^{?
zbVf?aFfceMfrstw3-}lq?1h9G7>>`IuItGn;m#W=4^mqSaxeR{NCi<)n;#U*?Xi*I
zfx~5>GI;NmNKj9Pp-Krf_;0Vr#=tO7E;2%zfx$FKn1Ny5@990BERrFaGE(9U3=Zow
zK&ou72{SNcYdOe(+V_rpBB?11GIAme3^uPoerA6r1G3nd5oFiAOc@2RMvz_FZ)6m~
zp$76x_MhoLJz3<%&1Is&mO(wwbR<HUfua53bbT)tNsYNt;^GVpjujvc^D?6(K%82T
z=kpw*Kq2AS1WGe@+ol(IvB)qAPw(|&k*Md5k{4rOaJ=dvQj${45GAhw;(!u^_M0dL
zu>GLHVD@KGpzSrrj0qqwS^Q*UU~u+}QUOK88#V?8g-cPnV0T$EFicWl;}-(;@ZfF?
zuw-Cxdcr1vD(WH3z`!c%#K8s{t8)rwVqgg4X9MkHfwavcbJ-w6b)dFcbQ>FJs17tV
zD$Ky(f1H^OR2evd^7hg*)6=|JjO*>#mh&($IDtCi$N1QG@Gvm&8^m$2edT0ea01Ou
zh4Hg}699GP!J#h5_8rWD8va87G~CI=kix<Cg_VK9=|?;RgVUN|1_tdnY`;L04dAwi
z=X?&f&m0U4&O8YqLqRLz7%I-O{S{_la5Db^_pXC51H&#ek7&?@jB^STXfi1pF`0Do
zd$cIHrwED|zl+oTeORRGb>yQ#>B{*m69Yr|!DwZ8mRPzp8q%Z$Wh%9>Xh@S1lt_&~
zMT3^0F;s!drQ~VRkRCE<CT9zOG^B?N8mUV^5)B%9)sq2lS_#|38?DE|z~BOEkhfio
zhBQJLKx;C?7^5Mr5Rgra9ikzv5RgrpP1D(ZS(F%ar)&ALNZA(0=yHQhNS28KX?NKG
zY6LmO7=XuiK!MxG8Dj|MfCBf>q!=SG2UO%L1Ws@CWl>{PoW8=BMb@i3#vEjlcd}dz
zXzbNhoQZ*9#?Kflkb3YGqUq@vP>+fM+}@AOjREzj_!U5v)kL-!Td*=vPrk@-I=>%_
zYyxA9J;=N>$;>g1oD2-E;Y<t+D@|j-V_RVJgyLc#Lt0FrQ4iOU7|>9bt8p?<j2lS(
zLQt1(ZHzm}U~tVDnH%E)=74+>-!r|(k44IgGX}H`%QZPgF2<jgfx-28Fav{oLrj1a
z1B1(fU<QUIMlpd>3=FR7!3+$6O))_r_QGHW2G{865Byj(>lem^a)Y!9GcXvJCB%Rh
zlDSoaQ%Ot&sLLJ#3d8&zF_EBt{$@}rac_u;0w)<z_BA~n6QuykUZ7H5ZbD3yCWr$n
z*DXwAqKrYD0Fj*1Jcby^VzvlS3#DU^0OuhN1_rm?OmZOCa)LTrkbGvmobw1+2IR*s
znd!^?Su~ka-b}yf&myIf$H94)gMq<anu&p-ONJA&SOw(1$XrgyViizo={P=JIDkb<
zR|howu!GA0v?STRNF+I<n8Cmsyowp5h4rujWak1XO&ys#Ju84kwqDpELX?5Qy$F_h
z4qvha9kgh02xWNf@C9K8hQPZ#nlm{V7(77b(Y70!v%oz!kjb0}HD`l4ATLxr(gdx)
zf}|N?Tg|y(8Bm(hPS8Xwz*3XZoX^1!!2sEC<=&tPT7d;wkGt@qCTI&01GwAE_Dd78
zhX~~A6erCkVB<iutO@>_pqX|C@L<x85KYJ)B5np21_l<%>2ZN9iuGQa%%7DR7(7aa
z85lGdNW_8$^*r`4F)*wtj0I0ngQwA&Yh%GPI^fa1v$3(@sjgGt$ySec1_qB4kOl4q
zYhuME85lhFXfrTme~*;_m%YLa4BHhQbU+J6J@vtfNC!Ob6T%=;kX)b1pkoLgQUj%;
z_E;TIXM*7rC>8DX(Sb~!*nrcD4rmUPp~@DNRwDm7=z<#mo}le7_A_*yAc+z@LZ|DD
zWSp)GxR`<%rwf{cWT=7|rweLiF;vytGAsejwBAzE<zry*Jfy?GpuCJhhk>E_4WkYN
zgT(<R9R>!;Z_GLj43<7DIt&b@maIAq3^V4j=`b+(6|w6uFhquMFeJ+;fqEHUpt9{q
zn36AOQUKic-2O_*Pk@0zy$_TK-6WO#!7`wVROz)+fFQ&4KS3<=rWQ&eU~y1NSrMfa
z3g)ngB&Q@XD1`}t#;HM3>n5ob4weD6-;`cY4+v(l@jLudDTo{7@?ZuA!AnY!+zbp}
zym{%Vc??Q1AT~H}=>}OSfx27XSt7}~DGW-GCH)}V<_9ZTgOdv=T^4yyzZJ}4?Eg{;
z6u6L-#%-honm&T0v>ByJkN^caM@vBovW6B^x|iHg0xy~c&!#3ZD1q0^E(6V`Zc~^Z
z6T%|H=rg@CghkCoS}9!=RK<b9qmNT5Llm?G4>SSQT&t7`lKIa8+FK_zg@r>2RDpW`
z04-Vnqm&4$;=n<wU_SkE2#dMt45b1{v@<a<=*B4($}=$dq(D-U5~wExNk!}Pm5M=W
zU>T_Sxz}g9e<+JQ-*N{%Q1#;j+UR3HV|q;}i)4MQ9;A;9Nh^Aw(M(uc(bEM7kuAeg
zMh1pi%z6ea3=AAWu*p@X!)HMI95zbmnesC*__i}KFtjr0nS;_kxP;d8(6az@KtWtq
zpl1o@fa;pGL_I4ohnb0?p27ILo;8>U3K~BFJsU6w6f|~?dbVH=XvE9JSI-X20gZT7
z*6G=UIN;ulOrxFyhyxzv>c6b#2<CulSb;TqP9P3=)PQNKo->#u!l1;!ptw=bg_(iD
zr~U%GeA^<-z|dePq6eDp^8*bUwKC}WgLJ^W69DFbywi1DFA&UudM60X0hMIN-}QpQ
z9H?(Xz#OP=LctuUZ^FQwdZ>58K|HW``Y-E6fH+|9lq}JU1am;%No&@FY;zC*6$YG-
z4D@0J7#RFPgX9}a_2NM4su)C^N{bov;=vq{Q_BkU62Kg&Qxm})kW+WQ(@Wy<h9$}q
z33|z3DUe%_=INz?IZ(Hzf;mv9rhz!8I7ECx{TTGpc|dbZpsbMne)^qo7K!@4$$D8}
z6`;0m>mj{tFh>Vet?%d3%aLYa@N*YtV3>HCL$3hje9#`oZ6bP*J_#sqHl^x8(lHB2
zkIG-YVrd2je{o?3hCF`@ZP0YDe=oQ^)pmqug!Wi%$Vi9*s9&_#M;kKTYXUApwL#Op
z3{|F}g=$kHIN}(KIT#rHkMe^yw@+Uf!D8yLjFEvMD_?=Jih;rZKR*M5?!Gw2YH<bz
z|6b4}WzXa|#u|Q*6l9Fy76U^7KXi-%q;t`x>0*&AW{jcJeIr?<>mSB3c7V#Ojd~1|
z7(q()LBthC28R9rI2btM7(s(@LBaeC44MDp7<>5{7#MDWtTDeE$Jh_%fmX12M#M2r
z1oJrf85mAD$1zR<^LY3f7(|5Q7^i@F0{jdNQNnSIQ`tcKz(n{N7~1Nm#xYJ~V_*mh
zmf&Y#*rFE4I32811td8yj&TM^E?EP_n;FMA8^kMi@MU0#WsPH;2jVp|G59hth-Ahw
zE(Dv(9N^2qu;h3g<01$*#Fv2~ZE+mqVhA_Fmw`dZDUNXo*cRrPdS3>H&N*?6poM@z
zlbI8I85p9w;}};$q#Jx07{tuu7*|8MExrs40nBlXYa!eYUj~MppK*-qAlx2b28IK_
z;utqUxD$LC7&5%$7&k*Kp5n{E;N2I;xCJ6R!<T`9d3zjV!d3`>&T>WuhRK&0cYs2l
zc>##WvV?Ibn0EohYZ7PN1>&)QynEnr9OGV)?-#QefDF12$9RCBfgxx!8%Va*F^=&d
z*jP3e-|4Q=ER*Y-0^%4iaxgFi=kYTz<dwxSUIO)63_uZC+!n`p8O#Gk9pkPz#w%bR
zD6&eD;~1}kd7#+oejUen4a`&EXJA-n9mjYb%mc-am3<uJ4KUAupMjyuHjeQom}kMy
zz;INjK92DgnCrmLz)-U_j`21)L3)7Fxau^HI7ZOI;1FRy28P(1af}Z^2ap&jfR@cF
zeu!gy4Cb;Z_%Sfl_r@_kfpAqot7tXi7@vZ<%o=_S459&XjL*PaCT%|khU0B<jL*Sb
z#(G^p28IK7;}~Cn`Am9#3=CV(#4)}EbD0f57Bj^$z5;W(jQtoG)*X&xd=2I@+k#w~
z{)Hos@f`;PL&z*Y1_q{zIL7zFpuuDwkSm!};}}1J6)W)gF)-xaievl?<}&GkOx_Zg
z&iDn)X9QWy;TgyH6~fi`V_?uwjAQ%;=7Qb95+BF-9n56~xg+mQ9ODl#m%{?&j-@X?
z#4-NnU|<OI<!4|pKOD#S7aXvlnDpS8z9*JNs(!}(I3@<LC@9vB#Kti(f_b1=TRkt1
zi3!XD#hS>QI3^Y_4-{()J>r;H#XyM!6l)Q`;+WXLa-c|?xGj!}9nACKXJ9Djk7MEh
z^8!Gw*d50NT1UxX5W&yDaJ>Fo91}NKGJ&6gp+hN-iARKiAw)QXpMgR3UmO!JSgrt6
za23We@qu|2AeE7EO#EP813v@96uvkn0WhzFpMl|2UmTMlm^Xo+fk9z<9Fq{3H-n#n
zLH1f4lQ5XK0JK^*xIT_a6wC$XX<^qmCNZ$}8$hdqcf~P@gXMOB7I&1#F-d@Vpv)ur
zAdU$%;mu%hf}epwZGRk-6j<&8KLdk(a~zX2n0JGpfnj+=9Fq)~_kf>)p;#)8Nfyj|
z!2l{>r%QVUFex%HgoBE(F26V?B_YspHJ}K}E1RAd&myfG8^@$72ohxWV_@(}jbl;+
z=T>kMKj|39qz>i^gOd1)v(vZ5vuNqq#xZGwEa?O-$c|-=V*=gw!_dj?2Ra!fj!74+
zLm<Hq)V-R{lfa@=U%ONwjtSH{2#@DyVAy##j>#Wn065R@+Ze|b0Oo<$LwjBoh+_in
z*bWDUr=&p~QwUfR<Yp#|IHph#?-r<dh|G;+0=0D+Zt;Lp<Eb)<IHo8L28Qs9{0t1~
zyW^NZcc(Cb?66^w+aJdi1JY>#(wP(+#{_BsFc^TBjoTFo#4&+tw(vg=83l<9aZDv(
zr64Ph_e}qsz;al;lqHS{wEH9CSONn>gbo8kHzNbX?(FGj6IqO$eHj?0`NuIG2YZ}R
z0aUE##4&-Qj^P%giZ26$a84Z4Nr<e5F9XB;<8e%<q!<_?HZtmf4caR^-6@I11XLk_
z47v!~@XgNzs#}C|;+QT$xE@f0E`tqX0@W=bgRX!LVhUlfWMByJ;{vY^fsG?F9o`_!
zz;MiZ`ne<)30@l>NoEFy$P>a03~M(||D434A-RcH0wnZSn}LD%a6G3Ns2Fi&V93sz
zZj#KRQ-5GX2m^!16)9o(V!s0`lo%K!c%=EHK#PQ6Ex-c{Kpp?I1=65nL83M?F)*Co
zC!Hw<S`-9omuSC{&H|6R%>XsOa-wAtK#LoqL4BWWt^~-UN|3td+63_G5%AE6eMLe&
zXz3tF5U9x&nVSIWXh!pbno?Tf3E-aQGEl#!@j(K(r@2fDJdIJszz{79_6NAFCnO<}
z02;H3z5?nMa3z2z4ZyvEMF9!mNdxfgs+vp!c=#W@OLz)P0(kg;8R&8dhLr{hkl|O*
zsEkiz0%Uz5sNEKND*?2=5VDlae_sN4I&K-Ly&1A60X!WC?%V_)O8`&Dfjc*6V-p~&
zAVA~mQvwn|tBfJXUPR_5fT!b@iGc!XnXE#BGHCidW*@}ikP$ObC@m6B0L?crRI!NU
zq~<XsKt{|!jn7`E1n`6d*cZls6F^-S$k{LoClf#;W{{=S3#KMO=3qfSk~^LN?#6)K
z?Y}7jJktkuccF?@0;C@U>Xl_BC4i>-7{KRs=#@_|OJy-Mow+jsJbee=eB1gh0X%)T
zOpbw#fk8IJLJHJ=1&yT6|6?H~3u<PuF)+-@ntmshMWfzZCJ~efVnLJR*<6X>L;#ML
z6A_7!L;&gsbjc)w(g0*YL*Zm1C=EcmnVL%yK`Z(h4}uazWNsp8L5$mOaZuQ)R7mh;
z3otOm&Shd?*dD=`!wp*g3ktf7gM5(fgB<lt3=9Rfe0iXr9(b4cNgY1Ou)hGf?OefE
zz|6o98?D5^Fr$&LNP>YOc0W9|&)@?YuEf9~#mQF;_9Rq_dD0do1_t3<d_Vaa7-By_
zMVSsv-~+ipiGjgp4c{-YhI*(R^P~-`3=C6O@G+hSi^GN2s4_69aPl#pK^A5@(80pM
z(A2@lcmXV|%D`}X0UzT<FbArY=|GDr14E%0ALAud;RY541|K0l#>*h#`Zt>y1^5{M
zvNABlZCSwx8Wd*y$IrkZcmTvv`@r~L5_FCgh+{v4i9r&ys1a1kI%!()f$RKuMt;ya
z0(^{rKtcG1A%TG*t`StYwp8*lfp-_Z0oC}~m-v{NLA$2QK{fueBt9k<@OcpR8Vsro
z3?6s+nApIFGQb^QA;`eM_=15UUIUzo6+!cC@e-;G3>we*m^KQ7Bw%Xm1PmD%EZsQx
zn3Fje7~=CG4q^sRkG=sF-fAECm_hTS45wH?Wkb9R14Dd0*jVA|^%*Q;^^<s185p`h
z@-b(C!UVQ@j(HM?Dg#4wIUjQ-sxXTx1H-Bte9W21YwegPfmU#;pXFomL|Ghnpdgch
zfvJJfCJD4UE&;SPHk&I6vV;<p7EeSZ)pLWw4qO0v?M>nV74ru{{l>_fN#OGB6lm|N
zl6MjxSO&CC+{ZTwJd(BybU;;gYZ7E>G-z^d`q3mourg3LF5^m)5SRlx^XAm%Bw;WI
zG`k&{n*`cLkuV{SL6Bkk<V+U9`m8QSo+QxngCx+%NsxLHc!m=^wp?$S1S#P_U10qO
zNuU+fkj)*3ZIU1*94MF0=u3i>a3II?c_o1t9Dvu<=pIf2FE{|NsSyuO0!=|N9t0Jh
z-G`DOQ&4%J`9!15N#OZ`WuOy#G#({^OFQuF6mNDCq_hL=^^E(Q1S##5LHo#ilOXd0
zpjpT5?~@><ohoR&+a?K8+JO!Y$=sd<TGzk;J~YJ8W%|S{7RmYtNsy8a6pXc(l0ZX^
z3{{}jg(r6>8Gy%bKw;{UkYotvfDZj)=1+pG(*^~w%=9G4P$Ou3Qtx~cWT+7|mb7wK
z5@_y+p~{enfnnE$B*^3s=)9K09Z8VMA7jvwT(b(3K=T6(r$F<cCa;np3mQOUNhV*C
zzzZ6{15n+&lfY{jmVsiD$v6qL;ew$GG)(TdC<!!W%uof|5>b0P3Dmu3r~(~WbaG1)
zWH`<l6iSgvkl{GcoGCL$61aQsQ3c-QKOqUyzjtF|V9+~}1R3oFjo+-CoCF!|1P#IO
zI+^4S4h7HwGD&}uz$101KucjFbEkjEX3=GopDvffqGY-;*$&jayagKTn|?hReBRI-
zP+TV|CWB8>djlHA3}{aVO<p8V1XbSJZ>E>#u&CGDa3p)NGcY9Y4Q617Dogg3WMD{P
z3}#?hT%PO$VuPp2SHBT#Nd~RgP5}+iD4t3NZ7okJ2W6(LzsaE06DjQ=U#`8KoFvS^
zkTSi+n}H!_Wpc6*14GJk#um^lU-Dki$thE<_!t;c*n~lQWHgffIrJGAQp!bAk{Oc0
zt2o|(jI5uQ93;ZPkUS0Kol1w~U@!;d14Gs6Ub!sAj1|-O<+2ztMo#~j%i>kf6<&}G
zT1lAtnu&pdr8XI~k}&l(gMWT$2}3eyAz|ttHV1D82L7$dYdIMh(s+45JXZeX^&o?5
z`9Zu4>*Nh03=Ao+`8~WD7<3wvHwrQ^q$%^qcr!2rswHm%@r?N=fK1tzyjhrmA<bF9
zz#AN78e1e77}6pI4g53n7?MFf`DB%FkeO4vlEDiL--Ks)gF3v^ALX&kVbq*npU<M{
z#GlNp%*()#Hd&Z~fvHm=1+>I84Yca+jB*N}1Or35BPb|X`BV78jsyio&DIofsRNG8
zsa?}w<+DiDUt&qo1Kr&RN{dn^DUkdG(#p<}0?ALHDBJ0s0?ALH;^b&{3M4-<gW@Ia
ze-9%AL;G&fkWMN)8v{dnmJS2M{%4?(_4sF?k@fkd;0dmMovFN_Qn?DGetIxieR@4e
z!vY-!hMc7!4LLhN8gfp9hT?PXF@xF!=Gi=MpmI3<Jre_i_YpU6ISd}2Jjmn*E{4G?
zNg9{Afj94fTcDA-Zs1}Vyco~C+6~;y{10A2(_>rW23j$cl?!g2)w}tE%6@SBrAr3N
z0hNr4gdrU8CJBX;P!4FOWpW9aqct1U2%Eni%;87^C9mpMFoyxWVn{9!%z^B&iZumu
zAj@1&A9jN*Mp6Nd1-I^XgRDjZjU76*xq;I$^yES}@M@$gP$9O>!VSC{34C&)ZM_?0
zH4>=YI=#*fd>TX*s65*5<rWI6nyO4e>uzqkfsZT%Z;v<m;s)O3SOwZ1FS6JTd`!ft
zdQiEQddUrRP6PvZOZ+@dw<wSa;MIJp``jS&cA(rD^UW;=ECVWAD!SdkXBM6UE!*(_
z<rW8)31DJi$V+gG2XjDsxR&g8O8{}IK+|OLQ{6y$ouMicG_l;~mIPi(R0TSzhNa03
zyi%$P)T-<=a|1U8sz5vEMgO~jTLM+FppDZeZs1jcRdGxV3?~2Fz^ekQ;z6e?cDR98
z1%gj%+otCRS{2B!40KYPg_2tq$O+3plixf&Zs7G)%Rq;-Z5MTO$N@=Jfwto(>~;e;
zF{?5`XNR%7fm@hWpq=E>U2fnOW>q#51B2@pH}JxeD$uTdQ;z9&#Vo4zB{$qkKn9&E
z03}(;N)<QI*@ju5^Y*g2+$xci7=!~&Vqgv|i9tBfBnINZlNg8tPhubrJc)rg96|M<
znmE=JYLNoS4S|1E+(2h2W`mX=WplYTA-e&>fw}?Afw=*~fw}?2fx7|3fx7|3fxDrJ
zRU9-)0(ApK3bbTo^}*>CB`h-auT<PX!@oJ8dHrlIw_aqIKsZpBfH^RiKsZpBfH-iM
zfH-iMfH-iMfH?3B2jYM-Ts;HB>Vs~e^_@BLDxlUR!+!>b9K9q^j~NtFGn^dUK!>j7
zfX=4N=5hlsC59CU;HAXi)nwD(x`CGxp8^%74nN$$ONqf9kbO>W;FZMSDVLHPZs3)~
z;I))%B;DqL);TA0NPwE)!5fX-7(s1}Tt9x$$yaWS=8&-92MxHuc%YH+MZ!>C6{umZ
za1zGj<Y!=*Tms=~%?6F)%wG@TaU_9;TB}<jJcd)CCcIoAh*uAe98kB$6vPFsT?4h~
z%WB*hEkJ9nmVt(trkT4jT7r0|)c6?~mRPtkg0_b<{MQ1xJL0;J8zZPKl4lEbH~28;
zQ=pc5my8=Dga>msm<M;a3oB@ycNNUxAW4M7K|F-RK|F-RK|GEi8K}EKJcd&+cZ0UC
zF@W72nd`>r26Fc@kh@J^x-o)R(ftRFONKsnWAxwxuT}&NOzw(zV+1XvQ|~k3XJ7z%
z7_yQMG%yMBFnB55e-}^+VSLEIkmn2TZ-6Tet4l2Ip!HIDpab;I#=1iW0zkE7myA1P
zAOKWLvTSsR3<Q7=B;EEv!X31GvpyfxB0ajxT~!5SDo9tsS$9Zl7?ki2w7ElC!=QnH
z$^>`tVngsi!0u3YNNX6B<n+1RA+2Fhmhidc4%(>5kp!xPTF$wHrZD*(K)wBbW_L&f
z88l3>=7_r<<e)TB(7AhB?vUyo)HzA#a)(s!;EwmUchc^lmT>-hCI*J1yWCCTPVMS(
zhctviPEBNRhctviPCd}=4q64p0A8HWy3rjp>kOGYjxKTsO*`v>Zs}&Qt50=@%sYdc
zjhoEeL0gg;z<c3mdbxx4Br{Y=F@V|x#UDUzf;1;K28R5PIt&bbL7*nVsX3q~0beSp
zNx-!iG&`TN3p6`FR~a-rU-A(&J0ESv4$8@)K?-U991IKvpc-Y0c3L24wahZ`mXOHY
zG|=2R19$;;rh8hjAOk}|JjhR4^U^{<>cCmKp*9V)90qbyTfx+{Ft9REP#S8bg@cvJ
zfcmxhANd#<3R13v_Th*psHA~LFAMH4F)&QgP6N%wGk`l`k-2HH+@SOavo#JpmIk#o
z9&8+_mEBOAmH_5}8WAR6(h|WOkgWw%(~`h?Kw)R7m6i;a0T=KN$ueo6Q+^9U9WUjZ
zY2c19%vx~w7i_DASA7~}ZW3gz+}AYF+@yLP_<*J^3yw6<>d8V-TWE@QS^=ne1~US5
z*a0NCly9aLfn`7@n0!eC51fD#=$ut)B|Hoag}IPP!YT%a!WwwF+U3EL2C4-W3qiw*
z$~V(0!G?g+e`Ic26_^8RP8RD=Us=T>Q=g=g23mAn1lo==MLVqltN^OI5zGOp&U8;}
z5<-f*W{?al?pnYcP$(KzrL}@N&`@jx>w$)1J6J{m6p@9XeUyDw9BEykA-f{bGE(K6
zX+0nXuz=_Vb3k@mc%}7$IHy<`rZHwDW-^GRO=Msw+7F5M$sj41rYT?!NK>YJ+ElRR
zpwQErmo^O~19ouK>9px!4*2-V>4&RXgiN*5=75A?#>@qCK*lKFOq&PhfQ&Kuk~SaA
z0d?Esv!`>_uxLo%OamWm2h+L?tN^5ywPw0+4U3G^a)mTdH>Y?rXls9M+8U4oa6M;K
zo3<9r0hulLHEkUa1A}@UsL)AeOj{3@0afm*Qqx!0ut=NFJ;0TAje~)q_`66+Vmd?G
zb&v|MwTG^y-2idGyTOkzq}>E_*g$zx(_{MI8WxHAL)X&ofki<s)BBSKK6LLCSP91g
zrL;#J3=AcSA{i+~3~7(085oKWfl@$2ZQ2vCCQxxF_ciS)*n!{^fZ~MY(q4cxbwV_~
z1ZnyX(j@ma?G;!Zc;9&LR<X3V91PQ^)UpU`oxY#;9&X;Gg0v4{4ru(BH9GAhm?H#o
zv^MMXi?u8g^(8mb{(+5RVz|M`z~H6D4q6a)D~%C!{(h;Q4g&+n1W;L3?++@gwyy@2
zRcV(%WtB@hsH~Fr1C>=pZ$M>L&m(pn28N9Xz;h-Ol2p<dL0z}fatE-V8TlaY=La1%
zpT@`!c8e&eqMuNh#t6F4u;er!s7~HCeR^#ji&R8&Z5pE*SQSW-?cy{>br7!#tf>8q
zTpA;&)+l`mHC`LVcpZ?^Qy`5zo6{I|c|g5tu*Oqi)8E5PH-alVm72zA%mX@^4XntF
zOC*gEbSPU{G}QE3km-j&%>t0K>Od{xWgyd8($W~gn+X1cCwz8_PEV|7k+!x?V{Cz_
z0r_Zgx>y<`=+w2cjZoirfF(i3bu3L|1fANgUdIGddMtJN_IegA4++jR#)%vZ4CTuF
z3=AwA(-<Mgt$}n@Elpzt?<!jcYM02ZOk)I{vdd5fI;ZGlUK%5KU)eHtkZBx&(={7d
zq^;JbG0p<n2o8`FSJN0FO*}r(RHbYh;~Z%QhO#@LP2F;T(irE8GBA|2NrUv;otR$N
zz#>)OP@BfM2*rTKU>?kXB?tq)rh(7JDL*R>YHl!8F))<hffSsE3=Dl|WYQQ{a4;}b
z7(&B!B|KbN)}}G80-Fj7SCAt?qZJIN`1l#p8OmkT7}vlp+3%mmxE4J819qkE8R;~}
z4Ioo1pr&p_F%`Vw5$<*Hjz^HGU_-Y+3<Y`CIcj=cBa5`h+B8PUk!Ub?fHykAb?k=d
z05xpu(-^^99Z!J{Fv^xrW84dNlsw3^&GV-}Y-Ev6sYqjloPGu}ZJA#hBjorqP{=L3
zmBt9(fOkp=q(gHRe;VU)4hDwGOsF?bfV}Y?6z9>0(il&I4F?&cRFTGb3LI42{Gd_t
z=?P6NvW!{N>zY`k>({0+UI5F1RDy!>BA5rV5EP1+;Lgwflg4-%EC+Ia!{RhX&;e*1
zL15==88N3Zf{r??0xd%^-<-yH1Eh2r$T2o=(-<LVoq@LbE0?A*f(|>Y5@80#_;iV8
z7J+bSmNZ7t(PmZP?!cck#(N;$;AVBhnl#4y@(c`Be&7M{%G(SKRk83Ck~*C!jqxJ~
z149*PS{r2VCy-9Cz4O0MuWx3Nl|99h#`q1S<PfOM{wIy`J4gxGaJjG3cQ&)gYWs7f
zF)?v4FjRvAp`kX7338Yi$n{3GX-tr_#K76->vYBz7Fk(GmNX{N+)uR&KLbN5V;U25
z@&`00FE!n|g+;c04oe!7C=UZebsawggZ0TYCh$RCV3!4Or!k3x*7hv}XX4GFGHFbp
zvak9t$c0>KOrV({JsFVohfbt1frraafqFF}N7I-fo1;O&%=tNu337h4D5!JrKaB~r
z(TJf+jGuwQrhZWx6KK|up-P;efnlpb8WUvRP=cR<p<qE8lLR{hL-k)7P#jbTGceTf
zHiMRg8h}z3Yluu5lOhKLLk;M>EXAK`OyGfSaEO8Y3Le=8pR^_SHH`_h^c~cUGGt(=
zmQqM#0*ztU%;v9WU;yca%+i5;0@4YdrUUDY%uQp0%+ql=6r?3Gq%ncF<bexGkg1@F
zI`ujphGY$XB}N8@nrEP0Mdth}pj9H^s(Oh9zq&B!6e>{dtaFK93oHX_@tj!1uPe+@
z&mg1(YUL=`^BaKGDS&2|)pzh4GBYsL%!W<C9Pm(LU^o%N4>}_<Jqs$zJn@eb1H&{v
z{;A*+A1?X>w02OEf0{A_L#-WL^aCFQLzQwS14B0tV*x*Ck#lX1NXGP#HWppyDeENo
zmx?kl)Sh8tVCV?sUj|Bg;1<G4Wq$C52H;`3Q+N2mM?->#>9$AkuLMswfqWLwJpD);
zi+BB$b^NQD85ru=pw=?&?@(o6;NHQ{d=TVD_`J`=7ljNA%<cTls4KPiHx@E59AM{X
zZ3ETURd7QZwlOj=IKAg*I{`AK3bb)qK}0}AfPtZ|S0sZ$05rX9@sfd|-j#tNSW!R>
z<b;wC1_nWAK>=a7DHR|Qe?dX`6#M=HVFm`}w+iW?RS@-{)4pburh`{Qf>&1e%cg@@
zLxNXU9|}zeuZ9E<8Yn(Z2QP+P25PPPzD|cMh7=P?0G;8N4q6Q<#|hr+X}P*59dtZO
z{Yubz1wrYtAoqh4Mq6<@cr_$=timfO9lRP6JXVnrnGRk632t*b@~0<(^?;I$<%#LJ
z9W0X4tI|PB8X3Sl)nd-4gL@LEK)YFToTe}AV3GBgX-Eeh<k|qbk6=b=dM?NWu$MG1
zr{{q=ph)YNP0t5&KxVJfNe6c)z$aTD3QY%hC&0V>OKwc(?PQT;JU3mvlf^i}C%pos
zsR}gZ!C0LR?j%%!h8x?Kr-M2P4YjVI+zP5A8+yTAaw|~N%(GV_9khGB;SlJcFW2-s
zIR=IXaAVQ>eR{n-14F}ckeeJbr|;@yk<lpiNC({&(g+%tvY(OOg0zY<y%pTU0u80^
z^_l*!lSQ)LKfObqfuT{s0W`qf&<pCEcGQA8r)CTI7#Ny3br=|IDnJcB{}@n%Pp}o#
z;A>tEYVd7-3u^GSd<Hf6T$h3xd`s#;4L;vJ96AgPN6SHamrHQzFfden;nrbbP*dj7
zVPM#$#;e1?pml^#hk+qhwVq#xfgvGR0MrNGDX0TlX)L6}z+l`Vti!-CT}ecTfnm{Q
zQ5^<`^}oe*7#P^t#B~@LOzkCf7#I}UBy|`VRAx%)Ffe$1lm_XQm(^il*w7-c!@$5}
zprFIRu+&mfhk-$Cu96M|gATv44g-Vq3>DBy?AlgF1+zOG3_c7^pkdG2F0;E*3=B<K
z4F0KQB@AZwq!<`%xEL9{85pJ+ncW8+xP6LIz?*@=V~W`W2v5X6xtPK1A%r90&A`CJ
zIX$tPMYewG4<@sx91ILipj#T&6q-E)SJR+odiEc)=U@&aC|djGb(p>405yI^N{f>i
z%w9`@&hr4N(`z$(2R0WpP9ElN_8!au4Xre*nSB6rKv8H_X7&-p0gr~S2{iiz@<Ej_
zXgGZ0bF<H29%uxdZSHh|9u{j&;ooL|r5PBSr-6om_0`S(fjF~4{XjVjv;SZYXjz%h
z=IJFpEJpF5#X}pz89mGxnHd;b`1u(atiPBsvVe@`1g)B6e`dxAnin@_1g|DaN;hL<
z2RY{yBWQ``>@G7#4hYv|DkEt3x)~#<G-&Rg(ZZL3VM5Jx)?OBQM&0SEy(~(Mjnh4P
zS-f+qN*EPE8xKJ%n?RKn69WSSXe}QL3j@PZc{9f8;H_?;ZEx2zrh(b63=9?TGbKUy
zi*@QVFti+TWnkbrlPLw7{NCuwz#yQRDGka=w_F(*;_hdHR-v^#6lP#Zji3I%m&H&j
zArmxH+VT^0(!~miOfvxnhE~uRdur-*uRa#}`jweB%nS^z=E4jNN4HBDgC?3=K_z`Q
zmoa!H4Y)wsm}m^1X9gEY0cpnId1i2dbYz<`c%B(tAg$PE44!8OmxIfm8G{GVPJwqt
zJ7!53gJzK1Kx1ob3XQ@0bN@3ifezEDH3qMj0T-obV~xRMW~adGhT4NUj6ow{ZD!!!
zsWGTZh3utnuAQ#f&!XwHgU1*&aMd;iq5v|P3rb?mwZ@RiTu?vwke)GkG8a4^9m!-2
z-klCUw<U7s^qzhe8MB1~#-Ksbwi^(0ASaMR&4KKl0GT7O#Ml*7{rv|Ixme~;zt_(q
z;nG}d4BABk*+<P$Weh$s9HN9hhr<|j3rag^M!31w7&6lXGIxivF?gm29HgxGr&~>6
zkrkd~94W`Z&>jyes@i$k7#O6ar)N!Ikq@ift6<Csnlx_z#?Qdu^23-B;wVt7<V1uq
zBiL2oR>|UZ#*A(tH=Y8GHm966W^@PhK<lo>+Kd??^Twc-n8~c^_b0H(@Uuu5GlE9i
zIwHYFPv@G*BCQ>3%m|*MIt9|FaMG9&;&O;SV@8P6K`l7jgy{hjS!C<CY%pd79T3*B
zmmjq5%$P9}vha+bfq~c6m@!J6fuUnBXfdJo8)L?3a48L1oY^d7%m|r?0<Fy~xnay0
z1Dd@)wFVpn-wZ*wmdF@0KIULx=u`zSEiq<%0`?Hd>yxXE8J~iABA}+N$t+{WXJ9VK
z?+ac}o5Uh5Cu__IIXW0TZ0|Th#+dOF$TTN@28N28(=8{l$knrF#ewourz-<PN<mh<
zB<Q|CR|bYA`K$y`#slT8Z5y%@Wf&M3`9Yh_mkVTp>Z{HpObiS~3|XMnES*`PSmkWV
zY7k>!=*$A87EYtAMlgp1G^drD)dc47fL1n5TbtFQ!@$tlB+S4N%3Uvz1?nqz35n#D
z<}ze;g4KbHYp%`e0&}3ob%Qw|<AgS6^?*5G<1}Nl`ivPEIxpO06v$f4%)rp)7|g&h
zVPV!%Wd?@MBf$&|tNXK-X)!Q#2{FWRWSwPYVCVu}Z=@fSbzX{rApzp}xxcb5NHH*U
z#<4KOv1MHXDFU7IpkAJJMUsJ`GYI6OHj}KYU=AoBS372119L#*KSKYru7f$Cg@Q8M
zvTlGmActF5P2W11MX`QIMHc8rogPqLD7ld}8SH+Lq4O_hO#^d4s=23UO$T#8-prey
zH4DrE4XqyAl{FX40kuht{$?!zb3n~3o|#z-!5j&ZQiiPMAeYO5M!8%bWvv2>gQ}ML
zl}oc$gL$C3g;_Fd9hd`}Y0aOKwI0j?&7i7o%-RIzfVLjBXk~2$b3ltdk|t&C0CPZ1
znv4xuyTKgL3~E+a)*dhiG=s{=owXOli381`dLGW&2j&EU7Q3moWbFs@K=Y|#T3H9c
zoG>N^1~$vALm*BWXmZuhA?q-RlLb13b9HRi5ikcd=UH+u>nNB5s^YwgvW|&@Vg@vQ
znbDMW3e3q(U|{Il3!c0@I71-o3kL&352yhs!}2QYJ6JC$%)@tP{Qz@7VSa4a^!%xy
z1q2JSL8n;tfX=Bsy)Rn;l7&I{KEBBo1n1cqpe~5&;%pnx@>kdbSLTUNEEyQoW3z2Q
zCz>HdAAq*cD+=U*x|zM8bx+w`InZ7vX!k#F4tV|_Tmp8<<Zwe~H$c(8cv}u+jUi}$
zMB!u(sAmb;4Y}|{4yb3zPzBmGwD4jM$hnY>%8|J_0^rjD!Pm~k_Uhz-j+N*G&2D6K
z<$%|fg6py_nH<QvQjo{j?aP52(*qiORj5Ci16fxJTFtmzC`Sr@vZDBn9BD2FhCWtM
z(v$j{1E~!`No?oU99dA2170R2W0(W34Z#=f7#z-l)P|syQLGv{;Mx#;e87s`IiS8N
zLltP@Q)F%qXoEIGl{Uk4w&^Uw_5Eu_azGP8eV|>EXJd0f^FfdewO*DvpxO{}V$s~&
zIiUU4klm=0Pvt<SgFu<DYgrCrzxA?pIf(t%k-0fWoS+*3z{e%@gmdJ8W-$9egUDxN
zb0Bj=!l2Zl@0A0Y90Fx?udUNpPiK*>SLMjD=3rpx2Te_#jm?3~{eV<^S>{0Ien6_{
z-p+w6j{+46B{y;)%cDT<S{;%DUVsES)Kk=zBL`HY^@EPOIUAb;Sp)?#F54srvIq)f
zoSt3|xH?<LWCdE}k(>ir1qF&cs}nh((`X^fQiaNLK<7$8X0R-0<bZYxGgN`6l6LH$
z-Z+CrLSWB1SMWKq%fPME#t+k1&R|iKwsqwbV_@k21afZ1b5}@$0u3KW=1zY#gT+%S
zBZq-OBv&Xyk_~jph0tMj28Q$npi>I?ru)uhk*H4zVPFvH5;}(HIwtI7WMB}D5@J+=
z_Ai+y-pFKNn0c9zAs4iPVlt=za`}-9IpP-N<r5LPV5foeLcqLSNG<_og^*3TkX!;P
z0k>Vu1uu*NH?SP$<$@N*Krd}b%gP0>i~+A#Nne`_8F2xnP?rt4-~;Hu9k%%YxsapU
zL5Xsac`o=Y7w|m|nZdb`;T2F>DI=E)$uS_8PSnf==NRxJxsyt{;Dy-Wy}l>5<w6cd
z0<SjdRmp`k89`-b*vni<CIOX|*^_d?nFM@DNKQ*GIFo=^n+WOTg7d{GP+6IqoeN%#
z2tF}5w<{NNk}jw~%!|y04B&uPkyvHtf<|l@PJv2C)q1;JaAWcmsCZP2$OX40Pl1ZZ
z{EfMgwj`){+_5niGLQr64iv=XLdJ1GcQO>@=YofEPJ!-ZC@jnckK&vH-QBk^HWzdb
z0i-iM^Jp$4SAojXB92^0uId1-A}qGZ1!XISQ=l6fDok_13$Rat)|&2@&4rww1UhS7
zdv7k}yjaljB&CA6=Ad%p)Ev+X6@gqx%N2A%gVM%aNXr#;)7{3rTyV?v)C$l++IG3%
zmg^}{`5YjYYX>sG;}qza1do}y;FW&h8}ag1=Rz_XXrpZUvs}=T1q`P^yTg-r<${{F
zlMO&O;vJOBg|r)gFflMVY?-bxhegJ4=H*;>W(I}{UC9o4prMn=pmBoJ`|`wu7#Jqk
zg3_v3Tb?**uL?K?c>bSWI)_Cq?Oq;eQwv1F>0NosVAY`7)MQqk3RpEL+?#9jR6$*z
zsuG4|mpo9|P63thr}yO<fHi=OH<^`Z2-X17y{0hF2+RT1#a%Mf8RxQy)!)mrhpRrl
zE6)MU0jbuWmFEan4YJE*TAmY_1B&D3+B|2l#T5)GHF-R&3=C6d1v4;AR?Cy*W?-1?
z6U@LMb~+DqF689iU<L-+xI7b(_~~E<hGk#!Kxa8j;miXK;N-dUO`kTGMWX)rp@uxr
z3i&Cg!DkZZfmg4c0xiIv62b!AoSx^+#=tNIH2vKY2^w2Ctp^%g;K=}uEwqNgRRysz
zFiZuFANb3HR0Y3hVhCYiFftcbfE6js6EA>7oQ0KOBK6D@Pk@B{g;iieO#5Rj85laZ
z39Eq?q9BITj#x4<oQx9&Z%ILj9>`~4n8Yp|uE4-B6?7AsVS^z9gNpJ3VMfp%oT=Nv
zt$1O^5=aw(pMk+)tuSLLD8an}wc_h1NC-2Qg2MOB9MFKPG?#=hcu;)m2hjenYGFq3
z4IuwPt@JJ#Va7Wko&Q12^0TqRjCVmi$ZZk*s%*mG=KVBt&;)~wFr;}89%NRL5M~4o
zG%!?whTRR!gc%`24a}e$DK_#7Gd>5IvkZI(#=>n5!c0CK3=GpigVoKo!c4xPr6k}H
zUx&5AOnx99c>X9dSC|QWhSD<7{L%IZVJ6TaN|S3j7(f?ynfY_bNw708Oj{bvz#ttZ
z2Wk*-B!Ld%_$?;|t~){7uT$!y<-qgkumEM+9|0O!QceYpEQzSFF)&Pfs>8q#xezq6
zlpg?!*W4md?B}zACk;f)85pL01$EpFm_QpfPCpmX76EArVPFvL6){9aY5+)Nric+j
z#3P4+K|^$@h%svp1B2*B5ffHR28Q(iBBr2t{|~KlnD&DXi}4Vd9=L!-wZ6Gl1YD+o
zPkI$=69Jbg;NiTTn?=B7${WyV+SynUTPX&HX}dwS!?Gk1JMb<64bWhY-VFf}(0b<S
zpp_AUmLi~H1ajwe!A21mkh*kmr`Y44g$SsMp1~wi#314!&cHB(i2>9IbF7;FYXOUv
zBS#5n4+;ar3=3n>k*vmGo)QB?;d_xnJ_d#vesB+1fViNb^lTE@3>sH_!@|HIH-CES
zLKeMxDG|m1Wd?>BoiOElU$8JRa8`&gf`=eMN+<6WVM<j79g?vNH0m;Q8WRIUu!Omi
z00YC!X`rHJ_gZshP!c``DgYBJ%^?NVA8!VRJUMevK{az3BZGfxVg-Y_8dx3U1^?7!
z5Kj!W5b6};75~%}5LX(s5R37Ke`*qlrvT>N@lP!-U@%ux1@j*GrzU}TT43H2|J344
z26Hv=ee;Yj{8LjvJQJ|o8~@ZykV;E1?}Il3gZMjhH9Iixi#G$qDIRlm0fy-l7qJ-D
zOPFg3Ffhz|2l7l}rMWiPks$Z)UTdxc=72}|@+{1CLF)c7vUoEvs1%y(f#m)(7Wfx|
ztkMJZcmFe1_!k+PGMMXu+VKAw8~lq5O&HAeltEYVF?RSD85%Q~>uG>_6a0$|jTp@J
z>UF`~8U96vh79I<Mqu6o{~|*J26H`gFmHu_ktKt<o(-6@!N16Y!CVh?<l2A69sWfi
zU+Y7ha=^a`6e9Yd9Pyv=gntnzwDdvY`k(QFe-S7o^+DnKpYeu&5h#@PRT&r*8U8aq
z@Gk;Ifj%f;|1-YuF9OAnJ}6-SGk)-&{%|o%SiLn9gE?qr*KGF$28P*u3=Fp!85p=P
zF)%VPn1fbI&ECbtz>s5NZYsvWFxv<;COW6h+ziZN0`YqPnM3Mo77&l^i#ce>Y4$D_
zP-xEjWDc&n|2Kf-wy>FlR!hx3-N50WTu{njZY{>ZFn!w+7M=R~m*6D4n~{N`Z23zi
zP_oZwV3@r-Ulf#WPvtN$L@DKqfrc0M&Qr(-^-AV|j=Rt1%9rF~V3<<~isLSse9!<L
z<R%S;llhRHAfOYMyvy?;ttD^=B_SWuS_1WrT?O+&O(G7+!peP1re`i?k(D-VC;+u|
z=d2Vd$Sh(g5D*7lkO{J)S#A2lr7UucQPU4BW$AHF6et93{hFH(-c4A@13#5q`%NJ)
zxJL-i^+H!U3PI-01+BZBFINazn+`Hh=*jf{Wh^rF+b=2<f;wb#K?hWeoh}47FTwK;
zCbJ45%}Wju(B1Ea;N~Ux^avTzLQwGw@$RyuLeSA?0tN!0^0Mhfp$vG-k}v~<*kyqt
z&}|I!TtHW18x?`OQ~w#j`|^rFN2oHK;sEWZD7jGtTEoWxHrr6O2s9qaunfHN#7dK;
z2sG<A4|H5o$&Dh=Itzwn3?i8+6%0k7&KP9%RBhMv!sRS7j3=k}EoV{FNMtDj^`GWF
z0rh5Y6oGq8FioH&0@rkBIg6}mk3tcs%QW8%JjzpK3rhI6KtZ(pauKMYoo@ze?_22?
z*-J1m%(n(bq>|Khy%j7nj5^c3SFp$=-PE!u0`+U=Ujkj%tX<?S%)l_;6_oA-dWw7m
z85rh$(ctiAV32Ak0-gWQuuMb4n}H#4P7!F+FT*koEpG;fuC^l3VBh>p8amz#3`!bB
z;2WFYXn}a4C#RoW!6I9qRWDEkx}kXiXo(J|QBfEtXyY8nsa-Nf;h=WZEpV*wNf0UK
z7hqsm06Nbi`EM~e*1?_Z0^edtp99oS>(wrX^f^HOJE>F*?sI@6p`x)E+~)vqdlb?s
z1~oVtma&1nZhCrp_DUAXdYNKSdT`kw0va~klTZxWJiCBPn1P{xt3WYmMdd<J^0&TM
z430AJUV=Hb#o#Cd?<KHEEQWNTLH)a_yv2|XG_y!jVi7|zqyr6dqsxk7PzM@vse;L@
zVn|b;gUJfCnztCz)(3Z*XEllxgUXDB<|4_71q{We(hLj>W`e?I>Gxtt^Bz2OeUxXq
z?J5?@dYxiWpP3^FESR{!qS#J=fngD-ui`MT7}81yY2J3R7}81yIVS#pu@k6e10G>_
z*-#9wYr!Mz4TZ(vfnV^}P@Cz+;PyLsOY4q}#gNTHpgixer5IEPGgOI!2AyQ&ib2OL
zLauGC`d91?G8?>Ww`EH)c;p&<`$<=2F?i$}yp1&UWHESO19&Ug!q{TSwgyleVdl|d
z@U{l<!QTA6#o%oX;2tE$`C`bJF{lS=DN_s@GPY$n1?oZ?9xa9p8JmEjF>yh0C^G}Y
z!gyf@2AOM&#h@g$s9PknxQL-R0z7}j08%D%ZTiI3EW+yjM~aidn<9f57~<v^r+}6n
zoC;=O*y>!I3TA`aCmpk<pI*)4R==n?8*Bo26eu||q8PL&axthcX1Jv|UzmYm(NR!%
z3mFyXOM^H95Nq?5K^&0()MSeDH9#DYyO-Q4&Nl#YKwa9U-;2S!1;BmP>5avOV2eN_
zc~-BALAP8oRD}wI+@kSuf+47AUVIpQ&dc=0Ygn{Q12T+2VoN|h8T%PVGLTtI@Yz>J
zvhcI7?0*=^fs0j8e`b5cbf&c|DvUnU)z`Af*QX_jflAONpsh_jo5jSq7#Nnk26^UG
zs+c&K1Il0u6=I+Ryq1EGeY6x419fng@_^P6Y@aPACB(q6R2<|@-SuM9+zbp$c|cQe
zAzorKAdWW3&)X-8$$~gMAScwMiGkd+)WrdGyjzyLm^?@-7BuGB|4R&XisMoqP}f~D
zd-~(GEK3-lPVZR9B43|(R7?kC)jU}1to942xVy^0u=FITiZ@^aE!bSTQ;C70+fWR2
z*Y(nqaHTImmyiXCfzDWx5`&5|PXz7ho%CG{bk>sEEx70sB?g9duf@RUEFlISEf**;
zFt9BWv*QEJ$H5hYj*i*ED+W1wNr{1B-h43!R237Z$FFBmlhsgVV6Zn4V}cwJ2-VND
zS3#J8LFv)-MeA8qoO))JfU7WYw$yu30;$3TM3R#kN<bwR<SI?JeI?+1oZwLzKDH82
z4}t-FSiax-=^PtaoFnIyK$@1Ic-&G@q7Dis@F)=5z7h=(2RtpNlUAY$=75UEtj{Ij
zmL9nMeju_0+|v86z>wllqRh&`uzW)>1H-K9=}R`SDAeyf=uiTx50_s_U|?82m4P8n
zpae7`u>zDwH_Rz91DOggvf1{Pn1eZ>5@^e@5(^LqynWRBWr-!2!zGfOnZi(F1?GUp
zqfAeiSc5ry3@HL7#;gnsE8M}BmzeN^)*r^pF)%E@0?HDcHw8*S8_iZkConLq&|v_H
zEmNDGxRFIN#iRsWz%2vUDb_^_C7^<A#WB!f<6BDH#Tgh@L^Fsa7p5|lc!)7DtT+Y=
z1A~1f&|=J!fuWhF#Gen;@nXCHnl@SiI-hAultu|?=4~Zt>4xE!>Gw9WsPgSA0dI!_
zkJVa5P8Zz7BF<PmU2_wQT0MUWc$*S<WX<4WNty@)!-~_OTq7n{k`CfDgNlHo%q8H>
zNZ_F-oiiobAeqw{ObiT%c}sFYoaPB2CoBier*?<ED9PtwU|3}hE(S^v=bnkZFDVoU
zNr3Vjw`fT*Xk!WF;4@|35^yj3Kgc@SloIf<wcv5H<-H}46Q4nI3`duiKu&xHWxkGu
zB{ksP^`N1$1(qe?<(Xh7X8kB>02e19C$79y0y^S(l|uo@i7UZfpZ^RDs{%l6RNu`k
zcJ;L<p!>d8%>n1qKu|7S)pL)LfkDizl$D2pVbvT4hS^V*7#QrORE5B5pt*y2Vh3mm
z%_mh~ct>@wj5Y&<k7pTp1q|qp?#QcUp!F{dVD^?W$YEgG3=D@Y%A!Gy<N9Tw#8kz=
zuv!Xi^ncJDepdU-K&$Xqb7?a$Bqo)C7S{{@(`I1UY*>~E@*0?JT?SrS4`NT9SO!{I
z4_4Fgr7Q)eCh%Jscx4RemXXGcGVsEfH^K}I9A-S_phn{A$DpCSz_;b#HX^toQM0ui
zJkSVUd_T3T96Zhl-YCBQayew52WZ}40!KNh?FiW~VQ{M))GC1-_z)yi4jyz|#svz<
z)u6>mEXu6qpzW7yWWkNba!{s#jPCPs*Ox=iaR7~b+l7^bhY^>7H%@N2AW#A7!K?ud
z5W1>XK*mf#WkzCS1!yioP7;)DWy&i+nH}O1*X#<AzaTDgO{swR3pCzVa=8NHFD}p_
z?8_=Z`&alKctAJGPMB5!@fc_XJn2FO#AE!Rh)C-z4^w1dSR)G>koYF94U1>yi4D{D
zZ)Gv72OYDgHBnrTkAY#$V+UBe5NxnyU~t?gZUD-mKjESUmJAF$tm1~Cc_jEC%3g{4
zj7$;YMvM#$Yh!{L7<|r%8%r=SL>vodVDRS^H<4gqh_nW+AX;m|z_2z4oJjb=$NOnN
z5wAC825IAfTEX=CLkI(dn1Hw!{KUW4Z}J%!IDU)!urV+&KFnueko_X=BL-#b?H2ci
zi5KOG`-*_XEg2Z}wu<{IfY_YO_W%EX_`vk~bv^@wk)pUCShXbsgG-pWKN|x>J>x^T
zl2?`t3}$D<LHFMwiN4HdV92^E9stuA%_<(G47#2Trtj5JO9qB$M)6=728Puy;Gzd|
z7#PHu#6v{$85rheiih$sFtE1dGcd&ah=+l~&mf<H!TxQ%csQ67!oVP)A|3(1>+044
zO9qAs4&rT~ekMGqZ-MS|V$u@tK@|nv<+Ns+cpn=BgH9LB0ed+t85rbM#QRZ1_xuQ9
zU|_r|J^{L*ul@tmtqqn84An{E;G^CQVA}V9B7*U)_+);#2<SpC#-HL-5F!sk7#JAB
z#HYbUZmj^V4M`B62}(Dx3ZLoL5=#b#kXZ3qsG<u%XS)`9i_ZZ~<0BN$v1DM7a2KD8
zDmnu+a2hQ>A7K^fPAA<SanOP=2Dt7$H$YBG5?_Q+2P)zi^28S-L>jai81zfUm+^w*
zA5`A$5MRy<N-m(1^dSSo243(L6O7=p%)>x@1up}``ajwX3^_vLE5Qo285p+y6ki2q
zD={!csfynMCv13NT~K0Rm>4a78%6Y11?V7?-QsuQqV=G}d8>epfuVh=_#@DnoVP#`
ze^>k^Y7}RH(&i)aS8NOn8&<<Cxs?D4&^MM03~k)v?@%=C0o?^=_)Po@s)h(v1_u4B
z;*9PRpi@aWneFSrx#L!VDg#6AKXFD6m^eh(LzRI+euFq8=*~!CMEE(VGB7w4i!*x5
zGcfpHg}G+Wip7i(;*6lZ!W%DuPlFO?OarZs1)U?sFx^j_F<p#-VdDkRc=DF(;*1%p
z3=A9Nu7Xyl?6@S(m?_J^u<;gXnXpiuI3sw&@EZltR!9YL#%xXohK=_@+aymN7iY`?
z8*1SIx+6-QF&Eqn2kjx;`(K<f4=e{d+)R^8oH2j;sa-63^`P@;Hd=sIj-4pt$q;8O
zXJFU_8gQP}EzVdW0LnC=5pSm^amGq%28N)^ASV?hi!)Y%vgRAm@n`F&i!)Y(c`2Zq
z8fS`w&t_zJ13C;X{*E|fEhw=XfDS`j`a+zsP6A{>g)akxsFFBi{q*wPEIRczm4fOF
z4B<22!8JjNfx&QIr5I`;7AP?=m`<z&Efov%g{xHntqabq)I~LcLy3VQ=vJi>iV3?x
zE%9)<N;3)2>2fd=cGu5PVqh>2t@K1OVs`^*5chJWAF2@vN(>C8os~hTMhGY|Fw9n}
zOhqwa7ie)ZZ)0T^iV3@JC^0Z-1Xt$4O#mnKT^%6bX;wC(8UgZiUT0++su2N73=GAW
zE4$!EfU?Ri&_MpWy2`mIChP?HS%bTB5sC>rPbe`kC{3zd1~Q=@9+*2pnNU`uawn=0
zAU|)&tK5fbgo6?T!`91{hd@TaP1x~4iGjiTXXRBC6Lx_7%*#-D3&n&TJCqn0%Kui@
z-$OMbLy3W*x2y6asu3VRck)(#Lp8!ciGhK6a^)`+6ShB4WneJYtYqXxF=G1(RR)I8
z+Db+t6f?HhuTW)Rh?-N$D28eZs6^mZtz^_hH3gK#ZS^Y|^-xVwP-S3nTwcj&gks3H
z3#tqZ`By6$T~Q3#wnLSHVQqUQqnA7bLp`FP*fv9zfnigBC8HmzDWK9udUGXXBC06{
zstgR%dny^zP@J+&K$U@E*0xH<EEGew9#CaqusK=DSc_uF))n=t3=F$GD;b+mOxX%r
z&0hVolCcfd6wuWYhXX4aXQG+{^1e}QCF49)LqO*-S#Vb}E<!P63+Q+%_P$EStsq0{
z;TeAm$oo#`Dj9d7n6jlpm4U(aXC>o4R8v6RTECl>j2A(sAPfO{zbm$q@fwODn?I;B
zF!a5tWW0r9$mRvA^$ZNF(kdC>qL^|EWVn<~CF3VlQyNqm7-aWXGJZof1(Xi^?^ZF&
zFfeTV3oBWcfpVG4zG^iTlb3B!VqnmpTdfT<7*f$J0~LC0b=CSP1}_8UvL*i2&ZtIc
zfDQy(UhM%h0$e980~LA_ZPh*~CM*TzGM~BC2`DBk1&t_V`&Or-roW}2La(5%8gv#F
zqKsV%@?CyiHEP0HDxt){ur{<BHQ6iy6?&VZs!>zT63_vEoYSgjp*Ug*$jdWy>Z|9Y
z_+tsE(3|_XdNGPWmVgTS(Ddr<s78SNJW;rM4~hwkL51Gbi`55EOjrym=PR<SZ=sm5
zxS?K&fx+3Z8nmSekrNk#3cZbz)sIn)02TB?JJI5K+KNI3hJ#nc8K;ObFzn2OMgKHV
z`)lK0RR)GBHsXxa#2FZN!keJeK&QQJe6PyD(Cl9?&a?;AT|~5H6$BX=Hoj+I*treT
z8Up2_Y#VW=y_yURJD0)CzqVl|Bd8){VAy#Np{{1PIMY6my0b8KmnR5<YF7q^U7)j1
z84Nf<#%(z#&a@w->?>zIv?Fk70mwZ6s|*agbP?w5I4RC_K$C%C7yK64iwU4^tpNkW
zt`M*?agcfa9pcO)VhjwsTwvB-SO8Mi$-uCy2G(R$WnhqbCC&<3U%D$BrtVz*0#ycv
z(jDTgparD}@iQR(qBRT*yLN%CVF&d&cdaU9U|1$5&N@j1BmpyH8mO#Z_DG!L1xi4k
znFDgdDF%jJf5Aq?gIu~cTbu(lceU#+RChhoX&F@phSXYd?qiY+3<2=g+%!-bFwst&
z`!tI1)E}x03{6$y+!s)VLDh@3lsGqNK`FwJsh~1#?rL%FTd1l*wVbt)x)2XTJp%(g
z>Q93*Rm?1P5jh41@lQ|(GEI$9Vqma+tgfKIz##S#CVCo__6t6!E6Xr2h`Yi>r-Jgy
z!WwmTB?bmb*l;7$RFJt{-_^C{7#Jio;A%n1`9Qs#y1qOEgX9F5@F~z<E3eDyMsf@c
z@~|CPOjAMDRr0BufkYW$YNz~AVqkFLP`8$6V31!26Fv1siGg8es=6IW^cqZb3aD{#
zl2P4Bo`FHZ7AAVC{(%w$1K%`tR|N(J1=ye`)2SPv9>)s?hCQGKs|*JJLD9cw=_*DB
zhGtiFS&%r?1jg+Sf(#5|PZ${XJOD>CIHl~l08&~rUsD_;4p*uG5<R76AjiNU2OXlV
z|G=cXU^OEHL-c7zdxY=@CWQu&DDP(`c_dNB9|<7QS*|P_kwtfa+^{#9fnjel*bU(G
zr{qqmGB8a1C&>d^7rQqY>IkMO7X%p?q!%zS?Cl4s6*XW6`E4(#9<F~X$#Yy4Bs0DG
z7>i=PNR6Bz=<Lya28J}7nov+jW?4Q1!^)2}*`VM#n8U!ZI;mzBXywG}yqejp!VC;Y
zWE?6$D^&NDGBGeXyH|h?sDg~hY>}w|E%9LhPb3-KssPP|Le^W_@m27EXHh`w8hNcN
zKnqkkf>=Q#NV!54kQJ(+kru<<6`*O+eWjq07S{6>pcSg>b)a+e=A~4CHa_laH3yAn
zfObUfYXy1EKmyL63g&}HMN{ubRDj0*_kCnyV3>EULJWMAAZYw2qP0RC%mIyx&aZ!6
zApz!rhWH&nR)FqiVmt^MW%PPfAqAEJjVngxR)FRrIFbTD<FJ#eeJVf`X8S=)JJR|p
zbinFBhM)Rg0h%w{e+OjvrvDY7`7$|4(1w!LP8Fc}G6wJgd%2Dkkn=~3Knp#}8>h>i
zV3Dj(s(>8M2RZ{{Yi|W;(u@IoU{&t&3edDELltO(VOCBBWZkJH=;Vd&3h*Rq6=<#J
z-18NnNmPCZ(D3Qr;0nl@B(_Wp3=^hRfM(elszAr_3940qX4n|2KnL+#YE^*dSk?O+
z7;HdASrr4r{x{%Ylm+>8WsXKID+dF^fpR7WhC^JnY~mm`$fxr@)IwHcf~HV(t*3uF
z!J-$}QVWjPB+wZv8Ru)k>np(%Vov{SLA#3?zyryfx@y6TEte^QhE>6XeDix)YQ;hJ
z>=LP9s0GdCGgL8%R5H{`fX@5?CnpY{>2)VrBsDV+vebg&;=mt~<isL|S{d-9639tq
zi)v*+(_3KWW%H&VILRXAB;rwbnS+7hpf?i(!>R9ep#970c_7uB{?}dQ09`c&TJp)q
zU3U$fJVD1b8q3yQ2gfLArpH)$y38pSY5z2E6~q3YVJ{;C!)i6qff)zE_m@;LFdS?K
zOY;6_m=2OOV&rCEI9LP?&VviUlKfCfJ0?B`hJ*dn+fK2#)Qh<_GJ>X>4=v_rU|9d5
z5xlL0p$gO^R^Hsm2)S(@bYf}h=0-;Fyfb)V*Tj}aM$k|_LlrYW1H-l(jf|i@mkd>)
zEgihpjf^22pi_@n`571{$Tl*9CZ-v{XAl|gZe$GOU|`r+3fl9`dcMAqF`NT*+6CwY
zfq5y7;Qc83T0!f|qP{mWf{#U82I}3fywk`CI^~5U$cX{el`pSiW@%)c&%ki#7e51o
zLQEqg<jNk9!`CD<GA;zi3CQ6GRT~*0H~26)q$DOYG%|v&@HzC0*_VM~O?`PIBjgev
zX7Cy>P^Lc24Gu1*|FB$r7`$7{U_WRPgU|0KF>VHi!`y5P48AN)psURxY~Ci&eN+&(
zSd%|D$Yr3DbiOuC<pzZX8v{e?m!@glAiuLQFvM{+&E{rcs8_FJV_@iyX_^m`Xa#Bb
z+q4j_;ZM^dka#H@14998({h-28cWj(n0TCG(^_s&2!hN>Y1#-92bohK+_V|4Ub<-u
zNE~ENoLSROxcZ#>roA8ukcKqnru`r`NKu|z(-F9$lBN?NagdtA#HLd)L(}t`PJ_fj
z>f>dbF2K~!dDwIXBo0=e*>nxAzO3mwNF1a-y{_pFm<>9AFkZFkAxv}ekEW+EcKWrZ
zmtaL~3=HwnP48ghg)^Ey!419F^ck)ux#<T?4d3#nKOk|CBMQoz{(;z~h71gh?>(9r
z**F*&ju!DVFgPueX<`JIA>g%(8P-jV9AXR%tHDY9pz8DoXIZ4`dp0&PLMjf>=oGJY
z6C-E|w~!KObShV<i4jtBXz(*I818Oj1QjbnN(TH446Nsy7(uHmgp@!B@y|<XVgxO(
z5K?jgC95OX85oX&+JX!Q{GdCcTos!bMPxzFVqst?s%&CRRAFG)H&u{<p?>ct28N?+
z#6ZWT$$*p|f6~O53{nbi_$^~#I0~7bWdtS9BR85Qco-Ot?qp+ND6D9f<Y8do`@qJ)
zu<>6r=um0C51=9eq~|Z#Kpv1DZ}nzbke;_txnq)GIYE$|Oh$dPG7kg8F;18yXu%bO
zfjCGqW`DC5NKTcFfkD5w8FVzsF-|rHhBWPF&_wVtkho!KGw2E&uz0_BvlmQ#NM|$X
z(i*V%mTk?Tc_py=65VFd25GSPy4>bWo_Yobute#jX3!pHu*3${X3&a3uy}BNGw7%y
zu(<u|X3*I}VDX~c&HW(DKn_w^(hNHG2P|Gv+YCC$2drKtpc!;#4_LfsK{MzO9<X?1
zS@RZ<UXTas)vcOAT^F!K<;CX1FbOl=X3!DSVDZU*&7i}fkEseXFl@0kXui$Cz;JvM
z6DWl>gO|~QH{U1rH{St`B7*0pGOU|H<G`!IOId6zo9}}Qe*ux=)Ix^l2V5ZipsCE$
z_0`P}!8}m&K<HQVBQOVimm~vd?(MiI1H<v-;27fvMM{l&^HW&{hU42=7#Pa8G&Ayo
zIG!MPJ>Y9$;b34m0je&Y7PYW~Ed<p=8P+XqkYo=^n#Uh7Fq{y9+%o2>&{EH-2-2g?
zz_6pFg$q1H4cbU?q*Vso4Pj$oa9YqN1Y=wKv<XXsau6E>L-U_D5g2>kyEf3N6bz??
z85pumG}@MPFfg371aI7I1D`<vp3iQsZCeR)6?if|B)<)Gwn{w%cs9M)v<-9=EaYS`
zy9sTelVBn9^}J$j;0xx#^Yz=`x2*@4{Gck;L9-2X;0i+(Xx^^Pp=~2r26SGR*2A_<
zU=HX^L}BhW&;<nyRiF@FY}B>|EThQ8z+m0hwiQ&(GE{*o<&t%6piAc&sz7bQk^^nq
z!Rk~PW-u}^EDmU9{Lfp;zz`%^vq$g&BLhRmdvTshUIvDf#h~S~2G|I&&em#i_SJ$9
z85tN_#Kl*GG<217ure?(cFqJHF21xr7qlY%<Vs@(h9x$j<+leIN*NgX9+`K7tV=C$
z=3oOUtkQ8l#KypI@*>EhQ^pJoqU9iUR@0ob!1627onL_D-+<(+KvGVr?G9|E3=G^h
zioaR+fi7i`aso{#oMK=&B?Gnyr1Vrhm}CGc;EL)1ZGc|Jz;Mb4BwEGrh>?LofZfi5
z*MNbc)vFEUZ-zGv45t?JBqwDsv^^IGvDp|H8k5`J$S^RRTEWJ^z-iR>2NcQwd6EhW
z7~1}VLy?7nA#ze1BO^%S6bl1`AwwG@_$>5O^(+hw^FFjOLeECwV_;|nUDtXdLzjWU
zTeNLABLl-}P!Y^&)V3S6@$)|~*x22mm8Vr4U}JY{f>z>kfKA<P3T4mx(6-wV#OBFl
zXxj_2_l*D>1H+-pwsXoLBN;#~!{ZMO>KPcgRN5ARJpP7(;WVhxe2A-Uff~3KYQVtI
znbg(@lLVcgc8II3Q3)goIuz?hTO(*$E9fYH-5+hB6A&1x*ccet-nD^F<YcH4;K?sw
zXqzkzYVtBL7%(u%8@5%#Oxw&0x<PJw?iCjC`ZsNrI-qqiAT`3BZN)G(cQ`<e;<jRS
zkd3@$i8%~y#h^9GZ$Jv;4z=aN6#j%L%mph1Nt!per9&mpfF__1akZsuAxudJtpx^~
zqHEZeSPxSP+8K6;t1S_%5@ZaEZd)`=5_E^fA+EM)4TLe#px_1@)8f(=3RBn$aZD&!
zA;=Vcoi=}%<SvM$zY53{4hDv~v2Fg-o365m)d#nE!W4lv7a!tk^F&hQX$V@M%b?4^
zkfYqD#mK;L){VC~HJzbN3sg9Q?qf`z*rufbDp)~xo-(&-X@l5o3=Fdp+Q7Ss-Uxuw
zf+?s04@(Q?>Y%g$D&!Wm)kBuofGT1J2BF1mpzFa7lru1#t>yp~^ljqmAP0bq0PmH8
z8KD48P8JLd%OA8dnn1m9u9vGQwS=LS(F~mSSQr@m(_5h%zgZX<3MaHe_kD9ErKB;m
zGJ1mdmx0#Emnlu3e~m@Lb$u%%`1IUmEDQ{0Wvz_h({q<`<ubG~=F5Ye&BDO2qq3E;
z0JJ;%mM8<mISUpBhD8CbjNTwGg0yuNPycg`MM|NF1$4l5D`OE%Vro|_V=;`g{_=FQ
z>nv(Phg%sNctMBXfRn2FwALR`zno_T$5|_A(C7f@%)ycytv^6Z%R$Z!eA~(hl4q!b
zS_0lR2eN%?*YtJQS;W<%zPB=hSDP;5Dr0D61ogrgszAxY?Ro1Hm=%80UtedD@qE+z
zL?4t9c))=N-Z>7+T^ZJ`ufP=}gDnF?w0!FYMo?TZFr4oJr-9ZBG7Jn1pfr$S-FiU{
z6z|gmZm@`H*fKDfhPQ$WH&D5C{u)H}KG5oVsOo*nVAXv$SkxpAw624idjT}aaEPmQ
z9XKOQKXZdcMq*7XXf*}MoC}~8B8RwImx5)d-DHvG1>JFdh^uv)E(61X^645kS!68c
zeQ2Ex3gS25;5??-+66OwA0#-tz>2}eWGm?WTn3O&=Y5!7bCX4(KDHH>DKC75D6iKB
znGG%kTI(%9{s$Fkn_F6&5w?U#ww6O}xd=M8=@3_IIanJgxP_0kX2B%gA!cTQ%L{NW
zY|R1}ED-avrc2*q;jEw8)0zO&Q2^1AfTSY<tOFD!d`hk0++W4OaIuFcHIJbc(zRny
zW?(3-ZS@mjV7R!Ew<tB8q18_X6jcyw{6M=EmVpfLiE0HkVi=Y&FkCzbQRt~u4^j!r
z@d2+}jTspjE-6Fe&lnbe$rD?R!SM&q@vX*spt$78WoR`8XAm}U1~CKY4^UV+Eoy}<
zlmo{|_`Oy&VNj4VFkAxlS)CTOs)4pFya5@Y0Wu(p4`PBQ*aVO>BagJof!jh143|JH
zheKSga{3@MAPN;A3N08I8v2@<f}lZn=_t4;Xl4Shw*}=H|MclKw^<~mm71Br$6zmG
z$YNlS@oHvr18J#ZV7T;l`i9#q()Eok%}n+nu{Y)n3|u|UOqz@g43|Nx9Oq>=GigeJ
zIG~D*wMCMFVU<@ilQKviv~~|94;odyEGEOiu;>&6!{uO*3Q!A>@dbznDm4vwK%;h-
zoh2C<PJC%*k_Bll<^-*1X=aj@VPL4gEC#ya<mmTiCUKA)D3yW?7MB5AEXlxdd}}k4
zAV><-umed6BBWL{GjV{VKxe;!q&UD*EDQ`1_nVoxAmcoe3=FMTn;CzC)V+b&%=i<m
z4rFnC)Bk41&x{NVS3teEd6~_OpW$*%cbggCfTWb5+CVK3h<j~*H8Va1Nr7&N0O@*)
z(6zgn@hV6v8LI0lSc<ERp&5MA977d@1p|Wve={Sf<&g%;?N>m})I(g&jJv`0J}2mo
z$7aUe;EEsO8OB4>3=CIR3$QRS=%h3=9#UmsxUvD#!0_Z_U|9WFl7V4OOEV*=bh+|^
zlYyc0OEcp-P-_NMOlJR?zV0rIq{`f8#ubc`3=B(tG&A-xGB8{Pt!)#RYi8`#0-4Uj
zz!3O$`s=$alG4`AjG#8jRnQ6X+HaZ}8x=w6o|A#WC}O(&Jr-%c?iJ09CE#Skz;Jci
zbdP&1a%pdx8A~8-3=0N^^5kYlSo7d2=x%3_{~+xHAy6x$nGw=JU}0d0`rgb4USPQl
z6f!$*H#0^-O}=Kq32L1*Ge&{SL9p8CXYR3h)$24f2EY`7Zs7!(9sq6)Kur$-w;RAZ
znjxo}fK9hgZf10cY1|Gq-5snEs@4-!n}R|u$EKMPwDAI5?PMl2GlFg%fW)43ePuJF
z9n6>yP-E=CZ3#|LgQJ<z4&0c4I>ycxRG5N%mpieU(E_URI%uyn$l(^q8ZE#Y8O#|N
zwEdeIRT&u=u4fB@njy`Ms-PSNI*Kj1equADD!3)W$-v;k+{~y7Zi;YaGBh)SHvTZY
z0VNfuMa_(wprU&j1ITWz#%4wdMo?M8z;Jy!=py??&5WRtV+K%(A#uN%Q3{;OKx!kO
zH8X;89VmHT-v;%dAUJt~ipzTO<DH<icKtKByzB&>ssXMYr|#}tCl9LOIY75kcdpX`
zUDe9Lz>xi?a~-5XsLR06pw~H{k%8fc0YvkBP@fP~Sx(*EIbRN;dA>G6^L#UK2<kF0
zOjYij&Zy78a09gSKXq{@==3CpDh5z;t!nC=01DeGT?U5Tk2_mIc7V>c)8v}&_>e`Z
zUb?db+*jZ!W9aMxvp{|^KiydkQVF`5T$8J_8WhN&c7N*P&T4QUfQ^BHTe=g}G>0@Q
z@>4qV!PYP^++^TjV9@01%m;Y^)G+6k?u2X#0NGIjw<Be0XBwj@1H(<wD(9&0ooOIT
zKwj45n*RMEi*EX!PEa*?6V&vH`rZjXfCeJnnE={L2z5^as7L@eY@}ayM#9_x8n=x4
z-U&K;2OI~QT%D1iDzFOVyCjWHP)4~4I=fPnYkK!17G3|~PA^6VhMWH(ZubJY1!{p8
z*u$WzTyl4(Gt`1xpy6pvu1;sLCqaff9P6}VWMH@js?;>Orn5h0(e-la1T{==fts?K
zT%9IJhMK?)J-n<_7iQ=Ti0!&?Lsd_As(}pMGrjIHi%flLrviuv8sAP`+^GOI4;;%Y
z96P1JhUhXd1nlS(2B`vFg_*jz6Et!FO$#TRJ9)vXKn0!m`z9t~Mhgap+N37N!yw@|
z3=Fp)fRl9-<6&h`o&cA+O^k;PKnYETp&neN-Tna5!@|HI`KF2Sq%;G=?XRHTWM&iN
zLrzda<;rAeVtfQDF+f=eG?@1p9OvM&q>1qhNCs4v1io!z0yX#;szezWZm$Fv<4uew
z)xpI$D66jd)5LfY+%#rkV2Ga5#5jG%6Be!d4<K(F@Pq2m+Yk5{7><BW+hG!IV%)^Y
zz;Fk&bLtRR6XPZYkOx3ThR~}fM$k2}cR-hHI4x>oTn;*{3{>q2{c2)dt^#s13#dqK
zVq6KX9-&?X9XfmaE65=_DNT%PAnsx?uV-M0iECm^V`N~s8^^-H;BcpjF_$020ec*L
zV+P3MuBuIpkV_Lp85r)YW?^8^z1_r^0UCrj$N&=B2NlYK3*Gf&VPF8cunbf{fee{1
z+Qe8X&%kgu59-1y>3WdAz>WSU##)%Vsa;Ksbudog+a|_(P<si~H!!%>1nyse%QH}n
zb<2ZdOq7A)t{n>l!vu~d##YcM<QoQ<PrJ3jF#zU+95Wwe?lJ~Y8wNCxUw=0b904+*
z7SP^L<_ru+w3-+}t**Q0!DVt2V-UEK<z!$;p4h|~1gj=pn41`bbU<|`IG`ZSGLWSp
zSA~IH1@(S7)J6*i2HE^3Mo{w%)Fr$J>f<;uE}Fjo8H<GHn<nrYsM}u|K+U+#_nH_X
zO*RIGd!W)Dlm_e}W%B_>28N}fjf{6eso0!>Vak(6#%qiW4EI2LAolxDS9s1MQE$))
zZhL^r_InG2Kw|`rjJrWC-Zx-RHG<nA44{fe`%NR`Ze37!iK`&Ln4ysoG}teA0Mv3?
z9@@yb8D#PasHV-JJ;WeQ8P<)An=Kg_?wtSy+o8ph3=F!`jf|iR?e2XQDo(9WXJ}+x
z0ovvZQ@z3rtQvH9lyW0uEh7WNeN(8ZwX&clIwu1I$kbXJkPKHQLnGugYEZHP&GNK@
z^BKstgKs1m7!Ia2GRA=nse&332g(I7%i_2!L8gGS=yZn{EE4rQ8W~-og~EN%eIbXq
z8o^7^4wQqcLe-c?cyQl83NAAm8STMM25|M>$Y>94Yk<@?y=r8%gc<b&s@4*$79@S>
zX(OXPRQdtva1@YD`jBoH)GU2)zYFZRMn>=!L~y%h(&|P=Q0WMYvj?E9nIN5N;Eoqm
zE%?+EP+7xi)X1m_3XnG-D`&(vGRncMY=XK-P7{=|pf<{dLh4ov28POcjf|jXIM^1@
zm?+2=aj;@8P@}Dp5wbNGWU$}+MtBS1!E>m=f~p{c!A+p)t6#E6+N=L;WaNfg{}8kX
z6l5YdLRBLpH@KS*GEsb8BO@b7?J@?2hdy9$O=o_^qFx`~_=}N&;bAHV1A}#X<1bKT
zg6p<~>c)>C2~b^bUfuW+l%(FUff|&JpFshz3{+Q@{A_#)QUn^+<z{Gn2~JNCMXw=>
z3>X;N9UE_fY<|PQ@bC<{8`^ja>_||JQ_rxQtMMX8dYLW*!{)P%px*wY0C3}_5p>QM
zxYpI#+qh2=lvBX1oyL87pmYmv1vTymt?mU?=Vtwl`$3z)LAC7?fyVuyx(3v0sO@hA
zpPs#pje#NZYvW<i_LT!XnGB8KbF=H0fjYTII2t!HGB7+!=P6@o1hrflmNB$2GBC_6
zZCuKz%fO&1&<Hxp;t}YSbxrxk$)Her0}6ocxs9MxDjtERFxTyC?1488ay=VC!+?)o
zLtF_O0tEXc`%hyrC{mVzTu{czFn#%J7Lk-MjWy7sN|%9Q#^J_fMh1q*8XOD^DoKsW
zilB;xgMq=)tT9;!#Aah)m?zl?iZSqbWyRJ;&{Y=<;AqQKX$%Hwj^toquwC333>x(U
zg^2c>>GE$_B<i0v`huiE?I_#DjlQ6P7qC9oCyh=ZiG`4mcLFslK%qKyccYUg$WoAd
z!8>Ka{_bpSGzTfa08ws^q}&{?9K4MmtbC1KBPeS={tTMT&hu>42Nmp9AS1!K@C_&>
zFt~X&g8Ih{pcdxbltxfr_z5UWcsn#IgWGAK0AJ76D8|UZ@B}mh;_Wb<<t>Xsef{hP
z#vLHRByg{=fpLd4tb?23(7*_a*(Y64sg2-HH?&jzWEKNM26)B~)Tw>~Iv9_^0KBv4
z321c3<Z8oTkg+d0Kz-_lzhJFV3=9XpHZY2U>(K^AR&fSq(3sJ(w=7Eau3gc(3=EBo
zU7(ugDX2{{FSE-{73>&g1_s6ME_Fr*hNp2H3=CcMUFx9W22hqNxzPpL;RG7t=IYV~
zHy(JB3mCc##26S3)PNIimmN6avN14}E$RXd^fFX|Qm$fq7eC0%`=9~zLtI__;O-8@
z0)B9BhZkfJzZcXXZiX(<L?;6%H>@d~Uh$4amJQ?vgIm*QzhhCV7wl#NO(PuG#lY}P
zNhrC1p_>V`F8n|Z*uULOU0}z7CIr5AGfe~!>T#7ZbTduj1Z7E3GijYoH&YQK1H-dI
zi1s2-3$R8gIgz28smP3h;lM7aQ6<Pm)q;H|0Gdx|W9??Dhh_(J1_mFaZl*Ahd7FgF
zGxHd_nLt(iff`N*hPHLxOkt)Vk8y$uuWqJr5m3zxu__$YtK9{vOuL?TGlA0fb6%(c
zPM|P?8Q^3EG615-Sq0Q6g1OHX=Dw}*-AsNU|ADH+vPIoY;Jw?+KxP}Xbu)od_VY4u
zE2W!BAM9IB1_ss@-Awvmv!RaD_W(H#>UTqAv%v?+fXwc)tM3MHkrh0^!oW}&-pynU
z@AL0r>Sh8}Qi2B<7@n_#1g)Ap$n7i)3?LVR>nM;Z#wWX(z;)CqP{BX@R5uepsC=zr
zV0ivssDh!Ji67MNS|(HpVuDL-sG|hM8I%|flyl{SVqH`iJndo5z%cDqH{*9k28I`)
zW8=IXrr-X+qEye-&G-}S2e4|!zhKoY3=A{5x|zU7<G%s5rhLzLGad!?igz(Ey!Z#M
z$GRDhDuU`Uun!oIT0?zco!$+;xIj;ag@M7~RyX4baDanzTQ}oJh%INqws0jU7D+R7
zGhPC#U}0d;_}|S4TEhb#OgQ8|efmchrTTX)3=BNl-HZ>w4Onm^bo0$_Mo<%m@gM^z
z?v%p187DF_Fua6x!MhnJf}42|hfM;f5pc3#oMaA7wIBnggIE4Q+%p609;k!C_hEp-
zALN|5kYRFAz`A!c&IQ#MphomeuIc`tSj71|S9CLO0y|8Uf#K!y>7}1o<m)eXgU5wH
zu6y}bD4C&~u@O{4fb>O7>t<|*c^Bl07O*QozF;}i&6vl?!0-xmD(xYzZpJ)N3M_{t
zb;dkfQ20Xf3S&N!pYm-$eu8+T5bO<5)&m7Rc(d#qkkR=T-Hfpyqe1s}fQ*g>2M{Es
zGsc2U0Ocaq72S++AWK0UP&~$g%N>Z>31G9KK?L3q{03A=tW51@1Pv9v+9L!?ZH(@6
z4D}4J_JCTM`$2=H64u>}wjirtK;&&@7#LoGF3JEo!`29tfIu#6INr_3!^pt!IuoLd
zM;fGzD=mqkn~@J(qOdS9tiRk1Ufcohxkx8;LuNBTF%|i>n^731tX}&~HzR0Cp!z(n
zOonbo&@e4zsK?u(n^6T+Ac5vSb@p~M>VXeWU;qs%ds}pa=UJ*47~X(Z&8@%O{R6bk
z=?w=1gSSKX4^X@P6dMCWvSarza0Ie3FciP){v`k^3_z=n9J_ykD#JHi(<gjk395f1
z!NR~$oY2k40<!Q8sDt-L8!E&K5dw8}Kq}ZET#ze*%)1|h^7ttRhPTWdU@t!gtz`hY
zqHIw&Xap17R7iI02A}Q=D)Eb7bw5RN#Z#~=rYC-7@wI*ga%4g`=n?}4h!a3t)ru3k
zK^J>5ykP*1#uq1ae*#TNzhMAXL#xcXuQ4((y!Dy>@+*t9vD2UKYoOs2ko{ZZyRU&x
zD*~~t)4Q*Mi$PFTKCz;E9~%S1+cg}Z4&HS0Z!B7DYuG^Jv(wYRv8dOB&VOYvU<Db!
zd0Y2Fkn!($L8)b-G$@wAwPN>TaP)y3q_ejhbTtmBd{ky&2>IO&YDB$T1J;o&0n!1U
ztLX;qfdkLgM1Ji~gX`9Q)7=BkkZcSLI(xgPgAPO!JRr)z@GgW6bU#XWE-0)(?aA3!
zyYnC&U65=ML>9c54^*elzS>=akevXLtwqvX2ayH2So=+PGl&P(*8*a{VE~7xU{!ZL
zXw&X{6R`V@kbG<gb~76TgQk49IXFpy%+lH09S%;Fq6`f0*&x<}4n_e-`|PXT_7KBC
zvY-RNwBK~QBRR?gA`3D|`%QNsSO%1Slo=SdhINCgo%fy7rGBtz=q7cmfts(N$lMy=
z4L(H+#I{cFR`UWSX;5tGWp>LmGBCWqH$5MsMII?F$XkPyfqNU>^6nruNQ<FqH)yQs
zgYonuKUmc3o&IzSgVr#BjNTgGEetx~3dFWf?-up}>oI3waNAhN0vc=k0J^z#US=JO
zmn5jA6#$tq`H&78XaKeAK7h71f;JuKGcbGzmt<hreZ7taH2(Hs3b;{N$KnibFG3rI
zAC@o#G3>q$*S!Q(TN-eKhKW8*kz`<~RIOt%U}RwU2wG?cvep2sn+r6IT*m@Fwi47+
z)P7UPVhoNd76t|x_UU_mvPje)_*%ze2cAx<V*w4nGl0w4H7a#1pq}AJ(8(_#6UC8D
z1Rr++GBLxtjzvnAf#G8ys07fxUB@B|8Sw#?n)^OVGB5~ytYcvTISn*w4>E`aY!IlV
zlvq*6{0}rI`4Q9!pO;z3{7)7XT2N1aT*<&7u>$7jk1N4`<^}or<4j2ghL{(1%-=u;
zpM-=M^Ea?&kijvx>X_eyq(D7#kh$;SQWdUs%-0zi7(Rhc!2wAbUI)8}E4hH7j`^k-
zsA^&X4PVzW-vT9MkSD!P)G>n&Iuuf30kw3eGyi5$tltH$uU8(cV+IYud;(o%3o`Bi
z*ffwMLRZu=?*iF00qVY8U`HT%E_4M*U8;K>GiY4p(+;S*&FJb<-9hT&w$w4N0htFH
z#+>JqS;xEvU18i7u)<|^%%FMYPrsoCE(NOtNu|oxG0$OSVE7C={uJcgIbf;j?|-w%
z)K9Eq26ZSugAR`e$xQ~!fwaXn*D-^pnm<=VP3!_oag{ODG55g6KNGX-n0vt-u$Iy~
z<{Xes8=zWpz*<-s7(nVk$Mt|)MpMt!F@sLeV5nlKmt<gwdRfPu2+{?*l?mjAM3}Cq
z?{&<e2{s0B6SqRMju|w9^BL6b2dQ&~2fJQ(9W!XK?29ziVtcR=NWrex4RYX~Id#mS
zYWfRka0O&UJr7u+C<DV6cdp`mhB{^eNd^YSgA4)?o*0A&(z|PS9Wxsv1H%_+nr3DL
zYXwPdx>v^xI&$ty57c@FxYVxxIwsJ##uw0iI`cB?n0_Io8ta%8zko~x4GVzezCh&6
z85jiW>X<-B*?rZXzVa`NEYsAk=_mfOsMPz`F@dh4VyJ@VJf{25oF~b^u&cO^2{b49
z6?C;U$hfOu<6tVUBUDz%)-lyEGBA7v9eM;(SpyHrAdfnxGLRJLeqE4M8Q2hLNY;b0
zXOIWT&*c~Dm_S+l>t=|bnGjjL{74;mCiW|6-Nn4jI>w)1<GGR(8R{7Sih$dDpq$6}
z51jKrrmc8f$M}hnf#DlyX%|S#C$JWfRQZZJ#@8Sz8PGk{Ai38FxjA)=cR+HW`UfO+
z2QKAtz79Ml`VDl;HAw0jvPVGv@Hh`PenK7NevlFKA^u?84>khg*n>!p1)bqu5AJ?u
z|EYuAd<HHwm!;P+ZUq?tTAB&6Xe*Kd+mQ?a9WW2q55AQRtiMdGj&Us`1H*SVr~}p_
z=?C3ie*oNhEaR$UT<!r<2RcX@WY2Q2I*=bq|J5;qnkC;s=Y4{tKn)Yf9Cm|W9b-Eq
z1H%snsOjzCV3=ya>RRtp$Jh-k?p$uyF@mP$89-&9^O8Eoi69wJ+f=Kv4%{IDw_2^!
z>li_m6~h}YP#?IC5j0c*_Eg)tI>y=H_ym`ib&PYsUI#gEnNuCOL-7NeI~g0nF0Tj4
zm42#YtOB_Yve=-Gu?j2)O>ZBTFff#U0;w}ssbeevsRQl#2YImotPWg)GZusG1t}}N
zR>znLQU-E9NLeP5vTTI1Q+15Vpi1ZmXtgLvT{2i5$Ow+SI`FLX576WfNGbp<1s=(-
zgG@4mf~Dj}9pvT=@BnOQN*yDpZ~%>|{yYetb**D$1NE9f(=s5nY@iV?kj6t?b&Q;#
z9&3F$qyh#n6bFZH&DJ_ZpI~ZN9V2Kg6)Y3@wvJH*T+V`fFm;TeSs{iuT$v1YjNqF7
zjVJ@d&kFGTM;)U&q(Kf6>ITor)G=B@az99D9#qI3w5);gAgE>kb0bs?bZi}{^n-Fi
zkpk)lg63V#UF!aWdeG$t3=Ag)>p<BK<lA4G(|0hj%GAH9yQ2jf7-a(u;@5#L8v3OP
zYR2(#*S!Zh2h_Ga#8n3xz6DKv@G&qP_@m6gz?xeJO8mcCcnd&9!dfK;hF>kbpps&(
z8K|IOV_*pPsXGixjLQUgz-jKd6sW#t0}Z>>oq)0H%NEt0lmO`fFPJz`qs+jt&Z!PG
z1O00)#B9*4Gt}()ppM%vP<wBacpYe(_ZMhrjl-udA2e_SYFr=Usw)LWQaNb&tFB56
zYNdH~9jH2F0IyY?XI2NAG&@kk!0@{swB?J#rw)9UMHNp)B|{x3r80m=brYKEK+Bqb
zYl4Qr>Ow)o4mBXlOBw1wgP^~iI2ahX8S21SSuX?4%Z8WMfhQQ2F);iF9nHecPzOHO
z7Ziv)r0Z<JDS-_%`CbPZf#a!9%}ZgZbAU-0+^Pc~ItVsxYh9f-s8a?q?Fa{G{YRZP
zsA~usj;+~Rr>)4q03H&a+Eu3wn#u=jTCurK2Bhf?1H<pP;KA}b8EH^=mkrdbtAiXl
z1nND>cGS#cWUyuUlMWu8teGbPYR*9$zkkZXEAVPS(+mu6U<;qM85nkG)f@vg?5ngH
z7y=Tf^Rlvv*GKSx)-cw9PF!JF2JYMG-mcjTNw}~U;h%DFi;x4<BK(sM8X8w>uIXY_
zW?(SzssXK4`E#q3fx(`!rb4ikfq}28rc#iNfni%~O%-^cf{lS8;!RC8m@Ue{@aHre
zXcn`kT8@E%vHl>;&RQXG8-QUpBLhRSdkttHgY9We1S12(UqPOt)MADj$i+6L3=G~^
zYZ3)P>0I}AO%l|p1`G_vN;RO-IEGUU41Yn36Pjyl^g*S;DbULL{u+I7VZgz_;M`H8
z4_bB%>Id5&x?2Mtg+3*~Q;?g>P-83&(hcfhEvc~pH$>PN82mQW*ue6W+?5&|P(*@~
zMahlniEONLd;yZY|JWE9{+Y2bFz{DQ?`30^tgn;gV-f=G$7Eq(nDkhZk4YBFVYQIt
zW6}h1xH1_e`M`^(K_$sQ9<HJS21z~vVUS7SF{|7Ul6;_bX?ufN7#K2nCHWLVHXE=o
zFtneR<WmF<FBpKcp4bgD1_riJN!~}Gsri3vgo>Q<a~ULgA89Z!{9D77%pl1NYN3PM
z)mbwnd7r>0#D&r&dBKAMpejgSQj+&6$OaH+&6eru?5vuM71JlOvr02QpT3rzRhBVw
z`e}AnS;vG_P)}Ww_p}QG!~X=vtkBFn21(vCAYLkCW@vtC34<i>Syu*z|5=O~p~-3K
z43fO(K-_%BbSVag#mA;=a<FREuj4%i8iITSJ_(9(n*aj@a4^nsWMHT*lH_d%&FR3T
zL32GI1#1}RFfjc81a(5Y8;ApQLI;TV9qxoqcLs+4f8b8&0y!|BF&)%rl03@C$G{-@
zn~#A(O3jghVUGRu2OO-jfiSOCc`z_Cz`a%t;vu|N<H^9tfbd!^$X2Mi;-G;M$qbO$
z6C4>BP8Uu0<7AZ$n+$cXix;x7t_lo{3<zW06j6+Imt$b~4+}9#UQh6$lne|Epv0>x
z#lX;OKK&pks|aJ;^lO}~in=Y#42%L(7#J9m85kH6L7asQpbM247z#j~bqov)Ees3{
zO>PX#Nx!D6aIq@ZCxgnasSFGZlbIQqlR*ncmM}0dEMi~~XJ8a)gG9?lAJ9e=mJ5=+
zNt_Ifj6XqUfo$2zz`(E>!~xlIgn@zK5Qqb^<pu)-!?i$=El?8@K+(qXK$7PME65&@
zr7sv57@mcJcpzK9GcYiGMYS~tZ0iR}-egV&My4u|*;5!87}*&Z7+FD_g$xXgpu@&Q
zK%8|942)U~42&8Oze#bkD$0TU#%RUBz-R%rh0&9Nfzh3TK_29{>5<&53VO`!Al)Ey
zBN-SN!$BO7xfu)$jA<Ya$lNLh2F41Axy#|^b}=w8cEHS?$-uxk9cJz`ZdOIzDIm=t
zV^=aTFfIpiK*sK1U|`$^;(&}j#lXOL0%EKQ536DV*ts_u7#Od^jD5kt!1xR`P>z6l
zJgf|oyg8f<j4Yxcvp}|dXJBCb3gRqeU|?cnU|?baan>;~Fi9{lFo{8I*~$Zra3&oF
z1|}`2Elk!7;A`UoL4g8^u1z9fTLdI|OF2R2OkrSP@@HUR@&$1~HpDS7FvWm4ARCGp
z7?=vcHb8YNFfbrkponMSfJb}`0|QeV0|QeF%=W1a3`~<57#JKG7-BX^@(P2dP@(yK
z6KLFrfq{W3g>eo8BNv-Gq{tEW0&y4^m{v0|FfBI$7d#>$G4AObd0B-OxCG$YUCaZX
ze>UHg<dpyy$J3wivMMmuY@N==$LcTTBgrcRsuJHYFtD&PFt9KNF)*;~VPIr4nV!$b
zD#_S3y_1hsNn;8F14}3a14}T-*9#dKSW*}mSdu`TbqowFWef}~CEy^KewmL|F%%S)
zEUgR-EX`1FvVinYVgSb_mnbxJVi?#M7+At3c@;Ss7}>Iz85p_L85mfWGBB_#1aV9l
z7+Cf*FtF@~CRk5?Rz=<KAUi>(J!N2Ec?{x!T=Rv2f#nm3vyOp*m5qUcl?CFO>HN@y
z#VX3cz$y%N4XX+R1FI6)F#^y$z8N%M&cKo*$*aT4z{p+!GHVJ01FJCu1FIp3vyg#-
z)ro<D)d9o-*%HRUz#0OvMM40Y+gMW>7+8~Gwv;e1uol5`MYsT~f*uDr<ATg>W?*1#
z1Q`V~cM<~w>jV%7WbQHs2G%7IbC<%+-O9kgx*2Bf5e5d<Lojon2(T*VOaf^J8GD(5
zf%PJY12Xmz0|V;=5C>%JHwFgQFJNOKp}#o=mP$b^a4O}2r&0z6HZBGRHV&wbY?2HN
zpsnrTGI4sLAghQTr!dIiDGUs3x(p0#+91wC1_m}81_m}O5N90&1DhWM1Dg-n%ITX0
zp;?bDmVtpS8fI<|0|Q$YYCQCSOT8XRUISJJM$Qh9Ss+`g85r0qK^%}RT?`CtU>T4t
z^B5S|<{*`|o9BQ$!!ifiGn*I~*fs>gY(2=pz_y=(0V%_8UIDgsjU=xjEQZ*wGBB`R
zhS~Upfr0H2hy$|m2Ll7!H;BKM3b86$gHk&?2Ll5;8`K7NaRvr<P^r!bI==%%FoKA6
zDhv!en<RNzKrM_npcL*jol%%oj!EtNbVXrS87BcwNFB-Z+>L=zfD>A!^Sl7@_+V8!
z&r5d(Mgd`19_M-G49Vk=LcLy?RZ&+L<kBe&4D9L*4D6~P&O!zTb~6SBb`ub19RmZq
z7Xt&k2gDC&g`ugJJ(_`mJrd@JECvSl3|K1T5n)x--38JNGPat5fgKhZ>|G2D?6AmS
zpU1$!J_llKln6A+**7sTuy24Fdys*FeLqT+Z+QR;eCF$tJnvW;7<u$zwp?XkV24Ej
z`x6ERc31?k|6pKX|ArLhTRwoIocTFYlymSfFmQ0es#gwa1_lmER9pXmZT&9E^B!dD
z2B@tZ`V0&l;P6|>z`$Y0z`$Vxl354ZCC|XX5diU9fG9M`IMNsxI8vZ~<0xfd;3$UL
zGQD4vRa6&TbWCAj;OJyv;AjV#1TuC80|Uo25C>%J8U_ZARS;t@!j0X{z`(H+X6z{j
z296UjV+F)mMRPWRG=q%2$-uyI9mD|{`+|Xi;~9tpGWHJx1II70v5@?})dH5^K`c;s
zF|Z(o7biCZ11BfcMouXP22Kf>jT6OKMRkoq=1yT?;M8Pb;8X{37BVn!S}-thnt?d$
z7#KLc7#KLAN$Ro~t70xFTX04)FmQ&$jLl$R;7o%iDX6Pz;I66xy9pFeJl{AO82Oq&
z=7MZ2XJFtg1#v(&wlOepf}43D8)q;ua884?)TSqjvx;i`11SUPS<b+~x%3bt1Eat~
zZU&GbNclDf2F@+uAelZ-99l1M9%W$QJPdQ-6$S>*OHhA99k>DHEEac3o}ZiyjQsT=
zvp^O+W?<la2;zVo^@)Lj^8<*pj)8%Tg@J*K31W-91T>j|?ib(^gxbQT#K6F%z`y{?
z)os(`Bp|gbmmvcK7dY)NWMJTOU|`^~gP9n_z`zAfcq=4W75PB{%azE$z!eWRarzAj
zRyoG=)4xlw%375}OOV^%42%NhuoC1Bh*twILGJo6FbXunOOSiuR>E{YNmeoOP)VMv
z;-GNbBa{s4wD4TD1QjpSt0h^b>oXV_yo4nj*uX)<U<jJZ1clBGQ1e9ai8KRq3M*79
z2PDqCUBZ=>fl-j3nSnV)n1O){v|Y6p#8F^i;OYbI31UFjGy|;ZxP&`MlM6^4NYgw9
z2Cg|Ejsi&gS_THL)eJCe8W@;nMlvu8#xgQyF>^7$fJ>}lU=)19z$jP-mSFr3mpA~G
z=woEeV&eD;7rz1(Uk=tF@BuFI0xGeOk<llM(GV{F2P%FIY|s}535d^)1Q?ikJQ#c!
z7~Cr)z!xY%8gmQ=86e*=Ffcp-g_f}G^aoO`BK39*%t>b<It?~JvjPK%1y;-=Vb0CK
zC<Ll5lkPJxa6MvR;JU}oz?}4kfq|Qqfq|PDIs6RHfHW~Lm#}1IU=*4F3Nm2^25u1s
z25un`M}dKX8+1CbA_Lsk`VR~S58&250O@C7U|^B3=4D_My2#AH46>Hngn@zE0A_7C
z0|R#`*n|a8cmIGJ@B?muEe`{uFv!-VO$-d&84L{EDIf#(Gca&ZU|`_xg9c+ggP{f_
z3WYTp8M7Fz7`P#Z8rpz_Awmr93=AtuB@94kFTG)46b7yKb8nC^0Iw?MU|@(TlrT^O
zt<eL8x|5WI5Lh9^oSzFIPGS=Pg}MZfMlyqhkQDg#5eDwX4ATo`Sf%STB}9ZkCm<_<
zCgUVTK_ezVnI_r<F)+wgGcbx4fVQx^-Ib7)XJ8b5Y781@0tGwAM~D^w&M>etFv#^v
zfLgI4>zNstIsP#)aKB<;;C>;_z|55nRdxeZ-^k5pWn>p%U=&%%%)rc5!oa}&kD;D{
z`;Qd^Gj}OmA^2J<)}5fPB6kx51CI~`1CIbR12cCY0|Sp50|So=h%<|Ufya!2fyacM
zfth<50|Sp60|So>h_i`-fhU%MfhSs)fth<Bh&Tlzu7QY046vm7?*aoeCpUv$Jp(h$
zFaH@BpqcwWB-|JnS|rp!)dI**JY@_FJVot{49r}O3=DGHSQ*&_7#Kwptr?iP`kpX?
zyZ{#7#A?mJ%-sYc`ar}ikefgboX^0(GabYMIq(t#1J5}Sr+yy;1J7Ru2A=OA-YEtK
zUIhjQUI`HA8Uq7wC<6m;Fo^Srfq^%Nfq^#*?t}jvU>|^DgY6$A^nNV>-G45-MnaO4
zfl<7dnSq&|n}LD1n}LD1QJjI9T^*|I2xw+Pj-8b$jJ2MDQ9J^q(3F9J_ca3p?@e|F
zW_BkA2EG^u20jN6$De_L?<NBS-$f87hJk@!nSp^{7R1S9VBim9VBq%yampAN_!lxT
z@XrooU}kTI+H?ULk}?d8V(K7O9SjWo2N@Xn_cO>dFmu0$oO8_Z`vn6NM8|K?$N)%F
z1}l>jCj+C{Tu^NPXJFvJz`(!{3NjvU1_u873=I5t*%_EYS19p+V_@L_0^%q$FbME6
zFbHsiIQk3>pabRvq(B^N1_l8a1_l8qkhL7pX#P8cfzcge?O$;5%fP^p!pg+R%fKiO
zj&>0S27zD(27y3!24)UL1_psF1_pr)MFwULJ*J5q(A@g>0|T>{`t$$=R<T@=*QY^D
z{0AQOU|?VfU|<xt1$lis1A{;<1A{<0h_i%&L0}^TgTQK7g8cJ>ftkY^T9E#8VPH(}
zU?^r_W|v@KkV{cyU}l#@Sov!U%t~?OLiCpgtS|zxK!M1>A|b)Uz$ktWTAB%*XJ8OG
z4JwS@Ffa&wVqg&Xz@W##oCGb+e$9a!0PaVCi$h6KkmgMc44`dm0{=mp_cJgE3NSDT
z@-Z-gs>Q5G^=4?0c0mX6m})>pj?_GjWCrzSDFz16S`0yL1_nV{g`)gi2K81^(8weM
zgJ32DgJ8NQ1H<N<>TOaCj8gL$7z8^R7zEo3it@`D)Z0Pk!Otf=b)X<QKZilR9n`&m
zh}M7jz;x<}Gy|g)w5kCg-@w4#t3HR9fl<<unSoK7m4QL<C<BAwVGu_a#<6B#l==x0
z5oBNxyvo2J2x@LiYcenhK4D-G1U0v%O&J&jzc4TeezIm@ly(HE^@T~ZGcZa=GB60$
zb2Bgqan?fOygLO{A676hGG;QBGB7g2k2*YcgOM?vsf>Yv!4Ao#6|m6mt^h|C1A~wH
zB9N=!fvjR>U;q`?LJ}a3ER2KfY9TEKhI%0lkmEE#icA?8gsd1Cge*WDM+OF=Kn4aO
ze-Ou)fk7yhfk7x4=Il}i2BBh@tB(+LwKM~xbSK1*;AQR%+>6yWvNAAAb=8Ax2Q}xV
z7cnphwJ<OUHGwQ#$G{*omw`cOCWy0(fkEg11B1{$knKkp7=+F<FbJImaV{`02;E~~
z5W2I55o&r1Q!xW0Bhs;tjEtG^lM8<!2k94Zkb*XvLo;Fz4+EnF5476kV_=Z8v|(Ua
zs-a%Q#>l`Zb&?mH@QTzy36G6|p@v(%gqwj;>Nx}C3Pnb#=f(_-3<)426+~nigW7%!
zd?39>3=BJa)uVYC85pJ0AO=P2fD8iNvaPjA9deik=)|}k>d~NqE6{=^4h{7feb9m>
z(1~mM>M^jzPc>WBV`1V`yVPT?plWz-s>gxF*}%3Xa5FGUx4>K{-C_*t6@v&q5CK{u
z^*^71uO8$gBL;>;x#}KZ=iP-k&qEXBJYH}n@_?<{GHq1%0K0-WnL*vd50ouIQ%h><
zULd=Evw^drKO`GMLq+<xF=)UIL~w%$0eGlL-z{Tc2(Hf*=cyF{M;@a$G!-j$fHJ@F
zY`IJZah`fmi{cgogV1jV2BFtd3=F68#d+#M8Tb|hgRmU~gRqqp1H<Vb;yewYkpTk+
z2H`XY2H_Mb1_t><;yewY83K@CIRk@mu@nPC_iJ$;&@srMIXmHAhI$6!Zn@%;A_j4u
zM)0jI3=G1H7#M_SNii@qyb|YW<^o+Gz`!7Uo`FI5cp3x4;Uf%;#_*H+D+NRu7-b%F
zrKFZIi1QXpfKJKf$|y)=5a$IgQD-n<aEACT72FkKU|?`yV3Y;z-rpc0&c`ecIzAQT
zx^D~&!e1cikTG=+19RXCq(ofo0q#|qnL~{729NS+a*6YFure^pddV^{nz@2Ha@jr*
z1wIC#5m-$Hah~-c1vzsV85px8LF0gFP$L44FhDX4V|@T<>>U*FD&oAhAmy8x85q-C
z7#Kv@85l&Etr-~80@)cD)8ZHyL=+epMC2H985q-lL2L?K0W&9X1;`9gfiKP*#+l2&
zm~<bi1a4Iz%qA9b-Z;>7`rn22|3SycGX~xPJJ>*+H=dJ$QNEF#f#L5u1_lvh1_lvb
z5a$E~gGe<4gGfGzbCrQX<RSxu$WajI5d(v$90P->5Qy`hfkAW{1A}M-XzkSB-C+z2
zf1wTq?fC;cP=J9^t_h^}KLdjp2LnUB7#o8r1H(Ta1_n(J21dCDiVO_@c$p@0uro0H
zlVV^HQ(<5blLK+o85qQ385qQZA$2Tc&=m&ecrF;{3j_0lInW3U&H-^ig<?5)(3at!
zH6$!TUV!}>DajYd%D^a}!py)>|Id?wL2McWgV-dHC1DH<Vn-Ml#P)$Wi3|*4Zx|TF
zUVu1x3=E)a#l)FFoN5LJaYF_MaZup=>tJ9IPh?;a_XWvJWnd6L#K0iF3&dH#z#tBq
z7kLZq888O^U|=o-6>-cCt|~4JjLX^U89`?gF)&IkhC1;J12dcj4l#xdaoz+@21W%&
zW(G#74GattQVa|d66_3&QhOK}B#amsBn%)m0b{5KQmUOAgH-fR6<|cF&HgYlrb7$m
zdZwug;MAQU46!z}0USo%;=H-642%lq><o;coz@brpoS}m1G2D?fk7e_l;q<fO;W~i
z3D5z0n#;v`^H>=e6;CoVFvgoQFi5OoV31hE&cGO7z`!7JgMmTf9EelPz#u8ez#z%W
z&QQ-7-^IWn>CC_&X%CW`&cGm<$iN^O3F0hbV2}jKwtzTm85krVFfd47XlG<#ObBFP
z(7YzjT*%A7sBp=efiVG8H6|1=Fi2T3Fi4p&m@+WNKVo3ee8#}2@D`-~F$05CBLjm}
zEwuN>81BNrm{3#Cz^KRu?luQ7z-1ypG7OB0@?ePsghUQh!U8N&fRJc_N(6!>6c7?q
zpb}YN2?vD43W$WQVl!B#0U>h$BBMA5EYS!GchCv#jNw;663{drbp_mnylBWOTn`G6
zxK#`cS`6a61*{B=O3dsGjB$Gy7(lHtsc9h2Nd^X~YYYrh$3UDb3=GoM3=GnRpcwRA
z28s9R1W>$d35oO0;$>h|+Re_u=(&Y~L3%X<gY;q$=O6=v^m7IV>6;+V83qQ>NoF#-
z><o<co;Mj7WYQTJWa2?m&lnhF`WP5wx<H)I3=A?y7#L&@nKCeX2{SNg=`b)VwX-uY
zdP#t8J7i#xxde(TFEs`REgJ?#rCG8Jj9%KX>=NAp@+2f9Gcsl}8Za_uFmo|BfD>#Y
z7u4bPM?jrZEgx~-Ih+iPs*3CkjENEq44|XwWd4{kFeZ94Flc2kFsguDo*2NuAgj&5
zAgc*d7R$gOYs<hOYYF0HF)+x2t~(DDXJAZx3^6=D0F<t^TEv+?b22b0*D^COCVpUG
zkZodMkOeJZO#I8hP%k@=fkAc#G-BdIpl%j!U@%f?U{Eqqfn;c=%M+Afo?zk#U|;}6
zTgnm!2CentOgH!$7?p2XGccxXV`pGYIn2Nydy9cV_8N$Do`FI369a?nyJ7~$lv@l8
zTKhqww;34ZI2ah@*tqK<PL1nfV0w28)N}=vdZ4IH+yIe@KL9F7v@VG=ec@zaQ~}L`
zCGKTlkP~NMkP`*@=oABkoEigzoC=6@m4QLdlz~Cc7&1=97=H)kAqGYjJ5WS4fEvf(
zh+y=9MpGzb{0|1kq!^Gi$ZBy0#w1RN%?T3VsCgmI^c7_DX=Vn-BrygCITr>7IVTWD
znSntrn1Mkq5NcV13e>XI)9>iAO4cVhfcRjO89`p-_|M3g!Dt506LBsKOy8Oq!WbA6
zE1*`whGJP57*!cS@mdS&fiW=1B|zQF7<~g~Xc^o$%v{U`;ACa`1!7K&4g(WIJ%iS7
zao+iy42)`d><o;c!<*$m##Mtj{0t0o6B!ufx<MQn1_rsq3=DFcK^#p626;gS26=9n
zuX-35KXWlKs&<02G&?-6Cv0F~u2E!QR9yo~873gV8M`nry=rAN02fB}A3iW9oB+iu
z1EcC;kQxWDI7s*fR2UTHj4m+YL=LF%N04fSunGg?haLt-H9k;Sg8DX@NO~L~del@w
zdf+xBrZChqek^8SRI`O>g4@vnRUZOT4^8=rOF(u&ltLsJ#2J{`ApL1jwqa&q&=wcx
zUBt@3s5VEIfthVFwDyj%U|{ZE2THQ0`=Ftp0xFHP>ovuBSF$oNstd9+Fq)oWV30Rq
zV30Qeac(j&$Okhp$oqmg&lniwYZ(~i%b@`tQveBYweR2n2VHOtHFp97<HuqYHzKu_
zVlKd%Q!$W%4^Zz!oOdmoI0KW(T8IfrU%)Q27U#VRa@ba81}2kT3=Hyf7#QSdfH=n)
z801edFvuTaXJ9h9!oVQ^je$Y_gDC@($wLMP?H~q5^@$*vXABGq;tUK5!VDe^OeWAo
zm%Im*Q$ejbkdmJa^$ZG*pwsTbDKqsw#0AL#piHHmB+h#s<br#k_97z#gF+kwgF*x-
z5a9~JLz>!^5QQ3`#S);!cM3BZ7!)Rh6q*G?OiYsi`>9WykB^gqQP+i;fzd3LfkEM1
zJp+Tn84$0CfkELh1A_u+*1!xT`ip@<;TtHe_b@OhiZL)K3V=8>85k5z7#I|d6d4%J
zmN8Gf0m^`8n;94s-53}Yoj^(sFfb@4GcYKE>I$>73=E153=E1j;tWj2(1el(u86cB
ziF0QP)iW?^eqv@|GG4*Jpg5O-L2)KK1C#Mq1_s4F3=E2!K%7Gi42nM(7!;qGGB6oG
zVqnk_W?<BGR%Bo@e$F(J1DYPvc7U4n42+tbNDZXo23UelyTicj{(^x~Qyr8tCUP(`
zW-xL1GH}~Z?^kDKtN#PijI4110|Usm^9&3+#te*_aUgeGVPH_QVqj3R07;ohGcf45
zF)(UYg5ptufk7#hfkDY1ETzZ5pcBTxs5u2BWz4{!)Wg7_)CH0<{>s3hlfl5Kxm=ck
z$@mvT7z2}uBeaR00ULp5VPMoe2h!@sz@W5(fk9~rI002bVltx#IRVu(Fen{nU{Kl*
zscg)iGBD^=h;!$1GBD~yfg<BG1B22%1_q^DiVTeA4B%Ebqd6~l7ZZchCw2x#a|s59
zdSz<{24%}S21avL5TPs1z?ifjVqf|cP|DGnFV3wX&A_PD2`bYsGB7B6GcYK7BIT^~
zCD5@FMi2|^Miz0V1XWO{$h;eBRs;hJoCQ|GAS2E#0~+GgIs+|Z(sR(`Vh1R1Fqz6g
zbY@Nf<qe%p;@sX`42;^o%nVGXdJGK8=?o0Y$si8MD-#(QlzZ73m`ptw7?f8sFeooI
zWneN5Wnj=b$H1tq36hCoU{F5Fz@WUB!Gocm$ut9MI(U)-<TQ|)Tm}Z^{|pSuzv0Ds
zI=JV^z^I*rlv+yR$t?W>$ngw}+TF;~7htI{{S5>2+)4&UZBXBnsUBQ4xihfZ2Z39E
zphZoQ2@H(d`ynGF(4sQ~JkkhF<{1y57Q9Bb05%=On7IKWt;03FQHxcq{t1)|n!SK_
z2bjtvV9v>6fH+6T4U{P$&M|~lp;;mfjFAZtm%ue-K+UT}vb_xM`>Z)o=^0RIP}h^G
zYyn*R4hCj9DF#NJ4Iul<;end<0V;k1RXke<D*gaXJOXOZf2cj6>&?mzz^uv6VPM+h
z%fP5BUXP}455zoOeW*Az$>s2X#Gzu)(OyQMH4Kb9?V)ktbAW-#`YbdKe4a2cd51AD
z>eeDzpSuHQy{`aNdJ$tiVwf!V2B>jU4EM9I3B(V&$B_;B0a8=}Z~ORqFfeAoN;uyN
z2IiX042-(JkaXmExG*sJxI-HgA3iYp&R}5ndd0w~2kP0>Gl82wu$a$FfVt5x1yUU9
zc_Nv$2W&e?M+PIjiQv}&@r_<SlFGacM#fBLE=IU-{MJBK%|=$$P|t`M8oZSOxBLnN
zqwxj?Mm<nEhr4Y7BV#6f{*uw30jlO6vVrh0_P2rB_ZM0E1k48i42bS}eMMyX2OujT
z&8`n082zU}!c*TJS<MHu@bupS2~T}chG!}VWm%Y$^Won2e*jf95t4{t-UbbQ=X1bZ
z6~F;;mHt*F3-cvV92H;!RdWSdjRxF^45*ut(?GrjnwtZ9AhByuFNb8xUQnfnh}eKV
z49pAWFfbZ`ntse&9-zT+rbf7z0t+DN(*V@yhxs_|0xWlg)_~@bp}8YWhk;RG4>Wg#
zIe_}G42%Z-jEwbJ%>LdgFvo{MJKYAW7#Xuz%NR--l;BbYP)(o`fTNV5j6q4cfeB_=
z<P8SKKpv?1Q5;Z*{Y3IxegLRp?EupdEyBQfV6y~d>WVSihJkVNa;RHlJV0)Rabg&l
z^^~9n$1*T5noMP2G>indD49VC66Wz~8sG*4JpaV1K-Ct3)v~~YE!F|zIzv!OfZv>z
zxdG<U*c7PzVPw~@0A+g)2c!X<z3@~MTLabc2uVi)ybO<>0+BXiM3OFq>aPF5n4|!4
zsgW+&r6|6ddIHr~NeNK1f{@Kx0a8?25A#7%3sg}dvZ5bw={Hd6J&cT5TCngd;(%p|
z4<DF7<xB<>$h)v1DyAZa=^w0EMZ8lo7#NfE85oT&gK`CIH3MTx2UPeqD4?q0p`CI7
zVwtf9l3R*8K#FRn`&+Xr)~Cuqyl)%~@%{xQcTCLyB^r2nkZJ)n3>2p@hZl3e(p2gX
z28NT~uo@!-q!!6iP_Gzt;nEAx&^357hA4wR17p4M>_`TNia>FmLeL^s18^gQ0d!Cx
zsENUlz&MA2(Ii8ifnj@uI8UJ|_~dy86)6S=6)|-Nh9#2XJcXW+GqY7p85mRyq2uVq
z&~bDXKL!RBpTmqGL!d^3P7MZ`tsu@*D!@?BXyVPxz-Us%z@U=Iz@QS%&cJBW&cLA3
z#K53Z1Fh;As#QRx3MhaUGiJfc5(X~@2IlMHJZWHugRGb;1R2FolL0MI0H2B_&XWO|
z5^!W-2)i!M;|kiO51r<-jbH$cy)!T{TmgC0biO(RL-Is%9#=~SM$`EW3@S?*7*s%l
zt^dS%Knv?lmoPA>oM2#3Iik+Muufi_#~l=qw-^{yo-r_}Jdgv=0PuK<fMx&~7(h3A
ztFp?0X99RY15cpo232_m231)p28JD%#Cg1B8B!TG-eO=-wP0XSHIsqNEST;DITca>
zFxYl5FedDS6aWmiFCZnNX$hzl2TgK8=LnfN6ktJR#{p8q$e6`b1|7v^I=5i@MO#*d
zdefaC=Nbrt;@xzm83TjS9C03P(2S4i7cTIHyF9uQ3=D#x^Z58=#d-9=9sw=KS}D$>
z58BIhiouM5!K+D}`xi);nK?uk_a7u(+@PJJJG&sdxc`9zpM`;8F0Xh!_kS+%M2Z;$
zgNLd(_XDsQpnWOq-^95efmJf7FfgooE6yDYjwVJ1Ml;Z6?$bZSxnp&p9Qi}y+_A1u
zPQxp4?l?Y>so+g{;@k-!XM*<Y?e!7oP84QfG<yKrQKKx*om4Nzz@QAWZsiMc?&;tu
zB^CyTZYgo@88FVi7vkJA!5q;34hHZI>9@=n7{qwQxkW+FH3#j_nd2+YEe^A%MqHd*
zf{TIC+>9%kL7ZC>obXu~7!JG==avM!EQ*04GfJFWx;~15p}<U>TMoP_>LCN8xf?h>
z#6g~RHx%c(&j(7jj0}wC-9jZ5B@E(Rpc@^PL6^?(Ulr%NuK}9m1KGj_x-*3FA^6xo
zaW2RamkdW385rakxlTngFs$D#&Xo&V-2=(ajP55u8Lpmzf!P9-(5<GM6lCTyh;!xI
zFfdw8XJAnEW?)ctg``xje9%E21`G_UISdS{SyBuP>vxEA<%4!UfduOq7*wm|k_$>1
z#JLK1K@MVIP@TfSpgKve5+no)yf+LCs#_QsR2Rt=Fo<&%N`T^ufdPD_mFh1k@FntG
zMG6qB)v_5F)Z(SUx5;xAg9PU=FsPkiU{E_I#lVm)EzVV<$iNV>k%2+&3j>4N8_4V%
z!-plX@~=`Oh=D=l7Xzck0=eWO263)3aB;xEpsvoqpsorl^*uNk>KQYV7#J;ffbtHa
zY3~sODkvEkEj}O>mT90;n9&)jx~tS+WK3t~;%bDIwjKoxh?cJhw92uRK{5nUr+O>_
z*-_8HXo=jC%ZUJ00~O$A4U&6qfYdTDT7sH$Fi+-804c46S1X<jP({eSxSSO*&wA=W
zr9tf&m>HS%@H*ZT>SxRINY2eU0I~z&5Kow&-XSYO*a7XxS@9xCBfJbMn?W;!RyuI$
z`VUMwH(*Zmf;!R48!rEWDHrZRFAs<htUz-XFdyW?TbW)jpwghhOt`cKEN;C1fS11T
zF)&0N<6~fmw2ow8h`(Ad&UpxwHXx-xqX~4mj<5kJPk3^fBo?JJh;ts&ha^{ZUj_zs
zQ*{Og-!O5`Lr#!7PW?6mgZg$U28Oh=;+#hyB^HB52Lppfg%ktBerIvcqcFiM3=A3<
zAgPtnQwropa9^`BLY#roTNGRuGMdi;ja;a07w6&;VPLeL$IQU!t<J!p@s5E(;}tst
zqqhm@0AmIQO%@Qxk%2)Ibe5nd(&Vf899V#w!&cjHh;vMUO-Y(xVPH)E1RCJ*l!vx8
z&ELSr7tKLu#efP12XQVtko|9&85lwLY-qYOFlf4hrcUe_7&Ido7&Jpb9B&2&%|ZqS
z&0Ns1T|hg;3l^XuY6i7);+&U77#MBxnHd-ZW->5n_AoGLwy`rX1}tM>(A>hnpt*v*
zo`Er7GXsO>8_<*(Na_FsgBC9XgBCladSkSJ_Rejhk<vtV1hi&jv;a>6fSO$fpz#*Q
z0A8pQK7hts)Lx2nUK3$pv<0ou50GbI(9&aI(9!_eqr<?U<;TEKujK*aSu!wa<uWj6
zrGq$b3=CSG3=CSJ>7amM1_rHJ3=CSJ*{Xmz1_rGS3=CT9K+3Wi7_<&EFlg-!V_*z`
z4)R;VR`0SfFxv8fR8=xCXuV)y(0T?-hn67>j2TJL7MW%J7D&wutFu8ZGI0h*|0xh}
zSc0dJ)S1LNZ;CK5+A%XTF#0cJV9@%>z@P=%ndQHkfk9h@fk7KI%ISZAfkE4tfk9iF
zoq^H+ECYjf1_Oh39Efv^fkAr_1B3Pq5a&4qgZ3o`25r!kXTARy1_tf-3=G;YL9S(F
zV9*g^V9?=$hQ8Gj24?Ta42-s*LV>9io)xVQK>BL7&q3t_=t?1od#xvc#F1L7*`P^i
z21c)Bh`j3$P~ukC5a-ed`6r6Go`KP;lz~B~fq_A%4mADN#K54_&%mJ5`xH8xs%|gN
zaY+byCRJxK1B1?7aCG~7K+LrUXBu^Xan3s+bGL)SDT;wX=M4jc&NGmo(-|0aMHm=#
z`9Pc!1_oVI1_oV2&@``qBLjnOFav|GH>7pNXuXGl;bbi+J$pt%Om}MmyE;{z%Upzk
z(H^u=-!q$mL3c3&gYH65E~sE&(B00!pt}*oX=Py0y~)6!dmU<?jRq)+p%L!R0Gr~0
z%yra5rw+mE0T}(RLM*hg09!agobx`&!u`w)jDF7<7<6AVFz7yKXJGXE!oZ-%$iSfc
zALJcI1_nJr1_nKT5QmR}K~I^1K~EmUk!E1fvu0q>GY?~6^tXhX?E=c)prL#QM*CIu
zAZ1nz40^!~40`^sTxAmiN~54Uu@vGkZ|Jb9Gk924eStU^n+OA=18Ccp_eBN<y=(>s
zJy729zQ@3z*UG@42Qt_DH3Ng*QU(US`Jj^O2LprN5e5dm1JI;pGXYdw*E29W7$N0s
zXeA5FEH+C(6)LE#^6P^-e+zU)C!@_4s7GSNIUj*s1B!LO1q=*&AV=H+1=Csv2ECsQ
z40>NdoLvkIpnco=pd{dToPhzfSzEte9U3t<7hn+sYC?l%b0I$WgBHuS0-yp#eUCWj
zQxOJ6CmB$bs53C=+b}TbTY!u=VPMdYXJF6|25}r281$zyFz8PNar_t<^fxgu=&w;^
zVDyV-3<HT}Ffiy}Vqnm(2W3LPQU(V7cMJ^rFF;aF3=9VR3=9Um;tY&&X%JuAnt&6;
z9dWk5!VHX#puHM#6$}gp$_xw!vY@H+Rt5$G4+aJUI}m3Q1A{>$1A{>^h%*;-2^Ir`
z!4FW1hOP6l18>Yze<NPcF2l>f=y)77SL4FKV3@_gV3+~o1TrufRx&UcmP6P07<Mu+
z7`DSI7TX7)G|j;1_y9cf%>*C&vlC!oUa$-r#dhG7&%o#ep4<aBYFNt{${A!}(d)jW
z9&C;{1EcS4h)?Zmz~THyobv@Joa31p7=7O|Fc{8YU@!!g!M?v37!21jFc>Zag%vvk
zgW&}R2E%h8&-pHd8Ufyfq`@oB`5I)zdXN#D85j&7GcXw5WoKaYJ;1<V#LB>6_#c%2
zea|v57-=yu7^y(>tNj|#xDD7q$SQM2`z;_hX()?xz7t_!bXEfySjoU(<i)^X<OVXZ
zje)@^m4U%15yY9yz+lwGz+hAdGp_*TM`$v0h=3+DQ04#s!-smNGoTS0@WeGU==x!>
zy}A&OIHZ8>brk3PD8j(#0xAZ4?HL%1<}xrC%>-HH!@yv)n}NY-D~J=xz+iNjfx+me
zI0Iwy38)DlK<P#!M4WvwCj+C)DrN@8<Xa33Mn4!BjJ~ilFecYOXJ9ZEXJ9Y}6&}f7
z7#NJ57#NIg#2FY<THr>oGB9Z5h%^4>WMFg#EoM!b#=u~lz`$S}2U;VM!pOj&QNzIK
z{0=nz&&I%DoX@~uoC}r`VPMecXJB*ztrSa<WMDAvVPG(Bk!4^^Q8Q&=Ofh7rXV6&1
z!02KF(rU!OV7!-s!FVS$tQ<2y)48Au1~hdJ6Z`=a<bW(tN=bpZ({Tx`4dV#fYz`_L
zIK-J41Q-}y+L##_Q_2_^jGr(t7(Zh0U|>vfglKZA2lZh<YC)~36gLJ2&|H`CM+R6)
z=<op4)drP>RSXQEa>(ZeRHp{aIww#U3}i%$IOlf}21eJ_%nXb^zZe)y_!t;WK#c%j
zK?VjBIR*w3nJ@-MUpc4&As{`ViCh*2Mpt!E49YVwnCLMunCLLbGcZkG3RTwvw+OV&
z9;8V`oP8TF1EXspGXvA~O$-bswhRm=*3bZQn!vy`{S#<dgp2VDJYPB`fJ$^|zI1{P
z&biJ-9_!DZ0n3(7OBfhV7K2ivj~>(!YrrY-s5lq12m_-VXlJUA0|SGJKLdjaXrkN4
zmw~|~lYzk`mYspoCyIf=WC;U<$s7*`MjvP%a(V)CIRgVj2}nf-1B1zF1_qOppnAfm
zl!3wI9s`5P4Ukk51B1yQ1_qN~;0oT`AL0NP0dPXTA<o4q!ocVr#>~Lzoyfody1C7i
z6I8wAF))~FFff=ZfjHF+44^qQQx_1YgMq;mq!i>d@2Lz7rgaPqrWJ||jNXfwCf0Kl
zGcbCuXJF6(wST-fFff?TW?(R#2@NS13kK%W!wigWM_m{gV^1&|fT%}^c?*{WP<Ccu
zbbAF#BA`hKXhRNpn!)7&#1MBbkZx2%K<$4<S8$_%fze$LZVI$OV1!4Ys|si-3p9>h
zT^JbSK!cM^;5lJN(AlW+42)iTA%W!zPcp8sBx57aB@YTX(4@K7c?Jg4RSXQKD?sI+
z*Bu51(CCusc2M){B?E)$X$A(<;~>sA1_skd3=F0ZK*7kwz+n1`fx+|xv{-YU19Af>
zOL$FyT6+VQQe8nuHGtxqN1RJtgn`k6kC}ndYY_v386yLODX7unwVr{&On`wQ(2NgO
zr<iguFa}&^VDwM}g#x0jX==d0nDUB&(F45BrvlyvHH8jJdo&`oAF^&t-x<KFQ*YV>
zYF#iedMrSa%!c<BO?N=;0(bn8?1D}`dfY|U1|D!mC^F-Ln*9e!QH}yE_kh~C_30hp
z0i72NjGj{90UZGbeFjEPE)@obmEq!?`mmua&qyIi7gJvo)Wu|hbQlf69Y)Y$!+heL
zMj{{?(0EYAG;vODxXxuzo!rPec_BLM85nr@#5wuES|J@yhL0<ubq-Ud1!&05bG<mn
zYtZ<WmnUS%j^izO$d0RkL7d|q_)riQ28PBj;vDZmCu>x(Ffgo(7w32n8qEQ5lIDnW
zyjKO?_`|}$Fxy?6<2|TRQ3bXQ)U1z$SyypDl!4Jp4Sa`+ILB9321c(q29S^?su1XO
zJDn7`3RnPoMS=rR7!-hBpv$uaB2*X{m|uu<oPdRe*91sdaGcNsg%t}!J*eN!0lIpY
z!2lF;X1B#TcEDBdg{t161W^rEybBz1AjKzFh;uB4DfSkCDqgIPq<AS<G3bb{ZQ>lu
zWEdE|1-Mc`;kI0sfnnn<u6ppOFUJb-U@2(WF#Mtl14Hy2agJ`d!TwN#yS0!E?u8l5
z!za$s2aZ0Flak(wbJ)Oj?uY8MLDp%9th3%8td)fUG^EVo0C5z=O^#qUu`n=bvWasz
zfi($0mZ@`;%RmOHRTvn81;jZZ*V-{MF#1SBEtFG6a;gGYFC>w2D8lSZG7;xc5(ZUk
z2H=#y!04k1O9+)7usHS61ji{mC{BGORTvmn^N6!Qg?Z3tBE&xSr%3j(KS#2U9n?59
zyA4V)wcErwSacW|eI~LnFo?^EbFiv0FxLA_108!dL7amPbjJkbG^21(g&ZEQ!oZMw
zQk)%hdo#lukneUwZMzJ%4HVo_ed6r<;I4TAmEQ->Xpk{w_5<LtUXbFnlj7_vVTyfq
z!HVm}*;lH7!fFO10|Vr~Ur5$wUjz1q02gRjl6?#4azO(IkSQnsiL>{>O-TovBF^3e
zwi2qf53CiG4Nr=*_k%egogqua*>m7J7lL)xi?in-Ys~|zhQt+nJ~*yGS|b*TvwOp}
z-Ue$GXZKbExg2V#FS1TQxX$)B;_QYnoqnQFord5LWMN>a-|sBWZj7we1g>?umpI!y
zxYj<1R<?KG;DT7n_5n#J8>sDTcAE=4Wy1CeCQ~CT&h`m(bdv!j@v?n}rEB(Y;%xO_
z#26ShUI2}Yvwam|U`Vb7dDmD-ob5K;=BrSfZzFk^?JmrG9zJoldtf)SFfb&Uh_l@X
z%YckI!za#m3}%eK2h^BjFu(727H6wJ0agtOaJG|RbD%ze6iQr~4B~93!D$FHn*>0T
z2itkDA>ibpc}JYB6K-ce)Xq*-L`<=DgH=PUtY_;1+sVSfu<4CBTdxcQqkliB915AG
z!oc9vB+drU+yT5$!{oq*aWa4gH`(Msx7vVC1glaKXHyUaP4PkF27Xo;D1?+?wgmKu
zvnj)7R$Bkni?gYKrNI6KO?olB0R^2?tT^jim^T92AvUwVMG89B_ekDg{Qxlp9QUjr
z!7?BdSwDe84t&n9IO}InjdY8Jf#L9Wan{eEDUMt9&=6z=YXOH~pMp5+DY(_=pjMwk
zD%DxffK@|6ko7FsY8D2DrX}L6=Xe+x1I~d0km0Z+1H-gPan|V~pg;k)d>C{<y9q%<
zDj}d@<3Jvh`n=Ly265KupbPN~7#Pg-7#Pgt7@`>%WS)w%wm`-x8MJqRnn(-`3=myD
zkj5Q@Hgrfc3%p|uwz!;$fq@~Cfk8V{oHZMHz#6nE3}g(%j3<x*Yu5T~W6&%Y1A|#5
z1A|#9WE`3`7wkU<2D3>F3}zFgz-<K9JaDWrFqkc5U@)5xO^iqznF=7zVl>HNV2pSQ
z>Q^jg%t9LBt1JLJjCYMVt1sMP^&c3GVG9Gn2N?uQKwai*0(ICv1_rZjMUa^F2Rn>0
z9O}*hFqeVB>;(gZ*%PQc1EKCT7iM5E=Z8$IvIc=OJp+Te9Rq{871Z&;8t^3yl^xFD
z7-BSrZU5zAU<_Iz#lT>@QJggfItyhU&cI+E3~PrPF93OzfidVTq#cUv*ABR%EuelO
z17i?qMH@#s1BZeNhk_bhw*CqOWAc0k#$aZU8RhWqqzMZHV>0OY1SZfxuOMin90Oyp
z2Dma51678>5|IoH>DJ<`Zt$@Dz-SE0jG#!?0VS{C+0dYLGlK-Bc_jmbc`3~E;4NtN
zptWU{3!qVF90KwYmZ)0*zBrBX1p{O7YOot5z-|D|{`dNdvpOKV0n`SByCFml>IMgB
zIy0Zbz+gTB>IUQ0^_<YX1(gS2ZcxGDh6CW_!*orYRRqa8LujX(@eat#p@*T?i9l12
z`DO+N^VQJQBL+?`jG@rfBQ6Y@!8c%FFu%{hV15&td?dixnSsGVl7YcO6q<Y_p~=U>
zg@M7s0qXi-4Y=cPutHLgVFJkU42&UnAkm4OB;d1Gh9!_B5%P<Xu|A8V6fI2{PJtwe
zP$7^Rh~9(|2PjD}FotTOi7PNLCMz&7hB~2%dqBmb(8Mc1!%Pf}p>>Rmneg!6vjMbP
z!~>Qvje4M#O+(Xs04lx?Dh`b`qX!_%pkko%C$L?dWdTw==|Ynx^9N8oMO=Wy6HEO9
zBS_k`$Yfx!h=j}{vn&Ef6a$0BP6h^xjgaVKSqu|=#K2&24-#7}OQ4zEl8=GGk_!@B
zEK8xWWoZYxw@MCl9k@6P=#n_l*|nDG3=EdZayhAa4B{-y>iHnE(3Z^%43@QW$qeEw
z%fXZI3=Ed*7#J)UNr8?V5NBBdp8jWGu>8lsVEF=?03sg15<nG45CenSat6jQ&>^_&
z+r?QPC_^UwtPV0TSnY*&h4oK>20dY6tXsgqSf8+ufidg{DBuv2r@9Lu{l;(uq<$lG
zz#C~+xrzfktIV<%)}hqh0vZH|CPm#dkeCV&1sPrj?+xod0gVqZFox%X#Oo2Z>ajr5
zZulgS1ZZ#@zVEpTy5Q;qqn-iORM6xwXg@jBHoXq0_#u#Hgl&2Yptjuti6dFIhk-Ha
zEdyhHIA{b4RLH>$x&k_5gn==F3#0*&`t=zgxgtUdB#y8^Ujiy_g(m(2wCI(AF(L>g
zJ`wH#0}DvlMnKkgLAD+-Wx<zT8bm-m5&@bVM)IIR0Rv<7YzD@Ng&^}v;lnKke?U<R
z%>{-spdbV(Ko34xe<tDqxcC$S6`v6o>>27A+z*JeOlM<YjD$9?Sf+zIo1mlr1KPz|
zrW=DA51<y29=kY8J1=Ol3L^t!q&K8V!_o<E-+-F0EM4IBG0>zL84XLC6%$}~M@EC~
z<^$Os>0QRa5Em<6&r%OPIN^H-sL*C$U~mCt(8zrzpuA8IIyvDX1B2BE1_rBFkSJpK
zzJh@<avuX@<Vw);X<O(BD8u(1AYq8-89+@K5p!{tGH4U#JG7W)hyj@%l?gVzOpBqO
zf$<>&gS7wygEbFgRX)Ra4bU*6Y>hZe1t$Yz6zCAJq>Bs;)|w0q*6N5=`3&DZpsVu1
zEU*V4tMXw^%>eDlXJCv1PYN$)%;K<6;jmDHW*CO=pxu*EnIOj=d@0W23w7)_Xj#Po
zE~}zvgB|Ou0t$Nu25WBy25U#q5nV>&EdBxv42)$A4AvD44Aw=^;wKtf{8&$8V6dKq
zv@Yx5%OC~@*&GJOXdStn;vxodmfU(!L$iv3!Fmk?gY_z?tH1qWU`{P%V2lQB_F$eU
zzy=Ru83yLmDWK)0#S9$(r5G7A*-IH5d{pEW89>L1q(L^VF?>sbj<11O;6P#E5N8SD
zWMGU=WM*InT~Tbkn}NZ4Cj%=a{WE-<0Uo1cjIIJz{#?upU?KEv1E@%WByWaq7Z@0$
zG9i%;Ix(}0Nt^|I9WZ325X1Km5X%_BNho$3INVHh85orL85pcDF)&!4P-kG^zbejR
zVh1T5ZR*(=7_33tq&bbmSwQ1_pwP52VPLS)kxR`>VGw5lHRC{Q-)v$T7;HcdzwAHa
zEEdqZz-B1}gUw86nujcu05@npKw5JQKYSoAV(?*Lj5z>}A8YU?dj<xZdkhTqHn*UG
z{v!lZE60F>fC;{mo#96Vq`-*TgtsuR`~WG8ZD1kyV+ttb7(g*Thk-G65j4gfp%HHL
zg@M85lYBh`(=5n7cZMHdV6pb&3)Iy-;w<jG42-cQ%nVGk-ZL=RGBYsPGU_of&H4jw
zZ-Deb+D{-BL=y{_sgNE6bJ}LO3YZ6Brm}G9@pv#Wrya5X|G)mj2PCbs49saqLB_ze
z9DyXn*j`Ywm?!~Hh(DfyBw%?Rnmm5!FfdIw1SJm_a7SvxLU9%eanMK+BPexoGBBJv
zF3uuh4~lwD(ApGn7K!=@1_lPu{VS1<;w%!NgM;5dy6G%Z;9Lai#Ib;`5MTgz3m5$t
zX9nH;wzCUlB<L#SiRR+WKRrNWX%Hisf5Dde_4JA}{{r7k4l$AW58OoNzmQ@xuc)3u
zocS*(O2Ed~-WF%R2Y2x*A#kUI`JOGv#ZW^YAPfQB6~OR@E3b$_ocST#j01Y&%sb#_
zJc4T5h0wMeY&U3JjZ2)lem7jB#yN531z;W{17kes_Fvt7;>-&ypnd~+bRmob^4lWt
zS+$@5VqO9^5;Rsj#Z;WxA2e1Q59;|E_K7q5g9ck~sWLF=w~8|dYBMm#e}YvFlMPhs
z85m4N#hHVY85k3oVB!-&{dw17apqu%t0BP<0?u<R3=GF_iZh2mMpQBx#F;@ik1)Ie
z4F)rZf}PJ*0ulwc{Zttk4q1vbM}WG$kmGVbd|;Zg0h(crSHt^X6*mMR!ye2X&=rJ&
z3=H8jK&}E;TKo(v85tP-uQD(u2tx%_7#Q?_i8I4T$P)sgVQmO;HOOs{YZ9Q=1%rD$
zpz@*O1E@xIJ1@>$uLO27XbDLTG`f{QRh0oaTvZ_98qL7aUn9;e2CW{nL1`A0OTg=!
z6ZVBd!bc1=xnjVW1v+$uSpuSy!B&)k!B!AdSgHw&GyMUl3rNP)0-G}ZOeQNweIl0$
z*bJsWp!<dm7#M8z7#M7|KqfJPE-nPMTWx(A7;K$Eaa^1w&U6G6$BDBc<MB+#z~k{y
zZzdwVxj>YGF%i^M&`A+zItw39Ppsf7NK0f8XF3NCYnFNjhJ#PUna+WxI6+a*Co9f$
z9#Tkx4Csc8zQYUvjin-)2Wwp<LOO=hpw>m=Y<mU<rg(9tO>Cf@=tAJ-!AzTsK+A)L
z3K+zhHtRAlY`iK2amD6(NNr%xz+jsx&NP#afiZ~_s%NG?T+b{y&`2GFJp+TIuQ*c!
zNR>WRRf8E^Rii2>zks55fs;5>K6vbf5!42S#4b}l=qMTk&}AK_;!OGAvuGIVBN-Uv
z6vdg6SwWovX!O9w0SZ73mZbgA2ug+y#M<s+V6fc=sZf|w!3mCm!S*@>gY89VX{hxF
zRG)y#&Bcsa3=Ccj3_983OtD}qKn}VObx^DZgA@aU0Ye8P1H-;5ai$1xf^=kH=s7FS
z<T(9RHmg*<0wjqsIf72-F<{IBnHH=i&SVKQE!k5DJZR5ksRb%;10ZX`jaP#dw#A7v
z>BAM4L9Nw?q;iNZNR9z14hj=zQiCg=4>7f#Nlg>U*oX%pmD{z&ndIOqPe4>M$zj^h
ztsu_$Lj)8-j0}t^DG>V^e}Go<8$i-8<1cXfWno}g*(1*Q8=Q4S85mPUpb4*@6`pic
z9Jz8+a~Z^$*uY5_luMb|!7GVD$&%AZoQV@Ujt?>*1Zn_OKS&8E<wCh2Ur0-fGk$>i
zBBcfDxDTM&Dg%)G%6f6e7xi!jOP~r~fNnMhD=1A7XS@t5>kL4?dj(05jF+uJ{^iQd
zXAoz+3NAN6E@iw1_L>013ye3wUI3pxzCA>oaW*)uLQ>y~22lCJz`%3_l=|vZ??aLw
z<80_Sq3u5g2HOvy@_}(K*h~fnJ0AuHI}b>TWIO>)k#;Ez40Z|7#?VSw13-m=F|}Nk
zfx&vJI3sAvE%iRE<e#zwdfX7hO7M{j3=9k=42<=u7gZS;rtA}EJSED&(8mf>ed+`>
zt*?B*z#IVTFd<|>D=lr1I;)_n9nuSCSP2;t0}X0DWME8v4=&F+L7`o^K%6mv7u4fn
zWME7KEnT;tA<h_3uff0|%n!P`bMbR=MoTsZ#x!#wa57-D1SPBkLg3y!qa`F(>=_u=
zofBu&0;$X41YMXS&Zs2|YK3w#Fm%a?Giqsrj_T(Ew=WrWAl-e?MX^0)jMCunXVd|2
zJZE5FumOjEdWSj#!_oQTjMAV{R09SEy9NdZyDCthe>wwW+Fm)(Bn_iHC?-IX^B5TH
z=0F3IQ5QBI#=^ju_8h7bbmI(2<yr;?yVY=&pqvkicNPZ5bU~;}c?JfCdXUmR3=DR=
z;7UOiDom+0R4KG*vOCSdV0RL(5@Z!jWhzu9w3e~E#lT>91KPP@)CDi9Mr!0{d4RS-
zE@sTCXJ7yY&)%PmeBj_=_zCMEWq^Vw{Szxx7`nkK{V0+tX|TOh3_mL%E$Q?pNYd#N
zum<zb9tO~IW6(~7T4hF7P<goJlQ<&-4?_wA!<%P}895~k;@=<<#P9^#)nM=exgaA6
z>Vl^d5Gyi3TYh1QF%5Rk2g6enkTjC*X$cGr;S3BWvf>w~#}%?l)h|s4SHu^=`HV43
zA(KHIa?>vZgWX#O2D|4BHVh2M+{N?R7#SEdPIG{pv7lOp;S_IKVh)3NJ}AQegH)}b
zEuIBZl?l4mRg+6R3lwLkcvBNA7{s$=7#Nnk=1olkvDF~#<O&Ay`YZzoCj}&71!6PI
zWn^H8Js_R|DTHDe7z8GXr?bT{FeK`Ur?J^EFlbtfr-Ci=<zQe~RxF;X%)prG3z~xv
z(zRh=*ne9*1uUHdkxo$rOWQCotl<$)2FtW@Fff>`7Ee~J2OqC$!@%I`C7uM9S^$ws
zk^{@cFfecki6??=*Igl=0HX8i#p6Nr;#%=IHjrC+K8nY(fo>OKjA3Aiv=EO0$?iEU
z9u1<ILd2ukIvE)l$}W{Vg9^qswhRo%&h|_Ivl*BfvoxmvC<0wA)ic2kbhQ-df?0`e
zJ!KGi#;ic_wM0E-p!<Kz!9m_r2HHdR2BeVhS5FR1A?W78LtH&MV1*z_<G`K>m?Y?o
z#zR~^5uhuw%R!Q!&w9WUm~R*uvkq`DFz_AX>hT3#Mpe$iz%Vy<`odyXk$PJOhFzRJ
z5N9(mW`VAcI>goEj8N9&><nr_Fn~O`{b&z(bq2_T-R?aSP^+`$As&!00o|*_0lHJ7
zN5T=T%a(y*sYDMC=%%Q02F7gAg-=e4dU!yY^$kM|14DgdiE20~P@Qa40~l=>7#i(V
zT^T_~v!!V>Fa$NKdV=bqDp1;s?pL(}%QSF+?vGWq;sJ-HI|D;uv#JRr*gD4Sxe!Sc
z(6rbo(DA)1q*QeoK`J5nxdN8SOhB0|r{1cMk%6JPR#g||ms5;cY77iwZK}GEQkTJ=
zmw~~aU5|k=#|o<b3v6(v0#@_rsOp36OUdzKV6fL?V6fL=W?;+-V_>kiV_>icjq>Cq
zF)-NsGceeDvokQ}<S{VVXD~3>r!jy|A+8T9R+R#|-GG5H2eir1^S`Q;9F*N$t11O*
z(ts{o5^GbH0$uuR0KSP<RR-i-15kbtyi&oyFt@drnS&8@0)I>|6X;%1@Z^5ZVbCSc
zy-eSf85na8bLAB?^fLXHVPMQT0ckb#GX1VsWMIrW3%>72Ihc=uVdXqN1_q&jpl0iF
zF{VmJ2F6^_b$&dX#h5B3Kv@^m<4qM~s?-E=xJptO#F(ljK&n7)S>pJdk%3{It{77=
z$WM@cB@AlN$uLH6vonuboq<7KPK+rS<c0bw1_t{|1_t|5lcLl@1~H~!Lk7k?W(EfP
znG6i}6V(|QcAgSr3K0WEAOnN_DFz1n1L_P6qEp3~LO|OsUo$Y+|7KvY|E$iyu<NH7
zQ>ZEfL%JISgM&H)gM+Lb*nLqD_c1txFfcd-$YmBKGl((8fGW0A3>pj$a~K#LCRIYB
zSKWqzG50EH44{;O0VdYKz?l1b`t>qat$MSsVobiElm-fG!DC`fc8m-R=~;{njCoF6
znG9k~4xn^*O8^ouPBP$t0riw5)5Vy;tCvneESd@`I6+kycvvZ45$b$yW2p0wGcY(D
zmIJ#~0OC>xher(c3=a1|x6H}QF@f$Eu99M4NMaCU5`wAt$-v<7J&=L19@;vZDg#<L
z$kQ&yB*Mkaz*rx`z~Csuz~Cqa;#4p&IO;GkIBJ17Eyywn3=EDo3=EE-Yd7k1Kz$Pi
z21n37TG{^}J}^vmVPI?!1<kA&GBT!vPRe6A&d9*f|82TV1*>emvlt_Ik{jw#JJ=E6
zFF^S%|AIOLL&s7v#<!reSCtqT9LpFO9P>;-Z5=Vjw_2b?#lYY=hk?Oy2E?O`pFoSO
zq!<`%_{A8(7k-~&U~t^Qz~HzA+Vrv)U|>$Jg|^!4Rls}XK`~g&1|G4gNfKkc2Wo|!
zVq{<};Nk?89n<eruu9g;i7`F{HDszl5wyKmjPV>;86<+HK#%!m04Lglzu>rFybKL#
z$BPUMj%T4RyaIJ$*IqHkt1tzx7#JL%$s?j-$^+O)*c51pL@>yRG2Y-}U@UkEih&RY
z1}8=a2FL#(P6Y#llOO|w6F-R4f-IB3z~H3Fz~CeglF4CUa57?Ga58}Ue##F})J#89
z$toE%<pu+DN;s&=YRCZYh>1puF&+Z@(2;>5#7&G5ye149O=_^#j|M233Tslqd6aPn
zsQX;SnB@jKh=00y6{}LcFav{=BLjnzJ@f#0rvL^9CqHnDKfhFr5xf`(YG@2>CFBmU
zq0gZa7V`xZVNg!23^K<BnUe$JKz$Zl!@yVznx?1+t@i|_x9!szL9=J+S&;Zr0}Tm*
zG8E*ZGk;+*#yYTPA<~m4faDk$7{RBu7dJwpvjrMkPDu<5PH~_s7?Z^q!P5_?7#N&D
zkx&L66c=Nh15){)fx)T1oq@rrRU8qqlP7?V2j?jiV{GALU@UqHiWg8^PGewj0$o{E
z4~j832NYw=7#N(EfRuqO*ulWy1iHVf9u&(b85o?7Lw!7X4=64{tyQj4&^{R^jtQW%
zdFweEz~kb{Hy|FHk^@gy;2RPc7(mHtjsOE=u?grdhgS>?PPZ5soNll)FeiU!U~qcJ
zz~J--8u(K>7?{)d!5XWRKY#)p+UlI50!ls%jKxtPCpg%`j)bUZnBoAHDF(~ftHAV6
zi2>;cWhNbSF~)SH(4Ph??Q%c~p=36sv|~(%mUf`4!<~LZq6E~rVK~LW;H=2N;0)Rp
zE-xp>m<!3K49*q|^$gBtkYbN94-_XLrJf87&aUF1Bnk<WY2el6JZHriK?g6E=z>zJ
zFav{gDg%Qv=qjZY1qKG^5(Wn6BG5AL`iW3o3848Ip1Wd<MVt(bCB4=RjP;8^(X@_%
z!MT-z!MPd40bQN#JcWV58FWEX{V@gx2nQNz(=s5Dmci%%DjOYOQ)&#;G#D7GI6z?&
zbzO`RJRSngBvWAvVIn|bQ(6KEhFF;2mN76mgC=Z2!4L;Jnw6o7fx&q%1B3H!DFy~m
zkrNM7dVzt#`4lK+LOnF~4A?{4#TXMg85m1Jm#@_?VqkD#VqkCq-C$C`j)B2Nl!3to
zT*~ZXU~q9~U~q8-`SKWy1M?RH)L%^X91Wmk2ug*}L^SmT%xguP#2D?7qJ09i$ImbW
z<h8N|(6S$Nr?rq01A|Kx1A|K#wCuNsmi;be3=A$sFBm~pAEOJzYf=mhCbPsCT|vD1
zQw$6)Qy3Ur`s9jBiW$Th-9Vxs!Ho<IF6%)D9LtF@x<eC;%TWdfm&5W5%*o1-NS<&9
zmR%;?fs_agEMkmaQVfh`0if(+%D~`qg@M845-7VkF)+A1W?*o62%3n3no!R$;RD<V
zSX+`sjM0amfw627%!p463@#s_Mu4vRcKHv>Boh|ELQBP2j8O<Fv?hXvpBX?G<AFk}
zl2IL0Q;9JOX)-X>zF}Z+6=Ps<<uj>=RFy);3=E)b;_Ae};A#U&GvFQgrx+Mq(-|0C
z6QO|y9<&7sPGn$kZI@zTI3y*;C<zTS*Fy{puKT1I7}&3iF-n01moYH7zGPr<y$uaW
zX=p&YsWULRf$m4Fmo*h*lmRI{#lYZZ!@%HX0v>b_W0VC8LN7eN9L&I=;w;X<G+hJ|
z@Dsr|9`e|TG0O5YFjnw^c5kRKFu1icFu2ts&HhaEfu1+UFcCJ-#ljV50iXS;{{WJJ
z&hH{AK}`RA0IPsRE(?72M;=i;Ok#nx;Xy30LKZPbLtX~P3J+`0y)vNk0(6_s2?hqY
zW1#IQu<5Kx84UH1Bcd55K^wIU9Ab>hq6~}`_n`AxZr2$Y+^!<|Xi^6B*a?IlwE3(_
zuydA>RiJnXZW~KI+(*#tH_-)@prHA5QUs_71`W`HCbmGu4c9F(Mkb_GHWfTX&%gjV
z$fSw`l62U?amT>m_JV=I4YcSCRNQdD;{HDagWF$FX|q|3v7QsE)Lnpq!JP-G)SU{t
zz><Myx)>ujD+6QY3{WTvGcdTTGcdTTf;b8c4DMzO4DKe#rS8-P;6iG-7$XlC17qbc
z<Wkq&oq@p}TpsOWU~ms(U~mrs?U@CYx)2`J*Hc%(N+<9MHB20ca(8M5D0D#MAqx(R
zeLxC_2@2qdhlN8g=yXsyv9C}syXP}7xTo47l^YJwG*izo0W@9)(##_EgO7o+sver@
z-Dff|xKD>>diNC!4DQR|nZAO7v8os3imioW7m-}i54)pa2`JCk99IK3yDoxTT?`EF
zI~f?<w<>^&LhvZ-DFz1j`l}2K?iUpjlam?5uESjWo`J#rtwIii*bPwRykTJQU}9i!
z|D(ykAoEk~CP?fQ1A~V>1A~VplArpQK>fr3Vu5_bz#?{=n}M-95b7n56b1&5B&e4>
ziWwL@3hO}^^}sG=>fZw^3j6nf^)oQAh~4L9V5|m}grEzWJen97JQ|>}?=g{q!J{9=
zfGcnVK&@zy8609ySQ!|rFN5?5Gcb58VqoxC0OBYxFnDZasAuq44>AE-95eLafo_Qf
zu|WDkPI$)6z*r*!^Ta_029NzPPh4PN@Hhv$-UaRl@USS4jMxiK2F4mskWC<K?=vuX
z+y!w!*1lt4@OZ;u#lToUF$hweO<(~hTOF~Npxr&7YSrUE1B1t3Q02Lffx%Odfx#12
zt$HdjFnG#=WR5W~KseBZJAnt3aHmggW!0{)5IYQ=i?e~YRT;no<+WyN3=BM*#SY6s
zI!B=M2t4)G7#L2aiXGO6ia9Vac-kqH<QFrDod9oMVPNnKU|{g{Q%ET-W)M3G6N_hH
z@Qeke!<|WD+mO;>%mUD+1yJyT&qJwQh;)fo4EX*Vj@e?nSs55>LHFN)BGxmXfx$Bu
z8bF@S3=E!)&_P#*m=n;pI;d|5njgC%wiGnAS9_a-fnmFw*it!A4_cIgvGxob*c&VO
z7#Ql8yawM|&9hl-Js-qZ;S3C|kHkQ0{b7xKd+@O>3=9kvpzKnoqfnHZ&LB1sn!r7$
zGB9{fgcghTPe3Ihl;gkw;(+{J8YPyA<nKwap#D=2GO^wnoZ0eW2Cipd@LZ|Mz#un6
ztQ018hJnHJlqLhifn+i84eF;D7(8z?FnHdSW?-zp3`rf6Abo;Rv3x!T#=762sDHx1
z;Q5My!Se-(^MQfE^A`hy=MNC)4+Dc2A45HZ7Y{Q7BWP^Pi;sc9i-#L()Dch;VPwo?
z<ze711TAP}!f1g_<^g#R>etB{AP%$@KRE-^R<G9u?IeXCRlqR00VED<zcXktFbLbv
z6H5k%3?nF+bASq>>3$uo;`N+j$)LU!Xb>vNL@e17)Z67?VAz`}mJB)sqza^a(G;;b
zxaP}X&0=xjQjCLv!H!cb4m6$yH6adU8tBUQy_sThVADV*MBf#QgqhF)8eNu`6N?0m
zJJ*Ah+Hs0Sf~EqXMnr;IKOphFnPQQkQL!pe+#VJda{?Oy3AsL44<5V*yNOW)oLHQs
z!1sDFc&Rclc*&}PUFQT^*LaG7!ONe4!OL3>wB<p}33P#c6$67;eKrGwSGpS5!%m=a
zOORkE1A|vHIIXxt(}mYM1_rMcJfQg(F%Pg9v?cT*oq^%7a1a9n4-W%lW3?s&L+WBN
z@V*m}K^GVpyw2Gn7R>a!zzam^Q3dr39AW{y42+Gb&<2LreFg@vyGRX;eiv8+qaUh=
z0j+`24?A+20Z9c)0|OxrZ(l$YV12(1C_#bS6dY^}3|5FXUEdy1*O&W`m<K<!Ip_6(
zfx+tylH2<BKv#w`^ucQg<mTK5kT^Ru!VoHu+*S`(0xFsq7!b`l(3ClshY=$eBLibo
z918=(5mzHd9&mjKo_{rB6amk_iZU=ZS%YUxjTlAYGp<d3s6vq8P`C;PT?U4dKBH$K
zvyZTHFfiEvn4Z$jsvy1S6zHrtkR%&utEkZju!T_!3<thWpWn?YrD)5*P&CPC5qR*E
zfw5Vg7qm*iXps(R<`iPit!`GudLN_3po9;)?%sKx(K1N}hQ%j%Kuda!R)LZZc-(*4
zETc-8IqP_HO7j?uDnZ*jKv{sp!KhLXG=Inj_Bd$Vn4yY|fnoM-qZ%m&#^!Zw3=CqW
zMs;ArK;jRKdcfk4G#Sq570JM`Y!<}I>0nh=AWs<05ny9r&`B|><%AClFFv8nz%co}
zQ3@jiV~Y?61H<eGMk(4LOCX+01zqlB2l3p+9#%ygA0yCp^bE@&ZU*HXhGn3k?t*Pb
z>QE20oafCiU@%hG0*y;U+@}q8-*mlRRyB#mMh1!u44Sb##pw)2hT;s2E$7)77*5=r
zp3}>!TwiTu2X-+VXn?@T9?TYHU~D-6ak>t~=^&59n;3b3=h49{{pUYoU~IV$o|t6<
zC7*@nhKxLn42-Qd;N)Y-$On#1aPl!^6oVz7R!MMLF=P~nB%gXw2F6w$R53{Ufhz%}
zpYR03V<5x#f<wmem<(tH8=PtkPk`-VV_>i;G(08Ez}UJM5-p4o4;UE26Tr#Ikdc+A
ztboDrrZ@w`5*s!KhTXP?pe1Dt|AW~W7#bcLf=+>B_|L|`uyMQL9Z(p6*vl^){)0^Y
z@-Z+hp5V^FAUW9(G8E6i*m@5X=!U_Xpg;#rJd4QoF|J`_U~KE3{-BRlv%X_iALDuv
z5TAvC!D&$+;|AE)CzDxyj2l6goMK^M2(;{D+z1+eKE;(=n#0h?xKSL`7iD2!;56!E
z+yqkgpM`<pY-}InX0T6185rB@q0%2kL24O50R~e2OB@s|;OU1&7Dp`@7<O9qF<O9U
z1sNFI*@Vgp82T73lt5v?$-tnb(Z^^3ss`S0GBCux>SMIj1gV;Spr2Kye$gogh9|Q?
zCV&I5k8v4SSrJ1YW2G<yV>>r!c4F~iJ_d$)U(6X8rv2$-6k}sxY<Gp&AO^NUsH~8o
zk5SByfno7skOM)!mIkGtQw*Ts@~-P+<N#@khiC%bUAM#rw2af8z3(r`gA7#+jP2FD
zAV>dI1i2ZM5Z21{eE{j24;KFbnivJmf|;J~`=AS|N<jwrrSv^z0dpAJcZ1bERe|Xj
z^X|I{(*G4Keo+G?&H+jfeHTF$>3^Oy1BSlKoYQYjU=`t+(YF^Ac>fs~JJhHDn!u`7
zU*1>B#=zJyjW;>5fT6Ec9u&Qx>CahxrLd``=GwkeaD~cSmRQ8lR|;Ah_+ONPv7?j?
z9H%vqFaU|PLqvM{!O;fFW1L2P^C0pdj}$!blZ85<lM`fRJwu<YEW%Duh06dc!J2FP
zWI=1os(8S5f|nV9?R){TK?Pza$j)C75la+1{UGw70M>lg-^s?n*y#@np#Dx}Pyq3k
z6*Ba9+A}cJFFwq{z)-xZztbJm=;SFYV(9M%rwCA0rr+Nq$-pq*8f45C@BU<vG5^7O
zlXXC;fP;adU}JxZ8UthJf8PAk5{CX%MbO$#-po9P{!~zy-2%^+_osozZa~+Q6|d?~
z1GOgJfNjbUW&tI>=?f>ZO4je|&jbyFzF}ivDAVcB1QkRe_VUa9SrQBk^UWX*$_6_K
zQXnvVT*<(&#T%4%=RY!FU}#<6?+pswHw=tjX<%o1YlEE03mOyZ_qJtVG<yKH*B9nP
z`78Z?vLMxL49pBlQqyfFv+CDx0Bbb@Yvo{IFxb~`1ZqRw0&6vaX<dG~-xTaFo=k>*
zGa-<-K{2ev->(dF!xOMU%DNyourV+wN%gCObU1(_%&A`uR1&;lP-b9A-B%RN$iUbw
z$6Hp!P$V8L1qu{i&@REEXwaerP#`YTp3XRhRkZ%(>B0+8^Sft)`U??-7c@YtXV@4R
zG?x@!Qej~1p2-H9vMmHp#(;v*WL6<~xe|yyU#{>nXtflGE%c=DiV_23_dM{NY2j6F
zP^yIlEn~0-1H;MF^B7Z$iWmwR!6nd?RiI}0+<avQhU4mmvw0a9dsIQuyQFZoC&*R~
z1_q%gg>&4YCi34aoF~q}ps&Wpz;Jq3;e17qdXP=C3KxKO;M`(kU@)0hxDdt`J6*U4
z6eR!WgDpM7#Kyp|gsbp?8UtgG7Q|HytLh6tmV;t^t~(zC!`$V{3=9g}3R^&qSqgDX
ziwD9nt!_}qoZeU14s(FXtileMrE3ZcJHc!oP#P)h0<%Gmd{fxX32F&L95bB};sD0_
z#MK}RL9r&bqcEM9fw7k#Vr@Fe-=G)~dQzC-3bmI1USSr@+S9uVvtewLS%o<;tHe$h
z<|6sK0cKUNJOhK+4%kx5UU^W4FsPRTt+njsS7u=F%qp}1*}o8Czl96J+m=pH`#t{`
zT8n^Y%RzCluh0f&zxJC#TX1ZHn>dB=27_2bp*`4L5N{{L-Les6UljvG{fw7|iEuY<
z1iMKb?4*Ud3=GjBg*t2ujD3ud#ApbPI#CA3-Ur~eN1+j<i2xG$gdzeeDRoj{@}R{T
zyOj&&89^zAfw9j7lFmUp9{fZ>i!+3t6e<{jyvUQuP^bh7yf>g0%bbG~82>XeF!nRE
zfL4G_U}6JT_5lnGpoXbeBntz>v2PQYctILKHT8DZ>2cFp^`+-bU{U~yflh&q_&kA0
z1;!EnGJVB#R;Ab{plV%r0u$))L55S{+Ihm22~1|-LKajN2I@{=vH;il3=E)U8?y@v
zVnM4lA`~Wyf!1V9n8U`vaQNp$IXMQ#33DJ0V)(d{je#MXWxDzdR^@v0iQ1sG-KW?X
z7$l4*Le?;|F)-}cooESeB(O0sIG&tnBg()yVIdFbG}VbV24Hq3!$e!Kd)XKmWDF;I
z!r0#Y6MaCcm+>T(7Bfur(PChn0BTU{yH5;<shK=$VgkhUdIpBAniCTx7#Jt4W@BIw
zESi`NVsBt$U=a13m~F<uIAH@1XyNEY@B|d7^a$NHF&DJZY$Fe-5kD~>+#m$`X!*o0
zm<3%j6Su+Gd}k)^k!N7&xdC!jAUOIbg65yV=Y23UPN<&lJ(E>ax)((Tk}#m^ruWZe
zm8;L0nBT$1z&POpPbNb?+@=ic{BBU-eqdu@a23q&5ochW@Kt~(l_7tUG>8c<!RB!A
zF)(<v>oPFd$>&$IF)&WlWMg2+u+FcAY4tA8uj2uUgAA_+I~`Qm2p+IuV5m8npTx$<
z!oWDOX}ZBIRuh$p`Kb~N3{iR@wP~Q$8U~=A`mrVXF`#ZX==g|<_ojEuVwH8+pAYW-
zgBGXEkOQ+%cCj%q6hXwn?1gMlaRvs^+5*RXbI@9>NhWNd7UlG(vskU`x$>>J7#Js+
zfb-u&2F6J);QYq}Dvi3Y=4<mZFiwi*En&#lHUWhXC`)iPnKLpmGB8dmV_{%WlQC!H
z0QqSd$O;7+^EaThISG_DTRF@>!XnVY%>1Jws7D5>_PI*T&#^HuPCCoMP|t93q4_x_
zP&<Kxfx-5R`8hohn+?=sH@^rn_Y}w_i@%$L?v9)U%HdOwn6H#zV4U=cr#Ls4!F&~%
z4GPfN?#c`d>wL}o85tNS%djypOg&;g2`mdyIT_4m$Y5Y7Gc>n{%qa*lE)Rh8a~W7b
zqfwKWr%yMS!>U~WiKi&FjKLf{|8)wQxt`1tWni4##>T*4pl=?o0CEH9SeeN)*cce*
zWtt}mGBAig0*|Q8%QP<)WMGJ5V*mx1@?;T~Zy-mVXJKIQS}elK1v2M6r1)n54OS>m
z26<rm9Ww@otTiGmdwJ^_85pO4j*<3SEW)zah=FnPc`i_%6JdD)3Y0gZ42)9(K!+_9
zim)7!W?-1Ug@u8^AWMYhhzgWbdsu|!Jg6`Mbqw~jiLhLNaZZVduv~<3CTNJTTmo~z
zMbOz;5tdiHp#98mz<ckcFNv@$hmMgxg$}|q?E!_<jB0hTXIPe-fLzDG;LXdx;LUDQ
z#2~`5+@FDQMl}P2w;=<Ax3*j!g9yt?2?hp%SOx~~AO;5S04Y$zLWE_N90TKw1_lQ2
z6b1(Ggdhe6NgoErDet5h80vLWL|9fsigpI?S_TI1YS0!a$ruL484lp}0U|7GAkJp+
zp3K1D-7U_*IHMIZsPT*ev;;@8N`z%QCj;a3Q_KvEGeBx~F)(;<0dW>EFn|t@^ah>(
zHDfIUgAWq}gZCeH2F4k?7#Mt185n%(<;58oH$!f^Vt5W7;*p#r!qUshz&H(b7T9Kx
z!Y~E~pCD!i#?8kV7<`Hu7<_U;oJ$N0K9d+2eEL9~dkhRds~H%4ma{W3ZhpnU;B$z9
z!RLT91LNlJ5Vt;e0S#(PE)t32XJDLW&CI~Kg#%>&Wd;VH^B|rG1B1^81_qy3vJ8w{
z6!egEu7OP@JYNG%!U7^bpaIP-A`A?^ybKJ!+#mxu7#MtI85n$}*+B*{F!<^+F!*Z2
zP6%Llp25KMWiw=`5_E+@EdywaFF)w29foHH3``%A7#OG3Oplq*DjV#>!1T$4fpHq>
zj4SZH(3wme;B^ueAUzN*8Bi_97#Xu5Y8ZVP88cYR7&w2x7BnzCYk`{dYWkV^tkRq-
zAl&I9(?85-RpdMZ<=Rb`TEMEn_3Q<dpE2EK0jnY>3zR!)dfoz7#d-yh2N)Qq?}6LM
z!~wd9f}@s!^MnfL3su;Z(DM$kN_ht61jucj49_RPW-^|`Mx{kWSaxtSFwT%<W?)V*
zVPNoeW?=AjWM^Pbuw!8G4PjvL4FYkz7#Mt$85n#M8S0_qzE4+xt~6y}oM8mM&y>*s
zX6@4>42&5Z(1p|t&tZoJGB7aC$d&>P{UB1hZxI87Zvi+bB4+?TP@V=6-ewF8iZeu5
zT0n*Dj1!=(YD?-xSU^`Q&uHKT^&CZ5T0pyC{&OXzq%nxFfXC^Vu`n>`ONg*c0u>$q
zK{J$sUqx8Ji$$Qz1wn0YP#R(cFGZU9&;(M}q+3I>wr@KFgD+?g@BSDOmP`pq=Jwsl
zz~H-9ilLq%<d_Ic7EJUE1B34|x#H4X1`(D*h=mNkuNWA7pMfs1Z4+TBf(rVvGcfr6
zhX$Ui2?OH-H3r6+paaJd=l(LN`as27K#>dIuFarYz`!`ah=FnD9MFk^$QnAJ8n%Em
z!1sMKsP2GjI0F(dgC~F03n2ASG0=9ORjnc{Ua-1$mb4HgB)qIZA;H4HP+B3v5)Sq&
z7sQVd;2QluNNbX%2=ft`*4ZmL!Q~_K5o3^6@DP^>^GR@p$il$Daz}(2G^D}+D#~Z2
zgU7Z+m`_1UJW&S5S-T<SJ@Yw9u=Y#_5#}qP0`Co|ZFn|Tg!v|@ZTN<Tp`KyqW)Wu4
zpcMnCvDsWJ!h8!P1uFM7mxwSwRD%?<AVbe#+Vc=qNPw%DL4^4o*ise-hEu0Sm_Nce
zAX~qK-2h2l%s)V!dQkE@X(Yn@6Xf+O76yh^c@gGcFiuCV2=gD1I<UjV+C-TD!Cco|
zE5ZU^RQVqomg+E>UAIJ7G(a4Xk9KYrVKIeqG?$35Sb%*53J0A)5te!u@c0&}Ib9~g
z!V2R22c=~d28MN0M3~os90F=L&3+8tR3pN?&J@%T;bdS?&J<x@4;q@<4bp5W!n_gO
za0NwWN2&;OFHGm0U`Q%p?gdwMoD2*g@AiT^@KvDj7grHs?gwiHxk*S-gn1Ik!=P|E
z>L$WG1!N8=T#S50n5V%w8S_P$7lM_6*YT~sBEnqE2#P64y|5p;IFL~WRN2n`4at$r
z#hRehz`)>V$iU#IZ31dN*NZS0JA!<~z~C3bz~C2Pl9X7)Ai`V%x^Vmr1A|`+1A||k
zI;i_D!d#-pz`*dIfx&Mz1B2gUb<o0V5#|!`pcVsz-%SPvzl-XiaYPa363Cu527gut
z2EYHHMZudzm`hwituqD&e=P<Ef6xUinoC6LnaiNnxW7LGgTJQ?q-)f>k%3|L6)6UW
zGHns&W=RGHfg}b7|6&FP|6I9(d{825foYq-z~J8lT|T=Xc5EjD1LNEVNb$(r3dt4>
z{%aT*{8xZ3(~O5!pZk9>L@_Wh2s{*F?qp?PoO>8lYO^pf_#a|m@IL_J@G&s>UuIzN
zKMyLkL03GyVqoxp0h=M&-@(8fSH!?L_co{q;ILqT&cN(n0Xk=M`rT!$;`PTwm=mE*
zAQk9w{S4qmb@Pi-85kPlM3@sDK}8~CmPtuIg9vjHn8(22|Br#e{|Bh`!<+(b{RGG{
zFa*d*F)+9=i!i6iLINegkbxmU8`30VPK5?afIkC60I0FV95<bTao$X5NTfkSA|RcC
zAs`u6r>KDE(?N-zfpOjubft9+3;{KuhU&cQ(7X;c1zZtMzqp)LQBMsNR3;1z0lf?i
z0o|aWvSVNfn8UyjFbl--VqgeZ&A<?_lEICEIsW@}g%zxd+6gQS3<0|s7y@>HH1jbq
z1e|1G2sjQ>FU7zRaD#y%;2Jn>&wM#OX9cTlm|7?(U54pF0t-?{Fh@YEgMgO|3;|D}
zp%4iTg+K-dhJb%T3=GWe42<(%Lwyzn4TL~`28KZ1>GxN#it31=%PBH21j@o{Qf8PI
zM+OG9-02D{S!I=Xf?Wf;qJBm-Bj}0|P+{o@v)GD(A<$xa!b(<=`e{(3{bAO6GcW{t
zf&z5GN@##Wr9jzVCq;xA$^{i9JLiZnn}hN^s0do<AOs2lb8AotKuaSFSZM?*T`fR$
zH>k|xS}DS80}7c_pk1{fm$`slCd$CLP!?*bE5tn@A<%AHki}3Tm^+|c&}QG7A0o`W
zpjN{ocBsX?s-Qwc2vS(^g1cRu3=EBaBFuc^3=A7qb22cT0CBjK85kFV7AsANnO?Js
z)mVD72(vKAX&`rk94!p$rh+(0Ceu%?VwI{tE5fV^D%n8eA=)V-%-UcMxVOyk-;9C5
zFGz&x2iPs9EDQ|uABZsh0+*gF3=AIsM3{bqIiSNdtQtg^mO?se44}<9pcKvoKA>r7
z9i%{HS_&R`WMBx4V_*o3PzRY%FT%7`1vJjaz!2EVzz|p~2W|^7EeAWAfgx}!14H0y
zDF%k{H6lzaK!VE{7y=(MFa+L(bo3aFR|hdLu>EFWTryjVfngVu2-6-=6jm`X1pZ)P
z2>b@xX!}!y30&7#F)##iGcW|PN-;2`T8S`S<N+<~0Ey}{Fa)UwF)*+TF)%I$6=id!
zMVPLG#-l;9Aq)&b9&(@=0uiPgFu@iEhM)#$N$3qbN;iOkaWSZ&I9FVR={Bf(JH@~d
zG>d^DXa=;f@}2@YqB@JIjDdlHJ04Plc$+XVF0BI<Yamfph@h7X1Jj#q2FAs6Arhdq
z>Q=DA&?|v~>D5XG#>Kl3lCYDU7`z%F4g1A+ryp3uDy239supy`9_0Q+Mo+jwCm?E<
z$WB|!Dyi=E0HSt@6~bIEm|AZJsM^@+4r^JZlqDD#7nw3JE~y5o1>ae~R0(gbdB=bh
zPp@6eD$N<e!1RKLfpN*s=?mAgigH#!xz{1w3lM)U`7!<OT2^r`&krDt42(<Vr~g~a
zDp$_~<+?I5X0a7BaQz3Lg2Lzp+G1e<bDEb5#LT71Ah&>z;$f;lxTORn3z7j}cL<UJ
zHLYiz6=AC322CtMLfj3y)|in8RFN;6ZURb-^&(6)ppDDR7#M=qGB5-!2Njs}M3}&{
z#~{Ho3=Bc1psAw=k{=j?ZZj|h-GrtNci2h`6$Zv-phcn<i6TspmIebu&?^Rppcl~8
z;l2hG`XF~gLbI5O0p4eEdjJWhWlnH;_*v5o?g~)Jc!Z=8ENt9M7?@sqGB7S{LP%PI
z`j5r%0CJy#u$Tc<21%NUFy(?)B`wQ%0cj62K}PsQ85oxxg_LScpoQSz;XB4<H&BJ3
zr5a2HXrphdh6s}*Xtx?@*Yt8wf!SOu!sKWMI%tEFfuY7^I^zab2}YyoQX5#MxoSk1
zEI`&TPn~YRfmM!s$zu^F9k4*(^o$Lxa!iFUr*~{%m1PW>zH9@lu4mA128N*TQlK-5
zMVK@|1;rZ%hG10&hG0c;2IfRzNCc~ZR;@5Fmy0l|^D{86P-13aP6Qoj>(9Ut><g+d
z6TVKD*~qFWmB_}x5FF3I5F85*jnh3MOuQi5SJX}q-^eOoe_4bPw2p7Zej!j25n;Tq
z0^0oup2QVl1RoLtYSMGh7GVTmwgoC(=U)|Jd<=3J_)av|i6V>}KqjsffCMk&CUAE{
zl!0-@TS!<kZh==CD;ZFQ>Y?EaQv!;yDKkVESAb1SgqpYtX5vcF1#LPhB8<>c8c_zu
zm4Q$bp+YbNp<IxG$^jyblfVW}hg3t1lfd;KS5nIKl1;1<^}UP?48d_CjMZ$>3=9GP
zMHtngO|KeI83|gdJpq)DR{saLeMK164M4RR14D2z14D2w_%t{XMs?7(`2!3L!P6KR
zf+tBaFoc{FVblaq95FBiZ(v{uUdO_~V6sqzQ417!{~=9QhT9()>KOw52Qe^knKCf0
zx(XR*V$_4of-(eyOx!2Wz#IoTQJ<lv0=96d2DYYDMubsMjDc}gA2S1UoIV3X@OcJ?
z;Ikl(H3LKNLk5Q6`_ODz)4{-)Jr}ebj0@y5=*Bm;nmr7Rt5!^(u$fh)zUBf0b4C;c
z<EjIoJcj7A*1Q3YV}OQiIQ}re+JLpN#kDC6jH{PHoes(yf*@yqVqggVAkV-YdkT_h
zYZYKlhwGCNVRRH@U|b!;%)lIbn}H#u9uyV-LA>V-44_k6LIk01uQh<U9aQ0feBj`q
z0v`aX4PjvN{lUPvx)S6-&<XV!jPO#UHUr|L)u4MnL5Cy33~Ye=C<bnlW{nL4lg~s3
z#??oWwpu5^j$mV`iGkd1yZYty(_2`jK{v~#?_*@lVx9<EGZoFiaGF7cQ30BKd|}HN
z!H2D^Sq)7-3Wkv66QaVv5TXE0J_<IVNlONX5PJrO5bHn&#x<)Uq2_x6wD^j>S%guA
zm6?HY%}xe}kO&5bkT6i~s{Y{vgYO@ZKNuL-bb(?FQe$wyZ$<PI0o6Lwd$zJl)VGT;
z3W4&$n&Z&iE(DswUIuFQ99Sd5$O&~eXy^~r>R|vcs9XEO1T-%q!pI3e&V+#>B#VI|
zBn|3pPAjOh+ZY%^ngSUZ*S>%_+vfw=*_k4YJRoPU{mQ@~9<qReA!HuN-5_U6fE>oa
zxHf#c)izcsP8WzT*49ps-Nq`blK_=P9`<Vh)s(QCM;UxupgN9EU$%`^u6_YX2Pg<2
zRSw4`kZREKD<cL5xkQoQAfK;e;suv;zd`F1moY>zFl3$-`3m)S256xK$m8Gvsdalb
z!2bRUTG?vHz!0*Dfgxm_2IwGrk*~H;U!P@Q2svp59<_}F4@G8x4}as-7Wo14HE6^(
z<OKsm$P>`G>@fz0P(}uZ5YW!Q&6gM$LIoKZLP3j%H{XNFKu2sryIVt*q3JZk0p!o=
z3%9e1*4v7_hdQ<gHg*Vh?D|TGW8dpRl2)iW14F1W#If%!A&w0VVqggMgE$uK)*kS6
z?cAG1KEd1?n#;ftnhA4j8v{cq=n@{VTc<HFgifgkNr4;-mV!BU6$3-)3aDdyR)8D}
zYT<#d%w-d7XqeCfDyJeC7>aB}UO*l12y=V@s9fD31#$cfXaWn}!@v-_1LF7>(DW60
zoq-|rvZ?|&_FjPs&}9q^p&u9+Lf=8tlj9c12<`eG({Juzm9BR@1LA|y12juGfp75v
zZB>e3V3_JAatrDh6$Mb7gAO(ZJ0>(89PPKj(axBa4vz3!;0R~T1f>{@)gs%WS|g#G
zLl{?pv~H@=0F8}^YzNgYpmTx3m>3vB|3N&m-2oB{VR8%%VNwu(?1cIw%z}X-%uFGZ
zL1Y(5<P8Hum=6O(n43aoQ6YoKE>JfBB$mg(5SF9Fz>t+CvYUf}f!~2?B8MFV<E9!&
zj*IevwUeTJ7@%F39Fa?`42&CVtr-|MbwUFwssI#442&C1kpc%4TP&pvhKg`AdO+EU
zfpKHxbn9KL()AlanvgVn0FAE;HZ~kDV_>iYmA+6%?0^k!M?u@53<@GwKyG-?%)sQw
z%D@m-$G{L)1L6oWFoaEFU<jK4;>a>Ege_rU2wNn}z~rY1B21x4D(V6QbFK^Mf^cRo
z2hg37j7IR{I`R#~m79bSP6K8C3{bBG=3fq|8uRIryIG|<br_gar!X*Xik@z}n^l_C
z1;m{myPH*_ezpjB{raY9kV0Z9q;!m6U@*-VnFNjUAXsVvcL_J=L6Yty@F7kN3}HJM
z7{WF|VtkS#G{$c+FoazL#qJbX?EYY22>S$yU2yaH4Ff~C6oWNGxCA76r^2Ea>V=>=
z5HD=j1l4bd^ZkNAXWUI;VBG9GU4IX&6kE^@uxI@Duu3rIP0!fFDx<v?lAN=^4rI(q
zFUZVe5XrI!4XH6^G8i#1G#?d-0QHMEf1kd7535YQkw^r1VHgJkXpA=kvYaYEt(ZY1
z3grA#psC@oEh0XkR0-N@y+s$iK2*d<9aQviFfjDL7V!ZM?t$jk&&G-bLwXXr3=Gpc
z<yJ8=FmCB#V_-OXP;LWc;YLPL0fQW5(IIG(yk6Q%ZXdYs&c?vtvRG~($f#4I42)Z9
zv_abl<@Sj&fX>|%&}LvTJ0rKx9LxjHHP3k|Hyz}YEuiHAYBF-*RXE@&;s`ytGO)}u
z9#8=y2Od6u1G28|uv{a|wnYJQO}wCvG*o{Rq>=#TdGlFve$X)if7oVc@J9D-`Wj#p
z{XlyimN77d>oPEetE(|EFgwfnf%KnZU<eOjU<mh7VqoyUDHkHjz%Z?jX(ES0L1He0
z9B2gtXp3Zc9s@&o#tB9ShWaK(NH~KyOXo#_+T*7bG8yE++dn}GWi<ms_+n^}EC6;D
zqW}Zr*2M~-bA{v*!Tw=j2*1R@5Ppu~BqIZJ+9gQt^uGa`_+y_b7sv`tSpgEDZaf3y
z)*H|aH2wHKR=#=*sOUGSC}SoQ{QO&n0BFU#O#~r}Xeb8EK`kjjXMjgAFla25vw?*m
z%+WodQggdBBm`|>A^3%XAv^pXBnWMwK^P&)zz`t_-UcEES>(gO5Mj^25Md1s2!Bu|
z11iT27#O!b;sFiz%DI38f{lS8pk2;YfPrzl&Kj5tRtQ6np7hh0zJEWfLVXUX+sMGU
zodMw`#4ZZ|6AX;oL5D*^4yy;v{4g{yf(!&L4O|8yPBHK?Fm9Iyd33RyJk%OLXoG@L
z0p!sg4<H_u2bCbp7#Jdw85kmBA^sGW*95PZWr%2FV2Ee}r<Li22UsQQBbG2QM9c#v
z09a=*;xPk5#BEImhV)Z%x}YrihJhiHgMlHEO_YIg`z1&&0Ut;D5Y|rj2Q4}Ug$@S;
z<MuBQ73M<VoC6C#P<95XU|?X}AqL4?7D5aRYK#v-gN{2iAet;dr%yeE)e(N+yUQ3D
zcesK34jO(f3{3BCF);2(L4+bA+4$W7B@70}9Zg`>Tz)^G`~}k=wy=xT`>TM?_C{)T
zzkUTfg8bwAPasYPG}f42zl1~|)9Y6<;KLvIzY8<X0C@p4;<?ivd`XHh(=1sAhN;_G
z7#I%q2s6!=U|^VL&ceXpuvVC94k+9}o!RDEVWv6Y@hw&s28QfE(-jV}O4N%BGv%={
zFz##wiwQGTft7QmG6*x(f|)D~3^{eeOuZn^GEkQjWJA3S$OiD}vtFbyQ!v;)kc^iI
z+l~1JloEDH%N1v)GYB(9f!B30Fht5QFhokpWikjeMRPJRaDmQDjI?H8h%}yl@DQtb
z>I4SH{S6F^J3m9h6*kG6cmi~iDYTkQ;$dLiXAe>Ux-Kgd)X@QTewSPpW)cFGeY<9`
zFfc5R6=nkO-v#yRC-?|6ffwY0#!<INOt(GEsuDFzm`Mxla8U-vT^(GY)r7)KI-s1i
z3_P%XbeAxbr7{D<)DPeR1-*B|jIY7Q-)3Q8P`oS5_ze^$prF-G5oQ7n;WGRO1(4>F
z>AMfJO4e@>W;_kr9k7gnaW^Lm14H3<VaBr{E#P46T_DT|UKz5Cfnh%*1H-O=!i-13
z&aq%%I51t9aTiQ4s5m^mPndC+254y}B#s&P$S^SOj)(ND!K>^KOb6MmlOoJ`ke7jR
zcM3y2XwA#iIz9#leZ^=726Z1{#+A_AS_wNu`T{79_Oz%oFl>(yW&|xFQRZi00JZfZ
zlR(GKtQBTl30^(Kz!2HPz!2G{&cHB1LYQ$Scs!edA#x)FL*#1k<d-nxO3<7dD2HBS
zV2HdRRS!;#jH|&8WnhT>&cG1)73yG5DUgH28JK)GLQ+kY0jRj<;t^)t#>&9BN1d60
z$#)+ELlip$Lli446ILF8%qHyt$34daxcC#$Y!U<Go+MD30Jnh|4H)YgGnhCQz-FAP
z7$7&<W-%3mE?NV1VnM@cpiTc43=GEtg&Ajq!ut&a<DTn6#YM>s!i=+}L9H521_n^z
z&o%-DJ|_c%$t+>U*`T?}Q{dz5gc)ap%J@@IkAZff91CQyU|`t6`$?D)G~B}QhJkUf
z?DV@wS>+gKP5*P0RkGgonJ^<{Ck({*X|U18IiUF1`#~LIXQdj*P6mc383u+Z5tEeS
z5(Z($N>FS400Tpm8v{d>ojL<U##v#;O3-ZLDF%k90tSYt4A7SN9%05>Xvjy+W?+b#
zD$2mPcR6?fNjQ$N4w6KmHDlTxP<~=y+zT2A0fh`K*QIlSawBvXUb+ke<Gv<n7ECu_
zVBB{ZJ{lm&z~I&|%$UIlGHCjzW2_n)p!J)e-5+lKpmeG7RhTgwl(kNQ^O7i^Fk>_*
zFYRlZ?sS}0(-b5hhmfDZFU;rzmY)X=WgqY?2!kX8LmH1TqaDbi%hMMeXO)!%Sri!!
z5(gCm;U9%TckMAS?)x+S+HqF-dSPKkIcTzvhaDCQzFcL0gE|9)d9^U3oGd7w85ls#
z_^2)Fpu-1+89^sxf=(ldy2`*1bzYr;0pvnC(8wn!n7=VFM14|aU<fM_W>gSkU@+2V
zn#chSngkgJ=G4capy~Tj$50O%a+uR6%qRhMgfggG2C9Chfa3Z<NoX2_Frx&hTwcbQ
z70AGx3c2);K^dG!nVp3hrC6C6m{U(NFhmP8Fhui$IM)~$qRkl?qIIPim@~>CiAebf
z$W-QV?*C>Cj0ZHC8JIKL85ruLa~T+-v#l7IGiSrqF)=VOhclY<Ff%Y`u3=z^u4iC~
zu4P~dL^A9TXpI+hIyWP`2GpeJi3|+U{m2IW0gZbwrz07(fPo=;9>^Is3=Cy9!Y3IS
z>lqji%!JPSctwKRp<WKcFF`T=h5^(jS7#JH2pX<9uo<)%cA@ZLPyzWLw2E;58sT}+
zFiV0iB4j=R3bP}PK@1F_Ya<V)DHIhm2(JT~1`3|d3=Gk0p=mmK4g=Hkat6lwgRG!J
zfx`q=SR`+ONF0;}i<`p5??A=DeMJuVEJgAcsJJg!y&<eXN#g-^1wqGXgO+H4j_{FY
zU_8<Y3FD*yP;thwPk2E+D+A*pX?6z2BYg}E(U%w)qA$oYFdmr!5?RE+5dDyWA^JXu
zvzCD&`U3+)G^~@K)B>3vICuhTM<!zGAZZO$4s=8#qXB3P0zL+qbOa)Ih!L!>9@LHE
z(1E!+2|ObKmH|uXfx5JeN1?|xChIUjH!gxUi-6*hAwYN`$OrG)85oahFfc^_XJCl_
ztH{83)P#BB69y2&fqCKsFvEv=;t4P#f@va$H0az#`~UwFKYU<F)?wggVBokRYzH#x
zEHeXR#tjCB7=8wZ7+w(P2?IlnA_GGV=m4mU4-5=3rVI=*#vqwL3=A>u3=A=#6B9By
z7#LzA85m;1VV+5jVPN)pHU0c)R>}GYkbqCFVPIuo;CLszhKqsm2&W<g<Bm^IXYKgU
zG?9ayfpI4f14B$P14B$Eh$G3s5VL`SA!dal1LICLkXJyW#taNGj~N(Zpm%;VB)5Q?
zNYJE}q5&%97#I(Oj-UtWU}Vgko_>Z^fHMG8C^9e}o-w`Q467(-0RywQF$3e_L(}J-
zVU?_hmZK>PK!qyQtW+PUmUoPdSu7J@FtC9l(*srjrxt(`8B}BH6cC3&4@5$Io5}*)
zCYuUt_KFDaVFe8`ure^jiZd|8ih?+T3=FZ_8Vn4vnjoGm14FDW14FDeXy^fD{2^6@
zfjRfV^tiLE(p+Nyg)2cB^T^KW&1YHlIr)VnLENL#(|4a`bzodP{m)re3C>nwOR#9_
zblG#PCiPsxHe3v#<<6iJCQn8RLr(o>Ze(O&=-em_X>FM^Fj(FaVq#!qU_3fo2-JNM
zVqy>i7r_+_43P;!j6WDv7#LdS3o)(%SILYFjK@G%OWH^XF|Gs8GO#c(c$W$>t_O3t
zQVSS_7&pi>Fo;aQaE_Iy9;CJ?ObD`X541|i@SPCjCeXTT5T~I{h;cJ`p9sj5av{de
z!l21)X#EYUv0CPXYOKxOLX77@CCf7K%z9pv3Il`YK_N!au)W{`kelvvg0?IOG1g0h
z9M8$XuqZ%?u|d9`fkCt!G`k-m#Ml777lf06Vb63S#s&|N3>V0?P0}DgflrwcVr&LC
zjX@g}mkTk1&+h^)T06Ff1+=C}h_MT@cSw|h@fc`<b91c_V>d(y<V+B^7s3Utg^tb=
z3ShKnWMDk5%vF+<!yv@yC=KF(OcxenbOM#G;FV(0MM8|Of*_xRdJx<~jBWx940<wP
zzvk=MGce4#D#WM`GALuZ)&*9X`c5H669ona(KJX%F??78QUkg}h<CaWBQMf<luEE+
z1MpDc3GP$|hB>!{7<n~7x*4<7L7T;d7<oa%GzS<MVgnf%V!fpxK`96xC}CiTEoWee
z%>`dAA;c&I63jfnzyN9>#Bs`Hq!cj-F@mnQJHgGs5U0w(5U03~k%58P7%C;M$-oGf
zvSnZZZO7+hV8{b4%bhh{=shC?;|V`D1_r%Gp^r*X_KfL5UqAr^+R0(Hdb-|4RymPq
zp(h}v6}+G=_Cilg7#L4fOi#GTD(ac{K<G3`Y8q%yn2`{875#tEJ~Fi@LR&!z_7nr-
ziTw~Ow!^H@Z5P@FV($kv%5(I57#P?(r|-MSDx(_*I;}ICOQ;Lf1USW*#m2xeL0PC@
ziGlHC92)}ztFzDq5Ib3vf$^mIboNWEN{kuPwJx!$GG<H<xWp<dwBU|V4Lc|WGBBPz
z#0Cn->E)MLmFqWaGca)c7OInGfDIzaeh~ttRmO)547v;qhvI~?85tN)G4O)(V73^@
z3^q{fM+kgc#2e7qRi{u9DD)3NBApS`&N>vwV9UU;%|R#x<k>e2jHm1&CWL@D1ap8>
zZHN|VIO7&i0fSJOECYi`CB)!Ja4>^x=NA;x2iZP(y2E8w(fY{{c?+;SXgKVhkR^x>
z8lO7aDdeQUz<6ph#1RajgP8aQK>^uwLzjU;$wWvJWYQIgD<lO#{s37lEy2Jb{1oB~
z6(nCU{3!?N0&S>RUzTkTYG&G>Hs;Aq%4EoPlwn{zZOoI&knIby{tZuVehNdjp8^Bp
zX$xp8CNdh-ipe;h9RL!wWn*Ai7d2h@3aduF$E0>hPGmfLkhiRuVN$y?1LN6)pyOMQ
zOzMzgU_5(_gMmR=e^Q4Q14GMO4hDv8DU&)Z85qxkPAKMXnA8cr+LD8T!SeT{PF1Ly
z?0b_sO+jjS3K%AJb1^Wq#<MXnsD@7J;RLB*V_=wMKdBdVj#|qRHU@?TMU(ot7#La}
zf;OS|PwEG=d2*5&CQV=m4TXZX`$$ik3}Z{4nKT8ggpGkg^5Uc^B2cZ8*CtJogRyT<
znxX+>gLm9bnhMj)d~(t>eg?*~7uXmWd<!QjPls{rK2DkeGqj^|(o8U0l!5U~-Sn8N
ztkU&;JedrWmNJ8!1K!WE{OF`rJW!8?aZXyz1G0>bfx*FM(i(6yfb@cPgHOLRX$xra
z2dIEN1KKxK@oExy2=$EsPf}(H!=yv}AVWcCu*gk1ECe!=0c^u5xk+aQAY4%fQ^vDG
zEDQ_>vL`WuDxMbbxX;-r(6Zs)NsJ1hLLW3vU@~hGxN#3&_q)q+y7o0zO+BMYj80$$
zq6~~@+qp6sCNYA~%XlNem0SSjw8k@l2N2f&ncj4bRh3bD`ig6;YV{W<<w29jIWZ0f
zhT~Hw<!Li8g4u_fCgpiS(?@gdq`XL|FJeO{6@ZrJc7jrStF}D@!{Jh6CM`w=#&dZr
zpiZJOlODJd1XTqY$Bmhc6`)eK3C2vOqM!<gg@IxDWn(6@dVbK^>L7(WDaK4Dg5W^{
zaCzU60a~Ry$C&XuBLm}k22KVBURPtr?<x!o9ecS75-S;u8UILuWVnh`(;18z|0*#s
zo@W){0(Fy(8UKUl?^zfak|!E7F~B%Fp2kd!pnw96kIYUtW@4%b^F$dK&%Fn&Y-~4X
z;u2wCJkP@*0KS6Pm`NN|0={7YJE>EZkAb1%&`U->2FCMT_6!W=*2avhLC$OC0+s*9
zj2k2w7|*wY271;RGwuha5|B+hvyB<SSNVcCAYU952l)b&brnuAFrJ?U^1sUuW5%N(
z*MNqGGL9QFo&bm1^z0j~GE%cZ4Fv-s&<4r#T{a912_nXSK}E#*`_mWRV3n@V{$tF@
z1s<mn;L2q%X5>+1U_5^x?C91rx(p2LRmQj37#J@I^CmMG-<AgzzHAH(JCu#VOH4pj
zOvw#n$O;os3A9kycsa=U3vE2fNf`{rpf=5^#o(hWjIZz{C*?92Zx&}@XfNQ&WH8>&
z$xzS004kWX{}^uvJA#dYp@7%;h!g|k1<=l^o*?7XAa=I^PcDP;PO#h9Kr4=ocY!>7
z3hd6d8+;55ZLS6k4B}$OlNlKpPAz6&ys#7EfT`jjK2LH|8iVl+36MA_?X@j7U|=x(
zX51nQuIL#UFN*Vm-P@u9Qa=6sO;%~9>_5}r++<Y{wPj#9y2&^XYVgH04h9BJqv?vb
zShedHvoSEp-7zkOI>wfP;m{W27*IvBjDhjuQr@J}GzQ}s0Z>Zi01Z+a$AAt9dBan{
zU>wKAz;JvM4`^F}F=$AP;S{LBvy^)>lQJU%<0XD@ewfUp0nQJgODc9wX3_+ui#Oo4
zHItc4B^c@%1noo_7%zgdw@%7rCNowB=;h@XL1_U=2$W8cxS-WgZWfanB|uIEjl5pc
z106&?nNdO&eD;Jp14B4l#yqer1LGyotXBSxjCslo45pxt?efbROXL|CY^HnNW|ggv
z$k+#V7pNXte>r0#C@?^gdg^q>CRvaU@D-X|AI(^1f(-;W_8FIh#+g8UG7eBD__AYY
z0fQOKOhpC;<8;QXRM5$aW-K$cK$Rb3CJO@t`!h3^dEyL=mmNW8f%KTM%$HzbyzIu6
zlUkq0V8*f#<bqRNpzt<hSp=>fLD!$xn6WGd$-DvOm{Salk<p?IjF%0;<3?sI^W+#9
zFMET_Hk}kRmih7wjF$tzNve4%9|J?vB0dHN<0L)?2BYs@3=C`Enz7V?J;2Doc!gUC
z<lY)Z28QXWcUTqb-<Yw~f)+c0a;u@P8A~mAoDu5qMr4OKK^&f(%wWdSkLkD<P{%bw
z90zjmZ>Ufc#DSm!rjWsmrA-~=4zPR8>dm|u7$&|kV=-q0hadyv70}ph{th!1b9GQ0
za569itT1CScK}IqGB9ZPn6X%xf|Ri^Ff{s_u{eQe`&bwlxVy|)oWbsby51Gp^=@F-
zLxa<FCs!sY^aCVp85plz0(D)?SVANi7_VIC0{brvY>p@c<CVQoKe$4?1xb%)EN);g
zO+Rp#RaAPt8Pg0#2F9yy-~?{QG#3<}pmk#_i>H6M%PLY2+D&{_8DbFAJa}5aYKAHV
zH5;aaVG1Jy!)h}=kjeH83=8|y!99wr3&GZ;GrEJV5oKV!S_d{KozVkfH0aiLofL>r
zqE{R=tw8u*ao_{u8)VWigOddV<26&>`~rsb%iv4|+C@As{kjxLn2mwK(?9*DJOe|c
z0#7kR`YkyIh6YgUwzn=Fd`=9gAU$z%`jdOC%JrwyL0vHhu+Yu)7vLZS<t?3*^c#?)
zb3jE{!^H{)hU!VOOq&_a7#P&9$}%kl6};D`fW0Nlv;yX>YlUEM$ug~kd+S;Yst_c^
zpenTEz+;-ldu5rxQ?J*#!E5hinaV)95fmRr5wc7bk_?R3xu<Wu&#GM?E6Y>|%W`7x
zWto~J85lG`$C!i0GL2U=Fcj|vxmbOl83RLymMjx^sPsB$v#j<TS*B=^Ll3YpFo2AW
z1sls%l*}N@6bJS>Xq9XWyDTH9Ma2N!fVK^^29AM&fem~jZ~eok>R{cBs|-MnVql1i
zV_=921MMJtFUz<F>>37!xDEz}xE8sBydnl!#<d``PcbmWEoNYdo3F~i;M69|xQ>f~
z@!?bEi5+aJpfk{A8P{_%FwDQiG?7CtIX8ttmT?12*AWJWxLr~V42Pe{GH$2`omT)d
z>mLI{+#fm6c@?sZ8$cV=PcbmW^D;2RbIX;afwY4Pe~_3Q14FzN=v+@($e}%N7#QL$
z7#QM>z+FUHM(|~AAce6E4Dq4Re!}e!3=A#oK@1E6Tnvo2K&#3ZF~~Ch;04v8{}~wK
zTNoJPLF>jn^<^3Vfy!Wz;A{qlc+hT;utTzp|M@_*Hv>cb1_p+B&?VEUD`lB@K-KP4
z28Q^D3=Hw0HH@D8vP`^C!31Rnh6G6|28KQzStdT1U<?C8LXbEE(}q-VNzPEe1AJ?b
zfQ~E^ix>mr%}!<prVT9&3<*693<+HzPB{ZZ!h8mXgxMg@L<WY0T?`Bf+t?YHHq2vS
zNVvwpkZ?g9F<86f3}~=cz($klfE)wk%@StF&~L&o28M(mNCUPz&VUAN1#IdOBescL
z3=D}J@HNFdL9-+tjEq^}<<{~HOdD1~oV=3*w%BDSsMrHlLk3XS-vGIB4+8_}c-}+_
zkQ+}jFeGX-FeGY%IM)~$5}g<r60I2I85lpLfsCvFz_9ZLY<De)1u~97MHaLOnDJIQ
zGXvv?Vg`o9bOwgRR1l}0fg!Psfg!QPih<elE64<}0Za@G0{*gcpwV$JCI*JYb_RyT
zR%Qlf&|!m#(-;^Mr+_$83=E0O7#I?lK!@jd{$XHd_EMi7@t9RcCWe98e;Whit#u$T
za|FO9VLyCeO1Uw8!edrxl?n#tuE`9Hx6XowOG_DC7?>PV7!6<}kh@$M7+-WuKmV9j
z1$5du*dKQo81Ga{F);M*lV$P*C4njihQ!?r42fGo;R#IwySKpn4`PA!Imj~ki7_zV
zz6%P^76yjIe+&$Xe?Xja1_sdP_at5rXCebbk`4nyk_ISn=P@uOc`z^}If*mW!zTiE
z?*S)=CP;F)eFB;sl5!XrlCqGJ!*1|dcLGg_)R0uez>ri0PYt`@FfhA=Qv+y=1IYEz
z)Uf*tEH&(gUl~#lasC}0kR$gnFeLRbFeG(>9C?y~A!#lHL(*&z=Nbb;(iR4Wq&2W{
z_dPa{IJgsw5eKOppeecv2GHr;h*cMRB0y1s8XXMs4E69EI=8`3v)%?f&6-1&@enTq
z<6Y39ezV>)FeKe%U`V=-bg19953rF`xE>bN8#=drfVmh+1?r)G2nqO!gYt-T5Vylm
zmfa3J6_7)g@hZq!OQGi=CcR)_NP33ktnGVX&VuVfbJlj)X@vC*NJ^00^#Ms7$yv~>
z_<>>jAJ|gm?SH`Okbyx(mhmAg1LHl=s5>YpCVgjMNcsxRiOFmX49P4=IdMC98i>FC
z7a}Vri!(4Ji-K|=9|J?O8UsVJ3Wy`cz>sXlz>sVL&5An&K=ZbsXoqd_0L3@xsAJFx
z)y{U1oW3gnmQ_G3uoFvUnL=3^81GMGW?*toV_-;jXJDvLb_MbL7#Nbn85oj7L7XTC
zhGdX*3W!t0z>r+Zz>r+5$iU=W$2_rvg`I)Pxr>1zxs8D#xy6ow$;}jMV+1UD?}9C6
zaN&Cevao@ffyph1fgyP+14Hs;5T}fRA$d6iL-Nvk5YLT)A$d0gL-JM-Cys$3`3?g^
z@+}Z2i-95eH3LKPOLhh(w<ZRL<X;R7$v>d80J}06m^&UaFy4;@O&d<^U_ma3R=6-Q
zxic|yF~alZt|^dv+%jNSXQdoqWUNmI9|w>II-wRCzPpw%Fu7Vojbs2FQ4J}7KQQdN
z11=)sWf`AyGB7>>-IoH2=oC%{h7@*aM5jnFFr<hfMf9#a;OZkE5zi@_3=Apips3|z
zP-IB4U|>iw1M#F77*aeK7*gC|4tW8J=;>T9S!Fq67#QE>GB7^yoo?`wRf@BPf$?o9
z1LK1N2zLdPJ9~QKD^~I8y)Rk0UG{+Pt7Tw(0J_<i5x$#h+a0Ju*FXuVk^xd6fD@1g
zET?YwfU5a5?G>vuXAZ>hhjJjEQVYb`hvuLF;;Mx&wA{W1qUmAublX>~Qe4|VK()1j
z+@!?m04nks7$0t*-t&r8gH;5?1u+%sVTZgt{0bgJ&;V^vta6nFPsCs6W@KP|1lmGl
z6d}u4>jY|dah2p2Fvx=D4;Zg=b3s~6pkoFYV5<pCcQP<kxq_y(%MQpgmVjnj9)UJ=
zf{Z9J1{ndeA|XPSF$8qPEyRxboD2+N?`0W7R6&hOAxQHr1au`OXiNm8H4NNllmTxf
z2JOmVNQeN<Qg;T)GFm`qTsxps<&YB#p46*D%(MWT$-s~j%fOHlZUQme0&F$|Lw!mU
z14BxU9O!~ISw<^p(=TN?14GI}Xgdvj?9nL(h7=G69Uuuh;t<qM>kL9FDLZRmMN(%C
zIKMM6@W?W{@-i?!24yTz0iN=dfg$BFQc2la!%z=dDa8QSgjQ5`*1*yQk_wcP5+M#R
zDWN&E6MShh1LNa!;MBtS1#XlNB(*&L$mq(L1z$A>T96Ol+t*nFNkLDLRuO`i?lK~j
zKokBGo9R+-S>-j3KumoC-Wvv9(E`rh8H^6Frbp)!kfGBP-?EC=bI3Akf_qeq42)0a
zfd(dI88yK-WPv&Z%N=DILD?PF8JIl-5~z&eBd4EjG06v|LI!p4Kn6p~Zw7`G(A`tz
z9kPrJps0Prz>uoVz>q2nX@G+lI)TJ;7#LDPYfWa<GsrS>h%qoI2Qx6FPGVq41+}UL
z9?LR<4%P>)`ApMdU`W#dt@-JdW#j@+zA-SQc`-1gSp+dK@P;!mKD{r+z%VmjmQeuI
z5MRc?khYhBA#J-j1G8rpq)?u-0OSYWELlb&UIxaeN0=FyJ=+-=(rz&@Xr|o&@g_4c
zq`hQdNP7<A%x7Ro`_I6T_7_?N&DjE4ayNbcJ66T|Iae4MpMegrV4i3Io^LgTZ}XW0
zJ%ooLf`RcFs2>1wlN8iV>B0;Q>HP9YZi4Snngd&usUXWJ&&$C0tPbReb_RxYeFlbf
z&|(bF$qWqXu?!69(NZ9(`3wx{IiQQSVD6g$c3<RsRwdRPkn^TDyk`}ypM3|!29<E2
z1Or*>77n`VMfNQ?!XaTZs{k6KDxjgE7y25Y7=5b`iO}>G28Q$+H3o+A4%xThi?$gU
z(l;<Lq_5IsU=Y|N`yN~xFfgQFW?)D^uK+HFK1wh!Xaq1Y)Th5=U`T(Z0P0?T0%hno
z3=A2Z3=A2ppwplKGB7?5(*zx{BKsbc+RidCWGFH)WXLi|GcbOTg}QA6Xek6Quk06A
z2F4fspvpyyfg!_&fg!^J#4%%F$cSWM$Or~;92pogDj66uO4%70Klm~*#AeK7V91yZ
z;(^p`XJE+Kic}-b+Q7iZz`$!Ks{!i-WE^8)$N;4cP$wYcDg#5tWoU(z@sxof<1sX}
zXKevjNFP41%CH823vj`Ytm5^*WUoO-=wEbz1}0>$>4L(L4IECl!QsRM4xhW=@ByFT
zD+?aieZvC^qNm^>f($*#-i8KAI0M79)3O<$o&dBrJ`H+Z7BhIS-P=$#u=yFf_23en
zA>#)FL&g_Kgk@NPW&#)(Kxb=a3aK$L=$Xl8fETJWFl3rAFk~92fqUMW@}Pk~28PT4
z28K)@H3o(vCfQ8TL6oN$7%~eO7&5aIz{PSl$b}%W`3wx16E#6cKFel9yW^Slw;32R
zuWB+d*l5XurUOCipRyPk7&8BBf-XRm%?2G_eu{x1ONfCXOF)x>L1nvaHt56)keChw
zLzV{U;A9cmY*48I5_4l<$a2yIR~<RfL4~Yb28OI`NGi((i3Kn)WYsb-WK}Dq)n^tn
z$mW3ry%`v?`WP6px->z@mCELW#6X5EXJE)$ssOHb3ZOp8+QGn(wM7ARO1W%1OzbiP
zL)Lj{1qYfgoOT-NK=N5Su<B(NcyB2KsCt<p$iP_tY5}w%p7oA_A?poN^)gEb))0s5
zL91P6>A<Q4Bo!#N3ql;dc9~uQF7BBbUmczv_=Q!HYx*2e;m*ML>KT;32f}~NKmE;T
zR(a*=7a)z7*BapJ2+??%{sU|h<7;n_Mk!7OsJ=Wfx4r->3*8?GZ!;k(q8U@5IzZ(k
z_UdfL2B<05LFE#1<pi(JW?X?P`HiAvI^S1TUalEmAXdDQpU(J|Rhm-(qV|mw$c>U*
zGYz29sZc(&hJDjHJsYIF1gd=P^nMT*8d7gAg1HJC7?`GiVqkpp0<^{nzJYG$1&En%
zg{Hsz%BoO5^9{t1x8TKIs9t~-5j-F*D9&fhVDw-B?U7h@To!g@Nyi3A(aQk7W#U~f
z=(5fCvWZ5Zwig3KHUk4g)*lUUf=vW38f9R}mS(7D$QIWCEi8~t1fBSDih&{9f`K91
zNCTWl6a63y<g=qe+XFNi7$%&SO@^lI><R{k>>_Cf#`g)3;<W=@ymF_@CW|mIzLR8T
zV0>T5z>vL(fgyVXh*QhJkbQ)KA^Q+J1LONn28Qgb3=G*x7eP0Fyq^X)f|G%PyGk~N
z6{KS^14H&-28QgPAkKOQh8!sdh8)m!pzn7xFyw?VFysV5gQx>`A0P8##&ibo6}`#H
zveBTD?$q?adu+n>jPDa50TOKh36Pu&28NszNPt9x%C=Js3^~mV3_0~0;P8kB-OLIS
zTfo4OGYjH(*u`NvM;RD$_9OY-ZUv}nVYQQu6=7g}uLyE)Ap=9se+Gse(5)r!YwH;p
zas?R}a`~a2&sAbz$dv>8{RG7Cb}K;BoveYfaiEjk-rr<k$n|1i$aMpm^^}1jH=ThY
zHxau2%I*vUb8;;MXjjnsR$1_xchIh&_tSX6@f!@9zyKWtty(A>3@&=v<iK$k3W+--
z1_ot0SwB!C{ypftbg}o-=l)<-sn?YSj}n26`osY)EIq-Y1zvh0>j?=ZBL;?<VzTxi
z-5(@)(?BJqy%7WB2MG?)G4itZpasCoK!e6A8;uwkq*G;;z)I5~N|nq&O2Ji{vN5Pi
z;{Z1Yl&!%>5%T0DB{ImWf}9DOWOr|nRRaz3Re{!LT78z40h`nVF-gW4WD*AhgL{Ll
z49L<d(2cYQR|~FW1l2&0P%Q_o1PA4d1EBWE$71l#F~OB;plwqO47tl07;@*UfhGk7
zSL%ayA)R7i$i2wGkb6=AbX<xcc+MXr_ML$t_cNpzX9V?y4z6~FS^&FRM}~p%qopPT
zgLaDGCQvKw6azyZXt@vUu95O5pnV#QjG1f`d8V*{rb3_%`tk&j1Owy8`d~)JOcszV
ztYuw(fPuM25ws4^1k{W-a$#V4)e7oX`!F!9Su8k}k%55`y5_bVb}~>4$fKXcAs(Fy
zKKg}$Ay1isAx|3O(W#&n^B~uGGBD)1Li{;HfPsOrzKnq(FOz{GFA?fd(AxMli=ob}
zfNom)_#Lznd@*At%#jrVD2_CQJ2HcTK|EWq2ilLTfUPzL-;n+(6XL)gP(5wOz>qhe
zfx#|sCNw)&EI={R1a71O1H%Cq!3IzS+c7YHy1<*6Qp_OOU<6`Mulmg@Q@<WGcatL6
z44*LhbPz=Z(j<b(gOaJ>Dt88k?pDEkXoKrB7sS+jLy)Q9eRhHc;Q13?(6&^;0#i`(
z0;RR^#e%6|r$CZ|(hN`<1|>EVP#k=o1zJzlY%7=wnon59n56*P<0_ag0ZDs#`xzMW
zc7skl5@ulhoC|Ke3T8l@&5(DMfg$fQ=pamHWd_F2-DtA!7#Q+ifmf60q`>tUFfd5n
zlo5;syNH4D3nK^U!WF?t&{~FN91IK#rcU4RhgH1(0VF(PAXbSoFn$IdwyKjN2o-^b
z5R?a6{~T2#C<=|mJ<!d!OyK<*-+n1EFzkyHl#pOx{Pv4!B8MjE6fi+4=pkVFybKKa
z%$lH+e*~pLdHM|lLw>z814F)}0_e0oLGV>~Ai*dGhWsE<3rkNBeEBj+tc!smzebaR
z!JAu9Mgh|H%s<7zkPn)B%l;!M18Um6fu>YYmW-+aO|VR5VEncPywg`u9+VA1CVgaJ
z$bSox+{(cCt-e?Rv|(6KNdXcM1)y{2*)$m#4zmjCf>yY^VPGhbVPGf_(*&K0C#VNg
zXU)J+V9v(C&~{kR4x|orPm!6Opd*;gz)%p(z)%pVP{tq#y1Wf^kz_#<14BUqw4B&?
z1e7os7#Qju7#P1cX)-Vv{1o&ArHm>DhJrE%hJq4k;@@`#v@H%)-Ghgc7(E#nq(NtK
zK@!>C51`Jcz(qj~UIxamp#BBubgqI{28M!WW(MX2J_d$@X$%Ynlc1+_6|7}oC|C_^
z5boW<P!B!^?du(o1&Fofdmn(hAq<S)z<co;!DCnr4B#;=1DNK0K9GXyn;b|l*l|n^
z@WHBm1yEVgFdq|GmeB&PwFl%U2F7oZjMJU|vx+FM0P*3*FxtV5+3Nv1Y=?pI+sx^e
z|5;^OML^u?6Vus5xEc1`fI9NV^j-g1rRw*50i6qhw0SKRv;ZBnX%aO4C1}UM_?-(p
z{smse@3~5#37U!vU`-|P-I?Ease#rk2s8;WFw{P0U?@1iz)%1Z>yi;@l7h5=3LY~s
z6x>x~V3_}1ph*q1Se1c6t&oj@p^%{<xuk+Ypq-C_p{|!{A_ug%ER<kiu3E>y_<iPd
z-wA9o^@RqYUNxwVJW&DE(+4+bGZ<aKTMx>k1;Rlyz(3S@!G?tkGcf)D)qL*11;Uj;
zuHpc#h7<?~7u}$v?`H`>7BKRF4*C}WZ(ap0P?Xsy0NTsOaEhm#K_G^cf$@hn4`^sl
zV7dq+n@GJiI5hl04ab>L0#eY>P=uyTMsR5SlGi9_5RejtToYEP!@y9ek`8ti=<4(z
zYK)l*nG6EpoO_Cap)i4gp)g1xkwE~w!wn>|m4TsftwIumfGlWz97yCb14H3;g=B_$
z0a;L%JjK9JB+I~1B&?9aARr4`CI=GnV_+z9Q%GeHkcDQbq8bK<q5_391_4>njvJ7g
zEes4rs}#T<k^_||AhCZ83`IW_GE*uT1i<_1PBAbPdonN-+k?VwkAR{W1H;mJkm2e2
z4@^}G(hSULUXZ+`XaQ=qF+CR05@2Bb*}}}goEF8vP+ZBtP+Sh;q%klQ&t_mKp2^O@
zoL0oZPz;(6UkT#WF)$QgWMC*h3(A^s<92|J`z+wZ&%pQ-)Y}IcS0c#3P{I#3uAYIR
zM1g^!L=I#`5d%Ys0Ruyc9*9%Nz)<4Nz)<4IV1?woC!kSoW@Z6T&`uk$S)B|FCGB9d
z7#K=sFff!%1L+1CwSs}6WEqG9GHN#iL&;9?(jCWh{G1%H@tNr=%xpqzow*E5{JPU^
znAwyVb*INOvnl6p<>&aqXvV;x{gI#J94I0F0v(j;nZVC+0Tj%jHA>x&`8h5MF)-An
zfd+b$<@q@#fQ@BjVEi4y!oV;~o}Xh9xUI$l>d*6YOai5~Di#I?J7a#1X<!-9T7{L$
z)88|*iPcN|=jYf6YM+CYq(<>`fE!Jq)s(;8Sr`~>7xQz>2Q3u<Nvka3=U5=gz#v)<
zUc@ntm7ik^D3O3x=$SDvEa2q_T}{cr_<J)80|Q7FvbdaufuUsrKZlbrR0iY)XRsGQ
zXL)8z^K*c&z<tA&$-vLy0xF6@9*y+j=K!s5V0Z&6L_k~Sejf&T#efYo`pveApB=mi
z@Ar33PzQ>i{V!-`0O)|%mI?gqe^o#S>VXVo{|^p1P++OA<7a;a3#>n&6a2EJ^Z41H
zfE92Rq%rWbKLsU=(<}@OR^t5Z&%hEOoi+LV>}TLQvp5+Tx*zkipHTos11AH6Bs)Jl
zXrUj&8}PbCe)e;4ojjNM+1JB$Zk%4o$|lDsHGKjro0NhCKl?<O)L+o`_WS+$*(ZYT
z8L9#sI{g$Yn;N6k^p7CLUHt4xaK%1Q7bGEEFkPFCO-h%CpWPm=3N-Am{*s>^bQLiJ
zC}cqHv<Gd=28FMc`1B$+Hr4uRH~85l;d(xEGB7Mq;%AoxIRm6;1_wX8BxsX2hyyY}
z3M>N+B5?5o^EJ5Sc>@YBkDdJN{4g{Bf%a)TdGNFIgHH|wdySu+A2iVNhO2107&{xk
zURgIk+XuJ?(2Pfj7eCtv@P#v+3=B>l{A{30g`mEe9?Z_BrjW$Xb`!4U7$*ZmS3N)5
zO;8enICc6=b~ZIep6LhJ*<|ZI)xmMfc3K*gFc=t0t}rl^oKa<92r=YmJFCjTP+AUJ
zqXN2~jGqk}eGDbv85l~wLYo5`cNmz2UxLOEOhFBAE=EC6tqj_3oX%*^zyO+!_T*<P
zgOufrbHM947#O%Z80RoBvDSn3^3TiUXDd@@V7M&Cz);G=z);E}&cK`mnPCKJU}j*D
zh~{UjW@TXfznPhVImwBEq11$dq0|V(@nc{pb!K2Fbz}e?x1YxWE;<?KmVlZe5_$Y=
zEqw9}Oq^FC!t-D^>@m&*AEgfJQVH<0P1OXIjLZy7oX;5;N`n~~N&^|h8JIY?LUo0J
z4Xfj4o2Jab!~ohF#Ce>7p)`qsp)>)ckR7rYjB#ELSm8u|wkf;}ObmaS8JO5585l}S
z85m0QK^!#(hSI4F45bs<8JO6O85q(^w=po3t^x7v85l}mF))-q0dag77|OU97|Pf{
zoJa<SGGzvaGDQ$4je()e7<6#}h*QkKQ0B_OQ0Cam$iT$j0CDYt1*}kp0|OKL3<f5K
zyVDPFvPrSd0oCx+?{l(=*F%G2p#yY$k8vSvG+%(9ZMG=`6QdC{G|Czo7|QBFv&^v2
zSQr4;1l?@NAi&Qy2c#(-r0F;VL)iodhO$0T$gp)l+_EqM95QS9*=F-HFeNemVrF1s
zo5jFTwv>UPY%YkioPnY20s}+Y8FmIHwk-?{Wp5c6%AU(IFtHt|V_;%C3lhG{z)&v5
zz);So$iT$*2)s#+iS0cDLwOYgLwN-xK{77lU|`JUo_?K+O|~8~Bf_`{5-&&j*%pW*
zrG`ZvFrO>}Zy^Pp-^<Uo#EgN7$sOdA=L`(xoeT`+?I54PyuWA$*e6%{*_MJ77Jw8U
zXJ9Cw!N5>H4Wy7w0OI9E8yG-4pd?=Kvn>&2U}Aa)@}&|3L-|SuhVrE#jy?lJ`4I+&
z@&h2h*)TAaKW1PkzYXGeFfdf`GcZ(egE*lK3>8`o3>6xnSY}Itn7-r-)VoX8fMS`E
z5j>rZ<hi9f42<;<wM#)|3aAk!z|Xcyoq>s28RY2a3=9=k3=9<(AV<S|x6}sYJ4r@<
zw$+LZOw2wYg~u5fDm)n&D%?Q|S?@v3v|(UjV2~8%XIsU~z{K3o%)rF@fq|hSih-db
z48-}%z)%5N=~K}J85Ck%rUPp4BB!Kf9<cCV23xT!z|XcplYxo(2+ZO+3=9>sK$=)r
zLM&bu0oMduav;LbwqBHhiG>Yh?`{T$iq#AZ6)Tw;nCe+UZa>7pP;mg{c33H}tO4vv
zHGa0O#tcj>`XIYNp>dIcq2fG9A*&74F7V{PqzymYR&E9+mIEO3{TLW39x*V0ul#0>
zW?-oJ&%jXe8zhs#z)&g9z)%U=NXS~sz)-1O&%jWr36g4JV5qcWV5qcEWME?Lha_Cq
zISdSy-V6+tp3s<FE&_?kEGBU2$uv;|6sv{|pradM#o=-j=z<Hz<)C9bL6IuL&$gEn
zR1!KdFjPh{FjPi>IDQNam6;&>)AbOA>2ebW7KqOfx=pniVd^Ux7%D*xOHct@*~!3A
z+0FnyNW<tTKO4A`J;lht#JZ9bG>^j120HdY2y{PDhBZH1GH4UiDNto2!_Sri<J33Q
z^0TGFcxB1_Y-yk?>|V1lFvu?FXUh;`U?@%jt;pnO1K$#L3RFot@8M?y4H7VbZMz~=
zlF7i&7AeBO#Ck=jBp<|9W?*8y2^tzHI>N`mP^_rJz_4^JKbsGz)&pr`;}*(D1nH{x
zQD9(V;|49Y{LatjqshP^qy*NtUxk4|`wu^x3S0|lx~DIRpG`%bfr$;wsp4l-v0`9i
zD}Xo<e4`m?T|jd!KbtzJAp_bY3G#-9Far}?DQE@F1%5Usu=!?u3=BoqeDxszbucn8
z*t+tw$%5?y-HNh^pY=7E!^ptI_7@ar7W}NQK^B8K9{jAYZ5Wu?nZOpaz6IHJimRk3
zgMpv*oeTqG9y8P~VXl(IbOwG_P*aZq<QnV!{A}Pma85xQT+?6ivx(K8<!9XhvyQ!!
zlYv1SBx1_I1m-v-^RsT$WME?NgIEXJ@yP)4r)&d1>lO(HCiclJ3=9QR`B}FLGB6ax
zvoJ6iYVoszZ$1JmTh7nA9UKBI3=9pm{H!~`?u9s!^&tZ&5DKC|-TpfuBF&M3!Quly
zD`+zX1N02YQs^Kk;{s5lfOD%lIC-#6mIs9^14HFJ28POM>I@8A+5D`NjX;iIV5mIB
zz)*PvbOeDgKkH;r?FABe%fL|iT%CbIRf?Z=3V5?A14Dfk9|J=bmpTJOi3~sM6wuj8
zZx|S=bQl<_)QWOa8TeU2XDin_Gfm`>VqjqN;%5al5J9J{RQWS7RC&vR8$Ybz^O->!
zGZ`4F(xIa!Wm`Zw5S&YxI2J-xE(UcXK`JX47^=#+>%lpWq3j3)lfVqnkOC-oXM%dx
z;tWjEry;VX;8O%R@9?wE7h_=J_{Pk@Bz>2Gp{kvMp{f<cdC9;~HHU$rY8s@lU?>v-
z)#hO11VEEh#h?{{Xoi+4fXX>T&Nuw5%UKziIK4pzflS@az)-al!~vOlfq|jw6wFi;
zkg3ykh1jGy*MN&_CeFg?fkJFD^`$2mm=|ndVB(w#wiI+U2qS1eKQk9&0c@zXtb~C{
z{wYG<1=JKQRsa_w6O8#;dqqJ*lc3`EDktcsB7W9h18}=f1vGcf&)NZ({|c4w&<D$#
zGt@K8T+PoK!pOkHB>_p?tl*J^H_(Ju4cg+8Xv5Fy3Q_{vlE`Vq&+4iO8k_*-Fd2SU
zSMXE==;ot?{H(s<>rFwL`dax}%|Mz!J0`>%_*u=s-FfgOCj6|R3)pL)gLV^j$?&t9
zfe#*o8UY$*6D<cBF>4h+s}#rx&=yya5uo7-22gPba)gu$k|U(RLnKfWlpu~UXJBv$
z;b-M!WMJZEgWAgp8sduwAL+r*%Bcogi4DqatReiYe3A?dHEs+Q3=C7n_*p)JI>zd^
z_*rf;g7iB;0*3{>^dA~HEU#D?7<wP^v)t!kU{J3Exj0aUpJh8peKb`49#F1*!vHF*
zW^?khtOgYrZ&Vl<di42OY8gQ@R&PMcCqk7sf|WzUo@Ftp*w*FcXMx-{3sScest&SC
z1FEhRq;7W~KZ_~Ybdb8I(+`NS$qH<I&Cenaaz76r3j+gd$n>`&Y*O_M{4AhTikNsD
zRT&ug_VKfbfVSzKg$$N_V5$OjRi#hzvxtHma|*ODYwIh17IsKigP{bvc7Or2lAnp^
ziaG-WNHII8BYld2q3SaOL)BZ*)lmoeS=hC}y?2IcAqIwOJ~_|<NBk`HphY>Lnf+>Q
z28L=)NUNHml!1ZS`!NF(&koRF8PYsMsR{!V&lT|D1Uyqf>k=7F!8cb)NbobigSx30
z+Wi4vroqJ5p$;xGncsoNk54f$RNFByR9mPsFc?hdXMR@?PAUux)yWJD)v=ILjrl!j
zZ+JNaLv<GeLpA6yy4B10ncsstq9Fad85pWJLrO|!P{$B7Tv+{vfuZ^dq@-m20BSXy
zVqmC|Wnicg1s8wJU!@orkcvO%pP=9bEnlf|XJDvthLmc|f1si@2@DK1G5w67K^jQe
zReS){d*VF9&-{rC8b~EFkivrZ8K^J-&l)2N3z!-g1|~@_1|~ki>2Ji?l=M<S<s$<V
zpC&{L>|lqI8U`l54w#-TP(3lzZN%AR*h(&d3Y_V2;%v$~%lMg3LxVXFHkSk1SI@++
z3)P)>hk;4_9Rm~J<>_n1*_7(@zA!L@j#J|M1h$gfg@K8G9pdbed=7{-zaUte5he{S
zEAwSQ(qJhbm=rkw@W0?^J_=6ZDhv$0XZe|DgE^oO0~Im7kNBBq%P}wrDJZcpFi36Y
zXP&Fcz)-HtRa9KSz|Xv1nt`GCI|~EDE~)8x65!zw=4!YBA2=BpPWkXNSIdCLeZfOK
z(^p7<heOUwut~Wq^E1c66bl3jfi|u2GslU78a|-Ss>%G!ao{8Mpq3@bGcc5GWMN>~
zbC;hv6~u{#*lZxlCMB%S&+Gy>40KW$OWO2UNjAxPDSqZaP;!7aGnj)woHw8qbo2M{
zGh2Z5K+=YF0;Gau)B#oPf{RT+6)v-d5(AUqVg`nqCI*I@5_NE`%WR<qnMA2M&%jV~
zSe}7N2+~VsuwKIejaO^P{bC^u3>WyBZ3GyY1gBavFbO?pW?&Nf%)kIThOL%Wk%38=
zfoUQKh~{OQs0E^>Kqs59GcXCOGceSuGBDICLX(6IxEf_(63m?LDa9tsY6I>&W=pZj
z!ww;_X<=XzTmfp;)jB&eFqDY#GmC-71)(dHtUzNipwqxzKpqs@5AmRwKE#8y_6!WQ
zmQW9hL6?-(W-&0-CP^_c2paG+OUQt_t_%#dvltj^CxABx@iVJ(FfbVi?FWs#loX{h
z@H4B)GB62UU|^^_!@y8?qzIBybipZwd15!SDmb-RO0!9e*ZpQ-sQV7}oz)&tb<V&f
zG<kZqG@A;W)fce$rb@G^8(v5RolVc!1oByVg$e`1vUB{*OyH<vWMC3D6#~Z;lM2Wq
zoS+z*{#Kez4HWgfpxA~*Js*hk1~l}jP{hyl0aS(y$ARu^O66w)t%H*iV_{(6+04%b
zYNV>&0@VOKi}{&O!7W-0l|Q4xz)-pYQf)Au1)B;r<`QTa>LqB<lIaHcm~`-18p{`c
zCh);;pn6I8B_ydc?NS15hy^G0>3d|@)an!YnU;a=f}}@v*ohmUlUkWX4w!)Mz2Ij8
z9a9b}>FY%q80z`e85r75@iQ$09rb#OfuY`lfuY{W1RUs0%bXaPL=G@8)W<R~)Q77x
zF!1K{GcEH5<wgbuP=B|+4wSzB^E0iGW?(4c>|~nAp~}FpLvVVQESr>Y{Yuca)X)+{
zBLW;9(`DJzh1>a=W`UCxBLkBNDBxzvProS3CRMM*&lCgp03!pF=p9b*NH$XpDAj@5
z1M3&^GsP(}FjQ6;GB9jf#>UT-#lyfP8qUwaV7{5334D;)GSF6Yo45Q-IUozFm_WPR
zOZk~{c^DYvB$*kwN(zb@_?hz9LFR))8FHuvXk)N4zcCYN0+OK$G*B+a&r}E=D2EK8
zGZhMfZkK=*B}@~*sS#3o%#~x4st@F6DhG{%gU|3wGT~>c0@b`#3=9l{3{0YO3{0YL
zK!cJ7%%F0Ee-1yBCD@ygc#?-56bzcjWfJ?5%D}+CjGxI8RBkGPH}NJL@-tZ)feJRp
zOu6FJ90q<SM+F8Zu^$W!^~V?(>gx}IS5oscIf3^NGBDKNV_>Mi13LbMX|EIm11LaT
z!2!a+Q2&X6q5h2&1A|2vKa(4HV?F~zg8&0V1D_NFLq{M#lNYE>zl?#QL5YE(K~9Q+
zVWl!ZlQ&d*g9QUagPB|=13!~LC`fKGFf@2`GB7l_1~M?oPo2I`o=vPCq&b^`p&^}}
zfk}Q714BbQ149F7{E?4=q4GAUiO9*%BnA!wMg}HvP#)@7%FiUh0pf6#6s0rpGfAp2
zFp1|u^9W>&8B}&(<!1u*!@<3_=30IxNLLj)^?V*wuy8WegQB7eq#YdS;3E$!l~foQ
zR{!8<{0q1C9VY{WQUyOFc-8>afL-Rt&-fR74k@Uz`NPln7gUO!5(4K2#(z4X+yKgM
z`TUIkOhLH->QvBWsTH8(A9o1yGjVb<OuwYSCdz0#{e=RXY`vE{1B1LAKjR%xOS_7J
zp<x{ZL&Gw428JUH{ET-%71SvPh6YeDf?91dvHXm8L9Twoz|ioQfuZ5MIs-#YAwMH%
zzLQ}Y14E+{14E;XIs?P5pZtt>ofsI>-53}e-5D4f9Tzk5@H5_LWnhw6#LvK>*u>BH
zK%SwVq4*FePk_vL2##1ThN7a>LI!@uM|=!S5>=quLY0Amzm=cy1E|S757IZBl+Dlh
zQ3m8=28PBW28PBoRR#v5kNk|F{K{~OdEylYNMnf+)O`W<AR9rhTf_=U)0#El>0u_x
zdPPvH0n!Zwb)lFz;A_=2=YWa?kTkf_1ab(d4+T=24l<tslv(l@@H2u=0){P9FNBVs
zF@ct;GfAHY*FlUYG(bf+14H9628PC6kVYZn2{Q(U+WO}V3{9XbmOv-oAD+q2cmgyS
zeu{yiDVTww$yJ?!LHR#F<4I5%^M-+;X%+)RQ=dEolk|6pKZ;mj^>Gmkq;_Wz;b%N6
zz`!JBz|6n|N|#O77#NzafH<NI3{6iN7@8h~I7$o*O<x%p_?tdMOTZ!#2FCAP(*=~-
zMC$_?m}Cr~Hh?>>obmjO=LJCeoER9IL8s*~fjE8)49(gM49%c{HJNAzhGrWEhGr{}
zOa=o(Gf38poq<WFl!2i+hk>Cv4a8|;U})}TU})|Harzk;nwKyzG%o^i<}ffc?_pqQ
z-c%3btz=+m{=~r0{079?#=y`b%D~XVFU!CrbGVp+N#+~_17|r%>O2EOix~q$ixG%(
zhk>ERkAb1Z2gG^Fz|c~~z|c}6&cGxOJ)p1%yt$5ZDnDbdC<BwU2{Qwe{5b}OmbnZJ
zEi*yI!7T=cmh9aO3@w`(0vVX(zCc2u7&Iltz`2{BaRDbt3ljrF%OeJcmU|!$KLbO{
zZw7{z?;ws014FAA14FA2h@;8C(5lbC(5ekG*^Ggq)sKOp)dhO3M{xoJll0o@eJX4+
ztdN!6>s8o9>qGe&55UR*>F?mGpYebpDE)9UFnF%wXFOmJ>cfI+Z-Zif#vL%VG6oQ}
zJG7u`xw82gcglg(axyT0lGaYp*fV%sPwpi@V<}wYH;Bekutv}UMj)MK$U4iwIzhK1
z{^w^b1K&r+1uo|qtHI?w3#hoBUZct;SwE4Vu@+p)gOBFrX9OSR4XPfCR`D~|gQjUu
zag{OfGp<u$V3PR;n&!26%g@*dF1}e97?zynXY2))18=~prYbWq$@~T%eo!?XG<Fp0
z$iT3ylAloq?0QJ#^gt^p#wUz(>KT~i9=~E_?B!=vWMyEI^>F|lyu#0@q{+ZgUB}>1
zkeI^2&#24;QYOQo$^aUkVpL&gV3Jh^HSr*x(gk~pfuZ#*14HX^NL|FJ2lf>ML+d*R
zhSpb*3XM?@as(Vh8#@C-8#CyR;_N^Cj0T`4(<ugqHf08eHd!gqN(6pJ1F+v27}`7;
z7~1Tm7#LP9=4S-$ivkr+ZIuiRZKYBS45eE9;Pb^n8&KLNGBC9DgFA+dao~<2^Tesl
zK@1Gs#~7I8svs37qY*gh7#P~tGcdHR&Xa<Kp)EKJ85r75Ffg<ogW3i@aQh7dL)!-i
zhPHR03K5zs`oPJX`vE_rEoj6Xlq1@C85r6*LFx7u14Fwe14FwaeBn*60HjMPH*b1_
zI-68|?+qybFsL6saVj%t86v1OMIMmqV*vFJK{76&VidG9B%P@kv;qy(asg#ENGrGi
z)POaU<7edNWn^HI2hGo$Z{}y@2KCFAfksT<@H287!;<w}enxIn(0TZv3UdB;enxI@
zP&)+Fc4Fk^V_;waH*;&;`N5lsM9V=&g2uO3Do^**V3V-2=KlgpNy|Xupz}{wD)WB<
zEs3q-$z<UF1~EX3fx*O_{{={06-eD)4p573`T`9$(fU)D`0s!uKrLVSr(g;GJD?p0
z%RmO)gBTFbz@RF`UjSAINwSt8-+&5i(0S8L3J=skcVF`ts4*}pJYZmG_hVpa_fP}1
z^!W=6AziWdLI#F*(7pv#DgHuP$iQp+jCux!_DO0C3=!4*g`hZm!@$tKhk>Den<nT$
zGyY0wLTta!z|amllHA{hzZxpm!N$PQ!KBH+kUWvU37WP$Oc)qCj1)>3_*-Ndm=vBe
zFm$*wFmyOVYfZ};kUosU5zzGVV#X}+amD5EEuNMaK=L5Di5zU8NCxe|2Ibm|d<+cL
zl3EN5mc0By;9y{6U{VC#$TKsPKST+{2K9Y%{j?YuG&J~~;YzgG7#NN{;CBTn(FQ5W
znI6u-u+f0u7?kSY*iSdoViPf&t;WEx#Dd>g5ft?d3?0b~3?0#Gpu@iTO+YJ_PBAca
z^fNGYv_q>p`5aK~KfOkaO`={SB@?oklS%OlZ&GdnLrNydvM;;^naK<(nV_A&wHyo#
zHCt0M!Iv^{FfdH*N&#&qVR*yAz_9*uN*1V*1Y##QrDTDcXKz3bP1~T$z~D4FC6SGR
zNy!Xia-uo|lj0YMX^DoQS$>XsuyKjDAP#R*K><Tbq8Eq_I+{<8C&d@)Hl==u3BD>&
z6SUu?_*yV9B!k?xBP+$%36x4eD-M6AfJXp8E4*gvra)G4voSE(B&C4Mno}Tyqc*3w
ziGmDbV2V*%!vprUha^})nSr4yJjI%qfk~O07j#rsinRtPR5?KDB*oeg%C6a(VhvhH
z4f6KXt`r;a;c6TV3=>|a*nk?6Ao1j;>F>1J#5i4(SvWxE9huIn!zRmAvvs<T4x6q<
zZZZou_~bYi1_t4<WEO5|kat)Z7$icHS$McWfdIM)^7iyb9X4yt#+k{??|B)RRBDCt
zOG_A%ncvHUR0x4$DH%NImJAwlsM$LGDa3H*Pe_I{e?l^x`7@H?R=R99oC(Ry*LWG2
zRL!Q>>q1;OPZ#V$=9|cd+(b6y7Lp;Kb=hpp)smSbK!*4W6*43<M@TU+sm4Q>1u?0{
zgWAjn_6&RsOsf8p3=B1|l9^3Gs;5j((_>SUsd=9ax)GB}^^#CwW*$Q_v$iTIG&mU;
zj=M}>p~t4IE||;&a--S_A&@-NHSl$ukg#C7rT_{HP6h`4ZPP#LvCU-jXJKGC>@$6$
zKAWO*O=B|CZLl{$=TI*$NM_3AWnfYd6Ur!MNM_2_V_-;O<YZu||D4Q}YYsJM?e%1)
zJW$b4%fi4Qls^5dK3kM%bTX4KNar(%3qVOx{n_*s12$#0*PILt8>de1HDHU@t}aey
zk^<*W1}2SAh*~KH1}61q5F4dH8?He%Zrw9o*pSWINiv!7KTLfcSUux^HIRC)T!v&O
zkV=L(3|R~e-0PDWAHx)$f+&0pHhB63LpI}jkz~f(ybMel?;%pR6+vbQ6)+?--ZlXR
zCW8e7LuzO;V;?k6X@aKL+We9k`&1a1G&e(%5@VkwNG<4|z^%!Qec)`x3Cg3%jQyb1
z(V%rZ>n|rW_Jhh55GT1QnXw<#Jd%3@axWwJa&^$+rS7T8j1$4m1zkqaJw3sQO}V~!
zOETj`Q2hc@VceL^I1!}v4Oebr1w%3;=q~o4WKijmYG%&BAi6l2v4f3)NfR{f2y$qL
zCdi>sw}Hy)4WJ8Ir*<VXb~u1y4&+0d?qo)7s1LPrI2jl~8nx9x8ikUkGa0ib*DEG7
zs)~UG7?`xWSs*IZrN9DN3=AID$&3<UcQY_)ZG{>jVF;4u%4A4plmgWsZ$N2DZ+S8!
zA1?!w7HEP4WDTDIT$KPsl`R9qu|vtnp~h*0R{gc{`XwLN0V(8QU`RYT{i88kX?^|Y
z<d>oh3@PnA*$l}q!2!g^z_9ju@+)};hLq_Hpu;;CtxDbxGw3J>*xCER0m74P$dG&x
zY#~pw5kvApNZZGjfuZPFGW2#PChbQMExW*47-AS0H0rE=GTJaO6dtsyPXY~=>AVIX
zI%kyu9#~;xVDRCz$^;wB#=x+Q*9x?#PDqK3fgx7bsu;W<7*yc;S(Sjp4qS{{m4b^=
zHU<XAxmIOj3`}4%v-+&cr5TuXKEMyus$yWsU1ar+C#i_RszHdMo`JQ6je%iNfK?Cp
zSY0*-hL!GCy<j#EXwK6Llr+F+=+$hsngnW9fR0|9+GRBfoG95C7~<KjCd1si{I?Y-
z;=t-7cUbKK*Y0ef%F1dlOpVeRt0Q1GD7n?gf8t|cNLXOQz~Jj_r2z^IT|Thmw1pTL
zSX)4QYKrZxq`(sDydYOg$$)1A%NQ8k{_?SeLq>%em%|qCfXA41lOY~v_>c~%c^Q{4
zVPMh)om&IinNr5Uu*a5<#h1~(9(3Os<8s&{5(Ciqt?oLwX1U_jLIysT0El}TI<_(}
zbZmw$Wm#SUGLa#gfkCL9k3|vc4rb`sA`|F>RVIT&>I@9=x_m5(kd(pDaSL=#qg-Yx
z10Rc)FauM)!662Q&PWD^PUoVeA_hJd(ArPd7N&_D;tWiN_rYy8MwS<#DO|btd@QD%
z3{3i8nHiW2-!d?C^)WDXfsTwZ{Kde~wUU9MYbiSelMy=uL)U%=hOWIJjtB!o*EI%)
zt}C((Oh$_G3`|_U5Hnd#z&kV(K73$g1x*KmnuHa6%<otknDjyGp19H(7`i}~yk=%#
z;woWa==#gR&;?rJ!WG59(9O@l(9O%vz{J(az|gJ3z|gG)Ua$){8`5rLWHp(7z?@B_
zK7oOW$B}_a5469L(FEzZj?@b1>U&1k3doe2z7!*47ANFv0;UYu73hqtOP~{LVC{^y
zjEwN(JTfd88B>|Lm>3v9ON5NJKpn9L>_L$K)__LXKps@!WBvm2-~wv~CZj_j;=CdQ
zlhGacZ3K+02S5!p_|OY@zKV$heytcI%LfMLz!eNk`umYwnGU<aospG=fm!ka1C#zu
z@D$(y1~%}lcs<A!8X%oWx<H#$<QbR@A@>Y0vYvr0>R~+taw}*Z8Xt=_Cj*m#7bwD4
zGB9+zF)(yH$uck*ZiA+3)*I-CdN4re%otff^9RSl5yA6;k;Mb#F$N}ss_C(oY*O_-
zAdL)61~ZXdl)eG3cMSuRksZ_$mLnjw$m&jj`^E7t(F_a+KJc;dLeoAIG#fG2fU=R{
zY;aeV4>mK)(A~_y(A_A`!1Q}RG~Y4%fP5-<hmS>ElYz-l#+rfY_eEHOVCn!_%fMs^
z+N%Le5a|(c=>-f-zwa|J83sdQ3ntE-0M%B6?BWG5pD~v(Fs64v*JCg;V|cBA0n`iB
zmgHk$29-I6pbHk%KJc+HgNnXWT*dhed@O9D3=E71LF(+j^D+Mfs{<XWcX}Tm^G{jO
z0jeN5`R#nn_d#+-pnIw8XYeuKmtkNK1|7U<dOC-X8M6BwbewntAM<N)$<M;TklN43
z465D1OL_7>@iBh{l|A6$bKTo~%wHf@gUmnH&&Rw2Y(D51Iq?QQ<{cn6f|f^z`SLOE
z052#8n>anenoYbOWY~4EVWJF7M)SFHLFEneS#bs?qxIk=>mc)QLCxo5VBqR8V_@jK
z#K*i6Y{^T|@$I|#m{%%-JkQC%0J3o<Xn#``7ucjVkOJGDfkFBgA859c$=D5a+~Zw7
zX3(1D>EEo``07Eee`C<TLY)*o<~G>wE+%8h5sPpk(C7@33Q$cEw<Vf^Vc!ux<{U_B
zV~~UGk0}AAHsfijpmSUKm~+4-EqHc7?E@b(Xd}Jg0me+Oq|`D7zIx^oVFo6HL!k3X
z^^fy0n+k$rgpq;CWG-l^{uLjysXpisI~E28=Tm&l=Ahtu!&Q)9%)rNNCCR{K40it`
z@acwp%+?6^e+3^K%*SlQ2QrI6l!3{F14EUGbUmh+9#qH;ZkUN93j@Q}gM7?>pyB#A
zV8cQ%Ri$GJRY8Tq5N7qF2-Sll8WgfnC7^x+<3k1}leOS}f)8j}NNYbIvnCq@lc_i-
z14AAcAG4-8l+)MC$E+m>;y}Yh2NotKU!eBr!mT!CM->9aX+6kls1i`53iEq0FzmJA
zW0nIq92psyOuIQ581%35G0W+K?BQf!*z3c`EC(8BfklJ@%u>?~s11q;ORG_ZK$e2+
zgsP|q`A=j6AJc9|1}3xBpeq9s_?W=QA%oh*PRIC|&Vk!LphHW=`Iydw695YXgPQ;!
z(`66`G@$62z{dnyy97Sz`mg~X6XZ+_NSH7^0y~d|fx%jdkLi&-DA9oSiu~bY`oamS
zh~9`YFqtVpoXPYU?s79@ND^Xt0#8C_p!}ng!iTIX5>+F}e?A}in7)BiJqrVa`g=a6
zzhDl?ns$h4W=>AX!M*hiOlGrC#Xu&2LI|n^ydlTEgO6zucqjy1mokJ*0F~1W3=H6j
zICIcC&z%2!OpCxBZU%<#DGUtV6F{pOK~7l$3Z^%pk$m%HxOOH61`csPrurqIQ9koh
z28Qkp3=G|%HSgw43=G|;7#O-wKxzh1gNz|$320XlhXx<hOkM^ibI=Op-xnDex^FTt
zbYBNosUJQtgn(-R(7@kf#w-Q~P@Z1)pN|Q=s1P(NW<G(FfdS;s$>2#0(Df11s~y<*
z>Z|#f+QGhKU@~6^F1(mJA%#~K1B1_VJ|@Ug3kD|hGZ5KYh^#pSgAyYjQ$8aDlLe@E
zsQreIDIdIAjgx_4`DH$)e09(YBG7?SrF=~JknyuJ1_n-XKBib`sdaJ%XcZSIIM;xR
zEz1yf1_t{Xd`z*jppuAzq5BO3L-#Xvh<ULFAoCa)dW0AldO(X8#Y*{@VnI9H-!L%r
z*f22km_gSdo`mi2c41($_$bA|Q0dCYlnk2W<!4~%iDh8uiI!(z%!ZvOc}fB{dvgjD
zHX!FP@G+(FGB8<evu0q-E{4{o3@0BjFiZ3?Fj<@jh4VxXNPFhP2ZmETpmPX8RWHgp
zkf|%cjWDZtNX(y-fEfh0hl8)4DU+3f$<mmafyt_nfuSddfuSc0#HnLo=&5F4=&6Lo
z@F^PxCaWIMwi09T@<z~JPw<6XplmE?!N(NF$iQR?TFnXyLeR|#!u-&v2m=QlG%CU%
zL1xat&~b*3$=V;J3v{M5NSD7NDBz*G{7pas4%Ouko^D_;XJFXf$j9W)$iQU9H~oMU
zn~Vu4uH8Wk13<&Vpg3{Y1&xA%vXbs?J|-_&P!-7l(z$OxACoOeXZ&;lXExb-kWO3B
z>Qk6bThRKhH!z(JP@SN&<e%^{nS(PJC}_Z!7gX{wnahJL;$&broyNyx4z?B41DS5a
z$0P_%VFzHXFab~kvp%a1t{0gEL1xv1(#<pmhMo!P3=ANL3(A7bV_@jn&A`wDT5}6Z
z(}JM=?gtncdhRhW^xT4`ML}y&&@eFc{9<6}`6ic?%D~4Y3NGpx7<xq*7<z>ubIlAN
zS28e6w~+#EvgTt_g6^{J)nZ`iRg$X*SEWqKFntjW480-HBz)iwI2nQnCTq})1gPXw
zfs~I7y`>Bcy@d?oh&{#!!1HMWANiP!Ss9qDcQ7+BgEkrW_AoH?c7Zs23=F+<85nv&
z8zU1y2aIlEV5sli1WQ{7IvAMaKy5@O4h!%OrS;W(jMt!HI2SZ!!oa}5+yDwgyV;;)
zx2hPJY<i^_7>=><G2RE2u%{RpdXF$L^d6GSWZ+|b3=(?7z|ec0fuZ*z)K7C^OM?{{
zm~1@c%IXty82A{Ug6egU?k@}sy`Nw?WUdML<}4<g1aPi`Z%dvV0~N0Ti`&9HFt-FG
z4i>WjomR-?484eW9uKIy$UBjb@e?ZpldUD_+(ytDyZj6c^?i&Wo+<-FUnm1ZpSL&z
zv-^HXR-K;!*0qk0QIeN|$>s+$1GD=@28O=53=Dl!L7Y1b41Gr#82a|Z96V2kfw^Wg
z1CuRit2L~Fo{-?ez~tl3XaH?+Gt4VsV2*n$0kNchehmY&y9a1{h3ia+(7Xu@%nS^?
z`}i0?vobK*Rj@NKxh`X1==;pT(DxX`*}%Zi@5sQ=Z*I!K<a(Tef%g>ylbs7l<^%&n
ze>($1e<O%<iGiViGXq2aa%m(#flvD7<KkPy%fMuNikYDv?5F-03=I7bpnjSl%)l^#
zmjPK9c+DuEG~ZGg1}5A8AaxfR7$#USFibE4aqciMOo(7$m=FRBi1~jQm|Pz)FxiQN
zN~u!#Y}Eo0sJK2@oP~iq6yoOv1|SKrU;$k9JkWU(n;DqwvXDA12?c1uIiCR(obWX8
z1GKq(dX+nyl*wT}##P`}6a$kTs0We1gO72QHt1}2p`6k@20q4BphX*?X3p}<e2g2p
zK+2|{aA#AL`~z<L{Ra(oI=J#NE?@*LpJHILcbLxP!De1Rg^v+(gDL})eLN=v1IXYR
zIv|5V!+zble2hI%d+kAo;ct)NV+5U;0lw8~TL~Xy4`^X3%-)G$d$|f2_!uXG&cNdb
znIWyq$JhWf<2m>^a6ZNc@QwALMb{uh8ju~|iZBE;<*f`hWVRn4V*%6<2Meenph+x2
zQ2)y)f{(EPTn&IWf~fK_7J!yJz+6>@Ft7^ZDlY~G{ylt*Nvxpi8q}I_sD~PvWC%Kw
zfs=v3sF;s231;L;Yd*##H&9^;X~r>TgN+3FuDy+qF#_hWqnr#3_CNR-BeX!P;33Uh
z#t6^|%o}JlMS%7(z#JCC#Zb>=_Xc!tRC5y_qYu~^NFv${J;jazbTcB8<3AJ7$sK%*
zKA;OP?HCv)lru0)C{zcxpBa6?Qzi@y6J{|mOqgN<Ne@2mAm=hLOxVl7Fk!nYxXHm7
z40bkT{K>5sWK;bIhRt(8i+lNR@iB(5GB7#51f9^jih*ImJqCsecR-wZ3=9)KF)&Pc
z2jXmFV3^3qz%Y>m#5u&kFj0?zVWO5b1C!f1&}pu>7#JqHGcZhaWd)i3fnoCo@M*40
zj%Pt-8F<ADtT0Jg!N{0V&%Bs13*%7N&3Dibb=?4;4cz>OfyrqN#54v_3|KGaV{`@w
z9RrgSX!Rf{2Ao01&VbH^2W1C$u(v^K<@5L$&0%W8gbI>nL8ZGnIMSg}YX?yr$-q$d
zX?lP+n{53W(AxAZe2}U3H!$Z<IRP0#VUX*AItV5clK@`BBUZr22;O}JT}LVlT^SCE
zQfFRu1_t5xe2gmMkg9iL6a&M=5O8e+-h1?hfnj1D1H;4$Wtcq*3{2n?s3DCcBL)W1
zB0kVga3*KF>HI!ylJ%eiL_rm_Xc2=u14G(+z6VgRI!^^3BE$CpoP0RIsrvyq)o?H{
zoV4b908T8t$r;5Ad=GUQn4G7wffLM2a9HppG4Q<>WnhQ}U)ZHQ+lPT6Xc6BTu-TAU
z-U1rn0OchH&>=@mE`PvB>+qd124yA&hKY+97$(k81E<zApp(Bqe!IrNF!78AII*4q
zt!{e5zyKP@pTwX6cE(vfkTVz<CYdrYOwv^XJLf9cIiOqAlNk7}LtMl#DUyL<Qn)k&
zlUqGFMSoz}5&}-pulTO9GBCM-mJYkEVqln*!N4#n4U}r<F)&Q3V_=w60pe_9V3@R!
zfngHpba}T!3=EU@GcZiri=3V(U0`6CbPk%Hw<JK)v&$h+3Ir|M%7jIGip~l~#tf|K
zc}ovQdY*pKmrYo94)joBrimO33<eAgYxnZ)1&1q0d^)2an|M7mDh`7E4vLDy5RZp5
zFdY2Nx0w+XFOXP}h0XqhH(9yPR0Ail%`%YmHR&k>!=$?knGAg3ja_dT7$);FFid8L
zrY_kf=&5T)EngcWqcf;7<4I%S>jHP3c`_OJ`oMiaNQ00ObVAdNS^=IE20qXM39+Ed
z-cG&YTMF%+gflQ4R-1myk4?taR3o{xh=H$65L^K<fVO!})=1A|;46~`o%F$&sgTRS
zR{=8n6a&NLL<WY*k)Y$nbhq$DgX=6t1}3-O>DK;i8ob4PG2jU<aO$02;Lj$;JC)BL
zuIlOZ$^L8_j6T!%__HbT-s7`|$+&w=f9=mE!zekOBY@4a-kDDkECUHX8PG}xPy-db
zrNDhMB={5|r#>)DZed`U+@MihQpCWgs0|6y$qN}6CeH><`ZOAvEC)^cl;1I#4H{5$
z-wry%NcXnMB5_D>!H0ptRL-Og)G>u@iDR6z12kR$vX2AQ4E12_V`N}Bo@>%32)fz_
zeD~edZ6=_u0mCxzWQ_@EYXQS42GBjqJ4-AW-+(sXGyk?=Jj}?z<N+EjaoTIa2&#e@
zAh-NjFkS<n^d!o_<lzb)7qDQw4ry|Ogd%KF#RO2fpkCN&H4DZZMg}HN9u@|MIe#n|
zi#VYix3=jufoy8^po<xGQY;uN5axm|W<(Q$jH$s@32+tV=Q3C@cE~U=#Qfqa$SYv5
zVC<7(VDgk<VPM!+V!=2K+TI4WrT>G(!Ht-B(5O=M6?X=P+4UAzKw)X~hJnd50$jLR
zTmc>XX~zRPlhon{C>bpS#evv+i@PAhPJt);T+A)pK>9%1dZ)(*v1xKlwXg^IaO3p8
zAT}BMCl(eU-ZfsZ3oXD7<V{LRW3T`n_sp;iG-W07$U+$u$zHk;RmyT8Z*YLF!=C;!
zh)uu#wuJ#dB-(8l7^>$=cY{^uaDZ+Wm+qDYrGE|vhSbH<-QbP0Y@oA$q<gtQxd580
zK=+<h&jneg<tkkb*1jF0y;>5gUHgr6HMo)kEt{;Bt_BU(f@beBj@L`q$}%u{ZHJl#
zI+;q#6%=$)o#6}&JA<S_w^6}XmRdlkv=}@<sn9!24Rn*5H0ZQ8eKiJ#$p;x2Chyh&
z-L@^Arw?k>FfdGh%)l@iv@kd0taP3QXhARo!xUx)hRL9lQ8SK97uADpXJD8j&A>24
zQj~$o+W~ywmvk}Yrfq16W61(p)|15y+F}Jd%}nZ~bSNlx{zEckHn>({U|;|p4a?-C
ztp*OiP+3Uko1(+OFhv8jL`PCO6cmpC85pMcFfdGU0iC>hdY^PS`0^_ThABl13{ybM
z4tzMJAsY%A7^ZYEFidHizBhzTwtmWV28Jn9q2+tF0t1uJL<S}w7SNCgXy^&LtTMZX
zfyqY})T##+`WcKCur5$`4+C@hK2U`_Nl)4gwD9Zz$OuSmnaP113p$q2PuffqG?~r@
z4qpqf+rV?d_0ph&(7}_c+Ha&Cz@;oS=0IiZBt3BEmxf%d2MVRxqSAVdpv%x9p_B#N
z2?aiH!`BTGN_tWtiy0WEtYKi7vP7DJ$u}RW9K6AX(_h+vhk?o0Ae+I0$#(_==!*FU
z28JnD7#OCU195s77^Zw;V3_iOoq@@B2?GP@p2Mk((3s2m0=mq1x<DA4Z2bbz#2zTD
zK*L9%DomDDS_AAnkewV14B8&j8lbyU%Q+Yr%5<bPtUyi&73{Li(o$fBj0{Y^8zCyC
zlt9krU|=ZXmj>^n1g-cf(~*|)2I=AfRUpzb;ILz`VPMemmaZ2BWe#7^osp;aNejw@
zlz|Fl=Lu3%8Fd*LBDtmdK<5A809^(u)dwz6z&S>$546GRKgb-F45<K+F@7ZwRRN%>
zmj4h{0g?<13?TN|Sg8QesL&~%)Vvf1sYp->^PgwBb~qbveKb!hgH(((1LK6Rpg27y
z6$>hI{xb-G#6c&N!o<rU;-HKjCMjhPwsZ+kCW91cJtD&!uzD9Hb6lb7BN!ND?WGi;
z0~ki&(Gdm)hBKf%>)%_ik;x#X0P@-!28O8`3=C5h)WF_V0FD3sXJD8b!oV=qPYtwq
zPf7vg36L0QcWIFtX#7Y@0W{Whih*J390rD|(;%r2e5tLhy+SI3l$JQiXABHe_cJg|
z-3?6y#yJek9wCg3SrVnw%_7(WEV-n_VeW&CD93=@7a#_5o;cKb)1(;~rinw%FuDUW
zWBUFGHYKJ58>T;wU{kI?a6$<@Vj~u<%;*R)ka6|`P(8`Oz$gMTFi=vQfpN<+aC!zw
zu`w`6NGLP<vNA9Qa<elqZrRMhFwKmCVVaRC1LKzc3=9(X3`_x6Kr#my7^e9%Fii6W
zan3L>Op9Y+m=*)#++bjsme0U2tv(x45-`r;0iPzv6aZRRzy!XO1HN&PaZUgO<2HQ;
zrhsFNj9E<OAS*ya+l+G(7?^@ophE|YvtKYUz2ISB3it?8#rYq!N)>ip4&$69AW4t}
zxK{*Pxd0kR0nH}QX<%Rqlms2Dv*w;MqX8@sK&@m@ID~)#AxK4@f$@ScG!P1)BfgBY
zVf{u1WkxelfHcc8FkVooV_>|X17aD22zwCW2_iy4L?Y-mqHG_CQT4M6;LeAcC7=xI
zG%*EkoWsb#m>mfk;0e-&D4*Q|8d#FxP-e7ZWnc>8v}Rxmvd(5;3UXzTWnc;l1QBr{
zA{#_hfQVKQF$t0a7-#n|Fa=Ks4FVfL0#Wb72gcbEpil&b28ffvz<6LYXfL!Dw=$y=
z;~Pc>h8{)b|De1R+%VlBnoX*{U73-Qhk+@05(@)^+)ZUh&=za(UK!!J%8cMM`cJWd
z&SF<)<Nz;P0nJ?IC^K@xIPEFQjNqk34@DW6f;Po6Foc*ZGqQ<*W(z?xbU{aB85rc}
zD>Jg`!i8?cGB89$Dl@W+GSq`E6$a^i4OPYonrH>xq{<ZZFP4Ep$XA&WG=Rzo777-O
zWnc(&QDzh}hZz>E63f6~k*~}sA_EsPk7ZzBJfO@df>7lZ%fR3grpzcN1XmRs%fOIa
ze^Z%J4DPbvf>;KIBZbP0;t=->K)oXY8h(Drz|g?Rz!VG`wh=tQFbTwN-~$OnFfi<!
zqI?vZ*w~=W0yPCtVrxDo&A`+W1c`FC8=&r$JhSo%RtBcfFlh#+`j$fwDRu+UaG$)m
zav>`NQ}B0o2Bwzt3=Gp|FfdGOVE`Es1yRQ#0ZKLUM#@DXBlHv*m|D`gpsPY&9i0z4
z;iIJ(G?>{^&%iJ}o`GR{Bv`DQVLc-Qb7BwN6gDuco{<Ao(1G#>gR-AW7z0zwbg%>?
z2WU4xSe$_=q<#(~15?W!kVAZbK;<WZ{o<w^&&t3Q@(Oe#JSzjk^hpd1(<gv9f(#7P
z7cnqQ2c3oPC(FPveG3D_^iAk@#j`VV%wPar7Jnv|O`1~!vKAwhZ~BK=HtG5j5Eq=l
z!Py_wMdSk2Owi=buED^#(;mv<Si!(#eHO;q!NAPp0dj4N1Jt$PZP@aW%BNWwm|~CF
zF)%%gh08#Xec^zOG9)PXvNAA*)w4s(GmZ-k%&Aitm_j$f9b*g2=^QVha-fMI(6X3J
zCXQP$Nlpf+<Xcc-#c=@C2I9B|9i(LBlmN-XjAY`t0y-;{@jwa0U7QN_46F<c@@2|X
zSs9q3%k3B#4?u>7895DLC)IGmB1uO09>~eLvJ8v|mO%>$P8ZN1DAJ&5#s+XWf~`3U
zU0%cK!@$nKAm1na3}j1YAOqvkB~S;{`+yF$mhTf{{Kd)6z<6{U1H<$q3=GpjXMi6)
z%)l`HDg(pxi;4`4M=yX6?O{B6hk;@GCkBS;Z$QdlFfh!JWMG&9IyL*~R|bX|ehdsV
zoY)x{k1;VY%;;cXn9%~_@G~&XSkAyOV}2L|<1tN$)m-568q~?_VPFbx1S!*EV3=`<
zfnmlOXq<3GfLc!sOyO=w9?ax`g*;aYR5}$&y7mMt=((nVq>-dD1sFg@`7y|4QH<Q6
zU0jegaNN*sT#P+JjIV_lm?EW_85obnGBC{e$iOh;Er^rFz%WyefnlZ;h*QqMFw>iX
zVWvBX6TrYQvx0$PW(mj(Ees4ZCo?e2><4lB85m}6V_=xM3dEViz%cVI1H;UxrVNb7
zRx&WiFJoYe2&)H4tz%%ACBeWjO9<+3ZUd0Z8JHr#N6uHn#`YMwV;Gnh%mF2{VhK<(
zs|L*pf~r>rkePcJ7~~HzFh#5c8F`R_VU{@q!z^Q%ku6XoJ3!iN;6_GrZ-JRv20l}^
z25e?E0|VI1^9&5~R~eWh{(#K9z`!uepMhbPH_Xg8P&03%n#m&rGIILeL^hdvA87Vw
zD&_*GOGZXe-vD&K)Nu_+I^g*MF6>?lf#*P?K=(@>H)UX$mCC>{E18{v@wgKM!>m#U
zhFQh342;Kp<rx@ZI(cKDw|y~!Sm0tTM2JzHk%1}l88ZVT$P~?4tqcsaK$ZM)P^vuc
z%fK*e3IoHeNl-8F<}fh(s4y@^?wr0biA}V=g@HL<oq;LxBFIPZEf$QtOF%vX1v%*M
z7MNZgh~6k>kYdo)bD8ifcNlpCKz#s^1i1ME8wAT#00n?411t%1#(+9Q3`|j;;B;CK
z4ict}6L9$osC))k9xDBU0n+PY<lMu+6x9T>1rm7`2!n5cr%ITjW<g|OI=BQFn4-3T
zd;&TEID@GSu7gX1fzkSS1_M(R*z*woz>XGX<odwC9Ph%w6a_ly5R~Mgfxxo@6fz7<
z(d^UTC$ovF9e{*Mv<k>th#3wr&+xo}N;-i8Tclp3f`JiaVRRHkF|^CbD6#+?3otIH
z1_R^d<)DK8pA<L%7<s{Wxyb)fo&_rC=dv>}{ZnUPn6;RJVb($r$C!a()?o&QSqEhq
znEu&=2ybZyrf1MfjdueBF9U-Df4!nQD+5!^W_AXq=Nt?SvmP@r%zB8p`-4&B39Qv9
z@&uf?7#KJdEO;51VhW*Gf6V&Cz%c6r;_45O7DzP>VnOtvUi|?QhlZR;J<L=VF66sE
zKuVxm(eD0W<lO_B^<-d*0cB$N^=6DBkXz4~V&;SD8GBgyCvpX(8YE-|stuU_bwNW9
zd|#J>V!a~h+^(40%nVHbW-~B=&ghu+9~{h3g`ksY7#I}H6*Yw!m|~e>>I4`VX7iz_
zO98o8!Ans~kbx;y*&1w~Gy~IYE{KJEDWH?`6rvQhLGsSl3{1177+9gpAbIbAT*<%`
z3rYlt9t7_XsBj_314ghU#3uk128VzN%&YtgAYo7{0xeh7V_@QjHVOFQ=e_ZRrkOzQ
zWKf>VD$Bsc?OP8H6&=VWp^W?{pdlcIV&yBW3`}v~6&aXxnV2SWNHZ`VgRVs8F8~!(
z3f)#FAQj*;{S5=dY()l!*|MPG@h1brY#RoK*`S-BkFzl_C@f}RiYo+_VC)PGvtt<;
zW``;=Fdi3So_H1PoyZR#82PV&iU|g$xMYyyK}T3+f}}x(gaa)73qaO_LX!=D4<ysX
z^@DUkvVAeUI2SDe$%0Pf7UP62dW}0beM35%bbSVBX(&=DlBt2T6uI^UI51kgATcHY
zo|jhGrhJ2wfvGG-nt|!YGq?;Z1B1dN<wjNprqV)j2Br&cP?;T|SXShfXZ#D2@@HpY
zx)993FuRL^VRnltLp{@l1O^603kIh6Jdji>1H<f<3=FfEgStx>AlHj9iY@^Kv7(0z
zqd6}FQwiu0unS8V7-k=0V3@rRq-!Gs!|dA(46|>7IQtkFX1`@%nEevuiklEuh=ETk
zRV<ca)L~^{Dv4xfV7l;(fng44%hw#xEshsHF)++gW?+~j4>IB(1H&9U28KCS><mm7
zxfmGcgflSA39Vybx~L2i(Pm(nlg+>|Cl$moWnh@o&cHCI6?6*aMMsEz5(ywFF9wD=
zvltlWOtWKPj+2APh=sr!aAF}0(0d1DWIo9;FeOZ5W?+ufXJDAKiGg9x1`x*@#(_5L
z#8Ma-v*&`wjkp*=)iU@>M^K)-SO+m(+yWd@vt<7BGccuWVP;^u*w4T)=NJRSoI@ba
zYzBro4;dKd+yyyrIRnF-`acW|bAEt$n;979iZd|G6$WwkGce3GU|^W52jbjdV3?c4
zz%Vz#j)7_VQm92MV5Ok=3UKyeU=Wen%gVr%=*G;zG<_2T!`wm!hPnArhl_6kU8)00
znxLF0&A>EW1Y%CT_#RMSLUFCk0e%Li#PcA{Dhv#Bn;018HXs$D;(K7hCJwv$l!YtK
zLXUwtZ8O9q@jVQXehnj%3X~EQAr3D=!|EBBE<T1BAOUMo8!#{>%>a4)2?N92DGUsA
zCm<F767W-AC19t#a>yJ5o!tt$b{TZB;M~;=40Bf^xm_Xvw(K6R1z!9^s&+<+0C3*_
z@BzevgeO|@kI)KtJhaCn;Q+o=2Fern0r6m*3=jueM2L4VFsFnwFeRM=)$`SmfdkOM
ziTDB}RT3IdRqsFzGecNuBXI#F3^hsO1Bk=Glq?J~sS@5+kYr(C&WK`QO4bI&bS=b&
z4<8sMRY2;Ynk9Qc90sP81V+ZpiQAoW*rXWiC9gmQ>lhg`Im#F~PpELdR)twE`3A{>
zQan(l%NQ9mS*sa1wkyKaNvVL;fp$DxjDW^z0&E9?1oXfqh5#8xE>;GnR9R4dNM&G{
zyNiLLe(nxXe1lT#Nd|_w$DzR|Q2;Uz#+d-J7sgouk^z-bmyIAcN$G&gxx+Gy%z_L|
zMa9evOqZP*80Ow%V3>P{oq_4HKLf+ucMJ@3-zYLLU5*CVA@JN(F9jYDQhX(o3vwFh
z&{$9wn#at*Fpm*xrPK^i76N7V8}Ff3J^*L-Uoxev3`|8r%nVF7{xC4ilVD(&C&tde
zbQ5$`pauiOJT(wUjDcaE4FkhGGgAhpn|cfkN>U6=MWB-Jral8h{k&)fhIx_V3`{qn
zy&&lrkl9MM@{F%I8JG&sFf%aS^kHC_mkT<c5M*8?1H-%y28MYpAWj+s!@R`|4D;rL
zIK>PM^Y$??%-aPj5N|d>+$sYqV{U>p+-6{yceRdz>E=|B;<*eA^Zqi_GtB!f&cJjF
zTF*$o0b8CR&$yqPfhhxYM8>Tc28Q{33=H$R*cq5^Wil|#*JNOrud2wvbgPVc;u{7K
zqZw33f}|%fFwA#hV3_Y9jwrBXSiojh$usJ*GBBlq>JU&6&yQwcm>*dWEv94yKw%7O
zT3CUWk1=PIL0zu`Dx{RU<QWa68JN<ItwGnLBksXwlu-dizET&XIgd31bLJY5W~O`m
zP|e^nS!tF$qlq{JQ+fw81JgZu28Q|B3=H!#K^$#{dWQK`3=H#OCpF7>FfiQ%UrGzE
z$U#F38BCzQ7vjctMwtw-e^$ve+6XZ)rC((RIf;Q`ekTLN{B~rgWq<~klvW|G=$^lj
zfnol9P@k9S?n{Uh>t$e<i8F#&-~vcSp3#w$fhi-GnStr<HwK3JI~f?}ZwI-TiGgAM
z2?mDw$MhKBCdll8b-F+-umK|Sxr{Kq*BKb*Uxn#?#=tQD2`t1<fV>(FDlb5O%>WJP
zg0dB?o{<#*dvljOqbn-|Q^rbA{jiCFVg6SJhWXILQW#}rV6leSlq9o&f$6R|15?I{
z>FW#G#OhH(6cU)AjIfG<LFp6&Q|5C}T3pS*uz;O`VF5GZB3VZ12{3<wSYUtg$TO~!
zU|`AwUET~T?-$52Ff5QpD(|HyzzQ9>o_ctJ4+(JT39#x6t^}>TM~K7Ad!*DX4Q>%B
z-I8bA$jQKzc>x+M3v?M67HC6*R(cIISeP0>i%e>vHaCF6x(d{KV5(yPC)As}AX2gs
z;8grdp7FRK15*KLNz=_U3=9kG85kB=D>5+Mya~-<H=i*uEJ$QvSP%*dw$BU<3uZ7d
zESLn!gAB|Q8$d&lw|E&C793+>SO99D-IA(jU|0ZB_ZE~r)fpHT$}uo3lmc-~7#J4X
zGcYVPtz%%i<tWd<blVv28pz^JMp@|UT?QL@#z=k!rYun3<hBa~!@@iUhJ`uI3{1BJ
z7#J4TGB7NxR%Bqh9Rn&5pn)Je0hA6Hryne46RuZ=m@LNwYrDvSwy=UCl|!B}mXm=g
z+X0k~Ku+poU|86r$H1Hk9V?ULfz{y%J&X=K%#hr^a6SXW!nvTpgclidF(7l58RZ#M
zr5TvAdzl%S>oeLJ7#40|U|6^gDTB(zfXWtSMnnc(xSxSx;a+eCy>$cX<Px}(OF-r_
zFfi<qXUx@MV9Ehi7Pnq9Ff2UBz_9QPC=R}Y{0|BUM&^k>7}yz@Zu2rQEPTL_%diks
z6Wx|%U|9H#fnnhnX$IyDSeSsXIZ_ss|832{lw%1EhDEFl42zhN9eV`qSV4r>7l|=2
zEE0h?0pzxT!kd99Cw{tpDVwMiwDOX>0~&XL#)&)!NX_)TQZ})AP^mu;;zxP#<|SoC
zdB!$w2BuulX+XC&Ffc4qXJA;Q%FMuYYcB)CA~ObtMJ6Cmo&tFisXUa2xXe(VQ9y`+
zDHn7@E-1JcxiT;;az^rj{1H$hS2lzMcRi@AUKGN>un2UL3)CHVK+XfTY`_C)pb|-*
zf$2ylL{<SlX`}$1=wZAf&p3^rfvMmuGXv9+N(P2S$qWpO64@D;j<hl`EGlPUSX2n&
zOk`kKG=qU*(KI^-rrUWC)9Mvq7gaMVz%HtGVVkVSz?6Fzl&-rN7#6KyU|6&a#F@sx
zuxJMZ!=h~<P8|coqLT~^i;jchcM$`_q8khhi>@))F)$su0x?_R3M|biz;;5MVVf<$
zz?2WFf{r|8U|96Lo`GS}Q;@SiGB7Oq&cLwfE6AmP85kC`GcYV>MM@wF;0?FRj%@Cn
z3`}`t&;+trjDcaX2vYDWyZ}`<%8rNxvRI9QVX+DW$Yn?EAudxCfVr$*5xT0JL4(bo
zpMfb4bT-z}7zT#LW(*9AK}q0f00YBfHwK2qE{Y6HM>9aN4oyaiCWv?fcT<l-2No1P
zKy`+4AX_ju15>^>GXv96bq0pTp$rU*gFzf=28P9H3=E4?6dCH7jv65wS%5GS)Y&#*
zV9;ZLSLBKnupWjYXuJ=U4`tZGMM2e?JOjhxQU->_pl07aZ3c$LEes5cn_v#@0o8G!
zVi#1!Wio;e<6&w9X}79pU^)U#{)&6Ru1;i|D*%d+^$ZM)Co?cCo(SUXW?)#nn1Nw2
zXc+6raR!FPn;94uZ$ye6MewR_<s!C1P6nm|L1qT#3=;;1#fKOe79T*09mO-?*eQa?
zPCdioOAHK)FQ7)x7g+QtegV0Xfq_AXtrC>NOF+Q~ik(Lc42vItIH1`1#K5rl1A6Qz
z$>0l0B@Kub^&c3OU<=43*lIy-SWw$&2@?YYXuA^=C@hzNuC(HZhNY4Xa#&_Sf)O^}
zBbR_8395>~r6{bKBf9`rnS)p$uhlci$TNaw<O&<1O_e1I3=B);KyeCkgFXYp5?!Qb
zj_eA!3Gi+&qM5VAj)7r`4NR{u1H%$;sIz6aptuZFrhtcDLESIuI}A*Pvq8xNUMoY#
zab><RFcoe^k%89YvY^Xpnc(VSokwXEP%+EERQLp>i32`sE)5@VM@oU9Sw84tu8dMI
zz_$TIOKT|`Q11rXUz3Uf^?MkYiY!292|3un=jo+tpb|l#>n{Zx8fswiAO$`_4deuf
z3n635Ap67_m@a;T6aq>q3``9549ZP1j4Z4SOvRvL=;D6{h9xl!3`?Te8JI3{GcYX4
zVPII21>%S^Ff6HIU|3QW#=vw5T4^c4h5|wun2NJOs#F*lmh><%ECC$>aLIsyVaXB(
zh9!&a7?|#?h1z-p);3cD&DDbDnHU&kmhdt#6@$*ryR(;pVaaX=h9#g=;P0GdU|4dB
zfnmuB20PeBu@8*O9554<VJodTWR`&ph-GE~Z4+Zy@|b~P$wLNcU@DzpV9wxx^N@Sw
zN;B#qL0CK))R!%1;5;t{SGb0O=~5sx4wRvt@?y~0+DvuuC{T8R>c0T0u0U4`L42v4
z01^j@l{3JrX0aN`SbgyyPzMJx{0>TgVmm;SF$_#4;L{gt!7W43!i@}OE=GjrD^Nu)
zjEq@K;8X-&-I0Nq+YtK$>it8c;rc{3Ffe}TVPGmL14*Eb{EMEchosk%K9DT@RzpV7
z4^Z1Sg2cg7C5+%w6QM**gn{vsI0IA3Nsto642PHj$m<MDB@aQ~=ll;#lVUy~ai|!B
zJOgw5Cj0;YLH-wQfs{ob7)4t^Wdi7w0U1U!UIwO8ZDt1M_`?hgOMWphEcwCU!N7E(
z7!tw~;Km9A0|TfFeW8MZVJSBQ!%}wmh^xR7v<cYE86dkkQb08oGYd2i2-Jgbg;buQ
z+``JhR3^jDz|8WWfnliz1H)1!X$Iy*=*+*M1h~<%LIpI_TY8I`fjKdqfnlj91H)2x
z5T}@dVQDl2!_r802Ij<i28N}D3=B*2VWon=9|q=%Hw;Xr|3MLN;KIPnD$59_H0v2%
zU;!j30#b!63A!~wnt_=OItnXj18)26P;Lde)l-&%nQbvNjSD6)Fn6zmC0&6V42%MM
zpi%-a7?|~xK*JWM-H@OY%wS+;U{F4x{D76Ao~cTdoq@@81_Q&=4hDv$Z6MB428N~6
z85ov=1_(?yF)%D$#=x+22}ou?1H;m-3=B&_lQX7g7#NlwVPIH#2qbfpfnn(_28N|q
zK%8d`3`_qqFf9EE;(TUcSSH56uuMdjfyoRM@d@EjcPwCFfS&vz2wf?~z{AIMl$U|2
zTmiIOE`xz#nK}c*GF8xslJ+ZzE)@<~YEgk@e+E7#(Ck3@n(2-WY|5ZhF?GD_7?^Yt
zWEq%r(x(?Uu<3#pck0|@FlAse<7Hq_zQw>)4r;iW2{AA%vu9vfW($^5U|>*w#lTdd
zq{zTzrV784l2NsTf!X~915^1gP+A9-sToWhzOaZ>U4k}*p9Pu)<|t?2uu$Q!Py@}_
zGS!<!GBAKnR;-u>3Wg{Uksipv1l^9zs2T!l7^txGF@2L{W?%yCMqU=iz_2VtmVwE<
zNt^+6J_UHGmTCwC2LpqO6l522MKk1h3TQ2-vIBJf1bBFw88n*&@~$xhgNhMDJyXS6
zke#p{e2juMp!~tWQ~{b*giV7cS1>YWGQ!6k1*b4D{*s3lfr2MMzGPsk_=`MQu>qFG
zm0LiY*BO{9MZjqsE<6XaAFsaB3R&9@*bXwN;mUg;uBnVeRs||l8DST|Gb+D;IH0l_
zNlnTGP_8b97k4TwP=i(?Daw4oSkIWr%*A;GmP1q|K(2*au3`e>FfdhuHv1r^x>S6i
z_Ps$eDhocQs?q}r99Y1w0I5Y*rvNHvm|83#iB>T40w~X^I4M72WngL!k_KI<0hPJ{
zS_GofuDpbmfvI+(JOdLCA4En7p3;S2Dcymem5G&sscJ1d0~3!i1H-Z$28Ly6P)7)v
zfR3Y?Uf;~74C>Z#Lx;aq!4vr^Gx=HmaxyU02C_3Samz9=EbCxkSk?v_BIMSB*r)zO
zk%5WZ2sFkZ&%h)Q2oY8N0qc0H!fwjm!_RV?pMk0Rmm&j`Kr-Y+dw~LwK9E2y^Tapx
zpkA*)7X!nx*$fQJrpqH{3Di_z4LA@BT->wpGkXg%Fjd!jFfgYbf!K<WgpR%-8=(Pf
z0I0#5t}Oh_enJdP)d!$P=>Pxlfe|4KH3M2As+lk_XTVnSsTF|EHJ*OHg-rnzX#5|b
z_HO}avsL^o54ahaY8EjwFbVK8Ff7~7z_4s9h{MFdu<Q&2!?I%_FUvr~KoiuJ0STBv
zJN^RB3=GTOF)%E915ImcA3)YIFx51I8gmohfLC>Z3Y2u_iPQ61*#znl*WF$Pw*)4N
zfI31hps@`mert&9)C0h!#a@1vC)^B7wa&~8O#HqK49giA7?%B3WMJZtf;fmj9qJ(d
z5~zdt8yOguD>E=Ghu$;5s19C2!N6223M$$rs!D;~1+qE=Q8lTb0l9j*cpIA{Y|WPj
z1L*b(ST+}8fE=b&TMEkk$cHIq!B0z4eFM7WVtRQSn{qvL*i*;@RHLb!QwH4v)C4{p
z>Kg;Yaw7(Y<p%5wOvcO%49i^^7?#_cGB6nnFfgbJGceVH)^;0<GB7MpVPIIE1loS>
z0y)!xQ3u=!Q&r<*p32L>R2Rq0!0b}Mz_7fQfnj-NAOo`tbf!wD{tRe!m8t^^qd03d
z1GCEk*ebqb3iCnyGf+PBq&@RNhTLFaSU!z`VfiFbEHJxxKw?3|hk=oSK{bkxxtEuL
zson>qGL(T~`FaM1<*UUJ)@gv(a;a9cFe<PzFx8!8W~gU&Il#cM{1^kna?nN8E@v1R
zmfvGwSbhg&1jw=<3=GS^fV>84fM}cng_P<97Di1@2Bvz@xEH7evVxz1VFl=t+r(l9
z1_%e*0$HKJz_3D&ArR4q(Wn4BcM%JtYCY&$Hn4tk28I=;&=$-J4+e%6ZZQ233=Av6
zApV8UZEAqmZ>#R$W1h&%z|^D(a%?vP!-_%%h84N&49qSw7#LP`F)*y?0CAQwFsxY2
zz_4PWI0LimL`aBf3V?m_qMn73o0Wm7k%O6m*>xTR!-}m83@bLWGcdcZVqjQtg@Iwk
z84zb11H(#D28I>CL7YPj3@fKFFs!Ttan3O?tP*2jSj7V3++tu@mCeAgDiy?e#=x*@
zE(61=ZfOQ)H%7R%EDQ{4!YoB%3``9lK;iEu#J~W$N@&$zb_QlQIR=K+(hLl%#X%e`
z28Pw93=FG{K^!v%hSjbN46B_%947{b)u9XwtAjxtKL&=?sSFIOlR=y)28Pw83=FG_
zLAI8{ZDnI%P}5}z=44=MSjf!4?AFG>uzD5)!|M7O3}Fn+Zs3zIJ}_#6_7;LlLK6n2
zhN~ds(is?5uVi3Yy&PI%X$FASQNSuM%^wWR3zk8pv_Pj1FJmZXV0Qh)z@TOi3WLuK
z46AoBFs$AN>U_gfy~YOy==h9AJvb&A7#I{-7&$-@5e|yW0}KpnJQx_(xPdrl7#P+h
zFfgnEXQCSn3~MSF7}k`5(vu6c?X0Z>DumQhSQz<OK|203Fsx~3U|7=%id1d}hBY%7
z7}iVyxksFVVa-MchBfO!9AyTEHT58?_JMf%3=C_|Gcc?<3*uNaFs!-9z_8{Hh~v({
zu;v{D!<siBPA~(*ntu!oYyN;Z@eB-W1sE9C@|ZF(yJj;msFgD?HSx+aFuN9<1g*1$
zE(zCR0kzrH%30oW!dhzDR~VRmR2UiSvzQxCf=X9L2k?SACSzp=2DNqurY0L%1}0+-
zc(E1(+9S)r)CAfvz=UXJ2sMDt0AXNiDhCys93Ma>v;iYyI<k@n3{1w}3`|XvK_#Lg
zs9gnLv?Wyk11h;5BxwYZghr^w4zQdZ1GB6tBq0ei!0J2DaT%b5!qA|+ij{$>*_54u
zS=NbxVXY$r!&+F$EG)sm>^2!%-v}Fk*K9F0gNt|AfJFTVM&Sfd4-e#g)ZQH|sDu|l
zf+~yI&t3&oCx8YXK;7^y&}GcRdtmKwVb~}@fbw&Yt9F1kCd_1DSR25=u+|UekOvG*
zZ?YMfnin%NX4Qi)anEEbg?HCPSQr?$K<{LNH?c${7?_%mF=Q|>a7|a<4$aK7V66}z
z&=T(!i-M#g2Ialr!*CD{_Sq63-!U+?NPru|1>m>_bzoUII&D-Krt|i)v9rxK04bWj
zu$^7FK8AszcBb+|M$p~dnQ6*hjEpf146*Z+>p}F2U&?8WMhpz@tCYP!>-SrB@Fb-q
zGAR4WF)+34U}IpYTB!`ab_leQZQVL$_?g3e>y@L`8JJr3iZU>@tkh;;(A%mU0$tv&
z&A^a#RXNEFye1xe>jn2hJ_ZK<1S19pv2<lckVS1eJeds2;9E05Cp5Kyj^xz6t*pVx
zz`%GAw8FpTFB=1c?rmiqxJWBML_`lEq6iT&WQFN!HHL^7!A0s@T_HloaG}<4h=>V7
zBoiWHiV&%Wh?pTndLbg_2$A^^5etOKMu><dLZtpMM92yubQL0EjSzVb5wSst{Dg?u
z!bRG+AtH7N5m|@`Xr~h6K?cy?O5NMaZV-7;(yE!vd!G%m3WUKNmbUJI(pK9&HP9AE
z-uvR9^VJy`)+RGBtc_J;VCa(Jy$?F^_7nrd+Aao$wJmB44D-M9-q!`42hG5+b|VAB
z+SLWgB^3<34+R()qQu|{lfhyM15^712Bx;%@T>>gdObaA0-HcR_);YBA&n;(*dYBH
z(7E9p4h$fN=7jK`fGn_KFo*3M0K2n&0>qssVD7xhz_9i*#GNOg?p(*fz_9ig#GNOg
z?p&wNz_3mc;?7e73=GrFC$RBy9)UQpJ$JhA1U4Bq^E;r0q|@^!uu0Xg<DCVW5o9oh
zT{4gW3aCyE4X|ftDKjv2YA`UY3uIte=c&fP;QpI;mJuZI*3~mGtSg5&Y8L1aqf-nF
z>ozektXrW8+JVYD2edH_B=(GfVci3TywY3--nk&LWeg1KL8rAcY1T6^$ZX`D2NL|x
zz_4D8fnmK&K{*5Od`<?YPF>Lc`jXrN2HpiQ1=S1;>q{ZU4}%$a?K1;Y2WU+?Qz^LF
z4KL3b%mNsgI&B%4IzU}Zuxut`EiHo?_<(c<ruvR$phyF0hRz{yG(c+#2D28Z2}j^c
zkWB!`ECW-=BbaOk6O!H=5WSrYFj=tekX{|=z$Rudbw<W4_UUYs*i`Cm!F!7R86p@M
zHaz0Bg+>VI9BEL^!1w_aA-z*H${BcV<rx?ku`@8NKfu7Sen&buifr{jQN)<3P{P1#
z4+^ML3=HePFfgotrjW?M>i`n@&%m%Dnt@?MutE|8uLEd;79`Tfz_6iCA(^3`*MT3j
zwUB{f!$t;%4J#E=7<e5(cME|OJz!wia77`Nf!6_a5bu8mhK=G33>yU%(inIhKuH!P
zV$Hy?(O4m!f!6_a7$is}je%ifoI(ZzuY(-K<c$*<7&dk)gcvgLIznBvaVrDE#?1;L
zM)eH5j?mqO8!s?0Y&@jIz)-t~*G-Ipsdou%9HYuYnt`czCAj)zkOI#YF`nkl7GPlN
z`pnG0)Vqs;VRJ46!{%&h2Btp9SU*S^69WU|Jzgsw2Bt1hAFr>AfnjqE1H<MjW(KCd
zDGUsoyBQcbHg|%ir1~nSub<4OSPxP%n}K2TOqh~Y3=ErBfcyTvN1^tE2Q?Yr@n-8X
zFm;2bIeM=#Fl^q<z_58Ivi&WfwlNbUuPF}$Q@20JJdok17#KF60C7O}-(+Cee4W7x
z;b_phB~}IoCP7|PDUc$Nj+YD!n?a{XfL;89fnoDEh;tr7oFffh(7~k0+aSci)Z+pQ
zj!z5>prbIhupv1|S^(6#V>0IjZMf|Q&4q%3V~aQg!xqql8_4i2pvynEsDOqRVSy+u
zz`(}9z~s(rAkDzk1DZ_&>oQ|t*aDhM1nY8TVA$e}><MWBP;ZPWoYz1L>W3|%3=CU9
zQ-xp+DGUr-lE8lG^Mw0>hk=19o!7WQo`I>S4WuoKfniH21H%^33}7EfOA7<TmL`x)
z9s|Rc$qWozCW2hr`*(W7R5p=%Pml~B1H+a@3=CTqAbUIp?1f%lZIBlpfs}PIFl^b#
zz_4XKh%<$OVaovqhAsO*rosIk0}idZyxKerOugbDbs$X_85p*JR#bw$@qmG0%RQLC
zrwdPG6P5+3`M|)i<sC=^$l(7B3|sz!=REr)r#nw$Q>@owVAv|az_67Mq{M`QVXHg?
z!&cDJxjs7vhOK%G3|n<T_m(j*a)B}cv~194VCtQs#lR3giPr+uX8aF|<)ge647?Vg
z`rtokA9D{YuQ6QiAxI8%V*~?O&Z(4F4<cv7z|{K}B&i2F<P9w8|A|)<BFVtiCkc|%
zgv%w*<5hvnc}|y~&Zfkd*~2Rj7pt7^Kb=jP_b{&%TxkCE`sr+<^%)Ed{+D?6L2Ec;
z=zcIp@RcAFy1+FY&pv1kx7C$_VXL(os3zvw2lCM=28OMT3=CUA70mqaJo}(E+}7O;
z3|lvYYdD?*0t^h151A)+FiA5oO@J(=XD~?s^@&*(crMnnGB8a5owG7wIs?PjZww4u
zpD{BqO<2spu+4{oVVe_(vz~!rTN4Arwkmc8rU|<l7`A}~R)aXl85p*mWMJ5K6vVmA
zz_9HZ1H-lliVRE>?n6dmCcI>xxPl2<8JSE0)u{|j{R=<^KB)bj!Bh|5@xfqngn?-y
zHv>~Y=saggOBv*BSXE>40Mu+{VCn}~CLrCg+Q<f`#FPPI!URT`1)0bum_|VCpCAvD
z&S28#aDeMBf$Fw{Nkeo)D<so7Ap55~%w$upmjD?AZn11&0<~B`wt$-~3Jjpl;+@Pq
zlR)>@O!&qNs(pASDKjul_{ITh81PI2Hw-wyaX1OwAYcPE1bC)^O8iqipauZXR1h0<
zd56qKo@pTVDV}l$p6Q$nOcQ?dl;jpne>9U#w0<HtIN95Ss>G9JJeJTZQ3AY?je!AD
zB~DG!C}-fYln0$w!N9Pcn}K0FGq_6RvD5=O3S1@fSc5HLVAyWYz_8s=A(4Rxe9FNo
z28Qj+7#OzCQ%GXqu>n<yAdyQ94BJmBB-b<W*np};kkCH{hV9=JQW$t_Kvm)?28JD4
z3=BJz6jB*@Y(P~aNF;=TVTYeW8Uv3Fs7eHhR5CE^C{##i;IRQ!i6D`s3=BKwDr7M5
z*np};kjO;_h8-tCRU(fq)Qvm7F)-}-q7b5E#J~f-;OG<s!%lVvhMmmdDv`%YjDcxt
z5v)qA*&)rqG_`!X;%qh%kAut%OjA1;7<OJ@VAy$1nt?e@5mK;9bbu-$hEF_ZJPb^e
znwc4x(+n9HcHU=T*m)Pkv1MS``Hq2M=Nksl!f(atwX@k2>p?31F)-}>168q$mw{my
zH@Lu_IvHy26ma8&i6>c$foU?Ra+|t@fnk>{1H&$9Wb3DZtY;MEG2~%jnk)-4&yay(
zmktBNE-etpmVsfHH3P#gO9m^1n}a2$fX3DtRe200K#D**ycrmFd4f0~9Z?JnyCNXY
zSr2iJB={OPMpK>&AqJ)?plWLB0S1O$Squ!jGQiH6UNDDEq<%HX1dwr+3=F%<K^%~A
z9SjV++CXRX!2(TE0aRl!M)2rJFfdI9o#6)xv|Te87<Pen6r_PPEoWfZwG`Rak_w<o
zk1>NsM-^l+$d>I447;|1I3Nwj7#Qkz9Ra&~ni$;GJPZts6+9I(3`|o(m>HO+f$mqm
z#=x)(v}$LXJ_Ez9rwk0cK+AQfSu!x}`oh4l>l3J&nhL$lT`~t$+%b0WRPr$}O$Aj`
zQ|~Y^>}F<Q*v$y`H`JmWu!mx2^QcQOFiipNgaG+yw-5uvZULwRcPlb5?3PCfh8$2G
z$hewEori&G%2SX!Lk5Q3AgmAK*fKEec3@!GZ3hX4>G$WdiOPax0~i=~`@vMiGcfFq
z1=oO6pHCN@$EH~Soq=I@J_EyU&^p*@j0_CB>lhez*MNM_&A_m`mw{n-H@F65xC%<|
z(4s(}foW=z76ZeUOdb<ZO>+vA;wSS~Fz}c_aui4|iANtUw;m*?50@*~;n9M~Su-$A
zJq?o70v)_@3RHELtMjNrBpH~dJ_pIELgW@O`X**E@PH1qI>o>=O>Fv`d2I6h3mBa<
z7<i<?N6s)!bD1tRpG~=*nX8V`hk;@9BrfD*ZNy;%bKtANr@huFXW+_{Wnh~2nt@^W
z0tSZNvoskPX0~z_fXaY}3=F&XF)-}jBhA1x>klOA#6N%{fnhyYu?Pdxw5y<O0vYsX
z5dQ$mB@Fwy^mvLHnCsI(>kZFCCq@{cMZ1I!XcY>0$OJTh$j87SEMmjJ(3{K!z7k}*
z2yZz9SCTx)Jsb=SGTK~8YG7ZvGcdSXae;4xJq0p>gMq<gGgl0x#PeZbP&D8Q2c3`u
zIYWv;d<MgG>ji8)QcKmqri6pmpq*l1*nNY6VfQ5~kZ-0ZE?^U_hdF%)Xe5uJAL4Yd
z%jd&f4mt?skRMkd8zTeL^!*$R4B3CU0tLaYvSDDbG2-$A%iM&>fKM+!#h}Z;Alks?
z%?4VZ3z6`KXvtt;Fula(4sC?gPlFv&13nRCW~3U}cz1|ehTXpy7<PXFITy0Fg<)C;
zsFdS*%jLle+KIS}fnkpn1H&FMb_S+d#~2v)xH2&8aRzZNF)-{2VPM!31lrdEjk#$Z
z&{009F$@e0^(<W0f(%SEj)4kWXjn|^fG%7{C_`Pij3f>VBhb=l$Ywc)X(!;eoB%nN
zfq{X8%a#}9-1iI&d-50<_T+$+gB?}>0i+(XLm$L~Xh2;_4HAb2*EE=k=njI5!yLo_
z9?+Pn#^nOlDh|prAmd9w-Pc)DAOT(P0uAXsjSLKXs*yrkTme*3FxYUpvRX4R&DsSD
zR8R=dXJFU^+IKn&6vFEm81}3|&KnBgWaJMH)LD$kc>`R6GsGh$uzXntX0EiO4B(<@
z*8S<f7qKbwfr97+1H&HB!uwf&rfV%`Q)Jvc-DfeIV(<}Y{)43$79_vwGBA{|aXGRv
zFwI&ENp6l1j~OvAuv>6hf`<BL-REFnP`l4%36^04or5#|z+yIu`iWe|pse!-lq+~a
zXZUa#gOxCJF)}bLsOQoF$(~|#XJ9yekxPyhobs7wtMTR*GjPd?gSqYu4Atsf5->Su
z4hDuv7r7)L+0%xBVWth2FvtzFV>uWYR`zfSg9^80p!0}k+SPOMF;*}z_(^Lsnu9D!
zc%ThF?CK2z)0|@7`~n8;P%Q?=oWpDk3_eq}K|5IH6tjVjOw<M+S_Nvn$u7{2=U`ya
zlVM|EIB`=u0aSLqVPjxukJU~Fu}|@&<R&s`r-0dP3=F2HwbMWo-c@W244U<(+UYQk
zYoB%|Cj--*3Z9hW0tW4Jn1(8GZP0BF3~#C!7!G{Z-Y?3)G)E15c9(V(Cj(>7S@5vm
z<R#k8pr#wh*u#&tTVQOLcI{R;yHC3f%m$4Uo|e<@03ENw5yZy8u#Rhb+)_62><(}R
z!_8pNz))~QkI{gUfoaYSF3>TjdW@E^bL-}81s_VM$7lsVUvAC`R3XT*b#N7+%QHCL
z^%%hye9Scl-|RU3!BRHK`gT1=HZIWFdMuz2(?gsK(_p8^$R)$T;5(NqlR=LWbc86w
z8&In|i9_!%XyeD+R1OA)fOfsVpop&GO)N@h(EAIj;i@>mM*UT1V1OJAx9_svCr|>I
zyBK^Xo!%$VVcT|KRrPwGj6jKq0~DuvpFnpWfC8}IQ}2ry1A|W{LpTFN#S%U6v3AfC
zL$5*?^Du&Mo}b^V0Xi*H?+Pg3PBAd-xy`_^=c*b51BZj&6>SCvVSWaNy`bgvzcd*b
zdUonv6K7zW-^;+TSDArfuPkWLuV<g$4Va)41H)bi$VpF(pmWA5mS}>GSJQjM4LV<r
zfnjeD1H;|`P0&H&dQU*<;|&AD-b4n5z3~d5o1^p~7o0FK>@8qm*qgV35tLx`pzgkQ
zM3jMPUIRGc=v{{-9O-lhrumZ~dHX7ObXfR|-d$D(rg^`a8JIx3c=pyaFzl@baaJ=h
z?CoP<*xLi*Y-eEDJC}iB?`#m~FayKhH4F@USAjU^85s8NW?<O66I$tBV*&T4)^B5z
zQo4EpGF>xY7}WJbbjhx{FfcjKVqlu@F#Yv5Hs$(jIiQp78JOmShch_>khTn`!B4rq
z*2BQ$a1>_C8V05<^&nHhJx0*f3ut4tPo@zAL(pEm<DlrDe}{vCp=Y1oaaB+hK$607
zJJ4aM;H01j8enEP#lgV9wAW|)-W6;T^*(xAK*i4+2Brmmpu#|Ji#oJ0kX@j+6Orll
zc7fvpTuA8c14kyfkkC5-5?{sxP9fk+%RmK2d#v6ekoYN3F4RfU+YgBgP}9qtO|J}W
zBO?RTLcw~7yUM_wEwKG%Iw1RblT(ry^vZ=m<MEJ$TMlY|E#n2-Qw~n|pwsPc>Xn1`
zoGt^Ojiv{=AC!%OAzVbSnuCGCReTd81B3Zz3l_Z^9tNfbFPIn@<~`J_Rb*iB=VlNo
zPEVbFc_o`@{XUR04+-fl<^^RG5NF<Ey`_*sngLW$1UM)$)_@$G2rej;7+YWk#X>u9
zsi4Hz3NI)Y2BHc<3JSOiP(jhQO^GoR6k!WN_gXM%znPx7icKvvR*5km9BiQ5kfZFC
zpcmIMGB7Pt1fLVF#3*46icL-ihPe4kj1r*Jra>o68G9%}F0uo0_&z8xN`dPQ76t~(
zkJF#5VpFRZP-1idohWyTfdSOZ4qT=58QROfbOBUtGcYiL4|Q9r4L(9w>9YyQ9tMWJ
z7Z@1!o=^i7H%gyDWydK7hP{6n81{ZsVqgemR{AQ%z~Fs|X(ERv1A}gy(l>bq2A>oL
zhJCUO4Ev;^+1x9Vp`IadRS*M%@I(ftB{_1L3`&gLps;?!z_8DdfnlF^AOq7<ZAd1)
z(gSjj@FFEfK|y8)rlmFv4Ey{U820&sI35fP`{EfG_QirYAq))r3K<yof%+9o6Brow
zbu%#RYiDO*TAIVaux~K~!#>bz|D_cS4EyT0GBE7h2$E`HVAyw-fnnci5N84d!@fHV
z4Et_LGcd<N7KJcec>`*h2ya%pC(OXKxCyk0Jd%N7-&+QTeXl{BR0f89{}~we{e|Ys
zD<7ac%9%L8>$^cqeqjSKSEfKpgT<2I(?Sr%!4>F=;l+EWFIdAS#VG+P9Tq>Ies~R=
zqKpHia99F51D^@Ca1fZbmQ7kS0aP$BFfDNcl?R}u#+gi@mBATIm9Pm}hN~^0@?yHn
zS~f*5$WaUom%-~@gd3GW2MH`W%gn&+#l*m{Ux0yOKOcz0$H1^(o`GRMsNe1-#lWy%
zpMhb&F4Uiw!Sl`2*RN%hu9sn8jycM}v;?%Ujv2C%9(3UWbad>p3#dF~U|K2wavfr}
zg_(<m1J+TwBEi74Odd2v23k9n0h)IQl@5;ol+MCRho!5)1(?!V6;M(H7Zgfo!3PGi
zf{TRde(Tu8B_AuDmu6sEx{3`{izr>-2Gt^LpxR@4-8wcg@X^$_KQJ&j{sR}59PSJZ
zA`D6k!FGUL04j5o7OH{D93D`aqqG!J<|%=$(*PfkY16E<5@w5ToYHD=DhJJJ<twcL
zWmwSd$VzKLtT&+2LnlRP6{N(g2i2|-SxOb4HVL$rii1tPfiD$Yz6CT5makL+8U<a(
zz_8zqfnmR$8aRVjfPKrru)mUlVSlz7IEPi5Lvq;uoeT{7H)}F5XfY_k?m*sukAY$T
z4bT<p7EhFFK+dUu!>Gx?5cEL_bg?c2sCC82z_9<X0;n0P1U}>U6a&KnX$FP^;?T?r
zs*@wKK;0T>ha<iRx=er}9-K2l9S)^Qf(%T{L0fNUy=P!JV93C5Kp)=e_yAG}Ijw~u
z4z35S(-GeT%OglCkk1+b83HN@7#I)@acKIA`@z7R`j~-f`NZk@8`#95J1`jHQ$WJd
z)EZv_>c)aQ!mkn-Kz+<A4&8sCB6kG~xD3~2WP_FA%O8RZY+Xincp1L@3#t&L42P=#
zHPXD(bzg(ct9JmMA^JuabX2+E0Ul6GQui&`Y;Y4<_Z=uAPVr<i=>7n)z%9Jc$+{20
zn(M%6T=yZOy{7vR(OlDg2r6<R%{AS}VhjwP`k(~WtfPAboPxn6W<A42@B|qH10(o^
z##Kq+_L}YyXnXB|3j@OeP>SMk&^-ceuN_EdU^tKrZm;Pc6K7yrmBhespqYW;Ks`uo
zpDyUyB(T_A28IK(k&;HU4!F6d3(05<3<uUS)H57d4Q{XLUV-?J;lLgSh6B66?KNG<
zl~xQ42Tn6E95@MSuj$?fJDlOt8c_zOmC@k#n(lE(j*(_yT9powzIX+c0EClt&$2Qw
zt-Qv}z_hA_f#JX{28IJSK%52!h667d7|afUCd*d!FfbhW#lUa?v@d<t3<idS!VC-t
z`9bQIFfbg{VqiF^0ZkhhpMc7z>7e#n{lyiK5_;u3P+5g2pf8y~ir`gBU~!c88F=m)
zRIH`3mN9Vrmx86_OA(M#e3ca=XeAL7bh#J9r4mqS4YmBz6i~4YG8EK|s|PQk0ToT2
z`bG>43az@^K*?ei=vdmGeY)FJK~V!qBHIw{INfdTpoR*#6x7`gismYC!$@~Ks1T_F
zoe8YJSr^vJTU`h$<a9$}4LhHyx}aX(sw6fBhWfoex{z)jxCN&h1B$_AYzz#t3v@w!
zNobc(Hx48Y>GJ6&g4p2noCIQlM6;!JlfWe$xbvr*4DRoVGBB<7fW$3QC+_eQ-Aa&B
zP@>Lk*VL^7b3mnL_8;9&SQEvFfuZA@E_kiZ>h<8Fe|p6hHsyLtT`y33?+qwJSKrdP
z3JR>%zrlG<=Po$Ufo#16wpHgIJUg!jIZ`JDCIYez!2@Mx@dY}EKxVBm2j^v-L*NUz
zAm$zcn+wj%^*TpEUIuwy2Xc!WNVC=lo$X-FrQn#-*^bD}I@=MMS!X*UGwbXWV_@)j
z0Lsku={mCznVI1NbVW2Hcy-jecyM0UnFWgEQw;SC2W=S`4w{2IUplj(nfYK61H-`>
zP{!S<Ge?|(X<a-6!@*VthJ%pItTPWL2FeJFkTP?9Iyf`ytN_=V3=9XiFfbh41kTGk
zt3V!o!@zLxFayKEgW$ZZv$`H8c!`1G-~~u#*4YTnts$ZeOlv_sZJiXIx$w-qE(Ice
z0X(iE?54Arm4Rt3Xru4CLI#F|4;dH^-e+cDT35@!aPR{I!@+kTPA3Dy!T$^l2mgXN
zQyCZz@i8zQ;$dcxU|P43f#HxW1H&O{XnwlT1Ix_PiV={!y!I(5dm-}jg)5MJxlRbu
z_qy;0lDF5HgViDD?bHvjOnXrVDbrrGLC&=BJnI3v*J7uJP7f&d*R2Ehy>xn1K`{VH
z2|b8BtJ4F^v!K3L|8_PBjUpWjaKtk(tzQbtqB<6cEUIGzjx=x|Yx?=^Y~qp&bU^hC
zG(+lumsNmLb$jge|J&Kb>X+Ttapz!Q;0GOfZhBhB8=M8%7#Nba==i|IHBEJVVdAcR
zI{us>o54ddIys=2Jq2nYeAQ_eWnfxg2gyUWkcb53n8S~C%E6hHje)@;S_j;u0p((g
zOr1&|&^Ev-$SD3P2B!5}LFv^%6m%~4LX|1;FmGN2d2>oUxVZ(&!dur(5e0?a22eS1
zdfyaj@DbZ=3=FmjQ{)6eM{=`)&W@fU4|W~s3T^)>iXiqI9?+d%Q#8N_>4Gj+u0O@V
z@Np&h$nq%$U=?hjEAXb6ih>3xz_*G_v4SLXdj^J3Jxvw?Mh2!0si2Bo_qHaBtQdH0
z9q78h9)3-x-QfEfKq^4_z^P4>X*c-%drpvZG?{jTE?Yar$-vODRFi49J_Ez?`b}J!
z44O=!``;MefJ|8|p~<uc>~D}MPoQeoNI?gJ4z1K=0^P6*zLE7rgeKDlaKwOg9(|<A
z<PFogagk7d0fQ!!w+5(*$^t5wHJO4q7#P(1SU`hunoPl9-|Db1Fl=PjWD1vHVA{Bd
zg@Iv3kS0^4Gy{Xm8WsiyqaIDBC;<ir#xf9R%5>XZY^wDKzG^acvVcbGG?@y(hKMpS
zZ3G=<tdpY26s`gpcjHPeDq_%Ng2X)dhF+C&F9rr%1x+UKz$NGwqm7Rsj?__tIuhg(
zL$FIg;R`a(5MmrCL2P!_e8~tpx9bf9(<abR=0;}CmntA<^MdYB(0u6*5@!Q@;WgL?
zY+xU}0eb+%o}&2{%mzod<|nY*qd)^envATVy3~E0EdxW`HBHd^a0ZYqpn;5y%$loZ
z5w@(ZcR*OP7G}*!YfVr#W&ovYqaMxmU~9mYn&u|3HEawFqI#NJ!I8zrz_3|c6LdcU
zLlx*o_bz2kA8@=eFm1X9y6mP$(?<~$=wL}LO%s^pXATC2KqpI06DgQ1hn%J|RCaST
z2LnTriKa5>FnG{FU&#$kWl(n>#16F7RMrG(0;yq`uDA!<#rcrVz`!9V0CA~0IG2KN
z3f$3Qz;vCFfoU@+;=?x?Fx>^a9JD6QE!%+U1W0NYDF2*dVEB;El~z>DV8C=9qQ-)O
zVeuRTXd-4{+Pni4$p%boR6&spipV%0gH4Q}gHhfvFl`3iHQZclunCm$LG`1-7I1h8
z@FX)BY!ipvsbj;y(4J*58I<F<*orbRZQ%kh?KGGUS<DF%0Sz&qjWw7L@d8Lh4}6Qg
z!BU6_$cwtS4c3AVx<1GNaz*{pI|iT`IAMNJ8O_1Kpf6{T2O7Hp9pS&$-yjdPwgpsD
z+Rrd31(ybp8W4QW{L(w1OR$cMaWaB#WP#mHaT+=#!UAqj?-Eo86(yXEib|legn{9Z
z5d*^^Et6sfPDVvjhI$6kat4M&2@DK}BEa__axyA{_5-|OU^vvzz;LJ&d|MVLqoOMV
z1E>dfXcGg&p>^QfvN#zPK_{S9F)$oD$G~vtR8dNP0Rtza8tAgHV5W&2s-V@YoQ#^%
z3=BFfOcM>{KqH`>uz_NRLthve4n31oWnfqoz{#k~#lW;nka^++MpXuemF}F3x|$43
zyA-Df?qgG_KWxUpa2Rwq!<sNoMl*2CFfbf0V_-O3pvu6IA<D_<r^vvd^_F?!Ohzft
zokyIEm5|bs;qXodhQr&TR}Y?r9V8RLz_iT+s?r{M=g#313=D^lK|5(@dmxqUHeE)>
zECJL(jMN>|pC4kA<Aqk?XP1DkKAo<=pG~y>9B5BDsM-I5foZ#hDg%SO04HOHIs=2Q
zF!RJK3{YpB2Mv6IRMjvrZJQ~@z`zs6$(Rj_^ivEBhi@}59KOon#=x|n2h#R92ivmF
z05?8`lQ9$2IoL1Dz;O5%1H<7j%nVHXHR>4{jz}^v91&M!VA^j2I{pCaopaFr)Z3Xr
zZ3f8hZBQ2gv3r~0yafZZoD@hJbg2^P2&VmzbMY9?_<-hgh2=RJwfGsBw)cXp`oh3)
zM2CUlh#H9VpMl{>AOph@PbozPrUTp{pF-_D10Ho@VA@_WJ>~$LWX1wyJLDOd_CpSd
zWH=`Pn-)AL016le28IAmMt^PwrX65!hBGi6sbXL_0y=+Ue-Z=3k=YCkN2Y^(nTKTC
zIp`VU+kZ{Jdw@-<J_gw~aRw&K5J-TY2Oni3Y{to0&C0;EV>2@YlVu_U!;viv3`aJB
zIC%^VM-DSE909FUv8-lbIC6!7;m8Gf1}4}YuIFDsHzhKh2kmnOIhlixDFS2~=u{}s
z6|P6#dNME^dCkngWL3w&aO4jI!;xRG;iC%zp#2++j9HAJy%*qP93W#zuwZilwF()S
zc7V?So5(SJqbj>F*O?=bUBEkjO}}%HO-lL94F=G?kxV;5gY}@C1MA71`2tb6(_*^h
zAvT$M4yd|7(160k_pr^X3};oK>dL?p3mHNCEGAw6br2a%VTPTxfa(SvEXq7_AtOxU
z918=}9$yBgoy(z#2I}~8XCP;n?z{vxbpqq`Er-~oB+owq<tUI+lo7$y8=%ajuCE9x
zc?~#VcW>`91oH(zEeiW{oQxu%$wN?Oy{nazfnn#5>9&X2B$(<8riUM9Q?K91c@HcP
ziQZGtT+Rrd%-zGU2GYQJPXki?9hGEYI4Y>dz))YndC!4?L3b|$!%=qzhNJf2UIOO>
zXz_Bif`Q>^fhGe3lM?4+kk}~(hNH_F7>+K~WMGie;{>&d7(ikt7?>H39+`H8O|Aau
z69$H(cQiqV;c>oGU|`zA&%kg@l7ZovD5TJ4JU@$p!F%I8#{AL}22MskXnAlNdXNx9
z2m{mZ2XdfE0!~Iw&<OK?28Lrs3=GE%4l^<^?SUMb$pBX_!pX=f%)qq!q%{N69#wXR
zdZs;w3=GGd85oY)vokR5v1VX6mdL<xERtajWb+Ec=@l#!4?x!Tm%$H)U^w*xbnPnx
z)9xRj=z*Ua%W&EOnt@m*o&c@L;bUNMd#1&}pk2>-8C0MB2RX`vgMlIC4d-P|1}3IG
z9@Ev1vMJOXbAtA<!0Mwzu<@NMpvm=pZ5p6zVuB*L9%eW;gMs1L1kmvNB+eP2V1C2E
zaO@ZZ!?Asu3=AjCIcLJezA!KxdjlT%<D3N&JH^0oT%Lj9xO5N$gHS62)4l>o{4L~V
zNM~Sp!@zLdih<#{nGyrT5+lxKpt`6La^~Xxm5^j|H~}<LF0`3*IX?r_-Z)S}wu^z`
zcmM;#aX%2}C<DXscm{^!v7ln+BGW`EX!<@3zM6o6X|LyWonvfLK}(>41ReyIW?<S6
zIq{I;F!;6xp^Kagg&COk9t9aWk%8fO9s|Si9FUQ75W6xCLkq6G8$c0IG2QSOn`nIq
zvbjhjnulTMk1!ktwRFH`59b_S2Bv*c%nVGR5zXVZ3=GGskw!ERbHEmDz_p+aXddQ(
z9&H3SG=u?d83jTsd}#r+20UT`AFV7kfRErG`U4jg?qFc>VPIJMV0y!GHktZu>7W$Q
zp#Vw&j9H-Zp6r>NxzGmWejZRSi!&FTJ~%)<2F_e<&=p!73=EUoIdj2xo(h2PE8{Gd
zV_?uSg1REQ0=gI!JhuoMj^FT}GYo7hBLmZZN3gMB>I{taIUuiSzu^q?0*OP6iU74z
zR)Lz|y24rv468*r-QilR!CKwHEl2PG3#U7%daj1(^aMF#HAtt{TP+5LeQBJKelf_>
zm0+Eajxj{Fl^jDFgSIHhdB@{9L03L8fQq&K_rNMOV7}IV!>QrKz_kA!M3<Hv14t7e
z1A}&>76XI01*Zhebq6HCIwh1rp$T!FgdGFZ0f}iR*~IDtV{U*IGB6zg4MgSdh`FH*
zx}}zlfuS@c2DHJ*G@U24fFb6&Dg)z{vuq3u?hP?7#26Ti)4{Frn3piN+=Q4{Ft&wh
z%xf5X`Q;eU&ALKL;4VxIqcjTxL%mlFqo6nggWL3}C)tGS-C|%}=!0S)$Hv5ids?6l
zaa~M`1OwASF`m*)hM0671_n14@G6ZMaF6~CxQi46o>hb_u83Jt#lSEnDQ2+%xPu>)
z0`m4*aL3L~z@33%)xT)axDKe>bP%-GC4WcshE#-)qql*M!vJ}0-<jxxFfYt8k3Ogd
z^|EGf^dVSKte1;E0%n5;7NT#mF)-B1M4ttfK5xJSj?w49Y&Hf4E7R#cr`V+G)uWxD
z;eALA<ke^=m{&XAM0-jwFdb6kNlq$fi1rm?U~o<W`!(7hX3CL0(cry%r@;P>1`lmQ
z{2g7+lU!WR5S;<ib{69KXisRbl#hYISqXH%p=P}*8{<Jn3kC++wQP*@U@id-dAc{S
zG0p?^!$6T0Q^>|RPX#nP&2WH`f#JksHpZz83=D5185rz6*ch7_8JG?&Wno}of5yhx
z1`Z`qM_Bs}8)G*Q0|Q4A7pNuA#@GX@qTVntNHQ>3#j!D#Ff!CL9Rk&rAeAMG3`~a}
zb5$^~F;;-esi|C*ASP%n$W#^v2HVAKjFlkqDp1aG3ie`P=qzMoj0L-ynStrBC?_Z_
zvN6Vjbif=Ps|0rRF-8W4_Hs5x&;i<Sm?aq)v`yI<9T^#z>JLXjo$ZR^Y%d<r`X8vX
zy%Emt{>8=!>dzfM4qoxX#>gnkz;yUHSAI?k0~;foI0J*z4;BW7?Y?Y`T;NFJ%4A?;
z<OVZE8JG@l=gLk6d5afR9aeE=O<#0|O<9tU?FAzP)8XG73=I3$u)P2+&Ia{<U5`$`
zcZN-@{u<j|Mh2!M7QA4+cR>wah%_5$4447L-nWMBE@&hb)RCXY%JvXs;W7qg28QS+
zwu2zenH&rZ(^%OKf_mA@Kx+k#vK<61F@S15s15F|xic_iZ)Ix-hbicwISvMf{2ldd
z?T8G))(guJ8a`~3!HFGIH0{r4%K+;F*>wf1jV(hJRB&)GFlhL&Wg3G@3veoB120>6
z1JY%>mCX*O>nImQmmSzHh%S3WkS=A2Hb|leX=~WdrUut$&jCty(?!p*DG66^W|M?V
zltLuD&ao*6?mrX71nM+{viUJ-p#p{|raVPZ1_sAs6jL7fB580+h+--hXJ9%e%~g`Z
z5XDp?#=zism4$(!i8G3+6cnnUB?sKS)AyZYlMHwi#Z(6#l4D_DFjS3VY67bkWnel6
zx(G%mC5ow7j)C#AH-kVd1H&SjD5iR4@a|bq3U+MwVqn<q7R3Y^2w`MkI&L#v{XCnd
z!J8;170?(wXsJmmTNIOu5-6)d9j5_y918=3x^WbfE(cgw!+AE@`rareBar)+u`n>~
zy%NO)T9O66n=5%@6cgz3ZZIcvZWNOpDBe#&MnM=Oqq#tnqft!Y$&FK7nG8`(;6-kr
z{kz9O_mP6Up#kxRC<D`R(8ycWrzj@ym3g2Wwha`bnA~`$%UocSt@ll2U|=v{+y`of
zmr6u29%2LqG9v@i2`2EJ=TVG@)Io`YlYt>%MHJ&92aq%;D1}5Z9ySF<HVXqoqi+-=
zXweQs6$=A{6JHeLSqYE<pw%7mQH&SC`4kcwjJLs|0riUM&UzLGhCGKT#+RZD43148
z*FFZ%Yeq4im1khQ9KZl7mDry}F<y}dMKOq{lM=;vMF|{9;7Y+!vx0%ank9-c40P@5
z%mq=59w6r@fG1I-7=1tyV<*bMbOLg#YZRj|eAeYe0LXrjflx7+`A{zCVr+pUGEC~=
zB+9^aQctLWL54{kkq~8=)Da0$hDlc(q=>5|rI<m6Ne|>F&`lZ!`(&8(VH~SS872c5
zC%gWS43i-!5xn67jTg&6QUoZH3{_>AKxdFRf=uA<m0_|1D`R0`*b*tjWDQHiy!T|7
zY``2*2Bwp8;J}k%(uKr6BoWIn*&-6L!{$f^hN{OhjCa9)s)sa`TV{aTm<$ZeCqV7@
zvqB~X3^I&&!QNzGI6jGi;dqxxN@fvA5L9M?n%?^u7>@5S0gZ>sFy6IfU?>1Jq#rXd
z9KWj$8WfUYyax*S0}Ko&K+B+*)EO93*<={+fpZ1}!wGE$h7;;i4D}4`&tw>%fP;;J
z;e<B>!wF|qP*#y)e9pnZbXJIIB8MC}I2m7n1C4><L?;8oiAuSW6b2c_7j6s;j(iLZ
zC;l=poOmn6z`)%r!w9NL7?v?GoOEPhIB6>d%3LyxZ$Y7Vih<!|6a&M_FewHG8$TJw
zx1yj~0gz}p1H;K;DF%k*i874fNpO(hGzNx~eNqeznR8_re}J<f1H;Mv3=AiCLi>7=
z(V(yd*Eupwav&Q(dGORiNGvcufy4sn*jZBsrqhN}3=CDDWElTLE2on$7#QkLK9OQz
zFi?<T0^Ljl>eGM*?N70?LgJ<U4d}c*2BuS>bu6HzGf?pk=qdcCL6@;2?E>zQfv7(%
z1L|eK?|NeBumOpK#LDYICw4I1hHg`-Z}WgHo@n!cqyYv2874V?2By=XZH~A1GccS|
zU|=`}Ixh3}X$FQ<`V0)GbU~-3orRpx$j}x6Hv!fwXMvb-#(|lE>8vRO!zpJ5hEw(+
zjw1uZsRRawQ*rDJOlSQV80t@zGBBLV1+Djo9E$`p4!Rt?4Qd=iiVWjnRtBasphHuq
z{bgV{wTXe@)CSOb*z61pr;ac%oH_(K*@B^M1E@m+n;~lhg&qe~s$BzgMkBN%(eA;(
zG|dNeOa$}99Zc}il2#GOpv)Q2nn&ic2esg1Gawh!DZmCrS}j0f$-s1`795@k%>hvH
zsUY!Egm?y2d@V@4oE_%6)*TGY8TC=n7;U`*RRtPSVJa1XtNH?RHq;Mo0w6_D9c>Pv
z(+(M!&a!|ODV4&Gv|wm2VPLux2pVN!sA6C`s|+dN^*}53VsvE~_k;62BLmafOrg}2
zdIlNB{gNOKCj&zgh@%Lqy1+Gz3?pcTf-vaj#YLwW7=1Ju7-Dom6`{>5F9rtTavAVZ
z7RKp}3{2<L!Igy!;{-%yA;UNUQCY|^PDE4|GK@38%|cK&!ii6Yakd1=1aNI3!#E#N
zTgWi302d6<+y=U?S-6~qfx%#(4C7YtrO=`bOy@YDxotLbg(1VZNE%cWLke^m#zjaK
zhC`bQ1H=AFGK>MBxdE{I&nrRQAD{)T>@<927y~V!^&7~M!7xY4ddo0|g7Z4)vdmr?
z#waj{E4P?Ih7r6x0aScv|B(S5H_pHS;(*GyIIveBRRd!@xGV$tU;B*=V*<GRp2rB9
z$dX~~;7SD*ZCRqASmDZKkYUUNTfoA=;I~VLv0R*i>AVui<Nu)^4~BSLl!58I5DNpt
z(epBlRp2NESDswbGK}@m5{Hk0!L~S>f#GO?45Jfxyr}*ILjZIiEW-g%*?+-J9n?CL
zVRTXgg&zaMsp||3r!K04nw2t)PBx(6VPH7*hk@bL4|Py8K!(xT2oy{V45y_S7*2~x
zfm#4Ej9%d2VqiFJ#=vme1mw20Q0IC<oGZ@2bcYvm6BNh^ObiU{D`mhp09>$OW?;Gl
zGR&2M;WX&vu{)r<x5F72PKSbIj2IYBr!z2|PPKxcZO#zL1KM`ReoTI&I5Xs6<kRI0
z45v#G2P1=&Ff%Z)AA=u^%y7D$p`PJ%D+4_11jc~!7ic}Li;fI<;r)ea;AVsjqY0=s
z12rQq6hr-C3U5YSXhRi(B|4}I(0W?uM>34y3z;w61h12oVH5<l8|*;sk9nCgjKbm!
z3=ZqSttS~q32@j!Q$6UybLU5(RUB#?WZr^$G8ZGjV*oO5#Xw^wY~b*I57xp4P9mTq
zQ_m~0fm6a~a4Lct1*)#pHbgNnMEA=ua`R*|$o!tJdW%i49+vbtSr`~V36~k1;6Qd7
zJ(qb3wzG}{Y|m3UP*!DQVAv2U^BklKyj#sAN@g>xSh@HKqH?o5NF@i@MVrk*X_k$F
z!DXt<R<JIJ3ERMIo_bJwRtD5~W;g|LD#Mdm3=AewJZYH>GMB)LK>cCU(=vxaDftw5
z=da*XnJFNrT>`BhaN?7hq5`szje#LoR0cfEcnUlPFEbBZQh@Xus>&<?XACxQ5?>4{
zA=nt|8FW%)7Ar9@UGiZ7Hz{p(A{ZF9ipw;B^T-E=7TDgQ3Q!igY@`OdAw{M^5fo<(
z45w!^Fr1zW3HxSn?qp+NXbYBU0Xw_^?73E9&_*|=i5yV>eOw8$K$?MR+6Vjp_5VM7
zU}$jxO~G(0$+WXFFkJ?1t^iear*|_joCY0KJe{3^;q(~>hSR5@Rai?1sHy{vzjJ{$
z(y>As3@sL*W1Sh8E`u5Xtcw}5lqFy@5-l~*I*)mx1RH2oCPSEwOfo3i>OsR(mop&o
zmaGa2MxLUKL<X5mun%}LN|P953Pc$gj30s41MU4F1L*@otZaq`4kH67aIS3A04ujs
zWMD8!VPH7@h=JiWDE}Ho$k=It7KJe|oM8uD(5(qhP!19dO!eo~85quJFfg1^Qz$Me
zW{?4$qyrjwKV!wfaK;Q0g3hQR$OuZzdq05MR!j^`S41=!K#}MGDO(uM1TZk1@dNEk
z1%)ptc$;g$!7C)=%F4iW1++RF6uf5=7#PmP)kB*SX9^h@&OooTVrcGwhA$K7KwoI^
zHWxtZ+$*J^I=2#Da5S$01v^a92~a>YFkJy1_{}^~fDIM{%?}uuu51If0zfP4Ad7S&
z7#KFzFP1TbrZjihMm7^rU|tP?1g4o9BrwmkFfg2HP-9>)ijXnWhX&?C28J`UA%STD
zE(I7E&KzW5II|x*^#C`Lfr06&6(pQ2VBvI;f#J;gdYA*<-+;Uanj+$2Vq^ftwcT79
zT~HE%t_-$=O=Ccu_Y2}YT_vdV9y2hUxesxkE@*h-6a&Lq&}HnPeK$^gGWt;GomF69
zI4cK<YS2=cdQe=SHDF*ks|R&6+#Zmd-$2}~4|Vfddj^KHwy^e*-2_m`gF0%-#gR<%
zV7D?bU7IXaz!1qK5AMN$M+_pF<Us}Q0dO}ol1Wt@qzE)(5Xq!gFUr8+PzqjX63GN=
z$$&fFO`MTTpkuJW9D_%ZO#0wz8a!|i$z%f7Bg(*Ztr=YSM>45GTKkYbS0s}GQlCrR
zi-AGaEs_y5s0AJizWx^EKE`8U_X$m3eV<LX{!Jv~aZn`#DhE^9A{mc^yGjuEGM)yz
z7u?{8WP}V!vM?~TSVuCR2jx*vBO@p~lJNqJv-e6QBe>uM$*3DgGG66iV7mSm-28}S
zyaskW3j@Q#Ly?R(z<Ri*yFXy#Pe1TAl1W^Yf$4fB#8-@`A-)0$%>V}%<0DCEXzi|w
zWPA)Mk3rHGA=2-`(%?Q(B;yB=G{^}C3XzOoV4U4m)Av4L)2;spX`1?h#vVE!MKY$t
z#vX1=1UJVb8PgHX$w<a@L~}BdF$2+@jAYD*H7A|;A{mP$7?^HM1h*z58Oso@$w<aJ
za3G?LJ=EGqGWLQ(Ll#nLM=};clNlcagZ*uL1_pkwNJh{~tQ*g`KntfM8AU*m1ZoM~
zI1CLVQFu$>#x+zSn4wS=pu5`Tw#qYp28~p#uHP)rc$1NV>870!sK}IOyr}@nM=T5s
z@eAb{Z-b%*G`b_t2$`=$syS9~1{s{cL!R-GETlnZ#=y`NB+s}AR3Y93?S#^PBhR=<
z3e-Sg0X5y^8J9?cRB}OVS}MlCU{ap~T5A;{&j{W{a4L#{A$O5H;~8+&$usT%+5aYr
zfnm>IdB%(2hJidIXbhF%jQ~{1DsY4{fO;0`ZSssk;LOJey5kERee#S!;MOz?1A~6M
zJY$3s1B010RBI$BczqQ(LCZs0&7fg04Ig>N6cq*rGf><1@K1ThTxA9Zllv?T45b0`
zjKyFlfttA2<rzz0xv?}vp0N}>#0j3BkY}6&a!}t&c}7*ZgFq*Gfr3jFJirNVX2~;h
zYX~zi82w=ZwPL3iJZ4iD_K|1ghU)?43-)KzS3PD^6F&S-{w*WOC5#MAw~Zmgl#d^?
z={X$!DgPVnL`du~g8C?j-+_iaGycdwgqd|4G?vT$O#Y!VX!H!U0;pa7p*sW9?ab+c
zPuN83m!Fb9&j@ZrGu?*F;mDtd4XU1vl|K(E>fi8!24LjRTY~y$Y#=wwUxW<ix-&3{
zw#$PC?m&a3w{L)*Cx1u*YL}s|{2@@q`vx=%w=GnDJJ?mA);D<gR(`umJt$>xfQ{S%
zZp*VVFl>vJ2PGp0@Iq$xyYeeRDeDeo=vICu%<TLf@+++nx>tcme?j)Fzb`)noSPY#
z?lgfL7V<Md2e$m-0F4&P&(H)7Ub8VU6n4qa60Zj-0yWUspUKaW0y!Jp3Nuc(VPIG=
zTfP@;HE61b{h53(I0(UwUipdO_ybwDS4X}L=B;ZG>)PZ&kqZfnHZ!oH1`G_=cJlR5
zg?Gg{7#P+sldo5p{`e`INc|i6dJ9l~;Q)<P$=5r9!WlHBsq#b~vL6uA-04Vw4wLwR
zYUsN!)j(}Y`7&*=4Gd=k85qv`Y80gwGRT+tGcaD^W?(p*$G~tl1AM%Ye7O?H3I>L=
z6BroIc3Ckn-RpoF3p$;Mfq^?vzLE!YyU0uihO-+O7|yN%ah5VLoIT0FaP~Nevyp+}
z>@x<2v!J_K?(Jn@ILE=jaE{5Ef$82!Xw$G`4g=FkV^Gs@F=G~J^kOk+FJC(IV#W*x
z@J^GdMe@0zK)uHgNdll;R&Tl)5?Hx5V6V6{Fl^<JPlZO}Jqw7+R24*Qr-9Q7XocI+
z3Gxx()fo&-_d+3|8leg{#ejh!vrZl|&kFJ^MA99Wezf1nyX%8OM4(ijfr0CZe6Rqx
zWxDvZyb(B>7(sWcfHh5@{G3g>{*An`I7mGtlEBAFy#cjT+S%k4z)ppPW-WAoFl!Ac
zlAiRafy+PzP${vQf#IA91H(BLNW>}FgWbt+ZW05-xhgeqCQvj1=S7C|{0t1|{#!9H
zoy~(7TUQU>pT^}buK^m1I@`d&a6X=a;XJ5YdbXE=;rvnthV!7?e9q2dV7S1`z;J;X
zG|si0f#HHD1H%Q-ijA{d7#J=zGB8}I2gw{{V7M@uf#E_wh;xpC;lf%5h6^h}oEHoX
z7fvxSTsS1pz;ve_YQ0ZAY?8kY)KdW^L=hRrsjLi4_d%<}?o44|xbTjF;ldks2Btd;
z7#J@6Wnj4Q8??~toDS3o@CnUanKF#C1Q?hedoeRGowH+LxG2QHaFGkd@n&GS=*qxw
z(UzTo>0AT@!^IK?hKmItPAUV##rnw%3>UjWydnmMi)R=ZE}j5!>KPa=er8~}_#VXR
zW?;A^z`$?`bc^G;84L`U%orFh8G&S$GB8~7XJEMG3*u~IV7L^|z;G!RbUysK{SfCh
z>VTw9Ffd#yWMH_I3*ua1V7N4ef#FgIh*N)`f#K3g28K&V#Tl4xLoQBZsH*_2T;Xby
zVGI>vV0s7|biDn7f#K2<28K(ZOmh1R1H+|%3=Efkfr5pBf#I?g1H)wz(1{n_5NqpT
zHvlq#SfF5Ku#w-R0y;2e4g<qwI|hc!Hi`_)Y0K&vL&4`&XF$h3>%hy*xMs*OMu{>o
zJp|nVmtn%da5;#9;c@`d*h3xo$}FxKh_Q#uNem2^6F`PB%~pfBq8@zYI@f9$##liH
zriY*_z-F5<FkCKTV7OcWx;*0C|9S=nuH6hw55KW9Fr8;%V7T1Gz;L+%+V5zX03N+y
zdI-Kas2JWkX}AFzLSzU7jSoR=YTN_%BLhPN1Jff}kXgbE43{S}FkJ43jdIp&Ffhj_
zGB7<d1@%{8TNNBXFx0z1CHz5$a@8=Hz;3ExsLz4QWHB;kvDP!xFv!78+XER`ebhI-
z;5D06ef<pvrt|6yOpi8!Oo#M_K)2FlFu`wmVQAohc<0e6kQ&6<WepBc@#l<;S?o3S
zCMsnNO0e!gLj|Zi01c4F5QxghJRlPq;3Kk)^(9aV@Llya2#FqWNHIOO0cn6=Zp+ZP
z0IVJ~WCgk2jG@T}ba+4485zd;3Jgq-mw?8l{23T7Z)9M&ycWcXW?;B{l7Zne=(x5!
z=?n~)A2TpqzFW+|bf=hsp`PnLC@GdOFn~6YUH-!Wj$IB02Ch#GOi$QADV>vn;ff3c
z!xgbG2BvdjkZ5ay4Tv)^Fg<<>QYFs7aK)N|;ff`!2iKGW3RsZqiwi(qRCu7mVxnmZ
z19P10TLz{lkgdD$BiWk37dkO8J#hqW_?4`0x&ShXf$0foEF5w~9249$XaF~X2B)JK
zn4W-#!VxL1nFE{>K!@OnOb)7IWMF!-o;R5xs0y@);UQ>&d_+(kc;!0i1Q0*npln7P
z28NWIK@p%@>B&XVzON*PAjn`U$dnZtLH;09UVu#TmjF-6Dl;%BGXyy?GB7>m1_?U}
zgM`^Y!`MM?;Fcn20|)1tAU%+wPd(Wf7-G4CK#e!>;`y~~LB^m>{h;~x`949QZB<}#
zy#+z$0-(le75Mm*@L&z_DNS#fL5HEF{nbzhom>Lp1wYhKhVW)HGBEglo0<=zg?*=H
z*f20m)|u)GwivV&f3opZSCD0(72g5vQ(ZwT<PWkjFsOZ)>IHFX3<HDnrm1$IaA3YS
zRg<wE<gdpZ3=C!4rfPzg0Dz|booc6Qf);pGfx?8(a;iKd1Jg5e-u$#QhN<$P)s)M4
z^Ya*{%7Ye^gZ9YHtC$MDzzXC?yMt39i}cwT7)~CZstnp70unFDo~mpHYK?)+%v?HE
z3}j{iM?GkX|5P!MZOa%M85tP*Cr#x8Rmsa@7#JqKwX_1=Zzktv30b7X!1Qb%2Ll7A
zk)?zHXjlS#1dXMH6sQfw!N6d!$P%<tn&A!j6a-6Yke5O3OPFXW17e?IV_;Z((^3K4
zjRU#kXne9l6v!dh*+3(b3UMG+Z$L7~Jr#UG5+5KEkTbDCsc7mv1qaaSF#*O3kR?|P
zOwUEZ_9>Wvbc2s%N|~zw3bW^d91IMaT+^jLuxZ!ZFfiC3Q4j~k)$?+&xPmx1z<J9O
za~KrFK}YCSff|C+9~JmPAy5U$jlr<75F1b%<N0$nkdX@fpgvI*1H%;`28Jsh(0mfy
z!@!(6g@NfgXmW>hF=G~IgCfU&&^;JT9Q6gTyc;}+fjJd)y9E<RAp^*-d%M^_Gcqte
z|Ho6t!2T5yICB{p7!oeBzW_Pp4d{5UMGM)_fH@FXxxyAJUjVu4rKd(xN*V+E8IXtG
zFfd#J6**}dNu|XM>}No6`-Y*O;mQ^UhAZoW7#P^*FfhINu29Cn4!YVEG=+NQDg(on
z%XSRRiNX-$-CSU+qTOIC+!@%f^D;2KSPHu0L4|?g$`b~LD~}lL7?=~TL-iEECJ5bN
zLB_y-AEf6d=*HB97YqznJ~J>}`3MULw;0et?u?9CY{d**|H0t|N^M9+y1sxdCWrf%
zf&CmO1Jg^;bzUG7uQD+(T!k-GbW>npdIh?#2gyV`@Pb99`h50HETHrcajXmMc(fm&
z@Oxzq3BOIC!`GHEFkF>jV7Mv-I#P^}eG@nbF)&=UW?;B#s*#*nz`(u<)KjZsV7MB`
zz;HD}A(Md}vdM&j;VMY9LKC!^i5)xy4l=Eqf#GU>J2a8F>VSOB!1VGJsQ3mg-Opq+
zgB9DZ4ImFNFuek=?ng{6y6%9AE5J2@7O6rz0<Kp;vPd$F;B>W5mVFf?1JkPnP?j||
zVqXQ?)cT(TbUp$5Ds9lFHc-jQF3S!cPI$GF7o3Jbx4<%h79w#PO)vh;re812J^?A<
zoWV!eFfcHH1MW>WB;Y21j0SmiIRnGh`D&mdf_(yLVCxhE!_}({3|G%WNBmqsp$Tf0
zlrS*8vD9Q>IQWEpGAM-_Ffd&G%fN8;w=@IOw@7FtxiEmH?%2ZEr*Secy$)n%VEUHH
zz;KO+f#Djc75lA}f#I4m1H&~%&=Bx<Xxepg0Ugf8mIl$(#>~L<U4?<+nh^uTH3JaG
zfPvwf8w0~N7my~nRW+cACAKp5>0%5_uXn?2ie_M_zXm!!7;M!628L_<KuJCs+AegN
z0!#8P;A1Jlm&i>QU|@O;I>9p8l!4*ec?O1SpereoofsId-D6<5b_W*ME(Q!t-<lYh
z-hl48LW)h766olxP$>h)AF1gtez6JH!~C`Zw9=WajeU+h$SWX!y=7py2HKnO9ptY+
z3=G$PffM|(r|k8hzS=TKP&z#T1v&!*qX;Oyzq<vAwt7&>y^Mk3x*!9?bxugMfmT9+
z25PT6GB8{>helhyGiX^H$cP#Srgxw%z6YPMH$mg=dI1B&^*p3_bJhU|CIfpbCj--4
zVQ64puV-Mm4m#cl6qeVgF)&=80*V1xv^nd5qfG#!$ph-W>q{9Jt}kY;XJ7*P@A^&#
zhU?owx?u6<oC3B=fxS(Pf$1&S^h^eZ>t`4kt{(&0Tgt$2Lym#rh735`0w96m47(<f
z!5Ms_HaOba1Q?j!$ul!BCnqs5+|XrUxS`F?z?_`Vz;MHcp`PJ}l^bFj(iwijo-_EM
zK2X4LGd6?n(gF1gZg?{=-0(zPInCe<KWY!59??g*5yil81Jve&mJrSokc9CLye$~K
zh@TsDV;h4r`2No6_kXcT)FW<;WpI7~4g&-B9zh1CcPpS1qc<`c7;dB^bxxcgfTl*+
z43I2tVPLq?!~i-;8XgO4zzNKOy&IOmZp>$3xG@(L9R>^xH`XyQ+*rfF;8V}QuxAx}
z9w>#Kf&{7uC=fvS4=9CwNP?uWJZK8Lag>4K#%@Ro%Torm9T*sH{AOUd@fn)JJU|PM
zK-w!9m_Eou3Wh>x0=uckz;IIqDS>$e)PudemA!<Mf$2TyY;I7&aMP55;ifS(+Hd+W
zFx>P4r4^XpJOaQe>?lOjc954;7#MCwGceqY1aS-)7;fe>Fx<=qX@Vs%j}EX+SJ_L&
z7?|F_0U4gjz;Ls^j)CDO=;%;TV!k<*f#K$4SibhKfJEO1@S+_=YuTd#l&_&nJUr%r
zIxrxM;I7*N4*93-Rq_l>A3{J50=aGp1H(<wonfHle{(Yf!_AH0K2ZIK4-6h3z}=V(
z28IJA?6J`E4;^6{9Xw6<$pjJ&vCxX`<_QLdn+G7#5UUD_hMV6Q7;e7P0JVbHWA#8)
zBm=`O6$XY|GSH}T5&^{v0|P?=1JfraNYvCPK;!0?4+Fz3FQm9}0%v~KUF^x63``$E
zXUT)2=2kQV!!1xKgTm`p5d*`m0%XrSfipkrDTpS}slK2x`&J_Z!>xKyNEk3M+?vY3
zaBDJ16DVrHbE!@lptxbZ#hwDPss$Q1w^lJQ+yVs|$g0~C3=Fr$K$$-Un!B9fncoSP
z`57Pv9A#!;P7!8cxUIp!a9a(;QD9)WZO*`O8@`3gNdXeKA4Ttis#|d01ZPbr@HMTV
ztSJL4tDTmBB9!$NdnPO^-F9POxD7fd9~7ClLm3!u2ZN8VOxnlp1C2fh*bW;BP%iqi
z84`Uy(CE9J#lUbIbW$p(5xWmG`fkr+V7NU25`8|Pc1is*28P?`85nLKhsK}78fg4g
zFfe^Fg~XpfH2Q9TXJEMf6)E~0j)227g*}Lqf$0-0z29MDV7S8q3gA)(hC8wh40ohK
zF#$`v4&a;ESxdm0>OU)jqD+N>;f@Xi!yV8`{2>3{abRG$V+Ya&ia*d?ts?{2sup(8
zwN{_QK&EFhFx&}dV7LQ1V+$00ca}0R+*u5cK0Qb=<ER3wavfn!2?mG(KR_{N!@y8~
zXDb84oy{PgCj-NsBMc084uQ(<GPnUOa27ORxETvTM@@llnZI+Hf#J?Yq_W#l1-73C
zVIkzkdC-OPcOEe?+yP}dXzFs<!Jq)H)xUtxoI)fJhaaHa&&Zf5R5so2JDYet%sCC<
zK$yZFsn5Xlr4dwkw=*!@`N+U<=RH#4?brY+yjiCpY`)9Dz;NduO5yG315R;E*dt&m
z?k+zA!(Gsste_aUE62caR|cHoB+k~eTSJqaH^})63=E7spd|M#5|ZSsp-JwpDFee@
zZAgh>4NY=)vl$rfCPR{(H7LoQVqmyCkAdOt6ljX`L2500<A<a;J7|i#dzOLW?rG_I
zL^IC^Tw<^*vpaG!Fn!I2rh~h87#Qx}0&z+i818;%V7U7clz3oC&Iep#up2`(Er6!D
zdrS-r_ZUDN0|thBVhjxTL_nHgDb5F6V6Z#0J8{-CFnzrWGCh-l;hri3!#!mXr<8%=
zo(%)TJu6sY?jr-q@L%6T^E<Ts_5tU2X#3lz1sb>D{YugdOmIgo07VFUFuS`v1JgHf
z&R1bzxaY&ba4!fnCJTy{d(jLG_ab3^BA*MOAt;btr3?%V?hFi@^VrSUK||pncYyZt
zN3feIfYx$zfZNVyCLlJb+gfvXdd+_}85dzl{ON)eEn{G~m&3qtFGGoeL1QAjz8C|8
z{R-GQ?zKA<z#T-;)I4ZK>b-UbhI`F=pibcQJO9}f>p@Ok&A@PPIe4tTdp5f)C|XZ3
zGBAC&h4d9<WkKhDg1Q$*?6QypoV6Gj_P4N0@PV8RQkf1>DFJp4M5P31R_GLH>;LXA
zfuQL`rteKcph?$2#vmoo5o;hRf5!SiM$o9wchJEX^D+Y&ounBUE{m}+Fr2aoWb_2}
z_1}OLhRg_LGz8fMng<7|GelNr0Z}K(z_6z%5HwTB^!+W=E>#V%U6Kq8=C1-7r5PER
zesFMtR{R7qN=q;>T&@=bZHJMV8^|aGl2eAt34unH!BQ*U2QqSkq(F=KK{j(jq?8#L
z^aBF_fn>tL$FBtbQvh3~%)l^XYv4DKL;*wsba<hl9cVkqg0F#~<vBk(Arf!o8R{7z
zGEy%CAA__kg2+6En^njXcn&17n*;3Xb5fx20hy)rIq(=r0<_&@US{Ai8JI*$bKpLZ
z#9N4teQ=4e<$>E68JK>uK_s?;B<jULX3fhBoDP!FgxEe^4&)P_6o$ar;Q4XTi4tmc
zfyLmV2?nO0Zs4Pe0!!hNstSRy{eVA{A!dN4p#<$fIycq@!uFH>oB@%HhgeXQnm)aP
ziJhnZVPFP7XrmIyE&D73gF$Wq9ZEGXGcXtwOJGMHQVs--7X1WmPMDV&=nD^turq=7
zj0{Y_I3WJA2TOofMQI1Z53aGk8t4d0k#8V#yWllxVP`=0?coosHvwr^glGpHlW`er
zVW@kcHb}w>BB2d77o=sSXdr0h=@+QaJufp*UKSMeP=i5>!B&cbRP6~0lmuySgJ_pT
zSG6Yyl(Jd)6&dS6+3mM3WHAH7hjbPO29In-#*5%lA{GXQwR062FM&DWd3{C3Un~p^
zcAScgFF*<Zlqdt!ue)4HMGT6JH^dkiSX)3>z5V*Y!oX0Rpvd?VG>G>GB=lRBg@GZ+
zQIYYrB<T1V7SM5+ij41h8R{8?lvo%THmfKyegNhED)3@ckmhfoQx4vM5BKm7P-NW6
z$iVd51Dr<`8FzxSASnAt`YJMR0!e`mcA1x{$hZmJuadqXzxo#_GIoK~?S~rC1vWxP
zj)7qj=tz(y3=IASAZH0FGEM~h7razq`aBkP$@=WWij3eDZlE0W`@T?WUJ8REV=}1O
zdJ44YL{V3fF$$DI!GZao6LeI(B4ZS2OcyLa>98VWFiidr=!~E2KZ=aOpfQb844~b3
zzDbIVj*R9E46b5|jQWfWOn-dfF~XHp4+>sWA#m`53YvaJMk$aQP-Lz9r^pBy`vm#Y
zgGrH*9VFEa^(DI`D1E@q0)^O|I7LPVkeba<H4KoDKm^2`I8Yi|cVF=<NZB>e81B4G
z#jjvx0-%c!Z4`flu4QLni11Z>08#_mzcw#Z@c~!~8w10<cty|<HA5B1pa@6B{frDu
ze|5o$QE@+#qSN4zh9=(+OBfg;96>s=G!z$rbi_k+)Gq*QK~k2b0kLEoSU*?`mtsFi
zODjZ6KZXu2kgA$?#X^v(RS;E$U{w&KKpG+L&3vvH4^ngiq9|Uv9u$U1wr4&EnU#54
z5mZ?G1r4aq%Tx@8nKkL6B6wN%DUhNFE=4y+2Bv>f5VPEn6oG4)Q=k#DRosf;I~4zQ
zfl7{5ijdV}Yzz#EGZZz!3tT`0+d=J$;DfV4>`50DwPE@1UnUy^1E;d0F(mtlGBEvv
z+;ymE1vxtgv?4<HwxSI<=Ygx*mSc+G-EyGh`fmkzd|FWwqTQT<LG*qAQ$8aD(|;Bg
z&^TKFlWGabF3`G~qjmw1y>K87=fnV}GH?VyvdT4fc6FVF0Zb_%lin~e{a5BHPAy~z
zU`hjNf5VW)z)))uz!VOXj+w5>!LC!kH-O2Pmx1YjKPLl2q(A@@sBmR?!<ESpzy#U&
z$HKrM85_Xl57Ae_z~H_)fbl<@IRk^u{Q$;$AeTatascB!Sx{7gQhDsz0LB|2V?pbm
z=4A#j-cScgA;n_sS&%xN`g;M4XF&?TfwMyZ<5{pmketHH0LEjy49pCIP^n{ZDe*@E
zj2l2wpzAC_#&3X2@jee=oD7l*f$EwJmI8-S03+m{Adu;7M*=|GV(Xb1K%169X7qp+
zg5;F<1u#~E%;<ueQHhW;3t%h+NiBs+6~d)>O9L3QK~kWle;@<1;Zkh10gNdiDOhl%
zz@+LK*a`y}O?erZ89~Vlq|Fp8$HKtiH9de4GNA=p>a-|;5wv;(yg6@=ZvdkuEbh6)
z0vIhpGXqs1w`Uy;U{nJc7cZ2YQN$3y2)-b_ij#q%Y*7HCnht0HfRllNwK#xL%@i_0
zCdt6ys2RX03DQ-?m7Jf$5Wpx6HXUSOV0r)}7f5O<S5baBLjWTWL<)46p!uHwMpj;B
z28Ko10Y5=%cJP3;g9;=_ZmxV1@ChVwmlv%06KDxj6)#xPC(x0F(=Twbvjw#TJm6(u
zW@6$2JNXgV0yeOVA3-K!lo=Q#o(CKODN^SFn{*7U2x8rFFdLNN^Y;hr1}XBHuEEVN
z>lPER8pJE)1)IAXG-3^!EaOTJ03V{e45Wo;Prw3@qAt)Z-J*a6pq4DS;Pjpy&;^p%
zIlY^kT}reupbOL(2TN%s2GoM2?oHpt%`Rs=A)th}g^_`Qi8CMv%*d4rNCO2+rD1?C
zF9S2P1;hcqpcy@o12~PQbMvq(Np><aFwCA8-~rBC$_xzo#{$$r>dU6P@vy7b+cGeO
zS_CL^gW`;VnRzmJC42y=rOL1j)V`XxAwU`?xd9?63(D-v7(fPd2?U6NWkH-h?g4^e
zjyVIv9%U6q6GjGRX3&YT^D<Q!O)#q|xfT`1dR;~aW)?AULRVqb1s9%3Iasa*lsrP-
zt1v2q)InOwDvZitb>Ol~g;5pa97zU-kjE;ZhBh+`X!#$=QXyn@B4BkapsGuSQ34vB
z^$ZLl*Hu1%4BrDTz*Rng^{|1;MHTRIY>)%lRX~LY1E^%47q9XYtXqJmj6vl;C|s);
zKtVP0hsq;R6JQwwGYe>I!@NwDN8nZ+)I*@13NwE|Oa`~DmND4WGcfdiQMts($iU3X
z1D>c<0j(xvSO!`cILSxlFxWtltP{BBrg9k6BmvE>Br&KQ2KAjlv%T4WR1SmMpWxYE
zx1%a+KpIjY{#k<-@X8DfV)iOaK`Od97@`>FWvVO%dl~9VP#rC14@$N3TvcX)l!4Y6
z&dXGpB@HTGA<hS1kP1%P8V)KAAVu#WwlyFWO+U!Tt|sZPlFG=y%m!&0sH7sKr}49^
z)w8MigJdC1T@`<XtO|I#b{VK*TYpm}5|l%ifdiQ}NyQNyCJfAM(;#*_q6ac7=r~wT
zBNcaWjDzZ5(-kT@pfG0J010DLh>V^V1H<t^6)~`ZAcy>e1TtuA5+kVMOJYzF0}VAp
z0(tsnes&d3b5<rdMh0ef^=Sg^3iYO}j3+=Qvx6$AX{@Y_CqT3JRV)k)tK?W2A*~-4
z1_sxotcX?C8P=>!s$vYx?3+Q##91MW$3YeDQ9D*9P<w!3nJ5D@`!p5?hGkn=8P7q|
z7-%K0?JZU&eJ~faP5d*f0+Rul2VMrL=Pb#<AohioaW}|)_c=k<PTw!UE?Hm6%DA49
zftiC1EXK+RIt-BE4X9Pm%D4&A>@;Iwn7oRWaSq5c9M({Eb3myLv?@E~AS>fSaG*gn
zt$=8XW?-0il9jQW5i%SmmH{0N106QU%yB#w<N{X4?s`y|ykX2zXJDw#VrA?G1u1A?
z;TQwMy+f%C3>CXr8M{G;;Z`wbq%tr}zRk+m4Z4MI8DqK>1H&qDR>oei-3$!(o-#1p
zy9*MOV`c0EXF~=CkWcS3gI4w*HDzV20?jBaV_@d^$jQK<{+X4rN)ohpw~8y1ft3+_
zk~ny!s@q-GZy>*Na)VP5>o;&d0bM8%m&5u5<{{XW0%+!*ne&z=14FYE>ob_WCJYSs
zjWih;coJBj!^GSf8192QgUA1|zJQ6zwK6c=Zv-Dn#0uVX{Dy(y{u%~``>XUAn7O^D
z7Ynf~%ET}*+~32%aDNvw12cC91H=7u3=H?rtOp$)Av%475W8}H3F|$Oi@6vfF1`oO
zE=bvyy9Bfm%c6nx23Q%Wew~-edIPKsBy;ct>jkikDa3#a5E*3#hLmNj#~B%zx%?m!
z$KeuN8d>*&BtX~RM9<4)-3O5|0^M)Qx*cp-BSg=3xJ=+a)(v2p*$|lx5E*3#hAoDy
zi$SKHfk-R{ORzC8#1u|nE6grYFTpwqtPvEz^D<c{f#pF(k-rOTH%KFB>Umx!Yd1u~
zh=F0#CDvw;7H&z1k<AbpWd?>#$5?9^8JM|^AQCkQiCwIvAPLa1vhy-oOCb_k3=Avk
zD_L_uMZp`8H0X#4_XgG+a37Te<VMyUIR*wHB~VDN<YYAmTl*ejx;fYo4hDvl39ROz
zAx====&&rSIcR7TbYNrX2UhT|e9&5!z57@}`HKO>K5EAb?j?ZO>h+&ly}(I^je#NL
zAS?LP29U)5aMol<`gdnwVD(@HpYK@3z{~?WZtJKWt0KsaAcY|ZSs^ty8w11sa8?zt
zCN>6!&=0KOd)q;3_U>Z^Z(ISf(>}98N*mCX-ksL<tisTAFA7^50#5fl#cvra7+68I
zG{Z7EP%o6l$&Z<hk%5_~3(@g3XJByK?Z@;KBzzNGq5CmC1!pR_8WskIhFN}0kbD6u
z&N|xsm_C4p5UN1D`qgcIOrI4YN3(&f@v-+~x(hPzFVwudsOEth2Mb^LG3{k!VCD^j
zs@baqs;4+1R_z6CE~<j$5%7U)3txcO{`)aq2kn>n>&J8!e2yl_diMIieoV(CA=XPW
zFid9iV_E?+8C3Yp%k*PffnL!}W`peE@nc%04_Z<NKK;ghnjh0-kT%fb4Uo3UU`KN@
zFtGpiW16fFHeZr~!QiAHQ!Yr|U8uuz>&2li2Pw?eg(;NU>Bp4L$iU1e1XY-hY+yRr
zK!^_+Kxd~)?F0pju7@8}G)NOD*@0XUjjSmetO=yfq|1*f1f(vXlcAmgq%Z`WmZ8oK
zF$B2+X8IBa29qw3E~kxtOnx9;pgUhcn*5M8`Jroa+6dA#xzCTu1EdL-Iy{gyc^ER(
zGYIn|Sv9#2q-$@1ACnU!12aD#)c24<T&Vk;(5>2A0M-=i$7BQ2<P6nhgKU)zhNf7M
zCWC-geoXoxT@_GW`p99X4-PY!`_dU03|4`38FTo7PW@o!KMB>Oj?gr{M}l1fd~XLR
zVvIRJsZ95_ACo3%UE)D-YSFXvV^RRw3979?A*q1S?#HA6wi9HH_ANige~b*w0zMFH
z82=%uWBdnJhvYWxTPzF=GX?#a*f>Fj0H_L2`8{1nl3lW1#g7qGzzH-$4FVnXbQzSl
z+5h@6zCkxgPX%OqaK9fTC}RtN_TkRU^kaOA6rPMv(Ze&iAEZf4-jDGPBLlM_E7Ybt
zAWii!tL}hxL7d5W58+Bb#{1wx5aydD3=CrOAoFU&{1{Jz%!72h{TNS!%!3(s8re9=
zv0N++3@N|;7(v?}7@%bU!-x7M3=FklVDr5Ez%3=g#ZdR{Mm7(0SEw*Q)OmZ6od;UK
zh%gUioEOMA0|!6GjUeZph8njKIfgcZ1C~LOp`JnauOH(okiySUg`ibc@E8D<B*Oe4
z1C5;h7(vyg5NH)7D9{%p8@L!|AcOt~KgOAi49r3SQ1fOYtD6Z{2Mf$}hI$754<OUk
zPWv(Tf^>n-&;*&@i>#{`O&5dOX^<x6$9|0EAWgraR+S@bDo59({Fo~_qnN>uu}O%5
zL3uV;UQRN@^aIlDCiUWej0KDg%)$mxa|)2nDL^+zP8?*p+H^n0OpvBjsHRM0O_}JL
z)TV<q_4+Y_%0Xe!@;Z<=!Q~)45kd+=u9W-&20zAl@L|Q^-JO1n;2IY;pbyHvYP}%y
z<X!w2LFJ|JOQ<74kR1_%?g)7okS5hHevH1149p^OP)+r|$hv&db*X*<=@Q@T#|Y|a
zhy+7*xgl$EL)Rp}7o<r+*N;&cWEH3z3G%NnvL<1$Ca&b^g|h6X5!rwI7(v69h{T-E
zz@VTDDy2Hw{1}a(Jqu+929;ZW-x(R0ML~zO&CB%r4mK0C3Fxoicd(I&^u?fZYx+M~
zc4MjRKYpO@6nLq$?Fv6o(+xbZWUz0#w;a1<{b@f&UU0SoHSiR8{Xm^?(RtwZl-~y=
z3qF7?04Y-0@Aneq3ebs-^D_NjA}M+aS0w+_?-585sF5)*(+{)<^|BbmsgK}_RMz^{
zUuI-r76a|<nwRN!8Of;2U{yS241QO^<q*hb`I~;A_OVzZ#CgY&lplvE2dAKu-~<Fd
zE71>91R;fs{7sNa>2ZFbJS}!u7Gl(5c~G4Xao=K7P-P3ck-TAgy*#^kJ*(d`2?l1d
z!%$N|mp`S)L5$xC2|7Lo2G)1V3=Cm;eie)i%;I$rQ!7BTZ%|)X7{N{Tt8f6#w(@`-
zTLp7$_8&ixHdsV~FUA114qX+S{J>XPf;a~I{6G~3!!oE_E(e1woo=SUZc=~R4}1vg
z8_*yKznot-xDCy~EItc#=%HUW_-Id%T)3&98|X5E*$m9$py?;}zkZ-3EzHkTlv>Q-
z=K(GxKwW;;E<Zm+;uDneGh$?5mSBST%?Mmdb1*P?xBD4^+S>J?#<sh*pOGbaL8>wX
z!z>*?b&w9wCd7G}e(D;~Fjl?erw$qs1Wod}Yx}8tfHbf%FbJjlX~N@rX|10mNOKLu
zI!SP&kAs0h^^Tt;XuSwjv!oSFb8xyJsH??L#Q++hOZYxbhY`f6u9>FH7|Fnpp|8&f
z8jDxvhjfxpK(_@ldN9smV3vFUK9OCYQ4)G0`~6o84EG;Q->t~5;PgO&f#CsYJ$%Pf
zeMU9VbbTn(L=Gtih80%&jP}q&%^x^1Fg$Qzg&IBsynTjQ(gd^spqK%CSakh~4Gf^u
znVBU)2N{9Zi9%JM6aXD7%fKv|0#OZHvT)LZf!XU71G8i&NPHqE(v6O(5pYE*P|XWL
zii+V|V@`H}&UR*CmOKqQ)7p=bF|!`FULa)xBVz{BL<87Tg_CnY$4NuAgH|ADZ_;lC
zryhuJj)0Do2Q94>00ot-sT%0;di_=zP=aP)co50J@W8(Sl$iBFH=!yAGf(Ug0NqI~
zsNV_69t;n985kbacY?d#`k?s-&@zPw>lhdwEKveod7(cA7ODz4Nr?>lp!O_i>FR@9
z3=9u$XfiPL)$1RCBn^fK9~l@Pywqf1$jj6RUkSO4f#IPv1H(gcO$LTGas3k@J3(R=
z3=9tqKqnFZW?+_jpvh3rko`yh8fXmb4Fki&WCn(Z(a>cd$9+Iy2-<%+u|t3Xb|n09
z*vfJZ24-n)x!j~827N|uaRw%%^$ZLTyBQcBc7pCYcY_|aaHIq@>LT<)zf*vLS-Ojv
zf!Xa31H;4F3=9uvGBYr{gJ$<0u4Z6(xRRZL*<FNz;o&|8hKD=!7?|DVq2W9Mwj%1t
z1dv%E%wog~(yY(G@bDG`!^0aOjx__r!&eLp4_`1a*fB71K^L+dy#dpG6n5f$j{Y82
z24<NgW(FoMBZhj0hd&t@9)1V$R2di^aWgPH;$&xF;<9I80F977lE`IX;@5?^<>(Ct
z=!I)=(^&Xf-MOGi_UI1=CLTuyW*N|?Bt{eDlvx2wna4yJn7tn}Fw2;Ml2#c5A1u8c
zvteN3xiZ~Cm0j6C3S!;yIiST;!u<N5I2o8_mVmY<q%$x)GGbtOWB}q6!#L~=%!&03
z43C@{7#=yoY&voPlHFuZOkbtSE>(Zz2_&P*JcPw5%-Is4h-P4x`Gqb4x?u1X1GB6=
z$gSvE4Vp}jP5|kK=>!dEvP{*_0u4aO#(?jJ(Juz~V(TG=Gb8B46PBr<{kEbe`jOxa
z#lS3E0V<C5BSGiH9tIW1?h5*HP&qj%u$-J6=-goNQM~#JU=zVr1^7I6<zVp8sXllh
z0W_px*s2ej#uQQ#Wnh+l2tLPCOJ5J1%Gnqgnr7)6LW*#Z^nb9lzCA*A`WrQNiTb8l
z`T-DCpt~z<Ralrxz%GKs%^}c`ASf+@OG>#3Ciw*nEKDU}M=~%xieq4S6d_lXTEf7>
z1e$yTW$i~b3=EH|q!<_~|FJMtfo81UFfcsoW?*>K2@T6bpe#256xhX}`#vHW80Olr
zFu5SCW$Xo6$-uzC`vp|$=pKbw>!Jt>8wQ3)`xqD=%@b!});$V#C1XDaXoZ%bAPZBp
z00Xm52r~n-?sW!+$LS0VkNw3Nm}Wz^1T)TX0HriRM;0av0S0Ep3(O2m^|R|37#?3^
zV0e6qoq=g~Cj-OdPYeu?KY%z>85o{0F)%z~P-I}5y^wk00|t=jS_XzE;tUK=L_wUL
z3=B`y85o|Zf;dMR7@k-%Fg!5@slUiPv567HxXV286WD~8OcOa|8JK2&WoKZT!^pt!
zB$$EWNqt})1JfK{Q_vOF3=D$749tq4ZOC&#h9)yGJV^v8HfCUWQp~{cq!7fhXJB~J
z%E0iX5ybIkV0bd0f#J#QFb1YM;gHan1=<7!3cwx)W`%572BtX?AOgB{mT{H_Xy+0G
zvw{dCV-`n!sWH$0|Nr6F&N0q%fl3>Jq)Uy^WD}sW0bp4}s4OI68E4giWWh29P#Ms|
zz3Gq*!;G`QOWXx>wD)i_Fe@wr9prPSo`K=Xb_RwgTVY1LU|^aV397bCVbvMq%mW}}
z8JHFJfznJlLi`3)9DFSUd^0NJ%nwj;@GX4sJ4_j8ae%}@W>hi23~^wb5y8N;ZyN)%
zq5^0SCivb{M%YG6#u+sXO#9jxm=!HR+Tb-T<4hg!CNXBk_~~|9?6QV4J)rzH(01Bl
z2F@QUjEtEarFzg{fRsUuGeMV1PGMkHTsyr-i(QVj0i<jCdM$RT`gM@V>u-RT<c$5`
zE6x}gm=ai+3<MaMRSKCInAYuMV0dzpf#C^gtLi!s<0%8flgI1~OzW;PFg*Fn!0_ZV
zi1Uzv;VBmb!&44L2Bvjyp-Fe$PX>mkatsVlW!M>**0VA&JT+iocnaFZy<V`Mf#InS
z1H)4<MFytzve2}<UXyuZD<~1KH-#qR^^VLFTfic|OcOak#zZnOJdI;ucp3%T8ooXi
z;){s~>=>BSAcsUUPFMon{{>=!(j^0ff=)gw1GCZxW(MYTP6mdj^$hh4Ps>4Dxc@RR
zJl(^<@N^5LW@DVN0ko77wB>ev9Rq`44Fj|C5|FhZ_ugY*czOrK>1JSf`j&y=>1z;Y
zIs?Pge+&#ye@Qbi!BXDDHQ<atRi}ZIfmt~oobnhLo{2CpJQIQ>yn4ooTQF1J#28SD
zVPIA+2Sq<3<xMPsii0lU0BwVY7{WLaw097^D-g8s6B_CLb07&!`5=}A)_(w!z@(IK
zf~-KKunBiSX@h}Tg<<-A9d<bb&@H7?7?@SmQ4^RhY66=m0@dX=U00V~mTjT|h(A3*
zmtCrUBQ$Ovz@lR!bj>ic2Md#t00Xl|0qB0qgA5GMG#D73DX}v!tvbWN@XVWm;h86h
zbAy55Su_K~vq%u<2?N8kd<KSRxrz)-t3E&y!>T_F49{8^7@jq;Gcc{@U|@JQje+6W
zBoIf0p`PK{RtAP=Ye76Y28L&E7#N=20CBV!7@pfQFg&+51zqvTz#zDkfmwYkNXC<a
z;duZ9!*eeXCzOHVc|HTf^V~27rqziMzf6X0*!sf2thNKBDv5#Nc^w18^BQRerqzW|
zRp2Xf>jn4ec8M}DtF<ySFs%lu>0@Ac4!WFubr%D}^LY#m&*y+-rZF%)U&p}k9CVn+
z>O~9;&-XDfJl_M2%gHA|;mN?PdJz;2HK6-CL6HjI@Xk2-2~+{-?he)(SV2(6!ZZE3
z9y>4B6b6XAn*8*CdhD|LQ)EEb%rY>mxqza-i2>A_Dm%e|8mm(*po%i5d+D=F*G~bJ
z!c)LX55SZ{+e3_#*FX}K+FX!<@TKdFQ$S_&6p$Fl1dx-<8Ne+_SPq#g04sN<f+hn%
z*;GPzH75hJ+J9(nd486G;rVG$La+bufpMw~W^S3R0?8HX;vj3PU_~tBWE-fsK1jS8
zA>INB3w2PRh|v-1DriVgSpk*I22}<IjEtEq6FV5$K;8sx8)2Ms25M+C$WZtuOU5an
z2q<M>R-X+O2f6se2gWJj3<NUE32G6@sQ({6Fi!jf$)D<%KoT_!jEtabn4r#>1gb5k
zFfgls02v3l8@nFiwMjk@S8DKrOg01=fG8y<Wk8&$p$gKA@b@H8DKUkCS;H2j9^v#!
zJD`SzLdBs@p9HGsAW;W)dp#)b<QbTjLe2$doN54%J7{x_(Se1@M1X-=6SQ%1>3#-=
z=XV(xp5InvU|M>L30!V3y~e=s{4E2+b5NPN^brHY^S=xX&wqoiF@MLv@Pe0t;RQE{
z^NWGug**ep3u$%+CeR?n3tI+;fET9H49uR8Yrq+&g70k+Jg>B#m4R8)4|MZ469dDG
zLI#Ex`5+D-1H+3328I`PAdVCR!;1+F3@`eiUYnW&YQ0Z4Fk+XgpXvaK2hD7d_a|~d
z;sL5~S`6rZZBRH?f+7gKMn8~&Y5pBZ7N1rCZUH`GVKM_9_A>ts1H+5u3=A*kD>5+6
z{|>6W*cq4>Ff%Z`xWd5j0@T!7z|X+&;xPlmi-#Z?X$FS+7oQjyUVs{Y3)C4HUa~VV
zykrGQ88a}vRAOLwDJ9Low7?H)-3oAh@>TCJ4+FD~B{Kulf_Mgom!S*{FF~7L7GyIp
zyzF3Lc-a7wDPv%Gxt)RGCFowO1x*YLFE2ANyu1jK>0@Ac`GSGr<ueeceij46%fAc^
zFF}#8U>O6$D;@@hS6qq=Oba%FDsT|v1=B<hQwF95Ul<sKxEYwWpMf0sm4V@v3<JX}
zDN_a}&{gC@dJN3kpr-0VCI*IA+6)Y@G@*%kI;bIK#=xv~3>1)vx@I~kfz^W~?m;D>
zp+5Z&sNi8_%z_Oc96kezn_@`WF$;31H{<jkXnzsJ0+k#L3><p%c^R0sr$TSQd1b}G
z@X7*l0}e<b%uTRs!0S=3zyT>?hlKWYm=e?*a6l>`wju8HMym5?D1hQfNKS7(Cj+xK
zD7>eiVPJUW$-wZ+9qPRqI?zIliNlB?1lmPqoW6vCIThS*1?4lSGp9igt7g{z59$MQ
zy-I+U9@AYQ<*g35&_k5B(+faBH(k<{UADdjl(0bo2fm%25i|lQ&cOHta-KV5?-j5^
zomiN>LA{sh%nXcACNeO*ieq4S6#;Dq^?qSs*8KqG^l>mSKAFc5$iVnQ9}+@+A)t*#
zLLn?nz5>h)j4$jN7+%#fFubZ{XJCBcRnNfiY8nH>t4SbU7z4wrjSLL0R)aW63=FR>
zGBCV43*zK4FuZ!s!0_s+Gy~)NPf&wrfZdiV`-GK&S+|jyf${x+28LJP7#LoCVP;_b
zz|Fw$nw5d!HM13>K<JwRc1)?PBP%G&Gco8fycS_#cr66t@i8#GR%T#$tq9^sF)+L~
zW?*=22#t@vHQ>_V!v|K8dT6-!HGsm7fmwGcBxQomyDU8bDgqd7U=h~$g@N%!2S^@#
zlOCf1sN^tY0H1XiDbB*A1nyZff<h2<=_Cu266lti!vdf~&*tj0Fxd()fcn1fFIboa
z!AkA_|DXQVj9sW+DHPn_6$D=~%b3Mb#=u}XpM~)+bdLTSbdH{n1=LM-ydVy`xe^?3
z4A)+O3MApDER6qI8JP8QiW!(T|6pJcVV7lK+WZ%Eln~=JD~QtT1)v?RA_^=_jI0dI
zrvC#O7_ULLVAV5RF901iFQOpJw2PIUf$>@(1H)@K28P#8rVNbN;usi2{27?_j)7#7
z85my2F)+N2VGw6vyfy`5^o<fw^ogX(GOgoeU^czQ%)oeU5d*{PQU-?C#UNel85mx-
zGBCVu266T<Fub0^!0;NBPOhC~V0c}>l7Zp%LXgxo28P$?85mxJ63Vs53=FRyFfhEn
z2a@@~!0;M`--$CYzCQu6_9l2wph%}I(*$k?X8n3lvbhPq1dQSJKM?0B1H&7B28K7h
zkQB{uQvke?7G%UUs1YIzObqo5A~R)~CbBXx>z@Z{Tg<@lMxKG;jVy?>o`K<w9s|Q0
z9S~<X1H&6T28K5_Far%ho4G(i0e6!HC_+S5$}&wBVqi890_g&|DTIOHO%R9!a#Jz`
z!<$5y5grWn%*nMVW(0tPbEhoR6k!HtgHVt*kQv1c3~vfS9FQ4J3=D4?U}mJi{PidT
z>aQhWBhJV&%@JT=HqvEgV0@It!0=`g1H+pMAWk_0!<$763~v^&GceXaYGGh_vx$M>
z%?3zzV7R%4fjO>-f!Sa^D7hmJL%MkZlyexE4K9Pk!RJvhK`KflH6Iw5V~#Q~8+-;A
zVJr-wyu`%<YmPD85`f4Xg6}WnVq{>nV9aFZVniq~fGPkVR|isnCf@*Ygki*VODlF6
z&N)zS`Sds|b}`N!Q0_Dc_XY#w+fW8(!(G$oSg}iS-TDFL-<y8Gid~vh0m3z6pZ>&(
zU7_9q#0B{coW+?S-E<p9#&pm{3!pf<E&vJO+a93ON92Jl(|k~p&thg^ye`MU@a6~u
z!<z%_42;*c85rK&XJB}96U4D#V0iPNf#J<>r0Xc}f-4SD7FnhoUIu1k(8f#4`a}kX
zx1tOT;Bycx^B5T3sxUCTRRUd3S<S%k)|7$atufMlly?=NH6p`Z&_ZKSEd{xclG*4p
z=myF{28Oq83=D5Un+ZYJQN9glV0aq}EzcP4+8|v=nZZ=cz`#&1&cOH((%@pa4NgL$
zlCn%`0u0P1zd@;noq^$P0RzL^9CilAM<NUiZ`&Cd-nN1`iVO^IXEHFnohr`2_{att
zMh8H7LDWi?v6Yj7*|-&Cf)@kB+szCNZ#P1d?(Gf+#z*rR#2J|5<e;Zs-{AojRH9z8
zj1z?zn2oP9Gcd>LGcde8#K7?O0ElA^<3P%DhC4D0jM<=m2s0NVwZV)8Z63a(0d`1~
zEaN0W24)jYkRc!wuP`vYy#(TbOayTfF2Rhnfg8yPNx+~I8|q51kse?pvt$`3gN&>O
znF2EM83V)HCm;^UNH7OxVhYH_=?S*%67?IvSH3fwOa`U28u+1XcUVAS0nLJUR)CTs
z1GC8v&`e4tJa^nV0TsUh60bvuKVe{em&?Fx@*GqxdB7u?1*9Az#2^oe8&JoF;dTYI
zH4kEeQVs(Hk1SIPC@~wrBI*YN!`pA*BLqHtV7MKD<ht8A42;)Z8JJB&L0$muBZ5Tv
z-3SII3r3I_C^<pn_(lx_v)g2-zi!N6sAv4p!@z6`z7qq|)!~327<Xd}By3FAf(+q+
z->`Ax0qEEo24>Tvpau>HtWsvU@q>Z!6Sz$TYDIZ4FkXZ7#u;wJKs?330;)dB7#Kk7
z)8BzsjLO$DFt$M2lnmD^V5cWuhi;~45MW_qVP#-8vy)|DY<UABenS0my@7$rDGXE!
zG(l_T>m8tD21Tn_m{>tt3S}7>oA^M4G)&7Bs1~NxkX{tS^(74Tp!>MHSeV#Y8JI2B
zgN76KFfhDRVPJTt02-S(!N4H8l7ZQ53rOZH1H(Hz28MT5pb^g1zoDTFK4(I7kIo}b
z24;(HW(KA;91INaVi*|SMX@t5tr1~hc$dS#@Gc9)QD9(rSHr;Yt_sA_VPJSSsh)x1
zU6(Wi(;9QAaeu&R`I^o}ka4CU<6IaR-tA&wcn3Oga7_RM!@J824DZf^WI&d@VPJUo
zLXm-KO$Ov{&2=eogIF0DL|^OdW@TVD2c1m1u8@J@Ju?Htd(h$a>uMPo-U~4>)V~LH
zp4N3TFuYe}V0aJOf4*)i1H*d*28Q=~pwY*L3=Hq>85rK%Li5f&0Z^F^N)V7L2V5*O
zaX2tAoMvQT+GWVVAjYn<kAc}j*qVW9R{)4`1`)Bc3{1N~fv~Hbf#H211H*e?kcpu4
zFzz)lFs%U(q1A%&H@Kq*lKb$1;hqlz)2>#yZO}dm!vzg^Ub{Pkf$?K81G7aCNEP^~
zLikuN!`&UA6v@DB0Xp&!GzAMa_U;u>w;QBkdVwRmNc}Bnn8D7!VgW_>eFld2nG6i?
zQ$bBPrsZ28YOaHi`w)|0VPa=xV73B{Z7n~@!0^6>f#H3FDFf5;a|{e(`V7n#pV%3g
zmS1LIct3}M;r%So@s7(MLX5b#0+t;Zm@OsQ8JOyqKVx8czm<XE{YKEO(<`9o9Naqq
zD;Dm-?f^NX%gD{i%)qolkb&X-IR=LJXV@8-R>(3iyuZi5@cs^nqshSV{v89ud(a`H
zD@+*}J}@yby#FK3z_h{vV*Pz^2`px>`-_u-*(w|~BeKGmf#HKZ1H%VdklB$83?K9u
z7(VELIH?Q_A8Z*IK3FR<Fs&$rq_I`$aFbXW7{r2fpMrt{lvr1lFff1){r>>kCBLeH
zf#E|L1H%W<ozbg$7#KdZGBA8-28}q*U|{$#g@NJ2BoJpwJp;ps#S9D|7DA)vz6~sm
zfrbP!nW{mJe<n~GgDI$hB@3_uShBbXpAcZUcL9<ttV%$!jFv3!eSjnjs~(6X{DA%Y
zJkWFjz7?9IoCi862TlPC1tGq^egTw4#qwB~I9M5&Z7;JkFfEj0VEC||f#JhOP={Qb
zfkA8&1G5!qU}2#F1H*@F3=AKxfR1@x2pPm=xDP&;RP2xv;}l*7X50Gp%nVEm^BEXE
zyk}te02-cISi`{Zk&A)hBj~Wng`ErxA5|F`J}QE&n#REJ(T;)Pqm?)V)50YXCq3{1
zRnuaBlo-o78JKNB0}>0jF))0LWMKFh3NrgJ1H;D>28NHIlVTTMU|{$-oq^#a=%Cnz
zcNrKy)?Z~{_;?az_$vm6Pa+HqpV&bD_|Cu}Zot573py8f;SUCePeBX}pZw$*n4qHo
z3=dhL<H{fwBu#TDF@_2<Fxz-ThXFoiF))0}Knw$bR6>*YL(u7DAYCl=T&AEAjI_-V
z-#lc2o!o&?!llRK!N8n$1g-+4k%0j*3=qb^v<O<QJ+gsFGPp1>+ni@-U|Ph+!0@S>
zf#Fj*h$G0r@M#eP!>0w}3{2CPf()$x!0;#n)JPXkS7LONWMH=01sVa}#K7=rD+9x)
z&Cpc$D20J(`X|t+p9=%5PJaZN1wtD+V0iEYbT<V9vkmB^S7y-20kjHw2pTRmgK-{!
zh6_M$R{QXQ;SqFH*cLP;&1ep)S<4Z&OaUpKuIR=tTo2X#paV2y0UeTHxc`NL>D?^`
zX4@1-#!N;JnD7G;NG`Cg0VQ<!up`3*6G#TI1rISInhcMQFfc7rgs6qOfWd=-X`vk`
zls+&#OaSdG1O+arfL!Rz!0_of1H-4o3=Dw`Omm<oWnTxMr7K>}!o&p{Oq(;6f#K5=
z28K`fK=YN0AO>BB_M#bh7?|zkK(m_585lk@GcbH+1Z9&s(3687{Q*bHWIaZEUIu2z
z)yxb`bLyWlFnpF_VE8Nn()O8w;j=jd!)If52Bx_T3=E$`7#KeLfjGPj44>N=7(O>C
zGBC}RVxD*cG(0v}oq^%=QU-?4bLAPB<{CpB^Vk5^?syCxOJ$JJV-#d%V77b9%)m6)
zfq~)kNd|_`pgMFe=m4$Hw-^{c-vCKPFfe?6#lZ0S1vG^`2F;{C2KBWZyg;*o;Hpd<
z$tv)nG2+Yg7{yo_nC(IN6m0xY28Pd|g&K2x7#O~AF))1LfSUeAih<#a1kCga49uzZ
zAmdqioY)xPb)`51a|-k@ug5b$Ws~?eJw_>z1)!A`DNh*~zUVVBd{GCTtn-P1;Y$<)
z!<PsU=LQ4Amn;T`FBvckK%>!*K@ks{%L2I@GP%d_1bje^_%S_3oqA3NW(Tn6ix?Qb
zR5LJqDF?Z=j)CFJ6b6Pb6F{6U28J(d85q8-1cm)HNS!f%5+t;r_%N_CFo@sQ`^L(^
z?2yIGz%+k81H+di3=CfmfjFxf7`|L)VE6(Wy_>(Cf#J&|28J)7W1{CDW?=a8kwKQ>
z%X^Tz^9&4M85kJ8{DZpvNdl<OnC|V#E?IBLz##rz?<WJZ!!}UU14kp|s}KXjS3a2b
z3k*zi7lTqhXf_}dbY~wdi$9qGt8BmxWLRZ$bpgB$@|XjX%^bdh3@EM##SEem@>m0s
z*&IO=2B1a=D9eBN!0;F}rSq79+0g)0q*#I{k4>Nz4opb}DBm+MJNkl@fM!HM4ueU8
zrVGs&m>t0<03$N@6MYt_t|nw%Fpq+YAW#~D`h)54nduX~*oEu2LgQxxD1U>Ne}VGX
zE(V6LS_}+dL1)BRFfi~gW?_5|>V3UoV0Qc?l$w&lz{2=kih+UgAb4v43*&R}!c5Sf
z^m0EI#^q48&eBk|%jKYI*VeHxE;j}(DPv(^*vQPnSie?+fobC+76yhDK`e~xr5PAh
z*03-zoU~?P+yGt*2D%Jm3Jc>#@Om$<%%VaD7RF6*nI0BK&|W}>Wn7@cFj*Ku3y;Bf
zyRpf!Fm8n@i;-ku+zv6IxHOl6g%NZa19*L`SN&EN=$#%c3=9J0ER4572PvHrWngx?
z2EH_eg>fxt5zko$kkCsO1_qU07RH^Bbu=KMKe3=2X;~O=NP{<}fY$Ts-ezHZ2;Ox7
z*|7rUJ!D`21<?K^7Dmu<u?(jen4R70g&+=}3)-~@y72?#@VQdp9l}`*42}<27;T}U
z>Ea9xO<N@fM9ABkgF=&&fnnh~7DhYJf)LPEm1>+UjCP;}lvSVzdd<RUXAC+$j+23*
z(wl|R&KbnvDo#yjFkxYI0EY|<14B703!|e11G9@W3j;%QEej*~!lz|iC5FZfER3Mt
z9Sop-lV@Y6U-4nLuiyKEg%Pw09xSL~&cawN2wJ7d!oa|Gi-oZb%mLj?$X;#Fz~Jzl
zg;9o)f!PJL)Z2ar3!@BV38p;*gZ)Gn@G5GTI!@4%Ll#D1Igpn?_q_#_u`n`$bb%rn
zq>BkG#g&wj$WYJ1$STLc)Utzxfx)$tg%PyflHm<#!&vnJ7VvIE7tqFFu_~5tG7L<n
zpvA}8e^|b$gSM4%fGzrF2eJpUj0?P*r}_X$yG;bkNzigH*B*$nlhPn%psSucSx$m-
z#2X&)+Im4hcK7;NmTMvm%&tA649u>zYzz##w^`nDf})23w6<3FHp>SH4-^m_MMew^
zD(x%<Ak*DI8w>4cuoNhROlJe9t0HiMWn*9{Ucv&tBN;Rg#}md<296<~;(`(emU1wg
zje%hi14{*GBm)D(e>Mh&<(FA1!2u4kHLZ}PgBKLT;L|Bu`B?%%DX5B(f!PhT(awGb
zOCWgP7aIe^*;p3P%@E+_$i+)o;$epKgiSZ_XBV$$U;%H816eWIk_8lZ4F5q^sPwW#
zK=J@+?{vQfix<cW&{h|>$&gU<QUUo3w9eFTKZ`l2(+^!iSq<B_3c9I-+3k%&QfV3k
ziw!3zUKkj@x-u|)b%ewTqiOw41_r<V&?2n52XuTnsFnrYa1A<aOQ(%R7i=<UbtPy8
z@d_4Q&?zyX9mMuCSafwjPT<L8U;*uXU;y8=vZ{s!bmg@$KWH&5M2i|ItUy{CF0rVA
z4w0z>%@G{F$jrzMx|9UAlvotjO6UMh0l4os0lAx*kz101L7AU{;cGkt!`Dc;oYXu9
zX4qPLhOgBO3|}kdKnL6~Gx9;#5P$7rVEEbr^^~X!X!#_#{$OAL9e%TVIy2~EbOvR9
zMh513_ZLFN49tv-BA}cllni1@gHG=Th3iUx=5L@C-q5AaBCv(5;BAB+A$^Pt49OFj
zzwv|I$C#y2T$Ief{7n&L5Cg;4*$fO{r)z*+`%RaDfl-5j;p=t=hOg@tQW%(jz+9Sp
zmx1ByRgh(p-ONuI85jf)K&lHP*kET4C@?&3XrwSOKj8<-GcbJPWnlRFSEHDL`H39l
z0^)D!3=H3*A+|lyfY|nJI|IYFmC#TyvSDCeFlYLPKz0Srv{%fh7#Wy7S*PC&WLMS6
zVg}VFFnbR{YbgdDkiDK&=_!T`%*!FCmu00-*9u~n^8EIff#KVCkU#cA{qbFkf#JK7
zLNNpL0hmZ41H<=7(BjUX!_2c8nHiWpLE|?L*O_Mvf_%Zjz>ugoy*G$mqJAcG2go^J
zIT#ppKQV(=4ug+d-s#HRAq!P17|GlL+Pn-pDj;?jbB8s^+q~ew?eGM9*M@=NU>|cG
zXd9=OI&VQq5d(7__?}4cX)(-oa-agA161lV*J*)u_%JX?tzj-_oURhgF6mj4Ud+H;
z4)bR+19Q13C>bzjYUD96m&=27FnpiJ!0>$n=!o*=tC`an8JN95rwQnOVon2BE*uOD
zJ6)%@1+yzjMlgqiq+db&6b@Pk0&@FK*Xaj?*%iIB-Y`S*GbFM_V29>9fCAmySfkjG
zf!Pb3BpDdKZ)afmzFwo)h=CcD<weUG7`{JdVEBF;lxm!Mrt5~V%cS*zwb+P&!i9n1
z2R{SD4|cE?8x^RK8w0}+JCJ8=K$|-?7#M!kGBEro1ud(sVPMt+moA{3!ok2`*Tt*{
zb}=u=9eT<j6F3+cSZ_{WAHuG~RPcBD-4J$}dKFNRDT7_fn59s_z^o1~AQ>2btYcvK
zu?plog_F#(Ad{g-$5+6HTfm9SXLmX{hsz3pVwo{39UPyspaS9)W2O}Yv(Iiw@Kk^=
z2ju+2EDt(R*yl6@!;fPO43R$$F*7jxTxVeT@qmHh#~l#oF$2So9}EmXzOXYe`@Cmh
z_$k7`@RJ9``N_cW)0%<drz!Xl!6S#5g~0A&VD<$a@wTIZSqK(|jk~5_3}x4=w`KyJ
zD#YvyIvi<UCKFRWc;5vlXzK(MQ$Bd(1t$Z8yEYS3K6vK^3uxyB6H_6$ieUk5=wM<h
z0u}e*ll`LKGBJV9j_?Jo$p;yi3ftJLdWVTA6?DoBs96CrF4YNCgn({H6-sAf0_{}?
zx1_w=nV2%*=DE8wF-0*lF#AHbpE5B;DTB6!a6;^j(gh`6sPm#6LFR#WAj{rkVhUnp
zVD^LTK4oGG0-rww)fA+Tq$#N08m!Bnfx(M~iOCzJ%M7Z}8+?ue)O2qRm^!tEOia!o
zb)Z`dK(2L0R_6>?C&<dgWDQc+1~tzb)EWbwBmnZgwI0O0dIko;jZ932AcecZTgI4}
z3{{Z)Xb3u*7pBV)9A+RtmOW+y?_l)<wF^K2tuBY83AA~J0j5da25gl%14Gt)CMJ1C
z24;WI@hc!r@-pB<w4e@@2RBNf9+n4hl>u3`?JyIQI7pW-)P3Tx-~@R@TpwooyapyF
zK9D+4^ns-KB*9XW3=C3TOpJd(Qq2$}82^AbV=<UB)HB#QF@ZV-%>LViQW%&RpNoR>
zp%5sOFfl#{HKIZLV6*=)F}?()iZ`G-RqP%UXj3TztV-PqIz<~)qVE6|ECHSBpaPJI
z@w6bMJo_2V!0<EFBrUgufr;_7GT2cJKWi8mepXDhV3aE^DPmw^yZ|lHe@<gy_&EjA
zaA5dT&cGlBIwrK6jfwH9Bm;xeHKvIistgRrbEg|dvP;$fT*|=kb1^F<18-dbnQ9Gy
z4jRIGfLk9hFb9F}Pyrob7s<e2<-x?b1C%kLO_}AeEf_06?hmvxfjDW00I14kVEDO%
zf#K&SsHb+wKs|Mvf#GNUb*Qg)K#~)~Pf!8yc_O1K0|Us(dr_Rs#JCUCMDb#pr~qzC
zFfks2dis|H1H&&dXeGMB2jN`MgfIABv1kSc*F8*(tD&<cBB1OK9?ekzJ9%Cz14D*2
z6XR-W1_q^7j9H<{3`~rx)j(Yt#!M-QW7bMBFbB?KVECoZ!0<~I)WOk7VPagX#K0W5
z7<?3p(ltH?2Bj%w3=HYvOpH^ZRxJhfML>}o0kSDb5bEQppb{ChuI-l<1H&&9u$PbL
zGBM78dXWR_o24;O-@rPo$5uc*l?6V-Fg=6`bQueCke3i7eSr4!i<VDhWC2Ao6Jsyf
zI03HYQcxmkmStcL@&Y?nNc|lnLp?)P9us38s2v_u3pF557?i*!GJ-q^a!?`Ypa(Ao
z&><z0pD}%g`f34m&khT?6&N0&#=x-k6VqpK@G&s_ieX^*6{Z1p(Pu~oWB66i!0@YD
z4eYGXpdm^x28Q}y+Zh;sO;;#pVEPKJm44eWF#I-AC{1Qy`Uc4`48Kzu7=9<NV`O09
z(^g1kVEVxaiWdfk--{R+e%C4FF);lX1-Y4l;g2f=!yk1i28NpTOpKs)B%tjXf37kx
z{Mj$Xz_8kfiIEYi_pc=b!(YvMDF%j}o0%Ayp>6oTbqoxDE95|DiZd}vgM#iM1H<3t
z3=DrkT~UsEOpG$T3=E873=Ds-Gcf$U%EG|Vd6tP$7HqvZ19LcZ&BH>_S`G%jDkerw
zAqM7P&<Wk)nG6hnpD{4}eFB;e4le;`xq61h5}*+)zAh$4TR{fqkmt+{%;Aj;41d2d
zF#P=j;`A~w{9|Qc_{S^_I^h<q3#5sKfq`!}(^C-!<`5}s2IfQ+(B`ZJ=zRHN70|#T
z-)g4kAbBUymLfI=hJPXq4F80{>Y!JjEY<}dEX=o$=_N>E7Bd5L!V3n5e<}<N|CC^Z
zsEZjGn8SZFFo*O^FNkHARF`33j!t7>4p{|itV1TjIN;|FFLr?{J~MqoEW2cV3`j9T
zVI>1-DuFqC7StbKKr0vc&M`3t^D;1pP6PROIRnE#GX{o#Mj*~+28Mrr3=IFgK%D&y
z4F7T%82%-JIHwsH{!M3K_%|8Exz51wZ#@IUzt!vv%;Aq182+7OVEA`}oq@SN{2c?s
zzqbqw|DHq3xFsqO2ZmN7TvZ1jXkOxj>fRa#1_pTs=4dB~dzZi`s+Yi~XbqSc<3VnJ
z!_2@O?a#mfI;HbJJBSm_!0;cGzW&3?r6o%chC_^ntoCDAvI92JwFJCwn}LBrgNZSj
zmw`D96eZCj3=IE`7#RK=STit3E3h*#M{6-K{C8zw_;2sQz#MG~bsS7DScMq_!~Z0P
zdWQcA&~jwS6=d6Ck-KmQNR)v&3^Y~-8m@%~)50%M@mY{yf~j8wj!*{XF!0T2h(WhS
z9Z>ZbAnHMbs2sWs&^2ugi<U4jM_Ds4hk^H}KoSjnF($*JBM{keHi%}JWs4giaTN~Q
zc8BD+#d9E*g@f-wgP2wgkHf`VK(Y{%V!`eJ#g!HV!_nhRpj%QIKv5N5!kf&%^cIrs
zjTjg#<}f`5m4e~3IKTzjV?|Is06yB6>9Gyy>|oG{$Z0{Qt6){2a{#w~n!YfBU5u}0
zE7Mib0eYYf!K;0yA5CCatk3?#1lkJE@CH<BhR<O-2rV^*pgjmi(8Z6;kyjw4=0Q*`
zw~B$`e<=gQ|9tTI<V*)an~eW6F#Mmz!0>;H8UsVkR;GjCrW6Ci|APz+|95JDipYcD
z`&Jnk{y%46`2P?Zc|x2gAOROKb$VVRy9VnO2Ih!;(`P5LtALr$ryqebBL$|vg)uFs
zizPu6L?%tQhcUaSXTX>nr%y~`SCqK|30lzd^kN2kDbUi7G6rz<u=n=#b4lzH_0|w?
zZIK6sAp;`=4+A3u8^l{%Ku6=8Vqj!2U|?j>0DEBzIPe%48G;xX8T_ErJ3=|2NCbtR
znLE=WXy^$-_XjbY0M(??>=0`}*9a@EVqjz_WME{-)F?}=&tYI%1ZoQYXJBMl$iT=j
zy#UmKVOq+?z_2QSX(ES03Io$JNXvnd;Uxnj!&7NQ9vA!qDmxi;K--0wqd;jT+Mj`u
zk(Ggw;Xfo>Gcu|(FfuAa^OcYV$fcmsn282#;Po?FphY=?dl;A(Jc9a0@Bst!0`QQW
zNfQ(Jw5e#&$$DEqP3KEt*HH`o!_)yvR?%sY#MdDX3OL?k2Br?kbw?2l3@c2hC#0}T
zSl@+sx)iL0fsxUTfsxTkBbkAzR0UiqGBPGIFfzt!GB5<RGu81hFh{>*U}OZX!mXIT
zIfY%N{+%(%aAUAyJ_hFKyAccw>e)=m&@ldf0n}7sU|;~Zi(<+l)+Nh<G%+wT_AoFq
zc7Uu))&`rv$he$=k#VsV19MC{q!{{s0W=pY+ryLzS_>P~!obJ~TD-as8eCrAA22XR
zCV&=LFJ{c-uu$Q!07aD%1A~7JlRqdFV){W@(;re#PhezVNO=HS$7966utJ|n8?0h4
zIGm<0NM#qTuWw*dW(;Rw$or}0EDGwOLYz?zD-FS|uGmv*3=CpzYR(|LPBAbtUSnWn
zyr2eZW~(`a*3E*%elRdHegbdWR&xR0-ps(rB*wtVBqGhg91ERbss^`oxs=pg1R0oP
zi<lYenPYD=Ffyq#Ffu7KGcd<KXJBNqWng5ohWfYq0cfoiD9eB+;X$PsgB}BO>=&pr
z-@uCg>Nn7U7f^Et^`GNd85o&-7#NvAbzhty10z#310z!;%-A1LW9y-JAA)AAKtqrm
zPt+X1!2oj17Y?wm9YBYZf=&=<u2pj|1rLa7F)&E-tJ%U-#>qic+JX*rgsQX!<;znb
zGllilKxh66f>*qOj{g#CQ?ml~LQiop)H5{Ks#$@%*&wC5DQf0$LqWs1Vr^>X;6Mit
z>ZqAR0y~_6!CGC-5Udgs5S6fdc)(*Tac?1U1L{dKoMK>P%41+;%7Da;5iD-H85o&5
zVKq!;0t0j0TL$Jh(9TGfi9AzSV7-^h5(egYF3@eDU{TN}<b%3udSJUjG7yL9fyS*)
zfh2wJs%gU{)ghAFV9$aiHy>2ffJwT5B<pL{G(bf)SZh&|nkq~dbZSR)t(q!CGMs^-
zd5)SASQ6@CkcFTq2WPbSO%M+&f#xbe9-hO%$TR~Q*_9U1$Yus#n4Ae(POrtlu;;zC
zv@qzD!Bfl(%<&h%m6f%$39Pa**dnSA8qkaX#GA(;s;|tzAP~!&!62${$-o@{2{aBb
zkZ#1lAUI1@1*9xN9i&V}4x|ipVyw2PiYWtw0O(XpLsd~V36MCb4)k9kDg{;_4pJ{w
z57xlOz+k8<Dg#yoI^R}X6f{00kOWE+4n3kG;JzZLby*B@fruIdb3!rL1x;EE3@0CP
zNP$MHmw^;4;sssqz##=1X#v%!TKhPpKuH#SHmP7dhd5m2b+F3mYctuE>sdHNK;uGH
zAQQfVZ*Jfa0fi)3*N!P1f-u=cVTi0CC|ba>4ICUCa9Kl$EU1Uf06A>-$a1Y}u$7?u
zHAO#ZMKUrlwd@7owz+PVRw!7CS;&Zif%~JDiwLNt4Vo?Cxj8*Ci(RGuu9hB1{SJ^g
z=<2#?RxM){1_thhptQu}GMx)_n5qE-bK+6nGKT3~2B7i_bYP38xv3W;19Kv1U~*oj
zsTcU<WDd~Cm8lnK_#J#$FZ&Wx7e)r=Bxca?eWs}kc%%xX+eXpU79=5450SA|01d5x
zWNJT~nuBB@XEB;WP7nmes^N4~ZBVQxMMJb`i-ELoFff!ZFx3W)af8oUnZ-NfCO8Q*
zFejDs7Uwg}xM>ca<1u4kh;!p++z1MQqy?Oyt0uV_H_A<K&Sn=C={?NNI13iUNuVQY
zIE|*S$!3?#n(&94aVjVXK`A)t7bocaTW-dwnxGLBE>I_on{gVb4|s~fjDaC6nVYc}
zWI;0MxIs=MZpL0!P<RPJ6oL+qVmQU1!objboSU%~W?wRBW{%Tnx_%D3q{y)k+>8w%
z`#?!8xfX2S^q3rWsd@%(MsPGki+MX(X`}*bX(ZoJhq$a-734AoMyBlyj7*!s-9&E4
z>7Jl0dx3$G=^V7iw@U!uaizk*uvmwiu?%D<sP&M-3bvD*u?%by)Q{zypdo_)AWt5s
z=VmMdc``*0ta3VUF1u9yNp8kGuwXb?kee}25y|Iypf=SqhG+(cuyk(5ED=cg;sDxn
z11eukKwe1M2K7P~SSJG`(_;okrn@GPu*(9OaEgJEnTdgs3AUoZAp*1y8Pu?;U(A@v
zzyLZIdxi=(V~Plf#q^e&F;T>ffx$qNn=umPxKsvC1_q-DZpKJe1_nmZRGs!4ZpKIh
z28JcCIT;wT|8O%#T7fGcGX@5uc5X%|urAPOB}kVOsQm)d<)jCi1%v8xvatYbJHwcn
zm&3ql0t(Di49uyZ5nqr_6VNnp8N++V%)D|2Zbo&G{4&r!M6i3NC+4wB)=vSmxfvxD
zL2d(ubj>VoMsBbRK<BKbF6L(B1`XDM=7~Xua_fN=8Zj_L9pnBBRtLK7Hgz%gUr?R}
z%@P<zaQ_7j(wBiU&;kzb_aIeioS?hk7jwS{sRGrcMiJca^}}F>2}^U|1uIkJO=jS}
z3z~6y$gqI1D8Gn-`yAMp%xR$GIA_&xp94*BflLq$<~|2%`QHL7%wga@236QS-9MjQ
zLrR?cIOxm?a8<3(!o3>ge^7=>+dO?@KD%`NLhcrjV?Za1q+Jr=NiJgGZUc3E3>X+d
z%`2Uw+z}$oAXe2$ZZjxrAGd-Cvk?PB#~Q{MkbBcX=Q_FeF@mm8T=JTOf#Jv=#u$6>
z9X?tN4828+5g=PZNj%+%w}OE&0(9E$e^Bwix1OC5Tug$Tl<o(T3<XJoo$JTK7zEM?
z%8%(;Ah{rr9JpY%d&=k!k^>vs29om!$$<?mT+QeMk^`H$2qfnNk^`HWx0BHmBnLKg
zA8$oH1EVKMav4K714CFfqbo@AKO~a`!g>_oN;rc<qk@6a6{Pq-10%C610%B}v<eQK
z!oZv{36vQYGiHI$gciBR=maw96zF<IkPDnZ`oJ!*+{0)Ok^;FP!#)`#X%CWI1}gPu
zuV=IYN&W}rE|8QBNDAz$$xe)xASsZqGRi=5mLNH>nN!mk%|LQsGbe%M%s_HrPwlsw
z-c!gfQ*R3HV==0O%4?7ZEEpJ>O?WaH7(q=I#xR9^21X6ga*QwrM&>{UMrMC$2IfrY
z=z*XFsM*fI!>Gl>z?><_%)p%K#=yv&#K6cLC(FQ`8N>j()eENB0^CQEVbtcS1}S9B
z0x78v0?)HI=QB!xTnh3<W;}Raj}d&0(kV6uhTNZwGN7XQ7AR>rUtkmksRYGvW-Uae
zD5wPr4h{Rij6xt;usO3KvO*wPaCofMV&n(Og2E$nCs?+g5p-o2!!iaZ2IkCKNCbn%
zE<uGL1L*!x=FB@F=k_sXfs|xG596@|Rj42}U?o{r%nZyK*$j-#wG52Rm7ojNpq{of
zfUWj~>)>Iu0yWjaAvKMmo{@P9C>(+qK*py+H>3qF0GZ9ezyR*@XU(Z*U`}1cn8nP%
zoVuQYk$EixBlF@w(6U>Ig9E{{*X-9|h0`JiM&^4AjLe{UGq8sD42;aLAvTmkv;;#f
zsAnhu74=!KKxVfwFtP|RFtV_L%!Vlh--*orjGIvsv@<akq{f+nk;NWl9Mf;;K7`;6
zQ1kA9Ov?r>QU3jrfsrMFfsrN3jRB$V4Fdzz0g$dsJp;oG(1kV33`}4R%?ykzwV<<T
zxZui|7#P^UDKf_KFfeC>E=-#(#lXn2h=Gx10cZ*3Z)mOzegj$~$H4|t$jrd>N05P$
zWitaK%X$WoLm87GTR<5?p=X*gfM-o|%IcXJ7?T_s7+Ib(FtXeQar_t<S!Ed*Sw+Pe
z7?U7JvVe3kF)(o0i8B@QFfiu`gVbGQU}W`TU}Sa6WnfH#2195C%zGdfI7nE;nG#e%
zdoJKE08f;11d21|i!d<P=Xin)16i8Fz{r{a;y5xevbHcVvev=Iv_j`FFeb$?Fy|yf
z`h>7vO6V2_#-z7UF$O0F#<)k2PzwXK4M5g6fTAPkJ2L}g+!qE$*0l_btc#f$7~>fk
z7+D`PFtXmPuV!G3=VQ!ZXJCw%W?*C!XJBOG|G<c3R1U}-1_lNRapna))*#i^Ak#oB
zMwl)~21Yh(a5%?tKwU5cqK#1l<bvD>AQwn6FtRl=FtSyGIO+_HZ0i{q>)DorcqR;t
zY<C$L*{-rPFvdADFtT$pFtRg)IDQO_>^cmL>`EX`B#hGzav=u;14p7b^G|UG=G-G7
zM@fMQbr4|!QVlXEo`I1)8pHvaQ^~-{4%*Kd2Qp^{10(w+Zph|hhVUMck3n-J69w2n
zqf?+kXJ|1V_6Lic69bd)4~SR8!4b;9zz7cPyr0YrOn$5kjO+&)7}-G=ulflxFtUGS
zU}Oi~T<j;yz{nxYz{tVN&cNiS$xzS8VaLG8VF2QpGB9$iW?<x)Ys$dnXV1XEQNqBS
zR|k@DVPNEV#=yw&0L1ZQVC1xCVC0027DSw3VDei6Nd=&xOVGd?$b@JH299<H<~-0g
ze!mz7M$T{sM$TZ6326+BoHH31IVZE)*Mo2LjQGL8<loD{oVOQZ3@m{~nt;TiVlcr7
z162D!W2qV7t%i_YhDbpZ32RS+o5cB<(4gVm!@$V71H=)mXJF*K&cMid8N`!iVC4M7
zz{vSd78Euh!W0?@kr52cxeuUKDJYs2GiEX}W-x=N>6}1&pCNG(4O-g(N_n6gyO|5B
zm>HP%9b;hR5@cZH0__3WcaedS%bbCc3v_etzPk*J^;`iAj9flp3{3l8LXCiJXc1vx
z&Oar~z_jlbgC3F%@GDiLVOOfwaOQ%x2Z1fhVqoOT0NDz%sG5P13$)S~WD(ai21c$)
z9!U0pwS#V9sbL3O!pOCgfst!1bUZeC0%&b619L&-bn8lX>3Z;<Z%|BtcXl#@H*bSO
z*NK6#b|J*+F^~yL28J1+Ojiin|699`fsxymfsxxXjDfLs7gQanqYMfq4F=|dlk5zP
zwfh+uxx*P4xkDNBkc`WLm1Z$Hpdka04g;~Jyvz)YU}N(c7`byj7#M5MK#heJ6$T(9
z&oVG_H!?7CgLFDEFy>!?D2j#70Wy?;-FSzYfieFP10(lb21ahsp8ovz42;|$=j@ba
zV9fvH2Gt4L^Ax)U<{l6W<QfJWF~)m5Fe4r^Fmm4pao#g9f&{t$vV)9ZVB}F`VC0d9
z25jsZ&~hmT=ECEUbd<%&n8CT2F%!Cq7@FW>-+*>TgEj_$2A`Z5>X}m?Lp%@%3*-$T
z4-}PxD$WlKj6B8+j6C`v&L0Lwo?r$>9&bC)l47VP2bk02z>&tlz#zi?UW9?UC>^8)
zq`!`Vkq0yukqXj3lYx<ED%2@)J`Btm^-<8o4<0QB4Hm~O05t|drT)Il5K9tZMuVfj
z7_?7%-$MpQo?Q%#JR6u9827znVB~qhz{v9?mx1vpbeVcW3~Vql0k-3iLzvNwQ=Wkl
zZtfHY2532%06R&@Mwronk%755A7t)B21Z^M21d}GPGC!TWf>TGrQH~qQ=yf8!Wx+O
zK`e00sR%P#a)SKM$H2&I$iT>}3*tyKF!FjZF!H*AI2sI$yparyyrJCo{}n-AP5>P%
z1lsh*JQ1{x5>_B3R4_2^`!l_;hFzlG9vT$jAy)<l25^~NvKr({Uj|0rdIm<`QV=JK
zfsuC|10(M;5GR#^k@qeGBk$#YMx=nb0h(mxSSQRF3l0pZ$%zawuYg!!uSf`k4{k1L
zVrB?o+~>={$j8CJ$j1UQIf{XiPo9C150n-6r7|$`88R^P>3c9R?kj>g6k!NE1LMA8
z21Y&y21Y(RXw)Z)fPEHI%PuVi9VAG!U|`(e0F(Ct#nSYNwd}(6O%MaqU{ybOj=eMj
z<cbLljC^qnjC>(T@t&pwi}y5GX}}@O7zFkz%%}#KSJPl!9syxSA4Ue|QZJaXT?~wT
zZ6McxGH6;4$hoiu^pJta3`P@pl1+o0^y38Dg#&SIIxNX90A;4q!=Pw)XJF)8&%nsH
zP##HL0n91su;Q7A8`P_3F5L>zQ_slvg@KXp9c;UAdIxwg#fgD2b{o_#=s8{t9w58Q
zc&Zr~W3Mu1u`@8nzGq<MmttV#7XxwrFfj6)F);G$Wiv3wK4JioC%|o+WiKEGWk3&m
zWt0IKRL;Q6z_{#JJp&{EN(M&$+3XCA%S9L%1sE6@`F~|IFfM0jC}v<>F3-TgX$O*1
zU|<xGXJ8bN1aWj37zLad7zJ#gg;T~6@JR^FWuW7lm`fYL2RVU~ex?AZJYrxjTLdZx
zN*mZfH9cZBG*d$nD!&^nKLMf911j-w`oVg3*?RC@zF;+AGgyil3>CpmWG3Oo5btHe
zLKvKa$~Q7IFbQvEU=&DWU=)Z`WMC3L4>=o2_%;KhKpz96Kvy;clkg!is24J)Kq{{C
zG>|P54L~l1R99{ctoHoi_D1Fw1}5Q`49w*drsp)UE7WIR0hP%J^-L4RKwG}uz`_2n
z0qU+F;M~T*&;knf3NvN~#($F-7zI`^FbXVEWMKTa2J9}ze>)f$1x_<C3LMR5VEi|q
z5$dii2?pkJ1_tH|(76pv6FFQ!j%IWN6(Zmb<yjdFOyZ!aW{6`A7#Y(+tTaXgkSmyi
zR3NU%hBj;&z>9Y)-ncO!q;|j(X*O&k$wrw`iP4RL>3JYj_YPQp5UxZ=nbBQ?m6?I*
zc^m_yz%vF$fhQnN76YTecLqj*uTbY_9|86E7?>;0gBk%G{h;{gC;+)0lsvLQ`&y<<
zzu3qwQqKdiDhH*Ws;p;bU}iOCU=-wLU=(D{W?*L36akU4uuet}Xp>7R19PQ0C<7b8
zg&iRFR{DV|LxgYyR2X#b7!$`TkR;@^WKcnnlLHz`1DOL3JZ82HP&dKC<qRkat3abm
zYzG+_1&tUO1+|zNnAvVJFbc*oFbamSGcdC~WndI+XJ8a;1#vzyFbYm%U=*B^&A`ld
zmJ1pxxu9)3Qy7>lKY}bX0tHHaF(b_Fxe_2}Ffdnfg2Jqr5mq+jf{yzu1(jMKJ}~44
zfP4bdZUE8_y4}}_fr-B#;^JKB<U0enL0PqqnSqIaAp@h}N(M&3#fl6}{JWVZf=-X*
zKfyFn1H`|o%rw!2oq>t}5d)*(IR-|-6WI(*{Oe#5m1n}hn9DuAwV7S19@-iMEj|UM
zY({Xpu2E!WVElfZfl=^11Eb(`5a%)jqmV2EqmU?wbDx1xD1d=c$c>$W@%w8AMxho4
zMxi<o=Q{(V&=LklA<&U1KbRR9g$^??3hh>8VEn-kb|d2tN#=<sn4lq-Kc^m)=NOo)
z-N1nZ-Y$$-n~{Hpf$@hm19LU>z->^_z>jQW$bSLJ<JIjjy_ulAlEK7b0}K27KcK-c
z2IlJdASLjV{}>7+pa$;+FT{XMa3V}D2!OikHb@&tHUqSY8S3bQ9H{1>(;v35i?V`?
zn(4n=*yZaJAn{cOtN0T@DXa!`nAoda21ZbiUFa_}1JkQY21a3321a4fuKiaN85o6K
z7#M{e*cq5!&0$~^j%Q#Lj?QLadesW^M>zun)0=Dt=9+0R2W6tn6qYM6Fnuy%tY^%E
zOsYa88JrlHe6%4>s)8-l1UDFKW0@J4e5@H5h3gm?g+YfJ_yjXB3eRF-6rRS;z~lpR
z!Da?VVbHk>KG_V6!Y3IRg^z<|S{N9GZ!j<lU(04-@^Oc`ud0H9$!8)%J#(!dsQd(t
zG(rQb>I7tVvlbk|rHl;F;jJprnTt%|ZUks&9muIh(9Nn#p+!Gq1}OCEKQS{f8Tl|U
z3cqGx6n+ZgL^3dn@G&rofX*~EN@HLYF=k*C(N<(&sy8ZTnrOw&z+_a<z$lW$z$lUs
z#=vCM0||nqYd{H{fq_AWfw}fJNYz9JMv)Q*Mv)>0c?Kr9^(SBj=u+^qa8N6mk9h|p
z19KhdfNqdeL|PaaMVeqvna02<GDVhw$tbNJL>7aHdJiOf;l_YuCPH)k(mM>yfh$0(
z2_WZpGbMm}@Ss!6q30DW+rYrVz`*yEkNFlW19RPekadR`7)6#cFp4Y&an3U^itJ}#
z6xplDz+`lXX(9(Vw9s7!K4yFR!ghAydT|COE@&yT6udr!?>is!6;=l3`b(hm#aA*g
zid<%36ak$|!L^NnQRD*yqsSYO%p3+rQ9%YqQP2<p*I@=mQ9A}kQIlK-_{rl-zrfDT
zS^5PUupIoXGO$8%nF0e7kE1aIbG-+sSTlhom1Q=dO#lqc^`Mm$ps0r?lw~QP!^Rny
z>-(msb+D_-Hb9jvgQR#^(Y0&^NZIri9qj7$3qbiFBt6jzT=Ij4OgM}{6(!?eA4r@p
zgXP3OptRI*hM9r!ZyW=oXdeTkXon&L<KGIVi3;otjDK4h7)7@;Fp91Q2~J{~$dS#!
z_%|C?Z7=)7!1(VN19JoTq?U;a;4<9u!v}`tE}&S1dSQ74q;hX)1Um{|xx=KVfa-Pz
z=7tT^+dJ9S>W_f5A|-&t1hCU1o<f|y8a9)+1myI_c4h{~h))cRqAwX3MIVDW{}~v?
zco-PPINTT*;hHjFiFY+@lU9K^%XBu7`cDjuVj2vLVk#ice};NSF$V@lF&k);esu!_
zW6CS2Q&(>Qxs8Fj5p?_pZ24|72P_g+Uja!YIXxNVRwo9=ozVWtYVcSv0|Og)O+?2-
zSq8?PJ|H3zM5Ks=R6;v*Ye0)N82Gt_nex~em^&^jf|N2(oB$fu+ZoBgC>G1WC>9P9
zO<|hIA<n?KOBxbBYfM00BYs0+rgByW=9W*242-)pnJ0FDH10BEU=*unU=*tai8@1S
zo?QXV6Q_Y?K}JpsV_+2PU}s?5mBGL$c9Vfo?6fHZ<E~N$27W&V=BB$Kja49bK!apm
z38<IDz}!>?id@jLq)et7_(tM&GZ>fyIvJRoR!?u}W|xqB06OgoQIV}Xz`(dWlYzPE
z{Pd08?C_%i*4<!W+}FeavbTeQfj@zPxp@l6-cDqDe?aVQ7J%E!Xa>tn>s27uHd})v
zK@}CqQJ}E|XrYq)0j|^o;)Lc%M#g$*HNjK{?-i|2067I(HmwKy28WR;9E^-<;MG9T
zkXaJ|HTe*7il_i(Njp#j8r+D5x7pTIFff{e!lD_}T7su7@Hw{?OmOvvFn6z605QEq
zV*2+Ub~(_f-9CE;<`(Pea=q-5Tx)JHFnNbDFt<cZckE>ssb_$y24z9G;X6QXu?3lJ
z0W)^34pbrNh$Ohe3owN&#f-)(aJ8VWGRRKQLBgOk1ZszXkI!K=f@O)d9Sn^7>_Ig!
zTmd7<LL&xH^zJNVVBl|JU~Y8)CFCNei5$?dTfYYqyRG13XCV>D;Q%vq{R5CALGdtA
z093eDffpe&?wSF~0c+oYCbRgb2s5>^GBCHZD>5+F?^*`S0-G5a#RV7`#rbj>n4Wq<
zbgVOh^|#l7vmFBi1CKD{e*t;KK=L{dxDrsN29@j*!c5GZ49soppy5$g21apt21aqv
zfis{%WpQH$MsY)sj4T7Ac)cqFqqs9@&{Pvdz(!8j#Xv?*Gnu&@Ky5rmBL;>r2F6{`
zy@>0f#RcfxkG2F*4mb$uMeRDrz$hNdz$hLJ3$H(r@M=RkG{^&78h`k}ut9>Mp2_zI
zJlg(%8zszb^+@S59-blAseodPfw>JdY7GiB&`2Ct12ZVr;I-8T2L`6+<qXVidqA<k
z5e+kYLj+VDyrz^R1}0v=p#UoJ2CN|#7L^-TfP$EjF^k#3M+IbsA!t20lb0?eVm5|=
z0-ArBFw;a%2IdYMW(FoND+WgK6b43dP^-hsje$|TmVr^cnw^2kD~N$nd<p}j_#`_9
zCa)Z*2?d~d19u`fLK{#FEz*-&8JIgXK&DkPFp4i>U=&{j;!I><6yM9hD83uSX=Pv(
z2Zb}}L?W-b42<IU7#PLxNHZ|`LQWxP*!Too((aOO2PL!9%nVGv`xqF--!d?YzlM2y
zV-0u*jx=*S=!gO)js<WDa4pTi+`&Hm<pg$V);$c&?k}cuPGpw>EwPU)f;0|bs@GnD
zL`p{-DEPpoETbnVxDYXN01~Smplv;{jGF>K;%vhgr~%*>KR82yu06?Mgcm>?C7=e>
zZwJ{?248-?(F7!clvYwa;Kkz_4F<-Yji6Sl8?<`f1f6_k1aH>un#|0=<o1n$QG$hm
zQT!J(1Cu)+1EYi;1EYiyh$F?oC{e}0C{e`Dz~rvRz$meXfw5j<9*Aeaz$o#8fl=ZS
zh-1URD5=cAD5-dek%7sbiIKsMff=?pViSBM48#JZ7X}7CcYX%u&Nk30Ej9*5Npl89
zNmJx~5}O)8`xN+3@ww|UFn6v4tulMTz$od?z$ocj4-527ISkAl4;h#{?|=dXG?S7E
z57-75kUNl1mfW-iQs;CDf>eV;n6;Flm_Y`q+DTc!$e7MNkpn&ewCM~~lPf}#7KW}F
zpjs2rOWO>s-MR{=drxMUte*hOOq&Bhrol|gfID^u11N?ZEFd{z3#{GU18P8ZgL=&l
zUJQ(q(F}}|ptF@6!WkGP>lhd%D-;=+96%>zWiv22q=5PYZqS+YEl*%0C0m|=u0H_<
zdH^3|4l4t5_e@ZX2Qe^8&SzkhoD1TVF)&JQWMGs89SY^<#=t0fn1N9e)NXf+V_=lL
z&%h{o)0%<F4Rn^8TN4AL<X;9x$=}d|Z7TyL4!SE~-a^E|3dkf=eHJ1vpcVC29Y{bR
zg5UrnBY3a~roe`Q$!QJ5NKoJ~vq8^nJqT+aP5}i@PY`HyV=)7xlmG*x6c=d24s?yd
z!7U7I3=D#dDz>ck49q<epp=%*z$j(Nz$gWpXh<w(V3cxZV3cx%-1x&N70JLT6%I>U
z2YVQpD?u8~KsBp@3uxGc(Fzui2RDFZLA7ZysOV=q%V-61B;(}ekQjs?HuM4H$oe@w
zvJ8xqw}>+^J^u$+z{$WMxk-fOA14EI&mm}Fz5rd_@tA?R2UNMUIC!hbL+pUr`vP=2
z3;66O(COHL3<wK5Krt+NQiSCjsG&G{3j?E683UtKo;U;JqC_63r5&K+P|87s6?6u0
zFX$N0MN$lmQu7%YrDiKKFfLL@)bB6mK$<7LR!HSaDrk&{(Et`kFOD!UE;40c?hT*r
zFpXWLeh!Gs$e76lt?rjihuZrAY;TYVE9d~bK4V!1#$`(b85oyCPYQkU0TfkIDI!c2
ztjr9I%e@#FrM5FLN^J&l!eJbF2FB&kS(ld*peh42a`zH8Uhg2nRBtW7z})*EqzM$a
z7a16(KnMCRZ(v}Q0&_rzS+59zxak%6aCNCN5hhy!W(LL;Neqlq4;dJx?t?h_Fb<^I
zG7H*pe+kjkA;K!a$-q2qDl-G)EL{dhsqYMoQt#Or>KSKQF)&IiGB8R@vokQxa%W(a
z_F!O?whLomoCUS^CF~$R9tP&VIUrS$42;sH42;snpyt-B-3$y;4;YyHwu7V&FfdB@
zF)&JZfu+(J7^FTiFi#Q%N#!swN-t+%lwJ(tR5CD1pJZUHm)<Ln*s%8M3M`CXT>+&H
z1_lNe5$1F149xw)puC{Mz$pEbfl>N9XncKE3j>3+ILNG421Xf921Xfn5N8qtql^Rt
zqYP+Zf7W~kMj3SmMj2I*%o+wp88Ze(853~^#)Z&R{_0;#fXZxXClTh`ybR0}pD{Bq
zF7#tylyPTZlyL@eq8S)vk{B3e;y|1X21c1$21XgsdWMCi42&|17#L;dfn=H(7-fz#
zFv=WeXJA~|&%h}2hJjJ$1&A|;fl-!&fl-zT#97I}D67f9C<}7X!fgzU^|GD}jI#D1
zslyD6vP}$(vSlF71qMdh0}PC^+d!PV42-g085m{Xi!(58{tihCuO&c>U!>DTm<9M5
zm?!iwGca!9U|^KfU|^I3^*OhQFfhtFF)+%34h7w!poh@;rU%w*ebWOgW(7oict9qA
zG(|Bm%7NyPz{X`UFv@{eifmC}V3ez5V3aEdw<Q<8g1Q1W%G1KYJkbH<*4GS-a{Ua9
za=jqV4+ciLc?^tlbD%}V>pcwM^VcTa1r?H@W0*rSnaWsTdGqxh2Bt5Y8JH(B!lXg6
zptd;Yf4Cax5pEMf2f#6bi~y;Dl{IffKqgFAoW(9vZvnAuBDiq_RS54wzD@usWMG~M
znstF018OWYbN@gnYJeI6zC{qjhy_q1jv~1hWCT+asFkAwp7wb21*8aF0q1{^3W$OX
z2F5wT(_hSDSF3->z#t7en10qH21dE942*K1qv&V7Wnh$h%D^ahAC!iFF)+#tGcd}7
z7RrF;o#Z1K807=m85n1aFfhtDF)+%528KZeqx?JuM)?^a89fF@`6CRB@_UeS+FKh~
zA^@=<d97ZA`J)yC^CVEiB~gWeQGtztQGo@tkZCq_BK$4*6j$lBBFul}8JH)7mM+cy
z%D|`~!N8~>!py)phlznv!H9uTL64n*aSlHNqk<O$qk@Mi1LGVS1_tRv49t^3gV=Lq
z85k8J85kA9LCUlk7!@)Y7!}g$K|FH?MukQOMg=g(g@I9FJ_Dn|TxbRRb^&N)7F1f7
zGr>dfT?hlyOHWXZX9G$qphI;{85n0<GcZVBVql&Y3km`o21bPg42%k!Kpam7Mn!Q3
zMnzT-CyaqnF^z#yF#%K-&Q4}vRP174RBQoB6)-R=-eq7^yba>iGB7H>VPI5zCC<P&
zdnF|Gzx@E}63Q@$urLTQFi!y;LOgpn1Eb<!21do7%nXdPPcSelNiZ-fiGWPF%D|{(
z$iS$i56ukkco>*IBrz~gkp_9FjDfM9F@uTYKP)M~Qvn?x43PqNYiD;cFvy59Fi+(G
znbys~sN}@Js05l|oIQhqQ7MjrQ7Hmu^a4o2odTLUho<g24p<g?2hD|3z=t_Ql64&q
z11ofl=-msb=8cGCTPFb1{9z7M7Cb2h)hq&+-2s&aFHwWaO2EAI;R;9=$y6Cow~TSY
zPDpUpzXzZDC!;08Vk*JFJdN3!fpNiUW(LLu*BBU;Y8e=nszIE`42(+s42(+M><o+x
zJ}@vUtzlqPS_b0$Wnfe~&cLX2G>n09A#^q2N7$Sg3j_01&|&@y`573MKn7j`)lds%
z85m?77?`Kd1I7PBB?d;N7YvL_PhcK;5B2WUZJ?My9QyqJ2q<4OFi*V(5oct~U=jTA
z-x;p&4#=wv%v0Y%<Y7VZ{trkWR1B_If`M^?8iN+|G|-`v91{)LOjJr4lwdvW_XZ4%
z^NXNa;DZIYyfB#0u2r7`O85-S(?DHrNGvltFfwK^LT2SYd|-H6!@#(-4ieyyX2Iku
zkg$IF091X*1c<PTure^uOkrkVocxG^QJIl}Q3<q$X7YOmMr9cWMr8?c2F97t6M0{P
z?)hVoDHmbc&&j|%y&g1gHS;qAqp}eLqcUg(&@2W9MrB6^MrBZiHj9^mQ8|EtQP~gb
z^p`I{{s6fK)DSdfV4VDifkCF7fqABwA_L<TMy81pAes*{8Zkwhfl)c0fl)bDmVt4K
z20H`e6jKI9<w6EV<y;WQiJ_iRxtD=axl^8jImjR4tyl1!*RMdkc|qlxfC$T3UIymr
z-<cVhgW?z%m6tOxDle61U`~VFki+l_exNp74+|4xB`X8-^q1=y8JN?a!Odoavp^=-
zGcd4lTd=^Q=~V{<V+K5vy|Q6ooco)Bd4?$1!vdfvpC|!~@mC>GS<r<6OvT^}_TYCX
zF}%uPV4QJ+fq8~ESTDRj`e*|RKnCU+$sqBG^>E`phCn62yVVf}earwSEan;DoQ|;m
zV*^xtHOL?&^$Q>k=oz5x*|3gYS_8=KmGIvA$1M!Z>HAorN8f+aU|<B@x;5iB$S80J
zm1!b8$A5AF$s%MxjqET6#wh`ifcykqR>7dcz&z6*6wiUswDKthRU>GHBUI{@1SoVE
z8M8op8o>p~O6Uy-pL#%TcA1$Xte|s4XM>u9E9Dp%mG?6+D(^I9U|gxqz#y}mfqCX~
zb_T|k1`LeK_ZS$J?|^E!m5C4+ebxXM>E}ck*Kjg0&jJnougqs)RQ}GusQekEtA>G5
zMVx_AMG#b8tn6f9RIy-SQ~@<9KV5|y0j?xvK8P^RWo2NV<;cvy_~|JFqe>71qlyoR
z^Ou29rHX-3r3}RR$iS#Fi-A#P8g#1e3wY!i9FCx62+#ukvjwO!U|^mV4+=}jL>@=I
zEkh;L$_xhPS;ZhJ#QKoW4Up<()<lpvR118r_KOAsbB!Vc^DOXC8(0=Ra>LBU$m{}|
z3`G<oUjjf%kqiNkGaI=u)HA(m1-a3KfpH~tHt`E=;uCa){YqyBMwJ~5j4E5ev9toZ
zvij2oP>WlZO@tM6`05-`gJ8v321b?Z42&x0O&J(h++tvmm1SU_?ZwW(xZ*woqsngv
zMwOqS6K_2gA^!c60y3grR#${^D=!1{Y|xRYo`wvJsv-=Gssii`OrEw3jH+4;jH()@
z3{0M$3=FdF49v6Ffn>ZG7*#D97*)-o$?3}qP|$*sIENj)P4T4x+Ry+kWeQ_pT=5oa
zF>EO#3j_1)`j;RFeqvx$^=DvI^@io`PgfWiKXWlK&jGh$5%b)iet^P}fq4$-$Xjq=
zGa91>^=BE75{O$sZJ8<tm;zWK^Wp^q;}_^enLNWw$T%SL9PpA1!~w-G!NY*lbC<G9
z)I;toV)z0Z^$h{_?&k`C*1e_wg8B;F*OiSFXXM~?V_-~&YWXSwYa@bKpc0QkL7b75
z7n&x&s(|LD7?|gR{0T2CX24wf)dE}`)`ONSCeMdh^c6P94L-|ou5mR3WAaAuHVek&
zGN=;RVw(W4JHtRqI-p7vph{pP6%bP@K}w7uO3d9LO8!GPCorw32N^SeA~OS{c?1Ka
zY90flY8r@>%D|{Poq<txB0B@4c@YDn>LCV3RZwrsyq1AcjfH_x^_w^YV<a!wJVpi;
zP{|^9Oq}ZtF9Y+u@9YeWk@5_TYK{zyYPO0DjFCD_6FKA=7?UAG|BMVLpdDGpdIs3Q
zn1(n@A0Gqrym)2?#^h)QMzu%=Mm10iI5~rXQ4NICAR)`haD{;}VIKqYyg*Q{tALff
zj0|rW7?aDO>5P%V0<;x?fq5SI3QqW$?u-l}42;5Q49xSur&ia4kA7!_&G0ZXaxgGP
z&t_nr2X5V=OIkppblyv(0hBcGJdHEbfMdl3(10Ts%S32gGcx*s;~M6C8Hg$K`N4%W
zd}5A~aSmutKLhi8&{ds?BYGJbH$cVhLH^}{O!$8Iz{q$4Bn~x|@ehc@z&szkJO!Su
z7?}j1;^4!(ITWBREk-64kT__L2xJo|75;+^|1+|}($5=E+E_3Lw5rUWfl;lIfl&>#
zQuLn>1Ebm=21d0lpe1H$kmkt0A_hjaXAF#L_drX`A{pgjr=ovgWLpD^Y&KYTScIRQ
zjhBIWfi`mx1Jm?P42<d=42<e*kRpeXZ3py(bY?F03$WUqkxc+Hp}oKh6bgvdYEb{P
zRX`@R7vxV5SjjFExdal(3;K|vDkA|FBW!0F7}Gl#&N4DEuw^kYuqA8+9ep{MfkAmL
zNK9%C1B29}g^X<TSaOmQ85S~f&SNjqO-;@yW>`4={7QCl0T%`a8yAqKd_4w+e7%L!
z->hUetnX!KU^p{hmYIQB%$<RO?EnJ<TNosV<bVhBKu69oFe-jy<X~lBVC-b%U}s=h
zUBbu$qADSREsUTOqs~-wu&`$4l`w!3BtwcQBO@CFLy8=P5@%#$WngGmWn^M!V2Da)
zW?(pL(#+4mzz`h<VjH)JF)%PVf|$|mAYo%h0agZvGf9jBAm<q|vam2PoSDMN!OXyL
zriYOO#A{#_0I9cTQ~(JUb22cT(d1xaV&-CCVED_$z@VKn{rf6*8|7>!CXhmgzo2s^
zWI<<v&Shj00PRbM4CONBbW9Ih&91_xuED^lt}?x0HM?>>X#a`2CFnHUvn=uP<qS+B
zVhjw7vS0xw28J_!3=9n242<fY42<f|AOX-;EReu-21fOXAOTRd+0DSH;mg3N;R+In
zg=o>3$-t;F9VFlh6<Ef=sIdSfFbgVhgrS~MV;@Kav~3Gy$ZG~hji(@ic8C&9P6kFz
zW^nn<z~05c%E-aMAP72i?Q9OVn9PN?oY^igFe<%afy5*WBqmuPF$ocDVS&VCy&xni
zSwIG-h_XPU5<-cyK%$Zb5|!-ms0;%!p)m<!LSqudjOqZzuN4a<QduC8$^wa07D%MB
zKq8d|6jx`Ztyv(kDufiPpe;9`ShZfuZc`79RYneR(4le?pajjx3O+ItvW<cf;b+D<
z3=Aw=dGi=RryVY2VAOPFVAM3^1x-{ifKG|goX5bZIZG0x2$Jw~D?n9)?r%m`5iU*!
z2A1OtjG6}-7&X^|IOiD{wG<fY8MVYfyz2~%TA>V#TE46d3@i^o1n7!D7SO4*tc(nd
zTHOqcTBV>{#dsJPwf-_NYCQ&V#2Fa1S1~YZ_kcJ`42(LK42(L$AdW5rqt1H<MxD1H
zjs*jwE-M40&UX;UnSoK)hk;So1H|!DXJFJ#Wnk2e1@R&n7<IcC7<F4%85mfTxfmE&
zp?ARNE}1@O9lKP$3IhYv8Ia0W21eaw42-(-K%9vTjJg*Y7<EsBICB{obw4vO>b?YV
zRx&W^DKjwYNrO0B85s5a7#Q_Hch<8WWMI^5WMI@Q2g#geVAMOzz^J#K0c0oSDj7!5
zS)1U5>A=9i1PTn+`&^)fSZr<#40<Nh?box5dg%ROVAT5nD#-E~81;=A81=P5oN5L}
z{TK#D{SXkRoq<umk%3Xa62zIzz^K20fl+@M$R@T0kZ3AsnLcMdyHvd&0|PVIcOMxT
z_3tt;>R$yp?k@wQ0TTnG{x6VzP6kE;Z3adIMG!}nfzcqAfzcos#8G5mG?>c3XwVMg
z=rS-GTxDQ1I0@odGB6rSFfbbOG4L@kux(;s0DGEkGXtYxAOoYJFG$Tk21djB6b44a
z1P%rUwv!ADdQA)rED<27a}11zl?;rAprxp6w-^`=r!g=ZP6Ek1V_-Dg$iQd_I@Oo$
z69c2+Lk32}n;@Bg42(ux42(uhj0_CyAciReqmep@BgVjJRK~z)lm~JQyD|fV-ZGG|
z3In52;4}tCqbVSs0RyAa0tQASQ0%hXFfbaeVPG^`0g~}xU^Lp#z-Y9am4Sgh1Vki&
zgmV}ejV>`T8l3})fXfIe28MHD(^)sN@Ada$kpkUQ(hZsvVZFt~z;HH{MGY(hVh13x
z(~;Oo2=+M*B)0N&!A<P4{$4CbU?V_=vbli_3T5#IjpuZO*a1lFbR>2Xf_+W{iLE?c
zZx_3S6R7Y!8_E&@HW^|Lf}M^eo`hhZ(?DV?Prts2U6#v>r5J1k1ON2(yV#}bl|g2O
zvdlqpAA+5ZB%Xv|pVL5MD?{1L@$tC~P&NZUs2ulWnF}-ZOfV8V0*P%Hi^TCnV$VWi
zyCAXKr=Qr&E>rKq&%l7a9w>n}*4Z2w7&Uz$MSdr~dO(1TY9Nh@^#H6I5Jag4gus>i
z$t}p$0H}J_5C^qz7+Kjsl{>T=KzJEk4cy=@g;fJazZn>f-t(3*$TNVe0b>IOMq?d`
zat20L4sNKBBLkzcJ*Z~50V#4yz!xs+9cN_a0@n=nuNWAOLm3#2JwcVhCk962E(S*9
zHW23*1EcY521etVphB4$MDT$KNl@9O!oX;}n}N|7R06Q-GccNnGBBF3f@G{17){z4
z7)|m)99ITLQw9b`lRF?z00X1x1_nmcRUl3@1Ec9z21Zk>&mdkJ1EU!W1Ec9b5T}rV
z(M*+r(F}B~Gix;iqgg5gqnR(r>Ne03(G#H_DVc7&ja{xDwv-=KLxAgn6%34KI~f?w
zwu8*t!oX;Dh=I}U07yHS0GG2j7#PjYFff{(0tr6>5g)+iawY?V-fIR1W)o0ZmdC(o
zc8!72><Wle#lUFxgn`lQ5s1^qz-ab`fzj*}BZC72+av}?vwsYXW`96Z^B5S-1sE93
zK{3d-ih<GGhJn!>Y}_^mM)O1lM)OE;U2+)Wi_$IArM9!n)|bIHAUQBFFc+~hFt9O!
z9mLPTpwGp?z<e8Iwg>~Gc{2l}Ip{=tHU$Po^EnKR=Ad$uO^1Qe{2&9P`EHOh3kF8>
zXAF$y_dpyM21W}J21W}m5GR0v(ZZR5(ZUkMiD6*0$Y)@*NN12@sAph<3=}a|_<*ZE
z1}4yu6WcWgMvKi1j23G_8Xht*TAXEIv^dGdz`*u~fk9uBfq?~FIecVbw0Ok8XaS05
zw!aLFmY~~6e}l?rP6kFxO$J6wc@RgGfzdLOfzc9ll>um}nq><Eqh%FHre2qU(efAr
zqvakD&ys=B@;3vc<wpi-1_pLF1_u2Ykgz)gqm>&2qZOzcXAfpzv<hHgwDJSV#4|8j
z#V{~hfvPR`Yz9WFJO)Oq98i@2s^!_685pf97#OX}Kx+FL7_B-O7_Hhs(z8LHm0@6D
zIwv-L+Ya<9<1eK2q_D~m4`l-tm}gNcj!cNr6jmIvwv^Qw9lO|N8NH@2+r_S7OHnN`
zoqIRCWGFFJ0_inE<!*MF`uB_sjCzn&?2O9~oMB;LIH$|Na4waBfx)5yR9LD)x)7qw
zj0}wW`H;-DN}vO`LUBe0Mgz!%J7ZPH5hk1_YBMr0+8W%07`aB_2OCb6_KXaSM$o~T
z>I*BBU<$Vf?qP3cl$K>Q6b@qC;lvs$9>E>S8qUoq%)lVw!BERszy1AQ_An-WRt7_1
z1_m2FMtezSJ}Yi(ZcA=;Nd>SvTRldEkf$(6tKIb61MK44yAQB)GDh(-fTdY2xjls~
zSQ!}nkOg?Tv$+`<{COFeIUuG&)C8C?F!Ol|n@BP+1Y$Ujfgy;SF;tvUc>BA9?5>Pv
zFttn)3=HY4NG5><GEki?$SB0_AW<dBD7-!MF#CSSdXVYJzV2YugS%H<(o<Lg)U54<
z34*;1ItQl<O+<m4fuWmGn30)}o7IZjn$=Q~0~8QFj4X`Ie0GZL+=?uo!Vn*V#CsX_
z7{DRP4pPglE;)VOQTA^pP(f($dJ2O~oyW)p@e->g$SLz7T*Z$Jpg3S)STOy;F?Mmz
zg^XqlAnz`kcAQ--d@-XiBR4nL9pETh!pOpi>4>F_ppb(&%2U{0vV)NuWW+LvH@G_(
z6*;UF?=iqVvwV8)adwIN6`*a*d{&Bl*5D{*U|7k>$ml5yQV#OkDu}6yk|6hig%v=i
zu7(S<S}MvR#Mdx-FxE0QGfFTptc5BO1Ka2+ECbqhxsDMO*9;8n8D$y3iFEs)<Luv<
z`H|y|f#KQokEhw?7@toUIKwVm{{mzXC_RB4D8tRb@RCuKL0yu8;T0%gAQ1!(nAaec
zp!5t;$;-g-h7mQvv@=4J`CE`ukfGe5gbXtD9YQH9C_BKEiZQ%r)MErEXs|dWPkh*Z
z=nVS<mg$Qxvga^%Oc%JszO25N0RnixK=SY`*al9>4iU!L&^9FlWN8uOZ0M;sjF8jF
z80Wy67#tA&b3og47#JA1Ah+f*E{Exd$}fjaAVDrmlxAEG8c6}U!2n{wa@eqx&cr}r
zSsex@2Iht5L5*qX&^9At+zPH>2?w$Q#Lxg-!Rl$q3J{G(xPr~@$O@K2J;CIIP*8xZ
zU={QT3nmVPf|<w)s-V7LbU`RMgsfl<=qx7&&{o%pfx@C-Z*B%1zXjX5&RBh6`-v;;
z>MYxT-(ctF<&KX}$t=!}FD@xf+AjKxT}pGiH9v<Ak3~jeUP?}Cyg@2ML1u1zazSZ)
zaY<rHYJ74ULqUFVNqkv)B12(nZfSgST6%nWQD#YMd}>}vQRVaoX$~FU?9|kP_>zpw
z;`oe$#O(*9Im&srJ7{tUaBq(?;pkx5{?&q`nsxg*JB~#>+iScz6!@pl$>WgPz9Nca
zF5`B;7>>CdqD85>`DLl`X+`<D@nGX}GK)*Lze?d)!OT%moSIycUsSw(VFt%<*6myK
zI94)EH>hH=6D~_FD$dN$Q!vsqG0`>DOG`E}+8$fT!NbK3^^l=~f$8>)YK~&=>48Zc
z3ftM+IVN#!UpbNEI4f^yUS?iqNoHbBW>sp+_WbD_2Y99jE#Z*h%7G@j+=}S|OE{!C
zD<Da#!~?{Y;wtfg@T)qeKLANXRabRDq?aFnNUsvWD!mFaXUVum0Y$p{3`BP|<bVxE
z7=Mid#I*Gb!18?6kh3)ydl?uQ)kU`NS<2DORiDGd2s)1gk~bI(b9k5x<})xb!1yyz
zrDyOk8G@uixdl40ZIHpj;J}#0;!waC#!~Qrk!3Ms7FY=rOu+^g1{TH~78Vvh=$@Bb
zE7&R+l;$%qFmXWFj~HxWKz4?~84h%A7|2Svkq__~3HCID!4rsy3~)U^SQuDXds-Tp
z=CiP{@I#%VerpArGDr;M7^u!aV4aMhW((8{KNn0-*~p>HxL|t6Mh?aLe`ieC7J&9H
zGB7Z~Lh9cQ4VV}U0WnYrBdY-gDL0ZH*u2=Q`wTqTgk2wkx*xEMT>mq$Ftjj2?PgiQ
zxB<onE!F@98eE|P3xf&5?CH6iIK-{)gT_gaRfND*JY=b8U_|ghmtrz7z?Ire-?xcF
ziP2{I!%Z9}<^gbnUk5U<!W{h{NjR8+iJcwn9Jm?37EJfq%n{FcWcr%T90dwTSQr#w
z*1b+=QP5z_V9|&`h)lQH!V$yt>&^68TR1!=Ggufh7*kjtu)bjB?`JSpfyU?Y3)BB>
z;gDk7GhKWuhiCoo6D$l0jL9q$SZA;@wXm?fU~OSzOh%;dUk_Lq^AVBw`$Y_6G6Otr
ze!oCikK`?6VbG{NG_U;r5y1#*@IpKZPB|<e82)fff4r4L(Tc-^F@=E<7BYWluy8go
za5hMB{Fee{7N`+_x7dSRhn)2OrA)Wm#$lY0!opy|n9O3~z|_LX;@|^P#sE*-zcjGq
zhbm|mgQV(TI^a~z1hwhc92QUxgL4;5zqpM<icw(tn{6Dni~`fOwsXic3QYIf&S728
zkpoJx@G_yBBN}Ww)TC}qY0ee~4g(bq12rVCb(`oj<|6{2yTS+6Pz=5|%#?Z*V=BDa
zni)_-4P+L$RD!u^filQ%u(0k?iH9YkQ;=E}95){rdQ?D(Ba=lT9#$}&Ix>aDPzK4>
zJt_%|GN9%G)aV|Q07j%J?=hG@e+P$*iv$aUJYx<^Kr&+v%K_%s%#1lKPdMIiFy^qd
zC~i??GMLY@K<kJWV<^iNtri`|P?i@uJ-Upcpg90&eqxM#F#Z1y4p}2udBT{Zkii(u
z0J^3Q;#$TW1r`P##!wcX3?vsY2G~qb*vTPMKY@i|4HIJ+OAkv2D`Pmz9oGM>Ah)nz
zU}prEoZv(WHOV`Jh2a7-V<gK1<_=TFNR~OKJ!XuNEC<Y1m@`Jgqlhteg9BqI1ELgU
z3^>BVz`?@h!7!hNLxnL5o{Ja*P8cgNf{&;HjYELb8)FbSaC2A`F0cyL|Cg_4sAn+H
z1#NB>wo#kUvVy&VV|vYg4)yveEDX+!DJ*jsZ!<FHuuNcDz{HrtvVds=6D-cA++f+j
z^neA<eZaDVZ2~)j3-%cU69W@ycnj*opbQoU6~<(il75h(N0`nqF($KIVY<V_n8I?0
zsfQJ=`vpJC6Sh4F(_TzBJis9;*#Qdba26g1m2w6l<pvmFY?&T^fJ3}~0V88L%M_*)
zAg7*SdV_G=1(qXha}cIo0EZqU0|OHi1BhT^Vgf}dEY5>ESQuD9iG#(TwVA<Kbv{c2
zV+$iYh^fptpQVLy0wd?d9gJ+osvzzJ#s!QZ#S0kgpMwtm1F4_Gw1x>JwuWgB6O-Y5
zmOV^on3#;_vz%di!@^`dAM6??<N1g<4bl<df|Qhu+d->j!GQ-0v=b~09NfJOkQ1(y
z1?IDG@N;(+Ah;74moqXZGcd(5GlMDvL|g|;fC}SqmW&*Zat4r#mFBbLRB-k%ut7N$
zcbFN&S+=nDurY=+faV^cR))M_Vc>x|XamE1mM4sRn5Od|;*hKdNwFYHvG6dag5?=g
z8JH1vgVgabCPQREWj6yODAbWGfCMoQC{Hr}0i}l}OdFUOa~N3A3}NAJ;efb+g}Y_?
z@<SYQ$sogF+VfeSFuq}A%xC!kG9{no4`UA~{(G2unArOn3{?yj=d<)MO<`j1fpVrW
zEdeP2+m_F=foTuOQYKKy!K+cm&?nP14s#f)BU_Zl@`P~(6Jr`gOB%d7Vhs5*z2Pv2
zc)fx;sCZ*!U}S`)q|gbV^q$Z1hOvQ}F`uP@xr3Rde?>hg;=wTtBB1RcMvz(#P@>_m
zVa#E9!}tLdBtICxfZY0psezd>8LS@^Kp<@hw}wlwFbFVnv3Z-Y2uLvXv#>}UU||en
z`NIk>V<0^XkPc|jgOpDJr_L!%FPIopSza*x0NL?_X$K2qD$5_%73_?u(;dq=h3gq3
zbXXW%81q?NQkdEpSW*fY^H~Z?Kupl8k$jd3poN}oAhTg@2gZmSEDRNl87zC4?l3cg
zZyEwiL+y_E!or{c$`A@Mj9DxTK=x;`>|s8@3@Ww2nGvQ?hlQcQlE00inL%cS0Y}6N
z1L+kE^H~Z?1W|=R8L;F9Bf7%r|2sJ)>OroLU`%0&dBMn-!t#P~2@^*PLl=XRq0D@i
zB}{9W7!z1tFmGT%2)3|xup)R<SeLLeCa`Q_-NVY5fSNo&CNuE&K#y@?y0Ab7l<OHd
zkc3vqc!R`J3XsIW%0RgQmOi2)SQs=Ib6GSZnA#b@5}*PJ8U~R$EDSb``7Aa*EdA5t
zj&g|AgUTv!aDtV>42g_jVGsc&91$P!ewdS{&0s?gIG+GX>{6fr42Y3Ik>rR#Xa&i~
zBtYarTV$C)2BRw|sbS1#nZUdPl*ZREZ((N42fGqfpuiIb!j+)p?NbA)RG1flYUCv#
z9Xa5mh(X$*zK@>4!XU#7DHECYSFl;g%ok>n(P7MI*}~Go%9zhG2NXT|(;bg-h^2uQ
zLklIQ(=zix3d32pu-st*)wwJWSeVOM=CeFt>0o6p=a|pZ!8(DJxtwP{%LI@a;m`&-
z%;E$Vh7eG2PGOzH%Gv`i|L3soVdd_hzV{f1lv^}RJ|u-Ph2;&)5mv?&mNTq(Si$W`
zxPN0o-5S1rttpI#G9W{YR21j4ut<nNMEa-89_Ns#|KS2^Y=M?@z$~A^!k`1I1@~95
zY++dfuN3!JFhCmWFtu-37%Wgjh{eKzF_h&3%M?z=P((8zUg85I=(-d{krC$ssz`ID
zo9*M^uaC3gmWPJ(Erls8911EN3Thk?a!|2r8<ggQBL`}2d;kjrJ9Ezg1{U@l#!#>f
z+|yt=#$*=u2$2Q`Bb5dQB@<W&;PM2e`79ARym0YCa5I>JfeV(7<0__~+s7eRA6LP`
z;K3Nq;t>HVPNA(u#<&?4NUdAO_yZ9rUOW&1%A+vF@drG>6&j><$e17z0&3MUB5}hR
zkU~A722|mfa<H)QFqi6c%x7SLE1hzO3EJ3VV1x!hBB<XCOKjIROrLn1LzyXI$MkK-
zIeb7g%Lxv}`j`qI#!#qzNem1iGnkl|U>yU-m?bO>3<xvkgBrYHEO)r>a6y`dNGhkW
zFbFW_um~71=Ci!vdcy_o7r{e3=?e=(49uWg9`ji?Fn(a<Vup0znQnQ^M{dlbDt3S=
z1~&|uZaIM3*GM@qSpw9x$zkbXTmh<zHZY!HWXu8Q6=*<!je{lD0~KJap<F?x1K_1J
zu((a$Gu`$ihje{%01JZwR1MQD50)v6OW<AETOKTT7(XC!L2f~$+2kKc-Q-&iEFSPa
z;4KH19+n00*4{19K?%^HPm`F!1L}gy`~(%?9P(hVGQvb<K?}nWHl#^R*WJY-RiCv7
zoI6-5RxmO~u<T)+!o(PXND^r_AGkr$iO`pA!@?lXT>62L#ip4NL?eeeRPqZ{@(Uw!
z!h=fwfJ*)VH<92OA}wLM?`{rRrnH3VIlDQmK=g{;91bCA2^_E>goHAp!IW0O!eD`r
zWLdzt0Un?SDp;;CuYd>BfeJ+PGb3iY%^nUZi;N6VM(Ec7WrThWl(du41Cr_iOZ8}g
zS}^cdPUeK^eS0_*m@+t~Z`i|ODU>B+zyvx@1eP1qr%eC7heJvya{>#41U#(<%xBT@
zK;nU>PGMOrbHa4Ty&PionG0ALK)p2?3&tGqfCwlSp{WmK8V{0JdBC|u0!c*21HoZn
zW?_LP#!S#W7*mf13j+r;$Sa_91~HVOnuCQwnlXz-Isr6XHvPs)4n9AyP$onu6O>0F
zX^Wv+MF3ntA=-Nk)g}=4atJW@)X!%TPyi`F9yO>onQn55Ly0kBdN_otI>jN&7%_du
zDGnv^DbT@!aK?NF_*ji?#Po}&I3z??WPr;%gj*TiPfY)NibGz+{m&Lq@s89X^a`17
zaGFDuQDVB=X%0Cik2TZNPICk?d2E@!>okYC*axNgEHhZnu<(|_S_^MKD9wj9`8*6*
z7?5OMgA}vqGv=`9J0R49MIFK!b6CPVSkZ*%uwFnDLZmYfgFj5-6%3FnhKmVa$AHXZ
zU}s<kU*8FfCifH5m!07-WODyA{pJ}Cm3WgGpx#UtOGXC=V=zkx#{>>g9L;B$0P4{P
zv%KM0!U+*r!r8$GQo*-?A0n`Te~kcRFv}W&9|9189|Aih7=u}MNKBB12uzUPFg@lh
zhkiZCl48b8mf{W$#&DP=nIKC(fCN53EXkbDvV^mRi!q#~g=-BL%VNgN`7CR=-Uu;<
zv%C>HAq){XA-qA7F`Q+CWRDa?phs$h6i7e{Y%9o6=@s&f;VdiU=O{o_%$d%0jzfrL
zgBoKvxCzT-a%Z~LISvco7Pbp)sD+Nn9To-^rY-{(6@8{+(9L@AD#3gXsL>wG@<959
zG-EKRxM5;~g(*nRdiwrz9CC?ZCR4EnSRGTb1|pWs-#9?@!F9c1VbEYIHek_kV9W>C
z_>k<vXbzFk07>M4JCJZ!Sm;c*JI^6A-MfsF)0)u&G{(u8!(x&RGNz&dRH1Z$dJn}0
zEK?X~fVeXl=P-hNg3`9NFquB@Jck0K$@Kl_IppgtKCm!|Fb1>u1TY4(L|kD6kGLRZ
z35zd~%F@G!F^452nK1`q7|b6K=`a=#AI312kPD2AVF*uK`f!6fA&8>XGJ=Icf-#3h
zK?RhF!DX4>hYyUF8$=kxp=A*?6u`!^a4|*9XYufX&><HX!3;zr3}QY~^WO5v^wk$Q
zBuy-jurSPEVhm?lz;uHd+Dt?8lH~;!h8)IFmYfCff_&P7=|3)TC@@)Gm@ajZ!vaKy
zT;$M`2Py3V4K__-I>QWUM<BYQRwmOIUgS{Gv0!0<^fG0H;Qg0r3)o~Fz+D&_6w&D)
zFLH>~gJeBqAcGw`7Fcv40@3wH1vuqEN=Qc69|hnT1(n*cIB>IJVc<dU6S0VhU<%1V
zgrxp|_`q~w1;}}zVK+nsS<jh1{}P89ll6k>$1icngXkBRIAqeS7qBo$!`j8u7O*K-
z%xBRtK@%`>K@)JPK@~uF%B`h?3G6GRSaEBao^_c+F&QL<G8SiJ0m*zhHDE2!fUvQU
z2L%Ld0Gkoa2jw_;cCqnbVK89~Wr+c`sgW$QiJ1QGGKaV%vNTdj?>uF?+!YQ9Cg&N`
zEv|6Lf#`@U9I`UbGe9}kcs`3k1(PvKJ#MpQ`ot?7l0i0GSQrFAnNdKVF%!8}2bIuZ
z5r|<7MudXR4GU(D11Lt>3a~J|VPXts`6IGHlrb1uf!K<G#yoOZRB}M3=d^(Gb_?SQ
zP~K)a!*m5a)F8546cipv9s%ik!NeHK@<U{eD0)q2Yr?|d!<fvHGJ%mXndOE^yC}FT
z0B?ZUZU7YvIV^XCztjtZb1PCl14}aXaDZfmLG%~lZV|>zgwNdfurL)1KuQW&0|ahk
z4cNjPB8<sk1t1s0I|8;2AZznkL{z|oIxG<xj5*WwuW@iPpAk7T-TE4bl$Z$%18Cxo
zg+~UtYd$^u8i%Ajs3#2{+W_^m6$~K#Y*2!qHe>qYYaE9745%ky0GkY2KOIpR*%@en
z`{>Z*X=k9pR0>)E3*+0!Fy_E#Ul{Fb8W1HdJjL4CHGukQ`79nGpok8MV9aNU0L3{X
zWbGPiz~&&OXS+Wv3<-?EEHyKx+g;+2;0E(S`fFxPPrSq-WeXNy%x9^Y0UFa=!nmFh
zwZmh-1vIV37|b$(aRbOzAZJ6%Vf!u9FJ9-6X0qQh{oQpADb5s7$r;R&b7Z>U4Gz)R
z9B8^s0a=$)&bpW}OBr$$6;!`N0}I0nM#d<XC7>bXC~$<sq&~1PEC5MuVcfyQ7zL_S
zL7svYY7QT!H{amUVpN#E?god9p2G(P#wbMiIcjLY8lwBbYps#BI_6COaf8EvF=D#r
zO%7FI$0ZD4t?*!Wl9`@(lS9HyqXptyXcReVSc7s9Z1RWEDFRe|!RE0Tomxa#xEQ~H
zvMWr(niq_W!P5gybBJ&{ZGiObET-SN$zjCgv|+lyEe=&trzbg(utwAxPEV$L-Qti*
zcY0C5n1&o6E&?DUf>|6u1pwGTa2LCXK#DS(IiUQ!1T@HpQba=J!&q!yFo7#6cs6#)
zn11#ahYX{`^jEhyWa>RY&1<-iTw83AOH|huX^{VsV&Aoeg+UtBo{_d;428F!8Nmuc
zD=MJj;JN_S*c&1!#@-MC84L2zbe1koA!Y_0f$4{Cb9ga2Oy|ABA)%X~11c0@!viJ>
zI-I4@fq78R0HhBd4#pYNgYIx>Fd5I8UUP>-6GSh+!=Wi{d;rvr4QDB605{v2m|%sD
z@r&uN?{FwGT1@A?%OS<cF<s*>ha98EboaX)+Ke&Ni|=w+GR90_dzV9#$*^Jijk_Ew
z^%kI@&SEin!^jxS@`mvM6QntNfN2jaV=&7e)+uZdfhlY|*g*|m_A~4dfivtM*x{`w
zxRZ5rSQwswCQ*8ru7G9+cCb!hV+?1R!M=x`F`R*sogJ3oK?)hTyQWv)<4|MFnZD>A
zhkkSg3j?T0#nQmE0W|)6h4l#=XyS`~18k}bnwRu{fErf8EI&X4^`J>RP@xKy(*w^=
z1+%E=Fc;U)XK7%Wzye}Sf4GQK*nm+_1~fVb4{#P8P>nf*@dzVhC`$*+5*Ef#mL)7J
zSeQ#0=d-L}c`!ZUK8M)E1eWOnU7YOo`VK4%8SIle!Y6Y~mSD*!;DIoiawjuQ76C;D
zOdt#_(7-r>5mjUY;~Yk~{yB_W(4@C8?qKAd%rQ}5GRI^lh#5N=FEH{!h3c6mN`VdD
z!!(B(VGQ#IW>i}?Fz*J5<bX`c0%-uJDQNKMgDP!K*i_Jb76Ea-a+xVC%?#3z*&tXN
zgeYhD-oe5k!<fY)W5F1#&tl;Mj(Q~X7`|(;FxWF@vDn8zq+qk04Bs`TS3d+N#kmhT
zbQoi%pL)n4YdeR9L6|XzMZ_Fj$3ij`!*|dk5_p-<@GXS{)Q$$*0wQ2e`7mAO5r+}e
z_Ycz}9&zY0YD{l?#G%1xGJX9c4tGYA>E9o5STIIRH+ak;qW9wjXbzkan#mY`d|_dl
z$O9T4fTlhM?FdlY#b7>*iw|SY^uv!iteB?FnEwAUha`xWdcq+MqRpRhWcoLNI^<a_
z9NU=~vskt>ePLo>%$UXbPij8P7p57^j9Dx*n3pia#g;JdU}el=*}-~*6($Dq1I*r)
zOQ!#O!XaM2gM~qxF^8prxrG@V5+F4Ye=_R)U}4Z<%wo|oX3S(Uwt)mIyp-1EP-X-j
z9|s9KMqM6x#&krjtScbRn1;j^5eKhZfGL&`W(04QXP7?aDTgLg#fRzppK{16SA5X{
z4I;yaEEy`k=s+R>TC6Zse3{Ppj6;G^V!G5bj=zc;O7mGbv}K^9yL%O;Fmn8t;z)oE
z_wLo0Zt<MMp<V#$4``x6jFvJ?1r`0E0dfl$u<s%6W0)$#A=(8k3yol-zI!LIDZwj3
zhN&`Or@~Vih;IlQN`f1q!_46W7BB>l)ZsA{6y_id33mp&2h%lPaHufZJ(%wIf<qcK
z@2<d9%*3Lg&zJ+Qt)c3sEMQ@X0XaUV0PJ`MSlmvz!ot7~Y96wifX0f!{k;z#7^Xas
z0fjEy$sj(mlczk8VdiiEI~n5QDGy{ALm8&Oc)_7ve*l#Da#&=H!B#;%Ir$3;cS;AS
zK4OO1H+g~q$UbB~3s<SZd<J9@X3h!d0u6|&o?%Lk3>(kCD-4+#pz;7}?UWi&0|69b
za4%02fDLvr2D2pOK+-BwM1$lZVU>gIfoVD*7lTZKhUqk)>AzocNY{t(fD<0n!f7Eq
z%p3|x&YG6M&6tTu4AT;Lm>fXffV*ev4i*N`>Jt_p<dJ`dsb@g;fhq}v$}=nsB0R7p
ztih(t!6G72k18Nx&eYF=unuAh6Uf=HD4&YW6at1=FmpD5LKW_m2@Rk%CRr@<Gp38Y
z<`8CVn6B}fL$<zwg&_cx%mOk%bEcrSEW#-hzOb;hpskgeumH5OjuE!*XTlv8P!|Wz
zeZT-}e!;mPKm{ZNoco1=F$L@~5CM)9mJbXQC8nQv&7sXGG5yPH4i!d;>5^|aG#MqP
zJHO#DV3e3%@`gi=QDXY+HypP0J~8l-61cx6`miwYAO{8y3y%OQUqFYcpNB<f1|y0v
zc<>wUkPi%m4XS5>n$&}460F>0n8X5F4hF9gCS|aI8*OmMPK|)h*@Yw^r_`xApp=8;
zmZ?3UsnUKH77<XV7iPRS!_+A#Nq6cL9&o0H=lZD&P?GM{1rT{q>yv?z5k9=eFhOCu
z;yVsaMF)^`5%J@~0L~b2=k`}j&wj@ttyjUqFax}HWCr6B(A)~#zWxWGMOl#LDd710
zz|g;E`j&SbHuW>W!|)6&EGn?E^Sv5uEGp%o>zZK+qJIfW`siQ5fV{-3e-FrYu!c25
z{~i`_K1B#z0VhRRiPV3EgUM(<0~5sX=|b;0#Oq-p$I$-+CE)shKmrEtkqIn3kYWW%
z1SKdZut0RcO|+Si0S+u^DPl9>03%~2yi#PanG?g9B7?+VumQC81ztMFESRqNfkRk#
z0l3&kihBDOkiuBS0GvXQWG0=Np7?=7##ulboC}~9PqqLR({OVqO|U^JmnTiIVdG)o
zF5Cbr!Jt|uO_+Y*1BV#ng6Y>kaA-0vn9lf-Lz;2HblHy_vWyF+TYuzGVcau4;UkBl
zrU5vJVJ)0~7qs-;w+A$`kjWyFFkNvCr!dn~hw1x2awz*curLHLX0ik<0j(ul!n%hQ
zJZy|;d_A49hJ`Vb0W_QgO*T(^SQuuoFvhSfU^&9V7z6JYF+6pcuK$TclySy%*H0X3
zj11FrK5-~BGEAQUp|*VDP-0}6e*F`N0i(-wj?Wx2^)8@Uu}~Hs0p`-0`79Zz162&q
zT|lc9Vp%d87#Tqa9>5bjL?R3<0b23~4Xo!OI^cR1MV$as4FgCa=zai{qWZZDiw$Iz
z9g^+v6#IOQ1d|!4REC+oMgn32oIm~kXAV(=2_noj8p!IVK*|T0vKc&#py6#8cgb{>
zFC6<AEv7&I!lA}!F`erxhc=_dbhEEuUhG#6T}F%P-4Ma;UpZ75EvDZAQ4^*!e&bN8
z-+u?xgvw!wDPYWDDX3sfMsA1ff5O7R!`vJ(pCzOKM1f09Xq<uN7?W8-3P5!LEFbRw
zApqvW18n~f&`@r%0SgC;FAgxUF!eAnFl=A+jU$(lkzu;P4{-dN|KQMPOqrhkgF{Ql
z^9rca%7LuILu4ke6nRkQ0G-YNt0TSUOyB#1LxIWb&Gh>qb2O&2{p8Ts0*xXw=CJt0
zgVe)Z=siOO%tgvuZab#O|KyO9*8tCi!4$eDq=5UL(13Q|Fn!KXjt)kF>8igtlt3*{
zea1`{{RzyF)D15hYC@iX#z5fZYR!}cq!E0EnhF^fE&&FlwpdMtFmrJSBLf37)TUYs
zA5ixl=8jqg2^I$j6(k+C3KH7jK?!&$`<?(T(aB=b0M7`55)YEp^pC$d#6^5h@Gy0O
zJPnue`7mAPH;0s`&j(PR$z<WV0a|{aiBwkjd|*M-lc52cyU1b@(14VfAOoQZB12<(
z{cjE_Mvdw6e>lX0Gc>@38xySf$k32s<7sGMV3^Oqf+PlNT_G9LGXbahJrh9YOEUFL
z09hbmJ^|JIo(UlHTTsmJnIMB^zT<@Hd4D*hJSITB8~}+uc){;D0pepsZ5f#X8bHiq
z@mK+hY0%~bWVz`V{%}Z&W`H#@f);2(7s@e2ZkYb>4~L@nmJ^`yBe?ldI~3S>{#`u4
zfYjuS+M&S0<$xvvs?9**0*|dAh3Q#;ITRTcruY2ikY!AmzUnWBqDY20xT^+I35^E-
z8`JOq<xu4IzX2-hGFfb1Fiv;;&mqhd;4od`ABPR2!}QpH9BPaK(_8*=C^C9XU-pkf
zh0$aB>3<xmj0Mv_{^L+))R->%pF@dJW4gtE4q3*Y>0$pl>==8dPyNrKB6^^LtrXHM
zgqLiIbEcpB&mqS+XZqX!96F30Q>8eS89S!hajGzOOic!p9h~y&l_xqtIRhRRRR$d3
z3<h#M+?#0&rk>-}WLz-y2Z)@m#K@_|cx1XSBd0V|{EO*XP`aIwQ=TjS1q*{YV+M<P
z$aF<DPT}c?89B`*C$P9AFy^qNR50eSRP?}Sqi#)@F3iLkP@jB)g+ZJ#lVuLe0v5(h
zmJKY&S&%F4qz-VKgcX_-lP-W}7vNbt=>@oefTiAKA8;=SzWE|qM}ft`OJzO-vIuBh
z$Dz**P%+I99~eN&CO%<6RmL*$0jkJ!Ze~tN#+vD>%$zoiHPe%rIgJ<%rcY(&G*)L3
zVdMG#2b9p^6@My=2#bTA3R2chW!e6onNxw0QDC|NE2k!7#B?iGPASHS>7lHg3XB=k
z%UC%rl(szp)$nltZTEpJeTPTJ_6^f7uyRT=x=eq?%Bjq>?Zk9`HcmC&1<*0-WYCNR
zT=$L@(Tu5}$uDqxLQ~_871NX0I1LyZrcY+$bYyIpewB^Wg0W#bA3LYM$N>*#4scD!
z02>9^abS8NJEs)mf$2HyoYIU3rgyM&Dw*s!!@yK-#=s1V7APOy(%#8oz&sIYK@`JI
z9-Zj{oSY&|J9(ymVdqp1+xbF;F$%FsXXgtQX3qCWSr8%*PnkPksDRp0$b4{98>M@<
zd(QM+4o)ZiEe`0u*u8~?frVva2itrW76(W{4fEjcEz|FDa7r_7nf{A|Q`u+_s>gOi
z_;8Qy{-T5GvE4tW`*U)NGVT5`J&lu7xqjOR7RCtBiB^zq{q{X9jG!3-X!70uM+Gz>
z3ad!A|50J)T!@rLw*OIJ1T8UxD^~#d8lI@O|51SW8kXR91(bjkz+-$@YJfDT_(75f
zO^P9LnTwe~l@Zi}T`NFUFEd;|!i9y4kzqaqvIximaH9$qV!I-y=W=l>)JF(2W-!2O
zlU)%mAgf?r+f@Ks)eJ9?cHNOd4u@TLWSBYMAbEV(9SQLC2+Un~BtX`}J-+LX1lZ%?
zgbZzCFf(+#n9k45sm#>zV!8=8rwU`h^hj<_B}R+sHQbz1;x*vmKZp)^{+T^v`dV&I
zea0En?{afGFcwUg<Ka|g)R^wV!#SN%XZjr;PI*S1>3?`Qix?M7&*$ZoQCk3t5x76*
zEKuMmX0TK#1Fb?t5}m%0ms42Q1JuqAW(kM@4L*aXJ>VA4shIwdms3}u0@b*R>2iFW
z;*15;&G<OA84IQ-@o_52tYBfd0$M_L2ed#Pv|9yk%B&637w~aPnMANKFfitT+KG@Q
zv(UUf3r!~|+F()}roZFklwsU3otvLio^iu;Z3yMf&nfG~0V;IZU{N<~0|#R$12PvB
z7sz~gTtE$<_F(!deoh&tX%D8K;OCUFoAv-SRguAxF#$Af03J?)djTXjn~^b{Wi}&N
zHXW24L9v7|OG$uJkFjKWpa5tE$n;(TPF0<V9n2s{z!Um(7Z$D#22+)021QdvhzU^r
z(`%;R6X29&w3z-wfKyFL;sP5ZXtDsBu%^pEnx1gyOjnrhAjm0EuL4><h2)Ispe<O;
zT^ATwSaz_15;lBti(&c=7KRC|OcQw^+tB)W5ZQf}4m{C8ozt-aHkOXjJOfE7FlMqS
zSg<UfeqE4Lh;hU8SAv{Mj2ou&3W1~Qj1Z^%bWb5pDW44t&}I=k)FT}m7#K4cSXfz+
z1i*P0ArHFV++0PufoVPiCw$c*L&t{c>*1zbvTx8~S<IL|e|mc{r^0j{VNMRt6`&4p
zCJToNxDPpfLop}I^blcACB_xgB}F*pr%w~+l=4}D?jE}pXzsCF!GP=@yA=%B-D9_6
z`X6CV8Hnljj26=)ML0DXEv7e%aH{HNfEtCtEE*F)%@la#m%o7YTtLwUkI3>L)31tf
zsxX!RnEqRYQ=U;_y0j>#DPzO*Kv7Ny#)|2aL^-wj_dH->FyMj?0Pe4tenym2U2@M4
z7UqdP0^qI`$Vh0+?fEgCM~qXCY0r=8He#H1Ai743Q%xrX)W;5EiFpE9D+3Mhy$60U
zF(yLIfSRyRV){8TPB})F>2Jk2#p_E@1`76VU}5WF;HXF5FSzdkXnQWaSlRnQfH4+a
zj6e<C`vKH-YZL%=-69b~yC8Kr;KefV&?wlz!jQt4#gdZEn8}hogOO!1<MgeUIQW?v
z3N}oiDh^6y+jod_va&E9n7&V%Q{Cx+3u6}CM8-J>z$?sQE@7PKB7l^O80UpZfVqg!
zVw{&VU0sG#j%i-bbaxp}c@Ui;!)XMf=g4r%+x%f+Si;O03K>s8T4X+7qX#^M1+9V@
z=LcK>t(-<Od49n3?=qZLY6~4u+^{eJ!Ud^>d7E)z!t`)iPEGlR2`mf;K+}5{K$C@`
z49uXC5L$156wR0A)M30Z{fsPUoZ%uK<UnU!)B!OU60eMlX284(i37$(8>UCgaY`|6
zm|iBwDaW{B`cyeiZN?4L56W>$8ZDNX4%(9f54WW{V8fvONXDf$3@8JTj7x2%^T=~*
z)GxL9%*a{HF@=fiKWGCfT>ml;uzpzJEQ=7~EM|eJf=%5pE{g!w;s{L*kTx<rRF;88
z6xcc$S{M}Pv*=iZo7X6k(>Kd=iq_vzVe4S%VE`AWP~R`R0~+&#Wjw}ZcOsaJML@+Z
zRDQVx%8HNWCOnM646sHT<8l-5_Hx*oR2Uz=oC%^F5`hd1oR9!!D7Ba#puh<lF{x1i
z*XHvTI29NzrXNt?lx4J-eh(xlF`ZG7Q_`dYRBypt$53_x#DzE2O8>}!n`+=DBCPFF
z`e(YIBBxxvf&->pnF45KZ!yPw77kE{MBIV77}SIXyASHNk_XVzJOEVu2ShOS@t{j9
zGiI_VM?gwzxYJ5Gz#}AZwX7dLFccq{{y~vbh4H|2Q6)|_#skxBlsF9-4@}R6Q1c+v
zc_mIw6(1G`1IAF6fC-GCng~&rmt;U@R!#gFbEY$Paf&iCSSL(3QRehvOqkxN%xTHE
zX8LYrPH9G$>1$OvC77%vrhioC)MAvFE~CP!&nU6oM}^ankuha@ohqj;lhvQ?YgIW<
zF)?~fuh8IhV)U54TZ7Y+(PKKRCZ`*t$8;Y}PHSTp5zu;4Xo6%YVi94QD1fN{idaM#
zW56XAEPXK)DNNs`$*H8Guz(q?lmU`-7>X1YFhkWs1Gh+Fnii)lqr-GLElvf-8Pn~x
zIK?D=zA!-+H-fi$AxsUJo~OlW$`~+xi5904W5D#|TAT{5prHz;9wrut7^WU3(6MZg
zMtCs?gH#W6iqQi$VY$Cs2|R@f*`xwDxR_(Qjy9(vQ_+X%{@R=}AUao@Q%y<(H0F@V
zQZa)OvNIN1m@pJ;Okb<bDFu;_0n5k0qZt&-8q*(YbIR#!fJ$zI`79hZqVVO@`#WS-
z7<fSUsM$D(BS}ox)8Uk~*uMa-0JPAnVg@62&0q^*i**@#3#QlWa4Ik^n7%-VQ-ZNz
z`c55AX~u%-S9Lg584ITW*5TAQ2X9pfX5k57E@ng;$Lie^z*h`iXFZWYNtpvA2M?Rx
z8PgMWIVId2M5Oxh1Se#~{{usxg9&d3BV>hvk%}^CA2xgyCPSab^!>V=(u^9@Z|icZ
zFe*&b<5Xf)n69kHsm7=<-Aj*CnNeYS9!M}|`b3am!So$^oN|f*Y%(A>K@*W>gEV-G
z0`5f19n-(-aptp>urp>&-?)KM61<3miTTF#9(~Tb01g%g0nr|)2VsW{Fi+x9n$IF&
zAlijh!XQFyF=G~F?K!HJh=%DC4LF6FCh<(qH{g^4(cK1|k}6>HwlH2`#HH~9;~lup
zy9S(6o?snEn9nfdaKjnqJIpu?1IIli2Qjj|nC@W6DOJw{8m3KS(Fh04{y{SwBddu%
zY&qGHPl!SqS@;iPb1JI|xMvA3t65D-Sh$!#Lxo7@!A{*c@(G%iAa#)0hYyUb84j>^
zR))oVaJvZVNY*nf3>+euVJ$G7--uJZev*I^d}NuCX$fSl06cy}CV)!3EEeGlpe9Wg
z*kD-M4wpLum4g?*Az)+RqZJ`bz-K2Qg&f1l6)X(aj9Dz!)0Y}?$}z5(e#D4VlX1oL
zcSfA@)+b+p`m(TUjNz07Xzdp=7Z$DuTEJ$)U3(y6x`#2R3S-3dTw_ip#)#<?j5(zl
zBc`u0=9E;Ka0ArvVMEiggM~o`7H|hDroS}ilxI3{XF8V&r?l3AJD}!p3X4q-BY5H#
znh6ek5CC%#)_$1oZ^9|6df*2OQ$GWI3lhWJEugV9a8n3Ye9c`mz0-tKMrMZsXp(@D
z0kjny<RV5!*s$q5mFWjfI9(Zarn8%Jx-%wB_c!HKXH1x0Zpx|4xMKQJQ%+yT4bwlH
za=I|hKQZ0Xj8ltg{)g$QW}L=M^UqA5WyYxqqK}$!Dl^T0F#VMoryPjpGUt?IESRoo
z&Z)#$Fx>}2<(qRV7|!tkcN;({1{SfK=dduafa+@&77uXy0^}!1YGT+tXZitiPI<;T
z(;t{~N-*x2{?nW@ijiY_hy|xHBgga(3r<5uj_JEBICU5~ra!mfR90Ic0b1GttHHK}
zIKb^=fRB1@37KwS$*E)z0_qE8v2gG+X0Y%(KzeZS5sxh)4$KpKK*0%(h%Fh@n=Cos
z^IO~ibrG^yL>w4{SsXm3f3)Tl_67;6FlMr-=rd-q=zBmL2&}BIm;lKuFlMkQ=re=n
z9$*=d!QuyM1C$|~WBNTSPI*R->Hn-aRjpM(PRwDE2?x)iKwXmUVh)N=XjWy&u7NCX
z25mWlr;@CO>2cPa>LzPg7z~&ua<CX!F!gb;Si~?*1nvEX8kDt$gSm$h)Z#-5^Q;}y
zcUp7GGZ}rDe#@Fu3q-Toa4LalEhz10!>PpBFul-*Q-SHgjOmkYI5mV0%mAGcglN4O
zO_+YxhEvMw3kw5ip)gAi;|}C*9^)Jll!iHk%K+EUI7eo>qAjOJy#Wh!AF~WUd_VH7
z12QJ6^I2q&g)V@FbW8+MRVj1KXE8w*1gQfFI(VR~ESS&Yfh-7C=~*zJ<p|>uMrMu#
z5aSG^Abf)a*cHkN^I6U?q6mZaC4dVr1_l;LN@nCRm@a6?DPI4Y`wxQ@7Yl<7=L;3i
zAF3c#kjP-<m>>We1cA4&IVK3OxY(<psW1Y?7E}jkK>%d56Pn5xIUAtMpj#OG8Nn0g
zNCC=a!or|FeYqW{GNZ%v({`LDj1AN5IW3qtA56Eh=agmQ`Z7Jzo>NO<32167hegAH
zF`4C!@E1_p0_6gzKe$<@|F!2-NJkN3Vd!Co6>GI8=CdpjUL%ae2jzB{6S-NC6=w>d
zD$W!DRsXO=%*f3$UCV(}ijifys{^MJqrmhG2Tn6af$8%dIJFpUrk`@)l#`so!l2BU
z!=h}$7!C3)+@3$v867!A9C&{0U_=_SW#koD0OG@YSG+MHpnaUsyu`@c0cy&_<AC?Y
z^iW4m`Fa)|p<)ITRgV8sR&vD*_Mn4+z^NS?5h5o{Kr@KYQioCG325dXHY3T%`+@-!
zP0)rDBOeQ>n+S3%G)VbpurT}pE!BO(^@JN_4k8nPq|R_MP5<o3Db2WHI=>UAHj}`a
z={8QBa;`f>U=`DT(56jzpouPFVd!CFj9{6;c10T5Z=yTSfHpTF*(`cx`g|u&DaMfL
zyPP<sWI|XN?yxWhv%FwgA_W}*fI3mEVEP9qP6^SLBaqoOBs0XmOqX@$l&;q~BLqsm
zNHR((pv7|&O<35cFfm3V8XsaIGLS-<5nd!Sid(QStN`sAX<`1t3JC*f{Q#4SWdTbe
zuOeU+PhnyB16rAUgK7G9XHG$>5*CIxjEvDNCzy7yg3|*uf+Q5CKXT?YtS?bOnj2;m
zUm?QG0b0cZi+%AuDNI(N3<j$z7$rPF%aS8mN}e!-PTPUSutWe0V;G{9C6R!9&=8|U
zi9CA`0~Zs66sY?Fb%K=64go%}&tL)`(-*jKideM>u-7tps2U>8I5SE;_``=ZVh-WQ
zg7XnPo~3?Ff9Jv}C#<u959BE(xP)}fba_`!DaM%TR<4{<GBGR+E0`IhShg@XfXrk?
zQCQ&0Da|DPV0y1Br=rlD1n~3)!k{<P54dtlGD-iKe%qB(s(uBiWC&-;*Z^Ll4hu9H
z76nkCK^li2J}}ByNPye}m$r}q9gPH?OJbDCVBo4(1UD#^8Rx_2n9#*xjXOq}Ei$0Y
z12PSC(gdT-7IE+h2Q(06_K3iw|AXw_!;id)M^-=qHm?g!$kGj<$~%X}!Uj~K!lF}p
z0t?eb75Iu7M(HIyOs1f?g9n9d1PjCT&u*OZj8moyyK|Z`@=W(~=hS61m|o$|sl#Y6
zeW^RA7Nf!R3+|kteTg64IrZuztQm6{ctI`)IZZaghIwKKBfQ_rD96LVJn=dMA_!mt
z3@lL3$;E(LvP`I4csR?I>|tb#2jw?dnJ2e{g+U#($1wxsxq6t*axXkUy;`_2M;MqV
zzGGlOm<ttvhq?R)eQ@Ogbq0u=%)rD3;~rrE9lM6gg}X|j;0|cyl%0VAG<E_Fb%lcI
znx32r^#^*G!K0{9lN4%PAp6h|d}fXYPz`_(K#pC71_#DO_;3WH!WD3N1{)HB@IeP#
zL3JxyfLj=_l&A2bo`I>61rgo~FTi|wVXr8l0V=`ZUQrZKXUsxmazzgVW)4Lp*C~2v
zGiJeOQWzC0Kq(bAkpku>B9fHio(YWg$oT>!0E!k^EGa2~Y92<IYZcFc9S7^xFhcnV
z$3hl(BOLpMg{h1KVV{x)$Te_j5I3<N(e;vD0Fs8sxa<OyTqU~#C0EI=0OcxJ%a~Cq
zr3JM05nhEV75o4d2nhb3HQ?1=u-v6|VFn{-83WJ%>8{?K{2EF(9KgK);K5LMDpa}w
zsuq#B(`&prB{Vr0kQ6h*hFV2i7#JgvR!%WWY?!{+n^T%e;KTG=-kb{c5-Kd*phX|B
zhBl+11P4bkLl1)zXx1JcNrDn8uuAmRRYd3rHi(0A5G-nxw<v(CLuk5EK9Yl+Dpfc@
zO(b|ws>sY?W)|lB51Rf&w5l0ZLZ<ila4IooOkeNADG?s>gb9?^;JO4C@W2{O2P)<x
z5|v5_e3#gP3d9J$Y6uSt7xRnx44_Mx;9I4HIHt?_a!R{yIRZ5tUXrL)*f8cmov*fq
z0c15N%y(*A<}fn3%m*E$k7#(PZJA!@%c&5l_Qf95pF%EW)B{);6j&x+Wth*R5YCv%
z625{F%tHj9`UMT-;1f!KEpvbur$Q^HfA{5-lj?AQ1wZ)U3Ant@nd$m|oZ`|tXIL0i
zn2I@ARCFK*=|KCfj2b@E6a6^F>V4n~UXLn(Cc>b8)If+ITL2P=o2=mjI&7+#1GIxX
z1(CTm&WJE`ID(3Nm<ea#&8t^e5!p(kLIJD}nz8CXFltmNfQ|%(O=g4mFh7Bl6vE~Y
zEDUE@7!z5Ru$^INOk{u!F)(U;xWf*M{8vYjA|E8d7zy4%4=qSF1y~s7fXrxNTLUs<
zdZ|CB0As=QHh=Ie*l~Z(I>v_SZULN)j1ALI1aO8hHcXcd<TPY#nC>6QDUp`Lz%qq(
z3M*(0`V`g&tZWMym=~5ZuuNc^zy=bVz_x%5EY`@tvVd&^SZo8^9*9^D0|U|_Y#^5;
zfIP$a2R1VXbECoZvw@tFjys&08j<Q$O%PuV5#nIJ1|ms=`2vVmqUMh2>Oq_;iUQ!n
z3Sni5W(;UD1Swx>-I$&e#Mx7?@j(F=hDR67XW)XRZY1&7Zm8mni3r=Zbp*g%cx-9w
zurRy;P18>RoktacNCDa=28_7~Z)lr%Fs3mud&BJ0HpyU2NBBb9WHD$ZGCZ!q{1im~
z2J=(FM>s))Pupbrp<qq}Wed<?2)uj{ege)z$ft&w|Crt#!l}miW4cWUrz(^AkLk%F
zoa&4c5K#%JsKoS}A)K0wJEk*-a_Tbfm~I%#X~ei=dP*p#G2@QuGeSA#84afI08u-p
z-w5RlVJz9M8^(E(mGQvz@6nvrj0dJ0$8cJLCN5$)tr!!guZZCcWlWg<FNV{UF=4t%
zET;}*!t}&g@Y<>BSWX$ngzYn8IfYpn8>X*G;*@9Xn0_XSQ%kGI2DG&p8jB3mPB8HF
zGH{+y;e4&y4_a#ht6LbRotUnW%$dWuV0v#drwZQ!76xO`mZ=EFFqViT(-ku~Me45}
z01XmmvItu+hOt;IVS<jeKqG+R>YWB~?F8dr1D&}9FPj*yO#oH1uyAF#wgEJ&1gp9j
zuKoarI?SCQZYW}e4aAKwK;?&_a>KzTC5V7TC&Q%+)0<K_wU{nln7%HBQ=wjE0>pJl
zO0IzRgEPjmxZGi4jAeNM+8P^+SUYv4rvW@i0_{FBfca4%?a;E2;Ytq+12<DC2Mc!t
z_)H?iNwZKHPOwZQ$js@!shsTfb3Q<ZVqhmvF<kWkZTiV!k#=F8I00#Z=xPcm*})ne
z3|HoS0PReGr+$VjZ+IYGIfRloJj@&xh*lEAWgpPFA<**j1BlDSXMiF<{b4Gn7~_uV
zKT^R-Q#*~*o^i+Y>@-egrno!PC!}#Ixio-w%oj7Us01(-gGL@;*_0u^26RXkc(fu1
z-ZEr}?*R>kg2D){@M6XEZ)u!Lj1|)*(>bN<E1(JM3VQOnxCI(Pka~dOQa}uNRu0Ck
zKuJEAW}qaWi$`)m4Fy>8xp)G4JP))h%W&}uXr8Fkg2jd-1~TsjZMwr`Y*;viL7V^J
zCR~XDH#I<BfhMR68q?pWbE+_EOc%-ERATg)Zl1v@SDyktjRKymFLL-GyZR!yZHbU|
zKymej25|2cW+#Y?l;}ZR#6edKATCmx2XVt07@)`7!+dl4!t^H@oH|UWFH9H8<kSVx
zj+vZ_a;Gn_FcdSUvlL$eozeqc8wB;&=?l{vGC5TlS4>})$?3=#F#Sa)r#)l9bd4-d
zN0sw0w2@jA3}+{ZgSkk-a^7cpZx*L4)43bd*JN?Zik`cX!U$SKfu!V&&-8m)oGOey
z)0wk5H5dh^>tu5(FbYif&E^zOKmP)}hZ|OEKr94JE<>Gn{spMx7{ww2T2Ye$YTQ9n
z#Q7H@NIi9i^Dp4-h64>C%fT3G$f=0wr?WYA86&3u%;p5`?$^rU)MJd89+|_bz^E|2
zDu+{w>C~I)({eaXJVDddjG-(h9xM}2FtEXE6o%6+%An2}Gc$B#k>PX!3j?S{2O1{@
z9jpu)<VVO(7tZB0W2~6&mCLEiSTVf<LM_YX)MDhAeleF*3Umk~_&{XPhA((VKAZq5
z3Q@R-T9Dze1SnU-i|xZ4Ea3D8_AD$Fw9J_9lE<mdIAeN29;XW9jOkM$)UG^ECD0PR
zJWhE=mg#@<IBgkOrd#K87BjL;U!TwEETzK2AkI|G!y=x;7{S2A%nUQIRb@I)0jCV3
z%5=>FPC3Sk=^h1~8jKaw3kx{anc6Q*pH;vquhD)1G>wwa!qWg6=Yy9!ZQ!*QNZjcU
z3pj<1BUl((n3#(TK)cF2SU?O!RnZm^z?cP{?uM5mZBwSJ7joLDMWnDy+`)usFfu??
zqXa;}f$5!v;57j23OQvN4@^H($SIwc0-9rohikxr21e#C0mLXT14smUOC*?|0UtMD
z2;^a4>Ogd3VSE&uTNI}I7IDgJxJZB|R^ZJXh87nI7B1lq@DLZgvCq(~Fnvl9XqtBV
z&LU2Q)C|yx$zbE4$+md|q;{}z0OvYr!f%GCV}@m!<{A-H%RmAgDG<A$Cb^#g71voT
z3MSxb6CV&?f-#dtLY=uMdp?W038XTI_1YNRPp~j`2_W1L<%1jtHPNmBx@H4nVl;@)
z!<fm!qs-iyJ)cDx-9)<ru!-=p&~6H-EQEUkE)9?Hjs)m#cptEnnK}}tE0l05S|xx6
z!!lSj>>1Np?0r}kGiHF|5K|j$UI`XV9SPH`OF-?U=`%_=6&W+8?<(QcW?V4+SqWz>
z<AUifrJOa43#K0|<@9ItnJ!qy>B{IcJ-m!FozZ9d{xVK$&=h|er@5}p14i(YTeyWy
z;FGC>SyYaIt7xPkYML=UzMNB<sp-b_nsQEMRUhPoZW!u9z@sD}^@tQvS26uaIj0e0
z#q{sxoO%isEDTFn7^7JBupVIpt?Ncpd||q41*ZjL!1THbPBpmz7KS^_jL|G#nBRcL
zU|GS6p|MpTF#S*kr>YG^O)x|a(gM!<gci^MGdy<cYhExiCV=xG)Px3>>B^Phde5zr
z(}b~QdUYkIlyn6PLj+?i%O2J<tc<Y?pjlU_^16!Y8!9=a85^dbspM3ypI`%8m500t
zi=pm?GgAc%B8kEH(193+`Tz#V7$P*;H{1yT=K^@ZH=bc(@L<eg@hD(7^si%(QJK%c
zfmjLAWCKc{Q7k47j8P1{C=%1Ft2iaCY(VGxMX|8RfDS?fWiU|t2I~4I2NnhirXB_s
z0~65hEs($9);2{<KUc*mClmpmKt$}32`-rauZmNR$@Rr_wQ5c~5S>=dsi2<#Y7)VQ
zlNj7wK%*_N@e~HP0uUEA_`=}&f&r4)T|P`dRn4i$<nm$qTPQ71!znE^0d?Yu!PQ{8
zZ4IXslk<=1ku{t;AiBMVQ@!2>)O>;4;^M*p>l*KQ!GJ8x7{<U19Z+O&abaL9hU|Dj
z76UCz0w*PS2)NX+FmQ;KG8juiR-r%_e(rg|20F}uN34`V5JPIZT`i|^Pz`8=8a6+}
z;4%eVdBGakE;EovT^U?9paczw3)*?gzy^v9XgoPRn0~mHQ;*5%!Sv6yoO<;tDWH))
z=wKCtvkq2oJL`a^h2UOv*1_~PND1VW9Jr^QQ&<=T#7Y^Auz6ZQ1T4dk79P{r*KsQN
zq=4o=7+|67+ydT+1Lt;tb_2u4cp03*TozPWc;)H*V7hcYr=*Va0})<?OL`cT;A6@R
z&TCLY&3VoAgnCXfMuzF-^_-@R4Aa-vb86MQfST6uWZ)5iHJCgCK<DJbgUKTRGnhb1
zG7;&?qXS{k0~BG<-csl=ID^Ly6%;3W>|g*-EHEH%baZ?$y{dszhsp85^c7J0S_7wg
zy$Wbl4DNC#>=En)zQhCWawjYi3{nD%V0aWef!0OiO4mG~$j6eddmA|=nf5%GzM_#+
zF*rj8Jk1aDs#6On2w{VP3?Ob8BC4F0po9a63r^tRJF=h&+@WH+OcSR*W5slzCQcK^
zis_9_oa*&^P(s1s2qM^#a<{_~P<Dccg2NHa_yZ{k0~hk}FmPmGVc-!f!=B7}M8GoB
z)tfnaL4G!C=2WO>Pyzdy16oWws(_;tnH$Q$g34t><-*3^85|ox;RP=%AzXOj=;(tI
zULbBJ1H<&I&71;E-VdffZ{{=s(XuU^h9Eki1ymrQgp?2V^x}h>UVN~m7myO9l<t#(
z2y&#9?vud)3JbW4eFPSuIN4{xblz6ZUBc-s0-$?0R1ntzrBA=r%Bd}#!6GBW*~7s3
zL#iLNs8~it2wJwj&X}&y#;L=YG2OR~(~|M_^og0A!b~R;rq5~PG*#IGS*&7U!kEL7
zki(e6vW4+FXcZK^IzKr@Wcq@AoFYs|0;Y4fa~d<QnQq_CslX^RJ)xabTO!1sdE$BS
ziT9w67p&EPEMWTLc1}&kkm+aJIi;D7-I)HWol}cZXS!$yr@9FXcvmXCXgX42fl^x^
zDX{?0(ST|WXj(o}GQFUKQ@VZvxL#+3Ws)NkKvN3vcKOj8IV@Zp$oqzm-T-y(;Wiy(
zaDfdtrp`bb&p18@GC~Y*QXZcJzbFYhAPi3BZ2v!eU^rwjU7(XwRv-X8U=HhnAF`Ql
z+sSFj)XOlvpp$b2W6gBQF3#N484fHAQ$XtkrZ8?{g{)SBPh`w+xPjboVw~aefRU{n
zQj5ZZpK(UQ8qh>Mf}hjD3hlN*!iI6ioawK-I3;~2fcN9U70$eJ1+p*}lDQaXK6wLb
zmLUR_apoTuh7iVJmKC7$z(EZ<updG5p0jwS2X=Fc3qJr)se&RFYFB^5^y+R->H3B{
zkW~p#v->+bFkRl?W58C4=9~T{;N5pfj_BV4T3f;x%F@HUhJ~ecZ~c4*252*mvH!^d
zM#fxlAp^C4!V(sSHH?hYMSD1<8JA2q?BTRwTrxechf`6pzyx$&0<^`>II#h=A`r=*
zi4&%8=;0I<T?6(KsJ#aF?ZgMuZ}o60sXk~y@zlf@J{Ykv@y&F_UQS_=Ni1vFP!306
zoRl)%qnA^Tamn=bUQRQ{Khx*+at74jumFuMft&#yPGX#_0oq)f0~s>RVd-I>!VGSj
zLPK)017sr&jJxCtBO_?_GK{}t1Bx3bgZN4C?k^*lk5He&IC%$Xq6?M*7^eydfF{Wi
ze1ij!p-rgyQ$1FIh9hD5fN^TT0+b{=HDnIjUXZB?(=YaM$}&Ef{=SdX$YN@O2B^Y@
zMZ?qt@boM!hcZr0&;XA#Lc$*&1JeqoNA`2-`1gQD*x;5=n^FQENQ1g<+Kd&<Y&B>J
zYTBG7%xu*#K~O*=3|%pueFCQuBb>6Dz^TW$VtVETPU-p;GvH>y17jLU5NZ~ZpaXc+
z59Wvi4a~^vbEdBVHPPXjZu%L}k%h3mnvBzXz*|pYp)o^20K9gE5qvr}EJgHQnJzGq
zQ<kYOWV-%DPVxG_5YVRdFcz0Jpr{7z6N7sRB&E+>c7lOL--a<1tOB%g2O-}9D$T=L
z1S*i--1h_2U55LpZwAPXC|tw_SH`~j8K7gc;E~Wb!vr+*h|CA?H55X0Jg*l(Y<<A^
zg_|*)K~M-1Rt(n*;58k1wG&kMM#%?Gkn><|_uC$znj02`4B|IMK*P0=E-1`r3^#M8
zM^EBZt<U+v&g2goo`4y)0D5*bjK60EC#W3{4RVH?44_$Ym}fy;CKFJfAFBMOhzio0
zAcmVFDrnO396byU-YW8n5KYtnPvT^&w*Z+5OVbQDEkJj+z$cp+ZU%sQDhMkBB$#ZF
z>YAHNmVg#pAml-O(3Vn|leSD@W(-A|Cug|r0Xm5|lqF^ZXtN0`DDl9ij~Q-zOrJQJ
zQ=YM4`o_teqV)<I;O%KpqwXrmGuPe#RnEu)4;T;~=er6#%(Z9&u<qW01_nk3*pZeD
zx0iq_i%^!3H%y>{4_58n-f;uM2fGMdKi+vU-FphBWcUFA@TDS9tMBm0uyC;;AK-9D
zLji3b;*N(7L<Al<w<~zS#R)te+=!XJdkUvi{Tk4KVKB=M?hm|-!3=^(iE#-iF$S}6
z@WA|moc8W^OaYa5u++=|<--%--36efY0x!Wa7*vr0nI-f%x6((U}TJ8X<(c%J!C4U
z80+0XEDSNz4Q6wS)PtFf;VcE<aX3)%2C1<aAQCZPi5Soo-S+=MjflH{K!g3PuwVpn
zgHdI}QMsskL0J;CbQo&MJxTD0S}f?c9MEyU2$vU3m!8HcWq1H|Vn{H{9o{SajKK`B
z^-T=dcL*Sb5|XR$O;5N9IvwiX0dV$$hZmF&53hSS_JEd=FoEwgf;#5D2xwH>U_OgT
z0b?lWI8N}%!O&!IUjwug4xV>F+;GIy6o?Bt@fBQ-Gs1eZ_cf-oOy^W~(f}R#0uQqL
z8a|9jVFcoaB7*F`2I%}busQI+xPD`L=5$V3>FXDeeT`_{Fx-DJec^OYNv8WRrtg`~
zDJgyb1t{J<=7Y{2%mkYS_2L7W=^v(ZN-_FO=bizk)MjuhG5SpRoWW_!IAwbK3{E>n
zpXtYDaN5?hfbMQhVwuCdg_$u4u{ZxA3kzcsDAZsB4v%b1*tuRMR5HlShX&Q70tR-j
zSBW4Icm>b!$cKfshrv(^sX%!YApu$nf)slX6F^6cm2$AK@Jw%-$th%Y{R=4b2D97|
zJs`;#%yL5Vha_V#10SrAy#4}y*#<bXz(efOpXujja!N8i`ZN9IOipR0#}}rv&Ehm<
z6qs%?i&Ku#V0!p0PUU(78E}mN9{_%A0B+wS^T7i_P=7sckYMI;Lh``l2JoRz@J#=>
zK>}QIfL08Eixp6Yc{~GgksZ_FE%RA;WEjI(WK@{TrvIG9DWo(5+OC6HGQ$G3;CSLQ
zU3WI8gp?0x)G-vC9g(kxWO(8;J$^Q)Sh^4Bz9D!bd*TC{P(k4$B{Gm~7$VI*@$o>*
zmro9W1`=Z+*%IkI#wQ!5-<i!R#W)4L32-|99M1KO3e)$`;f!Qdm@YY&)1OgcdgfeC
zS4M{E>*sRnFtSX)Gndnhk!8E^JkDfBlZq3dsa1pdECS#rKj?NYXu_;G0Gjd2Vvzu!
z9EupxtT-`!)qGAVriv5OkIm;)1<`NkbILPDOy^y|slXU9U2g%Wr1A=DP*W6ECT)Eo
z0-FD400F4+%Wq82TEMBuwEV{O-UXa8AbRxzPC3Sq>8BQODl$q;e*>Z>Oy^t3sl+&8
zy5T}jbH)kNGZ%6;Gc9;A{oO)Nb-~47WEj(-k+j5wfiWGlCrm~Nd|wWz(u3Nx;KTHg
zMVyNmd8U6~#M#ftGrfH=XEGzt^w*0yT^K8-8!Q1&B1JCY)UTfc8cc=vn-_{OFqI+Q
z8oXEnG++fUa6sG`#Q4%;6$a4xV(?L+#Tj5eQdBMe0y-W$6m<DAN~H`Dk7IF|&c2jW
zlxgvo>2gasH7y~+F(BnJpi2~Cfr;U523F8zz0fuw!{RT~8<uj)f{dBJlv6sY0+f1@
z0)9yc3j^q$6A2CIITo-G+yQECGlL2eSl4^W4yaNEkW$bkzo4!iO#OlFBFi{6n3%p_
zm~OX%Q_}GJ1?a*I$h{?qDa-E{L?H7zD7mnD$MlXBoQjM)rmtGTDHB!w1T?3MRPt2s
z0M*M`EIc~kJ}T7K>KmX<$ngAK{RY%BK;eR%h~(W$kLe04Ic0=WK%Ez4agFKcS8_^b
z*m*#$QGs-+;q{SS2sdb=l?lm74i2EYFAH=s<wOn^9TTQL&{_$25eJf%X3S)fhE6&m
z*%sIUvMrv`V7mS)P6-JE*x8RDC2;+L3#P}f;?x%o`~c2!h=xeuhv^GfaVjt}Oh2@W
z(}>dr<_hp2J%8{9P@66bbnbB`i_e|u8!vGP8#4sI0X1H-K!*urvIv0B2mo!UgAI2C
zzX3S`bXFxamju6=p1PXTm@#4c%+;I<(-nVkh%kjFOh3OGyu#<tYEDVU1JlLUaLO|t
zm~OU)Q-e`rdi)wrQ$~sDQ`c}BGn!04xrS4dF=zVcHJtX0Go~A_<<w=IF+CAN^{?gB
zW@MSZdo6h8_ug7gBgT&Dg6lXX88fD9uj7<s%$V-Aj#Gp2!1UsEocfFhrY~N{smOR>
z`q6cqnoQw8rhiz+nGK?2*K=A)#IP`kh!#V4bHaE09@sE_{d!Ju?E@Q>=CcGuU{e6z
zvH=h6h>YnU*K>+VM%-Xw(7>jAy21udaS@PtkXVA{iij7}y*F?wF*;1o+rTNM;sEM|
zXR?Tc(oZI+I{~*L5-gR$BCaz1f(552Q?$VJ!y7nNT|q}BGiI`cyaBbrL1sgvAQ~)@
z!D8_Pw8as8unIKQN4J1(4nbDhGF^8grxat$bdQao;~u7GZ{%!d<e2_`Bd4Uhjs|pO
zih1G|#I<z{F*yd1Bo3dpkI6BBt6TzcI^6NG6Q=ub;#6duFuf2&ZJ9oK6Q`op7Eor%
zWZ{u!%wUnWf#hnqaj{!$z?Bvv;l^>WFt{^jvAAzwoUZVLLzF3wV>;_*PAx`<=?0rQ
zr5GKidvE4cV04(Cvzb$u(P8?m&79I<Q$TaX!7K{UL#E*wGGPix1T}~g)_|tZa#&b&
zK-<p|O4sOs2TR~pe!`mR+*>$Rm=bPGH{8Oh3!)RCbpIAkt#AfVBxbRQOMnJW;l?B~
zNI<-ZECSx62#uFS1__SEjF}E9R^W3LKoJDO(D+P~m@crDQ=742y3JNj6-I~YiCZ~c
z7z?H^+sdiJl>TM<nXQ~s;^_}yO<WU{+d%$q<-~Fuh=q$JeE-?B8PiR-ajG%~Opo5i
z8K$rUbV^t-iwbD;)dbYM1$EZo(V1~#`o(RWN{l<Ef7!;V%vdm8Vmqfg<DTgb+c_ne
zGJi~u+RmxOC^NlwJExS|4jpFBexxNX**m}|bc1{bH!p`{`rhrFYK%LkKiSTy&A4N_
zzz$9gWf@Qz4iBtc6UcxDNFy{zayzC+@8DEnw3*(pgHwS~WBS4!oS<{x&+p(gV$_(<
zw3E}AQDeH<PVmaXu$`Qsn+{5Ma@sMK-I%_0C#M34zP^)FR<`U0=(zO^7H!Z8jG(N7
zIKii!WxC)lPC3xQ@w>oNzdpM-B`m>f7&2I-1CVQzsw<$4TW|+g{eX;^Avt(y!SuPi
zz}r|4?BY~m?3n&^7pGqR1{oHv8sx#@rE9=v)4?mEr6)jDUKUczbm<Aux(^OmJ9*g#
z86J=klQ|6LPiC6T#(*pX&8CQawDb!L!yeGQKFbZpCyY#n2B0AXcw9ha!5g^2@?aLy
zP$$FEFVhe22Jeymu$$A5Y1xhG4tqE?7+I!g?%_0K^q4+-4|qm>-yTkBGtlG{V-^cf
z0XPG}?O2@wS_6{FB3%H<5uj!bTypK5>HK>+Wti5ynXbE+Q;IQQy2oBlC&qy3-FrFB
z1SUu`A}-cpSm!bQ;$BYSdJhQ}F3=&2@E}{~A%QY<zy5;@Xgd<D)w3~V0VA}qVoI?9
z6;{wZxG{tq*73a6gIJBZ5p*w5D596Nv7iN6zYVGkXs8CZk%R%H6qHKfR=0ox176H+
zd@_ChK29-4gX!D$aauAOO#iTt)0)v>y3T%1Lq>z?ar-%~85^e0+RtfaIU#_p3_73)
z8=~6OfZC|s)F1$AWP*|$JUq9Yn9h5EQ;})QiRlIhIOUzTJPCjdX23=R8MZtD9V8AK
zT!1zEwme~B058B{5dkgd1GQRUyVw}EJefZ60H<s{2WY1|N(cL3255h<!F(12AJ7eI
zA#C715{NbE3<tLuuyFA)pol<sQdojkI>6HN!7cC`JmIq(aR0n)0WGs)oUVJ2Q<-ti
z^uU9hVoonUurTC+7M<^4J^?=c3*N4NDd7OBM&JqK)e7*&SWxF06iU#N<mHO#D-VKK
zHeWu-smk>7%=BLeId!B~Adl4`tsQ&QGTq@2r#REAAJZcbaVmi5>O-7*^{=ilFqI;;
z@!uGDFvcSWwLo0ZnqFvHdt+dYbQuG~n;g*E8PI||sH0v>fUj)}W%<I?0$NmnDHR8i
ziUaS(XS1&dkKjPGfmYu4pJM<kfU=>g&=tKvQuKlWhoaj^if)4f4jvt^Rah86m)$im
zznH%KFsBfs%Jf}_!PW5X!<_Pr4%2@h=CojRm~L`})0WX=deIS16ULtD%a3px)k}ct
ze~|ZjKm&`QfmI}*^Du&Z*Tc*hhZw<p(*y31!;9EAJ)jObJg(pLNN|*DOkqSlDeLu#
z4A6)MEN#7E097lX_@5qel#`E9W_tQjPJKq7>C=yL>M*^%G5zRKPFKc+>D<RSHDpUb
zS4oAlTmaqs4vIOD&!KL7+c7=h7^ezIN7*q>$9fwE(5f1cxo`!bBmP2J_AtHxHO<gu
zd>F$aG9Y823F2J@C<VZM_ZGaI9G-IDZs6eVVE~=_WTIv-1uC<l+TL#95a^MH%GiRo
z6PsuvRk&|AOb<NHDbMuw!}Ox#oMDVD(@!4f^kcM{E^&fWnbBst%?ZvRMG0l_xe!nj
zKiEJ9=HV@#w;!gjKfx*K@fLiln8AFO2F59%@il~7e;9zLMBvHd-5XH9B8O!U^BmCb
zR#0aRA$MlFz)4Oy;Rbo8QsjFj8QwQccRa}{!?<92+(}NUdI8Y!3-HmJj~p6Ir5eaf
zI6rED7OVDv&dXs$zBZWQ<pc0FTfr<B_|^!bRz05rKuhgHSqwmP4eYQE%*zJ`jKK_?
zs9X>DO8%E`KxbFMJ^Rt40d=y8;bRF4LkVL9OUV^RmI?-WP=x~b?Z+w8?N4z^N>&Jf
z^5Mc2pfm&u4rns@G-rC@DNZ@79vN800~zXq)fb;NHZU;;LnG!(3TW;fv{(pU9DmlB
ze)1Hjf(E!ZnZqKW4qonwWWnbS76ukrWw-ambivb{QuZA^pauZKR7e>K_weVA9!4}v
zL3K3L$zLL-XPxGhW85>n^E9Wj`v&+T<^7;tW$;AvB?WZqWH5_G1gQRl<-ad2kair*
z?ls`E?fy&6pB{6XQ;r`JI#7%LZ<wxdhEs!a!*tIxoLY=I(@V~9Ix=pUzU>UBjdlzq
zfo);j16mdU%O;ErCp3`f!5D6cGv<Kr4P<6yeKFnmET<(C>x=1mXE{MPRm?ccsmQoy
z`>wN`lX)10xBK1Ve9y+Xce~v~&Q;7x2B1rPSy(t2Sna`OreO{X0|N^O51c<^JJ(ar
z2*!E^(221k5-bic7+F>@-C<&R!Zd{$rpj&wNEZVK3y%P*kbnq_ga%B=;Rr~Ti~=&B
zgM~)|#&=`@*`c5U=Y!7jV2OzV@j+Xe8615;2JlF*$SAOA=zxSlgOg4=AW?*|AU?9O
zpw&SvED|zs^`J|`Ss<pUz#Zp|W(tUpWJ)~)XdM{?3&I-b4i*L;mWT+LvCeBi&VU$;
zaGZ+^NED$9#78og0kkBKfkgx!1}+;w>d{ScGnsz>Ij4ks07w#Hm`4B$D9quSJvu=0
zh{*HU0pg<@=Gijc?ggh<ga&9=V$2#wm<N2&LIA`^cB)SX$TR^FxcUWPz6^_k3Q}zN
ze3-uG1*e1t=)iYSdSDTeVNnQx=>eVjjU0#p2d2My!6^eep^1S-0-iDgFMv~m3rt%u
z==4z*83#E34ajN+3sk<v47guFXCE=Ja2!DhfFqq{4kODN#tm@M&;*b<EFASL0tPU%
zLP5jEEIx22hlj8*$grq{u*9Umltjd^Fi3#9+W{qTp#>lpTO_a)ARG|`4j>K@q_mfC
z17slwJeMSaW0Yk&+bd2Had7x^@URGoASJWpn(2nGI8{?7urO4xd|~>+#BznDgB4~i
z=(KwV78V{B0eJGx*ucV|!eX-r?#Zk*AP-oC!1NR;urNGeVtK*zgNdbqc?LWa7llmU
z^@>xLF=YCUSDdOrpcCF$Dki{<DL#Pe^wK{dJ`3Dl&~bqhEH>~s0*{j;xvNTIy8mlV
zQMDtWfa2g`5rM~cO$7@>4a)>Zgk5z$)4N`CDl%3~U-Oz%2DJAm0<@GG?(Mo4AiFgT
zSW+@zzN-7e!XN@IEI_3~LklQ*Ypj5~zsUxqKthJa1nxx8YGDBu5eXIp6PPhg0bu9B
z-PWwY!cfn^;^F~Q&|HG5parxXnT11v1yPi=tN<xF!FYy|<qG2qMwS_D3)o@WJ3v>%
zvv3H2iZB&;`UM?*3mW}JDnB7Ypz>3P3#Pg2$Mg$tI7RDaK<0B4z=T0p5}+l5-Uv|1
z;1IyFg>eoO%NnLVOfbbD85WicAb0&?Y(bR+-Io%;5|IE?+s^|sMF8&i{vTkArQx+h
z{~xdbyhxbnGrj&Trv&KQFo=UBSY$wj1B-zT%*@FXKv4%uu@WpY@Ju&V1|-S@FVm-j
zE^$YyhNjLywFq?Q6axzjxPXy>2jjF5uqqxam}S!<zyfghO#?L(SZv^VdlqOX5Q_=i
zfLSHe1Kx2OFqTYje8(w~v4Dlag~ca;B?O+z<}3i^d_)O6R{-R0h&vQ6z|-119u|fc
zMwSgs2bfqcFil}*`N8ss1?H&v2`mf(EEe!oIB&vq#`mCO!cI)rea|VUJpT+xzM=tc
z+WZF~fsz`S0SlH)&wJ157b*bq91GmsMNe25Ojt}1xoFWFkOCcepe|N{Iu=nEE(T3j
zvT(qw|HXHv3x41fRbP4sq!g5TVU|LNOl~mVfxBys$#mZjoNDzZphaXXTUa)*vg}|z
zz{YZd?F$=B+gi}^z${akCculCwG%*zibnu+-|ro!8_X<sn4d7SykVXJ_sH5iAa`G3
z?m>vWVPPm?X<<16F9A0CfYgAp-HK?qgEoRSa=`1uO${JlAlf9Gdq4px0I#yQfaV2Q
z1mMYG`ybTU-BB>z_amnw=mI(h78ZCm*a2-bvGBkX*3K6oortE(t_xsK!dn+mKB%sQ
zh0N|fAjg4{4&0PI;A8nqRxq;sVSK~F@`dFK3(FstKhxiS<m8G4%l%=zfDnfV&)z3s
z+u%j<{tw{5frrC^7pVM$TfkPsl09Q@&Ge8@occE4thqt>2}~p7%oec01}p|IKo!OZ
zSSi9d>j9|o1NT4UM3d?JKXFQcSB4;hg>ljyP}Ku!A1q*D*}`%L=3>Ul8^A8w0gF1u
zsi33fSa@U*MKR;F0?;`;EE||lz|s!mv^ik+{9$5gVV(mQoen9IC0Hb+r!Yd=v5Yem
zz)=nN$@G%xg`YWvU9N!gNCP80b1{Neb=iOxb3x;Uv2O;b{?vdKSYSSK4RL6~^b?;s
zb?YG|6128vad2Td!8idHJ`9KUfc*!SjhO@UCBu;vkoyG$Sajft>DUR7N)ZW`6hyP+
z_#9B(g-A`OAAr<w@PI0foD&e!>OXv70By0<VbOtCUKdJ0#`74km{_pbIDktoaN`+N
zA6`5GmNQ|oumL$1RH{X=B)|){%RZn4jHtb@Xn^<uZ{R)x3GlF_Jb?+wFkCqUbrq<R
zl3`JRC-$pvrt^R06lc2jV!FmxP6g>};My9bN`Xa1hou5ukX@IUp8S<lPh0|Okb?(O
zd-}S}^c7z@l_MBH)i$Dmd{YFRcHy0bn-(B>M2U72(xL+O5uh>3aI*kxz5t8K4Op6C
zxLGn?`5ULQ7&z$&h_I|-KLf9$Z#GPi`NpXb2u}Pq@J8qz9#os|fP)B87u@jxS;GTw
zI$ZAnB|(JCuFsf$_8X_12sq*JfRYBxf!F6u|No6sLL9u*iA4d_7J}ythP!vB>wV{x
z%DfA%d`l3C={jhxndJ%Z7haY>yjS?)hJhRXh#uX2(25`ykqnj`c!L2X!~$xBh}f{W
zc(4S7Al3QTFHGO~ozqF^`UP+}!>ju17pAlR;Iw44m~Q`r)0lC}^x_|!W`dv_WRZF=
z*I!KE^@CH&>(L(;hAqr22bf>L1N?CVC_y2b_@E^v3@jY*7Qhn&P*EXM!qUUI1(L!)
zd|-HDFkS8^r?e6{WD#CxoZSElY8F^CnsN4m>Crzq)#|}zB!>W~&*5=^k>w1cvSOSA
zZoaCxAewTFb4yUX$T$z$d|(lP7aQ{+4G10<5eF8J6D%w*SRTNtAV$cc>MR!+pD?n#
zVQgVyV4e1hldXPH4#;irP8j1NaD0QB^>9-c&4DOk5xD^>&Ed^?#-%nO7u{ie0Sf`J
z$Q?$O7mPpPLd(FlnvMY|Cr7~YH{-G^U^5e>VCmqg1IR2FA2{D<`uty<vWyJV_x|D(
zw*cKU$C6P2lYI`Z3K9Gl(B>$MgaS)U2h47U7ah}iesh+2cCau+ur#nB>TK}fG|LX=
z1MmpP6nO~_%nM96U}Xry%N5g4|K<!A2FKe4)(fz(Wq7q?y6GQIWu{jTrbqqZ)MR?~
zVtVTzP8DI$Xewy97jDa2ndy7}a2hjqO#kqQQ$!HlzT<&s*|%q=i~i-*2?7o2F|e>$
zurx3t{PM1cg~5X*pn#<Xsd4rmbki{l&kRPE4(1hbTR!rD0#^oJ!M=Pjeez#URTa<}
zoCb>yJQ2TAVPQyN>ET-fOPLIxdZyp`%c&^R1Bwh#WsfW)_>WW34%}yF>0xBKgGj9m
zpEj^C6tHZ8w2Y>}s!gyk3sSTA)0XK4|2QSn4uG6@hxrHG!CyXr?L#hPzTE(4KzL&Z
zbZIpMivX+<zyMl|!ob1-Z;bqy0aC95FEoB`nEw7BXB6Xx>0bXiqw9Zy+Y~z(FEFwo
zw+Vk)fSfXg^8>uo0uwpG2}^4bkvW_TI9V2OB830*fZ7xS@Fe*kT<f{?fKora9%5u#
z0ov2SVzz{F2`p7IvTOj=Z5lc(26JFZi;)e|)8=9EftNvy>;_Y#xTG{#Ku!de67aH=
zk)sAC2CG;YISx#n!zClBz``(rljVrm12L8#Vh!R@KQMCoOufh@&d4$KC6{zPXa<l)
zB!ML(2PVx8uGM)!U4IrCxG2vLaIC<~c1GR}EDSBoEDd}|_+UCgLNcf#;Oa9Zh9#$f
zr34l_jC`P7cPt7zECwd9EYHX%0;+KWU{TD-=Q4dRBbS7v2@As=CYBT2D|lEo@SK1Z
z>5TjZ)6X$-iHmGtVR*pEa)xUSH_Q<N6Q=)U<kDuDz{21%{VyYzI^&M%0Zd$4f;+&$
z1WO}~0(+)+GjVA#hD_ha#HA(zK9UlA>Lkn{@jcT&FmZ`8>P%;2=28=E0s9}8jToiQ
zOt)p`l4FwkFg=!;OA$mjFmox^OF`PNA}oIxA272lV0i({0E{v$ARof(Tt*pimj*tb
z0_L-@h`^d6j56RcD?~e0RsdDMbPNka2uldO6qR1W!oX9H)Pe;aW9Y)Ngt3Q>Wd_?D
zSQ2KG1Kr%nq5@AWa^Rs&ggx@0h0rWK@J6Kk4p0i^fd{<;I8G7ujG_ZLU?G{Y{=)}G
z#RZ_oh72N&D}p;62pvi>U>#c+S@tmYz*D`z2Nnh&79Us-hfz=h)R<L)bpaU#!4(X=
zpUo(k!NQQiGC}18Jj7H&Soj%`$_+-9gz37hTr!|kvV@Uk31ak&QDx8cSXM4^LGW+~
zybsAJcwu@gE0?pU;04f-)eH4KaNAWuGb=0{bKudbwgq(7G0O}_L{3yU0Tnwk@R2)4
zA&=>TY+Np&u}yGy9})RNpjD}$(XuTjM@(2wnB0Ihgc<S3Y?wZmjZ47}(*NLLnWKF`
z8<tpwz}3(Uoi%U=YgB+8qrjqoRLV07?V0|YjZ2?#&vb2eE-hVHQ~!$27G0Jfx+nDE
z=7D9d=zM{jr`0pPiJeO&8+=q2%LK&W8>2Spv=kP24a2Ab){6*K9dOYB@5(ajm#{Fz
zAcnsf&F8Q%*sv^-SR=vmK>C3+%n24c)BQQPB&97rfIQ+8z!K5G$kM@h1zvPoI!tfo
z;8M}Fx&um}bHv_=v3wEhffsXbHlQ+D1fFB9=S)Aq!37?H5@C5E@<Np5gJ_Q!%M`H_
zVk{TLZiulw5PKoUvP66h+yom7&>%_<tj*78Q^Ufb!7_vI2p`KCz88EfANYD;O;<)+
z0Z?iz06TF8Bg+EDH%u&lL^g=Rd}C_@GApHo!42BWvoio0rU9#e8SQFV7{Gpn>9G65
z!jQmHGXs=x5yh^345+PXVKcpvlS{ll1zb8lVcG+$JsBN7urMrOWC2}Sz;c6e13Y(u
z#E}O27#+dG(x93I-n4Vn0cA_b=!Q-T%N)iJ@SsLW$*_Q>ARRu?%m$;=8qn4{mMx4A
z;L2S<Yui{H5H+8R4#?Fi7vRouKLILE;bWJK-eBjXEC6{HKJLlrV*rX-_$&)!;2jo*
z8Eh;c*tc-7?BO`TQ4b5NpbC)FITpap4+am_3W$LEiwP+#1tlyC7?*(BDGwM~mN0E#
zV(DNx!@_cf<pw-Ihc<vB=nrE96H5ov1ZI{QNGUvA0#x*h++k#S!q~&aGKJ{_6Uz^#
z11$9{e^@85v&>*$z|OLQ{Q|5P#u%Xka(4=>{lOR|!opy{V&cH!;=<w)z!EV99#Wv=
zcxqTCFt33}U^M8~brz8dmIl^2tSn1dU%(ocj1U<gSgV*ZPNE*<Yj`h>G5QE74gO%6
z!pbs-bpt2M4$eLBQa}0+D7hVAxx>QpgyjbZO9N*ETrLLOs+hyJgpFkb+ZHyK9c%~K
zSkAC50eNZ-JIe<49dMt;rGTvDfHn*2KQKZCcvwVWgY=B?2SEAR!G*=chb07FoF{+>
zWO)KuLK0xH76T5ZI~+&2Sk7?m;bu9)eFR>O$AHdBW7)%f1|gCH$`5n6=fFjh7{5$^
z&&wrN{{<913h<&T88nB?G6fdlFzb?kurTPbcto)DfEowTY?vm&!qCCUGJ){}Bg+rQ
zD=aK`SbnguG_cNKWm&-bgq7tD>m4?hCv02TS@y7B;b6JL@q~lr4aCJaxL6)={orP4
z5aQ|JVVS@)1zts_$xQ#k#igH~1|IEJ0TsY3E<P+hpzhWS#y9ZTPcs39rh*C!e4vvt
z4Lqz1?*cQX^?;OIV7>!SAnD+#Mnv(NZZW-!n@iOz9a0bTu!O*7b{NyagDP`awy?0A
zV7bA<@_^+DJiWu@7O=1^VOhh%zz&&26=dkxKHY_nt02CY;fpjxka5-zA1G_KM+l6y
zU<wnIIcEn4jCG(x6v|xg0TWyvzycGCFo3Z-whQxf?O@z~LV)Wzn_vP11A_`^Y8m1P
z?H$t(h;yk+LQfiF31MJh&_PHWWK5Ib(r5J8ZXm%W&d8`R-9wT~o@)X~0Rsa=jO%no
zK`v3y6$TxWT%h&EJ0!Wx8Fx(o0HP$O2S{<Lfeugv(-t?TS4eTGGb&79AjPH6C^7v4
zh?g+^2Z)+5T|t^loH1g$g*2DGqyf}?5e5bZ84w%dRy&XB4bohojdTm7x#XwMm*(P}
zenOf{jLGi7^as*hYE1SgrgO+}fmYgR$Z)AMR!k3&;nHWEFug&BOAUP1gbWw>Fp(P|
zzVnZ1vRrDQBUm(Kx%5EixkSi<o3ITaVfPc$SIBb7Gcrs+0TN}H{y~<@j>-GMbOSjq
zH71`A(<4B%?}_ORa$M?+8q-(Efr4rJ4Unk+jcM}W&@hnaQfF+K9wE;qFS!8Z4+aK?
z8q@#|QkXsgq?lp)0eLRam6kW;xj+|9{s2)Erb{Sr$ulNQw@}~$oj{qOz$MN&V|s-G
zmpS8s=^H?l!}J#*B^lE>6uHb91*SVFa;Zx~R?jmq%s>slm<7`t6uIQ4*C}#wPG7Fb
zCBZmh`T<2Qbw-ZqFF@3e=>kezYE1Djrdud+sWUoEPXKWfZcOh0aU-U008s(cZzzGI
zk3*SDopHf*17$9CE(fUR7Pw5GD9$A+mHq%K;DPFb42|g%l)2;?1Ey~P=`NUlLzzpB
zDf7oP6>valfGCdX0U&C|^a>EgF?|7u+A;kEi0YXB0Yo)Smrw<Vx`Qg0Ipc=u6(F9+
z^aZM1?u-Yfzfk4UV=8$tT|$jZozY^tgBq6}Q`wE_1rY8GH7+&Kb%zH)+=l5dK-7Wh
z1wve6QWYPdt~Nn+b*0912X!uaMvv(U>RjrK9n(A1x%3$$rtbjpIHo@UQ5n-YG{C9H
z07MB)j{s2%rZ;GC*)u9kKcK;7&Zsc`2S{+nbOlW=(3LP5nq2Z+8=zKNxK014z$FU0
zm34(CI3^!xg43>m7MDEZj_C$k;Lwf$Q5Dl0K!OU>7l5dS=?6f964PI3fi*~IbEz{<
znC<|g7EI3oQ3BH^Xmf#f5^VrcJEmU%Q3BIHfaDscOXzUPfi5An(BaZ&ESR1FqGn8=
z0ipz^p8!!4rvK34vS*Z-ZlTMi&R8%#L6=JnwA!@;L@&QFeS<ESI%fmKCrn4CKhWh8
zXY`o<10=ip!*m5bE^|hM=@EKh<2&@g32uWPml|jt<_!=xVwygeI-|gJ4Sg<i#*FC+
z`ds0R7SnftcoEY-faEf!OBiseGcrtfFyImc9pDgQz-7;9FntC{v|{=J11^8YfawB;
zT=t9!(*q2-%o$fq?=a+2XN;J>!H`Q2bW-92kfg?R1tTudc`E@%Tza6xLmP~^+!+^4
zKLO%idolfo5tlvVkLec1Txv|SJ*FoZbICI<nBHIvF4Y>uxI~#5=Ny=R!I(>rX}QNV
z6D~2P<pI+TB)P<xo_v^YU;-|C0!+B<85yQeFyXRe`to7=1(2x6^baOn;*y{Y2@0kF
z1_lOD;l=<d*uK7)u3*X~&S){+!W5jY6HK{4N4z$ea;b5DzW~y~z`&s31SxI5f0%y4
zluI9US1U-_g6R@wT<(k;rYC@?i0LcLxYR&bcU=I{%Oj@$Faw(<Va_E7TJB?E&ZWl0
zc4K;iIhP%`&JU>BHqO%nEx1IDbS)qP%paVD(*&97oZC2BxSX1~T{_s>*;^qS-I3}C
zMnjG1Kg_xG89AnFSa8WRT1@u<Q5n-SEV%R;9j4E);8No<f%;n5VEPFQE<Gmq6VrcK
zaG4uIY+_LCa1-_rWU6!QmJgaFF;Q}YRKIkeOs{N@T$e(pVuw<@a+^x4YKvO4I(Qq}
z^cqX9*^;1g1*#vkRT{dYim5JPx`7p!xMT%fjsYyq1rBGXx`ycqR$O9IbraC!d7$!Z
zrcVHA_d%29gGl!$Og{jUHbIjXfJjepnf?JJ4XQ%nDwr7<grL$X(-o|_#3f7MauBzP
zK&4xz2Uv57Nlk!;7DN>@1A`bu{@8};4IugB2Ou&Kl9_=)0wRC>#Pkhdd027*D_~||
zkb=mcI<WnLHCHn;<Nxg`_FP?zOtm|ve{kTkX1p_9$B`?Dsb<IY21jtJ+Th3)&$wl}
zfD@M(=oTUkCoX+SSTO}!Wq6d4fk6~v=z$5-3!J$0n5LYVz5ql|VwrxyiAzjs608Pd
zVPIh9W`sF{c@o1kXD%_&m2VQxT<(k?rYAUaiA%x~AxLo{!tnha(<eA{=`;SBe!!Va
zobko<8z7#-bPgAA4z_UNikE~%BnJZniyGV>rdu1PZ*bw-&*(9|z?Dm!F<^R!D_1$A
z!ZbH7aYl{l5^h}mj4P(EaO2XGng$DQ4h9C+i%2FYO#c8<y<s|sJC}KV0s{k^7((^}
ztTsQuz`&-!#K6D^4i5(H9pF%BU<hGgU{gh?KL=G0T0PEYf>5u6)a+ujMTi?@K+So;
zz`*9q#83~jzz~-3Z!j>hMT3@{gDqy<1Zy(!Ffg!XA;h;p*H|)w98`i3-vq6(nNk=S
z*qRaI8=$F+v4DYrZ4z9(o^c!0L7?j=*cQMg7`I74CDt%7u&qTBhx!b3{5{(qB=Hka
z^%@KeY-f?gVRbJD0|VPFxHyw7*g^FS3=Av`3~Y}OL1d%=H7JLHf$bHNI4nuTFfg!v
zLlTEsaE5__9klrn8fC^{3m6y}zc4Vcb0XB6LZgx~fq{X&UKk-^4)gIH1_pL1Bym_W
z28k;o#4T<>9qPfrz;1{Tw}g2BWU)O$+zM(wqYDEAyAMPh)ca?!1~uJ5t66mz7}&!h
z5}-L-8<>xeFfg#EFv3>bGSz;8S}ef8z+Q<Y{sJn_!@$7ak1)p;bixHl>Iwq``$B}c
zodE+V{2^5qJ1CB!L1za`bRrB49QTkkz!Iqn0|Wa`B=G`}=?n}ECJYShCy~UVi4-h;
z6G<G_ihNPez`*_to}HK{!hFoZz`*_<p}`)OxGESJI6)WkKppA;P3<5HI6$`=!^ENW
z1fv841BWQ0<k<rYAr1xx4s}KbhI(juw+H4Tkc1V&Vn>*R0vH%LJdwnq>Om{sIY8MJ
zYOxbc929an2=&geH1vakfuj~7Uhe`+y&#E+2nko1OD`}maLhu8yTMW~4+8_oeuTI?
zEQCxL7&tB?#9=YU@P~nc;|W6C6B1+f3`}<z7&v|*B)nlh;9+3k<Uxr0z#Mvmfq_#R
z5v2Q}i5IlBhEoHf-WTSe1O^69ON6+e2E=AY1qKGrka~FBGrfKVkpS((;!H&ne~Bb+
zjWEa`=CvLM22M~32#o@NShjq@z`)syP#*v-4;T(GFmTR+ii4I>1VS6Q3?LV+fJ%J$
zzz_&6+d(}$PNdus1k2xd7#KJYBeGu|Qr*aT24N0te>Fn^0|Vy;B=G_UX#TTdVBkc`
z9>K6m8Dzn8goY4UV!Xh>!1)y+9tw+s9SjUytcZ}i)d3AT4h9A;q=GICS`aZbFw`?}
zsUr*ugVvdh8Vn3v4hZpZXwWe>FfechAjBhK*-wRmfh!V899qjUu3%u`%0q}p!|IM7
z3=CW~An|%|EyoZ83%VH$3|yUXA23hc0`&n80|VDgB=IFsaRCMfE~F@nfkl}G0|VDa
zkOfflVQB&sLc5U6sfYR)RGV=fLXv<P#KOS9bsk|*EG!C27#O(jAjIQf9@xOZ!1WMG
z9F|>m7#O%dA;jaM*}ERppy1{}NF>05bOr+hH=<#}JP{fNpxTmK4M{!BXAKMt+(-pi
zBCO2+!oa}oh2*g#(2!$cVBij8s)x65l0aP-P{Z{E0|R$5k_K2l=3rn@s6Y~jHAg`P
z6(Ssz21{HW3=G`$NaC;%ox{Mu4QhaZvuphahIE*Z7cekzPeW)x9%|qQH8j8)J}_iJ
z3lIhk1_thP2=y6I4=~CwFmQiHh-bnorw#@N9;9kL6I3LF>%SHT1|D;ShAdcl0Mg)s
zDCrKse89oLz=M<vvSD#Qfq{W10bx!yEN$g5Fz}Qjg&fR$76yiTo<@X*9GF2H7#Mh9
zCDexx3^~w5#BhdzfoB^+eJ(72|6pL?K`KA;U>2-kVBmR)P@fMCIYy9&|ANIK+vy5m
z1<nix2418lR3Ws8WvXCc;6*AxilK=S6x6(WV1vNBM@pb|2SWq{120mmw-nm>WL&_&
z!0U@pUv>i={tOHZ2@DLppw=xkj?1AMKxH*AxS)XK<8n}(ff8^F0|PHo*<Jzju?+(Q
z?;?Z+6;OwQdbYf)k;Gw@S-lAZ1Mg0xxPb*J2Ll7|A%uoXXwZS`2wqU@7V1zGaisD9
zMI5OSiz5CFsr`>E!G{zDmCz_)aA08I<3(~1%%K+;82IE6;#IJGzkz{)52?1ShNZ0p
z1_r)RxcYjAYG_%_;KRVc2fC#c>a%KCqKjZ);6tijYoKK~;{*l<z81Ja47JeQ!CJ$>
zz&8~k-VCiRK`kY|B?$2rusA6GD;OB~HX%tsvkmhJ1_r)^2=NYBEeCQas3QS&Xa_9u
zS}-v1y+%?GEn-2H8Q*V&co)<IptEQA>p?d(K|9i?VI>y}0|UPRJWVj2LMk%(#gW8e
zi3_A&4pB}_1^bMFfx(7>fnOU*JuG*KFfj02L)3%X|4dV0sgZ+$f!`ZR1FUQZiN`=R
z{QvNQX$mYC2rw}4XCtYH^$S4is}bs_!r~qz-h~K>o(a(Q2dF6JpMfL+jeEu?3=I58
z?fgDy95dWtVBkNDP~Q)2ZZj-lVBkk;;Y@&qL;?c?KT<(70hV27)H5*fBlYDbLZg7O
zf`LH*sXadlR_*>_U=Tpc1(TuTi~<Y{0^$e<O@TSIfPp~(smnGM8utt?3=9IsObiV5
z&_py9mTeLk7zB_?uBp(F0F`J0{s;@E!3@e_U=T<|5{LOLhJisK14$ej_skO*7z9cY
z;`OtjwG*QX1A_ok`+qhx7l1=zDMG_ssKv|;3=9J65pjF~Rvxf0FbM2J5{EemBz^`-
zyaiN@g5n<}aSNV^m?y0POMtuO0xu92FMtL$O9umkpbkQODKyH!A@mVp!7*6hkAs0h
z;17~|n1?eM7zEjn8VJi^sr?TFgP;~d!*ZDT3I+y2P@F-dYz5S3Oh*_P1a06RU^)eB
zu<$T22>Ku#GzAuwTnr3?uwFK({l6Mk#4cfA5KKi_yc(J<*&G-c1VOhbK`n+2$uQb5
zFbMV`)Nh9RjA04`gCJ6)bPFu|9bjM(M9MW=PQcp#Jq!$jNI|_7mKb+1FbIA`Sg;Km
z_iPai3_^?u@jcKYoaq7sgAh_Ry&qbOf~sjDZG`#*Q1clD80;B@ED=F;0G5wA7#M_{
z5E>3bEdcpUC=3zQw;HB9L~)7N!-fky7#M_75ZVqwjbpsRz#vqF5I+KKsj&z!FbE-a
zhEG6Cct(&pNCA5imXy{oFbE;_g-=2KQO{Vyz#xRwLpu#^n}Q}ih4vvVz5uPo8GRTS
zgpgYG7hw(!VPFt?fKY!4Y7WyG1_q%o2=S}X;srF4Bg~4_h`t7`bNE;o7=#6p0t#AH
zfFe*Bsq=go*1wTpU=Y@YTfoQ$P4j9B3=G0%hzQyb^)aXyAPn!I$$VgV3T;F)?O|XL
zh9&L~9~fRRO#cwgC0-9r37~F{a3Yd<P;FrG0)+Tps6QA37#M_+^5_?6mH_oygr^|+
z4;ph|b3lWL(5&(mnziadtqWnKrt4Q|@x}nM;56Lh3}2xZgViJTqrSmB@PUCr7^!jp
z9U7wyF$@eM+z4~N!-_)}1_lu+q!>a>x-c+^AoZiZLwyE{QW0}Rr@j&@4m##k#2sP5
zPiPWg6JTHv0c8nEa0`{`I4sGWU|<kQV`N|u2Z`5zV1f_tb1*Q7lrSO<??cO5ka!cq
zg8$HF4but+1`$x#7qVZRsRCLKGw?Goh^&OGXJmpV4aOP<29eDOab{3b0yVRkco-N&
zb|WNMVL|<dfk6aO0WiIO4RsJB1B1w0L`c-a%2ing29dAuxM!XSvH+xogMmR5G<XAP
zPBBk{mA9a7jwq--1@%D{thiudU=USA7&K`Q$P~~xC<BA2CS089^&2E{q|9&x>SIuw
zT+|Wa&^lOJ5nx~t4FZdUyE#mCpzH@SONoI&6x5!AIS5uji!v~X<{&J-1udsQsamug
zY!IlM!&C|Lu{Z;RXgea;?17b23JeUQ3y{<w0EIuuVlf5=(G5rv&_u)_$-p3b07)E{
zdO;RkKoW=5Fd%atAc@05LXd$$^aH{{(_rHD4h#&U-;pF>7IQE#h_NHY_rT(qg@Hj#
z7)c!FW01H!lEp|NB&LrPa?k=56mnuVj12V*kVL_B3+5t_#h|`5RQwFoL7;gQF;I4b
zjmtu_6WAccs07n3SV(}(0ZlDIqY~a-0*N=m9aPVBW)3L)A+rr)li?Cfr@_lm7#Ki9
zTVivOd<@I?AcK}7`52bC_!t<(wjznc3L+i`1~Je?8pLDFf?$V&;vW=rR}mK9f(>DT
z#GfE6o(40>fPq2m8$x_4tkG}4z#xtkWm92M1`<aa>YfTKVL{^cN=OF5Dszy80YZEl
zH1+aiFffSQA;kB<EEZs35J&2r+=7|I!oVONj^r_<d@l}-GH^HN7Ob)ZX#iz2XdEwt
z`T%Tk6~f}Zuxtsk7?jOmaSY4GVhjx8(-|2Um_SAB2S#Xt$p9KO5MP22->v{^=7OSM
zfq_AM3&Mgau*3xt-;1OHq!xrh;-`_sp|vHbD=Ur^m8X#%3YyJ;dJNv%;HYO{5C;{R
zFbP<jnS+5r0(8X{B(X4^`UA3+0els_gapE&Q$e>1fTTd`LDLpcbEd$&%)-DRVSz}D
z@bxZ|3=9$;NYfmXp+zq!wMzseESLxt2W3BrI3$B$`Cg2HK_U+k$Csg%5VHaUgG3EN
z{1P-9GkjoRkmy5**I$G-5Eva87$lI2M)&}Y2m^xzQps2WGf0MkK>}1VLPO}52Phao
zM=~=oNFYVQEojt$$_a_*2#aq)%&7-=XC%JB<B~}iBEcXaz`!8Mh7ebP_9}Qm;-Dyi
zCaxb)4`_hIL7jT2_ztMW4j^%)T(b-+4r<^?hJvO!pmDYg7H1L+43ePEJ4_rJq@dbN
z5>#?Q#h1deQvd^l<P1cVErXR4Aam9siNg}30t18O5vX|mhYw6kp>Yg$(QT*%NE{jx
z3?PF(B8fvo0^}emqylFNw44B$BZV~V0q+P(Ffd4&Ak10v1J=z^U|^5}4MjtJwgfgh
z5Wv77h14ir0t*R{L7-|ErXF0Bg4WA0Fi7<xELaRH4?yOC@;y}jVweXcK=lu3)E_1R
zjZ3i4K-DW$d<!gUKn8&l5mbCD%%LC${Y6;36`B@7=13#emWyFUZvX>>v=&G`WSWC%
z2`p|T7#O4-Koa1Ri)k^eDW<@{AdOu6!7K(Dl#5Wm2PuT4n~}tkLP#3aW`ufRH+-4{
zWDqEuK_&JeJLnj~pxww0x`QN+6x7n6k;D-}%^<^xBn}PfdQcF_fEo@^i+90VH~|a{
zGDvN@U9ieVf`LH>sq?-IRuCyLFvuh!EZ7B$0+2bNsc@M2u#f<m)6ZBBU)Zt>)?xt}
z1gh7e8g{~3EFgpSAS~Dk3ki@xmypDvl@{1zFA(B8VC@EwIsake^&gmaLW2U7&18}4
z>7B5GLV<xn7F4i69kc^hy#_Ea$U4Cc`oOdU77`K+46+eO;;?c8WDcmPhMKb-H1Y&$
ze}M9<Y%7umSV({jnvEn5D<?n(ZA6G~hc(?m4myD(4hsp8IrosnVdaDZ14F$msOW{d
zXdA5B4Pao91Fa!~if@O7gaiYF9H?Ia6Nlvj1qKE=P}dA9z719vfXwkjSiB7u5+HLx
z%O*r2rv@@@gXK$*K}Zdat<c^%D1_uDA{hh=36Md{k;GxS0AvoR-2ipaR#@8*<e)1E
z^;=hf!=Hfx6!&tkkR)KaK!Jfl9@KS$8nhW!BnL1s$b&|lq2gO$7E3TN$m=4^*$hi`
zAak6N#9<z&2N@KFR4pP^9`Z>2{>`v_3^J$<VbB(sdXPCtt>i7R5Cu7CGm?5(ZUUKe
zl7*rE|3_FxMbPpmSr|wXzl=luZ3d`0|NsAo^%WTy804S8#X<c)B#Ym|CI0`11szDk
zHzaXbK?D;2PqxKS^P%xCPol*N?37vz@w9wBsTT87$zrIz^$ZOEp+Nz45ssi%kfE-{
zP<y!{wu0jF+w?toT>AAYj7SSG;j#=0x<c?7@h7mP;lse7U?>0=XGB^is^F>!uUhuQ
zG7lpIgF*~K{0OXB0TRyub<yqrgF8g~VU-jM1A{^lL;^IwvlrSY1&#74G{`bR*9bDM
zg=J?@8>kDR{zwnh10ZvzAS^zBZ2m%o_>s-94iU&j8{s}?G=Y`CAq)%(#}O8<Pk~wh
zviJf*d=0El1Bu^6auBR)0j(K$jxgU4T8uE>sb^qN_=ltc)}UcwU{Dl91T`nDAY@=*
zP*g)$yc}9$Gx;zuDC!|B=!LqI_X`7qq76da8!E2Y!N8yxB+CSw_hDQQnFaw%E5^Vr
zW?YYKaWcZ<HL&IY$U!-9^$eV_wZSqB42sPN_0`b2PEdn^L9q)F1@(tviGqcJfo~q%
zr3^n|bw~ySgCcTV!YVtELGut6Ge8p^;~fSD#bpR{4uQP{*^;8T7B0>>3sSDtGk``|
z6}KZ?bOh!z4h9CrlY$Je5t~=gpk`oYU{Jh+u$UjT-vu;S2lDZABy&zdZDwL%Q2dOr
zcs4Xd8ATWv6#v&FBoM2}85ooVkkSNrw-N&b10Mr};#njI9feo`nlV#CP7|<cS_TFN
zB}6u6oC9kPa4;|^SqLyNfUf2Qb%?xR?Fx_vCq$gBfu&xMxDUcXdttqH76t~TP((<u
zLURF!0|SFntPniAmO!HnG=HR&jxc{+46H*0vY-&5As1R}vRz<cP^v}>QdqVG`JfHq
zprcR^fO_*HZw2A&Ln~nUUY3DDsRyC{2-JKA4u*OLr8x)}twAbSl$Ih{3@ZVJ85opS
z!=r$C(q2dufJmi{2=R$eKq8PqHl_WDC|(W=QBcU80+|o(5FI{)q~Qv}LF-{b4GN*V
z2=O)0>;%%K^bBMWqyu#X)(&B0U{HD|01t^6Seq4O&NqZP>*}E;5y&8A1|)+{f<!>c
znt?%?7ZG$vVGiP8U{IDuQa=T%o`r!y8MNpdI`P2^YITE*@nB$3wh_P>qXIVwl)Vua
z9DtSwpd)CNL5T~LN<VyHf<-;Z8s$WU`XjJZEx^E_T#4}6dZegSZbC$jAhetSQOf-S
zh;?5Au%KgLU{GER*T8fNmhVC0D-dxx2P)3h!N8z=04XG3qkD`D49XV~xq}}T(jg2C
z%8y{?)PG=H4r~1CFfb^;LHJ-5w2{jM3hK|${QBVo6LNM{{(%UI{jkc3g@HkZ4dI}p
zpu1W?!6v}Kpdtjb_yZ$&Ck!b3nLjWvsHh_}9D#LY7#SE;Op(MlflL8KCIf?tE5f1c
zVAV8e<E1~s$57Q^N(B^^&@{mZOY95`4D~9hNck0(xPllMRPqr9@xtO*gMmS%9?3z_
zqLcyTvo<6L!F&vI&;&#X9liv13j;$G1B1$Ju=$_{@dpMbq;W-+6-XA$glYhV#721P
zMM;b*`w&5D46C$s7#LKpBP>4Bie%0+ghSUTfWjXtr}7)2VL!}4EDQ{)ya)@H!}75K
z1B0qKvOy3-m@60<R22}3_cgTOQf**hP}K$d7&LRkzzHiE>tz@iR2`8Ff;FKS7#LK&
z5Dq#5&Bvf|Mb$_o^{~-<koqKq1-!7Rkzim@RR>K#K?*43%|EK8iVXFzjW$O%LVN(~
z{i!x0ELe+_SX8@_#9?U#WbqUvhqfV^gIt7zGCW8M6r$_k>g$;fz`ExkiJgd`Hiiue
z=`b*;o<~@`2B{=cy@3#42dh*-4tfZ;faw@4Bp4YORNo?{EpQPIihltH2GyU4AUXyu
z0YQ#cV?a1)HnbWA%{i;FBP=)qD?eBm7}SK3#9>W3Mg|5oC4@Q4Vdii!FsRidwdeVf
z+Vg5Y2o10$^~@Fw3~CXGYB~pI@f!vPHKZbWKWxMXWI-mv$NL*WUV@Y#YNe1w3U2@3
zf)%|WA2cC?bS=_OGPNEgacHUr8K(wXfdnmBKzn^aVoV<x7}S;^)K@_r3YybaTa6H3
z4_fyP(g4D0TM<4+>>6ZXP&<PVH-`D_1_OiIV~7v_fB3*W5tchZ9{30sXS#(n*`|&h
zW$-A_U|>)eLe$fBFbM_*26d$B_3(x56*XM)OpF%OXVh_-Gg?f)P{$?4Xg>XU9akHp
z(e%7}u6vAT+kG3jY?(xhQgidmQsdK#@^j;}Q&S7#b25udw$Ewe(&pwdV{i@#jSq<k
z(K9yRez}+HJrkqJ^urUlZZeurpF5GuOU9HTDL=m?KBXwLER`WX-YwM6ImFZ7FFsz+
z*m!!LD2LQ^*-2b{f<|a^hSOyxaT!j}oy29!Xg+=QB(6Y4v*~{)aTyDmqN+49neI55
z>msA^bm1vn6BSDHGV?M^G81z$t5Q?+j118f8*N`ag=>w#^x&mjDvS%ZS1jeSV`NhN
zFnz;xCh6&ymvM=3LIRAb{>1bT%ec%rAx%)G`UleumUEeNLh>Y2{g3Gd%el<B>L7&x
zQv<{F4PZW`yT#NXF#Q9V4_WiY)SxrnU<H>sCuEx>(}XkA3qV|`;S(NA-vHu5vJ2D1
zEz>`MxGtbn#K1K12!spi2r*5(0^vd`XQqiyAY4ewW}5f~!i8j2rb#T*4OVfP2|-Iq
zrb*C3&P)R0<H@VIgt?&Q1JenE=^IvYnQ=iER4|=%nEnCGhg9E8Cq1SctOm)03mOKd
zlL6BUR&$vNK^rtoXP|~3|2uuhYA$m|iRm9!bJ=r3x-*Q%OQtt~0y%gMmkguA^nx{9
zc3kWbS2J%B0m(^CzqE!+hHE!8bBP8+1clae$uM1bFx_A+mpv!6VSeuX^ba$cq^3^-
z$t`+6eZyKVJEp}d(?6``vg29;DeoAqCPEAdTE`{Bb>9&jnhg4d5Wz_xK|W|ZKw|<V
zI4-Z_k`^+DqyPqIP~Ox4H87{G=hEY<f|$ynt_m_hdV27BE@`HPSEm=O=TZOw_N8k*

diff --git a/roms/seabios-hppa b/roms/seabios-hppa
index d0d359929a..a04b6f35c0 160000
--- a/roms/seabios-hppa
+++ b/roms/seabios-hppa
@@ -1 +1 @@
-Subproject commit d0d359929a009549f7cecac9d2a29c8bdbc07a98
+Subproject commit a04b6f35c0b7437ce968f64106ee6ff5aadee419

From 98d7c299415bb21b5fa6e44020df608acfea729f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 05:56:09 +0200
Subject: [PATCH 2068/2396] accel/tcg: Trace tb_flush() calls
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250925035610.80605-2-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/tb-maint.c   | 3 ++-
 accel/tcg/trace-events | 3 +++
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/accel/tcg/tb-maint.c b/accel/tcg/tb-maint.c
index 5a8d0784e7..cd7c32361b 100644
--- a/accel/tcg/tb-maint.c
+++ b/accel/tcg/tb-maint.c
@@ -40,7 +40,7 @@
 #else
 #include "system/runstate.h"
 #endif
-
+#include "trace.h"
 
 /* List iterators for lists of tagged pointers in TranslationBlock. */
 #define TB_FOR_EACH_TAGGED(head, tb, n, field)                          \
@@ -771,6 +771,7 @@ void tb_flush__exclusive_or_serial(void)
 {
     CPUState *cpu;
 
+    trace_tb_flush();
     assert(tcg_enabled());
     /* Note that cpu_in_serial_context checks cpu_in_exclusive_context. */
     assert(!runstate_is_running() ||
diff --git a/accel/tcg/trace-events b/accel/tcg/trace-events
index 14f638810c..121d6b5081 100644
--- a/accel/tcg/trace-events
+++ b/accel/tcg/trace-events
@@ -24,3 +24,6 @@ store_atom2_fallback(uint32_t memop, uintptr_t ra) "mop:0x%"PRIx32", ra:0x%"PRIx
 store_atom4_fallback(uint32_t memop, uintptr_t ra) "mop:0x%"PRIx32", ra:0x%"PRIxPTR""
 store_atom8_fallback(uint32_t memop, uintptr_t ra) "mop:0x%"PRIx32", ra:0x%"PRIxPTR""
 store_atom16_fallback(uint32_t memop, uintptr_t ra) "mop:0x%"PRIx32", ra:0x%"PRIxPTR""
+
+# tb-maint.c
+tb_flush(void) ""

From 31dd80e1e7a237cb7a096589b726801c085ebb19 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 25 Sep 2025 05:56:10 +0200
Subject: [PATCH 2069/2396] accel/tcg: Trace tb_gen_code() buffer overflow
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20250925035610.80605-3-philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 accel/tcg/trace-events    | 1 +
 accel/tcg/translate-all.c | 3 +++
 2 files changed, 4 insertions(+)

diff --git a/accel/tcg/trace-events b/accel/tcg/trace-events
index 121d6b5081..0816cafd33 100644
--- a/accel/tcg/trace-events
+++ b/accel/tcg/trace-events
@@ -12,6 +12,7 @@ memory_notdirty_set_dirty(uint64_t vaddr) "0x%" PRIx64
 
 # translate-all.c
 translate_block(void *tb, uintptr_t pc, const void *tb_code) "tb:%p, pc:0x%"PRIxPTR", tb_code:%p"
+tb_gen_code_buffer_overflow(const char *reason) "reason: %s"
 
 # ldst_atomicity
 load_atom2_fallback(uint32_t memop, uintptr_t ra) "mop:0x%"PRIx32", ra:0x%"PRIxPTR""
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index da9d7f1675..fba4e9dc21 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -290,6 +290,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     if (unlikely(!tb)) {
         /* flush must be done */
         if (cpu_in_serial_context(cpu)) {
+            trace_tb_gen_code_buffer_overflow("tcg_tb_alloc");
             tb_flush__exclusive_or_serial();
             goto buffer_overflow;
         }
@@ -325,6 +326,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
     if (unlikely(gen_code_size < 0)) {
         switch (gen_code_size) {
         case -1:
+            trace_tb_gen_code_buffer_overflow("setjmp_gen_code");
             /*
              * Overflow of code_gen_buffer, or the current slice of it.
              *
@@ -389,6 +391,7 @@ TranslationBlock *tb_gen_code(CPUState *cpu, TCGTBCPUState s)
 
     search_size = encode_search(tb, (void *)gen_code_buf + gen_code_size);
     if (unlikely(search_size < 0)) {
+        trace_tb_gen_code_buffer_overflow("encode_search");
         tb_unlock_pages(tb);
         goto buffer_overflow;
     }

From 1ca08107c54227580786527db28fb77440f62391 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Wed, 5 Nov 2025 16:22:19 +0100
Subject: [PATCH 2070/2396] qapi/parser: Mollify mypy

re.match(r'^ *', ...) can't fail, but mypy doesn't know that and
complains:

    scripts/qapi/parser.py:444: error: Item "None" of "Match[str] | None" has no attribute "end"  [union-attr]

Work around by using must_match() instead.

Fixes: 8107ba47fd78 (qapi: Add documentation format validation)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251105152219.311154-1-armbru@redhat.com>
---
 scripts/qapi/parser.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/qapi/parser.py b/scripts/qapi/parser.py
index 1bb1af7051..c3cf33904e 100644
--- a/scripts/qapi/parser.py
+++ b/scripts/qapi/parser.py
@@ -441,7 +441,7 @@ class QAPISchemaParser:
             self._literal_mode = True
             self._literal_mode_indent = 0
         elif self._literal_mode and line:
-            indent = re.match(r'^ *', line).end()
+            indent = must_match(r'\s*', line).end()
             if self._literal_mode_indent == 0:
                 self._literal_mode_indent = indent
             elif indent < self._literal_mode_indent:

From 290e4e7de7a579be7457bfbc338b697b8eea638f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 4 Nov 2025 15:59:55 +0100
Subject: [PATCH 2071/2396] tests/functional: Mark another MIPS replay test as
 flaky
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When disabling MIPS tests on commit 1c11aa18071
("tests/functional: Mark the MIPS replay tests as flaky")
we missed the 5KEc test.

Reported-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251104145955.84091-1-philmd@linaro.org>
---
 tests/functional/mips64el/test_replay.py | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/functional/mips64el/test_replay.py b/tests/functional/mips64el/test_replay.py
index 05cc585f85..e9318448fa 100755
--- a/tests/functional/mips64el/test_replay.py
+++ b/tests/functional/mips64el/test_replay.py
@@ -40,6 +40,7 @@ class Mips64elReplay(ReplayKernelBase):
         '75ba10cd35fb44e32948eeb26974f061b703c81c4ba2fab1ebcacf1d1bec3b61')
 
     @skipUntrustedTest()
+    @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
     def test_replay_mips64el_malta_5KEc_cpio(self):
         self.set_machine('malta')
         self.cpu = '5KEc'

From 4f503afc7eb503997fedad84f24e2cdf696a7a0e Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 21 Oct 2025 18:31:51 +0100
Subject: [PATCH 2072/2396] target/x86: Correctly handle invalid 0x0f 0xc7 0xxx
 insns

In the decode_group9() function, if we don't recognise the insn as
one that we should handle, we leave the 'entry' pointer unaltered.
Because the X86OpEntry struct has a union for the gen and decode
pointers, this means that the top level code will call decode.e.gen()
which tries to use the decode function pointer (still set to
decode_group9) as a gen function pointer.

This is undefined behaviour, but seems to be mostly harmless in
practice (we call decode_group9() again with bogus arguments and it
does nothing).  If you have CFI enabled then it will trip the CFI
check:

../target/i386/tcg/decode-new.c.inc:2862:9: runtime error: control flow integrity check for type 'void (struct DisasContext *, struct X86DecodedInsn *)' failed during indirect function call

Set *entry to UNKNOWN_OPCODE to provoke the #UD exception, as we do
in decode_group1A() and decode_group11() for similar situations.

Thanks to the bug reporter for the clear description and analysis of
the bug and the simple reproducer.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3172
Fixes: fcd16539ebfe2 ("target/i386: convert CMPXCHG8B/CMPXCHG16B to new decoder")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251021173152.1695997-1-peter.maydell@linaro.org>
---
 target/i386/tcg/decode-new.c.inc | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index a50f57dbaa..f4192f1006 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -335,6 +335,8 @@ static void decode_group9(DisasContext *s, CPUX86State *env, X86OpEntry *entry,
         *entry = group9_reg;
     } else if (op == 1) {
         *entry = REX_W(s) ? cmpxchg16b : cmpxchg8b;
+    } else {
+        *entry = UNKNOWN_OPCODE;
     }
 }
 

From 94b66a353596a62216b623129dc2bf255b771e19 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 13 Oct 2025 18:53:30 +0200
Subject: [PATCH 2073/2396] tests/functional: Fix problems in testcase.py
 reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- put 3rd party "import pycotap" after the standard imports
- "help" is a built-in function in Python, don't use it as a variable name
- put the doc strings in the right locations (after the "def" line)
- use isinstance() instead of checking via type()

Message-Id: <a3413bbd-e98c-4267-81c7-aa42aeda8a09@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 tests/functional/qemu_test/testcase.py | 251 +++++++++++++------------
 1 file changed, 126 insertions(+), 125 deletions(-)

diff --git a/tests/functional/qemu_test/testcase.py b/tests/functional/qemu_test/testcase.py
index 1d773dd697..58f2740100 100644
--- a/tests/functional/qemu_test/testcase.py
+++ b/tests/functional/qemu_test/testcase.py
@@ -14,7 +14,6 @@
 import logging
 import os
 from pathlib import Path
-import pycotap
 import shutil
 from subprocess import run
 import sys
@@ -23,6 +22,8 @@ import warnings
 import unittest
 import uuid
 
+import pycotap
+
 from qemu.machine import QEMUMachine
 from qemu.utils import hvf_available, kvm_available, tcg_available
 
@@ -34,50 +35,50 @@ from .uncompress import uncompress
 
 class QemuBaseTest(unittest.TestCase):
 
-    '''
-    @params compressed: filename, Asset, or file-like object to uncompress
-    @params format: optional compression format (gzip, lzma)
-
-    Uncompresses @compressed into the scratch directory.
-
-    If @format is None, heuristics will be applied to guess the format
-    from the filename or Asset URL. @format must be non-None if @uncompressed
-    is a file-like object.
-
-    Returns the fully qualified path to the uncompressed file
-    '''
     def uncompress(self, compressed, format=None):
+        '''
+        @params compressed: filename, Asset, or file-like object to uncompress
+        @params format: optional compression format (gzip, lzma)
+
+        Uncompresses @compressed into the scratch directory.
+
+        If @format is None, heuristics will be applied to guess the
+        format from the filename or Asset URL. @format must be non-None
+        if @uncompressed is a file-like object.
+
+        Returns the fully qualified path to the uncompressed file
+        '''
         self.log.debug(f"Uncompress {compressed} format={format}")
-        if type(compressed) == Asset:
+        if isinstance(compressed, Asset):
             compressed.fetch()
 
-        (name, ext) = os.path.splitext(str(compressed))
+        (name, _ext) = os.path.splitext(str(compressed))
         uncompressed = self.scratch_file(os.path.basename(name))
 
         uncompress(compressed, uncompressed, format)
 
         return uncompressed
 
-    '''
-    @params archive: filename, Asset, or file-like object to extract
-    @params format: optional archive format (tar, zip, deb, cpio)
-    @params sub_dir: optional sub-directory to extract into
-    @params member: optional member file to limit extraction to
-
-    Extracts @archive into the scratch directory, or a directory beneath
-    named by @sub_dir. All files are extracted unless @member specifies
-    a limit.
-
-    If @format is None, heuristics will be applied to guess the format
-    from the filename or Asset URL. @format must be non-None if @archive
-    is a file-like object.
-
-    If @member is non-None, returns the fully qualified path to @member
-    '''
     def archive_extract(self, archive, format=None, sub_dir=None, member=None):
+        '''
+        @params archive: filename, Asset, or file-like object to extract
+        @params format: optional archive format (tar, zip, deb, cpio)
+        @params sub_dir: optional sub-directory to extract into
+        @params member: optional member file to limit extraction to
+
+        Extracts @archive into the scratch directory, or a directory beneath
+        named by @sub_dir. All files are extracted unless @member specifies
+        a limit.
+
+        If @format is None, heuristics will be applied to guess the
+        format from the filename or Asset URL. @format must be non-None
+        if @archive is a file-like object.
+
+        If @member is non-None, returns the fully qualified path to @member
+        '''
         self.log.debug(f"Extract {archive} format={format}" +
                        f"sub_dir={sub_dir} member={member}")
-        if type(archive) == Asset:
+        if isinstance(archive, Asset):
             archive.fetch()
         if sub_dir is None:
             archive_extract(archive, self.scratch_file(), format, member)
@@ -89,108 +90,108 @@ class QemuBaseTest(unittest.TestCase):
             return self.scratch_file(member)
         return None
 
-    '''
-    Create a temporary directory suitable for storing UNIX
-    socket paths.
-
-    Returns: a tempfile.TemporaryDirectory instance
-    '''
     def socket_dir(self):
+        '''
+        Create a temporary directory suitable for storing UNIX
+        socket paths.
+
+        Returns: a tempfile.TemporaryDirectory instance
+        '''
         if self.socketdir is None:
             self.socketdir = tempfile.TemporaryDirectory(
                 prefix="qemu_func_test_sock_")
         return self.socketdir
 
-    '''
-    @params args list of zero or more subdirectories or file
-
-    Construct a path for accessing a data file located
-    relative to the source directory that is the root for
-    functional tests.
-
-    @args may be an empty list to reference the root dir
-    itself, may be a single element to reference a file in
-    the root directory, or may be multiple elements to
-    reference a file nested below. The path components
-    will be joined using the platform appropriate path
-    separator.
-
-    Returns: string representing a file path
-    '''
     def data_file(self, *args):
+        '''
+        @params args list of zero or more subdirectories or file
+
+        Construct a path for accessing a data file located
+        relative to the source directory that is the root for
+        functional tests.
+
+        @args may be an empty list to reference the root dir
+        itself, may be a single element to reference a file in
+        the root directory, or may be multiple elements to
+        reference a file nested below. The path components
+        will be joined using the platform appropriate path
+        separator.
+
+        Returns: string representing a file path
+        '''
         return str(Path(Path(__file__).parent.parent, *args))
 
-    '''
-    @params args list of zero or more subdirectories or file
-
-    Construct a path for accessing a data file located
-    relative to the build directory root.
-
-    @args may be an empty list to reference the build dir
-    itself, may be a single element to reference a file in
-    the build directory, or may be multiple elements to
-    reference a file nested below. The path components
-    will be joined using the platform appropriate path
-    separator.
-
-    Returns: string representing a file path
-    '''
     def build_file(self, *args):
+        '''
+        @params args list of zero or more subdirectories or file
+
+        Construct a path for accessing a data file located
+        relative to the build directory root.
+
+        @args may be an empty list to reference the build dir
+        itself, may be a single element to reference a file in
+        the build directory, or may be multiple elements to
+        reference a file nested below. The path components
+        will be joined using the platform appropriate path
+        separator.
+
+        Returns: string representing a file path
+        '''
         return str(Path(BUILD_DIR, *args))
 
-    '''
-    @params args list of zero or more subdirectories or file
-
-    Construct a path for accessing/creating a scratch file
-    located relative to a temporary directory dedicated to
-    this test case. The directory and its contents will be
-    purged upon completion of the test.
-
-    @args may be an empty list to reference the scratch dir
-    itself, may be a single element to reference a file in
-    the scratch directory, or may be multiple elements to
-    reference a file nested below. The path components
-    will be joined using the platform appropriate path
-    separator.
-
-    Returns: string representing a file path
-    '''
     def scratch_file(self, *args):
+        '''
+        @params args list of zero or more subdirectories or file
+
+        Construct a path for accessing/creating a scratch file
+        located relative to a temporary directory dedicated to
+        this test case. The directory and its contents will be
+        purged upon completion of the test.
+
+        @args may be an empty list to reference the scratch dir
+        itself, may be a single element to reference a file in
+        the scratch directory, or may be multiple elements to
+        reference a file nested below. The path components
+        will be joined using the platform appropriate path
+        separator.
+
+        Returns: string representing a file path
+        '''
         return str(Path(self.workdir, *args))
 
-    '''
-    @params args list of zero or more subdirectories or file
-
-    Construct a path for accessing/creating a log file
-    located relative to a temporary directory dedicated to
-    this test case. The directory and its log files will be
-    preserved upon completion of the test.
-
-    @args may be an empty list to reference the log dir
-    itself, may be a single element to reference a file in
-    the log directory, or may be multiple elements to
-    reference a file nested below. The path components
-    will be joined using the platform appropriate path
-    separator.
-
-    Returns: string representing a file path
-    '''
     def log_file(self, *args):
+        '''
+        @params args list of zero or more subdirectories or file
+
+        Construct a path for accessing/creating a log file
+        located relative to a temporary directory dedicated to
+        this test case. The directory and its log files will be
+        preserved upon completion of the test.
+
+        @args may be an empty list to reference the log dir
+        itself, may be a single element to reference a file in
+        the log directory, or may be multiple elements to
+        reference a file nested below. The path components
+        will be joined using the platform appropriate path
+        separator.
+
+        Returns: string representing a file path
+        '''
         return str(Path(self.outputdir, *args))
 
-    '''
-    @params plugin name
-
-    Return the full path to the plugin taking into account any host OS
-    specific suffixes.
-    '''
     def plugin_file(self, plugin_name):
+        '''
+        @params plugin name
+
+        Return the full path to the plugin taking into account any host OS
+        specific suffixes.
+        '''
         sfx = dso_suffix()
         return os.path.join('tests', 'tcg', 'plugins', f'{plugin_name}.{sfx}')
 
     def assets_available(self):
         for name, asset in vars(self.__class__).items():
-            if name.startswith("ASSET_") and type(asset) == Asset:
+            if name.startswith("ASSET_") and isinstance(asset, Asset):
                 if not asset.available():
                     self.log.debug(f"Asset {asset.url} not available")
                     return False
@@ -216,9 +217,9 @@ class QemuBaseTest(unittest.TestCase):
         self.log.setLevel(logging.DEBUG)
         self._log_fh = logging.FileHandler(self.log_filename, mode='w')
         self._log_fh.setLevel(logging.DEBUG)
-        fileFormatter = logging.Formatter(
+        file_formatter = logging.Formatter(
             '%(asctime)s - %(levelname)s: %(name)s.%(funcName)s %(message)s')
-        self._log_fh.setFormatter(fileFormatter)
+        self._log_fh.setFormatter(file_formatter)
         self.log.addHandler(self._log_fh)
 
         # Capture QEMUMachine logging
@@ -260,7 +261,7 @@ class QemuBaseTest(unittest.TestCase):
         res = unittest.main(module = None, testRunner = tr, exit = False,
                             argv=[sys.argv[0], path] + sys.argv[1:])
         failed = {}
-        for (test, message) in res.result.errors + res.result.failures:
+        for (test, _message) in res.result.errors + res.result.failures:
             if hasattr(test, "log_filename") and not test.id() in failed:
                 print('More information on ' + test.id() + ' could be found here:'
                       '\n %s' % test.log_filename, file=sys.stderr)
@@ -279,7 +280,9 @@ class QemuUserTest(QemuBaseTest):
     def add_ldpath(self, ldpath):
         self._ldpath.append(os.path.abspath(ldpath))
 
-    def run_cmd(self, bin_path, args=[]):
+    def run_cmd(self, bin_path, args=None):
+        if args is None:
+            args = []
         return run([self.qemu_bin]
                    + ["-L %s" % ldpath for ldpath in self._ldpath]
                    + [bin_path]
@@ -304,8 +307,8 @@ class QemuSystemTest(QemuBaseTest):
         self._console_log_fh = logging.FileHandler(self.console_log_name,
                                                    mode='w')
         self._console_log_fh.setLevel(logging.DEBUG)
-        fileFormatter = logging.Formatter('%(asctime)s: %(message)s')
-        self._console_log_fh.setFormatter(fileFormatter)
+        file_formatter = logging.Formatter('%(asctime)s: %(message)s')
+        self._console_log_fh.setFormatter(file_formatter)
         console_log.addHandler(self._console_log_fh)
 
     def set_machine(self, machinename):
@@ -343,17 +346,15 @@ class QemuSystemTest(QemuBaseTest):
                           "available" % accelerator)
 
     def require_netdev(self, netdevname):
-        help = run([self.qemu_bin,
-                    '-M', 'none', '-netdev', 'help'],
-                   capture_output=True, check=True, encoding='utf8').stdout;
-        if help.find('\n' + netdevname + '\n') < 0:
+        helptxt = run([self.qemu_bin, '-M', 'none', '-netdev', 'help'],
+                      capture_output=True, check=True, encoding='utf8').stdout
+        if helptxt.find('\n' + netdevname + '\n') < 0:
             self.skipTest('no support for " + netdevname + " networking')
 
     def require_device(self, devicename):
-        help = run([self.qemu_bin,
-                    '-M', 'none', '-device', 'help'],
-                   capture_output=True, check=True, encoding='utf8').stdout;
-        if help.find(devicename) < 0:
+        helptxt = run([self.qemu_bin, '-M', 'none', '-device', 'help'],
+                   capture_output=True, check=True, encoding='utf8').stdout
+        if helptxt.find(devicename) < 0:
             self.skipTest('no support for device ' + devicename)
 
     def _new_vm(self, name, *args):
@@ -415,7 +416,7 @@ class QemuSystemTest(QemuBaseTest):
             try:
                 vm.shutdown()
             except Exception as ex:
-                self.log.error("Failed to teardown VM: %s" % ex)
+                self.log.error("Failed to teardown VM: %s", ex)
         logging.getLogger('console').removeHandler(self._console_log_fh)
         self._console_log_fh.close()
         super().tearDown()

From b0ea044d547ea84cc0ac6a958480c7462007e04a Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 30 Oct 2025 15:32:03 +0100
Subject: [PATCH 2074/2396] tests/functional/aarch64/test_device_passthrough:
 Fix warnings from pylint

Remove unused imports, write constants with capital letters and make
sure that the code uses the right indentation / formatting.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251030143203.297692-1-thuth@redhat.com>
---
 .../aarch64/test_device_passthrough.py        | 28 +++++++++++--------
 1 file changed, 17 insertions(+), 11 deletions(-)

diff --git a/tests/functional/aarch64/test_device_passthrough.py b/tests/functional/aarch64/test_device_passthrough.py
index 05a3f52d5e..10c73728f3 100755
--- a/tests/functional/aarch64/test_device_passthrough.py
+++ b/tests/functional/aarch64/test_device_passthrough.py
@@ -10,13 +10,13 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 from os.path import join
-
-from qemu_test import QemuSystemTest, Asset
-from qemu_test import exec_command, wait_for_console_pattern
-from qemu_test import exec_command_and_wait_for_pattern
 from random import randbytes
 
-guest_script = '''
+from qemu_test import QemuSystemTest, Asset
+from qemu_test import wait_for_console_pattern
+
+
+GUEST_SCRIPT = '''
 #!/usr/bin/env bash
 
 set -euo pipefail
@@ -56,7 +56,7 @@ qemu-system-aarch64 \
 -device vfio-pci,host=$pci_iommufd,iommufd=iommufd0
 '''
 
-nested_guest_script = '''
+NESTED_GUEST_SCRIPT = '''
 #!/usr/bin/env bash
 
 set -euo pipefail
@@ -75,6 +75,7 @@ diff $image_iommufd /dev/$dev_iommufd
 echo device_passthrough_test_ok
 '''
 
+
 class Aarch64DevicePassthrough(QemuSystemTest):
 
     # https://github.com/pbo-linaro/qemu-linux-stack/tree/device_passthrough
@@ -86,7 +87,7 @@ class Aarch64DevicePassthrough(QemuSystemTest):
     ASSET_DEVICE_PASSTHROUGH_STACK = Asset(
         ('https://github.com/pbo-linaro/qemu-linux-stack/'
          'releases/download/build/device_passthrough-a9612a2.tar.xz'),
-         'f7d2f70912e7231986e6e293e1a2c4786dd02bec113a7acb6bfc619e96155455')
+        'f7d2f70912e7231986e6e293e1a2c4786dd02bec113a7acb6bfc619e96155455')
 
     # This tests the device passthrough implementation, by booting a VM
     # supporting it with two nvme disks attached, and launching a nested VM
@@ -108,10 +109,14 @@ class Aarch64DevicePassthrough(QemuSystemTest):
         guest_cmd = join(stack, 'guest.sh')
         nested_guest_cmd = join(stack, 'nested_guest.sh')
         # we generate two random disks
-        with open(disk_vfio, "wb") as d: d.write(randbytes(512))
-        with open(disk_iommufd, "wb") as d: d.write(randbytes(1024))
-        with open(guest_cmd, 'w') as s: s.write(guest_script)
-        with open(nested_guest_cmd, 'w') as s: s.write(nested_guest_script)
+        with open(disk_vfio, "wb") as d:
+            d.write(randbytes(512))
+        with open(disk_iommufd, "wb") as d:
+            d.write(randbytes(1024))
+        with open(guest_cmd, 'w', encoding='utf-8') as s:
+            s.write(GUEST_SCRIPT)
+        with open(nested_guest_cmd, 'w', encoding='utf-8') as s:
+            s.write(NESTED_GUEST_SCRIPT)
 
         self.vm.add_args('-cpu', 'max')
         self.vm.add_args('-m', '2G')
@@ -139,5 +144,6 @@ class Aarch64DevicePassthrough(QemuSystemTest):
         wait_for_console_pattern(self, 'device_passthrough_test_ok',
                                  failure_message='Kernel panic')
 
+
 if __name__ == '__main__':
     QemuSystemTest.main()

From 92e262fc28c713f5913e57691ba6bc941ff6aa4f Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 3 Nov 2025 20:24:30 +0100
Subject: [PATCH 2075/2396] tests/functional/mips64el: Silence issues reported
 by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop unused imports, annotate imports that are not at the top, but done
on purpose in other locations, use f-strings where it makes sense, etc.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251103192430.63278-1-thuth@redhat.com>
---
 tests/functional/mips64el/test_malta.py  | 15 ++++++++-------
 tests/functional/mips64el/test_replay.py |  4 ++--
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/tests/functional/mips64el/test_malta.py b/tests/functional/mips64el/test_malta.py
index e37463dc29..bc750cb7ad 100755
--- a/tests/functional/mips64el/test_malta.py
+++ b/tests/functional/mips64el/test_malta.py
@@ -10,7 +10,6 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import os
-import logging
 
 from qemu_test import LinuxKernelTest, Asset
 from qemu_test import exec_command_and_wait_for_pattern
@@ -50,7 +49,7 @@ class MaltaMachineConsole(LinuxKernelTest):
         self.vm.add_args('-kernel', kernel_path,
                          '-append', kernel_command_line)
         self.vm.launch()
-        console_pattern = 'Kernel command line: %s' % kernel_command_line
+        console_pattern = f'Kernel command line: {kernel_command_line}'
         self.wait_for_console_pattern(console_pattern)
 
     ASSET_KERNEL_3_19_3 = Asset(
@@ -66,7 +65,7 @@ class MaltaMachineConsole(LinuxKernelTest):
         '75ba10cd35fb44e32948eeb26974f061b703c81c4ba2fab1ebcacf1d1bec3b61')
 
     @skipUntrustedTest()
-    def test_mips64el_malta_5KEc_cpio(self):
+    def test_mips64el_malta_5kec_cpio(self):
         kernel_path = self.ASSET_KERNEL_3_19_3.fetch()
         initrd_path = self.uncompress(self.ASSET_CPIO_R1)
 
@@ -134,8 +133,8 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         Boot Linux kernel and check Tux logo is displayed on the framebuffer.
         """
 
-        import numpy as np
-        import cv2
+        import numpy as np    # pylint: disable=import-outside-toplevel
+        import cv2            # pylint: disable=import-outside-toplevel
 
         screendump_path = self.scratch_file('screendump.pbm')
 
@@ -149,7 +148,7 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
                                'clocksource=GIC console=tty0 console=ttyS0')
         self.vm.add_args('-kernel', kernel_path,
                          '-cpu', 'I6400',
-                         '-smp', '%u' % cpu_cores_count,
+                         '-smp', str(cpu_cores_count),
                          '-vga', 'std',
                          '-append', kernel_command_line)
         self.vm.launch()
@@ -157,7 +156,7 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         self.wait_for_console_pattern(framebuffer_ready)
         self.vm.cmd('human-monitor-command', command_line='stop')
         res = self.vm.cmd('human-monitor-command',
-                          command_line='screendump %s' % screendump_path)
+                          command_line=f'screendump {screendump_path}')
         if 'unknown command' in res:
             self.skipTest('screendump not available')
 
@@ -191,6 +190,8 @@ class MaltaMachineFramebuffer(LinuxKernelTest):
         self.do_test_i6400_framebuffer_logo(8)
 
 
+# Add the tests from the 32-bit mipsel file here, too.
+# pylint: disable=unused-import,wrong-import-position
 from mipsel.test_malta import MaltaMachineYAMON
 
 if __name__ == '__main__':
diff --git a/tests/functional/mips64el/test_replay.py b/tests/functional/mips64el/test_replay.py
index e9318448fa..9a432be5ce 100755
--- a/tests/functional/mips64el/test_replay.py
+++ b/tests/functional/mips64el/test_replay.py
@@ -23,7 +23,7 @@ class Mips64elReplay(ReplayKernelBase):
         kernel_path = self.archive_extract(self.ASSET_KERNEL_2_63_2,
                                     member='boot/vmlinux-2.6.32-5-5kc-malta')
         kernel_command_line = self.KERNEL_COMMON_COMMAND_LINE + 'console=ttyS0'
-        console_pattern = 'Kernel command line: %s' % kernel_command_line
+        console_pattern = f'Kernel command line: {kernel_command_line}'
         self.run_rr(kernel_path, kernel_command_line, console_pattern, shift=5)
 
 
@@ -41,7 +41,7 @@ class Mips64elReplay(ReplayKernelBase):
 
     @skipUntrustedTest()
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2013")
-    def test_replay_mips64el_malta_5KEc_cpio(self):
+    def test_replay_mips64el_malta_5kec_cpio(self):
         self.set_machine('malta')
         self.cpu = '5KEc'
         kernel_path = self.ASSET_KERNEL_3_19_3.fetch()

From 0fa4b130a8d4fc46fb7b0b97b34656ac0c69c3c9 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 10 Nov 2025 11:48:37 +0100
Subject: [PATCH 2076/2396] tests/functional/m68k/test_nextcube: Fix issues
 reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix the indentation in one line, and while we're at it, use an f-string
instead of old-school formatting in another spot.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251110104837.52077-1-thuth@redhat.com>
---
 tests/functional/m68k/test_nextcube.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/m68k/test_nextcube.py b/tests/functional/m68k/test_nextcube.py
index e5e1c69dcb..71c160d026 100755
--- a/tests/functional/m68k/test_nextcube.py
+++ b/tests/functional/m68k/test_nextcube.py
@@ -40,7 +40,7 @@ class NextCubeMachine(QemuSystemTest):
             time.sleep(0.1)
 
         res = self.vm.cmd('human-monitor-command',
-                          command_line='screendump %s' % screenshot_path)
+                          command_line=f"screendump {screenshot_path}")
         if 'unknown command' in res:
             self.skipTest('screendump not available')
 
@@ -52,7 +52,7 @@ class NextCubeMachine(QemuSystemTest):
 
         from PIL import Image
         with Image.open(screenshot_path) as image:
-                width, height = image.size
+            width, height = image.size
         self.assertEqual(width, 1120)
         self.assertEqual(height, 832)
 

From dbf70f0a0388d0ba5bdf9c31ff3b81f77f4a90eb Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:19 -0500
Subject: [PATCH 2077/2396] aio-posix: fix race between io_uring CQE and
 AioHandler deletion

When an AioHandler is enqueued on ctx->submit_list for removal, the
fill_sq_ring() function will submit an io_uring POLL_REMOVE operation to
cancel the in-flight POLL_ADD operation.

There is a race when another thread enqueues an AioHandler for deletion
on ctx->submit_list when the POLL_ADD CQE has already appeared. In that
case POLL_REMOVE is unnecessary. The code already handled this, but
forgot that the AioHandler itself is still on ctx->submit_list when the
POLL_ADD CQE is being processed. It's unsafe to delete the AioHandler at
that point in time (use-after-free).

Solve this problem by keeping the AioHandler alive but setting a flag so
that it will be deleted by fill_sq_ring() when it runs.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251104022933.618123-2-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/fdmon-io_uring.c | 33 ++++++++++++++++++++++++++-------
 1 file changed, 26 insertions(+), 7 deletions(-)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index b0d68bdc44..ad89160f31 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -52,9 +52,10 @@ enum {
     FDMON_IO_URING_ENTRIES  = 128, /* sq/cq ring size */
 
     /* AioHandler::flags */
-    FDMON_IO_URING_PENDING  = (1 << 0),
-    FDMON_IO_URING_ADD      = (1 << 1),
-    FDMON_IO_URING_REMOVE   = (1 << 2),
+    FDMON_IO_URING_PENDING            = (1 << 0),
+    FDMON_IO_URING_ADD                = (1 << 1),
+    FDMON_IO_URING_REMOVE             = (1 << 2),
+    FDMON_IO_URING_DELETE_AIO_HANDLER = (1 << 3),
 };
 
 static inline int poll_events_from_pfd(int pfd_events)
@@ -218,6 +219,16 @@ static void fill_sq_ring(AioContext *ctx)
         if (flags & FDMON_IO_URING_REMOVE) {
             add_poll_remove_sqe(ctx, node);
         }
+        if (flags & FDMON_IO_URING_DELETE_AIO_HANDLER) {
+            /*
+             * process_cqe() sets this flag after ADD and REMOVE have been
+             * cleared. They cannot be set again, so they must be clear.
+             */
+            assert(!(flags & FDMON_IO_URING_ADD));
+            assert(!(flags & FDMON_IO_URING_REMOVE));
+
+            QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
+        }
     }
 }
 
@@ -241,7 +252,12 @@ static bool process_cqe(AioContext *ctx,
      */
     flags = qatomic_fetch_and(&node->flags, ~FDMON_IO_URING_REMOVE);
     if (flags & FDMON_IO_URING_REMOVE) {
-        QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
+        if (flags & FDMON_IO_URING_PENDING) {
+            /* Still on ctx->submit_list, defer deletion until fill_sq_ring() */
+            qatomic_or(&node->flags, FDMON_IO_URING_DELETE_AIO_HANDLER);
+        } else {
+            QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
+        }
         return false;
     }
 
@@ -347,10 +363,13 @@ void fdmon_io_uring_destroy(AioContext *ctx)
             unsigned flags = qatomic_fetch_and(&node->flags,
                     ~(FDMON_IO_URING_PENDING |
                       FDMON_IO_URING_ADD |
-                      FDMON_IO_URING_REMOVE));
+                      FDMON_IO_URING_REMOVE |
+                      FDMON_IO_URING_DELETE_AIO_HANDLER));
 
-            if (flags & FDMON_IO_URING_REMOVE) {
-                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers, node, node_deleted);
+            if ((flags & FDMON_IO_URING_REMOVE) ||
+                (flags & FDMON_IO_URING_DELETE_AIO_HANDLER)) {
+                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers,
+                                      node, node_deleted);
             }
 
             QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);

From c31a4457498bb845ffcb70068f976e14a3cadaad Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:20 -0500
Subject: [PATCH 2078/2396] aio-posix: fix fdmon-io_uring.c timeout stack
 variable lifetime

io_uring_prep_timeout() stashes a pointer to the timespec struct rather
than copying its fields. That means the struct must live until after the
SQE has been submitted by io_uring_enter(2). add_timeout_sqe() violates
this constraint because the SQE is not submitted within the function.

Inline add_timeout_sqe() into fdmon_io_uring_wait() so that the struct
lives at least as long as io_uring_enter(2).

This fixes random hangs (bogus timeout values) when the kernel loads
undefined timespec struct values from userspace after the original
struct on the stack has been destroyed.

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251104022933.618123-3-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/fdmon-io_uring.c | 27 ++++++++++++---------------
 1 file changed, 12 insertions(+), 15 deletions(-)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index ad89160f31..b64ce42513 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -188,20 +188,6 @@ static void add_poll_remove_sqe(AioContext *ctx, AioHandler *node)
     io_uring_sqe_set_data(sqe, NULL);
 }
 
-/* Add a timeout that self-cancels when another cqe becomes ready */
-static void add_timeout_sqe(AioContext *ctx, int64_t ns)
-{
-    struct io_uring_sqe *sqe;
-    struct __kernel_timespec ts = {
-        .tv_sec = ns / NANOSECONDS_PER_SECOND,
-        .tv_nsec = ns % NANOSECONDS_PER_SECOND,
-    };
-
-    sqe = get_sqe(ctx);
-    io_uring_prep_timeout(sqe, &ts, 1, 0);
-    io_uring_sqe_set_data(sqe, NULL);
-}
-
 /* Add sqes from ctx->submit_list for submission */
 static void fill_sq_ring(AioContext *ctx)
 {
@@ -291,13 +277,24 @@ static int process_cq_ring(AioContext *ctx, AioHandlerList *ready_list)
 static int fdmon_io_uring_wait(AioContext *ctx, AioHandlerList *ready_list,
                                int64_t timeout)
 {
+    struct __kernel_timespec ts;
     unsigned wait_nr = 1; /* block until at least one cqe is ready */
     int ret;
 
     if (timeout == 0) {
         wait_nr = 0; /* non-blocking */
     } else if (timeout > 0) {
-        add_timeout_sqe(ctx, timeout);
+        /* Add a timeout that self-cancels when another cqe becomes ready */
+        struct io_uring_sqe *sqe;
+
+        ts = (struct __kernel_timespec){
+            .tv_sec = timeout / NANOSECONDS_PER_SECOND,
+            .tv_nsec = timeout % NANOSECONDS_PER_SECOND,
+        };
+
+        sqe = get_sqe(ctx);
+        io_uring_prep_timeout(sqe, &ts, 1, 0);
+        io_uring_sqe_set_data(sqe, NULL);
     }
 
     fill_sq_ring(ctx);

From 5f8741fca51d6984ea5fa7bf73cc6c04e8a98585 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:21 -0500
Subject: [PATCH 2079/2396] aio-posix: fix spurious return from ->wait() due to
 signals

io_uring_enter(2) only returns -EINTR in some cases when interrupted by
a signal. Therefore the while loop in fdmon_io_uring_wait() is
incomplete and can lead to a spurious early return.

Handle the case when a signal interrupts io_uring_enter(2) but the
syscall returns the number of SQEs submitted (that takes priority over
-EINTR).

This patch probably makes little difference for QEMU, but the test suite
relies on the exact pattern of aio_poll() return values, so it's best to
hide this io_uring syscall interface quirk.

Here is the strace of test-aio receiving 3 SIGCONT signals after this
fix has been applied. Notice how the io_uring_enter(2) return value is 1
the first time because an SQE was submitted, but -EINTR the other times:

  eventfd2(0, EFD_CLOEXEC|EFD_NONBLOCK) = 9
  io_uring_enter(7, 1, 0, 0, NULL, 8) = 1
  clock_nanosleep(CLOCK_REALTIME, 0, {tv_sec=1, tv_nsec=0}, 0x7ffe38a46240) = 0
  io_uring_enter(7, 1, 1, IORING_ENTER_GETEVENTS, NULL, 8) = 1
  --- SIGCONT {si_signo=SIGCONT, si_code=SI_USER, si_pid=596096, si_uid=1000} ---
  io_uring_enter(7, 0, 1, IORING_ENTER_GETEVENTS, NULL, 8) = -1 EINTR (Interrupted system call)
  --- SIGCONT {si_signo=SIGCONT, si_code=SI_USER, si_pid=596096, si_uid=1000} ---
  io_uring_enter(7, 0, 1, IORING_ENTER_GETEVENTS, NULL, 8 <unfinished ...>
  <... io_uring_enter resumed>) = -1 EINTR (Interrupted system call)
  --- SIGCONT {si_signo=SIGCONT, si_code=SI_USER, si_pid=596096, si_uid=1000} ---
  io_uring_enter(7, 0, 1, IORING_ENTER_GETEVENTS, NULL, 8 <unfinished ...>
  <... io_uring_enter resumed>) = 0

Reported-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251104022933.618123-4-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/fdmon-io_uring.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index b64ce42513..3d8638b0e5 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -299,9 +299,16 @@ static int fdmon_io_uring_wait(AioContext *ctx, AioHandlerList *ready_list,
 
     fill_sq_ring(ctx);
 
+    /*
+     * Loop to handle signals in both cases:
+     * 1. If no SQEs were submitted, then -EINTR is returned.
+     * 2. If SQEs were submitted then the number of SQEs submitted is returned
+     *    rather than -EINTR.
+     */
     do {
         ret = io_uring_submit_and_wait(&ctx->fdmon_io_uring, wait_nr);
-    } while (ret == -EINTR);
+    } while (ret == -EINTR ||
+             (ret >= 0 && wait_nr > io_uring_cq_ready(&ctx->fdmon_io_uring)));
 
     assert(ret >= 0);
 

From 511c62a2c6f8c6c9b0ddb235b1bddd6884a78c38 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:22 -0500
Subject: [PATCH 2080/2396] aio-posix: keep polling enabled with
 fdmon-io_uring.c

Commit 816a430c517e ("util/aio: Defer disabling poll mode as long as
possible") kept polling enabled when the event loop timeout is 0. Since
there is no timeout the event loop will continue immediately and the
overhead of disabling and re-enabling polling can be avoided.

fdmon-io_uring.c is unable to take advantage of this optimization
because its ->need_wait() function returns true whenever there are new
io_uring SQEs to submit:

  if (timeout || ctx->fdmon_ops->need_wait(ctx)) {
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Polling will be disabled even when timeout == 0.

Extend the optimization to handle the case when need_wait() returns true
and timeout == 0.

Cc: Chao Gao <chao.gao@intel.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251104022933.618123-5-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/aio-posix.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index 2e0a5dadc4..824fdc34cc 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -559,7 +559,14 @@ static bool run_poll_handlers(AioContext *ctx, AioHandlerList *ready_list,
         elapsed_time = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start_time;
         max_ns = qemu_soonest_timeout(*timeout, max_ns);
         assert(!(max_ns && progress));
-    } while (elapsed_time < max_ns && !ctx->fdmon_ops->need_wait(ctx));
+
+        if (ctx->fdmon_ops->need_wait(ctx)) {
+            if (fdmon_supports_polling(ctx)) {
+                *timeout = 0; /* stay in polling mode */
+            }
+            break;
+        }
+    } while (elapsed_time < max_ns);
 
     if (remove_idle_poll_handlers(ctx, ready_list,
                                   start_time + elapsed_time)) {
@@ -722,7 +729,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
          * up IO threads when some work becomes pending. It is essential to
          * avoid hangs or unnecessary latency.
          */
-        if (poll_set_started(ctx, &ready_list, false)) {
+        if (timeout && poll_set_started(ctx, &ready_list, false)) {
             timeout = 0;
             progress = true;
         }

From 330adf44dcb69598a298c0e2d3b1337b0de5e11e Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:23 -0500
Subject: [PATCH 2081/2396] tests/unit: skip test-nested-aio-poll with io_uring

test-nested-aio-poll relies on internal details of how fdmon-poll.c
handles AioContext polling. Skip it when other fdmon implementations are
in use.

The reason why fdmon-io_uring.c behaves differently from fdmon-poll.c is
that its fdmon_ops->need_wait() function returns true when
io_uring_enter(2) must be called (e.g. to submit pending SQEs).
AioContext polling is skipped when ->need_wait() returns true, so the
test case will never enter AioContext polling mode with
fdmon-io_uring.c.

Restrict this test to fdmon-poll.c and drop the
aio_context_use_g_source() call since it's no longer necessary.

Note that this test is only built on POSIX systems so it is safe to
include "util/aio-posix.h".

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251104022933.618123-6-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/unit/test-nested-aio-poll.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/tests/unit/test-nested-aio-poll.c b/tests/unit/test-nested-aio-poll.c
index d8fd92c43b..d13ecccd8c 100644
--- a/tests/unit/test-nested-aio-poll.c
+++ b/tests/unit/test-nested-aio-poll.c
@@ -15,6 +15,7 @@
 #include "qemu/osdep.h"
 #include "block/aio.h"
 #include "qapi/error.h"
+#include "util/aio-posix.h"
 
 typedef struct {
     AioContext *ctx;
@@ -71,17 +72,17 @@ static void test(void)
         .ctx = aio_context_new(&error_abort),
     };
 
+    if (td.ctx->fdmon_ops != &fdmon_poll_ops) {
+        /* This test is tied to fdmon-poll.c */
+        g_test_skip("fdmon_poll_ops not in use");
+        return;
+    }
+
     qemu_set_current_aio_context(td.ctx);
 
     /* Enable polling */
     aio_context_set_poll_params(td.ctx, 1000000, 2, 2, &error_abort);
 
-    /*
-     * The GSource is unused but this has the side-effect of changing the fdmon
-     * that AioContext uses.
-     */
-    aio_get_g_source(td.ctx);
-
     /* Make the event notifier active (set) right away */
     event_notifier_init(&td.poll_notifier, 1);
     aio_set_event_notifier(td.ctx, &td.poll_notifier,

From ded29e64c6f3a95d37e18823cc90c023aa7af236 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:24 -0500
Subject: [PATCH 2082/2396] aio-posix: integrate fdmon into glib event loop

AioContext's glib integration only supports ppoll(2) file descriptor
monitoring. epoll(7) and io_uring(7) disable themselves and switch back
to ppoll(2) when the glib event loop is used. The main loop thread
cannot use epoll(7) or io_uring(7) because it always uses the glib event
loop.

Future QEMU features may require io_uring(7). One example is uring_cmd
support in FUSE exports. Each feature could create its own io_uring(7)
context and integrate it into the event loop, but this is inefficient
due to extra syscalls. It would be more efficient to reuse the
AioContext's existing fdmon-io_uring.c io_uring(7) context because
fdmon-io_uring.c will already be active on systems where Linux io_uring
is available.

In order to keep fdmon-io_uring.c's AioContext operational even when the
glib event loop is used, extend FDMonOps with an API similar to
GSourceFuncs so that file descriptor monitoring can integrate into the
glib event loop.

A quick summary of the GSourceFuncs API:
- prepare() is called each event loop iteration before waiting for file
  descriptors and timers.
- check() is called to determine whether events are ready to be
  dispatched after waiting.
- dispatch() is called to process events.

More details here: https://docs.gtk.org/glib/struct.SourceFuncs.html

Move the ppoll(2)-specific code from aio-posix.c into fdmon-poll.c and
also implement epoll(7)- and io_uring(7)-specific file descriptor
monitoring code for glib event loops.

Note that it's still faster to use aio_poll() rather than the glib event
loop since glib waits for file descriptor activity with ppoll(2) and
does not support adaptive polling. But at least epoll(7) and io_uring(7)
now work in glib event loops.

Splitting this into multiple commits without temporarily breaking
AioContext proved difficult so this commit makes all the changes. The
next commit will remove the aio_context_use_g_source() API because it is
no longer needed.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251104022933.618123-7-stefanha@redhat.com>
[kwolf: Build fixes; fix AioContext.list_lock use after destroy]
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h   | 36 ++++++++++++++++++
 meson.build           |  2 +
 tests/unit/test-aio.c |  7 +++-
 util/aio-posix.c      | 69 ++++++++---------------------------
 util/aio-posix.h      |  5 +++
 util/async.c          |  3 +-
 util/fdmon-epoll.c    | 34 ++++++++++++++---
 util/fdmon-io_uring.c | 46 ++++++++++++++++++++++-
 util/fdmon-poll.c     | 85 ++++++++++++++++++++++++++++++++++++++++++-
 9 files changed, 224 insertions(+), 63 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index 99ff48420b..aef43f9c51 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -106,6 +106,38 @@ typedef struct {
      * Returns: true if ->wait() should be called, false otherwise.
      */
     bool (*need_wait)(AioContext *ctx);
+
+    /*
+     * gsource_prepare:
+     * @ctx: the AioContext
+     *
+     * Prepare for the glib event loop to wait for events instead of the usual
+     * ->wait() call. See glib's GSourceFuncs->prepare().
+     */
+    void (*gsource_prepare)(AioContext *ctx);
+
+    /*
+     * gsource_check:
+     * @ctx: the AioContext
+     *
+     * Called by the glib event loop from glib's GSourceFuncs->check() after
+     * waiting for events.
+     *
+     * Returns: true when ready to be dispatched.
+     */
+    bool (*gsource_check)(AioContext *ctx);
+
+    /*
+     * gsource_dispatch:
+     * @ctx: the AioContext
+     * @ready_list: list for handlers that become ready
+     *
+     * Place ready AioHandlers on ready_list. Called as part of the glib event
+     * loop from glib's GSourceFuncs->dispatch().
+     *
+     * Called with list_lock incremented.
+     */
+    void (*gsource_dispatch)(AioContext *ctx, AioHandlerList *ready_list);
 } FDMonOps;
 
 /*
@@ -222,6 +254,7 @@ struct AioContext {
     /* State for file descriptor monitoring using Linux io_uring */
     struct io_uring fdmon_io_uring;
     AioHandlerSList submit_list;
+    void *io_uring_fd_tag;
 #endif
 
     /* TimerLists for calling timers - one per clock type.  Has its own
@@ -254,6 +287,9 @@ struct AioContext {
     /* epoll(7) state used when built with CONFIG_EPOLL */
     int epollfd;
 
+    /* The GSource unix fd tag for epollfd */
+    void *epollfd_tag;
+
     const FDMonOps *fdmon_ops;
 };
 
diff --git a/meson.build b/meson.build
index 48c1795b0f..df4460035c 100644
--- a/meson.build
+++ b/meson.build
@@ -2745,6 +2745,8 @@ endif
 if linux_io_uring.found()
   config_host_data.set('HAVE_IO_URING_PREP_WRITEV2',
                        cc.has_header_symbol('liburing.h', 'io_uring_prep_writev2'))
+  config_host_data.set('HAVE_IO_URING_CQ_HAS_OVERFLOW',
+                       cc.has_header_symbol('liburing.h', 'io_uring_cq_has_overflow'))
 endif
 config_host_data.set('HAVE_TCP_KEEPCNT',
                      cc.has_header_symbol('netinet/tcp.h', 'TCP_KEEPCNT') or
diff --git a/tests/unit/test-aio.c b/tests/unit/test-aio.c
index e77d86be87..010d65b79a 100644
--- a/tests/unit/test-aio.c
+++ b/tests/unit/test-aio.c
@@ -527,7 +527,12 @@ static void test_source_bh_delete_from_cb(void)
     g_assert_cmpint(data1.n, ==, data1.max);
     g_assert(data1.bh == NULL);
 
-    assert(g_main_context_iteration(NULL, false));
+    /*
+     * There may be up to one more iteration due to the aio_notify
+     * EventNotifier.
+     */
+    g_main_context_iteration(NULL, false);
+
     assert(!g_main_context_iteration(NULL, false));
 }
 
diff --git a/util/aio-posix.c b/util/aio-posix.c
index 824fdc34cc..9de05ee7e8 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -70,15 +70,6 @@ static AioHandler *find_aio_handler(AioContext *ctx, int fd)
 
 static bool aio_remove_fd_handler(AioContext *ctx, AioHandler *node)
 {
-    /* If the GSource is in the process of being destroyed then
-     * g_source_remove_poll() causes an assertion failure.  Skip
-     * removal in that case, because glib cleans up its state during
-     * destruction anyway.
-     */
-    if (!g_source_is_destroyed(&ctx->source)) {
-        g_source_remove_poll(&ctx->source, &node->pfd);
-    }
-
     node->pfd.revents = 0;
     node->poll_ready = false;
 
@@ -153,7 +144,6 @@ void aio_set_fd_handler(AioContext *ctx,
         } else {
             new_node->pfd = node->pfd;
         }
-        g_source_add_poll(&ctx->source, &new_node->pfd);
 
         new_node->pfd.events = (io_read ? G_IO_IN | G_IO_HUP | G_IO_ERR : 0);
         new_node->pfd.events |= (io_write ? G_IO_OUT | G_IO_ERR : 0);
@@ -267,37 +257,13 @@ bool aio_prepare(AioContext *ctx)
     poll_set_started(ctx, &ready_list, false);
     /* TODO what to do with this list? */
 
+    ctx->fdmon_ops->gsource_prepare(ctx);
     return false;
 }
 
 bool aio_pending(AioContext *ctx)
 {
-    AioHandler *node;
-    bool result = false;
-
-    /*
-     * We have to walk very carefully in case aio_set_fd_handler is
-     * called while we're walking.
-     */
-    qemu_lockcnt_inc(&ctx->list_lock);
-
-    QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
-        int revents;
-
-        /* TODO should this check poll ready? */
-        revents = node->pfd.revents & node->pfd.events;
-        if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
-            result = true;
-            break;
-        }
-        if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
-            result = true;
-            break;
-        }
-    }
-    qemu_lockcnt_dec(&ctx->list_lock);
-
-    return result;
+    return ctx->fdmon_ops->gsource_check(ctx);
 }
 
 static void aio_free_deleted_handlers(AioContext *ctx)
@@ -390,10 +356,6 @@ static bool aio_dispatch_handler(AioContext *ctx, AioHandler *node)
     return progress;
 }
 
-/*
- * If we have a list of ready handlers then this is more efficient than
- * scanning all handlers with aio_dispatch_handlers().
- */
 static bool aio_dispatch_ready_handlers(AioContext *ctx,
                                         AioHandlerList *ready_list,
                                         int64_t block_ns)
@@ -417,24 +379,18 @@ static bool aio_dispatch_ready_handlers(AioContext *ctx,
     return progress;
 }
 
-/* Slower than aio_dispatch_ready_handlers() but only used via glib */
-static bool aio_dispatch_handlers(AioContext *ctx)
-{
-    AioHandler *node, *tmp;
-    bool progress = false;
-
-    QLIST_FOREACH_SAFE_RCU(node, &ctx->aio_handlers, node, tmp) {
-        progress = aio_dispatch_handler(ctx, node) || progress;
-    }
-
-    return progress;
-}
-
 void aio_dispatch(AioContext *ctx)
 {
+    AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
+
     qemu_lockcnt_inc(&ctx->list_lock);
     aio_bh_poll(ctx);
-    aio_dispatch_handlers(ctx);
+
+    ctx->fdmon_ops->gsource_dispatch(ctx, &ready_list);
+
+    /* block_ns is 0 because polling is disabled in the glib event loop */
+    aio_dispatch_ready_handlers(ctx, &ready_list, 0);
+
     aio_free_deleted_handlers(ctx);
     qemu_lockcnt_dec(&ctx->list_lock);
 
@@ -766,6 +722,7 @@ void aio_context_setup(AioContext *ctx)
 {
     ctx->fdmon_ops = &fdmon_poll_ops;
     ctx->epollfd = -1;
+    ctx->epollfd_tag = NULL;
 
     /* Use the fastest fd monitoring implementation if available */
     if (fdmon_io_uring_setup(ctx)) {
@@ -778,7 +735,11 @@ void aio_context_setup(AioContext *ctx)
 void aio_context_destroy(AioContext *ctx)
 {
     fdmon_io_uring_destroy(ctx);
+
+    qemu_lockcnt_lock(&ctx->list_lock);
     fdmon_epoll_disable(ctx);
+    qemu_lockcnt_unlock(&ctx->list_lock);
+
     aio_free_deleted_handlers(ctx);
 }
 
diff --git a/util/aio-posix.h b/util/aio-posix.h
index 82a0201ea4..f9994ed79e 100644
--- a/util/aio-posix.h
+++ b/util/aio-posix.h
@@ -47,9 +47,14 @@ void aio_add_ready_handler(AioHandlerList *ready_list, AioHandler *node,
 
 extern const FDMonOps fdmon_poll_ops;
 
+/* Switch back to poll(2). list_lock must be held. */
+void fdmon_poll_downgrade(AioContext *ctx);
+
 #ifdef CONFIG_EPOLL_CREATE1
 bool fdmon_epoll_try_upgrade(AioContext *ctx, unsigned npfd);
 void fdmon_epoll_setup(AioContext *ctx);
+
+/* list_lock must be held */
 void fdmon_epoll_disable(AioContext *ctx);
 #else
 static inline bool fdmon_epoll_try_upgrade(AioContext *ctx, unsigned npfd)
diff --git a/util/async.c b/util/async.c
index a736d2cd0d..83f1e73e34 100644
--- a/util/async.c
+++ b/util/async.c
@@ -418,10 +418,11 @@ aio_ctx_finalize(GSource     *source)
     aio_set_event_notifier(ctx, &ctx->notifier, NULL, NULL, NULL);
     event_notifier_cleanup(&ctx->notifier);
     qemu_rec_mutex_destroy(&ctx->lock);
-    qemu_lockcnt_destroy(&ctx->list_lock);
     timerlistgroup_deinit(&ctx->tlg);
     unregister_aiocontext(ctx);
     aio_context_destroy(ctx);
+    /* aio_context_destroy() still needs the lock */
+    qemu_lockcnt_destroy(&ctx->list_lock);
 }
 
 static GSourceFuncs aio_source_funcs = {
diff --git a/util/fdmon-epoll.c b/util/fdmon-epoll.c
index 9fb8800dde..61118e1ee6 100644
--- a/util/fdmon-epoll.c
+++ b/util/fdmon-epoll.c
@@ -19,8 +19,12 @@ void fdmon_epoll_disable(AioContext *ctx)
         ctx->epollfd = -1;
     }
 
-    /* Switch back */
-    ctx->fdmon_ops = &fdmon_poll_ops;
+    if (ctx->epollfd_tag) {
+        g_source_remove_unix_fd(&ctx->source, ctx->epollfd_tag);
+        ctx->epollfd_tag = NULL;
+    }
+
+    fdmon_poll_downgrade(ctx);
 }
 
 static inline int epoll_events_from_pfd(int pfd_events)
@@ -93,10 +97,29 @@ out:
     return ret;
 }
 
+static void fdmon_epoll_gsource_prepare(AioContext *ctx)
+{
+    /* Do nothing */
+}
+
+static bool fdmon_epoll_gsource_check(AioContext *ctx)
+{
+    return g_source_query_unix_fd(&ctx->source, ctx->epollfd_tag) & G_IO_IN;
+}
+
+static void fdmon_epoll_gsource_dispatch(AioContext *ctx,
+                                         AioHandlerList *ready_list)
+{
+    fdmon_epoll_wait(ctx, ready_list, 0);
+}
+
 static const FDMonOps fdmon_epoll_ops = {
     .update = fdmon_epoll_update,
     .wait = fdmon_epoll_wait,
     .need_wait = aio_poll_disabled,
+    .gsource_prepare = fdmon_epoll_gsource_prepare,
+    .gsource_check = fdmon_epoll_gsource_check,
+    .gsource_dispatch = fdmon_epoll_gsource_dispatch,
 };
 
 static bool fdmon_epoll_try_enable(AioContext *ctx)
@@ -118,6 +141,8 @@ static bool fdmon_epoll_try_enable(AioContext *ctx)
     }
 
     ctx->fdmon_ops = &fdmon_epoll_ops;
+    ctx->epollfd_tag = g_source_add_unix_fd(&ctx->source, ctx->epollfd,
+                                            G_IO_IN);
     return true;
 }
 
@@ -139,12 +164,11 @@ bool fdmon_epoll_try_upgrade(AioContext *ctx, unsigned npfd)
     }
 
     ok = fdmon_epoll_try_enable(ctx);
-
-    qemu_lockcnt_inc_and_unlock(&ctx->list_lock);
-
     if (!ok) {
         fdmon_epoll_disable(ctx);
     }
+
+    qemu_lockcnt_inc_and_unlock(&ctx->list_lock);
     return ok;
 }
 
diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index 3d8638b0e5..2460ac1556 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -262,6 +262,13 @@ static int process_cq_ring(AioContext *ctx, AioHandlerList *ready_list)
     unsigned num_ready = 0;
     unsigned head;
 
+#ifdef HAVE_IO_URING_CQ_HAS_OVERFLOW
+    /* If the CQ overflowed then fetch CQEs with a syscall */
+    if (io_uring_cq_has_overflow(ring)) {
+        io_uring_get_events(ring);
+    }
+#endif
+
     io_uring_for_each_cqe(ring, head, cqe) {
         if (process_cqe(ctx, ready_list, cqe)) {
             num_ready++;
@@ -274,6 +281,30 @@ static int process_cq_ring(AioContext *ctx, AioHandlerList *ready_list)
     return num_ready;
 }
 
+/* This is where SQEs are submitted in the glib event loop */
+static void fdmon_io_uring_gsource_prepare(AioContext *ctx)
+{
+    fill_sq_ring(ctx);
+    if (io_uring_sq_ready(&ctx->fdmon_io_uring)) {
+        while (io_uring_submit(&ctx->fdmon_io_uring) == -EINTR) {
+            /* Keep trying if syscall was interrupted */
+        }
+    }
+}
+
+static bool fdmon_io_uring_gsource_check(AioContext *ctx)
+{
+    gpointer tag = ctx->io_uring_fd_tag;
+    return g_source_query_unix_fd(&ctx->source, tag) & G_IO_IN;
+}
+
+/* This is where CQEs are processed in the glib event loop */
+static void fdmon_io_uring_gsource_dispatch(AioContext *ctx,
+                                            AioHandlerList *ready_list)
+{
+    process_cq_ring(ctx, ready_list);
+}
+
 static int fdmon_io_uring_wait(AioContext *ctx, AioHandlerList *ready_list,
                                int64_t timeout)
 {
@@ -339,12 +370,17 @@ static const FDMonOps fdmon_io_uring_ops = {
     .update = fdmon_io_uring_update,
     .wait = fdmon_io_uring_wait,
     .need_wait = fdmon_io_uring_need_wait,
+    .gsource_prepare = fdmon_io_uring_gsource_prepare,
+    .gsource_check = fdmon_io_uring_gsource_check,
+    .gsource_dispatch = fdmon_io_uring_gsource_dispatch,
 };
 
 bool fdmon_io_uring_setup(AioContext *ctx)
 {
     int ret;
 
+    ctx->io_uring_fd_tag = NULL;
+
     ret = io_uring_queue_init(FDMON_IO_URING_ENTRIES, &ctx->fdmon_io_uring, 0);
     if (ret != 0) {
         return false;
@@ -352,6 +388,9 @@ bool fdmon_io_uring_setup(AioContext *ctx)
 
     QSLIST_INIT(&ctx->submit_list);
     ctx->fdmon_ops = &fdmon_io_uring_ops;
+    ctx->io_uring_fd_tag = g_source_add_unix_fd(&ctx->source,
+            ctx->fdmon_io_uring.ring_fd, G_IO_IN);
+
     return true;
 }
 
@@ -379,6 +418,11 @@ void fdmon_io_uring_destroy(AioContext *ctx)
             QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
         }
 
-        ctx->fdmon_ops = &fdmon_poll_ops;
+        g_source_remove_unix_fd(&ctx->source, ctx->io_uring_fd_tag);
+        ctx->io_uring_fd_tag = NULL;
+
+        qemu_lockcnt_lock(&ctx->list_lock);
+        fdmon_poll_downgrade(ctx);
+        qemu_lockcnt_unlock(&ctx->list_lock);
     }
 }
diff --git a/util/fdmon-poll.c b/util/fdmon-poll.c
index 17df917cf9..0ae755cc13 100644
--- a/util/fdmon-poll.c
+++ b/util/fdmon-poll.c
@@ -72,6 +72,11 @@ static int fdmon_poll_wait(AioContext *ctx, AioHandlerList *ready_list,
 
     /* epoll(7) is faster above a certain number of fds */
     if (fdmon_epoll_try_upgrade(ctx, npfd)) {
+        QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
+            if (!QLIST_IS_INSERTED(node, node_deleted) && node->pfd.events) {
+                g_source_remove_poll(&ctx->source, &node->pfd);
+            }
+        }
         npfd = 0; /* we won't need pollfds[], reset npfd */
         return ctx->fdmon_ops->wait(ctx, ready_list, timeout);
     }
@@ -97,11 +102,89 @@ static void fdmon_poll_update(AioContext *ctx,
                               AioHandler *old_node,
                               AioHandler *new_node)
 {
-    /* Do nothing, AioHandler already contains the state we'll need */
+    if (old_node) {
+        /*
+         * If the GSource is in the process of being destroyed then
+         * g_source_remove_poll() causes an assertion failure.  Skip removal in
+         * that case, because glib cleans up its state during destruction
+         * anyway.
+         */
+        if (!g_source_is_destroyed(&ctx->source)) {
+            g_source_remove_poll(&ctx->source, &old_node->pfd);
+        }
+    }
+
+    if (new_node) {
+        g_source_add_poll(&ctx->source, &new_node->pfd);
+    }
+}
+
+static void fdmon_poll_gsource_prepare(AioContext *ctx)
+{
+    /* Do nothing */
+}
+
+static bool fdmon_poll_gsource_check(AioContext *ctx)
+{
+    AioHandler *node;
+    bool result = false;
+
+    /*
+     * We have to walk very carefully in case aio_set_fd_handler is
+     * called while we're walking.
+     */
+    qemu_lockcnt_inc(&ctx->list_lock);
+
+    QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
+        int revents = node->pfd.revents & node->pfd.events;
+
+        if (revents & (G_IO_IN | G_IO_HUP | G_IO_ERR) && node->io_read) {
+            result = true;
+            break;
+        }
+        if (revents & (G_IO_OUT | G_IO_ERR) && node->io_write) {
+            result = true;
+            break;
+        }
+    }
+
+    qemu_lockcnt_dec(&ctx->list_lock);
+
+    return result;
+}
+
+static void fdmon_poll_gsource_dispatch(AioContext *ctx,
+                                        AioHandlerList *ready_list)
+{
+    AioHandler *node;
+
+    QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
+        int revents = node->pfd.revents;
+
+        if (revents) {
+            aio_add_ready_handler(ready_list, node, revents);
+        }
+    }
 }
 
 const FDMonOps fdmon_poll_ops = {
     .update = fdmon_poll_update,
     .wait = fdmon_poll_wait,
     .need_wait = aio_poll_disabled,
+    .gsource_prepare = fdmon_poll_gsource_prepare,
+    .gsource_check = fdmon_poll_gsource_check,
+    .gsource_dispatch = fdmon_poll_gsource_dispatch,
 };
+
+void fdmon_poll_downgrade(AioContext *ctx)
+{
+    AioHandler *node;
+
+    ctx->fdmon_ops = &fdmon_poll_ops;
+
+    QLIST_FOREACH_RCU(node, &ctx->aio_handlers, node) {
+        if (!QLIST_IS_INSERTED(node, node_deleted) && node->pfd.events) {
+            g_source_add_poll(&ctx->source, &node->pfd);
+        }
+    }
+}

From d1f42b600a506393dfa99c0fa5ff7820c5e9f131 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:25 -0500
Subject: [PATCH 2083/2396] aio: remove aio_context_use_g_source()

There is no need for aio_context_use_g_source() now that epoll(7) and
io_uring(7) file descriptor monitoring works with the glib event loop.
AioContext doesn't need to be notified that GSource is being used.

On hosts with io_uring support this now enables fdmon-io_uring.c by
default, replacing fdmon-poll.c and fdmon-epoll.c. In other words, the
event loop will use io_uring!

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251104022933.618123-8-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h |  3 ---
 util/aio-posix.c    | 12 ------------
 util/aio-win32.c    |  4 ----
 util/async.c        |  1 -
 4 files changed, 20 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index aef43f9c51..3ee6015424 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -728,9 +728,6 @@ void aio_context_setup(AioContext *ctx);
  */
 void aio_context_destroy(AioContext *ctx);
 
-/* Used internally, do not call outside AioContext code */
-void aio_context_use_g_source(AioContext *ctx);
-
 /**
  * aio_context_set_poll_params:
  * @ctx: the aio context
diff --git a/util/aio-posix.c b/util/aio-posix.c
index 9de05ee7e8..bebd9ce3a2 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -743,18 +743,6 @@ void aio_context_destroy(AioContext *ctx)
     aio_free_deleted_handlers(ctx);
 }
 
-void aio_context_use_g_source(AioContext *ctx)
-{
-    /*
-     * Disable io_uring when the glib main loop is used because it doesn't
-     * support mixed glib/aio_poll() usage. It relies on aio_poll() being
-     * called regularly so that changes to the monitored file descriptors are
-     * submitted, otherwise a list of pending fd handlers builds up.
-     */
-    fdmon_io_uring_destroy(ctx);
-    aio_free_deleted_handlers(ctx);
-}
-
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink, Error **errp)
 {
diff --git a/util/aio-win32.c b/util/aio-win32.c
index c6fbce64c2..18cc9fb7a9 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -427,10 +427,6 @@ void aio_context_destroy(AioContext *ctx)
 {
 }
 
-void aio_context_use_g_source(AioContext *ctx)
-{
-}
-
 void aio_context_set_poll_params(AioContext *ctx, int64_t max_ns,
                                  int64_t grow, int64_t shrink, Error **errp)
 {
diff --git a/util/async.c b/util/async.c
index 83f1e73e34..9d6f0c73ee 100644
--- a/util/async.c
+++ b/util/async.c
@@ -434,7 +434,6 @@ static GSourceFuncs aio_source_funcs = {
 
 GSource *aio_get_g_source(AioContext *ctx)
 {
-    aio_context_use_g_source(ctx);
     g_source_ref(&ctx->source);
     return &ctx->source;
 }

From 3769b9abe9e03acc3cbf4a22a8754a2c09482c7d Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:26 -0500
Subject: [PATCH 2084/2396] aio: free AioContext when aio_context_new() fails

g_source_destroy() only removes the GSource from the GMainContext it's
attached to, if any. It does not free it.

Use g_source_unref() instead so that the AioContext (which embeds a
GSource) is freed. There is no need to call g_source_destroy() in
aio_context_new() because the GSource isn't attached to a GMainContext
yet.

aio_ctx_finalize() expects everything to be set up already, so introduce
the new ctx->initialized boolean and do nothing when called with
!initialized. This also requires moving aio_context_setup() down after
event_notifier_init() since aio_ctx_finalize() won't release any
resources that aio_context_setup() acquired.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251104022933.618123-9-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h |  3 +++
 util/async.c        | 31 ++++++++++++++++++++++++++++---
 2 files changed, 31 insertions(+), 3 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index 3ee6015424..6cddf4d13b 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -291,6 +291,9 @@ struct AioContext {
     void *epollfd_tag;
 
     const FDMonOps *fdmon_ops;
+
+    /* Was aio_context_new() successful? */
+    bool initialized;
 };
 
 /**
diff --git a/util/async.c b/util/async.c
index 9d6f0c73ee..95b1c6b610 100644
--- a/util/async.c
+++ b/util/async.c
@@ -366,12 +366,16 @@ aio_ctx_dispatch(GSource     *source,
 }
 
 static void
-aio_ctx_finalize(GSource     *source)
+aio_ctx_finalize(GSource *source)
 {
     AioContext *ctx = (AioContext *) source;
     QEMUBH *bh;
     unsigned flags;
 
+    if (!ctx->initialized) {
+        return;
+    }
+
     thread_pool_free_aio(ctx->thread_pool);
 
 #ifdef CONFIG_LINUX_AIO
@@ -580,16 +584,35 @@ AioContext *aio_context_new(Error **errp)
     int ret;
     AioContext *ctx;
 
+    /*
+     * ctx is freed by g_source_unref() (e.g. aio_context_unref()). ctx's
+     * resources are freed as follows:
+     *
+     * 1. By aio_ctx_finalize() after aio_context_new() has returned and set
+     *    ->initialized = true.
+     *
+     * 2. By manual cleanup code in this function's error paths before goto
+     *    fail.
+     *
+     * Be careful to free resources in both cases!
+     */
     ctx = (AioContext *) g_source_new(&aio_source_funcs, sizeof(AioContext));
     QSLIST_INIT(&ctx->bh_list);
     QSIMPLEQ_INIT(&ctx->bh_slice_list);
-    aio_context_setup(ctx);
 
     ret = event_notifier_init(&ctx->notifier, false);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Failed to initialize event notifier");
         goto fail;
     }
+
+    /*
+     * Resources cannot easily be freed manually after aio_context_setup(). If
+     * you add any new resources to AioContext, it's probably best to acquire
+     * them before aio_context_setup().
+     */
+    aio_context_setup(ctx);
+
     g_source_set_can_recurse(&ctx->source, true);
     qemu_lockcnt_init(&ctx->list_lock);
 
@@ -623,9 +646,11 @@ AioContext *aio_context_new(Error **errp)
 
     register_aiocontext(ctx);
 
+    ctx->initialized = true;
+
     return ctx;
 fail:
-    g_source_destroy(&ctx->source);
+    g_source_unref(&ctx->source);
     return NULL;
 }
 

From 421dcc8023aa3751763d12aa0e13d8dcbb393b4c Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:27 -0500
Subject: [PATCH 2085/2396] aio: add errp argument to aio_context_setup()

When aio_context_new() -> aio_context_setup() fails at startup it
doesn't really matter whether errors are returned to the caller or the
process terminates immediately.

However, it is not acceptable to terminate when hotplugging --object
iothread at runtime. Refactor aio_context_setup() so that errors can be
propagated. The next commit will set errp when fdmon_io_uring_setup()
fails.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251104022933.618123-10-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h | 5 ++++-
 util/aio-posix.c    | 5 +++--
 util/aio-win32.c    | 3 ++-
 util/async.c        | 6 +++++-
 4 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index 6cddf4d13b..13b6d34238 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -718,10 +718,13 @@ void qemu_set_current_aio_context(AioContext *ctx);
 /**
  * aio_context_setup:
  * @ctx: the aio context
+ * @errp: error pointer
  *
  * Initialize the aio context.
+ *
+ * Returns: true on success, false otherwise
  */
-void aio_context_setup(AioContext *ctx);
+bool aio_context_setup(AioContext *ctx, Error **errp);
 
 /**
  * aio_context_destroy:
diff --git a/util/aio-posix.c b/util/aio-posix.c
index bebd9ce3a2..9806a75c12 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -718,7 +718,7 @@ bool aio_poll(AioContext *ctx, bool blocking)
     return progress;
 }
 
-void aio_context_setup(AioContext *ctx)
+bool aio_context_setup(AioContext *ctx, Error **errp)
 {
     ctx->fdmon_ops = &fdmon_poll_ops;
     ctx->epollfd = -1;
@@ -726,10 +726,11 @@ void aio_context_setup(AioContext *ctx)
 
     /* Use the fastest fd monitoring implementation if available */
     if (fdmon_io_uring_setup(ctx)) {
-        return;
+        return true;
     }
 
     fdmon_epoll_setup(ctx);
+    return true;
 }
 
 void aio_context_destroy(AioContext *ctx)
diff --git a/util/aio-win32.c b/util/aio-win32.c
index 18cc9fb7a9..6e6f699e4b 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -419,8 +419,9 @@ bool aio_poll(AioContext *ctx, bool blocking)
     return progress;
 }
 
-void aio_context_setup(AioContext *ctx)
+bool aio_context_setup(AioContext *ctx, Error **errp)
 {
+    return true;
 }
 
 void aio_context_destroy(AioContext *ctx)
diff --git a/util/async.c b/util/async.c
index 95b1c6b610..7030047cfb 100644
--- a/util/async.c
+++ b/util/async.c
@@ -581,6 +581,7 @@ static void co_schedule_bh_cb(void *opaque)
 
 AioContext *aio_context_new(Error **errp)
 {
+    ERRP_GUARD();
     int ret;
     AioContext *ctx;
 
@@ -611,7 +612,10 @@ AioContext *aio_context_new(Error **errp)
      * you add any new resources to AioContext, it's probably best to acquire
      * them before aio_context_setup().
      */
-    aio_context_setup(ctx);
+    if (!aio_context_setup(ctx, errp)) {
+        event_notifier_cleanup(&ctx->notifier);
+        goto fail;
+    }
 
     g_source_set_can_recurse(&ctx->source, true);
     qemu_lockcnt_init(&ctx->list_lock);

From 59202c98c0d3b3c3fbb5f5efc6b91411d991ec76 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:28 -0500
Subject: [PATCH 2086/2396] aio-posix: gracefully handle io_uring_queue_init()
 failure

io_uring may not be available at runtime due to system policies (e.g.
the io_uring_disabled sysctl) or creation could fail due to file
descriptor resource limits.

Handle failure scenarios as follows:

If another AioContext already has io_uring, then fail AioContext
creation so that the aio_add_sqe() API is available uniformly from all
QEMU threads. Otherwise fall back to epoll(7) if io_uring is
unavailable.

Notes:
- Update the comment about selecting the fastest fdmon implementation.
  At this point it's not about speed anymore, it's about aio_add_sqe()
  API availability.
- Uppercase the error message when converting from error_report() to
  error_setg_errno() for consistency (but there are instances of
  lowercase in the codebase).
- It's easier to move the #ifdefs from aio-posix.h to aio-posix.c.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251104022933.618123-11-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/aio-posix.c      | 28 +++++++++++++++++++++++++---
 util/aio-posix.h      | 12 ++----------
 util/fdmon-io_uring.c |  5 +++--
 3 files changed, 30 insertions(+), 15 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index 9806a75c12..c0285a26a3 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -16,6 +16,7 @@
 #include "qemu/osdep.h"
 #include "block/block.h"
 #include "block/thread-pool.h"
+#include "qapi/error.h"
 #include "qemu/main-loop.h"
 #include "qemu/lockcnt.h"
 #include "qemu/rcu.h"
@@ -724,10 +725,29 @@ bool aio_context_setup(AioContext *ctx, Error **errp)
     ctx->epollfd = -1;
     ctx->epollfd_tag = NULL;
 
-    /* Use the fastest fd monitoring implementation if available */
-    if (fdmon_io_uring_setup(ctx)) {
-        return true;
+#ifdef CONFIG_LINUX_IO_URING
+    {
+        static bool need_io_uring;
+        Error *local_err = NULL; /* ERRP_GUARD() doesn't handle error_abort */
+
+        /* io_uring takes precedence because it provides aio_add_sqe() support */
+        if (fdmon_io_uring_setup(ctx, &local_err)) {
+            /*
+             * If one AioContext gets io_uring, then all AioContexts need io_uring
+             * so that aio_add_sqe() support is available across all threads.
+             */
+            need_io_uring = true;
+            return true;
+        }
+        if (need_io_uring) {
+            error_propagate(errp, local_err);
+            return false;
+        }
+
+        /* Silently fall back on systems where io_uring is unavailable */
+        error_free(local_err);
     }
+#endif /* CONFIG_LINUX_IO_URING */
 
     fdmon_epoll_setup(ctx);
     return true;
@@ -735,7 +755,9 @@ bool aio_context_setup(AioContext *ctx, Error **errp)
 
 void aio_context_destroy(AioContext *ctx)
 {
+#ifdef CONFIG_LINUX_IO_URING
     fdmon_io_uring_destroy(ctx);
+#endif
 
     qemu_lockcnt_lock(&ctx->list_lock);
     fdmon_epoll_disable(ctx);
diff --git a/util/aio-posix.h b/util/aio-posix.h
index f9994ed79e..dfa1a51c0b 100644
--- a/util/aio-posix.h
+++ b/util/aio-posix.h
@@ -18,6 +18,7 @@
 #define AIO_POSIX_H
 
 #include "block/aio.h"
+#include "qapi/error.h"
 
 struct AioHandler {
     GPollFD pfd;
@@ -72,17 +73,8 @@ static inline void fdmon_epoll_disable(AioContext *ctx)
 #endif /* !CONFIG_EPOLL_CREATE1 */
 
 #ifdef CONFIG_LINUX_IO_URING
-bool fdmon_io_uring_setup(AioContext *ctx);
+bool fdmon_io_uring_setup(AioContext *ctx, Error **errp);
 void fdmon_io_uring_destroy(AioContext *ctx);
-#else
-static inline bool fdmon_io_uring_setup(AioContext *ctx)
-{
-    return false;
-}
-
-static inline void fdmon_io_uring_destroy(AioContext *ctx)
-{
-}
 #endif /* !CONFIG_LINUX_IO_URING */
 
 #endif /* AIO_POSIX_H */
diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index 2460ac1556..bcfdddf398 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -45,6 +45,7 @@
 
 #include "qemu/osdep.h"
 #include <poll.h>
+#include "qapi/error.h"
 #include "qemu/rcu_queue.h"
 #include "aio-posix.h"
 
@@ -375,7 +376,7 @@ static const FDMonOps fdmon_io_uring_ops = {
     .gsource_dispatch = fdmon_io_uring_gsource_dispatch,
 };
 
-bool fdmon_io_uring_setup(AioContext *ctx)
+bool fdmon_io_uring_setup(AioContext *ctx, Error **errp)
 {
     int ret;
 
@@ -383,6 +384,7 @@ bool fdmon_io_uring_setup(AioContext *ctx)
 
     ret = io_uring_queue_init(FDMON_IO_URING_ENTRIES, &ctx->fdmon_io_uring, 0);
     if (ret != 0) {
+        error_setg_errno(errp, -ret, "Failed to initialize io_uring");
         return false;
     }
 
@@ -390,7 +392,6 @@ bool fdmon_io_uring_setup(AioContext *ctx)
     ctx->fdmon_ops = &fdmon_io_uring_ops;
     ctx->io_uring_fd_tag = g_source_add_unix_fd(&ctx->source,
             ctx->fdmon_io_uring.ring_fd, G_IO_IN);
-
     return true;
 }
 

From a63e41f2a41cdd4a577e50eadc9b1f6d3028ab36 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:29 -0500
Subject: [PATCH 2087/2396] aio-posix: unindent fdmon_io_uring_destroy()

Reduce the level of indentation to make further code changes easier to
read.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251104022933.618123-12-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 util/fdmon-io_uring.c | 46 ++++++++++++++++++++++---------------------
 1 file changed, 24 insertions(+), 22 deletions(-)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index bcfdddf398..6ee6adbebb 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -397,33 +397,35 @@ bool fdmon_io_uring_setup(AioContext *ctx, Error **errp)
 
 void fdmon_io_uring_destroy(AioContext *ctx)
 {
-    if (ctx->fdmon_ops == &fdmon_io_uring_ops) {
-        AioHandler *node;
+    AioHandler *node;
 
-        io_uring_queue_exit(&ctx->fdmon_io_uring);
+    if (ctx->fdmon_ops != &fdmon_io_uring_ops) {
+        return;
+    }
 
-        /* Move handlers due to be removed onto the deleted list */
-        while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) {
-            unsigned flags = qatomic_fetch_and(&node->flags,
-                    ~(FDMON_IO_URING_PENDING |
-                      FDMON_IO_URING_ADD |
-                      FDMON_IO_URING_REMOVE |
-                      FDMON_IO_URING_DELETE_AIO_HANDLER));
+    io_uring_queue_exit(&ctx->fdmon_io_uring);
 
-            if ((flags & FDMON_IO_URING_REMOVE) ||
-                (flags & FDMON_IO_URING_DELETE_AIO_HANDLER)) {
-                QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers,
-                                      node, node_deleted);
-            }
+    /* Move handlers due to be removed onto the deleted list */
+    while ((node = QSLIST_FIRST_RCU(&ctx->submit_list))) {
+        unsigned flags = qatomic_fetch_and(&node->flags,
+                ~(FDMON_IO_URING_PENDING |
+                  FDMON_IO_URING_ADD |
+                  FDMON_IO_URING_REMOVE |
+                  FDMON_IO_URING_DELETE_AIO_HANDLER));
 
-            QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
+        if ((flags & FDMON_IO_URING_REMOVE) ||
+            (flags & FDMON_IO_URING_DELETE_AIO_HANDLER)) {
+            QLIST_INSERT_HEAD_RCU(&ctx->deleted_aio_handlers,
+                                  node, node_deleted);
         }
 
-        g_source_remove_unix_fd(&ctx->source, ctx->io_uring_fd_tag);
-        ctx->io_uring_fd_tag = NULL;
-
-        qemu_lockcnt_lock(&ctx->list_lock);
-        fdmon_poll_downgrade(ctx);
-        qemu_lockcnt_unlock(&ctx->list_lock);
+        QSLIST_REMOVE_HEAD_RCU(&ctx->submit_list, node_submitted);
     }
+
+    g_source_remove_unix_fd(&ctx->source, ctx->io_uring_fd_tag);
+    ctx->io_uring_fd_tag = NULL;
+
+    qemu_lockcnt_lock(&ctx->list_lock);
+    fdmon_poll_downgrade(ctx);
+    qemu_lockcnt_unlock(&ctx->list_lock);
 }

From 87e7a0f4237a076b0fd75795cba8bd9bff28a147 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:30 -0500
Subject: [PATCH 2088/2396] aio-posix: add fdmon_ops->dispatch()

The ppoll and epoll file descriptor monitoring implementations rely on
the event loop's generic file descriptor, timer, and BH dispatch code to
invoke user callbacks.

The io_uring file descriptor monitoring implementation will need
io_uring-specific dispatch logic for CQE handlers for custom SQEs.

Introduce a new FDMonOps ->dispatch() callback that allows file
descriptor monitoring implementations to invoke user callbacks. The next
patch will use this new callback.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251104022933.618123-13-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h | 19 +++++++++++++++++++
 util/aio-posix.c    |  9 +++++++++
 2 files changed, 28 insertions(+)

diff --git a/include/block/aio.h b/include/block/aio.h
index 13b6d34238..fc1a3c06e2 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -107,6 +107,25 @@ typedef struct {
      */
     bool (*need_wait)(AioContext *ctx);
 
+    /*
+     * dispatch:
+     * @ctx: the AioContext
+     *
+     * Dispatch any work that is specific to this file descriptor monitoring
+     * implementation. Usually the event loop's generic file descriptor
+     * monitoring, BH, and timer dispatching code is sufficient, but file
+     * descriptor monitoring implementations offering additional functionality
+     * may need to implement this function for custom behavior. Called at a
+     * point in the event loop when it is safe to invoke user-defined
+     * callbacks.
+     *
+     * This function is optional and may be NULL.
+     *
+     * Returns: true if progress was made (see aio_poll()'s return value),
+     * false otherwise.
+     */
+    bool (*dispatch)(AioContext *ctx);
+
     /*
      * gsource_prepare:
      * @ctx: the AioContext
diff --git a/util/aio-posix.c b/util/aio-posix.c
index c0285a26a3..6ff36b6e51 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -385,10 +385,15 @@ void aio_dispatch(AioContext *ctx)
     AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
 
     qemu_lockcnt_inc(&ctx->list_lock);
+
     aio_bh_poll(ctx);
 
     ctx->fdmon_ops->gsource_dispatch(ctx, &ready_list);
 
+    if (ctx->fdmon_ops->dispatch) {
+        ctx->fdmon_ops->dispatch(ctx);
+    }
+
     /* block_ns is 0 because polling is disabled in the glib event loop */
     aio_dispatch_ready_handlers(ctx, &ready_list, 0);
 
@@ -707,6 +712,10 @@ bool aio_poll(AioContext *ctx, bool blocking)
         block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
     }
 
+    if (ctx->fdmon_ops->dispatch) {
+        progress |= ctx->fdmon_ops->dispatch(ctx);
+    }
+
     progress |= aio_bh_poll(ctx);
     progress |= aio_dispatch_ready_handlers(ctx, &ready_list, block_ns);
 

From 1eebdab3c37a4a837baa5ca614ae2aca211a1d8d Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:31 -0500
Subject: [PATCH 2089/2396] aio-posix: add aio_add_sqe() API for user-defined
 io_uring requests

Introduce the aio_add_sqe() API for submitting io_uring requests in the
current AioContext. This allows other components in QEMU, like the block
layer, to take advantage of io_uring features without creating their own
io_uring context.

This API supports nested event loops just like file descriptor
monitoring and BHs do. This comes at a complexity cost: CQE callbacks
must be placed on a list so that nested event loops can invoke pending
CQE callbacks from parent event loops. If you're wondering why
CqeHandler exists instead of just a callback function pointer, this is
why.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251104022933.618123-14-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h   |  83 +++++++++++++++++++++++++++++++-
 util/aio-posix.c      |   9 ++++
 util/aio-posix.h      |   1 +
 util/fdmon-io_uring.c | 109 ++++++++++++++++++++++++++++++++++++------
 util/trace-events     |   4 ++
 5 files changed, 190 insertions(+), 16 deletions(-)

diff --git a/include/block/aio.h b/include/block/aio.h
index fc1a3c06e2..0f77ae2f64 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -61,6 +61,27 @@ typedef struct LuringState LuringState;
 /* Is polling disabled? */
 bool aio_poll_disabled(AioContext *ctx);
 
+#ifdef CONFIG_LINUX_IO_URING
+/*
+ * Each io_uring request must have a unique CqeHandler that processes the cqe.
+ * The lifetime of a CqeHandler must be at least from aio_add_sqe() until
+ * ->cb() invocation.
+ */
+typedef struct CqeHandler CqeHandler;
+struct CqeHandler {
+    /* Called by the AioContext when the request has completed */
+    void (*cb)(CqeHandler *handler);
+
+    /* Used internally, do not access this */
+    QSIMPLEQ_ENTRY(CqeHandler) next;
+
+    /* This field is filled in before ->cb() is called */
+    struct io_uring_cqe cqe;
+};
+
+typedef QSIMPLEQ_HEAD(, CqeHandler) CqeHandlerSimpleQ;
+#endif /* CONFIG_LINUX_IO_URING */
+
 /* Callbacks for file descriptor monitoring implementations */
 typedef struct {
     /*
@@ -157,6 +178,27 @@ typedef struct {
      * Called with list_lock incremented.
      */
     void (*gsource_dispatch)(AioContext *ctx, AioHandlerList *ready_list);
+
+#ifdef CONFIG_LINUX_IO_URING
+    /**
+     * add_sqe: Add an io_uring sqe for submission.
+     * @prep_sqe: invoked with an sqe that should be prepared for submission
+     * @opaque: user-defined argument to @prep_sqe()
+     * @cqe_handler: the unique cqe handler associated with this request
+     *
+     * The caller's @prep_sqe() function is invoked to fill in the details of
+     * the sqe. Do not call io_uring_sqe_set_data() on this sqe.
+     *
+     * The kernel may see the sqe as soon as @prep_sqe() returns or it may take
+     * until the next event loop iteration.
+     *
+     * This function is called from the current AioContext and is not
+     * thread-safe.
+     */
+    void (*add_sqe)(AioContext *ctx,
+                    void (*prep_sqe)(struct io_uring_sqe *sqe, void *opaque),
+                    void *opaque, CqeHandler *cqe_handler);
+#endif /* CONFIG_LINUX_IO_URING */
 } FDMonOps;
 
 /*
@@ -274,7 +316,10 @@ struct AioContext {
     struct io_uring fdmon_io_uring;
     AioHandlerSList submit_list;
     void *io_uring_fd_tag;
-#endif
+
+    /* Pending callback state for cqe handlers */
+    CqeHandlerSimpleQ cqe_handler_ready_list;
+#endif /* CONFIG_LINUX_IO_URING */
 
     /* TimerLists for calling timers - one per clock type.  Has its own
      * locking.
@@ -782,4 +827,40 @@ void aio_context_set_aio_params(AioContext *ctx, int64_t max_batch);
  */
 void aio_context_set_thread_pool_params(AioContext *ctx, int64_t min,
                                         int64_t max, Error **errp);
+
+#ifdef CONFIG_LINUX_IO_URING
+/**
+ * aio_has_io_uring: Return whether io_uring is available.
+ *
+ * io_uring is either available in all AioContexts or in none, so this only
+ * needs to be called once from within any thread's AioContext.
+ */
+static inline bool aio_has_io_uring(void)
+{
+    AioContext *ctx = qemu_get_current_aio_context();
+    return ctx->fdmon_ops->add_sqe;
+}
+
+/**
+ * aio_add_sqe: Add an io_uring sqe for submission.
+ * @prep_sqe: invoked with an sqe that should be prepared for submission
+ * @opaque: user-defined argument to @prep_sqe()
+ * @cqe_handler: the unique cqe handler associated with this request
+ *
+ * The caller's @prep_sqe() function is invoked to fill in the details of the
+ * sqe. Do not call io_uring_sqe_set_data() on this sqe.
+ *
+ * The sqe is submitted by the current AioContext. The kernel may see the sqe
+ * as soon as @prep_sqe() returns or it may take until the next event loop
+ * iteration.
+ *
+ * When the AioContext is destroyed, pending sqes are ignored and their
+ * CqeHandlers are not invoked.
+ *
+ * This function must be called only when aio_has_io_uring() returns true.
+ */
+void aio_add_sqe(void (*prep_sqe)(struct io_uring_sqe *sqe, void *opaque),
+                 void *opaque, CqeHandler *cqe_handler);
+#endif /* CONFIG_LINUX_IO_URING */
+
 #endif
diff --git a/util/aio-posix.c b/util/aio-posix.c
index 6ff36b6e51..e24b955fd9 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -806,3 +806,12 @@ void aio_context_set_aio_params(AioContext *ctx, int64_t max_batch)
 
     aio_notify(ctx);
 }
+
+#ifdef CONFIG_LINUX_IO_URING
+void aio_add_sqe(void (*prep_sqe)(struct io_uring_sqe *sqe, void *opaque),
+                 void *opaque, CqeHandler *cqe_handler)
+{
+    AioContext *ctx = qemu_get_current_aio_context();
+    ctx->fdmon_ops->add_sqe(ctx, prep_sqe, opaque, cqe_handler);
+}
+#endif /* CONFIG_LINUX_IO_URING */
diff --git a/util/aio-posix.h b/util/aio-posix.h
index dfa1a51c0b..babbfa8314 100644
--- a/util/aio-posix.h
+++ b/util/aio-posix.h
@@ -36,6 +36,7 @@ struct AioHandler {
 #ifdef CONFIG_LINUX_IO_URING
     QSLIST_ENTRY(AioHandler) node_submitted;
     unsigned flags; /* see fdmon-io_uring.c */
+    CqeHandler internal_cqe_handler; /* used for POLL_ADD/POLL_REMOVE */
 #endif
     int64_t poll_idle_timeout; /* when to stop userspace polling */
     bool poll_ready; /* has polling detected an event? */
diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index 6ee6adbebb..d0b56127c6 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -46,8 +46,10 @@
 #include "qemu/osdep.h"
 #include <poll.h>
 #include "qapi/error.h"
+#include "qemu/defer-call.h"
 #include "qemu/rcu_queue.h"
 #include "aio-posix.h"
+#include "trace.h"
 
 enum {
     FDMON_IO_URING_ENTRIES  = 128, /* sq/cq ring size */
@@ -76,8 +78,8 @@ static inline int pfd_events_from_poll(int poll_events)
 }
 
 /*
- * Returns an sqe for submitting a request.  Only be called within
- * fdmon_io_uring_wait().
+ * Returns an sqe for submitting a request. Only called from the AioContext
+ * thread.
  */
 static struct io_uring_sqe *get_sqe(AioContext *ctx)
 {
@@ -168,23 +170,46 @@ static void fdmon_io_uring_update(AioContext *ctx,
     }
 }
 
+static void fdmon_io_uring_add_sqe(AioContext *ctx,
+        void (*prep_sqe)(struct io_uring_sqe *sqe, void *opaque),
+        void *opaque, CqeHandler *cqe_handler)
+{
+    struct io_uring_sqe *sqe = get_sqe(ctx);
+
+    prep_sqe(sqe, opaque);
+    io_uring_sqe_set_data(sqe, cqe_handler);
+
+    trace_fdmon_io_uring_add_sqe(ctx, opaque, sqe->opcode, sqe->fd, sqe->off,
+                                 cqe_handler);
+}
+
+static void fdmon_special_cqe_handler(CqeHandler *cqe_handler)
+{
+    /*
+     * This is an empty function that is never called. It is used as a function
+     * pointer to distinguish it from ordinary cqe handlers.
+     */
+}
+
 static void add_poll_add_sqe(AioContext *ctx, AioHandler *node)
 {
     struct io_uring_sqe *sqe = get_sqe(ctx);
     int events = poll_events_from_pfd(node->pfd.events);
 
     io_uring_prep_poll_add(sqe, node->pfd.fd, events);
-    io_uring_sqe_set_data(sqe, node);
+    node->internal_cqe_handler.cb = fdmon_special_cqe_handler;
+    io_uring_sqe_set_data(sqe, &node->internal_cqe_handler);
 }
 
 static void add_poll_remove_sqe(AioContext *ctx, AioHandler *node)
 {
     struct io_uring_sqe *sqe = get_sqe(ctx);
+    CqeHandler *cqe_handler = &node->internal_cqe_handler;
 
 #ifdef LIBURING_HAVE_DATA64
-    io_uring_prep_poll_remove(sqe, (uintptr_t)node);
+    io_uring_prep_poll_remove(sqe, (uintptr_t)cqe_handler);
 #else
-    io_uring_prep_poll_remove(sqe, node);
+    io_uring_prep_poll_remove(sqe, cqe_handler);
 #endif
     io_uring_sqe_set_data(sqe, NULL);
 }
@@ -219,19 +244,13 @@ static void fill_sq_ring(AioContext *ctx)
     }
 }
 
-/* Returns true if a handler became ready */
-static bool process_cqe(AioContext *ctx,
-                        AioHandlerList *ready_list,
-                        struct io_uring_cqe *cqe)
+static bool process_cqe_aio_handler(AioContext *ctx,
+                                    AioHandlerList *ready_list,
+                                    AioHandler *node,
+                                    struct io_uring_cqe *cqe)
 {
-    AioHandler *node = io_uring_cqe_get_data(cqe);
     unsigned flags;
 
-    /* poll_timeout and poll_remove have a zero user_data field */
-    if (!node) {
-        return false;
-    }
-
     /*
      * Deletion can only happen when IORING_OP_POLL_ADD completes.  If we race
      * with enqueue() here then we can safely clear the FDMON_IO_URING_REMOVE
@@ -255,6 +274,35 @@ static bool process_cqe(AioContext *ctx,
     return true;
 }
 
+/* Returns true if a handler became ready */
+static bool process_cqe(AioContext *ctx,
+                        AioHandlerList *ready_list,
+                        struct io_uring_cqe *cqe)
+{
+    CqeHandler *cqe_handler = io_uring_cqe_get_data(cqe);
+
+    /* poll_timeout and poll_remove have a zero user_data field */
+    if (!cqe_handler) {
+        return false;
+    }
+
+    /*
+     * Special handling for AioHandler cqes. They need ready_list and have a
+     * return value.
+     */
+    if (cqe_handler->cb == fdmon_special_cqe_handler) {
+        AioHandler *node = container_of(cqe_handler, AioHandler,
+                                        internal_cqe_handler);
+        return process_cqe_aio_handler(ctx, ready_list, node, cqe);
+    }
+
+    cqe_handler->cqe = *cqe;
+
+    /* Handlers are invoked later by fdmon_io_uring_dispatch() */
+    QSIMPLEQ_INSERT_TAIL(&ctx->cqe_handler_ready_list, cqe_handler, next);
+    return false;
+}
+
 static int process_cq_ring(AioContext *ctx, AioHandlerList *ready_list)
 {
     struct io_uring *ring = &ctx->fdmon_io_uring;
@@ -299,6 +347,32 @@ static bool fdmon_io_uring_gsource_check(AioContext *ctx)
     return g_source_query_unix_fd(&ctx->source, tag) & G_IO_IN;
 }
 
+/* Dispatch CQE handlers that are ready */
+static bool fdmon_io_uring_dispatch(AioContext *ctx)
+{
+    CqeHandlerSimpleQ *ready_list = &ctx->cqe_handler_ready_list;
+    bool progress = false;
+
+    /* Handlers may use defer_call() to coalesce frequent operations */
+    defer_call_begin();
+
+    while (!QSIMPLEQ_EMPTY(ready_list)) {
+        CqeHandler *cqe_handler = QSIMPLEQ_FIRST(ready_list);
+
+        QSIMPLEQ_REMOVE_HEAD(ready_list, next);
+
+        trace_fdmon_io_uring_cqe_handler(ctx, cqe_handler,
+                                         cqe_handler->cqe.res);
+        cqe_handler->cb(cqe_handler);
+        progress = true;
+    }
+
+    defer_call_end();
+
+    return progress;
+}
+
+
 /* This is where CQEs are processed in the glib event loop */
 static void fdmon_io_uring_gsource_dispatch(AioContext *ctx,
                                             AioHandlerList *ready_list)
@@ -371,9 +445,11 @@ static const FDMonOps fdmon_io_uring_ops = {
     .update = fdmon_io_uring_update,
     .wait = fdmon_io_uring_wait,
     .need_wait = fdmon_io_uring_need_wait,
+    .dispatch = fdmon_io_uring_dispatch,
     .gsource_prepare = fdmon_io_uring_gsource_prepare,
     .gsource_check = fdmon_io_uring_gsource_check,
     .gsource_dispatch = fdmon_io_uring_gsource_dispatch,
+    .add_sqe = fdmon_io_uring_add_sqe,
 };
 
 bool fdmon_io_uring_setup(AioContext *ctx, Error **errp)
@@ -389,6 +465,7 @@ bool fdmon_io_uring_setup(AioContext *ctx, Error **errp)
     }
 
     QSLIST_INIT(&ctx->submit_list);
+    QSIMPLEQ_INIT(&ctx->cqe_handler_ready_list);
     ctx->fdmon_ops = &fdmon_io_uring_ops;
     ctx->io_uring_fd_tag = g_source_add_unix_fd(&ctx->source,
             ctx->fdmon_io_uring.ring_fd, G_IO_IN);
@@ -425,6 +502,8 @@ void fdmon_io_uring_destroy(AioContext *ctx)
     g_source_remove_unix_fd(&ctx->source, ctx->io_uring_fd_tag);
     ctx->io_uring_fd_tag = NULL;
 
+    assert(QSIMPLEQ_EMPTY(&ctx->cqe_handler_ready_list));
+
     qemu_lockcnt_lock(&ctx->list_lock);
     fdmon_poll_downgrade(ctx);
     qemu_lockcnt_unlock(&ctx->list_lock);
diff --git a/util/trace-events b/util/trace-events
index bd8f25fb59..540d662507 100644
--- a/util/trace-events
+++ b/util/trace-events
@@ -24,6 +24,10 @@ buffer_move_empty(const char *buf, size_t len, const char *from) "%s: %zd bytes
 buffer_move(const char *buf, size_t len, const char *from) "%s: %zd bytes from %s"
 buffer_free(const char *buf, size_t len) "%s: capacity %zd"
 
+# fdmon-io_uring.c
+fdmon_io_uring_add_sqe(void *ctx, void *opaque, int opcode, int fd, uint64_t off, void *cqe_handler) "ctx %p opaque %p opcode %d fd %d off %"PRId64" cqe_handler %p"
+fdmon_io_uring_cqe_handler(void *ctx, void *cqe_handler, int cqe_res) "ctx %p cqe_handler %p cqe_res %d"
+
 # filemonitor-inotify.c
 qemu_file_monitor_add_watch(void *mon, const char *dirpath, const char *filename, void *cb, void *opaque, int64_t id) "File monitor %p add watch dir='%s' file='%s' cb=%p opaque=%p id=%" PRId64
 qemu_file_monitor_remove_watch(void *mon, const char *dirpath, int64_t id) "File monitor %p remove watch dir='%s' id=%" PRId64

From 047dabef97bd0c4af3c3dc453b19e20345de3602 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:32 -0500
Subject: [PATCH 2090/2396] block/io_uring: use aio_add_sqe()

AioContext has its own io_uring instance for file descriptor monitoring.
The disk I/O io_uring code was developed separately. Originally I
thought the characteristics of file descriptor monitoring and disk I/O
were too different, requiring separate io_uring instances.

Now it has become clear to me that it's feasible to share a single
io_uring instance for file descriptor monitoring and disk I/O. We're not
using io_uring's IOPOLL feature or anything else that would require a
separate instance.

Unify block/io_uring.c and util/fdmon-io_uring.c using the new
aio_add_sqe() API that allows user-defined io_uring sqe submission. Now
block/io_uring.c just needs to submit readv/writev/fsync and most of the
io_uring-specific logic is handled by fdmon-io_uring.c.

There are two immediate advantages:
1. Fewer system calls. There is no need to monitor the disk I/O io_uring
   ring fd from the file descriptor monitoring io_uring instance. Disk
   I/O completions are now picked up directly. Also, sqes are
   accumulated in the sq ring until the end of the event loop iteration
   and there are fewer io_uring_enter(2) syscalls.
2. Less code duplication.

Note that error_setg() messages are not supposed to end with
punctuation, so I removed a '.' for the non-io_uring build error
message.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251104022933.618123-15-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c      |  40 ++--
 block/io_uring.c        | 489 ++++++++++------------------------------
 block/trace-events      |  12 +-
 include/block/aio.h     |   7 -
 include/block/raw-aio.h |   5 -
 stubs/io_uring.c        |  32 ---
 stubs/meson.build       |   3 -
 util/async.c            |  35 ---
 8 files changed, 130 insertions(+), 493 deletions(-)
 delete mode 100644 stubs/io_uring.c

diff --git a/block/file-posix.c b/block/file-posix.c
index 8c738674ce..8b7c02d19a 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -755,14 +755,23 @@ static int raw_open_common(BlockDriverState *bs, QDict *options,
     }
 #endif /* !defined(CONFIG_LINUX_AIO) */
 
-#ifndef CONFIG_LINUX_IO_URING
     if (s->use_linux_io_uring) {
+#ifdef CONFIG_LINUX_IO_URING
+        if (!aio_has_io_uring()) {
+            error_setg(errp, "aio=io_uring was specified, but is not "
+                             "available (disabled via io_uring_disabled "
+                             "sysctl or blocked by container runtime "
+                             "seccomp policy?)");
+            ret = -EINVAL;
+            goto fail;
+        }
+#else
         error_setg(errp, "aio=io_uring was specified, but is not supported "
-                         "in this build.");
+                         "in this build");
         ret = -EINVAL;
         goto fail;
-    }
 #endif /* !defined(CONFIG_LINUX_IO_URING) */
+    }
 
     s->has_discard = true;
     s->has_write_zeroes = true;
@@ -2522,27 +2531,6 @@ static bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
     return true;
 }
 
-#ifdef CONFIG_LINUX_IO_URING
-static inline bool raw_check_linux_io_uring(BDRVRawState *s)
-{
-    Error *local_err = NULL;
-    AioContext *ctx;
-
-    if (!s->use_linux_io_uring) {
-        return false;
-    }
-
-    ctx = qemu_get_current_aio_context();
-    if (unlikely(!aio_setup_linux_io_uring(ctx, &local_err))) {
-        error_reportf_err(local_err, "Unable to use linux io_uring, "
-                                     "falling back to thread pool: ");
-        s->use_linux_io_uring = false;
-        return false;
-    }
-    return true;
-}
-#endif
-
 #ifdef CONFIG_LINUX_AIO
 static inline bool raw_check_linux_aio(BDRVRawState *s)
 {
@@ -2595,7 +2583,7 @@ raw_co_prw(BlockDriverState *bs, int64_t *offset_ptr, uint64_t bytes,
     if (s->needs_alignment && !bdrv_qiov_is_aligned(bs, qiov)) {
         type |= QEMU_AIO_MISALIGNED;
 #ifdef CONFIG_LINUX_IO_URING
-    } else if (raw_check_linux_io_uring(s)) {
+    } else if (s->use_linux_io_uring) {
         assert(qiov->size == bytes);
         ret = luring_co_submit(bs, s->fd, offset, qiov, type, flags);
         goto out;
@@ -2692,7 +2680,7 @@ static int coroutine_fn raw_co_flush_to_disk(BlockDriverState *bs)
     };
 
 #ifdef CONFIG_LINUX_IO_URING
-    if (raw_check_linux_io_uring(s)) {
+    if (s->use_linux_io_uring) {
         return luring_co_submit(bs, s->fd, 0, NULL, QEMU_AIO_FLUSH, 0);
     }
 #endif
diff --git a/block/io_uring.c b/block/io_uring.c
index dd4f304910..dd930ee57e 100644
--- a/block/io_uring.c
+++ b/block/io_uring.c
@@ -11,28 +11,20 @@
 #include "qemu/osdep.h"
 #include <liburing.h>
 #include "block/aio.h"
-#include "qemu/queue.h"
 #include "block/block.h"
 #include "block/raw-aio.h"
 #include "qemu/coroutine.h"
-#include "qemu/defer-call.h"
-#include "qapi/error.h"
 #include "system/block-backend.h"
 #include "trace.h"
 
-/* Only used for assertions.  */
-#include "qemu/coroutine_int.h"
-
-/* io_uring ring size */
-#define MAX_ENTRIES 128
-
-typedef struct LuringAIOCB {
+typedef struct {
     Coroutine *co;
-    struct io_uring_sqe sqeq;
-    ssize_t ret;
     QEMUIOVector *qiov;
-    bool is_read;
-    QSIMPLEQ_ENTRY(LuringAIOCB) next;
+    uint64_t offset;
+    ssize_t ret;
+    int type;
+    int fd;
+    BdrvRequestFlags flags;
 
     /*
      * Buffered reads may require resubmission, see
@@ -40,36 +32,51 @@ typedef struct LuringAIOCB {
      */
     int total_read;
     QEMUIOVector resubmit_qiov;
-} LuringAIOCB;
 
-typedef struct LuringQueue {
-    unsigned int in_queue;
-    unsigned int in_flight;
-    bool blocked;
-    QSIMPLEQ_HEAD(, LuringAIOCB) submit_queue;
-} LuringQueue;
+    CqeHandler cqe_handler;
+} LuringRequest;
 
-struct LuringState {
-    AioContext *aio_context;
-
-    struct io_uring ring;
-
-    /* No locking required, only accessed from AioContext home thread */
-    LuringQueue io_q;
-
-    QEMUBH *completion_bh;
-};
-
-/**
- * luring_resubmit:
- *
- * Resubmit a request by appending it to submit_queue.  The caller must ensure
- * that ioq_submit() is called later so that submit_queue requests are started.
- */
-static void luring_resubmit(LuringState *s, LuringAIOCB *luringcb)
+static void luring_prep_sqe(struct io_uring_sqe *sqe, void *opaque)
 {
-    QSIMPLEQ_INSERT_TAIL(&s->io_q.submit_queue, luringcb, next);
-    s->io_q.in_queue++;
+    LuringRequest *req = opaque;
+    QEMUIOVector *qiov = req->qiov;
+    uint64_t offset = req->offset;
+    int fd = req->fd;
+    BdrvRequestFlags flags = req->flags;
+
+    switch (req->type) {
+    case QEMU_AIO_WRITE:
+#ifdef HAVE_IO_URING_PREP_WRITEV2
+    {
+        int luring_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
+        io_uring_prep_writev2(sqe, fd, qiov->iov,
+                              qiov->niov, offset, luring_flags);
+    }
+#else
+        assert(flags == 0);
+        io_uring_prep_writev(sqe, fd, qiov->iov, qiov->niov, offset);
+#endif
+        break;
+    case QEMU_AIO_ZONE_APPEND:
+        io_uring_prep_writev(sqe, fd, qiov->iov, qiov->niov, offset);
+        break;
+    case QEMU_AIO_READ:
+    {
+        if (req->resubmit_qiov.iov != NULL) {
+            qiov = &req->resubmit_qiov;
+        }
+        io_uring_prep_readv(sqe, fd, qiov->iov, qiov->niov,
+                            offset + req->total_read);
+        break;
+    }
+    case QEMU_AIO_FLUSH:
+        io_uring_prep_fsync(sqe, fd, IORING_FSYNC_DATASYNC);
+        break;
+    default:
+        fprintf(stderr, "%s: invalid AIO request type, aborting 0x%x.\n",
+                        __func__, req->type);
+        abort();
+    }
 }
 
 /**
@@ -78,385 +85,115 @@ static void luring_resubmit(LuringState *s, LuringAIOCB *luringcb)
  * Short reads are rare but may occur. The remaining read request needs to be
  * resubmitted.
  */
-static void luring_resubmit_short_read(LuringState *s, LuringAIOCB *luringcb,
-                                       int nread)
+static void luring_resubmit_short_read(LuringRequest *req, int nread)
 {
     QEMUIOVector *resubmit_qiov;
     size_t remaining;
 
-    trace_luring_resubmit_short_read(s, luringcb, nread);
+    trace_luring_resubmit_short_read(req, nread);
 
     /* Update read position */
-    luringcb->total_read += nread;
-    remaining = luringcb->qiov->size - luringcb->total_read;
+    req->total_read += nread;
+    remaining = req->qiov->size - req->total_read;
 
     /* Shorten qiov */
-    resubmit_qiov = &luringcb->resubmit_qiov;
+    resubmit_qiov = &req->resubmit_qiov;
     if (resubmit_qiov->iov == NULL) {
-        qemu_iovec_init(resubmit_qiov, luringcb->qiov->niov);
+        qemu_iovec_init(resubmit_qiov, req->qiov->niov);
     } else {
         qemu_iovec_reset(resubmit_qiov);
     }
-    qemu_iovec_concat(resubmit_qiov, luringcb->qiov, luringcb->total_read,
-                      remaining);
+    qemu_iovec_concat(resubmit_qiov, req->qiov, req->total_read, remaining);
 
-    /* Update sqe */
-    luringcb->sqeq.off += nread;
-    luringcb->sqeq.addr = (uintptr_t)luringcb->resubmit_qiov.iov;
-    luringcb->sqeq.len = luringcb->resubmit_qiov.niov;
-
-    luring_resubmit(s, luringcb);
+    aio_add_sqe(luring_prep_sqe, req, &req->cqe_handler);
 }
 
-/**
- * luring_process_completions:
- * @s: AIO state
- *
- * Fetches completed I/O requests, consumes cqes and invokes their callbacks
- * The function is somewhat tricky because it supports nested event loops, for
- * example when a request callback invokes aio_poll().
- *
- * Function schedules BH completion so it  can be called again in a nested
- * event loop.  When there are no events left  to complete the BH is being
- * canceled.
- *
- */
-static void luring_process_completions(LuringState *s)
+static void luring_cqe_handler(CqeHandler *cqe_handler)
 {
-    struct io_uring_cqe *cqes;
-    int total_bytes;
+    LuringRequest *req = container_of(cqe_handler, LuringRequest, cqe_handler);
+    int ret = cqe_handler->cqe.res;
 
-    defer_call_begin();
+    trace_luring_cqe_handler(req, ret);
 
-    /*
-     * Request completion callbacks can run the nested event loop.
-     * Schedule ourselves so the nested event loop will "see" remaining
-     * completed requests and process them.  Without this, completion
-     * callbacks that wait for other requests using a nested event loop
-     * would hang forever.
-     *
-     * This workaround is needed because io_uring uses poll_wait, which
-     * is woken up when new events are added to the uring, thus polling on
-     * the same uring fd will block unless more events are received.
-     *
-     * Other leaf block drivers (drivers that access the data themselves)
-     * are networking based, so they poll sockets for data and run the
-     * correct coroutine.
-     */
-    qemu_bh_schedule(s->completion_bh);
-
-    while (io_uring_peek_cqe(&s->ring, &cqes) == 0) {
-        LuringAIOCB *luringcb;
-        int ret;
-
-        if (!cqes) {
-            break;
+    if (ret < 0) {
+        /*
+         * Only writev/readv/fsync requests on regular files or host block
+         * devices are submitted. Therefore -EAGAIN is not expected but it's
+         * known to happen sometimes with Linux SCSI. Submit again and hope
+         * the request completes successfully.
+         *
+         * For more information, see:
+         * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
+         *
+         * If the code is changed to submit other types of requests in the
+         * future, then this workaround may need to be extended to deal with
+         * genuine -EAGAIN results that should not be resubmitted
+         * immediately.
+         */
+        if (ret == -EINTR || ret == -EAGAIN) {
+            aio_add_sqe(luring_prep_sqe, req, &req->cqe_handler);
+            return;
         }
-
-        luringcb = io_uring_cqe_get_data(cqes);
-        ret = cqes->res;
-        io_uring_cqe_seen(&s->ring, cqes);
-        cqes = NULL;
-
-        /* Change counters one-by-one because we can be nested. */
-        s->io_q.in_flight--;
-        trace_luring_process_completion(s, luringcb, ret);
-
+    } else if (req->qiov) {
         /* total_read is non-zero only for resubmitted read requests */
-        total_bytes = ret + luringcb->total_read;
+        int total_bytes = ret + req->total_read;
 
-        if (ret < 0) {
-            /*
-             * Only writev/readv/fsync requests on regular files or host block
-             * devices are submitted. Therefore -EAGAIN is not expected but it's
-             * known to happen sometimes with Linux SCSI. Submit again and hope
-             * the request completes successfully.
-             *
-             * For more information, see:
-             * https://lore.kernel.org/io-uring/20210727165811.284510-3-axboe@kernel.dk/T/#u
-             *
-             * If the code is changed to submit other types of requests in the
-             * future, then this workaround may need to be extended to deal with
-             * genuine -EAGAIN results that should not be resubmitted
-             * immediately.
-             */
-            if (ret == -EINTR || ret == -EAGAIN) {
-                luring_resubmit(s, luringcb);
-                continue;
-            }
-        } else if (!luringcb->qiov) {
-            goto end;
-        } else if (total_bytes == luringcb->qiov->size) {
+        if (total_bytes == req->qiov->size) {
             ret = 0;
-        /* Only read/write */
         } else {
             /* Short Read/Write */
-            if (luringcb->is_read) {
+            if (req->type == QEMU_AIO_READ) {
                 if (ret > 0) {
-                    luring_resubmit_short_read(s, luringcb, ret);
-                    continue;
-                } else {
-                    /* Pad with zeroes */
-                    qemu_iovec_memset(luringcb->qiov, total_bytes, 0,
-                                      luringcb->qiov->size - total_bytes);
-                    ret = 0;
+                    luring_resubmit_short_read(req, ret);
+                    return;
                 }
+
+                /* Pad with zeroes */
+                qemu_iovec_memset(req->qiov, total_bytes, 0,
+                                  req->qiov->size - total_bytes);
+                ret = 0;
             } else {
                 ret = -ENOSPC;
             }
         }
-end:
-        luringcb->ret = ret;
-        qemu_iovec_destroy(&luringcb->resubmit_qiov);
-
-        /*
-         * If the coroutine is already entered it must be in ioq_submit()
-         * and will notice luringcb->ret has been filled in when it
-         * eventually runs later. Coroutines cannot be entered recursively
-         * so avoid doing that!
-         */
-        assert(luringcb->co->ctx == s->aio_context);
-        if (!qemu_coroutine_entered(luringcb->co)) {
-            aio_co_wake(luringcb->co);
-        }
     }
 
-    qemu_bh_cancel(s->completion_bh);
+    req->ret = ret;
+    qemu_iovec_destroy(&req->resubmit_qiov);
 
-    defer_call_end();
-}
-
-static int ioq_submit(LuringState *s)
-{
-    int ret = 0;
-    LuringAIOCB *luringcb, *luringcb_next;
-
-    while (s->io_q.in_queue > 0) {
-        /*
-         * Try to fetch sqes from the ring for requests waiting in
-         * the overflow queue
-         */
-        QSIMPLEQ_FOREACH_SAFE(luringcb, &s->io_q.submit_queue, next,
-                              luringcb_next) {
-            struct io_uring_sqe *sqes = io_uring_get_sqe(&s->ring);
-            if (!sqes) {
-                break;
-            }
-            /* Prep sqe for submission */
-            *sqes = luringcb->sqeq;
-            QSIMPLEQ_REMOVE_HEAD(&s->io_q.submit_queue, next);
-        }
-        ret = io_uring_submit(&s->ring);
-        trace_luring_io_uring_submit(s, ret);
-        /* Prevent infinite loop if submission is refused */
-        if (ret <= 0) {
-            if (ret == -EAGAIN || ret == -EINTR) {
-                continue;
-            }
-            break;
-        }
-        s->io_q.in_flight += ret;
-        s->io_q.in_queue  -= ret;
-    }
-    s->io_q.blocked = (s->io_q.in_queue > 0);
-
-    if (s->io_q.in_flight) {
-        /*
-         * We can try to complete something just right away if there are
-         * still requests in-flight.
-         */
-        luring_process_completions(s);
-    }
-    return ret;
-}
-
-static void luring_process_completions_and_submit(LuringState *s)
-{
-    luring_process_completions(s);
-
-    if (s->io_q.in_queue > 0) {
-        ioq_submit(s);
+    /*
+     * If the coroutine is already entered it must be in luring_co_submit() and
+     * will notice req->ret has been filled in when it eventually runs later.
+     * Coroutines cannot be entered recursively so avoid doing that!
+     */
+    if (!qemu_coroutine_entered(req->co)) {
+        aio_co_wake(req->co);
     }
 }
 
-static void qemu_luring_completion_bh(void *opaque)
+int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd,
+                                  uint64_t offset, QEMUIOVector *qiov,
+                                  int type, BdrvRequestFlags flags)
 {
-    LuringState *s = opaque;
-    luring_process_completions_and_submit(s);
-}
-
-static void qemu_luring_completion_cb(void *opaque)
-{
-    LuringState *s = opaque;
-    luring_process_completions_and_submit(s);
-}
-
-static bool qemu_luring_poll_cb(void *opaque)
-{
-    LuringState *s = opaque;
-
-    return io_uring_cq_ready(&s->ring);
-}
-
-static void qemu_luring_poll_ready(void *opaque)
-{
-    LuringState *s = opaque;
-
-    luring_process_completions_and_submit(s);
-}
-
-static void ioq_init(LuringQueue *io_q)
-{
-    QSIMPLEQ_INIT(&io_q->submit_queue);
-    io_q->in_queue = 0;
-    io_q->in_flight = 0;
-    io_q->blocked = false;
-}
-
-static void luring_deferred_fn(void *opaque)
-{
-    LuringState *s = opaque;
-    trace_luring_unplug_fn(s, s->io_q.blocked, s->io_q.in_queue,
-                           s->io_q.in_flight);
-    if (!s->io_q.blocked && s->io_q.in_queue > 0) {
-        ioq_submit(s);
-    }
-}
-
-/**
- * luring_do_submit:
- * @fd: file descriptor for I/O
- * @luringcb: AIO control block
- * @s: AIO state
- * @offset: offset for request
- * @type: type of request
- *
- * Fetches sqes from ring, adds to pending queue and preps them
- *
- */
-static int luring_do_submit(int fd, LuringAIOCB *luringcb, LuringState *s,
-                            uint64_t offset, int type, BdrvRequestFlags flags)
-{
-    int ret;
-    struct io_uring_sqe *sqes = &luringcb->sqeq;
-
-    switch (type) {
-    case QEMU_AIO_WRITE:
-#ifdef HAVE_IO_URING_PREP_WRITEV2
-    {
-        int luring_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
-        io_uring_prep_writev2(sqes, fd, luringcb->qiov->iov,
-                              luringcb->qiov->niov, offset, luring_flags);
-    }
-#else
-        assert(flags == 0);
-        io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
-                             luringcb->qiov->niov, offset);
-#endif
-        break;
-    case QEMU_AIO_ZONE_APPEND:
-        io_uring_prep_writev(sqes, fd, luringcb->qiov->iov,
-                             luringcb->qiov->niov, offset);
-        break;
-    case QEMU_AIO_READ:
-        io_uring_prep_readv(sqes, fd, luringcb->qiov->iov,
-                            luringcb->qiov->niov, offset);
-        break;
-    case QEMU_AIO_FLUSH:
-        io_uring_prep_fsync(sqes, fd, IORING_FSYNC_DATASYNC);
-        break;
-    default:
-        fprintf(stderr, "%s: invalid AIO request type, aborting 0x%x.\n",
-                        __func__, type);
-        abort();
-    }
-    io_uring_sqe_set_data(sqes, luringcb);
-
-    QSIMPLEQ_INSERT_TAIL(&s->io_q.submit_queue, luringcb, next);
-    s->io_q.in_queue++;
-    trace_luring_do_submit(s, s->io_q.blocked, s->io_q.in_queue,
-                           s->io_q.in_flight);
-    if (!s->io_q.blocked) {
-        if (s->io_q.in_flight + s->io_q.in_queue >= MAX_ENTRIES) {
-            ret = ioq_submit(s);
-            trace_luring_do_submit_done(s, ret);
-            return ret;
-        }
-
-        defer_call(luring_deferred_fn, s);
-    }
-    return 0;
-}
-
-int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
-                                  QEMUIOVector *qiov, int type,
-                                  BdrvRequestFlags flags)
-{
-    int ret;
-    AioContext *ctx = qemu_get_current_aio_context();
-    LuringState *s = aio_get_linux_io_uring(ctx);
-    LuringAIOCB luringcb = {
+    LuringRequest req = {
         .co         = qemu_coroutine_self(),
-        .ret        = -EINPROGRESS,
         .qiov       = qiov,
-        .is_read    = (type == QEMU_AIO_READ),
+        .ret        = -EINPROGRESS,
+        .type       = type,
+        .fd         = fd,
+        .offset     = offset,
+        .flags      = flags,
     };
-    trace_luring_co_submit(bs, s, &luringcb, fd, offset, qiov ? qiov->size : 0,
-                           type);
-    ret = luring_do_submit(fd, &luringcb, s, offset, type, flags);
 
-    if (ret < 0) {
-        return ret;
-    }
+    req.cqe_handler.cb = luring_cqe_handler;
 
-    if (luringcb.ret == -EINPROGRESS) {
+    trace_luring_co_submit(bs, &req, fd, offset, qiov ? qiov->size : 0, type);
+    aio_add_sqe(luring_prep_sqe, &req, &req.cqe_handler);
+
+    if (req.ret == -EINPROGRESS) {
         qemu_coroutine_yield();
     }
-    return luringcb.ret;
-}
-
-void luring_detach_aio_context(LuringState *s, AioContext *old_context)
-{
-    aio_set_fd_handler(old_context, s->ring.ring_fd,
-                       NULL, NULL, NULL, NULL, s);
-    qemu_bh_delete(s->completion_bh);
-    s->aio_context = NULL;
-}
-
-void luring_attach_aio_context(LuringState *s, AioContext *new_context)
-{
-    s->aio_context = new_context;
-    s->completion_bh = aio_bh_new(new_context, qemu_luring_completion_bh, s);
-    aio_set_fd_handler(s->aio_context, s->ring.ring_fd,
-                       qemu_luring_completion_cb, NULL,
-                       qemu_luring_poll_cb, qemu_luring_poll_ready, s);
-}
-
-LuringState *luring_init(Error **errp)
-{
-    int rc;
-    LuringState *s = g_new0(LuringState, 1);
-    struct io_uring *ring = &s->ring;
-
-    trace_luring_init_state(s, sizeof(*s));
-
-    rc = io_uring_queue_init(MAX_ENTRIES, ring, 0);
-    if (rc < 0) {
-        error_setg_errno(errp, -rc, "failed to init linux io_uring ring");
-        g_free(s);
-        return NULL;
-    }
-
-    ioq_init(&s->io_q);
-    return s;
-
-}
-
-void luring_cleanup(LuringState *s)
-{
-    io_uring_queue_exit(&s->ring);
-    trace_luring_cleanup_state(s);
-    g_free(s);
+    return req.ret;
 }
 
 bool luring_has_fua(void)
diff --git a/block/trace-events b/block/trace-events
index 8e789e1f12..c9b4736ff8 100644
--- a/block/trace-events
+++ b/block/trace-events
@@ -62,15 +62,9 @@ qmp_block_stream(void *bs) "bs %p"
 file_paio_submit(void *acb, void *opaque, int64_t offset, int count, int type) "acb %p opaque %p offset %"PRId64" count %d type %d"
 
 # io_uring.c
-luring_init_state(void *s, size_t size) "s %p size %zu"
-luring_cleanup_state(void *s) "%p freed"
-luring_unplug_fn(void *s, int blocked, int queued, int inflight) "LuringState %p blocked %d queued %d inflight %d"
-luring_do_submit(void *s, int blocked, int queued, int inflight) "LuringState %p blocked %d queued %d inflight %d"
-luring_do_submit_done(void *s, int ret) "LuringState %p submitted to kernel %d"
-luring_co_submit(void *bs, void *s, void *luringcb, int fd, uint64_t offset, size_t nbytes, int type) "bs %p s %p luringcb %p fd %d offset %" PRId64 " nbytes %zd type %d"
-luring_process_completion(void *s, void *aiocb, int ret) "LuringState %p luringcb %p ret %d"
-luring_io_uring_submit(void *s, int ret) "LuringState %p ret %d"
-luring_resubmit_short_read(void *s, void *luringcb, int nread) "LuringState %p luringcb %p nread %d"
+luring_cqe_handler(void *req, int ret) "req %p ret %d"
+luring_co_submit(void *bs, void *req, int fd, uint64_t offset, size_t nbytes, int type) "bs %p req %p fd %d offset %" PRId64 " nbytes %zd type %d"
+luring_resubmit_short_read(void *req, int nread) "req %p nread %d"
 
 # qcow2.c
 qcow2_add_task(void *co, void *bs, void *pool, const char *action, int cluster_type, uint64_t host_offset, uint64_t offset, uint64_t bytes, void *qiov, size_t qiov_offset) "co %p bs %p pool %p: %s: cluster_type %d file_cluster_offset %" PRIu64 " offset %" PRIu64 " bytes %" PRIu64 " qiov %p qiov_offset %zu"
diff --git a/include/block/aio.h b/include/block/aio.h
index 0f77ae2f64..f38b584ac7 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -310,8 +310,6 @@ struct AioContext {
     struct LinuxAioState *linux_aio;
 #endif
 #ifdef CONFIG_LINUX_IO_URING
-    LuringState *linux_io_uring;
-
     /* State for file descriptor monitoring using Linux io_uring */
     struct io_uring fdmon_io_uring;
     AioHandlerSList submit_list;
@@ -615,11 +613,6 @@ struct LinuxAioState *aio_setup_linux_aio(AioContext *ctx, Error **errp);
 /* Return the LinuxAioState bound to this AioContext */
 struct LinuxAioState *aio_get_linux_aio(AioContext *ctx);
 
-/* Setup the LuringState bound to this AioContext */
-LuringState *aio_setup_linux_io_uring(AioContext *ctx, Error **errp);
-
-/* Return the LuringState bound to this AioContext */
-LuringState *aio_get_linux_io_uring(AioContext *ctx);
 /**
  * aio_timer_new_with_attrs:
  * @ctx: the aio context
diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
index 6570244496..30e5fc9a9f 100644
--- a/include/block/raw-aio.h
+++ b/include/block/raw-aio.h
@@ -74,15 +74,10 @@ static inline bool laio_has_fua(void)
 #endif
 /* io_uring.c - Linux io_uring implementation */
 #ifdef CONFIG_LINUX_IO_URING
-LuringState *luring_init(Error **errp);
-void luring_cleanup(LuringState *s);
-
 /* luring_co_submit: submit I/O requests in the thread's current AioContext. */
 int coroutine_fn luring_co_submit(BlockDriverState *bs, int fd, uint64_t offset,
                                   QEMUIOVector *qiov, int type,
                                   BdrvRequestFlags flags);
-void luring_detach_aio_context(LuringState *s, AioContext *old_context);
-void luring_attach_aio_context(LuringState *s, AioContext *new_context);
 bool luring_has_fua(void);
 #else
 static inline bool luring_has_fua(void)
diff --git a/stubs/io_uring.c b/stubs/io_uring.c
deleted file mode 100644
index 622d1e4648..0000000000
--- a/stubs/io_uring.c
+++ /dev/null
@@ -1,32 +0,0 @@
-/*
- * Linux io_uring support.
- *
- * Copyright (C) 2009 IBM, Corp.
- * Copyright (C) 2009 Red Hat, Inc.
- *
- * This work is licensed under the terms of the GNU GPL, version 2 or later.
- * See the COPYING file in the top-level directory.
- */
-#include "qemu/osdep.h"
-#include "block/aio.h"
-#include "block/raw-aio.h"
-
-void luring_detach_aio_context(LuringState *s, AioContext *old_context)
-{
-    abort();
-}
-
-void luring_attach_aio_context(LuringState *s, AioContext *new_context)
-{
-    abort();
-}
-
-LuringState *luring_init(Error **errp)
-{
-    abort();
-}
-
-void luring_cleanup(LuringState *s)
-{
-    abort();
-}
diff --git a/stubs/meson.build b/stubs/meson.build
index 27be2dec9f..0b2778c568 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -32,9 +32,6 @@ if have_block or have_ga
   stub_ss.add(files('cpus-virtual-clock.c'))
   stub_ss.add(files('icount.c'))
   stub_ss.add(files('graph-lock.c'))
-  if linux_io_uring.found()
-    stub_ss.add(files('io_uring.c'))
-  endif
   if libaio.found()
     stub_ss.add(files('linux-aio.c'))
   endif
diff --git a/util/async.c b/util/async.c
index 7030047cfb..48f8828636 100644
--- a/util/async.c
+++ b/util/async.c
@@ -386,14 +386,6 @@ aio_ctx_finalize(GSource *source)
     }
 #endif
 
-#ifdef CONFIG_LINUX_IO_URING
-    if (ctx->linux_io_uring) {
-        luring_detach_aio_context(ctx->linux_io_uring, ctx);
-        luring_cleanup(ctx->linux_io_uring);
-        ctx->linux_io_uring = NULL;
-    }
-#endif
-
     assert(QSLIST_EMPTY(&ctx->scheduled_coroutines));
     qemu_bh_delete(ctx->co_schedule_bh);
 
@@ -469,29 +461,6 @@ LinuxAioState *aio_get_linux_aio(AioContext *ctx)
 }
 #endif
 
-#ifdef CONFIG_LINUX_IO_URING
-LuringState *aio_setup_linux_io_uring(AioContext *ctx, Error **errp)
-{
-    if (ctx->linux_io_uring) {
-        return ctx->linux_io_uring;
-    }
-
-    ctx->linux_io_uring = luring_init(errp);
-    if (!ctx->linux_io_uring) {
-        return NULL;
-    }
-
-    luring_attach_aio_context(ctx->linux_io_uring, ctx);
-    return ctx->linux_io_uring;
-}
-
-LuringState *aio_get_linux_io_uring(AioContext *ctx)
-{
-    assert(ctx->linux_io_uring);
-    return ctx->linux_io_uring;
-}
-#endif
-
 void aio_notify(AioContext *ctx)
 {
     /*
@@ -631,10 +600,6 @@ AioContext *aio_context_new(Error **errp)
     ctx->linux_aio = NULL;
 #endif
 
-#ifdef CONFIG_LINUX_IO_URING
-    ctx->linux_io_uring = NULL;
-#endif
-
     ctx->thread_pool = NULL;
     qemu_rec_mutex_init(&ctx->lock);
     timerlistgroup_init(&ctx->tlg, aio_timerlist_notify, ctx);

From 684363fa3bbd78556aa24144195319e19c5602e4 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Mon, 3 Nov 2025 21:29:33 -0500
Subject: [PATCH 2091/2396] block/io_uring: use non-vectored read/write when
 possible

The io_uring_prep_readv2/writev2() man pages recommend using the
non-vectored read/write operations when possible for performance
reasons.

I didn't measure a significant difference but it doesn't hurt to have
this optimization in place.

Suggested-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251104022933.618123-16-stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io_uring.c | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/block/io_uring.c b/block/io_uring.c
index dd930ee57e..f1514cf024 100644
--- a/block/io_uring.c
+++ b/block/io_uring.c
@@ -46,17 +46,28 @@ static void luring_prep_sqe(struct io_uring_sqe *sqe, void *opaque)
 
     switch (req->type) {
     case QEMU_AIO_WRITE:
-#ifdef HAVE_IO_URING_PREP_WRITEV2
     {
         int luring_flags = (flags & BDRV_REQ_FUA) ? RWF_DSYNC : 0;
-        io_uring_prep_writev2(sqe, fd, qiov->iov,
-                              qiov->niov, offset, luring_flags);
-    }
+        if (luring_flags != 0 || qiov->niov > 1) {
+#ifdef HAVE_IO_URING_PREP_WRITEV2
+            io_uring_prep_writev2(sqe, fd, qiov->iov,
+                                  qiov->niov, offset, luring_flags);
 #else
-        assert(flags == 0);
-        io_uring_prep_writev(sqe, fd, qiov->iov, qiov->niov, offset);
+            /*
+             * FUA should only be enabled with HAVE_IO_URING_PREP_WRITEV2, see
+             * luring_has_fua().
+             */
+            assert(luring_flags == 0);
+
+            io_uring_prep_writev(sqe, fd, qiov->iov, qiov->niov, offset);
 #endif
+        } else {
+            /* The man page says non-vectored is faster than vectored */
+            struct iovec *iov = qiov->iov;
+            io_uring_prep_write(sqe, fd, iov->iov_base, iov->iov_len, offset);
+        }
         break;
+    }
     case QEMU_AIO_ZONE_APPEND:
         io_uring_prep_writev(sqe, fd, qiov->iov, qiov->niov, offset);
         break;
@@ -65,8 +76,15 @@ static void luring_prep_sqe(struct io_uring_sqe *sqe, void *opaque)
         if (req->resubmit_qiov.iov != NULL) {
             qiov = &req->resubmit_qiov;
         }
-        io_uring_prep_readv(sqe, fd, qiov->iov, qiov->niov,
-                            offset + req->total_read);
+        if (qiov->niov > 1) {
+            io_uring_prep_readv(sqe, fd, qiov->iov, qiov->niov,
+                                offset + req->total_read);
+        } else {
+            /* The man page says non-vectored is faster than vectored */
+            struct iovec *iov = qiov->iov;
+            io_uring_prep_read(sqe, fd, iov->iov_base, iov->iov_len,
+                               offset + req->total_read);
+        }
         break;
     }
     case QEMU_AIO_FLUSH:

From 9730b9974dafa594c3303374d2d2d2e47fc8809b Mon Sep 17 00:00:00 2001
From: Yeqi Fu <fufuyqqqqqq@gmail.com>
Date: Tue, 7 Oct 2025 18:35:11 +0200
Subject: [PATCH 2092/2396] block: replace TABs with space

Bring the block files in line with the QEMU coding style, with spaces
for indentation. This patch partially resolves the issue 371.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/371
Signed-off-by: Yeqi Fu <fufuyqqqqqq@gmail.com>
Message-ID: <20230325085224.23842-1-fufuyqqqqqq@gmail.com>
[thuth: Rebased the patch to the current master branch]
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251007163511.334178-1-thuth@redhat.com>
[kwolf: Fixed up vertical alignemnt]
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/bochs.c       | 14 +++++------
 block/file-posix.c  | 58 ++++++++++++++++++++++-----------------------
 block/file-win32.c  | 38 ++++++++++++++---------------
 block/qcow.c        | 10 ++++----
 include/block/nbd.h |  2 +-
 5 files changed, 61 insertions(+), 61 deletions(-)

diff --git a/block/bochs.c b/block/bochs.c
index b099fb52fe..bfda88017d 100644
--- a/block/bochs.c
+++ b/block/bochs.c
@@ -300,15 +300,15 @@ static void bochs_close(BlockDriverState *bs)
 }
 
 static BlockDriver bdrv_bochs = {
-    .format_name	= "bochs",
-    .instance_size	= sizeof(BDRVBochsState),
-    .bdrv_probe		= bochs_probe,
-    .bdrv_open		= bochs_open,
+    .format_name         = "bochs",
+    .instance_size       = sizeof(BDRVBochsState),
+    .bdrv_probe          = bochs_probe,
+    .bdrv_open           = bochs_open,
     .bdrv_child_perm     = bdrv_default_perms,
     .bdrv_refresh_limits = bochs_refresh_limits,
-    .bdrv_co_preadv = bochs_co_preadv,
-    .bdrv_close		= bochs_close,
-    .is_format          = true,
+    .bdrv_co_preadv      = bochs_co_preadv,
+    .bdrv_close          = bochs_close,
+    .is_format           = true,
 };
 
 static void bdrv_bochs_init(void)
diff --git a/block/file-posix.c b/block/file-posix.c
index 8b7c02d19a..12d12970fa 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -133,7 +133,7 @@
 #define FTYPE_FILE   0
 #define FTYPE_CD     1
 
-#define MAX_BLOCKSIZE	4096
+#define MAX_BLOCKSIZE 4096
 
 /* Posix file locking bytes. Libvirt takes byte 0, we start from higher bytes,
  * leaving a few more bytes for its future use. */
@@ -4562,20 +4562,20 @@ static void coroutine_fn cdrom_co_lock_medium(BlockDriverState *bs, bool locked)
 }
 
 static BlockDriver bdrv_host_cdrom = {
-    .format_name        = "host_cdrom",
-    .protocol_name      = "host_cdrom",
-    .instance_size      = sizeof(BDRVRawState),
-    .bdrv_needs_filename = true,
-    .bdrv_probe_device	= cdrom_probe_device,
-    .bdrv_parse_filename = cdrom_parse_filename,
-    .bdrv_open          = cdrom_open,
-    .bdrv_close         = raw_close,
-    .bdrv_reopen_prepare = raw_reopen_prepare,
-    .bdrv_reopen_commit  = raw_reopen_commit,
-    .bdrv_reopen_abort   = raw_reopen_abort,
-    .bdrv_co_create_opts = bdrv_co_create_opts_simple,
-    .create_opts         = &bdrv_create_opts_simple,
-    .mutable_opts        = mutable_opts,
+    .format_name            = "host_cdrom",
+    .protocol_name          = "host_cdrom",
+    .instance_size          = sizeof(BDRVRawState),
+    .bdrv_needs_filename    = true,
+    .bdrv_probe_device      = cdrom_probe_device,
+    .bdrv_parse_filename    = cdrom_parse_filename,
+    .bdrv_open              = cdrom_open,
+    .bdrv_close             = raw_close,
+    .bdrv_reopen_prepare    = raw_reopen_prepare,
+    .bdrv_reopen_commit     = raw_reopen_commit,
+    .bdrv_reopen_abort      = raw_reopen_abort,
+    .bdrv_co_create_opts    = bdrv_co_create_opts_simple,
+    .create_opts            = &bdrv_create_opts_simple,
+    .mutable_opts           = mutable_opts,
     .bdrv_co_invalidate_cache = raw_co_invalidate_cache,
 
     .bdrv_co_preadv         = raw_co_preadv,
@@ -4688,20 +4688,20 @@ static void coroutine_fn cdrom_co_lock_medium(BlockDriverState *bs, bool locked)
 }
 
 static BlockDriver bdrv_host_cdrom = {
-    .format_name        = "host_cdrom",
-    .protocol_name      = "host_cdrom",
-    .instance_size      = sizeof(BDRVRawState),
-    .bdrv_needs_filename = true,
-    .bdrv_probe_device	= cdrom_probe_device,
-    .bdrv_parse_filename = cdrom_parse_filename,
-    .bdrv_open          = cdrom_open,
-    .bdrv_close         = raw_close,
-    .bdrv_reopen_prepare = raw_reopen_prepare,
-    .bdrv_reopen_commit  = raw_reopen_commit,
-    .bdrv_reopen_abort   = raw_reopen_abort,
-    .bdrv_co_create_opts = bdrv_co_create_opts_simple,
-    .create_opts         = &bdrv_create_opts_simple,
-    .mutable_opts       = mutable_opts,
+    .format_name            = "host_cdrom",
+    .protocol_name          = "host_cdrom",
+    .instance_size          = sizeof(BDRVRawState),
+    .bdrv_needs_filename    = true,
+    .bdrv_probe_device      = cdrom_probe_device,
+    .bdrv_parse_filename    = cdrom_parse_filename,
+    .bdrv_open              = cdrom_open,
+    .bdrv_close             = raw_close,
+    .bdrv_reopen_prepare    = raw_reopen_prepare,
+    .bdrv_reopen_commit     = raw_reopen_commit,
+    .bdrv_reopen_abort      = raw_reopen_abort,
+    .bdrv_co_create_opts    = bdrv_co_create_opts_simple,
+    .create_opts            = &bdrv_create_opts_simple,
+    .mutable_opts           = mutable_opts,
 
     .bdrv_co_preadv         = raw_co_preadv,
     .bdrv_co_pwritev        = raw_co_pwritev,
diff --git a/block/file-win32.c b/block/file-win32.c
index af9aea631c..0efb609e1d 100644
--- a/block/file-win32.c
+++ b/block/file-win32.c
@@ -741,16 +741,16 @@ static QemuOptsList raw_create_opts = {
 };
 
 BlockDriver bdrv_file = {
-    .format_name	= "file",
-    .protocol_name	= "file",
-    .instance_size	= sizeof(BDRVRawState),
-    .bdrv_needs_filename = true,
-    .bdrv_parse_filename = raw_parse_filename,
-    .bdrv_open          = raw_open,
-    .bdrv_refresh_limits = raw_probe_alignment,
-    .bdrv_close         = raw_close,
-    .bdrv_co_create_opts = raw_co_create_opts,
-    .bdrv_has_zero_init = bdrv_has_zero_init_1,
+    .format_name            = "file",
+    .protocol_name          = "file",
+    .instance_size          = sizeof(BDRVRawState),
+    .bdrv_needs_filename    = true,
+    .bdrv_parse_filename    = raw_parse_filename,
+    .bdrv_open              = raw_open,
+    .bdrv_refresh_limits    = raw_probe_alignment,
+    .bdrv_close             = raw_close,
+    .bdrv_co_create_opts    = raw_co_create_opts,
+    .bdrv_has_zero_init     = bdrv_has_zero_init_1,
 
     .bdrv_reopen_prepare = raw_reopen_prepare,
     .bdrv_reopen_commit  = raw_reopen_commit,
@@ -914,15 +914,15 @@ done:
 }
 
 static BlockDriver bdrv_host_device = {
-    .format_name	= "host_device",
-    .protocol_name	= "host_device",
-    .instance_size	= sizeof(BDRVRawState),
-    .bdrv_needs_filename = true,
-    .bdrv_parse_filename = hdev_parse_filename,
-    .bdrv_probe_device	= hdev_probe_device,
-    .bdrv_open     	= hdev_open,
-    .bdrv_close		= raw_close,
-    .bdrv_refresh_limits = hdev_refresh_limits,
+    .format_name            = "host_device",
+    .protocol_name          = "host_device",
+    .instance_size          = sizeof(BDRVRawState),
+    .bdrv_needs_filename    = true,
+    .bdrv_parse_filename    = hdev_parse_filename,
+    .bdrv_probe_device      = hdev_probe_device,
+    .bdrv_open              = hdev_open,
+    .bdrv_close             = raw_close,
+    .bdrv_refresh_limits    = hdev_refresh_limits,
 
     .bdrv_aio_preadv    = raw_aio_preadv,
     .bdrv_aio_pwritev   = raw_aio_pwritev,
diff --git a/block/qcow.c b/block/qcow.c
index 8a3e7591a9..b442bfe835 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -1184,11 +1184,11 @@ static const char *const qcow_strong_runtime_opts[] = {
 };
 
 static BlockDriver bdrv_qcow = {
-    .format_name	= "qcow",
-    .instance_size	= sizeof(BDRVQcowState),
-    .bdrv_probe		= qcow_probe,
-    .bdrv_open		= qcow_open,
-    .bdrv_close		= qcow_close,
+    .format_name            = "qcow",
+    .instance_size          = sizeof(BDRVQcowState),
+    .bdrv_probe             = qcow_probe,
+    .bdrv_open              = qcow_open,
+    .bdrv_close             = qcow_close,
     .bdrv_child_perm        = bdrv_default_perms,
     .bdrv_reopen_prepare    = qcow_reopen_prepare,
     .bdrv_co_create         = qcow_co_create,
diff --git a/include/block/nbd.h b/include/block/nbd.h
index 92987c76fd..ab40842da9 100644
--- a/include/block/nbd.h
+++ b/include/block/nbd.h
@@ -296,7 +296,7 @@ enum {
     NBD_CMD_BLOCK_STATUS = 7,
 };
 
-#define NBD_DEFAULT_PORT	10809
+#define NBD_DEFAULT_PORT 10809
 
 /* Maximum size of a single READ/WRITE data buffer */
 #define NBD_MAX_BUFFER_SIZE (32 * 1024 * 1024)

From 9dbfd4e28dd11a83f54c371fade8d49a63d6dc1e Mon Sep 17 00:00:00 2001
From: Wesley Hershberger <wesley.hershberger@canonical.com>
Date: Wed, 29 Oct 2025 08:27:02 -0500
Subject: [PATCH 2093/2396] block: Drop detach_subchain for bdrv_replace_node

Detaching filters using detach_subchain=true can cause segfaults as
described in #3149.

More specifically, this was observed when executing concurrent
block-stream and query-named-block-nodes. block-stream adds a
copy-on-read filter as the main BDS for the blockjob; that filter was
dropped with detach_subchain=true but not unref'd until the the blockjob
was free'd. Because query-named-block-nodes assumes that a filter will
always have exactly one child, it caused a segfault when it observed the
detached filter. Stacktrace:

0  bdrv_refresh_filename (bs=0x5efed72f8350)
    at /usr/src/qemu-1:10.1.0+ds-5ubuntu2/b/qemu/block.c:8082
1  0x00005efea73cf9dc in bdrv_block_device_info
    (blk=0x0, bs=0x5efed72f8350, flat=true, errp=0x7ffeb829ebd8)
    at block/qapi.c:62
2  0x00005efea7391ed3 in bdrv_named_nodes_list
    (flat=<optimized out>, errp=0x7ffeb829ebd8)
    at /usr/src/qemu-1:10.1.0+ds-5ubuntu2/b/qemu/block.c:6275
3  0x00005efea7471993 in qmp_query_named_block_nodes
    (has_flat=<optimized out>, flat=<optimized out>, errp=0x7ffeb829ebd8)
    at /usr/src/qemu-1:10.1.0+ds-5ubuntu2/b/qemu/blockdev.c:2834
4  qmp_marshal_query_named_block_nodes
    (args=<optimized out>, ret=0x7f2b753beec0, errp=0x7f2b753beec8)
    at qapi/qapi-commands-block-core.c:553
5  0x00005efea74f03a5 in do_qmp_dispatch_bh (opaque=0x7f2b753beed0)
    at qapi/qmp-dispatch.c:128
6  0x00005efea75108e6 in aio_bh_poll (ctx=0x5efed6f3f430)
    at util/async.c:219
7  0x00005efea74ffdb2 in aio_dispatch (ctx=0x5efed6f3f430)
    at util/aio-posix.c:436
8  0x00005efea7512846 in aio_ctx_dispatch (source=<optimized out>,
    callback=<optimized out>,user_data=<optimized out>)
    at util/async.c:361
9  0x00007f2b77809bfb in ?? ()
    from /lib/x86_64-linux-gnu/libglib-2.0.so.0
10 0x00007f2b77809e70 in g_main_context_dispatch ()
    from /lib/x86_64-linux-gnu/libglib-2.0.so.0
11 0x00005efea7517228 in glib_pollfds_poll () at util/main-loop.c:287
12 os_host_main_loop_wait (timeout=0) at util/main-loop.c:310
13 main_loop_wait (nonblocking=<optimized out>) at util/main-loop.c:589
14 0x00005efea7140482 in qemu_main_loop () at system/runstate.c:905
15 0x00005efea744e4e8 in qemu_default_main (opaque=opaque@entry=0x0)
    at system/main.c:50
16 0x00005efea6e76319 in main
    (argc=<optimized out>, argv=<optimized out>)
    at system/main.c:93

As discussed in 20251024-second-fix-3149-v1-1-d997fa3d5ce2@canonical.com,
a filter should not exist without children in the first place; therefore,
drop the parameter entirely as it is only used for filters.

This is a partial revert of 3108a15cf09865456d499b08fe14e3dbec4ccbb3.

After this change, a blockdev-backup job's copy-before-write filter will
hold references to its children until the filter is unref'd. This causes
an additional flush during bdrv_close, so also update iotest 257.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3149
Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Wesley Hershberger <wesley.hershberger@canonical.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251029-third-fix-3149-v2-1-94932bb404f4@canonical.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                    | 38 ++++----------------------------------
 tests/qemu-iotests/257     |  8 ++++++--
 tests/qemu-iotests/257.out | 14 +++++++-------
 3 files changed, 17 insertions(+), 43 deletions(-)

diff --git a/block.c b/block.c
index cf08e64add..0fe0152a7c 100644
--- a/block.c
+++ b/block.c
@@ -5398,17 +5398,13 @@ bdrv_replace_node_noperm(BlockDriverState *from,
  *
  * With auto_skip=false the error is returned if from has a parent which should
  * not be updated.
- *
- * With @detach_subchain=true @to must be in a backing chain of @from. In this
- * case backing link of the cow-parent of @to is removed.
  */
 static int GRAPH_WRLOCK
 bdrv_replace_node_common(BlockDriverState *from, BlockDriverState *to,
-                         bool auto_skip, bool detach_subchain, Error **errp)
+                         bool auto_skip, Error **errp)
 {
     Transaction *tran = tran_new();
     g_autoptr(GSList) refresh_list = NULL;
-    BlockDriverState *to_cow_parent = NULL;
     int ret;
 
     GLOBAL_STATE_CODE();
@@ -5417,17 +5413,6 @@ bdrv_replace_node_common(BlockDriverState *from, BlockDriverState *to,
     assert(to->quiesce_counter);
     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
 
-    if (detach_subchain) {
-        assert(bdrv_chain_contains(from, to));
-        assert(from != to);
-        for (to_cow_parent = from;
-             bdrv_filter_or_cow_bs(to_cow_parent) != to;
-             to_cow_parent = bdrv_filter_or_cow_bs(to_cow_parent))
-        {
-            ;
-        }
-    }
-
     /*
      * Do the replacement without permission update.
      * Replacement may influence the permissions, we should calculate new
@@ -5439,11 +5424,6 @@ bdrv_replace_node_common(BlockDriverState *from, BlockDriverState *to,
         goto out;
     }
 
-    if (detach_subchain) {
-        /* to_cow_parent is already drained because from is drained */
-        bdrv_remove_child(bdrv_filter_or_cow_child(to_cow_parent), tran);
-    }
-
     refresh_list = g_slist_prepend(refresh_list, to);
     refresh_list = g_slist_prepend(refresh_list, from);
 
@@ -5462,7 +5442,7 @@ out:
 int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
                       Error **errp)
 {
-    return bdrv_replace_node_common(from, to, true, false, errp);
+    return bdrv_replace_node_common(from, to, true, errp);
 }
 
 int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
@@ -5478,7 +5458,7 @@ int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
 
     bdrv_drained_begin(child_bs);
     bdrv_graph_wrlock();
-    ret = bdrv_replace_node_common(bs, child_bs, true, true, errp);
+    ret = bdrv_replace_node_common(bs, child_bs, true, errp);
     bdrv_graph_wrunlock();
     bdrv_drained_end(child_bs);
 
@@ -5929,17 +5909,7 @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
         updated_children = g_slist_prepend(updated_children, c);
     }
 
-    /*
-     * It seems correct to pass detach_subchain=true here, but it triggers
-     * one more yet not fixed bug, when due to nested aio_poll loop we switch to
-     * another drained section, which modify the graph (for example, removing
-     * the child, which we keep in updated_children list). So, it's a TODO.
-     *
-     * Note, bug triggered if pass detach_subchain=true here and run
-     * test-bdrv-drain. test_drop_intermediate_poll() test-case will crash.
-     * That's a FIXME.
-     */
-    bdrv_replace_node_common(top, base, false, false, &local_err);
+    bdrv_replace_node_common(top, base, false, &local_err);
     bdrv_graph_wrunlock();
 
     if (local_err) {
diff --git a/tests/qemu-iotests/257 b/tests/qemu-iotests/257
index 7d3720b8e5..cd0468aaa1 100755
--- a/tests/qemu-iotests/257
+++ b/tests/qemu-iotests/257
@@ -310,14 +310,18 @@ def test_bitmap_sync(bsync_mode, msync_mode='bitmap', failure=None):
                     'state': 1,
                     'new_state': 2
                 }, {
-                    'event': 'read_aio',
+                    'event': 'flush_to_disk',
                     'state': 2,
                     'new_state': 3
+                }, {
+                    'event': "read_aio",
+                    'state': 3,
+                    'new_state': 4
                 }],
                 'inject-error': [{
                     'event': 'read_aio',
                     'errno': 5,
-                    'state': 3,
+                    'state': 4,
                     'immediately': False,
                     'once': True
                 }]
diff --git a/tests/qemu-iotests/257.out b/tests/qemu-iotests/257.out
index c33dd7f3a9..fb28333cb2 100644
--- a/tests/qemu-iotests/257.out
+++ b/tests/qemu-iotests/257.out
@@ -272,7 +272,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -1017,7 +1017,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -1762,7 +1762,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -2507,7 +2507,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -3252,7 +3252,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -3997,7 +3997,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---
@@ -4742,7 +4742,7 @@ qemu_img compare "TEST_DIR/PID-img" "TEST_DIR/PID-fbackup2" ==> Identical, OK!
 
 --- Preparing image & VM ---
 
-{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 3}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "read_aio", "new-state": 3, "state": 2}]}, "node-name": "drive0"}}
+{"execute": "blockdev-add", "arguments": {"driver": "qcow2", "file": {"driver": "blkdebug", "image": {"driver": "file", "filename": "TEST_DIR/PID-img"}, "inject-error": [{"errno": 5, "event": "read_aio", "immediately": false, "once": true, "state": 4}], "set-state": [{"event": "flush_to_disk", "new-state": 2, "state": 1}, {"event": "flush_to_disk", "new-state": 3, "state": 2}, {"event": "read_aio", "new-state": 4, "state": 3}]}, "node-name": "drive0"}}
 {"return": {}}
 
 --- Write #0 ---

From 23798d3f885497c1f0a0c062fc889e7a5eff0648 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Tue, 28 Oct 2025 10:43:28 +0100
Subject: [PATCH 2094/2396] iotests: Test resizing file node under raw with
 size/offset

This adds some more tests for using the 'size' and 'offset' options of
raw to the recently added resize-below-raw test.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251028094328.17919-1-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/resize-below-raw     | 53 +++++++++++++++++--
 tests/qemu-iotests/tests/resize-below-raw.out |  4 +-
 2 files changed, 51 insertions(+), 6 deletions(-)

diff --git a/tests/qemu-iotests/tests/resize-below-raw b/tests/qemu-iotests/tests/resize-below-raw
index 3c9241c918..ddf3f44742 100755
--- a/tests/qemu-iotests/tests/resize-below-raw
+++ b/tests/qemu-iotests/tests/resize-below-raw
@@ -8,16 +8,27 @@
 # SPDX-License-Identifier: GPL-2.0-or-later
 
 import os
+from typing import Dict, Optional
+
 import iotests
 from iotests import imgfmt, qemu_img_create, QMPTestCase
 
 image_size = 1 * 1024 * 1024
 image = os.path.join(iotests.test_dir, 'test.img')
 
-class TestResizeBelowRaw(QMPTestCase):
+class BaseResizeBelowRaw(QMPTestCase):
+    raw_size: Optional[int] = None
+    raw_offset: Optional[int] = None
+
     def setUp(self) -> None:
         qemu_img_create('-f', imgfmt, image, str(image_size))
 
+        extra_options: Dict[str, str] = {}
+        if self.raw_size is not None:
+            extra_options['size'] = str(self.raw_size)
+        if self.raw_offset is not None:
+            extra_options['offset'] = str(self.raw_offset)
+
         self.vm = iotests.VM()
         self.vm.add_blockdev(self.vm.qmp_to_opts({
             'driver': imgfmt,
@@ -26,7 +37,8 @@ class TestResizeBelowRaw(QMPTestCase):
                 'driver': 'file',
                 'filename': image,
                 'node-name': 'file0',
-            }
+            },
+            **extra_options
         }))
         self.vm.launch()
 
@@ -34,14 +46,16 @@ class TestResizeBelowRaw(QMPTestCase):
         self.vm.shutdown()
         os.remove(image)
 
-    def assert_size(self, size: int) -> None:
+    def assert_size(self, size: int, file_size: Optional[int] = None) -> None:
         nodes = self.vm.qmp('query-named-block-nodes', flat=True)['return']
         self.assertEqual(len(nodes), 2)
         for node in nodes:
-            if node['drv'] == 'file':
+            if node['drv'] == 'file' and file_size is not None:
+                self.assertEqual(node['image']['virtual-size'], file_size)
                 continue
             self.assertEqual(node['image']['virtual-size'], size)
 
+class TestResizeBelowUnlimitedRaw(BaseResizeBelowRaw):
     def test_resize_below_raw(self) -> None:
         self.assert_size(image_size)
         self.vm.qmp('block_resize', node_name='file0', size=2*image_size)
@@ -49,5 +63,36 @@ class TestResizeBelowRaw(QMPTestCase):
         self.vm.qmp('block_resize', node_name='node0', size=3*image_size)
         self.assert_size(3*image_size)
 
+# offset = 0 behaves the same as absent offset
+class TestResizeBelowRawWithZeroOffset(TestResizeBelowUnlimitedRaw):
+    raw_offset = 0
+
+class TestResizeBelowRawWithSize(BaseResizeBelowRaw):
+    raw_size = image_size // 2
+
+    def test_resize_below_raw_with_size(self) -> None:
+        self.assert_size(image_size // 2, image_size)
+
+        # This QMP command fails because node0 unshares RESIZE
+        self.vm.qmp('block_resize', node_name='file0', size=2*image_size)
+        self.assert_size(image_size // 2, image_size)
+
+        # This QMP command fails because node0 is a fixed-size disk
+        self.vm.qmp('block_resize', node_name='node0', size=3*image_size)
+        self.assert_size(image_size // 2, image_size)
+
+class TestResizeBelowRawWithOffset(BaseResizeBelowRaw):
+    raw_offset = image_size // 4
+
+    def test_resize_below_raw_with_offset(self) -> None:
+        self.assert_size(image_size * 3 // 4, image_size)
+
+        # This QMP command fails because node0 unshares RESIZE
+        self.vm.qmp('block_resize', node_name='file0', size=2*image_size)
+        self.assert_size(image_size * 3 // 4, image_size)
+
+        self.vm.qmp('block_resize', node_name='node0', size=3*image_size)
+        self.assert_size(3 * image_size, image_size * 13 // 4)
+
 if __name__ == '__main__':
     iotests.main(supported_fmts=['raw'], supported_protocols=['file'])
diff --git a/tests/qemu-iotests/tests/resize-below-raw.out b/tests/qemu-iotests/tests/resize-below-raw.out
index ae1213e6f8..89968f35d7 100644
--- a/tests/qemu-iotests/tests/resize-below-raw.out
+++ b/tests/qemu-iotests/tests/resize-below-raw.out
@@ -1,5 +1,5 @@
-.
+....
 ----------------------------------------------------------------------
-Ran 1 tests
+Ran 4 tests
 
 OK

From f00bcc833790c72c08bc5eed97845fdaa7542507 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Thu, 23 Oct 2025 17:10:58 +0900
Subject: [PATCH 2095/2396] qemu-img: Fix amend option parse error handling

qemu_opts_del(opts) dereferences opts->list, which is the old amend_opts
pointer that can be dangling after executing
qemu_opts_append(amend_opts, bs->drv->create_opts) and cause
use-after-free.

Fix the potential use-after-free by moving the qemu_opts_del() call
before the qemu_opts_append() call.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20251023-iotests-v1-1-fab143ca4c2f@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c
index a7791896c1..7a32d2d16c 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4597,9 +4597,9 @@ static int img_amend(const img_cmd_t *ccmd, int argc, char **argv)
     amend_opts = qemu_opts_append(amend_opts, bs->drv->amend_opts);
     opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort);
     if (!qemu_opts_do_parse(opts, options, NULL, &err)) {
+        qemu_opts_del(opts);
         /* Try to parse options using the create options */
         amend_opts = qemu_opts_append(amend_opts, bs->drv->create_opts);
-        qemu_opts_del(opts);
         opts = qemu_opts_create(amend_opts, NULL, 0, &error_abort);
         if (qemu_opts_do_parse(opts, options, NULL, NULL)) {
             error_append_hint(&err,

From 71c1a1f18c1127dfa706f972821157c0feac168d Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Thu, 23 Oct 2025 17:10:59 +0900
Subject: [PATCH 2096/2396] iotests: Run iotests with sanitizers
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 2cc4d1c5eab1 ("tests/check-block: Skip iotests when sanitizers
are enabled") changed iotests to skip when sanitizers are enabled.
The rationale is that AddressSanitizer emits warnings and reports leaks,
which results in test breakage. Later, sanitizers that are enabled for
production environments (safe-stack and cfi-icall) were exempted.

However, this approach has a few problems.

- It requires rebuild to disable sanitizers if the existing build has
  them enabled.
- It disables other useful non-production sanitizers.
- The exemption of safe-stack and cfi-icall is not correctly
  implemented, so qemu-iotests are incorrectly enabled whenever either
  safe-stack or cfi-icall is enabled *and*, even if there is another
  sanitizer like AddressSanitizer.

To solve these problems, direct AddressSanitizer warnings to separate
files to avoid changing the test results, and selectively disable
leak detection at runtime instead of requiring to disable all
sanitizers at buildtime.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20251023-iotests-v1-2-fab143ca4c2f@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/meson.build   |  8 --------
 tests/qemu-iotests/testrunner.py | 12 ++++++++++++
 2 files changed, 12 insertions(+), 8 deletions(-)

diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
index fad340ad59..56b0446827 100644
--- a/tests/qemu-iotests/meson.build
+++ b/tests/qemu-iotests/meson.build
@@ -2,14 +2,6 @@ if not have_tools or host_os == 'windows'
   subdir_done()
 endif
 
-foreach cflag: qemu_ldflags
-  if cflag.startswith('-fsanitize') and \
-     not cflag.contains('safe-stack') and not cflag.contains('cfi-icall')
-    message('Sanitizers are enabled ==> Disabled the qemu-iotests.')
-    subdir_done()
-  endif
-endforeach
-
 bash = find_program('bash', required: false, version: '>= 4.0')
 if not bash.found()
   message('bash >= v4.0 not available ==> Disabled the qemu-iotests.')
diff --git a/tests/qemu-iotests/testrunner.py b/tests/qemu-iotests/testrunner.py
index 14cc8492f9..e2a3658994 100644
--- a/tests/qemu-iotests/testrunner.py
+++ b/tests/qemu-iotests/testrunner.py
@@ -263,10 +263,21 @@ class TestRunner(contextlib.AbstractContextManager['TestRunner']):
             Path(env[d]).mkdir(parents=True, exist_ok=True)
 
         test_dir = env['TEST_DIR']
+        f_asan = Path(test_dir, f_test.name + '.out.asan')
         f_bad = Path(test_dir, f_test.name + '.out.bad')
         f_notrun = Path(test_dir, f_test.name + '.notrun')
         f_casenotrun = Path(test_dir, f_test.name + '.casenotrun')
 
+        env['ASAN_OPTIONS'] = f'detect_leaks=0:log_path={f_asan}'
+
+        def unlink_asan():
+            with os.scandir(test_dir) as it:
+                for entry in it:
+                    if entry.name.startswith(f_asan.name):
+                        os.unlink(entry)
+
+        unlink_asan()
+
         for p in (f_notrun, f_casenotrun):
             silent_unlink(p)
 
@@ -312,6 +323,7 @@ class TestRunner(contextlib.AbstractContextManager['TestRunner']):
                               description=f'output mismatch (see {f_bad})',
                               diff=diff, casenotrun=casenotrun)
         else:
+            unlink_asan()
             f_bad.unlink()
             return TestResult(status='pass', elapsed=elapsed,
                               casenotrun=casenotrun)

From 31242df6caff67c96c08566ff372f067bfb47c3a Mon Sep 17 00:00:00 2001
From: Jean-Louis Dupond <jean-louis@dupond.be>
Date: Tue, 13 May 2025 15:26:27 +0200
Subject: [PATCH 2097/2396] qcow2: rename update_refcount_discard to
 queue_discard

The function just queues discards, and doesn't do any refcount change.
So let's change the function name to align with its function.

Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be>
Message-ID: <20250513132628.1055549-2-jean-louis@dupond.be>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2-refcount.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 0266542cee..8fb210501c 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -754,8 +754,8 @@ void qcow2_process_discards(BlockDriverState *bs, int ret)
     }
 }
 
-static void update_refcount_discard(BlockDriverState *bs,
-                                    uint64_t offset, uint64_t length)
+static void queue_discard(BlockDriverState *bs,
+                          uint64_t offset, uint64_t length)
 {
     BDRVQcow2State *s = bs->opaque;
     Qcow2DiscardRegion *d, *p, *next;
@@ -902,7 +902,7 @@ update_refcount(BlockDriverState *bs, int64_t offset, int64_t length,
             }
 
             if (s->discard_passthrough[type]) {
-                update_refcount_discard(bs, cluster_offset, s->cluster_size);
+                queue_discard(bs, cluster_offset, s->cluster_size);
             }
         }
     }
@@ -3619,7 +3619,7 @@ qcow2_discard_refcount_block(BlockDriverState *bs, uint64_t discard_block_offs)
         /* discard refblock from the cache if refblock is cached */
         qcow2_cache_discard(s->refcount_block_cache, refblock);
     }
-    update_refcount_discard(bs, discard_block_offs, s->cluster_size);
+    queue_discard(bs, discard_block_offs, s->cluster_size);
 
     return 0;
 }

From 524d5ba8c0b18e8de6530632160bf2aa71b60a21 Mon Sep 17 00:00:00 2001
From: Jean-Louis Dupond <jean-louis@dupond.be>
Date: Tue, 13 May 2025 15:26:28 +0200
Subject: [PATCH 2098/2396] qcow2: put discards in discard queue when
 discard-no-unref is enabled

When discard-no-unref is enabled, discards are not queued like it
should.
This was broken since discard-no-unref was added.

Add a helper function qcow2_discard_cluster which handles some common
checks and calls the queue_discards function if needed to add the
discard request to the queue.

Signed-off-by: Jean-Louis Dupond <jean-louis@dupond.be>
Message-ID: <20250513132628.1055549-3-jean-louis@dupond.be>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2-cluster.c  | 16 ++++++----------
 block/qcow2-refcount.c | 17 +++++++++++++++++
 block/qcow2.h          |  4 ++++
 3 files changed, 27 insertions(+), 10 deletions(-)

diff --git a/block/qcow2-cluster.c b/block/qcow2-cluster.c
index ce8c0076b3..c655bf6df4 100644
--- a/block/qcow2-cluster.c
+++ b/block/qcow2-cluster.c
@@ -1978,12 +1978,10 @@ discard_in_l2_slice(BlockDriverState *bs, uint64_t offset, uint64_t nb_clusters,
         if (!keep_reference) {
             /* Then decrease the refcount */
             qcow2_free_any_cluster(bs, old_l2_entry, type);
-        } else if (s->discard_passthrough[type] &&
-                   (cluster_type == QCOW2_CLUSTER_NORMAL ||
-                    cluster_type == QCOW2_CLUSTER_ZERO_ALLOC)) {
+        } else {
             /* If we keep the reference, pass on the discard still */
-            bdrv_pdiscard(s->data_file, old_l2_entry & L2E_OFFSET_MASK,
-                          s->cluster_size);
+            qcow2_discard_cluster(bs, old_l2_entry & L2E_OFFSET_MASK,
+                                  s->cluster_size, cluster_type, type);
         }
     }
 
@@ -2092,12 +2090,10 @@ zero_in_l2_slice(BlockDriverState *bs, uint64_t offset,
             if (!keep_reference) {
                 /* Then decrease the refcount */
                 qcow2_free_any_cluster(bs, old_l2_entry, QCOW2_DISCARD_REQUEST);
-            } else if (s->discard_passthrough[QCOW2_DISCARD_REQUEST] &&
-                       (type == QCOW2_CLUSTER_NORMAL ||
-                        type == QCOW2_CLUSTER_ZERO_ALLOC)) {
+            } else {
                 /* If we keep the reference, pass on the discard still */
-                bdrv_pdiscard(s->data_file, old_l2_entry & L2E_OFFSET_MASK,
-                            s->cluster_size);
+                qcow2_discard_cluster(bs, old_l2_entry & L2E_OFFSET_MASK,
+                            s->cluster_size, type, QCOW2_DISCARD_REQUEST);
             }
         }
     }
diff --git a/block/qcow2-refcount.c b/block/qcow2-refcount.c
index 8fb210501c..6512cda407 100644
--- a/block/qcow2-refcount.c
+++ b/block/qcow2-refcount.c
@@ -1205,6 +1205,23 @@ void qcow2_free_any_cluster(BlockDriverState *bs, uint64_t l2_entry,
     }
 }
 
+void qcow2_discard_cluster(BlockDriverState *bs, uint64_t offset,
+                           uint64_t length, QCow2ClusterType ctype,
+                           enum qcow2_discard_type dtype)
+{
+    BDRVQcow2State *s = bs->opaque;
+
+    if (s->discard_passthrough[dtype] &&
+        (ctype == QCOW2_CLUSTER_NORMAL ||
+         ctype == QCOW2_CLUSTER_ZERO_ALLOC)) {
+        if (has_data_file(bs)) {
+            bdrv_pdiscard(s->data_file, offset, length);
+        } else {
+            queue_discard(bs, offset, length);
+        }
+    }
+}
+
 int qcow2_write_caches(BlockDriverState *bs)
 {
     BDRVQcow2State *s = bs->opaque;
diff --git a/block/qcow2.h b/block/qcow2.h
index a9e3481c6e..547bb2b814 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -880,6 +880,10 @@ void GRAPH_RDLOCK qcow2_free_clusters(BlockDriverState *bs,
 void GRAPH_RDLOCK
 qcow2_free_any_cluster(BlockDriverState *bs, uint64_t l2_entry,
                        enum qcow2_discard_type type);
+void GRAPH_RDLOCK
+qcow2_discard_cluster(BlockDriverState *bs, uint64_t offset,
+                      uint64_t length, QCow2ClusterType ctype,
+                      enum qcow2_discard_type dtype);
 
 int GRAPH_RDLOCK
 qcow2_update_snapshot_refcount(BlockDriverState *bs, int64_t l1_table_offset,

From 061b0275c7c22a97927449ecbac365a4a152a67d Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Oct 2025 12:41:40 +0200
Subject: [PATCH 2099/2396] tests/qemu-iotests/184: Fix skip message for
 qemu-img without throttle

If qemu-img does not support throttling, test 184 currently skips
with the message:

  not suitable for this image format: raw

But that's wrong, it's not about the image format, it's about the
throttling not being available in qemu-img. Thus fix this by using
_notrun with a proper message instead.

Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251014104142.1281028-2-thuth@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/184 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/184 b/tests/qemu-iotests/184
index 6d0afe9d38..9248b3265d 100755
--- a/tests/qemu-iotests/184
+++ b/tests/qemu-iotests/184
@@ -51,7 +51,7 @@ run_qemu()
 }
 
 test_throttle=$($QEMU_IMG --help|grep throttle)
-[ "$test_throttle" = "" ] && _supported_fmt throttle
+[ "$test_throttle" = "" ] && _notrun "qemu-img does not support throttle"
 
 echo
 echo "== checking interface =="

From f00a45e9ca1ab5d8f157f8f2109173782157dac3 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Oct 2025 12:41:41 +0200
Subject: [PATCH 2100/2396] tests/qemu-iotests: Improve the dry run list to
 speed up thorough testing

When running the tests in thorough mode, e.g. with:

 make -j$(nproc) check SPEED=thorough

we currently always get a huge amount of total tests that the test
runner tries to execute (2457 in my case), but a big bunch of them are
only skipped (1099 in my case, meaning that only 1358 got executed).
This happens because we try to run the whole set of iotests for multiple
image formats while a lot of the tests can only run with one certain
format only and thus are marked as SKIP during execution. This is quite a
waste of time during each test run, and also unnecessarily blows up the
displayed list of executed tests in the console output.

Thus let's try to be a little bit smarter: If the "check" script is run
with "-n" and an image format switch (like "-qed") at the same time (which
is what we do for discovering the tests for the meson test runner already),
only report the tests that likely support the given format instead of
providing the whole list of all tests. We can determine whether a test
supports a format or not by looking at the lines in the file that contain
a "supported_fmt" or "unsupported_fmt" statement. This is only heuristics,
of course, but it is good enough for running the iotests via "make
check-block" - I double-checked that the list of executed tests does not
get changed by this patch, it's only the tests that are skipped anyway that
are now not run anymore.

This way the amount of total tests drops from 2457 to 1432 for me, and
the amount of skipped tests drops from 1099 to just 74 (meaning that we
still properly run 1432 - 74 = 1358 tests as we did before).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251014104142.1281028-3-thuth@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/check | 42 +++++++++++++++++++++++++++++++++++++---
 1 file changed, 39 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/check b/tests/qemu-iotests/check
index d9b7c1d598..3941eac8e2 100755
--- a/tests/qemu-iotests/check
+++ b/tests/qemu-iotests/check
@@ -17,6 +17,7 @@
 # along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import os
+import re
 import sys
 import argparse
 import shutil
@@ -82,7 +83,7 @@ def make_argparser() -> argparse.ArgumentParser:
     g_env.add_argument('-i', dest='aiomode', default='threads',
                        help='sets AIOMODE environment variable')
 
-    p.set_defaults(imgfmt='raw', imgproto='file')
+    p.set_defaults(imgproto='file')
 
     format_list = ['raw', 'bochs', 'cloop', 'parallels', 'qcow', 'qcow2',
                    'qed', 'vdi', 'vpc', 'vhdx', 'vmdk', 'luks', 'dmg', 'vvfat']
@@ -137,15 +138,50 @@ def make_argparser() -> argparse.ArgumentParser:
     return p
 
 
+def dry_run_list(test_dir, imgfmt, testlist):
+    for t in testlist:
+        if not imgfmt:
+            print('\n'.join([os.path.basename(t)]))
+            continue
+        # If a format has been given, we look for the "supported_fmt"
+        # and the "unsupported_fmt" lines in the test and try to find out
+        # whether the format is supported or not. This is only heuristics
+        # (it can e.g. fail if the "unsupported_fmts" and "supported_fmts"
+        # statements are in the same line), but it should be good enough
+        # to get a proper list for "make check-block"
+        with open(os.path.join(test_dir, t), 'r', encoding='utf-8') as fh:
+            supported = True
+            check_next_line = False
+            sd = "[ \t'\"]"           # Start delimiter
+            ed = "([ \t'\"]|$)"       # End delimiter
+            for line in fh:
+                if 'unsupported_fmt' in line:
+                    if re.search(sd + imgfmt + ed, line):
+                        supported = False
+                        break
+                elif 'supported_fmt' in line or check_next_line:
+                    if re.search(sd + 'generic' + ed, line):
+                        continue      # Might be followed by "unsupported" line
+                    supported = re.search(sd + imgfmt + ed, line)
+                    check_next_line = not ']' in line and \
+                            ('supported_fmts=[' in line or check_next_line)
+                    if supported or not check_next_line:
+                        break
+            if supported:
+                print('\n'.join([os.path.basename(t)]))
+
+
 if __name__ == '__main__':
     warnings.simplefilter("default")
     os.environ["PYTHONWARNINGS"] = "default"
 
     args = make_argparser().parse_args()
 
+    image_format = args.imgfmt or 'raw'
+
     env = TestEnv(source_dir=args.source_dir,
                   build_dir=args.build_dir,
-                  imgfmt=args.imgfmt, imgproto=args.imgproto,
+                  imgfmt=image_format, imgproto=args.imgproto,
                   aiomode=args.aiomode, cachemode=args.cachemode,
                   imgopts=args.imgopts, misalign=args.misalign,
                   debug=args.debug, valgrind=args.valgrind,
@@ -189,7 +225,7 @@ if __name__ == '__main__':
 
     if args.dry_run:
         with env:
-            print('\n'.join([os.path.basename(t) for t in tests]))
+            dry_run_list(env.source_iotests, args.imgfmt, tests)
     else:
         with TestRunner(env, tap=args.tap,
                         color=args.color) as tr:

From 67685a2331f7c4f1d5bf14f253ff8edf6cac9cbb Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 14 Oct 2025 12:41:42 +0200
Subject: [PATCH 2101/2396] tests/qemu-iotest: Add more image formats to the
 thorough testing

Now that the "check" script is a little bit smarter with providing
a list of tests that are supported for an image format, we can also
add more image formats that can be used for generic block layer
testing. (Note: qcow1 and luks are not added because some tests
there currently fail, and other formats like bochs, cloop, dmg and
vvfat do not work with the generic tests and thus would only get
skipped if we'd tried to add them here)

Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251014104142.1281028-4-thuth@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/meson.build | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/qemu-iotests/meson.build b/tests/qemu-iotests/meson.build
index 56b0446827..d7bae71ced 100644
--- a/tests/qemu-iotests/meson.build
+++ b/tests/qemu-iotests/meson.build
@@ -13,7 +13,10 @@ qemu_iotests_env = {'PYTHON': python.full_path()}
 qemu_iotests_formats = {
   'qcow2': 'quick',
   'raw': 'slow',
+  'parallels': 'thorough',
   'qed': 'thorough',
+  'vdi': 'thorough',
+  'vhdx': 'thorough',
   'vmdk': 'thorough',
   'vpc': 'thorough'
 }

From 1bd7bfbc2ba3ed767eaff3bd73f598e877b30f28 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 15 Sep 2025 16:37:26 -0500
Subject: [PATCH 2102/2396] block: Allow drivers to control protocol prefix at
 creation

This patch is pure refactoring: instead of hard-coding permission to
use a protocol prefix when creating an image, the drivers can now pass
in a parameter, comparable to what they could already do for opening a
pre-existing image.  This patch is purely mechanical (all drivers pass
in true for now), but it will enable the next patch to cater to
drivers that want to differ in behavior for the primary image vs. any
secondary images that are opened at the same time as creating the
primary image.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250915213919.3121401-5-eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                            | 4 ++--
 block/crypto.c                     | 2 +-
 block/parallels.c                  | 2 +-
 block/qcow.c                       | 2 +-
 block/qcow2.c                      | 4 ++--
 block/qed.c                        | 2 +-
 block/raw-format.c                 | 2 +-
 block/vdi.c                        | 2 +-
 block/vhdx.c                       | 2 +-
 block/vmdk.c                       | 2 +-
 block/vpc.c                        | 2 +-
 include/block/block-global-state.h | 3 ++-
 12 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/block.c b/block.c
index 0fe0152a7c..4f1581cedf 100644
--- a/block.c
+++ b/block.c
@@ -693,7 +693,7 @@ out:
 }
 
 int coroutine_fn bdrv_co_create_file(const char *filename, QemuOpts *opts,
-                                     Error **errp)
+                                     bool allow_protocol_prefix, Error **errp)
 {
     QemuOpts *protocol_opts;
     BlockDriver *drv;
@@ -702,7 +702,7 @@ int coroutine_fn bdrv_co_create_file(const char *filename, QemuOpts *opts,
 
     GLOBAL_STATE_CODE();
 
-    drv = bdrv_find_protocol(filename, true, errp);
+    drv = bdrv_find_protocol(filename, allow_protocol_prefix, errp);
     if (drv == NULL) {
         return -ENOENT;
     }
diff --git a/block/crypto.c b/block/crypto.c
index 7c37b23e36..b97d027444 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -835,7 +835,7 @@ block_crypto_co_create_opts_luks(BlockDriver *drv, const char *filename,
     }
 
     /* Create protocol layer */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto fail;
     }
diff --git a/block/parallels.c b/block/parallels.c
index 3a375e2a8a..7a90fb5220 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -1117,7 +1117,7 @@ parallels_co_create_opts(BlockDriver *drv, const char *filename,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto done;
     }
diff --git a/block/qcow.c b/block/qcow.c
index b442bfe835..3d37d26ee8 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -978,7 +978,7 @@ qcow_co_create_opts(BlockDriver *drv, const char *filename,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto fail;
     }
diff --git a/block/qcow2.c b/block/qcow2.c
index 4aa9f9e068..ec72e27214 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -3956,7 +3956,7 @@ qcow2_co_create_opts(BlockDriver *drv, const char *filename, QemuOpts *opts,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto finish;
     }
@@ -3971,7 +3971,7 @@ qcow2_co_create_opts(BlockDriver *drv, const char *filename, QemuOpts *opts,
     /* Create and open an external data file (protocol layer) */
     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
     if (val) {
-        ret = bdrv_co_create_file(val, opts, errp);
+        ret = bdrv_co_create_file(val, opts, true, errp);
         if (ret < 0) {
             goto finish;
         }
diff --git a/block/qed.c b/block/qed.c
index 4a36fb3929..da23a83d62 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -788,7 +788,7 @@ bdrv_qed_co_create_opts(BlockDriver *drv, const char *filename,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto fail;
     }
diff --git a/block/raw-format.c b/block/raw-format.c
index df16ac1ea2..a57c2922d5 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -463,7 +463,7 @@ static int coroutine_fn GRAPH_UNLOCKED
 raw_co_create_opts(BlockDriver *drv, const char *filename,
                    QemuOpts *opts, Error **errp)
 {
-    return bdrv_co_create_file(filename, opts, errp);
+    return bdrv_co_create_file(filename, opts, true, errp);
 }
 
 static int raw_open(BlockDriverState *bs, QDict *options, int flags,
diff --git a/block/vdi.c b/block/vdi.c
index 3ddc62a569..87b874a7ef 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -938,7 +938,7 @@ vdi_co_create_opts(BlockDriver *drv, const char *filename,
     qdict = qemu_opts_to_qdict_filtered(opts, NULL, &vdi_create_opts, true);
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto done;
     }
diff --git a/block/vhdx.c b/block/vhdx.c
index b2a4b813a0..c16e4a00c8 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -2096,7 +2096,7 @@ vhdx_co_create_opts(BlockDriver *drv, const char *filename,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto fail;
     }
diff --git a/block/vmdk.c b/block/vmdk.c
index 7b98debc2b..eb3c174eca 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -2334,7 +2334,7 @@ vmdk_create_extent(const char *filename, int64_t filesize, bool flat,
     int ret;
     BlockBackend *blk = NULL;
 
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto exit;
     }
diff --git a/block/vpc.c b/block/vpc.c
index 801ff5793f..07e8ae0309 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -1118,7 +1118,7 @@ vpc_co_create_opts(BlockDriver *drv, const char *filename,
     }
 
     /* Create and open the file (protocol layer) */
-    ret = bdrv_co_create_file(filename, opts, errp);
+    ret = bdrv_co_create_file(filename, opts, true, errp);
     if (ret < 0) {
         goto fail;
     }
diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index 62da83c616..479ca2858e 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -65,7 +65,8 @@ int co_wrapper bdrv_create(BlockDriver *drv, const char *filename,
                            QemuOpts *opts, Error **errp);
 
 int coroutine_fn GRAPH_UNLOCKED
-bdrv_co_create_file(const char *filename, QemuOpts *opts, Error **errp);
+bdrv_co_create_file(const char *filename, QemuOpts *opts,
+                    bool allow_protocol_prefix, Error **errp);
 
 BlockDriverState *bdrv_new(void);
 int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,

From 2e909d7ca95e6d395bd282a5bbf775c4b4eac10f Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Mon, 15 Sep 2025 16:37:27 -0500
Subject: [PATCH 2103/2396] qcow2, vmdk: Restrict creation with secondary file
 using protocol

Ever since CVE-2024-4467 (see commit 7ead9469 in qemu v9.1.0), we have
intentionally treated the opening of secondary files whose name is
specified in the contents of the primary file, such as a qcow2
data_file, as something that must be a local file and not a protocol
prefix (it is still possible to open a qcow2 file that wraps an NBD
data image by using QMP commands, but that is from the explicit action
of the QMP overriding any string encoded in the qcow2 file).  At the
time, we did not prevent the use of protocol prefixes on the secondary
image while creating a qcow2 file, but it results in a qcow2 file that
records an empty string for the data_file, rather than the protocol
passed in during creation:

$ qemu-img create -f raw datastore.raw 2G
$ qemu-nbd -e 0 -t -f raw datastore.raw &
$ qemu-img create -f qcow2 -o data_file=nbd://localhost:10809/ \
  datastore_nbd.qcow2 2G
Formatting 'datastore_nbd.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2147483648 data_file=nbd://localhost:10809/ lazy_refcounts=off refcount_bits=16
$ qemu-img info datastore_nbd.qcow2 | grep data
$ qemu-img info datastore_nbd.qcow2 | grep data
image: datastore_nbd.qcow2
    data file:
    data file raw: false
    filename: datastore_nbd.qcow2

And since an empty string was recorded in the file, attempting to open
the image without using QMP to supply the NBD data store fails, with a
somewhat confusing error message:

$ qemu-io -f qcow2 datastore_nbd.qcow2
qemu-io: can't open device datastore_nbd.qcow2: The 'file' block driver requires a file name

Although the ability to create an image with a convenience reference
to a protocol data file is not a security hole (unlike the case with
open, the image is not untrusted if we are the ones creating it), the
above demo shows that it is still inconsistent.  Thus, it makes more
sense if we also insist that image creation rejects a protocol prefix
when using the same syntax.  Now, the above attempt produces:

$ qemu-img create -f qcow2 -o data_file=nbd://localhost:10809/ \
  datastore_nbd.qcow2 2G
Formatting 'datastore_nbd.qcow2', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2147483648 data_file=nbd://localhost:10809/ lazy_refcounts=off refcount_bits=16
qemu-img: datastore_nbd.qcow2: Could not create 'nbd://localhost:10809/': No such file or directory

with datastore_nbd.qcow2 no longer created.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20250915213919.3121401-6-eblake@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 2 +-
 block/vmdk.c  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index ec72e27214..cb0bdb32ec 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -3971,7 +3971,7 @@ qcow2_co_create_opts(BlockDriver *drv, const char *filename, QemuOpts *opts,
     /* Create and open an external data file (protocol layer) */
     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
     if (val) {
-        ret = bdrv_co_create_file(val, opts, true, errp);
+        ret = bdrv_co_create_file(val, opts, false, errp);
         if (ret < 0) {
             goto finish;
         }
diff --git a/block/vmdk.c b/block/vmdk.c
index eb3c174eca..3b35b63cb5 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -2334,7 +2334,7 @@ vmdk_create_extent(const char *filename, int64_t filesize, bool flat,
     int ret;
     BlockBackend *blk = NULL;
 
-    ret = bdrv_co_create_file(filename, opts, true, errp);
+    ret = bdrv_co_create_file(filename, opts, false, errp);
     if (ret < 0) {
         goto exit;
     }

From 909852ba6b4a22fd2b6f9d8b88adb5fc47dfa781 Mon Sep 17 00:00:00 2001
From: Alberto Garcia <berto@igalia.com>
Date: Fri, 7 Nov 2025 10:18:30 +0100
Subject: [PATCH 2104/2396] qemu-img rebase: don't exceed IO_BUF_SIZE in one
 operation

During a rebase operation data is copied from the backing chain into
the target image using a loop, and each iteration looks for a
contiguous region of allocated data of at most IO_BUF_SIZE (2 MB).

Once that region is found, and in order to avoid partial writes, its
boundaries are extended so they are aligned to the (sub)clusters of
the target image (see commit 12df580b).

This operation can however result in a region that exceeds the maximum
allowed IO_BUF_SIZE, crashing qemu-img.

This can be easily reproduced when the source image has a smaller
cluster size than the target image:

base <- int <- active

$ qemu-img create -f qcow2 base.qcow2 4M
$ qemu-img create -f qcow2 -F qcow2 -b base.qcow2 -o cluster_size=1M int.qcow2
$ qemu-img create -f qcow2 -F qcow2 -b int.qcow2  -o cluster_size=2M active.qcow2
$ qemu-io -c "write -P 0xff 1M 2M" int.qcow2
$ qemu-img rebase -F qcow2 -b base.qcow2 active.qcow2
qemu-img: qemu-img.c:4102: img_rebase: Assertion `written + pnum <= IO_BUF_SIZE' failed.
Aborted

Cc: qemu-stable <qemu-stable@nongnu.org>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3174
Fixes: 12df580b3b7f ("qemu-img: rebase: avoid unnecessary COW operations")
Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-ID: <20251107091834.383781-1-berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 |  2 +-
 tests/qemu-iotests/024     | 46 ++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/024.out | 26 +++++++++++++++++++++
 3 files changed, 73 insertions(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c
index 7a32d2d16c..c42dd4e995 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -4081,7 +4081,7 @@ static int img_rebase(const img_cmd_t *ccmd, int argc, char **argv)
             n += offset - QEMU_ALIGN_DOWN(offset, write_align);
             offset = QEMU_ALIGN_DOWN(offset, write_align);
             n += QEMU_ALIGN_UP(offset + n, write_align) - (offset + n);
-            n = MIN(n, size - offset);
+            n = MIN(n, MIN(size - offset, IO_BUF_SIZE));
             assert(!bdrv_is_allocated(unfiltered_bs, offset, n, &n_alloc) &&
                    n_alloc == n);
 
diff --git a/tests/qemu-iotests/024 b/tests/qemu-iotests/024
index b29c76e161..021169b4a1 100755
--- a/tests/qemu-iotests/024
+++ b/tests/qemu-iotests/024
@@ -315,6 +315,52 @@ echo
 
 $QEMU_IMG map "$OVERLAY" | _filter_qemu_img_map
 
+# Check that the region to copy to the overlay during a rebase
+# operation does not exceed the I/O buffer size.
+#
+# backing_new <-- backing_old <-- overlay
+#
+# Backing (new): -- -- -- --    <-- Empty image, size 4MB
+# Backing (old):|--|ff|ff|--|   <-- 4 clusters, 1MB each
+# Overlay:      |-- --|-- --|   <-- 2 clusters, 2MB each
+#
+# The data at [1MB, 3MB) must be copied from the old backing image to
+# the overlay. However the rebase code will extend that region to the
+# overlay's (sub)cluster boundaries to avoid CoW (see commit 12df580b).
+# This test checks that IO_BUF_SIZE (2 MB) is taken into account.
+
+echo
+echo "=== Test that the region to copy does not exceed 2MB (IO_BUF_SIZE) ==="
+echo
+
+echo "Creating backing chain"
+echo
+
+TEST_IMG=$BASE_NEW _make_test_img 4M
+TEST_IMG=$BASE_OLD CLUSTER_SIZE=1M _make_test_img -b "$BASE_NEW" -F $IMGFMT
+TEST_IMG=$OVERLAY  CLUSTER_SIZE=2M _make_test_img -b "$BASE_OLD" -F $IMGFMT
+
+echo
+echo "Writing data to region [1MB, 3MB)"
+echo
+
+$QEMU_IO "$BASE_OLD" -c "write -P 0xff 1M 2M" | _filter_qemu_io
+
+echo
+echo "Rebasing"
+echo
+
+$QEMU_IMG rebase -b "$BASE_NEW" -F $IMGFMT "$OVERLAY"
+
+echo "Verifying the data"
+echo
+
+$QEMU_IO "$OVERLAY" -c "read -P 0x00  0 1M" | _filter_qemu_io
+$QEMU_IO "$OVERLAY" -c "read -P 0xff 1M 2M" | _filter_qemu_io
+$QEMU_IO "$OVERLAY" -c "read -P 0x00 3M 1M" | _filter_qemu_io
+
+$QEMU_IMG map "$OVERLAY" | _filter_qemu_img_map
+
 echo
 
 # success, all done
diff --git a/tests/qemu-iotests/024.out b/tests/qemu-iotests/024.out
index 3d1e31927a..1b7522ba71 100644
--- a/tests/qemu-iotests/024.out
+++ b/tests/qemu-iotests/024.out
@@ -243,4 +243,30 @@ Offset          Length          File
 0               0x20000         TEST_DIR/subdir/t.IMGFMT
 0x40000         0x20000         TEST_DIR/subdir/t.IMGFMT
 
+=== Test that the region to copy does not exceed 2MB (IO_BUF_SIZE) ===
+
+Creating backing chain
+
+Formatting 'TEST_DIR/subdir/t.IMGFMT.base_new', fmt=IMGFMT size=4194304
+Formatting 'TEST_DIR/subdir/t.IMGFMT.base_old', fmt=IMGFMT size=4194304 backing_file=TEST_DIR/subdir/t.IMGFMT.base_new backing_fmt=IMGFMT
+Formatting 'TEST_DIR/subdir/t.IMGFMT', fmt=IMGFMT size=4194304 backing_file=TEST_DIR/subdir/t.IMGFMT.base_old backing_fmt=IMGFMT
+
+Writing data to region [1MB, 3MB)
+
+wrote 2097152/2097152 bytes at offset 1048576
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Rebasing
+
+Verifying the data
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 2097152/2097152 bytes at offset 1048576
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+read 1048576/1048576 bytes at offset 3145728
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+Offset          Length          File
+0               0x400000        TEST_DIR/subdir/t.IMGFMT
+
 *** done

From 04496ce926d77b6de1af2f3c4d050b8e1d411895 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:26 -0600
Subject: [PATCH 2105/2396] iotests: Drop execute permissions on vvfat.out
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Output files are not executables. Noticed while preparing another
iotest addition.

Fixes: c8f60bfb43 ("iotests: Add `vvfat` tests", v9.1.0)
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-16-eblake@redhat.com>
---
 tests/qemu-iotests/tests/vvfat.out | 0
 1 file changed, 0 insertions(+), 0 deletions(-)
 mode change 100755 => 100644 tests/qemu-iotests/tests/vvfat.out

diff --git a/tests/qemu-iotests/tests/vvfat.out b/tests/qemu-iotests/tests/vvfat.out
old mode 100755
new mode 100644

From 59506e59e0f0a773e892104b945d0f15623381a7 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:27 -0600
Subject: [PATCH 2106/2396] qio: Add trace points to net_listener
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Upcoming patches will adjust how net_listener watches for new client
connections; adding trace points now makes it easier to debug that the
changes work as intended.  For example, adding
--trace='qio_net_listener*' to the qemu-storage-daemon command line
before --nbd-server will track when the server first starts listening
for clients.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-17-eblake@redhat.com>
---
 io/net-listener.c | 10 ++++++++++
 io/trace-events   |  5 +++++
 2 files changed, 15 insertions(+)

diff --git a/io/net-listener.c b/io/net-listener.c
index 47405965a6..007acbd5b1 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -23,6 +23,7 @@
 #include "io/dns-resolver.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "trace.h"
 
 QIONetListener *qio_net_listener_new(void)
 {
@@ -50,6 +51,7 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
         return TRUE;
     }
 
+    trace_qio_net_listener_callback(listener, listener->io_func);
     if (listener->io_func) {
         listener->io_func(listener, sioc, listener->io_data);
     }
@@ -123,6 +125,7 @@ void qio_net_listener_add(QIONetListener *listener,
     object_ref(OBJECT(sioc));
     listener->connected = true;
 
+    trace_qio_net_listener_watch(listener, listener->io_func, "add");
     if (listener->io_func != NULL) {
         object_ref(OBJECT(listener));
         listener->io_source[listener->nsioc] = qio_channel_add_watch_source(
@@ -143,6 +146,8 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
 {
     size_t i;
 
+    trace_qio_net_listener_unwatch(listener, listener->io_func,
+                                   "set_client_func");
     if (listener->io_notify) {
         listener->io_notify(listener->io_data);
     }
@@ -158,6 +163,8 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
         }
     }
 
+    trace_qio_net_listener_watch(listener, listener->io_func,
+                                 "set_client_func");
     if (listener->io_func != NULL) {
         for (i = 0; i < listener->nsioc; i++) {
             object_ref(OBJECT(listener));
@@ -218,6 +225,7 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     };
     size_t i;
 
+    trace_qio_net_listener_unwatch(listener, listener->io_func, "wait_client");
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
@@ -247,6 +255,7 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     g_main_loop_unref(loop);
     g_main_context_unref(ctxt);
 
+    trace_qio_net_listener_watch(listener, listener->io_func, "wait_client");
     if (listener->io_func != NULL) {
         for (i = 0; i < listener->nsioc; i++) {
             object_ref(OBJECT(listener));
@@ -268,6 +277,7 @@ void qio_net_listener_disconnect(QIONetListener *listener)
         return;
     }
 
+    trace_qio_net_listener_unwatch(listener, listener->io_func, "disconnect");
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
diff --git a/io/trace-events b/io/trace-events
index dc3a63ba1f..10976eca5f 100644
--- a/io/trace-events
+++ b/io/trace-events
@@ -72,3 +72,8 @@ qio_channel_command_new_pid(void *ioc, int writefd, int readfd, int pid) "Comman
 qio_channel_command_new_spawn(void *ioc, const char *binary, int flags) "Command new spawn ioc=%p binary=%s flags=%d"
 qio_channel_command_abort(void *ioc, int pid) "Command abort ioc=%p pid=%d"
 qio_channel_command_wait(void *ioc, int pid, int ret, int status) "Command abort ioc=%p pid=%d ret=%d status=%d"
+
+# net-listener.c
+qio_net_listener_watch(void *listener, void *func, const char *extra) "Net listener=%p watch enabled func=%p by %s"
+qio_net_listener_unwatch(void *listener, void *func, const char *extra) "Net listener=%p watch disabled func=%p by %s"
+qio_net_listener_callback(void *listener, void *func) "Net listener=%p callback forwarding to func=%p"

From 6e03d5cdc991f5db86969fc6aeaca96234426263 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:28 -0600
Subject: [PATCH 2107/2396] qio: Unwatch before notify in QIONetListener
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When changing the callback registered with QIONetListener, the code
was calling notify on the old opaque data prior to actually removing
the old GSource objects still pointing to that data.  Similarly,
during finalize, it called notify before tearing down the various
GSource objects tied to the data.

In practice, a grep of the QEMU code base found that every existing
client of QIONetListener passes in a NULL notifier (the opaque data,
if non-NULL, outlives the NetListener and so does not need cleanup
when the NetListener is torn down), so this patch has no impact.  And
even if a caller had passed in a reference-counted object with a
notifier of object_unref but kept its own reference on the data, then
the early notify would merely reduce a refcount from (say) 2 to 1, but
not free the object.  However, it is a latent bug waiting to bite any
future caller that passes in data where the notifier actually frees
the object, because the GSource could then trigger a use-after-free if
it loses the race on a last-minute client connection resulting in the
data being passed to one final use of the async callback.

Better is to delay the notify call until after all GSource that have
been given a copy of the opaque data are torn down.

CC: qemu-stable@nongnu.org
Fixes: 530473924d "io: introduce a network socket listener API", v2.12.0
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-18-eblake@redhat.com>
---
 io/net-listener.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/io/net-listener.c b/io/net-listener.c
index 007acbd5b1..d71b65270e 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -148,13 +148,6 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
 
     trace_qio_net_listener_unwatch(listener, listener->io_func,
                                    "set_client_func");
-    if (listener->io_notify) {
-        listener->io_notify(listener->io_data);
-    }
-    listener->io_func = func;
-    listener->io_data = data;
-    listener->io_notify = notify;
-
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
@@ -163,6 +156,13 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
         }
     }
 
+    if (listener->io_notify) {
+        listener->io_notify(listener->io_data);
+    }
+    listener->io_func = func;
+    listener->io_data = data;
+    listener->io_notify = notify;
+
     trace_qio_net_listener_watch(listener, listener->io_func,
                                  "set_client_func");
     if (listener->io_func != NULL) {
@@ -300,10 +300,10 @@ static void qio_net_listener_finalize(Object *obj)
     QIONetListener *listener = QIO_NET_LISTENER(obj);
     size_t i;
 
+    qio_net_listener_disconnect(listener);
     if (listener->io_notify) {
         listener->io_notify(listener->io_data);
     }
-    qio_net_listener_disconnect(listener);
 
     for (i = 0; i < listener->nsioc; i++) {
         object_unref(OBJECT(listener->sioc[i]));

From b5676493a08b4ff80680aae7a1b1bfef8797c6e7 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:29 -0600
Subject: [PATCH 2108/2396] qio: Remember context of
 qio_net_listener_set_client_func_full
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

io/net-listener.c has two modes of use: asynchronous (the user calls
qio_net_listener_set_client_func to wake up the callback via the
global GMainContext, or qio_net_listener_set_client_func_full to wake
up the callback via the caller's own alternative GMainContext), and
synchronous (the user calls qio_net_listener_wait_client which creates
its own GMainContext and waits for the first client connection before
returning, with no need for a user's callback).  But commit 938c8b79
has a latent logic flaw: when qio_net_listener_wait_client finishes on
its temporary context, it reverts all of the siocs back to the global
GMainContext rather than the potentially non-NULL context they might
have been originally registered with.  Similarly, if the user creates
a net-listener, adds initial addresses, registers an async callback
with a non-default context (which ties to all siocs for the initial
addresses), then adds more addresses with qio_net_listener_add, the
siocs for later addresses are blindly placed in the global context,
rather than sharing the context of the earlier ones.

In practice, I don't think this has caused issues.  As pointed out by
the original commit, all async callers prior to that commit were
already okay with the NULL default context; and the typical usage
pattern is to first add ALL the addresses the listener will pay
attention to before ever setting the async callback.  Likewise, if a
file uses only qio_net_listener_set_client_func instead of
qio_net_listener_set_client_func_full, then it is never using a custom
context, so later assignments of async callbacks will still be to the
same global context as earlier ones.  Meanwhile, any callers that want
to do the sync operation to grab the first client are unlikely to
register an async callback; altogether bypassing the question of
whether later assignments of a GSource are being tied to a different
context over time.

I do note that chardev/char-socket.c is the only file that calls both
qio_net_listener_wait_client (sync for a single client in
tcp_chr_accept_server_sync), and qio_net_listener_set_client_func_full
(several places, all with chr->gcontext, but sometimes with a NULL
callback function during teardown).  But as far as I can tell, the two
uses are mutually exclusive, based on the is_waitconnect parameter to
qmp_chardev_open_socket_server.

That said, it is more robust to remember when an async callback
function is tied to a non-default context, and have both the sync wait
and any late address additions honor that same context.  That way, the
code will be robust even if a later user performs a sync wait for a
specific client in the middle of servicing a longer-lived
QIONetListener that has an async callback for all other clients.

CC: qemu-stable@nongnu.org
Fixes: 938c8b79 ("qio: store gsources for net listeners", v2.12.0)
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-19-eblake@redhat.com>
---
 include/io/net-listener.h |  1 +
 io/net-listener.c         | 25 ++++++++++++++++---------
 io/trace-events           |  6 +++---
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index ab9f291ed6..42fbfab546 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -50,6 +50,7 @@ struct QIONetListener {
     QIOChannelSocket **sioc;
     GSource **io_source;
     size_t nsioc;
+    GMainContext *context;
 
     bool connected;
 
diff --git a/io/net-listener.c b/io/net-listener.c
index d71b65270e..0f16b78fbb 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -51,7 +51,8 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
         return TRUE;
     }
 
-    trace_qio_net_listener_callback(listener, listener->io_func);
+    trace_qio_net_listener_callback(listener, listener->io_func,
+                                    listener->context);
     if (listener->io_func) {
         listener->io_func(listener, sioc, listener->io_data);
     }
@@ -125,13 +126,14 @@ void qio_net_listener_add(QIONetListener *listener,
     object_ref(OBJECT(sioc));
     listener->connected = true;
 
-    trace_qio_net_listener_watch(listener, listener->io_func, "add");
+    trace_qio_net_listener_watch(listener, listener->io_func,
+                                 listener->context, "add");
     if (listener->io_func != NULL) {
         object_ref(OBJECT(listener));
         listener->io_source[listener->nsioc] = qio_channel_add_watch_source(
             QIO_CHANNEL(listener->sioc[listener->nsioc]), G_IO_IN,
             qio_net_listener_channel_func,
-            listener, (GDestroyNotify)object_unref, NULL);
+            listener, (GDestroyNotify)object_unref, listener->context);
     }
 
     listener->nsioc++;
@@ -147,7 +149,8 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
     size_t i;
 
     trace_qio_net_listener_unwatch(listener, listener->io_func,
-                                   "set_client_func");
+                                   listener->context, "set_client_func");
+
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
@@ -162,9 +165,10 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
     listener->io_func = func;
     listener->io_data = data;
     listener->io_notify = notify;
+    listener->context = context;
 
     trace_qio_net_listener_watch(listener, listener->io_func,
-                                 "set_client_func");
+                                 listener->context, "set_client_func");
     if (listener->io_func != NULL) {
         for (i = 0; i < listener->nsioc; i++) {
             object_ref(OBJECT(listener));
@@ -225,7 +229,8 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     };
     size_t i;
 
-    trace_qio_net_listener_unwatch(listener, listener->io_func, "wait_client");
+    trace_qio_net_listener_unwatch(listener, listener->io_func,
+                                   listener->context, "wait_client");
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
@@ -255,14 +260,15 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     g_main_loop_unref(loop);
     g_main_context_unref(ctxt);
 
-    trace_qio_net_listener_watch(listener, listener->io_func, "wait_client");
+    trace_qio_net_listener_watch(listener, listener->io_func,
+                                 listener->context, "wait_client");
     if (listener->io_func != NULL) {
         for (i = 0; i < listener->nsioc; i++) {
             object_ref(OBJECT(listener));
             listener->io_source[i] = qio_channel_add_watch_source(
                 QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
                 qio_net_listener_channel_func,
-                listener, (GDestroyNotify)object_unref, NULL);
+                listener, (GDestroyNotify)object_unref, listener->context);
         }
     }
 
@@ -277,7 +283,8 @@ void qio_net_listener_disconnect(QIONetListener *listener)
         return;
     }
 
-    trace_qio_net_listener_unwatch(listener, listener->io_func, "disconnect");
+    trace_qio_net_listener_unwatch(listener, listener->io_func,
+                                   listener->context, "disconnect");
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
diff --git a/io/trace-events b/io/trace-events
index 10976eca5f..0cb77d579b 100644
--- a/io/trace-events
+++ b/io/trace-events
@@ -74,6 +74,6 @@ qio_channel_command_abort(void *ioc, int pid) "Command abort ioc=%p pid=%d"
 qio_channel_command_wait(void *ioc, int pid, int ret, int status) "Command abort ioc=%p pid=%d ret=%d status=%d"
 
 # net-listener.c
-qio_net_listener_watch(void *listener, void *func, const char *extra) "Net listener=%p watch enabled func=%p by %s"
-qio_net_listener_unwatch(void *listener, void *func, const char *extra) "Net listener=%p watch disabled func=%p by %s"
-qio_net_listener_callback(void *listener, void *func) "Net listener=%p callback forwarding to func=%p"
+qio_net_listener_watch(void *listener, void *func, void *ctx, const char *extra) "Net listener=%p watch enabled func=%p ctx=%p by %s"
+qio_net_listener_unwatch(void *listener, void *func, void *ctx, const char *extra) "Net listener=%p watch disabled func=%p ctx=%p by %s"
+qio_net_listener_callback(void *listener, void *func, void *ctx) "Net listener=%p callback forwarding to func=%p ctx=%p"

From 9d86181874ab7b0e95ae988f6f80715943c618c6 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:30 -0600
Subject: [PATCH 2109/2396] qio: Protect NetListener callback with mutex
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without a mutex, NetListener can run into this data race between a
thread changing the async callback callback function to use when a
client connects, and the thread servicing polling of the listening
sockets:

  Thread 1:
       qio_net_listener_set_client_func(lstnr, f1, ...);
           => foreach sock: socket
               => object_ref(lstnr)
               => sock_src = qio_channel_socket_add_watch_source(sock, ...., lstnr, object_unref);

  Thread 2:
       poll()
          => event POLLIN on socket
               => ref(GSourceCallback)
               => if (lstnr->io_func) // while lstnr->io_func is f1
                    ...interrupt..

  Thread 1:
       qio_net_listener_set_client_func(lstnr, f2, ...);
          => foreach sock: socket
               => g_source_unref(sock_src)
          => foreach sock: socket
               => object_ref(lstnr)
               => sock_src = qio_channel_socket_add_watch_source(sock, ...., lstnr, object_unref);

  Thread 2:
               => call lstnr->io_func(lstnr->io_data) // now sees f2
               => return dispatch(sock)
               => unref(GSourceCallback)
                  => destroy-notify
                     => object_unref

Found by inspection; I did not spend the time trying to add sleeps or
execute under gdb to try and actually trigger the race in practice.
This is a SEGFAULT waiting to happen if f2 can become NULL because
thread 1 deregisters the user's callback while thread 2 is trying to
service the callback.  Other messes are also theoretically possible,
such as running callback f1 with an opaque pointer that should only be
passed to f2 (if the client code were to use more than just a binary
choice between a single async function or NULL).

Mitigating factor: if the code that modifies the QIONetListener can
only be reached by the same thread that is executing the polling and
async callbacks, then we are not in a two-thread race documented above
(even though poll can see two clients trying to connect in the same
window of time, any changes made to the listener by the first async
callback will be completed before the thread moves on to the second
client).  However, QEMU is complex enough that this is hard to
generically analyze.  If QMP commands (like nbd-server-stop) are run
in the main loop and the listener uses the main loop, things should be
okay.  But when a client uses an alternative GMainContext, or if
servicing a QMP command hands off to a coroutine to avoid blocking, I
am unable to state with certainty whether a given net listener can be
modified by a thread different from the polling thread running
callbacks.

At any rate, it is worth having the API be robust.  To ensure that
modifying a NetListener can be safely done from any thread, add a
mutex that guarantees atomicity to all members of a listener object
related to callbacks.  This problem has been present since
QIONetListener was introduced.

Note that this does NOT prevent the case of a second round of the
user's old async callback being invoked with the old opaque data, even
when the user has already tried to change the async callback during
the first async callback; it is only about ensuring that there is no
sharding (the eventual io_func(io_data) call that does get made will
correspond to a particular combination that the user had requested at
some point in time, and not be sharded to a combination that never
existed in practice).  In other words, this patch maintains the status
quo that a user's async callback function already needs to be robust
to parallel clients landing in the same window of poll servicing, even
when only one client is desired, if that particular listener can be
amended in a thread other than the one doing the polling.

CC: qemu-stable@nongnu.org
Fixes: 53047392 ("io: introduce a network socket listener API", v2.12.0)
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251113011625.878876-20-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
[eblake: minor commit message wording improvements]
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 include/io/net-listener.h |  1 +
 io/net-listener.c         | 58 +++++++++++++++++++++++++++++----------
 2 files changed, 44 insertions(+), 15 deletions(-)

diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index 42fbfab546..c2165dc166 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -54,6 +54,7 @@ struct QIONetListener {
 
     bool connected;
 
+    QemuMutex lock; /* Protects remaining fields */
     QIONetListenerClientFunc io_func;
     gpointer io_data;
     GDestroyNotify io_notify;
diff --git a/io/net-listener.c b/io/net-listener.c
index 0f16b78fbb..f70acdfc5c 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -23,11 +23,16 @@
 #include "io/dns-resolver.h"
 #include "qapi/error.h"
 #include "qemu/module.h"
+#include "qemu/lockable.h"
 #include "trace.h"
 
 QIONetListener *qio_net_listener_new(void)
 {
-    return QIO_NET_LISTENER(object_new(TYPE_QIO_NET_LISTENER));
+    QIONetListener *listener;
+
+    listener = QIO_NET_LISTENER(object_new(TYPE_QIO_NET_LISTENER));
+    qemu_mutex_init(&listener->lock);
+    return listener;
 }
 
 void qio_net_listener_set_name(QIONetListener *listener,
@@ -44,6 +49,9 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
 {
     QIONetListener *listener = QIO_NET_LISTENER(opaque);
     QIOChannelSocket *sioc;
+    QIONetListenerClientFunc io_func;
+    gpointer io_data;
+    GMainContext *context;
 
     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc),
                                      NULL);
@@ -51,10 +59,15 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
         return TRUE;
     }
 
-    trace_qio_net_listener_callback(listener, listener->io_func,
-                                    listener->context);
-    if (listener->io_func) {
-        listener->io_func(listener, sioc, listener->io_data);
+    WITH_QEMU_LOCK_GUARD(&listener->lock) {
+        io_func = listener->io_func;
+        io_data = listener->io_data;
+        context = listener->context;
+    }
+
+    trace_qio_net_listener_callback(listener, io_func, context);
+    if (io_func) {
+        io_func(listener, sioc, io_data);
     }
 
     object_unref(OBJECT(sioc));
@@ -111,6 +124,9 @@ int qio_net_listener_open_sync(QIONetListener *listener,
 void qio_net_listener_add(QIONetListener *listener,
                           QIOChannelSocket *sioc)
 {
+    QIONetListenerClientFunc io_func;
+    GMainContext *context;
+
     if (listener->name) {
         qio_channel_set_name(QIO_CHANNEL(sioc), listener->name);
     }
@@ -126,14 +142,18 @@ void qio_net_listener_add(QIONetListener *listener,
     object_ref(OBJECT(sioc));
     listener->connected = true;
 
-    trace_qio_net_listener_watch(listener, listener->io_func,
-                                 listener->context, "add");
-    if (listener->io_func != NULL) {
+    WITH_QEMU_LOCK_GUARD(&listener->lock) {
+        io_func = listener->io_func;
+        context = listener->context;
+    }
+
+    trace_qio_net_listener_watch(listener, io_func, context, "add");
+    if (io_func) {
         object_ref(OBJECT(listener));
         listener->io_source[listener->nsioc] = qio_channel_add_watch_source(
             QIO_CHANNEL(listener->sioc[listener->nsioc]), G_IO_IN,
             qio_net_listener_channel_func,
-            listener, (GDestroyNotify)object_unref, listener->context);
+            listener, (GDestroyNotify)object_unref, context);
     }
 
     listener->nsioc++;
@@ -148,6 +168,7 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
 {
     size_t i;
 
+    QEMU_LOCK_GUARD(&listener->lock);
     trace_qio_net_listener_unwatch(listener, listener->io_func,
                                    listener->context, "set_client_func");
 
@@ -228,9 +249,15 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
         .loop = loop
     };
     size_t i;
+    QIONetListenerClientFunc io_func;
+    GMainContext *context;
 
-    trace_qio_net_listener_unwatch(listener, listener->io_func,
-                                   listener->context, "wait_client");
+    WITH_QEMU_LOCK_GUARD(&listener->lock) {
+        io_func = listener->io_func;
+        context = listener->context;
+    }
+
+    trace_qio_net_listener_unwatch(listener, io_func, context, "wait_client");
     for (i = 0; i < listener->nsioc; i++) {
         if (listener->io_source[i]) {
             g_source_destroy(listener->io_source[i]);
@@ -260,15 +287,14 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     g_main_loop_unref(loop);
     g_main_context_unref(ctxt);
 
-    trace_qio_net_listener_watch(listener, listener->io_func,
-                                 listener->context, "wait_client");
-    if (listener->io_func != NULL) {
+    trace_qio_net_listener_watch(listener, io_func, context, "wait_client");
+    if (io_func != NULL) {
         for (i = 0; i < listener->nsioc; i++) {
             object_ref(OBJECT(listener));
             listener->io_source[i] = qio_channel_add_watch_source(
                 QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
                 qio_net_listener_channel_func,
-                listener, (GDestroyNotify)object_unref, listener->context);
+                listener, (GDestroyNotify)object_unref, context);
         }
     }
 
@@ -283,6 +309,7 @@ void qio_net_listener_disconnect(QIONetListener *listener)
         return;
     }
 
+    QEMU_LOCK_GUARD(&listener->lock);
     trace_qio_net_listener_unwatch(listener, listener->io_func,
                                    listener->context, "disconnect");
     for (i = 0; i < listener->nsioc; i++) {
@@ -318,6 +345,7 @@ static void qio_net_listener_finalize(Object *obj)
     g_free(listener->io_source);
     g_free(listener->sioc);
     g_free(listener->name);
+    qemu_mutex_destroy(&listener->lock);
 }
 
 static const TypeInfo qio_net_listener_info = {

From 36769aeedf6dbd56eda16f0c6e3032d937896fdc Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:31 -0600
Subject: [PATCH 2110/2396] qio: Minor optimization when callback function is
 unchanged
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In qemu-nbd and other NBD server setups where parallel clients are
supported, it is common that the caller will re-register the same
callback function as long as it has not reached its limit on
simultaneous clients.  In that case, there is no need to tear down and
reinstall GSource watches in the GMainContext.

In practice, all existing callers currently pass NULL for notify, and
no caller ever changes context across calls (for async uses, either
the caller consistently uses qio_net_listener_set_client_func_full
with the same context, or the caller consistently uses only
qio_net_listener_set_client_func which always uses the global
context); but the time spent checking these two fields in addition to
the more important func and data is still less than the savings of not
churning through extra GSource manipulations when the result will be
unchanged.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-21-eblake@redhat.com>
---
 io/net-listener.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/io/net-listener.c b/io/net-listener.c
index f70acdfc5c..93100a2d25 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -169,6 +169,11 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
     size_t i;
 
     QEMU_LOCK_GUARD(&listener->lock);
+    if (listener->io_func == func && listener->io_data == data &&
+        listener->io_notify == notify && listener->context == context) {
+        return;
+    }
+
     trace_qio_net_listener_unwatch(listener, listener->io_func,
                                    listener->context, "set_client_func");
 

From e685dd26c7afbf2461dfb4d51a699b9a10824114 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:32 -0600
Subject: [PATCH 2111/2396] qio: Factor out helpers qio_net_listener_[un]watch
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code had three similar repetitions of an iteration over one or all
of nsiocs to set up a GSource, and likewise for teardown.  Since an
upcoming patch wants to tweak whether GSource or AioContext is used,
it's better to consolidate that into one helper function for fewer
places to edit later.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251113011625.878876-22-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 io/net-listener.c | 122 ++++++++++++++++++++--------------------------
 1 file changed, 52 insertions(+), 70 deletions(-)

diff --git a/io/net-listener.c b/io/net-listener.c
index 93100a2d25..9a94b15327 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -120,13 +120,54 @@ int qio_net_listener_open_sync(QIONetListener *listener,
     }
 }
 
+/*
+ * i == 0 to set watch on entire array, non-zero to only set watch on
+ * recent additions when earlier entries are already watched.
+ *
+ * listener->lock must be held by caller.
+ */
+static void
+qio_net_listener_watch(QIONetListener *listener, size_t i, const char *caller)
+{
+    if (!listener->io_func) {
+        return;
+    }
+
+    trace_qio_net_listener_watch(listener, listener->io_func,
+                                 listener->context, caller);
+    for ( ; i < listener->nsioc; i++) {
+        object_ref(OBJECT(listener));
+        listener->io_source[i] = qio_channel_add_watch_source(
+            QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
+            qio_net_listener_channel_func,
+            listener, (GDestroyNotify)object_unref, listener->context);
+    }
+}
+
+/* listener->lock must be held by caller. */
+static void
+qio_net_listener_unwatch(QIONetListener *listener, const char *caller)
+{
+    size_t i;
+
+    if (!listener->io_func) {
+        return;
+    }
+
+    trace_qio_net_listener_unwatch(listener, listener->io_func,
+                                   listener->context, caller);
+    for (i = 0; i < listener->nsioc; i++) {
+        if (listener->io_source[i]) {
+            g_source_destroy(listener->io_source[i]);
+            g_source_unref(listener->io_source[i]);
+            listener->io_source[i] = NULL;
+        }
+    }
+}
 
 void qio_net_listener_add(QIONetListener *listener,
                           QIOChannelSocket *sioc)
 {
-    QIONetListenerClientFunc io_func;
-    GMainContext *context;
-
     if (listener->name) {
         qio_channel_set_name(QIO_CHANNEL(sioc), listener->name);
     }
@@ -142,21 +183,9 @@ void qio_net_listener_add(QIONetListener *listener,
     object_ref(OBJECT(sioc));
     listener->connected = true;
 
-    WITH_QEMU_LOCK_GUARD(&listener->lock) {
-        io_func = listener->io_func;
-        context = listener->context;
-    }
-
-    trace_qio_net_listener_watch(listener, io_func, context, "add");
-    if (io_func) {
-        object_ref(OBJECT(listener));
-        listener->io_source[listener->nsioc] = qio_channel_add_watch_source(
-            QIO_CHANNEL(listener->sioc[listener->nsioc]), G_IO_IN,
-            qio_net_listener_channel_func,
-            listener, (GDestroyNotify)object_unref, context);
-    }
-
+    QEMU_LOCK_GUARD(&listener->lock);
     listener->nsioc++;
+    qio_net_listener_watch(listener, listener->nsioc - 1, "add");
 }
 
 
@@ -166,25 +195,13 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
                                            GDestroyNotify notify,
                                            GMainContext *context)
 {
-    size_t i;
-
     QEMU_LOCK_GUARD(&listener->lock);
     if (listener->io_func == func && listener->io_data == data &&
         listener->io_notify == notify && listener->context == context) {
         return;
     }
 
-    trace_qio_net_listener_unwatch(listener, listener->io_func,
-                                   listener->context, "set_client_func");
-
-    for (i = 0; i < listener->nsioc; i++) {
-        if (listener->io_source[i]) {
-            g_source_destroy(listener->io_source[i]);
-            g_source_unref(listener->io_source[i]);
-            listener->io_source[i] = NULL;
-        }
-    }
-
+    qio_net_listener_unwatch(listener, "set_client_func");
     if (listener->io_notify) {
         listener->io_notify(listener->io_data);
     }
@@ -193,17 +210,7 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
     listener->io_notify = notify;
     listener->context = context;
 
-    trace_qio_net_listener_watch(listener, listener->io_func,
-                                 listener->context, "set_client_func");
-    if (listener->io_func != NULL) {
-        for (i = 0; i < listener->nsioc; i++) {
-            object_ref(OBJECT(listener));
-            listener->io_source[i] = qio_channel_add_watch_source(
-                QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
-                qio_net_listener_channel_func,
-                listener, (GDestroyNotify)object_unref, context);
-        }
-    }
+    qio_net_listener_watch(listener, 0, "set_client_func");
 }
 
 void qio_net_listener_set_client_func(QIONetListener *listener,
@@ -254,21 +261,9 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
         .loop = loop
     };
     size_t i;
-    QIONetListenerClientFunc io_func;
-    GMainContext *context;
 
     WITH_QEMU_LOCK_GUARD(&listener->lock) {
-        io_func = listener->io_func;
-        context = listener->context;
-    }
-
-    trace_qio_net_listener_unwatch(listener, io_func, context, "wait_client");
-    for (i = 0; i < listener->nsioc; i++) {
-        if (listener->io_source[i]) {
-            g_source_destroy(listener->io_source[i]);
-            g_source_unref(listener->io_source[i]);
-            listener->io_source[i] = NULL;
-        }
+        qio_net_listener_unwatch(listener, "wait_client");
     }
 
     sources = g_new0(GSource *, listener->nsioc);
@@ -292,15 +287,8 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
     g_main_loop_unref(loop);
     g_main_context_unref(ctxt);
 
-    trace_qio_net_listener_watch(listener, io_func, context, "wait_client");
-    if (io_func != NULL) {
-        for (i = 0; i < listener->nsioc; i++) {
-            object_ref(OBJECT(listener));
-            listener->io_source[i] = qio_channel_add_watch_source(
-                QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
-                qio_net_listener_channel_func,
-                listener, (GDestroyNotify)object_unref, context);
-        }
+    WITH_QEMU_LOCK_GUARD(&listener->lock) {
+        qio_net_listener_watch(listener, 0, "wait_client");
     }
 
     return data.sioc;
@@ -315,14 +303,8 @@ void qio_net_listener_disconnect(QIONetListener *listener)
     }
 
     QEMU_LOCK_GUARD(&listener->lock);
-    trace_qio_net_listener_unwatch(listener, listener->io_func,
-                                   listener->context, "disconnect");
+    qio_net_listener_unwatch(listener, "disconnect");
     for (i = 0; i < listener->nsioc; i++) {
-        if (listener->io_source[i]) {
-            g_source_destroy(listener->io_source[i]);
-            g_source_unref(listener->io_source[i]);
-            listener->io_source[i] = NULL;
-        }
         qio_channel_close(QIO_CHANNEL(listener->sioc[i]), NULL);
     }
     listener->connected = false;

From dfeadf82c2b428d1c7f59d4b573588095630d99e Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:33 -0600
Subject: [PATCH 2112/2396] chardev: Reuse channel's cached local address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Directly accessing the fd member of a QIOChannelSocket is an
undesirable leaky abstraction.  What's more, grabbing that fd merely
to force an eventual call to getsockname() can be wasteful, since the
channel is often able to return its cached local name.

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251113011625.878876-23-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-socket.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 62852e3caf..ec4116ade4 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1255,7 +1255,7 @@ static int qmp_chardev_open_socket_server(Chardev *chr,
     }
 
     qapi_free_SocketAddress(s->addr);
-    s->addr = socket_local_address(s->listener->sioc[0]->fd, errp);
+    s->addr = qio_channel_socket_get_local_address(s->listener->sioc[0], errp);
 
 skip_listen:
     update_disconnected_filename(s);

From ec59a65a4db79297ca155738a2a7358204696f12 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:34 -0600
Subject: [PATCH 2113/2396] qio: Provide accessor around QIONetListener->sioc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

An upcoming patch needs to pass more than just sioc as the opaque
pointer to an AioContext; but since our AioContext code in general
(and its QIO Channel wrapper code) lacks a notify callback present
with GSource, we do not have the trivial option of just g_malloc'ing a
small struct to hold all that data coupled with a notify of g_free.
Instead, the data pointer must outlive the registered handler; in
fact, having the data pointer have the same lifetime as QIONetListener
is adequate.

But the cleanest way to stick such a helper struct in QIONetListener
will be to rearrange internal struct members.  And that in turn means
that all existing code that currently directly accesses
listener->nsioc and listener->sioc[] should instead go through
accessor functions, to be immune to the upcoming struct layout
changes.  So this patch adds accessor methods qio_net_listener_nsioc()
and qio_net_listener_sioc(), and puts them to use.

While at it, notice that the pattern of grabbing an sioc from the
listener only to turn around can call
qio_channel_socket_get_local_address is common enough to also warrant
the helper of qio_net_listener_get_local_address, and fix a copy-paste
error in the corresponding documentation.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251113011625.878876-24-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 chardev/char-socket.c       |  2 +-
 include/io/channel-socket.h |  2 +-
 include/io/net-listener.h   | 42 +++++++++++++++++++++++++++++++++++++
 io/net-listener.c           | 27 ++++++++++++++++++++++++
 migration/socket.c          |  4 ++--
 ui/vnc.c                    | 34 ++++++++++++++++++------------
 6 files changed, 94 insertions(+), 17 deletions(-)

diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index ec4116ade4..26d2f11202 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1255,7 +1255,7 @@ static int qmp_chardev_open_socket_server(Chardev *chr,
     }
 
     qapi_free_SocketAddress(s->addr);
-    s->addr = qio_channel_socket_get_local_address(s->listener->sioc[0], errp);
+    s->addr = qio_net_listener_get_local_address(s->listener, 0, errp);
 
 skip_listen:
     update_disconnected_filename(s);
diff --git a/include/io/channel-socket.h b/include/io/channel-socket.h
index fcfd489c6c..a1ef3136ea 100644
--- a/include/io/channel-socket.h
+++ b/include/io/channel-socket.h
@@ -228,7 +228,7 @@ void qio_channel_socket_dgram_async(QIOChannelSocket *ioc,
  * release with a call qapi_free_SocketAddress() when no
  * longer required.
  *
- * Returns: 0 on success, -1 on error
+ * Returns: the socket address struct, or NULL on error
  */
 SocketAddress *
 qio_channel_socket_get_local_address(QIOChannelSocket *ioc,
diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index c2165dc166..95bc7407d6 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -185,4 +185,46 @@ void qio_net_listener_disconnect(QIONetListener *listener);
  */
 bool qio_net_listener_is_connected(QIONetListener *listener);
 
+
+/**
+ * qio_net_listener_nsioc:
+ * @listener: the network listener object
+ *
+ * Determine the number of listener channels currently owned by the
+ * given listener.
+ *
+ * Returns: number of channels, or 0 if not listening
+ */
+size_t qio_net_listener_nsioc(QIONetListener *listener);
+
+
+/**
+ * qio_net_listener_sioc:
+ * @listener: the network listener object
+ * @n: index of the sioc to grab
+ *
+ * Accessor for the nth sioc owned by the listener.
+ *
+ * Returns: the requested listener, or NULL if not in bounds
+ */
+QIOChannelSocket *qio_net_listener_sioc(QIONetListener *listener, size_t n);
+
+/**
+ * qio_net_listener_get_local_address:
+ * @listener: the network listener object
+ * @n: index of the sioc to grab
+ * @errp: pointer to a NULL-initialized error object
+ *
+ * Get the string representation of the local socket
+ * address. A pointer to the allocated address information
+ * struct will be returned, which the caller is required to
+ * release with a call qapi_free_SocketAddress() when no
+ * longer required.
+ *
+ * Returns: the socket address struct, or NULL on error
+ */
+SocketAddress *
+qio_net_listener_get_local_address(QIONetListener *listener, size_t n,
+                                   Error **errp);
+
 #endif /* QIO_NET_LISTENER_H */
diff --git a/io/net-listener.c b/io/net-listener.c
index 9a94b15327..9ffbc141a7 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -316,6 +316,33 @@ bool qio_net_listener_is_connected(QIONetListener *listener)
     return listener->connected;
 }
 
+size_t qio_net_listener_nsioc(QIONetListener *listener)
+{
+    return listener->nsioc;
+}
+
+QIOChannelSocket *qio_net_listener_sioc(QIONetListener *listener, size_t n)
+{
+    if (n >= listener->nsioc) {
+        return NULL;
+    }
+    return listener->sioc[n];
+}
+
+SocketAddress *
+qio_net_listener_get_local_address(QIONetListener *listener, size_t n,
+                                   Error **errp)
+{
+    QIOChannelSocket *sioc = qio_net_listener_sioc(listener, n);
+
+    if (!sioc) {
+        error_setg(errp, "Listener index out of range");
+        return NULL;
+    }
+
+    return qio_channel_socket_get_local_address(sioc, errp);
+}
+
 static void qio_net_listener_finalize(Object *obj)
 {
     QIONetListener *listener = QIO_NET_LISTENER(obj);
diff --git a/migration/socket.c b/migration/socket.c
index 5ec65b8c03..9e379bf56f 100644
--- a/migration/socket.c
+++ b/migration/socket.c
@@ -170,9 +170,9 @@ void socket_start_incoming_migration(SocketAddress *saddr,
                                           NULL, NULL,
                                           g_main_context_get_thread_default());
 
-    for (i = 0; i < listener->nsioc; i++)  {
+    for (i = 0; i < qio_net_listener_nsioc(listener); i++)  {
         SocketAddress *address =
-            qio_channel_socket_get_local_address(listener->sioc[i], errp);
+            qio_net_listener_get_local_address(listener, i, errp);
         if (!address) {
             return;
         }
diff --git a/ui/vnc.c b/ui/vnc.c
index 50016ff7ab..0d499b208b 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -235,12 +235,12 @@ static VncServerInfo *vnc_server_info_get(VncDisplay *vd)
     VncServerInfo *info;
     Error *err = NULL;
 
-    if (!vd->listener || !vd->listener->nsioc) {
+    if (!vd->listener || !qio_net_listener_nsioc(vd->listener)) {
         return NULL;
     }
 
     info = g_malloc0(sizeof(*info));
-    vnc_init_basic_info_from_server_addr(vd->listener->sioc[0],
+    vnc_init_basic_info_from_server_addr(qio_net_listener_sioc(vd->listener, 0),
                                          qapi_VncServerInfo_base(info), &err);
     info->auth = g_strdup(vnc_auth_name(vd));
     if (err) {
@@ -377,7 +377,7 @@ VncInfo *qmp_query_vnc(Error **errp)
     VncDisplay *vd = vnc_display_find(NULL);
     SocketAddress *addr = NULL;
 
-    if (vd == NULL || !vd->listener || !vd->listener->nsioc) {
+    if (vd == NULL || !vd->listener || !qio_net_listener_nsioc(vd->listener)) {
         info->enabled = false;
     } else {
         info->enabled = true;
@@ -386,8 +386,7 @@ VncInfo *qmp_query_vnc(Error **errp)
         info->has_clients = true;
         info->clients = qmp_query_client_list(vd);
 
-        addr = qio_channel_socket_get_local_address(vd->listener->sioc[0],
-                                                    errp);
+        addr = qio_net_listener_get_local_address(vd->listener, 0, errp);
         if (!addr) {
             goto out_error;
         }
@@ -549,6 +548,8 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp)
     size_t i;
 
     QTAILQ_FOREACH(vd, &vnc_displays, next) {
+        size_t nsioc = 0;
+
         info = g_new0(VncInfo2, 1);
         info->id = g_strdup(vd->id);
         info->clients = qmp_query_client_list(vd);
@@ -559,14 +560,21 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp)
                                                   "device", &error_abort));
             info->display = g_strdup(dev->id);
         }
-        for (i = 0; vd->listener != NULL && i < vd->listener->nsioc; i++) {
-            info->server = qmp_query_server_entry(
-                vd->listener->sioc[i], false, vd->auth, vd->subauth,
-                info->server);
+        if (vd->listener != NULL) {
+            nsioc = qio_net_listener_nsioc(vd->listener);
         }
-        for (i = 0; vd->wslistener != NULL && i < vd->wslistener->nsioc; i++) {
+        for (i = 0; i < nsioc; i++) {
             info->server = qmp_query_server_entry(
-                vd->wslistener->sioc[i], true, vd->ws_auth,
+                qio_net_listener_sioc(vd->listener, i), false, vd->auth,
+                vd->subauth, info->server);
+        }
+        nsioc = 0;
+        if (vd->wslistener) {
+            nsioc = qio_net_listener_nsioc(vd->wslistener);
+        }
+        for (i = 0; i < nsioc; i++) {
+            info->server = qmp_query_server_entry(
+                qio_net_listener_sioc(vd->wslistener, i), true, vd->ws_auth,
                 vd->ws_subauth, info->server);
         }
 
@@ -3550,11 +3558,11 @@ static void vnc_display_print_local_addr(VncDisplay *vd)
 {
     SocketAddress *addr;
 
-    if (!vd->listener || !vd->listener->nsioc) {
+    if (!vd->listener || !qio_net_listener_nsioc(vd->listener)) {
         return;
     }
 
-    addr = qio_channel_socket_get_local_address(vd->listener->sioc[0], NULL);
+    addr = qio_net_listener_get_local_address(vd->listener, 0, NULL);
     if (!addr) {
         return;
     }

From cc0faf8273f090a44429be0365cd476efc2d63a2 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:35 -0600
Subject: [PATCH 2114/2396] qio: Prepare NetListener to use AioContext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For ease of review, this patch adds an AioContext pointer to the
QIONetListener struct, the code to trace it, and refactors
listener->io_source to instead be an array of utility structs; but the
aio_context pointer is always NULL until the next patch adds an API to
set it.  There should be no semantic change in this patch.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-25-eblake@redhat.com>
---
 include/io/net-listener.h |   6 ++-
 io/net-listener.c         | 105 ++++++++++++++++++++++++++------------
 io/trace-events           |   6 +--
 3 files changed, 78 insertions(+), 39 deletions(-)

diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index 95bc7407d6..93608f7fe8 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -28,6 +28,7 @@
 OBJECT_DECLARE_SIMPLE_TYPE(QIONetListener,
                            QIO_NET_LISTENER)
 
+typedef struct QIONetListenerSource QIONetListenerSource;
 
 typedef void (*QIONetListenerClientFunc)(QIONetListener *listener,
                                          QIOChannelSocket *sioc,
@@ -47,10 +48,11 @@ struct QIONetListener {
     Object parent;
 
     char *name;
-    QIOChannelSocket **sioc;
-    GSource **io_source;
+    QIONetListenerSource **source;
     size_t nsioc;
+    /* At most one of context or aio_context will be set */
     GMainContext *context;
+    AioContext *aio_context;
 
     bool connected;
 
diff --git a/io/net-listener.c b/io/net-listener.c
index 9ffbc141a7..49399ec926 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -24,8 +24,15 @@
 #include "qapi/error.h"
 #include "qemu/module.h"
 #include "qemu/lockable.h"
+#include "qemu/main-loop.h"
 #include "trace.h"
 
+struct QIONetListenerSource {
+    QIOChannelSocket *sioc;
+    GSource *io_source;
+    QIONetListener *listener;
+};
+
 QIONetListener *qio_net_listener_new(void)
 {
     QIONetListener *listener;
@@ -52,6 +59,7 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
     QIONetListenerClientFunc io_func;
     gpointer io_data;
     GMainContext *context;
+    AioContext *aio_context;
 
     sioc = qio_channel_socket_accept(QIO_CHANNEL_SOCKET(ioc),
                                      NULL);
@@ -63,9 +71,10 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
         io_func = listener->io_func;
         io_data = listener->io_data;
         context = listener->context;
+        aio_context = listener->aio_context;
     }
 
-    trace_qio_net_listener_callback(listener, io_func, context);
+    trace_qio_net_listener_callback(listener, io_func, context, aio_context);
     if (io_func) {
         io_func(listener, sioc, io_data);
     }
@@ -134,13 +143,23 @@ qio_net_listener_watch(QIONetListener *listener, size_t i, const char *caller)
     }
 
     trace_qio_net_listener_watch(listener, listener->io_func,
-                                 listener->context, caller);
+                                 listener->context, listener->aio_context,
+                                 caller);
     for ( ; i < listener->nsioc; i++) {
-        object_ref(OBJECT(listener));
-        listener->io_source[i] = qio_channel_add_watch_source(
-            QIO_CHANNEL(listener->sioc[i]), G_IO_IN,
-            qio_net_listener_channel_func,
-            listener, (GDestroyNotify)object_unref, listener->context);
+        if (!listener->aio_context) {
+            /*
+             * The user passed a GMainContext with the async callback;
+             * they plan on running the default or their own g_main_loop.
+             */
+            object_ref(OBJECT(listener));
+            listener->source[i]->io_source = qio_channel_add_watch_source(
+                QIO_CHANNEL(listener->source[i]->sioc), G_IO_IN,
+                qio_net_listener_channel_func,
+                listener, (GDestroyNotify)object_unref, listener->context);
+        } else {
+            /* The user passed an AioContext. Not supported yet. */
+            g_assert_not_reached();
+        }
     }
 }
 
@@ -155,12 +174,17 @@ qio_net_listener_unwatch(QIONetListener *listener, const char *caller)
     }
 
     trace_qio_net_listener_unwatch(listener, listener->io_func,
-                                   listener->context, caller);
+                                   listener->context, listener->aio_context,
+                                   caller);
     for (i = 0; i < listener->nsioc; i++) {
-        if (listener->io_source[i]) {
-            g_source_destroy(listener->io_source[i]);
-            g_source_unref(listener->io_source[i]);
-            listener->io_source[i] = NULL;
+        if (!listener->aio_context) {
+            if (listener->source[i]->io_source) {
+                g_source_destroy(listener->source[i]->io_source);
+                g_source_unref(listener->source[i]->io_source);
+                listener->source[i]->io_source = NULL;
+            }
+        } else {
+            g_assert_not_reached();
         }
     }
 }
@@ -172,13 +196,12 @@ void qio_net_listener_add(QIONetListener *listener,
         qio_channel_set_name(QIO_CHANNEL(sioc), listener->name);
     }
 
-    listener->sioc = g_renew(QIOChannelSocket *, listener->sioc,
-                             listener->nsioc + 1);
-    listener->io_source = g_renew(typeof(listener->io_source[0]),
-                                  listener->io_source,
-                                  listener->nsioc + 1);
-    listener->sioc[listener->nsioc] = sioc;
-    listener->io_source[listener->nsioc] = NULL;
+    listener->source = g_renew(typeof(listener->source[0]),
+                               listener->source,
+                               listener->nsioc + 1);
+    listener->source[listener->nsioc] = g_new0(QIONetListenerSource, 1);
+    listener->source[listener->nsioc]->sioc = sioc;
+    listener->source[listener->nsioc]->listener = listener;
 
     object_ref(OBJECT(sioc));
     listener->connected = true;
@@ -189,15 +212,18 @@ void qio_net_listener_add(QIONetListener *listener,
 }
 
 
-void qio_net_listener_set_client_func_full(QIONetListener *listener,
-                                           QIONetListenerClientFunc func,
-                                           gpointer data,
-                                           GDestroyNotify notify,
-                                           GMainContext *context)
+static void
+qio_net_listener_set_client_func_internal(QIONetListener *listener,
+                                          QIONetListenerClientFunc func,
+                                          gpointer data,
+                                          GDestroyNotify notify,
+                                          GMainContext *context,
+                                          AioContext *aio_context)
 {
     QEMU_LOCK_GUARD(&listener->lock);
     if (listener->io_func == func && listener->io_data == data &&
-        listener->io_notify == notify && listener->context == context) {
+        listener->io_notify == notify && listener->context == context &&
+        listener->aio_context == aio_context) {
         return;
     }
 
@@ -209,17 +235,28 @@ void qio_net_listener_set_client_func_full(QIONetListener *listener,
     listener->io_data = data;
     listener->io_notify = notify;
     listener->context = context;
+    listener->aio_context = aio_context;
 
     qio_net_listener_watch(listener, 0, "set_client_func");
 }
 
+void qio_net_listener_set_client_func_full(QIONetListener *listener,
+                                           QIONetListenerClientFunc func,
+                                           gpointer data,
+                                           GDestroyNotify notify,
+                                           GMainContext *context)
+{
+    qio_net_listener_set_client_func_internal(listener, func, data,
+                                              notify, context, NULL);
+}
+
 void qio_net_listener_set_client_func(QIONetListener *listener,
                                       QIONetListenerClientFunc func,
                                       gpointer data,
                                       GDestroyNotify notify)
 {
-    qio_net_listener_set_client_func_full(listener, func, data,
-                                          notify, NULL);
+    qio_net_listener_set_client_func_internal(listener, func, data,
+                                              notify, NULL, NULL);
 }
 
 struct QIONetListenerClientWaitData {
@@ -268,8 +305,8 @@ QIOChannelSocket *qio_net_listener_wait_client(QIONetListener *listener)
 
     sources = g_new0(GSource *, listener->nsioc);
     for (i = 0; i < listener->nsioc; i++) {
-        sources[i] = qio_channel_create_watch(QIO_CHANNEL(listener->sioc[i]),
-                                              G_IO_IN);
+        sources[i] = qio_channel_create_watch(
+            QIO_CHANNEL(listener->source[i]->sioc), G_IO_IN);
 
         g_source_set_callback(sources[i],
                               (GSourceFunc)qio_net_listener_wait_client_func,
@@ -305,7 +342,7 @@ void qio_net_listener_disconnect(QIONetListener *listener)
     QEMU_LOCK_GUARD(&listener->lock);
     qio_net_listener_unwatch(listener, "disconnect");
     for (i = 0; i < listener->nsioc; i++) {
-        qio_channel_close(QIO_CHANNEL(listener->sioc[i]), NULL);
+        qio_channel_close(QIO_CHANNEL(listener->source[i]->sioc), NULL);
     }
     listener->connected = false;
 }
@@ -326,7 +363,7 @@ QIOChannelSocket *qio_net_listener_sioc(QIONetListener *listener, size_t n)
     if (n >= listener->nsioc) {
         return NULL;
     }
-    return listener->sioc[n];
+    return listener->source[n]->sioc;
 }
 
 SocketAddress *
@@ -354,10 +391,10 @@ static void qio_net_listener_finalize(Object *obj)
     }
 
     for (i = 0; i < listener->nsioc; i++) {
-        object_unref(OBJECT(listener->sioc[i]));
+        object_unref(OBJECT(listener->source[i]->sioc));
+        g_free(listener->source[i]);
     }
-    g_free(listener->io_source);
-    g_free(listener->sioc);
+    g_free(listener->source);
     g_free(listener->name);
     qemu_mutex_destroy(&listener->lock);
 }
diff --git a/io/trace-events b/io/trace-events
index 0cb77d579b..ec91453335 100644
--- a/io/trace-events
+++ b/io/trace-events
@@ -74,6 +74,6 @@ qio_channel_command_abort(void *ioc, int pid) "Command abort ioc=%p pid=%d"
 qio_channel_command_wait(void *ioc, int pid, int ret, int status) "Command abort ioc=%p pid=%d ret=%d status=%d"
 
 # net-listener.c
-qio_net_listener_watch(void *listener, void *func, void *ctx, const char *extra) "Net listener=%p watch enabled func=%p ctx=%p by %s"
-qio_net_listener_unwatch(void *listener, void *func, void *ctx, const char *extra) "Net listener=%p watch disabled func=%p ctx=%p by %s"
-qio_net_listener_callback(void *listener, void *func, void *ctx) "Net listener=%p callback forwarding to func=%p ctx=%p"
+qio_net_listener_watch(void *listener, void *func, void *gctx, void *actx, const char *extra) "Net listener=%p watch enabled func=%p ctx=%p/%p by %s"
+qio_net_listener_unwatch(void *listener, void *func, void *gctx, void *actx, const char *extra) "Net listener=%p watch disabled func=%p ctx=%p/%p by %s"
+qio_net_listener_callback(void *listener, void *func, void *gctx, void *actx) "Net listener=%p callback forwarding to func=%p ctx=%p/%p"

From de252f7993bb0a258537c7d3359bb524c6122ae3 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:36 -0600
Subject: [PATCH 2115/2396] qio: Add QIONetListener API for using AioContext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The user calling himself "John Doe" reported a deadlock when
attempting to use qemu-storage-daemon to serve both a base file over
NBD, and a qcow2 file with that NBD export as its backing file, from
the same process, even though it worked just fine when there were two
q-s-d processes.  The bulk of the NBD server code properly uses
coroutines to make progress in an event-driven manner, but the code
for spawning a new coroutine at the point when listen(2) detects a new
client was hard-coded to use the global GMainContext; in other words,
the callback that triggers nbd_client_new to let the server start the
negotiation sequence with the client requires the main loop to be
making progress.  However, the code for bdrv_open of a qcow2 image
with an NBD backing file uses an AIO_WAIT_WHILE nested event loop to
ensure that the entire qcow2 backing chain is either fully loaded or
rejected, without any side effects from the main loop causing unwanted
changes to the disk being loaded (in short, an AioContext represents
the set of actions that are known to be safe while handling block
layer I/O, while excluding any other pending actions in the global
main loop with potentially larger risk of unwanted side effects).

This creates a classic case of deadlock: the server can't progress to
the point of accept(2)ing the client to write to the NBD socket
because the main loop is being starved until the AIO_WAIT_WHILE
completes the bdrv_open, but the AIO_WAIT_WHILE can't progress because
it is blocked on the client coroutine stuck in a read() of the
expected magic number from the server side of the socket.

This patch adds a new API to allow clients to opt in to listening via
an AioContext rather than a GMainContext.  This will allow NBD to fix
the deadlock by performing all actions during bdrv_open in the main
loop AioContext.

Technical debt warning: I would have loved to utilize a notify
function with AioContext to guarantee that we don't finalize listener
due to an object_unref if there is any callback still running (the way
GSource does), but wiring up notify functions into AioContext is a
bigger task that will be deferred to a later QEMU release.  But for
solving the NBD deadlock, it is sufficient to note that the QMP
commands for enabling and disabling the NBD server are really the only
points where we want to change the listener's callback.  Furthermore,
those commands are serviced in the main loop, which is the same
AioContext that is also listening for connections.  Since a thread
cannot interrupt itself, we are ensured that at the point where we are
changing the watch, there are no callbacks active.  This is NOT as
powerful as the GSource cross-thread safety, but sufficient for the
needs of today.

An upcoming patch will then add a unit test (kept separate to make it
easier to rearrange the series to demonstrate the deadlock without
this patch).

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3169
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-ID: <20251113011625.878876-26-eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
---
 include/io/net-listener.h | 21 +++++++++++++
 io/net-listener.c         | 66 +++++++++++++++++++++++++++++++++++++--
 2 files changed, 84 insertions(+), 3 deletions(-)

diff --git a/include/io/net-listener.h b/include/io/net-listener.h
index 93608f7fe8..fdc5f1c81a 100644
--- a/include/io/net-listener.h
+++ b/include/io/net-listener.h
@@ -152,6 +152,27 @@ void qio_net_listener_set_client_func(QIONetListener *listener,
                                       gpointer data,
                                       GDestroyNotify notify);
 
+/**
+ * qio_net_listener_set_client_aio_func:
+ * @listener: the network listener object
+ * @func: the callback function
+ * @data: opaque data to pass to @func
+ * @context: AioContext that @func will be bound to; if NULL, this will
+ *           will use qemu_get_aio_context().
+ *
+ * Similar to qio_net_listener_set_client_func_full(), except that the polling
+ * will be done by an AioContext rather than a GMainContext.
+ *
+ * Because AioContext does not (yet) support a clean way to deregister
+ * a callback from one thread while another thread might be in that
+ * callback, this function is only safe to call from the thread
+ * currently associated with @context.
+ */
+void qio_net_listener_set_client_aio_func(QIONetListener *listener,
+                                          QIONetListenerClientFunc func,
+                                          void *data,
+                                          AioContext *context);
+
 /**
  * qio_net_listener_wait_client:
  * @listener: the network listener object
diff --git a/io/net-listener.c b/io/net-listener.c
index 49399ec926..9410d72da9 100644
--- a/io/net-listener.c
+++ b/io/net-listener.c
@@ -85,6 +85,17 @@ static gboolean qio_net_listener_channel_func(QIOChannel *ioc,
 }
 
 
+static void qio_net_listener_aio_func(void *opaque)
+{
+    QIONetListenerSource *data = opaque;
+
+    assert(data->io_source == NULL);
+    assert(data->listener->aio_context != NULL);
+    qio_net_listener_channel_func(QIO_CHANNEL(data->sioc), G_IO_IN,
+                                  data->listener);
+}
+
+
 int qio_net_listener_open_sync(QIONetListener *listener,
                                SocketAddress *addr,
                                int num,
@@ -157,8 +168,26 @@ qio_net_listener_watch(QIONetListener *listener, size_t i, const char *caller)
                 qio_net_listener_channel_func,
                 listener, (GDestroyNotify)object_unref, listener->context);
         } else {
-            /* The user passed an AioContext. Not supported yet. */
-            g_assert_not_reached();
+            /*
+             * The user passed an AioContext.  At this point,
+             * AioContext lacks a clean way to call a notify function
+             * to release a final reference after any callback is
+             * complete.  But we asserted earlier that the async
+             * callback is changed only from the thread associated
+             * with aio_context, which means no other thread is in the
+             * middle of running the callback when we are changing the
+             * refcount on listener here.  Therefore, a single
+             * reference here is sufficient to ensure listener is not
+             * finalized during the callback.
+             */
+            assert(listener->context == NULL);
+            if (i == 0) {
+                object_ref(OBJECT(listener));
+            }
+            qio_channel_set_aio_fd_handler(
+                QIO_CHANNEL(listener->source[i]->sioc),
+                listener->aio_context, qio_net_listener_aio_func,
+                NULL, NULL, listener->source[i]);
         }
     }
 }
@@ -184,7 +213,13 @@ qio_net_listener_unwatch(QIONetListener *listener, const char *caller)
                 listener->source[i]->io_source = NULL;
             }
         } else {
-            g_assert_not_reached();
+            assert(listener->context == NULL);
+            qio_channel_set_aio_fd_handler(
+                QIO_CHANNEL(listener->source[i]->sioc),
+                listener->aio_context, NULL, NULL, NULL, NULL);
+            if (i == listener->nsioc - 1) {
+                object_unref(OBJECT(listener));
+            }
         }
     }
 }
@@ -259,6 +294,31 @@ void qio_net_listener_set_client_func(QIONetListener *listener,
                                               notify, NULL, NULL);
 }
 
+void qio_net_listener_set_client_aio_func(QIONetListener *listener,
+                                          QIONetListenerClientFunc func,
+                                          void *data,
+                                          AioContext *context)
+{
+    if (!context) {
+        assert(qemu_in_main_thread());
+        context = qemu_get_aio_context();
+    } else {
+        /*
+         * TODO: The API was intentionally designed to allow a caller
+         * to pass an alternative AioContext for future expansion;
+         * however, actually implementating that is not possible
+         * without notify callbacks wired into AioContext similar to
+         * how they work in GSource.  So for now, this code hard-codes
+         * the knowledge that the only client needing AioContext is
+         * the NBD server, which uses the global context and does not
+         * suffer from cross-thread safety issues.
+         */
+        g_assert_not_reached();
+    }
+    qio_net_listener_set_client_func_internal(listener, func, data,
+                                              NULL, NULL, context);
+}
+
 struct QIONetListenerClientWaitData {
     QIOChannelSocket *sioc;
     GMainLoop *loop;

From 89179bb4d91cc8d816e762c2c92f7c2120dda663 Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:37 -0600
Subject: [PATCH 2116/2396] nbd: Avoid deadlock in client connecting to
 same-process server
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

See the previous patch for a longer description of the deadlock.  Now
that QIONetListener supports waiting for clients in the main loop
AioContext, NBD can use that to ensure that the server can make
progress even when a client is intentionally starving the GMainContext
from any activity not tied to an AioContext.

Note that command-line arguments and QMP commands like
nbd-server-start or nbd-server-stop that manipulate whether the NBD
server exists are serviced in the main loop; and therefore, this patch
does not fall foul of the restrictions in the previous patch about the
inherent unsafe race possible if a QIONetListener can have its async
callback modified by a different thread than the one servicing polls.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3169
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251113011625.878876-27-eblake@redhat.com>
---
 blockdev-nbd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/blockdev-nbd.c b/blockdev-nbd.c
index 1e3e634b87..696474aea9 100644
--- a/blockdev-nbd.c
+++ b/blockdev-nbd.c
@@ -94,10 +94,10 @@ static void nbd_update_server_watch(NBDServerData *s)
 {
     if (s->listener) {
         if (!s->max_connections || s->connections < s->max_connections) {
-            qio_net_listener_set_client_func(s->listener, nbd_accept, NULL,
+            qio_net_listener_set_client_aio_func(s->listener, nbd_accept, NULL,
                                              NULL);
         } else {
-            qio_net_listener_set_client_func(s->listener, NULL, NULL, NULL);
+            qio_net_listener_set_client_aio_func(s->listener, NULL, NULL, NULL);
         }
     }
 }

From 24fd6d75b3e73105a95b93e54c0a17bae8f79c0c Mon Sep 17 00:00:00 2001
From: Eric Blake <eblake@redhat.com>
Date: Wed, 12 Nov 2025 19:11:38 -0600
Subject: [PATCH 2117/2396] iotests: Add coverage of recent NBD qio deadlock
 fix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Test that all images in a qcow2 chain using an NBD backing file can be
served by the same process.  Prior to the recent QIONetListener fixes,
this test would demonstrate deadlock.

The test borrows heavily from the original formula by "John Doe" in
the gitlab bug, but uses a Unix socket rather than TCP to avoid port
contention, and uses a full-blown QEMU rather than qemu-storage-daemon
since both programs were impacted.

The test starts out with the even simpler task of directly adding an
NBD client without qcow2 chain ('client'), which also provokes the
deadlock; but commenting out the 'Adding explicit NBD client' section
will still show deadlock when reaching the 'Adding wrapper image...'.

Fixes: https://gitlab.com/qemu-project/qemu/-/issues/3169
Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Message-ID: <20251113011625.878876-28-eblake@redhat.com>
---
 tests/qemu-iotests/tests/nbd-in-qcow2-chain   | 94 +++++++++++++++++++
 .../qemu-iotests/tests/nbd-in-qcow2-chain.out | 75 +++++++++++++++
 2 files changed, 169 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/nbd-in-qcow2-chain
 create mode 100644 tests/qemu-iotests/tests/nbd-in-qcow2-chain.out

diff --git a/tests/qemu-iotests/tests/nbd-in-qcow2-chain b/tests/qemu-iotests/tests/nbd-in-qcow2-chain
new file mode 100755
index 0000000000..455ddfa86f
--- /dev/null
+++ b/tests/qemu-iotests/tests/nbd-in-qcow2-chain
@@ -0,0 +1,94 @@
+#!/usr/bin/env bash
+# group: rw quick
+#
+# Test of opening both server and client NBD in a qcow2 backing chain
+#
+# Copyright (C) Red Hat, Inc.
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+
+# creator
+owner=eblake@redhat.com
+
+seq=`basename $0`
+echo "QA output created by $seq"
+
+status=1    # failure is the default!
+
+_cleanup()
+{
+    _cleanup_qemu
+    _cleanup_test_img
+    rm -f "$SOCK_DIR/nbd"
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+cd ..
+. ./common.rc
+. ./common.filter
+. ./common.qemu
+. ./common.nbd
+
+_supported_fmt qcow2  # Hardcoded to qcow2 command line and QMP below
+_supported_proto file
+
+size=100M
+
+echo
+echo "=== Preparing base image ==="
+
+TEST_IMG="$TEST_IMG.base" _make_test_img $size
+
+echo
+echo "=== Starting QEMU and exposing base image ==="
+
+_launch_qemu -machine q35
+h1=$QEMU_HANDLE
+_send_qemu_cmd $QEMU_HANDLE '{"execute": "qmp_capabilities"}' 'return'
+_send_qemu_cmd $QEMU_HANDLE '{"execute": "blockdev-add",
+  "arguments": {"node-name":"base", "driver":"qcow2",
+     "file":{"driver":"file", "filename":"'"$TEST_IMG.base"'"}}}' 'return'
+_send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-start",
+  "arguments": {"addr":{"type":"unix",
+    "data":{"path":"'"$SOCK_DIR/nbd"'"}}}}' 'return'
+_send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-add",
+  "arguments": {"device":"base","name":"base"}}' 'return'
+
+echo
+echo "=== Adding explicit NBD client ==="
+
+_send_qemu_cmd $QEMU_HANDLE '{"execute": "blockdev-add",
+  "arguments": {"node-name":"client", "driver":"nbd",
+     "read-only":true, "export":"base",
+     "server":{"type":"unix", "path":"'"$SOCK_DIR/nbd"'"}}}' 'return'
+_send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-add",
+  "arguments": {"device":"client","name":"client"}}' 'return'
+
+echo
+echo "=== Creating wrapper image ==="
+
+_make_test_img -F raw -b "nbd+unix:///base?socket=$SOCK_DIR/nbd" $size
+
+echo
+echo "=== Adding wrapper image with implicit client from qcow2 file ==="
+
+_send_qemu_cmd $QEMU_HANDLE '{"execute": "blockdev-add",
+  "arguments": {"node-name":"wrap", "driver":"qcow2",
+     "file":{"driver":"file", "filename":"'"$TEST_IMG"'"}}}' 'return'
+_send_qemu_cmd $QEMU_HANDLE '{"execute":"nbd-server-add",
+  "arguments": {"device":"wrap","name":"wrap"}}' 'return'
+
+echo
+echo "=== Checking NBD server ==="
+
+$QEMU_NBD --list -k $SOCK_DIR/nbd
+
+echo
+echo "=== Cleaning up ==="
+
+_send_qemu_cmd $QEMU_HANDLE '{"execute":"quit"}' ''
+
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/tests/nbd-in-qcow2-chain.out b/tests/qemu-iotests/tests/nbd-in-qcow2-chain.out
new file mode 100644
index 0000000000..b65cdaa4f2
--- /dev/null
+++ b/tests/qemu-iotests/tests/nbd-in-qcow2-chain.out
@@ -0,0 +1,75 @@
+QA output created by nbd-in-qcow2-chain
+
+=== Preparing base image ===
+Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=104857600
+
+=== Starting QEMU and exposing base image ===
+{"execute": "qmp_capabilities"}
+{"return": {}}
+{"execute": "blockdev-add",
+  "arguments": {"node-name":"base", "driver":"IMGFMT",
+     "file":{"driver":"file", "filename":"TEST_DIR/t.IMGFMT.base"}}}
+{"return": {}}
+{"execute":"nbd-server-start",
+  "arguments": {"addr":{"type":"unix",
+    "data":{"path":"SOCK_DIR/nbd"}}}}
+{"return": {}}
+{"execute":"nbd-server-add",
+  "arguments": {"device":"base","name":"base"}}
+{"return": {}}
+
+=== Adding explicit NBD client ===
+{"execute": "blockdev-add",
+  "arguments": {"node-name":"client", "driver":"nbd",
+     "read-only":true, "export":"base",
+     "server":{"type":"unix", "path":"SOCK_DIR/nbd"}}}
+{"return": {}}
+{"execute":"nbd-server-add",
+  "arguments": {"device":"client","name":"client"}}
+{"return": {}}
+
+=== Creating wrapper image ===
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=104857600 backing_file=nbd+unix:///base?socket=SOCK_DIR/nbd backing_fmt=raw
+
+=== Adding wrapper image with implicit client from qcow2 file ===
+{"execute": "blockdev-add",
+  "arguments": {"node-name":"wrap", "driver":"IMGFMT",
+     "file":{"driver":"file", "filename":"TEST_DIR/t.IMGFMT"}}}
+{"return": {}}
+{"execute":"nbd-server-add",
+  "arguments": {"device":"wrap","name":"wrap"}}
+{"return": {}}
+
+=== Checking NBD server ===
+exports available: 3
+ export: 'base'
+  size:  104857600
+  flags: 0x158f ( readonly flush fua df multi cache block-status-payload )
+  min block: 1
+  opt block: 4096
+  max block: 33554432
+  transaction size: 64-bit
+  available meta contexts: 1
+   base:allocation
+ export: 'client'
+  size:  104857600
+  flags: 0x158f ( readonly flush fua df multi cache block-status-payload )
+  min block: 1
+  opt block: 4096
+  max block: 33554432
+  transaction size: 64-bit
+  available meta contexts: 1
+   base:allocation
+ export: 'wrap'
+  size:  104857600
+  flags: 0x158f ( readonly flush fua df multi cache block-status-payload )
+  min block: 1
+  opt block: 4096
+  max block: 33554432
+  transaction size: 64-bit
+  available meta contexts: 1
+   base:allocation
+
+=== Cleaning up ===
+{"execute":"quit"}
+*** done

From 1c34de6d1f929af447a131ee97ab70c06f98d4e3 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Thu, 13 Nov 2025 09:05:25 +0100
Subject: [PATCH 2118/2396] tests/qemu-iotests: Fix broken grep command in
 iotest 207
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Running "./check -ssh 207" fails for me with lots of lines like this
in the output:

+base64: invalid input

While looking closer at it, I noticed that the grep -v "\\^#" command
in this test is not working as expected - it is likely meant to filter
out the comment lines that are starting with a "#", but at least my
version of grep (GNU grep 3.11) does not work with the backslashes here.
There does not seem to be a compelling reason for these backslashes,
so let's simply drop them to fix this issue.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251113080525.444826-1-thuth@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 tests/qemu-iotests/207 | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/207 b/tests/qemu-iotests/207
index 41dcf3ff55..ceab990e64 100755
--- a/tests/qemu-iotests/207
+++ b/tests/qemu-iotests/207
@@ -119,7 +119,7 @@ with iotests.FilePath('t.img') as disk_path, \
     iotests.img_info_log(remote_path)
 
     keys = subprocess.check_output(
-        'ssh-keyscan 127.0.0.1 2>/dev/null | grep -v "\\^#" | ' +
+        'ssh-keyscan 127.0.0.1 2>/dev/null | grep -v "^#" | ' +
         'cut -d" " -f3',
         shell=True).rstrip().decode('ascii').split('\n')
 

From 4c91719a6a78a1c24d8bb854f7594e767962d0d9 Mon Sep 17 00:00:00 2001
From: Alberto Garcia <berto@igalia.com>
Date: Wed, 12 Nov 2025 18:09:57 +0100
Subject: [PATCH 2119/2396] tests/qemu-iotest: fix iotest 024 with qed images

Use 'qemu-io -c map' instead of 'qemu-img map' to get an output that
works with both image types.

Cc: qemu-stable <qemu-stable@nongnu.org>
Fixes: 909852ba6b4a ("qemu-img rebase: don't exceed IO_BUF_SIZE in one operation")
Signed-off-by: Alberto Garcia <berto@igalia.com>
Message-ID: <20251112170959.700840-1-berto@igalia.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
---
 tests/qemu-iotests/024     | 2 +-
 tests/qemu-iotests/024.out | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/qemu-iotests/024 b/tests/qemu-iotests/024
index 021169b4a1..10be2bd845 100755
--- a/tests/qemu-iotests/024
+++ b/tests/qemu-iotests/024
@@ -359,7 +359,7 @@ $QEMU_IO "$OVERLAY" -c "read -P 0x00  0 1M" | _filter_qemu_io
 $QEMU_IO "$OVERLAY" -c "read -P 0xff 1M 2M" | _filter_qemu_io
 $QEMU_IO "$OVERLAY" -c "read -P 0x00 3M 1M" | _filter_qemu_io
 
-$QEMU_IMG map "$OVERLAY" | _filter_qemu_img_map
+$QEMU_IO -c map "$OVERLAY" | _filter_qemu_io
 
 echo
 
diff --git a/tests/qemu-iotests/024.out b/tests/qemu-iotests/024.out
index 1b7522ba71..da8fedc08b 100644
--- a/tests/qemu-iotests/024.out
+++ b/tests/qemu-iotests/024.out
@@ -266,7 +266,6 @@ read 2097152/2097152 bytes at offset 1048576
 2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 1048576/1048576 bytes at offset 3145728
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Offset          Length          File
-0               0x400000        TEST_DIR/subdir/t.IMGFMT
+4 MiB (0x400000) bytes     allocated at offset 0 bytes (0x0)
 
 *** done

From 781b5470ec38d0b44991a9f4624fc5ffe91ee5b0 Mon Sep 17 00:00:00 2001
From: Jonah Palmer <jonah.palmer@oracle.com>
Date: Thu, 21 Aug 2025 14:26:41 +0000
Subject: [PATCH 2120/2396] net/hub: make net_hub_port_cleanup idempotent

Makes the net_hub_port_cleanup function idempotent to avoid double
removals by guarding its QLIST_REMOVE with a flag.

When using a Xen networking device with hubport backends, e.g.:

-accel kvm,xen-version=0x40011
-netdev hubport,...
-device xen-net-device,...

the shutdown order starts with net_cleanup, which walks the list and
deletes netdevs (including hubports). Then Xen's xen_device_unrealize is
called, which eventually leads to a second net_hub_port_cleanup call,
resulting in a segfault.

Fixes: e7891c57 ("net: move backend cleanup to NIC cleanup")
Reported-by: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/hub.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/hub.c b/net/hub.c
index e3b58b1c4f..ee5881f6d5 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -34,6 +34,7 @@ typedef struct NetHubPort {
     QLIST_ENTRY(NetHubPort) next;
     NetHub *hub;
     int id;
+    bool listed;
 } NetHubPort;
 
 struct NetHub {
@@ -129,7 +130,10 @@ static void net_hub_port_cleanup(NetClientState *nc)
 {
     NetHubPort *port = DO_UPCAST(NetHubPort, nc, nc);
 
-    QLIST_REMOVE(port, next);
+    if (port->listed) {
+        QLIST_REMOVE(port, next);
+        port->listed = false;
+    }
 }
 
 static NetClientInfo net_hub_port_info = {
@@ -159,8 +163,10 @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name,
     port = DO_UPCAST(NetHubPort, nc, nc);
     port->id = id;
     port->hub = hub;
+    port->listed = false;
 
     QLIST_INSERT_HEAD(&hub->ports, port, next);
+    port->listed = true;
 
     return port;
 }

From 6da0c9828194eb21e54fe4264cd29a1b85a29f33 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 3 Nov 2025 17:58:49 +0000
Subject: [PATCH 2121/2396] hw/net/e1000e_core: Don't advance desc_offset for
 NULL buffer RX descriptors

In e1000e_write_packet_to_guest() we don't write data for RX descriptors
where the buffer address is NULL (as required by the i82574 datasheet
section 7.1.7.2). However, when we do this we still update desc_offset
by the amount of data we would have written to the RX descriptor if
it had a valid buffer pointer, resulting in our dropping that data
entirely. The data sheet is not 100% clear on the subject, but this
seems unlikely to be the correct behaviour.

Rearrange the null-descriptor logic so that we don't treat these
do-nothing descriptors as if we'd really written the data.

This both fixes a bug and also is a prerequisite to cleaning up
the size calculation logic in the next patch.

(Cc to stable largely because it will be needed for the next patch,
which fixes a more serious bug.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 8fef598b49..ba77cb6011 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -1481,7 +1481,6 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
     PCIDevice *d = core->owner;
     dma_addr_t base;
     union e1000_rx_desc_union desc;
-    size_t desc_size;
     size_t desc_offset = 0;
     size_t iov_ofs = 0;
 
@@ -1500,12 +1499,6 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
         E1000EBAState bastate = { { 0 } };
         bool is_last = false;
 
-        desc_size = total_size - desc_offset;
-
-        if (desc_size > core->rx_desc_buf_size) {
-            desc_size = core->rx_desc_buf_size;
-        }
-
         if (e1000e_ring_empty(core, rxi)) {
             return;
         }
@@ -1519,6 +1512,12 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
         e1000e_read_rx_descr(core, &desc, ba);
 
         if (ba[0]) {
+            size_t desc_size = total_size - desc_offset;
+
+            if (desc_size > core->rx_desc_buf_size) {
+                desc_size = core->rx_desc_buf_size;
+            }
+
             if (desc_offset < size) {
                 static const uint32_t fcs_pad;
                 size_t iov_copy;
@@ -1582,13 +1581,13 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
                 }
             }
+            desc_offset += desc_size;
+            if (desc_offset >= total_size) {
+                is_last = true;
+            }
         } else { /* as per intel docs; skip descriptors with null buf addr */
             trace_e1000e_rx_null_descriptor();
         }
-        desc_offset += desc_size;
-        if (desc_offset >= total_size) {
-            is_last = true;
-        }
 
         e1000e_write_rx_descr(core, &desc, is_last ? core->rx_pkt : NULL,
                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);

From 9d946d56a2ac8a6c2df186e20d24810255c83a3f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 3 Nov 2025 17:58:50 +0000
Subject: [PATCH 2122/2396] hw/net/e1000e_core: Correct rx oversize packet
 checks

In e1000e_write_packet_to_guest() we attempt to ensure that we don't
write more of a packet to a descriptor than will fit in the guest
configured receive buffers.  However, this code does not allow for
the "packet split" feature.  When packet splitting is enabled, the
first of up to 4 buffers in the descriptor is used for the packet
header only, with the payload going into buffers 2, 3 and 4.  Our
length check only checks against the total sizes of all 4 buffers,
which meant that if an incoming packet was large enough to fit in (1
+ 2 + 3 + 4) but not into (2 + 3 + 4) and packet splitting was
enabled, we would run into the assertion in
e1000e_write_hdr_frag_to_rx_buffers() that we had enough buffers for
the data:

qemu-system-i386: ../../hw/net/e1000e_core.c:1418: void e1000e_write_payload_frag_to_rx_buffers(E1000ECore *, hwaddr *, E1000EBAState *, const char *, dma_addr_t): Assertion `bastate->cur_idx < MAX_PS_BUFFERS' failed.

A malicious guest could provoke this assertion by configuring the
device into loopback mode, and then sending itself a suitably sized
packet into a suitably arrange rx descriptor.

The code also fails to deal with the possibility that the descriptor
buffers are sized such that the trailing checksum word does not fit
into the last descriptor which has actual data, which might also
trigger this assertion.

Rework the length handling to use two variables:
 * desc_size is the total amount of data DMA'd to the guest
   for the descriptor being processed in this iteration of the loop
 * rx_desc_buf_size is the total amount of space left in it

As we copy data to the guest (packet header, payload, checksum),
update these two variables.  (Previously we attempted to calculate
desc_size once at the top of the loop, but this is too difficult to
do correctly.) Then we can use the variables to ensure that we clamp
the amount of copied payload data to the remaining space in the
descriptor's buffers, even if we've used one of the buffers up in the
packet-split code, and we can tell whether we have enough space for
the full checksum word in this descriptor or whether we're going to
need to split that to the following descriptor.

I have included comments that hopefully help to make the loop
logic a little clearer.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/537
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 61 ++++++++++++++++++++++++++++++++++----------
 1 file changed, 47 insertions(+), 14 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index ba77cb6011..471c3ed20b 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -1495,6 +1495,13 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
     rxi = rxr->i;
 
     do {
+        /*
+         * Loop processing descriptors while we have packet data to
+         * DMA to the guest.  desc_offset tracks how much data we have
+         * sent to the guest in total over all descriptors, and goes
+         * from 0 up to total_size (the size of everything to send to
+         * the guest including possible trailing 4 bytes of CRC data).
+         */
         hwaddr ba[MAX_PS_BUFFERS];
         E1000EBAState bastate = { { 0 } };
         bool is_last = false;
@@ -1512,23 +1519,27 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
         e1000e_read_rx_descr(core, &desc, ba);
 
         if (ba[0]) {
-            size_t desc_size = total_size - desc_offset;
-
-            if (desc_size > core->rx_desc_buf_size) {
-                desc_size = core->rx_desc_buf_size;
-            }
+            /* Total amount of data DMA'd to the guest in this iteration */
+            size_t desc_size = 0;
+            /*
+             * Total space available in this descriptor (we will update
+             * this as we use it up)
+             */
+            size_t rx_desc_buf_size = core->rx_desc_buf_size;
 
             if (desc_offset < size) {
-                static const uint32_t fcs_pad;
                 size_t iov_copy;
+                /* Amount of data to copy from the incoming packet */
                 size_t copy_size = size - desc_offset;
-                if (copy_size > core->rx_desc_buf_size) {
-                    copy_size = core->rx_desc_buf_size;
-                }
 
                 /* For PS mode copy the packet header first */
                 if (do_ps) {
                     if (is_first) {
+                        /*
+                         * e1000e_do_ps() guarantees that buffer 0 has enough
+                         * space for the header; otherwise we will not split
+                         * the packet (i.e. do_ps is false).
+                         */
                         size_t ps_hdr_copied = 0;
                         do {
                             iov_copy = MIN(ps_hdr_len - ps_hdr_copied,
@@ -1550,14 +1561,26 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                         } while (ps_hdr_copied < ps_hdr_len);
 
                         is_first = false;
+                        desc_size += ps_hdr_len;
                     } else {
                         /* Leave buffer 0 of each descriptor except first */
                         /* empty as per spec 7.1.5.1                      */
                         e1000e_write_hdr_frag_to_rx_buffers(core, ba, &bastate,
                                                             NULL, 0);
                     }
+                    rx_desc_buf_size -= core->rxbuf_sizes[0];
                 }
 
+                /*
+                 * Clamp the amount of packet data we copy into what will fit
+                 * into the remaining buffers in the descriptor.
+                 */
+                if (copy_size > rx_desc_buf_size) {
+                    copy_size = rx_desc_buf_size;
+                }
+                desc_size += copy_size;
+                rx_desc_buf_size -= copy_size;
+
                 /* Copy packet payload */
                 while (copy_size) {
                     iov_copy = MIN(copy_size, iov->iov_len - iov_ofs);
@@ -1574,12 +1597,22 @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                         iov_ofs = 0;
                     }
                 }
+            }
 
-                if (desc_offset + desc_size >= total_size) {
-                    /* Simulate FCS checksum presence in the last descriptor */
-                    e1000e_write_payload_frag_to_rx_buffers(core, ba, &bastate,
-                          (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
-                }
+            if (rx_desc_buf_size &&
+                desc_offset >= size && desc_offset < total_size) {
+                /*
+                 * We are in the last 4 bytes corresponding to the FCS checksum.
+                 * We only ever write zeroes here (unlike the hardware).
+                 */
+                static const uint32_t fcs_pad;
+                /* Amount of space for the trailing checksum */
+                size_t fcs_len = MIN(rx_desc_buf_size,
+                                     total_size - desc_offset);
+                e1000e_write_payload_frag_to_rx_buffers(core, ba, &bastate,
+                                                        (const char *)&fcs_pad,
+                                                        fcs_len);
+                desc_size += fcs_len;
             }
             desc_offset += desc_size;
             if (desc_offset >= total_size) {

From bab496a18358643b686f69e2b97d73fb98d37e79 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 3 Nov 2025 17:58:51 +0000
Subject: [PATCH 2123/2396] hw/net/e1000e_core: Adjust
 e1000e_write_payload_frag_to_rx_buffers() assert

An assertion in e1000e_write_payload_frag_to_rx_buffers() attempts to
guard against the calling code accidentally trying to write too much
data to a single RX descriptor, such that the E1000EBAState::cur_idx
indexes off the end of the EB1000BAState::written[] array.

Unfortunately it is overzealous: it asserts that cur_idx is in
range after it has been incremented. This will fire incorrectly
for the case where the guest configures four buffers and exactly
enough bytes are written to fill all four of them.

The only places where we use cur_idx and index in to the written[]
array are the functions e1000e_write_hdr_frag_to_rx_buffers() and
e1000e_write_payload_frag_to_rx_buffers(), so we can rewrite this to
assert before doing the array dereference, rather than asserting
after updating cur_idx.

Cc: qemu-stable@nongnu.org
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index 471c3ed20b..46e156a5dd 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -1392,10 +1392,13 @@ e1000e_write_payload_frag_to_rx_buffers(E1000ECore *core,
                                         dma_addr_t data_len)
 {
     while (data_len > 0) {
-        uint32_t cur_buf_len = core->rxbuf_sizes[bastate->cur_idx];
-        uint32_t cur_buf_bytes_left = cur_buf_len -
-                                      bastate->written[bastate->cur_idx];
-        uint32_t bytes_to_write = MIN(data_len, cur_buf_bytes_left);
+        uint32_t cur_buf_len, cur_buf_bytes_left, bytes_to_write;
+
+        assert(bastate->cur_idx < MAX_PS_BUFFERS);
+
+        cur_buf_len = core->rxbuf_sizes[bastate->cur_idx];
+        cur_buf_bytes_left = cur_buf_len - bastate->written[bastate->cur_idx];
+        bytes_to_write = MIN(data_len, cur_buf_bytes_left);
 
         trace_e1000e_rx_desc_buff_write(bastate->cur_idx,
                                         ba[bastate->cur_idx],
@@ -1414,8 +1417,6 @@ e1000e_write_payload_frag_to_rx_buffers(E1000ECore *core,
         if (bastate->written[bastate->cur_idx] == cur_buf_len) {
             bastate->cur_idx++;
         }
-
-        assert(bastate->cur_idx < MAX_PS_BUFFERS);
     }
 }
 

From a01344d9d78089e9e585faaeb19afccff2050abf Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 28 Oct 2025 16:00:42 +0000
Subject: [PATCH 2124/2396] net: pad packets to minimum length in
 qemu_receive_packet()

In commits like 969e50b61a28 ("net: Pad short frames to minimum size
before sending from SLiRP/TAP") we switched away from requiring
network devices to handle short frames to instead having the net core
code do the padding of short frames out to the ETH_ZLEN minimum size.
We then dropped the code for handling short frames from the network
devices in a series of commits like 140eae9c8f7 ("hw/net: e1000:
Remove the logic of padding short frames in the receive path").

This missed one route where the device's receive code can still see a
short frame: if the device is in loopback mode and it transmits a
short frame via the qemu_receive_packet() function, this will be fed
back into its own receive code without being padded.

Add the padding logic to qemu_receive_packet().

This fixes a buffer overrun which can be triggered in the
e1000_receive_iov() logic via the loopback code path.

Other devices that use qemu_receive_packet() to implement loopback
are cadence_gem, dp8393x, lan9118, msf2-emac, pcnet, rtl8139
and sungem.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3043
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/net.c b/net/net.c
index 27e0d27807..8aefdb3424 100644
--- a/net/net.c
+++ b/net/net.c
@@ -775,10 +775,20 @@ ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size)
 
 ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size)
 {
+    uint8_t min_pkt[ETH_ZLEN];
+    size_t min_pktsz = sizeof(min_pkt);
+
     if (!qemu_can_receive_packet(nc)) {
         return 0;
     }
 
+    if (net_peer_needs_padding(nc)) {
+        if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
+            buf = min_pkt;
+            size = min_pktsz;
+        }
+    }
+
     return qemu_net_queue_receive(nc->incoming_queue, buf, size);
 }
 

From 2053f311f7761b6eb414f1860ef3064fa06b8d24 Mon Sep 17 00:00:00 2001
From: Mohamed Mediouni <mohamed@unpredictable.fr>
Date: Fri, 7 Nov 2025 08:23:37 +0100
Subject: [PATCH 2125/2396] MAINTAINERS: update maintainers for WHPX

From Pedro Barbuda (on Teams):

> we meant to have that switched a while back. you can add me as the maintainer. Pedro Barbuda (pbarbuda@microsoft.com)

Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
Message-id: 20251107072337.28932-1-mohamed@unpredictable.fr
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index 9cb181e1da..38325e0617 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -547,7 +547,8 @@ F: include/system/hvf.h
 F: include/system/hvf_int.h
 
 WHPX CPUs
-M: Sunil Muthuswamy <sunilmut@microsoft.com>
+M: Pedro Barbuda <pbarbuda@microsoft.com>
+M: Mohamed Mediouni <mohamed@unpredictable.fr>
 S: Supported
 F: target/i386/whpx/
 F: accel/stubs/whpx-stub.c

From 18cf3898e3f59116bd179b2f74fad377d57e7f25 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 6 Nov 2025 15:49:09 +0100
Subject: [PATCH 2126/2396] target/arm: Fix accidental write to TCG constant

Currently an unpredictable movw such as

  movw pc, 0x123

results in the tinycode

   and_i32 $0x123,$0x123,$0xfffffffc
   mov_i32 pc,$0x123
   exit_tb $0x0

which is clearly a bug: writing to a constant is incorrect and
discards the result of the mask.  Fix this by always doing an and_i32
and trusting the optimizer to turn this into a simple move when the
mask is zero.

Signed-off-by: Anton Johansson <anjo@rev.ng>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: <gustavo.romero@linaro.org>
Message-id: 20251106144909.533997-1-richard.henderson@linaro.org
[rth: Avoid an extra temp and extra move.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: commit message tweak]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index 5f64fed220..63735d9789 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -303,20 +303,23 @@ TCGv_i32 add_reg_for_lit(DisasContext *s, int reg, int ofs)
    marked as dead.  */
 void store_reg(DisasContext *s, int reg, TCGv_i32 var)
 {
+    uint32_t mask = 0;
+
     if (reg == 15) {
-        /* In Thumb mode, we must ignore bit 0.
+        /*
+         * In Thumb mode, we must ignore bit 0.
          * In ARM mode, for ARMv4 and ARMv5, it is UNPREDICTABLE if bits [1:0]
          * are not 0b00, but for ARMv6 and above, we must ignore bits [1:0].
          * We choose to ignore [1:0] in ARM mode for all architecture versions.
          */
-        tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
+        mask = s->thumb ? 1 : 3;
         s->base.is_jmp = DISAS_JUMP;
         s->pc_save = -1;
     } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
         /* For M-profile SP bits [1:0] are always zero */
-        tcg_gen_andi_i32(var, var, ~3);
+        mask = 3;
     }
-    tcg_gen_mov_i32(cpu_R[reg], var);
+    tcg_gen_andi_i32(cpu_R[reg], var, ~mask);
 }
 
 /*

From 00de647c0ab69e92cf333d7d061782103b1fd794 Mon Sep 17 00:00:00 2001
From: Osama Abdelkader <osama.abdelkader@gmail.com>
Date: Mon, 10 Nov 2025 18:15:52 +0200
Subject: [PATCH 2127/2396] target/arm/cpu64: remove duplicate include
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

cpregs.h is included twice.

Signed-off-by: Osama Abdelkader <osama.abdelkader@gmail.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Gavin Shan <gshan@redhat.com>
Message-id: 20251110161552.700333-1-osama.abdelkader@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index f81cfd0113..ae84d8e420 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -34,7 +34,6 @@
 #include "hw/qdev-properties.h"
 #include "internals.h"
 #include "cpu-features.h"
-#include "cpregs.h"
 
 /* convert between <register>_IDX and SYS_<register> */
 #define DEF(NAME, OP0, OP1, CRN, CRM, OP2)      \

From f52db7f34242d3398bab0bacaa3e5dde99be5258 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 6 Nov 2025 14:52:08 +0000
Subject: [PATCH 2128/2396] hw/display/xlnx_dp.c: Don't abort on AUX FIFO
 overrun/underrun
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The documentation of the Xilinx DisplayPort subsystem at
https://www.xilinx.com/support/documents/ip_documentation/v_dp_txss1/v3_1/pg299-v-dp-txss1.pdf
doesn't say what happens if a guest tries to issue an AUX write
command with a length greater than the amount of data in the AUX
write FIFO, or tries to write more data to the write FIFO than it can
hold, or issues multiple commands that put data into the AUX read
FIFO without reading it such that it overflows.

Currently QEMU will abort() in these guest-error situations, either
in xlnx_dp.c itself or in the fifo8 code.  Make these cases all be
logged as guest errors instead.  We choose to ignore the new data on
overflow, and return 0 on underflow. This is in line with how we handled
the "read from empty RX FIFO" case in commit a09ef5040477.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1418
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1419
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1424
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-id: 20251106145209.1083998-2-peter.maydell@linaro.org
---
 hw/display/xlnx_dp.c | 28 ++++++++++++++++++++++++++--
 1 file changed, 26 insertions(+), 2 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index 96cbb1b3a7..c2bf692e7b 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -435,7 +435,18 @@ static void xlnx_dp_aux_clear_rx_fifo(XlnxDPState *s)
 
 static void xlnx_dp_aux_push_rx_fifo(XlnxDPState *s, uint8_t *buf, size_t len)
 {
+    size_t avail = fifo8_num_free(&s->rx_fifo);
     DPRINTF("Push %u data in rx_fifo\n", (unsigned)len);
+    if (len > avail) {
+        /*
+         * Data sheet doesn't specify behaviour here: we choose to ignore
+         * the excess data.
+         */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: ignoring %zu bytes pushed to full RX_FIFO\n",
+                      __func__, len - avail);
+        len = avail;
+    }
     fifo8_push_all(&s->rx_fifo, buf, len);
 }
 
@@ -466,7 +477,18 @@ static void xlnx_dp_aux_clear_tx_fifo(XlnxDPState *s)
 
 static void xlnx_dp_aux_push_tx_fifo(XlnxDPState *s, uint8_t *buf, size_t len)
 {
+    size_t avail = fifo8_num_free(&s->tx_fifo);
     DPRINTF("Push %u data in tx_fifo\n", (unsigned)len);
+    if (len > avail) {
+        /*
+         * Data sheet doesn't specify behaviour here: we choose to ignore
+         * the excess data.
+         */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: ignoring %zu bytes pushed to full TX_FIFO\n",
+                      __func__, len - avail);
+        len = avail;
+    }
     fifo8_push_all(&s->tx_fifo, buf, len);
 }
 
@@ -475,8 +497,10 @@ static uint8_t xlnx_dp_aux_pop_tx_fifo(XlnxDPState *s)
     uint8_t ret;
 
     if (fifo8_is_empty(&s->tx_fifo)) {
-        error_report("%s: TX_FIFO underflow", __func__);
-        abort();
+        /* Data sheet doesn't specify behaviour here: we choose to return 0 */
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: attempt to read empty TX_FIFO\n",
+                      __func__);
+        return 0;
     }
     ret = fifo8_pop(&s->tx_fifo);
     DPRINTF("pop 0x%2.2X from tx_fifo.\n", ret);

From 032333eba77b83dfbd74071cc2971f0bda9a3d4f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 6 Nov 2025 14:52:09 +0000
Subject: [PATCH 2129/2396] hw/display/xlnx_dp: Don't abort for unsupported
 graphics formats
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the guest writes an invalid or unsupported value to the
AV_BUF_FORMAT register, currently we abort().  Instead, log this as
either a guest error or an unimplemented error and continue.

The existing code treats DP_NL_VID_CB_Y0_CR_Y1 as x8b8g8r8
via a "case 0" that does not use the enum constant name for some
reason; we leave that alone beyond adding a comment about the
weird code.

Documentation of this register seems to be at:
https://docs.amd.com/r/en-US/ug1087-zynq-ultrascale-registers/AV_BUF_FORMAT-DISPLAY_PORT-Register

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1415
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251106145209.1083998-3-peter.maydell@linaro.org
---
 hw/display/xlnx_dp.c | 55 +++++++++++++++++++++++++++++++++++++++-----
 1 file changed, 49 insertions(+), 6 deletions(-)

diff --git a/hw/display/xlnx_dp.c b/hw/display/xlnx_dp.c
index c2bf692e7b..a248b943a5 100644
--- a/hw/display/xlnx_dp.c
+++ b/hw/display/xlnx_dp.c
@@ -665,14 +665,28 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_GRAPHIC_BGR888:
         s->g_plane.format = PIXMAN_b8g8r8;
         break;
+    case DP_GRAPHIC_RGBA5551:
+    case DP_GRAPHIC_RGBA4444:
+    case DP_GRAPHIC_8BPP:
+    case DP_GRAPHIC_4BPP:
+    case DP_GRAPHIC_2BPP:
+    case DP_GRAPHIC_1BPP:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
+        break;
     default:
-        error_report("%s: unsupported graphic format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
-        abort();
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid graphic format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_GRAPHIC_MASK);
+        s->g_plane.format = PIXMAN_r8g8b8a8;
+        break;
     }
 
     switch (s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK) {
     case 0:
+        /* This is DP_NL_VID_CB_Y0_CR_Y1 ??? */
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
     case DP_NL_VID_Y0_CB_Y1_CR:
@@ -681,10 +695,39 @@ static void xlnx_dp_change_graphic_fmt(XlnxDPState *s)
     case DP_NL_VID_RGBA8880:
         s->v_plane.format = PIXMAN_x8b8g8r8;
         break;
+    case DP_NL_VID_CR_Y0_CB_Y1:
+    case DP_NL_VID_Y0_CR_Y1_CB:
+    case DP_NL_VID_YV16:
+    case DP_NL_VID_YV24:
+    case DP_NL_VID_YV16CL:
+    case DP_NL_VID_MONO:
+    case DP_NL_VID_YV16CL2:
+    case DP_NL_VID_YUV444:
+    case DP_NL_VID_RGB888:
+    case DP_NL_VID_RGB888_10BPC:
+    case DP_NL_VID_YUV444_10BPC:
+    case DP_NL_VID_YV16CL2_10BPC:
+    case DP_NL_VID_YV16CL_10BPC:
+    case DP_NL_VID_YV16_10BPC:
+    case DP_NL_VID_YV24_10BPC:
+    case DP_NL_VID_Y_ONLY_10BPC:
+    case DP_NL_VID_YV16_420:
+    case DP_NL_VID_YV16CL_420:
+    case DP_NL_VID_YV16CL2_420:
+    case DP_NL_VID_YV16_420_10BPC:
+    case DP_NL_VID_YV16CL_420_10BPC:
+    case DP_NL_VID_YV16CL2_420_10BPC:
+        qemu_log_mask(LOG_UNIMP, "%s: unimplemented video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     default:
-        error_report("%s: unsupported video format %u", __func__,
-                     s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
-        abort();
+        qemu_log_mask(LOG_UNIMP, "%s: invalid video format %u",
+                      __func__,
+                      s->avbufm_registers[AV_BUF_FORMAT] & DP_NL_VID_FMT_MASK);
+        s->v_plane.format = PIXMAN_x8b8g8r8;
+        break;
     }
 
     xlnx_dp_recreate_surface(s);

From 2a2527c8158b77bf767f5672998d2efc90d83c27 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Nov 2025 16:09:41 +0000
Subject: [PATCH 2130/2396] cxl: Clean up includes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git cxl hw/cxl hw/mem

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Message-id: 20251104160943.751997-8-peter.maydell@linaro.org
---
 hw/cxl/cxl-mailbox-utils.c | 2 +-
 hw/mem/cxl_type3.c         | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 68c7cc9891..6cfdd98168 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -7,9 +7,9 @@
  * COPYING file in the top-level directory.
  */
 
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "hw/cxl/cxl.h"
diff --git a/hw/mem/cxl_type3.c b/hw/mem/cxl_type3.c
index be609ff9d0..4f3688a71b 100644
--- a/hw/mem/cxl_type3.c
+++ b/hw/mem/cxl_type3.c
@@ -8,9 +8,9 @@
  *
  * SPDX-License-Identifier: GPL-v2-only
  */
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "qemu/units.h"
 #include "qemu/error-report.h"
 #include "qapi/qapi-commands-cxl.h"

From b1f4f4695c96bb8e20a00e82d1868b5b018002bc Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Nov 2025 16:09:42 +0000
Subject: [PATCH 2131/2396] vfio: Clean up includes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git vfio hw/vfio hw/vfio-user

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251104160943.751997-9-peter.maydell@linaro.org
---
 hw/vfio-user/container.c | 2 +-
 hw/vfio-user/container.h | 1 -
 hw/vfio-user/device.h    | 1 -
 hw/vfio-user/pci.c       | 2 +-
 hw/vfio/ap.c             | 1 -
 hw/vfio/container.c      | 2 +-
 hw/vfio/cpr-legacy.c     | 2 +-
 hw/vfio/pci-quirks.h     | 1 -
 8 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/vfio-user/container.c b/hw/vfio-user/container.c
index e45192fef6..dab7a23224 100644
--- a/hw/vfio-user/container.c
+++ b/hw/vfio-user/container.c
@@ -6,9 +6,9 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
-#include "qemu/osdep.h"
 
 #include "hw/vfio-user/container.h"
 #include "hw/vfio-user/device.h"
diff --git a/hw/vfio-user/container.h b/hw/vfio-user/container.h
index a2b42e3169..c952e09063 100644
--- a/hw/vfio-user/container.h
+++ b/hw/vfio-user/container.h
@@ -7,7 +7,6 @@
 #ifndef HW_VFIO_USER_CONTAINER_H
 #define HW_VFIO_USER_CONTAINER_H
 
-#include "qemu/osdep.h"
 
 #include "hw/vfio/vfio-container.h"
 #include "hw/vfio-user/proxy.h"
diff --git a/hw/vfio-user/device.h b/hw/vfio-user/device.h
index d183a3950e..49c05848f1 100644
--- a/hw/vfio-user/device.h
+++ b/hw/vfio-user/device.h
@@ -9,7 +9,6 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#include "qemu/osdep.h"
 #include "linux/vfio.h"
 
 #include "hw/vfio-user/proxy.h"
diff --git a/hw/vfio-user/pci.c b/hw/vfio-user/pci.c
index b53ed3b456..353d07e781 100644
--- a/hw/vfio-user/pci.c
+++ b/hw/vfio-user/pci.c
@@ -6,8 +6,8 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
-#include <sys/ioctl.h>
 #include "qemu/osdep.h"
+#include <sys/ioctl.h>
 #include "qapi-visit-sockets.h"
 #include "qemu/error-report.h"
 
diff --git a/hw/vfio/ap.c b/hw/vfio/ap.c
index 7719f24579..3368ac8915 100644
--- a/hw/vfio/ap.c
+++ b/hw/vfio/ap.c
@@ -10,7 +10,6 @@
  * directory.
  */
 
-#include <stdbool.h>
 #include "qemu/osdep.h"
 #include CONFIG_DEVICES /* CONFIG_IOMMUFD */
 #include <linux/vfio.h>
diff --git a/hw/vfio/container.c b/hw/vfio/container.c
index 9ddec300e3..013a691bc5 100644
--- a/hw/vfio/container.c
+++ b/hw/vfio/container.c
@@ -10,10 +10,10 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
 
-#include "qemu/osdep.h"
 #include "system/tcg.h"
 #include "system/ram_addr.h"
 #include "qapi/error.h"
diff --git a/hw/vfio/cpr-legacy.c b/hw/vfio/cpr-legacy.c
index 86c943158e..7c03ddb961 100644
--- a/hw/vfio/cpr-legacy.c
+++ b/hw/vfio/cpr-legacy.c
@@ -4,9 +4,9 @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 
+#include "qemu/osdep.h"
 #include <sys/ioctl.h>
 #include <linux/vfio.h>
-#include "qemu/osdep.h"
 #include "hw/vfio/vfio-container-legacy.h"
 #include "hw/vfio/vfio-device.h"
 #include "hw/vfio/vfio-listener.h"
diff --git a/hw/vfio/pci-quirks.h b/hw/vfio/pci-quirks.h
index d1532e379b..a6282e063a 100644
--- a/hw/vfio/pci-quirks.h
+++ b/hw/vfio/pci-quirks.h
@@ -12,7 +12,6 @@
 #ifndef HW_VFIO_VFIO_PCI_QUIRKS_H
 #define HW_VFIO_VFIO_PCI_QUIRKS_H
 
-#include "qemu/osdep.h"
 #include "exec/memop.h"
 
 /*

From 168558ed7b4eb215e58d1dd6dea12b53114738ff Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 4 Nov 2025 16:09:43 +0000
Subject: [PATCH 2132/2396] tests: Clean up includes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This commit was created with scripts/clean-includes:
 ./scripts/clean-includes --git tests tests

with one hand-edit to remove a now-empty #ifndef WIN32...#endif
from tests/qtest/dbus-display-test.c .

All .c should include qemu/osdep.h first.  The script performs three
related cleanups:

* Ensure .c files include qemu/osdep.h first.
* Including it in a .h is redundant, since the .c  already includes
  it.  Drop such inclusions.
* Likewise, including headers qemu/osdep.h includes is redundant.
  Drop these, too.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-id: 20251104160943.751997-10-peter.maydell@linaro.org
---
 tests/qtest/aspeed-hace-utils.h      | 1 -
 tests/qtest/aspeed-smc-utils.h       | 1 -
 tests/qtest/aspeed_gpio-test.c       | 1 -
 tests/qtest/dbus-display-test.c      | 3 ---
 tests/qtest/pnv-spi-seeprom-test.c   | 1 -
 tests/unit/test-cutils.c             | 2 +-
 tests/unit/test-error-report.c       | 1 -
 tests/unit/test-io-channel-command.c | 2 --
 8 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/tests/qtest/aspeed-hace-utils.h b/tests/qtest/aspeed-hace-utils.h
index c8b2ec45af..27ab2bb975 100644
--- a/tests/qtest/aspeed-hace-utils.h
+++ b/tests/qtest/aspeed-hace-utils.h
@@ -8,7 +8,6 @@
 #ifndef TESTS_ASPEED_HACE_UTILS_H
 #define TESTS_ASPEED_HACE_UTILS_H
 
-#include "qemu/osdep.h"
 #include "libqtest.h"
 #include "qemu/bitops.h"
 
diff --git a/tests/qtest/aspeed-smc-utils.h b/tests/qtest/aspeed-smc-utils.h
index b07870f3b8..e2fd8ff1bd 100644
--- a/tests/qtest/aspeed-smc-utils.h
+++ b/tests/qtest/aspeed-smc-utils.h
@@ -26,7 +26,6 @@
 #ifndef TESTS_ASPEED_SMC_UTILS_H
 #define TESTS_ASPEED_SMC_UTILS_H
 
-#include "qemu/osdep.h"
 #include "qemu/bswap.h"
 #include "libqtest-single.h"
 #include "qemu/bitops.h"
diff --git a/tests/qtest/aspeed_gpio-test.c b/tests/qtest/aspeed_gpio-test.c
index c2f9ca2298..decbba23c8 100644
--- a/tests/qtest/aspeed_gpio-test.c
+++ b/tests/qtest/aspeed_gpio-test.c
@@ -27,7 +27,6 @@
 #include "qemu/timer.h"
 #include "qobject/qdict.h"
 #include "libqtest-single.h"
-#include "qemu/typedefs.h"
 
 #define AST2600_GPIO_BASE 0x1E780000
 
diff --git a/tests/qtest/dbus-display-test.c b/tests/qtest/dbus-display-test.c
index f7fc873bfb..1d5951b711 100644
--- a/tests/qtest/dbus-display-test.c
+++ b/tests/qtest/dbus-display-test.c
@@ -7,9 +7,6 @@
 #include <gio/gio.h>
 #include <gio/gunixfdlist.h>
 #include "libqtest.h"
-#ifndef WIN32
-#include <sys/mman.h>
-#endif
 #include "ui/dbus-display1.h"
 
 static GDBusConnection*
diff --git a/tests/qtest/pnv-spi-seeprom-test.c b/tests/qtest/pnv-spi-seeprom-test.c
index 600493c425..8033261758 100644
--- a/tests/qtest/pnv-spi-seeprom-test.c
+++ b/tests/qtest/pnv-spi-seeprom-test.c
@@ -5,7 +5,6 @@
  *
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
-#include <unistd.h>
 #include "qemu/osdep.h"
 #include "libqtest.h"
 #include "qemu/bswap.h"
diff --git a/tests/unit/test-cutils.c b/tests/unit/test-cutils.c
index 227acc5995..75fae29003 100644
--- a/tests/unit/test-cutils.c
+++ b/tests/unit/test-cutils.c
@@ -25,9 +25,9 @@
  * THE SOFTWARE.
  */
 
+#include "qemu/osdep.h"
 #include <math.h>
 
-#include "qemu/osdep.h"
 #include "qemu/cutils.h"
 #include "qemu/units.h"
 
diff --git a/tests/unit/test-error-report.c b/tests/unit/test-error-report.c
index 0cbde3c4cf..a8532fc58f 100644
--- a/tests/unit/test-error-report.c
+++ b/tests/unit/test-error-report.c
@@ -8,7 +8,6 @@
  */
 
 #include "qemu/osdep.h"
-#include "glib-compat.h"
 #include <locale.h>
 
 #include "qemu/error-report.h"
diff --git a/tests/unit/test-io-channel-command.c b/tests/unit/test-io-channel-command.c
index 4f022617df..964418b5cd 100644
--- a/tests/unit/test-io-channel-command.c
+++ b/tests/unit/test-io-channel-command.c
@@ -20,8 +20,6 @@
 
 #include "qemu/osdep.h"
 #include <glib/gstdio.h>
-#include <sys/types.h>
-#include <sys/stat.h>
 #include "io/channel-command.h"
 #include "io-channel-helpers.h"
 #include "qapi/error.h"

From 5fc50b4ec841c8a01e7346c2c804088fc3accb6b Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 7 Nov 2025 15:01:37 +0000
Subject: [PATCH 2133/2396] hw/misc/npcm_clk: Don't divide by zero when
 calculating frequency
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the guest misprograms the PLL registers to request a zero
divisor, we currently fall over with a division by zero:

../../hw/misc/npcm_clk.c:221:14: runtime error: division by zero
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior ../../hw/misc/npcm_clk.c:221:14

Thread 1 "qemu-system-aar" received signal SIGFPE, Arithmetic exception.
0x00005555584d8f6d in npcm7xx_clk_update_pll (opaque=0x7fffed159a20) at ../../hw/misc/npcm_clk.c:221
221             freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);

Avoid this by treating this invalid setting like a stopped clock
(setting freq to 0).

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/549
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107150137.1353532-1-peter.maydell@linaro.org
---
 hw/misc/npcm_clk.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/misc/npcm_clk.c b/hw/misc/npcm_clk.c
index c48d40b446..e202a8a299 100644
--- a/hw/misc/npcm_clk.c
+++ b/hw/misc/npcm_clk.c
@@ -212,13 +212,14 @@ static void npcm7xx_clk_update_pll(void *opaque)
 {
     NPCM7xxClockPLLState *s = opaque;
     uint32_t con = s->clk->regs[s->reg];
-    uint64_t freq;
+    uint64_t freq, freq_div;
 
     /* The PLL is grounded if it is not locked yet. */
     if (con & PLLCON_LOKI) {
         freq = clock_get_hz(s->clock_in);
         freq *= PLLCON_FBDV(con);
-        freq /= PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
+        freq_div = PLLCON_INDV(con) * PLLCON_OTDV1(con) * PLLCON_OTDV2(con);
+        freq = freq_div ? freq / freq_div : 0;
     } else {
         freq = 0;
     }

From 522444744eb79dd01e377ad2ed15544f10bcc70c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 7 Nov 2025 15:41:16 +0000
Subject: [PATCH 2134/2396] hw/audio/lm4549: Don't try to open a zero-frequency
 audio voice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If the guest incorrectly programs the lm4549 audio chip with a zero
frequency, we will pass this to AUD_open_out(), which will complain:

   A bug was just triggered in AUD_open_out
   Save all your work and restart without audio
   I am sorry
   Context:
   audio: frequency=0 nchannels=2 fmt=S16 endianness=little

The datasheet doesn't say what we should do here, only that the valid
range for the freqency is 4000 to 48000 Hz; we choose to log the
guest error and ignore an attempt to change the DAC rate to something
outside the valid range.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/410
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107154116.1396769-1-peter.maydell@linaro.org
---
 hw/audio/lm4549.c | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/hw/audio/lm4549.c b/hw/audio/lm4549.c
index 745441bd79..bf711c49c0 100644
--- a/hw/audio/lm4549.c
+++ b/hw/audio/lm4549.c
@@ -15,6 +15,7 @@
 
 #include "qemu/osdep.h"
 #include "hw/hw.h"
+#include "qemu/log.h"
 #include "qemu/audio.h"
 #include "lm4549.h"
 #include "migration/vmstate.h"
@@ -179,9 +180,23 @@ void lm4549_write(lm4549_state *s,
         break;
 
     case LM4549_PCM_Front_DAC_Rate:
-        regfile[LM4549_PCM_Front_DAC_Rate] = value;
         DPRINTF("DAC rate change = %i\n", value);
 
+        /*
+         * Valid sample rates are 4kHz to 48kHz.
+         * The datasheet doesn't say what happens if you try to
+         * set the frequency to zero. AUD_open_out() will print
+         * a bug message if we pass it a zero frequency, so just
+         * ignore attempts to set the DAC frequency to zero.
+         */
+        if (value < 4000 || value > 48000) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: DAC sample rate %d Hz is invalid, ignoring it\n",
+                          __func__, value);
+            break;
+        }
+        regfile[LM4549_PCM_Front_DAC_Rate] = value;
+
         /* Re-open a voice with the new sample rate */
         struct audsettings as;
         as.freq = value;

From 799fa30a6e3cfb21d6b46b33d4e8a12cac439ac4 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Thu, 6 Nov 2025 12:49:46 +0100
Subject: [PATCH 2135/2396] ioapic: fix typo in irqfd check
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Not registering the IEC notifier results in a regression with interrupt remapping
when running a VM configured with an intel-iommu device and an assigned
PCI VF. At boot, Linux complains with :

[   15.416794] __common_interrupt: 2.37 No irq handler for vector

Reported-by: Cédric Le Goater <clg@redhat.com>
Analyzed-by: Magnus Kulke <magnuskulke@linux.microsoft.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 hw/intc/ioapic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index e431d00311..38e4384648 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -216,7 +216,7 @@ static void ioapic_update_kvm_routes(IOAPICCommonState *s)
 #endif
 }
 
-#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
+#ifdef ACCEL_GSI_IRQFD_POSSIBLE
 static void ioapic_iec_notifier(void *private, bool global,
                                 uint32_t index, uint32_t mask)
 {
@@ -434,7 +434,7 @@ static const MemoryRegionOps ioapic_io_ops = {
 
 static void ioapic_machine_done_notify(Notifier *notifier, void *data)
 {
-#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
+#ifdef ACCEL_GSI_IRQFD_POSSIBLE
     IOAPICCommonState *s = container_of(notifier, IOAPICCommonState,
                                         machine_done);
 

From 46b06eaeb48d82ec231e9a09ce032ab1d5df8d33 Mon Sep 17 00:00:00 2001
From: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Fri, 14 Nov 2025 16:29:15 +0800
Subject: [PATCH 2136/2396] target/i386: emulate: Make sure fetch_instruction
 exist before calling it

Currently, this function is only available in MSHV. If a different accelerator
is used, and the code jumps to this section, a segfault will occur.
(I ran into this with HVF)

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Link: https://lore.kernel.org/r/20251114082915.71884-2-phind.uet@gmail.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/emulate/x86_decode.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/i386/emulate/x86_decode.c b/target/i386/emulate/x86_decode.c
index 97bd6f1a3b..d037ed1142 100644
--- a/target/i386/emulate/x86_decode.c
+++ b/target/i386/emulate/x86_decode.c
@@ -77,7 +77,11 @@ static inline uint64_t decode_bytes(CPUX86State *env, struct x86_decode *decode,
         memcpy(&val, decode->stream->bytes + decode->len, size);
     } else {
         target_ulong va = linear_rip(env_cpu(env), env->eip) + decode->len;
-        emul_ops->fetch_instruction(env_cpu(env), &val, va, size);
+        if (emul_ops->fetch_instruction) {
+            emul_ops->fetch_instruction(env_cpu(env), &val, va, size);
+        } else {
+            emul_ops->read_mem(env_cpu(env), &val, va, size);
+        }
     }
     decode->len += size;
 

From ebd9ea2947d88f237e20333fe547ca8817d0b0ee Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 14 Nov 2025 17:54:17 +0000
Subject: [PATCH 2137/2396] target/i386: Mark VPERMILPS as not valid with
 prefix 0

There are a small set of binary SSE insns which have no MMX
equivalent, which we create the gen functions for with the
BINARY_INT_SSE() macro.  This forwards to gen_binary_int_sse() with a
NULL pointer for 'mmx'.

For almost all of these insns we correctly mark them in the decode
table as not permitting a zero prefix byte; however we got this wrong
for VPERMILPS, with the result that a bogus instruction would get
through the decode checks and end up in gen_binary_int_sse() trying
to call a NULL pointer.

Correct the decode table entry for VPERMILPS so that we get the
expected #UD exception.

In the x86 SDM, table A-4 "Three-byte Opcode Map: 08H-FFH
(First Two Bytes are 0F 38H)" confirms that there is no pfx 0
version of VPERMILPS.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3199
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/r/20251114175417.2794804-1-peter.maydell@linaro.org
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index f4192f1006..805cfd08e8 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -643,7 +643,7 @@ static const X86OpEntry opcodes_0F38_00toEF[240] = {
     [0x0a] = X86_OP_ENTRY3(PSIGND,    V,x,        H,x,  W,x,  vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
     [0x0b] = X86_OP_ENTRY3(PMULHRSW,  V,x,        H,x,  W,x,  vex4 cpuid(SSSE3) mmx avx2_256 p_00_66),
     /* Listed incorrectly as type 4 */
-    [0x0c] = X86_OP_ENTRY3(VPERMILPS, V,x,        H,x,  W,x,  vex6 chk(W0) cpuid(AVX) p_00_66),
+    [0x0c] = X86_OP_ENTRY3(VPERMILPS, V,x,        H,x,  W,x,  vex6 chk(W0) cpuid(AVX) p_66),
     [0x0d] = X86_OP_ENTRY3(VPERMILPD, V,x,        H,x,  W,x,  vex6 chk(W0) cpuid(AVX) p_66),
     [0x0e] = X86_OP_ENTRY3(VTESTPS,   None,None,  V,x,  W,x,  vex6 chk(W0) cpuid(AVX) p_66),
     [0x0f] = X86_OP_ENTRY3(VTESTPD,   None,None,  V,x,  W,x,  vex6 chk(W0) cpuid(AVX) p_66),

From ebb46ba6a4a20d393a6889c21e8a80dabab4cc8e Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 15 Nov 2025 00:57:52 +0100
Subject: [PATCH 2138/2396] target/i386/tcg: validate segment registers

Correctly reject invalid segment registers, including CS when used as
the destination of a MOV.  Ignore the REX prefix as well.

Fixes: 5e9e21bcc4d ("target/i386: move 60-BF opcodes to new decoder", 2024-05-07)
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3195
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/decode-new.c.inc | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 805cfd08e8..0f8c5d1693 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2059,7 +2059,12 @@ static bool decode_op(DisasContext *s, CPUX86State *env, X86DecodedInsn *decode,
 
     case X86_TYPE_S:  /* reg selects a segment register */
         op->unit = X86_OP_SEG;
-        goto get_reg;
+        op->n = (get_modrm(s, env) >> 3) & 7;
+        /* Values outside [CDEFGS]S, as well as storing to CS, are invalid.  */
+        if (op->n >= 6 || (op->n == R_CS && op == &decode->op[0])) {
+            return false;
+        }
+        break;
 
     case X86_TYPE_P:
         op->unit = X86_OP_MMX;

From 9c3afb9d9b92d166d227b43d890c6a8ad33a928d Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 15 Nov 2025 01:04:18 +0100
Subject: [PATCH 2139/2396] target/i386: svm: fix sign extension of exit code

The exit_code parameter of cpu_vmexit is declared as uint32_t, but exit
codes are 64 bits wide according to the AMD SVM specification.  And because
uint32_t is unsigned, this causes exit codes to be zero-extended, for example
writing SVM_EXIT_ERR as 0xffff_ffff instead of the expected 0xffff_ffff_ffff_ffff.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2977
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/helper-tcg.h        | 2 +-
 target/i386/tcg/system/svm_helper.c | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/helper-tcg.h b/target/i386/tcg/helper-tcg.h
index be011b06b7..e41cbda407 100644
--- a/target/i386/tcg/helper-tcg.h
+++ b/target/i386/tcg/helper-tcg.h
@@ -99,7 +99,7 @@ void cpu_load_eflags(CPUX86State *env, int eflags, int update_mask);
 
 /* system/svm_helper.c */
 #ifndef CONFIG_USER_ONLY
-G_NORETURN void cpu_vmexit(CPUX86State *nenv, uint32_t exit_code,
+G_NORETURN void cpu_vmexit(CPUX86State *nenv, uint64_t exit_code,
                            uint64_t exit_info_1, uintptr_t retaddr);
 void do_vmexit(CPUX86State *env);
 #endif
diff --git a/target/i386/tcg/system/svm_helper.c b/target/i386/tcg/system/svm_helper.c
index 505788b0e2..4b86796518 100644
--- a/target/i386/tcg/system/svm_helper.c
+++ b/target/i386/tcg/system/svm_helper.c
@@ -128,7 +128,7 @@ static inline bool virtual_gif_enabled(CPUX86State *env)
     return false;
 }
 
-static inline bool virtual_vm_load_save_enabled(CPUX86State *env, uint32_t exit_code, uintptr_t retaddr)
+static inline bool virtual_vm_load_save_enabled(CPUX86State *env, uint64_t exit_code, uintptr_t retaddr)
 {
     uint64_t lbr_ctl;
 
@@ -723,7 +723,7 @@ void helper_svm_check_io(CPUX86State *env, uint32_t port, uint32_t param,
     }
 }
 
-void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1,
+void cpu_vmexit(CPUX86State *env, uint64_t exit_code, uint64_t exit_info_1,
                 uintptr_t retaddr)
 {
     CPUState *cs = env_cpu(env);
@@ -732,7 +732,7 @@ void cpu_vmexit(CPUX86State *env, uint32_t exit_code, uint64_t exit_info_1,
 
     qemu_log_mask(CPU_LOG_TB_IN_ASM, "vmexit(%08x, %016" PRIx64 ", %016"
                   PRIx64 ", " TARGET_FMT_lx ")!\n",
-                  exit_code, exit_info_1,
+                  (uint32_t)exit_code, exit_info_1,
                   x86_ldq_phys(cs, env->vm_vmcb + offsetof(struct vmcb,
                                                    control.exit_info_2)),
                   env->eip);

From 106d766c9d5b549bc9780d2d2c519aa2bbebc89a Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Sat, 15 Nov 2025 01:58:57 +0100
Subject: [PATCH 2140/2396] target/i386: fix stack size when delivering real
 mode interrupts

The stack can be 32-bit even in real mode, and in this case
the stack pointer must be updated in its entirety rather than
just the bottom 16 bits.  The same is true of real mode IRET,
for which there was even a comment suggesting the right thing
to do.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1506
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 target/i386/tcg/seg_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/i386/tcg/seg_helper.c b/target/i386/tcg/seg_helper.c
index 667b1c3869..227336c4ef 100644
--- a/target/i386/tcg/seg_helper.c
+++ b/target/i386/tcg/seg_helper.c
@@ -1161,7 +1161,7 @@ static void do_interrupt_real(CPUX86State *env, int intno, int is_int,
     sa.env = env;
     sa.ra = 0;
     sa.sp = env->regs[R_ESP];
-    sa.sp_mask = 0xffff;
+    sa.sp_mask = get_sp_mask(env->segs[R_SS].flags);
     sa.ss_base = env->segs[R_SS].base;
     sa.mmu_index = x86_mmu_index_pl(env, 0);
 
@@ -1964,7 +1964,7 @@ void helper_iret_real(CPUX86State *env, int shift)
     sa.env = env;
     sa.ra = GETPC();
     sa.mmu_index = x86_mmu_index_pl(env, 0);
-    sa.sp_mask = 0xffff; /* XXXX: use SS segment size? */
+    sa.sp_mask = get_sp_mask(env->segs[R_SS].flags);
     sa.sp = env->regs[R_ESP];
     sa.ss_base = env->segs[R_SS].base;
 

From 89dd8c4faac660ffde8f429d1f3699d1c4541b94 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:06 +0000
Subject: [PATCH 2141/2396] tests/docker: drop --link from COPYs in emsdk
 docker
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As we need to build images in both docker and podman lets not have any
incompatibilities. I don't think it makes any major difference.

Reviewed-by: Kohei Tokunaga <ktokunaga.mail@gmail.com>
Message-ID: <20251117115523.3993105-2-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/emsdk-wasm32-cross.docker | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/docker/dockerfiles/emsdk-wasm32-cross.docker b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
index 6b1642a207..1f08eb0b85 100644
--- a/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
+++ b/tests/docker/dockerfiles/emsdk-wasm32-cross.docker
@@ -115,8 +115,8 @@ RUN mkdir -p /glib
 RUN curl -Lks https://download.gnome.org/sources/glib/${GLIB_MINOR_VERSION}/glib-$GLIB_VERSION.tar.xz | \
     tar xJC /glib --strip-components=1
 
-COPY --link --from=zlib-dev /builddeps/ /builddeps/
-COPY --link --from=libffi-dev /builddeps/ /builddeps/
+COPY --from=zlib-dev /builddeps/ /builddeps/
+COPY --from=libffi-dev /builddeps/ /builddeps/
 
 WORKDIR /glib
 RUN <<EOF
@@ -141,5 +141,5 @@ RUN sed -i -E "/#define HAVE_PTHREAD_GETNAME_NP 1/d" ./_build/config.h
 RUN meson install -C _build
 
 FROM build-base
-COPY --link --from=glib-dev /builddeps/ /builddeps/
-COPY --link --from=pixman-dev /builddeps/ /builddeps/
+COPY --from=glib-dev /builddeps/ /builddeps/
+COPY --from=pixman-dev /builddeps/ /builddeps/

From ec99c49382b3c059387c5e0359ed88cfc6d3af25 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:07 +0000
Subject: [PATCH 2142/2396] libvirt-ci: bump libvirt-ci to latest version
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We will need the latest version to add coreutils in the next commit.
As libvirt has updated the handling of ENV variables this brings a
little bit of churn to the docker images.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/alpine.docker        | 10 +++++-----
 tests/docker/dockerfiles/centos9.docker       | 10 +++++-----
 .../dockerfiles/debian-amd64-cross.docker     | 16 ++++++++--------
 .../dockerfiles/debian-arm64-cross.docker     | 16 ++++++++--------
 .../dockerfiles/debian-armhf-cross.docker     | 16 ++++++++--------
 .../dockerfiles/debian-i686-cross.docker      | 16 ++++++++--------
 .../dockerfiles/debian-mips64el-cross.docker  | 16 ++++++++--------
 .../dockerfiles/debian-mipsel-cross.docker    | 16 ++++++++--------
 .../dockerfiles/debian-ppc64el-cross.docker   | 16 ++++++++--------
 .../dockerfiles/debian-riscv64-cross.docker   | 19 ++++++++-----------
 .../dockerfiles/debian-s390x-cross.docker     | 16 ++++++++--------
 tests/docker/dockerfiles/debian.docker        | 10 +++++-----
 .../dockerfiles/fedora-rust-nightly.docker    | 10 +++++-----
 .../dockerfiles/fedora-win64-cross.docker     | 14 +++++++-------
 tests/docker/dockerfiles/fedora.docker        | 10 +++++-----
 tests/docker/dockerfiles/opensuse-leap.docker | 10 +++++-----
 tests/docker/dockerfiles/ubuntu2204.docker    | 10 +++++-----
 tests/lcitool/libvirt-ci                      |  2 +-
 18 files changed, 115 insertions(+), 118 deletions(-)

diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index 52adf9ccbb..1da375c915 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -126,11 +126,11 @@ RUN apk update && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 # https://gitlab.alpinelinux.org/alpine/aports/-/issues/17463
 RUN apk add clang19-libclang
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/centos9.docker b/tests/docker/dockerfiles/centos9.docker
index 0674d77826..ff3e8069b4 100644
--- a/tests/docker/dockerfiles/centos9.docker
+++ b/tests/docker/dockerfiles/centos9.docker
@@ -132,11 +132,11 @@ RUN dnf distro-sync -y && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/clang && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 7f4674400d..26a3994012 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture amd64 && \
@@ -178,9 +178,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/x86_64-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-linux-gnu-gcc
 
-ENV ABI "x86_64-linux-gnu"
-ENV MESON_OPTS "--cross-file=x86_64-linux-gnu"
-ENV RUST_TARGET "x86_64-unknown-linux-gnu"
+ENV ABI="x86_64-linux-gnu"
+ENV MESON_OPTS="--cross-file=x86_64-linux-gnu"
+ENV RUST_TARGET="x86_64-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=x86_64-linux-gnu-
 ENV DEF_TARGET_LIST x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index c7cd54ee5c..4b0163fa1b 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture arm64 && \
@@ -177,9 +177,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/aarch64-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/aarch64-linux-gnu-gcc
 
-ENV ABI "aarch64-linux-gnu"
-ENV MESON_OPTS "--cross-file=aarch64-linux-gnu"
-ENV RUST_TARGET "aarch64-unknown-linux-gnu"
+ENV ABI="aarch64-linux-gnu"
+ENV MESON_OPTS="--cross-file=aarch64-linux-gnu"
+ENV RUST_TARGET="aarch64-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=aarch64-linux-gnu-
 ENV DEF_TARGET_LIST aarch64-softmmu,aarch64-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 627d41c6de..742031ce0a 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture armhf && \
@@ -174,9 +174,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabihf && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/arm-linux-gnueabihf-gcc
 
-ENV ABI "arm-linux-gnueabihf"
-ENV MESON_OPTS "--cross-file=arm-linux-gnueabihf"
-ENV RUST_TARGET "armv7-unknown-linux-gnueabihf"
+ENV ABI="arm-linux-gnueabihf"
+ENV MESON_OPTS="--cross-file=arm-linux-gnueabihf"
+ENV RUST_TARGET="armv7-unknown-linux-gnueabihf"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=arm-linux-gnueabihf-
 ENV DEF_TARGET_LIST arm-softmmu,arm-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 2998764065..1ccfde2e4b 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture i386 && \
@@ -174,9 +174,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/i686-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/i686-linux-gnu-gcc
 
-ENV ABI "i686-linux-gnu"
-ENV MESON_OPTS "--cross-file=i686-linux-gnu"
-ENV RUST_TARGET "i686-unknown-linux-gnu"
+ENV ABI="i686-linux-gnu"
+ENV MESON_OPTS="--cross-file=i686-linux-gnu"
+ENV RUST_TARGET="i686-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=i686-linux-gnu-
 ENV DEF_TARGET_LIST i386-softmmu,i386-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 6e88777f76..eeb77212d5 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -71,11 +71,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture mips64el && \
@@ -173,9 +173,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64 && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mips64el-linux-gnuabi64-gcc
 
-ENV ABI "mips64el-linux-gnuabi64"
-ENV MESON_OPTS "--cross-file=mips64el-linux-gnuabi64"
-ENV RUST_TARGET "mips64el-unknown-linux-gnuabi64"
+ENV ABI="mips64el-linux-gnuabi64"
+ENV MESON_OPTS="--cross-file=mips64el-linux-gnuabi64"
+ENV RUST_TARGET="mips64el-unknown-linux-gnuabi64"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=mips64el-linux-gnuabi64-
 ENV DEF_TARGET_LIST mips64el-softmmu,mips64el-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 5f4e3fa963..9b3dca44f1 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -71,11 +71,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture mipsel && \
@@ -173,9 +173,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/mipsel-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/mipsel-linux-gnu-gcc
 
-ENV ABI "mipsel-linux-gnu"
-ENV MESON_OPTS "--cross-file=mipsel-linux-gnu"
-ENV RUST_TARGET "mipsel-unknown-linux-gnu"
+ENV ABI="mipsel-linux-gnu"
+ENV MESON_OPTS="--cross-file=mipsel-linux-gnu"
+ENV RUST_TARGET="mipsel-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=mipsel-linux-gnu-
 ENV DEF_TARGET_LIST mipsel-softmmu,mipsel-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index dfa690616d..15c6b436d3 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture ppc64el && \
@@ -176,9 +176,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/powerpc64le-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/powerpc64le-linux-gnu-gcc
 
-ENV ABI "powerpc64le-linux-gnu"
-ENV MESON_OPTS "--cross-file=powerpc64le-linux-gnu"
-ENV RUST_TARGET "powerpc64le-unknown-linux-gnu"
+ENV ABI="powerpc64le-linux-gnu"
+ENV MESON_OPTS="--cross-file=powerpc64le-linux-gnu"
+ENV RUST_TARGET="powerpc64le-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=powerpc64le-linux-gnu-
 ENV DEF_TARGET_LIST ppc64-softmmu,ppc64-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index 09b2953f32..2591c4adc9 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -72,17 +72,14 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture riscv64 && \
-    eatmydata apt-get install debian-ports-archive-keyring && \
-    eatmydata echo 'deb http://ftp.ports.debian.org/debian-ports/ sid main' > /etc/apt/sources.list.d/ports.list && \
-    eatmydata echo 'deb http://ftp.ports.debian.org/debian-ports/ unreleased main' >> /etc/apt/sources.list.d/ports.list && \
     eatmydata apt-get update && \
     eatmydata apt-get dist-upgrade -y && \
     eatmydata apt-get install --no-install-recommends -y dpkg-dev && \
@@ -179,9 +176,9 @@ endian = 'little'\n" > /usr/local/share/meson/cross/riscv64-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/riscv64-linux-gnu-gcc
 
-ENV ABI "riscv64-linux-gnu"
-ENV MESON_OPTS "--cross-file=riscv64-linux-gnu"
-ENV RUST_TARGET "riscv64gc-unknown-linux-gnu"
+ENV ABI="riscv64-linux-gnu"
+ENV MESON_OPTS="--cross-file=riscv64-linux-gnu"
+ENV RUST_TARGET="riscv64gc-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=riscv64-linux-gnu-
 ENV DEF_TARGET_LIST riscv64-softmmu,riscv64-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 09a78c15ba..57aa3209c5 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -72,11 +72,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     dpkg --add-architecture s390x && \
@@ -175,9 +175,9 @@ endian = 'big'\n" > /usr/local/share/meson/cross/s390x-linux-gnu && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-cc && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/s390x-linux-gnu-gcc
 
-ENV ABI "s390x-linux-gnu"
-ENV MESON_OPTS "--cross-file=s390x-linux-gnu"
-ENV RUST_TARGET "s390x-unknown-linux-gnu"
+ENV ABI="s390x-linux-gnu"
+ENV MESON_OPTS="--cross-file=s390x-linux-gnu"
+ENV RUST_TARGET="s390x-unknown-linux-gnu"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=s390x-linux-gnu-
 ENV DEF_TARGET_LIST s390x-softmmu,s390x-linux-user
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index 8dd893be4b..bbb920c681 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -152,11 +152,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 # netmap/cscope/global
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \
   apt install -y --no-install-recommends \
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index 7d31c9f406..e4233b53cb 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -152,11 +152,11 @@ exec "$@"\n' > /usr/bin/nosync && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 RUN dnf install -y wget
 ENV RUSTUP_HOME=/usr/local/rustup CARGO_HOME=/usr/local/cargo
 ENV RUSTC=/usr/local/rustup/toolchains/nightly-x86_64-unknown-linux-gnu/bin/rustc
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index c76a70c368..e6f84dd556 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -72,11 +72,11 @@ exec "$@"\n' > /usr/bin/nosync && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 
 RUN nosync dnf install -y \
                mingw-w64-tools \
@@ -110,8 +110,8 @@ RUN nosync dnf install -y \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-w64-mingw32-g++ && \
     ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/x86_64-w64-mingw32-gcc
 
-ENV ABI "x86_64-w64-mingw32"
-ENV MESON_OPTS "--cross-file=/usr/share/mingw/toolchain-mingw64.meson"
+ENV ABI="x86_64-w64-mingw32"
+ENV MESON_OPTS="--cross-file=/usr/share/mingw/toolchain-mingw64.meson"
 ENV QEMU_CONFIGURE_OPTS --cross-prefix=x86_64-w64-mingw32-
 ENV DEF_TARGET_LIST x86_64-softmmu
 # As a final step configure the user (if env is defined)
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 891a740fcb..632259378c 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -152,11 +152,11 @@ exec "$@"\n' > /usr/bin/nosync && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index 75e1747780..def0ca9db4 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -138,11 +138,11 @@ RUN /usr/bin/pip3.11 install \
                      sphinx \
                      sphinx-rtd-theme
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3.11"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3.11"
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index 602d419624..c8cc624929 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -150,11 +150,11 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
 
 RUN /usr/bin/pip3 install meson==1.8.1
 
-ENV CCACHE_WRAPPERSDIR "/usr/libexec/ccache-wrappers"
-ENV LANG "en_US.UTF-8"
-ENV MAKE "/usr/bin/make"
-ENV NINJA "/usr/bin/ninja"
-ENV PYTHON "/usr/bin/python3"
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
 ENV RUSTC=/usr/bin/rustc-1.83
 ENV RUSTDOC=/usr/bin/rustdoc-1.83
 ENV CARGO_HOME=/usr/local/cargo
diff --git a/tests/lcitool/libvirt-ci b/tests/lcitool/libvirt-ci
index 9da20ff7c3..caed407a0f 160000
--- a/tests/lcitool/libvirt-ci
+++ b/tests/lcitool/libvirt-ci
@@ -1 +1 @@
-Subproject commit 9da20ff7c3bc9067804a7561c2ff87583b434853
+Subproject commit caed407a0f1dfe3a3293a41c378c382deefbac36

From 03025667c0dd1d7ce4c77d12d6374670dd0a8e42 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:08 +0000
Subject: [PATCH 2143/2396] tests/lcitool: update ENV stanzas outputted by
 refresh
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Now lcitool has been updated to use the non-legacy ENVs we should do
the same for what refresh adds.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 4 ++--
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 4 ++--
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 4 ++--
 tests/docker/dockerfiles/debian-i686-cross.docker     | 4 ++--
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 4 ++--
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 4 ++--
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 4 ++--
 tests/docker/dockerfiles/debian-riscv64-cross.docker  | 4 ++--
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 4 ++--
 tests/docker/dockerfiles/debian.docker                | 2 +-
 tests/docker/dockerfiles/fedora-win64-cross.docker    | 4 ++--
 tests/lcitool/refresh                                 | 6 +++---
 12 files changed, 24 insertions(+), 24 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index 26a3994012..c38ab8247d 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -181,8 +181,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/x86_64-linux-gnu && \
 ENV ABI="x86_64-linux-gnu"
 ENV MESON_OPTS="--cross-file=x86_64-linux-gnu"
 ENV RUST_TARGET="x86_64-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=x86_64-linux-gnu-
-ENV DEF_TARGET_LIST x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=x86_64-linux-gnu-
+ENV DEF_TARGET_LIST=x86_64-softmmu,x86_64-linux-user,i386-softmmu,i386-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 4b0163fa1b..2f62da0f5e 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -180,8 +180,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/aarch64-linux-gnu && \
 ENV ABI="aarch64-linux-gnu"
 ENV MESON_OPTS="--cross-file=aarch64-linux-gnu"
 ENV RUST_TARGET="aarch64-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=aarch64-linux-gnu-
-ENV DEF_TARGET_LIST aarch64-softmmu,aarch64-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=aarch64-linux-gnu-
+ENV DEF_TARGET_LIST=aarch64-softmmu,aarch64-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 742031ce0a..62e297f5d1 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -177,8 +177,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/arm-linux-gnueabihf && \
 ENV ABI="arm-linux-gnueabihf"
 ENV MESON_OPTS="--cross-file=arm-linux-gnueabihf"
 ENV RUST_TARGET="armv7-unknown-linux-gnueabihf"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=arm-linux-gnueabihf-
-ENV DEF_TARGET_LIST arm-softmmu,arm-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=arm-linux-gnueabihf-
+ENV DEF_TARGET_LIST=arm-softmmu,arm-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index 1ccfde2e4b..eb9a915d49 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -177,8 +177,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/i686-linux-gnu && \
 ENV ABI="i686-linux-gnu"
 ENV MESON_OPTS="--cross-file=i686-linux-gnu"
 ENV RUST_TARGET="i686-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=i686-linux-gnu-
-ENV DEF_TARGET_LIST i386-softmmu,i386-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=i686-linux-gnu-
+ENV DEF_TARGET_LIST=i386-softmmu,i386-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index eeb77212d5..42e8444d15 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -176,8 +176,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/mips64el-linux-gnuabi64 && \
 ENV ABI="mips64el-linux-gnuabi64"
 ENV MESON_OPTS="--cross-file=mips64el-linux-gnuabi64"
 ENV RUST_TARGET="mips64el-unknown-linux-gnuabi64"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=mips64el-linux-gnuabi64-
-ENV DEF_TARGET_LIST mips64el-softmmu,mips64el-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=mips64el-linux-gnuabi64-
+ENV DEF_TARGET_LIST=mips64el-softmmu,mips64el-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 9b3dca44f1..1ab197b144 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -176,8 +176,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/mipsel-linux-gnu && \
 ENV ABI="mipsel-linux-gnu"
 ENV MESON_OPTS="--cross-file=mipsel-linux-gnu"
 ENV RUST_TARGET="mipsel-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=mipsel-linux-gnu-
-ENV DEF_TARGET_LIST mipsel-softmmu,mipsel-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=mipsel-linux-gnu-
+ENV DEF_TARGET_LIST=mipsel-softmmu,mipsel-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 15c6b436d3..85d2c0ffdc 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -179,8 +179,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/powerpc64le-linux-gnu && \
 ENV ABI="powerpc64le-linux-gnu"
 ENV MESON_OPTS="--cross-file=powerpc64le-linux-gnu"
 ENV RUST_TARGET="powerpc64le-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=powerpc64le-linux-gnu-
-ENV DEF_TARGET_LIST ppc64-softmmu,ppc64-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=powerpc64le-linux-gnu-
+ENV DEF_TARGET_LIST=ppc64-softmmu,ppc64-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index 2591c4adc9..4f01eecf41 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -179,8 +179,8 @@ endian = 'little'\n" > /usr/local/share/meson/cross/riscv64-linux-gnu && \
 ENV ABI="riscv64-linux-gnu"
 ENV MESON_OPTS="--cross-file=riscv64-linux-gnu"
 ENV RUST_TARGET="riscv64gc-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=riscv64-linux-gnu-
-ENV DEF_TARGET_LIST riscv64-softmmu,riscv64-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=riscv64-linux-gnu-
+ENV DEF_TARGET_LIST=riscv64-softmmu,riscv64-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 57aa3209c5..2a3046e785 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -178,8 +178,8 @@ endian = 'big'\n" > /usr/local/share/meson/cross/s390x-linux-gnu && \
 ENV ABI="s390x-linux-gnu"
 ENV MESON_OPTS="--cross-file=s390x-linux-gnu"
 ENV RUST_TARGET="s390x-unknown-linux-gnu"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=s390x-linux-gnu-
-ENV DEF_TARGET_LIST s390x-softmmu,s390x-linux-user
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=s390x-linux-gnu-
+ENV DEF_TARGET_LIST=s390x-softmmu,s390x-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index bbb920c681..c1817f162f 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -169,7 +169,7 @@ RUN cd /usr/src/netmap/LINUX && \
   ./configure --no-drivers --no-apps \
   --kernel-dir=$(ls -d /usr/src/linux-headers-*-$(dpkg --print-architecture)) \
   && make install
-ENV QEMU_CONFIGURE_OPTS --enable-netmap
+ENV QEMU_CONFIGURE_OPTS=--enable-netmap
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index e6f84dd556..1da425768f 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -112,8 +112,8 @@ RUN nosync dnf install -y \
 
 ENV ABI="x86_64-w64-mingw32"
 ENV MESON_OPTS="--cross-file=/usr/share/mingw/toolchain-mingw64.meson"
-ENV QEMU_CONFIGURE_OPTS --cross-prefix=x86_64-w64-mingw32-
-ENV DEF_TARGET_LIST x86_64-softmmu
+ENV QEMU_CONFIGURE_OPTS=--cross-prefix=x86_64-w64-mingw32-
+ENV DEF_TARGET_LIST=x86_64-softmmu
 # As a final step configure the user (if env is defined)
 ARG USER
 ARG UID
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index df186caffe..3a31fcfee9 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -121,7 +121,7 @@ debian13_extras = [
     "  ./configure --no-drivers --no-apps \\\n",
     "  --kernel-dir=$(ls -d /usr/src/linux-headers-*-$(dpkg --print-architecture)) \\\n",
     "  && make install\n",
-    "ENV QEMU_CONFIGURE_OPTS --enable-netmap\n"
+    "ENV QEMU_CONFIGURE_OPTS=--enable-netmap\n"
 ]
 
 # Based on the hub.docker.com/library/rust Dockerfiles
@@ -162,8 +162,8 @@ ubuntu2204_rust_extras = [
 ]
 
 def cross_build(prefix, targets):
-    conf = "ENV QEMU_CONFIGURE_OPTS --cross-prefix=%s\n" % (prefix)
-    targets = "ENV DEF_TARGET_LIST %s\n" % (targets)
+    conf = "ENV QEMU_CONFIGURE_OPTS=--cross-prefix=%s\n" % (prefix)
+    targets = "ENV DEF_TARGET_LIST=%s\n" % (targets)
     return "".join([conf, targets])
 
 #

From 556386b0aea625b86f5e4f70f55f0770e9df475e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:09 +0000
Subject: [PATCH 2144/2396] tests/docker: add coreutils to the package list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We need coreutils to run the IO tests so we need to include it in the
package list. Now we have the latest libvirt we can do that.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-5-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/cirrus/freebsd-14.vars                   | 2 +-
 .gitlab-ci.d/cirrus/macos-14.vars                     | 2 +-
 scripts/ci/setup/debian/debian-13-ppc64le.yaml        | 1 +
 scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml      | 1 +
 scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml        | 1 +
 tests/docker/dockerfiles/alpine.docker                | 1 +
 tests/docker/dockerfiles/centos9.docker               | 1 +
 tests/docker/dockerfiles/debian-amd64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-arm64-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-armhf-cross.docker    | 1 +
 tests/docker/dockerfiles/debian-i686-cross.docker     | 1 +
 tests/docker/dockerfiles/debian-mips64el-cross.docker | 1 +
 tests/docker/dockerfiles/debian-mipsel-cross.docker   | 1 +
 tests/docker/dockerfiles/debian-ppc64el-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-riscv64-cross.docker  | 1 +
 tests/docker/dockerfiles/debian-s390x-cross.docker    | 1 +
 tests/docker/dockerfiles/debian.docker                | 1 +
 tests/docker/dockerfiles/fedora-rust-nightly.docker   | 1 +
 tests/docker/dockerfiles/fedora-win64-cross.docker    | 1 +
 tests/docker/dockerfiles/fedora.docker                | 1 +
 tests/docker/dockerfiles/opensuse-leap.docker         | 1 +
 tests/docker/dockerfiles/ubuntu2204.docker            | 1 +
 tests/lcitool/projects/qemu.yml                       | 1 +
 tests/vm/generated/freebsd.json                       | 1 +
 24 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/cirrus/freebsd-14.vars b/.gitlab-ci.d/cirrus/freebsd-14.vars
index 19ca0d3663..6477440ef3 100644
--- a/.gitlab-ci.d/cirrus/freebsd-14.vars
+++ b/.gitlab-ci.d/cirrus/freebsd-14.vars
@@ -11,6 +11,6 @@ MAKE='/usr/local/bin/gmake'
 NINJA='/usr/local/bin/ninja'
 PACKAGING_COMMAND='pkg'
 PIP3='/usr/local/bin/pip'
-PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache4 cmocka ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk-vnc gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson mtools ncurses nettle ninja opencv pixman pkgconf png py311-numpy py311-pillow py311-pip py311-pyyaml py311-sphinx py311-sphinx_rtd_theme py311-tomli python3 rpm2cpio rust rust-bindgen-cli sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 vulkan-tools xorriso zstd'
+PKGS='alsa-lib bash bison bzip2 ca_root_nss capstone4 ccache4 cmocka coreutils ctags curl cyrus-sasl dbus diffutils dtc flex fusefs-libs3 gettext git glib gmake gnutls gsed gtk-vnc gtk3 json-c libepoxy libffi libgcrypt libjpeg-turbo libnfs libslirp libspice-server libssh libtasn1 llvm lzo2 meson mtools ncurses nettle ninja opencv pixman pkgconf png py311-numpy py311-pillow py311-pip py311-pyyaml py311-sphinx py311-sphinx_rtd_theme py311-tomli python3 rpm2cpio rust rust-bindgen-cli sdl2 sdl2_image snappy sndio socat spice-protocol tesseract usbredir virglrenderer vte3 vulkan-tools xorriso zstd'
 PYPI_PKGS=''
 PYTHON='/usr/local/bin/python3'
diff --git a/.gitlab-ci.d/cirrus/macos-14.vars b/.gitlab-ci.d/cirrus/macos-14.vars
index b039465f56..4701c388e1 100644
--- a/.gitlab-ci.d/cirrus/macos-14.vars
+++ b/.gitlab-ci.d/cirrus/macos-14.vars
@@ -11,6 +11,6 @@ MAKE='/opt/homebrew/bin/gmake'
 NINJA='/opt/homebrew/bin/ninja'
 PACKAGING_COMMAND='brew'
 PIP3='/opt/homebrew/bin/pip3'
-PKGS='bash bc bindgen bison bzip2 capstone ccache cmocka ctags curl dbus diffutils dtc flex gcovr gettext git glib gnu-sed gnutls gtk+3 gtk-vnc jemalloc jpeg-turbo json-c libcbor libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson mtools ncurses nettle ninja pixman pkg-config python3 rpm2cpio rust sdl2 sdl2_image snappy socat sparse spice-protocol swtpm tesseract usbredir vde vte3 vulkan-tools xorriso zlib zstd'
+PKGS='bash bc bindgen bison bzip2 capstone ccache cmocka coreutils ctags curl dbus diffutils dtc flex gcovr gettext git glib gnu-sed gnutls gtk+3 gtk-vnc jemalloc jpeg-turbo json-c libcbor libepoxy libffi libgcrypt libiscsi libnfs libpng libslirp libssh libtasn1 libusb llvm lzo make meson mtools ncurses nettle ninja pixman pkg-config python3 rpm2cpio rust sdl2 sdl2_image snappy socat sparse spice-protocol swtpm tesseract usbredir vde vte3 vulkan-tools xorriso zlib zstd'
 PYPI_PKGS='PyYAML numpy pillow sphinx sphinx-rtd-theme tomli'
 PYTHON='/opt/homebrew/bin/python3'
diff --git a/scripts/ci/setup/debian/debian-13-ppc64le.yaml b/scripts/ci/setup/debian/debian-13-ppc64le.yaml
index e29c9c1840..25d96cea46 100644
--- a/scripts/ci/setup/debian/debian-13-ppc64le.yaml
+++ b/scripts/ci/setup/debian/debian-13-ppc64le.yaml
@@ -14,6 +14,7 @@ packages:
   - ca-certificates
   - ccache
   - clang
+  - coreutils
   - dbus
   - debianutils
   - diffutils
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
index d303411391..6a72eabca9 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-aarch64.yaml
@@ -14,6 +14,7 @@ packages:
   - ca-certificates
   - ccache
   - clang
+  - coreutils
   - dbus
   - debianutils
   - diffutils
diff --git a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
index 4ee8630cc4..6001da1250 100644
--- a/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
+++ b/scripts/ci/setup/ubuntu/ubuntu-2404-s390x.yaml
@@ -14,6 +14,7 @@ packages:
   - ca-certificates
   - ccache
   - clang
+  - coreutils
   - dbus
   - debianutils
   - diffutils
diff --git a/tests/docker/dockerfiles/alpine.docker b/tests/docker/dockerfiles/alpine.docker
index 1da375c915..03dd6851f6 100644
--- a/tests/docker/dockerfiles/alpine.docker
+++ b/tests/docker/dockerfiles/alpine.docker
@@ -22,6 +22,7 @@ RUN apk update && \
         ceph-dev \
         clang \
         cmocka-dev \
+        coreutils \
         ctags \
         curl-dev \
         cyrus-sasl-dev \
diff --git a/tests/docker/dockerfiles/centos9.docker b/tests/docker/dockerfiles/centos9.docker
index ff3e8069b4..670e22be5a 100644
--- a/tests/docker/dockerfiles/centos9.docker
+++ b/tests/docker/dockerfiles/centos9.docker
@@ -26,6 +26,7 @@ RUN dnf distro-sync -y && \
         ccache \
         clang \
         compiler-rt \
+        coreutils-single \
         ctags \
         cyrus-sasl-devel \
         daxctl-devel \
diff --git a/tests/docker/dockerfiles/debian-amd64-cross.docker b/tests/docker/dockerfiles/debian-amd64-cross.docker
index c38ab8247d..c386b658b0 100644
--- a/tests/docker/dockerfiles/debian-amd64-cross.docker
+++ b/tests/docker/dockerfiles/debian-amd64-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-arm64-cross.docker b/tests/docker/dockerfiles/debian-arm64-cross.docker
index 2f62da0f5e..9d83ab7a32 100644
--- a/tests/docker/dockerfiles/debian-arm64-cross.docker
+++ b/tests/docker/dockerfiles/debian-arm64-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-armhf-cross.docker b/tests/docker/dockerfiles/debian-armhf-cross.docker
index 62e297f5d1..c2077ec7a2 100644
--- a/tests/docker/dockerfiles/debian-armhf-cross.docker
+++ b/tests/docker/dockerfiles/debian-armhf-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-i686-cross.docker b/tests/docker/dockerfiles/debian-i686-cross.docker
index eb9a915d49..db9f04ee93 100644
--- a/tests/docker/dockerfiles/debian-i686-cross.docker
+++ b/tests/docker/dockerfiles/debian-i686-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-mips64el-cross.docker b/tests/docker/dockerfiles/debian-mips64el-cross.docker
index 42e8444d15..7758afd80a 100644
--- a/tests/docker/dockerfiles/debian-mips64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-mips64el-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-mipsel-cross.docker b/tests/docker/dockerfiles/debian-mipsel-cross.docker
index 1ab197b144..cba7f43870 100644
--- a/tests/docker/dockerfiles/debian-mipsel-cross.docker
+++ b/tests/docker/dockerfiles/debian-mipsel-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-ppc64el-cross.docker b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
index 85d2c0ffdc..24f946d144 100644
--- a/tests/docker/dockerfiles/debian-ppc64el-cross.docker
+++ b/tests/docker/dockerfiles/debian-ppc64el-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-riscv64-cross.docker b/tests/docker/dockerfiles/debian-riscv64-cross.docker
index 4f01eecf41..f476cf65ea 100644
--- a/tests/docker/dockerfiles/debian-riscv64-cross.docker
+++ b/tests/docker/dockerfiles/debian-riscv64-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian-s390x-cross.docker b/tests/docker/dockerfiles/debian-s390x-cross.docker
index 2a3046e785..a60b4ab01d 100644
--- a/tests/docker/dockerfiles/debian-s390x-cross.docker
+++ b/tests/docker/dockerfiles/debian-s390x-cross.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       bzip2 \
                       ca-certificates \
                       ccache \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/debian.docker b/tests/docker/dockerfiles/debian.docker
index c1817f162f..6c6ab0256e 100644
--- a/tests/docker/dockerfiles/debian.docker
+++ b/tests/docker/dockerfiles/debian.docker
@@ -20,6 +20,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       ca-certificates \
                       ccache \
                       clang \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/docker/dockerfiles/fedora-rust-nightly.docker b/tests/docker/dockerfiles/fedora-rust-nightly.docker
index e4233b53cb..8e3b3a9fd9 100644
--- a/tests/docker/dockerfiles/fedora-rust-nightly.docker
+++ b/tests/docker/dockerfiles/fedora-rust-nightly.docker
@@ -33,6 +33,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                ccache \
                clang \
                compiler-rt \
+               coreutils \
                ctags \
                cyrus-sasl-devel \
                daxctl-devel \
diff --git a/tests/docker/dockerfiles/fedora-win64-cross.docker b/tests/docker/dockerfiles/fedora-win64-cross.docker
index 1da425768f..4f743c0043 100644
--- a/tests/docker/dockerfiles/fedora-win64-cross.docker
+++ b/tests/docker/dockerfiles/fedora-win64-cross.docker
@@ -26,6 +26,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                ca-certificates \
                ccache \
                compiler-rt \
+               coreutils \
                ctags \
                dbus-daemon \
                diffutils \
diff --git a/tests/docker/dockerfiles/fedora.docker b/tests/docker/dockerfiles/fedora.docker
index 632259378c..9278d79769 100644
--- a/tests/docker/dockerfiles/fedora.docker
+++ b/tests/docker/dockerfiles/fedora.docker
@@ -33,6 +33,7 @@ exec "$@"\n' > /usr/bin/nosync && \
                ccache \
                clang \
                compiler-rt \
+               coreutils \
                ctags \
                cyrus-sasl-devel \
                daxctl-devel \
diff --git a/tests/docker/dockerfiles/opensuse-leap.docker b/tests/docker/dockerfiles/opensuse-leap.docker
index def0ca9db4..a041d43976 100644
--- a/tests/docker/dockerfiles/opensuse-leap.docker
+++ b/tests/docker/dockerfiles/opensuse-leap.docker
@@ -20,6 +20,7 @@ RUN zypper update -y && \
            ccache \
            clang \
            clang-devel \
+           coreutils \
            ctags \
            cyrus-sasl-devel \
            dbus-1 \
diff --git a/tests/docker/dockerfiles/ubuntu2204.docker b/tests/docker/dockerfiles/ubuntu2204.docker
index c8cc624929..23b33d6ad4 100644
--- a/tests/docker/dockerfiles/ubuntu2204.docker
+++ b/tests/docker/dockerfiles/ubuntu2204.docker
@@ -19,6 +19,7 @@ RUN export DEBIAN_FRONTEND=noninteractive && \
                       ca-certificates \
                       ccache \
                       clang \
+                      coreutils \
                       dbus \
                       debianutils \
                       diffutils \
diff --git a/tests/lcitool/projects/qemu.yml b/tests/lcitool/projects/qemu.yml
index 82812e7736..1ee7dcf3d4 100644
--- a/tests/lcitool/projects/qemu.yml
+++ b/tests/lcitool/projects/qemu.yml
@@ -13,6 +13,7 @@ packages:
  - clang
  - cmocka
  - column
+ - coreutils
  - ctags
  - cyrus-sasl
  - daxctl
diff --git a/tests/vm/generated/freebsd.json b/tests/vm/generated/freebsd.json
index c03e1cd586..f586827b13 100644
--- a/tests/vm/generated/freebsd.json
+++ b/tests/vm/generated/freebsd.json
@@ -15,6 +15,7 @@
     "capstone4",
     "ccache4",
     "cmocka",
+    "coreutils",
     "ctags",
     "curl",
     "cyrus-sasl",

From 45265100be95c634b66e9854e8183dced4ce50b6 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Mon, 17 Nov 2025 11:55:10 +0000
Subject: [PATCH 2145/2396] docs/about/emulation: update assets for uftrace
 plugin documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro is discontinuing its fileserver service by end of the year.
Migrate assets to GitHub.

Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251117115523.3993105-6-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/about/emulation.rst | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/about/emulation.rst b/docs/about/emulation.rst
index 92c219119e..4a7d1f4178 100644
--- a/docs/about/emulation.rst
+++ b/docs/about/emulation.rst
@@ -886,24 +886,24 @@ As an example, we can trace qemu itself running git::
     $ uftrace dump --chrome | gzip > ~/qemu_aarch64_git_help.json.gz
 
 For convenience, you can download this trace `qemu_aarch64_git_help.json.gz
-<https://fileserver.linaro.org/s/N8X8fnZ5yGRZLsT/download/qemu_aarch64_git_help.json.gz>`_.
+<https://github.com/pbo-linaro/qemu-assets/raw/refs/heads/master/qemu-uftrace/qemu_aarch64_git_help.json.gz>`_.
 Download it and open this trace on https://ui.perfetto.dev/. You can zoom in/out
 using :kbd:`W`, :kbd:`A`, :kbd:`S`, :kbd:`D` keys.
 Some sequences taken from this trace:
 
 - Loading program and its interpreter
 
-.. image:: https://fileserver.linaro.org/s/fie8JgX76yyL5cq/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/loader_exec.png?raw=true
    :height: 200px
 
 - open syscall
 
-.. image:: https://fileserver.linaro.org/s/rsXPTeZZPza4PcE/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/open_syscall.png?raw=true
    :height: 200px
 
 - TB creation
 
-.. image:: https://fileserver.linaro.org/s/GXY6NKMw5EeRCew/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/tb_translation.png?raw=true
    :height: 200px
 
 It's usually better to use ``uftrace record`` directly. However, tracing
@@ -916,7 +916,7 @@ Example system trace
 
 A full trace example (chrome trace, from instructions below) generated from a
 system boot can be found `here
-<https://fileserver.linaro.org/s/WsemLboPEzo24nw/download/aarch64_boot.json.gz>`_.
+<https://github.com/pbo-linaro/qemu-assets/raw/refs/heads/master/qemu-uftrace/aarch64_boot.json.gz>`_.
 Download it and open this trace on https://ui.perfetto.dev/. You can see code
 executed for all privilege levels, and zoom in/out using
 :kbd:`W`, :kbd:`A`, :kbd:`S`, :kbd:`D` keys. You can find below some sequences
@@ -924,27 +924,27 @@ taken from this trace:
 
 - Two first stages of boot sequence in Arm Trusted Firmware (EL3 and S-EL1)
 
-.. image:: https://fileserver.linaro.org/s/kkxBS552W7nYESX/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/bl3_to_bl1.png?raw=true
    :height: 200px
 
 - U-boot initialization (until code relocation, after which we can't track it)
 
-.. image:: https://fileserver.linaro.org/s/LKTgsXNZFi5GFNC/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/uboot.png?raw=true
    :height: 200px
 
 - Stat and open syscalls in kernel
 
-.. image:: https://fileserver.linaro.org/s/dXe4MfraKg2F476/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/stat.png?raw=true
    :height: 200px
 
 - Timer interrupt
 
-.. image:: https://fileserver.linaro.org/s/TM5yobYzJtP7P3C/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/timer_interrupt.png?raw=true
    :height: 200px
 
 - Poweroff sequence (from kernel back to firmware, NS-EL2 to EL3)
 
-.. image:: https://fileserver.linaro.org/s/oR2PtyGKJrqnfRf/preview
+.. image:: https://github.com/pbo-linaro/qemu-assets/blob/master/qemu-uftrace/poweroff.png?raw=true
    :height: 200px
 
 Build and run system example

From 863449cc8ec7ff23d41ac71d462e2349e11b3852 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:11 +0000
Subject: [PATCH 2146/2396] tests: move test_xen assets to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Message-ID: <20251117115523.3993105-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/aarch64/test_xen.py | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/tests/functional/aarch64/test_xen.py b/tests/functional/aarch64/test_xen.py
index 261d796540..d90595cad3 100755
--- a/tests/functional/aarch64/test_xen.py
+++ b/tests/functional/aarch64/test_xen.py
@@ -25,8 +25,7 @@ class BootXen(LinuxKernelTest):
     XEN_COMMON_COMMAND_LINE = 'dom0_mem=128M loglvl=all guest_loglvl=all'
 
     ASSET_KERNEL = Asset(
-        ('https://fileserver.linaro.org/s/JSsewXGZ6mqxPr5/'
-         'download?path=%2F&files=linux-5.9.9-arm64-ajb'),
+        'https://share.linaro.org/downloadFile?id=RRahAWwAwYKTZQd',
         '00366fa51ea957c19462d2e2aefd480bef80ce727120e714ae48e0c88f261edb')
 
     def launch_xen(self, xen_path):
@@ -55,8 +54,7 @@ class BootXen(LinuxKernelTest):
         wait_for_console_pattern(self, console_pattern, "Panic on CPU 0:")
 
     ASSET_XEN_4_11 = Asset(
-        ('https://fileserver.linaro.org/s/JSsewXGZ6mqxPr5/download?path=%2F&'
-         'files=xen-hypervisor-4.11-arm64_4.11.4%2B37-g3263f257ca-1_arm64.deb'),
+        'https://share.linaro.org/downloadFile?id=ALU4n2NGGYbE4fO',
         'b745c2631342f9fcc0147ddc364edb62c20ecfebd430e5a3546e7d7c6891c0bc')
 
     def test_arm64_xen_411_and_dom0(self):
@@ -66,8 +64,7 @@ class BootXen(LinuxKernelTest):
         self.launch_xen(xen_path)
 
     ASSET_XEN_4_14 = Asset(
-        ('https://fileserver.linaro.org/s/JSsewXGZ6mqxPr5/download?path=%2F&'
-         'files=xen-hypervisor-4.14-arm64_4.14.0%2B80-gd101b417b7-1_arm64.deb'),
+        'https://share.linaro.org/downloadFile?id=os4zSXPl7WW4lqX',
         'e930a3293248edabd367d5b4b3b6448b9c99c057096ea8b47228a7870661d5cb')
 
     def test_arm64_xen_414_and_dom0(self):
@@ -77,8 +74,7 @@ class BootXen(LinuxKernelTest):
         self.launch_xen(xen_path)
 
     ASSET_XEN_4_15 = Asset(
-        ('https://fileserver.linaro.org/s/JSsewXGZ6mqxPr5/download?path=%2F&'
-         'files=xen-upstream-4.15-unstable.deb'),
+        'https://share.linaro.org/downloadFile?id=jjjG4uTp2wuO4Ks',
         '2a9a8af8acf0231844657cc28baab95bd918b0ee2d493ee4ee6f8846e1358bc9')
 
     def test_arm64_xen_415_and_dom0(self):

From dfaf3695b20d653338c2f34edbbb552f697033c3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:12 +0000
Subject: [PATCH 2147/2396] tests: move test_virt assets to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site. While I'm at it drop the old pauth-impdef flag
which is no longer needed.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Message-ID: <20251117115523.3993105-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/aarch64/test_virt.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/tests/functional/aarch64/test_virt.py b/tests/functional/aarch64/test_virt.py
index 63071f9b51..f9e3ec08fa 100755
--- a/tests/functional/aarch64/test_virt.py
+++ b/tests/functional/aarch64/test_virt.py
@@ -60,8 +60,7 @@ class Aarch64VirtMachine(QemuSystemTest):
 
 
     ASSET_KERNEL = Asset(
-        ('https://fileserver.linaro.org/s/'
-         'z6B2ARM7DQT3HWN/download'),
+        'https://share.linaro.org/downloadFile?id=3zGlbmXh8pXFewt',
         '12a54d4805cda6ab647cb7c7bbdb16fafb3df400e0d6f16445c1a0436100ef8d')
 
     def common_aarch64_virt(self, machine):
@@ -77,7 +76,7 @@ class Aarch64VirtMachine(QemuSystemTest):
         self.vm.set_console()
         kernel_command_line = (self.KERNEL_COMMON_COMMAND_LINE +
                                'console=ttyAMA0')
-        self.vm.add_args('-cpu', 'max,pauth-impdef=on',
+        self.vm.add_args('-cpu', 'max',
                          '-machine', machine,
                          '-accel', 'tcg',
                          '-kernel', kernel_path,

From 5ff8d1fac98ba35391412883a17feb16a5b464e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:13 +0000
Subject: [PATCH 2148/2396] tests: move test_netdev_ethtool to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Message-ID: <20251117115523.3993105-9-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/x86_64/test_netdev_ethtool.py | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/tests/functional/x86_64/test_netdev_ethtool.py b/tests/functional/x86_64/test_netdev_ethtool.py
index ee1a397bd2..ac8a92512c 100755
--- a/tests/functional/x86_64/test_netdev_ethtool.py
+++ b/tests/functional/x86_64/test_netdev_ethtool.py
@@ -16,16 +16,10 @@ class NetDevEthtool(QemuSystemTest):
     # Runs in about 17s under KVM, 19s under TCG, 25s under GCOV
     timeout = 45
 
-    # Fetch assets from the netdev-ethtool subdir of my shared test
-    # images directory on fileserver.linaro.org.
-    ASSET_BASEURL = ('https://fileserver.linaro.org/s/kE4nCFLdQcoBF9t/'
-                     'download?path=%2Fnetdev-ethtool&files=')
-    ASSET_BZIMAGE = Asset(
-        ASSET_BASEURL + "bzImage",
-        "ed62ee06ea620b1035747f3f66a5e9fc5d3096b29f75562ada888b04cd1c4baf")
-    ASSET_ROOTFS = Asset(
-        ASSET_BASEURL + "rootfs.squashfs",
-        "8f0207e3c4d40832ae73c1a927e42ca30ccb1e71f047acb6ddb161ba422934e6")
+    ASSET_BZIMAGE = Asset("https://share.linaro.org/downloadFile?id=QD37GYYAJhGOgVe",
+                          "ed62ee06ea620b1035747f3f66a5e9fc5d3096b29f75562ada888b04cd1c4baf")
+    ASSET_ROOTFS = Asset("https://share.linaro.org/downloadFile?id=YAqnr0W8fruDh3f",
+                         "8f0207e3c4d40832ae73c1a927e42ca30ccb1e71f047acb6ddb161ba422934e6")
 
     def common_test_code(self, netdev, extra_args=None):
         self.set_machine('q35')

From 533b5ac2d6a826619cf80b009bf23ae3246d7011 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:14 +0000
Subject: [PATCH 2149/2396] tests: move test_kvm_xen to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Message-ID: <20251117115523.3993105-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/x86_64/test_kvm_xen.py | 15 ++++-----------
 1 file changed, 4 insertions(+), 11 deletions(-)

diff --git a/tests/functional/x86_64/test_kvm_xen.py b/tests/functional/x86_64/test_kvm_xen.py
index a5d445023c..424d4b2001 100755
--- a/tests/functional/x86_64/test_kvm_xen.py
+++ b/tests/functional/x86_64/test_kvm_xen.py
@@ -23,18 +23,11 @@ class KVMXenGuest(QemuSystemTest):
     kernel_path = None
     kernel_params = None
 
-    # Fetch assets from the kvm-xen-guest subdir of my shared test
-    # images directory on fileserver.linaro.org where you can find
-    # build instructions for how they where assembled.
-    ASSET_KERNEL = Asset(
-        ('https://fileserver.linaro.org/s/kE4nCFLdQcoBF9t/download?'
-         'path=%2Fkvm-xen-guest&files=bzImage'),
-        'ec0ad7bb8c33c5982baee0a75505fe7dbf29d3ff5d44258204d6307c6fe0132a')
+    ASSET_KERNEL = Asset('https://share.linaro.org/downloadFile?id=UG0V8dzzHrrHb9X',
+                         'ec0ad7bb8c33c5982baee0a75505fe7dbf29d3ff5d44258204d6307c6fe0132a')
 
-    ASSET_ROOTFS = Asset(
-        ('https://fileserver.linaro.org/s/kE4nCFLdQcoBF9t/download?'
-         'path=%2Fkvm-xen-guest&files=rootfs.ext4'),
-        'b11045d649006c649c184e93339aaa41a8fe20a1a86620af70323252eb29e40b')
+    ASSET_ROOTFS = Asset('https://share.linaro.org/downloadFile?id=VwLRKDXKFl6oKti',
+                         'b11045d649006c649c184e93339aaa41a8fe20a1a86620af70323252eb29e40b')
 
     def common_vm_setup(self):
         # We also catch lack of KVM_XEN support if we fail to launch

From ced9f2ffc20dd182b2504fb08391a796c65bb0af Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:15 +0000
Subject: [PATCH 2150/2396] tests: move test_kvm to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site.

Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251117115523.3993105-11-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/aarch64/test_kvm.py | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/tests/functional/aarch64/test_kvm.py b/tests/functional/aarch64/test_kvm.py
index 9fb9286139..7545f5ed55 100755
--- a/tests/functional/aarch64/test_kvm.py
+++ b/tests/functional/aarch64/test_kvm.py
@@ -19,9 +19,7 @@ from qemu_test.linuxkernel import LinuxKernelTest
 class Aarch64VirtKVMTests(LinuxKernelTest):
 
     ASSET_KVM_TEST_KERNEL = Asset(
-        'https://fileserver.linaro.org/s/HmjaxXXYHYSqbes/'
-        'download?path=%2F&files='
-        'image-with-kvm-tool-and-unit-tests.gz',
+        'https://share.linaro.org/downloadFile?id=Bs8Eb2Wb7yWtkTA',
         '34de4aaea90db5da42729e7d28b77f392c37a2f4da859f889a5234aaf0970696')
 
     # make it easier to detect successful return to shell

From 497d3e87ce2d58a4781de03c6f5b0200ef79909f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:16 +0000
Subject: [PATCH 2151/2396] tests: move test_virt_gpu to share.linaro.org
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Linaro are migrating file-hosting from the old NextCloud instance to
another sharing site.

Cc: qemu-stable@nongnu.org
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251117115523.3993105-12-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/functional/aarch64/test_virt_gpu.py | 8 ++------
 1 file changed, 2 insertions(+), 6 deletions(-)

diff --git a/tests/functional/aarch64/test_virt_gpu.py b/tests/functional/aarch64/test_virt_gpu.py
index 4e50887c3e..c26a1f20c6 100755
--- a/tests/functional/aarch64/test_virt_gpu.py
+++ b/tests/functional/aarch64/test_virt_gpu.py
@@ -23,15 +23,11 @@ from subprocess import check_output, CalledProcessError
 class Aarch64VirtGPUMachine(LinuxKernelTest):
 
     ASSET_VIRT_GPU_KERNEL = Asset(
-        'https://fileserver.linaro.org/s/ce5jXBFinPxtEdx/'
-        'download?path=%2F&files='
-        'Image.6.12.16.aarch64',
+        'https://share.linaro.org/downloadFile?id=lL8wgnMmSXZo7Co',
         '7888c51c55d37e86bbbdeb5acea9f08c34e6b0f03c1f5b2463285f6a6f6eec8b')
 
     ASSET_VIRT_GPU_ROOTFS = Asset(
-        'https://fileserver.linaro.org/s/ce5jXBFinPxtEdx/'
-        'download?path=%2F&files='
-        'rootfs.aarch64.ext2.zstd',
+        'https://share.linaro.org/downloadFile?id=qOn1wbfKmS6KVHZ',
         'd45118c899420b7e673f1539a37a35480134b3e36e3a59e2cb69b1781cbb14ef')
 
     def _launch_virt_gpu(self, gpu_device):

From f65da9e69039a4b92a7f94dd114d5417df9f5a00 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:17 +0000
Subject: [PATCH 2152/2396] gitlab: add initial ppc64le custom-runner test
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This is a plain configure build but I only run a subset of the tests
until the kinks have been worked out.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-13-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners.yml               |  1 +
 .../custom-runners/debian-13-ppc64le.yml      | 41 +++++++++++++++++++
 docs/devel/testing/ci-jobs.rst.inc            |  6 +++
 3 files changed, 48 insertions(+)
 create mode 100644 .gitlab-ci.d/custom-runners/debian-13-ppc64le.yml

diff --git a/.gitlab-ci.d/custom-runners.yml b/.gitlab-ci.d/custom-runners.yml
index 142fbf4a24..3e28e48c97 100644
--- a/.gitlab-ci.d/custom-runners.yml
+++ b/.gitlab-ci.d/custom-runners.yml
@@ -31,3 +31,4 @@
 include:
   - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml'
   - local: '/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml'
+  - local: '/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml'
diff --git a/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
new file mode 100644
index 0000000000..e088c3b67b
--- /dev/null
+++ b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
@@ -0,0 +1,41 @@
+# All jobs should run successfully in an environment setup by the
+# scripts/ci/setup/build-environment.yml task:
+# "Install basic packages to build QEMU on Ubuntu/Debian"
+
+.debian_ppc64le_template:
+  extends: .custom_runner_template
+  needs: []
+  stage: build
+  tags:
+    - debian_13
+    - ppc64le
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: "$PPC64LE_RUNNER_AVAILABLE"
+  before_script:
+    - source scripts/ci/gitlab-ci-section
+    - section_start setup "Pre-script setup"
+    - JOBS=$(expr $(nproc) - 2)
+    - section_end setup
+  script:
+    - mkdir build
+    - cd build
+    - section_start configure "Running configure"
+    - ../configure $CONFIGURE_ARGS ||
+          { cat config.log meson-logs/meson-log.txt && exit 1; }
+    - section_end configure
+    - section_start build "Building QEMU"
+    - make --output-sync -j"$JOBS"
+    - section_end build
+    - section_start test "Running tests"
+    - if test -n "$MAKE_CHECK_ARGS";
+      then
+        make -j"$JOBS" $MAKE_CHECK_ARGS ;
+      fi
+    - section_end test
+
+debian-13-ppc64le-default:
+  extends: .debian_ppc64le_template
+  variables:
+    # qtest currently fails: https://gitlab.com/qemu-project/qemu/-/issues/3207
+    MAKE_CHECK_ARGS: check-unit check-tcg check-softfloat
diff --git a/docs/devel/testing/ci-jobs.rst.inc b/docs/devel/testing/ci-jobs.rst.inc
index b92d372a0a..f1c70344ec 100644
--- a/docs/devel/testing/ci-jobs.rst.inc
+++ b/docs/devel/testing/ci-jobs.rst.inc
@@ -174,6 +174,12 @@ If you've got access to an IBM Z host that can be used as a gitlab-CI
 runner, you can set this variable to enable the tests that require this
 kind of host. The runner should be tagged with "s390x".
 
+PPC64LE_RUNNER_AVAILABLE
+~~~~~~~~~~~~~~~~~~~~~~~~
+If you've got access to an PPC64LE host that can be used as a gitlab-CI
+runner, you can set this variable to enable the tests that require this
+kind of host. The runner should be tagged with "ppc64le".
+
 CCACHE_DISABLE
 ~~~~~~~~~~~~~~
 The jobs are configured to use "ccache" by default since this typically

From ea55bfc3a9fa6803944e5bbf758e488aaa294f6b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:18 +0000
Subject: [PATCH 2153/2396] gitlab: use template for ubuntu-24.04-s390x jobs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Most of the test is pure boilerplate so to save ourselves from
repetition move all the main bits into a minimal copy of
native_build_job_template but without the caching.

We keep all the current allow_fail, manual and configure setups but do
take the opportunity to replace the inline nproc calls to using a
common JOBS variable. We also fix the namespace check to use the
QEMU_CI_UPSTREAM variable.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-14-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .../custom-runners/ubuntu-24.04-s390x.yml     | 185 +++++++-----------
 1 file changed, 70 insertions(+), 115 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
index 45dbee1788..2fc940e127 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
@@ -2,129 +2,84 @@
 # setup by the scripts/ci/setup/ubuntu/build-environment.yml task
 # "Install basic packages to build QEMU on Ubuntu 24.04"
 
+.ubuntu_s390x_template:
+  extends: .custom_runner_template
+  needs: []
+  stage: build
+  tags:
+    - ubuntu_24.04
+    - s390x
+  rules:
+    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: "$S390X_RUNNER_AVAILABLE"
+  before_script:
+    - source scripts/ci/gitlab-ci-section
+    - section_start setup "Pre-script setup"
+    - JOBS=$(expr $(nproc) - 1)
+    - section_end setup
+  script:
+    - mkdir build
+    - cd build
+    - section_start configure "Running configure"
+    - ../configure $CONFIGURE_ARGS ||
+        { cat config.log meson-logs/meson-log.txt; exit 1; }
+    - section_end configure
+    - section_start build "Building QEMU"
+    - make --output-sync -j"$JOBS"
+    - section_end build
+    - section_start test "Running tests"
+    - if test -n "$MAKE_CHECK_ARGS";
+      then
+        make -j"$JOBS" $MAKE_CHECK_ARGS ;
+      fi
+    - section_end test
+
 ubuntu-24.04-s390x-all-linux:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
- - if: "$S390X_RUNNER_AVAILABLE"
- script:
- - mkdir build
- - cd build
- - ../configure --enable-debug --disable-system --disable-tools --disable-docs
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc`
- - make --output-sync check-tcg
- - make --output-sync -j`nproc` check
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --enable-debug --disable-system --disable-tools --disable-docs
+    MAKE_CHECK_ARGS: check-tcg check
 
 ubuntu-24.04-s390x-all-system:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- timeout: 75m
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   allow_failure: true
- - if: "$S390X_RUNNER_AVAILABLE"
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --disable-user
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc`
- - make --output-sync -j`nproc` check
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --disable-user
+    MAKE_CHECK_ARGS: check
+  allow_failure: true
 
 ubuntu-24.04-s390x-alldbg:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$S390X_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --enable-debug
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make clean
- - make --output-sync -j`nproc`
- - make --output-sync -j`nproc` check
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --enable-debug
+    MAKE_CHECK_ARGS: check
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-s390x-clang:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$S390X_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --cc=clang --cxx=clang++ --enable-ubsan
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc`
- - make --output-sync -j`nproc` check
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-ubsan
+    MAKE_CHECK_ARGS: check
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-s390x-tci:
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$S390X_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --enable-tcg-interpreter
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc`
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --enable-tcg-interpreter
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-s390x-notcg:
- extends: .custom_runner_template
- needs: []
- stage: build
- tags:
- - ubuntu_24.04
- - s390x
- rules:
- - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-   when: manual
-   allow_failure: true
- - if: "$S390X_RUNNER_AVAILABLE"
-   when: manual
-   allow_failure: true
- script:
- - mkdir build
- - cd build
- - ../configure --disable-tcg
-   || { cat config.log meson-logs/meson-log.txt; exit 1; }
- - make --output-sync -j`nproc`
- - make --output-sync -j`nproc` check
+  extends: .ubuntu_s390x_template
+  needs: []
+  variables:
+    CONFIGURE_ARGS: --disable-tcg
+    MAKE_CHECK_ARGS: check
+  allow_failure: true
+  when: manual

From 56ebddfcc25472cc0771e232dc9ed0c4df878b04 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:19 +0000
Subject: [PATCH 2154/2396] gitlab: simplify the ubuntu-24.04-aarch64 rules
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We don't need to duplicate the if rules to get the allow_failure and
manual behaviour we want. Clean that up to keep all the rules in the
same place.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-15-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .../custom-runners/ubuntu-24.04-aarch64.yml   | 43 +++++--------------
 1 file changed, 10 insertions(+), 33 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index ee13587d99..6f950baee0 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -46,26 +46,16 @@ ubuntu-24.04-aarch64-all:
   extends: .ubuntu_aarch64_template
   variables:
     MAKE_CHECK_ARGS: check
-  rules:
-    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-      when: manual
-      allow_failure: true
-    - if: "$AARCH64_RUNNER_AVAILABLE"
-      when: manual
-      allow_failure: true
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-aarch64-without-defaults:
   extends: .ubuntu_aarch64_template
   variables:
     CONFIGURE_ARGS: --disable-user --without-default-devices --without-default-features
     MAKE_CHECK_ARGS: check
-  rules:
-    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-      when: manual
-      allow_failure: true
-    - if: "$AARCH64_RUNNER_AVAILABLE"
-      when: manual
-      allow_failure: true
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-aarch64-alldbg:
   extends: .ubuntu_aarch64_template
@@ -78,34 +68,21 @@ ubuntu-24.04-aarch64-clang:
   variables:
     CONFIGURE_ARGS: --cc=clang --cxx=clang++ --enable-ubsan
     MAKE_CHECK_ARGS: check
-  rules:
-    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-      when: manual
-      allow_failure: true
-    - if: "$AARCH64_RUNNER_AVAILABLE"
-      when: manual
-      allow_failure: true
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-aarch64-tci:
   extends: .ubuntu_aarch64_template
   variables:
     CONFIGURE_ARGS: --enable-tcg-interpreter
     MAKE_CHECK_ARGS: check
-  rules:
-    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-      when: manual
-      allow_failure: true
-    - if: "$AARCH64_RUNNER_AVAILABLE"
-      when: manual
-      allow_failure: true
+  allow_failure: true
+  when: manual
 
 ubuntu-24.04-aarch64-notcg:
   extends: .ubuntu_aarch64_template
   variables:
     CONFIGURE_ARGS: --disable-tcg --with-devices-aarch64=minimal
     MAKE_CHECK_ARGS: check
-  rules:
-    - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-      when: manual
-    - if: "$AARCH64_RUNNER_AVAILABLE"
-      when: manual
+  allow_failure: true
+  when: manual

From 7b0e69d4a73808f206bee88ff966b5d16d10a8fd Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:20 +0000
Subject: [PATCH 2155/2396] gitlab: suppress custom runners being triggered by
 schedule
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise the mere presence of the RUNNER env vars is enough to
trigger the jobs.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-16-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners/debian-13-ppc64le.yml    | 2 +-
 .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml | 2 +-
 .gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
index e088c3b67b..40b1f408f9 100644
--- a/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
+++ b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
@@ -11,7 +11,7 @@
     - ppc64le
   rules:
     - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
-    - if: "$PPC64LE_RUNNER_AVAILABLE"
+    - if: '$PPC64LE_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section
     - section_start setup "Pre-script setup"
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index 6f950baee0..c8adb8171c 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -11,7 +11,7 @@
     - aarch64
   rules:
     - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
-    - if: "$AARCH64_RUNNER_AVAILABLE"
+    - if: '$AARCH64_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section
     - section_start setup "Pre-script setup"
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
index 2fc940e127..fb093d05b5 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
@@ -11,7 +11,7 @@
     - s390x
   rules:
     - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
-    - if: "$S390X_RUNNER_AVAILABLE"
+    - if: '$S390X_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section
     - section_start setup "Pre-script setup"

From d9e58fd1b241184c11d0853cec893d5e2d243bf7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:21 +0000
Subject: [PATCH 2156/2396] gitlab: make custom runners need QEMU_CI to run
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In addition to not being triggered by schedule we should follow the
same rules about QEMU_CI. One day we may figure out how to fold the
custom runner rules into the .base_job_template but today is not that
day.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-17-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners/debian-13-ppc64le.yml    | 4 ++++
 .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml | 4 ++++
 .gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml   | 4 ++++
 3 files changed, 12 insertions(+)

diff --git a/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
index 40b1f408f9..23b188dc72 100644
--- a/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
+++ b/.gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
@@ -11,6 +11,10 @@
     - ppc64le
   rules:
     - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+      when: never
+    - if: '$PPC64LE_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule" && $QEMU_CI == "1"'
+      when: manual
     - if: '$PPC64LE_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index c8adb8171c..98d9919345 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -11,6 +11,10 @@
     - aarch64
   rules:
     - if: '$CI_PROJECT_NAMESPACE == "qemu-project" && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+      when: never
+    - if: '$AARCH64_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule" && $QEMU_CI == "1"'
+      when: manual
     - if: '$AARCH64_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section
diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
index fb093d05b5..efa8252d94 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
@@ -11,6 +11,10 @@
     - s390x
   rules:
     - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: '$QEMU_CI != "1" && $QEMU_CI != "2" && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+      when: never
+    - if: '$S390X_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule" && $QEMU_CI == "1"'
+      when: manual
     - if: '$S390X_RUNNER_AVAILABLE && $CI_PIPELINE_SOURCE != "schedule"'
   before_script:
     - source scripts/ci/gitlab-ci-section

From c689e3423cc32bcbfc4f0a08fce4cb2da4867aa1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:22 +0000
Subject: [PATCH 2157/2396] gitlab: make the schedule rules a bit more general
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

By default no jobs should run under the schedule and then we can be
more explicit for the ones that we need to. Otherwise I trigger all my
custom runners every time I do a scheduled run.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-18-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/base.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.gitlab-ci.d/base.yml b/.gitlab-ci.d/base.yml
index 60a24a9d14..921c562000 100644
--- a/.gitlab-ci.d/base.yml
+++ b/.gitlab-ci.d/base.yml
@@ -45,8 +45,8 @@ variables:
     - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_TAG'
       when: never
 
-    # Scheduled runs on mainline don't get pipelines except for the special Coverity job
-    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_PIPELINE_SOURCE == "schedule"'
+    # Scheduled jobs should explicitly enable the run in their job rules
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
       when: never
 
     # Cirrus jobs can't run unless the creds / target repo are set

From 8bec7b9874235e60f14172618121c60fdbd39302 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Mon, 17 Nov 2025 11:55:23 +0000
Subject: [PATCH 2158/2396] gitlab: add a weekly container building job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This will hopefully catch containers that break because of upstream
changes as well as keep the container cache fresh.

As we have all the container jobs as dependants we tweaks the
container template to allow scheduled runs. Because we added a new
rules stanza we also need to make sure we catch the normal runs as
well.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-ID: <20251117115523.3993105-19-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/container-template.yml |  5 ++++
 .gitlab-ci.d/containers.yml         | 39 +++++++++++++++++++++++++++++
 tests/docker/Makefile.include       | 11 ++++++++
 3 files changed, 55 insertions(+)

diff --git a/.gitlab-ci.d/container-template.yml b/.gitlab-ci.d/container-template.yml
index 4eec72f383..82c1b69e8d 100644
--- a/.gitlab-ci.d/container-template.yml
+++ b/.gitlab-ci.d/container-template.yml
@@ -19,3 +19,8 @@
     - docker push "$TAG"
   after_script:
     - docker logout
+  rules:
+    # because we want to enable this for scheduled runs we also have to replicate the normal rules
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
+    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
+    - if: '$QEMU_CI && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
diff --git a/.gitlab-ci.d/containers.yml b/.gitlab-ci.d/containers.yml
index db9b4d5e57..f7d3e7205d 100644
--- a/.gitlab-ci.d/containers.yml
+++ b/.gitlab-ci.d/containers.yml
@@ -33,3 +33,42 @@ amd64-fedora-rust-nightly-container:
   variables:
     NAME: fedora-rust-nightly
   allow_failure: true
+
+# this scheduled job will trigger all the containers to build
+weekly-container-builds:
+  extends: .container_job_template
+  allow_failure: true
+  needs:
+    # core
+    - amd64-centos9-container
+    - amd64-fedora-container
+    # cross
+    - amd64-debian-cross-container
+    - amd64-debian-user-cross-container
+    - amd64-debian-legacy-cross-container
+    - arm64-debian-cross-container
+    - armhf-debian-cross-container
+    - hexagon-cross-container
+    - loongarch-debian-cross-container
+    - i686-debian-cross-container
+    - mips64el-debian-cross-container
+    - ppc64el-debian-cross-container
+    - riscv64-debian-cross-container
+    - s390x-debian-cross-container
+    - tricore-debian-cross-container
+    - xtensa-debian-cross-container
+    - win64-fedora-cross-container
+    - wasm-emsdk-cross-container
+    # containers
+    - amd64-alpine-container
+    - amd64-debian-container
+    - amd64-ubuntu2204-container
+    - amd64-opensuse-leap-container
+    - python-container
+    - amd64-fedora-rust-nightly-container
+  script:
+    - apk -U add make bash skopeo
+    - make docker-verify V=1 DOCKER_DEFAULT_REGISTRY=$CI_REGISTRY_IMAGE
+  rules:
+    # this only ever runes as a scheduled build
+    - if: '$CI_PIPELINE_SOURCE == "schedule"'
diff --git a/tests/docker/Makefile.include b/tests/docker/Makefile.include
index 3959d8a028..38467cca61 100644
--- a/tests/docker/Makefile.include
+++ b/tests/docker/Makefile.include
@@ -49,6 +49,15 @@ docker-image-%: $(DOCKER_FILES_DIR)/%.docker
 		-t qemu/$* - < $< $(if $V,,> /dev/null),\
 		"BUILD", $*)
 
+# General rule for inspecting registry images.
+docker-verify-%: $(DOCKER_FILES_DIR)/%.docker
+	  $(call quiet-command,			\
+		skopeo inspect 			\
+			--format '{{.Created}}' \
+			docker://$(DOCKER_REGISTRY)/qemu/$*	\
+		$(if $V,,> /dev/null),\
+		"VERIFY", $*)
+
 # Special rule for debootstraped binfmt linux-user images
 docker-binfmt-image-debian-%: $(DOCKER_FILES_DIR)/debian-bootstrap.docker
 	$(if $(EXECUTABLE),,\
@@ -236,6 +245,8 @@ docker-run: docker-qemu-src
 
 docker-image: ${DOCKER_IMAGES:%=docker-image-%}
 
+docker-verify: ${DOCKER_IMAGES:%=docker-verify-%}
+
 docker-clean:
 	$(call quiet-command, $(DOCKER_SCRIPT) clean)
 

From aed74d3d6244b3ed8662ac9a987415079ac3eb31 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:36 +0100
Subject: [PATCH 2159/2396] block: Note on aio_co_wake use if not yet yielding

aio_co_wake() is generally safe to call regardless of whether the
coroutine is already yielding or not.  If it is not yet yielding, it
will be scheduled to run when it does yield.

Caveats:
- The caller must be independent of the coroutine (to ensure the
  coroutine must be yielding if both are in the same AioContext), i.e.
  must not be the same coroutine
- The coroutine must yield at some point

Make note of this so callers can reason that their use is safe.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-2-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/aio.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/block/aio.h b/include/block/aio.h
index f38b584ac7..6049e6a0f4 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -746,6 +746,21 @@ void coroutine_fn aio_co_reschedule_self(AioContext *new_ctx);
  * aio_co_wake may be executed either in coroutine or non-coroutine
  * context.  The coroutine must not be entered by anyone else while
  * aio_co_wake() is active.
+ *
+ * If `co`'s AioContext differs from the current AioContext, this will call
+ * aio_co_schedule(), which makes this safe to use even when `co` has not
+ * yielded yet.  In such a case, it will be entered once it yields.
+ *
+ * In contrast, if `co`'s AioContext is equal to the current one, it is
+ * required for `co` to currently be yielding.  This is generally the case
+ * if the caller is not in `co` (i.e. invoked by `co`), because the only
+ * other way for the caller to be running then is for `co` to currently be
+ * yielding.
+ *
+ * Therefore, if there is no way for the caller to be invoked/entered by
+ * `co`, it is generally safe to call this regardless of whether `co` is
+ * known to already be yielding or not -- it only has to yield at some
+ * point.
  */
 void aio_co_wake(Coroutine *co);
 

From 89d22536d1a1715083ef8118fe7e6e9239f900c1 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:37 +0100
Subject: [PATCH 2160/2396] =?UTF-8?q?rbd:=20Run=20co=20BH=20CB=20in=20the?=
 =?UTF-8?q?=20coroutine=E2=80=99s=20AioContext?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

qemu_rbd_completion_cb() schedules the request completion code
(qemu_rbd_finish_bh()) to run in the BDS’s AioContext, assuming that
this is the same thread in which qemu_rbd_start_co() runs.

To explain, this is how both latter functions interact:

In qemu_rbd_start_co():

    while (!task.complete)
        qemu_coroutine_yield();

In qemu_rbd_finish_bh():

    task->complete = true;
    aio_co_wake(task->co); // task->co is qemu_rbd_start_co()

For this interaction to work reliably, both must run in the same thread
so that qemu_rbd_finish_bh() can only run once the coroutine yields.
Otherwise, finish_bh() may run before start_co() checks task.complete,
which will result in the latter seeing .complete as true immediately and
skipping the yield altogether, even though finish_bh() still wakes it.

With multiqueue, the BDS’s AioContext is not necessarily the thread
start_co() runs in, and so finish_bh() may be scheduled to run in a
different thread than start_co().  With the right timing, this will
cause the problems described above; waking a non-yielding coroutine is
not good, as can be reproduced by putting e.g. a usleep(100000) above
the while loop in start_co() (and using multiqueue), giving finish_bh()
a much better chance at exiting before start_co() can yield.

So instead of scheduling finish_bh() in the BDS’s AioContext, schedule
finish_bh() in task->co’s AioContext.

In addition, we can get rid of task.complete altogether because we will
get woken exactly once, when the task is indeed complete, no need to
check.

(We could go further and drop the BH, running aio_co_wake() directly in
qemu_rbd_completion_cb() because we are allowed to do that even if the
coroutine isn’t yet yielding and we’re in a different thread – but the
doc comment on qemu_rbd_completion_cb() says to be careful, so I decided
not to go so far here.)

Buglink: https://issues.redhat.com/browse/RHEL-67115
Reported-by: Junyao Zhao <junzhao@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-3-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index 3611dc81cf..2a70b5a983 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -110,9 +110,7 @@ typedef struct BDRVRBDState {
 } BDRVRBDState;
 
 typedef struct RBDTask {
-    BlockDriverState *bs;
     Coroutine *co;
-    bool complete;
     int64_t ret;
 } RBDTask;
 
@@ -1309,7 +1307,6 @@ static int qemu_rbd_resize(BlockDriverState *bs, uint64_t size)
 static void qemu_rbd_finish_bh(void *opaque)
 {
     RBDTask *task = opaque;
-    task->complete = true;
     aio_co_wake(task->co);
 }
 
@@ -1326,7 +1323,7 @@ static void qemu_rbd_completion_cb(rbd_completion_t c, RBDTask *task)
 {
     task->ret = rbd_aio_get_return_value(c);
     rbd_aio_release(c);
-    aio_bh_schedule_oneshot(bdrv_get_aio_context(task->bs),
+    aio_bh_schedule_oneshot(qemu_coroutine_get_aio_context(task->co),
                             qemu_rbd_finish_bh, task);
 }
 
@@ -1338,7 +1335,7 @@ static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
                                           RBDAIOCmd cmd)
 {
     BDRVRBDState *s = bs->opaque;
-    RBDTask task = { .bs = bs, .co = qemu_coroutine_self() };
+    RBDTask task = { .co = qemu_coroutine_self() };
     rbd_completion_t c;
     int r;
 
@@ -1401,9 +1398,8 @@ static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
         return r;
     }
 
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
+    /* Expect exactly a single wake from qemu_rbd_finish_bh() */
+    qemu_coroutine_yield();
 
     if (task.ret < 0) {
         error_report("rbd request failed: cmd %d offset %" PRIu64 " bytes %"

From a9500527db10db7cf8a490b0de58a9b2321440b7 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:38 +0100
Subject: [PATCH 2161/2396] =?UTF-8?q?iscsi:=20Run=20co=20BH=20CB=20in=20th?=
 =?UTF-8?q?e=20coroutine=E2=80=99s=20AioContext?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For rbd (and others), as described in “rbd: Run co BH CB in the
coroutine’s AioContext”, the pattern of setting a completion flag and
waking a coroutine that yields while the flag is not set can only work
when both run in the same thread.

iscsi has the same pattern, but the details are a bit different:
iscsi_co_generic_cb() can (as far as I understand) only run through
iscsi_service(), not just from a random thread at a random time.
iscsi_service() in turn can only be run after iscsi_set_events() set up
an FD event handler, which is done in iscsi_co_wait_for_task().

As a result, iscsi_co_wait_for_task() will always yield exactly once,
because iscsi_co_generic_cb() can only run after iscsi_set_events(),
after the completion flag has already been checked, and the yielding
coroutine will then be woken only once the completion flag was set to
true.  So as far as I can tell, iscsi has no bug and already works fine.

Still, we don’t need the completion flag because we know we have to
yield exactly once, so we can drop it.  This simplifies the code and
makes it more obvious that the “rbd bug” isn’t present here.

This makes iscsi_co_generic_bh_cb() and iscsi_retry_timer_expired() a
bit boring, so at least the former we can drop and call aio_co_wake()
directly from scsi_co_generic_cb() to the same effect.  As for the
latter, the timer needs a CB, so we can’t drop it (I suppose we could
technically use aio_co_wake directly as the CB, but that would be
nasty), but we can put it into the coroutine’s AioContext to make its
aio_co_wake() a simple wrapper around qemu_coroutine_enter() without a
further BH indirection.

Finally, remove the iTask->co != NULL checks: This field is set by
iscsi_co_init_iscsitask(), which all users of IscsiTask run before even
setting up iscsi_co_generic_cb() as the callback, and it is never set or
cleared elsewhere, so it is impossible to not be set in
iscsi_co_generic_cb().

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-4-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/iscsi.c | 56 +++++++++++++++++++--------------------------------
 1 file changed, 21 insertions(+), 35 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c
index 15b96ee880..852ecccf0d 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -107,7 +107,6 @@ typedef struct IscsiLun {
 
 typedef struct IscsiTask {
     int status;
-    int complete;
     int retries;
     int do_retry;
     struct scsi_task *task;
@@ -180,21 +179,10 @@ iscsi_schedule_bh(IscsiAIOCB *acb)
 
 #endif
 
-static void iscsi_co_generic_bh_cb(void *opaque)
-{
-    struct IscsiTask *iTask = opaque;
-
-    iTask->complete = 1;
-    aio_co_wake(iTask->co);
-}
-
 static void iscsi_retry_timer_expired(void *opaque)
 {
     struct IscsiTask *iTask = opaque;
-    iTask->complete = 1;
-    if (iTask->co) {
-        aio_co_wake(iTask->co);
-    }
+    aio_co_wake(iTask->co);
 }
 
 static inline unsigned exp_random(double mean)
@@ -239,6 +227,8 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
 {
     struct IscsiTask *iTask = opaque;
     struct scsi_task *task = command_data;
+    IscsiLun *iscsilun = iTask->iscsilun;
+    AioContext *itask_ctx = qemu_coroutine_get_aio_context(iTask->co);
 
     iTask->status = status;
     iTask->do_retry = 0;
@@ -263,9 +253,9 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
                              " (retry #%u in %u ms): %s",
                              iTask->retries, retry_time,
                              iscsi_get_error(iscsi));
-                aio_timer_init(iTask->iscsilun->aio_context,
-                               &iTask->retry_timer, QEMU_CLOCK_REALTIME,
-                               SCALE_MS, iscsi_retry_timer_expired, iTask);
+                aio_timer_init(itask_ctx, &iTask->retry_timer,
+                               QEMU_CLOCK_REALTIME, SCALE_MS,
+                               iscsi_retry_timer_expired, iTask);
                 timer_mod(&iTask->retry_timer,
                           qemu_clock_get_ms(QEMU_CLOCK_REALTIME) + retry_time);
                 iTask->do_retry = 1;
@@ -284,12 +274,17 @@ iscsi_co_generic_cb(struct iscsi_context *iscsi, int status,
         }
     }
 
-    if (iTask->co) {
-        replay_bh_schedule_oneshot_event(iTask->iscsilun->aio_context,
-                                         iscsi_co_generic_bh_cb, iTask);
-    } else {
-        iTask->complete = 1;
-    }
+    /*
+     * aio_co_wake() is safe to call: iscsi_service(), which called us, is only
+     * run from the event_timer and/or the FD handlers, never from the request
+     * coroutine.  The request coroutine in turn will yield unconditionally.
+     * We must release the lock, though, in case we enter the coroutine
+     * directly.  (Note that if do we enter the coroutine, iTask will probably
+     * be dangling once aio_co_wake() returns.)
+     */
+    qemu_mutex_unlock(&iscsilun->mutex);
+    aio_co_wake(iTask->co);
+    qemu_mutex_lock(&iscsilun->mutex);
 }
 
 static void coroutine_fn
@@ -592,12 +587,10 @@ static inline bool iscsi_allocmap_is_valid(IscsiLun *iscsilun,
 static void coroutine_fn iscsi_co_wait_for_task(IscsiTask *iTask,
                                                 IscsiLun *iscsilun)
 {
-    while (!iTask->complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_set_events(iscsilun);
+    qemu_mutex_unlock(&iscsilun->mutex);
+    qemu_coroutine_yield();
+    qemu_mutex_lock(&iscsilun->mutex);
 }
 
 static int coroutine_fn
@@ -669,7 +662,6 @@ retry:
     }
 
     if (iTask.do_retry) {
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -740,7 +732,6 @@ retry:
             scsi_free_scsi_task(iTask.task);
             iTask.task = NULL;
         }
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -902,7 +893,6 @@ retry:
     }
 
     if (iTask.do_retry) {
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -940,7 +930,6 @@ retry:
     }
 
     if (iTask.do_retry) {
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -1184,7 +1173,6 @@ retry:
     }
 
     if (iTask.do_retry) {
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -1301,7 +1289,6 @@ retry:
     }
 
     if (iTask.do_retry) {
-        iTask.complete = 0;
         goto retry;
     }
 
@@ -2390,7 +2377,6 @@ retry:
     iscsi_co_wait_for_task(&iscsi_task, dst_lun);
 
     if (iscsi_task.do_retry) {
-        iscsi_task.complete = 0;
         goto retry;
     }
 

From deb35c129b859b9bec70fd42f856a0b7c1dc6e61 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:39 +0100
Subject: [PATCH 2162/2396] =?UTF-8?q?nfs:=20Run=20co=20BH=20CB=20in=20the?=
 =?UTF-8?q?=20coroutine=E2=80=99s=20AioContext?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Like in “rbd: Run co BH CB in the coroutine’s AioContext”, drop the
completion flag, yield exactly once, and run the BH in the coroutine’s
AioContext.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (!task.complete)` loops.)

Like in “iscsi: Run co BH CB in the coroutine’s AioContext”, this makes
nfs_co_generic_bh_cb() trivial, so we can drop it in favor of just
calling aio_co_wake() directly.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-5-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/nfs.c | 41 ++++++++++++++++-------------------------
 1 file changed, 16 insertions(+), 25 deletions(-)

diff --git a/block/nfs.c b/block/nfs.c
index 0a7d38db09..1d3a34a30c 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -69,7 +69,6 @@ typedef struct NFSClient {
 typedef struct NFSRPC {
     BlockDriverState *bs;
     int ret;
-    int complete;
     QEMUIOVector *iov;
     struct stat *st;
     Coroutine *co;
@@ -230,14 +229,6 @@ static void coroutine_fn nfs_co_init_task(BlockDriverState *bs, NFSRPC *task)
     };
 }
 
-static void nfs_co_generic_bh_cb(void *opaque)
-{
-    NFSRPC *task = opaque;
-
-    task->complete = 1;
-    aio_co_wake(task->co);
-}
-
 /* Called (via nfs_service) with QemuMutex held.  */
 static void
 nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
@@ -256,8 +247,16 @@ nfs_co_generic_cb(int ret, struct nfs_context *nfs, void *data,
     if (task->ret < 0) {
         error_report("NFS Error: %s", nfs_get_error(nfs));
     }
-    replay_bh_schedule_oneshot_event(task->client->aio_context,
-                                     nfs_co_generic_bh_cb, task);
+
+    /*
+     * Safe to call: nfs_service(), which called us, is only run from the FD
+     * handlers, never from the request coroutine.  The request coroutine in
+     * turn will yield unconditionally.
+     * No need to release the lock, even if we directly enter the coroutine, as
+     * the lock is never re-taken after yielding.  (Note: If we do enter the
+     * coroutine, @task will probably be dangling once aio_co_wake() returns.)
+     */
+    aio_co_wake(task->co);
 }
 
 static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, int64_t offset,
@@ -278,9 +277,7 @@ static int coroutine_fn nfs_co_preadv(BlockDriverState *bs, int64_t offset,
 
         nfs_set_events(client);
     }
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
+    qemu_coroutine_yield();
 
     if (task.ret < 0) {
         return task.ret;
@@ -328,9 +325,7 @@ static int coroutine_fn nfs_co_pwritev(BlockDriverState *bs, int64_t offset,
 
         nfs_set_events(client);
     }
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
+    qemu_coroutine_yield();
 
     if (my_buffer) {
         g_free(buf);
@@ -358,9 +353,7 @@ static int coroutine_fn nfs_co_flush(BlockDriverState *bs)
 
         nfs_set_events(client);
     }
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
+    qemu_coroutine_yield();
 
     return task.ret;
 }
@@ -723,8 +716,8 @@ nfs_get_allocated_file_size_cb(int ret, struct nfs_context *nfs, void *data,
     if (task->ret < 0) {
         error_report("NFS Error: %s", nfs_get_error(nfs));
     }
-    replay_bh_schedule_oneshot_event(task->client->aio_context,
-                                     nfs_co_generic_bh_cb, task);
+    /* Safe to call, see nfs_co_generic_cb() */
+    aio_co_wake(task->co);
 }
 
 static int64_t coroutine_fn nfs_co_get_allocated_file_size(BlockDriverState *bs)
@@ -748,9 +741,7 @@ static int64_t coroutine_fn nfs_co_get_allocated_file_size(BlockDriverState *bs)
 
         nfs_set_events(client);
     }
-    while (!task.complete) {
-        qemu_coroutine_yield();
-    }
+    qemu_coroutine_yield();
 
     return (task.ret < 0 ? task.ret : st.st_blocks * 512);
 }

From 53d5c7ffac7bd4e0d12174432ebb2b3e88614b15 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:40 +0100
Subject: [PATCH 2163/2396] curl: Fix coroutine waking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If we wake a coroutine from a different context, we must ensure that it
will yield exactly once (now or later), awaiting that wake.

curl’s current .ret == -EINPROGRESS loop may lead to the coroutine not
yielding if the request finishes before the loop gets run.  To fix it,
we must drop the loop and yield exactly once, if we need to yield.

Finding out that latter part ("if we need to yield") makes it a bit
complicated: Requests may be served from a cache internal to the curl
block driver, or fail before being submitted.  In these cases, we must
not yield.  However, if we find a matching but still ongoing request in
the cache, we will have to await that, i.e. still yield.

To address this, move the yield inside of the respective functions:
- Inside of curl_find_buf() when awaiting ongoing concurrent requests,
- Inside of curl_setup_preadv() when having created a new request.

Rename curl_setup_preadv() to curl_do_preadv() to reflect this.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (acb.ret == -EINPROGRESS)` loop.)

Also, add a comment why aio_co_wake() is safe regardless of whether the
coroutine and curl_multi_check_completion() run in the same context.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-6-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/curl.c | 45 +++++++++++++++++++++++++++++++--------------
 1 file changed, 31 insertions(+), 14 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index d7d93d967f..4e77c93b46 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -258,8 +258,8 @@ read_end:
 }
 
 /* Called with s->mutex held.  */
-static bool curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len,
-                          CURLAIOCB *acb)
+static bool coroutine_fn
+curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len, CURLAIOCB *acb)
 {
     int i;
     uint64_t end = start + len;
@@ -307,6 +307,10 @@ static bool curl_find_buf(BDRVCURLState *s, uint64_t start, uint64_t len,
             for (j=0; j<CURL_NUM_ACB; j++) {
                 if (!state->acb[j]) {
                     state->acb[j] = acb;
+                    /* Await ongoing request */
+                    qemu_mutex_unlock(&s->mutex);
+                    qemu_coroutine_yield();
+                    qemu_mutex_lock(&s->mutex);
                     return true;
                 }
             }
@@ -378,6 +382,16 @@ static void curl_multi_check_completion(BDRVCURLState *s)
                 acb->ret = error ? -EIO : 0;
                 state->acb[i] = NULL;
                 qemu_mutex_unlock(&s->mutex);
+                /*
+                 * Current AioContext is the BDS context, which may or may not
+                 * be the request (coroutine) context.
+                 * - If it is, the coroutine must have yielded or the FD handler
+                 *   (curl_multi_do()/curl_multi_timeout_do()) could not have
+                 *   been called and we would not be here
+                 * - If it is not, it doesn't matter whether it has already
+                 *   yielded or not; it will be scheduled once it does yield
+                 * So aio_co_wake() is safe to call.
+                 */
                 aio_co_wake(acb->co);
                 qemu_mutex_lock(&s->mutex);
             }
@@ -868,7 +882,7 @@ out_noclean:
     return -EINVAL;
 }
 
-static void coroutine_fn curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
+static void coroutine_fn curl_do_preadv(BlockDriverState *bs, CURLAIOCB *acb)
 {
     CURLState *state;
     int running;
@@ -880,10 +894,13 @@ static void coroutine_fn curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
 
     qemu_mutex_lock(&s->mutex);
 
-    // In case we have the requested data already (e.g. read-ahead),
-    // we can just call the callback and be done.
+    /*
+     * In case we have the requested data already (e.g. read-ahead),
+     * we can just call the callback and be done.  This may have to
+     * await an ongoing request, in which case it itself will yield.
+     */
     if (curl_find_buf(s, start, acb->bytes, acb)) {
-        goto out;
+        goto dont_yield;
     }
 
     // No cache found, so let's start a new request
@@ -898,7 +915,7 @@ static void coroutine_fn curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
     if (curl_init_state(s, state) < 0) {
         curl_clean_state(state);
         acb->ret = -EIO;
-        goto out;
+        goto dont_yield;
     }
 
     acb->start = 0;
@@ -913,7 +930,7 @@ static void coroutine_fn curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
     if (state->buf_len && state->orig_buf == NULL) {
         curl_clean_state(state);
         acb->ret = -ENOMEM;
-        goto out;
+        goto dont_yield;
     }
     state->acb[0] = acb;
 
@@ -925,13 +942,16 @@ static void coroutine_fn curl_setup_preadv(BlockDriverState *bs, CURLAIOCB *acb)
         acb->ret = -EIO;
 
         curl_clean_state(state);
-        goto out;
+        goto dont_yield;
     }
 
     /* Tell curl it needs to kick things off */
     curl_multi_socket_action(s->multi, CURL_SOCKET_TIMEOUT, 0, &running);
+    qemu_mutex_unlock(&s->mutex);
+    qemu_coroutine_yield();
+    return;
 
-out:
+dont_yield:
     qemu_mutex_unlock(&s->mutex);
 }
 
@@ -947,10 +967,7 @@ static int coroutine_fn curl_co_preadv(BlockDriverState *bs,
         .bytes = bytes
     };
 
-    curl_setup_preadv(bs, &acb);
-    while (acb.ret == -EINPROGRESS) {
-        qemu_coroutine_yield();
-    }
+    curl_do_preadv(bs, &acb);
     return acb.ret;
 }
 

From 7214ad20da625c84e55536a274acdd5af9627ff7 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:41 +0100
Subject: [PATCH 2164/2396] gluster: Do not move coroutine into BDS context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The request coroutine may not run in the BDS AioContext.  We should wake
it in its own context, not move it.

With that, we can remove GlusterAIOCB.aio_context.

Also add a comment why aio_co_schedule() is safe to use in this way.

**Note:** Due to a lack of a gluster set-up, I have not tested this
commit.  It seemed safe enough to send anyway, just maybe not to
qemu-stable.  To be clear, I don’t know of any user-visible bugs that
would arise from the state without this patch; the request coroutine is
moved into the main BDS AioContext, so guest device completion code will
run in a different context than where the request started, which can’t
be good, but I haven’t actually confirmed any bugs (due to not being
able to test it).

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-7-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/gluster.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/block/gluster.c b/block/gluster.c
index 89abd40f31..4fb25b2c6d 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -56,7 +56,6 @@ typedef struct GlusterAIOCB {
     int64_t size;
     int ret;
     Coroutine *coroutine;
-    AioContext *aio_context;
 } GlusterAIOCB;
 
 typedef struct BDRVGlusterState {
@@ -743,7 +742,17 @@ static void gluster_finish_aiocb(struct glfs_fd *fd, ssize_t ret,
         acb->ret = -EIO; /* Partial read/write - fail it */
     }
 
-    aio_co_schedule(acb->aio_context, acb->coroutine);
+    /*
+     * Safe to call: The coroutine will yield exactly once awaiting this
+     * scheduling, and the context is its own context, so it will be scheduled
+     * once it does yield.
+     *
+     * (aio_co_wake() would call qemu_get_current_aio_context() to check whether
+     * we are in the same context, but we are not in a qemu thread, so we cannot
+     * do that.  Use aio_co_schedule() directly.)
+     */
+    aio_co_schedule(qemu_coroutine_get_aio_context(acb->coroutine),
+                    acb->coroutine);
 }
 
 static void qemu_gluster_parse_flags(int bdrv_flags, int *open_flags)
@@ -1006,7 +1015,6 @@ static coroutine_fn int qemu_gluster_co_pwrite_zeroes(BlockDriverState *bs,
     acb.size = bytes;
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
-    acb.aio_context = bdrv_get_aio_context(bs);
 
     ret = glfs_zerofill_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
     if (ret < 0) {
@@ -1184,7 +1192,6 @@ static coroutine_fn int qemu_gluster_co_rw(BlockDriverState *bs,
     acb.size = size;
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
-    acb.aio_context = bdrv_get_aio_context(bs);
 
     if (write) {
         ret = glfs_pwritev_async(s->fd, qiov->iov, qiov->niov, offset, 0,
@@ -1251,7 +1258,6 @@ static coroutine_fn int qemu_gluster_co_flush_to_disk(BlockDriverState *bs)
     acb.size = 0;
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
-    acb.aio_context = bdrv_get_aio_context(bs);
 
     ret = glfs_fsync_async(s->fd, gluster_finish_aiocb, &acb);
     if (ret < 0) {
@@ -1299,7 +1305,6 @@ static coroutine_fn int qemu_gluster_co_pdiscard(BlockDriverState *bs,
     acb.size = 0;
     acb.ret = 0;
     acb.coroutine = qemu_coroutine_self();
-    acb.aio_context = bdrv_get_aio_context(bs);
 
     ret = glfs_discard_async(s->fd, offset, bytes, gluster_finish_aiocb, &acb);
     if (ret < 0) {

From 7a501bbd51941fb1867d78e6b0d1dc69e396b9e2 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:42 +0100
Subject: [PATCH 2165/2396] nvme: Kick and check completions in BDS context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nvme_process_completion() must run in the main BDS context, so schedule
a BH for requests that aren’t there.

The context in which we kick does not matter, but let’s just keep kick
and process_completion together for simplicity’s sake.

(For what it’s worth, a quick fio bandwidth test indicates that on my
test hardware, if anything, this may be a bit better than kicking
immediately before scheduling a pure nvme_process_completion() BH.  But
I wouldn’t take more from those results than that it doesn’t really seem
to matter either way.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-8-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/nvme.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/block/nvme.c b/block/nvme.c
index 8df53ee4ca..7ed5f570bc 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -481,7 +481,7 @@ static void nvme_trace_command(const NvmeCmd *cmd)
     }
 }
 
-static void nvme_deferred_fn(void *opaque)
+static void nvme_kick_and_check_completions(void *opaque)
 {
     NVMeQueuePair *q = opaque;
 
@@ -490,6 +490,18 @@ static void nvme_deferred_fn(void *opaque)
     nvme_process_completion(q);
 }
 
+static void nvme_deferred_fn(void *opaque)
+{
+    NVMeQueuePair *q = opaque;
+
+    if (qemu_get_current_aio_context() == q->s->aio_context) {
+        nvme_kick_and_check_completions(q);
+    } else {
+        aio_bh_schedule_oneshot(q->s->aio_context,
+                                nvme_kick_and_check_completions, q);
+    }
+}
+
 static void nvme_submit_command(NVMeQueuePair *q, NVMeRequest *req,
                                 NvmeCmd *cmd, BlockCompletionFunc cb,
                                 void *opaque)

From 0f142cbd919fcb6cea7aa176f7e4939925806dd9 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:43 +0100
Subject: [PATCH 2166/2396] nvme: Fix coroutine waking
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

nvme wakes the request coroutine via qemu_coroutine_enter() from a BH
scheduled in the BDS AioContext.  This may not be the same context as
the one in which the request originally ran, which would be wrong:
- It could mean we enter the coroutine before it yields,
- We would move the coroutine in to a different context.

(Can be reproduced with multiqueue by adding a usleep(100000) before the
`while (data.ret == -EINPROGRESS)` loop.)

To fix that, use aio_co_wake() to run the coroutine in its home context.
Just like in the preceding iscsi and nfs patches, we can drop the
trivial nvme_rw_cb_bh() and use aio_co_wake() directly.

With this, we can remove NVMeCoData.ctx.

Note the check of data->co == NULL to bypass the BH/yield combination in
case nvme_rw_cb() is called from nvme_submit_command(): We probably want
to keep this fast path for performance reasons, but we have to be quite
careful about it:
- We cannot overload .ret for this, but have to use a dedicated
  .skip_yield field.  Otherwise, if nvme_rw_cb() runs in a different
  thread than the coroutine, it may see .ret set and skip the yield,
  while nvme_rw_cb() will still schedule a BH for waking.   Therefore,
  the signal to skip the yield can only be set in nvme_rw_cb() if waking
  too is skipped, which is independent from communicating the return
  value.
- We can only skip the yield if nvme_rw_cb() actually runs in the
  request coroutine.  Otherwise (specifically if they run in different
  AioContexts), the order between this function’s execution and the
  coroutine yielding (or not yielding) is not reliable.
- There is no point to yielding in a loop; there are no spurious wakes,
  so once we yield, we will only be re-entered once the command is done.
  Replace `while` by `if`.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-9-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/nvme.c | 56 +++++++++++++++++++++++++++-------------------------
 1 file changed, 29 insertions(+), 27 deletions(-)

diff --git a/block/nvme.c b/block/nvme.c
index 7ed5f570bc..b8262ebfd9 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -1176,25 +1176,35 @@ fail:
 
 typedef struct {
     Coroutine *co;
+    bool skip_yield;
     int ret;
-    AioContext *ctx;
 } NVMeCoData;
 
-static void nvme_rw_cb_bh(void *opaque)
-{
-    NVMeCoData *data = opaque;
-    qemu_coroutine_enter(data->co);
-}
-
 static void nvme_rw_cb(void *opaque, int ret)
 {
     NVMeCoData *data = opaque;
+
     data->ret = ret;
-    if (!data->co) {
-        /* The rw coroutine hasn't yielded, don't try to enter. */
-        return;
+
+    if (data->co == qemu_coroutine_self()) {
+        /*
+         * Fast path: We are inside of the request coroutine (through
+         * nvme_submit_command, nvme_deferred_fn, nvme_process_completion).
+         * We can set data->skip_yield here to keep the coroutine from
+         * yielding, and then we don't need to schedule a BH to wake it.
+         */
+        data->skip_yield = true;
+    } else {
+        /*
+         * Safe to call: The case where we run in the request coroutine is
+         * handled above, so we must be independent of it; and without
+         * skip_yield set, the coroutine will yield.
+         * No need to release NVMeQueuePair.lock (we are called without it
+         * held).  (Note: If we enter the coroutine here, @data will
+         * probably be dangling once aio_co_wake() returns.)
+         */
+        aio_co_wake(data->co);
     }
-    replay_bh_schedule_oneshot_event(data->ctx, nvme_rw_cb_bh, data);
 }
 
 static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
@@ -1218,7 +1228,7 @@ static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
         .cdw12 = cpu_to_le32(cdw12),
     };
     NVMeCoData data = {
-        .ctx = bdrv_get_aio_context(bs),
+        .co = qemu_coroutine_self(),
         .ret = -EINPROGRESS,
     };
 
@@ -1235,9 +1245,7 @@ static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
         return r;
     }
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-
-    data.co = qemu_coroutine_self();
-    while (data.ret == -EINPROGRESS) {
+    if (!data.skip_yield) {
         qemu_coroutine_yield();
     }
 
@@ -1333,7 +1341,7 @@ static coroutine_fn int nvme_co_flush(BlockDriverState *bs)
         .nsid = cpu_to_le32(s->nsid),
     };
     NVMeCoData data = {
-        .ctx = bdrv_get_aio_context(bs),
+        .co = qemu_coroutine_self(),
         .ret = -EINPROGRESS,
     };
 
@@ -1341,9 +1349,7 @@ static coroutine_fn int nvme_co_flush(BlockDriverState *bs)
     req = nvme_get_free_req(ioq);
     assert(req);
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-
-    data.co = qemu_coroutine_self();
-    if (data.ret == -EINPROGRESS) {
+    if (!data.skip_yield) {
         qemu_coroutine_yield();
     }
 
@@ -1384,7 +1390,7 @@ static coroutine_fn int nvme_co_pwrite_zeroes(BlockDriverState *bs,
     };
 
     NVMeCoData data = {
-        .ctx = bdrv_get_aio_context(bs),
+        .co = qemu_coroutine_self(),
         .ret = -EINPROGRESS,
     };
 
@@ -1404,9 +1410,7 @@ static coroutine_fn int nvme_co_pwrite_zeroes(BlockDriverState *bs,
     assert(req);
 
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-
-    data.co = qemu_coroutine_self();
-    while (data.ret == -EINPROGRESS) {
+    if (!data.skip_yield) {
         qemu_coroutine_yield();
     }
 
@@ -1434,7 +1438,7 @@ static int coroutine_fn nvme_co_pdiscard(BlockDriverState *bs,
     };
 
     NVMeCoData data = {
-        .ctx = bdrv_get_aio_context(bs),
+        .co = qemu_coroutine_self(),
         .ret = -EINPROGRESS,
     };
 
@@ -1479,9 +1483,7 @@ static int coroutine_fn nvme_co_pdiscard(BlockDriverState *bs,
     trace_nvme_dsm(s, offset, bytes);
 
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-
-    data.co = qemu_coroutine_self();
-    while (data.ret == -EINPROGRESS) {
+    if (!data.skip_yield) {
         qemu_coroutine_yield();
     }
 

From ac3520f599fedee05945ce06bb0f71820a7b2ffc Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:44 +0100
Subject: [PATCH 2167/2396] nvme: Note in which AioContext some functions run

Sprinkle comments throughout block/nvme.c noting for some functions
(where it may not be obvious) that they require a certain AioContext, or
in which AioContext they do happen to run (for callbacks, BHs, event
notifiers).

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-10-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/nvme.c | 43 ++++++++++++++++++++++++++++++++++---------
 1 file changed, 34 insertions(+), 9 deletions(-)

diff --git a/block/nvme.c b/block/nvme.c
index b8262ebfd9..919e14cef9 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -65,6 +65,7 @@ typedef struct {
 } NVMeQueue;
 
 typedef struct {
+    /* Called from nvme_process_completion() in the BDS's main AioContext */
     BlockCompletionFunc *cb;
     void *opaque;
     int cid;
@@ -84,6 +85,7 @@ typedef struct {
     uint8_t     *prp_list_pages;
 
     /* Fields protected by @lock */
+    /* Coroutines in this queue are woken in their own context */
     CoQueue     free_req_queue;
     NVMeQueue   sq, cq;
     int         cq_phase;
@@ -92,7 +94,7 @@ typedef struct {
     int         need_kick;
     int         inflight;
 
-    /* Thread-safe, no lock necessary */
+    /* Thread-safe, no lock necessary; runs in the BDS's main context */
     QEMUBH      *completion_bh;
 } NVMeQueuePair;
 
@@ -206,11 +208,13 @@ static void nvme_free_queue_pair(NVMeQueuePair *q)
     g_free(q);
 }
 
+/* Runs in the BDS's main AioContext */
 static void nvme_free_req_queue_cb(void *opaque)
 {
     NVMeQueuePair *q = opaque;
 
     qemu_mutex_lock(&q->lock);
+    /* qemu_co_enter_next() wakes the coroutine in its own AioContext */
     while (q->free_req_head != -1 &&
            qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
         /* Retry waiting requests */
@@ -281,7 +285,7 @@ fail:
     return NULL;
 }
 
-/* With q->lock */
+/* With q->lock, must be run in the BDS's main AioContext */
 static void nvme_kick(NVMeQueuePair *q)
 {
     BDRVNVMeState *s = q->s;
@@ -308,7 +312,10 @@ static NVMeRequest *nvme_get_free_req_nofail_locked(NVMeQueuePair *q)
     return req;
 }
 
-/* Return a free request element if any, otherwise return NULL.  */
+/*
+ * Return a free request element if any, otherwise return NULL.
+ * May be run from any AioContext.
+ */
 static NVMeRequest *nvme_get_free_req_nowait(NVMeQueuePair *q)
 {
     QEMU_LOCK_GUARD(&q->lock);
@@ -321,6 +328,7 @@ static NVMeRequest *nvme_get_free_req_nowait(NVMeQueuePair *q)
 /*
  * Wait for a free request to become available if necessary, then
  * return it.
+ * May be called in any AioContext.
  */
 static coroutine_fn NVMeRequest *nvme_get_free_req(NVMeQueuePair *q)
 {
@@ -328,20 +336,21 @@ static coroutine_fn NVMeRequest *nvme_get_free_req(NVMeQueuePair *q)
 
     while (q->free_req_head == -1) {
         trace_nvme_free_req_queue_wait(q->s, q->index);
+        /* nvme_free_req_queue_cb() wakes us in our own AioContext */
         qemu_co_queue_wait(&q->free_req_queue, &q->lock);
     }
 
     return nvme_get_free_req_nofail_locked(q);
 }
 
-/* With q->lock */
+/* With q->lock, may be called in any AioContext */
 static void nvme_put_free_req_locked(NVMeQueuePair *q, NVMeRequest *req)
 {
     req->free_req_next = q->free_req_head;
     q->free_req_head = req - q->reqs;
 }
 
-/* With q->lock */
+/* With q->lock, may be called in any AioContext */
 static void nvme_wake_free_req_locked(NVMeQueuePair *q)
 {
     if (!qemu_co_queue_empty(&q->free_req_queue)) {
@@ -350,7 +359,7 @@ static void nvme_wake_free_req_locked(NVMeQueuePair *q)
     }
 }
 
-/* Insert a request in the freelist and wake waiters */
+/* Insert a request in the freelist and wake waiters (from any AioContext) */
 static void nvme_put_free_req_and_wake(NVMeQueuePair *q, NVMeRequest *req)
 {
     qemu_mutex_lock(&q->lock);
@@ -381,7 +390,7 @@ static inline int nvme_translate_error(const NvmeCqe *c)
     }
 }
 
-/* With q->lock */
+/* With q->lock, must be run in the BDS's main AioContext */
 static bool nvme_process_completion(NVMeQueuePair *q)
 {
     BDRVNVMeState *s = q->s;
@@ -451,6 +460,7 @@ static bool nvme_process_completion(NVMeQueuePair *q)
     return progress;
 }
 
+/* As q->completion_bh, runs in the BDS's main AioContext */
 static void nvme_process_completion_bh(void *opaque)
 {
     NVMeQueuePair *q = opaque;
@@ -481,6 +491,7 @@ static void nvme_trace_command(const NvmeCmd *cmd)
     }
 }
 
+/* Must be run in the BDS's main AioContext */
 static void nvme_kick_and_check_completions(void *opaque)
 {
     NVMeQueuePair *q = opaque;
@@ -490,6 +501,7 @@ static void nvme_kick_and_check_completions(void *opaque)
     nvme_process_completion(q);
 }
 
+/* Runs in nvme_submit_command()'s AioContext */
 static void nvme_deferred_fn(void *opaque)
 {
     NVMeQueuePair *q = opaque;
@@ -502,6 +514,7 @@ static void nvme_deferred_fn(void *opaque)
     }
 }
 
+/* May be run in any AioContext */
 static void nvme_submit_command(NVMeQueuePair *q, NVMeRequest *req,
                                 NvmeCmd *cmd, BlockCompletionFunc cb,
                                 void *opaque)
@@ -523,6 +536,7 @@ static void nvme_submit_command(NVMeQueuePair *q, NVMeRequest *req,
     defer_call(nvme_deferred_fn, q);
 }
 
+/* Put into NVMeRequest.cb, so runs in the BDS's main AioContext */
 static void nvme_admin_cmd_sync_cb(void *opaque, int ret)
 {
     int *pret = opaque;
@@ -530,6 +544,7 @@ static void nvme_admin_cmd_sync_cb(void *opaque, int ret)
     aio_wait_kick();
 }
 
+/* Must be run in the BDS's or qemu's main AioContext */
 static int nvme_admin_cmd_sync(BlockDriverState *bs, NvmeCmd *cmd)
 {
     BDRVNVMeState *s = bs->opaque;
@@ -638,6 +653,7 @@ out:
     return ret;
 }
 
+/* Must be run in the BDS's main AioContext */
 static void nvme_poll_queue(NVMeQueuePair *q)
 {
     const size_t cqe_offset = q->cq.head * NVME_CQ_ENTRY_BYTES;
@@ -660,6 +676,7 @@ static void nvme_poll_queue(NVMeQueuePair *q)
     qemu_mutex_unlock(&q->lock);
 }
 
+/* Must be run in the BDS's main AioContext */
 static void nvme_poll_queues(BDRVNVMeState *s)
 {
     int i;
@@ -669,6 +686,7 @@ static void nvme_poll_queues(BDRVNVMeState *s)
     }
 }
 
+/* Run as an event notifier in the BDS's main AioContext */
 static void nvme_handle_event(EventNotifier *n)
 {
     BDRVNVMeState *s = container_of(n, BDRVNVMeState,
@@ -722,6 +740,7 @@ out_error:
     return false;
 }
 
+/* Run as an event notifier in the BDS's main AioContext */
 static bool nvme_poll_cb(void *opaque)
 {
     EventNotifier *e = opaque;
@@ -745,6 +764,7 @@ static bool nvme_poll_cb(void *opaque)
     return false;
 }
 
+/* Run as an event notifier in the BDS's main AioContext */
 static void nvme_poll_ready(EventNotifier *e)
 {
     BDRVNVMeState *s = container_of(e, BDRVNVMeState,
@@ -1050,7 +1070,7 @@ static int nvme_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
     return 0;
 }
 
-/* Called with s->dma_map_lock */
+/* Called with s->dma_map_lock, may be run in any AioContext */
 static coroutine_fn int nvme_cmd_unmap_qiov(BlockDriverState *bs,
                                             QEMUIOVector *qiov)
 {
@@ -1061,13 +1081,17 @@ static coroutine_fn int nvme_cmd_unmap_qiov(BlockDriverState *bs,
     if (!s->dma_map_count && !qemu_co_queue_empty(&s->dma_flush_queue)) {
         r = qemu_vfio_dma_reset_temporary(s->vfio);
         if (!r) {
+            /*
+             * Queue access is protected by the dma_map_lock, and all
+             * coroutines are woken in their own AioContext
+             */
             qemu_co_queue_restart_all(&s->dma_flush_queue);
         }
     }
     return r;
 }
 
-/* Called with s->dma_map_lock */
+/* Called with s->dma_map_lock, may be run in any AioContext */
 static coroutine_fn int nvme_cmd_map_qiov(BlockDriverState *bs, NvmeCmd *cmd,
                                           NVMeRequest *req, QEMUIOVector *qiov)
 {
@@ -1180,6 +1204,7 @@ typedef struct {
     int ret;
 } NVMeCoData;
 
+/* Put into NVMeRequest.cb, so runs in the BDS's main AioContext */
 static void nvme_rw_cb(void *opaque, int ret)
 {
     NVMeCoData *data = opaque;

From 9b9ee60c07f52009f9bb659f54c42afae95c1d94 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:45 +0100
Subject: [PATCH 2168/2396] block/io: Take reqs_lock for tracked_requests

bdrv_co_get_self_request() does not take a lock around iterating through
bs->tracked_requests.  With multiqueue, it may thus iterate over a list
that is in the process of being modified, producing an assertion
failure:

../block/file-posix.c:3702: raw_do_pwrite_zeroes: Assertion `req' failed.

[0] abort() at /lib64/libc.so.6
[1] __assert_fail_base.cold() at /lib64/libc.so.6
[2] raw_do_pwrite_zeroes() at ../block/file-posix.c:3702
[3] bdrv_co_do_pwrite_zeroes() at ../block/io.c:1910
[4] bdrv_aligned_pwritev() at ../block/io.c:2109
[5] bdrv_co_do_zero_pwritev() at ../block/io.c:2192
[6] bdrv_co_pwritev_part() at ../block/io.c:2292
[7] bdrv_co_pwritev() at ../block/io.c:2225
[8] handle_alloc_space() at ../block/qcow2.c:2573
[9] qcow2_co_pwritev_task() at ../block/qcow2.c:2625

Fix this by taking reqs_lock.

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-11-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/io.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/block/io.c b/block/io.c
index 928c02d1ad..c4a4301321 100644
--- a/block/io.c
+++ b/block/io.c
@@ -718,11 +718,14 @@ BdrvTrackedRequest *coroutine_fn bdrv_co_get_self_request(BlockDriverState *bs)
     Coroutine *self = qemu_coroutine_self();
     IO_CODE();
 
+    qemu_mutex_lock(&bs->reqs_lock);
     QLIST_FOREACH(req, &bs->tracked_requests, list) {
         if (req->co == self) {
+            qemu_mutex_unlock(&bs->reqs_lock);
             return req;
         }
     }
+    qemu_mutex_unlock(&bs->reqs_lock);
 
     return NULL;
 }

From 90db3a1721b30daf839901813616c0854f383cc5 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:46 +0100
Subject: [PATCH 2169/2396] qcow2: Re-initialize lock in invalidate_cache

After clearing our state (memset()-ing it to 0), we should
re-initialize objects that need it.  Specifically, that applies to
s->lock, which is originally initialized in qcow2_open().

Given qemu_co_mutex_init() is just a memset() to 0, this is functionally
a no-op, but still seems like the right thing to do.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-12-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/block/qcow2.c b/block/qcow2.c
index cb0bdb32ec..4e4f77170a 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -2873,6 +2873,8 @@ qcow2_co_invalidate_cache(BlockDriverState *bs, Error **errp)
     data_file = s->data_file;
     memset(s, 0, sizeof(BDRVQcow2State));
     s->data_file = data_file;
+    /* Re-initialize objects initialized in qcow2_open() */
+    qemu_co_mutex_init(&s->lock);
 
     options = qdict_clone_shallow(bs->options);
 

From f86dde9a1524f0d7fca0f4037f560e6131d31f7f Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:47 +0100
Subject: [PATCH 2170/2396] qcow2: Fix cache_clean_timer
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The cache-cleaner runs as a timer CB in the BDS AioContext.  With
multiqueue, it can run concurrently to I/O requests, and because it does
not take any lock, this can break concurrent cache accesses, corrupting
the image.  While the chances of this happening are low, it can be
reproduced e.g. by modifying the code to schedule the timer CB every
5 ms (instead of at most once per second) and modifying the last (inner)
while loop of qcow2_cache_clean_unused() like so:

    while (i < c->size && can_clean_entry(c, i)) {
        for (int j = 0; j < 1000 && can_clean_entry(c, i); j++) {
            usleep(100);
        }
        c->entries[i].offset = 0;
        c->entries[i].lru_counter = 0;
        i++;
        to_clean++;
    }

i.e. making it wait on purpose for the point in time where the cache is
in use by something else.

The solution chosen for this in this patch is not the best solution, I
hope, but I admittedly can’t come up with anything strictly better.

We can protect from concurrent cache accesses either by taking the
existing s->lock, or we introduce a new (non-coroutine) mutex
specifically for cache accesses.  I would prefer to avoid the latter so
as not to introduce additional (very slight) overhead.

Using s->lock, which is a coroutine mutex, however means that we need to
take it in a coroutine, so the timer must run in a coroutine.  We can
transform it from the current timer CB style into a coroutine that
sleeps for the set interval.  As a result, however, we can no longer
just deschedule the timer to instantly guarantee it won’t run anymore,
but have to await the coroutine’s exit.

(Note even before this patch there were places that may not have been so
guaranteed after all: Anything calling cache_clean_timer_del() from the
QEMU main AioContext could have been running concurrently to an existing
timer CB invocation.)

Polling to await the timer to actually settle seems very complicated for
something that’s rather a minor problem, but I can’t come up with any
better solution that doesn’t again just overlook potential problems.

(Not Cc-ing qemu-stable, as the issue is quite unlikely to be hit, and
I’m not too fond of this solution.)

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-13-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 141 ++++++++++++++++++++++++++++++++++++++++----------
 block/qcow2.h |   5 +-
 2 files changed, 117 insertions(+), 29 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index 4e4f77170a..05da589729 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -835,41 +835,113 @@ static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 };
 
-static void cache_clean_timer_cb(void *opaque)
+static void coroutine_fn cache_clean_timer(void *opaque)
 {
-    BlockDriverState *bs = opaque;
-    BDRVQcow2State *s = bs->opaque;
-    qcow2_cache_clean_unused(s->l2_table_cache);
-    qcow2_cache_clean_unused(s->refcount_block_cache);
-    timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-              (int64_t) s->cache_clean_interval * 1000);
+    BDRVQcow2State *s = opaque;
+    uint64_t wait_ns;
+
+    WITH_QEMU_LOCK_GUARD(&s->lock) {
+        wait_ns = s->cache_clean_interval * NANOSECONDS_PER_SECOND;
+    }
+
+    while (wait_ns > 0) {
+        qemu_co_sleep_ns_wakeable(&s->cache_clean_timer_wake,
+                                  QEMU_CLOCK_VIRTUAL, wait_ns);
+
+        WITH_QEMU_LOCK_GUARD(&s->lock) {
+            if (s->cache_clean_interval > 0) {
+                qcow2_cache_clean_unused(s->l2_table_cache);
+                qcow2_cache_clean_unused(s->refcount_block_cache);
+            }
+
+            wait_ns = s->cache_clean_interval * NANOSECONDS_PER_SECOND;
+        }
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->lock) {
+        s->cache_clean_timer_co = NULL;
+        qemu_co_queue_restart_all(&s->cache_clean_timer_exit);
+    }
 }
 
 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
 {
     BDRVQcow2State *s = bs->opaque;
     if (s->cache_clean_interval > 0) {
-        s->cache_clean_timer =
-            aio_timer_new_with_attrs(context, QEMU_CLOCK_VIRTUAL,
-                                     SCALE_MS, QEMU_TIMER_ATTR_EXTERNAL,
-                                     cache_clean_timer_cb, bs);
-        timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-                  (int64_t) s->cache_clean_interval * 1000);
+        assert(!s->cache_clean_timer_co);
+        s->cache_clean_timer_co = qemu_coroutine_create(cache_clean_timer, s);
+        aio_co_enter(context, s->cache_clean_timer_co);
     }
 }
 
-static void cache_clean_timer_del(BlockDriverState *bs)
+/**
+ * Delete the cache clean timer and await any yet running instance.
+ * Called holding s->lock.
+ */
+static void coroutine_fn
+cache_clean_timer_co_locked_del_and_wait(BlockDriverState *bs)
 {
     BDRVQcow2State *s = bs->opaque;
-    if (s->cache_clean_timer) {
-        timer_free(s->cache_clean_timer);
-        s->cache_clean_timer = NULL;
+
+    if (s->cache_clean_timer_co) {
+        s->cache_clean_interval = 0;
+        qemu_co_sleep_wake(&s->cache_clean_timer_wake);
+        qemu_co_queue_wait(&s->cache_clean_timer_exit, &s->lock);
+    }
+}
+
+/**
+ * Same as cache_clean_timer_co_locked_del_and_wait(), but takes s->lock.
+ */
+static void coroutine_fn
+cache_clean_timer_co_del_and_wait(BlockDriverState *bs)
+{
+    BDRVQcow2State *s = bs->opaque;
+
+    WITH_QEMU_LOCK_GUARD(&s->lock) {
+        cache_clean_timer_co_locked_del_and_wait(bs);
+    }
+}
+
+struct CacheCleanTimerDelAndWaitCoParams {
+    BlockDriverState *bs;
+    bool done;
+};
+
+static void coroutine_fn cache_clean_timer_del_and_wait_co_entry(void *opaque)
+{
+    struct CacheCleanTimerDelAndWaitCoParams *p = opaque;
+
+    cache_clean_timer_co_del_and_wait(p->bs);
+    p->done = true;
+    aio_wait_kick();
+}
+
+/**
+ * Delete the cache clean timer and await any yet running instance.
+ * Must be called from the main or BDS AioContext without s->lock held.
+ */
+static void coroutine_mixed_fn
+cache_clean_timer_del_and_wait(BlockDriverState *bs)
+{
+    IO_OR_GS_CODE();
+
+    if (qemu_in_coroutine()) {
+        cache_clean_timer_co_del_and_wait(bs);
+    } else {
+        struct CacheCleanTimerDelAndWaitCoParams p = { .bs = bs };
+        Coroutine *co;
+
+        co = qemu_coroutine_create(cache_clean_timer_del_and_wait_co_entry, &p);
+        qemu_coroutine_enter(co);
+
+        BDRV_POLL_WHILE(bs, !p.done);
     }
 }
 
 static void qcow2_detach_aio_context(BlockDriverState *bs)
 {
-    cache_clean_timer_del(bs);
+    cache_clean_timer_del_and_wait(bs);
 }
 
 static void qcow2_attach_aio_context(BlockDriverState *bs,
@@ -1214,12 +1286,24 @@ fail:
     return ret;
 }
 
+/* s_locked specifies whether s->lock is held or not */
 static void qcow2_update_options_commit(BlockDriverState *bs,
-                                        Qcow2ReopenState *r)
+                                        Qcow2ReopenState *r,
+                                        bool s_locked)
 {
     BDRVQcow2State *s = bs->opaque;
     int i;
 
+    /*
+     * We need to stop the cache-clean-timer before destroying the metadata
+     * table caches
+     */
+    if (s_locked) {
+        cache_clean_timer_co_locked_del_and_wait(bs);
+    } else {
+        cache_clean_timer_del_and_wait(bs);
+    }
+
     if (s->l2_table_cache) {
         qcow2_cache_destroy(s->l2_table_cache);
     }
@@ -1228,6 +1312,7 @@ static void qcow2_update_options_commit(BlockDriverState *bs,
     }
     s->l2_table_cache = r->l2_table_cache;
     s->refcount_block_cache = r->refcount_block_cache;
+
     s->l2_slice_size = r->l2_slice_size;
 
     s->overlap_check = r->overlap_check;
@@ -1239,11 +1324,8 @@ static void qcow2_update_options_commit(BlockDriverState *bs,
 
     s->discard_no_unref = r->discard_no_unref;
 
-    if (s->cache_clean_interval != r->cache_clean_interval) {
-        cache_clean_timer_del(bs);
-        s->cache_clean_interval = r->cache_clean_interval;
-        cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
-    }
+    s->cache_clean_interval = r->cache_clean_interval;
+    cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
 
     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
     s->crypto_opts = r->crypto_opts;
@@ -1261,6 +1343,7 @@ static void qcow2_update_options_abort(BlockDriverState *bs,
     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
 }
 
+/* Called with s->lock held */
 static int coroutine_fn GRAPH_RDLOCK
 qcow2_update_options(BlockDriverState *bs, QDict *options, int flags,
                      Error **errp)
@@ -1270,7 +1353,7 @@ qcow2_update_options(BlockDriverState *bs, QDict *options, int flags,
 
     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
     if (ret >= 0) {
-        qcow2_update_options_commit(bs, &r);
+        qcow2_update_options_commit(bs, &r, true);
     } else {
         qcow2_update_options_abort(bs, &r);
     }
@@ -1908,7 +1991,7 @@ qcow2_do_open(BlockDriverState *bs, QDict *options, int flags,
     qemu_vfree(s->l1_table);
     /* else pre-write overlap checks in cache_destroy may crash */
     s->l1_table = NULL;
-    cache_clean_timer_del(bs);
+    cache_clean_timer_co_locked_del_and_wait(bs);
     if (s->l2_table_cache) {
         qcow2_cache_destroy(s->l2_table_cache);
     }
@@ -1963,6 +2046,7 @@ static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
 
     /* Initialise locks */
     qemu_co_mutex_init(&s->lock);
+    qemu_co_queue_init(&s->cache_clean_timer_exit);
 
     assert(!qemu_in_coroutine());
     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
@@ -2048,7 +2132,7 @@ static void qcow2_reopen_commit(BDRVReopenState *state)
 
     GRAPH_RDLOCK_GUARD_MAINLOOP();
 
-    qcow2_update_options_commit(state->bs, state->opaque);
+    qcow2_update_options_commit(state->bs, state->opaque, false);
     if (!s->data_file) {
         /*
          * If we don't have an external data file, s->data_file was cleared by
@@ -2805,7 +2889,7 @@ qcow2_do_close(BlockDriverState *bs, bool close_data_file)
         qcow2_inactivate(bs);
     }
 
-    cache_clean_timer_del(bs);
+    cache_clean_timer_del_and_wait(bs);
     qcow2_cache_destroy(s->l2_table_cache);
     qcow2_cache_destroy(s->refcount_block_cache);
 
@@ -2875,6 +2959,7 @@ qcow2_co_invalidate_cache(BlockDriverState *bs, Error **errp)
     s->data_file = data_file;
     /* Re-initialize objects initialized in qcow2_open() */
     qemu_co_mutex_init(&s->lock);
+    qemu_co_queue_init(&s->cache_clean_timer_exit);
 
     options = qdict_clone_shallow(bs->options);
 
diff --git a/block/qcow2.h b/block/qcow2.h
index 547bb2b814..96db7c51ec 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -345,8 +345,11 @@ typedef struct BDRVQcow2State {
 
     Qcow2Cache *l2_table_cache;
     Qcow2Cache *refcount_block_cache;
-    QEMUTimer *cache_clean_timer;
+    /* Non-NULL while the timer is running */
+    Coroutine *cache_clean_timer_co;
     unsigned cache_clean_interval;
+    QemuCoSleep cache_clean_timer_wake;
+    CoQueue cache_clean_timer_exit;
 
     QLIST_HEAD(, QCowL2Meta) cluster_allocs;
 

From 94ce870f60dc59777aa78313633930c252638c19 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:48 +0100
Subject: [PATCH 2171/2396] qcow2: Schedule cache-clean-timer in realtime

There is no reason why the cache cleaning timer should run in virtual
time, run it in realtime instead.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-14-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index 05da589729..e29810d86a 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -846,7 +846,7 @@ static void coroutine_fn cache_clean_timer(void *opaque)
 
     while (wait_ns > 0) {
         qemu_co_sleep_ns_wakeable(&s->cache_clean_timer_wake,
-                                  QEMU_CLOCK_VIRTUAL, wait_ns);
+                                  QEMU_CLOCK_REALTIME, wait_ns);
 
         WITH_QEMU_LOCK_GUARD(&s->lock) {
             if (s->cache_clean_interval > 0) {

From 7c3e9b87f568e726731fad8b64f8e3dd28417563 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:49 +0100
Subject: [PATCH 2172/2396] ssh: Run restart_coroutine in current AioContext

restart_coroutine() is attached as an FD handler just to wake the
current coroutine after yielding.  It makes most sense to attach it to
the current (request) AioContext instead of the BDS main context.  This
way, the coroutine can be entered directly from the BH instead of having
yet another indirection through AioContext.co_schedule_bh.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-15-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/ssh.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/block/ssh.c b/block/ssh.c
index 70fe7cf86e..bdec94e9e9 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -1010,19 +1010,18 @@ static int ssh_has_zero_init(BlockDriverState *bs)
 }
 
 typedef struct BDRVSSHRestart {
-    BlockDriverState *bs;
+    BDRVSSHState *s;
     Coroutine *co;
 } BDRVSSHRestart;
 
 static void restart_coroutine(void *opaque)
 {
     BDRVSSHRestart *restart = opaque;
-    BlockDriverState *bs = restart->bs;
-    BDRVSSHState *s = bs->opaque;
-    AioContext *ctx = bdrv_get_aio_context(bs);
+    BDRVSSHState *s = restart->s;
 
     trace_ssh_restart_coroutine(restart->co);
-    aio_set_fd_handler(ctx, s->sock, NULL, NULL, NULL, NULL, NULL);
+    aio_set_fd_handler(qemu_get_current_aio_context(), s->sock,
+                       NULL, NULL, NULL, NULL, NULL);
 
     aio_co_wake(restart->co);
 }
@@ -1031,12 +1030,13 @@ static void restart_coroutine(void *opaque)
  * handlers are set up so that we'll be rescheduled when there is an
  * interesting event on the socket.
  */
-static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
+static coroutine_fn void co_yield(BDRVSSHState *s)
 {
     int r;
     IOHandler *rd_handler = NULL, *wr_handler = NULL;
+    AioContext *ctx = qemu_get_current_aio_context();
     BDRVSSHRestart restart = {
-        .bs = bs,
+        .s = s,
         .co = qemu_coroutine_self()
     };
 
@@ -1051,7 +1051,7 @@ static coroutine_fn void co_yield(BDRVSSHState *s, BlockDriverState *bs)
 
     trace_ssh_co_yield(s->sock, rd_handler, wr_handler);
 
-    aio_set_fd_handler(bdrv_get_aio_context(bs), s->sock,
+    aio_set_fd_handler(ctx, s->sock,
                        rd_handler, wr_handler, NULL, NULL, &restart);
     qemu_coroutine_yield();
     trace_ssh_co_yield_back(s->sock);
@@ -1093,7 +1093,7 @@ static coroutine_fn int ssh_read(BDRVSSHState *s, BlockDriverState *bs,
         trace_ssh_read_return(r, sftp_get_error(s->sftp));
 
         if (r == SSH_AGAIN) {
-            co_yield(s, bs);
+            co_yield(s);
             goto again;
         }
         if (r == SSH_EOF || (r == 0 && sftp_get_error(s->sftp) == SSH_FX_EOF)) {
@@ -1168,7 +1168,7 @@ static coroutine_fn int ssh_write(BDRVSSHState *s, BlockDriverState *bs,
         trace_ssh_write_return(r, sftp_get_error(s->sftp));
 
         if (r == SSH_AGAIN) {
-            co_yield(s, bs);
+            co_yield(s);
             goto again;
         }
         if (r < 0) {
@@ -1233,7 +1233,7 @@ static coroutine_fn int ssh_flush(BDRVSSHState *s, BlockDriverState *bs)
  again:
     r = sftp_fsync(s->sftp_handle);
     if (r == SSH_AGAIN) {
-        co_yield(s, bs);
+        co_yield(s);
         goto again;
     }
     if (r < 0) {

From b0cc742f8475398467eaf85f1d3692d215465327 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:50 +0100
Subject: [PATCH 2173/2396] =?UTF-8?q?blkreplay:=20Run=20BH=20in=20coroutin?=
 =?UTF-8?q?e=E2=80=99s=20AioContext?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While it does not matter in which AioContext we run aio_co_wake() to
continue an exactly-once-yielding coroutine, making this commit not
strictly necessary, there is also no reason why the BH should run in any
context but the request’s AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-16-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/blkreplay.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/block/blkreplay.c b/block/blkreplay.c
index 16d8b12dd9..8a6845425e 100644
--- a/block/blkreplay.c
+++ b/block/blkreplay.c
@@ -63,9 +63,10 @@ static void block_request_create(uint64_t reqid, BlockDriverState *bs,
                                  Coroutine *co)
 {
     Request *req = g_new(Request, 1);
+    AioContext *ctx = qemu_coroutine_get_aio_context(co);
     *req = (Request) {
         .co = co,
-        .bh = aio_bh_new(bdrv_get_aio_context(bs), blkreplay_bh_cb, req),
+        .bh = aio_bh_new(ctx, blkreplay_bh_cb, req),
     };
     replay_block_event(req->bh, reqid);
 }

From d45b2c65f2570433c092f35296976c1f6241f54b Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:51 +0100
Subject: [PATCH 2174/2396] block: Note in which AioContext AIO CBs are called
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This doesn’t seem to be specified anywhere, but is something we probably
want to be clear.  I believe it is reasonable to implicitly assume that
callbacks are run in the current thread (unless explicitly noted
otherwise), so codify that assumption.

Some implementations don’t actually fulfill this contract yet.  The next
patches should rectify that.

Note: I don’t know of any user-visible bugs produced by not running AIO
callbacks in the original context.  AIO functionality is generally
mapped to coroutines through the use of bdrv_co_io_em_complete(), which
can run in any AioContext, and will always wake the yielding coroutine
in its original context.  The only benefit here is that running
bdrv_co_io_em_complete() in the original context will make that
aio_co_wake() most likely a simpler qemu_coroutine_enter() instead of
scheduling the wakeup through AioContext.co_schedule_bh.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-17-hreitz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int-common.h | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index f2a4e863fc..cb0143ea77 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -508,7 +508,12 @@ struct BlockDriver {
         BlockDriverState *bs, BlockdevAmendOptions *opts, bool force,
         Error **errp);
 
-    /* aio */
+    /*
+     * AIO
+     * The given completion callback will be run in the same AioContext as the
+     * one in which the AIO function was called.
+     */
+
     BlockAIOCB * GRAPH_RDLOCK_PTR (*bdrv_aio_preadv)(BlockDriverState *bs,
         int64_t offset, int64_t bytes, QEMUIOVector *qiov,
         BdrvRequestFlags flags, BlockCompletionFunc *cb, void *opaque);

From 63d15c7aa5c82b3bebcaf4be3802f6949657f41c Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:52 +0100
Subject: [PATCH 2175/2396] iscsi: Create AIO BH in original AioContext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AIO callbacks must be called in the original request’s AioContext,
regardless of the BDS’s “main” AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-18-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/iscsi.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c
index 852ecccf0d..7d6bf185ea 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -119,6 +119,7 @@ typedef struct IscsiTask {
 
 typedef struct IscsiAIOCB {
     BlockAIOCB common;
+    AioContext *ctx;
     QEMUBH *bh;
     IscsiLun *iscsilun;
     struct scsi_task *task;
@@ -173,7 +174,7 @@ iscsi_schedule_bh(IscsiAIOCB *acb)
     if (acb->bh) {
         return;
     }
-    acb->bh = aio_bh_new(acb->iscsilun->aio_context, iscsi_bh_cb, acb);
+    acb->bh = aio_bh_new(acb->ctx, iscsi_bh_cb, acb);
     qemu_bh_schedule(acb->bh);
 }
 
@@ -1012,8 +1013,7 @@ static void iscsi_ioctl_handle_emulated(IscsiAIOCB *acb, int req, void *buf)
         ret = -EINVAL;
     }
     assert(!acb->bh);
-    acb->bh = aio_bh_new(bdrv_get_aio_context(bs),
-                         iscsi_ioctl_bh_completion, acb);
+    acb->bh = aio_bh_new(acb->ctx, iscsi_ioctl_bh_completion, acb);
     acb->ret = ret;
     qemu_bh_schedule(acb->bh);
 }
@@ -1030,6 +1030,7 @@ static BlockAIOCB *iscsi_aio_ioctl(BlockDriverState *bs,
     acb = qemu_aio_get(&iscsi_aiocb_info, bs, cb, opaque);
 
     acb->iscsilun = iscsilun;
+    acb->ctx         = qemu_get_current_aio_context();
     acb->bh          = NULL;
     acb->status      = -EINPROGRESS;
     acb->ioh         = buf;

From f18782a8f538160f1b9924e5964ed1899f130852 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:53 +0100
Subject: [PATCH 2176/2396] null-aio: Run CB in original AioContext
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-19-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/null.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/block/null.c b/block/null.c
index 4e448d593d..253d20ccbb 100644
--- a/block/null.c
+++ b/block/null.c
@@ -173,18 +173,17 @@ static inline BlockAIOCB *null_aio_common(BlockDriverState *bs,
 {
     NullAIOCB *acb;
     BDRVNullState *s = bs->opaque;
+    AioContext *ctx = qemu_get_current_aio_context();
 
     acb = qemu_aio_get(&null_aiocb_info, bs, cb, opaque);
     /* Only emulate latency after vcpu is running. */
     if (s->latency_ns) {
-        aio_timer_init(bdrv_get_aio_context(bs), &acb->timer,
-                       QEMU_CLOCK_REALTIME, SCALE_NS,
+        aio_timer_init(ctx, &acb->timer, QEMU_CLOCK_REALTIME, SCALE_NS,
                        null_timer_cb, acb);
         timer_mod_ns(&acb->timer,
                      qemu_clock_get_ns(QEMU_CLOCK_REALTIME) + s->latency_ns);
     } else {
-        replay_bh_schedule_oneshot_event(bdrv_get_aio_context(bs),
-                                         null_bh_cb, acb);
+        replay_bh_schedule_oneshot_event(ctx, null_bh_cb, acb);
     }
     return &acb->common;
 }

From 837c04e9fc798cddafe721e2abbbd0d932571793 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 10 Nov 2025 16:48:54 +0100
Subject: [PATCH 2177/2396] win32-aio: Run CB in original context
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

AIO callbacks must be called in the originally calling AioContext,
regardless of the BDS’s “main” AioContext.

Note: I tried to test this (under wine), but failed.  Whenever I tried
to use multiqueue or even just an I/O thread for a virtio-blk (or
virtio-scsi) device, I/O stalled, both with and without this patch.

For what it’s worth, when not using an I/O thread, I/O continued to work
with this patch.

Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-ID: <20251110154854.151484-20-hreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/win32-aio.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/block/win32-aio.c b/block/win32-aio.c
index 6327861e1d..f0689f3ee9 100644
--- a/block/win32-aio.c
+++ b/block/win32-aio.c
@@ -48,48 +48,62 @@ struct QEMUWin32AIOState {
 typedef struct QEMUWin32AIOCB {
     BlockAIOCB common;
     struct QEMUWin32AIOState *ctx;
+    AioContext *req_ctx;
     int nbytes;
     OVERLAPPED ov;
     QEMUIOVector *qiov;
     void *buf;
     bool is_read;
     bool is_linear;
+    int ret;
 } QEMUWin32AIOCB;
 
+static void win32_aio_completion_cb_bh(void *opaque)
+{
+    QEMUWin32AIOCB *waiocb = opaque;
+
+    waiocb->common.cb(waiocb->common.opaque, waiocb->ret);
+    aio_context_unref(waiocb->req_ctx);
+    qemu_aio_unref(waiocb);
+}
+
 /*
  * Completes an AIO request (calls the callback and frees the ACB).
  */
 static void win32_aio_process_completion(QEMUWin32AIOState *s,
     QEMUWin32AIOCB *waiocb, DWORD count)
 {
-    int ret;
     s->count--;
 
     if (waiocb->ov.Internal != 0) {
-        ret = -EIO;
+        waiocb->ret = -EIO;
     } else {
-        ret = 0;
+        waiocb->ret = 0;
         if (count < waiocb->nbytes) {
             /* Short reads mean EOF, pad with zeros. */
             if (waiocb->is_read) {
                 qemu_iovec_memset(waiocb->qiov, count, 0,
                     waiocb->qiov->size - count);
             } else {
-                ret = -EINVAL;
+                waiocb->ret = -EINVAL;
             }
        }
     }
 
     if (!waiocb->is_linear) {
-        if (ret == 0 && waiocb->is_read) {
+        if (waiocb->ret == 0 && waiocb->is_read) {
             QEMUIOVector *qiov = waiocb->qiov;
             iov_from_buf(qiov->iov, qiov->niov, 0, waiocb->buf, qiov->size);
         }
         qemu_vfree(waiocb->buf);
     }
 
-    waiocb->common.cb(waiocb->common.opaque, ret);
-    qemu_aio_unref(waiocb);
+    if (waiocb->req_ctx == s->aio_ctx) {
+        win32_aio_completion_cb_bh(waiocb);
+    } else {
+        aio_bh_schedule_oneshot(waiocb->req_ctx, win32_aio_completion_cb_bh,
+                                waiocb);
+    }
 }
 
 static void win32_aio_completion_cb(EventNotifier *e)
@@ -120,10 +134,13 @@ BlockAIOCB *win32_aio_submit(BlockDriverState *bs,
     DWORD rc;
 
     waiocb = qemu_aio_get(&win32_aiocb_info, bs, cb, opaque);
+    waiocb->req_ctx = qemu_get_current_aio_context();
     waiocb->nbytes = bytes;
     waiocb->qiov = qiov;
     waiocb->is_read = (type == QEMU_AIO_READ);
 
+    aio_context_ref(waiocb->req_ctx);
+
     if (qiov->niov > 1) {
         waiocb->buf = qemu_try_blockalign(bs, qiov->size);
         if (waiocb->buf == NULL) {

From ad2085658511d0b14db7fca54094471b37bc6751 Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Red Hat)" <david@kernel.org>
Date: Mon, 3 Nov 2025 11:39:46 +0100
Subject: [PATCH 2178/2396] MAINTAINERS: Update David Hildenbrand's email
 address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch to kernel.org email address as I will be leaving Red Hat. The
old address will remain active until end of January 2026, so performing
the change now should make sure that most mails will reach me.

Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251103103947.384401-1-david@kernel.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 .mailmap    |  1 +
 MAINTAINERS | 18 +++++++++---------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/.mailmap b/.mailmap
index 7f817d9f42..0690f7be34 100644
--- a/.mailmap
+++ b/.mailmap
@@ -82,6 +82,7 @@ Brian Cain <brian.cain@oss.qualcomm.com> <bcain@quicinc.com>
 Brian Cain <brian.cain@oss.qualcomm.com> <quic_bcain@quicinc.com>
 Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
 Damien Hedde <damien.hedde@dahe.fr> <damien.hedde@greensocs.com>
+David Hildenbrand <david@kernel.org> <david@redhat.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
 Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
 Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index 38325e0617..d1c5080e50 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -364,7 +364,7 @@ F: target/rx/
 
 S390 TCG CPUs
 M: Richard Henderson <richard.henderson@linaro.org>
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 R: Ilya Leoshkevich <iii@linux.ibm.com>
 S: Maintained
 F: target/s390x/
@@ -1862,7 +1862,7 @@ F: target/s390x/ioinst.c
 L: qemu-s390x@nongnu.org
 
 S390 CPU models
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 S: Maintained
 F: target/s390x/cpu_features*.[ch]
 F: target/s390x/cpu_models.[ch]
@@ -2384,7 +2384,7 @@ F: tests/functional/x86_64/test_virtio_version.py
 
 virtio-balloon
 M: Michael S. Tsirkin <mst@redhat.com>
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 S: Maintained
 F: docs/interop/virtio-balloon-stats.rst
 F: hw/virtio/virtio-balloon*.c
@@ -2532,7 +2532,7 @@ F: hw/virtio/virtio-crypto-pci.c
 F: include/hw/virtio/virtio-crypto.h
 
 virtio based memory device
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 S: Supported
 F: hw/s390x/virtio-ccw-md.c
 F: hw/s390x/virtio-ccw-md.h
@@ -2541,7 +2541,7 @@ F: hw/virtio/virtio-md-*.c
 F: include/hw/virtio/virtio-md-pci.h
 
 virtio-mem
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 S: Supported
 W: https://virtio-mem.gitlab.io/
 F: hw/virtio/virtio-mem.c
@@ -2919,7 +2919,7 @@ L: qemu-s390x@nongnu.org
 S390 floating interrupt controller
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: hw/intc/s390_flic*.c
@@ -3248,7 +3248,7 @@ T: git https://gitlab.com/stsquad/qemu gdbstub/next
 Memory API
 M: Paolo Bonzini <pbonzini@redhat.com>
 M: Peter Xu <peterx@redhat.com>
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Supported
 F: include/system/ioport.h
@@ -3268,7 +3268,7 @@ F: system/ram-block-attributes.c
 F: scripts/coccinelle/memory-region-housekeeping.cocci
 
 Memory devices
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 M: Igor Mammedov <imammedo@redhat.com>
 R: Xiao Guangrong <xiaoguangrong.eric@gmail.com>
 S: Supported
@@ -3371,7 +3371,7 @@ R: Ilya Maximets <i.maximets@ovn.org>
 F: net/af-xdp.c
 
 Host Memory Backends
-M: David Hildenbrand <david@redhat.com>
+M: David Hildenbrand <david@kernel.org>
 M: Igor Mammedov <imammedo@redhat.com>
 S: Maintained
 F: backends/hostmem*.c

From 3abfbb571143ba865488b6c11f8ad75dda97d1a3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Thu, 6 Nov 2025 11:51:48 +0100
Subject: [PATCH 2179/2396] hw/intc/ioapic: Fix ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
 typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 638ac1c78457 introduced a regression in interrupt remapping
when running a VM configured with an intel-iommu device and an
assigned PCI VF. During boot, Linux reports repeated messages :

 [   15.416794] __common_interrupt: 2.37 No irq handler for vector
 [   15.417266] __common_interrupt: 2.37 No irq handler for vector
 [   15.417733] __common_interrupt: 2.37 No irq handler for vector
 [   15.418202] __common_interrupt: 2.37 No irq handler for vector
 [   15.418670] __common_interrupt: 2.37 No irq handler for vector

and may eventually hang.

The issue is caused by the incorrect use of the macro
ACCEL_KERNEL_GSI_IRQFD_POSSIBLE, which should instead be
ACCEL_GSI_IRQFD_POSSIBLE.

Fixes: 638ac1c78457 ("hw/intc: Generalize APIC helper names from kvm_* to accel_*")
Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251106105148.737093-1-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/intc/ioapic.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/ioapic.c b/hw/intc/ioapic.c
index e431d00311..38e4384648 100644
--- a/hw/intc/ioapic.c
+++ b/hw/intc/ioapic.c
@@ -216,7 +216,7 @@ static void ioapic_update_kvm_routes(IOAPICCommonState *s)
 #endif
 }
 
-#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
+#ifdef ACCEL_GSI_IRQFD_POSSIBLE
 static void ioapic_iec_notifier(void *private, bool global,
                                 uint32_t index, uint32_t mask)
 {
@@ -434,7 +434,7 @@ static const MemoryRegionOps ioapic_io_ops = {
 
 static void ioapic_machine_done_notify(Notifier *notifier, void *data)
 {
-#ifdef ACCEL_KERNEL_GSI_IRQFD_POSSIBLE
+#ifdef ACCEL_GSI_IRQFD_POSSIBLE
     IOAPICCommonState *s = container_of(notifier, IOAPICCommonState,
                                         machine_done);
 

From 321ded29e663ca040a0c4ecd3ff97452c9d30a3f Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 7 Nov 2025 17:43:06 +0000
Subject: [PATCH 2180/2396] system/qtest.c: Allow for multiple CHR_EVENT_CLOSED
 events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the qtest_event() QEMUChrEvent handler, we create a timer
and log OPENED on CHR_EVENT_OPENED, and we destroy the timer and
log CLOSED on CHR_EVENT_CLOSED. However, the chardev subsystem
can send us more than one CHR_EVENT_CLOSED if we're reading from
a file chardev:
 * the first one happens when we read the last data from the file
 * the second one happens when the user hits ^C to exit QEMU
   and the chardev is finalized: char_fd_finalize()

This causes us to call g_timer_elapsed() with a NULL timer
(which glib complains about) and print an extra CLOSED log line
with a zero timestamp:

[I +0.063829] CLOSED
qemu-system-aarch64: GLib: g_timer_elapsed: assertion 'timer != NULL' failed
[I +0.000000] CLOSED

Avoid this by ignoring a CHR_EVENT_CLOSED if we have already
processed one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <lvivier@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251107174306.1408139-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/qtest.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/system/qtest.c b/system/qtest.c
index e4d1cd75da..cbeb7f3772 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -808,6 +808,10 @@ static void qtest_event(void *opaque, QEMUChrEvent event)
         }
         break;
     case CHR_EVENT_CLOSED:
+        if (!qtest_opened) {
+            /* Ignore CLOSED events if we have already closed the log */
+            break;
+        }
         qtest_opened = false;
         if (qtest_log_fp) {
             fprintf(qtest_log_fp, "[I +" FMT_timeval "] CLOSED\n", g_timer_elapsed(timer, NULL));

From 2739d6ff50bbfcb1983660730a05be26271e4fce Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng.cn@gmail.com>
Date: Mon, 10 Nov 2025 19:05:06 +0800
Subject: [PATCH 2181/2396] hw/sd: Fix incorrect idle state reporting in R1
 response for SPI mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit b66f73a0 ("hw/sd: Add SDHC support for SD card SPI-mode"),
the CARD_POWER_UP bit in the OCR register has been set after reset.
Therefore, checking this bit against zero in sd_response_r1_make() to
determine the card’s idle state is incorrect in SPI mode. As a result,
QEMU makes the U-Boot mmc-spi driver believe the card never leaves the
reset state.

Fixes: 1585ab9f ("hw/sd/sdcard: Fill SPI response bits in card code")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-2-bmeng.cn@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 9c86c016cc..5aae541363 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -789,8 +789,7 @@ static size_t sd_response_size(SDState *sd, sd_rsp_type_t rtype)
 static void sd_response_r1_make(SDState *sd, uint8_t *response)
 {
     if (sd_is_spi(sd)) {
-        response[0] = sd->state == sd_idle_state
-                   && !FIELD_EX32(sd->ocr, OCR, CARD_POWER_UP);
+        response[0] = sd->state == sd_idle_state;
         response[0] |= FIELD_EX32(sd->card_status, CSR, ERASE_RESET) << 1;
         response[0] |= FIELD_EX32(sd->card_status, CSR, ILLEGAL_COMMAND) << 2;
         response[0] |= FIELD_EX32(sd->card_status, CSR, COM_CRC_ERROR) << 3;

From 40260d3ea67cc5cdf20553be24353680d70b1b6c Mon Sep 17 00:00:00 2001
From: Bin Meng <bmeng.cn@gmail.com>
Date: Mon, 10 Nov 2025 19:05:07 +0800
Subject: [PATCH 2182/2396] hw/sd: Fix ACMD41 state machine in SPI mode
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In SPI mode, the ACMD41 argument only defines bit 30 (HCS); all other
bits are reserved. The current implementation incorrectly checks the
voltage window bits even in SPI mode, preventing the state machine
from transitioning to the READY state. As a result, the U-Boot
mmc-spi driver falls into an endless CMD55/ACMD41 loop.

Fixes: 3241a61a ("hw/sd/sdcard: Use complete SEND_OP_COND implementation in SPI mode")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2945
Reported-by: Tom Rini <trini@konsulko.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251110110507.1641042-3-bmeng.cn@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 23 ++++++++++++-----------
 1 file changed, 12 insertions(+), 11 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index 5aae541363..df5a36fad9 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -2289,20 +2289,21 @@ static sd_rsp_type_t sd_cmd_SEND_OP_COND(SDState *sd, SDRequest req)
         }
     }
 
-    if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
-        /*
-         * We accept any voltage.  10000 V is nothing.
-         *
-         * Once we're powered up, we advance straight to ready state
-         * unless it's an enquiry ACMD41 (bits 23:0 == 0).
-         */
-        sd->state = sd_ready_state;
-    }
-
     if (sd_is_spi(sd)) {
+        sd->state = sd_ready_state;
         return sd_r1;
+    } else {
+        if (FIELD_EX32(sd->ocr & req.arg, OCR, VDD_VOLTAGE_WINDOW)) {
+            /*
+             * We accept any voltage.  10000 V is nothing.
+             *
+             * Once we're powered up, we advance straight to ready state
+             * unless it's an enquiry ACMD41 (bits 23:0 == 0).
+             */
+            sd->state = sd_ready_state;
+        }
+        return sd_r3;
     }
-    return sd_r3;
 }
 
 /* ACMD42 */

From a344e22917f48d8cd876d72057bcfb938beb0630 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Yannick=20Vo=C3=9Fen?= <y.vossen@beckhoff.com>
Date: Tue, 11 Nov 2025 11:28:29 +0100
Subject: [PATCH 2183/2396] hw/dma/zynq-devcfg: Fix register memory
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Registers are always 32 bit aligned. R_MAX is not the maximum
register address, it is the maximum register number. The memory
size can be determined by 4 * R_MAX.

Currently every register with an offset bigger than 0x40 will be
ignored, because the memory size is set wrong. This effects the
MCTRL register and makes it useless. This commit restores the
correct behaviour.

Cc: qemu-stable@nongnu.org
Fixes: 034c2e69023 ("dma: Add Xilinx Zynq devcfg device model")
Signed-off-by: YannickV <Y.Vossen@beckhoff.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251111102836.212535-9-corvin.koehne@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/dma/xlnx-zynq-devcfg.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/dma/xlnx-zynq-devcfg.c b/hw/dma/xlnx-zynq-devcfg.c
index 26845713ee..8141d46033 100644
--- a/hw/dma/xlnx-zynq-devcfg.c
+++ b/hw/dma/xlnx-zynq-devcfg.c
@@ -372,7 +372,7 @@ static void xlnx_zynq_devcfg_init(Object *obj)
                               s->regs_info, s->regs,
                               &xlnx_zynq_devcfg_reg_ops,
                               XLNX_ZYNQ_DEVCFG_ERR_DEBUG,
-                              XLNX_ZYNQ_DEVCFG_R_MAX);
+                              XLNX_ZYNQ_DEVCFG_R_MAX * 4);
     memory_region_add_subregion(&s->iomem,
                                 A_CTRL,
                                 &reg_array->mem);

From f20a824902abe144c1441322d02ba18567797452 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 12 Nov 2025 09:35:19 +0100
Subject: [PATCH 2184/2396] hw/arm: Re-enable xenpvh machine in
 qemu-system-arm/aarch64 binaries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While registering the ARM/Aarch64 machine interfaces
in commit 38c5ab40031 ("hw/arm: Filter machine types
for qemu-system-arm/aarch64 binaries"), we missed the
XenPV machine. Correct that.

Reported-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@amd.com>
Message-Id: <20251117091253.56009-1-philmd@linaro.org>
---
 hw/arm/xen-pvh.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/xen-pvh.c b/hw/arm/xen-pvh.c
index 1a9eeb01c8..86a0296616 100644
--- a/hw/arm/xen-pvh.c
+++ b/hw/arm/xen-pvh.c
@@ -10,6 +10,7 @@
 #include "hw/boards.h"
 #include "system/system.h"
 #include "hw/xen/xen-pvh-common.h"
+#include "hw/arm/machines-qom.h"
 
 #define TYPE_XEN_ARM  MACHINE_TYPE_NAME("xenpvh")
 
@@ -95,6 +96,7 @@ static const TypeInfo xen_arm_machine_type = {
     .class_init = xen_arm_machine_class_init,
     .instance_size = sizeof(XenPVHMachineState),
     .instance_init = xen_arm_instance_init,
+    .interfaces = arm_aarch64_machine_interfaces,
 };
 
 static void xen_arm_machine_register_types(void)

From 99282a805cea60a1b81223b1ed4fe42ea4b16189 Mon Sep 17 00:00:00 2001
From: Jan Kiszka <jan.kiszka@siemens.com>
Date: Fri, 14 Nov 2025 22:27:35 +0100
Subject: [PATCH 2185/2396] hw/sd/sdcard: Avoid confusing address calculation
 in rpmb_calc_hmac
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From the source frame, we initially need to copy out all fields after
data, thus starting from nonce on. Avoid expressing this indirectly by
pointing to the end of the data field - which also raised the attention
of Coverity (out-of-bound read /wrt data).

Resolves: CID 1642869
Reported-by: GuoHan Zhao <zhaoguohan@kylinos.cn>
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <4f7e1952-ecbd-4484-b128-9d02de3a7935@siemens.com>
[PMD: Add comment before the memcpy() call]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/sd/sd.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index df5a36fad9..40a75a43ff 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -1160,8 +1160,13 @@ static bool rpmb_calc_hmac(SDState *sd, const RPMBDataFrame *frame,
 
         assert(RPMB_HASH_LEN <= sizeof(sd->data));
 
-        memcpy((uint8_t *)buf + RPMB_DATA_LEN, &frame->data[RPMB_DATA_LEN],
+        /*
+         * We will hash everything from data field to the end of RPMBDataFrame.
+         */
+        memcpy((uint8_t *)buf + RPMB_DATA_LEN,
+               (uint8_t *)frame + offsetof(RPMBDataFrame, nonce),
                RPMB_HASH_LEN - RPMB_DATA_LEN);
+
         offset = lduw_be_p(&frame->address) * RPMB_DATA_LEN + sd_part_offset(sd);
         do {
             if (blk_pread(sd->blk, offset, RPMB_DATA_LEN, buf, 0) < 0) {

From d3bc229c79c7d5a94463f836707793331807b709 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 18:20:19 +0100
Subject: [PATCH 2186/2396] qga/commands: Include proper Solaris header for
 getloadavg()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Solaris declares getloadavg() in <sys/loadavg.h>:

    getloadavg(3C)       Standard C Library Functions       getloadavg(3C)

    NAME
           getloadavg - get system load averages

    SYNOPSIS
           #include <sys/loadavg.h>

           int getloadavg(double loadavg[], int nelem);

    [...]

    Oracle Solaris 11.4           23 Jul 2020               getloadavg(3C)

Include it in order to avoid:

  ../qga/commands-posix.c: In function 'qmp_guest_get_load':
  ../qga/commands-posix.c:1408:9: error: implicit declaration of function 'getloadavg' [-Wimplicit-function-declaration]
   1408 |     if (getloadavg(loadavg, G_N_ELEMENTS(loadavg)) < 0) {
      |         ^~~~~~~~~~
  ../qga/commands-posix.c:1408:9: warning: nested extern declaration of 'getloadavg' [-Wnested-externs]

../configure relevant output:

  C compiler for the host machine: gcc (gcc 14.2.0 "gcc (GCC) 14.2.0")
  C linker for the host machine: gcc ld.solaris 5.11-1.3315

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-2-philmd@linaro.org>
---
 qga/commands-posix.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index c7059857e4..66f3e6f673 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -43,6 +43,9 @@
 #include <net/ethernet.h>
 #endif
 #ifdef CONFIG_SOLARIS
+#ifdef CONFIG_GETLOADAVG
+#include <sys/loadavg.h>
+#endif
 #include <sys/sockio.h>
 #endif
 #endif

From 9c3b76a0d40671cbdf1f97c662311ec8bb517c76 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Sun, 16 Nov 2025 23:56:54 +0100
Subject: [PATCH 2187/2396] hw/southbridge/lasi: Correct LasiState parent
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

TYPE_LASI_CHIP inherits from TYPE_SYS_BUS_DEVICE, not
TYPE_PCI_HOST_BRIDGE, so its parent structure is of
SysBusDevice type.

Cc: qemu-stable@nongnu.org
Fixes: 376b851909d ("hppa: Add support for LASI chip with i82596 NIC")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Gustavo Romero <gustavo.romero@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-Id: <20251117091804.56529-1-philmd@linaro.org>
---
 include/hw/misc/lasi.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/hw/misc/lasi.h b/include/hw/misc/lasi.h
index 04312d0b58..0e95be1c32 100644
--- a/include/hw/misc/lasi.h
+++ b/include/hw/misc/lasi.h
@@ -13,8 +13,8 @@
 #define LASI_H
 
 #include "system/address-spaces.h"
-#include "hw/pci/pci_host.h"
 #include "hw/boards.h"
+#include "hw/sysbus.h"
 
 #define TYPE_LASI_CHIP "lasi-chip"
 OBJECT_DECLARE_SIMPLE_TYPE(LasiState, LASI_CHIP)
@@ -63,7 +63,7 @@ OBJECT_DECLARE_SIMPLE_TYPE(LasiState, LASI_CHIP)
 #define LASI_IRQ_PS2MOU_HPA 26
 
 struct LasiState {
-    PCIHostState parent_obj;
+    SysBusDevice parent_obj;
 
     uint32_t irr;
     uint32_t imr;

From 15544486f0609608f6118a551f876e3030fc5eb9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 11:05:56 +0100
Subject: [PATCH 2188/2396] buildsys: Remove dead 'mips' entry in
 supported_cpus[] array
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove 'mips' from supported_cpus[], forgotten in commit
269ffaabc84 ("buildsys: Remove support for 32-bit MIPS hosts").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20251117114200.60917-1-philmd@linaro.org>
---
 meson.build | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index df4460035c..5ddec8afd7 100644
--- a/meson.build
+++ b/meson.build
@@ -52,7 +52,7 @@ qapi_trace_events = []
 bsd_oses = ['gnu/kfreebsd', 'freebsd', 'netbsd', 'openbsd', 'dragonfly', 'darwin']
 supported_oses = ['windows', 'freebsd', 'netbsd', 'openbsd', 'darwin', 'sunos', 'linux', 'emscripten']
 supported_cpus = ['ppc', 'ppc64', 's390x', 'riscv32', 'riscv64', 'x86', 'x86_64',
-  'arm', 'aarch64', 'loongarch64', 'mips', 'mips64', 'sparc64', 'wasm32']
+  'arm', 'aarch64', 'loongarch64', 'mips64', 'sparc64', 'wasm32']
 
 cpu = host_machine.cpu_family()
 

From 0456a977af2157d85871a7645b9b34ca29bd8d8a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 18:25:38 +0100
Subject: [PATCH 2189/2396] migration/rdma: Check ntohll() availability with
 meson
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 44ce1b5d2fc ("migration/rdma: define htonll/ntohll
only if not predefined") tried to only include htonll/ntohll
replacements when their symbol is *defined*, but this doesn't
work, as they aren't:

  ../migration/rdma.c:242:17: error: static declaration of 'htonll' follows non-static declaration
    242 | static uint64_t htonll(uint64_t v)
        |                 ^~~~~~
  In file included from /usr/include/netinet/in.h:73,
                   from /usr/include/sys/socket.h:32,
                   from /home/f4bug/qemu/include/system/os-posix.h:30,
                   from /home/f4bug/qemu/include/qemu/osdep.h:176,
                   from ../migration/rdma.c:17:
  /usr/include/sys/byteorder.h:75:18: note: previous declaration of 'htonll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
     75 | extern  uint64_t htonll(uint64_t);
        |                  ^~~~~~
  ../migration/rdma.c:252:17: error: static declaration of 'ntohll' follows non-static declaration
    252 | static uint64_t ntohll(uint64_t v)
        |                 ^~~~~~
  /usr/include/sys/byteorder.h:76:18: note: previous declaration of 'ntohll' with type 'uint64_t(uint64_t)' {aka 'long unsigned int(long unsigned int)'}
     76 | extern  uint64_t ntohll(uint64_t);
        |                  ^~~~~~

Better to check the symbol availability with meson.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117203834.83713-3-philmd@linaro.org>
---
 meson.build      | 1 +
 migration/rdma.c | 4 +---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/meson.build b/meson.build
index 5ddec8afd7..81f9f7b328 100644
--- a/meson.build
+++ b/meson.build
@@ -2663,6 +2663,7 @@ config_host_data.set('CONFIG_SYNCFS', cc.has_function('syncfs'))
 config_host_data.set('CONFIG_SYNC_FILE_RANGE', cc.has_function('sync_file_range'))
 config_host_data.set('CONFIG_TIMERFD', cc.has_function('timerfd_create'))
 config_host_data.set('CONFIG_GETLOADAVG', cc.has_function('getloadavg'))
+config_host_data.set('CONFIG_ARPA_INET_64', cc.has_function('htonll'))
 config_host_data.set('HAVE_COPY_FILE_RANGE', cc.has_function('copy_file_range'))
 config_host_data.set('HAVE_GETIFADDRS', cc.has_function('getifaddrs'))
 config_host_data.set('HAVE_GLIB_WITH_SLICE_ALLOCATOR', glib_has_gslice)
diff --git a/migration/rdma.c b/migration/rdma.c
index 2d839fce6c..337b415889 100644
--- a/migration/rdma.c
+++ b/migration/rdma.c
@@ -238,7 +238,7 @@ static const char *control_desc(unsigned int rdma_control)
     return strs[rdma_control];
 }
 
-#if !defined(htonll)
+#if !defined(CONFIG_ARPA_INET_64)
 static uint64_t htonll(uint64_t v)
 {
     union { uint32_t lv[2]; uint64_t llv; } u;
@@ -246,9 +246,7 @@ static uint64_t htonll(uint64_t v)
     u.lv[1] = htonl(v & 0xFFFFFFFFULL);
     return u.llv;
 }
-#endif
 
-#if !defined(ntohll)
 static uint64_t ntohll(uint64_t v)
 {
     union { uint32_t lv[2]; uint64_t llv; } u;

From 08ab276a38002baabf05aa7cdb96f395bb8d5c35 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 16:59:35 +0100
Subject: [PATCH 2190/2396] docs: Correct release of MIPS deprecations /
 removals
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We are going to release 10.2, not 11.0 :)

Reported-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-2-philmd@linaro.org>
---
 docs/about/deprecated.rst       | 2 +-
 docs/about/removed-features.rst | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 03e29915f0..30ab72b2a4 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -192,7 +192,7 @@ The ``info capture`` command is deprecated and will be removed in a future relea
 Host Architectures
 ------------------
 
-MIPS (since 11.0)
+MIPS (since 10.2)
 '''''''''''''''''
 
 MIPS is not supported by Debian 13 ("Trixie") and newer, making it hard to
diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index 88ea0dc4ed..a72df26dd2 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -896,7 +896,7 @@ work around the atomicity issues in system mode by running all vCPUs
 in a single thread context; in user mode atomicity was simply broken.
 From 10.0, QEMU has disabled configuration of 64-bit guests on 32-bit hosts.
 
-32-bit MIPS (since 11.0)
+32-bit MIPS (since 10.2)
 ''''''''''''''''''''''''
 
 Debian 12 "Bookworm" removed support for 32-bit MIPS, making it hard to

From 4af2433a81bd057161371413348790969500bd4b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 16:34:34 +0100
Subject: [PATCH 2191/2396] docs: Mention 32-bit PPC host as removed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We removed support for 32-bit PPC hosts in commit 5c1ec5a1ee0
("tcg/ppc: Remove support for 32-bit hosts").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251117171236.80472-3-philmd@linaro.org>
---
 docs/about/removed-features.rst | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/docs/about/removed-features.rst b/docs/about/removed-features.rst
index a72df26dd2..422b9c98d3 100644
--- a/docs/about/removed-features.rst
+++ b/docs/about/removed-features.rst
@@ -902,6 +902,11 @@ From 10.0, QEMU has disabled configuration of 64-bit guests on 32-bit hosts.
 Debian 12 "Bookworm" removed support for 32-bit MIPS, making it hard to
 maintain our cross-compilation CI tests of the architecture.
 
+32-bit PPC (since 10.2)
+'''''''''''''''''''''''
+
+The QEMU project no longer supports 32-bit host builds.
+
 Guest Emulator ISAs
 -------------------
 

From f6816bf9adeac77db3cc7832f0d27a6482acf6e9 Mon Sep 17 00:00:00 2001
From: Djordje Todorovic <Djordje.Todorovic@htecgroup.com>
Date: Tue, 18 Nov 2025 08:58:11 +0000
Subject: [PATCH 2192/2396] scripts/checkpatch: Check DEVICE_NATIVE_ENDIAN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Developers should specify endianess explicitly.

Signed-off-by: Djordje Todorovic <djordje.todorovic@htecgroup.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118085758.3996513-15-djordje.todorovic@htecgroup.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/checkpatch.pl | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index d0f4537f25..3a9557417f 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -3200,6 +3200,10 @@ sub process {
         if ($realfile =~ /.*\/hw\/.*/ && $line =~ /\baio_bh_new\s*\(/) {
 			ERROR("use aio_bh_new_guarded() instead of aio_bh_new() to avoid reentrancy problems\n" . $herecurr);
 		}
+# check for DEVICE_NATIVE_ENDIAN, use explicit endianness instead
+		if ($line =~ /\bDEVICE_NATIVE_ENDIAN\b/) {
+			ERROR("DEVICE_NATIVE_ENDIAN is not allowed, use DEVICE_LITTLE_ENDIAN or DEVICE_BIG_ENDIAN instead\n" . $herecurr);
+		}
 # check for module_init(), use category-specific init macros explicitly please
 		if ($line =~ /^module_init\s*\(/) {
 			ERROR("please use block_init(), type_init() etc. instead of module_init()\n" . $herecurr);

From 29ca82150657624a77df301d2c11114c4420d23a Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 18 Nov 2025 16:47:16 +0100
Subject: [PATCH 2193/2396] ebpf: Fix stubs to set an error when they return
 failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stubs in ebpf_rss-stub.c return false for failure without setting an
Error.  This is wrong.  Callers may assume that the functions set an
error when they fail, and crash when they try to examine or report the
error.  Callers may also check the error instead of the return value,
and misinterpret the failure as success.

ebpf_rss_load() and ebpf_rss_load() are reachable via
virtio_net_load_ebpf().  Fix them to set an error.

ebpf_rss_set_all() is unreachable: it can only be called when the
context has an eBPF program loaded, which is impossible with eBPF
support compiled out.  Call abort() there to make that clear, and to
get rid of the latent bug.

Fixes: 00b69f1d867d (ebpf: add formal error reporting to all APIs)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-2-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ebpf/ebpf_rss-stub.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
index d0e7f99fb9..11729f3d8f 100644
--- a/ebpf/ebpf_rss-stub.c
+++ b/ebpf/ebpf_rss-stub.c
@@ -25,6 +25,7 @@ bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
 
 bool ebpf_rss_load(struct EBPFRSSContext *ctx, Error **errp)
 {
+    error_setg(errp, "eBPF support is not compiled in");
     return false;
 }
 
@@ -32,6 +33,7 @@ bool ebpf_rss_load_fds(struct EBPFRSSContext *ctx, int program_fd,
                        int config_fd, int toeplitz_fd, int table_fd,
                        Error **errp)
 {
+    error_setg(errp, "eBPF support is not compiled in");
     return false;
 }
 
@@ -39,7 +41,7 @@ bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
                       uint16_t *indirections_table, uint8_t *toeplitz_key,
                       Error **errp)
 {
-    return false;
+    abort();
 }
 
 void ebpf_rss_unload(struct EBPFRSSContext *ctx)

From 6cb4cd503b7c8d543a234b59271522a524b2f6b0 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 18 Nov 2025 16:47:17 +0100
Subject: [PATCH 2194/2396] ebpf: Clean up useless error check in
 ebpf_rss_set_all()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ebpf_rss_set_all() is only called when the context has an eBPF program
loaded.  Replace the dead error check with an assertion.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-3-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ebpf/ebpf_rss.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
index e793786c17..b64e9da3e3 100644
--- a/ebpf/ebpf_rss.c
+++ b/ebpf/ebpf_rss.c
@@ -247,10 +247,8 @@ bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
                       uint16_t *indirections_table, uint8_t *toeplitz_key,
                       Error **errp)
 {
-    if (!ebpf_rss_is_loaded(ctx)) {
-        error_setg(errp, "eBPF program is not loaded");
-        return false;
-    }
+    g_assert(ebpf_rss_is_loaded(ctx));
+
     if (config == NULL) {
         error_setg(errp, "eBPF config table is NULL");
         return false;

From de285aa9076841c618d068f7b838e312fc8b26c6 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 18 Nov 2025 16:47:18 +0100
Subject: [PATCH 2195/2396] ebpf: Make ebpf_rss_load() return value consistent
 with @errp
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ebpf_rss_load() returns false for failure without setting an Error
when its @ctx argument already has an eBPF program loaded.  This is
wrong.  Fortunately, it is only called @ctx has a program.  Replace
the incorrect error check by an assertion.

The return value is now obviously reliable.  Change the caller to use
it, because it's more concise.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251118154718.3969982-4-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 ebpf/ebpf_rss.c     | 4 +---
 hw/net/virtio-net.c | 4 +---
 2 files changed, 2 insertions(+), 6 deletions(-)

diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
index b64e9da3e3..926392b3c5 100644
--- a/ebpf/ebpf_rss.c
+++ b/ebpf/ebpf_rss.c
@@ -106,9 +106,7 @@ bool ebpf_rss_load(struct EBPFRSSContext *ctx, Error **errp)
 {
     struct rss_bpf *rss_bpf_ctx;
 
-    if (ebpf_rss_is_loaded(ctx)) {
-        return false;
-    }
+    g_assert(!ebpf_rss_is_loaded(ctx));
 
     rss_bpf_ctx = rss_bpf__open();
     if (rss_bpf_ctx == NULL) {
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index 3b85560f6f..f5d93eb400 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -1363,9 +1363,7 @@ static bool virtio_net_load_ebpf(VirtIONet *n, Error **errp)
         return virtio_net_load_ebpf_fds(n, errp);
     }
 
-    ebpf_rss_load(&n->ebpf_rss, &err);
-    /* Beware, ebpf_rss_load() can return false with @err unset */
-    if (err) {
+    if (!ebpf_rss_load(&n->ebpf_rss, &err)) {
         warn_report_err(err);
     }
     return true;

From 50797af6e8ed8b7d3921413d6879cac772ded956 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 17 Nov 2025 16:48:09 +0100
Subject: [PATCH 2196/2396] mtest2make: cleanup mtest-suites variables
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Remove the "--suite" argument from the .*.mtest-suites variables, and
add it only when actually computing the arguments to "meson test".
This makes it possible to set ninja-cmd-goals from the set of suites,
instead of doing it via many different .ninja-goals.* variables.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 Makefile              |  4 +++-
 scripts/mtest2make.py | 40 +++++++++++++++++++---------------------
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/Makefile b/Makefile
index 74c2da2037..9fb55dcf33 100644
--- a/Makefile
+++ b/Makefile
@@ -96,6 +96,8 @@ meson.stamp: config-host.mak
 
 # 3. ensure meson-generated build files are up-to-date
 
+ninja-cmd-goals =
+
 ifneq ($(NINJA),)
 Makefile.ninja: build.ninja
 	$(quiet-@){ \
@@ -150,7 +152,7 @@ NINJAFLAGS = \
           $(or $(filter -l% -j%, $(MAKEFLAGS)), \
                $(if $(filter --jobserver-auth=%, $(MAKEFLAGS)),, -j1))) \
         -d keepdepfile
-ninja-cmd-goals = $(or $(MAKECMDGOALS), all)
+ninja-cmd-goals += $(or $(MAKECMDGOALS), all)
 ninja-cmd-goals += $(foreach g, $(MAKECMDGOALS), $(.ninja-goals.$g))
 
 makefile-targets := build.ninja ctags TAGS cscope dist clean
diff --git a/scripts/mtest2make.py b/scripts/mtest2make.py
index 2ef375fc6f..d7c514243a 100644
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@@ -8,24 +8,23 @@ from collections import defaultdict
 import itertools
 import json
 import os
-import shlex
 import sys
 
 class Suite(object):
     def __init__(self):
         self.deps = set()
-        self.speeds = ['quick']
+        self.speeds = []
 
     def names(self, base):
-        return [base if speed == 'quick' else f'{base}-{speed}' for speed in self.speeds]
+        return [f'{base}-{speed}' for speed in self.speeds]
 
 
-print('''
+print(r'''
 SPEED = quick
 
-.speed.quick = $(foreach s,$(sort $(filter-out %-slow %-thorough, $1)), --suite $s)
-.speed.slow = $(foreach s,$(sort $(filter-out %-thorough, $1)), --suite $s)
-.speed.thorough = $(foreach s,$(sort $1), --suite $s)
+.speed.quick = $(sort $(filter-out %-slow %-thorough, $1))
+.speed.slow = $(sort $(filter-out %-thorough, $1))
+.speed.thorough = $(sort $1)
 
 TIMEOUT_MULTIPLIER ?= 1
 .mtestargs = --no-rebuild -t $(TIMEOUT_MULTIPLIER)
@@ -34,8 +33,10 @@ ifneq ($(SPEED), quick)
 endif
 .mtestargs += $(subst -j,--num-processes , $(filter-out -j, $(lastword -j1 $(filter -j%, $(MAKEFLAGS)))))
 
-.check.mtestargs = $(MTESTARGS) $(.mtestargs) $(if $(V),--verbose,--print-errorlogs)
-.bench.mtestargs = $(MTESTARGS) $(.mtestargs) --benchmark --verbose''')
+.check.mtestargs = $(MTESTARGS) $(.mtestargs) $(if $(V),--verbose,--print-errorlogs) \
+    $(foreach s, $(sort $(.check.mtest-suites)), --suite $s)
+.bench.mtestargs = $(MTESTARGS) $(.mtestargs) --benchmark --verbose \
+    $(foreach s, $(sort $(.bench.mtest-suites)), --suite $s)''')
 
 introspect = json.load(sys.stdin)
 
@@ -72,29 +73,26 @@ def emit_prolog(suites, prefix):
     print(f'all-{prefix}-targets = {all_targets}')
     print(f'all-{prefix}-xml = {all_xml}')
     print(f'.PHONY: {prefix} do-meson-{prefix} {prefix}-report.junit.xml $(all-{prefix}-targets) $(all-{prefix}-xml)')
-    print(f'ifeq ($(filter {prefix}, $(MAKECMDGOALS)),)')
-    print(f'.{prefix}.mtestargs += $(call .speed.$(SPEED), $(.{prefix}.mtest-suites))')
-    print(f'endif')
+    print(f'ninja-cmd-goals += $(foreach s, $(.{prefix}.mtest-suites), $(.{prefix}-$s.deps))')
     print(f'{prefix}-build: run-ninja')
     print(f'{prefix} $(all-{prefix}-targets): do-meson-{prefix}')
     print(f'do-meson-{prefix}: run-ninja; $(if $(MAKE.n),,+)$(MESON) test $(.{prefix}.mtestargs)')
     print(f'{prefix}-report.junit.xml $(all-{prefix}-xml): {prefix}-report%.junit.xml: run-ninja')
     print(f'\t$(MAKE) {prefix}$* MTESTARGS="$(MTESTARGS) --logbase {prefix}-report$*" && ln -f meson-logs/$@ .')
 
-def emit_suite_deps(name, suite, prefix):
+def emit_suite(name, suite, prefix):
     deps = ' '.join(suite.deps)
-    targets = [f'{prefix}-{name}', f'{prefix}-report-{name}.junit.xml', f'{prefix}', f'{prefix}-report.junit.xml',
-               f'{prefix}-build']
     print()
     print(f'.{prefix}-{name}.deps = {deps}')
-    for t in targets:
-        print(f'.ninja-goals.{t} += $(.{prefix}-{name}.deps)')
+    print(f'.ninja-goals.check-build += $(.{prefix}-{name}.deps)')
 
-def emit_suite(name, suite, prefix):
-    emit_suite_deps(name, suite, prefix)
-    targets = f'{prefix}-{name} {prefix}-report-{name}.junit.xml {prefix} {prefix}-report.junit.xml'
+    names = ' '.join(suite.names(name))
+    targets = f'{prefix}-{name} {prefix}-report-{name}.junit.xml'
+    if not name.endswith('-slow') and not name.endswith('-thorough'):
+        targets += f' {prefix} {prefix}-report.junit.xml'
     print(f'ifneq ($(filter {targets}, $(MAKECMDGOALS)),)')
-    print(f'.{prefix}.mtest-suites += ' + ' '.join(suite.names(name)))
+    # for the "base" suite possibly add FOO-slow and FOO-thorough
+    print(f".{prefix}.mtest-suites += {name} $(call .speed.$(SPEED), {names})")
     print(f'endif')
 
 targets = {t['id']: [os.path.relpath(f) for f in t['filename']]

From b1085f87ef868e1153591c6e596b0e2b03b0e066 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 17 Nov 2025 16:51:17 +0100
Subject: [PATCH 2197/2396] mtest2make: add dependencies to the
 "speed-qualified" suite
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thorough tests may have more dependencies than faster ones.
Dependencies are now looked up based on the suites being
executed, not on the suites passed as goals to the makefile.
Therefore, it is possible to limit dependencies to the
speeds that need them.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/mtest2make.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/mtest2make.py b/scripts/mtest2make.py
index d7c514243a..38512046d9 100644
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@@ -58,13 +58,13 @@ def process_tests(test, targets, suites):
             s = s.split(':')[1]
             if s == 'slow' or s == 'thorough':
                 continue
+        suites[s].deps.update(deps)
         if s.endswith('-slow'):
             s = s[:-5]
             suites[s].speeds.append('slow')
         if s.endswith('-thorough'):
             s = s[:-9]
             suites[s].speeds.append('thorough')
-        suites[s].deps.update(deps)
 
 def emit_prolog(suites, prefix):
     all_targets = ' '.join((f'{prefix}-{k}' for k in suites.keys()))

From 5f9d28a2f8d3d42bf17643e62064100d977f9f7b Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Nov 2025 00:26:28 +0100
Subject: [PATCH 2198/2396] mtest2make: do not repeat the same speed over and
 over
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are just two of them (slow and thorough; quick is simply the
default).  Avoid repeating them for as many times as there are tests.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 scripts/mtest2make.py | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/scripts/mtest2make.py b/scripts/mtest2make.py
index 38512046d9..4b252defc3 100644
--- a/scripts/mtest2make.py
+++ b/scripts/mtest2make.py
@@ -13,7 +13,7 @@ import sys
 class Suite(object):
     def __init__(self):
         self.deps = set()
-        self.speeds = []
+        self.speeds = set()
 
     def names(self, base):
         return [f'{base}-{speed}' for speed in self.speeds]
@@ -61,10 +61,10 @@ def process_tests(test, targets, suites):
         suites[s].deps.update(deps)
         if s.endswith('-slow'):
             s = s[:-5]
-            suites[s].speeds.append('slow')
+            suites[s].speeds.add('slow')
         if s.endswith('-thorough'):
             s = s[:-9]
-            suites[s].speeds.append('thorough')
+            suites[s].speeds.add('thorough')
 
 def emit_prolog(suites, prefix):
     all_targets = ' '.join((f'{prefix}-{k}' for k in suites.keys()))

From 58f88d0bf7c4c0676b54f97ba91eecccbca968c9 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 18 Nov 2025 14:53:32 +0100
Subject: [PATCH 2199/2396] replay: add tracing events

The replay subsystem does not provide any way to see what's going on
and how the replay events interleave with other things happening in QEMU.

Add trace events to improve debuggability; to avoid having too many
events reimplement all functions in terms of (non-traced) replay_getc
and replay_putc and add a single trace event for each datum that is
extracted or written.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
---
 meson.build              |  1 +
 replay/replay-internal.c | 70 ++++++++++++++++++++++++++++++----------
 replay/trace-events      | 12 +++++++
 replay/trace.h           |  1 +
 4 files changed, 67 insertions(+), 17 deletions(-)
 create mode 100644 replay/trace-events
 create mode 100644 replay/trace.h

diff --git a/meson.build b/meson.build
index df4460035c..95fcec9ba1 100644
--- a/meson.build
+++ b/meson.build
@@ -3678,6 +3678,7 @@ if have_system
     'hw/gpio',
     'migration',
     'net',
+    'replay',
     'system',
     'ui',
     'hw/remote',
diff --git a/replay/replay-internal.c b/replay/replay-internal.c
index c2a7200339..4839f2b632 100644
--- a/replay/replay-internal.c
+++ b/replay/replay-internal.c
@@ -15,6 +15,7 @@
 #include "replay-internal.h"
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
+#include "trace.h"
 
 /* Mutex to protect reading and writing events to the log.
    data_kind and has_unread_data are also protected
@@ -44,7 +45,7 @@ static void replay_read_error(void)
     exit(1);
 }
 
-void replay_put_byte(uint8_t byte)
+static void replay_putc(uint8_t byte)
 {
     if (replay_file) {
         if (putc(byte, replay_file) == EOF) {
@@ -53,29 +54,45 @@ void replay_put_byte(uint8_t byte)
     }
 }
 
+void replay_put_byte(uint8_t byte)
+{
+    trace_replay_put_byte(byte);
+    replay_putc(byte);
+}
+
 void replay_put_event(uint8_t event)
 {
+    trace_replay_put_event(event);
     assert(event < EVENT_COUNT);
-    replay_put_byte(event);
+    replay_putc(event);
 }
 
 
 void replay_put_word(uint16_t word)
 {
-    replay_put_byte(word >> 8);
-    replay_put_byte(word);
+    trace_replay_put_word(word);
+    replay_putc(word >> 8);
+    replay_putc(word);
 }
 
 void replay_put_dword(uint32_t dword)
 {
-    replay_put_word(dword >> 16);
-    replay_put_word(dword);
+    int i;
+
+    trace_replay_put_dword(dword);
+    for (i = 24; i >= 0; i -= 8) {
+        replay_putc(dword >> i);
+    }
 }
 
 void replay_put_qword(int64_t qword)
 {
-    replay_put_dword(qword >> 32);
-    replay_put_dword(qword);
+    int i;
+
+    trace_replay_put_qword(qword);
+    for (i = 56; i >= 0; i -= 8) {
+        replay_putc(qword >> i);
+    }
 }
 
 void replay_put_array(const uint8_t *buf, size_t size)
@@ -88,7 +105,7 @@ void replay_put_array(const uint8_t *buf, size_t size)
     }
 }
 
-uint8_t replay_get_byte(void)
+static uint8_t replay_getc(void)
 {
     uint8_t byte = 0;
     if (replay_file) {
@@ -101,36 +118,52 @@ uint8_t replay_get_byte(void)
     return byte;
 }
 
+uint8_t replay_get_byte(void)
+{
+    uint8_t byte = replay_getc();
+    trace_replay_get_byte(byte);
+    return byte;
+}
+
 uint16_t replay_get_word(void)
 {
     uint16_t word = 0;
     if (replay_file) {
-        word = replay_get_byte();
-        word = (word << 8) + replay_get_byte();
+        word = replay_getc();
+        word = (word << 8) + replay_getc();
     }
 
+    trace_replay_get_word(word);
     return word;
 }
 
 uint32_t replay_get_dword(void)
 {
     uint32_t dword = 0;
+    int i;
+
     if (replay_file) {
-        dword = replay_get_word();
-        dword = (dword << 16) + replay_get_word();
+        for (i = 24; i >= 0; i -= 8) {
+            dword |= replay_getc() << i;
+        }
     }
 
+    trace_replay_get_dword(dword);
     return dword;
 }
 
 int64_t replay_get_qword(void)
 {
-    int64_t qword = 0;
+    uint64_t qword = 0;
+    int i;
+
     if (replay_file) {
-        qword = replay_get_dword();
-        qword = (qword << 32) + replay_get_dword();
+        for (i = 56; i >= 0; i -= 8) {
+            qword |= (uint64_t)replay_getc() << i;
+        }
     }
 
+    trace_replay_get_qword(qword);
     return qword;
 }
 
@@ -172,10 +205,12 @@ void replay_check_error(void)
 
 void replay_fetch_data_kind(void)
 {
+    trace_replay_fetch_data_kind();
     if (replay_file) {
         if (!replay_state.has_unread_data) {
-            replay_state.data_kind = replay_get_byte();
+            replay_state.data_kind = replay_getc();
             replay_state.current_event++;
+            trace_replay_get_event(replay_state.current_event, replay_state.data_kind);
             if (replay_state.data_kind == EVENT_INSTRUCTION) {
                 replay_state.instruction_count = replay_get_dword();
             }
@@ -246,6 +281,7 @@ void replay_advance_current_icount(uint64_t current_icount)
     int diff = (int)(current_icount - replay_state.current_icount);
 
     /* Time can only go forward */
+    trace_replay_advance_current_icount(replay_state.current_icount, diff);
     assert(diff >= 0);
 
     if (replay_mode == REPLAY_MODE_RECORD) {
diff --git a/replay/trace-events b/replay/trace-events
new file mode 100644
index 0000000000..e9c887a6c5
--- /dev/null
+++ b/replay/trace-events
@@ -0,0 +1,12 @@
+replay_put_byte(uint8_t event) "%02x"
+replay_put_event(uint8_t event) "%02x"
+replay_put_word(uint16_t event) "%04x"
+replay_put_dword(uint32_t event) "%08x"
+replay_put_qword(uint64_t event) "%016" PRIx64
+replay_get_byte(uint8_t byte) "%02x"
+replay_get_word(uint16_t word) "%04x"
+replay_get_dword(uint32_t dword) "%08x"
+replay_get_qword(uint64_t qword) "%016" PRIx64
+replay_fetch_data_kind(void) ""
+replay_get_event(uint32_t current, uint8_t data) "#%u data=%02x"
+replay_advance_current_icount(uint64_t current_icount, int diff) "current=%" PRIu64 " diff=%d"
diff --git a/replay/trace.h b/replay/trace.h
new file mode 100644
index 0000000000..39ff481742
--- /dev/null
+++ b/replay/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-replay.h"

From 9ccd0c8a88af80f467633ca99ad7adcf513f976e Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 18 Nov 2025 15:06:55 -0500
Subject: [PATCH 2200/2396] python/mkvenv: ensure HAVE_LIB variables are
 actually constants

Pylint 4.x has refined checking for variable names that behave as
constants vs ones that do not; unfortunately our tricky import machinery
is perceived as these variables being re-assigned.

Add a temporary variable with an underscore and assign to the global
constants precisely once to alleviate this new nag message. Add an
ignore for this name for older versions of pylint that developers may
have installed locally.

(In other words: there is no solution that will cater to both pre- and
post- 4.x versions, so we target 4.x here and silence older versions.)

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-2-jsnow@redhat.com>
---
 python/scripts/mkvenv.py | 24 ++++++++++++++++--------
 python/setup.cfg         |  1 +
 2 files changed, 17 insertions(+), 8 deletions(-)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index 9aed266df1..a064709e6c 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -92,7 +92,7 @@ import venv
 # Try to load distlib, with a fallback to pip's vendored version.
 # HAVE_DISTLIB is checked below, just-in-time, so that mkvenv does not fail
 # outside the venv or before a potential call to ensurepip in checkpip().
-HAVE_DISTLIB = True
+_import_ok = True
 try:
     import distlib.scripts
 except ImportError:
@@ -102,11 +102,13 @@ except ImportError:
         from pip._vendor import distlib
         import pip._vendor.distlib.scripts  # noqa, pylint: disable=unused-import
     except ImportError:
-        HAVE_DISTLIB = False
+        _import_ok = False
+
+HAVE_DISTLIB = _import_ok
 
 # pip 25.2 does not vendor distlib.version, but it uses vendored
 # packaging.version
-HAVE_DISTLIB_VERSION = True
+_import_ok = True
 try:
     import distlib.version  # pylint: disable=ungrouped-imports
 except ImportError:
@@ -114,9 +116,11 @@ except ImportError:
         # pylint: disable=unused-import,ungrouped-imports
         import pip._vendor.distlib.version  # noqa
     except ImportError:
-        HAVE_DISTLIB_VERSION = False
+        _import_ok = False
 
-HAVE_PACKAGING_VERSION = True
+HAVE_DISTLIB_VERSION = _import_ok
+
+_import_ok = True
 try:
     # Do not bother importing non-vendored packaging, because it is not
     # in stdlib.
@@ -125,20 +129,24 @@ try:
     import pip._vendor.packaging.requirements  # noqa
     import pip._vendor.packaging.version  # noqa
 except ImportError:
-    HAVE_PACKAGING_VERSION = False
+    _import_ok = False
+
+HAVE_PACKAGING_VERSION = _import_ok
 
 
 # Try to load tomllib, with a fallback to tomli.
 # HAVE_TOMLLIB is checked below, just-in-time, so that mkvenv does not fail
 # outside the venv or before a potential call to ensurepip in checkpip().
-HAVE_TOMLLIB = True
+_import_ok = True
 try:
     import tomllib
 except ImportError:
     try:
         import tomli as tomllib
     except ImportError:
-        HAVE_TOMLLIB = False
+        _import_ok = False
+
+HAVE_TOMLLIB = _import_ok
 
 # Do not add any mandatory dependencies from outside the stdlib:
 # This script *must* be usable standalone!
diff --git a/python/setup.cfg b/python/setup.cfg
index d7f5dc7baf..f40f11396c 100644
--- a/python/setup.cfg
+++ b/python/setup.cfg
@@ -159,6 +159,7 @@ good-names=i,
            c,   # for c in string: ...
            T,   # for TypeVars. See pylint#3401
            SocketAddrT,  # Not sure why this is invalid.
+           _import_ok,  # For mkvenv import trickery and compatibility pre-4.x
 
 [pylint.similarities]
 # Ignore imports when computing similarities.

From cc74a4d86e8fd848e87dc67902498cd0cd36a4aa Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 18 Nov 2025 15:06:56 -0500
Subject: [PATCH 2201/2396] python/qapi: add an ignore for Pylint 4.x

Pylint 4.x wants to use a different regex for _Stub for some reason;
just silence this.

Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-3-jsnow@redhat.com>
---
 scripts/qapi/introspect.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/qapi/introspect.py b/scripts/qapi/introspect.py
index 89ee5d5f17..7e28de2279 100644
--- a/scripts/qapi/introspect.py
+++ b/scripts/qapi/introspect.py
@@ -59,7 +59,7 @@ from .source import QAPISourceInfo
 #
 # Sadly, mypy does not support recursive types; so the _Stub alias is used to
 # mark the imprecision in the type model where we'd otherwise use JSONValue.
-_Stub = Any
+_Stub = Any  # pylint: disable=invalid-name
 _Scalar = Union[str, bool, None]
 _NonScalar = Union[Dict[str, _Stub], List[_Stub]]
 _Value = Union[_Scalar, _NonScalar]

From 12b4267d609afd6a56505a1982de06cdc5fd6db3 Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Tue, 18 Nov 2025 15:06:57 -0500
Subject: [PATCH 2202/2396] python/qapi: delint import statements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Missed a spot with isort, which now causes the python-minreqs test on
GitLab to fail. Fix it.

(Hint: the commands in python/tests/qapi-isort.sh can be run without the
"-c" parameter to automatically adjust import statements according to
our style rules. Maybe I should make a pre-submit hook that makes this
adjustment automatically. What do you think?)

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3200
Fixes: 5bd89761a4b ("qapi/command: Avoid generating unused  qmp_marshal_output_T")
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251118200657.1043688-4-jsnow@redhat.com>
---
 scripts/qapi/commands.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/scripts/qapi/commands.py b/scripts/qapi/commands.py
index a82b5a2a5e..9dede74720 100644
--- a/scripts/qapi/commands.py
+++ b/scripts/qapi/commands.py
@@ -13,10 +13,7 @@ This work is licensed under the terms of the GNU GPL, version 2.
 See the COPYING file in the top-level directory.
 """
 
-from typing import (
-    List,
-    Optional,
-)
+from typing import List, Optional
 
 from .common import c_name, mcgen
 from .gen import (

From e5eb98b3cae77ffe7d142229a8225cedd8b78f07 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 19 Nov 2025 12:48:47 +0100
Subject: [PATCH 2203/2396] Update version for v10.2.0-rc1 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 9856be5dd9..5b71bdb7d5 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.50
+10.1.91

From e5cb62e7b6f99d45a42f0cd358d76d6ee2cef5cd Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Tue, 18 Nov 2025 18:40:47 +0100
Subject: [PATCH 2204/2396] hw/s390x: Fix a possible crash with passed-through
 virtio devices

Consider the following nested setup: An L1 host uses some virtio device
(e.g. virtio-keyboard) for the L2 guest, and this L2 guest passes this
device through to the L3 guest. Since the L3 guest sees a virtio device,
it might send virtio notifications to the QEMU in L2 for that device.
But since the QEMU in L2 defined this device as vfio-ccw, the function
handle_virtio_ccw_notify() cannot handle this and crashes: It calls
virtio_ccw_get_vdev() that casts sch->driver_data into a VirtioCcwDevice,
but since "sch" belongs to a vfio-ccw device, that driver_data rather
points to a CcwDevice instead. So as soon as QEMU tries to use some
VirtioCcwDevice specific data from that device, we've lost.

We must not take virtio notifications for such devices. Thus fix the
issue by adding a check to the handle_virtio_ccw_notify() handler to
refuse all devices that are not our own virtio devices. Like in the
other branches that detect wrong settings, we return -EINVAL from the
function, which will later be placed in GPR2 to inform the guest about
the error.

Reviewed-by: Halil Pasic <pasic@linux.ibm.com>
Reviewed-by: Eric Farman <farman@linux.ibm.com>
Tested-by: Eric Farman <farman@linux.ibm.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251118174047.73103-1-thuth@redhat.com>
---
 hw/s390x/s390-hypercall.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/s390x/s390-hypercall.c b/hw/s390x/s390-hypercall.c
index ac1b08b2cd..508dd97ca0 100644
--- a/hw/s390x/s390-hypercall.c
+++ b/hw/s390x/s390-hypercall.c
@@ -10,6 +10,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/error-report.h"
 #include "cpu.h"
 #include "hw/s390x/s390-virtio-ccw.h"
 #include "hw/s390x/s390-hypercall.h"
@@ -42,6 +43,19 @@ static int handle_virtio_ccw_notify(uint64_t subch_id, uint64_t data)
     if (!sch || !css_subch_visible(sch)) {
         return -EINVAL;
     }
+    if (sch->id.cu_type != VIRTIO_CCW_CU_TYPE) {
+        /*
+         * This might happen in nested setups: If the L1 host defined the
+         * L2 guest with a virtio device (e.g. virtio-keyboard), and the
+         * L2 guest passes this device through to the L3 guest, the L3 guest
+         * might send virtio notifications to the QEMU in L2 for that device.
+         * But since the QEMU in L2 defined this device as vfio-ccw, it's not
+         * a VirtIODevice that we can handle here!
+         */
+        warn_report_once("Got virtio notification for unsupported device "
+                         "on subchannel %02x.%1x.%04x!", cssid, ssid, schid);
+        return -EINVAL;
+    }
 
     vdev = virtio_ccw_get_vdev(sch);
     if (vq_idx >= VIRTIO_QUEUE_MAX || !virtio_queue_get_num(vdev, vq_idx)) {

From 248b7eae44c60c1af7eeb96e2ff58243933d6b19 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:24 +0100
Subject: [PATCH 2205/2396] tests/functional/arm/test_aspeed_ast2600_buildroot:
 Fix pylint warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pylint recommends to use a "with" context for tempfile.TemporaryDirectory()
to make sure that the directory is deleted once it is not needed anymore,
and it recommends to use the "check" parameter for subprocess.run().
For style reasons, the imports at the beginning of the file should be
grouped by module.

Message-Id: <20251113100601.476900-1-thuth@redhat.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-4-thuth@redhat.com>
---
 .../arm/test_aspeed_ast2600_buildroot.py      | 21 +++++++++++--------
 1 file changed, 12 insertions(+), 9 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_ast2600_buildroot.py b/tests/functional/arm/test_aspeed_ast2600_buildroot.py
index 51f2676c90..575a5f6414 100755
--- a/tests/functional/arm/test_aspeed_ast2600_buildroot.py
+++ b/tests/functional/arm/test_aspeed_ast2600_buildroot.py
@@ -9,8 +9,8 @@ import time
 import tempfile
 import subprocess
 
-from qemu_test import Asset
 from aspeed import AspeedTest
+from qemu_test import Asset
 from qemu_test import exec_command_and_wait_for_pattern, skipIfMissingCommands
 
 
@@ -66,21 +66,18 @@ class AST2600Machine(AspeedTest):
          'images/ast2600-evb/buildroot-2023.02-tpm/flash.img'),
         'a46009ae8a5403a0826d607215e731a8c68d27c14c41e55331706b8f9c7bd997')
 
-    @skipIfMissingCommands('swtpm')
-    def test_arm_ast2600_evb_buildroot_tpm(self):
-        self.set_machine('ast2600-evb')
-
+    def _test_arm_ast2600_evb_buildroot_tpm(self, tpmstate_dir):
         image_path = self.ASSET_BR2_202302_AST2600_TPM_FLASH.fetch()
 
-        tpmstate_dir = tempfile.TemporaryDirectory(prefix="qemu_")
-        socket = os.path.join(tpmstate_dir.name, 'swtpm-socket')
+        socket = os.path.join(tpmstate_dir, 'swtpm-socket')
 
         # We must put the TPM state dir in /tmp/, not the build dir,
         # because some distros use AppArmor to lock down swtpm and
         # restrict the set of locations it can access files in.
         subprocess.run(['swtpm', 'socket', '-d', '--tpm2',
-                        '--tpmstate', f'dir={tpmstate_dir.name}',
-                        '--ctrl', f'type=unixio,path={socket}'])
+                        '--tpmstate', f'dir={tpmstate_dir}',
+                        '--ctrl', f'type=unixio,path={socket}'],
+                       check=True)
 
         self.vm.add_args('-chardev', f'socket,id=chrtpm,path={socket}')
         self.vm.add_args('-tpmdev', 'emulator,id=tpm0,chardev=chrtpm')
@@ -97,6 +94,12 @@ class AST2600Machine(AspeedTest):
 
         self.do_test_arm_aspeed_buildroot_poweroff()
 
+    @skipIfMissingCommands('swtpm')
+    def test_arm_ast2600_evb_buildroot_tpm(self):
+        self.set_machine('ast2600-evb')
+        with tempfile.TemporaryDirectory(prefix="qemu_") as tpmstate_dir:
+            self._test_arm_ast2600_evb_buildroot_tpm(tpmstate_dir)
+
 
 if __name__ == '__main__':
     AspeedTest.main()

From c0e84b9223ad73458bd5616326bb6a7796e31f2c Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:25 +0100
Subject: [PATCH 2206/2396] tests/functional/x86_64/test_virtio_gpu: Fix
 various issues reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the recommended order for import statements, specify the kind of
exceptions that we try to catch, use f-strings where it makes sense,
rewrite the vug_log_file part with a proper "with" statement and
fix some FIXMEs by checking for the availability of the devices, etc.

Message-Id: <20251113114015.490303-1-thuth@redhat.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-5-thuth@redhat.com>
---
 tests/functional/x86_64/test_virtio_gpu.py | 54 +++++++++++-----------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/tests/functional/x86_64/test_virtio_gpu.py b/tests/functional/x86_64/test_virtio_gpu.py
index be96de24da..58b0f72ba4 100755
--- a/tests/functional/x86_64/test_virtio_gpu.py
+++ b/tests/functional/x86_64/test_virtio_gpu.py
@@ -5,22 +5,23 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
+import os
+import socket
+import subprocess
 
 from qemu_test import QemuSystemTest, Asset
 from qemu_test import wait_for_console_pattern
 from qemu_test import exec_command_and_wait_for_pattern
 from qemu_test import is_readable_executable_file
 
-
-import os
-import socket
-import subprocess
+from qemu.machine.machine import VMLaunchFailure
 
 
 def pick_default_vug_bin(test):
     bld_dir_path = test.build_file("contrib", "vhost-user-gpu", "vhost-user-gpu")
     if is_readable_executable_file(bld_dir_path):
         return bld_dir_path
+    return None
 
 
 class VirtioGPUx86(QemuSystemTest):
@@ -46,8 +47,8 @@ class VirtioGPUx86(QemuSystemTest):
         )
 
     def test_virtio_vga_virgl(self):
-        # FIXME: should check presence of virtio, virgl etc
         self.require_accelerator('kvm')
+        self.require_device('virtio-vga-gl')
 
         kernel_path = self.ASSET_KERNEL.fetch()
         initrd_path = self.ASSET_INITRD.fetch()
@@ -68,7 +69,7 @@ class VirtioGPUx86(QemuSystemTest):
         )
         try:
             self.vm.launch()
-        except:
+        except VMLaunchFailure:
             # TODO: probably fails because we are missing the VirGL features
             self.skipTest("VirGL not enabled?")
 
@@ -78,8 +79,8 @@ class VirtioGPUx86(QemuSystemTest):
         )
 
     def test_vhost_user_vga_virgl(self):
-        # FIXME: should check presence of vhost-user-gpu, virgl, memfd etc
         self.require_accelerator('kvm')
+        self.require_device('vhost-user-vga')
 
         vug = pick_default_vug_bin(self)
         if not vug:
@@ -95,27 +96,29 @@ class VirtioGPUx86(QemuSystemTest):
         os.set_inheritable(qemu_sock.fileno(), True)
         os.set_inheritable(vug_sock.fileno(), True)
 
-        self._vug_log_path = self.log_file("vhost-user-gpu.log")
-        self._vug_log_file = open(self._vug_log_path, "wb")
-        self.log.info('Complete vhost-user-gpu.log file can be '
-                      'found at %s', self._vug_log_path)
-
-        vugp = subprocess.Popen(
-            [vug, "--virgl", "--fd=%d" % vug_sock.fileno()],
-            stdin=subprocess.DEVNULL,
-            stdout=self._vug_log_file,
-            stderr=subprocess.STDOUT,
-            shell=False,
-            close_fds=False,
-        )
-        self._vug_log_file.close()
+        vug_log_path = self.log_file("vhost-user-gpu.log")
+        self.log.info('Complete vhost-user-gpu.log file can be found at %s',
+                      vug_log_path)
+        with open(vug_log_path, "wb") as vug_log_file:
+            with subprocess.Popen([vug, "--virgl", f"--fd={vug_sock.fileno()}"],
+                                  stdin=subprocess.DEVNULL,
+                                  stdout=vug_log_file,
+                                  stderr=subprocess.STDOUT,
+                                  shell=False,
+                                  close_fds=False) as vugp:
+                self._test_vhost_user_vga_virgl(qemu_sock,
+                                                kernel_path, initrd_path)
+                qemu_sock.close()
+                vug_sock.close()
+                vugp.terminate()
 
+    def _test_vhost_user_vga_virgl(self, qemu_sock, kernel_path, initrd_path):
         self.vm.set_console()
         self.vm.add_args("-cpu", "host")
         self.vm.add_args("-m", "2G")
         self.vm.add_args("-object", "memory-backend-memfd,id=mem,size=2G")
         self.vm.add_args("-machine", "pc,memory-backend=mem,accel=kvm")
-        self.vm.add_args("-chardev", "socket,id=vug,fd=%d" % qemu_sock.fileno())
+        self.vm.add_args("-chardev", f"socket,id=vug,fd={qemu_sock.fileno()}")
         self.vm.add_args("-device", "vhost-user-vga,chardev=vug")
         self.vm.add_args("-display", "egl-headless")
         self.vm.add_args(
@@ -128,17 +131,14 @@ class VirtioGPUx86(QemuSystemTest):
         )
         try:
             self.vm.launch()
-        except:
+        except VMLaunchFailure:
             # TODO: probably fails because we are missing the VirGL features
             self.skipTest("VirGL not enabled?")
         self.wait_for_console_pattern("as init process")
         exec_command_and_wait_for_pattern(self, "/usr/sbin/modprobe virtio_gpu",
                                           "features: +virgl +edid")
         self.vm.shutdown()
-        qemu_sock.close()
-        vug_sock.close()
-        vugp.terminate()
-        vugp.wait()
+
 
 if __name__ == '__main__':
     QemuSystemTest.main()

From e24882e8483d20d214c452a68c3bf35064791982 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:28 +0100
Subject: [PATCH 2207/2396] tests/functional/x86_64/test_reverse_debug: Silence
 pylint warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pylint does not like the underscores in the class name here, so
rename the class accordingly to make pylint happy here.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-8-thuth@redhat.com>
---
 tests/functional/x86_64/test_reverse_debug.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/x86_64/test_reverse_debug.py b/tests/functional/x86_64/test_reverse_debug.py
index 2b31ae8724..ab5dac9838 100755
--- a/tests/functional/x86_64/test_reverse_debug.py
+++ b/tests/functional/x86_64/test_reverse_debug.py
@@ -18,7 +18,7 @@ from qemu_test import skipFlakyTest
 from reverse_debugging import ReverseDebugging
 
 
-class ReverseDebugging_X86_64(ReverseDebugging):
+class ReverseDebuggingX86(ReverseDebugging):
 
     @skipFlakyTest("https://gitlab.com/qemu-project/qemu/-/issues/2922")
     def test_x86_64_pc(self):

From d0d86db5c98ad68473ca9b7e201fd449f1e4ed1b Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:29 +0100
Subject: [PATCH 2208/2396] tests/functional/x86_64/test_memlock: Silence
 pylint warnings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pylint complains about a missing "encoding" parameter for the open()
function here, and about a missing return statement in the "except"
block (which cannot happen since skipTest() never returns). Rework
the code a little bit to silence the warnings.

Reviewed-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-9-thuth@redhat.com>
---
 tests/functional/x86_64/test_memlock.py | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/functional/x86_64/test_memlock.py b/tests/functional/x86_64/test_memlock.py
index 81bce80b0c..f970a2c309 100755
--- a/tests/functional/x86_64/test_memlock.py
+++ b/tests/functional/x86_64/test_memlock.py
@@ -69,11 +69,13 @@ class MemlockTest(QemuSystemTest):
         return result
 
     def _get_raw_process_status(self, pid: int) -> str:
+        status = None
         try:
-            with open(f'/proc/{pid}/status', 'r') as f:
-                return f.read()
+            with open(f'/proc/{pid}/status', 'r', encoding="ascii") as f:
+                status = f.read()
         except FileNotFoundError:
             self.skipTest("Can't open status file of the process")
+        return status
 
 
 if __name__ == '__main__':

From 5560bad6953b7d1b5b4730e6eef66ab79e321d46 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:30 +0100
Subject: [PATCH 2209/2396] tests/functional/ppc/test_amiga: Fix issues
 reported by pylint and flake8
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pylint complains about unused variable "tar_name" and a missing "check"
for subprocess.run(), and flake8 suggest a second empty line after the
class. While we're at it, also remove the unused "timeout" class variable
(that was only necessary for the avocado framework which we don't use
anymore).

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-10-thuth@redhat.com>
---
 tests/functional/ppc/test_amiga.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tests/functional/ppc/test_amiga.py b/tests/functional/ppc/test_amiga.py
index 8600e2e963..36378fb697 100755
--- a/tests/functional/ppc/test_amiga.py
+++ b/tests/functional/ppc/test_amiga.py
@@ -15,8 +15,6 @@ from qemu_test import wait_for_console_pattern
 
 class AmigaOneMachine(QemuSystemTest):
 
-    timeout = 90
-
     ASSET_IMAGE = Asset(
         ('https://www.hyperion-entertainment.com/index.php/'
          'downloads?view=download&format=raw&file=25'),
@@ -25,19 +23,19 @@ class AmigaOneMachine(QemuSystemTest):
     def test_ppc_amigaone(self):
         self.require_accelerator("tcg")
         self.set_machine('amigaone')
-        tar_name = 'A1Firmware_Floppy_05-Mar-2005.zip'
         self.archive_extract(self.ASSET_IMAGE, format="zip")
         bios = self.scratch_file("u-boot-amigaone.bin")
         with open(bios, "wb") as bios_fh:
             subprocess.run(['tail', '-c', '524288',
                             self.scratch_file("floppy_edition",
                                               "updater.image")],
-                           stdout=bios_fh)
+                           stdout=bios_fh, check=True)
 
         self.vm.set_console()
         self.vm.add_args('-bios', bios)
         self.vm.launch()
         wait_for_console_pattern(self, 'FLASH:')
 
+
 if __name__ == '__main__':
     QemuSystemTest.main()

From dffd646ae615c8680fb85baef425c67133132e95 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:31 +0100
Subject: [PATCH 2210/2396] tests/functional/ppc/test_ppe42: Fix style issues
 reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Pylint suggests to write some parts of the code in a slightly different
way ... thus rework the code to make the linter happy.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Glenn Miles <milesg@linux.ibm.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-11-thuth@redhat.com>
---
 tests/functional/ppc/test_ppe42.py | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/tests/functional/ppc/test_ppe42.py b/tests/functional/ppc/test_ppe42.py
index 26bbe11b2d..7b360a40a5 100644
--- a/tests/functional/ppc/test_ppe42.py
+++ b/tests/functional/ppc/test_ppe42.py
@@ -6,8 +6,9 @@
 #
 # SPDX-License-Identifier: GPL-2.0-or-later
 
-from qemu_test import QemuSystemTest, Asset
 import asyncio
+from qemu_test import QemuSystemTest, Asset
+
 
 class Ppe42Machine(QemuSystemTest):
 
@@ -30,13 +31,13 @@ class Ppe42Machine(QemuSystemTest):
             raise
 
         self.log.info(output)
-        if "NIP fff80200" in output:
-            self.log.info("<test completed>")
-            return True
-        else:
+        if "NIP fff80200" not in output:
             self.log.info("<test not completed>")
             return False
 
+        self.log.info("<test completed>")
+        return True
+
     def _wait_pass_fail(self, timeout):
         while not self._test_completed():
             if timeout >= self.poll_period:
@@ -49,14 +50,13 @@ class Ppe42Machine(QemuSystemTest):
 
                 except asyncio.TimeoutError:
                     self.log.info("Poll period ended.")
-                    pass
 
                 except Exception as err:
                     self.log.debug(f"event_wait() failed due to {err=},"
                                     " {type(err)=}")
                     raise
 
-                if e != None:
+                if e is not None:
                     self.log.debug(f"Execution stopped: {e}")
                     self.log.debug("Exiting due to test failure")
                     self.fail("Failure detected!")

From 76da444a5362e653eab2b4a076d45112e53fecfc Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:33 +0100
Subject: [PATCH 2211/2396] tests/functional/aarch64/test_reverse_debug: Fix
 issues reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Don't use underscores in CamelCase names and drop an unused import.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-13-thuth@redhat.com>
---
 tests/functional/aarch64/test_reverse_debug.py | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/functional/aarch64/test_reverse_debug.py b/tests/functional/aarch64/test_reverse_debug.py
index ec3348c96d..e9fa4479d7 100755
--- a/tests/functional/aarch64/test_reverse_debug.py
+++ b/tests/functional/aarch64/test_reverse_debug.py
@@ -14,11 +14,11 @@
 # This work is licensed under the terms of the GNU GPL, version 2 or
 # later.  See the COPYING file in the top-level directory.
 
-from qemu_test import Asset, skipFlakyTest
+from qemu_test import Asset
 from reverse_debugging import ReverseDebugging
 
 
-class ReverseDebugging_AArch64(ReverseDebugging):
+class ReverseDebuggingAArch64(ReverseDebugging):
 
     ASSET_KERNEL = Asset(
         ('https://archives.fedoraproject.org/pub/archive/fedora/linux/'

From 2bfba5d94ba7e8c72f1eeed6ff9f098563b569a3 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 19 Nov 2025 09:26:35 +0100
Subject: [PATCH 2212/2396] tests/functional/aarch64/test_rme_sbsaref: Silence
 issues reported by pylint
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Drop unused import and use an encoding for open().

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251119082636.43286-15-thuth@redhat.com>
---
 tests/functional/aarch64/test_rme_sbsaref.py | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/functional/aarch64/test_rme_sbsaref.py b/tests/functional/aarch64/test_rme_sbsaref.py
index 6f92858397..4845c82496 100755
--- a/tests/functional/aarch64/test_rme_sbsaref.py
+++ b/tests/functional/aarch64/test_rme_sbsaref.py
@@ -14,7 +14,6 @@ from os.path import join
 import shutil
 
 from qemu_test import QemuSystemTest, Asset, wait_for_console_pattern
-from qemu_test import exec_command_and_wait_for_pattern
 
 
 class Aarch64RMESbsaRefMachine(QemuSystemTest):
@@ -48,7 +47,7 @@ class Aarch64RMESbsaRefMachine(QemuSystemTest):
         efi = join(rme_stack, 'out', 'EFI')
         os.makedirs(efi, exist_ok=True)
         shutil.copyfile(join(rme_stack, 'out', 'Image'), join(efi, 'Image'))
-        with open(join(efi, 'startup.nsh'), 'w') as startup:
+        with open(join(efi, 'startup.nsh'), 'w', encoding='ascii') as startup:
             startup.write('fs0:Image nokaslr root=/dev/vda rw init=/init --'
                           ' /host/out/lkvm run --realm'
                           ' -m 256m'

From 88175cff49dedd709b7a01e0e5e1bdcad69e0c8d Mon Sep 17 00:00:00 2001
From: "David Hildenbrand (Red Hat)" <david@kernel.org>
Date: Thu, 20 Nov 2025 11:46:02 +0100
Subject: [PATCH 2213/2396] MAINTAINERS: s390 maintainer updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately, I don't have a lot of capacity lately to take good care of
s390 in QEMU like I used to; and it doesn't look like that situation
will change. So let me convert myself to a reviewer in the s390 areas I
co-maintain.

Fortunately, we still have two other maintainers for "S390 floating
interrupt controller", so no action needed on that front.

For the other sections we get two new maintainers: Hendrik will
maintain "S390 CPU models" and Ilya will co-maintain "S390 TCG CPUs".

Thanks Hendrik and Ilya for stepping up!

Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Thomas Huth <thuth@redhat.com>
Cc: Christian Borntraeger <borntraeger@linux.ibm.com>
Cc: Ilya Leoshkevich <iii@linux.ibm.com>
Cc: Halil Pasic <pasic@linux.ibm.com>
Cc: Hendrik Brueckner <brueckner@linux.ibm.com>
Cc: Matthew Rosato <mjrosato@linux.ibm.com>
Signed-off-by: David Hildenbrand (Red Hat) <david@kernel.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Acked-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Message-ID: <20251120104602.205718-1-david@kernel.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
---
 MAINTAINERS | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d1c5080e50..d048c9f30d 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -364,8 +364,8 @@ F: target/rx/
 
 S390 TCG CPUs
 M: Richard Henderson <richard.henderson@linaro.org>
-M: David Hildenbrand <david@kernel.org>
-R: Ilya Leoshkevich <iii@linux.ibm.com>
+M: Ilya Leoshkevich <iii@linux.ibm.com>
+R: David Hildenbrand <david@kernel.org>
 S: Maintained
 F: target/s390x/
 F: target/s390x/tcg
@@ -1862,7 +1862,8 @@ F: target/s390x/ioinst.c
 L: qemu-s390x@nongnu.org
 
 S390 CPU models
-M: David Hildenbrand <david@kernel.org>
+M: Hendrik Brueckner <brueckner@linux.ibm.com>
+R: David Hildenbrand <david@kernel.org>
 S: Maintained
 F: target/s390x/cpu_features*.[ch]
 F: target/s390x/cpu_models.[ch]
@@ -2919,7 +2920,7 @@ L: qemu-s390x@nongnu.org
 S390 floating interrupt controller
 M: Halil Pasic <pasic@linux.ibm.com>
 M: Christian Borntraeger <borntraeger@linux.ibm.com>
-M: David Hildenbrand <david@kernel.org>
+R: David Hildenbrand <david@kernel.org>
 R: Jason Herne <jjherne@linux.ibm.com>
 S: Supported
 F: hw/intc/s390_flic*.c

From efbcf49ba06221241e3fed07ca4ac79f07b2bbbc Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@bytedance.com>
Date: Wed, 28 May 2025 11:31:56 +0800
Subject: [PATCH 2214/2396] MAINTAINERS: update email of zhenwei pi

I will leave ByteDance in the next days. Update email to stay reachable.

Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Acked-by: Fam Zheng <fam.zheng@bytedance.com>
Signed-off-by: zhenwei pi <pizhenwei@bytedance.com>
Message-ID: <20250528033156.1188531-1-pizhenwei@bytedance.com>
[Rescued from the list archive, I double-checked it's still valid]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 MAINTAINERS | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d1c5080e50..1cb21cd0fe 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3381,7 +3381,7 @@ T: git https://gitlab.com/ehabkost/qemu.git machine-next
 
 Cryptodev Backends
 M: Gonglei <arei.gonglei@huawei.com>
-M: zhenwei pi <pizhenwei@bytedance.com>
+M: zhenwei pi <zhenwei.pi@linux.dev>
 S: Maintained
 F: include/system/cryptodev*.h
 F: backends/cryptodev*.c

From bba249a256c1f6924f336f136782f3a4927f3a35 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Sat, 1 Nov 2025 13:30:24 +0300
Subject: [PATCH 2215/2396] qga: use access(2) to check for command existance
 instead of questionable stat(2)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The code checks existance of a command (halt/poweroff/reboot) by using
stat(2) and immediately checking for S_ISLNK() on the returned stat
struct.  This check will never be true, because stat(2) always follows
symbolic links and hence will either return ENOENT (in case of dangling
symlink) or the properties for the final target file.  It is lstat(2)
which might return information about the symlink itself.  However, even
there, we want to check the final file properties, not the first symlink.

This check - S_ISLNK - is harmful but useless in this case.  However, it
is confusing and it helps the wrong usage of stat(2) to spread, so it is
better to remove it.

Additionally, the code would better to check for the executable bits
of the final file, not check if it's a regular file - it's sort of
dubious to have anything but regular files in /sbin/.

But a POSIX system provides another command which suits the purpose
perfectly: it is access(2).  And it is so simple that it's not
necessary to create a separate function when usin it.

Replace stat(2) with access(X_OK) to check for file existance in
qga/commands-posix.c

Fixes: c5b4afd4d56e "qga: Support guest shutdown of BusyBox-based systems"
Reviewed-by: Rodrigo Dias Correa <r@drigo.nl>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kostiantyn Kostiuk <kkostiuk@redhat.com>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 qga/commands-posix.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/qga/commands-posix.c b/qga/commands-posix.c
index 66f3e6f673..837be51c40 100644
--- a/qga/commands-posix.c
+++ b/qga/commands-posix.c
@@ -216,12 +216,6 @@ out:
     return retcode;
 }
 
-static bool file_exists(const char *path)
-{
-    struct stat st;
-    return stat(path, &st) == 0 && (S_ISREG(st.st_mode) || S_ISLNK(st.st_mode));
-}
-
 #define POWEROFF_CMD_PATH "/sbin/poweroff"
 #define HALT_CMD_PATH "/sbin/halt"
 #define REBOOT_CMD_PATH "/sbin/reboot"
@@ -248,17 +242,17 @@ void qmp_guest_shutdown(const char *mode, Error **errp)
 
     slog("guest-shutdown called, mode: %s", mode);
     if (!mode || strcmp(mode, "powerdown") == 0) {
-        if (file_exists(POWEROFF_CMD_PATH)) {
+        if (access(POWEROFF_CMD_PATH, X_OK) == 0) {
             shutdown_cmd = POWEROFF_CMD_PATH;
         }
         shutdown_flag = powerdown_flag;
     } else if (strcmp(mode, "halt") == 0) {
-        if (file_exists(HALT_CMD_PATH)) {
+        if (access(HALT_CMD_PATH, X_OK) == 0) {
             shutdown_cmd = HALT_CMD_PATH;
         }
         shutdown_flag = halt_flag;
     } else if (strcmp(mode, "reboot") == 0) {
-        if (file_exists(REBOOT_CMD_PATH)) {
+        if (access(REBOOT_CMD_PATH, X_OK) == 0) {
             shutdown_cmd = REBOOT_CMD_PATH;
         }
         shutdown_flag = reboot_flag;

From 5fbcbf76a19a0d3500a4103fc8876c6cace2afcf Mon Sep 17 00:00:00 2001
From: Jack Wang <jinpu.wang@ionos.com>
Date: Tue, 21 Oct 2025 07:33:09 +0200
Subject: [PATCH 2216/2396] qmp: Fix a typo for a USO feature

There is a copy & paste error, USO6 should be there.

Fixes: 58f81689789f ("qmp: update virtio feature maps, vhost-user-gpio introspection")
Signed-off-by: Jack Wang <jinpu.wang@ionos.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/virtio/virtio-qmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/virtio/virtio-qmp.c b/hw/virtio/virtio-qmp.c
index b338344c6c..968299fda0 100644
--- a/hw/virtio/virtio-qmp.c
+++ b/hw/virtio/virtio-qmp.c
@@ -299,7 +299,7 @@ static const qmp_virtio_feature_map_t virtio_net_feature_map[] = {
     FEATURE_ENTRY(VIRTIO_NET_F_GUEST_USO4, \
             "VIRTIO_NET_F_GUEST_USO4: Driver can receive USOv4"),
     FEATURE_ENTRY(VIRTIO_NET_F_GUEST_USO6, \
-            "VIRTIO_NET_F_GUEST_USO4: Driver can receive USOv6"),
+            "VIRTIO_NET_F_GUEST_USO6: Driver can receive USOv6"),
     FEATURE_ENTRY(VIRTIO_NET_F_HOST_USO, \
             "VIRTIO_NET_F_HOST_USO: Device can receive USO"),
     FEATURE_ENTRY(VIRTIO_NET_F_HASH_REPORT, \

From 5f9ac963735598c1efbdce9c4a09f0a64e13d613 Mon Sep 17 00:00:00 2001
From: Yanghang Liu <yanghliu@redhat.com>
Date: Fri, 21 Nov 2025 17:43:41 +0800
Subject: [PATCH 2217/2396] Fix the typo of vfio-pci device's enable-migration
 option

Signed-off-by: Yanghang Liu <yanghliu@redhat.com>
Reported-by: Mario Casquero <mcasquer@redhat.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/vfio/pci.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/vfio/pci.c b/hw/vfio/pci.c
index 8b8bc5a421..b46b1305a7 100644
--- a/hw/vfio/pci.c
+++ b/hw/vfio/pci.c
@@ -3871,7 +3871,7 @@ static void vfio_pci_class_init(ObjectClass *klass, const void *data)
                                           "(DEBUG)");
     object_class_property_set_description(klass, /* 5.2, 8.0 non-experimetal */
                                           "enable-migration",
-                                          "Enale device migration. Also requires a host VFIO PCI "
+                                          "Enable device migration. Also requires a host VFIO PCI "
                                           "variant or mdev driver with migration support enabled");
     object_class_property_set_description(klass, /* 8.1 */
                                           "vf-token",

From 0b5bf4ea76205a93386c5e02fbb519871a62e677 Mon Sep 17 00:00:00 2001
From: Li Zhijian <lizhijian@fujitsu.com>
Date: Tue, 4 Nov 2025 09:36:06 +0800
Subject: [PATCH 2218/2396] migration: Fix transition to COLO state from
 precopy

Commit 4881411136 ("migration: Always set DEVICE state") set a new DEVICE
state before completed during migration, which broke the original transition
to COLO. The migration flow for precopy has changed to:
active -> pre-switchover -> device -> completed.

This patch updates the transition state to ensure that the Pre-COLO
state corresponds to DEVICE state correctly.

Cc: qemu-stable <qemu-stable@nongnu.org>
Fixes: 4881411136 ("migration: Always set DEVICE state")
Signed-off-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Tested-by: Zhang Chen <zhangckid@gmail.com>
Link: https://lore.kernel.org/r/20251104013606.1937764-1-lizhijian@fujitsu.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/migration.c b/migration/migration.c
index c2daab6bdd..1b2c02d7fa 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -3081,9 +3081,9 @@ static void migration_completion(MigrationState *s)
         goto fail;
     }
 
-    if (migrate_colo() && s->state == MIGRATION_STATUS_ACTIVE) {
+    if (migrate_colo() && s->state == MIGRATION_STATUS_DEVICE) {
         /* COLO does not support postcopy */
-        migrate_set_state(&s->state, MIGRATION_STATUS_ACTIVE,
+        migrate_set_state(&s->state, MIGRATION_STATUS_DEVICE,
                           MIGRATION_STATUS_COLO);
     } else {
         migration_completion_end(s);

From 911bdd34ca1a3f9e62836e7bc581e7edc57319be Mon Sep 17 00:00:00 2001
From: Matthew Rosato <mjrosato@linux.ibm.com>
Date: Thu, 13 Nov 2025 16:35:45 -0500
Subject: [PATCH 2219/2396] migration: set correct list pointer when removing
 notifier
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In migration_remove_notifier(), g_slist_remove() will search for and
potentially remove an entry from the specified list.  The return value
should be used to update the potentially-changed head pointer of the
list that was just searched (migration_state_notifiers[mode]) instead
of the migration blockers list.

Fixes: dc79c7d5e1 ("migration: multi-mode notifier")
Signed-off-by: Matthew Rosato <mjrosato@linux.ibm.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/r/20251113213545.513453-1-mjrosato@linux.ibm.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/migration.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/migration.c b/migration/migration.c
index 1b2c02d7fa..b316ee01ab 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -1693,7 +1693,7 @@ void migration_remove_notifier(NotifierWithReturn *notify)
 {
     if (notify->notify) {
         for (MigMode mode = 0; mode < MIG_MODE__MAX; mode++) {
-            migration_blockers[mode] =
+            migration_state_notifiers[mode] =
                 g_slist_remove(migration_state_notifiers[mode], notify);
         }
         notify->notify = NULL;

From 93817ec39656896543b84b877528ce6fedc3903b Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Sat, 15 Nov 2025 09:34:58 +0100
Subject: [PATCH 2220/2396] migration: Plug memory leaks after
 migrate_set_error()

migrate_set_error(s, err) stores a copy of @err in @s.  The original
@err is not freed.  Most callers free it immediately.  Some callers
free it later, or pass it on.  And some leak it.  Fix those.

Perhaps migrate_set_error(s, err) should take ownership of @err.  The
callers that free it immediately would become simpler, and avoid a
copy and a deallocation.  The others would have to pass
error_copy(err).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Link: https://lore.kernel.org/r/20251115083500.2753895-2-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/cpr-exec.c | 3 ++-
 migration/multifd.c  | 2 ++
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/migration/cpr-exec.c b/migration/cpr-exec.c
index d284f6e734..0b8344a86f 100644
--- a/migration/cpr-exec.c
+++ b/migration/cpr-exec.c
@@ -159,11 +159,12 @@ static void cpr_exec_cb(void *opaque)
     error_report_err(error_copy(err));
     migrate_set_state(&s->state, s->state, MIGRATION_STATUS_FAILED);
     migrate_set_error(s, err);
+    error_free(err);
+    err = NULL;
 
     /* Note, we can go from state COMPLETED to FAILED */
     migration_call_notifiers(s, MIG_EVENT_PRECOPY_FAILED, NULL);
 
-    err = NULL;
     if (!migration_block_activate(&err)) {
         /* error was already reported */
         error_free(err);
diff --git a/migration/multifd.c b/migration/multifd.c
index 98873cee74..a529c399e4 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -964,6 +964,7 @@ bool multifd_send_setup(void)
 
         if (!multifd_new_send_channel_create(p, &local_err)) {
             migrate_set_error(s, local_err);
+            error_free(local_err);
             ret = -1;
         }
     }
@@ -988,6 +989,7 @@ bool multifd_send_setup(void)
         ret = multifd_send_state->ops->send_setup(p, &local_err);
         if (ret) {
             migrate_set_error(s, local_err);
+            error_free(local_err);
             goto err;
         }
         assert(p->iov);

From ffaa1b50a87960acb169f06b6f9d2f8f4eafdf62 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Sat, 15 Nov 2025 09:34:59 +0100
Subject: [PATCH 2221/2396] migration: Use warn_reportf_err() where appropriate

Replace

    warn_report("...: %s", ..., error_get_pretty(err));

by

    warn_reportf_err(err, "...: ", ...);

Prior art: commit 5217f1887a8 (error: Use error_reportf_err() where
appropriate).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-3-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index a529c399e4..6210454838 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -464,8 +464,8 @@ static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
          */
         migration_tls_channel_end(ioc, &local_err);
         if (local_err) {
-            warn_report("Failed to gracefully terminate TLS connection: %s",
-                        error_get_pretty(local_err));
+            warn_reportf_err(local_err,
+                        "Failed to gracefully terminate TLS connection: ");
         }
     }
 

From bfcaa18a14f585da4448c055477bead5a6b27541 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Sat, 15 Nov 2025 09:35:00 +0100
Subject: [PATCH 2222/2396] migration/postcopy-ram: Improve error reporting
 after loadvm failure

One of two error messages show __func__.  Drop it; it doesn't help
users, and developers can grep for the message.  This also permits
de-duplicating the code to prepend to the error message.

Both error messages show a numeric error code.  I doubt that's
helpful, but I'm leaving it alone.

Use error_append_hint() for explaining that some dirty bitmaps may be
lost.  Polish the prose.

Don't faff around with g_clear_pointer(), it's not worth its keep
here.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251115083500.2753895-4-armbru@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 migration/postcopy-ram.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 3f98dcb6fd..7c9fe61041 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -2146,25 +2146,24 @@ static void *postcopy_listen_thread(void *opaque)
     if (load_res < 0) {
         qemu_file_set_error(f, load_res);
         dirty_bitmap_mig_cancel_incoming();
+        error_prepend(&local_err,
+                      "loadvm failed during postcopy: %d: ", load_res);
         if (postcopy_state_get() == POSTCOPY_INCOMING_RUNNING &&
             !migrate_postcopy_ram() && migrate_dirty_bitmaps())
         {
-            error_report("%s: loadvm failed during postcopy: %d: %s. All states "
-                         "are migrated except dirty bitmaps. Some dirty "
-                         "bitmaps may be lost, and present migrated dirty "
-                         "bitmaps are correctly migrated and valid.",
-                         __func__, load_res, error_get_pretty(local_err));
-            g_clear_pointer(&local_err, error_free);
+            error_append_hint(&local_err,
+                              "All state is migrated except dirty bitmaps."
+                              " Some dirty bitmaps may be lost, but any"
+                              " migrated dirty bitmaps are valid.");
+            error_report_err(local_err);
         } else {
             /*
              * Something went fatally wrong and we have a bad state, QEMU will
              * exit depending on if postcopy-exit-on-error is true, but the
              * migration cannot be recovered.
              */
-            error_prepend(&local_err,
-                          "loadvm failed during postcopy: %d: ", load_res);
             migrate_set_error(migr, local_err);
-            g_clear_pointer(&local_err, error_report_err);
+            error_report_err(local_err);
             migrate_set_state(&mis->state, mis->state, MIGRATION_STATUS_FAILED);
             goto out;
         }

From b187a183b107d84595ee79589cbf13ef2a75e960 Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 17 Nov 2025 17:39:05 -0500
Subject: [PATCH 2223/2396] tests/migration-test: Introduce MemType

Some migration tests need to be run with shmem, the rest by default use
anonymous memory.

Introduce MemType and replace use_shmem with such a enumeration.  This
prepares for a 3rd type of memory to be tested for migration.

Careful readers may also already notice that MigrateStart has another field
called memory_backend, which makes the whole "memory type" definition
convoluted.  That'll be merged into MemType soon in a follow up patch.

When doing this, introduce some migrate_mem_type_*() helpers to do the
work for each memory type.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-2-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/cpr-tests.c  |  2 +-
 tests/qtest/migration/framework.c  | 81 ++++++++++++++++++++++--------
 tests/qtest/migration/framework.h  |  8 ++-
 tests/qtest/migration/misc-tests.c |  2 +-
 4 files changed, 68 insertions(+), 25 deletions(-)

diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 9388ad64be..70f8e69633 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -32,7 +32,7 @@ static void test_mode_reboot(void)
     g_autofree char *uri = g_strdup_printf("file:%s/%s", tmpfs,
                                            FILE_TEST_FILENAME);
     MigrateCommon args = {
-        .start.use_shmem = true,
+        .start.mem_type = MEM_TYPE_SHMEM,
         .connect_uri = uri,
         .listen_uri = "defer",
         .start_hook = migrate_hook_start_mode_reboot,
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index a9be9c2dbf..8fa39999a1 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -260,6 +260,25 @@ static char *test_shmem_path(void)
     return g_strdup_printf("/dev/shm/qemu-%d", getpid());
 }
 
+/* NOTE: caller is responsbile to free the string if returned */
+static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
+{
+    g_autofree char *shmem_path = NULL;
+    char *backend = NULL;
+
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+        shmem_path = test_shmem_path();
+        backend = g_strdup_printf(
+            "-object memory-backend-file,id=mem0,size=%s"
+            ",mem-path=%s,share=on -numa node,memdev=mem0",
+            memory_size, shmem_path);
+        return backend;
+    default:
+        return NULL;
+    }
+}
+
 int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
 {
     /* options for source and target */
@@ -268,7 +287,6 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
     g_autofree char *shmem_opts = NULL;
-    g_autofree char *shmem_path = NULL;
     const char *kvm_opts = NULL;
     const char *arch = qtest_get_arch();
     const char *memory_size;
@@ -332,13 +350,7 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    if (args->use_shmem) {
-        shmem_path = test_shmem_path();
-        shmem_opts = g_strdup_printf(
-            "-object memory-backend-file,id=mem0,size=%s"
-            ",mem-path=%s,share=on -numa node,memdev=mem0",
-            memory_size, shmem_path);
-    }
+    shmem_opts = migrate_mem_type_get_opts(args->mem_type, memory_size);
 
     if (args->memory_backend) {
         memory_backend = g_strdup_printf(args->memory_backend, memory_size);
@@ -403,6 +415,42 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     return 0;
 }
 
+static bool migrate_mem_type_prepare(MemType type)
+{
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
+            g_test_skip("/dev/shm is not supported");
+            return false;
+        }
+        break;
+    default:
+        break;
+    }
+
+    return true;
+}
+
+static void migrate_mem_type_cleanup(MemType type)
+{
+    g_autofree char *shmem_path = NULL;
+
+    switch (type) {
+    case MEM_TYPE_SHMEM:
+
+        /*
+         * Remove shmem file immediately to avoid memory leak in test
+         * failed case.  It's valid because QEMU has already opened this
+         * file
+         */
+        shmem_path = test_shmem_path();
+        unlink(shmem_path);
+        break;
+    default:
+        break;
+    }
+}
+
 int migrate_start(QTestState **from, QTestState **to, const char *uri,
                   MigrateStart *args)
 {
@@ -410,11 +458,8 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
     g_autofree gchar *cmd_target = NULL;
     g_autoptr(QList) capabilities = migrate_start_get_qmp_capabilities(args);
 
-    if (args->use_shmem) {
-        if (!g_file_test("/dev/shm", G_FILE_TEST_IS_DIR)) {
-            g_test_skip("/dev/shm is not supported");
-            return -1;
-        }
+    if (!migrate_mem_type_prepare(args->mem_type)) {
+        return -1;
     }
 
     dst_state = (QTestMigrationState) { };
@@ -441,15 +486,7 @@ int migrate_start(QTestState **from, QTestState **to, const char *uri,
                                      &dst_state);
     }
 
-    /*
-     * Remove shmem file immediately to avoid memory leak in test failed case.
-     * It's valid because QEMU has already opened this file
-     */
-    if (args->use_shmem) {
-        g_autofree char *shmem_path = test_shmem_path();
-        unlink(shmem_path);
-    }
-
+    migrate_mem_type_cleanup(args->mem_type);
     migrate_start_set_capabilities(*from,
                                    args->only_source ? NULL : *to,
                                    args);
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 9bb584a6bb..70705725bc 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -18,6 +18,12 @@
 #define FILE_TEST_OFFSET 0x1000
 #define FILE_TEST_MARKER 'X'
 
+typedef enum {
+    MEM_TYPE_ANON,
+    MEM_TYPE_SHMEM,
+    MEM_TYPE_NUM,
+} MemType;
+
 typedef struct MigrationTestEnv {
     bool has_kvm;
     bool has_tcg;
@@ -102,7 +108,7 @@ typedef struct {
      * unconditionally, because it means the user would like to be verbose.
      */
     bool hide_stderr;
-    bool use_shmem;
+    MemType mem_type;
     /* only launch the source process */
     bool only_source;
     /* only launch the target process */
diff --git a/tests/qtest/migration/misc-tests.c b/tests/qtest/migration/misc-tests.c
index 54995256d8..20edaa51f5 100644
--- a/tests/qtest/migration/misc-tests.c
+++ b/tests/qtest/migration/misc-tests.c
@@ -97,7 +97,7 @@ static void test_ignore_shared(void)
     g_autofree char *uri = g_strdup_printf("unix:%s/migsocket", tmpfs);
     QTestState *from, *to;
     MigrateStart args = {
-        .use_shmem = true,
+        .mem_type = MEM_TYPE_SHMEM,
         .caps[MIGRATION_CAPABILITY_X_IGNORE_SHARED] = true,
     };
 

From b1d67d86db63340dd64061def7eba6d6172cf0fa Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 17 Nov 2025 17:39:06 -0500
Subject: [PATCH 2224/2396] tests/migration-test: Merge shmem_opts into
 memory_backend

The two parameters are more or less duplicated in migrate_args().  They all
describe the memory type.  When one is used, the other is not.

mem_type currently uses numa parameter to specify the memory backend, while
memory_backend (the two users of such uses "-machine memory-backend=ID").

This patch merges the use of the two variables so that we always generate a
memory object string and put it into "memory_backend" variable.  Now we can
drop shmem_opts parameter in the function.

Meanwhile we always use a memory-backend-* no matter which mem type is
used.  This brings mem_type to be aligned with memory_backend usage, then
we stick with this as this is flexible enough.

This paves way that we merge mem_type and memory_backend in MigrateStart.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-3-peterx@redhat.com
[peterx: move MEM_TYPE_ANON case upper, per juraj]
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.c | 41 ++++++++++++++++++++-----------
 1 file changed, 26 insertions(+), 15 deletions(-)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 8fa39999a1..7f325e4753 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -260,23 +260,36 @@ static char *test_shmem_path(void)
     return g_strdup_printf("/dev/shm/qemu-%d", getpid());
 }
 
+#define  MIG_MEM_ID  "mig.mem"
+
 /* NOTE: caller is responsbile to free the string if returned */
 static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
 {
     g_autofree char *shmem_path = NULL;
-    char *backend = NULL;
+    g_autofree char *backend = NULL;
+    bool share = true;
+    char *opts;
 
     switch (type) {
+    case MEM_TYPE_ANON:
+        backend = g_strdup("-object memory-backend-ram");
+        share = false;
+        break;
     case MEM_TYPE_SHMEM:
         shmem_path = test_shmem_path();
-        backend = g_strdup_printf(
-            "-object memory-backend-file,id=mem0,size=%s"
-            ",mem-path=%s,share=on -numa node,memdev=mem0",
-            memory_size, shmem_path);
-        return backend;
+        backend = g_strdup_printf("-object memory-backend-file,mem-path=%s",
+                                  shmem_path);
+        break;
     default:
-        return NULL;
+        g_assert_not_reached();
+        break;
     }
+
+    opts = g_strdup_printf("%s,id=%s,size=%s,share=%s",
+                           backend, MIG_MEM_ID, memory_size,
+                           share ? "on" : "off");
+
+    return opts;
 }
 
 int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
@@ -286,7 +299,7 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
     gchar *cmd_source = NULL;
     gchar *cmd_target = NULL;
     const gchar *ignore_stderr;
-    g_autofree char *shmem_opts = NULL;
+    g_autofree char *mem_object = NULL;
     const char *kvm_opts = NULL;
     const char *arch = qtest_get_arch();
     const char *memory_size;
@@ -350,12 +363,12 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    shmem_opts = migrate_mem_type_get_opts(args->mem_type, memory_size);
-
     if (args->memory_backend) {
         memory_backend = g_strdup_printf(args->memory_backend, memory_size);
     } else {
-        memory_backend = g_strdup_printf("-m %s ", memory_size);
+        mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
+        memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
+                                         MIG_MEM_ID, mem_object);
     }
 
     if (args->use_dirty_ring) {
@@ -378,12 +391,11 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
                                  "-name source,debug-threads=on "
                                  "%s "
                                  "-serial file:%s/src_serial "
-                                 "%s %s %s %s",
+                                 "%s %s %s",
                                  kvm_opts ? kvm_opts : "",
                                  machine, machine_opts,
                                  memory_backend, tmpfs,
                                  arch_opts ? arch_opts : "",
-                                 shmem_opts ? shmem_opts : "",
                                  args->opts_source ? args->opts_source : "",
                                  ignore_stderr);
 
@@ -400,13 +412,12 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
                                  "%s "
                                  "-serial file:%s/dest_serial "
                                  "-incoming %s "
-                                 "%s %s %s %s %s",
+                                 "%s %s %s %s",
                                  kvm_opts ? kvm_opts : "",
                                  machine, machine_opts,
                                  memory_backend, tmpfs, uri,
                                  events,
                                  arch_opts ? arch_opts : "",
-                                 shmem_opts ? shmem_opts : "",
                                  args->opts_target ? args->opts_target : "",
                                  ignore_stderr);
 

From c2f2470e31646ac9e07a18277f5d7fe08910b0fb Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 17 Nov 2025 17:39:07 -0500
Subject: [PATCH 2225/2396] tests/migration-test: Add MEM_TYPE_SHMEM

Add memfd support for mem_type.  Will be used to replace memory_backend.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-4-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/framework.c |  3 +++
 tests/qtest/migration/framework.h | 13 +++++++++++++
 2 files changed, 16 insertions(+)

diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 7f325e4753..1c662f86a9 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -280,6 +280,9 @@ static char *migrate_mem_type_get_opts(MemType type, const char *memory_size)
         backend = g_strdup_printf("-object memory-backend-file,mem-path=%s",
                                   shmem_path);
         break;
+    case MEM_TYPE_MEMFD:
+        backend = g_strdup("-object memory-backend-memfd");
+        break;
     default:
         g_assert_not_reached();
         break;
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 70705725bc..9dec21c344 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -19,8 +19,21 @@
 #define FILE_TEST_MARKER 'X'
 
 typedef enum {
+    /*
+     * Use memory-backend-ram, private mappings
+     */
     MEM_TYPE_ANON,
+    /*
+     * Use shmem file (under /dev/shm), shared mappings
+     */
     MEM_TYPE_SHMEM,
+    /*
+     * Use anonymous memfd, shared mappings.
+     *
+     * NOTE: this is internally almost the same as MEM_TYPE_SHMEM on Linux,
+     * but only anonymously allocated.
+     */
+    MEM_TYPE_MEMFD,
     MEM_TYPE_NUM,
 } MemType;
 

From 6aef825073a751215de1ed410a5c94efa675f5ca Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 17 Nov 2025 17:39:08 -0500
Subject: [PATCH 2226/2396] tests/migration-test: Use MEM_TYPE_MEMFD for
 memory_backend

The only two users of memory_backend as of now (cpr-exec, cpr-transfer)
uses memfd as backend, now we fully support it.  We can move memory_backend
usage to mem_type and drop it.

Reviewed-by: Juraj Marcin <jmarcin@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/r/20251117223908.415965-5-peterx@redhat.com
Signed-off-by: Peter Xu <peterx@redhat.com>
---
 tests/qtest/migration/cpr-tests.c |  6 ++----
 tests/qtest/migration/framework.c | 10 +++-------
 tests/qtest/migration/framework.h |  5 -----
 3 files changed, 5 insertions(+), 16 deletions(-)

diff --git a/tests/qtest/migration/cpr-tests.c b/tests/qtest/migration/cpr-tests.c
index 70f8e69633..2a186c6f35 100644
--- a/tests/qtest/migration/cpr-tests.c
+++ b/tests/qtest/migration/cpr-tests.c
@@ -89,8 +89,7 @@ static void test_mode_transfer_common(bool incoming_defer)
         .start.opts_source = opts,
         .start.opts_target = opts_target,
         .start.defer_target_connect = true,
-        .start.memory_backend = "-object memory-backend-memfd,id=pc.ram,size=%s"
-                                " -machine memory-backend=pc.ram",
+        .start.mem_type = MEM_TYPE_MEMFD,
         .listen_uri = incoming_defer ? "defer" : uri,
         .connect_channels = connect_channels,
         .cpr_channel = cpr_channel,
@@ -235,8 +234,7 @@ static void test_mode_exec(void)
     MigrateCommon args = {
         .start.only_source = true,
         .start.opts_source = "-machine aux-ram-share=on -nodefaults",
-        .start.memory_backend = "-object memory-backend-memfd,id=pc.ram,size=%s"
-                                " -machine memory-backend=pc.ram",
+        .start.mem_type = MEM_TYPE_MEMFD,
         .connect_uri = uri,
         .listen_uri = listen_uri,
         .start_hook = test_mode_exec_start,
diff --git a/tests/qtest/migration/framework.c b/tests/qtest/migration/framework.c
index 1c662f86a9..e35839c95f 100644
--- a/tests/qtest/migration/framework.c
+++ b/tests/qtest/migration/framework.c
@@ -366,13 +366,9 @@ int migrate_args(char **from, char **to, const char *uri, MigrateStart *args)
         ignore_stderr = "";
     }
 
-    if (args->memory_backend) {
-        memory_backend = g_strdup_printf(args->memory_backend, memory_size);
-    } else {
-        mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
-        memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
-                                         MIG_MEM_ID, mem_object);
-    }
+    mem_object = migrate_mem_type_get_opts(args->mem_type, memory_size);
+    memory_backend = g_strdup_printf("-machine memory-backend=%s %s",
+                                     MIG_MEM_ID, mem_object);
 
     if (args->use_dirty_ring) {
         kvm_opts = ",dirty-ring-size=4096";
diff --git a/tests/qtest/migration/framework.h b/tests/qtest/migration/framework.h
index 9dec21c344..ed85ed502d 100644
--- a/tests/qtest/migration/framework.h
+++ b/tests/qtest/migration/framework.h
@@ -134,11 +134,6 @@ typedef struct {
     bool suspend_me;
     /* enable OOB QMP capability */
     bool oob;
-    /*
-     * Format string for the main memory backend, containing one %s where the
-     * size is plugged in.  If omitted, "-m %s" is used.
-     */
-    const char *memory_backend;
 
     /* Do not connect to target monitor and qtest sockets in qtest_init */
     bool defer_target_connect;

From cacd8fb08d3f992ef9cdf4c26a2d28ced409cfd4 Mon Sep 17 00:00:00 2001
From: Nabih Estefan <nabihestefan@google.com>
Date: Tue, 4 Nov 2025 23:37:42 +0000
Subject: [PATCH 2227/2396] hw/arm/ast27x0: Fix typo in LTPI address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The address for LTPI has one more 0 that it should, bug introduced in
commit 91064bea6b2d747a981cb3bd2904e56f443e6c67.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Fixes: 91064bea6b2d ("aspeed: ast27x0: Map unimplemented devices in SoC memory")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251104233742.2147367-1-nabihestefan@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast27x0.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index c484bcd4e2..1e6f469538 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -87,11 +87,11 @@ static const hwaddr aspeed_soc_ast2700_memmap[] = {
     [ASPEED_DEV_UART11]    =  0x14C33A00,
     [ASPEED_DEV_UART12]    =  0x14C33B00,
     [ASPEED_DEV_WDT]       =  0x14C37000,
+    [ASPEED_DEV_LTPI]      =  0x30000000,
     [ASPEED_DEV_PCIE_MMIO0] = 0x60000000,
     [ASPEED_DEV_PCIE_MMIO1] = 0x80000000,
     [ASPEED_DEV_PCIE_MMIO2] = 0xA0000000,
     [ASPEED_DEV_SPI_BOOT]  =  0x100000000,
-    [ASPEED_DEV_LTPI]      =  0x300000000,
     [ASPEED_DEV_SDRAM]     =  0x400000000,
 };
 

From 510d5c61ad3eb1690b61c804d38c984527a5ea62 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Thu, 6 Nov 2025 16:49:10 +0800
Subject: [PATCH 2228/2396] hw/arm/aspeed: Fix missing SPI IRQ connection
 causing DMA interrupt failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It did not connect SPI IRQ to the Interrupt Controller, so even the SPI
model raised the IRQ, the interrupt was not received. The CPU therefore
did not trigger an interrupt via the controller, and the firmware never
received the interrupt.

Fixes: 356b230ed13889e09d087a96498887de695df17e ("aspeed/soc: Add AST1030 support")
Fixes: f25c0ae1079dc0b9de02676eb3e3949a09df9f41 ("aspeed/soc: Add AST2600 support")
Fixes: 5dd883ab0635c9f715c77cc32622e458a0724581 ("aspeed/soc: Add AST2700 support")
Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251106084925.1253704-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/arm/aspeed_ast10x0.c | 2 ++
 hw/arm/aspeed_ast2600.c | 2 ++
 hw/arm/aspeed_ast27x0.c | 2 ++
 3 files changed, 6 insertions(+)

diff --git a/hw/arm/aspeed_ast10x0.c b/hw/arm/aspeed_ast10x0.c
index 7f49c13391..ca487774ae 100644
--- a/hw/arm/aspeed_ast10x0.c
+++ b/hw/arm/aspeed_ast10x0.c
@@ -372,6 +372,8 @@ static void aspeed_soc_ast1030_realize(DeviceState *dev_soc, Error **errp)
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                           aspeed_soc_ast1030_get_irq(s, ASPEED_DEV_SPI1 + i));
     }
 
     /* Secure Boot Controller */
diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index 498d1ecc07..4c5a42ea17 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -557,6 +557,8 @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
                         sc->memmap[ASPEED_DEV_SPI1 + i]);
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                           aspeed_soc_ast2600_get_irq(s, ASPEED_DEV_SPI1 + i));
     }
 
     /* EHCI */
diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 1e6f469538..95f155fcf1 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -831,6 +831,8 @@ static void aspeed_soc_ast2700_realize(DeviceState *dev, Error **errp)
                         sc->memmap[ASPEED_DEV_SPI0 + i]);
         aspeed_mmio_map(s->memory, SYS_BUS_DEVICE(&s->spi[i]), 1,
                         ASPEED_SMC_GET_CLASS(&s->spi[i])->flash_window_base);
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->spi[i]), 0,
+                           aspeed_soc_ast2700_get_irq(s, ASPEED_DEV_SPI0 + i));
     }
 
     /* EHCI */

From e9a8b04dbb98fba7942b23b3ac5c35f2f0b9c4a0 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 21 Nov 2025 13:01:08 +0800
Subject: [PATCH 2229/2396] hw/pci-host/aspeed_pcie: Update ASPEED PCIe Root
 Port capabilities and enable MSI to support hotplug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This patch updates the ASPEED PCIe Root Port capability layout and interrupt
handling to match the hardware-defined capability structure as documented in
the PCI Express Controller (PCIE) chapter of the ASPEED SoC datasheet.

The following capability offsets and fields are now aligned with the actual
hardware implementation (validated using EVB config-space dumps via
'lspci -s <bdf> -vvv'):

- Added MSI capability at offset 0x50 and enabled 1-vector MSI support
- Added PCI Express Capability structure at offset 0x80
- Added Secondary Subsystem Vendor ID (SSVID) at offset 0xC0
- Added AER capability at offset 0x100
- Implemented aer_vector() callback and MSI init/uninit hooks
- Updated Root Port SSID to 0x1150 to reflect the platform default

Enabling MSI is required for proper PCIe Hotplug event signaling. This change
improves correctness and ensures QEMU Root Port behavior matches the behavior
of ASPEED hardware and downstream kernel expectations.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: 2af56518fa91 ("hw/pci-host/aspeed: Add AST2600 PCIe Root Port and make address configurable")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Nabih Estefan <nabihestefan@google.com>
Tested-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251121050108.3407445-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/pci-host/aspeed_pcie.c | 40 ++++++++++++++++++++++++++++++++++++++-
 1 file changed, 39 insertions(+), 1 deletion(-)

diff --git a/hw/pci-host/aspeed_pcie.c b/hw/pci-host/aspeed_pcie.c
index f7593444fc..1fc2c61772 100644
--- a/hw/pci-host/aspeed_pcie.c
+++ b/hw/pci-host/aspeed_pcie.c
@@ -68,6 +68,38 @@ static const TypeInfo aspeed_pcie_root_device_info = {
  * PCIe Root Port
  */
 
+#define ASPEED_PCIE_ROOT_PORT_MSI_OFFSET        0x50
+#define ASPEED_PCIE_ROOT_PORT_MSI_NR_VECTOR     1
+#define ASPEED_PCIE_ROOT_PORT_SSVID_OFFSET      0xC0
+#define ASPEED_PCIE_ROOT_PORT_EXP_OFFSET        0x80
+#define ASPEED_PCIE_ROOT_PORT_AER_OFFSET        0x100
+
+static uint8_t aspeed_pcie_root_port_aer_vector(const PCIDevice *d)
+{
+    return 0;
+}
+
+static int aspeed_pcie_root_port_interrupts_init(PCIDevice *d, Error **errp)
+{
+    int rc;
+
+    rc = msi_init(d, ASPEED_PCIE_ROOT_PORT_MSI_OFFSET,
+                  ASPEED_PCIE_ROOT_PORT_MSI_NR_VECTOR,
+                  PCI_MSI_FLAGS_MASKBIT & PCI_MSI_FLAGS_64BIT,
+                  PCI_MSI_FLAGS_MASKBIT & PCI_MSI_FLAGS_MASKBIT,
+                  errp);
+    if (rc < 0) {
+        assert(rc == -ENOTSUP);
+    }
+
+    return rc;
+}
+
+static void aspeed_pcie_root_port_interrupts_uninit(PCIDevice *d)
+{
+    msi_uninit(d);
+}
+
 static void aspeed_pcie_root_port_class_init(ObjectClass *klass,
                                              const void *data)
 {
@@ -80,7 +112,13 @@ static void aspeed_pcie_root_port_class_init(ObjectClass *klass,
     k->device_id = 0x1150;
     dc->user_creatable = true;
 
-    rpc->aer_offset = 0x100;
+    rpc->aer_vector = aspeed_pcie_root_port_aer_vector;
+    rpc->interrupts_init = aspeed_pcie_root_port_interrupts_init;
+    rpc->interrupts_uninit = aspeed_pcie_root_port_interrupts_uninit;
+    rpc->exp_offset = ASPEED_PCIE_ROOT_PORT_EXP_OFFSET;
+    rpc->aer_offset = ASPEED_PCIE_ROOT_PORT_AER_OFFSET;
+    rpc->ssvid_offset = ASPEED_PCIE_ROOT_PORT_SSVID_OFFSET;
+    rpc->ssid = 0x1150;
 }
 
 static const TypeInfo aspeed_pcie_root_port_info = {

From 4a5df192932a49f4e074162bd6d09dd33b18e3e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:45 +0000
Subject: [PATCH 2230/2396] contrib/gitdm: add group-map for Huawei
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we do see contributions from the top-level domain some
contributors also post via other addresses.

Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
Reviewed-by: Mauro Carvalho Chehab <mchehab+huawei@kernel.org>
Message-ID: <20251119113953.1432303-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/group-map-huawei | 5 +++++
 gitdm.config                   | 1 +
 2 files changed, 6 insertions(+)
 create mode 100644 contrib/gitdm/group-map-huawei

diff --git a/contrib/gitdm/group-map-huawei b/contrib/gitdm/group-map-huawei
new file mode 100644
index 0000000000..c287dd5d2b
--- /dev/null
+++ b/contrib/gitdm/group-map-huawei
@@ -0,0 +1,5 @@
+#
+# Some Huawei contributors submit via another domain
+#
+
+mchehab+huawei@kernel.org
diff --git a/gitdm.config b/gitdm.config
index 9db43ca142..05a2dad229 100644
--- a/gitdm.config
+++ b/gitdm.config
@@ -36,6 +36,7 @@ GroupMap contrib/gitdm/group-map-amd AMD
 GroupMap contrib/gitdm/group-map-cadence Cadence Design Systems
 GroupMap contrib/gitdm/group-map-codeweavers CodeWeavers
 GroupMap contrib/gitdm/group-map-facebook Facebook
+GroupMap contrib/gitdm/group-map-huawei Huawei
 GroupMap contrib/gitdm/group-map-ibm IBM
 GroupMap contrib/gitdm/group-map-janustech Janus Technologies
 GroupMap contrib/gitdm/group-map-netflix Netflix

From 9b6ceb68550a758cc7557ec5b49ddd413ed779c4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:46 +0000
Subject: [PATCH 2231/2396] contrib/gitdm: add group-map for Microsoft
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we do see contributions from the top-level domain we want to
catch the linux.microsoft subdomain and those contributors also post
via other addresses.

Cc: Magnus Kulke <magnuskulke@linux.microsoft.com>
Acked-by: Wei Liu <wei.liu@kernel.org>
Message-ID: <20251119113953.1432303-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/group-map-microsoft | 8 ++++++++
 gitdm.config                      | 1 +
 2 files changed, 9 insertions(+)
 create mode 100644 contrib/gitdm/group-map-microsoft

diff --git a/contrib/gitdm/group-map-microsoft b/contrib/gitdm/group-map-microsoft
new file mode 100644
index 0000000000..989a307b6d
--- /dev/null
+++ b/contrib/gitdm/group-map-microsoft
@@ -0,0 +1,8 @@
+#
+# Some Microsoft contributors post from other emails
+#
+
+# Some posting don't use the main domain
+linux.microsoft.com
+
+wei.liu@kernel.org
diff --git a/gitdm.config b/gitdm.config
index 05a2dad229..8764bf2f9f 100644
--- a/gitdm.config
+++ b/gitdm.config
@@ -39,6 +39,7 @@ GroupMap contrib/gitdm/group-map-facebook Facebook
 GroupMap contrib/gitdm/group-map-huawei Huawei
 GroupMap contrib/gitdm/group-map-ibm IBM
 GroupMap contrib/gitdm/group-map-janustech Janus Technologies
+GroupMap contrib/gitdm/group-map-microsoft Microsoft
 GroupMap contrib/gitdm/group-map-netflix Netflix
 GroupMap contrib/gitdm/group-map-redhat Red Hat
 GroupMap contrib/gitdm/group-map-wavecomp Wave Computing

From b6690596b2d26c3a1e4f698a497059be6c644eac Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:48 +0000
Subject: [PATCH 2232/2396] contrib/gitdm: add University of Tokyo to academic
 group
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

From Akihiko:

  I and my colleagues use QEMU for academic microarchitecture
  researches so it is indeed to appropriate to have an entry here.

Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Message-ID: <20251119113953.1432303-6-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/group-map-academics | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contrib/gitdm/group-map-academics b/contrib/gitdm/group-map-academics
index 082458e1bd..40865b01cd 100644
--- a/contrib/gitdm/group-map-academics
+++ b/contrib/gitdm/group-map-academics
@@ -25,3 +25,6 @@ iscas.ac.cn
 
 # Université Grenoble Alpes
 univ-grenoble-alpes.fr
+
+# University of Tokyo
+u-tokyo.ac.jp

From 93d39daebe007932c6d877f103d3abbe6ba20e7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:49 +0000
Subject: [PATCH 2233/2396] contrib/gitdm: add mapping for Eviden
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reviewed-by: Clement Mathieu--Drif <clement.mathieu--drif@eviden.com>
Message-ID: <20251119113953.1432303-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/domain-map | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/gitdm/domain-map b/contrib/gitdm/domain-map
index bf1dce03fd..4e67c3e484 100644
--- a/contrib/gitdm/domain-map
+++ b/contrib/gitdm/domain-map
@@ -19,6 +19,7 @@ crudebyte.com   Crudebyte
 chinatelecom.cn China Telecom
 daynix.com      Daynix
 eldorado.org.br Instituto de Pesquisas Eldorado
+eviden.com      Eviden
 fb.com          Facebook
 fujitsu.com     Fujitsu
 google.com      Google

From e4799403d1a55b71d57f8db0284898ac4794e2ff Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:50 +0000
Subject: [PATCH 2234/2396] contrib/gitdm: add mapping for Nutanix
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have a number of hackers from Nutanix, make sure they are grouped
together.

Reviewed-by: Jon Kohler <jon@nutanix.com>
Reviewed-by: John Levon <john.levon@nutanix.com>
Message-ID: <20251119113953.1432303-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/domain-map | 1 +
 1 file changed, 1 insertion(+)

diff --git a/contrib/gitdm/domain-map b/contrib/gitdm/domain-map
index 4e67c3e484..c07dffc51b 100644
--- a/contrib/gitdm/domain-map
+++ b/contrib/gitdm/domain-map
@@ -35,6 +35,7 @@ lwn.net         LWN
 microsoft.com   Microsoft
 mvista.com      MontaVista
 nokia.com       Nokia
+nutanix.com     Nutanix
 nuviainc.com    NUVIA
 nvidia.com      NVIDIA
 oracle.com      Oracle

From f5b6ca5606f8a1ed29a127847932fa2bc237ae38 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 19 Nov 2025 11:39:52 +0000
Subject: [PATCH 2235/2396] contrib/gitdm: add more individual contributors
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I only add names explicitly acked as individual contributors.

Acked-by: Sean Wei <me@sean.taipei>
Acked-by: William Kosasih <kosasihwilliam4@gmail.com>
Message-ID: <20251119113953.1432303-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/gitdm/group-map-individuals | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/contrib/gitdm/group-map-individuals b/contrib/gitdm/group-map-individuals
index d7116f5444..4f4645a84c 100644
--- a/contrib/gitdm/group-map-individuals
+++ b/contrib/gitdm/group-map-individuals
@@ -42,3 +42,6 @@ shentey@gmail.com
 bmeng@tinylab.org
 strahinja.p.jankovic@gmail.com
 Jason@zx2c4.com
+amarjargal16@gmail.com
+me@sean.taipei
+kosasihwilliam4@gmail.com

From 697ccce3c50145a82e6f754cc8fc75b209f241ba Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Wed, 19 Nov 2025 21:37:59 +0100
Subject: [PATCH 2236/2396] hw/arm/Kconfig: Exclude imx8mp-evk machine from
 KVM-only build

Fixes make check failures on an aarch64 host when QEMU is configured
using '--enable-kvm --disable-tcg':
  qemu-system-aarch64: unknown type 'arm-gicv3'

Reported-by: Cornelia Huck <cohuck@redhat.com>
Tested-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Message-id: 20251119203759.5138-1-shentey@gmail.com
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index 0cdeb60f1f..7877506384 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -623,7 +623,7 @@ config FSL_IMX8MP_EVK
     bool
     default y
     depends on AARCH64
-    depends on TCG || KVM
+    depends on TCG
     select FSL_IMX8MP
 
 config ARM_SMMUV3

From fa9d9f6b71c9412c96a8adc92402c78a01049bd1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Fri, 21 Nov 2025 10:35:09 +0100
Subject: [PATCH 2237/2396] hw/display/exynos4210_fimd: Remove duplicated
 definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

FIMD_VIDWADD0_END is defined twice, keep only one.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251121093509.25088-1-philmd@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/display/exynos4210_fimd.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index c61e0280a7..6b1eb43987 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -131,7 +131,6 @@
 /* Frame buffer address registers */
 #define FIMD_VIDWADD0_START         0x00A0
 #define FIMD_VIDWADD0_END           0x00C4
-#define FIMD_VIDWADD0_END           0x00C4
 #define FIMD_VIDWADD1_START         0x00D0
 #define FIMD_VIDWADD1_END           0x00F4
 #define FIMD_VIDWADD2_START         0x0100

From 4a934d284dfac9fa19b0f47874f12d9b3519c21c Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 14 Nov 2025 15:53:04 +0000
Subject: [PATCH 2238/2396] hw/arm/armv7m: Disable reentrancy guard for
 v7m_sysreg_ns_ops MRs
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

For M-profile cores which support TrustZone, there are some memory
areas which are "NS aliases" -- a Secure access to these addresses
really performs an NS access to a different part of the device.  We
implement these using MemoryRegionOps read and write functions which
pass the access on with adjusted attributes using
memory_region_dispatch_read() and memory_region_dispatch_write().

Since the MR we are dispatching to is owned by the same device that
owns the NS-alias MR (the TYPE_ARMV7M container object), this trips
the reentrancy-guard that is applied by access_with_adjusted_size().

Mark the NS alias MemoryRegions as disable_reentrancy_guard; this is
safe because v7m_sysreg_ns_read() and v7m_sysreg_ns_write() do not
touch any of the device's state.  (Any further reentrancy attempts by
the underlying MR will still be caught.)

Without this fix, an attempt to read from an address like 0xe002e010,
which is a register in the NS systick alias, will fail and provoke

 qemu-system-arm: warning: Blocked re-entrant IO on MemoryRegion: v7m_systick at addr: 0x0

We didn't notice this earlier because almost all code accesses
the registers and systick via the non-alias addresses; the NS
aliases are only need for the rarer case of Secure code that needs
to manage the NS timer or system state on behalf of NS code.

Note that although the v7m_systick_ops read and write functions
also call memory_region_dispatch_{read,write}, this MR does not
need to have the reentrancy-guard disabled because the underlying
MR that it forwards to is owned by a different device (the
TYPE_SYSTICK timer device).

Reported via a stackoverflow question:
https://stackoverflow.com/questions/79808107/what-this-error-is-even-about-qemu-system-arm-warning-blocked-re-entrant-io

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251114155304.2662414-1-peter.maydell@linaro.org
---
 hw/arm/armv7m.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index c4a9c3ac52..7fa1b37630 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -442,6 +442,12 @@ static void armv7m_realize(DeviceState *dev, Error **errp)
                               &v7m_sysreg_ns_ops,
                               sysbus_mmio_get_region(sbd, 0),
                               "nvic_sysregs_ns", 0x1000);
+        /*
+         * This MR calls memory_region_dispatch_read/write to access the
+         * real region for the NVIC sysregs (which is also owned by this
+         * device), so reentrancy through here is expected and safe.
+         */
+        s->sysreg_ns_mem.disable_reentrancy_guard = true;
         memory_region_add_subregion(&s->container, 0xe002e000,
                                     &s->sysreg_ns_mem);
     }
@@ -499,6 +505,12 @@ static void armv7m_realize(DeviceState *dev, Error **errp)
         memory_region_init_io(&s->systick_ns_mem, OBJECT(s),
                               &v7m_sysreg_ns_ops, &s->systickmem,
                               "v7m_systick_ns", 0xe0);
+        /*
+         * This MR calls memory_region_dispatch_read/write to access the
+         * real region for the systick regs (which is also owned by this
+         * device), so reentrancy through here is expected and safe.
+         */
+        s->systick_ns_mem.disable_reentrancy_guard = true;
         memory_region_add_subregion_overlap(&s->container, 0xe002e010,
                                             &s->systick_ns_mem, 1);
     }

From 579be921f509fb9d2deccc4233496e36b221abb3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 7 Nov 2025 14:39:13 +0000
Subject: [PATCH 2239/2396] hw/display/exynos4210_fimd: Account for zero length
 in fimd_update_memory_section()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In fimd_update_memory_section() we attempt ot find and map part of
the RAM MR which backs the framebuffer, based on guest-configurable
size and start address.

If the guest configures framebuffer settings which result in a
zero-sized framebuffer, we hit an assertion(), because
memory_region_find() will return a NULL mem_section.mr.

Explicitly check for the zero-size case and treat this as a
guest error.

Because we now have a code path which can reach error_return without
calling memory_region_find to set w->mem_section, we must NULL out
w->mem_section.mr after the unref of the old MR, so that error_return
does not incorrectly double-unref the old MR.

Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1407
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251107143913.1341358-1-peter.maydell@linaro.org
---
 hw/display/exynos4210_fimd.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/display/exynos4210_fimd.c b/hw/display/exynos4210_fimd.c
index 6b1eb43987..49c180fec0 100644
--- a/hw/display/exynos4210_fimd.c
+++ b/hw/display/exynos4210_fimd.c
@@ -1146,6 +1146,13 @@ static void fimd_update_memory_section(Exynos4210fimdState *s, unsigned win)
     if (w->mem_section.mr) {
         memory_region_set_log(w->mem_section.mr, false, DIRTY_MEMORY_VGA);
         memory_region_unref(w->mem_section.mr);
+        w->mem_section.mr = NULL;
+    }
+
+    if (w->fb_len == 0) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "FIMD: Guest config means framebuffer is zero length\n");
+        goto error_return;
     }
 
     w->mem_section = memory_region_find(s->fbmem, fb_start_addr, w->fb_len);

From 4be62d311791bf9d318f5139439d170ad5112279 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
Date: Mon, 27 Oct 2025 16:47:11 +0400
Subject: [PATCH 2240/2396] ui/vdagent: fix windows agent regression
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit f626116f ("ui/vdagent: factor out clipboard peer
registration"), the QEMU clipboard serial is reset whenever the vdagent
chardev receives the guest caps. This triggers a CHR_EVENT_CLOSED which
is handled by virtio_serial_close() to notify the guest.

The "reconnection logic" is there to reset the agent when a
client (dbus, spice etc) reconnects, or the agent is restarted.
It is required to sync the clipboard serials and to prevent races or
loops due to clipboard managers on both ends (but this is not
implemented by windows vdagent).

The Unix agent has been reconnecting without resending caps, thus
working with this approach.

However, the Windows agent does not seem to have a way to handle
VIRTIO_CONSOLE_PORT_OPEN=0 event and do not receive further data...

Let's not trigger this disconnection/reset logic if the agent does not
support VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL.

Fixes: f626116f ("ui/vdagent: factor out clipboard peer registration")
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reported-by: Lucas Kornicki <lucas.kornicki@nutanix.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Tested-by: Lucas Kornicki <lucas.kornicki@nutanix.com>
---
 ui/vdagent.c | 20 ++++++++++++++------
 1 file changed, 14 insertions(+), 6 deletions(-)

diff --git a/ui/vdagent.c b/ui/vdagent.c
index ddb91e75c6..660686c9c0 100644
--- a/ui/vdagent.c
+++ b/ui/vdagent.c
@@ -316,6 +316,15 @@ static bool have_selection(VDAgentChardev *vd)
     return vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_SELECTION);
 }
 
+static bool have_clipboard_serial(VDAgentChardev *vd)
+{
+#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
+    return vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL);
+#else
+    return false;
+#endif
+}
+
 static uint32_t type_qemu_to_vdagent(enum QemuClipboardType type)
 {
     switch (type) {
@@ -345,8 +354,7 @@ static void vdagent_send_clipboard_grab(VDAgentChardev *vd,
         return;
     }
 
-#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
-    if (vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL)) {
+    if (have_clipboard_serial(vd)) {
         if (!info->has_serial) {
             /* client should win */
             info->serial = vd->last_serial[info->selection]++;
@@ -356,7 +364,6 @@ static void vdagent_send_clipboard_grab(VDAgentChardev *vd,
         data++;
         msg->size += sizeof(uint32_t);
     }
-#endif
 
     for (q = 0; q < QEMU_CLIPBOARD_TYPE__COUNT; q++) {
         type = type_qemu_to_vdagent(q);
@@ -464,6 +471,9 @@ static void vdagent_clipboard_reset_serial(VDAgentChardev *vd)
 {
     Chardev *chr = CHARDEV(vd);
 
+    if (!have_clipboard_serial(vd)) {
+        return;
+    }
     /* reopen the agent connection to reset the serial state */
     qemu_chr_be_event(chr, CHR_EVENT_CLOSED);
     /* OPENED again after the guest disconnected, see set_fe_open */
@@ -518,8 +528,7 @@ static void vdagent_clipboard_recv_grab(VDAgentChardev *vd, uint8_t s, uint32_t
 
     trace_vdagent_cb_grab_selection(GET_NAME(sel_name, s));
     info = qemu_clipboard_info_new(&vd->cbpeer, s);
-#if CHECK_SPICE_PROTOCOL_VERSION(0, 14, 1)
-    if (vd->caps & (1 << VD_AGENT_CAP_CLIPBOARD_GRAB_SERIAL)) {
+    if (have_clipboard_serial(vd)) {
         if (size < sizeof(uint32_t)) {
             /* this shouldn't happen! */
             return;
@@ -537,7 +546,6 @@ static void vdagent_clipboard_recv_grab(VDAgentChardev *vd, uint8_t s, uint32_t
         data += sizeof(uint32_t);
         size -= sizeof(uint32_t);
     }
-#endif
     if (size > sizeof(uint32_t) * 10) {
         /*
          * spice has 6 types as of 2021. Limiting to 10 entries

From 313f6884c8cd585756df6cc87692e434157c87f1 Mon Sep 17 00:00:00 2001
From: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Date: Tue, 14 Oct 2025 17:50:28 +0300
Subject: [PATCH 2241/2396] chardev/char-file: fix failure path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

'in' will be -1 when file->in is unset. Let's not try to close
invalid fd.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Coverity: CID 1630444
Fixes: 69620c091d62f "chardev: qemu_chr_open_fd(): add errp"
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251014145029.949285-1-vsementsov@yandex-team.ru>
---
 chardev/char-file.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/chardev/char-file.c b/chardev/char-file.c
index 89e9cb849c..1f7adf592f 100644
--- a/chardev/char-file.c
+++ b/chardev/char-file.c
@@ -94,7 +94,9 @@ static void qmp_chardev_open_file(Chardev *chr,
 
     if (!qemu_chr_open_fd(chr, in, out, errp)) {
         qemu_close(out);
-        qemu_close(in);
+        if (in >= 0) {
+            qemu_close(in);
+        }
         return;
     }
 #endif

From 303f6049358e2ef35f2b107d6bd1a5be07ec35e9 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Wed, 22 Oct 2025 17:07:39 +0200
Subject: [PATCH 2242/2396] chardev/char-pty: Do not ignore chr_write()
 failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251022150743.78183-6-philmd@linaro.org>
---
 chardev/char-pty.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/chardev/char-pty.c b/chardev/char-pty.c
index b066f01412..652b0bd9e7 100644
--- a/chardev/char-pty.c
+++ b/chardev/char-pty.c
@@ -125,7 +125,7 @@ static int char_pty_chr_write(Chardev *chr, const uint8_t *buf, int len)
     rc = RETRY_ON_EINTR(g_poll(&pfd, 1, 0));
     g_assert(rc >= 0);
     if (!(pfd.revents & G_IO_HUP) && (pfd.revents & G_IO_OUT)) {
-        io_channel_send(s->ioc, buf, len);
+        return io_channel_send(s->ioc, buf, len);
     }
 
     return len;

From 3050b349214568172776e3cc45c0455e42af741c Mon Sep 17 00:00:00 2001
From: Klaus Jensen <k.jensen@samsung.com>
Date: Tue, 4 Nov 2025 11:51:45 +0100
Subject: [PATCH 2243/2396] hw/nvme: fix namespace atomic parameter setup

Coverity complains about a possible copy-paste error in the verification
of the namespace atomic parameters (CID 1642811). While the check is
correct, the code (and the intention) is unclear.

Fix this by reworking how the parameters are verified. Peter also
identified that the realize function was not correctly erroring out if
parameters were misconfigured, so fix that too.

Lastly, change the error messages to be more describing.

Coverity: CID 1642811
Fixes: bce51b83709b ("hw/nvme: add atomic boundary support")
Fixes: 3b41acc96299 ("hw/nvme: enable ns atomic writes")
Reviewed-by: Jesper Wendel Devantier <foss@defmacro.it>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c       | 115 +++++++++++++-------------
 hw/nvme/ns.c         | 189 ++++++++++++++++++++++++++-----------------
 hw/nvme/nvme.h       |  25 +++---
 include/block/nvme.h |   2 +-
 4 files changed, 185 insertions(+), 146 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 4d150c7206..901d4d8633 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -6524,6 +6524,53 @@ static uint16_t nvme_set_feature_fdp_events(NvmeCtrl *n, NvmeNamespace *ns,
     return NVME_SUCCESS;
 }
 
+void nvme_atomic_configure_max_write_size(bool dn, uint16_t awun,
+                                          uint16_t awupf, NvmeAtomic *atomic)
+{
+    atomic->atomic_max_write_size = (dn ? awupf : awun) + 1;
+
+    if (atomic->atomic_max_write_size > 1) {
+        atomic->atomic_writes = 1;
+    }
+}
+
+static uint16_t nvme_set_feature_write_atomicity(NvmeCtrl *n, NvmeRequest *req)
+{
+    NvmeCmd *cmd = &req->cmd;
+
+    uint32_t dw11 = le32_to_cpu(cmd->cdw11);
+
+    uint16_t awun = le16_to_cpu(n->id_ctrl.awun);
+    uint16_t awupf = le16_to_cpu(n->id_ctrl.awupf);
+
+    n->dn = dw11 & 0x1;
+
+    nvme_atomic_configure_max_write_size(n->dn, awun, awupf, &n->atomic);
+
+    for (int i = 1; i <= NVME_MAX_NAMESPACES; i++) {
+        uint16_t nawun, nawupf, nabsn, nabspf;
+
+        NvmeNamespace *ns = nvme_ns(n, i);
+        if (!ns) {
+            continue;
+        }
+
+        nawun = le16_to_cpu(ns->id_ns.nawun);
+        nawupf = le16_to_cpu(ns->id_ns.nawupf);
+
+        nvme_atomic_configure_max_write_size(n->dn, nawun, nawupf,
+                                             &ns->atomic);
+
+        nabsn = le16_to_cpu(ns->id_ns.nabsn);
+        nabspf = le16_to_cpu(ns->id_ns.nabspf);
+
+        nvme_ns_atomic_configure_boundary(n->dn, nabsn, nabspf,
+                                          &ns->atomic);
+    }
+
+    return NVME_SUCCESS;
+}
+
 static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
 {
     NvmeNamespace *ns = NULL;
@@ -6536,8 +6583,6 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
     uint8_t save = NVME_SETFEAT_SAVE(dw10);
     uint16_t status;
     int i;
-    NvmeIdCtrl *id = &n->id_ctrl;
-    NvmeAtomic *atomic = &n->atomic;
 
     trace_pci_nvme_setfeat(nvme_cid(req), nsid, fid, save, dw11);
 
@@ -6691,50 +6736,7 @@ static uint16_t nvme_set_feature(NvmeCtrl *n, NvmeRequest *req)
     case NVME_FDP_EVENTS:
         return nvme_set_feature_fdp_events(n, ns, req);
     case NVME_WRITE_ATOMICITY:
-
-        n->dn = 0x1 & dw11;
-
-        if (n->dn) {
-            atomic->atomic_max_write_size = le16_to_cpu(id->awupf) + 1;
-        } else {
-            atomic->atomic_max_write_size = le16_to_cpu(id->awun) + 1;
-        }
-
-        if (atomic->atomic_max_write_size == 1) {
-            atomic->atomic_writes = 0;
-        } else {
-            atomic->atomic_writes = 1;
-        }
-        for (i = 1; i <= NVME_MAX_NAMESPACES; i++) {
-            ns = nvme_ns(n, i);
-            if (ns && ns->atomic.atomic_writes) {
-                if (n->dn) {
-                    ns->atomic.atomic_max_write_size =
-                        le16_to_cpu(ns->id_ns.nawupf) + 1;
-                    if (ns->id_ns.nabspf) {
-                        ns->atomic.atomic_boundary =
-                            le16_to_cpu(ns->id_ns.nabspf) + 1;
-                    } else {
-                        ns->atomic.atomic_boundary = 0;
-                    }
-                } else {
-                    ns->atomic.atomic_max_write_size =
-                        le16_to_cpu(ns->id_ns.nawun) + 1;
-                    if (ns->id_ns.nabsn) {
-                        ns->atomic.atomic_boundary =
-                            le16_to_cpu(ns->id_ns.nabsn) + 1;
-                    } else {
-                        ns->atomic.atomic_boundary = 0;
-                    }
-                }
-                if (ns->atomic.atomic_max_write_size == 1) {
-                    ns->atomic.atomic_writes = 0;
-                } else {
-                    ns->atomic.atomic_writes = 1;
-                }
-            }
-        }
-        break;
+        return nvme_set_feature_write_atomicity(n, req);
     default:
         return NVME_FEAT_NOT_CHANGEABLE | NVME_DNR;
     }
@@ -7669,6 +7671,10 @@ static int nvme_atomic_boundary_check(NvmeCtrl *n, NvmeCmd *cmd,
 
         imask = ~(atomic->atomic_boundary - 1);
         if ((slba & imask) != (elba & imask)) {
+            /*
+             * The write crosses an atomic boundary and the controller provides
+             * no atomicity guarantees unless AWUN/AWUPF are non-zero.
+             */
             if (n->atomic.atomic_max_write_size &&
                 ((nlb + 1) <= n->atomic.atomic_max_write_size)) {
                 return 1;
@@ -8709,7 +8715,6 @@ static void nvme_init_state(NvmeCtrl *n)
     NvmeSecCtrlEntry *list = n->sec_ctrl_list;
     NvmeSecCtrlEntry *sctrl;
     PCIDevice *pci = PCI_DEVICE(n);
-    NvmeAtomic *atomic = &n->atomic;
     NvmeIdCtrl *id = &n->id_ctrl;
     uint8_t max_vfs;
     int i;
@@ -8781,19 +8786,9 @@ static void nvme_init_state(NvmeCtrl *n)
             id->awupf = 0;
         }
 
-        if (n->dn) {
-            atomic->atomic_max_write_size = id->awupf + 1;
-        } else {
-            atomic->atomic_max_write_size = id->awun + 1;
-        }
-
-        if (atomic->atomic_max_write_size == 1) {
-            atomic->atomic_writes = 0;
-        } else {
-            atomic->atomic_writes = 1;
-        }
-        atomic->atomic_boundary = 0;
-        atomic->atomic_nabo = 0;
+        nvme_atomic_configure_max_write_size(n->dn, n->params.atomic_awun,
+                                             n->params.atomic_awupf,
+                                             &n->atomic);
     }
 }
 
diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 86f5ab0a75..253e7b406b 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -718,85 +718,119 @@ static void nvme_ns_unrealize(DeviceState *dev)
     nvme_ns_cleanup(ns);
 }
 
+void nvme_ns_atomic_configure_boundary(bool dn, uint16_t nabsn,
+                                       uint16_t nabspf, NvmeAtomic *atomic)
+{
+    atomic->atomic_boundary = dn ? nabspf : nabsn;
+
+    if (atomic->atomic_boundary > 0) {
+        atomic->atomic_boundary += 1;
+    }
+}
+
+static bool nvme_ns_set_nab(NvmeCtrl *n, NvmeNamespace *ns, Error **errp)
+{
+    NvmeIdNs *id_ns = &ns->id_ns;
+    NvmeIdCtrl *id_ctrl = &n->id_ctrl;
+
+    uint16_t nabsn = ns->params.atomic.nabsn;
+    uint16_t nabspf = ns->params.atomic.nabspf;
+    uint16_t nabo = ns->params.atomic.nabo;
+
+    if (nabsn && nabsn < le16_to_cpu(id_ctrl->awun)) {
+        error_setg(errp, "nabsn must be greater than or equal to awun");
+        return false;
+    }
+
+    if (nabspf && nabspf < le16_to_cpu(id_ctrl->awupf)) {
+        error_setg(errp, "nabspf must be greater than or equal to awupf");
+        return false;
+    }
+
+    if (id_ns->nsfeat & NVME_ID_NS_NSFEAT_NSABP) {
+        if (nabsn && nabsn < le16_to_cpu(id_ns->nawun)) {
+            error_setg(errp, "nabsn must be greater than or equal to nawun");
+            return false;
+        }
+
+        if (nabspf && nabspf < le16_to_cpu(id_ns->nawupf)) {
+            error_setg(errp, "nabspf must be great than or equal to nawupf");
+            return false;
+        }
+    }
+
+    if (nabo && (nabo > nabsn || nabo > nabspf)) {
+        error_setg(errp, "nabo must be less than or equal to nabsn and nabspf");
+        return false;
+    }
+
+    id_ns->nabsn = cpu_to_le16(nabsn);
+    id_ns->nabspf = cpu_to_le16(nabspf);
+    id_ns->nabo = cpu_to_le16(nabo);
+
+    ns->atomic.atomic_nabo = nabo;
+
+    nvme_ns_atomic_configure_boundary(n->dn, nabsn, nabspf, &ns->atomic);
+
+    return true;
+}
+
+static bool nvme_ns_set_nsabp(NvmeCtrl *n, NvmeNamespace *ns, Error **errp)
+{
+    NvmeIdNs *id_ns = &ns->id_ns;
+    NvmeIdCtrl *id_ctrl = &n->id_ctrl;
+
+    uint16_t awun = le16_to_cpu(id_ctrl->awun);
+    uint16_t awupf = le16_to_cpu(id_ctrl->awupf);
+
+    uint16_t nawun = ns->params.atomic.nawun;
+    uint16_t nawupf = ns->params.atomic.nawupf;
+
+    if (nawupf > nawun) {
+        if (nawun == 0) {
+            nawun = nawupf;
+        } else {
+            error_setg(errp, "nawupf must be less than or equal to nawun");
+            return false;
+        }
+    }
+
+    /* neither nawun or nawupf is set */
+    if (nawun == 0) {
+        return true;
+    }
+
+    if (nawun < awun) {
+        error_setg(errp, "nawun must be greater than or equal to awun");
+        return false;
+    }
+
+    if (nawupf < awupf) {
+        error_setg(errp, "nawupf must be greater than or equal to awupf");
+        return false;
+    }
+
+    id_ns->nsfeat |= NVME_ID_NS_NSFEAT_NSABP;
+
+    id_ns->nawun = cpu_to_le16(nawun);
+    id_ns->nawupf = cpu_to_le16(nawupf);
+
+    nvme_atomic_configure_max_write_size(n->dn, nawun, nawupf, &ns->atomic);
+
+    return true;
+}
+
 static void nvme_ns_realize(DeviceState *dev, Error **errp)
 {
     NvmeNamespace *ns = NVME_NS(dev);
     BusState *s = qdev_get_parent_bus(dev);
     NvmeCtrl *n = NVME(s->parent);
     NvmeSubsystem *subsys = n->subsys;
-    NvmeIdCtrl *id = &n->id_ctrl;
-    NvmeIdNs *id_ns = &ns->id_ns;
     uint32_t nsid = ns->params.nsid;
     int i;
 
     assert(subsys);
 
-    /* Set atomic write parameters */
-    if (ns->params.atomic_nsfeat) {
-        id_ns->nsfeat |= NVME_ID_NS_NSFEAT_NSABPNS;
-        id_ns->nawun = cpu_to_le16(ns->params.atomic_nawun);
-        if (!id->awupf || (id_ns->nawun && (id_ns->nawun < id->awun))) {
-            error_report("Invalid NAWUN: %x AWUN=%x", id_ns->nawun, id->awun);
-        }
-        id_ns->nawupf = cpu_to_le16(ns->params.atomic_nawupf);
-        if (!id->awupf || (id_ns->nawupf && (id_ns->nawupf < id->awupf))) {
-            error_report("Invalid NAWUPF: %x AWUPF=%x",
-                id_ns->nawupf, id->awupf);
-        }
-        if (id_ns->nawupf > id_ns->nawun) {
-            error_report("Invalid: NAWUN=%x NAWUPF=%x",
-                id_ns->nawun, id_ns->nawupf);
-        }
-        id_ns->nabsn = cpu_to_le16(ns->params.atomic_nabsn);
-        id_ns->nabspf = cpu_to_le16(ns->params.atomic_nabspf);
-        id_ns->nabo = cpu_to_le16(ns->params.atomic_nabo);
-        if (!id->awun || (id_ns->nabsn && ((id_ns->nabsn < id_ns->nawun) ||
-            (id_ns->nabsn < id->awun)))) {
-            error_report("Invalid NABSN: %x NAWUN=%x AWUN=%x",
-                id_ns->nabsn, id_ns->nawun, id->awun);
-        }
-        if (!id->awupf || (id_ns->nabspf && ((id_ns->nabspf < id_ns->nawupf) ||
-            (id_ns->nawupf < id->awupf)))) {
-            error_report("Invalid NABSPF: %x NAWUPF=%x AWUPF=%x",
-                id_ns->nabspf, id_ns->nawupf, id->awupf);
-        }
-        if (id_ns->nabo && ((id_ns->nabo > id_ns->nabsn) ||
-            (id_ns->nabo > id_ns->nabspf))) {
-            error_report("Invalid NABO: %x NABSN=%x NABSPF=%x",
-                id_ns->nabo, id_ns->nabsn, id_ns->nabspf);
-        }
-        if (id_ns->nawupf > id_ns->nawun) {
-            error_report("Invalid: NAWUN=%x NAWUPF=%x", id_ns->nawun,
-                id_ns->nawupf);
-        }
-    }
-
-    if (id_ns->nawun || id_ns->nawupf) {
-        NvmeAtomic *atomic = &ns->atomic;
-
-        if (n->dn) {
-            atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawupf) + 1;
-            if (id_ns->nabspf) {
-                atomic->atomic_boundary = cpu_to_le16(id_ns->nabspf) + 1;
-            } else {
-                atomic->atomic_boundary = 0;
-            }
-        } else {
-            atomic->atomic_max_write_size = cpu_to_le16(id_ns->nawun) + 1;
-            if (id_ns->nabsn) {
-                atomic->atomic_boundary = cpu_to_le16(id_ns->nabsn) + 1;
-            } else {
-                atomic->atomic_boundary = 0;
-            }
-        }
-        if (atomic->atomic_max_write_size == 1) {
-            atomic->atomic_writes = 0;
-        } else {
-            atomic->atomic_writes = 1;
-        }
-        atomic->atomic_nabo = cpu_to_le16(id_ns->nabo);
-    }
-
     /* reparent to subsystem bus */
     if (!qdev_set_parent_bus(dev, &subsys->bus.parent_bus, errp)) {
         return;
@@ -804,6 +838,14 @@ static void nvme_ns_realize(DeviceState *dev, Error **errp)
     ns->subsys = subsys;
     ns->endgrp = &subsys->endgrp;
 
+    if (!nvme_ns_set_nsabp(n, ns, errp)) {
+        return;
+    }
+
+    if (!nvme_ns_set_nab(n, ns, errp)) {
+        return;
+    }
+
     if (nvme_ns_setup(ns, errp)) {
         return;
     }
@@ -872,12 +914,11 @@ static const Property nvme_ns_props[] = {
     DEFINE_PROP_BOOL("eui64-default", NvmeNamespace, params.eui64_default,
                      false),
     DEFINE_PROP_STRING("fdp.ruhs", NvmeNamespace, params.fdp.ruhs),
-    DEFINE_PROP_UINT16("atomic.nawun", NvmeNamespace, params.atomic_nawun, 0),
-    DEFINE_PROP_UINT16("atomic.nawupf", NvmeNamespace, params.atomic_nawupf, 0),
-    DEFINE_PROP_UINT16("atomic.nabspf", NvmeNamespace, params.atomic_nabspf, 0),
-    DEFINE_PROP_UINT16("atomic.nabsn", NvmeNamespace, params.atomic_nabsn, 0),
-    DEFINE_PROP_UINT16("atomic.nabo", NvmeNamespace, params.atomic_nabo, 0),
-    DEFINE_PROP_BOOL("atomic.nsfeat", NvmeNamespace, params.atomic_nsfeat, 0),
+    DEFINE_PROP_UINT16("atomic.nawun", NvmeNamespace, params.atomic.nawun, 0),
+    DEFINE_PROP_UINT16("atomic.nawupf", NvmeNamespace, params.atomic.nawupf, 0),
+    DEFINE_PROP_UINT16("atomic.nabsn", NvmeNamespace, params.atomic.nabsn, 0),
+    DEFINE_PROP_UINT16("atomic.nabspf", NvmeNamespace, params.atomic.nabspf, 0),
+    DEFINE_PROP_UINT16("atomic.nabo", NvmeNamespace, params.atomic.nabo, 0),
 };
 
 static void nvme_ns_class_init(ObjectClass *oc, const void *data)
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index a7d225d2d8..8f8c78c850 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -218,12 +218,14 @@ typedef struct NvmeNamespaceParams {
     struct {
         char *ruhs;
     } fdp;
-    uint16_t atomic_nawun;
-    uint16_t atomic_nawupf;
-    uint16_t atomic_nabsn;
-    uint16_t atomic_nabspf;
-    uint16_t atomic_nabo;
-    bool     atomic_nsfeat;
+
+    struct {
+        uint16_t nawun;
+        uint16_t nawupf;
+        uint16_t nabsn;
+        uint16_t nabspf;
+        uint16_t nabo;
+    } atomic;
 } NvmeNamespaceParams;
 
 typedef struct NvmeAtomic {
@@ -288,11 +290,7 @@ typedef struct NvmeNamespace {
         /* reclaim unit handle identifiers indexed by placement handle */
         uint16_t *phs;
     } fdp;
-    uint16_t  atomic_nawun;
-    uint16_t  atomic_nawupf;
-    uint16_t  atomic_nabsn;
-    uint16_t  atomic_nabspf;
-    uint16_t  atomic_nabo;
+
     NvmeAtomic  atomic;
 } NvmeNamespace;
 
@@ -742,4 +740,9 @@ void nvme_rw_complete_cb(void *opaque, int ret);
 uint16_t nvme_map_dptr(NvmeCtrl *n, NvmeSg *sg, size_t len,
                        NvmeCmd *cmd);
 
+void nvme_atomic_configure_max_write_size(bool dn, uint16_t awun,
+                                          uint16_t awupf, NvmeAtomic *atomic);
+void nvme_ns_atomic_configure_boundary(bool dn, uint16_t nabsn,
+                                       uint16_t nabspf, NvmeAtomic *atomic);
+
 #endif /* HW_NVME_NVME_H */
diff --git a/include/block/nvme.h b/include/block/nvme.h
index 9fa2ecaf28..8640dfa826 100644
--- a/include/block/nvme.h
+++ b/include/block/nvme.h
@@ -1589,7 +1589,7 @@ enum NvmeIdNsMc {
 
 enum NvmeIdNsNsfeat {
     NVME_ID_NS_NSFEAT_THINP         = 1 << 0,
-    NVME_ID_NS_NSFEAT_NSABPNS       = 1 << 1,
+    NVME_ID_NS_NSFEAT_NSABP         = 1 << 1,
     NVME_ID_NS_NSFEAT_DAE           = 1 << 2,
     NVME_ID_NS_NSFEAT_UIDREUSE      = 1 << 3,
     NVME_ID_NS_NSFEAT_OPTPERF_ALL   = 3 << 4,

From cf6a1592f17c79f639f0a3ab9bcc72cdbb8ab88b Mon Sep 17 00:00:00 2001
From: Keith Busch <kbusch@kernel.org>
Date: Wed, 19 Nov 2025 17:53:35 -0800
Subject: [PATCH 2244/2396] hw/nvme: fix up extended protection information
 format

Set the protection information format (pif) only in the formats that can
support the larger guard types, and update the current in-use format
information when the user changes it.

Signed-off-by: Keith Busch <kbusch@kernel.org>
[k.jensen: fix missing braces and wrong indentation]
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ns.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 253e7b406b..58800b3414 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -32,11 +32,13 @@ void nvme_ns_init_format(NvmeNamespace *ns)
     NvmeIdNs *id_ns = &ns->id_ns;
     NvmeIdNsNvm *id_ns_nvm = &ns->id_ns_nvm;
     BlockDriverInfo bdi;
-    int npdg, ret;
+    int npdg, ret, index;
     int64_t nlbas;
 
+    index = NVME_ID_NS_FLBAS_INDEX(id_ns->flbas);
     ns->lbaf = id_ns->lbaf[NVME_ID_NS_FLBAS_INDEX(id_ns->flbas)];
     ns->lbasz = 1 << ns->lbaf.ds;
+    ns->pif = NVME_ID_NS_NVM_ELBAF_PIF(ns->id_ns_nvm.elbaf[index]);
 
     nlbas = ns->size / (ns->lbasz + ns->lbaf.ms);
 
@@ -112,8 +114,6 @@ static int nvme_ns_init(NvmeNamespace *ns, Error **errp)
         id_ns->dps |= NVME_ID_NS_DPS_FIRST_EIGHT;
     }
 
-    ns->pif = ns->params.pif;
-
     static const NvmeLBAF defaults[16] = {
         [0] = { .ds =  9           },
         [1] = { .ds =  9, .ms =  8 },
@@ -129,6 +129,12 @@ static int nvme_ns_init(NvmeNamespace *ns, Error **errp)
 
     memcpy(&id_ns->lbaf, &defaults, sizeof(defaults));
 
+    for (i = 0; i < ns->nlbaf; i++) {
+        if (id_ns->lbaf[i].ms >= 16) {
+            id_ns_nvm->elbaf[i] = (ns->params.pif & 0x3) << 7;
+        }
+    }
+
     for (i = 0; i < ns->nlbaf; i++) {
         NvmeLBAF *lbaf = &id_ns->lbaf[i];
         if (lbaf->ds == ds) {
@@ -142,13 +148,14 @@ static int nvme_ns_init(NvmeNamespace *ns, Error **errp)
     /* add non-standard lba format */
     id_ns->lbaf[ns->nlbaf].ds = ds;
     id_ns->lbaf[ns->nlbaf].ms = ms;
+    if (ms >= 16) {
+        id_ns_nvm->elbaf[ns->nlbaf] = (ns->params.pif & 0x3) << 7;
+    }
     ns->nlbaf++;
 
     id_ns->flbas |= i;
 
-
 lbaf_found:
-    id_ns_nvm->elbaf[i] = (ns->pif & 0x3) << 7;
     id_ns->nlbaf = ns->nlbaf - 1;
     nvme_ns_init_format(ns);
 

From bd3ba0d342318a61ce22721322c56205d5f3853c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 24 Nov 2025 05:02:01 +0100
Subject: [PATCH 2245/2396] hw/nvme: Validate PMR memory size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per the PCI spec 3.0, in section 6.2.5.1, "Address Maps":

  A 32-bit register can be implemented to support a single
  memory size that is a power of 2 from 16 bytes to 2 GB.

Add a check in nvme_init_pmr(), returning an error if the
PMR region size is too small; and update the QTest.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Klaus Jensen <k.jensen@samsung.com>
Signed-off-by: Klaus Jensen <k.jensen@samsung.com>
---
 hw/nvme/ctrl.c          | 13 +++++++++++--
 tests/qtest/nvme-test.c |  2 +-
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/hw/nvme/ctrl.c b/hw/nvme/ctrl.c
index 901d4d8633..cc4593cd42 100644
--- a/hw/nvme/ctrl.c
+++ b/hw/nvme/ctrl.c
@@ -8814,10 +8814,15 @@ static void nvme_init_cmb(NvmeCtrl *n, PCIDevice *pci_dev)
     }
 }
 
-static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev)
+static bool nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
 {
     uint32_t pmrcap = ldl_le_p(&n->bar.pmrcap);
 
+    if (memory_region_size(&n->pmr.dev->mr) < 16) {
+        error_setg(errp, "PMR device must have at least 16 bytes");
+        return false;
+    }
+
     NVME_PMRCAP_SET_RDS(pmrcap, 1);
     NVME_PMRCAP_SET_WDS(pmrcap, 1);
     NVME_PMRCAP_SET_BIR(pmrcap, NVME_PMR_BIR);
@@ -8832,6 +8837,8 @@ static void nvme_init_pmr(NvmeCtrl *n, PCIDevice *pci_dev)
                      PCI_BASE_ADDRESS_MEM_PREFETCH, &n->pmr.dev->mr);
 
     memory_region_set_enabled(&n->pmr.dev->mr, false);
+
+    return true;
 }
 
 static uint64_t nvme_mbar_size(unsigned total_queues, unsigned total_irqs,
@@ -9050,7 +9057,9 @@ static bool nvme_init_pci(NvmeCtrl *n, PCIDevice *pci_dev, Error **errp)
     }
 
     if (n->pmr.dev) {
-        nvme_init_pmr(n, pci_dev);
+        if (!nvme_init_pmr(n, pci_dev, errp)) {
+            return false;
+        }
     }
 
     return true;
diff --git a/tests/qtest/nvme-test.c b/tests/qtest/nvme-test.c
index 5ad6821f7a..4aec1651e6 100644
--- a/tests/qtest/nvme-test.c
+++ b/tests/qtest/nvme-test.c
@@ -149,7 +149,7 @@ static void nvme_register_nodes(void)
         .before_cmd_line = "-drive id=drv0,if=none,file=null-co://,"
                            "file.read-zeroes=on,format=raw "
                            "-object memory-backend-ram,id=pmr0,"
-                           "share=on,size=8",
+                           "share=on,size=16",
     };
 
     add_qpci_address(&opts, &(QPCIAddress) { .devfn = QPCI_DEVFN(4, 0) });

From 4c1646e23f761e3dc6d88c8995f13be8f668a012 Mon Sep 17 00:00:00 2001
From: "AlanoSong@163.com" <AlanoSong@163.com>
Date: Tue, 25 Nov 2025 21:19:55 +0800
Subject: [PATCH 2246/2396] ui/vnc: Fix qemu abort when query vnc info
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When there is no display device on qemu machine,
and user only access qemu by remote vnc.
At the same time user input `info vnc` by QMP,
the qemu will abort.

To avoid the abort above, I add display device check,
when query vnc info in qmp_query_vnc_servers().

Reviewed-by: Marc-AndréLureau <marcandre.lureau@redhat.com>
Signed-off-by: Alano Song <AlanoSong@163.com>
[ Marc-André - removed useless Error *err ]
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251125131955.7024-1-AlanoSong@163.com>
---
 ui/vnc.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/ui/vnc.c b/ui/vnc.c
index 0d499b208b..e6bcf0e1cf 100644
--- a/ui/vnc.c
+++ b/ui/vnc.c
@@ -556,9 +556,12 @@ VncInfo2List *qmp_query_vnc_servers(Error **errp)
         qmp_query_auth(vd->auth, vd->subauth, &info->auth,
                        &info->vencrypt, &info->has_vencrypt);
         if (vd->dcl.con) {
-            dev = DEVICE(object_property_get_link(OBJECT(vd->dcl.con),
-                                                  "device", &error_abort));
-            info->display = g_strdup(dev->id);
+            Object *obj = object_property_get_link(OBJECT(vd->dcl.con),
+                                                   "device", NULL);
+            if (obj) {
+                dev = DEVICE(obj);
+                info->display = g_strdup(dev->id);
+            }
         }
         if (vd->listener != NULL) {
             nsioc = qio_net_listener_nsioc(vd->listener);

From 8eeaa706ba73251063cb80d87ae838d2d5b08e9a Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Wed, 19 Nov 2025 18:27:20 +0100
Subject: [PATCH 2247/2396] block-backend: Fix race when resuming queued
 requests

When new requests arrive at a BlockBackend that is currently drained,
these requests are queued until the drain section ends.

There is a race window between blk_root_drained_end() waking up a queued
request in an iothread from the main thread and blk_wait_while_drained()
actually being woken up in the iothread and calling blk_inc_in_flight().
If the BlockBackend is drained again during this window, drain won't
wait for this request and it will sneak in when the BlockBackend is
already supposed to be quiesced. This causes assertion failures in
bdrv_drain_all_begin() and can have other unintended consequences.

Fix this by increasing the in_flight counter immediately when scheduling
the request to be resumed so that the next drain will wait for it to
complete.

Cc: qemu-stable@nongnu.org
Reported-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251119172720.135424-1-kwolf@redhat.com>
Reviewed-by: Hanna Czenczek <hreitz@redhat.com>
Tested-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/block-backend.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/block/block-backend.c b/block/block-backend.c
index f8d6ba65c1..d6df369188 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -1318,9 +1318,9 @@ static void coroutine_fn blk_wait_while_drained(BlockBackend *blk)
          * section.
          */
         qemu_mutex_lock(&blk->queued_requests_lock);
+        /* blk_root_drained_end() has the corresponding blk_inc_in_flight() */
         blk_dec_in_flight(blk);
         qemu_co_queue_wait(&blk->queued_requests, &blk->queued_requests_lock);
-        blk_inc_in_flight(blk);
         qemu_mutex_unlock(&blk->queued_requests_lock);
     }
 }
@@ -2767,9 +2767,11 @@ static void blk_root_drained_end(BdrvChild *child)
             blk->dev_ops->drained_end(blk->dev_opaque);
         }
         qemu_mutex_lock(&blk->queued_requests_lock);
-        while (qemu_co_enter_next(&blk->queued_requests,
-                                  &blk->queued_requests_lock)) {
+        while (!qemu_co_queue_empty(&blk->queued_requests)) {
             /* Resume all queued requests */
+            blk_inc_in_flight(blk);
+            qemu_co_enter_next(&blk->queued_requests,
+                               &blk->queued_requests_lock);
         }
         qemu_mutex_unlock(&blk->queued_requests_lock);
     }

From 98e788b91ad037193b1fb375561ef7e0fef3c2fd Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 7 Oct 2025 10:16:58 -0400
Subject: [PATCH 2248/2396] file-posix: populate pwrite_zeroes_alignment

Linux block devices require write zeroes alignment whereas files do not.

It may come as a surprise that block devices opened in buffered I/O mode
require the alignment for write zeroes requests although normal
read/write requests do not.

Therefore it is necessary to populate the pwrite_zeroes_alignment field.

Cc: qemu-stable@nongnu.org
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-2-stefanha@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/block/file-posix.c b/block/file-posix.c
index 12d12970fa..c9e367a222 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -1611,6 +1611,22 @@ static void raw_refresh_limits(BlockDriverState *bs, Error **errp)
 
             bs->bl.pdiscard_alignment = dalign;
         }
+
+#ifdef __linux__
+        /*
+         * Linux requires logical block size alignment for write zeroes even
+         * when normal reads/writes do not require alignment.
+         */
+        if (!s->needs_alignment) {
+            ret = probe_logical_blocksize(s->fd,
+                                          &bs->bl.pwrite_zeroes_alignment);
+            if (ret < 0) {
+                error_setg_errno(errp, -ret,
+                                 "Failed to probe logical block size");
+                return;
+            }
+        }
+#endif /* __linux__ */
     }
 
     raw_refresh_zoned_limits(bs, &st, errp);

From d704a13d2c025779bc91d04e127427347ddcf3b3 Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 7 Oct 2025 10:16:59 -0400
Subject: [PATCH 2249/2396] block: use pwrite_zeroes_alignment when writing
 first sector

Since commit 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t
writeback"), qemu-img create errors out on a Linux loop block device
with a 4 KB sector size:

  # dd if=/dev/zero of=blockfile bs=1M count=1024
  # losetup --sector-size 4096 /dev/loop0 blockfile
  # qemu-img create -f raw /dev/loop0 1G
  Formatting '/dev/loop0', fmt=raw size=1073741824
  qemu-img: /dev/loop0: Failed to clear the new image's first sector: Invalid argument

Use the pwrite_zeroes_alignment block limit to avoid misaligned
fallocate(2) or ioctl(BLKZEROOUT) in the block/file-posix.c block
driver.

Cc: qemu-stable@nongnu.org
Fixes: 5634622bcb33 ("file-posix: allow BLKZEROOUT with -t writeback")
Reported-by: Jean-Louis Dupond <jean-louis@dupond.be>
Buglink: https://gitlab.com/qemu-project/qemu/-/issues/3127
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-3-stefanha@redhat.com>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                           |  3 ++-
 block/block-backend.c             | 11 +++++++++++
 include/system/block-backend-io.h |  1 +
 3 files changed, 14 insertions(+), 1 deletion(-)

diff --git a/block.c b/block.c
index 4f1581cedf..48a17f393c 100644
--- a/block.c
+++ b/block.c
@@ -606,12 +606,13 @@ create_file_fallback_zero_first_sector(BlockBackend *blk,
                                        int64_t current_size,
                                        Error **errp)
 {
+    uint32_t alignment = blk_get_pwrite_zeroes_alignment(blk);
     int64_t bytes_to_clear;
     int ret;
 
     GLOBAL_STATE_CODE();
 
-    bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
+    bytes_to_clear = MIN(current_size, MAX(BDRV_SECTOR_SIZE, alignment));
     if (bytes_to_clear) {
         ret = blk_co_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
         if (ret < 0) {
diff --git a/block/block-backend.c b/block/block-backend.c
index d6df369188..98315d4470 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -2305,6 +2305,17 @@ uint32_t blk_get_request_alignment(BlockBackend *blk)
     return bs ? bs->bl.request_alignment : BDRV_SECTOR_SIZE;
 }
 
+/* Returns the optimal write zeroes alignment, in bytes; guaranteed nonzero */
+uint32_t blk_get_pwrite_zeroes_alignment(BlockBackend *blk)
+{
+    BlockDriverState *bs = blk_bs(blk);
+    IO_CODE();
+    if (!bs) {
+        return BDRV_SECTOR_SIZE;
+    }
+    return bs->bl.pwrite_zeroes_alignment ?: bs->bl.request_alignment;
+}
+
 /* Returns the maximum hardware transfer length, in bytes; guaranteed nonzero */
 uint64_t blk_get_max_hw_transfer(BlockBackend *blk)
 {
diff --git a/include/system/block-backend-io.h b/include/system/block-backend-io.h
index ba8dfcc7d0..6d5ac476fc 100644
--- a/include/system/block-backend-io.h
+++ b/include/system/block-backend-io.h
@@ -116,6 +116,7 @@ BlockAIOCB *blk_abort_aio_request(BlockBackend *blk,
                                   void *opaque, int ret);
 
 uint32_t blk_get_request_alignment(BlockBackend *blk);
+uint32_t blk_get_pwrite_zeroes_alignment(BlockBackend *blk);
 uint32_t blk_get_max_transfer(BlockBackend *blk);
 uint64_t blk_get_max_hw_transfer(BlockBackend *blk);
 

From 59a1cf0cd31597d2f6e2c18dc400a1de8427d47d Mon Sep 17 00:00:00 2001
From: Stefan Hajnoczi <stefanha@redhat.com>
Date: Tue, 7 Oct 2025 10:17:00 -0400
Subject: [PATCH 2250/2396] iotests: add Linux loop device image creation test

This qemu-iotests test case is based on the reproducer that Jean-Louis
Dupond <jean-louis@dupond.be> shared in
https://gitlab.com/qemu-project/qemu/-/issues/3127.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-ID: <20251007141700.71891-4-stefanha@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Tested-by: Vladimir Sementsov-Ogievskiy <vsementsov@yandex-team.ru>
Tested-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Fiona Ebner <f.ebner@proxmox.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/loop-create-file     | 59 +++++++++++++++++++
 tests/qemu-iotests/tests/loop-create-file.out |  8 +++
 2 files changed, 67 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/loop-create-file
 create mode 100644 tests/qemu-iotests/tests/loop-create-file.out

diff --git a/tests/qemu-iotests/tests/loop-create-file b/tests/qemu-iotests/tests/loop-create-file
new file mode 100755
index 0000000000..5ec75b046b
--- /dev/null
+++ b/tests/qemu-iotests/tests/loop-create-file
@@ -0,0 +1,59 @@
+#!/usr/bin/env bash
+# group: quick
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright Red Hat, Inc.
+#
+# Test Linux loop device image creation
+#
+# This test verifies #3127 "qemu-img create fails on loop device with sector size 4096"
+# https://gitlab.com/qemu-project/qemu/-/issues/3127
+
+seq="$(basename $0)"
+echo "QA output created by $seq"
+
+status=1	# failure is the default!
+
+_cleanup() {
+    if [ -n "$loopdev" ]; then
+        sudo losetup --detach "$loopdev"
+    fi
+
+    _cleanup_test_img
+}
+
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+cd ..
+. ./common.rc
+. ./common.filter
+
+_supported_fmt raw
+_supported_proto file
+_supported_os Linux
+
+if ! sudo -n losetup &>/dev/null; then
+    _notrun "sudo losetup not available"
+fi
+
+echo
+echo "=== Create image on a 4 KB sector size loop device ==="
+echo
+
+_make_test_img -f $IMGFMT 1M
+
+loopdev=$(sudo losetup --sector-size 4096 --find --show "$TEST_IMG")
+if [ -z "$loopdev" ]; then
+    _fail
+fi
+
+sudo $QEMU_IMG_PROG create -f raw "$loopdev" 1M | \
+    sed -e "s#/dev/loop[0-9]\\+#LOOPDEV#g"
+
+# success, all done
+echo
+echo '*** done'
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/tests/loop-create-file.out b/tests/qemu-iotests/tests/loop-create-file.out
new file mode 100644
index 0000000000..32d4155695
--- /dev/null
+++ b/tests/qemu-iotests/tests/loop-create-file.out
@@ -0,0 +1,8 @@
+QA output created by loop-create-file
+
+=== Create image on a 4 KB sector size loop device ===
+
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576
+Formatting 'LOOPDEV', fmt=raw size=1048576
+
+*** done

From 3de6afef49449c487256dc6238649ba0f0508789 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Thu, 6 Nov 2025 15:19:59 +0000
Subject: [PATCH 2251/2396] qtest: Allow and ignore blank lines in input
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently the code that reads the qtest protocol commands insists
that every input line has a command.  If it receives a line with
nothing but whitespace it will trip an assertion in
qtest_process_command().

This is a little awkward for the case where we are feeding qtest a
set of bug-reproduction commands via standard input or a file,
because it means you need to be careful not to leave a blank line at
the start or the end when cutting and pasting the command sequence
from a bug report.

Change the code to allow and ignore blank lines in the input.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251106151959.1088095-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 system/qtest.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/system/qtest.c b/system/qtest.c
index cbeb7f3772..67e2385f4b 100644
--- a/system/qtest.c
+++ b/system/qtest.c
@@ -69,6 +69,9 @@ static void *qtest_server_send_opaque;
  * so clients should always handle many async messages before the response
  * comes in.
  *
+ * Extra ASCII space characters in command inputs are permitted and ignored.
+ * Lines containing only spaces are permitted and ignored.
+ *
  * Valid requests
  * ^^^^^^^^^^^^^^
  *
@@ -367,7 +370,11 @@ static void qtest_process_command(CharFrontend *chr, gchar **words)
         fprintf(qtest_log_fp, "\n");
     }
 
-    g_assert(command);
+    if (!command) {
+        /* Input line was blank: ignore it */
+        return;
+    }
+
     if (strcmp(words[0], "irq_intercept_out") == 0
         || strcmp(words[0], "irq_intercept_in") == 0) {
         DeviceState *dev;

From ef44cc0a762438ebc84c4997a5ce29c6f00622c3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Fri, 7 Nov 2025 13:10:44 +0000
Subject: [PATCH 2252/2396] hw/pci: Make msix_init take a uint32_t for nentries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

msix_init() and msix_init_exclusive_bar() take an "unsigned short"
argument for the number of MSI-X vectors to try to use.  This is big
enough for the maximum permitted number of vectors, which is 2048.
Unfortunately, we have several devices (most notably virtio) which
allow the user to specify the desired number of vectors, and which
use uint32_t properties for this.  If the user sets the property to a
value that is too big for a uint16_t, the value will be truncated
when it is passed to msix_init(), and msix_init() may then return
success if the truncated value is a valid one.

The resulting mismatch between the number of vectors the msix code
thinks the device has and the number of vectors the device itself
thinks it has can cause assertions, such as the one in issue 2631,
where "-device virtio-mouse-pci,vectors=19923041" is interpreted by
msix as "97 vectors" and by the virtio-pci layer as "19923041
vectors"; a guest attempt to access vector 97 thus passes the
virtio-pci bounds checking and hits an essertion in
msix_vector_use().

Avoid this by making msix_init() and its wrapper function
msix_init_exclusive_bar() take the number of vectors as a uint32_t.
The erroneous command line will now produce the warning

 qemu-system-i386: -device virtio-mouse-pci,vectors=19923041:
   warning: unable to init msix vectors to 19923041

and proceed without crashing.  (The virtio device warns and falls
back to not using MSIX, rather than complaining that the option is
not a valid value this is the same as the existing behaviour for
values that are beyond the MSI-X maximum possible value but fit into
a 16-bit integer, like 2049.)

To ensure this doesn't result in potential overflows in calculation
of the BAR size in msix_init_exclusive_bar(), we duplicate the
nentries error-check from msix_init() at the top of
msix_init_exclusive_bar(), so we know nentries is sane before we
start using it.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/2631
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251107131044.1321637-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/pci/msix.c         | 10 ++++++++--
 include/hw/pci/msix.h |  4 ++--
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/hw/pci/msix.c b/hw/pci/msix.c
index 8c7f6709e2..b35476d057 100644
--- a/hw/pci/msix.c
+++ b/hw/pci/msix.c
@@ -318,7 +318,7 @@ static void msix_mask_all(struct PCIDevice *dev, unsigned nentries)
  * also means a programming error, except device assignment, which can check
  * if a real HW is broken.
  */
-int msix_init(struct PCIDevice *dev, unsigned short nentries,
+int msix_init(struct PCIDevice *dev, uint32_t nentries,
               MemoryRegion *table_bar, uint8_t table_bar_nr,
               unsigned table_offset, MemoryRegion *pba_bar,
               uint8_t pba_bar_nr, unsigned pba_offset, uint8_t cap_pos,
@@ -392,7 +392,7 @@ int msix_init(struct PCIDevice *dev, unsigned short nentries,
     return 0;
 }
 
-int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,
+int msix_init_exclusive_bar(PCIDevice *dev, uint32_t nentries,
                             uint8_t bar_nr, Error **errp)
 {
     int ret;
@@ -401,6 +401,12 @@ int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,
     uint32_t bar_pba_offset = bar_size / 2;
     uint32_t bar_pba_size = QEMU_ALIGN_UP(nentries, 64) / 8;
 
+    /* Sanity-check nentries before we use it in BAR size calculations */
+    if (nentries < 1 || nentries > PCI_MSIX_FLAGS_QSIZE + 1) {
+        error_setg(errp, "The number of MSI-X vectors is invalid");
+        return -EINVAL;
+    }
+
     /*
      * Migration compatibility dictates that this remains a 4k
      * BAR with the vector table in the lower half and PBA in
diff --git a/include/hw/pci/msix.h b/include/hw/pci/msix.h
index 11ef9454c1..551a2bcfe7 100644
--- a/include/hw/pci/msix.h
+++ b/include/hw/pci/msix.h
@@ -7,12 +7,12 @@
 
 void msix_set_message(PCIDevice *dev, int vector, MSIMessage msg);
 MSIMessage msix_get_message(PCIDevice *dev, unsigned int vector);
-int msix_init(PCIDevice *dev, unsigned short nentries,
+int msix_init(PCIDevice *dev, uint32_t nentries,
               MemoryRegion *table_bar, uint8_t table_bar_nr,
               unsigned table_offset, MemoryRegion *pba_bar,
               uint8_t pba_bar_nr, unsigned pba_offset, uint8_t cap_pos,
               Error **errp);
-int msix_init_exclusive_bar(PCIDevice *dev, unsigned short nentries,
+int msix_init_exclusive_bar(PCIDevice *dev, uint32_t nentries,
                             uint8_t bar_nr, Error **errp);
 
 void msix_write_config(PCIDevice *dev, uint32_t address, uint32_t val, int len);

From a5da8dd90b9cdc308f053b2543ebf5368c12ce49 Mon Sep 17 00:00:00 2001
From: Zhao Liu <zhao1.liu@intel.com>
Date: Fri, 21 Nov 2025 16:44:16 +0800
Subject: [PATCH 2253/2396] docs/deprecated: Remove undeprecated SMP
 description
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

"Unsupported 'parameter=1' SMP configuration" was proposed to be
deprecated in the commit 54c4ea8f3ae6 ("hw/core/machine-smp: Deprecate
unsupported "parameter=1" SMP configurations").

But the related code was reverted later in the commit 9d7950edb0cd
("hw/core: allow parameter=1 for SMP topology on any machine").

Thus, this SMP behavior is still valid and is not actually deprecated.

Remove outdated document descriptions.

Reported-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Zhao Liu <zhao1.liu@intel.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251121084416.1031466-1-zhao1.liu@intel.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 docs/about/deprecated.rst | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 30ab72b2a4..9386cffba2 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -54,20 +54,6 @@ as short-form boolean values, and passed to plugins as ``arg_name=on``.
 However, short-form booleans are deprecated and full explicit ``arg_name=on``
 form is preferred.
 
-``-smp`` (Unsupported "parameter=1" SMP configurations) (since 9.0)
-'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
-
-Specified CPU topology parameters must be supported by the machine.
-
-In the SMP configuration, users should provide the CPU topology parameters that
-are supported by the target machine.
-
-However, historically it was allowed for users to specify the unsupported
-topology parameter as "1", which is meaningless. So support for this kind of
-configurations (e.g. -smp drawers=1,books=1,clusters=1 for x86 PC machine) is
-marked deprecated since 9.0, users have to ensure that all the topology members
-described with -smp are supported by the target machine.
-
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
 

From 622a0c9dee44f7a6c51e80644a3c5f3b132fbb7e Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 21 Nov 2025 13:14:25 +0100
Subject: [PATCH 2254/2396] hw/usb: Convert to qemu_create() for a better error
 message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The error message changes from

    open FILENAME failed

to

    Could not create 'FILENAME': REASON

where REASON is the value of strerror(errno).

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-3-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/usb/bus.c | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/hw/usb/bus.c b/hw/usb/bus.c
index 8dd2ce415e..714e33989f 100644
--- a/hw/usb/bus.c
+++ b/hw/usb/bus.c
@@ -259,10 +259,9 @@ static void usb_qdev_realize(DeviceState *qdev, Error **errp)
     }
 
     if (dev->pcap_filename) {
-        int fd = qemu_open_old(dev->pcap_filename,
-                               O_CREAT | O_WRONLY | O_TRUNC | O_BINARY, 0666);
+        int fd = qemu_create(dev->pcap_filename,
+                             O_WRONLY | O_TRUNC | O_BINARY, 0666, errp);
         if (fd < 0) {
-            error_setg(errp, "open %s failed", dev->pcap_filename);
             usb_qdev_unrealize(qdev);
             return;
         }

From 6d85f1d4492f0ef7347c488ae1d7f6f03a892573 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 21 Nov 2025 13:14:29 +0100
Subject: [PATCH 2255/2396] hw/scsi: Use error_setg_file_open() for a better
 error message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The error message changes from

    vhost-scsi: open vhost char device failed: REASON

to

    Could not open '/dev/vhost-scsi': REASON

I think the exact file name is more useful to know than the file's
purpose.

We could put back the "vhost-scsi: " prefix with error_prepend().  Not
worth the bother.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dave@treblig.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-7-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/scsi/vhost-scsi.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/scsi/vhost-scsi.c b/hw/scsi/vhost-scsi.c
index cdf405b0f8..239138c931 100644
--- a/hw/scsi/vhost-scsi.c
+++ b/hw/scsi/vhost-scsi.c
@@ -245,8 +245,7 @@ static void vhost_scsi_realize(DeviceState *dev, Error **errp)
     } else {
         vhostfd = open("/dev/vhost-scsi", O_RDWR);
         if (vhostfd < 0) {
-            error_setg(errp, "vhost-scsi: open vhost char device failed: %s",
-                       strerror(errno));
+            error_setg_file_open(errp, errno, "/dev/vhost-scsi");
             return;
         }
     }

From 77f4f14e08184b47f1356269ae2c5db039d16af2 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 21 Nov 2025 13:14:30 +0100
Subject: [PATCH 2256/2396] hw/virtio: Use error_setg_file_open() for a better
 error message
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The error message changes from

    vhost-vsock: failed to open vhost device: REASON

to

    Could not open '/dev/vhost-vsock': REASON

I think the exact file name is more useful to know than the file's
purpose.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251121121438.1249498-8-armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/virtio/vhost-vsock.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/virtio/vhost-vsock.c b/hw/virtio/vhost-vsock.c
index 107d88babe..7940b60d8a 100644
--- a/hw/virtio/vhost-vsock.c
+++ b/hw/virtio/vhost-vsock.c
@@ -153,8 +153,7 @@ static void vhost_vsock_device_realize(DeviceState *dev, Error **errp)
     } else {
         vhostfd = open("/dev/vhost-vsock", O_RDWR);
         if (vhostfd < 0) {
-            error_setg_errno(errp, errno,
-                             "vhost-vsock: failed to open vhost device");
+            error_setg_file_open(errp, errno, "/dev/vhost-vsock");
             return;
         }
 

From 78d66a25c54339b370d2062826c8a011012ab6c0 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Mon, 24 Nov 2025 17:34:07 +0000
Subject: [PATCH 2257/2396] replay: Improve assert in
 replay_char_read_all_load()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In replay_char_read_all_load() we get a buffer and size from the
replay log.  We know the size has to fit an int because of how we
write the log.  However the way we assert this is wrong: we cast the
size_t from replay_get_array() to an int and then check that it is
non-negative.  This misses cases where an over-large size is
truncated into a positive value by the cast.

Replace the assertion with checking that the size is in-range
before doing the cast.

Coverity complained about the possible overflow: CID 1643440.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251124173407.50124-1-peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 replay/replay-char.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/replay/replay-char.c b/replay/replay-char.c
index 81dc416e98..4e58dd154a 100644
--- a/replay/replay-char.c
+++ b/replay/replay-char.c
@@ -126,8 +126,8 @@ int replay_char_read_all_load(uint8_t *buf)
         int res;
         replay_get_array(buf, &size);
         replay_finish_event();
+        assert(size <= INT_MAX);
         res = (int)size;
-        assert(res >= 0);
         return res;
     } else if (replay_next_event_is(EVENT_CHAR_READ_ALL_ERROR)) {
         int res = replay_get_dword();

From 98ee8aa92e930a447c6108d4689f0bf8b535359d Mon Sep 17 00:00:00 2001
From: Peter Xu <peterx@redhat.com>
Date: Mon, 24 Nov 2025 14:14:08 -0500
Subject: [PATCH 2258/2396] hw/core/machine: Provide a description for
 aux-ram-share property
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It was forgotten when being introduced in commit 91792807d1 ("machine:
aux-ram-share option").

Cc: qemu-stable@nongnu.org
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Xu <peterx@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-ID: <20251124191408.783473-1-peterx@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/core/machine.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 06e0c9a179..27372bb01e 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -1204,6 +1204,8 @@ static void machine_class_init(ObjectClass *oc, const void *data)
     object_class_property_add_bool(oc, "aux-ram-share",
                                    machine_get_aux_ram_share,
                                    machine_set_aux_ram_share);
+    object_class_property_set_description(oc, "aux-ram-share",
+        "Use anonymous shared memory for auxiliary guest RAMs");
 #endif
 
     object_class_property_add_bool(oc, "usb",

From 57756aa01fe52c50d655929c43d9a80f8214cf1a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 25 Nov 2025 15:26:31 +0100
Subject: [PATCH 2259/2396] hw/aspeed/{xdma, rtc, sdhci}: Fix endianness to
 DEVICE_LITTLE_ENDIAN
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When the XDMA, RTC and SDHCI device models of the Aspeed SoCs were
first introduced, their MMIO regions inherited of a DEVICE_NATIVE_ENDIAN
endianness. It should be DEVICE_LITTLE_ENDIAN. Fix that.

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251125142631.676689-1-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/misc/aspeed_xdma.c | 2 +-
 hw/rtc/aspeed_rtc.c   | 2 +-
 hw/sd/aspeed_sdhci.c  | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/misc/aspeed_xdma.c b/hw/misc/aspeed_xdma.c
index cc03c422b0..c448ad32ff 100644
--- a/hw/misc/aspeed_xdma.c
+++ b/hw/misc/aspeed_xdma.c
@@ -113,7 +113,7 @@ static void aspeed_xdma_write(void *opaque, hwaddr addr, uint64_t val,
 static const MemoryRegionOps aspeed_xdma_ops = {
     .read = aspeed_xdma_read,
     .write = aspeed_xdma_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
     .valid.min_access_size = 4,
     .valid.max_access_size = 4,
 };
diff --git a/hw/rtc/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
index c4feea23a0..6793e253f4 100644
--- a/hw/rtc/aspeed_rtc.c
+++ b/hw/rtc/aspeed_rtc.c
@@ -131,7 +131,7 @@ static void aspeed_rtc_reset(DeviceState *d)
 static const MemoryRegionOps aspeed_rtc_ops = {
     .read = aspeed_rtc_read,
     .write = aspeed_rtc_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
 };
 
 static const VMStateDescription vmstate_aspeed_rtc = {
diff --git a/hw/sd/aspeed_sdhci.c b/hw/sd/aspeed_sdhci.c
index fc38ad39ce..f5c0c4956a 100644
--- a/hw/sd/aspeed_sdhci.c
+++ b/hw/sd/aspeed_sdhci.c
@@ -124,7 +124,7 @@ static void aspeed_sdhci_write(void *opaque, hwaddr addr, uint64_t val,
 static const MemoryRegionOps aspeed_sdhci_ops = {
     .read = aspeed_sdhci_read,
     .write = aspeed_sdhci_write,
-    .endianness = DEVICE_NATIVE_ENDIAN,
+    .endianness = DEVICE_LITTLE_ENDIAN,
     .valid.min_access_size = 4,
     .valid.max_access_size = 4,
 };

From 7248dab3c9d73fcefe609f7a3414f9d048fefcc1 Mon Sep 17 00:00:00 2001
From: Harald van Dijk <hdijk@accesssoftek.com>
Date: Fri, 28 Nov 2025 04:38:11 +0000
Subject: [PATCH 2260/2396] target/arm: Fix assert on BRA.

trans_BRA does

    gen_a64_set_pc(s, dst);
    set_btype_for_br(s, a->rn);

gen_a64_set_pc does

    s->pc_save = -1;

set_btype_for_br (if aa64_bti is enabled and the register is not x16 or
x17) does

    gen_pc_plus_diff(s, pc, 0);

gen_pc_plus_diff does

    assert(s->pc_save != -1);

Hence, this assert is getting hit. We need to call set_btype_for_br
before gen_a64_set_pc, and there is nothing in set_btype_for_br that
depends on gen_a64_set_pc having already been called, so this commit
simply swaps the calls.

(The commit message for 64678fc45d8f6 says that set_brtype_for_br()
must be "moved after" get_a64_set_pc(), but this is a mistake in
the commit message -- the actual changes in that commit move
set_brtype_for_br() *before* get_a64_set_pc() and this is necessary
to avoid the assert.)

Cc: qemu-stable@nongnu.org
Fixes: 64678fc45d8f6 ("target/arm: Fix BTI versus CF_PCREL")
Signed-off-by: Harald van Dijk <hdijk@accesssoftek.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: d2265ebb-84bc-41b7-a2d7-05dc9a5a2055@accesssoftek.com
[PMM: added note about 64678fc45d8f6 to commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 08b21d7dbf..cde22a5cca 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1916,8 +1916,8 @@ static bool trans_BRA(DisasContext *s, arg_bra *a)
         return false;
     }
     dst = auth_branch_target(s, cpu_reg(s,a->rn), cpu_reg_sp(s, a->rm), !a->m);
-    gen_a64_set_pc(s, dst);
     set_btype_for_br(s, a->rn);
+    gen_a64_set_pc(s, dst);
     s->base.is_jmp = DISAS_JUMP;
     return true;
 }

From ebb625262c7f9837d6c7b9d8a0c1349fe8a8f4ff Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Tue, 25 Nov 2025 16:45:11 +0000
Subject: [PATCH 2261/2396] docs/devel: Update URL for make-pullreq script

In the submitting-a-pull-request docs, we have a link to the
make-pullreq script which might be useful for maintainers.  The
canonical git repo for this script has moved; update the link.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20251125164511.255550-1-peter.maydell@linaro.org
---
 docs/devel/submitting-a-pull-request.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/devel/submitting-a-pull-request.rst b/docs/devel/submitting-a-pull-request.rst
index a4cd7ebbb6..e7d0080878 100644
--- a/docs/devel/submitting-a-pull-request.rst
+++ b/docs/devel/submitting-a-pull-request.rst
@@ -67,7 +67,7 @@ subject tag is "PULL SUBSYSTEM s390/block/whatever" rather than just
 pull requests that should be applied to master.
 
 You might be interested in the `make-pullreq
-<https://git.linaro.org/people/peter.maydell/misc-scripts.git/tree/make-pullreq>`__
+<https://gitlab.com/pm215/misc-scripts/-/blob/master/make-pullreq>`__
 script which automates some of this process for you and includes a few
 sanity checks. Note that you must edit it to configure it suitably for
 your local situation!

From 3bee93b9abf5509f1ac25909478dd52a724bf0c3 Mon Sep 17 00:00:00 2001
From: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Wed, 26 Nov 2025 17:46:01 +0800
Subject: [PATCH 2262/2396] accel/hvf: Fix i386 HVF compilation failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Recent changes introduced build errors in the i386 HVF backend:

 - ../accel/hvf/hvf-accel-ops.c:163:17: error: no member named 'guest_debug_enabled' in 'struct AccelCPUState'
   163 |     cpu->accel->guest_debug_enabled = false;

 - ../accel/hvf/hvf-accel-ops.c:151:51
   error: no member named 'unblock_ipi_mask' in 'struct AccelCPUState'

 - ../target/i386/hvf/hvf.c:736:5
   error: use of undeclared identifier 'rip'

 - ../target/i386/hvf/hvf.c:737:5
   error: use of undeclared identifier 'env'

This patch corrects the field usage and move identifier to correct
function ensuring successful compilation of the i386 HVF backend.

These issues were caused by:

Fixes: 2ad756383e1b (“accel/hvf: Restrict ARM-specific fields of AccelCPUState”)
Fixes: 2a21c9244740 (“target/i386/hvf: Factor hvf_handle_vmexit() out”)

Signed-off-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-Id: <20251126094601.56403-1-phind.uet@gmail.com>
[PMD: Keep setting vcpu_dirty on AArch64]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Nguyen Dinh Phi <phind.uet@gmail.com>
Message-Id: <20251128085854.53539-1-phind.uet@gmail.com>
---
 accel/hvf/hvf-accel-ops.c | 5 ++---
 target/i386/hvf/hvf.c     | 6 ++----
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/accel/hvf/hvf-accel-ops.c b/accel/hvf/hvf-accel-ops.c
index 3e5feecd8a..e4c62522e1 100644
--- a/accel/hvf/hvf-accel-ops.c
+++ b/accel/hvf/hvf-accel-ops.c
@@ -148,10 +148,11 @@ static int hvf_init_vcpu(CPUState *cpu)
     sigact.sa_handler = dummy_signal;
     sigaction(SIG_IPI, &sigact, NULL);
 
+#ifdef __aarch64__
     pthread_sigmask(SIG_BLOCK, NULL, &cpu->accel->unblock_ipi_mask);
     sigdelset(&cpu->accel->unblock_ipi_mask, SIG_IPI);
+    cpu->accel->guest_debug_enabled = false;
 
-#ifdef __aarch64__
     r = hv_vcpu_create(&cpu->accel->fd,
                        (hv_vcpu_exit_t **)&cpu->accel->exit, NULL);
 #else
@@ -160,8 +161,6 @@ static int hvf_init_vcpu(CPUState *cpu)
     assert_hvf_ok(r);
     cpu->vcpu_dirty = true;
 
-    cpu->accel->guest_debug_enabled = false;
-
     return hvf_arch_init_vcpu(cpu);
 }
 
diff --git a/target/i386/hvf/hvf.c b/target/i386/hvf/hvf.c
index 16febbac48..2023a7bfbb 100644
--- a/target/i386/hvf/hvf.c
+++ b/target/i386/hvf/hvf.c
@@ -728,7 +728,8 @@ static int hvf_handle_vmexit(CPUState *cpu)
     uint64_t exit_qual = rvmcs(cpu->accel->fd, VMCS_EXIT_QUALIFICATION);
     uint32_t ins_len = (uint32_t)rvmcs(cpu->accel->fd,
                                        VMCS_EXIT_INSTRUCTION_LENGTH);
-
+    CPUX86State *env = &x86_cpu->env;
+    uint64_t rip = 0;
     uint64_t idtvec_info = rvmcs(cpu->accel->fd, VMCS_IDT_VECTORING_INFO);
     int ret = 0;
 
@@ -966,10 +967,7 @@ static int hvf_handle_vmexit(CPUState *cpu)
 
 int hvf_arch_vcpu_exec(CPUState *cpu)
 {
-    X86CPU *x86_cpu = X86_CPU(cpu);
-    CPUX86State *env = &x86_cpu->env;
     int ret = 0;
-    uint64_t rip = 0;
 
     if (hvf_process_events(cpu)) {
         return EXCP_HLT;

From c1116b1d73fa0cd4346484688ebb22ecd847ec3f Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Tue, 25 Nov 2025 08:05:54 +0100
Subject: [PATCH 2263/2396] migration: Fix double-free on error path

Fixes: ffaa1b50a879 (migration: Use warn_reportf_err() where appropriate)
Resolves: Coverity CID 1643463
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-ID: <20251125070554.2256181-1-armbru@redhat.com>
Acked-by: Peter Xu <peterx@redhat.com>
---
 migration/multifd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/migration/multifd.c b/migration/multifd.c
index 6210454838..3203dc98e1 100644
--- a/migration/multifd.c
+++ b/migration/multifd.c
@@ -450,7 +450,7 @@ static void multifd_send_set_error(Error *err)
  */
 static void migration_ioc_shutdown_gracefully(QIOChannel *ioc)
 {
-    g_autoptr(Error) local_err = NULL;
+    Error *local_err = NULL;
 
     if (!migration_has_failed(migrate_get_current()) &&
         object_dynamic_cast((Object *)ioc, TYPE_QIO_CHANNEL_TLS)) {

From 88be119fb19b8ee04d681ad9048cde9f6a37c631 Mon Sep 17 00:00:00 2001
From: Markus Armbruster <armbru@redhat.com>
Date: Fri, 28 Nov 2025 16:20:50 +0100
Subject: [PATCH 2264/2396] kvm: Fix kvm_vm_ioctl() and kvm_device_ioctl()
 return value
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

These functions wrap ioctl().  When ioctl() fails, it sets @errno.
The wrappers then return that @errno negated.

Except they call accel_ioctl_end() between calling ioctl() and reading
@errno.  accel_ioctl_end() can clobber @errno, e.g. when a futex()
system call fails.  Seems unlikely, but it's a bug all the same.

Fix by retrieving @errno before calling accel_ioctl_end().

Fixes: a27dd2de68f3 (KVM: keep track of running ioctls)
Signed-off-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251128152050.3417834-1-armbru@redhat.com>
---
 accel/kvm/kvm-all.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/accel/kvm/kvm-all.c b/accel/kvm/kvm-all.c
index f9254ae654..28006d73c5 100644
--- a/accel/kvm/kvm-all.c
+++ b/accel/kvm/kvm-all.c
@@ -3373,10 +3373,10 @@ int kvm_vm_ioctl(KVMState *s, unsigned long type, ...)
     trace_kvm_vm_ioctl(type, arg);
     accel_ioctl_begin();
     ret = ioctl(s->vmfd, type, arg);
-    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
+    accel_ioctl_end();
     return ret;
 }
 
@@ -3413,10 +3413,10 @@ int kvm_device_ioctl(int fd, unsigned long type, ...)
     trace_kvm_device_ioctl(fd, type, arg);
     accel_ioctl_begin();
     ret = ioctl(fd, type, arg);
-    accel_ioctl_end();
     if (ret == -1) {
         ret = -errno;
     }
+    accel_ioctl_end();
     return ret;
 }
 

From 05f36f7c0512c40a8f929e8ba2ca3c825198f234 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 2 Dec 2025 20:09:51 -0800
Subject: [PATCH 2265/2396] Update version for v10.2.0-rc2 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 5b71bdb7d5..a0f6b4da40 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.91
+10.1.92

From 1f3b34e403b90292d0bfceb4109937511d525b61 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Fri, 10 Oct 2025 12:24:53 +0200
Subject: [PATCH 2266/2396] docs/interop/vfio-user: update protocol
 specification
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Refresh the protocol specification to the latest version implemented by
libvfio-user. All changes are backward compatible.

Note that QEMU client itself does not yet implement these extensions,
but as this is now the canonical specification, it needs to be kept up
to date.

Signed-off-by: John Levon <john.levon@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20251010102453.711072-1-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 docs/interop/vfio-user.rst | 550 +++++++++++++++++++++++++++++++++----
 1 file changed, 504 insertions(+), 46 deletions(-)

diff --git a/docs/interop/vfio-user.rst b/docs/interop/vfio-user.rst
index 0b06f026b0..303fc13d6e 100644
--- a/docs/interop/vfio-user.rst
+++ b/docs/interop/vfio-user.rst
@@ -76,7 +76,7 @@ structures used in the ``ioctl()`` implementation. Messages derived from the
 ``ioctl()`` will have a name derived from the ``ioctl()`` command name.  E.g., the
 ``VFIO_DEVICE_GET_INFO`` ``ioctl()`` command becomes a
 ``VFIO_USER_DEVICE_GET_INFO`` message.  The purpose of this reuse is to share as
-much code as feasible with the ``ioctl()`` implementation``.
+much code as feasible with the ``ioctl()`` implementation.
 
 Connection Initiation
 ^^^^^^^^^^^^^^^^^^^^^
@@ -201,12 +201,32 @@ A server can serve:
 1) one or more clients, and/or
 2) one or more virtual devices, belonging to one or more clients.
 
-The current protocol specification requires a dedicated socket per
-client/server connection. It is a server-side implementation detail whether a
-single server handles multiple virtual devices from the same or multiple
-clients. The location of the socket is implementation-specific. Multiplexing
-clients, devices, and servers over the same socket is not supported in this
-version of the protocol.
+The current protocol specification requires dedicated sockets per
+client/server connection. Commands in the client-to-server direction are
+handled on the main communication socket which the client connects to, and
+replies to these commands are passed on the same socket. Commands sent in the
+other direction from the server to the client as well as their corresponding
+replies can optionally be passed across a separate socket, which is set up
+during negotiation (AF_UNIX servers just pass the file descriptor).
+
+Using separate sockets for each command channel avoids introducing an
+artificial point of synchronization between the channels. This simplifies
+implementations since it obviates the need to demultiplex incoming messages
+into commands and replies and interleave command handling and reply processing.
+Note that it is still illegal for implementations to stall command or reply
+processing indefinitely while waiting for replies on the other channel, as this
+may lead to deadlocks. However, since incoming commands and requests arrive on
+different sockets, it's possible to meet this requirement e.g. by running two
+independent request processing threads that can internally operate
+synchronously. It is expected that this is simpler to implement than fully
+asynchronous message handling code. Implementations may still choose a fully
+asynchronous, event-based design for other reasons, and the protocol fully
+supports it.
+
+It is a server-side implementation detail whether a single server handles
+multiple virtual devices from the same or multiple clients. The location of the
+socket is implementation-specific. Multiplexing clients, devices, and servers
+over the same socket is not supported in this version of the protocol.
 
 Authentication
 --------------
@@ -364,6 +384,9 @@ Name                                    Command    Request Direction
 ``VFIO_USER_DMA_WRITE``                 12         server -> client
 ``VFIO_USER_DEVICE_RESET``              13         client -> server
 ``VFIO_USER_REGION_WRITE_MULTI``        15         client -> server
+``VFIO_USER_DEVICE_FEATURE``            16         client -> server
+``VFIO_USER_MIG_DATA_READ``             17         client -> server
+``VFIO_USER_MIG_DATA_WRITE``            18         client -> server
 ======================================  =========  =================
 
 Header
@@ -486,45 +509,48 @@ format:
 
 Capabilities:
 
-+--------------------+---------+------------------------------------------------+
-| Name               | Type    | Description                                    |
-+====================+=========+================================================+
-| max_msg_fds        | number  | Maximum number of file descriptors that can be |
-|                    |         | received by the sender in one message.         |
-|                    |         | Optional. If not specified then the receiver   |
-|                    |         | must assume a value of ``1``.                  |
-+--------------------+---------+------------------------------------------------+
-| max_data_xfer_size | number  | Maximum ``count`` for data transfer messages;  |
-|                    |         | see `Read and Write Operations`_. Optional,    |
-|                    |         | with a default value of 1048576 bytes.         |
-+--------------------+---------+------------------------------------------------+
-| pgsizes            | number  | Page sizes supported in DMA map operations     |
-|                    |         | or'ed together. Optional, with a default value |
-|                    |         | of supporting only 4k pages.                   |
-+--------------------+---------+------------------------------------------------+
-| max_dma_maps       | number  | Maximum number DMA map windows that can be     |
-|                    |         | valid simultaneously.  Optional, with a        |
-|                    |         | value of 65535 (64k-1).                        |
-+--------------------+---------+------------------------------------------------+
-| migration          | object  | Migration capability parameters. If missing    |
-|                    |         | then migration is not supported by the sender. |
-+--------------------+---------+------------------------------------------------+
-| write_multiple     | boolean | ``VFIO_USER_REGION_WRITE_MULTI`` messages      |
-|                    |         | are supported if the value is ``true``.        |
-+--------------------+---------+------------------------------------------------+
++--------------------+---------+-----------------------------------------------+
+| Name               | Type    | Description                                   |
++====================+=========+===============================================+
+| max_msg_fds        | number  | Maximum number of file descriptors that can   |
+|                    |         | be received by the sender in one message.     |
+|                    |         | Optional. If not specified then the receiver  |
+|                    |         | must assume a value of ``1``.                 |
++--------------------+---------+-----------------------------------------------+
+| max_data_xfer_size | number  | Maximum ``count`` for data transfer messages; |
+|                    |         | see `Read and Write Operations`_. Optional,   |
+|                    |         | with a default value of 1048576 bytes.        |
++--------------------+---------+-----------------------------------------------+
+| max_dma_maps       | number  | Maximum number DMA map windows that can be    |
+|                    |         | valid simultaneously.  Optional, with a       |
+|                    |         | value of 65535 (64k-1).                       |
++--------------------+---------+-----------------------------------------------+
+| pgsizes            | number  | Page sizes supported in DMA map operations    |
+|                    |         | or'ed together. Optional, with a default      |
+|                    |         | value of supporting only 4k pages.            |
++--------------------+---------+-----------------------------------------------+
+| twin_socket        | object  | Parameters for twin-socket mode, which        |
+|                    |         | handles server-to-client commands and their   |
+|                    |         | replies on a separate socket. Optional.       |
++--------------------+---------+-----------------------------------------------+
+| write_multiple     | boolean | ``VFIO_USER_REGION_WRITE_MULTI`` messages     |
+|                    |         | are supported if the value is ``true``.       |
++--------------------+---------+-----------------------------------------------+
 
-The migration capability contains the following name/value pairs:
+The ``twin_socket`` capability object holds these name/value pairs:
 
-+-----------------+--------+--------------------------------------------------+
-| Name            | Type   | Description                                      |
-+=================+========+==================================================+
-| pgsize          | number | Page size of dirty pages bitmap. The smallest    |
-|                 |        | between the client and the server is used.       |
-+-----------------+--------+--------------------------------------------------+
-| max_bitmap_size | number | Maximum bitmap size in ``VFIO_USER_DIRTY_PAGES`` |
-|                 |        | and ``VFIO_DMA_UNMAP`` messages.  Optional,      |
-|                 |        | with a default value of 256MB.                   |
-+-----------------+--------+--------------------------------------------------+
++-----------+---------+--------------------------------------------------------+
+| Name      | Type    | Description                                            |
++===========+=========+========================================================+
+| supported | boolean | Indicates whether the sender supports twin-socket      |
+|           |         | mode. Optional, defaults to false.                     |
++-----------+---------+--------------------------------------------------------+
+| fd_index  | number  | Specifies an index in the file descriptor array        |
+|           |         | included with the message. The designated file         |
+|           |         | descriptor is a socket which is to be used for the     |
+|           |         | server-to-client command channel. Optional, only valid |
+|           |         | in the reply message.                                  |
++-----------+---------+--------------------------------------------------------+
 
 Reply
 ^^^^^
@@ -532,6 +558,38 @@ Reply
 The same message format is used in the server's reply with the semantics
 described above.
 
+If and only if the client has indicated support for twin-socket mode by setting
+``twin_socket.supported`` to true in its capabilities, the server may optionally
+set up a separate command channel for server-to-client commands and their
+replies. The server enables twin-socket mode as follows:
+
+* Create a fresh socket pair.
+* Keep the server end of the socket pair and pass the client end in the file
+  descriptor array included with the reply message.
+* Set ``twin_socket.supported`` to true in the reply.
+* Indicate the index in the file descriptor array by the
+  ``twin_socket.fd_index`` capability field in the reply, so the client can
+  identify the correct file descriptor to use.
+
+A client requesting twin-socket mode must examine the ``twin_socket`` capability
+in the reply:
+
+* If ``twin_socket.supported`` is false, the field is missing, or the entire
+  ``twin_socket`` object is absent, the server does not support twin-socket mode
+  or decided not to enable it. The client can choose whether it wants to proceed
+  without twin-socket mode, or close the connection if not.
+* If ``twin_socket.supported`` is true and ``twin_socket.fd_index`` is present
+  and refers to a valid file descriptor, twin-socket mode negotiation has
+  succeeded. The client monitors the provided file descriptor for commands from
+  the server.
+* Otherwise, the reply from the server is inconsistent. The client must abort
+  and close the connection since it is potentially unable to receive commands
+  from the server.
+
+The twin-socket feature is optional, so some servers may not support it.
+However, for server implementations that do send server-to-client commands it is
+strongly recommended to implement twin-socket support.
+
 ``VFIO_USER_DMA_MAP``
 ---------------------
 
@@ -1335,7 +1393,9 @@ Reply
 -----------------------
 
 If the client has not shared mappable memory, the server can use this message to
-read from guest memory.
+read from guest memory. This message and its reply are passed over the separate
+server-to-client socket if twin-socket mode has been negotiated during
+connection setup.
 
 Request
 ^^^^^^^
@@ -1373,7 +1433,9 @@ Reply
 -----------------------
 
 If the client has not shared mappable memory, the server can use this message to
-write to guest memory.
+write to guest memory. This message and its reply are passed over the separate
+server-to-client socket if twin-socket mode has been negotiated during
+connection setup.
 
 Request
 ^^^^^^^
@@ -1466,6 +1528,402 @@ Reply
 
 * *wr_cnt* is the number of device writes completed.
 
+``VFIO_USER_DEVICE_FEATURE``
+----------------------------
+
+This command is analogous to ``VFIO_DEVICE_FEATURE``. It is used to get, set, or
+probe feature data of the device.
+
+Request
+^^^^^^^
+
+The request payload for this message is a structure of the following format.
+
++-------+--------+--------------------------------+
+| Name  | Offset | Size                           |
++=======+========+================================+
+| argsz | 0      | 4                              |
++-------+--------+--------------------------------+
+| flags | 4      | 4                              |
++-------+--------+--------------------------------+
+|       | +---------+---------------------------+ |
+|       | | Bit     | Definition                | |
+|       | +=========+===========================+ |
+|       | | 0 to 15 | Feature index             | |
+|       | +---------+---------------------------+ |
+|       | | 16      | VFIO_DEVICE_FEATURE_GET   | |
+|       | +---------+---------------------------+ |
+|       | | 17      | VFIO_DEVICE_FEATURE_SET   | |
+|       | +---------+---------------------------+ |
+|       | | 18      | VFIO_DEVICE_FEATURE_PROBE | |
+|       | +---------+---------------------------+ |
++-------+--------+--------------------------------+
+| data  | 8      | variable                       |
++-------+--------+--------------------------------+
+
+* *argsz* is the maximum size of the reply payload.
+
+* *flags* defines the action to be performed by the server and upon which
+  feature:
+
+  * The feature index consists of the least significant 16 bits of the flags
+    field, and can be accessed using the ``VFIO_DEVICE_FEATURE_MASK`` bit mask.
+
+  * ``VFIO_DEVICE_FEATURE_GET`` instructs the server to get the data for the
+    given feature.
+
+  * ``VFIO_DEVICE_FEATURE_SET`` instructs the server to set the feature data to
+    that given in the ``data`` field of the payload.
+
+  * ``VFIO_DEVICE_FEATURE_PROBE`` instructs the server to probe for feature
+    support. If ``VFIO_DEVICE_FEATURE_GET`` and/or ``VFIO_DEVICE_FEATURE_SET``
+    are also set, the probe will only return success if all of the indicated
+    methods are supported.
+
+  ``VFIO_DEVICE_FEATURE_GET`` and ``VFIO_DEVICE_FEATURE_SET`` are mutually
+  exclusive, except for use with ``VFIO_DEVICE_FEATURE_PROBE``.
+
+* *data* is specific to the particular feature. It is not used for probing.
+
+This part of the request is analogous to VFIO's ``struct vfio_device_feature``.
+
+Reply
+^^^^^
+
+The reply payload must be the same as the request payload for setting or
+probing a feature. For getting a feature's data, the data is added in the data
+section and its length is added to ``argsz``.
+
+Device Features
+^^^^^^^^^^^^^^^
+
+The only device features supported by vfio-user are those related to migration,
+although this may change in the future. They are a subset of those supported in
+the VFIO implementation of the Linux kernel.
+
++----------------------------------------+---------------+
+| Name                                   | Feature Index |
++========================================+===============+
+| VFIO_DEVICE_FEATURE_MIGRATION          | 1             |
++----------------------------------------+---------------+
+| VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE   | 2             |
++----------------------------------------+---------------+
+| VFIO_DEVICE_FEATURE_DMA_LOGGING_START  | 6             |
++----------------------------------------+---------------+
+| VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP   | 7             |
++----------------------------------------+---------------+
+| VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT | 8             |
++----------------------------------------+---------------+
+
+``VFIO_DEVICE_FEATURE_MIGRATION``
+"""""""""""""""""""""""""""""""""
+
+This feature indicates that the device can support the migration API through
+``VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE``. If ``GET`` succeeds, the ``RUNNING``
+and ``ERROR`` states are always supported. Support for additional states is
+indicated via the flags field; at least ``VFIO_MIGRATION_STOP_COPY`` must be
+set.
+
+There is no data field of the request message.
+
+The data field of the reply message is structured as follows:
+
++-------+--------+---------------------------+
+| Name  | Offset | Size                      |
++=======+========+===========================+
+| flags | 0      | 8                         |
++-------+--------+---------------------------+
+|       | +-----+--------------------------+ |
+|       | | Bit | Definition               | |
+|       | +=====+==========================+ |
+|       | | 0   | VFIO_MIGRATION_STOP_COPY | |
+|       | +-----+--------------------------+ |
+|       | | 1   | VFIO_MIGRATION_P2P       | |
+|       | +-----+--------------------------+ |
+|       | | 2   | VFIO_MIGRATION_PRE_COPY  | |
+|       | +-----+--------------------------+ |
++-------+--------+---------------------------+
+
+These flags are interpreted in the same way as VFIO.
+
+``VFIO_DEVICE_FEATURE_MIG_DEVICE_STATE``
+""""""""""""""""""""""""""""""""""""""""
+
+Upon ``VFIO_DEVICE_FEATURE_SET``, execute a migration state change on the VFIO
+device. The new state is supplied in ``device_state``. The state transition must
+fully complete before the reply is sent.
+
+The data field of the reply message, as well as the ``SET`` request message, is
+structured as follows:
+
++--------------+--------+------+
+| Name         | Offset | Size |
++==============+========+======+
+| device_state | 0      | 4    |
++--------------+--------+------+
+| data_fd      | 4      | 4    |
++--------------+--------+------+
+
+* *device_state* is the current state of the device (for ``GET``) or the
+  state to transition to (for ``SET``). It is defined by the
+  ``vfio_device_mig_state`` enum as detailed below. These states are the states
+  of the device migration Finite State Machine.
+
++--------------------------------+-------+---------------------------------------------------------------------+
+| Name                           | State | Description                                                         |
++================================+=======+=====================================================================+
+| VFIO_DEVICE_STATE_ERROR        | 0     | The device has failed and must be reset.                            |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_STOP         | 1     | The device does not change the internal or external state.          |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_RUNNING      | 2     | The device is running normally.                                     |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_STOP_COPY    | 3     | The device internal state can be read out.                          |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_RESUMING     | 4     | The device is stopped and is loading a new internal state.          |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_RUNNING_P2P  | 5     | (not used in vfio-user)                                             |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_PRE_COPY     | 6     | The device is running normally but tracking internal state changes. |
++--------------------------------+-------+---------------------------------------------------------------------+
+| VFIO_DEVICE_STATE_PRE_COPY_P2P | 7     | (not used in vfio-user)                                             |
++--------------------------------+-------+---------------------------------------------------------------------+
+
+* *data_fd* is unused in vfio-user, as the ``VFIO_USER_MIG_DATA_READ`` and
+  ``VFIO_USER_MIG_DATA_WRITE`` messages are used instead for migration data
+  transport.
+
+Direct State Transitions
+""""""""""""""""""""""""
+
+The device migration FSM is a Mealy machine, so actions are taken upon the arcs
+between FSM states. The following transitions need to be supported by the
+server, a subset of those defined in ``<linux/vfio.h>``
+(``enum vfio_device_mig_state``).
+
+* ``RUNNING -> STOP``, ``STOP_COPY -> STOP``: Stop the operation of the device.
+  The ``STOP_COPY`` arc terminates the data transfer session.
+
+* ``RESUMING -> STOP``: Terminate the data transfer session. Complete processing
+  of the migration data. Stop the operation of the device. If the delivered data
+  is found to be incomplete, inconsistent, or otherwise invalid, fail the
+  ``SET`` command and optionally transition to the ``ERROR`` state.
+
+* ``PRE_COPY -> RUNNING``: Terminate the data transfer session. The device is
+  now fully operational.
+
+* ``STOP -> RUNNING``: Start the operation of the device.
+
+* ``RUNNING -> PRE_COPY``, ``STOP -> STOP_COPY``: Begin the process of saving
+  the device state. The device operation is unchanged, but data transfer begins.
+  ``PRE_COPY`` and ``STOP_COPY`` are referred to as the "saving group" of
+  states.
+
+* ``PRE_COPY -> STOP_COPY``: Continue to transfer migration data, but stop
+  device operation.
+
+* ``STOP -> RESUMING``: Start the process of restoring the device state. The
+  internal device state may be changed to prepare the device to receive the
+  migration data.
+
+The ``STOP_COPY -> PRE_COPY`` transition is explicitly not allowed and should
+return an error if requested.
+
+``ERROR`` cannot be specified as a device state, but any transition request can
+be failed and then move the state into ``ERROR`` if the server was unable to
+execute the requested arc AND was unable to restore the device into any valid
+state. To recover from ``ERROR``, ``VFIO_USER_DEVICE_RESET`` must be used to
+return back to ``RUNNING``.
+
+If ``PRE_COPY`` is not supported, arcs touching it are removed.
+
+Complex State Transitions
+"""""""""""""""""""""""""
+
+The remaining possible transitions are to be implemented as combinations of the
+above FSM arcs. As there are multiple paths, the path should be selected based
+on the following rules:
+
+* Select the shortest path.
+
+* The path cannot have saving group states as interior arcs, only start/end
+  states.
+
+``VFIO_DEVICE_FEATURE_DMA_LOGGING_START`` / ``VFIO_DEVICE_FEATURE_DMA_LOGGING_STOP``
+""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""""
+
+Upon ``VFIO_DEVICE_FEATURE_SET``, start/stop DMA logging. These features can
+also be probed to determine whether the device supports DMA logging.
+
+When DMA logging is started, a range of IOVAs to monitor is provided and the
+device can optimize its logging to cover only the IOVA range given. Only DMA
+writes are logged.
+
+The data field of the ``SET`` request is structured as follows:
+
++------------+--------+----------+
+| Name       | Offset | Size     |
++============+========+==========+
+| page_size  | 0      | 8        |
++------------+--------+----------+
+| num_ranges | 8      | 4        |
++------------+--------+----------+
+| reserved   | 12     | 4        |
++------------+--------+----------+
+| ranges     | 16     | variable |
++------------+--------+----------+
+
+* *page_size* hints what tracking granularity the device should try to achieve.
+  If the device cannot do the hinted page size then it's the driver's choice
+  which page size to pick based on its support. On output the device will return
+  the page size it selected.
+
+* *num_ranges* is the number of IOVA ranges to monitor. A value of zero
+  indicates that all writes should be logged.
+
+* *ranges* is an array of ``vfio_user_device_feature_dma_logging_range``
+  entries:
+
++--------+--------+------+
+| Name   | Offset | Size |
++========+========+======+
+| iova   | 0      | 8    |
++--------+--------+------+
+| length | 8      | 8    |
++--------+--------+------+
+
+  * *iova* is the base IO virtual address
+  * *length* is the length of the range to log
+
+Upon success, the response data field will be the same as the request, unless
+the page size was changed, in which case this will be reflected in the response.
+
+``VFIO_DEVICE_FEATURE_DMA_LOGGING_REPORT``
+""""""""""""""""""""""""""""""""""""""""""
+
+Upon ``VFIO_DEVICE_FEATURE_GET``, returns the dirty bitmap for a specific IOVA
+range. This operation is only valid if logging of dirty pages has been
+previously started by setting ``VFIO_DEVICE_FEATURE_DMA_LOGGING_START``.
+
+The data field of the request is structured as follows:
+
++-----------+--------+------+
+| Name      | Offset | Size |
++===========+========+======+
+| iova      | 0      | 8    |
++-----------+--------+------+
+| length    | 8      | 8    |
++-----------+--------+------+
+| page_size | 16     | 8    |
++-----------+--------+------+
+
+* *iova* is the base IO virtual address
+
+* *length* is the length of the range
+
+* *page_size* is the unit of granularity of the bitmap, and must be a power of
+  two. It doesn't have to match the value given to
+  ``VFIO_DEVICE_FEATURE_DMA_LOGGING_START`` because the driver will format its
+  internal logging to match the reporting page size possibly by replicating bits
+  if the internal page size is lower than requested
+
+The data field of the response is identical, except with the bitmap added on
+the end at offset 24.
+
+The bitmap is an array of u64s that holds the output bitmap, with 1 bit
+reporting a *page_size* unit of IOVA. The bits outside of the requested range
+must be zero.
+
+The mapping of IOVA to bits is given by:
+
+``bitmap[(addr - iova)/page_size] & (1ULL << (addr % 64))``
+
+``VFIO_USER_MIG_DATA_READ``
+---------------------------
+
+This command is used to read data from the source migration server while it is
+in a saving group state (``PRE_COPY`` or ``STOP_COPY``).
+
+This command, and ``VFIO_USER_MIG_DATA_WRITE``, are used in place of the
+``data_fd`` file descriptor in ``<linux/vfio.h>``
+(``struct vfio_device_feature_mig_state``) to enable all data transport to use
+the single already-established UNIX socket. Hence, the migration data is
+treated like a stream, so the client must continue reading until no more
+migration data remains.
+
+Request
+^^^^^^^
+
+The request payload for this message is a structure of the following format.
+
++-------+--------+------+
+| Name  | Offset | Size |
++=======+========+======+
+| argsz | 0      | 4    |
++-------+--------+------+
+| size  | 4      | 4    |
++-------+--------+------+
+
+* *argsz* is the maximum size of the reply payload.
+
+* *size* is the size of the migration data to read.
+
+Reply
+^^^^^
+
+The reply payload for this message is a structure of the following format.
+
++-------+--------+----------+
+| Name  | Offset | Size     |
++=======+========+==========+
+| argsz | 0      | 4        |
++-------+--------+----------+
+| size  | 4      | 4        |
++-------+--------+----------+
+| data  | 8      | variable |
++-------+--------+----------+
+
+* *argsz* is the size of the above structure, including the size of the data.
+
+* *size* indicates the size of returned migration data. If this is less than the
+  requested size, there is no more migration data to read.
+
+* *data* contains the migration data.
+
+``VFIO_USER_MIG_DATA_WRITE``
+----------------------------
+
+This command is used to write data to the destination migration server while it
+is in the ``RESUMING`` state.
+
+As above, this replaces the ``data_fd`` file descriptor for transport of
+migration data, and as such, the migration data is treated like a stream.
+
+Request
+^^^^^^^
+
+The request payload for this message is a structure of the following format.
+
++-------+--------+----------+
+| Name  | Offset | Size     |
++=======+========+==========+
+| argsz | 0      | 4        |
++-------+--------+----------+
+| size  | 4      | 4        |
++-------+--------+----------+
+| data  | 8      | variable |
++-------+--------+----------+
+
+* *argsz* is the maximum size of the reply payload.
+
+* *size* is the size of the migration data to be written.
+
+* *data* contains the migration data.
+
+Reply
+^^^^^
+
+There is no reply payload for this message.
 
 Appendices
 ==========

From a8731f691df2bd9efd041d836ece27e3173555f2 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Dec 2025 15:33:11 +0530
Subject: [PATCH 2267/2396] vfio-user: simplify vfio_user_process()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

It can figure out if it's a reply by itself, rather than passing that
information in.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20251203100316.3604456-2-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 11 ++++-------
 1 file changed, 4 insertions(+), 7 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index bbd7ec243d..75845d7c89 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -147,8 +147,7 @@ VFIOUserFDs *vfio_user_getfds(int numfds)
 /*
  * Process a received message.
  */
-static void vfio_user_process(VFIOUserProxy *proxy, VFIOUserMsg *msg,
-                              bool isreply)
+static void vfio_user_process(VFIOUserProxy *proxy, VFIOUserMsg *msg)
 {
 
     /*
@@ -157,7 +156,7 @@ static void vfio_user_process(VFIOUserProxy *proxy, VFIOUserMsg *msg,
      *
      * Requests get queued for the BH.
      */
-    if (isreply) {
+    if ((msg->hdr->flags & VFIO_USER_TYPE) == VFIO_USER_REPLY) {
         msg->complete = true;
         if (msg->type == VFIO_MSG_WAIT) {
             qemu_cond_signal(&msg->cv);
@@ -187,7 +186,6 @@ static int vfio_user_complete(VFIOUserProxy *proxy, Error **errp)
 {
     VFIOUserMsg *msg = proxy->part_recv;
     size_t msgleft = proxy->recv_left;
-    bool isreply;
     char *data;
     int ret;
 
@@ -214,8 +212,7 @@ static int vfio_user_complete(VFIOUserProxy *proxy, Error **errp)
      */
     proxy->part_recv = NULL;
     proxy->recv_left = 0;
-    isreply = (msg->hdr->flags & VFIO_USER_TYPE) == VFIO_USER_REPLY;
-    vfio_user_process(proxy, msg, isreply);
+    vfio_user_process(proxy, msg);
 
     /* return positive value */
     return 1;
@@ -381,7 +378,7 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
         data += ret;
     }
 
-    vfio_user_process(proxy, msg, isreply);
+    vfio_user_process(proxy, msg);
     return 0;
 
     /*

From 356c7b175258f29429fb91a7641f775080ab6b49 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Dec 2025 15:33:12 +0530
Subject: [PATCH 2268/2396] vfio-user: clarify partial message handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Improve a comment for this.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20251203100316.3604456-3-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 75845d7c89..82c76c6665 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -362,7 +362,10 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
     while (msgleft > 0) {
         ret = qio_channel_read(proxy->ioc, data, msgleft, errp);
 
-        /* prepare to complete read on next iternation */
+        /*
+         * We'll complete this read on the next go around; keep track of the
+         * partial message until then.
+         */
         if (ret == QIO_CHANNEL_ERR_BLOCK) {
             proxy->part_recv = msg;
             proxy->recv_left = msgleft;

From 7b884e2a27793e0ff5817ad04ecce85d0a90149d Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Dec 2025 15:33:13 +0530
Subject: [PATCH 2269/2396] vfio-user: refactor out header handling
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Simplify vfio_user_recv_one() by moving the header handling out to a
helper function.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251203100316.3604456-4-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 101 +++++++++++++++++++++++++------------------
 1 file changed, 60 insertions(+), 41 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index 82c76c6665..e0f9202535 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -218,6 +218,61 @@ static int vfio_user_complete(VFIOUserProxy *proxy, Error **errp)
     return 1;
 }
 
+static int vfio_user_recv_hdr(VFIOUserProxy *proxy, Error **errp,
+                              VFIOUserHdr *hdr, int **fdp, size_t *numfdp,
+                              bool *isreply)
+{
+    struct iovec iov = {
+        .iov_base = hdr,
+        .iov_len = sizeof(*hdr),
+    };
+    int ret;
+
+    /*
+     * Read header
+     */
+    ret = qio_channel_readv_full(proxy->ioc, &iov, 1, fdp, numfdp, 0,
+                                 errp);
+    if (ret == QIO_CHANNEL_ERR_BLOCK) {
+        return ret;
+    }
+
+    if (ret < 0) {
+        error_setg_errno(errp, errno, "failed to read header");
+        return -1;
+    } else if (ret == 0) {
+        error_setg(errp, "failed to read header: EOF");
+        return -1;
+    } else if (ret < sizeof(*hdr)) {
+        error_setg(errp, "short read of header");
+        return -1;
+    }
+
+    /*
+     * Validate header
+     */
+    if (hdr->size < sizeof(*hdr)) {
+        error_setg(errp, "bad header size");
+        return -1;
+    }
+
+    switch (hdr->flags & VFIO_USER_TYPE) {
+    case VFIO_USER_REQUEST:
+        *isreply = false;
+        break;
+    case VFIO_USER_REPLY:
+        *isreply = true;
+        break;
+    default:
+        error_setg(errp, "unknown message type");
+        return -1;
+    }
+
+    trace_vfio_user_recv_hdr(proxy->sockname, hdr->id, hdr->command, hdr->size,
+                             hdr->flags);
+    return 0;
+}
+
 /*
  * Receive and process one incoming message.
  *
@@ -230,10 +285,6 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
     g_autofree int *fdp = NULL;
     VFIOUserFDs *reqfds;
     VFIOUserHdr hdr;
-    struct iovec iov = {
-        .iov_base = &hdr,
-        .iov_len = sizeof(hdr),
-    };
     bool isreply = false;
     int i, ret;
     size_t msgleft, numfds = 0;
@@ -257,46 +308,14 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
         /* else fall into reading another msg */
     }
 
-    /*
-     * Read header
-     */
-    ret = qio_channel_readv_full(proxy->ioc, &iov, 1, &fdp, &numfds, 0,
-                                 errp);
-    if (ret == QIO_CHANNEL_ERR_BLOCK) {
-        return ret;
-    }
-
-    /* read error or other side closed connection */
-    if (ret <= 0) {
+    ret = vfio_user_recv_hdr(proxy, errp, &hdr, &fdp, &numfds, &isreply);
+    if (ret < 0) {
+        if (ret == QIO_CHANNEL_ERR_BLOCK) {
+            return ret;
+        }
         goto fatal;
     }
 
-    if (ret < sizeof(hdr)) {
-        error_setg(errp, "short read of header");
-        goto fatal;
-    }
-
-    /*
-     * Validate header
-     */
-    if (hdr.size < sizeof(VFIOUserHdr)) {
-        error_setg(errp, "bad header size");
-        goto fatal;
-    }
-    switch (hdr.flags & VFIO_USER_TYPE) {
-    case VFIO_USER_REQUEST:
-        isreply = false;
-        break;
-    case VFIO_USER_REPLY:
-        isreply = true;
-        break;
-    default:
-        error_setg(errp, "unknown message type");
-        goto fatal;
-    }
-    trace_vfio_user_recv_hdr(proxy->sockname, hdr.id, hdr.command, hdr.size,
-                             hdr.flags);
-
     /*
      * For replies, find the matching pending request.
      * For requests, reap incoming FDs.

From 0df8baec95b76c93093efde37d1644508c3c7d2c Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Dec 2025 15:33:14 +0530
Subject: [PATCH 2270/2396] vfio-user: simplify vfio_user_recv_one()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This function was unnecessarily difficult to understand due to the
separate handling of request and reply messages. Use common code for
both where we can.

Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20251203100316.3604456-5-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 68 +++++++++++++++++++-------------------------
 1 file changed, 30 insertions(+), 38 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index e0f9202535..f2601eada5 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -281,15 +281,14 @@ static int vfio_user_recv_hdr(VFIOUserProxy *proxy, Error **errp,
  */
 static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
 {
-    VFIOUserMsg *msg = NULL;
     g_autofree int *fdp = NULL;
-    VFIOUserFDs *reqfds;
-    VFIOUserHdr hdr;
+    VFIOUserMsg *msg = NULL;
     bool isreply = false;
-    int i, ret;
-    size_t msgleft, numfds = 0;
+    size_t msgleft = 0;
+    size_t numfds = 0;
     char *data = NULL;
-    char *buf = NULL;
+    VFIOUserHdr hdr;
+    int i, ret;
 
     /*
      * Complete any partial reads
@@ -317,8 +316,8 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
     }
 
     /*
-     * For replies, find the matching pending request.
-     * For requests, reap incoming FDs.
+     * Find the matching request if this is a reply, or initialize a new
+     * server->client request.
      */
     if (isreply) {
         QTAILQ_FOREACH(msg, &proxy->pending, next) {
@@ -332,51 +331,44 @@ static int vfio_user_recv_one(VFIOUserProxy *proxy, Error **errp)
         }
         QTAILQ_REMOVE(&proxy->pending, msg, next);
 
-        /*
-         * Process any received FDs
-         */
-        if (numfds != 0) {
-            if (msg->fds == NULL || msg->fds->recv_fds < numfds) {
-                error_setg(errp, "unexpected FDs");
-                goto err;
-            }
-            msg->fds->recv_fds = numfds;
-            memcpy(msg->fds->fds, fdp, numfds * sizeof(int));
-        }
-    } else {
-        if (numfds != 0) {
-            reqfds = vfio_user_getfds(numfds);
-            memcpy(reqfds->fds, fdp, numfds * sizeof(int));
-        } else {
-            reqfds = NULL;
-        }
-    }
-
-    /*
-     * Put the whole message into a single buffer.
-     */
-    if (isreply) {
         if (hdr.size > msg->rsize) {
             error_setg(errp, "reply larger than recv buffer");
             goto err;
         }
-        *msg->hdr = hdr;
-        data = (char *)msg->hdr + sizeof(hdr);
     } else {
+        void *buf;
+
         if (hdr.size > proxy->max_xfer_size + sizeof(VFIOUserDMARW)) {
             error_setg(errp, "vfio_user_recv request larger than max");
             goto err;
         }
+
         buf = g_malloc0(hdr.size);
-        memcpy(buf, &hdr, sizeof(hdr));
-        data = buf + sizeof(hdr);
-        msg = vfio_user_getmsg(proxy, (VFIOUserHdr *)buf, reqfds);
+        msg = vfio_user_getmsg(proxy, buf, NULL);
         msg->type = VFIO_MSG_REQ;
     }
 
+    *msg->hdr = hdr;
+    data = (char *)msg->hdr + sizeof(hdr);
+
+    if (numfds != 0) {
+        if (msg->type == VFIO_MSG_REQ) {
+            msg->fds = vfio_user_getfds(numfds);
+        } else {
+            if (msg->fds == NULL || msg->fds->recv_fds < numfds) {
+                error_setg(errp, "unexpected FDs in reply");
+                goto err;
+            }
+            msg->fds->recv_fds = numfds;
+        }
+
+        memcpy(msg->fds->fds, fdp, numfds * sizeof(int));
+    }
+
     /*
-     * Read rest of message.
+     * Read rest of message into the data buffer.
      */
+
     msgleft = hdr.size - sizeof(hdr);
     while (msgleft > 0) {
         ret = qio_channel_read(proxy->ioc, data, msgleft, errp);

From 23c586abf2e12843894189c4742c8ea55c594cd5 Mon Sep 17 00:00:00 2001
From: John Levon <john.levon@nutanix.com>
Date: Wed, 3 Dec 2025 15:33:15 +0530
Subject: [PATCH 2271/2396] vfio-user: recycle msg on failure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If we fail to read an incoming request, recycle the message.

Resolves: Coverity CID 1611807
Resolves: Coverity CID 1611808
Signed-off-by: John Levon <john.levon@nutanix.com>
Reviewed-by: Mark Cave-Ayland <mark.caveayland@nutanix.com>
Link: https://lore.kernel.org/qemu-devel/20251203100316.3604456-6-john.levon@nutanix.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/vfio-user/proxy.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/hw/vfio-user/proxy.c b/hw/vfio-user/proxy.c
index f2601eada5..314dfd23d8 100644
--- a/hw/vfio-user/proxy.c
+++ b/hw/vfio-user/proxy.c
@@ -412,11 +412,22 @@ err:
     for (i = 0; i < numfds; i++) {
         close(fdp[i]);
     }
-    if (isreply && msg != NULL) {
-        /* force an error to keep sending thread from hanging */
-        vfio_user_set_error(msg->hdr, EINVAL);
-        msg->complete = true;
-        qemu_cond_signal(&msg->cv);
+    if (msg != NULL) {
+        if (msg->type == VFIO_MSG_REQ) {
+            /*
+             * Clean up the request message on failure. Change type back to
+             * NOWAIT to free.
+             */
+            msg->type = VFIO_MSG_NOWAIT;
+            vfio_user_recycle(proxy, msg);
+        } else {
+            /*
+             * Report an error back to the sender. Sender will recycle msg.
+             */
+            vfio_user_set_error(msg->hdr, EINVAL);
+            msg->complete = true;
+            qemu_cond_signal(&msg->cv);
+        }
     }
     return -1;
 }

From 2c3165a1a61c299b4a3ae30899e1cc738d20e004 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 28 Nov 2025 23:14:40 +0100
Subject: [PATCH 2272/2396] file-posix: Handle suspended dm-multipath better
 for SG_IO

When introducing DM_MPATH_PROBE_PATHS, we already anticipated that
dm-multipath devices might be suspended for a short time when the DM
tables are reloaded and that they return -EAGAIN in this case. We then
wait for a millisecond and retry.

However, meanwhile it has also turned out that libmpathpersist (which is
used by qemu-pr-helper) may need to perform more complex recovery
operations to get reservations back to expected state if a path failure
happened in the middle of a PR operation. In this case, the device is
suspended for a longer time compared to the case we originally expected.

This patch changes hdev_co_ioctl() to treat -EAGAIN separately so that
it doesn't result in an immediate failure if the device is suspended for
more than 1ms, and moves to incremental backoff to cover both quick and
slow cases without excessive delays.

Buglink: https://issues.redhat.com/browse/RHEL-121543
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251128221440.89125-1-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/file-posix.c | 56 ++++++++++++++++++++++++++++------------------
 1 file changed, 34 insertions(+), 22 deletions(-)

diff --git a/block/file-posix.c b/block/file-posix.c
index c9e367a222..6265d2e248 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -4288,25 +4288,8 @@ hdev_open_Mac_error:
 static bool coroutine_fn sgio_path_error(int ret, sg_io_hdr_t *io_hdr)
 {
     if (ret < 0) {
-        switch (ret) {
-        case -ENODEV:
-            return true;
-        case -EAGAIN:
-            /*
-             * The device is probably suspended. This happens while the dm table
-             * is reloaded, e.g. because a path is added or removed. This is an
-             * operation that should complete within 1ms, so just wait a bit and
-             * retry.
-             *
-             * If the device was suspended for another reason, we'll wait and
-             * retry SG_IO_MAX_RETRIES times. This is a tolerable delay before
-             * we return an error and potentially stop the VM.
-             */
-            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
-            return true;
-        default:
-            return false;
-        }
+        /* Path errors sometimes result in -ENODEV */
+        return ret == -ENODEV;
     }
 
     if (io_hdr->host_status != SCSI_HOST_OK) {
@@ -4375,6 +4358,7 @@ hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
 {
     BDRVRawState *s = bs->opaque;
     RawPosixAIOData acb;
+    uint64_t eagain_sleep_ns = 1 * SCALE_MS;
     int retries = SG_IO_MAX_RETRIES;
     int ret;
 
@@ -4403,9 +4387,37 @@ hdev_co_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
         },
     };
 
-    do {
-        ret = raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
-    } while (req == SG_IO && retries-- && hdev_co_ioctl_sgio_retry(&acb, ret));
+retry:
+    ret = raw_thread_pool_submit(handle_aiocb_ioctl, &acb);
+    if (req == SG_IO && s->use_mpath) {
+        if (ret == -EAGAIN && eagain_sleep_ns < NANOSECONDS_PER_SECOND) {
+            /*
+             * If this is a multipath device, it is probably suspended.
+             *
+             * This can happen while the dm table is reloaded, e.g. because a
+             * path is added or removed. This is an operation that should
+             * complete within 1ms, so just wait a bit and retry.
+             *
+             * There are also some cases in which libmpathpersist must recover
+             * from path failure during its operation, which can leave the
+             * device suspended for a bit longer while the library brings back
+             * reservations into the expected state.
+             *
+             * Use increasing delays to cover both cases without waiting
+             * excessively, and stop after a bit more than a second (1023 ms).
+             * This is a tolerable delay before we return an error and
+             * potentially stop the VM.
+             */
+            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, eagain_sleep_ns);
+            eagain_sleep_ns *= 2;
+            goto retry;
+        }
+
+        /* Even for ret == 0, the SG_IO header can contain an error */
+        if (retries-- && hdev_co_ioctl_sgio_retry(&acb, ret)) {
+            goto retry;
+        }
+    }
 
     return ret;
 }

From 41706d3e72d651edb03b4a06b02b490bec8a3ddf Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 2 Dec 2025 16:40:52 -0800
Subject: [PATCH 2273/2396] tcg: Zero extend 32-bit addresses for TCI

For native code generation, zero-extending 32-bit addresses for
the slow path helpers happens in tcg_out_{ld,st}_helper_args,
but there isn't really a slow path for TCI, so that didn't happen.

Make the extension for TCI explicit in the opcode stream,
much like we already do for plugins and atomic helpers.

Cc: qemu-stable@nongnu.org
Fixes: 24e46e6c9d9 ("accel/tcg: Widen tcg-ldst.h addresses to uint64_t")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-ldst.c | 72 +++++++++++++++++++++++++++++++++++++++--------
 1 file changed, 61 insertions(+), 11 deletions(-)

diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 67c15fd4d0..1c0b06dbc7 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -135,6 +135,30 @@ static void tcg_gen_req_mo(TCGBar type)
     }
 }
 
+static TCGTemp *tci_extend_addr(TCGTemp *addr)
+{
+#ifdef CONFIG_TCG_INTERPRETER
+    /*
+     * 64-bit interpreter requires 64-bit addresses.
+     * Compare to the extension performed by tcg_out_{ld,st}_helper_args
+     * for native code generation.
+     */
+    if (TCG_TARGET_REG_BITS == 64 && tcg_ctx->addr_type == TCG_TYPE_I32) {
+        TCGv_i64 temp = tcg_temp_ebb_new_i64();
+        tcg_gen_extu_i32_i64(temp, temp_tcgv_i32(addr));
+        return tcgv_i64_temp(temp);
+    }
+#endif
+    return addr;
+}
+
+static void maybe_free_addr(TCGTemp *addr, TCGTemp *copy)
+{
+    if (addr != copy) {
+        tcg_temp_free_internal(copy);
+    }
+}
+
 /* Only required for loads, where value might overlap addr. */
 static TCGv_i64 plugin_maybe_preserve_addr(TCGTemp *addr)
 {
@@ -234,6 +258,7 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
     MemOp orig_memop;
     MemOpIdx orig_oi, oi;
     TCGv_i64 copy_addr;
+    TCGTemp *addr_new;
 
     tcg_gen_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
     orig_memop = memop = tcg_canonicalize_memop(memop, 0, 0);
@@ -248,10 +273,12 @@ static void tcg_gen_qemu_ld_i32_int(TCGv_i32 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
+    addr_new = tci_extend_addr(addr);
     copy_addr = plugin_maybe_preserve_addr(addr);
-    gen_ldst1(INDEX_op_qemu_ld, TCG_TYPE_I32, tcgv_i32_temp(val), addr, oi);
+    gen_ldst1(INDEX_op_qemu_ld, TCG_TYPE_I32, tcgv_i32_temp(val), addr_new, oi);
     plugin_gen_mem_callbacks_i32(val, copy_addr, addr, orig_oi,
                                  QEMU_PLUGIN_MEM_R);
+    maybe_free_addr(addr, addr_new);
 
     if ((orig_memop ^ memop) & MO_BSWAP) {
         switch (orig_memop & MO_SIZE) {
@@ -282,6 +309,7 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
 {
     TCGv_i32 swap = NULL;
     MemOpIdx orig_oi, oi;
+    TCGTemp *addr_new;
 
     tcg_gen_req_mo(TCG_MO_LD_ST | TCG_MO_ST_ST);
     memop = tcg_canonicalize_memop(memop, 0, 1);
@@ -304,8 +332,10 @@ static void tcg_gen_qemu_st_i32_int(TCGv_i32 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
-    gen_ldst1(INDEX_op_qemu_st, TCG_TYPE_I32, tcgv_i32_temp(val), addr, oi);
+    addr_new = tci_extend_addr(addr);
+    gen_ldst1(INDEX_op_qemu_st, TCG_TYPE_I32, tcgv_i32_temp(val), addr_new, oi);
     plugin_gen_mem_callbacks_i32(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
+    maybe_free_addr(addr, addr_new);
 
     if (swap) {
         tcg_temp_free_i32(swap);
@@ -326,6 +356,7 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
     MemOp orig_memop;
     MemOpIdx orig_oi, oi;
     TCGv_i64 copy_addr;
+    TCGTemp *addr_new;
 
     if (TCG_TARGET_REG_BITS == 32 && (memop & MO_SIZE) < MO_64) {
         tcg_gen_qemu_ld_i32_int(TCGV_LOW(val), addr, idx, memop);
@@ -350,10 +381,12 @@ static void tcg_gen_qemu_ld_i64_int(TCGv_i64 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
+    addr_new = tci_extend_addr(addr);
     copy_addr = plugin_maybe_preserve_addr(addr);
-    gen_ld_i64(val, addr, oi);
+    gen_ld_i64(val, addr_new, oi);
     plugin_gen_mem_callbacks_i64(val, copy_addr, addr, orig_oi,
                                  QEMU_PLUGIN_MEM_R);
+    maybe_free_addr(addr, addr_new);
 
     if ((orig_memop ^ memop) & MO_BSWAP) {
         int flags = (orig_memop & MO_SIGN
@@ -388,6 +421,7 @@ static void tcg_gen_qemu_st_i64_int(TCGv_i64 val, TCGTemp *addr,
 {
     TCGv_i64 swap = NULL;
     MemOpIdx orig_oi, oi;
+    TCGTemp *addr_new;
 
     if (TCG_TARGET_REG_BITS == 32 && (memop & MO_SIZE) < MO_64) {
         tcg_gen_qemu_st_i32_int(TCGV_LOW(val), addr, idx, memop);
@@ -418,8 +452,10 @@ static void tcg_gen_qemu_st_i64_int(TCGv_i64 val, TCGTemp *addr,
         oi = make_memop_idx(memop, idx);
     }
 
-    gen_st_i64(val, addr, oi);
+    addr_new = tci_extend_addr(addr);
+    gen_st_i64(val, addr_new, oi);
     plugin_gen_mem_callbacks_i64(val, NULL, addr, orig_oi, QEMU_PLUGIN_MEM_W);
+    maybe_free_addr(addr, addr_new);
 
     if (swap) {
         tcg_temp_free_i64(swap);
@@ -530,6 +566,7 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
 {
     MemOpIdx orig_oi;
     TCGv_i64 ext_addr = NULL;
+    TCGTemp *addr_new;
 
     check_max_alignment(memop_alignment_bits(memop));
     tcg_gen_req_mo(TCG_MO_LD_LD | TCG_MO_ST_LD);
@@ -557,8 +594,10 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             hi = TCGV128_HIGH(val);
         }
 
+        addr_new = tci_extend_addr(addr);
         gen_ldst2(INDEX_op_qemu_ld2, TCG_TYPE_I128, tcgv_i64_temp(lo),
-                  tcgv_i64_temp(hi), addr, oi);
+                  tcgv_i64_temp(hi), addr_new, oi);
+        maybe_free_addr(addr, addr_new);
 
         if (need_bswap) {
             tcg_gen_bswap64_i64(lo, lo);
@@ -586,7 +625,9 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             y = TCGV128_LOW(val);
         }
 
-        gen_ld_i64(x, addr, make_memop_idx(mop[0], idx));
+        addr_new = tci_extend_addr(addr);
+        gen_ld_i64(x, addr_new, make_memop_idx(mop[0], idx));
+        maybe_free_addr(addr, addr_new);
 
         if (need_bswap) {
             tcg_gen_bswap64_i64(x, x);
@@ -602,7 +643,9 @@ static void tcg_gen_qemu_ld_i128_int(TCGv_i128 val, TCGTemp *addr,
             addr_p8 = tcgv_i64_temp(t);
         }
 
-        gen_ld_i64(y, addr_p8, make_memop_idx(mop[1], idx));
+        addr_new = tci_extend_addr(addr_p8);
+        gen_ld_i64(y, addr_new, make_memop_idx(mop[1], idx));
+        maybe_free_addr(addr_p8, addr_new);
         tcg_temp_free_internal(addr_p8);
 
         if (need_bswap) {
@@ -636,6 +679,7 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
 {
     MemOpIdx orig_oi;
     TCGv_i64 ext_addr = NULL;
+    TCGTemp *addr_new;
 
     check_max_alignment(memop_alignment_bits(memop));
     tcg_gen_req_mo(TCG_MO_ST_LD | TCG_MO_ST_ST);
@@ -666,8 +710,10 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
             hi = TCGV128_HIGH(val);
         }
 
+        addr_new = tci_extend_addr(addr);
         gen_ldst2(INDEX_op_qemu_st2, TCG_TYPE_I128,
-                  tcgv_i64_temp(lo), tcgv_i64_temp(hi), addr, oi);
+                  tcgv_i64_temp(lo), tcgv_i64_temp(hi), addr_new, oi);
+        maybe_free_addr(addr, addr_new);
 
         if (need_bswap) {
             tcg_temp_free_i64(lo);
@@ -694,7 +740,9 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
             x = b;
         }
 
-        gen_st_i64(x, addr, make_memop_idx(mop[0], idx));
+        addr_new = tci_extend_addr(addr);
+        gen_st_i64(x, addr_new, make_memop_idx(mop[0], idx));
+        maybe_free_addr(addr, addr_new);
 
         if (tcg_ctx->addr_type == TCG_TYPE_I32) {
             TCGv_i32 t = tcg_temp_ebb_new_i32();
@@ -706,13 +754,15 @@ static void tcg_gen_qemu_st_i128_int(TCGv_i128 val, TCGTemp *addr,
             addr_p8 = tcgv_i64_temp(t);
         }
 
+        addr_new = tci_extend_addr(addr_p8);
         if (b) {
             tcg_gen_bswap64_i64(b, y);
-            gen_st_i64(b, addr_p8, make_memop_idx(mop[1], idx));
+            gen_st_i64(b, addr_new, make_memop_idx(mop[1], idx));
             tcg_temp_free_i64(b);
         } else {
-            gen_st_i64(y, addr_p8, make_memop_idx(mop[1], idx));
+            gen_st_i64(y, addr_new, make_memop_idx(mop[1], idx));
         }
+        maybe_free_addr(addr_p8, addr_new);
         tcg_temp_free_internal(addr_p8);
     } else {
         if (tcg_ctx->addr_type == TCG_TYPE_I32) {

From 92cf74baf4984e87083474f23021a0c6f4719bea Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Mon, 1 Dec 2025 14:02:41 -0800
Subject: [PATCH 2274/2396] tcg/tci: Introduce INDEX_op_tci_qemu_{ld,st}_rrr
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since d182123974c4, the number of bits in a MemOpIdx tops out at 17.
which won't fit in the TCI rrm format, thus an assertion failure.
Introduce new opcodes that take the MemOpIdx from a register, as
we already do for qemu_ld2 and qemu_st2.

Fixes: d182123974c4 ("include/exec/memopidx: Adjust for 32 mmu indexes")
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tci.c                    | 19 +++++++++++++++++++
 tcg/tci/tcg-target-opc.h.inc |  2 ++
 tcg/tci/tcg-target.c.inc     | 14 ++++++++++++--
 3 files changed, 33 insertions(+), 2 deletions(-)

diff --git a/tcg/tci.c b/tcg/tci.c
index 700e672616..e15d4e8e08 100644
--- a/tcg/tci.c
+++ b/tcg/tci.c
@@ -794,12 +794,24 @@ uintptr_t QEMU_DISABLE_CFI tcg_qemu_tb_exec(CPUArchState *env,
             taddr = regs[r1];
             regs[r0] = tci_qemu_ld(env, taddr, oi, tb_ptr);
             break;
+        case INDEX_op_tci_qemu_ld_rrr:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            taddr = regs[r1];
+            oi = regs[r2];
+            regs[r0] = tci_qemu_ld(env, taddr, oi, tb_ptr);
+            break;
 
         case INDEX_op_qemu_st:
             tci_args_rrm(insn, &r0, &r1, &oi);
             taddr = regs[r1];
             tci_qemu_st(env, taddr, regs[r0], oi, tb_ptr);
             break;
+        case INDEX_op_tci_qemu_st_rrr:
+            tci_args_rrr(insn, &r0, &r1, &r2);
+            taddr = regs[r1];
+            oi = regs[r2];
+            tci_qemu_st(env, taddr, regs[r0], oi, tb_ptr);
+            break;
 
         case INDEX_op_qemu_ld2:
             tcg_debug_assert(TCG_TARGET_REG_BITS == 32);
@@ -1050,6 +1062,13 @@ int print_insn_tci(bfd_vma addr, disassemble_info *info)
                            op_name, str_r(r0), str_r(r1), oi);
         break;
 
+    case INDEX_op_tci_qemu_ld_rrr:
+    case INDEX_op_tci_qemu_st_rrr:
+        tci_args_rrr(insn, &r0, &r1, &r2);
+        info->fprintf_func(info->stream, "%-12s  %s, %s, %s",
+                           op_name, str_r(r0), str_r(r1), str_r(r2));
+        break;
+
     case INDEX_op_qemu_ld2:
     case INDEX_op_qemu_st2:
         tci_args_rrrr(insn, &r0, &r1, &r2, &r3);
diff --git a/tcg/tci/tcg-target-opc.h.inc b/tcg/tci/tcg-target-opc.h.inc
index 4eb32ed736..f8bfffc125 100644
--- a/tcg/tci/tcg-target-opc.h.inc
+++ b/tcg/tci/tcg-target-opc.h.inc
@@ -13,3 +13,5 @@ DEF(tci_rotl32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_rotr32, 1, 2, 0, TCG_OPF_NOT_PRESENT)
 DEF(tci_setcond32, 1, 2, 1, TCG_OPF_NOT_PRESENT)
 DEF(tci_movcond32, 1, 2, 1, TCG_OPF_NOT_PRESENT)
+DEF(tci_qemu_ld_rrr, 1, 2, 0, TCG_OPF_NOT_PRESENT)
+DEF(tci_qemu_st_rrr, 0, 3, 0, TCG_OPF_NOT_PRESENT)
diff --git a/tcg/tci/tcg-target.c.inc b/tcg/tci/tcg-target.c.inc
index 35c66a4836..532f87262c 100644
--- a/tcg/tci/tcg-target.c.inc
+++ b/tcg/tci/tcg-target.c.inc
@@ -1188,7 +1188,12 @@ static const TCGOutOpStore outop_st = {
 static void tgen_qemu_ld(TCGContext *s, TCGType type, TCGReg data,
                          TCGReg addr, MemOpIdx oi)
 {
-    tcg_out_op_rrm(s, INDEX_op_qemu_ld, data, addr, oi);
+    if (oi & ~0xffff) {
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, oi);
+        tcg_out_op_rrr(s, INDEX_op_tci_qemu_ld_rrr, data, addr, TCG_REG_TMP);
+    } else {
+        tcg_out_op_rrm(s, INDEX_op_qemu_ld, data, addr, oi);
+    }
 }
 
 static const TCGOutOpQemuLdSt outop_qemu_ld = {
@@ -1213,7 +1218,12 @@ static const TCGOutOpQemuLdSt2 outop_qemu_ld2 = {
 static void tgen_qemu_st(TCGContext *s, TCGType type, TCGReg data,
                          TCGReg addr, MemOpIdx oi)
 {
-    tcg_out_op_rrm(s, INDEX_op_qemu_st, data, addr, oi);
+    if (oi & ~0xffff) {
+        tcg_out_movi(s, TCG_TYPE_I32, TCG_REG_TMP, oi);
+        tcg_out_op_rrr(s, INDEX_op_tci_qemu_st_rrr, data, addr, TCG_REG_TMP);
+    } else {
+        tcg_out_op_rrm(s, INDEX_op_qemu_st, data, addr, oi);
+    }
 }
 
 static const TCGOutOpQemuLdSt outop_qemu_st = {

From 93fa8293442fcb1f297d0ee7c669539cd009cf26 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 2 Dec 2025 07:47:24 -0800
Subject: [PATCH 2275/2396] tcg: Remove duplicate test from
 plugin_gen_mem_callbacks
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

All callers have already tested tcg_ctx->plugin_insn.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 tcg/tcg-op-ldst.c | 24 +++++++++++-------------
 1 file changed, 11 insertions(+), 13 deletions(-)

diff --git a/tcg/tcg-op-ldst.c b/tcg/tcg-op-ldst.c
index 1c0b06dbc7..7716c3ad7c 100644
--- a/tcg/tcg-op-ldst.c
+++ b/tcg/tcg-op-ldst.c
@@ -182,23 +182,21 @@ static void
 plugin_gen_mem_callbacks(TCGv_i64 copy_addr, TCGTemp *orig_addr, MemOpIdx oi,
                          enum qemu_plugin_mem_rw rw)
 {
-    if (tcg_ctx->plugin_insn != NULL) {
-        qemu_plugin_meminfo_t info = make_plugin_meminfo(oi, rw);
+    qemu_plugin_meminfo_t info = make_plugin_meminfo(oi, rw);
 
-        if (tcg_ctx->addr_type == TCG_TYPE_I32) {
-            if (!copy_addr) {
-                copy_addr = tcg_temp_ebb_new_i64();
-                tcg_gen_extu_i32_i64(copy_addr, temp_tcgv_i32(orig_addr));
-            }
+    if (tcg_ctx->addr_type == TCG_TYPE_I32) {
+        if (!copy_addr) {
+            copy_addr = tcg_temp_ebb_new_i64();
+            tcg_gen_extu_i32_i64(copy_addr, temp_tcgv_i32(orig_addr));
+        }
+        tcg_gen_plugin_mem_cb(copy_addr, info);
+        tcg_temp_free_i64(copy_addr);
+    } else {
+        if (copy_addr) {
             tcg_gen_plugin_mem_cb(copy_addr, info);
             tcg_temp_free_i64(copy_addr);
         } else {
-            if (copy_addr) {
-                tcg_gen_plugin_mem_cb(copy_addr, info);
-                tcg_temp_free_i64(copy_addr);
-            } else {
-                tcg_gen_plugin_mem_cb(temp_tcgv_i64(orig_addr), info);
-            }
+            tcg_gen_plugin_mem_cb(temp_tcgv_i64(orig_addr), info);
         }
     }
 }

From 8c00f56fcaf60f42474ca277e86c95f55941aa0d Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 3 Dec 2025 14:04:21 +0000
Subject: [PATCH 2276/2396] tcg/tci: Disable -Wundef FFI_GO_CLOSURES warning
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we build TCI with FFI (commit 22f15579fa1 "tcg: Build ffi data
structures for helpers") we get on Darwin:

  In file included from ../../tcg/tci.c:22:
  In file included from include/tcg/helper-info.h:13:
  /Library/Developer/CommandLineTools/SDKs/MacOSX15.sdk/usr/include/ffi/ffi.h:483:5: warning: 'FFI_GO_CLOSURES' is not defined, evaluates to 0 [-Wundef]
    483 | #if FFI_GO_CLOSURES
        |     ^
  1 warning generated.

This was fixed in upstream libffi in 2023, but not backported to MacOSX.
Simply disable the warning locally.

Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/tcg/helper-info.h | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/include/tcg/helper-info.h b/include/tcg/helper-info.h
index 909fe73afa..49a27e4eae 100644
--- a/include/tcg/helper-info.h
+++ b/include/tcg/helper-info.h
@@ -10,7 +10,19 @@
 #define TCG_HELPER_INFO_H
 
 #ifdef CONFIG_TCG_INTERPRETER
+/*
+ * MacOSX 15 uses an old version of libffi which contains
+ *   #if FFI_GO_CLOSURES
+ * but does not define that in <ffitarget.h>, included from <ffi.h>.
+ * This was fixed upstream with
+ *   https://github.com/libffi/libffi/commit/c23e9a1c
+ * We don't care about go closures one way or the other;
+ * just suppress the warning.
+ */
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wundef"
 #include <ffi.h>
+#pragma GCC diagnostic pop
 #endif
 #include "tcg-target-reg-bits.h"
 

From 6833615bfdd7e104fabb7223df50e18dce2d161c Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 3 Dec 2025 13:41:45 +0000
Subject: [PATCH 2277/2396] include/generic/host: Fix atomic128-cas.h.inc for
 Int128 structure
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Use the Int128Alias structure more when we need to convert
between Int128 and __int128_t, when Int128 is a struct.

Fixes the build on aarch64 host with TCI, which forces
the use of the struct.

Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/generic/host/atomic128-cas.h.inc | 24 ++++++++++++-------
 1 file changed, 15 insertions(+), 9 deletions(-)

diff --git a/host/include/generic/host/atomic128-cas.h.inc b/host/include/generic/host/atomic128-cas.h.inc
index 990162c56f..8bf5f47768 100644
--- a/host/include/generic/host/atomic128-cas.h.inc
+++ b/host/include/generic/host/atomic128-cas.h.inc
@@ -34,39 +34,45 @@ static inline Int128 ATTRIBUTE_ATOMIC128_OPT
 atomic16_xchg(Int128 *ptr, Int128 new)
 {
     __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
-    Int128 old = *ptr_align;
+    Int128Alias o, n;
 
-    while (!__atomic_compare_exchange_n(ptr_align, &old, new, true,
+    n.s = new;
+    o.i = *ptr_align;
+    while (!__atomic_compare_exchange_n(ptr_align, &o.i, n.i, true,
                                         __ATOMIC_SEQ_CST, 0)) {
         continue;
     }
-    return old;
+    return o.s;
 }
 
 static inline Int128 ATTRIBUTE_ATOMIC128_OPT
 atomic16_fetch_and(Int128 *ptr, Int128 val)
 {
     __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
-    Int128 old = *ptr_align;
+    Int128Alias o, v;
 
-    while (!__atomic_compare_exchange_n(ptr_align, &old, old & val, true,
+    v.s = val;
+    o.i = *ptr_align;
+    while (!__atomic_compare_exchange_n(ptr_align, &o.i, o.i & v.i, true,
                                         __ATOMIC_SEQ_CST, 0)) {
         continue;
     }
-    return old;
+    return o.s;
 }
 
 static inline Int128 ATTRIBUTE_ATOMIC128_OPT
 atomic16_fetch_or(Int128 *ptr, Int128 val)
 {
     __int128_t *ptr_align = __builtin_assume_aligned(ptr, 16);
-    Int128 old = *ptr_align;
+    Int128Alias o, v;
 
-    while (!__atomic_compare_exchange_n(ptr_align, &old, old | val, true,
+    v.s = val;
+    o.i = *ptr_align;
+    while (!__atomic_compare_exchange_n(ptr_align, &o.i, o.i | v.i, true,
                                         __ATOMIC_SEQ_CST, 0)) {
         continue;
     }
-    return old;
+    return o.s;
 }
 # define HAVE_CMPXCHG128 1
 #elif defined(CONFIG_CMPXCHG128)

From ff633bc5d55a309122d306a83d09a4362de28b65 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 3 Dec 2025 15:19:40 +0000
Subject: [PATCH 2278/2396] include/aarch64/host: Fix atomic16_fetch_{and,or}
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The tmp[lh] variables were defined as inputs to the
asm rather than outputs, which meant that the compiler
rightly diagnosed uninitialized inputs.

Reported-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 host/include/aarch64/host/atomic128-cas.h.inc | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/host/include/aarch64/host/atomic128-cas.h.inc b/host/include/aarch64/host/atomic128-cas.h.inc
index aec27df182..52e98a0bdd 100644
--- a/host/include/aarch64/host/atomic128-cas.h.inc
+++ b/host/include/aarch64/host/atomic128-cas.h.inc
@@ -67,9 +67,9 @@ static inline Int128 atomic16_fetch_and(Int128 *ptr, Int128 new)
         "stlxp %w[tmp], %[tmpl], %[tmph], %[mem]\n\t"
         "cbnz %w[tmp], 0b"
         : [mem] "+m"(*ptr), [tmp] "=&r"(tmp),
-          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh)
-        : [newl] "r"(newl), [newh] "r"(newh),
-          [tmpl] "r"(tmpl), [tmph] "r"(tmph)
+          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh),
+          [tmpl] "=&r"(tmpl), [tmph] "=&r"(tmph)
+        : [newl] "r"(newl), [newh] "r"(newh)
         : "memory");
 
     return int128_make128(oldl, oldh);
@@ -87,9 +87,9 @@ static inline Int128 atomic16_fetch_or(Int128 *ptr, Int128 new)
         "stlxp %w[tmp], %[tmpl], %[tmph], %[mem]\n\t"
         "cbnz %w[tmp], 0b"
         : [mem] "+m"(*ptr), [tmp] "=&r"(tmp),
-          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh)
-        : [newl] "r"(newl), [newh] "r"(newh),
-          [tmpl] "r"(tmpl), [tmph] "r"(tmph)
+          [oldl] "=&r"(oldl), [oldh] "=&r"(oldh),
+          [tmpl] "=&r"(tmpl), [tmph] "=&r"(tmph)
+        : [newl] "r"(newl), [newh] "r"(newh)
         : "memory");
 
     return int128_make128(oldl, oldh);

From ca49625616d61554725257a98d7fd131f9ccc4d1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:52 +0000
Subject: [PATCH 2279/2396] gitlab: drop --disable-pie from
 aarch64-all-linux-static build
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since we have upgraded to 24.04 with its new libc we no longer need
this workaround.

Link: https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1987438
Suggested-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204194902.1340008-2-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
index 98d9919345..b4c0faab15 100644
--- a/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+++ b/.gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
@@ -41,9 +41,7 @@
 ubuntu-24.04-aarch64-all-linux-static:
   extends: .ubuntu_aarch64_template
   variables:
-    # Disable -static-pie due to build error with system libc:
-    # https://bugs.launchpad.net/ubuntu/+source/glibc/+bug/1987438
-    CONFIGURE_ARGS: --enable-debug --static --disable-system --disable-pie
+    CONFIGURE_ARGS: --enable-debug --static --disable-system
     MAKE_CHECK_ARGS: check-tcg
 
 ubuntu-24.04-aarch64-all:

From 56a4ba5f88ce0d691847462749a38ade7cc0f374 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:53 +0000
Subject: [PATCH 2280/2396] gitlab: drop explicit pxe-test from the build-tci
 job
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This needs libslirp to run and as debian-all-test-cross will soon be
based on qemu-minimal we won't have it in a few commits.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204194902.1340008-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/buildtest.yml | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/buildtest.yml b/.gitlab-ci.d/buildtest.yml
index 44df116139..dfe954fe3c 100644
--- a/.gitlab-ci.d/buildtest.yml
+++ b/.gitlab-ci.d/buildtest.yml
@@ -656,14 +656,12 @@ build-tci:
         --target-list="$(for tg in $TARGETS; do echo -n ${tg}'-softmmu '; done)"
         || { cat config.log meson-logs/meson-log.txt && exit 1; }
     - make -j"$JOBS"
-    - make tests/qtest/boot-serial-test tests/qtest/cdrom-test tests/qtest/pxe-test
+    - make tests/qtest/boot-serial-test tests/qtest/cdrom-test
     - for tg in $TARGETS ; do
         export QTEST_QEMU_BINARY="./qemu-system-${tg}" ;
         ./tests/qtest/boot-serial-test || exit 1 ;
         ./tests/qtest/cdrom-test || exit 1 ;
       done
-    - QTEST_QEMU_BINARY="./qemu-system-x86_64" ./tests/qtest/pxe-test
-    - QTEST_QEMU_BINARY="./qemu-system-s390x" ./tests/qtest/pxe-test -m slow
     - make check-tcg
 
 # Check our reduced build configurations

From 7e71b8e7f2f658999fd6d0871cab3acad53150e7 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Thu, 4 Dec 2025 23:50:23 +0300
Subject: [PATCH 2281/2396] gitlab-ci.d/cirrus: Update the FreeBSD job to v14.3
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The FreeBSD 14.2 job fails since the image disappeared
from the cloud.  We already bumped FreeBSD image to 14.3
in tests/vm in c8958b7eb4 (part of v10.1.0).

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204205025.2423326-1-mjt@tls.msk.ru>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .gitlab-ci.d/cirrus.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.gitlab-ci.d/cirrus.yml b/.gitlab-ci.d/cirrus.yml
index 13a0bf5bb9..0d66a14186 100644
--- a/.gitlab-ci.d/cirrus.yml
+++ b/.gitlab-ci.d/cirrus.yml
@@ -37,7 +37,7 @@ x64-freebsd-14-build:
     NAME: freebsd-14
     CIRRUS_VM_INSTANCE_TYPE: freebsd_instance
     CIRRUS_VM_IMAGE_SELECTOR: image_family
-    CIRRUS_VM_IMAGE_NAME: freebsd-14-2
+    CIRRUS_VM_IMAGE_NAME: freebsd-14-3
     CIRRUS_VM_CPUS: 8
     CIRRUS_VM_RAM: 8G
     UPDATE_COMMAND: pkg update; pkg upgrade -y

From 7242e51517cbc2df9121d6674ea53d3aebac1d3e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:54 +0000
Subject: [PATCH 2282/2396] tests/tcg: honour the available QEMU binaries when
 running check-tcg
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Currently configure can identify all the targets that have
cross-compilers available from the supplied target-list. By default
this is the default_target_list which is all possible targets we can
build.

At the same time the target list passed to meson is filtered down
depending on various factors including not building 64 bit targets on
32 bit hosts. As a result make check-tcg will erroneously attempt to
run tests for which we haven't built a QEMU.

Solve this by filtering the final list of TCG_TEST_TARGETS based on
what actually was configured by meson. Rename the variable that
configure spits out to TCG_TESTS_WITH_COMPILERS for clarity and to
avoid larger churn in the Makefile.

Message-ID: <20251204194902.1340008-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 configure              | 6 +++---
 tests/Makefile.include | 9 +++++++++
 2 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index a2f66f7ff9..82cace1bc9 100755
--- a/configure
+++ b/configure
@@ -1801,7 +1801,7 @@ if test "$plugins" = "yes" ; then
 fi
 echo "PYTHON=$python" >> tests/tcg/$config_host_mak
 
-tcg_tests_targets=
+tcg_tests_with_compilers=
 for target in $target_list; do
   arch=${target%%-*}
 
@@ -1852,12 +1852,12 @@ for target in $target_list; do
       fi
 
       echo "run-tcg-tests-$target: $qemu\$(EXESUF)" >> Makefile.prereqs
-      tcg_tests_targets="$tcg_tests_targets $target"
+      tcg_tests_with_compilers="$tcg_tests_with_compilers $target"
   fi
 done
 
 if test "$tcg" = "enabled"; then
-    echo "TCG_TESTS_TARGETS=$tcg_tests_targets" >> $config_host_mak
+    echo "TCG_TESTS_WITH_COMPILERS=$tcg_tests_with_compilers" >> $config_host_mak
 fi
 
 if test "$skip_meson" = no; then
diff --git a/tests/Makefile.include b/tests/Makefile.include
index d4dfbf3716..7728098981 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -37,6 +37,15 @@ export SRC_PATH
 
 SPEED = quick
 
+
+# TCG_TESTS_WITH_COMPILERS represents the test targets we have cross compiler
+# support for, CONFIGURED_TEST_TARGETS it what meson has finally
+# configured having rejected stuff we can't build.
+CONFIGURED_TCG_TARGETS=$(patsubst %-config-target.h, %, $(wildcard *-config-target.h))
+
+# This is the intersection of what tests we can build and is configured
+TCG_TESTS_TARGETS=$(filter $(CONFIGURED_TCG_TARGETS), $(TCG_TESTS_WITH_COMPILERS))
+
 # Per guest TCG tests
 BUILD_TCG_TARGET_RULES=$(patsubst %,build-tcg-tests-%, $(TCG_TESTS_TARGETS))
 CLEAN_TCG_TARGET_RULES=$(patsubst %,clean-tcg-tests-%, $(TCG_TESTS_TARGETS))

From a55d610bac73bd3a0f222b6d851565375d822085 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Fri, 5 Dec 2025 14:00:14 +0100
Subject: [PATCH 2283/2396] tests/qemu-iotests: Check for a functional "secret"
 object before using it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

QEMU iotests 049, 134 and 158 are currently failing if you compiled
QEMU without the crypto libraries. Thus make sure that the "secret"
object is really usable and skip the tests otherwise.

Reported-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251205130014.693799-1-thuth@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/qemu-iotests/049       |  2 ++
 tests/qemu-iotests/134       |  1 +
 tests/qemu-iotests/158       |  1 +
 tests/qemu-iotests/common.rc | 14 ++++++++++++++
 4 files changed, 18 insertions(+)

diff --git a/tests/qemu-iotests/049 b/tests/qemu-iotests/049
index ed12fa49d7..a1b922060d 100755
--- a/tests/qemu-iotests/049
+++ b/tests/qemu-iotests/049
@@ -39,6 +39,8 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow2
 _supported_proto file
+_require_secret
+
 
 filter_test_dir()
 {
diff --git a/tests/qemu-iotests/134 b/tests/qemu-iotests/134
index b2c3c03f08..cc1e35eb16 100755
--- a/tests/qemu-iotests/134
+++ b/tests/qemu-iotests/134
@@ -39,6 +39,7 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow qcow2
 _supported_proto file
+_require_secret
 
 
 size=128M
diff --git a/tests/qemu-iotests/158 b/tests/qemu-iotests/158
index 3a9ad7eed0..8fc4e98653 100755
--- a/tests/qemu-iotests/158
+++ b/tests/qemu-iotests/158
@@ -39,6 +39,7 @@ trap "_cleanup; exit \$status" 0 1 2 3 15
 
 _supported_fmt qcow qcow2
 _supported_proto file
+_require_secret
 
 
 size=128M
diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index e977cb4eb6..10d83d8361 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -1053,6 +1053,20 @@ _require_one_device_of()
     _notrun "$* not available"
 }
 
+_require_secret()
+{
+    if [ -e "$TEST_IMG" ]; then
+        echo "unwilling to overwrite existing file"
+        exit 1
+    fi
+    if $QEMU_IMG create -f $IMGFMT --object secret,id=sec0,data=123 \
+                 -o encryption=on,encrypt.key-secret=sec0 "$TEST_IMG" 1M 2>&1 \
+                 | grep "Unsupported cipher" ; then
+        _notrun "missing cipher support"
+    fi
+    rm -f "$TEST_IMG"
+}
+
 _qcow2_dump_header()
 {
     if [[ "$1" == "--no-filter-compression" ]]; then

From 7cffc861620fb1a15d3dd2e6dfd41eb688aa2fb0 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:55 +0000
Subject: [PATCH 2284/2396] tests/lcitool: add bzip2 to the minimal dependency
 list
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

You cannot build any softmmu targets without it by default unless you
build with --disable-install-blobs.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204194902.1340008-5-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/lcitool/projects/qemu-minimal.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/lcitool/projects/qemu-minimal.yml b/tests/lcitool/projects/qemu-minimal.yml
index 6bc232a1c3..2a1ac51d40 100644
--- a/tests/lcitool/projects/qemu-minimal.yml
+++ b/tests/lcitool/projects/qemu-minimal.yml
@@ -4,6 +4,7 @@ packages:
  - bash
  - bc
  - bison
+ - bzip2
  - ccache
  - findutils
  - flex

From 2addcefd69e32ed23199272dadb689b84634f51a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:57 +0000
Subject: [PATCH 2285/2396] tests/docker: transition debian-all-test-cross to
 lcitool
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

While we are at it bump up to debian-13. As we use this container in
the CI runs this also has the benefit of ensuring our qemu-minimal
dependencies project really has just what we need to build a basic
QEMU.

We add a few extra packages so we can build with clang as well as what
we need to probe for the available cross-compilers in the image.

Message-ID: <20251204194902.1340008-7-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 .../dockerfiles/debian-all-test-cross.docker  | 128 ++++++++++--------
 tests/lcitool/refresh                         |  49 +++++++
 2 files changed, 123 insertions(+), 54 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index 420a4e33e6..079942a1c5 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -1,77 +1,97 @@
+# THIS FILE WAS AUTO-GENERATED
 #
-# Docker all cross-compiler target (tests only)
+#  $ lcitool dockerfile --layers all debian-13 qemu-minimal
 #
-# While the normal cross builds take care to setup proper multiarch
-# build environments which can cross build QEMU this just installs the
-# basic compilers for as many targets as possible. We shall use this
-# to build and run linux-user tests on GitLab
-#
-FROM docker.io/library/debian:12-slim
+# https://gitlab.com/libvirt/libvirt-ci
 
-# Duplicate deb line as deb-src
-RUN sed -in "s/Types: deb/Types: deb deb-src/g" /etc/apt/sources.list.d/debian.sources
+FROM docker.io/library/debian:13-slim
 
 RUN export DEBIAN_FRONTEND=noninteractive && \
     apt-get update && \
     apt-get install -y eatmydata && \
     eatmydata apt-get dist-upgrade -y && \
-    apt build-dep -yy --arch-only qemu
+    eatmydata apt-get install --no-install-recommends -y \
+                      bash \
+                      bc \
+                      bison \
+                      bzip2 \
+                      ca-certificates \
+                      ccache \
+                      findutils \
+                      flex \
+                      gcc \
+                      git \
+                      libc6-dev \
+                      libfdt-dev \
+                      libffi-dev \
+                      libglib2.0-dev \
+                      libpixman-1-dev \
+                      locales \
+                      make \
+                      ninja-build \
+                      pkgconf \
+                      python3 \
+                      python3-pip \
+                      python3-setuptools \
+                      python3-venv \
+                      python3-wheel \
+                      sed \
+                      tar && \
+    eatmydata apt-get autoremove -y && \
+    eatmydata apt-get autoclean -y && \
+    sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen && \
+    dpkg-reconfigure locales && \
+    rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED && \
+    dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt && \
+    mkdir -p /usr/libexec/ccache-wrappers && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc && \
+    ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
 
-# Add extra build tools and as many cross compilers as we can for testing
+RUN /usr/bin/pip3 install meson==1.8.1
+
+ENV CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+ENV LANG="en_US.UTF-8"
+ENV MAKE="/usr/bin/make"
+ENV NINJA="/usr/bin/ninja"
+ENV PYTHON="/usr/bin/python3"
+# extras for cross and alternate toolchains
 RUN DEBIAN_FRONTEND=noninteractive eatmydata \
-        apt install -y --no-install-recommends \
-        bison \
-        ccache \
-        clang  \
-        dpkg-dev \
-        flex \
-        gcc \
-        git \
-        libclang-rt-dev \
-        ninja-build \
-        python3-pip \
-        python3-setuptools \
-        python3-tomli \
-        python3-venv \
-        python3-wheel
-
-# All the generally available compilers
+  apt install -y --no-install-recommends \
+  clang\
+  dpkg-dev\
+  libclang-rt-dev
 ENV AVAILABLE_COMPILERS gcc-aarch64-linux-gnu \
-        libc6-dev-arm64-cross \
-        gcc-arm-linux-gnueabihf \
-        libc6-dev-armhf-cross \
-        gcc-mips-linux-gnu \
-        libc6-dev-mips-cross \
-        gcc-mips64-linux-gnuabi64 \
-        libc6-dev-mips64-cross \
-        gcc-mips64el-linux-gnuabi64 \
-        libc6-dev-mips64el-cross \
-        gcc-mipsel-linux-gnu \
-        libc6-dev-mipsel-cross \
-        gcc-powerpc64le-linux-gnu \
-        libc6-dev-ppc64el-cross \
-        gcc-riscv64-linux-gnu \
-        libc6-dev-riscv64-cross \
-        gcc-s390x-linux-gnu \
-        libc6-dev-s390x-cross
-
+  libc6-dev-arm64-cross \
+  gcc-arm-linux-gnueabihf \
+  libc6-dev-armhf-cross \
+  gcc-mips-linux-gnu \
+  libc6-dev-mips-cross \
+  gcc-mips64-linux-gnuabi64 \
+  libc6-dev-mips64-cross \
+  gcc-mips64el-linux-gnuabi64 \
+  libc6-dev-mips64el-cross \
+  gcc-mipsel-linux-gnu \
+  libc6-dev-mipsel-cross \
+  gcc-powerpc64le-linux-gnu \
+  libc6-dev-ppc64el-cross \
+  gcc-riscv64-linux-gnu \
+  libc6-dev-riscv64-cross \
+  gcc-s390x-linux-gnu \
+  libc6-dev-s390x-cross
 RUN if dpkg-architecture -e amd64; then \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-hppa-linux-gnu libc6-dev-hppa-cross"; \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-m68k-linux-gnu libc6-dev-m68k-cross"; \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-powerpc-linux-gnu libc6-dev-powerpc-cross"; \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-powerpc64-linux-gnu libc6-dev-ppc64-cross"; \
   export AVAILABLE_COMPILERS="${AVAILABLE_COMPILERS} gcc-sparc64-linux-gnu libc6-dev-sparc64-cross"; \
-  fi && \
-  DEBIAN_FRONTEND=noninteractive eatmydata \
-        apt install -y --no-install-recommends \
-        ${AVAILABLE_COMPILERS} && \
-        dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
-
-
+fi && \
+DEBIAN_FRONTEND=noninteractive eatmydata \
+apt install -y --no-install-recommends \
+${AVAILABLE_COMPILERS} && \
+dpkg-query --showformat '${Package}_${Version}_${Architecture}' --show > /packages.txt
 ENV QEMU_CONFIGURE_OPTS --disable-system --disable-docs --disable-tools
 ENV DEF_TARGET_LIST aarch64-linux-user,arm-linux-user,hppa-linux-user,i386-linux-user,m68k-linux-user,mips-linux-user,mips64-linux-user,mips64el-linux-user,mipsel-linux-user,ppc-linux-user,ppc64-linux-user,ppc64le-linux-user,riscv64-linux-user,s390x-linux-user,sparc64-linux-user
 # As a final step configure the user (if env is defined)
-ENV MAKE /usr/bin/make
 ARG USER
 ARG UID
 RUN if [ "${USER}" ]; then \
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index 3a31fcfee9..c5e936112c 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -161,6 +161,46 @@ ubuntu2204_rust_extras = [
     'RUN cargo install bindgen-cli\n',
 ]
 
+debian_all_test_cross_compilers = [
+    "# extras for cross and alternate toolchains\n",
+    "RUN DEBIAN_FRONTEND=noninteractive eatmydata \\\n",
+    "  apt install -y --no-install-recommends \\\n",
+    "  clang\\\n",
+    "  dpkg-dev\\\n",
+    "  libclang-rt-dev\n",
+    "ENV AVAILABLE_COMPILERS gcc-aarch64-linux-gnu \\\n",
+    "  libc6-dev-arm64-cross \\\n",
+    "  gcc-arm-linux-gnueabihf \\\n",
+    "  libc6-dev-armhf-cross \\\n",
+    "  gcc-mips-linux-gnu \\\n",
+    "  libc6-dev-mips-cross \\\n",
+    "  gcc-mips64-linux-gnuabi64 \\\n",
+    "  libc6-dev-mips64-cross \\\n",
+    "  gcc-mips64el-linux-gnuabi64 \\\n",
+    "  libc6-dev-mips64el-cross \\\n",
+    "  gcc-mipsel-linux-gnu \\\n",
+    "  libc6-dev-mipsel-cross \\\n",
+    "  gcc-powerpc64le-linux-gnu \\\n",
+    "  libc6-dev-ppc64el-cross \\\n",
+    "  gcc-riscv64-linux-gnu \\\n",
+    "  libc6-dev-riscv64-cross \\\n",
+    "  gcc-s390x-linux-gnu \\\n",
+    "  libc6-dev-s390x-cross\n",
+    "RUN if dpkg-architecture -e amd64; then \\\n",
+    "  export AVAILABLE_COMPILERS=\"${AVAILABLE_COMPILERS} gcc-hppa-linux-gnu libc6-dev-hppa-cross\"; \\\n",
+    "  export AVAILABLE_COMPILERS=\"${AVAILABLE_COMPILERS} gcc-m68k-linux-gnu libc6-dev-m68k-cross\"; \\\n",
+    "  export AVAILABLE_COMPILERS=\"${AVAILABLE_COMPILERS} gcc-powerpc-linux-gnu libc6-dev-powerpc-cross\"; \\\n",
+    "  export AVAILABLE_COMPILERS=\"${AVAILABLE_COMPILERS} gcc-powerpc64-linux-gnu libc6-dev-ppc64-cross\"; \\\n",
+    "  export AVAILABLE_COMPILERS=\"${AVAILABLE_COMPILERS} gcc-sparc64-linux-gnu libc6-dev-sparc64-cross\"; \\\n",
+    "fi && \\\n",
+    "DEBIAN_FRONTEND=noninteractive eatmydata \\\n",
+    "apt install -y --no-install-recommends \\\n",
+    "${AVAILABLE_COMPILERS} && \\\n",
+    "dpkg-query --showformat '${Package}_${Version}_${Architecture}' --show > /packages.txt\n",
+    "ENV QEMU_CONFIGURE_OPTS --disable-system --disable-docs --disable-tools\n",
+    "ENV DEF_TARGET_LIST aarch64-linux-user,arm-linux-user,hppa-linux-user,i386-linux-user,m68k-linux-user,mips-linux-user,mips64-linux-user,mips64el-linux-user,mipsel-linux-user,ppc-linux-user,ppc64-linux-user,ppc64le-linux-user,riscv64-linux-user,s390x-linux-user,sparc64-linux-user\n",
+]
+
 def cross_build(prefix, targets):
     conf = "ENV QEMU_CONFIGURE_OPTS=--cross-prefix=%s\n" % (prefix)
     targets = "ENV DEF_TARGET_LIST=%s\n" % (targets)
@@ -256,6 +296,15 @@ try:
                         # https://github.com/mesonbuild/meson/pull/14991
                         enable_rust=False)
 
+    # We also generate some docker files with minimal dependencies and
+    # as many cross-compilers as Debian will package for building TCG
+    # tests.
+
+    generate_dockerfile("debian-all-test-cross", "debian-13",
+                        project="qemu-minimal",
+                        enable_rust=False,
+                        trailer="".join(debian_all_test_cross_compilers))
+
     #
     # Cirrus packages lists for GitLab
     #

From 0b50ff0c0a1df21aa85596690b54033fdde38e2b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:58 +0000
Subject: [PATCH 2286/2396] tests/docker: drop --disable-[tools|system] from
 all-test-cross
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We use this container to build system images in CI which do not honour
QEMU_CONFIGURE_OPTS. Drop the --disables from the container so
developers don not need to jump through hoops trying to replicate that
on their workstations.

Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204194902.1340008-8-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 tests/docker/dockerfiles/debian-all-test-cross.docker | 2 +-
 tests/lcitool/refresh                                 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/docker/dockerfiles/debian-all-test-cross.docker b/tests/docker/dockerfiles/debian-all-test-cross.docker
index 079942a1c5..1823233438 100644
--- a/tests/docker/dockerfiles/debian-all-test-cross.docker
+++ b/tests/docker/dockerfiles/debian-all-test-cross.docker
@@ -89,7 +89,7 @@ DEBIAN_FRONTEND=noninteractive eatmydata \
 apt install -y --no-install-recommends \
 ${AVAILABLE_COMPILERS} && \
 dpkg-query --showformat '${Package}_${Version}_${Architecture}' --show > /packages.txt
-ENV QEMU_CONFIGURE_OPTS --disable-system --disable-docs --disable-tools
+ENV QEMU_CONFIGURE_OPTS --disable-docs
 ENV DEF_TARGET_LIST aarch64-linux-user,arm-linux-user,hppa-linux-user,i386-linux-user,m68k-linux-user,mips-linux-user,mips64-linux-user,mips64el-linux-user,mipsel-linux-user,ppc-linux-user,ppc64-linux-user,ppc64le-linux-user,riscv64-linux-user,s390x-linux-user,sparc64-linux-user
 # As a final step configure the user (if env is defined)
 ARG USER
diff --git a/tests/lcitool/refresh b/tests/lcitool/refresh
index c5e936112c..9df607a55f 100755
--- a/tests/lcitool/refresh
+++ b/tests/lcitool/refresh
@@ -197,7 +197,7 @@ debian_all_test_cross_compilers = [
     "apt install -y --no-install-recommends \\\n",
     "${AVAILABLE_COMPILERS} && \\\n",
     "dpkg-query --showformat '${Package}_${Version}_${Architecture}' --show > /packages.txt\n",
-    "ENV QEMU_CONFIGURE_OPTS --disable-system --disable-docs --disable-tools\n",
+    "ENV QEMU_CONFIGURE_OPTS --disable-docs\n",
     "ENV DEF_TARGET_LIST aarch64-linux-user,arm-linux-user,hppa-linux-user,i386-linux-user,m68k-linux-user,mips-linux-user,mips64-linux-user,mips64el-linux-user,mipsel-linux-user,ppc-linux-user,ppc64-linux-user,ppc64le-linux-user,riscv64-linux-user,s390x-linux-user,sparc64-linux-user\n",
 ]
 

From 6f365f185a4ac618dae8d2bc5ddcce16bd8ed7b1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:48:59 +0000
Subject: [PATCH 2287/2396] docs/devel: update build environment setup
 documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bring `libvirt-ci` front and centre when discussing dependencies for
QEMU. While we are at it:

  - drop links to additional instructions (libvirt is more upto date)
  - compress pkg installs into a table
  - call out distro/upstream dep difference in a proper note

Message-ID: <20251204194902.1340008-9-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/devel/build-environment.rst | 121 +++++++++++++++++++++----------
 1 file changed, 84 insertions(+), 37 deletions(-)

diff --git a/docs/devel/build-environment.rst b/docs/devel/build-environment.rst
index 661f6ea850..61b2dc0d1b 100644
--- a/docs/devel/build-environment.rst
+++ b/docs/devel/build-environment.rst
@@ -4,55 +4,103 @@
 Setup build environment
 =======================
 
-QEMU uses a lot of dependencies on the host system. glib2 is used everywhere in
-the code base, and most of the other dependencies are optional.
+QEMU uses a lot of dependencies on the host system a large number of
+which are optional. At a minimum we expect to have a system C library
+(usually glibc but others can work), the glib2 library (used heavily
+in the code base) and a few other core libraries for interfacing with
+code modules and system build descriptions.
 
-We present here simple instructions to enable native builds on most popular
-systems.
+We use the ``libvirt-ci`` project to handle the mapping of
+dependencies to a wide variety output formats including system install
+scripts. For example:
 
-You can find additional instructions on `QEMU wiki <https://wiki.qemu.org/>`_:
+.. code-block:: bash
 
-- `Linux <https://wiki.qemu.org/Hosts/Linux>`_
-- `MacOS <https://wiki.qemu.org/Hosts/Mac>`_
-- `Windows <https://wiki.qemu.org/Hosts/W32>`_
-- `BSD <https://wiki.qemu.org/Hosts/BSD>`_
+  # THIS FILE WAS AUTO-GENERATED
+  #
+  #  $ lcitool buildenvscript debian-13 ./tests/lcitool/projects/qemu-minimal.yml
+  #
+  # https://gitlab.com/libvirt/libvirt-ci
 
-Note: Installing dependencies using your package manager build dependencies may
-miss out on deps that have been newly introduced in qemu.git. In more, it misses
-deps the distribution has decided to exclude.
+  function install_buildenv() {
+      export DEBIAN_FRONTEND=noninteractive
+      apt-get update
+      apt-get dist-upgrade -y
+      apt-get install --no-install-recommends -y \
+              bash \
+              bc \
+              bison \
+              bzip2 \
+              ca-certificates \
+              ccache \
+              findutils \
+              flex \
+              gcc \
+              git \
+              libc6-dev \
+              libfdt-dev \
+              libffi-dev \
+              libglib2.0-dev \
+              libpixman-1-dev \
+              locales \
+              make \
+              meson \
+              ninja-build \
+              pkgconf \
+              python3 \
+              python3-venv \
+              sed \
+              tar
+      sed -Ei 's,^# (en_US\.UTF-8 .*)$,\1,' /etc/locale.gen
+      dpkg-reconfigure locales
+      rm -f /usr/lib*/python3*/EXTERNALLY-MANAGED
+      dpkg-query --showformat '${Package}_${Version}_${Architecture}\n' --show > /packages.txt
+      mkdir -p /usr/libexec/ccache-wrappers
+      ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/cc
+      ln -s /usr/bin/ccache /usr/libexec/ccache-wrappers/gcc
+  }
 
-Linux
------
+  export CCACHE_WRAPPERSDIR="/usr/libexec/ccache-wrappers"
+  export LANG="en_US.UTF-8"
+  export MAKE="/usr/bin/make"
+  export NINJA="/usr/bin/ninja"
+  export PYTHON="/usr/bin/python3"
 
-Fedora
-++++++
+If you instead select the ``qemu.yml`` project file you will get all
+the dependencies that the project can use.
 
-::
+Using you system package manager
+--------------------------------
 
-    sudo dnf update && sudo dnf builddep qemu
+.. note::
 
-Debian/Ubuntu
-+++++++++++++
+   Installing dependencies using your package manager build dependencies may
+   miss out on deps that have been newly introduced in qemu.git. It
+   also misses deps the distribution has decided to exclude.
 
-You first need to enable `Sources List <https://wiki.debian.org/SourcesList>`_.
-Then, use apt to install dependencies:
+Systems with Package Managers
++++++++++++++++++++++++++++++
 
-::
+.. list-table:: Package Manager Commands
+  :widths: 10 50 40
+  :header-rows: 1
 
-    sudo apt update && sudo apt build-dep qemu
-
-MacOS
------
-
-You first need to install `Homebrew <https://brew.sh/>`_. Then, use it to
-install dependencies:
-
-::
-
-    brew update && brew install $(brew deps --include-build qemu)
+  * - System
+    - Command
+    - Notes
+  * - Fedora
+    - ``sudo dnf update && sudo dnf builddep qemu``
+    -
+  * - Debian/Ubuntu
+    - ``sudo apt update && sudo apt build-dep qemu``
+    - Must enable `Sources List
+      <https://wiki.debian.org/SourcesList>`_ first
+  * - MacOS
+    - ``brew update && brew install $(brew deps --include-build qemu)``
+    - Using `Homebrew <https://brew.sh/>`_.
 
 Windows
--------
++++++++
 
 You first need to install `MSYS2 <https://www.msys2.org/>`_.
 MSYS2 offers `different environments <https://www.msys2.org/docs/environments/>`_.
@@ -104,7 +152,7 @@ build QEMU in MSYS2 itself.
     makepkg --syncdeps --nobuild PKGBUILD || true
 
 Build on windows-aarch64
-++++++++++++++++++++++++
+~~~~~~~~~~~~~~~~~~~~~~~~
 
 When trying to cross compile meson for x86_64 using UCRT64 or MINGW64 env,
 configure will run into an error because the cpu detected is not correct.
@@ -115,4 +163,3 @@ and force a cross compilation (with empty prefix).
 ::
 
     ./configure --cpu=x86_64 --cross-prefix=
-

From 23a5e2584ea9738510ce5d34f267c2525c3fa2c4 Mon Sep 17 00:00:00 2001
From: Alano Song <AlanoSong@163.com>
Date: Thu, 4 Dec 2025 19:49:00 +0000
Subject: [PATCH 2288/2396] docs/devel: Correct typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Correct typo in atomics.rst

Signed-off-by: Alano Song <AlanoSong@163.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
[AJB: fixed author entry]
Message-ID: <20251204194902.1340008-10-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/devel/atomics.rst | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/devel/atomics.rst b/docs/devel/atomics.rst
index 95c7b77c01..ea4ede4b8c 100644
--- a/docs/devel/atomics.rst
+++ b/docs/devel/atomics.rst
@@ -266,7 +266,7 @@ Splitting a loop can also be useful to reduce the number of barriers:
     |   n = 0;                                 |     smp_mb_release();            |
     |   for (i = 0; i < 10; i++) {             |     for (i = 0; i < 10; i++)     |
     |     qatomic_store_release(&a[i], false); |       qatomic_set(&a[i], false); |
-    |     smp_mb();                            |     smb_mb();                    |
+    |     smp_mb();                            |     smp_mb();                    |
     |     n += qatomic_read(&b[i]);            |     n = 0;                       |
     |   }                                      |     for (i = 0; i < 10; i++)     |
     |                                          |       n += qatomic_read(&b[i]);  |
@@ -283,7 +283,7 @@ as well) ``smp_wmb()``:
     |                                          |     smp_mb_release();            |
     |   for (i = 0; i < 10; i++) {             |     for (i = 0; i < 10; i++)     |
     |     qatomic_store_release(&a[i], false); |       qatomic_set(&a[i], false); |
-    |     qatomic_store_release(&b[i], false); |     smb_wmb();                   |
+    |     qatomic_store_release(&b[i], false); |     smp_wmb();                   |
     |   }                                      |     for (i = 0; i < 10; i++)     |
     |                                          |       qatomic_set(&b[i], false); |
     +------------------------------------------+----------------------------------+

From ee6a482e9c060b028ee6634efecc22beb080b381 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:49:01 +0000
Subject: [PATCH 2289/2396] MAINTAINERS: update the custom runner entries
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix a number of issues:

  - update the ubuntu references to 24.0
  - add the s390x and ppc64le yml files
  - replace Works on Arm with Linaro
  - Also mention IBM (s390x) and OSUL (ppc64le) as HW hosts

Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251204194902.1340008-11-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 MAINTAINERS | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index d007584b47..63e9ba521b 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -4444,12 +4444,13 @@ R: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
 F: tests/tcg/Makefile.target
 
-GitLab custom runner (Works On Arm Sponsored)
+GitLab custom runners (HW sponsored by Linaro, OSOUL and IBM)
 M: Alex Bennée <alex.bennee@linaro.org>
 M: Philippe Mathieu-Daudé <philmd@linaro.org>
 S: Maintained
-F: .gitlab-ci.d/custom-runners/ubuntu-22.04-aarch64.yml
-F: .gitlab-ci.d/custom-runners/ubuntu-22.04-aarch32.yml
+F: .gitlab-ci.d/custom-runners/ubuntu-24.04-aarch64.yml
+F: .gitlab-ci.d/custom-runners/ubuntu-24.04-s390x.yml
+F: .gitlab-ci.d/custom-runners/debian-13-ppc64le.yml
 
 Documentation
 -------------

From 81c5a3f8673403de315441991ff1566c4828f288 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 4 Dec 2025 19:49:02 +0000
Subject: [PATCH 2290/2396] plugins/core: allow reading of registers during
 discon events
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

We have protections that prevent callbacks that didn't declare
themselves as wanting to access registers. However for discontinuities
the system state is fully rectified so they should always be able to
read the register values.

a1688bc86ce (plugins: add hooks for new discontinuity related callbacks)

Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Cc: Julian Ganz <neither@nut.email>
Reviewed-by: Julian Ganz <neither@nut.email>
Message-ID: <20251204194902.1340008-12-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 plugins/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/plugins/core.c b/plugins/core.c
index 8f8bc7219c..b4b783008f 100644
--- a/plugins/core.c
+++ b/plugins/core.c
@@ -119,6 +119,7 @@ static void plugin_vcpu_cb__discon(CPUState *cpu,
     struct qemu_plugin_cb *cb, *next;
     uint64_t to = cpu->cc->get_pc(cpu);
 
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_RW_REGS);
     if (cpu->cpu_index < plugin.num_vcpus) {
         /* iterate safely; plugins might uninstall themselves at any time */
         QLIST_FOREACH_SAFE_RCU(cb, &plugin.cb_lists[ev], entry, next) {
@@ -127,6 +128,7 @@ static void plugin_vcpu_cb__discon(CPUState *cpu,
             func(cb->ctx->id, cpu->cpu_index, type, from, to);
         }
     }
+    qemu_plugin_set_cb_flags(cpu, QEMU_PLUGIN_CB_NO_REGS);
 }
 
 /*

From fa2580f5741da3e80e523910faf20914d572be1e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?S=C3=B6nke=20Holz?= <sholz8530@gmail.com>
Date: Fri, 5 Dec 2025 11:56:14 +0100
Subject: [PATCH 2291/2396] contrib/plugins/uftrace_symbols.py: unbreak
 --no-prefix-symbols
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since 8a545a336d, `name` is unbound if --no-prefix-symbols is passed,
causing this script to break when that option is set.

Signed-off-by: Sönke Holz <sholz8530@gmail.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20251205105614.13673-1-sholz8530@gmail.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 contrib/plugins/uftrace_symbols.py | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/contrib/plugins/uftrace_symbols.py b/contrib/plugins/uftrace_symbols.py
index 45fb79c7a5..21704541a6 100755
--- a/contrib/plugins/uftrace_symbols.py
+++ b/contrib/plugins/uftrace_symbols.py
@@ -98,6 +98,8 @@ class BinaryFile:
                 size = f'{s.size:{addrx}}'
                 if prefix_symbols:
                     name = f'{binary_name}:{s.name}'
+                else:
+                    name = s.name
                 print(addr, size, 'T', name, file=sym_file)
 
     def generate_debug_file(self):

From 704db3e250f5c646b3f51bfc7975b66b0f47d767 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Wed, 26 Nov 2025 11:24:24 +0100
Subject: [PATCH 2292/2396] aspeed: Deprecate the fby35 machine
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

There are no functional tests for the 'fby35' machine which makes
harder to determine when something becomes deprecated or unused.

The 'fby35' machine was originally added as an example of a multi-SoC
system, with the expectation the models would evolve over time in an
heterogeneous system. This hasn't happened and no public firmware is
available to boot it. It can be replaced by the 'ast2700fc', another
multi-SoC machine based on the newer AST2700 SoCs which are excepted
to receive better support in the future.

Cc: Peter Delevoryas <peter@pjd.dev>
Signed-off-by: Cédric Le Goater <clg@redhat.com>
Message-ID: <20251126102424.927527-1-clg@redhat.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 docs/about/deprecated.rst | 13 ++++++++++++-
 hw/arm/fby35.c            |  1 +
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index 9386cffba2..ac31a2bce4 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -308,13 +308,24 @@ I2C devices connected to the board can be defined via the QEMU command
 line.
 
 Arm ``fp5280g2-bmc`` machine (since 10.2)
-'''''''''''''''''''''''''''''''''''''''''''
+'''''''''''''''''''''''''''''''''''''''''
 
 The ``fp5280g2-bmc`` machine does not rely on any specific device
 models, it can be replaced by the ``ast2500-evb`` machine using the
 ``fmc-model`` option to specify the flash type. The I2C devices
 connected to the board can be defined via the QEMU command line.
 
+Arm ``fby35`` machine (since 10.2)
+''''''''''''''''''''''''''''''''''
+
+The ``fby35`` machine was originally added as an example of a
+multi-SoC system, with the expectation the models would evolve over
+time in an heterogeneous system. This hasn't happened and no public
+firmware is available to boot it. It can be replaced by the
+``ast2700fc``, another multi-SoC machine based on the newer AST2700
+SoCs which are excepted to receive better support in the future.
+
+
 RISC-V default machine option (since 10.0)
 ''''''''''''''''''''''''''''''''''''''''''
 
diff --git a/hw/arm/fby35.c b/hw/arm/fby35.c
index 70d3a99d79..e61a6438fe 100644
--- a/hw/arm/fby35.c
+++ b/hw/arm/fby35.c
@@ -175,6 +175,7 @@ static void fby35_class_init(ObjectClass *oc, const void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
 
     mc->desc = "Meta Platforms fby35";
+    mc->deprecation_reason = "For a multi-soc machine, use 'ast2700fc' instead";
     mc->init = fby35_init;
     mc->no_floppy = 1;
     mc->no_cdrom = 1;

From c22e943ea195c121246de4301b65f9564248f40e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 9 Dec 2025 09:24:56 +0000
Subject: [PATCH 2293/2396] Revert "target/arm: Re-use arm_is_psci_call() in
 HVF"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This breaks a pure HVF (--disable-tcg) build because the fallback stub
will always report false.

This reverts commit 4695daacc068cd0aa9a91c0063c4f2a9ec9b7ba1.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Christian Stussak <christian.stussak@imaginary.org>
Message-ID: <20251209092459.1058313-2-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/hvf/hvf.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index de1e8fb8a0..70d34063df 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1935,7 +1935,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
         break;
     case EC_AA64_HVC:
         cpu_synchronize_state(cpu);
-        if (arm_is_psci_call(arm_cpu, EXCP_HVC)) {
+        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_HVC) {
             /* Do NOT advance $pc for HVC */
             if (!hvf_handle_psci_call(cpu)) {
                 trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
@@ -1949,7 +1949,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
         break;
     case EC_AA64_SMC:
         cpu_synchronize_state(cpu);
-        if (arm_is_psci_call(arm_cpu, EXCP_SMC)) {
+        if (arm_cpu->psci_conduit == QEMU_PSCI_CONDUIT_SMC) {
             /* Secure Monitor Call exception, we need to advance $pc */
             advance_pc = true;
 

From 2a425aae0b5c9ab162cb9cc9bb8064f5e909bdc2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 9 Dec 2025 09:24:57 +0000
Subject: [PATCH 2294/2396] target/arm: ensure PSCI register updates are
 flushed
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When we handle a host call we report state back to the caller via
registers. Set vcpu_dirty to indicate QEMU is currently the reference
and hoist the flush_cpu_state() and make the call unconditional.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3228
Tested-by: Christian Stussak <christian.stussak@imaginary.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251209092459.1058313-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/hvf/hvf.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 70d34063df..8e2940217a 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -1942,6 +1942,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
                 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
                 env->xregs[0] = -1;
             }
+            cpu->vcpu_dirty = true;
         } else {
             trace_hvf_unknown_hvc(env->pc, env->xregs[0]);
             hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
@@ -1958,6 +1959,7 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
                 /* SMCCC 1.3 section 5.2 says every unknown SMCCC call returns -1 */
                 env->xregs[0] = -1;
             }
+            cpu->vcpu_dirty = true;
         } else {
             trace_hvf_unknown_smc(env->xregs[0]);
             hvf_raise_exception(cpu, EXCP_UDEF, syn_uncategorized(), 1);
@@ -1980,10 +1982,12 @@ static int hvf_handle_exception(CPUState *cpu, hv_vcpu_exit_exception_t *excp)
         error_report("0x%llx: unhandled exception ec=0x%x", env->pc, ec);
     }
 
+    /* flush any changed cpu state back to HVF */
+    flush_cpu_state(cpu);
+
     if (advance_pc) {
         uint64_t pc;
 
-        flush_cpu_state(cpu);
 
         r = hv_vcpu_get_reg(cpu->accel->fd, HV_REG_PC, &pc);
         assert_hvf_ok(r);

From d10019372467edac05b783deff7fa9ef830545d7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 9 Dec 2025 09:24:58 +0000
Subject: [PATCH 2295/2396] target/arm: make HV_EXIT_REASON_CANCELED leave
 hvf_arch_vcpu_exec
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without this we can spin tightly in the main HVF dispatch loop and
never release the lock long enough. As a result the HMP never gets to
run and shutting down the system deadlocks.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3228
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251209092459.1058313-4-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/hvf/hvf.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index 8e2940217a..8288b60529 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -2020,6 +2020,7 @@ static int hvf_handle_vmexit(CPUState *cpu, hv_vcpu_exit_t *exit)
         break;
     case HV_EXIT_REASON_CANCELED:
         /* we got kicked, no exit to process */
+        ret = -1;
         break;
     default:
         g_assert_not_reached();

From dd77ef99aa0280c467fe8442b4238122899ae6cf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Tue, 9 Dec 2025 09:24:59 +0000
Subject: [PATCH 2296/2396] target/arm: handle unaligned PC during tlb probe
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

PC alignment faults have priority over instruction aborts and we have
code to deal with this in the translation front-ends. However during
tb_lookup we can see a potentially faulting probe which doesn't get a
MemOp set. If the page isn't available this results in
EC_INSNABORT (0x20) instead of EC_PCALIGNMENT (0x22).

As there is no easy way to set the appropriate MemOp in the
instruction fetch probe path lets just detect it in
arm_cpu_tlb_fill_align() ahead of the main alignment check. We also
teach arm_deliver_fault to deliver the right syndrome for
MMU_INST_FETCH alignment issues.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3233
Tested-by: Jessica Clarke <jrtc27@jrtc27.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251209092459.1058313-5-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
---
 target/arm/tcg/tlb_helper.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index f1983a5732..5c689d3b69 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -250,7 +250,11 @@ void arm_deliver_fault(ARMCPU *cpu, vaddr addr,
     fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
 
     if (access_type == MMU_INST_FETCH) {
-        syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
+        if (fi->type == ARMFault_Alignment) {
+            syn = syn_pcalignment();
+        } else {
+            syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
+        }
         exc = EXCP_PREFETCH_ABORT;
     } else {
         bool gcs = regime_is_gcs(core_to_arm_mmu_idx(env, mmu_idx));
@@ -346,11 +350,18 @@ bool arm_cpu_tlb_fill_align(CPUState *cs, CPUTLBEntryFull *out, vaddr address,
     }
 
     /*
-     * Per R_XCHFJ, alignment fault not due to memory type has
-     * highest precedence.  Otherwise, walk the page table and
-     * and collect the page description.
+     * PC alignment faults should be dealt with at translation time
+     * but we also need to catch them while being probed.
+     *
+     * Then per R_XCHFJ, alignment fault not due to memory type take
+     * precedence. Otherwise, walk the page table and and collect the
+     * page description.
+     *
      */
-    if (address & ((1 << memop_alignment_bits(memop)) - 1)) {
+    if (access_type == MMU_INST_FETCH && !cpu->env.thumb &&
+        (address & 3)) {
+        fi->type = ARMFault_Alignment;
+    } else if (address & ((1 << memop_alignment_bits(memop)) - 1)) {
         fi->type = ARMFault_Alignment;
     } else if (!get_phys_addr(&cpu->env, address, access_type, memop,
                               core_to_arm_mmu_idx(&cpu->env, mmu_idx),

From df3b3046059edfae4b36cafe513f69d0c1ae78d5 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Mon, 17 Nov 2025 19:06:49 +0100
Subject: [PATCH 2297/2396] osdep: Undefine FSCALE definition to fix Solaris
 builds
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Solaris defines FSCALE in <sys/param.h>:

  301 /*
  302  * Scale factor for scaled integers used to count
  303  * %cpu time and load averages.
  304  */
  305 #define FSHIFT  8               /* bits to right of fixed binary point */
  306 #define FSCALE  (1<<FSHIFT)

When emulating the SVE FSCALE instruction, we defines the same name
in decodetree format in target/arm/tcg/sve.decode:

  1129:FSCALE          01100101 .. 00 1001 100 ... ..... .....    @rdn_pg_rm

This leads to a definition clash:

  In file included from ../target/arm/tcg/translate-sve.c:21:
  ../target/arm/tcg/translate.h:875:17: error: pasting "trans_" and "(" does not give a valid preprocessing token
    875 |     static bool trans_##NAME(DisasContext *s, arg_##NAME *a) \
        |                 ^~~~~~
  ../target/arm/tcg/translate-sve.c:4205:5: note: in expansion of macro 'TRANS_FEAT'
   4205 |     TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz, name##_zpzz_fns[a->esz], a)
        |     ^~~~~~~~~~
  ../target/arm/tcg/translate-sve.c:4249:1: note: in expansion of macro 'DO_ZPZZ_FP'
   4249 | DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
        | ^~~~~~~~~~
  ../target/arm/tcg/translate-sve.c:4249:12: error: expected declaration specifiers or '...' before numeric constant
   4249 | DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
        |            ^~~~~~
  ../target/arm/tcg/translate.h:875:25: note: in definition of macro 'TRANS_FEAT'
    875 |     static bool trans_##NAME(DisasContext *s, arg_##NAME *a) \
        |                         ^~~~
  ../target/arm/tcg/translate-sve.c:4249:1: note: in expansion of macro 'DO_ZPZZ_FP'
   4249 | DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
        | ^~~~~~~~~~
  ../target/arm/tcg/translate.h:875:47: error: pasting "arg_" and "(" does not give a valid preprocessing token
    875 |     static bool trans_##NAME(DisasContext *s, arg_##NAME *a) \
        |                                               ^~~~
  ../target/arm/tcg/translate-sve.c:4205:5: note: in expansion of macro 'TRANS_FEAT'
   4205 |     TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz, name##_zpzz_fns[a->esz], a)
        |     ^~~~~~~~~~
  ../target/arm/tcg/translate-sve.c:4249:1: note: in expansion of macro 'DO_ZPZZ_FP'
   4249 | DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
        | ^~~~~~~~~~
  In file included from ../target/arm/tcg/translate-sve.c:100:
  libqemu-aarch64-softmmu.a.p/decode-sve.c.inc:1227:13: warning: 'trans_FSCALE' used but never defined
   1227 | static bool trans_FSCALE(DisasContext *ctx, arg_FSCALE *a);
        |             ^~~~~~~~~~~~
  ../target/arm/tcg/translate-sve.c:4249:30: warning: 'sve_fscalbn_zpzz_fns' defined but not used [-Wunused-const-variable=]
   4249 | DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
        |                              ^~~~~~~~~~~
  ../target/arm/tcg/translate-sve.c:4201:42: note: in definition of macro 'DO_ZPZZ_FP'
   4201 |     static gen_helper_gvec_4_ptr * const name##_zpzz_fns[4] = { \
        |                                          ^~~~

As a kludge, undefine it globally in <qemu/osdep.h>.

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-Id: <20251203120315.62889-1-philmd@linaro.org>
---
 include/qemu/osdep.h | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/include/qemu/osdep.h b/include/qemu/osdep.h
index cf8d7cf7e6..3cb45a1467 100644
--- a/include/qemu/osdep.h
+++ b/include/qemu/osdep.h
@@ -141,6 +141,12 @@ QEMU_EXTERN_C int daemon(int, int);
 #undef ELF_DATA
 #undef ELF_ARCH
 
+/*
+ * Avoid conflict with Solaris FSCALE definition from <sys/param.h> header,
+ * but we might as well do this unconditionally.
+ */
+#undef FSCALE
+
 #ifdef CONFIG_IOVEC
 #include <sys/uio.h>
 #endif

From 93332c90bfcd91d4a30104d53650e4355db0a099 Mon Sep 17 00:00:00 2001
From: Alano Song <AlanoSong@163.com>
Date: Tue, 2 Dec 2025 21:21:32 +0800
Subject: [PATCH 2298/2396] hw/9pfs: Correct typo
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Correct comment typo in xen_9pfs_bh()

Signed-off-by: Alano Song <AlanoSong@163.com>
Reviewed-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251202132132.17636-1-AlanoSong@163.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/9pfs/xen-9p-backend.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/9pfs/xen-9p-backend.c b/hw/9pfs/xen-9p-backend.c
index 79359d911a..ca0fff5fa9 100644
--- a/hw/9pfs/xen-9p-backend.c
+++ b/hw/9pfs/xen-9p-backend.c
@@ -310,7 +310,7 @@ static void xen_9pfs_bh(void *opaque)
 
 again:
     wait = ring->co != NULL && qemu_coroutine_entered(ring->co);
-    /* paired with the smb_wmb barriers in xen_9pfs_init_in_iov_from_pdu */
+    /* paired with the smp_wmb barriers in xen_9pfs_init_in_iov_from_pdu */
     smp_rmb();
     if (wait) {
         cpu_relax();

From 8062bfd517645e0219fe302839fad7231bebf61d Mon Sep 17 00:00:00 2001
From: "Denis V. Lunev" <den@openvz.org>
Date: Wed, 3 Dec 2025 23:01:38 +0100
Subject: [PATCH 2299/2396] scripts: fix broken error path in
 modinfo-collect.py
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

sys.stderr.print is dropped long ago and should not be used. Official
replacement is sys.stderr.write

The problem has been found debugging building on some fancy platform
derived from Debian.

Signed-off-by: Denis V. Lunev <den@openvz.org>
CC: John Snow <jsnow@redhat.com>
CC: Cleber Rosa <crosa@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251203220138.159656-1-den@openvz.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/modinfo-collect.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/modinfo-collect.py b/scripts/modinfo-collect.py
index 6ebaea989d..db78b16c1f 100644
--- a/scripts/modinfo-collect.py
+++ b/scripts/modinfo-collect.py
@@ -41,7 +41,7 @@ def main(args):
     for obj in args:
         entry = compile_commands.get(obj, None)
         if not entry:
-            sys.stderr.print('modinfo: Could not find object file', obj)
+            sys.stderr.write(f'modinfo: Could not find object file {obj}')
             sys.exit(1)
         src = entry['file']
         if not src.endswith('.c'):

From 46228925edd53bb0569519538b94e10b85f9c001 Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 8 Dec 2025 12:30:08 +0100
Subject: [PATCH 2300/2396] vhost: Always initialize cached vring data
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

vhost_virtqueue_start() can exit early if the descriptor ring address is
0, assuming the virtqueue isn’t ready to start.

In this case, all cached vring information (size, physical address,
pointer) is left as-is.  This is OK at first startup, when that info is
still initialized to 0, but after a reset, it will retain old (outdated)
information.

vhost_virtqueue_start() must make sure these values are (re-)set
properly before exiting.

(When using an IOMMU, these outdated values can stall the device:
vhost_dev_start() deliberately produces an IOMMU miss event for each
used vring.  If used_phys contains an outdated value, the resulting
lookup may fail, forcing the device to be stopped.)

Cc: qemu-stable@nongnu.org
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251208113008.153249-1-hreitz@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/virtio/vhost.c | 38 +++++++++++++++++++++++---------------
 1 file changed, 23 insertions(+), 15 deletions(-)

diff --git a/hw/virtio/vhost.c b/hw/virtio/vhost.c
index 266a11514a..e654ea468a 100644
--- a/hw/virtio/vhost.c
+++ b/hw/virtio/vhost.c
@@ -1261,7 +1261,7 @@ int vhost_virtqueue_start(struct vhost_dev *dev,
     BusState *qbus = BUS(qdev_get_parent_bus(DEVICE(vdev)));
     VirtioBusState *vbus = VIRTIO_BUS(qbus);
     VirtioBusClass *k = VIRTIO_BUS_GET_CLASS(vbus);
-    hwaddr s, l, a;
+    hwaddr l;
     int r;
     int vhost_vq_index = dev->vhost_ops->vhost_get_vq_index(dev, idx);
     struct vhost_vring_file file = {
@@ -1272,8 +1272,17 @@ int vhost_virtqueue_start(struct vhost_dev *dev,
     };
     struct VirtQueue *vvq = virtio_get_queue(vdev, idx);
 
-    a = virtio_queue_get_desc_addr(vdev, idx);
-    if (a == 0) {
+    vq->desc_size = virtio_queue_get_desc_size(vdev, idx);
+    vq->desc_phys = virtio_queue_get_desc_addr(vdev, idx);
+    vq->desc = NULL;
+    vq->avail_size = virtio_queue_get_avail_size(vdev, idx);
+    vq->avail_phys = virtio_queue_get_avail_addr(vdev, idx);
+    vq->avail = NULL;
+    vq->used_size = virtio_queue_get_used_size(vdev, idx);
+    vq->used_phys = virtio_queue_get_used_addr(vdev, idx);
+    vq->used = NULL;
+
+    if (vq->desc_phys == 0) {
         /* Queue might not be ready for start */
         return 0;
     }
@@ -1301,24 +1310,23 @@ int vhost_virtqueue_start(struct vhost_dev *dev,
         }
     }
 
-    vq->desc_size = s = l = virtio_queue_get_desc_size(vdev, idx);
-    vq->desc_phys = a;
-    vq->desc = vhost_memory_map(dev, a, &l, false);
-    if (!vq->desc || l != s) {
+    l = vq->desc_size;
+    vq->desc = vhost_memory_map(dev, vq->desc_phys, &l, false);
+    if (!vq->desc || l != vq->desc_size) {
         r = -ENOMEM;
         goto fail_alloc_desc;
     }
-    vq->avail_size = s = l = virtio_queue_get_avail_size(vdev, idx);
-    vq->avail_phys = a = virtio_queue_get_avail_addr(vdev, idx);
-    vq->avail = vhost_memory_map(dev, a, &l, false);
-    if (!vq->avail || l != s) {
+
+    l = vq->avail_size;
+    vq->avail = vhost_memory_map(dev, vq->avail_phys, &l, false);
+    if (!vq->avail || l != vq->avail_size) {
         r = -ENOMEM;
         goto fail_alloc_avail;
     }
-    vq->used_size = s = l = virtio_queue_get_used_size(vdev, idx);
-    vq->used_phys = a = virtio_queue_get_used_addr(vdev, idx);
-    vq->used = vhost_memory_map(dev, a, &l, true);
-    if (!vq->used || l != s) {
+
+    l = vq->used_size;
+    vq->used = vhost_memory_map(dev, vq->used_phys, &l, true);
+    if (!vq->used || l != vq->used_size) {
         r = -ENOMEM;
         goto fail_alloc_used;
     }

From 0bc6fa244618b3a70cc09c328c4e7d0625a11a96 Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Tue, 9 Dec 2025 13:50:49 +0100
Subject: [PATCH 2301/2396] migration: Fix order of function arguments
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes a compiler error when higher warning levels are enabled:

../migration/postcopy-ram.c: In function ‘postcopy_temp_pages_setup’:
../migration/postcopy-ram.c:1483:50: error: ‘g_malloc0_n’ sizes specified with ‘sizeof’ in the earlier argument and not in the later argument [-Werror=calloc-transposed-args]
 1483 |     mis->postcopy_tmp_pages = g_malloc0_n(sizeof(PostcopyTmpPage), channels);
      |                                                  ^~~~~~~~~~~~~~~
../migration/postcopy-ram.c:1483:50: note: earlier argument should specify number of elements, later size of each element

Avoid also a related int/unsigned mismatch by fixing the type of
two local variables.

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251209125049.764095-1-sw@weilnetz.de>
[PMD: Replace g_malloc0_n() by g_new0()]
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Acked-by: Peter Xu <peterx@redhat.com>
Message-Id: <20251209195010.83219-1-philmd@linaro.org>
---
 migration/postcopy-ram.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/migration/postcopy-ram.c b/migration/postcopy-ram.c
index 7c9fe61041..715ef021a9 100644
--- a/migration/postcopy-ram.c
+++ b/migration/postcopy-ram.c
@@ -1467,7 +1467,8 @@ retry:
 static int postcopy_temp_pages_setup(MigrationIncomingState *mis)
 {
     PostcopyTmpPage *tmp_page;
-    int err, i, channels;
+    int err;
+    unsigned i, channels;
     void *temp_page;
 
     if (migrate_postcopy_preempt()) {
@@ -1479,7 +1480,7 @@ static int postcopy_temp_pages_setup(MigrationIncomingState *mis)
     }
 
     channels = mis->postcopy_channels;
-    mis->postcopy_tmp_pages = g_malloc0_n(sizeof(PostcopyTmpPage), channels);
+    mis->postcopy_tmp_pages = g_new0(PostcopyTmpPage, channels);
 
     for (i = 0; i < channels; i++) {
         tmp_page = &mis->postcopy_tmp_pages[i];

From 4fdff25625724f682a1174d53ccf8b0d099733ca Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Tue, 9 Dec 2025 13:57:59 +0100
Subject: [PATCH 2302/2396] hw/pci: Fix typo in documentation
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Message-ID: <20251209125759.764296-1-sw@weilnetz.de>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/hw/pci/pci.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index 6bccb25ac2..b72e484500 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -751,7 +751,7 @@ int pci_iommu_register_iotlb_notifier(PCIDevice *dev, uint32_t pasid,
 
 /**
  * pci_iommu_unregister_iotlb_notifier: unregister a notifier that has been
- * registerd with pci_iommu_register_iotlb_notifier.
+ * registered with pci_iommu_register_iotlb_notifier.
  *
  * Returns 0 on success, or a negative errno otherwise.
  *

From e742b7bdc244499761a21bc1965580c6261a74bf Mon Sep 17 00:00:00 2001
From: Stefan Weil <sw@weilnetz.de>
Date: Tue, 9 Dec 2025 14:02:12 +0100
Subject: [PATCH 2303/2396] scripts/nsis.py: Tell makensis that WoA is 64 bit
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This fixes some settings like the default installation path
for the QEMU installation on Windows on ARM (WoA).

Signed-off-by: Stefan Weil <sw@weilnetz.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251209130212.764443-1-sw@weilnetz.de>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 scripts/nsis.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/nsis.py b/scripts/nsis.py
index 8f469634eb..33069f4a86 100644
--- a/scripts/nsis.py
+++ b/scripts/nsis.py
@@ -114,7 +114,7 @@ def main():
             "-DSRCDIR=" + args.srcdir,
             "-DBINDIR=" + destdir + prefix,
         ]
-        if args.cpu == "x86_64":
+        if args.cpu == "aarch64" or args.cpu == "x86_64":
             makensis += ["-DW64"]
         makensis += ["-DDLLDIR=" + dlldir]
 

From 326e620fc0145686124f754194cdc6d0d9b3400d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Tue, 9 Dec 2025 18:43:28 +0100
Subject: [PATCH 2304/2396] Fix const qualifier build errors with recent glibc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A recent change in glibc 2.42.9000 [1] changes the return type of
strstr() and other string functions to be 'const char *' when the
input is a 'const char *'.

This breaks the build in various files with errors such as :

  error: initialization discards 'const' qualifier from pointer target type [-Werror=discarded-qualifiers]
    208 |         char *pidstr = strstr(filename, "%");
        |                        ^~~~~~

Fix this by changing the type of the variables that store the result
of these functions to 'const char *'.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=cd748a63ab1a7ae846175c532a3daab341c62690

Signed-off-by: Cédric Le Goater <clg@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251209174328.698774-1-clg@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 backends/tpm/tpm_passthrough.c | 2 +-
 block/vmdk.c                   | 2 +-
 block/vvfat.c                  | 2 +-
 gdbstub/gdbstub.c              | 2 +-
 qga/commands-linux.c           | 7 ++++---
 ui/ui-hmp-cmds.c               | 2 +-
 util/log.c                     | 2 +-
 7 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/backends/tpm/tpm_passthrough.c b/backends/tpm/tpm_passthrough.c
index b7c7074c2a..a9f35ab7d6 100644
--- a/backends/tpm/tpm_passthrough.c
+++ b/backends/tpm/tpm_passthrough.c
@@ -211,7 +211,7 @@ static size_t tpm_passthrough_get_buffer_size(TPMBackend *tb)
 static int tpm_passthrough_open_sysfs_cancel(TPMPassthruState *tpm_pt)
 {
     int fd = -1;
-    char *dev;
+    const char *dev;
     char path[PATH_MAX];
 
     if (tpm_pt->options->cancel_path) {
diff --git a/block/vmdk.c b/block/vmdk.c
index 3b35b63cb5..89e89cd10e 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -1089,7 +1089,7 @@ vmdk_open_vmdk4(BlockDriverState *bs, BdrvChild *file, int flags,
 static int vmdk_parse_description(const char *desc, const char *opt_name,
         char *buf, int buf_size)
 {
-    char *opt_pos, *opt_end;
+    const char *opt_pos, *opt_end;
     const char *end = desc + strlen(desc);
 
     opt_pos = strstr(desc, opt_name);
diff --git a/block/vvfat.c b/block/vvfat.c
index 814796d918..e334b9febb 100644
--- a/block/vvfat.c
+++ b/block/vvfat.c
@@ -1826,7 +1826,7 @@ cluster_was_modified(BDRVVVFATState *s, uint32_t cluster_num)
 
 static const char* get_basename(const char* path)
 {
-    char* basename = strrchr(path, '/');
+    const char *basename = strrchr(path, '/');
     if (basename == NULL)
         return path;
     else
diff --git a/gdbstub/gdbstub.c b/gdbstub/gdbstub.c
index dd5fb5667c..5b2fc06e58 100644
--- a/gdbstub/gdbstub.c
+++ b/gdbstub/gdbstub.c
@@ -362,7 +362,7 @@ static const char *get_feature_xml(const char *p, const char **newp,
      * qXfer:features:read:ANNEX:OFFSET,LENGTH'
      *                     ^p    ^newp
      */
-    char *term = strchr(p, ':');
+    const char *term = strchr(p, ':');
     *newp = term + 1;
     len = term - p;
 
diff --git a/qga/commands-linux.c b/qga/commands-linux.c
index 4a09ddc760..c639a60a94 100644
--- a/qga/commands-linux.c
+++ b/qga/commands-linux.c
@@ -403,7 +403,8 @@ static bool build_guest_fsinfo_for_pci_dev(char const *syspath,
     int i, offset, nhosts = 0, pcilen;
     GuestPCIAddress *pciaddr = disk->pci_controller;
     bool has_ata = false, has_host = false, has_tgt = false;
-    char *p, *driver = NULL;
+    const char *p;
+    char *driver = NULL;
     bool ret = false;
 
     p = strstr(syspath, "/devices/pci");
@@ -543,7 +544,7 @@ static bool build_guest_fsinfo_for_nonpci_virtio(char const *syspath,
                                                  Error **errp)
 {
     unsigned int tgt[3];
-    char *p;
+    const char *p;
 
     if (!strstr(syspath, "/virtio") || !strstr(syspath, "/block")) {
         g_debug("Unsupported virtio device '%s'", syspath);
@@ -575,7 +576,7 @@ static bool build_guest_fsinfo_for_ccw_dev(char const *syspath,
                                            Error **errp)
 {
     unsigned int cssid, ssid, subchno, devno;
-    char *p;
+    const char *p;
 
     p = strstr(syspath, "/devices/css");
     if (!p || sscanf(p + 12, "%*x/%x.%x.%x/%*x.%*x.%x/",
diff --git a/ui/ui-hmp-cmds.c b/ui/ui-hmp-cmds.c
index 980a8bbc51..6c93d452c9 100644
--- a/ui/ui-hmp-cmds.c
+++ b/ui/ui-hmp-cmds.c
@@ -418,7 +418,7 @@ err_out:
 void sendkey_completion(ReadLineState *rs, int nb_args, const char *str)
 {
     int i;
-    char *sep;
+    const char *sep;
     size_t len;
 
     if (nb_args != 2) {
diff --git a/util/log.c b/util/log.c
index 41f78ce86b..c44d66b5ce 100644
--- a/util/log.c
+++ b/util/log.c
@@ -203,7 +203,7 @@ static ValidFilenameTemplateResult
 valid_filename_template(const char *filename, bool per_thread, Error **errp)
 {
     if (filename) {
-        char *pidstr = strstr(filename, "%");
+        const char *pidstr = strstr(filename, "%");
 
         if (pidstr) {
             /* We only accept one %d, no other format strings */

From 0d42e48c73d3840fec57a6c4309b9a078138c6ce Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 9 Dec 2025 20:11:09 +0100
Subject: [PATCH 2305/2396] Revert "migration/vmstate: remove
 VMSTATE_BUFFER_POINTER_UNSAFE macro"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Next commit will re-use VMSTATE_BUFFER_POINTER_UNSAFE().

This reverts commit 58341158d022823234d25fd337654a82fa6d157b.

Suggested-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 include/migration/vmstate.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index df57e6550a..a87a5efa42 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -727,6 +727,15 @@ extern const VMStateInfo vmstate_info_qlist;
     .offset     = offsetof(_state, _field),                          \
 }
 
+#define VMSTATE_BUFFER_POINTER_UNSAFE(_field, _state, _version, _size) { \
+    .name       = (stringify(_field)),                               \
+    .version_id = (_version),                                        \
+    .size       = (_size),                                           \
+    .info       = &vmstate_info_buffer,                              \
+    .flags      = VMS_BUFFER | VMS_POINTER,                          \
+    .offset     = offsetof(_state, _field),                          \
+}
+
 /* Allocate a temporary of type 'tmp_type', set tmp->parent to _state
  * and execute the vmsd on the temporary.  Note that we're working with
  * the whole of _state here, not a field within it.

From efd6b3d1768d04d5491b62ad7385f623fb12f627 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 9 Dec 2025 20:11:17 +0100
Subject: [PATCH 2306/2396] Revert "hw/net/virtio-net: make VirtIONet.vlans an
 array instead of a pointer"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Per https://lore.kernel.org/qemu-devel/7798584d-e861-47b7-af52-2c2efb67a4de@proxmox.com/:

Loading a VM state taken with v10.1.2 or older doesn't work anymore,
using the script [*] we get:

  kvm: VQ 1 size 0x100 < last_avail_idx 0x9 - used_idx 0x3e30
  kvm: load of migration failed: Operation not permitted: error while loading state for instance 0x0 of device '0000:00:13.0/virtio-net': Failed to load element of type virtio for virtio: -1
  qemu-system-x86_64: Missing section footer for 0000:00:13.0/virtio-net
  qemu-system-x86_64: Section footer error, section_id: 41

[*]:

  #!/bin/bash
  rm /tmp/disk.qcow2
  args="
    -netdev type=tap,id=net1,ifname=tap104i1,script=/usr/libexec/qemu-server/pve-bridge,downscript=/usr/libexec/qemu-server/pve-bridgedown,vhost=on
    -device virtio-net-pci,mac=BC:24:11:32:3C:69,netdev=net1,bus=pci.0,addr=0x13,id=net1
    -machine type=pc-i440fx-10.1
  "
  $1/qemu-img create -f qcow2 /tmp/disk.qcow2 1G
  $1/qemu-system-x86_64 --qmp stdio --blockdev qcow2,node-name=node0,file.driver=file,file.filename=/tmp/disk.qcow2 $args <<EOF
  {"execute": "qmp_capabilities"}
  {"execute": "snapshot-save", "arguments": { "job-id": "save0", "tag": "snap", "vmstate": "node0", "devices": ["node0"] } }
  {"execute": "quit"}
  EOF
  $2/qemu-system-x86_64 --qmp stdio --blockdev qcow2,node-name=node0,file.driver=file,file.filename=/tmp/disk.qcow2 $args -loadvm snap

This reverts commit 3a9cd2a4a1571266dea37398de04f650c2a72d86.

Reported-by: Fiona Ebner <f.ebner@proxmox.com>
Suggested-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 hw/net/virtio-net.c            | 9 +++++----
 include/hw/virtio/virtio-net.h | 2 +-
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index f5d93eb400..ca813203d7 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -986,7 +986,7 @@ static void virtio_net_set_features(VirtIODevice *vdev,
         virtio_has_feature_ex(vdev->guest_features_ex,
                               VIRTIO_NET_F_CTRL_VLAN)) {
         bool vlan = virtio_has_feature_ex(features, VIRTIO_NET_F_CTRL_VLAN);
-        memset(n->vlans, vlan ? 0 : 0xff, sizeof(n->vlans));
+        memset(n->vlans, vlan ? 0 : 0xff, MAX_VLAN >> 3);
     }
 
     if (virtio_has_feature_ex(features, VIRTIO_NET_F_STANDBY)) {
@@ -3598,8 +3598,7 @@ static const VMStateDescription vmstate_virtio_net_device = {
          * buffer; hold onto your endiannesses; it's actually used as a bitmap
          * but based on the uint.
          */
-        VMSTATE_BUFFER_UNSAFE(vlans, VirtIONet, 0,
-                              sizeof(typeof_field(VirtIONet, vlans))),
+        VMSTATE_BUFFER_POINTER_UNSAFE(vlans, VirtIONet, 0, MAX_VLAN >> 3),
         VMSTATE_WITH_TMP(VirtIONet, struct VirtIONetMigTmp,
                          vmstate_virtio_net_has_vnet),
         VMSTATE_UINT8(mac_table.multi_overflow, VirtIONet),
@@ -4017,7 +4016,8 @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
 
-    memset(n->vlans, 0xff, sizeof(n->vlans));
+    n->vlans = g_malloc0(MAX_VLAN >> 3);
+    memset(n->vlans, 0xff, MAX_VLAN >> 3);
 
     nc = qemu_get_queue(n->nic);
     nc->rxfilter_notify_enabled = 1;
@@ -4066,6 +4066,7 @@ static void virtio_net_device_unrealize(DeviceState *dev)
     n->netclient_type = NULL;
 
     g_free(n->mac_table.macs);
+    g_free(n->vlans);
 
     if (n->failover) {
         qobject_unref(n->primary_opts);
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index f708355306..5b8ab7bda7 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -202,7 +202,7 @@ struct VirtIONet {
         uint8_t uni_overflow;
         uint8_t *macs;
     } mac_table;
-    uint32_t vlans[MAX_VLAN];
+    uint32_t *vlans;
     virtio_net_conf net_conf;
     NICConf nic_conf;
     DeviceState *qdev;

From 9c23f2a7b0b45277693a14074b1aaa827eecdb92 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 9 Dec 2025 16:44:49 -0600
Subject: [PATCH 2307/2396] Update version for v10.2.0-rc3 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index a0f6b4da40..d8254def9b 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.92
+10.1.93

From ab0065e36adf8becd9c1ffceec37ee809ce683af Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Mon, 8 Dec 2025 08:53:20 +0100
Subject: [PATCH 2308/2396] tests/qemu-iotests: Fix check for existing file in
 _require_disk_usage()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Looks like the "$" has been forgotten here to get the contents of
the FILENAME variable.

Fixes: c49dda7254d ("iotests: Filter out ZFS in several tests")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20251208075320.35682-1-thuth@redhat.com>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/common.rc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index 10d83d8361..c0f8f0f8df 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -1008,7 +1008,7 @@ _require_disk_usage()
     else
         FILENAME="$TEST_IMG_FILE"
     fi
-    if [ -e "FILENAME" ]; then
+    if [ -e "$FILENAME" ]; then
         echo "unwilling to overwrite existing file"
         exit 1
     fi

From b002acacc1d72521351501fa0af81d146106c9ed Mon Sep 17 00:00:00 2001
From: Hanna Czenczek <hreitz@redhat.com>
Date: Mon, 15 Dec 2025 15:15:40 +0100
Subject: [PATCH 2309/2396] Revert "nvme: Fix coroutine waking"
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit 0f142cbd919fcb6cea7aa176f7e4939925806dd9.

Said commit changed the replay_bh_schedule_oneshot_event() in
nvme_rw_cb() to aio_co_wake(), allowing the request coroutine to be
entered directly (instead of only being scheduled for later execution).
This can cause the device to become stalled like so:

It is possible that after completion the request coroutine goes on to
submit another request without yielding, e.g. a flush after a write to
emulate FUA.  This will likely cause a nested nvme_process_completion()
call because nvme_rw_cb() itself is called from there.

(After submitting a request, we invoke nvme_process_completion() through
defer_call(); but the fact that nvme_process_completion() ran in the
first place indicates that we are not in a call-deferring section, so
defer_call() will call nvme_process_completion() immediately.)

If this inner nvme_process_completion() loop then processes any
completions, it will write the final completion queue (CQ) head index to
the CQ head doorbell, and subsequently execution will return to the
outer nvme_process_completion() loop.  Even if this loop now finds no
further completions, it still processed at least one completion before,
or it would not have called the nvme_rw_cb() which led to nesting.
Therefore, it will now write the exact same CQ head index value to the
doorbell, which effectively is an unrecoverable error[1].

Therefore, nesting of nvme_process_completion() does not work at this
point.  Reverting said commit removes the nesting (by scheduling the
request coroutine instead of entering it immediately), and so fixes the
stall.

On the downside, reverting said commit breaks multiqueue for nvme, but
better to have single-queue working than neither.  For 11.0, we will
have a solution that makes both work.

A side note: There is a comment in nvme_process_completion() above
qemu_bh_schedule() that claims nesting works, as long as it is done
through the completion_bh.  I am quite sure that is not true, for two
reasons:
- The problem described above, which is even worse when going through
  nvme_process_completion_bh() because that function unconditionally
  writes to the CQ head doorbell,
- nvme_process_completion_bh() never takes q->lock, so
  nvme_process_completion() unlocking it will likely abort.

Given the lack of reports of such aborts, I believe that completion_bh
simply is unused in practice.

[1] See the NVMe Base Specification revision 2.3, page 180, figure 152:
    “Invalid Doorbell Write Value: A host attempted to write an invalid
    doorbell value. Some possible causes of this error are: [...] the
    value written is the same as the previously written doorbell value.”

    To even be notified of this error, we would need to send an
    Asynchronous Event Request to the admin queue (p. 178ff), which we
    don’t do, and then to handle it, we would need to delete and
    recreate the queue (p. 88, section 3.3.1.2 Queue Usage).

Cc: qemu-stable@nongnu.org
Reported-by: Lukáš Doktor <ldoktor@redhat.com>
Tested-by: Lukáš Doktor <ldoktor@redhat.com>
Signed-off-by: Hanna Czenczek <hreitz@redhat.com>
Message-id: 20251215141540.88915-1-hreitz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/nvme.c | 56 +++++++++++++++++++++++++---------------------------
 1 file changed, 27 insertions(+), 29 deletions(-)

diff --git a/block/nvme.c b/block/nvme.c
index 919e14cef9..c3d3b99d1f 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -1200,36 +1200,26 @@ fail:
 
 typedef struct {
     Coroutine *co;
-    bool skip_yield;
     int ret;
+    AioContext *ctx;
 } NVMeCoData;
 
+static void nvme_rw_cb_bh(void *opaque)
+{
+    NVMeCoData *data = opaque;
+    qemu_coroutine_enter(data->co);
+}
+
 /* Put into NVMeRequest.cb, so runs in the BDS's main AioContext */
 static void nvme_rw_cb(void *opaque, int ret)
 {
     NVMeCoData *data = opaque;
-
     data->ret = ret;
-
-    if (data->co == qemu_coroutine_self()) {
-        /*
-         * Fast path: We are inside of the request coroutine (through
-         * nvme_submit_command, nvme_deferred_fn, nvme_process_completion).
-         * We can set data->skip_yield here to keep the coroutine from
-         * yielding, and then we don't need to schedule a BH to wake it.
-         */
-        data->skip_yield = true;
-    } else {
-        /*
-         * Safe to call: The case where we run in the request coroutine is
-         * handled above, so we must be independent of it; and without
-         * skip_yield set, the coroutine will yield.
-         * No need to release NVMeQueuePair.lock (we are called without it
-         * held).  (Note: If we enter the coroutine here, @data will
-         * probably be dangling once aio_co_wake() returns.)
-         */
-        aio_co_wake(data->co);
+    if (!data->co) {
+        /* The rw coroutine hasn't yielded, don't try to enter. */
+        return;
     }
+    replay_bh_schedule_oneshot_event(data->ctx, nvme_rw_cb_bh, data);
 }
 
 static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
@@ -1253,7 +1243,7 @@ static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
         .cdw12 = cpu_to_le32(cdw12),
     };
     NVMeCoData data = {
-        .co = qemu_coroutine_self(),
+        .ctx = bdrv_get_aio_context(bs),
         .ret = -EINPROGRESS,
     };
 
@@ -1270,7 +1260,9 @@ static coroutine_fn int nvme_co_prw_aligned(BlockDriverState *bs,
         return r;
     }
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-    if (!data.skip_yield) {
+
+    data.co = qemu_coroutine_self();
+    while (data.ret == -EINPROGRESS) {
         qemu_coroutine_yield();
     }
 
@@ -1366,7 +1358,7 @@ static coroutine_fn int nvme_co_flush(BlockDriverState *bs)
         .nsid = cpu_to_le32(s->nsid),
     };
     NVMeCoData data = {
-        .co = qemu_coroutine_self(),
+        .ctx = bdrv_get_aio_context(bs),
         .ret = -EINPROGRESS,
     };
 
@@ -1374,7 +1366,9 @@ static coroutine_fn int nvme_co_flush(BlockDriverState *bs)
     req = nvme_get_free_req(ioq);
     assert(req);
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-    if (!data.skip_yield) {
+
+    data.co = qemu_coroutine_self();
+    if (data.ret == -EINPROGRESS) {
         qemu_coroutine_yield();
     }
 
@@ -1415,7 +1409,7 @@ static coroutine_fn int nvme_co_pwrite_zeroes(BlockDriverState *bs,
     };
 
     NVMeCoData data = {
-        .co = qemu_coroutine_self(),
+        .ctx = bdrv_get_aio_context(bs),
         .ret = -EINPROGRESS,
     };
 
@@ -1435,7 +1429,9 @@ static coroutine_fn int nvme_co_pwrite_zeroes(BlockDriverState *bs,
     assert(req);
 
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-    if (!data.skip_yield) {
+
+    data.co = qemu_coroutine_self();
+    while (data.ret == -EINPROGRESS) {
         qemu_coroutine_yield();
     }
 
@@ -1463,7 +1459,7 @@ static int coroutine_fn nvme_co_pdiscard(BlockDriverState *bs,
     };
 
     NVMeCoData data = {
-        .co = qemu_coroutine_self(),
+        .ctx = bdrv_get_aio_context(bs),
         .ret = -EINPROGRESS,
     };
 
@@ -1508,7 +1504,9 @@ static int coroutine_fn nvme_co_pdiscard(BlockDriverState *bs,
     trace_nvme_dsm(s, offset, bytes);
 
     nvme_submit_command(ioq, req, &cmd, nvme_rw_cb, &data);
-    if (!data.skip_yield) {
+
+    data.co = qemu_coroutine_self();
+    while (data.ret == -EINPROGRESS) {
         qemu_coroutine_yield();
     }
 

From 307bc43095b8ab1765fd66c26003d5da06681c05 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Mon, 15 Dec 2025 16:07:14 +0100
Subject: [PATCH 2310/2396] block: Fix BDS use after free during shutdown

During shutdown, blockdev_close_all_bdrv_states() drops any block node
references that are still owned by the monitor (i.e. the user). However,
in doing so, it forgot to also remove the node from monitor_bdrv_states
(which qmp_blockdev_del() correctly does), which means that later calls
of bdrv_first()/bdrv_next() will still return the (now stale) pointer to
the node.

Usually there is no such call after this point, but in some cases it can
happen. In the reported case, there was an ongoing migration, and the
migration thread wasn't shut down yet: migration_shutdown() called by
qemu_cleanup() doesn't actually wait for the migration to be shut down,
but may just move it to MIGRATION_STATUS_CANCELLING. The next time
migration_iteration_finish() runs, it sees the status and tries to
re-activate all block devices that migration may have previously
inactivated. This is where bdrv_first()/bdrv_next() get called and the
access to the already freed node happens.

It is debatable if migration_shutdown() should really return before
migration has settled, but leaving a dangling pointer in the list of
monitor-owned block nodes is clearly a bug either way and fixing it
solves the immediate problem, so fix it.

Cc: qemu-stable@nongnu.org
Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-ID: <20251215150714.130214-1-kwolf@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/blockdev.c b/blockdev.c
index dbd1d4d3e8..6e86c6262f 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -686,6 +686,7 @@ void blockdev_close_all_bdrv_states(void)
 
     GLOBAL_STATE_CODE();
     QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) {
+        QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
         bdrv_unref(bs);
     }
 }

From 2f5c96d53409160b11f031b22f2d947f75ab06ab Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 15 Dec 2025 11:19:34 +0100
Subject: [PATCH 2311/2396] i386: Fix const qualifier build errors with recent
 glibc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A recent change in glibc 2.42.9000 [1] changes the return type of
strstr() and other string functions to be 'const char *' when the
input is a 'const char *'. This breaks the build in :

  ../hw/i386/x86-common.c:827:11: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
  827 |     vmode = strstr(kernel_cmdline, "vga=");
      |           ^

Fix this by changing the type of the variables that store the result
of these functions to 'const char *'.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=cd748a63ab1a7ae846175c532a3daab341c62690

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251215101937.281722-2-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 hw/i386/x86-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86-common.c b/hw/i386/x86-common.c
index c844749900..f77e2e6304 100644
--- a/hw/i386/x86-common.c
+++ b/hw/i386/x86-common.c
@@ -654,7 +654,7 @@ void x86_load_linux(X86MachineState *x86ms,
     uint8_t header[8192], *setup, *kernel;
     hwaddr real_addr, prot_addr, cmdline_addr, initrd_addr = 0;
     FILE *f;
-    char *vmode;
+    const char *vmode;
     MachineState *machine = MACHINE(x86ms);
     struct setup_data *setup_data;
     const char *kernel_filename = machine->kernel_filename;

From e37a0d514a17a660434ea20c0dd84bc6c20ca517 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 15 Dec 2025 11:19:35 +0100
Subject: [PATCH 2312/2396] tests/vhost-user-bridge.c: Fix const qualifier
 build errors with recent glibc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A recent change in glibc 2.42.9000 [1] changes the return type of
strstr() and other string functions to be 'const char *' when the
input is a 'const char *'. This breaks the build in :

../tests/vhost-user-bridge.c: In function ‘vubr_parse_host_port’:
../tests/vhost-user-bridge.c:749:15: error: initialization discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
  749 |     char *p = strchr(buf, ':');
      |               ^~~~~~

Fix this by using the glib g_strsplit() routine instead of strdup().

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=cd748a63ab1a7ae846175c532a3daab341c62690

Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Acked-by: Yodel Eldar <yodel.eldar@yodel.dev>
Tested-by: Yodel Eldar <yodel.eldar@yodel.dev>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20251215101937.281722-3-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 tests/vhost-user-bridge.c | 10 ++++------
 1 file changed, 4 insertions(+), 6 deletions(-)

diff --git a/tests/vhost-user-bridge.c b/tests/vhost-user-bridge.c
index a5c711b1de..ce4c3426d3 100644
--- a/tests/vhost-user-bridge.c
+++ b/tests/vhost-user-bridge.c
@@ -746,14 +746,12 @@ vubr_run(VubrDev *dev)
 static int
 vubr_parse_host_port(const char **host, const char **port, const char *buf)
 {
-    char *p = strchr(buf, ':');
-
-    if (!p) {
+    g_auto(GStrv) tokens = g_strsplit(buf, ":", 2);
+    if (!tokens[0] || !tokens[1]) {
         return -1;
     }
-    *p = '\0';
-    *host = strdup(buf);
-    *port = strdup(p + 1);
+    *host = g_steal_pointer(&tokens[0]);
+    *port = g_steal_pointer(&tokens[1]);
     return 0;
 }
 

From dfe87815ba450228811f3abc633d7dc02757922e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 15 Dec 2025 11:19:36 +0100
Subject: [PATCH 2313/2396] monitor: Fix const qualifier build errors with
 recent glibc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A recent change in glibc 2.42.9000 [1] changes the return type of
strchr() and other string functions to be 'const char *' when the
input is a 'const char *'. This breaks the build in :

../monitor/hmp.c:589:7: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
  589 |     p = strchr(type, ':');
      |       ^

Fix this by changing the type of the variables that store the result
of these functions to 'const char *'.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=cd748a63ab1a7ae846175c532a3daab341c62690

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251215101937.281722-4-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 monitor/hmp.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/monitor/hmp.c b/monitor/hmp.c
index 34e2b8f748..a3ee02e52c 100644
--- a/monitor/hmp.c
+++ b/monitor/hmp.c
@@ -577,10 +577,11 @@ static const char *get_command_name(const char *cmdline,
  * Read key of 'type' into 'key' and return the current
  * 'type' pointer.
  */
-static char *key_get_info(const char *type, char **key)
+static const char *key_get_info(const char *type, char **key)
 {
     size_t len;
-    char *p, *str;
+    const char *p;
+    char *str;
 
     if (*type == ',') {
         type++;

From d7e1df769910da9d832dda86b01fe1363e4f4a3c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 15 Dec 2025 11:19:37 +0100
Subject: [PATCH 2314/2396] gdbstub: Fix const qualifier build errors with
 recent glibc
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

A recent change in glibc 2.42.9000 [1] changes the return type of
strstr() and other string functions to be 'const char *' when the
input is a 'const char *'. This breaks the build in :

../gdbstub/user.c:322:21: error: assignment discards ‘const’ qualifier from pointer target type [-Werror=discarded-qualifiers]
  322 |     pid_placeholder = strstr(path, "%d");
      |                     ^
Fix this by changing the type of the variables that store the result
of these functions to 'const char *'.

[1] https://sourceware.org/git/?p=glibc.git;a=commit;h=cd748a63ab1a7ae846175c532a3daab341c62690

Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251215101937.281722-5-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
---
 gdbstub/user.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/gdbstub/user.c b/gdbstub/user.c
index 2e14ded3f0..e233c59816 100644
--- a/gdbstub/user.c
+++ b/gdbstub/user.c
@@ -317,7 +317,7 @@ static bool gdb_accept_socket(int gdb_fd)
 static int gdbserver_open_socket(const char *path, Error **errp)
 {
     g_autoptr(GString) buf = g_string_new("");
-    char *pid_placeholder;
+    const char *pid_placeholder;
 
     pid_placeholder = strstr(path, "%d");
     if (pid_placeholder != NULL) {

From 00829ae3845fd11e56239390924e3e74c3a4c144 Mon Sep 17 00:00:00 2001
From: Zesen Liu <ftyghome@gmail.com>
Date: Wed, 17 Dec 2025 11:59:52 +0800
Subject: [PATCH 2315/2396] qdev: fix error handling in set_uint64_checkmask

When specifying lbr_fmt=VALUE in cpu options with an invalid VALUE, error_setg() gets triggered twice, causing an assertion failure in error_setv() which requires *errp to be NULL, preventing meaningful error messages from being displayed.

Fix this by checking visit_type_uint64()'s return value and returning early on failure, consistent with other property setters like set_string().

Fixes: 18c22d7112a7 (qdev-properties: Add a new macro with bitmask check for uint64_t property)
Cc: qemu-stable@nongnu.org
Signed-off-by: Zesen Liu <ftyghome@gmail.com>
Message-ID: <20251217-qdev-fix-v1-1-bd33ea463220@gmail.com>
Reviewed-by: Markus Armbruster <armbru@redhat.com>
[Add Fixes: and Cc:]
Signed-off-by: Markus Armbruster <armbru@redhat.com>
---
 hw/core/qdev-properties.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/core/qdev-properties.c b/hw/core/qdev-properties.c
index 422a486969..0930d64252 100644
--- a/hw/core/qdev-properties.c
+++ b/hw/core/qdev-properties.c
@@ -494,7 +494,9 @@ static void set_uint64_checkmask(Object *obj, Visitor *v, const char *name,
     const Property *prop = opaque;
     uint64_t *ptr = object_field_prop_ptr(obj, prop);
 
-    visit_type_uint64(v, name, ptr, errp);
+    if (!visit_type_uint64(v, name, ptr, errp)) {
+        return;
+    }
     if (*ptr & ~prop->bitmask) {
         error_setg(errp, "Property value for '%s' has bits outside mask '0x%" PRIx64 "'",
                    name, prop->bitmask);

From bb7fc1543fa45bebe7eded8115f25441a9fee76e Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 18 Dec 2025 06:46:27 +1100
Subject: [PATCH 2316/2396] Update version for v10.2.0-rc4 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index d8254def9b..7596c57239 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.93
+10.1.94

From 698104725efad4b29079d857dfdebbd804e34c99 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 23 Dec 2025 14:44:07 +1100
Subject: [PATCH 2317/2396] Update version for v10.2.0 release

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 7596c57239..2bd6f7e392 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.1.94
+10.2.0

From b33a56328187f9cc4e90253b9450c0b84dc0cc5d Mon Sep 17 00:00:00 2001
From: Andrew Cooper <andrew.cooper3@citrix.com>
Date: Wed, 12 Mar 2025 00:06:03 +0000
Subject: [PATCH 2318/2396] target/i386: Fix #GP error code for INT
 instructions

While the (intno << shift) expression is correct for indexing the IDT based on
whether Long Mode is active, the error code itself was unchanged with AMD64,
and is still the index with 3 bits of metadata in the bottom.

Found when running a Xen unit test, all under QEMU.  The unit test objected to
being told there was an error with IDT index 256 when INT $0x80 (128) was the
problem instruction:

  ...
  Error: Unexpected fault 0x800d0802, #GP[IDT[256]]
  ...

Fixes: d2fd1af76777 ("x86_64 linux user emulation")
Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com>
Link: https://lore.kernel.org/r/20250312000603.3666083-1-andrew.cooper3@citrix.com
Cc: qemu-stable@nongnu.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3160
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 60efba3c1bff0d78632d45c2dc927c5bc7a17ba8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/tcg/user/seg_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/user/seg_helper.c b/target/i386/tcg/user/seg_helper.c
index 263f59937f..28bbef1bba 100644
--- a/target/i386/tcg/user/seg_helper.c
+++ b/target/i386/tcg/user/seg_helper.c
@@ -63,7 +63,7 @@ static void do_interrupt_user(CPUX86State *env, int intno, int is_int,
         cpl = env->hflags & HF_CPL_MASK;
         /* check privilege if software int */
         if (dpl < cpl) {
-            raise_exception_err(env, EXCP0D_GPF, (intno << shift) + 2);
+            raise_exception_err(env, EXCP0D_GPF, intno * 8 + 2);
         }
     }
 

From 59c9137156c1c82060563f679cdb56da5b949ae8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 24 Nov 2025 14:12:49 +0100
Subject: [PATCH 2319/2396] target/i386/tcg: ignore V3 in 32-bit mode

From the manual: "In 64-bit mode all 4 bits may be used. [...]
In 32-bit and 16-bit modes bit 6 must be 1 (if bit 6 is not 1, the
2-byte VEX version will generate LDS instruction and the 3-byte VEX
version will ignore this bit)."

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 0db1b556e4bcd7a51f222cda9e14850f88fe3f88)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/tcg/decode-new.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 0f8c5d1693..dfaffec599 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2665,7 +2665,7 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
                     goto unknown_op;
                 }
             }
-            s->vex_v = (~vex3 >> 3) & 0xf;
+            s->vex_v = (~vex3 >> 3) & (CODE64(s) ? 15 : 7);
             s->vex_l = (vex3 >> 2) & 1;
             s->prefix |= pp_prefix[vex3 & 3] | PREFIX_VEX;
         }

From 2af81f12518e69c0d6194fcb1edad00d761a69af Mon Sep 17 00:00:00 2001
From: Alano Song <AlanoSong@163.com>
Date: Thu, 18 Dec 2025 22:11:44 +0800
Subject: [PATCH 2320/2396] hw/i2c/imx: Fix trace func name error
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Alano Song <AlanoSong@163.com>
Fixes: e589c0ea9c9 ("hw/i2c/imx_i2c: Convert DPRINTF() to trace events")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20251218141144.51001-1-AlanoSong@163.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 3fbadbb3927a92db1932baee0c1188b05c0ac6b1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i2c/imx_i2c.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/i2c/imx_i2c.c b/hw/i2c/imx_i2c.c
index d26177c85d..22b10e4166 100644
--- a/hw/i2c/imx_i2c.c
+++ b/hw/i2c/imx_i2c.c
@@ -151,8 +151,8 @@ static void imx_i2c_write(void *opaque, hwaddr offset,
 {
     IMXI2CState *s = IMX_I2C(opaque);
 
-    trace_imx_i2c_read(DEVICE(s)->canonical_path, imx_i2c_get_regname(offset),
-                       offset, value);
+    trace_imx_i2c_write(DEVICE(s)->canonical_path, imx_i2c_get_regname(offset),
+                        offset, value);
 
     value &= 0xff;
 

From a7383751c2c462f416eee75c8e477feb44404af7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 22 Dec 2025 08:33:51 +0100
Subject: [PATCH 2321/2396] tests/functional: Fix URL of gb200nvl-bmc image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit [1] moved the FW image of the gb200nvl-bmc machine and broke
the associated functional test. Fix that.

[1] https://github.com/legoater/qemu-aspeed-boot/commit/52451b2472eeb40aa97e131aeea327e9d4a8a78a

Cc: Ed Tanous <etanous@nvidia.com>
Cc: Patrick Williams <patrick@stwcx.xyz>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20251222073351.166720-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 75bcfb98a13d14beb2ea95fb3c51da01c7102325)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/functional/arm/test_aspeed_gb200nvl_bmc.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/functional/arm/test_aspeed_gb200nvl_bmc.py b/tests/functional/arm/test_aspeed_gb200nvl_bmc.py
index 8e8e3f05c1..e5f2dce0f5 100755
--- a/tests/functional/arm/test_aspeed_gb200nvl_bmc.py
+++ b/tests/functional/arm/test_aspeed_gb200nvl_bmc.py
@@ -11,7 +11,7 @@ from aspeed import AspeedTest
 class GB200Machine(AspeedTest):
 
     ASSET_GB200_FLASH = Asset(
-        'https://github.com/legoater/qemu-aspeed-boot/raw/refs/heads/master/images/gb200nvl-obmc/obmc-phosphor-image-gb200nvl-obmc-20250702182348.static.mtd.xz',
+        'https://github.com/legoater/qemu-aspeed-boot/raw/refs/heads/master/images/gb200nvl-bmc/openbmc-20250702182348/obmc-phosphor-image-gb200nvl-obmc-20250702182348.static.mtd.xz',
         'b84819317cb3dc762895ad507705978ef000bfc77c50c33a63bdd37921db0dbc')
 
     def test_arm_aspeed_gb200_openbmc(self):

From d6b9de8f9ee3828d8e1f70690615b1c191b7101a Mon Sep 17 00:00:00 2001
From: Jie Song <songjie_yewu@cmss.chinamobile.com>
Date: Tue, 25 Nov 2025 22:07:06 +0800
Subject: [PATCH 2322/2396] monitor/qmp: cleanup SocketChardev listener sources
 early to avoid fd handling race
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When starting a dummy QEMU process with virsh version, monitor_init_qmp()
enables IOThread monitoring of the QMP fd by default. However, a race
condition exists during the initialization phase: the IOThread only removes
the main thread's fd watch when it reaches qio_net_listener_set_client_func_full(),
which may be delayed under high system load.

This creates a window between monitor_qmp_setup_handlers_bh() and
qio_net_listener_set_client_func_full() where both the main thread and
IOThread are simultaneously monitoring the same fd and processing events.
This race can cause either the main thread or the IOThread to hang and
become unresponsive.

Fix this by proactively cleaning up the listener's IO sources in
monitor_init_qmp() before the IOThread initializes QMP monitoring,
ensuring exclusive fd ownership and eliminating the race condition.

Signed-off-by: Jie Song <songjie_yewu@cmss.chinamobile.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-ID: <20251125140706.114197-1-mail@jiesong.me>
(cherry picked from commit e714f1a3d4d1e66b9a3ff4be1ff999c32bbef29e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 chardev/char-io.c         |  8 ++++++++
 chardev/char-socket.c     | 10 ++++++++++
 include/chardev/char-io.h |  2 ++
 include/chardev/char.h    |  2 ++
 monitor/qmp.c             |  5 +++++
 5 files changed, 27 insertions(+)

diff --git a/chardev/char-io.c b/chardev/char-io.c
index 3be17b51ca..beac5cd245 100644
--- a/chardev/char-io.c
+++ b/chardev/char-io.c
@@ -182,3 +182,11 @@ int io_channel_send(QIOChannel *ioc, const void *buf, size_t len)
 {
     return io_channel_send_full(ioc, buf, len, NULL, 0);
 }
+
+void remove_listener_fd_in_watch(Chardev *chr)
+{
+    ChardevClass *cc = CHARDEV_GET_CLASS(chr);
+    if (cc->chr_listener_cleanup) {
+        cc->chr_listener_cleanup(chr);
+    }
+}
diff --git a/chardev/char-socket.c b/chardev/char-socket.c
index 26d2f11202..3f45dd2ecd 100644
--- a/chardev/char-socket.c
+++ b/chardev/char-socket.c
@@ -1570,6 +1570,15 @@ char_socket_get_connected(Object *obj, Error **errp)
     return s->state == TCP_CHARDEV_STATE_CONNECTED;
 }
 
+static void tcp_chr_listener_cleanup(Chardev *chr)
+{
+    SocketChardev *s = SOCKET_CHARDEV(chr);
+    if (s->listener) {
+        qio_net_listener_set_client_func_full(s->listener, NULL, NULL,
+                                              NULL, chr->gcontext);
+    }
+}
+
 static void char_socket_class_init(ObjectClass *oc, const void *data)
 {
     ChardevClass *cc = CHARDEV_CLASS(oc);
@@ -1587,6 +1596,7 @@ static void char_socket_class_init(ObjectClass *oc, const void *data)
     cc->chr_add_client = tcp_chr_add_client;
     cc->chr_add_watch = tcp_chr_add_watch;
     cc->chr_update_read_handler = tcp_chr_update_read_handler;
+    cc->chr_listener_cleanup = tcp_chr_listener_cleanup;
 
     object_class_property_add(oc, "addr", "SocketAddress",
                               char_socket_get_addr, NULL,
diff --git a/include/chardev/char-io.h b/include/chardev/char-io.h
index ac379ea70e..540131346d 100644
--- a/include/chardev/char-io.h
+++ b/include/chardev/char-io.h
@@ -43,4 +43,6 @@ int io_channel_send(QIOChannel *ioc, const void *buf, size_t len);
 int io_channel_send_full(QIOChannel *ioc, const void *buf, size_t len,
                          int *fds, size_t nfds);
 
+void remove_listener_fd_in_watch(Chardev *chr);
+
 #endif /* CHAR_IO_H */
diff --git a/include/chardev/char.h b/include/chardev/char.h
index b65e9981c1..192cad67d4 100644
--- a/include/chardev/char.h
+++ b/include/chardev/char.h
@@ -307,6 +307,8 @@ struct ChardevClass {
 
     /* handle various events */
     void (*chr_be_event)(Chardev *s, QEMUChrEvent event);
+
+    void (*chr_listener_cleanup)(Chardev *chr);
 };
 
 Chardev *qemu_chardev_new(const char *id, const char *typename,
diff --git a/monitor/qmp.c b/monitor/qmp.c
index cb99a12d94..7ae070dc8d 100644
--- a/monitor/qmp.c
+++ b/monitor/qmp.c
@@ -537,6 +537,11 @@ void monitor_init_qmp(Chardev *chr, bool pretty, Error **errp)
          * e.g. the chardev is in client mode, with wait=on.
          */
         remove_fd_in_watch(chr);
+        /*
+         * Clean up listener IO sources early to prevent racy fd
+         * handling between the main thread and the I/O thread.
+         */
+        remove_listener_fd_in_watch(chr);
         /*
          * We can't call qemu_chr_fe_set_handlers() directly here
          * since chardev might be running in the monitor I/O

From 682e043b17dab18e7c73adc4156b8c5ec619d740 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Wed, 7 Jan 2026 09:51:38 +1100
Subject: [PATCH 2323/2396] tcg/optimize: Save o_mask in fold_masks_zosa_int
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When adding o_mask to this function, we used it in a
couple of places but failed to save it for future use.
Also, update a related comment.

Cc: qemu-stable@nongnu.org
Fixes: 56f15f67ea1 ("tcg/optimize: Add one's mask to TempOptInfo")
Reported-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 7d2d577de0c72f3cf2eb43f1534e908070d3bc47)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tcg/optimize.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index f69702b26e..1f95da487b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1088,8 +1088,9 @@ static bool fold_masks_zosa_int(OptContext *ctx, TCGOp *op,
 
     ti = ts_info(ts);
     ti->z_mask = z_mask;
+    ti->o_mask = o_mask;
 
-    /* Canonicalize s_mask and incorporate data from z_mask. */
+    /* Canonicalize s_mask and incorporate data from [zo]_mask. */
     rep = clz64(~s_mask);
     rep = MAX(rep, clz64(z_mask));
     rep = MAX(rep, clz64(~o_mask));

From b276b2ca228e8a0b1cd01234827be08fb451a8dd Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Sun, 11 Jan 2026 18:03:01 +1100
Subject: [PATCH 2324/2396] tcg/optimize: Fix a_mask computation for orc

In computing a_mask, for or, we remove the bits from t1->o_mask
which are known to be zero.  For orc, the bits known to be zero
are the inverse of those known to be one.

Cc: qemu-stable@nongnu.org
Fixes: cc4033ee47c ("tcg/optimize: Build and use zero, one and affected bits in fold_orc")
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 08b12bfb8f532dbc62e35c31d081ede1aa12098b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tcg/optimize.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index 1f95da487b..db1d89396b 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -2360,7 +2360,7 @@ static bool fold_orc(OptContext *ctx, TCGOp *op)
     s_mask = t1->s_mask & t2->s_mask;
 
     /* Affected bits are those not known one, masked by those known one. */
-    a_mask = ~t1->o_mask & t2->o_mask;
+    a_mask = ~t1->o_mask & ~t2->o_mask;
 
     return fold_masks_zosa(ctx, op, z_mask, o_mask, s_mask, a_mask);
 }

From a53ba65fff5d4e944b179715adb0d89f35b5b3a6 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 23 Dec 2025 17:37:20 +0100
Subject: [PATCH 2325/2396] tcg/optimize: Do use affected bits

We inadvertently disabled affected bits optimizations on operations
that use fold_masks_zosa.  These happen relatively often in x86 code
for extract/sextract; for example given the following:

   mov %esi, %ebp
   xor $0x1, %ebp

the optimizer is able to simplify the "extract_i64 rbp,tmp0,$0x0,$0x20"
produced by the second instruction to a move.

Cc: qemu-stable@nongnu.org
Fixes: 932522a9ddc ("tcg/optimize: Fold and to extract during optimize")
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251223163720.985578-1-pbonzini@redhat.com>
(cherry picked from commit 23b53ec3a8a279cb5acd5e022b464a4272fe9f8c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tcg/optimize.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tcg/optimize.c b/tcg/optimize.c
index db1d89396b..5ae26e4a10 100644
--- a/tcg/optimize.c
+++ b/tcg/optimize.c
@@ -1103,7 +1103,7 @@ static bool fold_masks_zosa_int(OptContext *ctx, TCGOp *op,
 static bool fold_masks_zosa(OptContext *ctx, TCGOp *op, uint64_t z_mask,
                             uint64_t o_mask, int64_t s_mask, uint64_t a_mask)
 {
-    fold_masks_zosa_int(ctx, op, z_mask, o_mask, s_mask, -1);
+    fold_masks_zosa_int(ctx, op, z_mask, o_mask, s_mask, a_mask);
     return true;
 }
 

From f34c0eb054f3a27c39d6068037a77ebf13d9a18f Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Tue, 6 Jan 2026 06:25:57 +0000
Subject: [PATCH 2326/2396] tcg/riscv: Fix TCG_REG_TMP0 clobber in
 tcg_gen_dup{m,i}

TCG_REG_TMP0 may be used by set_vtype* to load the vtype
parameter, so delay any other use of TCG_REG_TMP0 until
the correct vtype has been installed.

Cc: qemu-stable@nongnu.org
Fixes: d4be6ee1111 ("tcg/riscv: Implement vector mov/dup{m/i}")
Reported-by: Zhijin Zeng <zengzhijin@linux.spacemit.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit af6db3b71310ea63a018d517ba7d79e4e014db62)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tcg/riscv/tcg-target.c.inc | 33 +++++++++++++++++++--------------
 1 file changed, 19 insertions(+), 14 deletions(-)

diff --git a/tcg/riscv/tcg-target.c.inc b/tcg/riscv/tcg-target.c.inc
index 31b9f7d87a..0967a445a3 100644
--- a/tcg/riscv/tcg-target.c.inc
+++ b/tcg/riscv/tcg-target.c.inc
@@ -1074,7 +1074,7 @@ static bool tcg_out_sti(TCGContext *s, TCGType type, TCGArg val,
 }
 
 static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
-                                   TCGReg dst, TCGReg src)
+                            TCGReg dst, TCGReg src)
 {
     set_vtype_len_sew(s, type, vece);
     tcg_out_opc_vx(s, OPC_VMV_V_X, dst, 0, src);
@@ -1082,29 +1082,34 @@ static bool tcg_out_dup_vec(TCGContext *s, TCGType type, unsigned vece,
 }
 
 static bool tcg_out_dupm_vec(TCGContext *s, TCGType type, unsigned vece,
-                                    TCGReg dst, TCGReg base, intptr_t offset)
+                             TCGReg dst, TCGReg base, intptr_t offset)
 {
+    /* Note set_vtype* may clobber TMP0, so do that first. */
+    set_vtype_len_sew(s, type, vece);
     tcg_out_ld(s, TCG_TYPE_REG, TCG_REG_TMP0, base, offset);
-    return tcg_out_dup_vec(s, type, vece, dst, TCG_REG_TMP0);
+    tcg_out_opc_vx(s, OPC_VMV_V_X, dst, 0, TCG_REG_TMP0);
+    return true;
 }
 
 static void tcg_out_dupi_vec(TCGContext *s, TCGType type, unsigned vece,
-                                    TCGReg dst, int64_t arg)
+                             TCGReg dst, int64_t arg)
 {
     /* Arg is replicated by VECE; extract the highest element. */
     arg >>= (-8 << vece) & 63;
 
-    if (arg >= -16 && arg < 16) {
-        if (arg == 0 || arg == -1) {
-            set_vtype_len(s, type);
-        } else {
-            set_vtype_len_sew(s, type, vece);
-        }
-        tcg_out_opc_vi(s, OPC_VMV_V_I, dst, 0, arg);
-        return;
+    /* Note set_vtype* may clobber TMP0, so do that first. */
+    if (arg == 0 || arg == -1) {
+        set_vtype_len(s, type);
+    } else {
+        set_vtype_len_sew(s, type, vece);
+    }
+
+    if (arg >= -16 && arg < 16) {
+        tcg_out_opc_vi(s, OPC_VMV_V_I, dst, 0, arg);
+    } else {
+        tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP0, arg);
+        tcg_out_opc_vx(s, OPC_VMV_V_X, dst, 0, TCG_REG_TMP0);
     }
-    tcg_out_movi(s, TCG_TYPE_I64, TCG_REG_TMP0, arg);
-    tcg_out_dup_vec(s, type, vece, dst, TCG_REG_TMP0);
 }
 
 static void tcg_out_br(TCGContext *s, TCGLabel *l)

From e71e02caa7b89ec0de8caa5aeb6ac11c67726145 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jean-Christian=20C=C3=8ERSTEA?=
 <jean.christian.cirstea@gmail.com>
Date: Mon, 29 Dec 2025 14:14:16 +0200
Subject: [PATCH 2327/2396] linux-user: allow null `pathname` for
 statx()/fstatat()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since Linux 6.11, the path argument may be NULL.

Before this patch, qemu-*-linux-user failed with EFAULT when `pathname` was
specified as NULL, even for Linux kernel hosts > 6.10. This patch fixes this
issue by checking whether `arg2` is 0. If so, don't return EFAULT, but instead
perform the appropiate syscall and let the host's kernel handle null `pathname`.

Cc: qemu-stable@nongnu.org
Signed-off-by: Jean-Christian CÎRSTEA <jean.christian.cirstea@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251229121416.2209295-1-jean.christian.cirstea@gmail.com>
(cherry picked from commit 82ae60c8b5cb98d610056a1e2d0ba72e9ef7907c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 2060e561a2..ee7c34027e 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -12141,9 +12141,13 @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
             int dirfd = arg1;
             int flags = arg3;
 
-            p = lock_user_string(arg2);
-            if (p == NULL) {
-                return -TARGET_EFAULT;
+            p = NULL;
+            /* Since Linux 6.11, the path argument may be NULL */
+            if (arg2 != 0) {
+                p = lock_user_string(arg2);
+                if (p == NULL) {
+                    return -TARGET_EFAULT;
+                }
             }
 #if defined(__NR_statx)
             {

From 86ce6e07739b98137e9401076f54a3e89f6a5fbd Mon Sep 17 00:00:00 2001
From: Jim MacArthur <jim.macarthur@linaro.org>
Date: Tue, 6 Jan 2026 15:40:48 +0000
Subject: [PATCH 2328/2396] linux-user/elfload.c: Correction to HWCAP2 accessor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

get_elf_hwcap was used when get_elf_hwcap2 should have been.

Cc: qemu-stable@nongnu.org
Fixes: fcac98d0ba8b ("linux-user: Remove ELF_HWCAP2")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3259
Signed-off-by: Jim MacArthur <jim.macarthur@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260106-fix-hwcap2-sve2-v1-1-1d70dff63370@linaro.org>
(cherry picked from commit c333f9c4ee212297f3b9a8a6ef62396a63c48e61)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/elfload.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/linux-user/elfload.c b/linux-user/elfload.c
index 0002d5be2f..35471c0c9a 100644
--- a/linux-user/elfload.c
+++ b/linux-user/elfload.c
@@ -708,7 +708,7 @@ static abi_ulong create_elf_tables(abi_ulong p, int argc, int envc,
     NEW_AUX_ENT(AT_EXECFN, info->file_string);
 
     if (HAVE_ELF_HWCAP2) {
-        NEW_AUX_ENT(AT_HWCAP2, get_elf_hwcap(thread_cpu));
+        NEW_AUX_ENT(AT_HWCAP2, get_elf_hwcap2(thread_cpu));
     }
     if (u_base_platform) {
         NEW_AUX_ENT(AT_BASE_PLATFORM, u_base_platform);

From a8adf882fd43c1df51ebaa24d17b1720fae9542e Mon Sep 17 00:00:00 2001
From: Matthew Lugg <mlugg@mlugg.co.uk>
Date: Mon, 17 Nov 2025 17:09:51 +0000
Subject: [PATCH 2329/2396] linux-user: fix mremap unmapping adjacent region

This typo meant that calls to `mremap` which shrink a mapping by some N
bytes would, when the virtual address space was pre-reserved (e.g.
32-bit guest on 64-bit host), unmap the N bytes following the *original*
mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-2-mlugg@mlugg.co.uk>
(cherry picked from commit aaed9ca1797d70a507371aea688c5cd60b074e2d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/mmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 423c77856a..ef3833a2bb 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -1171,7 +1171,8 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
                     errno = ENOMEM;
                     host_addr = MAP_FAILED;
                 } else if (reserved_va && old_size > new_size) {
-                    mmap_reserve_or_unmap(old_addr + old_size,
+                    /* Re-reserve pages we just shrunk out of the mapping */
+                    mmap_reserve_or_unmap(old_addr + new_size,
                                           old_size - new_size);
                 }
             }

From 5ac0811f40976bf4339791a43c02516cc087462a Mon Sep 17 00:00:00 2001
From: Matthew Lugg <mlugg@mlugg.co.uk>
Date: Mon, 17 Nov 2025 17:09:52 +0000
Subject: [PATCH 2330/2396] linux-user: fix mremap errors for invalid ranges

If an address range given to `mremap` is invalid (exceeds addressing
bounds on the guest), we were previously returning `ENOMEM`, which is
not correct. The manpage and the Linux kernel implementation both agree
that if `old_addr`/`old_size` refer to an invalid address, `EFAULT` is
returned, and if `new_addr`/`new_size` refer to an invalid address,
`EINVAL` is returned.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-3-mlugg@mlugg.co.uk>
(cherry picked from commit 2422884ec5a12037d2378f45ca1411d3f37c7081)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/mmap.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index ef3833a2bb..6163f1a0d1 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -1110,12 +1110,15 @@ abi_long target_mremap(abi_ulong old_addr, abi_ulong old_size,
     int prot;
     void *host_addr;
 
-    if (!guest_range_valid_untagged(old_addr, old_size) ||
-        ((flags & MREMAP_FIXED) &&
+    if (((flags & MREMAP_FIXED) &&
          !guest_range_valid_untagged(new_addr, new_size)) ||
         ((flags & MREMAP_MAYMOVE) == 0 &&
          !guest_range_valid_untagged(old_addr, new_size))) {
-        errno = ENOMEM;
+        errno = EINVAL;
+        return -1;
+    }
+    if (!guest_range_valid_untagged(old_addr, old_size)) {
+        errno = EFAULT;
         return -1;
     }
 

From 860f8f3f5348bba50b468f50e4fb9030786d6d70 Mon Sep 17 00:00:00 2001
From: Matthew Lugg <mlugg@mlugg.co.uk>
Date: Mon, 17 Nov 2025 17:09:53 +0000
Subject: [PATCH 2331/2396] linux-user: fix reserved_va page leak in do_munmap

The old logic had an off-by-one bug. For instance, assuming 4k pages on
host and guest, if 'len' is '4097' (indicating to unmap 2 pages), then
'last = start + 4096', so 'real_last = start + 4095', so ultimately
'real_len = 4096'. I do not believe this could cause any observable bugs
in guests, because `target_munmap` page-aligns the length it passes in.
However, calls to this function in `target_mremap` do not page-align the
length, so those calls could "drop" pages, leading to a part of the
reserved region becoming unmapped. At worst, a host allocation could get
mapped into that hole, then clobbered by a new guest mapping.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-4-mlugg@mlugg.co.uk>
(cherry picked from commit 81ceab30492ed251addae8539f7b69a069b0f984)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/mmap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/linux-user/mmap.c b/linux-user/mmap.c
index 6163f1a0d1..4bcfaf7894 100644
--- a/linux-user/mmap.c
+++ b/linux-user/mmap.c
@@ -1029,9 +1029,9 @@ static int mmap_reserve_or_unmap(abi_ulong start, abi_ulong len)
     void *host_start;
     int prot;
 
-    last = start + len - 1;
+    last = ROUND_UP(start + len, TARGET_PAGE_SIZE) - 1;
     real_start = start & -host_page_size;
-    real_last = ROUND_UP(last, host_page_size) - 1;
+    real_last = ROUND_UP(last + 1, host_page_size) - 1;
 
     /*
      * If guest pages remain on the first or last host pages,

From 4cc64bd6c4cc11614b30cd7d3d42f6fe4ed47919 Mon Sep 17 00:00:00 2001
From: Matthew Lugg <mlugg@mlugg.co.uk>
Date: Mon, 17 Nov 2025 17:09:54 +0000
Subject: [PATCH 2332/2396] tests: add tcg coverage for fixed mremap bugs

These tests cover the first two fixes in this patch series. The final
patch is not covered because the bug it fixes is not easily observable
by the guest.

Signed-off-by: Matthew Lugg <mlugg@mlugg.co.uk>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251117170954.31451-5-mlugg@mlugg.co.uk>
(cherry picked from commit 9290c10ae9d0c3ff433efbb7ecb0e781966c5404)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/tcg/multiarch/test-mmap.c | 42 +++++++++++++++++++++++++++++++--
 1 file changed, 40 insertions(+), 2 deletions(-)

diff --git a/tests/tcg/multiarch/test-mmap.c b/tests/tcg/multiarch/test-mmap.c
index 96257f8ebe..e297f4b1e9 100644
--- a/tests/tcg/multiarch/test-mmap.c
+++ b/tests/tcg/multiarch/test-mmap.c
@@ -22,6 +22,7 @@
  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  */
 
+#define _GNU_SOURCE
 #include <stdio.h>
 #include <stdlib.h>
 #include <stdint.h>
@@ -41,7 +42,7 @@ do                                                             \
   }                                                            \
 } while (0)
 
-unsigned char *dummybuf;
+unsigned char *dummybuf; /* length is 2*pagesize */
 static unsigned int pagesize;
 static unsigned int pagemask;
 int test_fd;
@@ -451,9 +452,45 @@ void check_invalid_mmaps(void)
     fail_unless(addr == MAP_FAILED);
     fail_unless(errno == ENOMEM);
 
+    /* Attempt to remap a region which exceeds the bounds of memory. */
+    addr = mremap((void *)((uintptr_t)pagesize * 10), SIZE_MAX & ~(size_t)pagemask, pagesize, 0);
+    fprintf(stdout, "%s mremap addr=%p", __func__, (void *)addr);
+    fail_unless(addr == MAP_FAILED);
+    fail_unless(errno == EFAULT);
+
     fprintf(stdout, " passed\n");
 }
 
+void check_shrink_mmaps(void)
+{
+    unsigned char *a, *b, *c;
+    a = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    b = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+    c = mmap(NULL, pagesize * 2, PROT_READ, MAP_PRIVATE | MAP_ANONYMOUS, -1, 0);
+
+    fail_unless(a != MAP_FAILED);
+    fail_unless(b != MAP_FAILED);
+    fail_unless(c != MAP_FAILED);
+
+    /* Ensure we can read the full mappings */
+    memcpy(dummybuf, a, 2 * pagesize);
+    memcpy(dummybuf, b, 2 * pagesize);
+    memcpy(dummybuf, c, 2 * pagesize);
+
+    /* Shrink the middle mapping in-place; the others should be unaffected */
+    b = mremap(b, pagesize * 2, pagesize, 0);
+    fail_unless(b != MAP_FAILED);
+
+    /* Ensure we can still access all valid mappings */
+    memcpy(dummybuf, a, 2 * pagesize);
+    memcpy(dummybuf, b, pagesize);
+    memcpy(dummybuf, c, 2 * pagesize);
+
+    munmap(a, 2 * pagesize);
+    munmap(b, pagesize);
+    munmap(c, 2 * pagesize);
+}
+
 int main(int argc, char **argv)
 {
 	char tempname[] = "/tmp/.cmmapXXXXXX";
@@ -468,7 +505,7 @@ int main(int argc, char **argv)
 
 	/* Assume pagesize is a power of two.  */
 	pagemask = pagesize - 1;
-	dummybuf = malloc (pagesize);
+	dummybuf = malloc (pagesize * 2);
 	printf ("pagesize=%u pagemask=%x\n", pagesize, pagemask);
 
 	test_fd = mkstemp(tempname);
@@ -496,6 +533,7 @@ int main(int argc, char **argv)
 	check_file_fixed_eof_mmaps();
 	check_file_unfixed_eof_mmaps();
 	check_invalid_mmaps();
+    check_shrink_mmaps();
 
 	/* Fails at the moment.  */
 	/* check_aligned_anonymous_fixed_mmaps_collide_with_host(); */

From 639ffcbd640e0c08bd4fef548cd6f1834c053ff5 Mon Sep 17 00:00:00 2001
From: Fabiano Rosas <farosas@suse.de>
Date: Fri, 9 Jan 2026 09:35:18 -0300
Subject: [PATCH 2333/2396] target/ppc: Fix env->quiesced migration

The commit referenced (from QEMU 10.0) has changed the way the pseries
machine marks a cpu as quiesced. Previously, the cpu->halted value
from QEMU common cpu code was (incorrectly) used. With the fix, the
env->quiesced variable starts being used, which improves on the
original situation, but also causes a side effect after migration:

The env->quiesced is set at reset and never migrated, which causes the
destination QEMU to stop delivering interrupts and hang the machine.

To fix the issue from this point on, start migrating the env->quiesced
value.

For QEMU versions < 10.0, sending the new element on the stream would
cause migration to be aborted, so add the appropriate compatibility
property to omit the new subsection.

Independently of this patch, all migrations from QEMU versions < 10.0
would result in a hang since the older QEMU never migrates
env->quiesced. This is bad because it leaves machines already running
on the old QEMU without a migration path into newer versions.

As a workaround, use a few heuristics to infer the new value of
env->quiesced based on cpu->halted, LPCR and PSSCR bits that are
usually set/cleared along with quiesced.

Note that this was tested with -cpu power9 and -machine ic-mode=xive
due to another bug affecting migration of XICS guests. Tested both
forward and backward migration and savevm/loadvm from 9.2 and 10.0.

Also tested loadvm of a savevm image that contains a mix of cpus both
halted and not halted.

Reported-by: Fabian Vogt <fvogt@suse.de>
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3079
Fixes: fb802acdc8b ("ppc/spapr: Fix RTAS stopped state")
Acked-by: Chinmay Rath <rathc@linux.ibm.com>
Reviewed-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Link: https://lore.kernel.org/qemu-devel/20260109123519.28703-2-farosas@suse.de
Signed-off-by: Harsh Prateek Bora <harshpb@linux.ibm.com>
(cherry picked from commit 628bda1ab7596a7cceb1c5356d23a92001c7a8c5)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ppc/spapr.c        |  6 +++++
 target/ppc/cpu.h      |  1 +
 target/ppc/cpu_init.c |  7 +++++
 target/ppc/machine.c  | 62 +++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 76 insertions(+)

diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index 99b843ba2f..9dde61a667 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -4776,8 +4776,14 @@ DEFINE_SPAPR_MACHINE(10, 1);
  */
 static void spapr_machine_10_0_class_options(MachineClass *mc)
 {
+    static GlobalProperty spapr_compat_10_0[] = {
+        { TYPE_POWERPC_CPU, "rtas-stopped-state", "false" },
+    };
+
     spapr_machine_10_1_class_options(mc);
     compat_props_add(mc->compat_props, hw_compat_10_0, hw_compat_10_0_len);
+    compat_props_add(mc->compat_props, spapr_compat_10_0,
+                     G_N_ELEMENTS(spapr_compat_10_0));
 }
 
 DEFINE_SPAPR_MACHINE(10, 0);
diff --git a/target/ppc/cpu.h b/target/ppc/cpu.h
index 787020f6f9..bbd661e96c 100644
--- a/target/ppc/cpu.h
+++ b/target/ppc/cpu.h
@@ -1529,6 +1529,7 @@ struct ArchCPU {
     void *machine_data;
     int32_t node_id; /* NUMA node this CPU belongs to */
     PPCHash64Options *hash64_opts;
+    bool rtas_stopped_state;
 
     /* Those resources are used only during code translation */
     /* opcode handlers */
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index 86ead740ee..8dac1cd812 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -55,6 +55,11 @@
 /* #define PPC_DEBUG_SPR */
 /* #define USE_APPLE_GDB */
 
+static const Property powerpc_cpu_properties[] = {
+    DEFINE_PROP_BOOL("rtas-stopped-state", PowerPCCPU,
+                      rtas_stopped_state, true),
+};
+
 static inline void vscr_init(CPUPPCState *env, uint32_t val)
 {
     /* Altivec always uses round-to-nearest */
@@ -7529,6 +7534,8 @@ static void ppc_cpu_class_init(ObjectClass *oc, const void *data)
                                       &pcc->parent_unrealize);
     pcc->pvr_match = ppc_pvr_match_default;
 
+    device_class_set_props(dc, powerpc_cpu_properties);
+
     resettable_class_set_parent_phases(rc, NULL, ppc_cpu_reset_hold, NULL,
                                        &pcc->parent_phases);
 
diff --git a/target/ppc/machine.c b/target/ppc/machine.c
index d72e5ecb94..49cfdc6d67 100644
--- a/target/ppc/machine.c
+++ b/target/ppc/machine.c
@@ -257,6 +257,45 @@ static int cpu_post_load(void *opaque, int version_id)
         ppc_store_sdr1(env, env->spr[SPR_SDR1]);
     }
 
+    if (!cpu->rtas_stopped_state) {
+        /*
+         * The source QEMU doesn't have fb802acdc8 and still uses halt +
+         * PM bits in LPCR to implement RTAS stopped state. The new (this)
+         * QEMU will have put the secondary vcpus in stopped state,
+         * waiting for the start-cpu RTAS call. That call will never come
+         * if the source cpus were already running. Try to infer the cpus
+         * state and set env->quiesced accordingly.
+         *
+         * env->quiesced = true  ==> the cpu is waiting to start
+         * env->quiesced = false ==> the cpu is running (unless halted)
+         */
+
+        /*
+         * Halted _could_ mean quiesced, but it could also be cede,
+         * confer_self, power management, etc.
+         */
+        if (CPU(cpu)->halted) {
+            PowerPCCPUClass *pcc = POWERPC_CPU_GET_CLASS(cpu);
+            /*
+             * Both the PSSCR_EC bit and LPCR PM bits set at cpu reset
+             * and rtas_stop and cleared at rtas_start, it's a good
+             * heuristic.
+             */
+            if ((env->spr[SPR_PSSCR] & PSSCR_EC) &&
+                (env->spr[SPR_LPCR] & pcc->lpcr_pm)) {
+                env->quiesced = true;
+            } else {
+                env->quiesced = false;
+            }
+        } else {
+            /*
+             * Old QEMU sets halted during rtas_stop_self. Not halted,
+             * therefore definitely not quiesced.
+             */
+            env->quiesced = false;
+        }
+    }
+
     post_load_update_msr(env);
 
     if (tcg_enabled()) {
@@ -649,6 +688,28 @@ static const VMStateDescription vmstate_reservation = {
     }
 };
 
+static bool rtas_stopped_needed(void *opaque)
+{
+    PowerPCCPU *cpu = opaque;
+
+    return cpu->rtas_stopped_state;
+}
+
+static const VMStateDescription vmstate_rtas_stopped = {
+    .name = "cpu/rtas_stopped",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = rtas_stopped_needed,
+    .fields = (const VMStateField[]) {
+        /*
+         * "RTAS stopped" state, independent of halted state. For QEMU
+         * < 10.0, this is taken from cpu->halted at cpu_post_load()
+         */
+        VMSTATE_BOOL(env.quiesced, PowerPCCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 #ifdef TARGET_PPC64
 static bool bhrb_needed(void *opaque)
 {
@@ -715,6 +776,7 @@ const VMStateDescription vmstate_ppc_cpu = {
         &vmstate_tlbmas,
         &vmstate_compat,
         &vmstate_reservation,
+        &vmstate_rtas_stopped,
         NULL
     }
 };

From 920634e4117864f712bdcf7ca0877a6b1fdc5064 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 12 Jan 2026 17:07:36 +0100
Subject: [PATCH 2334/2396] configs: use default prefix for Windows compilation

The update to Python 3.13 causes meson configuration to fail, see e.g.:

   https://gitlab.com/qemu-project/qemu/-/jobs/12672816538#L397

   meson.build:1:0: ERROR: prefix value '/qemu' must be an absolute path

This is https://github.com/mesonbuild/meson/issues/14303.  Remove the
prefix='/qemu' line in configs/meson/windows.txt, since commit d17f305a264
("configure: use a platform-neutral prefix", 2020-09-30) says that the
NSIS installer doesn't care.

Cc: qemu-stable@nongnu.org
Cc: Thomas Huth <thuth@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260112160736.1028280-1-pbonzini@redhat.com>
(cherry picked from commit 894c8bd56ff1d25127efa4ba9ee8cf4dd0670b1a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 configs/meson/windows.txt | 1 -
 1 file changed, 1 deletion(-)

diff --git a/configs/meson/windows.txt b/configs/meson/windows.txt
index 55b192e71b..9ef0fb3c8f 100644
--- a/configs/meson/windows.txt
+++ b/configs/meson/windows.txt
@@ -3,7 +3,6 @@
 
 [built-in options]
 bindir = ''
-prefix = '/qemu'
 
 [project options]
 qemu_suffix = ''

From 359076c8a0120714aa41213267a7a42894676392 Mon Sep 17 00:00:00 2001
From: Laurent Vivier <laurent@vivier.eu>
Date: Fri, 26 Dec 2025 22:37:07 +0100
Subject: [PATCH 2335/2396] m68k: fix CAS2 writeback when Dc1==Dc2

According to Programmer's Reference Manual, if Dc1 and Dc2 specify the
same data register and the comparison fails, memory operand 1 is stored
in the data register.

The current helpers wrote Dc1 then Dc2, leaving operand 2 in the shared
register.

Swap the writeback order for cas2w/cas2l so memory operand 1 wins.

Signed-off-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20251226213707.331741-1-laurent@vivier.eu>
(cherry picked from commit 11dac41f2e830bcd7ba74969dc50f5740e3ce7e7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/m68k/op_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/m68k/op_helper.c b/target/m68k/op_helper.c
index e9c20a8e03..10266b1e0e 100644
--- a/target/m68k/op_helper.c
+++ b/target/m68k/op_helper.c
@@ -799,8 +799,8 @@ void HELPER(cas2w)(CPUM68KState *env, uint32_t regs, uint32_t a1, uint32_t a2)
         env->cc_v = c2;
     }
     env->cc_op = CC_OP_CMPW;
-    env->dregs[Dc1] = deposit32(env->dregs[Dc1], 0, 16, l1);
     env->dregs[Dc2] = deposit32(env->dregs[Dc2], 0, 16, l2);
+    env->dregs[Dc1] = deposit32(env->dregs[Dc1], 0, 16, l1);
 }
 
 static void do_cas2l(CPUM68KState *env, uint32_t regs, uint32_t a1, uint32_t a2,
@@ -861,8 +861,8 @@ static void do_cas2l(CPUM68KState *env, uint32_t regs, uint32_t a1, uint32_t a2,
         env->cc_v = c2;
     }
     env->cc_op = CC_OP_CMPL;
-    env->dregs[Dc1] = l1;
     env->dregs[Dc2] = l2;
+    env->dregs[Dc1] = l1;
 }
 
 void HELPER(cas2l)(CPUM68KState *env, uint32_t regs, uint32_t a1, uint32_t a2)

From 51bc24d4273b5b68ae3e254588f108df8afd1cd1 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Tue, 23 Dec 2025 15:12:38 +0100
Subject: [PATCH 2336/2396] target/i386/tcg: do not mark all SSE instructions
 as unaligned

If the vex_special field was not initialized, it was considered to be
X86_VEX_SSEUnaligned (whose value was zero).  Add a new value to
fix that.

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 73dd6e4a36dd8d85548292f382a4d479e2810371)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/tcg/decode-new.c.inc | 11 +++++++----
 target/i386/tcg/decode-new.h     |  2 ++
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index dfaffec599..31aad730fc 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -944,15 +944,15 @@ static void decode_0F10(DisasContext *s, CPUX86State *env, X86OpEntry *entry, ui
 static void decode_0F11(DisasContext *s, CPUX86State *env, X86OpEntry *entry, uint8_t *b)
 {
     static const X86OpEntry opcodes_0F11_reg[4] = {
-        X86_OP_ENTRY3(MOVDQ,   W,x,  None,None, V,x, vex4), /* MOVUPS */
-        X86_OP_ENTRY3(MOVDQ,   W,x,  None,None, V,x, vex4), /* MOVUPD */
+        X86_OP_ENTRY3(MOVDQ,   W,x,  None,None, V,x, vex4_unal), /* MOVUPS */
+        X86_OP_ENTRY3(MOVDQ,   W,x,  None,None, V,x, vex4_unal), /* MOVUPD */
         X86_OP_ENTRY3(VMOVSS,  W,x,  H,x,       V,x, vex5),
         X86_OP_ENTRY3(VMOVLPx, W,x,  H,x,       V,q, vex5), /* MOVSD */
     };
 
     static const X86OpEntry opcodes_0F11_mem[4] = {
-        X86_OP_ENTRY3(MOVDQ,      W,x,  None,None, V,x, vex4), /* MOVUPS */
-        X86_OP_ENTRY3(MOVDQ,      W,x,  None,None, V,x, vex4), /* MOVUPD */
+        X86_OP_ENTRY3(MOVDQ,      W,x,  None,None, V,x, vex4_unal), /* MOVUPS */
+        X86_OP_ENTRY3(MOVDQ,      W,x,  None,None, V,x, vex4_unal), /* MOVUPD */
         X86_OP_ENTRY3(VMOVSS_st,  M,ss, None,None, V,x, vex5),
         X86_OP_ENTRY3(VMOVLPx_st, M,sd, None,None, V,x, vex5), /* MOVSD */
     };
@@ -2382,6 +2382,9 @@ static bool validate_vex(DisasContext *s, X86DecodedInsn *decode)
     X86OpEntry *e = &decode->e;
 
     switch (e->vex_special) {
+    case X86_VEX_None:
+        break;
+
     case X86_VEX_REPScalar:
         /*
          * Instructions which differ between 00/66 and F2/F3 in the
diff --git a/target/i386/tcg/decode-new.h b/target/i386/tcg/decode-new.h
index 7f23d373ea..9282296900 100644
--- a/target/i386/tcg/decode-new.h
+++ b/target/i386/tcg/decode-new.h
@@ -242,6 +242,8 @@ typedef enum X86InsnSpecial {
  * section of the manual.
  */
 typedef enum X86VEXSpecial {
+    X86_VEX_None,
+
     /* Legacy SSE instructions that allow unaligned operands */
     X86_VEX_SSEUnaligned,
 

From 6594e50e7e8518eb247bbcf96dc7a6557f28dd35 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 12 Dec 2025 18:05:48 +0100
Subject: [PATCH 2337/2396] target/i386/tcg: mask addresses for VSIB

VSIB can have either 32-bit or 64-bit addresses, pass a constant mask to
the helper and apply it before the load.

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 5e3572ef2e94608568b1a73eab9d382b250936eb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/ops_sse.h                | 16 ++++++++--------
 target/i386/tcg/emit.c.inc           | 17 +++++++++--------
 target/i386/tcg/ops_sse_header.h.inc |  8 ++++----
 3 files changed, 21 insertions(+), 20 deletions(-)

diff --git a/target/i386/ops_sse.h b/target/i386/ops_sse.h
index a2e4d48039..853196b2bb 100644
--- a/target/i386/ops_sse.h
+++ b/target/i386/ops_sse.h
@@ -2362,42 +2362,42 @@ void glue(helper_vpmaskmovq, SUFFIX)(CPUX86State *env, Reg *d, Reg *v, Reg *s)
 }
 
 void glue(helper_vpgatherdd, SUFFIX)(CPUX86State *env,
-        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale)
+        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale, target_ulong amask)
 {
     int i;
     for (i = 0; i < (2 << SHIFT); i++) {
         if (v->L(i) >> 31) {
             target_ulong addr = a0
                 + ((target_ulong)(int32_t)s->L(i) << scale);
-            d->L(i) = cpu_ldl_data_ra(env, addr, GETPC());
+            d->L(i) = cpu_ldl_data_ra(env, addr & amask, GETPC());
         }
         v->L(i) = 0;
     }
 }
 
 void glue(helper_vpgatherdq, SUFFIX)(CPUX86State *env,
-        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale)
+        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale, target_ulong amask)
 {
     int i;
     for (i = 0; i < (1 << SHIFT); i++) {
         if (v->Q(i) >> 63) {
             target_ulong addr = a0
                 + ((target_ulong)(int32_t)s->L(i) << scale);
-            d->Q(i) = cpu_ldq_data_ra(env, addr, GETPC());
+            d->Q(i) = cpu_ldq_data_ra(env, addr & amask, GETPC());
         }
         v->Q(i) = 0;
     }
 }
 
 void glue(helper_vpgatherqd, SUFFIX)(CPUX86State *env,
-        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale)
+        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale, target_ulong amask)
 {
     int i;
     for (i = 0; i < (1 << SHIFT); i++) {
         if (v->L(i) >> 31) {
             target_ulong addr = a0
                 + ((target_ulong)(int64_t)s->Q(i) << scale);
-            d->L(i) = cpu_ldl_data_ra(env, addr, GETPC());
+            d->L(i) = cpu_ldl_data_ra(env, addr & amask, GETPC());
         }
         v->L(i) = 0;
     }
@@ -2408,14 +2408,14 @@ void glue(helper_vpgatherqd, SUFFIX)(CPUX86State *env,
 }
 
 void glue(helper_vpgatherqq, SUFFIX)(CPUX86State *env,
-        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale)
+        Reg *d, Reg *v, Reg *s, target_ulong a0, unsigned scale, target_ulong amask)
 {
     int i;
     for (i = 0; i < (1 << SHIFT); i++) {
         if (v->Q(i) >> 63) {
             target_ulong addr = a0
                 + ((target_ulong)(int64_t)s->Q(i) << scale);
-            d->Q(i) = cpu_ldq_data_ra(env, addr, GETPC());
+            d->Q(i) = cpu_ldq_data_ra(env, addr & amask, GETPC());
         }
         v->Q(i) = 0;
     }
diff --git a/target/i386/tcg/emit.c.inc b/target/i386/tcg/emit.c.inc
index 1a7fab9333..12e7f5f943 100644
--- a/target/i386/tcg/emit.c.inc
+++ b/target/i386/tcg/emit.c.inc
@@ -43,8 +43,8 @@ typedef void (*SSEFunc_0_pppi)(TCGv_ptr reg_a, TCGv_ptr reg_b, TCGv_ptr reg_c,
                                TCGv_i32 val);
 typedef void (*SSEFunc_0_eppt)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
                                TCGv val);
-typedef void (*SSEFunc_0_epppti)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
-                                 TCGv_ptr reg_c, TCGv a0, TCGv_i32 scale);
+typedef void (*SSEFunc_0_eppptit)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
+                                 TCGv_ptr reg_c, TCGv a0, TCGv_i32 scale, TCGv amask);
 typedef void (*SSEFunc_0_eppppi)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
                                   TCGv_ptr reg_c, TCGv_ptr reg_d, TCGv_i32 flags);
 typedef void (*SSEFunc_0_eppppii)(TCGv_ptr env, TCGv_ptr reg_a, TCGv_ptr reg_b,
@@ -1098,18 +1098,19 @@ VEXW_AVX(VPMASKMOV, vpmaskmov)
 
 /* Same as above, but with extra arguments to the helper.  */
 static inline void gen_vsib_avx(DisasContext *s, X86DecodedInsn *decode,
-                                SSEFunc_0_epppti d_xmm, SSEFunc_0_epppti q_xmm,
-                                SSEFunc_0_epppti d_ymm, SSEFunc_0_epppti q_ymm)
+                                SSEFunc_0_eppptit d_xmm, SSEFunc_0_eppptit q_xmm,
+                                SSEFunc_0_eppptit d_ymm, SSEFunc_0_eppptit q_ymm)
 {
-    SSEFunc_0_epppti d = s->vex_l ? d_ymm : d_xmm;
-    SSEFunc_0_epppti q = s->vex_l ? q_ymm : q_xmm;
-    SSEFunc_0_epppti fn = s->vex_w ? q : d;
+    SSEFunc_0_eppptit d = s->vex_l ? d_ymm : d_xmm;
+    SSEFunc_0_eppptit q = s->vex_l ? q_ymm : q_xmm;
+    SSEFunc_0_eppptit fn = s->vex_w ? q : d;
     TCGv_i32 scale = tcg_constant_i32(decode->mem.scale);
     TCGv_ptr index = tcg_temp_new_ptr();
+    TCGv mask = tcg_constant_tl(MAKE_64BIT_MASK(0, 8 << s->aflag));
 
     /* Pass third input as (index, base, scale) */
     tcg_gen_addi_ptr(index, tcg_env, ZMM_OFFSET(decode->mem.index));
-    fn(tcg_env, OP_PTR0, OP_PTR1, index, s->A0, scale);
+    fn(tcg_env, OP_PTR0, OP_PTR1, index, s->A0, scale, mask);
 
     /*
      * There are two output operands, so zero OP1's high 128 bits
diff --git a/target/i386/tcg/ops_sse_header.h.inc b/target/i386/tcg/ops_sse_header.h.inc
index d92c6faf6d..bbeb7301c3 100644
--- a/target/i386/tcg/ops_sse_header.h.inc
+++ b/target/i386/tcg/ops_sse_header.h.inc
@@ -388,10 +388,10 @@ DEF_HELPER_4(glue(vpmaskmovd_st, SUFFIX), void, env, Reg, Reg, tl)
 DEF_HELPER_4(glue(vpmaskmovq_st, SUFFIX), void, env, Reg, Reg, tl)
 DEF_HELPER_4(glue(vpmaskmovd, SUFFIX), void, env, Reg, Reg, Reg)
 DEF_HELPER_4(glue(vpmaskmovq, SUFFIX), void, env, Reg, Reg, Reg)
-DEF_HELPER_6(glue(vpgatherdd, SUFFIX), void, env, Reg, Reg, Reg, tl, i32)
-DEF_HELPER_6(glue(vpgatherdq, SUFFIX), void, env, Reg, Reg, Reg, tl, i32)
-DEF_HELPER_6(glue(vpgatherqd, SUFFIX), void, env, Reg, Reg, Reg, tl, i32)
-DEF_HELPER_6(glue(vpgatherqq, SUFFIX), void, env, Reg, Reg, Reg, tl, i32)
+DEF_HELPER_7(glue(vpgatherdd, SUFFIX), void, env, Reg, Reg, Reg, tl, i32, tl)
+DEF_HELPER_7(glue(vpgatherdq, SUFFIX), void, env, Reg, Reg, Reg, tl, i32, tl)
+DEF_HELPER_7(glue(vpgatherqd, SUFFIX), void, env, Reg, Reg, Reg, tl, i32, tl)
+DEF_HELPER_7(glue(vpgatherqq, SUFFIX), void, env, Reg, Reg, Reg, tl, i32, tl)
 #if SHIFT == 2
 DEF_HELPER_3(vpermd_ymm, void, Reg, Reg, Reg)
 DEF_HELPER_4(vpermdq_ymm, void, Reg, Reg, Reg, i32)

From 11e286fb93049db0d92d8c411ce046ee3f67ff18 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Fri, 12 Dec 2025 18:06:45 +0100
Subject: [PATCH 2338/2396] target/i386/tcg: allow VEX in 16-bit protected mode

VEX is only forbidden in real and vm86 mode; 16-bit protected mode supports
it for some unfathomable reason.

Cc: qemu-stable@nongnu.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit ed88bdcfbdcf9d411607cd690f93f915feff6a5b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/tcg/decode-new.c.inc | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 31aad730fc..24dcf222f3 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -2613,20 +2613,16 @@ static void disas_insn(DisasContext *s, CPUState *cpu)
     case 0xc5: /* 2-byte VEX */
     case 0xc4: /* 3-byte VEX */
         /*
-         * VEX prefixes cannot be used except in 32-bit mode.
-         * Otherwise the instruction is LES or LDS.
+         * Bits 6-7 of the first byte must be set except in 64-bit mode.
+         * Otherwise the instruction is LES or LDS.  Not allowed in real mode.
          */
-        if (CODE32(s) && !VM86(s)) {
+        if (PE(s) && !VM86(s)) {
             static const int pp_prefix[4] = {
                 0, PREFIX_DATA, PREFIX_REPZ, PREFIX_REPNZ
             };
             int vex3, vex2 = x86_ldub_code(env, s);
 
             if (!CODE64(s) && (vex2 & 0xc0) != 0xc0) {
-                /*
-                 * 4.1.4.6: In 32-bit mode, bits [7:6] must be 11b,
-                 * otherwise the instruction is LES or LDS.
-                 */
                 s->pc--; /* rewind the advance_pc() x86_ldub_code() did */
                 break;
             }

From 058e1774d678031ec207441a51efcf8ae94cc6af Mon Sep 17 00:00:00 2001
From: Vulnerability Report <vr@darknavy.com>
Date: Fri, 9 Jan 2026 10:35:48 +0800
Subject: [PATCH 2339/2396] hw/i386/kvm: fix PIRQ bounds check in
 xen_physdev_map_pirq()

Reject pirq == s->nr_pirqs in xen_physdev_map_pirq().

Fixes: aa98ee38a5 ("hw/xen: Implement emulated PIRQ hypercall support")
Fixes: CVE-2026-0665
Reported-by: DARKNAVY (@DarkNavyOrg) <vr@darknavy.com>
Reviewed-by: David Woodhouse <dwmw@amazon.co.uk>
Signed-off-by: Vulnerability Report <vr@darknavy.com>
Link: https://lore.kernel.org/r/13FE03BE60EA78D6+20260109023548.4047-1-vr@darknavy.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit c7504ba2a560fd884557f6e5142f03b491aad0c7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i386/kvm/xen_evtchn.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/kvm/xen_evtchn.c b/hw/i386/kvm/xen_evtchn.c
index dd566c4967..173e0818c7 100644
--- a/hw/i386/kvm/xen_evtchn.c
+++ b/hw/i386/kvm/xen_evtchn.c
@@ -1877,7 +1877,7 @@ int xen_physdev_map_pirq(struct physdev_map_pirq *map)
             return pirq;
         }
         map->pirq = pirq;
-    } else if (pirq > s->nr_pirqs) {
+    } else if (pirq >= s->nr_pirqs) {
         return -EINVAL;
     } else {
         /*

From e12259821c2872d7b7c64043328d70c81158007d Mon Sep 17 00:00:00 2001
From: Xianglai Li <lixianglai@loongson.cn>
Date: Wed, 14 Jan 2026 15:20:15 +0800
Subject: [PATCH 2340/2396] hw/loongarch/virt: Modify the interrupt trigger
 type in fdt table

In the loongarch virt fdt file, the interrupt trigger type directly
uses magic numbers. Now, refer to the definitions in the linux kernel and
use macro definitions.

Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit 47de28a0b7fb96531271aaeaa3e7f2cad2b91221)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/loongarch/virt-fdt-build.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/loongarch/virt-fdt-build.c b/hw/loongarch/virt-fdt-build.c
index 1f0ba01f71..7333019cf7 100644
--- a/hw/loongarch/virt-fdt-build.c
+++ b/hw/loongarch/virt-fdt-build.c
@@ -16,6 +16,11 @@
 #include "system/reset.h"
 #include "target/loongarch/cpu.h"
 
+#define FDT_IRQ_TYPE_EDGE_RISING  1
+#define FDT_IRQ_TYPE_EDGE_FALLING 2
+#define FDT_IRQ_TYPE_LEVEL_HIGH   4
+#define FDT_IRQ_TYPE_LEVEL_LOW    8
+
 static void create_fdt(LoongArchVirtMachineState *lvms)
 {
     MachineState *ms = MACHINE(lvms);
@@ -415,7 +420,8 @@ static void fdt_add_uart_node(LoongArchVirtMachineState *lvms,
     if (chosen) {
         qemu_fdt_setprop_string(ms->fdt, "/chosen", "stdout-path", nodename);
     }
-    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq, 0x4);
+    qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts", irq,
+                           FDT_IRQ_TYPE_LEVEL_HIGH);
     qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
                           *pch_pic_phandle);
     g_free(nodename);
@@ -435,7 +441,8 @@ static void fdt_add_rtc_node(LoongArchVirtMachineState *lvms,
                             "loongson,ls7a-rtc");
     qemu_fdt_setprop_sized_cells(ms->fdt, nodename, "reg", 2, base, 2, size);
     qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupts",
-                           VIRT_RTC_IRQ - VIRT_GSI_BASE , 0x4);
+                           VIRT_RTC_IRQ - VIRT_GSI_BASE ,
+                           FDT_IRQ_TYPE_LEVEL_HIGH);
     qemu_fdt_setprop_cell(ms->fdt, nodename, "interrupt-parent",
                           *pch_pic_phandle);
     g_free(nodename);

From 21af0baf9aab2e1362bb1d03a94a6911b980866f Mon Sep 17 00:00:00 2001
From: Xianglai Li <lixianglai@loongson.cn>
Date: Wed, 14 Jan 2026 15:22:00 +0800
Subject: [PATCH 2341/2396] hw/loongarch/virt: Fix irq allocation failure with
 pci device from fdt

When we use the -kernel parameter to start an elf format kernel relying on
fdt, we get the following error:

pcieport 0000:00:01.0: of_irq_parse_pci: failed with rc=-22
pcieport 0000:00:01.0: enabling device (0000 -> 0003)
pcieport 0000:00:01.0: PME: Signaling with IRQ 19
pcieport 0000:00:01.0: AER: enabled with IRQ 19
pcieport 0000:00:01.1: of_irq_parse_pci: failed with rc=-22
pcieport 0000:00:01.1: enabling device (0000 -> 0003)
pcieport 0000:00:01.1: PME: Signaling with IRQ 20
pcieport 0000:00:01.1: AER: enabled with IRQ 20
pcieport 0000:00:01.2: of_irq_parse_pci: failed with rc=-22
pcieport 0000:00:01.2: enabling device (0000 -> 0003)
pcieport 0000:00:01.2: PME: Signaling with IRQ 21
pcieport 0000:00:01.2: AER: enabled with IRQ 21
pcieport 0000:00:01.3: of_irq_parse_pci: failed with rc=-22
pcieport 0000:00:01.3: enabling device (0000 -> 0003)
pcieport 0000:00:01.3: PME: Signaling with IRQ 22
pcieport 0000:00:01.3: AER: enabled with IRQ 22
pcieport 0000:00:01.4: of_irq_parse_pci: failed with rc=-22

This is because  the description of interrupt-cell is missing in the pcie
irq map.  And there is a lack of a description of the interrupt trigger
type.  Now it is corrected and the correct interrupt-cell is added in the
pcie irq map.

Refer to the implementation in arm and add some comments.

Signed-off-by: Xianglai Li <lixianglai@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit ff54394eed148c642f83b45753c7898acdbd5ddb)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/loongarch/virt-fdt-build.c | 44 ++++++++++++++++++++++-------------
 1 file changed, 28 insertions(+), 16 deletions(-)

diff --git a/hw/loongarch/virt-fdt-build.c b/hw/loongarch/virt-fdt-build.c
index 7333019cf7..e597b19dc3 100644
--- a/hw/loongarch/virt-fdt-build.c
+++ b/hw/loongarch/virt-fdt-build.c
@@ -321,6 +321,8 @@ static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
     uint32_t full_irq_map[PCI_NUM_PINS * PCI_NUM_PINS * 10] = {};
     uint32_t *irq_map = full_irq_map;
     const MachineState *ms = MACHINE(lvms);
+    uint32_t pin_mask;
+    uint32_t devfn_mask;
 
     /*
      * This code creates a standard swizzle of interrupts such that
@@ -333,37 +335,45 @@ static void fdt_add_pcie_irq_map_node(const LoongArchVirtMachineState *lvms,
      */
 
     for (dev = 0; dev < PCI_NUM_PINS; dev++) {
-        int devfn = dev * 0x8;
+        int devfn = PCI_DEVFN(dev, 0);
 
         for (pin = 0; pin < PCI_NUM_PINS; pin++) {
-            int irq_nr = 16 + ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
+            int irq_nr = VIRT_DEVICE_IRQS + \
+                         ((pin + PCI_SLOT(devfn)) % PCI_NUM_PINS);
             int i = 0;
 
-            /* Fill PCI address cells */
-            irq_map[i] = cpu_to_be32(devfn << 8);
-            i += 3;
-
-            /* Fill PCI Interrupt cells */
-            irq_map[i] = cpu_to_be32(pin + 1);
-            i += 1;
-
-            /* Fill interrupt controller phandle and cells */
-            irq_map[i++] = cpu_to_be32(*pch_pic_phandle);
-            irq_map[i++] = cpu_to_be32(irq_nr);
+            uint32_t map[] = {
+                devfn << 8, 0, 0,             /* devfn */
+                pin + 1,                      /* PCI pin */
+                *pch_pic_phandle,             /* interrupt controller handle */
+                irq_nr,                       /* irq number */
+                FDT_IRQ_TYPE_LEVEL_HIGH };    /* irq trigger level */
 
             if (!irq_map_stride) {
-                irq_map_stride = i;
+                irq_map_stride = sizeof(map) / sizeof(uint32_t);
             }
+
+            /* Convert map to big endian */
+            for (i = 0; i < irq_map_stride; i++) {
+                irq_map[i] = cpu_to_be32(map[i]);
+            }
+
             irq_map += irq_map_stride;
         }
     }
 
-
     qemu_fdt_setprop(ms->fdt, nodename, "interrupt-map", full_irq_map,
                      PCI_NUM_PINS * PCI_NUM_PINS *
                      irq_map_stride * sizeof(uint32_t));
+
+    /* Only need to match the pci slot bit */
+    devfn_mask = PCI_DEVFN((PCI_NUM_PINS - 1), 0) << 8;
+    /* The pci interrupt only needs to match the specified low bit */
+    pin_mask = (1 << ((PCI_NUM_PINS - 1))) - 1;
+
     qemu_fdt_setprop_cells(ms->fdt, nodename, "interrupt-map-mask",
-                     0x1800, 0, 0, 0x7);
+                           devfn_mask, 0, 0,  /* address cells */
+                           pin_mask);
 }
 
 static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
@@ -400,6 +410,8 @@ static void fdt_add_pcie_node(const LoongArchVirtMachineState *lvms,
                                  2, base_mmio, 2, size_mmio);
     qemu_fdt_setprop_cells(ms->fdt, nodename, "msi-map",
                            0, *pch_msi_phandle, 0, 0x10000);
+
+    qemu_fdt_setprop_cell(ms->fdt, nodename, "#interrupt-cells", 1);
     fdt_add_pcie_irq_map_node(lvms, nodename, pch_pic_phandle);
     g_free(nodename);
 }

From b8456254d0100ac6fb5251e53970e076aa0e04ff Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 30 Dec 2025 19:30:00 +0800
Subject: [PATCH 2342/2396] target/loongach: Fix some exceptions failure in
 updating CSR_BADV

According to Volume 1 Manual 7.4.8 ,exception,SYS,BRK,INE,IPE,PPD
FPE,SXD,ASXD are need't update CSR_BADV, this patch correct it.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit 70cf9b7bf7aff47f8d85ccce35b688dd91335cf0)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/loongarch/tcg/tcg_cpu.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index 9d077c56d9..ab247e82ec 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -121,8 +121,6 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
     case EXCCODE_FPE:
     case EXCCODE_SXD:
     case EXCCODE_ASXD:
-        env->CSR_BADV = env->pc;
-        QEMU_FALLTHROUGH;
     case EXCCODE_BCE:
     case EXCCODE_ADEM:
     case EXCCODE_PIL:

From 7d662d328df35adad1ec5362d1bfba59518402d1 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Tue, 30 Dec 2025 19:30:01 +0800
Subject: [PATCH 2343/2396] target/loongarch: Fix exception BCE missing to
 update CSR_BADV

Exception BCE need update CSR_BADV, and the value is env->pc.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit e4f0ef58d53eb20056f9f3ca9f21dbbbf25f2530)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/loongarch/tcg/tcg_cpu.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index ab247e82ec..c05a06eeb5 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -113,6 +113,9 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
         cause = cs->exception_index;
         update_badinstr = 0;
         break;
+    case EXCCODE_BCE:
+        env->CSR_BADV = env->pc;
+        QEMU_FALLTHROUGH;
     case EXCCODE_SYS:
     case EXCCODE_BRK:
     case EXCCODE_INE:
@@ -121,7 +124,6 @@ static void loongarch_cpu_do_interrupt(CPUState *cs)
     case EXCCODE_FPE:
     case EXCCODE_SXD:
     case EXCCODE_ASXD:
-    case EXCCODE_BCE:
     case EXCCODE_ADEM:
     case EXCCODE_PIL:
     case EXCCODE_PIS:

From 0b92a8a1301f157718d374237defb71bc64dbda4 Mon Sep 17 00:00:00 2001
From: Song Gao <gaosong@loongson.cn>
Date: Wed, 14 Jan 2026 15:24:17 +0800
Subject: [PATCH 2344/2396] target/loongarch: Fix exception ADEF/ADEM missing
 to update CSR_BADV

Exception ADEM/ADEF need update CSR_BADV, the value from the virtual
address.

Signed-off-by: Song Gao <gaosong@loongson.cn>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit a7be2e0a3f7d0f35bcc3b17e2b558084efc5d9fe)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/loongarch/tcg/tcg_cpu.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/loongarch/tcg/tcg_cpu.c b/target/loongarch/tcg/tcg_cpu.c
index c05a06eeb5..8615e03d14 100644
--- a/target/loongarch/tcg/tcg_cpu.c
+++ b/target/loongarch/tcg/tcg_cpu.c
@@ -225,6 +225,7 @@ static void loongarch_cpu_do_transaction_failed(CPUState *cs, hwaddr physaddr,
 {
     CPULoongArchState *env = cpu_env(cs);
 
+    env->CSR_BADV = addr;
     if (access_type == MMU_INST_FETCH) {
         do_raise_exception(env, EXCCODE_ADEF, retaddr);
     } else {

From 1a1ebc90cdf2c28f6f6e8def713b9f2483ab5357 Mon Sep 17 00:00:00 2001
From: Yao Zi <me@ziyao.cc>
Date: Wed, 14 Jan 2026 15:25:13 +0800
Subject: [PATCH 2345/2396] hw/loongarch/virt: Don't abort on access to
 unimplemented IOCSR
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Since commit f2e61edb2946 ("hw/loongarch/virt: Use MemTxAttrs interface
for misc ops") which adds a call to g_assert_not_reached() in the path
of handling unimplemented IOCSRs, QEMU would abort when the guest
accesses unimplemented IOCSRs.

This is too serious since there's nothing fatal happening in QEMU
itself, and the guest could probably continue running if we give zero as
result for these reads, which also matches the behavior observed on
3A5000M real machine.

Replace the assertion with qemu_log_mask(LOG_UNIMP, ...), it's still
possible to examine unimplemented IOCSR access through "-d unimp"
command line arguments.

Fixes: f2e61edb2946 ("hw/loongarch/virt: Use MemTxAttrs interface for misc ops")
Signed-off-by: Yao Zi <me@ziyao.cc>
Signed-off-by: Bibo Mao <maobibo@loongson.cn>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Bibo Mao <maobibo@loongson.cn>
(cherry picked from commit 49ee001a5b8378e9a9b3db8cbf61e7eda970ecd2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/loongarch/virt.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/hw/loongarch/virt.c b/hw/loongarch/virt.c
index 49434ad182..b59645be54 100644
--- a/hw/loongarch/virt.c
+++ b/hw/loongarch/virt.c
@@ -46,6 +46,7 @@
 #include "hw/block/flash.h"
 #include "hw/virtio/virtio-iommu.h"
 #include "qemu/error-report.h"
+#include "qemu/log.h"
 #include "kvm/kvm_loongarch.h"
 
 static void virt_get_dmsi(Object *obj, Visitor *v, const char *name,
@@ -621,8 +622,15 @@ static MemTxResult virt_iocsr_misc_write(void *opaque, hwaddr addr,
                           EXTIOI_VIRT_BASE + EXTIOI_VIRT_CONFIG,
                           features, attrs, NULL);
         break;
+    case VERSION_REG:
+    case FEATURE_REG:
+    case VENDOR_REG:
+    case CPUNAME_REG:
+        break;
     default:
-        g_assert_not_reached();
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented IOCSR 0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        break;
     }
 
     return MEMTX_OK;
@@ -680,7 +688,9 @@ static MemTxResult virt_iocsr_misc_read(void *opaque, hwaddr addr,
         }
         break;
     default:
-        g_assert_not_reached();
+        qemu_log_mask(LOG_UNIMP, "%s: Unimplemented IOCSR 0x%" HWADDR_PRIx "\n",
+                      __func__, addr);
+        break;
     }
 
     *data = ret;

From d9dd5dad3116bd5335bbd0be70aff70399d2ade4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Thu, 15 Jan 2026 15:26:29 +0000
Subject: [PATCH 2346/2396] hw/arm: Re-enable the MAX78000FTHR machine in
 qemu-system-arm/aarch64
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Unfortunately while rebasing the series registering the
ARM/Aarch64 machine interfaces and getting it merged as
commit 38c5ab40031 ("hw/arm: Filter machine types for
qemu-system-arm/aarch64 binaries") we missed the recent
addition of the MAX78000FTHR machine in commit 51eb283dd0e.
Correct that.

The effect is that the machine was accidentally disabled.

Cc: qemu-stable@nongnu.org
Reported-by: Thomas Huth <thuth@redhat.com>
Tested-by: Thomas Huth <thuth@redhat.com>
Tested-by: Markus Armbruster <armbru@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20251218214306.63667-1-philmd@linaro.org
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3248
Fixes: 38c5ab40031 ("hw/arm: Filter machine types for single binary")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit c5712ad83fa4bf2f2a4e8fc9431ad9548bac2b06)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/arm/max78000fthr.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/max78000fthr.c b/hw/arm/max78000fthr.c
index c4f6b5b1b0..ccef85e456 100644
--- a/hw/arm/max78000fthr.c
+++ b/hw/arm/max78000fthr.c
@@ -12,6 +12,7 @@
 #include "hw/qdev-properties.h"
 #include "hw/qdev-clock.h"
 #include "qemu/error-report.h"
+#include "hw/arm/machines-qom.h"
 #include "hw/arm/max78000_soc.h"
 #include "hw/arm/boot.h"
 
@@ -47,4 +48,4 @@ static void max78000_machine_init(MachineClass *mc)
     mc->valid_cpu_types = valid_cpu_types;
 }
 
-DEFINE_MACHINE("max78000fthr", max78000_machine_init)
+DEFINE_MACHINE_ARM("max78000fthr", max78000_machine_init)

From 35abae4511dc68a3b3ab390fbb13bff7b924936a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Thu, 15 Jan 2026 15:26:31 +0000
Subject: [PATCH 2347/2396] tests/functional: migrate aspeed_rainier image
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Cedric has a host for the file which allows us to keep the name.

Cc: qemu-stable@nongnu.org
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Message-id: 20260113135941.3361163-1-alex.bennee@linaro.org
Cc: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit 7cf096d609e67fd06abf6a59e592cb6de427825c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/functional/arm/test_aspeed_rainier.py | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tests/functional/arm/test_aspeed_rainier.py b/tests/functional/arm/test_aspeed_rainier.py
index 602d6194ac..30827beca3 100755
--- a/tests/functional/arm/test_aspeed_rainier.py
+++ b/tests/functional/arm/test_aspeed_rainier.py
@@ -9,10 +9,8 @@ from aspeed import AspeedTest
 
 class RainierMachine(AspeedTest):
 
-    ASSET_RAINIER_EMMC = Asset(
-        ('https://fileserver.linaro.org/s/B6pJTwWEkzSDi36/download/'
-         'mmc-p10bmc-20240617.qcow2'),
-        'd523fb478d2b84d5adc5658d08502bc64b1486955683814f89c6137518acd90b')
+    ASSET_RAINIER_EMMC = Asset('https://kaod.org/qemu/aspeed/rainier/mmc-p10bmc-20240617.qcow2',
+                               'd523fb478d2b84d5adc5658d08502bc64b1486955683814f89c6137518acd90b')
 
     def test_arm_aspeed_emmc_boot(self):
         self.set_machine('rainier-bmc')

From bcc7fc8f81da20b1880126e253a52626a45aa4f3 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 31 Dec 2025 17:08:55 +0000
Subject: [PATCH 2348/2396] target/arm: Don't specify ID_PFR1 accessfn twice
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the definition of ID_PFR1 we have an ifdef block; we specify the
accessfn once in the common part of the ifdef and once in the
not-user-only part, which is redundant but harmless.

The accessfn will always return success in user-only mode (because
we won't trap to EL2), so specify it only in the not-user-only
half of the ifdef, as was probably the intention.

This is only cc'd to stable to avoid a textual conflict with
the following patch, which is a bug fix.

Cc: qemu-stable@nongnu.org
Fixes: 0f150c8499e970bd ("target/arm: Constify ID_PFR1 on user emulation")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251231170858.254594-2-peter.maydell@linaro.org
(cherry picked from commit 8da52b8401afa34ea8caa58e1bfb321ae142899b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/arm/helper.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 27ebc6f29b..ec82ea6203 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -6296,7 +6296,6 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
-              .accessfn = access_aa32_tid3,
 #ifdef CONFIG_USER_ONLY
               .type = ARM_CP_CONST,
               .resetvalue = GET_IDREG(isar, ID_PFR1),

From 5ead00ce111e1e1d96e413b76f00e39ab29209ba Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 31 Dec 2025 17:08:56 +0000
Subject: [PATCH 2349/2396] target/arm: Correctly honour HCR.TID3 for v7A cores
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The HCR.TID3 bit defines that we should trap to the hypervisor for
reads to a collection of ID registers. Different architecture versions
have defined this differently:

 * v7A has a set of ID regs that definitely must trap:
    - ID_PFR{0,1}, ID_DFR0, ID_AFR0, ID_MMFR{0,1,2,3},
      ID_ISAR{0,1,2,3,4,5}, MVFR{0,1}
   and somewhat vaguely says that "there is no requirement"
   to trap for registers that are reserved in the ID reg space
   (i.e. which RAZ and might be used for new ID regs in future)
 * v8A adds to this list:
    - ID_PFR2 and MVFR2 must trap
    - ID_MMFR4, ID_MMFR5, ID_ISAR6, ID_DFR1 and reserved registers
      in the ID reg space must trap if FEAT_FGT is implemented,
      and it is IMPDEF if they trap if FEAT_FGT is not implemented

In QEMU we seem to have attempted to implement this distinction
(taking the "we do trap" IMPDEF choice if no FEAT_FGT), with
access_aa64_tid3() always trapping on TID3 and access_aa32_tid3()
trapping only if ARM_FEATURE_V8 is set.  However, we didn't apply
these to the right set of registers: we use access_aa32_tid3() on all
the 32-bit ID registers *except* ID_PFR2, ID_DFR1, ID_MMFR5 and the
RES0 space, which means that for a v7 CPU we don't trap on a lot of
registers that we should trap on, and we do trap on various things
that the v7A Arm ARM says there is "no requirement" to trap on.

Straighten this out by naming the access functions more clearly for
their purpose, and documenting this: access_v7_tid3() is only for the
fixed set of ID registers that v7A traps on HCR.TID3, and
access_tid3() is for any others, including the reserved encoding
spaces and any new registers we add in future.

AArch32 MVFR2 access is handled differently, in check_hcr_el2_trap;
there we already do not trap on TID3 on v7A cores (where MVFR2
doesn't exist), because we in the code-generation function we UNDEF
if ARM_FEATURE_V8 is not set, without generating code to call
check_hcr_el2_trap.

This bug was causing a problem for Xen which (after a recent change
to Xen) expects to be able to trap ID_PFR0 on a Cortex-A15.

The result of these changes is that our v8A behaviour remains
the same, and on v7A we now trap the registers the Arm ARM definitely
requires us to trap, and don't trap the reserved space that "there is
no requirement" to trap.

Cc: qemu-stable@nongnu.org
Fixes: 6a4ef4e5d1084c ("target/arm: Honor HCR_EL2.TID3 trapping requirements")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251231170858.254594-3-peter.maydell@linaro.org
(cherry picked from commit 205ca535abaceda375c54797b1129a54a5ebbe96)
(Mjt: trivial context fix around AA64MMFR4_EL1 definition)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/arm/helper.c | 146 ++++++++++++++++++++++++--------------------
 1 file changed, 81 insertions(+), 65 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index ec82ea6203..51d192f0ba 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5835,9 +5835,18 @@ static const ARMCPRegInfo ccsidr2_reginfo[] = {
       .readfn = ccsidr2_read, .type = ARM_CP_NO_RAW },
 };
 
-static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
-                                       bool isread)
+static CPAccessResult access_v7a_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                      bool isread)
 {
+    /*
+     * Trap on TID3 always. This should be used only for the fixed set of
+     * registers which are defined to trap on HCR.TID3 in v7A, which is:
+     *   ID_PFR{0,1}, ID_DFR0, ID_AFR0, ID_MMFR{0,1,2,3}, ID_ISAR{0,1,2,3,4,5}
+     * (MVFR0 and MVFR1 also trap in v7A, but this is not handled via
+     * this accessfn but in check_hcr_el2_trap.)
+     * Any other registers in the TID3 trap space should use access_tid3(),
+     * so that they trap on v8 and above, but not on v7.
+     */
     if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
         return CP_ACCESS_TRAP_EL2;
     }
@@ -5845,11 +5854,18 @@ static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
-                                       bool isread)
+static CPAccessResult access_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
 {
+    /*
+     * Trap on TID3, if we implement at least v8. For v8 and above
+     * the ID register space is at least IMPDEF permitted to trap,
+     * and must trap if FEAT_FGT is implemented. We choose to trap
+     * always. Use this function for any new registers that should
+     * trap on TID3.
+     */
     if (arm_feature(env, ARM_FEATURE_V8)) {
-        return access_aa64_tid3(env, ri, isread);
+        return access_v7a_tid3(env, ri, isread);
     }
 
     return CP_ACCESS_OK;
@@ -6287,7 +6303,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_PFR0)},
             /*
              * ID_PFR1 is not a plain ARM_CP_CONST because we don't know
@@ -6301,7 +6317,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .resetvalue = GET_IDREG(isar, ID_PFR1),
 #else
               .type = ARM_CP_NO_RAW,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore
 #endif
@@ -6309,72 +6325,72 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_DFR0)},
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_AFR0)},
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR0)},
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR1)},
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR2)},
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR3)},
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR0)},
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR1)},
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR2)},
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR3) },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR4) },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_v7a_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR5) },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR4)},
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa32_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_ISAR6) },
         };
         define_arm_cp_regs(cpu, v6_idregs);
@@ -6425,7 +6441,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .resetvalue = GET_IDREG(isar, ID_AA64PFR0)
 #else
               .type = ARM_CP_NO_RAW,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore
 #endif
@@ -6433,172 +6449,172 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64PFR1)},
             { .name = "ID_AA64PFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64PFR2)},
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64ZFR0)},
             { .name = "ID_AA64SMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64SMFR0)},
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64DFR0) },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64DFR1) },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64AFR0) },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64AFR1) },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64ISAR0)},
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64ISAR1)},
             { .name = "ID_AA64ISAR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64ISAR2)},
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64MMFR0)},
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64MMFR1) },
             { .name = "ID_AA64MMFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64MMFR2) },
             { .name = "ID_AA64MMFR3_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_AA64MMFR3) },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             /*
              * "0, c0, c3, {0,1,2}" are the encodings corresponding to
@@ -6609,17 +6625,17 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "RES_0_C0_C3_0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "RES_0_C0_C3_1", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "RES_0_C0_C3_2", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             /*
              * Other encodings in "0, c0, c3, ..." are STATE_BOTH because
@@ -6630,27 +6646,27 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "RES_0_C0_C3_3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
             { .name = "ID_PFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_PFR2)},
             { .name = "ID_DFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_DFR1)},
             { .name = "ID_MMFR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = GET_IDREG(isar, ID_MMFR5)},
             { .name = "RES_0_C0_C3_7", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
-              .accessfn = access_aa64_tid3,
+              .accessfn = access_tid3,
               .resetvalue = 0 },
         };
 #ifdef CONFIG_USER_ONLY
@@ -6800,7 +6816,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
                 .state = ARM_CP_STATE_AA32,
                 .cp = 15, .opc1 = 0, .crn = 0, .crm = i, .opc2 = CP_ANY,
                 .access = PL1_R, .type = ARM_CP_CONST,
-                .accessfn = access_aa64_tid3,
+                .accessfn = access_tid3,
                 .resetvalue = 0 };
             define_one_arm_cp_reg(cpu, &v8_aa32_raz_idregs);
         }

From 6bcd958030d6644d5d6e5da9d7a5e6f51b016e76 Mon Sep 17 00:00:00 2001
From: Peter Maydell <peter.maydell@linaro.org>
Date: Wed, 31 Dec 2025 17:08:57 +0000
Subject: [PATCH 2350/2396] target/arm: Correctly trap HCR.TID1 registers in
 v7A
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In v7A HCR.TID1 is defined to trap for TCMTR, TLBTR, REVIDR and AIDR.
We incorrectly use an accessfn for REVIDR and AIDR that only traps on
v8A cores.  Fix this by collapsing access_aa64_tid1() and
access_aa32_tid1() together and never doing a check for v8 vs v7.

The accessfn is also used for SMIDR_EL1, which is fine as this
register is AArch64 only.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20251231170858.254594-4-peter.maydell@linaro.org
(cherry picked from commit b67a35622f9a816544ec094132d8af0debfac7f2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/arm/helper.c | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index 51d192f0ba..633d314edf 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -924,8 +924,8 @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return ret;
 }
 
-static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
-                                       bool isread)
+static CPAccessResult access_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
 {
     if (arm_current_el(env) == 1 && (arm_hcr_el2_eff(env) & HCR_TID1)) {
         return CP_ACCESS_TRAP_EL2;
@@ -934,16 +934,6 @@ static CPAccessResult access_aa64_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-static CPAccessResult access_aa32_tid1(CPUARMState *env, const ARMCPRegInfo *ri,
-                                       bool isread)
-{
-    if (arm_feature(env, ARM_FEATURE_V8)) {
-        return access_aa64_tid1(env, ri, isread);
-    }
-
-    return CP_ACCESS_OK;
-}
-
 static const ARMCPRegInfo v7_cp_reginfo[] = {
     /* the old v6 WFI, UNPREDICTABLE in v7 but we choose to NOP */
     { .name = "NOP", .cp = 15, .crn = 7, .crm = 0, .opc1 = 0, .opc2 = 4,
@@ -969,7 +959,7 @@ static const ARMCPRegInfo v7_cp_reginfo[] = {
     { .name = "AIDR", .state = ARM_CP_STATE_BOTH,
       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 7,
       .access = PL1_R, .type = ARM_CP_CONST,
-      .accessfn = access_aa64_tid1,
+      .accessfn = access_tid1,
       .fgt = FGT_AIDR_EL1,
       .resetvalue = 0 },
     /*
@@ -4997,7 +4987,7 @@ static const ARMCPRegInfo sme_reginfo[] = {
       .writefn = smcr_write, .raw_writefn = raw_write },
     { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
-      .access = PL1_R, .accessfn = access_aa64_tid1,
+      .access = PL1_R, .accessfn = access_tid1,
       /*
        * IMPLEMENTOR = 0 (software)
        * REVISION    = 0 (implementation defined)
@@ -7094,7 +7084,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "REVIDR_EL1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 0, .opc2 = 6,
               .access = PL1_R,
-              .accessfn = access_aa64_tid1,
+              .accessfn = access_tid1,
               .fgt = FGT_REVIDR_EL1,
               .type = ARM_CP_CONST, .resetvalue = cpu->revidr },
         };
@@ -7118,7 +7108,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "TCMTR",
               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 2,
               .access = PL1_R,
-              .accessfn = access_aa32_tid1,
+              .accessfn = access_tid1,
               .type = ARM_CP_CONST, .resetvalue = 0 },
         };
         /* TLBTR is specific to VMSA */
@@ -7126,7 +7116,7 @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .name = "TLBTR",
               .cp = 15, .crn = 0, .crm = 0, .opc1 = 0, .opc2 = 3,
               .access = PL1_R,
-              .accessfn = access_aa32_tid1,
+              .accessfn = access_tid1,
               .type = ARM_CP_CONST, .resetvalue = 0,
         };
         /* MPUIR is specific to PMSA V6+ */

From 4131a1d83c69f63dcaec93342fe340fb3ba64a6f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Philippe=20Mathieu-Daud=C3=A9?= <philmd@linaro.org>
Date: Tue, 13 Jan 2026 21:34:20 +0100
Subject: [PATCH 2351/2396] accel/nvmm: Fix 'cpu' typo in nvmm_init_vcpu()
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix typo to avoid the following build failure:

  target/i386/nvmm/nvmm-all.c: In function 'nvmm_init_vcpu':
  target/i386/nvmm/nvmm-all.c:988:9: error: 'AccelCPUState' has no member named 'vcpu_dirty'
    988 |     qcpu->vcpu_dirty = true;
        |         ^~

Cc: qemu-stable@nongnu.org
Reported-by: Thomas Huth <thuth@redhat.com>
Fixes: 2098164a6be ("accel/nvmm: Replace @dirty field by generic CPUState::vcpu_dirty field")
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260113203924.81560-1-philmd@linaro.org>
(cherry picked from commit 7be4256281f430f726366c92ffdea0b72651de8a)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/nvmm/nvmm-all.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/i386/nvmm/nvmm-all.c b/target/i386/nvmm/nvmm-all.c
index b9bd9ed985..f808828d49 100644
--- a/target/i386/nvmm/nvmm-all.c
+++ b/target/i386/nvmm/nvmm-all.c
@@ -985,7 +985,7 @@ nvmm_init_vcpu(CPUState *cpu)
         }
     }
 
-    qcpu->vcpu_dirty = true;
+    cpu->vcpu_dirty = true;
     cpu->accel = qcpu;
 
     return 0;

From 6f54455c10276d750ae80f3140830a0d793140b7 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Tue, 13 Jan 2026 11:40:29 -0800
Subject: [PATCH 2352/2396] linux-user/aarch64/target_fcntl.h: add missing
 TARGET_O_LARGEFILE definition
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This caused a failure with program using openat2, where O_LARGEFILE was
replaced by O_NOFOLLOW.
This issue is only visible when QEMU is compiled with musl libc, where
O_LARGEFILE is different from 0 (vs glibc).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3262
Cc: qemu-stable@nongnu.org
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit 83017c4aaa9e3ef80161443019764196dffdb654)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/aarch64/target_fcntl.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/linux-user/aarch64/target_fcntl.h b/linux-user/aarch64/target_fcntl.h
index efdf6e5f05..55ab788a7c 100644
--- a/linux-user/aarch64/target_fcntl.h
+++ b/linux-user/aarch64/target_fcntl.h
@@ -11,6 +11,7 @@
 #define TARGET_O_DIRECTORY      040000 /* must be a directory */
 #define TARGET_O_NOFOLLOW      0100000 /* don't follow links */
 #define TARGET_O_DIRECT        0200000 /* direct disk access hint */
+#define TARGET_O_LARGEFILE     0400000
 
 #include "../generic/fcntl.h"
 #endif

From 769d19221e9fb02b8e6529f2f17dd3afa35fc507 Mon Sep 17 00:00:00 2001
From: Bernhard Beschow <shentey@gmail.com>
Date: Thu, 1 Jan 2026 21:51:35 +0100
Subject: [PATCH 2353/2396] hw/sd/sdhci: Fix TYPE_IMX_USDHC to implement
 sd-spec-version 3 by default
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes TYPE_FSL_IMX6UL, TYPE_FSL_IMX7, and TYPE_FSL_IMX8MP to implement
version 3 of the SD specification.

Note that TYPE_FSL_IMX6 already had "sd-spec-version" set accordingly and
that TYPE_FSL_IMX25 correctly sets the same property to version 2 since the
real hardware is an eSDHC which is the uSDHC's predecessor.

Fixes: fd1e5c817964 ("sdhci: Add i.MX specific subtype of SDHCI")
cc: qemu-stable
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: BALATON Zoltan <balaton@eik.bme.hu>
Message-ID: <20260112145418.220506-2-shentey@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit 214f79fdfb43e92f6c06efb76c3ad8e932b035f8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/sd/sdhci.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/sd/sdhci.c b/hw/sd/sdhci.c
index 89b595ce4a..09e9ebfe09 100644
--- a/hw/sd/sdhci.c
+++ b/hw/sd/sdhci.c
@@ -1884,9 +1884,11 @@ static const MemoryRegionOps usdhc_mmio_ops = {
 static void imx_usdhc_init(Object *obj)
 {
     SDHCIState *s = SYSBUS_SDHCI(obj);
+    DeviceState *dev = DEVICE(obj);
 
     s->io_ops = &usdhc_mmio_ops;
     s->quirks = SDHCI_QUIRK_NO_BUSY_IRQ;
+    qdev_prop_set_uint8(dev, "sd-spec-version", 3);
 }
 
 /* --- qdev Samsung s3c --- */

From ff338c6f78da0ab1be8ab7f4bb538f655517abe0 Mon Sep 17 00:00:00 2001
From: Richard Henderson <richard.henderson@linaro.org>
Date: Thu, 18 Dec 2025 14:21:04 +1100
Subject: [PATCH 2354/2396] bsd-user: Fix __i386__ test for
 TARGET_HAS_STAT_TIME_T_EXT
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The target test is TARGET_I386, not __i386__.

Cc: Kyle Evans <kevans@freebsd.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
(cherry picked from commit 369c1ba2b7c721341979889841772629b853092b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 bsd-user/syscall_defs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index 52f84d5dd1..c49be32bdc 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -247,7 +247,7 @@ struct target_freebsd11_stat {
     unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
 } __packed;
 
-#if defined(__i386__)
+#if defined(TARGET_I386)
 #define TARGET_HAS_STAT_TIME_T_EXT       1
 #endif
 

From 9707eaa47b4f20af56b0aa1a83547f0a7ae7dda0 Mon Sep 17 00:00:00 2001
From: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Date: Sun, 18 Jan 2026 23:57:38 -0800
Subject: [PATCH 2355/2396] bsd-user/syscall_defs.h: define STAT_TIME_T_EXT
 only for 32 bits
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Commit 369c1ba2b changed the wrong conditional "#if defined(__i386__)" to
"#if defined(TARGET_I386)".
However, TARGET_I386 is defined for target x86_64 also.

This commit fixes it by identifying correctly 32 bits target.

Found with:
$ ./build/qemu-x86_64 \
  -plugin ./build/contrib/plugins/libstoptrigger,icount=1000000 \
  -plugin ./build/tests/tcg/plugins/libinsn \
  -d plugin \
  ./build/qemu-system-x86_64 --version
ld-elf.so.1: /lib/libz.so.6: invalid file format
cpu 0 insns: 59746
total insns: 59746

Fixes: 369c1ba2b ("Fix __i386__ test for TARGET_HAS_STAT_TIME_T_EXT")
Fixes: dba028d1b ("Fix __i386__ test for TARGET_HAS_STAT_TIME_T_EXT" in 10.2.x)
Signed-off-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Warner Losh <imp@bsdimp.com>
Reviewed-by: Michael Tokarev <mjt@tls.msk.ru>
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
(cherry picked from commit f0de58ccf6566ad5cf04948788f9b0cfb8b960b4)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 bsd-user/syscall_defs.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bsd-user/syscall_defs.h b/bsd-user/syscall_defs.h
index c49be32bdc..cc4b484f3a 100644
--- a/bsd-user/syscall_defs.h
+++ b/bsd-user/syscall_defs.h
@@ -247,7 +247,7 @@ struct target_freebsd11_stat {
     unsigned int:(8 / 2) * (16 - (int)sizeof(struct target_freebsd_timespec));
 } __packed;
 
-#if defined(TARGET_I386)
+#if defined(TARGET_I386) && !defined(TARGET_X86_64)
 #define TARGET_HAS_STAT_TIME_T_EXT       1
 #endif
 

From ba3581de79dcb772aece8d4c1446f3967dc846f4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 21 Jan 2026 10:59:32 +0000
Subject: [PATCH 2356/2396] hw/intc: avoid byte swap fiddling in gicv3 its path
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This allows us to keep the MSI data in plain host order all the way
from the MemoryRegionOps write method to the final KVM_SIGNAL_MSI
ioctl. This fixes a theoretical bug on big-endian hosts because we
were using different size byte swaps which would have truncated the data.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20260121105932.135676-5-alex.bennee@linaro.org
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
(cherry picked from commit cf10273aff8198ab1c7e2a00e7e5fe51c80b04e7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/intc/arm_gicv3_its_common.c | 2 +-
 hw/intc/arm_gicv3_its_kvm.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index e946e3fb87..b993e6d116 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -81,7 +81,7 @@ static MemTxResult gicv3_its_trans_write(void *opaque, hwaddr offset,
     if (offset == 0x0040 && ((size == 2) || (size == 4))) {
         GICv3ITSState *s = ARM_GICV3_ITS_COMMON(opaque);
         GICv3ITSCommonClass *c = ARM_GICV3_ITS_COMMON_GET_CLASS(s);
-        int ret = c->send_msi(s, le64_to_cpu(value), attrs.requester_id);
+        int ret = c->send_msi(s, value, attrs.requester_id);
 
         if (ret <= 0) {
             qemu_log_mask(LOG_GUEST_ERROR,
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index 9812d50859..d5086a6407 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -58,7 +58,7 @@ static int kvm_its_send_msi(GICv3ITSState *s, uint32_t value, uint16_t devid)
 
     msi.address_lo = extract64(s->gits_translater_gpa, 0, 32);
     msi.address_hi = extract64(s->gits_translater_gpa, 32, 32);
-    msi.data = le32_to_cpu(value);
+    msi.data = value;
     msi.flags = KVM_MSI_VALID_DEVID;
     msi.devid = devid;
     memset(msi.pad, 0, sizeof(msi.pad));

From 5380228f7fbdc094f8ff7ad002b796ed4f131546 Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:32 +0100
Subject: [PATCH 2357/2396] linux-user: Add termios2 support

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/745f18b6-ee62-4903-9a56-dcb903b610cf@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
Tested-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
(cherry picked from commit e9a8a10e84c1bf6e2e8be000e4dd5c83ba0d8470)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/ioctls.h         |  6 +++
 linux-user/strace.c         | 69 ++++++++++++++++++++++++++++++
 linux-user/syscall.c        | 84 +++++++++++++++++++++++++++++++++++++
 linux-user/syscall_types.h  |  3 ++
 linux-user/user-internals.h |  3 ++
 5 files changed, 165 insertions(+)

diff --git a/linux-user/ioctls.h b/linux-user/ioctls.h
index 2f62fd2cb9..6ecfe6306e 100644
--- a/linux-user/ioctls.h
+++ b/linux-user/ioctls.h
@@ -1,5 +1,11 @@
      /* emulated ioctl list */
 
+#ifdef TARGET_TCGETS2
+     IOCTL(TCGETS2, IOC_R, MK_PTR(MK_STRUCT(STRUCT_termios2)))
+     IOCTL(TCSETS2, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios2)))
+     IOCTL(TCSETSW2, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios2)))
+     IOCTL(TCSETSF2, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios2)))
+#endif
      IOCTL(TCGETS, IOC_R, MK_PTR(MK_STRUCT(STRUCT_termios)))
      IOCTL(TCSETS, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios)))
      IOCTL(TCSETSF, IOC_W, MK_PTR(MK_STRUCT(STRUCT_termios)))
diff --git a/linux-user/strace.c b/linux-user/strace.c
index 758c5d32b6..18bc6c800c 100644
--- a/linux-user/strace.c
+++ b/linux-user/strace.c
@@ -1935,6 +1935,75 @@ print_termios(void *arg)
     qemu_log("}");
 }
 
+#ifdef TARGET_TCGETS2
+void
+print_termios2(void *arg)
+{
+    const struct target_termios2 *target = arg;
+
+    target_tcflag_t iflags = tswap32(target->c_iflag);
+    target_tcflag_t oflags = tswap32(target->c_oflag);
+    target_tcflag_t cflags = tswap32(target->c_cflag);
+    target_tcflag_t lflags = tswap32(target->c_lflag);
+
+    qemu_log("{");
+
+    qemu_log("c_iflag = ");
+    print_flags(termios_iflags, iflags, 0);
+
+    qemu_log("c_oflag = ");
+    target_tcflag_t oflags_clean =  oflags & ~(TARGET_NLDLY | TARGET_CRDLY |
+                                               TARGET_TABDLY | TARGET_BSDLY |
+                                               TARGET_VTDLY | TARGET_FFDLY);
+    print_flags(termios_oflags, oflags_clean, 0);
+    if (oflags & TARGET_NLDLY) {
+        print_enums(termios_oflags_NLDLY, oflags & TARGET_NLDLY, 0);
+    }
+    if (oflags & TARGET_CRDLY) {
+        print_enums(termios_oflags_CRDLY, oflags & TARGET_CRDLY, 0);
+    }
+    if (oflags & TARGET_TABDLY) {
+        print_enums(termios_oflags_TABDLY, oflags & TARGET_TABDLY, 0);
+    }
+    if (oflags & TARGET_BSDLY) {
+        print_enums(termios_oflags_BSDLY, oflags & TARGET_BSDLY, 0);
+    }
+    if (oflags & TARGET_VTDLY) {
+        print_enums(termios_oflags_VTDLY, oflags & TARGET_VTDLY, 0);
+    }
+    if (oflags & TARGET_FFDLY) {
+        print_enums(termios_oflags_FFDLY, oflags & TARGET_FFDLY, 0);
+    }
+
+    qemu_log("c_cflag = ");
+    if (cflags & TARGET_CBAUD) {
+        print_enums(termios_cflags_CBAUD, cflags & TARGET_CBAUD, 0);
+    }
+    if (cflags & TARGET_CSIZE) {
+        print_enums(termios_cflags_CSIZE, cflags & TARGET_CSIZE, 0);
+    }
+    target_tcflag_t cflags_clean = cflags & ~(TARGET_CBAUD | TARGET_CSIZE);
+    print_flags(termios_cflags, cflags_clean, 0);
+
+    qemu_log("c_lflag = ");
+    print_flags(termios_lflags, lflags, 0);
+
+    qemu_log("c_ispeed = ");
+    print_raw_param("%u", tswap32(target->c_ispeed), 0);
+
+    qemu_log("c_ospeed = ");
+    print_raw_param("%u", tswap32(target->c_ospeed), 0);
+
+    qemu_log("c_cc = ");
+    qemu_log("\"%s\",", target->c_cc);
+
+    qemu_log("c_line = ");
+    print_raw_param("\'%c\'", target->c_line, 1);
+
+    qemu_log("}");
+}
+#endif
+
 #undef UNUSED
 
 #ifdef TARGET_NR_accept
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index ee7c34027e..93ac285c5e 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -86,6 +86,7 @@
 #endif
 
 #define termios host_termios
+#define termios2 host_termios2
 #define winsize host_winsize
 #define termio host_termio
 #define sgttyb host_sgttyb /* same as target */
@@ -5888,6 +5889,89 @@ static const StructEntry struct_termios_def = {
     .print = print_termios,
 };
 
+#ifdef TARGET_TCGETS2
+static void target_to_host_termios2 (void *dst, const void *src)
+{
+    struct host_termios2 *host = dst;
+    const struct target_termios2 *target = src;
+
+    host->c_iflag =
+        target_to_host_bitmask(tswap32(target->c_iflag), iflag_tbl);
+    host->c_oflag =
+        target_to_host_bitmask(tswap32(target->c_oflag), oflag_tbl);
+    host->c_cflag =
+        target_to_host_bitmask(tswap32(target->c_cflag), cflag_tbl);
+    host->c_lflag =
+        target_to_host_bitmask(tswap32(target->c_lflag), lflag_tbl);
+    host->c_line = target->c_line;
+    host->c_ispeed = tswap32(target->c_ispeed);
+    host->c_ospeed = tswap32(target->c_ospeed);
+
+    memset(host->c_cc, 0, sizeof(host->c_cc));
+    host->c_cc[VINTR] = target->c_cc[TARGET_VINTR];
+    host->c_cc[VQUIT] = target->c_cc[TARGET_VQUIT];
+    host->c_cc[VERASE] = target->c_cc[TARGET_VERASE];
+    host->c_cc[VKILL] = target->c_cc[TARGET_VKILL];
+    host->c_cc[VEOF] = target->c_cc[TARGET_VEOF];
+    host->c_cc[VTIME] = target->c_cc[TARGET_VTIME];
+    host->c_cc[VMIN] = target->c_cc[TARGET_VMIN];
+    host->c_cc[VSWTC] = target->c_cc[TARGET_VSWTC];
+    host->c_cc[VSTART] = target->c_cc[TARGET_VSTART];
+    host->c_cc[VSTOP] = target->c_cc[TARGET_VSTOP];
+    host->c_cc[VSUSP] = target->c_cc[TARGET_VSUSP];
+    host->c_cc[VEOL] = target->c_cc[TARGET_VEOL];
+    host->c_cc[VREPRINT] = target->c_cc[TARGET_VREPRINT];
+    host->c_cc[VDISCARD] = target->c_cc[TARGET_VDISCARD];
+    host->c_cc[VWERASE] = target->c_cc[TARGET_VWERASE];
+    host->c_cc[VLNEXT] = target->c_cc[TARGET_VLNEXT];
+    host->c_cc[VEOL2] = target->c_cc[TARGET_VEOL2];
+}
+
+static void host_to_target_termios2 (void *dst, const void *src)
+{
+    struct target_termios2 *target = dst;
+    const struct host_termios2 *host = src;
+
+    target->c_iflag =
+        tswap32(host_to_target_bitmask(host->c_iflag, iflag_tbl));
+    target->c_oflag =
+        tswap32(host_to_target_bitmask(host->c_oflag, oflag_tbl));
+    target->c_cflag =
+        tswap32(host_to_target_bitmask(host->c_cflag, cflag_tbl));
+    target->c_lflag =
+        tswap32(host_to_target_bitmask(host->c_lflag, lflag_tbl));
+    target->c_line = host->c_line;
+    target->c_ispeed = tswap32(host->c_ispeed);
+    target->c_ospeed = tswap32(host->c_ospeed);
+
+    memset(target->c_cc, 0, sizeof(target->c_cc));
+    target->c_cc[TARGET_VINTR] = host->c_cc[VINTR];
+    target->c_cc[TARGET_VQUIT] = host->c_cc[VQUIT];
+    target->c_cc[TARGET_VERASE] = host->c_cc[VERASE];
+    target->c_cc[TARGET_VKILL] = host->c_cc[VKILL];
+    target->c_cc[TARGET_VEOF] = host->c_cc[VEOF];
+    target->c_cc[TARGET_VTIME] = host->c_cc[VTIME];
+    target->c_cc[TARGET_VMIN] = host->c_cc[VMIN];
+    target->c_cc[TARGET_VSWTC] = host->c_cc[VSWTC];
+    target->c_cc[TARGET_VSTART] = host->c_cc[VSTART];
+    target->c_cc[TARGET_VSTOP] = host->c_cc[VSTOP];
+    target->c_cc[TARGET_VSUSP] = host->c_cc[VSUSP];
+    target->c_cc[TARGET_VEOL] = host->c_cc[VEOL];
+    target->c_cc[TARGET_VREPRINT] = host->c_cc[VREPRINT];
+    target->c_cc[TARGET_VDISCARD] = host->c_cc[VDISCARD];
+    target->c_cc[TARGET_VWERASE] = host->c_cc[VWERASE];
+    target->c_cc[TARGET_VLNEXT] = host->c_cc[VLNEXT];
+    target->c_cc[TARGET_VEOL2] = host->c_cc[VEOL2];
+}
+
+static const StructEntry struct_termios2_def = {
+    .convert = { host_to_target_termios2, target_to_host_termios2 },
+    .size = { sizeof(struct target_termios2), sizeof(struct host_termios2) },
+    .align = { __alignof__(struct target_termios2), __alignof__(struct host_termios2) },
+    .print = print_termios2,
+};
+#endif
+
 /* If the host does not provide these bits, they may be safely discarded. */
 #ifndef MAP_SYNC
 #define MAP_SYNC 0
diff --git a/linux-user/syscall_types.h b/linux-user/syscall_types.h
index 6dd7a80ce5..ac45705acf 100644
--- a/linux-user/syscall_types.h
+++ b/linux-user/syscall_types.h
@@ -1,4 +1,7 @@
 STRUCT_SPECIAL(termios)
+#ifdef TARGET_TCGETS2
+STRUCT_SPECIAL(termios2)
+#endif
 
 STRUCT(winsize,
        TYPE_SHORT, TYPE_SHORT, TYPE_SHORT, TYPE_SHORT)
diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index 7099349ec8..067c02bb93 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -129,6 +129,9 @@ static inline uint64_t target_offset64(uint64_t word0, uint64_t word1)
 #endif /* TARGET_ABI_BITS != 32 */
 
 void print_termios(void *arg);
+#ifdef TARGET_TCGETS2
+void print_termios2(void *arg);
+#endif
 
 /* ARM EABI and MIPS expect 64bit types aligned even on pairs or registers */
 #ifdef TARGET_ARM

From 20b93df8d7915f07d4b71a109ebef366ce4f036a Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:33 +0100
Subject: [PATCH 2358/2396] linux-user: Add termios2 support to alpha target

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/02dba951-1bcf-4c74-8a6a-f4f4aa5ce909@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit 8d8c6aeee8599a099e49ec4411f3d1e087ae40ad)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/alpha/termbits.h | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/linux-user/alpha/termbits.h b/linux-user/alpha/termbits.h
index 4a4b1e96f2..b7be23ea13 100644
--- a/linux-user/alpha/termbits.h
+++ b/linux-user/alpha/termbits.h
@@ -17,6 +17,29 @@ struct target_termios {
 	target_speed_t c_ospeed;		/* output speed */
 };
 
+struct target_termios2 {
+	target_tcflag_t c_iflag;		/* input mode flags */
+	target_tcflag_t c_oflag;		/* output mode flags */
+	target_tcflag_t c_cflag;		/* control mode flags */
+	target_tcflag_t c_lflag;		/* local mode flags */
+	target_cc_t c_cc[TARGET_NCCS];		/* control characters */
+	target_cc_t c_line;			/* line discipline (== c_cc[19]) */
+	target_speed_t c_ispeed;		/* input speed */
+	target_speed_t c_ospeed;		/* output speed */
+};
+
+struct target_ktermios {
+	target_tcflag_t c_iflag;		/* input mode flags */
+	target_tcflag_t c_oflag;		/* output mode flags */
+	target_tcflag_t c_cflag;		/* control mode flags */
+	target_tcflag_t c_lflag;		/* local mode flags */
+	target_cc_t c_cc[TARGET_NCCS];		/* control characters */
+	target_cc_t c_line;			/* line discipline (== c_cc[19]) */
+	target_speed_t c_ispeed;		/* input speed */
+	target_speed_t c_ospeed;		/* output speed */
+};
+
+
 /* c_cc characters */
 #define TARGET_VEOF 0
 #define TARGET_VEOL 1
@@ -247,6 +270,12 @@ struct target_termios {
 #define TARGET_TIOCSBRK	0x5427  /* BSD compatibility */
 #define TARGET_TIOCCBRK	0x5428  /* BSD compatibility */
 #define TARGET_TIOCGSID	0x5429  /* Return the session ID of FD */
+#define TARGET_TCGETS2		TARGET_IOR('T', 0x2A, struct target_termios2)
+#define TARGET_TCSETS2		TARGET_IOW('T', 0x2B, struct target_termios2)
+#define TARGET_TCSETSW2	TARGET_IOW('T', 0x2C, struct target_termios2)
+#define TARGET_TCSETSF2	TARGET_IOW('T', 0x2D, struct target_termios2)
+#define TARGET_TIOCGRS485	TARGET_IOR('T', 0x2E, struct serial_rs485)
+#define TARGET_TIOCSRS485	TARGET_IOWR('T', 0x2F, struct serial_rs485)
 #define TARGET_TIOCGPTN	TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
 #define TARGET_TIOCSPTLCK	TARGET_IOW('T',0x31, int)  /* Lock/unlock Pty */
 #define TARGET_TIOCGPTPEER      TARGET_IO('T', 0x41) /* Safely open the slave */

From 06cfe78536d1ba27cf50783c6330707e9534e912 Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:34 +0100
Subject: [PATCH 2359/2396] linux-user: Add termios2 support to hppa target

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/ccf1be5c-9e2e-46f6-b303-d29888371fb0@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit edc741710acedd61011f937967b960d154794258)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/hppa/termbits.h | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/linux-user/hppa/termbits.h b/linux-user/hppa/termbits.h
index 11fd4eed62..645f17bf63 100644
--- a/linux-user/hppa/termbits.h
+++ b/linux-user/hppa/termbits.h
@@ -18,6 +18,29 @@ struct target_termios {
     target_cc_t c_cc[TARGET_NCCS];         /* control characters */
 };
 
+struct target_termios2 {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+struct target_ktermios {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+
 /* c_iflag bits */
 #define TARGET_IGNBRK  0000001
 #define TARGET_BRKINT  0000002
@@ -190,6 +213,12 @@ struct target_termios {
 #define TARGET_TIOCSBRK         0x5427 /* BSD compatibility */
 #define TARGET_TIOCCBRK         0x5428 /* BSD compatibility */
 #define TARGET_TIOCGSID         TARGET_IOR('T', 20, int)
+#define TARGET_TCGETS2          TARGET_IOR('T', 0x2A, struct target_termios2)
+#define TARGET_TCSETS2          TARGET_IOW('T', 0x2B, struct target_termios2)
+#define TARGET_TCSETSW2         TARGET_IOW('T', 0x2C, struct target_termios2)
+#define TARGET_TCSETSF2         TARGET_IOW('T', 0x2D, struct target_termios2)
+#define TARGET_TIOCGRS485       TARGET_IOR('T', 0x2E, struct serial_rs485)
+#define TARGET_TIOCSRS485       TARGET_IOWR('T', 0x2F, struct serial_rs485)
 #define TARGET_TIOCGPTN         TARGET_IOR('T', 0x30, unsigned int)
         /* Get Pty Number (of pty-mux device) */
 #define TARGET_TIOCSPTLCK       TARGET_IOW('T', 0x31, int)

From ce78d40265c8c1c264e2d92f28c15dcca7d51a1a Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:35 +0100
Subject: [PATCH 2360/2396] linux-user: Add termios2 support to mips target

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/361aa9c5-4464-4d27-8a2c-9ab767324530@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit edf9184f4feb691b0f70dc544443db2380891598)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/mips/termbits.h | 31 +++++++++++++++++++++++++++----
 1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/linux-user/mips/termbits.h b/linux-user/mips/termbits.h
index e8b4b58d87..27610f7c4d 100644
--- a/linux-user/mips/termbits.h
+++ b/linux-user/mips/termbits.h
@@ -18,6 +18,29 @@ struct target_termios {
     target_cc_t c_cc[TARGET_NCCS];         /* control characters */
 };
 
+struct target_termios2 {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+struct target_ktermios {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+
 /* c_iflag bits */
 #define TARGET_IGNBRK  0000001
 #define TARGET_BRKINT  0000002
@@ -227,10 +250,10 @@ struct target_termios {
 #define TARGET_TIOCSBRK	0x5427  /* BSD compatibility */
 #define TARGET_TIOCCBRK	0x5428  /* BSD compatibility */
 #define TARGET_TIOCGSID	0x7416  /* Return the session ID of FD */
-#define TARGET_TCGETS2          TARGET_IOR('T', 0x2A, struct termios2)
-#define TARGET_TCSETS2          TARGET_IOW('T', 0x2B, struct termios2)
-#define TARGET_TCSETSW2         TARGET_IOW('T', 0x2C, struct termios2)
-#define TARGET_TCSETSF2         TARGET_IOW('T', 0x2D, struct termios2)
+#define TARGET_TCGETS2          TARGET_IOR('T', 0x2A, struct target_termios2)
+#define TARGET_TCSETS2          TARGET_IOW('T', 0x2B, struct target_termios2)
+#define TARGET_TCSETSW2         TARGET_IOW('T', 0x2C, struct target_termios2)
+#define TARGET_TCSETSF2         TARGET_IOW('T', 0x2D, struct target_termios2)
 #define TARGET_TIOCGRS485       TARGET_IOR('T', 0x2E, struct serial_rs485)
 #define TARGET_TIOCSRS485       TARGET_IOWR('T', 0x2F, struct serial_rs485)
 #define TARGET_TIOCGPTN	TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */

From c1fac5fbfe6a2549c0640850aed37ce7a9277d85 Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:36 +0100
Subject: [PATCH 2361/2396] linux-user: Add termios2 support to sh4 target

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/642b32de-2985-45d2-bbdf-c0b2e3ea0551@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit afbe0ff81c29d674b9c18a588bcaab34ddcb8a7b)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/sh4/termbits.h | 46 +++++++++++++++++++++++++++++----------
 1 file changed, 34 insertions(+), 12 deletions(-)

diff --git a/linux-user/sh4/termbits.h b/linux-user/sh4/termbits.h
index 28e79f2c9a..cab6b1299e 100644
--- a/linux-user/sh4/termbits.h
+++ b/linux-user/sh4/termbits.h
@@ -18,6 +18,28 @@ struct target_termios {
     target_cc_t c_cc[TARGET_NCCS];         /* control characters */
 };
 
+struct target_termios2 {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+struct target_ktermios {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
 
 /* c_cc characters */
 #define TARGET_VINTR 0
@@ -251,14 +273,17 @@ struct target_termios {
 #define TARGET_TIOCNOTTY       TARGET_IO('T', 34) /* 0x5422 */
 #define TARGET_TIOCSETD        TARGET_IOW('T', 35, int) /* 0x5423 */
 #define TARGET_TIOCGETD        TARGET_IOR('T', 36, int) /* 0x5424 */
-#define TARGET_TCSBRKP         TARGET_IOW('T', 37, int) /* 0x5425 */ /* Needed for POSIX tcse
-ndbreak() */
+#define TARGET_TCSBRKP         TARGET_IOW('T', 37, int) /* 0x5425 */ /* Needed for POSIX tcsendbreak() */
 #define TARGET_TIOCSBRK        TARGET_IO('T', 39) /* 0x5427 */ /* BSD compatibility */
 #define TARGET_TIOCCBRK        TARGET_IO('T', 40) /* 0x5428 */ /* BSD compatibility */
-#define TARGET_TIOCGSID        TARGET_IOR('T', 41, pid_t) /* 0x5429 */ /* Return the session
-ID of FD */
-#define TARGET_TIOCGPTN        TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-m
-ux device) */
+#define TARGET_TIOCGSID        TARGET_IOR('T', 41, pid_t) /* 0x5429 */ /* Return the session ID of FD */
+#define TARGET_TCGETS2         TARGET_IOR('T', 0x2A, struct target_termios2)
+#define TARGET_TCSETS2         TARGET_IOW('T', 0x2B, struct target_termios2)
+#define TARGET_TCSETSW2        TARGET_IOW('T', 0x2C, struct target_termios2)
+#define TARGET_TCSETSF2        TARGET_IOW('T', 0x2D, struct target_termios2)
+#define TARGET_TIOCGRS485      TARGET_IOR('T', 0x2E, struct serial_rs485)
+#define TARGET_TIOCSRS485      TARGET_IOWR('T', 0x2F, struct serial_rs485)
+#define TARGET_TIOCGPTN        TARGET_IOR('T',0x30, unsigned int) /* Get Pty Number (of pty-mux device) */
 #define TARGET_TIOCSPTLCK      TARGET_IOW('T',0x31, int)  /* Lock/unlock Pty */
 #define TARGET_TIOCGPTPEER     TARGET_IO('T', 0x41) /* Safely open the slave */
 
@@ -270,8 +295,7 @@ ux device) */
 #define TARGET_TIOCSLCKTRMIOS  0x5457
 #define TARGET_TIOCSERGSTRUCT  TARGET_IOR('T', 88, int) /* 0x5458 */ /* For d
 ebugging only */
-#define TARGET_TIOCSERGETLSR   TARGET_IOR('T', 89, unsigned int) /* 0x5459 */ /* Get line sta
-tus register */
+#define TARGET_TIOCSERGETLSR   TARGET_IOR('T', 89, unsigned int) /* 0x5459 */ /* Get line status register */
   /* ioctl (fd, TIOCSERGETLSR, &result) where result may be as below */
 # define TARGET_TIOCSER_TEMT   0x01   /* Transmitter physically empty */
 #define TARGET_TIOCSERGETMULTI TARGET_IOR('T', 90, int) /* 0x545A
@@ -279,9 +303,7 @@ tus register */
 #define TARGET_TIOCSERSETMULTI TARGET_IOW('T', 91, int) /* 0x545B
 */ /* Set multiport config */
 
-#define TARGET_TIOCMIWAIT      TARGET_IO('T', 92) /* 0x545C */       /* wait for a change on
-serial input line(s) */
-#define TARGET_TIOCGICOUNT     TARGET_IOR('T', 93, int) /* 0x545D */ /* read
-serial port inline interrupt counts */
+#define TARGET_TIOCMIWAIT      TARGET_IO('T', 92) /* 0x545C */       /* wait for a change on serial input line(s) */
+#define TARGET_TIOCGICOUNT     TARGET_IOR('T', 93, int) /* 0x545D */ /* read serial port inline interrupt counts */
 
 #endif

From 22a55fc7df152f4e2216ae7838a410554877d799 Mon Sep 17 00:00:00 2001
From: Luca Bonissi <qemu@bonslack.org>
Date: Sat, 3 Jan 2026 16:25:37 +0100
Subject: [PATCH 2362/2396] linux-user: Add termios2 support to sparc target

Signed-off-by: Luca Bonissi <qemu@bonslack.org>
Link: https://lore.kernel.org/qemu-devel/909d9d68-c6fe-4368-825c-6aa8fdbd3bbc@bonslack.org
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit 947b971cad90375040f399899909a3f1f32b483f)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/sparc/termbits.h | 28 ++++++++++++++++++++++++++++
 1 file changed, 28 insertions(+)

diff --git a/linux-user/sparc/termbits.h b/linux-user/sparc/termbits.h
index 704bee1c42..588d7e8dcd 100644
--- a/linux-user/sparc/termbits.h
+++ b/linux-user/sparc/termbits.h
@@ -18,6 +18,28 @@ struct target_termios {
     target_cc_t c_cc[TARGET_NCCS];         /* control characters */
 };
 
+struct target_termios2 {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
+struct target_ktermios {
+    target_tcflag_t c_iflag;       /* input mode flags */
+    target_tcflag_t c_oflag;       /* output mode flags */
+    target_tcflag_t c_cflag;       /* control mode flags */
+    target_tcflag_t c_lflag;       /* local mode flags */
+    target_cc_t c_line;            /* line discipline */
+    target_cc_t c_cc[TARGET_NCCS]; /* control characters */
+    target_speed_t c_ispeed;       /* input speed */
+    target_speed_t c_ospeed;       /* output speed */
+};
+
 
 /* c_cc characters */
 #define TARGET_VINTR    0
@@ -251,6 +273,12 @@ struct target_termios {
 #define TARGET_TIOCGPGRP	TARGET_IOR('t', 131, int)
 #define TARGET_TIOCSCTTY	TARGET_IO('t', 132)
 #define TARGET_TIOCGSID	TARGET_IOR('t', 133, int)
+#define TARGET_TCGETS2		TARGET_IOR('T', 12, struct target_termios2)
+#define TARGET_TCSETS2		TARGET_IOW('T', 13, struct target_termios2)
+#define TARGET_TCSETSW2	TARGET_IOW('T', 14, struct target_termios2)
+#define TARGET_TCSETSF2	TARGET_IOW('T', 15, struct target_termios2)
+#define TARGET_TIOCGRS485	TARGET_IOR('T', 0x41, struct serial_rs485)
+#define TARGET_TIOCSRS485	TARGET_IOWR('T', 0x42, struct serial_rs485)
 /* Get minor device of a pty master's FD -- Solaris equiv is ISPTM */
 #define TARGET_TIOCGPTN	TARGET_IOR('t', 134, unsigned int) /* Get Pty Number */
 #define TARGET_TIOCSPTLCK	TARGET_IOW('t', 135, int) /* Lock/unlock PTY */

From 1e762859ce074f9766bf59207f971421f9907ac2 Mon Sep 17 00:00:00 2001
From: Vivian Wang <wangruikang@iscas.ac.cn>
Date: Sat, 3 Jan 2026 16:25:38 +0100
Subject: [PATCH 2363/2396] linux-user: Add missing termios baud rates

Add several missing baud rates and inputs baud rates in cflag_tbl.

Add these missing definitions in termbits.h:

- TARGET_BOTHER for alpha, hppa, ppc, sh4, sparc
- TARGET_IBSHIFT for hppa, mips, ppc, sh4, sparc
- Missing standard baud rates for hppa

These are required for the glibc test tst-termios-linux.

Link: https://lore.kernel.org/qemu-devel/20251203-linux-user-higher-baud-rates-v2-1-e45b35224437@iscas.ac.cn
Signed-off-by: Vivian Wang <wangruikang@iscas.ac.cn>
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit 4f22fcb5c67f40a36e6654f6cfaee23f9f9e93d1)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/alpha/termbits.h   |  1 +
 linux-user/generic/termbits.h |  2 +-
 linux-user/hppa/termbits.h    | 16 ++++++-
 linux-user/mips/termbits.h    |  4 +-
 linux-user/ppc/termbits.h     |  1 +
 linux-user/sh4/termbits.h     |  5 ++-
 linux-user/sparc/termbits.h   |  5 ++-
 linux-user/syscall.c          | 83 ++++++++++++++++++++++++++---------
 8 files changed, 92 insertions(+), 25 deletions(-)

diff --git a/linux-user/alpha/termbits.h b/linux-user/alpha/termbits.h
index b7be23ea13..50cff34f3c 100644
--- a/linux-user/alpha/termbits.h
+++ b/linux-user/alpha/termbits.h
@@ -149,6 +149,7 @@ struct target_ktermios {
 #define TARGET_B3000000  00034
 #define TARGET_B3500000  00035
 #define TARGET_B4000000  00036
+#define TARGET_BOTHER    00037
 
 #define TARGET_CSIZE	00001400
 #define   TARGET_CS5	00000000
diff --git a/linux-user/generic/termbits.h b/linux-user/generic/termbits.h
index 6675e0d1ab..6cc5995981 100644
--- a/linux-user/generic/termbits.h
+++ b/linux-user/generic/termbits.h
@@ -157,7 +157,7 @@ struct target_ktermios {
 #define  TARGET_B3000000  0010015
 #define  TARGET_B3500000  0010016
 #define  TARGET_B4000000  0010017
-#define TARGET_CIBAUD     002003600000  /* input baud rate (not used) */
+#define TARGET_CIBAUD     002003600000  /* input baud rate */
 #define TARGET_CMSPAR     010000000000  /* mark or space (stick) parity */
 #define TARGET_CRTSCTS    020000000000  /* flow control */
 
diff --git a/linux-user/hppa/termbits.h b/linux-user/hppa/termbits.h
index 645f17bf63..9d1d1a1d12 100644
--- a/linux-user/hppa/termbits.h
+++ b/linux-user/hppa/termbits.h
@@ -123,14 +123,28 @@ struct target_ktermios {
 #define TARGET_HUPCL   0002000
 #define TARGET_CLOCAL  0004000
 #define TARGET_CBAUDEX 0010000
+#define  TARGET_BOTHER  0010000
 #define  TARGET_B57600  0010001
 #define  TARGET_B115200 0010002
 #define  TARGET_B230400 0010003
 #define  TARGET_B460800 0010004
-#define TARGET_CIBAUD    002003600000  /* input baud rate (not used) */
+#define  TARGET_B500000 0010005
+#define  TARGET_B576000 0010006
+#define  TARGET_B921600 0010007
+#define  TARGET_B1000000 0010010
+#define  TARGET_B1152000 0010011
+#define  TARGET_B1500000 0010012
+#define  TARGET_B2000000 0010013
+#define  TARGET_B2500000 0010014
+#define  TARGET_B3000000 0010015
+#define  TARGET_B3500000 0010016
+#define  TARGET_B4000000 0010017
+#define TARGET_CIBAUD    002003600000  /* input baud rate */
 #define TARGET_CMSPAR    010000000000  /* mark or space (stick) parity */
 #define TARGET_CRTSCTS   020000000000  /* flow control */
 
+#define TARGET_IBSHIFT   16            /* Shift from CBAUD to CIBAUD */
+
 /* c_lflag bits */
 #define TARGET_ISIG    0000001
 #define TARGET_ICANON  0000002
diff --git a/linux-user/mips/termbits.h b/linux-user/mips/termbits.h
index 27610f7c4d..56b17441ee 100644
--- a/linux-user/mips/termbits.h
+++ b/linux-user/mips/termbits.h
@@ -139,10 +139,12 @@ struct target_ktermios {
 #define  TARGET_B3000000 0010015
 #define  TARGET_B3500000 0010016
 #define  TARGET_B4000000 0010017
-#define TARGET_CIBAUD    002003600000  /* input baud rate (not used) */
+#define TARGET_CIBAUD    002003600000  /* input baud rate */
 #define TARGET_CMSPAR    010000000000  /* mark or space (stick) parity */
 #define TARGET_CRTSCTS   020000000000  /* flow control */
 
+#define TARGET_IBSHIFT   16            /* Shift from CBAUD to CIBAUD */
+
 /* c_lflag bits */
 #define TARGET_ISIG    0000001
 #define TARGET_ICANON  0000002
diff --git a/linux-user/ppc/termbits.h b/linux-user/ppc/termbits.h
index eb226e0999..71b398c83a 100644
--- a/linux-user/ppc/termbits.h
+++ b/linux-user/ppc/termbits.h
@@ -129,6 +129,7 @@ struct target_termios {
 #define TARGET_B3000000  00034
 #define TARGET_B3500000  00035
 #define TARGET_B4000000  00036
+#define TARGET_BOTHER    00037
 
 #define TARGET_CSIZE	00001400
 #define   TARGET_CS5	00000000
diff --git a/linux-user/sh4/termbits.h b/linux-user/sh4/termbits.h
index cab6b1299e..861f861f6d 100644
--- a/linux-user/sh4/termbits.h
+++ b/linux-user/sh4/termbits.h
@@ -142,6 +142,7 @@ struct target_ktermios {
 #define TARGET_HUPCL   0002000
 #define TARGET_CLOCAL  0004000
 #define TARGET_CBAUDEX 0010000
+#define TARGET_BOTHER 0010000
 #define TARGET_B57600 0010001
 #define TARGET_B115200 0010002
 #define TARGET_B230400 0010003
@@ -157,10 +158,12 @@ struct target_ktermios {
 #define TARGET_B3000000 0010015
 #define TARGET_B3500000 0010016
 #define TARGET_B4000000 0010017
-#define TARGET_CIBAUD    002003600000 /* input baud rate (not used) */
+#define TARGET_CIBAUD    002003600000 /* input baud rate */
 #define TARGET_CMSPAR    010000000000 /* mark or space (stick) parity */
 #define TARGET_CRTSCTS   020000000000 /* flow control */
 
+#define TARGET_IBSHIFT   16           /* Shift from CBAUD to CIBAUD */
+
 /* c_lflag bits */
 #define TARGET_ISIG     0000001
 #define TARGET_ICANON   0000002
diff --git a/linux-user/sparc/termbits.h b/linux-user/sparc/termbits.h
index 588d7e8dcd..f64ea87d97 100644
--- a/linux-user/sparc/termbits.h
+++ b/linux-user/sparc/termbits.h
@@ -150,6 +150,7 @@ struct target_ktermios {
 #define TARGET_HUPCL	  0x00000400
 #define TARGET_CLOCAL	  0x00000800
 #define TARGET_CBAUDEX   0x00001000
+#define  TARGET_BOTHER   0x00001000
 /* We'll never see these speeds with the Zilogs, but for completeness... */
 #define  TARGET_B57600   0x00001001
 #define  TARGET_B115200  0x00001002
@@ -176,10 +177,12 @@ struct target_ktermios {
 #define B3000000  0x00001011
 #define B3500000  0x00001012
 #define B4000000  0x00001013  */
-#define TARGET_CIBAUD	  0x100f0000  /* input baud rate (not used) */
+#define TARGET_CIBAUD	  0x100f0000  /* input baud rate */
 #define TARGET_CMSPAR	  0x40000000  /* mark or space (stick) parity */
 #define TARGET_CRTSCTS	  0x80000000  /* flow control */
 
+#define TARGET_IBSHIFT	  16          /* Shift from CBAUD to CIBAUD */
+
 /* c_lflag bits */
 #define TARGET_ISIG	0x00000001
 #define TARGET_ICANON	0x00000002
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 93ac285c5e..28394961b6 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -5759,27 +5759,70 @@ static const bitmask_transtbl oflag_tbl[] = {
 	{ TARGET_FFDLY, TARGET_FF1, FFDLY, FF1 },
 };
 
+#if defined(TARGET_CIBAUD) && defined(CIBAUD)
+
+# define BAUD_TRANSTBL(baud) \
+    { TARGET_CBAUD, TARGET_##baud, CBAUD, baud }, \
+    { TARGET_CIBAUD, TARGET_##baud << TARGET_IBSHIFT, CIBAUD, baud << IBSHIFT },
+
+#else
+
+/* Alpha in particular does not have CIBAUD/IBSHIFT */
+
+# define BAUD_TRANSTBL(baud) \
+    { TARGET_CBAUD, TARGET_##baud, CBAUD, baud },
+
+#endif
+
 static const bitmask_transtbl cflag_tbl[] = {
-	{ TARGET_CBAUD, TARGET_B0, CBAUD, B0 },
-	{ TARGET_CBAUD, TARGET_B50, CBAUD, B50 },
-	{ TARGET_CBAUD, TARGET_B75, CBAUD, B75 },
-	{ TARGET_CBAUD, TARGET_B110, CBAUD, B110 },
-	{ TARGET_CBAUD, TARGET_B134, CBAUD, B134 },
-	{ TARGET_CBAUD, TARGET_B150, CBAUD, B150 },
-	{ TARGET_CBAUD, TARGET_B200, CBAUD, B200 },
-	{ TARGET_CBAUD, TARGET_B300, CBAUD, B300 },
-	{ TARGET_CBAUD, TARGET_B600, CBAUD, B600 },
-	{ TARGET_CBAUD, TARGET_B1200, CBAUD, B1200 },
-	{ TARGET_CBAUD, TARGET_B1800, CBAUD, B1800 },
-	{ TARGET_CBAUD, TARGET_B2400, CBAUD, B2400 },
-	{ TARGET_CBAUD, TARGET_B4800, CBAUD, B4800 },
-	{ TARGET_CBAUD, TARGET_B9600, CBAUD, B9600 },
-	{ TARGET_CBAUD, TARGET_B19200, CBAUD, B19200 },
-	{ TARGET_CBAUD, TARGET_B38400, CBAUD, B38400 },
-	{ TARGET_CBAUD, TARGET_B57600, CBAUD, B57600 },
-	{ TARGET_CBAUD, TARGET_B115200, CBAUD, B115200 },
-	{ TARGET_CBAUD, TARGET_B230400, CBAUD, B230400 },
-	{ TARGET_CBAUD, TARGET_B460800, CBAUD, B460800 },
+	BAUD_TRANSTBL(B0)
+	BAUD_TRANSTBL(B50)
+	BAUD_TRANSTBL(B75)
+	BAUD_TRANSTBL(B110)
+	BAUD_TRANSTBL(B134)
+	BAUD_TRANSTBL(B150)
+	BAUD_TRANSTBL(B200)
+	BAUD_TRANSTBL(B300)
+	BAUD_TRANSTBL(B600)
+	BAUD_TRANSTBL(B1200)
+	BAUD_TRANSTBL(B1800)
+	BAUD_TRANSTBL(B2400)
+	BAUD_TRANSTBL(B4800)
+	BAUD_TRANSTBL(B9600)
+	BAUD_TRANSTBL(B19200)
+	BAUD_TRANSTBL(B38400)
+	BAUD_TRANSTBL(B57600)
+	BAUD_TRANSTBL(B115200)
+	BAUD_TRANSTBL(B230400)
+	BAUD_TRANSTBL(B460800)
+	BAUD_TRANSTBL(B500000)
+	BAUD_TRANSTBL(B576000)
+	BAUD_TRANSTBL(B921600)
+	BAUD_TRANSTBL(B1000000)
+	BAUD_TRANSTBL(B1152000)
+	BAUD_TRANSTBL(B1500000)
+	BAUD_TRANSTBL(B2000000)
+
+	BAUD_TRANSTBL(BOTHER)
+
+	/* SPARC in particular is missing these higher baud rates */
+
+#if defined(TARGET_B2500000) && defined(B2500000)
+	BAUD_TRANSTBL(B2500000)
+#endif
+
+#if defined(TARGET_B3000000) && defined(B3000000)
+	BAUD_TRANSTBL(B3000000)
+#endif
+
+#if defined(TARGET_B3500000) && defined(B3500000)
+	BAUD_TRANSTBL(B3500000)
+#endif
+
+#if defined(TARGET_B4000000) && defined(B4000000)
+	BAUD_TRANSTBL(B4000000)
+#endif
+
 	{ TARGET_CSIZE, TARGET_CS5, CSIZE, CS5 },
 	{ TARGET_CSIZE, TARGET_CS6, CSIZE, CS6 },
 	{ TARGET_CSIZE, TARGET_CS7, CSIZE, CS7 },

From d0be1b581c9ecaf8b04f040fc796c7ce79ec80fe Mon Sep 17 00:00:00 2001
From: Icenowy Zheng <uwu@icenowy.me>
Date: Sat, 3 Jan 2026 16:25:39 +0100
Subject: [PATCH 2364/2396] linux-user: fixup termios2 related things on
 PowerPC

The termios things on PowerPC equal to termios2 things otherwhere.

Use some simple #define's to allow both termios and termios2 to map to
termios on PowerPC.

Signed-off-by: Icenowy Zheng <uwu@icenowy.me>
Link: https://github.com/AOSC-Dev/aosc-os-abbs/blob/8d77eeaa76e9b159c3f35adaf73c875751aa7d17/app-virtualization/qemu/01-shared/patches/0005-AOSCOS-linux-user-fixup-termios2-related-things-on-P.patch
Link: https://lore.kernel.org/qemu-devel/4403eb94ddbb2934f1f75d94ce921f0f1078ad9f.camel@icenowy.me
Reviewed-by: Helge Deller <deller@gmx.de>
(cherry picked from commit d68f0e2e906939bef076d0cd52f902d433c8c3da)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/syscall.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index 28394961b6..fbacbaea3a 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -148,6 +148,21 @@
 #include "fd-trans.h"
 #include "user/cpu_loop.h"
 
+#if defined(__powerpc__)
+/*
+ * On PowerPC termios2 is lacking and termios along with ioctls w/o 2
+ * behaves like termios2 and things with 2 on other architectures.
+ *
+ * Just define termios2-related things to be the same with termios-related
+ * ones to support PowerPC.
+ */
+#define host_termios2 host_termios
+#define TCGETS2 TCGETS
+#define TCSETS2 TCSETS
+#define TCSETSW2 TCSETSW
+#define TCSETSF2 TCSETSF
+#endif
+
 #ifndef CLONE_IO
 #define CLONE_IO                0x80000000      /* Clone io context */
 #endif

From f48aaf926ee226aaf043358bd37ea7d4b20ab4d8 Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Wed, 7 Jan 2026 16:42:19 +0100
Subject: [PATCH 2365/2396] target/i386/tcg: fix a few instructions that do not
 support VEX.L=1

Match the contents of table 2-17 ("#UD Exception and VEX.L Field Encoding")
in the SDM, for instruction in exception class 5.  They were incorrectly
accepting 256-bit versions that do not exist.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
(cherry picked from commit 2eb8d9734355ed86e162dce2a3f265ffee4005ed)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 target/i386/tcg/decode-new.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/i386/tcg/decode-new.c.inc b/target/i386/tcg/decode-new.c.inc
index 24dcf222f3..0462429cf1 100644
--- a/target/i386/tcg/decode-new.c.inc
+++ b/target/i386/tcg/decode-new.c.inc
@@ -504,7 +504,7 @@ static void decode_0F7E(DisasContext *s, CPUX86State *env, X86OpEntry *entry, ui
     static const X86OpEntry opcodes_0F7E[4] = {
         X86_OP_ENTRY3(MOVD_from,  E,y, None,None, P,y, vex5 mmx),
         X86_OP_ENTRY3(MOVD_from,  E,y, None,None, V,y, vex5),
-        X86_OP_ENTRY3(MOVQ,       V,x, None,None, W,q, vex5),  /* wrong dest Vy on SDM! */
+        X86_OP_ENTRY3(MOVQ,       V,dq,None,None, W,q, vex5),  /* wrong dest Vq on SDM! */
         {},
     };
     *entry = *decode_by_prefix(s, opcodes_0F7E);
@@ -569,7 +569,7 @@ static void decode_0FD6(DisasContext *s, CPUX86State *env, X86OpEntry *entry, ui
 {
     static const X86OpEntry movq[4] = {
         {},
-        X86_OP_ENTRY3(MOVQ,    W,x,  None, None, V,q, vex5),
+        X86_OP_ENTRY3(MOVQ,    W,dq, None, None, V,q, vex5),
         X86_OP_ENTRY3(MOVq_dq, V,dq, None, None, N,q),
         X86_OP_ENTRY3(MOVq_dq, P,q,  None, None, U,q),
     };
@@ -978,7 +978,7 @@ static void decode_0F12(DisasContext *s, CPUX86State *env, X86OpEntry *entry, ui
     };
     static const X86OpEntry opcodes_0F12_reg[4] = {
         X86_OP_ENTRY3(VMOVHLPS,  V,dq, H,dq,       U,dq, vex7),
-        X86_OP_ENTRY3(VMOVLPx,   W,x,  H,x,        U,q,  vex5), /* MOVLPD */
+        X86_OP_ENTRY3(VMOVLPx,   W,dq, H,dq,       U,q,  vex5), /* MOVLPD */
         X86_OP_ENTRY3(VMOVSLDUP, V,x,  None,None,  U,x,  vex4 cpuid(SSE3)),
         X86_OP_ENTRY3(VMOVDDUP,  V,x,  None,None,  U,x,  vex5 cpuid(SSE3)),
     };
@@ -1341,7 +1341,7 @@ static const X86OpEntry opcodes_0F[256] = {
     [0x6b] = X86_OP_ENTRY3(PACKSSDW,   V,x, H,x, W,x,  vex4 mmx avx2_256 p_00_66),
     [0x6c] = X86_OP_ENTRY3(PUNPCKLQDQ, V,x, H,x, W,x,  vex4 p_66 avx2_256),
     [0x6d] = X86_OP_ENTRY3(PUNPCKHQDQ, V,x, H,x, W,x,  vex4 p_66 avx2_256),
-    [0x6e] = X86_OP_ENTRY3(MOVD_to,    V,x, None,None, E,y, vex5 mmx p_00_66),  /* wrong dest Vy on SDM! */
+    [0x6e] = X86_OP_ENTRY3(MOVD_to,    V,dq,None,None, E,y, vex5 mmx p_00_66),  /* wrong dest Vy on SDM! */
     [0x6f] = X86_OP_GROUP0(0F6F),
 
     [0x78] = X86_OP_GROUP0(0F78),

From 8aee37581eff2260ccee1ce7ebccfc9a88b45459 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
Date: Mon, 19 Jan 2026 13:55:28 +0000
Subject: [PATCH 2366/2396] gitlab: preserve base rules for container template
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When extending the container template to allow scheduled pipelines in
upstream context, we must ensure that all the existing rules defined
by .base_job_template are preserved.

Fortunately since the new rule for scheduled pipelines can come at
the head of all other rules, not in the middle, we can just the obscure
'!reference' syntax to pull in all the pre-existing rules as a single
block.

This fixes

 * stable branches using the wrong tag name in container images
 * pushes to forks unconditionally running container builds

Fixes: 8bec7b9874235e60f14172618121c60fdbd39302
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Tested-by: Michael Tokarev <mjt@tls.msk.ru>
Fixes: 8bec7b987423 ("gitlab: add a weekly container building job")
Message-ID: <20260119135528.2738108-1-berrange@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
(cherry picked from commit 815567b4ea35176a8f92c5f25bfb335c1cac274e)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 .gitlab-ci.d/container-template.yml | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/.gitlab-ci.d/container-template.yml b/.gitlab-ci.d/container-template.yml
index 82c1b69e8d..8c7311cca5 100644
--- a/.gitlab-ci.d/container-template.yml
+++ b/.gitlab-ci.d/container-template.yml
@@ -21,6 +21,5 @@
     - docker logout
   rules:
     # because we want to enable this for scheduled runs we also have to replicate the normal rules
-    - if: '$CI_PIPELINE_SOURCE == "schedule"'
-    - if: '$CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM && $CI_COMMIT_BRANCH =~ /^staging/'
-    - if: '$QEMU_CI && $CI_PROJECT_NAMESPACE != $QEMU_CI_UPSTREAM'
+    - if: '$CI_PIPELINE_SOURCE == "schedule" && $CI_PROJECT_NAMESPACE == $QEMU_CI_UPSTREAM'
+    - !reference [.base_job_template, rules]

From 49d3f1381d5c01897de6d3ee91492171ea000849 Mon Sep 17 00:00:00 2001
From: Thomas Huth <thuth@redhat.com>
Date: Wed, 21 Jan 2026 08:48:19 +0100
Subject: [PATCH 2367/2396] pc-bios/optionrom: Use 32-bit linker emulation for
 the optionroms
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Without this linker flag, the linking fails on NetBSD v10.1 with:

 ld: i386 architecture of input file `multiboot.o' is incompatible with i386:x86-64 output
 ld: i386 architecture of input file `multiboot_dma.o' is incompatible with i386:x86-64 output

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Message-ID: <20260121074819.29396-1-thuth@redhat.com>
(cherry picked from commit e4f1a9b1dacb4d02500629056551b1db2985429c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 pc-bios/optionrom/Makefile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pc-bios/optionrom/Makefile b/pc-bios/optionrom/Makefile
index 30d07026c7..e6674a76e7 100644
--- a/pc-bios/optionrom/Makefile
+++ b/pc-bios/optionrom/Makefile
@@ -36,7 +36,7 @@ config-cc.mak: Makefile
 	    $(call cc-option,-Wno-array-bounds)) 3> config-cc.mak
 -include config-cc.mak
 
-override LDFLAGS = -nostdlib -Wl,--build-id=none,-T,$(SRC_DIR)/flat.lds
+override LDFLAGS = -nostdlib -Wl,--build-id=none,-T,$(SRC_DIR)/flat.lds,-m,elf_i386
 
 pvh.img: pvh.o pvh_main.o
 

From 92e6f2782942a900fdeabf2d58ddd101e1f87990 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Alex=20Benn=C3=A9e?= <alex.bennee@linaro.org>
Date: Wed, 28 Jan 2026 10:58:39 +0000
Subject: [PATCH 2368/2396] tests/functional: migrate sbsa_ref test images
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

As the builds in codelinaro.org are going away migrate the binaries to
share.linaro.org. As the hotlinks don't encode the filename we need to
explicitly tell uncompress how to handle the files.

Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Message-ID: <20260128105839.3487840-3-alex.bennee@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
(cherry picked from commit d9ca273f8f31acb22d3f5aca5f063b94fb962e19)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/functional/aarch64/test_sbsaref.py | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/tests/functional/aarch64/test_sbsaref.py b/tests/functional/aarch64/test_sbsaref.py
index d3402f5080..3ff674039e 100755
--- a/tests/functional/aarch64/test_sbsaref.py
+++ b/tests/functional/aarch64/test_sbsaref.py
@@ -31,10 +31,10 @@ def fetch_firmware(test):
     """
 
     # Secure BootRom (TF-A code)
-    fs0_path = test.uncompress(Aarch64SbsarefMachine.ASSET_FLASH0)
+    fs0_path = test.uncompress(Aarch64SbsarefMachine.ASSET_FLASH0, format="xz")
 
     # Non-secure rom (UEFI and EFI variables)
-    fs1_path = test.uncompress(Aarch64SbsarefMachine.ASSET_FLASH1)
+    fs1_path = test.uncompress(Aarch64SbsarefMachine.ASSET_FLASH1, format="xz")
 
     for path in [fs0_path, fs1_path]:
         with open(path, "ab+") as fd:
@@ -54,15 +54,13 @@ class Aarch64SbsarefMachine(QemuSystemTest):
 
     timeout = 180
 
-    ASSET_FLASH0 = Asset(
-        ('https://artifacts.codelinaro.org/artifactory/linaro-419-sbsa-ref/'
-         '20241122-189881/edk2/SBSA_FLASH0.fd.xz'),
-        '76eb89d42eebe324e4395329f47447cda9ac920aabcf99aca85424609c3384a5')
+    # SBSA_FLASH0.fd.xz
+    ASSET_FLASH0 = Asset('https://share.linaro.org/downloadFile?id=kyoMLGC9zXa4oA7',
+                         '76eb89d42eebe324e4395329f47447cda9ac920aabcf99aca85424609c3384a5')
 
-    ASSET_FLASH1 = Asset(
-        ('https://artifacts.codelinaro.org/artifactory/linaro-419-sbsa-ref/'
-         '20241122-189881/edk2/SBSA_FLASH1.fd.xz'),
-        'f850f243bd8dbd49c51e061e0f79f1697546938f454aeb59ab7d93e5f0d412fc')
+    # SBSA_FLASH1.fd.xz
+    ASSET_FLASH1 = Asset('https://share.linaro.org/downloadFile?id=Dj1HRXnDnKtU6Nj',
+                         'f850f243bd8dbd49c51e061e0f79f1697546938f454aeb59ab7d93e5f0d412fc')
 
     def test_sbsaref_edk2_firmware(self):
 

From cce96e6052d48cfdeba545c6bdf330948e6889f9 Mon Sep 17 00:00:00 2001
From: Jeuk Kim <jeuk20.kim@samsung.com>
Date: Mon, 2 Feb 2026 14:31:03 +0900
Subject: [PATCH 2369/2396] hw/ufs: Ensure DBC of PRDT uses only lower 18 bits

The UFS spec defines the PRDT data byte count as an 18-bit field. This
commit masks the value to the lower 18 bits to prevent incorrect
transfer lengths and ensure compliance.

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
(cherry picked from commit 289e6a3edf5041a9f96c3fb792845b94b5b3c666)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ufs/ufs.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index 0577747f46..58099a554e 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -224,7 +224,8 @@ static MemTxResult ufs_dma_read_prdt(UfsRequest *req)
 
     for (uint16_t i = 0; i < prdt_len; ++i) {
         hwaddr data_dma_addr = le64_to_cpu(prd_entries[i].addr);
-        uint32_t data_byte_count = le32_to_cpu(prd_entries[i].size) + 1;
+        uint32_t data_byte_count =
+            (le32_to_cpu(prd_entries[i].size) & 0x3ffff) + 1;
         qemu_sglist_add(req->sg, data_dma_addr, data_byte_count);
         req->data_len += data_byte_count;
     }

From 88ef8726ffc2189683bda9f10a5ea61b6239304c Mon Sep 17 00:00:00 2001
From: Jeuk Kim <jeuk20.kim@samsung.com>
Date: Tue, 27 Jan 2026 14:02:50 +0900
Subject: [PATCH 2370/2396] hw/ufs: fix CQE endianness and UPIU length

Round-trip UTRD fields through cpu_to_le/ le_to_cpu when building MCQ CQEs to
keep BE hosts correct. Also avoid double BE conversion of response
data_segment_length and document the LE round-trip.

Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
(cherry picked from commit ed621cc8e2a6dab2663ffb02e875f896f521bee2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ufs/lu.c         |  3 +--
 hw/ufs/ufs.c        | 27 ++++++++++++++++++---------
 include/block/ufs.h |  2 +-
 3 files changed, 20 insertions(+), 12 deletions(-)

diff --git a/hw/ufs/lu.c b/hw/ufs/lu.c
index 2d8ffd72c5..3f3c9589ce 100644
--- a/hw/ufs/lu.c
+++ b/hw/ufs/lu.c
@@ -53,8 +53,7 @@ static void ufs_build_scsi_response_upiu(UfsRequest *req, uint8_t *sense,
         response = UFS_COMMAND_RESULT_FAIL;
     }
 
-    data_segment_length =
-        cpu_to_be16(sense_len + sizeof(req->rsp_upiu.sr.sense_data_len));
+    data_segment_length = sense_len + sizeof(req->rsp_upiu.sr.sense_data_len);
     ufs_build_upiu_header(req, UFS_UPIU_TRANSACTION_RESPONSE, flags, response,
                           status, data_segment_length);
 }
diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index 58099a554e..128e2b1ea8 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -449,15 +449,24 @@ static void ufs_mcq_process_cq(void *opaque)
     {
         ufs_dma_write_rsp_upiu(req);
 
-        req->cqe.utp_addr =
-            ((uint64_t)req->utrd.command_desc_base_addr_hi << 32ULL) |
-            req->utrd.command_desc_base_addr_lo;
-        req->cqe.utp_addr |= req->sq->sqid;
-        req->cqe.resp_len = req->utrd.response_upiu_length;
-        req->cqe.resp_off = req->utrd.response_upiu_offset;
-        req->cqe.prdt_len = req->utrd.prd_table_length;
-        req->cqe.prdt_off = req->utrd.prd_table_offset;
-        req->cqe.status = req->utrd.header.dword_2 & 0xf;
+        /* UTRD/CQE are LE; round-trip through host to keep BE correct. */
+        uint64_t ucdba =
+            ((uint64_t)le32_to_cpu(req->utrd.command_desc_base_addr_hi)
+             << 32ULL) |
+            le32_to_cpu(req->utrd.command_desc_base_addr_lo);
+        uint16_t resp_len = le16_to_cpu(req->utrd.response_upiu_length);
+        uint16_t resp_off = le16_to_cpu(req->utrd.response_upiu_offset);
+        uint16_t prdt_len = le16_to_cpu(req->utrd.prd_table_length);
+        uint16_t prdt_off = le16_to_cpu(req->utrd.prd_table_offset);
+        uint8_t status = le32_to_cpu(req->utrd.header.dword_2) & UFS_MASK_OCS;
+
+        ucdba |= req->sq->sqid;
+        req->cqe.utp_addr = cpu_to_le64(ucdba);
+        req->cqe.resp_len = cpu_to_le16(resp_len);
+        req->cqe.resp_off = cpu_to_le16(resp_off);
+        req->cqe.prdt_len = cpu_to_le16(prdt_len);
+        req->cqe.prdt_off = cpu_to_le16(prdt_off);
+        req->cqe.status = status;
         req->cqe.error = 0;
 
         ret = ufs_addr_write(u, cq->addr + tail, &req->cqe, sizeof(req->cqe));
diff --git a/include/block/ufs.h b/include/block/ufs.h
index a3ee62b027..22dc379eaa 100644
--- a/include/block/ufs.h
+++ b/include/block/ufs.h
@@ -645,7 +645,7 @@ enum UtpOcsCodes {
 };
 
 enum {
-    UFS_MASK_OCS = 0x0F,
+    UFS_MASK_OCS = 0xFF,
 };
 
 /*

From ad5f6ffcd042ff309ae9f0052518f87c54da280d Mon Sep 17 00:00:00 2001
From: Ilia Levi <ilia.levi@intel.com>
Date: Mon, 22 Dec 2025 14:35:58 +0200
Subject: [PATCH 2371/2396] hw/ufs: Fix mcq completion queue wraparound

Currently, ufs_mcq_process_cq() writes to the CQ without checking whether
there is available space. This can cause CQ entries to be discarded and
overwritten. The solution is to stop writing when CQ is full and exert
backpressure on the affected SQs. This is similar to how NVMe CQs operate.

Signed-off-by: Ilia Levi <ilia.levi@intel.com>
Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
(cherry picked from commit f78762a3cc81ca9842907a5fc1b2280083ac51ba)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/ufs/ufs.c | 20 +++++++++++++++++++-
 hw/ufs/ufs.h |  9 +++++++++
 2 files changed, 28 insertions(+), 1 deletion(-)

diff --git a/hw/ufs/ufs.c b/hw/ufs/ufs.c
index 128e2b1ea8..8fdc0854eb 100644
--- a/hw/ufs/ufs.c
+++ b/hw/ufs/ufs.c
@@ -447,6 +447,10 @@ static void ufs_mcq_process_cq(void *opaque)
 
     QTAILQ_FOREACH_SAFE(req, &cq->req_list, entry, next)
     {
+        if (ufs_mcq_cq_full(u, cq->cqid)) {
+            break;
+        }
+
         ufs_dma_write_rsp_upiu(req);
 
         /* UTRD/CQE are LE; round-trip through host to keep BE correct. */
@@ -478,6 +482,12 @@ static void ufs_mcq_process_cq(void *opaque)
         tail = (tail + sizeof(req->cqe)) % (cq->size * sizeof(req->cqe));
         ufs_mcq_update_cq_tail(u, cq->cqid, tail);
 
+        if (QTAILQ_EMPTY(&req->sq->req_list) &&
+            !ufs_mcq_sq_empty(u, req->sq->sqid)) {
+            /* Dequeueing from SQ was blocked due to lack of free requests */
+            qemu_bh_schedule(req->sq->bh);
+        }
+
         ufs_clear_req(req);
         QTAILQ_INSERT_TAIL(&req->sq->req_list, req, entry);
     }
@@ -787,10 +797,18 @@ static void ufs_write_mcq_op_reg(UfsHc *u, hwaddr offset, uint32_t data,
         }
         opr->sq.tp = data;
         break;
-    case offsetof(UfsMcqOpReg, cq.hp):
+    case offsetof(UfsMcqOpReg, cq.hp): {
+        UfsCq *cq = u->cq[qid];
+
+        if (ufs_mcq_cq_full(u, qid) && !QTAILQ_EMPTY(&cq->req_list)) {
+            /* Enqueueing to CQ was blocked because it was full */
+            qemu_bh_schedule(cq->bh);
+        }
+
         opr->cq.hp = data;
         ufs_mcq_update_cq_head(u, qid, data);
         break;
+    }
     case offsetof(UfsMcqOpReg, cq_int.is):
         opr->cq_int.is &= ~data;
         break;
diff --git a/hw/ufs/ufs.h b/hw/ufs/ufs.h
index 3799d97f30..13d964c5ae 100644
--- a/hw/ufs/ufs.h
+++ b/hw/ufs/ufs.h
@@ -200,6 +200,15 @@ static inline bool ufs_mcq_cq_empty(UfsHc *u, uint32_t qid)
     return ufs_mcq_cq_tail(u, qid) == ufs_mcq_cq_head(u, qid);
 }
 
+static inline bool ufs_mcq_cq_full(UfsHc *u, uint32_t qid)
+{
+    uint32_t tail = ufs_mcq_cq_tail(u, qid);
+    uint16_t cq_size = u->cq[qid]->size;
+
+    tail = (tail + sizeof(UfsCqEntry)) % (sizeof(UfsCqEntry) * cq_size);
+    return tail == ufs_mcq_cq_head(u, qid);
+}
+
 #define TYPE_UFS "ufs"
 #define UFS(obj) OBJECT_CHECK(UfsHc, (obj), TYPE_UFS)
 

From 0c2fd08dc88d7cc7755ad67bd3248ac748e87f2c Mon Sep 17 00:00:00 2001
From: Ilia Levi <ilia.levi@intel.com>
Date: Mon, 22 Dec 2025 14:35:59 +0200
Subject: [PATCH 2372/2396] tests/qtest/ufs-test: Add test for mcq completion
 queue wraparound

Added a test that sends 32 NOP Out commands asynchronously. Since the CQ
has 31 entries by default, this tests the scenario where CQ processing
needs to wait for space to become available.

Additionally, added two minor fixes to existing tests:
* advance CQ head after reading from CQ
* initialize command descriptor slots bitmap in ufs_init()

Signed-off-by: Ilia Levi <ilia.levi@intel.com>
Acked-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Jeuk Kim <jeuk20.kim@samsung.com>
Signed-off-by: Jeuk Kim <jeuk20.kim@samsung.com>
(cherry picked from commit 94e72135d4d657d672561b1ae02a5854421616a7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 tests/qtest/ufs-test.c | 126 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 126 insertions(+)

diff --git a/tests/qtest/ufs-test.c b/tests/qtest/ufs-test.c
index 4867ccf08a..ff9835735c 100644
--- a/tests/qtest/ufs-test.c
+++ b/tests/qtest/ufs-test.c
@@ -166,6 +166,7 @@ __ufs_send_transfer_request_mcq(QUfs *ufs, uint8_t lun,
     cqhp = ufs_rreg(ufs, ufs->cqdao[TEST_QID]);
     cqentry_addr = ufs->cqlba[TEST_QID] + cqhp;
     qtest_memread(ufs->dev.bus->qts, cqentry_addr, &cqentry, sizeof(cqentry));
+    cqhp = (cqhp + sizeof(UfsCqEntry)) % (QUEUE_SIZE * sizeof(UfsCqEntry));
     ufs_wreg(ufs, ufs->cqdao[TEST_QID], cqhp);
 
     return cqentry.status;
@@ -208,6 +209,81 @@ static enum UtpOcsCodes ufs_send_nop_out(QUfs *ufs, UtpUpiuRsp *rsp_out)
     return ret;
 }
 
+static bool ufs_mcq_sq_has_space(QUfs *ufs)
+{
+    uint32_t sqhp = ufs_rreg(ufs, ufs->sqdao[TEST_QID]);
+    uint32_t sqtp = ufs_rreg(ufs, ufs->sqdao[TEST_QID] + 0x4);
+    uint32_t next_sqtp =
+        (sqtp + sizeof(UfsSqEntry)) % (QUEUE_SIZE * sizeof(UfsSqEntry));
+    return next_sqtp != sqhp;
+}
+
+static void
+__ufs_send_transfer_request_mcq_async(QUfs *ufs, uint8_t lun,
+                                      const UtpTransferReqDesc *utrd)
+{
+    uint32_t sqtp;
+    uint64_t utrd_addr;
+
+    /* Wait for SQ space */
+    while (!ufs_mcq_sq_has_space(ufs)) {
+        qtest_clock_step(ufs->dev.bus->qts, 100);
+    }
+
+    sqtp = ufs_rreg(ufs, ufs->sqdao[TEST_QID] + 0x4);
+    utrd_addr = ufs->sqlba[TEST_QID] + sqtp;
+    qtest_memwrite(ufs->dev.bus->qts, utrd_addr, utrd, sizeof(*utrd));
+    sqtp = (sqtp + sizeof(UfsSqEntry)) % (QUEUE_SIZE * sizeof(UfsSqEntry));
+    ufs_wreg(ufs, ufs->sqdao[TEST_QID] + 0x4, sqtp);
+}
+
+static int ufs_mcq_send_nop_out_async(QUfs *ufs)
+{
+    int cmd_desc_slot = alloc_cmd_desc_slot(ufs);
+    uint64_t req_upiu_addr =
+        ufs->cmd_desc_addr + cmd_desc_slot * UTP_COMMAND_DESCRIPTOR_SIZE;
+
+    /* Build up request upiu */
+    UtpUpiuReq req_upiu = { 0 };
+    req_upiu.header.trans_type = UFS_UPIU_TRANSACTION_NOP_OUT;
+    req_upiu.header.task_tag = cmd_desc_slot;
+    qtest_memwrite(ufs->dev.bus->qts, req_upiu_addr, &req_upiu,
+                   sizeof(req_upiu));
+
+    /* Build up utp transfer request descriptor */
+    UtpTransferReqDesc utrd =
+        ufs_build_req_utrd(req_upiu_addr, UFS_UTP_NO_DATA_TRANSFER, 0);
+
+    /* Send Transfer Request */
+    __ufs_send_transfer_request_mcq_async(ufs, 0, &utrd);
+
+    return cmd_desc_slot;
+}
+
+static int ufs_mcq_poll_cq(QUfs *ufs, UfsCqEntry *cqe, uint16_t n_cqe)
+{
+    uint32_t cqhp, cqtp;
+    uint64_t cqe_addr;
+    int ix = 0;
+
+    cqhp = ufs_rreg(ufs, ufs->cqdao[TEST_QID]);
+    cqtp = ufs_rreg(ufs, ufs->cqdao[TEST_QID] + 0x4);
+
+    while (cqhp != cqtp && ix < n_cqe) {
+        /* read completion entry */
+        cqe_addr = ufs->cqlba[TEST_QID] + cqhp;
+        qtest_memread(ufs->dev.bus->qts, cqe_addr, &cqe[ix], sizeof(cqe[ix]));
+
+        /* advance completion queue head pointer */
+        cqhp = (cqhp + sizeof(UfsCqEntry)) % (QUEUE_SIZE * sizeof(UfsCqEntry));
+        ix++;
+    }
+
+    ufs_wreg(ufs, ufs->cqdao[TEST_QID], cqhp);
+
+    return ix;
+}
+
 static enum UtpOcsCodes ufs_send_query(QUfs *ufs, uint8_t query_function,
                                        uint8_t query_opcode, uint8_t idn,
                                        uint8_t index, uint8_t selector,
@@ -416,6 +492,7 @@ static void ufs_init(QUfs *ufs, QGuestAllocator *alloc)
     ufs_wreg(ufs, A_UTRIACR, 0);
 
     /* Enable transfer request */
+    bitmap_zero(ufs->cmd_desc_bitmap, UFS_MAX_CMD_DESC);
     ufs->cmd_desc_addr =
         guest_alloc(alloc, UFS_MAX_CMD_DESC * UTP_COMMAND_DESCRIPTOR_SIZE);
     ufs->data_buffer_addr =
@@ -679,6 +756,53 @@ static void ufstest_read_write(void *obj, void *data, QGuestAllocator *alloc)
     ufs_exit(ufs, alloc);
 }
 
+static void ufstest_mcq_cq_wraparound(void *obj, void *data,
+                                      QGuestAllocator *alloc)
+{
+    QUfs *ufs = obj;
+    UfsCqEntry cqe[QUEUE_SIZE];
+    const int num_requests = QUEUE_SIZE;
+    int i, completed = 0;
+
+    ufs_init(ufs, alloc);
+
+    /* Ensure MCQ is supported */
+    g_assert_true(ufs->support_mcq);
+
+    for (i = 0; i < num_requests; ++i) {
+        ufs_mcq_send_nop_out_async(ufs);
+    }
+
+    while (completed != num_requests) {
+        int n_cqe = ufs_mcq_poll_cq(ufs, cqe, ARRAY_SIZE(cqe));
+        if (!n_cqe) {
+            break;
+        }
+
+        for (i = 0; i < n_cqe; ++i) {
+            uint64_t ucdba;
+            uint64_t rsp_upiu_addr;
+            UtpUpiuRsp rsp_upiu;
+            uint8_t tag;
+
+            g_assert_cmpuint(cqe[i].status, ==, UFS_OCS_SUCCESS);
+
+            ucdba = le64_to_cpu(cqe[i].utp_addr) & MAKE_64BIT_MASK(7, 57);
+            rsp_upiu_addr = ucdba + UTP_RESPONSE_UPIU_OFFSET;
+            qtest_memread(ufs->dev.bus->qts, rsp_upiu_addr, &rsp_upiu,
+                          sizeof(rsp_upiu));
+
+            tag = rsp_upiu.header.task_tag;
+            release_cmd_desc_slot(ufs, tag);
+        }
+
+        completed += n_cqe;
+    }
+
+    g_assert_cmpint(completed, ==, num_requests);
+    ufs_exit(ufs, alloc);
+}
+
 static void ufstest_query_flag_request(void *obj, void *data,
                                        QGuestAllocator *alloc)
 {
@@ -1129,6 +1253,8 @@ static void ufs_register_nodes(void)
     qos_add_test("init", "ufs", ufstest_init, NULL);
     qos_add_test("legacy-read-write", "ufs", ufstest_read_write, &io_test_opts);
     qos_add_test("mcq-read-write", "ufs", ufstest_read_write, &mcq_test_opts);
+    qos_add_test("mcq-cq-wraparound", "ufs", ufstest_mcq_cq_wraparound,
+                 &mcq_test_opts);
     qos_add_test("query-flag", "ufs", ufstest_query_flag_request,
                  &io_test_opts);
     qos_add_test("query-attribute", "ufs", ufstest_query_attr_request,

From a2fbfefbb7156487608b7a34cb1f194bebc2229a Mon Sep 17 00:00:00 2001
From: John Snow <jsnow@redhat.com>
Date: Fri, 30 Jan 2026 00:05:18 -0500
Subject: [PATCH 2373/2396] python: fix msys64 wheel directory specification

In python3.14, fixes were made to the file URI parsing [1] such that
file URIs that used to work but were technically out of spec are now
broken.

As a result, our msys2 GitLab CI tests began failing.

Stop using "file://" URI links in favor of simple paths (Thanks pbo) to
fix parsing errors under Python 3.14 and fix the msys2 GitLab CI tests.

[1] https://docs.python.org/3/whatsnew/3.14.html#urllib

Reported-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Suggested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: John Snow <jsnow@redhat.com>
Reviewed-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Tested-by: Pierrick Bouvier <pierrick.bouvier@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260130050518.517688-2-jsnow@redhat.com>
(cherry picked from commit 587f4a1805c83a4e1d59dd43cb14e0a834843d1d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 python/scripts/mkvenv.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/python/scripts/mkvenv.py b/python/scripts/mkvenv.py
index a064709e6c..5cba5770d2 100644
--- a/python/scripts/mkvenv.py
+++ b/python/scripts/mkvenv.py
@@ -683,7 +683,7 @@ def pip_install(
     if not online:
         full_args += ["--no-index"]
     if wheels_dir:
-        full_args += ["--find-links", f"file://{str(wheels_dir)}"]
+        full_args += ["--find-links", str(wheels_dir)]
     full_args += list(args)
     subprocess.run(
         full_args,

From 89f7d4fb13d9ee2263c98b300b67e06accff89e2 Mon Sep 17 00:00:00 2001
From: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Date: Sun, 25 Jan 2026 15:42:47 +0900
Subject: [PATCH 2374/2396] hw/nvme: Fix bootindex suffix use-after-free
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The bootindex suffix can be used as long as the property is alive.

Signed-off-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-ID: <20260125-nvme-v1-5-0658c31fade9@rsg.ci.i.u-tokyo.ac.jp>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
(cherry picked from commit eda9baa17a2854494709a8094419ba6a6901721d)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/nvme/ns.c   | 7 +++----
 hw/nvme/nvme.h | 1 +
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/nvme/ns.c b/hw/nvme/ns.c
index 58800b3414..38f86a1726 100644
--- a/hw/nvme/ns.c
+++ b/hw/nvme/ns.c
@@ -944,12 +944,11 @@ static void nvme_ns_class_init(ObjectClass *oc, const void *data)
 static void nvme_ns_instance_init(Object *obj)
 {
     NvmeNamespace *ns = NVME_NS(obj);
-    char *bootindex = g_strdup_printf("/namespace@%d,0", ns->params.nsid);
+
+    sprintf(ns->bootindex_suffix, "/namespace@%" PRIu32 ",0", ns->params.nsid);
 
     device_add_bootindex_property(obj, &ns->bootindex, "bootindex",
-                                  bootindex, DEVICE(obj));
-
-    g_free(bootindex);
+                                  ns->bootindex_suffix, DEVICE(obj));
 }
 
 static const TypeInfo nvme_ns_info = {
diff --git a/hw/nvme/nvme.h b/hw/nvme/nvme.h
index 8f8c78c850..d66f7dc82d 100644
--- a/hw/nvme/nvme.h
+++ b/hw/nvme/nvme.h
@@ -239,6 +239,7 @@ typedef struct NvmeNamespace {
     DeviceState  parent_obj;
     BlockConf    blkconf;
     int32_t      bootindex;
+    char         bootindex_suffix[24];
     int64_t      size;
     int64_t      moff;
     NvmeIdNs     id_ns;

From 8bf4744182148c8efc066770d9cb835054487dba Mon Sep 17 00:00:00 2001
From: Gerd Hoffmann <kraxel@redhat.com>
Date: Wed, 14 Jan 2026 11:47:45 +0100
Subject: [PATCH 2375/2396] hw/uefi: fix size negotiation

Payload size is the variable request size, not the total buffer size.
Take that into account and subtract header sizes.

Fixes: db1ecfb473ac ("hw/uefi: add var-service-vars.c")
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Message-ID: <20260114104745.3465860-1-kraxel@redhat.com>
(cherry picked from commit 46dee71a945d50639586ca3365be29aa9f368bfd)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/uefi/var-service-vars.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/uefi/var-service-vars.c b/hw/uefi/var-service-vars.c
index 8533533ea5..5607763525 100644
--- a/hw/uefi/var-service-vars.c
+++ b/hw/uefi/var-service-vars.c
@@ -592,7 +592,7 @@ uefi_vars_mm_get_payload_size(uefi_vars_state *uv, mm_header *mhdr,
         return uefi_vars_mm_error(mhdr, mvar, EFI_BAD_BUFFER_SIZE);
     }
 
-    ps->payload_size = uv->buf_size;
+    ps->payload_size = uv->buf_size - sizeof(*mhdr) - sizeof(*mvar);
     mvar->status = EFI_SUCCESS;
     return length;
 }

From d4c6c60993ac90fb72cb7abbba7ed5dc00dc893e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20Le=20Goater?= <clg@redhat.com>
Date: Mon, 26 Jan 2026 15:18:20 +0100
Subject: [PATCH 2376/2396] hw/adc: Fix out-of-bounds write in Aspeed ADC model
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The 'regs' array has ASPEED_ADC_NR_REGS (52) elements, while the
memory region covers offsets 0x00-0xFC. The aspeed_adc_engine_write()
function has an out-of-bounds write vulnerability when accessing
unimplemented registers.

Fix this by using 'return' instead of 'break' in the default case,
which prevents execution from reaching the s->regs[reg] assignment for
unimplemented registers.

Reported-by: Elhrj Saad <saadelhrj@gmail.com>
Fixes: 5857974d5d11 ("hw/adc: Add basic Aspeed ADC model")
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Link: https://lore.kernel.org/qemu-devel/20260126141820.719492-1-clg@redhat.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 4c6521296d2b6820ab1f8c59d3a80cd0c138b2d8)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/adc/aspeed_adc.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/adc/aspeed_adc.c b/hw/adc/aspeed_adc.c
index 3e820cae1e..5f2b8566f5 100644
--- a/hw/adc/aspeed_adc.c
+++ b/hw/adc/aspeed_adc.c
@@ -228,7 +228,8 @@ static void aspeed_adc_engine_write(void *opaque, hwaddr addr, uint64_t value,
         qemu_log_mask(LOG_UNIMP, "%s: engine[%u]: "
                       "0x%" HWADDR_PRIx " 0x%" PRIx64 "\n",
                       __func__, s->engine_id, addr, value);
-        break;
+        /* Do not update the regs[] array */
+        return;
     }
 
     s->regs[reg] = value;

From 2f46d99451b1e6e5102dae959f16e48175c4bb88 Mon Sep 17 00:00:00 2001
From: Nabih Estefan <nabihestefan@google.com>
Date: Tue, 20 Jan 2026 21:11:16 +0000
Subject: [PATCH 2377/2396] hw/i2c/aspeed_i2c.c: Add a check for dma_read
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If aspeed_i2c_dma_read fails in aspeed_i2c_bus_send currently, we get
stuck in an infinite retry loop. Add a check for the return value of
aspeed_i2c_dma_read that will break us out of said loop.

Signed-off-by: Nabih Estefan <nabihestefan@google.com>
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Fixes: 545d6bef7097 ("aspeed/i2c: Add support for DMA transfers")
Link: https://lore.kernel.org/qemu-devel/20260120211116.1367476-1-nabihestefan@google.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 0a1d4770670297a1da52118f84812e4a5ffc7722)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i2c/aspeed_i2c.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index 83fb906bdc..765a98b698 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -272,7 +272,11 @@ static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
         }
         while (bus->regs[reg_dma_len]) {
             uint8_t data;
-            aspeed_i2c_dma_read(bus, &data);
+            ret = aspeed_i2c_dma_read(bus, &data);
+            /* Check that we were able to read the DMA */
+            if (ret) {
+                break;
+            }
             trace_aspeed_i2c_bus_send("DMA", bus->regs[reg_dma_len],
                                       bus->regs[reg_dma_len], data);
             ret = i2c_send(bus->bus, data);

From 146214796cbd5a12b0cc3d0acae374292bd64c6d Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 3 Feb 2026 10:08:46 +0800
Subject: [PATCH 2378/2396] hw/arm/aspeed_ast27x0: Fix EHCI3/4 IRQ routing to
 GIC
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

EHCI3 and EHCI4 were missing entries in aspeed_soc_ast2700a1_irqmap,
so their source IRQs were never routed through the INTC OR-gates.

As a result, EHCI3/4 interrupts were not propagated to the GIC,
causing incorrect interrupt behavior for these controllers.

Add EHCI3 and EHCI4 to the IRQ map and route them to the same INTC
group as other shared peripherals, ensuring their interrupts are
properly connected to the GIC.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: ba27ba302a264117c8b8427f944ced1bed17c438 ("hw/arm: ast27x0: Wire up EHCI controllers")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260203020855.1642884-2-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 7d64f04863ed23f6a142fb8f47c5a470c0e081f9)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/arm/aspeed_ast27x0.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/aspeed_ast27x0.c b/hw/arm/aspeed_ast27x0.c
index 95f155fcf1..ff86020064 100644
--- a/hw/arm/aspeed_ast27x0.c
+++ b/hw/arm/aspeed_ast27x0.c
@@ -193,6 +193,8 @@ static const int aspeed_soc_ast2700a1_irqmap[] = {
     [ASPEED_DEV_ETH1]      = 196,
     [ASPEED_DEV_ETH2]      = 196,
     [ASPEED_DEV_ETH3]      = 196,
+    [ASPEED_DEV_EHCI3]     = 196,
+    [ASPEED_DEV_EHCI4]     = 196,
     [ASPEED_DEV_PECI]      = 197,
     [ASPEED_DEV_SDHCI]     = 197,
 };

From a66c02ea9d9cff0b0ad48254b24eba928fd0dfa4 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Fri, 2 Jan 2026 17:07:45 +0800
Subject: [PATCH 2379/2396] hw/i2c/aspeed: Fix wrong I2CC_DMA_LEN when
 I2CM_DMA_TX/RX_ADDR set first
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the previous design, the I2C model would update I2CC_DMA_LEN (0x54) based on
the value of I2CM_DMA_LEN (0x1C) when the firmware set either I2CM_DMA_TX_ADDR
(0x30) or I2CM_DMA_RX_ADDR (0x34). However, this only worked correctly if the
firmware set I2CM_DMA_LEN before setting I2CM_DMA_TX_ADDR or I2CM_DMA_RX_ADDR.

If the firmware instead set I2CM_DMA_TX_ADDR or I2CM_DMA_RX_ADDR before setting
I2CM_DMA_LEN, the value written to I2CC_DMA_LEN would be incorrect.

To fix this issue, the model should be updated to set I2CC_DMA_LEN when the
firmware writes to the I2CM_DMA_LEN register, rather than when it writes to the
I2CM_DMA_RX_ADDR and I2CM_DMA_TX_ADDR registers.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: ba2cccd64e90 ("aspeed: i2c: Add new mode support")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260102090746.1130033-4-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit 9cbd8ee7f67fceee51d3c993a282e5adc397b6b9)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i2c/aspeed_i2c.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index 765a98b698..93b8fd1661 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -660,8 +660,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         bus->dma_dram_offset =
             deposit64(bus->dma_dram_offset, 0, 32,
                       FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR));
-        bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
-                                                     TX_BUF_LEN) + 1;
         break;
     case A_I2CM_DMA_RX_ADDR:
         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
@@ -669,8 +667,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         bus->dma_dram_offset =
             deposit64(bus->dma_dram_offset, 0, 32,
                       FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR));
-        bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs, I2CM_DMA_LEN,
-                                                     RX_BUF_LEN) + 1;
         break;
     case A_I2CM_DMA_LEN:
         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
@@ -683,10 +679,16 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         if (FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T)) {
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, RX_BUF_LEN,
                              FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN));
+            bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs,
+                                                         I2CM_DMA_LEN,
+                                                         RX_BUF_LEN) + 1;
         }
         if (FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN_W1T)) {
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN, TX_BUF_LEN,
                              FIELD_EX32(value, I2CM_DMA_LEN, TX_BUF_LEN));
+            bus->regs[R_I2CC_DMA_LEN] = ARRAY_FIELD_EX32(bus->regs,
+                                                         I2CM_DMA_LEN,
+                                                         TX_BUF_LEN) + 1;
         }
         break;
     case A_I2CM_DMA_LEN_STS:

From 0b1ddf19d0b7033cd584b4294b9179f538502097 Mon Sep 17 00:00:00 2001
From: Jamin Lin <jamin_lin@aspeedtech.com>
Date: Tue, 3 Feb 2026 10:08:49 +0800
Subject: [PATCH 2380/2396] hw/i2c/aspeed_i2c: Fix DMA moving data into
 incorrect address
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In the previous design, the I2C model updated dma_dram_offset only when
firmware programmed the RX/TX DMA buffer address registers. The firmware
used to rewrite these registers before issuing each DMA command.

The firmware driver behavior has changed to program the DMA address
registers only once during I2C initialization. As a result, the I2C model
no longer refreshes dma_dram_offset, causing DMA to move data into an
incorrect DRAM address.

Fix this by introducing helper functions to update dma_dram_offset from
the DMA address registers, and invoke them right before handling TX/RX
DMA operations. This guarantees DMA always uses the correct buffer
address even if the registers are programmed only once.

Signed-off-by: Jamin Lin <jamin_lin@aspeedtech.com>
Fixes: c400c38854017eeccda63115814eba4c3ef2b51f ("hw/i2c/aspeed: Introduce a new dma_dram_offset attribute in AspeedI2Cbus")
Reviewed-by: Cédric Le Goater <clg@redhat.com>
Link: https://lore.kernel.org/qemu-devel/20260203020855.1642884-5-jamin_lin@aspeedtech.com
Signed-off-by: Cédric Le Goater <clg@redhat.com>
(cherry picked from commit efea7ddb4689a1ac4bce63a9ddb32887c7f3ac50)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/i2c/aspeed_i2c.c | 87 +++++++++++++++++++++++++++++++--------------
 1 file changed, 61 insertions(+), 26 deletions(-)

diff --git a/hw/i2c/aspeed_i2c.c b/hw/i2c/aspeed_i2c.c
index 93b8fd1661..c48fa2050b 100644
--- a/hw/i2c/aspeed_i2c.c
+++ b/hw/i2c/aspeed_i2c.c
@@ -116,8 +116,6 @@ static uint64_t aspeed_i2c_bus_old_read(AspeedI2CBus *bus, hwaddr offset,
             value = -1;
             break;
         }
-
-        value = extract64(bus->dma_dram_offset, 0, 32);
         break;
     case A_I2CD_DMA_LEN:
         if (!aic->has_dma) {
@@ -221,6 +219,64 @@ static uint8_t aspeed_i2c_get_state(AspeedI2CBus *bus)
     return SHARED_ARRAY_FIELD_EX32(bus->regs, R_I2CD_CMD, TX_STATE);
 }
 
+/*
+ * The AST2700 support the maximum DRAM size is 8 GB.
+ * The DRAM offset range is from 0x0_0000_0000 to
+ * 0x1_FFFF_FFFF and it is enough to use bits [33:0]
+ * saving the dram offset.
+ * Therefore, save the high part physical address bit[1:0]
+ * of Tx/Rx buffer address as dma_dram_offset bit[33:32].
+ */
+static void aspeed_i2c_set_tx_dma_dram_offset(AspeedI2CBus *bus)
+{
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
+    uint32_t value;
+
+    assert(aic->has_dma);
+
+    if (aspeed_i2c_is_new_mode(bus->controller)) {
+        value = bus->regs[R_I2CM_DMA_TX_ADDR];
+        bus->dma_dram_offset =
+            deposit64(bus->dma_dram_offset, 0, 32,
+                      FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR));
+        if (!aic->has_dma64) {
+            value = bus->regs[R_I2CM_DMA_TX_ADDR_HI];
+            bus->dma_dram_offset =
+                deposit64(bus->dma_dram_offset, 32, 32,
+                          extract32(value, 0, 2));
+        }
+    } else {
+        value = bus->regs[R_I2CD_DMA_ADDR];
+        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 0, 32,
+                                         value & 0x3ffffffc);
+    }
+}
+
+static void aspeed_i2c_set_rx_dma_dram_offset(AspeedI2CBus *bus)
+{
+    AspeedI2CClass *aic = ASPEED_I2C_GET_CLASS(bus->controller);
+    uint32_t value;
+
+    assert(aic->has_dma);
+
+    if (aspeed_i2c_is_new_mode(bus->controller)) {
+        value = bus->regs[R_I2CM_DMA_RX_ADDR];
+        bus->dma_dram_offset =
+            deposit64(bus->dma_dram_offset, 0, 32,
+                      FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR));
+        if (!aic->has_dma64) {
+            value = bus->regs[R_I2CM_DMA_RX_ADDR_HI];
+            bus->dma_dram_offset =
+                deposit64(bus->dma_dram_offset, 32, 32,
+                          extract32(value, 0, 2));
+        }
+    } else {
+        value = bus->regs[R_I2CD_DMA_ADDR];
+        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 0, 32,
+                                         value & 0x3ffffffc);
+    }
+}
+
 static int aspeed_i2c_dma_read(AspeedI2CBus *bus, uint8_t *data)
 {
     MemTxResult result;
@@ -270,6 +326,7 @@ static int aspeed_i2c_bus_send(AspeedI2CBus *bus)
         if (aspeed_i2c_is_new_mode(bus->controller)) {
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, TX_LEN, 0);
         }
+        aspeed_i2c_set_tx_dma_dram_offset(bus);
         while (bus->regs[reg_dma_len]) {
             uint8_t data;
             ret = aspeed_i2c_dma_read(bus, &data);
@@ -335,6 +392,7 @@ static void aspeed_i2c_bus_recv(AspeedI2CBus *bus)
             ARRAY_FIELD_DP32(bus->regs, I2CM_DMA_LEN_STS, RX_LEN, 0);
         }
 
+        aspeed_i2c_set_rx_dma_dram_offset(bus);
         while (bus->regs[reg_dma_len]) {
             MemTxResult result;
 
@@ -401,6 +459,7 @@ static uint8_t aspeed_i2c_get_addr(AspeedI2CBus *bus)
     } else if (SHARED_ARRAY_FIELD_EX32(bus->regs, reg_cmd, TX_DMA_EN)) {
         uint8_t data;
 
+        aspeed_i2c_set_tx_dma_dram_offset(bus);
         aspeed_i2c_dma_read(bus, &data);
         return data;
     } else {
@@ -657,16 +716,10 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
     case A_I2CM_DMA_TX_ADDR:
         bus->regs[R_I2CM_DMA_TX_ADDR] = FIELD_EX32(value, I2CM_DMA_TX_ADDR,
                                                    ADDR);
-        bus->dma_dram_offset =
-            deposit64(bus->dma_dram_offset, 0, 32,
-                      FIELD_EX32(value, I2CM_DMA_TX_ADDR, ADDR));
         break;
     case A_I2CM_DMA_RX_ADDR:
         bus->regs[R_I2CM_DMA_RX_ADDR] = FIELD_EX32(value, I2CM_DMA_RX_ADDR,
                                                    ADDR);
-        bus->dma_dram_offset =
-            deposit64(bus->dma_dram_offset, 0, 32,
-                      FIELD_EX32(value, I2CM_DMA_RX_ADDR, ADDR));
         break;
     case A_I2CM_DMA_LEN:
         w1t = FIELD_EX32(value, I2CM_DMA_LEN, RX_BUF_LEN_W1T) ||
@@ -748,15 +801,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         qemu_log_mask(LOG_UNIMP, "%s: Slave mode DMA TX is not implemented\n",
                       __func__);
         break;
-
-    /*
-     * The AST2700 support the maximum DRAM size is 8 GB.
-     * The DRAM offset range is from 0x0_0000_0000 to
-     * 0x1_FFFF_FFFF and it is enough to use bits [33:0]
-     * saving the dram offset.
-     * Therefore, save the high part physical address bit[1:0]
-     * of Tx/Rx buffer address as dma_dram_offset bit[33:32].
-     */
     case A_I2CM_DMA_TX_ADDR_HI:
         if (!aic->has_dma64) {
             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA 64 bits support\n",
@@ -766,8 +810,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         bus->regs[R_I2CM_DMA_TX_ADDR_HI] = FIELD_EX32(value,
                                                       I2CM_DMA_TX_ADDR_HI,
                                                       ADDR_HI);
-        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
-                                         extract32(value, 0, 2));
         break;
     case A_I2CM_DMA_RX_ADDR_HI:
         if (!aic->has_dma64) {
@@ -778,8 +820,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         bus->regs[R_I2CM_DMA_RX_ADDR_HI] = FIELD_EX32(value,
                                                       I2CM_DMA_RX_ADDR_HI,
                                                       ADDR_HI);
-        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
-                                         extract32(value, 0, 2));
         break;
     case A_I2CS_DMA_TX_ADDR_HI:
         qemu_log_mask(LOG_UNIMP,
@@ -795,8 +835,6 @@ static void aspeed_i2c_bus_new_write(AspeedI2CBus *bus, hwaddr offset,
         bus->regs[R_I2CS_DMA_RX_ADDR_HI] = FIELD_EX32(value,
                                                       I2CS_DMA_RX_ADDR_HI,
                                                       ADDR_HI);
-        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 32, 32,
-                                         extract32(value, 0, 2));
         break;
     default:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset 0x%" HWADDR_PRIx "\n",
@@ -887,9 +925,6 @@ static void aspeed_i2c_bus_old_write(AspeedI2CBus *bus, hwaddr offset,
             qemu_log_mask(LOG_GUEST_ERROR, "%s: No DMA support\n",  __func__);
             break;
         }
-
-        bus->dma_dram_offset = deposit64(bus->dma_dram_offset, 0, 32,
-                                         value & 0x3ffffffc);
         break;
 
     case A_I2CD_DMA_LEN:

From ad2c2ef5e57f8c67e935c406801693a9bbc2e629 Mon Sep 17 00:00:00 2001
From: Wafer Xie <wafer@jaguarmicro.com>
Date: Wed, 19 Nov 2025 21:24:52 +0800
Subject: [PATCH 2381/2396] vdpa: fix vhost-vdpa suspended state not be shared
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

When stopping a vhost-vdpa device, only the first queue pair is marked as suspended,
while the remaining queues are not updated to the suspended state.
As a result, when stopping a multi-queue vhost-vdpa device,
the following error message will be printed.

qemu-system-x86_64:vhost VQ 2 ring restore failed: -1: Operation not permitted (1)

qemu-system-x86_64:vhost VQ 3 ring restore failed: -1: Operation not permitted (1)

So move v->suspended to v->shared, and then all the vhost_vdpa devices cannot
have different suspended states.

Fixes: 0bb302a9960a ("vdpa: add vhost_vdpa_suspend")
Suggested-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Eugenio Pérez <eperezma@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Wafer Xie <wafer@jaguarmicro.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Message-Id: <20251119132452.3117-1-wafer@jaguarmicro.com>
(cherry picked from commit fd3a2c601ab4a1bdb669e4c584b364e00a978702)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/virtio/vhost-vdpa.c         | 6 +++---
 include/hw/virtio/vhost-vdpa.h | 8 ++++++--
 2 files changed, 9 insertions(+), 5 deletions(-)

diff --git a/hw/virtio/vhost-vdpa.c b/hw/virtio/vhost-vdpa.c
index 7061b6e1a3..2f8f11df86 100644
--- a/hw/virtio/vhost-vdpa.c
+++ b/hw/virtio/vhost-vdpa.c
@@ -905,7 +905,7 @@ static int vhost_vdpa_reset_device(struct vhost_dev *dev)
 
     memory_listener_unregister(&v->shared->listener);
     v->shared->listener_registered = false;
-    v->suspended = false;
+    v->shared->suspended = false;
     return 0;
 }
 
@@ -1354,7 +1354,7 @@ static void vhost_vdpa_suspend(struct vhost_dev *dev)
         if (unlikely(r)) {
             error_report("Cannot suspend: %s(%d)", g_strerror(errno), errno);
         } else {
-            v->suspended = true;
+            v->shared->suspended = true;
             return;
         }
     }
@@ -1481,7 +1481,7 @@ static int vhost_vdpa_get_vring_base(struct vhost_dev *dev,
         return 0;
     }
 
-    if (!v->suspended) {
+    if (!v->shared->suspended) {
         /*
          * Cannot trust in value returned by device, let vhost recover used
          * idx from guest.
diff --git a/include/hw/virtio/vhost-vdpa.h b/include/hw/virtio/vhost-vdpa.h
index 449bf5c840..80ff670e23 100644
--- a/include/hw/virtio/vhost-vdpa.h
+++ b/include/hw/virtio/vhost-vdpa.h
@@ -76,6 +76,12 @@ typedef struct vhost_vdpa_shared {
 
     /* SVQ switching is in progress, or already completed? */
     SVQTransitionState svq_switching;
+
+    /*
+     * Device suspended successfully.
+     * The vhost_vdpa devices cannot have different suspended states.
+     */
+    bool suspended;
 } VhostVDPAShared;
 
 typedef struct vhost_vdpa {
@@ -83,8 +89,6 @@ typedef struct vhost_vdpa {
     uint32_t address_space_id;
     uint64_t acked_features;
     bool shadow_vqs_enabled;
-    /* Device suspended successfully */
-    bool suspended;
     VhostVDPAShared *shared;
     GPtrArray *shadow_vqs;
     const VhostShadowVirtqueueOps *shadow_vq_ops;

From ab67c542a987c2a493700edadc495817bc6b7261 Mon Sep 17 00:00:00 2001
From: Dorinda Bassey <dbassey@redhat.com>
Date: Thu, 4 Dec 2025 17:20:13 +0100
Subject: [PATCH 2382/2396] virtio-dmabuf: Ensure UUID persistence for hash
 table insertion
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

In `virtio_add_resource` function, the UUID used as a key for
`g_hash_table_insert` was temporary, which could lead to
invalid lookups when accessed later. This patch ensures that
the UUID remains valid by duplicating it into a newly allocated
memory space. The value is then inserted into the hash table
with this persistent UUID key to ensure that the key stored in
the hash table remains valid as long as the hash table entry
exists.

Fixes: faefdba847 ("hw/display: introduce virtio-dmabuf")
Signed-off-by: Dorinda Bassey <dbassey@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Albert Esteve <aesteve@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Jim MacArthur <jim.macarthur@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251204162129.262745-1-dbassey@redhat.com>
(cherry picked from commit fff77cfb8413190c6362b95203ef0973c83b50d2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/virtio-dmabuf.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/display/virtio-dmabuf.c b/hw/display/virtio-dmabuf.c
index 3dba4577ca..5e0395be77 100644
--- a/hw/display/virtio-dmabuf.c
+++ b/hw/display/virtio-dmabuf.c
@@ -35,11 +35,13 @@ static bool virtio_add_resource(QemuUUID *uuid, VirtioSharedObject *value)
     if (resource_uuids == NULL) {
         resource_uuids = g_hash_table_new_full(qemu_uuid_hash,
                                                uuid_equal_func,
-                                               NULL,
+                                               g_free,
                                                g_free);
     }
     if (g_hash_table_lookup(resource_uuids, uuid) == NULL) {
-        g_hash_table_insert(resource_uuids, uuid, value);
+        g_hash_table_insert(resource_uuids,
+                            g_memdup2(uuid, sizeof(*uuid)),
+                            value);
     } else {
         result = false;
     }

From a440980876e0d311811030f77319437f8975a031 Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Thu, 4 Dec 2025 18:26:57 +0100
Subject: [PATCH 2383/2396] virtio: Fix crash when sriov-pf is set for
 non-PCI-Express device

Setting the sriov-pf property on devices that aren't PCI Express causes
an assertion failure:

    $ qemu-system-x86_64 \
        -blockdev null-co,node-name=null \
        -blockdev null-co,node-name=null2 \
        -device virtio-blk,drive=null,id=pf \
        -device virtio-blk,sriov-pf=pf,drive=null2
    qemu-system-x86_64: ../hw/pci/pcie.c:1062: void pcie_add_capability(PCIDevice *, uint16_t, uint8_t, uint16_t, uint16_t): Assertion `offset >= PCI_CONFIG_SPACE_SIZE' failed.

This is because proxy->last_pcie_cap_offset is only initialised to a
non-zero value in virtio_pci_realize() if it's a PCI Express device, and
then virtio_pci_device_plugged() still tries to use it.

To fix this, just skip the SR-IOV code for !pci_is_express(). Then the
next thing pci_qdev_realize() does is call pcie_sriov_register_device(),
which returns the appropriate error.

Cc: qemu-stable@nongnu.org
Fixes: d0c280d3fac6 ('pcie_sriov: Make a PCI device with user-created VF ARI-capable')
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251204172657.174391-1-kwolf@redhat.com>
(cherry picked from commit 623db856476806124e9ae45fbc39e75012261570)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/virtio/virtio-pci.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/virtio/virtio-pci.c b/hw/virtio/virtio-pci.c
index 99cb30fe59..c9a162728c 100644
--- a/hw/virtio/virtio-pci.c
+++ b/hw/virtio/virtio-pci.c
@@ -2183,15 +2183,17 @@ static void virtio_pci_device_plugged(DeviceState *d, Error **errp)
                          PCI_BASE_ADDRESS_SPACE_IO, &proxy->bar);
     }
 
-    if (pci_is_vf(&proxy->pci_dev)) {
-        pcie_ari_init(&proxy->pci_dev, proxy->last_pcie_cap_offset);
-        proxy->last_pcie_cap_offset += PCI_ARI_SIZEOF;
-    } else {
-        res = pcie_sriov_pf_init_from_user_created_vfs(
-            &proxy->pci_dev, proxy->last_pcie_cap_offset, errp);
-        if (res > 0) {
-            proxy->last_pcie_cap_offset += res;
-            virtio_add_feature(&vdev->host_features, VIRTIO_F_SR_IOV);
+    if (pci_is_express(&proxy->pci_dev)) {
+        if (pci_is_vf(&proxy->pci_dev)) {
+            pcie_ari_init(&proxy->pci_dev, proxy->last_pcie_cap_offset);
+            proxy->last_pcie_cap_offset += PCI_ARI_SIZEOF;
+        } else {
+            res = pcie_sriov_pf_init_from_user_created_vfs(
+                &proxy->pci_dev, proxy->last_pcie_cap_offset, errp);
+            if (res > 0) {
+                proxy->last_pcie_cap_offset += res;
+                virtio_add_feature(&vdev->host_features, VIRTIO_F_SR_IOV);
+            }
         }
     }
 }

From 8c65f73b315698bdf19b11b8c796f81690105b6d Mon Sep 17 00:00:00 2001
From: Kevin Wolf <kwolf@redhat.com>
Date: Fri, 5 Dec 2025 15:57:18 +0100
Subject: [PATCH 2384/2396] pcie_sriov: Fix PCI_SRIOV_* accesses in
 pcie_sriov_pf_exit()

PCI_SRIOV_* are offsets into the SR-IOV capability, not into the PCI
config space. pcie_sriov_pf_exit() erroneously takes them as the latter,
which makes it read PCI_HEADER_TYPE and PCI_BIST when it tries to read
PCI_SRIOV_TOTAL_VF.

In many cases we're lucky enough that the PCI config space will be 0
there, so we just skip the whole for loop, but this isn't guaranteed.
For example, setting the multifunction bit on the PF and then doing a
'device_del' on it will get a larger number and cause a segfault.

Fix this and access the real PCI_SRIOV_* fields in the capability.

Cc: qemu-stable@nongnu.org
Fixes: 19e55471d4e8 ('pcie_sriov: Allow user to create SR-IOV device')
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251205145718.55136-1-kwolf@redhat.com>
(cherry picked from commit f73e5ed9bc4cfacf041323a6b40a85e6b6459b75)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/pci/pcie_sriov.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/hw/pci/pcie_sriov.c b/hw/pci/pcie_sriov.c
index c4f88f0975..d467284cbd 100644
--- a/hw/pci/pcie_sriov.c
+++ b/hw/pci/pcie_sriov.c
@@ -195,14 +195,17 @@ bool pcie_sriov_pf_init(PCIDevice *dev, uint16_t offset,
 
 void pcie_sriov_pf_exit(PCIDevice *dev)
 {
+    uint8_t *cfg;
+
     if (dev->exp.sriov_cap == 0) {
         return;
     }
+    cfg = dev->config + dev->exp.sriov_cap;
 
     if (dev->exp.sriov_pf.vf_user_created) {
         uint16_t ven_id = pci_get_word(dev->config + PCI_VENDOR_ID);
-        uint16_t total_vfs = pci_get_word(dev->config + PCI_SRIOV_TOTAL_VF);
-        uint16_t vf_dev_id = pci_get_word(dev->config + PCI_SRIOV_VF_DID);
+        uint16_t total_vfs = pci_get_word(cfg + PCI_SRIOV_TOTAL_VF);
+        uint16_t vf_dev_id = pci_get_word(cfg + PCI_SRIOV_VF_DID);
 
         unregister_vfs(dev);
 
@@ -213,8 +216,6 @@ void pcie_sriov_pf_exit(PCIDevice *dev)
             pci_config_set_device_id(dev->exp.sriov_pf.vf[i]->config, vf_dev_id);
         }
     } else {
-        uint8_t *cfg = dev->config + dev->exp.sriov_cap;
-
         unparent_vfs(dev, pci_get_word(cfg + PCI_SRIOV_TOTAL_VF));
     }
 }

From 080b623ed4435ce09de9d40ed227f15628cf2d9b Mon Sep 17 00:00:00 2001
From: Igor Mammedov <imammedo@redhat.com>
Date: Thu, 11 Dec 2025 17:54:54 +0100
Subject: [PATCH 2385/2396] q35: Fix migration of SMRAM state

When migrating, dst QEMU by default has SMRAM unlocked,
and since wmask is not migrated, the migrated value of
MCH_HOST_BRIDGE_F_SMBASE in config space fall to prey of

  mch_update_smbase_smram()
    ...
    if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {
        *reg = 0x00;

and is getting cleared and leads to unlocked smram
on dst even if on source it's been locked.

As Andrey has pointed out [1], we should derive wmask
from config and not other way around.

Drop offending chunk and resync wmask based on MCH_HOST_BRIDGE_F_SMBASE
register value. That would preserve the register during
migration and set smram regions into corresponding state.

What that changes is:
that it would let guest write junk values in register
(with no apparent effect) until it's stumbles upon
reserved 0x1 [|] 0x2 values, at which point it
would be only possible to lock register and trigger
switch to SMRAM blackhole in CPU AS.

While at it, fix up test by removing junk discard before negotiation hunk.

PS2:
Instead of adding a dedicated post_load handler for it,
reuse mch_update->mch_update_smbase_smram call chain
that is called on write/reset/post_load to be consistent
with how we handle mch registers.

PS3:
for prosterity here is erro message Andrey got due to this bug:
    qemu: vfio_container_dma_map(0x..., 0x0, 0xa0000, 0x....) = -22 (Invalid argument)
    qemu: hardware error: vfio: DMA mapping failed, unable to continue

1) https://patchew.org/QEMU/20251203180851.6390-1-arbn@yandex-team.com/

Fixes: f404220e279c ("q35: implement 128K SMRAM at default SMBASE address")
Reported-by: Andrey Ryabinin <arbn@yandex-team.com>
Signed-off-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Andrey Ryabinin <arbn@yandex-team.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251211165454.288476-1-imammedo@redhat.com>
(cherry picked from commit 66cf169e29b06dca104c5a229fba0da4ce33599c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/pci-host/q35.c      | 27 ++++++++++++---------------
 tests/qtest/q35-test.c |  6 ------
 2 files changed, 12 insertions(+), 21 deletions(-)

diff --git a/hw/pci-host/q35.c b/hw/pci-host/q35.c
index a708758d36..946342ba58 100644
--- a/hw/pci-host/q35.c
+++ b/hw/pci-host/q35.c
@@ -432,30 +432,27 @@ static void mch_update_smbase_smram(MCHPCIState *mch)
     }
 
     if (*reg == MCH_HOST_BRIDGE_F_SMBASE_QUERY) {
-        pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] =
-            MCH_HOST_BRIDGE_F_SMBASE_LCK;
+        pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK;
         *reg = MCH_HOST_BRIDGE_F_SMBASE_IN_RAM;
         return;
     }
 
     /*
-     * default/reset state, discard written value
-     * which will disable SMRAM balackhole at SMBASE
+     * reg value can come from register write/reset/migration source,
+     * update wmask to be in sync with it regardless of source
      */
-    if (pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] == 0xff) {
-        *reg = 0x00;
+    if (*reg == MCH_HOST_BRIDGE_F_SMBASE_IN_RAM) {
+        pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = MCH_HOST_BRIDGE_F_SMBASE_LCK;
+        return;
+    }
+    if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) {
+        /* lock register at 0x2 and disable all writes */
+        pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] = 0;
+        *reg = MCH_HOST_BRIDGE_F_SMBASE_LCK;
     }
 
+    lck = *reg & MCH_HOST_BRIDGE_F_SMBASE_LCK;
     memory_region_transaction_begin();
-    if (*reg & MCH_HOST_BRIDGE_F_SMBASE_LCK) {
-        /* disable all writes */
-        pd->wmask[MCH_HOST_BRIDGE_F_SMBASE] &=
-            ~MCH_HOST_BRIDGE_F_SMBASE_LCK;
-        *reg = MCH_HOST_BRIDGE_F_SMBASE_LCK;
-        lck = true;
-    } else {
-        lck = false;
-    }
     memory_region_set_enabled(&mch->smbase_blackhole, lck);
     memory_region_set_enabled(&mch->smbase_window, lck);
     memory_region_transaction_commit();
diff --git a/tests/qtest/q35-test.c b/tests/qtest/q35-test.c
index 62fff49fc8..4e3a4457f6 100644
--- a/tests/qtest/q35-test.c
+++ b/tests/qtest/q35-test.c
@@ -206,12 +206,6 @@ static void test_smram_smbase_lock(void)
     qtest_writeb(qts, SMBASE, SMRAM_TEST_PATTERN);
     g_assert_cmpint(qtest_readb(qts, SMBASE), ==, SMRAM_TEST_PATTERN);
 
-    /* check that writing junk to 0x9c before before negotiating is ignored */
-    for (i = 0; i < 0xff; i++) {
-        qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, i);
-        g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0);
-    }
-
     /* enable SMRAM at SMBASE */
     qpci_config_writeb(pcidev, MCH_HOST_BRIDGE_F_SMBASE, 0xff);
     g_assert(qpci_config_readb(pcidev, MCH_HOST_BRIDGE_F_SMBASE) == 0x01);

From 2ac11c1d9370423ccdc527f9159ddd2ba4a2ea77 Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@tensorfer.com>
Date: Sun, 21 Dec 2025 10:43:20 +0800
Subject: [PATCH 2386/2396] hw/virtio/virtio-crypto: verify asym request size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The total lenght of request is limited by cryptodev config, verify it
to avoid unexpected request from guest.

Fixes: CVE-2025-14876
Fixes: 0e660a6f90a ("crypto: Introduce RSA algorithm")
Reported-by: 이재영 <nakamurajames123@gmail.com>
Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251221024321.143196-2-zhenwei.pi@linux.dev>
(cherry picked from commit 91c6438caffc880e999a7312825479685d659b44)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/virtio/virtio-crypto.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/virtio/virtio-crypto.c b/hw/virtio/virtio-crypto.c
index 517f2089c5..b20f299937 100644
--- a/hw/virtio/virtio-crypto.c
+++ b/hw/virtio/virtio-crypto.c
@@ -767,11 +767,18 @@ virtio_crypto_handle_asym_req(VirtIOCrypto *vcrypto,
     uint32_t len;
     uint8_t *src = NULL;
     uint8_t *dst = NULL;
+    uint64_t max_len;
 
     asym_op_info = g_new0(CryptoDevBackendAsymOpInfo, 1);
     src_len = ldl_le_p(&req->para.src_data_len);
     dst_len = ldl_le_p(&req->para.dst_data_len);
 
+    max_len = (uint64_t)src_len + dst_len;
+    if (unlikely(max_len > vcrypto->conf.max_size)) {
+        virtio_error(vdev, "virtio-crypto asym request is too large");
+        goto err;
+    }
+
     if (src_len > 0) {
         src = g_malloc0(src_len);
         len = iov_to_buf(iov, out_num, 0, src, src_len);

From 51514aa3c2f1e072c9728c975865e0b247b2619b Mon Sep 17 00:00:00 2001
From: zhenwei pi <pizhenwei@tensorfer.com>
Date: Sun, 21 Dec 2025 10:43:21 +0800
Subject: [PATCH 2387/2396] cryptodev-builtin: Limit the maximum size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This backend driver is used for demonstration purposes only, unlimited
size leads QEMU OOM.

Fixes: CVE-2025-14876
Fixes: 1653a5f3fc7 ("cryptodev: introduce a new cryptodev backend")
Reported-by: 이재영 <nakamurajames123@gmail.com>
Signed-off-by: zhenwei pi <zhenwei.pi@linux.dev>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20251221024321.143196-3-zhenwei.pi@linux.dev>
(cherry picked from commit 7b913094c703641a0442bb1d1165323a019c591c)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 backends/cryptodev-builtin.c | 9 +++------
 1 file changed, 3 insertions(+), 6 deletions(-)

diff --git a/backends/cryptodev-builtin.c b/backends/cryptodev-builtin.c
index 0414c01e06..55a3fbd27b 100644
--- a/backends/cryptodev-builtin.c
+++ b/backends/cryptodev-builtin.c
@@ -53,6 +53,8 @@ typedef struct CryptoDevBackendBuiltinSession {
 
 #define CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN    512
 #define CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN  64
+/* demonstration purposes only, use a limited size to avoid QEMU OOM */
+#define CRYPTODEV_BUITLIN_MAX_REQUEST_SIZE  (1024 * 1024)
 
 struct CryptoDevBackendBuiltin {
     CryptoDevBackend parent_obj;
@@ -98,12 +100,7 @@ static void cryptodev_builtin_init(
                          1u << QCRYPTODEV_BACKEND_SERVICE_TYPE_MAC;
     backend->conf.cipher_algo_l = 1u << VIRTIO_CRYPTO_CIPHER_AES_CBC;
     backend->conf.hash_algo = 1u << VIRTIO_CRYPTO_HASH_SHA1;
-    /*
-     * Set the Maximum length of crypto request.
-     * Why this value? Just avoid to overflow when
-     * memory allocation for each crypto request.
-     */
-    backend->conf.max_size = LONG_MAX - sizeof(CryptoDevBackendOpInfo);
+    backend->conf.max_size = CRYPTODEV_BUITLIN_MAX_REQUEST_SIZE;
     backend->conf.max_cipher_key_len = CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN;
     backend->conf.max_auth_key_len = CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN;
     cryptodev_builtin_init_akcipher(backend);

From be88ad424c0bbdab8746d4c99ebc7e15fbab1533 Mon Sep 17 00:00:00 2001
From: Joelle van Dyne <j@getutm.app>
Date: Sat, 3 Jan 2026 13:43:59 -0800
Subject: [PATCH 2388/2396] virtio-gpu-virgl: correct parent for blob memory
 region

When `owner` == `mr`, `object_unparent` will crash:

object_unparent(mr) ->
object_property_del_child(mr, mr) ->
object_finalize_child_property(mr, name, mr) ->
object_unref(mr) ->
object_finalize(mr) ->
object_property_del_all(mr) ->
object_finalize_child_property(mr, name, mr) ->
object_unref(mr) ->
fail on g_assert(obj->ref > 0)

However, passing a different `owner` to `memory_region_init` does not
work. `memory_region_ref` has an optimization where it takes a ref
only on the owner. That means when flatviews are created, it does not
take a ref on the region and you can get a UAF from `flatview_destroy`
called from RCU.

The correct fix therefore is to use `NULL` as the name which will set
the `owner` but not the `parent` (which is still NULL). This allows us
to use `memory_region_ref` on itself while not having to rely on unparent
for cleanup.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260103214400.71694-1-j@getutm.app>
(cherry picked from commit e27194e087aede62dbe3d2805c6f1aa30d3465df)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/virtio-gpu-virgl.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 07f6355ad6..6a83fb63c8 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -120,7 +120,7 @@ virtio_gpu_virgl_map_resource_blob(VirtIOGPU *g,
     vmr->g = g;
 
     mr = &vmr->mr;
-    memory_region_init_ram_ptr(mr, OBJECT(mr), "blob", size, data);
+    memory_region_init_ram_ptr(mr, OBJECT(mr), NULL, size, data);
     memory_region_add_subregion(&b->hostmem, offset, mr);
     memory_region_set_enabled(mr, true);
 
@@ -186,7 +186,7 @@ virtio_gpu_virgl_unmap_resource_blob(VirtIOGPU *g,
         /* memory region owns self res->mr object and frees it by itself */
         memory_region_set_enabled(mr, false);
         memory_region_del_subregion(&b->hostmem, mr);
-        object_unparent(OBJECT(mr));
+        object_unref(OBJECT(mr));
     }
 
     return 0;

From cfc706b38e2276afa9ee10645f849b3f43cc4997 Mon Sep 17 00:00:00 2001
From: Li Chen <chenl311@chinatelecom.cn>
Date: Tue, 6 Jan 2026 16:38:59 +0800
Subject: [PATCH 2389/2396] virtio-pmem: ignore empty queue notifications

virtio_pmem_flush() treats a NULL return from virtqueue_pop() as a fatal
error and calls virtio_error(), which puts the device into NEEDS_RESET.

However, virtqueue handlers can be invoked when no element is available,
so an empty queue should be handled as a benign no-op.

With a Linux guest this avoids spurious NEEDS_RESET and the resulting
-EIO propagation (e.g. EXT4 journal abort and remount-ro).

Signed-off-by: Li Chen <me@linux.beauty>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260106083859.380338-1-me@linux.beauty>
(cherry picked from commit efd581a8cd4405ca183ecd017072b0c878802d69)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/virtio/virtio-pmem.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/hw/virtio/virtio-pmem.c b/hw/virtio/virtio-pmem.c
index 3416ea1827..cec1072f78 100644
--- a/hw/virtio/virtio-pmem.c
+++ b/hw/virtio/virtio-pmem.c
@@ -74,7 +74,6 @@ static void virtio_pmem_flush(VirtIODevice *vdev, VirtQueue *vq)
     trace_virtio_pmem_flush_request();
     req_data = virtqueue_pop(vq, sizeof(VirtIODeviceRequest));
     if (!req_data) {
-        virtio_error(vdev, "virtio-pmem missing request data");
         return;
     }
 

From e5628119e117b0dd6b14e6c398b219c5113a0970 Mon Sep 17 00:00:00 2001
From: Honglei Huang <honghuan@amd.com>
Date: Tue, 13 Jan 2026 09:52:02 +0800
Subject: [PATCH 2390/2396] virtio-gpu: fix error handling in
 virgl_cmd_resource_create_blob
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fix inverted error check in virgl_cmd_resource_create_blob() that causes
the function to return error when virtio_gpu_create_mapping_iov() succeeds.

virtio_gpu_create_mapping_iov() returns 0 on success and negative values
on error. The check 'if (!ret)' incorrectly treats success (ret=0) as an
error condition, causing the function to fail when it should succeed.

Change the condition to 'if (ret != 0)' to properly detect errors.

Fixes: 7c092f17ccee ("virtio-gpu: Handle resource blob commands")
Signed-off-by: Honglei Huang <honghuan@amd.com>
Reviewed-by: Akihiko Odaki <odaki@rsg.ci.i.u-tokyo.ac.jp>
Reviewed-by: Dmitry Osipenko <dmitry.osipenko@collabora.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260113015203.3643608-2-honghuan@amd.com>
(cherry picked from commit 3560b51979577afc3ab937fd8b02597515bdfbae)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/display/virtio-gpu-virgl.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/display/virtio-gpu-virgl.c b/hw/display/virtio-gpu-virgl.c
index 6a83fb63c8..741728cabb 100644
--- a/hw/display/virtio-gpu-virgl.c
+++ b/hw/display/virtio-gpu-virgl.c
@@ -705,7 +705,7 @@ static void virgl_cmd_resource_create_blob(VirtIOGPU *g,
         ret = virtio_gpu_create_mapping_iov(g, cblob.nr_entries, sizeof(cblob),
                                             cmd, &res->base.addrs,
                                             &res->base.iov, &res->base.iov_cnt);
-        if (!ret) {
+        if (ret != 0) {
             cmd->error = VIRTIO_GPU_RESP_ERR_UNSPEC;
             return;
         }

From fd0abbb38661a25af64649f9bf1f0f834943e203 Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Fri, 2 Jan 2026 15:47:30 +0000
Subject: [PATCH 2391/2396] hw/cxl: Check for overflow on santize media as both
 base and offset 64bit.

The both the size and base of a media sanitize operation are both provided
by the VM, an overflow is possible which may result in checks on valid
range passing when they should not.  Close that by checking for overflow
on the addition.

Fixes: 40ab4ed10775 ("hw/cxl/cxl-mailbox-utils: Media operations Sanitize and Write Zeros commands CXL r3.2(8.2.10.9.5.3)")
Closes: https://lore.kernel.org/qemu-devel/CAFEAcA8Rqop+ju0fuxN+0T57NBG+bep80z45f6pY0ci2fz_G3A@mail.gmail.com/
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260102154731.474859-2-Jonathan.Cameron@huawei.com>
(cherry picked from commit 87f8e5a71d061964c9bfa4d6e02db47f54dd61f7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/cxl/cxl-mailbox-utils.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index 6cfdd98168..cf1d048d99 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -1875,7 +1875,7 @@ static uint64_t get_dc_size(CXLType3Dev *ct3d, MemoryRegion **dc_mr)
 static int validate_dpa_addr(CXLType3Dev *ct3d, uint64_t dpa_addr,
                              size_t length)
 {
-    uint64_t vmr_size, pmr_size, dc_size;
+    uint64_t vmr_size, pmr_size, dc_size, dpa_end;
 
     if ((dpa_addr % CXL_CACHE_LINE_SIZE) ||
         (length % CXL_CACHE_LINE_SIZE)  ||
@@ -1887,7 +1887,12 @@ static int validate_dpa_addr(CXLType3Dev *ct3d, uint64_t dpa_addr,
     pmr_size = get_pmr_size(ct3d, NULL);
     dc_size = get_dc_size(ct3d, NULL);
 
-    if (dpa_addr + length > vmr_size + pmr_size + dc_size) {
+    /* sanitize 64 bit values coming from guest */
+    if (uadd64_overflow(dpa_addr, length, &dpa_end)) {
+        return -EINVAL;
+    }
+
+    if (dpa_end > vmr_size + pmr_size + dc_size) {
         return -EINVAL;
     }
 

From ba31a6fca7b03fce47228423b4dc951e04efd96c Mon Sep 17 00:00:00 2001
From: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Date: Fri, 2 Jan 2026 15:47:31 +0000
Subject: [PATCH 2392/2396] hw/cxl: Take into account how many media operations
 are requested for param check

Whilst the spec doesn't speak to it directly my assumption is that
a request for more operations than exist should result in an invalid
input error return.

Fixes: 77a8e9fe0ecb ("hw/cxl/cxl-mailbox-utils: Add support for Media operations discovery commands cxl r3.2 (8.2.10.9.5.3)")
Closes: https://lore.kernel.org/qemu-devel/CAFEAcA-p5wZkNxK7wNVq_3PAzEE-muOd1Def-0O-FSpck4DrBQ@mail.gmail.com/
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jonathan Cameron <Jonathan.Cameron@huawei.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Message-Id: <20260102154731.474859-3-Jonathan.Cameron@huawei.com>
(cherry picked from commit 25465c0e1fd74d2118dfec03912f2595eeb497d7)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 hw/cxl/cxl-mailbox-utils.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/cxl/cxl-mailbox-utils.c b/hw/cxl/cxl-mailbox-utils.c
index cf1d048d99..9b99d44a80 100644
--- a/hw/cxl/cxl-mailbox-utils.c
+++ b/hw/cxl/cxl-mailbox-utils.c
@@ -2011,7 +2011,7 @@ static CXLRetCode media_operations_discovery(uint8_t *payload_in,
      * sub class command.
      */
     if (media_op_in_disc_pl->dpa_range_count ||
-        start_index > ARRAY_SIZE(media_op_matrix)) {
+        start_index + num_ops > ARRAY_SIZE(media_op_matrix)) {
         return CXL_MBOX_INVALID_INPUT;
     }
 

From 1af52156676065b1fc2d4815bf23b1c4c99938b3 Mon Sep 17 00:00:00 2001
From: Aleksandr Sergeev <sergeev0xef@gmail.com>
Date: Mon, 26 Jan 2026 18:16:12 +0300
Subject: [PATCH 2393/2396] linux-user/syscall.c: Prevent acquiring clone_lock
 while fork()

By the spec, fork() copies only the thread which executes it.
So it may happen, what while one thread is doing a fork,
another thread is holding `clone_lock` mutex
(e.g. doing a `fork()` or `exit()`).
So the child process is born with the mutex being held,
and there are nobody to release it.

As the thread executing do_syscall() is not considered running,
start_exclusive() does not protect us from the case.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/3226
Signed-off-by: Aleksandr Sergeev <sergeev0xef@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260126151612.2176451-1-sergeev0xef@gmail.com>
(cherry picked from commit d22e9aec572396836782e993cb18d598e6012688)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 linux-user/main.c           |  2 ++
 linux-user/syscall.c        | 14 ++++++++++++++
 linux-user/user-internals.h |  2 ++
 3 files changed, 18 insertions(+)

diff --git a/linux-user/main.c b/linux-user/main.c
index db751c0757..c49d1e91d2 100644
--- a/linux-user/main.c
+++ b/linux-user/main.c
@@ -145,6 +145,7 @@ unsigned long guest_stack_size = TARGET_DEFAULT_STACK_SIZE;
 void fork_start(void)
 {
     start_exclusive();
+    clone_fork_start();
     mmap_fork_start();
     cpu_list_lock();
     qemu_plugin_user_prefork_lock();
@@ -174,6 +175,7 @@ void fork_end(pid_t pid)
         cpu_list_unlock();
     }
     gdbserver_fork_end(thread_cpu, pid);
+    clone_fork_end(child);
     /*
      * qemu_init_cpu_list() reinitialized the child exclusive state, but we
      * also need to keep current_cpu consistent, so call end_exclusive() for
diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index fbacbaea3a..7404af9194 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -6853,6 +6853,20 @@ static void *clone_func(void *arg)
     return NULL;
 }
 
+void clone_fork_start(void)
+{
+    pthread_mutex_lock(&clone_lock);
+}
+
+void clone_fork_end(bool child)
+{
+    if (child) {
+        pthread_mutex_init(&clone_lock, NULL);
+    } else {
+        pthread_mutex_unlock(&clone_lock);
+    }
+}
+
 /* do_fork() Must return host values and target errnos (unlike most
    do_*() functions). */
 static int do_fork(CPUArchState *env, unsigned int flags, abi_ulong newsp,
diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index 067c02bb93..24d35998f0 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -69,6 +69,8 @@ abi_long get_errno(abi_long ret);
 const char *target_strerror(int err);
 int get_osversion(void);
 void init_qemu_uname_release(void);
+void clone_fork_start(void);
+void clone_fork_end(bool child);
 void fork_start(void);
 void fork_end(pid_t pid);
 

From b5ce6809b4b47e6cd414c9ce9449b114cd5c657f Mon Sep 17 00:00:00 2001
From: Paolo Bonzini <pbonzini@redhat.com>
Date: Mon, 2 Feb 2026 10:17:53 +0100
Subject: [PATCH 2394/2396] Revert "tcg/user: do not set exit_request
 gratuitously"

This reverts commit b422a7bff64eaf55b8250225533ca1df42c3777e.

The reporter says "The commit breaks go; if you run go build in a loop,
it eventually hangs uninterruptible (except -9) with a couple of zombie
children left over".

Reported-by: Andreas Schwab <schwab@suse.de>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-ID: <20260202091753.28459-1-pbonzini@redhat.com>
(cherry picked from commit 251a3d4ca3c961d95cd624252a178a33066455a2)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 accel/tcg/cpu-exec.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index 7c20d9db12..ad94f96b25 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -751,7 +751,6 @@ static inline bool cpu_handle_exception(CPUState *cpu, int *ret)
 
 void tcg_kick_vcpu_thread(CPUState *cpu)
 {
-#ifndef CONFIG_USER_ONLY
     /*
      * Ensure cpu_exec will see the reason why the exit request was set.
      * FIXME: this is not always needed.  Other accelerators instead
@@ -759,7 +758,6 @@ void tcg_kick_vcpu_thread(CPUState *cpu)
      * CPU thread; see kvm_arch_pre_run() for example.
      */
     qatomic_store_release(&cpu->exit_request, true);
-#endif
 
     /* Ensure cpu_exec will see the exit request after TCG has exited.  */
     qatomic_store_release(&cpu->neg.icount_decr.u16.high, -1);

From 63a76e01238c8a3cc2c02f6a12ec53c2ab844a7a Mon Sep 17 00:00:00 2001
From: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Date: Thu, 4 Dec 2025 12:50:17 +0200
Subject: [PATCH 2395/2396] scripts/qemugdb: timers: Fix KeyError in 'qemu
 timers' command

Currently invoking 'qemu timers' command results into: "gdb.error: There
is no member named last".  Let's remove the legacy 'last' field from
QEMUClock, as it was removed in v4.2.0 by the commit 3c2d4c8aa6a
("timer: last, remove last bits of last").

Signed-off-by: Andrey Drobyshev <andrey.drobyshev@virtuozzo.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20251204105019.455060-3-andrey.drobyshev@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
(cherry picked from commit 80c97930a93c32e2e666f5420af2d5734021a135)
Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 scripts/qemugdb/timers.py | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/scripts/qemugdb/timers.py b/scripts/qemugdb/timers.py
index 5714f92cc2..1219a96b32 100644
--- a/scripts/qemugdb/timers.py
+++ b/scripts/qemugdb/timers.py
@@ -36,10 +36,9 @@ class TimersCommand(gdb.Command):
 
     def process_timerlist(self, tlist, ttype):
         gdb.write("Processing %s timers\n" % (ttype))
-        gdb.write("  clock %s is enabled:%s, last:%s\n" % (
+        gdb.write("  clock %s is enabled:%s\n" % (
             tlist['clock']['type'],
-            tlist['clock']['enabled'],
-            tlist['clock']['last']))
+            tlist['clock']['enabled']))
         if int(tlist['active_timers']) > 0:
             self.dump_timers(tlist['active_timers'])
 

From 2d3df8abca265c9bcc9e438d691d561592060998 Mon Sep 17 00:00:00 2001
From: Michael Tokarev <mjt@tls.msk.ru>
Date: Thu, 12 Feb 2026 15:15:05 +0300
Subject: [PATCH 2396/2396] Update version for 10.2.1 release

Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
---
 VERSION | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/VERSION b/VERSION
index 2bd6f7e392..26ee5b054e 100644
--- a/VERSION
+++ b/VERSION
@@ -1 +1 @@
-10.2.0
+10.2.1